From 13af44768b39b622f12870e316293a55d97b06ce Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Sat, 7 Jun 2003 01:28:47 +0000 Subject: mark the HEAD branch as deprecated. Nothing that a determined programmer can't work around, but hopefully enough that people will notice that they should be using the 3.0 branch at the moment (This used to be commit d6de8e8a94c8fb7d7837ed2b43092a275cc9d6c5) --- source3/Makefile.in | 7 ++++++- source3/autogen.sh | 6 ++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/source3/Makefile.in b/source3/Makefile.in index 5fa3018c69..77af73f5b8 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -626,7 +626,12 @@ NTLM_AUTH_OBJ = utils/ntlm_auth.o $(LIBNTLMSSP_OBJ) $(LIBSAMBA_OBJ) $(POPT_LIB_O ###################################################################### # now the rules... ###################################################################### -all : SHOWFLAGS proto_exists $(SBIN_PROGS) $(BIN_PROGS) $(SHLIBS) \ +all: + @echo The Samba HEAD branch is deprecated pending the release of Samba 3.0 + @echo Please use the SAMBA_3_0 branch + @exit 1 + +all_real : SHOWFLAGS proto_exists $(SBIN_PROGS) $(BIN_PROGS) $(SHLIBS) \ $(MODULES) @EXTRA_ALL_TARGETS@ pam_smbpass : SHOWFLAGS bin/pam_smbpass.@SHLIBEXT@ diff --git a/source3/autogen.sh b/source3/autogen.sh index 2d91173f4a..056c0e6133 100755 --- a/source3/autogen.sh +++ b/source3/autogen.sh @@ -1,5 +1,11 @@ #!/bin/sh +echo The Samba HEAD branch is deprecated pending the release of Samba 3.0 +echo Please use the SAMBA_3_0 branch +echo to update to SAMBA_3_0 use this command: +echo " cvs -z3 update -r SAMBA_3_0 -dP" +exit 1 + # Run this script to build samba from CVS. ## insert all possible names (only works with -- cgit From 95fe82670032a3a43571b46d7bbf2c26bc8cdcd9 Mon Sep 17 00:00:00 2001 From: Herb Lewis Date: Fri, 11 Jul 2003 14:23:45 +0000 Subject: get rid of CFLAGS from LDSHFLAGS and WINBIND_NSS_LDSHFLAGS and instead define it in SHLD for those systems that use CC for SHLD (This used to be commit 142c54ca924bd854e7d840c2a67692c9f61ee396) --- source3/Makefile.in | 4 ++-- source3/configure.in | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/source3/Makefile.in b/source3/Makefile.in index 77af73f5b8..c81fdd4a83 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -18,8 +18,8 @@ CFLAGS=@CFLAGS@ CPPFLAGS=@CPPFLAGS@ EXEEXT=@EXEEXT@ LDFLAGS=@LDFLAGS@ -LDSHFLAGS=@LDSHFLAGS@ @LDFLAGS@ @CFLAGS@ -WINBIND_NSS_LDSHFLAGS=@WINBIND_NSS_LDSHFLAGS@ @LDFLAGS@ @CFLAGS@ +LDSHFLAGS=@LDSHFLAGS@ @LDFLAGS@ +WINBIND_NSS_LDSHFLAGS=@WINBIND_NSS_LDSHFLAGS@ @LDFLAGS@ AWK=@AWK@ DYNEXP=@DYNEXP@ PYTHON=@PYTHON@ diff --git a/source3/configure.in b/source3/configure.in index 93cbb0a871..533757aab8 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -910,7 +910,7 @@ BLDSHARED="false" HOST_OS="$host_os" LDSHFLAGS="-shared" SONAMEFLAG="#" -SHLD="\${CC}" +SHLD="\${CC} \${CFLAGS}" PICFLAG="" PICSUFFIX="po" POBAD_CC="#" -- cgit From 4a090ba06a54f5da179ac02bb307cc03d08831bf Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 16 Jul 2003 05:34:56 +0000 Subject: trying to get HEAD building again. If you want the code prior to this merge, checkout HEAD_PRE_3_0_0_BETA_3_MERGE (This used to be commit adb98e7b7cd0f025b52c570e4034eebf4047b1ad) --- README | 4 +- Roadmap | 42 +- WHATSNEW.txt | 1067 +- docs/Samba-Developers-Guide.pdf | 13657 ++--- docs/Samba-HOWTO-Collection.pdf | 55386 +++++++++++++------ docs/docbook/.cvsignore | 2 +- docs/docbook/Makefile.in | 122 +- docs/docbook/configure | 2401 +- docs/docbook/configure.in | 6 + docs/docbook/devdoc/contributing.xml | 3 + docs/docbook/devdoc/dev-doc.xml | 32 +- docs/docbook/devdoc/modules.xml | 16 +- docs/docbook/devdoc/rpc_plugin.xml | 7 +- docs/docbook/docbook.txt | 55 +- docs/docbook/faq/errors.xml | 77 +- docs/docbook/faq/features.xml | 60 - docs/docbook/faq/general.xml | 7 - docs/docbook/faq/install.xml | 216 - docs/docbook/faq/sambafaq.xml | 7 +- docs/docbook/global.ent | 14 +- docs/docbook/manpages/.cvsignore | 2 +- docs/docbook/manpages/net.8.xml | 9 - docs/docbook/manpages/pdbedit.8.xml | 85 +- docs/docbook/manpages/rpcclient.1.xml | 2 +- docs/docbook/manpages/samba.7.xml | 17 +- docs/docbook/manpages/smbcontrol.1.xml | 7 + docs/docbook/manpages/smbmount.8.xml | 6 +- docs/docbook/manpages/wbinfo.1.xml | 4 +- docs/docbook/manpages/winbindd.8.xml | 13 +- docs/docbook/projdoc/AccessControls.xml | 436 +- docs/docbook/projdoc/AdvancedNetworkAdmin.xml | 216 +- docs/docbook/projdoc/Bugs.xml | 56 +- docs/docbook/projdoc/CUPS-printing.xml | 6654 ++- docs/docbook/projdoc/Compiling.xml | 211 +- docs/docbook/projdoc/DOMAIN_MEMBER.xml | 383 +- docs/docbook/projdoc/Diagnosis.xml | 66 +- docs/docbook/projdoc/Further-Resources.xml | 99 + docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml | 351 +- docs/docbook/projdoc/Integrating-with-Windows.xml | 205 +- docs/docbook/projdoc/InterdomainTrusts.xml | 121 +- docs/docbook/projdoc/IntroSMB.xml | 46 +- docs/docbook/projdoc/NT4Migration.xml | 141 +- docs/docbook/projdoc/NetworkBrowsing.xml | 400 +- docs/docbook/projdoc/Other-Clients.xml | 116 +- .../projdoc/PAM-Authentication-And-Samba.xml | 893 +- docs/docbook/projdoc/PolicyMgmt.xml | 456 +- docs/docbook/projdoc/Portability.xml | 42 +- docs/docbook/projdoc/Problems.xml | 66 +- docs/docbook/projdoc/ProfileMgmt.xml | 749 +- docs/docbook/projdoc/SWAT.xml | 126 +- docs/docbook/projdoc/Samba-BDC-HOWTO.xml | 70 +- docs/docbook/projdoc/Samba-PDC-HOWTO.xml | 317 +- docs/docbook/projdoc/ServerType.xml | 271 +- docs/docbook/projdoc/Speed.xml | 98 +- docs/docbook/projdoc/StandAloneServer.xml | 53 +- docs/docbook/projdoc/UNIX_INSTALL.xml | 44 +- docs/docbook/projdoc/VFS.xml | 378 +- docs/docbook/projdoc/locking.xml | 79 +- docs/docbook/projdoc/msdfs_setup.xml | 135 +- docs/docbook/projdoc/passdb.xml | 811 +- docs/docbook/projdoc/printer_driver2.xml | 4047 +- docs/docbook/projdoc/samba-doc.xml | 32 +- docs/docbook/projdoc/securing-samba.xml | 467 +- docs/docbook/projdoc/unicode.xml | 48 +- docs/docbook/projdoc/upgrading-to-3.0.xml | 30 +- docs/docbook/projdoc/winbind.xml | 167 +- docs/docbook/smbdotconf/filename/mangledstack.xml | 2 +- docs/docbook/smbdotconf/filename/mangleprefix.xml | 2 +- docs/docbook/smbdotconf/generate-context.xsl | 8 +- docs/docbook/smbdotconf/generate-file-list.sh | 8 +- docs/docbook/smbdotconf/logging/debuglevel.xml | 2 +- docs/docbook/smbdotconf/printing/printcommand.xml | 2 +- .../smbdotconf/protocol/nameresolveorder.xml | 24 +- docs/docbook/smbdotconf/protocol/usespnego.xml | 2 +- docs/docbook/smbdotconf/security/authmethods.xml | 14 +- docs/docbook/smbdotconf/security/lanmanauth.xml | 16 + docs/docbook/smbdotconf/security/ntlmauth.xml | 12 +- docs/docbook/smbdotconf/security/passdbbackend.xml | 51 +- .../docbook/smbdotconf/security/passwordserver.xml | 32 +- .../smbdotconf/security/restrictanonymous.xml | 15 +- docs/docbook/smbdotconf/security/security.xml | 28 +- docs/docbook/smbdotconf/vfs/vfsobject.xml | 12 +- docs/docbook/smbdotconf/winbind/winbindgid.xml | 2 + docs/docbook/smbdotconf/winbind/winbinduid.xml | 11 +- .../smbdotconf/winbind/winbindusedefaultdomain.xml | 2 +- docs/docbook/smbdotconf/wins/winspartners.xml | 2 +- docs/docbook/xslt/db2latex/VERSION.xml | 3 - docs/docbook/xslt/db2latex/abstract.mod.xsl | 3 - docs/docbook/xslt/db2latex/admonition.mod.xsl | 3 - docs/docbook/xslt/db2latex/authorgroup.mod.xsl | 3 - docs/docbook/xslt/db2latex/biblio.mod.xsl | 3 - docs/docbook/xslt/db2latex/block.mod.xsl | 3 - docs/docbook/xslt/db2latex/book-article.mod.xsl | 5 - docs/docbook/xslt/db2latex/bridgehead.mod.xsl | 3 - docs/docbook/xslt/db2latex/callout.mod.xsl | 3 - docs/docbook/xslt/db2latex/citation.mod.xsl | 3 - docs/docbook/xslt/db2latex/common/common.xsl | 2 - docs/docbook/xslt/db2latex/common/l10n.xsl | 1 - docs/docbook/xslt/db2latex/component.mod.xsl | 3 - docs/docbook/xslt/db2latex/dedication.mod.xsl | 3 - docs/docbook/xslt/db2latex/dingbat.mod.xsl | 3 - docs/docbook/xslt/db2latex/docbook.xsl | 5 - docs/docbook/xslt/db2latex/email.mod.xsl | 3 - docs/docbook/xslt/db2latex/errors.mod.xsl | 2 - docs/docbook/xslt/db2latex/example.mod.xsl | 3 - docs/docbook/xslt/db2latex/figure.mod.xsl | 3 - docs/docbook/xslt/db2latex/font.mod.xsl | 3 - docs/docbook/xslt/db2latex/footnote.mod.xsl | 3 - docs/docbook/xslt/db2latex/formal.mod.xsl | 3 - docs/docbook/xslt/db2latex/glossary.mod.xsl | 3 - docs/docbook/xslt/db2latex/graphic.mod.xsl | 3 - docs/docbook/xslt/db2latex/html.mod.xsl | 2 - docs/docbook/xslt/db2latex/index.mod.xsl | 3 - docs/docbook/xslt/db2latex/info.mod.xsl | 3 - docs/docbook/xslt/db2latex/inline.mod.xsl | 3 - docs/docbook/xslt/db2latex/keywords.mod.xsl | 3 - docs/docbook/xslt/db2latex/labelid.mod.xsl | 3 - docs/docbook/xslt/db2latex/latex.mapping.xsl | 3 - docs/docbook/xslt/db2latex/lists.mod.xsl | 3 - docs/docbook/xslt/db2latex/mathelem.mod.xsl | 3 - .../mathml/mathml.content.constsymb.mod.xsl | 2 - .../mathml/mathml.content.functions.mod.xsl | 2 - .../xslt/db2latex/mathml/mathml.content.mod.xsl | 2 - .../db2latex/mathml/mathml.content.token.mod.xsl | 2 - docs/docbook/xslt/db2latex/mathml/mathml.mod.xsl | 2 - .../db2latex/mathml/mathml.presentation.mod.xsl | 2 - docs/docbook/xslt/db2latex/mediaobject.mod.xsl | 3 - docs/docbook/xslt/db2latex/msgset.mod.xsl | 2 - docs/docbook/xslt/db2latex/normalize-scape.mod.xsl | 3 - docs/docbook/xslt/db2latex/part-chap-app.mod.xsl | 7 - docs/docbook/xslt/db2latex/pi.mod.xsl | 3 - docs/docbook/xslt/db2latex/preamble.mod.xsl | 3 - docs/docbook/xslt/db2latex/preface.mod.xsl | 3 - docs/docbook/xslt/db2latex/procedure.mod.xsl | 3 - docs/docbook/xslt/db2latex/qandaset.mod.xsl | 3 - docs/docbook/xslt/db2latex/refentry.mod.xsl | 3 - docs/docbook/xslt/db2latex/revision.mod.xsl | 3 - docs/docbook/xslt/db2latex/sections.mod.xsl | 3 - docs/docbook/xslt/db2latex/set.mod.xsl | 3 - docs/docbook/xslt/db2latex/sgmltag.mod.xsl | 3 - docs/docbook/xslt/db2latex/synop-oop.mod.xsl | 2 - docs/docbook/xslt/db2latex/synop-struct.mod.xsl | 2 - docs/docbook/xslt/db2latex/table.mod.xsl | 3 - docs/docbook/xslt/db2latex/texmath.mod.xsl | 3 - docs/docbook/xslt/db2latex/vars.mod.xsl | 6 - docs/docbook/xslt/db2latex/verbatim.mod.xsl | 3 - docs/docbook/xslt/db2latex/xref.mod.xsl | 3 - docs/docbook/xslt/html-chunk.xsl | 2 +- docs/docbook/xslt/html-common.xsl | 2 +- docs/docbook/xslt/html.xsl | 2 +- docs/docbook/xslt/latex.xsl | 2 +- docs/docbook/xslt/latex/sambadoc.cls | 7 +- docs/docbook/xslt/lists.mod.xsl | 2 - docs/docbook/xslt/table.mod.xsl | 3 - docs/faq/FAQ-ClientApp.html | 13 +- docs/faq/FAQ-Install.html | 136 +- docs/faq/FAQ-errors.html | 67 +- docs/faq/FAQ-features.html | 67 +- docs/faq/FAQ-general.html | 9 +- docs/faq/samba-faq.html | 5 +- docs/htmldocs/Samba-Developers-Guide.html | 976 +- docs/htmldocs/Samba-HOWTO-Collection.html | 18908 +++++-- docs/htmldocs/bugreport.html | 80 +- docs/htmldocs/compiling.html | 195 +- docs/htmldocs/diagnosis.html | 215 +- docs/htmldocs/domain-member.html | 607 +- docs/htmldocs/editreg.1.html | 6 +- docs/htmldocs/findsmb.1.html | 40 +- docs/htmldocs/groupmapping.html | 227 +- docs/htmldocs/install.html | 188 +- docs/htmldocs/integrate-ms-networks.html | 159 +- docs/htmldocs/introduction.html | 9 +- docs/htmldocs/lmhosts.5.html | 8 +- docs/htmldocs/msdfs.html | 85 +- docs/htmldocs/net.8.html | 80 +- docs/htmldocs/nmbd.8.html | 118 +- docs/htmldocs/nmblookup.1.html | 54 +- docs/htmldocs/ntlm_auth.1.html | 12 +- docs/htmldocs/optional.html | 31 +- docs/htmldocs/pam.html | 662 +- docs/htmldocs/passdb.html | 1196 +- docs/htmldocs/pdbedit.8.html | 87 +- docs/htmldocs/printing.html | 2779 +- docs/htmldocs/problems.html | 71 +- docs/htmldocs/profiles.1.html | 6 +- docs/htmldocs/rpcclient.1.html | 72 +- docs/htmldocs/samba-bdc.html | 375 +- docs/htmldocs/samba-pdc.html | 810 +- docs/htmldocs/samba.7.html | 79 +- docs/htmldocs/securing-samba.html | 292 +- docs/htmldocs/smb.conf.5.html | 2381 +- docs/htmldocs/smbcacls.1.html | 28 +- docs/htmldocs/smbclient.1.html | 210 +- docs/htmldocs/smbcontrol.1.html | 22 +- docs/htmldocs/smbcquotas.1.html | 36 +- docs/htmldocs/smbd.8.html | 94 +- docs/htmldocs/smbmnt.8.html | 12 +- docs/htmldocs/smbmount.8.html | 44 +- docs/htmldocs/smbpasswd.5.html | 12 +- docs/htmldocs/smbpasswd.8.html | 86 +- docs/htmldocs/smbsh.1.html | 78 +- docs/htmldocs/smbspool.8.html | 10 +- docs/htmldocs/smbstatus.1.html | 18 +- docs/htmldocs/smbtar.1.html | 24 +- docs/htmldocs/smbtree.1.html | 26 +- docs/htmldocs/smbumount.8.html | 10 +- docs/htmldocs/speed.html | 90 +- docs/htmldocs/swat.8.html | 72 +- docs/htmldocs/testparm.1.html | 32 +- docs/htmldocs/testprns.1.html | 20 +- docs/htmldocs/type.html | 17 +- docs/htmldocs/unicode.html | 56 +- docs/htmldocs/vfstest.1.html | 20 +- docs/htmldocs/wbinfo.1.html | 50 +- docs/htmldocs/winbind.html | 293 +- docs/htmldocs/winbindd.8.html | 150 +- docs/manpages/pdbedit.8 | 54 +- docs/manpages/rpcclient.1 | 2 +- docs/manpages/samba.7 | 405 +- docs/manpages/smb.conf.5 | 570 +- docs/manpages/smbmount.8 | 11 +- docs/manpages/wbinfo.1 | 4 +- examples/LDAP/README | 30 +- examples/LDAP/convertSambaAccount | 56 +- examples/LDAP/export2_smbpasswd.pl | 64 - examples/LDAP/import2_smbpasswd.pl | 108 - examples/LDAP/samba.schema | 33 +- examples/VFS/.cvsignore | 5 + examples/VFS/README | 8 +- examples/libsmbclient/testsmbc.c | 2 +- examples/smb.conf.default | 2 +- packaging/Debian/README | 29 +- packaging/Debian/debian/README.build-upstream | 40 +- packaging/Debian/debian/README.debian | 56 +- packaging/Debian/debian/changelog | 95 +- packaging/Debian/debian/control | 8 +- .../Debian/debian/patches/documentation.patch | 123 +- packaging/Debian/debian/patches/fhs.patch | 330 +- packaging/Debian/debian/patches/samba.patch | 64 +- packaging/Debian/debian/po/es.po | 48 +- packaging/Debian/debian/po/fr.po | 52 +- packaging/Debian/debian/po/pt_BR.po | 51 +- packaging/Debian/debian/po/templates.pot | 34 +- packaging/Debian/debian/rules | 25 +- packaging/Debian/debian/samba-common.config | 7 +- packaging/Debian/debian/samba-common.dhcp | 53 +- packaging/Debian/debian/samba-common.postinst | 8 +- packaging/Debian/debian/samba-common.postrm | 1 - packaging/Debian/debian/samba-common.templates | 8 +- packaging/Debian/debian/samba.config | 1 - packaging/Debian/debian/samba.dirs | 3 +- packaging/Debian/debian/samba.files | 3 + packaging/Debian/debian/samba.init | 1 - packaging/Debian/debian/samba.postinst | 20 - packaging/Debian/debian/samba.postrm | 2 - packaging/Debian/debian/samba.prerm | 19 - packaging/Debian/debian/scripts/patch-source | 1 - packaging/Debian/debian/scripts/unpatch-source | 1 - packaging/Debian/debian/smb.conf | 174 +- packaging/Debian/debian/smbclient.files | 3 + packaging/Debian/debian/swat.config | 1 - packaging/Debian/debian/swat.postinst | 1 - packaging/Debian/debian/swat.postrm | 1 - packaging/Debian/debian/winbind.init | 1 - packaging/Mandrake/makerpms-cvs.sh | 13 +- packaging/Mandrake/makerpms.sh.tmpl | 4 +- packaging/Mandrake/samba-print-pdf.sh | 70 +- packaging/Mandrake/samba2.spec.tmpl | 545 +- packaging/Mandrake/smb.conf | 37 +- packaging/README | 10 +- packaging/RedHat/makerpms.sh.tmpl | 46 +- packaging/RedHat/winbind.init | 12 +- packaging/SGI/idb.pl | 9 +- packaging/Solaris/makepkg.sh | 31 - packaging/Solaris/pkg-specs/pkginfo | 2 +- packaging/Solaris/prototype.master | 11 +- source3/Makefile.in | 334 +- source3/aclocal.m4 | 115 +- source3/auth/auth.c | 59 +- source3/auth/auth_builtin.c | 9 +- source3/auth/auth_domain.c | 296 +- source3/auth/auth_rhosts.c | 19 +- source3/auth/auth_sam.c | 181 +- source3/auth/auth_server.c | 19 +- source3/auth/auth_unix.c | 2 +- source3/auth/auth_util.c | 402 +- source3/auth/auth_winbind.c | 20 +- source3/auth/pampass.c | 4 +- source3/auth/pass_check.c | 5 +- source3/autogen.sh | 6 - source3/change-log | 2 +- source3/client/client.c | 19 +- source3/client/clitar.c | 12 +- source3/client/mount.cifs.c | 5 +- source3/client/smbmount.c | 4 +- source3/client/tree.c | 6 +- source3/config.sub | 236 +- source3/configure.in | 922 +- source3/groupdb/mapping.c | 736 +- source3/include/.cvsignore | 1 - source3/include/ads.h | 1 + source3/include/auth.h | 2 + source3/include/client.h | 17 +- source3/include/idmap.h | 19 +- source3/include/includes.h | 33 +- source3/include/mapping.h | 28 - source3/include/ntioctl.h | 44 +- source3/include/ntlmssp.h | 9 +- source3/include/passdb.h | 27 +- source3/include/privileges.h | 25 +- source3/include/rpc_dce.h | 26 +- source3/include/rpc_lsa.h | 20 +- source3/include/rpc_samr.h | 10 - source3/include/rpc_secdes.h | 19 +- source3/include/rpc_srvsvc.h | 8 +- source3/include/safe_string.h | 23 +- source3/include/smb.h | 35 +- source3/include/smb_macros.h | 60 +- source3/include/smbprofile.h | 8 + source3/include/trans2.h | 1 + source3/include/version.h | 2 +- source3/include/vfs.h | 420 +- source3/lib/charcnv.c | 45 +- source3/lib/gencache.c | 29 +- source3/lib/module.c | 23 - source3/lib/popt_common.c | 4 +- source3/lib/substitute.c | 20 +- source3/lib/system.c | 125 + source3/lib/system_smbd.c | 24 +- source3/lib/time.c | 3 +- source3/lib/username.c | 76 +- source3/lib/util.c | 49 +- source3/lib/util_sid.c | 6 +- source3/lib/util_sock.c | 24 +- source3/lib/util_str.c | 107 +- source3/lib/util_unistr.c | 31 +- source3/lib/util_uuid.c | 6 +- source3/lib/wins_srv.c | 20 +- source3/libads/ads_ldap.c | 16 +- source3/libads/ads_struct.c | 3 +- source3/libads/ads_utils.c | 46 - source3/libads/kerberos_verify.c | 99 +- source3/libads/krb5_setpw.c | 37 +- source3/libads/ldap.c | 213 +- source3/libads/ldap_printer.c | 23 +- source3/libads/ldap_user.c | 8 +- source3/libads/sasl.c | 5 +- source3/libsmb/cliconnect.c | 113 +- source3/libsmb/clientgen.c | 45 +- source3/libsmb/clifile.c | 4 +- source3/libsmb/clikrb5.c | 30 +- source3/libsmb/climessage.c | 38 +- source3/libsmb/clirap.c | 4 +- source3/libsmb/clirap2.c | 4 +- source3/libsmb/clispnego.c | 2 +- source3/libsmb/namecache.c | 111 +- source3/libsmb/namequery.c | 756 +- source3/libsmb/namequery_dc.c | 128 +- source3/libsmb/nmblib.c | 4 +- source3/libsmb/ntlmssp.c | 120 +- source3/libsmb/ntlmssp_parse.c | 75 +- source3/libsmb/ntlmssp_sign.c | 206 +- source3/libsmb/pwd_cache.c | 14 +- source3/libsmb/smb_signing.c | 270 +- source3/libsmb/smbencrypt.c | 157 +- source3/libsmb/trustdom_cache.c | 129 +- source3/libsmb/trusts_util.c | 95 +- source3/locking/posix.c | 11 +- source3/modules/vfs_audit.c | 232 +- source3/modules/vfs_extd_audit.c | 241 +- source3/modules/vfs_fake_perms.c | 240 +- source3/modules/vfs_netatalk.c | 78 +- source3/modules/vfs_recycle.c | 516 +- source3/msdfs/msdfs.c | 18 +- source3/nmbd/nmbd.c | 98 +- source3/nmbd/nmbd_become_lmb.c | 3 +- source3/nmbd/nmbd_browserdb.c | 139 +- source3/nmbd/nmbd_browsesync.c | 8 +- source3/nmbd/nmbd_elections.c | 2 +- source3/nmbd/nmbd_incomingdgrams.c | 16 +- source3/nmbd/nmbd_incomingrequests.c | 2 +- source3/nmbd/nmbd_namelistdb.c | 4 +- source3/nmbd/nmbd_processlogon.c | 67 +- source3/nmbd/nmbd_sendannounce.c | 10 +- source3/nmbd/nmbd_serverlistdb.c | 6 +- source3/nmbd/nmbd_winsserver.c | 416 +- source3/nmbd/nmbd_workgroupdb.c | 2 +- source3/nsswitch/wb_client.c | 323 +- source3/nsswitch/wb_common.c | 26 +- source3/nsswitch/wbinfo.c | 264 +- source3/nsswitch/winbindd.c | 75 +- source3/nsswitch/winbindd.h | 8 +- source3/nsswitch/winbindd_ads.c | 143 +- source3/nsswitch/winbindd_cache.c | 513 +- source3/nsswitch/winbindd_cm.c | 676 +- source3/nsswitch/winbindd_group.c | 263 +- source3/nsswitch/winbindd_misc.c | 2 +- source3/nsswitch/winbindd_nss.h | 70 +- source3/nsswitch/winbindd_pam.c | 272 +- source3/nsswitch/winbindd_rpc.c | 315 +- source3/nsswitch/winbindd_sid.c | 30 +- source3/nsswitch/winbindd_user.c | 67 +- source3/nsswitch/winbindd_util.c | 235 +- source3/nsswitch/winbindd_wins.c | 24 +- source3/nsswitch/wins.c | 13 +- source3/pam_smbpass/pam_smb_passwd.c | 2 +- source3/pam_smbpass/support.c | 2 +- source3/param/loadparm.c | 337 +- source3/passdb/machine_sid.c | 5 +- source3/passdb/passdb.c | 746 +- source3/passdb/pdb_get_set.c | 31 + source3/passdb/pdb_guest.c | 16 + source3/passdb/pdb_interface.c | 70 +- source3/passdb/pdb_ldap.c | 2479 +- source3/passdb/pdb_smbpasswd.c | 153 +- source3/passdb/pdb_tdb.c | 509 +- source3/passdb/pdb_xml.c | 2 +- source3/passdb/privileges.c | 4 +- source3/passdb/secrets.c | 33 +- source3/printing/lpq_parse.c | 62 +- source3/printing/notify.c | 2 +- source3/printing/nt_printing.c | 171 +- source3/printing/pcap.c | 6 +- source3/printing/printfsp.c | 2 +- source3/printing/printing.c | 6 +- source3/printing/printing_db.c | 4 +- source3/python/py_winbind.c | 4 +- source3/registry/reg_db.c | 2 +- source3/rpc_client/cli_lsarpc.c | 56 +- source3/rpc_client/cli_netlogon.c | 20 +- source3/rpc_client/cli_pipe.c | 1043 +- source3/rpc_client/cli_samr.c | 107 + source3/rpc_client/cli_spoolss.c | 32 +- source3/rpc_parse/parse_misc.c | 142 +- source3/rpc_parse/parse_net.c | 35 +- source3/rpc_parse/parse_prs.c | 278 +- source3/rpc_parse/parse_rpc.c | 26 +- source3/rpc_parse/parse_samr.c | 64 +- source3/rpc_parse/parse_sec.c | 179 +- source3/rpc_parse/parse_spoolss.c | 9 +- source3/rpc_parse/parse_srv.c | 3 +- source3/rpc_server/srv_dfs_nt.c | 2 +- source3/rpc_server/srv_lsa.c | 185 +- source3/rpc_server/srv_lsa_nt.c | 222 +- source3/rpc_server/srv_netlog_nt.c | 26 +- source3/rpc_server/srv_pipe.c | 42 +- source3/rpc_server/srv_samr_nt.c | 212 +- source3/rpc_server/srv_spoolss_nt.c | 85 +- source3/rpc_server/srv_srvsvc_nt.c | 33 +- source3/rpc_server/srv_util.c | 27 +- source3/rpc_server/srv_wkssvc_nt.c | 4 +- source3/rpcclient/cmd_lsarpc.c | 45 - source3/rpcclient/cmd_netlogon.c | 9 +- source3/rpcclient/cmd_samr.c | 24 +- source3/rpcclient/cmd_spoolss.c | 127 +- source3/rpcclient/cmd_wkssvc.c | 2 +- source3/rpcclient/rpcclient.c | 182 +- source3/sam/idmap.c | 308 +- source3/sam/idmap_ldap.c | 1363 +- source3/sam/idmap_tdb.c | 398 +- source3/sam/idmap_util.c | 333 +- source3/script/.cvsignore | 1 - source3/script/build_env.sh | 26 +- source3/script/installswat.sh | 2 +- source3/script/mkproto.awk | 6 +- source3/smbd/.cvsignore | 1 + source3/smbd/change_trust_pw.c | 2 +- source3/smbd/close.c | 2 +- source3/smbd/conn.c | 39 +- source3/smbd/connection.c | 9 +- source3/smbd/dfree.c | 12 +- source3/smbd/dir.c | 20 +- source3/smbd/dosmode.c | 14 +- source3/smbd/fileio.c | 14 +- source3/smbd/filename.c | 8 +- source3/smbd/files.c | 4 + source3/smbd/lanman.c | 10 +- source3/smbd/mangle_hash.c | 17 +- source3/smbd/negprot.c | 16 +- source3/smbd/notify_hash.c | 4 +- source3/smbd/nttrans.c | 707 +- source3/smbd/open.c | 38 +- source3/smbd/oplock.c | 2 +- source3/smbd/password.c | 22 +- source3/smbd/posix_acls.c | 989 +- source3/smbd/quotas.c | 114 + source3/smbd/reply.c | 86 +- source3/smbd/server.c | 28 +- source3/smbd/service.c | 31 +- source3/smbd/session.c | 17 +- source3/smbd/sesssetup.c | 28 +- source3/smbd/statcache.c | 404 +- source3/smbd/trans2.c | 353 +- source3/smbd/uid.c | 372 + source3/smbd/utmp.c | 77 +- source3/smbd/vfs-wrap.c | 273 +- source3/smbd/vfs.c | 583 +- source3/smbwrapper/shared.c | 4 +- source3/smbwrapper/smbw_dir.c | 5 +- source3/tdb/tdb.c | 3 +- source3/tdb/tdbbackup.c | 174 +- source3/tdb/tdbutil.c | 7 +- source3/torture/cmd_vfs.c | 201 +- source3/torture/mangle_test.c | 4 +- source3/torture/masktest.c | 4 +- source3/torture/nsstest.c | 49 +- source3/torture/rpctorture.c | 8 +- source3/torture/smbiconv.c | 8 +- source3/torture/torture.c | 5 +- source3/torture/vfstest.c | 20 +- source3/torture/vfstest.h | 2 +- source3/utils/editreg.c | 30 +- source3/utils/net.c | 56 +- source3/utils/net_ads.c | 140 +- source3/utils/net_ads_cldap.c | 242 +- source3/utils/net_cache.c | 2 +- source3/utils/net_groupmap.c | 91 +- source3/utils/net_help.c | 20 - source3/utils/net_lookup.c | 8 +- source3/utils/net_rpc.c | 222 +- source3/utils/net_rpc_join.c | 47 +- source3/utils/net_rpc_samsync.c | 165 +- source3/utils/ntlm_auth.c | 587 +- source3/utils/pdbedit.c | 36 +- source3/utils/profiles.c | 4 + source3/utils/smbcacls.c | 13 +- source3/utils/smbcontrol.c | 60 +- source3/utils/smbpasswd.c | 21 +- source3/utils/testparm.c | 4 + source3/web/swat.c | 46 +- testsuite/build_farm/basicsmb-domainsec.test | 4 +- testsuite/build_farm/basicsmb.fns | 19 +- testsuite/build_farm/runlist | 10 +- testsuite/build_farm/template/preexec | 1 + testsuite/build_farm/torture-FDPASS.test | 2 +- testsuite/build_farm/torture_setup.fns | 2 +- 536 files changed, 101292 insertions(+), 57338 deletions(-) delete mode 100644 examples/LDAP/export2_smbpasswd.pl delete mode 100644 examples/LDAP/import2_smbpasswd.pl diff --git a/README b/README index cdc7e9e2a9..725a26523a 100644 --- a/README +++ b/README @@ -6,7 +6,7 @@ the Samba Team, who support the original author, Andrew Tridgell. >>>> about the configuration and use of Samba. NOTE: Installation instructions may be found in - docs/htmldocs/UNIX_INSTALL.html + docs/htmldocs/install.html This software is freely distributable under the GNU public license, a copy of which you should have received with this software (in a file @@ -19,7 +19,7 @@ WHAT IS SMB? This is a big question. The very short answer is that it is the protocol by which a lot of -PC-related machines share files and printers and other informatiuon +PC-related machines share files and printers and other information such as lists of available files and printers. Operating systems that support this natively include Windows NT, OS/2, and Linux and add on packages that achieve the same thing are available for DOS, Windows, diff --git a/Roadmap b/Roadmap index 83b0bcc0e6..4692807eab 100644 --- a/Roadmap +++ b/Roadmap @@ -1,43 +1,29 @@ -Copyright (C) 1997-1999 - Samba-Team +Copyright (C) 1997-2003 Samba-Team The Samba-Team are committed to an aggressive program to deliver quality controlled software to a well defined roadmap. -The current Samba release 2.0.4 is called the "NT Security update". - -It correctly implements the Windows NT specific SMB calls, -and will operate correctly as a client in a Windows NT -Domain environment. - -In addition, the first implementation of the Web-based GUI -management tool ships with 2.0.0, thus fullfilling some of -the commitments made in the 1.9.18 release Roadmap document. - -Some work has been done on ensuring compatibility with -Windows NT 5.0 (now Windows 2000 :-) although this is -a somewhat (slowly) moving target. +The current Samba Beta series of Samba 3.0.0 is called the "Domain Integration" +release. The following development objectives for future releases -are in place: - +are in progress: ---------------------------------------------------------------------------- -2.0.x - "NT Security update" - Allowing Windows NT Clients to - manipulate file security and ownership using native tools. +Samba-3.0.0 The Domain Integration Release -Note that the "NT Security update" part of the Roadmap has been -achieved with the Samba 2.0.4 release. +Samba-3.0.x Refinments to the User and Group IDMAP facility and + general code stabilization work. -2.0.xx - "Thin Server" mode, allowing a Samba server to be - inserted into a network with no UNIX setup required. - Some management capabilities for Samba using native NT tools. - Provision of command-line equivalents to native NT tools. +Samba-3.x.x Improvements in Management and Migration tools, + the introduction of further integration capabilities. -2.X - "Domain Controller" - able to serve as a Windows NT PDC. +Samba-4 Danger Will Robinson, a big code clean up with major + system redesign. More will be announced as this work + starts to take shape. -X.XX - "Full Domain Integration" - allowing both PDC and BDC modes. -Note that it is a given that the Samba Team will continue to track -Windows (NT/2000) update releases, ensuring that Samba will work +Note that it is a given that the Samba-Team will continue to track +Windows (NT/200x) update releases, ensuring that Samba will work well with whatever "Beta" releases Redmond throws our way :-). You may also note that the release numbers get fuzzier the diff --git a/WHATSNEW.txt b/WHATSNEW.txt index 4446832fd4..c264e6a3c7 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -1,378 +1,743 @@ - WHATS NEW IN Samba 3.0 alpha21 - 26th November 2002 - =============================== - -This is a pre-release of Samba 3.0. This is NOT a stable release. -Use at your own risk. - -The purpose of this alpha release is to get wider testing of the major -new pieces of code in the current Samba 3.0 development tree. We have -officially ceased development on the 2.2.x release of Samba and are -concentrating on Samba 3.0. To reduce the time before the final Samba 3.0 -release we need as many people as possible to start testing these alpha -releases, and hopefully giving us some high quality feedback on what needs -fixing. - -Note that Samba 3.0 is not feature complete yet. There is a more -coding we have planned, but unless we get what we have done already more -widely tested we will have a hard time doing a stable release in a -reasonable time frame. + WHATS NEW IN Samba 3.0.0 beta4 + July 16 2003 + ============================== + +This is the third beta release of Samba 3.0.0. This is a +non-production release intended for testing purposes. Use +at your own risk. + +The purpose of this beta release is to get wider testing of the major +new pieces of code in the current Samba 3.0 development tree. We have +officially ceased development on the 2.2.x release of Samba and are +concentrating on Samba 3.0. To reduce the time before the final +Samba 3.0 release we need as many people as possible to start testing +these beta releases, and to provide high quality feedback on what +needs fixing. + +Samba 3.0 is feature complete. However there is still some final +work to be done on certain pieces of functionality. Please refer to +the section on "Known Issues" for more details. + Major new features: ------------------- -- Active Directory support. This release is able to join a ADS realm - as a member server and authenticate users using LDAP/kerberos. +1) Active Directory support. Samba 3.0 is now able to + to join a ADS realm as a member server and authenticate + users using LDAP/Kerberos. + +2) Unicode support. Samba will now negotiate UNICODE on the wire and + internally there is now a much better infrastructure for multi-byte + and UNICODE character sets. + +3) New authentication system. The internal authentication system has + been almost completely rewritten. Most of the changes are internal, + but the new auth system is also very configurable. + +4) New filename mangling system. The filename mangling system has been + completely rewritten. An internal database now stores mangling maps + persistently. This needs lots of testing. + +5) A new "net" command has been added. It is somewhat similar to + the "net" command in windows. Eventually we plan to replace + numerous other utilities (such as smbpasswd) with subcommands + in "net". + +6) Samba now negotiates NT-style status32 codes on the wire. This + improves error handling a lot. + +7) Better Windows 2000/XP/2003 printing support including publishing + printer attributes in active directory. + +8) New loadable RPC modules. + +9) New dual-daemon winbindd support for better performance. + +10) Support for migrating from a Windows NT 4.0 domain to a Samba + domain and maintaining user, group and domain SIDs. + +11) Support for establishing trust relationships with Windows NT 4.0 + domain controllers. + +12) Initial support for a distributed Winbind architecture using + an LDAP directory for storing SID to uid/gid mappings. + +13) Major updates to the Samba documentation tree. + +Plus lots of other improvements! + + +Additional Documentation +------------------------ + +Please refer to Samba documentation tree (including in the docs/ +subdirectory) for extensive explanations of installing, configuring +and maintaining Samba 3.0 servers and clients. It is advised to +begin with the Samba-HOWTO-Collection for overviews and specific +tasks (the current book is up to approximately 400 pages) and to +refer to the various man pages for information on individual options. + +###################################################################### +Changes since 3.0beta2 +###################### + +Please refer to the CVS log for the SAMBA_3_0 branch for complete +details + +1) Added fix for Japanese case names in statcache code; + these can change size on upper casing. +2) Correct issues with iconv detection in configure script + (support needed to find iconv libraries on FreeBSD). +3) Fix bug that caused a WINS server to be marked as dead + incorrectly (bug #190). +4) Removing additional deadlocks conditions that prevented + winbindd from running on a Samba PDC (used for trust + relationships). +5) Add support for searching for Active Directory for + published printers (net ads printer search). +6) Separate UNIX username from DOMAIN\username in pipe + credentials. +7) Auth modules now support returning NT_STATUS_NOT_IMPLEMENTED + for cases that they cannot handle. +8) Flush winbindd connection cache when the machine trust account + password is changed while a connection is open (bug #200). +9) Add support for 'OSVersion' server printer data string + (corrects problem with uploading printer drivers from + WinXP clients). +10) Numerous memory leak fixes. +11) LDAP fixes ("passdb backend = ldapsam" & "idmap backend = ldap"): + - Store domain SID in LDAP directory. + - store idmap information in existing entries (use sambaSID=... + if adding a new entry). +12) Fix incorrect usage of primary group SID when looking up user + groups (bug #109). +13) Remove idmap_XX_to_XX calls from smbd. Move back to the the + winbind_XXX and local_XXX calls used in 2.2. +14) All uid/gid allocation must involve winbindd now + (we no attempt to map unknown SIDs to a UNIX identify). +15) Add 'winbind trusted domains only' parameter to force a domain + member. The server to use matching users names from /etc/passwd + for its domain (needed for domain member of a Samba domain). +16) Rename 'idmap only' to 'enable rid algorithm' for better clarity + (defaults to "yes"). +17) Add support for multi-byte statcache code (bug #185) +18) Fix open mode race condition. +19) Implement winbindd local account management functions. Refer to + the "Winbind Changes" section for details. +20) Move RID allocation functions into idmap backend. +21) Fix parsing error that prevented publishing printers from a + Samba server in an AD domain. +22) Revive NTLMSSP support for named pipes. +23) More SCHANNEL fixes. +24) Correct SMB signing with NTLMSSP. +25) Fix coherency bug in print handle/printer object caching code + that could cause XP clients to infinitely loop while updating + their local printer cache. +26) Make winbindd use its dual-daemon mode by default (use -Y to + start as a single process). +27) Add support to nmbd and winbindd for 'smbcontrol + reload-config'. +28) Correct problem with smbtar when dealing with files > 8Gb + (bug #102). + + + +Changes since 3.0beta1 +###################### + +1) Rework our smb signing code again, this factors out some of + the common MAC calculation code, and now supports multiple + outstanding packets (bug #40). +2) Enforce 'client plaintext auth', 'client lanman auth' and 'client + ntlmv2 auth'. +3) Correct timestamp problem on 64-bit machines (bug #140). +4) Add extra debugging statements to winbindd for tracking down + failures. +5) Fix bug when aliased 'winbind uid/gid' parameters are used. + ('winbind uid/gid' are now replaced with 'idmap uid/gid'). +6) Added an auth flag that indicates if we should be allowed + to fall back to NTLMSSP for SASL if krb5 fails. +7) Fixed the bug that forced us not to use the winbindd cache when + we have a primary ADS domain and a secondary (trusted) NT4 + domain. +8) Use lp_realm() to find the default realm for 'net ads password'. +9) Removed editreg from standard build until it is portable.. +10) Fix domain membership for servers not running winbindd. +11) Correct race condition in determining the high water mark + in the idmap backend (bug #181). +12) Set the user's primary unix group from usrmgr.exe (partial + fix for bug #45). +13) Show comments when doing 'net group -l' (bug #3). +14) Add trivial extension to 'net' to dump current local idmap + and restore mappings as well. +15) Modify 'net rpc vampire' to add new and existing users to + both the idmap and the SAM. This code needs further testing. +16) Fix crash bug in ADS searches. +17) Build libnss_wins.so as part of nsswitch target (bug #160). +18) Make net rpc vampire return an error if the sam sync RPC + returns an error. +19) Fail to join an NT 4 domain as a BDC if a workstation account + using our name exists. +20) Fix various memory leaks in server and client code +21) Remove the short option to --set-auth-user for wbinfo (-A) to + prevent confusion with the -a option (bug #158). +22) Added new 'map acl inherit' parameter. +23) Removed unused 'privileges' code from group mapping database. +24) Don't segfault on empty passdb backend list (bug #136). +25) Fixed acl sorting algorithm for Windows 2000 clients. +26) Replace universal group cache with netsamlogon_cache + from APPLIANCE_HEAD branch. +27) Fix autoconf detection issues surrounding --with-ads=yes + but no Krb5 header files installed (bug #152). +28) Add LDAP lookup for domain sequence number in case we are + joined using NT4 protocols to a native mode AD domain. +29) Fix backend method selection for trusted NT 4 (or 2k + mixed mode) domains. +30) Fixed bug that caused us to enumerate domain local groups + from native mode AD domains other than our own. +31) Correct group enumeration for viewing in the Windows + security tab (bug #110). +32) Consolidate the DC location code. +33) Moved 'ads server' functionality into 'password server' for + backwards compatibility. +34) Fix winbindd_idmap tdb upgrades from a 2.2 installation. + ( if you installed beta1, be sure to + 'mv idmap.tdb winbindd_idmap.tdb' ). +35) Fix pdb_ldap segfaults, and wrong default values for + ldapsam_compat. +36) Enable negative connection cache for winbindd's ADS backend + functions. +37) Enable address caching for active directory DC's so we don't + have to hit DNS so much. +38) Fix bug in idmap code that caused mapping to randomly be + redefined. +39) Add tdb locking code to prevent race condition when adding a + new mapping to idmap. +40) Fix 'map to guest = bad user' when acting as a PDC supporting + trust relationships. +41) Prevent deadlock issues when running winbindd on a Samba PDC + to handle allocating uids & gids for trusted users and groups +42) added LOCALE patch from Steve Langasek (bug #122). +43) Add the 'guest' passdb backend automatically to the end of + the 'passdb backend' list if 'guest account' has a valid + username. +44) Remove samstrict_dc auth method. Rework 'samstrict' to only + handle our local names (or domain name if we are a PDC). + Move existing permissive 'sam' method to 'sam_ignoredomain' + and make 'samstrict' the new default 'sam' auth method. +45) Match Windows NT4/2k behavior when authenticating a user with + and unknown domain (default to our domain if we are a DC or + domain member; default to our local name if we are a + standalone server). +46) Fix Get_Pwnam() to always fall back to lookup 'user' if the + 'DOMAIN\user' lookup fails. This matches 2.2. behavior. +47) Fix the trustdom_cache code to update the list of trusted + domains when operating as a domain member and not using + winbindd. +48) Remove 'nisplussam' passdb backend since it has suffered for + too long without a maintainer. + + + + +###################################################################### +Upgrading from Samba 2.2 +######################## + +This section is provided to help administrators understand the details +involved with upgrading a Samba 2.2 server to Samba 3.0. + + +Building +-------- + +Many of the options to the GNU autoconf script have been modified +in the 3.0 release. The most noticeable are: + + * removal of --with-tdbsam (is now included by default; see section + on passdb backends and authentication for more details) + + * --with-ldapsam is now on used to provided backward compatible + parameters for LDAP enabled Samba 2.2 servers. Refer to the passdb + backend and authentication section for more details + + * inclusion of non-standard passdb modules may be enabled using + --with-expsam. This includes an XML backend and a mysql backend. + + * removal of --with-msdfs (is now enabled by default) + + * removal of --with-ssl (no longer supported) + + * --with-utmp now defaults to 'yes' on supported systems + + * --with-sendfile-support is now enabled by default on supported + systems + + +Parameters +---------- + +This section contains a brief listing of changes to smb.conf options +in the 3.0.0 release. Please refer to the smb.conf(5) man page for +complete descriptions of new or modified parameters. + +Removed Parameters (order alphabetically): + + * admin log + * alternate permissions + * character set + * client codepage + * code page directory + * coding system + * domain admin group + * domain guest group + * force unknown acl user + * nt smb support + * post script + * printer driver + * printer driver file + * printer driver location + * status + * total print jobs + * use rhosts + * valid chars + * vfs options + +New Parameters (new parameters have been grouped by function): + + Remote management + ----------------- + * abort shutdown script + * shutdown script + + User and Group Account Management + --------------------------------- + * add group script + * add machine script + * add user to group script + * algorithmic rid base + * delete group script + * delete user from group script + * passdb backend + * set primary group script + + Authentication + -------------- + * auth methods + * realm + + Protocol Options + ---------------- + * client lanman auth + * client NTLMv2 auth + * client schannel + * client signing + * client use spnego + * disable netbios + * ntlm auth + * paranoid server security + * server schannel + * smb ports + * use spnego + + File Service + ------------ + * get quota command + * hide special files + * hide unwriteable files + * hostname lookups + * kernel change notify + * mangle prefix + * map acl inherit + * msdfs proxy + * set quota command + * use sendfile + * vfs objects + + Printing + -------- + * max reported print jobs + + UNICODE and Character Sets + -------------------------- + * display charset + * dos charset + * unicode + * unix charset + + SID to uid/gid Mappings + ----------------------- + * idmap backend + * idmap gid + * idmap uid + * winbind enable local accounts + * winbind trusted domains only + * template primary group + * enable rid algorithm + + LDAP + ---- + * ldap delete dn + * ldap group suffix + * ldap idmap suffix + * ldap machine suffix + * ldap passwd sync + * ldap trust ids + * ldap user suffix + + General Configuration + --------------------- + * preload modules + * privatedir + +Modified Parameters (changes in behavior): + + * encrypt passwords (enabled by default) + * mangling method (set to 'hash2' by default) + * passwd chat + * passwd program + * restrict anonymous (integer value) + * security (new 'ads' value) + * strict locking (enabled by default) + * winbind cache time (increased to 5 minutes) + * winbind uid (deprecated in favor of 'idmap uid') + * winbind gid (deprecated in favor of 'idmap gid') + + +Databases +--------- + +This section contains brief descriptions of any new databases +introduced in Samba 3.0. Please remember to backup your existing +${lock directory}/*tdb before upgrading to Samba 3.0. Samba will +upgrade databases as they are opened (if necessary), but downgrading +from 3.0 to 2.2 is an unsupported path. + +Name Description Backup? +---- ----------- ------- +account_policy User policy settings yes +gencache Generic caching db no +group_mapping Mapping table from Windows yes + groups/SID to unix groups +winbindd_idmap ID map table from SIDS to UNIX yes + uids/gids. +namecache Name resolution cache entries no +netsamlogon_cache Cache of NET_USER_INFO_3 structure no + returned as part of a successful + net_sam_logon request +printing/*.tdb Cached output from 'lpq no + command' created on a per print + service basis +registry Read-only samba registry skeleton no + that provides support for exporting + various db tables via the winreg RPCs + + +Changes in Behavior +------------------- -- Unicode support. Samba will now negotiate UNICODE on the wire and - internally there is now a much better infrastructure for multi-byte - and UNICODE character sets. +The following issues are known changes in behavior between Samba 2.2 and +Samba 3.0 that may affect certain installations of Samba. + + 1) When operating as a member of a Windows domain, Samba 2.2 would + map any users authenticated by the remote DC to the 'guest account' + if a uid could not be obtained via the getpwnam() call. Samba 3.0 + rejects the connection as NT_STATUS_LOGON_FAILURE. There is no + current work around to re-establish the 2.2 behavior. + + 2) When adding machines to a Samba 2.2 controlled domain, the + 'add user script' was used to create the UNIX identity of the + machine trust account. Samba 3.0 introduces a new 'add machine + script' that must be specified for this purpose. Samba 3.0 will + not fall back to using the 'add user script' in the absence of + an 'add machine script' + + +###################################################################### +Passdb Backends and Authentication +################################## + +There have been a few new changes that Samba administrators should be +aware of when moving to Samba 3.0. + + 1) encrypted passwords have been enabled by default in order to + inter-operate better with out-of-the-box Windows client + installations. This does mean that either (a) a samba account + must be created for each user, or (b) 'encrypt passwords = no' + must be explicitly defined in smb.conf. + + 2) Inclusion of new 'security = ads' option for integration + with an Active Directory domain using the native Windows + Kerberos 5 and LDAP protocols. + +Samba 3.0 also includes the possibility of setting up chains +of authentication methods (auth methods) and account storage +backends (passdb backend). Please refer to the smb.conf(5) +man page for details. While both parameters assume sane default +values, it is likely that you will need to understand what the +values actually mean in order to ensure Samba operates correctly. + +The recommended passdb backends at this time are + + * smbpasswd - 2.2 compatible flat file format + * tdbsam - attribute rich database intended as an smbpasswd + replacement for stand alone servers + * ldapsam - attribute rich account storage and retrieval + backend utilizing an LDAP directory. + * ldapsam_compat - a 2.2 backward compatible LDAP account + backend + +Certain functions of the smbpasswd(8) tool have been split between the +new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8) +utility. See the respective man pages for details. + + +###################################################################### +LDAP +#### + +This section outlines the new features affecting Samba / LDAP +integration. + +New Schema +---------- + +A new object class (sambaSamAccount) has been introduced to replace +the old sambaAccount. This change aids us in the renaming of attributes +to prevent clashes with attributes from other vendors. There is a +conversion script (examples/LDAP/convertSambaAccount) to modify and LDIF +file to the new schema. + +Example: + + $ ldapsearch .... -b "ou=people,dc=..." > old.ldif + $ convertSambaAccount old.ldif new.ldif + +The can be obtained by running 'net getlocalsid ' +on the Samba PDC as root. + +The old sambaAccount schema may still be used by specifying the +"ldapsam_compat" passdb backend. However, the sambaAccount and +associated attributes have been moved to the historical section of +the schema file and must be uncommented before use if needed. +The 2.2 object class declaration for a sambaAccount has not changed +in the 3.0 samba.schema file. + +Other new object classes and their uses include: + + * sambaDomain - domain information used to allocate rids + for users and groups as necessary. The attributes are added + in 'ldap suffix' directory entry automatically if + an idmap uid/gid range has been set and the 'ldapsam' + passdb backend has been selected. + + * sambaGroupMapping - an object representing the + relationship between a posixGroup and a Windows + group/SID. These entries are stored in the 'ldap + group suffix' and managed by the 'net groupmap' command. + + * sambaUnixIdPool - created in the 'ldap idmap suffix' entry + automatically and contains the next available 'idmap uid' and + 'idmap gid' + + * sambaIdmapEntry - object storing a mapping between a + SID and a UNIX uid/gid. These objects are created by the + idmap_ldap module as needed. + + * sambaSidEntry - object representing a SID alone, as a Structural + class on which to build the sambaIdmapEntry. + + +New Suffix for Searching +------------------------ + +The following new smb.conf parameters have been added to aid in directing +certain LDAP queries when 'passdb backend = ldapsam://...' has been +specified. + + * ldap suffix - used to search for user and computer accounts + * ldap user suffix - used to store user accounts + * ldap machine suffix - used to store machine trust accounts + * ldap group suffix - location of posixGroup/sambaGroupMapping entries + * ldap idmap suffix - location of sambaIdmapEntry objects + +If an 'ldap suffix' is defined, it will be appended to all of the +remaining sub-suffix parameters. In this case, the order of the suffix +listings in smb.conf is important. Always place the 'ldap suffix' first +in the list. + +Due to a limitation in Samba's smb.conf parsing, you should not surround +the DN's with quotation marks. + + +IdMap LDAP support +------------------ -- New authentication system. The internal authentication system has - been almost completely rewritten. Most of the changes are internal, - but the new auth system is also very configurable. +Samba 3.0 supports an ldap backend for the idmap subsystem. The +following options would inform Samba that the idmap table should be +stored on the directory server onterose in the "ou=idmap,dc=plainjoe, +dc=org" partition. -- new filename mangling system. The filename mangling system has been - completely rewritten. An internal database now stores mangling maps - persistently. This needs lots of testing. + [global] + ... + idmap backend = ldap:ldap://onterose/ + ldap idmap suffix = ou=idmap,dc=plainjoe,dc=org + idmap uid = 40000-50000 + idmap gid = 40000-50000 -- new "net" command. A new "net" command has been added. It is - somewhat similar to the "net" command in windows. Eventually we plan - to replace a bunch of other utilities (such as smbpasswd) with - subcommands in "net", at the moment only a few things are - implemented. +This configuration allows winbind installations on multiple servers to +share a uid/gid number space, thus avoiding the interoperability problems +with NFS that were present in Samba 2.2. + -- Samba now negotiates NT-style status32 codes on the wire. This - improves error handling a lot. -- better w2k printing support. The support for printing from win2000 - clients has improved greatly. +###################################################################### +Trust Relationships and a Samba Domain +###################################### -Plus lots of other changes! +Samba 3.0.0beta2 is able to utilize winbindd as the means of +allocating uids and gids to trusted users and groups. More +information regarding Samba's support for establishing trust +relationships can be found in the Samba-HOWTO-Collection included +in the docs/ directory of this release. +First create your Samba PDC and ensure that everything is +working correctly before moving on the trusts. -Reporting bugs & Development Discussion ---------------------------------------- +To establish Samba as the trusting domain (named SAMBA) from a Windows NT +4.0 domain named WINDOWS: -Please discuss this release on the samba-technical mailing list or by -joining the #samba-technical IRC channel on irc.openprojects.net + 1) create the trust account for SAMBA in "User Manager for Domains" + 2) connect the trust from the Samba domain using + 'net rpc trustdom establish GLASS' -If you do report problems then please try to send high quality -feedback. If you don't provide vital information to help us track down -the problem then you will probably be ignored. +To create a trustlationship with SAMBA as the trusted domain: + 1) create the initial trust account for GLASS using + 'smbpasswd -a -i GLASS'. You may need to create a UNIX + account for GLASS$ prior to this step (depending on your + local configuration). + 2) connect the trust from a WINDOWS DC using "User Manager + for Domains" -Removed Parameters ------------------- +Now join winbindd on the Samba PDC to the SAMBA domain using +the normal steps for adding a Samba server to an NT4 domain: +(note that smbd & nmbd must be running at this point) - * postscript - * printer driver - * printer driver location - * printer driver file + root# net rpc join -U root + Password: -Added Parameters ---------------- +Start winbindd and test the join with 'wbinfo -t'. - * ldap trust ids - * acl compatibility - * mangle prefix +Now test the trust relationship by connecting to the SAMBA DC +(e.g. POGO) as a user from the WINDOWS domain: + $ smbclient //pogo/netlogon -U Administrator -W WINDOWS + Password: -Modified Parameters -------------------- +Now connect to the WINDOWS DC (e.g. CRYSTAL) as a Samba user: + + $ smbclient //crystal/netlogon -U root -W WINDOWS + Password: + +###################################################################### +Changes in Winbind +################## - * restrict anonymous - * password server - - -Changes in alpha21: - - See cvs log for SAMBA_3_0 for complete details. There are many - smaller numerous changes that would clutter the release notes. - -1) Numerous documentation updates including new Samba FAQ -2) Fixed logic error in checking wins server lists -3) Added more Solaris sendfile checks -4) Added --with-ldapsam for compatibility with 2.2.x Samba/LDAP setups -5) Add new client side support the Win2k LSARPC UUID in rpcbinds - Detect a native mode Win2k DC when in "security = domain" -6) Include Domain Local Groups in listing when a member of a native - mode Win2k domain -7) Fix ACL inheritance problem -8) Register <0x1c> name on unicast subnet -9) Removed stat() call in lp_add_home() -10) Change default of max_xmit to match W2K. Ensure NT negprot uses it -11) Merge the new ACL mapping code from Andreas Gruenbacher -12) Removed make_printerdef tool from build -13) Fix fd leak on printer queue tdb's -14) Better error/status loggin in both the pam_winbind client and - winbindd_pam -15) Fix fd leak with kernel change notify -16) Fix slowdown because of enumerating all print queues on every smbd startup -17) Fix --set-auth-user command to delete entries from the secrets file - when an empty username/password is passed on the command line -18) Added --get-auth-user to wbinfo for displaying account information - used to enumerate users and groups -19) Numerous updates for 'net rpc vampire' to migrate from an NT 4.0 Domain -20) Merge of scalable printing code from APP_HEAD -21) Numerous changes the passdb layer -22) More work on printer publishing in Active Directory -23) Enable "make modules" to build VFS libraries -24) Enable print notify messages on printer attributes from smbcontrol -25) Enable auto lookup of domain controllers when adding '*' to - "password server" parameter. Allows to have preferred list - of DC's, but not authoritative (e.g. password server = DC1 DC2 *) - - - - =============================== - -Changes in older alpha releases follow: - ---------------------------------------------------------------------- - -Changes in alpha20: - -1) Rework the 'guest account gets RID 501' code again... -2) Change to use NT-based session key negotiated for Win2k SPNEGO -3) Support printer data registry keys other than the default - PrinterDriverData -4) Moved internal printerdata to REGISTRY_VALUE object -5) Corrected bug in dependentfiles list of DRIVER_INFO_3 -6) fixed logic bug in blocking locks code -7) Updated registry api code to work with new printer data key - support -8) Added vfstest tool -9) round lock timeouts in lockingX upwards to multiples of 1 second -10) Fixed bugs in Printer Change Notify code -11) added a 'net ads lookup' command that does a CLDAP NetLogon - query to a win2000 server -12) Added script to find undocumented smb.conf parameters -13) Added missing parameters to smb.conf(5) -14) receive & parse main CLDAP reply from win2k server -15) removed "admin log" & "alternate permissions" parameters from smb.conf -16) added a generic print_guid utility, and get the byte order handing -17) fixed memory corruption in cli_full_connection() -18) remove unused 'max packet' and 'packet size' options -19) add support for the "value,OID" format described in MSDN for Printer - Data values -20) moves NT_TOKEN generation into our authentication code -21) Update documentation build system -22) Several fixes for IRIX compiler -23) Correctly handle "max data count" value in smb transacts -24) Fix for permissions error when adding/modifying using a Print - server handle -25) Fix pam_smbpass to always check the return value of pdb_getsampwnam() -26) Use the 'init' flag to determine if the UID is set, rather than testing - the uid for -1 -27) Cope with non-unix accounts ) we just won't get the groups for those users -28) Add 'net rpc getsid' to fetch the PDC's SID into the local secrets.tdb. - Print domain SID on 'net rpc info' -29) don't use lp_passwd_file() to retrieve NIS domain name, but use location - instead -30) Various POSIX compatibility fixes -31) Show only non-default values in testparm -32) Fix longstanding bug in Win2k clients by clearing the shortname - buffer before returning ascii short name. -33) Add example backtrace script -34) Added NETLOGON NetServerAuthenticate3 include and parser file -35) fix for difference in strsep and strtok semantics in nmbd -36) Ensure we don't change to a user that we can't get an NT_TOKEN for -37) Put back in BDC support in set_server_role() -38) added a 'net rpc samdump' command for dumping the whole sam via - samsync operations (as a BDC) -39) don't use spnego in the client unless enabled in smb.conf -40) Added some new delta types discovered by Ronnie from ethereal -41) Cope with negative cache dns entries better -42) do not expose special files, only files, directories and links -43) attempts to simplify Samba's external lib dependencies -44) support non-root-mode systems without getgrouplist() -45) Some fixes for SMB signing -46) Pass the object name down to the enum_printers client rpc -47) add the netatalk VFS module -48) Ensure we have at least smb_size bytes before processing a packet -49) Allow us to "lock" printer tdb entries in memory to stop them being - re-used as cache -50) fix 2 byte alignment/offset bug that prevented Win2k/XP clients - from receiving all the printer data in EnumPrinterDataEx() -51) Add option to compile new sam system can be enabled with the - configure option --with-sam -52) Added SGML/DocBook version of developer oriented docs to build process -53) Return correct FILE_SUPERSEDED response -54) Added example sam module (skeleton) -55) Add plugin support for the sam system (based on passdb code) -56) show builtin groups in samdump -57) Adding samtest utility used to test sam backends -58) fix connecting to a BDC when the PDC is down but in WINS and no bcast - can be used to find a BDC -58) convert the LDAP/SASL code to use GSS-SPNEGO if possible -59) added cli_net_auth_3 client code -60) merge of phant0m key fix from APP_HEAD -61) allow rpcclient's samlogon command to use cli_net_3() -62) Added attribute specific OPEN tests -63) Fix bug with stat mode open being done on read-only open with - truncate -64) Add lots of const casts to function parameters -65) Implemented some more client side spoolss functions -66) usrmgr expects UNICODE as ProductType -67) Change JOB_INFO_CTR to return a pointer to an array rather than array of - pointers in client code -68) Various NTLMSSP fixes -69) fixed crash bug in cli_connection code -70) DeletePrinterDriver[Ex]() fixes from APP_HEAD -71) remove some inet_aton() calls for portability -72) Set default ACB attributes on 'unixsam' accounts -73) Add bcast_msg_flags to connection struct -74) aggregate change notify events in the smbd sender and when transmitting -75) Added better error code on out of space in printer spool directory -76) Removed total jobs check ) not applicable any more -77) fixed bug in share enumeration RPC code -78) extend the ADS_STATUS system to include NTSTATUS -79) commit trusted domain patch n+3 -80) remove block VFS module -81) restrict readline headers to readline.c -82) merge of various recycle bin VFS patches -83) Winbind client-side cleanups -84) change parametric option name to vfs_recycle_bin it is more - sane and do not pollute standard options namespace too much -85) added --enable-python configure option for building the samba-python - unit tests -86) correct trans2 bugs in client for enumerating files/directories -87) Re-add OS/2 EA error codes -88) Added patch for required attributes in directory listings to reply code -89) Fix browse synchronization bug by noticing that W2K DMB's return empty - NetServerEnum2 on port 445, but not on port 139 -90) Fix semantics of AbortPrinter() spoolss call in server code -91) Ensure we've failed a lock with a lock denied message before automatically - pushing it onto the blocking queue -92) Added experimental sendfile code -93) Initialize user_rid value in WINBIND_USERINFO structure returned by - the rpc version of query_user() -94) added gencache implementation -95) Merge the cli_shutdown change from 2_2 -96) Fixes for DeletePrinterDriverEx() -97) Fixed alignment error in spoolss code -98) Changed Major/Minor version info reported to Server Manager to 4.9 -99) Applied new display mode FLAGS for SWAT -100) Update to add DEVELOPER option to more parameters -101) Added --with-ads option, defaults to yes -102) Added --with-ldap option to configure -103) Add clock skew handling to our kerberos code -104) correct race condition in password change code for out machine account - when a member of a domain -105) First implementation for 'net rpc vampire' -106) store current handle's Device Mode with print job -107) Move functionality to check whether entries for lp_workgroup() and - "BUILTIN" exist and add them if necessary from check_correct_backend_entries - into sam_context_check_default_backends -108) allow --with-krb5 to override the location of the kerberos libs on - redhat -109) unlink spool file after submitting print job when using CUPS api -110) Add framework for samtest commands -111) Add the ability to view/set the current local domain SIDs to net command -112) When creating a group you have to take care of the fact that the - underlying unix might not like the group name -113) Don't uppercase the username and domain in a session setup -114) Merge of "profile acls" code from SAMBA_2_2 -115) Check for existing of security descriptor in PRINTER_INFO_2 structure - in rpc client code -116) Move to common user token debugging, and ensure we always print both the - NT_TOKEN and the unix credentials -117) If adding a user to ldap, make sure we have the 'account' structural class, - or else we can't add to OpenLDAP 2.1 -118) Kill of Get_Pwnam_Modify and smb_getpwnam() -119) add a 'ldap passwd sync' option to smb.conf -120) Whenever we deal with adding machine/trusted domain accounts, always reset - the flag to what we expect -121) Fix the circular dependency that was preventing 'domain master = auto' (the - default) from working -122) move all the passdb internal interface to NTSTATUS -123) to expand % values (ie we go \\%L\%U -> \\server\user, we don't want to - store \\server\user back) and to correctly notice 'not set' compared to 'null - string' etc. -124) get some more of our access control bits right on the SAMR pipe -125) Add -r parameter to smbgroupedit. With -r you can manually choose - a rid - -Changes in alpha19 -1) Virtual registry framework with printing hooks (jerry) -2) Heavy registry updates (jerry) -3) Use 850 as the default DOS character set in smb.conf (tpot) -4) printer fixes ) removed encoding of queueid in job number (jra) -5) A lot of small fixes (jra) -6) Don't crash on setfileinfo on printer fsp(jra) -7) fixed line buffer mode in XFILE(jra) -8) update samba.schema from 2.2 (jerry,idra) -9) Fix problem with oplock breaks and win2k ) - noticed by Lev Iserovich (jra) -10) Update smbgroupedit to document -d ) thanks to metze (abartlet) -11) Support weird behaviour used by win9x pass-through auth (abartlet,tpot) -12) Support for duplicating stderr in log files (abartlet) -13) Move startup time initialisation to server.c (abartlet) -14) *A lot* of fixes and cleanups (abartlet) -15) Fix up compiler warnings (abartlet) -16) Few small fixes (tpot) -17) Renamed new_cli_netlogon_* -> cli_netlogon_* (tpot) -18) Fixed segfault in net time when host is unavailable (tridge) -19) Ensure to be root when opening printer backend tdb (jra) -20) Merges from APPLIANCE_HEAD (tpot,jerry) -21) configure updates (tridge) -22) getgrouplist() updates (tridge) -23) Support for pdbedit to query account policy values (abartlet) -24) Allow one to create trusting domain account using smbpasswd (mimir,abartlet) -25) 'Net rpc trustdom list' (mimir, abartlet) -26) Fix fallback to anonymous connection (mimir, abartlet) -27) Fix for pdb_ldap and OpenLDAP 2.1 -28) Added support in swat to determine whether winbind is running (idra) -29) Add 'hide unwritable' option (idra) -30) Correct pickup of [homes] share after subsequent session setups (abartlet) -31) Update rebind code in pdb_ldap (abartlet) -32) Add some info levels to RPC srvsvc code ) - thanks to Nigel Williams" (abartlet) -33) Small doc fixes (tridge) -34) good security patch from Timothy.Sell@unisys.com (tridge) -35) fix minor nits in nmbd from adtam@cup.hp.com (tridge) -36) make sure async dns nmbd child dies (tridge) -37) interim fix for nmbd not registering DOMAIN#1b (tridge) -38) fix for smbtar filename matching (tridge) -39) Better quote handling in smb.conf (abartlet) -40) Support browsers setting multiple languages in swat (idra) -41) Changed str_list_make to be able to use a different separator string (idra) -42) Samsync support to insert account info into the pdb (tpot) -43) Don't hide unwritable dirs when 'hide unwritable' is enabled ) - suggested by Alexander Oswald (idra) -44) Fix for handling sparse files in smbd (tridge) -45) Merges from 2_2 (jerry) -46) Minor printer fixes (jerry) -47) Add some checks to SID lookup code (abartlet) -48) Cascaded VFS (Alexander Bokovoy, idra) -49) Some netbios-less connections support in ADS mode (tridge) -50) ADS tweaks (tridge) -51) Fix plaintext passwords with win2k (tridge) -52) 'net ads info' reports IP of LDAP server (tridge) -53) Add some more RPC functions (jmcd) -54) Add 'smb ports = ' option (tridge) -55) Various small fixes (tridge) -56) Passdb security checks (abartlet) -57) Large winbind updates (abartlet) -58) Moved rpc client routines from libsmb to rpc_client (tpot) -59) Few nmbd fixes (jmcd) -60) Fix swat to handle new debug level code (idra) -61) Fix name length bug in namequeries (tridge) -62) Don't have client binaries depend on libs they don't use ) - patch from Steve Langasek (abartlet) -63) Printing change notification (merged from HEAD_APPLIANCE) (jerry) -64) fix delete printer driver (from HEAD_APPLIANCE) (jerry) -65) Added pdb_xml and pdb_mysql (jelmer) -66) Update pdb_test (jelmer) -67) Fix security issues with %m (abartlet) -68) Support for service joins from win2k AND use SPNEGO (jmcd) -69) pdbedit -i and -e fix, add -b (idra) -70) textdocs converted to sgml (jelmer, jerry) -71) Merge netbios namecache code from APPLIANCE_HEAD (tpot) -72) Fix segs in new NTLMSSP code (abartlet) -73) Always make guest rid 501 (abartlet) +Beginning with Samba3.0.0beta3, winbindd has been given new account +manage functionality equivalent to the 'add user script' family of +smb.conf parameters. The idmap design has also been changed to +centralize control of foreign SID lookups and matching to UNIX +uids and gids. +Brief Description of Changes +---------------------------- + +1) The sid_to_uid() family of functions (smbd/uid.c) have been + reverted to the 2.2.x design. This means that when resolving a + SID to a UID or similar mapping: + + a) First consult winbindd + b) perform a local lookup only if winbindd fails to + return a successful answer + + There are some variations to this, but these two rules generally + apply. + +2) All idmap lookups have been moved into winbindd. This means that + a server must run winbindd (and support NSS) in order to achieve + any mappings of SID to dynamically allocated UNIX ids. This was + a conscious design choice. + +3) New functions have been added to winbindd to emulate the 'add user + script' family of smbd functions without requiring that external + scripts be defined. This functionality is controlled by the 'winbind + enable local accounts' smb.conf parameter (enabled by default). + + However, this account management functionality is only supported + in a local tdb (winbindd_idmap.tdb). If these new UNIX accounts + must be shared among multiple Samba servers (such as a PDC and BDCs), + it will be necessary to define your own 'add user script', et. al. + programs that place the accounts/groups in some form of directory + such as NIS or LDAP. This requirement was deemed beyond the scope + of winbind's account management functions. Solutions for + distributing UNIX system information have been deployed and tested + for many years. We saw no need to reinvent the wheel. + +4) A member of a Samba controlled domain running winbindd is now able + to map domain users directly onto existing UNIX accounts while still + automatically creating accounts for trusted users and groups. This + behavior is controlled by the 'winbind trusted domains only' smb.conf + parameter (disabled by default to provide 2.2.x winbind behavior). + +5) Group mapping support is wrapped in the local_XX_to_XX() functions + in smbd/uid.c. The reason that group mappings are not included + in winbindd is because the purpose of Samba's group map is to + match any Windows SID with an existing UNIX group. These UNIX + groups can be created by winbindd (see next section), but the + SID<->gid mapping is retreived by smbd, not winbindd. + + +Examples +-------- + +* security = server running winbindd to allocate accounts on demand + +* Samba PDC running winbindd to handle the automatic creation of UNIX + identities for machine trust accounts + +* Automtically creating UNIX user and groups when migrating a Windows NT + 4.0 PDC to a Samba PDC. Winbindd must be running when executing + 'net rpc vampire' for this to work. + + +###################################################################### +Known Issues +############ + +* The smbldap perl scripts for managing user entries in an LDAP + directory have not be updated to function with the Samba 3.0 + schema changes. This (or an equivalent solution) work is planned + to be completed prior to the stable 3.0.0 release. + +Please refer to https://bugzilla.samba.org/ for a current list of bugs +filed against the Samba 3.0 codebase. + + +###################################################################### +Reporting bugs & Development Discussion +####################################### + +Please discuss this release on the samba-technical mailing list or by +joining the #samba-technical IRC channel on irc.freenode.net. + +If you do report problems then please try to send high quality +feedback. If you don't provide vital information to help us track down +the problem then you will probably be ignored. +A new bugzilla installation has been established to help support the +Samba 3.0 community of users. This server, located at +https://bugzilla.samba.org/, will replace the existing jitterbug server +and the old http://bugs.samba.org now points to the new bugzilla server. diff --git a/docs/Samba-Developers-Guide.pdf b/docs/Samba-Developers-Guide.pdf index 9dcb2a1825..a2aa5f1b84 100644 --- a/docs/Samba-Developers-Guide.pdf +++ b/docs/Samba-Developers-Guide.pdf @@ -369,6358 +369,7334 @@ endobj << /S /GoTo /D (chapter.9) >> endobj 252 0 obj -(9 NT Domain RPC's) +(9 Finding useful information on windows) endobj 253 0 obj << /S /GoTo /D (section.9.1) >> endobj 256 0 obj -(9.1 Introduction) +(9.1 Netlogon debugging output) endobj 257 0 obj -<< /S /GoTo /D (subsection.9.1.1) >> +<< /S /GoTo /D (chapter.10) >> endobj 260 0 obj -(9.1.1 Sources) +(10 NT Domain RPC's) endobj 261 0 obj -<< /S /GoTo /D (subsection.9.1.2) >> +<< /S /GoTo /D (section.10.1) >> endobj 264 0 obj -(9.1.2 Credits) +(10.1 Introduction) endobj 265 0 obj -<< /S /GoTo /D (section.9.2) >> +<< /S /GoTo /D (subsection.10.1.1) >> endobj 268 0 obj -(9.2 Notes and Structures) +(10.1.1 Sources) endobj 269 0 obj -<< /S /GoTo /D (subsection.9.2.1) >> +<< /S /GoTo /D (subsection.10.1.2) >> endobj 272 0 obj -(9.2.1 Notes) +(10.1.2 Credits) endobj 273 0 obj -<< /S /GoTo /D (subsection.9.2.2) >> +<< /S /GoTo /D (section.10.2) >> endobj 276 0 obj -(9.2.2 Enumerations) +(10.2 Notes and Structures) endobj 277 0 obj -<< /S /GoTo /D (subsubsection.9.2.2.1) >> +<< /S /GoTo /D (subsection.10.2.1) >> endobj 280 0 obj -(9.2.2.1 MSRPC Header type) +(10.2.1 Notes) endobj 281 0 obj -<< /S /GoTo /D (subsubsection.9.2.2.2) >> +<< /S /GoTo /D (subsection.10.2.2) >> endobj 284 0 obj -(9.2.2.2 MSRPC Packet info) +(10.2.2 Enumerations) endobj 285 0 obj -<< /S /GoTo /D (subsection.9.2.3) >> +<< /S /GoTo /D (subsubsection.10.2.2.1) >> endobj 288 0 obj -(9.2.3 Structures) +(10.2.2.1 MSRPC Header type) endobj 289 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.1) >> +<< /S /GoTo /D (subsubsection.10.2.2.2) >> endobj 292 0 obj -(9.2.3.1 VOID *) +(10.2.2.2 MSRPC Packet info) endobj 293 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.2) >> +<< /S /GoTo /D (subsection.10.2.3) >> endobj 296 0 obj -(9.2.3.2 char) +(10.2.3 Structures) endobj 297 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.3) >> +<< /S /GoTo /D (subsubsection.10.2.3.1) >> endobj 300 0 obj -(9.2.3.3 UTIME) +(10.2.3.1 VOID *) endobj 301 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.4) >> +<< /S /GoTo /D (subsubsection.10.2.3.2) >> endobj 304 0 obj -(9.2.3.4 NTTIME) +(10.2.3.2 char) endobj 305 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.5) >> +<< /S /GoTo /D (subsubsection.10.2.3.3) >> endobj 308 0 obj -(9.2.3.5 DOM\137SID \(domain SID structure\)) +(10.2.3.3 UTIME) endobj 309 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.6) >> +<< /S /GoTo /D (subsubsection.10.2.3.4) >> endobj 312 0 obj -(9.2.3.6 STR \(string\)) +(10.2.3.4 NTTIME) endobj 313 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.7) >> +<< /S /GoTo /D (subsubsection.10.2.3.5) >> endobj 316 0 obj -(9.2.3.7 UNIHDR \(unicode string header\)) +(10.2.3.5 DOM\137SID \(domain SID structure\)) endobj 317 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.8) >> +<< /S /GoTo /D (subsubsection.10.2.3.6) >> endobj 320 0 obj -(9.2.3.8 UNIHDR2 \(unicode string header plus buffer pointer\)) +(10.2.3.6 STR \(string\)) endobj 321 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.9) >> +<< /S /GoTo /D (subsubsection.10.2.3.7) >> endobj 324 0 obj -(9.2.3.9 UNISTR \(unicode string\)) +(10.2.3.7 UNIHDR \(unicode string header\)) endobj 325 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.10) >> +<< /S /GoTo /D (subsubsection.10.2.3.8) >> endobj 328 0 obj -(9.2.3.10 NAME \(length-indicated unicode string\)) +(10.2.3.8 UNIHDR2 \(unicode string header plus buffer pointer\)) endobj 329 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.11) >> +<< /S /GoTo /D (subsubsection.10.2.3.9) >> endobj 332 0 obj -(9.2.3.11 UNISTR2 \(aligned unicode string\)) +(10.2.3.9 UNISTR \(unicode string\)) endobj 333 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.12) >> +<< /S /GoTo /D (subsubsection.10.2.3.10) >> endobj 336 0 obj -(9.2.3.12 OBJ\137ATTR \(object attributes\)) +(10.2.3.10 NAME \(length-indicated unicode string\)) endobj 337 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.13) >> +<< /S /GoTo /D (subsubsection.10.2.3.11) >> endobj 340 0 obj -(9.2.3.13 POL\137HND \(LSA policy handle\)) +(10.2.3.11 UNISTR2 \(aligned unicode string\)) endobj 341 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.14) >> +<< /S /GoTo /D (subsubsection.10.2.3.12) >> endobj 344 0 obj -(9.2.3.14 DOM\137SID2 \(domain SID structure, SIDS stored in unicode\)) +(10.2.3.12 OBJ\137ATTR \(object attributes\)) endobj 345 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.15) >> +<< /S /GoTo /D (subsubsection.10.2.3.13) >> endobj 348 0 obj -(9.2.3.15 DOM\137RID \(domain RID structure\)) +(10.2.3.13 POL\137HND \(LSA policy handle\)) endobj 349 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.16) >> +<< /S /GoTo /D (subsubsection.10.2.3.14) >> endobj 352 0 obj -(9.2.3.16 LOG\137INFO \(server, account, client structure\)) +(10.2.3.14 DOM\137SID2 \(domain SID structure, SIDS stored in unicode\)) endobj 353 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.17) >> +<< /S /GoTo /D (subsubsection.10.2.3.15) >> endobj 356 0 obj -(9.2.3.17 CLNT\137SRV \(server, client names structure\)) +(10.2.3.15 DOM\137RID \(domain RID structure\)) endobj 357 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.18) >> +<< /S /GoTo /D (subsubsection.10.2.3.16) >> endobj 360 0 obj -(9.2.3.18 CREDS \(credentials + time stamp\)) +(10.2.3.16 LOG\137INFO \(server, account, client structure\)) endobj 361 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.19) >> +<< /S /GoTo /D (subsubsection.10.2.3.17) >> endobj 364 0 obj -(9.2.3.19 CLNT\137INFO2 \(server, client structure, client credentials\)) +(10.2.3.17 CLNT\137SRV \(server, client names structure\)) endobj 365 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.20) >> +<< /S /GoTo /D (subsubsection.10.2.3.18) >> endobj 368 0 obj -(9.2.3.20 CLNT\137INFO \(server, account, client structure, client credentials\)) +(10.2.3.18 CREDS \(credentials + time stamp\)) endobj 369 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.21) >> +<< /S /GoTo /D (subsubsection.10.2.3.19) >> endobj 372 0 obj -(9.2.3.21 ID\137INFO\1371 \(id info structure, auth level 1\)) +(10.2.3.19 CLNT\137INFO2 \(server, client structure, client credentials\)) endobj 373 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.22) >> +<< /S /GoTo /D (subsubsection.10.2.3.20) >> endobj 376 0 obj -(9.2.3.22 SAM\137INFO \(sam logon/logoff id info structure\)) +(10.2.3.20 CLNT\137INFO \(server, account, client structure, client credentials\)) endobj 377 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.23) >> +<< /S /GoTo /D (subsubsection.10.2.3.21) >> endobj 380 0 obj -(9.2.3.23 GID \(group id info\)) +(10.2.3.21 ID\137INFO\1371 \(id info structure, auth level 1\)) endobj 381 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.24) >> +<< /S /GoTo /D (subsubsection.10.2.3.22) >> endobj 384 0 obj -(9.2.3.24 DOM\137REF \(domain reference info\)) +(10.2.3.22 SAM\137INFO \(sam logon/logoff id info structure\)) endobj 385 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.25) >> +<< /S /GoTo /D (subsubsection.10.2.3.23) >> endobj 388 0 obj -(9.2.3.25 DOM\137INFO \(domain info, levels 3 and 5 are the same\)\)) +(10.2.3.23 GID \(group id info\)) endobj 389 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.26) >> +<< /S /GoTo /D (subsubsection.10.2.3.24) >> endobj 392 0 obj -(9.2.3.26 USER\137INFO \(user logon info\)) +(10.2.3.24 DOM\137REF \(domain reference info\)) endobj 393 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.27) >> +<< /S /GoTo /D (subsubsection.10.2.3.25) >> endobj 396 0 obj -(9.2.3.27 SH\137INFO\1371\137PTR \(pointers to level 1 share info strings\)) +(10.2.3.25 DOM\137INFO \(domain info, levels 3 and 5 are the same\)\)) endobj 397 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.28) >> +<< /S /GoTo /D (subsubsection.10.2.3.26) >> endobj 400 0 obj -(9.2.3.28 SH\137INFO\1371\137STR \(level 1 share info strings\)) +(10.2.3.26 USER\137INFO \(user logon info\)) endobj 401 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.29) >> +<< /S /GoTo /D (subsubsection.10.2.3.27) >> endobj 404 0 obj -(9.2.3.29 SHARE\137INFO\1371\137CTR) +(10.2.3.27 SH\137INFO\1371\137PTR \(pointers to level 1 share info strings\)) endobj 405 0 obj -<< /S /GoTo /D (subsubsection.9.2.3.30) >> +<< /S /GoTo /D (subsubsection.10.2.3.28) >> endobj 408 0 obj -(9.2.3.30 SERVER\137INFO\137101) +(10.2.3.28 SH\137INFO\1371\137STR \(level 1 share info strings\)) endobj 409 0 obj -<< /S /GoTo /D (section.9.3) >> +<< /S /GoTo /D (subsubsection.10.2.3.29) >> endobj 412 0 obj -(9.3 MSRPC over Transact Named Pipe) +(10.2.3.29 SHARE\137INFO\1371\137CTR) endobj 413 0 obj -<< /S /GoTo /D (subsection.9.3.1) >> +<< /S /GoTo /D (subsubsection.10.2.3.30) >> endobj 416 0 obj -(9.3.1 MSRPC Pipes) +(10.2.3.30 SERVER\137INFO\137101) endobj 417 0 obj -<< /S /GoTo /D (subsection.9.3.2) >> +<< /S /GoTo /D (section.10.3) >> endobj 420 0 obj -(9.3.2 Header) +(10.3 MSRPC over Transact Named Pipe) endobj 421 0 obj -<< /S /GoTo /D (subsubsection.9.3.2.1) >> +<< /S /GoTo /D (subsection.10.3.1) >> endobj 424 0 obj -(9.3.2.1 RPC\137Packet for request, response, bind and bind acknowledgement) +(10.3.1 MSRPC Pipes) endobj 425 0 obj -<< /S /GoTo /D (subsubsection.9.3.2.2) >> +<< /S /GoTo /D (subsection.10.3.2) >> endobj 428 0 obj -(9.3.2.2 Interface identification) +(10.3.2 Header) endobj 429 0 obj -<< /S /GoTo /D (subsubsection.9.3.2.3) >> +<< /S /GoTo /D (subsubsection.10.3.2.1) >> endobj 432 0 obj -(9.3.2.3 RPC\137Iface RW) +(10.3.2.1 RPC\137Packet for request, response, bind and bind acknowledgement) endobj 433 0 obj -<< /S /GoTo /D (subsubsection.9.3.2.4) >> +<< /S /GoTo /D (subsubsection.10.3.2.2) >> endobj 436 0 obj -(9.3.2.4 RPC\137ReqBind RW) +(10.3.2.2 Interface identification) endobj 437 0 obj -<< /S /GoTo /D (subsubsection.9.3.2.5) >> +<< /S /GoTo /D (subsubsection.10.3.2.3) >> endobj 440 0 obj -(9.3.2.5 RPC\137Address RW) +(10.3.2.3 RPC\137Iface RW) endobj 441 0 obj -<< /S /GoTo /D (subsubsection.9.3.2.6) >> +<< /S /GoTo /D (subsubsection.10.3.2.4) >> endobj 444 0 obj -(9.3.2.6 RPC\137ResBind RW) +(10.3.2.4 RPC\137ReqBind RW) endobj 445 0 obj -<< /S /GoTo /D (subsubsection.9.3.2.7) >> +<< /S /GoTo /D (subsubsection.10.3.2.5) >> endobj 448 0 obj -(9.3.2.7 RPC\137ReqNorm RW) +(10.3.2.5 RPC\137Address RW) endobj 449 0 obj -<< /S /GoTo /D (subsubsection.9.3.2.8) >> +<< /S /GoTo /D (subsubsection.10.3.2.6) >> endobj 452 0 obj -(9.3.2.8 RPC\137ResNorm RW) +(10.3.2.6 RPC\137ResBind RW) endobj 453 0 obj -<< /S /GoTo /D (subsection.9.3.3) >> +<< /S /GoTo /D (subsubsection.10.3.2.7) >> endobj 456 0 obj -(9.3.3 Tail) +(10.3.2.7 RPC\137ReqNorm RW) endobj 457 0 obj -<< /S /GoTo /D (subsection.9.3.4) >> +<< /S /GoTo /D (subsubsection.10.3.2.8) >> endobj 460 0 obj -(9.3.4 RPC Bind / Bind Ack) +(10.3.2.8 RPC\137ResNorm RW) endobj 461 0 obj -<< /S /GoTo /D (subsection.9.3.5) >> +<< /S /GoTo /D (subsection.10.3.3) >> endobj 464 0 obj -(9.3.5 NTLSA Transact Named Pipe) +(10.3.3 Tail) endobj 465 0 obj -<< /S /GoTo /D (subsection.9.3.6) >> +<< /S /GoTo /D (subsection.10.3.4) >> endobj 468 0 obj -(9.3.6 LSA Open Policy) +(10.3.4 RPC Bind / Bind Ack) endobj 469 0 obj -<< /S /GoTo /D (subsubsection.9.3.6.1) >> +<< /S /GoTo /D (subsection.10.3.5) >> endobj 472 0 obj -(9.3.6.1 Request) +(10.3.5 NTLSA Transact Named Pipe) endobj 473 0 obj -<< /S /GoTo /D (subsubsection.9.3.6.2) >> +<< /S /GoTo /D (subsection.10.3.6) >> endobj 476 0 obj -(9.3.6.2 Response) +(10.3.6 LSA Open Policy) endobj 477 0 obj -<< /S /GoTo /D (subsection.9.3.7) >> +<< /S /GoTo /D (subsubsection.10.3.6.1) >> endobj 480 0 obj -(9.3.7 LSA Query Info Policy) +(10.3.6.1 Request) endobj 481 0 obj -<< /S /GoTo /D (subsubsection.9.3.7.1) >> +<< /S /GoTo /D (subsubsection.10.3.6.2) >> endobj 484 0 obj -(9.3.7.1 Request) +(10.3.6.2 Response) endobj 485 0 obj -<< /S /GoTo /D (subsubsection.9.3.7.2) >> +<< /S /GoTo /D (subsection.10.3.7) >> endobj 488 0 obj -(9.3.7.2 Response) +(10.3.7 LSA Query Info Policy) endobj 489 0 obj -<< /S /GoTo /D (subsection.9.3.8) >> +<< /S /GoTo /D (subsubsection.10.3.7.1) >> endobj 492 0 obj -(9.3.8 LSA Enumerate Trusted Domains) +(10.3.7.1 Request) endobj 493 0 obj -<< /S /GoTo /D (subsubsection.9.3.8.1) >> +<< /S /GoTo /D (subsubsection.10.3.7.2) >> endobj 496 0 obj -(9.3.8.1 Request) +(10.3.7.2 Response) endobj 497 0 obj -<< /S /GoTo /D (subsubsection.9.3.8.2) >> +<< /S /GoTo /D (subsection.10.3.8) >> endobj 500 0 obj -(9.3.8.2 Response) +(10.3.8 LSA Enumerate Trusted Domains) endobj 501 0 obj -<< /S /GoTo /D (subsection.9.3.9) >> +<< /S /GoTo /D (subsubsection.10.3.8.1) >> endobj 504 0 obj -(9.3.9 LSA Open Secret) +(10.3.8.1 Request) endobj 505 0 obj -<< /S /GoTo /D (subsubsection.9.3.9.1) >> +<< /S /GoTo /D (subsubsection.10.3.8.2) >> endobj 508 0 obj -(9.3.9.1 Request) +(10.3.8.2 Response) endobj 509 0 obj -<< /S /GoTo /D (subsubsection.9.3.9.2) >> +<< /S /GoTo /D (subsection.10.3.9) >> endobj 512 0 obj -(9.3.9.2 Response) +(10.3.9 LSA Open Secret) endobj 513 0 obj -<< /S /GoTo /D (subsection.9.3.10) >> +<< /S /GoTo /D (subsubsection.10.3.9.1) >> endobj 516 0 obj -(9.3.10 LSA Close) +(10.3.9.1 Request) endobj 517 0 obj -<< /S /GoTo /D (subsubsection.9.3.10.1) >> +<< /S /GoTo /D (subsubsection.10.3.9.2) >> endobj 520 0 obj -(9.3.10.1 Request) +(10.3.9.2 Response) endobj 521 0 obj -<< /S /GoTo /D (subsubsection.9.3.10.2) >> +<< /S /GoTo /D (subsection.10.3.10) >> endobj 524 0 obj -(9.3.10.2 Response) +(10.3.10 LSA Close) endobj 525 0 obj -<< /S /GoTo /D (subsection.9.3.11) >> +<< /S /GoTo /D (subsubsection.10.3.10.1) >> endobj 528 0 obj -(9.3.11 LSA Lookup SIDS) +(10.3.10.1 Request) endobj 529 0 obj -<< /S /GoTo /D (subsubsection.9.3.11.1) >> +<< /S /GoTo /D (subsubsection.10.3.10.2) >> endobj 532 0 obj -(9.3.11.1 Request) +(10.3.10.2 Response) endobj 533 0 obj -<< /S /GoTo /D (subsubsection.9.3.11.2) >> +<< /S /GoTo /D (subsection.10.3.11) >> endobj 536 0 obj -(9.3.11.2 Response) +(10.3.11 LSA Lookup SIDS) endobj 537 0 obj -<< /S /GoTo /D (subsection.9.3.12) >> +<< /S /GoTo /D (subsubsection.10.3.11.1) >> endobj 540 0 obj -(9.3.12 LSA Lookup Names) +(10.3.11.1 Request) endobj 541 0 obj -<< /S /GoTo /D (subsubsection.9.3.12.1) >> +<< /S /GoTo /D (subsubsection.10.3.11.2) >> endobj 544 0 obj -(9.3.12.1 Request) +(10.3.11.2 Response) endobj 545 0 obj -<< /S /GoTo /D (subsubsection.9.3.12.2) >> +<< /S /GoTo /D (subsection.10.3.12) >> endobj 548 0 obj -(9.3.12.2 Response) +(10.3.12 LSA Lookup Names) endobj 549 0 obj -<< /S /GoTo /D (section.9.4) >> +<< /S /GoTo /D (subsubsection.10.3.12.1) >> endobj 552 0 obj -(9.4 NETLOGON rpc Transact Named Pipe) +(10.3.12.1 Request) endobj 553 0 obj -<< /S /GoTo /D (subsection.9.4.1) >> +<< /S /GoTo /D (subsubsection.10.3.12.2) >> endobj 556 0 obj -(9.4.1 LSA Request Challenge) +(10.3.12.2 Response) endobj 557 0 obj -<< /S /GoTo /D (subsubsection.9.4.1.1) >> +<< /S /GoTo /D (section.10.4) >> endobj 560 0 obj -(9.4.1.1 Request) +(10.4 NETLOGON rpc Transact Named Pipe) endobj 561 0 obj -<< /S /GoTo /D (subsubsection.9.4.1.2) >> +<< /S /GoTo /D (subsection.10.4.1) >> endobj 564 0 obj -(9.4.1.2 Response) +(10.4.1 LSA Request Challenge) endobj 565 0 obj -<< /S /GoTo /D (subsection.9.4.2) >> +<< /S /GoTo /D (subsubsection.10.4.1.1) >> endobj 568 0 obj -(9.4.2 LSA Authenticate 2) +(10.4.1.1 Request) endobj 569 0 obj -<< /S /GoTo /D (subsubsection.9.4.2.1) >> +<< /S /GoTo /D (subsubsection.10.4.1.2) >> endobj 572 0 obj -(9.4.2.1 Request) +(10.4.1.2 Response) endobj 573 0 obj -<< /S /GoTo /D (subsubsection.9.4.2.2) >> +<< /S /GoTo /D (subsection.10.4.2) >> endobj 576 0 obj -(9.4.2.2 Response) +(10.4.2 LSA Authenticate 2) endobj 577 0 obj -<< /S /GoTo /D (subsection.9.4.3) >> +<< /S /GoTo /D (subsubsection.10.4.2.1) >> endobj 580 0 obj -(9.4.3 LSA Server Password Set) +(10.4.2.1 Request) endobj 581 0 obj -<< /S /GoTo /D (subsubsection.9.4.3.1) >> +<< /S /GoTo /D (subsubsection.10.4.2.2) >> endobj 584 0 obj -(9.4.3.1 Request) +(10.4.2.2 Response) endobj 585 0 obj -<< /S /GoTo /D (subsubsection.9.4.3.2) >> +<< /S /GoTo /D (subsection.10.4.3) >> endobj 588 0 obj -(9.4.3.2 Response) +(10.4.3 LSA Server Password Set) endobj 589 0 obj -<< /S /GoTo /D (subsection.9.4.4) >> +<< /S /GoTo /D (subsubsection.10.4.3.1) >> endobj 592 0 obj -(9.4.4 LSA SAM Logon) +(10.4.3.1 Request) endobj 593 0 obj -<< /S /GoTo /D (subsubsection.9.4.4.1) >> +<< /S /GoTo /D (subsubsection.10.4.3.2) >> endobj 596 0 obj -(9.4.4.1 Request) +(10.4.3.2 Response) endobj 597 0 obj -<< /S /GoTo /D (subsubsection.9.4.4.2) >> +<< /S /GoTo /D (subsection.10.4.4) >> endobj 600 0 obj -(9.4.4.2 Response) +(10.4.4 LSA SAM Logon) endobj 601 0 obj -<< /S /GoTo /D (subsection.9.4.5) >> +<< /S /GoTo /D (subsubsection.10.4.4.1) >> endobj 604 0 obj -(9.4.5 LSA SAM Logoff) +(10.4.4.1 Request) endobj 605 0 obj -<< /S /GoTo /D (subsubsection.9.4.5.1) >> +<< /S /GoTo /D (subsubsection.10.4.4.2) >> endobj 608 0 obj -(9.4.5.1 Request) +(10.4.4.2 Response) endobj 609 0 obj -<< /S /GoTo /D (subsubsection.9.4.5.2) >> +<< /S /GoTo /D (subsection.10.4.5) >> endobj 612 0 obj -(9.4.5.2 Response) +(10.4.5 LSA SAM Logoff) endobj 613 0 obj -<< /S /GoTo /D (section.9.5) >> +<< /S /GoTo /D (subsubsection.10.4.5.1) >> endobj 616 0 obj -(9.5 \134\134MAILSLOT\134NET\134NTLOGON) +(10.4.5.1 Request) endobj 617 0 obj -<< /S /GoTo /D (subsection.9.5.1) >> +<< /S /GoTo /D (subsubsection.10.4.5.2) >> endobj 620 0 obj -(9.5.1 Query for PDC) +(10.4.5.2 Response) endobj 621 0 obj -<< /S /GoTo /D (subsubsection.9.5.1.1) >> +<< /S /GoTo /D (section.10.5) >> endobj 624 0 obj -(9.5.1.1 Request) +(10.5 \134\134MAILSLOT\134NET\134NTLOGON) endobj 625 0 obj -<< /S /GoTo /D (subsubsection.9.5.1.2) >> +<< /S /GoTo /D (subsection.10.5.1) >> endobj 628 0 obj -(9.5.1.2 Response) +(10.5.1 Query for PDC) endobj 629 0 obj -<< /S /GoTo /D (subsection.9.5.2) >> +<< /S /GoTo /D (subsubsection.10.5.1.1) >> endobj 632 0 obj -(9.5.2 SAM Logon) +(10.5.1.1 Request) endobj 633 0 obj -<< /S /GoTo /D (subsubsection.9.5.2.1) >> +<< /S /GoTo /D (subsubsection.10.5.1.2) >> endobj 636 0 obj -(9.5.2.1 Request) +(10.5.1.2 Response) endobj 637 0 obj -<< /S /GoTo /D (subsubsection.9.5.2.2) >> +<< /S /GoTo /D (subsection.10.5.2) >> endobj 640 0 obj -(9.5.2.2 Response) +(10.5.2 SAM Logon) endobj 641 0 obj -<< /S /GoTo /D (section.9.6) >> +<< /S /GoTo /D (subsubsection.10.5.2.1) >> endobj 644 0 obj -(9.6 SRVSVC Transact Named Pipe) +(10.5.2.1 Request) endobj 645 0 obj -<< /S /GoTo /D (subsection.9.6.1) >> +<< /S /GoTo /D (subsubsection.10.5.2.2) >> endobj 648 0 obj -(9.6.1 Net Share Enum) +(10.5.2.2 Response) endobj 649 0 obj -<< /S /GoTo /D (subsubsection.9.6.1.1) >> +<< /S /GoTo /D (section.10.6) >> endobj 652 0 obj -(9.6.1.1 Request) +(10.6 SRVSVC Transact Named Pipe) endobj 653 0 obj -<< /S /GoTo /D (subsubsection.9.6.1.2) >> +<< /S /GoTo /D (subsection.10.6.1) >> endobj 656 0 obj -(9.6.1.2 Response) +(10.6.1 Net Share Enum) endobj 657 0 obj -<< /S /GoTo /D (subsection.9.6.2) >> +<< /S /GoTo /D (subsubsection.10.6.1.1) >> endobj 660 0 obj -(9.6.2 Net Server Get Info) +(10.6.1.1 Request) endobj 661 0 obj -<< /S /GoTo /D (subsubsection.9.6.2.1) >> +<< /S /GoTo /D (subsubsection.10.6.1.2) >> endobj 664 0 obj -(9.6.2.1 Request) +(10.6.1.2 Response) endobj 665 0 obj -<< /S /GoTo /D (subsubsection.9.6.2.2) >> +<< /S /GoTo /D (subsection.10.6.2) >> endobj 668 0 obj -(9.6.2.2 Response) +(10.6.2 Net Server Get Info) endobj 669 0 obj -<< /S /GoTo /D (section.9.7) >> +<< /S /GoTo /D (subsubsection.10.6.2.1) >> endobj 672 0 obj -(9.7 Cryptographic side of NT Domain Authentication) +(10.6.2.1 Request) endobj 673 0 obj -<< /S /GoTo /D (subsection.9.7.1) >> +<< /S /GoTo /D (subsubsection.10.6.2.2) >> endobj 676 0 obj -(9.7.1 Definitions) +(10.6.2.2 Response) endobj 677 0 obj -<< /S /GoTo /D (subsection.9.7.2) >> +<< /S /GoTo /D (section.10.7) >> endobj 680 0 obj -(9.7.2 Protocol) +(10.7 Cryptographic side of NT Domain Authentication) endobj 681 0 obj -<< /S /GoTo /D (subsection.9.7.3) >> +<< /S /GoTo /D (subsection.10.7.1) >> endobj 684 0 obj -(9.7.3 Comments) +(10.7.1 Definitions) endobj 685 0 obj -<< /S /GoTo /D (section.9.8) >> +<< /S /GoTo /D (subsection.10.7.2) >> endobj 688 0 obj -(9.8 SIDs and RIDs) +(10.7.2 Protocol) endobj 689 0 obj -<< /S /GoTo /D (subsection.9.8.1) >> +<< /S /GoTo /D (subsection.10.7.3) >> endobj 692 0 obj -(9.8.1 Well-known SIDs) +(10.7.3 Comments) endobj 693 0 obj -<< /S /GoTo /D (subsubsection.9.8.1.1) >> +<< /S /GoTo /D (section.10.8) >> endobj 696 0 obj -(9.8.1.1 Universal well-known SIDs) +(10.8 SIDs and RIDs) endobj 697 0 obj -<< /S /GoTo /D (subsubsection.9.8.1.2) >> +<< /S /GoTo /D (subsection.10.8.1) >> endobj 700 0 obj -(9.8.1.2 NT well-known SIDs) +(10.8.1 Well-known SIDs) endobj 701 0 obj -<< /S /GoTo /D (subsection.9.8.2) >> +<< /S /GoTo /D (subsubsection.10.8.1.1) >> endobj 704 0 obj -(9.8.2 Well-known RIDS) +(10.8.1.1 Universal well-known SIDs) endobj 705 0 obj -<< /S /GoTo /D (subsubsection.9.8.2.1) >> +<< /S /GoTo /D (subsubsection.10.8.1.2) >> endobj 708 0 obj -(9.8.2.1 Well-known RID users) +(10.8.1.2 NT well-known SIDs) endobj 709 0 obj -<< /S /GoTo /D (subsubsection.9.8.2.2) >> +<< /S /GoTo /D (subsection.10.8.2) >> endobj 712 0 obj -(9.8.2.2 Well-known RID groups) +(10.8.2 Well-known RIDS) endobj 713 0 obj -<< /S /GoTo /D (subsubsection.9.8.2.3) >> +<< /S /GoTo /D (subsubsection.10.8.2.1) >> endobj 716 0 obj -(9.8.2.3 Well-known RID aliases) +(10.8.2.1 Well-known RID users) endobj 717 0 obj -<< /S /GoTo /D (chapter.10) >> +<< /S /GoTo /D (subsubsection.10.8.2.2) >> endobj 720 0 obj -(10 Samba Printing Internals) +(10.8.2.2 Well-known RID groups) endobj 721 0 obj -<< /S /GoTo /D (section.10.1) >> +<< /S /GoTo /D (subsubsection.10.8.2.3) >> endobj 724 0 obj -(10.1 Abstract) +(10.8.2.3 Well-known RID aliases) endobj 725 0 obj -<< /S /GoTo /D (section.10.2) >> +<< /S /GoTo /D (chapter.11) >> endobj 728 0 obj -(10.2 Printing Interface to Various Back ends) +(11 Samba Printing Internals) endobj 729 0 obj -<< /S /GoTo /D (section.10.3) >> +<< /S /GoTo /D (section.11.1) >> endobj 732 0 obj -(10.3 Print Queue TDB's) +(11.1 Abstract) endobj 733 0 obj -<< /S /GoTo /D (section.10.4) >> +<< /S /GoTo /D (section.11.2) >> endobj 736 0 obj -(10.4 ChangeID and Client Caching of Printer Information) +(11.2 Printing Interface to Various Back ends) endobj 737 0 obj -<< /S /GoTo /D (section.10.5) >> +<< /S /GoTo /D (section.11.3) >> endobj 740 0 obj -(10.5 Windows NT/2K Printer Change Notify) +(11.3 Print Queue TDB's) endobj 741 0 obj -<< /S /GoTo /D (chapter.11) >> +<< /S /GoTo /D (section.11.4) >> endobj 744 0 obj -(11 Samba WINS Internals) +(11.4 ChangeID and Client Caching of Printer Information) endobj 745 0 obj -<< /S /GoTo /D (section.11.1) >> +<< /S /GoTo /D (section.11.5) >> endobj 748 0 obj -(11.1 WINS Failover) +(11.5 Windows NT/2K Printer Change Notify) endobj 749 0 obj << /S /GoTo /D (chapter.12) >> endobj 752 0 obj -(12 The Upcoming SAM System) +(12 Samba WINS Internals) endobj 753 0 obj << /S /GoTo /D (section.12.1) >> endobj 756 0 obj -(12.1 Security in the 'new SAM') +(12.1 WINS Failover) endobj 757 0 obj -<< /S /GoTo /D (section.12.2) >> +<< /S /GoTo /D (chapter.13) >> endobj 760 0 obj -(12.2 Standalone from UNIX) +(13 The Upcoming SAM System) endobj 761 0 obj -<< /S /GoTo /D (section.12.3) >> +<< /S /GoTo /D (section.13.1) >> endobj 764 0 obj -(12.3 Handles and Races in the new SAM) +(13.1 Security in the 'new SAM') endobj 765 0 obj -<< /S /GoTo /D (section.12.4) >> +<< /S /GoTo /D (section.13.2) >> endobj 768 0 obj -(12.4 Layers) +(13.2 Standalone from UNIX) endobj 769 0 obj -<< /S /GoTo /D (subsection.12.4.1) >> +<< /S /GoTo /D (section.13.3) >> endobj 772 0 obj -(12.4.1 Application) +(13.3 Handles and Races in the new SAM) endobj 773 0 obj -<< /S /GoTo /D (subsection.12.4.2) >> +<< /S /GoTo /D (section.13.4) >> endobj 776 0 obj -(12.4.2 SAM Interface) +(13.4 Layers) endobj 777 0 obj -<< /S /GoTo /D (subsection.12.4.3) >> +<< /S /GoTo /D (subsection.13.4.1) >> endobj 780 0 obj -(12.4.3 SAM Modules) +(13.4.1 Application) endobj 781 0 obj -<< /S /GoTo /D (section.12.5) >> +<< /S /GoTo /D (subsection.13.4.2) >> endobj 784 0 obj -(12.5 SAM Modules) +(13.4.2 SAM Interface) endobj 785 0 obj -<< /S /GoTo /D (subsection.12.5.1) >> +<< /S /GoTo /D (subsection.13.4.3) >> endobj 788 0 obj -(12.5.1 Special Module: sam\137passdb) +(13.4.3 SAM Modules) endobj 789 0 obj -<< /S /GoTo /D (subsection.12.5.2) >> +<< /S /GoTo /D (section.13.5) >> endobj 792 0 obj -(12.5.2 sam\137ads) +(13.5 SAM Modules) endobj 793 0 obj -<< /S /GoTo /D (section.12.6) >> +<< /S /GoTo /D (subsection.13.5.1) >> endobj 796 0 obj -(12.6 Memory Management) +(13.5.1 Special Module: sam\137passdb) endobj 797 0 obj -<< /S /GoTo /D (section.12.7) >> +<< /S /GoTo /D (subsection.13.5.2) >> endobj 800 0 obj -(12.7 Testing) +(13.5.2 sam\137ads) endobj 801 0 obj -<< /S /GoTo /D (chapter.13) >> +<< /S /GoTo /D (section.13.6) >> endobj 804 0 obj -(13 LanMan and NT Password Encryption) +(13.6 Memory Management) endobj 805 0 obj -<< /S /GoTo /D (section.13.1) >> +<< /S /GoTo /D (section.13.7) >> endobj 808 0 obj -(13.1 Introduction) +(13.7 Testing) endobj 809 0 obj -<< /S /GoTo /D (section.13.2) >> +<< /S /GoTo /D (chapter.14) >> endobj 812 0 obj -(13.2 How does it work?) +(14 LanMan and NT Password Encryption) endobj 813 0 obj -<< /S /GoTo /D (section.13.3) >> +<< /S /GoTo /D (section.14.1) >> endobj 816 0 obj -(13.3 The smbpasswd file) +(14.1 Introduction) endobj 817 0 obj -<< /S /GoTo /D (chapter.14) >> +<< /S /GoTo /D (section.14.2) >> endobj 820 0 obj -(14 Modules) +(14.2 How does it work?) endobj 821 0 obj -<< /S /GoTo /D (section.14.1) >> +<< /S /GoTo /D (section.14.3) >> endobj 824 0 obj -(14.1 Advantages) +(14.3 The smbpasswd file) endobj 825 0 obj -<< /S /GoTo /D (section.14.2) >> +<< /S /GoTo /D (chapter.15) >> endobj 828 0 obj -(14.2 Loading modules) +(15 Modules) endobj 829 0 obj -<< /S /GoTo /D (subsection.14.2.1) >> +<< /S /GoTo /D (section.15.1) >> endobj 832 0 obj -(14.2.1 Static modules) +(15.1 Advantages) endobj 833 0 obj -<< /S /GoTo /D (subsection.14.2.2) >> +<< /S /GoTo /D (section.15.2) >> endobj 836 0 obj -(14.2.2 Shared modules) +(15.2 Loading modules) endobj 837 0 obj -<< /S /GoTo /D (section.14.3) >> +<< /S /GoTo /D (subsection.15.2.1) >> endobj 840 0 obj -(14.3 Writing modules) +(15.2.1 Static modules) endobj 841 0 obj -<< /S /GoTo /D (subsection.14.3.1) >> +<< /S /GoTo /D (subsection.15.2.2) >> endobj 844 0 obj -(14.3.1 Static/Shared selection in configure.in) +(15.2.2 Shared modules) endobj 845 0 obj -<< /S /GoTo /D (chapter.15) >> +<< /S /GoTo /D (section.15.3) >> endobj 848 0 obj -(15 RPC Pluggable Modules) +(15.3 Writing modules) endobj 849 0 obj -<< /S /GoTo /D (section.15.1) >> +<< /S /GoTo /D (subsection.15.3.1) >> endobj 852 0 obj -(15.1 About) +(15.3.1 Static/Shared selection in configure.in) endobj 853 0 obj -<< /S /GoTo /D (section.15.2) >> +<< /S /GoTo /D (chapter.16) >> endobj 856 0 obj -(15.2 General Overview) +(16 RPC Pluggable Modules) endobj 857 0 obj -<< /S /GoTo /D (chapter.16) >> +<< /S /GoTo /D (section.16.1) >> endobj 860 0 obj -(16 Notes to packagers) +(16.1 About) endobj 861 0 obj -<< /S /GoTo /D (section.16.1) >> +<< /S /GoTo /D (section.16.2) >> endobj 864 0 obj -(16.1 Versioning) +(16.2 General Overview) endobj 865 0 obj -<< /S /GoTo /D (section.16.2) >> +<< /S /GoTo /D (chapter.17) >> endobj 868 0 obj -(16.2 Modules) +(17 VFS Modules) endobj 869 0 obj -<< /S /GoTo /D [870 0 R /Fit ] >> +<< /S /GoTo /D (section.17.1) >> +endobj +872 0 obj +(17.1 The Samba \(Posix\) VFS layer) +endobj +873 0 obj +<< /S /GoTo /D (subsection.17.1.1) >> +endobj +876 0 obj +(17.1.1 The general interface) +endobj +877 0 obj +<< /S /GoTo /D (subsection.17.1.2) >> +endobj +880 0 obj +(17.1.2 Possible VFS operation layers) +endobj +881 0 obj +<< /S /GoTo /D (section.17.2) >> +endobj +884 0 obj +(17.2 The Interaction between the Samba VFS subsystem and the modules) +endobj +885 0 obj +<< /S /GoTo /D (subsection.17.2.1) >> +endobj +888 0 obj +(17.2.1 Initialization and registration) +endobj +889 0 obj +<< /S /GoTo /D (subsection.17.2.2) >> +endobj +892 0 obj +(17.2.2 How the Modules handle per connection data) +endobj +893 0 obj +<< /S /GoTo /D (section.17.3) >> +endobj +896 0 obj +(17.3 Upgrading to the New VFS Interface) +endobj +897 0 obj +<< /S /GoTo /D (subsection.17.3.1) >> +endobj +900 0 obj +(17.3.1 Upgrading from 2.2.* and 3.0aplha modules) +endobj +901 0 obj +<< /S /GoTo /D (section.17.4) >> +endobj +904 0 obj +(17.4 Some Notes) +endobj +905 0 obj +<< /S /GoTo /D (subsection.17.4.1) >> +endobj +908 0 obj +(17.4.1 Implement TRANSPARENT functions) +endobj +909 0 obj +<< /S /GoTo /D (subsection.17.4.2) >> endobj -872 0 obj << -/Length 241 +912 0 obj +(17.4.2 Implement OPAQUE functions) +endobj +913 0 obj +<< /S /GoTo /D (chapter.18) >> +endobj +916 0 obj +(18 Notes to packagers) +endobj +917 0 obj +<< /S /GoTo /D (section.18.1) >> +endobj +920 0 obj +(18.1 Versioning) +endobj +921 0 obj +<< /S /GoTo /D (section.18.2) >> +endobj +924 0 obj +(18.2 Modules) +endobj +925 0 obj +<< /S /GoTo /D (chapter.19) >> +endobj +928 0 obj +(19 Contributing code) +endobj +929 0 obj +<< /S /GoTo /D [930 0 R /Fit ] >> +endobj +932 0 obj << +/Length 250 /Filter /FlateDecode >> stream -xÚ‘ÁJ1†ïû9&‡g’Ì$9¶¨¡'sÅnEh©X|{']K¥îA!™ÿæ !ƒºÈd Ť,ÀÌÓ®Có¬É¢£"rŽQÏaJ{Š9§)¨0+â#”ßÄ%É™ÇIóÚ]Ýz4A$˜º9"uý`ïgËùÌõA’½v=ÙásØî_µ€vxk…C Å.>^Öƒ{¬wÝM= 5¤<¥K™@ˆ•èÏ2EQ.eÚÌ&äÅV—UhåÈîÚd èƒúÁ—tl Ãûˆ.WÎ'û5^¼v êþ -ŸtØgõáÿÑ7üc2endstream +xÚ‘ÁJ1†ïûsÌ2f2™Ùì±E-<™›x»¡E±Vðí¸ÛE°‚äæÿ2ó%!¶²`ຬ(Lð¸oo†ö¾¬›«2Ï^Aƒ Ÿ½æø™¥(!'­RQõûš’)ô³T]Å¢ºÒf{hÉí«$ŒvÖ§síaèð>¢ëãîsÜÅ`|à?”Y01ÿûß¾U[gÛendstream endobj -870 0 obj << +930 0 obj << /Type /Page -/Contents 872 0 R -/Resources 871 0 R +/Contents 932 0 R +/Resources 931 0 R /MediaBox [0 0 595.276 841.89] -/Parent 881 0 R +/Parent 941 0 R >> endobj -873 0 obj << -/D [870 0 R /XYZ 85.039 786.531 null] +933 0 obj << +/D [930 0 R /XYZ 85.039 786.531 null] >> endobj -874 0 obj << -/D [870 0 R /XYZ 85.039 766.606 null] +934 0 obj << +/D [930 0 R /XYZ 85.039 766.606 null] >> endobj -871 0 obj << -/Font << /F20 877 0 R /F21 880 0 R >> +931 0 obj << +/Font << /F20 937 0 R /F21 940 0 R >> /ProcSet [ /PDF /Text ] >> endobj -884 0 obj << -/Length 1042 +944 0 obj << +/Length 1050 /Filter /FlateDecode >> stream -xÚ­VKÛ6¾ï¯ð-ÔÁ4¢{KÚf‘`S,§—¤Ù¢mµ²$Ht¶ù÷™áP–× (ŠV$g8óÍGÎgÊ™€?9Ë :Ÿ¥Y–³õþN̶`y¸“Á#6š›8†ñã<ŽO´™ÍµàY£Ï›åÝâ-,IÁs‘Ï–ï»,?³×«ÁõE¤[»è¯åû»ß–S¤à>WÏd|šì<©”\E€(Yr%Ùcd$+͵Éا§e4‡5g1ùâ­<Ř öÞGPXÌ>´ ìÖš}Œ$³¸·£¹ô•æ^é{£iö˯KÄL ¡.ë#Ô?Sšê“×È\îª`&‚­¢¹JY ÿ3Öþk&g£­ éÁ·5”Qû:Ö®ÂÚÐÔnè[¶>Œ÷<€ã¶‰ ¨ ÁÜ.Búh²¯¶;o¤íÂ’í0ø,p?Ôdß´= ºÑuî)GŽ¿bT[·]ÕÀÒ–¬C±`Û - µÓ}‘p=gÄg`¶˜?– «¿í퀡ݘ£$Ϫ¡/æn«fK3ïÚòhžä‚½÷½(dÓzŽÞû¶ÉÜ®ñ -úÜbLžõ1³?¹›ÄCä羃s>Jˆ°ŠTξy.±瞆‘*¡e|…×éz° èÃ-:8Úæ‹´d ,Žz<—¢±-5„7 +úª=LA»3¸3OÏ/‚ÌŽ ‹¦$›ÛYZùøá : Ѻ@R[ùÄ:cïÜ«èd+Oó:ü-¢“Øwµu%¡Bx—[Ò‰œõv}B?iç+üâ¢/¾Î·!n½v”áÀ¦XÞT„ÇžA Ø,íÁ–¯¸ÐHÐŽ TWð$ÎHCÐÐoƒÇAÓ+Š±s®»_,JûÕÖnɪàÔJ:ŽyªÒ´µývq¡aZIODì¶PqÓ§ÚØ–(q\’n"S'®ôú‚½Š^pæg¤‚¡6ñƒÒ¯bxoë}¸ñ>åŸQ¦™µMO¢×VŸ§ÊWR½üÕûQçT)¥yj²ÿ[ïU”®Òa®iAº‚¶ŠšO¥ ¨a Í-T­g7Ê:ãBsÔ‡ž±Í± 1ÄŒÿ4Ãu–“z5YŸPêQëjMq«ÐICöEAža$É餵F°ˆz¬FáÝQš½¾%ùkP3ˆðăF"¢Ì2Ý9Z÷-‹ß£6 zJ[R€ç¨`¥Q cÿ8ý5š4ÍK_¿IÊ -^;úå¥+…j¼}~½ŒO+^Ã$ó¥8`©8žÈ«Æ^Q¾KQ¿5^ƒ~endstream +xÚVM“£6½Ï¯àq@$ñ1·ÝÔÎT¦&©©¬7—$ ²M‚Ábý÷Û­˜a¼»©© õôºõ¤~rä…ðy™â¡È½4K¸‘WžîBï#w‘CH%¸’Þo Jd\e  ï·w›¡¼(äy˜{Ûý”EUÏmõ'{öUÄŠÁøPûtÆÏÊ f´ÿ÷öió-’Ë0œ8÷Þ¤”ìÁÏëýˆÕ@"{[zIè†÷RÝ+I_?øÐ-~H‡¡À,^àˆƒ8åaN¥mõDÂv>ÄYÿ3ÖýK±i¬ÀGÊÊ®itiꮥp·Ç§bÍ*Ç“ÆUµ~œ33Ðsôq4á„Ã5G&˜kæŒiú˱ÐØPß»žÞ϶J éÎo4¥©àÝF?#±nì`ÝhÖPœ|˜¶ÃR\齕$ô‚·œÄ°µvÒ mžÙZ[[ª%ï§,ƒÑ"RÈAO, £„ð5tÜrÈó‹ùi ªæhÊÊÑ9RÄXŽ± GiAM3¥žô‡!«ž|[ ¼ôµ©ÆØy;|¹!À¤¤‘¼%ê¬>V= L±ÂÑÐ4» +Mc5©7õ¨BѸ‰X¿ˆÐ+8c}ÝWÒsÌ +i÷‹Ìæ"‹¶¢1sÔùøë{z9÷Vs§N×pÜûÌí ,©QÛæ†5VKúŸÎ6T 5-0 Ù©£¾ÎY¯-T»Û^'áìÊ»m´‹Q¸ÛØ_8Õª±(ü•3—*ÇnÚ ¬Á6ȈÅVÄý«¹û°½:[œó4I< Öæ‚ü úƒCü¾pº ,àätɧ֜(ÙјóýfSéϺápœv'ïRò4NI_e±]جëŒÂ”ç2ódÃ6ˆ›>´ƒ6‡sÃÍoêŠ&‹ÕëÂV­ÃÊà'ôLó<’ÿû—ãW-w6endstream endobj -883 0 obj << +943 0 obj << /Type /Page -/Contents 884 0 R -/Resources 882 0 R +/Contents 944 0 R +/Resources 942 0 R /MediaBox [0 0 595.276 841.89] -/Parent 881 0 R -/Annots [ 897 0 R 901 0 R 902 0 R 904 0 R ] +/Parent 941 0 R +/Annots [ 952 0 R 956 0 R 957 0 R 958 0 R ] >> endobj -897 0 obj << +952 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [428.769 653.951 539.579 665.943] +/Rect [428.769 482.672 539.579 494.665] /Subtype/Link/A<> >> endobj -901 0 obj << +956 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 640.401 108.944 652.394] +/Rect [84.043 469.123 108.944 481.115] /Subtype/Link/A<> >> endobj -902 0 obj << +957 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.588 640.401 309.793 652.394] +/Rect [227.588 469.123 304.945 481.115] /Subtype/Link/A<> >> endobj -904 0 obj << +958 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [97.376 584.489 299.821 596.481] +/Rect [97.376 414.926 299.821 426.919] /Subtype/Link/A<> >> endobj -885 0 obj << -/D [883 0 R /XYZ 85.039 786.531 null] ->> endobj -889 0 obj << -/D [883 0 R /XYZ 85.039 740.382 null] ->> endobj -896 0 obj << -/D [883 0 R /XYZ 85.039 709.447 null] ->> endobj -903 0 obj << -/D [883 0 R /XYZ 85.039 626.133 null] +945 0 obj << +/D [943 0 R /XYZ 85.039 786.531 null] >> endobj -882 0 obj << -/Font << /F35 888 0 R /F36 892 0 R /F15 895 0 R /F37 900 0 R >> +942 0 obj << +/Font << /F35 948 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -907 0 obj << -/Length 1430 +961 0 obj << +/Length 3113 /Filter /FlateDecode >> stream -xÚí›Isâ8†ïü -íªÆ£}9BHgèÊ6éKw0K1c¦;ÿ¾%Ë6›ñL©R ²¥ØŽžoyõYP_ÐÔX:\0ŸbèôžjÀªž«ÌFŠ}Jˆj—tÖóÞ:C> ¼l pêˆø¤ÍníÏ8øŒa§;HuûßÜ‹i”„Q2ó~t¿Ô.»Ë¿N/)»6d>V=ú„ŠÒ'̆€å»C žG.ßzuIÛ -½:t¿H¢±ÝDéÆ4òê˜qw:0Ÿ·aÒÔ}mÕw§sþ^ÇúxšLÕàö¦ÝÃÜ Ò§ûæàV·ƒ§Ð=„35 -ºs}6Y¾Ý¹H_w„3C_1'ã¡cW[þX±~%¶ƒ.Ø6÷P‘ÅôBZ6½¾š`ro/»Íöš.B¤ë{u -À«Dʃú>ö×ßwéuÆúÑ2¬Kg~ƒ5Už²v½Mî˜ûP¼-ÊÐ6<Ä•; á6ZŽ2䮲_Lî’‚çÜ<#@º‹Î]³y«ÃÆŠWŠŒ£"J­O©|Òw§:dR]'xz LšiĽÑ8 {É<7“ <,É@°~)ˆNfP‘fÚ‘CI¬“©2aáöçªÙ36M¯€Û¼³ÅÆó‡‡Ûx ~3æx™™çFÃ$ãd¤õWôÇ‘j Mò t»o›2zmÚð!È"üp„yò鎴¯¦y'è«Ö8d3}ÊP3Ž¬ÂÖM+ØîBLv!ŽVñra£ð±ðÂ3¸0ÍøF†¢öÖzq[álÄò °ž ÿ¯l³1­B >¿‘«Š@LábiÃÞ‘Vw;óá0œi1;^ñ€ x€1ÇDзszI”¤eÓ8 -&Gœqþ7t´(œ\Œ¨óN.Œ¨ÿ3ˆt&š¤µa5Ž[Yx°K‹S¯´éfÅ$Ê+ü? ÏÎFþÏŠ0lÕþÇbÝí¤y%]cÏ Ú4ªº¨ù’„Ó¸ŸóŽ}Õ©…€äêþPåéE¿¢Z,á.¾¦%•FZRI•ÚàÓ³WWáv:3Š‰2b¥~U1æk·{ŠcÑldÕ( eUQæ˶ΪKêíÀ8?ýëQæ“lM±%xb‚t7@’|“/rl+(•õEš¡l—dGõã9Ý ’'H‰lT­,I¶î”­()¶ +ǯ{cçõ̘½dÒºdUqŠÜ%õ¶˜ívUçHaV@çÈœ_{_¡Š%³ŽX¡PKÂuGì¼&AÄR¬E˜Q\¤G/̓ëåœU| J‹oÛnfp&|Èà{è쎦ù dUMõ8âŒc{gEU2nžàT $¹¾"KËÃhúrÄrûHÇ£9¸½õ(ÁÂºÞ îõ†1ßì{ݸͷóFÁ0ß°ôšú°qßÖ«{lß%ž_±Ç…øŒñmc‘ݵkc§?BÒWQþ ¿ƒÇ×endstream +xÚµ[KsÛF¾ëWð¶äA³˜€AÕÖ–d;ÎÚ{µ–’²9@L1æC Rqœ_¿Ý3`0/0S>ˆvwOßôt7†t–Á?:“9Éx5+eArNgËíE6[Á7ß^P#‘Í.3Â+‰ßýï⧟³Ùȼ½Ð~†×¡U5Û^ˆœ“\pó~sq{ñŸ^‹þNÌzU®™KVpRÊ|vÉ3"¥°e|ÙRô\–yN +Q¢ð‹»‹¿¿ÎËYEª‚Ïî>ΘÌËÙ¬“¹{øiþ]³ª7‹K.ùüýþ¸¸¤óõ²Yü|÷öâ›»^}•“JÈYÉJBsr–Q"i/C ¡´$eQ‚sƒÏ9Ê8aŒöFйëgsåÔ±]€gøêþù¸Þﮋ4+ˆÌÁGÊ –j•‡ú£v5Ó/>Œ|e„S¾öŠ”«,³\52F=}Õ oÿͨحÁSt‚Z”óýGü[Ìßã÷ÍñÅ›ßê/nÚýq/é|¹ßh™z÷ ¿{_oýчæßÒù³ +ªî¿ÃÿœÍ”a/¼â„Ò@4|æä…fˆV9 È ”¢ª€AU*¬¨ˆ‚°²˜u2Hé!•Sø^Î,]¾A#ãÌ-ƒè9xeüîùÓ‚É9Fs ·"4Dmõˆ!xÞ°ßyVž8–¦(s:tù¶ÞÞ×íkt·]>* +)Â,Ï­·YàEÈg/’.OœˆnÉ Ï‹4ºFfÝAW]×`]Ëà«z§½…=6uÛ´Q<‹ŒˆLœÏASO#ƒNÞ=6z‡ê-¸y8|_áëoàÃøâ{xñ­ýr86[g^BVe¡µø1Í(ÉO„Y”ž†ÙÈLÂ<èJÀì Ál|ù¨²ý±ó5í±ÙDqæ‚ä;΃¦8ÎFFyiðz·Ò Þ>¯VÍÁ$郿i))yÈ_Ï‚ç´ËÈlL8yó<¥™„²×”@Ò±r°v{„P¨ükŸ”ÅüõBŠyÛì–øÙ£çYX‘U$¯ò‰ÅBñÕ™Éå§ öëw †`¼E2l1û!qíÛ¥Êí±¥çU åYzåƒLtáFdjÝ)kݲ]kU[Ö®¡Œc¬ù¬ñ~Q·Èƒ"Âñ]5Þ…œÜŠ¯ÛÈL.„‡)î3P¨õŸïÕã7ýæÇÇÒÊÜÑ~ð65ƒ¬ÇB ò"[qèaN3ˆ +ò®5| ¡ÝÉL¡m銣í  mtJœ»…äs…?~¼RAÞDá’“¬¨Î¿¥) +'£¶õ¢¯ë¥B}5êRë¾Å£\­`«É¥:7~Chåpâ–èNqzâ^%S™FßÈL¢?èJ ï ¡oüsèç%¡Å9M–¦8úFÝ~½Þ=ØÈ?šÏfô¸Þ}ÔÛÉP»±Y?Å4?›|©`©áspøÈ$ô-5 BEOkv…„ÑtùßÉL2cЕ`†k0Ä ËàÛf³5¿*…À^W°[¨&Kãõ/â‰XA¼x* ¢åØéDñ¤¥“î»*Ñî/è~{…)Š¼{¤Ù·+¯¢¹&W"„Œïƒ] 9ŠÂÕA_p(Š ‚ô2q~h‘Iz$¬õìp¬…È1X;9k8Ä€Ð0'†„Þ“ÜMðB §w¢Ñc‹»þaÕœ@ 8"3‘ +^'âù0¢ÅHM²F´"<;GiiŠ§S#£j©;ÕPw¯òæÚ¤Éðææåßü~²’DHrÚBB€’ê´‚Áót?ÙÉLЕ`¾k0D}ËàIeÆ$(r" ç}F8ËÇÞ&ˆ¯¥“~»*ÑîF¹½Ü\>¯Käþ#ÎuîuWc²ëZGo¶Å"Wɘv2¾oöŽp%%¯”ÚG©%¥L'3E™¤ÁŽ2žÁelƒjŠT?cé©Ys}ÐS$Œ.M<Î@½!Ê*Êl×ÄØÛ8e´pÒmG!}Ò_)j¬öä¡ãÆv¿#Ë=Áo?ù4¤àé8v2¾C#šŒ¥i"¢œ É §‰‘™¤IÊ`O×`ˆ&–ÁWÑݲ0x¬wj’gžÆwáï»×qÀ@—ñª (ÁÎÈñ8cŒtr ®J´«&N¸„ÃÕA=Ø«Y‹9V<®p"+š f'ã{2âÊXQò”åEEDuŽI”¥)zÊv2δö¦]ïŽýÓ¶7ˆ{z|ËXAhØ{/f²\ŠÓŽ[<Ä«;ÉMad&7Å +±)\ƒ¡Maü¶ië=»ÕúȳˆcÁI^c*eiŠcldŒ|óÞL¦Ôl€õQ¥%h(Bþú¨R]lž„*œÿ…H:™IT] T]ƒ!T-ƒ_‡*Dë,³¦AQS-2 ÿdî8mÕ¨}¥a¾EŸ¯ß™7áË/¦K%´ì´Ï)yzºÔÉLÂ<èJÀì ÁlüƒO ά¢¤”ç+Yš¢Hw2ª¶¯wï°ùéÆÈý%6ÓÝà\©Æ±âá3¾Tƒ£Ö}³[¶_žÔu9oˆTAyhaXg„f'‘X)‰äé!R'3EKWœžÁlƒo›¶Q}öSøn6뮦 vJ’dŒÇ;%¦zΑ«‰NIK'vU¢]{4p¥\Åäü¾&êÊC`V¸–ÉߗѬ`¤&YÅ0ì)å9î„Yšâ{ÄȨ'äæ®Ðó¦ñ‡@^ =]À;ŸSÎøüDžç ÄÓ^'3ÉóAW‚ç®ÁÏ-ƒõ°täôô°4徫ò+†¥©öÃRχÀ°Ôö!NuÿOžã´¥)Nu#ƒ.}¸yiÊuuoyµªï7¦x§Q…ôÜŒá•òÝ/ì Ó§ô´ÂŽ±’déëŽFdrôš»À±Úƒµëšg<ê¼49ÿ»õêYåÍu€ý€`b0r#GÌGÑ”Ã#eh®Þt~]!¸²¾ß’e¨K&ãe$<ë£ÕV’œe0ØY9qgΊÁÈL2!e°§‚k0ÄËà_žm§OHˆ ÷]•_“!¢ëC(!Z>Äb!bü qÐOˆF]úáõíø賺<ã×%'UÅBÞú1‚¾èÄûTVêaBŠùÌó-]qæ{Ì· ^ošßÔàî¡1ÜW7ä÷ŸôUB¼ÑÕ¿úãA(hœþp`fP#Ž<ÓßH'×àªT¹ñþª«ÒûÒw\`"X™ e'ã»1ÚcEÉIKì’' ZBq¦™I¦¤ öLq †˜bî”ìšN`Ë»æø»š²×æ!‘iƒ\as…’¢p‚•àŠ–N®ÂU‰vuš?þÞèëˆà½~H°þ¨Mà1b.«dH;ß›1Ž¢dΤ… Еœ!gZš¢9³“QÏVõO›ƒ.%Õå ƒ>ÕËO8=¨WMøE¦ž”¼ö®Bš=q\€Lå4]>v2“;bЕØ®ÁÐŽ° þ‘ª!ˆ2—„ç˜ûZšâ(ý šÝ±]ã:»¹àÒ´k¥é0áúÎú×J%¡Å‰7±)ËU#‘D×ÈL¢;èJ ë ¡kü«k‘ÓÓ5aÊ}WåWÔ„©ö5¡çC &´}ðò›ù‰7Îÿð¦øãìêÏýÂûÒعúÙQ!A3Re•zdÍ9Tz²sý宿9>—<àðÿño+ªendstream endobj -906 0 obj << +960 0 obj << /Type /Page -/Contents 907 0 R -/Resources 905 0 R +/Contents 961 0 R +/Resources 959 0 R /MediaBox [0 0 595.276 841.89] -/Parent 881 0 R -/Annots [ 910 0 R 911 0 R 912 0 R 913 0 R 914 0 R 915 0 R 916 0 R 917 0 R 918 0 R 919 0 R 920 0 R 921 0 R 922 0 R 923 0 R 924 0 R 925 0 R 926 0 R 927 0 R 928 0 R 929 0 R 930 0 R 931 0 R 932 0 R 933 0 R 934 0 R 935 0 R 936 0 R 937 0 R 938 0 R 939 0 R 940 0 R 941 0 R 942 0 R 943 0 R 944 0 R 945 0 R 946 0 R 947 0 R 948 0 R 949 0 R ] +/Parent 941 0 R +/Annots [ 966 0 R 970 0 R 971 0 R 972 0 R 973 0 R 977 0 R 978 0 R 979 0 R 980 0 R 981 0 R 982 0 R 983 0 R 984 0 R 985 0 R 986 0 R 987 0 R 988 0 R 989 0 R 990 0 R 991 0 R 992 0 R 993 0 R 994 0 R 995 0 R 996 0 R 997 0 R 998 0 R 999 0 R 1000 0 R 1001 0 R 1002 0 R 1003 0 R ] >> endobj -910 0 obj << +966 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [531.586 631.159 539.579 640.727] +/Rect [111.316 711.214 394.107 720.125] /Subtype /Link -/A << /S /GoTo /D (chapter.1) >> +/A << /S /GoTo /D (netbios) >> >> endobj -911 0 obj << +970 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [532.132 617.61 539.579 626.632] +/Rect [111.316 685.311 204.163 694.222] /Subtype /Link -/A << /S /GoTo /D (section.1.1) >> +/A << /S /GoTo /D (architecture) >> >> endobj -912 0 obj << +971 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [532.132 604.06 539.579 613.083] +/Rect [111.316 657.471 238.808 668.319] /Subtype /Link -/A << /S /GoTo /D (section.1.2) >> +/A << /S /GoTo /D (debug) >> >> endobj -913 0 obj << +972 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [532.132 590.511 539.579 599.534] +/Rect [111.316 631.568 202.726 642.416] /Subtype /Link -/A << /S /GoTo /D (section.1.3) >> +/A << /S /GoTo /D (CodingSuggestions) >> >> endobj -914 0 obj << +973 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 566.053 539.579 575.621] +/Rect [111.316 559.782 187.013 568.693] /Subtype /Link -/A << /S /GoTo /D (chapter.2) >> +/A << /S /GoTo /D (internals) >> >> endobj -915 0 obj << +977 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 552.504 539.579 561.527] -/Subtype /Link -/A << /S /GoTo /D (section.2.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.002 544.893 383.28 555.741] +/Subtype/Link/A<> >> endobj -916 0 obj << +978 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 538.955 539.579 547.977] +/Rect [111.316 533.879 192.838 542.79] /Subtype /Link -/A << /S /GoTo /D (section.2.2) >> +/A << /S /GoTo /D (parsing) >> >> endobj -917 0 obj << +979 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 525.405 539.579 534.428] +/Rect [111.316 507.976 230.716 516.887] /Subtype /Link -/A << /S /GoTo /D (section.2.3) >> +/A << /S /GoTo /D (unix-smb) >> >> endobj -918 0 obj << +980 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 511.856 539.579 520.879] +/Rect [111.316 480.136 237.502 490.984] /Subtype /Link -/A << /S /GoTo /D (section.2.4) >> +/A << /S /GoTo /D (tracing) >> >> endobj -919 0 obj << +981 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 498.307 539.579 507.33] +/Rect [111.316 454.233 288.599 465.081] /Subtype /Link -/A << /S /GoTo /D (section.2.5) >> +/A << /S /GoTo /D (windows-debug) >> >> endobj -920 0 obj << +982 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 473.849 539.579 483.417] -/Subtype /Link -/A << /S /GoTo /D (chapter.3) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 441.282 316.308 452.13] +/Subtype/Link/A<> >> endobj -921 0 obj << +983 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 460.299 539.579 469.322] -/Subtype /Link -/A << /S /GoTo /D (section.3.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [237.686 429.326 317 440.175] +/Subtype/Link/A<> >> endobj -922 0 obj << +984 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 446.75 539.579 455.773] +/Rect [111.316 418.312 199.48 427.223] /Subtype /Link -/A << /S /GoTo /D (section.3.2) >> +/A << /S /GoTo /D (ntdomain) >> >> endobj -923 0 obj << +985 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 433.201 539.579 442.224] -/Subtype /Link -/A << /S /GoTo /D (section.3.3) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [229.329 403.424 323.006 414.272] +/Subtype/Link/A<> >> endobj -924 0 obj << +986 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 419.652 539.579 428.675] -/Subtype /Link -/A << /S /GoTo /D (section.3.4) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [220.944 391.468 325.635 402.317] +/Subtype/Link/A<> >> endobj -925 0 obj << +987 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 406.103 539.579 415.125] -/Subtype /Link -/A << /S /GoTo /D (section.3.5) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [245.85 381.061 324.887 390.361] +/Subtype/Link/A<> >> endobj -926 0 obj << +988 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 392.553 539.579 401.576] +/Rect [111.316 366.562 227.154 377.41] /Subtype /Link -/A << /S /GoTo /D (subsection.3.5.1) >> +/A << /S /GoTo /D (printing) >> >> endobj -927 0 obj << +989 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 379.004 539.579 388.027] +/Rect [111.316 342.596 218.312 351.507] /Subtype /Link -/A << /S /GoTo /D (subsection.3.5.2) >> +/A << /S /GoTo /D (wins) >> >> endobj -928 0 obj << +990 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 365.455 539.579 374.478] +/Rect [111.316 314.756 244.52 325.604] /Subtype /Link -/A << /S /GoTo /D (subsection.3.5.3) >> +/A << /S /GoTo /D (sam) >> >> endobj -929 0 obj << +991 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 340.997 539.579 350.565] +/Rect [111.316 288.853 287.409 299.701] /Subtype /Link -/A << /S /GoTo /D (chapter.4) >> +/A << /S /GoTo /D (pwencrypt) >> >> endobj -930 0 obj << +992 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 316.538 539.579 326.107] -/Subtype /Link -/A << /S /GoTo /D (chapter.5) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [231.487 275.902 312.766 286.75] +/Subtype/Link/A<> >> endobj -931 0 obj << +993 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 302.989 539.579 312.012] +/Rect [111.316 264.888 151.853 273.799] /Subtype /Link -/A << /S /GoTo /D (section.5.1) >> +/A << /S /GoTo /D (modules) >> >> endobj -932 0 obj << +994 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 289.44 539.579 298.463] -/Subtype /Link -/A << /S /GoTo /D (section.5.2) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 249.999 316.308 260.847] +/Subtype/Link/A<> >> endobj -933 0 obj << +995 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 275.891 539.579 284.914] +/Rect [111.316 237.048 224.719 247.896] /Subtype /Link -/A << /S /GoTo /D (section.5.3) >> +/A << /S /GoTo /D (rpc-plugin) >> >> endobj -934 0 obj << +996 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 262.342 539.579 271.364] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.3.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [238.904 224.096 327.876 234.944] +/Subtype/Link/A<> >> endobj -935 0 obj << +997 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 248.792 539.579 257.815] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.3.2) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 212.141 316.308 222.989] +/Subtype/Link/A<> >> endobj -936 0 obj << +998 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 235.243 539.579 244.266] +/Rect [111.316 201.127 174.989 210.038] /Subtype /Link -/A << /S /GoTo /D (subsection.5.3.3) >> +/A << /S /GoTo /D (vfs) >> >> endobj -937 0 obj << +999 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 221.694 539.579 230.717] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.3.4) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [251.081 186.238 315.423 197.086] +/Subtype/Link/A<> >> endobj -938 0 obj << +1000 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 208.145 539.579 217.168] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.3.5) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [250.666 175.831 340.385 185.131] +/Subtype/Link/A<> >> endobj -939 0 obj << +1001 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 194.596 539.579 203.618] +/Rect [111.316 161.331 201.218 172.18] /Subtype /Link -/A << /S /GoTo /D (subsection.5.3.6) >> +/A << /S /GoTo /D (Packaging) >> >> endobj -940 0 obj << +1002 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 181.046 539.579 190.069] +/Rect [111.316 135.429 195.473 146.277] /Subtype /Link -/A << /S /GoTo /D (subsection.5.3.7) >> +/A << /S /GoTo /D (contributing) >> >> endobj -941 0 obj << +1003 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 122.477 316.308 133.325] +/Subtype/Link/A<> +>> endobj +962 0 obj << +/D [960 0 R /XYZ 85.039 786.531 null] +>> endobj +959 0 obj << +/Font << /F57 965 0 R /F20 937 0 R /F14 969 0 R /F15 951 0 R /F11 976 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1025 0 obj << +/Length 2400 +/Filter /FlateDecode +>> +stream +xÚåœËr·†÷z +.É*w –º89JÙ²céd“dA‹Ô¥J"’Šã·0¸rÀ5N\>¤ÊekÈ™F7ÿ ô4G&lþA#fz ‰#ƒëÇ#<¸5g~<"þ +.œ›ã-'ÇáìXR„¹Úz÷1V”#Þp{ÍÉÕÑ~ x@1’’ ®n„PÄH­‘Pjp5ýuxº˜¯góõjôûÕOG¯¯âˆ~@)$’„m š!ÉÔ`l=ŠfkT„6H*i"g!ò°Fë°üE6,2k‡g³Ñ˜ ÄÏïGd¸¶¯ìÁb>3©†‹÷ób¶>±çÎ͹wöàÒ½ÿÞ¼^Ú׋õ¼ƒ‡×‹{F'sûöÔ½¸°Ç“Ç™{õa¶2W‘á“}w»{ë™Ú³B2…ùƒì³º3ËÛ;øIã/®+ÓÑ +£ ¯„t¼–ˆJD¦W˜:ÝHˆÈy’’˜ŸX:FÈP"˜ÒáÅë«“ówFsÎõ̇Ãà®õWû¾æÛÎmÁßý‚D…Öà<°Vã̬”¿;vu&”þ æþÒºÓÈÜ8ÇByæÔ3?ù0¢Ê$m†Çg§Ç—&M®Lv0ž’±J}4߈¬¢/ÙdV!›‰ ’-ýÃdkNY¡ ¸ñdYÈæ“ »|2fH¶K Ëm*ÄËHcŒ8&Q›çÂvVãÌlìͱ[Ý1@{KmÖP³ s¿ ëú&,¤2õƒ®oÂá"u›ðåäñãÄm€ÇËë»ûõìzý´œuÃ6Ú¶a'/½üÅõ˜:#¶jH­4ÐWîÝP¶gŒ­Åœ8q÷;ŸÛEp½´…‚I“f8}2‡×›Õn^âŽè§{+ZßD +F•4Š0àiÑu .˜>ÓH âñ‡ð­¥ý°¾_ßÙbs6™ÞÏÍÁ­Û 'öxêVS“Gv¢Ø\"Ó}ê…è‹4™U f"ÃXË`°5¯­Y"8¦mØ ¯îlR·›àdjŽîç·åʾåhºŒ7+%'/#™½R}Ù'³ +ûŒ̾ f_óÙ›­¯=ßÅ~¾É]5/d÷*õåžÌ*Ü3„BÜË`î5¯{[^`æ¹ Ï}îèÚôÇ¥û,L…Õý­ÙÍ¢_à6ôê923xä,À°%€ñŽ¶W5|G[*\dCc®"¾º›¹zxJci¦ˆ™¯Oþ÷£?cfÌ—Õzö”É™ëg”ÉÕ@;#¶2HÂ4X&MiKIµVæŠ"EùŽü’Qíš,õŠfŸ]iôÎÖMëOO®¯gß±=„/®˜žüe²Œ5‡šI^™¾™”Ì*™”©Oƒ2p-­z¬¹BŠ+ÏšÆ=tæÈÚõÓæÆoX`ó—¸Uõíäziî˜ξ¡oØËÑp2«Î¤&\®y€GDÀ ||v¶±nö§ÿð}q&³ +ÎLX" œe0Κ׈Ó~+Ä“C8ߌ!Ã_Þle*ð!dª¢/ÚdVA›‰ £-€ÑÖ¼F´X!¬µG+ºÛŸæ×ëû…íM¬ìúÛ¼¨2ÖëÓ—x2«Ï´'"^¯y%‚!%Õ€iÃYàm¥E8Ní]Ìízö×:¥¯RÍÿ¥oÙKÒ“q²‚gbƒ„Kï àšËÈ·ÁcÓ Àw¶;±LˆMº‹—ÁØËÒr2«PÎ$‡1—Àœk^#h)ÍMkÍ<è›Å24$&ën0”D”ŽÆÆÃG¿þŽSÍOG1Ý >›clÊ=x<2õ¹bþÕÃÑåÑÏ)Ú0Ö8¬ —¶÷Öt#ÜéìãSÛöîFgÛêšü;Ñù±vD'$j$߈nslð^$4íÓ‡ï5íkšuÇ®Oû2€Ö†aœ ­Y½ .²¡q׆9õã¸Ö¬TÃ˧ÛÛÙÊV6+ í’¹zFÛ¥XgÄV2I–úŠ¶K|ÒÊ(ÁÔ-‰B‚íhi…‹lÌ¢ø’×>D5_·íÎå|òЉ€šÉÙsÔ¬…Ö±Uz"è+¿ë톲µf˜!ݸNŠˆý«Ó»‰]Œ'îûÝÙÒÝýw2·ÛðC;Íuê@‹ç IßÅ'™UŸLo˜}¼çÖ¼ÊTï,P.:WóÐùÿì@ßØ]ÎÝ=­âNr¸5VP§'ïÌ æ+òÞÈ»ê5òV¦Gv]MoIözô¥›Ì*x3­a¾e0àš×@˜h„¦‘°ìæïe±`Ã6(Ñ“mf³ÍUÙn d[õÙ6öw Yd«ºÙÛ²5P?–û­ÿ‚XêCKá J_Ìɬ‚9Æ\c®y˜eƒ¸NeURØ>‚U_¨7«*Ýì5X/C_°É¬6“[ƒ­y`Gš'°:€ÝØ~·çï&Y¦åd®—£/àdVœIM¡‡Õ·®y€¹¹X‹ÔÑÀæF¶›¹—Ï…Ì)ßgº^‹¾t“Y…n¦3L· ¦[óéR….]âé¦ýwÔn´Ýû£M¬’è}ÆêEè‹5™U°fÃXË`¬5¯+áˆj•°R‡õÃåîU9<·C§œòjôå›Ì*|3¥a¾e0ßš×È×xW¹ Ïgd¿{m_¿?· +¶ÿkn«@O˜ÁFuAvýVkâHÊúfË1к`X#Üð¿Æ=Ö5H4lÆéºü¦jæendstream +endobj +1024 0 obj << +/Type /Page +/Contents 1025 0 R +/Resources 1023 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 941 0 R +/Annots [ 1028 0 R 1029 0 R 1030 0 R 1031 0 R 1032 0 R 1033 0 R 1034 0 R 1035 0 R 1036 0 R 1037 0 R 1038 0 R 1039 0 R 1040 0 R 1041 0 R 1042 0 R 1043 0 R 1044 0 R 1045 0 R 1046 0 R 1047 0 R 1048 0 R 1049 0 R 1050 0 R 1051 0 R 1052 0 R 1053 0 R 1054 0 R 1055 0 R 1056 0 R 1057 0 R 1058 0 R 1059 0 R 1060 0 R 1061 0 R 1062 0 R 1063 0 R 1064 0 R 1065 0 R 1066 0 R 1067 0 R ] +>> endobj +1028 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 167.497 539.579 176.52] +/Rect [504.314 631.159 512.306 640.727] /Subtype /Link -/A << /S /GoTo /D (subsection.5.3.8) >> +/A << /S /GoTo /D (chapter.1) >> >> endobj -942 0 obj << +1029 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 153.948 539.579 162.971] +/Rect [504.859 617.61 512.306 626.632] /Subtype /Link -/A << /S /GoTo /D (subsection.5.3.9) >> +/A << /S /GoTo /D (section.1.1) >> >> endobj -943 0 obj << +1030 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 140.399 539.579 149.422] +/Rect [504.859 604.06 512.306 613.083] /Subtype /Link -/A << /S /GoTo /D (subsection.5.3.10) >> +/A << /S /GoTo /D (section.1.2) >> >> endobj -944 0 obj << +1031 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 126.85 539.579 135.872] +/Rect [499.405 590.511 512.306 599.534] /Subtype /Link -/A << /S /GoTo /D (subsection.5.3.11) >> +/A << /S /GoTo /D (section.1.3) >> >> endobj -945 0 obj << +1032 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 113.3 539.579 122.323] +/Rect [498.314 566.053 512.306 575.621] /Subtype /Link -/A << /S /GoTo /D (subsection.5.3.12) >> +/A << /S /GoTo /D (chapter.2) >> >> endobj -946 0 obj << +1033 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 99.751 539.579 108.774] +/Rect [499.405 552.504 512.306 561.527] /Subtype /Link -/A << /S /GoTo /D (subsection.5.3.13) >> +/A << /S /GoTo /D (section.2.1) >> >> endobj -947 0 obj << +1034 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 86.202 539.579 95.225] +/Rect [499.405 538.955 512.306 547.977] /Subtype /Link -/A << /S /GoTo /D (subsection.5.3.14) >> +/A << /S /GoTo /D (section.2.2) >> >> endobj -948 0 obj << +1035 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 72.653 539.579 81.676] +/Rect [499.405 525.405 512.306 534.428] /Subtype /Link -/A << /S /GoTo /D (subsection.5.3.15) >> +/A << /S /GoTo /D (section.2.3) >> >> endobj -949 0 obj << +1036 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 59.104 539.579 68.127] +/Rect [499.405 511.856 512.306 520.879] /Subtype /Link -/A << /S /GoTo /D (section.5.4) >> ->> endobj -908 0 obj << -/D [906 0 R /XYZ 85.039 786.531 null] ->> endobj -909 0 obj << -/D [906 0 R /XYZ 85.039 656.613 null] ->> endobj -905 0 obj << -/Font << /F20 877 0 R /F15 895 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -952 0 obj << -/Length 2006 -/Filter /FlateDecode ->> -stream -xÚíœI{›8€ïþ¾ ÌÔ Zà˜&iã>ÎRÛií& S2€Ûäß>Ià5‰ï)f3Xzõ­úªÛâƒê®cÙÄ«s—YAõ`P³ë7âÌÇÒWØujÙÌSﻵ¿?8nÙ–g{õîµ¼¤Ûûf&±‰]#ÕWfþÓýT;îŽÝ¤A-ÊÜå¿Ú·ìzO<èSͶˆçÖ‰mÛBžWÔ¨C,‡½ß¯ujŸË»¨s´®~5ç¿6(–ízõ±-×¥åŸFÎœ?íXÔBf!J øß~j"ÈCF˜‡ð2³ÁbXfñíÙ/êyž[à’מ[ûϧRYÈ›3ÝžÞÔÕFûãíé;êk&îø8Pè½çb ´-ùå‚ß0Í!Äøi:ÌðûCqLœt¯`¾&zLÂá± ²t@c¡[̆Î^¨(&æÆ­Õ@2Su&÷¯úŠ­#@ï€ ²ÅÌÂ-/ EïÌ×ΈY„Quù|lÏy>3žcÝ[©‡ZÆŒlpe ´A_Ãn|·í‡3m§HxÂ#mžûLLfÚŒçõ ´³0BóÎêÊî<=À™´=0À[á}ø}ÄÔ8ˆa`÷²(ƒÓ¶·ÓzeŸ†5Y¿LKâÄ{e? 7 -nr­4ÕWqè6ÊÃìÎÄg Wf+°ð°Z‘8‡ê`áèÊc°5ôå¶8Üp)¯P­ ѨZ’Ñ4ÅTg%Úßû ûQúCûð6ª¤K#£kwߘ-°n‡BTrÿ^´ã½0^oËö9ËËè³î .MßÁ•ðع‘ s%ˆwcufr`TáÖúñ­Ê#çÊ#?S!õûæyG9áÊÊM_}]ÆѽòØ¿šÄ6“ #í÷V秳ÕûéÏ©2^:êM¥Æ`0ë˜,Œ -B•Õ±y¥ÇÖ©ÇØÚ / ×e¦R€ñ()(ÜìñÊbíiç9ÐDƒþõGåù¯8L³ÛèN„eœWT÷O~©ÆªRú¤QŒ_°¤= -8b§’áõÓæ ]d‰[Ê"úG‹ž+M]…o6Ó°Ô<ム-/Nµ3¦”¸”pB+GlïisM»kºÄHý;TöJç;ÑÓ>—Í#AœQ·b¼ZÆîú]0wÜV'XåÊ òíÃÌõ©d‚pÊDC=\ÉóŽ²~^ž½¶  sm°“~‘ÊÜõ ~É¡ ¸?u¯"»%²KçŽ\=›kz"”ö2R“,0±ë®|½ùåá@m~¿/}õU%ŽˆýâÄQ[£§²G[„ð%:ÇÓ‰µ.´Ú5Ž’?–Sk_Š?VØ xã³Ü^•<ÛM@ðú'ê¼± ðN€Ó ðÉ݉"º½D²[Ó„lh1I~˜†½($=F+’»@òî—WæµÏ’ÙàsAÕƒŒ¡:àn¥#…,%®¢vUI·ã:šwÕd]—¾ ¿£¾Å¥¾=ÖApY‰.k[²éŠ -â‹ ¾®ö…ð…³!T«‚XbáÇŸ‚vg^êÜ“Ðï•Ë2‹©[P’Î÷‘ˆˆ×–T“Ë#YH¬€ žËäÍ—•å?I¨³P2»N  ï¯Èl Ћ_Qâ×eé0ȇéXN_»"•!Û¸Îq%øäê¼y¤ߟ¢¹üwB¶/J’Œ+IµÔšåþ¶· ôœá ï²Û<=†Fò -ÔnŠդκ]0qÍSqìø_£BµUTŽFut~:ýP.ŽâÕ³ óJT·N‹öï¬yrÔVqiˆ£"Ã9Q2—dy:¾ø붿,+Ö -´Giå%>‰;Á¯ŠZa‹÷†™Ú¹JRˆÈšíò -Y3T®ÛËÃTÁt8~ûBáLh±!ônTv>׫ìÇz^wb•¦Zyhl› þß8ê’²Fv~ÛzQà«W’ȼ˜Øhue;UïÏö>R½¯Døýè&. èù1Ð(qÌöô¬@Y%/$‰ó÷Ÿ¦ÊøFœë¨0ív'½…äJt.3þ-†B W3ú¹¯+°\y˜iæ6ߺ?7ãa;KzØlcîXjçb§53\ ]ë(89 ±Zƒ‘ãÀ¤#/D¿. ,,Úžs?ÃZ®ëm•ûâ’Oø­†Õx~\+;û\Pý®Œ½;êêº$² QÕñAötïF¾*á—=û—.x‰‘“?¸+³jœ¡½Ž˜^¹$®\m žØü7°Ž$r‰—§RwñjŒ™©Ç¢bhL4å(ùHendstream -endobj -951 0 obj << -/Type /Page -/Contents 952 0 R -/Resources 950 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 881 0 R -/Annots [ 957 0 R 958 0 R 959 0 R 960 0 R 961 0 R 962 0 R 963 0 R 964 0 R 965 0 R 966 0 R 967 0 R 968 0 R 969 0 R 970 0 R 971 0 R 972 0 R 973 0 R 974 0 R 975 0 R 976 0 R 977 0 R 978 0 R 979 0 R 980 0 R 981 0 R 982 0 R 983 0 R 984 0 R 985 0 R 986 0 R 987 0 R 988 0 R 989 0 R 990 0 R 991 0 R 992 0 R 993 0 R 994 0 R 995 0 R 996 0 R 997 0 R 998 0 R 999 0 R 1000 0 R 1001 0 R 1002 0 R 1003 0 R 1004 0 R 1005 0 R ] +/A << /S /GoTo /D (section.2.4) >> >> endobj -957 0 obj << +1037 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 754.651 539.579 763.674] +/Rect [499.405 498.307 512.306 507.33] /Subtype /Link -/A << /S /GoTo /D (subsection.5.4.1) >> +/A << /S /GoTo /D (section.2.5) >> >> endobj -958 0 obj << +1038 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 741.102 539.579 750.125] +/Rect [498.314 473.849 512.306 483.417] /Subtype /Link -/A << /S /GoTo /D (subsection.5.4.2) >> +/A << /S /GoTo /D (chapter.3) >> >> endobj -959 0 obj << +1039 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 727.553 539.579 736.575] +/Rect [499.405 460.299 512.306 469.322] /Subtype /Link -/A << /S /GoTo /D (section.5.5) >> +/A << /S /GoTo /D (section.3.1) >> >> endobj -960 0 obj << +1040 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 703.094 539.579 712.663] +/Rect [499.405 446.75 512.306 455.773] /Subtype /Link -/A << /S /GoTo /D (chapter.6) >> +/A << /S /GoTo /D (section.3.2) >> >> endobj -961 0 obj << +1041 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 689.545 539.579 698.568] +/Rect [499.405 433.201 512.306 442.224] /Subtype /Link -/A << /S /GoTo /D (section.6.1) >> +/A << /S /GoTo /D (section.3.3) >> >> endobj -962 0 obj << +1042 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 675.996 539.579 685.019] +/Rect [499.405 419.652 512.306 428.675] /Subtype /Link -/A << /S /GoTo /D (subsection.6.1.1) >> +/A << /S /GoTo /D (section.3.4) >> >> endobj -963 0 obj << +1043 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 662.447 539.579 671.469] +/Rect [499.405 406.103 512.306 415.125] /Subtype /Link -/A << /S /GoTo /D (subsection.6.1.2) >> +/A << /S /GoTo /D (section.3.5) >> >> endobj -964 0 obj << +1044 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 648.897 539.579 657.92] +/Rect [499.405 392.553 512.306 401.576] /Subtype /Link -/A << /S /GoTo /D (subsection.6.1.3) >> +/A << /S /GoTo /D (subsection.3.5.1) >> >> endobj -965 0 obj << +1045 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 635.348 539.579 644.371] +/Rect [499.405 379.004 512.306 388.027] /Subtype /Link -/A << /S /GoTo /D (section.6.2) >> +/A << /S /GoTo /D (subsection.3.5.2) >> >> endobj -966 0 obj << +1046 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 621.799 539.579 630.822] +/Rect [499.405 365.455 512.306 374.478] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.1) >> +/A << /S /GoTo /D (subsection.3.5.3) >> >> endobj -967 0 obj << +1047 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 597.341 539.579 606.909] +/Rect [498.314 340.997 512.306 350.565] /Subtype /Link -/A << /S /GoTo /D (chapter.7) >> +/A << /S /GoTo /D (chapter.4) >> >> endobj -968 0 obj << +1048 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 583.792 539.579 592.814] +/Rect [498.314 316.538 512.306 326.107] /Subtype /Link -/A << /S /GoTo /D (section.7.1) >> +/A << /S /GoTo /D (chapter.5) >> >> endobj -969 0 obj << +1049 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 570.242 539.579 579.265] +/Rect [499.405 302.989 512.306 312.012] /Subtype /Link -/A << /S /GoTo /D (section.7.2) >> +/A << /S /GoTo /D (section.5.1) >> >> endobj -970 0 obj << +1050 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 556.693 539.579 565.716] +/Rect [499.405 289.44 512.306 298.463] /Subtype /Link -/A << /S /GoTo /D (section.7.3) >> +/A << /S /GoTo /D (section.5.2) >> >> endobj -971 0 obj << +1051 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 543.144 539.579 552.167] +/Rect [499.405 275.891 512.306 284.914] /Subtype /Link -/A << /S /GoTo /D (section.7.4) >> +/A << /S /GoTo /D (section.5.3) >> >> endobj -972 0 obj << +1052 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 529.595 539.579 538.618] +/Rect [499.405 262.342 512.306 271.364] /Subtype /Link -/A << /S /GoTo /D (section.7.5) >> +/A << /S /GoTo /D (subsection.5.3.1) >> >> endobj -973 0 obj << +1053 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 516.046 539.579 525.068] +/Rect [499.405 248.792 512.306 257.815] /Subtype /Link -/A << /S /GoTo /D (section.7.6) >> +/A << /S /GoTo /D (subsection.5.3.2) >> >> endobj -974 0 obj << +1054 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 502.496 539.579 511.519] +/Rect [499.405 235.243 512.306 244.266] /Subtype /Link -/A << /S /GoTo /D (section.7.7) >> +/A << /S /GoTo /D (subsection.5.3.3) >> >> endobj -975 0 obj << +1055 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 488.947 539.579 497.97] +/Rect [499.405 221.694 512.306 230.717] /Subtype /Link -/A << /S /GoTo /D (section.7.8) >> +/A << /S /GoTo /D (subsection.5.3.4) >> >> endobj -976 0 obj << +1056 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 475.398 539.579 484.421] +/Rect [499.405 208.145 512.306 217.168] /Subtype /Link -/A << /S /GoTo /D (section.7.9) >> +/A << /S /GoTo /D (subsection.5.3.5) >> >> endobj -977 0 obj << +1057 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 450.94 539.579 460.508] +/Rect [499.405 194.596 512.306 203.618] /Subtype /Link -/A << /S /GoTo /D (chapter.8) >> +/A << /S /GoTo /D (subsection.5.3.6) >> >> endobj -978 0 obj << +1058 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 426.481 539.579 436.05] +/Rect [499.405 181.046 512.306 190.069] /Subtype /Link -/A << /S /GoTo /D (chapter.9) >> +/A << /S /GoTo /D (subsection.5.3.7) >> >> endobj -979 0 obj << +1059 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 412.932 539.579 421.955] +/Rect [499.405 167.497 512.306 176.52] /Subtype /Link -/A << /S /GoTo /D (section.9.1) >> +/A << /S /GoTo /D (subsection.5.3.8) >> >> endobj -980 0 obj << +1060 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 399.383 539.579 408.406] +/Rect [499.405 153.948 512.306 162.971] /Subtype /Link -/A << /S /GoTo /D (subsection.9.1.1) >> +/A << /S /GoTo /D (subsection.5.3.9) >> >> endobj -981 0 obj << +1061 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 385.834 539.579 394.857] +/Rect [499.405 140.399 512.306 149.422] /Subtype /Link -/A << /S /GoTo /D (subsection.9.1.2) >> +/A << /S /GoTo /D (subsection.5.3.10) >> >> endobj -982 0 obj << +1062 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 372.285 539.579 381.307] +/Rect [499.405 126.85 512.306 135.872] /Subtype /Link -/A << /S /GoTo /D (section.9.2) >> +/A << /S /GoTo /D (subsection.5.3.11) >> >> endobj -983 0 obj << +1063 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 358.735 539.579 367.758] +/Rect [499.405 113.3 512.306 122.323] /Subtype /Link -/A << /S /GoTo /D (subsection.9.2.1) >> +/A << /S /GoTo /D (subsection.5.3.12) >> >> endobj -984 0 obj << +1064 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 345.186 539.579 354.209] +/Rect [499.405 99.751 512.306 108.774] /Subtype /Link -/A << /S /GoTo /D (subsection.9.2.2) >> +/A << /S /GoTo /D (subsection.5.3.13) >> >> endobj -985 0 obj << +1065 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 331.637 539.579 340.66] +/Rect [499.405 86.202 512.306 95.225] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.2.1) >> +/A << /S /GoTo /D (subsection.5.3.14) >> >> endobj -986 0 obj << +1066 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 318.088 539.579 327.111] +/Rect [499.405 72.653 512.306 81.676] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.2.2) >> +/A << /S /GoTo /D (subsection.5.3.15) >> >> endobj -987 0 obj << +1067 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 304.539 539.579 313.561] +/Rect [499.405 59.104 512.306 68.127] /Subtype /Link -/A << /S /GoTo /D (subsection.9.2.3) >> +/A << /S /GoTo /D (section.5.4) >> >> endobj -988 0 obj << +1026 0 obj << +/D [1024 0 R /XYZ 85.039 786.531 null] +>> endobj +1027 0 obj << +/D [1024 0 R /XYZ 85.039 656.613 null] +>> endobj +1023 0 obj << +/Font << /F20 937 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1070 0 obj << +/Length 3095 +/Filter /FlateDecode +>> +stream +xÚíœ[s;€ßó+ü¶öÖZ;º4@` 1{çÁ±Mâű³¶³¿ºK¹EÈn.EÅ«Õ­þºuÜ«Ô?Ü“U´é Y#Nqor±WõÎÔ/ÿØîÄÐ&ežöþþªV¿V¨©šÞèS¨§©oêÞhúGÿÅj9 ²¿Ù?›ÁŸ£7{/G¡âD5¦TWûï½?þ¬zSe›½ +ÑFö¾¨ÏÂMÓ»Øcœ"Ψû¾Ø;Ùû-Ôec=+µ«œJÄ%Í›yÒ ¬êµè ÎQÍ„iG áÁcÆúïtSÆëî/Ô¥þl;Óô…Í`(8í£ÁWUþ‡5 øÛ-Š|ïoß)ÞB¥."Váà–ÌÁ볞ýð>u¹“&b¹ËÛuk—œY€1¢; ÈIÛ¢e­4#¨R!ãAú½áºU\¯ÖËÁRÚÿÏ€×ýñâJ]S?J,+dç’®£XrânB ȹ0ä’VL$ªEÝê/gƒÌÙŠÕ? †*›§3‹w2 ¢ns{bàÏÖö—íøta¡sºsQWèQ¬=q?¡ôÜ€ :•Õ”õ†„!Æw÷óžùPTLEFìçI:\aL”RÒó…´iõ`Øðª?:×Q‹þæâ)ì“Õò“½ð±Âl1kÛ¯œlìê +Žs…ËƵj4ncÛbE™+©úkqXo™²3ƒj=®3ç'3ê :œ}OÆ %¬ÿl©3gq½™oôÏUóî;L; o¼c:æM"çMêt0vv–E­~DT¸QÓ:L}^—SEx1לÏ,óÕ'ÛCþ®.Ï·³Íåx¢²§®Éƒêü|“»BŒbˆ‰;aˆ¹0Ä’Ö±¦ˆ©¹²‡Hnñp®®-gö¢Ÿ¼›kúÓÕØ|V—‡’‰û‡Ð5¸+Â(V@˜8F˜#,i YƒdÃBêvmL–‘î·ó•›°þ¦¿ÏןÝâ¤Â$]û¢Œb”‰S ‡PæÀ(KZÃèIkDw(‰=O®}nmÇ_•‡yƒãÿplunëQ¬ 8rà@(i 9MM„0¶>;UKÑ_]mmæ^&[ 41óxÖÞ ]¹F±×Ä䆸æüØZƒ7Q*Êk _H›&ìZãÈî2±K ;ÜšcûçÃR_ûj¿ü> U5 ¸¿^L…HbË-"EË[5Ÿ +À§IEß¹i›²³+å’!!í‚ ‘Ûê¤q‹z=ôÙU¼ŸµÐJ>ݮԻ­cÊ%bpÊ¥HàðÈ »Ò¢ÖBÍjiãÁ©6v?Ö¬E/Ìg5õ!xòƒ©÷W׈b…HXÀG@Ikˆ.P-}P¯æ‹8=>þ²œ­7çóKµ&âIávÎéŠ;Šp'Ž‡qçÀ¸KZnÆfŽ6s´íyÌFï8õ¿èÏ«õÔ.w8‘¿rÞº¬k ©BDDBi‡  2ð§úh»ð›ø‡v¼ŸhöŸçË3µÎµý¯.ëQ¬ 8rà(i A€ªqAP» Ø·GÌ×vñôÖMí0`:ÊÄŽç³®QÅ +Qð ¹p”´†(¨(b uQ \Œ’ö×ãK³”ž†¥ÀÊâ}8ØW‘P3ù¤Ø;OueÅ +ì +0ûܘ}I«gÏdƒæÙËt°Òë¿­ù©¡é_]è3]»·¢æÊW y‚€wYÇ HÄà Hq€A°Ã0ŠZCˆÑÆOfý¿u3‚ÕÂæý =¬..~<ø:7a¢bâZGDóX©;u¥Å +ÔÿÃÔs~l—qŒZ—wÙ|!mšt'úƒ«ab6×ÎÜáþøâÔì°ÕýÍõf;»°Ÿ'ãŬvï­%Übo­ho«Fm.…îzJ*÷Ö†a²ó>F•‹…*@À ºèb¢ÖVB~ÃÅ®¶¹±.~5_NÝÞ¥=WT¾¼ÚÌ>]-’}ÍO+½}¹¾ðGTªÌÊmv~Ñr¦ÐÔúˆÞ†@©9­ è¢2RÜâd„#Êëotn˜¢†8÷†-ΣÙv±:óG{ÓÙ©Þá<;3K}e¥¿o/¯ì(1~È]—ó@×®+Šº®Ä»0îÜ€뺨ÕØ7Î\m®”¿”‡ŽF6=öí6NŽÞ¿{¡¾üÊ“¨ðiR²îf}ÆkÐx¬æ;OZvìÌ*¸Bƒ›tzð_ßN)ﶎ)•ˆÁ)•"ƒ#7œµú³TZ«´$‚…š±þ‰é ׿ö—7nʾG¤î´sKWÐQ¬:q9…Íwƒ.i  ™D’КXÐ/Ö³é|«75{R„?ºŽb‰¯a¹0á’ÖЧS®F‡@˜Ø>ýhµmìj^ßµff9'zz³Ž}»Iu]ŠUõcí¹sºâŽb܉ãaܹ0î’ÖÐ#AXÀí{n\Jv¯9Ýfç”®˜£XsâpsnŒ¹¤5`®$‚GÌ®ß~éöæ“Sf=¸iß÷¨à:Wt…Å +p7Ãps`¸%­XÚ.›4 Õ¤Nàêg%T"+òý·º›Ö Óy¿ž§áQsNc·èõCTâþ±ò-ëÈ*ƒY¥^Yí0dUÔXIŒ*!Z¬È.VïtjŽÍ£PŸ5ª™ÛN÷û7CÎÉ}M2ßÌ®à¢X\âB +ÝV¸Ã\I«ïAI-' 8ê–8ú¹ÄõÕd{µN9ÝèÑ”Þ+]9G±çÄã0çܘsIkHPÅ»q[–sÒ™þSçáñÁ¾í@ÿª\%à–ÄÒµ¼+Ë(V`™xf™³,i ,™ÒNšK×ÙÚgLõ”g­#úFDÕù +Õ(V šø¦šS-i TId;A©…úatðö¥öx<ms»ò R|Ñ‘0½L; ¯ 2°ÃQŠ[ð˜…w4éáóà­ºô˜Þ<8z®Á]ñE±¿Ä™0Àܘ`I«Gˆ› ÙFÈ-Âýã·m;H]!™È}óÝ"ÔìZìz³ÈÐ×5L*Ë-%µ¾ƒ±¹a鉴?V¼27$™zÂ)ŽÞÏòE̬æüâÆ´NIªiãÍO 2 f’Æu‰™¢OÚucf‡`̵†˜‘5"”´b¦¶1s2zÑDßÏ—gÖã51ó}›»RŒbŠ‰?aŠ¹0Å’Ö@QTKÚ¢(ÜÈ{tðzÿ½]¡j:{ÌãRfsøÆm ºÈf»NŸ{>÷I6·Šê°Ð0vç°\ӺŠbX‰Û`X¹0¬’Ö‹7SÖ‚%SXä§Ò²KêÚ¯6ö‹¹-âc…©y;S(an ϲogkCãšÑL+€I\D¡g'vƒ)i `G\ò˜&€¹Ñ^i¯ÏáÞ“±)Âq}º<×´®°¢XVâ6Vn «¤5À¢U´ KßBô„õ™^lxVá¦FÃe{>4€¦óÉؾ˜Ì›‘Ûå™ëø*þS°¸FtÅÅ +XÁXr`,%­ –ˆÉº[,6‰H$3^ÌÏ–žŽ;½Ô}Ór>ÉäVß}æ¸uEÅ +ˆgÁˆr`D%­QÅPCE±ˆŽŸ¿ÉÖ œÛu‚ü¡u‚«k˜T¶c »k½NHL}¦\nNdV§ +_Ýÿ—¡‰{5Àx«òõTÛÙÆÅJuW;PäÄvŠœ’cÚu—#'7Žœ’V9*›íïèI„œwÇêËa;µZ„p/úc¡c«ƺv­0+Tq™šúú(Y`ž<‹³Ñ_-æ“ë8urïý™ùNÿì% *±E]"¥ä‡VÍÅ8ɵƒaRRé£D$i{k3%…m'÷Sv!b]ð&DbçÉÁ¾êþ•Ù&ÄÒ^ÖÇzBnmBÌþ¦Ç!¦ë8q¶«õlj?« +Tsõq1Lw{q;&» ¤½¢ 9ÎþΚò/éþPu”*½˜È”)Fs®½p/ºD’ï|b@ý§þM‹ßÿÂÝxK»D„¶(E˜ÈåˆQ»Í½Ý{y]™ÄàÿÄÏ–ßendstream +endobj +1069 0 obj << +/Type /Page +/Contents 1070 0 R +/Resources 1068 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 941 0 R +/Annots [ 1075 0 R 1076 0 R 1077 0 R 1078 0 R 1079 0 R 1080 0 R 1081 0 R 1082 0 R 1083 0 R 1084 0 R 1085 0 R 1086 0 R 1087 0 R 1088 0 R 1089 0 R 1090 0 R 1091 0 R 1092 0 R 1093 0 R 1094 0 R 1095 0 R 1096 0 R 1097 0 R 1098 0 R 1099 0 R 1100 0 R 1101 0 R 1102 0 R 1103 0 R 1104 0 R 1105 0 R 1106 0 R 1107 0 R 1108 0 R 1109 0 R 1110 0 R 1111 0 R 1112 0 R 1113 0 R 1114 0 R 1115 0 R 1116 0 R 1117 0 R 1118 0 R 1119 0 R 1120 0 R 1121 0 R ] +>> endobj +1075 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 290.989 539.579 300.012] +/Rect [499.405 754.651 512.306 763.674] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.1) >> +/A << /S /GoTo /D (subsection.5.4.1) >> >> endobj -989 0 obj << +1076 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 277.44 539.579 286.463] +/Rect [499.405 741.102 512.306 750.125] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.2) >> +/A << /S /GoTo /D (subsection.5.4.2) >> >> endobj -990 0 obj << +1077 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 263.891 539.579 272.914] +/Rect [499.405 727.553 512.306 736.575] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.3) >> +/A << /S /GoTo /D (section.5.5) >> >> endobj -991 0 obj << +1078 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 250.342 539.579 259.365] +/Rect [498.314 703.094 512.306 712.663] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.4) >> +/A << /S /GoTo /D (chapter.6) >> >> endobj -992 0 obj << +1079 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 236.793 539.579 245.815] +/Rect [499.405 689.545 512.306 698.568] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.5) >> +/A << /S /GoTo /D (section.6.1) >> >> endobj -993 0 obj << +1080 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 223.243 539.579 232.266] +/Rect [499.405 675.996 512.306 685.019] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.6) >> +/A << /S /GoTo /D (subsection.6.1.1) >> >> endobj -994 0 obj << +1081 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 209.694 539.579 218.717] +/Rect [499.405 662.447 512.306 671.469] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.7) >> +/A << /S /GoTo /D (subsection.6.1.2) >> >> endobj -995 0 obj << +1082 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 196.145 539.579 205.168] +/Rect [499.405 648.897 512.306 657.92] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.8) >> +/A << /S /GoTo /D (subsection.6.1.3) >> >> endobj -996 0 obj << +1083 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 182.596 539.579 191.619] +/Rect [499.405 635.348 512.306 644.371] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.9) >> +/A << /S /GoTo /D (section.6.2) >> >> endobj -997 0 obj << +1084 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 169.047 539.579 178.069] +/Rect [499.405 621.799 512.306 630.822] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.10) >> +/A << /S /GoTo /D (subsection.6.2.1) >> >> endobj -998 0 obj << +1085 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 155.497 539.579 164.52] +/Rect [498.314 597.341 512.306 606.909] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.11) >> +/A << /S /GoTo /D (chapter.7) >> >> endobj -999 0 obj << +1086 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 141.948 539.579 150.971] +/Rect [499.405 583.792 512.306 592.814] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.12) >> +/A << /S /GoTo /D (section.7.1) >> >> endobj -1000 0 obj << +1087 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 128.399 539.579 137.422] +/Rect [499.405 570.242 512.306 579.265] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.13) >> +/A << /S /GoTo /D (section.7.2) >> >> endobj -1001 0 obj << +1088 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 114.85 539.579 123.873] +/Rect [499.405 556.693 512.306 565.716] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.14) >> +/A << /S /GoTo /D (section.7.3) >> >> endobj -1002 0 obj << +1089 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 101.301 539.579 110.323] +/Rect [499.405 543.144 512.306 552.167] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.15) >> +/A << /S /GoTo /D (section.7.4) >> >> endobj -1003 0 obj << +1090 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 87.751 539.579 96.774] +/Rect [499.405 529.595 512.306 538.618] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.16) >> +/A << /S /GoTo /D (section.7.5) >> >> endobj -1004 0 obj << +1091 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 74.202 539.579 83.225] +/Rect [499.405 516.046 512.306 525.068] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.17) >> +/A << /S /GoTo /D (section.7.6) >> >> endobj -1005 0 obj << +1092 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 60.653 539.579 69.676] +/Rect [499.405 502.496 512.306 511.519] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.18) >> ->> endobj -953 0 obj << -/D [951 0 R /XYZ 85.039 786.531 null] ->> endobj -950 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F20 877 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -1008 0 obj << -/Length 1848 -/Filter /FlateDecode ->> -stream -xÚí][sÚ8~çWð3EÕÕ’Ó$MÓIIØ݇¶.8‰§\¶¶Ó¿ºÙC(ÄØMf‚lËô}ç;GG’AM¨þPS0‰lrFPs0nÀæ½:rÑ@®lR¦½ë7Þ¾g¢‰ P6ûw¦Jø¥u:´±hÍ#û1këlœ÷séP@¢¯ò³ñålÕ>6 R4©2HÊæ¸AŒ·=jôŸ³«Øc´iÏÚð¬Â9@B}B Íž± Ï,´Q Év‡¼uzÕ휩>ÿÜ`¾ù©Ý‘§æ²û^·Ü5nw!­¯ÁY»ƒZQòŸÞ%oìÁ(vml·M¥y¢¾Åb0_$QZM墳q¤Kê iÏ ­A Ý%âPW1—P7DíN€a ´; š*år«Ð.XF(*Àu’û¦-Ü^<ñ… /^ÒÕY¹â£#͹%ÀVàgð ºé¢mPS =èlžèê¦Æ\— -4ˆÕ®ô¤Œ8«4˜ük1²_žïÉ8+âµv‹-Ém9ž¨¶¹›n‹”)õ4uævcY^ZÖ™]Èi„ r±I*6Ù—eòdÍ.!àRÔvvlØ×Ew8‡ñdE Þ¬zÓÑÌJ/qwâ´ƒ¹í$²ÇçêäWž…†N‘¦ˆ¥ ¥¸lde‰ÈÙ¿zçjëv ]Õaåò(ø.fÆ„‡©õ§“Mv ƒ£ ýZ ÊD²&à.¦ú°Ë—RmŠåe)±|1š–qã›þí’ò*ÆÁ¼5]v'qú5Ÿ>ÞKÈu5–™¦w˜ 3BÞç“Pì(kÁq$…åÅ‘Â3úhŒîå}PÊF°UãÛ˶LI~r{^¼­PPèØYY‚¡秚çÒJ÷5 OˆîÃsTωK'»!Ôúû|-PŒ_…°Cí½ÑÙ´óéŦ¢ -ÚÔ —H?Jv¡Ÿê5"ˆqëSOóîæÔ:©©ß "XOÕo ÒJÂI:¶\ο뺒®×yÛ,–u‡˜‰c€tÐÌÅ{f®(þ3PÈ­Ê`¢´åÞ±!·‰OfÅÌkeq80Œi³8*Šìy±ñCÓÌæ´Fí^#HI þ]Ajæ(,±òïÚ.‹¡œ%8õ-èá@ÿÿ‘õWæZ¥IËdš[N¢Ÿ‹ÈŽëµÍH¤Úiö¸Îûd–ŽòécßµÆè¼#fØ& uá»éÚ í5õm¹º­êüçòkd. SÛ÷¦4N§ ¬å)À‚ÔeìP¾Lswá ÊFÆ–#æ²5¿BDá<6Ù>D^㘥åAC*`€—K:ØÿÝÜ¢îª~p‹-‘´´¸5²ðS=Í;]HeS‡ÓM$žeƒU€'á™y5sûŠp{F€lKB•QŠÙ»xRÔJφ2õWÊqt§É¸ |“Çx=T`åQATGRä”AîyðâÉ7âò6&OÆ#ÕîBÔ/iV£äMIÀR¬K¨£ëD†óÁoÙâ2-×Äp‹ð9»ý«ÞÉ>Ã2 ¯1ó”ciƒ)é:7la¦Äa›ÂœŽâÁoµ-¤×Ë—Fq×€(XIvgñi–ON;*¯dÔiÿ)/6¼Û,Ÿêñp½\;k%/jåçE:¼ —Ùü¶}ÁËü*œT:ÓŦŽË—²º-âîµ²ŽZɽVÖJ+EQ+ÏÍìbœÉe8w£r¶[°H{óTS]oàÌ.Ʊ“hõRx8£^ 먅Âkae´p‹ˆCnÑÅîE&%¹ ˆ¢›“^*k{%Âæ¥òXpí>*LòZy:šjœb~§Nz©öZÁä^/+¢—l[Ôp5/—U–KTË«©6›þȽצwyÖSÕ¸—Ç -É#òòXÃpÒÂæõqo¸dIúˆ·ÐÇn8NéqŽ½:·Í {u¬€¹í> >> endobj -1010 0 obj << +1093 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 754.651 539.579 763.674] +/Rect [499.405 488.947 512.306 497.97] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.19) >> +/A << /S /GoTo /D (section.7.8) >> >> endobj -1011 0 obj << +1094 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 741.102 539.579 750.125] +/Rect [499.405 475.398 512.306 484.421] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.20) >> +/A << /S /GoTo /D (section.7.9) >> >> endobj -1012 0 obj << +1095 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 727.553 539.579 736.575] +/Rect [498.314 450.94 512.306 460.508] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.21) >> +/A << /S /GoTo /D (chapter.8) >> >> endobj -1013 0 obj << +1096 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 714.003 539.579 723.026] +/Rect [498.314 426.481 512.306 436.05] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.22) >> +/A << /S /GoTo /D (chapter.9) >> >> endobj -1014 0 obj << +1097 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 700.454 539.579 709.477] +/Rect [499.405 412.932 512.306 421.955] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.23) >> +/A << /S /GoTo /D (section.9.1) >> >> endobj -1015 0 obj << +1098 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 686.905 539.579 695.928] +/Rect [498.314 388.474 512.306 398.042] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.24) >> +/A << /S /GoTo /D (chapter.10) >> >> endobj -1016 0 obj << +1099 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 673.356 539.579 682.379] +/Rect [499.405 374.925 512.306 383.947] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.25) >> +/A << /S /GoTo /D (section.10.1) >> >> endobj -1017 0 obj << +1100 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 659.807 539.579 668.829] +/Rect [499.405 361.375 512.306 370.398] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.26) >> +/A << /S /GoTo /D (subsection.10.1.1) >> >> endobj -1018 0 obj << +1101 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 646.257 539.579 655.28] +/Rect [499.405 347.826 512.306 356.849] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.27) >> +/A << /S /GoTo /D (subsection.10.1.2) >> >> endobj -1019 0 obj << +1102 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 632.708 539.579 641.731] +/Rect [499.405 334.277 512.306 343.3] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.28) >> +/A << /S /GoTo /D (section.10.2) >> >> endobj -1020 0 obj << +1103 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 619.159 539.579 628.182] +/Rect [499.405 320.728 512.306 329.751] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.29) >> +/A << /S /GoTo /D (subsection.10.2.1) >> >> endobj -1021 0 obj << +1104 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 605.61 539.579 614.633] +/Rect [499.405 307.179 512.306 316.201] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.2.3.30) >> +/A << /S /GoTo /D (subsection.10.2.2) >> >> endobj -1022 0 obj << +1105 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 592.061 539.579 601.083] +/Rect [499.405 293.629 512.306 302.652] /Subtype /Link -/A << /S /GoTo /D (section.9.3) >> +/A << /S /GoTo /D (subsubsection.10.2.2.1) >> >> endobj -1023 0 obj << +1106 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 578.511 539.579 587.534] +/Rect [499.405 280.08 512.306 289.103] /Subtype /Link -/A << /S /GoTo /D (subsection.9.3.1) >> +/A << /S /GoTo /D (subsubsection.10.2.2.2) >> >> endobj -1024 0 obj << +1107 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 564.962 539.579 573.985] +/Rect [499.405 266.531 512.306 275.554] /Subtype /Link -/A << /S /GoTo /D (subsection.9.3.2) >> +/A << /S /GoTo /D (subsection.10.2.3) >> >> endobj -1025 0 obj << +1108 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 551.413 539.579 560.436] +/Rect [499.405 252.982 512.306 262.005] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.2.1) >> +/A << /S /GoTo /D (subsubsection.10.2.3.1) >> >> endobj -1026 0 obj << +1109 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 537.864 539.579 546.887] +/Rect [499.405 239.433 512.306 248.456] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.2.2) >> +/A << /S /GoTo /D (subsubsection.10.2.3.2) >> >> endobj -1027 0 obj << +1110 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 524.315 539.579 533.337] +/Rect [499.405 225.883 512.306 234.906] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.2.3) >> +/A << /S /GoTo /D (subsubsection.10.2.3.3) >> >> endobj -1028 0 obj << +1111 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 510.765 539.579 519.788] +/Rect [499.405 212.334 512.306 221.357] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.2.4) >> +/A << /S /GoTo /D (subsubsection.10.2.3.4) >> >> endobj -1029 0 obj << +1112 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 497.216 539.579 506.239] +/Rect [499.405 198.785 512.306 207.808] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.2.5) >> +/A << /S /GoTo /D (subsubsection.10.2.3.5) >> >> endobj -1030 0 obj << +1113 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 483.667 539.579 492.69] +/Rect [499.405 185.236 512.306 194.259] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.2.6) >> +/A << /S /GoTo /D (subsubsection.10.2.3.6) >> >> endobj -1031 0 obj << +1114 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 470.118 539.579 479.141] +/Rect [499.405 171.687 512.306 180.71] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.2.7) >> +/A << /S /GoTo /D (subsubsection.10.2.3.7) >> >> endobj -1032 0 obj << +1115 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 456.569 539.579 465.591] +/Rect [499.405 158.138 512.306 167.16] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.2.8) >> +/A << /S /GoTo /D (subsubsection.10.2.3.8) >> >> endobj -1033 0 obj << +1116 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 443.019 539.579 452.042] +/Rect [499.405 144.588 512.306 153.611] /Subtype /Link -/A << /S /GoTo /D (subsection.9.3.3) >> +/A << /S /GoTo /D (subsubsection.10.2.3.9) >> >> endobj -1034 0 obj << +1117 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 429.47 539.579 438.493] +/Rect [499.405 131.039 512.306 140.062] /Subtype /Link -/A << /S /GoTo /D (subsection.9.3.4) >> +/A << /S /GoTo /D (subsubsection.10.2.3.10) >> >> endobj -1035 0 obj << +1118 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 415.921 539.579 424.944] +/Rect [499.405 117.49 512.306 126.513] /Subtype /Link -/A << /S /GoTo /D (subsection.9.3.5) >> +/A << /S /GoTo /D (subsubsection.10.2.3.11) >> >> endobj -1036 0 obj << +1119 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 402.372 539.579 411.395] +/Rect [499.405 103.941 512.306 112.964] /Subtype /Link -/A << /S /GoTo /D (subsection.9.3.6) >> +/A << /S /GoTo /D (subsubsection.10.2.3.12) >> >> endobj -1037 0 obj << +1120 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 388.823 539.579 397.845] +/Rect [499.405 90.392 512.306 99.414] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.6.1) >> +/A << /S /GoTo /D (subsubsection.10.2.3.13) >> >> endobj -1038 0 obj << +1121 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 375.273 539.579 384.296] +/Rect [499.405 63.293 512.306 72.316] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.6.2) >> +/A << /S /GoTo /D (subsubsection.10.2.3.14) >> >> endobj -1039 0 obj << +1071 0 obj << +/D [1069 0 R /XYZ 85.039 786.531 null] +>> endobj +1068 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1124 0 obj << +/Length 3444 +/Filter /FlateDecode +>> +stream +xÚå]KsÛF¾ëWðHÖ.'˜fptl%qʱI»{HràJ´ÃŠ$&$µ©üûÁ<9ƒnE:–åJ9ôcúûºçBtÒ˜ÿèDKÒðn¢tK$§“뻳fòÞ\ùöŒú;æþ–yvÏ×Wg_}Óš« éšnrõ.êé"»vruóÓôùú~Æôt·tÛÙ/Wߟ_EÅ™iʹUûÇÙO¿4“ãÂ÷g ážüiŽB»nrw&$'RpÿýöìòìǨË]'5Ô +É5‘š×Í 2kÕš´ª()I+Tßs•NftJålÎZ5}ñ懲1¬mˆÎ¶†¦†Û2ºæ™²ÚUÖ +BE·çêÅ˳9ç|ús#››õÝbuï¾Ç ÛÙœNwÓ˜‡ëÝÃfin¤³¹±6%³¹è:û!›¦þÀ®¹""æ$ Í#²ÊæýÄ\ä0y)¼í¥nÛv®*(%|КîVÜj$‡`¤1päh9^½ù¶"‡T¤c, +E¯kž)"5ÂbÏÕ—¯¿±‰ø&1¤'Ãró?{z¹ù§»°¸¾¶§×¦M.sý…þô­9»ZÚ#s­›îì%1Ýî6ööþŽ= +ÄbZ`ÄšÔºQ¬Á‚RêîY£!ÖÔÀ¬Á¬FÖ0S€L¾¬QŽ5Ï_½¾ªkŠ š&ÉãjŠÓ5Ï” ÑF“Fë=_//f”Òé¿3ÚôøÛâ˜Ó $¹]ùzï¾ß/î–[O’ýÒc>{IG®ø‡U ˆ/©Y£ø‚E£Ôó¥væ f5òÅœ-¸¢=W.Î_\&8®7ËóÕÂæ§÷?Ü-»ÕÝ2ÀÜ°¸³G¿ÏBðUKÇü¡k0¦cAq" >40ûFa K„†QáÐ}@Î:ÁÓ¤lÔ…dlr4Ôyf½ì† =Ó ªçL5Cõ|Oh’7¤º5dxhOݤkt:·ñ™Ì¹ ­–“9å1‘W M¯výŽdïÇ!«MgÝб ‰ÁInBaÀ0P«!!Z%—¬ÈÖΈ y’”È”Á9‘ûš?F9”Ò ~ìÙëõƒ'6öÚ½~Íj(ÇÑ^~8= ¨3Ʀ IŒ­Ë!ÔçL~;iøhò'1„üþ&œüµ0ù1«‘üB&EI~êÈo¦X%õEK¸uÄËE}¯kž) ¾èHkš‘{©_z§”a$;w^×ï´9”r?Ži ³ºqÇ+Ûs¼[çVÛíÃdÅvN»_Ý—ÛeÞºSÔ%RÛµÇQ9µj•±`”ºq*×ÀTƬF*sNTSQ™9*_>«8¤&<Š7ƒµšæ™ªáù«T|ÏM`þj³=úë÷ëû¯ì˜ÂüÜPî½Ã¤Úõlê6ùD~0!’ó£µ¹ÔÝ¢ƒQ;³ Á X²ê2îñm¾°ô~Ó/üî»`?£hºGÛ-ù†Ž….‰!ÐeA„¡«€¡Ã¬FèšÖý¶„N\¬ ‚'Y¬Ì”Á‹•¹«çßd‹•6oûiébÕ/<õW6ËwËMœLôƒ«e`Û;+áWumù2kÖ(º`Ñ(uãt©€é‚Y t‘',׶Ùáµí xºdÊ`ºä®æ#ø¦çŒñ:¬qÛù§§„Ÿ¨Þö´q‚Û­âîcaÉtㄤ?eYfÌX¢çSfnº¸‹½CO4€"YSÆP@©¥È€ EP«‘"ª#²)W¸™_áþ×å¹ùvQÓÄt3¦VáãhâtÍ3eC4Q¤azÏÝz”ðÖ+Ý0Á î‡ÊHÓ~¤þ "NjÜ(â`1)uãÄ©€‰ƒYÄi¥áWÄñ‹Ü—ßÕ3$; RÇÍúQe¦j€/Ò*s/áÙ‘™IIvß¼®ÞiFÌt?†•[º# §qËë:àVgPlÔž[o¯.l‰T}~ýn§ë•ßíÝlÝ¥ÝÚ}³2{Šºí¯‹M¨¶: ÐûK»Mÿý}Z„r(ù>*‡°&—ºm“EåPíœC˜Õ˜C’ëåFÓrÈK"‡’*$‡2/æÐ)|‹9„zr(!˜C§p+æêVÈ¡Ì­K›C¡ZºÈÖ?ì ¤¢ô3Z;>Îf²e¢Ì¹‰KNî5UTðÜ£ç6™D#>ÝΔK±£R i}¡¹O$ +%ReÎ#ÄdL#&ͽ´È#î7ü¬ Xàübhµ¹ëTÔqìj³Õ5Ï” õÔ¨ØsΩŽp;ßÀGÜoýû   m&C›„vÀZÔj„V Ò¶c±Mb¶Y”alk`l1«[ÆH£²Ué°}}õêòÙ1»s]+|¾±cáKb|Y …„à«€áìFøM$Ëó[_ï߉óçöËèëÛÕõ_3;À|:E×Ça,²I A6‹1ŒlíŒ,f5 ÑX'H§d†l¾MÑq¿#L¿žÄϼCãG™‰Ápæáp„µáÔ”VÂÉr8·þ¹ß{ûx}+ù€Ñ7z,ŒI 1 ¨h!k`1«¡ÞÚHØ_ÛDUQo|Gvßñ/7¿}™ÿT2”àðû«þžÏ²è†`Œ…7‰!ðf†á­€áŬÆ,•‚ð|=E}IE×7~,œI 3 , gí 'f5Â)¢”.à|êE×7z,ŒI 1 ( cí #f5]ûÀËÊuQtÏÛÕîbé]ìü6¬›¾<„ÙË.Ôg?kyá~ðèžS£â1è›;À$†˜…°v³óšñŽÊü’ʪoüX8“gXÎÚNÌj„ÓX§¼@ó©WU×æ± F)ÃMÂÊ:Œ b2Tjßت³Ü_5¸\ö#ÕÍÒ¦æZª q‰j&ÚÇÄuÀXÔjHMª8ix¶TÛ}A•64~,œI 3 , gí 'f5Â);"4/à|â¥64z,ŒI 1 ( cí #f5Ö[!IÇ3ic Ë îóÛµÅSùEì‘…€Œ…8‰!gÁÐ+¬€!ƬÆLåŒp-rˆ}åe_Båõ­‹gCðÌ" ãY;ã‰YxRM4—%ž,Çó –^ßê±8&1Ç,¢0Žµ0Ž˜ÕXzI˜Îl)-J﫵ûYÈo6;ý+Ø._Ú÷A·ê)”Z€±&1Ò,¸0¤µ0¤˜Õš%Š«Ñ/¨ÒúÆD3IÁ`fa±¬­ƒPb&ãËÀ5¡ºBò‰×Xß豯pRÈ[ÜS8Akëð»Ü“¡¼¶‚´<[`§ìªëkÿ8“ŸJ±Ï¸¶úÖ~‰mÂÞaã +BY[¯ Ì> ÚïQÖÈ¡¿ãcþñûcØŸ ŠÓHhÒih.Í-Aô„K"ü½ž‚ù¿*äïÉþ?z²endstream +endobj +1123 0 obj << +/Type /Page +/Contents 1124 0 R +/Resources 1122 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 941 0 R +/Annots [ 1126 0 R 1127 0 R 1128 0 R 1129 0 R 1130 0 R 1131 0 R 1132 0 R 1133 0 R 1134 0 R 1135 0 R 1136 0 R 1137 0 R 1138 0 R 1139 0 R 1140 0 R 1141 0 R 1142 0 R 1143 0 R 1144 0 R 1145 0 R 1146 0 R 1147 0 R 1148 0 R 1149 0 R 1150 0 R 1151 0 R 1152 0 R 1153 0 R 1154 0 R 1155 0 R 1156 0 R 1157 0 R 1158 0 R 1159 0 R 1160 0 R 1161 0 R 1162 0 R 1163 0 R 1164 0 R 1165 0 R 1166 0 R 1167 0 R 1168 0 R 1169 0 R 1170 0 R 1171 0 R 1172 0 R 1173 0 R 1174 0 R ] +>> endobj +1126 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 361.724 539.579 370.747] +/Rect [499.405 754.651 512.306 763.674] /Subtype /Link -/A << /S /GoTo /D (subsection.9.3.7) >> +/A << /S /GoTo /D (subsubsection.10.2.3.15) >> >> endobj -1040 0 obj << +1127 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 348.175 539.579 357.198] +/Rect [499.405 741.102 512.306 750.125] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.7.1) >> +/A << /S /GoTo /D (subsubsection.10.2.3.16) >> >> endobj -1041 0 obj << +1128 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 334.626 539.579 343.649] +/Rect [499.405 727.553 512.306 736.575] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.7.2) >> +/A << /S /GoTo /D (subsubsection.10.2.3.17) >> >> endobj -1042 0 obj << +1129 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 321.077 539.579 330.099] +/Rect [499.405 714.003 512.306 723.026] /Subtype /Link -/A << /S /GoTo /D (subsection.9.3.8) >> +/A << /S /GoTo /D (subsubsection.10.2.3.18) >> >> endobj -1043 0 obj << +1130 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 307.527 539.579 316.55] +/Rect [499.405 686.905 512.306 695.928] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.8.1) >> +/A << /S /GoTo /D (subsubsection.10.2.3.19) >> >> endobj -1044 0 obj << +1131 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 293.978 539.579 303.001] +/Rect [499.405 659.807 512.306 668.829] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.8.2) >> +/A << /S /GoTo /D (subsubsection.10.2.3.20) >> >> endobj -1045 0 obj << +1132 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 280.429 539.579 289.452] +/Rect [499.405 646.257 512.306 655.28] /Subtype /Link -/A << /S /GoTo /D (subsection.9.3.9) >> +/A << /S /GoTo /D (subsubsection.10.2.3.21) >> >> endobj -1046 0 obj << +1133 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 266.88 539.579 275.903] +/Rect [499.405 632.708 512.306 641.731] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.9.1) >> +/A << /S /GoTo /D (subsubsection.10.2.3.22) >> >> endobj -1047 0 obj << +1134 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 253.331 539.579 262.354] +/Rect [499.405 619.159 512.306 628.182] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.9.2) >> +/A << /S /GoTo /D (subsubsection.10.2.3.23) >> >> endobj -1048 0 obj << +1135 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 239.781 539.579 248.804] +/Rect [499.405 605.61 512.306 614.633] /Subtype /Link -/A << /S /GoTo /D (subsection.9.3.10) >> +/A << /S /GoTo /D (subsubsection.10.2.3.24) >> >> endobj -1049 0 obj << +1136 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 226.232 539.579 235.255] +/Rect [499.405 592.061 512.306 601.083] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.10.1) >> +/A << /S /GoTo /D (subsubsection.10.2.3.25) >> >> endobj -1050 0 obj << +1137 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 212.683 539.579 221.706] +/Rect [499.405 578.511 512.306 587.534] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.10.2) >> +/A << /S /GoTo /D (subsubsection.10.2.3.26) >> >> endobj -1051 0 obj << +1138 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 199.134 539.579 208.157] +/Rect [499.405 564.962 512.306 573.985] /Subtype /Link -/A << /S /GoTo /D (subsection.9.3.11) >> +/A << /S /GoTo /D (subsubsection.10.2.3.27) >> >> endobj -1052 0 obj << +1139 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 185.585 539.579 194.608] +/Rect [499.405 551.413 512.306 560.436] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.11.1) >> +/A << /S /GoTo /D (subsubsection.10.2.3.28) >> >> endobj -1053 0 obj << +1140 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 172.036 539.579 181.058] +/Rect [499.405 537.864 512.306 546.887] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.11.2) >> +/A << /S /GoTo /D (subsubsection.10.2.3.29) >> >> endobj -1054 0 obj << +1141 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 158.486 539.579 167.509] +/Rect [499.405 524.315 512.306 533.337] /Subtype /Link -/A << /S /GoTo /D (subsection.9.3.12) >> +/A << /S /GoTo /D (subsubsection.10.2.3.30) >> >> endobj -1055 0 obj << +1142 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 144.937 539.579 153.96] +/Rect [499.405 510.765 512.306 519.788] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.12.1) >> +/A << /S /GoTo /D (section.10.3) >> >> endobj -1056 0 obj << +1143 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 131.388 539.579 140.411] +/Rect [499.405 497.216 512.306 506.239] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.3.12.2) >> +/A << /S /GoTo /D (subsection.10.3.1) >> >> endobj -1057 0 obj << +1144 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 117.839 539.579 126.862] +/Rect [499.405 483.667 512.306 492.69] /Subtype /Link -/A << /S /GoTo /D (section.9.4) >> +/A << /S /GoTo /D (subsection.10.3.2) >> >> endobj -1058 0 obj << +1145 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 104.29 539.579 113.312] +/Rect [499.405 456.569 512.306 465.591] /Subtype /Link -/A << /S /GoTo /D (subsection.9.4.1) >> +/A << /S /GoTo /D (subsubsection.10.3.2.1) >> >> endobj -1059 0 obj << +1146 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 90.74 539.579 99.763] +/Rect [499.405 443.019 512.306 452.042] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.4.1.1) >> +/A << /S /GoTo /D (subsubsection.10.3.2.2) >> >> endobj -1060 0 obj << +1147 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 77.191 539.579 86.214] +/Rect [499.405 429.47 512.306 438.493] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.4.1.2) >> +/A << /S /GoTo /D (subsubsection.10.3.2.3) >> >> endobj -1061 0 obj << +1148 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 63.642 539.579 72.665] +/Rect [499.405 415.921 512.306 424.944] /Subtype /Link -/A << /S /GoTo /D (subsection.9.4.2) >> ->> endobj -1009 0 obj << -/D [1007 0 R /XYZ 85.039 786.531 null] +/A << /S /GoTo /D (subsubsection.10.3.2.4) >> >> endobj -1006 0 obj << -/Font << /F58 956 0 R /F15 895 0 R >> -/ProcSet [ /PDF /Text ] +1149 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 402.372 512.306 411.395] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.10.3.2.5) >> >> endobj -1064 0 obj << -/Length 1717 -/Filter /FlateDecode ->> -stream -xÚíœ]w›8†ïý+|·paŠ¾@\¦N›M7uÛØmöœ¶Ô&§6¤oNþýÎH€íÄIMãÏD'e¬GóÎŒ¤@š.ü‘¦ŽË‚¦/=G0ÒìnsWN¤¸ÃmrÇõ^zÝk¼z+d“¸NàÍÞ¥º¥7øjµÓĦÒÊ#}˜Øß{ïozs´¸Ã=†­üj|ýî6ðEï®ÃÙ¼²ë hŽ\0GpVœÝƧª}7õ§–?K‡gµ|9Æv ÉD®×èèö°Ü®Ú)VÑÈo.aÛèæg%“t!‰0*yˆ*)ŒJîT%Y\¿ãÕ[Îæ®Rá¸)nI}ÇÂç«Á;Þž¡°ž}è-iLHxZ6¶¤-áp}½ófY”9\òU›è}8ùÐRœîbœ¬¥é»rMÂá -‡÷Ó´š²Â-:[n]B1-çnŽÛ˜šÐb²/®—mAĤñ½ës¶ùˆ© f\ï®hÕÖKZèe÷hqÒ† ÿ`}×ËÒI³&¸w:¹26#”OÇÅ·£x€Ç…X±{nB¬/˜l|Á¿¶,{¶dV&P­¬.ìçZM;áÏ£A¹`H¬)KŒM»'¶^ɤ;¢YÏíyUšÐ‰rM‰^…Y¤9½QûB0…|>\6^oÃk…™žIöCEë9=ÏdëÂ%¶#“t™LV³*z/Œ>S²ynï4QS-v+`Ô¨åúAÖµ;“#ì…ýý6#—;“KV#&ñ‹¡Ý^µ<f!®â¾–ÎI<Ðâ‰'ée‘ôôù1Ê¥JÂ8Á*jMó«br WûêbãäLà?‹X+N̯býãè›K8æh1v#H_ ]3ɵVb‰|ÄÀ#ÍS•C÷ÓüV(x½gH½í -wY·µð«ÆÇ Ë²¬5;&ËÙ±Óã‰vkaRLx«*Ÿ‘CèûCòþÓmô·!¬\ç…-¹ÎôF#Ðß–~&*Å“½ÁÓd¶¿M1n`ìtÓ<ë%rqÚìs/&ñ“p¤!ÞØbD£Që7Œ}<÷Ìa‹\ÊD¯Ì n*2hsC“()(4ð_rbço#T‘Uô¹º‚ãëB‚Á™Q¿0Ê­XÙÂ,Ø.Ù=¬qÀO¦“(SQ y‘&7¿š#ç¹V3ÌR\ »F85T6d/¬&–p‡“H€Ä@Y=Õ¢Üábù[ˆç0ëvÔ÷SwÉ÷~.ü²n8þ `†Û 2„„^’ÇÉPןڊ±ò(KÂѽ×pNô‹ ðèƒ¥Ï ‚{}@—õ(þîâå-êºôMÅÏÏëp*®PCôvÞ£“¯Œ4ØøLÔP YÍƳÉq5°qÝQ+ `d—«”—a¿˜tÇYC¼ë JY˜áÓéD_{ö1éù©ïˆ’ÔK_„k]&vŸ îóÙŽýél¤wükþÒ«ñ„rM¹}¥öÄ Ö*B('Û£¸D>?ÚÚ¯Ô) »\/S­6å[8ŠÍÙ¸Xã„2 lЀ.bä3Ðá\!…Þ+úOÑÝJ$»»¼N˜ +í¤9º¼Å>‘/ÊœžHëéQ¹õ]`x×AJ]¬ðÀ@<Ž”®+ÜóxípÏ}4Ò[Áƒ2л8ítõˆ|‹³2au 4:M¢Ù¿¬f¸@Ž'Ÿ;§ÿBÉ•F¸ê³ô¶Á²ÈnþÆ—X£¨©fëá*ÕÉLe¯¬´W6g«øžÐ0Yw}Ç@«—‘Ò2W9 1r¸ &²ƒ°6Ã}Þ×ÂÑ÷–¿vfÉOx³+—«/ Þû-åË"æïw!endstream -endobj -1063 0 obj << -/Type /Page -/Contents 1064 0 R -/Resources 1062 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 881 0 R -/Annots [ 1066 0 R 1067 0 R 1068 0 R 1069 0 R 1070 0 R 1071 0 R 1072 0 R 1073 0 R 1074 0 R 1075 0 R 1076 0 R 1080 0 R 1081 0 R 1082 0 R 1083 0 R 1084 0 R 1085 0 R 1086 0 R 1087 0 R 1088 0 R 1089 0 R 1090 0 R 1091 0 R 1092 0 R 1093 0 R 1094 0 R 1095 0 R 1096 0 R 1097 0 R 1098 0 R 1099 0 R 1100 0 R 1101 0 R 1102 0 R 1103 0 R 1104 0 R 1105 0 R 1106 0 R 1107 0 R 1108 0 R 1109 0 R 1110 0 R 1111 0 R 1112 0 R 1113 0 R 1114 0 R 1115 0 R 1116 0 R 1117 0 R 1118 0 R ] +1150 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 388.823 512.306 397.845] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.10.3.2.6) >> >> endobj -1066 0 obj << +1151 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 754.651 539.579 763.674] +/Rect [499.405 375.273 512.306 384.296] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.4.2.1) >> +/A << /S /GoTo /D (subsubsection.10.3.2.7) >> >> endobj -1067 0 obj << +1152 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 741.102 539.579 750.125] +/Rect [499.405 361.724 512.306 370.747] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.4.2.2) >> +/A << /S /GoTo /D (subsubsection.10.3.2.8) >> >> endobj -1068 0 obj << +1153 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 727.553 539.579 736.575] +/Rect [499.405 348.175 512.306 357.198] /Subtype /Link -/A << /S /GoTo /D (subsection.9.4.3) >> +/A << /S /GoTo /D (subsection.10.3.3) >> >> endobj -1069 0 obj << +1154 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 714.003 539.579 723.026] +/Rect [499.405 334.626 512.306 343.649] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.4.3.1) >> +/A << /S /GoTo /D (subsection.10.3.4) >> >> endobj -1070 0 obj << +1155 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 700.454 539.579 709.477] +/Rect [499.405 321.077 512.306 330.099] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.4.3.2) >> +/A << /S /GoTo /D (subsection.10.3.5) >> >> endobj -1071 0 obj << +1156 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 686.905 539.579 695.928] +/Rect [499.405 307.527 512.306 316.55] /Subtype /Link -/A << /S /GoTo /D (subsection.9.4.4) >> +/A << /S /GoTo /D (subsection.10.3.6) >> >> endobj -1072 0 obj << +1157 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 673.356 539.579 682.379] +/Rect [499.405 293.978 512.306 303.001] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.4.4.1) >> +/A << /S /GoTo /D (subsubsection.10.3.6.1) >> >> endobj -1073 0 obj << +1158 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 659.807 539.579 668.829] +/Rect [499.405 280.429 512.306 289.452] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.4.4.2) >> +/A << /S /GoTo /D (subsubsection.10.3.6.2) >> >> endobj -1074 0 obj << +1159 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 646.257 539.579 655.28] +/Rect [499.405 266.88 512.306 275.903] /Subtype /Link -/A << /S /GoTo /D (subsection.9.4.5) >> +/A << /S /GoTo /D (subsection.10.3.7) >> >> endobj -1075 0 obj << +1160 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 632.708 539.579 641.731] +/Rect [499.405 253.331 512.306 262.354] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.4.5.1) >> +/A << /S /GoTo /D (subsubsection.10.3.7.1) >> >> endobj -1076 0 obj << +1161 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 619.159 539.579 628.182] +/Rect [499.405 239.781 512.306 248.804] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.4.5.2) >> +/A << /S /GoTo /D (subsubsection.10.3.7.2) >> >> endobj -1080 0 obj << +1162 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 605.61 539.579 614.633] +/Rect [499.405 226.232 512.306 235.255] /Subtype /Link -/A << /S /GoTo /D (section.9.5) >> +/A << /S /GoTo /D (subsection.10.3.8) >> >> endobj -1081 0 obj << +1163 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 592.061 539.579 601.083] +/Rect [499.405 212.683 512.306 221.706] /Subtype /Link -/A << /S /GoTo /D (subsection.9.5.1) >> +/A << /S /GoTo /D (subsubsection.10.3.8.1) >> >> endobj -1082 0 obj << +1164 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 578.511 539.579 587.534] +/Rect [499.405 199.134 512.306 208.157] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.5.1.1) >> +/A << /S /GoTo /D (subsubsection.10.3.8.2) >> >> endobj -1083 0 obj << +1165 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 564.962 539.579 573.985] +/Rect [499.405 185.585 512.306 194.608] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.5.1.2) >> +/A << /S /GoTo /D (subsection.10.3.9) >> >> endobj -1084 0 obj << +1166 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 551.413 539.579 560.436] +/Rect [499.405 172.036 512.306 181.058] /Subtype /Link -/A << /S /GoTo /D (subsection.9.5.2) >> +/A << /S /GoTo /D (subsubsection.10.3.9.1) >> >> endobj -1085 0 obj << +1167 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 537.864 539.579 546.887] +/Rect [499.405 158.486 512.306 167.509] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.5.2.1) >> +/A << /S /GoTo /D (subsubsection.10.3.9.2) >> >> endobj -1086 0 obj << +1168 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 524.315 539.579 533.337] +/Rect [499.405 144.937 512.306 153.96] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.5.2.2) >> +/A << /S /GoTo /D (subsection.10.3.10) >> >> endobj -1087 0 obj << +1169 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 510.765 539.579 519.788] +/Rect [499.405 131.388 512.306 140.411] /Subtype /Link -/A << /S /GoTo /D (section.9.6) >> +/A << /S /GoTo /D (subsubsection.10.3.10.1) >> >> endobj -1088 0 obj << +1170 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 497.216 539.579 506.239] +/Rect [499.405 117.839 512.306 126.862] /Subtype /Link -/A << /S /GoTo /D (subsection.9.6.1) >> +/A << /S /GoTo /D (subsubsection.10.3.10.2) >> >> endobj -1089 0 obj << +1171 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 483.667 539.579 492.69] +/Rect [499.405 104.29 512.306 113.312] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.6.1.1) >> +/A << /S /GoTo /D (subsection.10.3.11) >> >> endobj -1090 0 obj << +1172 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 470.118 539.579 479.141] +/Rect [499.405 90.74 512.306 99.763] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.6.1.2) >> +/A << /S /GoTo /D (subsubsection.10.3.11.1) >> >> endobj -1091 0 obj << +1173 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 456.569 539.579 465.591] +/Rect [499.405 77.191 512.306 86.214] /Subtype /Link -/A << /S /GoTo /D (subsection.9.6.2) >> +/A << /S /GoTo /D (subsubsection.10.3.11.2) >> >> endobj -1092 0 obj << +1174 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 443.019 539.579 452.042] +/Rect [499.405 63.642 512.306 72.665] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.6.2.1) >> +/A << /S /GoTo /D (subsection.10.3.12) >> >> endobj -1093 0 obj << +1125 0 obj << +/D [1123 0 R /XYZ 85.039 786.531 null] +>> endobj +1122 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1177 0 obj << +/Length 2719 +/Filter /FlateDecode +>> +stream +xÚåœ[sÛ¶Çßý)ôv¤¡Ä;'“žÔicô¡ík˶¦¶”Hr3ùö ®´›âLâ8òx<"),wñÿ‹ )ÒQcþèHKÒðn¤tK$§£‹»£ftm¾yqD}‰©/2ÍÊ<›ýðïÖ|Û®éF³«xž®!²kG³ËßÆ'«å„éñvî>6“?f?=ŸÅg®)çö´ï~û£]š~YC¨Ì³ü)¥[_ùZœÉ Á™ ã,€qb^#Φ%æ硧[_éZŒÉ Á˜ +c,€1b^Cº•'T £Ø“nrÛ¯,ÕÕõji×ÔW&÷pTƒ•T33˜j®/HuO UÔkhœRuD6:£ú„rm¨|-Îd†àÌ„…q–À81¯g+I'wqx® •®Å˜ÌŒ™ ²0–À1¯1×Jf¼§Ut"ÿA®ý½¡ü!à= X/C-Ød†€Í$†Á–À`1¯±}rMt6’O)Ûºº×ÂŒVˤ*Œ²ð“D\FLš²t‡ä¡'Z_éZ„É a˜ +C,€)b^ÃíJ[Xµq™VZ¿¦¨ÈŠšÓ4=»-³\úŸœÌm¹?¿|e³ó«×³='“šPÍÂÉöœK!…ÿþìù¾S0N„–Ÿ9EøþÌÞwµ7]…`ßâúC¾ƒ®1O¤öKfÈ5–ц¯±2øü†Î\tš0š®±p?õ—û¸>e6>ºÕÿ+³¹ + U§'îö99¬n=R‰83ƒçbƒˆ÷"F½†Þ@hAÚ–gˆŸP¿*_‹3™!83a%…p–À81¯§¢„R±ƒóÀ;÷PéZŒÉ Á˜ +c,€1b^câ•Š˜éVÂèïÁžÇ™“[¡2åYßø¥Ñz!jÑ&3m&2Œ¶ F‹y-TÒÐ6Cû”®¯|-Îd†àÌ„…q–À81¯'7Þ[µƒóЮ¯t-Æd†`Ì…1–À1¯a6%hK:1¶nôzþfB)¿µ³¢·ö~ëIþÔ§9Ø/wžúìïì~|êÓüÔv´l¦ußWîõšÔRNfåLoÉ Êe0eÌkìVNxטÛ0Ÿ9›oX ú¦_»Ù=ð|xÈÉNw XÅÅát¬^ŠZ¸É ›É Ã-€áb^C&æº#švÜ'Ô±†ÊWâÌÌ`œ¹° Î=€8Q¯§j S;4¼_õu®…­†IMaá&ˆ¸ É–·Œ(FA¶'ÙÆE$÷œ“ÛúÎsߧ¾\+K“iÇÙwœpƒµp“B7“Æ[óżÆ*:BUø)%\_ùZœÉ Á™ ã,€qb^#N.IËØÎCϸ¾Òµ“‚1ÆXcļ†™ gŒ4*.è*7“9Y|gŸÚ_]¯{»q³ð?`Û,.Óhwuå§13·jï0£éK{ˆï·7é÷RÃÌîÅPf»°kRê¾:5_ÇZjÉ ¡–é'9D­ ¦†ye£‰dqÝV…™Ééü÷† +ûôŠîð3ÃNÓÃ^õ jÔòMfßLi˜oÌóø²NNÉÄ׆~¶cŸÕv5¬\¬nLfã›ñxxÔA˜JÔ™Œ:D½'5ê5¢Ö”–¡ö÷Ÿ¸LzßY`ºRþ4{Ej'3„q¦¶ã2˜1æ5t²¬UD«¸ˆ¯ýráËÓë@û¥_|3Rœ~û6ý.ˆ·W§–w2CxgÊüË`Þ˜×ئ¥ <­FèÐ=ÿ:ÑÂ…†_‘OíÖ_ËaºjÚø7HŠ=ׂlºÃiØ^–ZÐÉ Iƒ.€Ac^Ã$ˆ “±•Î@gsÚÿ.Ÿ®Tlú[G÷ÃľÛáövúøJwß”—¯]-¯d†ðÊ”ƒy•À¼0¯‘3C)Öíðò“Ö0ù‰ÙFj!9B΀†uêÑ63_ÉZlÉ Á– c+€±a^c>¥ÜàË°±Ú|j:Ös3ü²¨£o2CðfBK á-€ñb^c«4Þ)ÏèfI4G<ÙºûÍ|=Œ¨èãƒæªXË,Z!È’x0±Â; qxQûÞ2Mw€±z`×땽WúÎBëØã¡*X‰+3ƒyåâÀöC½FdŠ“†³d¼Y»è7óa`J0_½Z`É –I+(€qÍHË…ª!»½ï 3Æ)šÈlå¯8¤”§l + TMÂF£óþîÏÞ°2\íó$k ÑŽC—ÛÅòÚ9¸Òñv¾^ö·ÅëðCRˆ˜¾0ðÎ)[HÊt¢BÁìD›¦eø;"©hÊŸYý¦Ü”ë¨ÔNÓìÄüøÏÍv=<¤#¨xÜÓ쇛¥©j›X2CšX†¾.Êàœˆyð%",²R;¦´ð‡%ÖEºW14šá¾²{…h¸}Õ_øÛ v9Ö–xkóê×Öhu¿qß=ë/ì\ï/Wb¾¼tKòZµ(yzjÉ&3„l¦1L¶ &‹ydE:Ö²¼$ëx¤¦Ü§»Z³ÓgöÈ¿)NÕ·k¯U-ýd†ÐÏ8ÀôË`ú˜×@¿„+àûsžÜôá}vqegÝõävñé]Jصޛáºñy Üô:W5…îøgOÖwþÞ¦ ü«qóµ¬Ä–¬`j™~z\éd†¹ È´’²ˆL:d¿.,±K7õùôlöû0dÚOœX‚7Ӷ׾9Ÿ­¶ßÕG«§~> endobj +1179 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 429.47 539.579 438.493] +/Rect [499.405 754.651 512.306 763.674] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.6.2.2) >> +/A << /S /GoTo /D (subsubsection.10.3.12.1) >> >> endobj -1094 0 obj << +1180 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 415.921 539.579 424.944] +/Rect [499.405 741.102 512.306 750.125] /Subtype /Link -/A << /S /GoTo /D (section.9.7) >> +/A << /S /GoTo /D (subsubsection.10.3.12.2) >> >> endobj -1095 0 obj << +1181 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 402.372 539.579 411.395] +/Rect [499.405 727.553 512.306 736.575] /Subtype /Link -/A << /S /GoTo /D (subsection.9.7.1) >> +/A << /S /GoTo /D (section.10.4) >> >> endobj -1096 0 obj << +1182 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 388.823 539.579 397.845] +/Rect [499.405 714.003 512.306 723.026] /Subtype /Link -/A << /S /GoTo /D (subsection.9.7.2) >> +/A << /S /GoTo /D (subsection.10.4.1) >> >> endobj -1097 0 obj << +1183 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 375.273 539.579 384.296] +/Rect [499.405 700.454 512.306 709.477] /Subtype /Link -/A << /S /GoTo /D (subsection.9.7.3) >> +/A << /S /GoTo /D (subsubsection.10.4.1.1) >> >> endobj -1098 0 obj << +1184 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 361.724 539.579 370.747] +/Rect [499.405 686.905 512.306 695.928] /Subtype /Link -/A << /S /GoTo /D (section.9.8) >> +/A << /S /GoTo /D (subsubsection.10.4.1.2) >> >> endobj -1099 0 obj << +1185 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 348.175 539.579 357.198] +/Rect [499.405 673.356 512.306 682.379] /Subtype /Link -/A << /S /GoTo /D (subsection.9.8.1) >> +/A << /S /GoTo /D (subsection.10.4.2) >> >> endobj -1100 0 obj << +1186 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 334.626 539.579 343.649] +/Rect [499.405 659.807 512.306 668.829] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.8.1.1) >> +/A << /S /GoTo /D (subsubsection.10.4.2.1) >> >> endobj -1101 0 obj << +1187 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 321.077 539.579 330.099] +/Rect [499.405 646.257 512.306 655.28] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.8.1.2) >> +/A << /S /GoTo /D (subsubsection.10.4.2.2) >> >> endobj -1102 0 obj << +1188 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 307.527 539.579 316.55] +/Rect [499.405 632.708 512.306 641.731] /Subtype /Link -/A << /S /GoTo /D (subsection.9.8.2) >> +/A << /S /GoTo /D (subsection.10.4.3) >> >> endobj -1103 0 obj << +1189 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 293.978 539.579 303.001] +/Rect [499.405 619.159 512.306 628.182] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.8.2.1) >> +/A << /S /GoTo /D (subsubsection.10.4.3.1) >> >> endobj -1104 0 obj << +1190 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 280.429 539.579 289.452] +/Rect [499.405 605.61 512.306 614.633] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.8.2.2) >> +/A << /S /GoTo /D (subsubsection.10.4.3.2) >> >> endobj -1105 0 obj << +1191 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 266.88 539.579 275.903] +/Rect [499.405 592.061 512.306 601.083] /Subtype /Link -/A << /S /GoTo /D (subsubsection.9.8.2.3) >> +/A << /S /GoTo /D (subsection.10.4.4) >> >> endobj -1106 0 obj << +1192 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 242.422 539.579 251.99] +/Rect [499.405 578.511 512.306 587.534] /Subtype /Link -/A << /S /GoTo /D (chapter.10) >> +/A << /S /GoTo /D (subsubsection.10.4.4.1) >> >> endobj -1107 0 obj << +1193 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 228.872 539.579 237.895] +/Rect [499.405 564.962 512.306 573.985] /Subtype /Link -/A << /S /GoTo /D (section.10.1) >> +/A << /S /GoTo /D (subsubsection.10.4.4.2) >> >> endobj -1108 0 obj << +1194 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 215.323 539.579 224.346] +/Rect [499.405 551.413 512.306 560.436] /Subtype /Link -/A << /S /GoTo /D (section.10.2) >> +/A << /S /GoTo /D (subsection.10.4.5) >> >> endobj -1109 0 obj << +1195 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 201.774 539.579 210.797] +/Rect [499.405 537.864 512.306 546.887] /Subtype /Link -/A << /S /GoTo /D (section.10.3) >> +/A << /S /GoTo /D (subsubsection.10.4.5.1) >> >> endobj -1110 0 obj << +1196 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 188.225 539.579 197.248] +/Rect [499.405 524.315 512.306 533.337] /Subtype /Link -/A << /S /GoTo /D (section.10.4) >> +/A << /S /GoTo /D (subsubsection.10.4.5.2) >> >> endobj -1111 0 obj << +1197 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 174.676 539.579 183.698] +/Rect [499.405 510.765 512.306 519.788] /Subtype /Link /A << /S /GoTo /D (section.10.5) >> >> endobj -1112 0 obj << +1198 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 150.217 539.579 159.786] +/Rect [499.405 497.216 512.306 506.239] /Subtype /Link -/A << /S /GoTo /D (chapter.11) >> +/A << /S /GoTo /D (subsection.10.5.1) >> >> endobj -1113 0 obj << +1199 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 136.668 539.579 145.691] +/Rect [499.405 483.667 512.306 492.69] /Subtype /Link -/A << /S /GoTo /D (section.11.1) >> +/A << /S /GoTo /D (subsubsection.10.5.1.1) >> >> endobj -1114 0 obj << +1200 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 112.21 539.579 121.778] +/Rect [499.405 470.118 512.306 479.141] /Subtype /Link -/A << /S /GoTo /D (chapter.12) >> +/A << /S /GoTo /D (subsubsection.10.5.1.2) >> >> endobj -1115 0 obj << +1201 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 98.661 539.579 107.683] +/Rect [499.405 456.569 512.306 465.591] /Subtype /Link -/A << /S /GoTo /D (section.12.1) >> +/A << /S /GoTo /D (subsection.10.5.2) >> >> endobj -1116 0 obj << +1202 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 85.111 539.579 94.134] +/Rect [499.405 443.019 512.306 452.042] /Subtype /Link -/A << /S /GoTo /D (section.12.2) >> +/A << /S /GoTo /D (subsubsection.10.5.2.1) >> >> endobj -1117 0 obj << +1203 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 71.562 539.579 80.585] +/Rect [499.405 429.47 512.306 438.493] /Subtype /Link -/A << /S /GoTo /D (section.12.3) >> +/A << /S /GoTo /D (subsubsection.10.5.2.2) >> >> endobj -1118 0 obj << +1204 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 58.013 539.579 67.036] +/Rect [499.405 415.921 512.306 424.944] /Subtype /Link -/A << /S /GoTo /D (section.12.4) >> +/A << /S /GoTo /D (section.10.6) >> >> endobj -1065 0 obj << -/D [1063 0 R /XYZ 85.039 786.531 null] +1205 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 402.372 512.306 411.395] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.6.1) >> >> endobj -1062 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F43 1079 0 R /F20 877 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -1121 0 obj << -/Length 1144 -/Filter /FlateDecode ->> -stream -xÚíZMs›H½ëWp„“ùfÈeË›JœMEY'VeÙ0YKhA²*ÿ~»™A‰e¬È–õaå*3Ô hè×ý^wó(ü1Ï(BEìEF%˜—Ž{ÔÂÌi¹Ô“„j…Sz/Þ(ã1Jb{ƒoõ’AöÅULnüYnUðuð®÷zðËMBI¤x—ÿz_¾R/ƒz×£DÄÆ[À˜ÇÞ¸'• J -w~Õ;ï}\ÞÅÎIÏ^Õ²×P2N¨‰½PPbŒ\nš©–MÃZIXj)ý“é4`þÕ(Mf#x–P3ê“ T´å ãøι –w‹ø“ çÅZr÷’¤š*à4Ÿäeój÷ïk,öòòzÔðÎ|!îôè8­9.Þ†ã´å¸EÝq®¿Õ¦›–ئIú½îÎóò)MŠÒtCiŸë÷SeZÛT¼ð8—íÁãÕî¹L7\Öoë^(¥;í:z¼›ÀŠGíŸ)ÿô†-¾0–fó*üÖ;t¼ò]Åÿkçeendstream -endobj -1120 0 obj << -/Type /Page -/Contents 1121 0 R -/Resources 1119 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 1148 0 R -/Annots [ 1123 0 R 1124 0 R 1125 0 R 1126 0 R 1127 0 R 1128 0 R 1129 0 R 1130 0 R 1131 0 R 1132 0 R 1133 0 R 1134 0 R 1135 0 R 1136 0 R 1137 0 R 1138 0 R 1139 0 R 1140 0 R 1141 0 R 1142 0 R 1143 0 R 1144 0 R 1145 0 R 1146 0 R 1147 0 R ] ->> endobj -1123 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 754.651 539.579 763.674] -/Subtype /Link -/A << /S /GoTo /D (subsection.12.4.1) >> ->> endobj -1124 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 741.102 539.579 750.125] -/Subtype /Link -/A << /S /GoTo /D (subsection.12.4.2) >> ->> endobj -1125 0 obj << +1206 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 727.553 539.579 736.575] +/Rect [499.405 388.823 512.306 397.845] /Subtype /Link -/A << /S /GoTo /D (subsection.12.4.3) >> +/A << /S /GoTo /D (subsubsection.10.6.1.1) >> >> endobj -1126 0 obj << +1207 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 714.003 539.579 723.026] +/Rect [499.405 375.273 512.306 384.296] /Subtype /Link -/A << /S /GoTo /D (section.12.5) >> +/A << /S /GoTo /D (subsubsection.10.6.1.2) >> >> endobj -1127 0 obj << +1208 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 700.454 539.579 709.477] +/Rect [499.405 361.724 512.306 370.747] /Subtype /Link -/A << /S /GoTo /D (subsection.12.5.1) >> +/A << /S /GoTo /D (subsection.10.6.2) >> >> endobj -1128 0 obj << +1209 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 686.905 539.579 695.928] +/Rect [499.405 348.175 512.306 357.198] /Subtype /Link -/A << /S /GoTo /D (subsection.12.5.2) >> +/A << /S /GoTo /D (subsubsection.10.6.2.1) >> >> endobj -1129 0 obj << +1210 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 673.356 539.579 682.379] +/Rect [499.405 334.626 512.306 343.649] /Subtype /Link -/A << /S /GoTo /D (section.12.6) >> +/A << /S /GoTo /D (subsubsection.10.6.2.2) >> >> endobj -1130 0 obj << +1211 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 659.807 539.579 668.829] +/Rect [499.405 321.077 512.306 330.099] /Subtype /Link -/A << /S /GoTo /D (section.12.7) >> +/A << /S /GoTo /D (section.10.7) >> >> endobj -1131 0 obj << +1212 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 635.348 539.579 644.917] +/Rect [499.405 307.527 512.306 316.55] /Subtype /Link -/A << /S /GoTo /D (chapter.13) >> +/A << /S /GoTo /D (subsection.10.7.1) >> >> endobj -1132 0 obj << +1213 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 621.799 539.579 630.822] +/Rect [499.405 293.978 512.306 303.001] /Subtype /Link -/A << /S /GoTo /D (section.13.1) >> +/A << /S /GoTo /D (subsection.10.7.2) >> >> endobj -1133 0 obj << +1214 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 608.25 539.579 617.273] +/Rect [499.405 280.429 512.306 289.452] /Subtype /Link -/A << /S /GoTo /D (section.13.2) >> +/A << /S /GoTo /D (subsection.10.7.3) >> >> endobj -1134 0 obj << +1215 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 594.701 539.579 603.724] +/Rect [499.405 266.88 512.306 275.903] /Subtype /Link -/A << /S /GoTo /D (section.13.3) >> +/A << /S /GoTo /D (section.10.8) >> >> endobj -1135 0 obj << +1216 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 570.242 539.579 579.811] +/Rect [499.405 253.331 512.306 262.354] /Subtype /Link -/A << /S /GoTo /D (chapter.14) >> +/A << /S /GoTo /D (subsection.10.8.1) >> >> endobj -1136 0 obj << +1217 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 556.693 539.579 565.716] +/Rect [499.405 239.781 512.306 248.804] /Subtype /Link -/A << /S /GoTo /D (section.14.1) >> +/A << /S /GoTo /D (subsubsection.10.8.1.1) >> >> endobj -1137 0 obj << +1218 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 543.144 539.579 552.167] +/Rect [499.405 226.232 512.306 235.255] /Subtype /Link -/A << /S /GoTo /D (section.14.2) >> +/A << /S /GoTo /D (subsubsection.10.8.1.2) >> >> endobj -1138 0 obj << +1219 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 529.595 539.579 538.618] +/Rect [499.405 212.683 512.306 221.706] /Subtype /Link -/A << /S /GoTo /D (subsection.14.2.1) >> +/A << /S /GoTo /D (subsection.10.8.2) >> >> endobj -1139 0 obj << +1220 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 516.046 539.579 525.068] +/Rect [499.405 199.134 512.306 208.157] /Subtype /Link -/A << /S /GoTo /D (subsection.14.2.2) >> +/A << /S /GoTo /D (subsubsection.10.8.2.1) >> >> endobj -1140 0 obj << +1221 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 502.496 539.579 511.519] +/Rect [499.405 185.585 512.306 194.608] /Subtype /Link -/A << /S /GoTo /D (section.14.3) >> +/A << /S /GoTo /D (subsubsection.10.8.2.2) >> >> endobj -1141 0 obj << +1222 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 488.947 539.579 497.97] +/Rect [499.405 172.036 512.306 181.058] /Subtype /Link -/A << /S /GoTo /D (subsection.14.3.1) >> +/A << /S /GoTo /D (subsubsection.10.8.2.3) >> >> endobj -1142 0 obj << +1223 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 464.489 539.579 474.057] +/Rect [498.314 147.577 512.306 157.145] /Subtype /Link -/A << /S /GoTo /D (chapter.15) >> +/A << /S /GoTo /D (chapter.11) >> >> endobj -1143 0 obj << +1224 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 450.94 539.579 459.963] +/Rect [499.405 134.028 512.306 143.051] /Subtype /Link -/A << /S /GoTo /D (section.15.1) >> +/A << /S /GoTo /D (section.11.1) >> >> endobj -1144 0 obj << +1225 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 437.39 539.579 446.413] +/Rect [499.405 120.479 512.306 129.502] /Subtype /Link -/A << /S /GoTo /D (section.15.2) >> +/A << /S /GoTo /D (section.11.2) >> >> endobj -1145 0 obj << +1226 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 412.932 539.579 422.5] +/Rect [499.405 106.93 512.306 115.952] /Subtype /Link -/A << /S /GoTo /D (chapter.16) >> +/A << /S /GoTo /D (section.11.3) >> >> endobj -1146 0 obj << +1227 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 399.383 539.579 408.406] +/Rect [499.405 93.38 512.306 102.403] /Subtype /Link -/A << /S /GoTo /D (section.16.1) >> +/A << /S /GoTo /D (section.11.4) >> >> endobj -1147 0 obj << +1228 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 385.834 539.579 394.857] +/Rect [499.405 79.831 512.306 88.854] /Subtype /Link -/A << /S /GoTo /D (section.16.2) >> +/A << /S /GoTo /D (section.11.5) >> >> endobj -1122 0 obj << -/D [1120 0 R /XYZ 85.039 786.531 null] +1178 0 obj << +/D [1176 0 R /XYZ 85.039 786.531 null] >> endobj -1119 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F20 877 0 R >> +1175 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F14 969 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1151 0 obj << -/Length 2942 +1232 0 obj << +/Length 3005 /Filter /FlateDecode >> stream -xÚ•]oÛ8ò½¿"÷X+ú–µûÔ¤í"‡n’k\t^[¶u•%/%ošûõ7_¤h[n{(‘Ãáp8ß7¼à_x1Ký ..òYæ§qx±Ø¾ -.Ö°òû«P0’4öÓ$ñÈâÔ¬N³È’| '¸˜F‰_´x=uõ. -.¢Àϲøb¾"¤ùò³N¦ixoÊÉ4ôþ„ISMB¯¯Úf2³ÜkWøͼ;\/ûküÜÆý#¯?è¶oaz‹¶fTÕ,yíNmËÉ—ù?/¢ÈÏ£BÊèÜeø¡·Žú¦LjYv¸ïÕÛùÉu²swý8Ï,†¹_Ä‘+ˆ0ñã$;„/¢¸{;¿¾…ë ãrÓØ’ Ó‹0Ö -—Ü‘ -*ÊsOïázM‡“\3šyã’»f”~(%Ž o…¨kB|®šµ`hÕìp赺Œwÿ:™&aæÍq|óЫۇßøäâíÇ[ž¨Ö–<¾E¼?¯éã3ìÆj;âOŠk›ú…GûŽ%µDÑþŠ‘›&éØå:¿Á‰°7™%žšdÞ»É,†Û0Ò²ìUUw¼‚vÀ~S2`~ó€{ xG´ûk{êcIÂè*³í±ÔW Ùz‚þFõj­áº§ÂÀfµ “ÿ,2ŽÅ¨a€×½Å•{ÀyÐAÜŽ¯+KhT#Ñ ƒ ôûoè[¼d´ûÐ"5û­÷‰5±¬1¿4Ômœ³l 8Tø <­ÈtFL“ËÂÊJ³¢§dlÙ³óÁâƒ|V.aî`P“·eƒ”{%ž X¸y£zž(cµÝp6Û‡ p–$}Ë›Õtä®[иŸÈèKœäÛ"pQ 0q¹Ý›Á`{š!d=8¸|®tyÉã’ÍÜEE`ÔYòêsEžX5<}ÿþ†¨%1 YóÍŠÈy"‰&Ϧ%®ROÒ_î*Í>NºÇµgo °qí1%ì» -M"@ÌMùˆ§!Ô¸ ŽQm¡Q³-ºR±Æ(U/ßN¶èrUjõ$ -§Cïç¼F¡q›®=óäÄauHœŒJ¡¹¬LdùÔõ”½P[:κÀíÄ.8îáO ˜æŸG`~&.¶¼†WEEàX—aCX2àyS"Sy@b^3pqYBD¾Â~a€•¦p"‡‘@ỳ*_™#^<Äû=ˆÁÎ*Ê"ô"d³Æ…Qà‚&v:vZ“*hißÔ†®ãÝ/$ë=¯+-4,vwdcæ|¢’CÞÞkt«ÞpȇÅElä÷Â+u©h{òK‚ÌÊ ¯9–atÉ1i»_ÅÐÙsÜÑp˜,¥–€@kõàÁnary™Øâ udðåY{üüÉñ`¨ÎG_Æ{“4õ>˜™ƒs0D"¸HQ`Pö}®P]5O°4ã½Dž„‹7Ç5›åqE×0hµ‹è•µžœ¥¶á±Fb1Ç!«O¨N–®E«}MŸç9 ,$”¹ wì3û• °PTjà!½•é “gû\—•®Úîê²ëe¥åïV5j]Be”‚~¢ .ÒŸqä•Ó‹”¿û‰5íéˆ%.Ú±ÞS&G| Ì÷C|ùòÃüÍ!f÷ÚQv­L‘™š ó4èö äuƒj‡¾Ôi(}À -Úo13Ï„!HTZvH†=.ŠäBŦ –ß”“ðÉC#* ÿ¸6È)x“6øÍPÿdßTœhÝF1Úš9O¤ÔïâÏAµ†€†J…Rì(‡Šq¾)_x$aõÖ3pQ«jËÃ~ƒÚ!*D"Ir{ž1$„5ÆÚz6ôDý•ñœJe%{È–(V"V×ú#63§$œ´R¢Žxf3" ”¬ˆî_3¸wƒ Ô‚kÓ]Ïs0KËýb°!¤bHK¾(ÐØj[Ý*tWÀ¿ìxQœp£jÌß[‡Kâ¤:94æ"!c,'Pœ†˜ÿ„ò|9Î ®ÑÎvue -`p”iƒ¶AI%‡¤Â™È5 -JAnÅÏgX- :¤iÙœ=Ù‘Ÿ,¹âÄ©.í~ðuÚDÛM9:ó$Í,¨Ò¡ìTÊhÑn¥x^ˆÿTtÈRhÇ/dÐsW3Ç5ó:Sþ.Ð(5hµè­ËËvré}'¯tþ\’¤^vƒè.™4“RT¤ÓUûRc O"°èj Z ½®¢ âJ­4UF’…µVnŽ\@æÿ^Áô>‚/¦_™S‰®Ý&*ÒáQ‹(¼Ã<„iâ”@ˆBZÚÓ£æð€„‘ivÃ;ÉI,q¸œSM0-A ™$qˆFŠô_‡SyƒE’»ˆI1x öĤù*FÙ´]?b|è]îz,+„”º4VˆïùÑI’kl -·$&Ôº”läBDvpŸ˜¾#È ÿÁ—N'›•œªøƒÖÙFzÿǵN¢}ꀇيÔ>Ý%)·ÍP2Aºvéz¬[)cÅ@f²Å¿±Äý) ÉV–…$ðˆIgÖìpÂQR*0ÜÍìä H¬ì­µ¨Ì¯h¦Ih:Å÷ˆ/O^R<£ÕfÑP >×^0 À´Ý»óX @Ô¦ÚZ “fözzªKW#_1ñðµQ•¶¢> )ù7éÂðç½T˜J*ù×üÀV¶CãHì«Ôõú€Â§j9ÛíÖ“à'Õâã@ªU”&.B6Ð úxwû¯oy[+°ß?à‰÷Ms a÷(ìÁá¤m ËáIABÃÛLÀ´¸C[Ž>§Ì#cŽ‡ÒËu%Ùf>ÔJci-5EJ’wÅ¿ÒãdipïþH:Îf~ξ×hŽÔhŽ¸Ñ|ýá~ -yýææ5òö8—®¹Ûe§…µ¢£ï·¢oêJbô¥¬¡`¿Ê–1\0‡ù`ÇXüÇC³׆Rô ©Áqx¹W§ìC(r°usâ`áÔÃHq_‹åÃnŒÄ½r(e'±¡é²‡†¯G’èÓ‘AL«®­UejE£±ce³/bæ‹b¶x%%-ÖeπÆs44L@ãÚç–l„£d…™äÄÆ_å G„”Q¿ó·ÕB·]»ê}(0¯–z}eC>×*uK-À«›ÛwWOÔ $ŸãÔê÷ß ´Žôáø'çá—Åôð«Ë+jgU6yf"4®:¹Ùïî Ž3(—«•y£%Òá–—kÛÂïB†ñÏBœ$`úþõÀ5Ãá5BÝuÇ3.CcnÀw«¾J­†3é«ÈNÝíNˉ%X©×†ö¼í=F“¢'úW[ö/¬t»å‘ûÛ ÿ BqëK:´—ƹüâƳÓ_ -¸8› ,'—MX­ ÍŽ9hA0]ê(0]êÂi³ñ“i9tªùÙ *½]1îШ‚ÉF¹=B¤©xkúÖjþõýrL0 -œÎLÜÎWXØÎ×ÙöBkÙÈ Î ùÌ’ç&9–¡PcwÒA’2ŸlÞé9…­^ Õ¢¥:ôW°¦E½±RÙžΟ©øÙH—K·ôál»VZÁ-³…í“ÞçÛ#Ιk¼ûСñ\·ëÍ82âwðœ‘6hYŽ6lž<Ûw]Íú™xÉcûÓM¨Õ‚#þBŒ¬¡¶Z¾0¸ß9bm(’`¸H"*P‹Ü)wªQõËK}öUDeæ†C›üG¾º_ol8‚€Žµ±b\ã-ýÎÃä\YízçÙÁùÌá p‰=¸ÇÇÂGsë.Ì(ùýãËX­f‘Ÿæ¿î—A’ò8_ÌŽ©GQá'Eqøß Ì÷…’endstream +xÚíœÝoÛ8ÀßóWøíìÌÅOÝË¡W´»Y4ÙnãvØÝÅV]cc;g;Íõþú~Ó–ÈD Ò¦IQ ¶,~Œæ73$‡Tð €x *H5’#Fð`º<*s¸óã¶%ƶÈ8*ó¯ÉÑ/9Ü-PUTƒÉ{ßNU VñÁdöûðùz5*åpטíèÏÉÏG/&¾á¨kLˆjö?G¿ÿY f ÂÏG"•\Ã÷áª,(#ˆQb¯/ŽÎŽ~õm™{t`ju=-*U Ƥ@RÒÎ2¸”ˆ ÊâTøG-ãGŸD—WH=+.GÐC1<«—çõhL¸þv<ÂÃÓÑÏÔ|x¼Ú5u½ª/àVK´ª ÝAÔ·¹³™Ì—7ñã˜ÂyIZT‚r|Ø-Ãø Û¶îJŽJ¡.³öq +f±Ò¬j-QˆŒÒYY‚®N•’¾I:¬ke3ÕRèM +1DP´ ðhÑÕþGîÞ×­ÞuïGQ Z`¯¨–Æ;ÍÁÕGÕÚÛÎD[€z"KÄ ŒKŠ(“78`7ø”)£­ƒ—š|hŒC½½„O<œ®—à=‹ÕÜüzöìÄ~ù´…ßwÊZšeÊ·¼·q­Œ¼ûíi=–)=úf’~5G(o¾˜!†«œ« € [õ9ç:k¦W›…ÖM)†ŸŒŸ©ë•ùºÓ +&tø7õ[sm.”^1ü4&þ’îpOÞd5Ó×›BµŒ7EZO[A[€k[4ß«cÍÕHK=ëÒ²Þ´z5Ó#ÌzeÁ¾‡‹ ¸¾x{züoøVȯòÓHOÆQµ4ãXÛœ$wdœíÕ3UUéÃø'à @/š­ª.µ#¿©§z°ÜZß÷où6TWaSVâÁ´Þf¨–©5 ³-@f®W“DaújaRóU­æ8Ÿ¢‰ŽæÇKòMLh¾Ü|È©¯¯A„jƒˆÐ¤ ¢-@Ú r½bX«.œVHVÔ„¯9¥Ãg——ʽÓz·€%Ô˜ãâ¡°¹'´V}цj´‘’ÓhÛ¤Ñæzõh G„²€¶4hÍdBñ1¬‰+X;—_OõÄb²äŽ¯ÕF_¾¡Z†o¤é4߶i¾¹^=ß²D¢Šø’¾jî¼!ªÏ®ÜX‹/Ô¿ Z«ˆ¾hCµ ÚHÉœ¦Ð¶H£Íõê‡é¢B%å-³óêX5¥zÈ#ê=¡·Šê‹>TË  ¤Ñ·H£Ïõ꼚U ñJxôn@>»àbØè½€¥U·%¨»ÿBmÝÊ@”²B…”¾“Ó°¦ÝÉαkk5Ö~¬²*áxï±.ëívv®b.¿º™% +z¨>†•ÕÅaÛYÃê iXÙ^½aÉa*ƒaÙé@—™aQù*w2ÛÖ8j¬ÃLàI(+÷„¬gj RàG¹I™]PR/³Ëéö°í¼ÙµH›]®W7”1.³°fÇÍPvÒ,×›<©Wõ¼YêÐeviTR?¶¡Ê)¢/ÚP-ƒ6Rrm[€4Ú\¯-c¨ ­0h'#I†zª9Üéï\Ï:å÷‚eeµÖ×BµŒDD8KÙA[€»í©0¢ö[q~SÅÒÆBͮʫzÎo6&M‘ ³[91ß_ÂlÌèzD +˜êÀ[ð…2®©ÞÌüt©Mm½Jl¹DÞbÏ%û<-jMó”¦CCwÙva è›¶4Õfi©Ûu96ñt³?KœzßT™ý$üSsF«¶¾Îªeœ1B’6‘¶é œëÕBA­ˆ3»%ó“Þʶ™÷™7‡½LýÎ|^« ºõæ/(ôÏÑXö¸WN_}- TËX@Ä"mmÒëÕY……YE½Ø ›‰Û`Ý.àsÀ«ÖaÊ®íÖÍf³ˆ$쑧{’zbª¥±Ç¸H`ïàn£0å QÉò£°+¤mƒ™Qød­54€-¨-Û&u*(êâÃhV ƒµªª”ªBCŸy*èP”n¿aUÄ&ݘBŸÍ>Ž˜šž˜• LGæ.j +ö„§±N[}(TË8PD"mm’q3Û«çO$"R8þvä|µ®gn£‚äRÁ_ë\ÜìJ{‹µ.ñÓoÕÔ|¨–!Hƒo ŸëÕeÆ(„WI¤ïS®ÚÝw‹©8—‡)w!ÝVŠSE_¸¡Zn¤æ4ܶi¸¹^=\(\Ê®Ûý àn;÷Y¶²èjZ\²Gت£/àP-8Rup[€4à\¯.l“J A*ØNwSGx7‹Ýb@C·ÔK +íÄ’UO"l;5õUKƒˆ"¾C€$øl¯Î³‰¤îQP§Ì>Ô7N[oß6~®«¾LÍ—ø¼Út½²Ë¡ù•¯ìU.ÉWq^ûÄ}úZ‚A—i€­Þï¶`!¬Èe~Áâ +iÊÜ,XÞ¼~nr†¯A½l™Ïës‹S¥o¿¤‰„¸Å’&+òA‹Z—©síQCùÌ`™]×&¿áü&¡aé4è—5çz +»¾Ú9‹òû9¿}G³:ëëi¡ZÆÕ"iûh –¹^½å™ÄY]Üüجš;Kð‹yÓeóqáâÝ5ØHõD†G«Ÿ¾ÄCµ ñH÷iâmî^õÆû ù WH›…0áõÝ˳(Šâýen"Š†¾nEs’´¨u–zŸ!jè3C‡¢túNYQÄK›.‚ú„ªšbÔ>©Z›ÿ(XW¯•K­u–uñ_¸†Ÿ±)ðîåȼ”žwÑ: S_ò-./œªzºQT-íF1†¤It œÙ^Ý,³”BxønšéñÏãºh©ÕÙtþ /ú2 Õ2L#í¦™¶H3Íõê™rX1µ9ë­Æ]ÞùEÓvÖõ¥Ù:ÛÔa µÓ‡M +¡b–«ÕB_®¡Z†k¤a‘:Ò!@šk®W¨o%¤ãZêÃóîµÝwÍ”¸Ù™­RõÕžI²o0ÙõÅ~ȯÍ]3hª¥åÕ¹!Áì—]³toIüÔ¿ñ¸£>o‘ùÌJxТÖ]j5t—“嘔ˆ1zÃHUbhȦ?¥K¾Ó¯yl¶`ãîx¥øÉï9eõõªP-ãUˆ´e´HÇÃ\¯!s Pé’*ë8fòœßw±×Z_;Õ2vIÛA[€»í'IXJDÇ:ƒ«-£M¥2±õùzµÛ,ίvþ¥Míæ|“©¡£[DÔœTûíim¥Öס™Ï§…:`ŠgÝ7Õ˶æu«ÏÿÓ’á$³DUr‡™ÀS”r@¢v»±½œ!1˜Ù2‘Àÿú¤Xendstream endobj -1150 0 obj << +1231 0 obj << /Type /Page -/Contents 1151 0 R -/Resources 1149 0 R +/Contents 1232 0 R +/Resources 1230 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1148 0 R +/Parent 1229 0 R +/Annots [ 1234 0 R 1235 0 R 1236 0 R 1237 0 R 1238 0 R 1239 0 R 1240 0 R 1241 0 R 1242 0 R 1243 0 R 1244 0 R 1245 0 R 1246 0 R 1247 0 R 1248 0 R 1249 0 R 1250 0 R 1251 0 R 1252 0 R 1253 0 R 1254 0 R 1255 0 R 1256 0 R 1257 0 R 1258 0 R 1259 0 R 1260 0 R 1261 0 R 1262 0 R 1263 0 R 1264 0 R 1265 0 R 1266 0 R 1267 0 R 1268 0 R 1269 0 R 1270 0 R 1271 0 R 1272 0 R 1273 0 R 1274 0 R 1275 0 R 1276 0 R 1277 0 R 1278 0 R ] >> endobj -1152 0 obj << -/D [1150 0 R /XYZ 85.039 786.531 null] +1234 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 754.651 512.306 764.219] +/Subtype /Link +/A << /S /GoTo /D (chapter.12) >> >> endobj -6 0 obj << -/D [1150 0 R /XYZ 85.039 766.606 null] +1235 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (section.12.1) >> >> endobj -1153 0 obj << -/D [1150 0 R /XYZ 85.039 651.298 null] +1236 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 716.643 512.306 726.212] +/Subtype /Link +/A << /S /GoTo /D (chapter.13) >> >> endobj -10 0 obj << -/D [1150 0 R /XYZ 85.039 651.298 null] +1237 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 703.094 512.306 712.117] +/Subtype /Link +/A << /S /GoTo /D (section.13.1) >> >> endobj -1154 0 obj << -/D [1150 0 R /XYZ 85.039 622.563 null] +1238 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 689.545 512.306 698.568] +/Subtype /Link +/A << /S /GoTo /D (section.13.2) >> >> endobj -14 0 obj << -/D [1150 0 R /XYZ 85.039 240.295 null] +1239 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 675.996 512.306 685.019] +/Subtype /Link +/A << /S /GoTo /D (section.13.3) >> >> endobj -1155 0 obj << -/D [1150 0 R /XYZ 85.039 211.559 null] +1240 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 662.447 512.306 671.469] +/Subtype /Link +/A << /S /GoTo /D (section.13.4) >> >> endobj -1149 0 obj << -/Font << /F20 877 0 R /F15 895 0 R >> -/ProcSet [ /PDF /Text ] +1241 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 648.897 512.306 657.92] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.4.1) >> >> endobj -1158 0 obj << -/Length 2860 -/Filter /FlateDecode ->> -stream -xÚµZ_oÛÈ÷§Ð[( ¢Éå’"Û¢€“8=9UÅ](’²ˆP¢KRqüí;ÿvIJt4(wZÎÎÎÎÎÎÎüf|þ̃üYº^Ì–qä†?ËöÞìfþqá ü«\½¤¹Wë‹Ë·a<ó=7ñ’ÙzK<ëüçõoWÖ×ç‹ ß/–ËØys=÷·7«›õÍí -§´s‹æZ]¯_;ss{‡å|ø8W±s»¾}}ûŽY®VoxÙêê=,¼fêÇë;óî_k^ãÕüóúwPeán¨Ré=N¼¹¾Ã©‹ëõà@ ?v=_á‰þsñÇgo–é¿ðÜ ‰g0ö\?Ifû ¢¸@¾«‹»‹Z1<§g!üwÒp ñð7Qá´qhË0±ÖU@Ön £¡u}7˜/ÂÐsV¯Vxf4X´tVEÇ„ƒÞ2]Î:±©¡²ûøáÄ-6[”¡$ßó|·ƒ¯oì¥#'/Z¤gM¹™/ÔÒáÏ—8™8é¾>Ü·ÂYw»¢áa·+AL!¨wÎ-œÙ£ŒTŽöÅ= K»²> W複œE‹¶,d—­Ù›¿_¬Hî0ð*°J÷¼ìÜCîŠæ+ð—tââxm´LœÕúò -Öjßwê?=? ¹ o¯}å¼øTà+¯Q×G!Þ°æ–÷Pt<Û<:ÙwxÄ“Áª;¦–"¯ãX¡}ž˜€¢·^Î¥bJV÷F,SÐ"qº—gÝ Q' û¥­ä<èjùM¿à9 -þjY2]7i]‚=4»ˆÖÊI3¾(ä},érùƒØt)]?Ó¦îGkÏ9غÀV -{GÍÑ‘†úÑYG:–r¦c[lÉTîðð!ýO/ôД5¹¥çÐ~ßÒ}ïyäK, ò"­Z&Á¹vvÀ¬ì¹žÓ÷%™¦C­³zà“¸÷å[í Þ–Â×ï'òÂþÆ£×»:ÍKÏ&DÀ(ðáø;ï5%HynûFR>%ÉwC?üIIFPñc•Î%@Òð“HðŽÅžiUñ¶xÑhÖ¼¤GÖÈÛçÉG| )žZx–: -!Èá½.ˆŽ^¬F¾Ý°wÖ{ö$zœ*øÎ`ÐÐ ¸;y˜ïÜs^¾9G ½/Mlê¶ÞvÌñéfuÇ£;fåwþU\¿hö·¢zà‘¼•Êx7Ò¶µ°mñ9’)à#/à¥T&À·úìÄbÍáQ×x ÆçA‘µèçÓóˆAu•ŠœvZWœ¢CR\h‘;hklGâª,y3G‹ iaŠ'0ÖÑÔ7úÂt~`†ˆ2É(v* ã²6œcêŠTÄWf^÷bÂ27¨MàqpÃݽ -à²lÏ„‡l¿| Æ#Dþ9Xî9<œ;KùÑ3µlë*튜¿ZcÉÍÁxGgÔ¨ïíI)1ÒjvöZöá„YÉÞb¤WläaO— <èÓ ÜvàrO¸S}¿{wµâqDðH8W«—üù¸#G”§@/ܦ.óá»±‰Æ£Ìlß”r½þ³—䘼9ó!Ü÷!¥üÇ‘½kÏýŸ#ù§1/FHr:ü(¦(Æx:Sþ‘÷ KX׆yž­ÇâþzÇf­&µ«²Wï±e®Ç’^4p!Fê5Ø“úšî‰Y-X} 6Óð?çïò®ûcÀÛ!áðÛõÀI­-FFøÐÐZŒ(ÆBB_Õp’6iÇœõð${ìêV˜HÍ•ˆËª²è­q*b×»R!:Ú, -±?g%Ûs—6¦Q‘vZ‘>‰t‘z6ÒÁߌŠGÐ+|-Ûrcc4Ayì·vGs÷8jװ䓺tr—ˆöƒÐÕÉOT«–ÓµÎ(}¬g€öNTð—P×$¼ðÝ;rý ùÑÞãë$Û jÏx<ŽZ`~qŒ¦ÄˆŽižÍÙÃUâ»þr|íè͉T†•@žL1”0 ØÛ#ÆlöO Y —˜§nÓ\SR¢zâɦà€NyEvèà 0ìËûÁ$ðɘ„6s³¡á„\‘1æ±ëwÜ3û ÈÀå\ƵåaÂùM hꪲȃÀ1ÀÇÝ®&D)÷œ&jâ=¸ŠO`+e”üš{ı½6N¨ŽS¶˜@¦Þd(zWÏùóPË– ¿Ì-Á*†Ì1?íòDk 3$ñL² C½ÔÜÝËÉ¥Ií/íiΨJrœÕYo‚Eºº¼Á´éd1…PœÇî‚ ÂA ƒŸi#:RˆëkBqw†|hŠ>—øðÓ<ÖÎwU…aL -5Ó¾–öÉ\[KµK_à;ÛãÐ-©Zƒ slã­Ô¬G#ò& l`„„óë8a‹çÌdz¤ûj°PÒáÒÙ2#oj 2÷^Zü -î„24N¼jlEmÊõ©¼w7LÝ:ç‰Õíš)ÿHʆQØe!y±Ð˜$ÞXn¹7žÐ÷ÆVïÆaåZq ¯Í¾OkDZ¹ô<†^/ë8¡‘´®â³tvÇáà -ËþðÔXD{¶09É åi7VªbßUIø«™*øQ¶8EÞž§Kw¹Œ~-W-Ýeýh÷”­3‚ @Ö3p§6½÷g)UZ(!›ž^1ýÀ)ñ»4í¢ˆWiqGM"È9õ t"Ï´J:½A_i0‡o=ãÿ~ƒÈO±Fäj_ý*ÖÀ}~°÷°6'wçƒUÈŽÓêçAaºQSÆë!. ÁÀ™$ø0—q¸Üó´ æpa,Èv º­åɇA4jËd @¡õÛcfé°…tžD± -”(rQc€Î¥C…ÚÔ‡gcŸÿKTÇ mÅn*×E_´âôTÑ -8‰8¹ð”^ÄÑ=婾'zÃtSß3Uâ’J -95SÇ]U¤PÇÈ8ÇŽà"~ó;`HÜ°UÌÝØv¢iÔ“*_D5‚€ñã¼ipn‹j% ûÁRp©Ä‚‚@¡–Á².ñœ#º28õÑ"îFÆt…t»"i'ž`Ã9(Á ñûróŒ4¡Zu—Tis/ Ÿ›1:–Æ´°$£žŒA i7a‰a%áOöá¨~j¥L©OþÞÒŸ­žXÝ¿÷ý ÷Ÿóú â)ž&ÿÚ’øbx Þ3…:Û=‚Åä±óÅZ·Ã`«)Öœþ9e™<îåÛidT'ð¤0È‹>ÁWõàL”pò“Žå¾lm~‘‚àP £v_EbMªŽs‡'ñ õ?³gQ}ßV婾ÇÆ•ãuQ‹òÄdå±mêýI-Óo0.û¨ã£›íOòKiSU6FÛ Ì÷ù¼„»ñNª!¢¤ü3HuèJY±Ú }¥-óÒ 8œ¶ã*Ç›JÇL·@{tra¥ó^.!Ä2³UrÊ -þûfËŠâ]L!öÛqa>²ñ¸i†ý×Q` -ŒzÄ+],*Òlèd€4¸¾ÓþàÀÛmgÝ6än”âŸÚ¿Sàºç¥Dä† T: -ÝPEÏü? R¿ûçv»^œ ïó19Õ3tu2Ð4êýgÆé{endstream -endobj -1157 0 obj << -/Type /Page -/Contents 1158 0 R -/Resources 1156 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 1148 0 R +1242 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 635.348 512.306 644.371] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.4.2) >> >> endobj -1159 0 obj << -/D [1157 0 R /XYZ 85.039 786.531 null] +1243 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 621.799 512.306 630.822] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.4.3) >> >> endobj -18 0 obj << -/D [1157 0 R /XYZ 85.039 766.606 null] +1244 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 608.25 512.306 617.273] +/Subtype /Link +/A << /S /GoTo /D (section.13.5) >> >> endobj -1160 0 obj << -/D [1157 0 R /XYZ 85.039 744.844 null] +1245 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 594.701 512.306 603.724] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.5.1) >> >> endobj -1156 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F40 1163 0 R >> -/ProcSet [ /PDF /Text ] +1246 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 581.151 512.306 590.174] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.5.2) >> >> endobj -1166 0 obj << -/Length 2761 -/Filter /FlateDecode ->> -stream -xÚÍYY7~Ÿ_¡7·€™NßǾñb½˜6v1ø!É%õHÄô!w³#O~ýÖEª[Ç àxÀ€Å&‹E²XõÕWœpÀ¿pQ¤~—‹¼ý¸(ëæ&Xlaäß7¡H$iì§Ií ƒwvô.‹ü É/É‹»(ñË€ß?Þüð! -QàgY¼x|"¡Çͯ^´¼KÓÀ{PÍJ-ïâ,ó~ZÞ…^¿ÞiS­ÍØWËß¾ù×ãÅb?Σ+«‡¹_Æñtõ0ñã$›­î‡¼þý2ôZÓãÒl#ð6ãÚà—†®}m 4Ü2aº8v9]æq§‡å]‡Û€ö(÷Ö¨zÕ 6ªvža‰­þ¿*š{Jz«¶êUÍ -°Ù -ôü¡«Oèžð7õv$uà`Þ%,»IQxÀï§>ËJxRÞˆÓÚªº†Ÿ—e{þò®H"ïÇvÐYñ¬Tyªü'ÓÑu Ç”dŽÂ%£Ø3¸ˆ&Á öDžéxdÝ5¸@”•öWâcê÷FtÔƒ AÜG¯­Ñdßx°Ž›dE’>L"æ ä<(„Á0;ÑS_}­Rövöp^žô=“>9Ì—±ŒŠj²¼u©ãœX„˜ C–ùazàä°;ÆÖë¨ú§J ?)ÒËœúIú¦Æ{Øk”„Ó UØxdpK߇I˜“Gqéõ#Ú¼Õøÿ–庖iõWèý>Lï*^û^þäö ­ÌS×7"öÝTÖ 8†ºQ¾ÍN¶Ò³ûtÒ¿'Ì8z&jÕ[q’s¬ÑÄîÎ<µ),êGy¼€ÜãYúí×}÷ëúµ¬¿“GFŒÎ!­‡Ómâ)k£ ÝúJmìMQȼKX§™§zÝ¢d¯z³tAfURÒ(ÐE®™,Šü4ü &‹¿»É>ï&8†§ïYvjš4É “ˆ®ÀÊ°à9™À„Cºþ¨_qçi½ƒ«®QÇ-Ë~¾ÿ„Qw{‚•+BHÉÔ0o캓†…Ÿfá5Æ“úE½Åx„q}\bTH¡Ï ÃØ|×¢Ó û }bš'~vŽq‘Ÿå5úÂ^ã7\œ.¤Ûc~ƒ¡›ìitãpºM‡®mäú· *ûË?Rú‰¸ )«Ñ‚ÜÛ -Q >Ò¥Û-°›$Ng솳Ȩ^67§\/ÜI«­­@‡n'ªIZ÷ÜÃ8•]ñ±Îa‹ÖŒòò¿ŒrÒ öìž{JÊÈØöõ<‹Ü•£×Ñ"Fw¾H{_e½o¼þ$…¾ÙË ÀðÆb‡>ÈLƒŠ?¨Ú)6žhR3+f˜ÅÛ·‹ÓèÅ£¯.=UD©Ÿéßê©Â¼#[X|‚F×@ËAuî­áÀ¦âö¬0ˆåEs0bX ·£úÉK¬Ä{å-O¦P”•_øøƒ#z0²>£1ô+f ®RÁ®ºæ†­¸'xrñ±Â=WMK¬^ Ö¸€Í=yË2’­V–ÍRפºÝOh†–0ŸBqL¨ë±§9ò$Vz¦>>¾87Ìùhµ«\'«nk‚.UcNô_bIþNO,hñ¤ˆÝtñÔ„8´™ì@›ñK.¾‰—=Cü¡Úr‘Tµ!Ö‹Dg-[n‘Wp×Ñ_qeÁŠ”†Þg|ñ•­…ÃH4Ì›7®úãÔH1=Ø÷„³lãòK;{ÏèFsòJêÚÛ ëòÿo¯fßÿ ¨áÜŽ[ïEq¬\ €^cóÒŸ:–°™ÛÍ‘j`ñKá“(ÛÛ\ -‘ ¼ n/ Jï9Ô*¦w‚@N©uü­êIÊFìöç‡fRW_ ÊŒÊI•©{ Ãa\S9Žt"-šRͽÃ3DõîÄp„¾ûŽÔ‘4;=P¿#c+½²„ÞƒôºGfm—wŒÚs»y>¯à¯X•@œ¿Äý‡1j-U Ù79V†Ð&ŒSTvñ‹PZ&Þ}£¶º {bMívSÚêe)Ç8©óý]„$L„ú¡+62‡8#C÷tÓ[çLènÎbûI ævB˜šSP|¬¿Ç½dÙ"ÓoúŒÌ˜ sK7OOTMŒ+„'ïÒŸ>€ìÃuüÈb?äGÂoÃä»ãÇ$ÙC¬Úw†›ýh_ÐS~+ÁÏŸ̪1h¶"ÆÎQo¸¡óœà1ÐŒ†¸Û€1‚´tZâí¨Ü[ˆôï9;ËÏ©¥ ùäÍ;•̼á ÍyM"Ñ2â†7?lµ½ÊöÔÄiâCl¸I`Î/7¿þ,6`ñŸo?.‹ÅÚ–墹‰é®ù«¾y¸ù¯Ó$#¯ßH5û;äÉ^€ºqÆ*¾u­øÆ.ðÅü½vûÎ`÷ÅïG‰ûCæ|iGµVïÞ¾,áb ½–sÃ0÷ ðm¨0ý2œ §žA‡ù›¼=83'莢|?ö÷s%%Rendstream -endobj -1165 0 obj << -/Type /Page -/Contents 1166 0 R -/Resources 1164 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 1148 0 R +1247 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 567.602 512.306 576.625] +/Subtype /Link +/A << /S /GoTo /D (section.13.6) >> >> endobj -1167 0 obj << -/D [1165 0 R /XYZ 85.039 781.388 null] +1248 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 554.053 512.306 563.076] +/Subtype /Link +/A << /S /GoTo /D (section.13.7) >> >> endobj -22 0 obj << -/D [1165 0 R /XYZ 85.039 761.463 null] +1249 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 529.595 512.306 539.163] +/Subtype /Link +/A << /S /GoTo /D (chapter.14) >> >> endobj -1168 0 obj << -/D [1165 0 R /XYZ 85.039 671.062 null] +1250 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 516.046 512.306 525.068] +/Subtype /Link +/A << /S /GoTo /D (section.14.1) >> >> endobj -26 0 obj << -/D [1165 0 R /XYZ 85.039 671.062 null] +1251 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 502.496 512.306 511.519] +/Subtype /Link +/A << /S /GoTo /D (section.14.2) >> >> endobj -1169 0 obj << -/D [1165 0 R /XYZ 85.039 642.326 null] +1252 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 488.947 512.306 497.97] +/Subtype /Link +/A << /S /GoTo /D (section.14.3) >> >> endobj -1170 0 obj << -/D [1165 0 R /XYZ 85.039 578.536 null] +1253 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 464.489 512.306 474.057] +/Subtype /Link +/A << /S /GoTo /D (chapter.15) >> >> endobj -1171 0 obj << -/D [1165 0 R /XYZ 85.039 544.592 null] +1254 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 450.94 512.306 459.963] +/Subtype /Link +/A << /S /GoTo /D (section.15.1) >> >> endobj -1172 0 obj << -/D [1165 0 R /XYZ 85.039 519.956 null] +1255 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 437.39 512.306 446.413] +/Subtype /Link +/A << /S /GoTo /D (section.15.2) >> >> endobj -30 0 obj << -/D [1165 0 R /XYZ 85.039 485.484 null] +1256 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 423.841 512.306 432.864] +/Subtype /Link +/A << /S /GoTo /D (subsection.15.2.1) >> >> endobj -1173 0 obj << -/D [1165 0 R /XYZ 85.039 456.08 null] +1257 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 410.292 512.306 419.315] +/Subtype /Link +/A << /S /GoTo /D (subsection.15.2.2) >> >> endobj -34 0 obj << -/D [1165 0 R /XYZ 85.039 277.719 null] +1258 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 396.743 512.306 405.766] +/Subtype /Link +/A << /S /GoTo /D (section.15.3) >> >> endobj -1174 0 obj << -/D [1165 0 R /XYZ 85.039 248.314 null] +1259 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 383.194 512.306 392.217] +/Subtype /Link +/A << /S /GoTo /D (subsection.15.3.1) >> >> endobj -1175 0 obj << -/D [1165 0 R /XYZ 85.039 227.962 null] +1260 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 358.735 512.306 368.304] +/Subtype /Link +/A << /S /GoTo /D (chapter.16) >> >> endobj -1176 0 obj << -/D [1165 0 R /XYZ 85.039 191.291 null] +1261 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 345.186 512.306 354.209] +/Subtype /Link +/A << /S /GoTo /D (section.16.1) >> >> endobj -1177 0 obj << -/D [1165 0 R /XYZ 85.039 157.953 null] +1262 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 331.637 512.306 340.66] +/Subtype /Link +/A << /S /GoTo /D (section.16.2) >> >> endobj -1178 0 obj << -/D [1165 0 R /XYZ 85.039 92.669 null] +1263 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 307.179 512.306 316.747] +/Subtype /Link +/A << /S /GoTo /D (chapter.17) >> >> endobj -1164 0 obj << -/Font << /F20 877 0 R /F15 895 0 R >> +1264 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 293.629 512.306 302.652] +/Subtype /Link +/A << /S /GoTo /D (section.17.1) >> +>> endobj +1265 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 280.08 512.306 289.103] +/Subtype /Link +/A << /S /GoTo /D (subsection.17.1.1) >> +>> endobj +1266 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 266.531 512.306 275.554] +/Subtype /Link +/A << /S /GoTo /D (subsection.17.1.2) >> +>> endobj +1267 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 252.982 512.306 262.005] +/Subtype /Link +/A << /S /GoTo /D (section.17.2) >> +>> endobj +1268 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 239.433 512.306 248.456] +/Subtype /Link +/A << /S /GoTo /D (subsection.17.2.1) >> +>> endobj +1269 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 225.883 512.306 234.906] +/Subtype /Link +/A << /S /GoTo /D (subsection.17.2.2) >> +>> endobj +1270 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 212.334 512.306 221.357] +/Subtype /Link +/A << /S /GoTo /D (section.17.3) >> +>> endobj +1271 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 198.785 512.306 207.808] +/Subtype /Link +/A << /S /GoTo /D (subsection.17.3.1) >> +>> endobj +1272 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 185.236 512.306 194.259] +/Subtype /Link +/A << /S /GoTo /D (section.17.4) >> +>> endobj +1273 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 171.687 512.306 180.71] +/Subtype /Link +/A << /S /GoTo /D (subsection.17.4.1) >> +>> endobj +1274 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 158.138 512.306 167.16] +/Subtype /Link +/A << /S /GoTo /D (subsection.17.4.2) >> +>> endobj +1275 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 133.679 512.306 143.247] +/Subtype /Link +/A << /S /GoTo /D (chapter.18) >> +>> endobj +1276 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 120.13 512.306 129.153] +/Subtype /Link +/A << /S /GoTo /D (section.18.1) >> +>> endobj +1277 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 106.581 512.306 115.604] +/Subtype /Link +/A << /S /GoTo /D (section.18.2) >> +>> endobj +1278 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 82.122 512.306 91.691] +/Subtype /Link +/A << /S /GoTo /D (chapter.19) >> +>> endobj +1233 0 obj << +/D [1231 0 R /XYZ 85.039 786.531 null] +>> endobj +1230 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1181 0 obj << -/Length 3267 +1281 0 obj << +/Length 2931 /Filter /FlateDecode >> stream -xÚ­Ùn7ò]_!äÅ-ÀÓÛ÷±/âx7’ØÉÈI¨ij¦£>Æ}HÑßo]dsfZ -°»0Œ!‹Åb±Xw+¼ à_xY¤~——yúqQ\nÛ‹àr+ÿ¼#¸Lü Kqé›Û‹¿ý#-.ÃÀ/ƒòòöžPn«_½wß]º}ÿóÕ&Žc/ò¯6y^x7W¡wýã7×M¼ëŸ¯¢?ܾwûPCïýÕï·ß_¼¿uÎÚ$~’ÅxØ—‹_.+àçû‹ÀËâò Æ–åe{‘¤±Ÿ&±Ì›‹›‹Y*¼–\ò®•+m Æ&ü¢HÖpÂØ®ahî¦+÷NýÓ+~R¤¼í”dê'é_Rœö 5}µI²À;\m¢'¡7$-ÃÀ…·%ø82êoA˜ÀZ£¯Ò#®n‡wL½lo궞xø„¯ÑÏM…ÓÂk]«Ž‰ µ`8Þ"Z?ãICú'Ï<g<î@üÁ™p2Ã3Ù9 Î+”¾xˆoQÒå;d -©·xæÝÑõQ³ú{þÝ6µ&Üi<{ØãGy o›½ýïÞ6û¿¿-Éî'p’}èuoXLqyó(‹ÀöšôÏã¤[^C!Š j$²cÜ­jš‘‡J~'C§±› -ØÄ;ByP–¥þSø 1Ãâý–ðÈß‚4€ÿ!cÔæþ9 S¨H#qýW5¤ŸVž[ñkNûutEòò“F¥_¾ä¥6aî—ql_ pâÇIæ¾@ä'W›4 ¼Ûý á08ÒÊ/˽®‹ÖÍÇùyùÂÉQè§YôúÛßîIfp]²'kC±ŠŽ~²®´jÞš…Л'ïH@“!ù"îÁ ‚ðŸyÌ~£&…êl~YôÜWšmÞµ#÷ûH׾ɠŸ€h ˜øVµX0@2ð.ø›Ã½ÈPa q/LìŒ&™í‰œªFF"§p‡ûÔðÌ(÷è¯tçøÊÙ®„Œe¤ï! PåèÐzóŽAFÑNט·“0Ú=Û=ˆµ#yl\¤$>rúƒ¼Ô†¼]Ê‘› -xþ£= Í@<Ì€¿ÏÝ=ZÂ0ÍÝA“Û oì[Í£7(+UÆ$î­mLL}Ú×Ì)¢™gÇ…Aä<à:Ýw2ÊípUxĺ°‡tÐs8÷>±ÓŠU€ÈóýÉþƒå5p¢ÄŒÑuŒ{… Nä2Èômhâ¸4Þ)ð¶ó`hdéšGG3¬·›ó&Åî—ð=Õá@J%Þ<óÒõ‡3™Êú¬³Õ#?Û¹(ČÒ_=KGP?ƒ•i˜%&â̆ê4áìÅpÒ8úóº æ[×° T(în˜g¢Ðó¡k1—˜!ù3n?<Ø·q$í‚ö„œ^4jº':-Kå\KËÜ4]ý^áüÑ"¤Ì&ünYÔ•€Ñ² ²lTuÚËfÞÃÆSÍ£LK0DŽsÚÖ•P¤)LŽ~©Ñ¯±©ºåG¹Äy -Ök¦;¤¹×ÊsóŒiÃÀ½N Jg²–4[ä•V^ì,]¢#ÉšPsvŠ Óx:¤¨:6ûY-èG¦¤÷äy+é*ü*ÞFÞô™Ä -³Åvé2Ç1X6ºJî -&]rUH%Љà¶Õ8iPa£òŒnÍ>(÷ćED€Úˆ½(éX÷Ý[vîx%\Þ¢ëÀÁò83r’ô¼r' -ÃX‚N†¥ZÍØä’Äûñ!´L°ò_¤ÙÏkêq¾«^ '$‘á<@Óñäô«7ŽÌæ¹-ÇdKt‹3°ð¥ ýŽÄÌÏ`Ф)±¨nâN-±eµ$+ÆÞ‰G0ÜÍÜ£±ÞuBxϪs–ÏDÝÓ ¶B›®&f$ŒÀG£c CÔ &‘Tåä&tÏY\ î?"ͼ<)£«"%º_sZ› â´ÁU}"ºÐl ¶K†IŒ`wèçÝž©qˆÇ•S£6¼tý &|žÜš0“JÕؽ™˜ Kw?¼¦’ðÚŠËŠ2aW&KyãJMøø¥(%ù„Á¾ ¼/ºã%—©Ô¨“ó~}ÃXøBÅÈ•‰»†TÝ’û!ëš(sWÙäyéÎ=Ô §ìuQ„Oo1Šeuë³2dqá]›À(I*;±q¢ ‰Ã§=‹Z´<õõ¥ñþ&)åâ™dÅ5¢2—Ø(p< üÀä²ÍlcôóU‘x‡Àò¨zkê !ô€çêÂÿa©ñ"TaŠ6· _x­ v c3ŽN?Zq.++QÁ>wø‚R°ÈH?>KÕƒœªÿãðFÞG7‘EÒ8“(HeLÚü*‹¯_s­×Ü áÔÝQ"ñ)õÜkuÀG€€b^׺~bäB7JòeO­K`‡ JÌÓÂd©8ì;þÕ‹6àôó·Ÿx ¥»’[}j{%#5Py°<‘T~kõ;ÎæŒ7H -ø#ù)' ¸9ƒ¿/4¨°­õ¸€Í#¥· 2å.R1hT*Iý(¥NÂa‰ ¯Ù ªå9Æ}ª©š¥•†Ižl°í5/RÚ~^‹ì -à6?.%e„dª›",ÀŒeõ%‡ÄÓmßý§ìࢀ«²y)i¤¥b¯duœ1 -t -'›€æJ× >L Í8ô~¹*bOðM*z9b2tLÏ ëåöq¬+Þ´¡ŒŒ¨åÒ®[ïñ¯6yâ×›<) ÛÕ_ØÈBïš² -+Ž'†Úv*R”g‰/C)ŽfèÃ){Ÿ¹BÓ TŒÃ+xäToN3nÛ!Ä¥¼~¬JT[§D™'ÜÇ¡Ì^ô€¶.ìòÑƈ7ÒjjÏÍHwlaT'¥)Ó †V\4‰cFÐÂ|cô–·=õNæQ—Øá¾›w;ÿg”4D7b@\â‡y)Øï]ƒwÅ›’ºãaú 2Y¦¢)‘Â:=ºñzë2ϼ/È”ž­hQkžs¿ƒ²¶ÔqÌú0 -þDωC"ãßj"5ÀæWã¤Ù©ÇŸ° ÌCÈ…¢|Ɖç9FKwé áLñϸôE›µË£3ÛBZ&‘ûiÏ='Ñ—(e†Ž—uVM1„c|h$RºMïlÁh"' -X›$€üLˆ[MŒD‚õT«¦6G*j‚‘9EìÁñWÚ<¼kÅ9˵ÜKP$îVÊ`[Ù©ô«¬>`ù8ìæC£vEÉ”…;ì¦|·ÛⳓY·E¶d¿üˆMï”t¸&DIÖŽš -EÆ1RO.©VLå ðnúöò¸cЇFm_üpÃÍš¨ /øCú°ƒnÓ•è\O¥Þr6JZÀq”¾J˜<'ûbƒú;l*zÞi¡äœßq#rùdbÚŠQ 9Î(ÆJs ¡{Zi-m8£oU…7[³_ ¾"ÿðwtBP;€hF%×;»·!B™luEÄÕ_ž|uC´¥8 ÷ïøúxñÇ“í¿å϶¼5›–’enw¬:¡+­§†ç¹ ¨Õ-ƇäGj¨àˆTŽŒ`k\É*cØ¡d§ãy²”«?øýéö¬?8EˆDÓ7‘0„ñ2áÒæN-Ÿ,Wñ7Ze‹8:Ãl¼øûÙ‘î"† œ0þ›†ˆðÓ ï:ÿ"tþEÝJ"ý¾~íØ" +ÑFoxÁrñË‘ªA¦=,éé¡cæ± âÁ7€IÆb‡‘$¯(Ò‡Àº‹¡@örÔéÙÄ)ôt/Q\«ÙÍö z¡WØò‡éähÍOï<90 ™˜l'Q‘íDWäCŽ)‘ °Õ(Ç$`©&€é‡ –ƒÈ‘$0q¤v%iT»Ùˆ%Y{&¡¯‚™ÇPJ:%¢lÈP¥[Û‰“^Ç||P˜;ûÅ€g¶5…Œì ö’@Þ0_Û…½â2Øal-%/‚¾¿ðŒÕ“A<é­ë÷)·PAvãÆ4æ©|{Ôg³úJ‰Ûø覊”×$eB…âdÑ6øè;¶/$l¢ï“­Îëˆ*—½æÞvRP’ô31S-øl'±?£4ê· ¤r-Bé=QؼЃ[ 4ÆÌ•åfɪ:¾‡í'HÞEèÒ[ÙZþ2›çšÒ§¤ÐÿqÍ+(Šú´Bq RšCUʼnBâ _›Ž]°Ð«$q„Ñðp'¬ µ)ž6‘n¢½S¹`Q›jÃÓÁéJÈŒ™’w«SlD*N·Èƒü‡¯>lñ^zêß’‚âwØ… “ÔÉ ÏׂsÀšÅÿÌ:…@ëmA|.í¸Ë{È“` Ð†3Cx‹ÒZÅÀW‚â6VžbÁ’½ MëÐJÔñÃÛL[¬M½B@DzƒgáœÌTÏÔ^l…•†’l<€ž½8â=¢À_ö6ÜÊ‚ï_Ùów“ѽâ]û +6Tm]ÎøÄ嘞yz€É +^ÿìî§uë`÷q6«lRËÊŽÙqg—2[´¤ƒ›²á—úwîAÏ +‘=ž."|×¾²Š€vÅx*ä¬ õžh lóÒs-V£ ,0vN*£1q’:÷OÂs:³œ_${ŒÐ»Ë±vd©oªš.—œ Œþ”»V<µEwfÎYèL’IŠi4Êé¯í{‹¶”u gã ³BÆ<0*•[öšÌg'wv¥—Aqh*Iƒ^¤NÒ UÑ)‰@$²æ©¡Z ±m°Ýñ{:=Õ‰x$χŸëƒ ¨9{l^Bþ+òðô¥U8Dv®}áTvP +èbvǨKïŒ1ƒá‚ 7«OpŸ˜1`½<îÊçCKüߎƒF;êmA@Ÿ¨W­¿Î¬ã¬õ($€cÙ,}[›ßØÔX +¥øD ƒ«­I¿vžŸFÃ'-í*Mÿ/C{¶c»qŽ™ F Ky•q‰71.¿¡dàD2Œ†‡Ã@…*<‹F/H‡ñQnã¢,W»‰œŸa‡Ø™K%p¢— ²bêcæÙ^“È<1>s™}ž3w-Ë úm5Œ¥)˜ßŒù…u¬v©ß""Hà7 _3‹òQòNSó÷•SkA¸; î|Ug¯:ÔÞ¯¶VEµ¹êJc«a–(‡îåÇ©aWÒȉ#Õél§Le5fjc~¹»ýï—÷8WÒ{‹‚ß?ã}Ÿ¾ŒÍ9p?øhõ‹ 6ã™6ŒYýÏ3QÒ§SpB)ÓÉdŽYvÄŒìË“uøÉU; 3,¹fì¾*2¹ÔŽ²*ˆ.ÆN¼ øA©åÒv>8Æz¿½‡nŒŠ8ø–⟤o±’ƒë®¥Ð²²T®·æÇÜsóBœ„ÔC;áà<Ã]l ì©âõ¿<œÓtU¤¡Îé kî _þ4j¯ÞÝ\!QsîcÞù'Рê졯Qçáœî±«@0"u7u%µçŠzléÄåéoüö«m|#΀z°â ëôx çàÇ,Yn"õƒʦ…—^¯¶”9¿Ç\-’CÊ|$¢±ASÌΰÍ]bE…ÓÇ=Ý™V¢fT(ºN`‚ïjüî9å´bÁV³D2›g1eB¸÷©´Ù^æ5ñéÔ1ì÷|ˆ”r´°%Ê(…#l#8T®Ûâ÷xžKµ·[Š±-®uLcx­ðªE×öíj­ÚÍ%eiO—Ërì­Ô-5 .on?<\zp6¿ðTðë:-X ´Ö®òÄ9Wž—»…%.`aù*i†P•1‰Ô¿ìlëK1 +E‘uN®W ضP2üùñêN +¨ŽÇ¯¥T`¡•”W”Á؈ø!üã—íó°Z×nçøe+è¼$’Kp_æ{Ô 6Ë…ñs¨gCí‚Nîd‚°°ê°þ8‘/ù©²dJ*Î/xQÅ3[--¤xŃWdÍP_¬ÝßD×g#.0uáVz^œhúaJÅã튑ƞl]Û?Jìé” +ñ@FØ= ßöÓÛßNÃÛ]9Ö¶áNüÙá5æð"éGfbv-ÿ«å^½÷òðS_Žb`ؽ—P»Ã5÷¥2W™u‹ÝPÜ5Êú%šVLC<&z¤Hܥȼ¿Q†5Â&¹4w;¼g ô^*¾ã›hCNx:U‡o‚À#ýkÍI‹@Ç_ôVZ’X;»8rk™â‡÷2ˆÈ/Ã3*RÅŽ¦óÄ%µ§‡È8 “xçð“‘rD= ”1þ =Kìq(ÍbÿÆ4ž…é,~åÊÿ[&ü¦endstream endobj -1180 0 obj << +1280 0 obj << /Type /Page -/Contents 1181 0 R -/Resources 1179 0 R +/Contents 1281 0 R +/Resources 1279 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1148 0 R +/Parent 1229 0 R >> endobj -1182 0 obj << -/D [1180 0 R /XYZ 85.039 781.388 null] +1282 0 obj << +/D [1280 0 R /XYZ 85.039 786.531 null] >> endobj -1183 0 obj << -/D [1180 0 R /XYZ 85.039 761.463 null] +6 0 obj << +/D [1280 0 R /XYZ 85.039 766.606 null] >> endobj -1184 0 obj << -/D [1180 0 R /XYZ 85.039 732.472 null] +1004 0 obj << +/D [1280 0 R /XYZ 85.039 651.298 null] +>> endobj +10 0 obj << +/D [1280 0 R /XYZ 85.039 651.298 null] +>> endobj +1283 0 obj << +/D [1280 0 R /XYZ 85.039 622.563 null] +>> endobj +14 0 obj << +/D [1280 0 R /XYZ 85.039 213.197 null] +>> endobj +1284 0 obj << +/D [1280 0 R /XYZ 85.039 184.461 null] +>> endobj +1279 0 obj << +/Font << /F20 937 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1287 0 obj << +/Length 3130 +/Filter /FlateDecode +>> +stream +xÚ­ZmoÛFþî_áû +ˆh’Ë×Þá€8u¯.9Wëzù@K´D„Òº$Ç÷ëož™Ý%eÑÉ-ŠF»³³³³3³óF‡çýžç‰¨â<ËS?Qáùjwœohåg¡Á˜”ùçryvñSJ«_ÅùòÞÑ) +?¢óåú7ïíÏo>,¯~Í•R^èÏæY–{?^ÍBï§ëÅõòúf¥Ø»D°WËËÙ<ô®onˆ¼¿Î¢Ü»YÞ¼½y'(o?ʶś÷´ñJ ¿^Ý‚Ì»-e;³OË_èóPùI\0Kï±ðãÕ-–ή–îŽN +tŸüýì·OÁùš„ñËYà«"?¤qà‡´¼;‹TfޜݞýÓ‘’µø<¡§å™¨ÜOru*Ð0 4 #_…Ñy–$~gÌþ¶| þfó(ó*\tOÓz¿ùa6ÃÔ+±yÀ)W3Âù áU½€Ë}Ù<ÑÒ±±jøX7 F©×¼¥u¯ šç^«Úlú÷I¶ðÁ_˜rû${{Þ FVϽ]½Ç $úŠ0d7mU¶ºGl.{ͤ» ½é{Qó!µº\¯J¦Ö ´oqãÿa +àê/Ÿü—ôE~ñ=+pX)­Æ¾ŠÓ#¥™ŸE)óúj6O’À[\.p>,7ͼEÕ‹)o7)Cë›L 8/[Jš+_e13ÕÞÓ±+½=’ÕWH+½µhbÕÖwƒ!u¯±¨¼r§÷›Ž1#OJie/jXÝƪ»úm%ëõî¡©vl`¬ù¾ìk˜Ô^–ËýZ°&P™“À®eA@¯ð„ùì~>a—â"ÂÄ[”;P!û¿¸% ­W<~EŽ'V¹·X^¼1;4™ŠªÚNf¯>ò…Ö ?vBêZدڽ¥Ùÿ§ Ö#ˉßàØ« a\ôÐÈsÝ*™ÐÚEDúIRh’,h–ÂÞQñ{8ô‚¶Å›ˆ’Œq¹`¯Ö—Ÿí»¤YB3¦ ‘@╬•«¾†¾°û±&…^/n¬è.ñ±¨n«ÖÄ;‰7?3 „bð|¹jÌ/\L1ØF&늞Oӑ݆ ¬ØÆG-áIã ?ò˜ãqÁ;bÊü2@ã×ÊQ·tãÜö†Ö^Ðî Σh +èž Ãyéö³û–ãëJð›Ø¹#½ñ•g@¦7_uº9˜€@zMcò³|h Î HVG³˜ÙW³Ê{Š$NsÄ“R$ ¶2 ú­!1JÌöš˜(ûj-ˆ•Ô]Û² §Φ"¢Pk®¦e ïX& B"ò~M=°åu‚H9°"všØÇEèaáN„¤W”>c, rª²?…1Këیي#¡²$Rñ” oïý¯0Nl&o²v˜€ßÖCÙÇ›J8«uµ,ö¯1R8³¼.aŽå]Ù™CºCÉ&ð$Øž0kYZÉ&‘PÈ.g’e§÷†´õI§ÎqWo¶6=IS“žìGf3µ™úÞ†îzœîª4ñ8&÷â‹Óô™Ÿ'ÀZïJÎÙc1áÉ6Ô,i&a€p´‰I´•J/Ž)¸ý{Çf*CGôUØÊhì4Tqq*Wm(Šü΃+›ƒ°[94kAºJNÚ¬  “zYÅÖ$ÚÀ²< þœIkŽhOW\ +ä’ž¶U#ÑbΩNbÁO\üÞfj0«­‰;=î.p¬kQqq‡Êƒ¡7nT©#g,TÊÖf›±xC»Q´Á&Ž¬ž™’¤zEÙËÓ,'ÂhbrC."“‚Yj9¥û2ؘY“À!´Yä½Ë(¹˜Q‰Iã0htov³Hùv£šÊù×bjR»²eÂ$ˆÎÈÆÙdj½w·ãB™èW!íy1~^¶®’õ×ÛãÈ [C"ÄÅÍR`¥ü'O£!‘-Õx5ÐÙtîeHo«3g»èÀU=Ææ,§dKóã8pº¸gHïé cìʽ¯"kâ^_ãŽ,‡Ì9Ž•÷F°œ¤Ì®Q­ò,LD¹ò³">§ÚÙ/Tñ‡Â„¥5; E¹ Í܉\TÕº{ÎIÏÏ©èú3X³´¾ÍšBx£Ð:f æ¢k.*8É:õÌVåÁJÝl½´æ)=Ôiô(ÈRõtÜ#±^C¼‚e‚2צ®\Ï€Ç-K97–hZŸH3Š?MIшÒPφÔ| 5¡æX‘ S{kY÷'\¥t2]öÏàÊú6W)å&I>æj¨ÿãqžI3Ó×Ü|šÙ*fƱdB#%½uº@B å”(BTDZ*ë ]' uH‰ãÄBê¥WP 1íJ]T*töW¯*sž6Çu‡•sC„ǾÑcàÅ:æh›^¿T§3é”]SÝÊðEŸíHRí7¯‡ª¤ìÝ )ø¹5JM‹.ôn 0JãqSÓû£½Û^p(pÒèùý‰ˆéù¹ªÝvX]œ;%|̧;’T£ÿ€Š¸0éØŒk¤@Ãœ}±íùV zw±†ú6ëQðh4‡ä‹·×?Ý^ŒX×ЩßÕ¿Â +cQÄíý¥Œ¥ƒtñÐJ]r7,tÛ²ýæ ’7€&åÖ¥tjHZ ,~Ý~v}1Âæ<@ÊmL¥É@¸œЯm2ÈŒ=TarrBß¹~-fÇ©,¡µú0$;f+%bíÚ4>¤r;½ÞikJ‘jJö|ŸÜ9m¡ääžE¾“‰k]`»kÝZÄPep£YD£Ü&63 Ñ„ª%¢Ê½ÏÐm9X¾’)6À0f|Ceø`Æ<}ÁP² Z¬ï'n6j}œüiŠ âÌ60½\!…×”í¦’!+ n{Ó¯A®"Ï4?ŠQùO“q‡$—þ^æ B€öà¾3T}ž„¶š¯s¦¶@Î +èÝ,*¦¾_ŒÛsE¯I’ÆèôQr.´‘µ ­B€Qzê"ó …~·¶”£‰‰”‘õ0Œ“x.-–GÚèÑWSÃS/ÂöŽŸE½«]‰õÉ$m_É—žNîáªJ¥¦¾Rš~Ù³/”/7Êä2Yxj`LߊX7ÃgµA†÷1¢„ñpàq‘ˆW@¹þõ½,ʾ,šj¼å8?z)™§ºfø¶–qsvgFZ~šEôÎت±€XÊ©qŽr¢W†æI›•`ÝXOö+¤ƒ_í˜b¹—ƒ‰9ƒf¾NåéVTãj ŽäÙÆa>Ôµâø㇠òn¤ÊDó<,lŸF«±²p-2nh‡ÅHûæˆqw äÖø ÇZêùé`ꉯMÇQJzÜÂAÉË›þ¨­?Vjê›6ý/’üCeᾌǹ_äÑt +˜D™Ÿf±e†¿j'Ý3óקÿÜÖoBendstream +endobj +1286 0 obj << +/Type /Page +/Contents 1287 0 R +/Resources 1285 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1229 0 R +>> endobj +1288 0 obj << +/D [1286 0 R /XYZ 85.039 786.531 null] +>> endobj +18 0 obj << +/D [1286 0 R /XYZ 85.039 722.931 null] +>> endobj +1289 0 obj << +/D [1286 0 R /XYZ 85.039 696.923 null] +>> endobj +1285 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R /F11 976 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1292 0 obj << +/Length 3154 +/Filter /FlateDecode +>> +stream +xÚ­ËnãFòî¯Ð-0bÈn>÷$‹ÍÂda/æäЖh‰0%zøˆâ|ýÖ«›­9—Å#²»ºªºÞUt¼Šà_¼*Ò0Òå*/âPÅj{|ˆV{Øù÷C,IªÃ4IàùÎæÆîn2FI~Fhlò¸ u#ÌÏßþ¨¢•ŠÂ,Ó«ç×U«PÇj••I˜èdõ¼û-PëMšFÁ“9¾˜õFgYðýzÝöPÕv»jýÇóOÿzv´„”Er‡›hµQ:Ô¹Zd5Ëã0Ê”ÏjœóÙ«p÷X•Ìj3³ë88 òÙÏQ°·¾Õ°ÑžæT‹@Z9¨a0/ÈAS"¼@0q:4"?‚ðÂ?Ó5ñ`[Ü¡³$tƒú-‚¡gZîGÄ{bN°¼ |\aô¬M¶Žáî?îèÿég ø˜ŠNƒZëàŸxâñÇ'|SÁ{×¢Ìo*q#ßãÀçMÓ[W†·¡«­\{¦5¬eSÈôÙs:×·èuD¾¢Å>ðᵫ¾Œ)Ë u÷!ä ßá“}Á˜êöÔ j«$k…|ì×ƈ4- Pß~fãÝ 5* 3ˆ„Ň7ôtÆz™ƒ|…š.ôH/¨=âÝÓì2&Ð +›Õ3½Ÿèø„9¢†N5þ¿çÕVvÿ‹kõ_ßA Ä9þ×ÇßüðÞ0˜þÚvGý|0h)iöôu1ð)Tò­©vlíÀA/¸©÷•VÝ;ÍÒ¾›U¨Y%ÉW:-(T€8ŸÍ)t‰œUè"5«PÚ¯¨¶·~´co½ˆ)¾óÖQ2Í€äW™S+ +õÌ°®A¦«I/‚çÝtÃ-V²¦"x1³’ŽóP—_“ô´ i»ëYI/‘³’^¤f%íQû|HŽ7F‰µèÆOñ¤/ÀT 23H6F vSEAû½‹‰ÝcÂolžÅc‹žm3":ˆcŸöóã/X2ț؀&ßîl]çXËßÍ”QIY„ÅýºÏ•QÌ|i—:Œ”W:SÌh“+ZšÍã'4½,Îá«Ö>‹(TZ/ó9ÁÌ—{ DÅŒ«½_Iuí;Õ*ÃœC’ê£MX¸<ØE/§³[ LÎ¥lþ¡°Y£Vc.ˆ$AáÞžÀ–H°–VTq¹¢h*ÀF¨! ¶´NvˆÂV¶êÓ¨9,§5XGbòÖ–qÔRöjðìhÁó—±ä‘83ï\eqè5vïmºãç^2 Fê\¤(€IŽ¼6¡CaŠÓ !_Ø#I™a¨ºO˜*Ø2nïåDz f\Q<Å4qT®¡ÇF‚¤Ô— 3 Õº_Íò™­s8Õ%*èPâc|Uçs¥J‰ö¨£pâ”Ržõ…u wj†d7:Ϲ0»ÊÞ½?ñ +88gèsCñd¨]BÒS?2q}Å#^}ãß+éÁ¼É•eb´=¿€P€3¶¨RYÊn°Cõ"ˆT ¼õ{”F7…nAøôÁ¥2ôÙyIÒcÊ,z&gU>0+!†3•œC}Ú‘˜×©ß£X“~;ÞºŠþ´¹cj;›“(’:ÜIKs"¼Ü$™ƒmVrŽã[YN‹‹ÿøF¢{]/î“¡)8÷¡H8ê‰6”² Ä®ƒöªz +ÛKgÖïg‚Fí**þ•ŠÃ8.«©r¦G9r²YÒv/œ‹095rpa'¿Î]u3åÍ·©[{wY ¶7}&Bo¡ÊçFp¨Ä~üì¨l7‰¢€f®¹Wmšm×úÉY§RõHŽ>¶]5¢8 +é öáàhÞÏO;jïÐÎÏ/¶0Þ"ƒo÷º&ƒ˜ß›Ú–¶VTךö£Ýeü%Ó_Š`*K‚†JŽí»T¦m<ì¹]B çäÀÆ=š±NX«ÆçË8øÁ‹{©Þ­ãyˆØ½_«"A¸i‹,\<š7{I|½Š›}‘f#×}!}e ¼Ÿ¯òÉ­„Ëü"”ò¶ÃhÛzÂþÑ…G|›Šc‚vlº®{[´d,{rQåEÄÖ³ó5†=èÓ»õı?²°>«)OÄ‘pDFxà3nÒ÷ ~'.%: ží G°¾º²b`Ôl(n~%©±·\0Ôm+™æpìñK ÇX9"Æ[1@8UÛó/†Û´œ¦0á˜iäf¾™œ•†<{ö‹^bY·FXŒì‡3«*q Z,V¬Ì|e­ò4Ti.•µæÊúùn) î£whTò [¹ +“lyììÁÌÒ*Å%v¯ï¥¡ù¦íÐÛgOGÇØ.nk2h7{ÑÍ+Ýñ¢£âÆÁÎs®‹' ˜]5;¿QÐùé™»&ÔšoB-Ðâüf‘œ4¡ËÔ¤ õ©=ß ó\+<´'zà…D.Cº©TÄ*¶o»Ü$[¢1ÚWþ½ðC,lïXq…ëöƒ•É/.Ðõ6 _¦V.‡>w²/DTHìc0&êžWëWþªÌ2Åu7®ŠÔÚ•ü|Ôî§9+W95Ô‰ O¦óíØQj‰ã‡ ƒ5êÖðåŒW§›5‚ø‚ð¾i_¨8ÇäΚk”‡j&nLæ:-˜«-N§ÉYs]¤fÍÕ£V“az'­«ÀÍœø•2« +à +¸Âö7Í"rúÜ™{ 36—ô¸=ð 2—†§¹"$ˆwu…XÓ2øLß;x•“é‰ÕÇ£+°µm>æêb7V¡ÉL‹‰uì‡ÓÅ(§‡«yõÙEéËô³Ú‹(Œ¿«&˜yÝ Ìâ¸l‰–h~‘”(Þ#uäÜHõæPR*竺„î£çÖôÈ0[ð÷ž]©Pj¼y+@Jžo5v²|£* m'S*ø¥=m^oÔ†.EÂqþvPsti¼/{½cúÎÈaº”(–g¬dº©ráQ‹ßnQÝâF†TøPŒBÒ5”rÍt˜‹¡fèóÉÅt;F‡žÂÝ ¼ô [¤xœ§D¿S—&_ŸZ)È »º×õ8éc¸lì'’/¬iÌôëʨÛHŠÛÎ iÑšúòSM/pààÛÕÚè«`%d!f_{Ä(¦\1ДyW 6¢‹tn? þ‚Ÿ·T‘ã8 Üò!Iðˆ«w‹¸ÍŸÖ`…¦T½ìv²øjú'¶5 å28×"„©,ªñ}Æ\gƒX9±…¶oú + ôý ï~é¹£­\Ó¯Åñ ª‚kÎøMÔWFóÐB¨ ä&™5Käl°Y¤f£GÍÕ˜]·æôÍÀÝÈ_3ð™æI ¿î0³ëª»ø¤ûvRdÈYÊQVÙÁ‚«C(ß ŸÁºëj!|¬ÌIÏ^ur]+È'øµôÞKB­÷á\®wƒµýl÷í¾¶6pó‡*‰CÂÄi~ž¢”¿<üöG´ÚF~zˆB]«3> endobj +1293 0 obj << +/D [1291 0 R /XYZ 85.039 781.388 null] +>> endobj +22 0 obj << +/D [1291 0 R /XYZ 85.039 761.463 null] +>> endobj +1005 0 obj << +/D [1291 0 R /XYZ 85.039 671.062 null] +>> endobj +26 0 obj << +/D [1291 0 R /XYZ 85.039 671.062 null] +>> endobj +1294 0 obj << +/D [1291 0 R /XYZ 85.039 642.326 null] +>> endobj +1295 0 obj << +/D [1291 0 R /XYZ 85.039 569.47 null] +>> endobj +1296 0 obj << +/D [1291 0 R /XYZ 85.039 542.372 null] +>> endobj +1297 0 obj << +/D [1291 0 R /XYZ 85.039 528.822 null] +>> endobj +30 0 obj << +/D [1291 0 R /XYZ 85.039 498.834 null] +>> endobj +1298 0 obj << +/D [1291 0 R /XYZ 85.039 469.43 null] +>> endobj +34 0 obj << +/D [1291 0 R /XYZ 85.039 291.068 null] +>> endobj +1299 0 obj << +/D [1291 0 R /XYZ 85.039 261.664 null] +>> endobj +1300 0 obj << +/D [1291 0 R /XYZ 85.039 245.795 null] +>> endobj +1301 0 obj << +/D [1291 0 R /XYZ 85.039 218.09 null] +>> endobj +1302 0 obj << +/D [1291 0 R /XYZ 85.039 193.719 null] +>> endobj +1303 0 obj << +/D [1291 0 R /XYZ 85.039 123.852 null] +>> endobj +1304 0 obj << +/D [1291 0 R /XYZ 85.039 96.147 null] +>> endobj +1290 0 obj << +/Font << /F20 937 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1307 0 obj << +/Length 3219 +/Filter /FlateDecode +>> +stream +xÚ¥ÙrãÆñ]_ÁòËBU"‚ûÈ‹K^obm9ÞÅ-§ÊñÀHX8¸(­þ>}ÍA‘”R®5çèééé» +ü.ŠÔâr‘¡ÅbÓ]‹-ìüó*ˆ¥€,˜VWûG»_åbõ`ñ¤~’Æ‹Uõ»÷þ§ÛÏ«¿^/ã8ö"ÿz™ç…wz·ÿúáWïö×ë¨À»Õ‡÷«/z®ÿX}¼ú°2÷ÌpW‰—½úý`Q¡¯?.‹Å3Œ?„íî +n÷Ó$–y{uõoƒŠ÷’Ÿ:÷Ö$Êü(‡AøE‘œ… ÃÈÃ’~$†!aê0$ŒR?K²…BŽdþëÇ…qâ‡ñÂÁtzƒüÅmqé§EztÛ3ò¶F±·m¬ïß͸z‡Ivæ,Ëxz™æ…Ðá<òÚázåÞæþ÷Øô¸å ©Ú‰ª‰w\t—=ÒÆw}ƒõ™×‡þ}€%ºÀJonÿ¤ü y·‘«2x©–ôæýGñÚÂÛöiÂÿß°" Ã̪§xiÞL0¼ä_R¿°¥IÞ6 CŠ`7ñcP”hMD )¶ÈO®—ix«ÝXÃõ@DƒBB6e¹×wk^u¦¬,ý¼Œß¤É9£5BS–~‡DÓjGüÖ<£Ü† +¹â•5ɳf6U­Ú½5óxKÌœ ±qôdóÂã=áÆY!‚¦mfgs¬¿â¹f¬;ÄQ³ÊL$ ý}Jtßö(¾±~†ÓIàÍcSÕ ?/=È\T:œ)«‰ÂY@Io¡z7ëQ¡‚¼ð*æ0ò•©C1Wôe;%¸ÈÂB½> x+hNèÞfùž—À$–ô²¥û4Ñêiäh’¤ÃÁœuI’„êùÏnÏs¡>d@(`àŸD5îa€6%~ù ’ô¢@IöjÖF$ò¥À4|‚íûZªê‡cMŒ}ú@ë#x¬bˆÓ€Ä©ö( 5ŠŽ“šÀÖíÝØYWƒ6<~,Í»Fë€H1-2m¼°ß©Gqÿ戒“HòAßá˜`ki$1jS€3-^fLáô}M'xˆ ©Ñ¸ÐŸ.³<ñîáIøðw:à‹Í弈¡9‘ÇÀ{#X¼¾oÕÌæØ¡º…¡‰w¸{ì»p% põÉÓäl8dT²Üw³æ5÷¹ìjØàê2N ï¹Ñ#²ëÊ®3Ïŵ ÃÌÄ6éȤ·‘õii Â+C4(:2¦£5ñÁFcxn5gFal_{*ÉMˈÍhid“‰4æ1$ú±‘×STMAiî=9À[Efj|!)Ró"©é·¨»B33¾F?+&­…ò´/ÈÎ/Ði5ëÉ–ÄG,Lî›Î<ûAAæ3"%qaµßã„Ù›¥` +gæ¸5VSöÉäëQÐ9¼dæãœ1õžŸó9^CÈ®æðó@Îþ ! #¢¸Ö¹Kîý4ú„ÇÁ³×YÞ:KHëœ>ß Ä1·Ûø,ÿ,Ͻ[ID\§±7¬šoHÅQl ]·R‚ûkŽY§~e*Öy Q^éd7íA'oÓË5Ôƒ7Ì}Ž}. +ÔIì‰O[Ñǘ—"NˆF¬#Â^ë‚vÖïpþÊÀ¯jXéë'›õiG0>òæ ŽâKß|ÓEá+v 1wâH]?h|(9{ð‰Ÿîu¥©LšùRul!°0ôRd= £-cÝÊãû³VÊ" ž}dW¬9‹ÒJ.ÐÍÔ^G¯\+AsŒÇÄ'J34`Û®†345*>ЙàÒÌÞï©ìœ‰ðE‚òËŸy@¾Õ1 +]§!Rá奂IQ¾ÞXµ„²‘ ã'ÎO´¢ûT¨0¥ÎEI{Ðà:Ù“‹'Î>T«*n7“㘃 –´mÍ;º>F¤º‡+¡§Â'ÂCîi;ªŽç˜ôÈq<^´ï¦ôõZ#på1vÃAÜ¡‚¡®bÐçi÷Hd︩¬+7>WbUÓ38ûÍnßÖßœó\]lŒ&i“=röôôg#Ÿºí¢]–»EÝ9[üíºH´Ùé(ôÞͺ‘оhSâ_ÖsÖ]éD´Tò‚™t¼ ‰¬)1mÇCO]¹ùN7Œ:?z™tÄ;—ÚIIùQœ¾Ùºq`.·“â"ó“(‘vRÊí¤~Ý!YæýÈaõ}Û_ %.b?‹ßnm90—ÛHqùAÎm¤Od€Û¦ç.!ò»¥ðÇM˜:-’*Ÿ’è©!!%RéésË#W©¨‰“r' œ¹Y¾®Ü+lùÔŒ”ðvNQ£Ë±ƒFã©Âá‰ÖW8U}d ÏlqÔ>9÷b`ЩJNè^Ž¢¯åŠ«›¡G ÃDù=ž®jòÈÛ­Y™Ü¼nèÑÏePü|ŸyJûÏu¾ßK©GrÓŒc×0׌þR… 0æÅŠç_õAÑñZóå¸z8±n¼ÞOrlVæÆ^Êy57š2ýk ö¼8N36ª)CHJuÕƒû +S£IÝ(‘G”à™RÒ*>5ñ#[A‚8ÝœžÒ˜ ¥qÆVÌJ*QÓ°ÓèMU…Wµ­SÓ +“œ‘™}®y¦fã0GŸØ*,¶€û„ÍÜPQÔLÂb4 òþIaJdsgŸ ДУ`bKÆ4°\ª²%À©qk2A™‹­iThG'}ʨûÍ̵rÚÃ!\^ÛèÞ­ +ÑFRuЖr–H"¸)N%u$ΩÊ^0Ž “€>T .º(pD +“±† ±1ÞPI#FŠvhiNf¸¤‰£ +òÎ3]çÁ¶Q\9 kÓ3kä Š4£¹Çꮶ8Vs§ñƒhxG-HÌ×GßlYê­ŒCœø–éPÑzÝÐf¯†[o5YŒ›Öf’ºei„˨¿c;3G“-9ˆ˜ôá8÷5'&†AmF¬'iG>YÙŽ [~à¤sãbB³j6XO¡<Ù}‹3‹*j€AªƒØù:AêâRÒíÒiÅÁØiæ”%k):QÛì%…Ä=%§= ¢íù÷—Õ;¹ÈúÁ±·u%õI˜Z¥PerÿÆIÅÿ’Ðô(&"¨WÂä]HEÇ£¶œùç~2j$/SN—‰½ó³Që¥ wþ¥¦ÒjGédzklˆ±ç¡³Ï#E:\;nöRÇ:M DÂû§Á…×mnœKRœ‡ç> +áîÄß]aøÌ‘D•K¡™Kö›±ö/5“îø\Á¦äoPͦæ WɬÈ3ƒÙšS +„sÊ-ÄÔ™£ÖÄîBr¯ó…÷Æ°(=û +e°Âì2=2¹šŸ‰´Tµâó-Ï~Í­Ì7Š\=)[ŸT†î3ü$U3ÀwüÅŒy|F€¯á¨ü4ÌaYúIþõÄ~”Ÿÿƒ¥Æµt¦ÌäÓyQšíW¾ï¤oÜó/É¥³Z_O¨£;yñ¼q§D¡8—È#­Q¸éY5²è4w–aúIž1¼7ÝÔ…©®É2PÖ¥ít,QSy½;2J¨³SÓ ÌŽº“#nt?0ãÈ<4ßVa|˜ì·½L*ÎŒ,®¡k™2 n£Ør­´;>£NTã) "Ís/:¥‘n¢åè’z)õ~ÃÆç/÷¯¾jïÍ'¬K•^øQy®¶‚LÚÿõ'-¶ZŒý".Ïk[å~–'B ²"Œ^“›Æý] ½ÿùqÑ{endstream +endobj +1306 0 obj << +/Type /Page +/Contents 1307 0 R +/Resources 1305 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1229 0 R +>> endobj +1308 0 obj << +/D [1306 0 R /XYZ 85.039 781.388 null] +>> endobj +1309 0 obj << +/D [1306 0 R /XYZ 85.039 761.463 null] >> endobj 38 0 obj << -/D [1180 0 R /XYZ 85.039 684.451 null] +/D [1306 0 R /XYZ 85.039 718.394 null] >> endobj -1185 0 obj << -/D [1180 0 R /XYZ 85.039 652.925 null] +1310 0 obj << +/D [1306 0 R /XYZ 85.039 688.99 null] >> endobj 42 0 obj << -/D [1180 0 R /XYZ 85.039 393.269 null] +/D [1306 0 R /XYZ 85.039 402.235 null] >> endobj -1186 0 obj << -/D [1180 0 R /XYZ 85.039 363.865 null] +1311 0 obj << +/D [1306 0 R /XYZ 85.039 372.831 null] >> endobj -1179 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F20 877 0 R >> +1305 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1189 0 obj << -/Length 1818 +1314 0 obj << +/Length 2207 /Filter /FlateDecode >> stream -xÚµXYoÛF~ׯЛ)ÀÚp¹<¤@œÈ©ÇA¥(àøiŠ(•¤";Eÿ{gvvyÈT\8)lhïÙ9¾9–|jŸú3E0õ|΄ïO×ùÄœ&°ònÂÕÛ̱mè,Îõêܵ˜i{c{ÌéܲY`ÊÅóåäÅ…eN-“¹®˜.ïä¦etcˆÙÜqLc¹‰gsázFæ3n¬fsn„8ão±¿€Ésì|~G³õCÝÄùìvù~²Xö/µ™É2$˜ðÄ‘E.XÀ>·ÜfÂvÜ2Nü^Ç{â÷#2µk¶»†ÆŸŠF2?›ÅÒÔA¢ t™ä·nÕ·Gu…J¬$.Z„„¤4Ì!Á”7ïbªX7i©,s‡TI¸v“„dF—é¦6xŸ[Oq+ 2qWÀj4ŠAéé}»õu4À³D Þœã á7®F sD»„ƒNqÄ;Ð ŒF]‹›°0¯) 4þðÇd=§´®Ã,{˜ù¶qª°ÒÞØ´=Ø¢!é†Eg¾´>Kždï±ä À)ªTŽçNrª>MŸÙ¾3^à8Þ¤øzˆ–¤ {Y™:Ogý<Œ”BñÔvhÝ>òF|ÚGR`°· ¨™[s¸û|Y?]A‹°u/×êËæ¢Õû1ÀUúÁÒØm©•Ê6¤fÃŽJMuáû†AR\W”Ãýú’º-oB鸴zGÁÍ¥ýÞ˜‹É2+”ë¡Wsä¨ã–.3]çù–?ÝRª°¤$MþuQV\Žå5MÈ€¢6šP¡É•I·¡Ü"Aî(cÁúHèr§_Wy…Û‹BÞXúu6ŒQ!QÖ] sTÞdx“ÉêÏùˆuãFø€.¥Nox…í÷Ke®Ò¦ìb„ƒº±—hÔ Ikƒ`iÑ‘ ñZË°YFGÛË®¶Ö0,?΢@»Ë¢0À,ª¡ 0u—YVâ–ýhy!I›ŽŠY…O˜.¹ ÌC‰•§…¢ãÖ R³.3ŸkñM‹²°kÔ rdV†ƒ½ÛT€îñ {DÉ…ãbÌ M æZ -á[˜ñ%J¥>ôKõ’’0ñy6ØÞegÈ,º¤f 5¾o¼áˆÝ"j«_ „ñ ¶•#„×e®¼Š*ÔY ;†•‹Ï¥ÚcYóùíØ ûqƒNPQjEM w8¯JÖ´¡!jÛ±’@ګ貞Q|Ä$ØÌ…„4wlÆù$ÿkrskN#ˆQï'&ðDÙCß„å`šO„ŒŽ4Ê&Ÿ&¿µ¤àenyÞOB®|? ¶å(.<ƒLñ£ ü° óï)òp­ W®lH…ûA A둵-içR!@úfÚáJc&ÄOPÏ!êÐ63A}ð¥ù6ÓðèWœmí~Ú•¬ðà‘9£}æ 2¤09Hïªi??EÚÿWŠ´*,©Û²à?ÕxßH»¥šUõ}^VÃ'A­³ ,Æáà¥cÏ#GkTömöÑ/¨9w”@`I@M©_ãJî8éjpy}™Çú‰oK]É–»×®9òù'àÒ!©ß’ý&ü úÞÀ­3Ç9³œS5TßGŠ|±õ&×  ’aýA©¸ë¸Y¥e­ŽAò¨ãê+Öx8†N-£¦¤Íp¤ù¶ŠÃl» iê’êðµFŠxSnª4Ù4´ñuUø¡O~.©Ò(‰ñÑ"é=‡Oéô1OI-”ÔYFÛ°Ê•äž+¾'ùe‘6i˜¥ßdÇóIV®BÅÐe>ꣵ'wÀüö øšhÄ·Âp¶4RÈ„ØþË&8l‹2ÿ”ªÃùõ÷ßÓäß4@Õnyÿ?ˆ×šÌ–¦‚Q,Ó#¡Ý¦áÓ—¿)ì/ýÍ.é¾!M<¤ttŒôòž¬n¾á¥+^ú|ó÷›Ï¼ö•×>Þ~v`×¼tÿñ×»W·¿Ü}u|‡âöîfXU—'&ÎÏh­,öù¤Ú| = Ëê櫱¬1GN¸”)¢‘1éúùJà<ÎzD×€Ëû--9Ÿ\/t<ß¡³6Ùº³®…p|>Yã +zåaSÀ¯;Þ9wß;g~.í>/¯Ñ%w„³Nx…ÙTˆ†øÏc~­™¸yoÓLËüwD–##æ»QÇ£•h­¨Ù6w!J”mÏd8R¶,§[„Q"5ö„C!| +%ÑF‚„¤s냃 å JQQxvYõ4¥rKÿäH©œ—,œ/0/`np‰áSA]ÑÆ3žBµlÙ#E½I?@Ä,¿m¯½gÔVƦÙæû¼ÉÈCŤHUœ°?êù~< “¬»¢f“<¢¶‰y ¸Ã3cÆù ÆÊ&±}VcfÕÌɼ½g×nº™tEð#7xg‹‘[[ÿA>*¤¥~ófÒF'Ýv¬ÃŠ™Ôé¼ó¨fÝ´ èNùDÆãñïO ùžÊB±ÎÊòu‘ó+ö—žb×Ï„½ÂâÍöƒ!‹öúmMuÕÐ@Ïbâh²ª:˜¥4QWu("Èiù¦˜Ñ3Pæ<9ù5“Š0 GÔ~;Û¶O—e½}xƒ»TÙ† §žÆîà;îDœÁ(Nj4HD¢ãoht:£QBõIž#ç4z–šÓ¨Gí&£RâË©~0»Œ'¹Û‘½nav@ÅJV¬¤ÚÃΡÌ6C°úí†æ}xéÄb 17lˆ ͘jÛ÷Xæ¼ÍqÞå-?½bW@¶~@Á_GEÁ¯–ýü´ýµ±N¾aÿèŒýˆúçSö?GÎÙÿ,5gšU³Žu¯fœcâ„ŠNo‹kˆ +ТÝuÚÄÕQ¥mgVœÁ…_¥U'u %-¡³¼ÅyÔ) @Ÿn©á©Û±Ñ9‹b¯ ãÔºoCžýϾ9éZt-ÍW®#îDú¼òk;¤`J[¿=i[Õœ÷²½•4™÷þ‚'Ë{>²‡‰Çq=Å•Îc«;Hi_Hew 2jËu]–5²òŒ‚«x,8ÀP²Ügcxá=aUì.ÕG +îe´duQ—½.¢„u{½¡9Rrµ'L~5aÊyVÌ˨¼J"K)²dA¸Ôâœr‚W»wäŸÜì Èq †×55Ÿ™í'h­sXKÛšó‡Å{u ß(ç8-õö¶¡À}ùQŠ: í´"9$©Èi·Baàê×\ѽه7jpœ¬ˆ[Uæ[$](óNÑöÊ°•3’¶/:šÛô)ß•Ç€Ur”ž(­€¹EšhÌ=ÿº¸ÿ*gÈS?]À=.TÏ0—BÁ­º0Âœ¿Ê‹/ëQ¨KòA±Th3¯ÇÏD. "{LÚã7j $µRBƒ0çÔ*J#«Ì:VS÷ÍåÛ‹ˆ»êìk.’6v ÊÙ ¥d †’ëfQ=•y5zå¸^Qà–Vtx1[œ©¢:"0æ|õ€NWQ„¢§ªèYr\EÏSsîîQ³U4Hâyå÷Ž¸@íFD”ÐÄvL8ãn7±âø•‰šW«ºá#|Û±D®ð "àæÊuq><T}´S4㮋fœg‰wŸ5?° v uÍ)Í^·–ÒVî'2ôn·f³C7ùð¥Gï$÷àôÉ; ÿ ½²(}†×:¼âO~ÚW±¾Æ …©õ3dÖ>£~¦½Ë»‡¢nù$Ê6o~Çf¿aÒÚ,jQ‹BnùÔäYù´Ëhî„ ¨oêÚöcýôÚÛ]G?ì7 ¾zÚG¢¦Øls¼ªYÄi,á'f}z<2ªoImXê²Î6OYS±äqd&%g¬·û¢+²²øÃ^•ðü¶¬2æ +ð€6:Œì‰,mgš»Ë`ÇÖ߆cEo4ñPù £âh÷Bd\'÷Ò×þ'÷„êu8Ÿèº`ÝÕ9r¹˜k=Â#hÍì”E;ÜÅcê8ð,]ýcåš]2 ì¹ËÈýá2’@|gósùÝ:;àeW » +Y¬êEƒÍAñ  €Fȯ»°gÙ†1ãñ àûtK ·¶µè_ +TJí—Qî1`þØk×u¯zl/8a×Ô*´®q¹ì¼×I›«¸aiºÑ«ÕÛj+Ô,‚K&Ýíÿ¯Å2Llí^ìLÔÊH‰p`ù\/`´2áŸC:•/MÕyéŒÑ"õesmFŒ8ñ'ˆyúEòä_bzÈ ÊÊF12û\dÞÒƒråÔœ&ø_†szendstream endobj -1188 0 obj << +1313 0 obj << /Type /Page -/Contents 1189 0 R -/Resources 1187 0 R +/Contents 1314 0 R +/Resources 1312 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1148 0 R +/Parent 1321 0 R >> endobj -1190 0 obj << -/D [1188 0 R /XYZ 85.039 781.388 null] +1315 0 obj << +/D [1313 0 R /XYZ 85.039 781.388 null] >> endobj 46 0 obj << -/D [1188 0 R /XYZ 85.039 761.463 null] +/D [1313 0 R /XYZ 85.039 761.463 null] >> endobj -1191 0 obj << -/D [1188 0 R /XYZ 85.039 667.044 null] +1006 0 obj << +/D [1313 0 R /XYZ 85.039 667.044 null] >> endobj 50 0 obj << -/D [1188 0 R /XYZ 85.039 667.044 null] +/D [1313 0 R /XYZ 85.039 667.044 null] >> endobj -1192 0 obj << -/D [1188 0 R /XYZ 85.039 639.536 null] +1316 0 obj << +/D [1313 0 R /XYZ 85.039 639.536 null] >> endobj -1193 0 obj << -/D [1188 0 R /XYZ 85.039 351.388 null] +1317 0 obj << +/D [1313 0 R /XYZ 85.039 373.804 null] >> endobj -1194 0 obj << -/D [1188 0 R /XYZ 85.039 328.872 null] +1318 0 obj << +/D [1313 0 R /XYZ 85.039 360.254 null] >> endobj -1195 0 obj << -/D [1188 0 R /XYZ 85.039 292.807 null] +1319 0 obj << +/D [1313 0 R /XYZ 85.039 333.156 null] >> endobj -1196 0 obj << -/D [1188 0 R /XYZ 85.039 201.94 null] +1320 0 obj << +/D [1313 0 R /XYZ 85.039 251.255 null] >> endobj -1187 0 obj << -/Font << /F20 877 0 R /F15 895 0 R /F37 900 0 R >> +1312 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1199 0 obj << -/Length 2079 +1324 0 obj << +/Length 2026 /Filter /FlateDecode >> stream -xÚ½YYoÛF~ׯ ¦ -‹Y’Ë+}JZ'qÛ¤G”E’Z¢dÖ©’˸ù÷c¹\ÊT‚ÖmÀÜsvÎofo.àŸ7OBWé,K7‘ý p¹X†¡€hÁ‹b€5Â4Ïy'B± Ç;/³uSO`øOŸàÁnlo0ø¤ˆœz‹ß!qØAV˜ÜÞ4,Z>ÕÁ…j¡ˆW³j—o¢H”“PÙ­ŽaBZŠfMû@XÅ8—«¼i5¶ Õ•Åá;áÉÆ —ÍWH˜h…YȦågé|¶Ë9”=h0¸”œr4¨L='Ÿ¨`6¼\´|}I©‘­¦Pß|äs¨ZüfüÙ²ÂzˆËR¿X½ü ±u ¾ó5“AÝ ¨P«‘˜2Ðe‹ {çNÒ‹¼¡×Ïù(J—iŽiýOc¡!&ß`6Ñî@‡÷jõ#o›$R2"½H’²P˜@$²ÖÙG¼[w<¹ãI©õ×àSŠ¬üèY[îm’N¸^B⚢R[ -¬eè‡ÎÙê ˆÃþ›ñç =…ÄÙ‚¸ï¼@VgúÚ&¿îvgÆ©ö<Žrø–~À$^/¡É ‘úa¢ë)m1Õh>4_\¼æ`tlÂÙÀ£¦7ºãùtC‡¾ì*ÒѾԢMqPw -3~§øð¡á¦gÓ­±}Ä×:ã㶹vh†pÖ]«Å"}OE>A‹ ¥Å%ä½ØðØtµ2Ò‰B¢wa™³ ß¡SÎÙÐñ[®ùP¥§º8®&¬‚d¿¾àŽ7΃RxÏ° IàÈÊ?2¤üC Ù_ðRÈXé}çjˆ4m»± ÛQªaíE±›@§5ê·;j&¼ 7²ô¼£J Wçèdص7hMœZ€ØP—L«ªØlùÈ .Tù]_ØUnSôÁëºcðª’úƒ8¡"H„ô¹Ö=fUÿ@ûÚ—¸2¥§ÒÞFBᢅ‹÷QÔÎ{ã6 Фj]Ë-µ-<çâÝìˆ"H­Œ€ÕøUp"Ö-Av°*j)¦àVsìº.œ¸î”Õ¡qQ-‰*D¶ú½kõñŒ?ß•J°Ë­NêJ1¿£Pë¥áisjåå2[ë¦ëþ¯7Ü,Zõw°CÏw“µ÷îæš²iEÈßÅÎ=àÌ­ÒI:D…ìõ%Y >×êR;—ó¾e±mçï5,È(j¦Û£]•Ü'šœ!Í ÷¶°ZÃÑ¢Úñìê|¯«Sò«[;õ‰²SS)Ì÷ÿFµ~F gš\uM…¦’üd1~,…Õ0!±Áªæþ‰dhøsÖtùÙÔ³Ë yÙæü³ ®|ž~ø ºwù|Ÿ²ìËŠ˜9úµÀ¬|S÷ÑoûÆ–~õ#7ÊT_áŒqNƒ‹¤Ü~s²¯A³¶íöÆ©¥j܆TPx™-O§›®ßújß)¹¬oûȺ] Ř‚"ç?-²ü0šô+«ö<áÚ§üèA̘Šï臷(nè§Ó?½éÇö_ý( ÄNÿŒçÇ,ê3Âfð/ÌDÍendstream +xÚ­XYsÛ6~ׯÐx¦c*cÑ8HŠtŸœÆ¹÷ŠÒL'É,A2kŠTxÄñ¿ï EÉ’ÓÔEX,öüvA9ð'‡qè '±ôug«.aåÅ@:Š±#÷hžN§Ï#X~"’át±áúA¨‡Óù輪ç¿M/þµÖžöGãÉ$ö¦//xâíHzç—OÏqxÏ.`øôÝ áÚ_o§8w9ú4}=¸˜vâtÁÑ Êòyðá“ÎAî×áë$Þ»ð%,¯ ŒÚ³ÁÛÁï+^ †¼kŸê-ÅX&~¢Â‡ÍI?ˆtg«¯ƒÍ#¥òµTÃI(üPdí«Ñ8 …7½¶ w4+ ¤÷Q„bDÉ+—fV‡LD~"' ·¡!ádØó]'œŠ|*î]2bâ |†^} ¹¹gðŠ¢¢˜,c "oE2ÒkZñ³Â|6Rw›|içQ$YÕþ~8ÁÜŒTìÙŠ©qp‹?ŽéÚ”Èd…²µ-+b¥È|`Px,Ñ] )ðQÈé+$¯ÁŠaLbé0],¿¬,®VDc–n2³_HœÌ€Ã º Ül"j;+òù®W£1h R—ù¡qÍðpÑäÀyƲI/-r^ž™,cŠºØáúÌ^¡9—²³ZOét^°½kd'=Ÿœ›û¦™^›ú˜MƒÙFRÐÚOê¥8\ú{ìúÒ–d™“sJÓü×ÎGkxË,“Ü^§¤/E¯ ùŽ—]l±½×L`xé +ÍSƒ«ƒ ð^-xíŽÂ¢áÇH“ÍÝ°Ä£jŠ‰Óç:êú¸5†¾ˆ'¤ÏºLózA 7UèM¯Ñ¡øÚ> ?~pÕ­*ÿ£ÔA~tâ¶ÍÁ=Ë# w~äó·íþñäfšƒ*w:´É†(Ð)õš~y¦ÛSÏyñ¤Ýeóýö™0—ï6QL2v¹ÊÚ‰“NËÿÙfÿÉz*IzÖ猻¦ƒL¶Â½¶6Ò›·ñ‡ÑÖ,™ "Hf1òÀd瘗8‹‰¼ufJQ®LÆCŒz©‘’ÅàpË¢@@¢Ü0u.È—¼ÉV”„fMÈÁ D¹7Þ“¾ïåÍÁüþ¥¨© @¤@¦ã›Æ„¦'‹ K¦E)øiñçí×ì%6î…Ë4.S©~÷ȶ”ϯx‰=U;¾?9Ô¡wii¹"F™µÂ’µ~ãó2žü0¸JÁÏPãjÒ€Œuň42UŠè{7Š„ü@^ÚÕ>ëJÜ®¶$„Ý:½­}™S†G5@@_âöCθÍ.>y‡½ðˬÀ¥`ƒ¨ü2 +CÖ³±ýFÊyHzo.þĉ78q²-}8¡œwï5aUmjËÅ–ÅÛSúç\ãfNSb:¸ò5ÍRë4›7ª9@×]]qØ?ƒiÿ‰d{¨Z°×Ho®k¼7à ¼éõlBSÔ‡›ÐCƧbrªðÉèLˆ³P:@Ÿø¹H7fgPä©# +Hw5[B£;†9 ‘ÛºÇJ3Ëž°f†ºa¹]co&»M˜17¥×£Ÿ¥ 2 ¤y4·<î‚ÈtØY2‡'ÔÚ´ÑÿÄÊh ðÙàùë¦fâ5…ÐÄ›7m;dçLxÕ¶@Õ¦Â>( tv€TçªÈ)BJ㈠+hØ AÏ JÆpˆ!cQ°|Ÿðr¶ëÇ”)4Úûu+ú“áH8|ÅÂäÐEIÆkÃÀ$c)ŠDé>|P”E³Ä¨Pì\¥¼…+aP”ÚüPP 8HÛ’GÐÁuñC‚…”aS]“×`Ø~ôËÏÖ)¦ ždx"··YêB +§[n–\(H0öt{¡ð^áx±§OmaN%±G3*Cæ)qrÂfKZgËíê^íbgoq²™*‰v§ÏÎÅóËŠÈ+\EyúÉD{sÊ ç} H¹¹Æ×*Ý”c'’Ys—¬8@·Œrx}ßI¶fžL\Aª+v¶Å”aÇÁìßXY*·}'cïç ¹Ì—Ü%ìš×Žc¹îFÍÓ¬33³<{µiwf¦©Üì.*ɘoÕf(îÜq€ÛÜ)ZðšÞº8nÓLY§TIa5£âÀ åÛ½é¸|bð W ™„z­°Ó¸ÚÜÚaíÐ…HrÙ¹ÁÉtCVš÷ ºFf_¯öźÉnHþ¥»:¹ÒÙÔûŠšRßÓáQÍÆ”„šßJ[7eŽ¦6þ`¿#fÚ»f!³»ýÊc'߶decö;ÞÃÂf•ý>öÏ lù6ÿðî¾óí»Íx§ÓxO±z]p”½ËŠÚ¾FðòÀÞLÚ¢«î݃TûÉp‘nV:x§@Ýï +$9+GÎÕÖ˦Œ Uÿ"ÃŒK{qs0I³ôf´iÖ Ò«oÆë£1F7b‡£ý€ë%ÌÃ]!øÁ€~̱‘|èØÛa¾§ŽºÿQ'm¿aA;vŸ+Vèã¦k€¬á«‚û¨ã.{eÜuà^ÉÆÉ›¶ô0c×}µîJÂPÙÞO0IŠ«Œ«ºàÛ)h£’}_N០ò¨/ÌÝ÷×@û±Nö~ ÕÄ&“ jíˆêØc}_ÞøŸ­Tendstream endobj -1198 0 obj << +1323 0 obj << /Type /Page -/Contents 1199 0 R -/Resources 1197 0 R +/Contents 1324 0 R +/Resources 1322 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1202 0 R +/Parent 1321 0 R >> endobj -1200 0 obj << -/D [1198 0 R /XYZ 85.039 781.388 null] +1325 0 obj << +/D [1323 0 R /XYZ 85.039 781.388 null] >> endobj 54 0 obj << -/D [1198 0 R /XYZ 85.039 707.104 null] +/D [1323 0 R /XYZ 85.039 761.463 null] >> endobj -1201 0 obj << -/D [1198 0 R /XYZ 85.039 674.781 null] +1326 0 obj << +/D [1323 0 R /XYZ 85.039 736.114 null] >> endobj -1197 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F20 877 0 R /F37 900 0 R /F43 1079 0 R >> +1322 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R /F14 969 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1205 0 obj << -/Length 1639 +1329 0 obj << +/Length 1795 /Filter /FlateDecode >> stream -xÚ­koÛ6ð»…P`˜ X -)R–”Ò&}¡ÅºÕë0´E [´-DW’›ûó»ãQ²+N‚Bòîxw¼·Ì-Ü -}—‰È -BîŠ0´ùˆY+À¼qCÁ,鲩¨³ÑÉ+?´8s#Y³¥&™%_ì—oÎ>Î.þ;B[¸c'B{öæ‚ŸÆÜ>ûðâ OÒ>¿€ã‹¿^Ó qÿ|š!ìÃøÛìÝèbÖíHWNÊþ>úòY ¨÷nÄ\…Ö5ì™Ë£ÈÊGÒ®/…9g£O£?:.„“Ýx¡#yäòÐrsÃPv/ÁÀKgÕV¡ž–ù+}Vdiäž°àD°±ã{¾Í§§Œú|BGöÖeš)wqºÜ‹&-‹¯ÌgÞ”ÃÂ5ëÎ."N^q¿§’ã ¢‘Ë|©éþ^ƒ!ÓÅØ ì5?­‹_Ö¹ó±ÚÛþ7øm­ÆŽ”Òž­—e•Ç íç[`ð•q„ª"àU†Ðd¥ˆ1 %œoTMçfÂÑ6ìËy¦ruÇÏŽ®˜JË ¥p1…÷ÝóÎ;€ášœö½#\ÐÑ÷™yÇ4€hÓ¡x~Ž ÚZ°SûC¼¨Ê°ÇÁ=zxÌ zù°ç’V·ðç¡' šL€¦Ä5óUô˜}Ûl›Àÿ•vÅ-‘Ö¸/3o܇ý\[÷ -}ªïÒ,-v26°­Ê9JÒ49]MˆµÀÿÈ(ˆ MÌ+TbTýÐb&ÈÞµV•Q"­iiY˜¸ÐÍöb¹.3z‘Ž:øͶ}ÑÔ3%à;íº¾Û´öÀ]§…úÑ=¾"ÐJªŠÀ0&èZʼnªŒÐ· ¯ñz)Ëo6; –I+暸5êÆÜmŒ`ˆþC}ýÎŶªZû¨ ^ŠB;Q:¡VxŠè-J;»Žu6Pß¡GA—´m}/¸Þd* ºLílòÐ5H«òMƒ,oÇ¡DËO%7y7µ· &ðoV.‰AÓéd:;;‡ú7»`*)ÿup@Í F¨ãÜìâ®^ylª”ŒôcôY¿mt1Ñ  ìÂÔɽÒíyzGeRhõC…©Ë¦>#äÙlêâ±]µÚT·«º¡-d—r¿r!‹gÝ]¾ÛývÆxçO[«EY$wå¹Å·J¯çݾ½=c}4ž„ÐI0¾&b-Ý]”ÿ·úÜ;ÖŸà£}Š©Ÿvý®áZ‹'¹Eò¾&¸‘59y_“{?æž°?¿|—›ërÓã]î÷¢-D”²’™GÀAÇ© ~BªÒÝõ.!IkDï—}«Wlø4k¬H8p7ÃrY¨–tWÉUbd–+e˜ÄtF}ÓfÀé™îW+=&ùöK}Ò53ízhÕ9äaÊšº‰óMÖÎTU™Ó®ÐsØœrê®gxÄ].;é¿Âõ‚áÑ×`Ž{±ÞY'.p)·E—å–yîðjªîe{ç1Ñ­VEr™•‹8»ÌãºQÕ%°Þ •«¢95 s»1©óËÉß²¢M¡{„F™4Ã!H'év^¨f×]».««UUn7-žŠßDûÔÀ"ÞžcQSVY9GmoQô¤“U©…óœd^ö0(ÈyŽÿ/µ<Œ¾{K*y°WVÛìÑýð`Ö mklª7U·xŒÙJÅWfÞ7C{Rbˆ]픟+Úi¤6šwîî7ý ´½{©5ÏH d†‚†Éýáˆ!ƒŠ^;¤Ýãbèál\}ØD>)"ŸMva<D?U³cáÿìþpý©:<œfƒ¹ñèÑã0HΠHN™]§yšÅØ &8œCÔoÁž_Õ -§’xžÝ H»òUÑå›}„Æí·1RbR!3 ×m[Ô•›…{m诜›þJ¹Ã ÛoVØ#!€ ë}CdíODŸu_}Ýð›:Qš&¦¾k›š‹{•ÈÅ8ï‘y°b|¾xO cßG<5ýÁˆu®ª í€×ózºÜ±6F§ÀŠ§Ý¬(÷LøïÁÏ <’®ä†œ(p}><=¶ûýéIzîTøýV~æò` ÖWð?Ìí»endstream +xÚµikÛHô»… ,È)FG +m“v[R¶»õ–¶Ù’Yr%¹IXö¿ï;FGlÙuI—kôæͼû’Ûð'ƲlŽý@X2ÆóÕÈ/açõHh S£˜=œÓÑÙ+vm+´ÃñtÑÝ£,WÉñ4þd¼üíùûéåŸSJiHkbú~`L»dÀ‡‰0ž¿{ñß\ãâ^_üõšßpïïS„½›|™¾]N[vZB@:D^¾Ž>}±Ç1ðývd[2 Æw°¶-Û«0c)Wê÷lôaôG{ï¹c>5$zƒaŠÐ +uX=ž°\O¶êq`×µ¤ë¡z„p,)œ±¯lKÙ.éGZrb*eÓ›äö|Щsq϶²á_à®g¼‹æe±O®g…Â?Ì`‡C +Õ³_Ë ãYB9Äà›|bº¾oD1"Ná§N «á­ÐKd·Ù—É¿WE¶A¼ƒ‡f%o'N`$(3¡zF–æ'œÀXò,fð›Ίƌ!ŒjŽ¿xQ:›˜ŽÏИoŠ]øùFdNQ‰ S uC’µ¾i.+Ñah¤?#~‰,‰r~EÙ´BÀ³=Wh+ÂY,ˆÖ›o¬ð +2"½æ EæªdèRk¡áQÍR>âç&‰â¤Ô´ßÔ}‘It—fH®@ëu§¼9F¸ß¹ã÷:¹¯õªà“d%ô(pY6‡räºf¼8™m–¼$!“ŠŽ–úxOÌœ!èM ML«ÞQ€ÀÊU¤ù@“o>ÛBj]4L{éj]㵓À5¬»’Uß1ˆ£`:4êèžaÅ‚Ÿuƒ4h:ǗƊ͆8D@-Û°®"›1¢>‰²—Vá*Í æì•ôzAê8´2¥mÙOòµ·@*q”aŸò!'Óä_›'ÇÅ"-«š—i‰õYH7?iÏŠnõë€R©é‡èVɼÈãmÂÔ7iÏèVV3!£õµõ¾ä £7ϵ³îªº=ÐÁOP=‚3Û?“Z`áÛö¹ZnûK£×,±æç‹M>ÇÔ€êPÂ!FQJ„r·ôh# º÷ñªþ±ãÛŠßSxˆd«Ã…§‡³¿2º¡´„£tet÷UÆ«‰p¤ññêøÒè¡¥äáÖ¦‡³¿4º^`ù>—Æßuî”n@‘ °ê¤ëkò²Y–¬š´ À»Ò­° +6¨[IAý$ N yGúžú3 +Ò8›a Ì“Š«“¼-‘±æ±ð‚eRsßqk6£RÏ ¼±È—Pg\×5^y•ÆTª$æ7D¬‘¨ÜcÂ#©×ºXãÖ‚Ê÷Š_Pq+ˆ+u¼m5ÃòBš3e9Žü~‡'-ȵƒýÙÜeö.Ûµ¯„ž,ôü–"ª¤êje”ã£Øäm¾€È¦ãø–3œœå)%Æ + ró(»^EU”×p9Ü éÓ–V™ÌÍgLóº·ƒ„Ìgø{MôÐ1÷¦f ˆà‘¾Ú¨RŠëu×d!Ð¥¾„ž­ç)N]øäMEMC™D·ŒšÖ )ž ñßé.77|‹ v$_2欷B P#Ì¥¸àQAF‚VWxä¢Á?ÅœdcÀ¢~M-r¯3[UYÇM5äOT+Ô¡b/{E—WÇyØêüÉòדÓÎɇ\ì§rv(8Nö;óOåáûA89G780NBí·*8Q{Q¥«4‹JtF‚¨‘®¹–FårÑ0õÀ€<7ý5í¯yÞ‚: ú†dp-¼o*ªÌaÛã&i*´[Úïf¨$ +*u;ñ¡5»Uƒ€†2A•sSæ:ôƒÐ˜NIh›„ñR¬Å/°3Ž 0ëÍ#™>X5[US´á;ø&aÀ½hMÜH¾bêˆôáºè¡'̺u¥—5Ì_z}…û/¯¸²~›àØ–m0Fð“á‘Y"]tþÇachr­}Íé?»ce<[âœø„œ3K»·þOiå8âOÎÇ‘yrr"óïsòÀ½58W/¯Äž­kyt–<ýR»w¿Î"ªšI¬»F«]Ö¬Ö­y-uWé/ mãÉbóA¯ŒbþÔ᫉S¼I=`7Uœ®¸éNηûʦ‹‡&Þõåà4Р˜ÎÀ4à(˃”«qP(±3õ,!ÒbŒÃ¤$L%ê“ÒFs)òW!ݨ÷ZñÞמRPigÐZ‘7¹Ÿ^æ{g;p'âþÙßžôùµ›¾¤ÈpX +šjÏw5/¤mµÍ.Ln '¹ËïÂØ…endstream endobj -1204 0 obj << +1328 0 obj << /Type /Page -/Contents 1205 0 R -/Resources 1203 0 R +/Contents 1329 0 R +/Resources 1327 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1202 0 R +/Parent 1321 0 R >> endobj -1206 0 obj << -/D [1204 0 R /XYZ 85.039 781.388 null] +1330 0 obj << +/D [1328 0 R /XYZ 85.039 781.388 null] >> endobj 58 0 obj << -/D [1204 0 R /XYZ 85.039 665.791 null] +/D [1328 0 R /XYZ 85.039 761.463 null] >> endobj -1207 0 obj << -/D [1204 0 R /XYZ 85.039 635.59 null] +1331 0 obj << +/D [1328 0 R /XYZ 85.039 736.114 null] >> endobj 62 0 obj << -/D [1204 0 R /XYZ 85.039 383.634 null] +/D [1328 0 R /XYZ 85.039 511.057 null] >> endobj -1208 0 obj << -/D [1204 0 R /XYZ 85.039 351.312 null] +1332 0 obj << +/D [1328 0 R /XYZ 85.039 478.735 null] >> endobj -1203 0 obj << -/Font << /F58 956 0 R /F37 900 0 R /F15 895 0 R /F20 877 0 R >> +1333 0 obj << +/D [1328 0 R /XYZ 85.039 79.901 null] +>> endobj +1327 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1211 0 obj << -/Length 2161 +1336 0 obj << +/Length 2029 /Filter /FlateDecode >> stream -xÚ½YëÛ6ÿî¿Â8 € Ī(R¯(°¹Ý$-ÚCÚ8-Š¦Xȶlë"K>I^g?Üÿ~ó¢$¿6i›°øÎ ‡3¿rÕ؃?5Ž×ÓÉ8Š•«ãx¼ØŽ¼ñf^Ž”Pxcãza€SÏg£/_ñXynâ%ãÙŠHfËßœ¾ºy=»ûi2ÕZ;ÚL£(vf¯îxàÍD97?<¿Ážqnï ûüíKîáܯof8öÃä÷Ùw£»Ù@ôÔ¸&Ô(û?£ß~÷ÆKPﻑçê$ í¹*IÆÛ‘ ´-ýbôfôcÇ…ç̘W]ØáÔhÏ u0žÂ7ŽM·U]Øêr¾n³í;/ð&ÓÀœ4Y¹¼/ªEZÜoÓ¦Íêû´,«}¹È¶YÙ~%TüeêkÜ'nN¡bÉ®íã.ãæø»ªjn”éÖN5BýŒ¿¸Hšë¢š£F=õ§ ¯Jn4ûy™µ—eÁ\-¦ß0Íýb‚+Rº ªúýº®ö;+éÒ¦´‚pvú þÞˆ®mæ¿8öå  Înª|8ÜÄõM4¨Ãl“±.ÁõzÕ-{í -Æ÷%ü,&Så´9ÚDkßÉ^—}Øióe¶äóÉÔ¬¨&ð9¸ÄêÌ ·Éi «m›?+QÎY¦Ë‡I:i‰,Ût‰ð¶âùv ¬F .\ å&Ûb;ûê4¤¦¾OF…|W{æR<€®À š6Žliã@¹§¼c×Ä/;e¸&ø(ÇîDZk„¦å´²ìqÇ6®ÑPU½%21…‡U<ÚÎ"sÏw¹~¤É - -þüæýϾù_'1(½‡Ý%†=Îœ:išËh›ápà°_Ôy:Ç]³¹x¦zç)-ÍÑ¢YH^Ò¦ä'ïez“¶,쀓hî¢ؙ֨“ÂgßXã-l7¹(ÞZ‰ŒøH¨¯œï'J)ççï»p;‹‘y§K' jFÎûë'©C›þÜIêÏ~’¯ë^y>²xŽ†\Ã02F-™:½ø­J23l·Îø<‡¡Ï3öH»Ìæûž]µowVÂpAžÔ‚G2Šá4ý?'ÌBšÓsC!YòÎMÀ÷œŸ¸Iœ\®8¦*r­;;û0l\mÂã“ žó¯ Á2Œœíd/«+øwHóž¾&Z»‰‰ŽD+7AÇ<íÂFËÇÄFh;È ç•ŒÿôvC/ü:’£D‰³Â£/9+!úcbÂñ:^Î±G¹\ Ab¿fºíÀ+!£ð`KƒZéUòÝ0âÕûôcŒw/E_Š.äUÓäsòêÏæ‘$“§¬9Ý"‡T>µb…­ <„Ê_CmêHóÚÅÃð%‰DÞåô&Ξs l«a”Ç!ØÎÈ©…$fœ®×{¨ã$‘²È)/ÁÜ¿Q†íàšüý„#†ç±"]»òf±öAn·bVe§íFPÇM¯áÇn/:äÍ‹ RMl¤[q÷èSÓñܾ±…$tØx°ö*cêœd5Ø ¬—D+?Ñȱ΀³À«dfÈ"%n +¨É…+nb=¨œ-§¹ÓÒ‘qÄãBþé;&œ¹t#™§ã­s÷=·ܘ¼¿]aEŠ>áùη+:õ©j‡G‡ÿ8¡LÀÕOïäÃ;×u$§EG9VØ"¯‚»Ä|P]íj*|mPhë/ ŠkÎ?¶[Ðm3öB øßŪü<•tfÐ -Ìà_Wåúþ'á¹ßáù†*›úo‡sãk[Üb“ŒƒKàe|¿/è@áÞÚÒ‡R&ë¡-Þ§kñ$Ùd)Wo’ ÞÛ•ï¼ÊÒeV[Žµ¨„ÚT"™à¼ÄÁFÞyjÕÍ.ÀÔq˜O‰8= !ŽGqàÜIJâyŽš˜Aõ„3ù -¿¡˜Vœ/NØ -Î!%ÙØt2›`»kÑ¡'±qÅL=­¼1 H”(µDöëͲ>Âvœáà鿆Õ%{{Й\úJÖƒÇw.r4ΛÌÞ’6ýíqQ‘9ù¤¡å¾”—̆㠗 ܺ»çR2‚6q©×R -ÉUE±g½x¸oÉ# ¾e%ºµÍ† ìá©t7WƒO'þ>¡R•èÄ–¾éoØéŽDüwÉøͼÎ-„ ytx¦euAæbmœ9ÊÁ±ÂdZÊŠÛ»)ñÐ"|uyþöåÍííUÌ'ˆ|­ä/ƒ•f°ZUXôÚi(*òà”‚OKT ^LT‰eq]!D›³4©µþd·OÝ`Lßõð]ïó€5–(ü5¶’»4•á žaW^HÁ0¾KÓâ²KÞKIÝs¯¶ª3aßU_ƒ«K\¥ãu­—FÁ;,ÙøÞÇËGa´²DÜ9¿àà@ÝôãU7¢D„¡‹“ÜÍ[þ -ITWû®d ì¢u̯^€’Ù¡ ¤ÉÄ..¾¿pÕ¨£ÒÅG¤Ø§k&%„:eðÈD©\d‰\–ÏxdȯÛáïÉÒ•9m+9·ÕÕ¡dlô™/¤ƒKv[Êmû"ƒí³+ó:)ª#ÓÕC‘ç;9É!ëº{J£_L"ÑàÐöÙhE+4ä¡áå{™²ûK—Ç‚Ï^lèH–rMJÅùyíµ¡êž%ÖyYÒ}eͤä¡0¥r¦4Ú¶Š…$p‹OêÈŽý°…D€ô½Þ€¨ZWa`¯óUD“Ö¶°êô?ßLÌ^Ýîè÷‚ƒØ§Y©Õ¬'ÑC²<ùü†,ÏÀRN§R-ç[™@×8lr -&±Ì/ø¡(-ûR|Ç)¸fÕú¤†¸–“|£Íeˆ”íüµÂŸÿÅÒ3{âi98UQhŽåþ)´Pbendstream +xÚ­XYã6~÷¯ð£ ÄZñÒñسәIÉŽ³‹ ɃڒŒmu$9þ÷[%úìvÐh‹G±X¿*RMøSÓÜʼn)¦Y®b“çÓå~’L×0óa¢„b.$ó€æÝbò¯S˜Mâ")¦‹ÕÈÇÅÖ™é¢ú5úçLJÿšÍ1‘‰gó,Ë£ÅÇGø4SÑÃ÷ï°g£÷Ð}÷óîáÜ/Ÿ8öýì÷Å·“ÇŠΰl] ,N~ý=™V ÷·“$6E>}v+˜ÞO@˜ØY#ýÝäÓä§ÏÙ)¯º¦ºÕi¬3h˜$Îs{•F)¥Á>.‰]bû(ØGi§6z"4ŽÏ•SÆÆÊLN—Û1É»™"v¹;Ùí—Yn¢æ8›[¥£eyÀ†‰Êy×Ìæ:‡Á¾æÑ¿fÎEe SÛò )`\EO6¿%ÊHsÅìú,ìúr9ÓYôÙ—=·^Á÷ÚÉÒv^yö‰öÇ®®¸õ²í7(ÃaÜ v+€ç +Ò‹CÙÿüá»x#ú÷w¿%.Åáô¨8ƒŸÏ—vfÚÄ6IßðóHtÇÏB„š›~¾·÷óÝݼŸƒÝ~D·‰¶ì¶Žlö^ƒAÒ$"«¢g°³íø;8;­÷ù®†XH#à'+zàn\UõÓqdÚûgè{ž\âjŒ2ì 3dˆ„4Ó0ÃCâ€þÆ™À߸êÌß[0$-’8-îbÞHBÆ×0icþEãK@¤`^nÅÕn6w.‰~¨_P§,úzf’èxXöÛæÐÝD8\‘uìIÌ}1S§¹:‘SÅš,À 3ƒœ1˜I±°ÕÓºG‹Ö÷ƒ)oHj³8³î¾0#Í•ˆõ¢Bô’0‹ Å`¡¢ÆÛ +’è¹¥¡X!U>4ÑÏÇ5/Ü×ä]¹®™ª]xŠ¢¿^x“ÀšÅдD‰g¢âégŠáFNÓ“?,ÁÝk·kÖÞzg0õ׶ªÄ2VšÄE«OÙžÎIÏstž^AÀr¦5ì#’'i´BQ*:E=Z‡lüp- ‡¶À’?|€[@r¯εëã¾N5Œì¶~½ ü[uáìç£4 +‚g½…“ªáœ®‚Z€^W`ZÀByÚA¹šWm|`¯ãoDI݆{åUÓñà±`t"Òí Ð{§J„¡¨¢¯`P%€g•w¢ Ã%D=—]Gs‚PF’êHÌ YÆP°®¹Y¡ 램þ†f ýu\v.¸¿ Ë#ÉíálgºS„RĆBº}#C@± è¯î‹2ÒÜÎjoe\˜!´a\ÐEa@Î)ã3¡¡6Rzbë¥ÝöA ‹«Kž +=:…›º¬„­Š>Rǯoe÷C#›<· ù~é8 ÜȨ¹n†`AXgt .¥%3Ú>ʇ]×ðÂQÓË:)°`»ò,YWâ:°Ì™ÏÖ¿F(HÜýs§ãu–[=ëTT2ݲ¤Ò]ž]`Gìk©rrÀ°Å’c[Ò‡TKUçBó•4èþ™~)]t5$Ak&á8€W•{J§õX0À •“ð½-"fbj웶ö‹È%tÞ|p†.üõÈ +ŽÇ<uƒ±Ý–%ÕY”ÛÔ¡%Ð:-v`@,•…õræ+éÝp «xõضõù°\ðÀL.W,ˆ%~ÆæXT~±4´ÃªšòèxÆ©=WŸ¡Ñ°`öáýû· +ïÚ…MïÂB@s¢¬ÕQ.„(õj°Ô¾šbsç.ÖþI¬€özŠ^ó€ÙióŠöSim®ä×nnꋈæyÝ ³°±Ù‰hýÛ•?>¸=¼áÀ‘æ6®[­×U€ëk:$.èðÓõe¿]r›«^9*61ü$ß³B>^Bü§ÎQüã<׳M>a嶃{+®’î¸7âÃùºó\‹é=™\»¹^$}‚mTD§QéQZªX¢myîÈpF¯'²ÊCöaÙ¹:‘¬ Ã×üeÇWmÊ'.úOPÀÒ&’Š`E ¤‡1‰ÐzS¶å²çì‘!è]&µ¡õ¡âjÙ¦…°´:Ì=Ð#—[y¢7¦¾¯<†¥2}ýÒ1Ec¯h;™á$J´"¬5tËà+£˜b’Upeâ"ADô<¿ç¥ZÁÛÃVnX-gúº.3~ðºAýt|]:Ê8ßZ`¾ªÎ/%)¿ÑT’½JI x"zžGÙ7B+)b½=èÉDî8Tm·æw¸ÜÞˆDVÉ¥š^ ëË@Õ¹’':.r*_h¸'{"QIU +¶$´$å  ÉVÈ~H‡HGŽÆFp ±»íø{$´ †(E¦žŸÌÑaÙK€Ä‹˜Ä6—fXîjy·â¼ µúñ™3)B7|©ë½À÷ÒžIb]\ב]ÿ¯ìyãÜ××Á…*ͬȂZªô\\gòØåæRÞÿcçœOendstream endobj -1210 0 obj << +1335 0 obj << /Type /Page -/Contents 1211 0 R -/Resources 1209 0 R +/Contents 1336 0 R +/Resources 1334 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1202 0 R +/Parent 1321 0 R >> endobj -1212 0 obj << -/D [1210 0 R /XYZ 85.039 781.388 null] ->> endobj -1213 0 obj << -/D [1210 0 R /XYZ 85.039 634.111 null] +1337 0 obj << +/D [1335 0 R /XYZ 85.039 781.388 null] >> endobj -1214 0 obj << -/D [1210 0 R /XYZ 85.039 611.596 null] +1338 0 obj << +/D [1335 0 R /XYZ 85.039 761.463 null] >> endobj -1215 0 obj << -/D [1210 0 R /XYZ 85.039 577.652 null] +1339 0 obj << +/D [1335 0 R /XYZ 85.039 734.228 null] >> endobj 66 0 obj << -/D [1210 0 R /XYZ 85.039 529.631 null] +/D [1335 0 R /XYZ 85.039 690.69 null] >> endobj -1216 0 obj << -/D [1210 0 R /XYZ 85.039 500.895 null] +1340 0 obj << +/D [1335 0 R /XYZ 85.039 664.681 null] >> endobj 70 0 obj << -/D [1210 0 R /XYZ 85.039 500.895 null] +/D [1335 0 R /XYZ 85.039 664.681 null] >> endobj -1217 0 obj << -/D [1210 0 R /XYZ 85.039 476.914 null] +1341 0 obj << +/D [1335 0 R /XYZ 85.039 640.699 null] >> endobj 74 0 obj << -/D [1210 0 R /XYZ 85.039 407.713 null] +/D [1335 0 R /XYZ 85.039 557.95 null] >> endobj -1218 0 obj << -/D [1210 0 R /XYZ 85.039 386.459 null] +1342 0 obj << +/D [1335 0 R /XYZ 85.039 536.695 null] >> endobj 78 0 obj << -/D [1210 0 R /XYZ 85.039 303.709 null] +/D [1335 0 R /XYZ 85.039 453.946 null] >> endobj -1219 0 obj << -/D [1210 0 R /XYZ 85.039 282.454 null] +1343 0 obj << +/D [1335 0 R /XYZ 85.039 432.691 null] >> endobj -1209 0 obj << -/Font << /F58 956 0 R /F37 900 0 R /F15 895 0 R /F20 877 0 R >> +1334 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1222 0 obj << -/Length 3244 +1346 0 obj << +/Length 3714 /Filter /FlateDecode >> stream -xÚ½ksã¶ñ»…fú!RçDóMê¾åÜsšÌ$—žÝLÚ$Ó%Hb">Nv~}÷¥KçϘÀb,û†‚‰Á$OG³Â?b€Ø4aá“»âEh‰+„¤§12åšZš€¦ÑYJ­.÷$£zÅsðîÚzGï¢ +s$(8ÃpxOœ7u«P¬‹WkñÞŸfy<}ÁÇ…}À²h-Ÿa#Ë3š¢±Ô|£g}Ž7nÿÀ)œ%‘øí¿‘â˜ÆYv;mõÁ‡9WrçXø†b&‹Kó®õû¨£4 V q€öÎÔÒ*vÌvƒ—ÓªáBƒ3°Ìêû¥mIgjÎðÄï/FÊùÛº#Ǩ¾öV5šj€¥id’áœ3TæYzIþ7v.ÁS -{‰Z¨Qu?Y?Šø-[§€Ñ‚y ë,‘ÜKU™Ñ”Åf; §|’ÃôBZy“ˆêìô ´¯>K}„xïU !›‹nXäÜS ‰uFÈÆ• -(µª++l²8ˆþœ=‰¢™‡fÙáÕcg¤#V p¤Õkœu¿A¾ÇÀ÷2ÄÈ)å±`»{3Îng! ®˜ÈÎ ‹ Õõm” `yi˜ˆlÔîA]7¦«—úº¨Z]Wªl¼•YòÌ#×$àWÓP¦"ÛÇ«‡—FÁ¹ÕU½Ü‚[Y¶À²Kd¾PгIÚX - -ð=äIâ ÷" aÈ µ"¥cªJvÒEµÆéõNÉÀØËü{ÔãbŽ’9Þ2ÛqÅ8M­=;¢ZÔH„ýÞY`C­Cœ¼æ@áq¼a¡(eC¹dl¾?2þ²¯(Qݘ -… Uq‚ív;XàCbÀèbá´LÀ…L{ÑAŸÚÊ(OYòL‚!Ç•¦ap»U‚Øtl_,ʲe},›;·jæâ'h6Ê*ÀÝŠß2ŒŒÆÐ{!ôÐq®çãJh¦)² - XCÓ—8a«–M×2S=4cÃÃ[!kb šðû@Ì×Ü!«×º®IX0.ªø{‡–8§p »$edQê¥uli’áaƒéšq\|Škcq—‚ïV×t´§{Y'ÀdîÅ^Çg"ÆY)E²Ä·ƒ¼Uxua8mÙ„"9gL’Yã}ÍŸTÃ8ËEáл²yÆ h$´®õËÓß d–‚Eà0áõFÞ~ñý‘ñ±±ý¶m÷/¯¯ËÇÚ+‹ª{ô*c­Ðß yø–¬ÂõÁŒã®E<¡ \d^$ ;j9ðqoݬ=So®÷µÞ_ST¬êUóŸÖ,½m»+GdÅ>l]"KFd]΀^u¨ÁB,æŽ(qŸ ºãX<‚"‡3â`ˆäÁ`Õ…³ FYëìnÆî*^8·¬HDžd.ñ«D¤zµ³j8fós`|çlìwÀþVŒ ôņ8›;²€¬è¾·u½ýºèAn1 6eiƒŒ`ꢦEˆòÍ V÷ô˜½•õóçÂFt€ÖØ’½(WÜíìtYô°Õ•ìºêCMèºpæ »÷9,v)2ƒ¯»AŒL "º-ꦕÙߟukãœAŸM¡îÁüŸ¯& 6Ûç——xû㬧\êÁùPU“(f(vª~²ÇÄÀK×J* 2‰¾ã‘$”0²¦l{‰ÜÇè–jŽ7ª´µƒ“õÎîä¼¥gBx5˜cѶ+}™‘Ü9gõ 'ZStƒíQrCNã w×óÿ -á!¦$åñ%°ñíÐ(ÈâØ t.Û¥! -*M|<‚ø¾wN©Ã›¬»aÂ1vEÈ+QÑ0¦‹‰ÂhÚîÅá¤+T áX a,êØ:¾Fœ¯dš*Knµæh€Äè¡Vk!Hnžek²x°0¶6+Ó2BÑgùæÝLrn€o8 -è…ÐQd1´žá@C)I¦_—Ì·ÖÜcM-¾ÁPì °ãô‰Á䕹®cÄ14©lrz“ -˜V|‚éõÍ··w”\¯t¶Üæ'dœœ¡%u¼˜ß²õ‡€£C¹¦Î/Ø¡0“!3å‹ bÄnW–D’PÖŒ½KIèD?‚|ÍÈ7Øæ³aÞ;Ë#ÈUi±Š×K&£o5‡cÖ<ëj©y‹_ýħbØÉv>–…–ïÝ‚”Ï°X“s„ÂFÙB£çv„b†vT¦ý|ý†ÓQҔܕÿ¿c˜‘1[É°õK2Ò–"D$䀓€‡ö6Úå3­¥ŠÀ5*`åEGùwRúxûÞ)ÒiŽêP4N…`Wr›5 -{CšBcq¶* DÀú6]‰ïtíÜ‹ó A`âÅÉŸ®Øq•áQ$çå™Ìÿýê—ßüÉ -¶øîÊ÷¢E>9`<é‹ÅdwyaI¯¼º»ú‡[CF>LûDª^aÀÖ´ZÙÊ ¨¬•ùMãR¹ÇÈd4ûR¹2ªYÇcË-ðM‹h^r=IWT )…lÀÍœðºgÉ.u½‡Î|GU5œx“× sȲ#±*)+ÞtjcKòHÖ©”$paád¥žŸÆ/#á—‘«r_ß¾>]?Î=žARnß¾ -^Û -ʈ~V¡X¤+¥f#54—ÙŽÞ}æYîåQÍÃÐK‚ôã/1úì—¸"Áÿ -k-þâ(€Áþú62Ôlg €ª©>Âîóé¿Œ·ñyñf”ç¦é3ÈÄÝ=QðÏ›{¦šª­ÿ…~zöÌ.q;uäqãÀ?X¶%ÆÇÙq9‘cÆa›»o !„^'bJ’—Âø Ja´HÄ°,2HÙëåÞÆ‚0À%shÀ@IA´1š‘) ¯â çôf³ ”oñ WûW¦EsèÊå„ò¸€äÂ8À© JR)0À}ÑÐrvö-dša%õ\lÛI”ø÷A²dm¹ïe‹c™9zPc±«;NíO…'ôsšOžäK -ˆ¿óJÝšýÈfÏå”JãRà!U’-Ø:rt.ƒ“™Š1òöhÚ9÷ué gn½Ð'\aúÙ¯P?îK÷2W è #[¸0`«"-7IµT‰©`ì"ï†ÇèU#˧{UïBÕ Ò±Æ¦Û.qݹ§]÷Ë B8pvJK¸ÅŠÆ͆äOÞÕx_Î$Æ隨† -úÀIg¹Jš„úŒ*r}Í> q5Ïþ’ƒB²Tƒ\)³áË_8FÆ“*-B¤\%ˆcb2E#…ÏHÊ?Yß³Ï.,RAÁ‡hÕ0“l …_¾qˆ­îhë ­çðîeA”È«-Ò%4«šl¾ºÕ=J榲•O„šJóD²êˆVd™ v)ö@Ð;Ûp™5´šFæ9’¹›7?þ µÀæãä’¢<ñr‡‡ª2Œ€@­éÈäeiÎ*Žq€±¿#@L[åãÔFÞ€’(‘çŒ-âœZžßžA*p2"äßùÖú×ÝR0¸8…-*Jv}ÚIÀþåV!ù/Z´ðýƒX²’„SZIщƒ¸xߎk¸} Ÿ=Ï™–; —¿ùIò«õ™ ­Èj~Õzc3€ÃÍÒO·#ùç\msi: -ªlî¼µÍI—j뉹˜ŠÉ¤>qÃÃ’?]‰ ^a ÅÅP˜*ï±bk÷Óü©]3=¯â/øòƒ6{??ª œ2$ / -²?-$¥#…^fÇl¶ßÿÈîÛendstream +xÚ­kÛÆñûý +ýª°x|?ü-¾úRpú®AÚ4(x"%1¦H™èÜ_ßy-¹E^á†OäììÎìì¼—öÊ‚ö*òMËWad›n­¶Çkµ‡‘ïnlÁð|×ô=ž¯ nÔè&pLË ¯âMhǦëÙˆóæñæöÞ±VŽe»zÜ­lÛ1]ÛY±gz®·zL6¼õÆ÷-ã®Zo\ËHórAh5 Ù!d‹…‡ %å)ÔEm_N³lr?p¼ýÂ@Ô~D¢ÃÉøy¤u(T72qO8RÖ‹mwÌz«ð™hüBz~j™ +Ù³š2Í•-ê ZdIø³Sâ<ó;ñl±˜p¬jyRI¡}ê *…ÎÑö #;e+&-¦§ŒvjÑA³Æ¦ÂR«h“0ÒæG!ÚÅ9|~Г¶aöCì#@‰ãWµÉ-êqàÚ r\Mî ÝØs½eM瑤–i|^³8@ÏY‘I›N~·Èå!!¹È|Ú7iÓþ@2DíGÜ‘î¢ðJ(“æã:Û¤“¬ çÃàÀi:\‚¨iEÁ€¶ dñ5¥_®lLW8iG¥T˜È6ü[V +04ªO£œG¥½ü('¹ç·«,­úˤðð<Ïø¶hªžh6˜—zº89 è<ÊÉvɽ™éF)[ ”ìûÑó²Sí tC†ß¿¹½{‡c÷ðò€p±"×¼464gˆ/Ap%Z Ùu(Rñº}êzêË·WÜ>QÙ1bÓ#:ª"þžùY8ð8µÐ”³^ê1Å|${÷-¾8lL¤ûëÈÅŠsR$ÓŽ• ~$ÞwG`“Û¾ÿå€T} »38G'š%uÑ‹@Æß÷½‰ºj §c(¥²Y¹•ÓIF³ÜaLš†óyçO·NCÕ! +*•4W[Ÿ$£,ÇJF=Ø÷ðüFž¹ï’’%¥°I›ñµÕëÝÐî(¨…5תýkV_ª/{ƒ£€+]×yœÚÛ}C|Ú4•Þ4$K¦íW³*…³Ñ®eU¾À BBžmsBÏõLÛ]&Ç(/PscÓü5rˆ®uÁ„jà›N¬Sý|óó/Ö*êßßX¦G«3&¼¦Ç«ã 䇡+oÅÍÃÍß5îx©¸ "ÓÜw¤Ù`)ãq$/¥(JR†Q™ãa_+W½U….ozNóæTô%(Úì¹å'C%þœdh V—<"¤„Rºj3TÁà€ÛN:°ÈŒÃhÕHç)—(ì2ô.Ý@Wîqd¯Š¸¾ûÖÎêž™–½ {Ò‚î 2êÌêÞ9¥{‹Ô”îiÔX÷äæÛû·ÚÔWa ÿz”µ^à2¶A÷â—÷ß{oUhÕKRUKÛûhÙOÿž4UùšCn¥æÁÕ-Tœ$ü§]6¾¿"Ü…îÿ*1©O®j‡Ç/hÆ€´ ‚„Rpg5c‰œÒŒEjJ34j)Ùá7§ÜX•+…ùÿr&Q] 9å&ÅuŸ2kÂú×Û(µ“òØL×óô=|µ‚©µ–7ëÚ±Øáh³ÄÝ?îy+ª@ZâܳÑËü1œ«µ–9÷Çt¼yÎm(Á`…HòÃ-$Ê:f8#‡8q·` }úûÃÌßý4«àVhz/¨·BYPnB¡‹îYÕž'¤{ŽRëžÎ ÔXé —CüÞ´Ü*<É¥'Õ˜tB}ººÈ¤ðļo29ÙeSåvG›øší¾´YT~ÏrµÍþ™Ë>w9unñ~¸¸HéUrç_q˜¡¸Aßš,Už2Hwœ¾A~5“j9 ÌÈŽ¦7D˜v£ZD|øåuüï¸ 0£~vÒ³œeÔæUP!!“þœ.’5\¦&Š¨SÓUÑâð>k«Ó$åpl•¯Ö%µÖ2ËŽÃaXg¹¨TËbÄ2_OVê£ñPiK/z’2bŸéJˆž»Õ›S„ 0Cß}A¤E$Üg0«Kä”",RSŠ QËžOE_æhWô•ÄNìoÁäéØò0•ùI]U¯¯  »%ÿâ¡$õ_"~¡ÕWA°jþú¸Öðøù@%\¿/ò·)jþ©S©òe;©”Û='éÛ=ùdÈæ IG°øåÚÅÕèfG­DºõžúFA.Òj95ê·³ºðGJ¦jå.”ÈøBiÀ™?ÁAÙÄsÇ°DKŽa‘”ƒFJë8®|;E¾ ßæü¥¥ƒú½-:º$ÅwOn5áá%)}/é „m¯ÀŽ/ E ðŽ_Gc›ËE®Ì×ï[SW*ë+ŽÒé}OÚ¹o ¨[Ôwªª“¾í?úPö¬Vç¯Ìó¹îå÷œ×?ãv-ìÛjÇ6û1wyÅZéú,F-îð’žïFpÂî<Áÿõ-pendstream endobj -1221 0 obj << +1345 0 obj << /Type /Page -/Contents 1222 0 R -/Resources 1220 0 R +/Contents 1346 0 R +/Resources 1344 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1202 0 R -/Annots [ 1225 0 R 1226 0 R ] +/Parent 1321 0 R +/Annots [ 1348 0 R 1349 0 R ] >> endobj -1225 0 obj << +1348 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [94.952 477.953 394.76 489.945] +/Rect [122.225 464.403 422.032 476.396] /Subtype/Link/A<> >> endobj -1226 0 obj << +1349 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [94.952 464.403 337.488 476.396] +/Rect [122.225 450.854 364.76 462.847] /Subtype/Link/A<> >> endobj -1223 0 obj << -/D [1221 0 R /XYZ 85.039 781.388 null] +1347 0 obj << +/D [1345 0 R /XYZ 85.039 781.388 null] >> endobj 82 0 obj << -/D [1221 0 R /XYZ 85.039 761.463 null] +/D [1345 0 R /XYZ 85.039 761.463 null] >> endobj -1224 0 obj << -/D [1221 0 R /XYZ 85.039 667.044 null] +1007 0 obj << +/D [1345 0 R /XYZ 85.039 667.044 null] >> endobj -1227 0 obj << -/D [1221 0 R /XYZ 85.039 309.189 null] +1350 0 obj << +/D [1345 0 R /XYZ 85.039 286.574 null] >> endobj -1228 0 obj << -/D [1221 0 R /XYZ 85.039 273.125 null] +1351 0 obj << +/D [1345 0 R /XYZ 85.039 259.476 null] >> endobj -1229 0 obj << -/D [1221 0 R /XYZ 85.039 250.609 null] +1352 0 obj << +/D [1345 0 R /XYZ 85.039 245.927 null] >> endobj -1230 0 obj << -/D [1221 0 R /XYZ 85.039 216.666 null] +1353 0 obj << +/D [1345 0 R /XYZ 85.039 220.95 null] >> endobj -1231 0 obj << -/D [1221 0 R /XYZ 85.039 180.601 null] +1354 0 obj << +/D [1345 0 R /XYZ 85.039 193.851 null] >> endobj -1232 0 obj << -/D [1221 0 R /XYZ 85.039 155.964 null] +1355 0 obj << +/D [1345 0 R /XYZ 85.039 178.181 null] >> endobj -1233 0 obj << -/D [1221 0 R /XYZ 85.039 119.293 null] +1356 0 obj << +/D [1345 0 R /XYZ 85.039 150.476 null] >> endobj -1234 0 obj << -/D [1221 0 R /XYZ 85.039 70.285 null] +1357 0 obj << +/D [1345 0 R /XYZ 85.039 110.435 null] >> endobj -1220 0 obj << -/Font << /F20 877 0 R /F15 895 0 R /F37 900 0 R >> +1358 0 obj << +/D [1345 0 R /XYZ 85.039 96.279 null] +>> endobj +1344 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1237 0 obj << -/Length 3357 +1361 0 obj << +/Length 3686 /Filter /FlateDecode >> stream -xÚ½ZKsÛ8¾ûW¸æ*‰’àso‰“Ízv’Ì®ÚÃÌ`’’X¡H IãýõÛ/€ÔÃÎVl¥\.‘@úùuþ¹þy¹žÊΓÔwUšžçë3ï| =ïÏ|¡ðÎC׋#ìzs}öêïQzî{næeç× "¹.~s.þñú×ëwÿžÍ•RNèÎæI’:ŸÞ^~|ÏmW3ßùüþý;ø¹º¾üôñjöÇõÏgï®'Ÿ™‡n+üΟg¿ýá°”ŸÏJ%#6 +³Ÿ5êNè´vÎ’•ih¹Ùƒ¼(Ì€Þ]1EWê¾mþ6›‡aÈCi’žxi†²Éïö…{qƒD~ÄFí÷…™¸i’}K˜Ð²?5ì1 ŸD?T’~Àk•›= ¨Ü3”]ƒÏÊYl-óP…ª¶é™èw/ò†U)CtÇ,TYähÜÐ.‰£V·@ôXðÔF¤8þ§µþ‚¯%¿nº¿Öþį jè#©a'ô@뢜aþ@ùY©Ý#Æþ´òóŸ\~ÛÙロ4¨±•Fù1oG/DпֹayÛsÓ-6XÃ(¨Ù ô`‚_È–Üwõá EI÷¥1ßØâP¶¸ w†óR»n -~yYÑ#ÏuÝ»EK¦N‹#Áõž¬…Ù´[eù—èïíßÚ¦dcÞÁ¢›Á†K^EY?,âðûE<¹ˆ?¶h" -œÜç¦Ê‘]©#ÞI¡w\£´ê*׃X"P¶ þÍq»+²DæÃÀí+Œ-j+]òÙS™FVd宬R'G9A<Žü€bðt̆¼ø{U ÑSI {8+’ñ@,=së9¯ƒ÷7YSÏʾ·.ÜÙZêð< !ø1«rD=l!*°¾8Ì:Ý ZªbN‰þÈEßZt?tQÉxЛL\5úM—½ig”a(/­i š´î¿DG“ìo2SÌÐ$7òámÕ“›âÛ1Z‚ëaÕo×âmÞ¯êªÀÐ65y$ê<Æ›ãÍ°§Uà^7E¼‰¿Ÿ7á“óæz–FÂÝF!ÇeøÕCh+me 2Ýòè~"~~Õn¹!§¥×ìµÊ®g*tR ŠQù¨€Ø1¬´ŒìJƒL¶„X ©  ¡™òvÅ8 $ŠÝ­]eÙÝv„{ ¶¥•ágȉ G"ÑÁB%ŠÝ#ó ŠÐ dDzŒPÜÊ ˜SB8= -Ý7u¹îO¼¢£Z¡²ûÕ"ú֜ﬓÀ­¢lT9y»¡­³—+†ÔƒäíÀ”¢6´i;Œ\dG±z I0…±HqC±ª$ž¤„Ëò™LÜèµÌL -k¿@fX˜.Ö,˜c%-M#_œh;tР¡‡¾s‰q8K–lù¥¨ -~à½âsÆ£øÑ$+¡ç9»ñÞw`¿¡9Shœí±—f %Ã'*™>'µƒ»Aýð®|½VÜ?ý¸Õ_CÖ. QyÄ®À`ÚÍ -ûþWþ‹E÷¨ò{›qïUä0scÿŠ?½"_¸ª(Æ­l{½¯ML¦·¸ùרf k!<í¯ÀOÝTÅ?l¼ùåÓ¼‹V\—Í’d HƒôecRlð…•¤ôSaI*f|á¼ ø­)ÔGG][oü®¾©(Æ‹ûÚ²ÒUiðø –<½”ÉMŒÆ…AÕõ¯cJôS‚â¦A’á9°Œ<¹žzøºšÎ~Sq±ásÔ@Ëd›JÓÈ»“!…ôé™<¨ NLsv4X -”õBø|õúÃÁ -<åzaöxSú&~²º¸Àµ}Âr#>|¼æ…<ÞZÉ÷‹+¦LÜD(.²Vë@Šc)êN¦™”¾àu,}ÁL:·˜cÌ3@#+ÍôëSoöÙdÊU‘ÿ<β\×Epf‹/A@”ÑNˆ°ÉΫ† *›);ðäiFËãÈ 'P³7IÎA)M—GY¸¸<ðÿ/ÙÀÙh‡oYkya–<>çÉNi­*6…’‹C·øg£ûž+ƈuºB°ÒÔ¨šˆ#–šà~/“›Àgœ¦¸!\ú_Ólš¸Ú3ÁdÞ,¨^ ŒÖúå …®òDÒ[¹Å!7¨¼eT+ƬbÎv¢¢ÄÒt·^]v —Ûºdæ@¾–,JäË%†àÕø†`•†nû®hÞ‰Bpw7-Ë«]¡cTî)’Õb š°©„ßaer­-Ïó e/|#`gq” „\qZ«–o³ïjû¾‚lìTq7🞳Ÿûr’duk]s^sÁ?y»æ,–™Úsë+þÁºZ¬€5âËtÁ ‚à÷âÅ‹g‘iZ„ÙÖŠ+t®‘Š×¨´Ä劇ŒöM+õ3ü?Ì?àËtÂ#¾6È0§ Ò@0ÙZÓ+Vù¹™3wiÄ}à/¦6Ô{‘eÜ2ÂÚ¦ FòL:ڵзu1ê - äŠÕå[iº`ZY醲|ªm`+2•·ña -Ž6÷T ªád‰TœÒ¾Ss¡HÎ"Èö©k›bóv*O-Frf„¯1ϼäçãGSÐÁ–Å+ßæö£C„¹0UÑ5Õz*®I%£êçK­9Ç ~Sf?ž›t·|ɘÇÎÏ´-ïøœ¨+[§MØÖ7YDˆGGXÈ´¶Ô­|IQî&SIšÇ'zdðР„âò¤„qÚâK­ß’-Žõ]å|ÐÝ&Alo6Ä\ÃVdÑ7µ5—:~…¼ë3¸Ñ’øÜ’‘+‚ŽçÏ'-?KÅ#Hwñ5MNQ \õà—M%èÀœܾåÒÓ /áç-e¿Þ-Ëæ%/Q þV4;êJ%-ö|ütf©žÞ,ÿYŠ“aDAµ.Ж F›Qc -ºëˆ%·¤™sÍÛ‡l¯Ú*VŒÕªñ!rê·¾óŠ쮢|¹.e`Ÿó¨ÛUÙìöQ«X%#Ïêfdûžþ!9.?ñÙÏ6ÏD¯«¶º-¤®?ÓnySýFç%· -¨Q¥·CY`‹”óΞœRôÊœõ¤ ¸•[8~ßÎßÆ‚¹ÐéÉ4„™+Û´0P¶-×ÜXµeÅà–9€'øÆÉ6º¶G -RIF2’ñó XíT%’¢ÃfÕŸNÉÃ! Ð3uÖAÌT<‰ÅrbÕ3éÀa9ôÔÄ[”i!(E†@TÆ"¨»|ËëàÑŽ¡Óõ›<,ú@j­lÚb°C þîÖNqÚªok=àeì¯dxö}䢞,A¥iˆgÆ"B/š”ÏqbŽM@a¿æL¸p^5_¼¨ìª‘–¼Ëa<>¶‡ÄÓ–­KÆ‘ é-ºÄþ–O]xyGvŽÏu;ôösoÁUÑ%¤$âè@@0 Ù¨¤Ø'd¦|‡Ý‹N/+{Ñ A_³‘"˜@ -Q ¸Ö‚ 8³åþÓt”Aä\"‚Ö…L7^3ª–2HËoÅ°F» ߃߲ߟdEGî<‰/5·´À‹Ø#f„RUcŽß°kꔡ!µ±· -â“GÄa8…Ųü­µâHpB$<æ<Ñ~”|³žRˆo -ÌøùJ6d5Òœ€€b²g;“×,ºaôõèñŒg3(dTj¼A7ŒÊ> P„—•î¤fi¥çô­´÷ŒÊº—'S¯`E£ ¯W© <•ÉúHÙÌÅHÿ&…³Ê”ÑÕŽüØ…´Ô.r#/1SBšŒ§‚Ë¥âYÀ¤é±ËÜÞMÇïÚ÷÷ˆ¥48~è;ì53TDI“Ñò1ÒÈè®åB9¦\Ë~Ùñ–õ†›é®iŠ—Ä -[ŸÜüœ‹êOŽdmæ•%N‡q˜÷ñ¦+Õ-Ñ>`Å…†rÎL®°bÃáIæ"·iàê·Ãõ2Èr§üº¯+ø^_/}§ U¿Èö|…ŽZ´y<`{=T„©‡ÎÜs~õbox‚o‚EÇP{»¥ñFvÅPnxuäjâ7;,>_͇®}ׂo]Eëá¡EîS€% Çœ6¹GÂíк¸"Xšj9"[ômó·ëeE¼sµŸðRc(›õË™`DÊiº‘—\ЄÈ¢ DšàÏj‚žÒ+9¥ ¹C¼ˆýÈ)› ìº*ü ¾x”]±V²o{îz~*ì€<ÛásÕl¹-÷Ã÷ŒJAÌ,á +_´RµˆySv &š\ Ê ·+–nÙ-MùÆ´ò¦¨•˜\\z‹*â¬í‚n@ȹ”_D­xg/øÕ6%Ï<(ÄeÏïeõœ.$yâ†^j×h^éB0§ Vz¢ vr¢ &¹-J$7üsS­™Ÿé©v†(F³ÓÜiñ7…± užÈÞ™{Ï}b‘Ò|Tì#­ ö+JÔ¹Â!½{%X™ºGyÕg²‰½¶xÄ+û‚ƒŸ>– +—©±»Y|ÌÔW¤¹Ë0ÁããÈ?`q ]¬¿:“sºy˜,’,pÓ8ûS‹W¸–² ÈR7€¦âÅ“±ÈJCgÝ’”Žmg8]{‡©ý5kW¸ìkb`¸Ÿ­½º +õnË&üMòV¤Á£ƒ–±k˜rïG¥Äs&¤Åÿ­`Î!$9qÓîF ‹C rá¬C°ÑSÁJN9ƒÜ&·úÃN¼ä[ân]òÒxÛÔäIgï‘ÝL±ÓNÁÀG•šãf»É…“v„±ð’aˆ•Ñ,+-Ä'm´#GZ×YètÈ™8pöia Õ;o« Ì„œ%tVÍM{ K£Ï=¹ØbÇ>VÛaÏHѳ²²ÑPdV ü¡å3 â®aÌ‚(øã‡qNÅŽ{qéÐfiMÊÏ]5¨S“Ìo¯ /vLUÇ~½:°aM%«-št&vî0 !×SP¨‚xû¡XU¨k«R(ÁÈ»v…ç@I|égU)ÈÜ8ñ/èÒdQ&"mŠgµÉFO©“•œÒ'ƒÜ[í¼HzÈ/–(vO!tWmŸÈwáÅ=ÕºdÆlq<©#4ì_Àï9Áï÷d¬%Ð: V^¡Æp8ÿ­`nHÄ¡—hM×T8¢`Ñ€häyìþ„`4"Ð|+:$AÁtèˆñ@^ú‘9ˆ;àG@3©Á! “jrs`üø­Éwpïyìg8ã˜Ù0s´&­ä—££† {.¿VýÔ6Ÿ«Aœ§J›Èw–œ|ˆ[}<‡¸ã´«‚‡ÞýC?ÒôA}¼/wÎb8õsÿB:kÍ›ƒ"sHæÌÁJOÌÁNNÌÁ$w×6}) +¤Ô¨‘a.¼ƒ®7È­[ôÂäŠoÏ"–‚’ðhuð‚!G9¬}¬@aÔIÌñ4èåëã½r” éŸ(.¬7ü¹R.™%‡Û¹—»ÙI2ú¥’³„ÝÊfu&å4‡bC7õÿ\6­p- dúÂ2ÓDSÄenËÁu] qÇ°QŒÔêùØ[g¥±›£zýP¸ìbH¥ 57À‚€MÀOöa”T{•“NDÄýš^‚‘×ìSØO ÿ¯ƒ@óN² b²8"‘Ï:=å ¬ä”ƒ0È"©@•ôó™» +þÙkoÜ?ãhÛaÅ9Å©´Ç]T÷ÆIÛ¢Ò!¶àVƘÈôýf\@HEýŒ‚ dî¥g€±‚¨&—S+¡ìDYå’› Ýø‰©¬9öÙ«úSD5µa6ŽÂ <æ%Ý,Ê+@¤½³w8VzJ}­ä”þä´‰|Ÿ¼þJ囹N9˜²çJ6«,Û·?½—N#Qá2x½Hç'ÒêCU ˯(‡šUº(¤>•S·\Vç +0Á#…‹B_«3¶uâÕ4-ŠcVH4Îdî¨S¯Êší¡–Õ‡þ:ãÇA…ˤÀˆVo4¤ú_RãGÏ^±\Wè&hU-ߤŽÅWìžžoT +=ÂóOþPtŸ±±qO`òyÃ?¯^Éh˘Çú­¤|¬ªÂ…‹XñÞ§DÈw…ä ˆœ7‡=ÿ®Œºíªÿ}Ñ…ÄFüw S5F ¬»ÇšG}±Àf‘›¤Ò`hÞªYõìEŒ•žXµœXµI¸2ºoE#c¿ âRE_•ùA_Cî·#¾>c\ÿÃS%·µì‰‹Æü,>w³Go;ú.€tUÁJÖ YÖ¡o¨ L\]´“Ñ‹y÷|ÍÁh±>•fÎ0™)ÙcŒõgradÎÚ#ø¨ö„Ï“‚3šb±–¹B¢®ºVŒ–"TÞr€Êwˆj7VKui¸3ÓML© ó2”ô•ÕtW5ÕQô}´ôõáÕX¼ëÌ2o OnðÊWY×b%_ô›”JYûXE2/z°<%(ÏEg³“‹²AÈb'Dv2{Ëf¥§ìÄJNÙ‰AŽÂ· Œ'«k®n´ú±¦kÀ1<(ñ—•²5œð™B +Ùs]n¶%é›ËÃÀß”]vƒ~ A±¬8Á,{^ +±` ]õmMï¡Îõ ½ ä{œF!x*‰’‘mQ¨†é|h(=†‰ÇF„=…`™]?Àì«r-èhÝixòú«Ðù 3ÓPŸ4“ó.lndõxàdŸÅºk{uW§NÝR`gl$ÐñÄZ?Ñ¡%ÿoäKÎôèGÀt•†»b[飜$$“çü ( ÓˆÆçfH0p~ϲŒýÄyßH¦àâ|›²¯¶ ì)]Ãçló‰´äJWîg†9:ã1 +è¹K^k FЅݧ¶A*ÂCæA¸[þÕNm¯Ií$s9wü:2R·Ùx^¯‘@6ý£0+Z¤Ë [ò¼ŸÑoŠ™È™ªRåÆŒ%ÒVº¡P±"Üv ª’ ’¶š«v>ª+²aÖkiâÙ…œÁš÷š +ˆ¼æìm²•žxM;9ñš&9`2ò¢Î(Ë$ÂÓÛ'QÕò²#Â÷œÊ÷q^…]Ï*VÄÊè§[úšñjw€ã]Âé¤F¸P´+é1–u/-Jg¤Øl¸¡;š™zWT¦Á†¹º#FyÚ|Éu&1ß$C?ÝçÂï3CS}>Çúzı&¹4¢ÝJäé芗Là`‹ì §ÝJdFþ²ìÍÔ×J=ÌiZ åܧâ¤>p¸RõOÜ +w‰‡™¾” ÿ°ÝÊ¥3»ƒžû'^èp§&V£?xá¤`÷ûšï÷ ´’6ÊÀJ= +1²lW 3r')âÛ©$4_ê½ºË Í>=&ñÍAWnúU³z ¦^Á”_µ†ª%t„Ÿ%Ï™X,±¨ÌiS>óŒ£Sœ²8|!á£`ÝËN©ƒQsI5> Eéð‹ù2»ÏAßëÍã‡Îìh%’ÅãA]PžlËwôˬPrªH–Ïi(>©îucµD!AõTOztåðäU0urÑ öYnÜ™×ú¡ç“•Søcþ©‡üú¿#D¡›…3å×8H!µŠd-|­yöz4ÌèÅçÙzÿÑ.P*endstream endobj -1236 0 obj << +1360 0 obj << /Type /Page -/Contents 1237 0 R -/Resources 1235 0 R +/Contents 1361 0 R +/Resources 1359 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1202 0 R ->> endobj -1238 0 obj << -/D [1236 0 R /XYZ 85.039 781.388 null] +/Parent 1321 0 R >> endobj -1239 0 obj << -/D [1236 0 R /XYZ 85.039 761.463 null] +1362 0 obj << +/D [1360 0 R /XYZ 85.039 781.388 null] >> endobj -1240 0 obj << -/D [1236 0 R /XYZ 85.039 730.35 null] +1363 0 obj << +/D [1360 0 R /XYZ 85.039 761.463 null] >> endobj -1241 0 obj << -/D [1236 0 R /XYZ 85.039 694.286 null] +1364 0 obj << +/D [1360 0 R /XYZ 85.039 734.228 null] >> endobj -1242 0 obj << -/D [1236 0 R /XYZ 85.039 658.221 null] +1365 0 obj << +/D [1360 0 R /XYZ 85.039 707.129 null] >> endobj -1243 0 obj << -/D [1236 0 R /XYZ 85.039 622.156 null] +1366 0 obj << +/D [1360 0 R /XYZ 85.039 680.637 null] >> endobj -1244 0 obj << -/D [1236 0 R /XYZ 85.039 599.641 null] +1367 0 obj << +/D [1360 0 R /XYZ 85.039 667.088 null] >> endobj -1245 0 obj << -/D [1236 0 R /XYZ 85.039 562.97 null] +1368 0 obj << +/D [1360 0 R /XYZ 85.039 639.383 null] >> endobj -1246 0 obj << -/D [1236 0 R /XYZ 85.039 516.083 null] +1369 0 obj << +/D [1360 0 R /XYZ 85.039 601.463 null] >> endobj -1247 0 obj << -/D [1236 0 R /XYZ 85.039 491.446 null] +1370 0 obj << +/D [1360 0 R /XYZ 85.039 572.243 null] >> endobj -1248 0 obj << -/D [1236 0 R /XYZ 85.039 468.931 null] +1371 0 obj << +/D [1360 0 R /XYZ 85.039 558.694 null] >> endobj -1249 0 obj << -/D [1236 0 R /XYZ 85.039 432.26 null] +1372 0 obj << +/D [1360 0 R /XYZ 85.039 530.99 null] >> endobj -1250 0 obj << -/D [1236 0 R /XYZ 85.039 396.801 null] +1373 0 obj << +/D [1360 0 R /XYZ 85.039 504.497 null] >> endobj -1251 0 obj << -/D [1236 0 R /XYZ 85.039 374.286 null] +1374 0 obj << +/D [1360 0 R /XYZ 85.039 490.948 null] >> endobj -1252 0 obj << -/D [1236 0 R /XYZ 85.039 326.793 null] +1375 0 obj << +/D [1360 0 R /XYZ 85.039 450.3 null] >> endobj -1253 0 obj << -/D [1236 0 R /XYZ 85.039 274.452 null] +1376 0 obj << +/D [1360 0 R /XYZ 85.039 396.104 null] >> endobj -1254 0 obj << -/D [1236 0 R /XYZ 85.039 225.444 null] +1377 0 obj << +/D [1360 0 R /XYZ 85.039 355.456 null] >> endobj -1255 0 obj << -/D [1236 0 R /XYZ 85.039 148.731 null] +1378 0 obj << +/D [1360 0 R /XYZ 85.039 287.71 null] >> endobj -1235 0 obj << -/Font << /F58 956 0 R /F15 895 0 R >> +1359 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1258 0 obj << -/Length 3217 +1381 0 obj << +/Length 3651 /Filter /FlateDecode >> stream -xÚ½ZYsÛ8~÷¯pÍ51ÄÅcßv2“ÝLÍQ»v¶fæ–h‰ŠÔTÿûí)‘²“Øq¥*&€ÐhôñuCâ2‚â25a¤²Ë$¡JÓËÕî"ºÜÀÈ¿.„¥ÐF…Fkøž\ºÑe,ÃH's4ÑåRê0‹hð‡ë‹×oet)£0ŽÕåõ-]¯ÿÌbiL\å»›|±Tq¼«û¢],EPçÕBÝâ¯ëŸ/~ºžÝ@†I’Ù]$a¦Ôxw¡C¥ã£ÝCÁû¿¶¸i¾P"hóñ â$ø7õÖ몒zã¸s&é9&¤M<0!Ì¥ˆ@(Ù˜‰ëmÙ-–25pVØ«Xáÿ=n×ÔÜ¿.hdÕ–7Б¶ìœÕ:¶y ä9ÏD·Õznlá@R•5ü¿Á¾8 ñ0È×¹ÁU^AWf‚¼³T»=N¤=wE½)l5O=]% ð&±©Âˆ—ÈqSKžóÜî#R(R'–¥@ÅÊH.ï`U•eA¿…ítÈGN§êyd´Žoq|ÍCvi mï¹'_/‘ A6@j4ƒ…‡ÓÚ‘ðÚ Ï/<–_¸XÆZWðMÓò~!¬Tð"œx˜{ìiÚüПœiÅü¬Y -Ë1Ü ')P%e@wp€åvÄdÛÈN`L«¼ª:&»Û–+¤ÜrsÕм‘`<ÏÈj,‚=iQ_®UÞrK»Ëzc×í›×·t¦oùãïиr›Øãìó +-ˆÊ¨”œå‚ðÛæ¦r’ÚÑÙ££S£IèHƒ $^h(”Z[p?I%·DuÃã܉wzÏÍ­XTÎ~©]Úþœç“bµdrt(OÒŒ ì{&/YÜôY3ѺéõÒéØÚ–ßXÆ»ì©üt2+±¢ Ç"1#7¡Œª±Š8]Ãý97ëtM‚Ž‘zäV!‘ÅWG bO¿EÓbmYœ¬»jöDoiïÊ~ËNnNa ê[Žeõ(¯~KZÚs·5¨ŠõÊí¼-faSÔE ‘`©”•SÞ¬XSWœÆa”ÉsÁ„©Éáz[°ÿ¯‹;þ¸…C'̧àS5õƒá –7ò1çû(Ðaw©w|Tãý™`±c2Rñ¦ýÐq“$øÁš4v½”4çs±J‡B‹9Èa>Çûó슉ÔÓP§f&˜P›GWœ‹d싿瞉ói@þ·sò_Ü‹ŽxÁ¸3oíèw¨y5ÒúŽ{:ÐrräÎEi•yë'+P˜9Tä!–HqƒvßÓå°m­ ŽàW€ñ©n÷Î)ÂÅŽïcêÁºø3º›<ôÞ C÷ü=^Åõ“3—aMšÝÇÍV‰ø›¥ýÛy†ì‘pÛÛÉ•ƒ› -e¢.ÁjÃø Ê$Ÿ]™z…$÷,"SP™ m¯:õ¦*x勺An/‹Î *?™.·íDŽ$GšõŠ}þs}º=Rnp|Î=Þ<ÞC Ño|”Cg5aªPëæù•b=U—Û¦ªÁ¤; ‘hߒχ¥À½g݉JC•ÌúÛ4L§ÇlÿÏȈÓe³0Î’'èéðÁ;N>­é­¥1êsV{üöþ—_¬´HRŸ(öv:ß5 -¯hw$§¼G뙆¦¼#šOJÒPjõû7s22©gŠŽŸL(-‚dySZ-…ÖªÙíáˆ7ùc— ûà(ßpÇDÕ©Ó"\Ÿµw´aÎàº>çKàž#OÏ]$qMLºèÞ4&mtWV•óîpp­ì.ûb ¹´¾“Á/Ž–©1O:ØA@H1B¡"þåY~\HpªÂÇÅîÑqF.vÖå7lôõÄk㡪óºìÄÃY½S[ËY½Ë@CÌc²š·Å(OP»»-Jf1ÈqËSËÇýàªZ‡™¯ɪ'Ý-È “äüÇ« 7Ëž'®ߢߒYâIF 4èxÁäë %Î@Ãz[–®¡+Ý°¨¦Ú7°óeôYŽaýBŽáÔvr—¨¼lF@œÄѲ,ûÊ¢ÒçÊÆš¼ªÐi£,^:§&^åi#ÊÝFÊCƒ­ÓµV[˜iKAy5Ê°o*úí"åL óŽâS¾ÛW:0“ï¯ß.S°y&,#ÔL•°W³U Àøœ‰7Íd‚‹0Ìš\¢†áÜSg¼¡w–¾µ¹H ©QEVyÿ§ –3À`ÕÜŒCáÑE{-pHÁG½?3%ê9A({yçýãýiŒåêoLRÁÒÍ&pK#WÆQ¨¹t÷uÀR=;°dG¦182>'à -FÉ>``ïn&átºF¾ -›%á@GoièBá–)t  ð(G>£CãÈ”#Õ[èÓâÔ V™¹q‹Ú×îrÛ´–'!t 9ElÓ®ˆàfY„ôUiÞyFæ§LFКÖ(ìœ&î¼.ØœÛÓ ½•2thÅ…£CUM´Í„0,æIQFÿï‹?þŠ.× |?_€ËÎÒË;øŽBû EjÏ­êâêâ?~¥8ÌDò˜r²™Znºí)7*°Qü›òqK~bEȘ³j Ž=UÕ¦²‚૧s—~wߣ»@vcƒwó©äH¾Ö9Ü;“õ ¸*Z,—bm´Q"jŽ -šÖ:»ÝЧ›ÈažöγPÔg/ì*†ÄÄ°ç+ÒZ›¡ÌêNt•€ñ0Â÷ËàÓde_!ûcþ-Ø£Ëß× =÷²s׈ÅzÍh¬$(˜ Ç¢è)Õ -ýͪRÂÉ<ÔEì*QPzŠ_県Ó8yšá˜!×~ K¯ñéFŠ‡J«P¨ì˜™h -oH.äILÆŽÞJ”ìg]´˜{Ú!WÇEÎø'‘)ÒŸ'ÍŽ<|´q2üøG3§SÏžÈ0“ÉK²ÆïKepßúÈÁ£wšŠb -ô$ññsfÇc}îKÖår*2ÁM>žÎÙacQ’â@7@" ëøY°md~§htZ0„;ônª]T µ}ô&2CýëŽ B3À 3l×s,œ¯èjaN«Zh~ÕöÍSlP~ n¤áØɹ.áá ç]ÈÖá7E WhèÉ©óm] ˆˆ…ÚRã‹·ãgæœØm£~æä…~RWH’ÞÏ•" ®•Q‘•_Üð¯‡n™ž•.’v<¼Ë[î_s?e‡‰Ì…ã—3Ø­I%ØÔ[Ó˜ÁeXŸIfÒJ—×k¼>"Éè–8ðn¹bKAi(é¸ô¯¼ÔÉ ¿Óò³ž²*nÞø×n~³˜ž¦ðc“SìÏÒà‹T1œ7öi8w¯oªkÆ»¯Üá Çë6|1lUv¥ÛòÐq%ˈ3ÏtW×ÿ‚Œ‘'¤sI˜èø›;©÷¿½{óû?±òpq^Ïñ]¹¸ý†äc ýóêÍ;º÷wÌ ßV‡voéº,›¬/™á¬ -::~Ç_7°r¿æñAuPQ–4¢´4£WglÆàã®Í]ù-õˆU:2æØ¡OA>ðW%èé4sÂTËçÀ“I(£ô³ ‰Š£ k?ΰ£³P¹„à›ò1Ä¢x(sŠ‹Á×ÅÄÑØ)Ž“¡0é ñ×à7™BƪŸ.±¯Èð—*eÏ¿¿:–Hs¿§ì‹þ/óÞvc@g“-‡qz¤¹y»~Ã@`øAE¦;éÁa¦@ì~7‚ ë,SI¿§á/Ï|ŸÁŠ`F$À $€ -Ìé[_iÞ‘Ò•7àzgõKë03/«N²xÈ«¥gakŒ™ËK êñL9Gñ,Ø^~¾lFÐqrwËŸCE”ðCíŸf­¦g =·ŽpÆà€4µÿ*‡¾¸wœUC“¢=α"Bûâ~x§ÈAFœ¡Õ!¾àB­û`Ûøý\~]ÀÏÊv³[Þ¬Ç,~´?@ãßòKþËB˜)™:i_à¤?ï¯ü“ÂGû›$t5I9@\j UGý€;_Šß¾Ÿ£ø÷Yšõ­½z&™úr¯.ÕiÙVM“žŒœ˜›ÝŽÀ&f¾x7›ÃÒj=Rdâè‚wãÇ {úW¶zt°—”ìËÄþÜe)jmž¸|Öm éôª `HùžhïÓ ¬<ν).…ŽÃ4E¡da&͸¾uZç’È÷ãµW‘N΋e9WÏÜßÿÄßÒendstream +xÚ­ËnãFòî¯r’CûÁ×Þ6“dw‚l‚ÝñI´D[ÄH¢#Rãñßo½ºÙ”(˜1 Xd³ºªººÞÝj‘ÀŸZiœ˜r‘*6E±Xïo’Å|ù盚8µž'>Fîk”é8±ù$ŒÐˆrUÆÆ*„ùþöæíO:Yè$Î2³¸½_(¥c£ô"+ml]Ün~_¦«(M“å‡jW­"“eË÷‡¾>®"µâ|B¾¯+],ûz"ÊQ!<#nªB=,i¹&Nζ<ð’ZÄöÿÕ4M„FsSšú)˜tÙoyÆdÄ2‰«¦gëàÁmE´¬Ã²yæ‘jm[`åH°#qö^ŽJdêÞ¡D!nD–1ˆË–ËëªwSd„p¿Å‘öô°mO+d—…kùøÅ)PflC¯Éòi`~€M(—§½nOC“*T;¶D}BÔ¬/2IÉ0-¡$Ó‡¼ÔcEC A#÷»êÈ4ºþÈö"4ûöí=1±ç÷~û ÌÈJæhB3«‡ºCA¶Þnqy ìï±½#•CŒI¾$[_SÕ/#ÁÀளpܤÖ ðï™I´÷üËGk<ÖÈ·J¸Ià‚Ï$_­ù›p*‚ÇÇmÚnbÝ~—QÏí‘‘Ä¡ù‚/¹lÖXŽ¤þôH*¨; Y&š¨,žÖM?‡æa‹›Þ“MWNj0B‰å¬~ˆfKò†Øu» ásBTO ìËÔ6#¹¾YŸXxàÖlÁuǶBQ“{þìMTM{ÒxàÕ¼@ì!¯øòÔ¨8)æ#Ms=Ò¤*u^H¤ÑiX!°ê'~¸?Ƚ“õî¦=\ ’é,wÌõHcKÒ™„šš%ì¥õIJ"I=³Â{dl¸+ÒÅO²/dŸÄO°SÚó÷óuxú¹Ërz!& +€&V¢Ó8‘; \‰ºØUel¬Ì<9yš)ã´HGÔЋ‚3håEÉÄáݹrvI/Û\vÛfi¤:Ö<á;6pø÷å;AIpdÄÞ°À}ëd†L5KÂI.¨o¢;rg}=…#4Át1dËÿœñË~Šlk ç'b›úDÙÃ(ÌX$þóÈBý*¿ˆ]Š 6µüŽÁÚGò ­0á˜é¼ôâu{¸Çß«ºfó¸(ËtmšÑ5Bq髺6GÎéÚ,5§kµ –ÕèM} ÁÇyäLtŒTo'P¸_‚Ý@°éT†¸­Ä—ûVFOˆ÷ÉÓðZôãNAÛp’iÕA‚è@Š”I’Ðúà©{æÒ©ÞeXhÄÉœœ Õ¢R›•‹z>é…ÑCª]¨°÷-ú©¥“OÎ)ž ¤£ ×W<—ÛUÄ*ˆéíe˜(šØ_ ¡p@äKþHRuA2-H¡æ(2È 33b zGÑÖKùx€uˉ|ŧ—¿~üåÙ ò—ñÔ24†_÷¤‡î5I&6.ró‚$ )I‚…èÜcÂ…ÝÍIrŽ¢“ä,A'É€à…$m®–¾³¹YæHCŸ4Ö—L ž;©œð e84ýtÎE-ÁæRÈ»–a¼ÛÆ—Ê‘8t=¢ð32[‚ÍšÈ:§ËœR/ü¾ÃÌÆ(ú•fXª)Sñô<1B¯ÜÃ0Ÿ¥ +®„¨厥¬·…û …Ü|^¥àdvµ[~ö‡Àç‰ÅM°–ÝÊÁ‡¡³ª¹ß_Óf“ÙXët^› )m.)ƒs@´3Ú¦~¹Î;nÑZ?¾CØÕÒÎq¡yG’ý°™ÐAc"Õ ’"¶ÏñÈ$ÂÆH»ÏØ •\þ,G0ìÒ‰‰]w5×E5‡šÏÇ ëù¸ââ•||–œäãóÔÄÀCjì&m¦7i3Ü8ÌOqmG1/ƇŠÇÏC:6,ÇvJû aHWŽ‚ׇûLKÆ)C¾‘¹PEý;l FÅÏ€€½Êªáåî„^Së²]×tuS xŽ4á0µ£ŠS”uäбg²ÎSj Nôj¯ëÊ`¯!kņã¾ZòW ›Ês@o šv@Ó’7vÄ5Ÿ0E;Iƒ(Ë&n$:M †oÂõ0¿E’¾æ ™0'@¸4{5ÌÍ‘san–šSá€Úp씀L´“´<°ç°GAÓ¾NkÃ絯V‡k~ ÚÀcZŒÖÀœã²»PY§q’¾“Œê ge9âñRaA¾CìæƒØo¤˜ðKiÛ†2lPZ>á/ÒN®í…d&Ëí«,Ûáš_·-L\žió`{”¹ƒOŠM¦ÆÙ='àé¬×AÔ+1 fßæuW ›0–"µ)<ÅÑb(P¨%d®Ð³Ó–q:äÎz8¨†3ŸDÜùsl°M‡â’/ÖÈ9) Ž»ELXìœø¨Œn‡hÁS«>@ÁÎ<œA  w¡ëñ´7²rˆ¿Î7X“P!òïïyü±¢D‹WÓ;ت¿œx^üD) ‹ ÃÜh>›Â…t<"ɯ.‡ÄŽ+T$üÉQ›Š_à¸ÓêAÎC±äªwrnI5å˸ËOþ(¼9‹euê[È`›5ÁÏ<´©¹*gž¸¢{‡YÆ9-%å@…îp +;>«©cºoã‚zxI/×€õmN Æš×w”b»d% ;f¬I^-p[ÃÂŽ‚åi9•š&K§9âæ #ì– ÐC6tqDuWuX_éÒRE£©Kˆš…O¼«t6¦–ÿ[†|'~Ù»s}]b§Â¹‘–¿b ì:Ù âw_|»rÝtÃ-O=uTû02Máö¿î6…P!XYŒå·¹[ÁÈ&ÜmZÄE‘yŠ(¿¿¾÷Û?Š³Å«]‰º(ÿ4^ߺ\Êmœe9¤ *æJùë]¬ Š\6Ï!\8rÈÜ?>¼{O*ôž™3ÆWùÐæÁO¤z:¥Ó0pÇ…tsvè-vÚ ;ª.i÷¨/woy[°¹SQ|~:V¾!Ê€#Å".(%=«JAÁ/Óf : \‹Î¾Qº‚+ +M‰7¹–žb)´ŽŸ'˜Ô 0ªP¯Â¤Ã5Ϥ†8‡Ü>d2¸â6É}ÇD ™j¢®U…&Á¦ }þ®yþ!ƒÉÙˆÿ·3y öjóòudT/ð‡ù–Ë÷2MÔÐí·"nì劸Ñ°b¥ÿMÕË°ô2%7•ÖlbãòóQØ:>œÜ=BiØÄÑÍ{tÌVУçÜ…Äà çÎñÍ_p“´f¾S ³$ eÙ·5 +ªhÀ5¡ÑY¾;uôhý|³Añ¾uísÅ@AáW`Ó¡šeÓ¨,. WØ<­;Í¢äöQ~­ž2à¸s]¾ +¯‚jžW¨§’Dψô’GH3c½Š<ªY­¡›tZžbq®1ÜHIã5C¶š> endobj -1259 0 obj << -/D [1257 0 R /XYZ 85.039 781.388 null] +1382 0 obj << +/D [1380 0 R /XYZ 85.039 781.388 null] >> endobj 86 0 obj << -/D [1257 0 R /XYZ 85.039 761.463 null] +/D [1380 0 R /XYZ 85.039 761.463 null] >> endobj -1260 0 obj << -/D [1257 0 R /XYZ 85.039 671.655 null] +1008 0 obj << +/D [1380 0 R /XYZ 85.039 672.655 null] >> endobj 90 0 obj << -/D [1257 0 R /XYZ 85.039 671.655 null] +/D [1380 0 R /XYZ 85.039 672.655 null] >> endobj -1261 0 obj << -/D [1257 0 R /XYZ 85.039 640.13 null] +1383 0 obj << +/D [1380 0 R /XYZ 85.039 641.13 null] >> endobj 94 0 obj << -/D [1257 0 R /XYZ 85.039 543.278 null] +/D [1380 0 R /XYZ 85.039 531.089 null] >> endobj -1262 0 obj << -/D [1257 0 R /XYZ 85.039 516.663 null] +1384 0 obj << +/D [1380 0 R /XYZ 85.039 504.475 null] >> endobj -1263 0 obj << -/D [1257 0 R /XYZ 85.039 494.657 null] +1385 0 obj << +/D [1380 0 R /XYZ 85.039 486.426 null] >> endobj -1264 0 obj << -/D [1257 0 R /XYZ 85.039 459.047 null] +1386 0 obj << +/D [1380 0 R /XYZ 85.039 459.327 null] >> endobj -1265 0 obj << -/D [1257 0 R /XYZ 85.039 418.185 null] +1387 0 obj << +/D [1380 0 R /XYZ 85.039 429.85 null] >> endobj -1266 0 obj << -/D [1257 0 R /XYZ 85.039 400.499 null] +1388 0 obj << +/D [1380 0 R /XYZ 85.039 415.695 null] >> endobj -1267 0 obj << -/D [1257 0 R /XYZ 85.039 370.476 null] +1389 0 obj << +/D [1380 0 R /XYZ 85.039 377.775 null] >> endobj -1268 0 obj << -/D [1257 0 R /XYZ 85.039 339.847 null] +1390 0 obj << +/D [1380 0 R /XYZ 85.039 348.555 null] >> endobj -1269 0 obj << -/D [1257 0 R /XYZ 85.039 281.905 null] +1391 0 obj << +/D [1380 0 R /XYZ 85.039 291.979 null] >> endobj -1270 0 obj << -/D [1257 0 R /XYZ 85.039 218.59 null] +1392 0 obj << +/D [1380 0 R /XYZ 85.039 224.233 null] >> endobj -1256 0 obj << -/Font << /F20 877 0 R /F15 895 0 R >> +1379 0 obj << +/Font << /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1273 0 obj << -/Length 2079 +1396 0 obj << +/Length 2305 /Filter /FlateDecode >> stream -xÚÅYIsÛF¾óW°|°ÊÄÝh°qTgâ”g"N.I ’(„%ûßÏÛ -‰Åq¹Êè~½¼å{[Sá4€áÔ?ÐÉtaC_[;]ï'Át +ÿš„²#˜F~\úf9ùç÷ÆNÃÀO‚dºÜЖåÍïÞ·?\ý²|÷ël®µöŒ?›/Ö»ž…ÞÕOß\!5òÞÿ¼|Øz?_}¸žý¹üqònÙã3ü(ÖÈè¿“ßÿ ¦7 Ë“À׉>À8ðÃ$™î'‘Ѿ‰´Ì‹Éõäßí-¼MùÔˆ:s·c®ßÚhlO¨}†NçÐŒè jž¨`ýÈ>vz¥ñ#óìË]¶Š”·Ê·Û¬FK5Lhv`ºü°•YÉß*Ûãø_-¼Õlÿg/å5~5Lå–ü0SÖk²ê€Ä‚‰&8r |‚aÈDæ]1Óº=M_„5e–)Sö)Þû™'‡'Ì~]2˃±äÍŸ¾tÉ®+š|¾â;€-aa¼5®îR"]“‹âþ|WÈî&­oÑ5í}?³0dzö)ÅM5ÏÊ wÄT¼O;aä‹Æ`sbeÂgƒ9¬›¼\FÀÍoÅÂZ½ j«:M‘õU`§sA2[<Ÿû´¯ã™WÔsffE‚±¢(ðÞ³¤·]ЬÙåMŠÝ‰C×ùÜÓ°à³o‘¤9Önxù¡5†sT¤f|'†c -äá}wœÈˆ—\”³·âðxÇߎB£<µÝÑ…Lqú DsÐ6²œZÁ .qƒ4 J†8©›ãA¨¹²Q(”È®"ñÖ Ó9·À`“ÖÍYY˜/¬¿0*Nì*éß«8ñ«Wœ”@Á‹»Ó«Uä[ðÈàK|2&~ÏÈЋ)q;0{ç0©\òhpku`‘éXþ‰'uS¡“@#Ï6RKa…òhºÍ9“áuo¾ûˆ5ì Ï]ƒ©sËÓRn¿ã2Àå+“[lËCv´Iü`‘LçJù&ü —ú~ÓyÔòMzÛ‹Ž3#S¦8%CGÞwtøM?BzŦ’…‡]æ,›Ötžñbe`üî ™9µªZƒÍCë›8ïQç¡ñm¶FP@Ž|ÅÃŽ âؘÀû‰zŠŠdEµã˜¥Á!vR:Àê]â·ºÉ*7Ò¬*—E… ¨z®×cWŠ½ZRIήg¼nýÖäÑØÖeoÃ^C˵v¹˜4Ð ¯-±àÑj“Ýð^§ W˜æ°1qyŒµc0©Ü%µcDá³®J‘ ­dáX»û³OÐÁÔyW!\FGÞ#Ý@#Lп®±“´ÜI¶îC*·êøcÆ·€¶yÌ´ŸD‹+„~‚Ì®àƒýáÛßf ¼U>`uD›‘ïæ팊‘FSÛ1æ‰}Ì Â…ñÓ^PeÍa8Ô½Ò#¦6Ä@H%”J.H¡xNã–ÍR.zÈåÉÀ‹+ŒcwŒÞŽ¸áq*çÒ~r­ó­8‘öÆMÛŒŠk?f•Ð·êeà(ç—‹cþ>8÷3±P;J)–_ -C'/›ø­ÃFšWؽNëvmú#È¥’,©™óe‡‡{ËmŸƒ"IôãP(õ"$$m^ŸÆ ²> Àñ}Z\(\Äáئ`qp9'úÄ%C" z8¬Žä_Pªž ûZYÊDR… iŒï`lÅ…BQ`z±F]öÔ»’ºyâPaÌ'°¹Ï‰X.èÐÙœ 9`mÈ)UÁ"—7 -\ÝbF<EB(;ôÒC˜õÑ7?,ðHV—.öé|®](&îZ·é {L‘ÇžÅwûÎ(¥ÕÌ÷™ªl“U.ÞÙç"IÔÚ{óŸë>þŠoÝ%{3æuÔOz]ü"¯3ìuïÁë”w…ì>P„tÎG]‘þßUòñDܸ@Ïÿ¶×UˆYµ’ðvOL¸  ïCo£ô Í]aõ6, ¯oÚHˆn¸¹d.‰‡¹äú/$“תª*‰[0qÜK¨8E$Ub[\O‚t”~ÌÁ<‚Ô“îì'\+Sÿ)´¸a Z¤§ˆ3H$¸ÒÁŠë.ÅAÌË•]2h[âæ²{1²cœåîöq;²JB6|åç‹—Äë¶_ƒxåßø$üŸŽÕS@»X½p7l%\«ýoï©_¨èu^ª×y©è䥠t[Ö•nÃǃš®ôãá8 ù¢Î›\þ…Q.?AN ²¬bäÜÓWuuª×Õ)©°jØÕñTzœ †k"à¾p»òzª_«Á>{v•³‹AÌ}…ÚkÒô’OÄ #i%õibÆaÛŸo8=¸FéédóE½ú˺¦08‰Øë‘Žéù¨}8•µœXq ªì¢+˜@^€R0qÛ°eGÒ£ãâhýz*¼Î[#¤vPãÞ^Ð’HgõN¸ %J§›´Öž¼J†”Ñ“ðãV–¿|ÙŸ¤#åÇÚ´€x±09Pö ~úý® Vfendstream +xÚ½YK“Û6¾Ï¯Pù²T•…/¡U…Œ¾›Ç»ó™ £gí)è®ø³Þ`\éhç “„ÔâºvóÞS0éuÅÉÆFת+ëÊaÀ¤êY>yßø-Öæ<ÿ@Zfru’%LÆéíô*!=^O® /k»ÌTR&,º?mq@o Ù­U³è=Yá©:±Mh ÿKhk^Ýu÷´á-L3í0‚^È$è„ÏR 2t¡+T1 —’ yÌ÷ûWZnŸ)kš—ýŸé±zt´¦Üî0ßtTå* Dº ÎJ~œb¸û»â¤íŽ¿Ç\’X›)jôhS¸¬aé.õÈhƒø#¿_VW¹’$c"Φ«[À4^Ý<š1«n“ǹê6}š«nái¹ÍH©ŠöÏÇ&’iÂs¿Ô^Ö SØ ¨ +¼ŒÐTG¢aÒWÛY›ŠîãÊ&MÚ®±åqÛÚÐЮ¨ÃæC¾-W4|ó-°||xC[+:ßÒ¸v2Ÿó¦OK”jJHØähžÄ‚ÝÖj]P1ƒ‘Œó(êy&@D¸žëñˆúlÞαEZH˜m¹Fô“)Kä4Êž ‰¸­zMÑч•pl|1ÉÝغ:B"ÌæõÙ¢¬v‚^J÷®rýæ +¿ _P=qCãÜíËÝ›[Úr[ùcä‘2êÌX@F•ÓÆxÆ©2xÿò4t¦ gþòwœ©LÊŒ˜þÄðŒ;SAÁBÜô槹N ÓçܧïÚ™@ɹ¿ùä­w&½lå­oÉ|>¶ø N_NvpžooúMA€‰i· ,^SœÅ®ýp^séüá<íóôÄm8þ”識' ‹Å´–=Ë„ï §Ÿ‹¥*ýñ<½s=\NÑ3êµXÂeo yà÷›Ì8´"ô›r~ Üöx´…Š;cÒ&ø4˜žq?Iˆ±Ä½ÐÂS6 +ÈS*0š/°ÒƘ²j ¤6\l}ݬ±!B +^’'4~ÄPê(q¾/»n_,úú¸.óŠV¨-9 4KÏT‹z;; +½âêk¯ò¿žÀ]¯w_ ±žE”¡·žÓçšnWÝäeé_zîEW +GjŠMÑø„B0U®lÈèÍ~øøëÜÈhùf ¤:ß$ŽÚ€g¤ò²Ò!H5ô=€TD÷¨úk¯«¶{´¤Q¸ +ÅŒN¦õx&à +m¬Ðü®:¦V A€ãÔUÇP5€öƒ*‹¤ ÞG|õãÀ~m±¨´N«°Õ"TÂâUTÝ¢¤]f1\²Î^|IüT—Ë®g5ü±ƒH ƒnxÒØÏ8D¢˜2'•&9ÍXÿGÊ gÓ^Ï1î¡à¥ž© ÿ 3¤+Ÿ¦+¤Ð§8×Pã€jù „ág }ÆB)ö+»ËX¸ ]G_> endobj -1274 0 obj << -/D [1272 0 R /XYZ 85.039 781.388 null] +1397 0 obj << +/D [1395 0 R /XYZ 85.039 781.388 null] >> endobj -1275 0 obj << -/D [1272 0 R /XYZ 85.039 761.463 null] +1398 0 obj << +/D [1395 0 R /XYZ 85.039 761.463 null] >> endobj -1276 0 obj << -/D [1272 0 R /XYZ 85.039 678.275 null] +1399 0 obj << +/D [1395 0 R /XYZ 85.039 680.637 null] >> endobj -1277 0 obj << -/D [1272 0 R /XYZ 85.039 653.638 null] +1400 0 obj << +/D [1395 0 R /XYZ 85.039 653.538 null] >> endobj 98 0 obj << -/D [1272 0 R /XYZ 85.039 619.166 null] +/D [1395 0 R /XYZ 85.039 623.55 null] >> endobj -1278 0 obj << -/D [1272 0 R /XYZ 85.039 589.762 null] +1401 0 obj << +/D [1395 0 R /XYZ 85.039 594.146 null] >> endobj 102 0 obj << -/D [1272 0 R /XYZ 85.039 550.188 null] +/D [1395 0 R /XYZ 85.039 552.451 null] >> endobj -1279 0 obj << -/D [1272 0 R /XYZ 85.039 526.206 null] +1402 0 obj << +/D [1395 0 R /XYZ 85.039 530.59 null] >> endobj 106 0 obj << -/D [1272 0 R /XYZ 85.039 498.26 null] +/D [1395 0 R /XYZ 85.039 502.643 null] >> endobj -1280 0 obj << -/D [1272 0 R /XYZ 85.039 476.399 null] +1403 0 obj << +/D [1395 0 R /XYZ 85.039 480.782 null] >> endobj 110 0 obj << -/D [1272 0 R /XYZ 85.039 447.846 null] +/D [1395 0 R /XYZ 85.039 452.23 null] >> endobj -1281 0 obj << -/D [1272 0 R /XYZ 85.039 426.592 null] +1404 0 obj << +/D [1395 0 R /XYZ 85.039 430.975 null] >> endobj 114 0 obj << -/D [1272 0 R /XYZ 85.039 398.645 null] +/D [1395 0 R /XYZ 85.039 403.028 null] >> endobj -1282 0 obj << -/D [1272 0 R /XYZ 85.039 376.784 null] +1405 0 obj << +/D [1395 0 R /XYZ 85.039 381.168 null] >> endobj 118 0 obj << -/D [1272 0 R /XYZ 85.039 335.288 null] +/D [1395 0 R /XYZ 85.039 339.672 null] >> endobj -1283 0 obj << -/D [1272 0 R /XYZ 85.039 313.427 null] +1406 0 obj << +/D [1395 0 R /XYZ 85.039 317.811 null] >> endobj 122 0 obj << -/D [1272 0 R /XYZ 85.039 285.481 null] +/D [1395 0 R /XYZ 85.039 278.436 null] >> endobj -1284 0 obj << -/D [1272 0 R /XYZ 85.039 263.62 null] +1407 0 obj << +/D [1395 0 R /XYZ 85.039 254.454 null] >> endobj 126 0 obj << -/D [1272 0 R /XYZ 85.039 235.067 null] +/D [1395 0 R /XYZ 85.039 215.08 null] >> endobj -1285 0 obj << -/D [1272 0 R /XYZ 85.039 213.813 null] +1408 0 obj << +/D [1395 0 R /XYZ 85.039 191.098 null] >> endobj 130 0 obj << -/D [1272 0 R /XYZ 85.039 185.866 null] ->> endobj -1286 0 obj << -/D [1272 0 R /XYZ 85.039 164.005 null] ->> endobj -134 0 obj << -/D [1272 0 R /XYZ 85.039 135.452 null] +/D [1395 0 R /XYZ 85.039 151.723 null] >> endobj -1287 0 obj << -/D [1272 0 R /XYZ 85.039 114.198 null] ->> endobj -138 0 obj << -/D [1272 0 R /XYZ 85.039 86.251 null] ->> endobj -1288 0 obj << -/D [1272 0 R /XYZ 85.039 64.39 null] +1409 0 obj << +/D [1395 0 R /XYZ 85.039 127.741 null] >> endobj -1271 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F20 877 0 R >> +1394 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1292 0 obj << -/Length 1935 +1412 0 obj << +/Length 2149 /Filter /FlateDecode >> stream -xÚÅYms7þî_ááÓ™Áât’î…~ - ”0$¥±Û/ÀtûbßÔö¥ç3ß]­to>'¡Øt˜ÁºÕêe÷yvµRøЇ|+æ‹dÅœ‰8ÎÖ¸€ž_ÜjøCÉüPa×Ëéàù¹Ï?NoŒÊtþÑ{õöìÃôõÕh,„ð£(ö&#î]¼I<¼ƒ¶Ïx’ שSRØïÕ`2ø½š…úäFõ˜3vcž°$Pý&ÑD•TF æ QM£ ,â|4VÊ÷&现ø=È&hå'_ùоÆöîæ4oÁÜË·Øþ¢W À{Ü°$Ní+b¡Vû⪌mŠ+–[ò{ k-Sjo³Å&J" ß묤Æ*Ͳ\¥cžnæð™é uf›Q{eºH è’¦Ì?ù\Ø©Œ "0’úï²r‰ov¹p³\ï ë†Úe¾¿á/#zz…Zm ëñøFÄá!Çqáã Ы‰¼n#x"芴Üè-ðžô¯DGH_t’üÆ©Ô²jAÆÎí2/Jj¢<¤ö5B[èZtqÇÄ=ܱË`Bm§4ØcÏ6-i5öøØ#–Ù¦^•ÐÇ1ºÏøã11æú° bsyȳ‚%2~¶Âb‹Áxg¸ X±Ã—D§†ØÐ}¹GîÝsñ:·¸m€™ô¸·Ò#’ ^ŒêÏmH&8a-lXB؉öÃg¶é¡ m-¼ÿN¬Òk7ZJÿg&[?®Á„¶Ó~$ý¨¥rLÐÃе0‚¦‹^ì!x)z±ïÄ ¹½(ÔvÊÄЃÇ1ô7!ÆUw&&;¡3,ï‰è¦„Ic -> 'ÆR*¯pV߸FÑ!5 ÀL˼'`]ñö·«Q,¼é““& å¸õp¶xöŘuz–){*`£v§q°¢SA(^«¤(™|¡[¨à“ïIŠÎüíÔ i$ %ZLRAO²€*&¡}yež%ÏAbõÂ…Ý¡Z½Ñ‚_2!Ã6ü6© ÖôKØPyðÿ)œ@6ÑkWäi”„4âÏ{™"BÀ™ -ƒû‰0]f[Šò÷¬Ìr›ÏçévfšÑ~¯tÛ9=0ÊvdhÂMZÇ[PÅÛZÿÛš~ÞŸ]Rƒ<¡«rð -í}Em³ ÃÊ•‰réMQb(°­ÊI@;/ÖÚleÞ¥†íJ:C,%(¿.uÖä2éÚ7l+/ý -˜ ãñ˜5š ê0~À‚E&j’˜M熶s£"ÒvzUem”' ðÂhè*&P`âðIñŒH`äóÜ2Û­S -%mA`Më•1þÜÂ[ç¶|·²ÙGä¥;_Ç éÍr(ü懒¨]3«ä«oÔQ ÐYúz•šý<#¢ûÆ"a¾f{3½Zý¥o3Ì‚Ù6£åݳMùŒÚ•pÞ'\÷ª®­.:b”ÇA‹³¥.Hñé­.ôÚoˆçºÔûÒ§Åõ§Àtý Ü -·qÈ‚HX«e'ònLNQº–åîŽdO¨ -Èq)è®\®Zš­2 ›Ù9o\ v.c§vBw Ãïâ¥- [Mû@ôr#uKƒU+‚‹Ô„F^ºÀ¾ÍzË32.ù}õYôÐ*ÍJ™ôÃH`¨AAh¤eZlÝ¢}‰Ðg*‘%ÂÔÕ¥01Njü€“]…íwu¦¾|µÊÑïwƽ/úÒ³bÊï}2Â4мw[|Ï™1“±¢aÝ)ÁEêÁo G6*æ^PáÔ¼%.!klRÃ$Ö,ÄéØY:Z¹»DúpM¥ õ lγ0™´‘”}»Æ -œ `Šÿ€ƒ£ûq~r?BB¡óä8Þ ÿ»÷Äѽg’¶Ùõ JXÍk«aŽþŠ¹ÐxŽ\xBjÞ™'¥N¹´~]Â9ªÎ»Æш)Ï¥ê]Ñ(NE]y|çÏÿçãI­ïõwùxGÿËÕñsmƒnÖÕº~Ô„«1E²¹ WË$½G’¬*ë -ó$ûSBxütJÉÎfQÝzú͸¨‘j±F²ô¢Ž¼“6olÕ“õ=#-d££»§p@áU-ŠzYE=JîñÆ(†Þ]uªc¤ÕxQÓ{1=Ê6§o/Þî«é×w‚sGÑ~e =SPÓþÝUÃ+Y¸è`a¶ŸÃ:4m¥êž¸êú^Åp–Õðÿ$ úþd{î‡ -*`û¤cŸÔðòk2éÖäóTcáhîoºLïJ~ -õu^|Ų‡¨qÂ8ÿñ0ŽÏSˆ@SÅ«ŒýlçH†2ð«éý£Ã*î5uáà˜¡|i?Ý­Üõ¹3Õ/HÕ*Ý` ™Û=k€à>Æ‚žÍU@P…n”åä>Y+‚ö3H˜”âXä ¾Ÿœxâã±~Ì`g¡SeûûÙjö÷~)Kç<ëÚ9ÆR¢Hô´/Œ©Q½/•¢Ð}!e"”L晎…ŽSr†JÀI‹ÅRë8ZÝþsQ€#>‚è—XÇ÷Ï;tÁ[è>gdÔœ°ý¥Üè y%Í„–¯Ø9èÐbÖÛ™,;OÒÀŠ"ºÇŠÏ`ÍñT?«- +²H%î—…6Q¹®¥ÐÕÐ…Y"äôXŠ¸xÅéƒN&Ï„L32¶èXYt¬,6Þ:P€ÒÛ/dß.Lž +©‹I=0.Œ1BÛËìáÂ$E¡âö °ß´3È–†G1DuGÖÒi× ´P•=©tûê5†BQçA„˜Ù\p¨²[{pq.0HÈÁÅ wÜîš+éÏ +|5‚Kß aŨLdjšT= ¬$Jd…aE^2ÉŠoŽt,èìþ;F1I,ò8™6xЙ@N¬€‚ÍrBNÅ3  9ïQÜq{’V ¸ÝÕƒ jb’\%@ Üìø`w>'”^¸ã…!ãc ˆ’K:K!ŸN{ÛÓ ÃC›X¤j”gdÂðøÉQ‰ƒžëy‹ +¸˜Ç_•"RC¾š&-Og"îà™˜ÉâBErþÎjèÑÊ®žJàN%Ø›*KCr?\€$Ç•°ñU5Hâaƒj9øp¸ÎÜÆ”ckÓ«µÀ!ZLj;×hÉ ÞüòÄ¿ùÇꇿѣ+WÑú›Tˆ§©@{:a ª ž\fœ´âëôz½«L&T6M–žN’*-D–]<ƒŒ{™s8â«…^CCÙÙcIÛÇ’q%í¨ÇŒ]º ,­þeB©ÿ62ã·‘ ‘—’¾_§Ã#9Ëå´Ó˜ÔŒœ¥Þ|æƧ'–ÃûîØÝw<¸)÷È:1lò%Õ8{×´‡’§¤‡]éJ-èß¹±mV¥¹ïÊzT’‘˜ù;·Iþ[y ¥šjmrÚÆOBHP¾/Y¾A톜µµÉ”Êãöl Æå™3¼oîn¹±mè´Íó¡bn/­ÿ-Þº[úD0D{K§Ç¦sm=·eÓÀ…ßV=éÚ\‚7ºn«ýï,…V]âÅÜÓ8Ý­o¿WÆCXÙ3Ι†0fÿ*ŸjäÅúØaôàÚ·›c÷–Û½p{Mx¸ªz°ºè,™ Ï 6eËzožÊ¶<ØÙžx[vå¥ôMPÓâäï¿ðyG7jiD’©Ñ¡í…Ê +Jf”Û)XÞ"ºZt§²­€ãR}4ÊÅ6iê¾v +náÖÄ «ôñÎøSçs»EiWZ!ÐÞ³¬k˾æ(ݺ§nW÷Jþi«a»ãÇâÒzÁ‡+Äzâã“L5VÓüåé„s²„â°€_Kº”“™yï +/> endobj -1293 0 obj << -/D [1291 0 R /XYZ 85.039 781.388 null] +1413 0 obj << +/D [1411 0 R /XYZ 85.039 781.388 null] +>> endobj +134 0 obj << +/D [1411 0 R /XYZ 85.039 761.463 null] +>> endobj +1414 0 obj << +/D [1411 0 R /XYZ 85.039 740.47 null] +>> endobj +138 0 obj << +/D [1411 0 R /XYZ 85.039 701.095 null] +>> endobj +1415 0 obj << +/D [1411 0 R /XYZ 85.039 677.113 null] >> endobj 142 0 obj << -/D [1291 0 R /XYZ 85.039 761.463 null] +/D [1411 0 R /XYZ 85.039 637.738 null] >> endobj -1294 0 obj << -/D [1291 0 R /XYZ 85.039 740.47 null] +1416 0 obj << +/D [1411 0 R /XYZ 85.039 613.757 null] >> endobj 146 0 obj << -/D [1291 0 R /XYZ 85.039 712.523 null] +/D [1411 0 R /XYZ 85.039 574.382 null] >> endobj -1295 0 obj << -/D [1291 0 R /XYZ 85.039 690.662 null] +1417 0 obj << +/D [1411 0 R /XYZ 85.039 550.4 null] >> endobj 150 0 obj << -/D [1291 0 R /XYZ 85.039 651.288 null] +/D [1411 0 R /XYZ 85.039 511.025 null] >> endobj -1296 0 obj << -/D [1291 0 R /XYZ 85.039 627.306 null] +1418 0 obj << +/D [1411 0 R /XYZ 85.039 487.043 null] >> endobj 154 0 obj << -/D [1291 0 R /XYZ 85.039 599.359 null] +/D [1411 0 R /XYZ 85.039 447.669 null] >> endobj -1297 0 obj << -/D [1291 0 R /XYZ 85.039 577.498 null] +1419 0 obj << +/D [1411 0 R /XYZ 85.039 423.687 null] >> endobj 158 0 obj << -/D [1291 0 R /XYZ 85.039 538.124 null] +/D [1411 0 R /XYZ 85.039 384.312 null] >> endobj -1298 0 obj << -/D [1291 0 R /XYZ 85.039 514.142 null] +1420 0 obj << +/D [1411 0 R /XYZ 85.039 360.33 null] >> endobj 162 0 obj << -/D [1291 0 R /XYZ 85.039 473.593 null] +/D [1411 0 R /XYZ 85.039 319.781 null] >> endobj -1299 0 obj << -/D [1291 0 R /XYZ 85.039 442.067 null] +1421 0 obj << +/D [1411 0 R /XYZ 85.039 288.256 null] >> endobj 166 0 obj << -/D [1291 0 R /XYZ 85.039 295.167 null] ->> endobj -1300 0 obj << -/D [1291 0 R /XYZ 85.039 276.295 null] ->> endobj -1301 0 obj << -/D [1291 0 R /XYZ 85.039 253.152 null] ->> endobj -1302 0 obj << -/D [1291 0 R /XYZ 85.039 230.637 null] ->> endobj -1303 0 obj << -/D [1291 0 R /XYZ 85.039 208.121 null] +/D [1411 0 R /XYZ 85.039 145.739 null] >> endobj -1304 0 obj << -/D [1291 0 R /XYZ 85.039 185.606 null] +1422 0 obj << +/D [1411 0 R /XYZ 85.039 126.867 null] >> endobj -1305 0 obj << -/D [1291 0 R /XYZ 85.039 163.09 null] +1423 0 obj << +/D [1411 0 R /XYZ 85.039 108.208 null] >> endobj -1306 0 obj << -/D [1291 0 R /XYZ 85.039 140.575 null] +1424 0 obj << +/D [1411 0 R /XYZ 85.039 94.658 null] >> endobj -1307 0 obj << -/D [1291 0 R /XYZ 85.039 118.059 null] +1425 0 obj << +/D [1411 0 R /XYZ 85.039 81.109 null] >> endobj -1308 0 obj << -/D [1291 0 R /XYZ 85.039 81.388 null] +1426 0 obj << +/D [1411 0 R /XYZ 85.039 67.56 null] >> endobj -1290 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F37 900 0 R >> +1410 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1311 0 obj << -/Length 3054 +1429 0 obj << +/Length 3696 /Filter /FlateDecode >> stream -xÚÍZYoãF~÷¯ü²`qÙÍ;ož »ë`2˜Í»Ø”D[L$ÑKR£x~ýÖÕÍæa{0/‚ £fuwõQ×WÕV‹þS‹,öƒ0_¤™òÃ,[lÁâzþ~¡dD°ˆü ‰±ëÍíÅ_ÿg øy/nïhÈíögïÛ\¿¿ýîÇå* C/ö—«4ͼKå]ÿðæ©‘wóîö; Àå½»~ûaùëí÷ßÝ:ë¬"?JB\è¿?ÿ,¶°—ï/?̳ÅÚ¯ò|q¸ˆâУP¾÷.þi¹p_´àY3ÇYE‘ö“0^¬ÂÀϲȞKÅ3çºÝ•-n¸„3äÊ+š¥mw;jÞCч²+qö·ÜÆï|W›¥N¡Eƒ—:óêÀ¯òîwHê˜ÒÕ<¹-Û«å* -"¯:J×®_»n¶ü+2«»á(XVzŠ <,W°¢Ãn@ÙØcÎ%Je±’‹X)¼ÌœnâÎ^hZW6,êõ6 Ûßà~ÿf,SË(Ìý ŽæäK€v@óY9(Ì:ó£,æic–±Å/r¼Æ3gÚ;Ydpa÷Gsw[îS ÿ®«ŽpQ(«òžÎŸ…Þõ{˜rÃmêC‰PÞëþÆñâÀ$â\{ÿYÂ@?pk†Ô§½¬ØÒY­ÛU¢N0éã2Ž½b„SÉ”sÕíxà´´-•{{ûKð¿’es¨/5 7ˆõXw,Éß4Žpf{=ïʦäf¯T­PfÏÚ´ÜYðˆ -òν® ¥I™£P¡sÄÁ!-Û´Œn, À’2WˆE¹uÞ+¶[k3QÉúM¡…!c¢W‡G} %‘Ò9Š&;­Úåo»ÆJ&7Øòï—a·÷'?õ>”î/ƒ®F[í;4 +!UËY­pm‚FW–·¸z˜y(ØÖÈô¯˜ÆFënù]ÁçaÔAÆs§/6pE¶l·öÜígXjúŠ£õ—Yjø:– -n‡-OàX+ÐÇÖ†/Xkh,'ŒÜ¶œN&Žvh™ÆëÍþ0Çzd]K ¥MÊä†nœpôœ ´öc•|¹ ¢×œè‘#Ï<Êâ±’ÂÀâa€R˜H&‘9dÑÈÄ ‡@Ö±GóÈ6ºì)·<ÐG¹iM-cçH±CäH3cCä&SÞ‡CôŒŒ·¼bÉw5‰R…Þ凲a/×\ʨã–àràW‹–@PEVÒWY·ÇE·³ -{‰]oé¼Ä^–˜È‹9þrõŠ_ÅÎuž¹Ð ÏOâE:Â6çäÇ«ŽÛ,ro6¤d–»îøó¾â»jyVÇ.÷Úê“´*Y|M*Þ™‘ˆ¿‘ÜG2X%º’R˜—¬â8à\‘ÚòÇÉF:;ÂcÔlÊ Cz‰ˆS=4ËF]HwjŒºGZƒ-QDÆ…™‚»4hy4¤´Æ5§ Og·ˆ©ÀÊ÷=åt(Ö4pb‡¡µgÑÃYäo]” ¶ñU´ü{Ø6F£iø3g¤ N< ìíŽüë~Û»ÔÔ3}ŒDÄ93h†Ö ù)3ˆr?Q_L“× w:…»ÿUÞOÜç"øt¹‰‚8ê´6ÊGáq¨gò•Blël3pdÇvùšPó•Š?q†TÞo§¶sË!Ø•™Ż߷Ò$Ë„QÅ¡>¹³ÖØ~äA3¡¨Rn’£-÷ -ãêhü%·À;ÞaËÓ"É8³’œ ­ÛßP±Ú®ÜR1ðní&[.:Ž ’3õLbSRæ4¥K5UYî "*Œ†6Àçn¾²P¶ cÙ¹ªöãÚ®h:Ûý4xÆ‚ÒØr8§ÈÍUÁ4ÆP~à˜ŒÙ1ÞÎl Y÷Ë&ͧ²ë¥‘×Pðä3a†±Ï~«|üR–”t›T­†_›2î»À‘WÙ™”`šSÄý­°Ó âN¥‚»Yd,¸Â…GíÝ5õÇÑfR-¥HmÃ@*©- ©×àè$%Oûèm›X7™Ò8r1iU_0Omy¾ö;a2´‹4´µœ©*Ø”…û´«J?UúOUý‚³E±€Ò“ 5L%³ˆLQ\T<à¿b£ÍpdÉÈÍú;`Õò’¤Ë òË ‡Ã(Ÿ(izò Fáä JâJ²b±okn FimÖ¿Þ?¥ºEç<^ø(CLjAC•­Þ´K:9d_‘ÆW—z.Ø4ÐF ’©E·/á3 ‹³ Ç¿¶›Ä³)B¨üÔÎyiû¿f:™•l+µzBx2ð“GÝ\ËDSôÀ¦©¤$és¸ï£g,/)>WøxI°‘ä’&Uwü;|ÜÂÑ•ÙŒ™n—_±Œíëlø’pÚ#[Po²ÌÜŠŠI¥±û\í±ÞªlC#’?q‰¨æ/¼Ú;nÚ[ˆRûÒ@ËôUO&´'~Ñ-·²qM.˜`gîèÓàøÉ68Bó>1Bã€ËAˆÆ[t_x® E*pÉú;órÌRÈ„°¯%4!yú²ŒTú4ÖŠkk:Ë{‰Âáþw+IJ¿[-[õàŒçT2·à*fNùhol! )SЦ3Ìÿ·D*:§j1xNguÞyú’w¯uAú—ƒ»Û"“× ë‹îKY<ŒkØÉ …˜ ã¹ú Ï»òÈ䪳ݩí&”CåÉN6pœn`ðT‡ÀòÜv#‡€p&Úº.öÔRξ2³©1øwæjÊ~Šò¢Ú¼_÷¥Õ”4y™Åâ¨iiˆ“¬M'ÊqcjTˆÅ)$V‚ê3EÚHÞ»º“Ct¬^Ð*ÈÝ@cŒ*Û'ÿÒƒžôO})[¹Ö§M6d‡þ¹ƒœûGºˆ–¶™ÂU˧ÁkOýÇ´úQ’,V™ò5×C^5¾‰QÓCÔh+g3xÕ=<¨›)~~€ßIosS{A°SïoŸdxwuÃd‹‹pæi^_2#Ñ¡öÃTMí%2‰EÕ ÙRî2¬010÷çPyÇ"ʬD}"Ê -áI@yÁµGR^¸ä?*[bžc¦·éílé_Yjîå¿¡&…¾'ü6Yöý»-«'NÆmÞÍ€'‚ í<#'ál²‰ƒPDø;ƒv¹‡±7-çÔÜulYˆÎ#ö1v8òGpR®ŸºìJðmy4ÚìyÇþÐâë›–ÃJ<½kT†³ýC'^º£—Ò~’?ñWŠ²É¯ûëAó·=³gªMjâ¤xÌ ‡û>´Àåendstream +xÚ­[[oëÆ~÷¯0üR +°X.ïÌ›¤­ƒ“ƒ4ÇhÑ&y DÚR"‰.IÅq~}çJ.)’JqŠCËÝÙåì\¾™å1·ü3·iäzAv›¤Æ Òôv{¼ñn_`ä¯7F(ÖB²¶h¾|ºùó_bõÜÌËnŸžûu"7Œ‚Û§âç«¿=|÷ôõ÷«uNä®ÖI’:ŸVÆyøöËì ÇO_CÐçãÇO«Ÿž¾¹ùú©ãÝ­ +|2düŸ›~òn Øä77ždéí´=×Àðñ8»QÈóáæÓÍß»¥x,¼åYSïú±ë'Ð<7MÃIc|70>#òÜÈ ;a˜È†ñ#7ã[%Bi€F/g‚Ð5Á­µÒ%;&¹Â-ÈÜ(Ü^óäšQ°_¬Öa:9Äëjí'Nµ?­üÔiËš{ÛŠ¤ÝÁ´’Û¯¸BK\(!©xʆÚ†ˆxÍË¡%AìfQtE°=Ñ‚`…_5žì;ì"7¬Å­È[ É4úƒ2… ;‘S“Û¼šYaɼ<ýÀ ½øŠ<{¢y +¾a2+Ï%v*ÏEn*O‹[­ZMB%¦þH¢¬“Æ©qÐ`ñ7ç¤Mv¥2³ißP¡÷Û¬¶“žýºü°¡¹%3mÊ–Ê`´‹óvWr£.Û3Û‰Ø(< HÄ•élÖB3rÙŸÜ2·->ç´7}Ô¢ê}>ŒÇObׄà#½ÌM£øº“ ÀÉM»Èµ®µ¶»òÊ$i[+#…Ë èÁJªª²!'©÷/_Ì:×&®8ˆžhÁAnÓÌ:ˆ%vê ¹©ƒ°¸= P2°/ ,ÍþåTÜabþÝ rµÜV?ðB‚‚Ž‡ï¹A¸éë¦?ššpÅ:6©ó¯Už™Çn¢: +««VíÏ•:ó_WQ !é,ç=oûvÇ„ˆó?­'œÀ?VÆÀ?¨=I4|KpyªÄ´~9H‚}¿qÇÛ®¬Ë!X5¤Çسø¾bŠyma1ž½U’½5¥X‚^1Ä>/¸’#XD :&D(VÇ–Ø©Ž-rS³¸¡Ž…&v>}õH¾ëñßØ‘8M[ïQì/ü8)'B[B ç€m;ñ([[öDYg¤ ¬Ð~äþg )Ïh÷•l1oF[ùÑ3!a®bBÅØ£X!+ˆ¹óÛü”³¡ÀC!Nû|,Ù†râI¶FF#VDüjv÷¾#8ßþåî™…å‘Š]<ØÛRý+’Á.·~‚…q¹$æù1¸\’åqß–ì*çûÔE¦%[:< Nº¡MÞô‘9!»x•â.òòHÊzžÉãlYôØ‘ËbÇ¥m­62/ù¡/?æl•mïGæÝN$FÁ’¬±4߶g B\-õW,7ŠB7 Òe˵ˆæ-W‰ðŃ9Ë]d'–»ÌM,×æö b~@/û¾roÀØß(<«Y'бN±XùüIôÚu©³çœ>Š!°šÂŒ>ú, fÀãÒ‘…ÆõÓkGÖ-™¡ÃÙ#[b§G¶ÈMÌâö@F +fÑØI"€ ³Aªüu€¥¸“³\jr +óØkŠÍâbi°´¼P.k%º0¬ÓjÝRâ3ö”—–ý-A9𜚕DI繃(eOš°ßæŒï6tªhüqàäό袴/@ûîSçïxýüTpã̸RgTÜì†I&Ûùèœ`Ä®íò5îÎJfr¸›©rÍ«!ÂõÐ\QÞhA …h±.¸ÈNÕp‘›ª¡ÅŒ¾Ðyî¼N&® õª°¡q|ðÎ ¨ï©¾Ooð%v~%—8³Yeq;=Í„3ÑíÄñeÙt) Ñ-Ôä}êÈÊL—eÞàJÂâtœ„ë¡‚‰ó»®üGø¿.ÆEÝÂb)p«q¨{Ù^y®g®@-‹h>(Ñb o‘Ä€enln|¯C¨¥v¢'€$ˆºðwƒ=l *z~”Ž®±„œUŧ™ïO Ó)LÂ6åôHjåôâ½àð0ã5Õ{"0hx‹Kßÿ?ƒî¸ób +\ç”Â÷Á ^Ñ‚RÑbÍm‘*Å"7U +‹áo £øß´vžÄCvÉ0W4C;?Vg{Vg¹þ$6÷//©eѽì¨Ã»Ð×_iÜ¡5 °ë8b cÐyç糪?°/d½"zK•ðq¤J¨ƒƒë2Fë€`.9&â9_æÍÞºV}ÇJ÷=83“æEÑ£sºVñåÊÃtòCPù6¯[îî‡K¦Gá‘{FááçØÚp¬™Ð‚g8¸#,¢)ôKÎ;~œyq¸h²~’òÉ´ÁDnƒ —¼O"y7 tnþÄ;ŠèÀ¬Ûf">†wØÓc׶η-3M©hQcm“8s¶IMaUÕ…uíßoF6àð¨ r‘µãût’W]n[˜(ÿA¢"B«.ë–C#`@#U±.e 4ë±ü(rM|åªÚ"š÷XJ´Xk\d'k™›x,›~©•‰4I_;¯“Iª›Yž úî`ˆV甇Òv~ Ï–ú-ª+`èSl‹ïL +’Eöéá=ìáQOæM†µüÐTZ"ƒj8joä“ŒîÊ)oÇ9 ½Hn'šYËvìªãÏ|le[š¨´BÒ\èè|rôOÛŠƒ,žÌjLâ»  RÎû¼›v]jݯ5¡jI H)Q~“÷ì°Õq±˜äŠ.Üø +P¥’dÉÈ6Ü©ð6ëý¶‡æ ¬&Š²|G +b²&ÒUPÓxîþ™¥n2J—F—”èᨴeí&A0Öœ-÷+ +ÓyX%J"JàpX>èH,5Á+ƒ§ý3_"± %‰\ðàê¹NoÎ[Z¿,øf)Áú^ï^¸rìé@¬¬©Ú¥q½»1Òë¾ûº§Ó¾cõµ?ˆ¬ÌÞ¥¼´­N¢é‹F9R„zç >$C$Š£T‡ÅïÆ ¢¶—¿÷¥fu‡¸Â÷9—†i",\:çÉãˆÖO±ÍAGnÑ羂°Q' ÷ü5 ŸH”ôÀŽ> endobj -1312 0 obj << -/D [1310 0 R /XYZ 85.039 781.388 null] +1430 0 obj << +/D [1428 0 R /XYZ 85.039 781.388 null] >> endobj -1313 0 obj << -/D [1310 0 R /XYZ 85.039 727.362 null] +1431 0 obj << +/D [1428 0 R /XYZ 85.039 761.463 null] >> endobj -1314 0 obj << -/D [1310 0 R /XYZ 85.039 693.418 null] +1432 0 obj << +/D [1428 0 R /XYZ 85.039 748.383 null] >> endobj -1315 0 obj << -/D [1310 0 R /XYZ 85.039 628.134 null] +1433 0 obj << +/D [1428 0 R /XYZ 85.039 734.834 null] >> endobj -1316 0 obj << -/D [1310 0 R /XYZ 85.039 605.618 null] +1434 0 obj << +/D [1428 0 R /XYZ 85.039 707.129 null] >> endobj -1317 0 obj << -/D [1310 0 R /XYZ 85.039 569.553 null] +1435 0 obj << +/D [1428 0 R /XYZ 85.039 647.561 null] >> endobj -1318 0 obj << -/D [1310 0 R /XYZ 85.039 519.333 null] +1436 0 obj << +/D [1428 0 R /XYZ 85.039 619.856 null] +>> endobj +1437 0 obj << +/D [1428 0 R /XYZ 85.039 566.266 null] +>> endobj +1438 0 obj << +/D [1428 0 R /XYZ 85.039 552.716 null] +>> endobj +1439 0 obj << +/D [1428 0 R /XYZ 85.039 512.069 null] +>> endobj +1440 0 obj << +/D [1428 0 R /XYZ 85.039 470.815 null] >> endobj 170 0 obj << -/D [1310 0 R /XYZ 85.039 436.16 null] +/D [1428 0 R /XYZ 85.039 398.971 null] >> endobj -1319 0 obj << -/D [1310 0 R /XYZ 85.039 415.167 null] +1441 0 obj << +/D [1428 0 R /XYZ 85.039 380.099 null] >> endobj -1320 0 obj << -/D [1310 0 R /XYZ 85.039 391.419 null] +1442 0 obj << +/D [1428 0 R /XYZ 85.039 360.833 null] >> endobj -1321 0 obj << -/D [1310 0 R /XYZ 85.039 355.354 null] +1443 0 obj << +/D [1428 0 R /XYZ 85.039 333.735 null] >> endobj -1322 0 obj << -/D [1310 0 R /XYZ 85.039 281.369 null] +1444 0 obj << +/D [1428 0 R /XYZ 85.039 268.716 null] >> endobj -1309 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F20 877 0 R >> +1427 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1325 0 obj << -/Length 985 +1447 0 obj << +/Length 1215 /Filter /FlateDecode >> stream -xÚ½—MsÛ6†ïü<’"üIôâ‘]·uÆñ´µ:=$9@$q†" -ŒëüúîbAZTh{Æ‘3:ÜØïPä†ð‹Ü‚³0n^D,) -w¹sBwžßÈöÝ”…G×ùÜy÷/Ü(d"î|mºÌW½‹?fÎ/ÿöƒ$I<Îü Ï ïÖ¼Ù‡óZSïêf~ èy7³ë[ÿóü½s9?'HYš%8ÐçãçÐ]Á\Þ;!KDáÞC;d‘îÎIyÂxšØ÷ʹuþ¢/u髉t‚¾G &b>r€)r1$ƒ9eIš&Í÷ÎCïòj ËÈ[)xd¹·ÜJ^[LV.Á­±¥Zòj¹¨TŸÿÄà1 ÅãaðˆOW±Åв¬!n‘{+©%¶ -o¯Û\K죡ѵjOÙ*j¬Ð]Úü ?ˆ O­Èµðcá=P{gÆ‘5t²š5=g¸¾WæË«oh8.†«7¶¯™@Sc<œ&ù¬«1_®À¤èã¥ï[‰9Iš¹j÷ 9™Áe&÷ù–æ®Ho²'¡Hizûئ ÀH9­1Ñ0r‰ñÑÿË„ÁBžN©&a ùìúDì8hÁÒ‚ÓgÇ!9Kù‹ÿ²Å‡ö!¥HôŽ–Ž¬ ÌíAÛL+ä­u¥C«FÖ¥¬©+ê£Þ—›Ú¬:@Eð±V«¬£éBç ª²òE‡K£Ú³³³7“—89»ÐfV»MY—Ÿ=ø“á’Ð*º 'Ýê€Ø•Þ‹P&µ‘³"/^Ãï L‘þKÀhóØága”bð†žÐ~|…2ųnÚÔp(ö›„üêó 9‰W¬JaÈgøÀ„Y”=ñoÓÞóì_`³,á߆çï£ñw´©Ï÷ÿ`Vendstream +xÚ¥˜Moã6†ïþ:J±¢(꣗ÀIÓ6‹4h=ìîA¶iG€,¥²Üìî¯ï ?ôá˜4Úb±°D¾æËyf4¢C½þQ/ç$b…—å”°<÷6‡Eäíaæ§ÕŠPK‰ævµøîÇf#RD…·Úëp’pæ­¶ý»Ÿ—¿®îBƘÏIfYî?Ô_þr»ÄÑÄxZÝÃh¨ÿ´||>¯>,îWƒ÷°*øhü×âãçÈÛÂ&?,"ŠÜ{ƒëˆP˜>,À™ð„éûzñ¼ømXJÍ%žúÖ¥8"¤)bîf‘R’¤l`ÃlBX’" JcÂhìe<"ß=HýÃ75qì;Øõ÷Z¸i\AîúU³WKmZù­­DBŠÉ,dD› Îü ¡+7ýžŒÊ2Iõ"ä­Pu9Ä×ýËx-ƒB§LeOí‹Z¹“k|ž-C9-R¥— Ëh‰èB¾bNR(2#Âè(yçÇB™ÛNI®¸±‚ðœÏÜþTs©>z$ûø¼ª«Q•â^ª1M}_‹Pn°–ª²QÒÜ4ÇjßÈò€JeWì¡þmó˜pz ã(r`Ô" ,¶btÙŒN7ƒqâö4Á5Ôž ì|¼•ÏÌOkS¦ã㦊Q£ö «³Ò.¿µÃS×-r|³2LsR¤é†£ÈÁP‹0*feè²3 n†áÄí‡Cö©*°˜T v!¬@äžW`c£êR!ª~aÉá…G³+ G‘¤ah‰¤Ë΀tº·[ÝôfOïØô>E‹+LG‘ƒ©a”©•©ËÎ0uº¦·zöšÚYƒªjt3ñPÛ„#+9z2­Bèå¶x(²a„a–^Ã8Šµˬ]v£ÓÍ`œ¸­5ÆfR€xiòjÞ-þCs(±_h¨~G¯Õ "JâøJ#JƒPrk +^&.+“€ÑJ—Ù« »5¯¤nξSÝ@¶æìaîXü'ÌŸènnnl¸xž‘4£n^‘˜a…˜ÓN#s»ifS7ÝþÔë^–‘©Æª9ïúņ3W'Ôk8l'ø`Ü´`7Å ¶~­ê&¢Kñ7,V’ýÈŠÑåg0:í Ɖf&k#?às-+Q‰&àâáUuœŸaås¼k»CÙÙÁteþðO%žqkqƒK¾'ªŲˆÄ[üW¿óþ×ß†Ë #9³ôGc‰%z/ò';ß.g9pdï÷ûêoÓ•endstream endobj -1324 0 obj << +1446 0 obj << /Type /Page -/Contents 1325 0 R -/Resources 1323 0 R +/Contents 1447 0 R +/Resources 1445 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1289 0 R +/Parent 1393 0 R >> endobj -1326 0 obj << -/D [1324 0 R /XYZ 85.039 781.388 null] +1448 0 obj << +/D [1446 0 R /XYZ 85.039 781.388 null] >> endobj 174 0 obj << -/D [1324 0 R /XYZ 85.039 761.463 null] +/D [1446 0 R /XYZ 85.039 761.463 null] >> endobj -1327 0 obj << -/D [1324 0 R /XYZ 85.039 739.701 null] +1449 0 obj << +/D [1446 0 R /XYZ 85.039 739.701 null] >> endobj -1328 0 obj << -/D [1324 0 R /XYZ 85.039 705.131 null] +1450 0 obj << +/D [1446 0 R /XYZ 85.039 709.614 null] >> endobj -1329 0 obj << -/D [1324 0 R /XYZ 85.039 680.494 null] +1451 0 obj << +/D [1446 0 R /XYZ 85.039 693.943 null] >> endobj -1330 0 obj << -/D [1324 0 R /XYZ 85.039 660.099 null] +1452 0 obj << +/D [1446 0 R /XYZ 85.039 682.515 null] >> endobj -1331 0 obj << -/D [1324 0 R /XYZ 85.039 635.463 null] +1453 0 obj << +/D [1446 0 R /XYZ 85.039 666.845 null] >> endobj -1332 0 obj << -/D [1324 0 R /XYZ 85.039 612.341 null] +1454 0 obj << +/D [1446 0 R /XYZ 85.039 652.69 null] >> endobj -1333 0 obj << -/D [1324 0 R /XYZ 85.039 590.432 null] +1455 0 obj << +/D [1446 0 R /XYZ 85.039 639.747 null] >> endobj -1334 0 obj << -/D [1324 0 R /XYZ 85.039 567.916 null] +1456 0 obj << +/D [1446 0 R /XYZ 85.039 626.197 null] >> endobj -1335 0 obj << -/D [1324 0 R /XYZ 85.039 544.794 null] +1457 0 obj << +/D [1446 0 R /XYZ 85.039 612.042 null] >> endobj -1336 0 obj << -/D [1324 0 R /XYZ 85.039 522.885 null] +1458 0 obj << +/D [1446 0 R /XYZ 85.039 599.099 null] >> endobj -1337 0 obj << -/D [1324 0 R /XYZ 85.039 500.369 null] +1459 0 obj << +/D [1446 0 R /XYZ 85.039 585.55 null] >> endobj -1323 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R >> +1445 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1340 0 obj << -/Length 2148 +1462 0 obj << +/Length 2569 /Filter /FlateDecode >> stream -xÚÍYKoã¶Þϯ0ÐEl`ÌJ"©G/î¢3¸sÛ"‹ ÐEÛ#+±0²äJÊ$é¯/σåÈI1˜)‚1ÅÇááwÞd¼Šì_¼Êµˆd±ÊòXÈ<_•‡7ÑêÖŽüÿMÌ3”–B+eÛ ƒ[7ºM©liN´Ú&J¾»zóí‡$Z%‘HS¹ººÁIW»ßÖéf«u´¾ÚW›­L³õpØÄëëÍ6^ Û(»ö†úbÕT›?®~zó¿«ÅͤYr†“8…”!'±R¥3NDL¼\Ú«‡º4 l®¿oMó8Ô¶wpû‡ûŠ,/Î NÛÆzG’"Üöà´°]ó¸ÉÕúíf«T¾•hwrÛN×Ä6½mw›m’¯K P!™¡ÚѪ®¥_C³XÙ2•ëMR¬yÀö×Ó@¼fvh#Â6KP>=O2=3vÓÝÙY=}Œ›$³4ãõYª˜Ëyî÷fdöz”)ÊTª@Lú -ÔݶÀÝ_|ØsI)÷x‡ö¸IA[­/1;`@bvì/¦§Îß#  f•(mWüÝ‚Le!"­–„j™´»‘Uœ—i,N‰æBåzÙ˜´PúEŠïÓ~¤sLP¹·ôsY·„Š ¦‚-À5\‚Sni~í†q¼ß×c5MY‘ÄOxß&™H2i¡-wŸ KòÅayß¡(Ó4GG:®Çº«¨xÐ[¤Eln §ûVµ°£š:œ"4àСޖ]ÆC]8E²) •´¬¾C}ÛNêxñ;tÁᵶë PÐä‘~¾<ä—Ç/U9Ö}ev´æ‰~žQ\/!+´~/šÚÉÄ8´“,±+!—õ'Ž^ŠÈYeJpOAIª1Àÿ· @xó5•^}q†cŽ¬‡49ôS÷úŒkrÑNÿ·`A¶Γ¯í&@,÷ˆ±A/3: öb—Bl¯缫n ¥ ,”]8nÁ1C 0 lãTÈÔæ‰:ÒxlJ$Dê0Ò7Ò¸‡mDz×Äd»k;¯Êæn¨?¡:TA`Q{€_ùâa)Æ(@>):õoÀ}]¡=}ÖÁº>ÔoKüÀ‘U©ÌËF03Žb:> =Œ‰î”RN!‰z³™•y3ˆy”xÅÎè¦ëϪ}ª„Öùk -¬Ê¿8‘ž¦laøjÞ2ùZ'úÒ1kK<Öè̬åŽá«¹&ù/ŸèÓFk°Ÿx}Gr:gçèÆ!ˌ٘¡á²=hw-˜­Š­éÈ«·Í@«wnüéê#²æ½&Lk:³ó^ŒºÀ‰q·]p lÑmškç‚ÃÂ’™È­ØP"8,îN¢¢·WضþTïf®Ëš,8>HzÐ';ëG³ÃŽ‹vZ=Ð0†÷™áèÔå<¥¹sΗðÁÌŽ‹ˆšó o–/àd“É¢Ö’©g‘Ȳl±ÃòtJsÅ‚6ëD¤‘|MÑvJKÎ¥@TfÛ¾ÇY™$œðX—<å•·q÷·;tƒuÕ%9¤ýŠî& ò©›UíùÈYõy©YýͨýQíÇš%h‚§ª<؀мp߈oëÒ8]bÄág7 †´¥Y™]0Ôõ•EÁµÜoò3ZU5N!êîOÔš_+1¤Í¼¢• È£B9Å«Zñ‘³ZñR³Z™QûïM1¿$ÿªFN9 ˆx²bYqì|+vúÀ7Ž¤¬)VÁ©¨%&µHº€Ý8e6Þ! PmX0’íâ,!mÜãžM3€úP=–¨Êf´Œ¶Õ­Ìv•è”`wQªLÓ319½Á…”NmÊªgüÓñ[,ˆñö õ‡@U³o.Cý… ‹"6ÀºÌí}`=¥MÄŒ2„ÌùÝIë¸Äû=¢{b8TαízÒ!¬NJnÆJ'Y$³‹a†¦d?©øânÃÕ +Ÿf¦ñ3U:6‰v¬}Ù:g•J”~Íyâ +Ä(÷;Ï hÝy,7³{ɉóø©‰óÌ©IœúÃ^|àÚÉ£†Ud¡Ê^+mf@7'{ÉYx©Y̨‰~G»Æ¢Žä0ÚÐÞÊƺ’LéWòÚãÃx³š–½¾”½ýDÊù/Û|¹¹°¬E®1À³’ÄÕÞ¸¦Þ®â£]ô)ÎUœÚ(5âɹœšÄÁØY<N*»§`MWfÑ·0ÞÊö™8"3V{Î…»8Êoeþeà‘ ŒF`cF{XÊæ*ñ»ÌŒÄë/õáFHé±t¥pew(š'+ûy{bkBô@]l2ØÊïؾ…‹A^¹ûùn{£„–Æ2 •½ÒÁÏ`\+©£ðÔ|š"S…¶0&%i‡ÿ”WÞ@ïÞIÿñ‰ªÔŠKýÛ,š"QI‘xYœÁ¬÷Ç&ˤ1âñ#ÚP=²­žQë{±Ú8O¨Æç¡Âœ9Ï+ƒ’NQÙhÆ ¹’ï²wáÏÚµ~×jq“0 ׬¡S¢§s´*ÏépD¤¨ñ‡Š¯ó²€Ø_'?7ï3c7à0é+K~ä-É}°62E€M'šç©é‡í…4ˆ¿yy”H9ŠÌªâ™ª´U¦À2¹™@Ì•™¨ OÎm=ËT¹ìmõŒ´¦”‡4àà›5—…&Æ}Ä*aÃ$½Ö©Òi´b-eõäÎÒÃE4XPÖS]7eØŒ™f-Ãjup*Í_É®3 õäb¼†—œ¤?5É/sj‹¢®ûµ¶V< Y¤ZœY‘ü€ ?ˆžm-]‚]fHÇ+Q?°Ý»–k6Š­”ÿ‡NÀb_AL00Œ·ÜñѲúð‘²ê˜H¹V'šS.Îì¹’ü¹T/Ë@Ø1Á©äˆBÇ{7ç¬ÔoÑ–‹Š-*Ïž%ü3žë€G™9 ~i&èûe„£&;W&n¨åZìgÏóDÖ3ÞaÊÌšÊ ²±?H^ͼ?Xd ÂG '€~Õ`ta^|Ì€ÖMÆyKD/91?5±š9µßD¡=;*\?ÌE=âwa±PC˜‘ê|]cÑ®+,ù'iž\žG „¿úêöê“P厰ÄxÂ~Þ̓óþÔΰ¯k‰<=rU—G7&1 ô­`®ew^KfQš«Lg?˜Ìz›Ì~³mšeª˜·Êó²¯NòÇâ9¬^š¨"~e¶3òžyg;^rÖð¼Ô¬áͨ}¨ÊÃ<`—³”:öeÝ,fh/gÉs÷wEŠÏZ×Ze¾Œzפg}Ñn½ÖÖqf诵g0뵶6©Ê̼ÖÖ?Pkpåüx/õ¢”Ží…Þ´eä +ÿ µŠ3/ÿÌz!®¡_ŒLÊíˆÏ,–šË`ÃMT3Ûfeñ­ø‘%¶Ôø—KHø‚èá ãT´ +ùÛ´ªû¾,DÀÓ¸úì>“%׃Ý,±ã¯悹$N" º±]+î=”äÉŸ[¦ò׺'†\äÞZ 1I¡ +W.ß +1²bÉï²"™FÑÈûBS€=Pp¿”TÌRO PG€5}8ëzê]`ÿ±1*ó‡!ü%ÎÁýs5}ºl ÷öÓ‡”ÎE0.Æt“mn´ß¿‰EsÌë†E8ò7W”WKÝôŽºWg̾*IãÐÞÙ°öÓÀ°>Sy¢€¥|‘^Xjšnú»˜<à ê–Î?:ip§cnKñYâ#f+Â9¿ô+ ‚'H:ÕÁ4nÖÍLàõ¶ ]þ~‹{ϵ4³øù þàÙÉQ¾$[±á ”zûrìÚr¤ 3=y}驾’þèeµ65ŽôùâG¿Á~Ç‹¿nsã>;U_ËÓ¹©Þ²'@Œ™yB¦¢«ñP…9%§é„NHyˆ«Ÿùa'K=ÿüÂÕ .‡±§àŠëOÊ^:?ËÏY¸ik[Õ¨Žºƒ.33 ö>â‡ûîÒ¦¾%›>d—²]®ý·À¤ÝÛúøÄB¾ŒÙ&L•IRAFíI|M/1´r³NðÓøüendstream endobj -1339 0 obj << +1461 0 obj << /Type /Page -/Contents 1340 0 R -/Resources 1338 0 R +/Contents 1462 0 R +/Resources 1460 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1289 0 R +/Parent 1393 0 R >> endobj -1341 0 obj << -/D [1339 0 R /XYZ 85.039 781.388 null] +1463 0 obj << +/D [1461 0 R /XYZ 85.039 781.388 null] >> endobj 178 0 obj << -/D [1339 0 R /XYZ 85.039 761.463 null] +/D [1461 0 R /XYZ 85.039 761.463 null] >> endobj -1342 0 obj << -/D [1339 0 R /XYZ 85.039 671.062 null] +1009 0 obj << +/D [1461 0 R /XYZ 85.039 671.062 null] >> endobj 182 0 obj << -/D [1339 0 R /XYZ 85.039 671.062 null] +/D [1461 0 R /XYZ 85.039 671.062 null] >> endobj -1343 0 obj << -/D [1339 0 R /XYZ 85.039 639.536 null] +1464 0 obj << +/D [1461 0 R /XYZ 85.039 639.536 null] >> endobj -1344 0 obj << -/D [1339 0 R /XYZ 85.039 605.028 null] +1465 0 obj << +/D [1461 0 R /XYZ 85.039 609.512 null] >> endobj -1345 0 obj << -/D [1339 0 R /XYZ 85.039 583.119 null] +1466 0 obj << +/D [1461 0 R /XYZ 85.039 596.568 null] >> endobj -1346 0 obj << -/D [1339 0 R /XYZ 85.039 559.997 null] +1467 0 obj << +/D [1461 0 R /XYZ 85.039 568.864 null] >> endobj -1347 0 obj << -/D [1339 0 R /XYZ 85.039 537.482 null] +1468 0 obj << +/D [1461 0 R /XYZ 85.039 555.315 null] >> endobj -1348 0 obj << -/D [1339 0 R /XYZ 85.039 473.53 null] +1469 0 obj << +/D [1461 0 R /XYZ 85.039 495.746 null] >> endobj -1349 0 obj << -/D [1339 0 R /XYZ 85.039 453.135 null] +1470 0 obj << +/D [1461 0 R /XYZ 85.039 484.318 null] >> endobj -1350 0 obj << -/D [1339 0 R /XYZ 85.039 430.62 null] +1471 0 obj << +/D [1461 0 R /XYZ 85.039 470.769 null] >> endobj 186 0 obj << -/D [1339 0 R /XYZ 85.039 356.148 null] +/D [1461 0 R /XYZ 85.039 409.747 null] >> endobj -1351 0 obj << -/D [1339 0 R /XYZ 85.039 334.951 null] +1472 0 obj << +/D [1461 0 R /XYZ 85.039 388.55 null] >> endobj -1352 0 obj << -/D [1339 0 R /XYZ 85.039 289.156 null] +1473 0 obj << +/D [1461 0 R /XYZ 85.039 347.238 null] >> endobj -1353 0 obj << -/D [1339 0 R /XYZ 85.039 264.519 null] +1474 0 obj << +/D [1461 0 R /XYZ 85.039 331.568 null] >> endobj -1354 0 obj << -/D [1339 0 R /XYZ 85.039 228.455 null] +1475 0 obj << +/D [1461 0 R /XYZ 85.039 304.469 null] >> endobj -1355 0 obj << -/D [1339 0 R /XYZ 85.039 191.784 null] +1476 0 obj << +/D [1461 0 R /XYZ 85.039 276.765 null] >> endobj 190 0 obj << -/D [1339 0 R /XYZ 85.039 159.092 null] +/D [1461 0 R /XYZ 85.039 248.557 null] >> endobj -1356 0 obj << -/D [1339 0 R /XYZ 85.039 137.896 null] +1477 0 obj << +/D [1461 0 R /XYZ 85.039 227.36 null] >> endobj -1338 0 obj << -/Font << /F20 877 0 R /F15 895 0 R /F43 1079 0 R >> +1460 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F14 969 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1359 0 obj << -/Length 1295 +1480 0 obj << +/Length 1463 /Filter /FlateDecode >> stream -xÚµWYoÛF~ׯà›H#Üìry¶ÈCcØM‚4iEáøiY0Eª<⦿¾s,)Š¦ã qaÀÜù攲$ü)+„Ô‰ÅJè8¶Ö»…´6pòëBiùB†½\-žŸ±¥¤Hdb­®‰e•]ا¯~ù}uö‡ãj­íP8nÅöêÕ>:Êþí¥8}ÿîœ ç¯ßž9—«7‹³Õè×~¨ñ¡¿—ÒÊ@—7 )t[w°–B%‰µ[ø¯Í¾X|\|¤ð™oñ­s\_‡B‡,à9­»t4c×>­Óã^`—é.çÕ þÐYÞæ5o?§Egš¶Þ–^RÚGSÑ>…º%$ønÛÞ0C±-͵uU¶Û²KÛmU -¼óü\#¥ÜPx‘¶\ _Æ$æO'öíª+2ÆõÊq½ÈÎqãÛužrÚ°´#•w$éÇ,õBØ|—M5ÞU-ÜôâØYÊN[ÜD°É뜗im>IåËgÇ‹mCjöé–Ênx çUQTÈrÇŠ’0 ›wxTÕŸ,Ñ8,7Ëg@IBq_37¥ÿ¥ã%v;+¬*Ž 2îQÿ5® ½ª¶¤ƒŽ21<\ƒÉ8HHÄl–èX°½Ìx±d(! P†RÈX›À-Ë°ÍŠ9ŒHOßÁHܶÚ3± ×IËglâ¾B×¾Ñ몃MÍ÷˜±;òŒÍèŸ2wFà£M?êkŠ®9aZ¡ÀìžšPz|Ì:È¿œXÛyÃÊÄØŸxG¿^î8[ÖU7ò,fMÿ0žnxósQ@IÀKŠ¤ýì·½Z:‘v¯4?†wß(  Ý@¦­!Ѿ”ÖÛMY °bbSÀñÝ«"ŧny7‚£a -Å -Zþ¶à¼?¬®&ÕnG@“šm˜†Ê³W7ù—C•²Q;©ÊâË ¯k㪠ê³ýwÐŽŒ¯ÑɸåÔZ4°d÷âzO0¤¬SKœ5Ÿ$‚},¦ ÅU‘P1¸Û“RxA0ßÜ\¥Dì…Cð€¬D‚.<´P(Oi¨i¿b‰@{ÃÈ>8¦|è¶õm3ÓÞ”€2ù‰Ð£ft”¶½\1Ç¡y]! -¦Æ!\À ëŸ=,IÑ~šë¯'ë -Gý/‘ÅÌS¶ÆIYa‰ÑA`ïzD²¬0˜!î=,Û†‰'rU{ÂT°®É3^§†#åí¢8$\™† ñœv¡âƒíñ{¦Õ¡Ê­Ò–Öi;¤Màl{„õú¡ÄœÔFß7ØPzR‰è -£Ö9kÆýÐO~ô³BoÝ=?ƒâ éA&4&G°ht}’ kMÑ`œw»¾šÇl¼î£âPM& Ü¿þ·ñðçP³lͤšéÑÅoKFL÷ó‰Á‡q˜«îŒ#ž`|œÚ<™)·lF­÷T“=ÊÜpÚf€~ÓçF:ô÷šOŽG&<¶ ”uQ5G…6ÔT uãTwëð”GtDp¦¹\Ò @¢ ïP~—åõî½ÚžÝ÷sæk8ùe& Ç°,<¯–³ç§>œ:"r¢ùòª—ã ×ÓóåêÌzýæçß–'¿Û ­µå {¡µ|s„϶´~}%^üpÊ„Ó·ïOìóå»ÙɲÓÝI=*þsvvîÌW`ä»™#tÎoaí Çù 4 ÏÕfŸÍ>Ï>u¢øÌó­)?= +/ÔÕþÀQ©=¡”œÚ‘瑧›¸Šs{á)Ï*â<áÕ1è,i’Š·_ãlkê¦J‹µ½P>lnÓæšÉYZ†Ë²hÒb7iY ÍóSé LYH5_¨HDðE3>” ÜtÀYÒŠ›Á¤Uñ‰qe_é~µUØÔ›ø’˜kÞ_Á2ËJd¹%{]Ç™†ýéeµbòúŠõÁ3 (ת’M•Ô(/)‚óõØ2\—à5¸N± ‰ùŠÈ1c“«¤uñ[2ÇV•±ž:ÖMvK«AWÁÚ¦ÇŪeà0º£ŒúB!ê*Š‰H›s™©ÑÙ9Ö5冉¹I¦a \em`ŸmkÃ7¸sUnmL ÝÛTí5NB²êâµs­ <Í „ +ƒQÔ¨¦$Ú‹ý…öâ—R‡ ÎÊ%þ_¢’“¦ 4Ý…ñœ?ìÐebýŒùÞâžãÞ…jÝŽ3ó”ž7¯ç!óÆ­Ýšçh¡o¤˜‘¶ãp=BB #‡’Âz‡Á¦ìS·íÃÉø „ ÇØý}O®¿HíR­y"Pc$莜ùG¼9Kz¤oåé +Û$£­×£ž¥5‘V6‡ÌnÕXϸŽ GÌ۾Ƞ0oëVCì¬É£W­ª ±‡8ZÅ ­ãÆÁ¾W‡ÃÃ(ÖWAü y#=ˆCÏb<„õ¬1à[O”ó+À þãÑ:N–È>§èHMv|×Æ{Ðí°! ”pŒóܼÆ}{0f'¾Pþ¿Za\ï?µ3‹æ›]ÓG3]|Z[pÄt;°˜øp¦0a1‘ˆ0Wîú¼3l~Û³‘YìÜGœ|¢€š5 +­š›‘é×I¼B»ð0£W*™ÁÓQ?ÀÀ E$+ënÀÚ–WLïùÍsÑq98ÇY†&¢Q«£œ²¨SÐGPÒ[ÕÏy‡Õq;›ìkù=“ijGµyØì¦Úq +ØåèàkØHhÎ#ÉÊ YËv,ÃÖ­Ÿöhœ™„·/¿ô‚a¥œógWñ:ùf½›j“k#„–ÇÃ{¬ò¹fÍ0ƒÓ -…LaVp"{JÿŸuþ´…þ¸Å“ýÑÙ;14àïp‘/<ÝLã +íúáAÊP8*43âqæó}ÑÄwûTKøõQ?þ‹ö€gÿ¼iáþ^ßä…¸ß1©+H ul9–ùPDÿ4>|8³‡å4»ê ½@“Ÿ “ß0£GWi–¼´aNtëÅñ±©¬¿9SG&ß/yûN>žN@ø€—^¼^ØѨj‚ŒÄVÏdb£u:§³¥¡¢©\Áõ]“è2îjêh:áž + Ó®±ƒ ¼]sÛ?]<°÷_6ÏZ©endstream endobj -1358 0 obj << +1479 0 obj << /Type /Page -/Contents 1359 0 R -/Resources 1357 0 R +/Contents 1480 0 R +/Resources 1478 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1289 0 R +/Parent 1484 0 R >> endobj -1360 0 obj << -/D [1358 0 R /XYZ 85.039 781.388 null] +1481 0 obj << +/D [1479 0 R /XYZ 85.039 781.388 null] >> endobj 194 0 obj << -/D [1358 0 R /XYZ 85.039 536.7 null] +/D [1479 0 R /XYZ 85.039 635.626 null] >> endobj -1361 0 obj << -/D [1358 0 R /XYZ 85.039 516.567 null] +1482 0 obj << +/D [1479 0 R /XYZ 85.039 615.492 null] >> endobj -1357 0 obj << -/Font << /F58 956 0 R /F37 900 0 R /F15 895 0 R /F43 1079 0 R /F20 877 0 R >> +198 0 obj << +/D [1479 0 R /XYZ 85.039 135.961 null] +>> endobj +1483 0 obj << +/D [1479 0 R /XYZ 85.039 104.435 null] +>> endobj +1478 0 obj << +/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F14 969 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1364 0 obj << -/Length 1373 +1487 0 obj << +/Length 1351 /Filter /FlateDecode >> stream -xÚµWKsÛ6¾ëWðf*S"Að‘±3cgä¦Çnk5×X¢mN(Ò!);n§ÿ½»X€z˜²Û´.»Øýö%áqø /UŒËÌKRÁdšz³Åˆ{7pòãHXîEŒÇ -Ž¦£×Ç*õgϼéµa™Î/üwïžN~RJ?fã IRú~B„ó±ð?±wg§ÇD8þéd2¾œ~M¦kz‚ˆE±DE_F—Ü›Ã[>Œ8“Yê=Àž3‘eÞb)ÉT$íw9:ýÒK¡³È£[æQ²X*/œ¥iÔÛ%Ô€]ºÉñő߀ °¾ž“ ºE^ËdíZÌÂD‚äŒqm>늺*T~¥ù%ÞóKÂÄ ¾63œwºÑ‹íh¹×å2ßvX`õiÈT&†± DÂ2){+C GLFñº•ðlУ¸þXuúë2!K² -BÁT>ïÆé­ucûXÃÔG%Æ‹õ5­¸·çYŒÃÄ¿ -›¡ÇÁy·|¿s•²-­Ú®×pT—e:Z¼üf%!X¤ÔLû×E™¿±äÜsnüñ'¹ß‚ø–>ÿ¢ervl ä0®ñF p­„ío„Âm®çyc%:=&ò.oè»,ª¼×¹[Õ–@£l¥vïbN?Nh·w¹7$nXû–¸5)Vð§Ã“ß,íô„ü½ñ†¿´A§˜é²|§‘ÿƒƒÛ ´h.%×UëÎt7š"ŠX¨£Œ9°}68Û–š²(Utm[¤‚ÐyQ¢^ Öœö.Rí–`èÝfüa njKmh]Ô®µ¦æÆKÂùMW¦,…½@qQTºËm¹ºÂ”xtÌ´N@ÈÙ±{«â˜wö½Ÿ«üÁJº6ÝÃSGaB/„$âoÇ üß18$;Œ“rSG: ­ºúxè§2€©p2(ãh eÅ£ Ð×CŽ ß;ôtcŠ¿ð;'òÐ5ŸöÔ·# ¿aœ zéÎ{¸G4Ì:Ï©?˜;Îê9‚'3ô$îµRbèì -±­n,#6k=C(>(:¤§x©¶žVxê„›ˆÏéά¬Ûb·`¶^GÕf¯Ë+¼ì,@$¡v‚;­lš›»Ô½ÍwÅînøe솴oƒ?ú.ð§j ¦‘Š¹í…> ú°ÎÑÈûb¾Ž;´†‚ÜT“&"µ!Ü™Òg6Äði,„ð±%1¢@ðäz¹q•³{EÔü f¾.é«-n*ºfâ(}4¤qÿì§Í“p¶ÆvJ®Vc w/–\š)¥©DîÜùêÝ8ùmjuo)¦‚¡£Í2ýÒ$‚­û|­üpã $™Ê.VàÑ Ùnáé3„èILcw€Ön¢ò€–=jô0†¯ —)ü™ÿj`pcÎ÷LÜ?×U"øs²{°, 7æZÁ2|ïÆ\Ë@‰ áö­¾B{ýz %ABFßé1|Bx¶4nM¾2T»žÂ;ÿÁä»Ê[K0¼®i]…—òWã.FªetS„I…v# ®ŠŽ6Ë -kã²]R£•þˆ¸ÖK› ³l×ó‹2+òËü+Lafoióš™%á8^´ýû,•’zÑÁ£Œq¢p´È]i ¼ÇÖÅ*F1€ƒfh3]U&2o06à0ÊúÂû;ãDø¾¡‹ô ¨4æ?@³èë.õI`بeÌ<=“\èø“Õ®K…iêШ¬¤ûBÓÆ8G›žå:Bo xô©å%ˆÁC7 T;i™dœ¾Ìq»60Ü´¤³û†ßЭïhþ3ojÕ }·uctÛ¨)Òb~ãØUÍH<°˜o ©NïÉÈÉí\ÄîiÃN½¶útNƒ¯À†Ç¹ˆÜ|È¥@èmiK{ì`ÃHN-€¡dBòWÜ+M@h”0qÃ)wÄIoÅ·%œ5 ‡i§›è0²@¢24@†ænÖœOñoÛz›P•ÙQC’;˜×eY#Vø§G¬ö‚âOmZÓý6¤¡/L´Q ^$]>| _Š²èñm#*CHãkwr¯4¨QB×ò(¢Sî,¢“Þ,¢o€¨/½g  ˜Š/ùPpGÑ’jgy…(t…¹ßÔ³øàXUô­c…›«{£Ø¨uz„;»Ë˜¢;¬º Ý&A3-kzŒ;¼¯#î ’ú¾ï®79©èUäÎ Øèy'…©¨Vô©¡, ©1¹yä;kï0ÉÇ©å%P ýW¨µWš –QÂ<øG©5åÎRkÒ›¥ÖÀPKD¾kk®á.•ˆ'&.fÅ¿˜¹,Ïh^P6kš)ú\¡•å%(®Ìz•=Sø2ç4°\s—‘‡µa1Žß 2MÛ½!uÕwïTI+=Qî«&éÇŠGSï +œÀxàž£-Iz}C0¯ZSo_È_Ækë¡6QXë&¹œÞ:[粑ôÏ%ðQѧʱ¢IŠõnC$1›%”`5„æGOésbZ!È?aÒƒVQ»«Fš%ld+?G£eÓt¨TŸÄ÷'ûçŽf¦)g Vê»þF`‘ G/dP6¹Ë¡£ƒ~o‰Ç¼…Áôël‰˜ÃˆÛ" é±àlz“éàö:#×Æ'ã‚"´…gÊÔó‡ –u9剡 ,¤ueÞ]£³Ò°Rð¾8ÃPÑÖÛ¢£ÁNß±uƒ¼h¤0nžP£ÞÑD5Æçnÿb(5}K½ø;1!h§J5‹ÌÒ-ÞpíªFŽêUxg»”vXgu·Ayf`MU©ò©ÕÌ‘&e›ªÊTd’UËhð ÏÔ´¥/´G@®Aî.šm¡»ÂD_ð@û‘ ¼¦èR!àBBc¯Ê]nÂAã#ÍD½¯žÝýÔ)ªø á–î˜x°¿j’"°ŸÈ°}Ä8-áWˆ%%ü§¨þ×¾žÚ¾d±<Âì@D,Œ|‹îT×áÚß…ñþºŸvsendstream endobj -1363 0 obj << +1486 0 obj << /Type /Page -/Contents 1364 0 R -/Resources 1362 0 R +/Contents 1487 0 R +/Resources 1485 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1372 0 R ->> endobj -1365 0 obj << -/D [1363 0 R /XYZ 85.039 781.388 null] +/Parent 1484 0 R >> endobj -198 0 obj << -/D [1363 0 R /XYZ 85.039 667.913 null] ->> endobj -1366 0 obj << -/D [1363 0 R /XYZ 85.039 636.387 null] +1488 0 obj << +/D [1486 0 R /XYZ 85.039 781.388 null] >> endobj -1367 0 obj << -/D [1363 0 R /XYZ 85.039 497.28 null] +1489 0 obj << +/D [1486 0 R /XYZ 85.039 701.758 null] >> endobj -1368 0 obj << -/D [1363 0 R /XYZ 85.039 474.158 null] +1490 0 obj << +/D [1486 0 R /XYZ 85.039 674.053 null] >> endobj -1369 0 obj << -/D [1363 0 R /XYZ 85.039 452.249 null] +1491 0 obj << +/D [1486 0 R /XYZ 85.039 649.682 null] >> endobj -1370 0 obj << -/D [1363 0 R /XYZ 85.039 418.305 null] +1492 0 obj << +/D [1486 0 R /XYZ 85.039 620.462 null] >> endobj 202 0 obj << -/D [1363 0 R /XYZ 85.039 355.182 null] +/D [1486 0 R /XYZ 85.039 563.944 null] >> endobj -1371 0 obj << -/D [1363 0 R /XYZ 85.039 334.592 null] +1493 0 obj << +/D [1486 0 R /XYZ 85.039 543.353 null] >> endobj -1362 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F37 900 0 R /F20 877 0 R /F43 1079 0 R >> +1485 0 obj << +/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F14 969 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1375 0 obj << -/Length 3268 +1496 0 obj << +/Length 3024 /Filter /FlateDecode >> stream -xÚ¥]Û¸ñ=¿b±@q2õI¢,É@[ wHŠ+zÍ¡ÙÃ=ôú@Û²­F– QÎfÿ}ç“¢l9)P,°"‡äp8œo:yˆá/y(WËجŠ2Yš²|ØžÞÄùë›Dfd+³\e´gŸtô)O—qVÌ͉žÒl¹Žið‡ç7ß¿Oã‡4^æ¹yxÞÓ¤çÝ¿¢bñ´ZÅÑ?ªÅS ?üôáãâÉäET/’¨å¦åϯ-¾pç·…I¢naâ¨oº[üûùooÞ=ÏRa–¦Hï˜˵1!‰I¶4Y>!q™0‘?!MC”v@Fí.Û{HX×~@ºJý6Éê!‰7ëp›çcíOézE訙ãÙÓu†½$:â.ýÀP–ÑörªÚ4^:à$+´‰¯n‹ÿ{èÖ*ʳ\wÂ^ŽnÏø QÅD=ðïR9ÝÇ -!„ŸDûžÙ0R#Ôüù‡ñ`´ÙMÅûò;ÔÌAº”®5q€À½<ºðí¿…^žE¶Ý1øØáêìÑG{ÂÞÆrwÛ§‡ØK £•Ã‘÷_.ž²dܯ^yÊÉ"é«æÌóÏÄïª;7˜ ö=vwòµ­ž:N™±qÐÝ(s‘×f¾6o'·a¡—CÚÑ‚€Ǽ tí]Ãö«·Üw &LÞ»£ ÄóÊSHV,1u_ñ(Kίç]Ïžç¿Q—°5è.ã•@Gä¹Ð3Œä¿²òÑ)&ÀvSÒØ< -v"ŠÉ¼ )±lwÕòîµq°hLÉ;›µØ°½«ö–ddà9i©1!β3+m3ˆ†ó×¼Ždœ €çЩ&*taï‹2û*Ül~qV¹$˜±ïú­jØ·±#£:J2'-´¶~>Q¢R Í×'lÙ\ÍÆÙÝÒOŒ’ª l\Ü^-ÀܬeŒUGbq{Í-Í0Ô’¾3Åz{€BkÂWs¾÷M~Ìs²ù#_—sA:&t4³rŒiL!!^Ñ=EÛˆKË„Ä—Wú”¢L¼ƶ7˜ç³¡]s£Ü t§³ZY Nš:‰‚MäŽâ…QO%|®¦ÆÝ6<Æ<Ž>~ÚqÊã…z‹¡H.o½›Â1ŠùÈ»UL$Œ ¥TBÐ=,ÖË¢ÿtaZuOè† p³l ™´•“ô²ô”KFFYޚϽm.šÏ3_mÏ:„‰@ä[°LD—dŒ•ëAæ(Ü«ì@ðsÊBe*/ŸÖ“MbâÙê:Ï.RwÅõmýÂñÛ£LÊT xZ³B.¤©wZþa°ØögÏ@ªžãÌûÇêAVð®faÊYèí)Î<é4btQo¥jßíÉÑíVõp¬zÕsÄ(š¬µ.u6Ÿk>2y©À;—þ'­‚ÉAØñÞ…MR,S ánU8Wߪ -® -¿§Š|ÅbÈ~´UïHsÏ3[§ËâÞ¾i²\åæ(/>§S×R‚³6*4;îÉsO6[½ðUa mÇ_µÂT7@TúåØ4s²ðÇW2X!ȶß鳘˜}ÁÒWª §m[«Æù7¯, -a! ç»ÙÊ)…^×ÕF,dÒE<’Mç¤ âÆ©áß2¨,{»Ôv>@bÃwËgêü^f‚èÒÏüŒaeÇ,_‰‹¸þNˆ©ƒt/„'§õÔzÝ ãLI>†^RQýcø µ©¨ø{ŽMyJõŞΠs£ÔŠ›)Æ«À=XÐÎ\â aËdC£j(ñ‰Žú§Â»†? MÞ²ö&ªˆ%íáv¸Q!5øŽa3Uaó5>8 •Ý42=;=`Áаû€Dm4ÞÈ…‚Nì`˜Æ«¹7úñD–šn -gô„„VíCÓ c©H¦Î±ì­tk¥Ãä¹GšG²ªÃÎ\Ë.`u^øÉ÷Àà*t &?àû†|åí™ÚP '8‰Œš]$GòŠ€o+V £üw79fî_X©3¾UAÇ]$x• ðÄIút›äúð@ÏB«d¼¤`›$…Ä)æt ½xºA†ª°¾“ ɼ‹Ûü«£B×,¼¡•WN7"¬o&F}3BIzÿqCÉd$Ž^‚Ȉoéh¯K_3okt3Y2Qš,½}!p ·ò|zAx]ÉB›Ý#'3´—õÊâ‡X>7nÕeh‹\”+*@°·u£è‘yy9Ö#j¡rk[žì|ÄÄ™¢>þš*¿L¹âÔN„ éΧ«ú.{°ZTµ›FíÆøn6±‡ÞžÐÔŸ‚W™Ç“å7¬Ïèeô¹ÚZæñ®¥CÖ@JVØÝSÕ ¯+$ÚGr_Ë¿é§Zm¸0KÀ!-Šˆ‹/\>pµ -sªA.Ui/’á:à‡j©pÕä˜cÓ¨HŸÞr10 Ù9Œ(f‚Ýt´Ÿ9¿y+eJz;.8– E¼Þ=Ocƒg´ º´­Å†o%Œ¼©pï+Äø›÷صˆ›Èïmà—déÒL‰p¦BhÊ?÷º¦ù5úÔ¤Ë4-¦¿Óï|tkendstream +xÚ…ZmÛ¸þž_a,Pœˆu¢Þ(mæ9ôšCwƒ|hûA¶äµY$y7ûï;o¤([ÚC€µ4’3Ãá3/ŠÚðOm²Ä¢ÝFgʲls8¿ 6O0ò÷wJ8â$ò“8†ç…Á­ݦ¡Äz‘GöØjµó£X!χÇw? +ƒMøim¥B?Rá&ÝÅ~Å›Çâßž¾ß&Iàý³¼ß*oüðùËÃý6JµWÝ+¯áÇœ¾6HûÁ/ßî#åµ÷Qàõ5P‹ûÿ>þúîã£Hä1;-ˆl¶aäG:|SŸT+?HCWƒ†éL0 +w¬¯X£Ï¨ÀØ£Z-ÈxÅå0âjÑ6kËRoÊ4ñL*Ù¨Àß»™Laæk­I¦ÇS5Üoã8¡½é1E«ÆqŒoÊ;¡HýÈ”Ä 3ïp9—Í=<Œ¸„àÊW#»ä¸,oÝ!!ö::„²íêÒU2!_NèRQäå}‰±‡*ó¹µß+Ôâ‰éhNd4ªÂRà0jæ0ÜO àÊ×¥2?Îß.¬ó£TÆÿúóÿ…å©ØµÊÞ˜°Ï÷*Ql•,ò|R|«ðš¦ñì?£3dx<07Ì‹qÅq×%ÚØòï©DÃâS‹¦é9ÿˆ­û¡•Yd_Y?“õwÞK_KOóÙ¹ã½lB iï‚GfŸÉ6`ÅØB®^‡¶iÊÃX=[3Äl†¨H’ÔÔÛPáð¬ÃW~d_!Ã×W¼œ%ÁWÎÞ9¬É!Óß”câY‡¬D%~–¤YèØ©½çôÜáᶣàS[3õ„烄5^¨4æ ‘xµ\ŠA–» ¥ñPKˆÖÐSÙxa£Ìû˜÷Î’V öŽ²ÿ‚$.tÉÓ0±˜ÊûåË¿>ÂS²¸A¬I&)ï÷|}€E oÑ žñOÉ“›–/;ËåÎ ÐâØ­:LÏÍo]£~aì}䥦Wò[ÐwFŠQx{ E¢>€'mVWÈø‚Ë`?\:¡`î( Ýñu$®ÙEB!²e4.²æýX.$bO“¡_p¶@ˆbÄúòzbaX“°LuÍ*FM‡qáøžïuUðBÍ“ °àë_øRœA &‡Æ†ïâ€`Jv´–9d_<÷Þ€ Vx2ŽMÌYðHÞÖ5òºì2?wù@T‚º¶f2uÕ¹Rïo¼‡‰"ÄÂñž¢¤+'[´–uº±«x®hÃ,jÑ…Xl´ÝØòoÁÁŽÌßSÀË`,´F$5—Æ[ô&øL8±à6g±+¶½¸(é‘Œ7`¾À«)oõ0 ÌÂ0–{´Ÿò&ŸÛaD_ÃH2 +ÇrÀûƒÕÈþU™ëå4ÙˆÆÅÙ|Œ¯É½@æj_™|gŽò œV—Ó,÷ά†„Ã¥w"õÍÙ20œ‹\(ŽBïÑìA»ï2ûKù >ؤÁ"¿Ô#’5[¤%g+„3¿žš×£xõtâH¿³÷’–šiuÇ´Õ˵²÷e¸€×çëHÉWvÑiw”¯F;Ég)ÁqrR"·N þƇ٘$ÍÈt}žÑ.âȲK “€ ÃÐ.q/>£”ôPæ­XÄÙþ„";§@ßx¿ òË©: @'Iìä®"ÚÆ `Šààʆ—§÷‡A÷RWc9¬^¯ÏèÆ1ºñ‰â5TÌ)1mÅÛÓyÇ‘9ï ÅŒÕdzŽCq¦8Z;*jè|YHq¢?‰× ¼uÎÔµ ct÷Ü]ù– ÆO8ÌÄñÒÑ\ƒÑëÄ˨8÷’êF €Tuä•0$¸LC6»Îd;!&'ò{à|âܬñ(úÁ`gƒÎ@©8™§Àq\Ë°NC£ dJo“—†/å8Ü&¤i µÉM÷`Ê°0V“éMÂŽìbëÀ»û²dFɸïøí:³C†IƉNè ºIÙ.çáus(1Ç´‰ªX\8 ¤ ¦' S%?;¨oä+ÉNÔY<ÏK’ ZPM"Uëþ‰I"©ì®z›(à0ù1Œ"xW@E6š5²ŒåqXBŠ[9§XÖÉ"‘2}HŎü2¡) ©”`%0?µæý©é{w4¶W•yŻنù:6mS‰7¥wúRdÓSdÞÛ\ˆÕ° ñ Nl¥¡§S,%Ë[â…J3¢ºgŒ QI‘J2¯žËf>Ÿ-,wuûôäΑóiïn7¤ºh˜†&ŠSsN:8g¹·J~£~DÁyžDŽ@€îß°ÂmûïO„`—Ž²sŸ[qRÊ\åüÜÕh’p—H:ôé€3lÝtÆ/2ú´ŠD´C½žq•27 ²éø"ÍÍUhçP +²Ì©à²™©q›K<•j‹Z&9ßÆÊ|oøQwl|â³9&™°·ú„ì¹-þϋ$ ’Ê“x/ôI¯^Š(=-:˜vŸ…zm¾_ô™Ü ÈÔNCC+\»æ'[l²GVN‘ÆY’`*<¿ô­ù8ª)˜©ØçN4zœ´›u(uå9¶9Å`ZV²丌չDЗo Zz€ùšúTêœj7cÄ"¬–Î>&'nž¨%>jílNx(óš™%ÒéÔäˆÚuùÞ­=³\Ï-Ζny–s;v´Lu”­1³Ù=w>DH‰V¯ýŸŒ(ðçÿÁa5(XÎÛ©%©,†& õõ~I”ùI­oølÔ›3endstream endobj -1374 0 obj << +1495 0 obj << /Type /Page -/Contents 1375 0 R -/Resources 1373 0 R +/Contents 1496 0 R +/Resources 1494 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1372 0 R +/Parent 1484 0 R >> endobj -1376 0 obj << -/D [1374 0 R /XYZ 85.039 781.388 null] +1497 0 obj << +/D [1495 0 R /XYZ 85.039 781.388 null] >> endobj 206 0 obj << -/D [1374 0 R /XYZ 85.039 761.463 null] +/D [1495 0 R /XYZ 85.039 761.463 null] >> endobj -1377 0 obj << -/D [1374 0 R /XYZ 85.039 671.062 null] +1010 0 obj << +/D [1495 0 R /XYZ 85.039 671.062 null] >> endobj 210 0 obj << -/D [1374 0 R /XYZ 85.039 671.062 null] +/D [1495 0 R /XYZ 85.039 671.062 null] >> endobj -1378 0 obj << -/D [1374 0 R /XYZ 85.039 642.326 null] +1498 0 obj << +/D [1495 0 R /XYZ 85.039 642.326 null] >> endobj 214 0 obj << -/D [1374 0 R /XYZ 85.039 569.569 null] +/D [1495 0 R /XYZ 85.039 556.019 null] >> endobj -1379 0 obj << -/D [1374 0 R /XYZ 85.039 542.954 null] +1499 0 obj << +/D [1495 0 R /XYZ 85.039 529.405 null] >> endobj 218 0 obj << -/D [1374 0 R /XYZ 85.039 212.156 null] +/D [1495 0 R /XYZ 85.039 157.959 null] >> endobj -1380 0 obj << -/D [1374 0 R /XYZ 85.039 183.358 null] +1500 0 obj << +/D [1495 0 R /XYZ 85.039 129.161 null] >> endobj -1373 0 obj << -/Font << /F20 877 0 R /F15 895 0 R /F40 1163 0 R >> +1494 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F11 976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1383 0 obj << -/Length 3686 +1503 0 obj << +/Length 3333 /Filter /FlateDecode >> stream -xÚ½ZKsÛF¾ëW¨tY0eÂÄ<Ú–²«”,y-f½©$’ˆ‚@Qú÷é× †$hmÕîºT% æÑèéîéþº‡Þåþ¼Ë4r'Áô2I=7HÓËEu1¹\ÁÈß/<™1¹ ÝIáÐûÙÅÛ£ôÒ›¸ÓÉôr¶¤)³üWçÃ?Þ}šÝ|ƒ pw4N’Ô¹¿yÎìýhì9·ß]~Ÿýtq3³¾?Ý0?/~ý}r™?]LÜ`š^î¡=q½éô²º£ÀÂ@ÞË‹Ç‹*<^òªmŽõŒ±7u§~4,Š1n=šaøкAÛÂHÜp4Ž¢‰óixNÖ¶ †ý(˜85þkòVoq€¾Ô"ßÐ÷¢aÌ6#ê¼ à¦ÎãÇ÷ÜX”…Ú »:‰³ƒïn·£±Ÿ8ªY ²VñÐv„/ØÕîqI\•9ÏÇ¡%Lª±Ñ@C¶4²Ž¼€›¯êÖª­‡±ïÜrÏ¿0ROH_qç¦æ'.ÍUÆ$÷kœA»I‘ì+¯5i˜\´. -4€jš’ ny»ªQ´•®@¾V%ý, -¶ðeÅ/¶,ô–z‘€x|žÛõÆÒÁÞÈ©7š8î`©×°xB ÍÄÞs#S…vƒ6@'è~ð:>cOܧ»Ÿáñ†Çi5·ë9òõ„¼×»¶|áÞ¢“g«Uû7éù9fÑr‡Þ*Ø<ë2î«k„^Sã2V†–-.`¶…RÖ™Nx›—8Zá|ź÷þóyæ•çlØ"¾àqykÕ¦-º‚•ƒÖFÎãH¤j•"]kŒD˜§lTųÊy–u¤NØI€4r{ïDóE³ØK²Uv )†$As‡lþdüÏÑt¼v¸á‰ŸµŒÔÆÜC/vöðÀø@q÷\< Ð7Á¸lábwçŽh$ι#Žcj³h^zãÁ.rb`¯‹ES·õ²ãnHk"¤¯ÚrqFIÃY.¾p#…„W8XgíZéù&°Àû~h\mËŒ -¿vê¹8EêÏ]!F*½BiÕù(R·/ê"k•žnÍò%ÉÏ–Ÿ?ü €0Øþ/?HÅ>£nºŒ?Áý쨽ÞVh«¨¡FÉ7Ð<ôgÄâ¼C•UÜs 0²¢Ó £Ë*u왲}Ö„'»¬Øô˜Ž X=§Cá–çU °k¹¶Ääz‹Ri€i£½ž“¦f)uüÚ[jƒ¡: «”…UaÕB‹Ž‹™Ή¹¹ÿÀúù„éÉ­ÆO÷n÷,àd‰ÎUÍH"´ -â)…e'^2…ê\¾¸Ó x-_ˆ8_¸0nã«ÀÄÓÏùn’NÏ|Í÷Ü(¾=<’Ž‘]ƒÂ­ú®¯±£øzt†HD8aqÎ&ìé)„¬|§‹tõÙqËÄ}ÐL¦Í4faGÑW| W·».'W >T#¨/7ÃÓ¤‰ÅPêô~)“âØÒr¤3è, -B«óRˆì(!"Ð5€…ôR¿âî3J dS™ÆžAÊx˜(ôu†Þ hê;3$jt3$.')ø,šâ™gõ°º‡ˆ ÏÃÈN8á«ÎÓðo`äfBŒ—Xu5cÔ@ ˆæ×ø®ÔÊ[€fÛ—yFþ -u˜fé£úØ©ÿœàü¿ë³‘à¼aÙ‘•ò@`(Õ‘âƒÀzœZj÷†Tu¤uvJ¬Ñfö$Š/iP -±èNÏûʼnÕAæ+À$þ1 À91y0ùŠßIó‘×)ìÌÅâpà€÷–Çb%øs©Uä¤3ã×Àçç¼ʨ2öXmzÌMºòxJƒøÆ4ÄLñ™ +yt{>Ûàã -'ðdá!<BÏ™ï$N™yÈ—ÊexU<™P -ctÄK)lHÙ#ðlºÜnÈ4W’üÃ8€P¦éhóàÚ4™‡»ál°ðcÔ行À¤ ±‹9õù0ÖR-d(;6tÛaÂxC®g%¥ç!? -ªlïnldNA;ÛnLÕà¼ïÆèMLN ¢„7•Aµ‡Mί†p8sÛÔ C*~´£±†Ä€§e4ã™tÇÉ K]XʳvLŒßÆH½f~«_û ¯[.ûÐÿcÖ9S4úA´·.–\]Y¡1âÔVÆT/Mé"n<“àç¯<€l‘ {r’¡oSëŽ\e%‘O°ÆF}ÏYÒ: R±G²*’œÎp°?ãu¬á-Õ;(0ã×,¡Q²¹™ó™ó¢*cA`7“O“A湕|úgȵT»¿½æ }®cɈmß@ ·ú”ÚªåŒä†uT= ûØ\n­êY&£ç/:”è(yìôegy¦ªz#>ßÔ·DöBdŽjY­^dÒF—©èÒ×ìÎxY¬Öd¶|溳F¨£KÊÕJÃ+‰-Œï#²ü˜s¿º©ÀÍRGì¬j¨”P¨•¹tl©tb`\QŸ?LÄÅ%ìó@Ñ׫Suä/tZ*†0=$ØÅîS§–”úa7z3|všâU½5 ¸²ra°à)0ëŠGX ºVÓ›fj|91]Wnñ˜Gý–MêB ‘[¾]!2™¬1Z8{‘IÅ‘V플ͺ¥­Qx &‰ì’4ê-’{€ˆq¿PÏÚ>ÂGRôÂÆaAMk~rE¢Ô‹´/¹©²m`g䨲•Uu %|hÚl¼§Vªå_³‹AÆ–ÁÆ!¥´Œ`Ä*†ð…I2a cûuÁY†)*!a“³ÔÆ‹ø”Ę;k÷/ÅRžÈcÉYžRÉ’Qi,! ž«ÂÊ’p¢§i-ðÓ¤cèÂÀÜ™„`†”6`oâBXÊa©jH¥¹Ç¹T²öùÖ®â¸9s²{-vš~|ÜØqh;¾ÁâNÀÑ*Ô!…ðEÓÛ§ÎË„!»æËUcËÌoÎYÈ®çJð¨Îmè -l¨°ãǾ†ñ¹ÊN䦞ÿZe'æÊεÚ)$ÎGÔ/$JýeÇÿ¸¾óåà\'ŒÛ“¨O+ñòÁ6Û„¼ˆ‰•:…‡nYi— “ØqBþA¦2ºï¿Æ€¿+3¹Ê•<ðZ Œ‚ïæêŠWqå7²`’*³%ȨìÉœAàG.aJ5dý³¾ˆb^«‹íýÕ$vcr ]×7÷¿kÄ›„nF†è«¿B\?þ ‚Œ|[}÷ô³‰7ÌØ54˜J|w:õ™Ôÿ•›Ï7ﮉ0adk•ìõ¿fÅ•/Ÿog7¯ð2uýIôxywwg89eÜF¤ßA;?âqúðžM…«ZŒÂIêÆpÎÈ •›Fñw3ðë‡Ç¾j£áâÁ­ª†:s;øÝÀ‚a~]^SÖ_J¾s˜#–¥¼Lͤ>ù#°T•v ÍpRëËzF'V ÎüFÀFÈÆ;™ Œ4Äî$<Äw}‘2ÖeyycìÁ÷|“‰s‹h"m/][ßM™è˜.óoYJÖÉ:§FS ( -ñÖtÚÇáT~ðœU=À IéX…™}öŒ/]§ 0éäc5ósÚ[û‘¥á°ðEe¥:ªZá=V;&fKö°Ó†‡;ÉŠ²Oq<;ÃéqX"å[l0^¡&±HÿèFRfÖ˜”g§€ýt ÇŽ™} Æúß|ÀËãÁ>öì¨äB`UEgß)àài¦&¾IVÍÍÝ ÿÔÂwêMŸÇxƒ’©¨«‰pXÑQˆÅ`B…Ð |Ú[vai ä‚1>NêLHòor†þ¢Q‹®¦ÌÀJú¥…‚ í:kìßtÀŸ¾Ê¬(ªSÌ—Ãœ“ÿ >ÂëÐYÆ;:‰éåÀý|¿÷‰åŽ“éîÏÏSÀ+îªþæ-Ö…ú.÷3æ7•ÛX—Š™‘2¹ÖFVÒ½`b–„Ä¥äã[^Í¿È9•CŸg]xQ‰ ‡¾”#}¼”B„ÙQÁÞ)ßWKÅŸó|aÛóMÆê¡»=EÓÔ?sÂv®–Ù®Ô%U_Ž8]é[÷eÔÃRn;«¦ªoþiø0©@N:m1Öò8žëŸA÷ÿ©ËþæÏ\C€cÁZ=ï¼ýäìÒœ‰Íà_’®Tendstream +xÚ¥ZÛrÛF}×W¨ô0e1Äsqv•r$¯¥¬7•ä"@0(ZŸî>=ƒ¡Hj·jËes.==3Ý=§/°9£?þeOgav™¤þ4LÓËÅæbv¹¢™\øJq­$×Íwßü8§ÙÙ4›e—Ë‘O<âðò¡øÍûþŸß~|xÿir†¡—L'×I’z·ï'¾÷ðÝäÚ÷nîî1ws‹ßoñóËí͸yŸ'AêÝ}úðÃ䇟.Þ?Ø3ÙÝhÿŒô×ÅoÌ. :üO³i˜¥—{jϦ>Mo.èDÓ8 +µ__Ü_ü˲Â\t‰U§î‡é4NÃcø±#ߦ¡\&ñlÏ"‘À¾«†2¬éÊ%ߘdÍ3ïÇIymGwŒ¯—™Å®#¢jà ¿`¢3«ò¾mzŒÝÓX¾™‰÷˜óˆïíäšÖ”J×5ÆŸùQ]b°ÝMfÌ5*Ë1×ßaí¸ý<‰câÄ*ò¡,Àq×[ïX$œkŸe—É]›v ÛùD€Q— ¯£Ð÷z^Øò4mDÃëíÝPQoóåï³xF}Ì,ù˜UÝ“ÄæIæ=0 Ÿ°ê1¿È4úaGW •QlqŠÞ¬È;¾ÏF Ï,å²&±˜ÍF²ª\ðøЊVd‘nLò:¾û–ÉÚU—ozn]=É0è+Ù$ÇÐ(öË·ÈŽ+ÙJ;¬B¦)±b¨6ÚZ´Âp+·«Ô:hAW­Ör‘©œQmSË9ÖeG<‚,d±p#RûƒH:R: ,DVa/R¬õ¼ª¬YÒlE óZ FM<ÈGìZ³ž¤MÎhžŠˆY +»‚Í YÙY×äÝ¢c>[Y´‚í]»—S-ä [jHÆÓv C^9ÄÓChòdïJ%¼Ù¸1÷ØåÒÊmÞ±ÙV²Š¯^çÃSͬÇ? Uó$™&Qò&À:4‚/ÍFÓ0š»ø2ŸûÓ,„>“i4¹Žã™÷q2Nôtý$œÑ[£º¢?wåñæaFšó`7F>ÌÏô$ƒŒÑ+ ŸûŸ¿CcQWú¼z 춪ƒn‘‹ÈJŒos˜Ûž‰[>¼ ?ŽØ•09ÝvËZ­‡È Ž‘­1Úú3ï¢$FÎg}™<Ø´øeE™ƒó~­(ð©×åˉÏ°úóÑÚîaêÝà²+ì±~Á²ÏËÏjž~ÔzÑ ¿A&³Mm–Õž/CrGyŠ†}µtN§K êNºÒ)ëŽÐ0‡ªYa*? sð}Ñ2xù©·ÕÆ|VÆgn}÷éýG"øðËý;ç -Ú Äê¹jw…lƃ0®U}ó•6ÿ´tƒÙ¨q!~-GG ®yÉÉwЂ +Õ¹^“H+3ôV‚¼-ûc-è üòýÒ°%}!ò8<2h=ŒæÔ¯­Ð+ÒX¬ØX< % h±@TM¿V0e×ëH¯;lª/âÃãÀ1+ž"‹Œ1ñ3ÐåbøÒbWqs«¢ àéÏŠèžã—Tâ— áȹÁÛ½h»ÕÉ1r Rö™¤"jq´R©ç¡áGó\i¢„Ô$ÆèÀd×_ ¬×%WGêu9J»¾© +âí„doƒ‘Km}V8‹|7¾`òe÷º ɈXÿòÍÃ,P{¦‘Q ëS”GCÇê*°ra €X `_ï ÌB¼Ÿá-f'ñœ­GYâ×ZêÑËQ9ÐñšÜ ~·±È?E±?Zªm&{óìÕi£Õ!†]a…£¦Ù¯Y-)Gº·ÜÝ÷ vÌOöm1\àEq³N…x(ÖUaâgØýs¥ÁEÞ6ŠÕqq NbP‡±„Ã\Dù[QH¨-ØÍŒLêÃ`|ûà„öâ&ÿ/ï+œ‘ÈŒ»m%„éÁÌhúøðhÙ,º—Q¬<´)‡5€ŸJ–™t@Ws›Ñ‰½?·ãUu5ÎVz·íPšcÏ=(cˇ𸟊•FArâF‘1ytŠcØJH'fC”bŒhþl# űǀyëCDØÇP?¬aºÌM¹)vF¿g­[,ÖÌ­Oz)Wâ¦f>Âxn\më\ï ’,¿(Eù×>Äät‡Š¸%D”TÆ<^.o\ƒ1;V„4uòëS–O8ùë×#Éf ¶Éòê2A&>YÓïºò ?¤cÔÃíÃì7Hç^ouk¤Z`Fòßq©¨³Å)òª±cÊARiÃPêžr óÓºÎÖÑE›úäcH$xñXë1!ŸQªBĘ@ËÛw<;ë*Š¼ûÒ&kÍ0µ +°Øm4ôq Š .·ß3ƒO\wøõãÃÍÝítø¢z|•êˆÞZ'ø)ʉøéT‚Òûi¿J84ç󚈥š×ÄÈk>h CïöI£Ó3Ç ´HÂðícŒ4ç3š0ͦ~$+Y0¾ÌS¨Àq4L‰ xÇ1™<¯‘®ÝÓCè±²Ó”´Æ'Xÿl(—˜¯[™O;‚ äJ¸Ãö&d*i”ð³Öy­3©£œsX}Â)Ff@âªÏEÄ'„@¡®5äÉ%¾ßYÕ¹ M¨ÒŽ8’Ñ°è¾»ÿæ³( °þ›§`ßÏ•@s³1`p1u f%È°3¡t‹~ÓÁHi)LÑi­¡Íqû°y¦’5´¡$Q_¸Ø§Fú4ˆ¨Q˜ñUyBÄP}Áê×9pÀ0–“xÄ…A­˜…ª†5T‚C[+ Åÿ+B¢Ñ74µâ“¹º&_Ï Q×c±Žg-8–JooÎ3ØIê‰ðŸ`Ò¨F>µú˜DýÍT¶ºU—‡å9fm£ j¿â¬Hk)k&³Ó÷®6Èd¡M“¿—ñ×£”cÏFYw&¤ËÈÕÑ2‰? Šf³ãº†Åaf3Ç…S§huôà6:¶P³¹&\’°EE楃9ºa€_œmÖ’h¢¯VMY¨ÂhMÇq:—VýȦ¬çžÄ'ö•SŽrŠdî=RÍé>»¼:¡S©%jët.ƒÊżdU=»‘[ÕDžY`ƒÐG×^—Ú& œ$'|1øµAÞd>”cyá(ä¸ûÀ^2Ðòª[±’ jJ²»¶…-*Ž•:kS*y­edDzBG ›¶äÂå[‡Ui«‘&¾FID|RìÃÊ·kTÅú7³îŽÏ¤dxx>¡—w­B±tmA+$üÂ3y”gÈýWŸbWmÄÞá¶ÆŒ7NÇ°†ÚbôkU§VeèU@—Vé}lÁ¶dVÚèédýw‹g'ÿV¢ðpî¼j÷å.µdž„‡„J”ìÑ!*óÆ ýiä¾Sî&‚¦&*ú:V”y­{Ý4ÎÁn)cgžÅÜâ{„oqv²£þ{’ÁX`äï®k.4²ËMŽÆ¥, %l˜EQ‡ö ½Úp_,¤Ê†ö*ÒÕNÕõŒ Þ°DRÎÈ{Þ$µI·~¾B~ö•R­Ëz‹Ö–ÔÙä¹õÔÛ¢sTÆ$úƹð•„÷°J­¨•—(rµÒžþ2Ãó-®B~¤ZjôCÝÊp]Ç0Wš±òaޱȑàáT¥Ö-PnOF<žëGd- l =ñPŸÔfú|ãð·Ÿ®ßq±p®Õœ¹[œòIe-¿œ.bqÅÿ¹AN'‰˜ÖZªS—D¬6Ê<û*ëÚÞ$B¬Ä3Š8Ï,<°csˆR)ËÀkÝËÇÅ9™Š€ÌM²nÈgEúµen'£;ÉÖCfR.9ðfKOι»-U1ÑëçÖó;û/°e>›k™Zýb×uGÅ@SƒvkÈÔE6E€Ôh9†šýn;±>¥èÚ`U¨õšp6 ²SÕú‹{ü_ÿ©Ç)=MÓ0;]ò‰ƒd:O"= Ë-H_×üߟ£óþ ·Ìendstream endobj -1382 0 obj << +1502 0 obj << /Type /Page -/Contents 1383 0 R -/Resources 1381 0 R +/Contents 1503 0 R +/Resources 1501 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1372 0 R +/Parent 1484 0 R >> endobj -1384 0 obj << -/D [1382 0 R /XYZ 85.039 781.388 null] +1504 0 obj << +/D [1502 0 R /XYZ 85.039 781.388 null] >> endobj 222 0 obj << -/D [1382 0 R /XYZ 85.039 761.463 null] +/D [1502 0 R /XYZ 85.039 677.747 null] >> endobj -1385 0 obj << -/D [1382 0 R /XYZ 85.039 739.701 null] +1505 0 obj << +/D [1502 0 R /XYZ 85.039 651.132 null] >> endobj 226 0 obj << -/D [1382 0 R /XYZ 85.039 547.122 null] +/D [1502 0 R /XYZ 85.039 431.455 null] >> endobj -1386 0 obj << -/D [1382 0 R /XYZ 85.039 515.597 null] ->> endobj -230 0 obj << -/D [1382 0 R /XYZ 85.039 242.391 null] ->> endobj -1387 0 obj << -/D [1382 0 R /XYZ 85.039 212.987 null] +1506 0 obj << +/D [1502 0 R /XYZ 85.039 399.93 null] >> endobj -1381 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R >> +1501 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1390 0 obj << -/Length 3974 +1509 0 obj << +/Length 3663 /Filter /FlateDecode >> stream -xÚ¥ZYoG~ׯø’!2s/ ØŽ½« ’H$y‘CjÖCŽ<3´¬üú­ª¯º§yÙ»XÐôY]]]ýÕÑ .}ú .ódîGÅe–ó(Ï/› ÿrM=ÿ¼t„Ïý4á®×w?¼KòËÀŸ~qy·’!wË?¼7ÿzõáîí¯ÓYE^6ŸÎ²,÷nÞNïîõtxWïoÑwuƒï+|~»¹úK±w? sïý¯?ÿ8ýë·wÎú³x§3ðéâ¿üË%ñøÓ…?Šüò™Êþ<(ŠËÍEœDó$Ž´Þ\Ü^üb© /¾Ä¬Ûœ™³ ˜arZ3ÞzRXa„ÔÏ£8u…‘ͳé,I|ïnZ„^Çû/Ÿh—¾·léxí”þQ{”fÞoW?ö'¶γâ a0OÒв$'΃ÅëGÞ-Àõk”ûŠéûºÝrCè-„1­t;ªåçzxD©ç!Õg>™ÝÑ ²=žP/é_:ÈFÞ@M•iÓBO'" ¦ôÑ’HQb:û»Çz¤óH² -¼'_mµñù±RæÊqup×9»!h•”«œl!røₘ$êÏÓ0ó´Ah=òöºŠ×¤ÓS1Pç’ÙûÓ",H¬Ðì}»ÞJf[n cÞVÑñç±Ð'b‹Vw„YÏ<Ž©š%†Çº7¥ -SäDê/ÊŸ]Å= éâ=K½Z*ç|ºn?®´àíêr8¼= %" Ù4õ±´ƒP™ "HVËOèóªRñ9ÌÌ{¯Sûv#L¡¶Û2_0Mú‰/™Ëu”=Öaí}ÃÞ‹ø“Í¢`µŽ1ŠCÅm;`>$Ý’ª?4•rugglªr«EÙj9ØžÐÑöf#¤«æTTæ=ZeœŽX4õ¨!„qµŽ!źz1ȼ%úÌIQw‰–Þœ×vÝThÚÉ5› {zÕ]oÚA„ì»ûñ½f¡Ýñí(¼îyA··oÑ¿®4éûÞdû ñ-í·Æ혫圭0Û—k%°â9Ê-p@çv²é²o·r9¢ÔûÐT¥•«¯°²ÑÖwÓ ͈_dÿ³XÉš$¨¥9•¡d^UËctÍãy§ç >›Qø-ˆÏñ¦žräiêmw\ÙøUg1þ ùä€~G¢¬ø8rÑ'þ–øà ††ÌSÝc0$ó«v|Ãw\D%!Yè„ÌëLáÚŒqÔ,Ö¨Lär0|wõg9Q@f‚1¬]„ºr#Ìò´ ¯õ êtM -ßïbß òy˜‡* `Äžðòyœ'Úø¾ Ù1œ-¡Q±ŸÎ³4sQpÑnu»áGÆ䃻Ë×È•¡ <£>QI°ˆ$ÁÝŽ$¸zR݈¬l&™’,[à£bµÅÅ[Xd!Žkeê7Þ©Xª”½Y‹•cÖéŽlê)ÛIòBZû4ÔM.|µÒëj Îâ lê~ÐùbnoA­tÅEßTžÚ( )&3•Jÿ,‚^·=¯’ÄÞ‡7ø>”½fB–Hœ¨ÄÅv1µ ŒØNüšG )µçž–_ݯµq«”îe«7wL\Mu ØBº‰Š©iZø(Ò¤îs°wÝssî•—a°¾³³ ùÔX°¬šöTHËÒ4b¤™òÄ—¬G±Ÿ`]–#æ¿0ˆÙŠýÌz}\¶ÉðÀ#Û~l6ÒèÍÔÛ5(µºÐnù„“±>r yHeÊäbªŸvfµîó`k>QóúpÒ\X÷$ŽIäêÒ°zIC‰OßîäZqù€jiWø‚¯,KÕÍà6óUBO]ËÂh*¡ŸCkØæmÇ‘škYpÐn~@Ù¨uq¸§\²²zl6ª%Gþy±qg–~fâeÓØë—%.%Z®¦pDÛã ó ÁårÔT㸠C¨*?ã -©Ç¨X˜!¾Å¼=Í’= µ¿—Iæ;pIÄ¡wûÚbŒâ§Ï꩸tgl¦íÂ÷UÒÇm5ÞžÊþEQxUЂĘ8:SÖE\Ž§˸̈Q|£.°E!Ô¡’@¨äý5g1ò¼r|¤Ì>6h†—KŽaÛé@,¤Ó6©¢ü@Å´Öí4óáÉ ;ð…+ÙÚž[ÇÔ÷®¾3xÈ#W­ø"K,6<ŠWL¥{×ûõ÷ùŠÆEr%·CÒ:·£9nOYûQèp’*n¸Ò1´øº3À¡î¹Âˆž7Û£üiWuu¥qËä挾S&p¨¤u‰M9 ¬$\~–-‡FÑ+,ÊxfneuBõÝÈŠ zTØð×À —»ê“Ù)ü” W´óÛî£VËjp5`•ÒÞ”²OPé4œ^Hֳ쪑R®×-Öy1PÃÛ!ÑÁ‡iá=ì€â²/%{ÀÁájÖÃwª„E¬qfa©#ú­ï豎N¸® çÊúa\émO5q.‹Ø„\ΤƒKAæR°uS~ø ìePÖ@2b\¢ù/¨LæmðE-ïoÝx¶Ð(—Ü)­½œÐ–×:èÝm÷=9(ŽôÂl%Ý“P,nr-:›D.|ËŒÍãk²€£Íø^[ô¹\Å5$Vé<‘C”ï£`†›Ãíb†k›| ®ÁaL“ZÙË86 ð G\ñi4{®KzWpÖ*ŒkÄy q&…u; 0«ÆAAŠ¾là–>µqšLÞOIgí#ŒQäšVÔáÙÚ눇Róx`¨çl¬Ž¥`¨¦¨¶Vn´dÀ“áTÌúîMË&ó<¾³&f×h½EXG¾`ƒdì–Ìæ©©¾@€§Qþ÷älôßÅòq¡€çêl›ÛÊ-ˆ…EÅ™Enn«Úô©‘¼å~ñ¸Íä~¹|HJ€:õ®̱¹²æ=fŒ)ªT•±B-ΗæÜä3¬=CÝnÅ©¨lëX;Fû 0†¹eÅf3BħáÏumÌVg3ríJAü "•,Ö S’±/t…g6IDÃβ£2rq„¤J?O¶õ6¯ÇÝ+=ÃïVSªÛ¼¶r¿­žQ@êÔ9Ó¸áäÛõWÇ7åöšÊ¯ÍÅ:Ô­‰ÅIõ…ÐF¢/Â$¡;Ùó/•?qf˧R¢¦ÈýøŠ7(þ^:Öa2rJØ3˜lŸ³jJ”†ªsø‚ÖIW#î˜0Ƈä÷pÎü cSx9sO -±jaŒ,~)¦,‰¸ˆÞ²ug‚O©S ;¿Æhó4ÍÐw¥FÒ|Kâ{=ç îo?2{ïø‚¥‹x€“¯Ç(APúZ÷ˆG-€Cè74(6*»5§´S2ç|{¥³1­tŽyªuh=6¢ç¾5É#•àoרùp˜ƒàõíæk1Ó†¥Ã>¯Q曂¨\ÒñDB'4—©>þ-ŽVn%c€0/@¾Ózƒ¹ÆA»½§™ÞY°Ý˜ µÉ%&&zÑc'nØ7$¼âñ§ŸZ,…1ÛÃK]ñ^ ˜ìö‘ï¸lml§#ÏO®5¤÷•íM±ñå€g»Xcðƒ 4BæÚH@Âýšâ”r­‹<ŠKs°·A΋§TÝPÊMitaxוMïʼn8¤qæÙSÔT³PaÒðT¸¾=¡ Kå·±×ÌIÓ)Rõ»ñéÏäYl&OqO"/]]jk°)ºHó&,çq¦T—£ìFÈ ÓÞª–Ç¢óÑ/+p–†”qeÛݵN|'ï’K6LÖÝOÐ|„5=ª!ç!Î\0HÏýÇHÏ#8 ©Ïvë^×­Í3+O&u {OÎ!šYŽÌ¹¨Bœ«ä¼JŒg9ñÎÙcñ§dV½6yŸf'¦ÍŒÙb/—^*ÓÔN·×âaæx:ˆ·7r…G*ôA!K-—úúb^–´„þÑ"'ÔY×੘¡‰#Έ>?Âÿ?²V— ð~yµddk´ÕÂMeBã[MMõ·SMØî6*Õ8½WroY5V˜»‡¨Ü1”.gŸæ¡]pHzißÃ܆-G@e#ïr+zIfÞ¢3×ÈšÃÝ‹!¡>+ ªë1òL¹O(ðhÿÆÛ~¢NÒýg[Ì›ˆ.°l &é± ~dIvn'B“¡Û-†]熾©û(œ²cÄFZš£ÒÐ`#» -ó·Õ’÷Mpt["c[bÀ1¢é*€i*°)Úéj!–À¥pÜ=*Q¸tQ¸ùœ7Št(qvu*H%þ¬êMò±Ñ¬eŽHOÐøº7ô•8~b#«Ìïªê:QÙœ“&â%Ÿz›üœ…ilÝ.g†ÆŠ¿x?Ûßh|¬x<Ð&#¸rÂ×Y_÷ãn7DÅg"a‡<“ÖØؠ—ÝôªYbêócmÝ/êë°oQËH%ýl’LF|GxÇws/fœ™ÚýMW ÁÙ -ÀÒˆŒ£b„ZÕø؞ʽqþR£Y’v0&ÆL2ý±jž´ˆh®ð6#ŽFæ·œ~çhaã<:N#³¹:ç³›_§E¦xQ=Ü#qÉ÷~µÃÑ2Œn]ußò¢"?Ñgìd?xáÇìí§^¨Ùü4ÍùÅ µÚX˜ÊN/øõ¢<„ Ÿ_ë;ºaŸßxïüú C\’¢hßãW*6IóÆ_½ ½÷ñsPG‡ÈK sz«’£‘$Ð—É RÔµý…K©(¦¹>Rðزnt¾$}-Ü\G¹y3¦šh)c¡J›ä~¬ºâRêšäcñÙ†Ó©DÅ©±×ÓáÂfU¤&L®€ÌéÌOh¨“õiûv%>$”[è›ÅfnµªåFngb~¾–8?„L¢SÙj}sõî“ØÞ½ŸP¥íÊ^*Hq|âFÿ»Z5U³É&óš„ðL ºÃP°ô$j£W3C.&P¤{Ù6®+¼æ5àè òæ$?»J£h/÷®ï›E6ÆETÍ»ºÕ&<+ŒOJ<¾m”±Qí·hP‹½ØmœßLÙèò%†„ãkÒ}ÉÎü Y5äÿûApÎÓ(±êöÕŒm˜²¨c|—Áÿª\8endstream +xÚ­ZIoÛH¾ûW¾„"—b‘¼ Äé7'(ð zú@Y”E„"’òòïçmU,jqkç«·|o¡Âóþ…çYâq~žf¡gÙùíö,8¿ƒ™…²b.KæΚ·‹³ü¦a6ðó ?_¬Çs_%ñùbõ§÷îßo>/Þ™Íã8öR6OÓÌ»~? ½ÅÛÙ<ô®>}幫k~¾áÇ·ë«ÿ`Ky7³(ó>}ùp9ûkñûÙû…¥É¾ ÞŸ#A?Îþü+8_ñ¿Ÿ~œgçÐü¦·g@‘Ÿ¨XúõÙ׳?ìQ<§Îy×±û›ó0÷ó(y™G:ô•Ž-"˜U~¬4ò( #?£ó4 ü$PĤÔ׳y’ÞeÙ<íuê}láx«™ÔŸººJý4T/3®!bÂĘ%&Ò~˜DDÌÍ„C¯mfó(O½™÷õ#Œ¿ÅvîÝÖUÙ \žkïá™zeÓs_¶ü/Uͧᮠ+š²¡èñßgx7š[C³í&»ïa¨è†êvWS‹G/Vüæg&n‹ç¯`deè¾à©¡åKš-ÇCëâ—•+!¾Aö×æ!Ê8'. CwÄ×(AwHd[-‹zY²ÊÞlI‚KÔòëÿîË.MÒ™>O÷:ˆ®¸±¥ÇÕvnΚ;‡J9J´Ÿ'¹}#Þïúák&÷šïI£ÌÂô—jÎz™Ô8Ó™Rúåý›K"3ôNpT‘¯TòKÈ4g½L¦ +0ªlBçÍ—«Å{Kè*³Ø³ü×P)gý„ÊL…*ß|øðšÔ}§Êפõ Mžào¨KóužûAò÷(7gÍÃŽà’Êü(7‹¸ßÐêß!éÈ+ íWgv€–Åé/!Ùœõ2ÉQ ›§_‚o  +B&”0O›·¢Þ3O>\)`ª¶”„k÷›v‡&7_š³ˆ%uÝ"‹gŒv–?K—x(`gaO6–5 ©D‚¯Æ¸@ø¸AOÀ7t•E= `qf7“»•2ý´;‘béâåè0AP£­ÅÖlÆ·ªâ*ˆ °³†Y ü˜¬c œ@=Áå¡Gý[(%gÍÃŽ ”Ž! +í LñݪžŸ÷àgŒ°‚¤; ¼yÍý58@’C”„~ ó‰ʧbËúcwÄxTíÂ8Eê CiF¡PZn¶ŽÒöÈФ¦òRÖ-ã©m(ÐÍV¨“w¼ÄÑI\µ.P€µO7–¹÷øÖàü:SÅúÞc;ñ&‡Ë;\ô0KPë1á€CÁ[šV #J•€WÎb³»ÚÞ×åö`Ë°©XOñeh˜ÀOàÂ[¼q×—2]Vƒuño¯ÙÃßâ‰ßy½Ã+‰Ñই7^=†q”ˆ +¨QýaŒ£‹ž;UÓ’lV2Y4+Þ!q‹Õ'ªä°‚—ö¥‘xуì¯ù¸[¼éw^¾ª:sµÛ¡ížy”„Œ/änoѨ+åul“ou„[NÔÄþ9oζ…/PX )çÞÂ\‚¾=žÆ&d”ém9lLh)[…Ÿ»mÿÌmã pómÛô»­…( ÷:Ã$žnÕWÍOº[彇`Ç»HÇ;æÖ*1š ?à ·˜¿Ð?PÊ ²"…Ài¤7 På5XÄP˶{+«õ¨¡…w\boá3µÍÞJó²%û€Ã»®ÊuA¶<ˆ-Ó'}mGŒùÊϽàL?b̦œxÚ=ÃMÛÉD5ø'ò™–P§/æ3ΚÓÉU’ê'Z’«”“«Å "ÝŽ0ìž“+ÄC˜¬Ó®oW—§’­D§~¢õËÄkN'[‰Ò~ ^³Ý4¶¹ÄdbÇ=±‹¤kH… êÀ5vÒx4Ë@D´Œ…ô@A@àIƒ§«ž_ÐÊVV_˜¥H€^míÑOQÁ¥X­€'.Ûˆ2'bçÙ#Á©Å!>À"š†€<­Ù×”ç6‡…¸f°ÑŒ ¸f&k+Ò9ž'φ :›¡âÜ£Y°/eÓF`JÓÑ…€ýI£›”7mx’Œ¡2ÄJ¬Cï×vhX,ÓN¤üI2¸xIIr¤`¨¥I2Øð0Ò^™µìšüaÎz’$9&ÇQæÞ'Ù×·[cÍø¦Ü"g’QkMØ¥¦BÐ…¾ûDÑí‰ô™xOpÚÜ@_’EG¤£¢©²ê²hdï@¸¢"£h9ß"gq)RÙTON„Ê»xW¸5 <ÇPÅaMÏá-ë"‚8.!MŒÂ©*‘‚© wÕŠB‘!ÏuKî8I™Hèp¾ÃŽönɲüë¾åù»rpvÉ CW0ûV­À*ïc.xÕÖÁâ®äk³´Ë—fWr%Æ$d I{Ÿk™)ãšÄÑi‰Çx^A¢‚1¼ÁÛý±çGl‰…WTuÊ(ÀHýOà¬9í ¤e™Pœú{‚Ï3ö9BÖÚkv·Ì(¯Š)N¹sè‹ÔkN»hH 8[\€PHR’AÀ³à„5ÈÌ›ØqTÅÁƒÊÅ6°Eê[WÓˆY3«{S1K'@O«Âi.»ÈŽï6¼õb‡jrßU8Zƒf­.x™ëâa!½x·Åÿ¥úƼܳ!Äî„nÝ°NKKþ)ó.÷2_eJæà 8ÃŽ• —¡,kÆ(Ç4£¬JöÀ¸çIæÌ”…À]¹AXõ0Þ'·MŽÞs×,äh·’w˜gÙpZe¢y6°ÈO£tžªájÒ76jR^lÚf.ß<´ëmtH‹b„”W¦âí'}tÏœPž\sQµª¬³7ùÜðÓa +®?ª´°Ä=PÞæ0R@±žÄÓmœŸýù?1Å2nªp*s`¿çRºÐ;ômpù6xÞ¬oîdÄD×8J×¾^ˆ¾¥ˆÁ8òJ¨Y·õD}ÒtôƒD +Híd–ÈêÈ”²eÓ'çg×™A¦¥³1BºQTf‹¹W»ºjàa¦ÁÒܳæ1,)éÇa78*»„J™ÒLbÇœ^°ºç1× Æ©ÄÖ¯¹Â±äØ»+)1ÒXUø±³^›d¤%ÖmÍ´–9S?úvGöƒí{Ò/JJi×ü$Zæ xžÑá@ËjeŽ#^µKËgy™D³Ð2Îúðb(#¬#›ÈB¢:ð“ƒÆ8Ö¦À’‘n‰“0‰gWR˜[ÔõXXÝaô™ ÝœA׃½PáILùOBÈFŽ¡#…¡îñ÷…äÝÆ« ý¡’qÃõ]½Ž„åÆØ¡ËÆN…;*©X¤éœ°#*ûõ¤¢Š¦2!ÂnŒ[“ï+°lbÅ‘³!¶>Õ¨3UUÒ¢¯–¤âÔM4º-ù¡TÛÆÉ|%°1q“In)©2sk)½ñÃÊ;{ú «—R÷âP¸†ÔÀ\ÀhÃI$»W„‹ÞŽU61t"…ˆVŽÆ7Atê 85I&å(Â7œ•Ýø¥Íž6Ãn|#¨©S*Ág ø«Wæ¸dMåtÖÊä0 ûSÐxƒpsGßV” pž %Š=>6nH篰MfŒ©!QY^ó×Á,qp?V’,9¼,ö6tv²NÀ¬*¥O“©‰@€èˆ’a±/†M[,ØvÜ~ä`ZVõ2ííÕ pÈ…]ÜG:Óó9<ÂTâaÌj“ÌwÁÜ7t„…œrwß{>C¼·ÉÆÁ°má8“ª #ɦjÆôëIÆÔGSÏ >¼•$Glj±J‡“»B¸ùšë5Ë Œ¸Ú” S‘Ðë󫞧1õñ”g8YÑ}#A„½O{Ô‘¸´|Ñ\{fqBÒRÖ4(Òh1ØE(a¸#åDïd?uk†šÜCÇÄ£ïL&ïŲ. +½Œ|ÉQÄzóL.ØØF ç®ñøœìЛ.>žDPqtlCÇ—dÈšFvd©ýi4ïø¥fÛi:5(íq‘'åŽývV™`GÉåâV+Aê¸Ä'L†žæÒ!T·V@ÏÕ˜xMË°ý€•€ý‚¸. c?dä¿c—-¦YIá´Ã‹KØó£’.“Û¬D§ñ[‰ó• ž¨v÷¯/í²°ÕöXÉ<jð0ˆ¬LÄ C“.}x8ýƒ ºŽ£ÏR9’E‡Iæ‡?ù)³ætŽ*|Æ’ãç&Ç—ì¾ø§4·mÍyþ»kñO¬r0ñ|Š¾8÷“èå_×8kNgùøY5×á$ËRAhlÇwÆŒ³¬÷áÀ­æ©ÚqÛuÁ» ë= +ƾ~|˃x–S lkŸ?p] ¼PŠ8Ûž»RI€¥ÁuÎðüñÃ,/nÆpåPÖA·ò•®¨«Á\‘‚ÈHr-ôY+ +£VO$ÊCó*—ò<…àŽòÄ6Ç{ÇN¢Z%¬¸(Ÿ©q–™ßCM|Qp·Å}A¹ ˆ¬2òý04]¦*0¤\¬¥ÈßD1Š%7cÄiÞ¥%åÅDG/¤‹wbK"È㰚ѕˆ7Æ¢lÔƒ{žEˆÙkž\µ&Â^éD*<â|ó;vº“Ž‚ùŠ©bsuLš¦ì€íi‚! šÒV)r©úçùøû4\2ÉøŸxÌÔ °Í?…»+‰ÅvŒ_AkSÅ¡§VÇ‘-ü(?†kðÇ÷ÿ[¿¦tj ~çÇÁ1‰R_§JhA~Gù>¹IœùIÒûš…&úendstream endobj -1389 0 obj << +1508 0 obj << /Type /Page -/Contents 1390 0 R -/Resources 1388 0 R +/Contents 1509 0 R +/Resources 1507 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1372 0 R +/Parent 1484 0 R >> endobj -1391 0 obj << -/D [1389 0 R /XYZ 85.039 781.388 null] +1510 0 obj << +/D [1508 0 R /XYZ 85.039 781.388 null] +>> endobj +230 0 obj << +/D [1508 0 R /XYZ 85.039 761.463 null] +>> endobj +1511 0 obj << +/D [1508 0 R /XYZ 85.039 736.911 null] >> endobj 234 0 obj << -/D [1389 0 R /XYZ 85.039 761.463 null] +/D [1508 0 R /XYZ 85.039 586.167 null] >> endobj -1392 0 obj << -/D [1389 0 R /XYZ 85.039 736.911 null] +1512 0 obj << +/D [1508 0 R /XYZ 85.039 556.763 null] >> endobj 238 0 obj << -/D [1389 0 R /XYZ 85.039 641.966 null] +/D [1508 0 R /XYZ 85.039 446.667 null] >> endobj -1393 0 obj << -/D [1389 0 R /XYZ 85.039 613.231 null] +1513 0 obj << +/D [1508 0 R /XYZ 85.039 420.052 null] >> endobj 242 0 obj << -/D [1389 0 R /XYZ 85.039 391.432 null] +/D [1508 0 R /XYZ 85.039 158.125 null] >> endobj -1394 0 obj << -/D [1389 0 R /XYZ 85.039 362.028 null] +1514 0 obj << +/D [1508 0 R /XYZ 85.039 128.721 null] >> endobj -1388 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F40 1163 0 R >> +1507 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F11 976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1397 0 obj << -/Length 434 +1517 0 obj << +/Length 1931 /Filter /FlateDecode >> stream -xÚ¥RMSÛ0½ëWè(,$K¶¥#ÐP´¡w`88¶š:6µ˜üûj½N`˜ ÆïÇ{«}»+©ðŸ¤&æBYšÉ•1´XA}æ;‘BPÍECê$#Gg±¡Rp+,ÍV#$+ïØéùñ¯lv„J)–ò LSó@²ì$%›_^cn¾Àÿ1þþ,æ·`ivD†]^ýøÜ2îꆿ¯øóçÍÕW\EΗy:>¿3ÿ±~7¹\[¬4¿B…þž|ûáMsPþÝÄsÃU:}€µçú€®& ‘G¡ìËÉíä“eŸhʧÎÝ?S7Nñüx`ßÜЦIì¹±‘t?_DÁÒÑ~ç'Þ§hšk0ÅwÏ_¢1²C »žéú†)*uO'º+*^m€ôpÇ4Û¶(жAä\ˆ«¬–á‘NnU56Š!ýN ®Cm¬Yˆë¢v[¶M…¾Ã,|´ÛŠîÙï…RÃÕÊÙ·(vSÕ 8çÇ ¢ äÕ"Iêt²ñÅ"´ëgäg¨âŽJxA“Õ7kÞå(¨þ­—ƒ‡=ì÷óplZ6&R}dêŸó8v´êuS3´Ùòwtf|çL•%CH«:ÇEBîF^—4NVŽB·VȨé±U{E—)ùð†/HfÍ %ì +•« Ú Ù6-/®Ã-/sccV½lÐÉñ¢†’ŸµÀ!Ȇ—é®-è~­rNR²|oz}ÁéŠ&éÌñ„+Õ²˜SÄKGi4Š‚qI–$Ñкë]Aç’XàbC7j=ï—1~#gÖã]RžØ`ÆàSSÃ;Æéš™˜ “åñN€ßSУՀcÖ” ýîÅ}}'ŒJô¦IWËeA\œ¹áE[°-= •5Ë~hu_€2;ŠÀÊMU0žíî»|JÁèš’%¦O.઄€#¤%#ä~Ý«Áb{°\zMé%txccŸ¤· +pã¼ØaäG1Z¿žSªã3´õñ"QXYÆ‚±|¤p^Û"§Þ4ÝGÊÚý'X¾ÊsfM‰ˆ‹›¢¿eÛt˜Ú¾sY+P*Še“Uì¼Â,FÆ`ˆg +™ Î…XƒmEÆ›ÿi­P%ãš=Iª7eTXº¤ªÍ†ªî +C)‹d¬8÷ˆ0TÓÞS|Î5° VÎã9%óæ)*ìô =¹+ç8çH#VÛH*E^èÌ(²¶T%È|J<„èü{4@É2|gÆ8²lN®ÊxYp„ „CÖZtãÍáÚ8¢ÈÕðwcrUm U¾ní! x÷Œ©¦ÎFq‰²½g/ÖhûŽK{ Ù¤V0–ÂHR’×R“ûÄ<3†m)3*CäÁ˜z7×eÑ áN§S`Fv ¯1T‹a-ÄÿÌHp‹ãÂ]Õÿ‹¤u/Ÿô¾ ßœ«eÑqoFÃŽ5 b˜YØÊòÙn0p +Ï-•2.h–(ŠžqÒƒI‰‚BöFv-*À÷×L3b0cÐiíÇ‚”„Î~3žàÝÆ/šºx¶ðïmnc^;@ †·zäõªt«˜w¶O F&!à .‰!ößhF¸×'1&d@Ì#Ù“&ŸD&ƒìäG4}h–©½Â Ð¥¦ŠFôÝl\A``ŒŠõƒ´|Øéá ‡)ÎA]P8Éèa¢‡ÚTó„#´Ö—|¦]äÃÕŃ T()e!¢ô›iñ¦È ³c§<ƒCRaæ;ÓߊroÚ'‡F/×E[vOª®ðHÉá.ak¦ÎÁ,EG´p>3x„cŸ‘hlmÖÒ†«íU5bE îøU%¾‘X‘Íñ ~Ð=FâIÔÈ\£ÁÜ•éL™z—ÆÉZ__~8úºvCV/žÍ-S#/2½%B~ƒÓ5w +·vú=’^,Õ”aæÑCMs•¢B6 ̵Â=Ùð2kÐ?OåW2p®#DWG“a™4èÞ(g“‚3ðÅ™à„Y‹¤ÁX +§–ÑIp „Šàò8ðFK¸W¥ît­d`A…‰s­³¶éšmÏôm‘‰ý¨èòK +Ûr†ÖP•íÑ'2¬Ãa=ªG㛼¾z‹gí×MÅo¨šaWbS?m£ïÿVK¸† âf*é‹Jz$€m5ú: ±õÔ KÝí +!ƒŠÃسµìàQczÉt>*”ô¢ RßZcî¨äéF0l'É3<Ö`‘EÈi¦ Lšov0…¦ãC&5p=|ÓV«®×8í 3êÿ#Ž2R¿ùÆþãG1<¥m“S<“±UÀHËÈÃ+µêã’V5Èà•n~iP0AÉKO^õòˆ¦õŽ‰Ì¤lPô2Ìl»ÅŸøˆÄòbøšNé·ñ]+H|+Jw)¿†È Èmµ‘”÷³ ëkm. ·íMÑ>óƒWè¹ÁêÜTðÏúü¯ßÂìO}Qè¦áêü]q¸Ë$]ðþ¡wª®ùÉl¤ï¿8ãendstream endobj -1396 0 obj << +1516 0 obj << /Type /Page -/Contents 1397 0 R -/Resources 1395 0 R +/Contents 1517 0 R +/Resources 1515 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1372 0 R +/Parent 1484 0 R >> endobj -1398 0 obj << -/D [1396 0 R /XYZ 85.039 781.388 null] +1518 0 obj << +/D [1516 0 R /XYZ 85.039 781.388 null] >> endobj -1395 0 obj << -/Font << /F58 956 0 R /F15 895 0 R >> +1515 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1401 0 obj << -/Length 3331 +1521 0 obj << +/Length 3228 /Filter /FlateDecode >> stream -xÚµ]ã¶ñý~Åvr2°VD‰²¬Ú"izÁA.È9)Š^d[k«+K†Dewÿ}ç‹eËÉS±ÀŠ’Ãáp¾iuÁŸº[§a”äwÙZ…Éz}·;½‹î0òý;%3tš„©ÖО\ÚÑå*#Í͉óˆ¿Ý¼ûúcÝÅQ¸Z%w›'š´Ùÿ;X/–i›E®‚®ØU 4‡Å2YeA_œ ·-¤÷ÖCÏ,–*(OZ»¢PÝ/þ³ùÇ»¿oü­u©[d%1¥Y*½S@rŸ¬Í±êy“/‘Ò¸KÉdì¡]"ýÿwЭ¶‹eœ ”ÛE¼^¸cZþâRiüéqÉÛBqøsa¯¨k쥶ÈæmàÏÀÀ¿-ü RØÈh»gáá—#ìPH§2Bâ¾y s:À­‚Cˆ¼D&)¸àÔgE’üÕAÓ<á‰:n›cÉ£,ª ”ií–w²Í<0t;È´J¦½áÒvÀN SmW{G1íW1ãp6o®'vqœ»v‹dmë7Œ×x/¯+LÉ  .èœØðÍÎ p'¸>Í-#á4 -l‹=OaœSŽMmhŸpŠ Њÿ†ÿ~"=DPT,ù8J’çFàX0þ Í¡—){ºÊ÷Ò+_½îh, $g\káVDáD]IìXÎðƒIîÞ,ƒKc"ýË/QªnñòÓ3Ò­b •ôï.ÊXŽ#k:MÕ¸;¢C‡‹¥NÒàSSò,’*\eù‹+‘Snûß)¨šH"ðôàTÔ[N¬¬^¹s¥2¹’¯9’y»*:1š²èji³îBc×ÒmÞæâKˆ€Ñ)š„x½"3gmöEû±9˜ -í]eùLÃV·±Û2?{î;] ™|µØ$šHH*ƒêKÛ#ÉB€¡s `dë~n3þ ôtí¡+dz%sOÅsõE±`K“ö|5eë©$nÂÈ`ïé?éQ ðåç‚n5{iÔ}Ë Ü}ÕçqÓ¸‘†× oL=O#Á„ÏÀªˆµÐ¢£~euôD8Iã}\Uï3DÄ —‹Cü¥3¨ÅœM»ÐgÔ -­ƒ-Ö‰›²³ ‡^Œ§/Ud/ñˆÅnÂT˜ÿbæè³Q…r«Ù„È'¡*jÙ–ì­êÂT­PÑ"„ºr7mì†Ì’Ng£fî˜l™8ÚÍé¬PiÞrÏ`4—xó„m}é<Œ‘dó-ÉJ"»ç%ðÁÜ$ÚxYFŠWÿÀ~pxå.¯éíd!×ô7̓£öíÅ°%ÔqðK㼊 ìó™ŒÙ§ÏÜÓ¼®2ÖOF¾u0ƒ®´x~ýYÛM‰±ý`wÎ>^0ö Ò®ˆÏ$Q°’U¡&‡_õ䄨95pä¡øwCOìý‚7³·ŠÁÒ—Éoòæ|çÄ]l˜Ä#´®$¦¼Œã…tdÉ¥„¦ž€‰ -»ÞØÄúRa{kcÚ7•íöí4¦Âðæ":Y5>“ç²±• ¸dé5dš+H$zV‰ðüìˆÅr\¼aõc3RqK*÷•EºØ7“®k•^(\“ÃÞ ­ƒÇ÷Äsî¼åU<$)¬Â†•l[Áçu£#VÌ®—aâ!6Èè #Á[­¶3ÅVnß¡š²‰PŒÌ¡“‘ˆÏJmÁÆ`÷¶µ„#x]ö®ðÞºòzâØD„x ‡ü*ì§ÏÌZÝÁ¨¶Iá !5ë÷6<ýnk£pƒb$[2ùô#¹¨›(ÿ}³ýcùŠÁ¼V©øNÀ’çžß¶î/­¶ÉÆ"ŒiÌžTäBj‰W^íѬt|$g‡LÌAØ_‹Ó¹.¸¯?®”—Ì%jf±dtý…´¤k”E¤N²À4 -ãHÉBØ赂3K§¨I!u¹[@òi éP’+X˜N˜v,ëš/ízÿ8 ó•%<=„”=M|cd}>ÄúˆJG9Ýgk*Ö–h Øp¬’ï¹³‘`°ÇÅîúqEÁs~ø´á - })8Ó¼…,-^¾f\ÝKÞK†Çœ!ÄŽ<Ú‰8 'Ï­ -ŒµpviM›§·›ÖhÛ¨ÜÏž•‹Øîò„8šD­8v’|˺eI)¶!¢ȃšâ®$~Å;ðˆ¤‰Ž+Á°]ÂÙÓe „pŒœ¦lȾž‘4ÌÆH§Í„“ð.ö]Fó ¦éõ¡4ܨ[6&±Ø‰øòÊ%Ê;2¼g¢&vG‘OdÓ¤FÉCL•|™ë,y˜âí¿1Ñwtød¨àþìR©zÔå½œÊ œÍ1ÄDÏ©&€¿Ø;{äÕ&œ—.:ÔÕ–âÍ®*ÅI—fç&<š¶=‡½Òˆ‚±š…¦ŸXl 6z$B»êËŸ~/iþHÌ×ÁÙZ>Ëœ{Б¢¶±åÊK(êa!¦âŽÚÎ:Æ8Y¶‘S3Á{m ã4 s=odTk ©Vbƒ9«—ë0Ísku)²?»ÚPÿW$™·ë,¡Ök´°`5§Ô]eJä¿–¤qÜ£©m¿¨D7÷Z±7ÍuÐ Eö{ÂÎÞO£»‰÷´20e¬|•Æø׎rlâ»»¡¹öÒ£µšI¦¹–a%JjŽq>F à0uAÐSq‚D‰$œR{Èã‹Ô"Ár,ºžFI$6Pq6ºmìcÀ*™QÁ¦˜nL3›ÒFØØ3‚Ðî†mÒKlt¤-¢‰*®B Ê‹Í¸å©mB¼È bt[o‹1¡^s|öÆ•´G©Ã•d¨°f©òJ±±Z‰&¯$÷_©iÄ¿B>nŽ'2Ù'†Cd·Òqö.”?ýÍGíªqjZ×tÊ8õ…3ÏL«é}•Ü÷¸ÙˆëÈ͹²6å„ì÷R.Cp„âÙï+ÌáÊÇïxÂhõ¸««1džA®ù¤0n -Á*ˆ¦}pWQÈcÈÒ -¶G`Þ^[%«PÅ«Y³DRd'ø<\¢2BöþœçÚh®“D0ÒÕAÔâ†ú.aG< ·$ÒrÕLÐ1`8’“Øaèu#càºrg !.9åî͘ýw<æ{lžDyIfù*²•ILA$'µÕ_fvšæaB)©Å™ºL¦.ŒÍÎÏ\7îœüQ"ÙåŒc#B5% ™Äí,°ÄGÓߟFs9Í'°6%µ'ñßlk½¢æÁhÿ?ÌñWùýŒÿZ"@5 |“u ®Øw^I¨#+™Ù,³4“ñ¯•{ÐâMËkûfFøÀê%¡šŠ«å#ÛqÊ'±Ì5/¼0‡St¼š9Î\DSÿ?®À.y’Ï©iÈïW€{ñJ‡:[ÿ»íøWj–£k¦€c’ɶ†^´è4î—H*Ò=Ú³Ô2åAbãÔ*kЄèKR‚H»˜4œâ• h&O’< 6 wÅðÞ†x‘ÍL)EøÖíËÆÚ ðñ­|§WÙW¼hŒSny×ñ2‹¡[LŠ§‘šw B-Çt“QŒõŽóNhéIcß‘Á‡•àäB×3Al7Vl™Ïã÷ñëd ·GWf«r€ûÜq¶…”;‚ô“…†´ÂUe‘ºbèÅ_…\[¯j㇜ªLž>½ê…HÌóŠd“ê;d‡›E–OËÕ¹B=^3V~éè¼w…“éâa¡µ“b*—È[F"/Æ´\ÞùxÀ>Dj~è å©(Œ¾ðûÚ{5òW!{ùb`©¼Îº ¸%ˆRøŠ§õU÷hQûï=: ^~æEî¾1”r¼­Œö^2WHq·— omoS%¯`póÎ>S4x?ˆµû@ìk*L¹);Ò§Òù|OÆ Mq±AOÕdCgø+zW|_6egÉ-´D‘Tp#DJb?\¿äùQDìU›a-¢w’X»@·»uoÏW -N4„åÝ…¾¨‹¯_å´²òOÔ5ÑÉ´¼Òð Œò" Xâj„ô -C¿3è#¨Ðß#Ûh§‘3䶖½ç1!Åû퀭d»ÚøòÚpôà8ð}4ãŸrÄ?ûf™ÿ+ì>âg%ïTpÚ3dæ2L6\nÕdÃÆZ%V,N㤙²:Nñ~%€]ÒClÔcXþ,C†Ùô•²Ïh©Àm‹/×Lí=øc‰1Y߀:úo\yÆÔqZò̲)ùš]ôO…q‚žg.Ëγ1v…öžsö]W‘¥h=¿×yYgÙõ<ÂÖ÷Oí…ã½çÖhÉüÌ”ü™k4º×Lh'k\Àm«‰‹«mQiZwØÕmïÒ‡pæÇQ«8 ã8ñuù3©Ò£Deüó¯Û?“J¢Kôqîlú»1ûýh~Yendstream +xÚ½ZÛŽãÆ}߯˜ÌC–V4ÉæÕ@ÄqÖ˜ÀˆìØAç#q$z)Q )ÏÎߧNUu³uä)X`Õ]}«®®:uáÄwý‹ïÊ,ŒLuW”qhÊònµ{Ýmhä»w±ÎH3fiJí+ƒK;ºÌ“0J‹«sôŒeW¡IcÌùæñÝW“è.‰Â<7wÏwqœ„&Nîò* S“Þ=®ÿ”‹e–EÁ㢊ƒ¡^µ‹8ØoK“ÁXï¨÷Tkïu¤Þ´XÆA³)VuG¤n\üçñoïþúè¸Qfò* +Óøm~½9ÌoœÝÅQXEÕ ¿Yf±a~·í¸X¦Æ¿DqŠãé®›¼­\ái±LÊ Ñ™Û~A½éL=~“`ÝK¿–./~'Ü äúr?]7P»f²žØïeé'’íÿTëDš§{¿€ÞŸuþQÈ#[ì¦vb’d–1=uÆ]÷î-Ò(xè´8Ø„´"O鹈 la`\~i>Ÿ„öÜÔ0U0m¥Ô¼'¸Ò9ý³üb¯†¯ŒkN@MHŒqpÔ™X©“_ùZGÙ¼tóAÖ¯Áó*äiky$6ö§x—N+¾µìF29 =N¯ŸºW!¬-‡ãAw¨§&ä-Tcü}þ¼šŽu‡ç£åi’°Œ¹a%„v­´'âš±#L*ik£†Vô¶ôßo¸Òwõç…նİ tÿ±?â¸5‰3MÓàWˆsÔ1ܧ߿Ÿä`¾Ù"éåXÏt àšË+÷ìP·?’*7~…Seêx%yˆ|›i€ö¿^þeñ-qþðWÈä¬5A“ˆÁRL*©‚§ãÈ//ÏÄEúZ‰üµc³•ãU[%àÛlQ¯[dyP‹ŽÖ1áyÑqñ~‘ɾÍÆÁ(ÄVWLζ€×KŠ¡í›zpŠ’Î6OíU¿k¤õÒÒ~ü¼µFœ‹cwBž4Î-Ñk0)Î(]fK°ï%›½‹Åz—,*dÞ÷-¯:2ŒÜ€„ùM`e*‚׶½CRjÔ R`¡7¡ÀÔO û ›‚ >÷÷àá“Rù¹µ«b £gJúÓÞ9¿Af|úùºÇ(bFÄÝ3H¼Ô7‚ùˆ‹Ÿ –x\»HÃè}Çq@;²S`å²Ì¢íGÌ^V9GHšPË‚#û?´¯¶UUÌ­ß#z­ã>ÍlVÎ1µû½xÜKõ뇩~Ò'7婧Gß½<ô«,E©Y;á^p) #ðž:9#Óüç¡9'í$æx2d¶o¿È˜˜®Ö,Ø©‰¶`ÞÌAg½È +7/Âû±ßYØ$%ç0Üh¬ vmXG…úg¢OànhÞí¿7_Æg\ +œ`Íšà| = sÙMKv“WÎq +ulwθh¡:ÜV_¾\”±Ú^ÔPóU΄?€ç¯>f…—ë™$Ó2!!±tNùÉ(gè e‰YRV-ëèèË­ñ$aRħn÷ÌwvRÐMO°í¥G1 dåHJZ+J©åLye…Q–žœa£8xΤdü=‡îØ´œ£5tÚI憅FGÁúèŒ2©–ŸïáQ¥-y\|àÀI`¸,‚ݯե£æ­$–ú¡£‰"0lpª¨¨xÙñ6 +Ab”4—‰Fv´rÅá,ZóÅm§‘öªê ú±.É‚wf—Y£¡yj༛Øó'ÁÏxƒfPf€í4uº`[æ”k? +‘lãJ^JcÅi>§1gaÜ×i'w¦¾Þ#½üÎb/ Íö0Òq~Ê@¢éyQziY_(WqWƒ %ÄÝØE’´Ú+ˆtSåžÔòÓ!sFŒá÷ž%Ò ROÎÂïetœŽ­qÇW=ì“'e&·®×.™ðŽ·õ ‘Q*ï÷ĺ1´Â[4ÓJî‡Í¾®Ù“«•ÂY0¾w¢/£D­n6ýx§®òò»·òc‡{I…Ô H~@O‹/ ó6œ7Q¦ÔÙD#ò. k ¥s3I…êij†Q:´jÎðš+X—¤UhŠ0Šëx G½7A΄Q[`µ¸¢¹áøµ¬0ù Ðf&4iB ònh§"á’,¸§C»þ—ؤû{%åâO«4‹‚?(é +GVðÞîbXÆú•â€ÖD쳻ꋋr›iò_ú(Xà×Q†ãþÌ1Ï^š—IL™Ìk`eŠbÉR¹ºE¤gF7Ê“jDE®õ´$z‚‘¨óÁÈeÀË"y­3¡ÉùMù$ ©¦XŸO,Ø7.ˆ¦ùSïŸ)Óߪ6 l6{ÉÍà)4<ú'ÇGk!¯kÉ@Xéa•¡`ÜB|$‰{m.Zð ôÉ9ßiˆë™Yt*¢·Jד—÷2äÂ}tº~Óî¥ù̯·“É;ïø¶ûÓÒÖµÔéÇ¿`r¦§äÖ]^“;…ÕAœâðÁ:{©ž='¦»õ¢¼åz’žè:1ò²¥‘¶ßʨè&#øÊÕà0ðð­eØ…y°êÚ9¦~{íÊ>µÁi;Ji=®bIÐ$ÿc€Y(äÙyY¢Šx/+NÓ°2ñ Ä"_µ<ˆ3û‘nq‰ Eéá‹ UDǵåYÅ&Õ5Qqâj,»\&v„/Z8L¶ȜÚCéó E Ú.÷ÜZžÑu(†[ÈÍ „æ鬊²†«n9—Ù¢¤X– a –ï«p7êêÉ/ä©&S ¥åuJ1yöT4O5‡æ.­}|x¿“ê}Z(¨½òÒ¸õ`U ?š½!¿â}íí/!æJ\¾Ä5+ýš²Hd³<=õWid5áWN«Â"³‰Âïe+÷IKìJ4w©h„‡&ŒóÓê»–7½g¡Œò}FÚs…ÆÒ‡âO×Dý¿¤B§Té5ë %ª¥­¯í›§aZ”ÿ«´ã«-ã0£=N²Ö~âûYKûåó=Zô0Nžzë8®Î>†Ñ +ûk« Ü9« +¸âB"ÞÅ<Îr![¯ °«¼|;ñ£ñg =iö±ÄæÔߪ+Z7åó‡º( ~u¾@ .˜¡‰®„3 3Þ*jÓÔ«˜{iâ(x²¥bš9×7¨³÷,³n=ø8¥âWiÎ3¾\ºÚð25™¸po”ëol(þ÷˜·„6Њ%§qÖ•zÏ ß q#¿ ©ßÿ:÷m‡kõqlÖö×üñJ£3CéÈpò…s.Û2ñröÌ/´#Þçs››…•ö~ùOz°Ogà†Äœ kæûtv|æC#Ý·ÖªXò²‘]à —²/"_¤e[eíÄÇG‰Dj&˜Ägž×†nÅ€’&>u-Ö²§‚@½Ï€D­&º7à\{:Ú¼^äî#£-òV~õ¨™}x ˜lÔ‰2³ ´ôã?A¬U>ÿY€© + O¸9߃&©j:Ç*ùî$3VÅiñaüÓb™“½|×ì›Á¥s˜ö ÛJäW.JÁn4m;p¢°ÙÊ4‘MUèw­ƒ5窰fvë Æ4È;¢øyE&tðSŸ÷^Ä º{3ŒÖ¯à‰4Ä__ApE]Z.P4v2å¬ÈBH’ç¹W)ŒŠ·*…´d†`ž2^ïnüÅ %†Iåÿ½ÉÍ¿;q3/ÿê„ -4Y®›A˜&>?/3e˜•æöÿYPá$endstream endobj -1400 0 obj << +1520 0 obj << /Type /Page -/Contents 1401 0 R -/Resources 1399 0 R +/Contents 1521 0 R +/Resources 1519 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1372 0 R +/Parent 1526 0 R >> endobj -1402 0 obj << -/D [1400 0 R /XYZ 85.039 781.388 null] +1522 0 obj << +/D [1520 0 R /XYZ 85.039 781.388 null] >> endobj 246 0 obj << -/D [1400 0 R /XYZ 85.039 761.463 null] +/D [1520 0 R /XYZ 85.039 761.463 null] >> endobj -1403 0 obj << -/D [1400 0 R /XYZ 85.039 667.044 null] +1011 0 obj << +/D [1520 0 R /XYZ 85.039 667.044 null] >> endobj -1399 0 obj << -/Font << /F20 877 0 R /F15 895 0 R /F61 1406 0 R /F37 900 0 R /F62 1409 0 R >> +1519 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F57 965 0 R /F36 955 0 R /F64 1525 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1412 0 obj << -/Length 819 +1529 0 obj << +/Length 1103 /Filter /FlateDecode >> stream -xÚ¥UmoÚ0þž_õ“#5ÁŽm’LÚ`´[Õ·A¤ªj«)#¡± KÒ¢þûÝÙ†AˤN>ßs>?÷æ0—¹± (OÜ(fcw¶t¨ûȩìuE@û¡aêôNdì2$4qÓ¹6Ió;2ú:¸NÇÏ眓8ðü(ŠI:xaLFß<Ÿ‘ËSN=FÃî„ÞÝNÓ1,¡ñàü|ê=¤gÎ8Ýáá‹@ô9ùíÜ=P7®g x»kiÀ’Ä]:Bò@ -n÷ gê|ßz1˜pÍ©áúB„AŸK×ç4ˆc±›Éq ¤û‚aÖ‘C!'] ²jq#,ú„›¬Ñ^ºXÓ2Cøÿ -{¸6ëS[ì;`¤1ˆÂ«T§²N™ƒp!I½˜{úQíúÜáÀIV.*/2£©çf]—Y÷æ@H²ÆºY€sÔÿÒ ±D®o³â3Ìl¢Ó2¯©`Œ”Œë˜[#f¸„d…*¿™µAˆ´]“muw·Òÿí4ImWÖHsmýꬬz'<Ú)W(%p‹lÑzyñÜ«ž Úr¯°²PaíTk®©j{ßZ'¥YävÛè2貟XÓâH©fh[š qÆG{)šeº¾:)8 +,/¤Nuè¶z4ó »Öy¦FZ+t;KÙÒ #‚·gŸDSÓ€J¡/½[)à.CIÂ8ìÇF®WEuO%=Ú&æèØ W?&_n&€1`*#I>½ÏÌ:ŒFã©‘ÑÃuÑ,UÛ*˜­Ë‹J¹>‰ {ø27“«Ëó[C5bóªð›.ÞÉVZbJJV ö}DfX¯¢µUCD·ˆ„ÖÄVx±Sa4µ±¸§L`iÛÎìë•¡¢:P,ÁkÌÂ÷µ©}kØYî¯݉xEW‚w-5› Ër|”ô3µxÁ—ŸéD¡VcO ‘˜>c“ˆP÷pÏ"ö{xi|Wz´ß†Ã9<²â=ÑȀś°Ë¬5Ý­ªYÝl#˜u›9ÁJèÊê:¨Ú\ï#çWŸŒíÓ…4™8üy³}ì³²ùhüuöïg¯‰ZºKðÚ#Ñoendstream +xÚ¥VÛnÛ8}÷Wy¢JEÉ¢ØÇëv[¤—µE,XKŽ…•%¯$ÇÈßï\HÇNüÐE8¼ÌpfÎáÌˆÒ áOz: B•y©–ÒÚ[mG¡÷’w#i5|«âŸèÜä£ë·†Af^¾~¶“q¢¼¼¸³?§_òùbì+¥„Æ~šj‘/¦ãH‹Ùû±/ŧw,\Ž¥˜~¼™â*¦Õ·e>‡á#Ëg¨<½½]Žïó£y~ŒíèâÈ0°Gw÷¡Wˆ£0P™ö0 âí" ’XÙu=ZŽþ:šbYìñ©K<$J‰V¯‰É RF’‘—&a„11±1ˆù±DÍÃØe"†vÿ–u‰Ë‰8TÆ»±ºe·­úaWmz=«Áœ” /¿‡2>1òÞÚBgí¾IÁ;}iºÕ8J…õ±QÛ± üJa†­¿Æl­íÊz6%^0âK$,#€ýЙh*g°0ìè?îhaš'©¨[×þÃKcå‚=Ýï;XtíQŽ1ÔªiQ)L“P‹)*µRg áÙŠZUo%-[38"P¼ßñˆ¸ëKÀŠ²_¡Ãï$ ²AŠáýT)=¾+LcF­"qµnk@'W|ü€ªŽwÜؘݎ4ö4 ÓðØîž4l×Mê 5T5¨¬ibF‚Q·}Y„Óf,Më ¢ìi8yð ÝŽ³ÂÒ½…QaŽYÙxD•Òžµ(öL‹tûÎ ÆQ¢Ãj¨Ì€D;tÑq‹|¬†ýPz8 ÈXfª‚ +#böÖ,8lãîRáŸra/Þt˜ø‘Ñ¥-EùÀûk* (ç«ãIÅ¢²% z†‡â#µ•5Œ1áyâ…2׬,E$>+#Üy®TXôΨÞÉ@X®ßªÉI3R2 dAR#¦ë¢|¼nöuÍšgm+™ò€+k•Ë‹9R© ¢,=#‰;MWÛL9P• L¼ënR¼±Ò JÕ‡)iö=iØœGŽ:à8Ê ©ìORhm\fs¯Äë\[àï· ð¡–U„:¥hïv~%"ÒÑDßó¼Ý•Í÷0 ¯Žì\½aÉç¿|]€LBŒIšˆßyß—<Χ³Ù|És´ð…›66lÚ+ʦ* :ÿº±üÿ`¾.>ºýÆáàÎ/Eóò£e €ØÒ`:NƷ°âÛêYPÙqèž\Ÿ¦%ê—ÛSçê~à½Ö~Ýš —%'2Èäägr5†ï°ËÕ®4…™7Øp‡c=6ì³;ö‚§¾V?a7ÁÎMÄM‹É„z`(äîèGQÄòìÊòë‚[ªS½ú5ŒD*T?ƒJSK«¸1½k„«¶ëÊÕàJ‚º>^%Q| `k¼ü‚;Œ²Kø1˜_z'Ÿƒ± +´Ê.?‚`o’Æ6¨¢—áºçÔ«xÿeendstream endobj -1411 0 obj << +1528 0 obj << /Type /Page -/Contents 1412 0 R -/Resources 1410 0 R +/Contents 1529 0 R +/Resources 1527 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1414 0 R +/Parent 1526 0 R >> endobj -1413 0 obj << -/D [1411 0 R /XYZ 85.039 781.388 null] +1530 0 obj << +/D [1528 0 R /XYZ 85.039 781.388 null] >> endobj -1410 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F37 900 0 R >> +1527 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1417 0 obj << -/Length 3435 +1533 0 obj << +/Length 850 /Filter /FlateDecode >> stream -xÚµksÛÆñ»~…&_ -Í„ ž§ãØŽ«TvTK4uòáœHÔx0xHÖ—þöîëmkO&æaoooooß'÷ÜÿÜó8´?9b×öãø<-Ïœó ̼:s#}; ÏL.ÌìbåÙNÍá8ç /°‡&¼=[þä9çžc¯Vþùí!Ýfï¬äb†Žõæöbá¯"ëÅŵêòµT^1èí5|=ÿK{ñÇíÏg/og7rm7JNpáFvâ{S.ÜÀöƒÕ¶Ë|\Â^U×°½ce}ÚáWuõ1€hèÛ¸á¹ëÀñ“é6·Û¼½X®oe@Ý‹­´/5R¯.¼Äêp*°Rئ:€kµ ¤ñ]ÝÀ¿%.P0DÔºš±vkj\}Ÿg0Ö V‚†BÆïĨ›÷LÞ…­ö¨=˜óv[õ&—¹–ØE6îó”Æí÷0ãï­Z ˜Hô¨% ½îéx eÆ<Ǫ4‘ÈxæyhxÌ,'Ì2`Ÿº¹GÎuc_,"dz.;žd¡"i¡ÛnHHƒeQ›×B´¾3÷hîÏCˆ¼hà˜4 'š`¼}Å÷êG3÷ºíºÝËe©òb[·®];­Ëå‹÷i±$i,·Àui~×V]VÃÂÊî>t‡l-ÜıÄÝç‹Uï´–Á…øp!))1kVS‹¤Ók”Ê#¯z˜|ObB ›9Ž#†Iâ\ú¶Æ%Þ\୯Ź|DVM7ÖækÙgHMQ:]hâ°cŠ§X 2ú8ZÉNpu„'èMÞ4u¿c¤ßÐ1Du ¿^^^ÃÑBOøï:bpC_°¥Ë“ªÊd€úÜé¿ü×$”|£ººydäF¯Yl$ɺƒ;ôVèè’X¨±YÌV%ë IH`°A˜€w%ßZ_5…ìi®:͈Š´WˆÞ­ñ|)žì=“@ËÆßG¦Üð—þÀº8ø¬\W·0’£‹CÔfÉ9#XÜ(9hÝŠ“;vi"Øl‰Í®$)jöäížE"#è>º$á†Üô`*ËÈ—BË4Äšpð…ÍD¶à95FéGžµ3òCµêZf|Ú´ÉYuÆð­nd±ÎÙ\km¤ëG¾¥Yár£D®ÉÙù -;lÉh¥,B ¥Ì»¦¦Û]Oèˆ{éȘ€¾§êm'öBÿf'·oÙTÙJq¿7š}„Sº›`ŒšÙ˜DÖoq*ÅËèxŒÑ˾€öÆ«hþ6†|ïE"\„îŒÙé L ©Ž'%à„®l«[†O”=’ùØvšÐQãbr¡3¡¸ÉÌÑ9%!ñî%+H=£™xÌG†Ø©ÈY3|piId½y ãÛ«_^ýòæ{¦YCªœWÊ«Œ–ã¸mî[’‰ÌÝ^ľըªU䘲ËGç×Ê­>l…cÜ-˜Í€ŽÁy{ìÆP-1ârƒƒiÄýy '¤ø{3ŠÊä<¾ÆŃ ÂÕ.O ÇPÞµ $¹¶| RµŒõ‘g÷´סVà¯(iY -ùèeÇ‹rV3òu•MB<®´H›saHº†¨Åñìûq=J5;œÑäáƒ|¶èDOêIÞY¼ÝÃ6TV yQð¨È÷ŽâÑä$êeÝȈâ]Û5ŠçæÖWHÎÈ—;ã‘~oì\tã¤{|V´hÆ+ϪÆhÃ'‚ÈÙÉÇ;±ä†>FŽBO·BWÊÏz!é ®8«Æá d¶ù ÀÖ0lI‚…ƒ1©z$'+÷ö™:pFµa0&Ƨ|cÚ<"×]½iÔŽdˆÆèùœD4¨=žÇ*é| ™ÀTo ~8˜æé´LAåu"©pÍœ¹˜§1­Áæ"w‘jMRå™!„àäØ;›£µD‚´.Z›dP"‰õ“¥ìœtÈÆ­Ù×õ”0HnÉ4B¬"£ŽÓ IF0áòp‹V•hâFUȈé(0ù …Ø3J·áé¶&æ&Úr¬ÐìêžMÝ$KÉ%«PÈ4Ç]-Gþ8*H†š NìUü¥…RÕ­û x•?í&µA;Rµ¼yþöòúöfùë3ûå¿^þõ™÷4¯²$râ'WOô'¿<}öäú©—øá!gçÛ±{²_!³ß¤¾C êìmWGe¥—ØHiž)3;aêtQ7½ÉE*ý ¸»ÌøÈr'Vª/6¥$¿­Ú™Ö ±ôL)xÀ¼¯l? ó³ÒšeõŠR?f¶o8åXO²ñÍávQ`‡n8/*ß^ù+ž:½-åR‡àÐ9Lµ?8t3Åh§ƒp­c#ðVÀk°ú?µ \ÁZÙu³Y¦›|re­ójYÞµKÇ]fàÚné&I´L"Õo–ŽŸ¸³Zõ‹8§TßÌŠWøš?Ó¸çlC¨:©ø<ûyŠO!9p¼IfÍGú Žkòn{i†ezø› A„˜ZÉf0é9cXÃñó­6y.û±Ï©Íá8“ŒÑ4“`ž:'Œ¸Ü´$Ú‰ùŠ½/\°‰ŠƒœI }7¶î¨ÃR0ÂþqB¹ƒ‹™7¥Ý0ùÆæ…·[Iñ#—_%‰Áx‚±.s£±ãýæ/¦Æñ„‚. -’õÃãíËWÇyfNoùϳw8çhÄÏg8—øüµÑ-?/Ï|Û‹|ù*ÎnÎþ1±/ò>eÿ7ÿf9¾~µ'èForH %ø‰çã´¶ö-çƒû»ãúæÿÁúŒcæ&ÿö÷«×ŒøLÏ£3XÍ -í Í~»¹}9GÅÀ\üϤò¼‡Z£êž×výnt7C0‰Ä:?‹-LN±rL'AÒÑgÒ·¨7uuŠNü :Ì_«F•ºƒ‚IWD0x)þ4 º¬Ò‹Ð4^p¤ñŸTY~ £,ïØw mGG:Ì0×€b]PNÈ%â#ÏÓŽÔÄ0Qã›4„Ä#•îŸX¥J·yµ×$u¬;NȨՙ³–†¦Ú@=wÈëÛz·S~&7h“á¨~þ¡äÛ¥¦†Ô¡SÓBª¹ËãD@. ;¢VwœŒ„.³Q ×Á -ŠgÍb"ôï®rµ¦3åÝãß1Ü®¹×6_æžeÏœäG-]……ç‡äñ·4 SïÝ–Ê^1~Š¿eÈa…ëù+ \‡/à’¸ê!—ž$b Ïè‘@µ5gÏÒ™ õìZ¡ÙäàùUòûìú’\%Ff®‡7ÝhSÔË ñ(Ø|;Am*j>Pñ¸ß.Ü+©±†6…C×Sr(6a §P’5ê°3™5æ~· ¼u;©q”T,ª©žË©ƒñ‰°éû„.xåÃXýè´5I)cw¶òŸV¦Üä!VjUÉ´´rÇÄšúÒ1¿Rá©|á¦;:~~?yCY„ñÊz-¹(>…PäŽÍ[ÖÐf“o,Jjl±ÏPüòóž= â¨9e`?WÕݤ»Â6Ѽútõq:;L/¶ãpö9vÛüTvíCâ{Æ'’zãÓ?Jñ5? /-TK¢ÿöò…Ñ>‰ßæDÀc‡æ„^L9…Maû8Ç(Yx ?ür‘x_]$¿î™îŸí´?pùâ Ì™<,Ê+öR”ÊT:´iÝÆÇ’û’——ƒk°ëW )à¤ù÷]²± ؇$ 4ìÌÎJ+QDàŸ¢@bÂC¤Šy ùÚ!h 3_Ú „äX +ãŽIßÎúŠa"t'¦áð5 1Ô`.§Î—kF#X)Ž¦ D)Ãœ2¤Bh=»¡çKIÜëU­<ê¦KÏçJ»›"^l3Vî*]d'n¾À¬ô|êh–ÖPûû!GÝwƒ(¼—é­3žn%6 +UH° Iä3Ž¹æƒ*¥ÁÑÎ +ÈYíe–QÖbZçø—I¶´r£ø×f¹\Ù„³Mùº)ûDK ]²˜Æ ûŒb©º…[MP¾k­·Ê©D”à„•r&±‚$,È(§øPåSŽZ‘ŽéjÈ 6bÈ=¶¢Ì^Á ÎÝtg<±©g[ÍcóN¸vîñjt$Ñ–€JÌXpÂ’hÀ’dD²^K†è¬%ƒlÖ’[§³µMÙ8°‚3K—๲¦LÌn¿pƒ¤™.³}31ÌEIb~²ÜÄ1›)éuP¬ô)÷v ÷ɇ÷º7DgÝd³îµØæ°žXà~Ô>Ì=¦ÝßqõóǼ£zâ­zÈ‹½¾ï³ÅÁj¤.ŽÝ->ªïJ[‹5gu¹L)V9Ð5³YþÑçµ ‚ªY zÝõ{mA&{Ñçõ ]ãõ0[ãu›­Þ¤Ð›cîÍ÷1dütÄx¾Çÿ×y~!(·t¸0@ï0&˜†!Z;¼jmõSâLœŸ-u¨:CX „ïé¼û1º¸;Æ8œ âS„5¡†…1αnÞ»¿0ËptóíaläÁ¢õ''4mí iç'O°:¾ï$`¡u"hæG›<· ;õXè–#3Ìêqž%“m ê ‚ä¤VçjŽó7³cªýá¸Æ¡>Søö¤í0€a Ýõ¼8¦&3ãÁl] +·gQÑ]%3:/ã«Ëëd¶4 ¸a ¸$€*ØpÓª„í0ä#ÕŸèíŠÂ-žè;Ð@ÿh@†_öö!:Û?Ùlÿh±å,/?áôo.L° ÷;\ïun‹<ÖɉÂ\ª&Xu~ñC>Éa•¼Ÿð?Òo‡2endstream endobj -1416 0 obj << +1532 0 obj << /Type /Page -/Contents 1417 0 R -/Resources 1415 0 R +/Contents 1533 0 R +/Resources 1531 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1414 0 R -/Annots [ 1421 0 R 1422 0 R 1423 0 R 1424 0 R 1425 0 R 1426 0 R 1427 0 R ] +/Parent 1526 0 R >> endobj -1421 0 obj << +1534 0 obj << +/D [1532 0 R /XYZ 85.039 781.388 null] +>> endobj +250 0 obj << +/D [1532 0 R /XYZ 85.039 761.463 null] +>> endobj +1012 0 obj << +/D [1532 0 R /XYZ 85.039 667.044 null] +>> endobj +254 0 obj << +/D [1532 0 R /XYZ 85.039 667.044 null] +>> endobj +1535 0 obj << +/D [1532 0 R /XYZ 85.039 639.536 null] +>> endobj +1536 0 obj << +/D [1532 0 R /XYZ 85.039 639.536 null] +>> endobj +1537 0 obj << +/D [1532 0 R /XYZ 85.039 626.656 null] +>> endobj +1538 0 obj << +/D [1532 0 R /XYZ 85.039 613.106 null] +>> endobj +1539 0 obj << +/D [1532 0 R /XYZ 85.039 599.557 null] +>> endobj +1540 0 obj << +/D [1532 0 R /XYZ 85.039 574.58 null] +>> endobj +1531 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F14 969 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1543 0 obj << +/Length 3491 +/Filter /FlateDecode +>> +stream +xÚ•ÙrÛFò]_ÁÊK¨*08ãrm9¶ãUV±½·²Ù$ ‘(ã`P²^öÛ·¯†$Hy+sŽFOwOß#gfÃÎ,ò-[ų0r,E³´º²gØyå„ç+Ë÷<Ol.ôî"p-Û 'aäŒEèÄ–ò„ùquµüɵg®mš­îgŽãZÊqgAìYžòf«ì÷¹c_/|ßžX]/TÎß^/œyS];ó¤¨yéó'˜½ù¾»þsõóÕ»Õp¨œ©±MeÏ®²Tè^¤9Ë\“fÇ.‚šAŽ Í–ÃTßeußÍ@¬=Ïöi³6šúÅ‚ë"Q# åø386¶ã¢ÜÈ +ÈZm‹Hˆ Åæé¾Êëkô¼œ•°Ï{­õ=’ÚVI_4(𶑗ؙï`§mÅC‘Á8çåDÀèÊ`þˆMû¥ë Z +ý–*› Nkžu¸· ”^“ƒ*ÆÒ}(Òœ¶_¡;,¸>\?œÓ,ÇqØhÿd¼ÉÌðétý€èDàŽ [€x@Š‡™u½ðœx~#øQŒ|NÎ"fS•<ãoÛŽ8Å…æþøš›„þ,p|ËuÅâp£ÝÄgÓ¼za€Ó•«À¸òcœ(©mßï~X.«¤(·M×[$LÐÂÐR`p$SŸÓµc¥Mµüoù%-—iqßÕ}ÖÀwµÕíÉw#T/š¶GN:Œ…†Y@§zzŒ i[UJhcÛ”%^ ®¯Q¼O<¾ÝÃí|îJøsÄè ÞR¢V¬-eÆKkÔ"R]…“†Àºb €¥ìÎk y™}‚5á– Ô<‚íóDNE0ÁÁ,BÔE`aÓ6ÈÊŽ7þ°}[ãÑÊŒ$=©ÑžÂ/‹ÓdW,í{¦Á £ùê Ò‚Žryó —BQ÷¾'«ÛtpªÃ° Òž1PrßkjyES„ͺ„I±Iú¦}âíVƒ³\ÙÕ4=ܪï(ÞÞN‹q §tÿìµÜò¶NªüÅ„Ø%]'ÂC¯ƒ +8ÂN©G7«À¸Qؾ?Þ Œ58îö)Ý${”î/Ë'Þ—Ä°¤ý9Íùt‚<ÉŽœ!«J4és! Ö `÷9‡d¯“7¾L0H>Òñà#”ݾåYþuû¥‚FÈÌÀ‚r|ö‡ô]U!Ë;üDN)lÁ’ð„$•t©̳¼-Øà ‚{kÅ8Ðr“švÔ<јYòë„ÜÉÓÁ!}Ÿ·g­xO„PÒ‹Ñ¿h˜Àá¾+êØ,L?°1W hªXÀ×”6„/~»Žj+q·,qBdžg<Âcðw4AYßÊà0,vFCÛèßð÷CŽtèoÉ&” +ºª­¦—síÑ (LÂ(^Â@Â9]pº'öHÓÓuäÍ­AOz†&óÞðMÊÇ:ÓËàg‡Ç„$‚0týTV—€ØbÐòFßùt4‚C‚‘éètßÔvL¯Íbg” Fr1)zº6~8®xWAQåÌTè@Ýï>S°iè…~Z°ã4 +¶º_ï7à¤þ²ÚÔeK“åÝ›Ï7ŸVwË__[ïþýîo¯ÝWEÅ¡½¼}5€¿üøêõ˳†òé•+ÿ„5/ ºQù¡Æjº˜S–ç{²oåÞó,×óžá^€¦ÊÕ£ªl¸·¶=ÔÙG,(»3ã¼䄦IÙVÊäêÞÈÂHp‘Ý£aÞ j-xlLÄDéP—ñGR¿³€5¹?}YÄza€Ÿ²sŒÙ¹å*žCQI |¶>,-6'bsx,dy†,¨ùýà€*ò½±=:œìĵ…bÉ¥}$=!éŠ'k.ýHûÝÐ…kŽL¯0xQg~Þ¼mƒoVðü‚‚ ¡à]R­«i7ËtS, ’¹–Õ}·´%{È¥Çá2“ýfi«Ø™T|/p¬Àõé>¾Yžý/ˆZ÷rÏó¦¾Õx'zI)X~äÎŒóNY˜¢&­× Ë‹##éñÐønHŠƒ Xh`âr–ƒCånä†W(±¸'S!Jú¡ðÁ]é³ñØå7:;àJƒSQÚùqOQ'ãÙAÇÉ£B* äœ3?ê©¢Ç ¼¡äv=±åšc›f×%Åã rŠæ¾)ô6&t.&yøù;ØÃ:èã‹wWƒ…z‘ü†R;PBL‡õ1nê~Ž9Óè{IÓNûC³ êê¦,)™ÂšUçu¸ñ‰zÒ“´+R3׋Á‘–ÿuõûŸö,uúùʆÅhöˆšoaͪ+ЕPɬ¼º»ú§íÕÂÀ5ѹ´}˱Ç‘ü»ÿp +Ñæ›zÉ:ÆB@t·Ãþêüa;Jÿ?x¦#c[€WPûÛÿû?naPÇ3‰ridL=ˇ8îËþÝow«wSX”GíáËX<Ù³‡*°îß45viïò~a~Â,.M» <žoENøx °,›MSŸÃ}#ƒŸ’6©òÌSM-€@ƒ—¢{ÍuzíëÆŽrü‡ú‘.Xg1±ló$+z®ŸŽ +d×–dÚ¥o\´ËÅÄV6u½&Oî§OÜ>„=™‘#ÚJ•Æ¶æJõGÜkêaC&Ÿ êd3lÖ/Î×cˆ k."¤æÉpâYѧTõðRäGÒ*ÀV÷Bl8ˆ<0Eð5V¢8°±òô™7øê»Û"Y“·-ú§àç;\Á+Ò7¹%rKNÙú‘;Øa²=nZÛþ¼*t¯&CW' NNË+ÇÝI)­]Ãå…ÜøbèÒa—?>lÛÁ5~Ƌب¡AÓú5Ök>'‘ùk|¸á1eW 9[ëôR}Ýams9Æß‘Úis …Ü`<Ñûpk˜k>¶ ,6=tI‡÷íø®çÛ:€¹ñ\º_-‰—ZÈ„ŒªOö³¨WD:s‹wA€L©­³Ôó=qü4QˆfFÖ¹×_Êý +5¼5pH{<ˆôC¿ñBÇzhœö=p™·ã1zÊ[fÃË,ÝTÄ£/Pæ}΋üÐa ƒÞ¼Ú¢g>ofô¶ù‹„u|õª7æshJ†8œS Ï åžÊšóŽ€2‹žå•èn1!E>e5¼ >Œ‘vš§Ë³¶ãzäG“É¢†Y@SÉ¢o^0`¢W{ëä<…Žº|ƒê‚Ñ—Êø“R?®3;¹…©ùOضN + +L­àì9hâpË=5¾Î*ñ€’¥ +c¿ïTãsO•|žm¼ƒÖø ~ÅÔú­ëÄ¿ë¶c ì§TôG®«H²ë¡šßUåvÐÆ;°T“.ó^j÷Müš²­Ã¿B;û×häT2°6ü„ü›w|ž¯"°uþÀÿè‚·yendstream +endobj +1542 0 obj << +/Type /Page +/Contents 1543 0 R +/Resources 1541 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1526 0 R +/Annots [ 1546 0 R 1547 0 R 1548 0 R 1549 0 R 1550 0 R 1551 0 R 1552 0 R 1553 0 R ] +>> endobj +1546 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [365.77 614.001 539.579 625.993] +/Rect [418.678 611.807 512.306 623.8] /Subtype/Link/A<> >> endobj -1422 0 obj << +1547 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 600.754 177.671 612.444] +/Rect [111.316 598.561 285.125 610.25] /Subtype/Link/A<> >> endobj -1423 0 obj << +1548 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [94.952 410.763 520.758 422.755] +/Rect [122.225 367.922 512.306 379.914] /Subtype/Link/A<> >> endobj -1424 0 obj << +1549 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 356.797 147.672 365.456] +/Subtype/Link/A<> +>> endobj +1550 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [94.952 397.213 326.033 409.206] +/Rect [122.225 340.823 353.306 352.816] /Subtype/Link/A<> >> endobj -1425 0 obj << +1551 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [281.346 383.967 357.854 395.657] +/Rect [306.355 327.577 382.391 339.267] /Subtype/Link/A<> >> endobj -1426 0 obj << +1552 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [94.952 370.115 435.348 382.108] +/Rect [122.225 300.176 462.621 312.168] /Subtype/Link/A<> >> endobj -1427 0 obj << +1553 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [94.952 356.566 320.306 368.558] +/Rect [122.225 286.626 347.579 298.619] /Subtype/Link/A<> >> endobj -1418 0 obj << -/D [1416 0 R /XYZ 85.039 781.388 null] +1544 0 obj << +/D [1542 0 R /XYZ 85.039 781.388 null] >> endobj -250 0 obj << -/D [1416 0 R /XYZ 85.039 761.463 null] +258 0 obj << +/D [1542 0 R /XYZ 85.039 761.463 null] >> endobj -1419 0 obj << -/D [1416 0 R /XYZ 85.039 673.255 null] +1013 0 obj << +/D [1542 0 R /XYZ 85.039 671.062 null] >> endobj -254 0 obj << -/D [1416 0 R /XYZ 85.039 673.255 null] +262 0 obj << +/D [1542 0 R /XYZ 85.039 671.062 null] >> endobj -1420 0 obj << -/D [1416 0 R /XYZ 85.039 644.52 null] +1545 0 obj << +/D [1542 0 R /XYZ 85.039 642.326 null] >> endobj -1428 0 obj << -/D [1416 0 R /XYZ 85.039 221.223 null] +1554 0 obj << +/D [1542 0 R /XYZ 85.039 138.017 null] >> endobj -1429 0 obj << -/D [1416 0 R /XYZ 85.039 197.66 null] +1555 0 obj << +/D [1542 0 R /XYZ 85.039 121.74 null] >> endobj -1430 0 obj << -/D [1416 0 R /XYZ 85.039 177.43 null] +1556 0 obj << +/D [1542 0 R /XYZ 85.039 108.797 null] >> endobj -1431 0 obj << -/D [1416 0 R /XYZ 85.039 155.989 null] +1557 0 obj << +/D [1542 0 R /XYZ 85.039 94.642 null] >> endobj -1432 0 obj << -/D [1416 0 R /XYZ 85.039 108.661 null] +1541 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R /F14 969 0 R /F35 948 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1415 0 obj << -/Font << /F20 877 0 R /F15 895 0 R /F37 900 0 R /F43 1079 0 R /F36 892 0 R >> +1560 0 obj << +/Length 3211 +/Filter /FlateDecode +>> +stream +xÚµËrÛFò®¯`ù°ÊÄbðÆîI±D)IöZJíÁñaD‚$Ö$À@ËÊק_3Eª²k­*s0Ó=ý˜~MjæÁŸš¥‘ëÙ,I•¤él¹¿ðfXùõB ÄB@=˜Ÿï/þñK «ž›yÙì~Ýí¹aÌîWŸœ7¿]~¸÷q¾‚ÀÈù"IRçöž'Þ¾¿¹¼ºåñÇo~º›¾ÿýâݽ¥kwýßŧÏÞl þ~á¹A–Îaì¹ +–÷@ÕÂ@žwwÿ¶[ñZ8c¬!C?výç¦i8£”ïÊEDžy¡U„ŠzŠP~äÆa<3@¨‰È}.œ +BW³ÞNçääjAæFitB­ÝΕ“ƒf“ÈYÖOxj«M­q°-–¸:M±ê ª5þ'˜·y[ßñ£rj|ûi÷ôŸtƒÍ#Ž«zeÁ[Þn‰ãj¿×åê5̤óˆôxËL0âqx+ÔbÃQe$ˆÞí*„xœ/ü ]ÿœÇBòKÓ궨JœŒAJþ‰³Õ%Ào¾h :¶Ø‰ƒm†Êwî·<HÝœ‘Ž÷.dõÈ€ ðªO<Še^ë6Ǫל]Unm^ïù±!½5 Éø¡óÅjûiž†2*çÓUËðÂ'@܇]ÎÈÈ .Õæ@þkËV ¶… /á€p…ÔEçäÇòðœ“ü`O¤‹H¸U¾Ö¨”]Ë>Ýi·;$œGµÊZàgwÄïãL¹iNF¤ ¹†«ÊÍ#p q×H²k€ã(¨ªù"Š<ç®:Ö¤•¼ãB¸ðˆàŸ>x^ Bw*…á”{DZçza6íÞe ëæCUßÏÁµj½d¹ÐYƒ”uµg€[:½v_•:œ +MÿéEÞ]^-‘Ø©ÉC¿HØæk0¥ØàŠcì£ÎœÑ~»? ƒ=¡AÅ@!/›-²Õ‹ë3}4æŒb]çņaQ+åO¢»Š#hég¬Ðy[íuQ¾âÙº{Â!Î>ðÁÕ÷‹ßáO(@€P¿Ü w(Óò¸'³(˜=W\°\ËbÝÄnû óĨ$*sCï$éð'$ ’„óœò´c>íù®§¢éÈÒÁŒG–(ƒp’f'‘ÅçÈò¦ÎW˜s†90ˆÿ¿¨Å Òì…¢Á!ÿìúÀY——”ÝÀ;2ô¤bþÁ¬¥WÆIÖük2±µ+Ò†9{üñö°6RÎõ{ÐǯïoyîF»fWµ ÚCöLŸ^A ¤L†aPìŒlÇl·ÝöÛQÆú©oý%V%Õg;~ðˆÿ€ÕßS+'ضŒJcKÆ@Ú­¤“­`³)ëzν®^Ò/`÷¢†×bš­Ý¥£‚ú}aÌp"H4iô‚át@†#@¨Ž`Ôp¦ÈÙ¤f §G/ÍØýS/®ÞâØ· ,’êRÕµÇ`nMmŠ½6ÝDÁ^œœþW)ùªrqڢ䕪4xrP }¤Sò]Stø¢R˜úMK©q ®âžÿÃB‚¡ +7¼tÎd,ÕJ,é~ÿ²Ñ¬â‰]^nÚ-H‘sµ>§2¸í™gÁŒ'¬ÌW åú’GE+¿d;48t‰zIÉȺµÛÖP¹‹ f{jÖ :u\“<¬½¿çÁá(yWÖYªjàè°ÃM\„Mný–üX™Mp z„½¨Í°V¡ž­øq¼"ßÒ Ä¡Àz¸Þã©øô©a>MÏÉ÷‡¢îŒ×¶lŠæ‚ÓÖŠ'¤qgÇ’$¿ß³òa¯œ ûlûÎõÝ% ‡]ÞðàºÚP¿4FÍ÷N®*Á9˜Þ¿I£TºÄàð|Ý$"±:¡õ€ºD›ãØÉò^ª; Î )•Ë$¶ç'¡Ä[¸çtïÙj^)JSHÏç65>Ž‰.·Ãê¶wá=¸­ÉÝõ.rVtº3tº¡9ï`ÆÄ\ŸÞav1÷\¤-u£{"—EtJ¸TmYZŽE×µ–̇ӕ¨ÚÆ&>¤óÌF‘£Û¸äpÁæ ýÀ-–¢w-ÇüÍVH— kû‡Ç¥Fg> ›cÞ˜v’¼7´…LâØÊw•V(*SnòRk 4^¡ Éwì“ä¤B™¦&JŸIf''r ÁßÎxè–C©!ò(i.%Ëë¢ìßjLòk8)^kdŠŠ°ÿVwoßÜl{´ý/dÚNaf–OmÇFÓÎØ„ÖSï­ƒHdæÚcnצjz}rQ +‡rgKïiEöòUα1bz—IÉ¢í]ÿøFΑ÷3ÔˆâáÑ4ËMb0-sæÍæsI+F5Ù•KA¨ºvÌ mAVË98`Qp†æIMw´agIð[v÷“žP¡/—Éòœ•µâž¢†P±fú$LÍœUqCù €œªÝJ§+D9ëj·£Ã FT½¸À§¬¢!v`–DT]| T|bŸ + `öªô”ŒÍˆ*’• ”ç |ùF<ŒÉY*ïpÒ“ršßØPɲþk ,é +l_2Q– œ#Î>ï䪴À,´[Êü+žl Û6(Lf632‚,ít3”Q€óÅËcŸQ(/u“tº[܃ïg¡›§Íbis¿+áJVS:ë òp?;q½púmlš@à=a¯ ÎÂ^º~¨NÙs¥›}s÷¿XzÃøߨSÉãvxÎ~Ö‚'2òìãOg r‡y‘ÐGaôý¿AÜsl~y¤›©tj¿$švMÂmêƒyQhÚ™úùg!a×.Ó«.rˀʲáãÓû¡ïïº÷ØÁÈ·.‘ŸÐ; æ…:UÑsv£ …Tœóû7È)|–endstream +endobj +1559 0 obj << +/Type /Page +/Contents 1560 0 R +/Resources 1558 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1526 0 R +>> endobj +1561 0 obj << +/D [1559 0 R /XYZ 85.039 781.388 null] +>> endobj +1562 0 obj << +/D [1559 0 R /XYZ 85.039 761.463 null] +>> endobj +266 0 obj << +/D [1559 0 R /XYZ 85.039 691.864 null] +>> endobj +1563 0 obj << +/D [1559 0 R /XYZ 85.039 673.598 null] +>> endobj +270 0 obj << +/D [1559 0 R /XYZ 85.039 602.015 null] +>> endobj +1564 0 obj << +/D [1559 0 R /XYZ 85.039 583.143 null] +>> endobj +274 0 obj << +/D [1559 0 R /XYZ 85.039 483.287 null] +>> endobj +1565 0 obj << +/D [1559 0 R /XYZ 85.039 456.673 null] +>> endobj +278 0 obj << +/D [1559 0 R /XYZ 85.039 456.673 null] +>> endobj +1566 0 obj << +/D [1559 0 R /XYZ 85.039 435.68 null] +>> endobj +1567 0 obj << +/D [1559 0 R /XYZ 85.039 435.68 null] +>> endobj +1568 0 obj << +/D [1559 0 R /XYZ 85.039 392.911 null] +>> endobj +1569 0 obj << +/D [1559 0 R /XYZ 85.039 365.813 null] +>> endobj +1570 0 obj << +/D [1559 0 R /XYZ 85.039 340.835 null] +>> endobj +1571 0 obj << +/D [1559 0 R /XYZ 85.039 203.222 null] +>> endobj +282 0 obj << +/D [1559 0 R /XYZ 85.039 108.783 null] +>> endobj +1572 0 obj << +/D [1559 0 R /XYZ 85.039 87.79 null] +>> endobj +286 0 obj << +/D [1559 0 R /XYZ 85.039 87.79 null] +>> endobj +1573 0 obj << +/D [1559 0 R /XYZ 85.039 65.074 null] +>> endobj +1558 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1435 0 obj << -/Length 2548 +1576 0 obj << +/Length 2312 /Filter /FlateDecode >> stream -xÚÅÛrÛ6öÝ_¡ÉK¨™Ë xë>%qÚMÇQ¼•;}hûK´Ä±DjI0Žûõ{n (‹²3N=g8Îý¦`âÃ_0ÉbÏòIš^”e“ÅöÌŸ¬`秳@ ü‰òü$Æ­wWgÿú1Î&ïå~>¹º!«åïÎûÿ¼½¼úðËÔ¢Èɽ©›¦™3»âïóÏŸÞ~œñü—Ë÷¯çÓ?¯~>ûp5xÂUžJ"|ãg¿ÿéO–€ÆÏg¾åÙäæ¾äùd{¦âÈ‹U$ß›³ùÙû[xOMøÔ%®…pƒÜËÃxœZ©‹óžÞ–X‰‡ôæ^àM'˜ºqì;óºk¦nà,ŠÖ’6roè{q>úhxYÃtd/öT¬x‹Ð âö/¦aêÜNÃÌ) óùjšEN£âÕâšrnã¦ÞòǬ0Ûº* ¬Õ ŸùÃýyÑ|)ñÂ\âzÿß2HÀº‚cK^Ò×Sj„úB(À=ÁC»aê…icèÅÁËp¡Û0FoÛ5âaêJ0`{Ñ1›˜Ž‹¢\1,²¡z-Œªñs][^±+ç¼Þê²zÅ«ËÈNóÀ_ïqj“¡öǹ ‚¨“Ý–Ä]E‰(-\&aQÞ´‰g¾Â–ù'Dôl¤½ƒP?w‚KOY5 &ßdÕ![õû¦X–æ²h6½°¥VyJ\(ëèd}gSkdf‹P©Sß0ôÂÕÍ­|•fͳúœ|ªÑ(JS7ÿjÓÔéÈHŠ¦5ºZ–0¯V iÖ…œ½âQw°ÄâB8²mPhÀ)b5zÙœÈhï mSlá‚ÿ!a£'¢Ic'•½ -3r»Û'4¶‘Î(9\ …qI6Êó¶CÙ±{jHåù°ìß­ñJòk{]ÙÚ{öæRØnŒŠ`ØŽÐ[7È’UYéÍ&÷¬Çך¸P,O; -•{I ^D•Îÿj¡Å¨æ†ü!aô‡(+ ª(•R -” - ½ÃewS|IºØ;T½¹oKë0oxã¬Ï!Äó×e¹#&í78ÉÓf”¦=~Šö‹’DÖMû 8«$ôš1#\ Õ;Š¤.Ò-J´¤„ÔÀ]È^Á‹7K#k¬›×ûgV»ïw†}®¶¬ŒÅâÙã{˜ñ[I6β<çˆ\×,Ä{çLß,øM½;63£·§ýqæÅÉ)w1á;V^¤’Cw,žxVÔ¡(IAõ–<™›¦[λM»€™B#òr•=ÂA®7à Ÿ'â¨1Ã{Àõ§©Gæ©L}‡è?‚ñ‡±Dz ã˜Dÿé¯KºØ;½0¼±+{ÊfüæIÎPõV®z…w@¬78køÀ+9±äÏESlo‰ç#̵ -ƒx¦÷>»Ð`]óØÄ7•{ÊxoöéM¹ª¬ò.‡î9&.HTqÏ¥gŽLÀÅu¡!*gx×BB¤h "dc°ÄÉçl~fmîyô ¬àê£ìaª°üÀ/ ÃHE»bDÐ×âˆKµ‰=»>˜.ʖݵğ[ {—N ìÓþåQ"–‹m£#xNÈú6-_FË3Ÿ³‚Äóëù%¯`z8Ÿ Ÿ>Ïxƒ•.7í¦6½fCвVgáÓZcÆÔ²«/%¨€Ú.ùMTêÁ½GŠŽ±ip–?B«Ûňœh9É’äŠ( ‚“s^K‰CÚÊk6J[•Æí­pàDvÓ/E=DÝOiA”ØîÀó´ úÛµà\R@¥ Ùùxα½”Yq²‚ãÞ@i\7[¶x‰îArú ºµ,®+wŸ5Öc–”PÓ9JÛÍ:p!SÆB2ô< ˜7Ã0óø™Â[=x/pc7#š«8qGdŸfùÄ;¤KþQw›}ÕÛ+ÉX£»~’З»úÛÅ®)7¹Ç`¹[uªÂ^£¬ Ž(@³LB‡ÓÖšsG5/oÑ¥wVàF.èí ª½üUP* ‹å C²W‚…Ö4Ö±ãç( -åT^ÁãÜô(¹“|NÍ®”}¬‘z×@€:TVЛ8F`/@³³%K %ãš\Õ/SŠ¬˜¼„Üó^kÃhÛ’—úÅ©µ:<ÔUƒ(T þWþ1LBžµ ·riÆQ$*ŒPl®G©5ZÆGa,IÊ…6T.æl1D!~P·‡çh -£OˆáxñµlM 8'QN怳_/.xwôÈ¡ -íË]AMsP”gÏÎJâ—ÈJÜ\Ái¤ÜªÅñÐq¼dßákž>öEÃ~…®=(*ä(E=×zÿ› ®dŽ½°îúF^bÁ9b¾ÔfWoý'Fî4a M¥;¼G²ëŒH—»… ¤Fö²šÊŽtïf`÷8ÄàªÍ$˜rî?Øûš-)¦ü‚–УuÔò]Û–I´\×ÚÇŽjöö’2ÀWÇqïé+þ¬:‘b*äÞÒI¾5Ò?°ý4fFª§Uꘗ´jY€Ý.ClDG.´*ÈþlHÍ#ž^xÈSØ{ð‚EvËm@Ê]´Ù7à±›šZÞ5ú÷»ãd…£uÏ-?ïulÐp@ÄüŒ¥ãçÐ#<H½"ß@zŠ\üÕ„ñ˜J=Ž7\ã;÷<'³Äó‡fé‹“„E-¿;”Õ0{ƒ(œÜ#£%Ož<ŽñH)¿“¬‡mYµõ7’ÔHùfÊ­TwÛ ›µÃÚo£[©ßûÔ -Pí î—>íEãØ;õã¸àþ}¿Ó«ÐK"Õ3âñö@ôO„ =òÿÄM®9endstream +xÚ½ZMsÛ8½ëWè¶ÔÔ +ƒo’sKœdÇSkÇkkæâä H´Å[ÊHÔŽwýv ~t­«¶r°H>âu¿nÝ`ØœÂ?6Ï¡"Ÿ§#"Ëæ›ç?“¿Í˜C,déaÞ¯f?~Òð”’œæóÕC;Ž"R‰ùj{Ÿ\üüîfõñv±B$€\,Ó4K®WöƇÏWï.¯íïÛ›‹¿Ü-¾®~™}\5¼ÍˆÀ‘#é³û¯t¾™Q"òlþ'ü¦„Áãç°%…»~šÝÍþÑ eŸÉ¹}kÌG)I¹š/%Y&G1Œj’© „P”(*!¸/cœÆç5•¸º»½Y°ä¢ï"»„ÖsoÀ¸“‚èQ—õH¶)Mrm»-þ8§ê§¾mœ½Î}ÛŠÔ˜+S+§9‘]RúBé@ 'o*ÀH¥&BЂ"!p W… ðÍ!ˆÚV‡À³í¶8}‡‰@“ÃþTŒ|ÎET—3àî‚)’CrûÜ ŒDR=‰‰„½*í€oŽDÔ¶:žmïËýv–Áp<Ëá0ÊNXΉìªú¿ê'SSú· ˆþô*ýÛ߬Ô¶ZÏ6ÔÿÝæ÷‘9Â)U¤Æ X{s€ÁVÐUbpØ}t.‰ÊYt_ô0áhØ<)ð"<åBÀ _,•¢¸¼¹€E@§ÉÍB°d½ùÿ•½WÂóýÃbÉ’CÈRGµ´ÅŒ$gm©¦DÊÔXºÚ¸CËä¹XïË=ñh¯vç®àÖ®8¡aù…27×'{]º¿gô`»@–¡ÎGd_?ç>ˆÁ!¶Q~‡ðwåÕ9TO]~H<ôXàÞ:ápƒ‰øk1H÷÷õ „F‡irsVe$i”ÚAúÔ=WS’óÔ§Žm3šÁ_Æ&\mA_¯•‰© ïhh9QiœÝBä]oSF´frpWÝ¥‚pÍ'ÜmAwÈÖ(# ¼XIÀ$ÛÇRMR44f€Ã èº J¦º€ËYÈe•å$e"î² +»\ƒl„¯ÎOUùý W—wSB¡¤’;Ì€¼ç®&Œ©9}aÁ +VˆLO4(â®y mòù`¦ðåWL\zŸ1ð#…‹Į́=3°§W¸P’ª®=ô…‡€‰£Ù”-(¢€y +<Ì”~¿7vIߣù™7ÆaÆ ò§ºc }‘a÷eN¨žhamêÊ./¦yVÇ`sÍ8$±š«ÅDBÈä(ëÅ0u ãõåÏÐJmD<ïËýæm÷¶°1¶Áµ ‘d½-Ž±`›C9YîM|®ÈäßÄñà ֿP±×Ž®õz¼£¥žÇûTì«]7Ì×+ ÿÆ~ƒÃÞt»h>zEMú” Í`>ñùªÅD>äZÌ«å‰ñÖòôxGåñxŸ×/V“'×™ƒÛ¹ðn¹q:có+ø¡þL}æsØG>„¼ºcˆÖ"uIG5jIe§Ô0btÚãç¦/ž0àn7~¨éŽ;Þô¢Ú#"¨®D öŠ§D§ÒÙ‚~‰AžÁ†IT&†öþÔq%Jendstream endobj -1434 0 obj << +1575 0 obj << /Type /Page -/Contents 1435 0 R -/Resources 1433 0 R +/Contents 1576 0 R +/Resources 1574 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1414 0 R +/Parent 1526 0 R >> endobj -1436 0 obj << -/D [1434 0 R /XYZ 85.039 781.388 null] +1577 0 obj << +/D [1575 0 R /XYZ 85.039 781.388 null] >> endobj -258 0 obj << -/D [1434 0 R /XYZ 85.039 761.463 null] +290 0 obj << +/D [1575 0 R /XYZ 85.039 694.591 null] >> endobj -1437 0 obj << -/D [1434 0 R /XYZ 85.039 743.459 null] +1578 0 obj << +/D [1575 0 R /XYZ 85.039 673.997 null] +>> endobj +294 0 obj << +/D [1575 0 R /XYZ 85.039 533.8 null] +>> endobj +1579 0 obj << +/D [1575 0 R /XYZ 85.039 512.807 null] +>> endobj +298 0 obj << +/D [1575 0 R /XYZ 85.039 512.807 null] +>> endobj +1580 0 obj << +/D [1575 0 R /XYZ 85.039 492.212 null] +>> endobj +302 0 obj << +/D [1575 0 R /XYZ 85.039 463.398 null] >> endobj -262 0 obj << -/D [1434 0 R /XYZ 85.039 644.976 null] +1581 0 obj << +/D [1575 0 R /XYZ 85.039 442.803 null] >> endobj -1438 0 obj << -/D [1434 0 R /XYZ 85.039 626.104 null] +306 0 obj << +/D [1575 0 R /XYZ 85.039 413.989 null] >> endobj -266 0 obj << -/D [1434 0 R /XYZ 85.039 499.35 null] +1582 0 obj << +/D [1575 0 R /XYZ 85.039 393.394 null] >> endobj -1439 0 obj << -/D [1434 0 R /XYZ 85.039 472.735 null] +310 0 obj << +/D [1575 0 R /XYZ 85.039 348.304 null] >> endobj -270 0 obj << -/D [1434 0 R /XYZ 85.039 472.735 null] +1583 0 obj << +/D [1575 0 R /XYZ 85.039 330.436 null] >> endobj -1440 0 obj << -/D [1434 0 R /XYZ 85.039 451.742 null] +314 0 obj << +/D [1575 0 R /XYZ 85.039 298.895 null] >> endobj -1441 0 obj << -/D [1434 0 R /XYZ 85.039 456.225 null] +1584 0 obj << +/D [1575 0 R /XYZ 85.039 278.3 null] >> endobj -1442 0 obj << -/D [1434 0 R /XYZ 85.039 404.49 null] +318 0 obj << +/D [1575 0 R /XYZ 85.039 178.49 null] >> endobj -1443 0 obj << -/D [1434 0 R /XYZ 85.039 368.425 null] +1585 0 obj << +/D [1575 0 R /XYZ 85.039 155.168 null] >> endobj -1444 0 obj << -/D [1434 0 R /XYZ 85.039 334.482 null] +322 0 obj << +/D [1575 0 R /XYZ 85.039 126.353 null] >> endobj -1445 0 obj << -/D [1434 0 R /XYZ 85.039 203.572 null] +1586 0 obj << +/D [1575 0 R /XYZ 85.039 105.759 null] >> endobj -1433 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R >> +1574 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1448 0 obj << -/Length 1182 +1589 0 obj << +/Length 2628 /Filter /FlateDecode >> stream -xÚÕXËRÛHÝû+´)õôSRÏLH€’M’…" £ËÄ’k˜ùú¹·»e - UrU¸ß}ϹÏ (ü± S„ -¤#"Ë‚r>¡Á fþœ0·‚’ÐDáÔ~>ùýHe£DSä—fI>ý¼ß;ËÏ£XjÅiš…§¹í¿ût²w|jÛçg¿]Dßó“Ã|ãŠX™¼ãçäëwLAŒJ„΂ M Ó:˜O¤DIáú7“‹É_ëSìœ ì®$q¿"fšh®†ÑƈNé5^à FÔ&^M8‰XÈ£X)6«yµ,ºzÑ´=¶ƒSBå“—‚dêÁÇý„Ù[O.Ρ{vÄ&iø¾*¦ÕÒ¶»HÐðß[è°° Žàì)A2"S±–„©IÊÅ<ŠY8/š©Õjq®æOÃQ ÿ$0Q7ö·»ŠPhËÐìm—·faiÇnaº(qÿuij°êì°ÛsÓ¾µ|Œ'VD*Ð)WDÑAzíº]`¨|t¶d„ö[·¦ É Qšñí7ŸW?WUÛýá].ˆ¤Âî~ IªÙÆÁƒj¢w”zl1ÊIB9ðʼnb¯“¯M›†àm•Ïºv:Ž5>ÀšŸIkÉ+dm¿n¦Y-0…h¸>kÔ®cc.™ŽŽŒ§ d¼+,ûÂ+J8Ôž£„—¾ð’dt|¬:¯JHK@¾-º±n’r¤ådžüiF´–;bÿ¬nºúö«­»!)W‘0¿"IµQìX82ö³0p (¦&äÌQ3>MÄHpN&H¶3t— ãûØ)­{cÓÇ·¦ãT#éuI–íËg´.l`Þñý2ûØZ$ó@Ô9ŸÍ®Z¦/zñ ›\/:“ Ve·ZVϽù’-I]êeuÑ?ú¾ e:~g3ø›çò¶ÚNY[ÿgü£OÓ_0½ÂéoÜëÍådÁmÿGݵdà=ùléòb”®v)¯ -›„w Ï<0ñMY,ÌÖø`ÒT)¿¦³¢Ïù1†ÜÑ0ñ˜CD@ æ4Æà5îÖµomÏTfÓº,ºº™Ù ]=¯Ö“f¤5…V )ÌÕšmåºvc!e#‰ Ó)%Q,¥§®\[Í«ufÅzÎ6Ëú²§7!Èô]g'¾QEÛÊÜ€ßPŽ J"´¬Šn‹Yõö¾éì“ lHe‚Áìé=ç/T™´*ÃoZ,Ì1µœŒÕÛins6ðÀ Ù[$F|g‘@´´D§u±ÑË&ç÷_]€ð˜¶4 G³Ñ®¡Ù -„§6¾ÂÌÌŠžã~d;ÍŒ3ÂíW#Ÿ‹{ÏñmOr’å¹Ù ¯Â+óÜš¹åè¡w#endstream +xÚÍZ[sÛ6~÷¯ÐÛJ;+”^ºONœnœIí¬­íKêYb,µ2•JTÿûžƒà dG»3;Ôpˆøpn8 ŸðŸ$Š2Ä g2I&«ç‹`ò=ÿºàFbnDæŽÌ›ÅÅ?Eа4H'‹/Õ8Š…JNëÏÓ·ï/?-ÞÝÍæRÊ)HÎæqœLoÔpuûóåõ =ß}zû·ûÙÃâÃÅ»E‰[Ž)‚þqñù!˜¬a‚.&ÓdòÏãÐý|¨L…ÒüÞ]Ü_ü»Šú ½ÕµF+1ç)K…òóqF²äA¸•,™Í• +¦ÿ¹¹~5›óé´ +à Š§¿*8åÛ´ì¡…O×u‹Ã6ÂçhºÉð­å:;Pß׈Ÿ°íH§_.ËnøL÷Û¼ÀŽ¼æ0fqw-\p–pX·X¢¢NjxA_܈øãÜ!äÆ¡¢11®b–òdâ ÙÆ52-\®\Ü(f<º¸§˜Û®€j‘Õ2ÔTC³fÔr“i¦›ó2k¹d2æ|TB>ŒÎë—ìØíõÕß[°aDtø`L ¶N‡ŠˆVÓ±F6âé +·ã¿Ÿñ!ËgÀP‘­‰“Gì@Ó}jüªYÜkîHúУfQªXšøíË‘éç,JB¦TÜ°¯´´¯ûÅ]eWh$9Ng¸rÍ+Â=·=ù“Ç@"ð~‰<×>¢V‡k3BÚ>®ab78Ã>·m$bQÄ'ΰ6B2-ì†Æ¡ÅÅ~ ÝÕ[ŠÛ¾ÛÍ í€V9¶¨6ËR9ŽØV`ïÖÚÐþ ýÅ÷óº½IÐ4P·Í_Xj­Å9²¾ ¨÷«N%ã¡WÂRUÚPîÜ\âD~†¶w5ÚeùS±Á¾¹^ßZ»êe¡í`M¢à¿› +þš´ÔaXÇDÊB)ÎV² a*ŽX0B %“¢­cB;gÔ#™tKÇÐñ¸Ð–Ö¶® “8%£2ðÓñÒ¨wO}žY Dì'Éê'É +·D/¶µÄ&v§%ºØÿ_–¨bˆ§2ôZ¢#ã¡7Š˜€¿ Kä®5+\îP/žòÊê"Êz-oœwW‘daw\ú+–§Àÿ€¬Ú5”*éЩ€tªµC§£S èVÈ×:å@£N¥b7&”ë2ï¦bOŸ´ŠôÃg”©pŒRK‡s”zœ‰túZ‘%&«Û§\ïȼlµá§Á´ØdÔDj»<L­²nÿ=úå7ȬÖ(œ8ãv˜>É´À¦²Uߨn$b$L[¶ÑHLj–ÚMîúôP$! •zõБé'DÄ’)ѼŸ€ìIëáÕ-™›Ô¤ ª—ÏÐE3ÒܪKáH$듽¿¾rJnëý3’¦ÓHhºGO¤õ4qªk§Uq:dÿ¨‹h¦ –=Fƒ-’S.dëåºd€+ÆÀ£Ì"U=W•E˜²4(JZ¡Ñž×µßó6¡;=¯ ­jžvÅdæÚÃ’zg}aHÈTE Q yÈ0BãÉðA—d4 »Ép Ï/Ý85%á~TBJŒPýöºMH$‰°‘i× ëÔ„8À`—K{¶»6H=ÂñÅýsc e™ +õ^w‹ …¸5D`%ä!Ðñ¦¶¥LŠ %ü˜F¦…ÙP&ôÕ²†ÙÍ´·wÃU¯~’.Æ<äŒ a*Ò”¼ßìébðÇÙÿžï_è4¨ûžôªö§¯ô3+V eƒg½{z$þÖZðœ™.‹Çýsö²AE‡©öÝrðì}.Ñ&YŽL¿'ááZ«v’,5*ɲ/ÿ’,g¨þ$Ëì“G™ó{é• eº»¾*¿ýÒÉÕPvÄ!ûQQzn~”¦,æ,#3:!¨Æìϸ逃[O^0òSER«;>ýžëZt”š_:{f>H¤·çÆ÷ÛSj+¢šíÑÅÿÌDƒûMmøK|zûñØ÷‰å7‰Ä#ÿT2ý[`dFo×nA·s \uvB q5ô5¡•ñ}L¨eF“áõd4p;ÉppÝ„M·÷³Djè«+ãû(EËŒ¿Mõà–—©uÜî»Ô +·ž»ë×1m™‹éý©¨ƒ–t0Gåøf W×Ô³/Ù!ËWYmD‰ºjàí;Ýü£huÖÃÕ¥›dI_½ NÌ,ŠC3¤EÆÍéB>ÈT"Ûóý,ÝÑ¥endstream endobj -1447 0 obj << +1588 0 obj << /Type /Page -/Contents 1448 0 R -/Resources 1446 0 R +/Contents 1589 0 R +/Resources 1587 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1414 0 R +/Parent 1599 0 R >> endobj -1449 0 obj << -/D [1447 0 R /XYZ 85.039 781.388 null] +1590 0 obj << +/D [1588 0 R /XYZ 85.039 781.388 null] >> endobj -274 0 obj << -/D [1447 0 R /XYZ 85.039 761.463 null] +326 0 obj << +/D [1588 0 R /XYZ 85.039 761.463 null] >> endobj -1450 0 obj << -/D [1447 0 R /XYZ 85.039 743.459 null] +1591 0 obj << +/D [1588 0 R /XYZ 85.039 740.731 null] >> endobj -278 0 obj << -/D [1447 0 R /XYZ 85.039 743.459 null] +330 0 obj << +/D [1588 0 R /XYZ 85.039 695.985 null] >> endobj -1451 0 obj << -/D [1447 0 R /XYZ 85.039 720.743 null] +1592 0 obj << +/D [1588 0 R /XYZ 85.039 674.784 null] >> endobj -282 0 obj << -/D [1447 0 R /XYZ 85.039 600.999 null] +334 0 obj << +/D [1588 0 R /XYZ 85.039 642.981 null] >> endobj -1452 0 obj << -/D [1447 0 R /XYZ 85.039 580.404 null] +1593 0 obj << +/D [1588 0 R /XYZ 85.039 622.387 null] >> endobj -286 0 obj << -/D [1447 0 R /XYZ 85.039 368.476 null] +338 0 obj << +/D [1588 0 R /XYZ 85.039 577.034 null] >> endobj -1453 0 obj << -/D [1447 0 R /XYZ 85.039 347.483 null] +1594 0 obj << +/D [1588 0 R /XYZ 85.039 556.44 null] >> endobj -290 0 obj << -/D [1447 0 R /XYZ 85.039 347.483 null] +342 0 obj << +/D [1588 0 R /XYZ 85.039 456.891 null] >> endobj -1454 0 obj << -/D [1447 0 R /XYZ 85.039 326.889 null] +1595 0 obj << +/D [1588 0 R /XYZ 85.039 436.296 null] >> endobj -294 0 obj << -/D [1447 0 R /XYZ 85.039 298.074 null] +346 0 obj << +/D [1588 0 R /XYZ 85.039 337.353 null] >> endobj -1455 0 obj << -/D [1447 0 R /XYZ 85.039 277.48 null] +1596 0 obj << +/D [1588 0 R /XYZ 85.039 316.152 null] >> endobj -298 0 obj << -/D [1447 0 R /XYZ 85.039 248.665 null] +350 0 obj << +/D [1588 0 R /XYZ 85.039 284.349 null] >> endobj -1456 0 obj << -/D [1447 0 R /XYZ 85.039 228.071 null] +1597 0 obj << +/D [1588 0 R /XYZ 85.039 263.755 null] >> endobj -302 0 obj << -/D [1447 0 R /XYZ 85.039 182.98 null] +354 0 obj << +/D [1588 0 R /XYZ 85.039 136.846 null] >> endobj -1457 0 obj << -/D [1447 0 R /XYZ 85.039 165.113 null] +1598 0 obj << +/D [1588 0 R /XYZ 85.039 113.524 null] >> endobj -1446 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R >> +1587 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1460 0 obj << -/Length 1316 +1602 0 obj << +/Length 2957 /Filter /FlateDecode >> stream -xÚíYKoã6¾ûWèV©€¸¤HêÑ[v“ízõnco/Þ‹±ø‘ÊrÓþûΔ²;°¤h âc4ä7óqf(3‡ÂsbI(Oœ(f„DZ3šu¨3†™_;ÌJPGJœz?è¼û(c‡Q’ÐÄwn[Kø‚ˆãt†wÔÉ`Ÿ;”ð$vž M KgÖ’)¸íO;ýÎok-fN8æ­$~%᳄$lFë#:™¬ñ´oBâ1Ôy¾” z>s¿Ô…1‰ìÆIØJ?¿—~÷lFî*i¶˜Á¾Ò|n†ú]èÙéeYà&W£rU(eõÝúQ@8l×`×Q£%ì$$x“„8²ã︫nfÀƒú.%!ŒŠºö„€¢r&”Ͻ vW°À 'ÜŃaÞruï§8^NEŽÏ\-ˆ¶ˆd0 -öó+ÂP†À¾uKII˜DKD2Ù†!âú\œgC €P¨?óe¾°€¶ÌDî½çÃUìÉÀðM|G_ÀÃpò‚p‘4[ÕËc¦¸3Bó¸GÃü]V Å>jhVÀ+žøF¼›)mÙe~P&”}ýjUNPC‘—z/.i:¤ˆO ‡óú2’A¬¼p\¥y¹ç-Á/8ì-q¢· T×Ù§ëBÏ×~ªh \Óöòî#·´ú ŠF`qI$z…Þ¢Ä×Õ/ä¼ÄÕ‰õ2øš [dl™ [šf¶ð$sG«™š— -›™WS”QOFsáÉÀUûd`k‡Ž%Qt(ßbR>5߆&ßö·›œ‡;1¹Mƒ7å6úLVÃ=D$£#u`ë\s‰Ë•Ú/vA=•/Í35®áA™¤Åä¬×Ñ%B­h<ú`_ÐY˜€f±¤¥ÊlTÛ^Ð U/]ŽªòÝuÑÉz®TÅ’4Øp' ?\!ÑOsLdó½×ýt+jÿ„ÚV«y>ÂÀ#Àµ®F šhäi¦Š—ºn§ Ú‰6m$S5CäÜqº|ŽÓÞË€¿0<+Ð8Ð?_x„oð,ýËÀ˜D`Ëž p4Yðª‰æ—Gß~ý)v²©™Œ:ŠêÔª2ÒTi„ „q 4”mÄÊxïH27Ø„ÍK3÷ˆþ\áØÒܯ >àëixPw‘C¢ÐÁø¬³|Æåb·îYyžgkŽªÎ:Æí¥íUwnH[¹/üî…¿v¯n»–>DS[P®L)ÈuQaËÁG-¼0õƒ–n¸EpËéˆðø`îeDñ‰œNÖœ®—Á&ÁÑ6¥ÃójƒK$˜á¥êÿVª “šjay„—ţư˜Š6Ë -FÃ{Wæ sov¼^%W,˜L¦cZjÊß̈®æ{¬€@‡•µ6Q Äx£ŸB.WyÈÿO NBÐÊI`Û¡/Ø9éQ秱þ´p¿N8Œ÷8Àãv8ð˜"¯3Kg=T. ËǪܩA«£í¤õõ‹Â¾ù¨‚æ³`óñ¼*p-™žòFì‰+'k]iQîRKI±Ó}ŒjïM{R)L³ªU4’kóå–Á¯t o==éð¯¼ßüw“Š¡¥‡%ÃVhرÁ)Éâ`®à’DB4çŠÍÅïŒÈD@B.÷n‘˜¹¬ïÓÊì˜ñs*Nendstream +xÚí[M“Û6½Ï¯Ða«,m,˜‚ÜKÊñG2){ì™Íh‰©,‰ŠDyÊÿ>Ýh€¿@9ãò²•rL‘x͇Fã¤ÃIÿ…“D²@¤•„L$Éd±½&wpåç‹Ð æ2w0?Ý^¡eÇÕzw7¨–L!éåˆZ5È£–£–´R«EÚ¯–C +SŠ.¶§*IHS£Aƒ•RV¦ò ÓjX¢H²˜ITƒ<–èH¯0à[˜×ÛÔ’ÓPôQL‡º)TÌi(:Ô”K‹©ŠYG.é˜yÀÁÝoL[#Á)˜s…j·˜AX6™Éü¹é& +ú„C`]b÷~¡ëtC†]»Ë7tŽ®ïu±ÉûU€4PïýýZƒ<ýj@社´Jýiê;¤N¡X r²›‘@:Çí8hTŒÜT].´¼Ý±`¬TF,N½f«†xô + ubÞ¶·Šìí³WÕÈ記B¢@¶ÙàoMKs§©>›2îðaÀ7׿ù­­õ8T~õ)}œmµkùj‹`®…Uá`†-®L8 Jõ·³¸}ƒ_Æ1 yêüh8™-è,o奵ުMÛë­\Úïæ­$Ì92­Âx4#ÌõÒÇhËe‹±·Z:ŒßÁUI‘¸ G„ªA¥ è¼ìòÑVÙÕ¢íÏ.‡öûe‡BðÕjG5:'Á|¤U†µHûSÌ!ý^² ¤þ¹ÁÁ +¥q578Srb¦äkøùâùM=ñ-ùÒLqø ÙæH3Ýô—.ØxAÏv¾Ë¶{Ï<¥‚¥½K(²$„'áäÀˆa‹”`A2²²³ m8WÙLèaNß%Ý¡.Œ¬ÓlÏÐ"L‡»™&QÂ"€.÷{kaMÒhiLÖ€(ïÀ Ù{ÐÔ¢Ô (¤Ííåë]-R]B¼”Ó¡l•™T——²\o«Y¦ËË~(Q@oPÓ›ôÆóÄ"€µv;çÓ³m¨¹ÿ¸Ðº¥aêDk÷Xy= Ñ 9Q»­ZÐlêdËû!8¬©²—tئoÀrÅÒTøû¡Æ ÓN…ƒÒŽ¯#5C“‘>Ìès·Þ[Ìu­Â[@#¤Ó/ʼnP[$ÒÛŽKö)o´¡=g±ÿB'qÏâþ nGHGöV¸¡1¬›Å EÏH }‰SøYm„u€²‹Gz0ž(ç1t{9b>Ó]ØßA8ýÐDd'´@x+Äù…Žî×v;~ÆæÄa3ÁMüûxúpÔa‚jø,ã¡:R˜õþŠ¢ùtd 'Áæ<–Ó==ÍñDÓˆa‡œ]›ÝgJSœgŽ™—¡¶–´†g¦ãñrfnËl•+Û")SÖ”²‘´÷üÄD§³¬ØMÐ%¥&Ý;fpƒÜÂÈÄ W1 ÒoÍ,ú(„móEëÆÚù“í?Ô…ƒó¬Àí¶‘]åãé-´¶“wÝ-À Yèå56oÇчpÆá5®ãÇ‘ÿoQö8\–Kr› /e +#N4Gô‡ŒÐ/¥™¨3]Åîv[kWRÒ9²Ûpß ^ÿDÇ«<[æ‡á!‹‘Ž¬šGd:kÕ䥵«¦6mïªÉ¥¥ÍÇb]-zhc² }Úy ónÛú–èû†Õ‚åF¬–G-ÒäúÄðc¸éõ*õ3L‡¹ëÿTƒ¸Vd®íp=e¬NK[ÓšNþà¸hšW÷L²£·ì71"€ÚûͤƒV‘§Š?ùU/íûQÔÔy¸Y0h.y1¿µ¬ÃÆ’+˜ +„ø¿±ì7–’ÜZX¹53¨ðBí⌕üloÓás¥z¼$=¼]‘¥”`)­«¥¬î×xÇ_â®®ñi¸éLÓ/»«nc?ËiZmþ¦V“ ÎTªü3…òÔ8B5_½é~~$býÑÓÖ_­d¦¥‘°ùB7¬ª’u|&Ìäô‹a0Ö–Ï”°¤¬Î~ßÐkèõNÛ©ÁN +¡*GcTƒ_úó a Ð?<6Û’?62FŸ–±á.ÖKú© åGûÊ%mSéZYmSe'½žø&í =ö!LSAüÐÝd¬ÉȾ©ÁœµÖ¨Û^j´8{Wç^¿ŒêæbcÑá{À§º%X*b²)toçãÔˆÁ´ýMb2Mùƒ‚¢¾ÉúXtLj±lSÞÀ8,'„PndáдJÁF¾¬ žÕó6ì=\w7¥è0£A´[ß)JЊqYl³µ™QÚÛ7ï¸ÌYfôÂÙ~•µ²u?«Öăï Ñ(9²oà€<:PkwFð¡´¼Ôö­6uïZ.õ>;¡ô^AAsß¡Ø *ÀcXiŽì8 ÔR ŽðQW +´¨ûp¨?uù|ð©!æXŽŽäyj:s„øx«1Òâí%ïéèîC6>X|Øð€å~Œì\Ö˜a‘ æ<|¤V¢i¯Bé=Ž‚âðéî ½õ¾#ÖÀ´ë8¤ø)GÔ©1ÃêLçrÏÇQ¢_û˜ ¤ÍÜò‘~¡ì0›Ýì°ˆèÙ_½¦3oP»ÿ‚&/éü[Ü_ÌôÇ{ü¡ÀŠ³IáyÇ\c<ÿ®…0_!’ÙŠÔbîÉaîˆdÿQ‰ô’~¼ÅÙQKd2oP™°hÌIÖÏg+„9ç«cõÑJ“±ÿ›•š±;O!ür¯Ý n­²þOÝàíÊ<èßeÕï˜KÄÀK!É‹UdbÁço<¤H˜LD7Þ?g ¯endstream endobj -1459 0 obj << +1601 0 obj << /Type /Page -/Contents 1460 0 R -/Resources 1458 0 R +/Contents 1602 0 R +/Resources 1600 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1414 0 R ->> endobj -1461 0 obj << -/D [1459 0 R /XYZ 85.039 781.388 null] ->> endobj -306 0 obj << -/D [1459 0 R /XYZ 85.039 761.463 null] +/Parent 1599 0 R >> endobj -1462 0 obj << -/D [1459 0 R /XYZ 85.039 740.731 null] +1603 0 obj << +/D [1601 0 R /XYZ 85.039 781.388 null] >> endobj -310 0 obj << -/D [1459 0 R /XYZ 85.039 587.122 null] +358 0 obj << +/D [1601 0 R /XYZ 85.039 761.463 null] >> endobj -1463 0 obj << -/D [1459 0 R /XYZ 85.039 563.801 null] +1604 0 obj << +/D [1601 0 R /XYZ 85.039 740.731 null] >> endobj -314 0 obj << -/D [1459 0 R /XYZ 85.039 534.986 null] +362 0 obj << +/D [1601 0 R /XYZ 85.039 614.69 null] >> endobj -1464 0 obj << -/D [1459 0 R /XYZ 85.039 514.392 null] +1605 0 obj << +/D [1601 0 R /XYZ 85.039 593.489 null] >> endobj -318 0 obj << -/D [1459 0 R /XYZ 85.039 431.318 null] +366 0 obj << +/D [1601 0 R /XYZ 85.039 508.095 null] >> endobj -1465 0 obj << -/D [1459 0 R /XYZ 85.039 407.996 null] +1606 0 obj << +/D [1601 0 R /XYZ 85.039 486.895 null] >> endobj -322 0 obj << -/D [1459 0 R /XYZ 85.039 345.317 null] +370 0 obj << +/D [1601 0 R /XYZ 85.039 442.148 null] >> endobj -1466 0 obj << -/D [1459 0 R /XYZ 85.039 324.117 null] +1607 0 obj << +/D [1601 0 R /XYZ 85.039 420.948 null] >> endobj -326 0 obj << -/D [1459 0 R /XYZ 85.039 283.347 null] +374 0 obj << +/D [1601 0 R /XYZ 85.039 309.668 null] >> endobj -1467 0 obj << -/D [1459 0 R /XYZ 85.039 262.753 null] +1608 0 obj << +/D [1601 0 R /XYZ 85.039 287.255 null] >> endobj -330 0 obj << -/D [1459 0 R /XYZ 85.039 199.468 null] +378 0 obj << +/D [1601 0 R /XYZ 85.039 203.073 null] >> endobj -1468 0 obj << -/D [1459 0 R /XYZ 85.039 178.873 null] +1609 0 obj << +/D [1601 0 R /XYZ 85.039 180.66 null] >> endobj -1458 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F36 892 0 R >> +1600 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F35 948 0 R /F14 969 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1471 0 obj << -/Length 1990 +1612 0 obj << +/Length 2719 /Filter /FlateDecode >> stream -xÚÕZ[sÓ8~ϯÈÃÎ`ïaÙ’/»O…r)-Ûf÷…åÁuÜ&àØÅBÿýž‹œÄ‰Óº:‰í#YÒùt.ß‘+‡üÉa¨…ãEà ” Ãa28ÃKhy9¦‡3TÂñ56=ž¼ÐáP:"r¢áø‚ºŒ'ï­g¯ÞŸŸÚ#Ïó¬HØ£ ­ã1?ž¼=8:æûÓwÏÙƯÏÇkSŒ”P¾‡s|¼ÿà '°Œ×GxQ8\À½#d ç¥=¡•gž³ÁÙà¯å(ܦ†üV&£¶ÇHF"ru¿¶#ÔNGK}]§GßH¸Â––'¤k´v¬“§öHZ¯75ó#áhXÒíšyÂïÕŠä7/æÀŽ¤5#ú~`ýëh§8ÿ˜&5?Çu]ÎΛ:­ En.p¸Â‡Ž\¸A/jZ(êìêÁnYäßG€×1‚4öÜÍU(GøNÀClŽFkƒKÝ3¸óU†l_#¼(+KóËzŠ÷.2˹ùÜvC뺆¥¤¸†„Þ˜,O²f×Y~ÉÝaêÙÒƒ!¥jÇÈð ±…«ÖBj¸ºR„òûaûÇöÀ¸ŽßœÀS÷„¬ƒWYØ°ÁV -ÕÜB@”iB¢¢„§ëVyí\A÷Ð*4„´NË^ëRÑCB¡8Gg¶>¥¹-ã9 -Œ! þ k!ý#Ð; Hû„a¿>Ô‚¢ÌvÞÀkWuÔor4‚@Hš9õXƒb² Š‡å)“4„Emƒ‹\¯¼ƒQIÚŸ]a\™«tÜ$`Ù»ü@ã؉Êg4Œ8›ÕfYV\ðµZºÈ—Y’ö¡àGdß2f°+5K¡Üð®©ÙãÔüîäMOZöÂ`ÏiùmÆá*+¿e¡ì€e``ÄE†(&×,›Æù$Kweê½÷LLcÛ•¾w-ó0¸ý¦„ãëÛléÛƒñlFªƒUa®)ªd=æá -é°yøLû™[èºw5Åæqx‚Š¾Ýœ1P¢Ü³‰œº+û˜s„€¸ -ˆÎСÉ|Bˆ½àh´#MR7eúÅ>[“éF¶…ª.08–é„Çá$M·M>K -²º yc¿…Âsåg„º°gCè(0±é¥ûÊM?07ÈN&«,lÍdoª½"[;ÝRLË›“·iæ·<ý Ôj÷ Œ$ÎÊŠNV¤¼–‚\®Bv¼ÌÏå¾P¸ÿgPsmn/iõÓ@€Å•¶viÄÀµf_c¼x0-4QmCå£i%57ÛÞ­)]sÖS3Æl(ðgb„´ÜK¾ŸÒ{ñ$-Í„ùä[‡˜ÕUš!Ç$®—y*È! -\΃þKÿˆô_¤Ös:ľtm¤¬ Lì„™~\lÝÖ:X-úf6#QO`ë; A =휤úEiÎcò¨_wv—ïKº¯˜sKšì ¿Cµçp[Íõm–úàQu}ÝI.äŒb"Ï…O¤õd kVÑð”u I¿Æó«,5â8ç—câ3qõ'n JIýuw¬lô)/Ô=°.ÉîŠæŠû¥u‚ÐaAеË1·2ŠtµAls“5)_ót1Mµžê܎ǹ.‚wÐ íŽlBÿ|6qº$ K>aÈ„m¦,–)ÄÃÎÿòÛÀó"× çŒðîSNÎ .^é´¨‚àWe7Ó¶õËFh^ÄY¸ ÉgÓÎØx÷ìMµsJÏîÏeßéŠzœ—ð¤€ÏInf!¿ºšë)ÝfoJïcõ]~¸®‹‰ê†}5ÕySwËôøÜœÂ~1^C'„éEZ¦y’vF³ßYÉ+yú†Øªî|ÈîspÅšâëËž‚>p÷^Ž_СÓ*À¢úiù…ƒ)Éâ$)š¼6O %C>3çñ›¥\ ö sw!ˆÐ–Kî°¾vÉë@GVFÙó²È™RÐÚKCDâ¹!U—uÅ÷‹YÝ2¤…¡žØùMå­M)#H¥^h&Î{¨hëØþˆJˆ‰ÅDâ¤6<”)LÊli˜!QÍÓ”’ÅÌL*ÎïøU8nèí"Aš&!þ@„²ÁQŽ6º+GÑ›Æ-'\H$UJêkdöÆ/Ä nçCœ‚häøÝßzÐÀZ´i/rLAqzªo7mÁ§È`¸0-ã1oÆ̘QÇáø³Ü› »7ÝøI‡D@…v‚»œ"}Ç°z—ÄÆ“:äÆsF£·9ÖÚø2Òâ{kÑw«@·S:bt²‚CD÷ÐvÉ Œ¢¨<'mT£ôí¤4ŸÑ¶ŠotQý˪Ñ›â\³Ü>óˆÃcK{fËB<àšÔTáøÖþt^±Hˆ}¼á>VoÎô7Ç…$îßõ¶x;r+µÜ<‚Ÿø¸ÿ[¾þ]_ˆq;r,,»Ç{aÏñ$U'ˆ‚ÛmH×Í¢ä.L‰uµÆØñÁÔøì¨C¨|(€•ßO-VÜìÿŒ¡\ᯥ–5÷¶ÌÙôé€ùµ›4endstream +xÚµZÛrÛF}×Wð-`*cn¸d\N$'L­å¬¤ì‹ãRQ$$¡LZ”Vµ•O÷\€!.ÚÒ–Ë".sfº{ºC'!ü£“D’§“8¡„'Éd¹9 'wpç—j3™9˜Ÿ®NÞ¼ànHÒ0\Ý6íH"$Ÿ\­>?ÿúî÷«³‹éŒsr:‹ã$8¿ÒN?~x7?×Ç¿ÿüÝåôóÕo'gW5oÝ"p¤HúŸ“OŸÃÉ +:øÛIHxšLžà8$noN€•HÁÍùúäòä_uSúž˜è§úÆ(8%1““I’ˆ^ #’È„!‘¡¨…`®”2Â)›X*ñÇùüòꂵGH#J˜l ½¤Ó!¥Ò%ah0x—t¿Ë¶ZÞb±ÉðHûbJƒ|YNg, Væâ®Úæp¹¸ëôÏ 8æI¥¥yD1 cDñ‘Ö¢´HûEqHŸ¦0ðrûeW-ª¼,Œ>0úÅf:£A¦/ì d‰WŒTSsO«…Ü Ù+M‰ŒF<©Áx´ +BU݆»Œ)'ŒMgR†Áå»åRoÕŽº 'Q¯»ÌlK3§©žŽ¦œ¤vt~þ~ÊÃà#hÅÁŸ¡ ¡×;Ú Öå]Y¼Á¿†”ëkùÊü·¥~ +Þ/«ýV½h‚)B¬¡Ü¯tƒQà²Gé(‰!×=ºQf93¿*Ó¡=ŒzIJ¢ˆÐ.×9¼1ˆc•ŽoùÊœæà‡Â†:ˆˆhpśž‚ƒ{‹Y:¡R…>pÔ¡— +Ê`?ü/µy^ªa÷ÿ­4›Ÿ~ß}¥Ùé­ÁthU“ áÐ¥“fqPæZ;™¢Ïá<°ÕSxzñÖè³Üfµ¶Öå}NÀ1ÐŽÈUcêZƒu¿õî i1ôTË)8ܽÖãq*£`±Þgؘ¸#§™'Iœªd=LbÓJ^-áQ “3¦úüú[°9Dk.\.`žRÐÝÛ:SüŸºÄ˜ât›Ÿ^CÿxM!'Ô4W¬ìI}Æ&%’Ôï Æ#(\Š Ìjy…Ð^qú;ÞSE¡ 4¿¤ŠÒ-Íœ¦úª(p]~ØÙ‹³÷º(B¹Wåf‘›é«Ì&ÐÃ&<Ñ´y45 ãMÎG]›\‹ºßäjàSBÌ´@›Å­thŠü{£4²Š•·ú×– Û6‡IjH0ΆòG°äÌ€ŽÌG] Ö¢îÌ¡z½²ÇÒ”pžŒˆÕ€óÊwðîfTˆ‰˜ˆ8ö¾0‹éÐXC×凴Ÿµ­ã}_c}Jb³6°¨—S¶jmiÀYÊ Íõ›cƒ¶Fƒi¾ÖtƒœTb|„Ò&l…8¡>Õ8„]·=ü†åmH–8!Q:²|ä€<Âvt¨ŽTeÿN{߼ܬ[險Žp»v9?íIJb°ÝWèšii¤k9¸Ãç‰\ŠWè–mÉß-†‡_9Úýâ1¡Ük=Òá; ‚™È¾¯ðJw‹ ‚Lý_ŒÇºEJ’8j×Íò¨ºÙ>ü +u³ÓÔpÝìv¶ûõq¥>Né@b+åÛò}¦–\3µ Å6×Wõ2Hs>åTUÝx¢¿ŸáGJˆGªØÆâq°æƹ„Šô¥E7ca)ykÔÊL“OÝ + tâ´Úµ5¦CÝ)‘(\q©E¿}‹ìðG<¨ykåNiú3 +î²J_³ÌbŸqØôÅ:¿+Z–~ê)¯Ì2ñ®Zl«Ãšàò<ó“gæš@ÈXŒM› Èó* èè•u/µ-ÚÔ½E‚KíÍ|Õ‡© +Óˆ¼0Iî:+ßë6$ø-øîˆXhX, :Z,/µ«MÝ+–Ký ÂA$F–ˆG,:j ÄKk×@Ú´½k .íë¬4›Ž¾jnPáÞh:FGa:Nam­p‹¶_a‡ö›¾Ì1§60°7ã NCÒÊ„H1²vâ€<Òл¿¼¤v÷W›´w÷—K:XS`ªàß×7É× +Aê¦# &È£QW8í½´®ðwÍÔn× í[ÃÁÍ)^- ¦CØzqLm`q ;†~:pQ†‰O˜ƒñ¼ +©MÂÛ9p¤sà?.q“E·N…Úd~I¬[š9MõåÀ‰Úbäv¶wÞM —DTÀÔ×lÙãÙú©1J§+• Í1§=ëfD‰Þ+ëá56o+ŠõNÙ†×Ù™¢¶…™¹{p3‘áØž”ãÛʧ0GÜÇkÞâí¸ÃëìNUcß ZR’Ê‘A7˜áAÌуöñÚA·x{íð~É—˜X|Q»£íèEïèÃsˆ‰½u-ü×_^´c¿ùÐÏIÂÖ`%‹I Óõ)mwWr˜þ!4vúû7~Œendstream endobj -1470 0 obj << +1611 0 obj << /Type /Page -/Contents 1471 0 R -/Resources 1469 0 R +/Contents 1612 0 R +/Resources 1610 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1414 0 R +/Parent 1599 0 R >> endobj -1472 0 obj << -/D [1470 0 R /XYZ 85.039 781.388 null] +1613 0 obj << +/D [1611 0 R /XYZ 85.039 781.388 null] >> endobj -334 0 obj << -/D [1470 0 R /XYZ 85.039 761.463 null] +382 0 obj << +/D [1611 0 R /XYZ 85.039 719.568 null] >> endobj -1473 0 obj << -/D [1470 0 R /XYZ 85.039 740.731 null] +1614 0 obj << +/D [1611 0 R /XYZ 85.039 698.368 null] >> endobj -338 0 obj << -/D [1470 0 R /XYZ 85.039 593.908 null] +386 0 obj << +/D [1611 0 R /XYZ 85.039 490.164 null] >> endobj -1474 0 obj << -/D [1470 0 R /XYZ 85.039 572.708 null] +1615 0 obj << +/D [1611 0 R /XYZ 85.039 466.842 null] >> endobj -342 0 obj << -/D [1470 0 R /XYZ 85.039 534.363 null] +390 0 obj << +/D [1611 0 R /XYZ 85.039 421.489 null] >> endobj -1475 0 obj << -/D [1470 0 R /XYZ 85.039 513.769 null] +1616 0 obj << +/D [1611 0 R /XYZ 85.039 400.895 null] >> endobj -346 0 obj << -/D [1470 0 R /XYZ 85.039 348.645 null] +394 0 obj << +/D [1611 0 R /XYZ 85.039 260.698 null] >> endobj -1476 0 obj << -/D [1470 0 R /XYZ 85.039 325.323 null] +1617 0 obj << +/D [1611 0 R /XYZ 85.039 240.104 null] >> endobj -350 0 obj << -/D [1470 0 R /XYZ 85.039 224.255 null] +398 0 obj << +/D [1611 0 R /XYZ 85.039 129.733 null] >> endobj -1477 0 obj << -/D [1470 0 R /XYZ 85.039 200.933 null] +1618 0 obj << +/D [1611 0 R /XYZ 85.039 106.411 null] >> endobj -1469 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F36 892 0 R /F43 1079 0 R >> +1610 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1480 0 obj << -/Length 1880 +1621 0 obj << +/Length 3050 /Filter /FlateDecode >> stream -xÚíZKoÛ8¾ûWøVi·bE‘Ôc/E›G›¢ylâviŠ¤ÄFmË•äù÷;áü’챓ÍE€ˆ¤(Î|ÃáÌGÒ¼ëÂ¹"ê!g" »É¨ãvoà͇7=Ü®d®¯ðÕû^çÍ¡ -»Üe‘u{׺K/½´ö>¾;ëœÛŽŠ˜íAhô¨¾züîè„Êçg{¯.ìï½OƒÞ‚G2é ”ñ³sùÝí¦ Æ§ŽËDvo¡ì2EÝQG*Á”¦>ì\tþžBïd—¾jAâÔ=±ÈSíhD§¢^ÏmÁ1ÙÜŒ¶£”kí}†*`äVo]€i(Þ‹N0¿™n߬ÐÅùW0°Xß\å– K†º¿²â5¶ûV2`ë›+jÒåx„Í%}ŒVúÃiRM‹ ã«pœ„Çc¬³aÀB?œ©,ü•Or-*ûˆ‰‰¬an+nÝä •P¡Uf¨<–k2ÓZÅEURùvPõ©TÝâ@9u~… -¿9'™‹äQÈ"Ác걤”bR)óþ ”ôµ} -[yVœ®ȈÇ)%õŸN&ˆ€”­+q™±†Q8¡'™­NHî™ñ¯¶p­Ó£ý?VÇ’ù®q˜Õ‘#æF|ad®ZFžŽe -æôÅt>…*Ki_Máí7— cÝ8Ñst1Ó»hÀ–ã -žž..ûËÉÑEïÜ[^ Ë-@sr=SÒÚ,¿‹©éWˆ}$Û„&ÛœCõ`ÿbò“"KMpG­ãaI1þOzèè…/t ]Œô:þOÚ½K!¾=•Ö1,d!<;µI?¶…^\ܺ ní2_yíS\ÇëSüÝLo½œõJNëÌxÖBS5<—3åïÀs{GÇ TÁv‹µŒê SÁäISŸùQ`*@54.`B”Wg˜%§Å4•vGŠÔ5¾YåôÅFqÐ$Œk2jžS0Ø“ìRÏ~5·ºv„7T/µåãÒìJ7kõÌUqæ‹ÇGý 1DðgÚ+­È…@õñAy™AHœ2üœN—4ô w4Í´pÛóÄ/G3û†— ‡LÈhû¤úö- -Àÿ¿&qšjÿn^“ ®Ñ‰ ^é\!ü»Ê¤®Xß›ñh!Ó³«žuqüž>îgqš¬_z*|¹´9ryF5½Žè*é„´†ž°§bÖ{ç m¥]´Ñ?Ø‚_Ïñ9š€afÀ(QÉ™-Ã[±Û€H+4þ¹ÀÛ(KƒÌŒ¥IP ë иÏ\Ï[—œ=æË’Ï}Y¤g3牓$ŸŽu†G>ƒ|0g@¶Þ¨8†Ddí½h6h&pÏ÷›=7’¡¸‡).gˆ/ ü”–ˆ¹ÈQ°j¾Ðå9 ’¡¬iqÒçLH{ö_£/¼óÌ!q1ÍBá£ôåÄŒ)í<×Øc0Þï©÷³èÏ¢l ?‘»'¥@ŸO?4(ˆ€õ\dU6ì±›ÃCú4vj/‡ìÁX‚æáä2±}ÿËîÉeœrÙ‘¶ÒŠ8²(ÿó=½p>Ï®Sªêˆr]_@¥ƒ&g°§Ò…jCÈPC*òÖIÆCÃõÈŽÎΞîüRÙ˜nW†åŠy‚?lšt0i(¯ŽqëÅÒUÑ ¤¿½dq¯dܾ\7B™âä7‰»“A´‹K“:6ž7ŽÑÕv›œ4Q6Æ]­­Ï“ÍÙ^—`Ë 1 ˜Sjöý:ƳýNóþÀwws0ß‹æ-‚»íb‰ ƒZoêrŠìE>l2µ›û¯9_îÎB"?Ú2›½q«»ËrñˆÅ\ݼ/|:Ì·èryñã¦Ð¤kÒÀ¿æÒ’ÎU6»¹Ûá~#Kù›/wäÏ¡â"‘çó1µœ¢9þ˜‡Ô~†)±¾ª+oñ^//l³Y¦\Sþÿvý+‚}H•3¬Ä¥mÜ£0 ÇÛøk³MÛî‡9 7KÎ|°õøDÐH¿Ð‡/[ì_”S&¸endstream +xÚµ\Ûr7}×Wð-äÖ;sÙ—TÖr¥âK,e_?ÐäXbY"µ$åËß—ÆLsh %m¥R"9‡8Ó@£ÑÍ'™þO*Å2YOÊŠ3YU“åÝY6¹ÖO~9〘dŽ0ÿ¹:û×Ï…~š±:«'WŸºvË•œ\­ÞO_üúÓÛ«—ïfs)åT#g󲬦¯¯Üço^ýtñÚ½~÷öÅ—³W¿½¼jyÛ5GmHÿwöþC6Yi;˘¬«ÉWý:c\?¾;Ó¬LåÞßž]žýÑ6åžå÷­PsÉY)Ôd.3VUyó‚UªÒB¨Œ©,o…XΓ\L<È(aú̧W¯f|ú²ßO®*&T÷… 5`Ô\aê¢dRK€©ïûý×™(§ÛÝʈ-¦·‹½±æà¤ß7èÍa}× Ìƒ^—²`µR e:¡ €Æ+CQ·Êô¨ÃÊ ê¡2KcËbã´XÎD5½Yl®›ÚÉò¬HhÓm4^ŠºÕ¦GÖQµ¹3ïö‡Vœrz33j9}r­~{g,ŽË”ÕúoJ¦DÈ c럯/~=7¼ï†•¬æ ^À xeú%æ}Ø7»Íâºÿ {¿Y/·³¹6+3n¢íô£õæÚ}tÓ,VÍ.¦PQLf%­Åò q +‘¼^¡>oP!Ìkúaïôù¤Ex¸½u"lÌȱb?xؘÑcç(8ƒgùtØ­Í®ÝÛ÷D7°ò¯ârV‚•ªJÈÙ94RNŠ·•³Ç–ñÞn¯·œöK×o=°îaJ>Ó,j&²:¡X"ÐHÅ(ÞV±oX1Ä{oz¾ý+ãù-r¿8Ü„ôBÃ- Ù)CN)V$B\‡!äs˜‘꤭xǤaí:Ò›­l¦Ïë]cGÜak„ùî'­yÒNÚF]oƈ£EËãZ˜C´ó\ï´étç;Ñyïu°ã˜ú»|=Ü';^æL©Žw ¢ãßqŠºíx:ÜqDmøƒÛO˜hx½Ûšw÷û¨…Þ¶óÄædÌøïLfÓ7çÿÐæ…ë=E ˜íqïUázhí‚°rKª]@Ú•›ù „‚æÎn¤}óãÞ®#[»z84<8l½˜0ª¸ËuXTÔ¼d"•Ë !*€Æ+ŠºV=êð°BÔf?â´Ð¢©Åu|8IÉJžØ†!ÑsúåÍb&mãÓ÷U%¯X­'I˜yoPå,çÕùÈÙŽb©{³ß¯ýjûò“®Ä´ãEbO…@„6—®‘¼>_ëó6Ì‹÷TßS}iUØý_÷ +Jÿ-xJÊDH  ‘RR¼­”=Þ°”ˆIiº¾µkáâÐéû…¨hy-YV$v¨̓F…z’Ö‡ú>m0ÔcÚÑ¡‹»½[¬áµQw‹ûäØËËš©DÖÜafßò,ß(fÞzÌÁ膘!¸iNhvZA–wVÈ™aJ¶š™yºÂó÷£Á}?4{6›ç¹ru«ƒqËFkóí~±ñ‹§‘{»ù1ªr¡X]&vfDè  ÑK(Ií—Ð>up ÅÔ ðÜIò´¾uÍjYb+èãÉD>¼™û¶hkE&mÝ[»=ÜDƒ°ÐûÍ2—Ïb¡o+a¡ÔzêO°…ûõj=ÚM¹HMÒDŒ umêz´áP‡h_ÿùûïGƒ§‹}n–¼X8s©¬›Þ¦•#‹ÏåÅù>šéæ²bU™ºBâË«wà Zp{*C’f@z,s™Ù“LJJÄ—˜*B1)…"TÐU(ÒV•iXDzÊID2I‰ÉÅ9+ËÄ.¹4F.Š´•«G– ‘žrÒpâ ÒQ• ‘Ø©#P\%¡IêUê“U¤?]0Ù¥Q•³¢Ll¼ˆÐ@c4¢H[z¤ai¤"n„Û}ꌓ%g\¤tê@„N£EÚêÔ# ë„HGè´²3ë„“ƒ˜jz‡§ÊDqÕ4:'%©}NÚ§椘úäj¡Ìs–‰Ä¾d«µçï7vwº¬Qæ9&NåšE$†–æi•$â3æUîm¹g˜«+&ò„,€ðörðŒ•Ù±,°7óN}ëæ“Máb’ÓÛ»„ƒ:á ™Øi;±{¤á‰HŸ£À”Z.¸ÎÉiZ‡!´r˜1RŒ­RÇŒa¡:Æç¨ÅôÑ;CY%6áD( cðùcÊ«á&Š³L +LúØ©-%LÓS­Ç¦]ŽŠ +©ã¥ µÌ€°ç;ÁŠBâ’Ô¥vEü¨JT5«dÂ÷…ðj奄 M_`Ó.ͪX4¤Ôg0 ZJ˜Vko!>W{0ðÁr ôF@¯”§2 <^ ôä®juD ‹Þ´û“˜áб1ïÇÈm`¡s¦JÖä=e„!†ŽSœè§‚inSá™Í•Ê¦—¿¦}Rí÷žâ0×Ò5°³’¬F|Æ΋×?ÛÚMÈcµªŸÁ6ßm›àŠ)Äg5Öׄ–óYŒ‚–Féí~UõöÊÜ>/Êé_™Ê ûÐËÇzshv{÷ÄžŠÅô¶ùÒܺ—Ü=Ù£rvãžè´e göÒ´Y˜Ý¥×Ÿ½=U<6tÍmÜÄÈm!¶R…nžu5µ­µ¡ù÷lž«Ú$ÊÙªªérmR¬ýÎ|´¸ìðíà8ÔÒÞ×ÝÚÒ¸ú§yRjy ö07öû“ÀÛ dì–¼ÐsOgñY8ÂËœqi<Ú~?°ÀÈš©Jµ$¨ìüië.oÖ|8Cs= +lÜãKÎÐVÂÒªb<¯,=Øóƒ{›¡@‚b³“Õz¹84P‚Z¸?ç&£±áîó,tïÕÖŒRªÇ«Ý}ŸP@n.Ÿ v×ø3¨MZêÕF–ž¢ö[—FÏDí~îOÿ0•À桉*Ïë‚•UñhåÑ÷ãÊ{é8AyÔøÓ•§-å±¥§Žs»ÛùÒÞò&4× Ÿåã5ï¾Oh ÓyŠæ]ãÏ 9i©×Y:NsH¦.Þ¾€¢äºýdxQ³"ü°q²wß'd éߪ,ƒ¸žµ¯ÌB}ØB•àã:ô#%Ÿ-j?é¾óŽšë]ŒÄzü¹´E÷NÔÚ¡yqÔ»ž« 1ðö‡¦‰œÞ¬ÍÎwÕlÐÝ}û›]=¹âÊÜeIì§(ž{Ш#B’ÖöiƒG„˜68óJk"óž4ó ­„ee¥£œ:²lÓz'E¹;ÆP¹ñA†±=¤‹yUšk5‰óH"¼ + Ñ%Z’Ú—hûÔÁ-¦ÇTî<Û5ö„˜ÊÁ³¤e:òZÏ"Ë1ΧO¶Ÿ|èYì¼;í=‘¼w1bĽžø”æ~PÊùˆp>€ÆMiŠ¶Ò=Úð”F´ä”î{†)MZæ§4²l×Ü-vŸ¼æ|½]‡îÍJøuÚö"‹lõx¦¢gi~¯‡0qê•ÅTÝ{EŠ*U¤€¯=C¢k)^¢@F¦*O6¬-PP†ùúV/VžxºE¾:AZÅ dÑ%®MÜšhˆÒ +W€Èܽ3ý©]aÚúƒ)z§*&{<šÒ™‚C6湬(R?év˜G]kñ£ƒcðè1†—Úæd]SOX[\S´YµdÜþÔ¸5Ëä íEœùiW`ýB£Û貇ýëjUj R·õ[ õ‹áKŠÑû²Çô%b¤|Ù5õt_’f/‘Yf±ð‡wŸ‡+ýˆŸÝz.ÝÉV{)µŽ¯"2‹Ô õÿæß³xâ?ŠÑ®D¹<*—i¡D©W©l1R /ö*YéÝÚû7/endstream endobj -1479 0 obj << +1620 0 obj << /Type /Page -/Contents 1480 0 R -/Resources 1478 0 R +/Contents 1621 0 R +/Resources 1619 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1487 0 R +/Parent 1599 0 R >> endobj -1481 0 obj << -/D [1479 0 R /XYZ 85.039 781.388 null] +1622 0 obj << +/D [1620 0 R /XYZ 85.039 781.388 null] >> endobj -354 0 obj << -/D [1479 0 R /XYZ 85.039 761.463 null] +402 0 obj << +/D [1620 0 R /XYZ 85.039 271.839 null] >> endobj -1482 0 obj << -/D [1479 0 R /XYZ 85.039 740.731 null] +1623 0 obj << +/D [1620 0 R /XYZ 85.039 251.244 null] >> endobj -358 0 obj << -/D [1479 0 R /XYZ 85.039 621.561 null] +406 0 obj << +/D [1620 0 R /XYZ 85.039 105.676 null] >> endobj -1483 0 obj << -/D [1479 0 R /XYZ 85.039 600.361 null] +1624 0 obj << +/D [1620 0 R /XYZ 85.039 84.475 null] >> endobj -362 0 obj << -/D [1479 0 R /XYZ 85.039 539.126 null] +1619 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1484 0 obj << -/D [1479 0 R /XYZ 85.039 517.925 null] +1627 0 obj << +/Length 4279 +/Filter /FlateDecode +>> +stream +xÚ­\ÛrÇ}çW°ò Læ¶7?¤Š¤¨˜6IQ$Ù%û!1Ð(ÉùúÌu·g/=+-í² ,ºÏöžžKÏ`Ø1Uÿ²ãùÏsˆ‰ƒLætvô¯—©ú”’‚dz•„ÈDÏîÞÎ~<¹™ßŽ'Bˆ‘BŽ'Y–®gö‹WW'×öõíÍÙߧãßg?ÏJ¿¥Eå£ÐNÿ~8R^I"…{¿>š½.MÙÏä±ýVÛ=zÄ„¤à ‡”™Š2Æ1NãÇYBIB¥ „ú”“1 ‹ñ$IèhúãÉxÂF·êâyý¾9ÊOe!z炤­w=ñ–&ÀT“1§)IEÈøâúåXÐÑ«7!IªÂó Üœ¥7‘ü™h6HII +ù,¤œ¥)™+­„¤Îf·]ú­Lu+ªæŽ%mŠâ…½¤Üíï绥ͅÒv3æùè0_)Am–;ûÉý‰¾r¸·¨þ#GK Þ©OVKÙÿPçΔ&ò$?Θ "c­ä=f@H>8fÿæB¹¾Öžg‚7\'œ,âÚa®ÃÀ¥œPõº¦6‰s‰BEbµÜ›t\Îïº"‘É9Ç#@Ý‘ð Þ‘@]ûHÔ]·Fº#qúôe¨a§yOTæeª±Ÿ°”$"ÿ>Õ)CŠ ƒL(S’×ôµÁ;DÀ•Æ=À‘4¼¬3eØ?®NÕ¦iJ2™FžUBž•õV˜ëòYÕ\·?+àú[tª:2Vd‘{¯@Ƚ;Pÿ{Ç\—÷^sÝ~ïÀõF©Œ&ÿÓΗ»-ªÚÖ€ˆ‚¤2¤!q þÁ\—©¹npý-bà)¡vð„Ü{BîÝ4é <'"M¡¿ïì½¥+ÁHüaC–¨n3ŒÅ÷rs–"ÜR5’þZ‡,,SCÂìYH9KR™ y’º™Ý¾?ßéqh‹ŒxJIŠŠÈ"¾ sÕÑ$ |ÿnÓØø^9wýJ06ùËbÇue»²ªw¹®Æ,šWŠMdLóѼE4_™¬y”•×<`Õüpn¥æQn^ó€[·æ‡“*5’òš‡ÑiÞQ”ôÛt¯n:E…d ÿ5Ý'V÷Àÿ7èÞ`ì }ó©SíI¬uOb-{âRôhùû¦ Tž§¬ÛûødßÊÉÇ¿ôðÓ!ækmüÓfyg-}Yéé~µ?ÌwÎüö£ó}_™žª—W§öú½RÉrG:Ÿ‚©zD¦I„< ê=Æ@]û1FÝuëºþ†1F’©v‰F&F„Ü»õ¿wÌuyï5×í÷\‡£P íSü$‘$a):Å$Ršçµ¢‘ ®ht®ûé·:(çc]•©ÁòAYyùV}ä3œ^)”ž— ÚkMïR7JíBÒ5€D ÌcÞC!IF¨”÷RHÒ icçR-b²×vfV¶±ST×f­üb“ž>½¾´c„ýÒ}­ÔJ½ØG#óYB„è@!V¦ eå…Xõâpz¥Qz^ˆ€Þ Ó=šúF[–ž=Gð¼%œgª§ÌÂàÍn/› »(‹‰ÈcÃÔHÔCa<ÊÔÈ­¸oÌèúAij6wÛ‡ùjãVÈÜêØn»^Û1)&}.IY°ª0ˆð-&¢ûÒÐ`Ùc”¼ê+J}D?˜[©yŒ›—|Å­‡â‡R«P+õ^Q;5{E~Ö£ÖVågÜ*¿[CR÷ê>gV÷•g/{æj"§Fð ­ë?žõ5>@óŒÆ"E3BTï@ÙW¦ëeå…XõQþpz¥ôQz^ûÞÅU“W‘š"û3ðr–"¼ôÞ„, ÛÔ$å]ì:kî“’Ið…ößb®k-¾$ExöÊçNùÓeëÐÇ×­M=Æ×beß°ÜoŸv‹¥ùµ«Ï+u­#+D‘‘$dug…áYL Í +œ•Ë +ȪGV<=Ÿ8=—ÞÉË›­<')+ð§ä0 ‡aåY}˜±ÀŸ×œtš;y|T¡Y;ù¼\7fü±=ØåÅv –Œ–Ñ ŸÈ%¡,R± Db‘Xej°ÄPV^b€U‰ §WJ ¥ç%è]¿ÒÕò²¤yÙV:г9ì™yLÃ}ØÈqªf|"pï—;Å]oµtª©Z­’ ›.0CáEFýYDb‘˜E$V™,1”•—`ÕGbÃé•Céy‰zñípvåÈe燶ÝÕ¹[eíZÓJ‹à;í›P,¦á=Ô–ëN:wògÔÉÿÊ^-Æ<}P-lÈŠ$%“±W Dì{ej°ØQV^ì€U±§WŠ¥çÅèÝÜVëƯ›zgVïƒ zK8AΤÕ.|ªíu½$íë ¹SyÍgm}!3*.Ê9íÊ‚Í(~+…Yø6;mí>{åOuåiùÔ=t•‚ˆ4‰äABòÀ"yP™œ(+Ÿ€UŸ<N¯Ì”žÏ@ïÅÅɥ̈́Æ5!Ê“g ç-áäôN üa9 d{XLÃg-8I²0 . $í?Ÿ»[Íצ´]\«Kf÷û²s­WpÕ!±X"T $(’•©Á‰€²ò‰XõI„áôÊD@éùDô~9¿¾ø¥™Üvƒ‰yK81“*Y·Ž$E€l¯iøáNÍg­¦a‡;À¥ËÜçÀ/îgJÐ_[yºäÍTœcÕjBäí@yW¦Ëeåå Xõ‘÷pz¥¼Qz^Þ€Þõ¬Y¡àj2Èñ‡ä0 µ +·FàÏJH ˜ý„qÖ¨mÅ×ù„JšŒEö+¢Šè§25X?(+¯Àª~†Ó+õƒÒóúôÞ½|׬û&¶Ä…=%‡i8 › *M‰ ø³úá´»Þ˜¾ ~g¥w¦2ñÅíoÓûÊ:ÄÅó‚°4²›€ºÅåA¸¸€©¡âÂY9qAV=Äõ ô¼¸pzN\AÐ:6Ã0Bés0ó–pfz–ÒY³ÙÔ»&x&PùxLÃ_mg…º…Tþ¬ìóRömšöMé¦Üõ)F/ξeÿÏlVâÒ¯@ˆô("ýÊÔ`飬¼ô«>ÒN¯”>JÏKлy5ó%-[ŒPó±¦ä¸ù±ùpžÞΓ‹Ô,Cž§·¦ýnÚ’§… h¡5#¦á8ÈݨACàØd„G茠IÕX…›kæÇs]| éh1ßØzñ´½$Bu¥N}±Ì(æƯö!J–Ú­ºv \sË©\gJé#‘•’ +ƒ$”ÅDò©4480J>›*J}’i0·2—0n>•*n§'Z g?¿¹iv$ªa×MöPjÞJM¯yå-–<™$…(0ýxHÝkmO†$4pj‡Ó²+iÛ’ñ¡–ß0·ÓÇr±‘¼E4_™,z”•W=`ÕGöÃ镺GéyázW'ÓY÷ºKì(j0Ao '¨åŸÒ ªÿÄf "'i8nd€NÇ&d•Wóý¡ì8Ôû–® e}¼38#2vÒ!)à@‘¨L N”•OÀªO + §W¦Jϧ _»ή\»DÙùµKÈOPu;yH°eáÒb®k —‰®äAÏ&ò*‚…ËZ2œúL€¿©^Ãi¦hFóIŠ$DejpB ¬|BV}b8½2!Pz>!½ËWg- *m_0˜˜·„Ó¦´FL¯6Mg­sÁŸƒš³¡¦ç8"Ú«kû£Š‚~mfifœa÷˜†çZ–f„ó,ðL¿J·m|<‘¬p¿ª~z°é6?ØÉ‹äTMø×v¹~Ó<ŸË~½ÚnþG™´wö£¿™GNÜŒG¨ç#9œñ,æë¿u¥7Ë)ɲÈöêNoÂÓ˜šÞ8+—ÞUô~z>½qz.½!½x7œ]Ùß¡ì|Ù_¿¹j[µÕELDÓðX[µÕ¿[ +Ò¯y™?<£&rsD™BKû‰êMr˜Âñžè<’£™?Ì!c£Ç½9@jZíJ»>ce¾¹sĹY9†?ïU/îtšùnþ°„ÇÒ˜‚Ù;ôdß»ßv‹j/‘)÷½¹¼ì\@fR ñ&v±}°¿r§›vžhJ$±M=;ÏÔ`LR]_Lg·ÍtRÃ0žpÔ£ƒÔ=†‘È”¸¤€÷Ÿ[NàÑ¿ƒ‘œß-Po +åÅ)5Éxmtgž†;YÇlB°+CÁcf)öì’µäðziј٠}§j‘ò$2çª0ȉQÓãbý­yl} Àãþss÷S¼½ïšÎNJW‡U›HµhŒS¦¨ÏÁÊ›BYé2JÊV ;uxð'—›ªÛ%—îÚô&œÞD«Þì·ƒö„tx¥Æżu,©þýNgÄÎÛ/ÍÒ½è&z¯fz–‹v4ž\"r’ä¢É÷ÿ±ï9åendstream +endobj +1626 0 obj << +/Type /Page +/Contents 1627 0 R +/Resources 1625 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1599 0 R >> endobj -366 0 obj << -/D [1479 0 R /XYZ 85.039 372.869 null] +1628 0 obj << +/D [1626 0 R /XYZ 85.039 781.388 null] >> endobj -1485 0 obj << -/D [1479 0 R /XYZ 85.039 350.456 null] +410 0 obj << +/D [1626 0 R /XYZ 85.039 761.463 null] >> endobj -370 0 obj << -/D [1479 0 R /XYZ 85.039 249.785 null] +1629 0 obj << +/D [1626 0 R /XYZ 85.039 743.459 null] >> endobj -1486 0 obj << -/D [1479 0 R /XYZ 85.039 227.372 null] +414 0 obj << +/D [1626 0 R /XYZ 85.039 554.516 null] >> endobj -1478 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F36 892 0 R /F43 1079 0 R /F15 895 0 R >> +1630 0 obj << +/D [1626 0 R /XYZ 85.039 536.042 null] +>> endobj +1625 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F11 976 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1490 0 obj << -/Length 1505 +1633 0 obj << +/Length 3204 /Filter /FlateDecode >> stream -xÚÕYÛrÛ6}×Wð-d§Dpå%}è¤V.Ê4rj«}q<Z¤-N%Ñ!)§™Nÿ½»(Ë"e»¦•&“‹—³»gw0‡Â?æDŠP;aĈˆ"gºPçFÞ ˜• Ž$4P8ôËdðüµŠFILcgr¡E&é‰{ðöå‡É«#ÏB¸1ñü0ŒÜñÄ´‡‡ï_ŽÆæûèÃÁ³cïtònðj²±…/‰ îñiprJŽñn@‰ˆ#ç3|SÂâØY ¤DIaÛóÁñà·õ*fL:fV_ªˆÄ0æ J¢HvÉ(",±FËiÚßÇ£ãÉ߆!au;w{٘Иm,ËTDzi±Hò¥ÑÓÒcn²È°!ݶò©ç3·ð|º©¨ê2DZËí£ø 2RŽÏ9Q,øÖ®ª¬´8·A"Àè@è^ÞP}k?{¢(ÿ¬ê¤Î‹[6E+6â[›{ëáÝÖ?¦~Y¬ ºYë3F$î†N`A8÷|¥¨{üòýön!'´QäÝì$èd¦î¿û £ñkOP÷¡û‘* -ǪP[ØžC£¸,–Ïçð÷#e»7Oíïò¢0‚ ²Õ´^•ZÉ° -k©.T$4>'!vi.$Q®,‚Ž‹ZoòÂó¥dîUé)hU«ù|þåG8˜³ž5öæÌ52x<°;vqwjúðOš-ë<™WF6¯Œ@…Nru….Uy8ŒkÍ|13.ŠÒL©g™›áN×YÓ_˜_è@§»°óÌ“zk2žŒ¯O†"5ÎJðkŽjÕšÂk…Lg&x©È%ø-åî³Útœ[°ž™j@ £¶b+Wf/ÒövMd_ÄÚËôƒ_a1ž~²½ƒÀä~%oÅì E`3ç Vt6gòÔ6s ŠlÂK¢ÍJV5|Ì™éF„ÒḴmˆ“ˆö¶hŒ†?´T I@ÃÝ*¸OW:+¹ÔäíïGKRÁ‘K¥Å:-³µž¤Q…"mï“1aŠõΤG¯`a‡ëQʼÜ' -1¬ñ¦Í‡õˆ*&¾€R|kñËeqK¾C -8þ™v´æ Zù–Þí÷rƒÕÁ¼s¨³y;ž(°(ï_íPõWFÊÖSœ{fÀ]{*p“ùJc„=!;…³}…­ •Â®“×Óæ -¥ÓªiŸ]ÃëÙDreÂI‘X˳qþoݺÃ-7FÃ3ˆq‡g ÈÀì<=ÃÄ|Æ~Ò3üŽ)ÿt±-À -´½ut%h³ÄKaJ›7£áMuqY«+ÓD§öÎÛU5PS/„· -›žxL".žÂ›roB¸XG4 ânNô!ùxÇ¿¹/$5ÅçeUg6’¡9 L\ó/FfUÙh¦[çu‰¢ÍTf—[¦M, Xgɨ}2Ôeaó]. WJÎê’Ò¸äðÚ®¸%8۞ˎ^ßB_>m"®R«ð"+³å4»á‰®»9â‡üŽÂZEY¢ð].¦úA/C'JÍ ['R¤Œ¹¯Ù¢q)0׳žy¥¯o…Ñ’)Cv÷¦Õ?Xôу>¾Å®ë§líkVa© Ÿ+ªŸK¾C·_d6nï: -¡l{À#N5¥Øwê°¤Få´‹ä¯Fè ü{®7ð‹ ókuXæ ÷äûE.o8ô-Kóÿ>Rô°ùxôvˆµß¬뉻Ïû£ž4Ë’¼¡õT<5ô“%8àvÒ I¨=gM0þö¾LÊ÷ý<¦Á‡¿•uè6TÝFßÖj§ÑOéâÕ¶ºúOÎÐL„†² Ð/·-òÃ%CÄOJ‚uÈyˆWáCâïE»£RäÑþ+ÅãÑ°‹oR:ãÿ‰oâkðm[×Hµ`7Õä“S 4ßÁA £û$æܾÜÜ{üwP)²uÙî.¢–™ŒÌ-mý *¦4ýendstream +xÚÕ]sÛ6òÝ¿B×¹™“f"–ø¥ä)u“ÆÄñÙj'7Ih‘¶y¡H…¤bûßw?”H§7½—N&°»\ûEÄ̇?b–„ž¯V³8žJ’Ùf{âÏnóˉÐKM²th~ZŸüø:¬ï­üÕl}Óó ½ T³uöq~úæåÅúÕåb©”šåbÇÉü|Í€Ÿß¿{yvÎãË‹Ó]->¯=yµ¶ëZŽ°Æ +ýzòñ³?Ë`ƒ¿žøžZ%³{ûžôöVõÂ@éyyruòoËŠqÁŒ¿;c „Ëp¶T¾—$Á(ð#/ Dè{¡XAHWBHO 93D(‰ßÎbgóuòñðœ£HÌ®ÇKkš£¥Eè.Fžˆ»ôçÅR†Á|—f°…¬€ª[u5ÿÞ渱Ž'{$(6ˆJæøIŽðpÞvMQÁô–§Áòzé4EZ"óÛ*ϘÓ}ÑÝñ¨íÒF³¯oôÚw=ë+¾û‰áwyšå7e + $¥â§´§±º <DÝ”’$ ŸZ,ÃП¿ƒ\¡,.apq +¦Åóú[Þðh½XÉyƒø´j"ÝtŒ Ŧ[K´ËMè(¯ ˆ¸aŸÊò.-Ê'¬häŽ0#w¯‰‚³ÑÑÒ¶üà<Ý’yd<½’&ã9Ÿ1¸¥‰æ»)n€ªEHäuh"2ˆbÐÌJ=)‡ÆêSx«0È ’^ÅVŸ,*´R¯.Y•hUâÏóvj?‘ïÉïèÄ¡yB'l1fûZß¡\D;Y iXPŠ§ ,Zþ%™×èaÙ~Ó‘´F'û†ÿ€Q³BŽk(ŒÓÊHžÆ™BØ1q”2¿Št¬Dˆî ’CΡ”J¼B¢OÇ©˜BE†|ƒ¿8»x5ÂDJ x D‡0Ä ð;žXÿ W ×—‚«BYê¨q Bpö)=„ÿ»&uÙ6ßÚo›eE~¢©n(âÄàW¼ù‰ÒCÿ‹­BÌ7dº1ê +D’ë‰O0!?ºE•³­okë@h먥ğ³Ò˜d‹Û“вMóÈfV$e4d½×±.ÕA’×",ë6ŸŽ ®ÙÀÔ˜MOPW=zÄ ‘p¡&ç2¨ +sÍYPÞ¥hDNÛ 9œ ¯€ëeþuŸk°Àc×€ùµ56 à˜]-äŠÑ®¥U‡¾G.5˜¾ÛëÌßÎÎ×"²*úªv1<Þ¥MºÕ»úä‡>î¼®rV‡{>­Ž/D€ ߃È%Äí”÷ z‚ïÅ3œ¬@Ycq­„‡YÚ¥<¢EóÎÚT‹`í¼x|„ãMFëø3*‰€nS3”!L½HŽã˜Tpf•–ff„ >£ó ]–¶.‡ à* 6Žåq’pº@0Å1Gø!ž§¸y¤ión¿cœ¸æà„92^›Œ€lrÈyÃc¶ïK½Häø T fÅ&ÅuT$Øs"ÏôŒG£Ùù‚§(`Dž8³ÕŒ®òŽnÝôú Þ€4ËþC>lÃŽŒtÖE±…f#±v +ŠQ‹¬†8床:ö#ö~¤‚£€Pj߶I„QX™Ò¬»Ó4»‘ZªOY6pÐÐ^0, ŽÃ„> ÂâÏä8âÔÅÕ]A^ÈpÀW¬F¼¼8ãÁiMö´µ¡`XÂã¯ÿÀV‚côëKSÕ$â µ¡»…‚))ÃRÙž‰g-O/‰~y8ú}Ý©Pl`ó`È<Xdâ Ý*P¾dE”emã[ð•Íò0ždÒD;aÑ/ƒ(Ô‚Fû1O´Ùu Yý>Ë9`9å±Ð•º$¡“/Á…Îþ’pž1üÂqÀ £˜$S›(Òn É¥(P #? X0çô/¸­Õãæªò‘)¿-B×å>9–¾#è4zÓû‚Õ¨q¨ÁúänÎU“µ dFñ0D©0©ÿ¨I—p7D¶´–«µÚxJ kSŽF:]ð™,T“4vçGL˜Pç#U˜K5¦ÔŽu“6“Ù«°ŒW2Æ6ýb ›ŠÚ>›Ì¤ºÐ?(Zz)à¬w £ °F)8¨0Ò1ÈýVa*§Ê”3Ê3>þ¶{-$ÐX…q Õ”f8v‚N +GCdUn‚$±«o#t ¥3²ä<ÝêåÒ6ÏÓ²¸u‚î”TÑí0¾5õuŠ¡m?>e‡.…Ù*+r’Lø7q\°Ê(kg '®iŸ7Ú”Gþ‚6ãŠ1@HÔðk–IKckµFP ÉͽÄÖ)Ʀ‘†o~.ÛßV$§%6î†ÓÚD(œsó܈qëøM˨{rtä;¸ è.‚)Ú…& +À±»Pè&Úlòá¸VßSU¢»TÌ~, 6 .@ò‚=o‡± +Œõ)×$O:•Ò<ði´àDÜz]ôu Ú!giZ”7#kÃ&ûHűÐ[·REFTIS’ÅÙÅé?yÔÞ¥6ÂyìIkCÕ·+*íÐ(ú2«èÛ×Dïë§$<ØömAk¸7jqkãnwÜI°¥Ù’LîéjÕdîupÓguÇ,7Úõ‘ÃÒ)9Åü¡£„†áÖ½U ˇ‹¢Ð½ÝÇ=ÑFrî„ÀâGLŽ+-ÙÛ„·Ã‰öᣈ+Z™Û3ð‘ÎñrPC‘5Èórþ†;“î 4á»lÇuz¢Ük1åuÓ‚‰›æÌú76ç6¼ä½R±Aw¸c踛í†'¥ì½÷xÔN¡Sµµ +¢)¾Â/7ª^$iê›QG}jQ¡XN^ ŽêJ'Éœ­Y¸åC—€Ü¾°\o»}C…–i5õžXÿãÉÞØ•}y]é—Wå©IÝ=4àЉèóõ[,^òŒ›¬€?µ\"½}£_ÞŸ3¼êKœº9¿e:iÞš0Âœ{€ ƒ×…Q˜GŠlKé†*^"7ã´y÷|$[HŽk ÊãUDò2yé÷EqyX¤×æ¨{¤Ó@¾ÍÇ–ˆñ!Ð<‚pzì,žŒÕS«`“`”½ð¢À$ÄU¿dƒ° ®1 Íÿk² ×#M‹~¼ˆ{{üpXž¢ˆ[,3m¾>÷idá‹)aFaúO“žõþ¬(%îGþQÊ¿»(å¸(u|w;U¶Åî„kŽäÿGÉÚ—K_MHVÆÓgŽ@²O‹UŠ?!V»‰Ñ%¸'8~­0!I¡Ì$‹–›½ÀèuÑ´ý7&½e öeŠnicjÛ‘º2¶(ì­IT´ˆÅ°Ý ÙSgx¼¶ÒU®Æ*øËŒþÒײõQ ¼D­ÆË#P¥ÅÞ %`y¸Ýþë‚:ÞïKO>?endstream endobj -1489 0 obj << +1632 0 obj << /Type /Page -/Contents 1490 0 R -/Resources 1488 0 R +/Contents 1633 0 R +/Resources 1631 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1487 0 R +/Parent 1599 0 R >> endobj -1491 0 obj << -/D [1489 0 R /XYZ 85.039 781.388 null] +1634 0 obj << +/D [1632 0 R /XYZ 85.039 781.388 null] >> endobj -374 0 obj << -/D [1489 0 R /XYZ 85.039 688.087 null] +418 0 obj << +/D [1632 0 R /XYZ 85.039 731.337 null] >> endobj -1492 0 obj << -/D [1489 0 R /XYZ 85.039 666.886 null] +1635 0 obj << +/D [1632 0 R /XYZ 85.039 702.539 null] >> endobj -378 0 obj << -/D [1489 0 R /XYZ 85.039 404.883 null] +422 0 obj << +/D [1632 0 R /XYZ 85.039 674.393 null] >> endobj -1493 0 obj << -/D [1489 0 R /XYZ 85.039 381.562 null] +1636 0 obj << +/D [1632 0 R /XYZ 85.039 653.197 null] >> endobj -382 0 obj << -/D [1489 0 R /XYZ 85.039 318.277 null] +426 0 obj << +/D [1632 0 R /XYZ 85.039 217.242 null] >> endobj -1494 0 obj << -/D [1489 0 R /XYZ 85.039 297.682 null] +1637 0 obj << +/D [1632 0 R /XYZ 85.039 196.249 null] >> endobj -1488 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F36 892 0 R /F37 900 0 R >> +1631 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F14 969 0 R /F36 955 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1497 0 obj << -/Length 1360 +1640 0 obj << +/Length 3098 /Filter /FlateDecode >> stream -xÚíY]sÚ8}çWø­vg­µ,ÉûÒiKÚÒ™°Ý@ö%›;à `Ö6aòï{¯$À&ÐÝ$³“™ oé]Ý{$SÃ?j‚8,4ü€Æ`ÒrŒ!Ô|nQÝÂ18q˜õL¦J£i¬Bç-FÍÜÆ>7–˜P]&ª>§Cì9ÁÚdŠÕºÃ"-G*U”Q® ³[õÛ;‡>Ô£Š¹™Êküs0S8®¶ëAÅ1è¥Þæ$Ü!žã7Ó'¤»è³‰²P@ˆ¤DÍR3–9¥Ó¡ª'ÓaEÐ[õãÖP A¨p5jïÔ?„úoéI:í·µcÄD”ºë#)’¢À±% 8^ò XX¨äm†áŒÔC–BÖþ[â{z®3‹Šba¡fÉe\wÍq¤t ŽäÉJæåî[¦ŒÍ‘>_rSGÑt˜ì ôåìçsó¢\"õ)Š³d_ã=H|}i#Þ‹¤žã"T‹$Ÿ.EF i:Ȥ¶Ô÷Ò-wšQÅ ÊInžñ›BáºDóñ¸ñªÂÌ ù¹ÎȪ6ßó6¿ÆxŽÜ¬Ëb @3mõëÖ¡IzM¦1CøX£›EÕ½ýGŽÆë0†QV¹„‘æÉ@1 (h1÷èè. í{$˜†ûþñ÷è(>K§<Ÿ½lÒŽô# üÂg˜›§2­§ß6½_ñ¶¹õmwýÝRW”Õ·—j¿©Š­ädOš'Ýp”™ -0 ¢áÉ6z0RŸøÈUÝG2x‚þõl¾æLŠDîM‘VàNÇ?j>Ô÷Ë'£Ï9̯êÞ¤Ò½÷KHùi$ €“úÀ‹O÷š_ñ¹•‡~Wç.ñWo·<|š -Ö^žU›5v¿ôÿãendstream +xÚ½[[sÛÆ~ׯà¤;áfïX¤K‘[g&®k+탓ˆ„(6")-å×÷œ½àŽ…œxbϘÀâìîÙïÜ`¶ ð—-Œ"Td‹Ô0"ŒY¬÷gt±…'ÿ8cžbåIV-šó«³o_jxJIF³ÅÕM³Ž"R‰ÅÕæ}rñÏo®.ß.WBˆ(—«45Éë+7ðý¿~|ñêµ»~ûæâëwË_®~8»¼ª÷­W„=2ÜôÃÙû_èb þpF‰ÈÌâ\SÂàñþ v%J +wöîìßõRî™\¸YcgTÂeÄðBµÉ'‚ñEª(QTÚS¦L”Eµ\±ä;<÷/Y{ŽDK » 1•Ž¢»*ÔŠÿ,Sä§%Kvùõ]±\I*’êé~©XRŒ­Ÿ2b¸ñ³zõúJð‘=¤ \›Ø›Ü!ÝfsÎðÈ(¥ 8#Z_­ÜÏ}¾^r“üŠÿ¸ÞÇ9®ž; +ÜÖ>¹‡‹S±Âí+øSµX1Tf÷)-ÕWª€7`öx9íLš•† ÔÓŸÄŒIC•±)¤„f‰]üi‰'˜ +hZÚ +ÓcBá$MEl«MŽ{Uù„àÓ4å'æÛ=’34­4¹+ÛêÖ]£Œ„‘©Ü”»ß +wõ3Uôg>UAD%Œ± A˜NØÊî¹;Ý'Ëä¶È7ÅÉYs~ظ‹*ßÅùRSZ©½“ZJx ÆJxÌJŒËgIŒ›Ø6¨èÒÒ2¨uø¬vùÈ#¢Ë’j·Î+ÔvKå%8ddâœígA™Ý@y1eF(›<£ôY  rÖ+IPáèVë“& …£ÔÂXçww0…Ãì7€@!°¸.D p]&Ù»E­§º-JœÆÆÈ«RD€»kÃê`åu¼q‚Aå>¬v5k [Ípà Ü_8zoo_À À5©(%rÚyeÙ³dªš¥Ï‰(\ĶŠÊNZ{YÝq¹â):œÀZíO³-cW;4X¹ŸÆ‰ÁMiE#¿Yÿççüh5m¶wû<uù§yµ€ “±Hê?Ç«¥¿Û«ñQ¯v_ú²åÙZ~m}tb-+oO†;êùeýàÖ +Üc †ÀP%¾0Úëü°¶pÝp¼ÑŒ¡Ç]´üLßCƒŠ°t¼ï©cAF³X¸2Ï@NqÛb9ÈÛMp7;T@¥!ù¼¿ÃéNI¿ƒ48cVx†°ªH¬k)NmB»ù¦e¦Y!(采ZÙ«ò;ïaxFRµ”ï­<ìÔVNXnÂýeS úê#ŽF=Wñ¹’a£9¯ &›v¦Ñ„Ë0›‚‘–ŒqÍ91Lƶ™”%uvWVù©Âpá"1Ø’¯.ð +þƒ‰/?JOxpoŽ'wáCŽI|¦Õ«=¥1$W RIÈp¶úΦGjÏUXkÕZÌ––ÊŒβzG<é­Í0j3^ Š}ÚQ©©7RJ+pôbv¬ÈoÑX&9©¸_J™ÏCˆ@‘s ‘RŠy›úôX`¦ˆfê3Õãx†•V­¥FX…iÑeõÍR@Ò°þÐ\„NA#–fžÜÍ©øðP”Õ7x‡ÖfYZ¿˜’”…t½³ÙLÉÃŵV]ÿz8â6ŸœO†ul6´-öK[ aU7%%ðã¥>¨È +~¥æ£bdT£ ­QÔÉÌŒ=‘sºÀÙkd |¯=ÄÇâT‚m ÇùÿúÌr +>ƒ7KŒ1hÌt4Ÿ3f¼k~r.±Ì÷Þ9æ>1CA5×yQ4}úHÕ˜Xd&‰Ñ&]‹hº@4 Ýî0 +áQfÍ€™!tàwÚÌ|>tÒBc€¢‡½1–Í ×EÐóDãèUh’Ohtøì3±\¦YœO3`¦ƒƒ‡*íðr<N™BWÝúßû5È£ˆ¬ÍÎïŽa­8ÛjkFE‡ï+îCÜC†›îŠ{ï‚á”`u +…øŒ\kšˆX͸T!KQùvÈ”‚ïb,8Š>=YBA€bh8ø>„:Š¬C}ùwŽŸ%߸; Cš·.„‘—7VQkR*h6ƒzCÝõp·ý +ÕîmŒ+ÊâP¦;XXô",šK]åÚºü6KDø‡Å’¤D§3Ñ°EÑõ`„RÑe +§|Ûôâº=µï b¬š+=‡®sk±šƒUÓÍm»¨æùÆ6Ês´EtÝTÜõ  ¹õ3ÞÁõçMäƒ öç±›Ÿún~5)Ð Æç$ÐE$à‰&$€Ò ` +9DœA¤jÞ1ÄÙE¢t& Dv·ÎQíïv›±\X¢Ïk6râiœtÝ^! ÎÔæÄuBc Û •ÒÅ};F¶~mŽÉLe2js”Êå „ QBO„ŒÿÕÁ† ·­e®]²ýÓ»K÷äêc/ƒ¸1 +[ó({fÀ^×!Ϥè°×¶³SázÈ.ç-Â1‹¼ónSÜÛ–§Ó,Ù4-dW¯ö-õ«ªò~ÚW„ÝÑ"þ2·E3-‘2Âûeweêû¡rÝ‘›|]8! w&ÛÆEÅ[»7‹¾«;Á²Û)ÊqM2ba~“©®¼”¶ä,©jýw »>¯RI~*ÜE+_¯¨ëNÏÆY¢™‹_°ø“wv…WîçÖºaÿX Åûµ§r®¹8¸»ý1ìoyÎýðñ0w|âÛÕ®ÂôÓ°YÐíE·UÒR×QÝü®“9êgåéci°öÝÝíA °ã²­üº¬NùºÂ—)ʇoy.¸|ya¾qƒà[Ø÷‚é”Ö2U/RÃx=`Ì%Ó—ç/›)î¨;÷Öly(oÐþš]Í cÔ÷TÖK0v‘±‹ËóöšæÒdÍ&šB2MùyWi¦p-­ªÅT¶E3md\1BµîY™xN3%LýÍ”ÖRÓÍ”6«¯‚Ñëäí§0jìeûÝE4’`ê)ÍL0DãÅÇ5FŒ'ë‹÷®ùß4…rÛ,Z;DdG3`§‘9Úìüâ?Ñî×w슲û:1â{&Â0CÈÄx Q@ˆQ><Í€n¼…8«iÖá£í²ü@ˆ4.)]ÕOB?½ì4¡Œ,3DëxTlÑLƒ…ÖÀ|áݬ|ŽÁ†©_À`[KMl›Õ·Å‡óºm9i²¸~–Í ÔÐL‡b¾OõR'H¿““Õé}nÓ›:A­˜qðÆ]·©ÇÒ'¤Éoª0Õ¶h¤¹–&ß4¹®%Ùù•ÇR(ûàêÆs\çܱæ§z»4¯5]дQÚà‘¸ëÞ û®ÁèööÐí ÿn„'@?¹“í?¼ðÙ„G`B)f:9-¢ˆ’{¢‰RlŸ?V˜¨ã×Cƒj—«(/fÀKÏ+dñé/°ñno=å¾[´îNVe]ô¢Ç8 ¿ŒøåSíGBÃim60¬ÌLÿ¸EÁ×Mã .¿h6@³Œ¤©Žóâi¼ôð5Äè´Ã lìqvº.v!ƒµÝ®ñÏÌÄÈí¶ò,¬Ø3%y‹(«'šdy‰J{´¯sÖ[[¬ á5DrçÉÓ xêÁ›Bèëò„ ¬,˜Uïòªð6¿=Yp*÷N,†äé r5É4nŽdµÃþ¸k¿¹*‡•7')Xê43¢ÇL¯yI!M[Ì´s€ƒ·zø·“uJoËg£œe£ˆô–b1$ ~½G²&™FÒ‘L˜õúxÀï]†-!|ßËð(z< Þᇺ _î+œ–>¢MÇ€Ôšèl¦±ÝÐLCéiÆ3zPÊòéPåÅPñCž8¤ÏG¯ „/²6Ÿ­À£û‚ù±h)£-óý}~÷ )l·àɵÖ+¼ Øßr¦bè+Ð9÷v¸¦‰½ä·4}ôßöÅž‹fÑ}=Ißnâ¨4䪪½¯/œä*”L1ôÜÛþ¥Ò­žõfc_»n}Ö•o]®Y¶ºoí®÷hÚ8Ñ¥»uotÑ4•ÿS¨l)ˆ™Š* + +KJÏ ¢$EŸÝð¿üþC/0endstream endobj -1496 0 obj << +1639 0 obj << /Type /Page -/Contents 1497 0 R -/Resources 1495 0 R +/Contents 1640 0 R +/Resources 1638 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1487 0 R +/Parent 1646 0 R >> endobj -1498 0 obj << -/D [1496 0 R /XYZ 85.039 781.388 null] +1641 0 obj << +/D [1639 0 R /XYZ 85.039 781.388 null] >> endobj -386 0 obj << -/D [1496 0 R /XYZ 85.039 761.463 null] +430 0 obj << +/D [1639 0 R /XYZ 85.039 542.823 null] >> endobj -1499 0 obj << -/D [1496 0 R /XYZ 85.039 740.731 null] +1642 0 obj << +/D [1639 0 R /XYZ 85.039 522.834 null] >> endobj -390 0 obj << -/D [1496 0 R /XYZ 85.039 567.596 null] +434 0 obj << +/D [1639 0 R /XYZ 85.039 382.638 null] >> endobj -1500 0 obj << -/D [1496 0 R /XYZ 85.039 544.274 null] +1643 0 obj << +/D [1639 0 R /XYZ 85.039 364.164 null] >> endobj -1495 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F36 892 0 R >> +438 0 obj << +/D [1639 0 R /XYZ 85.039 264.615 null] +>> endobj +1644 0 obj << +/D [1639 0 R /XYZ 85.039 244.021 null] +>> endobj +442 0 obj << +/D [1639 0 R /XYZ 85.039 198.668 null] +>> endobj +1645 0 obj << +/D [1639 0 R /XYZ 85.039 175.952 null] +>> endobj +1638 0 obj << +/Font << /F60 1074 0 R /F35 948 0 R /F15 951 0 R /F20 937 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1503 0 obj << -/Length 1584 +1649 0 obj << +/Length 3214 /Filter /FlateDecode >> stream -xÚíZKsÛ6¾ëWèªS¢ñ ÐK'òP&qKéÅÉA‘h™‰TIÊqþ}*”H=jF±=ídÆ¡‹ýv÷[ì’¤‹áéJŽ0UÝPD¥ìNÜÁÈËq3p—!,¸úsÔùí—]‚‘ª;º2SFÓKïÙ«§ç£ç=ŸRê)ÔóÃPzg#û»ÿîíÓÁ™½¾8ödØû4zÝy>ªˆðb‚jw.?áî¶ñºƒU²û®1"JuÆ)⌺ßóΰó~½Šc]ûTƒ&>ã)ó)FR²¦91K¬µ pƒ¶Î¯ú=ŸxÛš0ŽíóÛK+„©,MxÃÒót–&ªixéB‹ÇpéŽ'úvÚóƒÐ›Fz€yy‘Åzlfç]Gãi”mïÏ€º~ NÄø«G±÷nÐÿe[eû8¤¿Qoª5“Þdµˆ’\ÑÔ*UE']Œcw­áq3–æÉÔfÕHÕq` -p ~g&×ãÕëƒK†kh$m¼k}~ŽOV+XÙß8Å-ÔTNÍ5à2S=3Nœ7|ÖX|+¢B“1î]ÁàªXÁß̹OtkKò8Mþ¨Ã".Hk·ù0gz«#Ôb·Œ’o2æ×.jV ‘ -œ ýtCQ6“Ù¿¡´¸ùÍpÄ)ý ›Èãi^7(ù¨¼mÜ™ZóìÛ7ýN ¡gøÏ.¶Xb˜ÁÂ^pÃ<{(w8èCÜ42ÈA&åGä’áè¢ ©¨jß*²d¼pÑ­¡Jâ‰e›1¨—kE‹ÌñD-SPÄ$?ä ÷ªß“ÜjgØl>·Zi/[·(ISÛr1¥±r-iîUÿá™·’ ó‰õ`0ã²p*·4÷ÃÓw©÷~Ä„Í:Ë1„oƒ¶ã>fÿ¾NËØ5‰<‹Œ• {eߎ> ->2+¡ô4ÓÑ|£y=ªä…Mg·h·8ÝeD *‡£Î,Kõ¯e^S‡ó’†^ú—ÉJ«S;.1 Ž;©ˆçqH¾V°® `m~.ásåBreÛP*Š${¸ŒP¥ü¨¤ü2ÖG˜@†:Ûݹ*>‘ÊýwZèÛÚñ^¢ðÔ1çÒm±¤-ÒÕ²z¸ÕEø‚#‰Û‡Éýd·hhÞ`¥N,;7ÍŠ¼Áp«ÝLÇŽd:¨i¢¬Þ!±¦4ÐP b†¸„B 0VAsf!û•S(@ I×¥=ÈLؾږ&„9=1ȃ³¦.­9—VðÔÂIMåÓ{ôùH÷^Eè}Ä»LT'E”åv¤ÐU¯Þ<º‰æö’Ø‘¼ÒÄŠì¤ÈÔ ºƒ”œåpHƒ é‘R]å. -‘áZ*šªþ´0Ûø½ç3®t¢ãvS\z“Xçí<Ó·ÆË·…°³&Elk{Ø-ÿU„€ƒž;s €¸†Ö³îÄàÆfp@$²EPºŽÔUêB2¿ŽIë%/Ÿ´T˜àÒ¤G—MjœÆ“±m‘äv—c;Ø×pÊøRï~„¨Ø—=[ƒG3x纵ÛÞ¬½ó^7)¢Ut/XÚ£›xr7~ÜèãÄÍeýÁù3×+‰×Oï^ßJŒbwÅÊlU¤®2ûÕ§(ëµ5ø0¹†?á))¾\.,÷XÂ5%óês¬‹–i”Túpúö8kpj"C£OCÀUÝùx½¿1ߦ7ÑDAýo3‚ƒ‘¨øÞÕöÿ]¿?)»ýίÌBµX æåPëJø¤í¡Sšà.4äÞÐ4Œ¤We쎳~ó’m½®3}‹ýowˆK¿É“­KÑÇ+ •E‹qöeek›4v–1’ÚÿmÿdQE½Ž¹ˆl}š§2ÜuÔ'ˆÙ:à˜bQþ_,þÌbqX-ç:*oL\V«Ba«Bl¿€¹†]«Ea2Ë—‚þáÛ ôUvT³ñ^cVç·Í˜ë4wì—?%åÂRßó^Sª“‡?êøoÚ¡;x©ºÿĶ©«_éÔÙTb$±‰QÍlJôwmªåÇq,@‚2Ïõb»•¯Èäæló3£”endstream +xÚÍ[[Û¸~Ÿ_alj5W¼è¶EQ$iv›Åî$M¼hl4¶fƈ-;–œËþúžCJ”hQƒtŠEƲô™çðãá¹QËgüÇgYÌ"™ÏÒŒ3™e³õþ*šÝÁ“Ÿ®8!–Y:˜g««ïLàiÄò(Ÿ­n»qb¦b9[mÞÍŸÿóéëÕ‹7‹¥”rÈÅ2M³ùõÊÜøÇ«_Ÿ¾¼6×o^?ÿÓÛÅûÕÏW/V­ÜvD‘£ÐWïÞG³ (øóUÄdžÍ>ÃuÄ8<Þ_T+IßwWo¯þÕež©™ùÕ¥9*ÉY*âÙRF,ËÔE –ÅG,ŽTK„p‰à\0ÉÅÌ‚‰?Ã4“t^ÜÔ >oK>?ëf[5x?™ÿöö…¼y ÏŸ‰"g)2щ S!Yr‘†¥)<!%“Ž<œÁËÛb]zŠÅ)*sóH³O$]‘I≬"›Ÿ=‰šÕ/Äü>(5‹5•Rj~¸5†´Õ?jÊÓ-ü®X#¦4¿^ﶥyHÈÚÜG5â¶pQÝ §h×<• ËãxÂ.:PÀ.äØEs*ªú¶<‘A¤Ö ܾ5¤,N…«Ñ7[ƒ)¬·€ÁÓ¾Þ#Ö6ãAª,Æ9°å‰|\khàÆa`ô±‡“àTwhzøzÌAñœÅÉ„ëì0ˈ2Æ×Ó…§’dÁâÅ2Ž£×À3ºŸ~»1Ø‘–ÎPT… %²¯êÓÍF³_Ö5í¿Ç˜ê†2%8Ë8%ÀQO¹ß$S,ŽÓ0™„þö¸»F%W<1;lWVwͽOgÊr©fŽ_ ÂxjôL˜ç)‹ ž¸jLmYÆDż¹'³«›y 2Ýõî¼`Ã|~g0íØí +L{¿­ŠìuÄo%)gQ”MÚ„Èñ[Gøˆ`ÁŸÓÐsá||w*" ¯"¨–Åxjõ}D”³<•=µ€Üvë-Ýœ4ƒÄiq³XŠô…?Ök›ÐŸ5 wtïŸmÊ¿˜¯†ùRß9ãtöz…ŠFÛ¸ñ!û‘m@6’t&°$JÀVV‡‘<ÄaØŸ>‚Ãp†w®ªoÊúÙV»ï³p†gi º¿-Kà[bÐh!à°pÉŽÆ(ªÚ††ƒYÃãcœ‰5¸žf)0¸ãÜ[S(6­Qô «/õˆfô•„@Té´56£›8‚ù&|bw €ÅhÄ+î‹/ ¦¨Û?ÊK;—£C èb1ž.ÞÎ<ééR{'µ ¿Ïf‘F©‰sX\.ÂÔ8 qj,hœšSÚ§6KÓ$¬ a<]Ôd,KÒž.ßNM +*‘Ôt 5P#•5uM韯ï£OQÆ”aãé4 (ÕÔ¸:ýa6Ýa” È'Ÿb¢˜ qîåúPmŒ ØœÂKÌv”«×·¦ð4RX{!¡(w䙬MÇ+µ ÕK–Ë mã î/VfÒ9W°ë ®fŽ:½®»DHç<z º¿)kÁë4 #9xL +·eq‚ên4‚h»j"©t@å'Ð`#dï<ÑLÀ·EÆÝbqÂ8ÜqE¿7ÓVK›¥›ºV¹«öšOHYrSì*ˆqœ¸†ÇòzWhžÉ‰è{oáû¯ÏamŒa™?Õ± +0L !ÃfSUç=ìy×ø6)ð¯AEâéÑ·X.fÞÓõX“îñ¯É&ÝxoëN«£þò{GÑ—ˆÃ'åÊž4I&øë@þôp ‰n-t ú²…:¢ÿÿ,ô<`¸&ÐHž`ÖÞO»ÁBµTƒ0žƒÂ\*øW ÊdueØô¬.2ßþF„jº.MÚ œ†lRå ,þchœ1 e¬¨•ÏXu «AOc‹ HpÕ@™¨Ä¡2e¸K—²tU]“èÔšZ}°ÕâÑÄ µmþqUn‚”B8ä|¢w@J t¡‰X­šâË’•°HpW©oMBh¤°êBåPÑòžê—ûˆ)X¸ ’EOà ùž@ו#aÖ»Ü*7 Q·5‘TПÔzì—sÏmƒ°)eU³T† ~XöX1 þô!¿ýé#üÎPã¿«ê›ò£Þò‡…Ć u€¶cµ¿Š¡®Ïd˜°3^û+ 1)ºTû뢪Ð-·M9ˆß.RWèUèN *n›òR3 ,Úánm¹tzÔ¶öWóöî[ÙM{ù€ÚNñ”ñt¢#à€&E ±Ún·ëj»{MWs©þ•bB)ÂxJyõ¯âyO)¯©§‹p§$nWMÓi‹ˆó¹»Ñ͹¢ß±YI=Êo4Þ¢ëøУ³ ‘àwÔÍS,mL0Â>ÓaÁ/TËb<µú <ÛK{jÛèV;yYÑlm¨ƒêÖ¤|±‡g:KÛbÐøNKáfŠ…2X”NÔähœa aøp„ªÁ7Ù¼mÖ‚0žƒì"g™ÈzZŽni€ö×RécÂ/!Zòxd/MX,&JZ`@ƒŽ†>¤Ö{È=Ÿ^}z.¼XÀ¿a)©±ªg1žz};•™xÒS7q’™R¡×6շۀȯ6Ýy/šAEi’v4̶](¼S{ºÂUлâpSÜØv-Üo}\·‡‹Kda¶ÔÖ‚ôã«&â`v£W‘N,íûHm*]´u%Lëtiý)øI¥Xž… +X}©OùDö|‚~ùéD7Òx6áèù¦¬¯Í‘Ó~â¡8xÚ8åƒ@›8(q,袨#o<Š•ºE]¥žP\ÄÎ~?jzgfgÓ_ÓÁ³À Z˜§[ª•&ƒ§ÐgŸeŽ§Õ‚%x†ÔjƒçP­‹ÁÓUëI׿ 2œÜNëôÅ|M¥æ †Z‡E¡Ô–N$Ðã¯Ôöþbô#\ØL1-° «Ò©é@!Ðåöܺ¨ÖåN¯ÆYOÌ_‹(gi&‚YŒ§Ñ Q—± â­«­…Våïlúr¦HÀçÇ7Db[ïIKr–‹|‚´ @—I«)OŸÊ G&œåJ†õ Œ§ÇÀpð‡ª§QEý¡%ù„ªó´ËÝB vCï#Œ‘'LNZ‹ Pf0š”tks’nƒÝŸ›ét{r©!°/ðp›_ì _< ¾½„ÌX>qþí`Z.¹yeÊáR@1E}/ä¥ ñ«ENEðnL úqP‹3^‰ Xþ˜òã•-ÓJû—åÇôØtrwßÒ¾(s½ú›ÀOý¤êúÅê—W?Á÷W׶YOÞ³…´I$Xu§ƒîá—ÏÛæþ‡1ãÆ‚ ’§hܼ-É`¸öÏP²ìã/J&Œ'¹¿ Š3¨ùz’‰ýÎ:m­<6ÈÅU65ÿ˜?ütÉ;¥,ç¢ ã‰î@º —®èSÙœ1˜Ú2×ô¨°"Ø”#û'œM¼ºÓAÆ÷$W)´ìžT6í~nܳö­Ôqtß›ûîL: +.oDMHþEvf|Ûr‘°„«Ñ,‹fÏdɼ |¯[ÿ×:%:轶îNxá6·Ìä3p— [H˜ì»n £¨Ìg+Ôݺæñ’éXÚ+×Uç05ð‹½:jîüð-õ˜ž¿~‰•Î‹Kã$L áa¬˜]]œL=© ‰ +?Ð +ÍØ”ŠRÂf„qÜZñ»±v´È¸ÓŽþÎÜÐÉaIM0‘‰±7Ç•`©H`5%ã"Hµ†V9Òå7c-Á.ICDÊ[‰]—_«I]M˜Øymö^i¹Âww»Y¢XŠ§‡Ú™­}G¯Ñú?$¦ÑÕUmméóŒÄ~¨Èá犙u”®ÚK.`viÖ[’ëƒN8Ê@³4Ãþ¢í;Æ@9^ûç*X£åI2ƒøA§*RÅ#2´l‡Ò|Ë~n'õ>5½K1¨hß°‹åü­>/…‹Õ"ÍÀ¢àqQÕź1wõÿ˜“Œšîëäá³.+ºCvK“ˆ}>˜/gªgá–.ÌôošóÑ°tÔòð¡í“P„\°~¼_èÄ ¹E›ÐïqCì_QGlR—F'Ô ¿è……O<²É_ñ5Tn2¼[ëÙ¬ñ~-ÇýE㎷£ë{ý29Àí ÐJÌ18Tz(ãæ+~ +3{;²«£7S-«ÿèyF=SêS3ª¦¢¥?#QõÑhkÞ3‡QØXO#b—køgÄýOÿ£Lwº"Y&Göx ù^’*Ò§§ÔPÝ2Sl­xúþnèr¢endstream endobj -1502 0 obj << +1648 0 obj << /Type /Page -/Contents 1503 0 R -/Resources 1501 0 R +/Contents 1649 0 R +/Resources 1647 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1487 0 R +/Parent 1646 0 R >> endobj -1504 0 obj << -/D [1502 0 R /XYZ 85.039 781.388 null] +1650 0 obj << +/D [1648 0 R /XYZ 85.039 781.388 null] >> endobj -394 0 obj << -/D [1502 0 R /XYZ 85.039 372.262 null] +446 0 obj << +/D [1648 0 R /XYZ 85.039 719.568 null] >> endobj -1505 0 obj << -/D [1502 0 R /XYZ 85.039 351.668 null] +1651 0 obj << +/D [1648 0 R /XYZ 85.039 701.095 null] >> endobj -398 0 obj << -/D [1502 0 R /XYZ 85.039 125.402 null] +450 0 obj << +/D [1648 0 R /XYZ 85.039 653.622 null] >> endobj -1506 0 obj << -/D [1502 0 R /XYZ 85.039 104.202 null] +1652 0 obj << +/D [1648 0 R /XYZ 85.039 635.148 null] >> endobj -1501 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F36 892 0 R >> -/ProcSet [ /PDF /Text ] +454 0 obj << +/D [1648 0 R /XYZ 85.039 465.732 null] >> endobj -1509 0 obj << -/Length 1839 -/Filter /FlateDecode ->> -stream -xÚí[ÝSÛ8Ï_‘·³gjUŸ¶Õ‡› 4\¹B€Ä-½áú`C2 I‡ƒÞ_ZI‰íš -sib˲V«ýi÷·+CªXý'ÕP Ìd5 baXmßTpõZ=ù£Bl\åûíE•·"¬Œ$–ÕèJw‰:Îþ‡ÚiToºcÌ‘Èõ‚ t‘¹r\;l˜ëæéþo-÷kôg¥͈ð8â>ß+_qµ£¦ñg#&ÃêºÆˆHY½©pÁàÌÞ÷+­ÊÙtóŒWÍ[%šxYH$©(×Öí„œêKq‰¾Qä‡!*]Oì´>Ô\8MÕXÏ«rP¸YªC~©jºýñ6\†“¼p )é–…“¼T_i¼¦LL–IÝšy¹aQÆÍ«%Æ¥ ùf"JÆM»ñ81pmƒQ‡—†Î$î)ã’±yrO eÒ5 ~¸“˜Îcõ¤—@Ÿô]a’q¡PH…šj)RM‡%ê:T2 "b4/ƒcµ‚Aù2H¤¯6JyF©ºRJ*¥zIªQžÄ¢R¡~)Eœ¾ -­önÿÆ„i#ARÕc! -”Ì,3î´—A òö€ÏªE0Q–Xù¿›ss#Jæ'¨çd„©³e·pÍF<^æšÿ4v^¨e}Ð!οÉxø(’^rÏh¤Ö‡üÈÄG8{ï×ÄGö -ãã2™§Qó¢>0&-·hè?ð’2SŠe¨ùj6†LW ™zÊ™ øÃô¹žjö ÎìNQÁ±À…Tú;˜½˜µ`VŠ1ñ|Ó} ó\—!+œAÖFJx‘—¢ãr}}Gj)‰ÓéA̹6M“¡Qü:™˜†[xØ3Um¯ÀéØ¥I•9¦/r‡{—°T?€£Øq¿w =ôFìX"Ó²Ñ]Ësb^^Ùi@';LK]ï™ën6œžùt‡£‚¸JžDøkã!ÙX@¤/\‘yÊ›Á -ìu™e|å<(óEé1ÉvÏÒc†mz\‡Ìø3(Y‡h”-ñ¯N‘·î›1)z$•gHòäd•ù%ã6†XÕäëqŠ4q…Þ}4N»w±ß‡`ÉýÂpÖ«=é)N«{úˆ› Ït˜tíŠ×ò¤ßIÍ]'IÛãÞ¥!(xÛ{¬Û4®LÛ]¯¯LOœ¾yóº'æxh‹Ó^Hµñ =3ól@¤´R轎M{rߌúÉ®¡ #õBè)3¡B‘ îúà#Ó‰V¸cšÌüáÁðZ¤NßRûv6LßØ«X? -œ«V2þ'Gn œ©‘ñÆ<Ñ9`·×îšf†3+¦î³E›ÎByhýëƒe8"hQ™À&¥+¡Ï"$ ƒ-ã=ú Öä´¬ÆÈ3È?wQ[|÷G5‰–ö¯®¤NÍ•êêð¤QBUhÀÖqµ÷Øü#ÆçÖúý¬DÜ7‹ˆßÒI ;¯Œ¡0Èõ#ÊÿÔä*È|®B ç›0)Í™T³åÀ²É¸Ä”„"AäΔ+šò äÁÆ-5ª/ï›0,·†ŠlŒkØ«5®ißBl˜äbJ˜-[|vdÉw†ŠòjaÊׇþ«É¯]º>OÊïóðXÜ~Ô<*ÐG¹),†M§:…½‰ÇŽáM¬ÙHØôxü¥¿dBñé`©÷+‚Ìßl›â÷ôQâG 0exS$a3x#67Ü‹Û. œoàáFB®ÿÙ ðäÖx\/q,Û[Kcý$åû…p0£f­$Q!šl-ÂÔ–²ÂÒD{@ͱÒáí¸¶²ÀœÕ½’"ÕUäk‡ÃÕä×N 0¤HÙf@àµÑÈÆ.°éAoæF‡¾!T:PÚÃ2²½øè@bŠ]ö´¢üÆ Ǧ%º££b"µ¡¸Z4†`ЫNs«©—Yœö2½Ûì/’ç×íñÁ‚¢° ëƒ` ¶÷3Œæ8¹Âs©Mò:G´~òô¹ùpªqVâIžØl­DñF3sH9{þ6Òßð˜%Óò]µÜ&·%ìÅ'Oa/»¶À¡ÖŽ îòÒ%R¾ZÄqütÝéÅúÌcãNSÊŒJÊ$Ü¡n5ù_êÃ/ÉâUû¸0CÜû-¢‚Ï}Yé»Lt—€­Aã’ï–6Á»Êxw4—MçxvÞž¡ØQì5Ž!ÎKÊ:›È§)þ‰ p®ùHG'\ú°:5íp°^H£ƒ]½y—¼ý/ñ¶æ9Â)Òæ`”/’yx2´¤ãýþÏÂxw¶jŽue¹³I´û-”¶}^ÑÔ¥£óV÷b Ÿ@ˆ\ \ݤÛ!ÛñàÁû>T¼„l -[2Ÿ±©1ÁW.*(‡P†'ÿјýi½¿_ãùLL?jztaxák2Ûgn©ÿ<§Åÿendstream -endobj -1508 0 obj << -/Type /Page -/Contents 1509 0 R -/Resources 1507 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 1487 0 R +1653 0 obj << +/D [1648 0 R /XYZ 85.039 445.137 null] >> endobj -1510 0 obj << -/D [1508 0 R /XYZ 85.039 781.388 null] +458 0 obj << +/D [1648 0 R /XYZ 85.039 344.982 null] >> endobj -402 0 obj << -/D [1508 0 R /XYZ 85.039 761.463 null] +1654 0 obj << +/D [1648 0 R /XYZ 85.039 327.115 null] >> endobj -1511 0 obj << -/D [1508 0 R /XYZ 85.039 743.459 null] +462 0 obj << +/D [1648 0 R /XYZ 85.039 238.994 null] >> endobj -406 0 obj << -/D [1508 0 R /XYZ 85.039 457.432 null] +1655 0 obj << +/D [1648 0 R /XYZ 85.039 220.122 null] +>> endobj +466 0 obj << +/D [1648 0 R /XYZ 85.039 161.22 null] >> endobj -1512 0 obj << -/D [1508 0 R /XYZ 85.039 438.958 null] +1656 0 obj << +/D [1648 0 R /XYZ 85.039 137.238 null] >> endobj -1507 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F40 1163 0 R /F36 892 0 R >> +1647 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F14 969 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1515 0 obj << -/Length 2890 +1659 0 obj << +/Length 3171 /Filter /FlateDecode >> stream -xÚíZYsÛF~ׯ`¥¶jÁ-fÀàQ—×ÊêZ‰ÎÚåø"!kdP¶÷×o38PÞ˜±¶\åJ%™£13ÝýõIùþñ:p="í»RëÁdqà `çﾡðÊõ·ŽÆ?¿ ôÀ÷ÜØ‹ã{"Oß9ǯ¯Ç§7є҉Ýá(Š´s9æùÉÕÅáÙ%o®ÿz;|?þåàtܸb¤\J¼ã÷ƒwï½ÁžñËçÊX>ÂØsý8,T Ý@I3ŸÜü³:…÷Ô€¿êád¤íÆ°7’ž«µê£ \À·Âëáöö×müÄñwOs Ý°÷õ´þôµã·Ã‘ï\}çtû~é?ÃýG‡Cé9Çÿx}½}½ÒÏqýÍÞÿ¯[ÀÙÖýA膡¹[£±ëÅ~ãl?è9Ûûäyž€=†éQ2ŠÈù°a¯xén½ -í|,P éš‹gëGܵ­gü(rýHFB¸*–?÷Çî¿8¼ã Ná7=˜‹Ä÷9UCî")JF“Á0Ý 9ž<¹À ä~ø¸?xÿÉÞOñª‹·LøÿŠø}á¦k¸,I–÷CïÈ⮹h'¾ÃÐãY~aìú¾øáñ¾îþó«ãÃóÎÍÑ·÷tçgÀ3`oëjBá7¾ûê…~>Œ…ó¶Ã»··›%[áþ4ŠØÙ,¿I l§¸£œe>ÿÌ4iŽ/ëѼ¾Àq‚Ë*˜òÖOóåpÄHæ?õ†’? ãûô˧—¯/:|«ÝÐÔ®P_F¦®)‚€©Ì8·À)‚иë*+åÇÎxV﬊ÿ õ-¯t=4äC‚*ŽÍ&SN¥ð¥XBÅô¼=!̧eº.ØJôÈ¢äÙÞÐåëós· ü@¹±€¢+€¢+ -¾ø¯ÑC‘§KѸ o7Xÿ0b^Vsd¾¼_¢Û×…ÚÕáÿèE$w Žvž~V6íÊSD®†öu$¿bf{uvò·>\ï%Ëb™±µyk¹äÿç À{›)YC öNZ_Ÿ]~p´ ±H†#°»0–†·†½Ù2ï° övª,ØßÂ=¸Tm.³¼ÍÝwÌY‰ |^5}Õo^à¡ËìDSÑ@û›¶øÒ£Æo¯ûBiªgð+®‹‘D)ª2³’õü›ç«t>Ñø]¯#C7VáÞŠ~Úë„ßÌëP^¶\p4c’¯tB_ÆòåÙíøFôå)2ÞƒÁâÑ÷:Š`àEñ3 †Ü6™Îˆ%ºÁ”"c¹’è§f¿(×î=0Ý)îq,¶{»ãA,]-£ýÝÊ7SE' ÷ÜÈžA=ð¾~†»'K²NO©Ž*¿÷½­¬–¡Ú;ÀP»9e 1øÉ?1êèw‡¤]¹«ã²}z¯´Þ3C«dŠ¹w“vJÊyHË^ÁigZ—¥-Ù)Gî(šÁJi(’yöÛôßÔ£³rÖ°¹’’y£-+~,/fæ Œ…G<žÙ³’i³¨èªb¥ö$tœaÿGÿCi¶¡@²aST±+!§ -<ç»7×Çðœù#¡Fcl¬¡Š¡b^6)yã¼Ç”‡×™iÖã›»¿0 7ÒñŽ7 -Œ»òiu¾jU%|Ó´L²yaOËs<Ô’$˜äEBJ6j¿LMauUYŠï¼h6Þ̹“ì~è³NC·üDJíò -AF;â»Z´â»1๭ÎöV¬J–‹^)K캪âè IÉOM @–’¼:YæÉͤ¬ä»Ô¬¬ˆ¢r—v*-ÀÚõ·n©(*™SþŽ+q7#]òBÂßçu5Ì `FÀÿÏ/•l0"•€adƒ&S@$«)¬ïÀýë3η‚F­3Zâ²Å¥rÈEÚyKðÜð“øãÕÆÅ°Šéݺ^£ÂPâF °fῼCæ©9¬ÙWpü§w˜-⛧¼9#p£jæ) Vi c/E¤ìçi?ËZDz†(G0ÈÏß0ë>ã…rfn[µìWl±­Œí øó•Ñ9Ã*£X?“ÉØÚž‚]¿‚ÒFiÑú‰Q¶"i‚vC£v%k7¶=F„x¬Q:ÆGç¼kÀ¼¾§útÁT–úí - "Ž[n •æ×m"$m4z€x’¬‘ô3ï-7åÖ¹¤Fz6N–…µ$n<Žtˆ‹=(Ùˆû?aÞlËNÌè3¾ˆ„^1Y§uÕBá“îœÕqÐD,«„¦Œ™uº -¾R6+pÅIü äÜÖ;}™›W| ýdÃÏá¦^—ï„êÃ",U“á‚EÕµš§Ó¤$#ÕÕýÄ,·q¹Ø€ìɵӶ(àLs¼6­—YKÖXðw.ôò8Û‘wÐ3ãú™ÕG ðþ¦Ô2MLm;nÂ"eÝtŠ5E]W(¤#œnsΫ]÷ -‹wUÁ_²Ú.ÍGøœ0·ØªÅ–Oñ¿lÓ¥ùœÌ -è€ËãµcSM°q“òò¸”X’­ßàGÇ<_Y~¨KCK™9Û -NƪNv˜¤é݈63h‰»œÛ¥ç9¯¶ò〜ÏãÁGMùƒ*ö{~¥›}ç„šëh§¡ -[vJ»ìx¼ -`%védR3³px}ƃcS7²›€”&þ§ÅØ µ -©ZisÊÓë="Æ+›ãð”lÉ.´‘«–Üq$™,yƒER¦ø N -hù&Œíüã#P>ƒJº½$5-+Úd˜kÑûEÚ{%þ èx%OíÓP=Òð>A5×A=Wí¦¥ðLE®-skËtls`†AÑnà–!YWoçd¥qV± =8Êò"³Å0žÉÅ,¹*i§LvKY¾W‘½à麾ßÊOÂp+…hg˜Hý”54d£Ï$è/)ê²EV>‚ú´‹È®æŒ2 -§BxöƈËø²6Ø'($%Uæãf‚Ç+=YN#ÑžÏùÀ<µÕO¹Q6R{£ÖÔé‘çˆN,ö éÈí‹ÑòVø°å]r7§´r—Øm»£$‡Æ£}0žYfžé‰L¬‘¬3YSž8«užc’2™õÆHÊÙ*½šN$—ÌÀwöÀd^˜† ­æ•²…€˜ÖIOÈnèMŽ w¸M§kÊ5k=æh{:Í>ùìp ¶°`’êE°.ycIØ -•ñ6’D½Ù9v,Ò&óMU­m£¶4Œk}Ïå/ïjaYe~*#Ÿfžß@ÛÞfi2µÂÊ–ªGA¨grû7 -Ǽ8µa¦ß­½Ìêlð—9§udRBjó†`TµØL<’:4N*…„Zš“^Üa¥ÀÂÙõñ_xTÌ’Êóaèó”I'vŸßÍ4uØÈ4íÍ»¬gST­C`.Í'kì®Èu`¶J -:˜«”õÔ^D8PP˜2oF¾q°ûTùù2nE16óe]o-·Ìå ïp[ÉÅÚäMº®WÍÜÍÞ¸u[O*f9ôö Œlöû;s%ÜPªJÐOÿ¨*z~)à~Bãÿ&²¢Ñendstream +xÚÍ[YoÜ8~÷¯h D=HsÅKGÞrxg$Žc÷.˜™¥[vkm«–Ûûë·ŠEêh]^ÇÀƒqSÒ§bñ«b‘UTø̇ÿø,ÒÌ—ñ,Œ8“Q4[]ø³ xòë·ˆ……,˜·Ëƒ¿ÿ#€§>‹ýx¶<¯åh¦´œ-×xï~{s²<bìôÛÁù³5(øáÀg2ŽfwÐö‡Ç×Ð+ÓJÚ뫃³ƒ/•(z¦fôVßµŒ˜ŽdwR7É…dBðY¨}¦}eFy¼-ç ç Å}o¹Iç øÞ)Þ=y·?*GL©¨19.ɤҽ£Z8Y‹†°®ÒÂç,ŒeKéÓ¹•‹·Y¾&m¯Óë¯æÞnνÂÞKîË"ûOú +.Ã/ÍC¸CÏ÷rR[|y….2wwgÒEéh)’kÛÊ@XŽô€‡ÅLE8 4Sl44/Hz$¥¸ÁŸm^Ø»IA¿†{%ÙغÙÕˆ,”úƒfT 0’”œy¡ X¬õÙÈŠZ4duM$¥b +î8Pm"üó ͳG©€ÜËh~‚ªw4W" êYTw²ÆuW0@Ù£¹u.cÚ¹Œ¹Á,†9Ö²·±s’çä‚y™ÜÃë:ò24 nÚZW¶ÆÇ9ý’Q¡’Dí1øR17ŽˆãX4*cbTÑ ˆqŇ'tÌÂœÅY¤ƒœÐ$kÑÖ7¡%ãBW=v9m{¦íyAÀ"­¦î6_'ëõŽ +dq‹cKdyAèrc¸¡‹œl-ƒ;§öÝ&)ÉαÏ".[f6¶”Ú»±úÝ‚B×FÔ[^¹¥ß¯6x˜{Û0vÜ}ÏVÕCmxììEýe†‰§Œké@HHrƒÈ ‚Ñ+Ù:ÍËìOŸ«¦~…Õï_ÜQ;C½^wÃÀ<Ñ,Á¨AÜ»ì8Ì¢2͵•sÁ$•$CdŽú–Yr:wöéíö§›—æ¿ã-Œœhªo·iQv” +VWX Æ”s˜Žr¼åZA€Ó-åN»ÓD„ó#Ñìpjšˆ°5_8YŠáJ®÷KM8°Óv;Š pÈÆ ³þ™ù?dÐ €]À„=+̈9 ƒz½À¾@Õ€@+ +ÆçyN€¶jâä?9ì‘#4‹Õ£å»ïÅ÷Èzѱ î#Ïáá;ÈþðÛvf¤‚©áã>r_í–œ½áŸ€Î½Ã‡^ =VP>/(‹ïø³2Žñbд`AÈ'¡x‚ýd®`t4Q¤ËAŒ:©q,¦ÃAÛ|Íx¤'9@ÐÏåâÑ‚®Š¤˜pÃr<jЈXÐÏåW¸º%sé{;Z`¢ÌêHŒ²á06ö"f1„þ)6~^‡~u8å5hÄ!,èçrˆ»Ë]âûªÇ Æa§7Æ€ÃtØ[$4j’€g]$&}€×ìmgH¸Þ:1ÖN^Áe{Uª¹º‚Öí:Ë/j¡86¿5ªŸà#©žé b2 +¬ò`e-Âz꟰$ƒNÓt ¬©ØÚX9ÁÖÚTrXÏìÁ‰ ‚¸=H“†}C>R³Àv“V±XÛMg Ùr%¸½¤Rï@˜Áñiðu‚ d²<¥aRÉyrë$ªYfKµJ'¸ô$+ü{‰Ròé!®„‚”ìédU¯°E˜)º*IÏÀטVŽ°†V•k½Å†™}6†(É`ъ̧u= ´¥³¾êŽåWÅÒ–§Üx˜aš ¸!ëÇ9WÌ’ÜTìóKF¦ˆùdÞê÷Gx³ )ÞjYÏÀÛ¨bŽ·¦bšTÿ˜ +‹‚ѳ¹Rí"9äë]¤Rl~(ˆ€J’Á<аîÀ‚köoËgo¨r¸œÇ‚ÿ$7Ùߪ¤gÊéšîœd˜â’= »‚™5q°ØÀôPæ´9MQ[¾U^åÍ|e¯piÆ¢¨›mMÅ.ʤöÆœnmío ãØPEZy7p‘Ѥ·â’]:<íÞ0zº÷V¯8/ap¼‡E™|ý®²wN@wB?«mž§f´tÕsó;§“l™:8Üx÷7ºaVש_[ÈŸ¾öÏ>½-AÜïÐæX%±w[˜ç¸oZí Òи¦Ç7IaD-z¶,wÈùv·.؃2R,ˆø“)l¼?Ì¡¡JŸ+ãZG€mJ^?“ÉO:Np—áÆÏxËÆž"Á]{ò­¾,öûÿ—ºÄŽ47ié s`¨¼3t…íÎjÛžl\Õ—›Kßë«tØb!æÅÓ-V¿?b1 Â!ý³0c"?¥†ÑÚ¶7˜àÿ•‹®¬ŸÐϙٙBãbÖÂ-¸<Á-üíès£'m@“Ò^Ò¡”òü{Á„ñ‡9Ò¡ùŽàÉÕïpdAÈÑ™síÌÅ¡ÑqxIkô­ž/yØ;¡œË¬Geå@Û]í%M²Â²••ò›3¾?ÌRõÕÓªßaÈ‚†¼hTõWÖ,qöè¯Aì—Š%dæØ8Bäù¶_þŽŽáŠ†ø´\ó$}—œ?§úýž,èYyê8⻫m1á°ÿŽeðôÁÖï Ö‚Ì·I¤¹´lk¡4ñd“T3ƒQ¾"d ZùÂûcR^Mz÷Ü„]Ggf7#7nq± ãÐ:¥3§ _yÈPÐEw²Õ3sgmQë6pRÎD$‡6Ž²¨1ÃõG‹ÁÑV{ÄÏî´Ùîçpž:­^÷ò€)ä û +uαZØPÈ¿«¡ +¬a›;q@WcFÆO˜Öø¿Ü¦;Bƒ¦¿™ûÓLˆ<SÍAöUk3!úAS5ÿޙЦ¨¨A#\XP‹ŒCL©o‘“Pê`VÏ*›¸uâT{H¤í=¶·æ+Œ,/ºlcŽªï0õÛ|Å’ù"j©„­ SÒl¿Æ «A#„YÐØì9KW»´ç+ ”†È5¦ŒÃt”Ù›8‚ñ0h)ãßCà’ƒˆ˜ÁÄéE4B€µø87_ áT¹ÄšŸùÇ~Êrô¾Ç|eÎÇÔr˜ŽZ{THs¾ØTË¿?7Átˆ ÷œ« .jÐôX. ·›?]j¸†E)ÕÒa:Z¶©Š©Æxkj†ç‰/˜¦¨©A#ÔXP‹šw¸Û€¥º»Ä!èÐcý[L§ÿöö ˆ¾Fÿü‚@h4˜ár %“Z´Ê1•cµÈé ”/ÂqýjLO‘ßé§ uØý&2¶õyôy!åôaæ†ÊFkwøbn®èãNz©ú´?ÇÌ`wdöpõ°½%¼âe7uc”àÍ_Tc¬1Ã>‡tǪ]×'+œÒ¦}HܘŠáúEŒs©`b áLJ=ñ១šÿÂ/1>½ÿ¥3#loa§ÜØíÖb:ݶg¬‘>4›Ý~Åý'®6ï¡í,ÕÈ3ÚÀÒç½}A"‚Ÿ‰½Gf &U9>:[žŠnLàfw8ÒEìu·|sÖ\wGÉËÎœù§vèuhA7nó*«ÞZÖ®FYîš›ú¢LvX“©’­F… ; Êa_ö•…DdR6÷¹Z·,Ô<Y Ù¢˜ÚÖ˜a«XŒ©°™ã•ÝsJ\{‚FSUö`è’ë%#׽ѩp̽åò´ë/°b” + ÙïrÏc" +Ùìrûcˆ÷ïteOœMÆV–˜³ef.•vA0ŽY8µý¬1Ãæ±3kð»ªôËîÜh‘a¬_ Ùïwï„C˜ØÑè—ÓèäÓë´Èv®—zVDE1i%ä|½á þ§Šóýã úrJ95æd¡²ºà¨”ÞW×ý¢Ž¾ÿÆp«¹endstream endobj -1514 0 obj << +1658 0 obj << /Type /Page -/Contents 1515 0 R -/Resources 1513 0 R +/Contents 1659 0 R +/Resources 1657 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1487 0 R +/Parent 1646 0 R >> endobj -1516 0 obj << -/D [1514 0 R /XYZ 85.039 781.388 null] +1660 0 obj << +/D [1658 0 R /XYZ 85.039 781.388 null] >> endobj -410 0 obj << -/D [1514 0 R /XYZ 85.039 410.554 null] +470 0 obj << +/D [1658 0 R /XYZ 85.039 462.86 null] >> endobj -1517 0 obj << -/D [1514 0 R /XYZ 85.039 381.755 null] +1661 0 obj << +/D [1658 0 R /XYZ 85.039 439.542 null] >> endobj -414 0 obj << -/D [1514 0 R /XYZ 85.039 353.62 null] +474 0 obj << +/D [1658 0 R /XYZ 85.039 187.299 null] >> endobj -1518 0 obj << -/D [1514 0 R /XYZ 85.039 332.423 null] +1662 0 obj << +/D [1658 0 R /XYZ 85.039 163.982 null] >> endobj -1513 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F43 1079 0 R /F37 900 0 R >> +478 0 obj << +/D [1658 0 R /XYZ 85.039 135.371 null] +>> endobj +1663 0 obj << +/D [1658 0 R /XYZ 85.039 114.776 null] +>> endobj +1657 0 obj << +/Font << /F60 1074 0 R /F35 948 0 R /F20 937 0 R /F15 951 0 R /F14 969 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1521 0 obj << -/Length 2651 +1666 0 obj << +/Length 1706 /Filter /FlateDecode >> stream -xÚÕZ[wÓH~ϯð²+Ï7}Ó ž€ Cæ@È3gÏKq4Ø’‘ä\ö×oUW·,Û²I`8à¾_¾ªúªº[bÀá¯D>ã*„‘`*Š“ùL¡æ·a[ðf<ð±êùøàñK?ÎbÆç¦É8ýà½xõìd|øn8RJy1ŽÂ0òŽÇ”ÿ÷Û7ÏŽŽ)ýîäÅ¿N‡ŸÆ¿Ž;SŒ4ÓÂ9¾|øÄ),ã÷ÎT ® Í™ˆãÁü@ûŠùZÙüìàôàvªÓêÕ³“‘k1RœE‘n·$üž-%Ch/¼Ó¡ð²áHx æ¹wœÌ1—¥”=ÉÑ ± ¶~•)t˜Ùìi“469ÊÈ[Ö åÎV¤WgV6¿B6â^rÞ¸9+šäê"Ÿ`‹ êÜ\P=¦ëóç5ýVY’ÞP禤¢d21 _Ø<;9B9 øa‰Í®'¥ÙÞœöQc¤©µö^'u3»FÊû•D™Ð"¥ôéH?ÇÖ“YYgX¨Íbð·6{=Æ^ÃÌœíîÄc¹¤ÑÈË(S™Þu9»D²ôIwÕ¾é;ûŒU“Ùc.Š“—q…öÉ‹ ‡À\²hÁ<*,T¬lE¢„ý`”+üÏÖ&)â‘7y‰»Nf®´¸iÅUÛ¶çMVÙù­¨0m„¼œÍ dd*«æ¹­1½SÜØã— Ý+eTaÀå[•,¨ÅšºúLûÚÖŸÀp‡=ãÈ€I!÷ ±(Œ]}2Ï È#-#Æ£uA— †°%ƒYSá"‡ÒÉÏ*Ο(Ùd¶ì¢Ôj¨¾éW—Tz>´’A«ìè³Üéb“¥+±‚œ‘_=¡]©°³+í³HD`ï1ã¾2ËÏ "ÊÏ—>¨íór‘ÿ¡\•}Yfuó–BÖì ËÑRLŒÃ†ÉðkPj‘TɼîÑËG…ÒøsèÒ³:©“GÃQŒVȯߨ§.Ê6ÅÛB­Û–þÓÛí®®.ëËÎt¡jGV#º_Mç¿h«ÕÓÊ:f‚H{Ûgàºbµ+¡X°YQlÌÉâ^am¯Œ>$)ØŽ¬gXÉ™ßÂÜHµ&ÆXIUË ­A­ª²«*oš¬°|†ªWά6åÅÔÑÑ&ð¬ñس<§:"ˆê³ÉÀº<Ôöb’ØùÁN…?r¡) ¤Ÿ¶(‘´çˆ¼°©¾á -X•~ÂdÙd ª½üK5LŽëYR¦n½dpñ øÐ3TiùÆT¥†ÊÙbk;«uMIƒ&ˆpb+ãR„QÁ9•qîRÍEfÛ%@v&¡ ᡸ1:£!’éqrd™ÕŠÊmmVŸUãk†-±4K¬/S$Ui„‘þc§ëAÓ*¶“T$i,AIãoFà]tK#Ü)_Ÿ>£¤óŠ¦øpüúío{LȬ¶®K”è´5wÚ9Í‹šÚ\åÍ…£µ ëbà5?°ê^‚F©:kpñOz¨]AãÀq;i{<˜]‚›Ñk¨ü9 Ï`‘'gÐ(v|cV áDÖ7UÈ™£§©Þ£¾Õ‡L†Ê6ê%}ì^°@;/æ“xGÈ„/ 2Š÷—óT9T5òAÏîEHDÖÝý­ BÓÀù].z†ó÷móÿL¾LTÔâ+¡”×#»4ömHÊŸIÙ¤¥SŠ?Ë…Ȇ—³B\WÜÜÜ -îôTýìèª5t?rŸ¿Dõ¬ˆ¹!õƒÍ*™:—Œ1»q>W¹ÃÜ©2²+¥ðh5v„1Å÷_ÿðUŸ½‡2¼?K\ ãå3nSš„‘²¡ÃÖÿ¶ñ…‰¹\äÓbìà…«¾ùÈw¸ò¨ù ;! áà|³ö ÔØEÐ{´GéaŽ°KÆ'°sì”Lç° ·Ì5ƒ0±àÔ¨2¡0thÆ¥Tÿ7£Z‹ «l$ -ªnz™Hj‚i¼d°"JÒÕ5„ Ô¤Òà'×ä`NCJI_>c=ð»»‚g}R##|@{Ù%¸PFìU“%˜I‚ù$YOfYìU~:à“ò‡LðVù_ôÁ±PÅ»öçÑb¯òÃ’Ä휣™Ž£}sìÄ0€S»3› "âÀÄ!©C¯{Šªœn^Z56J_Ý4`G!Ñ:tì»ÅšRâI«}Éüp=úsöGžy{l}9®{®=E©–¢ï§(±G ¥ôÌàû>ˆYÐN³ÏA(±o¦4¡³ÑçÚiS‚'h r |«s£ø/L(i Fø¬\–a¢£Üiaa1¦æJqYÛÁÛ«´ÊÞ‰ªîâÛÅñí»¹*|`®Z´Žº{yÛa¬Iio'®*ÈûMóV‡~ÏÐ ÃO|Üš$ÅÄ^Yl—ÖH.Õ-Ý‹°=0ÄûRámèÍD±¾=.Õ¾Yö '#'œuPpˆx–“žâµ-Æ¥T‡ÐŠUˆYÙǃ§XÑ‘Ö ‚ ¾@ÁÒÞ³¹‘ÊñËœ†Q{ÏÞKé³xÝ9ÿ3ÍЊÖ~šj¢ï®üŒá­,þ¿=“TŒß_ÿë&©,o¸»T±B -)Z¶7cæÈVt®hÝë9šÈ›´'‡îµŠ5pëöÓcßþ·EE¦Ýó²hköß:¯9·Õ}p7ÖÞXâHEé($ÂÅñΛtÎ")×nÒ·&w7éLÐ]ú;|z±9a €wmä6,‚Hz—r2Tx×üP§UzçåPq|ÍÄŒ}fÁ[÷ ÀBr6w#J˜»[u–— ]—83 »ÒÉç¢Äi®Ü]z–NÑÍ1]4[€!SÀp‚Ÿ¾'bmcü {‘Ý{Û^ ÞÁŽq%Àƒf­—tg† KþÚ\W,˜oŲ9]Ìx,nS=K„7öa ŸïèÄQ»—Ž/«×·feeüšû½Š)xÀ8¸f 8XYð}pÈ‹>ŠÝ!A¾|í„BˆïEƒ6qƒZϽlËTÁú‚û`QÙ:Á6¶àÍi?;ú2øJv¸SŽ 1.ºü.ÈŒ<мÞRV þŠœ¯ŸL·f PEô÷)ãê9Ü9¼ç¹ù&þVBµÝæE3{•Nðx1õ€:§j"÷…¡ú¬þíuÌ`LL‹øïCÿˆÆ.cC¨õ€Z‡rU2]]ó¬ÙÏx¸ÇÔoƒ£ýÆ¿”ظ\³ÿU3¶èáaõ!Fçµ¼¯~õæ¹}`5÷‘EÝyÂè<-7=³À¸ÝS7‡j²l.v 1s?ª°"8µþÍH˜$¨›³<Ý\„¡Â—÷P{º ÛwÖ¶ßjùNÛM1›ÚïpP÷…ŽýX÷ê~„âá½…ô ÁPÓ:œªÎ(˜{zH5ãËq“xÄÜ4w©«¶UFïÁ6fÕnßz¾°qRšu¾3oûÝÏÚL:#=jZÿf»=Ú6 ˆø…&¡á<ôGþöˆx¿"Í˾ߞ7÷"§Õ¶0L›5aüÁ×?endstream +xÚ¥Y[“Ó6}ϯÈðR§Ó¨º_xéPÊ2twaÓ¾Ó1‰)™Ér)0þ÷~ºØ–[d˜ÙÈÒ±Îç#} 2ÆðŒµ@˜™±Ò1­Çóõÿ†‘ßF$ ¦20¿ÎF??•0Š‘Áf<{_Ï#l<[¼Î?{t7{òj2eŒe€œL•ÒÙÍÌw\ÝþþèúÆ·_Ý=þá~òvö|ôdVñV3‡±¤ŸF¯ßâñ |>ˆ=þ mŒ ¯GÀŠgáy5º½¬¦òc|ìßêúÆ1%*Ò:H‚¸d•4ÖŠ¡c%0˜;!`”¡ É$¢“©8{Uìáñ#|<ɶ›}Ñ÷é\ƒà¬ËJ&` µ¦ÐNs –H öR ßDì kïÝ틶E„ $A×h®ôr0$;—bZÎ4`3ˆF|Ö¬g°[Hvubš h§sBJDLª8bMÎ÷ü…Å¢*Û®–ó¯¾ãC¾YÀ"®N¯Ô]†˜"kSƒk@Ö ]q°*w›^N‘”$Í0'¼MAJ4y±ÿê©ýáÙrŸ¾XÎóìd׳wVAïÜ6æ…ý»ß÷lli4 ’^a*e2BÄÊHͦáeÊû˜_9©²—GgÌÈæýÖ?ÜM¬®–Öî¯}ÆBØÓŒ§­1ÎX&:–QJˆ1Ò‡„›­[ÆâáBÉfÀF&tf-ÙØ‘÷ÐØú¾ù*ß[•…²º»®ÝDÀËûöÇ×»†wŽûƒxç ¾}(§ßçò}9š‡wÊé+¼ç±>Ùµ-öÔ§—ˆ¨t‰0ý›]2›¯¹¢ˆ”qóÓlè3Áæ¦úÒp)a›)¬  pÍui¸L›ÂelÖ@¸Œæë—mÒ®ps^.…QH•^›Ô¿6%Èô‡uw'ÄŒÈjA‘!ÔsBÝ”BR„¡S»é |¾‹Š+èÈ]  Aó 8·½®3@s?V)XÆÔZH{WÞIö LBzªGÒ/†Ìj;—FìØÁ:Ki³edÜ”ƒW5ž2Œ°öÖí?/ó°ç©pf,]aŸ\†.ý$€¨ § ¿æ¹MÏÅ&‡EcØgÀ;Þ€ƒÓ_×7Ooý[‹í:·iÛ¶­A?ùæªø§Xí¯ÿ±ØÕŸï¹Ëø¶aµ­Di1ÿWöQ…0$°PÚZ\c[$Ú9¦¥9U…èf>ÎçEoIÈ”‚¢;]eE˜þ’A•e”j„*Ý* ŸlŽëb¦ùÇÙÄ@}•“sI踲¢ÚýÒkm é°äuxº¸e0 (û‡òfãKÎ+…'ˆJ’¶¡Æt8gi¥H…ý¿ þU|9ìrß\䇼Ϭ 4mBé—«5kÉðm¹‡È0‚^ZRe+·s=¦Fí £õœýa´ÅÛF#ÞæYͧ›ãÚŸ‚lX<,·!η!»|9ô¥ +[Uó]*LB9_—o¥K“·[—š·K—ÃnYawE¾èU|6Ñ€ 5(¡C/DŠºR¢EÝ-EDÝÔâ°;–UèÁ„Œº+‹Ø4öDºéˆ¤øÿÔ „@tÞmG’·¼íhóvÞvļø‹Æ8H„1Éb=(a¬ZYÍÙCÎÖ+æ$t£ü˜Í€®È«ë’P­l]¹·p5}O#ñîŒS…ÓÓŸ)Æs›W&¦•o}@-6þñ¾˜Û…è6ŒÆX|w*$šíNrO8¤Ö¼0ç¥BEƒ&,mCéO…`$bü;2!áa•>…E˜„ +Ì.l©ðm™P8æ—fBÛ0Cž\‚ÎuѬý¡®MÝêbêf¨;=—­ëYOpƒ +„™sié$`ÎÖ#Å[ÊÑâíT#â½\ pEÍ +‚“¸Õö˜³ÅHñ–b´x;ňx/CJȨbàB±Â$î=æl1R¼¥-ÞN1"ÞËÅbÅĨ1‰›9[ŒouÑäí¾‰¨y¿_ŒêøÂv'Åp¢¾è4«Ä%î;8§KŃ-ö³øÉmŽ` ÍNíý&Çjþendstream endobj -1520 0 obj << +1665 0 obj << /Type /Page -/Contents 1521 0 R -/Resources 1519 0 R +/Contents 1666 0 R +/Resources 1664 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1525 0 R +/Parent 1646 0 R >> endobj -1522 0 obj << -/D [1520 0 R /XYZ 85.039 781.388 null] +1667 0 obj << +/D [1665 0 R /XYZ 85.039 781.388 null] >> endobj -418 0 obj << -/D [1520 0 R /XYZ 85.039 601.341 null] +482 0 obj << +/D [1665 0 R /XYZ 85.039 761.463 null] >> endobj -1523 0 obj << -/D [1520 0 R /XYZ 85.039 580.348 null] +1668 0 obj << +/D [1665 0 R /XYZ 85.039 741.337 null] >> endobj -422 0 obj << -/D [1520 0 R /XYZ 85.039 277.822 null] +486 0 obj << +/D [1665 0 R /XYZ 85.039 698.106 null] >> endobj -1524 0 obj << -/D [1520 0 R /XYZ 85.039 257.834 null] +1669 0 obj << +/D [1665 0 R /XYZ 85.039 674.789 null] >> endobj -1519 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F43 1079 0 R /F37 900 0 R /F20 877 0 R /F36 892 0 R >> -/ProcSet [ /PDF /Text ] +490 0 obj << +/D [1665 0 R /XYZ 85.039 646.178 null] >> endobj -1528 0 obj << -/Length 1854 -/Filter /FlateDecode ->> -stream -xÚÝYYoÛF~ׯòª07{’˧Ârì6⦶‚>¸y %Z&*Q²H9²}g/’¦(s´1jîìœßÌô1ü‘¾³¨J‚˜”ýñ¼‡ûSXù­GìÜçB- G½7'Bö FŽú£+½e4¹ðŽ~?ü8:>øŒ1/B? ¥w:2ã·|8|wj~Ÿ}øñ’ÕUk‡“õóR7Êé/®¬3¨é5Ü«Œ[4$Ä¥€HBYR`Ôˆá6YåiýJDˆâ°]ÂyJeˆ†Ûâ¡Y)£ ÔüCœhá]" -†è(]¸ÿáîp–Ü ÓlbT°Û!|Š Ïâ%Ÿ„ÚëPùÿ¨C’˜=þ¡½ú|²Ç7€ÌøÖ·˜Vñp¾Ý1Ù®ÿ\vL(endstream -endobj -1527 0 obj << -/Type /Page -/Contents 1528 0 R -/Resources 1526 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 1525 0 R +1670 0 obj << +/D [1665 0 R /XYZ 85.039 625.583 null] >> endobj -1529 0 obj << -/D [1527 0 R /XYZ 85.039 781.388 null] +494 0 obj << +/D [1665 0 R /XYZ 85.039 579.625 null] >> endobj -426 0 obj << -/D [1527 0 R /XYZ 85.039 761.463 null] +1671 0 obj << +/D [1665 0 R /XYZ 85.039 559.636 null] >> endobj -1530 0 obj << -/D [1527 0 R /XYZ 85.039 743.459 null] +498 0 obj << +/D [1665 0 R /XYZ 85.039 377.924 null] >> endobj -430 0 obj << -/D [1527 0 R /XYZ 85.039 635.092 null] +1672 0 obj << +/D [1665 0 R /XYZ 85.039 356.931 null] >> endobj -1531 0 obj << -/D [1527 0 R /XYZ 85.039 614.498 null] +502 0 obj << +/D [1665 0 R /XYZ 85.039 356.931 null] >> endobj -434 0 obj << -/D [1527 0 R /XYZ 85.039 551.405 null] +1673 0 obj << +/D [1665 0 R /XYZ 85.039 334.215 null] >> endobj -1532 0 obj << -/D [1527 0 R /XYZ 85.039 528.689 null] +506 0 obj << +/D [1665 0 R /XYZ 85.039 307.522 null] >> endobj -438 0 obj << -/D [1527 0 R /XYZ 85.039 281.19 null] +1674 0 obj << +/D [1665 0 R /XYZ 85.039 284.806 null] >> endobj -1533 0 obj << -/D [1527 0 R /XYZ 85.039 262.717 null] +510 0 obj << +/D [1665 0 R /XYZ 85.039 214.477 null] >> endobj -442 0 obj << -/D [1527 0 R /XYZ 85.039 197.503 null] +1675 0 obj << +/D [1665 0 R /XYZ 85.039 191.159 null] >> endobj -1534 0 obj << -/D [1527 0 R /XYZ 85.039 179.03 null] +514 0 obj << +/D [1665 0 R /XYZ 85.039 191.159 null] >> endobj -1526 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F37 900 0 R >> +1676 0 obj << +/D [1665 0 R /XYZ 85.039 170.768 null] +>> endobj +518 0 obj << +/D [1665 0 R /XYZ 85.039 144.075 null] +>> endobj +1677 0 obj << +/D [1665 0 R /XYZ 85.039 121.359 null] +>> endobj +1664 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1537 0 obj << -/Length 2527 +1680 0 obj << +/Length 2354 /Filter /FlateDecode >> stream -xÚÕZmoÛ8þž_at?œ}X±¤HJb‡CÛëîu±M{‰»@·[IŒÚ²kÉi»¿þæ…”YN¼pRì!@Dñe83œ™g†²HøSƒÌ -©Ý Í”ÐY6˜,Näà -F~|`ILtr­½.ò9l:»*¤ÐŒÖ<²‚|:Åáòê{^_å³z*œ\sß9¼¿yÁk¼’qah­wôeœˆá,P]*aûá3ën˜ÆB%êÛ²¸Íö›×· BòÛ?½v&8mBb£öê^sÉ‘ÊÄ‹Ÿ=¬øyµ,wÄODââ£ÄÏI~ bÆ}²£OÁ„à9dÏ×ÃjN– ÒÎ æý.•)¦½ÊqJÄ:=Ú6þÎ -©×yY]ëêkYç_¸ï—óWØH0†v·WZÃÙx/»;„j‘ô†Oê¿›¹×—9ØHgëXÓ´‡ p(wðÒË­#òi|¥ðÇú€w_/~a‹Èºø´ k«z7ꥠ`B3°íb^¤”0qz·>œÐ6ŠE:Š¬•p0ð¶s6 M¬ùhΊO§Ë‘–ÃõÂɯ;‚' /0AT‰ã}bg¤úð[ ò -®Ó¢Eí™+2p|ñ_ÑŠÂùe–Õ×7®‹¼¡u¹ôâ¦Yº²_™ì²†öu³qÝ4Ù™?Áè¦ðQ¿«öÈ(¶`’ è˜]5ŸÏ}T¨z‘£ÜÙ=ìUÉùM"ÔØðÍ)†üÄzsÁ½ˆsyóËÌG¼±UO® „MÔc€ßŠì¶¨&#ÕpTÅ—}!N›#¶Z7Q¡•3äõ,ÄûÉ’# îÎj™Ü3ÃÈ߉GŒ&Ð)û“+•€+¹ÇPØrùæZ‚çÆöõ,W픣Q çЩgÚ“z6ªP¶cá «Åðë uÓáøæÝ<.Ÿ|ÄGÑcB™°û-(Ö÷©½Dï eÐߤŽ-Mr\d+âY¤Tx6þ C˜tÍšU؃ëòEðfèG“//ò‹¹€DÆO˜yã]#0rFWÐiÐh^Ný|Ž 8)bB,œ\c÷œ8¦A½öžB€€bBC Pn¾@åÅàs¬fX­VÉÐQ÷@k¯e˜Ñ`ýêÿe¾ó¸1û£‹*]ø©Ñ\¸ô!‹;YŽ©+N¿9¤|·­8}­å]ýnT qƒK¨,ZÑ”hå‹PëV>Û - Û î#£Ïi¸ã˜ä夘“F7ÄüŽ>] -{ÞQ¯¨MÚw˜n|üTÃ"cl¨äöˆƒÍÛ‡ζXßÓÌu"Ñêxûñiä=¬Üz–OÈÚi4ZÏ”òí«] 5B¥É_iVL§Ô€2cÚÉÂúÂѺX1@öa—~fé—uJ?ˆÖö`”f„Ö@xÍöì¡Ka¹[îqHÔ ÂëFÀØßNMŽ¯¹g+º_s:þï´žû A©O9}5þùíðþöt{ëáÓ ?¥IA §©¶«¢ô=Þ:­Ï;>/ùe3+kLíyr½Yqs…ôÀë-¥ÊPùVÂ×µéø–nXmJ™6 -dßéàà‰âäüR‡Ùñ<ÁK -j­u›äÜ·¯©Ð†é¡ƒ%‡¨])Oã«w›°˜ÎùàëÅ’Ä*H¿ñÀŽzóIݦ^­˜Á ú‚õàOp‰ÙTnMLé}&,:Ðe •$W=ÆÆ쟳1`kQ,.¨oí#=öå_j¨HQÒï¡ü zhœÊTœ’‡õy=œáÕ,ôzƒ¤—:¨ ¢Š [X¶Þ"++"o_±È2{K±á0¦à³9`|ñô¡µ@Þƒ`~êŒqÝÈ°-ôíó{i„ˆoìùä¾x2<­Ó[둺K„ þ ãjwk3ðîƒI'<Ñ×5¾3ÁÄú‹< !5Éڀ׸{ÛUù$µÍø‚ž>dû\’©’÷³ïwQ£·JÖÒ"²F=ÐÅÊ#wÒo ÈØm™+Ï.] ù“À.VÅ6¤¢<Ó|:¥aÓî­¡Ø«¸15/%khQB=Ÿé`òš{g¾dæʳµYøÐÛ\zª[¯—|(Ìiç8+ -<7³Ik'^{‡õA½µ†3dËy¢¥x €åeäþ„«UCäʣ˴`“ ×B,;âw©<·—ù:àÑn]æ >$¡t&œÒ‡üö¢·˜™•ÈE=ËçœñàÓ 1âÓoþn„ø#T¶ûY:† -ä˜ ’ž°‚œ³ì°°rTyÆÅ‚·rü¤Ø\ºù$±ä¼÷YÏ7fpHwïOEîÕÿ“ž: ñz£2À×·ûV¨'€éw½õ„N»ƒ Uë›êoÿžìdöNsÌï4ú¤l3e_µÓ‘ò°ªé^B\ÛTô©™J†êÉ®oAæ®1ëvÂÅ{~?p(.ßùƒ6Þ£Mä÷ëÐØÝa÷‡ÿýBë*endstream +xÚÍZKs7¾óW°rÙa*Äâ Ì^¶ËIärd¯¥ä¢è@St¬ +²H&ñþúm­ǧ)¶n)øwücó™3îFçnà‹-wnh?›“âß—3ªŠ~peF—0çîûãri†V¾w(;ÓP]Üë˜æ˜@”•i›6»\ +O *…°Ë%1B§ŠDKb— Ê`„X£¸xuý HIU<_›µí£düd0Ð@˜‹4QÂå²E´±KEc$KÕ!Šˆ£úvõñ¸Ú"e  IuM€üå’Ò$X"-ôt.•B„°4Ï +dx¾yýªËˆ€Q$8q0WÚ÷’ƒ~?¯fÊÐb%ئlÑúîÊ8ÙEš-è .<¦'´½—G¬-ó\Z»õÃò“sô‹­qðõÊm†ƒß:ï,ÎÚÍà|Ïn”û˜}E‰UI' 0 ãqm—×q2Z9Ù¾ÃJ0ÚF·ƒä¥³ÞÆ2ÞF9RDd{PÎÛš¹Nö¶$­ÊÛZ9okæKx[Gè ·2ñÞ9Ð<ªë‹À÷fŒZ‡ÔÆ!m˜†ñÆ/aä~mƒ¯ä',ðb½vÿkçxÚía”˜5A~!ˆÈÒ°EjG‹Íƒuü‡åâ° +3Lšpö%E%¡I‡0ñð/”F¥m‡'ðÿÊg6øÿ—㣻¾œ£ÉXrJ"ÉÓkˆeÈÄ€‡ ¡saÿjw°aà_³9¥Q®Óئï[2>©~;Â뤨a¿÷SÍ›¹¸J…J*C®«íáéÁdv&XÜüÕÅÓL˜tÿhþØbG7°„#ä.ûå…¸Ï&Ú,Ì"7³zl±w·ÇÞª™¥Jϱêjªäª™]µ¹jóßGc-HÓ(æ2&ןi0ñ°(h‰„·W,ªgâÔð-°@¥¢ž” ßÁ\§†ï4-¾CZ™ðÌß]¡Cá;”é"ÅDÕÐåãõÎ!êqš±MŠÛ¦B?˜hgqÃhO´06#Úcz¢ÛªaøŠÞÎ M G9 'ÅB¹9ï ŠEüÃÏ•á§AP¨‡üV– Ûö1›@’ÑŠglÒ€6ñ #øÇÃÅëË‹/{b¡þ²öH‰õ˜žØöz…töÄmy°³Ž¹l2ÉKN«{çª÷»ÍâÁ×€¹tûÈW¹ð»Ÿ0a®šh9ûƒŸæ)ªNØVŒŠŒ:PB4N)±µ:;b‡Õˆý,ušß,ÈUV>]j§Ë²8x-Çô œR2£Ï”Чµôy»=ºÞ¯ª%þsƒ»Ÿ)CÒ[¼*_r6/wR\"Ó +ª0=Ù-ËS™2f({”å)¥µåÍg»‘.ÜçÊƶζ?pf¶%5¥Ìž) °>SšÁµ»\Ùýb~R‰0¢Ñûrñ¾}ßU/!|þ!kEƒ­Ÿ*­2^ÂqB´Uv}yq[­¶_ÿ ÈÞü< ýTi†‚S¤: ƒlpçNG38iS‚ áö|/2^ìû—Úí탙A8†Ew4¥R™Ý€;Úƒ íå‡ÅŒÙhMŠ["ûqÒ¥xZ¸Çô„wâ$Gœè–ð»ðzpó觜~íK£Ñ‘¨û  ±ñ“?„ÆJrê’:}`âšd¥@Z²nIþÇ®VìÅ驵9S|¿Ìö CBÂ| &N€V=!„û™2Ô88kS{û÷ÍPy^J2,Ï ¦'³Sžƒê…jÉ 7ðSå‰ï«õȶºÍðYº~°÷¥ÎÖ]ëŶ1‘Ê™²Æ$,é0£ ù”ܪŽïÈ,ã¹ù*¾™ðô">IÎ×ð¹°„¯o¼L„yØ»ãÇÂ%ÒAÿ:sšÕEØ ¹@D“Œ P†4ªTMŠ­JÕ®ØÁR5;:À¾3L5jŸu*Ò¦Z‰¤Œ»ÍÓZk@ ­yÐx×O‰®}¿#zØùÑ#¼¿™ò îŸäWùÀïÿ¸ˆFXçbXJ˜ÒƒÆ¤£f¾“ÓQ’Z•ŽjP¢ÒÛËIé_1rn~¦ ·²D,7â´Ã¨m¦LVaz²Û§¦`£È–ì»È¥ÀEàqïM‚ÜmÜ€»¤´î÷•/„S©¼CgŒÖÅ s$XÎPÂ=h|`I‰®KGôp` D,Í”g,I~U` ø'°Lçvj‹‰B½)‚ªº¿ÄLÔ”ºSöÓ ¦«ÅfåÙ™‹ô-&Þ\¢LCzן×]ª~|–öR0Y¼¿Òý LçXxÝaJ.¼j1\ø˜¥iœn˜x47_Ì_ +7ž=®ÇD±BT°Sϱ¦Ëc=&Óajf:µÁ”ääûK§L{©™-Þ]êHj.Oè-sæ™ÓLJŃF§Ï¤è*}vE¦ÏPt>}Sžž>Óü|ú ùè-È/²Ìœ•PÂ&4Þ&)ѵM:¢‡mˆa“fÊ3Ø$ɯ²IÀoŒMÌ¡™çbWJØăFú“b«SWìà©?û×÷ûœTE™iŸ „:=hœ:SbkuvÄ«3û7è÷s,ã9}6 „>=È–Ïì™ÜÜÆÆ;~Ê +ø쎟›)CSA È×ñL&UTaz²;?n^íEû#ðÖö±~wï{†-Ÿú¥=æûtQÃÂÉ‹—™ÆxJÖƒzmŸ~ý$mC')Úcz¢Û›…SÛô Eßu;;ºX7« Ûé_f|gF>VákÜÞÈ/ÖêÌ™q±Ý¯‡P±U_µ>&ZÜq gÌÕ¿cÍ õ×ðKߦ×ÇO|±¿i/1¤Y¤¾3/kI(£3®ú}Q÷þïÿÃ¥oBendstream endobj -1536 0 obj << +1679 0 obj << /Type /Page -/Contents 1537 0 R -/Resources 1535 0 R +/Contents 1680 0 R +/Resources 1678 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1525 0 R +/Parent 1646 0 R >> endobj -1538 0 obj << -/D [1536 0 R /XYZ 85.039 781.388 null] +1681 0 obj << +/D [1679 0 R /XYZ 85.039 781.388 null] >> endobj -446 0 obj << -/D [1536 0 R /XYZ 85.039 643.264 null] +522 0 obj << +/D [1679 0 R /XYZ 85.039 735.239 null] >> endobj -1539 0 obj << -/D [1536 0 R /XYZ 85.039 622.67 null] +1682 0 obj << +/D [1679 0 R /XYZ 85.039 714.246 null] >> endobj -450 0 obj << -/D [1536 0 R /XYZ 85.039 486.952 null] +526 0 obj << +/D [1679 0 R /XYZ 85.039 714.246 null] >> endobj -1540 0 obj << -/D [1536 0 R /XYZ 85.039 469.084 null] +1683 0 obj << +/D [1679 0 R /XYZ 85.039 691.53 null] >> endobj -454 0 obj << -/D [1536 0 R /XYZ 85.039 336.481 null] +530 0 obj << +/D [1679 0 R /XYZ 85.039 659.727 null] >> endobj -1541 0 obj << -/D [1536 0 R /XYZ 85.039 317.609 null] +1684 0 obj << +/D [1679 0 R /XYZ 85.039 639.132 null] >> endobj -458 0 obj << -/D [1536 0 R /XYZ 85.039 240.984 null] +534 0 obj << +/D [1679 0 R /XYZ 85.039 592.912 null] >> endobj -1542 0 obj << -/D [1536 0 R /XYZ 85.039 217.002 null] +1685 0 obj << +/D [1679 0 R /XYZ 85.039 569.595 null] >> endobj -1535 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F43 1079 0 R /F36 892 0 R >> +538 0 obj << +/D [1679 0 R /XYZ 85.039 540.984 null] +>> endobj +1686 0 obj << +/D [1679 0 R /XYZ 85.039 520.389 null] +>> endobj +542 0 obj << +/D [1679 0 R /XYZ 85.039 406.685 null] +>> endobj +1687 0 obj << +/D [1679 0 R /XYZ 85.039 386.696 null] +>> endobj +546 0 obj << +/D [1679 0 R /XYZ 85.039 272.73 null] +>> endobj +1688 0 obj << +/D [1679 0 R /XYZ 85.039 249.413 null] +>> endobj +550 0 obj << +/D [1679 0 R /XYZ 85.039 220.802 null] +>> endobj +1689 0 obj << +/D [1679 0 R /XYZ 85.039 200.207 null] +>> endobj +1678 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1545 0 obj << -/Length 1726 +1692 0 obj << +/Length 2925 /Filter /FlateDecode >> stream -xÚíZmoÛ6þî_a&5KŠ¤$æ[ÞÚ¦h7ö€m?¨– ±¥Ä’›úß÷Ž¤d;’ov×- -$_N÷Üû]ʺþ±n( 媄Œð0쎦Ú½†7fOЮ Ô—¸u4ì¼z-Ã.£DQÕ^é#Ãø“süö°?<½t{œsG·¡s>4ï'ÏÎÍóeÿø÷ûeø®s:\ùDOásüÆ]çÓÚwJ¸ -»÷ðL Sª;íɉܾO:ƒÎÇšŠÙ]s«IOÈ(ØëqJÂP´‘DH Q£õh ÚàÕkàc¹çª˜ÝÏ2s`í²}2'úg.sú§-t TMàɺ€.dkU`wjÙ®qZɶn’Òps5s¥çDד$».Çfmš`šýêJ0Ã%ßI3³¥óê`i0ùÎQšÅ¾…?îæ@$)ìw¢êÀQ -Ë -'6wñðèF/å÷nÞ&š@|=M²eÕí…ŠÈDÌ°èQÅé#y.Ñõ/M£ŒY\ÔìáÃ9|¸=6Kùþ–gðS°êCcÐ˨-ýGeôÒ<ÖFHx§Ùõƒ^öq»¡g3²†ñO)Yk{ÔÊÖÂÍ2‡´Ø>ä`Í*Xöe‚—în¢³WyÐ0bî ¢pðpÙZoz€Ÿ©ö°ð0¶†…çÁHµ<ÝFš^À7HSï<þí>Æøh„?oð‡IÙƒDrñXÿOKai G•¿€kk'œøž´aL®œ. ²óðÏB¿l”™d„Rõ¿ål*žå:Wl‚Î$ñ|ÙÞ˜c&i1¶P +£Š,f@hp@nÍ&=ëÿfV “¬1{Ÿ©¤XøpTêJ;G¢Â*#æʼ°'­¸˜©È1Ñ-nËŠƒØF‰ÙFìÞÅà„Çâ‚4LÓ ´qÿL¯¼¨5gµ I:«'HS¿¡áû´7%˜ESûÔVBC­º¯šÿ•Žwf8×úxêB8¨Ë2¯´»Šá3eb²|G¨Ëx’üåüQ˜úNË91šÁŠ;4$iX¶¾¬;‹W<€;]…ÁÃ9™ž2ðÚ_×èÛ -èŠ ”Q™¬ú‹pèw8$8¥OˆãçÔ‹mi¢&¼ÂCÃŒ¹É|9ê2Õº_˜åY匦IÐ^XVfQæ³¥îk‘[JéÈ’x[É/ÿk ãQ._ZµÖá)~ Àµ4t̲!O^åíôg˜BŠ²X!Ÿ˜èøKŒco"iØÖñ$/~ªí×× ò ¹Ái2xý8ªíš˜Š˜ù„ûbm2p’`ð¨ó¡ÍßWðfo%—Úì[…W°ØŽ“ Z¦xe‘"¡ëf]úÕÌŠ}É[[çF*o.¿·šOÕuÖ…™ä&™­¥\x À„¼8hí†Bí0*¢ß½Që(•+±ó(µÆôqžÌªæûà•Ú%ŸDÇ ¢åTìMxžÒRÛu¤XÃ;­fs]›"YgžµºyŽesY×Q ˆ]ŠM#ÝMüÓMáNø›ý }‚ýi÷Å’Ñ,iŽ8%AÕçüM,àü¼ÅXÁHX¸?m¾Çp¢å78³AÝ} ÎNšZRÞn^¡ß¯tti öòm€­ôp&°¶D:Œ -TÊ‘¶$ ˆ¿?cÉ9§eåïNhƒ{_h±lÑ~‡[µß¾i¿·Jl±UƒÝ:ö\¾Keûm‚¡àØ£ 3þ›a@\õ¢&Gvˆüuee HÎÕ´w‘ÏÍy ä¦ÙPY=ê·CÙvüèÿñõà¤&¶YõÂoú©,¦âï¸xCÆendstream +xÚ½ZmsÛFþî_¡éu¦ÔM½å¾ñå¾¹IÚºMŸíëÝLšŠ$[š“EG¤êæß°À’KQ$}NÚé4&µÀ,XRNbøON2+bOÒL +e“ùýI<¹ƒ‘O$#Nr`¾¿9ùî‡Fc‘Çùäæ¶™Ç +cõäfñ.zñÓÙåÍ««é©Ö:äô4M³èâ†~xùöÍÙù]_]¾øæzúþæç“W7µÜzF‘£Ð'ïÞÇ“(øóI,tžMá:†ïO@ª°FóýæäúäŸõT4f&ôÔ1=âTæ"Wv˜‡D +“èšò ¥ZªIjcac㈀Q-¦2‚!5=µ6Ž®–%Ü?€õ2*¶å²Ïv“ãú˜6JŠL‚2 +uQGõ•q"2›Â*£äˆÂ B…_¾žÊèÍ¡VÒHP«ŽúD‹ä¨?NýL#ª#ÝVíê÷CG³ÄŠB7³Ö€XcГÀ h¿E]¡èñLùù `X?^¡~âH•H•qep%ƒž°/ó}î¾4¬ïK¡jWe/Q½wÛ}×Ýy,R-¿„†<Óˆ†¹:Gήv¨®Dð÷†J¥®rœÇtd·Mi\.IKö{Š£p#½5Î_qw‹ûeqO?\-?î—„ß~0,SK IÑ“6°½ÄdˆI==½ ‰®ÓËèãé%ý„ôÒLùÒË ~>½ú}™ô‚a5@Mœ°:sSï–Õ~ç¶7CLóŸÒÝz»@!óYEåýZú­Ëías*{*ïÊ?™§ƒ}@€©C–†Jœ •Xߪÿ/^ݼ~û£ËfØ%i´£f`Nw7Ó\E»Ù–Ô—Ñl^ÑÀÅìÞ±——뺅èë’º±t¸› 0G¼ÊVXˆ\R9p³âú¶Ä5ºó]qËÎœWkWéâM5ûoíOvUÁ+Ð~µæÀx@Q•ÌÓÍvËt¢Úk“¤PÙ޶(ƒË£+M!!ƒç˜¬sa3[ A“+ˆPmÖå +‹™<šÁŸ<ŽæÅvëk|g5VÿE¢w~ ¨ˆúšFʘGc¸$`ôúÍ÷L÷J`´/ï>!CÎ Æf.¦ËGL€.‡E)zIƒ7;ÞÙ>´æùÒÄ«Ÿ<ɯ˜­mtyào=®«†¯-Ä: ~…FHÓJˆ±Pq +JºT¸eHK+º"Ä¥ó«#3Á2V@ÐÈD’´taª·_§ŒI¢ëªØ±ÎµòP›ÍTzóV3Œ”SÊg +s$2àVX“S¹ñ‘ÔïAP4Uéó=ØvA·—<ðÓÌ%s/«¬\Rwœûÿ0:ŽûY’eš=ŸµæùÖäâ¾ÖðÅfÍ[ iêRò8Ûl–Û»¥ à„IÒÑk¤ç¬SñÓ«Ù†™ ³†;šóC†×ááD³¥îFfê¡Ð@3˜¨çS<ßO¡!…›ù~3«š€»&"ʵß<~Y~šf:´½¶Å×[Oé]œíÝŽC7ŠäñJÏ°t¨Vª¡pŠ£Ê£8ÍŸOaóü… " +¿û)ZîÖxRõ)ˆ@W±â*§ð.vKÜ="/w¿óBýwSÅÓzæG_ÌŽIHÞGtV?Ÿ»úñêó'2wö†/î|{ÊpB·"]eZK‡nYúõrGœ5|QÖ””fû©³™È3ù|îšçÈcÐ_Äž?aú3#Î@Q¬Õóikž AH[Q¶ £²®dúš·>([5‚kˆtbZÑË%îÎuYÊõ5ÒRì|}µæêüÁoµß +#nÁ;1ÙW|Ü×䲇Y·£­w:1È«MZïHk@ý­·¡­”Û¡ºòÚà–é:¥ä Cßu» ¥µË–CºyLG·ö‰‡Q°û·T‹ÿˆMÐ{‹,!#õ“áA-20W¸<=âTc—‚Ž¡¿†›Ý£*$¦Ë +Øb³lPIé(Ùf:™¸ •Z’^Z #U6¡¥ Р6-.…ÀÅk\ ƒ»¦Ci´TÄc:Š´Ma…C*¦«^ÓS)Ò81½ ˜Î AÓ1±^¶f8n=a:º´­ÇsŽX·tëu¯õ°}H›X߀¬gPËz(üVt¥º' +)8(Q1οŒ{9ªFßögÈrÄæ3`2aZû§»ŶÚ›®Ãai’!M<äP“¶»aGT: 5ÃûŽ¤´J…RzðH*ÀÔ†K‘[Û2\Z¡ó´>Xs/Øét­Ù–õ†1«å`HâðãÊ Cöá3Cšc~j} ’že£oÉgIìÓÐÔr¿D'.üYLš›©mÌÆf”nȪ{.ñÒ$ZWåÊ-»£ûâѹF½»Ý!½+Å­Ô~zC<Íã͈¡øwÓ|p1ƒÿÐ l#ÇŠÅKgµò,úSjsíówz‘ìýL‡Ž—®Øa78´’Xì8Eá&&/­<é8ê€ùŠ|Œ´ã=ÌÈ#TÊ›Y…á^H#²òv_:·ÞÑTà¿’;f üì)ù‡OÅžåŒðÍ’ÓtöÉ=ÛèÅÒ Àá°MŠð+¢ä\’ÖqzÀ`ßµ`Ï»‡}XÜK8îÿFƒî˜~wËdÅ &’Ѥ¯5/m´¥x¬? +Àd„èÉÂXDʼn̦‹Ät%k{§Ò‰E[Äqdž©†ÚgúKoä2…­ÑŽ”nô¤/=‚û¿ô8{ôKPì_ô¥G:‘ 8 )ùÐk r¯b/ίo®ºU6@”UÃBÓzðqX,´Ñ-¡›æ<§ì?n@¾¶ë¹{3äŽmüy6mc€[C +écˤb¬yn0\æ)T H¬™jKéßqbíyg-±ù\. ð T’¿k“Ý—Ywù)‘C¾”͘Žì6C&Ff-Ùü•Ä¼ÿ°lŽ¬9zîÉ^–¸Ì3h€ (¶îMw;ƒþß²Ê fû¹ß²fšŒ‘¯¿ótw6“ö{ó@ðQg‚߇/ÁÚ‡·s|]¼â—‚DñØGš>r0_â#Cc{ÌjøŸêŒÏú꺎1£E¦{Rª…^/I ë‚V›Ž›€a3ÝÕ÷/÷>^endstream endobj -1544 0 obj << +1691 0 obj << /Type /Page -/Contents 1545 0 R -/Resources 1543 0 R +/Contents 1692 0 R +/Resources 1690 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1525 0 R +/Parent 1646 0 R >> endobj -1546 0 obj << -/D [1544 0 R /XYZ 85.039 781.388 null] +1693 0 obj << +/D [1691 0 R /XYZ 85.039 781.388 null] >> endobj -462 0 obj << -/D [1544 0 R /XYZ 85.039 493.545 null] +554 0 obj << +/D [1691 0 R /XYZ 85.039 761.463 null] >> endobj -1547 0 obj << -/D [1544 0 R /XYZ 85.039 470.227 null] +1694 0 obj << +/D [1691 0 R /XYZ 85.039 741.337 null] >> endobj -466 0 obj << -/D [1544 0 R /XYZ 85.039 97.038 null] +558 0 obj << +/D [1691 0 R /XYZ 85.039 626.197 null] >> endobj -1548 0 obj << -/D [1544 0 R /XYZ 85.039 73.72 null] +1695 0 obj << +/D [1691 0 R /XYZ 85.039 594.672 null] >> endobj -1543 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F43 1079 0 R /F15 895 0 R /F36 892 0 R >> +562 0 obj << +/D [1691 0 R /XYZ 85.039 327.223 null] +>> endobj +1696 0 obj << +/D [1691 0 R /XYZ 85.039 306.027 null] +>> endobj +566 0 obj << +/D [1691 0 R /XYZ 85.039 209.064 null] +>> endobj +1697 0 obj << +/D [1691 0 R /XYZ 85.039 189.075 null] +>> endobj +570 0 obj << +/D [1691 0 R /XYZ 85.039 116.019 null] +>> endobj +1698 0 obj << +/D [1691 0 R /XYZ 85.039 96.03 null] +>> endobj +1690 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F14 969 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1551 0 obj << -/Length 1323 +1701 0 obj << +/Length 2490 /Filter /FlateDecode >> stream -xÚíXmOÜFþ~¿ÂÊì*Þì‹×^ó¥"PrGÀí—$ªŒÏ€«;_°}Tõ¿wf×ö½ùèA¨ª -‰Û÷gvæ™3‹Â³”$T„V JYɸG­K˜ù¥ÇêÔòõ%N½zo¥²%! ­èB/‰†Ÿíwï÷N¢ƒSÇBØ!qÜ Pv?2ýýÁǽ£¾iŸž¼Û9s¾Fǽƒhî -×#ž/ðŽëÞç¯Ô‚Ç=JD¨¬hSÂÂÐ÷<)ˆôDÝõÎzŸÚSÌœg™]HÜf…ËBrÙÖEt2lñrÚ7$‚8Ìö s\)©}š^OÓ²êÆ ã¬SI< ²pIü®y3M7Ëñ›#¨=8ÚÿiùfáŸfûòÉ!Cf3Ùqðùà}¡L¤ŽËìÂ<Þ7Çå=Ér‡+»J‹åK]/$LÂ/Çóþ9ª_ûGgÑ)_>ÞS$ôÖCb÷a* –ï(}ZCÊãqŠ-ÏvÍÀ4àY‚+'WÙCè×KʪÈpú²éÆE…«óK³÷&«®L«Â;nðßĬÝA0oÁtgrq®ˆ§d-]nV,HÞh çwÊuûBïßV݃·ˆöxùx.m6oöJÜå‘z|óÝ{NÈì(:]±_J|?Øâ±'çè™ö©~Êʘ¶î*]ÕhÀˆòýí øÎïãÅ‘X5cºÙ5ï…Æ ×XÖ0-³"Ö5ÚDzYvù§oç2ÈnxÈH’å?Þð_ ]àn“ƒ£ýh"<|è°_¡‚g¶ß÷ú•÷Wîö·xßg{ |;Ê’;3pçHG£t• -"ßÚp‹´B<Ó"ïpHá…[ ¢ V«yt˜%1z¡aS}1Œn6aÁï±àÐS HÄtÙaÁ±_£r?°?MM¸3]ôãübb:'Z÷(Cï:-\poHŠð •Hø -êO´îÓ]•ÐŽ®0êHeã}9Î\8:&áX2ŠKÔ› P“z¨p$l.¿ávA=:†=Ó²2s½Ä´«æø2;íh\6³q½§9¾]oîÁ×øZõ]0Ÿø\­S#Wb˜à¥3¬ÿ‰eŽXäSDDæ?6"Þ‡K“‰öR€¢é£v •/TÒxóeÒé0iæZ54¬3Ó²ÓÈø³†CXw0 ÀšÂ…·¾˜Pœ?ÐÔÿ-ÁôÙª -\M^LÇi]HÔÉK[shœ«9 ‹6$øÌeÇKÚhÙ"q9"wÀ@¬í¸YbB.(4?ê\­•˜jBs¢´ ÏÈ!Réšj–ŠÉ¥#ÓÑ{:Ä4†?—â®$Æø‚«Äîü´\š•»›ÿìÛ|üý¨80Û†“qŒqÛ(ÐkÓ¥ßÓQYßk~¶ÌM3qQß®C6P·­R–nþ«ã¼bØdA˜¹œQŠy žá6â´I‹>yš$éºD¹AB[Ÿ<4^;©JUìr©ÉF_£4š/øË©f‰Ì6åL¦ébu{‘,n`æç î)bO4?^]üð“Ù„eI¶¸ºîøh¦´\\­?FÏÿùìýÕËËXJå2¶6Þ^Ñ‹ïÞ<{õ–ÆÞ?ÿËåòÓÕ//¯Z¹-G‘¡Ðß.>~JkøËEÂd–.`œ0Ó· •i%ýóöâòâ_-+šS Z5¶Ç†"æË„ž×ƒáLÙêAÀ,g™Ö¨Î“\,¬N˜N”Sì]±%Ä2Ö:‰^_>ƒm=;–16ÅîP®òCAoÅ”"<ÇYhƒ&upD-4‘Ñ+€ö¶rŠ¿/cc“¨Ü-ceTôy©ET¸©‡b©ÀOìݾùíXÔ|)£|·gë;œ¯v¸º†mƒÙ,‰Vø:ß›Õq붋‹€V8[‚>ˆßª·.¿C 9Ž²FÎiðÍÚóظ«/¨GPOÌñhi»‡Mq»Œ……%7y¹Ã àƒ?z0ð(F´„@£ìÁñ´{§ðPæÛš&~MtrØ”þéÎí£r°Ü‚ÚOëÂø;by­Ž5Ê|¤™NÖÊ©¥¼÷P†û\mq¹ÛƒÔéLÈ™[é $\X…ÒY´£™7§¶É-ú›\˜4cˆón*™TzÔIã†W0±b 8eÚJD¼¿&\ç75mw¾£ak[R[¯¾Æ8뢣®jÿ®Îoý(o§r¯ÊrwB|â¤ÓüPr;¥TmtôXA»<‰nÎ8wþ¥ QN?ÎXª»G"¬®=ÙÆS§/ÚÓ D÷¥ ãð&íu—¯Â‚‡ ^)0/´7TñgÔÌ£Kÿ€:ß–7Þ²J¼ÀpTò½7I¼ð÷X¼ù‘xl–.†‚e®›Ñ~,ܵš6€MÏhº#šÑ´':Ñ´CMƒ¹ñ3¢=Í@t_ÓF°†¡è]1’™d,6x.ˆ +§2âu½ìÁêò8°˜Î + Và­sôh0m<ÖÇ|K÷KmÀ Žt¨¸º¬é7ù=?D•pà!¡ºJq=Ÿ¸_4ä{\˜Ù;. ™9rº;­l˜hî8¼gï˜O²&ÀÈ”ñTž½ìäå†Yq.Ñ|EÐl™ÎÄ̾àñÙ ö v Ùþýª.Šî¯mÝ×_B\!`Nûq"·üŒ’:¢-y¢§ûñœèÖODûq zÎ;^ßÁg‘°ÆüŠ„¦¸€§ÜOŽl@XðŽï´†×üd6zz¥¿^öEX±à¡A•‰Ù“«¯pÙ¾8÷¾œÂ@C{6h­¾qAETcãÇ&SZÑ”{É vP*Âd)/·Ç}Ôš0çoÀãî ʬÐvS9»²œI3ß± +h¦;5J[¦D/œÉ“FÍ%8­sX¿Ç´4Ç(W?à°jC +tc€Ø5*¦`“´YÔ-ÉtGAb +3¨Ö-ïšÒH_º?àƒòQ]?Tû¦È‚·M ÃúHå±+WMýè)%q®ˆ”:D4ÎéçÅKœ¿$Zj׬ð”ï|M4ÇÚ—ç” +5L¸U“S®'´t*ªönŠ©ÔH Kô/Åã°Õ¡E9§þ—L'ú_81èÉÔ÷¿ºÙ±þ—íáâ®G‘öú_Èï)ý/ö¿^ÿ+iïü¿ öµ]0-¤7'8Ǻ‰i°u×dqÂJwÄ5Ñæû¦¿Ä}»84WÿqÕª×\“žné©ÛžHܼØæ½µcãñLYYïi·ÌUÂ^q‡òvÙ6iþJ?Üwf–aãˆö¶~Š³}¯ØÓ¬ô¿ÓýjÌî­ý%áRLÔ|iÐLg‘"˘ñµO{—>­ý%2¸ô2û­°ØpRg`z"÷‘êu›ì É ä`Ï?ÛóœÎÀS–‰@ÞlÌ*¦­± •âiRO²]Àj ¥~]ì0Ä¥ûŒE4«Æ)×äÑõdsL@  R}æL;¢™3õDƒ:o¬¹‰5ܬhO3}Rè Wè…¢?5eÀ¥¶w†\ú Ù¢°Qµ÷ÉMWH sïÖÞn¤W|Aµ)´XO9®P +œFÎ:n@3£= Fàk…Îq¿®¦’c ÿÆþµñIz¦ëÔ9þðн ÔsàÁË ¦ ˜ŽÔôD3|ÒÞƒÊÑö×ÔgëWóûAŸQÓÓU?ÚånÝýn‘+ó»bÒ×P‡üöÎwïHý¸,ßûK{%^Fh7MwèÝ­ê@øÚNj–ªÿ`i÷Ïä÷ç]S*1¹åìÛñ£¨Qø-4• ü짌ŠCTâfÞšé*Ť´= W§eÞ³74À;¡º6 +;|¾ˆ h¦«8¼¬¯=Ã/ñ"‰îóm¹~ü°ÌÊvÙ7}l%VqÀkì[+\úV÷pB^v«¤u½H%S¸8­ö¾I©dæNœZ’øDÉÐáÊû´ŠOôŸ`¾©ñ`у+0›â©6y½ñôM&¤7¼®ö4håìÃüL§ÌÙËÏ\æYëê6oËÒ©X‹g–&óßšéàÅΤí#TOK’ ½Ú~kˆµpòÙ™ëÔÓ FôŠÁš2iÌ¢ãô§¿£yL +¼¹“6ÿu4®c7òqHNEž|\" Eb¿ïT䬩_¡†éΤg5‹J€åðD‡¨ÊuóhßFæÃlD• $™cšä#ßô_­º.–„ eãÑÂBº¡<܇ÊNáâ'Ê!Þ?õ8³}endstream endobj -1550 0 obj << +1700 0 obj << /Type /Page -/Contents 1551 0 R -/Resources 1549 0 R +/Contents 1701 0 R +/Resources 1699 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1525 0 R +/Parent 1711 0 R >> endobj -1552 0 obj << -/D [1550 0 R /XYZ 85.039 781.388 null] +1702 0 obj << +/D [1700 0 R /XYZ 85.039 781.388 null] >> endobj -470 0 obj << -/D [1550 0 R /XYZ 85.039 761.463 null] +574 0 obj << +/D [1700 0 R /XYZ 85.039 761.463 null] >> endobj -1553 0 obj << -/D [1550 0 R /XYZ 85.039 741.337 null] +1703 0 obj << +/D [1700 0 R /XYZ 85.039 743.459 null] >> endobj -474 0 obj << -/D [1550 0 R /XYZ 85.039 645.559 null] +578 0 obj << +/D [1700 0 R /XYZ 85.039 644.777 null] >> endobj -1554 0 obj << -/D [1550 0 R /XYZ 85.039 622.843 null] +1704 0 obj << +/D [1700 0 R /XYZ 85.039 624.182 null] >> endobj -478 0 obj << -/D [1550 0 R /XYZ 85.039 568.877 null] +582 0 obj << +/D [1700 0 R /XYZ 85.039 551.126 null] >> endobj -1555 0 obj << -/D [1550 0 R /XYZ 85.039 545.559 null] +1705 0 obj << +/D [1700 0 R /XYZ 85.039 531.137 null] >> endobj -482 0 obj << -/D [1550 0 R /XYZ 85.039 517.707 null] +586 0 obj << +/D [1700 0 R /XYZ 85.039 471.368 null] >> endobj -1556 0 obj << -/D [1550 0 R /XYZ 85.039 497.113 null] +1706 0 obj << +/D [1700 0 R /XYZ 85.039 450.375 null] >> endobj -486 0 obj << -/D [1550 0 R /XYZ 85.039 440.419 null] +590 0 obj << +/D [1700 0 R /XYZ 85.039 311.046 null] >> endobj -1557 0 obj << -/D [1550 0 R /XYZ 85.039 420.43 null] +1707 0 obj << +/D [1700 0 R /XYZ 85.039 290.451 null] >> endobj -490 0 obj << -/D [1550 0 R /XYZ 85.039 223.846 null] +594 0 obj << +/D [1700 0 R /XYZ 85.039 244.493 null] >> endobj -1558 0 obj << -/D [1550 0 R /XYZ 85.039 202.853 null] +1708 0 obj << +/D [1700 0 R /XYZ 85.039 224.504 null] >> endobj -494 0 obj << -/D [1550 0 R /XYZ 85.039 202.853 null] +598 0 obj << +/D [1700 0 R /XYZ 85.039 176.163 null] >> endobj -1559 0 obj << -/D [1550 0 R /XYZ 85.039 180.137 null] +1709 0 obj << +/D [1700 0 R /XYZ 85.039 154.967 null] >> endobj -498 0 obj << -/D [1550 0 R /XYZ 85.039 154.203 null] +602 0 obj << +/D [1700 0 R /XYZ 85.039 112.807 null] >> endobj -1560 0 obj << -/D [1550 0 R /XYZ 85.039 131.487 null] +1710 0 obj << +/D [1700 0 R /XYZ 85.039 92.212 null] >> endobj -1549 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F43 1079 0 R /F36 892 0 R /F37 900 0 R >> +1699 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F35 948 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1563 0 obj << -/Length 1264 +1714 0 obj << +/Length 1986 /Filter /FlateDecode >> stream -xÚíYKoÛF¾ëW¹”,Àí¾—Û›k¥Çr-µÇFbk!zØz I}gv(YI…®·( Ú÷ÎÎÌ·ßÌÒ"âð'¢Ì0®|ä2ÁT–EÃi‡GÂÈ/QÎà‘fÜúiÐùág“E‚3Ï}4ø#LŒ.ãã7Gçƒ×Iª”Š=KRç²øl@ínïÝÑÉÕ/οë'Wƒ·×ƒ©fÚ*”qÛ¹¼âÑŽñ¶Ã™òYô êœ ï£iGÅŒVe{Òéw~ÝîBc:¢U5š¤›©ðÌKS¯mŠÚ¿ÕWB·€³«¯gŠ%"öIj OûG uqïJ3jö‹á¢XÕh+™jï×GLJsïhWlŽÆ]ËúS)š$eL;µ•$L¤Ùœ|Z|^-rªŽòU^#I&m£Rà”¶:ÉNKh’±ç³eñåRô (δ¬Å Mà‡ôÛ œ@-â’ûò5g–;ÚbwÏ`#~زœ¬™b¡ãõ DÀØ2‹‡ë)  *«b´/LÄRJf„ýÿªf^¼ö¢Ú󫜑1Q2•†®Ãr øõÖÌhþ™sN{q®ô½Í_áæ%i.Q5´‡‰tñuÙY`/ ,V0øŠ.×Ã!vaÕ’&‡:é¦VH0ÕžYï äÌYß̾^g­¢à{áîx‚úÜÑïC£Fcߊùa U8“ßñÏ{§ûR¥‚¬©ÄÞáÄE1[›´„þÃrßäw+²m3æÅ×@¡P7ŸŒ‡_L×ù A4)p«¥¼²3Ž\ÀX½ïV2îà~ìÒ˜ÄhéÚºýaÿÅÿíüÏ—äÒt‡J&s¢ŸöÉ‘ !8 -úï‚9 ”6yÏ Ï'þ+챘/¡WkÁ𱦩eÍ{§(Ž‡ùªØ¡»ÂDŽ¤¡e#‘ôÜ!Îsí8OìqÞiIáðûq}SæùŸºx þ“}H³w®‚²5®:›¯Âmû1÷‹G‹‘¦û¢Œ„$Û·£R®‡c9|¢b¶ZŒ1)ãÀYXfñ"1Ÿn°4ôNá k`ëÐø¦PosŽªL“m_¾¤r¶®è&¼eÖØW9ü¹EÓCüaàIHv,\6"?{ˆü²vä'^bÞSr]a`’Á¯Â&Ž%Ÿ!}Œb!G­¥)˜±º¯¤S Þ -#‡PæÉáæìÛÐyæCÒü¸§Ûï‰âqï¤ûý¾¥i¿»œßQpÙÍûé³Æ|šËXÕ‡É'„Î2E‚ï¹PøîAl\n³¨ËÍŸâeô_1 -NΧ!NQ(¿³ÊŽE2²ˆW¥­Zå  r9[SŒÙdñEd¿1‡a$Aéã1*RL¨zÿ Žæáþ ŠxÇMRÊ­›°°Û¥úÆ!! È'!á’R…7Nܾ°sBÎùG\²¢oØ5º=h½«0‘ËҽÜèTM$´d^ºçeÄ+Jƒ5—ÛlóÁ'Ux¥»¬¾¿2ºS5¶ÇNÈAE\ÍF´2,ó(»ùzÿ®Òð:OT 5_ -[A1¦e²ÆúkfºÚý–1½)_Ð8)ƒs+ ãD8]I=À0_Ê·Ce gfL=¼Fw&ñßc•®|娵‚Î* /Ì÷íú7¢{óendstream +xÚÕYmoãÆþ®_¡o¥Šr³¯\² 8>_âÀ–ï,9_ÒÀÐI´MT"‘òåZä¿wfg)Q")9½"A|ði_fgfgžY 9üÃØ0®’¡Sq<œ¯|ø;ß„§=IØ ùf:øâm»œ%<Nv| ÓF §‹ƒóïÎÞM/nG¡R*ÊQhmŒ§´ðææúìrLãÛw癌~š~?¸˜nån9‚Œ…þ<øñ'>\€‚ß8SI<ücÎl¯ •­ü|9˜ ÞoYÑžÒ©®;Ö¡HX"Íq;D‚éHmí ›vB2%äÐÎ ×ΰ«ÙHšÉQh nÓ¦Ïpyy™ö]]Ç`pÕ¥Œ, ‹DUd§º‚G,61è+#¸“8¡¯'B})Ü\¾ùë¡^B‘ˆ‡ Žm±ž¦%V˜¦X1æØMFY£PÚ`> +E°ù +i>’qP¥ ‚ËÜø'Êí­i¬ 4E[žzÝRß[Ä +Å”'¬¶#:b5Oäà~{²ß N“¶áV69.ÙÓ´$.aÜî ü€Ìõ Þº¶Æ|í ‘€I’ ÊfËž¡Öùî,ª€:#ƒÓB‰ãj¶z¦éì™P‹ÇfëuPÞ)Îo)-fèËb§C‹|ñVE«„€‹¦Vœñغ»dðB¤ïþ2[f‹û h +3 ÀP¡À‡š8âÿ¸5a™ˆåÞÆÝåx*"|^ðØq é£ü˜Uó'ƒ€MJÃ,_dóY•å4¿›\ÜÞ_ŽßÞøSÕz3¯6ëÔÝch˜•vOâ2â¼ÈçëbOîs‘åI7©ŠãRšw5t£}J4 +–Åc‘×wx(Ö+¸,xÒ2¯¶‰‚ø#çØÓílS=묂£/Þë´|ÆÈô%Mùý.ˆg¾î³Ná¹³ÌÛbÝv3Ÿ§eéx„R:T4nük‡ÃÓe™þ/8èP¦…x@×Eí¦ZqšåÅ¡žÁZ›Uºx 8ø/~¼U·£n åÅkÀXÛ?ùãÜüËyãN‘Þç2½ŸLϦw“ûñÍýäîü»{¼k»Ýëמd¨!p˜XÍÌ šmÌ,ADíb¶J")»—™ åå«ÉÈ“³k\a{,\²éÖK%Ú±=¦WƒÆé¥LG.QR¢–N¯qQ¹0üwÒëy=22@Í>,A£Oƒ . ö>5Wê-‚ëC¥¶ ’DÍùd 9E›Î +*ô¬Â¯öU¤Œ›hï*€Û‘Œ‚R° ú;øŽŒË3šË +i#>Ö3—wR¤Xø«ÎòÑÌèÄ|ƒÌˆQ^-?³M5,Í7!L¨˜YWÛíP¶‚Äßå–PÌÎÌÅš¦sÜvœ˜ÕŒõ’øt”èPã:ààj{Öc‡(Kâ“å.µ±>DiÍŽW [ŠþÊR2‹l²r&êúóçMZV}ò•€ l?·ìT –'§ÔôD¨&>ºÃº \§¢hØàu +ÁQ7~kN'ÔÒ.òjc=ÜÒ-J˜TqS·¶1»Äpru3í`f±’T5³^Ð’Øz|ÑÅr­¯f1E“£B78øÖý?ˆ™ã…iƒ¦¿0QÌâ8:,L5÷+rw¹,ªaœqCÊKZ¢B*wgN às¬äðÃ׶ÏD…oWWŽrY"{’ … ‚ò΋†°'$ÄV¹ +¬Í•°îž!n–OÅ/húÁ—¢È²„Âuô˜TÚÅ1ÉŸ9öi…kI0N«o.o'DãäÍVþêWÒð7.Þß]Lp0=ôœâà ð0†)e?«`¯y… fm+ŽeQ²•è|ì› ÐÔV4O(¦=¿ò_ê4ÆLÇõó’¼ã<¾c@Qü£‡C-}žïç”|z`I—Z–„ê”ý_,Yó:nIA(†ÕgI‚‚ÜøUGÒ2èrŒŠÃÖb,\4òo‰² ôšO³ŠÉg}ÏVtõ_<R3ÍÇãM«ŸÆšm<Æ’Í· ï]Iן¨Ï~(FŠÒ&LÞ¹œÞ§p:ñ ýŽ¤?ª% mÜŠiQ ñÔ=M¼¤ëMLá¡©àêzŒ{…þ•æÛeÉ+œÓ4sŸÒœJS×bå€!7gu Œò Jr=î×Úmõ±Çì%Í;"”“yàm|. 㨷Ø*é2'ü÷ÏúÛËîË%~Ò]„ U«Õ^¼á‡êB}à 4 -}ÿ ÃB }endstream endobj -1562 0 obj << +1713 0 obj << /Type /Page -/Contents 1563 0 R -/Resources 1561 0 R +/Contents 1714 0 R +/Resources 1712 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1525 0 R +/Parent 1711 0 R >> endobj -1564 0 obj << -/D [1562 0 R /XYZ 85.039 781.388 null] +1715 0 obj << +/D [1713 0 R /XYZ 85.039 781.388 null] >> endobj -502 0 obj << -/D [1562 0 R /XYZ 85.039 761.463 null] +606 0 obj << +/D [1713 0 R /XYZ 85.039 761.463 null] >> endobj -1565 0 obj << -/D [1562 0 R /XYZ 85.039 741.134 null] +1716 0 obj << +/D [1713 0 R /XYZ 85.039 741.337 null] >> endobj -506 0 obj << -/D [1562 0 R /XYZ 85.039 741.134 null] +610 0 obj << +/D [1713 0 R /XYZ 85.039 410.584 null] >> endobj -1566 0 obj << -/D [1562 0 R /XYZ 85.039 720.743 null] +1717 0 obj << +/D [1713 0 R /XYZ 85.039 387.267 null] >> endobj -510 0 obj << -/D [1562 0 R /XYZ 85.039 694.05 null] +614 0 obj << +/D [1713 0 R /XYZ 85.039 344.5 null] >> endobj -1567 0 obj << -/D [1562 0 R /XYZ 85.039 671.334 null] +1718 0 obj << +/D [1713 0 R /XYZ 85.039 324.512 null] >> endobj -514 0 obj << -/D [1562 0 R /XYZ 85.039 517.119 null] +618 0 obj << +/D [1713 0 R /XYZ 85.039 294.83 null] >> endobj -1568 0 obj << -/D [1562 0 R /XYZ 85.039 496.126 null] +1719 0 obj << +/D [1713 0 R /XYZ 85.039 272.114 null] >> endobj -518 0 obj << -/D [1562 0 R /XYZ 85.039 496.126 null] +622 0 obj << +/D [1713 0 R /XYZ 85.039 211.171 null] >> endobj -1569 0 obj << -/D [1562 0 R /XYZ 85.039 473.41 null] +1720 0 obj << +/D [1713 0 R /XYZ 85.039 178.849 null] >> endobj -522 0 obj << -/D [1562 0 R /XYZ 85.039 432.64 null] +626 0 obj << +/D [1713 0 R /XYZ 85.039 124.401 null] >> endobj -1570 0 obj << -/D [1562 0 R /XYZ 85.039 412.046 null] +1721 0 obj << +/D [1713 0 R /XYZ 85.039 103.205 null] >> endobj -526 0 obj << -/D [1562 0 R /XYZ 85.039 347.893 null] +1712 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R /F35 948 0 R /F14 969 0 R /F11 976 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1571 0 obj << -/D [1562 0 R /XYZ 85.039 324.575 null] +1724 0 obj << +/Length 2341 +/Filter /FlateDecode +>> +stream +xÚÅZËrÛ8Ýë+´ UÕÂ/>zÓåIzfÒ{[½JgÁHŠ­Š-:¢”túëûâE‚xA;‹®T$š<â¹÷¼8Hç)ü£óB’”—ó¼ „Å|ý0Kç·på¿3jK Yz˜¯fÿúOWSR¦å|õ©»$Bòùjó>yù¿‹·«_¯KÎyÈÅ2Ï‹äjeN¼úÿåÅë+s|ýö勛ŇÕo³_W-o{Gà(é—Ùûé|þ6K /‹ù78N …Ë3`%Rpû÷ýìfö®½•¹&ææW¡bIKR2‰ëQ"2ÞêÀ|(e„S6ÏeJd*´pU’M(¡‹¥”ir½ýrÚ6DZŒE:óP Œ’‚BLEÀ‚QÒ4#…, L–A*4¦©0 1B‹ÐdE³alT2RÒbîÝõœÚbΨ©ô©3FR8ô©Ó?Ó4ÍMgXª/‘¼;A4[;›kŸêƒ9xû +N¾< ÒæžSNxN#út D RAÞ¬®Ï¹ ™ÈpB‹9#ì«"8ÉyÖ#|¨Ö –'w;Èu¿5²ìá¸zP²lDzÏÊ’,Ò;<ÐxöÉ%tÙ ƒÙû„‡m£Ò|\,AƒzßXªÝ}s_G³/2Ârɾ!Ù[ÐàÙ(ÞŸ?)É2ŠS[Ìu_™ +g|ê¦Ç?Va³SàÖHq„ÃÚ²åÇ+’ïÇ­AW÷»Û½9ü¶;Þ™£æXŽæ°þd¾šdTÎœ‘œ‰ˆœ‘Ó‚´œW¯CýIJÂ$Ã9-æŒsPcá0øœÏ}šdIh.#t D ô'ÎÆj-Jíjí:Xk}ê«ÕWÕUÚÒªŸ²]½@H’±˜À‚&6(u+À€:,€Gýæòju¬?kƳæðÃ<‹dݬ-hzÖu›õ€:œµGýæ’¥£Y[ç‘QHŒRÔýx$ç”–±ûaÎý4 ]×95u}$˜ü’ ?jƒd^’,/ñxhrywo£!u°|jmƒ.z6èº7 +6¦TiÀÑ–þwîi{8sHpúÕ¨C’ 4¬ŒH×é,(âPB熄AàÆjºVâT¦;;žNLS×U£DGÅ‚•ED«ƒHe0“ýÆëìÄ€7è&<ÞÖLH^£ñå‘Ò‚âfåtfbÈ4>ç3Í„d0=.b«!XÐ0ÎV€gXsSCkÛNaOšRRòˆ#÷@HÒ4ÙA¡Ôm™P‡Ë´G=ê ÚrãN*Utߨó}p“ÚµþÜ™mÌ/ž-è‹.íúNG¬@‰rtÅ SØ+ì@“B”Ú)<¤*ìS÷-Z+kHSË +ºëZÅ ªžNú2IÉB‚G¦;QÒ‚¦+‰Q·J¨ÃJzÔ}Û×)Ù!ÛÞ¹]ë³#Ý$t=³ ªh›€º µ‘¦Õž0){JåÚiÏFZys¡Â¸„Ȳ,ySßÖcžV­ì±2ǃé0:.C ÊÍrSê£êçü¶T£ÁÝN²Hö¦ƒÂ‘¾ É’mó¸Ô-d¨«Jt™'u~«>ÖíÑÆ|äÇïyü¦HkóÇ •/tá… +¥œð¥:ȽAô’Q«³Ò^an´¾ÓO•²Z›¼tUÓÃ8˜l‘~ l‘ò,}ÊÕ’.M¾n ÔÀŸÀ[\?ÀpRÃêÏÛî´îª'²LºçSö5Ò]Ìô5uÑgÿ8Þé‘4Zhu¤ú¯¹T7öÔíî«™æ¨çVg¯ãÆ7º–Ñ÷êšH‘ë•Y“zà‡ƒ†?5ÛƒQqoJ“‰Ùo|Ÿ.š©ÔÍÉ›ÎÛÎPèΠt8=Tïíº§“Æv®<©ŒF¦c˜&. ²Gé@“ëµw×ñz=¤ÖkŸZM)ëMo ˜‹Ks*Xé\¢œDðˆ»ô@ˆ4] Œºc@ãî8Fu}Ú/X™Œ.s*tÄUè@ˆ +÷Ø(§óØCΠÇö9Ÿ9Éà)%<æa<"€Mãlp†ð8myUS d~ÁŠœäEdÒçë@‘µ ”Эe ƒk>á3÷;X.ã±ì;’½Mž]¡Ôî¡RzŸºº¿¯•ýüÖºùê#sï\ÿZ{Ôú¤G9VŒ–¥$+"K¸QÆ‚¦+ƒQ·Ê ¨ÃÊxÔþœ[ +¯_IšÝ_ã¸7ÊóˆÁ‚T$ë»jÁÕädx¯¬Äns.%¼wo|Ÿ“,¸y¿twŠ„)É=>f£*ç_áb™C+Hëc1gÄý–ÊaÀJ‹±]f;o°Ÿú+ffåàL;–K¨ò)Ú©Ý zî^x ’ÈI@·òæˆnI° šÆ¶»qðÊEd­Ô!ÝÍ‚&¯–¢Ôn¹tH\/õ©mKþò‹bWŸBÈD-"Wµ„ºÛßú«ñ<Âô·PŽZí”ãvE¬·¢ +î¼þp¬Æœ+¤é),ÑC> neIX;°T;h¼:Ò4½öaÔmíP‡kŸGýÔ]Kߢˆ Ð,h²F©[Ôa<êI»–´„ÛGœ_‡ÏÙb&§ŒñºŒ¼Á„=Þ)û•4ÏI–ãoky$_0Ÿ”eƒ9êÓö+MòG÷+©Hõ{lx¼ô„ù™ûÞBi"ZOV9²_ÙºXWo&Md)_{è„b(>ƒA9Ý fÈœÁøœÏœÂQ:ºðá Ð,h‚g+À€3,€Ç9˜ÂilWÑ¿>|nŽÕ±Ý=9ªâ~jìÎb¥½¾™ò#N_½5VF¦@f\,‹‰k…:©„A¥<Â'l¨ü82¯é0ãéZÌä‘ãu5dÀ,!ïS‡uõ>W™Ç^|uì½WyÂk¯ã¼Ý[¯=Þ‘—^[ÞIº, XòÈÖi‹AvN fúû-o»oÚç o›v¼Stž’ð;"ðß,ÂÿÐ{à݆'Řû”LacQ‘ŸotI^À ŸÇû7üQendstream +endobj +1723 0 obj << +/Type /Page +/Contents 1724 0 R +/Resources 1722 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1711 0 R >> endobj -530 0 obj << -/D [1562 0 R /XYZ 85.039 295.965 null] +1725 0 obj << +/D [1723 0 R /XYZ 85.039 781.388 null] >> endobj -1572 0 obj << -/D [1562 0 R /XYZ 85.039 275.37 null] +630 0 obj << +/D [1723 0 R /XYZ 85.039 761.463 null] +>> endobj +1726 0 obj << +/D [1723 0 R /XYZ 85.039 741.337 null] +>> endobj +634 0 obj << +/D [1723 0 R /XYZ 85.039 616.811 null] +>> endobj +1727 0 obj << +/D [1723 0 R /XYZ 85.039 594.095 null] +>> endobj +638 0 obj << +/D [1723 0 R /XYZ 85.039 466.842 null] +>> endobj +1728 0 obj << +/D [1723 0 R /XYZ 85.039 446.251 null] +>> endobj +642 0 obj << +/D [1723 0 R /XYZ 85.039 376.993 null] +>> endobj +1729 0 obj << +/D [1723 0 R /XYZ 85.039 356.398 null] +>> endobj +646 0 obj << +/D [1723 0 R /XYZ 85.039 177.675 null] +>> endobj +1730 0 obj << +/D [1723 0 R /XYZ 85.039 154.959 null] >> endobj -1561 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F36 892 0 R >> +1722 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R /F14 969 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1575 0 obj << -/Length 1193 +1733 0 obj << +/Length 2317 /Filter /FlateDecode >> stream -xÚíZÝsÚFç¯Ð[¥Nu½oéúÒqƒÓ8ã`H_?È 7LØ µ“ÿ¾{·$a&ŠCé0žén¥ÝýíÇí.f…?æÅŠPa¼(fDı7Ê:Ôû v~ï°’‚z’P­ìÖoÃÎϯUì1J 5ÞðÞ‘ Ç7þ«7g×Ãó~ -!|C‚0Šb¿7ÄûîÕ»³‹^÷¯_ý0n‡o;çà ¡$R Ëã±ssK½1ˆñ¶C‰0±÷\SÂŒñ²ŽT‚()ÊûigÐùcýÜ“>U£I¸¢™!†«zmC«2k}9­Ñ×Aæ3Fx*Eý~º„ûP’ùóÙ2­Q‘ÆY­\ŠHR J$7uH@wËÔ½ -Bæ¿ÛæÌcq|v7¶‚èZ\ÝúnÖýó׶àP¢”y[C¨aïdªæãy–Lfè5 À6µÚݯ.Ö+3¸ًԒʧ%ƒÇ` XX"Á–ˆ¡Žº!çD1õÕÀ¿¿=Ëb(ø6I‰¦Q3ÏÁ0 @‰d5+-÷³,DƒmÝÎnR'C¾˜€;Œ?PE§ ÒÄᚧc´RrˆGþ<€¿í#)² -ê¤D]5ê‚úWÝ·ÙñÂzÌxî¼gTd¥ö+%ï¬->P&œK-p±tµIÀü’zQQ[Â;9ÛQ:Ûsëà¢ËofEÅ"ŠAÍ 3OgùÂjn= ²i‚0ÁêÝmÖZcߢ-7Sý8]t7lo3ú<Ã…~úX¤è?!ýÞ®A*¾²ªÚ;Ç)$Ÿ I8jÁÙ â -¹"ŠJ÷ÚEš —1ÝÓßâÝd6¶ FIŽ‡9®:~ÅêÄáÖ²ô’(¨=BÀ>Ò¦©ÌÄÈø Ë2(üT]™Wy—ƒ3CGþ¥uI¬õ>¸ÖK²j„¸²OpÙ$C ø¯EºüÞzP,q’mL2žPYàÂ"ÆÏK¬^¨Í칆çd€æOê-VÎ#þ ÈÌÕnä|¾Bß‚]šbŠõžíñ?¹ÂÖŠTÚÐf‡šæ‚Æ o힣I \P€%*É \Tñöú7Œ<ÖZr€V>ç+”Bü²ã¸dŠÓµiyšæ‹Um·ž¼Yø’|4ìò6Šz÷T1‚Ž ýµ‚%T1 "Ñ–VÆðæ±mÌù¾¥Õilëƶ üñOnOEÅ7lÝã²u·ÛÏOÔŽ³ù63Ü“Û¡Û2ÛZ«wÝ9^3âú4Îm9Îåú;sOÑy¸™.ãPÄE ¿Ý3ûû¾iùo’í8­_Ö ¥4•Q%ÐlÅпa¶!ëendstream +xÚ½ZMsÛ8½ûWè¶ÔÖ + €ø 粕I<OÕ8YY›K’#Ñ–ªdÉiÇ™_?/ P‰U[©”)ò±û¡Ñh<$ ÿÈ$ã§ùDf¥Y6YÞ_àÉ<ùý‚XÄÌBfæ×ÅÅ¿ð£ç“Åmk‡#ÆÓÉbõ1yýöÕûÅå|:KÓ4ät&e–\/Ì7ïþ|uum®çï_ÿãfúyñÇÅå¢ñÛX¹rúõâãgbÉ-üÞLÕëMe®6@ʤü—A)Ê«r7¥YRoÔ+ß7ÊÐyZ¯QuýõÑ98|7¶Šƒ»óËqs (ãÙDâ‰@{fæšþé7Ø‚Tƒ¯µÓÚtɺ^Sˆú¡4q¹{¼ï1Ê!Ñegd1=F. ˜!.;„ð3¾ …@äaÁã!ð@á8ÐpÊÃSy0íÿ½´Éyµ»Ýó¢„ ™Ê(/‡éñê‚b”Ѭà ?È}…!^°D‚rÎ;1*b´¦R˜±z­£`[~c3Bß3QÊ +GÍZ’k1š^:4,ˆBrè.Ú×Úû/S¨V,©Ö0^8Õl˜L¶åS¹U—")v+s¯ú¶©—ksýTlí€S¿Ô0Ý™Kmt]šWÁ"`ªõg¿«,ºãèÁbÀÂã}ñeûݼY¯íóª¸oý•u²ÞWº†A fD•Ú\·i£Hð̾ ÖxøúXV5Òïظø/v‚‘'ËÍm¥_-(ªŸkcìæ¸ÒÆ–õfo]q¸KÌ¥"Z(3ª \&_tË̳ý­¹·U¡ºßÔÚÌÊ<+ªJÝ­jýònÙ¼&“µ:º(”˜ "D<;ZLxó&4ƺɋlúÎKÁžeˆÒtˆ%(#¹´0ËÑxáÄ0ŽÐ´ ESO~ï®Þü³WÞ Ós’M<‹}·ÓsÛÒ8”¸ôÝšIj¿1Si§1•õÞ\W¶æ)€{¾ƒ¹XÝþN™@=æ (‹S ŠÄÉ‚áÿ]_Ý,æ´ç¤å4îÔbzN»Q’*wÒŽÓÊLÇý„šžÂ”%Ò‘¦· HÓ-H7ý +ÒXßEö±çd•€Nº¶˜žë^š¸ã»þ mΕ悺°Zé"ygné4¿wÍ< ?TAÝ)ÔRÝÄme‹_N¡>ñh6S¨/Sš'ßk )¶ð|s·Ó’0P°U½Î±­ˆ91‰YëS×%ÿùÍŸ`âW]'¡ëho]'Íô¹.‹Uy@Á„ðs1"§‡2Së¶ÀœÔ¢EaA'Uû¨[WíÝV{ßípµ7•žº%ÉÛWóËže`!£>§øŠ +§^oÎœ­8wÊ2$a¤úܯ®S¬ßõØIè„”‡µ5ÂÔ3t}‡]o¤TÂÏCËÚ£•Ch³­×‹y0±%h~"G»EÛ‚”Û·j˜ $áôõÝŽÅC GÃY!Çi—œJ!5îzÜ2Šåçàf-pSýéùL ’C©cg!e-‚Å%g]RéCIŽ2XºÇÒÇazVµÊeÇŸ7Kmvz_ÅT&;û§4Áæ†ÝH9lÚ½˜Pšó ¥"IóIs :}"‹¹n&²#×Ùçú¡Ù ºmö‰¦jKfew¯îÏzu¦&ºG}¡£¶-wwõº•øøž}Â$U¯˜¿æ‘Gêå" ,—ƒD”ñmA‰.ÍA›¥GK6ê–lU³ã§Wß2T"–Ò—®Ýæ*1ãt æô\hlFR¡ëw8Z¿?*é@V#FI¼í(Üx:¹õQ×®ùÇ®Ûï»þYI—Ê ÊÓX ZP$t’¤‹ºu’îØí ¤óݾLÒyî^.é¢Ü¤ó¹Iº³°s’.ÎÎJ:Ÿ]PÒ…–“t#´Œ¤óiE$]*8JéHuó@‘Ķ “$gñ¥’.NÎJ:ŸÜ˜¤;7'éâܬ¤ó¹%ÝH9I'e%O*"ébéÓHºc‡C’Î÷’tJìÕ&ÐÖr­VNϬŒÖÛÜz;ê€ÌZ2‡iêÄÅœ´© ÀÖ½=“S†÷»Ù_fïrïŒI–Û!£¨eýx°ûþ`ÃJÌ™#­hm–EÝžùYJnƒkiUY/ Nò¨Fò0á3™:»êd5:“éQyçWCÇTŽ¤µ%ÙbÂ'34W9 ‡#ÜQ —¦£üóöt~<éé[ <é@d ]4#ˆÇcßB‘J‡¢{FO;Q "C˜‘—ªR +Ë1štÂN¹g/¼S~ìtp§Üwú£;åòl”·˜Hà ædEóëé‘ßA=êù ÈQHz õpJ"‘ñU”‡‰„3â(MlE14-g/ÍW’J¤#:ÃNî7Ïj¸ãŽ]öœïúgºÎ5”‰p6’Â( :i5uëVÇnW¾ÛñÕÄå|JI>\Âu_I€ŽSŸy~^![[ñFPЄ™ºã5"¸¬%—AbŸ…µ5ÂT!:잘õ­U:rêä"©dAZ¿_Î?\ö× \jÉí™ûiñn,0f¸ùÌÂâ=Ó’û ܬ¥n ¦©ç/ÐMÞ ]Z:Ù`z»yB*…2í;š9õ)©Ó¹F1·rYPf7ý©Ü축kÈÖC#˜§Íwl;-ÇõYì_ͬ¾:ÊùÿW2C¥ ü7ߺ¼è³Çvk2EY7œJ$$³\T«yoZ‚x »Ç÷oøLùëendstream endobj -1574 0 obj << +1732 0 obj << /Type /Page -/Contents 1575 0 R -/Resources 1573 0 R +/Contents 1733 0 R +/Resources 1731 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1581 0 R +/Parent 1711 0 R >> endobj -1576 0 obj << -/D [1574 0 R /XYZ 85.039 781.388 null] +1734 0 obj << +/D [1732 0 R /XYZ 85.039 781.388 null] >> endobj -534 0 obj << -/D [1574 0 R /XYZ 85.039 761.463 null] +650 0 obj << +/D [1732 0 R /XYZ 85.039 761.463 null] >> endobj -1577 0 obj << -/D [1574 0 R /XYZ 85.039 741.337 null] +1735 0 obj << +/D [1732 0 R /XYZ 85.039 736.911 null] >> endobj -538 0 obj << -/D [1574 0 R /XYZ 85.039 564.607 null] +654 0 obj << +/D [1732 0 R /XYZ 85.039 680.8 null] >> endobj -1578 0 obj << -/D [1574 0 R /XYZ 85.039 541.289 null] +1736 0 obj << +/D [1732 0 R /XYZ 85.039 659.806 null] >> endobj -542 0 obj << -/D [1574 0 R /XYZ 85.039 512.678 null] +658 0 obj << +/D [1732 0 R /XYZ 85.039 601.166 null] >> endobj -1579 0 obj << -/D [1574 0 R /XYZ 85.039 492.084 null] +1737 0 obj << +/D [1732 0 R /XYZ 85.039 581.178 null] >> endobj -546 0 obj << -/D [1574 0 R /XYZ 85.039 315.615 null] +662 0 obj << +/D [1732 0 R /XYZ 85.039 440.375 null] >> endobj -1580 0 obj << -/D [1574 0 R /XYZ 85.039 295.626 null] +1738 0 obj << +/D [1732 0 R /XYZ 85.039 420.387 null] >> endobj -1573 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F36 892 0 R >> +666 0 obj << +/D [1732 0 R /XYZ 85.039 333.519 null] +>> endobj +1739 0 obj << +/D [1732 0 R /XYZ 85.039 312.526 null] +>> endobj +670 0 obj << +/D [1732 0 R /XYZ 85.039 281.59 null] +>> endobj +1740 0 obj << +/D [1732 0 R /XYZ 85.039 260.996 null] +>> endobj +674 0 obj << +/D [1732 0 R /XYZ 85.039 217.765 null] +>> endobj +1741 0 obj << +/D [1732 0 R /XYZ 85.039 195.049 null] +>> endobj +1731 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1584 0 obj << -/Length 1995 +1744 0 obj << +/Length 2243 /Filter /FlateDecode >> stream -xÚÕYYsÛF~ç¯`eSep+c.û¦ÈN¢¬Fd’­rüƒˆ -ÈÆÿ~»§g@ˆeÅ´W›ÒçhÌtÝÓ—ø؇?>Ž4óe<#ÎdÓ»‘?¾…ïGÜRøcÅü@ãÖ·‹ÑËït4æ>‹ýx¼¸1$‹åïô‡“Ùâõõd*¥ôb6™†aä].hþêêâäì’Æ׳ÓóÉÛţ׋ÎSÅT ñŽ÷£7oýñØøqä3Gã-Œ}Æãx|7RZ2­¤¯GóÑOí)´§ÆôÕ€$SG1å1‹…–vŠÒ鸕WÀ²bR]yc¦&S­}ïòõâüêû«É”{(azÕ=ür/¥Ùb ¯J -$¨'ÜKÒ†6.“»lIÃYôU6`a|€UÁ™DË*תY¬2„^yuö~“©•7¤`(/‹š&MòûDDÀp[ÐRiàq•×ôñ=LràX„ž=.©² ñ.Ù0ÎÀyÄcìi¦´¢­Ãb5É;`b×++ñ‘–E1á$‘Ìr_Úßm"éÙìôkZ­‘w@ -ÚûÍ×þ.¾mRÜ,ñÐÿÀ*gôɦ¶”+£pîU0øpß8–DŒp%æ’z;ÌJ$[Öl0À“‰P½†ú"¸e‘¤h$ fºÍ›U³¬–F_!ó/¿ƒ·¸»ƒð.µ°7" É6ìˆ(fg38úõÀI"`‚?ý z…pÖÕåW  ¥”7o Ê–Û†Årµ¶‹FãÅÍÈhë#úø2vœ£íÜ:.w#£–3Ãk‚tËuöMÇd³Â˜pÆ?wv×Ñ¥ÑVk†³Þ«ýa'¾ñMÒ8ÀìƒñÿTÒ÷ŸÇR[fN×9˜-8&+×iû^×문͜Ê-Ò;G$Nèãkt{u•ÓU²nunзڧC`L'ÛCméÖ7V9éÐZ§›uÒììgN2×­ üwöaÉ®˜-Ûˇ.á|~Bƒ“ñú4V½“ NWb‡Öº{í³¢õòD#«òtÙ»BsËcÇäª ö#v†ÃêûÒ~¥ß݃´Ÿž&C7ÔÎèòOÄ):Œ“~&œN.ìzyëÌÓ„ 3ñ´½nìíó¬"„vè“ãäÿ¯Š (õ @AD§öw3¥²ÞÅgÈ%Êà þ¬’Êqox„d<`²‰$žó*ÃÐØ&y6#EÊÊ%,¹Ígï]¸û†¨ÐŒ–6”f‡ÂïûM £Õ¥em9 鹡¶˜öùS=tÈçB1píîŨej…€<'º^ŠÍ… - ‡Õ3?æS‹ÿ§¯zBq©™„üë{økRá›5ïˉÄtRaé{%Nª¥£jPò¾”Òó Ž“2èK©‹ÿŒRšç -ƒs´Fpm=I¢ˆq!ŽDôñ À -¾˜ èzú²Ã>?,ËD‘¢`‰®?Ÿ(ìh$z‚Å‘>N7=Âiùùp¶D³Ó²hªrÝ%ŽY$Õq¢dÚˆL£dÊCæKq¨a¡\`WÎbˆ& áÔ5Ùy»¬us %›6þ‡7Ø‘Bâ$bFd0 çei| ¸Ò©Ò±·.'€WG^íü”]­‹«MR55m] £fk:Düb¨Ž=¹*–(0å'î¿ ƒRB šhAÍ"Ž‰Å9¸41™ LˆúÍý=J@LG5it®™ Ÿ±d*ÂŽ<+ýÒ5ÆȬhº·D6fÃà.IWyaâ)BTººªKƒ¡€$|º[Åû—¡òÌ?S†J8oðò„’&XS`ü`-Iq‘É-Šˆt÷$b½…x¯Mñ‚««ÄµØ €À ŠíY· Û¶àü 𶫱ÆaãXH±¸™jg|ÄVí~ñãMfî4Ç‹v ¼Iµ]‘-b@(b"¹£¯dèåM¡µßÐ>öÖåÖˆ -»©±ÇxfûOAlX6ÒÛs)¢”–}Z}Gš[³p›ÆšdB„îÃëÍÛĉ‹ÙH8k™¨Éê«ÎW¶‘3š¬}Íoó–5ÉcDÚ ,…oò54(HÔ7(û+“ㆉˆ‰Ú¦Î‹[ú´1 -ÎL:‰'õEÃCÍŠæ½uY"Ð~(7öŒ²¥â^òÁÒ,3w ÎZ`Í«7ÌZ®kr@ÓädñÄY6€Hû^Î/þAÓ“…gµÿÚh²óGÖœqhås>Ë=²”¾óŒ ¯‹i|c:ôhXr~œYOîøŸÆLg¨ Oño*  -?=@þ‚éãÕÙ«îß- üc’Å鉔¦r0U(:´;j¸™Ò!³ÕÚ;Üpe™+G±âU’Ž uÕ‹«*f\Ÿxþ|y6_\÷òAaç˜T`½«ÊëÕ$Ê^äiiÄ]î*'jµá'øb÷%0é¿äé^ÏÑE+nÛ05‰/''¸IS !¦o¢ž¥û,Ðâˆ6Ø[+ëá6EŠ 4îzepÀ8<:L=æ`ÄŒp¦nÿ;Vuö žæ£êè?lm¥øߢN£›’ ¡ÃnO¤ÊšM5iÿgç“î¦4ËM?OM;Ý6Lìu×gKi«>¨W%ÂÃÆ´ãþy« „•ª "¦ý^‡höJÑÿ¦íÕendstream +xÚµYYoã8~÷¯ðÃ`[ÆØ\‘ºè2NæJ¶'ë¸1™„Ñ"Ú^ųä‚0-ÅIÂt=¡Û®&Võ^ÓP…é1³¥d„úJù†(!œ.Tºð(„0>}¢¯–%“a|‚C©7¾QÒ7öP èØY6TÑ=êo÷ŠÄoí­(Ç oõM}T1Ò1ÄoGr\§h!ƒ‡|³wbˆ>† •ÓQ:â‰q(|Ö¬j‹¨€>䱶åTfÁ^ÿ\Э5R¦î‰hâàj"•«6kû3ÿÝ ü·¼^Þ-T~ÕÆê*Á¨‚¦ðÔ4=<ÝÓ±¸qÏð öÖȳ퓙PÊàå;´^uY•Fì@韒t®éCs¾‘%ù®ÚSû.¦¹·´¡Ô¡ +T¸m¯Œ¬>*ˆ÷Q‡ÅLX¼sX@{#¦s ž›6]‹hÜt5òûúx@G`9ÚÍ— gž€ ÓÆ izÎ2Í ët0<ŽLËÇ?dRaÛ&½™ÂøJSÏXšÓI»Ö¨¤ÑQBQß|‰_0@]0hÏ£ÙWªø’˜ºÚŽÐúOS’Ÿ%z÷zÛæ`{ÔR®Ë\Ï¿`©Ñ„¥4‘º–ILN6\¹p„ÛÈ$sMÓcÞ5‘q7°;Ì›bðÑcÌÃsâ=-Oƒ&cî“rû&©¨FÅómp¬”.!¿†ô‰@ž„ +v ‹cº„û%Á]žˆ&t©‰PœmzH4øá*¢¸kO3×4=ægu†«bX›¹=T{FGºbBˆ¢”£z|î\:b Í„VˆF°íº–}mÀªé°2ˆäœeWP˜Y®ßféã]Êi©{êР·¦:bª¢)u†lüôkyËz9&ç0ë†Ü:T ÅF%ýåF~\¬lî +·uyÃ^”¥1ˆ5å3Å]ÝÊKb]³-“:…·`ÃÉ»¯CÝ 5ÒôóA‹füùÀ[®×y>ô|p_*r¸E6†C/ŸÄq¢Q8,wà(Ùž !]?a­¾ƒë›#@ÙÉ_k°Ær©œgv²ÝÃê»5‘ѱÃi¸ »I£çþA½añäˆVÂŽL¤Ti;/xwÃÆ­¤ï'ú¨8uÿÛcÀwtØ‚® +ZË«XEU8üky^A5p\‚óQ‹u¶o³!ÛK[‚žôqEÏOiVÉr3¨”še£.i*㤬p¦Á5ìœsf„‚þ±ÇGŽó‘m>ç€Z<™é“…Å +ÌçÆŸUÈê~}Ð6„ׯwíAŠiËÕ(fÍ[ý®—eD;PÀhXUISØW4¦o¹Å&ú0æ>›èÛíeG}€Ÿ”÷hs°÷CRÁºËm´ ˈn;Cˆ·äEàÂF%Ø”^Uccv1 (¨ßŽ­è»f#õ„Ø--må¨'#Ó¸nå à~¤UþÝh3!Ò‰ÛEÈĸéß +P_t¥ÛÀuâ ýŽ / ®£bÔo½4z_“ɽªz]¯v_Ίý áPÌ! +Ðh‚L6Ê™Òø,ÞÁ]5Ó‹èÒêêÊ䨖¨'5ÊÑh¥a¿È*<½ªÖ¥ŽzD­ñ kR›ñ)º:ª÷vTçÌO?'Õ]±+ò‡ð ¾µ›~tTî.óJûê½BÁÝv2^Ò¸w{ÉH=J¾2À)þúI®©É 0ñ­‘k‡#<¸ºÙ ê˱Îá:–¯~ êáý/löšendstream endobj -1583 0 obj << +1743 0 obj << /Type /Page -/Contents 1584 0 R -/Resources 1582 0 R +/Contents 1744 0 R +/Resources 1742 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1581 0 R ->> endobj -1585 0 obj << -/D [1583 0 R /XYZ 85.039 781.388 null] +/Parent 1711 0 R >> endobj -550 0 obj << -/D [1583 0 R /XYZ 85.039 761.463 null] ->> endobj -1586 0 obj << -/D [1583 0 R /XYZ 85.039 736.911 null] +1745 0 obj << +/D [1743 0 R /XYZ 85.039 781.388 null] >> endobj -554 0 obj << -/D [1583 0 R /XYZ 85.039 356.436 null] +678 0 obj << +/D [1743 0 R /XYZ 85.039 761.463 null] >> endobj -1587 0 obj << -/D [1583 0 R /XYZ 85.039 335.239 null] +1746 0 obj << +/D [1743 0 R /XYZ 85.039 736.911 null] >> endobj -558 0 obj << -/D [1583 0 R /XYZ 85.039 238.63 null] +682 0 obj << +/D [1743 0 R /XYZ 85.039 736.911 null] >> endobj -1588 0 obj << -/D [1583 0 R /XYZ 85.039 218.642 null] +1747 0 obj << +/D [1743 0 R /XYZ 85.039 718.708 null] >> endobj -562 0 obj << -/D [1583 0 R /XYZ 85.039 114.582 null] +686 0 obj << +/D [1743 0 R /XYZ 85.039 522.193 null] >> endobj -1589 0 obj << -/D [1583 0 R /XYZ 85.039 94.594 null] +1748 0 obj << +/D [1743 0 R /XYZ 85.039 503.321 null] >> endobj -1582 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F43 1079 0 R /F36 892 0 R >> +1742 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1592 0 obj << -/Length 1994 +1751 0 obj << +/Length 2622 /Filter /FlateDecode >> stream -xÚíÙrÛ6ð]_¡·RÓ -ÅAðhŸ\'mÓIœ4vŸÒ<0mqlQ -»þûîb—¤$R¶§Ç´Mf, 콩¦þ«id…4ñ4Œ”0Q4MW9½‚&Š!äÔ2°¸õÝÅäëïm4URÄ2ž^\:‹Å;ïôÇ“7ÏßÎæÆ/³yFÞÙÍŸ½~uòâŒÆoßœ~q>{ñÓäùÅŠ¹/üÀ Ž“wïåtdü4‘ÂÄÑôÆR¨8ž®&¾5Âú†ç7“óÉÏÝ-´çOéÔ'ób®bk;Îí¹³qǯ†e+v›ßXøb¦<=›[+½—ç'À]z'M=›+o™už&uF«ºåw™–ÂƽpM0"ܳµ»5û°)ãå\YïÃÌÂb}—¹_^,Ýÿ|l€À¬ªi=)ÛÕÖE•}˱òRœ'7p$mnˆr®—¾PìØ&ä6äùŒ8T^=OñžÇL-üMjÆ@8mØS+D]E¿J+é‘ðÒŠ0lôÿ¤$Ÿ~¯©2>ÊoK“ NJ¤%»Í× ¸¹§­5]†ˆn{âöâ%ºª¥wÈ‚•pâaÍØ–Ñ–jø6öŠNÐWû6fCE`:’ÌãaK3ÂøvÔÎp'€Ñƒ:û«T6¹b"' kÖ…-AõºØCW-4¯UÉŠGI·•°èòb¸åÇ €„7·À£ŠKOz÷3ÔXhÐWEÞʽ*b11=~rÑ,¡§‹îÈæžÎ¬/|ÉåÌÙÄR´Kgb¬4ÐV–ì=¬M°ÌMÏ×ì:øÑUYGÕ=îòô&`CN8#ªÅ÷ н·2¯pçCÕ -»à'Išš| £ Î× î^:I¯³ºû -:”Ð:/ ± :蜕ðu´ãœº×:g¡È=¿ÍœŒDÑj4TXá[Fºx ‚äÔ¼|ýÃ>VmD¨éÜc0¿à1´/ξŸé½à… Þç'· ¶.Vväbp\àµtDF¡hÁÓìÝGw쬤FuoŽ0Å¥³«ÁsÇB°G­…Uö“Eœ.“™AO ˆßEûXàý«Ç9Æëíc¿'&Ò6Þ䎀i0¦9S´h0ç™36J8Pfl0öìsï+aÅÜŸÌý//ïâ½ˆÞ ˜ÀSÇOg~“,Ël^A\qKõ}ÏŸ@ï™}\Jnò+~ú»Ý=Žª:)YgÈCúŽÎ,[é9L…Vå }„ mŸ®4[b3z‰:#ÃÃVò˜ÔŠl|]gõÎBGí^·Žã0î>ì‚„ç$\ g JXg¬š;0˜5UÇMog6€l2¶ÝŠ®¿IøGkRÁ2ü«1»Ž#Œ³¡ˆcs8ÇŽ´>ÒëÖc8†¼Ëp¶ð©þ<ú‡;›Ê%%å-ZÄöÞ•½“á9"ô0â/p1ÿ~[q¢§\]oŽPaýÕTæìXËl;³Ul$„ìM[a¥ïŽ•YÝ”œv£ÑCóöT ®P9ÑdµkÚ žÒ–[„zÞ÷}ãx’ß4eïì÷üES\#Î5jî]1TI¡Ð9€Þ„A|È9ûÑQ¸Ù+ÀÏÁl8|À<ðÞ`”¸jî‡ëÎ|pîl­þ|º…"U"ç†ß -ˆ°uÉ…3îtÕŽ†dšJ!JÞû¶Üõk÷‰¹«ƒñ’gÏÏiN5eŠ/t¿iónCù{^\ñe} ÕË £èH\—_e•¨7Ôë×ÙýQ+èSh¶½ ÜÚêgÈp§Ÿ‘µå˜Œ¸Ÿ!Ûb¯­!κJH…»= Ô]Wogt1Q+£Ö†Ü/Ä݉­ÖÜÚ·6à–tIuÍ—R‡`E³íÖÆX…õƒã587¤t(=$mlYñ )ÚOzfø÷ê6®6½Ááþ% lE3B‹ÇþàKµ´kÓÖ*Ô>&Ó@w,©N¾âgú’Ä«¸o_…ÛÅâ¸ÖÑÿÍ¿·ùá:ÅÍÓÛ渶‡þÓäÓ—]Ê8È‘ñ;Cøßè| š0s_&m•29å]»"a "iŸœ´ï*1øŸ§N¡ì¢øýžË!ÁÑ!&8]#„k4—u‚Ãa¤m®¹"oí”-†#h¢‚ƒªIýôjÒ|öjòÓ»ƒ§oŸ ÏPƒOb&A>AU+Jƒw‹Èòpõ¾…C| M¡±Õƒ.|ÕfŒmP'« M“ É%%7 ¨?dÀB´n‹ì aöÛÁõ‹±"ò£GË—N—œí,Ž/_¾åK~;í›2Hvk!2ÜV2ÌF[ñÀO™ ì@„ØŒòµˆâÃŽ;ÒáQµŒ¿_Ëœ¼¢zÓõxŽ15‡¿cFb ó£u‹x·‰KoƒoGÕ‘NûI_ uZ'¹ó„$„|³i+Nx)ê>á°OWaÒPFXpñ¾ý Ò¨±âV—Iµdಠø0éÄ3ít`]2Æ®r2jÿ3S¶uñb½‚ÔèÍ,x÷À¸ÖÌ!gÆIÈÓ¾„ƒFÆv̓ŽbØÂc˜ßó;ðŠ[–endstream +xÚ¥Z[sÛ6~÷¯Ð[¨6¯éÎxí^Ü&vÖR&mŠŽ¸–H‡¢ìúßï¹¼“j§ÉÄœïÜèÈ… å"ô„­¢EJ¡Âp‘.ìÅXùéBjŠ•&Yµhþ³¹ø×>¬Ú"²£Åæ¡9Ç®§›íoÖÕÏ—6?Ü/WJ) (—« ­Û O\ß½¿¼¹åñý‡«7ëå›_.~ØÔ|ëG„L¿^üö‡½ØÀ_.l¡¢pñc[HX>\Wá¹J¿ï/Öÿ­â5wÁ»ÆdôT(¼P …T~KH)¡¤³<[x¶KR®¿[®<dzâã1-«ßmϾOÞðÔ÷ßóóªL·¸ðëñí}òí&±ÄýO0|)Êí‘q•ìxXíŠcÊÃ,ççúò=ZV%Œ:ˆ6úb“RäÒÞå*á«€w­þ}5€ÛGþ­4Øßžu–?¸¼/¾Ö1)³§êíÇ›ë·ë›ëãÛ´J&`^ wœÔ›öPÌ{Ÿt¤—dÂç@'µýÙhhÑ£8°*EäymGñá0p£@,¥¥g[WÅáo)èMZÕq +‰>`ICCH¤7â²¾íˆÐçÀ¼žNà[¿ÛÒ-¾ÖÿL‘åà^ÒúÂSÕ.åÁ¶8Ä™ÞTO¢CJëxÄŸY¡W—NhÑÂ+O$8.Npè~Ëû>ãÃÒ‡ðòá *Ú·å}Ÿñ W&Šs~£½¡µ‡aFì+ž”®f¹†ˆ‡î@•cƒ¼G9¼+ås€Å ñ)™.>2M›þ'KaGÌR¦ÃØÅ#ôî-Ï"‰9!æ©Üšî÷üöˆ¼ fKøWJFÖóÒƒ¸@ùN)¤M×µ­¤ƒ*Ûá÷à eF%)p¹2EÝ<²@Që[¹‘•ULó’4¡IH¤”߉%%kã“áq• ÿªI ~¦yR¾>¡iùr?ìŽQê-Ͻ{ÏŠ\ó!ÅÚü8ñ€zÀä,UF> q#òRÅSÐLjƒevY‚§îð [¦<øb–¦ÞDéWTAÆðÁÚ¿œƒ†h(]—¹A +;0'fdWCvÔ²%›HÙéCQjCÚ’C g-ºC§‚ìc‚Iƒƒ)O[9 +‡hå-“ƼÌ&MŠ|Ëï”&`ÓãÜŽÔÿ¬c׌¿ ’iž´kƒÞµá¤Úø¤ôÏ'†Ç@¶ Gß—Ö]ÇI™§M)·qxçé  D˜%¿…'Á©Ô+qÅÏj—iŸA®¤™$;þ*ðÄ­nÛF·äюÒÓÈàø`¥:砶ʭ„4MÔ•ppéé)ŽÌäT–ƒ†cO­14Ÿ* µÁ!Gc:#/‚q½ç9«&¥P¼¸™F‚OyomL1羕nu +«ºaÒ;Ùé`ðˆÙ™“n®—4É}º«Ì”mœÁ|2UÑèÛ ³Oåc'ð…º³I¯E3ýÕšsakCb>FHNÊŸ– +.¦˜­ö+øñ²Áɉy­E§Ï-6§‚ià^(lv€²µãBºð£.p¡¡ÌÑJÏXxÑN?pê—¥’Mnä’Í7’í\Ñ1ܧ‚ ¥‹NXHÚ¾½h@zg$ÕDtÑ;ÕعPbªì'Ï>Dmëð!M3@Ðvßíw¬Wresœk±;Ðâ½!š]!ãOh%rÁÚ»>k<âg–µ¦°îÊ Ag»Î(²œYFJa0/r‹hZdC„ŒßÑW+ïíóU¡`ž¯¦ðíÊëbQ +;|Q`çŒÀ¡-ž¸!šXÑõ2…›#Ù˜#ñŽÃ2Õ¯—=HŽí' +f!š¤Ž.É¿iCB]¨3ºð}á‡çtÑÍèBê⧲8=i=Œ(Á6¤ö9,†f€¥«;šö6–F rR ž‚ö!:£„†hF šè¯8Ä:-Ÿkç*.?’³Ø Í[W)®ÑÑÅÖ(Å™T +¶KçtRǪ́„iιŚ Þó|¸(O¸g°’>¶žJ\hYÚÐ…¨I…8>dWyF# ÑŒJ4‘é˜n‹|uʳ¯§´-;–ð±_¾a(H —<†f€g.†K *Âè$Ü’mwþ·l-šiDp¿×ÿ8ÜÿÐ…Û›n¨Ðšú®‡Ó§ŸëoÔ¼%%|WÍË¡i¨»Ñ°/é[íØÍ3ú¥Œ^^DÂüEÃfE“ô¡tk`ŠÀÚPЄޔûG£3­]C3-º¦A~×Y¼‡0´5cŽ;ËP“ôöšEí^‹! 8žÒ͇(‚Ñx¯o+ÿè?J4ßàþ?•w=²sàj,ˆÛ–ùÿ¼ÿsÑendstream endobj -1591 0 obj << +1750 0 obj << /Type /Page -/Contents 1592 0 R -/Resources 1590 0 R +/Contents 1751 0 R +/Resources 1749 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1581 0 R ->> endobj -1593 0 obj << -/D [1591 0 R /XYZ 85.039 781.388 null] ->> endobj -566 0 obj << -/D [1591 0 R /XYZ 85.039 761.463 null] +/Parent 1711 0 R >> endobj -1594 0 obj << -/D [1591 0 R /XYZ 85.039 743.459 null] ->> endobj -570 0 obj << -/D [1591 0 R /XYZ 85.039 658.326 null] ->> endobj -1595 0 obj << -/D [1591 0 R /XYZ 85.039 637.732 null] +1752 0 obj << +/D [1750 0 R /XYZ 85.039 781.388 null] >> endobj -574 0 obj << -/D [1591 0 R /XYZ 85.039 528.809 null] +690 0 obj << +/D [1750 0 R /XYZ 85.039 637.406 null] >> endobj -1596 0 obj << -/D [1591 0 R /XYZ 85.039 508.821 null] +1753 0 obj << +/D [1750 0 R /XYZ 85.039 616.413 null] >> endobj -578 0 obj << -/D [1591 0 R /XYZ 85.039 422.153 null] +694 0 obj << +/D [1750 0 R /XYZ 85.039 408.163 null] >> endobj -1597 0 obj << -/D [1591 0 R /XYZ 85.039 401.16 null] +1754 0 obj << +/D [1750 0 R /XYZ 85.039 381.549 null] >> endobj -582 0 obj << -/D [1591 0 R /XYZ 85.039 275.38 null] +698 0 obj << +/D [1750 0 R /XYZ 85.039 276.284 null] >> endobj -1598 0 obj << -/D [1591 0 R /XYZ 85.039 254.785 null] +1755 0 obj << +/D [1750 0 R /XYZ 85.039 258.018 null] >> endobj -586 0 obj << -/D [1591 0 R /XYZ 85.039 190.894 null] +702 0 obj << +/D [1750 0 R /XYZ 85.039 258.018 null] >> endobj -1599 0 obj << -/D [1591 0 R /XYZ 85.039 170.905 null] +1756 0 obj << +/D [1750 0 R /XYZ 85.039 237.423 null] >> endobj -590 0 obj << -/D [1591 0 R /XYZ 85.039 104.632 null] +706 0 obj << +/D [1750 0 R /XYZ 85.039 108.048 null] >> endobj -1600 0 obj << -/D [1591 0 R /XYZ 85.039 83.435 null] +1757 0 obj << +/D [1750 0 R /XYZ 85.039 90.181 null] >> endobj -1590 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F36 892 0 R /F15 895 0 R >> +1749 0 obj << +/Font << /F60 1074 0 R /F36 955 0 R /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1603 0 obj << -/Length 1646 +1760 0 obj << +/Length 2454 /Filter /FlateDecode >> stream -xÚíXYoÛF~ׯÐ[©¢ÜìÉ%Û¢…â(‰GN,9/i`0m H…¤r´èïÌ)“e«qQEÀÜcvîùV¢Ïá¿è‡†qõm(˜ -ÃþlÕãý+ØyÖïkƃ[§½GOMØœE<êO/ÉtþÖ;z>|5 |¥”±omè§4rúrx<¦ñÙ«£ï&ƒwӽѴ!Â×L -e|è½}ÇûsPãE3…ýO0æLDQÕÓF1£U5_ö&½×[.´§ûtªÃ¿¦ðEÄ"iº­õÑ:m핼ÃÞˆi6žfbàý³äÃ&)ÊÃ$Rtjc˜6 ‹ À½]´ÏïVd2|y[(2¬ÞíMÅ‚NOºõ»åŸ÷Nw„[&­¢Ó· ŠDƒ±0Œ‹xu›'DËpu˜ANx§IÒÊûd/攤E™o º³/¼Gyr['? ™d‹fÆFûR óíÐT’u*0]ƒ&ÂËÒ"ù÷sê‹ìñ“ïo‹VšÜîî}þݤ`Ù<ø2ôf›U’`P&•×ߣ§ãB¡Û“œ׎8[ÀVEï„BGLøJñ«ÎF ä -ß)Pʲ °ÉêùæÑ„Ú´Yîç Õ À¾È+ñ²€ú©µCÕw–•@½X9U¹ê’4^­i¯)yðXœ¸¨½2«< ë–joq…ÑÈn”`hõ£§Ê6ô÷uÀ,T|Cº%—¨Ò@¨ ÿ/ó‹ h -3 iĸ5a™ekãüx<f9ä¼"Ž>}ŠO‹rvMc°Ih¸Hç‹Y\.Ò+šŸOFgP‡N«Spigå&Oœs+mKâ—Òp7€8ÍRÿ÷$ÏZr×Ù"Åür“2»[J‡­·HÑ+4ZfWYZq™å+°*P2ytãu@ -Î=ÑRn¸)¯³|QÂÑ•Cò¤Xc…ø‰¦¼E? ñ̯-1¡“'`AZ‰i«œ 5ˆÌÝÌfIQ8¾”.-š&ÿÙt¥G²,’¯I„ev.†€¬kfE§Zqš¥Ùí¬Á[Præ‡dÿÌá_åÕí¨ÛCivH6þÂüù¨aS Û\¦“épz>¹Ÿ^LΞ_ 9ìî°·kp]'xÀ‚(Üß#¶ê°°e:ú¡¡nx2B¬:np‚Uë*s¢«5*©÷Il…« £N³ÒÕÖ¡(¤ùþBâ€ÌUü~ù¾?€PœËk¬£šÅOì 0¡$ ëÆpj†{P‹Û¹[g„b2(æÔ©±‹³Ãagm. -úbÙÆV»æ‘ ÅÜÙ¥½8Åv¬¥)VùÙ&ß2JKð‚ÛÙ¸žì»Ž;3ç$اæd$4ßDŸl™d9e–P“`S3µfŽÀi„J›H/¹±'%}i›‘2¶ -,œlÏW9BdEõ­u`'¥rÐÊä­RŠ3©÷";Á´ BvæÛ#áÛ#áŸy$˜ÿÁ#AþJ°ä]WX\U9ðÁ`áÁp÷kA~{-ÐkÜõUO¨†…ÐÎÑ•P5o0YdÃéãW|\d+˜&¼¢¡Óö*ÍhË-:Ë45šCâ2Æú¾t -Ôª§¨¯{7d)Û[†{/¨e‘’­|ÐИƒö5ô|Òª±+C¨²¦"IS¢hw#[Q¼#º™œœN;˜Y@VJÖÌ:x¶¶º2£. -%Õ=,ê}üùN8¸uŠƒgî︣Ò@ý -íßIÎlãÇÃû@—U€Ö{s±ÌJÈYï,øPõ–4%ˆ–1ä“[ˆéC@¡XÓ6^"\m°ˆc `bŽ;¶×(S¸âPDÅ -qŸ«±Oà#ŽW\g›åœß;™4.ü@ʆ–í¼ŒÊر½B,£@qR>>>Å€ÓùÇñÍôÍí$BŒÁr’cÇWSwâôúòøüÊßÞœüånòÛô§£7Ó*nåbäô£_££÷ð§#JDnG_ᘗ *QRøÏGwGÿª\¹kräîêÊQ +F W£LPb­ì´aT«,BQ¢¨¬ +ÁÃB0Ɖ`|Ta%®æ“Œ·ÁÆ_'‚ŽWøßúÓ~Æ `æBŽÿmÞ¦‚©„„rÙq—±Le„·ûÌŒÐ$Wj ûÚ(’½7ÂÀ¯g[Œz?aã­È’Á­"ÙÛ´"7SVÈÙˆ\§,zSæ‚HªR®"){# |¾ÜÎ׳ûíâ˼X+"Œˆö6­ÀÍŒ$RËFà:cÙ›1ÍáçPƵQ$coTž¯¿,îÛÙJCŒ6ñ Þ¦to|›ð›Ùê¾lu®‰ &žm`ÔŸmi„—«%†ýþ¤^í6««å¨¢³O(òLkZ—»‡wô€×ñÐŒ7pÇ|³Yàx ÛG.˜!6WQä¥M y£d‚ƒ¬n ¯KfzKf91Ê”¬6Š”Ìaà›õ +Kóí{›"”hÀ ëmZa›‘91 „0l¯íÍWç„Ó| ßÚ(’¯7*QLûë êŽ0ÈøÐČ߯gHOûÕr»FÛÕœ|˜¯ÝéÙý}Á5¼²ÜvGHbòx>¥M+Ÿ&q¤€U0oæó„B*EôÀÄRÛDÊèl0*Ö«®ÖáütÓ•<3œä0eÆ0x“} Mw(Lª†:s•ý;û¥7{É cÙW6‘ìM™}Ñ/AÞ0ãd»åâÝ[fÿçÙÚq?¬~wÆóÅö#Ξxp|Ùæ&l°øÐüqª†w<TܽßÉJ_Yà¬c”€éGÉ!ø3¼Ù®q$î‹ ­±èB §4‡¢Xhúîvy­ÅH>T’lJ_ñl„€ÅJØF6çWo‘=×-tf7fÒ ó¾Ð´Í蘯´ÛB…w÷ÛÝÚñ„‹js_í&.ÇÇîüÝqÁ$˜ÖNëÆQѸðË&l±×ó ÒX¿„{¹IŸü¡IàST`Ó?g+Ή•¬9EVMR€ág©¬˜¡psœù6H£ºÜtµÛÌ×›>¤>@imS å„K·ÞŸ­'ŠC§õy9{œÿ #ï%l®¡0>½¾Ä±8¿j-ĸ+c¶òü#+}e³®%[³F. M€×R'W†PÉÓ€ó¾Àip +gBp8ÄûÀ,ƒH‰€y_À¬„™» ìøôÒ è[ *¢F‡?]ì”ÈÜx#úŸWÆJ—VPˆ.OØ‚YVzboe‡ŸLÀ~:Æ +”–ÁÒZà•IÃàÀY?ƒK£'08 ¸’ÁqpžÁ!¸ƒ“+æ;{‡U»›v‘˜#ŸDbŒÄ¼&±ê™Ê¥aPÞøTØô/:Rå°y{‹ÿs‹ÎlóúV©ð +‡ZÛô¯:[k¡Yï9fkg͆¹Ü]×»›<è• —iày_ð ~-lðºT›ãþ*0ïk´è°Én+Ö».ÍZûÿóÂSi–wúÉWÄäò Fy"×Î"$öFO#q +x‰£ðJðb$N¬"qXIâ˜_°»h TÀ˜çéŸ8e4fø-ÔAi ³=KÅâÊW„ÄÎæiN€­¢p [Éà[ŒÀ PUü¡*éTÌ7N³°!–Šg£/ïiG@R€KFÛ‘À¦¿shmô^ç$þ\ç4C‹Ål3ïëžÊ(Q¸µM÷$4'Ʋ(¶ôœD²³~͆¹_œßµK‰ª&æ} @ƒ’Ù°ÎÝŽ$F%‚å} À‚]ˆ°Q°—Ù6ñY¢rsÀõFHü"”'boí,Â^o4ÌÞÐ*öF¡9öÀbìM«bo–go€ëÅöKœõ}ߤÕAù+Ñ°OÃßÚY„¿Þh˜¿) UüBsü €Åø›VÅß(,Ïß×Ëí˜8©Öás’ÄüåÐMŠTü­Eøë†ù›ZÅß(4ÇßXŒ¿)`UüÂòü pÝ\ãégÓ®§˜pg"€¥¯8@|A‡7¾ÜBtêK)ØPt ÐB¹—t¬v˜7X +h•À¢ÐœÀ`1¥€U , +Ë ,,êëä7‹øâû«iKfö}2ÍÀ–¾â0n xs`¯o&þ•˜=JsXì¨~6•u?öSš0}@‘áw#T¨4" œõ‹¬4Yh¥ÈâÐ +‘…À""K«Y–Yˆëî|'dúæ²ë­PT÷Ç–0ç+ŽNC”n‹kË<ÓÓHÎU§¶` +‘ø ‡—eDÚD/…Î"âòFÃâJ­WšW,&®°*qEayq¸nnÏ;-.¡EË“ +}Å‘ `¯d¼í¥.ZºSX°mä}WFä"Ñ»*³ˆ°¼Ñ°°R@«„…æ„‹ +¬JXQX^X®×КñÉ?Û¨Žë$輫88|{T‰&º—ª-Ó½h¾+t¨¯5¸’#•´jgiy£ai¥€VI+ +ÍI+“V +X•´¢°¼´B\o½çžëxbåxz}ÛA£‰…y..Û¾§„:Í®g„ðÏ-?ôÁõ{Z0ž}o7ˆ6ÒcAÀªõöš¸m¼ÿUzkendstream endobj -1602 0 obj << +1759 0 obj << /Type /Page -/Contents 1603 0 R -/Resources 1601 0 R +/Contents 1760 0 R +/Resources 1758 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1581 0 R ->> endobj -1604 0 obj << -/D [1602 0 R /XYZ 85.039 781.388 null] ->> endobj -594 0 obj << -/D [1602 0 R /XYZ 85.039 761.463 null] ->> endobj -1605 0 obj << -/D [1602 0 R /XYZ 85.039 741.337 null] ->> endobj -598 0 obj << -/D [1602 0 R /XYZ 85.039 707.744 null] +/Parent 1766 0 R >> endobj -1606 0 obj << -/D [1602 0 R /XYZ 85.039 685.028 null] +1761 0 obj << +/D [1759 0 R /XYZ 85.039 781.388 null] >> endobj -602 0 obj << -/D [1602 0 R /XYZ 85.039 338.256 null] +710 0 obj << +/D [1759 0 R /XYZ 85.039 610.569 null] >> endobj -1607 0 obj << -/D [1602 0 R /XYZ 85.039 314.938 null] +1762 0 obj << +/D [1759 0 R /XYZ 85.039 592.303 null] >> endobj -606 0 obj << -/D [1602 0 R /XYZ 85.039 273.465 null] +714 0 obj << +/D [1759 0 R /XYZ 85.039 534.269 null] >> endobj -1608 0 obj << -/D [1602 0 R /XYZ 85.039 252.87 null] +1763 0 obj << +/D [1759 0 R /XYZ 85.039 515.796 null] >> endobj -610 0 obj << -/D [1602 0 R /XYZ 85.039 219.277 null] +718 0 obj << +/D [1759 0 R /XYZ 85.039 471.311 null] >> endobj -1609 0 obj << -/D [1602 0 R /XYZ 85.039 196.561 null] +1764 0 obj << +/D [1759 0 R /XYZ 85.039 450.716 null] >> endobj -614 0 obj << -/D [1602 0 R /XYZ 85.039 119.598 null] +722 0 obj << +/D [1759 0 R /XYZ 85.039 394.804 null] >> endobj -1610 0 obj << -/D [1602 0 R /XYZ 85.039 87.276 null] +1765 0 obj << +/D [1759 0 R /XYZ 85.039 376.33 null] >> endobj -1601 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F37 900 0 R /F36 892 0 R /F43 1079 0 R /F40 1163 0 R >> +1758 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1613 0 obj << -/Length 1314 +1769 0 obj << +/Length 3124 /Filter /FlateDecode >> stream -xÚÕYKSã8¾çWø†]µÖèi[{caf—©!Ë#sb9˜ÄÔ’b†¿-µìÜ=èbûähoç4:ï}í|î-K"aθíœÓ`l|íP"tÜC›¦u0îH%ˆ’Âõ¯;§ã– -ÎÉwyÄÍŠ˜i¢¹ò£ :¥[¼†Œ¨E¼š(±E±R4<ŽbΊé`LÒ𲌠§Ø9Ú7“{Èœˆõ.ps^5Se³åjtç9Åì‰X¨F'ÚBrÔogEUÐÈA¬•#’gKš{$¶FsÄégyõÃ8óÚ‘"RIË‹äÚ·Пsòýø@µ±dõ|IIBS$±J] 4'Δ‡8ýA)MñÎÅæ#ÃãYdugL“…8wYN±vê1Sa -¾œÅÔ³±žöNVIEàj=B¶ â8ïG< ‡Ö¬ -Ä8v>¶÷â‘,ÕJò® LáÂÅæÆŨ4 *Ä`AóÑuu]Ö¯…hÁ³³ÕCDF„Ô~l†ºÚ„ííë&À)ƒ‘w…Cu‰øx|ñ,|¨£r~=ºšàªûQ=ÄVUçÓ›å%~Ñ|î뎣6S\Š¾0¼¿÷Zf¶.d‰WtaÖ?TÑ‘óã³›¨‘ ºˆ~^Ù,b?mê%,`MhË>xhÛÂù¬ mB¿UlSï Í =8u!ŠçFgµ}tN^#:4n/ª±O9k¦~§7ïÛÿ#¤2@‰4’iÝZ÷f)ÕÞ{ý´Øÿæs1ö·ž¬Zðm€»“Îh.ßF:øÞÅE·X¢5ï¦^Ɉ¹é};ºÆf@$m¦à7–6EI‰Ö|ý£Ÿc±±\ã”Ó]sæ¡©Ï$á·òêqŠêª3òEª3Riã‡#ë UNð’AËÊBÙ¢ ‹ -+.¶ÚbgUÞ4u0³¶5Àÿ¸òâWÖ÷æÐ;;Õ§/R,°Ç'Y&“\± I½Íüê­g°Læ}Äe]ˆ M *™Úº‹ÍÕ*ü„Ó•âTiªPØ^¬JÙ>êEíUÁ•(()´GPfYs[–2{°,eZÆ qª¬Ü+K™QwM›½’“ǦâTàY·¢ùYULQŒô¯.XоåØ™¿öf¶£5dÖŒ fãüâÚr‰TκÒ0Ç$-uX»“g2ûÌøÐ혚uW g}u8•*äöu8ÞÖáÚò¬rÜGx,0¾ôX8…óvqÈë…>FHXöã­_Î&‡ûôjñÿæ®ï.w®Çd®Þ´•ÃÞ3’ª5¿üÌŸÿ[ü,8!Õ¼,+±Ê¦[³$…ÿ ­ÑGendstream +xÚ­Zm£Fþ>¿ÂÊ—ÅQÌÍëݧlr·‘²ÙÜLî"%Ñ c<&‹pfGùóWo Æ8—ŒF#ÓÝÕ]ÕOWUW¸ þÜEØŽJQìÚ*ŽÙþÆY<ÀÈ?n\¡ðe¾Ïƒ+=º +=Ûñ£I᱊ÜÄV¾‹4·÷7¯¿öœ…çØa¨÷Û…ëz¶r½E˜ø¶¯üÅýæ'Ëu—« p¬»t¿N—+†Ö‡º8´Åá[‘õnéZ‡6¯—+øMKh5Ë_ùê¾ã.ÌÃı}wR>g±ò”­"5+|F°AßÞõa;á@x@ÃõÞñ߬›¶N³ö’h2i–{OCÜÝ`á:vâ$î^lGQDÜïw9@ä8Ö@9ÕÇåÊ‹¬ª‘ÎjË¿- hT@[ây‚æ>'d—Ð×ÂH’Xš¸­¸}¬+ý­ê¬ÞT{œ&­â@ÇHó°“Åhh©¯¸ã:ÒýD]ãÓ+av¬¡U0%-÷Àý[ܶIà⋧é¢Jò!´E…ãiY´8ûy¹ò•²ÒÃ<è'Á*înåw“SoVk‚-ÇnßjwKW?7Ì>™²†»W\!£a”ºMA`êÛòl¦Ehë|4ç?´³ Áù$cYY䂾±·€¶6|°/(Xƒò¸ñ¬‚4—Õ;PN¨ÕÛcõþ€»Ñç;6Nìݦ öÒQÃï¿— + X*Ǫ‹êÔ°uß>LüÈTùasÉ¢ƒÐ·wÞã4—Í&ð=; ØãÜ¡öÅy×# ]ÀÃR.h÷£Ý¤ë2çYüÕ‘Tú]ëHFUõڞײ\Ë&‡“™Ío8.FGs·(Â!ÃÅ•"ÓF~3Ôæç‘É×U[±Êµ‹sYHZãj¤õ?;®È7ÜDµÅ_Ñz˜øúkðŨ +VceD·¼e²ʾ²#/2ðƒ§LÔ—÷ÉélY ’ô¼Ïù¹ŽgQ8`:¿›àD¶yByfݹÃoN+¦YD¬A¾)8ÜDÒDÈ@ŒÎ8*ßvÕÊpWøœU¢xâΫmx„tW±bÃéT¸çñ”ŸòKú ÜèLs žn³Ipzfç6%úó+^yëÉ;†õkÂý1ÄüBd÷ +d=Ñ fBt ´9†µ1¿IØ ~†á•íÐ5£Õi‹«û`b¤x¦ÚÿŸ:§\¸a½+öD3 +Ñ5çjÇü&4ø5§õ¾B×CÁçP8q] Eh«Ð§ß@ñmñå©–øE_¥åswkè°&­{ÕSMƒÉÍ2«Î²Ëm`%@RdBaØyÝb,õ±î iRŠG1ÝÅ H%±í'áü™D—Ï\]9óY†rægü¦ÎÜä—b„íYF]þUd8¤$ak™ƒüå€=“$±aÊmUó(ŸRý‘“+é+@uè©i1‹„3ª7ÜñÃûw?òÓÔ‘’ §µö‰Ïú¡Í÷]d>y>±o'þ•‹À š9!ºv>s õùŒùMžÁ/•¬™®ƒä½¾õå˜@Þ’±PbS s–ƒ“ŒtˆÄΟÀiwEßQÈ/•Ï¼t§˜¸m¸¯ØŽSûåaJ\r]“-ç §áO]Ʀ©RŠ(ikI©8—Œ‹#3¥Õ±Á5Ø‹{)WÄÊÍx šËy¼R‘íxÎãÕdÏ ø÷tk ?¤æý[lß¾š©´)@Î}EÊžær^ÿ ¸ê,/WÎYÕ‰N^©Nu:ëç£Øˆ#@ŠLJ нëý­+‰£Cè8µT;k¹+Ñœk\®õYÉeq>Ü=»†Ï¸“ +Im‡®§ª§JV0™j%N —LÚèÜ?€Ü_Ô‡»­D– zÛb/O…IG¶€Æô@é7A?…bømòžt£Y~·&¨ ÍSCwã L0§$ê¼;ßW&’â<ßåšUW'ô Xá¹ä3m¸UmÛ%ôö¬ +r²ÔýT”%?u;œÈøQ2RÔúV) +À/õ}Â㌔²ê(åBæϤˆ×r›0´þÉÕºÎpþ]ôÞÒ¬+¯ÖiÆ—yŠ‚Z]Œ†¯ä÷›Bß4¸T™ò¶´¼›aXÔ—e¶à +C=®R´aE®¢hv:0MõÄŽE‰¨‘GÓ&n8O*eùºÚ¦å'ºÕ× ëZd’(Šˆ S:‹‡±1RŸA†÷Ø~{‹%flféú’/4¶ÕI".\™UN†Xo¸^Ý!þÄ7Œ`eîZT€w«"¾UÔéúìJaîÂóá"õè¶}¼ùég±ÇúÍcC´x‚gÇv“d±¿Q¶î’[åÍÝÍ÷ÆÍM+­Œ¥&ün·;, ‰ÆEæ3éâX¹/#Ÿ¬uEÂĵ}ÇM 7kFK‹]5´+°«(¤ð@hÈÝä ý@OF[SNb‡÷"[ÓkÍo /»®äÑÖÆry9/¹^ëŠ\=&#¥Øå醥‹#ò'"^;c”9žYab½aÚG‰&`ðþí-?X­<ȳÂÐË%[ÇpäÔÈÛ†¸ÏwCtÈrÿ§ÇA@@sÌ’¨ÍòV”µýí!?W ?¶D0bÙ*ŠÿÚÈZ+c±‰üBˆ†4Ñ5«8íP½Œ€¼Ôù"PG ä›P\°Ü0z!Üd­+r% °;‹"™çCç´1Úv´†ú±¼Y•0u„3†XT ½x~hNìdtôB1þ…(E%øn.™‚rT2£â¸B‡9ûª6£¢Tº¿}óã°:mئÙ1¿ þóÀÊZ+c±)…ŒlßWG„âÿ޽¿??s¼ç½—MÖº"ZÂ`0íííÝX0ßì¼ fz­yÁ|ϳãÈöæ[_½ç“-ä„é¤AUÈaA´®ªš_ý®¬„Þðí6Æm1†<ƒ‡R‡¹* ãeZc€Ž=£Z}¬_e£GéרyÞ{)퉀g×—vûŠ2íԌ)gB+-ÊË¥€)ˆN= Ù¿kGÉڪƴ#HëÝ–eÑ7’룗ü­€éã}‰Ø}ˆÀõÝqàf÷Z‚Ztû¸Ö+©øÊÊ?ñ‹û|Ó0 e9øð-MèDC\âØüùÈ_°=^jÕ¯5ez +âWó»lyqbÑ‹ˆÅ+ÍK•€rƒC0¤š4:¸LÜä%„ÒKÍJå»±'¬:‹Ã-9Lû&t‰Õ +µÃsB€`èú·¬ëÍ…R-çSÝK¡}ÕHñ[už_Õ¥ááKµ´|¨èšow{y¥ÄuX/•»?dDzËúÚan9 ¦¨ë“ óMvzÏ5múXF?´’ôFüáŒTJSìxÖE8%÷ðø®à‚‹,4øz$ì¡r½ßÕjÜè³/ Éõ‡]槺ˆ¨â–^~˜BÏY:> ¹˜«<6—)c4 +…R™¬)sÅb¢T壎®œ‰\ø•—å"Ù¥’ʒϧ‡?ç_æ—@DóD… ©ýpO!þ—d9ônÝ`|^àW#Þ@\’Ú§.çùuÞ}aBÅŸÀ[]½"ð-ì5Ñ–'«ðÓ+äÇX»«ÄÖxᆉõw1ðHñß&òmŽ ÞßÀ*¸§óÏ¥:¼>ÒBbf§£®oH½ß´|Ê»êƒ|Î4*Ë Ê~R«¨ö{QWî3{â ‰íÄœE½þ.:‹oYyÚ <ØbeÀ'ã jþzâøøƒc'¶~g‹ŽàV Çbó_=£ØüŸ´0h©;½\•åX‚ÃF™žÙN I:Œ·Iኃðiž ±êQz ‚Ï—G ÉG §ý¿óì™M•ž{øåå´¦œ¸ÎÀß« ”ÅpA8æ¨Øbu™áÿÆÝçlendstream endobj -1612 0 obj << +1768 0 obj << /Type /Page -/Contents 1613 0 R -/Resources 1611 0 R +/Contents 1769 0 R +/Resources 1767 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1581 0 R ->> endobj -1614 0 obj << -/D [1612 0 R /XYZ 85.039 781.388 null] ->> endobj -618 0 obj << -/D [1612 0 R /XYZ 85.039 761.463 null] +/Parent 1766 0 R >> endobj -1615 0 obj << -/D [1612 0 R /XYZ 85.039 741.134 null] +1770 0 obj << +/D [1768 0 R /XYZ 85.039 781.388 null] >> endobj -622 0 obj << -/D [1612 0 R /XYZ 85.039 698.974 null] +726 0 obj << +/D [1768 0 R /XYZ 85.039 761.463 null] >> endobj -1616 0 obj << -/D [1612 0 R /XYZ 85.039 678.379 null] +1014 0 obj << +/D [1768 0 R /XYZ 85.039 667.044 null] >> endobj -626 0 obj << -/D [1612 0 R /XYZ 85.039 482.122 null] +730 0 obj << +/D [1768 0 R /XYZ 85.039 667.044 null] >> endobj -1617 0 obj << -/D [1612 0 R /XYZ 85.039 459.406 null] +1771 0 obj << +/D [1768 0 R /XYZ 85.039 642.326 null] >> endobj -630 0 obj << -/D [1612 0 R /XYZ 85.039 260.422 null] +734 0 obj << +/D [1768 0 R /XYZ 85.039 583.118 null] >> endobj -1618 0 obj << -/D [1612 0 R /XYZ 85.039 239.831 null] +1772 0 obj << +/D [1768 0 R /XYZ 85.039 553.714 null] >> endobj -634 0 obj << -/D [1612 0 R /XYZ 85.039 170.573 null] +738 0 obj << +/D [1768 0 R /XYZ 85.039 352.231 null] >> endobj -1619 0 obj << -/D [1612 0 R /XYZ 85.039 149.978 null] +1773 0 obj << +/D [1768 0 R /XYZ 85.039 324.708 null] >> endobj -1611 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F36 892 0 R /F15 895 0 R /F43 1079 0 R >> +1767 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R /F14 969 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1622 0 obj << -/Length 1654 +1776 0 obj << +/Length 2945 /Filter /FlateDecode >> stream -xÚíZMsÛ6½ëWèV²S¢ø$‰\2Ží$ÎÄJj©¹890"mqBQ*I9q~}wR–DÊN-Ëq§ÌX bñv»Ë°>…¬*B…î!#" ûãiö/aäUÕ3h_ê+z1êýþR…}F‰¦º?º0SFñ¹søúàýèøÌõ„Ž&®¡3Ùç£w§'Û>{øËÐý4zÓ;­ˆð$‘¾@õÎ?Ñ~ ÛxÓ£Dè°ÿÚ”0­ûÓžT‚()êç¬7ìý±\Ŏɾ}«‰'UH4Œy‚’0”]s‘ -–X¢å´ípt¶ s"DýâæššPÍVÖdªcÍ")]9s×ã3Ë]æ˜çÕ&i”fe6«6ÅzÂ'a û§Ä÷Ù½ýy(p$ø¦ kÓ`lQ–Í\:_ñO‚R¢Ï /«ÁEã1öÍЗã”6L¥Sü‰ÃŒg`¦ÜúùÙ¶1dú=¹¿7ªñ$ruŠó„¦ñ¦‚³×›¿ýt âwž,ÓûÊd·»!Ÿ…„ù¬[¯›ø:õúɪ±­ÞßìÃìbUÏ-üÚ'š‡?†Ÿb‹ÌÈíû,ÓïË#+œÏèÉו=Ö¤e{0(ö.žw˜^H½]õêUÿü9 -À¿RJgÅ1z©K{„«™(Íåðzª‡ïYMÀäª9ðYzi É!$ Ípl²bÄ**°kݼS8Ò¬ »4+5ᤞv¬Œ®–Á°h¥÷ïùÔ?@ÃüN4þhÞžFÕì‹Aô¯…ÀévàS¾àÔJ¬›&y ù‡¾„&Š N¸ z¡Î™Ë¬`ì†ä/ æeÒÁ8a¼3GxV{—$´<í ª—~£” {=ÎÖO™¬‡’áÁ©m¼]îñ\ N:ØœäD ½Üi4vÕ#[^ÃpM;S¤§"CuøYheRX[äÑ´FSÑPºYñ¥¬¢ -×™UaD[”uüŽ »ÏÛ¸Ý*ö'gÉUÖa-˜ì ÁÇÿ?ãüç2Ž"ª;ªcÆ À»ÅHPÒ_Ï8¾M5CÌ5ÍðÞÁ©}ß¹"ÊËhŒÖœøxl›ïÓeZêÎIÞ²5Î`ßüv %)“ùM -4!åžgu¼©L­æ©ÍIÍûÓ8±!%ÅW®×øèÄ]ÞÿZ4Ðí¯k -Z4ÏÚÞcó)ÓDËûÇâY½²JN yuAEbU{œ/¦›¢CW¥`·4{Ñ£0±óiXdze y•ÔÎs’_ÌZ70M$—;Ábª}ƒ¢!QLÝMÊ´ Ö1¢íúARÆì91¾3œl5Z—ÓS¢ôM©Lø]j„k -xæz¾¦N9WTÆe œ,¹J2lr'Êq^lû˯i5žØöU”-ê阙ð·šÔv­rŽ?–Say=Å4úœ]o,Qšo^+›!SŸiV3¤›Ò¼êXa¿¦–e¥)g/)+sEk4±:oERigœ^”¾Í9©¾¡Tè|¤Š‚dXq\3 èTÐËlsŠI—Á“­¸mZ¨8f®ŽÐ—á–§ie–‰íXTšš|9/_Úfve¶’®b¥$œÛŽ’ó»nÖáÛ¸}m!ÿläß$„w'G¿¶*rÇ,WÓûÔFê†G¢Q¢o뜅e'k<“9Ï;rãÃqÿ6Ó -w¤Œe[€6qøâaXÿ% p÷Ð<šO|“dE}S“ÎeR3ýEŽ'ÊsÁì¡ßdá²*V´ô¶T…êƒÛ!êMl¡È„'»PTlT†V³ýðÚ/l{’DqRÜ·Bô“ù:&†º”˜•XÊìîÍM¡ÏÞŒ-²+Wù`xËÐöì±cÛ²€ñúàì¸Åð€ -5•ä]ŠÑü®½ ^â®Þµ>T…„úªá­°íFCða» -à±_°}iøݸîf›ìí š]¹eR¸j±gáæÜ;àKrAàl=LXMssÕ¬ Yió‚ÚŸúnY¤7×Ó–WqàeŒ?dßCè/¯º«á"‰W¿«|Ã/:S Íæ^`•’%ùe£¤lg}4…Üæ×­ö†³³­ Pš¯x7{¾)¡ïðÿ$žuÙªÇw*GÉÖçJ;gMßIÌdendstream +xÚ­ioÛFö»…/¥‚ˆ!9ëYìÂW»ÎæÚXÛh‹€–(‹‰D*"e7-úß÷3CR<œ"sŽ7óÞ¼y÷È8ðçN"ßvD< #×Q4YlOœÉ-Ìüxâ*ˆ™™5`Îæ'O`Ö±c'žÌWõ>¾-}1™/±Îÿ}úf~ùv:BX®kOgaY×S×:}yvŠÃÒz½·W¯æÓ™k]½ú‘a¡ùöÕé‹ëéoóç'—sCŠAhc¤ãÓÉ/¿9“%ÐüüıEMî¡íØ.LoO€Û—Bõ7'×'ÿ5[ñœœðª¾cû"²ýHtÏ-‚ƹ]/¶e,'¡ïؾ#éàY^Mg¾ç[«å3n<}¬²MÊ­eZ.öÙ®*öÜ/Vê»Kócج3÷ø)²蜹xŒ˜ÐVÙ6}¯0—U²¯pàˆ€ûµÞ¢Z«Ý?75éRuvE±ÉòÛ|昰°:”G˜Ìþ<Û>eµÎÊ#ìm>a(³?êA{Ì#蜮PlMö_r¦]r›¾_‡¼¤®¶°*æ‡íMzt¸®ü;Ï^¿~Ñ`yz,2ëDm—)ÊnR¿L5µUqÌÚKáýœVÿú2 +¶7À¯#Ê´j‹a—·ú2þ\¿<½\…wUV{#a(íy²¼b=ϽC©åTŸœܳfX¸ZèÒ1ìæ 5 ·ÙQ¥BS¥nèóÑòÅ&3Wõ0+àpû!BpNkrÑ£¶]ŠÆ÷éúx¨î²E:"ë°G¥WÚ’=¨ÛŠ†Wó÷—?]_¾|}q©àòêý2½ÛK WÌÜÐv#¯µî/šzúƒë7Í0·fh]†›#+„îöàeö)ú˜|êÅVÅãÛ$Ï`b…úêZ`¥°Wäì˜ðŒø­ô.;Ü#ƒõ‘U}@ÀàÅ8yXT„I£Å‰‚&Y^òh«~u\™n–ÜYáv{žÇ4Êÿ½ºúY±A¯Áb®tb+[òW¡bHM®»jz…óÅ:®Ã§ÂÆ£Ín:óBë1Í[àÌò@K5xÁ;Ø%ƒ1CVÜã‚’§4Wú +Ç/¸ý«ã;›ݠÃþ aÓº¬IìŠÇ nŠ$#×zC!ÂQ0à>øuoâ pÏqøp8 l/ìfz¯Yc3òõm! "[¾Áˆd¾<ý¹CX 1ß„0µ×„Å‘úA‹°ç¯Ï®.€õw!ß‘Û’‘G7  ½SRˆ'ÌBçð^#1*X°Oó¢X®`yS® »@ÁsQã`1ˆ uØ"°V³†ùÉ ¤µ[£z×-\Z¨)Ú-©ˆzÍC ž.LÚïŠ| (Ãu· Ã:@Y΄/åý?ôÁLã;Ř_œ=Qˆø 7¨Š*Ã?h_](h%íSøw‡ä¦}‘“ÁfÍm\¬BxPÿè±{ ‘Tóï¦~|XÐæ_È')óïH?¶>â¥kÝE°ûu¢¦îq´Ø/¹§%@¶ñ²¬yéXkÍ$#û ]ÛŠÀönᳯ ¢¾U¶Zc`ÓŒþ +gÀA;A²Tt‘Tyª“ÛôôÚŽ¶”“¾7‘±c‡2þ:%U{Í›õ(©”vèIƒQ)i׬Ëþ&„©½ ,tl¶èºžO#i¾‚úÏ•#,89Ó*ƒcÙ’Çö)k{ÁéK¶¶6ß mO¶Ùè£{èá:1¤À¢Äï–4=DMÇnÂt)Jù°ûŽ„`É’]â˜P +‰Tz1ûâÈlªvqvLØÞ ñÉÑHQ·éñyD+8¶3”<0 ÂqØÒlð†LÖrÐkCü†´‘žâW’)Â/™´t[ì?cŸ 7ˆ`ßW\ {GÃêp/ ¶Ji;½*á…!‡‰ÄcœÇSî(6‡TÇ›2T¬Yr{CFœ-pÞcÌ(Ø%¦[øÒ{XñÎX4Æ^`XL– m‡nÂs¾áH½F íÃulQZØð.ø>Ãlô^Æ.âÁ!rÝò„q@=³ay2†€Ø­¤»’»ÝpËÂUmé`pdøZ…ƒ–t°¢xÚ^|Oߎ]ˆBª¬HOØŽ#¾Ä.H@ØoÔ^³Æf=¥ 0QŒH"å +Ǥyà¦<÷Û¦÷'̓É@¶I;ì@rR¼Œzz\„ÜÀ×Îa¾ïðØõlá‚SpÀn +Ù[Ò0³PMõ| 00;!J×îà½ã(:y›ˆm?ò[ØÎ×)Í`¢0â/ø[’`¦ÜÁŒ¿ ÇVk4 +ÔV -ù»Ð +·ß+-ß •Ç<$W˜´ƒp]ÖZ㇔º]ÃÕÁ º¯Q ½×¬±YW- öù#RH‹®2xµø˜"HÁIÛŠ^O “rnqÒGͼ¨t´6"8òqêN)”O[i4E˜ºÖ™q}(H¢p\@è2oHGÑ) Ǧ4°‰í…|’;à°ˆMvmrƇ*ý»‘ö„(ÕèH>ó(%*ðåÄ +Ì¿3îpr Zn‡½jçRëw®` B÷ó¦N„L[ÔȽ¨ +߭Ǥÿ©ÊÿL"È‘PÙצLëÂF‚#èÐ7× Ìz|¨/»¹l„ÄŠÁËC§/{›¾ì¶ëŠÂ%#îu\›8c]^ªd»ãÁW€ÚvžÞsc‘4Žl²²ªóž^¶S"?ÀÖh„­ +*Ù:†N³u›fkÛÛԔײTåÏmƒÂ.‚Y‚fÜÔ㨾‰wYÂFQ»b€?d#|½‡¸h`F˜È0x*‡#¸4 Û¨Ú®Éì0'Öƒ¤Ë¥^Êd±>®Ø¿Õž–J®­üùϾ‡’/}  ä[CåþÆ$C$Ú»èJ(-§®Ú!CÛ¸£xDY¿M£DÊéöÐ]`F÷6~5ÐÈm( äQ8xcèô}ŒbÓÒÀ6ì©ôaŠ<-‡",ý0tè¹.óNÃ×5Ä<,²ð`^ 4Â<„lj™7†N3o›f^Ûh> endobj -1623 0 obj << -/D [1621 0 R /XYZ 85.039 781.388 null] +1777 0 obj << +/D [1775 0 R /XYZ 85.039 781.388 null] >> endobj -638 0 obj << -/D [1621 0 R /XYZ 85.039 591.485 null] +1778 0 obj << +/D [1775 0 R /XYZ 85.039 417.956 null] >> endobj -1624 0 obj << -/D [1621 0 R /XYZ 85.039 568.769 null] +1779 0 obj << +/D [1775 0 R /XYZ 85.039 377.915 null] >> endobj -642 0 obj << -/D [1621 0 R /XYZ 85.039 411.417 null] +1780 0 obj << +/D [1775 0 R /XYZ 85.039 350.816 null] >> endobj -1625 0 obj << -/D [1621 0 R /XYZ 85.039 379.891 null] +1781 0 obj << +/D [1775 0 R /XYZ 85.039 337.267 null] >> endobj -646 0 obj << -/D [1621 0 R /XYZ 85.039 314.138 null] +1782 0 obj << +/D [1775 0 R /XYZ 85.039 323.718 null] >> endobj -1626 0 obj << -/D [1621 0 R /XYZ 85.039 293.145 null] +1783 0 obj << +/D [1775 0 R /XYZ 85.039 146.47 null] >> endobj -650 0 obj << -/D [1621 0 R /XYZ 85.039 235.379 null] +1784 0 obj << +/D [1775 0 R /XYZ 85.039 131.709 null] >> endobj -1627 0 obj << -/D [1621 0 R /XYZ 85.039 215.391 null] +1785 0 obj << +/D [1775 0 R /XYZ 85.039 118.16 null] >> endobj -1620 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F36 892 0 R >> +1774 0 obj << +/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F11 976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1630 0 obj << -/Length 1888 +1788 0 obj << +/Length 2961 /Filter /FlateDecode >> stream -xÚåZ[oÛ6~÷¯ðÀÉCÄ‘"©Ë€>¤ŽÛ¦ÍÒÎöº‡4ª­ÄBmÉ•”é¯ß9$å›è8ˆÚtÀ$–DêÜ/ߡú~X7”„ò¨„Œð0ìNÚ½†•×fvЮ Ô—¸ôrÜùý• »Œ’ˆFÝñ•Ú2ž^8ý7ÇƃaÏåœ;é¹A:çc}òþÏãÓs}=üÐÿuÔ»¿í Æ,\A„Ï‘Ç×ÎÅ%íNAŒ·JxvïàšEÝEGHN¤àæ~ÞuþZQÑk¢«ß²hâÖ;\‘È“vm]ÔNF+}=jÑ7">é1‡¯çJIaRÂítdNž•‰EC0YÅ’DHŠƒà’Ûvè ôa‘þ> ÀÊÌso—¿ Ä§&±K="@hMœI ñr zP8s`“ ›Ûž:É|—؃0 ŸžGDôUç §À¡šô¼À™éà¼íI߉ç7ÉÃ:±'+õ±Ç©óþôä·]\´S"ÔÈÓ }R%…֧ʵËF è›ãá`—kpMûá¼ãÄ ìYgVïôü -ö~W/$4ˆžA¶ËÙ'Œ~ÆÞ!Æýñ°L,ô»– 2zƒ1lñ*I-×!Õü=Šù”b.Å`n¸4 QÔ–ý!æw?š§Å“'^û³–=º¬r'Í® KMÂ~¢’æÜÏïõj<ÖewjöÃý•¾,ññ îW5³«\//±Ì™Š–zÒÎ3÷¾™9ðS&Åæ'IQéz„^¨¤,’ê¦@ŠšÕ$ÜZn”,Ä•’®Üé&x1ÑKe3˜O|.ôÐÛ×9‰D°å-ZZ²iǪo$ÈâÎ()nUE„ë×Jµà;§h"#’…­G‰ŒÖ¸‡ûžç•bõGÀEäÌ“[hˆ.—¶´„bŽI<;¼Ô)&EôÈXù¿`Þ§Xûû€ßŸˆaˆcŒ9pÝhx‘$²nx?0†Ï)kv« "œF­kÄh0ü8hØVÀ0샘Ÿ‹Úš6eáw®í)"›ùhµÆP°4MjüTƒ'M¤Wϳú®Ik¹‚P=ƒrE)Œæâ+߶PTäƒüò¹@ ¥PL#¡ô÷Uxð0÷¶$þv…tiï÷”˜s¿¬òë"^ÎÒ‰PXòÓi¢oò+ ¤tÖÏNòE¬  ãÝ}eƃ¼P™PÔ¹ §‹TyF=ÈMrLò¢¨çŽ{G訟ªÔ¸Ö›„&ªYà¬a¸Üჼήi¹1š¶E«—L¼3½%V,̳F[w4¹lÛbÆïŽNlöç0˜øA œ`i%ý—Z³$›÷jk˜:l:Š;Ó¸ŠÍªþ¸)Ó̘=°yö‹ªa¦à½k¢F<æµn`ó…U¡‘Ü]¡­+ñ6| -ê‹Y\Κ*r ü¶ÑU‡ÔI‹E-ÔчáBÏéfb·¸'ôE[]>üÓè²{‡w½@’|1h•ElP0TŠ¬ö}òx†µe\0G[`ÑR¾r…ðœ/ð“9 }HÂ%õ¼Œ§ØBÕÓ¥ÞñK­ŠªE ‰um’Zb6Ým¾¯køöû¿¬_ÄEUSW?†«ù -¨Òx®NvôkØÈOEú¶è‹\ñLJW†ó">ÉU)ž&MahýkA -ž:Ò€æLh‹n6ì+ßa ;ûŽNŽÎtÍ6Ù Ðo‘=ÇC4Eé m«J)ZÐNQÎzmžd×8Ñ™aîÌ´™õ÷fáË - ®Šé6º-ªFX¿ÆhÚp}¶MêÛ‹B’¡áÑîs›…OÂHÚí¼ËÆjçËäù¹\˜m(«?0(‹|aiÿ+k+¢³#Ch‰>ÇÅs4ä½Þ…ÞltÞ¥þª,Uü'å6uåÛzJo×@¡È–~èhÒ±o… Ðh=G=e>_¡’‹€ý\­RBüK•o«×8 Í’/–7ÊþÆ,&& q¢Ñ VžÆ¹W@|î·†ãt‘ìíx&âµÈ~aƒ:5NF5s‘ZNöê°–ŽŸ 7ú¥åDbõmÉS<Zu›§[zÅÙ´žV‹Æ˜:Á3Ië’´ÎBá 'GC•ÒxL-„kªš§k"›ì×€¼Ô¸5tOjŸÔ lƒRŒçͱ•é“2*öL­ëcÉÿ ðÛ6Ù8ã´zCÊvÒ{¶üû/¹1_endstream +xÚ¥ZmÛÈ þ¾¿Âß"_kEï–½‰“M7MvÝ]A‘ ²5^ëN–IÞMúëË—i$KvŠC°Ðh†’Ï’Ž=±àŸ= }Ór£É<´M7 '›ý•5y„•wW¶¤˜I’™Fózuõò:€UËŒ¬h²Ú¶ûø¦ç»“UòÙXüãÕrõö~:s]×°ms:›ÏCãaj¯>¾~…Óž±„·û›ÛÕtf7·ï˜ÞßÞß¾úð0ý²zõvÕˆÒ0¶Êñõêók’€Ìï¯,ÓÂÉ3Œ-Ó†åýbúž+ß³«‡«5[ñš7ᯆÔöÝÐôC÷ToÛ×ô¶mÇtmg2÷-Ó·ì]3¹ÕLÛëÔw<×3ŠÁLÄÓ^Â1m0úÕ²=‘%åŠÎ`æ:¶y6…OßþûÃ!lŒ0hN¾ü, +&É*…IKpè€û¢bê]ª91—-· óHä‡qUµ“D›Æµ"<§ÀƒFx²ÒVÖS'"‡€qãÊ[”똡S˜¤¤ÄJ·¶;4²Œ\ÉR!%Û˜"JÍÓC¦Ó5¡á5.i®Z% “Ïä’;~ÑñàöËŠ_ÒœŸô…PŸ°ù¶Ÿ|=*õŽÊÉlcõæ5k8RQ‰MÖüLx6!lÙ‹¶e/p•²©ò=šöz~…3r ë:&oU¡7BôËbÏJwÍ‚‰Ñ”|ßø]Ïš'IÒ]9hR¡ƒ;m²T´¾×‹#)Q—4?>Þ‰ú}Ý=O¸ ‘eLöË/ütT(pÃ/eQ·i7—c9g¯~†ÜØUÏt½@¿pç(š“.pÝ{e,Øœ0ü>ŠxyÂsxUQ?ŒÇÛ\bISñf—æL\lyrY¦9NÞäÛbê¢Ìð:áÐÏ–7ˆ²®ŠÌÏ+ÛÒŒß÷L‡Ï«)\ÀƒÞ\ùxh¸²æÒIÚ(ó0ƒ(Q~‘Õl3pÏçdÍøÁøóÀô\WŒÏó‰äHBðúŠ!½]½tþÉÃÔ‹žž¤)êtû}Læ¹c†^p^æ–f_ßwL+´IæO—²ð3€¸@¯üCåž=— >Ñ4èN‚ºyvºý…/ø +Ê;ÇŒ„öJ+~ò½[UéZž%®PZ‚ûÅ’²,q¦e릒¸.xíØÄ3=°=Ý/uä1>+A×YÄ·$Rœh€`»’¬½Û¹‘‹ó¡ç…¸ž¢k¢NÑ7qR¾IõYB B—m­ägb¸"J + ´òÁ`F2CÇ÷z9?ež‡ã˜’Á’@>Ö¸L>»ÕNoLJóÃдÙ5¼«æ +=fÌî$ã$çØð‹é="©xˆàóq~– *Ã$yåwŠÁó€êœrørP¾ák%Ç;œŠÊ~#ôñ©nUC?Ê!ŸÏ÷¼?¦êéõ€—˜‚¸¹DiI}Xï(G¦‘Ü4¡ƒé+®÷y]{….Ìôz\[À<ùb~¬1Ðü—RéR¶òqšË€b†;¸<‰gèÌ}é3$j‡ áã/½l)0[Gz¡·FÝ—ÊÏQ]Õ ÀBnîHôdiÃx²csÈðàûR<¦œ'‹²ù1ÇãÒ–¹òNëo¸ŸpTNdDAÂTòŒås[dYSÑWæiç…Äw`õÅâTÉ z`”G?ÂéNóÀ¡n&ÿcU¸Ó>´OÀ%¬#»F8ÑÉŸ¯ÔÏ‚X<—¥¢%¬ >`ydr»¼زp¦_yãK–î â¸Ö +oPþåµhža¡¡›‘¬m?C!êøÆ÷Êi 'ØÿÂ1>ªQˆ/EÙ]¤ B§¢RvnÚa×™Ð=ÔOiÜû¸ªo\&R þ FÛ½Õ~üÂ¥ Ä7õ»Â)“©Ñ½¨E.wã¦!Ž$ק8K“qu‹5”æMû²o+Š:x=µµÜK9LpÌ-ùºÏZƒI<¥Å±ÂsCðE2†›.a»€‘BŠ[„*!™£âs›Å•ªÓÛÈv/íõ$òºè|(@öEžÖfº ÛuËVB±¼§ßö»½[Ý\ÿç·»åêæîöAryÜÔÇR ðÚ9â@¿tð"éx˜æ ÿ^ÆýĤ€àb6Å>ÎxåIñ<¤˜G‘)©§EªåêTÖBäê|Èr“.G +êŒÒïØd#Õß~’ˆA°nqŸVU£üsQ&?ý]ò_¨:Sà¤Kuäðq”AŠdu+n½;V­­¦%²1>J&çÖ·«ºÌÖ’×âæZ6ù»’\>ŸE–i&£Ü»ßC§¤ÜK nkcB7"tnDùñˆ±èŸŽŽVÉa¤‰#¸Ø‰$Ôåp•wÃiMi4T*`4ãÇ›}›n4ëßéǢúqËÓcp  ¦BªV7QU#„·±Ÿ](8{ðÇ +þ©ÿÓÓüÂä¹fèŽ4N|ÙÁÜ“² ~ØWýןyÿe æBendstream endobj -1629 0 obj << +1787 0 obj << /Type /Page -/Contents 1630 0 R -/Resources 1628 0 R +/Contents 1788 0 R +/Resources 1786 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1638 0 R ->> endobj -1631 0 obj << -/D [1629 0 R /XYZ 85.039 781.388 null] ->> endobj -654 0 obj << -/D [1629 0 R /XYZ 85.039 761.463 null] +/Parent 1766 0 R >> endobj -1632 0 obj << -/D [1629 0 R /XYZ 85.039 741.337 null] +1789 0 obj << +/D [1787 0 R /XYZ 85.039 781.388 null] >> endobj -658 0 obj << -/D [1629 0 R /XYZ 85.039 609.877 null] +742 0 obj << +/D [1787 0 R /XYZ 85.039 650.202 null] >> endobj -1633 0 obj << -/D [1629 0 R /XYZ 85.039 588.884 null] +1790 0 obj << +/D [1787 0 R /XYZ 85.039 621.404 null] >> endobj -662 0 obj << -/D [1629 0 R /XYZ 85.039 557.961 null] +746 0 obj << +/D [1787 0 R /XYZ 85.039 591.638 null] >> endobj -1634 0 obj << -/D [1629 0 R /XYZ 85.039 537.366 null] +1791 0 obj << +/D [1787 0 R /XYZ 85.039 562.043 null] >> endobj -666 0 obj << -/D [1629 0 R /XYZ 85.039 476.315 null] +1786 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R /F14 969 0 R /F36 955 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1635 0 obj << -/D [1629 0 R /XYZ 85.039 453.599 null] +1794 0 obj << +/Length 3869 +/Filter /FlateDecode +>> +stream +xÚ­ksã6î{~…¿3S«zP¯~Ëî6ívö’\Ö37¶³£ØJ¢V±\INšûõ‡%êa©Ýxv6¢H€AÚYØðÏYD¾e{ñ"ŒË‹¢ÅæéÌ^<ÀÈgŽ@¬deÀ¼[Ÿ}{À¨mÅv¼Xß·x|KùÞb½ýeùþÇ‹›õ÷·ç+Ïó–Žc¯Â0Z~>w–ÿ~wÝjyo·¯Öç+gùñꆅ÷ïo¯.>}>ÿmýÓÙ÷놕†‘?Ï~ùÍ^lçŸÎlË‹£Å ´mËá§3`Äò•'ïùÙç³ÿ4¨xL-xÖØgû^dù‘7ün/0¾Ûq\ËsÜEèÛ–o+þðïÎW¾ë/×)7^²Ý¶x©ø¥ÚEž–ür_äy3RkøÛËË›÷WznýÈ­D^á ˆfá„–¹‹•ƒßí2ýóVµ ,„JZo{46‡²Lwøœä0‹ÛŽËsn<»¬.ÊtK4í¹¤®ËìîP§•E£+“%Ÿ@>÷¥Q¥å³þþ2Ý癦l|êNže™¼róóÍõõ§/W×ë—?ùxuyýåÃÅú☪ºÛ$uVmÜæ2š «©!œ½‰’DPÛ"íËWC‰Üî%ðVΰ3”&é¬ú;ö«åÞZɞ׉_ž¿w$ço/ß#«ÀrCˆ5nlžK¤IØn“§†0™bŒÜ»Ñ²Æþh™gUͨYìA 8ËìWÛQZÀØM3ŸqfÊó+žVö¾‡—ø«5-ϺCÐWnNžÎݺ´+b*Ùi0œ.¬ÞÙ` Ìáü'l­ÄÖX¦ÄÁ-Ã'ì8€€@\a®1ó`Wˆ&çNä:¹ËцæUås?ypý²†pბyŽšOÆú'©—:V¹§áVpÍp*Èúý·+w‡?é„?kš?"³ëtù{"á=4Eʺy¡€ ™Ö6à?Š,e`{ÿ‚k†ÿµË·ÏžçÚ–ëžFý×4{žëY +ƒ³i¬ÇW“§ Ÿ?ƒ‚k†A9WÁž£g׌‚™ëÜÞ’··¾OŽm²Š·¬¾â-<_SÞ·S§f”ì9ã¢/Â$ÜuKãd‹¯×,Ïtw#&Ñ,JTÖ‘•G€‡›ûM}Ð%]ÛÈ×Vc…m„¤ýüȲ}÷¨Ûn8âá~º±5WÁfsÆÔ˜ Kc˜9C› ¦í¬GlÔÌZbà«ñ†ÐÍ5ü¹þ4´±ØŠQã ê7˜£šdÓµ4 6ù†È ¨¡À}÷ŒiTÓŒA^»ÊdìãÕ%ôµDªy7ÙÞ{‘¸Ïµ¸:8#fl'1µ= _9nh…¶×)Ø_ð™vïj”Áª´ù +^¯¨3Àeîñ™‡—9±) 1®OÁµ2\× +€w˜¬&4j»è XTÓœ¹v`¹QÐጮ! / ¸x _ÛO+p§yÌE8±ZMû踓Ð@3^b’ ¸‰½1?aÒ3ͶͻË&Ñ£ìêØ[]‰rüä¡j^TšËHR¦ÜØCOq¨Ÿþ¶ÅpÑ#ñâ·½TÂF›ä“ë6BåÑüÀ AÙ?£hB!4§)‚Z!}z£ +1èI"ïm^©Eñ!¥årb»:wyÂÁ8ï w´w¶Û<"`I7i '»-¦a7G¡¿5kùN`JáëK§‚kZ\Êv¬0Š;â÷7JÁú÷œ“ð¦qÍð¦bº²jòÖ‘>wƒ—aOÂàšá.²Áiv íòvÇUkü÷?aL×l:ªtc*Á5ø*A+à„ÒˆYk¾HÙ÷î¥\2jáqM:…@ÂySÔ\+ÙHÔ•í7'¢AùÁIxÓ¸¦ys¼àvxÓq«›!Ù–Š¢Óp&¸f8SåH&gúÎðXD Dé’‰—A_Þ ±Ç£«ç€G˜ñå Ì„+g˜9O>AM;ò±Q?Þkðškrúj ô6ç4âÏwZ<Í Á¢ìEÅZé(Ë9Ë”Ø|¯g':*uÀ)Ií²üŽú0†`NK-ЄšhNOSµ¢úôF5eÐkTÕ‰­mN¢åm¦JœÉø¶w¡”ŽB›™§KdÐn ŽIÖV¢Íl@   É +Ðœd§jÉöéJÖ gJ¬9»NÛÉÁ›®S!®Vñ:UwXÝRa]Ö%]’úkcØ¥/:扨|?Üâï<äîÀ—ƒŽØpÞ´ ´0Ç-@`f `Ššè¿OlLý1®tyx*<¼ó +‰ˆ zmQ¾áZ£šf ?tLöØ1ï›Ó`´·kÁš•gKy +oeÿ“U®Ú![tʃ>Ÿ¤“åRÉc— ·=IžkC´¿ÂÙžþƒ@1¯ÏH sÜ@fÆ@¦¨‰ô‰H‡˜o'|ÇoµëëQØÎèÖ{8rb‡æ-ùhióƒ++ÜNlôà+Çâ&vë þ3³u¡] Ÿy.}Ëþ¹a÷·?äøy“†tC|²µå&›4è—aÿЌ뮡|TH'aø:vz€³%ÌS›~Ý%7Pî2¹É„>Í£Bl* u=`Ÿ’škÄú.võƒqtü—7è7Ãoj˜Á@õlÓ¿úP5冠ÝÐ:Æ‘”¾þÐz4\›TpàC§š»éð±Ç.Rcÿ‹^×ú¢-±Ó;/ÿ¦g㎑uÿY oúqfó“SÈà#/>r5À Á(áàǃ òοÿ¯ïyøendstream +endobj +1793 0 obj << +/Type /Page +/Contents 1794 0 R +/Resources 1792 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1766 0 R >> endobj -670 0 obj << -/D [1629 0 R /XYZ 85.039 343.455 null] +1795 0 obj << +/D [1793 0 R /XYZ 85.039 781.388 null] >> endobj -1636 0 obj << -/D [1629 0 R /XYZ 85.039 311.93 null] +1792 0 obj << +/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F14 969 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -674 0 obj << -/D [1629 0 R /XYZ 85.039 311.93 null] +1798 0 obj << +/Length 724 +/Filter /FlateDecode +>> +stream +xÚ¥UMs›0½ó+8Š™ JñqtR7M¦uÒ˜žÒ0`ÃÔ†p2ɯﮈ'vséxlVoWoß®VXÚ>ÒŽ4*¶ÃHrEv¶³„½Ï¥%‡wqbÎëÓ—¼‚Ç"¶“õæ¾Vv’ß³‹¯³Ûd~ç¸J)&%wÜ0ŒØÒ‘löý|†°ÏnauwµHW²«Å%ÅÂz~·˜}[:ɵ5O&)SH£Ž?Öýƒ°sÐ|m ®âÈ~[p îB¸öÕ°ÞZKëÇDE>ߦ]§ÊÖ*â:RÇuK}P·T1Di;Ô‚ká›ÂS(#Ùc[AuµãE¬'¤Ã2‹ö ¡í–ðâÒ:‡ßmHÄÖ`7-Ù5Ú}õKH¬ ÷¥=R75ô4P[¦;Ç Ù +ihO¶oaÑ”}ûByö]Ñ‘¿/‡D‰ØCðŽ€fM±í‡^¸[›Ò‘¶"ÖõòM+Ø}‰Â0Ià±ç²Ê0²$_–Öd¬ÄÔŸþ&7­Gr"Á¶êzB›ÁÛ m“ì©ÊŒÝ‘£Lcå¸Ø]ã3ùV €‡,Ûhü9ùͱTõØÜSuOª`fëÆt‰28ˆ¦¦©-SdÈÍ ÂòOĈ‚-SÁ›¡=ÛWäüý„Kéq%=;1tpr0Ç÷ ˆÓ?L/âALLXH2*ŸKõqB +9Îwò"äKÌ”‰€uÕë`U=‹jl)Ý¡A)üHZN-Çý¦c4{ro‹zÓ—dÓ=3æÏÅÕßôyNغ2t}kŽycøΔ¤]}É_i.¨“ìxDV8ê/ýXÔpòfpa/‡¢!¦+Zõfå…ɘµÕ#¸ú¦=#Üè‡'JÍ©À#î@øIû”OŽÖ,Ý´'bþªÜ‹O=|©Àÿz×Nÿ ¾â‘ŠOÏöB˜WЂ Ä{¹ã+ùHï_ÌŒŽendstream +endobj +1797 0 obj << +/Type /Page +/Contents 1798 0 R +/Resources 1796 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1766 0 R >> endobj -1637 0 obj << -/D [1629 0 R /XYZ 85.039 293.727 null] +1799 0 obj << +/D [1797 0 R /XYZ 85.039 781.388 null] >> endobj -1628 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F36 892 0 R >> +1796 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F14 969 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1641 0 obj << -/Length 1313 +1802 0 obj << +/Length 2123 /Filter /FlateDecode >> stream -xÚÍWÝoÛ6÷_á§EFeUŸ¶U`2§ÝÒ®©g+ØC–UblÕ’èŠtü÷»ã‘¶âÊq€õa‘wÇûâÝg¯ïŸןDŽÄýñÄs‚ɤŸU=·¿Îï=OK¸ýÐqG²~Kz¯ßG“¾ç:±÷“%’äwÖôËYòn>A`ÅÎ`8O¬›„öWŸ?]^ßÐz>›^,÷ɇ޻¤eb:á(@ßzw÷n?7>ô\'ˆ'ý¬]Ç‹ã~Õ £À‰Â@ïËÞ¢÷×^ ñÂ>êˆdh$†^ìÄ~Ôí£‹â}¼>= Díxcgì <Ë £Èµf —â󬌗&¸ÍAèx`ÞhÆ]™¾]€V?²æìÛt•–ö4C•Ê3t?Vb‹áÛ)‰M…aG¾3rÒB¼_è£f¼Úl%£`B¼¦Íš=Ò⣠ï¯ôy÷¹³¿ïbÇñ¢{Ûl]ÇÝÛ—yŽûifO,<óßåÎRöDý´aJÅGA¶¶=äãr+W¬–E–JfÏ;“b̈“f”§6ÑS!X#‘³÷ë”c'œ;ÜÂ\tùþæCâ´!Ñ6ôú½µªC¯†Aì¸Q¨”†» Ç®õêuŸzI$È-r^¥Emˆ ¡èP¦eÁê?±$ñvEYÒŠo$ˆAa¤@ñ¬G¢¦ËƳª Ð$é@9®Õ¡ªUZ/µÙB -b x*ð¤Ø¡ or­°N~ðs74A¶2hF>”/¹Üpåšr¨!V•ü1:‹›†=l¯Ì2$–êN`m7ƒ!æ©ÔŒB#gÈ™X¬Î1|L$’ymT¢²eaÔʆrƒ*„âIIç`_øV‚DÌx!HŒRŒÊÒRéÐ.qe7Ë„n7u¤r§Ì°uùH@š>HÖ(FÚäÆ/‡JçXÚUcJ2yÚ‰IQ1¬ÃVw̳‹S]4Ï^%çûuÁšï¬™AñïàÞL¹ ;Éì´ÉBÒ„H2¶=“²â»$6i —¾Ñ§ŒO§ŒÅåê«“ýûcƒî£~&ìV–q2m{Ñ>N­xÖßÞ@*_Š9Ï„t0w&EG˜ŠJ_S·Ô ¨ Éu‹Õ;‚n8‚Ud©›ÆîUØ€”}v…X1Aâªá[rÕƒ5IªA6\ïøc@£š«È hhäh*õ!\Ë”6bKpF»T{ ák-d*ñÙ<XP½xÀo9X¼*@ó¶ÿ?ô†É?ù’׋´R_ÓŸ·êìZê&)7¼Qû1í>²ïëö‘ŸÛ‰Ç vè‚­R™­h)W\èñ§Ð“ÏâòÓ^Ðá­I§5—µžöNIRåi:Yí_y“ qÞ¿RF"Œ7 +C0g–;‹}× “Qcc–¨¹„ +2o–¯^¿ó½‰ï¹qL–ë‰R¾(ÏC7 ÂÉ2ûä(:‹"ÏYèý£žÎ‚8v>ÞÝ/0Jœ»²ÍëRïšéï˼z»ììsVшGÞdænø/º'Êõb¿ï® +iñÀ]Ú¿òçÆ]W‰Ãï¦Ê¹ŸÎ”³·ßMÏÑQwÕ·¼¾æ²Qö¢W'öJEå¹so>ðÊOÝ$IØ«å6'¼ØYÁŸ#¹P×y9õS§ú‚Hz?õ磞p5‘XFÔSf7â'NŤ†Ea7à'd@9b=qVú ¡ Ø! +-Ì=ƒ9m%ÚŽÝÔ$Qôß(ªÖ"ò‘H’4‹õ7l%¯9 p² + )Ònáq /§Ùê:—¡ÆÝã~_•B.9²ƒ^áuU‹ø=sÚ7wB(Y2u¾)š¶Ö-öVA¬ ™ŒëœƒSípmQ•îtúPÏ÷ˆ]‡Uåì±@ïh¿Aà º6Rî •u>OaGª¿ ¹àx¼~ÄýôH\•úŠžë¥’¨§/‹·¿½}øòïÛ‡Û‘¯Êóœ¿S"“o‘ñ'K‚ÜòÃC_âË?ïK!ü>r?°róT” ›¼¦ú¸Ña] 3 oùåáÓÏËÛ÷cFÁD„OvŠÃeµLþŸõ׬¼ ?©Z¢Ó-Êͨ[]8u¦V”Wz`è³ +ÂæoW7f"ø¿þ(Ìb×O‚Á©ßör§Ø#±v¨½ ”Bÿ.ˆ@£>‹‹Viùù6(¿wE&S:BS¯$:,Íž±¼mYnóB–ÎÌ°ïð§Í®zÔ;9f›Æ½ž'ŒMÕœ€9N]åúç„àGñJYý•3?J.ÞŸl¯ƒÒОnE¦¬äw9MŠ8I½©ÂŠ†YþÙSai6“…1·šÔ2Ö²`M9¡”r~{K㣲sPT¶#Hú‰†””wÀµ±¡ª‹MyòFsx»ø÷â›åk ØÚLcÞSˆ=%Ø“Gœø½ùë Ú•¤3gÁ}&#\àlj€>MMmyfZSZ¦Àõ^üÀ¹ÏÛ7˜ +R¡ìZ0˜¡t%7ÙȵQmr:é Sç×_ƒ¸%8·[]·ˆÅÁ DùY|I쉣‹íDL#9ZvshEˆ¯>âÉýaö,{Aìté EÕœìšM ÁTäÑLŸ +Rr¹»ªÌû9,RÎ#úes!bm…ÒêÍ&7µ.¥WÊñ2]n¡†îEA}B˜$¥sò°•~ƒà 1„JÖ™LÀÐ4|¸Àþv+ä¬dVj³­ õ$3bçt– ï«Ö¸a{ƒ‹ŒN­DÓÄ4&©iCR®OÔ|^¯{yÄÃD…#šÆ…KË5¿îžEôÚÍXz²7ïU‚˜ç^Ãh×ef\kNŽT­a«ù +Yº«XQWq™uþ™]Ô¹ìA ¹# íý_àùg:Kï£G¨¾ÈªÿîºûUR.T¦®$Llp•Þpo¬Ñ™Ñ€Š›^#Å…OˆKuÜIsŠnۜ˚Tø ¤¬»n9¦#Æx˜Ï1>õ±ëJnš¾3H¤ÄiKUƒ$õÒ(† + I‰ßa™cy¯÷ü)ßaor_öi›ÔßDâÝœ)cc[¼x•Ô&žÆÓaeÿt­•ç‹mn6¶ª8çÃäÈÂôì„@9•Mä4s™›Óå›po-ä–öfdÉî¢é·û¥ð>{‘'—urÙêsŠEÊh¡*Ë›V&”+/ì–2©YÛ¸·?†îîуŧ`VaßÉ«cûŽ.Ò`>Þ9!µªÝN‰qä²w.» 02Û“—%±LÓYìt-„Cïf¬ù!Úu#¿’íbˆJù‡¡ó±wV×Ú—¾—ßlê'sy ¦g ž‚æiG¨[È%…1??!w¿„ÀZÖ¼ÇF;ˆ™ƒÊÖ¼T)_ ^Û9ÔŸ”„¶âSÖu\lßÒ^¾VoÂÀùŠCÈëgÌ|è±±H¹Á ’`d®`Xȧž{ÿƒd®g ÝË³Ø %·öäZÆZ-ÓG5E[XkàvEÕtV‡2—¥ÁØOÜ=%;E¤|èÅÔgh[*˜VåŠÓ'åN”#ߦâ¯Ç¥ êyI…,®«½Lò^„žeM“þG ælµq³¶ '))³S§z¹µ2ßhªD:¢0íá_j’£¯rÚ9|uK [`7]ùwë|µ…|<¨– ,²g ï«cmßé8 žL@ò¹{Ê‘¼1Ñ,²’¾صºò=¯„d<q÷Ò«¥å§KŽ/­SHó½®ÿÃôLèÚÐ3ŸR¨\"4GÕùy+%2knÚíi²ô„š—F»ý°ÃÛ|ô4¿sˆƒkEV15± z'Ú¦÷TjrkGÌUe>õ¬Ú<ÃA'ó³Ü~8 V7ò›å:Ã%Œ®´pg02M㾜áÉ*“˜ªïa˜°7r/«Þ“Vuy¬z£ ø×µdsïe½Èú‚ûk(´Ú´ü˜ü« ûñräd>d(O~÷BÂÓc+%ë^ùHK}åðíÕOµäå‡ÚÀ‹Ý Š28«s{QºQ\7ø'ÙÁÔdendstream endobj -1640 0 obj << +1801 0 obj << /Type /Page -/Contents 1641 0 R -/Resources 1639 0 R +/Contents 1802 0 R +/Resources 1800 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1638 0 R +/Parent 1805 0 R >> endobj -1642 0 obj << -/D [1640 0 R /XYZ 85.039 781.388 null] +1803 0 obj << +/D [1801 0 R /XYZ 85.039 781.388 null] >> endobj -678 0 obj << -/D [1640 0 R /XYZ 85.039 761.463 null] +750 0 obj << +/D [1801 0 R /XYZ 85.039 761.463 null] >> endobj -1643 0 obj << -/D [1640 0 R /XYZ 85.039 743.459 null] +1015 0 obj << +/D [1801 0 R /XYZ 85.039 671.062 null] >> endobj -682 0 obj << -/D [1640 0 R /XYZ 85.039 102.539 null] +754 0 obj << +/D [1801 0 R /XYZ 85.039 671.062 null] >> endobj -1644 0 obj << -/D [1640 0 R /XYZ 85.039 81.546 null] +1804 0 obj << +/D [1801 0 R /XYZ 85.039 642.326 null] >> endobj -1639 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F37 900 0 R /F15 895 0 R >> +1800 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1647 0 obj << -/Length 2019 +1808 0 obj << +/Length 3445 /Filter /FlateDecode >> stream -xÚ½Y[wÛ6~ׯÐ[©žK/}s^Ü&rÖROÚ>ÐmñX"ŠŒê¿s)J¤ìœ•wã —ðÍÌ73€,ÇüÈqd„§âqI¡¢h¼ØŒ¼ñ#Ìü2’VÂká§~œþõ³‰ÆÒ±ç$2_þé\ÿzõiþÓÝÄUJ9±˜¸a9Ó9÷ßß~¼º™rûîÓõw³ÉßóßF?Í;G¸Zè@á_Fþí—ã·‘'T÷Ðö„Œãñf¤F+Û_f£·»ðœóªMÜFÂUžˆ"ݪ$Í€Jõ.È2vªU6‘Î:¾çà tvY‘óìÓÄœôÙŠ‚`ÁM’Ë¡¿ÀF çm…SÖ. ’äKøð‘?‹Ü¹Ÿø¡“àÎÏ<óP·[ápúŽ%‹Ø&»ÎîqQQ.ˆ÷+\°ÀW,›”ö\DGáð :B¢‰b²@ú¥Î¾NLà$ë4Ç}«xV+ϹÊ-6?öØP¨"õö«‚ëâq‡-8<ç‘{øÙ0h(„óÕÊ66‰…Ik¤c‡W‰Ý¨³Aj÷,©Çx0(_¥KžKxÃ[¹®ÐÚ„öÙzÍSxr‚¾’WlR­ $…,O£$ò¥FMŽMˆÓ–ÿÀì–13FôYX9·¼¹¼À}Jâ£çµ°7hö¼ï‘S;ò2mší^FAB‰…z ¿wl»Žq Ù&aV!,y# -¡ ¯®)§Dwí+"1~°Q¦U!“£+qàÀ1ì!ˆü¡àή^àY+î!U´¯‘}¡$°(³-¬¨ÞA_¶Ëâ/Oê5[å·IE;ø•¸n³7ïí~ß'Û-³/)¿·h-€{2ÛÃÐs‹š+‰…DNL„÷MtCÛ®b·=ò`q ZÉ#4äM'åÆ%®?q‡M‘ žvõæ¬ñç¼\;aeÃùÎyÝ@Áây•l¶;‹»± Ž'ͪ¢QÐNá)Ùc^”:Ló~lÍ9Îbu¢Åð¹in“J$^JPfY]ÈÚuºL˜&PÉ—ë†7i›¥ZS£¨œn®xÀg3LƒÉ:£¹ÈÏÒD™UÜÐ,DJ2« \ýOÝ&ãHøJ6ç¿zåW‡/üvæU£ÛâU•uKZR!ÅhÁÖB¸1RS“K[ôè†}(¸ÚÞ]7?œ*æúžÆÓD|¤ ÐÒ—"’1c>3Býš:¦2z|HÇE´Ó©;Ceîmõ“Ç]¿íR@)!DvHvt}lü_P{ÿL;ÿ¾Qê‚Â4öÖtÒ¢.[ºsˆ`TÐEô]¿Žµähvø¯œSrÐBã‚A)ÍCdí¡ÉO9½!|÷ùqE¾K×I•5‰˜ƒÈNaqb”Ô…½¦}x¸›s)P -ÿ8JcÐe@´¨ä4øy¯»M¶vá×S^àa‡TH ì| …§ƒsH8åw¡ôXÒ@Ì9šökZ²q¡­Ç~¢ä!åJ®3-ÚW·Ëì…Ç°0Qü-ô>­[,\A£‹ ª{ -Ń·ëötw F^Ês&}é@„&º˜óSûE1 Ï~xêÝW¤€lo¡J?M™@È ¼Ø ?âWÕø²Ã7oÿ¾bâWƒ÷\슛¼JËd¯ôô£àRñ6ðûÙB+xƒ+ Ö¹æ˲EO…{˜7Ñ r€'‡+¹Ü æËÃËã‚?-Â++P¦÷ŒlÂ^d™#üΟœendstream -endobj -1646 0 obj << +xÚ­]sÛ¸ñÝ¿Bo¢3Cü|t“\›kÎikgÚ™»$ÑŠÔ‘Pýûî@J¢}éè$°X,ö{ +güÂYžø*fYú*Ïg«ÝU0ÛÀÌ_¯Bˆå'q ï“ ;»H#?ˆ³IÙc‘……¯âaþòpõö§(˜EŸ¦jöð4 ÃÈWa4K‹ØU<{Xÿê…êz‘$÷°-¯*ͼ/{x†ÞªÝ]‡^Õlxôþö|I½ûcoÊÝõï?_}xpûËöiøq8Ia0[DÊW™z•ü4Íàˆñ˜ü0†¥'ä?¨òýp_®]e®ö#Ó\5L²Ù^/B¯äyS>Û#áð/ó—Î’°ñëÔ:"6LfaàAqBl”ûY–±Ÿ›k¦# +½ö ŸçÆ–ÕfSö†?ö0޵˚§Co×óøs…çÁ¥¡{œë×Kª`Hà*3ïep·¯Adȃæ:Ê=£ µ O[Jæ=í\DÁ„<ÎýëEÞíjEëy7ä +4D½d9¬ZFݵ5¬PÀüŸ9í«ÔÓü9×?Ž¸¤=ð‚®½^D™×žÓ†‡-pl׎O1g€¥î«þÞSåéf-»Ëê­îù¥iùIÇhQ| ½"ðy÷0>\Bg»ÅíÞ}¢³?b°– +qlÃ*öêê+ •òêµÞ³@>;Ûê5¿˜–Ÿz-s¥céMµšË˜î—c~‹àÓØ +'·%<2ïkïå¢cÙüû:‘¶$,<ƒ‚g,_q$§‘-J ?¾Ñ1º#~e|‚²«`9jã‘AŸ· {ÆýKíîL¹M´(刻$A@ð!³f+k«âÏGw°2øÖ `Åš·˜8ãºì«MCØH\¬>t:F‡€Ï o4Å¡÷„¢f%AÈÜ(lÓµK/|"%{+ïƒ&¦Ë&+]× ƒÒ¥ç ¹N#eÄ=a@¬xc?.΢l–¤!¸ré\ýú{0[ƒGúù +\O‘Ïžá=ðâ˜í®”{å¯úêþꟃDz¸#d>KÏrû!UŸÿþŽrúVÄl^ªPÞoATOüÞ•uùí:IP¶0æB Îs}ê=hÖ•kt0i” AÉ„}– òãwö…¨›ßªµÕ¡E ¼P½%)ü¢í˜ÇÞ•†Ö¢ÈoØvÛŽ©²vˆ›ÕÕª2õ‘gúí몓]’o{¶þQ-1yÿ-Yu-ð‚Í#¤-( ¢ýÌŠÆ{6´õ¥³ú ØÒI+¾kðé–7<Áyá4H9ïÛŸT:’µ3"øAž‰Þ?Ü>|¹‡S€Hz½{Ü”æ¤v`—ÇLj²oa +¡@»ß}¾{øðŸx“¦ünnø“A§ôýñËý‡=¢†ÝÉJØ©ìûGÓ~-Y~¨£"~—iÑœüüº…à˜ÖíNW€c2PMÀãÁn†ݾ{÷ù Pø·Û»÷Ÿ>Ìa)81ôÔx.ùI9U$.:[dm#bÒ +8z÷åÓ'F&[_‰3×ñõÐ[íG@t8ø!“}< ünÏÑ´3oËï{vø¨ô²ÿMõÈïŒÏ«ˆ4žžÑ¥ÃMNâ=k#"îGªhI§wKYeU5RgÛŒ¤¥Ì-®Ú¡{E[íâÃ(áÍ +b*æ1ëÁé:ßÓK@hm¨†ÓâPî½ÙáÈ¡7oø{ À÷ûÁ~WÕoA£. +Uxwm·ƒ£y•KT`‘È>?ÛWölF^žøITR°[¼ä:É|."øí|]¤~9çE +Áµ!›Š‰¯ÒÐíˆÔÁ¡»ëm" +2¦“éÆjƒa{æTócƒ@í`9ê=;T› +»ü‡“¹(æ¾_øùa|©´Íjð»ø½æÈTIª!ªq(BxyŽTAœ±ó8+i¢°àÉúë½î{§ú6û3vQ_ž5Ð4åOø/>D4’‹ƒýßZmý³µ€p /•57u‡º›Bò…QýÛØTùу?Ûd¶ˆ8W¦H¨âšÂð9„¼¯%•0¢í†]Ì`råžçuÜ%lQæˆ98ùÈ4Áb¡€–è(+˜ŒfÎþ'7¥Dä(˼9eu :]‹IÏyjd¸F{¡Gîwqä¢@ãaÝ;z2 Jt®esÓ‹c‚$Ö”ûï{ttšÝ+(Ó:K §Íds9[UA…Æ–õ .©°K¡ìGhËr„²Ï–ªË?%²âæVq Dï’öbø¼×äK—ú† Z’ƒÀŒ0“í´áCæ +–^Ò ÈFÞrªdlAtà°UžDŸZS…™QEõgì´°qHQâs+0aà%±’ ,ö^.ê,º(»‡H 3ÛF‰ ö(Ç +*H\0c1ãþ\8Dœ–ry¼¦˜XJ)Z@ïhqÂ×=ݸ9Ý•Œ +ì /1{®%(íâ6OÂ!íM#Nk‡léxÒ+;ÙË‚–ŸÓ&3š̨\¤ÆYÉg*©ý}LÊ2ï£LØÔGhj9*‘àÞèT‰—Ì ¤·ö\–šÃ”™ö‡e 0kïqF+ñ9}0œqžÞ“2›‡°<ªÖ¶5SS‰=ç©'ÊÙ6xŽ(Î]ñ秥¿ã¬à$dDUóF!.±)\[:Ád"¨Ëw×fý.ÃŽ¶vÃVO-"®r\+ÉÖ&f%M’Ì*® Ö'!PIkqOR‚g«R•1¶¾‘ØYõ%ýùZéƒöº+•Â©¸ÆÇHFXSï2<§¢žÂü¡¨K]û NVÿ`˜Ü¿8^—^$£22±ÜHO¸5²$ìi¹,»¬ŸxU%‘W0QF¤/6L*Ê ÙJ—Y.T CÕDnH”6U+®ê‚“/¤{匘“/¸œxTÇÂhI5,V]*‘Bpݾ¿¿áù¡ˆ±ÃÒ4­l7D€dº•‚º.­'Œ¹©:÷ajÖ}’T³¸Gû‰‡ ºqEÇJgwû™»¸~©Åü(¯“"k"†ˆtr{’4!'œ»ª¦¬ŒÇœ§<jÜq·³¿tF ìۦν໣š"+T­dS0Q—§y[” ™΋{­«Õ‘¨ÛůŒÃê( 츃(±hè‹F`R–€#¯y®( iÚPs™‹&œÞžQ5aoLÀ¥”çn«ZòòNÊ‚}çšœ×ìm6߈ÚHÇ™#컚@v…ëÙ"§‰Ø¶ÙÎֽͥôþåf,æ‘d‡Ž‹‡Ž£{7îædÔHäÍÒ˜ò¨)mS¤m0LW˜˜•Xµ ¸„¤íÝ%ˆfñ”‡~Ëú»\ZS ¼”6<]õ. è^MçÅ%‹B·F¿´—%ºÖ°u!ߘ;©¸ßNÅÌþ¬Ò@ĽŒpÉW¯Ä$ÜQ çú ¥ \WÝàêãkj çÔ–c‚IUb,2€³‰_’î&`ŠzAQváú,€qb~’fFùI!ºƒÀ8´D!AÚ ¼óó–c´´©qR Û&â†R$}xÚòëùK ‘Kb¯‰pϹ„Oê˘Ê9‰JFÂÐTUxX©püV£àÏÚQùQ2 ãÜO²ì‡º‚j1ÂuÙÔˆŠÄO"å6Äc¿§ö÷G¤ßÞË‘m®EǤ ”á:ˆCðVKð…—U465ÐKÉ +Æ ³ ‹"‡s…áY#Èt•å*ÛJ'O¼§Ëo|csÎÓißm€‹›²ä©³ÏÁ%Ë„ J@›]þ’KlgÏ“h&=­žøšè„ŒË ÐR?Ocj&QþC¶¸#d—Ž“ı .@gW@%„z⺊#?NûGå(ƒ ÷zRËr–@Þ»k×ýDVfá 8àâçÃ}áV‹Œ¯v¥Õ1Üvâñ< F92 •ôµ²~æ×. ±]n'ʉ@Ÿ¨±› +±7è˦¢{›—ú?ºµ$ÝòÂÇ\²·9’ëK”»9œ-ÓeðÐ:Ã.Ì™&)Ø?ˆ¢Yû*ÿ±›2‹j1àºÔ#¦>x »5pØ(0™ò‚Ào£þ/ô1¦×ÉKA¢Æä‰$ÉS³Bñ=2Ôu®á]êë’›‰5º+7£+éßƳËU>ÙKÃîqx16Øó ~86cu—§8ç2Ý`—.*‚Q_>(L⋨¼U-\»Ók»¤•§Ds|¿¸ŽÃ%çè$Ŧ9(‡½ÙÐÝRTä^/Hí’É> endobj -1648 0 obj << -/D [1646 0 R /XYZ 85.039 781.388 null] ->> endobj -686 0 obj << -/D [1646 0 R /XYZ 85.039 585.174 null] ->> endobj -1649 0 obj << -/D [1646 0 R /XYZ 85.039 556.439 null] ->> endobj -690 0 obj << -/D [1646 0 R /XYZ 85.039 440.216 null] +/Parent 1805 0 R >> endobj -1650 0 obj << -/D [1646 0 R /XYZ 85.039 421.95 null] +1809 0 obj << +/D [1807 0 R /XYZ 85.039 781.388 null] >> endobj -694 0 obj << -/D [1646 0 R /XYZ 85.039 421.95 null] +758 0 obj << +/D [1807 0 R /XYZ 85.039 761.463 null] >> endobj -1651 0 obj << -/D [1646 0 R /XYZ 85.039 401.356 null] +1016 0 obj << +/D [1807 0 R /XYZ 85.039 667.044 null] >> endobj -698 0 obj << -/D [1646 0 R /XYZ 85.039 203.603 null] +762 0 obj << +/D [1807 0 R /XYZ 85.039 667.044 null] >> endobj -1652 0 obj << -/D [1646 0 R /XYZ 85.039 185.736 null] +1810 0 obj << +/D [1807 0 R /XYZ 85.039 639.536 null] >> endobj -1645 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F20 877 0 R >> +1806 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1655 0 obj << -/Length 1530 +1813 0 obj << +/Length 3543 /Filter /FlateDecode >> stream -xÚí[[sÚF}çWðVi&Úî}W}éàK\Rß -xÒLšj+ Ž„÷ß÷û´c´8NŒÀ‰±¼ÒÞ¾ËÙ³g%™5)ü²¦U„Š¸i,#ÂÚæùUƒ6/¡æ ÁÊ´) Õ -«vz__*Ûd”Ä4nöÞMzoƒÝ?Z§½ýN !‚˜„‘168î¹ë½“£VûØ•;§»¿tÃw½WýÞÜ‘$R œãSãí;Ú¼3^5(±m~2%,Ž›W ©QR”×ÃF·ñ×lW'›®—Ç“H*Kb¨‹%ÖJ_E¤‚!fÞrêñ¶5ˆÿ]…,çÙáør<ú‡*Úÿ -ôÁU­ƒQ>ºÒë±h‚ z$Y6ÀŽØ…-Æ‚SE”΄EëbBc6gS뺋T„ö™ÅÁ#Î!rÜb(¦¿;§é=½)¢PqÁAår8 9±rj¿únû»Iú'HÒCÌÄ¥Ë'¦.ç²h‚‹ñU³Uæï|<š¤Øv<„›Ã$u·ûççã|4ñ&L•V¯$¡Õxpa`³G']¿ ºÔÞË|îhJ´f+ñFEGo*E8ÕÎ0:T¸R.×üËGƒOyr¯‡ V`¬åJ\¤70'seB L*þ2X’ -ú¯"ƒ;ùa9™z;Í@Œ¸xÇj¢•Ñ¬p]¦7œVŒÑŠƒ£È—û·˜ˆ1Â9»ã!#±RóóÄÄby)Eƒ×¡ AR¬BtõãhŒ7¾”wÚpoíší6žY1ô±¼ß»Ha@M¨8dîFßýÉòa¦¨ŸO>àòI“[àÄ¢íçP© 6æÉ ·ôËî×ýÔe -/Æï]ûd0ùPP -”Ëñ»Ðª~ìAáEÙ¼lR¤þS'®îÛö³äîÀé8‡6×mý¥I׈ôÖˆW‘ÜNã"³ „ÄÝ|1ÅR®Ù¬ÇWwqA¸ñïáeÍý9(Rb"C?&`ZšŸOòÔÙ袵EtãKËÏ0– R׻ЄM×W­†·_"8N<&5ñ `óqÃx-›¸“ôÃnËÝĶŽ\ù°Ü, ˜&Ř€/n@ØdÅxÄ+?k–säö~¶›ra36c‡¸Ô¢‚ -Xðm9ˆ»Õ ¼gIš=œ„öá/ Ýw=ê_%¿á` áÖ‚Q6Æå!+–ðqzà*£z ™?ëîƒìƒŠ­a~L@EéÁÛÇÏÍ¿6wkï¨}ìÒt'Ÿ %åØèwøñå"$cS6¢7~Æç›âÈ“Ì®ôêöA°ôüæ†×Âavº·(ŽýLïm¨ðâ–'Â¥¯óäó'¼^.U~ê +WVÃÅû-ˆø?ijT^Ñ–Ü`ÙOV©Ü×ég]X½,¹Ò‘Ÿ‚ZþcUq +Ë&Ù„×+Â%Ÿ¤ãTûnZ<Öm5°ÊŽÿ ô7jö÷ÐÞ>!5µzhµ@{…ËÖ™¯bÐÄí1§opî»ï ´·-Ú&ìöȶë®<ÑZ{÷\9DîeÇ¿ Š‘yÝ#Š·¸ó¡`Ò’?»všÛ¯üK0‚h¹~':ËFµ¯tBØF¾ +£ë4ˆIpo°Íh¾ˆãÀ»A1‹¦kqIê­ún‹­Äûùö„ûÏ%Ñ„ã‹¢M4g`KDKÒÌTH¢ýˆ¨%Ât+eÜHÇÆúz[ô¨Ú¢Å{‡g3€ÐLš Ç5âgܪeÚHX8JçÈOȸ£/y¤í„¤Y‰¶;é@µÃß²• +X—bÚÓS ,¢\{³§ .屇šÑÖŸ¸¿.¹s]Ïmj†š¦"Ð4øDqŒpœt¿‘™ðÃО'^cvŒüd=² ÃVèf¨{ðŸ¢uÝÕ¼cüþPà‘ï°§]s×Ý>H‘Çj;#St6,ƃ{Ð:eÝFÚ¯ð;ñVE¿W¤Ó˜ièR»‡âwsྡྷ„-N$/V“ÑR£dvÖÓ?Õ¤$(ÎEwŸ%Þ/óLá ¤ÙHbœÖ{@‘bÙµÃØï—c-§›*k³óå~ _ì 3†«7¿ÈÔà©|ƒåׄ^¢w|÷sÄ#Ö'\v{ØEn•¹AŠG‘—XõÄ›eVFKIEY „D)ððÊf:µ•j>};_ø“ÕÐ?žÙþhqYz±&¢`‰±w³äˆU Û 4vö«Op§5êö×ÂÌÚ„pvíÔn>K{¾-!Øïø÷Ïšb’Ô¨Æ\t©$¤5(änð~C» ï2ÄSâï7ÝŽÜLÇ!Õž¢ñDÃÔã³fú-ÊÛ¤ÞÕªêûJF«¶\¬‹-wjõ‡õ”Äà0ÁFè£s'JY‡ ~×û4wƒ C"BÁ™ŠOˆ/¶]Ëm5µÕ¹sÇw|Ò£8¼Znx#ªÏ BÙFɻŀü*_t!Íeï'KZï¦Ø»} jÞTƒ«|ê},–¦€˜@[‰ÙÞÝ ø—‚³Ü‹rO4—]Æ÷QøÜõåâÈ2‹ÖØ7n‡óiVf6ÜÈ&rJft2×Ry”æfØ_l%ŽŒ58ˆÚÂ%‹b“•ªC‡³ˆªÛî FBÜ«ÑzA7HMO!Å8ÆÌÁüb.Ĺ¬Ð¾‚ÄÚŽø“{˦î¦^·ÆqT A<ÂÎ/wœŸ9œüQ µÀSïl™LT¡›Dk'¨K;…ÇÑãÝ|øx?ñ4ãÌA±˜v¢b¾µ]_ÙÉÐLA î­Ïí¶ÖΘÀðef ã0ŠöýIìÂÀ²Ø2©F…‹S›!bæ,åكžA^žÕñ4úéé¸Ö¸¼F´!!-ÖJÖБ·<’¾0÷DǪ4ì{CX ­†º™¾]kªOxGiàÝ4C'<¶¬¼;a¸ä-6dnÐ{Wt?û8½Â¢çCTû%ÄFz,œþ„1¨3…3Dé” Š{B¬á"€nª·è¢[…¼ã¸‘‹ë¶Å«¤Iìðc)Yfü™žP"J#VÇ‚éËŠ®ônÔ3ì w¡'‚ïͪ°SmlSíâ_ak#¤µ0z´¦!ÇݺgÚÁ?õ\²Ó/ï‘àQbåxXôE„ U?`.îL2¬ÕTÓ!KçTÎ8ÍãˆB‹.U#ƒx‘…¸3°‰Ëƒî5m…¿![cDz=ŒÜê'LYà¿ø:sA½ +:fqÂÊMdpÀÂdæ•Êà×b´'ÔÂMÕå’ ò 娖K1ʉ˛jë_Š(~ÁÒ’œÞ³°ãŠIHÓíQJÌPìx‰‚툕à_Ï=®ñ”“Ö4?ër ÍÂ!bŸ«ªd™Ÿ¤‰å„;€ãHOVTÚÕË 2ÉézG>^åûÆGëÍ~èÈ%E˜pà] ¾.©Hsg—G0ÞWûŠ Ù³E¢$ytb‡õývÝsW·›|@oî¨ÈÕÌ«ºiŽ'´üYçÁrxûb¾„÷ܸv‡ðfà•…Uá™\c]I¾ÁÁLx3éYè½±Œ¶BJ¥Á '5¬œ^H݆¹Ùh„ Ül×øb!L÷Ïlõk4LzU˜D‰ò‚XŠj=Yè‡ÛÙä^i?(. r¯ç9-ɺU–øaþ³’œðZ8ÌΔä‚ØO£Ä®8Õ %ë¿ uR:;I²Ï#§ðzEÎ8õµå,¶¬QÏ¥ËB¾ÓÏ#ðzEºLû 2®p{2üÆ_J*xË7/iEzߜޅMÐÂÐF{RÈÔ°T|\‹áÚ^àIeÇÁÝ +q¡w⢷nšGÆXŒ&‘ŠÆ™a²œTÚí¨ ²¤'¨K‚ƉŸ¿ò˜îÐ\®ME*óÓ0sp³<ók3Y·2ä ’B“K:p^-/Ù¨­è 7€VW8?sª…5‰Ü*"G–K~1Ö“{S¾Ëo"Ð>†lÔ>¶¤‘'äÔFJ®\”3†z4x¬cïþèä]joßñMªm¤šãùï  Q³ÀöW²›·l¶jYšz\jÞ¡R)žàË€„Ù$=£ # aå§å”½±nzz4sk§X`*ÿrDömÕúI¾ƒKVæ‰Ü‹ZéÐ\6‘0ƒp5HŽLÄ> endobj -1656 0 obj << -/D [1654 0 R /XYZ 85.039 781.388 null] +1814 0 obj << +/D [1812 0 R /XYZ 85.039 781.388 null] >> endobj -702 0 obj << -/D [1654 0 R /XYZ 85.039 619.934 null] +766 0 obj << +/D [1812 0 R /XYZ 85.039 718.394 null] >> endobj -1657 0 obj << -/D [1654 0 R /XYZ 85.039 601.668 null] +1815 0 obj << +/D [1812 0 R /XYZ 85.039 691.78 null] >> endobj -706 0 obj << -/D [1654 0 R /XYZ 85.039 557.183 null] +770 0 obj << +/D [1812 0 R /XYZ 85.039 578.375 null] >> endobj -1658 0 obj << -/D [1654 0 R /XYZ 85.039 538.71 null] +1816 0 obj << +/D [1812 0 R /XYZ 85.039 551.76 null] >> endobj -710 0 obj << -/D [1654 0 R /XYZ 85.039 494.225 null] +774 0 obj << +/D [1812 0 R /XYZ 85.039 299.875 null] >> endobj -1659 0 obj << -/D [1654 0 R /XYZ 85.039 473.63 null] +1817 0 obj << +/D [1812 0 R /XYZ 85.039 270.47 null] >> endobj -714 0 obj << -/D [1654 0 R /XYZ 85.039 417.718 null] +778 0 obj << +/D [1812 0 R /XYZ 85.039 270.47 null] >> endobj -1660 0 obj << -/D [1654 0 R /XYZ 85.039 399.244 null] +1818 0 obj << +/D [1812 0 R /XYZ 85.039 249.942 null] >> endobj -1653 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F36 892 0 R >> +782 0 obj << +/D [1812 0 R /XYZ 85.039 196.354 null] +>> endobj +1819 0 obj << +/D [1812 0 R /XYZ 85.039 175.361 null] +>> endobj +1811 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R /F14 969 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1663 0 obj << -/Length 2581 +1822 0 obj << +/Length 3225 /Filter /FlateDecode >> stream -xÚÝÙŽÛFò}¾Bð‹)`Å°ysßì8Ùu€8ÎŽ² ä¡ERcŠ”IÊãùû­«›Ô•ñÚkc²`úªîê®»ŠR3þÔ,\/ÈfIªÜ MgùîÆ›m`å7J Â(p£0„þ…Å…Y]ľë…É%o¶ðC7óhñùòæ«o}oæ{n³åš€–ůŽòæ‹(òœ[½[éù"ˆcçuW5CÕlp”8/çÊi†²›/ Õ5ŒúùïËïn¾YNQ…®§®^#pƒ$¸²¨7SÑôŽ*tƒ0>¾£«ø–ÏVýÐé|07¸üè òíp6lϼlzàr[Î~ê;ûCÚãÀi{š œv­r†mE¯¥É¢…6qr$æwØ)›9lø¬ªçvhåì®ÅÕwxH!G÷íNzUÃg+×7ÛéA|ªs Ëz7Ü+ýt¼Ïº@â È._ãåš|¨ZD ëj@{^ÔM”ºGaFÔÐu¸‚ „ (GºtK¼^OOF2U+¢S‰P§dȾ$Zh¡ÀÑŽžÁ˜ØÒ\Ù îLkƒ@ãžCWö|œÙð3½ª Áãïd9¯+KuÛÓÍ„øä{A<ßUêšFnÊ‹*>Kàk¤»aÛ©šà<¨ÊZç%Ï"±ý÷<ð=gí¡g={N¯Ïaã†*›â’nùn’]S-åFqðçÂ~‹Ò“:¤Ý^ìúÒ°ÇKÍ ²@¯ê’GÄÊMìIZû|¢zÙÉYôXhÁ;\,›³“zw¾ƒÈY"Ж…w#ëZ’ÇÙoÕ´47ïdcQþæ©°1âtIÂÌ Œ¾ú6H&´ -€Ž*‚íÉþ­숤aà&¾KtÈ2 ¢ E™×p­‚‘ÒsDÊóÝ(9ÆÔlÜídQâú‰/…:s½è¢]U±Äâ;H0Âà‚`Ù’Óc#7Œ¢ËN—¦g^¶®ºÊ°‚E@LËv¤SÞŠäO™û™3œ(¿>Wnžy{(åé¥A(T´>±ñQQd¯ÆÒŸZNkÃ3~^è¼ESøà £ÇÆóÞzEy™¨ÅàˆV|ì›W‹².‡écçv5z¶®ÝËýۃьƒ±C&Ÿ‹±ðø´Ñ+kò¦v–eà‚ÿdˆ­¬×ñ­:t ÿFy" –L°ýÙxdDé«]uL ûV - ->@$Ä€Ûæg,üȼÎÿšœl7qõ½5¥Ñ‰#nÌS …ˆ¬5^eä ‡Œ¼k5§p  ß0  ´¶«ÚíkÃ¥Ýä6šâ†‘h¤,Ü«,Œ”ëyéãb¡°mcŸ\Ú¨?7a>E·ÇQýq¶!N|Ýv¼ÊDïÞ˜ü„ç$x  Ò§A™‰‡BìŸ^½üåÜMVæ¹þ¾çb×ÿ¥Ô…ÒìlBPAãÔùú§×·Ü#ºpÀ]RòT¡`)‰G^æÐðXqÈB§ýæEžÍ^xÒ%N‘þ`Ùh”úÚ.@\ÉU8L ñNu…ÐîªR0Ý¡º°¨¦œÕÉõp5×Ã$lwûJГ¯¬v = WÙ y\r™œÈùÞÃ¥„àb"ÇØd€ÑÑpùÇÏŸ^)z¨knÚ#ÁKƒäƒ33?ˆYÎ¥f0¦ßfÁ*%º¨˜ÿ~ÑÉtmÉ´nxU2 ×2ÆáZTÙaOÿj'b¼‚ËÆ'ᓚѾ塰l§)+"›QÙ‡dgÊeÛP.;›è÷”ýMd"’jLE²)¢ŒïHÙ/&Šd{\_±@$Ũ›IäJ 36,鬌ঞQ”:?À`ÅtnmTc<â4Èë¶Ù`å‹'G ZËÌxMëÔ£W}Ï+-’Æ$=çšÑs‘‡(Žª÷»«ê{f+h)JACŧ/ 8§\Êyo€ržÔÜäí^ -B8"³; £17}短õ™“D®ûobòà‘DÛœ¼3÷ïù8>6iý“xšÓ‡ï'ì¢ü›þ±ŠÊ𠵦Öü&sßâ8ökFâ¡„®°4ÒUj^ÕÎÚ„ªßš\^›EòÂÂ,Š=½£¥ªêÅÐG¡G¤Á6¿Ó„hRƒÈqbZêã™3Ê!ªå *(Igr©ËÑûR\!%=HhcVS^õD~ôŽ‚#2&8;le¹®úi׳S`(HÉNŒ¦J\O¥³Eœ¸IHvüíͯ¿{³Lèw7`›³tv}ÏUY6ÛÝdöyTßÜÞühO’•’–i yr?¤«xŸýÐ6Ì| tðFT6Bf!ùjì”<ØÛ$ù”„XNÕ—¹øn7I¢/€z[ê‚é€Æ©w)hG$):Bà°ÈüÐyÆ[Ï´ÁHK°#»G‡;­SL,ä™çú˜™ŒžËØ·ÐSÎ]§÷â¥;œmž‘ÏnxþBÉ:ÿûF¢ÁÓÈGen)ƒôéî²ÂdŸÎ|ÿ#å.þrGQÁ=}9áµS$+#¶ëÌÛIµ'ʦö$VÀHWH8Ðã §ùˆT´IÀ|°ŽÊŽÌhÓ¢©õDF*¨ãpע눼ˆã -ÓßÃàÙ/gB”†® -í¹Ÿ›ˆ¯ÿõòÕòôAì*/û,|ñüöLrÿGâó äþ€IÅ7¯˜ñ$p o°0PtÓqì“¢`»ïÊw6¶0ÕQ\ÐÜÔºÛ”tHá ºDi"Lžrã4=&è£A-ßoÇ’žý„føÑ°–ÅÈó(r4¥i6ÊÆý|O†Æò®Âpeh; ¶3•:/×|…Ø¡›& -Aö2£h‚ÛI²Óð”­.°áO{󊜽fq)J´ö9É®©†Š G„¬SL/K?»ˆüß*GðÁÊ&)ÇÅ»j€”"Ráiîƒkú|]÷Òà¬æ¹Ÿ‰£•`îäÀÜÔª#ÓŒKw[.¿0¥ñÎ+±7þ¼£ìì5Ì䋉…[c½„C œ+8©·#&†k~"Ç[qkÇàËêkç¶çÁÚKÈiƒîpW2:HÝxRwÈB©±’M!£œaãn›úž›ÑÊËœS%êÖË·ã/ f’ÞË\f PY>OÜ;º°ÃtÚnl¦mBi3®ãJÄY²èņ¹mN=jÍw’ÓàE¦zrœ<“ÊM’)Eèp5í¹Ç)f³7Ñ•" ‡Iku`íJVr‹(ºè„“*/Ð(µëÛaËWØÄpI)ÕñâÈ1“a?yqÉ_<“È,è=ía–AˆBq†8Øš %\“„iÌàñ\¢pܘñg"V7øJ¡¯ô¦CT{Nˆ9ÿrIÓž+/‘ÉÇÛåi:ñ5óXhCÁõ­¦ dƒ. 'B#ÐÄöÈfOgh=¹~øúã„çt†¦têAh"‡ˆƒ†›1 +E‘0à|S¶¬ÎèØa+ iû„œ:ráD¾.çÈsÚ•+ƒ’XMn"Tuþ„%-I÷‚ÉV{le³¯˸=çøÔWM+‰J#59EºµõAʯزՕ÷LbœB\{`ïØó]†ŒÍ¾¨© kº0c¯æÀÀ LBgYnüTê±™¥¾pT íMŠÑlLÎWÜp?r®{îð„ÄŒîQ‚QKÛb7]# ÔS„%‚Ù|Ò»Jaƒœ”¢}Ï L&6Ð}Å#·fs?ƒ‰¹I0zghe“Ø2m“uÖËÑm:²6â#OxÎÂÆã5bOFΘóK¿à¾¤oà®Æ+"¨5´ç?㥫I¾Â$†³i³¨{{ìÆMŠ§5L Y&ï+dδ¯øͨÏÌÄôÉF ;-’\Šâ°½è姰×eÂz¨ d© ¤3…`‚‡6Å¡zŒ§wu"^ÛCÄé¸Q¹´Ò…Ý‹ßA®F]Ëšá[[¤×ÌkÝTDבs3 Óu£˜3f[¢T»ãðY‰ÿ33ÙHsoQÞ@ˆœ¾ã•“TÉ4HÙ!¾£@aê`FN÷)྽لÚK~a¢ L%cNWj¢Rîs$€ÁöB73 Ø·3°†Û®8zxhÍ×öm$¤TÞšp&à|w°—¼EuÜÁbHOš’,dXmkŸL€LqQ`^M‚#¡æü^´€Bè]V&îµ@}ù<×1Ô@iT )¶\¤ È\eB7p Ì¾ØJT£5ÛÊ}3ÞOߺàølóšÝ£¢­ãÐFæÔ¦ .Y^Å.H3¼jíØ'«lîñòÍ›“pú-&^¼ñyË&Ñê×Øï«o!dAÁ‚—ò\/Ih˜ëÛõÅú—[°Ã Ä‹È»²i> û»®ÀÄÖ£’o/nîÞ}ü°¾úmÍ„7Ð(‘V'¬Öw¿Ü^ý|·þøãÕ‡¹ueÛmÞuw}ó)¯¥ûúâýûïîÞ­“Ñ«¼ºÛö_ŽG¿üxsw{})l ¨ay%2ñÍ©'Å¡¨{Wÿ¼çkÒÕ!€NUsJƒWäÙ§é¥s6Í +­ d";w5‰ŽÕø^ŽåEͯRh ãßráé±8ÜйìÍsƒtþÝM–ýþÄf€Z¹‰:ám v£X‹,¨«H¿7T‰&êXÞÿÚŠ­endstream +endobj +1821 0 obj << /Type /Page -/Contents 1663 0 R -/Resources 1661 0 R +/Contents 1822 0 R +/Resources 1820 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1638 0 R +/Parent 1805 0 R >> endobj -1664 0 obj << -/D [1662 0 R /XYZ 85.039 781.388 null] +1823 0 obj << +/D [1821 0 R /XYZ 85.039 781.388 null] >> endobj -718 0 obj << -/D [1662 0 R /XYZ 85.039 761.463 null] +786 0 obj << +/D [1821 0 R /XYZ 85.039 761.463 null] >> endobj -1665 0 obj << -/D [1662 0 R /XYZ 85.039 667.044 null] +1824 0 obj << +/D [1821 0 R /XYZ 85.039 743.459 null] >> endobj -722 0 obj << -/D [1662 0 R /XYZ 85.039 667.044 null] +790 0 obj << +/D [1821 0 R /XYZ 85.039 643.603 null] >> endobj -1666 0 obj << -/D [1662 0 R /XYZ 85.039 642.326 null] +1825 0 obj << +/D [1821 0 R /XYZ 85.039 616.988 null] >> endobj -726 0 obj << -/D [1662 0 R /XYZ 85.039 596.667 null] +794 0 obj << +/D [1821 0 R /XYZ 85.039 616.988 null] >> endobj -1667 0 obj << -/D [1662 0 R /XYZ 85.039 567.263 null] +1826 0 obj << +/D [1821 0 R /XYZ 85.039 593.671 null] >> endobj -730 0 obj << -/D [1662 0 R /XYZ 85.039 276.116 null] +798 0 obj << +/D [1821 0 R /XYZ 85.039 524.412 null] >> endobj -1668 0 obj << -/D [1662 0 R /XYZ 85.039 248.593 null] +1827 0 obj << +/D [1821 0 R /XYZ 85.039 505.54 null] >> endobj -1661 0 obj << -/Font << /F20 877 0 R /F15 895 0 R /F37 900 0 R /F43 1079 0 R >> +802 0 obj << +/D [1821 0 R /XYZ 85.039 367.158 null] +>> endobj +1828 0 obj << +/D [1821 0 R /XYZ 85.039 335.633 null] +>> endobj +1820 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1671 0 obj << -/Length 2359 +1831 0 obj << +/Length 1819 /Filter /FlateDecode >> stream -xÚµksÛ6ò»~…&_Je"š øRss7vì¶Î9vÎÖ]:Óv24 YløPHÊ®¯ÓÿÞ],À‡H9j“Œg,»ØöM-øcÓÀ5-¾˜ú3yL£lbMïòý„) kꘖç"èd99úÎ ¦Ì2Öbº\I”eü“ñê‡ã·Ë³ëÙœsnx6÷ýÀ¸™1ãøÍÉ1.;Æ[˜]Ÿ_.gsfœ_~O¸0?»¾<¾¸™ý²|=9[vØÎÓñ8òý8ùékƒh¯'–ÉÁôÆ–É‹i6q\nºWótr3ùOC…`Δvh7×sØqÞ¨Éý5žÏæ®íI¥ÛXÄ4[•EF£M™äu’ß™kš??BµP†\’HU—Û¨îløµ¸¥Ùï›ù& lÚâÊ›$~¯7$ñKiYÖI´ÖÔŠHTMÒp›Gk-c½4h˜ÊÒ´z¬s‡UC µP:ÿl¹Vºÿl‡A¾ÍnEy³Õ®N«$UœbQEe²© E¨X©ßÈwq“l”mdB›³ªÃ²Æ…Q5‰¡áäm×jS)œøA6­Ãz[íµ©„öµ¬×Iõ䱑TÉÿ[`¼—Àv ´+”YÃŽnÞ‰÷Q±Ík`Ê\¿Ç5:‚fŒûª¿Âñäêê¢cr±ë2ëP‘K”d·B󯄖¶.v-"i)¾¢þ×ad·Ãà¨DÝwámõa†ôsóæä˜\AÂh< ½=³½G¬á4ÛVMü…Göìw®{ô)îmì7"Ü%÷M(Z*uB;Û£4iŽêÓ¦åÊ}‚ LGr1¶¦Ã¿[±³=°ºO"ñ„¯c’׋+É>ÛJ†ËåûÓ³ÿ¿:{suz¦ðòú},î³"YpǼ[3Ô¾?$èè;æv -™͹¿Lâ-ÑÜ÷h[–P¢Öç|fFëž‘…9¸´`–JŠœ ¨ þÖšÄÐ@YÚÌH1D¨pkÔ¡òmBTr˜ÀZ^•~~¶˜£Ù¦1B9Ѐ¯×šŽoü÷òüGýŠ¸E±NÔÎFµ¹²˜²D·0lQü}Ķm(ëH*à o˜áøYºo|$¼qš)œg´ˆÐÏ;° -3âµ}¨ˆŽõ–àç§ô‹Õ”ÛsR€Éd†Ë·’!¤ÙX«!É#|$¤·²»Úé£xGøÓ¹íù¦ ]Í'û)nÚþx7¥ MÔs-Ý#½9þqWÛ7-ÐƯÊûõÕÉù)¶"&²c[ÆXï”ß­['Ÿs&Oˆ3ŽQ:ë8>kÏÇ«ø[ -ò_é%¸ )Q°ž‡à4BnEÖz.ÖëPñ‰ÉeŽ\}¥PPé\a!Ÿ5-…Jr©Åoè&`R»áóV¾a‚ù¸Õiß Ü5–§'/hR¿ãšiÁ½ÑÂ[©Žôö{ü'®¢Hæ%Çêæ¥7ÞBã?F2W`:«àÏïg®VˆÙ¸µ“¶ûFÉö B1G dtña†UÆ4K”ÂYRI"2Zïh­ñ—R<ÝæÌôl%Ù?Çr®m2î)`Džéx¦ÝwÌ;‘‹²kÃÚi nJ!ºIÜB9&=kn` (<.–é9Ÿòöa7yÛtt¼~Õ¿YÎÇ8¾žÜX’Õ°Ï@û48¦µRPdÔ àR×È:nUþ`I\»w;—±„ð8°ªãL²„_¬ŠÐ¿Ö´ÒÏ­Œ¿ÃÊ)òÉ=™Q«&#‘OSM%‹@cƒUE/ ó,T¢5Ux¡¡Tˆa€;b iÛ¢¢œ!uŠVÉÐÃÖ©#Œ¦ äö•ÍLâgE©lI£™Ì^dcYI3J«IS"XíRGª±Íp?An¤žÅ)$a­)êPŠT1XG³‘ -Á’ì5¥i+:ìÍz¥ÂµÁ6ä±}åG2Gõ8+€`c*¦dêK([@kÙ3Kô­D¤fC&tùtî:Í¥ãhèKÈÓ¯1²!$ž…Émç°ÄóYÜ·pV–oüï,LÇu6â|;°˜½™ï@Âæ&‡6eä} -Ì^ý©$HýN—´.—#$]%Ö“_­…ŒÙ-£  lƒrƒ  ^tR»²–‘‰Hh EÖWEºÍؽj¤0}TdsÅSç XÛ”…$'÷SW %Ä04‰†"0hriT‚ÕÉ`¤Aê•È-Ù”}èVìnrÛÈlKû¨A+ÊNûŽËÔrã‘96´º«¸¸zõï#}‹Üõw†í‡×üµÝ^Þì‡ÎõG„cΠ¿qŒóUG÷âE?ûSûÍ›î—r½j{a¹=O¡7*³B}1‡- š50Óê=,”ì/JÔ’¯`éÕfÈHÙÖÚ$¿ÑªòEYPaJNÒßHEÖö)øbZ$'“…C´±FжÑÄä[2@åaÙ½€—Œf²‘Q¿šÃV¶7èþ” bA-”®´¢ü0ò”"¯øéÈÉù²Í›s×äÔ«þ½ƒã_üànZSîDvÇ9U ã2Áª:Ì6´¸ÒHwo.h…Ýd‚+iRéöŸ•>×½/n¥k¡½®LD{ÙstÀrU§IÃö²Ú¤iÀ¸OBt/μwq~öÕLâþ“@žóx/ÛîO•pü"ÔßfÚGàÝ MC_~ú—ÂßÇß}`¦W1…ñB½±‚Lµè¡IÄÈ!ç¼>ïgؼº+RïàNS<è÷Ý°y~† Iü¢óa`¨Õðã—\Å ¸ž¥ˆäå}ôYr{yˆåÒmÈP©9"P&ìlŸ0üÈ-™²¥ØǃºË'>AµßŠòô‘8pÇäžÓîðfCH/žð(HÈÐx‹¿PÞÏ1§"m²ŒÊ$aÞéÊèÊ\©«~>Lºí´©kx…Ô¹½m<ôv»í7tùíö ˜Ç6²¬«L•&$@û -·/]Á}ja»ã_Úíážüäí`Šr)jü¨¬]9Nï¬þ#¸¢bendstream +xÚ½XmoÛ6þî_á"±¢wKý0ÀMÜ6]“tµlh ƒ–äX¨,yÕÔÿ~÷BÊr¢ E-’w¼7Þ=<Æ[ðχ¾i¹ÑxÚ¦†ãd7²Æ@y;²ÇT±L{<¯ãÑÅ›¨–YÑ8Þåø¦ç»ã8ýl\¾›ŒŸ&S×u Û5'ÓÙ,4âw ^¹ÿ8±ËÉÔ6î`ps}û–×—ó5€å¿–ñâfò5~?ZÄE.С9>µÆ)˜þ~d™nŽal™6w#°Çô=WÍ‹ÑrôG'ŠiÞ˜w yﻡé‡îs÷Ý ç¾m;¦k;㙘‘ï“ÿ·ñ2žÇ÷ËÉÔw|£»ÕC&W"Iª¶”«õaÕäéË·’ªl$3ï«Ë»ÛxñgÌ ¿Qf?ä9O™Â¶Mm4=RªV÷ËŧU|÷ûâVíEYÓ¬dõ-+Õö6/¥ëðX‘Ó¬Éë,=‘Oë»›Õòúª¯ŒÝúUyÖŸ­ž_^Þ݃ïæ·WÊÍ +^Ú(èâí÷ƒÆ£©k™V8#áó¢¨&Sgf$˜Bf æ‚gN‰­(!)Ò"S«4cR#«ZsËmÆ‹‚Å…F"d^•¼NN` ÃÊ š ·BžêŸ 1b~­7åÈûí©ˆÎ†MU œj^=ïÃ+ÆIM¢ñ<ƒ²²ÝéjþßäÈ æM«ÈËc:`–ÙA—er•Èº8žH½dÔ‰²¢ß´ZÜÞß¼d€š®ãýÜ€#pZÚ”Y`“ñ$t ÌqÛ9ähŸz¶oä ¿çVE¡VKüR‘@¶xq 9¥t’ñJµáoSm$2>â¨38Ï…,S³;Ìà5j8U›¼štçeq`þ²bjöƒé¨k® ±zÀlD@z(¹N°€`×nxRf< 0´@Y7‡F’ŠÝ9“Ȫ>ÇØ’½0ÿÞ-‚DñMÍÐX² jM¬ø›•M[3  ¸dŠ¶%dDŽå}P›ÕñhàHa ¬ÊËT¯NüÞì)“`cÆ ¥j£¾-®–}]I8ÜX¡%Í°4¤kŽR¨ê‹Ù2ŠÏ™ú>+v|° +1Š™••Z™Ä0µ‰TS¸Îˆ‚9ƒH‹ãFž Áh¼Åp:à{KI]äRå+®!Ä5´=ã@ytº­³‹ fB @œZ쉉úDÉNÇ @Nä­÷ÇË')ruÇ uË)@ÂÎg"嵪w„¨F(«Èéiÿ,”ëxïx–Ë ŽåhyÜýx–sšß¬h‡µã{\;’÷&uÖé¡ÁrÎ`g¢EðþjwÆ,JÇÉMˆåîXêþBÚN`¹x²Öž¡èT•#§y^&C—Ê#Pí`Gà„qW Q[ ºÀ†òô€®VSæî¬ÏRæ[k0 ,¾b‘«;ÔFI#P ìÅ$æp<6D /rÂs"J•HYƒP[;5Fû¹»É/–í= ½À’s]*tq ¤ÙKE9&O¸ƒ–…§t4(Oá.@Í4Âør!îv‚°«Ós F2M%‹j•ÉÎHÉI¬ò©`ðT,Ô ºž×¥;òC¤U„8Ýž"*ê,º3)ÁáKI¿¯¹:îgÌß cEÁ3¼¿ðÛƒT¸o¡¼ÙŒš/O¡Ö‰Mè ÂUHÃç=%`L¾rc™¶Êe׃ۭE±Ûªn˜ï‘ð”xpºÉD›”콨é:KÚ‚FW¯Ëâ!€ë'íä@pè‹89ÄÛcˆ0Ô@žjû…9üY#2Ýž:D_çå4”HN ¹¾Ô±Lg檾4¤Í¿u!7ÑÔé¥Í«"ûWvä˜vš¶m¿uÒã"Âw7¼÷$5Ë g?ÝLdæ#Ïõ äDÊ| µßƒ<ÝEà •=²èùÕ;2v|…v™HÁm c!¸C!ß‹‹²á= g§Àøy:è+]Cžs¥#öêAC^s•ÔÇ'ÔÓCïÅRKQUßÚýª$CU¿>¿V­½X‹Z™üWSg’ð£lÔ{Ší䇫ýb¿æS´œ®ÃÅKï!¸bθ…ƒÞCšPSßÛ˜¿sôûòOÖ¢9i§W‰¬•ÐÓÂÅúƉàO-§®q«„¦(esPËç8Ƙ-jì„sYSý8> endobj -1672 0 obj << -/D [1670 0 R /XYZ 85.039 781.388 null] ->> endobj -1673 0 obj << -/D [1670 0 R /XYZ 85.039 366.469 null] ->> endobj -1674 0 obj << -/D [1670 0 R /XYZ 85.039 331.425 null] ->> endobj -1675 0 obj << -/D [1670 0 R /XYZ 85.039 298.502 null] +/Parent 1805 0 R >> endobj -1676 0 obj << -/D [1670 0 R /XYZ 85.039 274.583 null] +1832 0 obj << +/D [1830 0 R /XYZ 85.039 781.388 null] >> endobj -1677 0 obj << -/D [1670 0 R /XYZ 85.039 252.785 null] +806 0 obj << +/D [1830 0 R /XYZ 85.039 579.046 null] >> endobj -1678 0 obj << -/D [1670 0 R /XYZ 85.039 66.98 null] +1833 0 obj << +/D [1830 0 R /XYZ 85.039 547.521 null] >> endobj -1669 0 obj << -/Font << /F58 956 0 R /F37 900 0 R /F15 895 0 R /F40 1163 0 R >> +1829 0 obj << +/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F20 937 0 R /F57 965 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1681 0 obj << -/Length 2714 +1836 0 obj << +/Length 3169 /Filter /FlateDecode >> stream -xÚÕÉrÛFö®¯`å"°Æ„ÑX U9È”å‘cQŠÄŒ က’5_?ok,$¤ÔÄ“*»\.öòºûí¤FüS£À3-'ù2 -7GÖèvÞ)°F®iM=Üz³8z}æ#e™¡Ž+YÄŸŒÙ?O®o¯ÇÇq ØO|?0nÆÊ8¹xs‚Ë®q³ëóùb¶£f>Þï’]Âà -\Gõ`*†PÚ ×rÇâôÍ>ÂÛ7mß_´Aýu^ÿw^ì¶cÀΈ€¨n8"/‘âh9€“êt#£ªŽ6[î"` 7š¨©éLAð¶g*zc^àÍ®æuTó$¥_ÇH«Î¦. B‚À04j*V|ª^§,\$ݾËN´ws™ÐÊ<‰¤à$n$¾Àçñ9³ÌÒ„q…(09Ÿµ~+¢™³…ZÙѲÞE³'K«:Å î˜s+D§ØC;ÚóSƹ Œ26!ù‰4ðÖÏ»–m€ØÓ @{6Øqðçf諾켬P§oÑ#Ö3^\ - Œ­ÁæbG£»Ðâjžha³QèXä”Ó­\Fƈ›;`sÙHåæ]¥ß"aà -½ÏÈwÕQ "‰º•,M]s—Ãx‹ãYxP–E>‰“U´Ë˜\>%…}@œÉx’‹‚í+‘Ó„wUÐÑjË#årÜÐxLݸ&qIÙx÷ ðBÜÐè‚â“EÚÐDà)â™ñä–¤ò©™ø.Ë ÄH.Eö _,æˆÇ ÑRšÚLIc0¸†B[fhu1É"†=MÒ¥œ»`FÄíMèQ˜|.\25I~¥@4¡j}ý·åYð_ñöVˆ?½–˳Õîv,ú’ÜïZ‚ðäÈ¿Ã`-’Z‹¤C·¶k8àúÄ~LUQò ««ÚزÈù·õ~0©"z+áÙš½K–`„<ã|Õ9B0AÇ#ñr-ùivH°Hï²8Ð6b¹_pnx×]×#ö'ÍYºL;µ>ÙZÌ=e\u¨y|…YGÊ2JÍë–ëUý -öP…5]ÊQì»-e9fzd‹*ôÿv¿'›¾6*$H¹÷LÜ?`¬#@ÌÿðI( -g…¢ºÖø+“è+7Û e;Ö/>¤Z–:ÈL!›tœžX6­ )›_p0#Ʊ)ãÊ-¢ðÄcriè)êg£Í%Ê?Cxð¥]OHÇxY«ŽûfîX€f©Ç¶¸ò¢QÄœ³`‰nºl=4a×Wñ„’0K\†³3xåm9˜a†6!ωÇ.ëÆËá¹GÍ3ö¯Ã{ßý±×ZÁoîÑê5Ú‚CB»ŽÈH[—+|™Òôú:€ÛúÂk¨RžGÚEw,kñØë$çQƒŒÅ5÷ý¿šVDck|"âŸwIýžðE«Î$®aÐñ lý2à'lö¨J%8Ü„Å{¸¶ÊìCê;\ M”gÚV["ٰ욎;í.ˆÆE†XÆ GA ¿KÎar -hL}ÌÜ„ÕÓ©1c^ÐR-KÑræw ŒI.^A¬a–Ãây¾*Ƹ´xpV‘"¨®lÓŸ!ÇV¦Ç•×ó~èÓb8è˜Ù.ÅåbjˆÎ(˺šƒ).Yç˜`ååçŒTh‚7ý6{Ìâô^LÌx¬˜9óÅkûWö˜6[£¦¨ÓÕÓn 7ÿ»,ÓïȃìúØIQ@-=°_LéÊ?šlš¸Øü9á÷™˜/þÁƒNÖÿJŒ¤æT@%¹bÓIÑ>²„wVTUò8âçö<lTIÉVÄþ† (µ„_HYèújƽþ(³°¨zÊ—xẤ,®Ø!žAð"¥$XÂ$ÐA=ZFuŠi‰¸FÒ"ÔTZNÃ~“M¤‡0”û8”ŠII¾NuóՆؠ-£z0ÌXÑ!“ ëšÿí®n<”9àpk’ $¾K´t´v`ëj'y¯øHOõrëA -y+OÄÚć+)”ñGÞ)ùƨîÔxVv(UÄuTí!È®ˆÅq׶1‡¨r?â œ„*J\åwȹ®`auX(¸®Ké¬:Å8ÜÓ)¾LÈs.?·'É&šÒV›ùxûdãvÓ]@gCLžSÝ1€mÎLHQu£´jQ+ò!†ˆ§e’IbS”tYqWäº,¯ÅÏ.¥É!I”nŠ€C•FÏmTµ^צŒ^²-ÜmÂù#/³ç;?åÛˆ†vzéL"[ӧݘþr©O8 c9-¥%C¼•´Žbü‚?9BvMf÷Yn¶Y²É´ý¯žxZjÁKnÌUW-áé,“OÚfae¨÷Å £6AwOïùû×b‹ë[º_×Äì hÛÅ‹ø,-5ƒê«CcQcHYŒü ¨†%$T?D9¦JÂò³³+ >o6Õ_é ~?Ü™'_ë~Ù7k#Œ¢ “Õç}Ž¸À‘9qd®³™ŒƒYV°+øÔ£U‹3äÛLÿayÁš±¥*ðr¬iû=š–¤—dü"MßIÅ®N˜.ê7s)¶¦ÞM7ñŠÛb{ w¯ŸsjmÿK ‹¶oKr“RÒ‰M:^Õ·á#:A"Rc†QšE:¿ÆšZ©ÔGÄiÕ]7¡VÆ+ÔEŽŽ8Ò }wž4I N{±átÇÔMÀÁǸ^±¾P5À}äŒ/Ö—–þÍÏÏêg™öw«6lWCÉ)†zIþM¢Rlµ²í6û)Q–õSn~TÒ¥¸Ñ¨Üqûá-Ò_ïšœYÒ‘\ç5úÓÜ~CTÿ.Yv˃ï%¾mNOù»ÛŽ•|ƒ ÒY™kæª i“cÛÝ’ï#"VHääÃøõ×QÎ~«L9.²â x«ù<m&ý%t%9 ÞÝ$õZwµŽ„¥ì¶,ÅŒàNcÐ+y•3XvÂòAÙÉQ> -ÛJÜ|ö«X`qý!MO®+Þ Týh¹K«6N3º>7»«ŸÁû¡¤½ê¿’PvÓ# ›Î=OSy7’ßÉ4ëx(q<(˜›6t<;ænÒÁRPiÛþß"r©HjmlÇøÇÇ¢ûUûµQ[\_ðë‘ë'Ú •~Yä1}Š+^Z‹–/HTŠôËY¼)K7iTLâ{}æø=õ"Í©P1ûxb{Æå-÷p |%¦âu·º½„“¢ìoºPT?ù¦ -ìË°£ïxH£½ÃU ïFe,m!§áëÞv¾6áÖ\—VÌÎ#l¢7BÐuRm‹\.ã.Žäч(Kãç©-n¿$˃ï"Ø>7m¨Nh>×;z¿ío<\p„NûôE?6U‡p¦‡þ ŽúKÒendstream -endobj -1680 0 obj << +xÚ…ZK“Û6¾ûWLùbªjÄðMê´µÞ8YoÙNj=)gk³ŽÄq-‘ +Iy<ÿ>ýu7@íš! Ñhýøº1áM@áM‘úA¼¹É‹Ð‹âf{|Ü<ÒÈÏ/B¥HÒØO“„ÚW×ftE~äWitunü8 AóúîÅ?EÁMøYßÜ=Ü„aäÇat“m?‰“›»Ý½0Y­Ó4ðÞ•ÍûUè•Íjg9}wÒøp'ß_Wqà•=‘ôOh¶«8ô:%zÓl»çÓP·ÍêwÿzñæÎ +¦re›ÀO«¢7ë(öã<þæ¾²,§½'î¾Â„všMöEFÝ—ÊÎÞ’ÌÍЭÖ! ½&Ñwçí€_5 ,K¬¼¾)ÔHÃB…éMø›`3**ü<ÏY¨Oõ@kîIŠMá û +·£¾ +}YE…WÚuÑQ5脾}¯½©ò±ê¤Kn‹Ÿ°§ ÛU”{O½¬À—HÃ[>„#ø—C}¨¤ûTö=Fž°ZÛ)¯ªYãlpA!PÎMÓù®×qZxX¬“öG0>bå{´n¡‰W2Z÷òm¬xò»1ËB?†V¾_Vi敇zWr]pÛ69½-ËÄ ­Y¾Ü«¾–¼íá@cϺÈ^WëK9gw£)ï“Ï¢„”˜ÇÐ}ú&ÔÇ?ç·@]­~?ÕcׂÓÎâ oÏ¢v+sÙæ—Ϩö¸ç}·çc cOnuM³¶ç#O$íØ°vè(wö[ó¾gêJçïÝc#=À­½-mV >b2s¢mÁh'tÍPÔ¨{¦ÖIõ€FKœïcÛÕÃ^ÔìFŸU +¨*¶º¾²×§=]ö: bVá Ù“ ¬]%ÍÒ4pÁ Ýb½=œ¶7¶Ý< +áÓÞœÍ`[Ì}f?˶4&‡(#8œ{³æà¯ÈìSï?«"¶yE–à|ØIWW•Ú"í¿bE¼‹çŒƒ;<ƒá­(PÅ O´\U».F}i\nŽ´‰o«TAïyB{Ößb(|W°ºìÌhs£÷ê²{ù+uþT¿|4dJó_>@M^-“ƒó\hšDþwÂÕH²ìÕÓ(ó³ÔzõH¼ú?[D¡'‰?;qì¬éô—?HÓĪÀë>Sïß–DÕ5¾)ëH³ìíÓ€¾xû™‹H’lnB¸R2!‰CLÅÇ·OÍôjè­õ¡T^¬œôýíÃÛߥ?®åKÒo­GŠœ“ÊÝí¯8?õR⢰\:¾·—ŽR>aç6¹c¶ž’=`Í8Rî­o±f1énÔÙŸ• "ºuÞytš¯xíhæ¦8ha?qNûÁÊ*b­ä[2ÇA¼4Æ{cˆ ågã:œ@1‰<¯4À@†v +'ÌÌ¿j »t¢ðÎ S2ýë'Ŷ¾6ëÔƒÆJ18ê©ê‰³ba:HÑl)tãxE 0 È-mm°±‹¨È8XÎÝÎ\º˜} ñU•Î|‚TÔÊ<¾è3y%C¶/B7‘’6jäºÂLx™K×ðž)@ :½p—¥ö²û’ó”Ž4»¶ccüAîýøn,ȼÏ6Ö>÷2Äû òë"C¥|^ËÇzûÊ!Ç +{ƒÌ‚ɾèí+•hx®n%6>´ÝÑÞ™aMW–¹ó!w%³£¡ž§}½Õ^fÐI]n½Ú®R}ïøzëßûªsQÇE ØjEœ>ÜG⽓¨iبe•c±²ÜZøb Ž¶ôÓL±“Qi6û²ßq/(…šKH”*ˆžÂ+ +x•$ñ÷ük¬þ5f×BóxK{qϱ÷'Nœ ÓDJô‰–ÃçÃlr¤«Mrvy}Ý[‹Sv_ID"º½e³ˆ{Þÿ˜àüH:´R–=¥üü­©·oçEE¦²ëkCŒ…AmŽD3Ç…áëWNüÄjAVúV't]íÎæp+C&è2¾Ö.õSv‡ëžé7kF©jf4Œ³„fÝUS lÑe/‹ ù“uPÀ ƒ‹EpXf=ÅÏ„ìþÒ€Þ•FƒÞóeSè6+³-Þ'v—šbÁ!©_%6¢¥>1@däû3ßùÔƒC°¹Ìhê&•ivúåKÚóáŽd‘³‘ýÔÓøÚK7{;úÛó˜Qr\Æg–µ¡3b=ëjsö à ±x L9MáÝëÏN€lËðsËATXNJZ¸‚~0³þ<ËÄ¡7Ü/ +¿J2¾u‚ìq¦zl‡ºäˆ•„êüÍlº'A•Dø SD÷“xô„3öjJ#2¢¾'£’‡ƒÌOÙByo›‘ÿ¥]tÕIÁ}%ë"ξŠzp öB¥Ò+FÛ9uü¼žb2ÏGë-â"]ÊD—''áþ‘ˆ +ù9÷‚E;aÕ¯lØ ´ÀŸL7ŒŽZ³xjŠ°YL@´œÜóu!Dê*_”MoÊ<ê/4ÐÚ— îâY×0"L}…äˆ*ÉDÖÏNÐÃBÚ}ýÒ_Ú´•R»ªy¬^úÙïœ9§‘^³$5w5YOL¹±5kò ¦áºÎçyˆ×ßlØOcr:Íëœ +SN›“[7Ò1Mh†ÕYjÛàO„×ÊOãW0aD˜ø5 ¢¾Ô½TÉGå!Î&QÆrã ÏRH;­/½­ø¹Ið‚|ôƒ"´Tp«Àä9Ð#)oµ&b@龫ï¥Öˮ੹íÀYsÆ·N‰¦t‘"W !à€äujï\DŒ²Ÿ)ñ]ÑÚá»ÊY¸øs¨l¼Ÿ@âØÄÊ•µ(¹d‘\ ŸÇ:âf¢Èj`¦uýIêCÕË—‹Z‡¥£kˆÒÜ–ÉпE=†[‘â¿fþ´ÇÄe öô»Ð©:?MÂ3¯’Ž .ÿ:¸µ`™,ãÛ3+´§`¬–gwP®v‚0Ò*Wm,:«ל!Ÿ©ÁÀ=>6ÞKÄ{yÚW,}8V¿¸¦…ñCåH-IªôÑUéIM¢,7bG¬˜3jz§—KÚÞTâòïªo ëègò ýŽ¾ X¬Ç»_%‚§ø»WÚ …ÎåZ/y™ÄûiÈÞ íªÄr,&(|Ð0À F³Çän¤”ìlâïxƒåa{>”æÙf +°|ݵñÚ‰dQA¤é^« c®S8ÿ bÇß'ó4×n¬i9kìågçEaaý¤O/™ ¯Íw˜ÑrqfÖ*´ûXq“©>\}°n*™%ïnjÜ'ˆ^>˜ 3¿Ä˜)ÛA#-B(€Øi.–p¹JO\^U.nóu§[.;óå#êÅxE6k%êzPÖÚ°„¨4Œå´k.Ä-éåZÒËEعÆõܵgü2°í+5>€û±†ÏevbüÀÖqÄ«ý$Û?Å™S¦²_DR +.˜ï¹dºÊIA7Í|BîJÈ5N=Zb¿9v•Â NG¥¢BøÏOÃpr"diU§©ZŽ 2ß%µÒ`cjNð2Ss®†¶ÐMÍœÆN{(òÞ3.bS$K& À€“%©“›¡PN ïçÞÛa*:ä•wƒÆ"Š<iNJù´xÉjÜЃôëóT †.pÎd5΄θµJ:–ÃTŒ~²@8[ÀXòÕ5&N†™´W\§Ááöôg¥¯«eˆe,‚)€E*›r¹ãfä7?dòVäòô9àe)ᬌ!8܈r¢¥šH‘ Â’'é°›( ]7>½Êøâë!Ùò.¾ä8¸(Z$îuéÂÛA\L±¥Ð®…–öY "&£ÅQ`iVqr…ƒ—j²…)ÎZ£’B[dgÌ5³Ck…+%—•¶R‘°‡*ù&×ÛÕr×pû%‰UOUi’Ï%œÕZT–5Ù+úHW©àK˱K÷è> J¡ŽBÕÔ¦Ž[nm<⇀•þЕã>Êaf‘—©0¼¬^ÓŒfŠ~´×É ÔÖ[™—ú¹ÿ¥Kü]v6Mû::Tɦ6£¤ów!ZÃàšÅÒÉs)°®åçÿ–Ó0{zbƒ ï˜ã—M å%¬ ðc‰“ 3è–ÓÙÉÌvñGý/ ”úÓ(ðþÎÕ^t×%‰5®> endobj -1682 0 obj << -/D [1680 0 R /XYZ 85.039 781.388 null] +1837 0 obj << +/D [1835 0 R /XYZ 85.039 781.388 null] >> endobj -1683 0 obj << -/D [1680 0 R /XYZ 85.039 761.463 null] +810 0 obj << +/D [1835 0 R /XYZ 85.039 761.463 null] >> endobj -1684 0 obj << -/D [1680 0 R /XYZ 85.039 743.967 null] +1017 0 obj << +/D [1835 0 R /XYZ 85.039 667.044 null] >> endobj -734 0 obj << -/D [1680 0 R /XYZ 85.039 548.428 null] +814 0 obj << +/D [1835 0 R /XYZ 85.039 667.044 null] >> endobj -1685 0 obj << -/D [1680 0 R /XYZ 85.039 519.63 null] +1838 0 obj << +/D [1835 0 R /XYZ 85.039 642.326 null] >> endobj -738 0 obj << -/D [1680 0 R /XYZ 85.039 489.767 null] +818 0 obj << +/D [1835 0 R /XYZ 85.039 542.47 null] >> endobj -1686 0 obj << -/D [1680 0 R /XYZ 85.039 460.172 null] +1839 0 obj << +/D [1835 0 R /XYZ 85.039 515.856 null] >> endobj -1679 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F20 877 0 R /F43 1079 0 R /F37 900 0 R >> +1834 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1690 0 obj << -/Length 2655 +1842 0 obj << +/Length 3278 /Filter /FlateDecode >> stream -xÚåZëoÛÈÿî¿BßN:œ¾EŠŽ_|HmÕPrA°"W{©ðaÕÿ}ç±Ë—('‡´n€"€¹Ü]ÎÌÎã73«XþY“À3L'œ,Ëp‚`í/ÌÉV~¹°Ôsâ¦ïáÒëÕÅ«k/˜X¦šádµ¡-«øÃôêÝårõö~6wg -˳ùbLfÖôòo¯/qÚ.áíþæv5›[Ó›Û_x/¼¿½¿½|ÿ0û¸úõâíªÃvî®ï ßÏ>š“DûõÂ4œ0˜alVNö®çžë¨÷ôâáâï ^s'üÕÈéæzÇÜ1 p›c:‹±cþ<›{¶7}YÌ#ÁûëëåÕ- ù¹–eÅ/ǤÚñ¨ÚI -ù˜äu™>ñ{¾®D’É50±†Ø“¹…R…Ät'²8•CrF²àñï¦g -øcñk)ó|ÃÏM*¶¥æê›ÈnUù(³ª$þfu•ó†}ž%U^ü¤ÈvØ®[¶JË{²é§Û»ÕÍõoŸî–«›»Û%YUÔQU²ËË#VQž¡’l;P ÇÃ$ñ÷¢JòLmêËngLÓÕ®QWçDZ“•‡'Ú¾¿¾ÅÅ¡ÎØŒ£>°‘U4Dߨ.ŠF§"­µ4X6¯@EóÀ/«ªHÖuõŸQ~ç¨Ê´¢(„B¢‡åÝÝ{¦7·×wŸÞ\®.ϺŽFز w­Úï’¬§Öú¨Á¶“ßl†zîä—S×íKR6¾Þ('•¢‰“õSKzÜøÝ}LDïx×WCÏýi i×,ŒC=¯Cè¹JóR±çÔ+zN¸Ñ_Ç›¤À`âÄõ.?¶Z#è–7jNÆà2”\™p‘ïŸá›4n_éL§‚¶g¬ÍNj˜1NŒÝ±£Î°KE™(ÊÄœ¶v”C|FU“‡ŸÆ­uÊ7ï«íÈHö•‹J Ä8y¶=›žà}b`ä!™HÿD œ dt³åÝû›«ß>½»}3’2ã\uÙæ ‘)½mê¢-1ÎÊsªMU~…ÿj½·^ÒK‹zùŸùšôüêÚò:•õÜ7ì…Õw`x¾O¬IÛ®IP - õ̦ιÓ4)+^E«âL{à,¿›– £» ¥d×t¦ß‘€"Sò×e}€Ý‡ÙærdSÑΘi®gv8}âØĈýÌ^À¬…ÞE¢‰Lï4œ*7y [²–HÀDÜ©ü—ØCq‹«[žÑh6Wºè*?Q'¶Xüˆ>… S%Ö);*DrDZ§%íz¶Pahø¶7AvÐþ¸_ÅX…+6ŒtwÔ³¡îŽJ¥Nþ›‚Ð$X9”Ëq kÁľEçKò° òŠsËvÐõÙÐÿZþXghù†ã»Ðbžò·[ ‰{† bŽÅ%÷KrЕ0Ôõ´ç–ûíÚû¢5U@ŒÍÓPBÕy ÐÕu |øxb”ÂÓ¶ Çs¾/Ú IZžá™ÎK¸ý³†{ Àp AʆƒÑGF:ß7B×W1· ÿØi#žÚ6Õ ø<Ámœv¶DJž¨€P«Q^§1ßâ²íR%ÅLb)H ]IeÏ/cØ}>¢  ÖY6úZÎÏnòHð|ÛWXê¡“>ÍwjD¸ÏiÏ®ü”ª_",ŸJžQ‹OÐÌñ àlî{†ï»ÿuHyáÚâë³£=’ŸÃ x”Ý“¶í]˜ÍøÙ˜µë -C)Ž±XøÿÙ¨D'2XFh¿D):@:z¢áfôà»LUà:a·m/_¦Õ }ÊŽP#©ëItPPóãøŒ}¸á¸“ÜâK^ð"u8¡‘ÏñÃ~Vâe„8\ªœpjMQ¨ÖûÐGÕ¶(Ï2]QÓ_!ïH'Τ“ÑX|dÅ,ο"nÅÓ}‹ÝI®}ÍÔ‡ü¬ùpþ„š:Ì@LT55Vx×€ÛT€Ã&À'ã &kƒý -Ó·É`ÍŸRᲯpˆŸögs˃Z>\`‡fønð]¨¾p‡‚üܤº(é$û“â°Ëò^»þ‡ ߎÞå#¸o,<xot1^³nýx…ÅUÅ8ôõUHY&k.G”ëºèÍ\Ù%ºÅIÁ¬T¹Ìàw.·|]ØZ§'M°‡.%‹°Á@*š¢Ètä¨ámßé”l‹ó·@CˆðÔõÖi9íž’€®˜à­m"à–Zj¯hržP,å6§¢Í¦É¨‹ ãt¿xÃ>Ÿæ2¾mBHT Â`^; -±àêUÙˆqëÁèÆ7QÕß`ñ0RBRYŠHØQ<Þ4±µ¨  \à¸ZmÊpNçø¢Í ð2È 0£¯«DgÈšåýòŠ""}æEÌ*"ÿ¢ë/ÅŠJV •ˆsìb±Ò -™cCªÁ-ø•ÿÅ‘$!’ÉŸîÚî—=–:$ŸMÓ®o霃}ö8!VÅ®owY_»¾I)¿à0•‡Í¾¹´„-u©…+Íöþž~Á!þ”Ðøf¥–—WV¨¶† ó³·Uç-dxÒ(ö$‰tÐÉ -À·¾¯š¦êïõ!¼h×ÁàN›Ì´À“…v££öaü¯ç—\â$íõÿAÕ8@¼_m›UËI¨ŠC½ê…™´²+6töæ’¤h[þ¡uì_¼·g\ÙZÞàpC.žñíCš£éŽ,Ðã̃ԗª(r,¬-ÑwëX.l…1þÀ„èæïxF¯èþEMR¥n¹Ê}`"¥Zº¿†môË7½cç6t³ç—†ýJ3ÚüÍÏð&3´½ñÿõ¥ÂüÛþû•k¾ã5˜ñ¬¢ý“*Kíé9Ò¿©îaÌendstream -endobj -1689 0 obj << +xÚ­koÛFò»…Q +°hr—OãPÀI›« Ÿ“‹ÝKŠ6(‰–ˆP¤JRq ôÇß¼–\JTÒÞ]‚„û˜Ý÷ÌÊ?÷௞„®§Óó8ñ]$çËí™w¾†™œù1¹óòáìòu³ž›zéùÃã°Oè¡>Xýâ¼úáúíÃ÷ïfs­µãîlljs{}÷Ï™ï\ßáxßïàî¿og‰v®ïäþýL%ΛwðýÝ«w8÷ó[˜{¸ys7ûøðãÙ÷=¢= +€TŠXþvöËGï|7úñÌsušœ?AÛs}˜Þžšnhé—g÷gÿê·â¹àœWM%Ô‰&ú˜*~hQÅ÷•«}u‡žz‘e—µíÓLÅNݬfó@)hð×ð«ÞûnÙå<°ÉÚM.ÀŸgaèdå¦aÖwZÉÀv•ÆhZ¶îš¬š°ïl‹®3»Õx ½1;™S:yÂÿêæͤÛàè¾Eniæ>R.¥›¸|ÉûÊ>Y[Tkæ'á’/÷M1£ýc¸r8î)¶ú 0#ø²„0Ä ³«ƒhÄ OçCœÍÃÐsðÊ:Šv è,ˆI+ùÕóƒ2?V”¦nœê/¢eÁœ‘(N\¥}Bë¦Â“‘Ö€Ë*o¸÷X7ŒÐ}¶Er-`2ã©®æïŽÄ +–Å.ër+d³fø’©“-fs”@›û8¾˜¦ÆÝ`–8W—²KÇgÓÉû¶ãQÞfØÔwJéŒJÃíà2Ÿxd¿³E%¤ ƒ‘€h?%-Ð~,Z@·ð“^pFT–ìó–­Qˆ9®0ãµ{#ùDI@¹âX¥@§ÎOÕ#"Út[íÊg´5¯p )–ÑæƒRk`¡Ò¢ZÅÚ)!lf%-®±§a¬Eï°M»fl)Á­GBvÙO¿z¡Wà•’HÇp°“ŠíŽùÐÒ‰ˆÃ¢”C:9¿É»¦è­ÍlTH ÊhúÁå–@aì22ilÂ’°Nê$f¹…AKn“¸ç¼ÈwB”ˆ%±¥AÐùDWßuÀÁÈÓΊ`Í»n‹ +ÏÚÖñ­xk­Ñ>Œž +`´B$£½À²æ—;( Út¡ÝiTŠÀwÖy×9çÔûŽ¡‘ø%àgQYÂú°ÄM8ùòµŽ,[¨üÔóí—y·¼;L #³EnìЬDEäŽwÀËëPÀÛíâä¾aè* ’<×uA¤ú)×S‰m½@ÐT:ûS++™: ŒmL´ë'æ€í'p7Z±¿ÅO+”û«T»"¼‰éõFD¥‘³kÈÊ¢1/Vh%²âð]çUβ=Á•\±èõÖF 챩·£u'ĈÜ(‰GrôUF°Ç¡]&4p"VãB(ÐnëZÐ#Ɇ}1[Íá¼_¢‡ûô#¯JòL +šÚL\‚D7ùÓ²éõܲ®†‡ì-Ý!þX—ì+*®èN°Þ²Ícc²lQþ}çj +knÙЛ’z"5#¼Ì:Íñ’xö¥MÈoð‡ÌÊ°„#–,ÅHóq¾„è:2Äüv!Š|åjïÛæ²´‚’¬¼l­è’ä¿`SÛ‘ ]NâDôS´ à²ø摯c$€:Y“s£Ù#7ªÞÖirРÔjŸ[>vËÃ݆i¨Ñïµ swsÑMpÊûKLzÞYÔ³&ä]ƒmùƒÏßN²É5â8ɦ(ÿ›úxO8ýKÂé¿gæ”I8¶›|¶ªÀõ¿l[76wdCºn08 ÀVPì„ʉÃ{ô2A¢(¢ÆÙ>ÀŠÉÁèd<ÕÖûf)S¨ E“=: +éÉ9`˜æöå³ÜRk7ÖÉè–«ü1CƒQvF°$ŽÐ'-(¨±rØ.D[8=—ùB$øO QÁ%kÞ9X|Ö]~É—ŽB|N°ÀY‘Ÿzª(BÑ KzrŒMê:6ÇXL‰fƒÏ4.…Þò€tl»!‹_®›‰®`ÚJêK3”ÐÀ·‘l¦“x@àÈ ±©EñˆRð(H–9ôΛmÁl*jIÇ•bk‚@±ã× »}ˆˆ°=N8C.¾ö{Ü `J1(jhȸDµØlñBŠ¼"¨!ïyÒu¶”´@„Þ¤LLóYÙ郭é•ç¹aÜû¿Ðø¾›øzDªÛ‚ƒÞ'&LŽ‚îGC²ê+gÒ2ÀŒ?Ä¥ ˆ<®Zˆ€xV²5XÖpvˆYc'c«¢¯I,A žyÔ–èÁ¹¯z¹íç8%Ãv3$¹hó± +I*ÕÔG¶á#¡hÇþ¥×\ /­-¼ŒÈÅ”Â׋pyÊÆ`Z*tàÂ'¤BƒéŠh´g”{h®ŒÌÈàƒ™ò`Uíùô1‰’#+NUN¾·™È&D‘PŠ‹2S" ½(¢làº>D‹ä×Ø`ÂpYTÒ2)$¶Eãû²ìùÔdhQEgå MÞ`f¡sÓñPk¨÷åê˜ï’ì„ÍY#1ƒð´®Ä<Ëј_ÃDÞœ-÷Ê¢,¿±ÝvÀ:”ÔN¿Æ-Ƹ”+O†!Ús=åyUš*ÛæWûbuõá+¾@4òcH€ÔH~¹^.Á½YC–öy—¼º}õ0ÿ{™µÝ|¹Éªu>ïŠmþíÕmÉ7‚!^8\ëÑ-®ËŽ¹´Þ°•$ã[>‹Aëj•)h{ÎvUPÜ^¬¤óµ‹^œ4xS2¬Tº!žc6—šh/uy˜4˜´¡Jîš#¢  òÄ1p1ˆk0È1,Îëªæs`‡§t8‚U3–<Ñ,)û²ÑœtIíM~\ͳb!”¹%o´ÊÙLPå†JU!*0KäÈ›„n’˜óß7³8v®oogqäü<%öÚx:®ya¡S¸Úe†èx±>ë;y“ssÑ—ÛBG+þ¾øð‚KœÜdM¶ìò†jk‘1ÈÄDª«ôö„vg†vé…÷½zÁÒ’BN¤ÆzÁüFé4s‰–YäJ,†1>”ê: èýȵ ÄÜ,’Ó¦AŒT`Ûb)v—ÀÊ•ìóT@þJ“h̳B:¢$ʪÙ+tÂÇe'æ RÝó{›Ö˜Bž’´ +§W5«Z6™]ÊF`⛧zv!RLæšgVöûu©üÛ"sæaâ 'vÁ2]²ÃýD¿šVB4Ür|W[Yç*µŠ9’kÈcŒJ §æ6« ÓçöqÙYx•òkÕˆ¼a­%u5€-éiFT±ý¾ ²Ç=òÔ„ãøR‡_ëÙHâÙ“ +þ~3ó‡Ê¼Öv 4}œ³Ã;t{â8^”:“Òd(€`ÕûeÉX<è܃"§Fž“ .¬—µþ¸º=닯¤Vü˜HÍS£ÔˆÈ~è^”¦” ÒaNH ”ÿ•3ÎAŸ5ÈøœÒ´œd•#™ì• ·ÉØçpõÖ´[¢»ÆÃMøÓ{Hê¨Mi2yÓ‰¿®¢€šú>3y qš<:´‰W­e%…¼ðE…G¬]mòß³U¾,¶RŠ AJÇ×E×rƒEož +>×s}=ó­ÐÕ;ŒYûRúP% +âÞ± ,2R‘^–Êc«?Åû©=&hm?&èáÛÖ“Ò €ÊT¤,x!9ÅîàÉ㤲öÏAd%?§Á˜%Ðcò SFZƒ•LžÔò "ÇŽ¤èõ–_çÈå¿2K.˜Éùªµ€ÝûªHù´{" Ïø }Ù£«S‘Z“ïÊÞÚ£EŒc1§1ŸÒ+-&ãàÙ}ŸçFÌó¾1“ Áï2¸¦ßÐ’'øßéŠÏ$*…¦)0s÷†â·×÷÷ïß¼û¨(ŽÝ †¬ÌÛ$„B"'Cèü¶¯;–UyR“$N¥ì£m»öíÍË4èÛvWRKÉò¤þÝð «;°Á0Åy ÏŽ_m£H25zç’úç·(ùZŠ8¤éV$QÛt'QZÏؘ‘¡}²<ÊÕW³©E½¸ò=ïêaÿïlê'ÚÞs8‰òäÏÕËz¶O~Ü£¯4YÔÕ%`¶©¥&&§í—QéÔoà#ð?ýì¦ÿÅD ÝD§Ó?˜UìF ËŒ ^8ŠÑ5¿Î9Â÷?/Eendstream +endobj +1841 0 obj << /Type /Page -/Contents 1690 0 R -/Resources 1688 0 R +/Contents 1842 0 R +/Resources 1840 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1687 0 R +/Parent 1846 0 R >> endobj -1691 0 obj << -/D [1689 0 R /XYZ 85.039 781.388 null] +1843 0 obj << +/D [1841 0 R /XYZ 85.039 781.388 null] >> endobj -1688 0 obj << -/Font << /F58 956 0 R /F37 900 0 R /F15 895 0 R /F43 1079 0 R >> +822 0 obj << +/D [1841 0 R /XYZ 85.039 718.394 null] +>> endobj +1844 0 obj << +/D [1841 0 R /XYZ 85.039 688.99 null] +>> endobj +1845 0 obj << +/D [1841 0 R /XYZ 85.039 688.99 null] +>> endobj +1840 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R /F36 955 0 R /F57 965 0 R /F11 976 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1694 0 obj << -/Length 1547 +1849 0 obj << +/Length 1308 /Filter /FlateDecode >> stream -xÚåYKsÛ6¾ëWð(ÎDAðÙ›’Ø©3©ìÚê¡“ä@Q”ÌD¢T’ŠêþúîbˆYNÇ:ψ vÅ~ûÍ-þ¸ù̱Fœ‰(²ÒõÀ±–@y?àŠÃ±<æ>’ÞL¯/ýÈâ‹Øš.$ËtþiøöçñÍôâÖ !†@¶Ga ïl>ÿòfŒÓÞðÞn¯&S{ćW“÷Ä ï·“ñÇ;ûËôÃàbÚ;ò˜”ûÇàÓÇšÃÑ> &âÈÚÃØa<Ž­õÀóó=¡ÞWƒ»Á¯f¢y­:¢ÝHsŒ„âÈ;ÆÃ&ØÃ@Âú|vxØUÂgžïÓÂî¦HjîÉý#{Nï3‘¼¹†Ÿë]èæ»´Ói sÃã0!Å}ê0“ëéÕåï]ñX Á®xñ”ø«É¥íFÃkò›½hSØn<¬“¼ÈJšÞçõ=àɇ -½ ™¿ãê¬ÀßšXòX›rÔ9lŠY#î†,tÀ\ŸùðDÉc$½¾aãTœ³ˆÇêhw7×}»Œ¢€ùkvú|<<‚¤|Z'9mñíó3ϳăy® §–õ\ÁóOº!øÁ`ÕO=¼bÁâP#ïŸW 6½‰ ]ª„É -è>Ò¥t©9á~²¬Ì‹—­%)3lËlž!© íÍÚæ>RÊßìV‡Ùb£¼xfÜPŸ-µaŒ¼I±Ìæ=ˆÁ¹1ÒF®Ë|îŸi®K7;ŠkzEx4: ýóŠÈMËHïÚÁûa0À ¡äšÍ‚ž*  ùrI¯LBP¹CÙçî‘œëî¿“tÅ3’®û’I· @Äœ0~¢óÅíH §ø3Ö„¶KÐÊ”·EÀ!Ñù&{hêgnð}ÏõOfnáÄL8a3ýRwËÀÐÅÁó…‡O 7žŽŸª:^ó¬Ò)Âðƒ~)Ⴓ€‹fí=ÃDW£ À2U¤“Ø\';•ø -­ôþ>ƒÄ¤SYÙ)2ꤘjT«áQyn¡W'º å¶æì -HhÇ-0”ys³¯X‘f§KLp¦ÈÿƒšBU\Ñm€øâAb·ìTŽ~Ëù_ªÅ­¢º©QÃÅC¯…L¸üŠÐ<©e¶—ÇÁò^˜~«ŽµÙ^wm~0LV;UóqJ·Mþ¤¦¶`†ŒuÖ³Z²(Ïܽ³"퓈E"xcQRÛ6›ÒN‹[µBÅVù_' "»_i“]ZïÊÁ$±uRV÷É -ã8×q˜2¤Ýá®Pd ®Ü5h¥>rÏ3 ?;¾“À]ÂP!ƒ|Nϵìw+LÈaÔ¸À‹C LÒ%¢˜L£«æÈíšAí7°ËH ƒ§VÓóãJN3{äÃ*Ô`fc-;¥D(£š,M“-]Œ;Àø+•ü<ÄñÃM,½<Ç3êâ®PòyD/œÞ(rB­ŒúC Ä9”!µH©$£HÓgò_IJ“J 0* K“}ÔtMÓ…¹O]]äq$CÂGnÕì&ÔüÊ„8ÏþDؼ¾™D]]uÂF¨SIáI±»)*5½Mäq¿IkµlC´æòÛËÉÍÛ Ñ÷úΪp—“æ¦b†ù•háO3tÜ’¬WÒÜýÁÅp­2wß°+‚í0í¤ò㸣çÁ}.‘!3K(9¤»²ìUôՃʲª›•àp {5®–\g5·çP8g¢Ƶ4¿Úz/_Ô厖´á¬Ì’o4—7dôu^åUݾæá éA`¬ß]c$²–Öäü\cØù8QåEš)µÔ(@'n•VÆ=ê©PfËœ"?+³9{´M -rqŽ7ru ƒ‘l!á™åªWx+ Ì,¬K¨Kz]eÅR’i¡ Rxþ6¹z‹áLjw4Gåf ‰â+˜Œ)cÍ´H~0Š”hΫDÌô]¤65¨àI}GëUçL:×NVu§‘¦5Ýr•ê¯eù¶ÞàóUû’ÑI°8åt®*¸YR'½fŽ<î7žÙ‚ãÿÙPZ=ï_ žËáˆNzL ºU<-'ü‰%¹Âendstream -endobj -1693 0 obj << +xÚ¥WKoÛF¾ëWðHåšËå³@Nâ´ Ùµ…ãER2Q‰tI*Šÿ}çµ%+½†½»³³³óøæãZ;>üh'”o2'Iµ2iê»™ïl`ç×™ OT¼‰Î»åìêc »¾ÊüÌY®v"FÆY–îûß®ï–7÷sÏãêPͽ$IÝ߯_æÚ½^ <„ñ+,–<ÞÍSã^?€Êßó uoïEáfñþ÷þºƒ½å§ÛÅüiùyv³]§2ôòŸÙã“ï”Ñ癯L–:˜ûJÃönnª(4²ÞÎfŒ¦x/tøÔ¥¤D&UQjÞfEG“¬èÀ¨ ÐNù*òCJ˧5Ä“†î+F×îqaܼ«p¹ùv áµó quÓ kï{PÐn’ž5‡VvX¤ÝŠ×óLH¸Ã[V/yO«CÉ׸hw;r¼¥”³b“/¬Á9×n=GHØ¢Ý +6i¯ð°,Ž'9ð4&2£ÀpWö?Á O }—]AÉ+ +4kƒoðw` 9ã¦þ†RŒR“ð»ž÷·<¾AÌîQóïc4M=àY—kû–Í }®DXÊÍM+®`Fr¬ÑÑòC÷O‚®8)žÄ „!u_:›ÖoèB»ïEnk%éâC”ê± t|i6,h3Eã±rrwSþë–¯~äS¨2úWRª¦´"œ€²VÓ#Æ7"4dT´;–¬1L™‹ ªlB@ck¡…’á¹ćŒl¸îêc”L{,Ö*3)8·÷»¹ ðxðNNš2UG¢OUh7]¾ã;¨_öýÀ«d"¡ú¢w+ôNì²í$Ì}S¶i8$êƒ ˆUâ›LHY.„’ª$=‹Ìî¥0L ²$å2¯vmÃD™÷L­tM>ðbÒ&¬u¨aŸfMËã ª“N@`µ˜šh;„xo0Ä|Eáƒ.Ô¥çÙÊö,Þ\–ÔT«$ÚÛº‘ÙÏ¢öB_¥Qz’¢cßÙX« d¯z&_,•ÂFÕ_HÒi3RÑ2_š›ç›m»" +xBc™d‰kIÙ°b»æ}ÛT(›P¬*ÚF4¾ú:´P%lª#ŽAPËxx¶¹CŸ&fsÄ]Ê;2 ^Wp昃º=µ†‚Öýûv•%}aÈbUr{aºøYíªuÕA•aúŠì‰Lm¤Ç–:LäCÅbÛÃÜà 8ãbC\‡ÃÈHùí¼ƒ¥´á7ÈÄ\$9­ °š]J‘§ß0Ï‘Si%}F û’š sOòj¤™á̘ ô¡RKGq‡ö"é$ù2³ÁN1 +ÍÉ3àm9è<Žm[œ@7ÈT<ÒÔ’}“PÀ¹~¦Ç¶dÑ„±¸£»v°Ä4r7iŠ¿¯¼*ದÂl©òŠžiðùÊ$ÞF¬ +s„&2\Õ¾Ÿry0enÃN[Ò£†’ð$EN¹Í¨[,7¥ÇŠ´ûˆþnÆÒ¶*7£î4©åœLˆÝÞ˜¸¶¥~VÞäÄ[¼È n3¦B–1B²sÈg.>/¾¼ã¹@‚ÆðRåÖBÀª” éÞËj×v²ßWM/•Ìòw_ˆ×2y·Ë·<ßcšêï‚Æx +, ÈÊAÖU5WÔ…¿•±Šá°î´vÕžßÆWAvéÉ ¿ÿÿz™ÿ„F¥&»ü쎂DÅ0ö]Óswíþ¿ÿhH"qendstream +endobj +1848 0 obj << /Type /Page -/Contents 1694 0 R -/Resources 1692 0 R +/Contents 1849 0 R +/Resources 1847 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1687 0 R +/Parent 1846 0 R >> endobj -1695 0 obj << -/D [1693 0 R /XYZ 85.039 781.388 null] +1850 0 obj << +/D [1848 0 R /XYZ 85.039 781.388 null] >> endobj -1692 0 obj << -/Font << /F58 956 0 R /F43 1079 0 R /F15 895 0 R /F37 900 0 R >> +1847 0 obj << +/Font << /F60 1074 0 R /F15 951 0 R /F57 965 0 R /F35 948 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1698 0 obj << -/Length 2082 +1853 0 obj << +/Length 2521 /Filter /FlateDecode >> stream -xÚµXKoÛH¾çW¾ µk1l6)’ÌÁÁ$»ÎÀÖLI´%J"–"²eÇÀþø©Wó¡ÇÌv`Àݪ®®®®ÇWÅV“þÔ$ý@g“$U¾NÓÉr÷*˜l`åý+%Q¬ý8Š`~fqæVgóТäO0™…‘Ÿ´øfñêõ»0˜„?ŸëÉbML‹Õ'O©é,ŽïÁìÍt¦çsïãíÝÎﶲyS™²~Yüòêíâì!Ú×IxA•ø™ÖC Täëh>ÖÀ>ÞN•w7)ï5y7Õg - –õSÞü™ 6»ƒT´Øæ 6Œ½%q©M“WÓ0õ,ÓÁø‹ì€lõt?Wù£iiçÜÛ%ñê þËÀë„n…wiöæ~eaQì Kµ5x>É¥6M}ØO;IõšÉÄþ€Ìß<¡¸¼iEàÖˆþíÖ49‰L’ÑÅá>‘V|íz·£¡bZâÍŽ¯°7Ë©¡·®^¾Ëí\»ý0%§ÐâG¶&ß­mŒ-œ8ƒòV:£j‡ tCÌ¡´ã»¤ptCç§A,cŒ„P ¯þqåcò…jH€ÍQgˆJ\'VLÅ"€T}"ñúÛqÝcx@€wJ‹¤;úaßÜ~x`B5†sÜfë smÝ憱ÿmOæB'5ˆ‘Ž±T®O!§êÌœx.-œ‘ËR²ÇZ:i‡2,§ •>Xãº!Š¥«›ÀU9%-UϺíÉR˜ ‰yè“ú¹€’¼ºê©cÃJBV<æf‰¾’]Öl6¹\=2ö>§âiÜ ˆ D|7€,9ÿ8´ˆž4a­ÌðÚY"1ÐÑßHí {¦ÏvàG£œñm(„2!\¯q÷3Gž¦ ¸{FÞ]mEWÉbš‰µ`ã¨-É /%A!˜àN¢4ZvÒ}(²#\Ê£¥·ygr·*#¹®|áåG×8Á|)}K˜y'°„q"¢M%,zœ®j;ÂtŽ½%îÝâqÉ6ºÉ¾¡1Š&ß ŽòÏ yðw`ø¹Ý'@~†2¯úß0þ7ŽÐ(ˆÙíhö(€nµ®¢7ÔCG‡ñT]#DhJ½æI—ò¸ý)”$¥P0çw{+ÒkÇÉÞ›ó±m¤½Oñ×¢ÖI -û¥…UJø‹]aŒ¥ûžYëRÌeR’1ÀÚ -€êºqÈštÈ9JF’ºj “+ôÍÏ|ð/¼°ÁXL )KrE©ãÜGÌ—õYÛØPà¥+xÔzœ`4Ÿp@×賊R -fìC”ÍÙ.|ÏL$䉈YÅ}^¸®Ê߸ö9ˆªáÀ~®ñ‡u%Ròo'¨µL#„ÄÑ•’¨¢Æ1œ:­%΢H|wÚ€Úbçн>Ø‹ÀÞ‡Æ[ÜÅT›îfxùê†u]– ¾-ó¤ï,JÓ0ã3¤‘]†˜“qaãSŸU‚© -½Û¼’õÎ|uù$mæ¥$@×eñI!m\Pð„• ˜3׃úrÔX™q+ÄQqŠFßÑ ó¨©7ÙµL7 Ù8ð•=ž~;äÍ‹Ç”®™«6e~á ¿P‚‹!KÜIf$S©¾ì«QÞ¯ÃÔÁ~Q2%ÄÉEŒáAú§¶°…; É+òbPÑ ‚b¼Å±ÆæÆš¢ôs$ÔòX憂_)®ˆ]]…µZ8ˆnhÉS ¯þ‹©AY\7õŽ™ò1ú¾0Õç}ó‚;·¼³¹íúG¸ƒãînµa˜èÅ—/,ʃ=?Ê{=R ´—gÁ|Xˆ2ïvÍÒÍ…ô‡¼G×k 0p uy † ˆÏ”b:9ð8ÌxÉ0}àRÆãB¾k–¸ š:Øs©¶]sôÑÍèsò%ô LÉ(Ô”ÿ§µb•Œ°¬*þEˆ -«ûF\+Ò©YÖTñÇ9œ&d-Â:‚:ª]©ä<®rÍK{G·¼rr`rLû’–vu¹û Âi!G-kyè!Ù>K¸“ RïÃ(-`ËÎ4l•h+¢ºï<³:þžqO=`á“ÔsQRJÑ<ÛGœN¹÷¡q ‡…Ý$|Ö:¶ ={ÉG¯;b÷áqx}®îèa4E— -G/xç2aÀ µÎ®ci”çð¸ëÕ?ؼõÝ;ìàý5ÎR?JGÑǯ´aý«JøEûò+í<:jhqÃdüîÆ?{J¸Óendstream -endobj -1697 0 obj << +xÚ­YmÛ6þ¾¿ÂhˆÔZñEowŸRÜå¢W ·{ŸÚ" -y-T¶¶’œí¢¸ÿÞy!)i-9wI ¢Éáp8œyæ!W¬"ø'VYF*_¥™U–­vÇ›hõ#ÿ¼VBÇ*Œµ†öÌàÆnF:•±klR‘‡J ”ùöþæö­ŒV2 +“D­î÷+!d¨„\%¹µÒ«ûâ§@ÄëMGÁ¿šõFEAq®ËnýËýw7ÿ¸÷Ú­r7mfýhµ‘*T©¼j\’Š0JäØ8¡ÁÜdbìVÈÜ +6ïMñÁœzóP®7"X40ŽÂyû¼Y ╈Â<Ê'È,LÓ”,¸?ÀŠJéà´-þ„¿UpÉ üýµµŠ:l?w}yä‰cz§jSšºnÖ0ÿ©:=ð°)>¬ã$0'ìîAÄmö¯/wë턯„MÍìWŠ0ÙB< ¥C¡ÀÃüg¨<Œ³Ø/BÎXg*h º‚vùˆV¶¥µx£$¸¢1E…¸+)ƒfÏý]oújÇ}¤ °ý¨çÀz +vž…N +Fêü9Š#œÖðO¥Õ³oZnèÎ[g¥; èíô%F«À”â]ýÊzeêŽÖlÁ€4hν=jÔÒP¤‡[¹“ÄÒÑ€çB¡?ùd†éËcepwut'RÛ0ëÈLoﮯšoˆ÷G½=!þÇî<‚xt,è•“mø£»Æ—÷Û`¬ wÍéçHhŒ‹s[Ú|¨Žå¢ÿ)â\|º‡ùW?¹,ž›ÖnÉà0ƒwUOÏØ4 ´bsšÁätbs6oçpÛÒƒXÆ¡’ÉU1’Y&11"¤p$F2‰ùž‘…O8I!·¹ ‰«´+†3Bï_5jYæ5¤Ó„‹Þ]à»ÑÊÖHD–m÷ÜqI°™{ìPB2~YasÄ„Øþyv5Öê*P”Óúf€cËé®7©J‘jumǧ‚WBsvæä4Ú2†?H_…¶Êv\åcÚ/-S×€O:RAM$e°¤ÀnØꉇ(Ð×íwMÄ{¦ñë’>†¤Ç솼/íÚi7Áå>:všÄ:xc•8ŠkUÁÙÝ¡!¸/X–j1šòÁšÌ6\²™ý™°Ä¥h'á40Žs*åD•TºTÃQ¢oX¤-\!³VR±Ê¨§çS«±¤Áuœo‘(rAƒúÝŒ¸É7V3“áŒ9$iè6hÂ$"{Å™±&j|ûV%£h!…QÆüý‡û»û7÷ÿ¹[cÞÝqûöRÖöý£é`I‚ßSÏãʶÇ}ÿ€´tv`w0-·^ŸÌ±´Åö}uªú÷û³ó8vc‚Ìßغi.rklâý¡Â‰âgO#hùXWQìÐ%¦ölÁBfëê/ȳA–â®êñcêª3ƒr<¯óx5âê ÇÏ2qîë-fAÓ3&v(ÑÆmpH½ª˜è>\9'P®¯_G2yE˜ã2È)-C‘ÅyCXÕÞ!ïzÌãÝÿƒÀNçUã™e† +0Îáb©!.®;Ø9 +нk|&U^Öð§²;R:NüB8K?vóñ³+,‰µ›1Õk ÈYà‹Óÿ±í›™ôœÜ´´öÈ„ûÜ3@5ê¹,Aå‹‚Ôpå´‘Êjq_ßKši'z¢%_B†p¨zt¡n”ÜÚ[Ûþ:N•0ÐwmsœGŸ‘*"uå- ɾz3€‹0Q1ÌCyD9LÛX)†Œdo_3ÚÜÙë˜Cn9Dê,jÝÎœÐ×E¹¯—4’†³GDbìücÀ¹ãs÷[ýÞB[ÄðæëÂ<.æ"Ò>K}±…2»4úp.»~:øßÿW>!"ôˆvŒ'òbRiAn`0†Œ¡ @éÅÜnÜç‡óe‹fVv¥sWHÒŒC,ÂAÕn(c¦‹]bª=»¢9 ׌§ƒ»·;{覵LìXÀ5Q[Eá)¥ôî^Š Övö>îláÁ’?š"ËÃL©« 9’YFtL>Š’ ¢[B}w0küFpî1ýËǤ;¥W­d–!]ÄigKֽÚ)"V™œ…58•Þ}x™vSvLœ{CWEèØ2P¾ ÌH¢ò˜Ì/dC¨pŠÑüÛ3i©ööÛ³-ü>‰V×ô ZöÌÝ£Ç"Š2|ô…ø+ü^Š£d“ÂÌwø뀶Eëôâf€—I­æ¼Ûô«ž{mfXg¦Ö²=-­ØTiŠç5¸a?ÕòËôG  'Œkfǽ$¼|ÂP@ D_¸ßŠÏ»ô:]›‘²¹÷ ¸›æ¯ˆÆÑÃV3“‰‰‰ +#­®˜˜$0˜MLœ¾¥#Îsø"ç–y¼^<*§ªà*äãÝϹ¼?bñùÉœå&œ;ú¶™§t ‘š^I†®™ α&ÇîiÛÒVHTqyÅBˆÎeàxý0ü €¯ÝØ÷hhEþþùË÷ï¾ýû»ß^ÁøÛK„]c}ÈˆÑ +ôùš‘+Ç¢ç/Ã|äc³s9¾Q’Ê}_ͤ2d.ÆTñkX¶sm<|áY::xÄù)%¡`äPßE(âÏŠW§k3Rv¯2‡ÁÄ/øÑŒR¦ +ýE,tº®[΄›G:1ñ2£èÕ‹üߣù•¥Çž†„[>&`té}Y¦%ÁàL¨ÛYï}c.b¶]SŸû¡"ú`ß»‡³«0ó¨,©yµž{ zEÄc5ÃÞì}`|¦W#J¤2Œ‡R¸[ŠäóÐªÚ ºfð/ +“%n½Æ“Œd˜kñ%ìsª®Ú'£¢Hí»üS'”TtpêK5¶_hôù;Ã!jè='ÀtÏRûÜ^)È4xðü52•žØ@—y@ÖDÑ9›GbÊJö— ùåÆèϵn'J_P˜N¯G m‘Ó/¼D¡œüyvùõÀIΤ7ˆŠ« ·’ä/׋UÆ™Z^ðO´ ˜endstream +endobj +1852 0 obj << /Type /Page -/Contents 1698 0 R -/Resources 1696 0 R +/Contents 1853 0 R +/Resources 1851 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1687 0 R +/Parent 1846 0 R >> endobj -1699 0 obj << -/D [1697 0 R /XYZ 85.039 781.388 null] +1854 0 obj << +/D [1852 0 R /XYZ 85.039 781.388 null] >> endobj -742 0 obj << -/D [1697 0 R /XYZ 85.039 761.463 null] +826 0 obj << +/D [1852 0 R /XYZ 85.039 761.463 null] >> endobj -1700 0 obj << -/D [1697 0 R /XYZ 85.039 671.062 null] +1018 0 obj << +/D [1852 0 R /XYZ 85.039 671.062 null] >> endobj -746 0 obj << -/D [1697 0 R /XYZ 85.039 671.062 null] +830 0 obj << +/D [1852 0 R /XYZ 85.039 671.062 null] >> endobj -1701 0 obj << -/D [1697 0 R /XYZ 85.039 642.326 null] +1855 0 obj << +/D [1852 0 R /XYZ 85.039 639.536 null] >> endobj -1696 0 obj << -/Font << /F20 877 0 R /F15 895 0 R /F37 900 0 R >> +834 0 obj << +/D [1852 0 R /XYZ 85.039 525.326 null] +>> endobj +1856 0 obj << +/D [1852 0 R /XYZ 85.039 496.528 null] +>> endobj +838 0 obj << +/D [1852 0 R /XYZ 85.039 356.132 null] +>> endobj +1857 0 obj << +/D [1852 0 R /XYZ 85.039 335.139 null] +>> endobj +842 0 obj << +/D [1852 0 R /XYZ 85.039 189.833 null] +>> endobj +1858 0 obj << +/D [1852 0 R /XYZ 85.039 170.961 null] +>> endobj +1851 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1704 0 obj << -/Length 3531 +1861 0 obj << +/Length 2882 /Filter /FlateDecode >> stream -xÚ½ZësÛ¸ÿî¿ÂßDe,†$À‡>º±Ó^›sÚZ™ëÌÝ’h‰5IÅÑß}¤NÚéäÆ3&,€Åb¿]*¼ à/¼Ìb?PóË4 }•e—«ê"¸ÜÀÈŸ/B¡Ð±òc­¡}fpfGgIä:=G\Î"íÏüÓââíû(¸Œ?IÔå⑈ë_½0šÎâ8ðÛ|:SIê}z†gè­šjzE½áÞû럱‘x÷û®Ï«éï‹¿^Ü.Æ›i?_e$ðÓùkƒ¡òça<æ2Ô¾ÒÉ!—~È|Þç«][ôS`qϬ5sÖo§³ÐËùeRç/–sìþyr†åÈO³ùk,‡~ ’²\ƒaÒœ¹úXOiÃ( ½æŸráú–(ÁÍ&GºžÇŸ[èl–e^uLôR ã4#¦#âõº’¹WQCýdôR!N(iõ*¯§Qæõ¦/šš§Z†&Q€Ô›Éö:Ó‘ò®W4”ó¦¼úªá¥ˆÏ’×°lÀHQ.-Ös’‚9ëØ›˜e¯¸˜ß츛–ÙÐÓsé™ÌJ -ÛUC’SL˜piº¢»Âvæ™zÍ…¬²EIa£nøIGiðF¨•? !ÊŸw Þê·x÷ŽŒbÈP÷ œ·é˜¢,ž&çyåÚ œ‰ÞTgο5ÈšŠ¼9QÚƒ÷У>åM*³)ˆ¡‰tà%“¤€rŒŒ%%Ä«i”zÛœO– Ÿxm$Fbâã—i¦‘i¤^?¬õ„="m¼G|ùBçk÷üÖåmLÈò%õÆÞËnƒÆ_DDÛ›¶Ï×£¦}ºbm¢;©öf‘†ìfââÈW»[õ¤ŒBa™Z³¢voj·Zžw6>°HÞIe»¸Ìª¨Qþ¨7så=’T+&ÁÝÉÍe°îEƒ»Z® zQ -Ï q–z·f…çÛòÈÊ”%·èšñiõV¾‡&yHègÍ„†á(Þ‘ëQQê+p–³Xû!ûÅÏ¿þ\®Áýõ"ðÕ<»|vÃóËêBùQªä­¼¸¿øÇ°|ÛO->þí¼¶È”@R¿qPhIö’È—b¯¹ÓÈÃgƒD†GŸ·W¼x#KÕs‰ê±²JÕ£fãÄn‡Í£´©¬¿$ßÈížôˆ›%Æïß–ÁUÆ ·Nå,äIØ| MX±ÿ'áäëSë•5Þ£ù2óŠ—újøôrÅl•Ø:ð¤°ðÛ÷*)€3¥üP±›¸[Ü/®ŸîáXQìu¦zØäý\!Bÿ°Ü?Ô¦ÊQ5 `ÐB*ˆþï>Þ-nÿµàŽ70Øç_û+~eÒS¹Ü->ÝßþóðNfÂNy×=ôÍS^Ëô]Q÷*ⶠ‹ú¬ÏÍ-\;¯´n*SÀ§ûž§Çƒ] º~÷îã'àð/×w7n…æÂ*þ‘EÈS³q‘¦€û³Ä‚\JÍ%yâœ_î>}øÀPÈSk0Bž ž»ÎieYWŽ jCIfñÂ= ä¤zMÛ¿Í¿>³ÇG³èí΢ÒÐfì{§¡¸Õ3?#áXbh4‡c -âRÕ¿H³¯¹cÐAæm°MšÙq³©9N.%ÈmYw»¢ÂY»²7µÕöQ8‚ÆÞ¹¡Ó¨ÇâRkhø -Fq 7 æÞ› -ƒ¨[¶ÃÝÎrqJÇ ŠzØmü„Úò„Q½™J¼»¦­à\{^ÃXBî¯`rž‘f×Kã‘ŸŒÌZÁ>DZ"N|•Äpâ$ôÃPýðX OêQx…S 2s ˜~eG7ß öä‰@ˆ/xS6ˆ„Mɽ{œI Ðhd@¯zI¾n\ÛÆQ®zh§.F…ôò|\µøZ‡ -`TÀ¡8ÛG뎟M×q*„ô<í¤.7‚£þao¿íQþ÷ćˆ•Çì­Óʼ­‡Æ$Œ¡áð˜ E¾5â”@y·_œz -à‘›·©X30&……¼WƒæðÅQ( 8`J Tœy #¦ÆÕI±©¬Ÿ×ÝÎaˆîۈ㯜ô¢19–3Š§þ ÿv¦<±HÑ‘Ý¡›w@D[/+ø]¶²°±vÈœö«ã9I£ÏÏ;Ògb&„€?á&7v7ôZßë‘°W˶ˆº#B\òdËWî€"ªÜ ªŽI쳡òó.çWÔSzZ4íÖå¢4á‘·º7ä—¼VÞrÇähq -b­aøQ  ¡%Æ‹=·K¼•@óª´äÝ91?Wr ßXœäéF€`Ë@“!¶ê6·Ö°k®×Å4ƒ´ÿÄù¶Ñ$#WìcÔ/I—UxØŠMVWYÄYdì°ÓfØIöÌéªì®Ìá3[tA ->éH¤ðŽY.=e¿º‘Žƒ'†Ý-eRÝÉÀÆkâ/$ÐXÄýˆZ³—ƒÉ#'d)+P β¶Z½«BâH0a‘5O.QL=Á"$?NêáÌI£Ð8†AlÈxõt‘^âÆè@Iviˆ;^NxRMàfG®œºÝ²ÃCÕ‘£ó ¯ÊÏøåÁ!%žSNÉ•±7æì=ä%Rs) £L˜¥Ù´*vÀ«Eo*–dÞåœÓ“ÞKœÑ,)0åš0gT"×D‚X³½Ä¬W…½˜5ÚÐÃEu}[¬¸*„ýl7+Ä1zŽw"Ò¼–ÉV{‚±Çâ - ÄËsÑþ¥-z§Uõ±ßGÙnˆpTä@Õg—ÐÔ߱٠ܥ˜KŠÕîn\ Fú¹CH£`Ž -!ªúaO’ká`ßã¬ÌÚG³ÆŠ¾ËËÇÃuÉÞeœõ/é,Œc Qùý7ÚQ*X‰„ÅŠ©æ×1–¤êX Ǹ2‚Ôƒ7ò"fߣ·$ $Îu d¨0&TŒáîúæþŠ[CŠXÖÔV’øÚ¹8ÎÎûK‰.¯yÀº¯l€e9-WÏÎXë=ºØ\îŠ5#wÒx:b í#\[Ë”K®ê  †îºãZqel¾”[3æ ‡!S)J# µ9¡ÈRǥˎg<ÁÁ‰ aÎ>±X-FDe~²Ñ­’TkS«ý)P—JU*•B£’€³sWØ¡4ˆ:6¤Rïžç¿X_B®æ׆Ã+å=wÉzN o:xˆ”ËÛ¼£î oøÜ6ÔÉ‘g½sÀ½“…ÉáF -™?©ÏÕG†Ã‘EêÓM!híÐuÆzî^k!©<³kÇ•*©Â7í¸FòíšÀÇßP¸=8H`Ïm³êV–Ò!Qµ£…>MÌ1a×mùÅåž@ð²¥’½¼I*ÃdEçb÷ÁjZô%ÆPÁ§é_G‚±%"J’dê¡Ú=³hÚíV×ĨœÎÙEJ›K¹š >¹\ì›Ù€ƒ«IjgS:IÄFI½­Ù:Ù€L¿^†j¯†‹>ä.ã€a5D¦¦Š/6°àƒã.8Ô’÷âàI™;ÒQ+.´Ÿ~Èp¨fžA¸•+ºÈ‚ p;€âÇ–°®ñsP?ù 9—ÑI[àÙæ\º¯ùuÂJöî]ñýqébÅ‘Ÿ¦©¯•þ‹Ñ÷Š7Ræ†L [7ù`5mn³Özc¶¥lt‰¯¦lú pcÃ,­ŽÄ0ôX&mqˆ×þ-}|˜«$ןFÉØÁœ÷ŸÓ`T:×£\Ü»Kài̺~hŒB–Ƚdp® þ¸·óì‡8uæcED~4,»?ú -Gß*€5‚ðÌÇð€c––œÔZ…+ˆúôÁpÐy¤c„N{Y!ä¦ÛˆtÇ;0‚É™š¿Às6XjÙŽGŸ,Gµ¡`,`µàïâ˜\9tqç:¶#Gƒ.î‘Õ« æè[-UM¸=|Ë Á+^î—í ëpôA‡£Ê{ŽPÂ>‘ˆxSî¤t6’/cêáý±+ЙFè R?˜g?¾ŠÉš±&xœŸ|S~’żÆUfñøäTGÔHJ. coÈ’GU¬’¥¼Î{S` îƒ2oll°FGîsý4<‹T'I^‰oè8‚lrëøüý€©#«Å.¡ƒ±Ê¬-}#îÅz³Vý[ÉaíŠ`ǹ˜5ä>1ŽÊo$ìw[-ÕNÙÁN¶ŽìÎi´þ•p1dëBRÊsÐu—KL8¥®†úÌPÖß4ÕðU ©ó!´Ï×I¿jà(há2>å2ö¾ÐÌð †èx¹9{µxHÁúV~Z1@9 €*¢E{’Î9 R> H¸×ÊaSž‘Êšœ¨±ìÆþN¥E&þ4*Ùº°í78pýwù¢ÃµlÁ‰ß*ƒ¾/j y› ÐQñð{ƒybKÕCΛ¼Î)ä®ìûÉg“Y–ú*ÿ°Oìò#›“à©ý$þ#<|þXáM‰™kùE4F%Ù1{)¬“è?€½,õ_ˆg%%ù‘xÚfÇ…§ç1Whàé@5¿æ_Ê“Cž»oDâjíë£ [™º $ -ÊTnÓXÂê\á‹£·à…ÒþX‡~€Ò ÉŽ‘Ÿ HQ\Êj÷?Ýø§hÛ²áM§zü»¶ãß·EQè«0ûžÔ’øx“Hìœ[ý?®¸Ò endstream -endobj -1703 0 obj << +xÚ­ÛrÛÆõ]_ÁI Îkì —æ%²#·NbË5©v2I†ȘT€´­éôß{ÎÙ @‚”ÒH£‘ì.ÎýñQ?|”jÉl”¤œÉ4-6gÑèvþvÆí‰Ð {g^MÏ^¾‰a7bY”¦7Í”–£iñKðú聯ǡ”2àšÃ$Iƒwc\}ýÓådüÛô‡³Ë©GäAÐ ±üûì—ߢQýp1™¥£/p1Û›3@ô’öy}69û‡eöÔȼuŒ)w"äË„~˜ñ˜3Kϸ€]ŤŠ‘qΓ\Œ1)☕ãPë(ø×Xò YmWÀu5yp âˆã`SÕÅn e{J*a W×!â¸îiÅ'bƵ â.óÅX¤ÁrªD!ðT»uiÖ–yknòÊ\Wl9R»j‘œXªí|½ZlW5žM§q¼§2¨›cx,üí2ßZLMÙCµ@ ëÜeaÖ¿¬¶K”0rT]FÌ´ùf,’`ž£•!@K >Tù¦4ÆçV^´»9 îÛm¹9”»Ð` Š[ÉÇP2‘7ÁÐÁ +{À†1€õ¹CÈÔÜhèþ)‘V”IqH«Œ@·Z= ­ÖôÊH³XÄ{´ZÓx:WJ¡ÎéÅ]~Ý–MFO<Ø '}+@ËÇ5«œ_#ƒÀ§/«µ}¯*?{A4dà³ÌZKÐFf8ÁC2s@ø«õ.!¾FDžÃ^–s4+D’Æ`¾HĽyÈÑ>5Ü­p9Ÿ¯K»Ó°¹yÜ7e ››õíreŒ Ï"ÆœX¶@ÈØú "Ê‘§{»öÂJñPÅJÅä¾q–±H?MÅVØ6T±RÓ©öQ´Ž_ܺDMƒòI]°ðÖØ'©EÊ„ð÷”<’D ‚EÞz@d¸Á«èì"q(œQÀ¡^8@qS8À—¾ZQ“KsÐ;iZÖŴ¨«_#®`ëv×صöžhÁ@ÏÖÞt^X¹Ùù ž+œ±Z@Uy,íæ-†<7-’H&ãQœÀUë'éÒÁ +{ÀŽÿX3·îÐ-"Âô–= ­ÖôŠ(ÐÂ÷hµN†f CyEZnɸPÏC±…õÅü)Kö(Þ÷G8þÚð8E‘;*¸k0‰në-Eƒ;Ã`ëÆDQé=|ÂmíeÛÖ,®Ú¿¢P^¾»è¨ ¹R,‡†ׄÈ|?L/¦×(Q„F‰ng›º0±,ú\¯ +¤ø[mߢÌ]ÖtIMd–*ç®D¬§A»¬I…9¶ÈÉÑ`£®J³DœÂ‚‰O4ŽóÛU»mrŒçìU#-ÉYUô ¢¶¢2Ô8 Ô»ua³‰åªK&M¹Ý5¦b“Jƒ¼†Î,ÀëÓ‘ÎR&$¢3XaØqgNÁAÜ!$s2Ål{ejsàÄ)Ëž…BéaúÔôé»ú姨JD9¶»)«l]„‡Å¼*Ì©¡”¥ðäYxp°æBBœdÿ‡eœ±4~Cp°!1è¤ö áúýäúõkè¨x0ysý“•zcl.›º19+q¦”í¥®][ÞìÖ&àTcpœ­‰*eÓ¸8´èʇH¯°s“£÷­wÞ]!êû•EÓ+¥9ú5ßÜùJðÜl˜8Ẋ I"S# !—Ë'VçVØv̪á6N{¸X·5ú4;&õ»±– j—êñÝ_;Û‚›Ì‰+6ú²…‚ëŪ·´2©õÀ†ª"b¿F7Ê?•(VfJ¡V áÏÀ ÍQf‚ôw( ÀHò̳ˆÅZŽ„VîcÕŸŸ[XaØ‘9p&a3ö;á·¯Q2ß9Óå,ÞÇÛq*TL]YÁ¶)ïÖù‚‚2<Ñ7:”›…5ì掆ÃíëÔàwSa…»V÷>ø7⮀û?9ÐYªgAUújž([À~WtèˆCo4&f0Ú=ì=È# Þ£¸ð[XöˆzÁ€™)ØPùC¿…ö€ ý +º_o/ðO¾ƒÄ¸«ùQ‘ +8ñŠÄ«H+3:OÊÄ=§•šHÑš[TPoÛ$haEºõh@QÈÏ6Mö–®ª,NÎ~¦ºh‡ßV£€>ì|QìûBb‘î…ÄŠ‘¯Í[˜«íºïœ÷ŠaxXÔ6HcäD$ö`øN^™›ÎÆpÕ$L8VÝ’‘Ñ[<#I/W8[Zö{å†9Ÿ7–/Ì짱½ú(^U=í;/¿Ùš-¸}Æ!+§ÐÓ&ÙÓÌÖ +{ÀŽ˜-Ö ©ò‘ç…ÑKŽÒ~a˜êx›7·%¶9J&Ájñº±1ÝáT[(°œBqÝûœ‡­e‡¤u–²v:³=Tî‰èÁA˜r¨ùÈÙͤ´ž»l¡“þV(›)(°PBhBÄ,“#žH‹?¤ˆ$V'a@…=X¤‡=’$až¹Cfö´2n6ø2‰1VÏCœ…õu³"}êÚ®èÚû²ÃQn匱ÛjË»ð~!{Y N:—i<؉!ÈNÀ¯t£?ÿ¯/Ý E²Tžp$ ‘?N”¥™N¢Cr5T¤:•Czÿ&™`ƒendstream +endobj +1860 0 obj << /Type /Page -/Contents 1704 0 R -/Resources 1702 0 R +/Contents 1861 0 R +/Resources 1859 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1687 0 R +/Parent 1846 0 R >> endobj -1705 0 obj << -/D [1703 0 R /XYZ 85.039 781.388 null] +1862 0 obj << +/D [1860 0 R /XYZ 85.039 781.388 null] >> endobj -750 0 obj << -/D [1703 0 R /XYZ 85.039 761.463 null] +846 0 obj << +/D [1860 0 R /XYZ 85.039 761.463 null] >> endobj -1706 0 obj << -/D [1703 0 R /XYZ 85.039 669.62 null] +1863 0 obj << +/D [1860 0 R /XYZ 85.039 736.911 null] >> endobj -754 0 obj << -/D [1703 0 R /XYZ 85.039 669.62 null] +850 0 obj << +/D [1860 0 R /XYZ 85.039 444.486 null] >> endobj -1707 0 obj << -/D [1703 0 R /XYZ 85.039 642.113 null] +1864 0 obj << +/D [1860 0 R /XYZ 85.039 420.504 null] >> endobj -1702 0 obj << -/Font << /F20 877 0 R /F15 895 0 R /F37 900 0 R >> +1859 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R /F57 965 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1710 0 obj << -/Length 3398 +1867 0 obj << +/Length 2512 /Filter /FlateDecode >> stream -xÚÍZ[sÛ6~÷¯Ð›¨LÄðÞö-MÓÖ:íÆêtwÚ>@"-qM‘ -IÅñþú=7€”DÛ™ÉËNf,8ÎõCü™ÿüY¹^˜Í’ÔwÃ4möWÞl #?^ùBáÍ”ëÅ}·ºzóC”Î|Ïͼl¶º#’Uþ§ó¿­Þ\,Ã0tüÀ],“$uV?½çžß[øλÅÒw~…ÆÍõ‡¹ÿöí4 ûß·«÷7‹¿W?_½_v_*WÅ!nÿéêÏ¿½Yþ|å¹a–Πí¹~–ÍöW* -ÝH…ò]]Ý^ýÓ®ÂcjƳ&¹4K?s³ šÄeVt+7TñXpú`±Œ"Ϲíu목 8dœ8wm³ÇVìüþeq ‡þ—9ðÄn¬v7?šü¯5,BëûNs¿Qæô;Óç9‡¶„=n§[h=rw_Ôº^©ÓwÜq9×wæЬ‹&€«š3I)SˆT÷üQö<ø°§9ÂH•sO݉î{^ø9yßðX^èŠ[%Ríø9xÀ ²ÈŠ®ï*£óñüå—ÅRÀDοwMË~§{\õÑ‹•Y - ÿŒ[œ±^,¡«ÀÀ© ¿wÐèy -rÌKÜ1GݽÁ?sîøË‹<ü4ÜÜè|JätË$·Ðîpå¾ØÏa‚Ïý†ïÛëïå$tit}¯¡G¨ÔX Iá€TÍZ¯ñ$xÅYäè|O[–²O[ä<ð5Bc;iƒdΚ(sSz΋T‘ÁN£–|Æ?OßiYgÓÔ]ߢð6´.;ÆN^šCnŽý–MCÊá_X«Aúþ˜¯uWnæüq¬qö—‰×ÚŽnmPa¸´ª¼7»ÃלD·™:M‹ñ¹rBÏšd -)YÛ[Ï$õ(Pêf KßïHl÷æK„]sƒè›öž•/ð-±¿iŽ'ÌãBd(ÐFui báKÙõFqpÚÏØzÒ³3BUé0TNG˶£«ÂsÎ9pós©eµ’¸D½*ëœû‹3±Ú±Q%b\(3þ~Õàz¼|oõŠ{ºíQ¥ÁO’pw¼?Êx;6>Ë5i±âóø$µ|¹Õ{úB+‡UŒú"§ê‹ó4ࢺ*º$¢”ÍÙÈgÛ0ˆüJAç_N€ï¿Þv,hÔ¢A!¡ãL”ç"'O¿äHáט†¹$>CëNÈ,sÓ(~*dEnêû/†¬CÖO¨ÿEÇQŠ•×G½1}eÍ]äþ°!"lÞ¼ϯŒg^Ê1 ܶIžµ9’2}R""¡˜×F_¸}1/ϸ€VÌÖ£ïxÃûKò“+N¹ƒÓsO)»®Å­ì˜`Óƒ>PŒ*é‚+¸FV'ÞÌÛ¶A@LüÒ´7ìÁòL%ˆB¾’ÔCóùTµ†*Z­ÊmmGÁŽ†GðPô‹â -8ûÈ-ÖOd´r>ËÇLeØ̘Ýy>X&¯E’þxº“u±–mEq}"3Á!ˆ}³·ö>Ÿ -_L4Ò ¸~Lø~¢ñ%£ÿö=Ã@Í -&/IÏO“¾mÑscZ”´‹ÍT /ÚŒ´M½•Çna¼.­×X''Ô­6‡"¡"W â5·È0‘õ)=±*X±r™€9o+sÞæ5û–=k‹xšætKè!Mn{ñdd†r»š\ôZÔrlÓçMe¯V†ÿòüÈl„ì•ëª01klØÁfÍzúÈ-¾»š?4ž©2ÙÃ3aé'¤h8˜ç<òÇFóõ¿æ\CœH°7HIWñÇ*ù¦ì8N¼y}OúRóTž¥h¤a¢!»ÁFYf[ÔEK /LÌùVQË à[Ž½á“S»mK,tÜi”…Îw”ÊþA ÊE@âœÐSgêÁZ;(L0rÚÌâì–ɆéòHæÆ“çìöƒÒõE%tr×zaR ›P=ySƒçÏ&}#¥óiÅA-m3š!¹Y#2!–HEþZœ*Š&—?ÚÒ[æ¼ä\.çÔÌ6+óB4«îPwfuY«YvÁ‚X_X‘Š¶/ q¹lž|ݯ:k„¬8¯˜fðÚ{ã+ñïÅÛ‹•bÝì\ðm0Å\ -P˜jAeèÞ£’ÞF€½TÀ¨!eQÆt•Á÷ÖFëQðiRp)S9©ð¹@#û”Rô½9¥!¹j²/XpmÂÌꊾg Ù#Gº_%÷;f‚A´áÿtSeçk@-üåg 0CjÍÿÓ€;Ѓ ŒÉÿ#Rˆí“8Œ18‰Oå¬ÎÉ`JñK8m[Hf8zå3 mMÎZ¡#Ö–¢Òý˜õK¼d"ýË\•¨i]!}ÛøRC~¹{ZãøhdšâÍÖXendstream -endobj -1709 0 obj << +xÚ­YmÛ6þ¾¿ÂßN."†¯zéHM‘â’îíºí‡¶d[»"[®$onûëo†CÉ”-kÛf¦ÈáÌÃy'WÌ8ü³Ä0®ÒYœ¦’d¶Ú^ñÙ¬|w%…6Š­a<²v«a$×ñ(“Æ"eJ ¤ùfqõú­ä3ÉY©Ùâ~&„dJÈY”j¦•ž-Ö¿"š‡Æðàöæzª( +nʹÙ²Ìq&ÞÃDC¬eÞÌ[|õí¢—íDG)gZŒ¢ã³P*¦b5 =Šb8žö¡ ‡‰ÐAB¦:þÍÒ«í%pnÛ¤ü#•/ÌLp–òt _&,Žc+±)šy(“4X“†d¬æ!h>·8Èws˜kD9Î6«ºÀ2vŸ´¼©ö3}´ýn³O8›ÓסÁAʃvC¼pr—¦ÉÛ˜¼¦É›1tFÄ™÷••¸ÆùÒ—{Ÿgí¡î±¡Ñ`}Žô\Ý£vyp—mÌ2ÃO(ÆÙ<Ô* +¸!¡>p)«WH¹)ÚÜ*¤E—ªsZüŒK™¥”A†ZYçk’ÐVDRì`Öî¬ó¬É‰´;4XífL†3»#[%εs8é±€ƒ%’ùg4öˆYY’ú-ŸØ’ÆÁ- +qJÅï›bOVCìiBhSäél‰“ötUMf[AµÃß5'ØguÖvú.Ÿhé¾®¶DÜnrlñPvtýÓ]' 4’‘r@äô)Ž˜˜íöæ=ì’rÂRÁ‰ËÒ‘•MEs½6èÓ*¾¨ÑR!îߣë)žhë£sR4˜³ª·³r¬×kÜ£ûíVmQí2Ì3Å‘Ë‘ú’©Ü¹,œº:á‡Ð 2“@뿱ù2?ìx…3ë‡T*…ö´ŽÈbk²¦w’Ÿ1§S¨4¶+4›¬ïÖd&% 3RF!E6fû®ïP ül*Û‹ 2î²HN¥×Lk¥£´U1é› ó‘bIÜA.Ôšl»ÌêªjG8ç0ÏÄZ·þŽúÚYzR—P-’“¤Ú(wgËÚÖy‹Å­uk+R³Œp/1P3…¨TêظØQ;tš#ÃR)g:,2éŸñ= Íûxt¼BÙH‰ŠRØlz‰yKFî;Rìõ8!¡=i7Ôæà”m)–µ{ÂðG·…æïz“Û†é“ãâ* +Ž©‘Âû«5Îu‡©5¡?H’¡ßS–Q°¡KÅî³_½Íð,¶!éÔáï|·£|Ú÷¶öìq‹s£Å¾\pqc&_f4Ç+ô˜-6L¦Q/qÌhþþÐgTÔ,œó*O»L®‡å{¦«6þ¹r±NuF5uÚ#YS²X&/¢„Ž×´Tý %ìÑD{—°Nj±Ô¼ ÂŽ×4Bpp&Õa? ¥ú ¡†{óK!t¼žA¨S(^C„«Ê¶q[ª«Ö!~å†Ã1w<˜HÅLˆÔ/ütéV§¹'ZwYn¨@‘÷!auv»ƒe[‘[×$»nÂùz¼·Tœñ„êæ‡ÅÝâÍâG¸–iÀ[W±cûèÔ^„ÓáÉúß_­¶ëÆIéÑ5Å9jÿŸg‰¼0+­!Œßž:šÐ#ê¯Og•Ž!;¥œ·éàúé¨PGs&t˜ÅŒ†ö[ „þ„µÁ %\9­ýéÙFzzŒXöé¬OáÀ>—áÀ5¢yù>£¶«O‚ísôªŒûW _¹ÐèÀÝEfРÃÉtÜ5ñwï¿9‹aÛi lò\ +ldFcØñ:Sã’– 4Uj F¸K†x™<g ±ÂýâEÀ9^Ï€ÃK»Úø݇¨÷[Dxûv.¸„ÜüÚNž 6p¿€¦ýEw¼¦ ©0‰†^I`ïÞýða¤‡„zel%í +zí$ÎѪ»ÜÑ«R÷ÞwQw\A7ûœîŽDºsDöBR?ž ”d<-ÐÑœ êLA°‹d Ð×Â]^Óc^ý—u&ñÕbZa2…árZaÑe…uDÖÙ š{YÌ)¦%:š3‰'^FUÆ—˜‘*Ê¢i}åH\ ÷Ñâ8(äOÏßnº«iØ’&´À¦ oæörMÛ}ïé£"ăÙg_z]/Ñ1¡¼§¿¼îXV®áÂf¿3£G•KNGÐÜ©gœâH4áŽÈž{ô?ú—ÂÓ ¤A¹“‚Í™à“hJ¡¡ÕÁƒø°mE¯ªcOJé*÷¨Ê1€üûãxMFB…Oãh¨Eßc »ôþØâ'KwC·¦¶]ýÚ]–xa ):ÀSуù]no…ÉÅK\(@÷$‚ü¿è¦ëx…³±ç ÁbôíÑÉV.¾ÉÊR Hñ"8;^Ó8%”~þæá„;[‘Bñ.ƒø¢fÑ´Ê;ç!v¼žA§,’â/jV+òH½ÎŽ×4N¥S*:Õì0(&z×ìx= îΉJÀ( =ºàC ½59'  ¿Ï¸Ðóÿ²í¾ì™RJ>@æ½É'ÇF(Œ[ ¯Ó> endobj -1711 0 obj << -/D [1709 0 R /XYZ 85.039 781.388 null] +1868 0 obj << +/D [1866 0 R /XYZ 85.039 781.388 null] >> endobj -758 0 obj << -/D [1709 0 R /XYZ 85.039 761.463 null] +854 0 obj << +/D [1866 0 R /XYZ 85.039 761.463 null] >> endobj -1712 0 obj << -/D [1709 0 R /XYZ 85.039 739.701 null] +1019 0 obj << +/D [1866 0 R /XYZ 85.039 667.044 null] >> endobj -762 0 obj << -/D [1709 0 R /XYZ 85.039 626.296 null] +858 0 obj << +/D [1866 0 R /XYZ 85.039 667.044 null] >> endobj -1713 0 obj << -/D [1709 0 R /XYZ 85.039 599.682 null] +1869 0 obj << +/D [1866 0 R /XYZ 85.039 642.326 null] >> endobj -766 0 obj << -/D [1709 0 R /XYZ 85.039 341.05 null] +862 0 obj << +/D [1866 0 R /XYZ 85.039 556.019 null] >> endobj -1714 0 obj << -/D [1709 0 R /XYZ 85.039 309.525 null] +1870 0 obj << +/D [1866 0 R /XYZ 85.039 529.405 null] >> endobj -770 0 obj << -/D [1709 0 R /XYZ 85.039 309.525 null] +1865 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R /F11 976 0 R /F35 948 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1715 0 obj << -/D [1709 0 R /XYZ 85.039 288.997 null] +1873 0 obj << +/Length 1221 +/Filter /FlateDecode +>> +stream +xÚÅWÝ“›6÷_Á#Ü:} $&Ó‡¤±;I/w×Ø“>¤5pf‚ÁœôÚéÿÞ ¾K¦édîÁÒj?~¿ÝÕê †?bIŽ0 ,! bRZ›Ý [÷pòÓŒ 3Ä=Ö‡n{êúaOL꘮ bQ:/V³«ÅÅÈ÷™µJ,B(b„Z~à!yÖ*zoḜcûÝbé¸Ìö›~±9.±™Cì¸r>¬^Ïæ«.š Öº™Àƒ-—2Ä}¬/Â>íƒ%À÷`=¡‹ˆ†»ÚÆî2Üýª¥oÿ†9¾s± …½èéŸ #úôj’¾…JïÁ¢qyŽž@Úéz#‰Ùãô˜D}zœèQ y’=°[Ž +±æéÛ÷±ÚåqfZæu\&Jnâs¨0÷GyÔiPn·”X !uÇÌÃC¥½ÒºÀK½.öŽK…Ý -AÖi‘룭ÚVzêŸOɨ±(‡Œõ¦?fï?`+ü¯g±@ZŸa k7cˆ +fvÙl9ûåȯõåöœ R*"ù€ Ð8Å%å ÊïA Éò·¾Üž³¦üCž„#EQ„–Å4U#I¤!‚š'eÌÖ¥ð^PIga)ô]xØÇQ SšSnÇùa§WkȺدձ–üÝÔM=’ʶ|ób oóúön}s{{§µÐ?.¹lÌÔk+ úA ¤ÚÏÕ…¶Y¤™ YìMcUzq5á¬þön~ÓÅ›Føãõír>Ðá§*oçÏ_>áå×·¯Vó't®—óùÏOè,ç7/¯®ç—é8MÒˆíõóåÊŒ¸qQþÑëUñÙDÛ˜U¿VÛ´Ò÷¯¹Êµ#‡̳7…ž³ajîºvóÖ‰š¥ùƼªê·“ +Ö[½ÉŒnoêÝèî¼&EiµHòõ¾hþ§[’å7íoˆ¨OÕ8½“\]oµ9¨^Ç,^÷ÅZvù%¡¸yÜ”nèBɧúäUkº K£äáâ5›z’…÷•îŠ(^×ǵbólÜÇ|‚ü&+ªøbŸ@Uª¡uRíGD¢3p[UúWÇ®Á\Æaô!ɧ"ŒZÖ¡‘öç_Kîs™Öñwg7æ½ÎüÒŸ'0iÐÿ89û‘ÒiŽÿ•cØGŒûÆ™(èi<_b\²óÿƒõÌþendstream +endobj +1872 0 obj << +/Type /Page +/Contents 1873 0 R +/Resources 1871 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1846 0 R >> endobj -774 0 obj << -/D [1709 0 R /XYZ 85.039 246.837 null] +1874 0 obj << +/D [1872 0 R /XYZ 85.039 781.388 null] >> endobj -1716 0 obj << -/D [1709 0 R /XYZ 85.039 227.965 null] +866 0 obj << +/D [1872 0 R /XYZ 85.039 761.463 null] >> endobj -778 0 obj << -/D [1709 0 R /XYZ 85.039 104.306 null] +1020 0 obj << +/D [1872 0 R /XYZ 85.039 671.062 null] >> endobj -1717 0 obj << -/D [1709 0 R /XYZ 85.039 83.313 null] +870 0 obj << +/D [1872 0 R /XYZ 85.039 671.062 null] >> endobj -1708 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F43 1079 0 R >> +1875 0 obj << +/D [1872 0 R /XYZ 85.039 638.739 null] +>> endobj +874 0 obj << +/D [1872 0 R /XYZ 85.039 638.739 null] +>> endobj +1876 0 obj << +/D [1872 0 R /XYZ 85.039 619.008 null] +>> endobj +1871 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1720 0 obj << -/Length 3034 +1879 0 obj << +/Length 1005 /Filter /FlateDecode >> stream -xÚ¥Z[sÛ¶~÷¯Ð›¨LÄð~É›j;­ÛØΩ•IÏ´EÒkŠTI*ŽÏ¯?{HIT’s:™±ìX,v¿ÝcO,øgO"ß´ÜxF¶éFÑ$ÝœY“G üxf ‡5ñL+ð‘ôÃòìÍ;?šØ–[ñdù@,Ëìwãü§Å‡å寳¹ëº†í˜³yFÆò§Kùøafç³¹mÜBãúêæG¿[\K†ÿ}·¼¼žý¹üùìr9Ø}î™^àâöŸýþ§5É@ŸÏ,Ó£É3´-ÓŽãÉæÌó]Ó÷\é—gwgÿÒ«0Í›ð¬‘CÎÇܵÌ(òôimä´ ˆ[ofsÏñÚëÛž±Nª ºe>m™hBoÛð÷óÌ÷™s&Õ̉®æ™X¾Õ¢‚’™/е‘àIÅ ï/°øÀ½ Lƒ.nVüaÙ^štE]ñŒ²h;¼;0–J° .sB#Û•!Z¦ç_¶´`žv9²f¼H÷—`£zb:ýô©Âã£8ÏÈ;^?0º5 -ƒ¤G\ÔA'dÊ™^tSç©g¢J8yAC¾qwuñZˆõFFWNˆ1Gj¢jXR BõÆšd¡ƒ4<ÒvI—óîI×%)2¯s™Kw@'ÈGŽ‹6jÃE²›m9XÇÔ]ìèæ[…Ã=†(r¤IYrkÅ[?1SGz¤fË:È™m—[º¬á>M;t¤b7ÇœÅ7?÷ã¹í›‘mkÛv`Ø3]/Ú68¯?›û¾%΄Ƶˆi£íÀe×± Ày,÷Ôî®{ÑÞî¶ûþáîè3¶ˆ°¥mó´HPA`\£  ò­ 6Z¶‹UØ~°@û›Àbù£°Yâ´ÈÛ¤mÙmcu(ÆÜ,Ó³ÉÜ1]Ç?¥™Èt¯CÎU…Fàu“å 7ji€Ý6b8]-v¦¬; ÿ´b¨è<¯!"Ø):©ºzͤ'B«‚;EË <7ÌU=ÖuF±…dYÜGCæšd¼Òhà í¾·ì/”†Ûl5âÚ‡[lB†¬É8Ö à€iàÛ<¿Eš…ŠÚp« ¸@ma£;ÎaYQ†²È[v3À˜zQ¶2eKÞ^2ÞñPFèžpG‡Ù— 9,˜Ö;Æ~YŠTW—EúÂ?Œœ:ïh.èÓ,ò µp©.’î8RÌ«ŒûtT8Þ3ÊU b/áŸA4¿Ý!„âb'›É¬ðvÀ’+µ}Ö÷Ñ(Y„6çŸÇ‚Yôl!µŸ°´äS†l2åÁš”‹t‘Ÿ@+¶O9šm:Î÷!ÃÔCKàÄÚÿYüo!K’µGx¦ &б€ìJ–kŠú–g|QؤÛÀf0Ü´÷ëüuƒälØØó{Š}b´^ÍLˆpn­ÞÐDÜ»ë“ ËÕS´(]£" Ì'äzåK¿ f/DÙ ì§]1O•çʦ¤qìe„Ÿ±’”á¥Èh7Ê!Ü؇¼‡OÌü¬Ï³æåÝ„‘ãy-+';r›ºÁìC3רnäEuã(-'ÎÀf˵€%2íg<–¡ª3ìZ!Ý û*™¶#G.‹-ÃÙÎÞÉES®#kuÛpêB> òdBÆ$Õ…|q‘2š+,À)EÃ÷BÙNó£}:«7E+Ð19ßäŽP+Y•½Hþ`òðº±_Wü›0ߦøÒ߸6dOV»87Gtó‰´N*ö‚ðŽ¼¯~S%YÓäŒNhŽHYõÉ›Žl0ÌæÞj«Ç±ä1!2ØäeÑÎS[ ¨x•íɬöL—ãU1ôo‹XįDoä'V¶3­+4B/ ,(sªEŽuCÚ°".xWrð¾’p-› ¸a‚U†1Òãfc›µ8·v<£ÄGŽd¬ÌíUAyÆu®t+M5°4KJÃR4I!ùV‘×\×ú .‘„A¤uÚ ò\ 1–CÍø Û")Ý(ä3¤oWpÊr1zÌíR.àNàr駊cta´+›³.ÏX\0Q®àüžõª!€ÀZêì 8ÈÉà÷P2´mL–`&ÜuLçkZÃù›mB ݪ”ÍQQY²ežCð² ÌÜ"›<¡bíÒÊ{p€J¥¸h:?£™€mAêاk!Ç -¾Y œ\+ÙþAB@&Å^ÊŸ#5¯XuÇ9f*ÍÛôù•ãk›¼Õ3¦º|æN¡¦ÜÑŽ¼¬ 8$‰Ëøµí’Ñþd0¡[€©ŸŠ‚ŒÛò‡žilÍǼëTNLëñO›T":ÖÏùfàÿ”4³é{”m# ³o(v8¡DLÊóAåDD “6®ÐhC‰Ôˆ„ØÉ8ƒ€ìs]5 7 $ÎSQ“1U#;vÔÚäŸh·)6Ö¼0cÂVijødžœ2ûJ£wž‘s`ík‰Ð"ŒŒi¡•ïU2QmE®ê†1^3CÁ—nÊ,µ¬£´ÌÏ*DY¡3åi§ -#?²À, ¡À"Ì¥‚GBK(~Úäò@Eë<𯒸_—=‡9lHd²zEI@YØè >Ç!Hú·)ItñP‘"äÕnO0m  É=ð9Ù5ò;½Ud¼øJFȸkuÔÃ…RÉ‘JÙºÞ{ÚAÃÍ´B«Ô~¤Så¨ëLÉÂ=‡€g'Ævl ¤ão‚¤ŽDz„ÙR§Õ§/Bí_©Ê/&7¥ß!Ó^ÀB"?ªN¹“Õü[Õ"ð £G%ÌG´0å3dG/nŽcÚád{fäyßS¢;¡{¢D'Ê×C²`Äsz -·Èåñ—Þîá7ÿ›ê—Ï3|¨.÷ƒUö™QîñG€V)˜’7l~ñÒêÄ ÷´•u/É -poöèFÛ©Zº‘Û²x\“H`ã¤sÇ7=ÏBl†ö£’†\•<¯Ù)CGJÇ´¯d˜°ž½ºº¨ÛÊK›ÌV ¨8 -Bk*ŸÚ)¯ÖÇ÷ ¦(. ÍŠ¨ …áçÞA²8ìHáÐÌsU•Ž$Çx‚6 m˜X?»Í>Î#-¢¸°«(YP¯Ÿpž††f„òbfÓ$êK‡Ã¡”ÈŸžª¬Fe–åçÌǾ¦DQ³Y ÙÞc ÿµë+è”"åJ…ª±'z)%è.ô ¦.Œl(ãû÷òÁHWµí¡u,¥RŠ ùØÒi@£¢µÜ/½UxQ´^YçÕ«“0û‹'µ?W'ƒùç½yç†PÐ8åƦå{´ÌÍòn¹X~¼ÿ„`Þ&›û²®ŸvÛû¶ÀbÕÄÇ:‰€‰÷ç·7ËËß–<ð -ˆ’Œ`wÀz³¼ÿxwùëýòö—Ë›¿JÒ4oÛû®~Ê+™¾\¼{~¾üMVßä›û´ûr¼úÅíõýÝÕ…° Šez£ÁWU²É_ì¼+ªÎu„«{Ùê׃QÕrÁM=©7b¼X©uÓ=D|æ8€Fm Òž¾NUT~-3ÖÅÿp™î‰Ë„zçt]ïªî~õò_êQ:»ÁcÐ}¥Q¥¢Ìõ`®Þü¡.KõþùÌ…ØÛ£z8]Ë6çD½/›ÿ³ÿÔà9fàúú$_MT‚ðè )óì}Iø/DÚ>&endstream -endobj -1719 0 obj << +xÚÍW[o›H~çWí ŽÂ„a.ŠTɉñ¶]7îÚ}èV Cc­ )DÝUÿûÎ <`²uœ}XY–ç6çû8sf€ºEP÷1°P {>È÷õt«YújùYƒÒÔ.¦âskçs—Z-Xç»<8éqöɸz=}‡7!d@LLÏóó 4"¡|·œ}X„üùsüV ãnÑ.] `+~Õ>}¶ôŒV÷V³ +|ý‘Ê€Ô¼Õè’;H>o´HûµK%lŽ.¢Æbäì£}„ÈUBÇ®‡u[[‡½»\-çóU<1±ß-lnjBþ¤dOuSݧ°>äõê6)² Y©êS¡;cè”&èÛº YÍ_CõÍ×R÷£óúîLˆë¢õÊD2«—gPk™ç5i†¡·¤H «þ‚§0Õ‚°¨§^ÿEV‚¸&EÆ*ûAw5%CóðU¹' -‹Z:ͦñtu¹X^¶Õ$#•LõoD©ØÓò¾hF¨²=`ÑNcKTiü.³ßÕm­Jà8…õꮤ@IU Ëß;ú`j»n›ThÏOE؜ٮNª¤YSb$ç×Ò4Qq1Âù!±é¦¬É±Á}s½X|pècµnŽ^—ïòcƒÛ 3öæG[Fæ–=#›áÉú[Îç«ãKHêRñíš¾wdzŒm’V¥”£×Ë‹•ÝÀøcBý " ÷Ô$¦¦Ú4Ùl„&)&¶o|ê:Õs™±¼kÓ@ƒ¶µÐŽ£Ç‘1[Šàëe,œ§,ÉÕUEž¬»¿‘ SB„ +DÛ–˦:sz5ÂKûCNëàˆ­¯©pÊÎ&ÇÈX™I™š•¼ù&ά““‘¹w8˜È¡å¹½í6Ü„þ³7¡‚ù§Œäë‚ì&ÔÇy´Z¾¯ÙÀe„´C²H¶¤•7É—ZÊÛ2ãóYŽmˆœ§F/KØ&eæ+ÚÆ”#ö'ŸUv$÷8ë’càÙžÚ˜jàÙîá5u¬ö®ÅÐþEƒØö^ƒŒ’uµXF!OÝyö„6‹§EöÎ~ø5Š‚¨Šã›æ·›7qørúë#~ ˆáGÿï\DaøËönV»›ç‹yloàG6"ÿÁ;€Gn Ü¡<ŽÎ(¼žÍß,xKªWã¹òú+. +굶Çvww}1ÙÊå¿ã{äKYÀƾ¾è_¬õ¢¼î#ÕAÀGA÷×;þ1=†]Ï‘µ0l–Û~ îÕû°WñÀendstream +endobj +1878 0 obj << /Type /Page -/Contents 1720 0 R -/Resources 1718 0 R +/Contents 1879 0 R +/Resources 1877 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1726 0 R +/Parent 1881 0 R >> endobj -1721 0 obj << -/D [1719 0 R /XYZ 85.039 781.388 null] +1880 0 obj << +/D [1878 0 R /XYZ 85.039 781.388 null] >> endobj -782 0 obj << -/D [1719 0 R /XYZ 85.039 704.845 null] +1877 0 obj << +/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F11 976 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1722 0 obj << -/D [1719 0 R /XYZ 85.039 678.231 null] +1884 0 obj << +/Length 2351 +/Filter /FlateDecode +>> +stream +xÚ¥YëoÛFÿî¿B÷©T`1|?P\'ur.Ûµ”ÚBX‰”D„"U.%Ww¸ÿ½óØ¥H‰rt(ŠZËÝÙÙyüfvfc,øÏD¾i¹ñ ŒlÓ¢Á|}e –°òéÊV#E2jѼŸ\½ýÀªeÆV<˜,||ÓóÝÁ$ùÕøð›§Éíóp亮a‡æp†‘ñÏCÛóäçÇŸ¾ÜßÒ÷o“Ÿ¯n'Í¡ ;8 Æ¿úõ7k€t?_Y¦Gƒ[¦ Ëë+8Òô=W}çWã«_V¼æ xWŸ‚¾™~äžjè- m'6½Ø„¾eú–G*~µ|k!7ðcÞÍË¢½Û-¤¹E’§Ò”i‘,²<½þj»ª8ðÍÐ #EŠu¹HÇõpä;~›k{¦*×'d«T$iu4Y.2­&ç嶠9ý?É3rÒo䄦³D¦ižqGö±<çU”´hȆ¬ÚfìûdCÛ1]ÛÇ6dØ&`ÀY}Ëxº¶QJ™ÁÔ,O(A ó ÜÀ¯m¤•¨³²à¹(ÅеŒý–ä9éÏ Ã×…oHHvÛoû_Ëî¦O’OV©ŽàÈ!˜Ï7vC?0D¾ÅI'„a5Tk±…!Ó&L<:1Lãz¥8šNè1)î™É=ëtÍ$/øµbƶQ0ù I³<Á¿ÅR3=œŽÈ„¯´²[Z¹àx°o‘FïE[ïÖ}µ¾[°¤²TÚ¼rºoÆAÔý…çù‚ÈŒ¼`¸Zßþ~ZpM'ìO +#ÍkÔbÖãsÈ ¶5'¢låFüÒmѶ±oȺBëÏÉKÊ:0½(+x€LúQ"¯Í»8ý’Ÿ`äë¡’Ëó:ÛàâϘ ØZÂ82ÐÑÛ\³“Y=×1î +ÄTMs½Bäù~yd×r ÉBœÐ13¡‚ß7#+`Ï0¤ »¯–íV«XFF‰AíY‘Q¢À>¶)pM#—ꊾ¼¨ŽÐ¼x9ø±Ç?¼ê¡HêU&y´ÁUÖœÌÌQ‡jA`<ÖM8Tj'óƃqD µ­·Co#rPÞªD&»Œ ‚1… 3æWש¢L2±D5K’¨Mºó,Ïê¬å$<[A«-ÀçRÖ¼g­¼»Uî'“àÂK–ç=¢1o×õÀÚhâBnZfFrNàq¶tEPñ<ã·=l?&ãÍ™ìØÅ9 0ðS2êĔ͑ӊÖ£o¶Þ4{×*‹!noàb^oEŽcqèQÀ<äAFöš¿çnÉC¼Ýr4ô7'œüé=f‚Ü‹3\xàÍg2ûÃÈ5(LáƒxÿÁ¢ ÷6ꉳ’Øæ5oyzD†wÿêßWh•¶E:Vm3 +v5[4¿ä=²3º¦´ä$šÔ<„ÚUvÝÙœ¾n§‹ôóG©½jŠcªPaȆ/—Ë´Â:Ãv ¹!?Ô‡¤(í‰C +¬(Í@BŒ^:y åÉ$m‚jY IŒ’{â€öd˜»š¼uƒIº¬Re­rÁÆêÄÐ|¯-¬“ºä»QbyÊxÐŒ"'Õq"XúIª³ÙáVÌ‘n…)Ìí@Ïò8-"j˜ãì|]UˆìFǀÅŽß%³j)Ín±V'×™©, ¢íó ¹Œ6je"ïÏz¥,R•¶Nn‡Nè@ÊÆÙD§ÄƬŠ.í€+*mÃäâ£SÜCøº–iE! Rï7i’.¸xN‹íšGS¨í§åfš‹=†Ný—ý%lä´cjüùýÀ0½¿ù÷íóôáññ‰éÿÎ?#¬Ìm*§·oÔ ÿ|,ã­¤J‡˜ð—À…ƒu ÎOyŒÁDI6uªeNxP*%DU‰=ß¼%™ƒZ‘ c”…„һʲšäoÉy•m¸|iñõ0ëZàñéæ—/·XhÈ '&È +Ä#ót—檇IÊTIQ”5ðPê{(´Áfé¾ÔÈj™æ‹Ž´Ö+rNžoÆO7Ï·uî‘teµÖâ5æ¹>È£dÜЖåûF¤dÄ¢Öà \±ÁVh–+ßÍ¡³\6L7BÒíFæµ8ï“>PÞ?~útûŒµ¡}ê„ûr)Œ/ÔO‘á•Ð,¬5ì¯] 48ÒŽÅz&ŽÐ1æÆO÷w“ ©èØÖ‰Šc¸¬jùW<9…Ûaª¼¨ˆPußþúbe!±ª½ór=Ë + ó*•Tjü:¸yx 7—§~X¥óoò/B‡JjY‘麟¨’$Ciì_ ¾|¨ÍÐñìÀ(Ê‚Ù·´):“á6uè4+$\$ÊÆò0@[Qìÿc‚vÊþñÌÀE¦ûgMó¬áÁLÐ~pBËô¬X?k¨ÉJ½bÜ ©cÇn¾óÃÆ û3h+ð ãÿ¤©Z©õV·‰e²›áëãu“ßB3vùŽ+˜6/¬Mà¼CÎ=•8¾cB¹Õg‹®îÈr_7—g›Aè¾þ +ä8!¡G› _l¶Ù]A…¤®¯Õ•ÿ¡Êƒz*mºF»Š +€%®AGÎWýÝ ëõ,ûuñ4ç‚ ®}—n$×xÝÒ£ÓqŸ­ řڑ«vž“ºj,·¹ª{VºiÓ…Õ«ýµM+<&ãÉÍäËøéZ²tŠ%ý®Ìè™ñÇžGš.¯ªQh$»\zªr:«P6‘5¸cž«Š:ÏŠV«¦ª8‡¢ŸˆOš¨ˆúu +LßztB=¦\#]¢ÎÍeê(wÉô IŸWÏõYzÐp£öRÕOžŒüCcàF!õ~©@§ fú(4ìa¿ ¢Yy »“mÑ«X¶ñ 'Êæ{<‘7«LÌZç +yÔ/6ºÈeyÔpñ·s§M »0*Ý[.3Ù<ÐÐ LŽ-Tª×)\ÛeʧÊ8§pk”¤gò>ÐÉõlZ¥|4ö ˆ¼¬P×÷º©VqõtÝÔsº, ¥ºîÜYõv£/Ð7í)ù +š[Ïøm4«¦§'B×ãÄýy^ùâ/ýãK“Q=׌ܸ?¡ú uzJ”=ôŽÅÕÿFs"nendstream +endobj +1883 0 obj << +/Type /Page +/Contents 1884 0 R +/Resources 1882 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1881 0 R >> endobj -786 0 obj << -/D [1719 0 R /XYZ 85.039 678.231 null] +1885 0 obj << +/D [1883 0 R /XYZ 85.039 781.388 null] >> endobj -1723 0 obj << -/D [1719 0 R /XYZ 85.039 654.913 null] +878 0 obj << +/D [1883 0 R /XYZ 85.039 681.042 null] >> endobj -790 0 obj << -/D [1719 0 R /XYZ 85.039 598.597 null] +1886 0 obj << +/D [1883 0 R /XYZ 85.039 657.724 null] >> endobj -1724 0 obj << -/D [1719 0 R /XYZ 85.039 580.332 null] +882 0 obj << +/D [1883 0 R /XYZ 85.039 288.342 null] >> endobj -794 0 obj << -/D [1719 0 R /XYZ 85.039 466.321 null] +1887 0 obj << +/D [1883 0 R /XYZ 85.039 241.673 null] >> endobj -1725 0 obj << -/D [1719 0 R /XYZ 85.039 437.523 null] +886 0 obj << +/D [1883 0 R /XYZ 85.039 241.673 null] >> endobj -1718 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F20 877 0 R /F37 900 0 R >> +1888 0 obj << +/D [1883 0 R /XYZ 85.039 218.355 null] +>> endobj +1882 0 obj << +/Font << /F60 1074 0 R /F36 955 0 R /F20 937 0 R /F15 951 0 R /F11 976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1729 0 obj << -/Length 1589 +1891 0 obj << +/Length 2334 /Filter /FlateDecode >> stream -xÚ¥WYoÛF~ׯÐCSE“\žy( 8jâ´¶ÓˆZ$°"i›0…\úø÷Ý9HQ‘œ—€¹»3;Ç7×ÊžZúÏž†ži‰h„¶)Âpš”kz§)&6sXS×´|HïâÉÙ^8µ-3²¢i|‹,qúÕ8ÿ¸ø/¿ÌæBÃvÌÙ<B#þ¸¤“›Ï3Û8ŸÍmãZ/./®>ÐùjqÉ }üï*^^ξǟ&Ëx¤}îš®/@ýÉ×ïÖ4Õ~šX¦ˆÂé“^[¦EÓrâzÂô\Áûb²šü=H!š;¥[Gœœ÷sW«bðVG¼½ŠWñ"¾YÍæžã­,×YÕ•k™$uW©ö›åYI]µŠèÚÉõùõU¼ü'¦ƒ7š¨²guJ[bÕ~ƒ³6˜±–õÍjùe_ÿ¹¼â›ZEÖ¶kU?dÕÞu\¾¿¾\¯.Þ3oZ—2¯Ú:h)P£È8îÀŽl Bä-°:'2 ¯¸Žel@„"ºo©L²´š.gÄhƒH ’Ô}†®Ï„‡‹+"£í Y ¬F“¯ A j2–ìBÖê…H'}®S<êò„hP™([¯u÷¥H`;w}_›1UD.1X=êZ߆\!jšÂ1Y¾u ˆÕ%„òú Ù­ƒŠcóâqæù†,ºŒói°<ãìÙ J p¸húµ)1(9H,ÍÊ¡a‰QÃ\Ïm ƵdŠdAÙVB Gì˜îß,Û½ë„-¯Y‚§µWËn¡áŒB£-eQÀ200–cÝK]IoYÊ*méöЃôzˆyÓp£àæ -ļÜ&•LwayCƒ* rËrï÷»!h-tÚ¥/ÄIfÌ‚°é WOœ×òÓÀ›ÛFò~Ë;¼ÿî<ÌÆ€üF¾=âˆLá»<à7y…Ƶ7l‡bçŽe:˜ÎEdZžÀË¿¯.¨y~M¥íÛ"•Û·ggv䘶š¶ù$ñ§7ÉrQ´`¬4œzdP2„ºÞAÙ>Í^Øï÷;p†wJàsi/.Þ¯èd?Ö:S¼@èIÁüPe¦†ù¤È°‘Ì“‚‡!•ª­%žcã`ÆÃÖT€F¹¥œ h6”èMÿZ<Œè(½¨ë‡n»®$ÌP~ð..øm,7:‹Lýu1 Þd4î*Npɦå)Øój»y‡Ø$²ƒ²~À¸èÅIÕÏÊ': !èø £>¼Šé»ßÏÿ¢ÍF¶{M$ð†öKO*¤„‡á`±9ó_aä_gÔRŒ,ÉÈ¡y;;{}À¨O"?Ìîö|$’fËÏÞ»_Ç׳ÉÍpÄ9÷¨"ÑR¡÷ébH½[ÓyyõËÇýþeöÛÙdV ­Ù€%þyöù‹?X‚v¿ù„GáàÚ>¡0¼9‘D +nß×g·g¿×¬Ì˜˜Ym œÅä`Ä}†¢•†ú e» }"}QïswRF8eƒŠ·á[’i¶=\!‰ÒV¡–æH(•®Pßç ¡Å*»_ÃÆ.ÍFÿ1±ÐKÌË|*ÖëÄ=¤åÊ´nþòí¡ž N]€›Ú-¢âÔ£xvîÈCµ²Ý±Kæ B>‡V–SVàÞ•#O£÷~·NŽ÷Kà8»ÏÇIlÚ ¸Ví\‰µ½ðÐ>•±|æ‡C0…GÓ“Ýá3h;UtïþÉþu† +äÕ½ aÄzΕEŠø}½,¯n½¸L¹88YØI8Ü—dB‚b–þ7è;ÞH.QüYôµ¬zÔߣ3ˆÎmä +@­Øó¨eyõè…˜²u»L´C\äéÆË_–©©ÅòÒ„Sôƒ•¿„Ø wYû~ Ê0@<8,jèi@x ôSòPÓ_ Cáeà¤9cfZ\Åì­¬ùis*1„!ªƒˆ¦Ñž>ÓtK¹é~HÏX#ü- CŠQŸ;ä•¡i"ŠÒ¥å”–æ‰f†KlU3|òG#<ÝZ†«Jk3k„à<Ù PQAô¤s¯xfÇç.?$äQ;Eȵû|½,¯½B4~ÕЫ£W‘l ©áC(Ä8œ}]|ø¡2<wÉ2G+™ôŠ2¿_”¦=‡ã™g»¹Ž¦ë/-Ê+²†ØoYº<74Ùî¦ò ¬Â²f² ¶t#C¸Ž1AJÝ|cÍáXòCåêúæTÊ!EˆÖ×™qìiN'–æD`gö8ïfI…5Ã'‡E2á +«m‡ ï¡°]X놊ÊØ}–³ÃÝÃ^m¿ø\Ùy…ã)–gUqær¤ÞɼMr ›@{vqOÔ±–H/mÈ}ïtƒGKÏIÖÔ)ÚÒ‰>Èá!Р)ºÚUŒt¶Û’Q¨mÖÿ·ñW¼zô£çJ5ôlZDÁÔóèeyõèA™Róèp5¬p1oãB5¶¶ XÌÌS#2ôLµ‚Á²% šªIéè¯UtËc‡LYUB }ð5¥r«Èvy62^DJ¸hº´ØÅiäû!a€Ûnäï‰:o‰Pô:r +ΚÓ*h¡ô•¬[¼¥9€~A @lˆw}J[ñ¤”¾pø>ú†W’¡¯ËWÉ6è3ˆÚôyô²¼zôŠ$¤ÿâðìûø§r¸©uÇ«}½ï8`t³{|b*UùïFâ—M8Bî +:¢{s2Á±™¨sÑt³Óå¶9H=ó{]Ô›¡ŸZR‘mº AQ‚q-ŽÃªéI¾Çx©{‹Ï_ÌÀÏ=)Â_·—oçŸ.nçW×XŒT|Ùv›,JLy_{ºù»«étòn¦Ô#ÆÿžÜÌg7ãéíõøf2ýxÕ’Jœ¸L‹N™¿¼¿ýçbäjQØ%6Oð*ÈŠl°™Àl|9Á©ä¼«ëñï'¢Ì +_Û”k¶ÂÊ[év™.â2±¯túÔ¶K›ÝŒ@Â?šæùëþ]œ~üðÁ."€ÂÓ]Äôêêº}ËpäÇé îMËÒ¦³ÛÙxöñ¶ZVZÎ7+‰.d!Û¬k¤uOÁ/OÊû|k³ÜÍp_ñž-Ç,yV›;Öñ»Éo1ß_M-B^؃|ñê„ B]ijûG&@*Øõ-Ä¡©C +5WûÂ8›'‚|FÀæ¨ +‡ñ«)÷ À<€{tX6÷y<¼K Ãt_êÛ>XÅÛ¥v(0Ã&f¹yCûÑû Ý˸ŒO-S€Gh÷2÷4-Þ·Z&c€“xLê—ºxk¯&°‰vTÅ)«'æÐ¥yGçú²–šìgÆÕ`ZG¶Ü·ú’ŸhNبKëP_46YµßÁÉT„ÕêžT]Z^#‡YKu ©^ܺû Ž_qÖGù·€Àísõ<êY^=êAÀiC;Sš¶Õ³> +«¬Åf =w»O:Žž¹ÚÝo“ï¥u ç»<ùÖVÚ‚Õ–Ïbç5¢®¥b>›íŠý ŠkáN²A¬ ±Îsìo­¼Á©Z4änô˜çwyáhÑõU~Ù²8¯úÿVåÞØÓ“å{ àt{¾˜îiNgß–Æ|úÀºN ízÞW" šă¯¥ŒPpiŽÄúó´êY—0ÐÞ¸ÞÃö{'ø,œœ<Ôæ÷-0JÀn¸Bç㑾 hÿx‹‚J±ýã‘MW”“—.¢ò/£…ðî2»‚—¶ÞÖ‹DÉRÖŸ­ö?b“ÔÆu¢K½ŸêÛ×¢|ioAjupæ–Ž™þå|œVU½ó¢4¹å r"nCaQÛñïAò“þ] Ž}€¥Ÿ¸”JX]p'•> endobj -1730 0 obj << -/D [1728 0 R /XYZ 85.039 781.388 null] +1892 0 obj << +/D [1890 0 R /XYZ 85.039 781.388 null] >> endobj -798 0 obj << -/D [1728 0 R /XYZ 85.039 679.868 null] +890 0 obj << +/D [1890 0 R /XYZ 85.039 256.633 null] >> endobj -1731 0 obj << -/D [1728 0 R /XYZ 85.039 648.343 null] +1893 0 obj << +/D [1890 0 R /XYZ 85.039 233.316 null] >> endobj -1727 0 obj << -/Font << /F58 956 0 R /F37 900 0 R /F20 877 0 R /F15 895 0 R /F61 1406 0 R >> +1889 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F57 965 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1734 0 obj << -/Length 3176 +1896 0 obj << +/Length 2385 /Filter /FlateDecode >> stream -xÚ¥ZK“Û¸¾ûWLÍÅTÕHKàC§TÛ§ÖÞ­ÌlÙ©l‘#1–H™¤,Ï¿O¿‚e'•šñh4~|hº áOÝdñ*Ôë›4S+e7›Ã‹ðf 3?¿PBab½ŠöÌäÒÎ.“hštŽ&¼YFfµiòÕËŸÞFáM®’Dß<<ÑCñÏ@éÅ2ŽÃà—¼~¿PA^/–:Iá[pãÃ[è0È; éÎØlZ­½©7í󱯚zñ¯‡¿½xóàKaV¡º*¡^éT_™TzµV±/¾2+m’±ø+Åx¢Õ}»X*m 'lo`¸ÇFA¾ymé8rÛÁÎ*ý­ýí>V=°Ù-–&Lƒ~Wr£(¿.¢,(q›=ns²¹âE-4ðrøüÄì Û-êBô›5ï>?àæù¨P­8.|Ó êø‹LY<îçû’[=*]%Á×Eœù¾*òžEÔ* Nh6( ©ø4È­.©-âÉ6UÍdå·œgñ¸Ï²ÑÎòM™g~)!Géžyy.ìrþ€êaé{«z¤+!–;ß‚Ö†½¾]ÙWŠ]Ñz1_“;ÔY´&NKX²9"ZGAÁG帛ªa*•Q¦Ú±Òñ€Äì÷ï_qMœQ62-É+ÑþÑ1i(ßo›UÝïÌ\–|^¸íÈ‘ø¼Ë{nUÌþäÄ¥S/gŽmoƒ·’­ƒ¼•ûZ‡äƒ5opß«¦éªz‹Ã ð] Çk™æ™d;É Ý®ÕN“ÉÁw°.î“®ËD©à‹Ì‹uÐí¤Ý̱%9s鑩×n -­ÈUN{¶¿Lwè@‘háHÒ—›*ßïŸy5ÞÍ¥[‰n 5ø úd‡Ð¬(TÈzkÁHKaÎêúö7hÿÕñë½%C‹åö_~ýpËMaK×/¦:‰ÍY²Òáµà¬âU¦ÔãoÄñ÷¯ ¦…3'„‚CpÙq·’£&hÃœ<€lîOÿg@ž„S\˜½NB_It û [6ÎÝT‡jŸ·<@F\~ÿðî·ÆñiF;€¡Å0ù`/·qáÁ´ôÔYÏFÖùeôù#TF‚{ö¶#‹>'סȴřƒ~pÛœNá<Ý7S6ŸJ&Ä„òΠÉ/;::Vö¼hUp>Cç«$D€T®IŠ)ó¾,xà=ô™Û}þ™ä‘)wŠ8§AInÿ=Ÿ’\~ëgÉ» EÞh¬ËÉy õØ“Ym™(† ¡åd #eåÅ*êQš“Kœyo…§É†¿Êà7‘söö:qª>Ç…+†ý:zÃMf#ðó~ˆ©4{vHH'4‡ýŒ2¦ ð¦ŒnJëˆ6Ó€Ôi±¦ƒiàie„<¾r-KBN /ŽR>F-&‹ak=Ú¯ßÜóªÏÎèŸAzYI¾ÃGY•óç% HéÛjóRH«íŽláGG¸›QÎYïÁ"?Ê/!Cø(”°«ÏPò€uqæ3RŹŠW’¢`¸ë›MÇmÄ=x‚4l\Z€"z(ˆŒÕ‚,ÄetüRöÌ„Ú]/Åsp;Ÿ}|Æ©·ì¬hs¹év—w»R’ÇÄ¿n/áÍ@ÌÓè5^‡Ñi°Ã›ö|†¾àÁ™m6Ä…ÀŠ ÛŽÒ]ÕÑå¢['Ú”ìú]ï¼øÖ˜–üѼæÑ÷¯ ø±ôÀi¿äüù½®6 bŠæŒ!bç½>h JCøe'€ÅÆ—â.ÀâÑ ¢‰‚ë+!Í÷¡cÛ5'«ýÒÒ0™=tÇfhL2±0˜ë9Y"°êfì§&­/L‰©wîò„üq7Øþ™@ð}UŠ7Pÿ0GiþŽqêGÔA]Œ,¾ã%èüÔøHð¯ýü3PµÍéh¯ãŽqíÔŒ1 ­c^êXÌÐ|x¡ÏŸ«qöý6&P¤9(ü³ÇÄÑœ?îÆÝ‚ ¡5(RGÓòìùZ&¸GUÐUÊ:DÛ5„3Ù>ðøÖ å­L8»•±¶ür*»¾cV"ÛµGœÈÂNS( · 佧§öq±3M Œ´M/o§f£œFÙm§äöƾ½«Ñ# §X4¾ -Ë`êl}t/ šE|—ªà ¨@=È™È#¥¥'@Ê@ÄsyØ‘}¡tåK¬„ï(+C3›:.Ýn[ÖeëT XÙ>Ü°q5ùç®þÓUëæ“”µŒÉZŠœ¢“_˜ˆX4-endstream -endobj -1733 0 obj << +xÚÅZ{oã6ÿ?ŸÂÛÃmEÄ%,¶€“uv[ä±Mœ¢E[:[NŒÊVj9Ù×ûî7ÇL=,§‰‹"HD‘Ãyqø›!Úóá‡ö¢€ø<îɈE½ñ|ÏïÝÀÈÇ=j(í_êÎÓóW'Cõþë軽á¨Z²1Jü}ïç_ýÞ´ûnÏ'<Žz_ í +Ãó=IÁÍ{¶w¹÷}ÉJ‰žžÕf à”Hô<î“(­4ÔIDà…À'/J/0× ”2Â)ëY"tÃô¨[GYH$xÉáÕm'a«mžå´E-0Œ;òP­EúǪ¡W@IL…«WÓ†¦!‘®ÄÐ'¾Ã %ŽngžÇkuI, ý<Â$ßàͪ[AæSÂj.ÉïŒ~ð ýÕó~¼Â.Þç‹}õWÉlÝ…î\ݦº1ƒ¾Åþä8'ᑬ 5ƒ™Šë4_êÆ8É2ÅæƲ¶á¤–EQ)ÀÉþä>[Säw:¯ç…”„!ØI1¾ceAºLV(j`Ë ØfWê¦sŸj¹Ï`ÏÑþéa}˜ˆH@Á/<$q¼h!,/ÏaÖ²P2 +K‰hÇÇ D)$‚…Ú‰b†×Ť$¾”ÅΆ?Žêšq?VÂw¡™åÕ­@ %­höF/¯Ž»ñ2/Ìrçú9VýY¦ßýÐÁ¦¦a Eh™ üNŸS*î(xχs/YLÒY’/¾RdË(2NQpQè÷ÛùL²T…0XE+à þŽÑÈñCáÚfüaj5ªFILKƉðÃF‰æå9ÌZ¢$b +%Zl%ˆwy£-Ÿ ,Sµ ˆ +Ùã«š#!¢ Ü’†ÖDiÈ¡N`‹†D@ÂÛ"ÑÐ4$Vñ^˸"Qã=æù™YþD¿Þ©XËh*PM—zà?Éx"î7ý¦B—”ņržŠÄ…q$²ÈfqØa,\³ž¿! ¯nó9IÊŠùÅj©²‡kÊÔ•^)Co­Ý+;ÄxD¹*ÍòÅMA6L‡„û²;`¢Íc‰PÿI²Jš#‹e·DCÓØßáäL选c0ðÚ fÕ J»¦}›c¢œØäŠ,,²a2W^…¾;xYÎöƒRtª§¢¹/C÷Ú ÍÞëþ1,ˆjxêl<ÖL”ÔÈ—¬ ‚FùŽU€·]:Vêq*û¨ßlšê—ÕlnZv¸  +Æ@qU#2í·bfõ6OÃLT¦ ‘~¸ x…Ÿ+eæM'!ƒ&!à¡ ¢—m:ÃËs˜µl: ‡AK‰ÊÂÕÚ‘#\ÃÁÉÉùQ]Q{•Bå· E-¯nE…€ÁŠ¢G£‰Öôð~¥Úv*’ “HÐj,©PTH²Â‡ø6OÉJÌBåËG;+Ó*ˆWËS6â—¶xL³éfÄ ¨=·NIÓ7š›.Ó´ 7xÖ Ž¸ç“ £n¥ Óki10DÄa§ I]\íˆ$Z8â4 +ªPP€øŠw VI{jHiùlI±>í|¬ë†Ô¸—•×mÚÂv½(Tâ–( 3PЩb•Áy‹IªõòWGþ ÿíæŠ2ÂôË*ÁhÌÊpB” +Û‘¨&MõiÜÅ–2Æðѱé!1aÐ a+¿hÏVÞšWË–‡xd噯­| +®‡\¾Ö=.0´DD¶1Ûï!V7dp¦ _æAËËs˜µì„w+Kdàý ‚VNahÁ±HWÚÒsÃrËQØA±SZ8eÛÙÕÉ Ñ±‡ÕÈdzTÅ¡öèe>7ˆ{_b§Úp™¹å ®GØ­ssûU.Ю•}õ¸Ç>] ¨Å㡻ʦ鱘ÀU*ýk’Ng ˜° yzx êëOƒ³'ÃëÃÑõ‡Áhð‹ø dh:pgÚ«Ç;Û½LW@JõËõã(ò”?àÈF£jÅ3›àÿj-yüù'¾ã¯’õ[(IOxƒ$Õ Þ7Hˆ­÷ïq E—2ÔÅ¡ÃëÈÒ?À¿_ý»0 +Ód–¥cr®Ÿ7?Øx˜×Z­Æ+´øêàøêìhôíùÙõéàèâܪô®¦Œ_q +8±Nà¹ê²ÿµÒ°aÏð¸o]ï˧¬7¦€ëéâo]ý§-œáóœ•+ìÊý3«–fEúÔÀtÝTyµ6îŸìø..þëMÛêÝ“®ËGmœõ„÷kòÙÄÙä*òÞý%¶¥9Þ&l;)xæÎÚŽ¤ÇÃamk={¯´±xýz=þœ©8`—ññLЪ'øfÞú”c‚ü ™ñ ÔX<ðƒ¢ ”Á‹Ë8º9¬ÚŠ8Ò˵¼ —Ó4IÓݨexmQ,Ž¡ÅNXÿþ„Ô.£<"L„;ÑÐòêÖ +盨¢áèbpvùy?ýÁÅðl„ëÌÜÃI¡{ÊzŽ1÷æ‡Êo%¿÷E ô.,µ¼º-pÜ£’m !c±½4«-jáÍtÈŸ"óI$‚(hyuk0§#YÑð\‡âÀ÷WCs­F±ê\8sO´å×.…|UðÝšúkhyüÐ÷U¬]Ž=:9¿* Ey\šlqŸ£¾™©] ®jêNgy‘¶yq½›XO*&Û\iظ^›ÔýÓòo8Ü',n»é„_-àEÿ¡Sþ‡‘áñ¦\!!G£ $ÃFCpŒxSßÿº‘y¾endstream +endobj +1895 0 obj << /Type /Page -/Contents 1734 0 R -/Resources 1732 0 R +/Contents 1896 0 R +/Resources 1894 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1726 0 R ->> endobj -1735 0 obj << -/D [1733 0 R /XYZ 85.039 781.388 null] ->> endobj -802 0 obj << -/D [1733 0 R /XYZ 85.039 761.463 null] ->> endobj -1736 0 obj << -/D [1733 0 R /XYZ 85.039 667.044 null] +/Parent 1881 0 R >> endobj -806 0 obj << -/D [1733 0 R /XYZ 85.039 667.044 null] +1897 0 obj << +/D [1895 0 R /XYZ 85.039 781.388 null] >> endobj -1737 0 obj << -/D [1733 0 R /XYZ 85.039 642.326 null] +1894 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F11 976 0 R /F36 955 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -810 0 obj << -/D [1733 0 R /XYZ 85.039 542.47 null] +1900 0 obj << +/Length 1115 +/Filter /FlateDecode +>> +stream +xÚÕX[“›6~÷¯`¦/°´’¼dÆÉâæâõnl’¶“dv±§6l ®Û_]cÀ—Ýn;;^tãÓw¾#éè€4ÈÿæP±«1ì8ÚtÙƒÚ7Þós#ÌbˆYóÊï]lÞ ]Í·8Š5?ü¬¿~Ó¿÷½±abŒuÄ€a2æèŸÒ'ªñöîæãГõ¯þ»žçW“Vp|WÌø½÷ù+ÔBÎî]ì:Ú†—!@¼{ÙãSJpQ_ô&½”ê#šz«Ë@Š@ܶÛ5 ²F–Æ(iâOaÏ“È0©EõÉí«‡OƒÉÃÝ}ÿÃGïaìõo¾@ +ãìñ…‡E! ò (&|RÅ/¡ƒÆµBŽ¥™HwåD¨/˜/§i’˜/ÿˆ³‡ô1ø¾Ž@ú˜U„rd‰[ ûfA."ò¢B €YL¡Ð&Ha‚l  ÂÄF“4µüIpÓ²¤ºu’‡$ýeüÖ÷þeM7«y-ªDéTµ sYYéQU‡Ï{¿GÕ4Ž³(/*›Y”L£KŠ»È¢è÷³Å•(WÛhÜ}ÖÒx£›ÁÛ¡\½yZé[“|•.«æ߃ѪËÓtäG\@Ÿà,JÂx¾8…—@Çü Œo:¢í)F£Q‰rŠÏ*‘Žº ú®ˆÖzU21Ðarà›Ô°}c˜„Ù·̀…Ðf…ØøxÄÂÀbÝñÊ,¡Ì-–ŒF»˜”Ó †|±µH¹.ÀÔ¹©ê ) Z¼ÕY û†ƒõßD7éYˆð%è•P‡é,‡Öéùãþhro8Dｑ¯Üs²ë„ÿ›&Òóy*Ê™ê“MA"*´¨,ª–Ï"5&‰þÌUi™&_6¡ä›D-C„p¹!µ½¯ùˆdº +é@mkØZ²¾˜c¢GA6ÄÐ,Wשa1=ëô/Õ§êÏ|6ÏTI=I5b ùŒ(Ê“[^n­t,nKœ>·PîìsÜVb™5°¶ß0w®CìjÆ=«Û86¹ ±ë1›Ÿº˜íy¿ú-f|ó¾y.¬À:ÌŒðÈxgÙ•rõR.Úé*ÍŠ£oç–kZ.í~Å)Ùˆ ×WêÄðS¿ˆTÑ*‹8Sõ«ëŽ×:£¤P‡Jo$zRª€—$eˆL‚eÙ/‚oYQ^¦áo%jÑD,;V†CnAÒ +·!µóÕ2Š×@aP3Ü ÃšmÂÀF[ièÝD¤Æ¯‡w¯%rýæw!%§‹4;v«8¨¥øÁDä Ê´m¯>gç{%;!};¨ØÞÌís ©i•·=ƒ¨§äoU}¾ÔíèZ­2·cº>=£§©{JwPÝÿtî&E®gn;:ÿÓiÜ©+üP +wbÜú_'oß ùÝÅr»¾õñŸzÿ¬OŠÕ'QÂo‰Øí¾‚Q‹›‘‚‹àËX“nùå±Å÷oîn¬endstream +endobj +1899 0 obj << +/Type /Page +/Contents 1900 0 R +/Resources 1898 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1881 0 R >> endobj -1738 0 obj << -/D [1733 0 R /XYZ 85.039 515.856 null] +1901 0 obj << +/D [1899 0 R /XYZ 85.039 781.388 null] >> endobj -1732 0 obj << -/Font << /F20 877 0 R /F15 895 0 R /F37 900 0 R >> +1898 0 obj << +/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1741 0 obj << -/Length 3475 +1904 0 obj << +/Length 2544 /Filter /FlateDecode >> stream -xÚ­koÜÆñ»~…0ðQ$wùÚrb§ -\Ûµ”:ãÔ‘Ò¾#’gY@|çµËåÏ®›Ê€¹;ûš÷Ì^xÀ¿ð4‹ý@å§iú*ËNWÛ“àôF~: eFpªý ‰qèÙõÉÙ‹8; ?òÓë[šr]¾÷~øûÅ›ëçoK¥”*±LÓÌ{yñê‹Ð»x…p ßy«kþ¾YdÊ»¸‚)WïQæ½~+ž¿úá-ŽýöÆ®/_¿Z|¸þùäùµƒÔRû:QˆÕ'ï?§% þóIà«<;}€và‡y~º=ѱòc­¤¿9¹:ù§Ý…Çô)¯š¹ûÒÌX†¹ŸGñ<}–H8·Š¬}¥—B@µXÆqà]¯+¸e’zýnws_ôýCÉ߃Poª™ËF~š9< -ý8‰ìáa<ÞËö×™×vpbYuÜ»m©‘zWÅÉS0|hù{“‹n¨W5µD[ç^ ÙoXC[ÀÅÍb¥^‹;}ÂÿŽk»÷تÝðÊzà£áàÔÛõCy‹qÃÐÛTSœ6¼Oû‘—ïîù;¬e^˜˜`Öã@´$!s"ƺè×< -Ñ8ñŠÍŽ¯z=ƒïjs¾jØðÈ®'`ǽé²%ˆ¼Ö÷ ‚€°|vM1˜7‹L{Oq™ò -9†±†Æ/¯.åJÎÀóÛnM…^-[›¾•´Í8‰6)ˆ.bK %HÝ-îÛ¬†Öà÷ jƒ9^,Šˆa8†G 0p{Ïü&tûÚ0 LjÙ0·«†®® )id]ñЊˆRxUŸeçö–¿vŽ¥uè=‘SɃïÙ Çx¾®#Ï‹*‹épüâNÜ?DVåQÀthu_t†£*Kæx<¦etK *ŒéMì¹ãõ¸Õš SIp‚›“àRoña…Y„ŒÒÀ‹G½‰÷0. Àܠ൲˜Ž¯·5ßg†"÷HíöfSmaŠ´÷P¡!_dt Ç<,Hå @F‚¥ÁdlxŒˆb•ì)Š¡CœÔîiÜò‰´Ù#Î BÒ²Àò±3|={¡RÇîùðƒH‰õ;«†Õ™˜Yš;±‘I -Ö?‘©ESÚËÎì»Ôaâë0Ÿ¬ßÞÝ<Žý$ -eó P¾Àá|¥ÚÛ¡,Ô›z`e%SA»%¡‹jâY,»m?‚ÿP;XýPú ̇(äÊ×àÝx‘œJBÇÞwl®kr %•–›w¢O‚sgÝŒ æ= $j¿UÚGŠ³nÉ lÍJ”;p\±zBËcüŒü0Šþ;v&~¢â9Šû|l–ú™Î\Kx¡FË‘ÇÑCüÂæ&Ñ5ÙeN„~Iò®€)öîʽ;tÉV þv3÷Œå'Aú§.Š§åd”Gàm»Ùk_ÖÁuØJm·ø)^žÏÉ~”~¤£ ¿þ2'ó~y[nïb%þ7èೂ\£¦¶œs â¶DËIßÏ`¢Øí;ÛõÝ€"º-öÏ葬Ùð$g³¨‘0…yæG¡šÐäò–¯eXM¢ÙévÍÄÝ.ÍaRõ=Ÿ»eð°f"*ã{‰¢/¯žŽðC†ßÄ©GvçL9Ïn—ešÏM|ã–fÙ†6QÉ·±«uÚœõ…=ô[ùyŽÓéRäÚ˜ø‰`BôÍ6¤Àê"»Ð»]j [­b²íŽ €F­7ƒNŽC}»ëV2„ªPwQb ÏúˆV -xÏÈQòªÒØ.<¯Ømt›qnbr€AM’Ü5‚B»–¶L¢8T2^‹øÎ i¹dÆ®˜Ÿ¤põ'ààÙ—ühpÀ¹¥Î'{F"!råÜz³<òu¼'l‡8ÍI©Î€fFmJt{|¡ƒEå›’q²QšÎ‚•Äo„eË3:Éng1È]a®VÊ<Œ…‡Qúy˜M£7s{.2¬5kâÙ6Â>cq(ÚŽ®É+m„©cD©\ɉ§„!àaLf4)̵¥&[¡­·”¬x*ó Æ@$#é; »úŽÚg”ÁŸ‰&…?ä zOe9ƒA¼¸|}ÁÒM=×ËšãäCŽm)Æ”Dù‘ðF™U œE¡}_—Ò#ÔÜÛ7S+ëΈë -„æ‘7t%ÆDι#4Ðayo*;†¹·;ëÙÚ!…œ 3á,—*öòcP6²Ã鿉•*2ZB3HX|Ô—Ä&~A|#>=¡­¸˜² P ‘™ó0Ú×ZÍHHQa2 -)ÚËr*“YÈ1f™d‹’Îâœ#aÉ£(*¦–]Nùrº¸=eS›Ä:ëB¦ÜŒ¼©=PLzïp­ddÖUWaΆޥà¹g„dWïG“Œ¶&JPŒi,êé£ ˆÏ÷Æ  Ïk¦1WLŽ‡ÎWã#cæy]¬9zº¦ØV绺<ÿõ+_Ÿ@DS?Ì"W -Þ_¬Và´žxÃã}õáüå×Ë¿nŠ~X®ÖEsW-‡z[}þ²mîx¢5#}Ë„ì¡{‰‹ÍÀì¹ÃZLqùfóÈ[Áˆ”[ i¤ä¶*ÒšŠu)¯Ýó)ïŒ×¢¨ŸJ?ÌØcRÀ9©#o$\mF•ßRŽ½%™5\3DZÕ™úIT Cõ]S‹š¬$Û&fÃ=ÉÒc%…ÐŒÊ -S£¤ðYθZp”/$W¼K9M]*°°Fi1~,›É4lÌ2c¬þuy½HSïâåËEšx¿ÍEÞ‘ۀіҺ¡^Y“ÀŸZ]àÂ&ƒUÄ°'€Ô¯O¸-”ïŠÕPu½Ycygª6™kT ‘2팷²÷9lkÚ8Å‘vîØý™Ú&»VÑ4(±9(ÈH —&{ñ~5 |Ï£Ks)/`½³‘ÆÕ”©‘H§¥)…Ö› ·(,®¥CÁLš:ÕA8ßX™ÖQ -9CÞ|, ²Ä'蔲Þ©f Ž“òx3SC^ª¸#댮÷<ë+L Ÿ¢ä Q-7NRqm°­h\Gõwè3{R=aLÅˆß R§²Ë^Ͷ‰Âsù¯~gÊ3c›^Â)ýúh…ZÏÖâ¬Ð8ùÇM{sÁù>¿þ_I”Èæû_hûÀãä)¿ógí j?ž|»ÃÍdOçg€Ùº•F¿®`ð+ •¶Åw|[´Åw쑤ÆfÃQC:‡t5=¿pSŽA0eœ1ÝËYµ 6·[~:”˜RÛw µuÇ©åpgþí”JõøhtLõ·M`!( øIÖæ:„à;y&×Yd/M\}ð“h½E¼~äñº©é©(ùÈ»ö²;(«@JHLíiàëbå„8XJ@PÁŸÑe}Â#Û]?÷`íÆ›KçÞ‡ гGO-Äq’ê'ÁGpÄÖxƱm#¿ ÷ÃþXÐkɳo«F\ÂÃîHó¯pàömÖhĹ„¹qî¼!†R-K‚Qpùi0»õîI9M~ Lmt|ÕX°$Ïð¬Zñ I ?Ø£œïŽl' ”Ó‹í +VíØ (U†V¸¯w =Np^å䥑¨(¨ldj¬ZÕPÒÔèá£FhAœæ•¨¡“¼ +dŒ 9„\ë#ïj±ƒä(èžWÜØ9hhóTkwQšÔÜ]“P-ÞÔ]´Š‹ÝE»´Ø]”¥ýžíÓ@ŠæÁt9Íf)a±«+åÐO•ÄœUɹ逌…û2äú6ˆ E”cý@‹¼:° K¬–lëÍ–\†Ð{œcWW—Û%:Ø¿Rì$l¨ú€\ðj‡, Y‡Ì Ì)ƒ­‚ë[äÕ ŒN-¯`[eß\P(]‰™³E^Èì ™« »„NLR“d¡AcÉ­°ÉÔwÀ0ˆfMï±%µT¿• *dìÑgg¶Hãý  –)endstream +endobj +1903 0 obj << /Type /Page -/Contents 1741 0 R -/Resources 1739 0 R +/Contents 1904 0 R +/Resources 1902 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1726 0 R +/Parent 1881 0 R >> endobj -1742 0 obj << -/D [1740 0 R /XYZ 85.039 781.388 null] +1905 0 obj << +/D [1903 0 R /XYZ 85.039 781.388 null] >> endobj -814 0 obj << -/D [1740 0 R /XYZ 85.039 761.463 null] +894 0 obj << +/D [1903 0 R /XYZ 85.039 761.463 null] >> endobj -1743 0 obj << -/D [1740 0 R /XYZ 85.039 736.911 null] +1906 0 obj << +/D [1903 0 R /XYZ 85.039 736.911 null] >> endobj -1744 0 obj << -/D [1740 0 R /XYZ 85.039 736.911 null] +898 0 obj << +/D [1903 0 R /XYZ 85.039 736.911 null] >> endobj -1739 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F37 900 0 R /F61 1406 0 R /F40 1163 0 R /F36 892 0 R >> +1907 0 obj << +/D [1903 0 R /XYZ 85.039 716.383 null] +>> endobj +1908 0 obj << +/D [1903 0 R /XYZ 85.039 716.383 null] +>> endobj +1909 0 obj << +/D [1903 0 R /XYZ 85.039 661.784 null] +>> endobj +1910 0 obj << +/D [1903 0 R /XYZ 85.039 634.685 null] +>> endobj +1911 0 obj << +/D [1903 0 R /XYZ 85.039 607.587 null] +>> endobj +1912 0 obj << +/D [1903 0 R /XYZ 85.039 566.939 null] +>> endobj +1902 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F11 976 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1747 0 obj << -/Length 831 +1915 0 obj << +/Length 1023 /Filter /FlateDecode >> stream -xÚ¥UÙnÛ8}×Wè‘F -)R[ßÜNÒ™ u2‰€bæ¶å•¥T’ëæï{Ê‘îÓÀ€¹Üíðð\Jù~ÊÏ“HêÂÏré<÷—{Oú°|ô”ó¾‰dš é}é]Ý$¹¯dTÈÂ/×äR®žÄ‡¿f÷åõCj­…ÒQfY.>ÍæŸ%fsÜ70þÉó’Çû ×bö._‚8wÎázþámÿÞƒ­üûn<—·Þu9šÈ¤Q}÷žž¥¿à·žŒt‘ûG˜ËH…¿÷L¢£Äh·®½GïŸS¶Ÿ£.œ=4&ŽRø¡–Qž› *¹@ÂÐaœ*1lu…óX<ÁtS· [?ã†}‚q‰ÿÃŒmÃAíšíöâ rÜ#-‹ü(œ•X³ý«T¦~+ôU&r€åv׳}¸ âB¼Žð\»€1-Öø.UOµªÆvoמ§kÚ'×díž VÍjÜ RÞ›:ªB…tÄÕý)|=NpÇ.ê× 7âÐAš [×X>K;T¸Ã!`Ù:\)qQU׳ݲaU­-ë×/¶'¿#…w+ÞÅÃqAEªÍ®áõqGwH( -Ñ;/WÚp›ÄN¶vÊ#B³Óé>]EŒÈ3.¨ò‹M‚zÀ˜œV}Õ™™(böêF§NiN(óÁ]ÄâÇœi7.¢"‰€KÎX\È^ÅËž5<ÔH]&kÇÙ_ºvpš~“¹£~e÷¥íªõÅ‹·­á0a’¤bÖ 3¼á<:‹ñ2P×j—,NBäÀ϶ÎoàSˆmØ …î—¤i ¯SuvUÓ6PΤ©øà #¢c}Rö¦BcF-‹NÔP¸ñF`ÂI¶­{ì6m,6{à 8%CIâ#p†dQæÇÏïyâ4ÎlvÀWn \WÅVz -†Ý˜“8÷ƒÛØ·Ý%ñõ'uR=J'ƒ ‡­u’´< oÛímÍv„Û`ÐO'Él*I]D9Tb}]UÃò -;ñ¸º Å4…§6u®“×͉}úüŸ^”,–Q¬Ìåï–;åÿûDŒ€·d¿ÿdê¿@œü4`Áãendstream +xÚ­X[o›H~÷¯àWe2†‹V[ÉMí^äØÙ˜TZ¥B\T\gUùï{°=¶ÆPEI`ÎåûÎ…Ã DÁðC‹#ÌlÅ´b–¥ø‹V@ò±GJ ­TÑ$÷Nïbd€#ÛŠíýp¤s¦8Ázùipí oúcL%&êk¦i©_G}¢ÎŠÅ«é‡Ûñ0¿¿w¾ô†Îtçlø£ww•Ø}éaÄlKù®1" ^ôq•÷óÞ¬÷ÏÎU!ӕª*@Î,Ä-v!3¤ 7i˜ŠÉ1âXÏCœÜŽÇoû§«oò u'ß‹«7",ÀЈ `ך,¾'ip¦Í*ôæK/{¬2ãµVÑC˜¹IæzþüL¼Ö†Ñº­e½!5¶ë ýÇE´¡Zk˜ZõLŸ×ÂÊI +“lõ|n¤’}æ=¸Ùó2<¯°²‡e¸Z@î:pø±ñæq‡«>¢xv1ZûóÐ[9héÁ ‚ܾ]²ÔÍŸm³'q[SFBvê¿õoúï•.Û‡¿ÊE·~ü CzwÝ¥wƒpB ƒ0ª¥ðúÐ’C´ +Ã.œÛÿ~ö‚Ø4yµuuÿh°‡ =ðôò—]Œ—ÞÔ‡/­Ô ’C¼Ûq.WÈÞõZ¡ 1Œ°eæjëÌËb¿ ô­Ýtéf›å¶FáOo7»ÕõÝ}!ø»ø÷+ "€_³«÷î×ÑÌ^Ãoýøi’„~K¤È³º×s/§“ÉðÒ“d<øwxã:7ƒÉìzp3œ8/o+r_ÄëFÌŸgçÃJU¨DZKDÂÍÈÑÌ8GL:Å(aQ‚±ŒUBý¹|Ο˜´÷8ÏQ‰a°Ã€&Óéuu@Bòrú@qéy’wâ„PÄUlƒW*Ú^'ß><”„rdèÆÖ3Ð )kÄ*4š¡˜ ûy.C]¥}j©OâO(κ +;g²½.‹v̆Bæ)¸Üc5ŸB¢fõDÛºjäMaÜè•y§ËR:E§„T骙”ΑMu™T¶Ô‰!ý¥ŠA'ÎrÞ +WžÈðs±’¥e¦Að¸ÍtÂ4*•$á7Lt¸3•¨¨®áHh£¹÷:õXꈀ̺FlÂ*±ªlD jä  ÐeÔ1„,6}Ç l1™Aë2—ž™R ­€™Ìtåƒb›¼$b܈QSpŽ`m“À_”*!¤IÙY·ªkºèU½– †0±ÏŽ˜¦·³bœŠí³ g¸MÁø)ƒœuõçxÞ¨]U]ø-&|§/»/':C³«3Ï!ÃÔK.y7ÚÇt·(Nøþ¿`Xêendstream endobj -1746 0 obj << +1914 0 obj << /Type /Page -/Contents 1747 0 R -/Resources 1745 0 R +/Contents 1915 0 R +/Resources 1913 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1726 0 R +/Parent 1919 0 R >> endobj -1748 0 obj << -/D [1746 0 R /XYZ 85.039 781.388 null] +1916 0 obj << +/D [1914 0 R /XYZ 85.039 781.388 null] >> endobj -1745 0 obj << -/Font << /F58 956 0 R /F15 895 0 R /F36 892 0 R /F37 900 0 R >> +1917 0 obj << +/D [1914 0 R /XYZ 85.039 107.714 null] +>> endobj +1918 0 obj << +/D [1914 0 R /XYZ 85.039 91.438 null] +>> endobj +1913 0 obj << +/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F11 976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1751 0 obj << -/Length 2215 +1922 0 obj << +/Length 2719 /Filter /FlateDecode >> stream -xÚåYYÛÈ~ׯv eŒzØÍ;y²‘8ðÂÉ"™yÛ]-‘’ˆå¡%)Ï‚ü÷ÔÑÍCCÎ,`x 0`5«¯ªêª¯¾î‘kþÉu×KÖQ,…Çë}¹r×GèùëJš~à‰À÷¡=Ó¹µ½ÛP ×æƸë­òEâR织ÕÝ{宕+ÂÐ[?hÐCúƒ#ýÍ6\çoõfë¹Nz)²vóÓÃw«¿<Ì.©D ÔÂ~2‰§ÆûI_x~8ÝOHÞñmúYW>f›­tú=Ç{‰(Y²LŠì°;É`-]°5ïôp‚•=Ïwªth“GüöœÛ`®ŠÀ\è+ŒÔÙbû©í²’'Ÿ´éèìr˜RE½Q±ó˜WGîÖéçM:ºBqC¬aœ³ N/˜3 ìŠe2èð/½‰=§Ñh2YrFMšÌhµUqâµNsš«ÄuêËÛNwùže´@jä¸Î‰×1¢‰ ëÞ–çþè.N¯ù³÷¾|¨nèÑúx»ö‰ÚQò -]ÍæUaÓG³À'wèf -BÌŒ„œQÒD{È´6('¯Ì*òÖ[\,½¯r.÷ùF²ÛÎ&â0”Z2³wà¾ËëŠÃiGÎÍØhø»±êp,ƒ•iØ£œD;8FOŽ uÐÛ×Õ. ÄÅ¥ÉLÌçe¶è-ôIèo}sn¬–¨.ìk¶|ÃÆÔèÝÁ‹”ª ·ójßdš¼†gaóöL«e -uµ·in'‚3wf#”/¡ÇÁM¯YÃJ·$O¬á·©u h5¨Þvx6XhJY7¯ñת·Ea#BxYýsã„>w5 -šÁ£kóbr2ÚD4eØå˜S(§b¤æ>':þ½ ® z+‡ìîÚ%*Œ„.!«~Yýð“»NÁðïV®ð’xýmWÈ$Y—+|Ç_Åê~õ~Óó²c -ÔGŸ¯2zI¯ÐAâÿju¨Ön>½0qôÆ"–J¶ „rÃWÉbrð‘ÓžÏ%Œ ë(é<9e(S¶ ]¸¯ë¶*€4¹ìlù4D€k[€ ¿ԩK ¬fÑ¥5Ó)ž8Ï 4Gµí0Òãg‘.6[_ÆÈXha³ÐufTéÆ(â;¾ÚhÓ ìÉòîdó¿1ÚR9ÐEñÄß•ÿA‰t¦vröpñÅß­X'”X`u¯²/oÒ$¤k'ؼÄôC‹}Ïyk‰àÔöDE¾Hy<•=Þ–m Ý¸ïpAãövS ÀW:PÓ¾°¨` -a¯e9®/ÙŒg:ƒºMvÌYÙÌ–˜n(è²ÐwÞ#!³¥$ûU—ç¾hÝZb9@ØY·-ŸˆÄSíë¼õM78ÅCjJäòî½MzëEÂMXÛwßÿRJN[î>‘Πï'Ü(Åtv¡îCõ û“n¸õ¦ÒevËísºû”Wy÷ ó4#ž•-g|vkÂüšF@-'¡j7¶t Ëžú‚àÒÔåLæ{ -j¬ôÌ¡á-.iv ~Èâ4“‰¡˜ñ˜µsx¥)±òöî çû½¹gX<à–ʼnÖ`ÉÝŒ¿M³C^e™h@þk@Ÿò©ý¥ n´ŸÑ¥ï,R}^êÈC {L—té -ÛRïñ’µÝ´óß/ÚEÝq%Ç+/“à0„È=týJ›ŠãQ-‡¾˜Sqäðµ7; u§I” ´ØˆºØå#væ-¾´™­1²Pú¨ v¯+”Öæ:'¼‹ÚýñŒ·ÖKÙ4 ¢!9¦| -ö*kó3«é-aÙÅ~gé,¼z€—*x ^£ß¯†‹ÞŸôœÄ×lÄVûTÖ_Þ¿_?P݉PâŠÒ*ë­e‰¾ï!¤ÓLÛ¢¢yˆ¢á ¡¾0³ŠšuÊ ë$Qn”³³Ì‹l_ô·tZŒêÆìJS&uR:“ð ¢Þ|FS¨˜77 ™¶VxÓ±ôJ P˜‘éôiûÈÈ0¿lùWQôBFÁFWÄÕf›NC˜¯"8&ÜÍÂÞį}q£§”Ú@Ƴkm$ øòë£zM‹k%m)ã*Œ¼½÷ܽe(Á[e0òaÉ“õ?ž”šÙôå;of/MÝknl -9°?¥€õ5yfúèÉ~ zz¢N‚Xík(̆¨RÏ'RX±†×%ÏÒf2G ½Ó]Rñs…†£ÅÐ+øøáÛÎ$ß?üónîFp7Ÿ%¢­­íØ”g~<Ð[?y°ÐÏ  ½¸­ñ•ºožûø†{,7òéq%´l¡ÛBO`¶á{óu,BÐøÒ§Ç'7‰ÿ/óÂÒ Î†+9½{6ùÕómgˆ¾gƒ•î/ <]Ý_Ì}¶ÿ…æ䢤{¤« zRφ÷4 -Ðþ:ʯQœ¹y5ßÃrsŸºY|Ü»¡Ê½ó…€ßÝøõ"Œ—pÃI„qbæHw¸…€O%}5ÄöèÄÒÀ‘Ù¯üW†K—¥TéäPéÂd†utTâLÝ cƒ»=M@‘>2¢…ÌP4^}æÙœ‚@òQÿø(Õ,’Ù(I9“i:š,¢Ñ¬üpÄ-DhABæåÅÑÓ71¬F,‹²ÑÅl‡G3¥åèbúsðê//þzqöé$”R/ŽÎþÖ ¢55¢]} j™2Ê.‡2ö8ä2(=JtÄt¤ ‹ÿBºGÀOÅ(äxPf6E½Ý¬NB-tP-/Ǜ⪬êb3¾™U¿D::ÿrüåÍùøíЛ¯ÎÆ_Î>¿ýøáÉqñ-_^/Šã'v0^_ë- p#fN {Žü÷¾ 9Lr1Š³˜É(éeÝÁ„akŸu¡Y¬â—²ÎyR1.‡#[N³‚öO{5/&'" ~; …ŽƒrF¿ßOD¬·zÙîÓ$xÊ’MÆ$™HúÍ(´¨†iB°(-ÚËXxY£ÚQƒDël‹³““u £õ +ç“`Šc¦AQÑÌaÖ˜/p" jÎ ÿxØV5=\Ãæ¸Î7=×s·+éŽÒ`EžZ"‡kX<*Ž˜âYK<ëkËhUo¶L*²s)"–JÕ2t…‰›bY ìà’df—êyÕÆIkÕ é²c) ˜&OGq*X¢Ó‡™ŠÅzÈzl%I)oNDÞnf@m׊3Î ‚= +i„êÊ2ÅŒeó vº0µGŸ1KSñ(:\ÃJ ›µnQˆºžÔ=aɆ“8c"Êúâx¶V†½1K§³vû{bV,[‡ =ogdp>^ÐÀF+z0& 2%S&?[^#Ì þ±lMYö9°¯P‚û¬Ý_î×0Ÿ’Ç,ÎT‹ÏN|Cjgèv«I]®W‡5¢!­Ä÷WH³}@ãÔ¡4~:;§ÁÔ }RÚ¡Ò¤\m”…_1d€²D†QÁê5­Ptö•fVç;„ +çÓ¢½Ñè'(Í÷¹•&xšyrºx¶¨…¦â˜©˜ûB›¬W«b²Ó-åH°4‰)(kÄɄĉƜ£â?%M¸VÊ2®äN6J˜ùVeÝÅ‹S°2% Ž>0ªp‡«'ÞAÉtâÎC†–VkhÆ‹ÂñojX¼XM-OsgC+š€œÔ5Õë¼JA$)>“Õ “ o–@ +õ˜Üó\Ë]Á®ÌH9é[@YÌãvž—(š+`/‚`¶È+仢Gªv7Î"Tóõm|JWkú-É¥vOHN'Ê%"dfQ!~˜¤®ÐCÖåÍ’æ¼®9 «(´óÉúÜE$¬gãÌb±6nA±ÞÕy$SŽZÐíÂÆ& SÆ•7'P&æµMSãT¹­j@šHÈ”àQš¦ê±¿†¾ƒQEBôM04rè± É?HœWè!맒,‚$í€z ;ؼD`Ú±¼¥yÙ 4/OÏ6/Cǹæeð4—Û¼ÓÉhÛ‹ï`Š3Œ‰8¹ä T÷Ðj{ùù„žàßã=:wfy¹(¦¿@éµ:¢ÁÿH)l}YÄ»_PT‰¯ï¬žêÿBOºQSøÜ‹ -Yaeº½îªâD\ßYÀ­s†¤m÷Žšÿ±À{>‡ƒ°#z?`€ÿ´ûA_Ê5_ú)ÉRyà F'ÊÒb¾‹öÉuÔuèý“8èendstream +endobj +1921 0 obj << /Type /Page -/Contents 1751 0 R -/Resources 1749 0 R +/Contents 1922 0 R +/Resources 1920 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1726 0 R +/Parent 1919 0 R +/Annots [ 1926 0 R ] >> endobj -1752 0 obj << -/D [1750 0 R /XYZ 85.039 781.388 null] +1926 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [248.685 529.993 326.185 542.895] +/Subtype /Link +/A << /S /GoTo /D (modules) >> >> endobj -818 0 obj << -/D [1750 0 R /XYZ 85.039 761.463 null] +1923 0 obj << +/D [1921 0 R /XYZ 85.039 781.388 null] >> endobj -1753 0 obj << -/D [1750 0 R /XYZ 85.039 671.912 null] +1924 0 obj << +/D [1921 0 R /XYZ 85.039 709.856 null] >> endobj -822 0 obj << -/D [1750 0 R /XYZ 85.039 671.912 null] +1925 0 obj << +/D [1921 0 R /XYZ 85.039 612.285 null] >> endobj -1754 0 obj << -/D [1750 0 R /XYZ 85.039 640.387 null] +1927 0 obj << +/D [1921 0 R /XYZ 85.039 517.44 null] >> endobj -826 0 obj << -/D [1750 0 R /XYZ 85.039 486.212 null] +1920 0 obj << +/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F11 976 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1755 0 obj << -/D [1750 0 R /XYZ 85.039 457.414 null] +1930 0 obj << +/Length 961 +/Filter /FlateDecode +>> +stream +xÚµWmOÛ0þž_‘!Mk«Æ›ºIAL*‚P) h (K©Mº$-°iÿ}vì¼6…"˜ª6Ží»{îî¹³ E™| ¨! +QÕ P4M´‚,>•Sòß"öBgÔ'«2ÈÑps=ô"ÎmãøløÍЯš’¢( ¨‚¦¤ªZãfÔ„)›¼¸<¹ëÉû½q.èFf4SG ¨Å_Âí½,:ݹ e ‰d,H–1 POáïsa*|ÏT±µžÈ¤êDŠ¦lz¨ô BÔj_U¥%.:VlI_Ÿ¦ø>¶c/ð›ê¢Æ!{Kì›|ùNF2ùÂê+1,uU ´TO§Åö[¾Ã~ðÈQ„˜ ã,ComÅü…BàÓçÇ8d/2#*ç˜`¤Û¨aÔ®*J…ç¶S…ÿ%æ(0æxâ€ÃYbÛsŸ9ZöpCŒMwåÜŸáôOl[«§>o7K7•Ý¬ÆÔŽÇ—ÇÙZŒŸb°]/ wˆãUÈ¥%ÈãrO‚ŽgžÿÀ°¼9vMPÎN2)‚Çp3ššgÃÉÉX7§ºaž !5Ì¢ÞÎ3ć“ëñ¸&6\Ù<ÎøÉZ,çØä‰ø–2üMîh „â®éÅ‘I!Mô†y|9™èÇFh;ÂáÚ³q›<ÌuJ¤@¡Ö-yý·†©QlÅžr¬‚ßž¦öÖnd2›fÑÏV)..‰xT^w£e»¢Ûu¶ääO2Wû¥Èr;yÑ扩 nZ˜8®a±ÚÒòVᶭÔ*rõÍ<Ý¢|%%çéé<ý0r¦ñs‚ZohŸpìr14'úÑõ)Å(·éd!²ûLøst•ž¿×f]¸°¢y{¹Œ/§úFPrF2"¾R-D…3ƒ˜Vd k*#&᤭ËaÇßc³«‘&J~žéD¯¸ôÙ%Ñ"í6ج“ñ>Ó^:‘*Ú •¹<§Ðœ«)LJ4ÛÒJÊaY-3ôñUFíî G‘0Lu œGº9ºÒ“\Õ¦þ ¦<6¤¶ʼnÝzcÒG¶OvàíÒ@·$%?2ËbIãÏNΈOÛ3‹·«Vz(ÔD®"ÐÊŽë0cL÷›ÄAÿ­;[óy`¿Ú™òN‹ï!ê"1žx¿qà¾&ºÑ› +8ÒžOu|JIʦ +á„/µÉN.ËÎ Ö,Kæknܤ¡tu·dòe@ßuÏþLô )ƒì¦]Ꚉ¤¸¯ö8ꥫpÓ;ûÞò‰eAendstream +endobj +1929 0 obj << +/Type /Page +/Contents 1930 0 R +/Resources 1928 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1919 0 R +>> endobj +1931 0 obj << +/D [1929 0 R /XYZ 85.039 781.388 null] +>> endobj +1928 0 obj << +/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -830 0 obj << -/D [1750 0 R /XYZ 85.039 328.278 null] +1934 0 obj << +/Length 1709 +/Filter /FlateDecode +>> +stream +xÚ­XénÛFþ¯§P´  qÍåòlŽ-' l§­• @´´²ˆP¤JR>PôÝ;³³¼,JIœ"H¸ÇßÜñ¡ø0p™%¡p&‚`8[ ¬á ܼpMaj³Eój28:óàÖb¡'‹FŽËW 'óÆÉ›ãß'ã?L!„Á}v`ú~`|8;àÆ^¼;}>VûÏ“·ƒñ¤VZ‹!jü{ðñ³5œº·‹‰0ÞÁÚb®WPÉ\Gè}2¸üQ‹¢;gH\}º"`n ¶-^ËBî :ÁÐw-æZŽ21—å&OL×v “?G+†&˜ÊËQo¨èþU7Öд}f…tvtH|q—´Ê6z±ÎãÛ¨”´™GeD«Ã£JLK4^›/‹l%§E™Çé Ѿ Í7ëO–kͲ45_®äj:+ïGÏJY”Ïà\ƒîÊŒÄ|?m)@.ºÿGñöØ{:~õþ5r[#ü÷Y£a^Dq"矸pRd˜¯úØíqqÐòÍüzŠÆËYgiÇ;ÙZ¦S}]{Þ#§ +U”Îi‘fw•³\Ç©\ʽÑ[gqZʼ +:}— 2‘€ÉP±Ë|ÛoÛ¥Ußiy©”C™ik9‹¡öm.åt±I[&_ËY´)dWhi«(I²Y7Bµ¹Ý𱞠6 Ó—6W'fQ¹¬“”R€)=2)ÝÍ–KôÍÕū釳«é›ãËÓóñôj<™žOŽQ;9tÔ8_//ߟŸjk63]iò>Z­9Õ1+4I׆í´ØÎÌ +Òåø¯ÉôäÝååødÒƒ6*d~Ï伞72)—í=ý‚’°(£2žUéóÿ,É +‰únÅ”tNÛvvü²·ÝûE±=’½˜ïL«ì»°÷yVëiêáE˜ç{Úã,×W»ª*È6ù®ê{TVÝŒýîlý‘D}ý ‰ú¿egåÀyÖkÍRæ’1Ö;S¶ÚwÓü%îŸ jÜ£Þé°«î.˜ówWã-¯49I©ØS/­Þß~>pn3Áí¡í†Ì‡Ùß7õ+³E¤¦>wÛSßÆ7¯%¡:N-°£P8Œ‹ýúˆä+êDO·£nr‚èx´é/v`HÚáÿ°åFT<ÐKÂqCãzÃÓ*™Ó©Èa£×kXFy‰’4Ï +x`7‡‹M‚ÅêxÜ@v­áîÀö¡Æ*y(]1h j°pc¡Ø"(5ä5*ÎP×m<—=Ù½ñ“Å”9 £‘wújžÌPr†‡-*LM£è $*£²b 7Có hoå8’ƒ„jÃ`…ÓéîâR³Â—#±ÜÚ7Êz ÏX7 2Ø«ØÔ¢‘:ê±0! ÙzöF%}k%Â!`÷ˆs…«µÆ‡W€D>~BÚ½–R EqEĬòÕ™ˆ¶·PI! ñißÂ:Á6+ Úýžk°`H¡îð ^—DÍÔ™\—EZá3OLýlÑê:2 hÜ3ÙƒY•gPÆdB59šŠ!•Âsî.Ë +ú:Rq´=Í@sèxdµí„,ð;,À‚ ~ £ÉöBAYDG%¼¨(]LǶßT¾Ñ•Ê:,Óµ/ú\áBû²‚Ú2®á8—·2÷hÞç +Ëc–íh–»%¼À¤%)K$xœ .5VŠÜj'2 Yî hAÝ™}ßVÙ ¹ö€k¨sØ؆ÊÄ,o’TuRUu7¹d;ã)‹  Äó +C¤ÈYæ¿*8o4»Y¥´©K£T«”úò(qoÂAf{¼Ê8è0‹2X5—mÿú6ó®i±il˳y“¿Ñ‰/¨~ažÇB^ÅJ +Ú¬ ch +Çbžçtܵ/«–PyC¦ºÍ§vwß°ãð4.ß?ìZD»‡]E¤†½kØíÕ§‡Ý~uzصÕduÿ‹ô¾WпÐG5\凢„×voÖP †¶X½9ü—ßqaÙ‹Þ }Ã߃Š©­DõÖ#=Ì°8 ßz2ÉuÕëå;Ëß·½ª}ï1×v˜íÚO7·áßc®&B,õkd `÷-ñt@ ÿ@š¨~*åz¼fôÕñ¸§Foºék”êâÍŠò”°Øe_­Üužl^þÛ:Mó-Þó,÷ÉhöÝh4MíjIï.rÓ¨]¡úBM‰Q_éâE¤¿†õ/€Âbv؇þRÿü¡ë7Áö[ïÂa<ßÑXÐøÀ~ ·ú q ïX`2cendstream +endobj +1933 0 obj << +/Type /Page +/Contents 1934 0 R +/Resources 1932 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1919 0 R >> endobj -1756 0 obj << -/D [1750 0 R /XYZ 85.039 309.406 null] +1935 0 obj << +/D [1933 0 R /XYZ 85.039 781.388 null] >> endobj -834 0 obj << -/D [1750 0 R /XYZ 85.039 163.931 null] +1936 0 obj << +/D [1933 0 R /XYZ 85.039 273.293 null] >> endobj -1757 0 obj << -/D [1750 0 R /XYZ 85.039 145.06 null] +1937 0 obj << +/D [1933 0 R /XYZ 85.039 162.779 null] >> endobj -1749 0 obj << -/Font << /F20 877 0 R /F15 895 0 R /F37 900 0 R >> +1932 0 obj << +/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1760 0 obj << -/Length 2380 +1940 0 obj << +/Length 1349 /Filter /FlateDecode >> stream -xÚ½Y[sÛÆ~ׯà¤gÌ5ö‚[óbÉ‘gªÈ5év2I†ˆT´¢vúß{.‹IÉÊ4Òxd,Î.Ξ=×oåÄ…rzÂÕÑ$¥Ða8YoOÜÉ ÌüåDÚîÄ×÷pê|qòúN¤+"7š,®iÉ"ùÙyûýÙ‡ÅÅÇéLkíH#¦³ Ë©t®¾ûô׋ùô×Å'‹Ó™Æ×Èõ_'?ÿêNØø‡Wè(œÜÁØ2Š&Ûãiámßó“ùÉß:.ÿî|ùþG¸`¼;{{±üûÅÇùû«»HmÅðž²Ù²ØÅmˆsOÞt A ¦&b°øøéÂ.”èwœðþ{௤ö„/ÍCWF»Ã«Š„Ë‹·Uà ’ï+ó½ &”¿~=ßÄS킨ž~É”BjÝ´x€"&ìõ‡ë²°…ad*9½ßDáCP‚ïúûð¼$ìæ» iâuUÖüž¡$^t€<ª6X™hñMZ¤UÜXVmÝо´(³Ê(ZÖƒ¤ö5.ÞªËo«º©ùóîâC +»A‘öÉïC°æžg¸v/DN‡ñX‰²{ŠX) œ¦ä'ÁÕ²úÌoë²êN¹n绞sF¨*ô{ì×ââ!üCž çaå^1BRßÃÐAàµ#Èßð§+*Æ„ã”3¢m!eì}üuÜ]P°å Ï7#ϱ%wD/'¤’/¦—ù§s´ÐOóÅÅå”ïº-h1Ý©»ÈéN=‚ƒ–u*é‹JÌ Ì煮¡SÅ¿?°~~y¾¼¼jÖ¶ž¶K¸ ~N)±¼—«RÍÄñuÁßBŠ|w“Y€­KîØÎ4P™×˘0zKÛ@qI,í°…b¢I‡#IÛ¹À0È;Ëë;5poØÆí×€+ÖmTá †´Q~wÇq[Sq~\Ÿx>ÉlKI‡Ú~Z1ƒ2®Pžj£&þœ¢NƒŒ½søÚ.Ã~¥RÎô¤Oç¸WïSû7ôÀ±šë Å(äyý{éÿ ›q‹÷oQ´7ì¢p½1:¶-’P +¦v:¥Þb|ÇŒ1^x—aÝðKÌ/¨/„Ï@µfž6kæ=BèWw8)Ô‡… ‰=úÕEÚË#mÉW6c§­@˜ŒúÞ‰]K( ¦Ùñ!ÛÝ£®ÄŠegZ…Býb5¿Ké(ÒÎX}§T¯˜Ù7"Ý…m­äÆø°µ_P“–P]j+ly}¸Šeš®ñÑ–^Û†MlRô!Þƒh˜¢ñŽáuøvì9á `×Ò@‹ÞØCCG¬ù‰Žd#:FØ_91ç¶w Z}Öùžbc¤hqhˆ÷aLì‹á—‚<¯`üÑy×ÕØ»ŽVé -;Ë;<‰iM³k­ž"Áñé~™EÙ›m¼‰]ðù«çšÅ ZÊRò7z -á­Z…7†À¸ÎÌÈXQºÃÔï}÷œøãÅ…}åf Öü ³LHÊ"Ò¢±Ù)uûrÜjEà/A”Â: -…4ú÷’À7¨”f:•Ž$ê»'wïöä¡‚'¶o@MÛø¦þíѪ'¨Dö³Ô}¶H‡I¥ËG³PÇÄ.”î"€]éGé=ðkéS-òè·F _›¡yv÷@X…׸CÿêC(endstream -endobj -1759 0 obj << +xÚ¥WmoÛ6þî_áôKä!fIQÔˆ}H[§kÑ$mìš"Pl*QkK®$' †ý÷Ýñ¨'r2`(jŠwÇ»ç^Ɉ!‡b*Æe4 BÁdç«^çí@X‰±wd^Í/|àrñh8KZ=ŠyJg‹/Îë??Î&g£±”Òƒ t>„3%âñé›ó³ÿ:{?˜Ì£:0¡Åƒ/_ùpèÞ8“Q8¼ƒoΰW0É”'í~9˜>5ªˆç éTŸƒµÄXD,rÕÓAðó|ÙÁ®Ç¤çc„p™î0Pœ)î™(€ãÞh¬w¦ù +\Õàº8'£±pòJ—»<·*z°pÊYÈåÓ@eÄ.¶€ +)µÔU,°éB  +BûÁ®åQ¯tVòÙÙ¡?ý8Š\ç?Ï@br2#~‚”M6¯R æîv:éJæ¹ÑÓ~´2Æ¡:U×øÁ*2~ÞŽÜÐÉÓÕØ]8ª4»¦}²-¢hˆ ˆž³L¿ã!M"ÕMZþŠ_I¿c ïŒGd§¬â*C°\å¤üÐ?ãÕz©/ç˼Ô\ñÛ¤¼¼‰³ÐʪØÌ­Ü/D; ]’.u¹ÍOÊõÁÝÉ +ÄeJk–ümh?º[ŒBW›"£ÓÓãW—Ÿ¦—'“?g—¯?œN'oFc“LýfôŽ{ÿCÑÙÊÅvtNMt±Ìc›ïå}bý(%QîMú6´)t¼¬ÏdZc1YuV×ÞŽÂR‘ üô8ëÈìn3O@uÄ}¦AN¡14†Î'dŸO¦W8Ô»šB! ‚àiì­Ìî¦P>ŽÀ`— †¨\?tîpgø[»Êiý7¥%¦PÑ4¸„³2¿p$ªÄ´\ û$SUº P@+Jì5CȓΡÐYè$Þ n««Äãñ +]Y½ùØñœ‡ù‚ã~æÆê~ÜXÛš]Ãã…n·½=߇e*RcñûÃLˆ0€‘•çCA„Ïß?’¹Aÿí3®u;Êzrq滢±ˆ>$Eu3ILóäa@€vÍ ú°®¯Ö”¥4^’ÀÌš{#QéU«4­öKúÊ¿ÓjŠÎ|£J@Fq»±_ÝÄM +¨J þ˜D(’ˆ"¬Qn0§¡Û“Há0še˜nF±‚]_´Œ›;,°¦‚‘‚ qÅ¢Õ+¼.;ÆÅ5¹«ø*.5Æ…¨VvÙ€ªÕ¶ŠZ‹Úóœã¸½³<§ÜÍíW=“´“»n;›u‡a§í-$özÌ×mw&t”¬½½½]é:…^S¤öž D¨¾s4¥c™S©XQ<•WÄ5±ÂSk¼¢fÜäf~,hÛ !T°ÃaÝÈÇøªšüšäß`ZmšQêï<+A/„Þ¼ÙÁ9¢Æ„hÆÍuFW^¨øžŒ™F|Ú ÁL›ÒeýɃç!…ÎâÕ…Ìó,Ó&aÛBH?0Î*>ªnÏoâŠåËš«•µŒLßYôxwÕ<÷„y3yuþ]ü—I3ùPyë"M2¤e¹EO‡üó›úÄ-5~ìÛ0í_ée/ð|ûèÙ¾MtQd9ú–ÉÉéô¯iŸl÷Í5î{B©öÕsûCnûÄðŸŒü¯?†š„'Y(w¼ª¼ãüÀ³Xm(ÂU2d*”ñþ Ín endstream +endobj +1939 0 obj << /Type /Page -/Contents 1760 0 R -/Resources 1758 0 R +/Contents 1940 0 R +/Resources 1938 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1764 0 R +/Parent 1919 0 R >> endobj -1761 0 obj << -/D [1759 0 R /XYZ 85.039 781.388 null] +1941 0 obj << +/D [1939 0 R /XYZ 85.039 781.388 null] >> endobj -838 0 obj << -/D [1759 0 R /XYZ 85.039 761.463 null] +902 0 obj << +/D [1939 0 R /XYZ 85.039 761.463 null] >> endobj -1762 0 obj << -/D [1759 0 R /XYZ 85.039 736.911 null] +1942 0 obj << +/D [1939 0 R /XYZ 85.039 739.701 null] >> endobj -842 0 obj << -/D [1759 0 R /XYZ 85.039 431.136 null] +906 0 obj << +/D [1939 0 R /XYZ 85.039 739.701 null] >> endobj -1763 0 obj << -/D [1759 0 R /XYZ 85.039 407.154 null] +1943 0 obj << +/D [1939 0 R /XYZ 85.039 716.383 null] >> endobj -1758 0 obj << -/Font << /F58 956 0 R /F20 877 0 R /F15 895 0 R /F37 900 0 R /F61 1406 0 R >> +910 0 obj << +/D [1939 0 R /XYZ 85.039 592.928 null] +>> endobj +1944 0 obj << +/D [1939 0 R /XYZ 85.039 571.731 null] +>> endobj +1938 0 obj << +/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1767 0 obj << -/Length 1953 +1947 0 obj << +/Length 1066 /Filter /FlateDecode >> stream -xÚ½Y[ÛD~ϯÈÚÌzn¾B‚Š"ˆ¥»‚¨ª‰ãÝXuâ`;]ʯç\ÆŽx»¥-«ÕÊsŸs¾sŸÈyržXêt'Rè$™gÛY8¿ƒ™ïgÒ¯0V k ´'&—Ýì2R"4ñÔšp¾TF¤!M~{3»|®Â¹ -EéùÍ--ºYÿH»XZ/®ž-–:Š‚«r!ƒÃÝ[•9ŽÄÁÏ|Ã`}(ófñòæÇÙw7Ã[Œåƒh¡cýÀ¤Ô"•vHž4B›hLžLà7+ BÕ¡íh˜æX[Õ §Ë0H‡GÞlŠŽÒi°N7•Ùb LCw‹|·€±ö¸(ÇцÕÐ-€ûQ^µ©pË=wÚŠ¿[÷Gsîl˜0h7|$¶wÝé~ë‹+xÆí«)ê%#( ¸$ÑÅ·¹kõÉ`u‹ß$¸vÛìZÁ´Cì<öÖ¤„‡¡X€F…=26pu†[Т¥3³‰©‰¨¾\÷î1ZóvÀ²×ÃF+\ãh79/"È] vG»Üª(q¬Å±·¼…²Á5Îxb*“²ÐÞñVnX„èû¡ôxX‚ƒh·QÐË;÷xY…Lte^­ ªÒœ½ÃEŽ1+ßòÔ-ŽU[>Šù†Æ¥ùg¸ø·kî KµÛexÏc¥Áø=/®~æUcÄG!ÁEYú•eã9reϹN5 -r‰‡í‘‹ú¾ÞôŒ£xÖUÝð8ËÚ€,¼üup‹¤ì²¶¨H”e1<ˆ7è±Zò̦®Hå7Üß³+Z»FL8› -&9+©u.ŠË÷ù.¯IKö‚¿¼áþT£üþ#]Îï›NýAâ&QÐ×+&dþrP@K4I4~›JÑ!á â‡_R¸-»"†ø_;ÊôS±×âµß‰ -Räþärk¦Æù+7®4ΔŊôº~Ë{V^žÝ©¨Ÿ¸uÇ–‰–€]>×ñ£#¡#åA)‹%)â²êãªÞg§"‡`bÓ¨_ˆÿ5ûãe8_ƒX~œ…B§ÉüÚ¡i:ß䀓}¯œ]Ï~íO™˜C+ Í„Bûj‚ƒD~~_ìóÛzFGGT¾Ø¯ûú‘sØ'­©Ž’Â&T$ªPG¶‡áÀ„æˆ<´3‡‹Š[ÿmù{ŒrìòvŸ‘[¥]¯ÑN;Ÿ‰Z *sÏ›7ã9ýÍ^¡Onfž×lõàþ²”R˜p,äç8^477-¸=¢ñãQü„Žþœæ[^éÐÉáq¤‹•æWh,o'P—i$be{ý›T²ÐˆØèO¥eÑ@ËF´tZV6®i¦U€´(é´BAl †Ž4Ì+µ ‡ú:Ú+[;`Õlȵ–=FÝH6 -ÒÐPƒ`éÓ"d¸AÆN¹é…®ö±R™÷4ŸÆmW®®ªvâ Êoì{ÚÏ%0{é%9…`g‡`”NûFIayÇ-×rôÞb l>™©UÌþØUñ uSÑžj•gãâ÷P*«§•ŠfÞo¶,¾õ¡3Y r“Iê:†"Ä&#‹¼/8Øu9çÆ„šé¡šyK_ÙLì(‡yÍéA竰ݧ.nßb˜Å*å˜ô†7ÜVu7[û3è[”J½uÈûŧðdÙ%^¨Ê;ÊšNesH€¨X„iòäRÒc)]àHz$À¦Ôc0òÓˤ: Uã»b\ŒbÙûÒæÌÃ%BOÝÇ0¨cp_ôTäçTˆÔ&OÄ£(×ù]Ñ°EקDh+R?YEIÑ–£IîÏІð/¡†õš/¿ŽZàó#¨á Ñ+5™1Û¨/2½©ôÅ%™Íƒ5Fѻӂ·ùbÂÕBŠ«Sp†î-v-¦˜6‡û -3 Wßúðˆü5ÈXVA4ç…f“Ôú<+wí…\ÐÔo.ØŒã˜ß7,¶4m}È|Ûí‹WÃþçÙvÝø[zj›âŸÁþòÜè¦'HPb!#9UNXa¬ˆXM¥‹YÉs«SȪ駀6•©ÏP¨ÏÊbð>¡JAi†Ëã×橾*Û‹ß34èv ¾O Ë2„HðŒ{#¤Œæþ¿0×\‡Ö3\=â_aÂþó -yÞ£×P¼37gáÈçÝÆeÑ´c6 óô6kžÈ©²Á ]Žóêȯ9{î_³0Ï_sfá‹l”&ê‡A ›×Ý‘þüÁ'-4ÀeÀ©üRp~´ò¢ü§¯^OLç1a2ß#ßþ-ªK„Þ)á$R§O-ap½ƒ§¹¡Oñe‰†"›¸ÓЊآLÀB®*®sÌE•~Wv9ºPà,»}ÿ;ŸŒ½÷*—þË@±ñ$éDR‘1@\çc[A¤%9C*²B'ê èz:ˆÞ'™;³L+ÔS\Í øAeDE -Èñ§ÙŽ -C!ÜþvTH–^õѼqÎ?´ðËò-0N¿ÐbÞš”‘Dã0ÔÝ3Ë8¨u{”’BÚÑO4§. —h™<†AlÎßä”Pê$ºwß11endstream +xÚ…VËnëF Ýç+´¡Ñxž’|»)Ú(Т@»i»[²-Ä–t5RÒü}Éáȱ;Eσò<¤"2)-z™¥äº,“ÍñA$;üò £†±š[c`C˜ÍÒ,W\˜â¦Nô‘rɵ‘¨óãêañ¤D¢Ïs¬¶‰”Šk©’|i¸Ñ&YU1Y¦™µ‚ýÞi&YíÓLç9;\ Ö»Ísª%s»zðé?«_~^¼F§ùRp#oâI¦4×…þtž˜9- „‘_€†,HµŒ ¹$Øß\ÈždM×6íîN+ÀèçHN*ˆ´‰|)–@TÉ‹¢@þ8¤Ñ½óay„´ HÛ彊MpÓ§™*Y;7ÆëqOš¸IA +y†(ðB²/ðá1U[Ãë"‹rÁšC]<éü §’À3]B`ˆÐwÓ°©M»9LU½x!ó|O/4‚§‡€|H¶A§DRÕø2É´2y’I$'•å‹µ1* ƃ†v(2¬ÛÒú†*NÀ4Ó¹?\, •JÎÃEÑpù ÂC:AÓ¡¾7þæ·Ÿ‚x×¹?X h9ëOäOÉÖPek;<½âA2ì2çiï§þ4Wºa$í-âh¿ž¬w…¿Ø€x×»aô´Å^Ä5”÷Òçì¢}¿kÚ™À4#ulMÔ8kM<6FDå‰:ðz}¨?¶×Ø 0(” #QûÀP¼îÑûˆÃß\Oj³zýœ|ÇPIõ=1%U›–VGKxSÌz#¯CwØ]9vWÀƒ%ÅÌã<ö䢞“l7z.úŽ|³Ž_ ¼sJ¶whsî5”8´ÝptÚ_U¯®FÀüf¤MU÷ï‹6Ì™0 ÉCèbu–N<`:q sëm®õwÔÁ‚ÅVa´‰Ó´û3ògJ€;ÍcKk5óÇEøhý!2Iñ}<žè'£ ƒùÿQÛ®Ý6»i¨i˜dÙk3î3¿wC]eÇ.´õסß<¾lý£›Æýc_­7 ÷õx§ßÁürÖíw»þ¤ù±çµÈ¹¶y4†`KsíÏê’ÛRßwø2ÙzØendstream endobj -1766 0 obj << +1946 0 obj << /Type /Page -/Contents 1767 0 R -/Resources 1765 0 R +/Contents 1947 0 R +/Resources 1945 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1764 0 R +/Parent 1919 0 R >> endobj -1768 0 obj << -/D [1766 0 R /XYZ 85.039 781.388 null] +1948 0 obj << +/D [1946 0 R /XYZ 85.039 781.388 null] >> endobj -846 0 obj << -/D [1766 0 R /XYZ 85.039 761.463 null] +914 0 obj << +/D [1946 0 R /XYZ 85.039 761.463 null] >> endobj -1769 0 obj << -/D [1766 0 R /XYZ 85.039 667.044 null] +1021 0 obj << +/D [1946 0 R /XYZ 85.039 667.044 null] >> endobj -850 0 obj << -/D [1766 0 R /XYZ 85.039 667.044 null] +918 0 obj << +/D [1946 0 R /XYZ 85.039 667.044 null] >> endobj -1770 0 obj << -/D [1766 0 R /XYZ 85.039 642.326 null] +1949 0 obj << +/D [1946 0 R /XYZ 85.039 639.536 null] >> endobj -854 0 obj << -/D [1766 0 R /XYZ 85.039 569.569 null] +922 0 obj << +/D [1946 0 R /XYZ 85.039 528.054 null] >> endobj -1771 0 obj << -/D [1766 0 R /XYZ 85.039 542.954 null] +1950 0 obj << +/D [1946 0 R /XYZ 85.039 499.318 null] >> endobj -1765 0 obj << -/Font << /F20 877 0 R /F15 895 0 R /F37 900 0 R /F40 1163 0 R >> +1945 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1774 0 obj << -/Length 1029 +1953 0 obj << +/Length 3214 /Filter /FlateDecode >> stream -xÚ…VÉnë6Ýç+¼¤P‹&Ej*ÐMѦ@j¼MÛmÉ–YÒÓ4ß;PŽ*y’wæå¹GÖz“ÅR™|“fZš,Û/jsÍ/Ú[ØØÈØZد(ÃE&‘T6]³Q›0²2W¤üqÿ°{ŒÔ&R2IÌf"£}ñ—ÐIƱ¿wSjQŽAh’DL®©èÝñ)0Z¸s9ŒÁ?û_~Þߦ°RéÓiRóR™ëø¶6m¥±É}mRsu_°† „*´¨»¶nÏ+åD2ÍòÊÑ2NÌ5#$× -ú“ßfü£ |7Ò² Â(ÍDß”n¤þÀ9‰ÅÜ£\nò‚©ò›ç Ê|¥Š| ZÔYÑ¢n¾àÿHÀn`§ºÅ»ìMzSS¤2™¤ÚW6vóp,wu{læ¢Ü=Ãs@\Y±ãÝe´UÔIvÄ—ô9´8b=Í »â“Â12˜„{›Ó#ã“Å6§ ì ŽV‹î„«¯ªäÏOAœ x0® B«ØWõÈž÷tMêEõÄî¾ÝuéÃÑ-@_àë“jªaÛžçzisÅ–ãäZ´rCáôœÜuÇ¢y5…Oz‚ÃÐ]øpœÇ ÷pÿÈçº)¨ŒÙ8æ×Àx)Å3Æ@<,«)¸c¬ø[Åê¦VÄBMV÷Ö›u§©l9Fï&z [-’ÿµp„¸ûh­x 2#ºmËÝ@ºå“ãèçŽPÖ1VYõ>‰Ä &ïfj¿¹’ù÷+…žGl¨)_“0±Q,"™çùwF*éš¾r‘cVœ°dÜüTj×® qcoõG¼‘ÊÜDßäˆyã7¸ 2gnÊ+­s¥‰¿Á¾¡ˆM´ž^øP!`MjÅÜ EÏÇO,GÑk¥wxA#YïÈØGÁ¡Bé-Ðà¸$ÁÍ|¦1 0Ì•¼-Õoµ0{uôúc0oJÖLB€å˽A¾}DúQ 8«ÑÏ>xžv\Ï;º.¬Ôµ×ñkÃGJ‹½¯cðžuË«óv%ç¹BDŒkÕ*ÁP1Hiijã’Çÿ‰ÙÂçñùü#<`p 6€é“T˜£-cƒB·Ò•–žšsá5mòžwŒM©gŽFü­l”·øñEŸ¢äšÊö  ¦;B u…ÜÚH^—þŠ_1d‰ PA,ÁîÌgËxƒ€à+9_¹R¥Ãäõ„FX4RWî"¬õ¤Ç2¤Èwž˜†ŸQ‰%W¹;ví©>ÏCÉd†/õT…c冲/óCÜ>ŸÆ­›§jÛ‡íôc9­ýPI”TÉ«¼g~!øЩÏY ߇L$£(½ÿ­¶¬ÿ©c²endstream -endobj -1773 0 obj << +xÚÛ®Û¸ñ=_á·#±*ŠÔíu³Ýn +)6»(Ú>èز-DC’sröë;7RËNøAäpH‡s§Õ&€ŸÚ¤‘èl“¤Ê×iºÙ×ï‚Í FþöN †‰´í•ÁÝÅ¡˜dGöØ%*óµQˆóÓó»¿ü›0ðãXož¥B_«pgÆ7ÚlžÿöT¶ÝEQà}h›¡+_®CÙœ¶;ÇÞ¾…¯òÅö¿Ï÷×g·™ìgoÔcr&8DŽŠ6*ð³ ›‘%~¤4‘ókÑ°my¹kðç¸U@”÷Êý¡À¥œæ€ ã5l“¡á  |àN]žÎÛ0õÆ~Ùî #û\·4v9b³bhydÔ7œÖ^¹ãh+›m˜y¼_g ì¹/ +}ë–6; ÙÇ· =!ga;Ñùû¼Þ†‰÷‚‡ÖÚëÛk·Ç½´¡ûÀ +â#CãT ƒ,GxåÀp¡­e¨]™ñÔ3¬Î‰8ÀEp—7{<äÙ_^¸ +b?ÒM&¾ £Õ·8» ’•À•+$<òo^ñÕÉÝ€Ì;Ü, +U +‘=$ÈâÜ4“Á0LýôeJÐGdJ +·Ýì•v !fÂw°–ù JXW¼sfî–x&BxR6»÷Û B¯Æuò/[BX™ů“Ù£ÜÁè9ÇÞWÆGÙÙ¥©G1KÉ'ÇÙ&ôª|(hI” #òÝÒú{:˜„Ä)Ü!¡—ÔüŠ-º˜5œe¹é÷=bˆ -8c×Ö¼ÒÄûý3wJV8Ä8ðœýµ.ÒÏâ0Õ 9™•VwBáü‚f€õ¸Á=ËoŒÔ-²(Ìç9ñùõîõÇó'^êC[UöÂ÷CÙ6w!Jc?IÒÇŠ0Aº¯ ÷sÙﯽ0%N¼Š(Õ× +†ÔhÝØ*—ÿ ”ÙçdAÅÞƼ–ÀŠ¼fX]Ô/4­èúå™tþ! žÉâÜœi¦K:KÔìLÿtÍ{ø„¡&Á(Iá´=ê¥è$SSiÙ6=K<êu–ÎE~T’,ã SË MÒAøÖ£²eʲ +áDbcèÑúžGI”p•³¬LÔ猞Ë1›*V‘÷¯¥¶Zã—¼V–{èL,–†H"Ão’¹ HÛX]ƒvÇߺíòDB ¼6ÎœõO¼üŽQ–ç‘CawWØ^˜)ÄÀ=·Œõjù\ڗުñT}—çCF2Å·±D9`³à89äõíâÏg”-£ Ð3r<øô(%8º‡m¨1r³-ŒØÏì Ê"Úéä @ºgjd¤VÓÉ7¶²aß²´Üêxžs.¨e¿r²¦ÅÑ A¹F†œ¸‡¢ß¹/1AJöU¦”Ì>A%9ç0{ °½à(4ÑCPlÃ&º»| ›&KÈ­`"5EÕKë—Ê׎HWÖv_\8±qï“šHY2©2ëfS:þNTyŸ_{™,÷(8îÑTlÄ‘ÕA¬€ìbÓ,©aîºÑwܪuÛw½‰IRH Ìco2AºïM,YޭƸw/ÎàØ’'©óᆠ˜†ác2熌y@Ÿ&0/È@-8²,z (È|“PEÝÄ0ÚvìLzWxÀÝ+Ed2ïŠ@^±´ƒ4w-žþ=ÏâàçDá!'ã•ø“øi fây*š¢Ë‡â`ƒf8Ó›=ë«4Û° ãÖLÔG´ÿfÚ™T¼@ë‰E,1éys¢ £9Xä.Ž€”ŠÉæþc±GÇ‘¶³ë;qV(é~G×õþfvÆENú‡'®ÞVÎgÙ$朙µ`q¼¸‰Ô¬!Á.[ò'—ÐMÙíyÜ4ÖâMìmø*IÎÁŠ Ï¯eUCãƒGG¤º(HN!$F£ƒRæ%;E#–&z.šÛ€’F6Ô, ˜å5Ýó˜'Ñ$JÜQü‰—Ëp2eÌƹR'û‘^ )¹Šî,‚Ï£;ðcŠucƒÄ¤ÑÆ"QL㉜–öœ”öùGöNô¹çcì:q6u·Öİ׆œëRå{”3µ¡N›çç +žse‡PrY`ÑÎcõkŠþaž±7…h“MNÎõ¤!QUäÍ"ÇGãÔžJö¸Õ–ó6y?cêyA€Œ +¡Õ˜‹iÞ •Mê£-ÕËXHyŽÞ[}ÑÝžNõÃ"2™_D,ÅwÛâ+›Ó°ë£?7à.äk0T!&%qä}D#*evî0L†üY‘§UÁ¹Ÿc+>‘Á£ó *3~¯=T[Ëöö‹€ò9©BÞŠË…nÏZ:‰$–â6•uàûZV·FâuC>ZÊŽänœ +Î,„EŒ‹õ̲¶=9­Ò0ð{“b Û€l­x…ÖZydâu–œ›±xöµœÖùÈ @ûm_Y=q¼z_"á›úÇ%rœÿ@"in´´1Þ底j‹‘°ø2I(Ù+"Úä®9*Š<1ï8LÂ… HŒOÒœzPÀFêBV4ÀxN~yLt¥Æ"uAøž)×>wW/«+òÕ¨$®:Pê§(Ôf£”™±1©1aÏuY´ÔÆHú*0çêfVÅ«¾å‰+|ᡆµÊíÂUÏ“Ì»#o(¸bá^à 9Ôe Y×ÖÏ cáVŒr²–å Ž‘‘–2^ùm4˜6E¥¯T0ÐiF;<–¥¡Cm;­w5@¾½»’f™FñKúdþ}I·HÈÒŒGe‹Re, …Êf†Baittä% }(•dK`—Ô"ÔXSuažE( +ÈWËeÕþz:NbÝ­ÀFd +'Òyk¢(¿¥S…†3rQgäŒ5¹Ÿ®$ĉ$`ÐÅàÔ3—|€¿*ò|[1{Íõ”€$—RÁØ^í+Kâµì©Ò)ʬ8Ãhç Yz™*ã›PÑÃ[ªïhœÅÞMÐWkï­ÎDõ¡}^1uu^VlÛ«²¿©‰ƒ”é9•ËgyÁyL›‰?MÂmR'Nfí˼r.¨ÀÁ•Bz>»+zHdÝLõ£¼ø¤_|¸š6ÆžŒòz–’ Ù¸ë1Qà“T¤'ŸÚ0òŒÃî>(¤zœ·•7ÜÔÜ<‰N£'@­óC±âï=IöJ °ñþØÂröE¼³ Ê 0{¹öoùq×^lÑ©—tdRCëööâ¢Fpþ2ytœË,{fVp>0*îÎ.†ËG9Ü´,K*öp 6˜Q!¿q<áAuÂECÅT´|­Â $R…)~ºÀ¡U)• °feoÌ"aEµQnäŒL%ú¢ø‚^BA¦Ù½1œ“0¶nÐ+W +Þ˜§‰‹¸ºç›²bÈ$z¦ÿ/L|Î$”gËiaPž“) §c½ Óïú~’|ç? ¤ûÈ"áiÁâzQ^òý)ñ‰z£ÒßÕj Œ\ØìÏ7~Hƒç£‡$Zœç¾|PÍIüdßb4‹Q¨ø!H§b8°µx MùÑG^ËJê_Й9x-ªqètñL€…[AT.»±S +B?Žç†®€0ÓSc´Mj*¸½X‹åMHÏ?8r*¿ºâŽvÉžè2%“¢“´õDÀ´.ÑÈbÛ<ÉK æWˆ4îr—$†þ6‚Û¯k|•CvÙII#¿“Jj)²CMÞ·¹¶°`šWM«„NsvýÄ”RJ°Ù}]¼·zÙOÿhѵããóÁ¿óÏ0øá,™¸ûÿ0‡¹âÔA5$žŒ‚,L£å~‘§šêûþ¦áL#endstream +endobj +1952 0 obj << /Type /Page -/Contents 1774 0 R -/Resources 1772 0 R +/Contents 1953 0 R +/Resources 1951 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1764 0 R ->> endobj -1775 0 obj << -/D [1773 0 R /XYZ 85.039 781.388 null] ->> endobj -858 0 obj << -/D [1773 0 R /XYZ 85.039 761.463 null] +/Parent 1957 0 R +/Annots [ 1955 0 R 1956 0 R ] >> endobj -1776 0 obj << -/D [1773 0 R /XYZ 85.039 667.044 null] +1955 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 252.502 213.733 264.192] +/Subtype/Link/A<> >> endobj -862 0 obj << -/D [1773 0 R /XYZ 85.039 667.044 null] +1956 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [313.424 225.404 447.309 237.093] +/Subtype/Link/A<> >> endobj -1777 0 obj << -/D [1773 0 R /XYZ 85.039 639.536 null] +1954 0 obj << +/D [1952 0 R /XYZ 85.039 781.388 null] >> endobj -866 0 obj << -/D [1773 0 R /XYZ 85.039 532.636 null] +926 0 obj << +/D [1952 0 R /XYZ 85.039 761.463 null] >> endobj -1778 0 obj << -/D [1773 0 R /XYZ 85.039 503.901 null] +1022 0 obj << +/D [1952 0 R /XYZ 85.039 667.044 null] >> endobj -1772 0 obj << -/Font << /F20 877 0 R /F15 895 0 R /F37 900 0 R >> +1951 0 obj << +/Font << /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1779 0 obj << +1958 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/alpha/beta/gamma/delta/epsilon1/zeta/eta/theta/iota/kappa/lambda/mu/nu/xi/pi/rho/sigma/tau/upsilon/phi/chi/psi/omega/epsilon/theta1/pi1/rho1/sigma1/phi1/arrowlefttophalf/arrowleftbothalf/arrowrighttophalf/arrowrightbothalf/arrowhookleft/arrowhookright/triangleright/triangleleft/zerooldstyle/oneoldstyle/twooldstyle/threeoldstyle/fouroldstyle/fiveoldstyle/sixoldstyle/sevenoldstyle/eightoldstyle/nineoldstyle/period/comma/less/slash/greater/star/partialdiff/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/flat/natural/sharp/slurbelow/slurabove/lscript/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/dotlessi/dotlessj/weierstrass/vector/tie/psi 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/alpha/beta/gamma/delta/epsilon1/zeta/eta/theta/iota/kappa/lambda/mu/nu/xi/pi/rho/sigma/tau/upsilon/phi/chi/psi/tie 197/.notdef] >> endobj -1408 0 obj << +1524 0 obj << /Length1 777 /Length2 1024 /Length3 532 @@ -6728,158 +7704,159 @@ endobj /Filter /FlateDecode >> stream -xÚíRiTWEŽ¢9‚(ˆµôQÄ(!Š•½A¬ †Ì ˜ÌÄÉ" HE‹EV—àP,bÐj-X,K1ˆ‚Z(µX"Rʱb‘ºuÀz<ÕŸí¯žÎü™û}÷ÝïÎ}Ÿ•EH˜'BÄ@?§ì¸l.x ¼¸@‡aeåMB!…¸‚|Àuss - 88Ž ŸçÄŸ$oB–D¢± -X{³&I.ÀS -IT$ÄA’@)­!b Œ¡JbO ¡“'ä Ê!™6ƒË*¢@ ŒEq†ý¤).&€ËË2¢½j%@RN›ÖS6Y€6‰8–(fد$èiöòoØzSÜOa+…ÒIù—Q½EJQ,é/ -!•)(H‚ $þ&u |é΋ÀÞš# „*òÄc1ì¸NlŽÓË:*÷C• A)‘ˆ…˜NÕ!Ž¼éƒŽoÊ…}  T²ÞöÕÕNuC„(N…'É à¼¦OaîkL‡D¢JÁas8\šH¿¯¾¢Þ˜æ‹‹ÅcÏIR˜Ä —ˆF<°™ PJ•´e{6NPô@³ˆ ’1y¯ÎÀ>vrÕè¬èãí_ñò"”›í¸<`çÀ£•¸ÎÀ…ÇÙòwâjݤ€À㸺8º9LUE -’„85µCtL¯°¥“…P EŒî[„È}{\áÙO+R}^«œÁ’/.>¾]S—©.vgÿä>ïy®=šÿf”i‡ž0,YQeˆywÌÎz¦4o³Ïì2j6˜Ï:\6sT4¹A·EÕÔ0Wz0û^÷{weçlG°|Ô›P7ã‹À!®Ë³‘Ó+¾¿õìaj|ZÛný"IJ¿€¥ú*0~2Ø›{å_ü‰£DwY‹idÉ#ãçÝf ·;â4(vÛ¥ -ÒY‘!u̱úýª|‡_K_‰m{@{ú©2‹ç]¶ùò׉ Ú´åï^ª ÖÿÌbfóôøÜQPßÄÌTFå©š%~ñ‰¹]ÚŒyU«Öü¾ÑcdѶ‡«Œ×Íw42ÍMo4¤ô—/ΛSÀœ{ýIJ+í£Qý ú]8•¿m÷šÜÏ—.Ýyþû«u èóR[ò±„ììR,<s`ùñKsò‰ùúMŽ1þÛ’.ãÚ0QNgŸ ›œYá;ÝGGœ³GÖ[îïÍ`|Ô| uHGèŒL$$[’Š«ÚXŸãÑ樴BOÝ$‘õ ¦E˜¢à’²ªnÉ£ÈÙ ÛúÞ‰¾¸8nçé=3Fê&®óÍ®e¢Ä 6’̤ã³&ÊÚƒ?iÔb.5Ä \7lD¶Ø•Q ‘CååkõZ†:ôÔ}~ÒO65×ET¸¿³%ÑWS1;?-d^N­eÙúÖ¸d›iyeÎý¹,óµÌÖk.ìõ­ Yϯ‹íôæDÿ“³69¸4ÂTµ(ÕÝRŸ] -g.2¨?`«K|/ýúxe·îÇ’ËU‘ãÖ=6›º¤aÕT1ž3m|´°ÆêÈòq•è1ñeC5ΰ·L9_+2¯ééÑ‘tEZùزé™÷ï_œf®â}W·"Jc†ð!«VtrõšrÝ!mÃô܃Û{Š>Ó?±weV›$rKYä}Õ´„…ÁOÝjeYîõNqïj÷Ù•†;í+W‘® Õ¥{¿›6–ܘ¢öÒµh>3¼+ÛЧö‰.SG5w£uço™¾FÅkΦ¬-ó9%‹/㨴™üQ7>ë5Y4øm°–xjn~3ºÐäXJó‹,õ¾AS‹Ì¬ÁéB„ú«Þ\×cDk}¨©ÖÁ‚?XþB“ü [“·ÎIc)ÿÁð"û‘WèÑ̶‰Ó‰‡dÜíYpøqæÒ\ãŠušfÛÍ¿xó¤¤ñƒ_™KiûýL.¹? úÀ¶Öä..m™¹õä½ÒŽêäË&¬Òýï÷ÿx¦6zÓ]á•·½òø ŽZ¸Pˆ à^¥d÷óó³Â}¾Úñå~ygÿ,¡¡fë5­]®ž²ÅòÙÏUo“†aÞ·&ÔLý'fŽc›<8|ÿ_Ʊø¬Óœø0þøOˆ0($)B*$ã.BZÆendstream +xÚíRiTWŽ¢9‚(ˆZ|1JH€°„¢²¡€ŠÄy!“™8™@@)"ØÒ"›[P P,Å`Ý +Š²ƒ(¸@i‹%‚PJ9V,R·X§ú³ýÕÓ™?s¿ï¾ûݹï³4 ³õ@ˆXèKà”-—Í寠 O.ЀÃaXZz‘P@¡î-  p]]@€ö€ãÌç9ò§HÀ‹&“hœ˜V^¬)’3ð@ +p$ ÄPBk#„(¤’ÙÀÃ@èÔ …2H&B„Íàr‚ +) ãPœa7eÊÀùe‘K_µ!)£M«i›,@›DK1ìÖô4H{ù7l½)î+Ç°µÉ”ü˨Þ"$(–ü…Hå$A@“º¾tçI`oÍñ§*ôÀã0l¹ŽlŽãË:*óE A)¡ˆ˜ N×!Ž¼éƒŽoÚ…·¯×ºõ6¯®vº"@q*·QÔ?9+Qu²v¹oBR~Q·æc~õ‡~ßì>ºxÇÃ6.p04ÉÏh2 ôV/-˜[ÄœwãøÊ«cÑ«†|Ï,ܱgCþç+Ví>{çZ}"ú¼Ì†|,&»ºå‹ÇX}ìâÜBb^³C¬ßŽä˸&L˜×ÕïŸCΪô™á­%ÊûD +"F&¬ÖìïËd¬j96¬¥^ã„L&¦Xòkš8cïc1f¨¤RWÕ,–ö¥G˜ à¢¢º~ù£¨9î‹Úû—Ä\X¿û«OfŽÖOÞ¸t)w¥0霵8+ùæÄìÉòŽàõMšCÌx±Ñ KÒ¦ÍÒ·6º1j¸¢¨"B·u¸SWeÞïû ÃèDsKmId¥Û’mI>êÚÈ9…é!óóê,Ê?j‹O±Ö.(wÈg™õÜJªc¶]wfÏlh[Äz~Cd«» æؼˆ”à²Håâ47 U|v1œ¹X¿á€j)M(ç(5Yü1W>ë3^> endobj -1407 0 obj << +1523 0 obj << /Ascent 694 /CapHeight 686 /Descent -194 -/FontName /LIRIPZ+CMMIB10 +/FontName /DFCUVK+CMMIB10 /ItalicAngle -14 /StemV 113 /XHeight 444 /FontBBox [-15 -250 1216 750] /Flags 4 /CharSet (/greater) -/FontFile 1408 0 R +/FontFile 1524 0 R >> endobj -1780 0 obj +1959 0 obj [894 ] endobj -1781 0 obj << +1960 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] >> endobj -1405 0 obj << -/Length1 1358 -/Length2 7588 +1073 0 obj << +/Length1 1348 +/Length2 8057 /Length3 532 -/Length 8432 +/Length 8902 /Filter /FlateDecode >> stream -xÚí”e\\Ëö¦!¸K°`iînÁÝ]‚h ±ÐtÓ¸ Np'hpî\‚»œ!x€Ó9÷ÏÉÜûqæÓü¦wØϪUë}kUÕ¦§ÑÔa—²‚X€ä!Ž.ìÜÜ"5éWÜ\n..iLzzèbq”º€DÜÂÂ<yüþáçáÀ¤È@ ž0;[“ óï$A€³³:Ô€.¶ 0¼†%Р±´¹xr¤Ú¿g8´AÎ ˜ÈŠ“›`egé°ÙØ9brþö¤äh þ+lå -ý÷æ 7`úË&3nÒ -âèà °YcrªCàj ¸—ÿ¶þ³¸¼«ƒƒ:ü»ü_ú¯q ØÎÁó2 `¨« PƒX`Žÿ™jú—9iˆÃÉ(¹ì,¥m@®…ìœåí<@Všv.–¶k ƒ3è¯8ÈÑê?-À÷—N9]-Y-ÖÿÙÓ¿5vŽ.ºžÐ¿ËþÎþ‹¹ÿaxw`vc.x{¹á‰ðçßo¯ÿCLÎÑbeçhàáa0 '&üôÀ‰àÍ °s´y@pÇœŽø¼%¾k ó÷†ò -8`(|?ðuÀ‡þŠòñ8m=¡¶ ÇBNxšä,A§³ÐÙöŸ¼šù' à„8‚þf~.§‹û?ãüÜp¶…þÈàpZÛ¹ýàƒ«À›ñ7ý9ƒÜþ°_8翶òïˆðï°%ÄòOž\ ää -?pGà~eÿ&A¸´Òß$·ªù7ÁÏ.'ð‚ϳø‡àj–7|¢Õø[õä¯ï„¯Îö„/Îî„«¾ùá² \üÂO§ã×…üp]è×…ý¿›úÂ;êòÂm¸þpn ܆û?È×õü ÿûVHKC<¼Ùyá-aç¸@˜OÀ÷ÏÔs´sr)ÉÂO — |~G-]a0£Ë__"ø•û7[ÛÁ/(ä²Ä\œƒX¾ ¶Oi)ñ“ËŸ(EaA”¶iŒU¯íšnÇ -ZˆCt(VqbY«yu[–þwe÷¹û/ -çˆ6­Qù“§ØÔÙ‡]7óÝt¯fŠWgéjž;PÚë C¼Ö†™‹#~D©µ‘’DÃ}~ôæj2Éêî¡­Ð |6v«ûœ, øJ>ÝA/ô] /6~ªSI_èª;~b<òêxŸ}(zëò)¤Í•ð6='áÁ áÆ52Ò™÷¨­\³¨FÒêÃm™ˆ©Õ›Ú²»Úd3$Aýº3 ±&‘?<ë÷qè”i€l7ÙøV~Ï“ŽF{¨¾@ (µõª/oó8©{fÞ*-äæ2sD2¡ÐµùKîªIêôfcÙ¥»61"pd'‚k¯dxcÞù ¼ç$Ó¸[rˆœ ƒã£BתDw¿¬k4h¥áá†Lº`œÒ¸‹Ùº¯#¼[¯±Ëïò*´F~ÖŽ‡{Þ'–Ç™‚Y«ÎÔҿϾL)³ZwLjáîºnGê_IJøpàÎEgüþ}8R3­f*Z¦^¾Ÿºá'–,¾ì¼®ŒêË qõ“S‰T®CtS?Hƒu¹‘pû*Ëxö°¾¾0&qrÚ‘ ä‚óø ]¤ìðSù„¢@Cµ ;VµÎç$½£G…ñ½¸²÷×Èødm:ÆgŒÜ{×Nž|NF=/_ x6IÊb.àN^é3T«óŽ/9־µÀw8?’¡´ÿV!¸Äy3t"|³?Ag,/Ê9ec,þÎŒïê–ÜsÊ-»ðM_)À¾X¢ÔSô¢¬þ]JÂ&ÿè?¼œŠwZcÛÏñj=öòÊø¹Õª¼·wÈ!\ý}ú 0ÚâË(CGü¬ÍêÒ:ÏëÛ|mÏŠ:ÛBº†YÆÎËã Ã÷‘ÔõIv[³jïo7Î7-<Ýí[ˆù¨¥wŸ@; UÒJƒ± nÌ"Öa¤âéf,5WlÒ~Æ+ˆ¸dVÔå±ö¦?nÚhÐQiøŠN1ôi2_)t-pâ†X.Zn®ã,¤ÅQ÷-`@üë2óeUO™5:Ë Öˇ&(å/´Ôz:žã•4:®sýH\Ú‹#±jr¸%'S‹@ø\ a9ë—K}ó’þñ4Z( „$Ì\œRJ íÅ îï÷s-ì!XÀr7)UKåÒt™·jòX½²Õêg¢ÌNôM•Ûn6”ÔðsGþšLCßW×*Cã³8j[³3îQ¾£û­OÓ±çW]OóÀ-ÙüPûOZ^ToŒßózør©óTgR†Ú2Ï´‚{ü«2ArÕPv3”¾ìjø™šÄ´Ìåöo4Í“ lM´ÕË¡Þ—zL3Y¦>áÒØ)+Òg5Do ,ëß³'ö¦O‚Ér8O‚±èuñ‡«‹ýÒñŸL)*:“+Ø‹÷×Cwf>Î/m×=_öZ“Æ­3?”úL=uÁ¸ÅÙõyãn›ä–šj<)#€ÀàDM¸ÿ¹jr&Ë÷~ +j)z —'£‡¡K>ÔV&J•Ñ·)å”ÐÍ[Lzâ\a °Â§œéùÅ¢ÿ…jÇI‰dww¹’µÖëûr$Ê˱Ù)CpâÛÕ¹ù­3õá ³â›<ÞîÕrQcÇ€|§‰âÝ7k;k{ìgš!&H‰¼Ñe‡Ï¬öÙNw:(Ò> }{¥ªmA•“)7ˆÂÁ嘋bçÈG­8¦k4=UnÙ»QHàn02¯Lãw‹­ë»H5)/ -—ýÅi¸5¼rɤ|x. UÞlQx©ÁæߘK+2ªuiÕÑéÅ -õ&?j‰çÑFÉËjÄ"ÿ•b£Á$sÍBß ’‡‚œmÓm£‚Àq’7•œq´âIˆ„¦~63†j49Ì^k.ú™Ä2£…3t‡UÕ™¶wõ­Ôb¢obîXžST­b c†‚ˆ <šCУœ£(ùQÝjzÃq/jkt»¾1Ù)“³èKX(÷/<]õJ;~mƒÆiQyÖôx\4e1šzËC|­Æ­b¯Ò¶^”ö•Aí}s)cì`ÀXeévÊÃé) SÍFç›HȲÇ,K´½Í Þ¾ö£›ã† Cƒëº¦NÄfÿˆz¬Ð`O,‘]‡¯ÌD§oâþ…Ç*÷~&- Œ¶œ¯Î‚£”@ ä ²¶­ˆà²)Zx;ÇèIlw«ëÂ^-êêCR:¦˜‘FÂ0=‰ÅðQ -» 0ï¾¥-´½é¿mhá$±'ò›fƒP½”$f‘w]õ¾€Œ”ùüŠsVu÷“€}ÆÄmžÓLÚWЮ“@ÏfÜy¿¼Ø»½$x)J ë'ÙúU¶Ùw¬ -…øÏIUõdÔ?¬¢™{E»bV†ø´£Ôù¼9zEšEx?†GÅ–»£ïa(jÞÂNdï¶ZäÇÓp·Ðs”hïgFäd$}½ö&aY-üN=½…l7gùŽæÕ‚>Súi®®C¸'f¹W–iB§µ.îð¢·÷òº>™ÊÍ<ô¿ -{… -£ß"÷ê4Ï¿'¦ê ŒV¹Þ³w²ñv¦Ù@þA~qœ˜þ"Ï”þy¹9¶AØwëçµ°rÄ÷GéFÌ(ìîIV躣ƒ|ñoŸ_èË–õ4†®3è;ˆ$Š_‘ÛM  lH -»FÑ~äÙ¸­"óò]媇mrJ½IV!fc„M—>šAh3•,Q|gèAºÞñ®•hŠósî5^j4~BD.=÷eD÷Âåý©’ÃÍÝ‘ß3ø]K 3qV‡4öOV½â9*cFÎ -ôgl¾û¶bÔ˜tE¦ð·œ}ŽŒ Ö “ÊZ0úxUdÓ5¹îèVe„»à!ÑuLÂج²$›_W¼¹ä^ùÔ¬>ƒÔ´Bš¿å¨YhJºµø‡qõ6Báû™_ß –ß&péM’|kè;ú4‘ìß쫺W&¤œ»èU+ŠÞwPzkt÷qñGá `R_M¶#JáT)+Mµßzm­ÜVE<´`ã·à?¾“èé¿1ÞÈE•®Eˆ\dQl¯§‡s^ˆ³Aä´)ˆ³/¹ÒóqñzÞNP) Wûä¶ L’ ˾㴀Y::èÈ]Y±M{<+Á|ÎÆ¥I²ÌÜà™vXžÈègV3‘³DÄDü«Œ¹~Îm0ƒâ6äjö°L}ÚÀ=äŸÕf^ðHËUŽãéwø¹U¸¬)·½ÈÜ*lu}fŠÔGÇ"!©,‰ZŽ“6½HZxù úŠ–ƒ„ÝïË ß&‹?a!£"üíX3(i°ÙW}¡.í™~ð4EbüÒÔšâzƒ(â2¤ s¼ÔÀÞãC€—dòŠœC$ú2„uL¼)l?šÝ†XAüö‰…šòc£à£¾ÃúŠ†vUC -¸ìrùˆ•º‘’a9ýœ ÿÄï!"m4ö+V7é ¤m辂ո–Ę©æ‹D÷¡àÞ° ¹ã”¢®äÂ۸咩f Ü!´TçÕæN÷Œ›h[QTTùÇYI V'?Ö~º1CdQÂrîLǨüƒÎ:¹,o%­0pY”ú‚©¤²±8}UV^dî„n¯#[5…œÆ£ð­±ílÉ™©‘§t3(£<¿‡J"“°.+\“"[æ/‹zÄšX×Wö>—D—Pµ…žƒ>"ýÈëšÄT¼üÔÒóM¢Ó" šE(møëÀ“"°uÁxrÓ_¼§€«–89šé‹©HÎ"ÇõG:¡ÖîͧBëuk¤/úß( -Œ%ùl 䶄©á¿=ÿaêà×+"³šfnÅ£;¥¿H飸ˆ¥»à¸æçÖÄÛp5lDÈL¼ m>¨¿?÷ò¦‘Ë9î0Ûywkð À‡*ÊífŒÕ;ž¸œPæå´~ƒùÐÿSVgl´¼Üø”ùLŒ‰¹l(1ëíªqrM (j -™eŠaý9–¡Ø‰yù¬2BÈ¢Òÿ]'âcojñDÐÍ#§`…µ&­ûKpçDsû7‰Ñï0Mãèµ¢Áê yHÛJÊ ‡RN2³ÁK•_w»I?|Å*¢ ïö]1Ù [ÎGêg&FTîÚå÷=Þ^ÔHÉM}-¸Œ+°î{°4sç˜Þµà&ô¤€Î‰ñz¼(;B&‹¶°úAm%âRáÄ™i¹ÕÒ¶-6ìÙXÂœ)CY[.ò½­ñ€åvöÈãÔ¿ºÁ½òyø{ÇÍ_›rÓ(Â~q1T©¦Ñ8©ð±zø»¯4˜c×/&Î32žŽïÞõhá ÂñóîýÚvâÆ`¹Ý{_Î&41–ÈÀ6!yY—Çn$ [Fj¼.Až1VãZûDW´´k–wf¯Àêbœ„×ùD3yBɘDò¥{•ÔÍWF¾ÚY¯Ã,Û–+ç^Ä‘•`Q. -תÑƼØ]‰×ôóõk~}{z$Sh—TûZc®hÏž8&8Û`¿.Á)pÝLæRڵǭªŽ„Ò6Èε”- ÝWı¾A¼;”÷ûN–:5Ï)– CKs•QýÔòwp3 iR*º™Âé/–Ã\²S¥$0±‘¥ÍKyÛ­(wç¾Éw‹c'‰ËŒdõ¼Å¬ì²*JÕÑçàöµ¯ Ý¦h¡Î}«»Œ£…óáñ;½>r÷ªC‘`<¦CŠ>ÁÀ$`]Á A§ÅÞ\à5±.s8tìŠ×JT+#‚/º€¬w`ØtŨs¬̵·Ë«p>¯î¤ƒv¾Šx¼¿5T¿u‡žZ§=H.Pr€»“z´Ó)ž£^ª CQ<×Ù¼°·tÚ”ÍÁ¨Åo³^¾§žŽ¹|uìÛ(PªìqÑÄFÙta{¹%,|$ZºÏ>ŸJŽÃÉÑ$¶ñ‘#ËtC§jlžuÉ°áiŽ] a,O|.ƒ*å -MÈyÔtf®£Aq÷’ú8¥Íõg‚ܯ‚ïu -…)‘ðìÐõ—)ÞÛŸd^D3LÍ!C¥* —I’;]Ĥ]ߊ¹—Ö¾ô1ø`vØþ>ïè"L´Æ)æ9þÃN‡ÅòÇÀ2ÑçÙ9Püå™Z†Š%®¨°Àsž=°»ãä4é7Kú”!2v¦^³\ö€‚Ñ›t<”%ý!Ô¢ A]U®õ“ëË„þá,[4hž”ï^§¬¬BÚTa+ž‰sùÉ~J«¹-j땼xIgF¯Ôhòý‚2)žH qÁ™„*ˆœˆ¥þ«åäÎò–9šæĤçˆZÇà38~î—™%l›b¤¥²oÞÖe*P9# Y¬_Fý˜×½ë´,k6±½fk²£Q×?š“$X=ðX~0-ó´Ð\äÚ¥C2!3a!ø! Ýä´W?’IZiI-í›ÙjæÁÏTbc"¨Ôå[Uf$Û˜¤Ï¬üê93 ËÙöž@SaM'V ªŸ!ƒ¬Á-7l~nà <㺴O>A›zÜH¦ôÆ‹‰wÂ3jCEŸ¢Mq:Û³5ò%{ø]UBŒ¾¥Ö$" ÛbÉûEf0¯SiÊøVùÒtaÒR/µÉâÌ‹øŽ·Ø£õÖ«/jz¢¬Ðtö1R­î[òŽ’|5uÅa ä -†·ˆÕýÛiÝÁoXó÷·þ¯·™2û:yÖí¹o~H5X # -úAwÂM‰W )D -žD”(x4³‡s]¯r>ž„ïÇ0x8ª*Ä¥TFm£µ]ÂŒÕÞJo!F-Ê…ßøÊK­}j4D¡QxÑñ8kÛ$l`?;Òx‘Bt‘H^̳ðã"0Ÿçå7låâ'(Õo$V¸ƒNV:T;»HMÅš8\q·•·›{“}‚å³@—Éãyi³??F­XPÌɾmFâ1t7FHÒIëHçô¯¼õíª(X±¿ý²÷©>]+®5—<œAC\BuIâºè¯ioz¶‡ˆöÆ—ZÍLjdG-µpÒîÏZÊp÷‰è˜¯uÈû!eW·—;Ð@¹R¾F-lz\ât<2þìöq™5ßÛ6V ´Â1N)Ø2Šïx¥{J±Ó*TN‚qh¯}š-è f«O_ZÍFYš¢µ—n•9ÛÍÕÔ"œBË1“1î¦T "gÁ…*œk:O—xNßWC‡d)ŒüTz}7¡ÈüÒ ƒÇ]Q¦ø÷,c_ŸQØ»g7„ö¥W(0&Hn€Ù•ÑÔ«í…ÃfU+"ç‘ŸQÔó™"V¼ßa[ãF ±ç‰¤q^©iÚ±áJßõmšù&¼MLß ¨|†œµñ“vÛ§7ó¸³ ¹yì¨=£Û8|ÍSCQýÍšÓµÔÈG[d ïZÍD»šu?‘^ä²]q+W›˜¥`š£áúSãAÌø‡.$0m‚Òb*i= +³öȹNmšZ´0›ZV;éÍ<ç{BÏ·²m1ôJdOtÈ!ŸP@>Fœ‡†MÔP¿hÜQôYN· ÆÛvZ•oDפðxCm­Êµ„¹¤3ë¸*;Ò»E›2^ŒJÜ -˜W,´ù$ÕÔÐ_ŸÐÂ’‹´[Î}p% ?¸k˪8¥)F;§Í#õ»Qó 2€äá%å0÷åQÕ–¶oœ½¶˜m¬`¤¬OÃ-RNYUY–ƒ›øaÈ›ÕýÑ+ï±”¶ðq’¹-=.?ˆÄ DA¾œàr®¼j?¼Ãʽ –¬Zœë±×X“:™”žX¸o•Ž3¥F¨¹ÿlïKT¨1wH,ÐK÷½*÷¨.Ÿ6œ_î¤[9ø©ëv•Þ6V÷Óö’ÑØYÁ óý\Å9Ï Þ—iÂþ¸½Q432/«D³Õ&}üR}á—önE6"Ÿ?öŸË5BíË…Î#¼¤Òè„Ñõæd±åÙ^:Üh-Œà oRb]æäÃ¥¨b?LVƒpW©Gîrœ½,jSl|!†Zú§*Ö›²~ÔCÂd.P‡’ä+ߟҺáÞQP–:¼£X¥[z…èƒ\|‹hÎH¶À›.s1à¶ê†a`¨ýú›«K®vÖ˜…LÃ/}Âàí$~§Üåâh‚χXY²¦ÆkŒ[Çrª -.$Û‘kÁíÆbìjê!é~ÈÑáò¨\ÇhoåðÍtG?Lȧ, @_ðMéy>·V¢2LqWw})R”Wö­Ú!´pIcÄ =; -4¼eza»+5¾ê??8çEL‚ªò¤NW¨q:H^lØ©ã ;‹wŒëREîc•¿¦;Ñü«UÒÏ?k{1bö‹¯ìqÀ˜¸¬J”ç¢TãYZߧy@YF¬œÖ¼Ðé¹×Ä”JäÁí›O7l0¼ªÉìf’˜"@`•G4ÌËѲhQå<fïêÛ[Ug“4ûñ¡fx×?ƒREǫZCl”¹ý¢…Ú·ÙIÐ8|¨pÈ[x¡‚+áÀž¥cÿñ®ý`g¿”ò-÷|G¤T Î.=i~¸t]U«ß< FcQ57]‡¼O¬Êbì·•9¼¬t¥@/“«ïóÏGUqkÃZ»›SMæÉ¡˜HÔgãâŽçÔÉ÷)GŒabìò FgºöSé„$¾Å9Wt¤ö(¡:!_»ð¬¼‹zøÓåí:CÆG|ƒcy½8×’´g•°½Û2FÎ-gcñðQÆWÆ<ŽäùŒ|ßzÁ£ƒØ™¡}F -)3 le¬òŒ´îWBJç.K’cfçÇtÅÜÔ|£ qÛ®-ÓP}á$]~iöŸ,ÉM„èŒ.´"«Üò#LÖå©¡™Ó°F8׋'W55ÝêkŒg„Ù^#dʤSO”¾:=pÌÒU¸¡Vùʨ÷À¾%ªÅEZ,K—©=¤Çˆ-·®´&»FNªG4 ÅöÏ8!k½/ƒÚÌÈÒ–ôL¬—k2¹²-F¶SLØþË ¤H\CÐÁVr¹V"òÏñÉ„÷ÕE¶Û¯ ô(–äÞ›£ÒØ©ÊcïeIû.|R7G"ê8Æ<²×Šx\ìPÒ¸llØ»|´ÌŽÔ~u¦ºïºêÇw„<¢¿–ùÇŽ>E)…|ٌ̠,z!u>o¯pn4)éù Ð<0¢O9Æs"Y×·–#Ó¼{hªÿSÁ‘éëÆV®ö¼¦59°Ÿ¢ånäÄ‚léSò'éå XfÝ;ßò'¼üu6?7 tVËM«®p‹Lêl3Ë}#^·~„ ·ûÞ®ŸzYQW$›H/(—UNß/õô0ø«ÆìÞÒGV Jî·_µ /\¬»êFffýu8…ùö¿¸=·ùy„88é«ôušÝoêÁÇÄÌQæȺ¡ø‰E”T—ÒLߪ† ÿ}ðdƒŠÐw/ ºM%œ(’´Öv-ïˆ,Ootm©ûzlåf{:Í7ïÖfÉo> °T¡fƒŒ£IÑóõušGs1ΰˆµY#9ŒAÜ$e‘Û•r¯#8»×CD´Á1Ž4s•¿FħY›eñi<}Ó§*QƒÙ÷,+† E$¿2.è‘h½6A'ÂT¤ë,ì·á&TÜâÂG‚jÏŸ¦ÀL±Ÿ€KP{Yã `Ϲn7§,ÌÇÓ¡ØÁc$Ø&mÍïfâS[èFÄÍk]hU~>õñž,;óƒÒTy)4©•¼ÿDõ³šMâ'Ü°þ½*³Ñ§;—]Ѿ׼ ú fGQúÄ ÁKulyj¤çõôCàà`Iú˜³+ýˆÃêšé ¸ùwsê2ÖFz¼•BH™K‰©kZОõý¯g.[šX‰@*^Å:¶óÊ[kì›/ò1J¡%É(cK<±ûKH d´k¦/æ“_6ä²OÅ$ ö•ìs7“ô†â8‡ûœ[‰÷-ãLœ^¡Ì]G ÐÐR®_E>õ´­ï1Êbù-ñ)Þ Å9âmzÐ%¡¨ã³Â'4ø)á‚ö%F¹¢ -xËø*|T«6…ÆM€âÓ•B”•â ò†%ÅdëÐbù\Aí -°4Å.ºä#r<Œ¾Î›©Sœ‹C~hzmŸñ¸öN[Ì RÅ£Õ½%Õ¢-ƒÕñe±qp…ý³.C  #]gÊܙʨþÑz}`nm&ø8°ãg©§f†§ín„/îÀ)ïU«aµëvs>¾ïãú?üaþÿÿO°ta.0öóž¤Å{endstream +xÚí”e\[ݶîq V¬@ +”-ŠSÜJ¡¸»ÁÝŠµ„âR\Jq-îîmñRÜíä}÷Ù›}öùxï§û»Y_òcÌù ¸13±¾7[í{˜™ØÕ f0Ü(nk Týk…P솹€ÍÙœœ@sˆh +¶„Ø8þr$goòý#lîìðÏ” æ„4|4ÉDZ4‡ÚÛºÍÁE(R ŒtòÃÔn.ãlk«hb÷×öwéåMì ¶îÿ]µsp†ƒaÀ÷Ps0Ìþ?KµÀÿ0÷lq¶ûϬÜÄb&noi ¾`çæýGâ$q›+CàfV@ ['ðßq°½ùA6ïoïdåÄ¥dØþûTÿN*›@ìáêî` è¡úoæ|`d`7 ˆâD"Ÿþ3ø1i{3¨9Ä9<¼@ÌÄ€œ$ñ=9{s°ì†tÌÁn…#—‘ñZ@a€¿õ5/Ãjkkû+þÃÑŠìÞßMúgÙd jþârx€aЇr)Ôü/æ9à®yN$[ÁÀÿVÁä°€:?¨ó¼F .ÿVÁ äpB6ã_̃d° Øþ!‚tþ^y‘5â„ÌK<Cò¯ õ@HÿÒÿ">¤{™Bz—} ¤ï·„4-÷@H=…Bê½ ¤žâ!õ”þEüH=åB*¨>RAí=Q äÛj<R]óêZ„T×~ ¤ºÎ¿ˆ9_mçD,‡ý¿!2 ý7üëþ ‘¢ÿhÿÿ¾ +P7ÏW¼\ÀW\Èyàääz äãyÿÏB {ˆ£3XN +92 ŸÿßQ3g lÿû „¼fÿd òb‚Án`3ÀÜ4ÔL(ÈúSMH¡tÎh&‹ "?h°%¸ +!ľ»,D2 «Q?="&¶†?ú¸'_ÊanÁ³JU#îÕã©Æ…¾Á±¸Y¬ 8?ÛÐÍi'²ÔOâ2.b&0ÍM¢K_~*L·ýniɳ;d¥['3×Yõ䆃†ñ¨ù„ÖÔý…âJÍ'—~ò¦nn/ÛÕò/D-"<"¬?ÕGB«µ]­Ÿõ¸ôdVë¯]Šï·ÏõwÀ[Å<,éý‚ ]H‰*yßmH65GÖÿìr>üÖXÅrS'©c³¼Ï -×¢d{º<"uôë×Ο«ì}vÑb;J+YÙï ÝS¯v6W=½ýt H™X§b=5p¡ôãtooÃW>Å3Õ1|"‘ÍGR°¾è -ÖòWÒùxçXd²?žþìheXhû¦'1¤ú©¥Å¦OÉ+­{ãi·’%LónK~âWõǯã^¹ëEé´~~óÕœØÄ.¼Ä‚3 +y¾&1–š}5» +üÔ|/ÅÅ|·â]éÝa~Mc(ii’¢VÞ#ž½bè⥧fÓóØ#€ÏÕ¬•õ~#Å›À?¥zÌñ!BÙá˜%°Î÷S±b˜p(  àFëmg°×·µwJÝ&©Ž.f&Ê ºœ¯ ×î_íyÉV—ŽDË¢œzU%ü|Ú©Ä'LJe–)ër.·4SŸãR—°•ßÿaÞ²éOØÇTûý‰/Ëþ“ìšàK7•ìMÜë©:7åwR±šy «°ñë®èts«µâàèU±Ÿœ=%¤Ó]Þl5Ü-ÛÐÌ5¢ 6âüðsÖ×ÂÓKÔí\Ì»Xëxb rü·<)VÉCåÄ”¿lî#QNKšXÛM‹Ã£$êÙqð-Ç¿¡,eeÛ,¾³FQÆ¢¼êoœ•Ê#_»ª´[Üÿñˆ©±Õú2!jpåê±­9}ÕÛ§ýïäsw³S·Ÿ œšÂåÒ<ŒéL;g@åÏجS½vÍEàüýˆ‰¬g“™h*­Jjõ@~G»dö«ñËqUa@û¥}¾ë´¤·dÉ}ØÅ—±ðg¸ýQ./OÆY<Òjgš»OÖóÍ«2(‹ô’ù+:¿02æ>Ù{ý›â|<°D ­Ø… +?¸ÇjVUӌ漀J PŽº¸ mGÞ~·¹BÇAeÍV—¢þIµé4G:-ƒúGÌ¢éq×hþ«ä~÷<¡ˆ.)yƆûMGW¦Eì‹Ï¥[ºFŸ£¿ˆ B•Š|ØxäzÉÞñ¤·Ïd5Ÿ !Õ£Œß†—Ž;¯rµyç¦"Z(YÕWõÑI"_±èqS3ä#s4ðYkç37é°’³2ÈÐWQ$ç§Ö¸'´V1ªËñídŽ¸?Õ;kºm²ð‹ÐÅbññ¥Ûq3î¸á£Wa¶j¸œoLð1ÃM:ÃDI +ìæl—i Wž¶FT$~€Lß™ýìmAðrVݘÿ& 3íŒÌÔf§¾Ô¸!MBœpÄ©,?B^3±øQ¯º.Fè„`öíPâ=Š—ˆªÏµEÎé>§T“^IRZãR]ˆ¿rGnÖÒ_‹«Êeæ’P€6­c»Ë8Õy&˜›I(ß —91êæ꘲[Ú8'°?ÊÛ)–q–ìCw0â=ºŠÔ÷Þ± šŒœ’œ`ZÁ•z L@¡Ø^7vj¸Úi†H¶ã)ØJ¿Îˆ„ã<±°v9â‚îd )©WÜéB•~Ö©yç(³Ž¢–5ŧì"’¢ØS­·è«\g_7‹1¿ªŸ’¯ïG²ÅPáÙ§GØ.ÊÙyýP¾B?YW”Ä«Õ ¥’SS£Ò>¡ÓÕ×ëXO€}”¤ÎUÅŠUÜë÷Ih]³ÉD©ŠS h'zÄPŠ¾H&þ2$ ý:}Z¿æ/„´÷ÆõªVÑüÑv¼ùIAWXSc]Ê›Cc›"8ù¶—¤ç˜’Qºï!5DànbÅ°î•ÄÚ³ FB”?7ÿÝñå3Ѹ¦D+ÎBmŽ*½V5>\ÿ²5r2|“=l‘æ7tWVÇz"h#WÁbå„+p‰cgäMNƒx&Êvþý°a)έb×ÓæJÛ9œC½>‚µZ‹³6‹]_ÙŽ¥Ù ƒ“Q +%={u„¢l{ð¹ïxeƒÄ¶Ú§Î'ÉÐÂ'í–°‹4Xa?¦2o(Ýž*×%ÛktÚµ½"Ñ<»˜4'iri]^€‹ÓŠ¢àa÷èe­*ìeùÛêum¿ç¹ ÷ŸZöu”Ëw§×'mõ÷·¥~² >£±s&dòV§SMVzúv+ºèµÈ«Ù6Y{R·òPü§¡XpåÎÂE/U@;MÙÐÙ½õâ4‡M&É,¥)x“u]:¦É–¢.æ«^.Ó곃À3í}zýx쌾5…±t êAŸÕ| ž2%«oî$÷ïñíŠV²¥lPº.%ÜŠÔÏÚg3ëRìõ0šNtîHUÓÏÁÓ$ñiúg«=„sÀ'yêƒ_~¦ïT‘g Z™1UñåšóúNâNrzöMcÞ1|¼pj Ìf6Q†‚¢¹Ô® +nç9š#[è(dG{)KOß©%²n;0J[ôÖO&¥j96Ìo'¢Ïüºéß9¾½Âà|…¶Ó»PzÞ(Öl\ôKÛ»;ž}>Ÿ¹L¶¿ÛùñtzèÆøWñŠ5è)^Ã+º¸GÏ$ÖÁvÑûZ]j|ìE„σ½Ë^ž M}ßê)…ïK4ŠÑöbôîdÞ7P ¸è®Ð‘0Ò(uÚŽN‰´¥c¶E‹ ¥ÂBwÜ=ZTX('`ýÓÌcmõ +¹ÊÐÅÚÆÚlÿ¹ÍjÃÁyk–Mbƒs%&É%ª•«†D‰’‰ûÅ}Ì”áø&Õ«áñ:|ÃYàó]ÌötF—á…jáj`Œ9IÊKŽmF:Mx8M„ý4%Fz37öeÎïŽqp6¯«R2Ðá4«µNJ1²ÌµÔ"`1|¼½ÐJìÊ’ ó²ÃŒÃiüf¾:Ô>À•u,yüäL¯ûâóû&ýJ4‘¶Žˆ +RÙ×öwƒ§#Ͻ±Ö™S—Ïë…ßZe¤î¢i‚/Cuª4qÕ'sh5ù‰ ¨8ËöS“g¹µ9vH¸—7Ù^¢N´=%nÍ0ñ¥l¢;åC$÷  Ðý$¦ú}­­0†á™cRw€"¼uêþ[å`‰Úˆñ‰…©‹‹‡³§.v(^aíûN"ï_”C˜ `Ÿ´>×íš×$çs˜ï¸ò¾noàûÑrg¼Ýڂ܈aCâN»µÜ›u5C5<ÞcøμÏ@ˆï˜µnÖÞá[;lvPUºß1h-p2~ ®z2¯¾ŸÓca78î)&uµ ºŒ‘v9ÞÅåƒÇ&Çá‡ï éÄjæ'kV2ÙæSä¥Y½DJE*uÕ0<Ïã÷iÝ78{²åN1¥¾ÝûðFØx“A_JEÏ‹#T˜7Gc¼‚šñË`1»)þT’ÿX.M6¸˜Çx6÷ê³\…/€¤jHéãÜTt»àr[~Q”ƒ¬¯´È…%[âÑŸ-_O!«+ ï§Ç“ET}[½‚žÒñþ:b˜´3®q!Ùìƒs}Í,IÄ@{/3j’Än& •\ôË{™-o^QýÃå¶=™Ÿ"}fê—÷}áº_íßâ;žàñévôeàbƒ§µHG¢¦úzç‡~ ŠÏÛó(.ÉUÞÛ”© ®ÐP«–jânª™§Wp’í3åìÏÜ[n*÷9;¾&øøUhšŸäG诶ϫc<¾ÂXij6™rµþ«¾#ú„‹3Õ=QK—ÌÁ¸ö±Òj4@Ô÷¦·Ãx6UxƼôÀþˆÝGôküDM`üÃðI1TYhKˆLk¿NTŠBÚ—úÏÙA°³¯õ2ï‹í¤i•W*!¶¾õùtg»"Šß¾Ë6ԉͩá)¸[k¥˜,ÙDéƒêÒi]]4ðpòahú ± Ô)†@¾ŠYç—šs/è´ª¢ÒXŸߣ‡L™œ™Á>8#mGÀŸ0WuTfY§•.CÏ8Þɪr%‹X‡Ðl.™CïÑià×xbî І‡tÐûu1ÙIØŸÀ}½µL@ 7å˜á¶#vž§4»diëW‡^3¶3»lO¯æ;„3,:_El':{² w‡N‹þÛó}~U†C$Ó¤ +¥SÝ\lYbŒ ®ó¯9‚¾{:25Å÷óÄ ž (¤Ø;†În N©EÝÕ+øë‘Êã¡JÜn_ /æ€Ì·üIh¶òÙ-Þá®Ï7´ùd¡7š­¥ýõ ‹E¶v¨äâ`ݪM{­£«¡TÐ ºš%[X 8Œ¹$F‘ÊmX[ÏE½JŠ:ÔTÝ Ò—9%ç3=«§B¯þϯÌ9*íª2ïëZ=´©†›%š¨Pì'>†6Ê\„Ú¾YÓ‹n žãb_|0d^§Í :Õbc¡Yõç;§.Ù%ÀîWrŠL›.Dï³ §Ô¶}³bgµøKõùìEwïÒ„iÒêÛTB_žCq"îï‘xb™øÅyÍD"œ°%-®O=ÞŒ”¬\–dFg¦¬WÙB °}•:V©ÈÚï±V°—˺Ä.Ë_"ä‚ýdðÅö¿é·Ò„Aôûàþ³×»qJìþÒ¡×?C2xøv;Zz_Þ¡g˜ê²E‰ãÕ|¥î4™¯kÇø~?ñ§tòégF7¾½i’oá¶#­Ö öa¼ßwÀD'úK"®õ_2TÄ©Y ª%›Ÿ¼Ÿ0¯½ûaÿ¶Œ.|}Ä’BÖ“ËÇî¡Rzùã~c¶ à*à•ÃÌÙ°pfÌŠËàËòµŠ—va>ëðVN¡lß<,¥è8‚Dùö~Lv•[ùÀµ‰1·›/)Þê/ñ™+üž&9ävx<’Hb_QêÁtFë\v9è}Õˆ|÷‡ØfòÅäîU°O§³|ž>Ç8Æ÷=Zl¹8?A{¦)¡µ‘Qÿ:ƒL þûæþÙäˆI—Ê™œ“ªÍÔüðc<……¾YÇ3¨`æã‹p\ðgôª 1! '•¥e;°‹­Š[Â'šMx%#¼üìXd‘ckµôè…#z¹‘“YÄ¥*uFH[â éçÞéâgJæB¬AX¤Ô{]ž™.pw²¼ö<¿s°I^‹„íÛh|ª=l[ήNÊPÅÒÉçÛÌ"ÔÛ\)^gê më# `#¦BB™¬iv®)ž/ݹ‰¸픯`4ˆ98O8ùQ'°Z•&5¢õ]P‘Fö>â|j} %¶óp&R^ˆ¯X“+`5 '`Î?âÄÚ›Ú(f[5Œ!Ê£g¾à\°QB#®ƒeC®ò[O'ñ6[Ç繃‡A }¶ŸåHÅ%±d3çÑUç RZ ü5”Œ~é·r?Íy¤ôHУÚÃXÅ›ýd¢\ã;½ø±¥Y× çž²Kè€i,|è’2{2'u΢4Õ)Æ÷î×ß÷jf¤gtÑŸ|è)ý™•Ô}1¸db_–õjÔçë{Q_’}Ž•l£%°–‘—ëx-“”ã]Æ…ŸäocÌ“’j¦¼1ñFðTÍq.84}íF„„f”ÿ"UŠGÍ*ª³Pz’Êß0W11ÔÞÛÕÅkŸï‘‚ž/[§>¢'‘ÁïŽn:Lö*/ò³‹`g!å\þ¾Õ¡X€Q¹mQQnhûóÒ‹‘uo¿è…h9Q3к¨ ‹u^4M8•Ñ³j+|‡ö×€~¹¡Œ¿N¢6¸z¯Æ!Ý­RÒ0‹ÊçX<%ædN›fGÿ×ô™JÇñÛ¤Ùº~K}cv¸Ý±ø»˜¯+ƒÐ$BŸeI}¥éþ1I›„Ë,¾ý[§õö4ž4 ãC»€Bú5Mö[ñÜrré(F‘(z(@æºàÛ{ù +I³Ò¬x=Y3ÍFF[¦¶ ')ÔN†ïÏ€™áaO ^-)íålÁ«°¥ÛÌ)$WÆ|ש°ßôâ pñZK1‰¤ÿÑæØÛ’´²(è2°j¢ÞîoÔL6™ï3ŽMn,™fŠ±[Ë~êW¹ WPÇ„\H6$]§ú“‚;EÕ^¡?5±EtñÜ,V´½<غ ¥+©´ 7œÍœ¡“r¥ae¶ƒ ‡Ÿc÷jPa¶Qý$ÑôQÝi +®Õiܱ*¶ŽÝ.‰ÞJ)¡býN$õ=¶Or—ÐâýA÷–¾sµ9 ï˜<÷H4p +Á¹íÍ3ø(å›Òp¾+yKžãè'-žÆôœ¶Iÿ»ìc@qÒñ³PFòõBá]©ý”™Gž!~ºùÚö¥ÁQaDwÚ íS^ù6nQÑRÉ+‹Ú1ÅÌ#ÃÕKºNYò‡ˆ‚0áX)Eâ`¡iTŒZB?äÃý¶s7Ǫ͛‘ØÒæ¬ÒêÇÛè îk¸÷l(‘žIã¹C9¥|ËäŸé”¶†­Iz» I»‹s|4„5ï;¿²å„C.quê·ÔTŽö6Y›±;q4µÚ,€wÞý_ì5$“»?Êïë®ô4vúa‰â&sÙqöteÿžë¥›ŸÒ+â¼t¤Ð-§Ø WÑ€PUó—Vì0p¯ÌzQ*}ÍÛTð¥r9… ‰= ®¢úšsó\¶ÐÇ`³=QX¸[Ž™ßö…£€Pg%„n®’"* ±2ÆäÀšB:›áÂö=ŽkîµTN9Ás5·¨>â0¶k­ñb÷ Ú KÃ_Ž§¯#!GV«5±ËÚäÒ·!ûØøuVµ4wš,ó›Ý€G—ò;—ùØS¥1ÑUÀVÿNûi%‡røR­™LÚËÈŠ{Š +‹-M:imªs;( -a¸}-b<æMŠ +ÿY+šAÉlÁz`Íš|Ñpý»áË4sô:|è×r);ú. +C•ÇÚøþŽ¹Ÿ½*8—⪲²8±‹p\zM,]p ²!ÁOj"dµòd>܇͒Ê´M¹Ì/û© Aú†1(Ì=ÇF2_2Ši_z‹Üúç Ã_Åuáßr»M}²Éëä¢Dü|iÒßRzÞ´7¤[»UÔ'Þ|©Á*\t诳i—¸E~‚Ÿí}C™°ïŽˆéòRÀK“lêOªMð~ ý$~™ÈeAG·¸˜_kü¾™´_tµ;¦d ¦íwýÂ@ÛcXRF•î¸—N€ó;ôZ![aÈJØ+·:¼sïDŒ¼*O ±ÞٽȻ¸äí öÎt ã1iÐ ïFÜ]¤>koIÜ0Ë:Æ+Ôϸßjž2bt×Ö>ïî +µ6i•*0œ_ÖsïyB„*(#FåY ×z¬ùüC÷å…Ê+ +rfPž“L_Ê"^éÚݧãæ7zr +”MEï;2çZ<ËR7ú+ôUM'ådÐ¥ì1š2%l † +w”ròu²ÕW,¥NHiżÐHþ“•~s:…Cå´½HïÙñ:аòn5mhœÙì¬C’w] %»#ªúÄÿvï,– +@Öî÷Ké²ñ°Ê7JχÓèxo#jåt÷W¾vQb¥¤Q~;7¤C?ÙsCWª]Á±ç!ãtVkgÆŠ¼Ð“‘ÂÜŸ™¼¦±™²äŽdt8£tAåÇìÈ/ù‹/¶é2.\E7…ä˜}j­Û¢•ÔWq »6[bý|/˜ƼʨS­ƒ®&â©2„ “ä^º·…Tù*¦‘KùÛÈ ùû©3&9šµw0½D}ºwìϬŸì/²IôÃC4~Ÿ­tiߣòaÐU)P«*”ž.('3øæSÍYò(ú¹@ šEîäÛwÖÇ?î);-ît8oãº÷ý’\•¬‘j;ŒËººµ @¤@=þMdæ`_s:‡ù8«stÑÉ%"ª …Ù»K¦û1rðl”hB7P÷j¼¹Nd´y×°°‰}R'!·=‡sZä«.!æhêå8F1ºjZTMFšÎ!í”RF|e`¯òÉÊÂMX£±Ï¯/ÕHÐÍlUâO¢fƒhiBã4h¥º»}Cs?&9dÍBüƒHô-³­+å…¦íy|6Má§7ž”ñò#ìÊÓg÷ çº ¸îÒÖî0‹Îáá\ËÐ}¡€ µw´½Fø0;±b߇œçö:n‰M»äšÜ"/ˆË”®;MuIžHFŽå½£^®ïE¼O$•À%„¡$P³UÔ£»ŠçÂ(ç°žR·Ä¢$Üi½Áµ©4xÄürá«j85}oç ‰!!µGìm-L>úù´GºŠ¶Joœô2˜˜·½û=ÉRã— nÑ)Ï®¼-Uþ‹á¦ú‹ž |tòóúÂÇ œú(²ÃG ´Ž.V—UÓdŒ„G#<½¿ÐC@ßpç N²B÷ÃEÕã?ªcë3ü©.i~ïÔM"\f<][+m= Œ¥.‘NbG'ú/í2Ú›X0^6üÜ~ô,ÊãíË„¶ÏÞ9ŽDÙ…á*'ÏÐ.¯Üž®|6ßa—µ¤ âÔÐb/ž°Í½¢ñýíÞÕÓBÂë?a®fZ”i|±Tx©}É×CnuWxXÒ=„ý¥Š'±ëø:ˆÂûSÂøÁ»¶'º¬=ný`lˆ& foÞ¤XWùë`©Mœ¥f SÊNýäAžç#—¬Ú£Ø5×î}Kx´ØÚ\`€tÐ#F]YåwLÔBLÕ„¡VˆYŒØñ¯³æÇ+Õ£rFõZ& ÿÃàÿoðÿÄf¶`jg³üÄ!ÕÐendstream endobj -1406 0 obj << +1074 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1781 0 R -/FirstChar 38 -/LastChar 121 -/Widths 1782 0 R -/BaseFont /ESTQDQ+CMBX10 -/FontDescriptor 1404 0 R +/Encoding 1960 0 R +/FirstChar 36 +/LastChar 116 +/Widths 1961 0 R +/BaseFont /JGIADF+CMSL10 +/FontDescriptor 1072 0 R >> endobj -1404 0 obj << +1072 0 obj << /Ascent 694 -/CapHeight 686 +/CapHeight 683 /Descent -194 -/FontName /ESTQDQ+CMBX10 -/ItalicAngle 0 -/StemV 114 -/XHeight 444 -/FontBBox [-301 -250 1164 946] +/FontName /JGIADF+CMSL10 +/ItalicAngle -9 +/StemV 79 +/XHeight 431 +/FontBBox [-62 -250 1123 750] /Flags 4 -/CharSet (/ampersand/hyphen/period/slash/zero/one/two/three/five/six/seven/eight/semicolon/equal/D/I/P/a/b/c/d/e/f/h/i/k/l/m/n/o/p/r/s/t/u/v/w/y) -/FontFile 1405 0 R +/CharSet (/dollar/quoteright/period/zero/one/two/three/four/five/six/seven/eight/A/B/C/D/E/F/G/H/I/L/M/N/O/P/R/S/T/U/V/W/X/Y/e/n/o/s/t) +/FontFile 1073 0 R >> endobj -1782 0 obj -[894 0 0 0 0 0 0 383 319 575 575 575 575 575 0 575 575 575 575 0 0 319 0 894 0 0 0 0 0 0 882 0 0 0 0 436 0 0 0 0 0 0 786 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 559 639 511 639 527 351 0 639 319 0 607 319 958 639 575 639 0 474 454 447 639 607 831 0 607 ] +1961 0 obj +[500 0 0 278 0 0 0 0 0 0 278 0 500 500 500 500 500 500 500 500 500 0 0 0 0 0 0 0 0 750 708 722 764 681 653 785 750 361 0 0 625 917 750 778 681 0 736 556 722 750 750 1028 750 750 0 0 0 0 0 0 0 0 0 0 0 444 0 0 0 0 0 0 0 0 556 500 0 0 0 394 389 ] endobj -1162 0 obj << +975 0 obj << /Length1 793 /Length2 1151 /Length3 532 -/Length 1728 +/Length 1727 /Filter /FlateDecode >> stream -xÚíRiTSבª¡¬2©¤j=,ŒiF !¡€DŒÃ(ƒÄÜrKr/^n i*©Ê²ˆ.EE©°ªÔ¥–X…p"­"<`ù|HÕª8½ ÖÕUúó½_o½sþœýíïìýïlš[„Œ!‚° p† “#AR©„Ãä™Í¦ÐhA8,' –°po°J«\/Àæ y^BŸBAXºGRUð¢O’ø@¤qD!GTN¨` YC!W¦@`BÏ"µ¬¼‘ÖÂ0ž CL -‡ DA€ p*‚RX“š$¨ü·0¤M—Ê„ñ Rð˜’I¤HCÕzÁJ -k FvƒI-ÿ YÓ‹‡hÕê5rÍdù)§þ–—kµþ¦I×0¤ãètj,üVœ†­fzVBÈÕˆB„¦ªaÀà¬`²W¼Å‘ŒDC¡P¥\Oá0 -MWBú7¥ƒ%ŽGGyþñµSÉ9‚Qút°ÿdOÅœ?cÒ$Ñ6“ÍæDr¿;%Mk&F„ ©€Ëór—ë)ä‘8A!X`©˜ÅD1‚¼Hgr€Ã)“ÿêÍ,5œ‘1‰¾¸€•:9{¤{“Øߟˆé /.`pyd+ö -Àç±sþJŒF‘ZX xl¾—o -UhqF‰©¡"m{+ÒiÖÁ -Šå&¦ðÝúÙ¾ÓÛkrÅUÇlé MG¶¶ŸßvÊäËîõuºŽ7þô»ã6ÇÏã%#áß° %¯zZ”m6ÈXÛzÍö.ôŠý²YÉÉ3.—µµ~ 9¸ãžeñ`z£çÃ_ÜŸÝ͇_I)œYsëæ«'¹i›:ú,v_CîC%”¤²3«÷Â1ÿ¼[tuâA(V…Yª/ÏOÜÿÌùµ…Úz§;í¶½I`,“ÚÜ0ù½œÃ¦ë”ýδŖ¸RÁ*™pöBïë1å&`õ¡Ÿ›)ο¹)\úÛì.º`ÀÍô~·$?§$,V=ºàX…“¢fÚ/´šj ×·®kÑø£ ë#óÒê;¹~Åœôƽ´µ)ã¯h¿/Ù9óiÒ‹½Ïß©-7+×3b=}dzxÓÛÙTÛk_˜Ýâ媯°^»•Æ6ÍOýÙÍcR'¸‘çróèî.å¾p\³¯ücé:Ïo›Ì{Å:+Aü%ô“þÊGÿºÔb<ÀM JèM9uËórmÃ…ª`çÚ‚™I榪%M³±žÀùnþÎ }ç:ˆ£€j—åb·®èê\¶ob|Ñq¡÷Áî—¾C?—D›GŽx/ʵÚ² móAÔrƒÏo6çÃkSô>µ'Í?Î[¶ŠÊfDîK;^^³]£,˜³÷˜ þǦ<ûÜSQÓÊ2¼Ôy„oz¶œÞF[¥ö1áPñ¢2…‰ÇœmiEqtðĸ!“{öÓõ<ßÄÔ×ÝþGÖª6ìÞôðñ­‹v¬§íú{Ôtñç%¹o¶Žö„jíÅMí ôÞ1ÓûÁÀ–s‡µî~qß,õo¡Ö]øÇØÊH×Qe`«ã= ­û'hPs¥¦Ö…¹ ^”§zX\ÍRçï%O]Qssºq{A;üêdUI +w°gå)o7bõX¥•-•œV/·šqgæØ“×Ágøæƒ×Âø å» €ÛëF+&üîvMh󜯌vüzÆKª”¾IíM™¯ÌÒë:çe5u•.p(×1<¶žùÔð%÷«ÓÆÆÍVóð5’è;kUûöëÎWÃbì5œ-±÷ùѸŽ|›÷s -WQ©QãÒº1Ýþº°ÒÁ¾£;/eEX`¾ëãZ*.ymS7Ôn]–x˜+tjT4Ö÷\¬,¶ÿ$F„—Få+Ún'oY5,­k8±Ûnç*»¸knAó¬…;7ÿâòxY¦¬âëuþçùù™1çBx}s¾w_\¤" äœ“CEâꃩ÷Ä=aÙÏ~øzÏ6xtɓس¦Â‚ƒªÞ3>åÅ’á+¢[­{hµ]ê¦êÒ‚=Ò¹5Nëß u8Ü~ExÍÁow{q;ocÛ8uñòu©å.ßêSŠ8ÁÝÆG¡-«³ ôH l¿¦·Ñ©-€™—'* 캱kD•ÜÐq½,ïW4ZÖ@h«Ú?‡Çòo›…/Ø̺ÿÑÕøÏ¿K©æŒ]·$]ëùr4r'ÿ¥%‰EO*bȉ•Ý¼y– O³"çWQkûÙÿá¢ü¿ÀÿD…–㦑ãi”ý’¸endstream +xÚíRiTSבª¡¬2©¤j=,ŒiF !¡€ˆ‹2soÈ-7÷âå’2ˆ8PIU–E,ºd¥Âª"P”ZbZÀ‰´Šð€åó!U«"àô.XWWéÏ÷~½õÎùsö·¿³÷w¾³.¡a, „o€e8F²xlž(rPg.—Æ`°’Dp,PIÂbÀ‰<Á* +ø€+ <Ä!ðT$kHàÀœ$ D ˆJ‰…’ÔÀZª†J‰‚0\…À¤ $( +ÖMÞHëà4˜H‡!6Ç¢"Á8ÁhœIMrLá[Ò¥¾K¥ÃD% +¸MÉdJ$„c¨@°šÆYƒSÝ`JËCÖôâ2Š®Qj'ËO9õ·¼R‹ †?¸6UGÂPàL`Ó©Qð[q +BtÚéY9©D•KFaÀâ­`sW¼Å‘4¢‡¡P„Ti€Z‰¦ÁS8ŒAÓ•PþMéàHýc$±2÷?¾v*ªD02Ü +îŸì©˜÷gL™D zÇes¹<ŠHíw§„iͤ˜ +‡,ðž@IJ"*€L@0ÖXO)æ°1œ¤®Ê™l Æ Úä¿zr…ÓÒ&Ñ·p’'groûûÓüýq}&˃X|ÕŠ»Â Üì¿#0d£–×Kèá%˜BU:‚€1rj¨(ÛÞÅj„r†õ°Šf¾‰«¼·~¶ïôöšiUç1kfÚÂ’#[ÛÏo;UâÍîõv¸N4þô»ý6ûÏãvÅ#!ßp µ ~Z’eÊ ãlë±7Ù:1+ö‡Íz¨ŽOœq¹¬­õíÁ÷Ì‹SÝþâúìnúyëºÕ÷yÂJúHÁÌš[7_=ÉIÙÔÑg¶ùr*¦%”Y½ŽüçÝ«‚ð*Ü\}y~üþgŽ¯ÍôÖ;Ý)·mKDÆ2…ÕŸ—s¸L½º¿ƒÆ;²Ø]*Z&ž½Ðózdy °øÐÇ¥$Ú·¹)DñÛì.¦hÀ¥äýny^vqp”E¼ÔƽŒuI㯿/Ù9ói‹½Ïßé-U™.Î'fD¹{ðKwsf¶séÖ×¾0¹Ä(5_Ý#%~Á½6+mÚŸüú³šÇ Zt#×éæÑ/\Í|Ú}ñ¸v_ùÇŠX÷o›L{â¥z QÌ%ì“þÊGÿºÔb<ÀO”Äõ& ¿å~¹¶áBU cmþÌS“LVµ¤i6Þ3à?ßÅ×q¡÷\;Iü`8Ðì2_ìÖ>ÐœËrLŒ/:.ö<ØýÒ{èçâSãÈÏE9ÖC[¤ìb?_žéõ›ÕùÚ$C§WíIÓó–íƒÂ³Xk÷¥¯ ©Ù®5<ÍÙ{LTÿˆgUžuéuQêÜB6=[Îlc¬¿Rû˜´+ }Q™Ä&büζ´b6xb<3öÓõïøä×ݾGÖªÎܽéáã[+íXOÛô÷ ˆè©ÒÏ‹sÞlí ÒÙØK›ÚãÌؽc%w~ìCD[β׹úD³Ô·…^wác+ײøöêðL.ã^`Ù?Á€š+µµN Èið²¿2ÙÍìlR8~/ꌙšSÛe$ãð«“UÅ‘œœÁž•§<]ÈÕc•b,l©ü4ºÜbÆ™cOŠŸ›^ 6”ï‚ünW„ÆŽVLøÜíšÐå:^)èøõŒ‡B­x¶7i¾:àÑÔUºÀ®\ÀrÛzæÓÌ/ù_66n¶˜G¬‘‡BßYjÚ·_w¼i«åm‰éùÏFwäY½Ÿ]°ŠN߈—Öé÷×—öÝy)#âÃ|Ó]·HçRiñk˘Ⱥ¡v˲øÃ|±C£ª±Þ¸çbe‘í'‘hQž§j»¸eÕ°¢®áÄn›¼Cš¬¢®¹ùͳîÜü‹Óãeéa_Çúžæ¥Gž“ úüæ|ﺸPCB‰Ù'‡ +¥Õ“ïI{‚³žûýðôžuàè’'QgK +ò_ jzÏx•ɇ¯tJnµîaÔv¡MÕ¥ù{skÖ¿dw¸ýŠøšÏîö¢vÁƶqú2òåë¸S˾5$ò»‚ZVg@Ø‘<ÐvMo£C›;7WRêßuc׈&±¡ãzYî¯XDX}¢­jÿ^D.Ç·m±Xd5ëþGWc>ÿ.©Z80vAÚ’p­çËѵ;…/Í fB!KI®ìÌ3oxšz8¯Š^ÛÏýíÿþ' +¨PXI¸VI¤Ðþ 憒±endstream endobj -1163 0 obj << +976 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1779 0 R +/Encoding 1958 0 R /FirstChar 60 /LastChar 62 -/Widths 1783 0 R -/BaseFont /EUEUQC+CMMI10 -/FontDescriptor 1161 0 R +/Widths 1962 0 R +/BaseFont /EBYAZF+CMMI10 +/FontDescriptor 974 0 R >> endobj -1161 0 obj << +974 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /EUEUQC+CMMI10 +/FontName /EBYAZF+CMMI10 /ItalicAngle -14 /StemV 72 /XHeight 431 /FontBBox [-32 -250 1048 750] /Flags 4 /CharSet (/less/greater) -/FontFile 1162 0 R +/FontFile 975 0 R >> endobj -1783 0 obj +1962 0 obj [778 0 778 ] endobj -1784 0 obj << +1963 0 obj << /Type /Encoding /Differences [ 0 /minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/arrowright/arrowup/arrowdown/arrowboth/arrownortheast/arrowsoutheast/similarequal/arrowdblleft/arrowdblright/arrowdblup/arrowdbldown/arrowdblboth/arrownorthwest/arrowsouthwest/proportional/prime/infinity/element/owner/triangle/triangleinv/negationslash/mapsto/universal/existential/logicalnot/emptyset/Rfractur/Ifractur/latticetop/perpendicular/aleph/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/union/intersection/unionmulti/logicaland/logicalor/turnstileleft/turnstileright/floorleft/floorright/ceilingleft/ceilingright/braceleft/braceright/angbracketleft/angbracketright/bar/bardbl/arrowbothv/arrowdblbothv/backslash/wreathproduct/radical/coproduct/nabla/integral/unionsq/intersectionsq/subsetsqequal/supersetsqequal/section/dagger/daggerdbl/paragraph/club/diamond/heart/spade/arrowleft 129/.notdef 161/minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus 171/.notdef 173/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/spade 197/.notdef] >> endobj -1078 0 obj << +968 0 obj << /Length1 795 /Length2 667 /Length3 532 @@ -6889,323 +7866,332 @@ endobj stream xÚSU ÖuLÉOJuËÏ+Ñ5Ô3´Rpö Ž44P0Ô3àRUu.JM,ÉÌÏsI,IµR0´´4Tp,MW04U00·22°25çRUpÎ/¨,ÊLÏ(QÐpÖ)2WpÌM-ÊLNÌSðM,ÉHÍš‘œ˜£œŸœ™ZR©§à˜“£ÒQ¬”ZœZT–š¢Çeh¨’™\¢”šž™Ç¥r‘g^Z¾‚9D8¥´&U–ZT t”‚Бš @'¦äçåT*¤¤¦qéûåíJº„ŽB7Ü­4'Ç/1d<8”0äs3s*¡*òs JKR‹|óSR‹òЕ†§B盚’Yš‹.ëY’˜“™ì˜—ž“ª kh¢g`l -‘È,vˬHM È,IÎPHKÌ)N‹§æ¥ ;|`‡è{8;úzùkCã,˜™WRYª`€P æ"øÀP*ʬPˆ6Ð300*B+Í2×¼äü”̼t#S3…Ä¢¢ÄJ.` +‘È,vˬHM È,IÎPHKÌ)N‹§æ¥ ;|`‡è»„…¹kCã,˜™WRYª`€P æ"øÀP*ʬPˆ6Ð300*B+Í2×¼äü”̼t#S3…Ä¢¢ÄJ.` òLª 2óRR+R+€.Ö×ËË/jQM­BZ~(ZÉI? ´©% qˆЩúI‰ÉÙÅ9‰Å`aLÿ99åWTëY*èZší344S077­EUš—YXšêé¢`j```añpriQQj^ 8aÃÆOˆwjjEj2×ÍkùÉÖ-YÓ·µ­¬s]|a«>çÏk_Þd?±£nvfJm°é¼@Åô’%¯>ÚÚwX<û¢„W²õTá¢-’½~=q_ ¯ÙÚµ`YÄ„Óýz7‚Å+›»¦ñþÓVåy¸0lÆœÖGÒVû‹ÏêTÖ¹ùE¹þϼ”NQ‹÷}¿w[H+h’–’”ùÍìwÅÄ+ï>¿,ÿiGýôã¶ÉïÎÞòñ /vëR¿˜fÇô%ñۮش²‹µŸ9¼òâQ¹DÊÿžýÑod;”ÚU? ^Vñµ«Nºúú©vñK¯{~­ñçäÚ/ëtôî…Ã-Çé÷7¸ï“õ‘9ñØ8ã·Ô m¿i"é÷Œ™6=Û!y:ëIèÆõ†íÿ_°K-­û±,1{Îö)².oª —ï¶ý*Þ[«ç½mFäû%»s_Û-j(lå¦sÿÏùœ~gغŒ|K·~›¶#£ïµ¾øÓ·&g®]p_ò¸!—GrnM`ìv®^ÿD·l½ŸÞë>Z`æ,ø&Á¦ûüãÈÝ7ƒ×ÆÛÎìÉ{Ø·úìeYÓã/ï-àpìòçpý3ËLXcµ:säɘ٧OËÍÛýyÍ1÷#ýu¬Óä”,™™ÿ¦U)MùÊPÅãPQÆÆSÝÚüµÂó—ÊÖi’Þ‰÷_µ]7`tçžlx~FóqéFÉDZIî8´>÷ö±ßùîÌéè»Æy§éjå&/Ÿž“ÿEí…Zþ [%ÿI¾óZÒ¼«×ÎÙØ/Ÿçy-¶ÇÉ—#ߘU)Ð)õÜïçãw¿px»Çkû>WÏõ÷§ë-˜Tµ2~U]Ùg¯«‡ßÍX­÷³òZà‰jEO-Z˜_ØȬ¼±ÊèÆ?ÖŒ›J -vMOýÜ7J§]8áîf°øþí’»vÁ_¸¹‹üÖ„7xÄh›t*ÉÌ€BÀ5jÀ°0 9'5±¨$?7±(› †-«žendstream +vMOýÜ7J§]8áîf°øþí’»vÁ_¸¹‹üÖ„7xÄh›t*ÉÌ€BÀ5jÀ°0 9'5±¨$?7±(› eì«Äendstream endobj -1079 0 obj << +969 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1784 0 R +/Encoding 1963 0 R /FirstChar 15 /LastChar 110 -/Widths 1785 0 R -/BaseFont /HCAMJO+CMSY10 -/FontDescriptor 1077 0 R +/Widths 1964 0 R +/BaseFont /EPVVDS+CMSY10 +/FontDescriptor 967 0 R >> endobj -1077 0 obj << +967 0 obj << /Ascent 750 /CapHeight 683 /Descent -194 -/FontName /HCAMJO+CMSY10 +/FontName /EPVVDS+CMSY10 /ItalicAngle -14 /StemV 85 /XHeight 431 /FontBBox [-29 -960 1116 775] /Flags 4 /CharSet (/bullet/backslash) -/FontFile 1078 0 R +/FontFile 968 0 R >> endobj -1785 0 obj +1964 0 obj [500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 ] endobj -955 0 obj << -/Length1 1351 -/Length2 8100 +964 0 obj << +/Length1 1430 +/Length2 8484 /Length3 532 -/Length 8939 +/Length 9360 /Filter /FlateDecode >> stream -xÚí”UXܶ®)îNqH‘Bqww+Þ÷@ 8ÅŠ‡Š»wwww/V )®;ÿ¿öZ¬½öå9Wç9ÉMÞ1Æœß7Æœ3ô¯ÔµX%- f@9ˆ½3+'§@ú­– -'€“ž^ -4uAìeLBNAAN€¤‹€ –çâá₤!P•µ3€QúÍ_EüI; dnjxkêl ´ƒían -hAÌA@g6€$ Ðük…@脺-ØÐ99 sg€Ð -dÎþ—#E{K€ÿa ‡¦\P'˜)#ÌäÌ¢Äì°Z¢³«B`Z@˜“ÿ¦þss90XÕÔî¯íÿžÒÿÊ›ÚÀÿ]±spqBo!@¨ý–~þÃÜ[ ÈÅî?³ŠÎ¦`¹¤½`dãáûGä$rZ¨ƒœÍ­–¦`'àßq ½Å ïoìzŠ -*ï˜ÿûTÿNª›‚ìµ=€Žçê¿™ó™a3‚‚Üúlœ°BØ÷Ÿ¿ ÿCLÖÞb²‡] ^>€)jê»0â|ä€ì-€î ;Ì1;›=ĶŒ7ÀEÿëP¹ùì0ØúWü!A»£ 6½¿‡ôÏ0l ì°Äâ9$`÷B!ÏØRˆ=ð_ÌË`wv{ÎórÂØ -ü· -.»%ÄåY—¹þ[€Ý 6Œ1/Œ®@ûçÌðxåå°ÛƒþÍl‘ä3ÁH=¬Xú™`=É<¬!Ù?¬¹g‚5#ÿL°Fž Ö…â3ÁôTž ¦÷ö™`zªÏÓSû ÀôÔŸ ¦ ùL0­g‚ Iû™`ݾ{&˜Þ‡g‚éé<LO÷_Ä »bìÏCã„ÝYvûCXòoø×AüšüÇ üï× %qÿÈÊÇ`å‚] NN.n?/‡÷ÿ,|grt*ÊÀn ¿ ÀßQs(hïü÷Ÿì¥ý“-A°· ºÍÑç æÂ6‰uŸ‹|ds&¾#½q¢H*i ªIf;\ÆŸÖk©Îð‚ðl@Ÿ Gʥ얼¤u’^ýµØƒðú±ßd%k¡›ÁdôuáØ¥…î-Ro;Ô3/Ñ^¬»¶!•«ìsòg“…!ÍÏ=üñ±õÝXÄøfA»“€n˜Ñ¬|ÿsýËðí/yHd1o€Ø ù‚àq‘´kuÊv+I0<ã-Âl’è=ÇwËÍQtÎ[êE¯ogÐèVâègFdþÜ$¥ƒ;¬¬xG­õJb¤P—ûÃkÈîÙ)^%ᶞSšy0ª^ÂÕ%ºµ„ñðxq¸‹h–çã´‰ñŠ1mi×ê¸ÙÐô»ögÖlÞHw-uC¿¶KxZQãn; _KŠ«y?îJ7 ·†7n)µŒû¢¯‡çÁ™a~B+‹P=ë\;êu9­n®ƒ ‰ -»kã70[=e— a¦á¸9#pôÒ)X¬ yBlOPJW 9èô7j].ÖÎíS 7XÃÓ­ØI X.M˜hªäW½ÔœÄÄÛÕFN`*g•-À¸B&”ÿAµÕÝN».Ø5Y­/5ª™ØÖf;¨æ•Ö·KÕç£f}ÿ¸ˆ¬<½]KæX9å•»ó=ÒÏow©–ï÷µ—DPFoe<]Y€y¥ùm@bë“ Ããºw•w·aè…‘´a¦i²AHy¿phöº‘«—¾–mÿKÏ@tL®ÖYow“½±>%wCþ° Swøó& ΙK%iÝ}Ú]î-R?ƒ­±³«Gæ!^sb%ó[‘²ð©ëÞئhýñí‘—|méx¤<Ü…§ñdM¼IBÊE¿"?²y¦¼ë•âê|-²ó"—¶Xùø‡EÛÞ'ìAþÀú2ß7Ç‹ôò›B,îÙ{hw³ îêJ2'Ñïó¤–7 Sw½‘éÖ›ÅA‘Ýš[Xœý%s½ÞÌu÷Ä=%aÝrl¶nðåñ(ßëo9r\©úD¦þXUë}’Hì8!+§qE~„ÆæÿriQCg²è³~)ÿgLS 7Fá&±L&šR/#¦~—Ž7©ögÛÑöª.yóJôV…×oÌY0ñažÎŒ_À•§ó."Ó_nðÒòÕÂCaÐZVä5ŧUZ$ -Êy¹Ù½EL™)#Š¸Ñ°2Y~ؼ|æËÎg!|ÚzˆÁÓBÙ£_Ÿà¼Ä4}î,s.Ž9eZôKâÓšWò8˜0«¬>}`GA®q¿ÁVD‡ŸÓ5>¤›í¹ÊͤrÞ •;7îãêžµ[ݽ²?Ë;(–s‘XDp0æ;» ×›ò>³ œ Ÿ•ž¦_G“QÄÁïï˜95Ý´‚¤»0Tlñþ¥§•ób¡¨d–6®g\ƒŒQ5íŠG=ˆÚVƒ–w:IÖÙIÄÚ{ÉYû—Iñ*‘è(³í'ž\—•{ÅH•šxD;AÇáÌQ¤vWéaàE;¯ß V„ó±iŒzA±Ð`RE--Rsj=ýî8èY‚4y®&r´êÑO\û¦mz„ö©$Iñ¤ ÎWïÂ(qÆTQ¼üQYHBðÜEã -P Ô53 !TCñ[Çñ~‹˜º¨®,ʦ”/‡œ,ƒ~^}¯ï˜œQzì)3ŠåajM»ãÏÔ¿,S°¸ÔáÈB#ÓòUÅš³H‡=GƒK¿ŽI‹íSÙ&!¦«éŠØ8Ã=–;‚“ãA#$‹Ž«p¥jÚ °Ê~0.R¨Û$™ ·_ð4fTŠú ÚKÕZ^D-1ÒÄÚ¬·¼œg¶<ô•OBµ2g4¼7=8'VÓ‡²’‡©:A÷G^ûNU5Iík%ö¡K‘uYyB¯Ó ECHê|ÁÔGš\7ÌÜ”›GßÅóì¢Òœd‰dõøÐ]ÖU…Nû&nê5¡,1D -óä?:-qžRœÚŽuÕËgOwfÀGû2[Ì#4v.ØôÞÚÔšßÔ¨~F~çc]è”·'p/?áˆMv’,_úwQ”=:\<ÚY“.üQ™åâÍ“[‚ö˜vd£ZÀÄ Q•ú¹ô?ÌO.uŽ_Ä¢d nšªL¦4O­—J0ÔI˜|sgx~Mí®h'\ÍæH×#q¶&ð³ñÙ˺‘àƒ×Ìý ê·nÙI˜ÃÅJ3¸Üè'Æ^¬{’åiäo¥Ôe¼°6§¯Í÷çB[óÏcÎsúÍ¢”ˆ>^¨u†æXó{p£‘\Z·…Kì­ámÔÄò$¥JZßF˜ö‹èd-‡gâS?86ͦ#/ýú^)9*Ü"r²ÂF ,—^5K´š|ßÖñî‹åAX*`¨ö$\ÌÞ›l¯ªå Âhb¥ŽÁ¥‘ÚÚEèÕâgûî€ý:È»Œå~¶ãg)ˆèXªY‚rqà ó>¨‰tØÕÀQ ÞÁ¯¨ãs±“@ðwžºàª¬«‚a‘*ÈøC_ñ‹ˆš&óÁü ü\µÛš™À7˜ï†ûMgéÞ”–Yãõ™I\Ùî‡ëûj9åª&M]@¡W•X²a¨XÔWŸ§.JtZ´Yä#S¢/rú±Ém+¢U‘ b–(4VrÑåT.‡™á<§¯V$Ýíu2´#§ÚjÜ®ÄiI÷o¨DˆI5‡î¨[;‹¦Êƒç$êÃ3–ÞáéèaÅ=,!We -®O[ʸzt­ h$ÒPúƒR8¥GLfRÊ:ÄÉ^3,†Ò)Œ)Ï9í®ëp¥çñÝ!b½Ó»3€úf"áºÙ× -ràTÕÌe™22aŸõ9 òZK¢/GM61œÏDÝò¤Ÿoþ¢?qî^¶$çS¤2mYžd¡5‘e ÃŽR×ÏÑÆC÷º!@îÓ3t£¥Im r:öÇÏVá „J‘†yQ€CpÔRÙΈöY*ègÓy-¶EÜ Œ5Ž³â}ýËÄ3&xÔ,•5ødo›Qj‘ë´G_™”1¿c1%@ži»Xæzw‹…†”„ܼ­˜ÓMb²|Þ·N›òƒ)øF,¼š(ðúÈñó” ÃŽúeçö¯ŠáÚÚ¼1d¥i'›—ç*oÈiª1'{£÷‘–’UéXIàO˜œ´OÇIY,BÝ>û¶-°èüÄðò£û€·E+ˆŽTˆLÞÈ%˜,¹èß[µƒã®N—´"Ñ+¼bÃoïï‚”ÑØP?®s`æ€ï"éê‘謪/îD9ªLò-ùø•^étÞËÆP¾ºw•É»®˜@¿µ§C'gùxœH À4n[x)_t³Üx -ÒV“ŠÌpãf+UƸá ï ôM¸Îxù‰Éï0—-©d–¢²l°gp¤d×Ô®Òhï{}ïFÇŽfKªË¬8/ø4~Žõ¨Õ]åÂiR¨YVMö² -5iÛ¶ÚÍiÇ‹ëÆC/©N!û1KɃ.§ù¥Ô= öÔµ¤z -)J^cúîŤZ=}3…‚s7K‰…RËÍø‘7Vý‡/hÔÚ!2ó àgd5BúQ±‹‘‰ÚÐWá³ÕN„±ÓäðµÑ ,ªÚ¹wêBsà[î‚è3u·»ï² àiw<´õ÷Ù4; )hѯ(ÉÔw¸ø4KbþÏ1šDúÕvŸ3ò)¥ü .èM—oå”úNÞ·¾Õïmû•zRú™šú­lüà 櫘„,×Eÿú§^ù«Ðº¢U¿«3-Ó‘C¤Äiº|æÕ^3v´R¢Õ—N’KûíT¸“~t¬‡…›7œ㑘-&oÊç0ôl/9:=ƒ2|—ד©.ÍhŸÉZ®X®ôè8—F4bÑwâÒÒ« µÚ¿JÁ}’uiþ¦7® -gsy¯°ºº\¨tÉ‹woí4ˆ2U2vLxÇ‚J ôaÌNft*ÛÓ¾á³ÆøEá²€Ô}fŠO«5ÌØZ™ÙûøK¯$¢z:—Šð`U„PLn*-ÁŠìíþLìQbjúCuÁöÞ<×;ÜtÅœdì÷j|Ÿâüútã0>;SuÚ±dæx~5Ë]ÆgÚÍîë~=«?H–M*]{Æ5¦’ØA­‹zÕ2|·=hg¡çIÙœ•,A‘¦uíÓYxLT³àð $Q.TØ45RWif%‰º¿º•è01i"þ#žÙ~\ Óšýˆ9:5 uTx|«¡á)Ï`ú${z±_RAŒ8¢iLtÊÌ|7K»Hí’ë±±©÷Í*FWSn™‚Š…ÄR Ùù<†h±ó£9Ý6ÿrïÃ9þSy'‡‘XoY~”Ë ëÙjeUQÔYwÚ³*Á5þd“²B€»CqUhG}n7: ž, L¤bXærê’}J÷ ³_„Á:{ï6,ü:Q?t -7~àhæWÝ­‘—%¿h‡5Oèm^µjÀ0Å¿qìãÖÎm& eFëm9‰]×o–WÍåÊy$é:Ÿ1Ó„f•ï[œyÝÍ(H/ ^‚–»ì¨Dø>߀s"ÁËpxËêÕÝÝbP“ºY»Ì¢ü6ý68Yr‡Ù¾îí>´hní¬¬3~ðz·Žsø˜€„¼HÝ«ÆŸ×;§Gíº!>Lºzù»C&´=ßκŒP] nisÓDuß¹zœÅ »Ãò]#µ·VÀeßpC"Ìjwº*Â|RüZ9õ¹d†vÅ× `ÅEs},å«bZ"îùŠ˜t¹™ zƒ'R 7|àŽíÊÀ0¹6Ïo’5Sý` BØAì‹Jýí _ØgÎXƒ,DŠæêù -³%å¹vËôktv¼/|~O>z>ðþ^×ÛÃ"Dh|x•¯¼PŸü©ØOSòÞâɆR†Ê£çL‚K:åܯq¿—ÖNP•‘1téúü8¸ÍÏW¦ŠU|®’Š%•Ì/t»ªÖ‘é3¶fë=ýÙÈ Y¶$Žx²}ºSÊ5½+R60î æ}ÞË÷Î(eŸ˜¸L¡£ØQÒÓ Î¶Î:%.û\ž:¾¨¿ õâÀ r62ÃàǾØH`›J¿;OÐ{Žè‰ÇIó×#Í/³h„×ò]öìBnÓNBÛZe5¤}­¡[cºø)Gmî•à¢¤¢šÆ‚P~©Q ‡ìûôÁGzÿqÍÏ«ðOvó…#³ž¬Òõou4?¢`%ü4{_Œ#; QD,ÖŒ{Â)Û¹¥¸{ýk¨®#Çõ7ͱ‰-ñZ6Ÿa–… -ä…ÿ‡"ˆ²`mêÍ\§ÿ;D/ÿzÊE——DÚĸX\`ŠYàÝ] -¾/Ò•ôNŽo¬Y*}µxð^¾õ>.œã§3œê.ÍÉ„“€~ÕÀv~奔[¯$ÖºFùSŒ: ÿÚ7íÒ©½×•³  Ú"‹VŸ)é;I ÖFÂDVæDt†e¸zBªH¹˜0SD³îXŒdN„Ц#sy÷Ü&SÓ'ÕçÎfQèÙš¼ÏÛÔšYÃI™qfù—î”~ð—žðÉ}pááG%ºJj¢CSI£YC;¢ÍL½$ÊÐ1~Aœq>Ó1\—wœ’¦X…ä¼c­ð²¬Ó›ÚVÕ®EÛ/ü!VB‹ˆ;oO²‰Sõ¿Ž&Oµýté–a7ª²sÔ­á³õ%i\_.YIR$*eF'ÐbDeÐVã¿&k¥%yÏÏqªÈ’z"'Dù´5]ÁöPÈ:Å^f"ú°}ûÂî=£¾Ké_ZBOêT\LzèŠ(¼‘Ä̆yÔÀONº0ÛóÎ,¡R¸sª0ª–xLžzßØ‚Fu’¤hcPg›).|?b2 Ç´Ùþ’ÔKc@bFËœQa€›l˜¶"6`-0}w¤xP¨jòm[XANì|Ž¿‰€q[lŒ)nÒòëÞ/ ~ñ2Ëü$rPÅÂdNA|7d™†ÈM"ãLc7MDB«äÀöØ÷¶OÐÒsG"ÛŒ¹äšhîó/TÒ”èx2Y›±Êá>¹ÞîHʥơŒûѹ'Ò‘Z:. žâ^ðÙ]ð Î$—nT”?ê º¢ä§¢] …3´¦»D"Zv½æ~ËCàöçrµç;MºÅW›ˆ>x÷]8öP|ÏÕ~¥õƒ¸‹>wZ,Á¹Q³ëæjçwêýͺf0N1s[*k5íiÉ–ùèP.ϯ1c· -“õª´Ÿ>¢*°BÁhüOQªT -¾½.øv^¼¼£ï{Ê»üýøq*1šœ*¿§¹Ö`ÆÅ]¼OïxÄ%Ek¦§ðÓP³=´àO*—,Àòê‚#å=àî- ^šÎð°ªUñ]¹O -ª&GgócsCFñÕÂn\Á¨{ãÕÂR¡°6Ñ‚8EKëcîå:N»Ë |ÀKå+˜ø*¿oáŒuùÖb .ßL‚÷iA,a²Új»£w#*ð)L}$3:F­ZþÓ‡/w:‘jf#ü* -ñØ'®˜´|sl?ü”[MÒß*€*þFž$ä]\å"y/| -$oD˜™ß t«=.]Gû5[+b&Š[冱`Æ+ãäJQÊÙùª›Ü¥öh#f>(M¬>ôb÷56[»¨+üæ1¿C{Ou½—­°…ù%6Î-®”Ø„ÛÿxVñàçPœjåÌÎc£ñ.’Û\#ß+ŸPcl‡ÆMÖ áÇÇ9bDìö|ÐjùÃá>‚5%ÝN¬M J6„—[Jìÿå.[qKrYÈ"+ÛeÙ6ïî’ìâ|ýŽœR÷Ñ$3™ª1Hø‹Pýõè+¬XFµ­]rÒ¨åckå¨q‡"õ“„£Ìü9º¸iõ éµ¶fO -!é™e”Àäoî»ËqºäZTßuÝRÞã5ºRw*ÕÞ™ýªQŽPDž]£gWVÖ¬™¦ÇS8û¡JÎbÇ¡tm6:3šl§óëë—uÆ‚ܺ­¥­=t¾P«)±IÓäi?ôè¬r;%¾u¼ØKvUb09žQÃUW¾Ôá@Téá-%>IÖÔ=sh¬–È!²¢š¥if‹ Õrß^›6GQ娡(ªJP©~¿$WÀÛàÉ‘ÅŠcÜ Ÿ Ï!íÿ*>Ç -[ ªÖÑJ@ò¯q Æ••Ó•îš^c6£¬,èÐÒÑas²>¤ŠVùúVO`"´YbvüÔé,×®ÄVÈš¡™®wðaùò]&}¬Á×­ü:•Æ=ÚÕˆñ­÷}Âò]lgZj•=›ö=ïï,E8öRvøîá+rst& –!iÃÕ£&ÂÒÝwð4ò÷›Þ»å¹{ø‹S++—<ÜŒ{•¬†Òy›G¨?SŸnò< Ç–šÁMÖY–IÎêæÑÖõM\ ¬ª¹H¹|fÓU8¸Ìé(›ÍðÑÚKŠBÁf·ðø ÊÅûo?o˜±nq¾Ö¦!Á‡‹{Ö~°»)ÿèoy‘’ê?•¨Î/™Ãð~ý3"4Ì4jƒõ PžUfñÞ§,'Èxl†žZÅsH#È´Ü@Å™•¼•R‚lé׶'OEòˆšÔ°H.9çÙaW÷œN„PÔ}wãÊ]ƒqu £K‰>”‘S(Ibðvl?1eåºÝ£¥€í<»ü10_âëÒûÔéóWì]™°5q=Ǹ©;ŸcNkÓ=…“fÅ£™³cÍÁ‘Üg ÊÒœ¹[û¢«iÖIYúååµ–8óëجÿ4Ž¢õJÿ²©dAÈgÇþ}Y„€yÂÄÐÒ˜Ø꣙. ·´=‘lDÀ©;ðåäS›§Å u¬p´2ibŒNƒ³¨¾Þhã˜Ïôõµ—BL³T%«k`ÃĄ̀”L_²"äË{¾DÌ«µË)„b†ö›Ô!²J¾ÆÙíoz¿’m¦=ÅÂ]Ä—¡Ýqtõuçt'_ÊÄJa£~VÆS8æº(g(-ÔἤHÐݯ ›ÔõyÝÛiU]w«gŠñú•1¦åÔO‰ÃÊ}f(ØF3=œ]+ºjàëìõŠšìF—Äîìõ²fc. p(ò³õ 8;È?Úܧ¾¨÷HËí¦½òÕ6—†7k…@BkHÑmzÃGû–Ûý”·#pr†"6ñ¬õ•S´+œQd‘ˆ/óé¼øÊøȺ]S•vZ†ÉjVLî“æ‘fhˆ®bi8lë·E;jV§69®‘kTEqú:*EÝÎœn”%[§w_Ñ ¿ÈŸÜ‰ÇË ¸û< ñ€%^N0_dÊÕˆó:î8$ͺ^‰IYÆOˆ¡'™ÇG¾0ç©áFò!˜*èèÂ]P€W½eÍ™ñ®X~.?]ImÎ…’Š—˜j4YǶŒ[Œàö¨ ‘–ºi¥(éÄæº÷ÙO¨)ÐÁèŽ;=0âxrÀ3ä3æ`‡@`·`-ñ˜CÐþÚPnÐÖ¶Ÿ@Ø:`CGyx–îv– È†þ‘Åàp´:ZþŽÀªy€ ¿‚(ôór8œ\órÁØÒôG7€ÃìòG€6 ¬ÿ0ÌÍäò‡láÿÚÊ"‚åØ‚M¡6Ðßy|°É@öΰ÷OVKü7Áì¥þ!~˜ˆüo‚Í¡ô›`™*ÿlQªÿì”s,Óä7Á¼Lÿ!.NØfà_~à+X'þ@˜Åk‹å[ ø„éZý0'ë?&eó¬l#ì¤r@þ@˜ô„YÙý0 ‡?ð¯ÍùaN LÃù„i¸ü0 ×ßø +6¯ûßøßO—„ÔÍ“Ö0¶W°#›‡ ÈÃçý¿gjAÀöÎ y)Ø©ãää‡íî_QSgÄéïo4Ø£ûo6ÃtÈ dŠ6? 5²Ji )õ‘.˜(Cd†—°hŠU©ëœúŒ8oS<¤hϼR«{WžŽµƒ¸Cåú@æÑî¥6*sìo›:ó¸ãò~'Ý£…L÷,]Ù}ÛŽæ:p»­qúâ€þí·•áÒD½Â¾¬“þý~]™t­ÐàZznjuœTûÒ0žÐeWœÄøçËã>V¡(Í,‹§Ðvg¼»”Ü„Gc¸[S¤_„}wBÇ\8$ ðnY­çgäíÙÌÞ­Èi,mSæøDÖ¹­¿Æò #éæÚreør³µžònSjy°œLd¸;÷z@ûv¦ãq˜„­z3-åÌlå32T„å“8ø5*(½öq¼€¨b4îI]¡ÒÁ¤A­«u"¦~TëÛ&øjï+«Òúö€ØŠXÁÐ7‡~/›/’Эf 画¼ø0‰(äÇš 8²2KJÛÅ­Wö*î™wòsyyŒçìiÛýÄOwTÆÞhôæ €Ó›àØs’lë®$¹c‚ýpᢹ#ÂcÉÔ.ãæÅìBÇÏmã¾F†®T‹ìŒ¬¾mTKÃÆ +™tB=¥v}méº +¼Z .èô(6Núë¼ïu>ׇ¼´:ÆÖþ=¶ErÉm€Ðàj¼+j »Dçõg„þyt“¬®œ´ÑÑá-4ª©È™Z>*zŸ˜³ùyrò;3j./$EUŽŒÄR9÷QŒ| ôæú‚‘lgŒHÌã9CÚÚ‚h„^ +iüoæÇÙi?H áË$”è)O€Y”¿PõŽÇ÷bIýê¸~ŽƒKÒ®¡cpÆÀµ{mïÎSi¯ß#üŽÏ½)hðÌΨÚÖä•6} +÷ø¤6à]¯Ô *РÓßñ‰ñóÃ"î%¦õtà¯ÁÛ½ Z™× ÜSVú¯˜pœ]’{N¹¤æ~jËû[UKå{J^–7§!&œ¡ñŽZû`çV«mQã•{¬dpòj”¸ï°söÛõiƒl‘ç…#1õ 8Ù5eõî×wêî•õ–Å´ô3 _.×,ô¢É>¸Q6$7'f”£ïÖÎ7LÜ]­Z y(%vø Ïüí: kÕò…A¸·Æ+OÄ¢éÆ̵W¬>KðX$f”±VF'·íÔ(HÔ<%§¨ÚÔ™º²sX!¦xó¦kx«˜siq”}s¨P¿úÌ)¥S¦·_ÊuV+'Èe.Ô”{:¨>b—6AV9OwãˆÌšmî^(GÀuÕ@™Ïú¥S­…y¿?F „™>¦”áª{Ыøùܬ„=ñ™î$¥ª¢+^-rWOªTµ™Ý$JnGÝV»ìäØëuu¬HÖÓ÷­;WëÁœÅQZŸqºõüÚü4{~Õ‰ŸoÛšÃkgõI̓ÂZÿ)šÛ3käR_cR’Ò4ߨ’k|]7¹z0§ÅŽ®üjˆÔYlJr“|+ËYõxCVyùr°WX‹qz"›ÌÈ+\#eIbÀÿ¬–à­o‘iý>ð(xleô,ˆ7—ã8€R¿¿<ß/ÿɈ¬òKr%pþWÄõཱ—£°åª»p¯9qÜ*)¿xå·Ó†MŽÎ®µû-¢;JŠñ¤ \ceÁ~*¥äLæ£~13Jq: §;ƒ›žS¥d…Ø‹1ñÏÅCÌ–øرÒÀvÀ ‡|z¸çù-ÎŶ½<ÑÎÎbKÇÑâÄMÞÖCã bú ÄA—]Šó÷wŽ”û·Lr·.2Ø;W‹%M2_ åͭØ1HUC ¹£Ê÷IÍöXO·¿Ì‘¥e!üÔUR7¡ÈÍ”þŠÈÎ ÉCCx(åÆšŒNZwoe¸õßW¥ñˆºÄÖŽõ]¤V”„K=pèìF-ýBcTØ?—²SØh•~Ëê×G |]¢_çÔ¦¡Ñ‹êùâ 5þ•:b~vqKëa„üò+×¾jL•Rx²Ð‹óµ¤z—ó†ivÞbêîEg·¤|vùÍc;\÷Y¬ÕhKrì…ÇC);̯׋/>‘ +éR"ÛâíÉP0ôˆ5 ÝgHNÎK¾DÔô'ž'ƒöcKÉ߀Ńüî×qéè*åâ]ÓŠøŠó÷_3òèÁ^®UÈBý?¹]@ª‚™Db+úŒøÛÅùÕƒ³ZÈAwSX¡AÕ¡¸“UÒ—¦þR…øçsÅ~?3â$fP騚Jƒàª¼¦n¯AkÕƒæÕî¹×­g)EK<Šb)¼ÎQºñAüéPêïÄ_&X¢ 9”N[)&".aÍ—ë ³Qdí·‡$ÍùÀÐ+{F,™©¯H¹ü˜€ê≀MòB» elýéóÇìÁŸÍ>ß69(ŒmT?Eb3i­S†‚‰ŸW¤ÐO*£: x«ÜÑ[g7O£”¹H£Þã¢ÈñÔâ¥+Ÿ¤(÷y³9–Ô¾K,8u;í,ùb(|Ÿ'h2"ЈÚõ¬™I76'|p´¥BV^Ng11; ÆFçßs•Ž¼ãúvHe…b‘r Ú?so<á ðÈïߪ½n¬£ãêe&HÙ) „ +¿ø y’Üï@C|—ûŒdP¤lH;ßG‚›ù¾^l¸¯Âî çœeΓœ«ZÑŠÝ·v”• ïVàåÓƒÉÒBÞ7mÕßTð´&¬túúYìJÕµVï¾(‘І¯–v0’@´\k䋛ܧ? UgR¸Ò.šÌéi;Ï„òdàF]hj+wÕéî£Õ”ÜæÆ݈bS‹áQ¡º$Ï‹‰P¯ äû 0í#(w'„ï0.q`o\¯«‚ü|ÔêB «AGªL)›˜‹¿TpO½AÂ2mê“ +L¸kq±¬Ý{k3I;€]­÷ߦ+BÅÙº¹$øqcZßM¹æ ­oŠKÃݧ™E5‹¼ê: ìŒUí¡Ë7ùAÿŽ¯ØžÛ!șZöSü6„¼H耿­7¬#0?«Å…ÕîµûÑ®+ÿ¼NïÏ[l• Ô£UΗȡÝ*™BÞ$©X´ïl,ZŸIoöŽxüDG†ogÙBŸFëô9£ø‚:9š˜/c(hP9àê)—ò)íñ`}ïG i•À¬ÅBôÊ¢Ë\˜øÓp¾„Sp"“WByàœ8˜Ä)·`±:Ið3íþ¡ÛgIU%ب,±:<‰ú§!A©»KrIpe ¹=£'M¬¬„lg¸‹>G« Ï%AEúazzó}DÉì!rž3*äslòXgäAÄöÊ@“«gy=BÓ@Rj«m¼zEè 3Pu*%Ž½‘Ÿ°êØBœªÅ7û«¹\ÀòöFõËp3Ù¶G1œA%´/ù†¶Ÿ¦ünP@™î̼«ùgšoæéšž±öö$[¯/¤^’ý”óFú?¤ÖÌŒŒ $“_ÏxÏP<,õég/†qŠ]ž³ˆ¯g®XÙÔd–\ Á³3Ÿ«Íë™lD\‚kˆXG»‘6¦ÚT¨Çz)æÂ]9A»³uÝ hxQã£ÙOÏÿÒÜH1>ØjH>1TõKå/Qòy¸ýñ]DaÔé÷Ø—ž<%SÒ&þœÖ-f€«[ìÂîømuÑ(v[0›Æç©j¹aöàÜœ÷`í¸lñèFRGèOi¢@šZkqý¹|gÚèhwY£*zZgüoÖÑEäÐVV Ñ$ûwªá-)<2rè=lñ.wç+<šF³Ï°º~aQn·ûÅè¨ÁÖáÞžñ¹Åý¨ßõžž$sPa¢~ÎØz‘SÜGù+ÈáÒ0fNnëBÖ·gP&£—vo)TB?Zà¡b-¾C²cnK¦“¶EÛ=hð F²>É k=u}}ò_tï]³JkIAó•a;Óã¸u#`*ô³vvbžÜZNMnGîgñ]¥àõ/î1¢4 ÛF@3ü*4”ª¬dRØ_z/mÛ¸TÒm\ç›2¦9);¸æÿÐåKÛg4—Så™Y-uˆN}o—JÌý2ÓMÚ¸ëT•‡z-ßdžÀÿú½» cXÆ7)„jËô×O.Eûbî4&ˆüÜü͵ÅÊØ×›OÊÑfåÝQOT<„®ùÜû ‡eJ‹ —çÓ'½D¾tgÃå„ãLO†ŸÒvÃôP}$—´1ÛÇøŒF7š*H#[ˆ_@[vTr‚ûJ§{Þb®sÆLÅZRé_T*ê°òƒvq5-*κî ÒwŠ¦lih¯†ÃC‚ÛËó ¡¼Š›¦fnJRÒ¡e³mfåg¾6¢+Ù«žæ¡ð@禧·_»/ù3¹‘/ž¨¤F“s|ì–Èú­ºŸÙ¼ +™]‘á‘ýËɵWo³î_¥t'>”þ2œ#±n€dzsFKKDNû…Xçâ7bÀŸG!Õ³P{ª7»QLGáEšÝfÒ;EÉõ&cœÙ—¾‡e_Íg;.~56QMÜ!ÿ¢J}öýÐF[Œ?uâá©7—GðrË<ºÇ:B@z¦á4¾˜U~Ç=´î_ –ÁË_§Ú× ñzä=]G1õ¸Ôotvð颶Ñì©…WÄ'tØ*K×ð(o¢_MN‹ŠŠ¨1bÈ^£Íò‰Ù4+>c×BlÚ^3ÈÅpg=­©Yp¡¶ûF¹mÓÁÿ|Im蕪Ȗ‡³ðñ9ÍÃûðüÞöâjÅ*ìÞ¦RL//¦íÑÚþ +­Y÷8žÚalE•ï nU>F—øio¦Xˆ¢Œ(©–h…XÝ”OËÆ¥ +—OÎÏO?™ßÛë¼LNAíþÀ­ŠN 2Aux×7òÑfHÊŽ†.·§÷¨$`ßñ.®Jã{'ú…9ž¿IÂÓÜCôdɪðwor˧ƒ‘¦þã[ ’›ð gÕ™ìÏ.hGíYû·G®“Ýái¨É6%ƒvƒbsÞñG‡›k2gH’UÁ!sÞ/_•5má¬ÁˆR‹ýÀ¡í3(£ïá³>EÂ$önËFµ×ªl ¹ \í…Ëýàây¤—5¼Ý¦I¦Ö8ÃjÌáú±Ï”÷)2k +”ûùvI<9Ìq‰ñÞ²åðΩTŸ­¼NwÕÓ*تzŒµ&UlÅ¢z»"&£1½æ2Ò}¥5(Å7i‹¯)ŒýÅh_(6Émw§ÂÖ¨íªýIñ9fLT¢/R3GÇZ×ÏËõ· +q¿MµÀ|L >c…;,q[á–|—ç¹uC‚|ÙÌÓàö¶ËÚzBja7˺[ˆB¥õ¦bÈðJ‚yîyN/t”Ñ”Öë–_szo¼í­jâëš&Ÿ£‹Oï8_. øÅ +ƒ[ Ö…òš‘­ÊžãLˆ®g͉‡XJ‰áÞ©²õD r +u i*ª Û ±Ó•`èš16ÐJÞsµ•¨œE§Àc»dváM>ç •6#éÄé4U¹ƒ\Ý>~¯ ø’V U|+P§nõçŠè+²ÿñLRõ̦ۢ$"F}‚!£ñزîâûÜ…W±Î„¤¹ýÀý¨Í©Š-]š 2û/½¿öxO¨5,Î#R`Lí¢(£ÏÒª¹c¾¥¥çÀ —ËÖu +0W‘ üñ4¨N$Œ(sÀšŽ:‡þ¬SÖê¸F¾ažILW5×psdéì,tQÓŽB÷êÛËër»øNåWÙÛ‰±ê¹=ÏeÛák>b‚åíh8 èÖ—oʪŒª¾Ô˜g¼¦46ý"Þß4Ñ >Lõuà(”ÞJP~ŒLÔb|ÍÌWŽêí¨–ä÷Ð :a­¯†Ci—¥Ñ([ÜwcÊÇ©«1ÌNqEÊÐcÀŠª= +¸2u¯1œyfïrv:®"ŠN’ú +`ø>ÀU.éÓE ^Ö¶VN¸â¡ú"ˆÎU6\aaÆÉ×6Ë­ZWBé~O¢„!bk_C74òô˜×f7£7’@¿¶SX™"R^ õS-‰ŸçŠêX\…¨S"º€Æ½ˆÅr¶2I­ŽªnƒÜ†£`µ+!V ¬öAlÒû n¢*>[ eÕ¶ó§Zx.¾–WƒBZÓD©Rõ}‹ªXæ ”‰XÏ¡¿»Ê5âÍ0AÄJôíð°ß‚™Ô5r÷ômÕ.k–xß—þ÷:~ àŸóøÞY>$ï9¾fMàôx+íò½âà?óÖ©|°Pâ‘òŒk,jzt<–WâRmüžñ‹Â|”ñA2Žèa¬4½3Ä#ö]η&éÜøöª +Wö¼G›P*ÿ¡†ÿ¼X6¢Ù‰}µD#²é ›éáGÏ`§Õ‹O8¾£wdã7RešEoæw6¶]ËGØ7≪žR áÇ3æ‹…lÆS+¾§‰hã5Ø;ÛÎL"Ô·Rlj•“Ìä6ùa„¶uðÊËR7NQ~Á驤 ¹7v‘ck`ì—+¹èðKKÊyxóHCÑìÝòl=—Nd¯·•d ê–ýS’K8”¤1fØÅùA?2ðen(ø‚ËÄž‘O)u¦gGêMSéÆåx.ŸS’°ÄdÑ©3»}ŸK~­fó¯'¾IÌ•‡ïNø6´ ɬQ]žuÎœò(“ù\Ô:@à]4î±ýóõÍ‚4!v¥\U Sþ]þx|2¯sý»Ãâ&¬ö÷´"ñBTÁkä *¤›¦ñ9Ð4³k¹=Ú¤³å˦\sÓö”R +ŒßX€É’ßeiZæãOY³>4_r7è;«}}3éá~°(±¢ÜVS”ÿ£â`«îi¯à’¥¤«¼.úzFÑ~ÃO/µý°^bšÐÁt>Ð,7:ȶ44¢/ã[²'¹Wçd¥C˜!¢<É&n6gIU”ÿ'TÏ4“ñ gZåèüpƒAé\Ci*äí’EµîÞÌNÊ%ú_RæÐè$#èÈŠ‹“‚3ø°gÑݶà ¢k !u~C©3½´ƒF¶ùÚ_ÀDÈ¡[³O`€ï«åÎ<6$YÐD¿îóéÚ&r¬qõc0’ììœõ0íko½­«îqÍÇ_27û8Ç)…K½j¼<õY¨é•m+èt5Û”4¢pÚ„ú4$cõr¡ŸØG™Ï“QR_ŠÖ]° +øé3¥jÎ1T`X­«·þ`:ùqø¾qÅ#JIH“›©÷–ß¿TQÃ=bõ²â×+ýôî׆ûîè¥Ó9Ü’¹†ozýà¦J®Y–¥§Õ„–Þûkû¨º¢!Sš9Yy¨­Óã€åäþÌG²žqÉÑŽƒê®¯³ù·§!·é‚ÃÐý³Lb£Ïw[dHÄ¥¾gÀ¦ÞŽ«ƒô•^™îNÄR¯P`ƒZµ»¤Mn_eúªeô «´ô‚ê +Âi_BÙZc7S¦S2^?™ w·˜™>, ›7<ËQÉW­A{¸3ÕZã8ÿ¤>I —Ò'Ü +Ê3 ¤¢ú! G©Õ9´®é6é:sBº¡)w°«x—‰îÏ¿Åœ¡¹Ba~ü3Œµ^—b«¾j­`,uµwªH,cØzÑØë€v::¹«ç©bÐ&„mæûÔµú.q +uÉÇuðVdQe +u7}™˜·€-H¨ýnuY>;‰ídŸÐžuþUÌðöZ€cû¯ƒ‹“(Ð…R"±87zÚ@î{cCTsòúP•WNìô}¸Â·ùp³w™®MÜ'r“VŸ­/”àØ3ä:ìž´e+e:5<.ðÔ[Bó¸Þ¼¦Ehž|ãL’£hV Bôf'[¯8± ‹V1*‚ˆÕ‹w3´òbg¨]^´.šñI`䉹†ÜØt²z¼ûœ“v„® Kôõ¦kp_ðbN™ ~ãDhõà;h ÈáÊ=Àú_¾ù^;N£îÅUxí”Ô +Øfm |…Y*ÇÌ6¸ ÄøÂU:ãí7rà­©ÿ¡Aîؽþ{OfÛžæ‚5®ÍŽçZoò{;.{ ¸cà#×å8lçíÇM4;?ëyÐè½®òÑp﹚0w•5º–÷;»æ ¹'$ï ‡B¾#8a»g}àØyQßÈø¸+±Çþ¬‚HÝ_³yµLâµÁiL/ Zé-OšÕ‹ð+Q¯òŽÇàë-åN) Ýô¢¾bì5`¡ªN¸Kܽ±b8X! D-¯›b!¸DoËv½XÜ$ý€Ò§¡q +AJ]BÕL°•âÓ(ŠÊž¥ô¡ŸÔ=œs[å“K[l>Sz-yæˆ$–;ô~2\’eÉçzkÂ)üb ›úNŒ»s¥Ý)+!iðsgæ[Ú¸Õo%IyÎ%ÝÄ,ðœHcNx$ú•r¸XCx†¼sãÓ©mçÖÞB[Xb²ŒÓ9ç-œüËQª¡”¢¨ß•¤_ª¸ñ}n F á‰éóó,²î2+ÓÖ˜Ö’¤[• ÅF°á÷ßÔRZñ ìÊå#D¼W<ÃîìÏì¿¥÷øê¦àzyÕúN¾ anâoêDƒÒt‹KºèG`*|V¹.s,žÅÉØ·ÏBŠ÷B¬Ö“A)²™ÙûU·É{+6Ž¯Ž1%1ÏÎT1ûp§§NÎ)šÔEI¡¦0){êJÖ‹eHQðŽIXæ3tH¹Ú0¿Vï|àòyvy0†ºwxwœZæœZ +C%óp©ÔѵˆÜyFMY‰%ñ ±IOŒ°5R]¿“ËRƒ€¢}¢ÃàöΗì"’—`¶8VÔqÍÓ±ÖuOž²NÏóÜìf$çPÛœÉj5ÙÃK\ª°Õ•–CêŒç:B&Ö.~×u§†fDF!û­Òt?fÚ·"I:úÈsosû|uE€Ô˜ÄO9bzX ¡å`Ö`rMćTò2S)½Ñ`U¬¼VÔ“¤"ÚzÌêTà6×Ø·dªFÈÇÜá‚ÑÍ{)D…‰œDÝIKLïSZ]Á‚G]Óžó¤ïv‰b]ï>¸ñ¡€Š¢‰¡MÂðÓ=s÷;•ÀµdÂVx»Áw¸"÷ë–Ù‘Íæ™Ùký!vJhz{¥äð(gƒ‘¤ê’™Eš‹þùÆ¡Û*×~ùå4öhsk^Ђ"ÈãùŠ‡ÎÌïÆ^Ó®Q}ÜBÃBFÌ.äÁ¸) -BŽL™(/÷ÅH²•ÁÔ—,“æo÷Ü7̾è%7‹X:u ‚iÇQµ,>”Œ|ߌ³Î…sU],X¶>¿€Î‹ÛÙësáéñ!ɵ: ˆÛ”Ôª¥Œ)"ìa\2UúbÈ«Ö2,T‘oZë±L/ +>XŠ0¶X¤ðÌÇTÃ}›h"OõÁþJ1ZZž†I¸–kšÔóŠÏæZˆND÷=Îö¼ŸœQ#¥“Îï‹ÈÍà7° Z€£¸:>S˜L&F½Ïѹì›ä©ž®·ÈL;:nÿYªÍþe9£™œøéSz¥ƒõ7¨Í¾ü sÕ! +¼¿•&>[‹ÿ²rå¼Z&€í&ïÙ@îê×=c{¯ªï +O…¿²[üŠh¸ÔU¾õ÷Á%†_k5#½»ëìÀs¨Î‹_œ|ñhý<Š¯ï º¯Æ=3ðžÍ#¢}ÿþ«Œø¢FÛV}ù){@ek©žÕ×s +©…d^¢1êgûl²öpûVøcO²Ÿêß”½?;n)t"mC^>jôûAE=\»ïWVa0i»ðÎ#Šˆö}PŸçͽ˜©|‡'U“LNu¾_ÐêK¹“9¥÷hïž²Äûš‚9x²5ÝÔW 1)o\úÍýî-Û2‡Ù¨§âvÚNŽLð?6ŠÝù]ufɉÐæ.Þ>žkk² ÷Éóîkg|ƒ,è+„wè}êߥ¹¹|“¡@%Òš÷‹ #'QXumdI9üXŽÊ­»ïYSvQM¼cÔMžÉ¹€M™I̦9ºÄð¡Ò9O»6ÀêµÉþˆëŽ­•'QýcdõOñ½ÐzV4x¬èX¨õÎûbL^ÉV¦O9ÁŠ«x5øaþ#|ŸÌu&r ‡îõhS—NÞªž®,| ùpl˜wÊÀúÝÜÄË^Y„תIË?óîX®¸çMOªX[ÿª|—ÙC…mÌöÏ£ >¦®¥fV²ÒÛ¡òÃ%šj5êñ„‰"eý#˜§;Ñó8fëßQÖ W~Ÿ0*úB1uoúÃý¿hÉ¢€}¸‚á¯MÉk4#÷dÐc“¹ŸÿÒ˜Ãø„:’˼@›ÏW³>û’:.]m·Œ“ºíÖvÁm´ŒÐÀ2SåÁÂ[–#OH#ÒÖËŸ‰àû/syŽPç0^È\ÿ†_ ó!NÎN1y‡E˜róɪFÔ¨ +VŒ¤#©æ¤[Qtè{a† +’³ÓâåÚ*§4”(Zî;ÀÐÿ™ ½!qÌÕ{ñ‚Ò1útœNó›”vID©8Ÿp^¹V—èÉ1?ÚÚƒ­–,ÊßV#U-ƒ=GëÛN¬AŸ}оJÕ‰‰Åî3UF"œ$1OáÔL”IÏFYªkøt$?ÒÍ.½%üÌò!ƒ…rI;ÚlÂà~=Ž×‹Ù©w¼,(ûÕNÄN?¢[†Ê\“c‹Mé×Ù¯g&àïï²iµ‡{¶Yîµ¾ŽDLàï°2W¾N—Vàè²¢ +GE >Uíq 'ÊÝ¥ª›?:–V·kÈiÚ¥5Eké_£î±¨]‡ªX ¬+ØU|u‘”“tpÀÅ»u.Ì ¼uÏÁ³Q,ßhœL*‹d` Íoj´²N/º ^Í8~x ÷g”¬¯–±b1aóÿð…öÿ ü?QÀÔtp‚Ú¬ÑþéL¶öendstream endobj -956 0 obj << +965 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1781 0 R -/FirstChar 36 -/LastChar 116 -/Widths 1786 0 R -/BaseFont /QZIHLU+CMSL10 -/FontDescriptor 954 0 R +/Encoding 1960 0 R +/FirstChar 38 +/LastChar 121 +/Widths 1965 0 R +/BaseFont /OGTSKT+CMBX10 +/FontDescriptor 963 0 R >> endobj -954 0 obj << +963 0 obj << /Ascent 694 -/CapHeight 683 +/CapHeight 686 /Descent -194 -/FontName /QZIHLU+CMSL10 -/ItalicAngle -9 -/StemV 79 -/XHeight 431 -/FontBBox [-62 -250 1123 750] +/FontName /OGTSKT+CMBX10 +/ItalicAngle 0 +/StemV 114 +/XHeight 444 +/FontBBox [-301 -250 1164 946] /Flags 4 -/CharSet (/dollar/quoteright/period/zero/one/two/three/four/five/six/seven/eight/nine/A/B/C/D/E/F/G/H/I/L/M/N/O/P/R/S/T/U/W/X/Y/e/n/o/s/t) -/FontFile 955 0 R +/CharSet (/ampersand/hyphen/period/slash/zero/one/two/three/five/six/seven/eight/semicolon/equal/A/D/I/L/N/P/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/r/s/t/u/v/w/y) +/FontFile 964 0 R >> endobj -1786 0 obj -[500 0 0 278 0 0 0 0 0 0 278 0 500 500 500 500 500 500 500 500 500 500 0 0 0 0 0 0 0 750 708 722 764 681 653 785 750 361 0 0 625 917 750 778 681 0 736 556 722 750 0 1028 750 750 0 0 0 0 0 0 0 0 0 0 0 444 0 0 0 0 0 0 0 0 556 500 0 0 0 394 389 ] +1965 0 obj +[894 0 0 0 0 0 0 383 319 575 575 575 575 575 0 575 575 575 575 0 0 319 0 894 0 0 0 869 0 0 882 0 0 0 0 436 0 0 692 0 900 0 786 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 559 639 511 639 527 351 575 639 319 351 607 319 958 639 575 639 0 474 454 447 639 607 831 0 607 ] endobj -1787 0 obj << +1966 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/dieresis/visiblespace 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/dieresis 197/.notdef] >> endobj -899 0 obj << -/Length1 2210 -/Length2 14292 +954 0 obj << +/Length1 2243 +/Length2 14621 /Length3 532 -/Length 15508 +/Length 15858 /Filter /FlateDecode >> stream -xÚí·UXœÍ¶p‹[pw·àîîîîÖ8»{ð`Á‚w ÁÝ]ÁÝÝ5ð÷·öÞ+Yû¿<çê<¸è1ßÙ5GÕ¬·êŠLEQÔÂÑ åtcdebå#WÔÐ`e!eebaC ¢w˜ºÙ8%LÝ|¤¬¼¼l¤¢N.¤l\¤¬,|l ?*RqG'o+k7RZñÿ$q“Š:\lÌM¤Š¦nÖÐæ¦ö¤êŽæ67o&RQ{{Rµ¾áJªp¸x,˜XYI-lÌÝHÍV6@æœd–Ž¤Üÿ¶pwúŸGW)í¿4?’‚$-öÞ¤Kf%GP5Èåÿ ­ÿ=¸”»½½’©Ã?Ãÿk¥þ¯ç¦6öÞÿáèàäîp!Ut´¸ÿwª6à¿ä6îÿû©¬›©½¹(ÐÊ@Êò_!W)/€…Š›¹5©›‹;à_aÐâ;€Vî_Ì:ÊšÒZbôÿÝÔ=T1µºix;ý{Ô²ÿŬ´<.6^¤ú, õe%‚~ÿç“áÿ*& 4w´°Z‘²qr‘šº¸˜z#€¶ˆ8I}YIm€/R€H˜™ èèú -)hMüI-]þé(;)³³»£ÀÂÌþŸ'ÿä$eº;˜ýÓf+àŸ0)³…£½½©ËŸ7)³ÀÅtûã!e6uE]MAKóï(ïú¯-ñ?aЦ. =Àò¯(ëGÿW2hd׆pµûdåÚ»»þ €¦dîèà`ú'šµ·“5àÏ\8¸þ%nãøÇ4W{SWë?ÐL|.Ž I8ÿfN½›çŸçœ o7kÀ_ eKG÷?+Æ Òµ´ñø+¤ë -jö¿$ë -ðøËÔXfÀ,'Hhó·Ï?s¶wüëK¼ÿ ã`óŸQ.°=ÀõÏbqŒÎÏ2¶úçØü‘æbÿ§y׎¢?A¨èIŠý! øÙIü!™ä¿‰d$õ‡@:Ò¤"ó‡@²T]þª+ü!PuÅ?ª®ô‡@Õ•ÿM< ê*TOíê©ÿ!P›4þ¨ºæU×úC êÚT]çªëþ›xA³5s15·¸ýÇöòÌf ðîF^ögÿçkÁ ’q½è.®æŽ.öè¼eþóð‚<ÌþÈÃüßÄÊZ‹¿ðŸMñþ³‡ÿB‡Õ_Zë¿$có‚–Æö/9Ùý… )û¿dåðAG&3ð/Y9þ… +§¿ðŸ-ú‚¬\þÂ^ª¿dåö‚¬ÜÿB•Ç_²òüƒl +¯¿dåý‚¬|þÂÿîà?úËÊÆñOƒÿòcãüï¼ÿì,+è¢xæ66n6öÿÕ’ÿû®sôòeä edÜÜ쬠]ÍâÿŸiš@Ðû++:±XXxØÙþ5ww±nÿºÝA·Øÿ°¥ èʼæK Žæüa¶iß#Ê$ §Ë¡éÀŬš?+5tÏu|ý•n_<*ïL·^¯ó\‘‰¼½OâùJàÝî§:!uìü9ýçÛ¾‡É~¦O Îu¦¢÷žùCè JÛ÷ùÛSNpåÙõ±²ÝoÙ—ƒ'ù*´°«d`=ú=Ya\Ü:R™öš‘áõÔìdj¨éÎeŸ8"×+DzÄ*"rAxáGݬŒëÉ'•?t1[Ü)sÌðjÇãvâX„COÜóîS~z¥ðCË%Öï,ÃßFá° í$¦Ÿ6·ƒzÿpŽÔûÓÁòÒ¡ž’G’–|ìøRè踔7ؽDØâÕã½Â,çÿRä¸PátÂ¥ ¾ž0úRð·îËcEOÔ暬()ꮤ¢ µ1”íˆ"©¸8´ÉDØ9 oŒ#'ÏÁ2cÏ°¶õ«ËZF@Œ=¨¢…Hc<øKS…Ë‚LJáe è‹]Rs}ýÀ2î 0pBI›àýt j±Ñ&<è4“—#HÝËK=¹õþ ÕÛ¤êºD?XßþÄ䌌Ñ7ÅÒýÝ }›+²0±'±Y32¶*Ëù†üÍ"0)4w®‰f5¶ýÀúÅ\¢?TÌ]ùM²!q©ª ñ¸]·Ÿ•…“Í -Oõ}·Yž­ê Úû¢4]qaïú}y™AÅtÇ-pk«hæó4í5Â=ÜÝÚÓÚ±çj÷iÃir'ô†ô'Å•™U»N‘ô ¨‚Ìûg¾ $„ -õ†¤ÅÓï`…?ÀUkJ -3·dôàgÜï4›èKd QèJöœ~Ú+Uqùf¹¾t—pš©S°ÀàÄdÚõ|þÕ”}à¸ÿüÛ§—– ¦ðž¿ú ‹™Lc´ßÅw&cb¸qÚð¶Ì&D•®Ãw;.Ù%òÝ»ðQáãé“xéêŽÇãd¿…½,±_£†Ò¦ßiße¤ÁíóE;½ŠÏ¿nH.ø$°º.s@Ml&ám»I¾`ù·:FãYq‘©·ùŒ¡Q\!íSeô©—Dâ4Ðîƒ},Ž¡LW!UÓå˜ý¿,3qºsÍ)ajòSŸWy=sN<÷>“a%-œãiñš“Àô^±NšŠ§š{üs<Hh©¡Ð.>÷fÕ®UÈB?àìõ9eJÑSÝÓ?À aÕ¬ioDd!x…Ê¢²Ô•2Õ*éù§29;üº¾0s?‡óÀœªÐ|Ýn;]<\AùÅ™“”m„ jKÑ¡ƒŠÛøY›zbþp©ÖPˆá¸¬ Ÿ·_\aIüÖmâŒ^Ç ˆC@ÖƒL(Q»„HºD)|‡.Øs#œx´³w3löK¦uÚõÛkÓùÈ»FSE<…¸€ï ]»ÆÁ§´Š.²'°‹‘BèW®WÊdf Ð¥÷¤IW}c»¦wç7{Þàåïw8`îâ—Jª/Õá?<É9Ù,=¨vœg±€ -PH¯sì¾É0öß߈1¾Àâø5ŸÀUÎv›Cž}ÝQˆŠŒü&@ P|kB%tŒÝ†zµdês×,ldÒñd -yÛ†I‰‰Ï=5RËA[åSh÷@Ûû¼ gî^€&Úø$å“ÞFGÙÆl/Ø<3c€—nòé´ÙìÒ—B9àŽ¹Ã¤;ÿ¶›Æ[R’ -yò"¶NªàW¥ÄÚ!î@6ÇW_Ø€Öw¯¡éÃÔ0Œo½¹:„øÈ¥.Ö@¾Çãê6µß¡Ú‡u,'ùÝàE¨ QPU¬d_ïg{¾³·ì„ÒË>BÜ­ÏK`b:_¥zœ(x•´„B–¥úï‰(^“— jÄõ@Ü|€‰ µ®Ývt¸’˜yhÎhÉsÏ[PãŠzÑL3¾= Š>|ƒ'mHõ7!Û6G‰µ¡Ý‡ÿš2i3KI÷5Èr¢ë ‡tÁ¿å[¼ w@èÁènä2+¢‰”Cšz¥²|†ïþªË°Æv.”ìqÛÍ´+ 7Lj˜†ÊÜbäþpï/ö›¦Ð´ˆ¡)†&Ôîä„ÔsJdøÉbÉe2 6å=:ádÄ1r"º[aºs…#[¤F, -¶ÀÏû^φê ofN¾_bH˜}h?™æQ±ËoZ?;PL0qõs^P-ßÓËY_Å™6uÄð°±¾|GÁÑ—5^¶^­½}ç…qc$–çÞ¬@ž)Ôà¦r '²GÐ2º“rÏèÖ)o|u« £Ø+«Ä2©Ì)‘§Çÿ¡ 0RVô6t#’Êûú„NµrAú&„»Šö^ôÞ ‰6Ô¬ñ1HŶúXÝüþµmïø£kêïWo"{º¤Œ°_÷Ù`$¶à>ÈGËèiB$_hÞ«_ -5J®‚}N,®/Ír–"ñ¢æÆñðËÅŠùÂ3œzåT1BqO$„ð-[€ ‡ ¿Jµ®äNËÎ6Í7‘ø‡„‰7"ÓB‰7áMNß„Q¢c?‰&oµ*J"¸ÈŒÏN««ZÔs?k%a œât_ÜÜF¸"™nƒ¿¡3­û¦j7»åYûF³5•îå] 6ÙIHc8-›¬q×¢ÌoQ»ÈÂð’´¿`Ýï]h@¼í[5”+x]«¿Ü ªl¼îAYÓM ÔÍÝ®½öª]|Ê­Âql -õñ}1CÂeÈrŽËõétµdYx<†" ?8]äêÛhR:$>øŒTIÝ Ë~ÆyÅÖÔ0 :u»Ú/(D¶¨ú B¹Õ½þ$æé„Ž£¿ba:“EÄ'°Vé)€¶Iâ¹f#Œ"ª6u‹§íSíìYJꜴɆÓa1ip‘Óëàïw9šlTДQåZ¬Ö ´ñ‹’L Ü:üÁU}S_6ö ½Öyܳ[–ƒ}ä¦í@{”™‹¼Ä‚—ÝŒ}\Ý@WøAÕ€>£ÝÆ“…˜8îò«â×Âq榥ܦ¥âKß/ƒ\êûZ‘BAÄr!óÎ -Ü—Œ7 -5fµ!¿ñÀˆ?ÚjÖàwÜ‘QH{5#¸“ºÉ¢úªµ¹æÅ7TØøب}"¾ø›´ :iƒË‹´¹´j!ìÛ.ö—RYÑR Ù?í$Ýx‰±x¿<ûÓâ6Š%u‰órP3¼iÁÇ+ÜÔ­BcÛ¿ñ°w•Šv#B'ÌÊÐZ x&3ÙÝW'mv«Øº¥?à-& -ûæ}jyÇ7]5uU’6…Äeˆƒ5Œ ³õhW^ñN¯r”«œ›/ðÃZÙ~ðá@pbRtŸ~Ê·>9eoÛŒô˜Ü@™†äAû "™š¢žÑ—\[á¢Që±Ôð)\s7+¹•ƒõç`xMòþV1¦Ÿ*%ÛV¡ÈhÞ²i¥Õ`}¡‡•\ûs¹ -׸Vˆ)5”Ÿ‡åô©؆ÞãÖçÈE“{‹á]Š§ô¶–íYwš—èŒÌ1gÀ$HÒÇx,ƒphغy~ƒAá¥R—Ö4N®(´~â¾KOn]Å–A—€±PSN¾u*Óô =b#SR¦OŸ¿Êæ×ÏjCYÙ€gL§û¡úNXîŠË+Œï…¸¸?ÆhùG2Ûž¡¹± [ˆÒæÌ3ˆõöè%5³í>t‚çhøß—'•ßÝ-µçÒëŽ01Ÿ>°Ñ<EŽiÎâNÓ¿½þìÙ2˜pGmó¬Ì°tôPð÷›Á«”§¬|¶±·s„ÇýØ“ƒµ/Ý„Û6­¡´;#‹¾¿X%&)—0ÍÙQôʸ4› h"L —Oêâöï"­™qwBÇVÏ>ù|¯·†÷œ¡Åñࡇ¸”UÒÎ]]¥Êhd•ÙScèg -õ`¬ Šˆ<5©”(pªÚAyÎf rJ ë>!qïÉð#\÷vF‚®ú!¾§…‚ïË;1Iõu(ÛÆx¹#LCšî]ª¢ß8ËñÍt>Ü ÚÖ,úgÀL–~—r ŠôÏ”§ÿâd-êGëpÝŠ6??Õxú•h5[œD+“â)µæ}¯îáÁ§I“D{µØ3¸ìèj~Ît¨ŸÚ̼e¥,îÙ -êô”íŽðo\YÔô„ÉSÅôŒµ¾gTÕ ¥ÊÆ?#|ÅÓÀV,]¸¡­¶X~D]¬ÂO˜ˆ7%}¥O´ {˜QH p_hÑã½ÿTÙJ1)¶~Þô5°Mø9y@k¦ÎáƪWI’†ŸúHÖú#™pòVxžcjZ¦&ÎÈÙ4.l 2&w¯ÖFMÙqïKô,qA²“a Æ°‘šÆ a+¦¬ô鯬g+rï3S.\ÅÀ1A|fl®Æ¸€çŠöÏubô Æ¿À,ª^oõ1Û»ýaôMô'Q#{°q÷‡&_Btf²Í6?-U«’Ü„äHܺ¬VDì ô;ÐåºÞr%“ÒˆÍ]͛Л„{ XWS™Ú"äTøð·Õ~•ä3òaÔN§Œ‘­‡èdסw]UÕ{ô fƒÙîdLB§¾JüÅÁq}5”¸Ü˜ïÐ$/"IA½HQ'Ù”'7×æ4IW¾¾¬o;`úmÉs›¥ŠÈ¿˜†ažRÛ‡æ$Šj¼Ä˜>#Úº%¤?qZŸK,NZ­Ï¼t«†QÅŽúFÆ‹œÛ¼ÏVÑbæä‰eqõ6¸†–¡¬mœ§Ädåœï²ï†*¿0u<ÑÒwÝׄô*S¶·8·_Åú¥‚MýI]j»ÆüN i«ÿIA'oHE‘u3›XªA®”É«\ÚtÞ8 6ÒšS #Z¥mu²W®]èý[c„&,gK?&·þ=¢ÆX¨rÛ¨¹˜¥½ÓÄ÷}7§¨#lPb»\¬„ÇÈ!ªL¨ì䜹È{±Ëï!ÿòôLw]H&Ü!´"}œ– B•ö2Æ‚³HŒ '°&Ø×kõRS[7£ _»6¬À¨–¶Zþd³÷0ÒhøÕÑ/"E`ï!mw^°—…´Œ‘0Üh…â -ù`®¹Z¹_zMâ>ÞgéÈ—Êy‰Ïádðyµeq¡õC%¦¤~Q Ç2b@®ÞO¹[v,†\½9ôî> Õ½‡ºoÌI†S{Ó=mÓ$)ßîÂ;ˆŽG󬙓òD:¡‡, $è…ÌV*.þÈXÁû“¤·w§Ã\LŒæHw/Gôj´Ç…*„(‘¯1£€+*1˜æJ™.áST1l×G½}ºÞ™Ö'/ió>1ðãjÕm¸NóçyTÕ­¯0¢>«ž¼Ï Œ*æ~Ô²¤A÷@‡Ì™3UjÇ6„ ~» öE[XÓ$“ØlòC/Ç}AŒB3è¶ðìîJKø3¿ü ñí¯]*ê)\»—Ê**æë¡é¨oS›ÔûÉm£Õ! _]ùDâ]Ôm«~³ÉEÖŽ(}dž'k-™šÝì¯] MÌ-%Ô,¢g$i°¾Šs¶˜nþ(—Áe‡ÇF¥zk‘ª•D{yñLåü:ÿ±Ð²ÙI=ãªãÜ’¼YµRpKº¢’<þf™Zw=ÿff„ÉÐ ×Yö.2(,©~Ê €Â'½—åÔû¬P¶¦å©×ƒ¡DÝ@u2"ðÍþIø;›?ÅÕ  ŸdÒìåèrÍ*=úV_cθšÑA°Å‡žáÐeù`€ãþ÷O6´Î­–ó—Í”œUVh~»óߌ‰¿_¬\:½4,tÏ0«úpâ.µß§È~ùsA!ÜAð)rv4ØcºÎ(ê)‚e‹hTÌþ=8°bøŒ%—öñ;Þ$k­˜[zJÙNjÌïV ¨îÇz¬M~5ùIýWΉ¥É—|1]e ;¹CæÇe.áéÑT’&B7;º„ÔzJë ‹ ŠB"Ë|öuõ>‘>Sº†’lßl6 l¸ý©äu§,s:M!.¤ýq”™ÝRvÉx”Yžä!‹J16"* ½—a÷JÊÒpÊÚ¤gNºO^‡\î7Ƥ9µÙxËYö9ÞÐÝRþ˜¨J ê¸YQÆ -Í‘°òà8Wž‘˜Þ*õá&Itk¦(‚¨_5ºÂ=wYïuÁ÷ß!3º‰Ég±©­üÛÃÕßÕyVŸóÇ6X~#<e -¼íâ}Ä’¯¯…EÛvß‹F‚´ -zÓÝ/²ø8˜ôÄ;_€``‰Þ·[c<>¶Ð)i×—!_õ@ªõvR'!œ~q -a T¶çtð>#ç˜wê’nˆœ ÷ó%²=Φ‹ Öí)9iIÈ!²43PØ»†p¢ßb»o‹p£ŸXÀs²ÿÁ­²ZS!:=šA°'?Ýçím#”¡2…öúzAÓð‘€ 3–ÄÒñ]œS®g+3böŽ˜3(†hµx/òQ~®ú9`þ5Vœc‰ž^¶h7^¼¬²`ï%¯û-Ðq⃸·J¯5x÷Ï\ÉÅWèì¾k -Áµœolí¹ñ™\Œ-¶âL Û²ñïS²hXUóke[h|ᢃ°ƒˆ¾T»Ë.ýãpXæÞçÚ‹¦<£«˜YT•ö>¶0BÆÿ8‘W²ê‡n|œ¤Þ%“ù´:…û›Ù¸p‘¾è€*CEI‹cÄPí^!—¡Çø¬;Yªx1g¬iM:9T¿µ‹³Á5ø³N™’z]ÅšmAónQ´`¿Ø{§ „tôå‡%Ø7ºç¦¬‰¢ _¯ƒ‘/Ãy–YüßÔà`o¤Zo_„«uò÷ŠVï0µƒ ,Öí#¼ôÔŽYÉKKødÇõ— ;á)¶«¹ ϳ^ -…+-+ÂáÈP¬$ÓŸßzç½ó;g™æ6`›Ãc—æb…0¢´spD‚JðEЄÐgWØ™ÏÇ¢JKœ­è™¼ ,€]&~)Àïl‚ß 1YZÓƒyHƒ]vœÃ‹ÜtR -áR8ë@¢øÞ…t@k½ûäfár„.Yü½ÏÚ,¤ÇSp7æâöæ#`¡ -3ÌŽêee(òøÒj.³Ë?²®d˜5ѵŽ÷@ƒrlRãBíOk«!êÕ` `åнÀšREt®/ɈE¹>, &e]Š`ƒ‹TFŸí~?6k°¶Ìpœ•ßð.˜‚ií3ï3Ù–kÛŽ•ÿ|ºÈazD«¸Kéte"ÝîÞvh ÿÛº¹Ûã§VÁz‘Èà÷at`# -Wê¹[T’–ÍÄïE“ظ®¨•,c2,W€WK º!q*§^‰YX³fN'y½¿ ¿,¢L¾1Âû÷ôK€®¡RÉ3–ó+³éÝjiD½HŽ–3¼¦å ¬”0œÚ7§+íîë¯ÑÊÆM2ÊðŸ2*õ-é èp³RaÃòÑ -K³â™q…§5¬ƒ×!§þß«+ÄHw×5´Ú~¤ˆLú秗Ӱ.s£Ll_Q¯YÏÖï ¬µzn '°(lámu£Öó1QßÙlŠŒ=¾W’V06RpoŸq’ÕÚwí½ò˜JÚ·ŽÞ·ñ#ç¸S­›UFnäú¡+¸sL¶>ê.¨1yïÔ˜¿ŽÕH¶9JOc§Ä#IjƤ‚Û⢛¶ 1$æ³HNò§ÕeG‚ÄÛ¿f›Úù•ÿÒP–`ów¤¥m=}µôrð wËyÐJÛ?ïDAãc»wZË·±ÌØÊŽÚ:°¦j^ …ˆ2¿ƒ1gÓV[—öq'ΊŠáèdî)__½lRjcn¦zh S¥ì²(¦ÍŽ«ÃWI^ø}xLÈÜÓ™æÂ~ú -óäð›è\Üülm@h»#;jz±š±Õ'¶¥qÕ:ðî`ÏI0.j”™ãTf->ø°è¯Æ~J.ÖÏm_¼ÀÛ£þ;åk¢d§k³·ëk7•–ɶEc^)~¹c]d• -åÑ ÿáÀÅIž¯;£zkùÝõé» ÃÌІ÷Q™úðNÅ"YóQ@ -Œ„Ç}™Ea-•a•H¾”/*¼Séz³|Ÿ^ƒ®€Ê¬4s³7-6 ÄÑ`'r.Ú'Ù ƒEåŒp“m— ɽ…ͽÀ1ê„ÆY↬‡§@˜ÚK¥çÄÝñ}9ˆ‡t¤Yx<ªýY˜}ÎØzõ¾¸u˜jo§Æ*"S+ÅÈÝæÈú»^ïÜ -Ï[©ô6¶úì}É3Ñ¥Dex¹âST7àë ½Uö˾HØg‚»õ)búHi'g˜tƒÕS ‡-çÞ¬Ä<ÎjFŸ*,Àd‰ÅÒ^=z¹2[¹ÂŽeÌ÷ü¢‡­[»+2j–KƒÉe*GwÖš;ŸîCG¿šôc/ï³Hû«µYmD¨b{žÞM`;+ø‚ã•3lqkØr¾ùÍDz“/­,àCm)»iŸ¶à¡Yñó|ª=qu‰.x/¬äG:d…w™­ çé õYbžEÁYêʾêÚêŠHŽ-1½(|÷vξ5"€{F‚~ÈNõ ü€'ÃóeûHØŸ?öÆä¦Bviþz‚ö.±|!O1îGn÷mÜó0¸ºC â#ÁÂn°¥!Pnˆ0¦ª®íMl¤2¤°1 Ô}mª³¬ôÒn„`oÀéý^Ô},}ç©«“Øûiæú娕Õnk½ÀNã¿·éBÆžä›{jU­/^0áì…Vµï$t´’{D¦0‹ŽAÌS¹Åì:Õ­ííA ãÍá‰à[Ðî4zAÈKSÇ•Rn%¾n¾™¡=‹hØ"ª¡÷þ11N© ö•ã LÎ32pŸÒÈÒef »±àãxòk¯Ö -ÏŽ¤X?x´¹Á#-†ô» œãáU»ãû+û­a%eV¥%¶-òTe>ZMãXµ…UL:~ü9CEÁ'7ÈÏ9›”Dé®>¸÷èS‚š/iÅsä §Ÿ\;£nüøØvšú}÷A@·óñÃU•x¥³ B)¦ÁŽKbñ·9¸ñ¡–"géÉÞ>¡[C3÷õtê+iµìü^PÍ]FDîÔÌ’»ž/»DÀ›Ìḣ“̓µ¯Ëª¡ùžž@êô!b§c‡®wšŽÑì—µt,È1Î6e{„¸“ÍëõñzŠüsÛ4í—ot¥\Œ¹ë©¥ÆJ; ‡mUvêwÊáΡ<Ñ®¦¹ÍÑ?,‹ÿL¨'M”ÆC‹nþৄ§¼‹c {r¿¿õ¶²®gÆ[,úº^ê´bO‚uÇ\>*JO {ö‚bìÁýõqlÜx¤Ù½·†Ÿ»ð¢ /¦M«9øë#âô—àL\ÞÆoû_Xd÷ñ2ë¥ ç6F«ùÐgM¾.=N†ùÓFÀdE}y% Þ{½ÚñŒ=‹@M.EßuÇR‰ƒVi–2jòŸ¤ùî/>êT™ˆôu`K=68ÙT?iò…’äºÒ,³£k:˜høûâ°å¡“IªìÆ6"¼¯‰-jzÄ37 ó£sO?±ÝÛnÄ3‰BtE“ÞÇôÍÊw¹hËÒ\¡Ø£jdÆãàžØ3ò…« ³?3ŒábrUËGú{XÒ*r]ŸÃ¿•¥¶´«.Cƒ—³˜ó¸†H 6jP˜ÖP]M˜~ðFvϧÛfÓ´Òõ_jéTâæ'Í{{äX½[AÇ;&CùLmt¢±ËwÛâP:·.(£ã…[] îp¡ðE{—èÕ0m¤'1àAš¢K¥¼ô‡”g%óÂUyDS$_ýÎ݉f­Í¨é`ùG×ß{¿b´N·™¤:ÆW4ò:Âu=fCDQÚÆ8lÀÅû©TÑZ¥#Q€AÔ5€êŽ.,J yÿWpÈÍk†_:9{Óì3°ø¿Sᬰã¼â>¡#¦,:Ya|ù–µ3ÉÔÓ¨XbÝÅÁa ŒS`m¹¢$‹«Ì=À½-sâkeýÞ$×íK_MðM…yBõJ˜ÆI³e4\{>};²dF>õÊ€þËúà¢bp€›axùý¸5þjæ§è=؃MÖˆf÷¹3ø¯òL/ ?µð ‘ïê¦,|—oäÝ]ÖsÁUÆA­ôçz!SÝŸY(Ök*ÊãPËYP¹ið3S³xä=1|ÒÎ<õ|ŸO›G|eö;jÉkOËã€,]…´a©œ"”Ää÷;¬WM_f{WYR]Œçv‚M²üçñ[ÚàˆeH{Î?Ÿ¯CƉ;£^ÃéD}¬+˜‚s¸˜Âøò…Ö§Ñó–6ÿü¥*?変e³ŽZ9™Ž£Ž[î=ÏÎå -¼.?5C'€`9ÖŒžä@^P&ÅìkŽ^N›XÈÍ}wÿfŒ§ÅÀáDѧï˜F9×x"#ßK­$¹–fˆjøëªihû@/y“8QWR5¦º]‘ÔW‰‘rí¾ë+ØÚdJ Åkk­üŒG+꥖eÁDI$Büä*Ä÷îß{mãµ5qaÇü!à±á„” 7̉£âÚ{ýs6tdAhÌ™tâ3äl²u3~÷b~ˆéÜ8'%û_ú +¾¡‘× ¶¨yÍKlž~þê¡^ gO7‘,"÷Œ“GDÂ5)ϧ/5‚‘ksOÏMJÄ ,ÒA†2Û1ÚÔAäºö›„=¸âa¢LÀQðÞ>n™KbxÙŒ^}Æ™îС9ü@a­µT!ŒêMSÂØÏ - Í}måèëó“Ϊøòçæ—E­?#ÍÚ÷kéÔ ²¶ÈIÿ®Çp¸R}ïô,êvyfSÒu‹™¯¤qåxiCQîÈ¢Vh{H©RùüÐ`”©¬Šñ:f¯mˆÎtTž;ÝP ‚}VòkÐüÃ×¼¼_CVŸÆà{‘€–¶N_9rËWüá[)74#Î’•9>ÔáúÌ>ñU¢ÉÖatjÌ™\ü›ƒ½nݦpBK.²+™ÝcªHµõ]Öß°üüM”]IÐ:Z§}µ–fSlÑÇ>Š.kâãó+çt £Õmˆ]‹|µ½v -»”÷/jí‹’:ãn´ï¦Ð¼q$~'JºŸôp©1臫æñ£` ‘ruã -^ãSVZ%I\ŠM',yØ ¶Âå«ð¿Î‘´Š~µ|*¡€‘óÀä°ìÓ<‚ÛŠ8dwVGÒ)p±é›P1„Ñ(G÷Js Ú”¡gî ØçÉ2ØVk%¶·=âîR‘MŸFRf!¿O2î`p9œ”Åì¿ r—ç2sbý `ŸîOyhRK< 7ÑIðÆç~ÿz]U- •å° ‰´÷‘«||ÉÓÄ2uÀWó¥ÙÛ˜ð¯È›ˆ=†ßÚÌ~®ö}‚º–RßßâáE³žUY„(ø2ç9AÀ¬þš\ÄNsÊ»ÌjES¸Ðžž£3Έ­ Ù%¦däæLÁÚMþO<lÍN‰±;–µ€-ƒá‘í‹¢^$‹ñ“ÃŪO³q|ðç œ¾êË£ džºœõ/Dáµì­ji®ÇæUh øÝ-åêfCŽ: 1žRqŽ`fçGÄ;"Gâ7 -'Ê+<63‘ŒJùêÞ‡ùÃd£-Ði[aèÞVÜfÆÝÀ^8ÿ‚Ëðû¼>Z±Çh‡w úœ—&ÂÙB‹³§‰7õŒ~q÷ïO›iC­3ÕäÆ)—†æۥϭéÙUл'¹£G4ëV­*»(°¤C­ñÒPøI0¸{œ‚}7+O·”ÃU½Ýí\¾p‘À·tŠÊøVÖЄƒ˜Ÿ¼O]ßz0 §ðOô#‡nj#õ#ŸN'[Ô¶,BÈŸÆ`­µ;©ùê…ñ\Kuw6/;|beèßÐôN" ‘ö4Nj89£Ü*òi%˜§|Ôg²k£w$‹r*mØ}Ž•ãËè# c§ß€B$…ÍbF(BÄ06Õ -ÐSàÞÌÇdŠ¾êi9uð‚_wB"m~Ù:ï 9q$eØ;mG¿¹a¡£zuâ*™'(Â.Ëù"ú¬ÒÔœ½£ÕüN‹¥¨µ5hÚMçñ»ã-„eu·]B×µo-26žõ$¥©sãD#·«´1™<ØX…§v -zyè›â*~tH±´§Ž¸¾ÂóéGö%/ðºðû7™C¢(ôöC†Í `I0úí ƒCÂ-³¿ò¯ƒˆsÝog ÁI¶Np™ûÞÐÆÚAVΓBL,ôõvu¯¡$Î2hB™­{;ÔN`s•1EG;¨Dix -2¢€|BÓA*úÂÔøƒÖ` õ«äËEŽz;A㙇ÑäÎ@”Ë‚Í®8Ù'Æê:òBB—©‚\íˆÝÍ8¯YÁ$™X¯ÄîÙ†#¾ “ -EWÐ÷ *§¾å)|5¥˜ÉW8Ä/Ï02ë‰|™äŸO}–$ ÂØÚ›xÓ¥ÏK±FÖÇ.•}Õ=®ù96 Ö¨>Ó€T =`G·‘;©Ã…Þ -ÈOY¤ÝüØk¢ìYNB9mM˜»»íÁžËj`Gå¬úq~Ë µ4°ÄÖqŒÌ•=€¬“îIÐ%“† -CbÇó#FA´ »>!àdœ­É9'ŒÃ8ˆ1ÈÆš õr—0¯‰‡¯åÇ -˜á3Ò0øäXÈ(À¹c‚yÜÁý²î.–«[;J—ÿQ´u•ò¢ò¡Þ5qö2 °[yxÚ¥jTN™DQ™·Q¢à³÷JX« i ©“h层°ôÖ (÷Õ’jó£%,^&>‡Zdub^ÿÝ\1Jܾ̃O$Šáó*üsGþ±íÇ­>ï•Ó Šß>É‚‡œ+#«ôÝb_8|. e‘€—¤é¢·VV{«¬Ùº¥+ë “±|¢‡éK_ÌÞÊ/Dð É®@%Lé4uÚŽÝÝ]÷ÏPÆ(œcª±gÈÆšU˜pŽwZñ‰!ƒ÷¾Áªô–4' -FÖ!¦\s®~¾6°¤.® §?§F˜ÍÙ#l6”ím`ÚŠ é¸9Ÿp­Ú=… Ël—IÌBBâ^ÛïvUí&3ƒÔ"„¡n»Ýhí( ±¼ÊBæÁéÛÙ)ožjLs«/á|§¼ÛU¡P›«.˜’žŽÈZÄ 6Ë°G¯gfðûBŽ9å&½ÜsÔà FBõI€S¬&/»dß ©áÙøµ„ž^®`yPžÅÓe`ÕÕ”óU††ôÇÖÄÚŽû7J ¤„EçÏì¶Â¾6(O°/öäjËÇ©Ëß™¯½2hKÃCÇý.‰Xð¨ÌÆccp!©ŸNU¥â7ñõ‚/-SÔ¼Á ŸQ‘0ÞötŽž3R¡×s?¬6Y#™»©Xhb–? •V #Mà±<ɧ). ÃO9 ƒ•b܃þÍunƒWƒÐØŒpijÁÆŸ–…ˆ‡Pï Y‹¹ÛÇrV ¤ ^éZgfm/‰3ìî¬u·0ï ‰Þ€qE«o²·.|ï1.!æ“;”½ã‰àØO}Ù/ц LWPT©Wº“¸kp²ð‹LÄ+¹ß «–ôç¤ê7ŽUd7+at¶iÛB¢e|÷áœó=ñ‘ÉÙ掳‡5f&5…Vø¶v£{*ætÚ!DsÜË=3î%×üæzäœÂŒ~ÖúÁ‡ce?½ÿ‡çýáRN^ØÞñÏ…9ÃÖø½äÈ}bøK`ÿmÚ§±¢tÒRV¤v¬,±²R -:Cg³®°\n¡|¾"ÃѸ¨KÞkAqƒònëó FÍ6›40:Sø#ÿÍRÄ8Çl–ՌޞjQ’u‹}€XücW"×0]Dê–â§~ l¡(ÃÉPH6ø¬‡. æZè5C²[†•?[AÓ÷®~â‹Žô‰Pý¬ºXé¯ê/T?’›L;bú8üÈ·áÊ”úQr²Ö€÷9/àÕ7ï½Ñ‰k:AƒíËᆋ°¸® Çw¯#’K -ft[z{kú²{ƒh¸šÒ9ëì~åWêD´÷N/VŽ·(õ8î5ôí¤£ü8ÉGX£póc—$ŒÕùßVC]/³€š‘ȱrf¼Íw$<Æ}Å]ÍÜk$éu¥Ÿüd￪›ÃœöV«wÿ¸Y3y¯ÎßY;£š£,À°eÜ–\YìñµB¤I¼Nz."É«_z(šPž]YBíµ‹Nè0t®á!p_l7b6ä -†óQúÅ3§ä j³afJ4ŒÕÂ]´TÁßÆÈ£nË;”±ô•Š{[ñ;o“¾I†.f6wÉ‹-DÕ*/Ç:g²‡·Í·«5çÆŠ OŠ(¯+éú†ˆzQóǨQÂäø†›£ùL4óoqm<8- Œ'¡ˆçkccÏ–î?œµÓ&GØw8ÆØ~Qªò<ÑŸ]®ß–‰´ó^*UϽ”:–ÛKBËÐ9V9_%3[´Ž —{¢Ëä9$:My¢ë¥ìÞÎ[Háâ!º}˺ Àƒ¨«šðÈ@ÝL8@‰þ¬ULiÑ%þŸ£c[dã—Ox)¢¸!}N¨ØeÐU^]DÓOMúç ³‘ðºÆÑ\œyíg©÷C×q›okèpí¦ì¿ éPØX'åÏ—C¤é¿À([“é Cj IH¹vV•ù.µÕuXú~¬µóš@¡çoÊæt¤»ª7Ct â©gû¤Å¥ÀU÷H"öÄCq³>…3žR;Œël¯ ½4,i½€wÓ|Xx&ņ·±“·ÑÚtGòX4ß1*,[`ÂÌaHÄW™ÒPZñŸ¥Z˜?p½ºHÈΣh¢m!P…"ô×ødQñô™øV¬8$w"' Þ©`Ú?1Ì& -úŸâÒûWkšž ?dJ€â‡cþ–_­S V^\–‚¦î3QèÅ'¨9”´1!³³ʇIªjô®âvÅ!îñ•d*ÀžÚ.ü|‡ÊŽ“>2Eík‡ûúî¶w[È@XÖPû²~ ¾G»6f€íy·²ù6éØJ]}ñ‰6ËD”Š¡G$É„\dz“¤GâÃ×ÖŠGSàr-ž…ýª¡Œ“UQþøwçÚõ=§Vk+¿ ¢²ƒµÌ[ç¹5.ªëlDmÆBL¥»e“§d> Sv“TŽý€KꃷÏT%ïrók‘„ Y¹øê´,§Ds„sÉâÒxT…E*2¶;½Ä/'vM^³Úìn2½I¹²¡h,l´Áñ®‰où*Ç«ƒ|Ç¡­1šÓJ¶¡¤¤aJN!ê@ù]ó ‘ª‘pqîw‹ÊàUa__w݆â1K°„záhôáÙu^xªk†Fr/QÅ7ã/$oâ¤á³"£#§;‚—À=xŒHƒE Ïl“|=|õÐ\úÇï<çüŽ-\3–v6Íj¦fÙn4ìlJönw;(.(Y¾Pú|Á,$3è­$ÚCç²ô’1ÎYØüL!Ÿ¡~u´ºpl¢â“¦£ørt!ò먂?‘Ö©!¨Ã{ÀvƒU!à¹Ìy¹>Âå˜Gr;qò¹`3TÄŽ•¬Ã3S][Ö_CMjk$ßM^}~h›ƒôý4¼%æ E®9gö„ðÏ5n7…õu_óÌ%…¯"%:sŸ_åû /_Ñp;ÙT+|øYv»û¿•“¹7¿ãC¬PIU¡Žº“—ývŽë3¥Fš¢•VìCÈœTLÊ -³¥GªŸ*û|‹0õTÅ5Ž¸(x*ô ¿º… +×÷RlFØn«(ë`ýœã”#ÒøèÂøI“ÉîtÛ,ÝjǨ VFe #çÏ5Š4>WÎÐEË…KÓ’†ñkÞÜR^ƽŸGòUug#[ßVûlä„„ßÑbWwjN…ds°Tƒ¾Q#y"¯ƒ,aÏ÷AÈrLp")=»–à Lêq1¦|X´3½R¨ý\ëk…MÍÙ=u{ =R Ÿ®¿g±r3sÌu¹¬ÐpÿòÐî†<\Üq\îüÈ´œÚz1òX€y¥Ö÷+ÒÍ=ˆa P rÝÄâ¥ï¯Tž÷ê¿ŽQùܯºO+Ãß-ˆÎ!+Ú®/Ôöd¨ÌUŸ;¸µ®/¢1©™}w:àùV6Ÿ4Gw…t‡p»õ¸µCæµÆ{Ò|’ÚÌ »#¥¼1¿iß+–µó1çîIà»”)*RµFóÔ•“Vˆ’v’÷õLŸJr¾Éé#Í{0ß%j}fTþ$ÎðéÀ¥ù«ƒJ-_®Ûsÿ'ns J68üØû¤vÜÏY1?<½úòÃ3b•Ü"òÕýÌe}§99 ò›Ïžo™3ºé„°ýðž¡Çƒ/>Õ=òͧäA‰þäQ²b³½çá¨ÀÍy-.£ù0z,sîîMNÒ^¸Xü§óh¯wùYÞn üÁ „DD¯Zt2ÔÂcݳŸQüÝȬd² )6û{){l’@DçDköù;=©ä=-¬Çè›s(Ëå‡Ú¹*œáU«üþB *¸úâôGåM~¯‚$¯ƒ¤w¸)Ëg„Úü†pƒ—ÀãÏå³m^@TÌôPXïy[-šÈ×ûŸú(ÜrXéYÈpc¸õ[Zã;¹§HÞ¡òlŸ™ŒTôÒY\W¯ÎÍ=΂Kæ >G‚0N0TUžvû+— ›j» ÷ØÏÌPù{v„q…‹•Ý°™9aGÐMp½#Qìv1Ï!Q{±ÖFo â4<¬šf™ísÙ Ëôó—Õª§ü§vâx]š`œ´Š‚XXMšúk'iy㊘µ.6AÝ N!Èõ—S6 h¤ëΆ ëSšïå©‹ëC]©§hN÷ôˆKzU©STœäkð0WrΆXnÙ#P÷úgE´4Kó ¯zòº±@Ñ…n¾°¦‘Î?ÒTRŽj9u*ÇØ»žDJLù2”í”\= tCYw['ÝŸs`lC$”½_'ÛóžÌ)U»•m?ê.Œ +—8[»u$—¶uEüFGHƒÆW:X|ba’«ƒaåC®GŒÀ‚ô=8"ú:ÅÖ­¹ûä¦ +Tçð¤Ý8°ßÅ(ñà9J$œÿ`i”X Éô"σîUäï›qEÈwlòûšG»)±šz÷Uú´üH%Bì{ÍD H¶3÷³˜O4÷YZIw—+óÞnŸÜ6-²=¿§Æ%|Ä%•Õ‹A ¨¿éýZW{¬ËµwƒL®»-l¯G¼ÖòlJµ7'§Èù‰´”†V°äÖtw©U;Ë>‡æµ¦—ç¤ñv­–û…X&Î-T]7>c0C(TB€#9 +€:¶Ò[…<~)îï»h[š+G$h/hÜ;zÙ7M•L˳¬•¸²+½³$ŸÔ%X¥þÅÆ%Ð!GD n/ƒ+=}­6÷/A]½ß `íšçúa:Rß"z{‘½ e~Ò³¯…´¹µñ†tÕbª?÷ñCzô*BÚŒp¯`ÍQùPdšw·BÅXts”x#E-}Õ³©wâ490"/æÖ¢†N ¯j›_¤°<ô9Uœ·v‹µÁ±B› +«ÑÄ +üPÐÎ#_ŸF+Ú( ªË÷­ßCÐ~IMXEÿ +ú`ÍÏ5˜õ¬¢HÛÍ zøöq¨l¦–ÒG¾ÃgC((ðŸY=Š_å$$vÔLö!Jt÷Ìض²ÂYóÒ©°£„ñaÙÓyý«ßˆûû0‘p–¨/k_óõŽ€s ¿¯^Žqð™¾t½AÖÚxaF9$ѹÎséÈA³§Ÿc0ÅõJ{ðZùÍãv{öŠâæ 05º9:ܹ§¤§e£Pði¹<ï’íФîýåÅyÉ©îüöZ´ÁômrhÿSh6G +cO¬bÆ€s!ëÏž– +¾öÇæ¼²7ÃÎrÎ(tlFè-šõc³E›ÜÌU3&ÙÎLd?ý/ +Y¯"måÌ)E4?êÔeÖè9]1ÙÔ.ª¬q ñXÌŸÃEº3–®LU)`G8½ZáÈÞAÌù>TÛp¶Ý˜k¹Çìp8úOÖ#&‰ãe'­‡ÉTúc)žÜ®ø›ç¨|Ý(ç¸'LÃÈاÌň*q+e#€,r”mu›Œµ€fߨèG?4¤¶ëN,Í|»Ö±AoÝã뚃CèË¥›&s¦"ëõ6r±¬S@å÷ߚƧÜXŽÒO9j6e‡…Lƒ¸½ÆeL-ÙðMÑa6ég8jF{yfÖ–¤f +ˆM}GpE9ê:<Ð-׳$¶@$2&Fîò¯¨¥nm2³¬z2r°V•Ø ÅêAÕ#2we4Ñ™¤XÙ³§Æ)²‘ÃN¬Èó7ŒS› 0èÌäÓ}ÃîܲáçÒÑïQËUªEƒ«FÎLœEö­&;LuC×I#÷DG—o;òœOËB{]eà-×=!hUwê½dù‘î•æD6&Þô—1œ¿O#­…¤Rz;·åÁœævñ”rZ÷à¯õb)ÿ!‰»’'¡§9§„r–¢GKt¶$Eèi°FH—V;ûU¤ø”ÝU!’Í}Š X€²‚~’\2§\zš4tšÚ”zî¼. Û&žør[eE³TK²¶Rè>õ›{^‚®ç›þ½ÃŽùÙ(·²’án? ^‹:Æ°j2˜cp5$K¿BÐ!ÁdέݭJнͣbì¦ÐHàù¬¨ðiÔÆŽœžpqÃ6©’»D´?ZmB…bâø#›ÀÖˆõ2t#:úøaÓ%Æ©Sé¸V#dÃœBÅ~:ÊÅüÈ\28ÍPÊ‹ˆVˆ…Ù._d…GjîKŘ ßœÌcâíp™Î‘™?Œ¢0–è$Ì`Ȳ¬·ç, >Ï@Nª´ •Zcì×lå;¬! iXØÄQ.o"¦¦ûiówìÎyd›¨»­¤tžÎò”QÂ]ì´åâU_DŠÄüäc¦.ÐåM£&}\ù¤VaDl1²çb O #Z'j]{M~jø®¼’±~{•à;„^ Kü¥D(²—Ÿ/éÁ×=¹Ê¶ÅL:VOkÒrïKÿ}xÒňÇ%鵧òKRer¹ÇâŒUu­Â *F}•v +3nŸVô$Ó]Ã*ÃÎNö:Q$«:Ûõt€³×Ìê\T9ä÷L­è×J +Íß3ì†lǃˆ—/=äØGáYñª´:ÌøŠw‹Ìû%¬ƒÙË7êÁÚ4«xÚúš «a‚P¹YבSæÅè¦æR%Q¶¶óHÊé&ÖU«1 ^Gêó܇ŠnÉ_ÏLçGÍ” ë+®‰•ºì¿"’ËÄjüyL8Å*jn6¥ÍïÅrò€gãJ$~®¶¶=î†y …˜‚»¤{wå¨O’ýŒf:²GÅû?ñPb*Êx5|Î)j…–õñº!pª¦ùMä¼lÈ/J+#oížÃ¹q +`[;ñÛÍ8£ÙØÞ%Q–¯g/F{$†d*Ê—ò~b0…&‡h9uä•17´â¤Yø½M³4³ÏψP}‹9¸ª›nדŴiÕ×eç£t + €Ê´" Ý M›*Mla‡˜9dIÞDÙ óÂrnÖÜÄÄÇìþ²Ý­µ´°]·œQ´6,2ý£)qr3Hp O÷E¦uHNwvxÉÇï7‰Âó¥¯I^ð¶~ȱ*Ú.Mz|ú•^E6Œ]XǾ¨ZÃѬAÈ,fŠxO$®uó¤]2Nþh´À3Ãp±RÛK<ºÜ“9Vœ|w²)T‡Øp¿ÙvdQ9ó­r¯™×N)}Ö¾SJ’£• g°.PP`Ÿ5h¼»À,ý¾K! ¸Å3ÿTÉÉ´‰î–îÎEúáqØ UŒa•S¬ké\Èøþë‹$¥¼è,DrŸGÈ<úª‰­ -Cð}A֚⇡çáƒvó —nç +åhËÖ3°˜xP +?„áÎW ©Hª¦_*¶Ò`ç$6KÞ4î“Üåß×|לC· Fù1<@¼ÉòhÒ&‚@Ì< ²¢ê…pα€~ÿNqñPÖßW.[NÛÂU1òX1s= >ËŽh¾ +«¢Ig.7xþî4úS‚¹÷ò†$ßÝ}g°°• ${Í@½IÉA&lœ’FÇÜ>¤y¹î{bÑÂE (hò1™­#ŒÎ®TÜæzQë<,¤Æ↊®jDõ&¶(V ?PûËCàQM;DÃc&½N7 +³,6<’/ÃqG»WëŽÁr5Ñ›2Do˜jÉYE®óÞÃxŽb‹Ö~)à®o~œÀ®ZJLÛÒIâð¤Ö;†/Âni‡‡d¹§³§;Æ…Z<¨º—¦]UÒþÿ·ý¼AMåEÚ Ô<ç2Šp¥E"äq õ²•ÂøJ4‹ûIŒ©b†êNåÚ×v Â#åÃ"T›j”} œƒ1öÛ>%ïŒÐ,Z2Ü4V\$ÆÅ·@×ÒJC>~'/˜œÏÝ~–̼ÆÎ5’\É +ž"$÷~KÚ7Â2†âœ.© +¸Á@Îüþ’“3$;ÈdtiC‡·]I,YTr5r”ÞغR–†wà ž(Z©nÌ +c!†©3 d0Ž²d°ÙÉTrW‚±˜ Ch ¼€Œ‰ºóI§IµÙ‡…0ƒÉ=4Žf‚Ô™ò™vh.Ò¬%Ÿ^Èý·-™èQroý1ýŒFAª>¬BR½U\}Û›Îë2Ús.ü… +‰…‰Óq'×ãrçgÜ~½Fߨ{¿ìæＪ_#¡$µZµß#DC·Ü +¦ø={%r¢à^Õ¼7“SË ^÷; #÷ â‘NsSRí!&*Æ~ìdEqvþºOú¤Ó@”R>0ª~="s\·7Ç'©Ô·:¼€Ú#£vkêï89ÐÂkƒP¶è Í+NR×±ïoŸÅDóFBŸ4dÅæÌzÈÌ!?9ú©£,\b,9d ‹ì•6ã«ù„Ÿž²³L]qù)®ç:}¶÷ ó™ö´ðÐg|¿ôN ”l=Tû7«Ä²:ý›_VŠ8¶­tH¥»K%,O¼ÂîEV<‹¸–x7¢pø¯ÔþßØžZÝö• ·p€2:‹¢ð¾åUPt$Œ,:“8n j~:þ¥öîahV~2­ö×¹Œ{E…rBøa¿Ìc ½jºnØ«hÑvR©×ákãÂx2°ŽfýP‡Xûå!— iÄHSŠFÝU™)nUkgˆ\©$.ˆ2êºü™ÐþeŒpäCmø$o¤·HŸüZó‹,‚äûNn~o +.»4DëÃ*FƒC±nÐû¦,™¾'8á"Rºõ³ «™}Çwv$Ï!–ô¿ +Ý®’â%{t)sY~/å¼®àƒJ? –û«Êº\oÀö« ÎÁ>´.šóÉlå(åìh«­Ãßš³«Ÿ‹|HN<£¿—Ÿó)”’†Ð z=•}‡Žå[¶”°¢Q×Ù.Çl„Hh0<<º–²Q[8 ë°¿Z²üœÏ¸ùn¡¯âj!F`Àö™×<…ç1ñ Îz¬]œQ¡Zëtï.ßY¡?ADN±3'ŸøQUý®¶G&g85¶v¾ÙEMâäFæ—¡ž¹ÎðêùõíÉ瘣÷ÅŠYq9 ´Ä“)Sû1稈Ïvx%úDõ°æ,­Âœ–)eÇÖ‡—ñœkÂóŒN²xIñéMT6¿í;‹K ïàRÏDïZ;Ü~U‡©Ö]T^\áÝšUDÄÍß±Å'ˆâIð8·#¤œ•µG5éw@1,ȱEÅÃÄŠ,nËPA0¦œByï7Ë‘;½¡)¯Ýý“ ©.™ C˜4øuØ*Îzß}‰Â5ö>ÍL0ý†Q=Dé0OÑVKŸÈõÁ©Ñlëø¾…såѪŽ#œ ‚üɯ4…ÍzðÔÇ~²­ÄSþÀ°¨sìòiˆ—ZjêÖéeeH"!25Èà!•p,Iu´[xíA~ÐR;-ãYxk< vÏÊÑŽ†òç2'B,œÉ‡5vßâ;¶Ašô '\'eÕì-_WUø„õ¨¿ó[£m%•¢ m˜±¹¨îxH-ÄìD~ýpE—~#}z 9ûœ>œ”¬¾FvÿÎÕ;!unŽþý¿{i3#fÖyƒ§ñ"{íÞ¿r[é:>@ìÙ¾)Wó [f ‚¸ÅùMx°¨—ʧŵ5èâ³­:V¿Æö2›dVHŸóømň4½Wº‘º®÷Ôæ^ˆM9µ±=•J†%6šu +G¢²–n"G‰±Ño7á^Pþs‚SìZ©ojlU5‰ÿ°ö R þGs#z›î+ fÉPÞ~ Ëq~1ÜþÃþ"Ô’Hí8ãr'@Í\=*N=jânyåì´„UÂü·Ù¬…Äx">ƒ‹Ì§Kš)úÂƒï® 0E*3è´Ï´zÖÖt-yZUfvÖwfá™BÙŒsO‚'2ÍÁÉsîÇ\_FÏŽÜó +ÏÉNòo Ÿ3ž Õ7»¨o.ˆÞ érÚfß"©’ˆûL³éyfŸ¹%¿ÂzVwÝ[6[ùE= ¹¥Ðó¿Í¶L(i6 „ ?êÙBŽ¦žðÄŽ<)™Ü›k¡IÐ'Ù5´_ɶEäààVPæÙd'BJ"´Y8PÊÄbz§BRæÂ;ûèJbÊÂH­¼áܧÌ;Êu5ûà˜e/"ˆÐÀ2'èÓ„ûÈ ?÷v¥.P¯­ #ÄÔÒé%vÔNÆïîöx¼£­qgÛ3߯WCÒBÕnÝ)»ÜÇ[kž€ÖF.—Íe‘)-ËûDkg¯gu`iŒÉßÅ®Ižs”Ò·_y “·Ú0V[¥å¹Ou®ûÝ,d“Â,®"Ž7¤ÔzÄx«Å,GÕR@aáÜZ]Šy×Ïä`ypÒxn6$DÊ›[rS1Œ½}üŒn¯CYÓÀÍñÆ%w¬foy¿cl±O‚{仂„(Ú[¤™A˜…‘Í›SÂ6*³&¬× §©ò›Ç¢8ÁG¸•]qåæ+SL}^pôc·Hõ^Ä +&Ãý3U#Æé÷iV5¤±ÁG‚7ß\Ê÷kè=Ù vù¯o9B´ÖTOw°u®‹Ù½z)õ¾ˆF v$ Áª.*(~X¹—dë ü¯é6FÔ˜@€Qyäï{e¨°•çÔæù ýí,2Þ¢h¶úÅÁíሡ ¸ŸýrCƒ²’Êù6xjq3ö¯·˜'Á1±©ò;òýn”¬hâv@Ž9aÖ˜¹;³ïÖËH³'ÉÀc²œÒ£!sžV%¬ ©ÆÊÖãÉ]í$G•@6 +?tpï–öx¶š™’ÀÎ܇¸Á¨Þ’vAèœnºîáÜùŘÎÙçQæ:Ö;ja¥„¯ÕýädöPÝ}'°sìr"ò¤œƒò.1x² +lžp› KË\’¶îýYbøôIÈfMaÃm>p'ÛL2!\Yn!í9öÉ_Ôóú§0vs‡¾BWÙê@’¶OÍIý¦i`P`žµúØ× +){pBwcZˆð‹Í[”Ο›¯ÎB<5¯Ø£ÊÚ ãýɵôÌkƒ&;å‹œ¾‹(7×*÷ôè©é&´vvš"·Àá­_¬H5×s‘˜eîǶ»Õõ¶Tj",Ñ\cvIáƒõCFD sêv‚±ßøîè.÷¤A×Tt;mWd;éUª´5Q”˜FÊËߎ2½v›œ+o(Az¯ùvE žÉY'z|bÀ¼+lýк"23|±k­©WÆ‹0–½ðX퇙2Ôv>ï¥`ÉÍâË…œ2ªÐ.Œœª†Ïálóºu=Ñßæ²2±Œ~f°éF¥móƪP_ÔÏúÝ <µY™öîoýFGå^)‚ˇ~ÑH¦8Jõ[fm1_?…½îµ¹V³†Ûש¹ÿÔíAYU-„š¼ÏÈ:q>1ŽJø Ñ ‘é3ò¤õõh•KãñýØji]íoiq/àÒÌbKî»Bܼ=Áfùýùbø|Lz *ž»Ï°¥C³†[áêÙ5]6D4˜‘°7ÒÇšFËPcÓè=ŠQ#1ºB”âŒìà³­ ¿èàºÁºå"[ ÇŽÙ5Áa+D%±Êq€ þ†q!žŽù´vØ‡­–øĸA@;ú§0G\ƒ,«7+zFÝDdf?ÏuJe¥Õ$ôzLIOÆsÖ_[ÚXŠòÞ®z¦îAFÑtÆ®£'üN¯~‹2:)#ïq‡œ>–ˆÄiª)@H9èWA +õMCûÀÈåZjk¶Žw³2ºº…‹mX6»g,œ¡Ë‹›S:™?v˜ákùT¯ÁéÃzžÿDxÔ‚t]?¤ ŽÑ ×QaaÝd‡×ëbîãT +;bZ; ÐI­ö``¦ l^ú8>ObaHoÉ{ËdôHrzzô¾ªcF¤È>-2"O@x;½tF@çz­ƒ?°o–<„ö’²@0òæ`#ß!u;ÆCg’d°’ðó ÿw•Gé“0Ž;÷•NêLÃÏ*W }³|dOx²­»ÙÍ-7¼ÐQΗ'V¢xHó;&‡ÔÕTÓü…×$ã¼9G?œã[ª&ÙÕö5·ÂÐøƒâóù¨f:ö+†»ýA€ÒOþÁ­¡åÃw†ä4–ëIºl/}4/\ÞžíÇ’^Ú„‰î.‡Tð¡ ØœßàNïx¥“¿;Á}vúÖж!r’ÛµœNÌ2q×ÚïüBG>z²°ð~ϤÎe'²«„’Øgð3¢É鎨Ao¿iJð˜˜× åGœ_®ßþnøNOz_†ç¿W4Q›§³”ž’0`¾=úç­×W[bæÐ5~Õ×ö:dBº œÞª=ú%82 +°É­ñÅr=/+/™•OÓRœÍL¶š"¬™”a²·¨âqÔÂŒñœLÙô¯IÄ¡bþüѶÛlYÖïdûe`5>¿9¥”—~(½ÏýááçP ö¥KûÜ.+ú©‚þ:šaî]ÅÖβrßà§Î¸{N9$#ƒBVáCÅòUÉ]F§€M¦Â®—4•;~€·¯k9´Ö™ Ï/ªu6¾F +ûq;¦¿œ"ý,fbdÖÊDX~º½·F'mZ|ïë­XÓWO7ÿþ8»{øðqá([$ÃÅ0YTòíkÌÞ jqêÀ:kP²ßëƒÐzŠJE³i0Bõ/´ðŠÄÀ—~Ûà ™pAbÎçyE5Êœ”oå—až)”Ý%[i âJÚ¿/3%"ÐJM¡ÃœÆ-J)?Ë9—óIMq†»{ÐN~ů,ˆ3K=—_O<ŒÓŽ<0±âDnÞ^ø°´<6¯É':Öku&žž”™õHZª7/ +ÎÁB“föòÓ¶¡¥àô¿v–í•×8½IIPt;×~뤣Óòœæo œ$©Œé*^Tß×X2Ä3S‹WE8o@Ñ°·Qu‰9F-np# +þ½‹YJÝ ê¡ gMtõ|â¾KÍ/ä(!¦]O›óãZGÆÍÆãrQPÕJƒ[.°ªÎábv»úøõáz'ûA6ì‹ö·Ü +6:âåÑE˜>’°áRŸtkË#@ê@iŒ8«d`hpÁ©Dëòxë¢wÿËÓ¸E…io[~¼Å*üZ‰..”ƒó¯6´ÖM -y«OV@ZÙRÝÎÏaŽÆü{Uzsjœ2ÂÏ>ö¼ Äà»K±èak!tb‰¤¬ï‡O,øŠ?–ëáó p7—êVm­2ÙIf¯kvÔg¹‹£ÛŒ3Íè¹DZ0XûÎMï²i¤­ä¥pÄ—.fo3Έñ~a)è Žûø$W|ä1ᮨ£"¶‘H·¯ d€Q Jl¢lvEú€[AÍ`*¨»›Òá‰úfp¾¶ÎÔ±ýÂc͹)íð&öY¼Ô[ˆ¥o{™£ „5«M‹fyM5u´ (?Œq»Â‹’Ëü˜ÁN«‡ÙbêY;e¨Òì‡Ú7ܧ*ä¤ÿr*h¾6Ë<ª!s„÷ul7Pà"D”6ýLOØæaFjǴ­ä§×8åj!‡<ÏE]4'ªç¯¾É•”_éØ®ºüqS‹EuªÁ(‡5Æ“§q_J‡9×>ð(BlÜ•KXBLÚëZ¶“¶¿ÏU§p›fJdt+‡}Þ`V¸{ÅžïJ>/Cè0(Ï,œ}RèCÕÓ1vp—ïºÎ…@ºNå>­_ë…Ø¢2j5+¨{x”@¿RF$ +c u]°qÄ<¢C÷®Ý:Ýx#6fà ù¿Åb¶3dn‚™åS†Ãri·oøcPö¯5½|úH¹ŽÓ'#ñ1rŒ¸ýˆù7kÙÈ÷G uÊA·*yæ7t#‘Ï!ÆkF.lÌ~ùÔt½ùR™û¤è3ñe¯$¢®âS!aõÆ"† +ã>핾}âÔ#èÓX“¾„ó¼@£²6þšôg\‚Z¢yµ{[×ê(ÙÝÃàóØ :ˆ¿ùqè'§§g4’Õ‚F8¶Â°»««7P”äLºÜK> ÉìáËCTLÛ„¥¢Ç ;¾·¦¯\ƒœ2(á2Îfˆ«sÀöYaÔË(‘/Ç òd&Jä€`ê8ä~Ç2G Ý®P|¾„¹w"HxÚg(ð¥5ŠÆ¾E‘j´§šݹ +ƒH²v$±tʤÉ{·ÏÞüŸ2-’ORçBx\õ™7mÌZ¼ÓÚ„™åö1õ¤>ÙϧÂB¥\/XUík“YŽSÈ·Á‹ö85œ†z–ùNSÎZó;]ŽVì¡«¼Îøóëb:V Bößd”vNI!£#¦ìêËGŠÔËÓúvÞ¾e6²ÏŒènú»ÛÙ¦DnÉ÷ߪØùÉ/ ÷î™? q¯Èû@·HaWHaoM²üîÓ +B&`ÑÜpœŠOGTngV%ÁÔº»èxPkàe„õü@ï(Î[Õð‰Éh,Ü•µ¬µÀ€È*zËÞ0H©Ç£¿Òuä³–4ËT.;T¥ó)„u$m“¸ßÁ«"è> endobj -898 0 obj << +953 0 obj << /Ascent 611 /CapHeight 611 /Descent -222 -/FontName /XOUGVB+CMTT10 +/FontName /MASIZP+CMTT10 /ItalicAngle 0 /StemV 69 /XHeight 431 /FontBBox [-4 -235 731 800] /Flags 4 -/CharSet (/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/R/S/T/U/V/W/X/Y/bracketleft/backslash/bracketright/underscore/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde) -/FontFile 899 0 R +/CharSet (/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/bracketleft/backslash/bracketright/underscore/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde) +/FontFile 954 0 R >> endobj -1788 0 obj -[525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 0 525 525 525 525 525 525 525 525 525 0 525 525 525 525 525 525 0 525 525 525 525 525 525 525 525 0 525 525 525 0 525 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 ] +1967 0 obj +[525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 0 525 525 525 525 525 525 525 525 525 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 0 525 525 525 0 525 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 ] endobj -894 0 obj << -/Length1 2181 -/Length2 16529 +950 0 obj << +/Length1 2203 +/Length2 16804 /Length3 532 -/Length 17761 +/Length 18067 /Filter /FlateDecode >> stream -xÚ¬¶stݺ¸ÛF㤱mÛV“4X±mÛ6'm4¶ÑØn¬Fßz÷>g·ûüþýÆÊXc]÷¼Ÿ9¯©û ‰’*½°‰@ÂÎÖ™ž™™‡XT^…™‰˜™‰IŽ‚BÔ`èlag+fè à!fææf!–ÿxØÙxØYà(ˆEíì=-Ì̉©D©ÿIâ$¶8ZÚË:›l€}Z«Ú[œ=ˆ…­­‰Uþy‰Xàpt˜0À13›X;Ì,láÿQ’¶5µ#æüwØÄÅþ›\ŽN@)bªiR%Mìl­=ˆM¦pŒ -vÀÑ@—ÿ?´þoç.ÖÖ -†6ÿtÿÏBý?͆6Öÿ“`gcïâ p$–·38ÚþßTMÀ¿Ýä&.6ÿ·UÚÙÐÚÂXØÖÌ@Ìôï…“„…;ÀDÉÂÙØœØÔÐÚ ð¯8ÀÖäÿJWî_ -ŒÒ -:Jš*´ÿÞÓµ)ZØ:«yØÿ§×’ÿÅ̸:ŽîĺLÀåe&?ÿûKïÿŒ%nklgbakFÌÂÎAlèèhè<=@b'öb&¶°5¸ÜÂŒ ¶vÎÀGˆkâCljç÷φ÷œÑô_±# -þ +­ÿ Û?ÉšYÍÀ¾­ mþ„€).vÎ#ëïýZ؉m]lŒþ9:f¶ÂÄŒ&vÖÖ†ŽBœÄŒöGc€í_OsÿO¿ÿÝ)0ÕÐ`k 0ý+Êü?Ñÿ“ œœ¡Ó?]8Yý ç`oíâô'œ±áŸÐÜÜÃÞðÇšã_Šv&B@k'kC'ó?.bFO€£ÝŸpv¶€ÿ0;ÐÞÙíO;;ÐÛÙÜðWÆ?ûaçògmØÿÙ ׿2€ºNÀ³òÊ:\ÿrž FÀ-;PÕÖâo®ælm÷×CÜÿtccñßQ  ÀÁÅðÏ‘à`ýg_NÿÔ¨?A “áŸá8€J¨#ò‡€*¢è!ö‡€âÿ!NàbIü! ‰ä.“Ô:Iÿ! ŒÌºÈþ! ‹ÜºÈÿ! ‹Âº(þ‡¸€.Jè¢ü‡€.*è¢ú‡€.jè¢þ‡€.è¢ù‡€.Zè¢ýâºèü! ‹‘£¡±Àù¿®7ëâÿ})€E™ñÏQçdô‡€ÿ¹ýLÀ‘LþÂÃ_øÏQý šý…À™›ÿ…À©ÿUf˜€s·ü NV!Pê¯"Ä´úSp˜…•Ñö/ZÙý…@+û¿ðŸãú­ÿÂîÎ_´rþ V.!ÐÊõ/Z¹ýUGVî!ÐÊã/Zyþ…@ €ÉÿÖŽÿ÷e""bçîEϬÀ/¦v‚›˜›ƒÛç¿3Õm-€WQZ XW˜˜8;þOÔØÅXÿõ¾©þ—M-€ï5À` ·ºdgÌl™ÖZî+^8SI*bÖ¯ÐÐ;ß´’j]2&ë@³Y¯õ»2éòÈíß)²Ó[yRâ2À!>}ñýÐõëa¦g¾ÖM¦¼Ç=écÐrGóÂÝ9;¨âÜæxy²vÑ`ÎÕÐY•˜Úô: HŸ®kc_V0§–D¦µzXHýgV”t‡òp¶° 7”äDˆé _Ë0˜VÚµk»N´ß…0ùIï_1ãP;‰XUvi0TŽÏËŠÂPë>Fj„²ˆÍT‰!¨ŒI墇Öäxâ‰Ì^aO‰‡Ë»^Òµuj‘¼Qpèm–ì°Ò˜ɬ3]%Ú}¡|†ñ|?%N}âþÖ)›äG¾íéœä\£ñ…Z’±Í’ [g03kÓé.[OØŽÔ^0ùÃËE(SOØ§Ä Îbå·¥õ«¯¢<òÀŸÒI.vn¡œì€ -¶##a¬ÐõŽH¬CÍö¥ùhTù×9y50ï -´ T;ãM!•Ò*Õfáo¾ûÉîÁSì¦øÒ˜‚¹p4¡^†ê¡Lü‡ÕPeH -âHØP®®‡4™äß;jǼ'd%Úkaš^pRPNTG{Ï?|pÂëƒãEAŶ;1‚ìGO‡ß¾ò^®¬€€êUmÀ5>×}ÀY,³ Ùa굺¥t²§>h×bj;Ž"ÿÁb9w«(Ù$ÉÝNQešñ8‹}*'s.&ÔcS’±ùÆbÄžúÅØă$0êÆâ|Ä“öSt•µ{óa-tZ7íðK£ªËƒ4þ‰ö컄€ƒY®ŠŸ¢¸›,ÍÓûíÊ/cTÆ;²S»XÃ4f º$aápÁ¤;¿@#‘ÌÔ±K–¥œ˜éî -Òãp¨UÔÁÛÜôkàèÙÂJ<Ã>œ+öêïãÞS Ì9Pn6-ÛðÊñq©n]Ñ1Ðo]w3Zb ->> î1§ÞÝâñ f¸²^…“ðwj¯%ð™ÄVMŸç›XwbæòëôU;[÷¶QÌæ6èÚjm˜IK9EU!èO†š1­ÞĶPfÅÀÎ.>à1d?eÍÑ;y¨½Ÿ¾3”’ô/Xæ# ˜ã—§!Â^Ÿ*–:Sé i·S‡gàw”h¯x‰p6@âÒ‚”€P§qˤ¯™°kkCÂ&…}Ù ñ¼K)½iI)Ìdz_·e›ËìCY1¿swòŠÊyà40{“ IÜ/wk;ÂQ›ÄË]ŸuõîOÌ…&j—ãÇVB¢ú&há¥÷e(Æ@ãtVvbÛ!Ppí^HÁùüX H_I_J˜ý… ˜¢.‡Øæ‹áf¬(?¼‚wa…>Ù†1Gf"ˆï/$ØØ©:ÛH ô²§âkØ\Ì*¬suYù[¨«ivH€ëF•œÆÜ„¼ð#-ÓîW}æŽÝhrÝxgCÄv¦!‡¢ÛfȤ’ÆOÖÆÖé0TÓ'…Œ`ש~Ènp’ñψ—9Û¥VÐà¯ZT‡ǫÁ/’6Šg©È/V\¶CãmgAö²p‚\Ãöñe? ‡C¡_ñ1žNî!ÊÝk Ñb¢ñ§ÊçP4Sbô¦Å“TN—¿•˜Nè…„h3+ùå2 i»µˆj¼§ëبáŠîËFèÚV¨$&”ºÈÒóAñæ= ìI¶$r¼ùß\#!L½ì0´@wÇ(¥©±í’ ù“ÚFu–ô$ÕÖqòÜëËl$ºéÒ_g4kg×Ò7ËÒ~íîˆôÒ¥'µEÖó~ù’)ãüB]œr‚¦RíînXÂJÔo -9š²¨LŒö©ÑX’Ç»‹ôÆ~ѺlûgFD wvÛ}Áø4ójŸ¢¬{~²ì…ŽÞ®é¯Õ¿ÄTh'(¨éRÇî¯!2Lázƒ/ÁØÛó•â•ï86ažœ~zØìÈ•Î*É{:zcõà$CçÕ”VÆØæf·c‹PU©°Ÿ¾»HèNnmf‹šÔ—]J[Ëm¹ÖjíwÚY?06Ù<áW––R·N›eÿ­ QÁHêå RäH=PÆÃŦ9Ú±,{U¶ž›ÚƒtsIÇÒµ½aF–ïR{Ç€F=“¼«oJs¯;õÙáÙ’à€^Û…¡#K–q˜ÚPXž_qsΡ1¶æN-TØ/µh.Q_o †+#³½}Àaø‘ƭ䶺†Ù6óm+Sð«È¨‚­4]ª¾BˆÈw™ûz\¨æc™ÝÚO0({Q¿OrVzžvÄgò\y­Ðe( -& ¼múfC!¾œÀ—›kÇ|eXµv,"Ž%ùÝ ¶ª—/³)§W5[JkÛKèõåivk®ë~'HPYB{U¶þNå\‘0åPñ˜•/ã:Tµ ïÓä -WD½ô‰ ÿm8Y¢/E³`–Á«ЭÂP`z|Õ áïˆÉÂ?Ø¿FÄInî4…“ þ›/•PfÒ¸ì±v;ÒlS®á«·íªüÌú‰‡ë.Œ¡_à€0HhQÓ¢A6k¡?:lžÓ rgªœ³È›¼Æ–·"½\è㔑•œ5vëµ–üuÊ3ã—’ýX…0“¯B¡:æKÏa€³Ÿ6—ä --L_ºšè†U?Fò¾“wpwiÍìrG‹ù½ J)u]=ü¬5@&6Êoe{“swo<ÀP ­ívª3<&v2—C~)þ³ýj¶tòñ™Í[K³çÒsëL5ªŸÄ ”³KS¯çö'nô3<â8'“Ð(‘¹”MG©ßW–¿ÛÀŒ»ŠÂù¯‘íıÉÍ™p„Žøúj7SsŒTÌü~f©(åóÆn€I14ûöeÿp1^åfnB:ÛðØ.ÿ¹ZWãÆÀo½8Êt¦ºÃß+t¼¨qœÓÒ-ì{-ŒM$¹hZ…Üt~j“ŽŒû:"aÈZº S×XèHœ÷åž*Ýö¹ˆ•÷™¡ Tmvz=Q³“eïà ±èP1}h\Ûò ÃÖ/ØÀ¨ºŒ5ü[%Xì5ÑhX„«Ð…Ò€ð¤Ö”Ëå_^…‰§LŒJí®*JTÆãvüOE7/§B^kâ$èlD—ûîº&×¾ÂݵDè”ÈxøgèÐøȬìÜJyÛÇ7GYÒg±÷_ØìúsIìê g«!Õ/–Ã_„&ñ·7e÷±¦½´34ah»WêÅ•7+±`Cn-'«H–Ê«±daT åÔºÅÕÄç]Zõúªè “{ƒàµ‰sͱrª.£™=›+7Â?V ¡™Êg‚OvDIm¿sÕÝ팂ٷ”5òM0Æñꃞ€wj ±¾‰C(.)èÒcæÖ«{<¿¡nX/Ü~èAÕáãÑž¨Û3yr2LB¤`qA¸Z'-}Wó¼äŠ£aO?ÀÝ[@W½­l¾9m1[ª©°]5!l8ÒçÏ•ô,˜vG–œDá+õFˆüþ«´GLÔ²À"zÈæGL›jÒÔÔ"¦©Â˜³LÁÇgFþþuOb'}ï±´÷u‰¸£¤æµ³úûtŒtÊæbž]b㣀’Ñò5Né};}\jµ¼¡R̹üï!ø a?xSí g]£pð«Q´ò¸~÷®Ë±®ùèVô}ãGùÚ›É~±¨Ü…É6¿ö®µ\ZáñÌéx9I3|=› -Í[®ûòlõ}¼[ÓϪU°Eì1\r!«ûëes×±”——M× 9žKì|z -@MÖ'¬´çUØa6PŽJ;p×$Ú›õõk%1®*´!EOĉLiù],Â_²’?´Íâi½bœ²í˜ÓDÐM…ÏŸŒ(ЈÁUõ…¼lJ??\ ¥)2©-,‘NЂŸUü¥Ã'p½/_qº€q>wÚJÊ›v‚hþõÊ=•ZŸŽ²$¯­µ÷+ î¹™=?BõÕ—Þvø[홦§]jä °‚ÆPiøbu(ÙÁñÔ›Ÿ !/Ÿ”GAm†Z¹§ÜÄvƒ:¸‡Œ®ÙÐ ^:köaœ- -iq¿bËrE$%Ȥ²Vr…¤ß*#Xp•´ðz¶ò%¢¯o7D}­Ìdy[Ùf6óí°,¢0¯ ÒFL‰Ñæ\¤ï -Sæq”chÖÀ&—ô²²¤žú˹;s¶I -Ó;éÞ»¬ƒ­nüuÝi_ DÄñÎG1÷-f}‹PËè`ï?ÈX-\A¨l){ÛÏ¡52½å¢ —Øvêô®¯* fÊÀ‚Å­_ .å>o©ñŸ߸?— -yH -u€^ˆ WéÄùÌ9I#³7éICE¯ˆË)žŒ%t±AŠŽ7Õ§èE‚’¦hÜ”lIzÉgf¶‹PƺÜôN‰‚Ýú&a…ébÇÖÎCVöÕ~aLr7”I'^âIKb¥çHßðl ³Ÿ5 îT©º›‹¨Èš³ª+Òb8ò`0ŒƒS|]eP& ØLÏ„Iу"ÝÞÂB¼UŒ¾‰°#-Ý÷zn+‚DaìFPažš«^ŒdÏZÎcâý”ÔOî(Ù8þ ;¬ÏÙAþ -8¥ô5øðÔ—Ú=—Ao—ìâ—ÈÞ’žuåË*0ù‹¯¤âlv!&êN?rø­æõ¾™Õ%”Íž;^3-pxŒ/Oäa³¶Eûx™i}7Q(!è>ÃnÆd7,¸$òE`Œ= ñiÛqøpÙ¸B·O™šQ°VžÀ€CÆMŠ ¬ˆ³{¦'ˆá£ì8賓o( l!±Çúº8Ѻîuó =âj¬œ*'¶NPf”æ z°¥°,‹JÅÜž+9™"ÁZÓ!eœ_ íž“zèù3Ïö(”S -¿;"¯´¯ŒHb½¾t¹Ø¨ ¬õoÁ¦±løƒP^ª)BÅšá=§1›ªæ¥A¸ã -"J¨ùîñ&ZΓú¸u³Þˆ\•°wƒ©±o èh¶§RºñiËvF$ì¹&Ï~°Š!Y³zÐ?š/„ès1h6Œ×êÿšöµ¼“ÆçK^:ßIµî¥Õâ¡wƒG‰Ž”ÃŨ7ˆ™åÈ3Ò·È$ª_cç³A¹×oRUŽ%Iô£½æð>º±Ã8 VsÓ7…Ê¿}¿—J|J#Ó5Þ¨ßDå• 9ÝD¤ê¶ŠrëŸ D??rðX·w¹&Bô°ÏýëÂϾÞî—Ö+¥1<,Ö©x„¸I^{Dã{‘âÝÉíÒ©3°ÛUIqd?ÿAuÊLz wÂS­×(¥÷Jq_ùû°FÓÑèwæäÚ';góP{~/çÇy+ ÕÏ¡d\Ü°¿ › …`ÝÅ "%8Ë«ÃéÆSòæ…¡F§‚#UCÂD i#-?%“¸1_Õý"sðž,ðå¾—W¤ÒÀ±öJkk­Ô”NSÔe˜ÞÜŸ§ŸA:ÛŽ—¬A“k”Q$ x9,\2JéW|u+×í÷·­~á/„äܺzÝe¹ò[Þ…Á:3ü1ñÝÙ’Œ¢ˆFx­gB¦ðËùòÙ¢¿k’æÊ$¤&Ôü•e-{ÍÆ;©Þ#qÃ¥„ðÌùï3ÙÄ"F€_Ÿù«8)¦JTä8CÉØÑ03wH²8=V}1t0bùÅÓ÷8`žúæïQ=®z¯²-æ‹X Ÿl—‚Ë3YPcž˜šLåöÑ`Üqžcºä©G"§y¦uImé „g8Òh±óL<ûÐ¥3 40é¿ÃM_û?„L­QÕ½—ôµ³Èd¢µµÅÃÿf@§VŠr²½7ÇuÛž,1^ou{†nyN5ùíÁxÞ†J–0Ÿ*³¡ðþeýQ7ÚÒª·€4pþ™ÑãtT"|µä¤lÌÒüÍcº™A¬T Ÿ]Û†.³oï·!CØE{¦ÇÈc×d@»Þ¦ýâêQs!B»éÞ„R:Çtª&¸5jÞó¸®À»‚¥E»:_@‡‰(÷+*•–cʈ×ÚX[÷¯ÌžÐïÛÐ9ÂYqòèoñ·yúÌÚå±EUåÑ\o&Pi© ÌŒÚ×?Íé8qÇ‘ç‘ Õ›ƒÍ!£$pÔáQˆ¡×,pߘZKT÷)XóoÎŽ4ný½+„P7ŸlCÌt‘äýåB¸Ò±yúàsÎ7 ?Iï\këSQ lÏŸû!ñ&œÓy°õÅâ™àPV+¬ÝÞ•Ô1ˆìÀ×/íÞçhÝ=¿åÞ.å >·­šJÃ[înBèói‘eBؽSÎÿzì?µ™jn0èÛO4¦x\{?ÐA?¿:jÙY3Nê€ ¼ìÁøÐ< Z¦tšÙáfM…°£¨”¯¨QóuúVjÖZ“ïÎFwÎwE›>ÅÝ}Å5àà&ÚR õ½ô˜q“"t>Ê‘øŒ’÷mö‹®_VgÊÐÛ²Ê/víû/©{ëW ˆÖ°žŒšŠôIÈÚщ#Ã[´ “)Y…çî§Ñ_ ¶mxZ\òÆ÷°~S¤ðÍÝ3,­¥3jÂtróQN}—ýE-‡¿D -'ù³$­#ÎêkM™æÃÄ… ”±ÚuØÃÇ*˜Q½WšÅÄo1FN?8­@èþ‘Ë~¦¦²ì2ô†”ö(¾dÅöOgFF#üà~vÚÁÌQÉãí…JÓX§Ý~õ»oôQ]ùþ`òO¿'/Y¨aOœø T0™–9õ©:©¹SRqa_Q0 ¾€¿(ø¢¸Ó©/ú06ý4 »Ïv4•ÝÉ!„‰­äýTå¬}‰Èž8y¾††;{7;S–;Ó#A¡úX¡óÙc„*>ëIRi§íÒ·z/ƒâóωc¼Hg¯e í‘~V2`¿C±gI0qx÷Ó÷-9ÔŠûB$Ð}3æ–HÒ¸9LŸažŸËï‹í -9JìéHH$kDæu`[v2ê‹‚FMµ®î Q ‹»UñPÂ$!sZCiÖµÞ¬íÙ$¶R­ô–'k›QSÜHr¯Pì­^¶Š)]«Ê¿M‘ŽŽ1}K(m&5‡eùð®fÌ?dC¨ée‹®âk6¶=ŽÎs¹?K¹c:v Íߟ²/øtôMRÝ4”DÉÃïû3òÔl Ú~"l7Eg´º„ÆJn¡ôGØEiƒoéáÈÑõRË'ãB¦17aÕä×NCËw,T>Ÿcâ:(T¢óظLÇËM÷PsùL¿¥Gë†Þ,tÀí àÆ"R¨é‰c3¥Z™V 9©]Ñoå¶õ>s”à;&xŽ½”)å{oi— -¯`?-ì¿bÃyévJb{xû!åœ^,ǦÎuõ–DÁHöW›öžóB)t›+{#y’½ƒbp„³ñºÓ&&‡VÌýJ3ý‰9Ç‚T²šúN’`bÚ!gRÆ_ÄÁj‡ìüãàòÐrþ'”ÚÖ9ÂSÊÝ~—M?Ü}òu_`ÍÎ8á0gÚ…®°p—KÞ²QñèþxiL4Š¬uR @ f<OcŸF ¥z±å½+ýhjôӃċÄǨ†³$¶ëì)|` 9¼.Òàa­w"µz$\¿&ÃÛâ#µ8GµBT®3»!™«sínc&¦ªóº%ô@V% ÝYÆkµŸQˆí~QnþÝô‡ÞijÓRÝ)þÖV›¾çÄMaÿ¿Ï-öÁòˆÑa. -%‘!öP¹/WàBjt{‘‡¾å‰ß/¾&·1”ùÕSOoÊj2ÿ›½{+ψ¯š•ãf›„èni:ç°àúÌÙƒ"(×RÔ»xv,Ó(^¯B€NêD™$üœ[[M&qèÂþ€Ê¸RÄX±Êó—!öž¾à„IºžÍ·çi¬Ç#hy#ƒ¾£D­œv|b³aï_ÎmúñüMjº-Ò(éÆ Uôv‰*äÎ*¨v¢‚Î!$ÏñqˆHÑ_=Žü"Y -lBRûµ.¤¤èX“¤å(dz+MñÉì”ül†±ÐqO¸0‚‡Ö4D9…-ˆ …¼¯-¿AçÉÓ¢•%£ù”«³Ò§Pö‹FR&»[Qh€Ô^²Ö÷ÖŸ2IXfb¬{}Ée#e9sÑCX×3.–ºšãoþW ««ÇS9vpÚ ž;3DHú¢ @$1Zæ!/û¸‘¶E(Î%ÉQxn¬{ š£Ž îS¡Ï¡Mä T¹‡¶QsÄš ·Eqàjè -¿4.ŠHØR•pa/¾ôÐÀÙ+§1»9UUÂl¬åãÙ63W–äÆUdÈޯ饚0ùš¥?Yq-‹[H¦ÄźәÍÒÞ&tɬ±h£WÜH"r»¿L ‡Øþ¢ºßåäU6ÛIö”f–¦ŠÎ_&pYQØe¶É—¥Í¢Ñey<î¬ùµüE5¹ôR %ÿ‹¼K$vj ?j=‡ý§ÿ MÇzS+åœomð‘ö"?0Ÿüß1 ³éÂ<†´s‡Ð åûu·³h=ðÚ̯‡±Á¯c.a ×LÇYiÇg°™cÔ‡–%.òn] |KÜï…Ý&Õ;‘!#[ËÂ0–·ÐRˆ¿-N:6ì²ßí5\ )"’E™ì¯m®ýcµ>=÷ÉÚeµ@?)Ƚ6i3"™‰€†é=)S -Hml€·GÝ 1“ž$ Ó?Îö³FM´†°L½O¯­Ìsæk ÎQ—ÑÜo}^’÷ñ%ñiÆ´ÜæB'j°oÙJÖpÐÓýÖü–°?!£BüÆ»é\þä·„}²óx%Ñ PM¿îŸj‚®Þk¥¦º~« ó¡Dò‘rÝ_ škf¶â08^»³Šc[ÖüZÛ ÖšCo»t‘‡"᳦¾Ñoz!Sù“üDÁúv=œ%(œÏ‡ïšƒ¹÷Ýx”©ðdäO—0¸:åýèÜ$˜DªGÛ-ö2B5ÝWr1æ¤è ‡ïM.K­œ±ÒcWdU¶Ã}uˆ>‚ÙÃïØûùBW¡û+°(kÞWvZèCì>!ž -c+:Yj -;F"¢ð&•º8;÷Ãûe)/>È¿£¼Ù®«àr¢VŒ¾ì69t% -Uͱˆ™‘,Éì!Ù­#Ì‹¶Õŵ÷ÈH+©ta¸A¯TõWCü¶½K`0;C/¢Å”XmÕºÞÙhrL£*,5Y&¯ÎdƒDó×îL©P~γ,!i¹ó·æF{ßÛƒ,n¹:ÈI›“æ Xƺ$ê$±sµî8YҵЅ‘[(ÖR(€ƒ úõîcŒ¦išåpêˆAëÑÝ+ŽÒD!…[AÐh˜hàˆ_"I…-ˆ†aèô9µ7qWh<‰$Ä}K’ëÖß úÑPÄ¡‡Þ¡~^EâvnÒû@HŠsP-a}­³?XÐØNÝÀ³×9÷!bäSå-¢«à¸k+žEÔµ§gR§>ô -˜B[~·Æ[·v§_ƒËÄø‹-$ú€Ð &ëòÒŸˆñnS¬ŠÖq-†YlƒêúµÚØJŃi<(æ§ÜU -÷I^·Ú--€Äw'劼Õ*,Œ±êŠ™F¼¥Þ†ãR`ƒæxÐJ –âÓU½óŒýÁ+ò½^°¶ß;¥M £s~;úäËJº2¦êÌ8ÎÚ‹2Š/v"Óxݸ‰öòÅRˆ¹“êý)XÜèm$íˆ5ÌÝ[2&Ö©ø§o}¾R{/Ìgb5î<)þÀ§/Ëo¥üÄßD?©O=ó8R¨¤o½6‹Œž$}¹Ç);•­zHÆúÊçªã„ .·äöÄÇCI®Û+ñ©©ò¤\(jŽÖäḃ:›Ð¼SXîx× oGIv¼·ß¸QËeÑ#©¥4«ùH•èVyxƒNe•=ÏVÐj´|W7IY˜2ä&x²!´ùwü4|謩¦ñµïq®ô´ù~¯=T*vn¸ƒ áh1ìï8»‰Ù­$aj·è穯ë+À´¢§ï 1¶èR}NIç´LºˆKß^EKÌÄÑ= ´†'©ŸlòWå“[ün37_õõVbâÎ †±JÏüK› ¢:•Îåx^çZ(õÓ¼ÇO½‚úwZï¿ô]Ë·½+šÒ}F‘k¾‚xvé^=³:DÏê“T©–Ó‡ön+)>}4ÚÇä÷E¢Y¼—ôë®"'Óí±…H«cÜÏDê¾;7ô¿rØ~k· ž0EôrMÎñÏT0 `þ„¤¹&f¦Ý€sƒ%P]±j¦E¢MUn¹Eß6³Bé|ªDn3÷€) ˜O81¤€Y5Þ•÷Ö¯ƒ7¸Óï¬âøû5ßJÌMú¨9‹‰ÈD)ßTOèÉÊ<ßjZ7åùy¼{písõÓpdkOûÞwgöŸqýÕ„³ÄË>ý±ÍSÚñ¯xWèîC­ÒâìfÉUb~Ó -ßgЯ” áIn:v­Íz¤XCYKÚ!ÍŽ¡̺©çÖ¤°d2&–H5¾g'¬€äÛðïüe×Û!b*(WyðGM÷³ËGìÊI݈DÐþ+ÙNö½ã /‹«·d½4Ü -/6ÜÉãe¡šbk¤JÍPò°q®ó«þÌè7)OrbPØ^B&—„Ý‚Ò8‡0IˆMó3qYëZ“š„ àRjñrߟßhQ7äˆü„âpÛ‚#s]ëkæë¬j|ãUÚuMbiÞ³s-$œ]¢èpÛ«:Ÿ÷ - m¨1òJ+¬ú÷Êyx…쬾ª—ËUïÄAe*Œ±œôÂN7ËÞ¨ 4²l«ý[§õýw‘¿.H`£n1Ä{„B¿ßn@ˆ«E™Ýå:Þâ°—vå×–~D´ÏtÔ’ -†¼g2·héKwûÂØÖ°ö½ØZøf’ïR‡)¶·ëytMW Oz-¾¦ë>ó§ðkáÌ`þbÈ’ ômÎë†ýÁÒÉpÛ‚ç=Ù‹ƒeÇá?J ʆ<œ¼/¸BÆÁþûŒdq!ýÇ—‘M°˜œýíù¬­š0Ü´(ë~ÙþãZ´î.'4s1lîèô;™—ÙÁ%™'‰z4áC)¨“zâ嶚×w‡Îáj•tâÝ—j옂å$DMö±”ÈŽÙÄ€_ßÔn`n¥ÍâZ4r³t ™T3Ålºéó„["ˆ[’ÇLó;÷ÓT©óuÝ Öï<²lðgq–¼ñäÎŒe$1—[æ#,Žã7wô¿Ë*Î46ŵH3pÔžF°ZZý*ÿ°—“C4‹PŽµ fáû,»#祇;|Fàœkæδ­€}BL8£­£E¥}Â…s,çYk°Õø£joWˆ=Lî«s l÷t5ÁmÁÈiƒ|´!¨/ß² ŽOFolΖ&©é¾wÆž›b¥á«…ÇW!OŠ…lîqAÃ) ]jñ ‚Í`n>ýõlr­˜7ßY¦ꢩR›Õv '¡²ƒ1ôUèi - qŽD ‹Óbа$-Åôú!wF+Ö½åŠmXõxvYÔÓ…ƒÊYKæØ6ÞhL¬Yœ›Ú¸N$N)¡®gèÅ’ìI—â„äuE£ž‘UÎ`ÄUì2´bVö£gY?fÊ"ñf(™´hµ‚½s˜àgÞDƒZ¥ë$Ú­*JMSã/oÑ`nz‰jT³3¶­?? ZŠê´@ž(Š…=)q™U°¬·àpæ¾ñOHªk9wº/¦ŒQˆW¤)ó…™èc¸UºbêIß´ xT¹Paˆ(–cþàeØ€Çv‚ÖŒ}ëq¼å̈^çøðŽ9Œ!x_×ïŠ_ŒÐãMñ;$‰Fé,vì÷€§ ±ì;>d/Ž„Ûé‘ò 3ã^d9Žç­ÖFØȃ{üÌý•ü-ÚB_™Sŧ'J4É”EGx>¦¢tßÕuz!àCüÓ¹=<$I^‰9¸¯k†eо”V•Ë—1&+ÊîvÑ-ähJa÷Jª£ø÷ t­ÜX Æ^’»ðè'– 42e•š±‚µ(ÔlC<#9€žçÂJϧ¯ß!Ùi•8\„&ðÔ¡ÞV泑ï°{ ž8}»í'®’”ù¼œ2í‚8[ØÐí~.y`}È 4š4sĸz_ùB©éâ¢&€d$.ƲQ*ª+¶³u/çËhyNK¯;uEÖE\Æeð0‚º -éýØnæƒÌU@€oK…6aƒ¦]zmÓ.eV7À“eD9ÅXr‘´¨ò`æk¤¤ÓA$ˆðÒ*‹]ŠÅ¶7•Rb4Ýkf¿ÃkÔ-¹­–oËísU™`¬ÑÌÀ€Zë7ðKc$§/@½®,ƒLæiÛo‹zjNI˜ïõÙÅÕA…ò}‹»=^Ô®+ý+ŸfSÉu@ó‚Ù§qÜÛÐiâR`-xÎÙ¾¢AÐÔ–éÄD¯ÓÞ¯í -¤È­<)µ¡.aC°¢Þ'A~›¸T›ÝÞŸõzW«¿Ü|׸ökb(³½lG¢o´k’$0â³—ÂѺ5Š›ÇΊSvÂÄPãC¶¦BÀß &éñQ)'ÁzƒwfGfßÓ°´¾“—®¢×:VÌ"»!ƒ5-Œªü>†n®ø©J¦í¶É6ÙÅÐýÂuå7ræ(Vüˆ¼<ªýODuý5¦7±Á:{*€³‰ù'´Úì&Ub¸ Ô—4ç#ü(‰àù¾âЪ(V&»¿ |÷ÑôF{˜^>3æ<wÓŒ*úeG±5ÕÝŠa5ô÷àägƒs&|ªÔ|“ßã!º,=#¬“ë'dÊq¡p„:¡Üƒæí ©òÅa¹Â“ÂD¥MªÀˆìµ÷žhìO†3nNÕåûý3Úýn3å‹¡êYe:§–ß©ERžî÷*|î Á–ïÐäA´í wäT’¤jPne š`†, Sɧ4wíXÓá©ÜSÖ_ó‹xû.ðrPñ¤ŒçA°+³6~iäÁð¡/–ðzpš©„½ ”  fsÌÛƒóÂ÷Ã’Ã~ÊòCŠ'S ¸ -6’Ùí Z3oÞSeN¦vÕ}¬Ê2´€œ‘¨¯‘òÒ±®EëÅÔÅÉä -—H(?oIå$ƒ¯rÙ¤Šü$ƬiŸŠ¦ýÝE¬´˜³FíWNôœŽÒ¸Ž®ñ~żÊq€ÑDPÉËüÝÈÊé :7Óó^8}LpÌvN(»EŠ]c¦ÞØ7ZË‘‹í´,^ß -ØI‘ÿs±ÓœÜ” ¿øÔÙø}¹'ÚÜðvA”/F½\&ÞýêËU -É Kÿã’ÂíwT5ívªau›Ð«ïµ ‰ç×Ú /߬yoÜÉ\‘ª¶HY•¸Ä0¼/¾¸ž!± mHßoYÎ@ (J$É ^÷ âšôA”`NøØÒB4WdxãhmõËqò/ÀqM“Îõ±¦Ú3jÓS^ð4®¸É»9Ù7Á¶”&M:°áéV½PÔn‘è"°Ÿ çaZ~䚨’´€c;çÕDó@Êʺ ¹ƒÛ§á(jo ñ„†ÑíÇ{)T¶€=€±Ê†vW0+,ƒâåFSWœ-¾wÊÕ¦òÀ´T¸¦‰d¾sïøPÛÕ±À)3kÇ|$¡Ý°¼+1}ífߎ0 ©_8D`ÚþZ&œÈ¦ÏëV [bþܬu4«Ì—û£Ðµ˜ó”]¾ÀÒŠþ¢nÿé`0‘æ`™ðþê s]ÍÔ2ð]&ÙdÖ*ÿ­ø³ñ™´> C/Áý¥ÏÓÌ-PÞ—Ä,'ÌVÛÓ‰ŠF †‹Í>NíÞØ+ãPtaùeÿ œÙnžtQyŽËÇvM×PÒj -Ì3‡–µŽ"ªègÕTã¯Îl÷Î[v°g!$U6¢>‡‡Ð}¿Ø<”›¢¿Q¿&é° -‘t…pm½òS.5O\Ö -ÆÄÑëŒ0Ô"]0˜Ø½vSˆZñh•'o‚cíö§×ƒ˜jÓŽè³ô›¼Ûº2…÷:ðTg¿ñâZ¢ÉÖ/Ñ!Èn¿µi+ˆ}ÿˆªóÐ~dÿñ©§QŠÌõ48ehZKÞ?²Saý­”ˆvSËAì«ÙzT¿„œóö¥&²ügú›kP¸‹%Jüíç|!?é¸^è XDfÞ’OÜ8.Å~æ?2¯{ŒÉãƒFá9MßéŽjÇ‚AIÚÖ¶(qú´"Tœ½ÒŽÅú‰ê} M%ú~œï¸ŒªÉr©.E%±ædTö~Vb|LÌ]”ס?’'r×T (++9Ó´âÙ×!_âþp\ Âõ`+î–Ñ·¨ýi9¯>E¶,°/!ö¼g9²{œüêüI¿C$#ÇÉBŽÙEráÀ†Ý%*§úMÁü‹P º³Â›nêÆèQEoH€ ?ù YxIÚ6W÷ÖKiDMÆ›i™ãíI.0¢æ–_œ¬µ`üS¤r”±ÑäóŒe“ŒnÉÒ†pM›óR%Õ„¨/br¤$z¹àÀ™(”2á×1õÞ´±Ü¦#˜œ²D¦íÅM~fÅS"¹þ³¶ÑŸ$¡·Ñë²ñïøB‰†¾LëÊsæß¾qî¡ûqLÅÉ÷Ø|›G‘ -ý-ð}™çd®cCÔ'K†s§ØDÇÝþDA¦5¿mPµBr2›É‚:0ò\sP»ÿ»ºDƒó<åÒ@_¢ÕAlšÌÅc#µP±&ê§mÃF¨2ã„ÌÒvØ,D¼½AŽÎÎÈ.Á9D·¬ÚÛT* "æ4ÁmìŽövR—Þ—K -;ò™~í2Wƒ®*Õ­1Çk%se4“•"í¡­½]œ+qÿŠ°Ýk›çš€øñ0ùóÐLó0GaÝ×¢K‰ÌË2ã…VôŸÓ9å/QE‚ýj2¨f–g‘Êæ -QEÌ Jê7Ã/n÷lË4ÎY­UW«0Ëä°­ƒ)“G‡YîÁŽœ1<Íoº&ƒ°õ[8jüôÉyª´.ë7Rmo¦mŽ gùgîõ4g6.gò!ì^Qze<Ûæ®4m)è«lËá–?׉ÀûEÇõ¹\õ´1ï@Ð–Ü psí ­È·ÈÔç5Э$x.8±™‚`ßgwº[ÅXcû›üú*+‹Æ9e±š˜t.w}ŽÉ³‘~$®ŠÍâÈRV5x»Œø¹\ÔΡ² ¹k2uäõ¹!yl'/h:÷‹ÑÑ÷ ®i™AhLÄø6½…ölpèé…œ¤ç¼¹yQbB‡k2/ëqÉæƲÏUÕ.¹ÇúÄb'`¾Loké¸ ¥‹ÐêL©1Á®!aø“Rˆ¢çFô©Åc(M,}5ëë\Ê(([×âÍ´")>‚;¡¿v(\ÕD‚À}œS•èà®säžCrÓé{"hGéª7¡)ɸKö,.à¾þ˜„ãÑ!ejDêŸA¿o”’ñ ûâ#4‰ µý[ª’d!i§Ï&jü¸à%+4¼ÜÞG¸ÈÛM]aâ"<)S§—¹m½ qyf BÙ §XþÆ;pîÁÇÊHÚ¾;dÂa¢…xÒu=o)¹Äù¹7 …è0QqXˆÆ'ðú!=GJÎ “zÒàx.Á—Ó+è«h¸êÅBt#¿·‚i¶ý÷êyè[Dá´ Ãà2 uöˆú"ùƒz2šO÷Ú&ˆ?Ø LçNr6}íjL@D)ò‹°î/!{1BÇEÁÁ8œdÚNxÔh9™è3¥@¾v.çÚ¨L€ °Ô@3Ö()Ö%÷2ÛX)¶±º›%¥(ê²´vǦ¿HPƇ¬æ£×ú¡Ûƒ%sÁ#;ù“xë` ‹ÒmÒ—~Tå"Ѿà4Ñ œ+<ø¼½{ñÀ{z¿ïoòáñÝGÔ¥íFËRØF•Ëi¢×¢$o®DÐî~AtÒ½°IuBûÁª!ùR^~ÃÏ!¿ÞŠ IóQ°Åìî*wð€1õáÿe…l.šnž‚"ñ+7–Ø„cUÑ(ÖŒðåMÕOî‰KcúÝ -ÛÖ‚ˆüBÙÀ_ù› {Æ(—ŒÞcöLj8 <¼ºÔ³=/Š#,{(œ—¨jw9öÕ5šâ;ЉûR?GE¡~ '|§ßÛù«•fÎ÷Ö§³ße(Ý…ËÔ“hðµ‚IÊü%¯Â%û¾¥FS²€ÁO–‹˜%šÂž« Nüî „¦6X‘U×£QìFÛÍù3âW< >úo¹Ã–,¿Ï‹U˜‘ôa)f³ÇÜ–Ò)U5_ S–ì~h¸ˆ/=%‘ÀÑlu… -°ø]å>©¸CPsR}'ç9xþž)úJH2„ìhõHP"p{†—ÌJf8%2ANœâ{c}é ¦Žd4?My°Bmôu©7ž‚ê·¶%„ÕÚM»ü% R£ÍAE¨Ú¹q·:HÙo¦1°m~SÒ~½ý¬ V^~³8 â‰`ß—•‰1£H¡Rˆsé¸Zò -^$­‡îø>ŒyXµ A"&-;ß¹kì÷5:^¤À\ÓAÈŸ¯2pýƒ–ùá6`µ¬ð¦ëõñ½éèÑ]Xd5Kðõû¿h[ÈÄ$ìø¢bxa~+®4„@OM¢‘Š¤¯®|c¬9FÊs;r”+j`¤h˜>ÖçðÇé'ÌÖõO:S°ÎÛ`‰›3¥qÿò; £ßd¯ ù4Åç|‚îÜ>fŠ"Ï›-15âz–U2cL%Ü{ߟSéD¼‘Ójû•WâU‹Jžq[À¯›ÿoñ'…Š7†¼Y¸uAÛåD›ïbî†ÿn:\o›Ãù«©y©’ÃË'YSr>_Ú¹}Ñ5©”󆦇Tr£o–ä+öÞ9«œøjŽuhUÓÂ`/ùy7x¿ö\Åb–“™°â‘uMÑ—ÀüNžõÕ™rk¶¬98æë~%ÝKóK£íùÂVÔŸÝ‘±Ÿó`ãi;×Þ“ß%|¯o¸·^AÂþß^¥C;×,Ê<xKûFϺÓ;O,ÝûÉíóG]ñ‹»¾‡~.н¶1îúó¡¯ __Ð17oöÖW%Q)Eyÿ—ýÊÜò¶îÝÎø³+r’¬/þêòõÖ…% -’:Ëôª ï‰N˘4åÞ².––ibïg–¯‘št|žé®¯I«÷¿{8óõ|†w~UK–Ïç»1ÅÀõ¨vë;¶Ç²¹ÊÏ›x³eŽIÊi0%Uü_oíùý9ß¿k/¸ÂL3Ž½föÛåöÓê‚b“>jÿ“5Kè:8—3.sÎÅÐòxÿ-Ïù¦U÷®°˜œ(b¥ÿèU¨æ+›åßÍ[ßÌ»9å¢ê™åó¯˜Ü,ayh,Q"sˆ÷ÝU»Uý²w¦¯¬ž¢7ÓN4?²rá€U\û]ƒšvÛKìÜå»sΩ{þžcs³ôL]SrõÎñ©+úg¤DŸ\óëëÚ Ó*ø‹®Æ„Û{¢..KR^­’qÓ™ Î\ó»¯:­ÒÚ1ÍÐÆjZ˜Mðg¶³õr_Ë•ïÞ6 ]XÕ¶7·e¿ ÿŽç‹¾WÞi´|—ÿô‡WœØæ·ÙFÁ?mX®I¯©1U”síÚ¥é3ÃeâœÉ»9#£,æšv¥\ÌÈvMY¡§ûæèÍßþ7ÜMþsVVçÄßî¢$Þ8®‹.×c¯ÿ=ÛU®Ó¶ì~ÌUµ»á:zE|ŠS] —œ0Îq{!45<õSþ]NÙ[¦Ì‡“ÔåÖ?úÿëtyÞÒ8Í…/ZÅ®1ÔXûTJé½÷+wæ«B—#ë; æšÆv9¶õŠ¸û&“Ú ·:”vˆJ½'¨ø‘M4+§ÍSɯsÿOîÒú§óvõ7m®ë1ß&»VO´ ”<ìà¨Ðl|ýoÁÁ­žÖ̳_ã#yoB6—j¹Â'¯f© ­êeBwƾômÙzϦsO4—ÉÄ»v¦‰Tð}ÓxÝܨ:èö½=Âë2%8ö|^(rø¼‘eu‘ßzÃÅ…KõXsŽ‡_jQjȱ¾f}ϱ“m3ƒGâœ÷Ób–òˆ¶É _3Ú] |üeÊÝzYk½kóüµõ'‹1K*ê.Xn@!à5`Xœ“šXT’Ÿ›X”ÍZ$æ endstream +xÚ¬¶eT\Ͷp{€àkÜÝÝ!¸»Kãî\BpwwwMpw‡àÜ%8_?çÜ{’sß¿ß £çªÚUsUÕ^ÕäÄŠ*ô¦öÆ@ {;zff€¨œ23€™‰Iœ\Ô häbio'fää0ss³$€Æ / ;; 9@ÔÞÁÓÉÒÜÂ@%JýO'N€°-ÐÉÒÄÈ gäb´abdP±7±ºx2„mlÊÿ<á P:Ü€¦ ÌÌSK€1ÐÜÒñ%);3{ç¿Ã¦®ÿÛätrI¨þ¥I IšÚÛÙxLfŒòö Ù€ —ÿ?´þïà®66òF¶ÿ ÿÏBý?ÍF¶–6žÿÓÁÞÖÁÕè³7:Ùýß®À»ÉM-]mÿo«”‹‘¥‰°¹ Àô拾„¥ÐTÑÒÅÄ`fdã üWhgú%@+÷/Fy I9EeÚïé¿Ú,í\T=þ3ê?ÿÅÌ´:N–&Ðò2ƒ:‚þþ÷›Þÿ™KÜÎÄÞÔÒÎÀÂÎ0rr2òD±¼™–v¦@Ð$ÌÈ`gïzZ_€™½Â? +ÚsF³Åþ, ´üƒ¬ ´ùƒlÿtþÓÌ +jmcdû'êâèjï45¶ù÷Þÿ§…ÀhçjküÏÑ1·ûæ0šÚÛØ9ý q€N&@»¿žæ0Ù‚¢ÎF åþO”ûfûï©Ø˜@9íl€fE™ÿ'ú:ƒR6rþggë?APf6®Î ¼LìmmþD@ùXx:XÿäÂÆñ/qKû?†l \œmŒœ-þD@™xìÿ@IØÛÿÃì {÷?íì o 'à_=þÙ%{×?+ÆþÏ>YºýÕ¤ë :Aÿa¬3Ðí/WÐiaþ×B°ƒTí,ÿáú'gû¿âþg[ËÿŽr€Ž®F +ë?ûtþ§rý ‚œŒþLÇRþC ‘?RýC ±?rÿq‚KâL$ÿh™>ÿ!“ÔÉHÿ!‹Ì¹Èþ!‹Ü¹Èÿ!‹Âˆ ä¢ø‡@.Jä¢ü‡@.*ä¢ú‡@.jä¢þ‡@.ä¢ù‡@.Zÿ!n‹ö¹;™X]þë•àfýOü¿_ +P©füsÔ¹Aÿ!ÐD&jh&Ó¿ðŸÃðþsTÿBЄæ!(s‹¿”ú_Ň ”»Õ_r²þ AR•&&ÕŸ2Ä *·Œv!ÈÊþ/Y9ü…ÿ׿dåôþóîü… +—¿dåú‚¬ÜþB•û_Õdåñ‚¬<ÿB•×_ÒÚšþoíø¯{ozP}ýcúg'¸ÜܾÿÝSÍÎô*J‰ê +'hÇÿ‰š¸: +¡Ë¿îuÐýõ¿lf ºí€@  ÂÊ¢½ o°UJsh™ŸxÁt94 ¸ˆyK¬|C÷ÜwÄ å8p›âQGšzͧŠttä_пˆÜ_ðœ¿vú(MH\8Ʀ.¼ýr3ü•îÕ†§y.ç¹ï@ò;襣yþö”\avc¬,Q«p ërð$O‘JLõv¬GÇ­±'#˜ƒSS"ÝF-,¤ž‚•X5Õ±,œ-lÝ51j}*ÈÏ* ®•võʾÓí©.7áM÷7fÌG“N"Vå åÁÓÒÂ0T”º÷þá¡ €¹ŠàôO8åQ© lôК,¯Oâ3—Ø“âárntmšÄ¯äzÅ{¬´…ÒËEL—ñö•Q”p^oÇ€äîüN™„/d[þ>( .yQêºÔÚÐÄÚ¬H±µÒ3¦1¼˜‘o3Õ> û!8&¾{» +¥ë û;#Xî¢>Y‰P¿ø)#¢ôò)ecg7ÊÊô+c;1F ]m‹D{2Ôléj+Î}Sþ(÷2+§ +áÓEŽ¶þÑÊdCH¹¤J¥Y8ß/`/ Ñ#x’Ý O +S0/&ÉÛH-Ô‘‰ÿW5L)²¼826Œ›Û¯ŽFšt²ÊNÚQo/Þ·R…3îñg[UúÎþl}¬SØŠ¬D5›ùK8² °æ5žš`DÁÁ@*'Žh^—u˜QŽš‰<Ñ!§q2F^b:™%ð(ǼÙôÄ3°„¢g Æí–+ªdÍ õ´¼µÚâ#J*gò~À †”Ò¦Ž+K>ÓkA“«6WÓA +ME)L—œ,ÇÖÕÛ$ÅöãÌ«6Ÿ®¡ñd©èñ„ÈOبÍ@ß#Òb­Õ0 o „Ï0ÎT»}¾8áõÁ±¢àâH[˜çÇ`{ß&LÂo^x/–WúÁÀu€(Œ*¶êuï–K,CyA¶&ºLÝÖg¢”ÎÔûíšLm‡_…ÈúX¬fo$›$¹ÃÉ«ÌÒ~Ï`ËJŸŠ uÙ–ƒ¥m¼²³'뚘zF^[ž{Ñ⫲ñhÞ7ª…MùA;4ÊÒ¨"äz/…w¤5sÏ.!àhž­üEAÜÞ]†æáífy—12í Ź]¬a +³]’°`(oƒ_ ‘Hzràša%+f¶³Œü{(Ôº +fŠmvö%päd~9–aÁ »¯ºrÌgŒ9 ƽܶe‹Q)6&ÙÒýû·(Ø×ï·Óšbò¾¾qQÇi>? ÅcÌqe¼ &oU_ŠÓÖM³ M,„ÛQ³¹uú*­»[¨æ ȳëtmµ¶Ì$%œ¢*ÐóôGƒÍñÖ¯b›¨3b'gïˆ2ø³ôΞÊÆoÇoÌÃ%ĽóV¹H¨xe)௎J\¨ ô„´Ú©Ã+ø$ÚËŸ#\ ¹4¡% Ô(‡ÝÓÉåj£ÆíÛÚ±IàŸwC¼n“J®d†“ +Ò™!×ìX fÓ{P—-nƒÇ<„¼#³Dî9 Ì_eCâ÷ÊÜÛpTgD'>e¯Í¸ùôÆgõËòc+"Så ZzëéF¨ÏÈ,@m9 +®¡Ý É»œâCÔ€õç}I +s8“†PÐáÛx6ºÖˆVçG”÷)¨"×']7áH'ñ;G†ø\g÷U½ô¡è +>³ +ëTMÆTîærŠÝZ;àªÑT9«1;.'ü@ÕìG¿›>sÇÎ72.D£íLƒ<Ž…7ÍÐ Åø6&6©pTSGŒWÉ_PÜ$c?\d©o•XÃB¾hR ÿ:\ ~–´U8IFy¶æ²k; rA¸ärˆ-ý™ü5Øjˆ‡ñptU¶àQõ o²lU#)JoÊDßI®lJ·~¦ÑHDqg¶ÝåM1¯äð)Èxä&Êœi{Úà1;ŸW‰ûŸ ë 3UâôÃ0Dš)\oà9{kîw…xÅŽm˜ç=ìuv”ŠåÄ]m½ÑzHâÁÓjJk“l ó‰Ñ˜ªdxüJW ‰ÍLQÓúÒ )ÙM·ZͽN"#{›{ÆfÓ¼Š’êÖ)óÌs𺑵è(Œ„nÞ Žä}¥O¸Ø4ÛV¥/J6³“ˆX:v×Ì(rßUß0`?‚ŸHÞÖ7¥xÔûnólJp À®îÀÑ‘…%J;N®Ë/Í-»»d‘ƒ™Øp'Èo•8Ü7«­µ#”’ÚÝÜã0àG¤p+º¯¬b¶Mço¦ ŠŒÈÛIÑ%ëˇˆTJßÕãÂ4JïÔâáîF>e- t=l‹Oç¸ñZ£K“çÃøØöL;…Bé!–YhEí2¬Ø8’GãC|k[ÑË•ÞÕ«šŒ…/¡µë&ôÖ} ÝœmĺÛT’ÐZ‘©¿U>U`N:–ÿŽƒÉ•ˆr› ªš—ómrC(¤^Ä'è=BJ”èIÒÈ›apÄjþPfÈ3;¼l†òwÂdáè]%b€&³pžÄɆ|¢þ”L(½mRú»vë«ù†lƒ¡ÝèG¹éµ#O·8#¾<Á~!a°ÐÂ<ç1‚LÖtøç#”Îdÿ‘W9õMzÙ Rðß“ÆÖ²6XØ­WšrWIŒƒ\Š']äÂL~ò²è8˜Ï±T=8·-ñý̬fXç!¯Âeç’Þ]+Kº­ h"ï_é“ßœbyaS¨~\ :TÂGÐo¦bæGŽG‹eèyöк4[„3ßÅù(Ú|‚“¾=Ån”} _{e¹Gøõš¬…RB=⻚¾>  ðñ¤%=›kBË`¡^5ÂöÌ$ʶéDŽ«w­3ì{§ï,UvÈÏcQ}@‹×KRÛ]‘3gÀclhÐ|U ‘S«Ìɧó¬îžü r<çœò\ÙŸ‘ê|‹*ðfþ–¶z°®ç=]çî+,’ÉΰÓË$ºË²ï¬Ç$MQ–î9½(±Ømót‘‹ÜžÁ¦ƒÎ—öIöv¯˜QÁTMbÒ!ÕVØ{[0·åîi5yK"Ý]>TzT,cñ[.KÍ‘ðåϤY[SU^ÖÁ¬yT£cÁ÷ýzE§_êo2²d”ƒtŒ_.d=Ö+†¥¿%x|Ø$3*Ä°бZBÒ!*k”oúP„j™:Ö=`´xÃîWt†so£mÈÕ3…ÆŽ Á²K_Ê·ó›{—Œã ™¨öȦg~ë³ ‹¢¥Kò4€ØÊ«à#sé¡Ääå“3ŠËeÏ-â—£JÜ 'Éå_®Ö +Eu&~[Ž;ÚL'eÈDwèÀùŒ–-v\¥>h„K!t€ù—ß­k¹àzómê>ÑúSZJª;¬è´yPâï6lLÐ:ü0$*±H <áý p7ªàoؽyôóüÛâ½éè—!ä€Úc¤‘ŸÕ®Ò w³‡¨4­oØ+«rn&Ì…$¶{QI—ë’/‘¥¯Ü¾·Ýl]§eÁÛ÷í+á™ü…$$$ã‡fOþì ù–r&l*z_‹…3î½fÓ.xËqt7Zé_g>¸¸•ˆ§Å*œ."ÖûbRà¤ÄÕ£³¢‡®Õ"ŒyÓwiÀOf" . Ì@sÒ…œ³~€~uJñoέúZŽ +Ãc-xZŸ ×<#“pÍ£ _ßÜØklþl&P)N-C^ZÐÛ‚<VöVŽ”¤ÝqõÍV¦7i­ðò«\¬žû¢TÜÃ9­Yþ¯ßNÁÍký«ú3DV"+7U|×ç!?¹„‰·¨ï»_^ó«¿ 9ñbÖã]÷qULE™Mß.å`jìõVI^»_aî ZþŠ€Í,›œÓ]‚B‚…"7æDÌÈ8®hM ‘æØFµˆ¢ÐбäßéÛö×0z{òX#ìRâî`„}|ËCŒ}†52  emêˆVsê²hV áÓç`·ÏYGÞÌÍ4ÎïDz‰µ#ö à”„ä‚Öž¤îÇ̈¬ðžŒÐ-„ãÔ–75/þ<ú•zÜ",u“[”žs›ÿ-ñ•Ã¯­xS(EÞB^ÔäaãÛ¨6_ÍÊÐ>l˜š¥ó×Uiö„¸õj–üLgpò©/V [R¿™o€=)|óÛÃ9s•P´üW’”;,€}½9 Ú׺¾BuºY}t +µ©ï⃯9M«í0Óçúª8$_<Z×ô)¡…ËE=LC¬Ï¡(üº¬™¨¨Ä)XèXÐ£Ñ +ß¾'G=Lˆ„!Nçoç;UY(Sôu.Ê­¢ŸU½âñP˜näÇi-žš +Hv™³«°+N7ˆ¶ºv›Jm.GJvDËU—kž†sŽõ ½Yr0eÐm1éÖÒÔ¦è„7’íÂ\FÔÎ{ºòjN B ®ú#ûLjì•þNßõÅ(™"³˜9 š¾(¹­<ƒKÈkýv;M Ò¹ÐHŽº}„^ïX‡q@Ñó)‡Äq¾!sÐ)R†"TxpÐÚJ“y¶øŽw–.¿n³ˆ" Ä,_kçëéá®N߀v•k;ï…z“X;%¹hf)Ì Z.Û6èáYÖnÌR퉱crø›| *¢•sp…Íç›ñÎ×usà÷°iiys÷±Á‹É" ©¾5H¯û’Œ…îs9òkmŽ`l™ÛU—þØÏ4¾%€Ì˜kMdLî–‰¤™Ô­k$žxOœÅ{Š˜ÁËÊAqÞDzmÛߊð@ÉkK$In¨ O„œ¨Ç½:ùê[jáÀ<öPç‘>­6f”rUXgØõé¥à6›Ï8{3ô˜A¨“w¨:|Š~õóŠWÄs¬oh‡L¨A¶1Gü\¸|Ô;?Ÿ"QȆ<[/Üs8ùî·h}®fmͼLb‘V­y•é=¤ÀÒ€K#„ǨâÏœ#Wø²Gæû6|Ü}ÿÜ32¢5•ªU=š0óNS7&¸÷õÜäñ›ÌÕ +±-/§¾T¿‡ç£/jL$B¨ø;&gz­¶íŠ6WÍ/«q¶ 6Ñ¿ØWùY}÷,̆‘KF@ÎA æ}MþÍtAp²HeÔ:×לOCôù¾K™,qá`Ù© …r—©g÷$Ï ‡ÞE­ù¬'_LýŠG–¥BÆÉŸ‘1yƒk®°– +À$:­66,j£ŒÜ®Å!¦!î¨÷››6ºU©w›fxHwEÁ…‚†I²^ñÄF¨¶Q%²“ÆKÜßX0÷mÖ maKßsÛ2ñb¦³r2éKÚs¤”:UàëøM•ìÞ7VüËNj1(jUA›¤ä]ûøh’iÆ×:§vJ¬ +ã ibÚE6pÆ•ÇÌktÀirë̃ê€îÔ»Qi>»ýä6’ì¤hê9£¿+²—„TúM§!íÐ;>ÌJ[¤åpB‹8Ù¬hÇÂÏ°J\@¬>jà“8òvT±.‰åm©M‘ŽIFÎàj=½¾xž¯æcŸ>bïwgCf…!–ô>«,R-!°³ÖÆ·CÓ´Î$d ó?ý ÑFªBk-¨ø:E''ŽTGÉá.ôkÇh‹‹bñÉ»buf†÷–(öKrvÝ9ÆÂ<")ÏXgrÃŒ« +Á—ÕÔüm—PqžWIÛoË…êÊ4fET$¬MçAN Í‹kŠÖH&Ù¼?žï5žn[Ðz¸ýHŒÝ„=¥û²?š\8œùtaâkÇF¸Ð pšÖÇ ëö‘.|´1-'óXº[8û¾ÐK;šâD¶Á¿ôÖ”Ï:ÈX¬iMO:læ}!@z8†lÀ°[¥ØªÀKx”ƒzXjI|ÅX·F¿ÂÁã†R‡¦,~7]w1.ý½}¯Æ[ñ›>y´EÕ+ ‡ j$ÎäJ˜ÝáÃLæïgA6–o°;…½ª+ƒ(YUnp–|”ÉÓötE¦SÎ58¸ê·PF´Lˆê¸ÌâßÏ¢ðÚpÚM!]ÈFÙo;1Ê–ÑWJ§+f›Œ‹æ;#J¤Ý#È6õØ*a6BSC­/M›ø\Ô5ÌäS»S6æë0«'Níå)9“;'$ G¾"\0~~«ØGC®#‚j ŽyS†*“ÇDc÷#:JÃÝ›T¼X>òŠØ´_2'–Ì°,ÀåËÁÉNŠ}ÈŽ<øe|Å_ð2c½ÿî½1oM[½8Ä ¥ŒæÜlG^há§øåQ=º`'@¹\\5;ݬƒoL¡KˆËÅ«ª'õ4ÛÅŠL[õ*K•ùƒa>Ldb6Ðþ>eNnEQ8EÆð$ôhe½¨¨|¼ +6¶é³or©|@Œð×pU±…Ýi5ÊÊÏÔ‘D@àï»P_u©;¬tUE¦`ÿAhõÌsÈùå#÷ú|ÚÄ›LTÛ'dC˜'] Šy)'»®o,׿/{;PÅCÔ†Gùo-ÑÆð¯Nóã‰Y.ØÂ=ÏÓÙÌHÀ¦:zý 3º–§vÑï’‚]¸-&M7C¹·‘IHàG+—úÜñGj?4éå}ãopO‰0YN%ïºHïàiÑÌÑý‚·„³ã¯I…8dÛTE[P…À6‚§bäÕ÷cXÈI,æïÏ©¿:‘âu´fmÄï•(5œðæÜâ¥ìrlŸ@¡CÚm„¾$¦e‰J °ê<ì~°¬ÅÛÖ»@ +7` ê)ë(6ü¼ëÿŽ´Q± u>Q…ßž1·<Ò1ýv¿O±,äÊóJÐ\Bõ>ï±4ÊÁâÏë(´÷.2RîöNÁ`³˜ÚƒSdäp«n²WUX5íñ€•gùC faP6³à%#å7-@¥}à–Èøés‚®€×ºV³ÂÄökïJCJã¨CÍ2 ôÃ9Üÿ¸ÕÂǃÜ‘A.;²K»Þw»ä2ÐÇ*5ààM ìK‹#bÀØ»Éԡꢉa™v ?Dþïfé"TC+ê{ì$ã£øU4,Ggõ2®J‰¼„Ž‡+ ¸0»E¦Çñ¦ÔS}´¥±ÅîH$¥¿ F™F¼œÑ©Ý°;ˆo;n<DŒøÕBÏUøZeØ WÂ¥r¿‘­Íéh Ö—ÙÅ_KÅÊs%2û ™¹·cäEr²âT[@€nf˜øÍ¿|U1øZ KÈüŒì&ûS>Ìéó¦m. +ñÈk„ˆ8”ðenðeAMºå‡2»V㥈/z"TÒÒTJî[\o6ÖÜÅ ÖxÂ)L†ÅÌ-J Ãk`HGÅκG+zÏŠIò.Öúó¼ $£^ž)ÆÚ{-U +Áà®Ê3öÝžOo!ÊêS6YÔüRf¨“\Üê”°ìÉ lÑRi(Ρ–ÄÒdEüï…®ƒnÂTñ +ä°‡éxu/š•Å×FK ]ó G²NѲӯ€9…B2”Ÿ}W¤øË”Å*wíØÔfAî éÛHäëÙiârá×øî£.öU˜•œw·8¾€& +x¾2øèÔ¥=*wæÊm½¶©[{Ê8EØRk4}¨KŒw ÝNñìj§ÑUÇ×àLÄÞÍ]±Ðö’¹}?:™l?ÚèÎ}û +œù5¬²ƒá fôËĽ$ãKX˜=?QIÏ0Nñ çÆç«)0ܘ­ýÆ;AÍÂ’Ä‘$‚ÍØËαqç6ûƒ–HÎ7ótøÅm?~ùKÂÛQÎø9kû•$¨ +á£ñ‡Õš\{¶¯”XÈ50´ú;Ù×{Ì?x¯Ž»‹8J<åõ}4¾¹OJ$67 ¨ì<9CâŒjvÎU_©Èê°·¸yNi»èc–G|õRp«®OEf˜©Ìn5Ø9&Ú#kgÐ0­ùRþáSyd¡Ó‹8Á0¦ˆ# 3un™ËÑý%ÆJ¤ÐÂ<úªUô¿ê|?ª’F²eUAÅ?N3ÈrAÎû\%¸_—Œ™RŸ¹·›’‚ÇYòI§ƒõdÉÒ”UŠ¼Å¨‡Ø7Ù Ãíç©Eë1ÁPŠ9øbïmÔ¼V½”äÞ‚r(ÂD·Îø©Š£Î€€òðØÏ[OÅûU?cÍŸ£–[´RÄ÷ »‚ø}UÄð +ö§|*|k +´Á=æögÄâî1Z2{¿/G(+)»§Õ™ÆPÜ=SUúeZý-.ÆŽŽë›Œ†Ð¿1É{Bc~~#UF7ž¦³]º•ky[u5NàS€Œ4Ða4Hп)¼@3šÂV XbzËÃ.`ÌaȦ(ú"»ÌÝ“ù}ÔZK0ØF >νÿ¹ÚÜz€âŸ2®£ýó ÂdfdI±d ØY\-B<ö’T}í࣯tïÞʘ÷Z”ô¨¾EK¬ë2’q·7Þ1…|ïÂi‹BóTÕp‚Û~>­Þ8‚¹þWäsdá³#o ¨@öµ²/;Á4«#ðZ]*zÊàwç‡;¢Žº03ÒÑåt'N'¡[åsù6¾Õ±v >:`ÎIßƹC…Ï»FoFóBMòhÆÝ,8Ò:TŸZ…ãzεÒf¯«à^œn^U¶®ÞX¿K!×#9‘óÑõ;EHÞÖ Ò’xÙÊ£«$l˜Ï¿-I2EO´žméÔ|=$Gàåò™ú‰-ð¸|W÷ÅÓv9ÇIJ3œº™’Z çÖxÔô·í¥x°.öû ¢](¤™¥g‹9$6˜p%£Ô\Ö÷“ ‡M|\rÆð-Û¥~šŸïa:IKî“bJ‚‹Ø ‡Å"ð‚€ËD̦êÁÝDÉ>3¢]eÙ^‚3ÌtìšöîÖÙñûo°ÐŒž;¢INÃöÐWÛyy¦ïb +>°$´X„ÍÜT4õ±DæÆà¿Ðp¡„ïHÃR£Ê‚_)ÌÌG½8ñ!B8†ÚèªPç°ºuÇTÝ»©2 kÓ\+ÓÙ±c:åÛšRT¾ÁÿÄdª˜Â"U"Å‹Æþ ,Ý@(æÊcõi,OHš»?ÒÓ²¥¨ ªËßFä,±ÒèáªZ°¢bnGôdqÕ‡'Î[TÑ2½åå÷ÎÌEö ÔÁWìÃ~Þ_@LÅÊW(ÝV(&†žSÚù¾ä³ù£N»‹ÓWGb3„P>ׂ#ì¤`²Ë¿VÔBKÁÐÔ“­Í¶ßÝlÍ£B«Jg²—+0〲§›kQ¨’šR{HõTPÒ‡"ᱶ˜jéH/>PMÿnmâqÊÚ-Gš½§§ýø³°¶öØ ä@585,C•ìv™ÓëªÞ]Ús↴àN=¡³À…_µr9Id¨*ó AÓgH”7ãÝv|o¬5¢âPËïüþ1Bý·AZ +0—~ºª -í[¸–Æö?‚pé¡—p~”ë´x B4¶aSÆ⳿@èÀpÊA/+£&xÅtLºŠç)³vç{SÇXç\ ’œV·»>amÑ$¤'?G±JÍnÕ"©ôªûö‘N±=Lhµ}V袔ÎI¨&…I52I{Ö§êìà9×re-–ìñ5ß?ˆŠ(ÑEˆv5SŸ­ä§mˆ€Ç¼"Œ“bÏ2jyÂ{ õ«<7|ü¾÷b-¹L;Y¡fh©(.õúÛz"1›2eÎ;+F¦úd B%¦Þ¦p{ÚÎ÷å ƒ| Y\6å£tìL7¡9¢ú;†\K!7—:Í#Œß+]ñóaO¼¿– îêu#É×¥èoª°Ä”n}‹kO¹¹UnÇ÷Ì/ìQd>9,{Ýý|CUáT¯¥<î›Gh?´ÎL6LÑÛ÷ƒ?˜ã{+3€!à3Ø-ÂÎ>¢Â0Žìø¢¼ON‘!Ò' +|dñ'ZP= ÎíÆbödÁÿ1F2`3]RtBÅçÌ'ÉTP4J'(mí€jÏæ‘ŒHœ|X x1a¹ÜÈS£Tø ¡Ÿ/½ §ÿ‰ºˆ1ÈÞY‡O”ý³Êqš~WÒ§öÝ—M™ž6Žoñâ:¤ã>«Ð®lg $÷ šiÄN¹É’å±Í´ÖCùï'…Ž¨4>ª¼:øIX É‚ûŠá DÓ}ÓúÈʬŠZfÈraDï›/’˜!îp{ÏôLI3™w°¿…i{ôø’ ˆ Œ¼íùîP»„CPíû)‹Nü"5”‰ïξûÚÛÙÕA3daç`{Ùcô=¥ïa¶´ÛfÌ©¤eOpF ùÉlDT:#g§E.«SxOÅPÌŒ•Oó³bß® ”§G*ù üI<*àùPS“Í-SRJôÖ2Ó¬ÇNÈárVÌÑfn&Æ +›¿³¡îšHù’o¢Öés.#®²o›`r§‘øòÖä5DËpäWèï;OXž¢w] +ËIwd!Ø6~ã¤&1¬Œ•J•¹:|‹‡_Ø-ð?; +-ôU4ö?|ï*1£×®ûzrѯÃsd„ašI0Mdø!çïñ˜7 +}z™ŠqQêSLºédª$$F{¡¢ÚËgT± ÷¡bÔc1ç,&íÆÒ½mAê§æCú±®Ö…W)sw†½Hgû’p‘ÝKâ°Ä<¨ŸŽjn°Ù”Â:ûñ6ãrtç.WƒŒG­?C”êYIeTjŠcÖ ¿Ò%K¥isuBnæY¡.2uÕÆñ¿f'òêÙÜ cÖâd§;Ó†îÉPïRj¦@æøþ@Ž]î{âl­¸k&?(ñÝú­#2ÊêmáªÞ›Ü³Û…Ê/îZ[0!â|ÒGé;þ,ɵµ4bkò&ýr’éý™—g72Ý-M‹—bOA¦&×*³%%¿ìŒuP-¬5¾Av— +yЮW÷Êù$ñ3E%ü±Üž)±Þ/JS¡!kŒó2RìSj>,‡XuZjÞbµšóñm>û`>zÛÞñÇõZœÅÃàÁ”ñ¾HóîÀ‚b‰ë@ÍN{¹jÂ%šL!aêƨ÷|Û{úA?ÎOÐC¾Ë.èIü¢³j‚o`føÄÁyñ#€I»éÓÇ ´¼ƒ‘/µB¿ +›\dÞ‚)œtÁã*ÇáP\ñ{+fhXï#n~•|aÇ&Œ÷|ÃFXpasqVû,í]Óu‹‚ye8_ÓxŸÇó?D •d~>KÇñ2Ï-‡/á áŠ• +ù–#‘]O¼é×HÐO59¨¹VËøA½¼9s1ÑцéwѴĹ>âú1×d£èÅd0·Å¡ÖÁþËâ/\uÌv]ê\]ž>o=“HTç8Æ€ÒæÏ¥ï“Ê”"|æ†TÆ3Èöœ}J:¢?ÈNݬ{¦NHu¤ÜÇ‘k›11¿5mìj^ºÑ‘ +ò»ý~Ãm +ü‚0pžË"r3vƒ tF”Vr‚e¦’×úkÚF$ä’ùÎ/h¿ö2Ð$HÇø©Â[Ÿø|E„Œ´HïÑœ&RAdº*eèÌB‘æU›=åäÃZ±¾¸›2¶Vg;î°ÓSX0RÁ5û™‚~«ˆm3þÕJÛç5•·ÿ[9CGêÊ¢3.âÿ}4ROÂ4‘o˽ݭ‘D¦æ—t?„Öw+›²q¨úKÃ<PÙ]G»‹CÕéÇ·‡h³¸.nº-\‘ÂaʳTz‘ˆ¸YübYŠÏêÒ«YÌCYQ¡¢Û°§ìu•Ë¶*yeó‘=O•öóbI„HüT˜^R… Õå ÷>‘™ì§òPˆ +hjˆ^Ôqjë[‰Á=ÄDGkŠºÃÀIÓ˜ÿX\ G[ôí¾«´rîâ"ÿ‡JžOŠ„ñ“åtev4ñ!.:Wsó1LgK¤cǼ·T ³’õj=@ âwxÚE¾ÅÚŠŽÙ¡Øu2R¸|%S Vb^· ~ +ùÅDjìš ÔAãÙYºÉáò[‚Mò‡¿âA?øÁÔã/»8ˆ¬²/¡qYë„"É’‰ñz6Úñî^â HK"i ßeÅ#é µp˜~Õ!Ú­w ZŠøh¼:*Ñ­pÉä°gÞ݇Á%¢lHót^¹Ä²Ä¶³±™ˆ{xѹ‰î¦€‰#ÜÁKK 7 ÷ɉ¸Ÿ•ÅîË`ãJ±ïìáOm t¨¾˜X±‹’ð”ó/¶”glyc%þ2‡P†Vå(zúZÿŒ2‹ãóÔ:J\Óݱ*ÍÉòêdfdX‡(Í:¤£3Tal°vŸü½$ÑFªJ[Mõt¿ïNÖêÕ¬ÜÔƒ ±­Ð +ŽQcQêtp‰=Ä‚0soŸK­?È-pÅÙò@ó£‘#IuÌÛ†#%[`Ѐï‡|Í먞”w/O_øf*»öí×’ì£/T÷‘'æD Û$¬©Çä #û”ê:£F¿UVqœr÷>s§A„µó$KB>áQAqɘcZáÅŶ½_6Ú>ïˆA’Zaë¦&È©¢NËÞ +R­,0ê‹i<ÁÓLÂS”îkÔÃÅJ²œ,êvö®èÝ/¹µ#3Û@ÚÄ8-Ü–”Û’%ºÛ“jýºQZ͉\ù¡‰ãâ?~•ºp» w–„¢ ”*¥€1íú8)(.·ýŽiL}‚KTèó&éï!3Rȹb½Ågz|‚É:–éáNvXéºÁ׌šä‡¥ƒËK|Ù’ça¶²s‘T;>x(Ø3Ññå&ÙùˆÂ–ó tÊ7âó×_2æFWûÈÀ‡5)¥~J„ãìÌû2KOè†_£™@7gøí7‰8n ýÊ2q1¥RZ~ÚñU E"ë™f°– v¿Ha[>Ææ‚#~^{PjÁ/æuCt=}ÛøôÁ*®l8+:©0Ÿ8©Çt_ln~ÕÔ+L¢ñ©¬è‹æÒÎÕ•žÓÍÓ…+L%½3n±‚Õ47àÕª»X¾XúÐœaÞ÷"ø•¶8†ùòø‹¿³¢˜;¦÷éûs¡iÍq› ›}Mó ŒŸÃ\jÉz…¸*:v:Ð9ûuÕ].$4YoÒdjúêÿ:H}‚6•|¯€•Ü%ðáYCÄsž&vnͬɲ(ŸaÑí&Š3Î~+ËB7ª Ñª,·s©ÛÒ×q¢ð*ŒŸÈdGTA¹¦ÈsÆ g!åoG,ªQþ-ÖÆH¾²ên‰˜çNÏ ³“Góü¾í ñ5Ìç¦>J¤Éòƒ¬ö‡eþao÷æu<ÁAa-Ô|!Æû:²¤¯Ú?÷°uøu‘¡À~n¼/PZg°T=ÝV,+äDœ¡:¹n¬¡ì+!¥°kSGWkÑØÈ:pÕJärPn¢÷#£ØÌŠ)¹l;mmÑ>LË)#¾ƒ*M¦/†üœºF«ösh2ôóξ·ï>^îÆÌ}ûÜ +šÇ’»;Sõ+@xkAÝ4ß’’&3öJÏÒ<<®Q‡bMçD +›¦­2)3`!~ܸ\äK\¼áÌEŽ‚lÜizŽŒXm5¢£Q8–"#ý4.Á|rib€:‹3Ív=ÖX_ù°ºo÷½‡s’ß糫ÝOKì –ªÐ&Çá[%Ê“ p|SéÄmbôåöYzËüÊÀ±¸ÊEWöÁ²±(§ÁÅÐÚþìesœR¶X§rØr)†–ºZÓÁÒIN t"%œLŒÄå…Ÿ¶¯úî“é~hµVân>^2„Elê68§Åɲ]£ŠÓ'fó˜2ÀsUÆ0n3¯ø¡})êÁÒJë1ÿ‰"×Dò¶H½e•M,“"î#<ÄÓ&4³ ­s-y5Þ®nSÌVßWʌǗ0DtÍ5dà”ßb§Yí‡B®w[šµÀÆêPKzoØÌ‚ŸñöœzÎõ‰*›½Ÿ­µ½Q¾öþþdð±ú•[úÉIýáåûÙý²µ i½×'°õ„¾Ç¯’’"‰þù$BÒc•jÚ@:þu@öòÄþ»"7¶’tQX8§'°Û„wíì Ý¢5üÈc€‚ܨ’}ÏÜyý Y>Sp%*OÏ|N9ã§êŽ~Ã÷Ûw9LlBcÂ/ëùhlwǘ~NYÁ-ëAÅíµÓwäRþÔEÕ¬éó¸u:=Ù*Žól®vÁ¶¬QLE¦ iU—G˜"uÝÇX±˜Ï¥ªC,Ôñ¯Oýz%¯•Ô©> »Ù˜>SÜ v;qR=”ø;»rq8Ž S acvp¯Y¨´p}¤/·<ɥЮyÚ?xúªŒãý±TqOÙ®YKãÛ7K¯ÌV/£Üæ×õKn^ìg%‚CëåíÔÅ]×dšþ–ƒ‘´ýð³”@YNv*‚ éÑÅÔqgžúšñ2Oï ÏRÆJ+$û^z|ö¾Ùé"°h—¶OOk…U,™ +-î´Di‡üé'‚–#ÉÁq!§åÉ(…bñæ/ñËèRÜ¢ ¯‡©c«‡÷n4++Hž³³áîH½im¿œj!Ý©r‡C:¸·ö+/ay²bòäk8²ƒ;ã]•=s„~?:­©–ó[¨ x•Â6\™.Ÿ¡•¼Òs‰qü?ZV‡,¯®NÆ•»I2w“2žú €2 ä,$é„GfÃùî­Þú]3Å‹¤9]¾‘ó8w:ò§¦ê¾;;¯´½ïm¥ÔÔSðŠöâ~wO?mxws0¶Ã{ö+¶ãµ”…ãÅ¡ú¯­Ï¬=¯¡½ÄêM¨‹³DÇQ…l[{cªàZ›4}À7ƒøÑCqvêFo¢ „ãv|Þ ‹ÝL9³YRf¯2V2bj¡\6˜Hdýý§²yö,ëÆT|ér2/ÅÒÅòÓŸ©"¶Oé3þ€:É­ã­ûØUÿ¶NŒQsë@Ë‹oO(ã:ƒg«¦ƒÎ™Ã®ÃmÜgÞ%òhº$ûKïÛôÑI“ÀÓµ±Ÿ^Á†ÖP JØrZÍ~ÊÈÅÑ$‡&«uC¤ud̼ü\9‚F?O‰œÓÊHÑ»ñ¾‹Çùõ'IÚ‚7Š†Î£ŠyÕÃdxLH[Á#LÐ&;¶Z[9š¡rNÔEúÝ’0·°."y¾Û«\]`‡*ñ÷yÂÀsø-û©µ<5ÓšáîFê´ f6ÖY]•]Ít†©œ©#r4ŒÈ2ݦ¥•T·ÜÎa …wÿô;çöŽìR¤ÇµXp·é:‰*ï¡L¿ŸßÔ[◡Ûù„3{¢ðùZógæÒ ‰²û‡Xì!¬ë{Ú9{–Ý‚ôo:vej46µ0Ö“J:¾”3•Ÿò<Ï¢6k«’ÔS½&}ºlqêì:im&U U~J*ñ +R ž®_ã„M™„‰OæJ>˜¬ÍÍ5X· Ý1¾Ãèί‘~è„âI­áì(Ú¡wÅÿz!8²ù‘ã`.–dð¼Nü~ù>ã›ZÃ|Ö½igѽ˜ƒôÎ|î·[|‚ûÆp|OhŽàw¢Y¯±hïwÈpúKjyʳÛ/ã…€ÂCDï½ök@ˆäôñ¥àëðï5pûß&niÈ)Èñ+m¾RyÞ‹ÌVv^‡TšåûÄ6˜©uòž·Ó4-Ä~1'¨¹é7eŒÛr»&LKðTÂ<ªü\ˆêSÌßÒ Z8*°z`»Qí/fãóæÓUÛ AËV¬(‘pqHÓ(ÀÊEÏDÊŸ`H#g`E%I«acÅ·ã¶xпóÔ £´±îê£9‚ œ©õ{æk¨ }2‰¶o±bTº°Ë–â9“Ç|‘©µó…v-; Ù½áò¹s'çóÀ>í¯¥ ’æSÀÎÚ0ûkb 0Ñ +=Ö%˜OVZ>p= bõ“.^è%¨CyiÞ\63+?í™®P^©ü€hB“d(xÆ ZßõÓ²aÏü $1%ZÛ¤vª¸Úþ3Vß~ñiľ `ß…ò½–ãQ‚‚¢,£± nëÄÎýaoM¾Kì(7ÛÖ¢à¦}ÿx Þ{–YÁPg ž„Í#LJl"’ƒ0’O'õvx­7Aìa¤œ-ûyóºn×ëàFHë£òñÝŠò§6MÑ(ý˜¡âøVSyV'È&17ÿÃQÞòu„&‹´%ÕÈ&u[ +`$]ÑÕ¢P‚çSäðR¡óÜ,XRj¬ôHjdµÊ9N¡íÈ%0ÃÁÆÙ‚„%–g¿Ž4¡«OË–%ÕX¦DPW +Ék›‰ëÊzTÍ}q;éúU?#ï=wZãÒùx™©X¥g~~*°Î)šY‡øò±!ù#Ê° +ýGĘjà.´»8çÌè*ƒ¥3×Þå³C ˜bºDb2/ßä–P3é'u¿íœ?;5³ƒ7ss]28ä‹QŒ£ƒìþþJ‡«‡Ï2d命ÚÞ/qƒêÎx?c¼Š<ÕÝ(`XJx½ ¼½’ǮѢÑ>xl&Y9íUjcâŸ÷ó2M¶}Â…vÓÍ¿yþˆì9PGÄ®`¬¤&AÉÞˆ]?À-nåS%{8;™„ß±¨‹ýôe¦ÕÕ9 ÿØšÄËä +àØÕ…mw\ã—¹4°cüßD0]9®êÅà·‡˜¢J{›T>™ê«¢1^õÌìÕT ­ýCbä]™}uxeãó^ýä„Çäo“mw©ñßU‚ÝÔóˆíâ.] +„Ì­g¤6‚¦SOýWê¬ vÑKàüâ${–PJ aYˆZ““_¿lªs2øÏJ.X‹Q†0Õ¥%©I¤o6ƒÔ>,> ÖþàJi»†Ûù<¼-Èô!IZÇJ-+üh¡æþ1Žþzñx†2Õ÷㪟’swÕÉ/Ç|hòoÕ/ߊ,ðõ¦Ëc +^6Î#­¤—#A’í _Ç\‘‹ÈÒúW_¡5-‚7D#¾hÌd€¡¨«˜Ì•S\mPA,:^`onäw?"÷挲¼y÷R/]v:¸å»¸Ë\ºIÀ.â#.¼»¼¼f¨X¤éÎÚœCWTo'( +çÝõJ´f0¦ÉfT‘ bR=¿¥)ÜEW£2‚ɲ4ä0Whts„¡^ÁZî}ö<°tƒ%ÐÈ,Ãgoo¦‚ß|÷ZaÔKû<Íh±ãiÜw#Áün Ä¢[Ûá LÃa@¶~ ãÎ ñ×4ýT—ÆKaCŽÓ]øì‚…)¬3èÞ”>Ÿ+×þ©ösòÆìdÞáÑÔgB ë§þX\ÌpƒM¿rë‰ëý”sK¬Z³Ñ{k2‰ý$³R&»ÛÀê€ûsÛŨˆ&Ñ5ôÑ[WæÓ²G+Ûð|†%X&ã$¡ßy5¤·sÊœ¶5Þ¢\H"ñ-W©%]ž¤SRŽ¨|ë‹Ðº4?µ,öñK „…µŒÎÞ$ÙH3ÝÕÆüAª+ÏHöˆÐ{…|?MÓ’ôÌj?Jö1\ë‘„‡â“™¬Èd³‡w­*£L¼*?ÿ!ñеAØ=©òtY§'moÄP"¾¯V?Ý!„¹X È Îe¬õ}Ž}“Ð iY®s[ØÒ]Ì…"gcÒ¸$ýOª h±ZèRß­ÂJjáߘâªùZ¿µä °MûzÜî +s/1+(T¢žWQ<ÆÊÿ¿vëþ à8ã¥bN³e&$!±)¤y9ÛmÉ榎4;lcõÄw"?RìÍpšE½¹ÑA _Qˆ.7ÛksyÂiÊå[Óç®1÷)cÅòúw¿âSm“®07 ´ê +¼ož’í¢BVÅUo­É~u¼§³‹ØøÄBK +ŸZ[{ÎQmèefA¶×Ô?Äp,I°Å‰é«ÜG׎·+›ƒÁ‘µ ì.[Èûü,jv¦ÓVÐè}cè\gµ‰Ôñ^ö:|èiäaìo/AV¶;Ä6¹R= ¦7R~kv–g‹Â^³ÎŒ›Æ>#ÂļENƒ9†[ |å»ðó…Ò¬êe‘Âö¡¡AǹíkWf}‹L£Ù+ĈC†"h!µô%>Ôƒp~(\Þ<%ªmÛžŽELÅûñ¦t-GõÚ(NÅRÿ÷„ku´™]tyS7Áre³}^Wb¼A=¾‰VMOùeÃed±™095c‹Z~rîÈñádºPÉ ÷s–Œ‚ှù^þ°×YxwŨ„?ø>„u·zrz±Õ^Í<ôLzlõeàÕƒ ?õvÓ¤šöÜ8Ž#“ØdØ$/§åÓœJƒ¥½[Çz÷ðc'†em–.;ñ(òSN´ØÑv‹©¿Éæ€è‹v‡‡¸§•±5©˜¤‰N/WxeX;z)´èYöW–û[Ó*.A"‚ÖŸ +AJ®bsè\÷÷%ÔºèrdüMÿ’„ ß¹íÉ‹ "©¬^?2c4Gº¦Åå|£Èg΂Vð*ŽÝ²w–mó yQ¥s^«”^"©o¹jÚI ˆý*On¶ÕÓcñgÉh}]gbÑ™IZæíÇäŦ€eø¶äñP7(øºc¼€ÂÃk·  'ëšüåùK€Z¤¾¶^ØÑ-ØX5Ž9;žâŽ”Ž):YyôEyœucns‚W~¥ª9¢»_eÄ„¨àÌ«˜–rÔ`™ó¬Cò|–Û.9<ó@ Ë|¦/ǪMN5ˆOK´€Á×½±þV>Ì^|«kb iÚw¢älõ ÀM¾°³OˆÎÍâ/xA±&^ÅÅAuË«¡—fn¥`4—6Êb‰ïŒ¤M@ß›\€µŠˆ%ƒ­«Ïm³¿n,ÚúLcbºˆÕq-€ê +lŽûi˜Hç‘nÚ1ªt Âöœ}¾pÙæÿÿ@NI 1˜gé$Fòæ¿Ÿ‹dendstream endobj -895 0 obj << +951 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1781 0 R +/Encoding 1960 0 R /FirstChar 11 /LastChar 124 -/Widths 1789 0 R -/BaseFont /INZPWR+CMR10 -/FontDescriptor 893 0 R +/Widths 1968 0 R +/BaseFont /NFGMPR+CMR10 +/FontDescriptor 949 0 R >> endobj -893 0 obj << +949 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /INZPWR+CMR10 +/FontName /NFGMPR+CMR10 /ItalicAngle 0 /StemV 69 /XHeight 431 /FontBBox [-251 -250 1009 969] /Flags 4 -/CharSet (/ff/fi/fl/ffi/exclam/quotedblright/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash) -/FontFile 894 0 R +/CharSet (/ff/fi/fl/ffi/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash) +/FontFile 950 0 R >> endobj -1789 0 obj -[583 556 556 833 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 500 833 500 833 0 278 389 389 500 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 778 750 708 722 764 681 653 785 750 361 514 778 625 917 750 778 681 778 736 556 722 750 750 1028 750 750 611 278 0 278 0 0 0 500 556 444 556 444 306 500 556 278 306 528 278 833 556 500 556 528 392 394 389 556 528 722 528 528 444 0 1000 ] +1968 0 obj +[583 556 556 833 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 500 833 500 833 778 278 389 389 500 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 778 750 708 722 764 681 653 785 750 361 514 778 625 917 750 778 681 778 736 556 722 750 750 1028 750 750 611 278 0 278 0 0 0 500 556 444 556 444 306 500 556 278 306 528 278 833 556 500 556 528 392 394 389 556 528 722 528 528 444 0 1000 ] endobj -1790 0 obj << +1969 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/sterling/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] >> endobj -891 0 obj << +947 0 obj << /Length1 1836 /Length2 14873 /Length3 532 @@ -7213,7 +8199,7 @@ endobj /Filter /FlateDecode >> stream -xÚí·S|ä߶öÛIǨضmÛéض;VGÛ¶mÛFÇV'éXoþkｺ÷z/Ϲ:ŸSUõsÌù7Ñ'±¼¶Æ&î÷OÇôt¶vΟ]Ÿ•ñ˜Ú9Âü³®ŸKOoú¯Ø!Ó'ZüAæO´þ72³è\ìœMŒ ­ÿk}ÿÝ +xÚí·S|ä߶öÛIǨضmÛéض;VGÛ¶mÛFÇV'éXoþkｺ÷z/Ϲ:ŸSUõsÌù7Ñ'±¼¶Æ&î÷OÇôt¶vΟ]Ÿ•ñ˜Ú9Âü³®ŸKOoú¯Ø!Ó'ZüAæO´þ72³è\ìœMŒ ­ÿk}ÿÝ  ·u±1üg{˜Ùþ sþw‡ÿÍ ·7p4±µ61ý+ÊøßÑÿHþô`oíâô'ðéÂÈÎÆÆàOäSÝÜÃÞÜä2 Ûg¯OY;ã?!v½“µ“ùŸ€ÞÓÄÑîOàÓ¯­É¿™õÓ¨³ÛŸvÖÊcçâø'ðO,\ÿêñiÎéséþÍÿ˜µ¶ûãŒõSÃÉÄÆâGÙ˜ÿ©”‰Ó?GþOðs^‚èsJBès6ÂèSFä}Jˆþ›Ø?'!ö‡>«,þ‡>e%ÿЧ‚ÌúTýCŸ rèSAþßÄñ© ð‡>ÿÐgÉ”þЧžòú,–Êúœ­êúô¢ö‡>Õ5þЧºæ¿éóv¡ÿ³8?3 ÿÐg¦ÑŸíÌðiÔø/ütjòþ³ºá§W³¿ðÓ¬ù_øéö¯ƒÂðiÂê/ütaý~Ú°ùƒŸw½í_øiÃî/ü´aÿþ³3þÂOŽ᧠§¿ð³jÎá§+—¿ðÓ•ë_øéÊí¯£ÿéÊý/ütåñ~ºòüþß—»-ãç¦eú<2ŸÙœlœ>ÿ;SÕÖâs‡KŠ|ž*&ŽE\?O¼ó¿~g>oÒÿaS‹ÏË×ÄÄÝÄfuÉΈ;È2¹)¤ÔW4¦ œÒ 7µ8h¢+¸!•›îì'7Ê‚có´Š þ r0²¥E9RÒ…t%½±)ë6V“ ÷°—2}ð ò0<enš2ä•Ñ™ŽÈHöP¢MføÑ*Á¾}3õÕñÝ–kxµÌ #{ÖEXéòÒÛ­¯Õ·ÉíUØcâƒ$Ýìv™Dµã­Øñçsq»|»Õ ´;Ô÷U¬¾Í9« øTÎïÙ² ‹©¼¯Ð ”î¦;“0ŒéV«Yœ5 Gˆ„t£®K @@ -7272,133 +8258,85 @@ v\ 0 h Ah¶ŸÕ‡ EÕ|Âöµ|ç?g­)Î.U‡ëQŽa—ÕG}åÕK=¾°ifïìî>z¯&éãD¶ssÊö9 XÁ§YßàUC§S¯A¬ Ã^ vý/C7b<.´z~Uœ´<˜‰…¤¤€“îÇ»!›ö“R& Nº^‘×Ôö‡2]°»ü°]òa1Ë3Þˆ™Eq$œÎZŽî®[%)ˆ Ý ® ·ŒvºË»¶üä ÛYêŽ![DEâS‘qê´ŠÒ†o¿]×r{Þ’œ{/¹»c®•ÒË­ÏX†ÿ‡/˜ÿ€ÿO `dmbàèlgcàhóu¾endstream +¥‰L‹MÎ`ñj=FS$‘•‘k…ͦè“f¦‡@˽ßßRªw¯ ¤îxqÝO[MJ;o@@ƒ,¥I;5l-y$hˆ É…k=žö”DJ(ÐïñÖüdØðbšW@i}Ù†QT³‚œ†Ý<1È`wÍM" úe¬8nùêän™ð.^¬çQª /@YäèsOéêC‚Hè†vÄÙ(UFÆ}ô#X0‚¯’ÓéaäLöéʉ†¸«)XØÃ颞Ý»%Ø—¹|'›kø[¸€Ä.¡z¤RmYúÚ5áãäÓxÊ•wXÝ?…“Rº—=ýR¿(lt~€ùš©ä&"TYÿ¶‹û„Q²ª-§ŸöÌârÇÙ½(,z z‚ß½Ÿ=âå…ÍmnéB³¯bªš¹ævŽãTß½¾>“R& Nº^‘×Ôö‡2]°»ü°]òa1Ë3Þˆ™Eq$œÎZŽî®[%)ˆ Ý ® ·ŒvºË»¶üä ÛYêŽ![DEâS‘qê´ŠÒ†o¿]×r{Þ’œ{/¹»c®•ÒË­ÏX†ÿ‡/˜ÿ€ÿO `dmbàèlgcàhóY0u˜endstream endobj -892 0 obj << +948 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1790 0 R +/Encoding 1969 0 R /FirstChar 11 /LastChar 122 -/Widths 1791 0 R -/BaseFont /SNTQWX+CMTI10 -/FontDescriptor 890 0 R +/Widths 1970 0 R +/BaseFont /KRNLRF+CMTI10 +/FontDescriptor 946 0 R >> endobj -890 0 obj << +946 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /SNTQWX+CMTI10 +/FontName /KRNLRF+CMTI10 /ItalicAngle -14 /StemV 68 /XHeight 431 /FontBBox [-163 -250 1146 969] /Flags 4 /CharSet (/ff/fi/fl/quotedblright/numbersign/quoteright/parenleft/parenright/plus/comma/hyphen/period/slash/zero/one/two/four/five/six/colon/semicolon/question/A/B/C/D/E/F/G/I/L/M/N/O/P/Q/R/S/T/U/V/X/Y/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) -/FontFile 891 0 R +/FontFile 947 0 R >> endobj -1791 0 obj +1970 0 obj [613 562 588 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 514 818 0 0 0 307 409 409 0 767 307 358 307 511 511 511 511 0 511 511 511 0 0 0 307 307 0 0 0 511 0 743 704 716 755 678 653 774 0 386 0 0 627 897 743 767 678 767 729 562 716 743 743 0 743 743 0 0 0 0 0 0 0 511 460 460 511 460 307 460 511 307 0 460 256 818 562 511 511 460 422 409 332 537 460 664 464 486 409 ] endobj -1792 0 obj << -/Type /Encoding -/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] ->> endobj -887 0 obj << -/Length1 850 -/Length2 2165 +939 0 obj << +/Length1 1013 +/Length2 3827 /Length3 532 -/Length 2768 +/Length 4518 /Filter /FlateDecode >> stream -xÚíRy<”ûN)5(¢Ecy%[eK)ÓX’QCö1ób˜™wŒg…ì*%²„¤!•NG×Zä Œ-[S¶¤”PáÝÎ9·óç½ÝÏ}ÿ¼Ï÷û|Ÿßóy¾?eEk[ ,rM!:K@ë8<·Fh -¦¬Œc‚D¢Y >€ÖÓCX¶'€Æh]}íúÚz0e1˜O/ †S_!éXȤˆtOdy4‰Hl!d ,• -جLø6 ÈôÉ )$àzRè0äŠ%sºè~+“ÙŒï-é'0¨ Lª‹dˆN È  i îNþ¦~7eS©–DÚŠü·˜þF Ò(Ô€Q ƒÍ™"ƒLúT;ð›;ŽÖ½)3+œÿ{÷⇟³¼¡^Ѳҫd˜sVùñ$06˜Ðôù”õrv8¥ÍJ-õÊÔ<ïðOՋ˯ëJ5üº ¥ÎñxɃ¡&ý×&ê&ln-Öã>~rÃDMØJÅ';ˆUŸ~õs]÷QÓó¿=šˆªhþ©Ö¾ÍfKÒÈ_ìÅÎt/Ó8L¶eôëX• Hö…{·BÍÅqÛÅŸ³®@rTÑKrv½Oä”ï¨nÕÙ™±¿AˆRDÅTª\àòÙÊM ,8ÙÚ û˜Býå$8j‡½Ú÷y“ 6«Ùœà·G=süܘõÌ:^‰j2ו˩=‚ãsl+ë -M6©âïÆ\ɲ?ø´¹Æb°.ĩBî M£î #ò­IúI¨ÛaÔ4W eôºiOéY^‘pÔÌM¡/ïøðÂŽ2¡y2FïGEä­›¶÷04v^$´I÷"ý[Dm -û/KŒìÁt”x}K4h«D9Ž³µ±nJ=yÎöÔ½vqXdYS5ì nиå·å \'’0~..KðcÄ•‰xv;ÃMdë0âq¿Ô„Ž-Ææ¥'*FFÎdìU&к¢f±7úà²O*&Ô`‰íŸ.F)ÀËz½Æ<ý¬wH¦aZµ&5É3x÷Z:Cã3]ëpbo|Uâš'·Å ¿€g¼;ïÝ»9XDœu-‘yUcöbt㻆Ýð>sµ:ö{éC|l³niGns0’FI–eø«Ÿ5}ñ)³Ñ$¹›ßX8otyw¾·E}ì…6æÒÃÓ¹±ÆU’dR-IÑìíA÷Kik79쨖ÄÕÃya¶{Ë%·Ûîíœbǯߊª©ŸB6›:÷È35ÔbÿxNµMØ“b•ë/vÛvçÔš]—vjõ v¨®r˜pEÊîð½r¢VýÙöÌ÷Þ^·Ü6·[¼’A ÎÅÈä¹´•|ºÖãÍõNn‰¦e.(QCnbk†›Ç‹];ÌdKΗʈÜÌ9›qÛ¸Å/¦¦¬„×Þ$o Iu˜f}…E6†òüO‹¯Ä.Xà–é›o;è·ô‹òd…߆-H±ü¦e¿#© µWßÒÚÛiØUÏ.„›H¢r¾Òðýku)לÇ÷G‡åÆ'5•OÙ‹í¾ì7º{žz/(òQÈ¥vÂè¥û„×¥¿ãâÓ¶<´<:zŸŽñO˜Ù¬ùjåJˆDŸÉì½ñL¾î-Ì…vºÝ¨^)s»RšÃN1WO¡ï;¤Uü¨­Gy9¤h3÷nÁIyOö}Šÿr\ÁȺ3þÚ/™¨µèòmæ–˜ê2àJÿ„ȶ̤Sg‰Ô’eÙä èµ^ôAË„½cçžV¸¥ƒ\H¢¼³åÄ{•õ½óPUnðůšŸàUŃbˆŒêþ°ÇtIO5~õ¥ì·›k]¼Ù–566@jþ—\ƒYWëáWì›mâÂ*Ç4Cܨ© #)“ºÉêÌñÅsùQ=¨§¹Ã§Þ^õQ |JQn¢ÅßðG1.%—,[¼[®æŒÉÈÖô] ìj{Ê»Ð?û$"_Š:´T¶7ý %ÙèÍ¢ÝtwݸdUðÂô)%’‡¸_Ff»í¶¨\¸½œA+óÖŽŽ³©‚ª^0L&²Ëq…ç>ÅA\¹C¥]¸M¢ù°E[ÕŽƒfª“Z§ëE«çӀ檿Oñò±ë_­yjq¥¹!BµÒ,+ÇaÛúëë¼p©ÂUÂgØc‘ìíL7 ,ÔmÞ•[ŽR1 wJ™¾?Yz>íÀ:äJEˆK >‡ï9ƒp¡/}E½/MÎÚŒZ?öÎ?¡@B²Ó¹%n$dÉÕì Li£’ññÑßI÷Rµ ðîËgká ó,Dí){iñW¨ÞYK”gÏòÓ÷c-õ²3Þlk‡=uTJ«Ó -Ÿ¿ÁVø@?ìR8ÿìr¼~€3ù¨â”a\lK_BËû¹ÞMþ/»öŒŸ²~yO„–î&¤¹øû Ëœ)KRcUqw*?*æ|iÚ"èÀΡˠ¹,asñúóÊîËJ¬ûØSŠçÝV•«î—Xn/Náî›­Ò©‰åæ•dµºuOUm<Ž1ˆ;G+¸OO¯ÊÏ©˜––_À@ÄöÝÒq6 ÇøÚT±pkZÿàþ¢q†RVtVç¾]Z†Xy•=ða 2ªúKO{œÕ´Â“S„Lf -¬79/ºU·ž.ò]h·":¿.ƽanVt:Ç}ËëWïzLv°ŽUÌn£%ö;q·šÏmiÈ’lŽpQìµbràÛy.`ù‰B=J†µÃ!W-Ü*¿h2Žd+;V–²Úó¼ì˜å#äzEg¦ºft™oïtÇÓªhlì`¿j–T,-Õç8ß¾Qäf¸yÛÄO¤#UPúâÝÐÀ…ùÏC¥éè‘ãÝw„eT‹ïM0ìÿ¹>2ƒïÂÁŠ´>o<ÌÔÿõ~že¾é6³MòsÓkênGÍâ-ò‡é…Í.êõ±Þ“A™®!–"Z(âɥǒo©Ê¶ªK½Ï‘¬7n”sÚ°æÅ8Þò€ß4 ñeÿµ¤ƒŒ—SøÄWùïJä:N}x»3NK5eΨçAP+-ƒ€ÀL8ݱ=³;Ù§ˆigIž ‘HrÜFE}ïpÌ^ù>Ö÷¨m$0v÷죴2Yžs¹[ç5¬Pÿáû¿Àÿ„‰ -™,ˆFdúÀþ ^}¢èendstream -endobj -888 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 1792 0 R -/FirstChar 65 -/LastChar 116 -/Widths 1793 0 R -/BaseFont /TBPDHW+CMCSC10 -/FontDescriptor 886 0 R ->> endobj -886 0 obj << -/Ascent 514 -/CapHeight 683 -/Descent 0 -/FontName /TBPDHW+CMCSC10 -/ItalicAngle 0 -/StemV 72 -/XHeight 431 -/FontBBox [14 -250 1077 750] -/Flags 4 -/CharSet (/A/a/b/c/r/s/t) -/FontFile 887 0 R ->> endobj -1793 0 obj -[814 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 613 580 591 0 0 0 0 0 0 0 0 0 0 0 0 0 0 602 458 591 ] +xÚí“y<”mÛÇ£„±Y*É:cì²ïû–˜˜a3Œ±3E(R„‘%)„%K²…ìŒ%kDÈ’%"‰gê~Ÿºßûùó}ÿz?ïuýs}ãwçï<Îãà3µSsÅ^Ehc1x1¨8TÐ02‡JPqH@@‡€ãQXŒ&P òòP@ÍÏ „P˜œD$h`½ƒp(7w< ¤qñ§HPóBàP.p `Ç»#¼È5\àhÀë‚BàƒÄ540ÿ¹Â0Gø"pþWq +¸¢\ðÀU„ +’øiHƒÄ²…]ý¼ÿòGà|ɦ!²É‹Ù¢+ƒ\H„1–¼‚ìäÃÔ?‹kû¡ÑÆp¯Ÿå6é?Òp/:è¿X/o?<a]8Ì?¥Öˆ¿¼!\Q~^ÿÌêááh”‹Æ …P¾Ú¨@„«) +ïâ áh_į8ãúOä¾ý² addbgª-ò×}þÊ™ÂQüå ïßUŠ1ô“»ƒCöqJ’ß9þc/-Œ Ö…!„´ ÇáàA òdI(Œ+"@’ Kˆc°xò€Ü“0‰Å~^§” ŒÀaFÿ +ÈX â7KC |ÀŸ¼4”Ìî8Ä…Œ4 ¡ö‡d õß$+Hèÿ!YrG~“ °øCdååßD øo‚’.ø’M£ÿ†dË^Jöãû7$Âÿ É•ýþ $¹rÐ/üÏ+TWdžˆÁ¤1Iò©ååäYiHØ×YbP>~=MrŸ Yy©_Q?ÁÿúgÈÓñoF¢È³„@"\@c#XÅ(U7 Z¹ý…TÂênÕ‰Æ/I¯è"ßÝ¥@?é4ðž.·Ù–ÎƸ@µÀpÀã[jÖ£½ᓘ:|¸àï¼\Ãc³•nôÑ›7r…©®jh{UšÂdpº«à¾íã77ÚVrL…4//ROòk²÷¯h"FÉÈÚh§£-£o” ÂøÌ™S} +b¤¢§˜ï'˜ê‹$xDÓ¼™ØÄÖû±îçÒdß;tØþ4¨jÏ‘1,ãˆéuñB»ÃãâuE¤xãsïkjö‹3$TúaU‚‰©˜!¥Œ{p­—à¤áÎYîЊ‡ñë“C7º² $ÅËž>ôä2¶m×wÅE·¬¦0•Æ«µ6ÏÆ`•¡K¹ÙžBf£z&¾´^;Š“Ⱥ½”Êè÷)Ð0'8ýMBª+<5Ù-˜J£rˆcÉ(ÉHcm5í9E®%­TtÓ +RÇÏ^ÕÉÙ‘$Ç L'?•3„á–s¹íoùc\œ´ZÝ‹ Knò Ç#JCkŒ.цÙ¥Á’ tçÞ…B¯ŸKJÎó⋶WKMæȱñ6miç1Ö°¬“ݲ)—íMÙºì¶Ë”“Ét#Ði;Ñý~FwÐÖ^‰õð.±æMß•5ÇTëš”0bJOŸïðˆÓ®Ý~ÒW•³öƒ«-èÈð ô׿GÙX±Âxñt|tÂ3õçGSe\%1o}ë>ó§@RÉg'¥Ýó ß‚}žÞ¢äfVà–ò6ýñdu7QÅmí,}¨Ž~¢ÅMLFÌ”dmôS™›Ë¥÷ní±§Ò¶¦ž †¬Ý/g)ex½Sßlðo¡UËu¥Œ´u²aø#ºs5Ñ)/ «õ¨ûZËùÈ–;”ïmwÖHjX c tcá‘lvä;ŽsùCFÉ*qwéb¯7v®ìªçX}íK¯‚3–¢õ»{Ø5Q5Ûkþ1ž*UAGӕĪ7v»4!ãü>K¼À—»Õ¹S”Ù©V ¿}îÙ.÷1eΘűñ¹êû,‚>½¥»Û)ÅÁw3s·›,6Ô>|ÞB‘)j-æq*Y•}Ñø„=aÐ`yV)”ݠIJØ?nêlº°IÃr}²C0Ð5ý$ÈS¸Ý³R[äYÍUáãŽ]´¯Ÿt#~P¿qͲéæœ+ìFQÌ}”õŠÀ¼u‡¶Z.ý4¼S6P׉ú„à‘ÇêÏh4Xg÷lLí½VQ¯Ö+|€mJ9bÛ"¨ÙapÎC yÝ%HÙ¡ÉPG‹#ý2í›ñ¹“óá©iôϽ«ü¡žU÷'Ÿkð7ÏÔ¹½‹<*oˆÜÙ†¥ÉÌjß8ÚE‡ÁF«_"˜5f×®Ü.àî­z.kÕ™ éJ(À"œªç¯gk°p¿‚^ጋo£j=îužÛNþ´¦¯âØë4½›³—ß¡¤­'!^?/,·nX?uVP¹ìÙvàèaxRþ‰N8‹W¤q3q8¾ª»yi.”ùÕP}tãHPQIâ„\àc¹ß¿Ø † #–Êž$ghÊš"‰‰¾¸6^c9ÆÑëjþ±æm‚}á=&÷m]:,rò’š ÝA V£LS;.Äì²þ-†þbY4½m€Ì¹ÉXZ(lë¾nÓ¾ˆÎÙ¨õuÖ2œlžG->ݱØmÂTÑR°ë<<òšB ##´6X³ò„÷Í@ñ’~¾ÃüwŽnœOXZòb_(/ûªÿfZ®ë1•Òªîázê—šÎ6©×98 Þ¹TÆu4“W[yÎî+v” .4;ñWP/Ö„Žz0ÖD¼Wíò×C^“.Lˆ5±®xâ=- «}W¼}κlœwÑ{oðL”yêwÙÁ)™ã6Žô'½BIüŠ}@ªZÍoòR§E'Ú‘y7ËYà Õø.¼ ¡ ™ä›EZË[™ô1ÙÊ…k,a×ì†o¿Ä½§Œnæ½q\Ú¬u­‘ÿû‚<¯ÖŽÝÁmÁ-ÁmÖ¡2øÔ¥¸é,¯ {¹×™y«u›¡A%ŒÂ"6ÞÞù~NøV–ŒÅýi·Í²J˜@¶^ªy´½BkWèJ‚òcé +ÃC¤¼¼ÌÊŸL÷ikÊX—‚s`Eð%“]‡ åŽn‰\¶~Óê8gþt«¹ãÝÌŠ†Ø–¬ñ˜”†ûõë±rO®P é„vh-v…\+å»5•Vºƒªå7ÿf.R³ª„¾ÏŠÎL)t&|”㈅ýq¿áÜ–,­J]8jýV a0òùšŶÂÛZUÆw‚ù` äÐPǼPããÞØ‘ˆ7æ&¬ªðÛž^eþL–Á›J“é%x¾bSóýc蘳µnŠr­þ7eÒÇý1‹÷¸JpÜÄãùÎCߣs< Ï6Ì{̨yÛsØ"iOL?ém&Ù)Õ-R{f [}V9çèw(¾\_nFh,ý:»»µ0m†¹.¶bÓÀÀu'®6fl +©Ì~r7.éTÍ#(I-â\ÿ°÷â¶nqŠ_ð˜U{„hpÓÊ…eŠåÔqaD!øÊx¥¢1-g£Ýqí{¼¶Í·Òƒ*Vˆ´Ï˽MáE7dæôh5w¯"ÛòóDGþ÷ÕwÂU·öäÚÑ‡í ¾Ø >Š“ÉÒ-7ƒ«ÕHZ/ ¢g涸ŽI-r–íxÆ´¼iˆÉ]»Ûi¬©ÞZÚ!©K•.jº /…àÖUÈí¼½#gñ؇¥æ)À [ȦëÙ#Ô‰Y +ñ0¥wv9éÅÙùðÌÇôè=¨J¬_ãà•5£Ô„}oàl +ïaN;£0—ÃD<õ©ã’ÅMæKbý·[Ö6¸·yIs%¥Lœ*õ:VëFrrV\Ô¶GM< Oz»>ÑŸI á˜ŠØ.§1^M?5ëj4=sRÓòS ¸kDñìÀ¼GÈ¿áÅiEa{¨P\¥“ÿ„/„–kKšžP«`¬P¾šdca!U}z¨øCú$'½YóÀ”c煵ݲk! ÊV;0ÊŒÏ?¢̼ÑûÁc¹;ÒžÆàÙÀ$“㨮Q{ò£~Ãkÿ3Ú\‚_¨Ûu5ªëä/²¯>$Î/kŸvr»Xw1D32únÒlþØ¢%ÍPŸã +1ú(±)L Óo4i8Œ™Â4èÑv˜øfŒJx¶åÛëÑ„åã,µ0jÞ2OßÏ-c +îºíÇ+bž˪:á’w$˃#ôœ¥{ü°ÕaØá²­ÐéØ>œ^ê/—tåÜÍøm_ŽÖvðí´õIu[ÑŒ‹j¶Ifð³@Å*L®OXQO0°åi›ßdm†ÄëSãb÷Q„ÖN©–8­Žÿg\M+B|Ù-a’0íÎ;Hå"&ä?½æà^ÿèlˆ]⵸ýÅ’ÅÕ&­Ñ÷‚tdgC—yô¸õóÁuö;eˆ°nÖÏÅL†=Ý.ëhÿÍ”¯’ÁfÅ”_Y`W#¾Ô¤½*ùŒÿ¤*ö.:á°Í0½»µ2}|¡_z~`~ÛÆ:ãÃ’‹²°Ý—ŽúV¯Cò7eÅÚZ\Òç‘Y$â‹S ܸ{¥fQ绣UÑaW‘t—Aì)•“Ž§va éÔ²3$5䧉àäçÉ<ýoéûmîT–^ÒÄßèÞ?»0HY_ *z·{ð–-© Óý‹³ùåÔ¶‚<ìh`vè®06¨A<¬´ßüÒÏþô‘Aºvˆa€m;ÞR_wM,wè‹ä“l !´Ïðû‹T›ÏÖÞ({Úƒ£zýÒ`þ-qÝ o5YN¹]vŠé;ïÅߺI•jâyxF?s“öÈÞ³:'|fÌ3¯¤—½ :¹—Ä´øµ N½¥HƒßKWØ 3¤¢c?$™4楲èúÓÙ<‰Ò,f)†ÐöƒÙN§_M|3¹ž{!o§{‚e¦>½xò»Ë˜#˜¥í åä17ÞaŒLâdò{Fų,’Õ ¿éUzêmÏl.¿¤ÄíÒ©¤,Û!K…¸Ýª® ïÏlá—s¹]tX5Û5Ez¹©|¸­‹Â‡Æè]äk^*>2QÁщ)}b¬¾·ñbœå ‘6Õ½,ì¸JÇÛäYêH:Í#È—Ï DÙ¯ç‰ŧ»CäÇ8Šy é>õ/i~3ÎñÚO’_8¬<gîQG=Ö/ºrþBè{k…–ÒÑuü “w25>$½KÜ8cù#FØÛú™wÓU=pÈíkU1—÷U/í܇KZIÙ o+Ù}Ñ\xa‰élæ"ÄuŒ_º¦pdK$Ùpž‚‚µ +…J^ª­$EöœaËD5ªhÙøÕY>‘\ËIÝ,³ÉðW÷¬uª|$aHˆ?Ëa#÷môˆ€<6j;Ò„üÐÿø?QÀ€ãðX/8Îô/»4 endstream endobj -879 0 obj << -/Length1 969 -/Length2 3492 -/Length3 532 -/Length 4169 -/Filter /FlateDecode ->> -stream -xÚí“y<”ý×ÇC%“’­dë"D˜ÅNÉ2ÈÞØndc03Œ[Œ(C$ÂH–,!B„d Ù“})»ÙB’±%~S=wýžû÷çóüõ¼žëúçzŸs¾ç|¾çœKTa&­áŒwBëàqDi¦ÀLa2 ‰ŠÂ h$ƒÇi!‰h¦¬ 4H®€ €)¨È*©@åA¢ïéOÀ¸ºq¸Ä E@ÃMÀ 8ÀItC{Ðs XÀ  ‰þ`@‹LœðLÑÞh‚Ú ‚Ág Š8¡]18ä‡ =œ Püev&yþíòA¼é¢qºH €.ÑÃúÎhÄO¯…¦+ùßõÏä:$,Öéñ#ý&ý‡éÁúÿWÞÓDD#¼3š€ûg¨%ú—6#´3†äñO¯‰Å 4p®X4ýeÂxë`üÐÎ å¸ ±ÞèŸv4ÎùŸ"è}û)‚¸dzÙÚRò×<úH Žhîïù;ëàŸ ûÃôî0~€  …Âèô÷ï/»ÔÒÆ¡ðÎ}!ä$€ôÑ7ƒNòÀU€Á9£ý´]0ŒÃéGzO‚<ôcœrJ$MÀÿ°þ2(<ý›å¡„èûÇ/£³ý'BA€hü!¢ù›ˆÑoR’ fH€˜ÿ&úr@¿ F¿,ýoHWåñaô’Þÿ†ôšÄ?(C?ëÿÿs,ššx¿«Ò²r€´ ý&ÊJJ€¢<4è¿ÇYà0^$´žýîP¨¢²ÜO+ŠD  qÄŸÿ}â³ †¾h´yG»á~·‚’OÖ~ÐûèÀYM×g±Æe Ï_¾Ã€Íí0ð:;Yjµ]ÌytæÀÌ)ß>ïÈÚ@“.Ï!^±IC»3>Ž3ÉU|V«ÉFþ=…7®b«©\[”g¸Ô?ù*?Á:»%m¥õS&B\Ë|–y\hß Ÿò)7­t’±áa¥b²B¦Ç’¼ò#äÂ'|%ÄíŸè¹Nv?T)9ö_KâØ~p(#~×vm¾_Ýæxê‚®{èÛk¬2ê–®¤Ü©[n§TUïl¥BÔze+Äb“pƒª©ñHíÊÓqCïxËÓÈàÐñÁ°W†¾2àÒ™‡iÞã'­_Y£5)`©Õ¿&pO«­B -FdŸÎ=Èè»"nòFï’7‹íܸKÍfâÓð©D8,ÈÉ:r(&Izâ-t£ÔwâÞÛ(öÔÇ©÷¸#›ß!ºv¤\–â>•w²œ}Ä|ëÓÅLÙË2£ùˆ~&êC%CÙ=ÂÂ^››>8”ƒvsƒ[yÎU9†)¤$°ÊHb%Èzﲚ¯ûa8*GÍñ -·ÑHŠ 8žiå‰hjã3†[Ô(®Z¼.UìN\5wÝ`˼Ïæç°ë–Ú鿺ùØrh#¥ª¥Ç~É.ɲ*1(%±«Ç{èµÃÆåíoužê÷ÎÖ =½ÏÛ_ÌG?ž±×¯üÓQ‰·Âc^c^ΚxròqD ¹ç³×4HŽ*0.ï–gøò´×ÛŒ¼ÇTxå<ßs7bÕ\û9X/êÇšQp©3ö™êð‡ -”…†ø››FÜI,ÍI‚Ð¥p){É‘zZm°öÞ§I6V±PSâ?êÎR£Ef¬ -O¬t$/Öb´ò\šn3NYÓ–ü *̲UGýä}•Ì¸Äí2|\0/u°ÏhŒªuçðNd0 ÙoeþµÞ®@²‘çÂõÅ^ÍvqkaªÖ–|"®¨UøïM>M©h¹¼qèjviRF|’Ò©É›x{÷À⣭宵R/ıÀ10þVÇÍmv31¯îú¥ZG›÷£ γâb{ÜñI†örŒu¢P7?÷ô臻YÌ 8ñ˜v®^þwu„Ëy‰ÕÝ4ÐI½·s¾GÏ~dÅFòôÍó›£Q›+Å{0£‚k[—°ÁײãÀ_Ù<ôþæÐ’2MuhT…Ì”¨jkf«3O•³çì®ãm/u>×…XYÝYp·0!—h)&¿K µù0Ù@5ƒHÄ5æ_ºxbÀW‚4î®ä±$0óÑ2žÙÆ ïbü%JíÆ>¯õÆmÝzÚ>¶Ï6èÀg–PìVZ4„" Q]jˆ>ð£Ff]™>ÇR(ïãÙ÷rƒŸOÝ|^w‡6¾š¥T½ž*Û­÷q«óѺù%HÒµx\Ë!¨èÚæ„ö—rj¡ÉtňúÿùWå³ÒuíZaÞï8Qþ\8ŸÛ'¬Û.>â–´ 2}=ÔD(%>} a]2ØȽüÅäl7ŸäÒI6š­#zü⧠ÑDê #=‰ËÈZ£ïñõîHÛ‘ ¡€ ÷ÚSµºr}mÓyøïÈùZµ¬1ZžkDVòËæU­ü-´ÝÇÊ;ȶ•Ò#×kÅæž0pKû~"µ~nTàNª–úÆóH3Ý®óÄ6ŠyÐd¬»R`\ÓsºZ,zOË›ï%w~ ­ï«Ó4ÜyزãÉÇâ†bÚ Õó“Yåa±"#×D:S -^Ç[r•)4]ÐÛjŒ—äªàd%Éœ;^Ô¸’Áu—&§—þâXU™òþö—oÜ4Ð÷F‹åˆûãO,yÚ‚Ÿù1\•=ê´x²©±,:¹ª2ñ‚êÂhÃMíbõ¼nÔ B~s!ýûU5ÿ -.rÍÕÞž·ÅåÎËêxû)ÑO¦ÖŒ­f"YÒZu×"™(’£šw}'y.œö(AdÖÙý_í)mÜÞ7/E=Éao ¡<ëó¯†JK ì?x²ßHÐÓ,’Þz·´M;hæÛÕm‘± Ók¼ÎÌػϋG«Jl»öE™WgÚË¡:@U"§ía£¬Êî߇N—uß™ÊN·¬84+ovÖì™Ñxç yhòL à¢3¼ÓkŠª÷²‚ûÍŸËi÷,ð¼?:YÂbµûõË\¶AlÐUj1ãýk :ZamÃte4XýxÐ\*ºµˆ“uª»!^çîóºù«SmJ褃ÉåƒDuå'G¦³#H7ù¢ŸpÇÇûõ{ž^)ó‰¾92ëE|,Û|äF•»no¨¸ŒZýËùKZoÙ5zÿ"ñi?:WÌ^'zF‡;Hl‘R·™ -X]rYûÀTÐs»<Ôi\“â°uFÛäT[ŒÊC/ bŸèHOÆn”¼êPÿ,î²0´ÇÉ…´~EóiXY˜]ÛÒ&{ÿH¬á²pƒ¢¤4“A±'cÀ§™s³çî$i=oùè+`BÃ| ¸gÌÉÜß®³ÒY)bÒÇ7?£äÞ•÷…9…çÐ,«™Gë*§Â™^?m>ŸZ~O‹Œ&£çW¿.ÍÚ«Zo Ž×E± -)~¯ß“ á<è»íP¦§ÀÄ\Côã -ç˜z#!¬ØYÍo[WEUŒKòúaúö8o>ÊiÙ×NqGíMÚ¹w¤g)óuYµ³â´2 s䊾ӑѡ%âwþr«œ:›ºÎ0<$òzš!Ü{´†¶ZoØx²Ê(nJ$ÊåÊEŸê’9É–ùÍÞ̾ʪr{P4«ÞÂ$¬0sš­“w?g—b”Ê*”` -][ä–xj)Ïci…÷§^ã8‡–@Ö¶êåÛŒŸO㬪,{|„›¸vª<–-¸Ë!ùÑ0^Ë€;§B3šªÕkÍà;|kÎ,7poÌù|’͸¼p(êüö`º8¹Õk¹zÙ¾ç²úÕi38¼wø¶µ‰Çþ}>“Ðvµ ò³•ç[õÛŸ¶º¶ß×[‡76¾WïƒT¸Ô[ˆ> endobj -878 0 obj << +938 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /PORZYW+CMR12 +/FontName /MMOZPF+CMR12 /ItalicAngle 0 /StemV 65 /XHeight 431 /FontBBox [-34 -251 988 750] /Flags 4 -/CharSet (/zero/one/two/three/A/B/M/S/T/a/e/m/s/t/y) -/FontFile 879 0 R +/CharSet (/zero/one/two/three/A/B/J/M/S/T/a/e/l/m/s/t/u/y) +/FontFile 939 0 R >> endobj -1794 0 obj -[490 490 490 490 0 0 0 0 0 0 0 0 0 0 0 0 0 734 693 0 0 0 0 0 0 0 0 0 0 897 0 0 0 0 0 544 707 0 0 0 0 0 0 0 0 0 0 0 0 490 0 0 0 435 0 0 0 0 0 0 0 816 0 0 0 0 0 386 381 0 0 0 0 517 ] +1971 0 obj +[490 490 490 490 0 0 0 0 0 0 0 0 0 0 0 0 0 734 693 0 0 0 0 0 0 0 503 0 0 897 0 0 0 0 0 544 707 0 0 0 0 0 0 0 0 0 0 0 0 490 0 0 0 435 0 0 0 0 0 0 272 816 0 0 0 0 0 386 381 544 0 0 0 517 ] endobj -876 0 obj << +936 0 obj << /Length1 1972 /Length2 11871 /Length3 532 @@ -7409,7 +8347,8 @@ stream xÚíµUX\]—h»;Á \‚w—`Á ‡ÂÝÝ݃»Hp <¸;ww‡Sï×ÝéîËÿ¿:Ï¡ns­=÷˜sɦ&WRe6%@¶NL¬Xy¢òªª"š¬,Ö,HÔÔ¢@C' ­˜¡Àúñ#+@ØÙ Àçâå`çeáB¢ˆ‚ìÜ,ÌÌ´¢tÿLâÛ,Œ mò†Næ@pcCk€*ÈØèäþ lm Pùç G€ Ðèà4ù€ÄÊ -0±0vÍ,l‘˜ÿq’¶5¸ÿ#lâl÷_C.@G°€,I+š€l­Ý&@S$fø]@°ÉÿRÿ3¹„³µµ‚¡Í?éÿ³Oÿk†¡…µûÎÙØ9;ò  ƒíÿœúøz" ëÿõ"i'Ck ca[3k €å?BŽn@% 'cs€©¡µ#ð_q ­ÉÿT7î_Ì2ššj’Š ÿ^Ó +ZØ:©¹Ûý;ñ?óÿŬo @‡å +x"ø÷_ÿ}ù¯·5™XØ‚7'ÀÐÁÁÐ ¼;ÀÄ ðdXØšÝ@7°3ó[ø¸)ÞSÒ?K +0±0vÍ,l‘˜ÿq’¶5¸ÿ#lâl÷_C.@G°€,I+š€l­Ý&@S$fø]@°ÉÿRÿ3¹„³µµ‚¡Í?éÿ³Oÿk†¡…µûÎÙØ9;ò  ƒíÿœúøz" ëÿõ"i'Ck ca[3k €å?BŽn@% 'cs€©¡µ#ð_q ­ÉÿT7î_Ìò2¢ +Š ÿ^Ó +ZØ:©¹Ûý;ñ?óÿŬo @‡å +x"ø÷_ÿ}ù¯·5™XØ‚7'ÀÐÁÁÐ ¼;ÀÄ ðdXØšÝ@7°3ó[ø¸)ÞSÒ?K ^ufÓÅþÙÀhñ†ì`´þ7²s˜íAN@#ëÿXÜ|üÏ‘ÿæ`0Û:m­¦EYÿ3ú?&ƒßmèøO G«· ØÀÎÚÙñ-v0ÙؾE8Ìæîvæ@Û·ø)p"É[ˆÀìhmèhþá0{@op [à¿™lïäú6Î öv2wþ5ãŸvœÞÿ4ÌÂå¯`]GðRþ›Á²Ž@—¿\ÁËÆ üoà«ÚZü-ÂóOÍÖ ·‡¸Øÿé7ÐñŸËá-Î-üFà¼"oÎ)úFà„bo®[üßÄ ®ZâÀ5K¾¸^©7KH¿¸R™7»È¾ØEîÀ.òovQx#°‹â¿‰ì¢ôF`å7»¨¼ØEõÀ.jovQ#°‹Æ]>¿ØEóÀ.Zÿ&ðÝËlä`hltúo»|³1¿mÆà FoÎ`üvšXÀå˜ü…àŒÀ¿ðŸÍô‚+2û Á%™ÿ…àšþ:§,à¢,ÿB°“Õ_–²þ ÁV6o¾™˜mÿB°è/[Ùý…ÿl¼¿låðþ³»ÿB°•Ó_¶rþ ÁV.!ØÊõ¯‹låö‚­ÜÿB°•Ç¿ð_¾"" 7O&ðÆebŸ`pµÁ{ŒÅû¿OT·µŸi1ð!gaá·ïŸ¨±³øVrú×÷|±ÿ›Z€?@ ÐiadÌd™ÚRæ#^0^KçHœ^4Ü\—Î÷áðÖ´Cã˜ô3ÓÒ¢#åX¶’ÙÄ”s°AØ«ßS•9x³‡./CþÔøPWêwN_ºMVøîÙ–]#Ãé"åõªK;lµÜ>+w>áqLÙÜìó¥•ïÈÚrš åv Ò—œV¹d ÆÞjÜÐÑ$¨´Pô_7ãûe°keÒj5ýcdŽ<ôLºÀ"ë²y–çd´_Tž›ûâuÙ @@ -7458,203 +8397,327 @@ rÙ¼ b½ˆ ¹%ÈÀWq¾ìl ôA"æ±—È>åDkâ[¯HÙ÷ôòÄ_D6ŸQpL_¤ºp³B#?nKÀ¡L%ŸÜ| nÿ\•þ4×gBÂQŽMŠ™=n³'úu,̈ùšÖnêÕNLŠØ).­C+Ü1 BŠÅ E‡†¸Íe8½O&ù“sI‘ÜoÂð^´×Rn3eÂeŒ½ŽÕ8¾??:i5ÎøèÙÍãc¬a'Zoï×QU«Ë‘ËŠi"îŠr¤RàGèQòÏ{0§ÒøÉšS@î ÔO§*ÙáPPcÚ˜8êÑÏ(?Ô]«3 ¾·~¨Ÿw%lgHn Cvf¾úîë› ðáË·J0ö‘3®ñÚ.(‚7/Rù…©“44Š¤"öˆ¢¢Mam£ã'B|ÿ¢‡cjå$ ñ<šËÿàˆm·†›s¡’´ì%ì¼Æ)WØ2úíH»ëÙß—|•ÞãGâª4¾Ég^a)£/T£æîoA•‰äPCÁˆW£sæÛ]±’™¶^'Ôýö¨Í¢ý‡=R[œÙ›ãÌ.-ó‹0K?Á¬„.ÿ‰â®ŒÖ˜7pEÆ¿ßCùýêo«ÐÎ=6’(cŽrîÿ÷>,UËòÓ@ñçNé(ÚDöeNmnœîelrÞëV& ‰¥>)>e°6a»./ø»n åCŒÑc89m©ÉÖÑï¯ð]81§Q\˜²Ô~ö0Ô2qC^&en¯}Z®Fé­—.Ú—U(KŽ$gEý0/¬V˜Å~„v;ð׳äòÛ8_h~7¥e-AfrŠî‰cÀÌ-ÝI±ê±¡zøö`#§=-i fÛÕ£iCå¹ >C­½%FcÜ—¯è_žÄDŸ=C¬´ üÅvÒvN)¿"é“®Pxq+¾>!¢ T i–%hf6ô‰ð¥*Øáð´å棙j;q„|ãØEž9å(ŵoö»´…äÀ«ÀbJpí/·9@ŒÐ„×ô¶ðãåDlßVaB=Ýy” …Ìé~·Xù/»ufÙ}ð#ÀkÉ*â‡?¦Aà­ÍÏùƒDÙ¯¢Ç‰Í€róÍ";2“j2±d @Ñü÷nS‰–ff/§béŒ -Yr%9Åy[sÊCb¾p“”¦zµ5+ãmdª”T”¢£ÝIèï7Úc…ß…3zídt‡¯€a…TÒE„*/f®1î{¢p8âú‘â&E™\¦X=yñ¥Ô¦_!R«– Êf•ñ/”£F(°ÛæÐýR‰”Ó‰'V™u#OóèwL®M «ÖNºñ°h5º9_Ö^%¢Ç"kYK ²´gs~é7^%ŠãØl‘›s.#Í # ×j-¤.¹§)àì`ëÛ!nйÐе4‰Òi;@±qäc\`º?M€œY§¶o’µ_·@[øü‚Áð–sBbÖãÙž±Ve,ÿÿþ_‚ÿ+[ œ@6†VHÿྑendstream +Yr%9Åy[sÊCb¾p“”¦zµ5+ãmdª”T”¢£ÝIèï7Úc…ß…3zídt‡¯€a…TÒE„*/f®1î{¢p8âú‘â&E™\¦X=yñ¥Ô¦_!R«– Êf•ñ/”£F(°ÛæÐýR‰”Ó‰'V™u#OóèwL®M «ÖNºñ°h5º9_Ö^%¢Ç"kYK ²´gs~é7^%ŠãØl‘›s.#Í # ×j-¤.¹§)àì`ëÛ!nйÐе4‰Òi;@±qäc\`º?M€œY§¶o’µ_·@[øü‚Áð–sBbÖãÙž±Ve,ÿÿþ_‚ÿ+[ œ@6†VHÿã¾zendstream endobj -877 0 obj << +937 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1781 0 R +/Encoding 1960 0 R /FirstChar 11 /LastChar 122 -/Widths 1795 0 R -/BaseFont /JXXTGO+CMSSBX10 -/FontDescriptor 875 0 R +/Widths 1972 0 R +/BaseFont /MJCNOV+CMSSBX10 +/FontDescriptor 935 0 R >> endobj -875 0 obj << +935 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 -/FontName /JXXTGO+CMSSBX10 +/FontName /MJCNOV+CMSSBX10 /ItalicAngle 0 /StemV 136 /XHeight 458 /FontBBox [-71 -250 1099 780] /Flags 4 /CharSet (/ff/fi/fl/quotedblright/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/question/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/bracketleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) -/FontFile 876 0 R +/FontFile 936 0 R >> endobj -1795 0 obj +1972 0 obj [642 586 586 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 558 0 0 0 0 306 428 428 550 856 306 367 306 550 550 550 550 550 550 550 550 550 550 550 306 0 0 0 0 519 0 733 733 703 794 642 611 733 794 331 519 764 581 978 794 794 703 794 703 611 733 764 733 1039 733 733 0 343 0 0 0 0 0 525 561 489 561 511 336 550 561 256 286 531 256 867 561 550 561 561 372 422 404 561 500 744 500 500 476 ] endobj -881 0 obj << +941 0 obj << /Type /Pages /Count 6 -/Parent 1796 0 R -/Kids [870 0 R 883 0 R 906 0 R 951 0 R 1007 0 R 1063 0 R] +/Parent 1973 0 R +/Kids [930 0 R 943 0 R 960 0 R 1024 0 R 1069 0 R 1123 0 R] >> endobj -1148 0 obj << +1229 0 obj << /Type /Pages /Count 6 -/Parent 1796 0 R -/Kids [1120 0 R 1150 0 R 1157 0 R 1165 0 R 1180 0 R 1188 0 R] +/Parent 1973 0 R +/Kids [1176 0 R 1231 0 R 1280 0 R 1286 0 R 1291 0 R 1306 0 R] >> endobj -1202 0 obj << +1321 0 obj << /Type /Pages /Count 6 -/Parent 1796 0 R -/Kids [1198 0 R 1204 0 R 1210 0 R 1221 0 R 1236 0 R 1257 0 R] +/Parent 1973 0 R +/Kids [1313 0 R 1323 0 R 1328 0 R 1335 0 R 1345 0 R 1360 0 R] >> endobj -1289 0 obj << +1393 0 obj << /Type /Pages /Count 6 -/Parent 1796 0 R -/Kids [1272 0 R 1291 0 R 1310 0 R 1324 0 R 1339 0 R 1358 0 R] +/Parent 1973 0 R +/Kids [1380 0 R 1395 0 R 1411 0 R 1428 0 R 1446 0 R 1461 0 R] >> endobj -1372 0 obj << +1484 0 obj << /Type /Pages /Count 6 -/Parent 1796 0 R -/Kids [1363 0 R 1374 0 R 1382 0 R 1389 0 R 1396 0 R 1400 0 R] +/Parent 1973 0 R +/Kids [1479 0 R 1486 0 R 1495 0 R 1502 0 R 1508 0 R 1516 0 R] >> endobj -1414 0 obj << +1526 0 obj << /Type /Pages /Count 6 -/Parent 1796 0 R -/Kids [1411 0 R 1416 0 R 1434 0 R 1447 0 R 1459 0 R 1470 0 R] +/Parent 1973 0 R +/Kids [1520 0 R 1528 0 R 1532 0 R 1542 0 R 1559 0 R 1575 0 R] >> endobj -1487 0 obj << +1599 0 obj << /Type /Pages /Count 6 -/Parent 1797 0 R -/Kids [1479 0 R 1489 0 R 1496 0 R 1502 0 R 1508 0 R 1514 0 R] +/Parent 1974 0 R +/Kids [1588 0 R 1601 0 R 1611 0 R 1620 0 R 1626 0 R 1632 0 R] >> endobj -1525 0 obj << +1646 0 obj << /Type /Pages /Count 6 -/Parent 1797 0 R -/Kids [1520 0 R 1527 0 R 1536 0 R 1544 0 R 1550 0 R 1562 0 R] +/Parent 1974 0 R +/Kids [1639 0 R 1648 0 R 1658 0 R 1665 0 R 1679 0 R 1691 0 R] >> endobj -1581 0 obj << +1711 0 obj << /Type /Pages /Count 6 -/Parent 1797 0 R -/Kids [1574 0 R 1583 0 R 1591 0 R 1602 0 R 1612 0 R 1621 0 R] +/Parent 1974 0 R +/Kids [1700 0 R 1713 0 R 1723 0 R 1732 0 R 1743 0 R 1750 0 R] >> endobj -1638 0 obj << +1766 0 obj << /Type /Pages /Count 6 -/Parent 1797 0 R -/Kids [1629 0 R 1640 0 R 1646 0 R 1654 0 R 1662 0 R 1670 0 R] +/Parent 1974 0 R +/Kids [1759 0 R 1768 0 R 1775 0 R 1787 0 R 1793 0 R 1797 0 R] >> endobj -1687 0 obj << +1805 0 obj << /Type /Pages /Count 6 -/Parent 1797 0 R -/Kids [1680 0 R 1689 0 R 1693 0 R 1697 0 R 1703 0 R 1709 0 R] +/Parent 1974 0 R +/Kids [1801 0 R 1807 0 R 1812 0 R 1821 0 R 1830 0 R 1835 0 R] >> endobj -1726 0 obj << +1846 0 obj << /Type /Pages /Count 6 -/Parent 1797 0 R -/Kids [1719 0 R 1728 0 R 1733 0 R 1740 0 R 1746 0 R 1750 0 R] +/Parent 1974 0 R +/Kids [1841 0 R 1848 0 R 1852 0 R 1860 0 R 1866 0 R 1872 0 R] >> endobj -1764 0 obj << +1881 0 obj << +/Type /Pages +/Count 6 +/Parent 1975 0 R +/Kids [1878 0 R 1883 0 R 1890 0 R 1895 0 R 1899 0 R 1903 0 R] +>> endobj +1919 0 obj << /Type /Pages -/Count 3 -/Parent 1798 0 R -/Kids [1759 0 R 1766 0 R 1773 0 R] +/Count 6 +/Parent 1975 0 R +/Kids [1914 0 R 1921 0 R 1929 0 R 1933 0 R 1939 0 R 1946 0 R] >> endobj -1796 0 obj << +1957 0 obj << +/Type /Pages +/Count 1 +/Parent 1975 0 R +/Kids [1952 0 R] +>> endobj +1973 0 obj << /Type /Pages /Count 36 -/Parent 1799 0 R -/Kids [881 0 R 1148 0 R 1202 0 R 1289 0 R 1372 0 R 1414 0 R] +/Parent 1976 0 R +/Kids [941 0 R 1229 0 R 1321 0 R 1393 0 R 1484 0 R 1526 0 R] >> endobj -1797 0 obj << +1974 0 obj << /Type /Pages /Count 36 -/Parent 1799 0 R -/Kids [1487 0 R 1525 0 R 1581 0 R 1638 0 R 1687 0 R 1726 0 R] +/Parent 1976 0 R +/Kids [1599 0 R 1646 0 R 1711 0 R 1766 0 R 1805 0 R 1846 0 R] >> endobj -1798 0 obj << +1975 0 obj << /Type /Pages -/Count 3 -/Parent 1799 0 R -/Kids [1764 0 R] +/Count 13 +/Parent 1976 0 R +/Kids [1881 0 R 1919 0 R 1957 0 R] >> endobj -1799 0 obj << +1976 0 obj << /Type /Pages -/Count 75 -/Kids [1796 0 R 1797 0 R 1798 0 R] +/Count 85 +/Kids [1973 0 R 1974 0 R 1975 0 R] >> endobj -1800 0 obj << +1977 0 obj << /Type /Outlines /First 7 0 R -/Last 859 0 R -/Count 16 +/Last 927 0 R +/Count 19 +>> endobj +927 0 obj << +/Title 928 0 R +/A 925 0 R +/Parent 1977 0 R +/Prev 915 0 R +>> endobj +923 0 obj << +/Title 924 0 R +/A 921 0 R +/Parent 915 0 R +/Prev 919 0 R +>> endobj +919 0 obj << +/Title 920 0 R +/A 917 0 R +/Parent 915 0 R +/Next 923 0 R +>> endobj +915 0 obj << +/Title 916 0 R +/A 913 0 R +/Parent 1977 0 R +/Prev 867 0 R +/Next 927 0 R +/First 919 0 R +/Last 923 0 R +/Count -2 +>> endobj +911 0 obj << +/Title 912 0 R +/A 909 0 R +/Parent 903 0 R +/Prev 907 0 R +>> endobj +907 0 obj << +/Title 908 0 R +/A 905 0 R +/Parent 903 0 R +/Next 911 0 R +>> endobj +903 0 obj << +/Title 904 0 R +/A 901 0 R +/Parent 867 0 R +/Prev 895 0 R +/First 907 0 R +/Last 911 0 R +/Count -2 +>> endobj +899 0 obj << +/Title 900 0 R +/A 897 0 R +/Parent 895 0 R +>> endobj +895 0 obj << +/Title 896 0 R +/A 893 0 R +/Parent 867 0 R +/Prev 883 0 R +/Next 903 0 R +/First 899 0 R +/Last 899 0 R +/Count -1 +>> endobj +891 0 obj << +/Title 892 0 R +/A 889 0 R +/Parent 883 0 R +/Prev 887 0 R +>> endobj +887 0 obj << +/Title 888 0 R +/A 885 0 R +/Parent 883 0 R +/Next 891 0 R +>> endobj +883 0 obj << +/Title 884 0 R +/A 881 0 R +/Parent 867 0 R +/Prev 871 0 R +/Next 895 0 R +/First 887 0 R +/Last 891 0 R +/Count -2 +>> endobj +879 0 obj << +/Title 880 0 R +/A 877 0 R +/Parent 871 0 R +/Prev 875 0 R +>> endobj +875 0 obj << +/Title 876 0 R +/A 873 0 R +/Parent 871 0 R +/Next 879 0 R +>> endobj +871 0 obj << +/Title 872 0 R +/A 869 0 R +/Parent 867 0 R +/Next 883 0 R +/First 875 0 R +/Last 879 0 R +/Count -2 >> endobj 867 0 obj << /Title 868 0 R /A 865 0 R -/Parent 859 0 R -/Prev 863 0 R +/Parent 1977 0 R +/Prev 855 0 R +/Next 915 0 R +/First 871 0 R +/Last 903 0 R +/Count -4 >> endobj 863 0 obj << /Title 864 0 R /A 861 0 R -/Parent 859 0 R -/Next 867 0 R +/Parent 855 0 R +/Prev 859 0 R >> endobj 859 0 obj << /Title 860 0 R /A 857 0 R -/Parent 1800 0 R -/Prev 847 0 R -/First 863 0 R -/Last 867 0 R -/Count -2 +/Parent 855 0 R +/Next 863 0 R >> endobj 855 0 obj << /Title 856 0 R /A 853 0 R -/Parent 847 0 R -/Prev 851 0 R +/Parent 1977 0 R +/Prev 827 0 R +/Next 867 0 R +/First 859 0 R +/Last 863 0 R +/Count -2 >> endobj 851 0 obj << /Title 852 0 R /A 849 0 R /Parent 847 0 R -/Next 855 0 R >> endobj 847 0 obj << /Title 848 0 R /A 845 0 R -/Parent 1800 0 R -/Prev 819 0 R -/Next 859 0 R +/Parent 827 0 R +/Prev 835 0 R /First 851 0 R -/Last 855 0 R -/Count -2 +/Last 851 0 R +/Count -1 >> endobj 843 0 obj << /Title 844 0 R /A 841 0 R -/Parent 839 0 R +/Parent 835 0 R +/Prev 839 0 R >> endobj 839 0 obj << /Title 840 0 R /A 837 0 R -/Parent 819 0 R -/Prev 827 0 R -/First 843 0 R -/Last 843 0 R -/Count -1 +/Parent 835 0 R +/Next 843 0 R >> endobj 835 0 obj << /Title 836 0 R /A 833 0 R /Parent 827 0 R /Prev 831 0 R +/Next 847 0 R +/First 839 0 R +/Last 843 0 R +/Count -2 >> endobj 831 0 obj << /Title 832 0 R @@ -7665,732 +8728,729 @@ endobj 827 0 obj << /Title 828 0 R /A 825 0 R -/Parent 819 0 R -/Prev 823 0 R -/Next 839 0 R +/Parent 1977 0 R +/Prev 811 0 R +/Next 855 0 R /First 831 0 R -/Last 835 0 R -/Count -2 +/Last 847 0 R +/Count -3 >> endobj 823 0 obj << /Title 824 0 R /A 821 0 R -/Parent 819 0 R -/Next 827 0 R +/Parent 811 0 R +/Prev 819 0 R >> endobj 819 0 obj << /Title 820 0 R /A 817 0 R -/Parent 1800 0 R -/Prev 803 0 R -/Next 847 0 R -/First 823 0 R -/Last 839 0 R -/Count -3 +/Parent 811 0 R +/Prev 815 0 R +/Next 823 0 R >> endobj 815 0 obj << /Title 816 0 R /A 813 0 R -/Parent 803 0 R -/Prev 811 0 R +/Parent 811 0 R +/Next 819 0 R >> endobj 811 0 obj << /Title 812 0 R /A 809 0 R -/Parent 803 0 R -/Prev 807 0 R -/Next 815 0 R +/Parent 1977 0 R +/Prev 759 0 R +/Next 827 0 R +/First 815 0 R +/Last 823 0 R +/Count -3 >> endobj 807 0 obj << /Title 808 0 R /A 805 0 R -/Parent 803 0 R -/Next 811 0 R +/Parent 759 0 R +/Prev 803 0 R >> endobj 803 0 obj << /Title 804 0 R /A 801 0 R -/Parent 1800 0 R -/Prev 751 0 R -/Next 819 0 R -/First 807 0 R -/Last 815 0 R -/Count -3 +/Parent 759 0 R +/Prev 791 0 R +/Next 807 0 R >> endobj 799 0 obj << /Title 800 0 R /A 797 0 R -/Parent 751 0 R +/Parent 791 0 R /Prev 795 0 R >> endobj 795 0 obj << /Title 796 0 R /A 793 0 R -/Parent 751 0 R -/Prev 783 0 R +/Parent 791 0 R /Next 799 0 R >> endobj 791 0 obj << /Title 792 0 R /A 789 0 R -/Parent 783 0 R -/Prev 787 0 R +/Parent 759 0 R +/Prev 775 0 R +/Next 803 0 R +/First 795 0 R +/Last 799 0 R +/Count -2 >> endobj 787 0 obj << /Title 788 0 R /A 785 0 R -/Parent 783 0 R -/Next 791 0 R +/Parent 775 0 R +/Prev 783 0 R >> endobj 783 0 obj << /Title 784 0 R /A 781 0 R -/Parent 751 0 R -/Prev 767 0 R -/Next 795 0 R -/First 787 0 R -/Last 791 0 R -/Count -2 +/Parent 775 0 R +/Prev 779 0 R +/Next 787 0 R >> endobj 779 0 obj << /Title 780 0 R /A 777 0 R -/Parent 767 0 R -/Prev 775 0 R +/Parent 775 0 R +/Next 783 0 R >> endobj 775 0 obj << /Title 776 0 R /A 773 0 R -/Parent 767 0 R +/Parent 759 0 R /Prev 771 0 R -/Next 779 0 R +/Next 791 0 R +/First 779 0 R +/Last 787 0 R +/Count -3 >> endobj 771 0 obj << /Title 772 0 R /A 769 0 R -/Parent 767 0 R +/Parent 759 0 R +/Prev 767 0 R /Next 775 0 R >> endobj 767 0 obj << /Title 768 0 R /A 765 0 R -/Parent 751 0 R +/Parent 759 0 R /Prev 763 0 R -/Next 783 0 R -/First 771 0 R -/Last 779 0 R -/Count -3 +/Next 771 0 R >> endobj 763 0 obj << /Title 764 0 R /A 761 0 R -/Parent 751 0 R -/Prev 759 0 R +/Parent 759 0 R /Next 767 0 R >> endobj 759 0 obj << /Title 760 0 R /A 757 0 R -/Parent 751 0 R -/Prev 755 0 R -/Next 763 0 R +/Parent 1977 0 R +/Prev 751 0 R +/Next 811 0 R +/First 763 0 R +/Last 807 0 R +/Count -7 >> endobj 755 0 obj << /Title 756 0 R /A 753 0 R /Parent 751 0 R -/Next 759 0 R >> endobj 751 0 obj << /Title 752 0 R /A 749 0 R -/Parent 1800 0 R -/Prev 743 0 R -/Next 803 0 R +/Parent 1977 0 R +/Prev 727 0 R +/Next 759 0 R /First 755 0 R -/Last 799 0 R -/Count -7 +/Last 755 0 R +/Count -1 >> endobj 747 0 obj << /Title 748 0 R /A 745 0 R -/Parent 743 0 R +/Parent 727 0 R +/Prev 743 0 R >> endobj 743 0 obj << /Title 744 0 R /A 741 0 R -/Parent 1800 0 R -/Prev 719 0 R -/Next 751 0 R -/First 747 0 R -/Last 747 0 R -/Count -1 +/Parent 727 0 R +/Prev 739 0 R +/Next 747 0 R >> endobj 739 0 obj << /Title 740 0 R /A 737 0 R -/Parent 719 0 R +/Parent 727 0 R /Prev 735 0 R +/Next 743 0 R >> endobj 735 0 obj << /Title 736 0 R /A 733 0 R -/Parent 719 0 R +/Parent 727 0 R /Prev 731 0 R /Next 739 0 R >> endobj 731 0 obj << /Title 732 0 R /A 729 0 R -/Parent 719 0 R -/Prev 727 0 R +/Parent 727 0 R /Next 735 0 R >> endobj 727 0 obj << /Title 728 0 R /A 725 0 R -/Parent 719 0 R -/Prev 723 0 R -/Next 731 0 R +/Parent 1977 0 R +/Prev 259 0 R +/Next 751 0 R +/First 731 0 R +/Last 747 0 R +/Count -5 >> endobj 723 0 obj << /Title 724 0 R /A 721 0 R -/Parent 719 0 R -/Next 727 0 R +/Parent 711 0 R +/Prev 719 0 R >> endobj 719 0 obj << /Title 720 0 R /A 717 0 R -/Parent 1800 0 R -/Prev 251 0 R -/Next 743 0 R -/First 723 0 R -/Last 739 0 R -/Count -5 +/Parent 711 0 R +/Prev 715 0 R +/Next 723 0 R >> endobj 715 0 obj << /Title 716 0 R /A 713 0 R -/Parent 703 0 R -/Prev 711 0 R +/Parent 711 0 R +/Next 719 0 R >> endobj 711 0 obj << /Title 712 0 R /A 709 0 R -/Parent 703 0 R -/Prev 707 0 R -/Next 715 0 R +/Parent 695 0 R +/Prev 699 0 R +/First 715 0 R +/Last 723 0 R +/Count -3 >> endobj 707 0 obj << /Title 708 0 R /A 705 0 R -/Parent 703 0 R -/Next 711 0 R +/Parent 699 0 R +/Prev 703 0 R >> endobj 703 0 obj << /Title 704 0 R /A 701 0 R -/Parent 687 0 R -/Prev 691 0 R -/First 707 0 R -/Last 715 0 R -/Count -3 +/Parent 699 0 R +/Next 707 0 R >> endobj 699 0 obj << /Title 700 0 R /A 697 0 R -/Parent 691 0 R -/Prev 695 0 R +/Parent 695 0 R +/Next 711 0 R +/First 703 0 R +/Last 707 0 R +/Count -2 >> endobj 695 0 obj << /Title 696 0 R /A 693 0 R -/Parent 691 0 R -/Next 699 0 R +/Parent 259 0 R +/Prev 679 0 R +/First 699 0 R +/Last 711 0 R +/Count -2 >> endobj 691 0 obj << /Title 692 0 R /A 689 0 R -/Parent 687 0 R -/Next 703 0 R -/First 695 0 R -/Last 699 0 R -/Count -2 +/Parent 679 0 R +/Prev 687 0 R >> endobj 687 0 obj << /Title 688 0 R /A 685 0 R -/Parent 251 0 R -/Prev 671 0 R -/First 691 0 R -/Last 703 0 R -/Count -2 +/Parent 679 0 R +/Prev 683 0 R +/Next 691 0 R >> endobj 683 0 obj << /Title 684 0 R /A 681 0 R -/Parent 671 0 R -/Prev 679 0 R +/Parent 679 0 R +/Next 687 0 R >> endobj 679 0 obj << /Title 680 0 R /A 677 0 R -/Parent 671 0 R -/Prev 675 0 R -/Next 683 0 R +/Parent 259 0 R +/Prev 651 0 R +/Next 695 0 R +/First 683 0 R +/Last 691 0 R +/Count -3 >> endobj 675 0 obj << /Title 676 0 R /A 673 0 R -/Parent 671 0 R -/Next 679 0 R +/Parent 667 0 R +/Prev 671 0 R >> endobj 671 0 obj << /Title 672 0 R /A 669 0 R -/Parent 251 0 R -/Prev 643 0 R -/Next 687 0 R -/First 675 0 R -/Last 683 0 R -/Count -3 +/Parent 667 0 R +/Next 675 0 R >> endobj 667 0 obj << /Title 668 0 R /A 665 0 R -/Parent 659 0 R -/Prev 663 0 R +/Parent 651 0 R +/Prev 655 0 R +/First 671 0 R +/Last 675 0 R +/Count -2 >> endobj 663 0 obj << /Title 664 0 R /A 661 0 R -/Parent 659 0 R -/Next 667 0 R +/Parent 655 0 R +/Prev 659 0 R >> endobj 659 0 obj << /Title 660 0 R /A 657 0 R -/Parent 643 0 R -/Prev 647 0 R -/First 663 0 R -/Last 667 0 R -/Count -2 +/Parent 655 0 R +/Next 663 0 R >> endobj 655 0 obj << /Title 656 0 R /A 653 0 R -/Parent 647 0 R -/Prev 651 0 R +/Parent 651 0 R +/Next 667 0 R +/First 659 0 R +/Last 663 0 R +/Count -2 >> endobj 651 0 obj << /Title 652 0 R /A 649 0 R -/Parent 647 0 R -/Next 655 0 R +/Parent 259 0 R +/Prev 623 0 R +/Next 679 0 R +/First 655 0 R +/Last 667 0 R +/Count -2 >> endobj 647 0 obj << /Title 648 0 R /A 645 0 R -/Parent 643 0 R -/Next 659 0 R -/First 651 0 R -/Last 655 0 R -/Count -2 +/Parent 639 0 R +/Prev 643 0 R >> endobj 643 0 obj << /Title 644 0 R /A 641 0 R -/Parent 251 0 R -/Prev 615 0 R -/Next 671 0 R -/First 647 0 R -/Last 659 0 R -/Count -2 +/Parent 639 0 R +/Next 647 0 R >> endobj 639 0 obj << /Title 640 0 R /A 637 0 R -/Parent 631 0 R -/Prev 635 0 R +/Parent 623 0 R +/Prev 627 0 R +/First 643 0 R +/Last 647 0 R +/Count -2 >> endobj 635 0 obj << /Title 636 0 R /A 633 0 R -/Parent 631 0 R -/Next 639 0 R +/Parent 627 0 R +/Prev 631 0 R >> endobj 631 0 obj << /Title 632 0 R /A 629 0 R -/Parent 615 0 R -/Prev 619 0 R -/First 635 0 R -/Last 639 0 R -/Count -2 +/Parent 627 0 R +/Next 635 0 R >> endobj 627 0 obj << /Title 628 0 R /A 625 0 R -/Parent 619 0 R -/Prev 623 0 R +/Parent 623 0 R +/Next 639 0 R +/First 631 0 R +/Last 635 0 R +/Count -2 >> endobj 623 0 obj << /Title 624 0 R /A 621 0 R -/Parent 619 0 R -/Next 627 0 R +/Parent 259 0 R +/Prev 559 0 R +/Next 651 0 R +/First 627 0 R +/Last 639 0 R +/Count -2 >> endobj 619 0 obj << /Title 620 0 R /A 617 0 R -/Parent 615 0 R -/Next 631 0 R -/First 623 0 R -/Last 627 0 R -/Count -2 +/Parent 611 0 R +/Prev 615 0 R >> endobj 615 0 obj << /Title 616 0 R /A 613 0 R -/Parent 251 0 R -/Prev 551 0 R -/Next 643 0 R -/First 619 0 R -/Last 631 0 R -/Count -2 +/Parent 611 0 R +/Next 619 0 R >> endobj 611 0 obj << /Title 612 0 R /A 609 0 R -/Parent 603 0 R -/Prev 607 0 R +/Parent 559 0 R +/Prev 599 0 R +/First 615 0 R +/Last 619 0 R +/Count -2 >> endobj 607 0 obj << /Title 608 0 R /A 605 0 R -/Parent 603 0 R -/Next 611 0 R +/Parent 599 0 R +/Prev 603 0 R >> endobj 603 0 obj << /Title 604 0 R /A 601 0 R -/Parent 551 0 R -/Prev 591 0 R -/First 607 0 R -/Last 611 0 R -/Count -2 +/Parent 599 0 R +/Next 607 0 R >> endobj 599 0 obj << /Title 600 0 R /A 597 0 R -/Parent 591 0 R -/Prev 595 0 R +/Parent 559 0 R +/Prev 587 0 R +/Next 611 0 R +/First 603 0 R +/Last 607 0 R +/Count -2 >> endobj 595 0 obj << /Title 596 0 R /A 593 0 R -/Parent 591 0 R -/Next 599 0 R +/Parent 587 0 R +/Prev 591 0 R >> endobj 591 0 obj << /Title 592 0 R /A 589 0 R -/Parent 551 0 R -/Prev 579 0 R -/Next 603 0 R -/First 595 0 R -/Last 599 0 R -/Count -2 +/Parent 587 0 R +/Next 595 0 R >> endobj 587 0 obj << /Title 588 0 R /A 585 0 R -/Parent 579 0 R -/Prev 583 0 R +/Parent 559 0 R +/Prev 575 0 R +/Next 599 0 R +/First 591 0 R +/Last 595 0 R +/Count -2 >> endobj 583 0 obj << /Title 584 0 R /A 581 0 R -/Parent 579 0 R -/Next 587 0 R +/Parent 575 0 R +/Prev 579 0 R >> endobj 579 0 obj << /Title 580 0 R /A 577 0 R -/Parent 551 0 R -/Prev 567 0 R -/Next 591 0 R -/First 583 0 R -/Last 587 0 R -/Count -2 +/Parent 575 0 R +/Next 583 0 R >> endobj 575 0 obj << /Title 576 0 R /A 573 0 R -/Parent 567 0 R -/Prev 571 0 R +/Parent 559 0 R +/Prev 563 0 R +/Next 587 0 R +/First 579 0 R +/Last 583 0 R +/Count -2 >> endobj 571 0 obj << /Title 572 0 R /A 569 0 R -/Parent 567 0 R -/Next 575 0 R +/Parent 563 0 R +/Prev 567 0 R >> endobj 567 0 obj << /Title 568 0 R /A 565 0 R -/Parent 551 0 R -/Prev 555 0 R -/Next 579 0 R -/First 571 0 R -/Last 575 0 R -/Count -2 +/Parent 563 0 R +/Next 571 0 R >> endobj 563 0 obj << /Title 564 0 R /A 561 0 R -/Parent 555 0 R -/Prev 559 0 R +/Parent 559 0 R +/Next 575 0 R +/First 567 0 R +/Last 571 0 R +/Count -2 >> endobj 559 0 obj << /Title 560 0 R /A 557 0 R -/Parent 555 0 R -/Next 563 0 R +/Parent 259 0 R +/Prev 419 0 R +/Next 623 0 R +/First 563 0 R +/Last 611 0 R +/Count -5 >> endobj 555 0 obj << /Title 556 0 R /A 553 0 R -/Parent 551 0 R -/Next 567 0 R -/First 559 0 R -/Last 563 0 R -/Count -2 +/Parent 547 0 R +/Prev 551 0 R >> endobj 551 0 obj << /Title 552 0 R /A 549 0 R -/Parent 251 0 R -/Prev 411 0 R -/Next 615 0 R -/First 555 0 R -/Last 603 0 R -/Count -5 +/Parent 547 0 R +/Next 555 0 R >> endobj 547 0 obj << /Title 548 0 R /A 545 0 R -/Parent 539 0 R -/Prev 543 0 R +/Parent 419 0 R +/Prev 535 0 R +/First 551 0 R +/Last 555 0 R +/Count -2 >> endobj 543 0 obj << /Title 544 0 R /A 541 0 R -/Parent 539 0 R -/Next 547 0 R +/Parent 535 0 R +/Prev 539 0 R >> endobj 539 0 obj << /Title 540 0 R /A 537 0 R -/Parent 411 0 R -/Prev 527 0 R -/First 543 0 R -/Last 547 0 R -/Count -2 +/Parent 535 0 R +/Next 543 0 R >> endobj 535 0 obj << /Title 536 0 R /A 533 0 R -/Parent 527 0 R -/Prev 531 0 R +/Parent 419 0 R +/Prev 523 0 R +/Next 547 0 R +/First 539 0 R +/Last 543 0 R +/Count -2 >> endobj 531 0 obj << /Title 532 0 R /A 529 0 R -/Parent 527 0 R -/Next 535 0 R +/Parent 523 0 R +/Prev 527 0 R >> endobj 527 0 obj << /Title 528 0 R /A 525 0 R -/Parent 411 0 R -/Prev 515 0 R -/Next 539 0 R -/First 531 0 R -/Last 535 0 R -/Count -2 +/Parent 523 0 R +/Next 531 0 R >> endobj 523 0 obj << /Title 524 0 R /A 521 0 R -/Parent 515 0 R -/Prev 519 0 R +/Parent 419 0 R +/Prev 511 0 R +/Next 535 0 R +/First 527 0 R +/Last 531 0 R +/Count -2 >> endobj 519 0 obj << /Title 520 0 R /A 517 0 R -/Parent 515 0 R -/Next 523 0 R +/Parent 511 0 R +/Prev 515 0 R >> endobj 515 0 obj << /Title 516 0 R /A 513 0 R -/Parent 411 0 R -/Prev 503 0 R -/Next 527 0 R -/First 519 0 R -/Last 523 0 R -/Count -2 +/Parent 511 0 R +/Next 519 0 R >> endobj 511 0 obj << /Title 512 0 R /A 509 0 R -/Parent 503 0 R -/Prev 507 0 R +/Parent 419 0 R +/Prev 499 0 R +/Next 523 0 R +/First 515 0 R +/Last 519 0 R +/Count -2 >> endobj 507 0 obj << /Title 508 0 R /A 505 0 R -/Parent 503 0 R -/Next 511 0 R +/Parent 499 0 R +/Prev 503 0 R >> endobj 503 0 obj << /Title 504 0 R /A 501 0 R -/Parent 411 0 R -/Prev 491 0 R -/Next 515 0 R -/First 507 0 R -/Last 511 0 R -/Count -2 +/Parent 499 0 R +/Next 507 0 R >> endobj 499 0 obj << /Title 500 0 R /A 497 0 R -/Parent 491 0 R -/Prev 495 0 R +/Parent 419 0 R +/Prev 487 0 R +/Next 511 0 R +/First 503 0 R +/Last 507 0 R +/Count -2 >> endobj 495 0 obj << /Title 496 0 R /A 493 0 R -/Parent 491 0 R -/Next 499 0 R +/Parent 487 0 R +/Prev 491 0 R >> endobj 491 0 obj << /Title 492 0 R /A 489 0 R -/Parent 411 0 R -/Prev 479 0 R -/Next 503 0 R -/First 495 0 R -/Last 499 0 R -/Count -2 +/Parent 487 0 R +/Next 495 0 R >> endobj 487 0 obj << /Title 488 0 R /A 485 0 R -/Parent 479 0 R -/Prev 483 0 R +/Parent 419 0 R +/Prev 475 0 R +/Next 499 0 R +/First 491 0 R +/Last 495 0 R +/Count -2 >> endobj 483 0 obj << /Title 484 0 R /A 481 0 R -/Parent 479 0 R -/Next 487 0 R +/Parent 475 0 R +/Prev 479 0 R >> endobj 479 0 obj << /Title 480 0 R /A 477 0 R -/Parent 411 0 R -/Prev 467 0 R -/Next 491 0 R -/First 483 0 R -/Last 487 0 R -/Count -2 +/Parent 475 0 R +/Next 483 0 R >> endobj 475 0 obj << /Title 476 0 R /A 473 0 R -/Parent 467 0 R +/Parent 419 0 R /Prev 471 0 R +/Next 487 0 R +/First 479 0 R +/Last 483 0 R +/Count -2 >> endobj 471 0 obj << /Title 472 0 R /A 469 0 R -/Parent 467 0 R +/Parent 419 0 R +/Prev 467 0 R /Next 475 0 R >> endobj 467 0 obj << /Title 468 0 R /A 465 0 R -/Parent 411 0 R +/Parent 419 0 R /Prev 463 0 R -/Next 479 0 R -/First 471 0 R -/Last 475 0 R -/Count -2 +/Next 471 0 R >> endobj 463 0 obj << /Title 464 0 R /A 461 0 R -/Parent 411 0 R -/Prev 459 0 R +/Parent 419 0 R +/Prev 427 0 R /Next 467 0 R >> endobj 459 0 obj << /Title 460 0 R /A 457 0 R -/Parent 411 0 R +/Parent 427 0 R /Prev 455 0 R -/Next 463 0 R >> endobj 455 0 obj << /Title 456 0 R /A 453 0 R -/Parent 411 0 R -/Prev 419 0 R +/Parent 427 0 R +/Prev 451 0 R /Next 459 0 R >> endobj 451 0 obj << /Title 452 0 R /A 449 0 R -/Parent 419 0 R +/Parent 427 0 R /Prev 447 0 R +/Next 455 0 R >> endobj 447 0 obj << /Title 448 0 R /A 445 0 R -/Parent 419 0 R +/Parent 427 0 R /Prev 443 0 R /Next 451 0 R >> endobj 443 0 obj << /Title 444 0 R /A 441 0 R -/Parent 419 0 R +/Parent 427 0 R /Prev 439 0 R /Next 447 0 R >> endobj 439 0 obj << /Title 440 0 R /A 437 0 R -/Parent 419 0 R +/Parent 427 0 R /Prev 435 0 R /Next 443 0 R >> endobj 435 0 obj << /Title 436 0 R /A 433 0 R -/Parent 419 0 R +/Parent 427 0 R /Prev 431 0 R /Next 439 0 R >> endobj 431 0 obj << /Title 432 0 R /A 429 0 R -/Parent 419 0 R -/Prev 427 0 R +/Parent 427 0 R /Next 435 0 R >> endobj 427 0 obj << @@ -8398,7 +9458,10 @@ endobj /A 425 0 R /Parent 419 0 R /Prev 423 0 R -/Next 431 0 R +/Next 463 0 R +/First 431 0 R +/Last 459 0 R +/Count -8 >> endobj 423 0 obj << /Title 424 0 R @@ -8409,251 +9472,251 @@ endobj 419 0 obj << /Title 420 0 R /A 417 0 R -/Parent 411 0 R -/Prev 415 0 R -/Next 455 0 R +/Parent 259 0 R +/Prev 275 0 R +/Next 559 0 R /First 423 0 R -/Last 451 0 R -/Count -8 +/Last 547 0 R +/Count -12 >> endobj 415 0 obj << /Title 416 0 R /A 413 0 R -/Parent 411 0 R -/Next 419 0 R +/Parent 295 0 R +/Prev 411 0 R >> endobj 411 0 obj << /Title 412 0 R /A 409 0 R -/Parent 251 0 R -/Prev 267 0 R -/Next 551 0 R -/First 415 0 R -/Last 539 0 R -/Count -12 +/Parent 295 0 R +/Prev 407 0 R +/Next 415 0 R >> endobj 407 0 obj << /Title 408 0 R /A 405 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 403 0 R +/Next 411 0 R >> endobj 403 0 obj << /Title 404 0 R /A 401 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 399 0 R /Next 407 0 R >> endobj 399 0 obj << /Title 400 0 R /A 397 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 395 0 R /Next 403 0 R >> endobj 395 0 obj << /Title 396 0 R /A 393 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 391 0 R /Next 399 0 R >> endobj 391 0 obj << /Title 392 0 R /A 389 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 387 0 R /Next 395 0 R >> endobj 387 0 obj << /Title 388 0 R /A 385 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 383 0 R /Next 391 0 R >> endobj 383 0 obj << /Title 384 0 R /A 381 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 379 0 R /Next 387 0 R >> endobj 379 0 obj << /Title 380 0 R /A 377 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 375 0 R /Next 383 0 R >> endobj 375 0 obj << /Title 376 0 R /A 373 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 371 0 R /Next 379 0 R >> endobj 371 0 obj << /Title 372 0 R /A 369 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 367 0 R /Next 375 0 R >> endobj 367 0 obj << /Title 368 0 R /A 365 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 363 0 R /Next 371 0 R >> endobj 363 0 obj << /Title 364 0 R /A 361 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 359 0 R /Next 367 0 R >> endobj 359 0 obj << /Title 360 0 R /A 357 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 355 0 R /Next 363 0 R >> endobj 355 0 obj << /Title 356 0 R /A 353 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 351 0 R /Next 359 0 R >> endobj 351 0 obj << /Title 352 0 R /A 349 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 347 0 R /Next 355 0 R >> endobj 347 0 obj << /Title 348 0 R /A 345 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 343 0 R /Next 351 0 R >> endobj 343 0 obj << /Title 344 0 R /A 341 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 339 0 R /Next 347 0 R >> endobj 339 0 obj << /Title 340 0 R /A 337 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 335 0 R /Next 343 0 R >> endobj 335 0 obj << /Title 336 0 R /A 333 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 331 0 R /Next 339 0 R >> endobj 331 0 obj << /Title 332 0 R /A 329 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 327 0 R /Next 335 0 R >> endobj 327 0 obj << /Title 328 0 R /A 325 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 323 0 R /Next 331 0 R >> endobj 323 0 obj << /Title 324 0 R /A 321 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 319 0 R /Next 327 0 R >> endobj 319 0 obj << /Title 320 0 R /A 317 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 315 0 R /Next 323 0 R >> endobj 315 0 obj << /Title 316 0 R /A 313 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 311 0 R /Next 319 0 R >> endobj 311 0 obj << /Title 312 0 R /A 309 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 307 0 R /Next 315 0 R >> endobj 307 0 obj << /Title 308 0 R /A 305 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 303 0 R /Next 311 0 R >> endobj 303 0 obj << /Title 304 0 R /A 301 0 R -/Parent 287 0 R +/Parent 295 0 R /Prev 299 0 R /Next 307 0 R >> endobj 299 0 obj << /Title 300 0 R /A 297 0 R -/Parent 287 0 R -/Prev 295 0 R +/Parent 295 0 R /Next 303 0 R >> endobj 295 0 obj << /Title 296 0 R /A 293 0 R -/Parent 287 0 R -/Prev 291 0 R -/Next 299 0 R +/Parent 275 0 R +/Prev 283 0 R +/First 299 0 R +/Last 415 0 R +/Count -30 >> endobj 291 0 obj << /Title 292 0 R /A 289 0 R -/Parent 287 0 R -/Next 295 0 R +/Parent 283 0 R +/Prev 287 0 R >> endobj 287 0 obj << /Title 288 0 R /A 285 0 R -/Parent 267 0 R -/Prev 275 0 R -/First 291 0 R -/Last 407 0 R -/Count -30 +/Parent 283 0 R +/Next 291 0 R >> endobj 283 0 obj << /Title 284 0 R /A 281 0 R /Parent 275 0 R /Prev 279 0 R +/Next 295 0 R +/First 287 0 R +/Last 291 0 R +/Count -2 >> endobj 279 0 obj << /Title 280 0 R @@ -8664,64 +9727,63 @@ endobj 275 0 obj << /Title 276 0 R /A 273 0 R -/Parent 267 0 R -/Prev 271 0 R -/Next 287 0 R +/Parent 259 0 R +/Prev 263 0 R +/Next 419 0 R /First 279 0 R -/Last 283 0 R -/Count -2 +/Last 295 0 R +/Count -3 >> endobj 271 0 obj << /Title 272 0 R /A 269 0 R -/Parent 267 0 R -/Next 275 0 R +/Parent 263 0 R +/Prev 267 0 R >> endobj 267 0 obj << /Title 268 0 R /A 265 0 R -/Parent 251 0 R -/Prev 255 0 R -/Next 411 0 R -/First 271 0 R -/Last 287 0 R -/Count -3 +/Parent 263 0 R +/Next 271 0 R >> endobj 263 0 obj << /Title 264 0 R /A 261 0 R -/Parent 255 0 R -/Prev 259 0 R +/Parent 259 0 R +/Next 275 0 R +/First 267 0 R +/Last 271 0 R +/Count -2 >> endobj 259 0 obj << /Title 260 0 R /A 257 0 R -/Parent 255 0 R -/Next 263 0 R +/Parent 1977 0 R +/Prev 251 0 R +/Next 727 0 R +/First 263 0 R +/Last 695 0 R +/Count -8 >> endobj 255 0 obj << /Title 256 0 R /A 253 0 R /Parent 251 0 R -/Next 267 0 R -/First 259 0 R -/Last 263 0 R -/Count -2 >> endobj 251 0 obj << /Title 252 0 R /A 249 0 R -/Parent 1800 0 R +/Parent 1977 0 R /Prev 247 0 R -/Next 719 0 R +/Next 259 0 R /First 255 0 R -/Last 687 0 R -/Count -8 +/Last 255 0 R +/Count -1 >> endobj 247 0 obj << /Title 248 0 R /A 245 0 R -/Parent 1800 0 R +/Parent 1977 0 R /Prev 207 0 R /Next 251 0 R >> endobj @@ -8789,7 +9851,7 @@ endobj 207 0 obj << /Title 208 0 R /A 205 0 R -/Parent 1800 0 R +/Parent 1977 0 R /Prev 179 0 R /Next 247 0 R /First 211 0 R @@ -8841,7 +9903,7 @@ endobj 179 0 obj << /Title 180 0 R /A 177 0 R -/Parent 1800 0 R +/Parent 1977 0 R /Prev 87 0 R /Next 207 0 R /First 183 0 R @@ -9005,7 +10067,7 @@ endobj 87 0 obj << /Title 88 0 R /A 85 0 R -/Parent 1800 0 R +/Parent 1977 0 R /Prev 83 0 R /Next 179 0 R /First 91 0 R @@ -9015,7 +10077,7 @@ endobj 83 0 obj << /Title 84 0 R /A 81 0 R -/Parent 1800 0 R +/Parent 1977 0 R /Prev 47 0 R /Next 87 0 R >> endobj @@ -9077,7 +10139,7 @@ endobj 47 0 obj << /Title 48 0 R /A 45 0 R -/Parent 1800 0 R +/Parent 1977 0 R /Prev 23 0 R /Next 83 0 R /First 51 0 R @@ -9120,7 +10182,7 @@ endobj 23 0 obj << /Title 24 0 R /A 21 0 R -/Parent 1800 0 R +/Parent 1977 0 R /Prev 7 0 R /Next 47 0 R /First 27 0 R @@ -9149,1851 +10211,2026 @@ endobj 7 0 obj << /Title 8 0 R /A 5 0 R -/Parent 1800 0 R +/Parent 1977 0 R /Next 23 0 R /First 11 0 R /Last 19 0 R /Count -3 >> endobj -1801 0 obj << -/Names [(CodingSuggestions) 1224 0 R (Doc-Start) 874 0 R (Item.1) 1170 0 R (Item.10) 1193 0 R (Item.100) 1441 0 R (Item.101) 1442 0 R (Item.102) 1443 0 R (Item.103) 1444 0 R (Item.104) 1445 0 R (Item.105) 1673 0 R (Item.106) 1674 0 R (Item.107) 1675 0 R (Item.108) 1676 0 R (Item.109) 1677 0 R (Item.11) 1194 0 R (Item.110) 1678 0 R (Item.111) 1683 0 R (Item.112) 1684 0 R (Item.12) 1195 0 R (Item.13) 1196 0 R (Item.14) 1213 0 R (Item.15) 1214 0 R (Item.16) 1215 0 R (Item.17) 1227 0 R (Item.18) 1228 0 R (Item.19) 1229 0 R (Item.2) 1171 0 R (Item.20) 1230 0 R (Item.21) 1231 0 R (Item.22) 1232 0 R (Item.23) 1233 0 R (Item.24) 1234 0 R (Item.25) 1239 0 R (Item.26) 1240 0 R (Item.27) 1241 0 R (Item.28) 1242 0 R (Item.29) 1243 0 R (Item.3) 1172 0 R (Item.30) 1244 0 R (Item.31) 1245 0 R (Item.32) 1246 0 R (Item.33) 1247 0 R (Item.34) 1248 0 R (Item.35) 1249 0 R (Item.36) 1250 0 R (Item.37) 1251 0 R (Item.38) 1252 0 R (Item.39) 1253 0 R (Item.4) 1175 0 R (Item.40) 1254 0 R (Item.41) 1255 0 R (Item.42) 1263 0 R (Item.43) 1264 0 R (Item.44) 1265 0 R (Item.45) 1266 0 R (Item.46) 1267 0 R (Item.47) 1268 0 R (Item.48) 1269 0 R (Item.49) 1270 0 R (Item.5) 1176 0 R (Item.50) 1275 0 R (Item.51) 1276 0 R (Item.52) 1277 0 R (Item.53) 1301 0 R (Item.54) 1302 0 R (Item.55) 1303 0 R (Item.56) 1304 0 R (Item.57) 1305 0 R (Item.58) 1306 0 R (Item.59) 1307 0 R (Item.6) 1177 0 R (Item.60) 1308 0 R (Item.61) 1313 0 R (Item.62) 1314 0 R (Item.63) 1315 0 R (Item.64) 1316 0 R (Item.65) 1317 0 R (Item.66) 1318 0 R (Item.67) 1320 0 R (Item.68) 1321 0 R (Item.69) 1322 0 R (Item.7) 1178 0 R (Item.70) 1328 0 R (Item.71) 1329 0 R (Item.72) 1330 0 R (Item.73) 1331 0 R (Item.74) 1332 0 R (Item.75) 1333 0 R (Item.76) 1334 0 R (Item.77) 1335 0 R (Item.78) 1336 0 R (Item.79) 1337 0 R (Item.8) 1183 0 R (Item.80) 1344 0 R (Item.81) 1345 0 R (Item.82) 1346 0 R (Item.83) 1347 0 R (Item.84) 1348 0 R (Item.85) 1349 0 R (Item.86) 1350 0 R (Item.87) 1352 0 R (Item.88) 1353 0 R (Item.89) 1354 0 R (Item.9) 1184 0 R (Item.90) 1355 0 R (Item.91) 1367 0 R (Item.92) 1368 0 R (Item.93) 1369 0 R (Item.94) 1370 0 R (Item.95) 1428 0 R (Item.96) 1429 0 R (Item.97) 1430 0 R (Item.98) 1431 0 R (Item.99) 1432 0 R (Packaging) 1776 0 R (SMBPASSWDFILEFORMAT) 1744 0 R (architecture) 1168 0 R (chapter*.4) 909 0 R (chapter.1) 6 0 R (chapter.10) 718 0 R (chapter.11) 742 0 R (chapter.12) 750 0 R (chapter.13) 802 0 R (chapter.14) 818 0 R (chapter.15) 846 0 R (chapter.16) 858 0 R (chapter.2) 22 0 R (chapter.3) 46 0 R (chapter.4) 82 0 R (chapter.5) 86 0 R (chapter.6) 178 0 R (chapter.7) 206 0 R (chapter.8) 246 0 R (chapter.9) 250 0 R (debug) 1191 0 R (id2733755) 1192 0 R (id2733820) 1154 0 R (id2733904) 1155 0 R (id2733935) 1160 0 R (id2733972) 1201 0 R (id2734187) 1185 0 R (id2734254) 1186 0 R (id2734448) 1207 0 R (id2734494) 1208 0 R (id2734600) 1216 0 R (id2734608) 1217 0 R (id2734627) 1218 0 R (id2734650) 1219 0 R (id2734703) 1169 0 R (id2786615) 1173 0 R (id2786652) 1174 0 R (id2800686) 1261 0 R (id2800712) 1262 0 R (id2800990) 1351 0 R (id2801045) 1343 0 R (id2801174) 1278 0 R (id2801187) 1279 0 R (id2801201) 1280 0 R (id2801215) 1281 0 R (id2801228) 1282 0 R (id2801244) 1283 0 R (id2801258) 1284 0 R (id2801273) 1285 0 R (id2801287) 1286 0 R (id2801302) 1287 0 R (id2801316) 1288 0 R (id2801330) 1294 0 R (id2801345) 1295 0 R (id2801359) 1296 0 R (id2801374) 1297 0 R (id2801389) 1298 0 R (id2801404) 1299 0 R (id2801439) 1300 0 R (id2801591) 1319 0 R (id2801677) 1327 0 R (id2801816) 1380 0 R (id2801840) 1385 0 R (id2801877) 1378 0 R (id2801899) 1379 0 R (id2801946) 1356 0 R (id2802010) 1361 0 R (id2802109) 1366 0 R (id2802179) 1371 0 R (id2802404) 1386 0 R (id2802466) 1387 0 R (id2802496) 1392 0 R (id2802521) 1393 0 R (id2802567) 1394 0 R (id2802753) 1420 0 R (id2802908) 1668 0 R (id2802951) 1666 0 R (id2802967) 1667 0 R (id2803176) 1437 0 R (id2803211) 1438 0 R (id2803249) 1439 0 R (id2803257) 1440 0 R (id2803333) 1450 0 R (id2803340) 1451 0 R (id2803415) 1452 0 R (id2803546) 1453 0 R (id2803553) 1454 0 R (id2803565) 1455 0 R (id2803576) 1456 0 R (id2803589) 1457 0 R (id2803602) 1462 0 R (id2803695) 1463 0 R (id2803709) 1464 0 R (id2803765) 1465 0 R (id2803808) 1466 0 R (id2803836) 1467 0 R (id2803878) 1468 0 R (id2803964) 1473 0 R (id2804058) 1474 0 R (id2804085) 1475 0 R (id2804172) 1476 0 R (id2804242) 1477 0 R (id2804342) 1482 0 R (id2804420) 1483 0 R (id2804461) 1484 0 R (id2804543) 1485 0 R (id2804596) 1486 0 R (id2804767) 1492 0 R (id2804871) 1493 0 R (id2804910) 1494 0 R (id2805054) 1499 0 R (id2805167) 1500 0 R (id2805730) 1505 0 R (id2805825) 1506 0 R (id2805868) 1511 0 R (id2806037) 1512 0 R (id2806504) 1517 0 R (id2806516) 1518 0 R (id2806618) 1523 0 R (id2806809) 1524 0 R (id2806942) 1530 0 R (id2806969) 1531 0 R (id2807008) 1532 0 R (id2807149) 1533 0 R (id2807189) 1534 0 R (id2807339) 1539 0 R (id2807412) 1540 0 R (id2807492) 1541 0 R (id2807538) 1542 0 R (id2807718) 1547 0 R (id2807884) 1548 0 R (id2807897) 1553 0 R (id2807967) 1554 0 R (id2808010) 1555 0 R (id2808024) 1556 0 R (id2808063) 1557 0 R (id2808117) 1558 0 R (id2808125) 1559 0 R (id2808137) 1560 0 R (id2808209) 1565 0 R (id2808216) 1566 0 R (id2808229) 1567 0 R (id2808319) 1568 0 R (id2808326) 1569 0 R (id2808353) 1570 0 R (id2808385) 1571 0 R (id2808399) 1572 0 R (id2808498) 1577 0 R (id2808595) 1578 0 R (id2808610) 1579 0 R (id2808723) 1580 0 R (id2808821) 1586 0 R (id2808983) 1587 0 R (id2809015) 1588 0 R (id2809085) 1589 0 R (id2809118) 1594 0 R (id2809149) 1595 0 R (id2809218) 1596 0 R (id2809265) 1597 0 R (id2809305) 1598 0 R (id2809347) 1599 0 R (id2809381) 1600 0 R (id2809396) 1605 0 R (id2809423) 1606 0 R (id2809495) 1607 0 R (id2809510) 1608 0 R (id2809537) 1609 0 R (id2809587) 1610 0 R (id2809604) 1615 0 R (id2809619) 1616 0 R (id2809745) 1617 0 R (id2809866) 1618 0 R (id2809894) 1619 0 R (id2810078) 1624 0 R (id2810192) 1625 0 R (id2810238) 1626 0 R (id2810259) 1627 0 R (id2810384) 1632 0 R (id2810458) 1633 0 R (id2810472) 1634 0 R (id2810513) 1635 0 R (id2810575) 1636 0 R (id2810583) 1637 0 R (id2810745) 1643 0 R (id2810826) 1644 0 R (id2810875) 1649 0 R (id2810915) 1650 0 R (id2810923) 1651 0 R (id2811049) 1652 0 R (id2811230) 1657 0 R (id2811245) 1658 0 R (id2811293) 1659 0 R (id2811353) 1660 0 R (id2811596) 1701 0 R (id2811836) 1685 0 R (id2811849) 1686 0 R (id2812158) 1738 0 R (id2812288) 1737 0 R (id2812322) 1707 0 R (id2812453) 1712 0 R (id2812488) 1713 0 R (id2812557) 1714 0 R (id2812564) 1715 0 R (id2812580) 1716 0 R (id2812608) 1717 0 R (id2812630) 1722 0 R (id2812637) 1723 0 R (id2812655) 1724 0 R (id2812694) 1725 0 R (id2812785) 1731 0 R (id2812874) 1743 0 R (id2813064) 1755 0 R (id2813097) 1756 0 R (id2813131) 1770 0 R (id2813150) 1771 0 R (id2813325) 1754 0 R (id2813533) 1757 0 R (id2813561) 1762 0 R (id2813621) 1763 0 R (id2813840) 1777 0 R (id2813873) 1778 0 R (internals) 1260 0 R (modules) 1753 0 R (netbios) 1153 0 R (ntdomain) 1419 0 R (page.1) 873 0 R (page.10) 1167 0 R (page.11) 1182 0 R (page.12) 1190 0 R (page.13) 1200 0 R (page.14) 1206 0 R (page.15) 1212 0 R (page.16) 1223 0 R (page.17) 1238 0 R (page.18) 1259 0 R (page.19) 1274 0 R (page.2) 885 0 R (page.20) 1293 0 R (page.21) 1312 0 R (page.22) 1326 0 R (page.23) 1341 0 R (page.24) 1360 0 R (page.25) 1365 0 R (page.26) 1376 0 R (page.27) 1384 0 R (page.28) 1391 0 R (page.29) 1398 0 R (page.3) 908 0 R (page.30) 1402 0 R (page.31) 1413 0 R (page.32) 1418 0 R (page.33) 1436 0 R (page.34) 1449 0 R (page.35) 1461 0 R (page.36) 1472 0 R (page.37) 1481 0 R (page.38) 1491 0 R (page.39) 1498 0 R (page.4) 953 0 R (page.40) 1504 0 R (page.41) 1510 0 R (page.42) 1516 0 R (page.43) 1522 0 R (page.44) 1529 0 R (page.45) 1538 0 R (page.46) 1546 0 R (page.47) 1552 0 R (page.48) 1564 0 R (page.49) 1576 0 R (page.5) 1009 0 R (page.50) 1585 0 R (page.51) 1593 0 R (page.52) 1604 0 R (page.53) 1614 0 R (page.54) 1623 0 R (page.55) 1631 0 R (page.56) 1642 0 R (page.57) 1648 0 R (page.58) 1656 0 R (page.59) 1664 0 R (page.6) 1065 0 R (page.60) 1672 0 R (page.61) 1682 0 R (page.62) 1691 0 R (page.63) 1695 0 R (page.64) 1699 0 R (page.65) 1705 0 R (page.66) 1711 0 R (page.67) 1721 0 R (page.68) 1730 0 R (page.69) 1735 0 R (page.7) 1122 0 R (page.70) 1742 0 R (page.71) 1748 0 R (page.72) 1752 0 R (page.73) 1761 0 R (page.74) 1768 0 R (page.75) 1775 0 R (page.8) 1152 0 R (page.9) 1159 0 R (parsing) 1342 0 R (printing) 1665 0 R (pwencrypt) 1736 0 R (rpc-plugin) 1769 0 R (sam) 1706 0 R (section*.1) 889 0 R (section*.2) 896 0 R (section*.3) 903 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.10.1) 722 0 R (section.10.2) 726 0 R (section.10.3) 730 0 R (section.10.4) 734 0 R (section.10.5) 738 0 R (section.11.1) 746 0 R (section.12.1) 754 0 R (section.12.2) 758 0 R (section.12.3) 762 0 R (section.12.4) 766 0 R (section.12.5) 782 0 R (section.12.6) 794 0 R (section.12.7) 798 0 R (section.13.1) 806 0 R (section.13.2) 810 0 R (section.13.3) 814 0 R (section.14.1) 822 0 R (section.14.2) 826 0 R (section.14.3) 838 0 R (section.15.1) 850 0 R (section.15.2) 854 0 R (section.16.1) 862 0 R (section.16.2) 866 0 R (section.2.1) 26 0 R (section.2.2) 30 0 R (section.2.3) 34 0 R (section.2.4) 38 0 R (section.2.5) 42 0 R (section.3.1) 50 0 R (section.3.2) 54 0 R (section.3.3) 58 0 R (section.3.4) 62 0 R (section.3.5) 66 0 R (section.5.1) 90 0 R (section.5.2) 94 0 R (section.5.3) 98 0 R (section.5.4) 162 0 R (section.5.5) 174 0 R (section.6.1) 182 0 R (section.6.2) 198 0 R (section.7.1) 210 0 R (section.7.2) 214 0 R (section.7.3) 218 0 R (section.7.4) 222 0 R (section.7.5) 226 0 R (section.7.6) 230 0 R (section.7.7) 234 0 R (section.7.8) 238 0 R (section.7.9) 242 0 R (section.9.1) 254 0 R (section.9.2) 266 0 R (section.9.3) 410 0 R (section.9.4) 550 0 R (section.9.5) 614 0 R (section.9.6) 642 0 R (section.9.7) 670 0 R (section.9.8) 686 0 R (subsection.12.4.1) 770 0 R (subsection.12.4.2) 774 0 R (subsection.12.4.3) 778 0 R (subsection.12.5.1) 786 0 R (subsection.12.5.2) 790 0 R (subsection.14.2.1) 830 0 R (subsection.14.2.2) 834 0 R (subsection.14.3.1) 842 0 R (subsection.3.5.1) 70 0 R (subsection.3.5.2) 74 0 R (subsection.3.5.3) 78 0 R (subsection.5.3.1) 102 0 R (subsection.5.3.10) 138 0 R (subsection.5.3.11) 142 0 R (subsection.5.3.12) 146 0 R (subsection.5.3.13) 150 0 R (subsection.5.3.14) 154 0 R (subsection.5.3.15) 158 0 R (subsection.5.3.2) 106 0 R (subsection.5.3.3) 110 0 R (subsection.5.3.4) 114 0 R (subsection.5.3.5) 118 0 R (subsection.5.3.6) 122 0 R (subsection.5.3.7) 126 0 R (subsection.5.3.8) 130 0 R (subsection.5.3.9) 134 0 R (subsection.5.4.1) 166 0 R (subsection.5.4.2) 170 0 R (subsection.6.1.1) 186 0 R (subsection.6.1.2) 190 0 R (subsection.6.1.3) 194 0 R (subsection.6.2.1) 202 0 R (subsection.9.1.1) 258 0 R (subsection.9.1.2) 262 0 R (subsection.9.2.1) 270 0 R (subsection.9.2.2) 274 0 R (subsection.9.2.3) 286 0 R (subsection.9.3.1) 414 0 R (subsection.9.3.10) 514 0 R (subsection.9.3.11) 526 0 R (subsection.9.3.12) 538 0 R (subsection.9.3.2) 418 0 R (subsection.9.3.3) 454 0 R (subsection.9.3.4) 458 0 R (subsection.9.3.5) 462 0 R (subsection.9.3.6) 466 0 R (subsection.9.3.7) 478 0 R (subsection.9.3.8) 490 0 R (subsection.9.3.9) 502 0 R (subsection.9.4.1) 554 0 R (subsection.9.4.2) 566 0 R (subsection.9.4.3) 578 0 R (subsection.9.4.4) 590 0 R (subsection.9.4.5) 602 0 R (subsection.9.5.1) 618 0 R (subsection.9.5.2) 630 0 R (subsection.9.6.1) 646 0 R (subsection.9.6.2) 658 0 R (subsection.9.7.1) 674 0 R (subsection.9.7.2) 678 0 R (subsection.9.7.3) 682 0 R (subsection.9.8.1) 690 0 R (subsection.9.8.2) 702 0 R (subsubsection.9.2.2.1) 278 0 R (subsubsection.9.2.2.2) 282 0 R (subsubsection.9.2.3.1) 290 0 R (subsubsection.9.2.3.10) 326 0 R (subsubsection.9.2.3.11) 330 0 R (subsubsection.9.2.3.12) 334 0 R (subsubsection.9.2.3.13) 338 0 R (subsubsection.9.2.3.14) 342 0 R (subsubsection.9.2.3.15) 346 0 R (subsubsection.9.2.3.16) 350 0 R (subsubsection.9.2.3.17) 354 0 R (subsubsection.9.2.3.18) 358 0 R (subsubsection.9.2.3.19) 362 0 R (subsubsection.9.2.3.2) 294 0 R (subsubsection.9.2.3.20) 366 0 R (subsubsection.9.2.3.21) 370 0 R (subsubsection.9.2.3.22) 374 0 R (subsubsection.9.2.3.23) 378 0 R (subsubsection.9.2.3.24) 382 0 R (subsubsection.9.2.3.25) 386 0 R (subsubsection.9.2.3.26) 390 0 R (subsubsection.9.2.3.27) 394 0 R (subsubsection.9.2.3.28) 398 0 R (subsubsection.9.2.3.29) 402 0 R (subsubsection.9.2.3.3) 298 0 R (subsubsection.9.2.3.30) 406 0 R (subsubsection.9.2.3.4) 302 0 R (subsubsection.9.2.3.5) 306 0 R (subsubsection.9.2.3.6) 310 0 R (subsubsection.9.2.3.7) 314 0 R (subsubsection.9.2.3.8) 318 0 R (subsubsection.9.2.3.9) 322 0 R (subsubsection.9.3.10.1) 518 0 R (subsubsection.9.3.10.2) 522 0 R (subsubsection.9.3.11.1) 530 0 R (subsubsection.9.3.11.2) 534 0 R (subsubsection.9.3.12.1) 542 0 R (subsubsection.9.3.12.2) 546 0 R (subsubsection.9.3.2.1) 422 0 R (subsubsection.9.3.2.2) 426 0 R (subsubsection.9.3.2.3) 430 0 R (subsubsection.9.3.2.4) 434 0 R (subsubsection.9.3.2.5) 438 0 R (subsubsection.9.3.2.6) 442 0 R (subsubsection.9.3.2.7) 446 0 R (subsubsection.9.3.2.8) 450 0 R (subsubsection.9.3.6.1) 470 0 R (subsubsection.9.3.6.2) 474 0 R (subsubsection.9.3.7.1) 482 0 R (subsubsection.9.3.7.2) 486 0 R (subsubsection.9.3.8.1) 494 0 R (subsubsection.9.3.8.2) 498 0 R (subsubsection.9.3.9.1) 506 0 R (subsubsection.9.3.9.2) 510 0 R (subsubsection.9.4.1.1) 558 0 R (subsubsection.9.4.1.2) 562 0 R (subsubsection.9.4.2.1) 570 0 R (subsubsection.9.4.2.2) 574 0 R (subsubsection.9.4.3.1) 582 0 R (subsubsection.9.4.3.2) 586 0 R (subsubsection.9.4.4.1) 594 0 R (subsubsection.9.4.4.2) 598 0 R (subsubsection.9.4.5.1) 606 0 R (subsubsection.9.4.5.2) 610 0 R (subsubsection.9.5.1.1) 622 0 R (subsubsection.9.5.1.2) 626 0 R (subsubsection.9.5.2.1) 634 0 R (subsubsection.9.5.2.2) 638 0 R (subsubsection.9.6.1.1) 650 0 R (subsubsection.9.6.1.2) 654 0 R (subsubsection.9.6.2.1) 662 0 R (subsubsection.9.6.2.2) 666 0 R (subsubsection.9.8.1.1) 694 0 R (subsubsection.9.8.1.2) 698 0 R (subsubsection.9.8.2.1) 706 0 R (subsubsection.9.8.2.2) 710 0 R (subsubsection.9.8.2.3) 714 0 R (tracing) 1403 0 R (unix-smb) 1377 0 R (wins) 1700 0 R] +1978 0 obj << +/Names [(CodingSuggestions) 1007 0 R (Doc-Start) 934 0 R (Item.1) 1295 0 R (Item.10) 1317 0 R (Item.100) 1554 0 R (Item.101) 1555 0 R (Item.102) 1556 0 R (Item.103) 1557 0 R (Item.104) 1562 0 R (Item.105) 1567 0 R (Item.106) 1568 0 R (Item.107) 1569 0 R (Item.108) 1570 0 R (Item.109) 1571 0 R (Item.11) 1318 0 R (Item.110) 1778 0 R (Item.111) 1779 0 R (Item.112) 1780 0 R (Item.113) 1781 0 R (Item.114) 1782 0 R (Item.115) 1783 0 R (Item.116) 1784 0 R (Item.117) 1785 0 R (Item.118) 1908 0 R (Item.119) 1909 0 R (Item.12) 1319 0 R (Item.120) 1910 0 R (Item.121) 1911 0 R (Item.122) 1912 0 R (Item.123) 1917 0 R (Item.124) 1918 0 R (Item.125) 1924 0 R (Item.126) 1925 0 R (Item.127) 1927 0 R (Item.128) 1936 0 R (Item.129) 1937 0 R (Item.13) 1320 0 R (Item.14) 1333 0 R (Item.15) 1338 0 R (Item.16) 1339 0 R (Item.17) 1350 0 R (Item.18) 1351 0 R (Item.19) 1352 0 R (Item.2) 1296 0 R (Item.20) 1353 0 R (Item.21) 1354 0 R (Item.22) 1355 0 R (Item.23) 1356 0 R (Item.24) 1357 0 R (Item.25) 1358 0 R (Item.26) 1363 0 R (Item.27) 1364 0 R (Item.28) 1365 0 R (Item.29) 1366 0 R (Item.3) 1297 0 R (Item.30) 1367 0 R (Item.31) 1368 0 R (Item.32) 1369 0 R (Item.33) 1370 0 R (Item.34) 1371 0 R (Item.35) 1372 0 R (Item.36) 1373 0 R (Item.37) 1374 0 R (Item.38) 1375 0 R (Item.39) 1376 0 R (Item.4) 1300 0 R (Item.40) 1377 0 R (Item.41) 1378 0 R (Item.42) 1385 0 R (Item.43) 1386 0 R (Item.44) 1387 0 R (Item.45) 1388 0 R (Item.46) 1389 0 R (Item.47) 1390 0 R (Item.48) 1391 0 R (Item.49) 1392 0 R (Item.5) 1301 0 R (Item.50) 1398 0 R (Item.51) 1399 0 R (Item.52) 1400 0 R (Item.53) 1423 0 R (Item.54) 1424 0 R (Item.55) 1425 0 R (Item.56) 1426 0 R (Item.57) 1431 0 R (Item.58) 1432 0 R (Item.59) 1433 0 R (Item.6) 1302 0 R (Item.60) 1434 0 R (Item.61) 1435 0 R (Item.62) 1436 0 R (Item.63) 1437 0 R (Item.64) 1438 0 R (Item.65) 1439 0 R (Item.66) 1440 0 R (Item.67) 1442 0 R (Item.68) 1443 0 R (Item.69) 1444 0 R (Item.7) 1303 0 R (Item.70) 1450 0 R (Item.71) 1451 0 R (Item.72) 1452 0 R (Item.73) 1453 0 R (Item.74) 1454 0 R (Item.75) 1455 0 R (Item.76) 1456 0 R (Item.77) 1457 0 R (Item.78) 1458 0 R (Item.79) 1459 0 R (Item.8) 1304 0 R (Item.80) 1465 0 R (Item.81) 1466 0 R (Item.82) 1467 0 R (Item.83) 1468 0 R (Item.84) 1469 0 R (Item.85) 1470 0 R (Item.86) 1471 0 R (Item.87) 1473 0 R (Item.88) 1474 0 R (Item.89) 1475 0 R (Item.9) 1309 0 R (Item.90) 1476 0 R (Item.91) 1489 0 R (Item.92) 1490 0 R (Item.93) 1491 0 R (Item.94) 1492 0 R (Item.95) 1536 0 R (Item.96) 1537 0 R (Item.97) 1538 0 R (Item.98) 1539 0 R (Item.99) 1540 0 R (Packaging) 1021 0 R (SMBPASSWDFILEFORMAT) 1845 0 R (architecture) 1005 0 R (chapter*.1) 1027 0 R (chapter.1) 6 0 R (chapter.10) 258 0 R (chapter.11) 726 0 R (chapter.12) 750 0 R (chapter.13) 758 0 R (chapter.14) 810 0 R (chapter.15) 826 0 R (chapter.16) 854 0 R (chapter.17) 866 0 R (chapter.18) 914 0 R (chapter.19) 926 0 R (chapter.2) 22 0 R (chapter.3) 46 0 R (chapter.4) 82 0 R (chapter.5) 86 0 R (chapter.6) 178 0 R (chapter.7) 206 0 R (chapter.8) 246 0 R (chapter.9) 250 0 R (contributing) 1022 0 R (debug) 1006 0 R (id2735718) 1316 0 R (id2735855) 1326 0 R (id2735907) 1294 0 R (id2736117) 1298 0 R (id2736155) 1299 0 R (id2736230) 1310 0 R (id2736297) 1311 0 R (id2739476) 1283 0 R (id2739563) 1284 0 R (id2739594) 1289 0 R (id2805869) 1383 0 R (id2805895) 1384 0 R (id2806295) 1331 0 R (id2806340) 1332 0 R (id2806446) 1340 0 R (id2806453) 1341 0 R (id2806472) 1342 0 R (id2806496) 1343 0 R (id2807146) 1401 0 R (id2807899) 1464 0 R (id2807992) 1472 0 R (id2808047) 1477 0 R (id2808071) 1402 0 R (id2808085) 1403 0 R (id2808098) 1404 0 R (id2808112) 1405 0 R (id2808128) 1406 0 R (id2808142) 1407 0 R (id2808156) 1408 0 R (id2808171) 1409 0 R (id2808185) 1414 0 R (id2808200) 1415 0 R (id2808214) 1416 0 R (id2808228) 1417 0 R (id2808243) 1418 0 R (id2808257) 1419 0 R (id2808272) 1420 0 R (id2808288) 1421 0 R (id2808324) 1422 0 R (id2808474) 1441 0 R (id2808560) 1449 0 R (id2809324) 1498 0 R (id2809349) 1499 0 R (id2809577) 1500 0 R (id2809614) 1505 0 R (id2809651) 1506 0 R (id2809707) 1482 0 R (id2809805) 1483 0 R (id2809876) 1493 0 R (id2810346) 1535 0 R (id2810590) 1511 0 R (id2810621) 1512 0 R (id2810646) 1513 0 R (id2810691) 1514 0 R (id2811313) 1545 0 R (id2812244) 1563 0 R (id2812278) 1564 0 R (id2812316) 1565 0 R (id2812324) 1566 0 R (id2812400) 1572 0 R (id2812408) 1573 0 R (id2812482) 1578 0 R (id2812613) 1579 0 R (id2812620) 1580 0 R (id2812632) 1581 0 R (id2812643) 1582 0 R (id2812656) 1583 0 R (id2812668) 1584 0 R (id2812763) 1585 0 R (id2812776) 1586 0 R (id2812833) 1591 0 R (id2812874) 1592 0 R (id2812902) 1593 0 R (id2812944) 1594 0 R (id2813030) 1595 0 R (id2813123) 1596 0 R (id2813150) 1597 0 R (id2813237) 1598 0 R (id2813306) 1604 0 R (id2813406) 1605 0 R (id2813484) 1606 0 R (id2813525) 1607 0 R (id2813607) 1608 0 R (id2813660) 1609 0 R (id2813830) 1614 0 R (id2813933) 1615 0 R (id2813972) 1616 0 R (id2814115) 1617 0 R (id2814228) 1618 0 R (id2814792) 1623 0 R (id2814886) 1624 0 R (id2814928) 1629 0 R (id2815097) 1630 0 R (id2815564) 1635 0 R (id2815576) 1636 0 R (id2815677) 1637 0 R (id2815868) 1642 0 R (id2816001) 1643 0 R (id2816028) 1644 0 R (id2816066) 1645 0 R (id2816207) 1651 0 R (id2816247) 1652 0 R (id2816397) 1653 0 R (id2816469) 1654 0 R (id2816549) 1655 0 R (id2816595) 1656 0 R (id2816775) 1661 0 R (id2816940) 1662 0 R (id2816953) 1663 0 R (id2817023) 1668 0 R (id2817066) 1669 0 R (id2817080) 1670 0 R (id2817119) 1671 0 R (id2817172) 1672 0 R (id2817180) 1673 0 R (id2817192) 1674 0 R (id2817263) 1675 0 R (id2817271) 1676 0 R (id2817283) 1677 0 R (id2817374) 1682 0 R (id2817381) 1683 0 R (id2817408) 1684 0 R (id2817439) 1685 0 R (id2817453) 1686 0 R (id2817552) 1687 0 R (id2817649) 1688 0 R (id2817663) 1689 0 R (id2817777) 1694 0 R (id2817874) 1695 0 R (id2818036) 1696 0 R (id2818068) 1697 0 R (id2818138) 1698 0 R (id2818170) 1703 0 R (id2818201) 1704 0 R (id2818270) 1705 0 R (id2818317) 1706 0 R (id2818357) 1707 0 R (id2818399) 1708 0 R (id2818433) 1709 0 R (id2818447) 1710 0 R (id2818474) 1716 0 R (id2818546) 1717 0 R (id2818561) 1718 0 R (id2818588) 1719 0 R (id2818637) 1720 0 R (id2818650) 1721 0 R (id2818670) 1726 0 R (id2818796) 1727 0 R (id2818917) 1728 0 R (id2818945) 1729 0 R (id2819129) 1730 0 R (id2819243) 1735 0 R (id2819288) 1736 0 R (id2819308) 1737 0 R (id2819434) 1738 0 R (id2819507) 1739 0 R (id2819521) 1740 0 R (id2819562) 1741 0 R (id2819623) 1746 0 R (id2819631) 1747 0 R (id2819794) 1748 0 R (id2819891) 1753 0 R (id2819940) 1754 0 R (id2819979) 1755 0 R (id2819987) 1756 0 R (id2820114) 1757 0 R (id2820295) 1762 0 R (id2820309) 1763 0 R (id2820357) 1764 0 R (id2820417) 1765 0 R (id2828738) 1810 0 R (id2828936) 1804 0 R (id2828976) 1771 0 R (id2828992) 1772 0 R (id2829247) 1773 0 R (id2829456) 1790 0 R (id2829469) 1791 0 R (id2830146) 1844 0 R (id2830264) 1815 0 R (id2830298) 1816 0 R (id2830366) 1817 0 R (id2830374) 1818 0 R (id2830390) 1819 0 R (id2830417) 1824 0 R (id2830439) 1825 0 R (id2830446) 1826 0 R (id2830464) 1827 0 R (id2830503) 1828 0 R (id2830593) 1833 0 R (id2831185) 1855 0 R (id2831234) 1838 0 R (id2831259) 1839 0 R (id2831852) 1869 0 R (id2831871) 1870 0 R (id2832085) 1856 0 R (id2832118) 1857 0 R (id2833060) 1858 0 R (id2833088) 1863 0 R (id2833149) 1864 0 R (id2833957) 1949 0 R (id2833990) 1950 0 R (id2834164) 1875 0 R (id2834172) 1876 0 R (id2834287) 1886 0 R (id2834358) 1887 0 R (id2834366) 1888 0 R (id2834558) 1893 0 R (id2834801) 1906 0 R (id2834809) 1907 0 R (id2835349) 1942 0 R (id2835356) 1943 0 R (id2835380) 1944 0 R (internals) 1008 0 R (modules) 1018 0 R (netbios) 1004 0 R (ntdomain) 1013 0 R (page.1) 933 0 R (page.10) 1288 0 R (page.11) 1293 0 R (page.12) 1308 0 R (page.13) 1315 0 R (page.14) 1325 0 R (page.15) 1330 0 R (page.16) 1337 0 R (page.17) 1347 0 R (page.18) 1362 0 R (page.19) 1382 0 R (page.2) 945 0 R (page.20) 1397 0 R (page.21) 1413 0 R (page.22) 1430 0 R (page.23) 1448 0 R (page.24) 1463 0 R (page.25) 1481 0 R (page.26) 1488 0 R (page.27) 1497 0 R (page.28) 1504 0 R (page.29) 1510 0 R (page.3) 962 0 R (page.30) 1518 0 R (page.31) 1522 0 R (page.32) 1530 0 R (page.33) 1534 0 R (page.34) 1544 0 R (page.35) 1561 0 R (page.36) 1577 0 R (page.37) 1590 0 R (page.38) 1603 0 R (page.39) 1613 0 R (page.4) 1026 0 R (page.40) 1622 0 R (page.41) 1628 0 R (page.42) 1634 0 R (page.43) 1641 0 R (page.44) 1650 0 R (page.45) 1660 0 R (page.46) 1667 0 R (page.47) 1681 0 R (page.48) 1693 0 R (page.49) 1702 0 R (page.5) 1071 0 R (page.50) 1715 0 R (page.51) 1725 0 R (page.52) 1734 0 R (page.53) 1745 0 R (page.54) 1752 0 R (page.55) 1761 0 R (page.56) 1770 0 R (page.57) 1777 0 R (page.58) 1789 0 R (page.59) 1795 0 R (page.6) 1125 0 R (page.60) 1799 0 R (page.61) 1803 0 R (page.62) 1809 0 R (page.63) 1814 0 R (page.64) 1823 0 R (page.65) 1832 0 R (page.66) 1837 0 R (page.67) 1843 0 R (page.68) 1850 0 R (page.69) 1854 0 R (page.7) 1178 0 R (page.70) 1862 0 R (page.71) 1868 0 R (page.72) 1874 0 R (page.73) 1880 0 R (page.74) 1885 0 R (page.75) 1892 0 R (page.76) 1897 0 R (page.77) 1901 0 R (page.78) 1905 0 R (page.79) 1916 0 R (page.8) 1233 0 R (page.80) 1923 0 R (page.81) 1931 0 R (page.82) 1935 0 R (page.83) 1941 0 R (page.84) 1948 0 R (page.85) 1954 0 R (page.9) 1282 0 R (parsing) 1009 0 R (printing) 1014 0 R (pwencrypt) 1017 0 R (rpc-plugin) 1019 0 R (sam) 1016 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.10.1) 262 0 R (section.10.2) 274 0 R (section.10.3) 418 0 R (section.10.4) 558 0 R (section.10.5) 622 0 R (section.10.6) 650 0 R (section.10.7) 678 0 R (section.10.8) 694 0 R (section.11.1) 730 0 R (section.11.2) 734 0 R (section.11.3) 738 0 R (section.11.4) 742 0 R (section.11.5) 746 0 R (section.12.1) 754 0 R (section.13.1) 762 0 R (section.13.2) 766 0 R (section.13.3) 770 0 R (section.13.4) 774 0 R (section.13.5) 790 0 R (section.13.6) 802 0 R (section.13.7) 806 0 R (section.14.1) 814 0 R (section.14.2) 818 0 R (section.14.3) 822 0 R (section.15.1) 830 0 R (section.15.2) 834 0 R (section.15.3) 846 0 R (section.16.1) 858 0 R (section.16.2) 862 0 R (section.17.1) 870 0 R (section.17.2) 882 0 R (section.17.3) 894 0 R (section.17.4) 902 0 R (section.18.1) 918 0 R (section.18.2) 922 0 R (section.2.1) 26 0 R (section.2.2) 30 0 R (section.2.3) 34 0 R (section.2.4) 38 0 R (section.2.5) 42 0 R (section.3.1) 50 0 R (section.3.2) 54 0 R (section.3.3) 58 0 R (section.3.4) 62 0 R (section.3.5) 66 0 R (section.5.1) 90 0 R (section.5.2) 94 0 R (section.5.3) 98 0 R (section.5.4) 162 0 R (section.5.5) 174 0 R (section.6.1) 182 0 R (section.6.2) 198 0 R (section.7.1) 210 0 R (section.7.2) 214 0 R (section.7.3) 218 0 R (section.7.4) 222 0 R (section.7.5) 226 0 R (section.7.6) 230 0 R (section.7.7) 234 0 R (section.7.8) 238 0 R (section.7.9) 242 0 R (section.9.1) 254 0 R (subsection.10.1.1) 266 0 R (subsection.10.1.2) 270 0 R (subsection.10.2.1) 278 0 R (subsection.10.2.2) 282 0 R (subsection.10.2.3) 294 0 R (subsection.10.3.1) 422 0 R (subsection.10.3.10) 522 0 R (subsection.10.3.11) 534 0 R (subsection.10.3.12) 546 0 R (subsection.10.3.2) 426 0 R (subsection.10.3.3) 462 0 R (subsection.10.3.4) 466 0 R (subsection.10.3.5) 470 0 R (subsection.10.3.6) 474 0 R (subsection.10.3.7) 486 0 R (subsection.10.3.8) 498 0 R (subsection.10.3.9) 510 0 R (subsection.10.4.1) 562 0 R (subsection.10.4.2) 574 0 R (subsection.10.4.3) 586 0 R (subsection.10.4.4) 598 0 R (subsection.10.4.5) 610 0 R (subsection.10.5.1) 626 0 R (subsection.10.5.2) 638 0 R (subsection.10.6.1) 654 0 R (subsection.10.6.2) 666 0 R (subsection.10.7.1) 682 0 R (subsection.10.7.2) 686 0 R (subsection.10.7.3) 690 0 R (subsection.10.8.1) 698 0 R (subsection.10.8.2) 710 0 R (subsection.13.4.1) 778 0 R (subsection.13.4.2) 782 0 R (subsection.13.4.3) 786 0 R (subsection.13.5.1) 794 0 R (subsection.13.5.2) 798 0 R (subsection.15.2.1) 838 0 R (subsection.15.2.2) 842 0 R (subsection.15.3.1) 850 0 R (subsection.17.1.1) 874 0 R (subsection.17.1.2) 878 0 R (subsection.17.2.1) 886 0 R (subsection.17.2.2) 890 0 R (subsection.17.3.1) 898 0 R (subsection.17.4.1) 906 0 R (subsection.17.4.2) 910 0 R (subsection.3.5.1) 70 0 R (subsection.3.5.2) 74 0 R (subsection.3.5.3) 78 0 R (subsection.5.3.1) 102 0 R (subsection.5.3.10) 138 0 R (subsection.5.3.11) 142 0 R (subsection.5.3.12) 146 0 R (subsection.5.3.13) 150 0 R (subsection.5.3.14) 154 0 R (subsection.5.3.15) 158 0 R (subsection.5.3.2) 106 0 R (subsection.5.3.3) 110 0 R (subsection.5.3.4) 114 0 R (subsection.5.3.5) 118 0 R (subsection.5.3.6) 122 0 R (subsection.5.3.7) 126 0 R (subsection.5.3.8) 130 0 R (subsection.5.3.9) 134 0 R (subsection.5.4.1) 166 0 R (subsection.5.4.2) 170 0 R (subsection.6.1.1) 186 0 R (subsection.6.1.2) 190 0 R (subsection.6.1.3) 194 0 R (subsection.6.2.1) 202 0 R (subsubsection.10.2.2.1) 286 0 R (subsubsection.10.2.2.2) 290 0 R (subsubsection.10.2.3.1) 298 0 R (subsubsection.10.2.3.10) 334 0 R (subsubsection.10.2.3.11) 338 0 R (subsubsection.10.2.3.12) 342 0 R (subsubsection.10.2.3.13) 346 0 R (subsubsection.10.2.3.14) 350 0 R (subsubsection.10.2.3.15) 354 0 R (subsubsection.10.2.3.16) 358 0 R (subsubsection.10.2.3.17) 362 0 R (subsubsection.10.2.3.18) 366 0 R (subsubsection.10.2.3.19) 370 0 R (subsubsection.10.2.3.2) 302 0 R (subsubsection.10.2.3.20) 374 0 R (subsubsection.10.2.3.21) 378 0 R (subsubsection.10.2.3.22) 382 0 R (subsubsection.10.2.3.23) 386 0 R (subsubsection.10.2.3.24) 390 0 R (subsubsection.10.2.3.25) 394 0 R (subsubsection.10.2.3.26) 398 0 R (subsubsection.10.2.3.27) 402 0 R (subsubsection.10.2.3.28) 406 0 R (subsubsection.10.2.3.29) 410 0 R (subsubsection.10.2.3.3) 306 0 R (subsubsection.10.2.3.30) 414 0 R (subsubsection.10.2.3.4) 310 0 R (subsubsection.10.2.3.5) 314 0 R (subsubsection.10.2.3.6) 318 0 R (subsubsection.10.2.3.7) 322 0 R (subsubsection.10.2.3.8) 326 0 R (subsubsection.10.2.3.9) 330 0 R (subsubsection.10.3.10.1) 526 0 R (subsubsection.10.3.10.2) 530 0 R (subsubsection.10.3.11.1) 538 0 R (subsubsection.10.3.11.2) 542 0 R (subsubsection.10.3.12.1) 550 0 R (subsubsection.10.3.12.2) 554 0 R (subsubsection.10.3.2.1) 430 0 R (subsubsection.10.3.2.2) 434 0 R (subsubsection.10.3.2.3) 438 0 R (subsubsection.10.3.2.4) 442 0 R (subsubsection.10.3.2.5) 446 0 R (subsubsection.10.3.2.6) 450 0 R (subsubsection.10.3.2.7) 454 0 R (subsubsection.10.3.2.8) 458 0 R (subsubsection.10.3.6.1) 478 0 R (subsubsection.10.3.6.2) 482 0 R (subsubsection.10.3.7.1) 490 0 R (subsubsection.10.3.7.2) 494 0 R (subsubsection.10.3.8.1) 502 0 R (subsubsection.10.3.8.2) 506 0 R (subsubsection.10.3.9.1) 514 0 R (subsubsection.10.3.9.2) 518 0 R (subsubsection.10.4.1.1) 566 0 R (subsubsection.10.4.1.2) 570 0 R (subsubsection.10.4.2.1) 578 0 R (subsubsection.10.4.2.2) 582 0 R (subsubsection.10.4.3.1) 590 0 R (subsubsection.10.4.3.2) 594 0 R (subsubsection.10.4.4.1) 602 0 R (subsubsection.10.4.4.2) 606 0 R (subsubsection.10.4.5.1) 614 0 R (subsubsection.10.4.5.2) 618 0 R (subsubsection.10.5.1.1) 630 0 R (subsubsection.10.5.1.2) 634 0 R (subsubsection.10.5.2.1) 642 0 R (subsubsection.10.5.2.2) 646 0 R (subsubsection.10.6.1.1) 658 0 R (subsubsection.10.6.1.2) 662 0 R (subsubsection.10.6.2.1) 670 0 R (subsubsection.10.6.2.2) 674 0 R (subsubsection.10.8.1.1) 702 0 R (subsubsection.10.8.1.2) 706 0 R (subsubsection.10.8.2.1) 714 0 R (subsubsection.10.8.2.2) 718 0 R (subsubsection.10.8.2.3) 722 0 R (tracing) 1011 0 R (unix-smb) 1010 0 R (vfs) 1020 0 R (windows-debug) 1012 0 R (wins) 1015 0 R] /Limits [(CodingSuggestions) (wins)] >> endobj -1802 0 obj << -/Kids [1801 0 R] +1979 0 obj << +/Kids [1978 0 R] >> endobj -1803 0 obj << -/Dests 1802 0 R +1980 0 obj << +/Dests 1979 0 R >> endobj -1804 0 obj << +1981 0 obj << /Type /Catalog -/Pages 1799 0 R -/Outlines 1800 0 R -/Names 1803 0 R +/Pages 1976 0 R +/Outlines 1977 0 R +/Names 1980 0 R /PageMode /UseOutlines /URI<> /ViewerPreferences<<>> -/OpenAction 869 0 R -/PTEX.Fullbanner (This is pdfTeX, Version 3.14159-1.10a) +/OpenAction 929 0 R +/PTEX.Fullbanner (This is pdfTeX, Version 3.14159-1.10b) >> endobj -1805 0 obj << -/Producer (pdfTeX-1.10a) -/Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfTeX-1.10a)/Keywords() -/Creator (TeX) -/CreationDate (D:20030501010600) +1982 0 obj << +/Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfTeX-1.10b)/Keywords() +/CreationDate (D:20030701232600) >> endobj xref -0 1806 +0 1983 0000000001 65535 f 0000000002 00000 f 0000000003 00000 f 0000000004 00000 f 0000000000 00000 f 0000000009 00000 n -0000074011 00000 n -0000409878 00000 n +0000093861 00000 n +0000481071 00000 n 0000000054 00000 n 0000000130 00000 n -0000074134 00000 n -0000409806 00000 n +0000093984 00000 n +0000480999 00000 n 0000000177 00000 n 0000000207 00000 n -0000074258 00000 n -0000409720 00000 n +0000094108 00000 n +0000480913 00000 n 0000000255 00000 n 0000000295 00000 n -0000077595 00000 n -0000409647 00000 n +0000097715 00000 n +0000480840 00000 n 0000000343 00000 n 0000000378 00000 n -0000080860 00000 n -0000409522 00000 n +0000101373 00000 n +0000480715 00000 n 0000000424 00000 n 0000000463 00000 n -0000080984 00000 n -0000409448 00000 n +0000101497 00000 n +0000480641 00000 n 0000000511 00000 n 0000000546 00000 n -0000081297 00000 n -0000409361 00000 n +0000101809 00000 n +0000480554 00000 n 0000000594 00000 n 0000000641 00000 n -0000081420 00000 n -0000409274 00000 n +0000101932 00000 n +0000480467 00000 n 0000000689 00000 n 0000000726 00000 n -0000085541 00000 n -0000409187 00000 n +0000106004 00000 n +0000480380 00000 n 0000000774 00000 n 0000000811 00000 n -0000085665 00000 n -0000409113 00000 n +0000106127 00000 n +0000480306 00000 n 0000000859 00000 n 0000000893 00000 n -0000087973 00000 n -0000408987 00000 n +0000108825 00000 n +0000480180 00000 n 0000000939 00000 n 0000000982 00000 n -0000088097 00000 n -0000408913 00000 n +0000108949 00000 n +0000480106 00000 n 0000001030 00000 n 0000001070 00000 n -0000090917 00000 n -0000408826 00000 n +0000111717 00000 n +0000480019 00000 n 0000001118 00000 n 0000001160 00000 n -0000093073 00000 n -0000408739 00000 n +0000114029 00000 n +0000479932 00000 n 0000001208 00000 n 0000001253 00000 n -0000093196 00000 n -0000408652 00000 n +0000114153 00000 n +0000479845 00000 n 0000001301 00000 n 0000001346 00000 n -0000096049 00000 n -0000408541 00000 n +0000116874 00000 n +0000479734 00000 n 0000001394 00000 n 0000001430 00000 n -0000096173 00000 n -0000408467 00000 n +0000116997 00000 n +0000479660 00000 n 0000001483 00000 n 0000001519 00000 n -0000096297 00000 n -0000408380 00000 n +0000117121 00000 n +0000479573 00000 n 0000001572 00000 n 0000001607 00000 n -0000096421 00000 n -0000408306 00000 n +0000117244 00000 n +0000479499 00000 n 0000001660 00000 n 0000001712 00000 n -0000100587 00000 n -0000408217 00000 n +0000121870 00000 n +0000479410 00000 n 0000001758 00000 n 0000001797 00000 n -0000109575 00000 n -0000408089 00000 n +0000131620 00000 n +0000479282 00000 n 0000001843 00000 n 0000001879 00000 n -0000109699 00000 n -0000408015 00000 n +0000131744 00000 n +0000479208 00000 n 0000001927 00000 n 0000001968 00000 n -0000109822 00000 n -0000407928 00000 n +0000131867 00000 n +0000479121 00000 n 0000002016 00000 n 0000002056 00000 n -0000113070 00000 n -0000407799 00000 n +0000135341 00000 n +0000478992 00000 n 0000002104 00000 n 0000002149 00000 n -0000113194 00000 n -0000407721 00000 n +0000135464 00000 n +0000478914 00000 n 0000002203 00000 n 0000002244 00000 n -0000113319 00000 n -0000407629 00000 n +0000135588 00000 n +0000478822 00000 n 0000002298 00000 n 0000002339 00000 n -0000113443 00000 n -0000407537 00000 n +0000135713 00000 n +0000478730 00000 n 0000002393 00000 n 0000002439 00000 n -0000113568 00000 n -0000407445 00000 n +0000135837 00000 n +0000478638 00000 n 0000002493 00000 n 0000002534 00000 n -0000113693 00000 n -0000407353 00000 n +0000135962 00000 n +0000478546 00000 n 0000002588 00000 n 0000002629 00000 n -0000113818 00000 n -0000407261 00000 n +0000136087 00000 n +0000478454 00000 n 0000002683 00000 n 0000002725 00000 n -0000113942 00000 n -0000407169 00000 n +0000136212 00000 n +0000478362 00000 n 0000002779 00000 n 0000002821 00000 n -0000114067 00000 n -0000407077 00000 n +0000136336 00000 n +0000478270 00000 n 0000002875 00000 n 0000002921 00000 n -0000114192 00000 n -0000406985 00000 n +0000138977 00000 n +0000478178 00000 n 0000002975 00000 n 0000003021 00000 n -0000114317 00000 n -0000406893 00000 n +0000139101 00000 n +0000478086 00000 n 0000003076 00000 n 0000003124 00000 n -0000116740 00000 n -0000406801 00000 n +0000139226 00000 n +0000477994 00000 n 0000003179 00000 n 0000003227 00000 n -0000116864 00000 n -0000406709 00000 n +0000139351 00000 n +0000477902 00000 n 0000003282 00000 n 0000003325 00000 n -0000116989 00000 n -0000406617 00000 n +0000139474 00000 n +0000477810 00000 n 0000003380 00000 n 0000003423 00000 n -0000117114 00000 n -0000406525 00000 n +0000139599 00000 n +0000477718 00000 n 0000003478 00000 n 0000003526 00000 n -0000117239 00000 n -0000406447 00000 n +0000139724 00000 n +0000477640 00000 n 0000003581 00000 n 0000003629 00000 n -0000117364 00000 n -0000406317 00000 n +0000139848 00000 n +0000477510 00000 n 0000003678 00000 n 0000003723 00000 n -0000117489 00000 n -0000406238 00000 n +0000139973 00000 n +0000477431 00000 n 0000003777 00000 n 0000003813 00000 n -0000121927 00000 n -0000406159 00000 n +0000145052 00000 n +0000477352 00000 n 0000003867 00000 n 0000003905 00000 n -0000123591 00000 n -0000406081 00000 n +0000146948 00000 n +0000477274 00000 n 0000003954 00000 n 0000003998 00000 n -0000126860 00000 n -0000405949 00000 n +0000150637 00000 n +0000477142 00000 n 0000004045 00000 n 0000004084 00000 n -0000126985 00000 n -0000405831 00000 n +0000150762 00000 n +0000477024 00000 n 0000004133 00000 n 0000004173 00000 n -0000127549 00000 n -0000405752 00000 n +0000151328 00000 n +0000476945 00000 n 0000004227 00000 n 0000004275 00000 n -0000127926 00000 n -0000405659 00000 n +0000151704 00000 n +0000476852 00000 n 0000004329 00000 n 0000004384 00000 n -0000129713 00000 n -0000405580 00000 n +0000153670 00000 n +0000476773 00000 n 0000004438 00000 n 0000004488 00000 n -0000131602 00000 n -0000405462 00000 n +0000153795 00000 n +0000476655 00000 n 0000004537 00000 n 0000004567 00000 n -0000131978 00000 n -0000405397 00000 n +0000155916 00000 n +0000476590 00000 n 0000004621 00000 n 0000004661 00000 n -0000135764 00000 n -0000405264 00000 n +0000159458 00000 n +0000476457 00000 n 0000004708 00000 n 0000004753 00000 n -0000135889 00000 n -0000405185 00000 n +0000159583 00000 n +0000476378 00000 n 0000004802 00000 n 0000004838 00000 n -0000136014 00000 n -0000405092 00000 n +0000159708 00000 n +0000476285 00000 n 0000004887 00000 n 0000004920 00000 n -0000136139 00000 n -0000404999 00000 n +0000159833 00000 n +0000476192 00000 n 0000004969 00000 n 0000005007 00000 n -0000140317 00000 n -0000404906 00000 n +0000163657 00000 n +0000476099 00000 n 0000005056 00000 n 0000005089 00000 n -0000140442 00000 n -0000404813 00000 n +0000163782 00000 n +0000476006 00000 n 0000005138 00000 n 0000005169 00000 n -0000140567 00000 n -0000404720 00000 n +0000167936 00000 n +0000475913 00000 n 0000005218 00000 n 0000005252 00000 n -0000145032 00000 n -0000404627 00000 n +0000168061 00000 n +0000475820 00000 n 0000005301 00000 n 0000005338 00000 n -0000145157 00000 n -0000404534 00000 n +0000168186 00000 n +0000475727 00000 n 0000005387 00000 n 0000005423 00000 n -0000145282 00000 n -0000404455 00000 n +0000168311 00000 n +0000475648 00000 n 0000005472 00000 n 0000005515 00000 n -0000149905 00000 n -0000404361 00000 n +0000174329 00000 n +0000475554 00000 n 0000005562 00000 n 0000005610 00000 n -0000156487 00000 n -0000404228 00000 n +0000177167 00000 n +0000475421 00000 n 0000005657 00000 n -0000005694 00000 n -0000156612 00000 n -0000404110 00000 n -0000005743 00000 n -0000005779 00000 n -0000159990 00000 n -0000404031 00000 n -0000005833 00000 n -0000005866 00000 n -0000160115 00000 n -0000403952 00000 n -0000005920 00000 n -0000005953 00000 n -0000160240 00000 n -0000403820 00000 n -0000006002 00000 n -0000006046 00000 n -0000160364 00000 n -0000403741 00000 n -0000006100 00000 n +0000005716 00000 n +0000177292 00000 n +0000475356 00000 n +0000005765 00000 n +0000005814 00000 n +0000183266 00000 n +0000475223 00000 n +0000005862 00000 n +0000005900 00000 n +0000183391 00000 n +0000475105 00000 n +0000005950 00000 n +0000005987 00000 n +0000187432 00000 n +0000475026 00000 n +0000006042 00000 n +0000006076 00000 n +0000187557 00000 n +0000474947 00000 n 0000006131 00000 n -0000162351 00000 n -0000403609 00000 n -0000006185 00000 n -0000006223 00000 n -0000162476 00000 n -0000403530 00000 n -0000006282 00000 n -0000006327 00000 n -0000162601 00000 n -0000403451 00000 n -0000006386 00000 n -0000006431 00000 n -0000162726 00000 n -0000403332 00000 n -0000006485 00000 n -0000006521 00000 n -0000162851 00000 n -0000403253 00000 n -0000006580 00000 n -0000006614 00000 n -0000162976 00000 n -0000403160 00000 n -0000006673 00000 n -0000006705 00000 n -0000163100 00000 n -0000403067 00000 n -0000006764 00000 n -0000006797 00000 n -0000163225 00000 n -0000402974 00000 n -0000006856 00000 n -0000006890 00000 n -0000165031 00000 n -0000402881 00000 n -0000006949 00000 n -0000007012 00000 n -0000165156 00000 n -0000402788 00000 n -0000007071 00000 n -0000007113 00000 n -0000165281 00000 n -0000402695 00000 n -0000007172 00000 n -0000007232 00000 n -0000165406 00000 n -0000402602 00000 n -0000007291 00000 n -0000007372 00000 n -0000165531 00000 n -0000402509 00000 n -0000007431 00000 n -0000007484 00000 n -0000165656 00000 n -0000402416 00000 n -0000007544 00000 n -0000007613 00000 n -0000165781 00000 n -0000402323 00000 n -0000007673 00000 n -0000007736 00000 n -0000168275 00000 n -0000402230 00000 n -0000007796 00000 n -0000007858 00000 n -0000168400 00000 n -0000402137 00000 n +0000006165 00000 n +0000187682 00000 n +0000474815 00000 n +0000006215 00000 n +0000006260 00000 n +0000187807 00000 n +0000474736 00000 n +0000006315 00000 n +0000006347 00000 n +0000188245 00000 n +0000474604 00000 n +0000006402 00000 n +0000006441 00000 n +0000188368 00000 n +0000474525 00000 n +0000006501 00000 n +0000006547 00000 n +0000191169 00000 n +0000474446 00000 n +0000006607 00000 n +0000006653 00000 n +0000191294 00000 n +0000474327 00000 n +0000006708 00000 n +0000006745 00000 n +0000191417 00000 n +0000474248 00000 n +0000006805 00000 n +0000006840 00000 n +0000191542 00000 n +0000474155 00000 n +0000006900 00000 n +0000006933 00000 n +0000191667 00000 n +0000474062 00000 n +0000006993 00000 n +0000007027 00000 n +0000191792 00000 n +0000473969 00000 n +0000007087 00000 n +0000007122 00000 n +0000191917 00000 n +0000473876 00000 n +0000007182 00000 n +0000007246 00000 n +0000192040 00000 n +0000473783 00000 n +0000007306 00000 n +0000007349 00000 n +0000192164 00000 n +0000473690 00000 n +0000007409 00000 n +0000007470 00000 n +0000195297 00000 n +0000473597 00000 n +0000007530 00000 n +0000007612 00000 n +0000195422 00000 n +0000473504 00000 n +0000007672 00000 n +0000007726 00000 n +0000195547 00000 n +0000473411 00000 n +0000007787 00000 n +0000007857 00000 n +0000195672 00000 n +0000473318 00000 n 0000007918 00000 n -0000007979 00000 n -0000168525 00000 n -0000402044 00000 n -0000008039 00000 n -0000008128 00000 n -0000168650 00000 n -0000401951 00000 n -0000008188 00000 n -0000008252 00000 n -0000168775 00000 n -0000401858 00000 n -0000008312 00000 n -0000008390 00000 n -0000171173 00000 n -0000401765 00000 n -0000008450 00000 n -0000008525 00000 n -0000171298 00000 n -0000401672 00000 n -0000008585 00000 n -0000008648 00000 n -0000171423 00000 n -0000401579 00000 n -0000008708 00000 n -0000008799 00000 n -0000171548 00000 n -0000401486 00000 n -0000008859 00000 n -0000008958 00000 n -0000171673 00000 n -0000401393 00000 n -0000009018 00000 n -0000009098 00000 n -0000173696 00000 n -0000401300 00000 n -0000009158 00000 n -0000009237 00000 n -0000173821 00000 n -0000401207 00000 n -0000009297 00000 n -0000009347 00000 n -0000173946 00000 n -0000401114 00000 n -0000009407 00000 n -0000009472 00000 n -0000175823 00000 n -0000401021 00000 n -0000009532 00000 n -0000009619 00000 n -0000175948 00000 n -0000400928 00000 n -0000009679 00000 n -0000009740 00000 n -0000178036 00000 n -0000400835 00000 n -0000009800 00000 n -0000009894 00000 n -0000178161 00000 n -0000400742 00000 n +0000007982 00000 n +0000195796 00000 n +0000473225 00000 n +0000008043 00000 n +0000008106 00000 n +0000195921 00000 n +0000473132 00000 n +0000008167 00000 n +0000008229 00000 n +0000196046 00000 n +0000473039 00000 n +0000008290 00000 n +0000008380 00000 n +0000196171 00000 n +0000472946 00000 n +0000008441 00000 n +0000008506 00000 n +0000199633 00000 n +0000472853 00000 n +0000008567 00000 n +0000008646 00000 n +0000199758 00000 n +0000472760 00000 n +0000008707 00000 n +0000008783 00000 n +0000199882 00000 n +0000472667 00000 n +0000008844 00000 n +0000008908 00000 n +0000200007 00000 n +0000472574 00000 n +0000008969 00000 n +0000009061 00000 n +0000200132 00000 n +0000472481 00000 n +0000009122 00000 n +0000009222 00000 n +0000200257 00000 n +0000472388 00000 n +0000009283 00000 n +0000009364 00000 n +0000203493 00000 n +0000472295 00000 n +0000009425 00000 n +0000009505 00000 n +0000203618 00000 n +0000472202 00000 n +0000009566 00000 n +0000009617 00000 n +0000203743 00000 n +0000472109 00000 n +0000009678 00000 n +0000009744 00000 n +0000203868 00000 n +0000472016 00000 n +0000009805 00000 n +0000009893 00000 n +0000203993 00000 n +0000471923 00000 n 0000009954 00000 n -0000010036 00000 n -0000180504 00000 n -0000400649 00000 n -0000010096 00000 n -0000010150 00000 n -0000180629 00000 n -0000400570 00000 n -0000010210 00000 n -0000010260 00000 n -0000184037 00000 n -0000400437 00000 n -0000010309 00000 n -0000010363 00000 n -0000184162 00000 n -0000400358 00000 n -0000010417 00000 n -0000010454 00000 n -0000187330 00000 n -0000400226 00000 n -0000010508 00000 n -0000010540 00000 n -0000187455 00000 n -0000400147 00000 n -0000010599 00000 n -0000010693 00000 n -0000189840 00000 n -0000400054 00000 n -0000010752 00000 n -0000010804 00000 n -0000189965 00000 n -0000399961 00000 n -0000010863 00000 n -0000010906 00000 n -0000190090 00000 n -0000399868 00000 n -0000010965 00000 n -0000011010 00000 n -0000190215 00000 n -0000399775 00000 n -0000011069 00000 n -0000011114 00000 n -0000190339 00000 n -0000399682 00000 n -0000011173 00000 n -0000011218 00000 n -0000193369 00000 n -0000399589 00000 n -0000011277 00000 n -0000011322 00000 n -0000193493 00000 n -0000399510 00000 n -0000011381 00000 n -0000011426 00000 n -0000193618 00000 n -0000399417 00000 n -0000011480 00000 n -0000011510 00000 n -0000193743 00000 n -0000399324 00000 n -0000011564 00000 n -0000011609 00000 n -0000195987 00000 n -0000399231 00000 n -0000011663 00000 n -0000011714 00000 n -0000196112 00000 n -0000399099 00000 n -0000011768 00000 n -0000011809 00000 n -0000197950 00000 n -0000399020 00000 n -0000011868 00000 n -0000011903 00000 n -0000198075 00000 n -0000398941 00000 n -0000011962 00000 n -0000011998 00000 n -0000198200 00000 n -0000398809 00000 n -0000012052 00000 n -0000012099 00000 n -0000198325 00000 n -0000398730 00000 n -0000012158 00000 n -0000012193 00000 n -0000198450 00000 n -0000398651 00000 n -0000012252 00000 n -0000012288 00000 n -0000198574 00000 n -0000398519 00000 n -0000012342 00000 n -0000012397 00000 n -0000198699 00000 n -0000398440 00000 n -0000012456 00000 n -0000012491 00000 n -0000198824 00000 n -0000398361 00000 n -0000012550 00000 n -0000012586 00000 n -0000200619 00000 n -0000398229 00000 n -0000012640 00000 n -0000012681 00000 n -0000200744 00000 n -0000398150 00000 n -0000012740 00000 n -0000012775 00000 n -0000200869 00000 n -0000398071 00000 n -0000012834 00000 n -0000012870 00000 n -0000200993 00000 n -0000397939 00000 n -0000012925 00000 n -0000012961 00000 n -0000201118 00000 n -0000397860 00000 n -0000013021 00000 n -0000013057 00000 n -0000201242 00000 n -0000397781 00000 n -0000013117 00000 n -0000013154 00000 n -0000201366 00000 n -0000397649 00000 n -0000013209 00000 n -0000013251 00000 n -0000201491 00000 n -0000397570 00000 n -0000013311 00000 n -0000013347 00000 n -0000203187 00000 n -0000397491 00000 n -0000013407 00000 n -0000013444 00000 n -0000203312 00000 n -0000397373 00000 n -0000013499 00000 n -0000013542 00000 n -0000203437 00000 n -0000397294 00000 n -0000013602 00000 n -0000013638 00000 n -0000203562 00000 n -0000397215 00000 n -0000013698 00000 n -0000013735 00000 n -0000206061 00000 n -0000397083 00000 n -0000013784 00000 n -0000013840 00000 n -0000206186 00000 n -0000396965 00000 n -0000013894 00000 n -0000013941 00000 n -0000206311 00000 n -0000396886 00000 n -0000014000 00000 n -0000014035 00000 n -0000206435 00000 n -0000396807 00000 n -0000014094 00000 n -0000014130 00000 n -0000208946 00000 n -0000396675 00000 n -0000014184 00000 n -0000014228 00000 n -0000209071 00000 n -0000396596 00000 n -0000014287 00000 n -0000014322 00000 n -0000209196 00000 n -0000396517 00000 n -0000014381 00000 n -0000014417 00000 n -0000209321 00000 n -0000396385 00000 n -0000014471 00000 n -0000014520 00000 n -0000209445 00000 n -0000396306 00000 n -0000014579 00000 n -0000014614 00000 n -0000209569 00000 n -0000396227 00000 n -0000014673 00000 n -0000014709 00000 n -0000209694 00000 n -0000396095 00000 n -0000014763 00000 n -0000014802 00000 n -0000211843 00000 n -0000396016 00000 n -0000014861 00000 n -0000014896 00000 n -0000211968 00000 n -0000395937 00000 n -0000014955 00000 n -0000014991 00000 n -0000212093 00000 n -0000395819 00000 n -0000015045 00000 n -0000015085 00000 n -0000212218 00000 n -0000395740 00000 n -0000015144 00000 n -0000015179 00000 n -0000212342 00000 n -0000395661 00000 n +0000010016 00000 n +0000207561 00000 n +0000471830 00000 n +0000010077 00000 n +0000010172 00000 n +0000207686 00000 n +0000471737 00000 n +0000010233 00000 n +0000010316 00000 n +0000212469 00000 n +0000471644 00000 n +0000010377 00000 n +0000010432 00000 n +0000212594 00000 n +0000471565 00000 n +0000010493 00000 n +0000010544 00000 n +0000216316 00000 n +0000471432 00000 n +0000010594 00000 n +0000010649 00000 n +0000216441 00000 n +0000471353 00000 n +0000010704 00000 n +0000010742 00000 n +0000216566 00000 n +0000471221 00000 n +0000010797 00000 n +0000010830 00000 n +0000220195 00000 n +0000471142 00000 n +0000010890 00000 n +0000010985 00000 n +0000220320 00000 n +0000471049 00000 n +0000011045 00000 n +0000011098 00000 n +0000220445 00000 n +0000470956 00000 n +0000011158 00000 n +0000011202 00000 n +0000220570 00000 n +0000470863 00000 n +0000011262 00000 n +0000011308 00000 n +0000224302 00000 n +0000470770 00000 n +0000011368 00000 n +0000011414 00000 n +0000224427 00000 n +0000470677 00000 n +0000011474 00000 n +0000011520 00000 n +0000224552 00000 n +0000470584 00000 n +0000011580 00000 n +0000011626 00000 n +0000224677 00000 n +0000470505 00000 n +0000011686 00000 n +0000011732 00000 n +0000224802 00000 n +0000470412 00000 n +0000011787 00000 n +0000011818 00000 n +0000224927 00000 n +0000470319 00000 n +0000011873 00000 n +0000011919 00000 n +0000228615 00000 n +0000470226 00000 n +0000011974 00000 n +0000012026 00000 n +0000228739 00000 n +0000470094 00000 n +0000012081 00000 n +0000012123 00000 n +0000228864 00000 n +0000470015 00000 n +0000012183 00000 n +0000012219 00000 n +0000231088 00000 n +0000469936 00000 n +0000012279 00000 n +0000012316 00000 n +0000231213 00000 n +0000469804 00000 n +0000012371 00000 n +0000012419 00000 n +0000231338 00000 n +0000469725 00000 n +0000012479 00000 n +0000012515 00000 n +0000231463 00000 n +0000469646 00000 n +0000012575 00000 n +0000012612 00000 n +0000231588 00000 n +0000469514 00000 n +0000012667 00000 n +0000012723 00000 n +0000231713 00000 n +0000469435 00000 n +0000012783 00000 n +0000012819 00000 n +0000231838 00000 n +0000469356 00000 n +0000012879 00000 n +0000012916 00000 n +0000231963 00000 n +0000469224 00000 n +0000012971 00000 n +0000013013 00000 n +0000232088 00000 n +0000469145 00000 n +0000013073 00000 n +0000013109 00000 n +0000232213 00000 n +0000469066 00000 n +0000013169 00000 n +0000013206 00000 n +0000235085 00000 n +0000468934 00000 n +0000013262 00000 n +0000013299 00000 n +0000235210 00000 n +0000468855 00000 n +0000013360 00000 n +0000013397 00000 n +0000235334 00000 n +0000468776 00000 n +0000013458 00000 n +0000013496 00000 n +0000235459 00000 n +0000468644 00000 n +0000013552 00000 n +0000013595 00000 n +0000235584 00000 n +0000468565 00000 n +0000013656 00000 n +0000013693 00000 n +0000235709 00000 n +0000468486 00000 n +0000013754 00000 n +0000013792 00000 n +0000235834 00000 n +0000468368 00000 n +0000013848 00000 n +0000013892 00000 n +0000235958 00000 n +0000468289 00000 n +0000013953 00000 n +0000013990 00000 n +0000239388 00000 n +0000468210 00000 n +0000014051 00000 n +0000014089 00000 n +0000239513 00000 n +0000468078 00000 n +0000014139 00000 n +0000014196 00000 n +0000239638 00000 n +0000467960 00000 n +0000014251 00000 n +0000014299 00000 n +0000239763 00000 n +0000467881 00000 n +0000014359 00000 n +0000014395 00000 n +0000239888 00000 n +0000467802 00000 n +0000014455 00000 n +0000014492 00000 n +0000242894 00000 n +0000467670 00000 n +0000014547 00000 n +0000014592 00000 n +0000243019 00000 n +0000467591 00000 n +0000014652 00000 n +0000014688 00000 n +0000243144 00000 n +0000467512 00000 n +0000014748 00000 n +0000014785 00000 n +0000243269 00000 n +0000467380 00000 n +0000014840 00000 n +0000014890 00000 n +0000243394 00000 n +0000467301 00000 n +0000014950 00000 n +0000014986 00000 n +0000243519 00000 n +0000467222 00000 n +0000015046 00000 n +0000015083 00000 n +0000243644 00000 n +0000467090 00000 n +0000015138 00000 n +0000015178 00000 n +0000243769 00000 n +0000467011 00000 n 0000015238 00000 n 0000015274 00000 n -0000212467 00000 n -0000395529 00000 n -0000015323 00000 n -0000015381 00000 n -0000214325 00000 n -0000395411 00000 n -0000015435 00000 n -0000015474 00000 n -0000214450 00000 n -0000395332 00000 n -0000015533 00000 n -0000015568 00000 n -0000214575 00000 n -0000395253 00000 n -0000015627 00000 n -0000015663 00000 n -0000214700 00000 n -0000395135 00000 n -0000015717 00000 n -0000015752 00000 n -0000214825 00000 n -0000395056 00000 n -0000015811 00000 n -0000015846 00000 n -0000216997 00000 n -0000394977 00000 n -0000015905 00000 n -0000015941 00000 n -0000217122 00000 n -0000394845 00000 n -0000015990 00000 n -0000016040 00000 n -0000217247 00000 n -0000394727 00000 n -0000016094 00000 n -0000016134 00000 n -0000217372 00000 n -0000394648 00000 n -0000016193 00000 n -0000016228 00000 n -0000219764 00000 n -0000394569 00000 n -0000016287 00000 n -0000016323 00000 n -0000219889 00000 n -0000394451 00000 n -0000016377 00000 n -0000016422 00000 n -0000220014 00000 n -0000394372 00000 n -0000016481 00000 n -0000016516 00000 n -0000220139 00000 n -0000394293 00000 n -0000016575 00000 n -0000016611 00000 n -0000220264 00000 n -0000394161 00000 n -0000016660 00000 n -0000016730 00000 n -0000220388 00000 n -0000394082 00000 n -0000016784 00000 n -0000016821 00000 n -0000222204 00000 n -0000393989 00000 n -0000016875 00000 n -0000016909 00000 n -0000222329 00000 n -0000393910 00000 n -0000016963 00000 n -0000016997 00000 n -0000224851 00000 n -0000393792 00000 n -0000017046 00000 n -0000017083 00000 n -0000224976 00000 n -0000393674 00000 n -0000017137 00000 n -0000017178 00000 n -0000225100 00000 n -0000393595 00000 n -0000017237 00000 n -0000017290 00000 n -0000225224 00000 n -0000393516 00000 n -0000017349 00000 n -0000017395 00000 n -0000227245 00000 n -0000393398 00000 n -0000017449 00000 n -0000017490 00000 n -0000227370 00000 n -0000393319 00000 n -0000017549 00000 n -0000017597 00000 n -0000227494 00000 n -0000393226 00000 n -0000017656 00000 n -0000017705 00000 n -0000227618 00000 n -0000393147 00000 n -0000017764 00000 n -0000017814 00000 n -0000230703 00000 n -0000393014 00000 n -0000017862 00000 n -0000017909 00000 n -0000230828 00000 n -0000392935 00000 n -0000017959 00000 n -0000017992 00000 n -0000230953 00000 n -0000392842 00000 n -0000018042 00000 n -0000018106 00000 n -0000231078 00000 n -0000392749 00000 n -0000018156 00000 n -0000018198 00000 n -0000237538 00000 n -0000392656 00000 n -0000018248 00000 n -0000018323 00000 n -0000237662 00000 n -0000392577 00000 n -0000018373 00000 n -0000018433 00000 n -0000245224 00000 n -0000392444 00000 n -0000018481 00000 n -0000018524 00000 n -0000245349 00000 n -0000392379 00000 n -0000018574 00000 n -0000018612 00000 n -0000249371 00000 n -0000392246 00000 n -0000018660 00000 n -0000018706 00000 n -0000249495 00000 n -0000392167 00000 n -0000018756 00000 n -0000018806 00000 n -0000253383 00000 n -0000392074 00000 n -0000018856 00000 n -0000018901 00000 n -0000253508 00000 n -0000391981 00000 n -0000018951 00000 n -0000019008 00000 n -0000253633 00000 n -0000391849 00000 n -0000019058 00000 n -0000019089 00000 n -0000253757 00000 n -0000391770 00000 n +0000246259 00000 n +0000466932 00000 n +0000015334 00000 n +0000015371 00000 n +0000246384 00000 n +0000466814 00000 n +0000015426 00000 n +0000015467 00000 n +0000246509 00000 n +0000466735 00000 n +0000015527 00000 n +0000015563 00000 n +0000246632 00000 n +0000466656 00000 n +0000015623 00000 n +0000015660 00000 n +0000246756 00000 n +0000466524 00000 n +0000015710 00000 n +0000015769 00000 n +0000246881 00000 n +0000466406 00000 n +0000015824 00000 n +0000015864 00000 n +0000249766 00000 n +0000466327 00000 n +0000015924 00000 n +0000015960 00000 n +0000249891 00000 n +0000466248 00000 n +0000016020 00000 n +0000016057 00000 n +0000250016 00000 n +0000466130 00000 n +0000016112 00000 n +0000016148 00000 n +0000250141 00000 n +0000466051 00000 n +0000016208 00000 n +0000016244 00000 n +0000250266 00000 n +0000465972 00000 n +0000016304 00000 n +0000016341 00000 n +0000253101 00000 n +0000465840 00000 n +0000016391 00000 n +0000016442 00000 n +0000253226 00000 n +0000465722 00000 n +0000016497 00000 n +0000016538 00000 n +0000253349 00000 n +0000465643 00000 n +0000016598 00000 n +0000016634 00000 n +0000253474 00000 n +0000465564 00000 n +0000016694 00000 n +0000016731 00000 n +0000253599 00000 n +0000465446 00000 n +0000016786 00000 n +0000016832 00000 n +0000253724 00000 n +0000465367 00000 n +0000016892 00000 n +0000016928 00000 n +0000253848 00000 n +0000465288 00000 n +0000016988 00000 n +0000017025 00000 n +0000256596 00000 n +0000465156 00000 n +0000017075 00000 n +0000017146 00000 n +0000256721 00000 n +0000465077 00000 n +0000017201 00000 n +0000017239 00000 n +0000256846 00000 n +0000464984 00000 n +0000017294 00000 n +0000017329 00000 n +0000259973 00000 n +0000464905 00000 n +0000017384 00000 n +0000017419 00000 n +0000260098 00000 n +0000464787 00000 n +0000017469 00000 n +0000017507 00000 n +0000260223 00000 n +0000464669 00000 n +0000017562 00000 n +0000017604 00000 n +0000260348 00000 n +0000464590 00000 n +0000017664 00000 n +0000017718 00000 n +0000260473 00000 n +0000464511 00000 n +0000017778 00000 n +0000017825 00000 n +0000263431 00000 n +0000464393 00000 n +0000017880 00000 n +0000017922 00000 n +0000263556 00000 n +0000464314 00000 n +0000017982 00000 n +0000018031 00000 n +0000263681 00000 n +0000464221 00000 n +0000018091 00000 n +0000018141 00000 n +0000263806 00000 n +0000464142 00000 n +0000018201 00000 n +0000018252 00000 n +0000267434 00000 n +0000464009 00000 n +0000018300 00000 n +0000018347 00000 n +0000267559 00000 n +0000463930 00000 n +0000018397 00000 n +0000018430 00000 n +0000267684 00000 n +0000463837 00000 n +0000018480 00000 n +0000018544 00000 n +0000267809 00000 n +0000463744 00000 n +0000018594 00000 n +0000018636 00000 n +0000275101 00000 n +0000463651 00000 n +0000018686 00000 n +0000018761 00000 n +0000275226 00000 n +0000463572 00000 n +0000018811 00000 n +0000018871 00000 n +0000283207 00000 n +0000463439 00000 n +0000018919 00000 n +0000018962 00000 n +0000283332 00000 n +0000463374 00000 n +0000019012 00000 n +0000019050 00000 n +0000287268 00000 n +0000463241 00000 n +0000019098 00000 n 0000019144 00000 n -0000019182 00000 n -0000253882 00000 n -0000391677 00000 n -0000019237 00000 n -0000019277 00000 n -0000254007 00000 n -0000391598 00000 n -0000019332 00000 n -0000019370 00000 n -0000257545 00000 n -0000391466 00000 n -0000019420 00000 n -0000019456 00000 n -0000257670 00000 n -0000391387 00000 n -0000019511 00000 n -0000019567 00000 n -0000257795 00000 n -0000391308 00000 n -0000019622 00000 n -0000019659 00000 n -0000257920 00000 n -0000391215 00000 n -0000019709 00000 n -0000019751 00000 n -0000260013 00000 n -0000391136 00000 n -0000019801 00000 n -0000019833 00000 n -0000263707 00000 n -0000391003 00000 n -0000019881 00000 n -0000019937 00000 n -0000263832 00000 n -0000390924 00000 n -0000019987 00000 n -0000020024 00000 n -0000263957 00000 n -0000390831 00000 n -0000020074 00000 n -0000020116 00000 n -0000267922 00000 n -0000390752 00000 n -0000020166 00000 n -0000020209 00000 n -0000271955 00000 n -0000390619 00000 n -0000020257 00000 n -0000020287 00000 n -0000272080 00000 n -0000390540 00000 n -0000020337 00000 n -0000020372 00000 n -0000272205 00000 n -0000390408 00000 n -0000020422 00000 n +0000287393 00000 n +0000463162 00000 n +0000019194 00000 n +0000019244 00000 n +0000291427 00000 n +0000463069 00000 n +0000019294 00000 n +0000019339 00000 n +0000291551 00000 n +0000462976 00000 n +0000019389 00000 n +0000019446 00000 n +0000291675 00000 n +0000462844 00000 n +0000019496 00000 n +0000019527 00000 n +0000291799 00000 n +0000462765 00000 n +0000019582 00000 n +0000019620 00000 n +0000291923 00000 n +0000462672 00000 n +0000019675 00000 n +0000019715 00000 n +0000295653 00000 n +0000462593 00000 n +0000019770 00000 n +0000019808 00000 n +0000295778 00000 n +0000462461 00000 n +0000019858 00000 n +0000019894 00000 n +0000295903 00000 n +0000462382 00000 n +0000019949 00000 n +0000020005 00000 n +0000296028 00000 n +0000462303 00000 n +0000020060 00000 n +0000020097 00000 n +0000296152 00000 n +0000462210 00000 n +0000020147 00000 n +0000020189 00000 n +0000298476 00000 n +0000462131 00000 n +0000020239 00000 n +0000020271 00000 n +0000302163 00000 n +0000461998 00000 n +0000020319 00000 n +0000020375 00000 n +0000302288 00000 n +0000461919 00000 n +0000020425 00000 n 0000020462 00000 n -0000272330 00000 n -0000390329 00000 n -0000020517 00000 n -0000020558 00000 n -0000272455 00000 n -0000390250 00000 n -0000020613 00000 n -0000020654 00000 n -0000275325 00000 n -0000390132 00000 n -0000020704 00000 n -0000020744 00000 n -0000275450 00000 n -0000390067 00000 n -0000020799 00000 n -0000020865 00000 n -0000277921 00000 n -0000389934 00000 n -0000020913 00000 n -0000020957 00000 n -0000278046 00000 n -0000389855 00000 n -0000021007 00000 n -0000021037 00000 n -0000278171 00000 n -0000389776 00000 n -0000021087 00000 n -0000021128 00000 n -0000279705 00000 n -0000389657 00000 n -0000021176 00000 n -0000021217 00000 n -0000279830 00000 n -0000389578 00000 n -0000021267 00000 n -0000021302 00000 n -0000279955 00000 n -0000389499 00000 n -0000021352 00000 n -0000021384 00000 n -0000021757 00000 n -0000021998 00000 n -0000021436 00000 n -0000021876 00000 n -0000021937 00000 n -0000386543 00000 n -0000373304 00000 n -0000386377 00000 n -0000372870 00000 n -0000368418 00000 n -0000372707 00000 n -0000387416 00000 n -0000024306 00000 n -0000023205 00000 n -0000022083 00000 n -0000024062 00000 n -0000368072 00000 n -0000365019 00000 n -0000367907 00000 n -0000024123 00000 n -0000363188 00000 n -0000346984 00000 n -0000363024 00000 n -0000345060 00000 n -0000327014 00000 n -0000344897 00000 n -0000024184 00000 n -0000023368 00000 n -0000326048 00000 n -0000310254 00000 n -0000325884 00000 n -0000023539 00000 n -0000023709 00000 n -0000024245 00000 n -0000023880 00000 n -0000032730 00000 n -0000025927 00000 n -0000024417 00000 n -0000032608 00000 n -0000032669 00000 n -0000026378 00000 n -0000026530 00000 n -0000026683 00000 n -0000026836 00000 n -0000026990 00000 n -0000027142 00000 n -0000027296 00000 n -0000027450 00000 n -0000027604 00000 n -0000027758 00000 n -0000027911 00000 n -0000028063 00000 n -0000028217 00000 n -0000028370 00000 n -0000028524 00000 n -0000028678 00000 n -0000028832 00000 n -0000028991 00000 n -0000029150 00000 n -0000029309 00000 n -0000029461 00000 n -0000029613 00000 n -0000029767 00000 n -0000029920 00000 n -0000030074 00000 n -0000030233 00000 n -0000030392 00000 n -0000030551 00000 n -0000030710 00000 n -0000030869 00000 n -0000031028 00000 n -0000031187 00000 n -0000031345 00000 n -0000031504 00000 n -0000031664 00000 n -0000031823 00000 n -0000031981 00000 n -0000032140 00000 n -0000032298 00000 n -0000032456 00000 n -0000043285 00000 n -0000034901 00000 n -0000032815 00000 n -0000043224 00000 n -0000308649 00000 n -0000299425 00000 n -0000308485 00000 n -0000035430 00000 n -0000035589 00000 n -0000035748 00000 n -0000035902 00000 n -0000036054 00000 n -0000036208 00000 n -0000036367 00000 n -0000036526 00000 n -0000036684 00000 n -0000036838 00000 n -0000036997 00000 n -0000037149 00000 n -0000037303 00000 n -0000037457 00000 n -0000037611 00000 n -0000037765 00000 n -0000037919 00000 n -0000038073 00000 n -0000038227 00000 n -0000038380 00000 n -0000038534 00000 n -0000038685 00000 n -0000038836 00000 n -0000038990 00000 n -0000039149 00000 n -0000039308 00000 n -0000039462 00000 n -0000039621 00000 n -0000039780 00000 n -0000039943 00000 n -0000040107 00000 n -0000040266 00000 n -0000040430 00000 n -0000040593 00000 n -0000040757 00000 n -0000040921 00000 n -0000041085 00000 n -0000041249 00000 n -0000041413 00000 n -0000041577 00000 n -0000041741 00000 n -0000041906 00000 n -0000042070 00000 n -0000042235 00000 n -0000042401 00000 n -0000042566 00000 n -0000042732 00000 n -0000042896 00000 n -0000043060 00000 n -0000054473 00000 n -0000045312 00000 n -0000043383 00000 n -0000054410 00000 n -0000045914 00000 n -0000046080 00000 n -0000046246 00000 n -0000046412 00000 n -0000046578 00000 n -0000046744 00000 n -0000046910 00000 n -0000047076 00000 n -0000047242 00000 n -0000047407 00000 n -0000047573 00000 n -0000047739 00000 n -0000047904 00000 n -0000048059 00000 n -0000048219 00000 n -0000048379 00000 n -0000048544 00000 n -0000048709 00000 n -0000048874 00000 n -0000049039 00000 n -0000049204 00000 n -0000049368 00000 n -0000049533 00000 n -0000049698 00000 n -0000049858 00000 n -0000050017 00000 n -0000050177 00000 n -0000050337 00000 n -0000050502 00000 n -0000050667 00000 n -0000050827 00000 n -0000050992 00000 n -0000051157 00000 n -0000051317 00000 n -0000051481 00000 n -0000051646 00000 n -0000051806 00000 n -0000051970 00000 n -0000052135 00000 n -0000052296 00000 n -0000052462 00000 n -0000052628 00000 n -0000052789 00000 n -0000052955 00000 n -0000053121 00000 n -0000053282 00000 n -0000053447 00000 n -0000053613 00000 n -0000053768 00000 n -0000053927 00000 n -0000054089 00000 n -0000054252 00000 n -0000065016 00000 n -0000056357 00000 n -0000054559 00000 n -0000064953 00000 n -0000056941 00000 n -0000057106 00000 n -0000057271 00000 n -0000057431 00000 n -0000057596 00000 n -0000057761 00000 n -0000057921 00000 n -0000058086 00000 n -0000058251 00000 n -0000058410 00000 n -0000058575 00000 n -0000298991 00000 n -0000297468 00000 n -0000298825 00000 n -0000058740 00000 n -0000058894 00000 n -0000059054 00000 n -0000059219 00000 n -0000059384 00000 n -0000059544 00000 n -0000059709 00000 n -0000059874 00000 n -0000060029 00000 n -0000060189 00000 n -0000060353 00000 n -0000060518 00000 n -0000060678 00000 n -0000060843 00000 n -0000061007 00000 n -0000061162 00000 n -0000061322 00000 n -0000061482 00000 n -0000061642 00000 n -0000061797 00000 n -0000061957 00000 n -0000062122 00000 n -0000062287 00000 n -0000062446 00000 n -0000062611 00000 n -0000062776 00000 n -0000062940 00000 n -0000063093 00000 n -0000063249 00000 n -0000063405 00000 n -0000063561 00000 n -0000063717 00000 n -0000063873 00000 n -0000064027 00000 n -0000064183 00000 n -0000064336 00000 n -0000064491 00000 n -0000064645 00000 n -0000064799 00000 n -0000070703 00000 n -0000066354 00000 n -0000065129 00000 n -0000070640 00000 n -0000066714 00000 n -0000066875 00000 n -0000067036 00000 n -0000067197 00000 n -0000067353 00000 n -0000067514 00000 n -0000067675 00000 n -0000067831 00000 n +0000302413 00000 n +0000461826 00000 n +0000020512 00000 n +0000020554 00000 n +0000306181 00000 n +0000461747 00000 n +0000020604 00000 n +0000020647 00000 n +0000311008 00000 n +0000461614 00000 n +0000020695 00000 n +0000020725 00000 n +0000311133 00000 n +0000461535 00000 n +0000020775 00000 n +0000020810 00000 n +0000311258 00000 n +0000461403 00000 n +0000020860 00000 n +0000020900 00000 n +0000311383 00000 n +0000461324 00000 n +0000020955 00000 n +0000020996 00000 n +0000311508 00000 n +0000461245 00000 n +0000021051 00000 n +0000021092 00000 n +0000314881 00000 n +0000461127 00000 n +0000021142 00000 n +0000021182 00000 n +0000315006 00000 n +0000461062 00000 n +0000021237 00000 n +0000021303 00000 n +0000318036 00000 n +0000460929 00000 n +0000021351 00000 n +0000021395 00000 n +0000318161 00000 n +0000460850 00000 n +0000021445 00000 n +0000021475 00000 n +0000318286 00000 n +0000460771 00000 n +0000021525 00000 n +0000021566 00000 n +0000320024 00000 n +0000460638 00000 n +0000021614 00000 n +0000021648 00000 n +0000320149 00000 n +0000460520 00000 n +0000021698 00000 n +0000021752 00000 n +0000320274 00000 n +0000460441 00000 n +0000021807 00000 n +0000021855 00000 n +0000324501 00000 n +0000460362 00000 n +0000021910 00000 n +0000021966 00000 n +0000324626 00000 n +0000460230 00000 n +0000022016 00000 n +0000022104 00000 n +0000324751 00000 n +0000460151 00000 n +0000022159 00000 n +0000022217 00000 n +0000327603 00000 n +0000460072 00000 n +0000022272 00000 n +0000022341 00000 n +0000334925 00000 n +0000459940 00000 n +0000022391 00000 n +0000022450 00000 n +0000335050 00000 n +0000459875 00000 n +0000022505 00000 n +0000022573 00000 n +0000345749 00000 n +0000459757 00000 n +0000022623 00000 n +0000022658 00000 n +0000345874 00000 n +0000459678 00000 n +0000022713 00000 n +0000022771 00000 n +0000345999 00000 n +0000459599 00000 n +0000022826 00000 n +0000022879 00000 n +0000347570 00000 n +0000459466 00000 n +0000022927 00000 n +0000022968 00000 n +0000347695 00000 n +0000459387 00000 n +0000023018 00000 n +0000023053 00000 n +0000347820 00000 n +0000459308 00000 n +0000023103 00000 n +0000023135 00000 n +0000351912 00000 n +0000459228 00000 n +0000023183 00000 n +0000023223 00000 n +0000023605 00000 n +0000023846 00000 n +0000023275 00000 n +0000023724 00000 n +0000023785 00000 n +0000456020 00000 n +0000442781 00000 n +0000455854 00000 n +0000442335 00000 n +0000437533 00000 n +0000442172 00000 n +0000456893 00000 n +0000025979 00000 n +0000025061 00000 n +0000023931 00000 n +0000025918 00000 n +0000436712 00000 n +0000420508 00000 n +0000436548 00000 n +0000418572 00000 n +0000400220 00000 n +0000418409 00000 n +0000025224 00000 n +0000399239 00000 n +0000383095 00000 n +0000399075 00000 n +0000025395 00000 n +0000025565 00000 n +0000025736 00000 n +0000034833 00000 n +0000029270 00000 n +0000026077 00000 n +0000034772 00000 n +0000381459 00000 n +0000371814 00000 n +0000381295 00000 n +0000029661 00000 n +0000371382 00000 n +0000369862 00000 n +0000371218 00000 n +0000029811 00000 n +0000029966 00000 n +0000030114 00000 n +0000030274 00000 n +0000367962 00000 n +0000365952 00000 n +0000367799 00000 n +0000030426 00000 n +0000030612 00000 n +0000030761 00000 n +0000030912 00000 n +0000031062 00000 n +0000031218 00000 n +0000031388 00000 n +0000031555 00000 n +0000031705 00000 n +0000031880 00000 n +0000032056 00000 n +0000032225 00000 n +0000032375 00000 n +0000032522 00000 n +0000032667 00000 n +0000032819 00000 n +0000032988 00000 n +0000033138 00000 n +0000033309 00000 n +0000033462 00000 n +0000033635 00000 n +0000033806 00000 n +0000033952 00000 n +0000034119 00000 n +0000034292 00000 n +0000034444 00000 n +0000034600 00000 n +0000093921 00000 n +0000101434 00000 n +0000108886 00000 n +0000121931 00000 n +0000131681 00000 n +0000150699 00000 n +0000159520 00000 n +0000174391 00000 n +0000177229 00000 n +0000183328 00000 n +0000267496 00000 n +0000283269 00000 n +0000287330 00000 n +0000302225 00000 n +0000311070 00000 n +0000318098 00000 n +0000320086 00000 n +0000347632 00000 n +0000351974 00000 n +0000044328 00000 n +0000037438 00000 n +0000034957 00000 n +0000044202 00000 n +0000044265 00000 n +0000037932 00000 n +0000038085 00000 n +0000038239 00000 n +0000038393 00000 n +0000038548 00000 n +0000038701 00000 n +0000038856 00000 n +0000039011 00000 n +0000039166 00000 n +0000039321 00000 n +0000039475 00000 n +0000039628 00000 n +0000039783 00000 n +0000039937 00000 n +0000040092 00000 n +0000040247 00000 n +0000040402 00000 n +0000040562 00000 n +0000040722 00000 n +0000040882 00000 n +0000041035 00000 n +0000041188 00000 n +0000041343 00000 n +0000041497 00000 n +0000041652 00000 n +0000041812 00000 n +0000041972 00000 n +0000042132 00000 n +0000042292 00000 n +0000042452 00000 n +0000042612 00000 n +0000042772 00000 n +0000042931 00000 n +0000043091 00000 n +0000043252 00000 n +0000043412 00000 n +0000043571 00000 n +0000043731 00000 n +0000043890 00000 n +0000044049 00000 n +0000055715 00000 n +0000047590 00000 n +0000044414 00000 n +0000055652 00000 n +0000365367 00000 n +0000356177 00000 n +0000365201 00000 n +0000048147 00000 n +0000048307 00000 n +0000048467 00000 n +0000048622 00000 n +0000048775 00000 n +0000048930 00000 n +0000049090 00000 n +0000049250 00000 n +0000049409 00000 n +0000049564 00000 n +0000049724 00000 n +0000049877 00000 n +0000050032 00000 n +0000050187 00000 n +0000050342 00000 n +0000050497 00000 n +0000050652 00000 n +0000050807 00000 n +0000050962 00000 n +0000051116 00000 n +0000051271 00000 n +0000051423 00000 n +0000051575 00000 n +0000051730 00000 n +0000051884 00000 n +0000052040 00000 n +0000052201 00000 n +0000052362 00000 n +0000052516 00000 n +0000052677 00000 n +0000052838 00000 n +0000053004 00000 n +0000053169 00000 n +0000053330 00000 n +0000053496 00000 n +0000053662 00000 n +0000053828 00000 n +0000053994 00000 n +0000054160 00000 n +0000054326 00000 n +0000054491 00000 n +0000054656 00000 n +0000054822 00000 n +0000054989 00000 n +0000055155 00000 n +0000055322 00000 n +0000055487 00000 n +0000068050 00000 n +0000059340 00000 n +0000055815 00000 n 0000067987 00000 n -0000068141 00000 n -0000068297 00000 n -0000068452 00000 n -0000068608 00000 n -0000068762 00000 n -0000068918 00000 n -0000069074 00000 n -0000069235 00000 n -0000069396 00000 n -0000069552 00000 n -0000069712 00000 n -0000069866 00000 n -0000070021 00000 n -0000070176 00000 n -0000070328 00000 n -0000070484 00000 n -0000387536 00000 n -0000074382 00000 n -0000073825 00000 n -0000070802 00000 n -0000073948 00000 n -0000074071 00000 n -0000074195 00000 n -0000074319 00000 n -0000077719 00000 n -0000077409 00000 n -0000074468 00000 n -0000077532 00000 n -0000077656 00000 n -0000295566 00000 n -0000293552 00000 n -0000295401 00000 n -0000081795 00000 n -0000080674 00000 n -0000077832 00000 n -0000080797 00000 n -0000080921 00000 n -0000081045 00000 n -0000081108 00000 n -0000081171 00000 n -0000081234 00000 n -0000081358 00000 n -0000081481 00000 n -0000081544 00000 n -0000081607 00000 n -0000081670 00000 n -0000081733 00000 n -0000085789 00000 n -0000085229 00000 n -0000081881 00000 n -0000085352 00000 n -0000085415 00000 n -0000085478 00000 n -0000085602 00000 n -0000085726 00000 n -0000088472 00000 n -0000087787 00000 n -0000085888 00000 n -0000087910 00000 n -0000088034 00000 n -0000088158 00000 n -0000088221 00000 n -0000088284 00000 n -0000088347 00000 n -0000088410 00000 n -0000091041 00000 n -0000090731 00000 n -0000088571 00000 n -0000090854 00000 n -0000090978 00000 n -0000387661 00000 n -0000093320 00000 n -0000092887 00000 n -0000091167 00000 n -0000093010 00000 n -0000093134 00000 n -0000093257 00000 n -0000096545 00000 n -0000095674 00000 n -0000093432 00000 n -0000095797 00000 n -0000095860 00000 n -0000095923 00000 n -0000095986 00000 n -0000096110 00000 n -0000096234 00000 n -0000096358 00000 n -0000096482 00000 n -0000101214 00000 n -0000099982 00000 n -0000096657 00000 n -0000100524 00000 n -0000100648 00000 n -0000100135 00000 n -0000100334 00000 n -0000100711 00000 n -0000100774 00000 n -0000100837 00000 n -0000100900 00000 n -0000100963 00000 n -0000101026 00000 n -0000101089 00000 n -0000101152 00000 n -0000106005 00000 n -0000104751 00000 n -0000101313 00000 n -0000104874 00000 n -0000104937 00000 n -0000105000 00000 n -0000105062 00000 n -0000105125 00000 n -0000105188 00000 n -0000105251 00000 n -0000105314 00000 n -0000105376 00000 n -0000105439 00000 n -0000105502 00000 n -0000105565 00000 n -0000105627 00000 n -0000105690 00000 n -0000105753 00000 n -0000105816 00000 n -0000105879 00000 n -0000105942 00000 n -0000110449 00000 n -0000109389 00000 n -0000106091 00000 n -0000109512 00000 n -0000109636 00000 n -0000109760 00000 n -0000109883 00000 n -0000109946 00000 n -0000110009 00000 n -0000110072 00000 n -0000110135 00000 n -0000110198 00000 n -0000110261 00000 n -0000110324 00000 n -0000110387 00000 n -0000114439 00000 n -0000112695 00000 n -0000110535 00000 n -0000112818 00000 n -0000112881 00000 n -0000112944 00000 n -0000113007 00000 n -0000113131 00000 n -0000113256 00000 n -0000113380 00000 n -0000113505 00000 n -0000113630 00000 n -0000113755 00000 n -0000113880 00000 n -0000114004 00000 n -0000114129 00000 n -0000114254 00000 n -0000114378 00000 n -0000387786 00000 n -0000118116 00000 n -0000116554 00000 n -0000114538 00000 n -0000116677 00000 n -0000116802 00000 n -0000116926 00000 n -0000117051 00000 n -0000117176 00000 n -0000117301 00000 n -0000117426 00000 n -0000117551 00000 n -0000117614 00000 n -0000117677 00000 n -0000117740 00000 n -0000117803 00000 n -0000117866 00000 n -0000117928 00000 n -0000117991 00000 n -0000118054 00000 n -0000122240 00000 n -0000121363 00000 n -0000118228 00000 n -0000121486 00000 n -0000121549 00000 n -0000121612 00000 n -0000121675 00000 n -0000121738 00000 n -0000121801 00000 n -0000121864 00000 n -0000121988 00000 n -0000122051 00000 n -0000122114 00000 n -0000122177 00000 n -0000124346 00000 n -0000123405 00000 n -0000122339 00000 n -0000123528 00000 n -0000123653 00000 n -0000123716 00000 n -0000123779 00000 n -0000123842 00000 n -0000123905 00000 n -0000123968 00000 n -0000124031 00000 n -0000124094 00000 n -0000124157 00000 n -0000124220 00000 n -0000124283 00000 n -0000128051 00000 n +0000059915 00000 n +0000060082 00000 n +0000060249 00000 n +0000060416 00000 n +0000060583 00000 n +0000060750 00000 n +0000060917 00000 n +0000061083 00000 n +0000061250 00000 n +0000061417 00000 n +0000061583 00000 n +0000061750 00000 n +0000061917 00000 n +0000062084 00000 n +0000062251 00000 n +0000062418 00000 n +0000062585 00000 n +0000062741 00000 n +0000062902 00000 n +0000063062 00000 n +0000063228 00000 n +0000063394 00000 n +0000063559 00000 n +0000063725 00000 n +0000063891 00000 n +0000064057 00000 n +0000064223 00000 n +0000064389 00000 n +0000064550 00000 n +0000064711 00000 n +0000064872 00000 n +0000065032 00000 n +0000065198 00000 n +0000065364 00000 n +0000065524 00000 n +0000065690 00000 n +0000065856 00000 n +0000066017 00000 n +0000066183 00000 n +0000066349 00000 n +0000066510 00000 n +0000066676 00000 n +0000066842 00000 n +0000067003 00000 n +0000067170 00000 n +0000067337 00000 n +0000067498 00000 n +0000067662 00000 n +0000067827 00000 n +0000079694 00000 n +0000070937 00000 n +0000068137 00000 n +0000079631 00000 n +0000071522 00000 n +0000071689 00000 n +0000071856 00000 n +0000072012 00000 n +0000072173 00000 n +0000072339 00000 n +0000072505 00000 n +0000072666 00000 n +0000072832 00000 n +0000072997 00000 n +0000073158 00000 n +0000073324 00000 n +0000073489 00000 n +0000073650 00000 n +0000073816 00000 n +0000073982 00000 n +0000074143 00000 n +0000074309 00000 n +0000074475 00000 n +0000074631 00000 n +0000074792 00000 n +0000074957 00000 n +0000075123 00000 n +0000075284 00000 n +0000075450 00000 n +0000075615 00000 n +0000075771 00000 n +0000075932 00000 n +0000076098 00000 n +0000076264 00000 n +0000076425 00000 n +0000076591 00000 n +0000076757 00000 n +0000076913 00000 n +0000077073 00000 n +0000077234 00000 n +0000077395 00000 n +0000077550 00000 n +0000077711 00000 n +0000077877 00000 n +0000078043 00000 n +0000078204 00000 n +0000078370 00000 n +0000078536 00000 n +0000078702 00000 n +0000078856 00000 n +0000079012 00000 n +0000079168 00000 n +0000079323 00000 n +0000079477 00000 n +0000457014 00000 n +0000090563 00000 n +0000082893 00000 n +0000079807 00000 n +0000090500 00000 n +0000083433 00000 n +0000083587 00000 n +0000083743 00000 n +0000083897 00000 n +0000084053 00000 n +0000084209 00000 n +0000084365 00000 n +0000084521 00000 n +0000084681 00000 n +0000084842 00000 n +0000085003 00000 n +0000085158 00000 n +0000085319 00000 n +0000085480 00000 n +0000085636 00000 n +0000085792 00000 n +0000085946 00000 n +0000086102 00000 n +0000086258 00000 n +0000086413 00000 n +0000086567 00000 n +0000086722 00000 n +0000086877 00000 n +0000087038 00000 n +0000087199 00000 n +0000087355 00000 n +0000087516 00000 n +0000087670 00000 n +0000087826 00000 n +0000087981 00000 n +0000088135 00000 n +0000088291 00000 n +0000088451 00000 n +0000088612 00000 n +0000088768 00000 n +0000088929 00000 n +0000089090 00000 n +0000089246 00000 n +0000089407 00000 n +0000089563 00000 n +0000089723 00000 n +0000089883 00000 n +0000090037 00000 n +0000090192 00000 n +0000090348 00000 n +0000094232 00000 n +0000093675 00000 n +0000090663 00000 n +0000093798 00000 n +0000094045 00000 n +0000094169 00000 n +0000097839 00000 n +0000097529 00000 n +0000094318 00000 n +0000097652 00000 n +0000097776 00000 n +0000102369 00000 n +0000101187 00000 n +0000097952 00000 n +0000101310 00000 n +0000101558 00000 n +0000101621 00000 n +0000101683 00000 n +0000101746 00000 n +0000101870 00000 n +0000101993 00000 n +0000102056 00000 n +0000102119 00000 n +0000102181 00000 n +0000102244 00000 n +0000102307 00000 n +0000106251 00000 n +0000105755 00000 n +0000102455 00000 n +0000105878 00000 n +0000105941 00000 n +0000106065 00000 n +0000106188 00000 n +0000109325 00000 n +0000108639 00000 n +0000106351 00000 n +0000108762 00000 n +0000109010 00000 n +0000109073 00000 n +0000109136 00000 n +0000109199 00000 n +0000109262 00000 n +0000457139 00000 n +0000111841 00000 n +0000111531 00000 n +0000109424 00000 n +0000111654 00000 n +0000111778 00000 n +0000114339 00000 n +0000113843 00000 n +0000111967 00000 n +0000113966 00000 n +0000114090 00000 n +0000114214 00000 n +0000114277 00000 n +0000117368 00000 n +0000116562 00000 n +0000114452 00000 n +0000116685 00000 n +0000116748 00000 n +0000116811 00000 n +0000116934 00000 n +0000117058 00000 n +0000117181 00000 n +0000117305 00000 n +0000122559 00000 n +0000121263 00000 n +0000117468 00000 n +0000121807 00000 n +0000121416 00000 n +0000121617 00000 n +0000121994 00000 n +0000122057 00000 n +0000122120 00000 n +0000122183 00000 n +0000122245 00000 n +0000122308 00000 n +0000122371 00000 n +0000122434 00000 n +0000122497 00000 n +0000127615 00000 n +0000126425 00000 n +0000122658 00000 n +0000126548 00000 n +0000126611 00000 n 0000126674 00000 n -0000124445 00000 n -0000126797 00000 n -0000126922 00000 n -0000127047 00000 n -0000127110 00000 n -0000127173 00000 n -0000127236 00000 n -0000127299 00000 n -0000127362 00000 n -0000127424 00000 n -0000127487 00000 n -0000127611 00000 n -0000127674 00000 n -0000127737 00000 n -0000127800 00000 n -0000127863 00000 n -0000127988 00000 n -0000129836 00000 n -0000129527 00000 n -0000128151 00000 n -0000129650 00000 n -0000129773 00000 n -0000132103 00000 n -0000131416 00000 n -0000129962 00000 n -0000131539 00000 n -0000131664 00000 n -0000131727 00000 n -0000131789 00000 n -0000131852 00000 n -0000131915 00000 n -0000132040 00000 n -0000387911 00000 n -0000136264 00000 n -0000135578 00000 n -0000132229 00000 n -0000135701 00000 n -0000135826 00000 n -0000135951 00000 n -0000136076 00000 n -0000136201 00000 n -0000140692 00000 n -0000140131 00000 n -0000136364 00000 n -0000140254 00000 n -0000140379 00000 n -0000140504 00000 n -0000140629 00000 n -0000145407 00000 n -0000144846 00000 n -0000140791 00000 n -0000144969 00000 n -0000145094 00000 n -0000145219 00000 n -0000145344 00000 n -0000146221 00000 n -0000146035 00000 n -0000145520 00000 n -0000146158 00000 n -0000150030 00000 n -0000149719 00000 n -0000146307 00000 n -0000149842 00000 n -0000149967 00000 n -0000292953 00000 n -0000284233 00000 n -0000292787 00000 n -0000283051 00000 n -0000281175 00000 n -0000282885 00000 n -0000151243 00000 n -0000151057 00000 n -0000150157 00000 n -0000151180 00000 n -0000388036 00000 n -0000157049 00000 n -0000154858 00000 n -0000151342 00000 n -0000156424 00000 n -0000156549 00000 n -0000156674 00000 n -0000155056 00000 n -0000155250 00000 n -0000155444 00000 n -0000155666 00000 n -0000155854 00000 n -0000156030 00000 n -0000156237 00000 n -0000156736 00000 n -0000156799 00000 n -0000156861 00000 n -0000156923 00000 n -0000156986 00000 n -0000160803 00000 n -0000159804 00000 n -0000157175 00000 n -0000159927 00000 n -0000160052 00000 n -0000160177 00000 n -0000160301 00000 n -0000160426 00000 n -0000160489 00000 n -0000160552 00000 n -0000160614 00000 n -0000160677 00000 n -0000160740 00000 n -0000163349 00000 n -0000162165 00000 n -0000160902 00000 n -0000162288 00000 n -0000162413 00000 n -0000162538 00000 n -0000162663 00000 n -0000162788 00000 n -0000162913 00000 n -0000163038 00000 n -0000163162 00000 n -0000163286 00000 n -0000165906 00000 n -0000164845 00000 n -0000163448 00000 n -0000164968 00000 n -0000165093 00000 n -0000165218 00000 n -0000165343 00000 n -0000165468 00000 n -0000165593 00000 n -0000165718 00000 n -0000165843 00000 n -0000168900 00000 n -0000168089 00000 n -0000166018 00000 n -0000168212 00000 n -0000168337 00000 n -0000168462 00000 n -0000168587 00000 n -0000168712 00000 n -0000168837 00000 n -0000171798 00000 n -0000170987 00000 n -0000169026 00000 n -0000171110 00000 n -0000171235 00000 n -0000171360 00000 n -0000171485 00000 n -0000171610 00000 n -0000171735 00000 n -0000388161 00000 n -0000174071 00000 n -0000173510 00000 n -0000171924 00000 n -0000173633 00000 n -0000173758 00000 n -0000173883 00000 n -0000174008 00000 n -0000176073 00000 n -0000175637 00000 n -0000174196 00000 n -0000175760 00000 n -0000175885 00000 n -0000176010 00000 n -0000178286 00000 n -0000177850 00000 n -0000176185 00000 n -0000177973 00000 n -0000178098 00000 n -0000178223 00000 n -0000180754 00000 n -0000180318 00000 n -0000178398 00000 n -0000180441 00000 n -0000180566 00000 n -0000180691 00000 n -0000184286 00000 n -0000183851 00000 n -0000180880 00000 n -0000183974 00000 n -0000184099 00000 n -0000184223 00000 n -0000187580 00000 n -0000187144 00000 n -0000184412 00000 n -0000187267 00000 n -0000187392 00000 n -0000187517 00000 n -0000388286 00000 n -0000190463 00000 n -0000189654 00000 n -0000187719 00000 n -0000189777 00000 n -0000189902 00000 n -0000190027 00000 n -0000190152 00000 n -0000190276 00000 n -0000190401 00000 n -0000193868 00000 n -0000193183 00000 n -0000190575 00000 n -0000193306 00000 n -0000193431 00000 n -0000193555 00000 n -0000193680 00000 n -0000193805 00000 n -0000196234 00000 n -0000195801 00000 n -0000193994 00000 n -0000195924 00000 n -0000196049 00000 n -0000196173 00000 n -0000198949 00000 n -0000197764 00000 n -0000196360 00000 n -0000197887 00000 n -0000198012 00000 n -0000198137 00000 n -0000198262 00000 n -0000198387 00000 n -0000198512 00000 n -0000198636 00000 n -0000198761 00000 n -0000198886 00000 n -0000201615 00000 n -0000200433 00000 n -0000199088 00000 n -0000200556 00000 n -0000200681 00000 n -0000200806 00000 n -0000200930 00000 n -0000201055 00000 n -0000201180 00000 n -0000201303 00000 n -0000201428 00000 n -0000201553 00000 n -0000203687 00000 n -0000203001 00000 n -0000201727 00000 n -0000203124 00000 n -0000203249 00000 n -0000203374 00000 n -0000203499 00000 n -0000203624 00000 n -0000388411 00000 n -0000206559 00000 n -0000205875 00000 n -0000203799 00000 n -0000205998 00000 n -0000206123 00000 n -0000206248 00000 n -0000206372 00000 n -0000206497 00000 n -0000209818 00000 n -0000208760 00000 n -0000206685 00000 n -0000208883 00000 n -0000209008 00000 n -0000209133 00000 n -0000209258 00000 n -0000209383 00000 n -0000209506 00000 n -0000209631 00000 n -0000209756 00000 n -0000212591 00000 n -0000211657 00000 n -0000209930 00000 n -0000211780 00000 n -0000211905 00000 n -0000212030 00000 n -0000212155 00000 n -0000212280 00000 n -0000212404 00000 n -0000212529 00000 n -0000214950 00000 n -0000214139 00000 n -0000212744 00000 n -0000214262 00000 n -0000214387 00000 n -0000214512 00000 n -0000214637 00000 n -0000214762 00000 n -0000214887 00000 n -0000217497 00000 n -0000216811 00000 n -0000215076 00000 n -0000216934 00000 n -0000217059 00000 n -0000217184 00000 n -0000217309 00000 n -0000217434 00000 n -0000220512 00000 n -0000219578 00000 n -0000217609 00000 n -0000219701 00000 n -0000219826 00000 n -0000219951 00000 n -0000220076 00000 n -0000220201 00000 n -0000220326 00000 n -0000220449 00000 n -0000388536 00000 n -0000222453 00000 n -0000222018 00000 n -0000220624 00000 n -0000222141 00000 n -0000222266 00000 n -0000222391 00000 n -0000225349 00000 n -0000224665 00000 n -0000222565 00000 n -0000224788 00000 n -0000224913 00000 n -0000225038 00000 n -0000225161 00000 n -0000225286 00000 n -0000227743 00000 n -0000227059 00000 n -0000225448 00000 n -0000227182 00000 n -0000227307 00000 n -0000227432 00000 n -0000227556 00000 n -0000227680 00000 n -0000231203 00000 n -0000230517 00000 n -0000227855 00000 n -0000230640 00000 n -0000230765 00000 n -0000230890 00000 n -0000231015 00000 n -0000231140 00000 n -0000234318 00000 n -0000233756 00000 n -0000231316 00000 n -0000233879 00000 n -0000233942 00000 n -0000234005 00000 n -0000234068 00000 n -0000234131 00000 n -0000234194 00000 n -0000234257 00000 n -0000237787 00000 n -0000237226 00000 n -0000234431 00000 n -0000237349 00000 n -0000237412 00000 n -0000237475 00000 n -0000237600 00000 n -0000237724 00000 n -0000388661 00000 n -0000240835 00000 n -0000240649 00000 n -0000237913 00000 n -0000240772 00000 n -0000242762 00000 n -0000242576 00000 n -0000240948 00000 n -0000242699 00000 n -0000245474 00000 n -0000245038 00000 n -0000242875 00000 n -0000245161 00000 n -0000245286 00000 n -0000245411 00000 n -0000249619 00000 n -0000249185 00000 n -0000245573 00000 n -0000249308 00000 n -0000249433 00000 n -0000249556 00000 n -0000254131 00000 n -0000253197 00000 n -0000249718 00000 n -0000253320 00000 n -0000253445 00000 n -0000253570 00000 n -0000253694 00000 n -0000253819 00000 n -0000253944 00000 n -0000254069 00000 n -0000258045 00000 n -0000257359 00000 n -0000254244 00000 n -0000257482 00000 n -0000257607 00000 n -0000257732 00000 n -0000257857 00000 n -0000257982 00000 n -0000388786 00000 n -0000260138 00000 n -0000259827 00000 n -0000258157 00000 n -0000259950 00000 n -0000260075 00000 n -0000264081 00000 n -0000263521 00000 n -0000260264 00000 n -0000263644 00000 n -0000263769 00000 n -0000263894 00000 n -0000264018 00000 n -0000268110 00000 n -0000267736 00000 n -0000264180 00000 n -0000267859 00000 n -0000267984 00000 n -0000268047 00000 n -0000269361 00000 n -0000269175 00000 n -0000268263 00000 n -0000269298 00000 n -0000272579 00000 n -0000271769 00000 n -0000269473 00000 n -0000271892 00000 n -0000272017 00000 n -0000272142 00000 n -0000272267 00000 n -0000272392 00000 n -0000272517 00000 n -0000275575 00000 n -0000275139 00000 n -0000272678 00000 n -0000275262 00000 n -0000275387 00000 n -0000275512 00000 n -0000388911 00000 n -0000278296 00000 n -0000277735 00000 n -0000275701 00000 n -0000277858 00000 n -0000277983 00000 n -0000278108 00000 n -0000278233 00000 n -0000280080 00000 n -0000279519 00000 n -0000278409 00000 n -0000279642 00000 n -0000279767 00000 n -0000279892 00000 n -0000280017 00000 n -0000280179 00000 n -0000283261 00000 n -0000283286 00000 n -0000293287 00000 n -0000295779 00000 n -0000295810 00000 n -0000299208 00000 n -0000308973 00000 n -0000309235 00000 n -0000326633 00000 n -0000345608 00000 n -0000346035 00000 n -0000363628 00000 n -0000364009 00000 n -0000368279 00000 n -0000373105 00000 n -0000387016 00000 n -0000389009 00000 n -0000389134 00000 n -0000389260 00000 n -0000389340 00000 n -0000389422 00000 n -0000409988 00000 n -0000424113 00000 n -0000424154 00000 n -0000424194 00000 n -0000424425 00000 n +0000126737 00000 n +0000126800 00000 n +0000126863 00000 n +0000126926 00000 n +0000126989 00000 n +0000127052 00000 n +0000127115 00000 n +0000127178 00000 n +0000127240 00000 n +0000127303 00000 n +0000127366 00000 n +0000127427 00000 n +0000127490 00000 n +0000127553 00000 n +0000132494 00000 n +0000131434 00000 n +0000127702 00000 n +0000131557 00000 n +0000131805 00000 n +0000131928 00000 n +0000131991 00000 n +0000132054 00000 n +0000132117 00000 n +0000132179 00000 n +0000132242 00000 n +0000132305 00000 n +0000132368 00000 n +0000132431 00000 n +0000457264 00000 n +0000136461 00000 n +0000134966 00000 n +0000132580 00000 n +0000135089 00000 n +0000135152 00000 n +0000135215 00000 n +0000135278 00000 n +0000135401 00000 n +0000135526 00000 n +0000135650 00000 n +0000135774 00000 n +0000135899 00000 n +0000136024 00000 n +0000136149 00000 n +0000136273 00000 n +0000136398 00000 n +0000140346 00000 n +0000138791 00000 n +0000136561 00000 n +0000138914 00000 n +0000139039 00000 n +0000139163 00000 n +0000139288 00000 n +0000139413 00000 n +0000139536 00000 n +0000139661 00000 n +0000139786 00000 n +0000139910 00000 n +0000140035 00000 n +0000140098 00000 n +0000140161 00000 n +0000140223 00000 n +0000140285 00000 n +0000145366 00000 n +0000144236 00000 n +0000140459 00000 n +0000144359 00000 n +0000144422 00000 n +0000144485 00000 n +0000144548 00000 n +0000144611 00000 n +0000144674 00000 n +0000144737 00000 n +0000144800 00000 n +0000144863 00000 n +0000144926 00000 n +0000144989 00000 n +0000145114 00000 n +0000145177 00000 n +0000145240 00000 n +0000145303 00000 n +0000147701 00000 n +0000146762 00000 n +0000145466 00000 n +0000146885 00000 n +0000147010 00000 n +0000147073 00000 n +0000147136 00000 n +0000147199 00000 n +0000147262 00000 n +0000147325 00000 n +0000147387 00000 n +0000147450 00000 n +0000147513 00000 n +0000147576 00000 n +0000147639 00000 n +0000151828 00000 n +0000150451 00000 n +0000147801 00000 n +0000150574 00000 n +0000150824 00000 n +0000150887 00000 n +0000150950 00000 n +0000151013 00000 n +0000151076 00000 n +0000151139 00000 n +0000151202 00000 n +0000151265 00000 n +0000151390 00000 n +0000151452 00000 n +0000151515 00000 n +0000151578 00000 n +0000151641 00000 n +0000151766 00000 n +0000153920 00000 n +0000153484 00000 n +0000151940 00000 n +0000153607 00000 n +0000153732 00000 n +0000153857 00000 n +0000457389 00000 n +0000156041 00000 n +0000155478 00000 n +0000154046 00000 n +0000155601 00000 n +0000155664 00000 n +0000155727 00000 n +0000155790 00000 n +0000155853 00000 n +0000155978 00000 n +0000159958 00000 n +0000159272 00000 n +0000156167 00000 n +0000159395 00000 n +0000159645 00000 n +0000159770 00000 n +0000159895 00000 n +0000163906 00000 n +0000163471 00000 n +0000160057 00000 n +0000163594 00000 n +0000163719 00000 n +0000163844 00000 n +0000168436 00000 n +0000167750 00000 n +0000164006 00000 n +0000167873 00000 n +0000167998 00000 n +0000168123 00000 n +0000168248 00000 n +0000168373 00000 n +0000170747 00000 n +0000170561 00000 n +0000168549 00000 n +0000170684 00000 n +0000174454 00000 n +0000174143 00000 n +0000170834 00000 n +0000174266 00000 n +0000354995 00000 n +0000353119 00000 n +0000354829 00000 n +0000457514 00000 n +0000175950 00000 n +0000175764 00000 n +0000174580 00000 n +0000175887 00000 n +0000177731 00000 n +0000176981 00000 n +0000176050 00000 n +0000177104 00000 n +0000177354 00000 n +0000177417 00000 n +0000177480 00000 n +0000177543 00000 n +0000177606 00000 n +0000177669 00000 n +0000183766 00000 n +0000181402 00000 n +0000177830 00000 n +0000183203 00000 n +0000183453 00000 n +0000181609 00000 n +0000181802 00000 n +0000181996 00000 n +0000182219 00000 n +0000182442 00000 n +0000182631 00000 n +0000182807 00000 n +0000183015 00000 n +0000183516 00000 n +0000183579 00000 n +0000183641 00000 n +0000183704 00000 n +0000188490 00000 n +0000187183 00000 n +0000183891 00000 n +0000187306 00000 n +0000187369 00000 n +0000187494 00000 n +0000187619 00000 n +0000187744 00000 n +0000187869 00000 n +0000187931 00000 n +0000187993 00000 n +0000188056 00000 n +0000188119 00000 n +0000188182 00000 n +0000188307 00000 n +0000188428 00000 n +0000192289 00000 n +0000190983 00000 n +0000188590 00000 n +0000191106 00000 n +0000191231 00000 n +0000191354 00000 n +0000191479 00000 n +0000191604 00000 n +0000191729 00000 n +0000191854 00000 n +0000191979 00000 n +0000192101 00000 n +0000192226 00000 n +0000196296 00000 n +0000195111 00000 n +0000192402 00000 n +0000195234 00000 n +0000195359 00000 n +0000195484 00000 n +0000195609 00000 n +0000195734 00000 n +0000195858 00000 n +0000195983 00000 n +0000196108 00000 n +0000196233 00000 n +0000457639 00000 n +0000200381 00000 n +0000199447 00000 n +0000196409 00000 n +0000199570 00000 n +0000199695 00000 n +0000199819 00000 n +0000199944 00000 n +0000200069 00000 n +0000200194 00000 n +0000200319 00000 n +0000204118 00000 n +0000203307 00000 n +0000200507 00000 n +0000203430 00000 n +0000203555 00000 n +0000203680 00000 n +0000203805 00000 n +0000203930 00000 n +0000204055 00000 n +0000207810 00000 n +0000207375 00000 n +0000204244 00000 n +0000207498 00000 n +0000207623 00000 n +0000207748 00000 n +0000212719 00000 n +0000212283 00000 n +0000207923 00000 n +0000212406 00000 n +0000212531 00000 n +0000212656 00000 n +0000216691 00000 n +0000216130 00000 n +0000212845 00000 n +0000216253 00000 n +0000216378 00000 n +0000216503 00000 n +0000216628 00000 n +0000220695 00000 n +0000220009 00000 n +0000216830 00000 n +0000220132 00000 n +0000220257 00000 n +0000220382 00000 n +0000220507 00000 n +0000220632 00000 n +0000457764 00000 n +0000225051 00000 n +0000224116 00000 n +0000220821 00000 n +0000224239 00000 n +0000224364 00000 n +0000224489 00000 n +0000224614 00000 n +0000224739 00000 n +0000224864 00000 n +0000224988 00000 n +0000228989 00000 n +0000228429 00000 n +0000225177 00000 n +0000228552 00000 n +0000228676 00000 n +0000228801 00000 n +0000228926 00000 n +0000232338 00000 n +0000230902 00000 n +0000229115 00000 n +0000231025 00000 n +0000231150 00000 n +0000231275 00000 n +0000231400 00000 n +0000231525 00000 n +0000231650 00000 n +0000231775 00000 n +0000231900 00000 n +0000232025 00000 n +0000232150 00000 n +0000232275 00000 n +0000236083 00000 n +0000234899 00000 n +0000232464 00000 n +0000235022 00000 n +0000235147 00000 n +0000235272 00000 n +0000235396 00000 n +0000235521 00000 n +0000235646 00000 n +0000235771 00000 n +0000235895 00000 n +0000236020 00000 n +0000240011 00000 n +0000239202 00000 n +0000236196 00000 n +0000239325 00000 n +0000239450 00000 n +0000239575 00000 n +0000239700 00000 n +0000239825 00000 n +0000239950 00000 n +0000243893 00000 n +0000242708 00000 n +0000240137 00000 n +0000242831 00000 n +0000242956 00000 n +0000243081 00000 n +0000243206 00000 n +0000243331 00000 n +0000243456 00000 n +0000243581 00000 n +0000243706 00000 n +0000243831 00000 n +0000457889 00000 n +0000247006 00000 n +0000246073 00000 n +0000244006 00000 n +0000246196 00000 n +0000246321 00000 n +0000246446 00000 n +0000246569 00000 n +0000246693 00000 n +0000246818 00000 n +0000246943 00000 n +0000250391 00000 n +0000249580 00000 n +0000247158 00000 n +0000249703 00000 n +0000249828 00000 n +0000249953 00000 n +0000250078 00000 n +0000250203 00000 n +0000250328 00000 n +0000253973 00000 n +0000252915 00000 n +0000250517 00000 n +0000253038 00000 n +0000253163 00000 n +0000253286 00000 n +0000253411 00000 n +0000253536 00000 n +0000253661 00000 n +0000253785 00000 n +0000253910 00000 n +0000256971 00000 n +0000256410 00000 n +0000254086 00000 n +0000256533 00000 n +0000256658 00000 n +0000256783 00000 n +0000256908 00000 n +0000260597 00000 n +0000259787 00000 n +0000257084 00000 n +0000259910 00000 n +0000260035 00000 n +0000260160 00000 n +0000260285 00000 n +0000260410 00000 n +0000260535 00000 n +0000263930 00000 n +0000263245 00000 n +0000260710 00000 n +0000263368 00000 n +0000263493 00000 n +0000263618 00000 n +0000263743 00000 n +0000263868 00000 n +0000458014 00000 n +0000267934 00000 n +0000267248 00000 n +0000264043 00000 n +0000267371 00000 n +0000267621 00000 n +0000267746 00000 n +0000267871 00000 n +0000271760 00000 n +0000271072 00000 n +0000268046 00000 n +0000271195 00000 n +0000271258 00000 n +0000271321 00000 n +0000271384 00000 n +0000271447 00000 n +0000271510 00000 n +0000271573 00000 n +0000271635 00000 n +0000271698 00000 n +0000275351 00000 n +0000274915 00000 n +0000271873 00000 n +0000275038 00000 n +0000275163 00000 n +0000275288 00000 n +0000279613 00000 n +0000279427 00000 n +0000275477 00000 n +0000279550 00000 n +0000280717 00000 n +0000280531 00000 n +0000279726 00000 n +0000280654 00000 n +0000283457 00000 n +0000283021 00000 n +0000280817 00000 n +0000283144 00000 n +0000283394 00000 n +0000458139 00000 n +0000287518 00000 n +0000287082 00000 n +0000283556 00000 n +0000287205 00000 n +0000287455 00000 n +0000292048 00000 n +0000291241 00000 n +0000287617 00000 n +0000291364 00000 n +0000291489 00000 n +0000291613 00000 n +0000291737 00000 n +0000291860 00000 n +0000291985 00000 n +0000296277 00000 n +0000295467 00000 n +0000292161 00000 n +0000295590 00000 n +0000295715 00000 n +0000295840 00000 n +0000295965 00000 n +0000296090 00000 n +0000296214 00000 n +0000298601 00000 n +0000298290 00000 n +0000296390 00000 n +0000298413 00000 n +0000298538 00000 n +0000302537 00000 n +0000301977 00000 n +0000298727 00000 n +0000302100 00000 n +0000302350 00000 n +0000302474 00000 n +0000306367 00000 n +0000305995 00000 n +0000302636 00000 n +0000306118 00000 n +0000306243 00000 n +0000306305 00000 n +0000458264 00000 n +0000308094 00000 n +0000307908 00000 n +0000306519 00000 n +0000308031 00000 n +0000311633 00000 n +0000310822 00000 n +0000308220 00000 n +0000310945 00000 n +0000311195 00000 n +0000311320 00000 n +0000311445 00000 n +0000311570 00000 n +0000315131 00000 n +0000314695 00000 n +0000311732 00000 n +0000314818 00000 n +0000314943 00000 n +0000315068 00000 n +0000318411 00000 n +0000317850 00000 n +0000315257 00000 n +0000317973 00000 n +0000318223 00000 n +0000318348 00000 n +0000320399 00000 n +0000319838 00000 n +0000318536 00000 n +0000319961 00000 n +0000320211 00000 n +0000320336 00000 n +0000321770 00000 n +0000321584 00000 n +0000320498 00000 n +0000321707 00000 n +0000458389 00000 n +0000324876 00000 n +0000324315 00000 n +0000321883 00000 n +0000324438 00000 n +0000324563 00000 n +0000324688 00000 n +0000324813 00000 n +0000327728 00000 n +0000327417 00000 n +0000325002 00000 n +0000327540 00000 n +0000327665 00000 n +0000330506 00000 n +0000330320 00000 n +0000327854 00000 n +0000330443 00000 n +0000332014 00000 n +0000331828 00000 n +0000330632 00000 n +0000331951 00000 n +0000335490 00000 n +0000334739 00000 n +0000332114 00000 n +0000334862 00000 n +0000334987 00000 n +0000335112 00000 n +0000335175 00000 n +0000335238 00000 n +0000335301 00000 n +0000335364 00000 n +0000335427 00000 n +0000337031 00000 n +0000336720 00000 n +0000335616 00000 n +0000336843 00000 n +0000336906 00000 n +0000336969 00000 n +0000458514 00000 n +0000340490 00000 n +0000339944 00000 n +0000337144 00000 n +0000340239 00000 n +0000340302 00000 n +0000340365 00000 n +0000340088 00000 n +0000340428 00000 n +0000341831 00000 n +0000341645 00000 n +0000340603 00000 n +0000341768 00000 n +0000344033 00000 n +0000343721 00000 n +0000341931 00000 n +0000343844 00000 n +0000343907 00000 n +0000343970 00000 n +0000346124 00000 n +0000345563 00000 n +0000344133 00000 n +0000345686 00000 n +0000345811 00000 n +0000345936 00000 n +0000346061 00000 n +0000347945 00000 n +0000347384 00000 n +0000346237 00000 n +0000347507 00000 n +0000347757 00000 n +0000347882 00000 n +0000352037 00000 n +0000351339 00000 n +0000348044 00000 n +0000351849 00000 n +0000351492 00000 n +0000351668 00000 n +0000458639 00000 n +0000352123 00000 n +0000355205 00000 n +0000355230 00000 n +0000365690 00000 n +0000368173 00000 n +0000368204 00000 n +0000371597 00000 n +0000381801 00000 n +0000382076 00000 n +0000399833 00000 n +0000419130 00000 n +0000419559 00000 n +0000437152 00000 n +0000442576 00000 n +0000456493 00000 n +0000458719 00000 n +0000458844 00000 n +0000458970 00000 n +0000459069 00000 n +0000459151 00000 n +0000481181 00000 n +0000496580 00000 n +0000496621 00000 n +0000496661 00000 n +0000496892 00000 n trailer << -/Size 1806 -/Root 1804 0 R -/Info 1805 0 R +/Size 1983 +/Root 1981 0 R +/Info 1982 0 R >> startxref -424621 +497048 %%EOF diff --git a/docs/Samba-HOWTO-Collection.pdf b/docs/Samba-HOWTO-Collection.pdf index 9798599637..5c604b7003 100644 --- a/docs/Samba-HOWTO-Collection.pdf +++ b/docs/Samba-HOWTO-Collection.pdf @@ -39,17868 +39,35213 @@ endobj << /S /GoTo /D (section.1.5) >> endobj 32 0 obj -(1.5 Additional Resources) +(1.5 Epilogue) endobj 33 0 obj << /S /GoTo /D (section.1.6) >> endobj 36 0 obj -(1.6 Epilogue) +(1.6 Miscellaneous) endobj 37 0 obj -<< /S /GoTo /D (section.1.7) >> +<< /S /GoTo /D (chapter.2) >> endobj 40 0 obj -(1.7 Miscellaneous) +(2 How to Install and Test SAMBA) endobj 41 0 obj -<< /S /GoTo /D (chapter.2) >> +<< /S /GoTo /D (section.2.1) >> endobj 44 0 obj -(2 How to Install and Test SAMBA) +(2.1 Obtaining and installing samba) endobj 45 0 obj -<< /S /GoTo /D (section.2.1) >> +<< /S /GoTo /D (section.2.2) >> endobj 48 0 obj -(2.1 Obtaining and installing samba) +(2.2 Configuring samba \(smb.conf\)) endobj 49 0 obj -<< /S /GoTo /D (section.2.2) >> +<< /S /GoTo /D (subsection.2.2.1) >> endobj 52 0 obj -(2.2 Configuring samba) +(2.2.1 Example Configuration) endobj 53 0 obj -<< /S /GoTo /D (subsection.2.2.1) >> +<< /S /GoTo /D (subsubsection.2.2.1.1) >> endobj 56 0 obj -(2.2.1 Editing the smb.conf file) +(2.2.1.1 Test your config file with testparm) endobj 57 0 obj -<< /S /GoTo /D (subsubsection.2.2.1.1) >> +<< /S /GoTo /D (subsection.2.2.2) >> endobj 60 0 obj -(2.2.1.1 Test your config file with testparm) +(2.2.2 SWAT) endobj 61 0 obj -<< /S /GoTo /D (subsection.2.2.2) >> +<< /S /GoTo /D (section.2.3) >> endobj 64 0 obj -(2.2.2 SWAT) +(2.3 Try listing the shares available on your server) endobj 65 0 obj -<< /S /GoTo /D (section.2.3) >> +<< /S /GoTo /D (section.2.4) >> endobj 68 0 obj -(2.3 Try listing the shares available on your server) +(2.4 Try connecting with the unix client) endobj 69 0 obj -<< /S /GoTo /D (section.2.4) >> +<< /S /GoTo /D (section.2.5) >> endobj 72 0 obj -(2.4 Try connecting with the unix client) +(2.5 Try connecting from a DOS, WfWg, Win9x, WinNT, Win2k, OS/2, etc... client) endobj 73 0 obj -<< /S /GoTo /D (section.2.5) >> +<< /S /GoTo /D (section.2.6) >> endobj 76 0 obj -(2.5 Try connecting from a DOS, WfWg, Win9x, WinNT, Win2k, OS/2, etc... client) +(2.6 What If Things Don't Work?) endobj 77 0 obj -<< /S /GoTo /D (section.2.6) >> +<< /S /GoTo /D (section.2.7) >> endobj 80 0 obj -(2.6 What If Things Don't Work?) +(2.7 Common Errors) endobj 81 0 obj -<< /S /GoTo /D (part.2) >> +<< /S /GoTo /D (subsection.2.7.1) >> endobj 84 0 obj -(II Server Configuration Basics) +(2.7.1 Why are so many smbd processes eating memory?) endobj 85 0 obj -<< /S /GoTo /D (chapter.3) >> +<< /S /GoTo /D (subsection.2.7.2) >> endobj 88 0 obj -(3 Nomenclature of Server Types) +(2.7.2 I'm getting "open\137oplock\137ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs) endobj 89 0 obj -<< /S /GoTo /D (section.3.1) >> +<< /S /GoTo /D (chapter.3) >> endobj 92 0 obj -(3.1 Stand Alone Server) +(3 Fast Start for the Impatient) endobj 93 0 obj -<< /S /GoTo /D (section.3.2) >> +<< /S /GoTo /D (section.3.1) >> endobj 96 0 obj -(3.2 Domain Member Server) +(3.1 Note) endobj 97 0 obj -<< /S /GoTo /D (section.3.3) >> +<< /S /GoTo /D (part.2) >> endobj 100 0 obj -(3.3 Domain Controller) +(II Server Configuration Basics) endobj 101 0 obj -<< /S /GoTo /D (subsection.3.3.1) >> +<< /S /GoTo /D (chapter.4) >> endobj 104 0 obj -(3.3.1 Domain Controller Types) +(4 Server Types and Security Modes) endobj 105 0 obj -<< /S /GoTo /D (chapter.4) >> +<< /S /GoTo /D (section.4.1) >> endobj 108 0 obj -(4 Samba as Stand-Alone Server) +(4.1 Features and Benefits) endobj 109 0 obj -<< /S /GoTo /D (section.4.1) >> +<< /S /GoTo /D (section.4.2) >> endobj 112 0 obj -(4.1 User and Share security level) +(4.2 Server Types) endobj 113 0 obj -<< /S /GoTo /D (subsection.4.1.1) >> +<< /S /GoTo /D (section.4.3) >> endobj 116 0 obj -(4.1.1 User Level Security) +(4.3 Samba Security Modes) endobj 117 0 obj -<< /S /GoTo /D (subsection.4.1.2) >> +<< /S /GoTo /D (subsection.4.3.1) >> endobj 120 0 obj -(4.1.2 Share Level Security) +(4.3.1 User Level Security) endobj 121 0 obj -<< /S /GoTo /D (subsection.4.1.3) >> +<< /S /GoTo /D (subsubsection.4.3.1.1) >> endobj 124 0 obj -(4.1.3 Server Level Security) +(4.3.1.1 Example Configuration) endobj 125 0 obj -<< /S /GoTo /D (subsubsection.4.1.3.1) >> +<< /S /GoTo /D (subsection.4.3.2) >> endobj 128 0 obj -(4.1.3.1 Configuring Samba for Seemless Windows Network Integration) +(4.3.2 Share Level Security) endobj 129 0 obj -<< /S /GoTo /D (subsubsection.4.1.3.2) >> +<< /S /GoTo /D (subsubsection.4.3.2.1) >> endobj 132 0 obj -(4.1.3.2 Use MS Windows NT as an authentication server) +(4.3.2.1 Example Configuration) endobj 133 0 obj -<< /S /GoTo /D (subsection.4.1.4) >> +<< /S /GoTo /D (subsection.4.3.3) >> endobj 136 0 obj -(4.1.4 Domain Level Security) +(4.3.3 Domain Security Mode \(User Level Security\)) endobj 137 0 obj -<< /S /GoTo /D (subsubsection.4.1.4.1) >> +<< /S /GoTo /D (subsubsection.4.3.3.1) >> endobj 140 0 obj -(4.1.4.1 Samba as a member of an MS Windows NT security domain) +(4.3.3.1 Example Configuration) endobj 141 0 obj -<< /S /GoTo /D (subsection.4.1.5) >> +<< /S /GoTo /D (subsection.4.3.4) >> endobj 144 0 obj -(4.1.5 ADS Level Security) +(4.3.4 ADS Security Mode \(User Level Security\)) endobj 145 0 obj -<< /S /GoTo /D (chapter.5) >> +<< /S /GoTo /D (subsubsection.4.3.4.1) >> endobj 148 0 obj -(5 Samba as an NT4 or Win2k Primary Domain Controller) +(4.3.4.1 Example Configuration) endobj 149 0 obj -<< /S /GoTo /D (section.5.1) >> +<< /S /GoTo /D (subsection.4.3.5) >> endobj 152 0 obj -(5.1 Prerequisite Reading) +(4.3.5 Server Security \(User Level Security\)) endobj 153 0 obj -<< /S /GoTo /D (section.5.2) >> +<< /S /GoTo /D (subsubsection.4.3.5.1) >> endobj 156 0 obj -(5.2 Background) +(4.3.5.1 Example Configuration) endobj 157 0 obj -<< /S /GoTo /D (section.5.3) >> +<< /S /GoTo /D (section.4.4) >> endobj 160 0 obj -(5.3 Configuring the Samba Domain Controller) +(4.4 Seamless Windows Network Integration) endobj 161 0 obj -<< /S /GoTo /D (section.5.4) >> +<< /S /GoTo /D (section.4.5) >> endobj 164 0 obj -(5.4 Creating Machine Trust Accounts and Joining Clients to the Domain) +(4.5 Common Errors) endobj 165 0 obj -<< /S /GoTo /D (subsection.5.4.1) >> +<< /S /GoTo /D (subsection.4.5.1) >> endobj 168 0 obj -(5.4.1 Manual Creation of Machine Trust Accounts) +(4.5.1 What makes Samba a SERVER?) endobj 169 0 obj -<< /S /GoTo /D (subsection.5.4.2) >> +<< /S /GoTo /D (subsection.4.5.2) >> endobj 172 0 obj -(5.4.2 "On-the-Fly" Creation of Machine Trust Accounts) +(4.5.2 What makes Samba a Domain Controller?) endobj 173 0 obj -<< /S /GoTo /D (subsection.5.4.3) >> +<< /S /GoTo /D (subsection.4.5.3) >> endobj 176 0 obj -(5.4.3 Joining the Client to the Domain) +(4.5.3 What makes Samba a Domain Member?) endobj 177 0 obj -<< /S /GoTo /D (section.5.5) >> +<< /S /GoTo /D (subsection.4.5.4) >> endobj 180 0 obj -(5.5 Common Problems and Errors) +(4.5.4 Constantly Losing Connections to Password Server) endobj 181 0 obj -<< /S /GoTo /D (subsection.5.5.1) >> +<< /S /GoTo /D (chapter.5) >> endobj 184 0 obj -(5.5.1 I cannot include a '\044' in a machine name) +(5 Domain Control) endobj 185 0 obj -<< /S /GoTo /D (subsection.5.5.2) >> +<< /S /GoTo /D (section.5.1) >> endobj 188 0 obj -(5.5.2 I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an existing set.." when creating a machine trust account.) +(5.1 Features and Benefits) endobj 189 0 obj -<< /S /GoTo /D (subsection.5.5.3) >> +<< /S /GoTo /D (section.5.2) >> endobj 192 0 obj -(5.5.3 The system can not log you on \(C000019B\)....) +(5.2 Basics of Domain Control) endobj 193 0 obj -<< /S /GoTo /D (subsection.5.5.4) >> +<< /S /GoTo /D (subsection.5.2.1) >> endobj 196 0 obj -(5.5.4 The machine trust account for this computer either does not exist or is not accessible.) +(5.2.1 Domain Controller Types) endobj 197 0 obj -<< /S /GoTo /D (subsection.5.5.5) >> +<< /S /GoTo /D (subsection.5.2.2) >> endobj 200 0 obj -(5.5.5 When I attempt to login to a Samba Domain from a NT4/W2K workstation, I get a message about my account being disabled.) +(5.2.2 Preparing for Domain Control) endobj 201 0 obj -<< /S /GoTo /D (section.5.6) >> +<< /S /GoTo /D (section.5.3) >> endobj 204 0 obj -(5.6 Domain Control for Windows 9x/ME) +(5.3 Domain Control - Example Configuration) endobj 205 0 obj -<< /S /GoTo /D (subsection.5.6.1) >> +<< /S /GoTo /D (section.5.4) >> endobj 208 0 obj -(5.6.1 Configuration Instructions: Network Logons) +(5.4 Samba ADS Domain Control) endobj 209 0 obj -<< /S /GoTo /D (chapter.6) >> +<< /S /GoTo /D (section.5.5) >> endobj 212 0 obj -(6 Samba Backup Domain Controller to Samba Domain Control) +(5.5 Domain and Network Logon Configuration) endobj 213 0 obj -<< /S /GoTo /D (section.6.1) >> +<< /S /GoTo /D (subsection.5.5.1) >> endobj 216 0 obj -(6.1 Prerequisite Reading) +(5.5.1 Domain Network Logon Service) endobj 217 0 obj -<< /S /GoTo /D (section.6.2) >> +<< /S /GoTo /D (subsubsection.5.5.1.1) >> endobj 220 0 obj -(6.2 Background) +(5.5.1.1 Example Configuration) endobj 221 0 obj -<< /S /GoTo /D (section.6.3) >> +<< /S /GoTo /D (subsubsection.5.5.1.2) >> endobj 224 0 obj -(6.3 What qualifies a Domain Controller on the network?) +(5.5.1.2 The Special Case of MS Windows XP Home Edition) endobj 225 0 obj -<< /S /GoTo /D (subsection.6.3.1) >> +<< /S /GoTo /D (subsubsection.5.5.1.3) >> endobj 228 0 obj -(6.3.1 How does a Workstation find its domain controller?) +(5.5.1.3 The Special Case of Windows 9x / Me) endobj 229 0 obj -<< /S /GoTo /D (subsection.6.3.2) >> +<< /S /GoTo /D (subsection.5.5.2) >> endobj 232 0 obj -(6.3.2 When is the PDC needed?) +(5.5.2 Security Mode and Master Browsers) endobj 233 0 obj -<< /S /GoTo /D (section.6.4) >> +<< /S /GoTo /D (section.5.6) >> endobj 236 0 obj -(6.4 Can Samba be a Backup Domain Controller to an NT PDC?) +(5.6 Common Problems and Errors) endobj 237 0 obj -<< /S /GoTo /D (section.6.5) >> +<< /S /GoTo /D (subsection.5.6.1) >> endobj 240 0 obj -(6.5 How do I set up a Samba BDC?) +(5.6.1 I cannot include a '\044' in a machine name) endobj 241 0 obj -<< /S /GoTo /D (subsection.6.5.1) >> +<< /S /GoTo /D (subsection.5.6.2) >> endobj 244 0 obj -(6.5.1 How do I replicate the smbpasswd file?) +(5.6.2 I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an existing set.." when creating a machine trust account.) endobj 245 0 obj -<< /S /GoTo /D (subsection.6.5.2) >> +<< /S /GoTo /D (subsection.5.6.3) >> endobj 248 0 obj -(6.5.2 Can I do this all with LDAP?) +(5.6.3 The system can not log you on \(C000019B\)....) endobj 249 0 obj -<< /S /GoTo /D (chapter.7) >> +<< /S /GoTo /D (subsection.5.6.4) >> endobj 252 0 obj -(7 Samba as a ADS domain member) +(5.6.4 The machine trust account for this computer either does not exist or is not accessible.) endobj 253 0 obj -<< /S /GoTo /D (section.7.1) >> +<< /S /GoTo /D (subsection.5.6.5) >> endobj 256 0 obj -(7.1 Setup your smb.conf) +(5.6.5 When I attempt to login to a Samba Domain from a NT4/W2K workstation, I get a message about my account being disabled.) endobj 257 0 obj -<< /S /GoTo /D (section.7.2) >> +<< /S /GoTo /D (subsection.5.6.6) >> endobj 260 0 obj -(7.2 Setup your /etc/krb5.conf) +(5.6.6 Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable") endobj 261 0 obj -<< /S /GoTo /D (section.7.3) >> +<< /S /GoTo /D (chapter.6) >> endobj 264 0 obj -(7.3 Create the computer account) +(6 Backup Domain Control) endobj 265 0 obj -<< /S /GoTo /D (subsection.7.3.1) >> +<< /S /GoTo /D (section.6.1) >> endobj 268 0 obj -(7.3.1 Possible errors) +(6.1 Features And Benefits) endobj 269 0 obj -<< /S /GoTo /D (section.7.4) >> +<< /S /GoTo /D (section.6.2) >> endobj 272 0 obj -(7.4 Test your server setup) +(6.2 Essential Background Information) endobj 273 0 obj -<< /S /GoTo /D (section.7.5) >> +<< /S /GoTo /D (subsection.6.2.1) >> endobj 276 0 obj -(7.5 Testing with smbclient) +(6.2.1 MS Windows NT4 Style Domain Control) endobj 277 0 obj -<< /S /GoTo /D (section.7.6) >> +<< /S /GoTo /D (subsubsection.6.2.1.1) >> endobj 280 0 obj -(7.6 Notes) +(6.2.1.1 Example PDC Configuration) endobj 281 0 obj -<< /S /GoTo /D (chapter.8) >> +<< /S /GoTo /D (subsection.6.2.2) >> endobj 284 0 obj -(8 Samba as a NT4 or Win2k domain member) +(6.2.2 Active Directory Domain Control) endobj 285 0 obj -<< /S /GoTo /D (section.8.1) >> +<< /S /GoTo /D (subsection.6.2.3) >> endobj 288 0 obj -(8.1 Joining an NT Domain with Samba 3.0) +(6.2.3 What qualifies a Domain Controller on the network?) endobj 289 0 obj -<< /S /GoTo /D (section.8.2) >> +<< /S /GoTo /D (subsection.6.2.4) >> endobj 292 0 obj -(8.2 Why is this better than security = server?) +(6.2.4 How does a Workstation find its domain controller?) endobj 293 0 obj -<< /S /GoTo /D (part.3) >> +<< /S /GoTo /D (section.6.3) >> endobj 296 0 obj -(III Advanced Configuration) +(6.3 Backup Domain Controller Configuration) endobj 297 0 obj -<< /S /GoTo /D (chapter.9) >> +<< /S /GoTo /D (subsection.6.3.1) >> endobj 300 0 obj -(9 Samba / MS Windows Network Browsing Guide) +(6.3.1 Example Configuration) endobj 301 0 obj -<< /S /GoTo /D (section.9.1) >> +<< /S /GoTo /D (section.6.4) >> endobj 304 0 obj -(9.1 What is Browsing?) +(6.4 Common Errors) endobj 305 0 obj -<< /S /GoTo /D (section.9.2) >> +<< /S /GoTo /D (subsection.6.4.1) >> endobj 308 0 obj -(9.2 Discussion) +(6.4.1 Machine Accounts keep expiring, what can I do?) endobj 309 0 obj -<< /S /GoTo /D (section.9.3) >> +<< /S /GoTo /D (subsection.6.4.2) >> endobj 312 0 obj -(9.3 How Browsing Functions) +(6.4.2 Can Samba be a Backup Domain Controller to an NT4 PDC?) endobj 313 0 obj -<< /S /GoTo /D (subsection.9.3.1) >> +<< /S /GoTo /D (subsection.6.4.3) >> endobj 316 0 obj -(9.3.1 Setting up WORKGROUP Browsing) +(6.4.3 How do I replicate the smbpasswd file?) endobj 317 0 obj -<< /S /GoTo /D (subsection.9.3.2) >> +<< /S /GoTo /D (subsection.6.4.4) >> endobj 320 0 obj -(9.3.2 Setting up DOMAIN Browsing) +(6.4.4 Can I do this all with LDAP?) endobj 321 0 obj -<< /S /GoTo /D (subsection.9.3.3) >> +<< /S /GoTo /D (chapter.7) >> endobj 324 0 obj -(9.3.3 Forcing samba to be the master) +(7 Domain Membership) endobj 325 0 obj -<< /S /GoTo /D (subsection.9.3.4) >> +<< /S /GoTo /D (section.7.1) >> endobj 328 0 obj -(9.3.4 Making samba the domain master) +(7.1 Features and Benefits) endobj 329 0 obj -<< /S /GoTo /D (subsection.9.3.5) >> +<< /S /GoTo /D (section.7.2) >> endobj 332 0 obj -(9.3.5 Note about broadcast addresses) +(7.2 MS Windows Workstation/Server Machine Trust Accounts) endobj 333 0 obj -<< /S /GoTo /D (subsection.9.3.6) >> +<< /S /GoTo /D (subsection.7.2.1) >> endobj 336 0 obj -(9.3.6 Multiple interfaces) +(7.2.1 Manual Creation of Machine Trust Accounts) endobj 337 0 obj -<< /S /GoTo /D (subsection.9.3.7) >> +<< /S /GoTo /D (subsection.7.2.2) >> endobj 340 0 obj -(9.3.7 Use of the Remote Announce parameter) +(7.2.2 Using NT4 Server Manager to Add Machine Accounts to the Domain) endobj 341 0 obj -<< /S /GoTo /D (subsection.9.3.8) >> +<< /S /GoTo /D (subsection.7.2.3) >> endobj 344 0 obj -(9.3.8 Use of the Remote Browse Sync parameter) +(7.2.3 "On-the-Fly" Creation of Machine Trust Accounts) endobj 345 0 obj -<< /S /GoTo /D (section.9.4) >> +<< /S /GoTo /D (subsection.7.2.4) >> endobj 348 0 obj -(9.4 WINS - The Windows Internetworking Name Server) +(7.2.4 Making an MS Windows Workstation or Server a Domain Member) endobj 349 0 obj -<< /S /GoTo /D (subsection.9.4.1) >> +<< /S /GoTo /D (subsubsection.7.2.4.1) >> endobj 352 0 obj -(9.4.1 Setting up a WINS server) +(7.2.4.1 Windows 200x XP Professional) endobj 353 0 obj -<< /S /GoTo /D (subsection.9.4.2) >> +<< /S /GoTo /D (subsubsection.7.2.4.2) >> endobj 356 0 obj -(9.4.2 WINS Replication) +(7.2.4.2 Windows NT4) endobj 357 0 obj -<< /S /GoTo /D (subsection.9.4.3) >> +<< /S /GoTo /D (subsubsection.7.2.4.3) >> endobj 360 0 obj -(9.4.3 Static WINS Entries) +(7.2.4.3 Samba) endobj 361 0 obj -<< /S /GoTo /D (section.9.5) >> +<< /S /GoTo /D (section.7.3) >> endobj 364 0 obj -(9.5 Helpful Hints) +(7.3 Domain Member Server) endobj 365 0 obj -<< /S /GoTo /D (subsection.9.5.1) >> +<< /S /GoTo /D (subsection.7.3.1) >> endobj 368 0 obj -(9.5.1 Windows Networking Protocols) +(7.3.1 Joining an NT4 type Domain with Samba-3) endobj 369 0 obj -<< /S /GoTo /D (subsection.9.5.2) >> +<< /S /GoTo /D (subsection.7.3.2) >> endobj 372 0 obj -(9.5.2 Name Resolution Order) +(7.3.2 Why is this better than security = server?) endobj 373 0 obj -<< /S /GoTo /D (section.9.6) >> +<< /S /GoTo /D (section.7.4) >> endobj 376 0 obj -(9.6 Technical Overview of browsing) +(7.4 Samba ADS Domain Membership) endobj 377 0 obj -<< /S /GoTo /D (subsection.9.6.1) >> +<< /S /GoTo /D (subsection.7.4.1) >> endobj 380 0 obj -(9.6.1 Browsing support in samba) +(7.4.1 Setup your smb.conf) endobj 381 0 obj -<< /S /GoTo /D (subsection.9.6.2) >> +<< /S /GoTo /D (subsection.7.4.2) >> endobj 384 0 obj -(9.6.2 Problem resolution) +(7.4.2 Setup your /etc/krb5.conf) endobj 385 0 obj -<< /S /GoTo /D (subsection.9.6.3) >> +<< /S /GoTo /D (subsection.7.4.3) >> endobj 388 0 obj -(9.6.3 Browsing across subnets) +(7.4.3 Create the computer account) endobj 389 0 obj -<< /S /GoTo /D (subsubsection.9.6.3.1) >> +<< /S /GoTo /D (subsubsection.7.4.3.1) >> endobj 392 0 obj -(9.6.3.1 How does cross subnet browsing work ?) +(7.4.3.1 Possible errors) endobj 393 0 obj -<< /S /GoTo /D (chapter.10) >> +<< /S /GoTo /D (subsection.7.4.4) >> endobj 396 0 obj -(10 User information database) +(7.4.4 Test your server setup) endobj 397 0 obj -<< /S /GoTo /D (section.10.1) >> +<< /S /GoTo /D (subsection.7.4.5) >> endobj 400 0 obj -(10.1 Introduction) +(7.4.5 Testing with smbclient) endobj 401 0 obj -<< /S /GoTo /D (section.10.2) >> +<< /S /GoTo /D (subsection.7.4.6) >> endobj 404 0 obj -(10.2 Important Notes About Security) +(7.4.6 Notes) endobj 405 0 obj -<< /S /GoTo /D (subsection.10.2.1) >> +<< /S /GoTo /D (section.7.5) >> endobj 408 0 obj -(10.2.1 Advantages of SMB Encryption) +(7.5 Common Errors) endobj 409 0 obj -<< /S /GoTo /D (subsection.10.2.2) >> +<< /S /GoTo /D (subsection.7.5.1) >> endobj 412 0 obj -(10.2.2 Advantages of non-encrypted passwords) +(7.5.1 Can Not Add Machine Back to Domain) endobj 413 0 obj -<< /S /GoTo /D (section.10.3) >> +<< /S /GoTo /D (subsection.7.5.2) >> endobj 416 0 obj -(10.3 The smbpasswd Command) +(7.5.2 Adding Machine to Domain Fails) endobj 417 0 obj -<< /S /GoTo /D (section.10.4) >> +<< /S /GoTo /D (chapter.8) >> endobj 420 0 obj -(10.4 Plain text) +(8 Stand-Alone Servers) endobj 421 0 obj -<< /S /GoTo /D (section.10.5) >> +<< /S /GoTo /D (section.8.1) >> endobj 424 0 obj -(10.5 TDB) +(8.1 Features and Benefits) endobj 425 0 obj -<< /S /GoTo /D (section.10.6) >> +<< /S /GoTo /D (section.8.2) >> endobj 428 0 obj -(10.6 LDAP) +(8.2 Background) endobj 429 0 obj -<< /S /GoTo /D (subsection.10.6.1) >> +<< /S /GoTo /D (section.8.3) >> endobj 432 0 obj -(10.6.1 Introduction) +(8.3 Example Configuration) endobj 433 0 obj -<< /S /GoTo /D (subsection.10.6.2) >> +<< /S /GoTo /D (subsection.8.3.1) >> endobj 436 0 obj -(10.6.2 Encrypted Password Database) +(8.3.1 Reference Documentation Server) endobj 437 0 obj -<< /S /GoTo /D (subsection.10.6.3) >> +<< /S /GoTo /D (subsection.8.3.2) >> endobj 440 0 obj -(10.6.3 Supported LDAP Servers) +(8.3.2 Central Print Serving) endobj 441 0 obj -<< /S /GoTo /D (subsection.10.6.4) >> +<< /S /GoTo /D (section.8.4) >> endobj 444 0 obj -(10.6.4 Schema and Relationship to the RFC 2307 posixAccount) +(8.4 Common Errors) endobj 445 0 obj -<< /S /GoTo /D (subsection.10.6.5) >> +<< /S /GoTo /D (chapter.9) >> endobj 448 0 obj -(10.6.5 Configuring Samba with LDAP) +(9 MS Windows Network Configuration Guide) endobj 449 0 obj -<< /S /GoTo /D (subsubsection.10.6.5.1) >> +<< /S /GoTo /D (section.9.1) >> endobj 452 0 obj -(10.6.5.1 OpenLDAP configuration) +(9.1 Note) endobj 453 0 obj -<< /S /GoTo /D (subsubsection.10.6.5.2) >> +<< /S /GoTo /D (part.3) >> endobj 456 0 obj -(10.6.5.2 Configuring Samba) +(III Advanced Configuration) endobj 457 0 obj -<< /S /GoTo /D (subsection.10.6.6) >> +<< /S /GoTo /D (chapter.10) >> endobj 460 0 obj -(10.6.6 Accounts and Groups management) +(10 Samba / MS Windows Network Browsing Guide) endobj 461 0 obj -<< /S /GoTo /D (subsection.10.6.7) >> +<< /S /GoTo /D (section.10.1) >> endobj 464 0 obj -(10.6.7 Security and sambaAccount) +(10.1 Features and Benefits) endobj 465 0 obj -<< /S /GoTo /D (subsection.10.6.8) >> +<< /S /GoTo /D (section.10.2) >> endobj 468 0 obj -(10.6.8 LDAP specials attributes for sambaAccounts) +(10.2 What is Browsing?) endobj 469 0 obj -<< /S /GoTo /D (subsection.10.6.9) >> +<< /S /GoTo /D (section.10.3) >> endobj 472 0 obj -(10.6.9 Example LDIF Entries for a sambaAccount) +(10.3 Discussion) endobj 473 0 obj -<< /S /GoTo /D (section.10.7) >> +<< /S /GoTo /D (subsection.10.3.1) >> endobj 476 0 obj -(10.7 MySQL) +(10.3.1 NetBIOS over TCP/IP) endobj 477 0 obj -<< /S /GoTo /D (subsection.10.7.1) >> +<< /S /GoTo /D (subsection.10.3.2) >> endobj 480 0 obj -(10.7.1 Creating the database) +(10.3.2 TCP/IP - without NetBIOS) endobj 481 0 obj -<< /S /GoTo /D (subsection.10.7.2) >> +<< /S /GoTo /D (subsection.10.3.3) >> endobj 484 0 obj -(10.7.2 Configuring) +(10.3.3 DNS and Active Directory) endobj 485 0 obj -<< /S /GoTo /D (subsection.10.7.3) >> +<< /S /GoTo /D (section.10.4) >> endobj 488 0 obj -(10.7.3 Using plaintext passwords or encrypted password) +(10.4 How Browsing Functions) endobj 489 0 obj -<< /S /GoTo /D (subsection.10.7.4) >> +<< /S /GoTo /D (subsection.10.4.1) >> endobj 492 0 obj -(10.7.4 Getting non-column data from the table) +(10.4.1 Setting up WORKGROUP Browsing) endobj 493 0 obj -<< /S /GoTo /D (section.10.8) >> +<< /S /GoTo /D (subsection.10.4.2) >> endobj 496 0 obj -(10.8 XML) +(10.4.2 Setting up DOMAIN Browsing) endobj 497 0 obj -<< /S /GoTo /D (chapter.11) >> +<< /S /GoTo /D (subsection.10.4.3) >> endobj 500 0 obj -(11 UNIX Permission Bits and Windows NT Access Control Lists) +(10.4.3 Forcing Samba to be the master) endobj 501 0 obj -<< /S /GoTo /D (section.11.1) >> +<< /S /GoTo /D (subsection.10.4.4) >> endobj 504 0 obj -(11.1 Viewing and changing UNIX permissions using the NT security dialogs) +(10.4.4 Making Samba the domain master) endobj 505 0 obj -<< /S /GoTo /D (section.11.2) >> +<< /S /GoTo /D (subsection.10.4.5) >> endobj 508 0 obj -(11.2 How to view file security on a Samba share) +(10.4.5 Note about broadcast addresses) endobj 509 0 obj -<< /S /GoTo /D (section.11.3) >> +<< /S /GoTo /D (subsection.10.4.6) >> endobj 512 0 obj -(11.3 Viewing file ownership) +(10.4.6 Multiple interfaces) endobj 513 0 obj -<< /S /GoTo /D (section.11.4) >> +<< /S /GoTo /D (subsection.10.4.7) >> endobj 516 0 obj -(11.4 Viewing file or directory permissions) +(10.4.7 Use of the Remote Announce parameter) endobj 517 0 obj -<< /S /GoTo /D (subsection.11.4.1) >> +<< /S /GoTo /D (subsection.10.4.8) >> endobj 520 0 obj -(11.4.1 File Permissions) +(10.4.8 Use of the Remote Browse Sync parameter) endobj 521 0 obj -<< /S /GoTo /D (subsection.11.4.2) >> +<< /S /GoTo /D (section.10.5) >> endobj 524 0 obj -(11.4.2 Directory Permissions) +(10.5 WINS - The Windows Internetworking Name Server) endobj 525 0 obj -<< /S /GoTo /D (section.11.5) >> +<< /S /GoTo /D (subsection.10.5.1) >> endobj 528 0 obj -(11.5 Modifying file or directory permissions) +(10.5.1 Setting up a WINS server) endobj 529 0 obj -<< /S /GoTo /D (section.11.6) >> +<< /S /GoTo /D (subsection.10.5.2) >> endobj 532 0 obj -(11.6 Interaction with the standard Samba create mask parameters) +(10.5.2 WINS Replication) endobj 533 0 obj -<< /S /GoTo /D (section.11.7) >> +<< /S /GoTo /D (subsection.10.5.3) >> endobj 536 0 obj -(11.7 Interaction with the standard Samba file attribute mapping) +(10.5.3 Static WINS Entries) endobj 537 0 obj -<< /S /GoTo /D (chapter.12) >> +<< /S /GoTo /D (section.10.6) >> endobj 540 0 obj -(12 Configuring Group Mapping) +(10.6 Helpful Hints) endobj 541 0 obj -<< /S /GoTo /D (chapter.13) >> +<< /S /GoTo /D (subsection.10.6.1) >> endobj 544 0 obj -(13 Printing Support) +(10.6.1 Windows Networking Protocols) endobj 545 0 obj -<< /S /GoTo /D (section.13.1) >> +<< /S /GoTo /D (subsection.10.6.2) >> endobj 548 0 obj -(13.1 Introduction) +(10.6.2 Name Resolution Order) endobj 549 0 obj -<< /S /GoTo /D (section.13.2) >> +<< /S /GoTo /D (section.10.7) >> endobj 552 0 obj -(13.2 Configuration) +(10.7 Technical Overview of browsing) endobj 553 0 obj -<< /S /GoTo /D (subsection.13.2.1) >> +<< /S /GoTo /D (subsection.10.7.1) >> endobj 556 0 obj -(13.2.1 Creating [print\044]) +(10.7.1 Browsing support in Samba) endobj 557 0 obj -<< /S /GoTo /D (subsection.13.2.2) >> +<< /S /GoTo /D (subsection.10.7.2) >> endobj 560 0 obj -(13.2.2 Setting Drivers for Existing Printers) +(10.7.2 Problem resolution) endobj 561 0 obj -<< /S /GoTo /D (subsection.13.2.3) >> +<< /S /GoTo /D (subsection.10.7.3) >> endobj 564 0 obj -(13.2.3 Support a large number of printers) +(10.7.3 Browsing across subnets) endobj 565 0 obj -<< /S /GoTo /D (subsection.13.2.4) >> +<< /S /GoTo /D (subsubsection.10.7.3.1) >> endobj 568 0 obj -(13.2.4 Adding New Printers via the Windows NT APW) +(10.7.3.1 How does cross subnet browsing work ?) endobj 569 0 obj -<< /S /GoTo /D (subsection.13.2.5) >> +<< /S /GoTo /D (section.10.8) >> endobj 572 0 obj -(13.2.5 Samba and Printer Ports) +(10.8 Common Errors) endobj 573 0 obj -<< /S /GoTo /D (section.13.3) >> +<< /S /GoTo /D (subsection.10.8.1) >> endobj 576 0 obj -(13.3 The Imprints Toolset) +(10.8.1 How can one flush the Samba NetBIOS name cache without restarting Samba?) endobj 577 0 obj -<< /S /GoTo /D (subsection.13.3.1) >> +<< /S /GoTo /D (subsection.10.8.2) >> endobj 580 0 obj -(13.3.1 What is Imprints?) +(10.8.2 My client reports "This server is not configured to list shared resources") endobj 581 0 obj -<< /S /GoTo /D (subsection.13.3.2) >> +<< /S /GoTo /D (chapter.11) >> endobj 584 0 obj -(13.3.2 Creating Printer Driver Packages) +(11 Account Information Databases) endobj 585 0 obj -<< /S /GoTo /D (subsection.13.3.3) >> +<< /S /GoTo /D (section.11.1) >> endobj 588 0 obj -(13.3.3 The Imprints server) +(11.1 Features and Benefits) endobj 589 0 obj -<< /S /GoTo /D (subsection.13.3.4) >> +<< /S /GoTo /D (section.11.2) >> endobj 592 0 obj -(13.3.4 The Installation Client) +(11.2 Technical Information) endobj 593 0 obj -<< /S /GoTo /D (section.13.4) >> +<< /S /GoTo /D (subsection.11.2.1) >> endobj 596 0 obj -(13.4 Diagnosis) +(11.2.1 Important Notes About Security) endobj 597 0 obj -<< /S /GoTo /D (subsection.13.4.1) >> +<< /S /GoTo /D (subsubsection.11.2.1.1) >> endobj 600 0 obj -(13.4.1 Introduction) +(11.2.1.1 Advantages of Encrypted Passwords) endobj 601 0 obj -<< /S /GoTo /D (subsection.13.4.2) >> +<< /S /GoTo /D (subsubsection.11.2.1.2) >> endobj 604 0 obj -(13.4.2 Debugging printer problems) +(11.2.1.2 Advantages of non-encrypted passwords) endobj 605 0 obj -<< /S /GoTo /D (subsection.13.4.3) >> +<< /S /GoTo /D (subsection.11.2.2) >> endobj 608 0 obj -(13.4.3 What printers do I have?) +(11.2.2 Mapping User Identifiers between MS Windows and Unix) endobj 609 0 obj -<< /S /GoTo /D (subsection.13.4.4) >> +<< /S /GoTo /D (section.11.3) >> endobj 612 0 obj -(13.4.4 Setting up printcap and print servers) +(11.3 Account Management Tools) endobj 613 0 obj -<< /S /GoTo /D (subsection.13.4.5) >> +<< /S /GoTo /D (subsection.11.3.1) >> endobj 616 0 obj -(13.4.5 Job sent, no output) +(11.3.1 The smbpasswd Command) endobj 617 0 obj -<< /S /GoTo /D (subsection.13.4.6) >> +<< /S /GoTo /D (subsection.11.3.2) >> endobj 620 0 obj -(13.4.6 Job sent, strange output) +(11.3.2 The pdbedit Command) endobj 621 0 obj -<< /S /GoTo /D (subsection.13.4.7) >> +<< /S /GoTo /D (section.11.4) >> endobj 624 0 obj -(13.4.7 Raw PostScript printed) +(11.4 Password Backends) endobj 625 0 obj -<< /S /GoTo /D (subsection.13.4.8) >> +<< /S /GoTo /D (subsection.11.4.1) >> endobj 628 0 obj -(13.4.8 Advanced Printing) +(11.4.1 Plain Text) endobj 629 0 obj -<< /S /GoTo /D (subsection.13.4.9) >> +<< /S /GoTo /D (subsection.11.4.2) >> endobj 632 0 obj -(13.4.9 Real debugging) +(11.4.2 smbpasswd - Encrypted Password Database) endobj 633 0 obj -<< /S /GoTo /D (chapter.14) >> +<< /S /GoTo /D (subsection.11.4.3) >> endobj 636 0 obj -(14 CUPS Printing Support) +(11.4.3 tdbsam) endobj 637 0 obj -<< /S /GoTo /D (section.14.1) >> +<< /S /GoTo /D (subsection.11.4.4) >> endobj 640 0 obj -(14.1 Introduction) +(11.4.4 ldapsam) endobj 641 0 obj -<< /S /GoTo /D (section.14.2) >> +<< /S /GoTo /D (subsubsection.11.4.4.1) >> endobj 644 0 obj -(14.2 Configuring smb.conf for CUPS) +(11.4.4.1 Supported LDAP Servers) endobj 645 0 obj -<< /S /GoTo /D (section.14.3) >> +<< /S /GoTo /D (subsubsection.11.4.4.2) >> endobj 648 0 obj -(14.3 CUPS - RAW Print Through Mode) +(11.4.4.2 Schema and Relationship to the RFC 2307 posixAccount) endobj 649 0 obj -<< /S /GoTo /D (section.14.4) >> +<< /S /GoTo /D (subsubsection.11.4.4.3) >> endobj 652 0 obj -(14.4 CUPS as a network PostScript RIP) +(11.4.4.3 OpenLDAP configuration) endobj 653 0 obj -<< /S /GoTo /D (section.14.5) >> +<< /S /GoTo /D (subsubsection.11.4.4.4) >> endobj 656 0 obj -(14.5 Windows Terminal Servers \(WTS\) as CUPS clients) +(11.4.4.4 Initialise the LDAP database) endobj 657 0 obj -<< /S /GoTo /D (section.14.6) >> +<< /S /GoTo /D (subsubsection.11.4.4.5) >> endobj 660 0 obj -(14.6 Setting up CUPS for driver download) +(11.4.4.5 Configuring Samba) endobj 661 0 obj -<< /S /GoTo /D (section.14.7) >> +<< /S /GoTo /D (subsubsection.11.4.4.6) >> endobj 664 0 obj -(14.7 Sources of CUPS drivers / PPDs) +(11.4.4.6 Accounts and Groups management) endobj 665 0 obj -<< /S /GoTo /D (subsection.14.7.1) >> +<< /S /GoTo /D (subsubsection.11.4.4.7) >> endobj 668 0 obj -(14.7.1 cupsaddsmb) +(11.4.4.7 Security and sambaSamAccount) endobj 669 0 obj -<< /S /GoTo /D (section.14.8) >> +<< /S /GoTo /D (subsubsection.11.4.4.8) >> endobj 672 0 obj -(14.8 The CUPS Filter Chains) +(11.4.4.8 LDAP special attributes for sambaSamAccounts) endobj 673 0 obj -<< /S /GoTo /D (section.14.9) >> +<< /S /GoTo /D (subsubsection.11.4.4.9) >> endobj 676 0 obj -(14.9 CUPS Print Drivers and Devices) +(11.4.4.9 Example LDIF Entries for a sambaSamAccount) endobj 677 0 obj -<< /S /GoTo /D (subsection.14.9.1) >> +<< /S /GoTo /D (subsubsection.11.4.4.10) >> endobj 680 0 obj -(14.9.1 Further printing steps) +(11.4.4.10 Password synchronisation) endobj 681 0 obj -<< /S /GoTo /D (section.14.10) >> +<< /S /GoTo /D (subsection.11.4.5) >> endobj 684 0 obj -(14.10 Limiting the number of pages users can print) +(11.4.5 MySQL) endobj 685 0 obj -<< /S /GoTo /D (section.14.11) >> +<< /S /GoTo /D (subsubsection.11.4.5.1) >> endobj 688 0 obj -(14.11 Advanced Postscript Printing from MS Windows) +(11.4.5.1 Creating the database) endobj 689 0 obj -<< /S /GoTo /D (section.14.12) >> +<< /S /GoTo /D (subsubsection.11.4.5.2) >> endobj 692 0 obj -(14.12 Auto-Deletion of CUPS spool files) +(11.4.5.2 Configuring) endobj 693 0 obj -<< /S /GoTo /D (chapter.15) >> +<< /S /GoTo /D (subsubsection.11.4.5.3) >> endobj 696 0 obj -(15 Unified Logons between Windows NT and UNIX using Winbind) +(11.4.5.3 Using plaintext passwords or encrypted password) endobj 697 0 obj -<< /S /GoTo /D (section.15.1) >> +<< /S /GoTo /D (subsubsection.11.4.5.4) >> endobj 700 0 obj -(15.1 Abstract) +(11.4.5.4 Getting non-column data from the table) endobj 701 0 obj -<< /S /GoTo /D (section.15.2) >> +<< /S /GoTo /D (subsection.11.4.6) >> endobj 704 0 obj -(15.2 Introduction) +(11.4.6 XML) endobj 705 0 obj -<< /S /GoTo /D (section.15.3) >> +<< /S /GoTo /D (section.11.5) >> endobj 708 0 obj -(15.3 What Winbind Provides) +(11.5 Common Errors) endobj 709 0 obj -<< /S /GoTo /D (subsection.15.3.1) >> +<< /S /GoTo /D (subsection.11.5.1) >> endobj 712 0 obj -(15.3.1 Target Uses) +(11.5.1 Users can not logon - Users not in Samba SAM) endobj 713 0 obj -<< /S /GoTo /D (section.15.4) >> +<< /S /GoTo /D (subsection.11.5.2) >> endobj 716 0 obj -(15.4 How Winbind Works) +(11.5.2 Users are being added to the wrong backend database) endobj 717 0 obj -<< /S /GoTo /D (subsection.15.4.1) >> +<< /S /GoTo /D (subsection.11.5.3) >> endobj 720 0 obj -(15.4.1 Microsoft Remote Procedure Calls) +(11.5.3 auth methods does not work) endobj 721 0 obj -<< /S /GoTo /D (subsection.15.4.2) >> +<< /S /GoTo /D (chapter.12) >> endobj 724 0 obj -(15.4.2 Microsoft Active Directory Services) +(12 Mapping MS Windows and Unix Groups) endobj 725 0 obj -<< /S /GoTo /D (subsection.15.4.3) >> +<< /S /GoTo /D (section.12.1) >> endobj 728 0 obj -(15.4.3 Name Service Switch) +(12.1 Features and Benefits) endobj 729 0 obj -<< /S /GoTo /D (subsection.15.4.4) >> +<< /S /GoTo /D (section.12.2) >> endobj 732 0 obj -(15.4.4 Pluggable Authentication Modules) +(12.2 Discussion) endobj 733 0 obj -<< /S /GoTo /D (subsection.15.4.5) >> +<< /S /GoTo /D (subsection.12.2.1) >> endobj 736 0 obj -(15.4.5 User and Group ID Allocation) +(12.2.1 Example Configuration) endobj 737 0 obj -<< /S /GoTo /D (subsection.15.4.6) >> +<< /S /GoTo /D (section.12.3) >> endobj 740 0 obj -(15.4.6 Result Caching) +(12.3 Configuration Scripts) endobj 741 0 obj -<< /S /GoTo /D (section.15.5) >> +<< /S /GoTo /D (subsection.12.3.1) >> endobj 744 0 obj -(15.5 Installation and Configuration) +(12.3.1 Sample smb.conf add group script) endobj 745 0 obj -<< /S /GoTo /D (subsection.15.5.1) >> +<< /S /GoTo /D (subsection.12.3.2) >> endobj 748 0 obj -(15.5.1 Introduction) +(12.3.2 Script to configure Group Mapping) endobj 749 0 obj -<< /S /GoTo /D (subsection.15.5.2) >> +<< /S /GoTo /D (section.12.4) >> endobj 752 0 obj -(15.5.2 Requirements) +(12.4 Common Errors) endobj 753 0 obj -<< /S /GoTo /D (subsection.15.5.3) >> +<< /S /GoTo /D (subsection.12.4.1) >> endobj 756 0 obj -(15.5.3 Testing Things Out) +(12.4.1 Adding Groups Fails) endobj 757 0 obj -<< /S /GoTo /D (subsubsection.15.5.3.1) >> +<< /S /GoTo /D (subsection.12.4.2) >> endobj 760 0 obj -(15.5.3.1 Configure and compile SAMBA) +(12.4.2 Adding MS Windows Groups to MS Windows Groups Fails) endobj 761 0 obj -<< /S /GoTo /D (subsubsection.15.5.3.2) >> +<< /S /GoTo /D (chapter.13) >> endobj 764 0 obj -(15.5.3.2 Configure nsswitch.conf and the winbind libraries on Linux and Solaris) +(13 File, Directory and Share Access Controls) endobj 765 0 obj -<< /S /GoTo /D (subsubsection.15.5.3.3) >> +<< /S /GoTo /D (section.13.1) >> endobj 768 0 obj -(15.5.3.3 NSS Winbind on AIX) +(13.1 Features and Benefits) endobj 769 0 obj -<< /S /GoTo /D (subsubsection.15.5.3.4) >> +<< /S /GoTo /D (section.13.2) >> endobj 772 0 obj -(15.5.3.4 Configure smb.conf) +(13.2 File System Access Controls) endobj 773 0 obj -<< /S /GoTo /D (subsubsection.15.5.3.5) >> +<< /S /GoTo /D (subsection.13.2.1) >> endobj 776 0 obj -(15.5.3.5 Join the SAMBA server to the PDC domain) +(13.2.1 MS Windows NTFS Comparison with Unix File Systems) endobj 777 0 obj -<< /S /GoTo /D (subsubsection.15.5.3.6) >> +<< /S /GoTo /D (subsection.13.2.2) >> endobj 780 0 obj -(15.5.3.6 Start up the winbindd daemon and test it!) +(13.2.2 Managing Directories) endobj 781 0 obj -<< /S /GoTo /D (subsubsection.15.5.3.7) >> +<< /S /GoTo /D (subsection.13.2.3) >> endobj 784 0 obj -(15.5.3.7 Fix the init.d startup scripts) +(13.2.3 File and Directory Access Control) endobj 785 0 obj -<< /S /GoTo /D (subsubsection.15.5.3.8) >> +<< /S /GoTo /D (section.13.3) >> endobj 788 0 obj -(15.5.3.8 Configure Winbind and PAM) +(13.3 Share Definition Access Controls) endobj 789 0 obj -<< /S /GoTo /D (section.15.6) >> +<< /S /GoTo /D (subsection.13.3.1) >> endobj 792 0 obj -(15.6 Limitations) +(13.3.1 User and Group Based Controls) endobj 793 0 obj -<< /S /GoTo /D (section.15.7) >> +<< /S /GoTo /D (subsection.13.3.2) >> endobj 796 0 obj -(15.7 Conclusion) +(13.3.2 File and Directory Permissions Based Controls) endobj 797 0 obj -<< /S /GoTo /D (chapter.16) >> +<< /S /GoTo /D (subsection.13.3.3) >> endobj 800 0 obj -(16 Advanced Network Manangement) +(13.3.3 Miscellaneous Controls) endobj 801 0 obj -<< /S /GoTo /D (section.16.1) >> +<< /S /GoTo /D (section.13.4) >> endobj 804 0 obj -(16.1 Configuring Samba Share Access Controls) +(13.4 Access Controls on Shares) endobj 805 0 obj -<< /S /GoTo /D (subsection.16.1.1) >> +<< /S /GoTo /D (subsection.13.4.1) >> endobj 808 0 obj -(16.1.1 Share Permissions Management) +(13.4.1 Share Permissions Management) endobj 809 0 obj -<< /S /GoTo /D (subsubsection.16.1.1.1) >> +<< /S /GoTo /D (subsubsection.13.4.1.1) >> endobj 812 0 obj -(16.1.1.1 Windows NT4 Workstation/Server) +(13.4.1.1 Windows NT4 Workstation/Server) endobj 813 0 obj -<< /S /GoTo /D (subsubsection.16.1.1.2) >> +<< /S /GoTo /D (subsubsection.13.4.1.2) >> endobj 816 0 obj -(16.1.1.2 Windows 200x/XP) +(13.4.1.2 Windows 200x/XP) endobj 817 0 obj -<< /S /GoTo /D (section.16.2) >> +<< /S /GoTo /D (section.13.5) >> endobj 820 0 obj -(16.2 Remote Server Administration) +(13.5 MS Windows Access Control Lists and Unix Interoperability) endobj 821 0 obj -<< /S /GoTo /D (section.16.3) >> +<< /S /GoTo /D (subsection.13.5.1) >> endobj 824 0 obj -(16.3 Network Logon Script Magic) +(13.5.1 Managing UNIX permissions Using NT Security Dialogs) endobj 825 0 obj -<< /S /GoTo /D (subsection.16.3.1) >> +<< /S /GoTo /D (subsection.13.5.2) >> endobj 828 0 obj -(16.3.1 Adding printers without user intervention) +(13.5.2 Viewing File Security on a Samba Share) endobj 829 0 obj -<< /S /GoTo /D (chapter.17) >> +<< /S /GoTo /D (subsection.13.5.3) >> endobj 832 0 obj -(17 System and Account Policies) +(13.5.3 Viewing file ownership) endobj 833 0 obj -<< /S /GoTo /D (section.17.1) >> +<< /S /GoTo /D (subsection.13.5.4) >> endobj 836 0 obj -(17.1 Creating and Managing System Policies) +(13.5.4 Viewing File or Directory Permissions) endobj 837 0 obj -<< /S /GoTo /D (subsection.17.1.1) >> +<< /S /GoTo /D (subsubsection.13.5.4.1) >> endobj 840 0 obj -(17.1.1 Windows 9x/Me Policies) +(13.5.4.1 File Permissions) endobj 841 0 obj -<< /S /GoTo /D (subsection.17.1.2) >> +<< /S /GoTo /D (subsubsection.13.5.4.2) >> endobj 844 0 obj -(17.1.2 Windows NT4 Style Policy Files) +(13.5.4.2 Directory Permissions) endobj 845 0 obj -<< /S /GoTo /D (subsubsection.17.1.2.1) >> +<< /S /GoTo /D (subsection.13.5.5) >> endobj 848 0 obj -(17.1.2.1 Registry Tattoos) +(13.5.5 Modifying file or directory permissions) endobj 849 0 obj -<< /S /GoTo /D (subsection.17.1.3) >> +<< /S /GoTo /D (subsection.13.5.6) >> endobj 852 0 obj -(17.1.3 MS Windows 200x / XP Professional Policies) +(13.5.6 Interaction with the standard Samba create mask parameters) endobj 853 0 obj -<< /S /GoTo /D (subsubsection.17.1.3.1) >> +<< /S /GoTo /D (subsection.13.5.7) >> endobj 856 0 obj -(17.1.3.1 Administration of Win2K / XP PoliciesInstructions) +(13.5.7 Interaction with the standard Samba file attribute mapping) endobj 857 0 obj -<< /S /GoTo /D (section.17.2) >> +<< /S /GoTo /D (section.13.6) >> endobj 860 0 obj -(17.2 Managing Account/User Policies) +(13.6 Common Errors) endobj 861 0 obj -<< /S /GoTo /D (subsection.17.2.1) >> +<< /S /GoTo /D (subsection.13.6.1) >> endobj 864 0 obj -(17.2.1 With Windows NT4/200x) +(13.6.1 Users can not write to a public share) endobj 865 0 obj -<< /S /GoTo /D (subsection.17.2.2) >> +<< /S /GoTo /D (subsection.13.6.2) >> endobj 868 0 obj -(17.2.2 With a Samba PDC) +(13.6.2 I have set force user and Samba still makes root the owner of all the files I touch!) endobj 869 0 obj -<< /S /GoTo /D (section.17.3) >> +<< /S /GoTo /D (chapter.14) >> endobj 872 0 obj -(17.3 System Startup and Logon Processing Overview) +(14 File and Record Locking) endobj 873 0 obj -<< /S /GoTo /D (chapter.18) >> +<< /S /GoTo /D (section.14.1) >> endobj 876 0 obj -(18 Desktop Profile Management) +(14.1 Features and Benefits) endobj 877 0 obj -<< /S /GoTo /D (section.18.1) >> +<< /S /GoTo /D (section.14.2) >> endobj 880 0 obj -(18.1 Roaming Profiles) +(14.2 Discussion) endobj 881 0 obj -<< /S /GoTo /D (subsection.18.1.1) >> +<< /S /GoTo /D (subsection.14.2.1) >> endobj 884 0 obj -(18.1.1 Samba Configuration for Profile Handling) +(14.2.1 Opportunistic Locking Overview) endobj 885 0 obj -<< /S /GoTo /D (subsubsection.18.1.1.1) >> +<< /S /GoTo /D (subsubsection.14.2.1.1) >> endobj 888 0 obj -(18.1.1.1 NT4/200x User Profiles) +(14.2.1.1 Exclusively Accessed Shares) endobj 889 0 obj -<< /S /GoTo /D (subsubsection.18.1.1.2) >> +<< /S /GoTo /D (subsubsection.14.2.1.2) >> endobj 892 0 obj -(18.1.1.2 Windows 9x / Me User Profiles) +(14.2.1.2 Multiple-Accessed Shares or Files) endobj 893 0 obj -<< /S /GoTo /D (subsubsection.18.1.1.3) >> +<< /S /GoTo /D (subsubsection.14.2.1.3) >> endobj 896 0 obj -(18.1.1.3 Mixed Windows 9x / Me and Windows NT4/200x User Profiles) +(14.2.1.3 Unix or NFS Client Accessed Files) endobj 897 0 obj -<< /S /GoTo /D (subsubsection.18.1.1.4) >> +<< /S /GoTo /D (subsubsection.14.2.1.4) >> endobj 900 0 obj -(18.1.1.4 Disabling Roaming Profile Support) +(14.2.1.4 Slow and/or Unreliable Networks) endobj 901 0 obj -<< /S /GoTo /D (subsection.18.1.2) >> +<< /S /GoTo /D (subsubsection.14.2.1.5) >> endobj 904 0 obj -(18.1.2 Windows Client Profile Configuration Information) +(14.2.1.5 Multi-User Databases) endobj 905 0 obj -<< /S /GoTo /D (subsubsection.18.1.2.1) >> +<< /S /GoTo /D (subsubsection.14.2.1.6) >> endobj 908 0 obj -(18.1.2.1 Windows 9x / Me Profile Setup) +(14.2.1.6 PDM Data Shares) endobj 909 0 obj -<< /S /GoTo /D (subsubsection.18.1.2.2) >> +<< /S /GoTo /D (subsubsection.14.2.1.7) >> endobj 912 0 obj -(18.1.2.2 Windows NT4 Workstation) +(14.2.1.7 Beware of Force User) endobj 913 0 obj -<< /S /GoTo /D (subsubsection.18.1.2.3) >> +<< /S /GoTo /D (subsubsection.14.2.1.8) >> endobj 916 0 obj -(18.1.2.3 Windows 2000/XP Professional) +(14.2.1.8 Advanced Samba Opportunistic Locking Parameters) endobj 917 0 obj -<< /S /GoTo /D (subsection.18.1.3) >> +<< /S /GoTo /D (subsubsection.14.2.1.9) >> endobj 920 0 obj -(18.1.3 Sharing Profiles between W9x/Me and NT4/200x/XP workstations) +(14.2.1.9 Mission Critical High Availability) endobj 921 0 obj -<< /S /GoTo /D (subsection.18.1.4) >> +<< /S /GoTo /D (section.14.3) >> endobj 924 0 obj -(18.1.4 Profile Migration from Windows NT4/200x Server to Samba) +(14.3 Samba Opportunistic Locking Control) endobj 925 0 obj -<< /S /GoTo /D (subsubsection.18.1.4.1) >> +<< /S /GoTo /D (subsection.14.3.1) >> endobj 928 0 obj -(18.1.4.1 Windows NT4 Profile Management Tools) +(14.3.1 Example Configuration) endobj 929 0 obj -<< /S /GoTo /D (subsubsection.18.1.4.2) >> +<< /S /GoTo /D (subsubsection.14.3.1.1) >> endobj 932 0 obj -(18.1.4.2 Side bar Notes) +(14.3.1.1 Disabling Oplocks) endobj 933 0 obj -<< /S /GoTo /D (subsubsection.18.1.4.3) >> +<< /S /GoTo /D (subsubsection.14.3.1.2) >> endobj 936 0 obj -(18.1.4.3 moveuser.exe) +(14.3.1.2 Disabling Kernel OpLocks) endobj 937 0 obj -<< /S /GoTo /D (subsubsection.18.1.4.4) >> +<< /S /GoTo /D (section.14.4) >> endobj 940 0 obj -(18.1.4.4 Get SID) +(14.4 MS Windows Opportunistic Locking and Caching Controls) endobj 941 0 obj -<< /S /GoTo /D (section.18.2) >> +<< /S /GoTo /D (subsection.14.4.1) >> endobj 944 0 obj -(18.2 Mandatory profiles) +(14.4.1 Workstation Service Entries) endobj 945 0 obj -<< /S /GoTo /D (section.18.3) >> +<< /S /GoTo /D (subsection.14.4.2) >> endobj 948 0 obj -(18.3 Creating/Managing Group Profiles) +(14.4.2 Server Service Entries) endobj 949 0 obj -<< /S /GoTo /D (section.18.4) >> +<< /S /GoTo /D (section.14.5) >> endobj 952 0 obj -(18.4 Default Profile for Windows Users) +(14.5 Persistent Data Corruption) endobj 953 0 obj -<< /S /GoTo /D (subsection.18.4.1) >> +<< /S /GoTo /D (section.14.6) >> endobj 956 0 obj -(18.4.1 MS Windows 9x/Me) +(14.6 Common Errors) endobj 957 0 obj -<< /S /GoTo /D (subsubsection.18.4.1.1) >> +<< /S /GoTo /D (subsection.14.6.1) >> endobj 960 0 obj -(18.4.1.1 How User Profiles Are Handled in Windows 9x / Me?) +(14.6.1 locking.tdb error messages) endobj 961 0 obj -<< /S /GoTo /D (subsection.18.4.2) >> +<< /S /GoTo /D (section.14.7) >> endobj 964 0 obj -(18.4.2 MS Windows NT4 Workstation) +(14.7 Additional Reading) endobj 965 0 obj -<< /S /GoTo /D (subsection.18.4.3) >> +<< /S /GoTo /D (chapter.15) >> endobj 968 0 obj -(18.4.3 MS Windows 200x/XP) +(15 Securing Samba) endobj 969 0 obj -<< /S /GoTo /D (chapter.19) >> +<< /S /GoTo /D (section.15.1) >> endobj 972 0 obj -(19 Interdomain Trust Relationships) +(15.1 Introduction) endobj 973 0 obj -<< /S /GoTo /D (section.19.1) >> +<< /S /GoTo /D (section.15.2) >> endobj 976 0 obj -(19.1 Trust Relationship Background) +(15.2 Features and Benefits) endobj 977 0 obj -<< /S /GoTo /D (section.19.2) >> +<< /S /GoTo /D (section.15.3) >> endobj 980 0 obj -(19.2 Native MS Windows NT4 Trusts Configuration) +(15.3 Technical Discussion of Protective Measures and Issues) endobj 981 0 obj -<< /S /GoTo /D (subsection.19.2.1) >> +<< /S /GoTo /D (subsection.15.3.1) >> endobj 984 0 obj -(19.2.1 NT4 as the Trusting Domain \(ie. creating the trusted account\)) +(15.3.1 Using host based protection) endobj 985 0 obj -<< /S /GoTo /D (subsection.19.2.2) >> +<< /S /GoTo /D (subsection.15.3.2) >> endobj 988 0 obj -(19.2.2 NT4 as the Trusted Domain \(ie. creating trusted account's password\)) +(15.3.2 User based protection) endobj 989 0 obj -<< /S /GoTo /D (section.19.3) >> +<< /S /GoTo /D (subsection.15.3.3) >> endobj 992 0 obj -(19.3 Configuring Samba NT-style Domain Trusts) +(15.3.3 Using interface protection) endobj 993 0 obj -<< /S /GoTo /D (subsection.19.3.1) >> +<< /S /GoTo /D (subsection.15.3.4) >> endobj 996 0 obj -(19.3.1 Samba-3 as the Trusting Domain) +(15.3.4 Using a firewall) endobj 997 0 obj -<< /S /GoTo /D (subsection.19.3.2) >> +<< /S /GoTo /D (subsection.15.3.5) >> endobj 1000 0 obj -(19.3.2 Samba-3 as the Trusted Domain) +(15.3.5 Using a IPC\044 share deny) endobj 1001 0 obj -<< /S /GoTo /D (chapter.20) >> +<< /S /GoTo /D (subsection.15.3.6) >> endobj 1004 0 obj -(20 PAM Configuration for Centrally Managed Authentication) +(15.3.6 NTLMv2 Security) endobj 1005 0 obj -<< /S /GoTo /D (section.20.1) >> +<< /S /GoTo /D (section.15.4) >> endobj 1008 0 obj -(20.1 Samba and PAM) +(15.4 Upgrading Samba) endobj 1009 0 obj -<< /S /GoTo /D (subsection.20.1.1) >> +<< /S /GoTo /D (section.15.5) >> endobj 1012 0 obj -(20.1.1 PAM Configuration in smb.conf) +(15.5 Common Errors) endobj 1013 0 obj -<< /S /GoTo /D (subsection.20.1.2) >> +<< /S /GoTo /D (subsection.15.5.1) >> endobj 1016 0 obj -(20.1.2 Password Synchronisation using pam\137smbpass.so) +(15.5.1 Smbclient works on localhost, but the network is dead) endobj 1017 0 obj -<< /S /GoTo /D (subsubsection.20.1.2.1) >> +<< /S /GoTo /D (subsection.15.5.2) >> endobj 1020 0 obj -(20.1.2.1 Password Synchonisation Configuration) +(15.5.2 Why can users access home directories of other users?) endobj 1021 0 obj -<< /S /GoTo /D (subsubsection.20.1.2.2) >> +<< /S /GoTo /D (chapter.16) >> endobj 1024 0 obj -(20.1.2.2 Password Migration Configuration) +(16 Interdomain Trust Relationships) endobj 1025 0 obj -<< /S /GoTo /D (subsubsection.20.1.2.3) >> +<< /S /GoTo /D (section.16.1) >> endobj 1028 0 obj -(20.1.2.3 Mature Password Configuration) +(16.1 Features and Benefits) endobj 1029 0 obj -<< /S /GoTo /D (subsubsection.20.1.2.4) >> +<< /S /GoTo /D (section.16.2) >> endobj 1032 0 obj -(20.1.2.4 Kerberos Password Integration Configuration) +(16.2 Trust Relationship Background) endobj 1033 0 obj -<< /S /GoTo /D (section.20.2) >> +<< /S /GoTo /D (section.16.3) >> endobj 1036 0 obj -(20.2 Distributed Authentication) +(16.3 Native MS Windows NT4 Trusts Configuration) endobj 1037 0 obj -<< /S /GoTo /D (chapter.21) >> +<< /S /GoTo /D (subsection.16.3.1) >> endobj 1040 0 obj -(21 Stackable VFS modules) +(16.3.1 NT4 as the Trusting Domain \(ie. creating the trusted account\)) endobj 1041 0 obj -<< /S /GoTo /D (section.21.1) >> +<< /S /GoTo /D (subsection.16.3.2) >> endobj 1044 0 obj -(21.1 Introduction and configuration) +(16.3.2 NT4 as the Trusted Domain \(ie. creating trusted account's password\)) endobj 1045 0 obj -<< /S /GoTo /D (section.21.2) >> +<< /S /GoTo /D (section.16.4) >> endobj 1048 0 obj -(21.2 Included modules) +(16.4 Configuring Samba NT-style Domain Trusts) endobj 1049 0 obj -<< /S /GoTo /D (subsection.21.2.1) >> +<< /S /GoTo /D (subsection.16.4.1) >> endobj 1052 0 obj -(21.2.1 audit) +(16.4.1 Samba-3 as the Trusting Domain) endobj 1053 0 obj -<< /S /GoTo /D (subsection.21.2.2) >> +<< /S /GoTo /D (subsection.16.4.2) >> endobj 1056 0 obj -(21.2.2 extd\137audit) +(16.4.2 Samba-3 as the Trusted Domain) endobj 1057 0 obj -<< /S /GoTo /D (subsection.21.2.3) >> +<< /S /GoTo /D (section.16.5) >> endobj 1060 0 obj -(21.2.3 recycle) +(16.5 Common Errors) endobj 1061 0 obj -<< /S /GoTo /D (subsection.21.2.4) >> +<< /S /GoTo /D (subsection.16.5.1) >> endobj 1064 0 obj -(21.2.4 netatalk) +(16.5.1 Tell me about Trust Relationships using Samba) endobj 1065 0 obj -<< /S /GoTo /D (section.21.3) >> +<< /S /GoTo /D (chapter.17) >> endobj 1068 0 obj -(21.3 VFS modules available elsewhere) +(17 Hosting a Microsoft Distributed File System tree on Samba) endobj 1069 0 obj -<< /S /GoTo /D (subsection.21.3.1) >> +<< /S /GoTo /D (section.17.1) >> endobj 1072 0 obj -(21.3.1 DatabaseFS) +(17.1 Features and Benefits) endobj 1073 0 obj -<< /S /GoTo /D (subsection.21.3.2) >> +<< /S /GoTo /D (section.17.2) >> endobj 1076 0 obj -(21.3.2 vscan) +(17.2 Common Errors) endobj 1077 0 obj -<< /S /GoTo /D (chapter.22) >> +<< /S /GoTo /D (chapter.18) >> endobj 1080 0 obj -(22 Hosting a Microsoft Distributed File System tree on Samba) +(18 Classical Printing Support) endobj 1081 0 obj -<< /S /GoTo /D (section.22.1) >> +<< /S /GoTo /D (section.18.1) >> endobj 1084 0 obj -(22.1 Instructions) +(18.1 Features and Benefits) endobj 1085 0 obj -<< /S /GoTo /D (subsection.22.1.1) >> +<< /S /GoTo /D (section.18.2) >> endobj 1088 0 obj -(22.1.1 Notes) +(18.2 Technical Introduction) endobj 1089 0 obj -<< /S /GoTo /D (chapter.23) >> +<< /S /GoTo /D (subsection.18.2.1) >> endobj 1092 0 obj -(23 Integrating MS Windows networks with Samba) +(18.2.1 What happens if you send a Job from a Client) endobj 1093 0 obj -<< /S /GoTo /D (section.23.1) >> +<< /S /GoTo /D (subsection.18.2.2) >> endobj 1096 0 obj -(23.1 Name Resolution in a pure Unix/Linux world) +(18.2.2 Printing Related Configuration Parameters) endobj 1097 0 obj -<< /S /GoTo /D (subsection.23.1.1) >> +<< /S /GoTo /D (subsection.18.2.3) >> endobj 1100 0 obj -(23.1.1 /etc/hosts) +(18.2.3 Parameters Recommended for Use) endobj 1101 0 obj -<< /S /GoTo /D (subsection.23.1.2) >> +<< /S /GoTo /D (subsection.18.2.4) >> endobj 1104 0 obj -(23.1.2 /etc/resolv.conf) +(18.2.4 Parameters for Backwards Compatibility) endobj 1105 0 obj -<< /S /GoTo /D (subsection.23.1.3) >> +<< /S /GoTo /D (subsection.18.2.5) >> endobj 1108 0 obj -(23.1.3 /etc/host.conf) +(18.2.5 Parameters no longer in use) endobj 1109 0 obj -<< /S /GoTo /D (subsection.23.1.4) >> +<< /S /GoTo /D (section.18.3) >> endobj 1112 0 obj -(23.1.4 /etc/nsswitch.conf) +(18.3 A simple Configuration to Print with Samba-3) endobj 1113 0 obj -<< /S /GoTo /D (section.23.2) >> +<< /S /GoTo /D (subsection.18.3.1) >> endobj 1116 0 obj -(23.2 Name resolution as used within MS Windows networking) +(18.3.1 Verification of "Settings in Use" with testparm) endobj 1117 0 obj -<< /S /GoTo /D (subsection.23.2.1) >> +<< /S /GoTo /D (subsection.18.3.2) >> endobj 1120 0 obj -(23.2.1 The NetBIOS Name Cache) +(18.3.2 A little Experiment to warn you) endobj 1121 0 obj -<< /S /GoTo /D (subsection.23.2.2) >> +<< /S /GoTo /D (section.18.4) >> endobj 1124 0 obj -(23.2.2 The LMHOSTS file) +(18.4 Extended Sample Configuration to Print with Samba-3) endobj 1125 0 obj -<< /S /GoTo /D (subsection.23.2.3) >> +<< /S /GoTo /D (section.18.5) >> endobj 1128 0 obj -(23.2.3 HOSTS file) +(18.5 Detailed Explanation of the Example's Settings) endobj 1129 0 obj -<< /S /GoTo /D (subsection.23.2.4) >> +<< /S /GoTo /D (subsection.18.5.1) >> endobj 1132 0 obj -(23.2.4 DNS Lookup) +(18.5.1 The [global] Section) endobj 1133 0 obj -<< /S /GoTo /D (subsection.23.2.5) >> +<< /S /GoTo /D (subsection.18.5.2) >> endobj 1136 0 obj -(23.2.5 WINS Lookup) +(18.5.2 The [printers] Section) endobj 1137 0 obj -<< /S /GoTo /D (chapter.24) >> +<< /S /GoTo /D (subsection.18.5.3) >> endobj 1140 0 obj -(24 Securing Samba) +(18.5.3 Any [my\137printer\137name] Section) endobj 1141 0 obj -<< /S /GoTo /D (section.24.1) >> +<< /S /GoTo /D (subsection.18.5.4) >> endobj 1144 0 obj -(24.1 Introduction) +(18.5.4 Print Commands) endobj 1145 0 obj -<< /S /GoTo /D (section.24.2) >> +<< /S /GoTo /D (subsection.18.5.5) >> endobj 1148 0 obj -(24.2 Using host based protection) +(18.5.5 Default Print Commands for various Unix Print Subsystems) endobj 1149 0 obj -<< /S /GoTo /D (section.24.3) >> +<< /S /GoTo /D (subsection.18.5.6) >> endobj 1152 0 obj -(24.3 Using interface protection) +(18.5.6 Setting up your own Print Commands) endobj 1153 0 obj -<< /S /GoTo /D (section.24.4) >> +<< /S /GoTo /D (section.18.6) >> endobj 1156 0 obj -(24.4 Using a firewall) +(18.6 Innovations in Samba Printing since 2.2) endobj 1157 0 obj -<< /S /GoTo /D (section.24.5) >> +<< /S /GoTo /D (subsection.18.6.1) >> endobj 1160 0 obj -(24.5 Using a IPC\044 share deny) +(18.6.1 Client Drivers on Samba Server for Point'n'Print) endobj 1161 0 obj -<< /S /GoTo /D (section.24.6) >> +<< /S /GoTo /D (subsection.18.6.2) >> endobj 1164 0 obj -(24.6 NTLMv2 Security) +(18.6.2 The [printer\044] Section is removed from Samba-3) endobj 1165 0 obj -<< /S /GoTo /D (section.24.7) >> +<< /S /GoTo /D (subsection.18.6.3) >> endobj 1168 0 obj -(24.7 Upgrading Samba) +(18.6.3 Creating the [print\044] Share) endobj 1169 0 obj -<< /S /GoTo /D (chapter.25) >> +<< /S /GoTo /D (subsection.18.6.4) >> endobj 1172 0 obj -(25 Unicode/Charsets) +(18.6.4 Parameters in the [print\044] Section) endobj 1173 0 obj -<< /S /GoTo /D (section.25.1) >> +<< /S /GoTo /D (subsection.18.6.5) >> endobj 1176 0 obj -(25.1 What are charsets and unicode?) +(18.6.5 Subdirectory Structure in [print\044]) endobj 1177 0 obj -<< /S /GoTo /D (section.25.2) >> +<< /S /GoTo /D (section.18.7) >> endobj 1180 0 obj -(25.2 Samba and charsets) +(18.7 Installing Drivers into [print\044]) endobj 1181 0 obj -<< /S /GoTo /D (section.25.3) >> +<< /S /GoTo /D (subsection.18.7.1) >> endobj 1184 0 obj -(25.3 Conversion from old names) +(18.7.1 Setting Drivers for existing Printers with a Client GUI) endobj 1185 0 obj -<< /S /GoTo /D (section.25.4) >> +<< /S /GoTo /D (subsection.18.7.2) >> endobj 1188 0 obj -(25.4 Japanese charsets) +(18.7.2 Setting Drivers for existing Printers with rpcclient) endobj 1189 0 obj -<< /S /GoTo /D (chapter.26) >> +<< /S /GoTo /D (subsubsection.18.7.2.1) >> endobj 1192 0 obj -(26 File and Record Locking) +(18.7.2.1 Identifying the Driver Files) endobj 1193 0 obj -<< /S /GoTo /D (section.26.1) >> +<< /S /GoTo /D (subsubsection.18.7.2.2) >> endobj 1196 0 obj -(26.1 Discussion) +(18.7.2.2 Collecting the Driver Files from a Windows Host's [print\044] Share) endobj 1197 0 obj -<< /S /GoTo /D (section.26.2) >> +<< /S /GoTo /D (subsubsection.18.7.2.3) >> endobj 1200 0 obj -(26.2 Samba Opportunistic Locking Control) +(18.7.2.3 Depositing the Driver Files into [print\044]) endobj 1201 0 obj -<< /S /GoTo /D (section.26.3) >> +<< /S /GoTo /D (subsubsection.18.7.2.4) >> endobj 1204 0 obj -(26.3 MS Windows Opportunistic Locking and Caching Controls) +(18.7.2.4 Check if the Driver Files are there \(with smbclient\)) endobj 1205 0 obj -<< /S /GoTo /D (subsection.26.3.1) >> +<< /S /GoTo /D (subsubsection.18.7.2.5) >> endobj 1208 0 obj -(26.3.1 Workstation Service Entries) +(18.7.2.5 Running rpcclient with adddriver) endobj 1209 0 obj -<< /S /GoTo /D (subsection.26.3.2) >> +<< /S /GoTo /D (subsubsection.18.7.2.6) >> endobj 1212 0 obj -(26.3.2 Server Service Entries) +(18.7.2.6 Check how Driver Files have been moved after adddriver finished) endobj 1213 0 obj -<< /S /GoTo /D (section.26.4) >> +<< /S /GoTo /D (subsubsection.18.7.2.7) >> endobj 1216 0 obj -(26.4 Persistent Data Corruption) +(18.7.2.7 Check if the Driver is recognized by Samba) endobj 1217 0 obj -<< /S /GoTo /D (section.26.5) >> +<< /S /GoTo /D (subsubsection.18.7.2.8) >> endobj 1220 0 obj -(26.5 Additional Reading) +(18.7.2.8 A side note: you are not bound to specific driver names) endobj 1221 0 obj -<< /S /GoTo /D (part.4) >> +<< /S /GoTo /D (subsubsection.18.7.2.9) >> endobj 1224 0 obj -(IV Troubleshooting) +(18.7.2.9 La Grande Finale: Running rpcclient with setdriver) endobj 1225 0 obj -<< /S /GoTo /D (chapter.27) >> +<< /S /GoTo /D (section.18.8) >> endobj 1228 0 obj -(27 The samba checklist) +(18.8 "The Proof of the Pudding lies in the Eating" \(Client Driver Install Procedure\)) endobj 1229 0 obj -<< /S /GoTo /D (section.27.1) >> +<< /S /GoTo /D (subsection.18.8.1) >> endobj 1232 0 obj -(27.1 Introduction) +(18.8.1 The first Client Driver Installation) endobj 1233 0 obj -<< /S /GoTo /D (section.27.2) >> +<< /S /GoTo /D (subsection.18.8.2) >> endobj 1236 0 obj -(27.2 Assumptions) +(18.8.2 IMPORTANT! Setting Device Modes on new Printers) endobj 1237 0 obj -<< /S /GoTo /D (section.27.3) >> +<< /S /GoTo /D (subsection.18.8.3) >> endobj 1240 0 obj -(27.3 The tests) +(18.8.3 Further Client Driver Install Procedures) endobj 1241 0 obj -<< /S /GoTo /D (section.27.4) >> +<< /S /GoTo /D (subsection.18.8.4) >> endobj 1244 0 obj -(27.4 Still having troubles?) +(18.8.4 Always make first Client Connection as root or "printer admin") endobj 1245 0 obj -<< /S /GoTo /D (chapter.28) >> +<< /S /GoTo /D (section.18.9) >> endobj 1248 0 obj -(28 Analysing and solving samba problems) +(18.9 Other Gotchas) endobj 1249 0 obj -<< /S /GoTo /D (section.28.1) >> +<< /S /GoTo /D (subsection.18.9.1) >> endobj 1252 0 obj -(28.1 Diagnostics tools) +(18.9.1 Setting Default Print Options for the Client Drivers) endobj 1253 0 obj -<< /S /GoTo /D (section.28.2) >> +<< /S /GoTo /D (subsection.18.9.2) >> endobj 1256 0 obj -(28.2 Installing 'Network Monitor' on an NT Workstation or a Windows 9x box) +(18.9.2 Supporting large Numbers of Printers) endobj 1257 0 obj -<< /S /GoTo /D (section.28.3) >> +<< /S /GoTo /D (subsection.18.9.3) >> endobj 1260 0 obj -(28.3 Useful URL's) +(18.9.3 Adding new Printers with the Windows NT APW) endobj 1261 0 obj -<< /S /GoTo /D (section.28.4) >> +<< /S /GoTo /D (subsection.18.9.4) >> endobj 1264 0 obj -(28.4 Getting help from the mailing lists) +(18.9.4 Weird Error Message Cannot connect under a different Name) endobj 1265 0 obj -<< /S /GoTo /D (section.28.5) >> +<< /S /GoTo /D (subsection.18.9.5) >> endobj 1268 0 obj -(28.5 How to get off the mailinglists) +(18.9.5 Be careful when assembling Driver Files) endobj 1269 0 obj -<< /S /GoTo /D (chapter.29) >> +<< /S /GoTo /D (subsection.18.9.6) >> endobj 1272 0 obj -(29 Reporting Bugs) +(18.9.6 Samba and Printer Ports) endobj 1273 0 obj -<< /S /GoTo /D (section.29.1) >> +<< /S /GoTo /D (subsection.18.9.7) >> endobj 1276 0 obj -(29.1 Introduction) +(18.9.7 Avoiding the most common Misconfigurations of the Client Driver) endobj 1277 0 obj -<< /S /GoTo /D (section.29.2) >> +<< /S /GoTo /D (section.18.10) >> endobj 1280 0 obj -(29.2 General info) +(18.10 The Imprints Toolset) endobj 1281 0 obj -<< /S /GoTo /D (section.29.3) >> +<< /S /GoTo /D (subsection.18.10.1) >> endobj 1284 0 obj -(29.3 Debug levels) +(18.10.1 What is Imprints?) endobj 1285 0 obj -<< /S /GoTo /D (section.29.4) >> +<< /S /GoTo /D (subsection.18.10.2) >> endobj 1288 0 obj -(29.4 Internal errors) +(18.10.2 Creating Printer Driver Packages) endobj 1289 0 obj -<< /S /GoTo /D (section.29.5) >> +<< /S /GoTo /D (subsection.18.10.3) >> endobj 1292 0 obj -(29.5 Attaching to a running process) +(18.10.3 The Imprints Server) endobj 1293 0 obj -<< /S /GoTo /D (section.29.6) >> +<< /S /GoTo /D (subsection.18.10.4) >> endobj 1296 0 obj -(29.6 Patches) +(18.10.4 The Installation Client) endobj 1297 0 obj -<< /S /GoTo /D (part.5) >> +<< /S /GoTo /D (section.18.11) >> endobj 1300 0 obj -(V Appendixes) +(18.11 Add Network Printers at Logon without User Interaction) endobj 1301 0 obj -<< /S /GoTo /D (chapter.30) >> +<< /S /GoTo /D (section.18.12) >> endobj 1304 0 obj -(30 How to compile SAMBA) +(18.12 The addprinter command) endobj 1305 0 obj -<< /S /GoTo /D (section.30.1) >> +<< /S /GoTo /D (section.18.13) >> endobj 1308 0 obj -(30.1 Access Samba source code via CVS) +(18.13 Migration of "Classical" printing to Samba-3) endobj 1309 0 obj -<< /S /GoTo /D (subsection.30.1.1) >> +<< /S /GoTo /D (section.18.14) >> endobj 1312 0 obj -(30.1.1 Introduction) +(18.14 Publishing Printer Information in Active Directory or LDAP) endobj 1313 0 obj -<< /S /GoTo /D (subsection.30.1.2) >> +<< /S /GoTo /D (section.18.15) >> endobj 1316 0 obj -(30.1.2 CVS Access to samba.org) +(18.15 Common Errors and Problems) endobj 1317 0 obj -<< /S /GoTo /D (subsubsection.30.1.2.1) >> +<< /S /GoTo /D (subsection.18.15.1) >> endobj 1320 0 obj -(30.1.2.1 Access via CVSweb) +(18.15.1 I give my root password but I don't get access) endobj 1321 0 obj -<< /S /GoTo /D (subsubsection.30.1.2.2) >> +<< /S /GoTo /D (subsection.18.15.2) >> endobj 1324 0 obj -(30.1.2.2 Access via cvs) +(18.15.2 My printjobs get spooled into the spooling directory, but then get lost) endobj 1325 0 obj -<< /S /GoTo /D (section.30.2) >> +<< /S /GoTo /D (chapter.19) >> endobj 1328 0 obj -(30.2 Accessing the samba sources via rsync and ftp) +(19 CUPS Printing Support in Samba 3.0) endobj 1329 0 obj -<< /S /GoTo /D (section.30.3) >> +<< /S /GoTo /D (section.19.1) >> endobj 1332 0 obj -(30.3 Verifying Samba's PGP signature) +(19.1 Introduction) endobj 1333 0 obj -<< /S /GoTo /D (section.30.4) >> +<< /S /GoTo /D (subsection.19.1.1) >> endobj 1336 0 obj -(30.4 Building the Binaries) +(19.1.1 Features and Benefits) endobj 1337 0 obj -<< /S /GoTo /D (subsection.30.4.1) >> +<< /S /GoTo /D (subsection.19.1.2) >> endobj 1340 0 obj -(30.4.1 Compiling samba with Active Directory support) +(19.1.2 Overview) endobj 1341 0 obj -<< /S /GoTo /D (subsubsection.30.4.1.1) >> +<< /S /GoTo /D (section.19.2) >> endobj 1344 0 obj -(30.4.1.1 Installing the required packages for Debian) +(19.2 Basic Configuration of CUPS support) endobj 1345 0 obj -<< /S /GoTo /D (subsubsection.30.4.1.2) >> +<< /S /GoTo /D (subsection.19.2.1) >> endobj 1348 0 obj -(30.4.1.2 Installing the required packages for RedHat) +(19.2.1 Linking of smbd with libcups.so) endobj 1349 0 obj -<< /S /GoTo /D (section.30.5) >> +<< /S /GoTo /D (subsection.19.2.2) >> endobj 1352 0 obj -(30.5 Starting the smbd and nmbd) +(19.2.2 Simple smb.conf Settings for CUPS) endobj 1353 0 obj -<< /S /GoTo /D (subsection.30.5.1) >> +<< /S /GoTo /D (subsection.19.2.3) >> endobj 1356 0 obj -(30.5.1 Starting from inetd.conf) +(19.2.3 More complex smb.conf Settings for CUPS) endobj 1357 0 obj -<< /S /GoTo /D (subsection.30.5.2) >> +<< /S /GoTo /D (section.19.3) >> endobj 1360 0 obj -(30.5.2 Alternative: starting it as a daemon) +(19.3 Advanced Configuration) endobj 1361 0 obj -<< /S /GoTo /D (chapter.31) >> +<< /S /GoTo /D (subsection.19.3.1) >> endobj 1364 0 obj -(31 Migration from NT4 PDC to Samba-3 PDC) +(19.3.1 Central spooling vs. "Peer-to-Peer" printing) endobj 1365 0 obj -<< /S /GoTo /D (section.31.1) >> +<< /S /GoTo /D (subsection.19.3.2) >> endobj 1368 0 obj -(31.1 Planning and Getting Started) +(19.3.2 CUPS/Samba as a "spooling-only" Print Server; "raw" printing with Vendor Drivers on Windows Clients) endobj 1369 0 obj -<< /S /GoTo /D (subsection.31.1.1) >> +<< /S /GoTo /D (subsection.19.3.3) >> endobj 1372 0 obj -(31.1.1 Objectives) +(19.3.3 Driver Installation Methods on Windows Clients) endobj 1373 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.1) >> +<< /S /GoTo /D (subsection.19.3.4) >> endobj 1376 0 obj -(31.1.1.1 Domain Layout) +(19.3.4 Explicitly enable "raw" printing for application/octet-stream!) endobj 1377 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.2) >> +<< /S /GoTo /D (subsection.19.3.5) >> endobj 1380 0 obj -(31.1.1.2 Server Share and Directory Layout) +(19.3.5 Three familiar Methods for driver upload plus a new one) endobj 1381 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.3) >> +<< /S /GoTo /D (section.19.4) >> endobj 1384 0 obj -(31.1.1.3 Logon Scripts) +(19.4 Using CUPS/Samba in an advanced Way -- intelligent printing with PostScript Driver Download) endobj 1385 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.4) >> +<< /S /GoTo /D (subsection.19.4.1) >> endobj 1388 0 obj -(31.1.1.4 Profile Migration/Creation) +(19.4.1 GDI on Windows -- PostScript on Unix) endobj 1389 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.5) >> +<< /S /GoTo /D (subsection.19.4.2) >> endobj 1392 0 obj -(31.1.1.5 User and Group Accounts) +(19.4.2 Windows Drivers, GDI and EMF) endobj 1393 0 obj -<< /S /GoTo /D (subsection.31.1.2) >> +<< /S /GoTo /D (subsection.19.4.3) >> endobj 1396 0 obj -(31.1.2 Steps In Migration Process) +(19.4.3 Unix Printfile Conversion and GUI Basics) endobj 1397 0 obj -<< /S /GoTo /D (section.31.2) >> +<< /S /GoTo /D (subsection.19.4.4) >> endobj 1400 0 obj -(31.2 Migration Options) +(19.4.4 PostScript and Ghostscript) endobj 1401 0 obj -<< /S /GoTo /D (subsection.31.2.1) >> +<< /S /GoTo /D (subsection.19.4.5) >> endobj 1404 0 obj -(31.2.1 Planning for Success) +(19.4.5 Ghostscript -- the Software RIP for non-PostScript Printers) endobj 1405 0 obj -<< /S /GoTo /D (subsection.31.2.2) >> +<< /S /GoTo /D (subsection.19.4.6) >> endobj 1408 0 obj -(31.2.2 Samba Implementation Choices) +(19.4.6 PostScript Printer Description \(PPD\) Specification) endobj 1409 0 obj -<< /S /GoTo /D (chapter.32) >> +<< /S /GoTo /D (subsection.19.4.7) >> endobj 1412 0 obj -(32 Portability) +(19.4.7 CUPS can use all Windows-formatted Vendor PPDs) endobj 1413 0 obj -<< /S /GoTo /D (section.32.1) >> +<< /S /GoTo /D (subsection.19.4.8) >> endobj 1416 0 obj -(32.1 HPUX) +(19.4.8 CUPS also uses PPDs for non-PostScript Printers) endobj 1417 0 obj -<< /S /GoTo /D (section.32.2) >> +<< /S /GoTo /D (section.19.5) >> endobj 1420 0 obj -(32.2 SCO Unix) +(19.5 The CUPS Filtering Architecture) endobj 1421 0 obj -<< /S /GoTo /D (section.32.3) >> +<< /S /GoTo /D (subsection.19.5.1) >> endobj 1424 0 obj -(32.3 DNIX) +(19.5.1 MIME types and CUPS Filters) endobj 1425 0 obj -<< /S /GoTo /D (section.32.4) >> +<< /S /GoTo /D (subsection.19.5.2) >> endobj 1428 0 obj -(32.4 RedHat Linux Rembrandt-II) +(19.5.2 MIME type Conversion Rules) endobj 1429 0 obj -<< /S /GoTo /D (section.32.5) >> +<< /S /GoTo /D (subsection.19.5.3) >> endobj 1432 0 obj -(32.5 AIX) +(19.5.3 Filter Requirements) endobj 1433 0 obj -<< /S /GoTo /D (subsection.32.5.1) >> +<< /S /GoTo /D (subsection.19.5.4) >> endobj 1436 0 obj -(32.5.1 Sequential Read Ahead) +(19.5.4 Prefilters) endobj 1437 0 obj -<< /S /GoTo /D (section.32.6) >> +<< /S /GoTo /D (subsection.19.5.5) >> endobj 1440 0 obj -(32.6 Solaris) +(19.5.5 pstops) endobj 1441 0 obj -<< /S /GoTo /D (subsection.32.6.1) >> +<< /S /GoTo /D (subsection.19.5.6) >> endobj 1444 0 obj -(32.6.1 Locking improvements) +(19.5.6 pstoraster) endobj 1445 0 obj -<< /S /GoTo /D (subsection.32.6.2) >> +<< /S /GoTo /D (subsection.19.5.7) >> endobj 1448 0 obj -(32.6.2 Winbind on Solaris 9) +(19.5.7 imagetops and imagetoraster) endobj 1449 0 obj -<< /S /GoTo /D (chapter.33) >> +<< /S /GoTo /D (subsection.19.5.8) >> endobj 1452 0 obj -(33 Samba and other CIFS clients) +(19.5.8 rasterto [printers specific]) endobj 1453 0 obj -<< /S /GoTo /D (section.33.1) >> +<< /S /GoTo /D (subsection.19.5.9) >> endobj 1456 0 obj -(33.1 Macintosh clients?) +(19.5.9 CUPS Backends) endobj 1457 0 obj -<< /S /GoTo /D (section.33.2) >> +<< /S /GoTo /D (subsection.19.5.10) >> endobj 1460 0 obj -(33.2 OS2 Client) +(19.5.10 cupsomatic/Foomatic -- how do they fit into the Picture?) endobj 1461 0 obj -<< /S /GoTo /D (subsection.33.2.1) >> +<< /S /GoTo /D (subsection.19.5.11) >> endobj 1464 0 obj -(33.2.1 How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?) +(19.5.11 The Complete Picture) endobj 1465 0 obj -<< /S /GoTo /D (subsection.33.2.2) >> +<< /S /GoTo /D (subsection.19.5.12) >> endobj 1468 0 obj -(33.2.2 How can I configure OS/2 Warp 3 \(not Connect\), OS/2 1.2, 1.3 or 2.x for Samba?) +(19.5.12 mime.convs) endobj 1469 0 obj -<< /S /GoTo /D (subsection.33.2.3) >> +<< /S /GoTo /D (subsection.19.5.13) >> endobj 1472 0 obj -(33.2.3 Are there any other issues when OS/2 \(any version\) is used as a client?) +(19.5.13 "Raw" printing) endobj 1473 0 obj -<< /S /GoTo /D (subsection.33.2.4) >> +<< /S /GoTo /D (subsection.19.5.14) >> endobj 1476 0 obj -(33.2.4 How do I get printer driver download working for OS/2 clients?) +(19.5.14 "application/octet-stream" printing) endobj 1477 0 obj -<< /S /GoTo /D (section.33.3) >> +<< /S /GoTo /D (subsection.19.5.15) >> endobj 1480 0 obj -(33.3 Windows for Workgroups) +(19.5.15 PostScript Printer Descriptions \(PPDs\) for non-PS Printers) endobj 1481 0 obj -<< /S /GoTo /D (subsection.33.3.1) >> +<< /S /GoTo /D (subsection.19.5.16) >> endobj 1484 0 obj -(33.3.1 Use latest TCP/IP stack from Microsoft) +(19.5.16 Difference between cupsomatic/foomatic-rip and native CUPS printing) endobj 1485 0 obj -<< /S /GoTo /D (subsection.33.3.2) >> +<< /S /GoTo /D (subsection.19.5.17) >> endobj 1488 0 obj -(33.3.2 Delete .pwl files after password change) +(19.5.17 Examples for filtering Chains) endobj 1489 0 obj -<< /S /GoTo /D (subsection.33.3.3) >> +<< /S /GoTo /D (subsection.19.5.18) >> endobj 1492 0 obj -(33.3.3 Configure WfW password handling) +(19.5.18 Sources of CUPS drivers / PPDs) endobj 1493 0 obj -<< /S /GoTo /D (subsection.33.3.4) >> +<< /S /GoTo /D (subsection.19.5.19) >> endobj 1496 0 obj -(33.3.4 Case handling of passwords) +(19.5.19 Printing with Interface Scripts) endobj 1497 0 obj -<< /S /GoTo /D (subsection.33.3.5) >> +<< /S /GoTo /D (section.19.6) >> endobj 1500 0 obj -(33.3.5 Use TCP/IP as default protocol) +(19.6 Network printing \(purely Windows\)) endobj 1501 0 obj -<< /S /GoTo /D (subsection.33.3.6) >> +<< /S /GoTo /D (subsection.19.6.1) >> endobj 1504 0 obj -(33.3.6 Speed improvement) +(19.6.1 From Windows Clients to an NT Print Server) endobj 1505 0 obj -<< /S /GoTo /D (section.33.4) >> +<< /S /GoTo /D (subsection.19.6.2) >> endobj 1508 0 obj -(33.4 Windows '95/'98) +(19.6.2 Driver Execution on the Client) endobj 1509 0 obj -<< /S /GoTo /D (subsection.33.4.1) >> +<< /S /GoTo /D (subsection.19.6.3) >> endobj 1512 0 obj -(33.4.1 Speed improvement) +(19.6.3 Driver Execution on the Server) endobj 1513 0 obj -<< /S /GoTo /D (section.33.5) >> +<< /S /GoTo /D (section.19.7) >> endobj 1516 0 obj -(33.5 Windows 2000 Service Pack 2) +(19.7 Network Printing \(Windows clients -- UNIX/Samba Print Servers\)) endobj 1517 0 obj -<< /S /GoTo /D (section.33.6) >> +<< /S /GoTo /D (subsection.19.7.1) >> endobj 1520 0 obj -(33.6 Windows NT 3.1) +(19.7.1 From Windows Clients to a CUPS/Samba Print Server) endobj 1521 0 obj -<< /S /GoTo /D (chapter.34) >> +<< /S /GoTo /D (subsection.19.7.2) >> endobj 1524 0 obj -(34 SWAT - The Samba Web Admininistration Tool) +(19.7.2 Samba receiving Jobfiles and passing them to CUPS) endobj 1525 0 obj -<< /S /GoTo /D (section.34.1) >> +<< /S /GoTo /D (section.19.8) >> endobj 1528 0 obj -(34.1 SWAT Features and Benefits) +(19.8 Network PostScript RIP: CUPS Filters on Server -- clients use PostScript Driver with CUPS-PPDs) endobj 1529 0 obj -<< /S /GoTo /D (subsection.34.1.1) >> +<< /S /GoTo /D (subsection.19.8.1) >> endobj 1532 0 obj -(34.1.1 Enabling SWAT for use) +(19.8.1 PPDs for non-PS Printers on UNIX) endobj 1533 0 obj -<< /S /GoTo /D (subsection.34.1.2) >> +<< /S /GoTo /D (subsection.19.8.2) >> endobj 1536 0 obj -(34.1.2 Securing SWAT through SSL) +(19.8.2 PPDs for non-PS Printers on Windows) endobj 1537 0 obj -<< /S /GoTo /D (subsection.34.1.3) >> +<< /S /GoTo /D (section.19.9) >> endobj 1540 0 obj -(34.1.3 The SWAT Home Page) +(19.9 Windows Terminal Servers \(WTS\) as CUPS Clients) endobj 1541 0 obj -<< /S /GoTo /D (subsection.34.1.4) >> +<< /S /GoTo /D (subsection.19.9.1) >> endobj 1544 0 obj -(34.1.4 Global Settings) +(19.9.1 Printer Drivers running in "Kernel Mode" cause many Problems) endobj 1545 0 obj -<< /S /GoTo /D (subsection.34.1.5) >> +<< /S /GoTo /D (subsection.19.9.2) >> endobj 1548 0 obj -(34.1.5 Share Settings) +(19.9.2 Workarounds impose Heavy Limitations) endobj 1549 0 obj -<< /S /GoTo /D (subsection.34.1.6) >> +<< /S /GoTo /D (subsection.19.9.3) >> endobj 1552 0 obj -(34.1.6 Printers Settings) +(19.9.3 CUPS: a "Magical Stone"?) endobj 1553 0 obj -<< /S /GoTo /D (subsection.34.1.7) >> +<< /S /GoTo /D (subsection.19.9.4) >> endobj 1556 0 obj -(34.1.7 The SWAT Wizard) +(19.9.4 PostScript Drivers with no major problems -- even in Kernel Mode) endobj 1557 0 obj -<< /S /GoTo /D (subsection.34.1.8) >> +<< /S /GoTo /D (section.19.10) >> endobj 1560 0 obj -(34.1.8 The Status Page) +(19.10 Setting up CUPS for driver Download) endobj 1561 0 obj -<< /S /GoTo /D (subsection.34.1.9) >> +<< /S /GoTo /D (subsection.19.10.1) >> endobj 1564 0 obj -(34.1.9 The View Page) +(19.10.1 cupsaddsmb: the unknown Utility) endobj 1565 0 obj -<< /S /GoTo /D (subsection.34.1.10) >> +<< /S /GoTo /D (subsection.19.10.2) >> endobj 1568 0 obj -(34.1.10 The Password Change Page) +(19.10.2 Prepare your smb.conf for cupsaddsmb) endobj 1569 0 obj -<< /S /GoTo /D (chapter.35) >> +<< /S /GoTo /D (subsection.19.10.3) >> endobj 1572 0 obj -(35 Samba performance issues) +(19.10.3 CUPS Package of "PostScript Driver for WinNT/2k/XP") endobj 1573 0 obj -<< /S /GoTo /D (section.35.1) >> +<< /S /GoTo /D (subsection.19.10.4) >> endobj 1576 0 obj -(35.1 Comparisons) +(19.10.4 Recognize the different Driver Files) endobj 1577 0 obj -<< /S /GoTo /D (section.35.2) >> +<< /S /GoTo /D (subsection.19.10.5) >> endobj 1580 0 obj -(35.2 Socket options) +(19.10.5 Acquiring the Adobe Driver Files) endobj 1581 0 obj -<< /S /GoTo /D (section.35.3) >> +<< /S /GoTo /D (subsection.19.10.6) >> endobj 1584 0 obj -(35.3 Read size) +(19.10.6 ESP Print Pro Package of "PostScript Driver for WinNT/2k/XP") endobj 1585 0 obj -<< /S /GoTo /D (section.35.4) >> +<< /S /GoTo /D (subsection.19.10.7) >> endobj 1588 0 obj -(35.4 Max xmit) +(19.10.7 Caveats to be considered) endobj 1589 0 obj -<< /S /GoTo /D (section.35.5) >> +<< /S /GoTo /D (subsection.19.10.8) >> endobj 1592 0 obj -(35.5 Log level) +(19.10.8 What are the Benefits of using the "CUPS PostScript Driver for Windows NT/2k/XP" as compared to the Adobe Driver?) endobj 1593 0 obj -<< /S /GoTo /D (section.35.6) >> +<< /S /GoTo /D (subsection.19.10.9) >> endobj 1596 0 obj -(35.6 Read raw) +(19.10.9 Run "cupsaddsmb" \(quiet Mode\)) endobj 1597 0 obj -<< /S /GoTo /D (section.35.7) >> +<< /S /GoTo /D (subsection.19.10.10) >> endobj 1600 0 obj -(35.7 Write raw) +(19.10.10 Run "cupsaddsmb" with verbose Output) endobj 1601 0 obj -<< /S /GoTo /D (section.35.8) >> +<< /S /GoTo /D (subsection.19.10.11) >> endobj 1604 0 obj -(35.8 Slow Logins) +(19.10.11 Understanding cupsaddsmb) endobj 1605 0 obj -<< /S /GoTo /D (section.35.9) >> +<< /S /GoTo /D (subsection.19.10.12) >> endobj 1608 0 obj -(35.9 Client tuning) +(19.10.12 How to recognize if cupsaddsm completed successfully) endobj 1609 0 obj -<< /S /GoTo /D [1610 0 R /Fit ] >> +<< /S /GoTo /D (subsection.19.10.13) >> endobj -1612 0 obj << -/Length 244 -/Filter /FlateDecode ->> -stream -xÚ‘OKÄ0Åïý9&‡Ž™™d’wñ ‚¹‰‡Ò]E¡[ÐzðÛ;Ý®®h „yyo2¿4^šÁscRˆŒ¦ë+oÕ¹ªð˜‘!† õ‚Yº5œÓRH°$SS€ÆË÷ÄÏd„“Ö¥:»$oȃ›òpˆ”í½]mÖ®F»r5‹Ø›—áy’»nœÎ'5hím÷Öïöc;> {w_®«‹r"O™¦€Ç¼„A0jB@ Ô -ÀAþ‚"±Åe%jÚ~lš¨7qjÒ¡_Ç9ºi%û> Òïuã_¼_8‘²òÄÿÕ©qeáendstream +1612 0 obj +(19.10.13 cupsaddsmb with a Samba PDC) endobj -1610 0 obj << -/Type /Page -/Contents 1612 0 R -/Resources 1611 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 1621 0 R ->> endobj -1613 0 obj << -/D [1610 0 R /XYZ 85.039 786.531 null] ->> endobj -1614 0 obj << -/D [1610 0 R /XYZ 85.039 766.606 null] ->> endobj -1611 0 obj << -/Font << /F20 1617 0 R /F21 1620 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -1624 0 obj << -/Length 1386 -/Filter /FlateDecode ->> -stream -xÚ•WMsã6 ½çWxrYyf¥H"%Y½õ3\¶ÓzÛC·ÚVlmdÑ#Éõ¦¿¾x©(v²“‹A|dÓ_2[dQ¬ÊY±È£L%³õþ*žmiåö*q:SQ¦5_X µN£\e³0MÊ(Ñ -J?,¯n~I²YGe\Ζ÷¬¼Üü,wu?U¼Vó0-K¿‹À>@V~ÍÈgm›¦ZÏÃ$jÛŠŠ½—ï¯ïæ´ñ¯å;¿e³™'Aåh V¾˜ýœ,­hÙ M1̇iºÇ jqæ`† -­([ÈþÅOÕ‰d؉%Œy›MGÒ£hj•=·ûÏòn:8Âx–Œß8/ÓÚ ú'>:1\kÇ‹Á~žã\¼jìáìoI¯Ði7²¡·òõÆê¡㎲ü -¯Á@ðu2­üËÑöÎÛoüÀô•,ñëй#D$û² € ,£ÒU‡ÑHÏ¿¢.ëRá%u™{úfyðÑv˜B—„ïJ¿î!¡+:iÐÂø±ðg±q'ó#TM3•¦â½½˜øÔ>eš>"Ç{ËÖÝÉ]µžÞe. úzôî^n0æ .N>""YÉ’ie"ÉUa¢ƒ{€pÄSndÕ °põórÌâ$É"Mà‡:Žr½DÇB·u¿ßJV«—²z7 ‡ïnnN§SÔ›ýÊD¶ÛÞ\ØHã(-’—iDEqé–^'ënç£ —»þÉeòqïA.Ÿb÷Z” f[ùä$h~k*ÃoTÉ‘2¦„áDMuiþìŽÆÉg‰LŠo¥Á3g7 “’àLÕ¸ÿu8_¼ç]ÕÈû"á• -þœ“‡UÛ´eëç6‹,RùG¿náíùö<ÊóÂïþO-ž¢7—ì¦Uú¡3fŠ(Õék!«â‹!Ð]„•¢‹«owý¶êL³Ï?ÄYL.ßÎw$JdñGÓ Õ¥ÙXEE¢¾ðHKÁÛų¸ZîÀ“:•zAuÑ„$MI΄¦j$¡Ù€Ö\å -—:íh颽«z¢´aäÂv=^ÑoÅšöÁiÊI)“œwlëQ$O/°Ö8Í$; SÌwæ©x:š ²¯ò’/EVgÚ²lÌwºC‰Z.˧¦Ú ­¡4ehܯ^1¹Ww†œ…âRÝ€Æ3Ê¥5Ø!)G.‡N_ÿçy‚¶sM… éÚŽH@Ž5æpV?¸œEªÖî:\a¸ô4Î9P•.ëà~EÂÄNGu$ŠÝl?>òªqÊ'/v¾ÒA,Š[­?ĉ¦¯/RN ´¶üì’\;êAʦ¬z°‰k»-ÎÑ5Mè²Eð½è¹‹ñ¸nû‰Ñõ3k<–ºÆ-Ó^¬²—5±Þ<õ´C/¤Ò!D459íº9ú–ŒË,¤Èt8z/ÓÎa0½Ð¤ŽÈ±õàÏ©ÚXð1‰¬qú8ó¿+gÏ®S·“ÎB¸Ù_LŒìý|óø=CJæ€55Ž,Ÿô×H…H¹Ø%wLÔ²†$¢*ƒþ8™#§¾íÜTv¬€ÙVÆ×Ë!ðc2“=ë§ÒÖ¹!=8‹ÎqÎMÛ;©p[:éúh²©FBðÐ_"²ò9Mun/éfc5’é± ‡k{ä¿ Z2ðv_·5 -þ`'ÿ·E*ÕQº ®×EÙâ«ÿÙü‡¨€©endstream +1613 0 obj +<< /S /GoTo /D (subsection.19.10.14) >> endobj -1623 0 obj << -/Type /Page -/Contents 1624 0 R -/Resources 1622 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 1621 0 R -/Annots [ 1629 0 R 1633 0 R 1634 0 R 1635 0 R ] ->> endobj -1629 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [210.406 523.32 332.67 535.312] -/Subtype/Link/A<> ->> endobj -1633 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.346 509.468 215.702 522.369] -/Subtype/Link/A<> ->> endobj -1634 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [220.377 509.468 289.612 522.369] -/Subtype/Link/A<> ->> endobj -1635 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [304.619 509.468 410.324 522.369] -/Subtype/Link/A<> ->> endobj -1625 0 obj << -/D [1623 0 R /XYZ 85.039 786.531 null] ->> endobj -1622 0 obj << -/Font << /F15 1628 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -1638 0 obj << -/Length 554 -/Filter /FlateDecode ->> -stream -xÚ¥TÁŽ›0½ó>šŽ1ؽµRi­¶]zÚîI¤`šöï;c“l’ÔC Æ3ofÞ›Œ„ÃO­—†d:eJ -RîN¶YbFpq&ÆØÏàå•“ -0wÁæLCöA¢$S‰œÏmð|=Wñ±„œKݶ‰âT²L+IδN.1·XÅ¥ò)_TJ 3©$ùÆ!òê…®êmц‘Ô’>ö6ŒmÊ:|Í‚Ïù[S¡&yÝ%3wåÇ‚ia|³ñê=|׌@#Nh -Ú‡Q¬i9íkdÔ…±¡¶°Mß!DÒ3´ìˆ;€Õ¬'xZ—Sy$:ºªüÉîjŸ¸|üî=˺«7ð>xZãmJïYÁ0ºÑ%)úƒ+ÁåÓ -,áó…ÀÓ5NT%̆ƙáÞ‚¥œÊ˜…Q§ô#èË@`Àü?þÔoðK(U£m€ Ø%–õ<Ð7‹vfw -·È½ò‰N=V:6PËÕ~«©és±㌢ÐÂ{Æ~Ê9Z5£°Åz²¡Sã8«3g¬Á;óž¢ó‡5¾Nì7øWNȱr#áWÃè»ÈÉëp¾2¡…½Ý; ÛË«­C÷°ãß–~¡ä…ÚY{ø°XG¶7¬¶‹Wúõ¸ØZf¿ë(´d<ïïq+ÅDš‘(Íb¸ Éýï€À+lþó;hÆ5.ϹØéêÌku!UÞªÀ §®5üw§endstream +1616 0 obj +(19.10.14 cupsaddsmb Flowchart) endobj -1637 0 obj << -/Type /Page -/Contents 1638 0 R -/Resources 1636 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 1621 0 R -/Annots [ 1643 0 R ] ->> endobj -1643 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [156.148 704.616 341.202 715.741] -/Subtype/Link/A<> ->> endobj -1639 0 obj << -/D [1637 0 R /XYZ 85.039 786.531 null] ->> endobj -1636 0 obj << -/Font << /F56 1642 0 R /F15 1628 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -1646 0 obj << -/Length 1747 -/Filter /FlateDecode ->> -stream -xÚíZ[s›F~÷¯Ð[ÑLDØ,OÛISwj§)ㇶDÂ2µ@qüïsÎÙ! Ë®u‰/šÌØ]­Ùóëw`þ±ŽV®'ÂN }W ÖN¼Îf>0»B*á*)á¾e²WÍö|îz2h[×¢ÓãÒ =Zq48xû÷:Üs}_t´r0úÛ9ÎÒ2NË¢ûïàƒ÷ƒùß©6‘Ü }Ùúž¡ë…°RhW†¢õe9s5Óæ$Õ;0æ†J5ßáÄíöÓÚùÓÆy4éö„ï;'iQÂ=s&Q™déí— L 2 ýÍ`>OVüE&noÅ„Ë»KæÜaÜ1+…ë‹€¤-•ný=ó]áË[bðœpá¥@ ¾”pè2ÏàüÌ͆tl’E‰c~àô£é—hY¾†ú^I,ÿQ¹$ ¾ŽjgX”©ÖƒâQ8êQ4ìòÀ¹ç€q6KGÝž -˜³Êó–/2 5·æÏ·°õmøæ\µ‰v Æv‘.ÃhÖ,츩Ð`“6ujÜ¢6èjáÄù4I3´Íl|š)ü§ÛPŠ°ÝomÂâö‰Ü+B•t;BÜ„óŒ ÇQÊù/âăžlÞJðÔ.À“¼þ) t„€Iç4./Ñðº=®Q6! ôµÚÕ.D@) ÔáhØ$¸ÁÒ&ÆÆŒíÙ,Æ`\"T{”~J¾EéýW ,gWÀFŠàiCð v``öaôy8¿8ÇÕø¤•sNÆ~§G˜¤­ÎoÌïqe’ò+;KÛ¼åoðØ®LóÌG|׸¤lÃÅ0ˆHµ  è®_m_džC<]M«˜¥óK"ØaŸØ¼qpIº0.Ìð;doÓ_ljsÞíÈò«_aŸ½®Ôÿ‘ÐËô&ZÏ€€G h ѱqŽ9ßð‚ÄÂ1ÁD©eÊ»¨jÇÎQT ñ‹5¥¹÷¨¦tR®Vv¦!¹b vFXvæ,›Æép•³<6RÈ.lSr§¹!aˆ’¹ùJ]ì¸ØÃÙÿfb@<Œ³•t s%׫Í[ÔtLŸx–Š~9œd6’ Y÷é’dþ¾Üow•lë½jQ³3ï²i”¤¬ÓØVö=ø?¶in™Õ^mpÛC´íˆ)êʦ‰Ñqfžœ>-˜T¨^°·¦v¨øö)„ª"Ï%<8MÍV¡/œx, }”u¾!“6R›Ä(4G…í‹”µ˜Ó¬«/A²4^Šà‹Öbó}“{¿¬ãô碩ŽFi³û57BL‰© u_’Öš‰IU!šð0õ—Áër-bû®«\Ë"dÆó¸<©bõ§€pZ^>ÿ¸+|j¶˜*ÛÜN>5©2Ë©ÅbÍÉgáŸíá#*|凱 ÷e-ÇoÌ“¹·Ó¯¹~_ëðÌ[­Ýb mg¡]ƒHGfù| -UŒ Þ&±*̼!G‚zMcÚ9‹ ãkÜ6C“¼"òQJ ºI>ž˜D.W‡/ýçÀ%ÞÑ€[/Ü©bp«ŸM¿ÅVª}Ë ’†Ì1E¿{6°)}Žl2ͪŽ~-ÃC§L†_…í[k¡›ÒÜt“«Ýx>ÙR”<$oL¼.WçïF£eÓÕõçß¾ÀFF_¹ ® -\¦Y1¯s³–hEüMj®dp]²؈ì‹y"ßÈYåòd¸c ™³¬Pž -ÕZÅ­'U£‚mW£ÛïÁyè‚Ú_äR.õendstream +1617 0 obj +<< /S /GoTo /D (subsection.19.10.15) >> endobj -1645 0 obj << -/Type /Page -/Contents 1646 0 R -/Resources 1644 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 1621 0 R -/Annots [ 1649 0 R 1650 0 R 1651 0 R 1652 0 R 1653 0 R 1654 0 R 1655 0 R 1656 0 R 1657 0 R 1658 0 R 1659 0 R 1660 0 R 1661 0 R 1662 0 R 1663 0 R 1664 0 R 1665 0 R 1666 0 R 1667 0 R 1668 0 R 1669 0 R 1670 0 R 1671 0 R 1672 0 R 1673 0 R 1674 0 R 1675 0 R 1676 0 R 1677 0 R 1678 0 R 1679 0 R 1680 0 R 1681 0 R 1682 0 R ] ->> endobj -1649 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [497.163 617.124 512.306 627.419] -/Subtype /Link -/A << /S /GoTo /D (part.1) >> ->> endobj -1650 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 592.666 512.306 602.234] -/Subtype /Link -/A << /S /GoTo /D (chapter.1) >> ->> endobj -1651 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 579.116 512.306 588.139] -/Subtype /Link -/A << /S /GoTo /D (section.1.1) >> ->> endobj -1652 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 565.567 512.306 574.59] -/Subtype /Link -/A << /S /GoTo /D (section.1.2) >> ->> endobj -1653 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 552.018 512.306 561.041] -/Subtype /Link -/A << /S /GoTo /D (section.1.3) >> ->> endobj -1654 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 538.469 512.306 547.492] -/Subtype /Link -/A << /S /GoTo /D (section.1.4) >> ->> endobj -1655 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 524.92 512.306 533.942] -/Subtype /Link -/A << /S /GoTo /D (section.1.5) >> ->> endobj -1656 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 511.37 512.306 520.393] -/Subtype /Link -/A << /S /GoTo /D (section.1.6) >> ->> endobj -1657 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 497.821 512.306 506.844] -/Subtype /Link -/A << /S /GoTo /D (section.1.7) >> ->> endobj -1658 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 473.363 512.306 482.931] -/Subtype /Link -/A << /S /GoTo /D (chapter.2) >> ->> endobj -1659 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 459.814 512.306 468.837] -/Subtype /Link -/A << /S /GoTo /D (section.2.1) >> ->> endobj -1660 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 446.265 512.306 455.287] -/Subtype /Link -/A << /S /GoTo /D (section.2.2) >> ->> endobj -1661 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 432.715 512.306 441.738] -/Subtype /Link -/A << /S /GoTo /D (subsection.2.2.1) >> ->> endobj -1662 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 419.166 512.306 428.189] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.2.2.1.1) >> ->> endobj -1663 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 405.617 512.306 414.64] -/Subtype /Link -/A << /S /GoTo /D (subsection.2.2.2) >> ->> endobj -1664 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 392.068 512.306 401.091] -/Subtype /Link -/A << /S /GoTo /D (section.2.3) >> ->> endobj -1665 0 obj << -/Type /Annot +1620 0 obj +(19.10.15 Installing the PostScript Driver on a Client) +endobj +1621 0 obj +<< /S /GoTo /D (subsection.19.10.16) >> +endobj +1624 0 obj +(19.10.16 Avoiding critical PostScript Driver Settings on the Client) +endobj +1625 0 obj +<< /S /GoTo /D (section.19.11) >> +endobj +1628 0 obj +(19.11 Installing PostScript Driver Files manually \(using rpcclient\)) +endobj +1629 0 obj +<< /S /GoTo /D (subsection.19.11.1) >> +endobj +1632 0 obj +(19.11.1 A Check of the rpcclient man Page) +endobj +1633 0 obj +<< /S /GoTo /D (subsection.19.11.2) >> +endobj +1636 0 obj +(19.11.2 Understanding the rpcclient man Page) +endobj +1637 0 obj +<< /S /GoTo /D (subsection.19.11.3) >> +endobj +1640 0 obj +(19.11.3 Producing an Example by querying a Windows Box) +endobj +1641 0 obj +<< /S /GoTo /D (subsection.19.11.4) >> +endobj +1644 0 obj +(19.11.4 What is required for adddriver and setdriver to succeed) +endobj +1645 0 obj +<< /S /GoTo /D (subsection.19.11.5) >> +endobj +1648 0 obj +(19.11.5 Manual Commandline Driver Installation in 15 little Steps) +endobj +1649 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.1) >> +endobj +1652 0 obj +(19.11.5.1 First Step: Install the Printer on CUPS) +endobj +1653 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.2) >> +endobj +1656 0 obj +(19.11.5.2 Second Step \(optional\): Check if the Printer is recognized by Samba) +endobj +1657 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.3) >> +endobj +1660 0 obj +(19.11.5.3 Third Step \(optional\): Check if Samba knows a Driver for the Printer) +endobj +1661 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.4) >> +endobj +1664 0 obj +(19.11.5.4 Fourth Step: Put all required Driver Files into Samba's [print\044]) +endobj +1665 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.5) >> +endobj +1668 0 obj +(19.11.5.5 Fifth Step: Verify where the Driver Files are now) +endobj +1669 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.6) >> +endobj +1672 0 obj +(19.11.5.6 Sixth Step: Tell Samba that these are Driver Files \(adddriver\)) +endobj +1673 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.7) >> +endobj +1676 0 obj +(19.11.5.7 Seventh Step: Verify where the Driver Files are now) +endobj +1677 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.8) >> +endobj +1680 0 obj +(19.11.5.8 Eighth Step \(optional\): Verify if Samba now recognizes the Driver) +endobj +1681 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.9) >> +endobj +1684 0 obj +(19.11.5.9 Ninth Step: Tell Samba which Printer should use these Driver Files \(setdriver\)) +endobj +1685 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.10) >> +endobj +1688 0 obj +(19.11.5.10 Tenth Step \(optional\): Verify if Samba has this Association recognized) +endobj +1689 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.11) >> +endobj +1692 0 obj +(19.11.5.11 Eleventh Step \(optional\): Tickle the Driver into a correct Device Mode) +endobj +1693 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.12) >> +endobj +1696 0 obj +(19.11.5.12 Twelfth Step: Install the Printer on a Client \("Point'n'Print"\)) +endobj +1697 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.13) >> +endobj +1700 0 obj +(19.11.5.13 Thirteenth Step \(optional\): Print a Test Page) +endobj +1701 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.14) >> +endobj +1704 0 obj +(19.11.5.14 Fourteenth Step \(recommended\): Study the Test Page) +endobj +1705 0 obj +<< /S /GoTo /D (subsubsection.19.11.5.15) >> +endobj +1708 0 obj +(19.11.5.15 Fifteenth Step \(obligatory\): Enjoy. Jump. Celebrate your Success) +endobj +1709 0 obj +<< /S /GoTo /D (subsection.19.11.6) >> +endobj +1712 0 obj +(19.11.6 Troubleshooting revisited) +endobj +1713 0 obj +<< /S /GoTo /D (section.19.12) >> +endobj +1716 0 obj +(19.12 The printing *.tdb Files) +endobj +1717 0 obj +<< /S /GoTo /D (subsection.19.12.1) >> +endobj +1720 0 obj +(19.12.1 Trivial DataBase Files) +endobj +1721 0 obj +<< /S /GoTo /D (subsection.19.12.2) >> +endobj +1724 0 obj +(19.12.2 Binary Format) +endobj +1725 0 obj +<< /S /GoTo /D (subsection.19.12.3) >> +endobj +1728 0 obj +(19.12.3 Losing *.tdb Files) +endobj +1729 0 obj +<< /S /GoTo /D (subsection.19.12.4) >> +endobj +1732 0 obj +(19.12.4 Using tdbbackup) +endobj +1733 0 obj +<< /S /GoTo /D (section.19.13) >> +endobj +1736 0 obj +(19.13 CUPS Print Drivers from Linuxprinting.org) +endobj +1737 0 obj +<< /S /GoTo /D (subsection.19.13.1) >> +endobj +1740 0 obj +(19.13.1 foomatic-rip and Foomatic explained) +endobj +1741 0 obj +<< /S /GoTo /D (subsubsection.19.13.1.1) >> +endobj +1744 0 obj +(19.13.1.1 690 "perfect" Printers) +endobj +1745 0 obj +<< /S /GoTo /D (subsubsection.19.13.1.2) >> +endobj +1748 0 obj +(19.13.1.2 How the "Printing HOWTO" started it all) +endobj +1749 0 obj +<< /S /GoTo /D (subsubsection.19.13.1.3) >> +endobj +1752 0 obj +(19.13.1.3 Foomatic's strange Name) +endobj +1753 0 obj +<< /S /GoTo /D (subsubsection.19.13.1.4) >> +endobj +1756 0 obj +(19.13.1.4 cupsomatic, pdqomatic, lpdomatic, directomatic) +endobj +1757 0 obj +<< /S /GoTo /D (subsubsection.19.13.1.5) >> +endobj +1760 0 obj +(19.13.1.5 7.13.1.5.The Grand Unification achieved...) +endobj +1761 0 obj +<< /S /GoTo /D (subsubsection.19.13.1.6) >> +endobj +1764 0 obj +(19.13.1.6 Driver Development outside) +endobj +1765 0 obj +<< /S /GoTo /D (subsubsection.19.13.1.7) >> +endobj +1768 0 obj +(19.13.1.7 Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and commercial Unix) +endobj +1769 0 obj +<< /S /GoTo /D (subsubsection.19.13.1.8) >> +endobj +1772 0 obj +(19.13.1.8 Foomatic Database generated PPDs) +endobj +1773 0 obj +<< /S /GoTo /D (subsection.19.13.2) >> +endobj +1776 0 obj +(19.13.2 foomatic-rip and Foomatic-PPD Download and Installation) +endobj +1777 0 obj +<< /S /GoTo /D (section.19.14) >> +endobj +1780 0 obj +(19.14 Page Accounting with CUPS) +endobj +1781 0 obj +<< /S /GoTo /D (subsection.19.14.1) >> +endobj +1784 0 obj +(19.14.1 Setting up Quotas) +endobj +1785 0 obj +<< /S /GoTo /D (subsection.19.14.2) >> +endobj +1788 0 obj +(19.14.2 Correct and incorrect Accounting) +endobj +1789 0 obj +<< /S /GoTo /D (subsection.19.14.3) >> +endobj +1792 0 obj +(19.14.3 Adobe and CUPS PostScript Drivers for Windows Clients) +endobj +1793 0 obj +<< /S /GoTo /D (subsection.19.14.4) >> +endobj +1796 0 obj +(19.14.4 The page\137log File Syntax) +endobj +1797 0 obj +<< /S /GoTo /D (subsection.19.14.5) >> +endobj +1800 0 obj +(19.14.5 Possible Shortcomings) +endobj +1801 0 obj +<< /S /GoTo /D (subsection.19.14.6) >> +endobj +1804 0 obj +(19.14.6 Future Developments) +endobj +1805 0 obj +<< /S /GoTo /D (subsection.19.14.7) >> +endobj +1808 0 obj +(19.14.7 Other Accounting Tools) +endobj +1809 0 obj +<< /S /GoTo /D (section.19.15) >> +endobj +1812 0 obj +(19.15 Additional Material) +endobj +1813 0 obj +<< /S /GoTo /D (section.19.16) >> +endobj +1816 0 obj +(19.16 Auto-Deletion or Preservation of CUPS Spool Files) +endobj +1817 0 obj +<< /S /GoTo /D (subsection.19.16.1) >> +endobj +1820 0 obj +(19.16.1 CUPS Configuration Settings explained) +endobj +1821 0 obj +<< /S /GoTo /D (subsection.19.16.2) >> +endobj +1824 0 obj +(19.16.2 Pre-conditions) +endobj +1825 0 obj +<< /S /GoTo /D (subsection.19.16.3) >> +endobj +1828 0 obj +(19.16.3 Manual Configuration) +endobj +1829 0 obj +<< /S /GoTo /D (section.19.17) >> +endobj +1832 0 obj +(19.17 When not to use Samba to print to CUPS) +endobj +1833 0 obj +<< /S /GoTo /D (section.19.18) >> +endobj +1836 0 obj +(19.18 In Case of Trouble.....) +endobj +1837 0 obj +<< /S /GoTo /D (subsection.19.18.1) >> +endobj +1840 0 obj +(19.18.1 Where to find Documentation) +endobj +1841 0 obj +<< /S /GoTo /D (subsection.19.18.2) >> +endobj +1844 0 obj +(19.18.2 How to ask for Help) +endobj +1845 0 obj +<< /S /GoTo /D (subsection.19.18.3) >> +endobj +1848 0 obj +(19.18.3 Where to find Help) +endobj +1849 0 obj +<< /S /GoTo /D (section.19.19) >> +endobj +1852 0 obj +(19.19 Appendix) +endobj +1853 0 obj +<< /S /GoTo /D (subsection.19.19.1) >> +endobj +1856 0 obj +(19.19.1 Printing from CUPS to Windows attached Printers) +endobj +1857 0 obj +<< /S /GoTo /D (subsection.19.19.2) >> +endobj +1860 0 obj +(19.19.2 More CUPS filtering Chains) +endobj +1861 0 obj +<< /S /GoTo /D (subsection.19.19.3) >> +endobj +1864 0 obj +(19.19.3 Trouble Shooting Guidelines to fix typical Samba printing Problems) +endobj +1865 0 obj +<< /S /GoTo /D (subsection.19.19.4) >> +endobj +1868 0 obj +(19.19.4 An Overview of the CUPS Printing Processes) +endobj +1869 0 obj +<< /S /GoTo /D (chapter.20) >> +endobj +1872 0 obj +(20 Stackable VFS modules) +endobj +1873 0 obj +<< /S /GoTo /D (section.20.1) >> +endobj +1876 0 obj +(20.1 Features and Benefits) +endobj +1877 0 obj +<< /S /GoTo /D (section.20.2) >> +endobj +1880 0 obj +(20.2 Discussion) +endobj +1881 0 obj +<< /S /GoTo /D (section.20.3) >> +endobj +1884 0 obj +(20.3 Included modules) +endobj +1885 0 obj +<< /S /GoTo /D (subsection.20.3.1) >> +endobj +1888 0 obj +(20.3.1 audit) +endobj +1889 0 obj +<< /S /GoTo /D (subsection.20.3.2) >> +endobj +1892 0 obj +(20.3.2 extd\137audit) +endobj +1893 0 obj +<< /S /GoTo /D (subsection.20.3.3) >> +endobj +1896 0 obj +(20.3.3 fake\137perms) +endobj +1897 0 obj +<< /S /GoTo /D (subsection.20.3.4) >> +endobj +1900 0 obj +(20.3.4 recycle) +endobj +1901 0 obj +<< /S /GoTo /D (subsection.20.3.5) >> +endobj +1904 0 obj +(20.3.5 netatalk) +endobj +1905 0 obj +<< /S /GoTo /D (section.20.4) >> +endobj +1908 0 obj +(20.4 VFS modules available elsewhere) +endobj +1909 0 obj +<< /S /GoTo /D (subsection.20.4.1) >> +endobj +1912 0 obj +(20.4.1 DatabaseFS) +endobj +1913 0 obj +<< /S /GoTo /D (subsection.20.4.2) >> +endobj +1916 0 obj +(20.4.2 vscan) +endobj +1917 0 obj +<< /S /GoTo /D (section.20.5) >> +endobj +1920 0 obj +(20.5 Common Errors) +endobj +1921 0 obj +<< /S /GoTo /D (chapter.21) >> +endobj +1924 0 obj +(21 Integrated Logon Support using Winbind) +endobj +1925 0 obj +<< /S /GoTo /D (section.21.1) >> +endobj +1928 0 obj +(21.1 Features and Benefits) +endobj +1929 0 obj +<< /S /GoTo /D (section.21.2) >> +endobj +1932 0 obj +(21.2 Introduction) +endobj +1933 0 obj +<< /S /GoTo /D (section.21.3) >> +endobj +1936 0 obj +(21.3 What Winbind Provides) +endobj +1937 0 obj +<< /S /GoTo /D (subsection.21.3.1) >> +endobj +1940 0 obj +(21.3.1 Target Uses) +endobj +1941 0 obj +<< /S /GoTo /D (section.21.4) >> +endobj +1944 0 obj +(21.4 How Winbind Works) +endobj +1945 0 obj +<< /S /GoTo /D (subsection.21.4.1) >> +endobj +1948 0 obj +(21.4.1 Microsoft Remote Procedure Calls) +endobj +1949 0 obj +<< /S /GoTo /D (subsection.21.4.2) >> +endobj +1952 0 obj +(21.4.2 Microsoft Active Directory Services) +endobj +1953 0 obj +<< /S /GoTo /D (subsection.21.4.3) >> +endobj +1956 0 obj +(21.4.3 Name Service Switch) +endobj +1957 0 obj +<< /S /GoTo /D (subsection.21.4.4) >> +endobj +1960 0 obj +(21.4.4 Pluggable Authentication Modules) +endobj +1961 0 obj +<< /S /GoTo /D (subsection.21.4.5) >> +endobj +1964 0 obj +(21.4.5 User and Group ID Allocation) +endobj +1965 0 obj +<< /S /GoTo /D (subsection.21.4.6) >> +endobj +1968 0 obj +(21.4.6 Result Caching) +endobj +1969 0 obj +<< /S /GoTo /D (section.21.5) >> +endobj +1972 0 obj +(21.5 Installation and Configuration) +endobj +1973 0 obj +<< /S /GoTo /D (subsection.21.5.1) >> +endobj +1976 0 obj +(21.5.1 Introduction) +endobj +1977 0 obj +<< /S /GoTo /D (subsection.21.5.2) >> +endobj +1980 0 obj +(21.5.2 Requirements) +endobj +1981 0 obj +<< /S /GoTo /D (subsection.21.5.3) >> +endobj +1984 0 obj +(21.5.3 Testing Things Out) +endobj +1985 0 obj +<< /S /GoTo /D (subsubsection.21.5.3.1) >> +endobj +1988 0 obj +(21.5.3.1 Configure and compile SAMBA) +endobj +1989 0 obj +<< /S /GoTo /D (subsubsection.21.5.3.2) >> +endobj +1992 0 obj +(21.5.3.2 Configure nsswitch.conf and the winbind libraries on Linux and Solaris) +endobj +1993 0 obj +<< /S /GoTo /D (subsubsection.21.5.3.3) >> +endobj +1996 0 obj +(21.5.3.3 NSS Winbind on AIX) +endobj +1997 0 obj +<< /S /GoTo /D (subsubsection.21.5.3.4) >> +endobj +2000 0 obj +(21.5.3.4 Configure smb.conf) +endobj +2001 0 obj +<< /S /GoTo /D (subsubsection.21.5.3.5) >> +endobj +2004 0 obj +(21.5.3.5 Join the SAMBA server to the PDC domain) +endobj +2005 0 obj +<< /S /GoTo /D (subsubsection.21.5.3.6) >> +endobj +2008 0 obj +(21.5.3.6 Start up the winbindd daemon and test it!) +endobj +2009 0 obj +<< /S /GoTo /D (subsubsection.21.5.3.7) >> +endobj +2012 0 obj +(21.5.3.7 Fix the init.d startup scripts) +endobj +2013 0 obj +<< /S /GoTo /D (subsubsection.21.5.3.8) >> +endobj +2016 0 obj +(21.5.3.8 Configure Winbind and PAM) +endobj +2017 0 obj +<< /S /GoTo /D (section.21.6) >> +endobj +2020 0 obj +(21.6 Conclusion) +endobj +2021 0 obj +<< /S /GoTo /D (section.21.7) >> +endobj +2024 0 obj +(21.7 Common Errors) +endobj +2025 0 obj +<< /S /GoTo /D (chapter.22) >> +endobj +2028 0 obj +(22 Advanced Network Management) +endobj +2029 0 obj +<< /S /GoTo /D (section.22.1) >> +endobj +2032 0 obj +(22.1 Features and Benefits) +endobj +2033 0 obj +<< /S /GoTo /D (section.22.2) >> +endobj +2036 0 obj +(22.2 Remote Server Administration) +endobj +2037 0 obj +<< /S /GoTo /D (section.22.3) >> +endobj +2040 0 obj +(22.3 Remote Desktop Management) +endobj +2041 0 obj +<< /S /GoTo /D (subsection.22.3.1) >> +endobj +2044 0 obj +(22.3.1 Remote Management from NoMachines.Com) +endobj +2045 0 obj +<< /S /GoTo /D (section.22.4) >> +endobj +2048 0 obj +(22.4 Network Logon Script Magic) +endobj +2049 0 obj +<< /S /GoTo /D (subsection.22.4.1) >> +endobj +2052 0 obj +(22.4.1 Adding printers without user intervention) +endobj +2053 0 obj +<< /S /GoTo /D (section.22.5) >> +endobj +2056 0 obj +(22.5 Common Errors) +endobj +2057 0 obj +<< /S /GoTo /D (chapter.23) >> +endobj +2060 0 obj +(23 System and Account Policies) +endobj +2061 0 obj +<< /S /GoTo /D (section.23.1) >> +endobj +2064 0 obj +(23.1 Features and Benefits) +endobj +2065 0 obj +<< /S /GoTo /D (section.23.2) >> +endobj +2068 0 obj +(23.2 Creating and Managing System Policies) +endobj +2069 0 obj +<< /S /GoTo /D (subsection.23.2.1) >> +endobj +2072 0 obj +(23.2.1 Windows 9x/Me Policies) +endobj +2073 0 obj +<< /S /GoTo /D (subsection.23.2.2) >> +endobj +2076 0 obj +(23.2.2 Windows NT4 Style Policy Files) +endobj +2077 0 obj +<< /S /GoTo /D (subsubsection.23.2.2.1) >> +endobj +2080 0 obj +(23.2.2.1 Registry Spoiling) +endobj +2081 0 obj +<< /S /GoTo /D (subsection.23.2.3) >> +endobj +2084 0 obj +(23.2.3 MS Windows 200x / XP Professional Policies) +endobj +2085 0 obj +<< /S /GoTo /D (subsubsection.23.2.3.1) >> +endobj +2088 0 obj +(23.2.3.1 Administration of Win2K / XP Policies) +endobj +2089 0 obj +<< /S /GoTo /D (section.23.3) >> +endobj +2092 0 obj +(23.3 Managing Account/User Policies) +endobj +2093 0 obj +<< /S /GoTo /D (subsection.23.3.1) >> +endobj +2096 0 obj +(23.3.1 Samba Editreg Toolset) +endobj +2097 0 obj +<< /S /GoTo /D (subsection.23.3.2) >> +endobj +2100 0 obj +(23.3.2 Windows NT4/200x) +endobj +2101 0 obj +<< /S /GoTo /D (subsection.23.3.3) >> +endobj +2104 0 obj +(23.3.3 Samba PDC) +endobj +2105 0 obj +<< /S /GoTo /D (section.23.4) >> +endobj +2108 0 obj +(23.4 System Startup and Logon Processing Overview) +endobj +2109 0 obj +<< /S /GoTo /D (section.23.5) >> +endobj +2112 0 obj +(23.5 Common Errors) +endobj +2113 0 obj +<< /S /GoTo /D (subsection.23.5.1) >> +endobj +2116 0 obj +(23.5.1 Policy Does Not Work) +endobj +2117 0 obj +<< /S /GoTo /D (chapter.24) >> +endobj +2120 0 obj +(24 Desktop Profile Management) +endobj +2121 0 obj +<< /S /GoTo /D (section.24.1) >> +endobj +2124 0 obj +(24.1 Features and Benefits) +endobj +2125 0 obj +<< /S /GoTo /D (section.24.2) >> +endobj +2128 0 obj +(24.2 Roaming Profiles) +endobj +2129 0 obj +<< /S /GoTo /D (subsection.24.2.1) >> +endobj +2132 0 obj +(24.2.1 Samba Configuration for Profile Handling) +endobj +2133 0 obj +<< /S /GoTo /D (subsubsection.24.2.1.1) >> +endobj +2136 0 obj +(24.2.1.1 NT4/200x User Profiles) +endobj +2137 0 obj +<< /S /GoTo /D (subsubsection.24.2.1.2) >> +endobj +2140 0 obj +(24.2.1.2 Windows 9x / Me User Profiles) +endobj +2141 0 obj +<< /S /GoTo /D (subsubsection.24.2.1.3) >> +endobj +2144 0 obj +(24.2.1.3 Mixed Windows 9x / Me and Windows NT4/200x User Profiles) +endobj +2145 0 obj +<< /S /GoTo /D (subsubsection.24.2.1.4) >> +endobj +2148 0 obj +(24.2.1.4 Disabling Roaming Profile Support) +endobj +2149 0 obj +<< /S /GoTo /D (subsection.24.2.2) >> +endobj +2152 0 obj +(24.2.2 Windows Client Profile Configuration Information) +endobj +2153 0 obj +<< /S /GoTo /D (subsubsection.24.2.2.1) >> +endobj +2156 0 obj +(24.2.2.1 Windows 9x / Me Profile Setup) +endobj +2157 0 obj +<< /S /GoTo /D (subsubsection.24.2.2.2) >> +endobj +2160 0 obj +(24.2.2.2 Windows NT4 Workstation) +endobj +2161 0 obj +<< /S /GoTo /D (subsubsection.24.2.2.3) >> +endobj +2164 0 obj +(24.2.2.3 Windows 2000/XP Professional) +endobj +2165 0 obj +<< /S /GoTo /D (subsection.24.2.3) >> +endobj +2168 0 obj +(24.2.3 Sharing Profiles between W9x/Me and NT4/200x/XP workstations) +endobj +2169 0 obj +<< /S /GoTo /D (subsection.24.2.4) >> +endobj +2172 0 obj +(24.2.4 Profile Migration from Windows NT4/200x Server to Samba) +endobj +2173 0 obj +<< /S /GoTo /D (subsubsection.24.2.4.1) >> +endobj +2176 0 obj +(24.2.4.1 Windows NT4 Profile Management Tools) +endobj +2177 0 obj +<< /S /GoTo /D (subsubsection.24.2.4.2) >> +endobj +2180 0 obj +(24.2.4.2 Side bar Notes) +endobj +2181 0 obj +<< /S /GoTo /D (subsubsection.24.2.4.3) >> +endobj +2184 0 obj +(24.2.4.3 moveuser.exe) +endobj +2185 0 obj +<< /S /GoTo /D (subsubsection.24.2.4.4) >> +endobj +2188 0 obj +(24.2.4.4 Get SID) +endobj +2189 0 obj +<< /S /GoTo /D (section.24.3) >> +endobj +2192 0 obj +(24.3 Mandatory profiles) +endobj +2193 0 obj +<< /S /GoTo /D (section.24.4) >> +endobj +2196 0 obj +(24.4 Creating/Managing Group Profiles) +endobj +2197 0 obj +<< /S /GoTo /D (section.24.5) >> +endobj +2200 0 obj +(24.5 Default Profile for Windows Users) +endobj +2201 0 obj +<< /S /GoTo /D (subsection.24.5.1) >> +endobj +2204 0 obj +(24.5.1 MS Windows 9x/Me) +endobj +2205 0 obj +<< /S /GoTo /D (subsubsection.24.5.1.1) >> +endobj +2208 0 obj +(24.5.1.1 How User Profiles Are Handled in Windows 9x / Me?) +endobj +2209 0 obj +<< /S /GoTo /D (subsection.24.5.2) >> +endobj +2212 0 obj +(24.5.2 MS Windows NT4 Workstation) +endobj +2213 0 obj +<< /S /GoTo /D (subsection.24.5.3) >> +endobj +2216 0 obj +(24.5.3 MS Windows 200x/XP) +endobj +2217 0 obj +<< /S /GoTo /D (section.24.6) >> +endobj +2220 0 obj +(24.6 Common Errors) +endobj +2221 0 obj +<< /S /GoTo /D (subsection.24.6.1) >> +endobj +2224 0 obj +(24.6.1 How does one set up roaming profiles for just one \(or a few\) user/s or group/s?) +endobj +2225 0 obj +<< /S /GoTo /D (subsection.24.6.2) >> +endobj +2228 0 obj +(24.6.2 Can NOT use Roaming Profiles) +endobj +2229 0 obj +<< /S /GoTo /D (subsection.24.6.3) >> +endobj +2232 0 obj +(24.6.3 Changing the default profile) +endobj +2233 0 obj +<< /S /GoTo /D (chapter.25) >> +endobj +2236 0 obj +(25 PAM based Distributed Authentication) +endobj +2237 0 obj +<< /S /GoTo /D (section.25.1) >> +endobj +2240 0 obj +(25.1 Features and Benefits) +endobj +2241 0 obj +<< /S /GoTo /D (section.25.2) >> +endobj +2244 0 obj +(25.2 Technical Discussion) +endobj +2245 0 obj +<< /S /GoTo /D (subsection.25.2.1) >> +endobj +2248 0 obj +(25.2.1 PAM Configuration Syntax) +endobj +2249 0 obj +<< /S /GoTo /D (subsubsection.25.2.1.1) >> +endobj +2252 0 obj +(25.2.1.1 Anatomy of /etc/pam.d Entries) +endobj +2253 0 obj +<< /S /GoTo /D (subsection.25.2.2) >> +endobj +2256 0 obj +(25.2.2 Example System Configurations) +endobj +2257 0 obj +<< /S /GoTo /D (subsubsection.25.2.2.1) >> +endobj +2260 0 obj +(25.2.2.1 PAM: original login config) +endobj +2261 0 obj +<< /S /GoTo /D (subsubsection.25.2.2.2) >> +endobj +2264 0 obj +(25.2.2.2 PAM: login using pam\137smbpass) +endobj +2265 0 obj +<< /S /GoTo /D (subsection.25.2.3) >> +endobj +2268 0 obj +(25.2.3 smb.conf PAM Configuration) +endobj +2269 0 obj +<< /S /GoTo /D (subsection.25.2.4) >> +endobj +2272 0 obj +(25.2.4 Remote CIFS Authentication using winbindd.so) +endobj +2273 0 obj +<< /S /GoTo /D (subsection.25.2.5) >> +endobj +2276 0 obj +(25.2.5 Password Synchronization using pam\137smbpass.so) +endobj +2277 0 obj +<< /S /GoTo /D (subsubsection.25.2.5.1) >> +endobj +2280 0 obj +(25.2.5.1 Password Synchronisation Configuration) +endobj +2281 0 obj +<< /S /GoTo /D (subsubsection.25.2.5.2) >> +endobj +2284 0 obj +(25.2.5.2 Password Migration Configuration) +endobj +2285 0 obj +<< /S /GoTo /D (subsubsection.25.2.5.3) >> +endobj +2288 0 obj +(25.2.5.3 Mature Password Configuration) +endobj +2289 0 obj +<< /S /GoTo /D (subsubsection.25.2.5.4) >> +endobj +2292 0 obj +(25.2.5.4 Kerberos Password Integration Configuration) +endobj +2293 0 obj +<< /S /GoTo /D (section.25.3) >> +endobj +2296 0 obj +(25.3 Common Errors) +endobj +2297 0 obj +<< /S /GoTo /D (subsection.25.3.1) >> +endobj +2300 0 obj +(25.3.1 pam\137winbind problem) +endobj +2301 0 obj +<< /S /GoTo /D (chapter.26) >> +endobj +2304 0 obj +(26 Integrating MS Windows networks with Samba) +endobj +2305 0 obj +<< /S /GoTo /D (section.26.1) >> +endobj +2308 0 obj +(26.1 Features and Benefits) +endobj +2309 0 obj +<< /S /GoTo /D (section.26.2) >> +endobj +2312 0 obj +(26.2 Background Information) +endobj +2313 0 obj +<< /S /GoTo /D (section.26.3) >> +endobj +2316 0 obj +(26.3 Name Resolution in a pure Unix/Linux world) +endobj +2317 0 obj +<< /S /GoTo /D (subsection.26.3.1) >> +endobj +2320 0 obj +(26.3.1 /etc/hosts) +endobj +2321 0 obj +<< /S /GoTo /D (subsection.26.3.2) >> +endobj +2324 0 obj +(26.3.2 /etc/resolv.conf) +endobj +2325 0 obj +<< /S /GoTo /D (subsection.26.3.3) >> +endobj +2328 0 obj +(26.3.3 /etc/host.conf) +endobj +2329 0 obj +<< /S /GoTo /D (subsection.26.3.4) >> +endobj +2332 0 obj +(26.3.4 /etc/nsswitch.conf) +endobj +2333 0 obj +<< /S /GoTo /D (section.26.4) >> +endobj +2336 0 obj +(26.4 Name resolution as used within MS Windows networking) +endobj +2337 0 obj +<< /S /GoTo /D (subsection.26.4.1) >> +endobj +2340 0 obj +(26.4.1 The NetBIOS Name Cache) +endobj +2341 0 obj +<< /S /GoTo /D (subsection.26.4.2) >> +endobj +2344 0 obj +(26.4.2 The LMHOSTS file) +endobj +2345 0 obj +<< /S /GoTo /D (subsection.26.4.3) >> +endobj +2348 0 obj +(26.4.3 HOSTS file) +endobj +2349 0 obj +<< /S /GoTo /D (subsection.26.4.4) >> +endobj +2352 0 obj +(26.4.4 DNS Lookup) +endobj +2353 0 obj +<< /S /GoTo /D (subsection.26.4.5) >> +endobj +2356 0 obj +(26.4.5 WINS Lookup) +endobj +2357 0 obj +<< /S /GoTo /D (section.26.5) >> +endobj +2360 0 obj +(26.5 Common Errors) +endobj +2361 0 obj +<< /S /GoTo /D (subsection.26.5.1) >> +endobj +2364 0 obj +(26.5.1 My Boomerang Won't Come Back) +endobj +2365 0 obj +<< /S /GoTo /D (subsection.26.5.2) >> +endobj +2368 0 obj +(26.5.2 Very Slow Network Connections) +endobj +2369 0 obj +<< /S /GoTo /D (subsection.26.5.3) >> +endobj +2372 0 obj +(26.5.3 Samba server name change problem) +endobj +2373 0 obj +<< /S /GoTo /D (chapter.27) >> +endobj +2376 0 obj +(27 Unicode/Charsets) +endobj +2377 0 obj +<< /S /GoTo /D (section.27.1) >> +endobj +2380 0 obj +(27.1 Features and Benefits) +endobj +2381 0 obj +<< /S /GoTo /D (section.27.2) >> +endobj +2384 0 obj +(27.2 What are charsets and unicode?) +endobj +2385 0 obj +<< /S /GoTo /D (section.27.3) >> +endobj +2388 0 obj +(27.3 Samba and charsets) +endobj +2389 0 obj +<< /S /GoTo /D (section.27.4) >> +endobj +2392 0 obj +(27.4 Conversion from old names) +endobj +2393 0 obj +<< /S /GoTo /D (section.27.5) >> +endobj +2396 0 obj +(27.5 Japanese charsets) +endobj +2397 0 obj +<< /S /GoTo /D (chapter.28) >> +endobj +2400 0 obj +(28 Samba Backup Techniques) +endobj +2401 0 obj +<< /S /GoTo /D (section.28.1) >> +endobj +2404 0 obj +(28.1 Note) +endobj +2405 0 obj +<< /S /GoTo /D (section.28.2) >> +endobj +2408 0 obj +(28.2 Features and Benefits) +endobj +2409 0 obj +<< /S /GoTo /D (chapter.29) >> +endobj +2412 0 obj +(29 High Availability Options) +endobj +2413 0 obj +<< /S /GoTo /D (section.29.1) >> +endobj +2416 0 obj +(29.1 Note) +endobj +2417 0 obj +<< /S /GoTo /D (part.4) >> +endobj +2420 0 obj +(IV Migration and Updating) +endobj +2421 0 obj +<< /S /GoTo /D (chapter.30) >> +endobj +2424 0 obj +(30 Upgrading from Samba-2.x to Samba-3.0.0) +endobj +2425 0 obj +<< /S /GoTo /D (section.30.1) >> +endobj +2428 0 obj +(30.1 Charsets) +endobj +2429 0 obj +<< /S /GoTo /D (section.30.2) >> +endobj +2432 0 obj +(30.2 Obsolete configuration options) +endobj +2433 0 obj +<< /S /GoTo /D (section.30.3) >> +endobj +2436 0 obj +(30.3 Password Backend) +endobj +2437 0 obj +<< /S /GoTo /D (chapter.31) >> +endobj +2440 0 obj +(31 Migration from NT4 PDC to Samba-3 PDC) +endobj +2441 0 obj +<< /S /GoTo /D (section.31.1) >> +endobj +2444 0 obj +(31.1 Planning and Getting Started) +endobj +2445 0 obj +<< /S /GoTo /D (subsection.31.1.1) >> +endobj +2448 0 obj +(31.1.1 Objectives) +endobj +2449 0 obj +<< /S /GoTo /D (subsubsection.31.1.1.1) >> +endobj +2452 0 obj +(31.1.1.1 Domain Layout) +endobj +2453 0 obj +<< /S /GoTo /D (subsubsection.31.1.1.2) >> +endobj +2456 0 obj +(31.1.1.2 Server Share and Directory Layout) +endobj +2457 0 obj +<< /S /GoTo /D (subsubsection.31.1.1.3) >> +endobj +2460 0 obj +(31.1.1.3 Logon Scripts) +endobj +2461 0 obj +<< /S /GoTo /D (subsubsection.31.1.1.4) >> +endobj +2464 0 obj +(31.1.1.4 Profile Migration/Creation) +endobj +2465 0 obj +<< /S /GoTo /D (subsubsection.31.1.1.5) >> +endobj +2468 0 obj +(31.1.1.5 User and Group Accounts) +endobj +2469 0 obj +<< /S /GoTo /D (subsection.31.1.2) >> +endobj +2472 0 obj +(31.1.2 Steps In Migration Process) +endobj +2473 0 obj +<< /S /GoTo /D (section.31.2) >> +endobj +2476 0 obj +(31.2 Migration Options) +endobj +2477 0 obj +<< /S /GoTo /D (subsection.31.2.1) >> +endobj +2480 0 obj +(31.2.1 Planning for Success) +endobj +2481 0 obj +<< /S /GoTo /D (subsection.31.2.2) >> +endobj +2484 0 obj +(31.2.2 Samba Implementation Choices) +endobj +2485 0 obj +<< /S /GoTo /D (chapter.32) >> +endobj +2488 0 obj +(32 SWAT - The Samba Web Administration Tool) +endobj +2489 0 obj +<< /S /GoTo /D (section.32.1) >> +endobj +2492 0 obj +(32.1 Features and Benefits) +endobj +2493 0 obj +<< /S /GoTo /D (subsection.32.1.1) >> +endobj +2496 0 obj +(32.1.1 Enabling SWAT for use) +endobj +2497 0 obj +<< /S /GoTo /D (subsection.32.1.2) >> +endobj +2500 0 obj +(32.1.2 Securing SWAT through SSL) +endobj +2501 0 obj +<< /S /GoTo /D (subsection.32.1.3) >> +endobj +2504 0 obj +(32.1.3 The SWAT Home Page) +endobj +2505 0 obj +<< /S /GoTo /D (subsection.32.1.4) >> +endobj +2508 0 obj +(32.1.4 Global Settings) +endobj +2509 0 obj +<< /S /GoTo /D (subsection.32.1.5) >> +endobj +2512 0 obj +(32.1.5 Share Settings) +endobj +2513 0 obj +<< /S /GoTo /D (subsection.32.1.6) >> +endobj +2516 0 obj +(32.1.6 Printers Settings) +endobj +2517 0 obj +<< /S /GoTo /D (subsection.32.1.7) >> +endobj +2520 0 obj +(32.1.7 The SWAT Wizard) +endobj +2521 0 obj +<< /S /GoTo /D (subsection.32.1.8) >> +endobj +2524 0 obj +(32.1.8 The Status Page) +endobj +2525 0 obj +<< /S /GoTo /D (subsection.32.1.9) >> +endobj +2528 0 obj +(32.1.9 The View Page) +endobj +2529 0 obj +<< /S /GoTo /D (subsection.32.1.10) >> +endobj +2532 0 obj +(32.1.10 The Password Change Page) +endobj +2533 0 obj +<< /S /GoTo /D (part.5) >> +endobj +2536 0 obj +(V Troubleshooting) +endobj +2537 0 obj +<< /S /GoTo /D (chapter.33) >> +endobj +2540 0 obj +(33 The Samba checklist) +endobj +2541 0 obj +<< /S /GoTo /D (section.33.1) >> +endobj +2544 0 obj +(33.1 Introduction) +endobj +2545 0 obj +<< /S /GoTo /D (section.33.2) >> +endobj +2548 0 obj +(33.2 Assumptions) +endobj +2549 0 obj +<< /S /GoTo /D (section.33.3) >> +endobj +2552 0 obj +(33.3 The tests) +endobj +2553 0 obj +<< /S /GoTo /D (section.33.4) >> +endobj +2556 0 obj +(33.4 Still having troubles?) +endobj +2557 0 obj +<< /S /GoTo /D (chapter.34) >> +endobj +2560 0 obj +(34 Analysing and solving samba problems) +endobj +2561 0 obj +<< /S /GoTo /D (section.34.1) >> +endobj +2564 0 obj +(34.1 Diagnostics tools) +endobj +2565 0 obj +<< /S /GoTo /D (section.34.2) >> +endobj +2568 0 obj +(34.2 Installing 'Network Monitor' on an NT Workstation or a Windows 9x box) +endobj +2569 0 obj +<< /S /GoTo /D (section.34.3) >> +endobj +2572 0 obj +(34.3 Useful URLs) +endobj +2573 0 obj +<< /S /GoTo /D (section.34.4) >> +endobj +2576 0 obj +(34.4 Getting help from the mailing lists) +endobj +2577 0 obj +<< /S /GoTo /D (section.34.5) >> +endobj +2580 0 obj +(34.5 How to get off the mailing lists) +endobj +2581 0 obj +<< /S /GoTo /D (chapter.35) >> +endobj +2584 0 obj +(35 Reporting Bugs) +endobj +2585 0 obj +<< /S /GoTo /D (section.35.1) >> +endobj +2588 0 obj +(35.1 Introduction) +endobj +2589 0 obj +<< /S /GoTo /D (section.35.2) >> +endobj +2592 0 obj +(35.2 General info) +endobj +2593 0 obj +<< /S /GoTo /D (section.35.3) >> +endobj +2596 0 obj +(35.3 Debug levels) +endobj +2597 0 obj +<< /S /GoTo /D (section.35.4) >> +endobj +2600 0 obj +(35.4 Internal errors) +endobj +2601 0 obj +<< /S /GoTo /D (section.35.5) >> +endobj +2604 0 obj +(35.5 Attaching to a running process) +endobj +2605 0 obj +<< /S /GoTo /D (section.35.6) >> +endobj +2608 0 obj +(35.6 Patches) +endobj +2609 0 obj +<< /S /GoTo /D (part.6) >> +endobj +2612 0 obj +(VI Appendixes) +endobj +2613 0 obj +<< /S /GoTo /D (chapter.36) >> +endobj +2616 0 obj +(36 How to compile SAMBA) +endobj +2617 0 obj +<< /S /GoTo /D (section.36.1) >> +endobj +2620 0 obj +(36.1 Access Samba source code via CVS) +endobj +2621 0 obj +<< /S /GoTo /D (subsection.36.1.1) >> +endobj +2624 0 obj +(36.1.1 Introduction) +endobj +2625 0 obj +<< /S /GoTo /D (subsection.36.1.2) >> +endobj +2628 0 obj +(36.1.2 CVS Access to samba.org) +endobj +2629 0 obj +<< /S /GoTo /D (subsubsection.36.1.2.1) >> +endobj +2632 0 obj +(36.1.2.1 Access via CVSweb) +endobj +2633 0 obj +<< /S /GoTo /D (subsubsection.36.1.2.2) >> +endobj +2636 0 obj +(36.1.2.2 Access via cvs) +endobj +2637 0 obj +<< /S /GoTo /D (section.36.2) >> +endobj +2640 0 obj +(36.2 Accessing the samba sources via rsync and ftp) +endobj +2641 0 obj +<< /S /GoTo /D (section.36.3) >> +endobj +2644 0 obj +(36.3 Verifying Samba's PGP signature) +endobj +2645 0 obj +<< /S /GoTo /D (section.36.4) >> +endobj +2648 0 obj +(36.4 Building the Binaries) +endobj +2649 0 obj +<< /S /GoTo /D (subsection.36.4.1) >> +endobj +2652 0 obj +(36.4.1 Compiling samba with Active Directory support) +endobj +2653 0 obj +<< /S /GoTo /D (subsubsection.36.4.1.1) >> +endobj +2656 0 obj +(36.4.1.1 Installing the required packages for Debian) +endobj +2657 0 obj +<< /S /GoTo /D (subsubsection.36.4.1.2) >> +endobj +2660 0 obj +(36.4.1.2 Installing the required packages for RedHat) +endobj +2661 0 obj +<< /S /GoTo /D (section.36.5) >> +endobj +2664 0 obj +(36.5 Starting the smbd and nmbd) +endobj +2665 0 obj +<< /S /GoTo /D (subsection.36.5.1) >> +endobj +2668 0 obj +(36.5.1 Starting from inetd.conf) +endobj +2669 0 obj +<< /S /GoTo /D (subsection.36.5.2) >> +endobj +2672 0 obj +(36.5.2 Alternative: starting it as a daemon) +endobj +2673 0 obj +<< /S /GoTo /D (section.36.6) >> +endobj +2676 0 obj +(36.6 Common Errors) +endobj +2677 0 obj +<< /S /GoTo /D (chapter.37) >> +endobj +2680 0 obj +(37 Portability) +endobj +2681 0 obj +<< /S /GoTo /D (section.37.1) >> +endobj +2684 0 obj +(37.1 HPUX) +endobj +2685 0 obj +<< /S /GoTo /D (section.37.2) >> +endobj +2688 0 obj +(37.2 SCO Unix) +endobj +2689 0 obj +<< /S /GoTo /D (section.37.3) >> +endobj +2692 0 obj +(37.3 DNIX) +endobj +2693 0 obj +<< /S /GoTo /D (section.37.4) >> +endobj +2696 0 obj +(37.4 RedHat Linux Rembrandt-II) +endobj +2697 0 obj +<< /S /GoTo /D (section.37.5) >> +endobj +2700 0 obj +(37.5 AIX) +endobj +2701 0 obj +<< /S /GoTo /D (subsection.37.5.1) >> +endobj +2704 0 obj +(37.5.1 Sequential Read Ahead) +endobj +2705 0 obj +<< /S /GoTo /D (section.37.6) >> +endobj +2708 0 obj +(37.6 Solaris) +endobj +2709 0 obj +<< /S /GoTo /D (subsection.37.6.1) >> +endobj +2712 0 obj +(37.6.1 Locking improvements) +endobj +2713 0 obj +<< /S /GoTo /D (subsection.37.6.2) >> +endobj +2716 0 obj +(37.6.2 Winbind on Solaris 9) +endobj +2717 0 obj +<< /S /GoTo /D (chapter.38) >> +endobj +2720 0 obj +(38 Samba and other CIFS clients) +endobj +2721 0 obj +<< /S /GoTo /D (section.38.1) >> +endobj +2724 0 obj +(38.1 Macintosh clients?) +endobj +2725 0 obj +<< /S /GoTo /D (section.38.2) >> +endobj +2728 0 obj +(38.2 OS2 Client) +endobj +2729 0 obj +<< /S /GoTo /D (subsection.38.2.1) >> +endobj +2732 0 obj +(38.2.1 How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?) +endobj +2733 0 obj +<< /S /GoTo /D (subsection.38.2.2) >> +endobj +2736 0 obj +(38.2.2 How can I configure OS/2 Warp 3 \(not Connect\), OS/2 1.2, 1.3 or 2.x for Samba?) +endobj +2737 0 obj +<< /S /GoTo /D (subsection.38.2.3) >> +endobj +2740 0 obj +(38.2.3 How do I get printer driver download working for OS/2 clients?) +endobj +2741 0 obj +<< /S /GoTo /D (section.38.3) >> +endobj +2744 0 obj +(38.3 Windows for Workgroups) +endobj +2745 0 obj +<< /S /GoTo /D (subsection.38.3.1) >> +endobj +2748 0 obj +(38.3.1 Use latest TCP/IP stack from Microsoft) +endobj +2749 0 obj +<< /S /GoTo /D (subsection.38.3.2) >> +endobj +2752 0 obj +(38.3.2 Delete .pwl files after password change) +endobj +2753 0 obj +<< /S /GoTo /D (subsection.38.3.3) >> +endobj +2756 0 obj +(38.3.3 Configure WfW password handling) +endobj +2757 0 obj +<< /S /GoTo /D (subsection.38.3.4) >> +endobj +2760 0 obj +(38.3.4 Case handling of passwords) +endobj +2761 0 obj +<< /S /GoTo /D (subsection.38.3.5) >> +endobj +2764 0 obj +(38.3.5 Use TCP/IP as default protocol) +endobj +2765 0 obj +<< /S /GoTo /D (subsection.38.3.6) >> +endobj +2768 0 obj +(38.3.6 Speed improvement) +endobj +2769 0 obj +<< /S /GoTo /D (section.38.4) >> +endobj +2772 0 obj +(38.4 Windows '95/'98) +endobj +2773 0 obj +<< /S /GoTo /D (subsection.38.4.1) >> +endobj +2776 0 obj +(38.4.1 Speed improvement) +endobj +2777 0 obj +<< /S /GoTo /D (section.38.5) >> +endobj +2780 0 obj +(38.5 Windows 2000 Service Pack 2) +endobj +2781 0 obj +<< /S /GoTo /D (section.38.6) >> +endobj +2784 0 obj +(38.6 Windows NT 3.1) +endobj +2785 0 obj +<< /S /GoTo /D (chapter.39) >> +endobj +2788 0 obj +(39 Samba Performance Tuning) +endobj +2789 0 obj +<< /S /GoTo /D (section.39.1) >> +endobj +2792 0 obj +(39.1 Comparisons) +endobj +2793 0 obj +<< /S /GoTo /D (section.39.2) >> +endobj +2796 0 obj +(39.2 Socket options) +endobj +2797 0 obj +<< /S /GoTo /D (section.39.3) >> +endobj +2800 0 obj +(39.3 Read size) +endobj +2801 0 obj +<< /S /GoTo /D (section.39.4) >> +endobj +2804 0 obj +(39.4 Max xmit) +endobj +2805 0 obj +<< /S /GoTo /D (section.39.5) >> +endobj +2808 0 obj +(39.5 Log level) +endobj +2809 0 obj +<< /S /GoTo /D (section.39.6) >> +endobj +2812 0 obj +(39.6 Read raw) +endobj +2813 0 obj +<< /S /GoTo /D (section.39.7) >> +endobj +2816 0 obj +(39.7 Write raw) +endobj +2817 0 obj +<< /S /GoTo /D (section.39.8) >> +endobj +2820 0 obj +(39.8 Slow Logins) +endobj +2821 0 obj +<< /S /GoTo /D (section.39.9) >> +endobj +2824 0 obj +(39.9 Client tuning) +endobj +2825 0 obj +<< /S /GoTo /D (section.39.10) >> +endobj +2828 0 obj +(39.10 Samba performance problem due changing kernel) +endobj +2829 0 obj +<< /S /GoTo /D (section.39.11) >> +endobj +2832 0 obj +(39.11 Corrupt tdb Files) +endobj +2833 0 obj +<< /S /GoTo /D (chapter.40) >> +endobj +2836 0 obj +(40 DNS and DHCP Configuration Guide) +endobj +2837 0 obj +<< /S /GoTo /D (section.40.1) >> +endobj +2840 0 obj +(40.1 Note) +endobj +2841 0 obj +<< /S /GoTo /D (chapter.41) >> +endobj +2844 0 obj +(41 Further Resources) +endobj +2845 0 obj +<< /S /GoTo /D (section.41.1) >> +endobj +2848 0 obj +(41.1 Websites) +endobj +2849 0 obj +<< /S /GoTo /D (section.41.2) >> +endobj +2852 0 obj +(41.2 Related updates from Microsoft) +endobj +2853 0 obj +<< /S /GoTo /D (section.41.3) >> +endobj +2856 0 obj +(41.3 Books) +endobj +2857 0 obj +<< /S /GoTo /D [2858 0 R /Fit ] >> +endobj +2860 0 obj << +/Length 233 +/Filter /FlateDecode +>> +stream +xÚ‘OK1 Åïó)r쓦M;Ç]ü ‚`oâAfWQÜÐÙƒßÞ–™]G^^ú~4¯ •Ã’t“b†~ß¼ç¦á™ðA0x_ô‚iO®eIC\‚4¢h[ô'ñë9=)X¥…S…×¹¹¸vŽPU ?‡ˆIáÄä탹_Ý®[ËfÕZQ5wÃ[-wý8]\Öj(šLÜïãÓø:ÚǼi®ò¹ÿ< ¥€²øÝ°gb +ÇÀÅk ç"a¾‹èjÚ’?k§fs|ÿš”£– Éý% ù÷2¾‘_endstream +endobj +2858 0 obj << +/Type /Page +/Contents 2860 0 R +/Resources 2859 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 2869 0 R +>> endobj +2861 0 obj << +/D [2858 0 R /XYZ 85.039 786.531 null] +>> endobj +2862 0 obj << +/D [2858 0 R /XYZ 85.039 766.606 null] +>> endobj +2859 0 obj << +/Font << /F20 2865 0 R /F21 2868 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2872 0 obj << +/Length 1451 +/Filter /FlateDecode +>> +stream +xÚWKÛ6¾ï¯0öRˆµ¢H½zë3A.)§=4=Ð×VV IŽ³ýõ)Ërâ Xäp83ü8/ŠE?±È“0’Å"ËÓ0‘bQîï¢ÅV^ß Ç¡&JÁø+‹«Dæa’ËÅj"áçõÝÃï"Yˆ(,¢b±~ôZ’4óL,ÖÕ?ÁzW÷Ë•Ì’`³\ÅY`á?ìÒTà×4OËåJ¶YŠ 18,‡Ú¶¼dùûæÝöÿ½~×ó\W•©x8Xþ¾×û%hÚ€Íâ+²âò¸'Éí2.‚AOä£ØÏøG빃†…<‹ºj£p¹JÒìRã¿ë·€ÙJ œa@§6';!§FYÏŽ|j[±"Öœ¦Á8g›{ ¦EÊðÊ¿­xCoùë•ÕCÿƒe y÷8“ÂðA”ô·Û;¯¿ñÝ^¢«¹#8@{YÇ5,9ŒZz+ÀÏàªBâõ©"öa>Ùç‘FÐa᯷e^扃†!Æ?‹ LÖN2Ý‚iš)5vþ7Z1±©€ŠX@LG{KÚäΔÓ3ï®ëëѺG>Á€8_#r Et_ÉKºå G”Á‰ +„#ÞeÅ«z@ w¿­Ç(Ž…U$I‡q¬8Ðq¡Û:Ž?'!ï¹Wv +y9 ù¹L<Æn?><œN§°×ûm·}˜#¥ÓL]3Ë:žçÊ„‹¬#¥ +³4¹0Á:ˆ¼"B÷¿~;ˆàž™0ÌôÖ¸àV€ïÑtцEòÂïo«"Ì┯1!ÝÇÝ F°Ø»!H$%¨B¡Tñ"‰r:èíñÜ« û5s™hÒ[Ó°/av‘2øk 1];æE[ºö€5J/m›]ç¹mÑ\ZôêJ],B™Éï„Âs¿ x&“ °è-ãð&äïšðàô+‚C?túÊ_#ªTÝ„ÃóܶJFY(.l‚¤5×G×Ú¾‰†ç~AïL&j~m:ÝT ÂÇ(‰àôoGºg ^üEwƒ¹2SÅ*Ùmñ<·›KBãB1 -d—ž…Q‘»¶“pTï1ÊÎÕw…¶óm•8N\ð”*ʃ«Å“«å¸Žm~Í—I9ê™6–—¶QñÛvÃç©¿”‚uÃÛ¶×-!R| @3öÐœ…œP莣ç;ê à0ŸGsfB# ™ÝeV;N5å:{ÄJ‘$c惭RTðÔR“sjL… ™¦ÏVo¨VbGE2ìDÖÚÊ0rðY\†Ã<)Š±4"O_ÿç3&l§- 8K{ë°bIÄ5*‰ÄN×`¹ä›Ò‡ +6UòÆGÉkø +;=íåd&¨PÂÄe} Eî¶oxÓ8æ ܾs@23nQký1 +¾¾syF¦ÒRšÝ#‰jq=8 U6¸IW£¿î]°ýJòà'æs'£qÝö¥å…6sŸ@þïPuÝ«@h'èpqª«s?Tκˆ‚¦±-›£on©kA*&´ó‘§-Ú†ƒéy&•ÅÖƒ—cؘ‘ÁkäæNýÄlãôÙÍ ëÖÛY1Íì^œhÞ{ ä,þ@ˆ€)9` 8Ñ'‰k7‚T"Uį +ø]¢’¦CH ÇéL)ìm禼cƒ˜my|¿vé‚Ô¹-½çeêºá«›Þ©Ck¥éÜŒ¤ò¢A6NdÄu`å‡#9óØSè¶[^tŠZ¤ô°\Ã0}pÅ8p€8Åôgžy¤ÑH0Cò³&Ñ=¤9:ó¡î(k°sá.ß²âø€íWS—“õ'̾œ¸.ž#ÊÖɧü¤žÔìw8ƒ%ïë¶Ææb°“'䬦ºG´LB%åw¿Ôÿ…à¿Îendstream +endobj +2871 0 obj << +/Type /Page +/Contents 2872 0 R +/Resources 2870 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 2869 0 R +/Annots [ 2877 0 R 2881 0 R 2882 0 R 2883 0 R ] +>> endobj +2877 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [210.406 518.803 332.67 530.796] +/Subtype/Link/A<> +>> endobj +2881 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.346 504.951 215.702 517.852] +/Subtype/Link/A<> +>> endobj +2882 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [220.377 504.951 304.46 517.852] +/Subtype/Link/A<> +>> endobj +2883 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [319.468 504.951 425.172 517.852] +/Subtype/Link/A<> +>> endobj +2873 0 obj << +/D [2871 0 R /XYZ 85.039 786.531 null] +>> endobj +2870 0 obj << +/Font << /F15 2876 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2886 0 obj << +/Length 3961 +/Filter /FlateDecode +>> +stream +xÚµ\msÛÆþ®_ÁäLy>¼NÇrì¨ve7µ•´3I>P$,1¦@$­øßw÷îîeaÄé4&ÁG»ÏÞí½à¢ ‡ÿE“2c<©&E™³,‰&ˇ >¹ƒ_®."…à“9gIUâoÿ»øùW>YæÝ…¼øŸ9‹ªjòp‘f ËÒD}ß\|ºøwoEþ–NzS¦›yœ'¬(³É<á¬,Scc‹”`g^dËÓÁ¯n.^|Ÿå“ŠUy2¹ù<‰KÎâ,žt˜›ÕÏÓëún±™Í“2™~Øîgóhº^Ö³_oÞ]¼¹éÍW«ÒrRÄs‡$ŽXUðÑuQT°"/€[ÿ÷‚Z” Ô¢8aqu.ÙÍýzÄâtºšEÓíl—Óåá¡FŽÍ,®¦ûÅ~½m’L{è°;„ì[ø´¾=À÷âoV‰šUÝÊoûûZþáՇ啫º©[¸ú€·ðŸÍz)¯\Cxšø£lú Ï8üxõÃ5|ŠäßOá°í¨ Kˆ(D‚³ŠWVe™¸Ë˜ÍæiœO/áþ +¸Áí#þý7ùmûÿ-€%˜ªñsLàóÍJxMÝ´øØt?oûJþ¡¸{´ô´[Âö`³œ~Z<ÌâbŠ7ºWvÛC»T¿®Ö»}‹.nû™¸Á9ë9£}w!¯,ùåÿéØÆGy@Ž+®‚‘‹`l›¹¸½㛤ÓÅÞTb”,‚¬)xySI½áíB|Ô•§Ðs .¤—èÒ3L"‘ûýþñ¯/^<==±Ï»ÏlÛÞ½Ø`^µ]½{q÷¸aûß-rI +ùÅó19#:ŒEIOÔ.ò*b)PCJ—³$žîeã'x ð4vVxÎʬœäEÎr°ëà‘±4Ke¾ÊK?ùa¿(†lŒ'sÍ’ s¬u$û¶Ù·± <æÃrT$jRÞÊAr· “xACS%.âV ‹Šå%rŒ¡áËÝ O’+úÐ’–û(Õا9‹‹|¢ Hþ¶î"h:ËÉ`Éö¦ –·‘ÖrV`¬o¯˜8_×Ø<Á¾ÙºÄtÄmDVµH,Eƒ¥¼´¹°ñ7+IÄŠ¤ÑõfI¦ˆÑéJ´Àó+ÊqõrÓ55Kä|/™Ãµ–-·VªÀ“æ`šˆg±hiQ0Ì ­¿{³žÏÓçȆÁ’?)ýc;KøôiœoEc²_l°«Ésh.Wò‡›YOëÝ^åÉåûW—ÖãÍ¡¿­R×-Ù²Œ3–•ñ‘‰’”,ÎK:S&˜*ƒ-"WL‡®dÑ^6(»¶~’ÄÍ êÑâå;!?¨•-PÅqìÏ–Ú’d̘H‰&¹›&ѯìDWwõËÖßbçbgGÎ8OÉv›Æ(?Æ†Ü ¢ž~ã¿I@!ȯ… *„rØ+ÄtèRˆæð]½yPåH$™þ4+SU5}¹]ÿæI uѤBŸÄ‹1iB$MÒ7M¢ßß~{„B²à3ë06£MŒú¥,ÉÊ€B_! +Tå°WˆéÐ¥Íá»­ìY…#Òኾiò„*„ýŠÅÁ±â£sðÜI†C—ø +nÍ’·àî0bá|¿hVóËͶ©»r\I·×ÂyBåbjÅŠ œâ=ªÀNR”#=(í0AÙ¶Ù›]²×ž§ÀQ ØgÃà)6·¾À¶88 +l„_ëÐŧÏñZÂ`ȯt A>ï?I}ÿ;µf%7e«Ý!Ä 5bSÈ^?¶_ú/]zwh»7ŽÀÊÕa½ªíú£¯•ãm9 ôÇæ4%y`3@‡ æÈ`‹ÈÓ¡+G4‡gÊj8GΆÁ“r„ˆÛ#&WŽh$ü9#’2¯ž#IKþ,Qш7s„ð_¨ýQ§&Î+¹L,œãà ÜɯðÊAÔm†•K0>,’Ê [·0ŽKã#“)®p-®Ä;L(™4[þd²:’IwxždQ &ÅÙ0xJ2Qqë“ÉâàH&„7™âß–zŽ»š%o2u1¨Z.·‡FmÏ}Û¨ º}?’O_‹1ø~q»Ø9ö‚:ò*rÝ€cÿ!gIQ™ ˜´¤wæv˜` ¶ˆ0ºr@sxî±Æˆtx¬AÑ7Mž0Ö BØ5,Ž±†ÎÁ;³˜e¡¥" äWˆÂB9ìb:t)Dsx–‰¬ÓðDÅÙ4yÒD¹~"Ëbá˜ÈÒYø…‘r–Q@È/ … +ƒrØ Ãtè†æð<3ß#ªá™oŠ´iò„™o*pýÌ·ÅÁ1ó­sð뤜G¡cùu¡0A]P{]˜]ºÐž©¬Ò©†Ë*‚³a𤲊ˆÛPV™\e•FÂ/‹:¾*zŒ_Ôá­—„áÍ¥ˆÁÛ¿D»ðu]«óØ@Ó¢Pçyˆ½â‚ØÊÓ:¶T+K¿Hr¨ ÓtDÞ/¦nÃ0(NÍÎ/ß¾~syý_†¥‘£7H'9ùÀ:ˆå[ïKÆfè’›ãùÏñ"fÉ_r+Œ˜æY<>ª}W¸#Mn$èF°â‡ñvÑt§ÃÀ—›õïÚð´Ýw®6˜g…ëʬXmñ1EyTáëüô†þÊÍ–?],‡Ž|Ѿ«ªùü¾[Z4¿ð„ÏÒ4.·âž$¾Çq¾<ÛÙÔ‹ƒ¯ ‰ +hô¢À»0È… †rØÆtè +Œæð,µèˆi¸¥8›&OªE©Èõµ¨ÅÂQ‹ê,¼K”, +­¶k ¿0&( Êa/ Ó¡KšÃóÔ#ªÁšƒâl<¥æ âÖ×GÍ¡“ðö+Q¹“?Ç+0š%o¿ÒaÄË×kqÂÍ_´iQˆÉËå^Îì¨7J‡—Mïå Úµü«K±ƒqYïäxDì ª÷²·ÙˆëVþž»nÝjŽ'(¥Gö7iIJœÞ&ßa‚Ù3Ø"²ÇtèÊÍᙲG§Î‚³að¤ì!â6dÉÁ•= £ +„ó(ðZòËBa‚² ö²0ºd¡9<ÏD5<À§H›&OàSëøÇ_çàoU#|·ÿ9–d5KþVUa´VÕh6?ÖKÙžªï×rÊ®,¿¨5$×{Iìºç{G¾§ñ´C§‚„3¡·D$‚áÍ•ƒ·3¥Æóˆ,ð36 ž’þ )`peÀ@ÀÛ0V1 r2Z Æ« iòÖiÁôæЂæíÜË%:ãðj ÁÝ0xÂZ ¼~©Ä$àX)ÑxUQrfÃ{ˆW’áªS„áÊ!ˆÁÕy*'d°nò³;¥fòǪ¯˜ ïŽzipï?ת„ñH`jbÀøOµ’à¡V„·þL+ÛëH«ÁÛ›VÍÃàœÌÇíNHàÁ1‡™¬"öðBךàY†AâñK0EÕ0ˆNëv½dmOñåý#¾3å:8”ƒ™4¡¢ÕA, +£©ˆ‘úÔh0²ç؉3òŸ¹ !ò@#<§Hî–çåâ Ì ×‰ …8xÆ$é8¸‹³<Ç>ܺ×áÿx*yõçŽ6Ÿ«3Ôñˆ‡ªUêlÔ\’°(Ư,Mä;1o.Ã÷ëp«·Äh„ÿ?šÒ’endstream +endobj +2885 0 obj << +/Type /Page +/Contents 2886 0 R +/Resources 2884 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 2869 0 R +/Annots [ 2891 0 R 2892 0 R 2899 0 R 2900 0 R 2901 0 R 2902 0 R 2903 0 R 2904 0 R 2905 0 R 2906 0 R 2907 0 R 2908 0 R 2909 0 R 2910 0 R 2911 0 R 2912 0 R 2913 0 R 2914 0 R 2915 0 R 2916 0 R 2917 0 R 2918 0 R 2919 0 R 2920 0 R 2921 0 R 2922 0 R 2923 0 R 2924 0 R 2925 0 R 2926 0 R 2927 0 R 2928 0 R 2929 0 R 2930 0 R 2931 0 R 2932 0 R 2933 0 R 2934 0 R 2935 0 R 2936 0 R 2937 0 R 2938 0 R 2939 0 R 2940 0 R 2941 0 R 2942 0 R 2943 0 R 2944 0 R 2945 0 R 2946 0 R ] +>> endobj +2891 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [156.148 700.189 341.202 711.314] +/Subtype/Link/A<> +>> endobj +2892 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 675.66 216.99 684.571] +/Subtype /Link +/A << /S /GoTo /D (IntroSMB) >> +>> endobj +2899 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [230.74 660.927 316.059 671.775] +/Subtype/Link/A<> +>> endobj +2900 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 650.068 262.89 658.979] +/Subtype /Link +/A << /S /GoTo /D (install) >> +>> endobj +2901 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [237.686 635.335 317 646.183] +/Subtype/Link/A<> +>> endobj +2902 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 623.38 316.308 634.228] +/Subtype/Link/A<> +>> endobj +2903 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 611.424 294.197 622.273] +/Subtype/Link/A<> +>> endobj +2904 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 586.673 240.908 597.522] +/Subtype /Link +/A << /S /GoTo /D (FastStart) >> +>> endobj +2905 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 573.878 294.197 584.726] +/Subtype/Link/A<> +>> endobj +2906 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 561.082 266.57 571.93] +/Subtype /Link +/A << /S /GoTo /D (ServerType) >> +>> endobj +2907 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [237.686 548.286 317 559.134] +/Subtype/Link/A<> +>> endobj +2908 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 536.331 316.308 547.179] +/Subtype/Link/A<> +>> endobj +2909 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 524.376 294.197 535.224] +/Subtype/Link/A<> +>> endobj +2910 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 513.517 186.188 522.428] +/Subtype /Link +/A << /S /GoTo /D (samba-pdc) >> +>> endobj +2911 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 498.784 294.197 509.632] +/Subtype/Link/A<> +>> endobj +2912 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [227.821 486.829 302.181 497.677] +/Subtype/Link/A<> +>> endobj +2913 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [229.606 474.874 321.068 485.722] +/Subtype/Link/A<> +>> endobj +2914 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 462.078 223.714 472.926] +/Subtype /Link +/A << /S /GoTo /D (samba-bdc) >> +>> endobj +2915 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 449.282 294.197 460.13] +/Subtype/Link/A<> +>> endobj +2916 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [237.52 438.874 364.24 448.175] +/Subtype/Link/A<> +>> endobj +2917 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 424.531 208.447 435.379] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> +>> endobj +2918 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 411.735 294.197 422.583] +/Subtype/Link/A<> +>> endobj +2919 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [231.487 399.78 297.241 410.628] +/Subtype/Link/A<> +>> endobj +2920 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [227.821 387.825 302.181 398.673] +/Subtype/Link/A<> +>> endobj +2921 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [237.686 375.87 317 386.718] +/Subtype/Link/A<> +>> endobj +2922 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 363.914 316.308 374.763] +/Subtype/Link/A<> +>> endobj +2923 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 353.056 206.025 361.967] +/Subtype /Link +/A << /S /GoTo /D (StandAloneServer) >> +>> endobj +2924 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 338.323 294.197 349.171] +/Subtype/Link/A<> +>> endobj +2925 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 325.527 310.315 336.375] +/Subtype /Link +/A << /S /GoTo /D (ClientConfig) >> +>> endobj +2926 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 312.731 294.197 323.579] +/Subtype/Link/A<> +>> endobj +2927 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 299.382 333.736 311.337] +/Subtype /Link +/A << /S /GoTo /D (NetworkBrowsing) >> +>> endobj +2928 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 287.139 294.197 297.988] +/Subtype/Link/A<> +>> endobj +2929 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 276.281 257.687 285.192] +/Subtype /Link +/A << /S /GoTo /D (passdb) >> +>> endobj +2930 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 261.548 316.308 272.396] +/Subtype/Link/A<> +>> endobj +2931 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [227.821 249.592 302.181 260.441] +/Subtype/Link/A<> +>> endobj +2932 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [231.487 237.637 297.241 248.486] +/Subtype/Link/A<> +>> endobj +2933 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 225.682 294.197 236.53] +/Subtype/Link/A<> +>> endobj +2934 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [261.348 213.173 347.359 225.129] +/Subtype/Link/A<> +>> endobj +2935 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 200.931 297.054 211.779] +/Subtype /Link +/A << /S /GoTo /D (groupmapping) >> +>> endobj +2936 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [227.821 176.18 302.181 187.028] +/Subtype/Link/A<> +>> endobj +2937 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 164.225 294.197 175.073] +/Subtype/Link/A<> +>> endobj +2938 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 151.429 303.302 162.277] +/Subtype /Link +/A << /S /GoTo /D (AccessControls) >> +>> endobj +2939 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 138.633 294.197 149.481] +/Subtype/Link/A<> +>> endobj +2940 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [231.487 126.678 297.241 137.526] +/Subtype/Link/A<> +>> endobj +2941 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 113.882 223.728 124.73] +/Subtype /Link +/A << /S /GoTo /D (locking) >> +>> endobj +2942 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [231.487 101.086 297.241 111.935] +/Subtype/Link/A<> +>> endobj +2943 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 89.131 316.308 99.979] +/Subtype/Link/A<> +>> endobj +2944 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 77.176 294.197 88.024] +/Subtype/Link/A<> +>> endobj +2945 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [221.386 65.221 310.94 76.069] +/Subtype/Link/A<> +>> endobj +2946 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 52.425 186.7 63.273] +/Subtype /Link +/A << /S /GoTo /D (securing-samba) >> +>> endobj +2887 0 obj << +/D [2885 0 R /XYZ 85.039 786.531 null] +>> endobj +2884 0 obj << +/Font << /F56 2890 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R /F11 2898 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2964 0 obj << +/Length 4158 +/Filter /FlateDecode +>> +stream +xÚµ\Ysã6~÷¯Ð£ü`„$xVmmÙ™É5ÉÌÎŽä!É-Ñ2cIt$zŽüúm\$ˆ£¡U¤JÕÄ–ÚÝïk4"žEð_<+3ÑjV”9Éh<[l.¢Ù +¾ùî"–Ñì*"´*Ùw]üöG4[‚Í› ñá'ø9"qUÍ6iFI–Rùûúâö⿃ñ]:\™a®Ò(!I?Ј”eê´‰iNhœÌ®Š,#yZ0£¯ï.¾ú6Ng©r:»{˜ÅiŽò™²¹[þ6ÿ=Š‹Ë?îÞ\|s7x‹³˜$Y9Ó|Ù¥0Óf9)•ðf»¼Œç»æÓå¥éüó|Ò²WÍåU<_¯"p®Š”$I±™™ˆZ’¼¤SÄì‹ÝJZ|а+k»é’Åíw-€\®šë}½¹LŠù=üZ“n·2Ñ8'Q”¢M¨llÚs›ŽŒ[&{¿H)É«$ÀÑÈÏidp`ˆÐÅ-à›îšuËøA?8+Iž÷ý®¶É‘§¤ ^n$Èn +ÕO aŒb6² >^&Õ¼Ò"©(I¢m7eccОØtä¦E”“’õ$Ž"uæ°Œ¤äö•øZEü ·J'’;£')‰´®”FʆAúaÛ7»e·©[Ù£y=ZAg¾ì{ñëø¦Y×}Ûm÷ðãcû¼·Z-+Hå~›uI :ÉÙð7!)Ä)Ê +—‚´ Jaô…HÁ è’‚ðLRС†¥€`6%¤ÝF)˜\RÐ@ø3d”‘’†ÆÐÑÈO i¤p …ÐE -à‡ú¡^ RÜBûþÍ8±àÿ6ûm[?9†Oz^ø‡O0L °Èð)¬QئKwÓnÚI 6êÛ£gAʈ¢§ll“ÑsêM“G¡¾¢'H“š'ošT6 Ò÷ݾo·+‘kö¿|þ–¥ÌÅŽujÇc÷ æë”ßÞ¿ôÍR|ð-³\7â—Û/̸ç\ØOý®‘_v2ßÖ›ûÚjt¨x“*s5ƒ-Ì´$« ɲyOcTNÊ&$'Í—_NV@‡œô€·,ɶ¼¶Û³†{Òú‘1t-*R6H9’-…d‹dÛ’c:ÅŒ¤[a¢7]²¸JO5`¼æøÙ%|@mµiToJibcѵ5uƒK+ω{vóÿ*kpä–0ax^±~«÷{.%ž1AïwíV©-Ÿß¾<³&ƒh4ï.áŸ]o§Çˆdu<…ÕpLSÒø@]d)‰’×…´ êbô…è èÒ…ðÇ6Së…Þ?p @[±Ö,™CðÇy™zCµfS°~AHk¶é’Å}z€MË1^³ie½}ºÌrn–JÇÓJ:$ËÑ6T66˜I%2u„V"yš¨ ŠŒF~ŠH› E°€EÌ€.Šh¿kvõšC4™¿â¹‡ 转R]Õ)k $a–q1EŠ&Lfb6]ò +µÙ1_“ø(&q™¡-§ll“T9u„çJVS'É)’åèÉŸ-¥ O—?¿‡¦¸5‚H“böÁJ4•-Y¦Œ‡LÉMµÉ¨,¸-%‘ÕÁ% ˜,‘ÚhS2…áåàTç$ƽ¤IP%ƒ'D$F4—FÆhgË¢Ò’¨³áð¥PëÔ@âJ #þŒ`¨…ÇÀy1ù‰!m‚ÌÀÔ0º¸¡|Õ>óÅÏZÎñiÿn¹ê^ÉjnêOž”ZS˜ÈNX£€M—°@È8}½ºgH¼“¸ˆTŽR66ŒÉ$nêh …Ѽ1äVÙ:¿GYÄ—™kV ‚jož”›UÐ}yz‚”«yò¦\eç}½xº„„Zß‹\>ÿ…e‡oeÞ°žgÜå˺±WÆ’ˆÏ`µ5äÞ²L˧YQò0Ý(›n4_~ÝXºÑ¾iÖYdÝ\–©\ÛŠ&ƒ~ïÚ?+! $;DE9ÉFЈŠ„5 +ßt)J€¿;`!ŒAšPÙØ&š:B3k–³,\2ù"m‚ Á 1º¢<ÏÒéjpéÃl84pxh3 ë¡µ€·lœÞð¥ÄqÕ¸Û-ø*¡ø„˜Ý®]ñZ^-.|àKb&ýr“IÛàÛß0à”•sóûJùB)É)“'Ú?±]®Íq¬¾¹y hß~ãèUwÒˆ¤¡ RÍÈßÒ&ØXÀ¡;Í€®îÔÞ¬›Ï5æ–þ¾æ}ËÛ¤cÿ|~ú2é^V§µ¡î­ +Ñ\‡~|÷J_è#Ò("Q’MqÛôu_³å»'!×å0ª/ø'ÚËqI2ˆŠ÷òhäïeiìe,àÐËf@W/ko{5U|àó/Ñgo›žoôlê#•ÍnìgøèçgÞT|âÖ7¢¸æ…_X ¿îÛgµ{6›nø;^núZÕÍQF²2;EÝ7õ¶Ù¶6-JJ²Â?%OK¨!Š)L?-¤5 +ØtÉ⮚~[¯®‡¬Á˜ÌÖ?)‡Î0­Y&±H’2õh+*”NÃNÖäy(ŒF~’H› I°€IÌ€.’hϽŠ3^ÅÁà›.XÅÁšpXű08Vqt ~†¤))ãPü ‘6A†`†˜] Ñžgg5¸Šƒa6³ŠƒµÛ°Šcap¬âè ¼»‹)I™Ÿâ,¨æÉ[²+^3,?ÖÛ…*Øßñµ‡ž-}º +õ'yö©†TÜlš­}#¡$Ï]á8 +šÓKs˜yUø%iÔÁà ‘Í¥‚1Ú™D á kÀxêî(ø[l€ÀÅÿŸþ0¥«²êô=ùé/møtþ˾W'òê­TÁÍbѽlåôô=CÇç2‹Ö±×òNãÂõ6Ñ¢’ÄQvØf…ö‹"|ùRلȯùò³ß +è ¿ð<üŸ@ +Ãl80+G-ùrP¹c4vfeìz›}qD’¼:PyúÁj”MP£/Df@—$´€g’„5, ³áð(I í6JÂÄà’„Â/‰,%qvŠÃßš'¿$¤ ƒôþ²Jæ7oåï뽨òùkuJÈ8î}Ã×7ûG¨ŽÚEÍ‹t[»#@M]å !ØzÒŠ¦1oTTÒ&¨ŒÑ¢ 3 KZÀ3)C‡V‚Ùpx”2v•abp)CáHR ‰6@‹ÑÈO i¤p …ÐE -ปÂö;@<‚ ?ÕÛHŽ}îxk¦„Iõ¯W²çªè/²0%¬Qä¦KWìåíÖ\ç×[õ}óù™¯Áò]š=Ù6½½4µ@Š÷ ²±aM–¦¦ŽðLçü=’dÒÑ“?“J}ShØây;gýu8ʺìø¤s/>gÍ3ÏO—á֧½È¿ŸÚþq8Ô +|Ï×­6N +’Χ¶ÉËOiøn"(vÇ%m‚Š}!Š2º¥Á·¿¥IPƒ'DF4—Æhg’€†3¬?à©»£øïo±‘þûG~òG)’S¼]®yò“_Úðºù¦›Ëaºù°ëä®öþgñ]ßMæ’ǫ̃ÙבýÒiÅ*eÇCÙÔƒr²ªÊÃÄèZø.² ÉAóå׃Ð!=๫ê èpUÁ7]QUcM8TÕGU­cðJ$.X¡qŠ5Í“W"ʆAâט¬vbíD^L"—¬'š)æïîR¹ôú•¼¸D½±0(ŠÊ+øÚø+»mÙeX…ëiÚ i™¨jóßR6A팾í˜]ÚÑžg4™@ 'fÃá1 +ÖnÈbap ):¿`Ø7'y _ó䌴áÓŠ_ù~›>Ü =\ Òßñ«iMre“ÕYͽ,–›v+7øjÃl$‘Ë;ÝÚ^¤lâxd› lj:âÐŒT¾Ž£l‚ª}!ª1ºT£<“jt¨aÕ ˜ ‡G©i·Q5&—j4~Õ“¢“ˆfpä׌0á«-qûD1gë™|Öͧåk¡ «™ØFQånµV“¨*›€³³Q`æ¡l‚Ì}!Ì7º˜¯<ëùý âðù} »éò¸óûXç÷-Žóû: ï +fU’8tîv´ñòCš„èESì0£9È¡E;w®#—ávÃáE8ÒxC np”àoj,3ç§H£#oj”&Bèõú ¿ÿl¸^P=ä— +®?šWüìõÍNþÉ3ßíî×ü(–½z5A”%Ž't0’]àzàݬ IðÚAX/àT~ë7§¡\—o¡Îrᕆ1|Ý•íÔÝQW]ù[k¸èʈï¸æjŒÜÞM¼¼GÙ w÷p“ðÕ=þhãÍ=Óh΋{†hçN’:âp’D°H’Hã IÒàH’‹ò®}(1SJÝWíÇì–üêŸ]µ%ã\ñÛK'KÿìŠ!¨Ù›­”’8)†75ñfP–d%uþyÎ^9endstream +endobj +2963 0 obj << +/Type /Page +/Contents 2964 0 R +/Resources 2962 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 2869 0 R +/Annots [ 2966 0 R 2967 0 R 2968 0 R 2969 0 R 2970 0 R 2971 0 R 2972 0 R 2973 0 R 2974 0 R 2975 0 R 2976 0 R 2977 0 R 2978 0 R 2979 0 R 2980 0 R 2981 0 R 2982 0 R 2983 0 R 2984 0 R 2985 0 R 2986 0 R 2987 0 R 2988 0 R 2989 0 R 2990 0 R 2991 0 R 2992 0 R 2993 0 R 2994 0 R 2995 0 R 2996 0 R 2997 0 R 2998 0 R 2999 0 R 3000 0 R 3001 0 R 3002 0 R 3003 0 R 3004 0 R 3005 0 R 3006 0 R 3007 0 R 3008 0 R 3009 0 R 3010 0 R 3011 0 R 3012 0 R 3013 0 R 3014 0 R 3015 0 R 3016 0 R 3017 0 R ] +>> endobj +2966 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [237.686 752.714 317 763.562] +/Subtype/Link/A<> +>> endobj +2967 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 740.759 294.197 751.607] +/Subtype/Link/A<> +>> endobj +2968 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 727.807 258.955 738.655] +/Subtype /Link +/A << /S /GoTo /D (InterdomainTrusts) >> +>> endobj +2969 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 714.856 294.197 725.704] +/Subtype/Link/A<> +>> endobj +2970 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [238.932 702.901 318.799 713.749] +/Subtype/Link/A<> +>> endobj +2971 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 689.949 386.292 700.797] +/Subtype /Link +/A << /S /GoTo /D (msdfs) >> +>> endobj +2972 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [227.198 676.998 308.477 687.846] +/Subtype/Link/A<> +>> endobj +2973 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 664.046 231.549 674.894] +/Subtype /Link +/A << /S /GoTo /D (printing) >> +>> endobj +2974 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [218.149 651.095 297.352 661.943] +/Subtype/Link/A<> +>> endobj +2975 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [227.821 639.14 302.181 649.988] +/Subtype/Link/A<> +>> endobj +2976 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 626.188 284.75 637.036] +/Subtype /Link +/A << /S /GoTo /D (CUPS-printing) >> +>> endobj +2977 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [218.149 613.237 297.352 624.085] +/Subtype/Link/A<> +>> endobj +2978 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [232.401 600.728 311.908 612.683] +/Subtype/Link/A<> +>> endobj +2979 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 590.267 221.19 599.178] +/Subtype /Link +/A << /S /GoTo /D (VFS) >> +>> endobj +2980 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 575.379 316.308 586.227] +/Subtype/Link/A<> +>> endobj +2981 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 563.424 294.197 574.272] +/Subtype/Link/A<> +>> endobj +2982 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 502.652 300.145 513.5] +/Subtype /Link +/A << /S /GoTo /D (winbind) >> +>> endobj +2983 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [215.935 489.7 317.305 500.548] +/Subtype/Link/A<> +>> endobj +2984 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [237.686 477.745 317 488.593] +/Subtype/Link/A<> +>> endobj +2985 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [247.04 465.79 347.303 476.638] +/Subtype/Link/A<> +>> endobj +2986 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 453.835 316.308 464.683] +/Subtype/Link/A<> +>> endobj +2987 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 441.879 294.197 452.728] +/Subtype/Link/A<> +>> endobj +2988 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 428.928 262.583 439.776] +/Subtype /Link +/A << /S /GoTo /D (AdvancedNetworkManagement) >> +>> endobj +2989 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 415.977 294.197 426.825] +/Subtype/Link/A<> +>> endobj +2990 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 403.025 245.414 413.873] +/Subtype /Link +/A << /S /GoTo /D (PolicyMgmt) >> +>> endobj +2991 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 390.074 294.197 400.922] +/Subtype/Link/A<> +>> endobj +2992 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 377.122 247.578 387.97] +/Subtype /Link +/A << /S /GoTo /D (ProfileMgmt) >> +>> endobj +2993 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 364.171 294.197 375.019] +/Subtype/Link/A<> +>> endobj +2994 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 353.157 291.45 362.068] +/Subtype /Link +/A << /S /GoTo /D (pam) >> +>> endobj +2995 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 338.268 294.197 349.116] +/Subtype/Link/A<> +>> endobj +2996 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [245.297 326.313 344.038 337.161] +/Subtype/Link/A<> +>> endobj +2997 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 313.361 328.574 324.21] +/Subtype /Link +/A << /S /GoTo /D (integrate-ms-networks) >> +>> endobj +2998 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 300.41 294.197 311.258] +/Subtype/Link/A<> +>> endobj +2999 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 286.905 194.618 298.86] +/Subtype /Link +/A << /S /GoTo /D (unicode) >> +>> endobj +3000 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 274.507 316.308 285.355] +/Subtype/Link/A<> +>> endobj +3001 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [275.268 262.552 388.51 273.4] +/Subtype/Link/A<> +>> endobj +3002 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 249.6 235.816 260.449] +/Subtype /Link +/A << /S /GoTo /D (Backup) >> +>> endobj +3003 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 236.649 294.197 247.497] +/Subtype/Link/A<> +>> endobj +3004 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 223.698 227.265 234.546] +/Subtype /Link +/A << /S /GoTo /D (SambaHA) >> +>> endobj +3005 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 210.746 294.197 221.594] +/Subtype/Link/A<> +>> endobj +3006 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 197.795 310.307 208.643] +/Subtype /Link +/A << /S /GoTo /D (upgrading-to-3.0) >> +>> endobj +3007 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 184.843 316.308 195.692] +/Subtype/Link/A<> +>> endobj +3008 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 171.892 314.693 182.74] +/Subtype /Link +/A << /S /GoTo /D (NT4Migration) >> +>> endobj +3009 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 158.94 294.197 169.789] +/Subtype/Link/A<> +>> endobj +3010 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 147.926 324.816 156.837] +/Subtype /Link +/A << /S /GoTo /D (SWAT) >> +>> endobj +3011 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 133.038 294.197 143.886] +/Subtype/Link/A<> +>> endobj +3012 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 122.023 208.405 130.934] +/Subtype /Link +/A << /S /GoTo /D (diagnosis) >> +>> endobj +3013 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [237.686 107.135 317 117.983] +/Subtype/Link/A<> +>> endobj +3014 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 95.18 316.308 106.028] +/Subtype/Link/A<> +>> endobj +3015 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 82.228 288.048 93.076] +/Subtype /Link +/A << /S /GoTo /D (problems) >> +>> endobj +3016 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [227.821 69.277 302.181 80.125] +/Subtype/Link/A<> +>> endobj +3017 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 57.322 316.308 68.17] +/Subtype/Link/A<> +>> endobj +2965 0 obj << +/D [2963 0 R /XYZ 85.039 786.531 null] +>> endobj +2962 0 obj << +/Font << /F14 2895 0 R /F15 2876 0 R /F11 2898 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3039 0 obj << +/Length 1737 +/Filter /FlateDecode +>> +stream +xÚµZÛrÛ6}×Wð‘zŠ AÓNë\š´nÓqcO_Ò<Èc)µDW—dò÷] áFkO&¶Ií.Î.(‘ Ã?’IŽ0S™%âŒd‹ÍgwðÊÛ 1œÍ0bJê×þ|øˆ³%`.'íɯð7FD©l3)8C¼`æø~r=ù³Ò¾Vd}(7ͬÀQ0Œ¤,‚ÂJÄÍf‚sTBƒ^ÞL¾{CŠL!U²ìæSFŠ•Y‡¹Y~ÈÿÆDL?Þ\N~¾é£Nå2³bù ÆOÈ­„¼DXÙ _ϧTæ_ÖËéŒ1š¿œÎH>ßNI¾­·šD C„²D¤ÐIõ[p‰R¨H‰é)QýÂîÎ Þ[”;t’²Rç]ÞN5GM²Þ^ÀÏ}Cz£/ävŽêœºs¹1Š4YÄã3²JàÒŒ~ô– —Hê%+(*UÊÆQÁAfú¥ö©ýÃ.!ÔiˆÔP¢ØZWê0šÒûêV*4…»Ãz{‡¥È_ïö[Éæeˆ­¯~´Ç R*NGÄOUNŠß`FÅ?ÄJˆßM¿•ð²ºßTZ<;­~–ÿ5•EÞžhÔ5¤êõg¿…F(ãP‚jÅ)éD#´è$}7¤ÎûYÓß]ìµôEÞt¨ß—>á­<%ì0>[úN °ôÍê "jD!(®ƒUH*a¯7aH!VÂëzSÕÛêûV7SÉòx%L¥Oym¤óÛ\ÛÎ}{ðâX™Ó„ªÝJ/ÎÃþ§¨QàI&ŸÂ(†Hq£0}…¿€Càük뇺ý½¨7@øa}?«öÔõ ÝïàDsxáižr$TèB¼Õ +Bžç!¥"p—-“ +é0c +±bÅâ% (ÄNøÜrBzÜCRôÝðT {ñ8<ÄæõRÀûÂÓž¥WˆÁŒ*$•°Wˆ›0¤+ᩇ\±ÀÿoƒGˆ¼?½š?t3MÔ.JÄÔS¸Å(j¢¯äjÚN&Šùmãëƒ>÷Í/¨BX’Q¯®”"Qª3Ý€S™^kƒ]ë!Vb­Ý„¡µ¶>»ؤÏpƒ}7äcÜ QÂÁ \!7°8D‡é² 0y‹§Pý).{ƒi:x¾¹ëÛ`©÷F°˜Ëö >¬ôQs³‡ÃW¿¾¹6÷O= ¬«íÁ›µi¡+Tèb|˜Ë™8³5¨D„òtkÌhk ±­á& µ†•ðr½i{âÝâu½­zˆZú€#ΣmPÀæ Ð'ãm`ÐIªnȦ 6‹åűsa¤mîvƒôPä5‚DLÉ‚uŸÅI#œJß lÃňzL\ -dT ‰l½œl!) ÙžÝ$-Ægxdœ»ð1/Þ`?âöˆ¢D=…=‘âöh0Ž=^éá Ú}j‡„Mó fav7SEòãv­.éžó×O"AƒWâKSTò)À^„«rD!(®ƒUH*a¯7aH!VB盿7âh7O‹ßvÁý‡¦žØ&N'÷äî†l¾ ¡©~ÑÏj–æs«†¿ÌW-yýÈ=ü‡# ±SUí0>3G4v  hÌYX"cáï±ýõÿ¾Ç23yf…DJžŒä#…•&̃“ìÈh¾ÜåËaSÎ% þ}X}3endstream +endobj +3038 0 obj << +/Type /Page +/Contents 3039 0 R +/Resources 3037 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 2869 0 R +/Annots [ 3041 0 R 3042 0 R 3043 0 R 3044 0 R 3045 0 R 3046 0 R 3047 0 R 3048 0 R 3049 0 R 3050 0 R 3051 0 R 3052 0 R 3053 0 R 3054 0 R 3055 0 R 3056 0 R 3057 0 R 3058 0 R 3059 0 R ] +>> endobj +3041 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [229.606 752.714 321.068 763.562] +/Subtype/Link/A<> +>> endobj +3042 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 739.762 184.052 750.611] +/Subtype /Link +/A << /S /GoTo /D (bugreport) >> +>> endobj +3043 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 726.811 316.308 737.659] +/Subtype/Link/A<> +>> endobj +3044 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 701.904 226.786 712.753] +/Subtype /Link +/A << /S /GoTo /D (compiling) >> +>> endobj +3045 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 688.953 316.308 699.801] +/Subtype/Link/A<> +>> endobj +3046 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 664.046 160.078 674.894] +/Subtype /Link +/A << /S /GoTo /D (Portability) >> +>> endobj +3047 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 651.095 316.308 661.943] +/Subtype/Link/A<> +>> endobj +3048 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 640.081 250.345 648.992] +/Subtype /Link +/A << /S /GoTo /D (Other-Clients) >> +>> endobj +3049 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [239.015 625.192 319.38 636.04] +/Subtype/Link/A<> +>> endobj +3050 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 613.237 316.308 624.085] +/Subtype/Link/A<> +>> endobj +3051 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 600.285 239.724 611.134] +/Subtype /Link +/A << /S /GoTo /D (speed) >> +>> endobj +3052 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [230.879 587.334 330.118 598.182] +/Subtype/Link/A<> +>> endobj +3053 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 575.379 316.308 586.227] +/Subtype/Link/A<> +>> endobj +3054 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 563.424 294.197 574.272] +/Subtype/Link/A<> +>> endobj +3055 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 550.472 283.767 561.32] +/Subtype /Link +/A << /S /GoTo /D (DNSDHCP) >> +>> endobj +3056 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.194 537.521 294.197 548.369] +/Subtype/Link/A<> +>> endobj +3057 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 526.507 195.697 535.418] +/Subtype /Link +/A << /S /GoTo /D (Further-Resources) >> +>> endobj +3058 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [235.611 511.618 316.308 522.466] +/Subtype/Link/A<> +>> endobj +3059 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [230.74 499.663 316.059 510.511] +/Subtype/Link/A<> +>> endobj +3040 0 obj << +/D [3038 0 R /XYZ 85.039 786.531 null] +>> endobj +3037 0 obj << +/Font << /F14 2895 0 R /F15 2876 0 R /F11 2898 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3069 0 obj << +/Length 2716 +/Filter /FlateDecode +>> +stream +xÚå›KsÛF€ïú¬\V™ 扽lY~dZ%ÙH.’`‰’¹¦@…¤lëßo÷<0C‚3&´Q"YqULóhô7ÝèžÓQ èH R²z¤´$‚ÑÑÙÕA9º„'ßPׂ Fçð{ÇÉ:‘)¹ÚÙÆÍ1Q'\slsxrðÝëªU%‘’N.F”V„Ñj$뚥F'ç¿/ízÚ®WãßO~8xuÒè”BIÙN¡kRÖ05Ó„×;[L(ã:O$Õæ„¢”ÔBleÛ LoÈxB©ÖÅ÷SøQ´Óe3O˜”Å›vµ†ß´˜7ë٢ݚ×0†¨Ga>ûdy9²?~‰Õêg¥Û¥«ªíi´°aœ>ÂJ’JÑÝ€9#’©ÑÑ ½[‘•&RÉÑDÔÐXn +[’º¬cUúF(-]JÎAsëå”H‹ó›3£;£Ð5Þ“ª8n®Þ5}uÖø^ÑœYušÆy ·F4êd uF Ógg Û¢P+Ë©Tè’PX¤VY¨.ê:lÎÆ•*>\.a±-nÚóñD(ZÀSQ–ý¿à½îôìïí¾ëÙ6‹²$¼¤–zêÞ¹|¯IÔ­O`{ìüjè Ðãîšægí¸KpÇÒs¯÷“±fÅty5kèf—·`L>aðNMCÁ‡nð‚4ø¾ið¹Y;ðð9-)wà™ÿ‹ùÔ ófm~ž#xVü wÐq +Qüwz†à[9ÑŒ> úNWCé‡nú‡Š§è÷HÓÏÍÚÑg5áR8úÜÑ?>̇HœGÓõ{4ýñ¤ÒÅùbn|€Ôâ+'íô2”tè–!é¼)Ò}Ò¤s³v¤+Aj*iáH¿º¶3€zƒ¡s¦6ÿp 8… ]¡[f D0ÒK /@z äfí–ÄR¹% Ý8šúºò3ëô×o§‹›Fyú)¢wŠŠ>tË  T2…¾/@=Ó$JÜ%Ju>QâZ :Ÿ(ùFF4—(ýk1feñɦE>=z+¤Åµ²‚ºt´Á¼ŸŸŒkð&«µ½}Œ-Ÿ>O$T‘l{$TÙ7ÙѼˆJè8èŽ Õ¶(;Ž+Nà±Jõ ÕOïŒæf-_{iƒ+«?ø1k½I®ÑçssãÒ~WÍæb8@³m ß´¼:šVÔ-mZªNbï ôªÙY;À²$š:¾>qz±hƒà ©Ý,cƆ*ÔÅ»ÆÞú­¥¹mïhm"ëB¿€ñ46¡ØøQzS§ ¡Ä»^à‘ꓼ{³§qg¦¤M+ðÈœ+RÉ€ Zƒ“{õyl¸7 ©æSk¬ëÀdSf¯©†´ú~ÜB÷ÖC†nˆ±F“û¤1æf¥ÚY-ž~ Ór¤fw°ÖµÛöpØØè-šæš«³@ÕbvWžú§äLð«*lò¼Z_7Hÿ +ìû·7÷jCa…nX±Ú’°ú¤aåf팮* •VåŒîøt ±Kñq<ühóžp;å źepÇŠ×)Ü}Ò¸s³v_ÔÒVY,nïE.o­bŽ2³]×ï®Þƒ³Öç¢+Œš>ŽÄ©3“â¼óæjvÿÁX7|e:/?âÍ)Üúoú|–‰šÓø†n¾±¦“|û¤ùæfõ|YÍH)ÝVW·é´Á›¶ˆ wMxxäµ1oÔ-ÍwCÓ)¾;HòÍÎÚñU5Ômpu[M¯â)¾J@À‹;ÌWö¢±­_þt wŸÙ‹Ó‹SlWZ§ÆüëÏæš¡~+^¡¯Y.–v·…A(ù„69½Š†BÝ2Ðcõ×)è}ÒÐs³ú4KgTwÐ}n& ÜE>.4Q¢Ùf±÷¯š6jíÇØ—¯±ö a¤ùLØqǘæwÅ+¬0+njþoÚ­qA÷¾C †n‚±.“û¤ æfíBcPNGÐ'zo¾Å€@ŠâÒhx‚~¸÷ÍâÚ@±§£¶E­'ZÑnh˜ÿƒ_/Gç ë%aµ}‚ߘÔõèꀑJ1w5?8>øOx?Ö$¬ÿ2•Ò„r¾ñ2‹ëyWDµGi¶åde ŠçŠœ~¬¼œàïÀWn*}vÖ÷?pù©â5ÆmÍÌmoØ“’»Z@GÄ^Ä/‰–0·mß¾üÙ>_mh«µ‰Å&´â¤,7£± °Hë¢9‡aÏC>·Âm”² %ü§.зƒi¾Zš³I®Ë'œ¡q _4híb톳v;»líõrúÇM7¶?í@‹olg³ÒŒ¥•ÎƵ¦(îÜÈ|ââat÷óù¨4'ÿ¡WÚõ¸6¨eV&8²ñ»ž®~/q¿—}¡­ ‚ÔÁÊh ÿÇïQMÉ—*ÆT…]uÞ¹½×¸àŒG–S·ÛÐ 8t®‹U\Ñ `Öuõµ¹9¯¤n.ê–vs1€ô‚Pû—5²³vØEØlçÝI4,_b0[M¹ÞŽ±ŒŒ¡2.-äüÎQq§ºGÔ-³"é ö¯{dgí»ñ¼«kož1¾s¶Žö"ŽÂñ[\ \}}¨ùJ Q· êHé,u®z‡iÔ¹YýF­B Qû­¨·«î# +dÿ=µ¦oÏÚGøÍgÓøvÔã/xu ºeGªNî œ›ÕŸ¡+ €Ãù‘a‡”ª)÷^CI…nR‘ÎXêÔóÒ¤r³v¦X†’ê˜BÏÒ±ñ¦8·—Ç]qÒêü±¤õc6ÃòNuž¨[n¤æ4Ürÿ:OvVo†:Ôۯ +õJ3zÊL¤°$%½]FïQ–Q¡’€Œ˜³¿—‹«fæ +q±¹m|ü¶ÂŸp`ö­ÙÄvR³ ,Ø|HñžÉ¤œùÚS´J²{ã¦îTQ{Ôc"%&¹©ý«1¹)½mÉPpܾ +Û’]Id#™)¤lœeÔŸ=³Û cygé·˜ œ%Ò¬•š\¯ÿïN˜&B³Qg{ÊÿŽÌ9Dendstream +endobj +3068 0 obj << +/Type /Page +/Contents 3069 0 R +/Resources 3067 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 2869 0 R +/Annots [ 3072 0 R 3073 0 R 3074 0 R 3075 0 R 3076 0 R 3077 0 R 3078 0 R 3079 0 R 3080 0 R 3081 0 R 3082 0 R 3083 0 R 3084 0 R 3085 0 R 3086 0 R 3087 0 R 3088 0 R 3089 0 R 3090 0 R 3091 0 R 3092 0 R 3093 0 R 3094 0 R 3095 0 R 3096 0 R 3097 0 R 3098 0 R 3099 0 R 3100 0 R 3101 0 R 3102 0 R 3103 0 R 3104 0 R 3105 0 R ] +>> endobj +3072 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [497.163 617.124 512.306 627.419] +/Subtype /Link +/A << /S /GoTo /D (part.1) >> +>> endobj +3073 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 592.666 512.306 602.234] +/Subtype /Link +/A << /S /GoTo /D (chapter.1) >> +>> endobj +3074 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 579.116 512.306 588.139] +/Subtype /Link +/A << /S /GoTo /D (section.1.1) >> +>> endobj +3075 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 565.567 512.306 574.59] +/Subtype /Link +/A << /S /GoTo /D (section.1.2) >> +>> endobj +3076 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 552.018 512.306 561.041] +/Subtype /Link +/A << /S /GoTo /D (section.1.3) >> +>> endobj +3077 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 538.469 512.306 547.492] +/Subtype /Link +/A << /S /GoTo /D (section.1.4) >> +>> endobj +3078 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 524.92 512.306 533.942] +/Subtype /Link +/A << /S /GoTo /D (section.1.5) >> +>> endobj +3079 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 511.37 512.306 520.393] +/Subtype /Link +/A << /S /GoTo /D (section.1.6) >> +>> endobj +3080 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 486.912 512.306 496.48] +/Subtype /Link +/A << /S /GoTo /D (chapter.2) >> +>> endobj +3081 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 473.363 512.306 482.386] +/Subtype /Link +/A << /S /GoTo /D (section.2.1) >> +>> endobj +3082 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 459.814 512.306 468.837] +/Subtype /Link +/A << /S /GoTo /D (section.2.2) >> +>> endobj +3083 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 446.265 512.306 455.287] +/Subtype /Link +/A << /S /GoTo /D (subsection.2.2.1) >> +>> endobj +3084 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 432.715 512.306 441.738] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.2.2.1.1) >> +>> endobj +3085 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 419.166 512.306 428.189] +/Subtype /Link +/A << /S /GoTo /D (subsection.2.2.2) >> +>> endobj +3086 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 405.617 512.306 414.64] +/Subtype /Link +/A << /S /GoTo /D (section.2.3) >> +>> endobj +3087 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 392.068 512.306 401.091] +/Subtype /Link +/A << /S /GoTo /D (section.2.4) >> +>> endobj +3088 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 364.969 512.306 373.992] +/Subtype /Link +/A << /S /GoTo /D (section.2.5) >> +>> endobj +3089 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 351.42 512.306 360.443] +/Subtype /Link +/A << /S /GoTo /D (section.2.6) >> +>> endobj +3090 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 337.871 512.306 346.894] +/Subtype /Link +/A << /S /GoTo /D (section.2.7) >> +>> endobj +3091 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 324.322 512.306 333.345] +/Subtype /Link +/A << /S /GoTo /D (subsection.2.7.1) >> +>> endobj +3092 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 283.674 512.306 292.697] +/Subtype /Link +/A << /S /GoTo /D (subsection.2.7.2) >> +>> endobj +3093 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 259.216 512.306 268.784] +/Subtype /Link +/A << /S /GoTo /D (chapter.3) >> +>> endobj +3094 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 245.667 512.306 254.689] +/Subtype /Link +/A << /S /GoTo /D (section.3.1) >> +>> endobj +3095 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [497.163 207.173 512.306 217.468] +/Subtype /Link +/A << /S /GoTo /D (part.2) >> +>> endobj +3096 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 182.715 512.306 192.283] +/Subtype /Link +/A << /S /GoTo /D (chapter.4) >> +>> endobj +3097 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 169.166 512.306 178.189] +/Subtype /Link +/A << /S /GoTo /D (section.4.1) >> +>> endobj +3098 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 155.617 512.306 164.64] +/Subtype /Link +/A << /S /GoTo /D (section.4.2) >> +>> endobj +3099 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 142.068 512.306 151.09] +/Subtype /Link +/A << /S /GoTo /D (section.4.3) >> +>> endobj +3100 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 128.518 512.306 137.541] +/Subtype /Link +/A << /S /GoTo /D (subsection.4.3.1) >> +>> endobj +3101 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 114.969 512.306 123.992] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.4.3.1.1) >> +>> endobj +3102 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 101.42 512.306 110.443] +/Subtype /Link +/A << /S /GoTo /D (subsection.4.3.2) >> +>> endobj +3103 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 87.871 512.306 96.894] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.4.3.2.1) >> +>> endobj +3104 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 74.322 512.306 83.344] +/Subtype /Link +/A << /S /GoTo /D (subsection.4.3.3) >> +>> endobj +3105 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 60.772 512.306 69.795] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.4.3.3.1) >> +>> endobj +3070 0 obj << +/D [3068 0 R /XYZ 85.039 786.531 null] +>> endobj +3071 0 obj << +/D [3068 0 R /XYZ 85.039 656.613 null] +>> endobj +3067 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3108 0 obj << +/Length 3504 +/Filter /FlateDecode +>> +stream +xÚíœësÛ6À¿û¯Ðdn¦ÒL…O’Ÿ:±ã^Ók:¹Ú½ÜMÛŒ¤Ø¼èáJtü÷‡Çâ!Q‹”“¸™k¦#âÀþ°Àb±4úU’¼••"’ÓÑluRŒ®ô/?¡pÇn™&÷œ^ž|õ#Zº¨G—¯Âsê‚ÈZ.ç?Ï6ë «ÆÝÂ}ì&¿^~wr~œTM97ýíäç_‹Ñ\7ồ‚ðºÝéï¡u=Zɉ®—''ÿ Ïr¿‰‘“:Ö É+"+Þï•I7¨~N©ÊQ)%Q¢´ý„A&ÓJ©ñã'“)ç||1¡ãÅdJdzÛm«¿w¦oÍobüL_o&S]0_¸»)dñÓÎܾغ’ï­ðïFj±„G.f¦ìVKo[÷<-G'S©ª±®_ú!êzÐo(t! Ýî)p{5r_~LU +RÓD¬¯ÒÃg•rÕk¥„m@Ÿ¤»5_+­*¢J5*#… H:¦ZuUÏßè‹fe´~£¿-ŽŸ¸¿Tè’«Û­¹£kõPž–%û3ªþ@¤ _CIE± ©Dg¼ÄHõ€“ÊÕLŽiu %Áä.[g&[ÔLR#³vŒÌIš¢eßnõ×=;ãR~R¤ €¡H£Xi¢\i¿8Ò\­Áøti‚óó0<ݧ¡„œH†è‰W™ýJq*XM”‘‚ᡘE­B[T³ZZ£ØíˆfI[Ï7Æ8î ì‡…µ•» +ÇCçµ+ª—÷Z¯òFþ*¡V=(j®ßCÁ© »¨Q_¯vœ`¦JQU¥.¢@Qųµ§•Ñ½™éÎ͹µ¤ AÊÞC«ï åžÄðö*<ɧêç5‚üHPæÙZýò¨J=‹J SX_\[“s¶¸j^ÛLöBO±úòeãFD¥ZàüÇ ¥tü/3H~üz2UºüÁ«ïêPxQ,/Q#¯ß^®ÖO¤*x€Çþ4¼'foa ½i­¡³ñ™¹Ú¸Yx»Y.[ ”+þ±hA߆ҊbZ©Þ +ŒV¿8­\­–( “"Ðâ÷Ië™](ÝÍzX:oÔ Œ}d;ƒ~%Å2äR¢äú ÀÉåj ä¸þ,"9¿m׎å®k\b Û…ï7»v}å¾ëß×ac`Ý·hj„ÝÆÝòÜ7v¿‹>ÐÜïIâEd,oèÊP8Q,'U +§ß€^1¢—ŽÑ”ioR¼x¯eªŠš0¡BÓX‘¤LWÊFþ&Ó4ãÙ(íÙ<Ù¬œù¨ROvf®ë¬Íl–‡M×úµM5et7çÛuðD«1Ši,>¨§Áa¥¹Ì…Ø›rÔý“µ$ª.AEÜ¿o&•p¸éìÞØÏLÍé©ý5ŒsØiuú¶ºfŸ›è•4Ð|1Ü|Rè`8ÒtnËÖ°k[£¢ì °Ÿº)©íÍ+;ØŒ›ÝìÌg&,m3ZŽ~€ACG± àDÕ‚c€û Àçjõ‹—T‘u{ÿ(JÍÑÅMB°ëÒF²n¢O¡GD)ù}ãø@4¡ïCiF± ÍD¯8Í~pš¹ZM©çtiz—ÿùÖOÀ&òÕl[3!_9ã}e t›1`c½´ êáñƒÞåÅ2üM +ñë7ç—«5L·‚ ô8L¶(S0…°Ë›fu³tŒ{1ͦk­ÿbbšåCÀf;9šÊ ÊØIO¯j^_€ÅJRK +¸B\sOÎîrkcÅÕ_r5 EÅ20å +,Äy¤8Ð\­)Õ[Š‚RyÄ›uÜ€ý`gT ®ô,úÚïò®6õ1Kdá»CF± ÀD•8À~p€¹Zèk¯$¹3öL¡Ä‘…Ó:cž¿·33§Vâá­~ÐÕ¡ð¢X^¢F^¿8¼\­þäNT%áżÏâôÎ÷k ©D '•ê %u¤(©l­T©Í mR—׋ó¿±))‹YÛ€ÇbÇÍn±¿s4Ù+°P¾°Îéþ1à¿Ÿ»ß¾Ý¬@ð|nÒ-l®rʇ¦U~Ë(?QƒÀâúG€+?WkP¾*+ä¾òù{(ÿ…QåznˆÌÄJ¯ß¸Ÿ¿DfN,XuŸ†=Ê&ŠeØ$ZÂÙô€³ÉÕê×!QR6,ä“Ä”­Ò玦l‰=ïâY³ë|úÉ©_ŽPXž4*UÑO:¹A‡2Œb†©6±ñ‘à sµz'PpNháC +9é~n›—Kï,¬ö#Ÿl|¾µÀ¶&Ô)ÕòÌ?SÐÀP¦Q,Ã4Õ.Ç<Òœi®Ö`—´&RF¦Þ/|ê`Úä.k|ëMçŠÚõliBÚÁ4]ñûÂÿžºññª™Ó¼¶9, ²‹›:Ë…:;_ËàK‰âë7Ç—«5à+)Š*àc ¾’¯`#f/:»©ž»‹Gÿ1'›[wÕ,·‹fnf_í^7ÆÃð¹z¼tˆõ]³Þ¹œ½ßžÉ™çÛ¶´;zwÈj³òÈhdÄ…íÀ”òÿf#lT7è,fúú¿¦µv,é‹ùÞÉ-iŠK]#Dv¨϶‹9ä6ëU}çäv>7ñƺÆíbîÊgÖ9–fyŸy éâ»ÖèèÚ6µØkeƒzñ¦Ýuá Ò-7íâ#7´ï®½†@B·«‰Þ(lWf¦µ×í:†§ºí­[»\“ŒÀÌ6pcÊ]ïŒ?Ãèò¼¬H=8¥ð÷dÇ{¿vt¸çªô£+I¸¢a´ûT€àÛíÞî:8Ñß›¾ì…ѳŸÄ–ò¾µ›Ý[·2ù%Ì䮞ú?Z›œš„TÇÆ+ùp”ïàP\Q,Ã+U +¬ßœX®Ö€Lk®¢™ØCVÅõÁºÚ¶Œ3ØuîkcÎ6·.£ÆɄȼ¹÷ºÝ¹oÎPV7ÆTºp£X´Ýu ]Ø¢yð0ýáŒy.Œd¦²¶p?Û˜™ÖGhñÂ%'´ÑÒ=çEõ0Ït±ñÈ+ÂÔà8X"–p“ ýàã1WkL’ò0ešMäçmÆ ³‚š¦ƒ å¦sfµ3Ÿzi×i5“»¹LÝæro5tE¯¶¦,ùáR|õ‚ýy>"·ëH‡ù²}Ý‹Ë|²Ä„b]Ë•÷Õ\’“]M|æT’³Ÿ[埗äEÙ.ÀJ6owMÛÆžðQ¤Q58ÒˆeFÜ”Eýà£(W«E¬.‰¢2Œ"£è'p@&ö ¡]”Æ}¼ZÜ™/ÕxÕÚ[ܵseÍ«.™žÌíÎAÖz9¡þ×ÍÎ}qþA³ óÜÜÁ+7 ,- f3kB=W‹Î=Àxj‡CÍufas”-àGøÁÌÒo¿Zƒ¯¨÷qM»l^†cpãò“LZ¬¤Pƒƒ'‰>ÜüMÙáv¤ï—«ÅdMT²“;š«åo2MS«uÚÌ^ßÞ¸\-‹ÓÍA6uk³Ö4§öœíxÞVRëÈÛʶñà‰V{ØÙò 4okÊeù÷#™,‰¨ÞÑ`BoŸd:{gòÖãw'o•â³KÞòJjOQ,cO |Dô€NßÙZvΈ,jÀî“·Îw;?gÂî£Ã§~»VŽ_›•­Y!C<òéÚù£+8b©UñЉBÿ‡b¢‰n%–r¤8Ñ\­aA¦z÷¨PÅzv‘ äk· N6Ý‹‡I¢š\RÕ+•ú4RÊ0ŠÚÂõjÇ eªôg3¬DÐÐ;O0M ùÉYö4S}*Ãõf(š •Aõ$%†¦W;Ž&S¥·Zë-ºŠl| ññ¬kCИD»Ñ¿Íöí»Ówøû%<Þ/3ßÍÐ1œZªBÛ‘ Ü²µpee=?îè›1¿éï·Í²ó áŽäµ˜#íNôó}`Ì…xM,mïõS³(~}„ ?C E± ¡DW8¡~pB¹Z!%ô'„|ôë[wˆïô$á¼°aú¸õ‡ø¤eé½Ñ|Oû°æìpÓ¦Õ¢|?FУ¡Œ¢X†Q¢-‰e*iÎ(W«w©¤„QŒxÈäwîÞ­Ë€™. äxË4Âx˜ß–¼‡]ɇ0BŸ‡RŒbŠ‰>qŠýàsµKã%Q*Rôà°ì¨ºâ©óhßë¡£X†c¢Qœc¿8Ç\­Á™ "k*äÿÿmú:¨h(ô(–ž¨_b™äHpè¹Zƒñê"©T€¶oGŽHûÑÚ4¥îí_x‘NjoZûGiì_ºÂ;sCôŽ!š>ßèu²¤â>‘A‡"‹bd‰òpdýàÈrµzduI +Zb~ÏpæuyíÿÒû7‰ks#*·7ïÚLWÔ½,´°‡þäìkLÿÐÚêR¸ö= Êï׎ê>W¥W}ʼnPUP=Ïø”ÉÑvq³4áF|çL¾ƒ?<7;7º›ïù›.²¯ƒÉê“,wÐó£Ž1Ñ)Š±_;Š1Wex;¾&5Å¡== ÉýQ·üËIøZwþd®»†Œý'f <~nþîD]>T׺?ô…ú •yŸ>*Vb‰ßýÚñ³®áTòØaƒþŸû¿»õçÿZb8²©+lk’ùX5â’î¶Hýq +TîIü?›ºfendstream +endobj +3107 0 obj << +/Type /Page +/Contents 3108 0 R +/Resources 3106 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3158 0 R +/Annots [ 3113 0 R 3114 0 R 3115 0 R 3116 0 R 3117 0 R 3118 0 R 3119 0 R 3120 0 R 3121 0 R 3122 0 R 3123 0 R 3124 0 R 3125 0 R 3126 0 R 3127 0 R 3128 0 R 3129 0 R 3130 0 R 3131 0 R 3132 0 R 3133 0 R 3134 0 R 3135 0 R 3136 0 R 3137 0 R 3138 0 R 3139 0 R 3140 0 R 3141 0 R 3142 0 R 3143 0 R 3144 0 R 3145 0 R 3146 0 R 3147 0 R 3148 0 R 3149 0 R 3150 0 R 3151 0 R 3152 0 R 3153 0 R 3154 0 R 3155 0 R 3156 0 R 3157 0 R ] +>> endobj +3113 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 754.651 512.306 763.674] +/Subtype /Link +/A << /S /GoTo /D (subsection.4.3.4) >> +>> endobj +3114 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.4.3.4.1) >> +>> endobj +3115 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 727.553 512.306 736.575] +/Subtype /Link +/A << /S /GoTo /D (subsection.4.3.5) >> +>> endobj +3116 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 714.003 512.306 723.026] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.4.3.5.1) >> +>> endobj +3117 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 700.454 512.306 709.477] +/Subtype /Link +/A << /S /GoTo /D (section.4.4) >> +>> endobj +3118 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 686.905 512.306 695.928] +/Subtype /Link +/A << /S /GoTo /D (section.4.5) >> +>> endobj +3119 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 673.356 512.306 682.379] +/Subtype /Link +/A << /S /GoTo /D (subsection.4.5.1) >> +>> endobj +3120 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 659.807 512.306 668.829] +/Subtype /Link +/A << /S /GoTo /D (subsection.4.5.2) >> +>> endobj +3121 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 646.257 512.306 655.28] +/Subtype /Link +/A << /S /GoTo /D (subsection.4.5.3) >> +>> endobj +3122 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 632.708 512.306 641.731] +/Subtype /Link +/A << /S /GoTo /D (subsection.4.5.4) >> +>> endobj +3123 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 608.25 512.306 617.818] +/Subtype /Link +/A << /S /GoTo /D (chapter.5) >> +>> endobj +3124 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 594.701 512.306 603.724] +/Subtype /Link +/A << /S /GoTo /D (section.5.1) >> +>> endobj +3125 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 581.151 512.306 590.174] +/Subtype /Link +/A << /S /GoTo /D (section.5.2) >> +>> endobj +3126 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 567.602 512.306 576.625] +/Subtype /Link +/A << /S /GoTo /D (subsection.5.2.1) >> +>> endobj +3127 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 554.053 512.306 563.076] +/Subtype /Link +/A << /S /GoTo /D (subsection.5.2.2) >> +>> endobj +3128 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 540.504 512.306 549.527] +/Subtype /Link +/A << /S /GoTo /D (section.5.3) >> +>> endobj +3129 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 526.955 512.306 535.978] +/Subtype /Link +/A << /S /GoTo /D (section.5.4) >> +>> endobj +3130 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 513.406 512.306 522.428] +/Subtype /Link +/A << /S /GoTo /D (section.5.5) >> +>> endobj +3131 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 499.856 512.306 508.879] +/Subtype /Link +/A << /S /GoTo /D (subsection.5.5.1) >> +>> endobj +3132 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 486.307 512.306 495.33] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.5.5.1.1) >> +>> endobj +3133 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 472.758 512.306 481.781] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.5.5.1.2) >> +>> endobj +3134 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 459.209 512.306 468.232] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.5.5.1.3) >> +>> endobj +3135 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 445.66 512.306 454.682] +/Subtype /Link +/A << /S /GoTo /D (subsection.5.5.2) >> +>> endobj +3136 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 432.11 512.306 441.133] +/Subtype /Link +/A << /S /GoTo /D (section.5.6) >> +>> endobj +3137 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 418.561 512.306 427.584] +/Subtype /Link +/A << /S /GoTo /D (subsection.5.6.1) >> +>> endobj +3138 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 377.914 512.306 386.936] +/Subtype /Link +/A << /S /GoTo /D (subsection.5.6.2) >> +>> endobj +3139 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 364.364 512.306 373.387] +/Subtype /Link +/A << /S /GoTo /D (subsection.5.6.3) >> +>> endobj +3140 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 337.266 512.306 346.289] +/Subtype /Link +/A << /S /GoTo /D (subsection.5.6.4) >> +>> endobj +3141 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 310.168 512.306 319.19] +/Subtype /Link +/A << /S /GoTo /D (subsection.5.6.5) >> +>> endobj +3142 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 283.069 512.306 292.092] +/Subtype /Link +/A << /S /GoTo /D (subsection.5.6.6) >> +>> endobj +3143 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 258.611 512.306 268.179] +/Subtype /Link +/A << /S /GoTo /D (chapter.6) >> +>> endobj +3144 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 245.062 512.306 254.084] +/Subtype /Link +/A << /S /GoTo /D (section.6.1) >> +>> endobj +3145 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 231.512 512.306 240.535] +/Subtype /Link +/A << /S /GoTo /D (section.6.2) >> +>> endobj +3146 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 217.963 512.306 226.986] +/Subtype /Link +/A << /S /GoTo /D (subsection.6.2.1) >> +>> endobj +3147 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 204.414 512.306 213.437] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.6.2.1.1) >> +>> endobj +3148 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 190.865 512.306 199.888] +/Subtype /Link +/A << /S /GoTo /D (subsection.6.2.2) >> +>> endobj +3149 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 177.316 512.306 186.338] +/Subtype /Link +/A << /S /GoTo /D (subsection.6.2.3) >> +>> endobj +3150 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 163.766 512.306 172.789] +/Subtype /Link +/A << /S /GoTo /D (subsection.6.2.4) >> +>> endobj +3151 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 150.217 512.306 159.24] +/Subtype /Link +/A << /S /GoTo /D (section.6.3) >> +>> endobj +3152 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 136.668 512.306 145.691] +/Subtype /Link +/A << /S /GoTo /D (subsection.6.3.1) >> +>> endobj +3153 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 123.119 512.306 132.142] +/Subtype /Link +/A << /S /GoTo /D (section.6.4) >> +>> endobj +3154 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 109.57 512.306 118.593] +/Subtype /Link +/A << /S /GoTo /D (subsection.6.4.1) >> +>> endobj +3155 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 96.02 512.306 105.043] +/Subtype /Link +/A << /S /GoTo /D (subsection.6.4.2) >> +>> endobj +3156 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 82.471 512.306 91.494] +/Subtype /Link +/A << /S /GoTo /D (subsection.6.4.3) >> +>> endobj +3157 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 68.922 512.306 77.945] +/Subtype /Link +/A << /S /GoTo /D (subsection.6.4.4) >> +>> endobj +3109 0 obj << +/D [3107 0 R /XYZ 85.039 786.531 null] +>> endobj +3106 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3161 0 obj << +/Length 3197 +/Filter /FlateDecode +>> +stream +xÚíœÝS9Àßù+\ûd,F#i®¶HrÉU.°ÅUííƒcp6g›Íæ¿¿n}Û3 »$M¥‚Ç}öOÝ’Z=Cü£]“Š7¥%©9L®vªÁÜyµC]Š‘K2JÒ¤}°‰ËÍÛ*[W7ÛÕÖ”nUÛ“„)¸`„²[FJŸÉÐZ§ârBU‚‘ +àXqQ˜½ÜÕb8ÝÑáx}ZNW 0.†ãù)^ðásswŽÂÄ‹ÿVTÀ5 §QÓ°!SW~@¿“o¥$˜½ëÞ6ª"¢¢AH-iwŽŸk”dkØ.»<"Ú hawI˵ìðY‹ÆagûÛ# ÷P΀4.ÐH|FÂnœàÈX,/vÍ/@|¼F ZÌ÷Ž¦Ëß1õti y;žà×ó™$˜ûxWóáò&d¶)ŸM&øm¿{«4¢ÕŸ…æºØZÌV€–ˆ/­Ý€<´R­YI5P𫆚ª¥)ƒÄšáÍøÒÊréÔ.æöÇŧ¿Ió*}ëKÊf)Prò’UŽÐf¥y:¹š™Šá0ç—Õl~UtøîXØ‹ 5ï8çã3ÿ}½°ŸÏPýN]šmnŠuJ XŸO±Û.LkG”‡!ëçCUé2¤ß6{fŒI­@´ï8K²åÇšOdÆÍŒ·ŽdÇ\±V?×, <îÞOïq¤ŒŒBŸû9zôòò \ÿdõ ˜îM ÁìHSÃs3Lí=g!VÁ4`a“ÅuÖpH)þB®?} ÅlB‰¬$Ëj7 O¨Tk $aa[ñ@H»}ad æ¡æ +,~J3ãç NªóS;ý®lšä°X gªÑ΄x©1EÛŸAçÍÄ` +Ά·Ó+Ä«cøk +¨ùßÊB`T‹Þã/f+Œ?—¨<þÚ È¿R­TÛ…žä0+‘Ž?:ÄÅC£eh&â(C»Àªê«èÿ9´Ÿ‡8䟦fЭp¼Á0Âå†_‘ŽëK_:1[N"§ŽqCé÷c]§ûbŒÙ +æ1¶ÇXªÕï‚놓ªö¾"îvÁÁ[„;¦í  3,DøMSùݸ:¼HzBN²å!§â–<¹£YÈÅZý +¬V ©+ ûó›…±¯v‡TǹݩÁÅÉ1îÁ‘¥¿n®£ÌOÆ?‚ßa­mˆ·#ÂâÁ¡¹.ö…³ %âËCk7 ­Tk€&kÒÔšßQŸœ£`¿X1Ïvƒ[j}>[Ù?ZXëµ×Öõ¹'»2 +;¹ÁõÌlôwo‡Õóϸ©¿’mõýíK0f+Ld)EŽ`»y‚¥Zƒm­aZ¬¼‡Q8ÛšÌf/yp´*Ú\¿aµI-OôÔ_ãýǶÉuÝï 4f+MD+ëÐvò@Kµ•äšhxz3z45'×–ÝD¶¸qª·²“'.Ž¬³ + î§]X9îÐZAô%rÀF繶jÏc-T¨²ÒÒ€•ÝëÞtmpî] %ýX“ÉbT…”O ës_‚1[a"Ï<ÃvòKµŠXI(z? qòMýþV¯®ñÚ/cÍ"h{#e×µ¡ëp_„1[a"L)sÛ È#,Õê·”¢Ñ„Ñ „ÑQshôoe(³pãÒœ.sf‰.ئ~RÛIßáž“ly„©0³;EX¬Õk¡Ð‚HÉBïë5ôiz¼¶5M: ¤Ãme¼…žÞ›kŒe OqÂôréK:f+Ndž'Ýn@žt©Ö@ZQB©¤ëÒfƒx–Ù!®¶Ö·“ËÙÔ›]QÕO’²“I_Ê1[r"o©r”Û ÈS.Õ(׊À^'P–Žò»Åk-µ‡ç0;¡ôų0'Ïcn7 ¹T«ß© +!HEýΦv;Õ}ëç¹ò'¤/0 jiŽßÐÓ@Ù“=ûºt'¢¾Ðc¶ôDüyèíä¡—j ºÍ¡v©t¿ÝnÀ…?ï>=ÍGÏ<·çåÎÕ´Øôf(ƾ²rº^õå³8%Ësj7 Ï©TkàD%ihää÷§H·ðçÌ¢04ÆÁ×¢´Í¯Mˆãxv¹B×Ⱦº÷E³&ÂÌ#l7 …kF$ƒƒUn­Ëa»¼a¨)‡íúDØ4íÂvÖ&ÜYèð^\šPéäÅc»V^eâw“šï¿[lçV‰F‚¹À¿¤ lünU ÝÝnJç¼Å•PNb?"w;µÉɨ§2Å\y]J¤Ÿ­Ú³Æ°Te.kÂ¥'îƒvýtf<7ˆ¹Vô;‰Ó¹r'¥¾Ìc¶ô„@žz»yì¥Z÷šM=wLýâœðÌ"õ:ñí/æN¥ÏÌA—‹cøî@;±ô³@'"W¹ðáŽäA—jõ‹ÎA­çQ'GÕŒ¥þäMöÒ_ÌýÁJ8›¶Îü ¿ίàãô·B–èægùãEÐjÌV€šˆ7µÝ€<ÔR­*¬‘åª_Áî;„¬®—>|ßÄÚͼ'È“ò®¤†±§è2ðèË4f+0M¤›gÚn@ži©Ö`‘!1•Â1?\ЈúBÙ +Ðñ«\°}GþÜ>†iITRÖ¹ñ‰°iÛǘǪ`ºye:á·wÓµùŠà ˜ {cßXk3•Ì\î£õÁt¼2~fAëß½ýI|‡íO±{[%ÁçÂô’‚Ê/²âˆiAj-ÊŠÈÌ’µ·ß¡ƒ†§nž’n}=ÕôBë©šI¶¼j¦@ò#¤Ý€¶j*E¨F%¢áÝšÉK=b|óÈG.% F'ŠÉãAÑkP£Êÿ%6rá™Q¥ßÇóÉôÔjÙ~‡úµ vÞ°OOZPÔ4›ºÜàí2$swII%]ã¬îJ"8X? ˜Ö»`ý€5«ê[¬ŸK„m†KX±˜/î6mÏ +vËšX4}y›ˆI.læçKg?]¦õÿmŬAŒ}¸‹A,õx«D)[—T‚¤˜*ÄJ¡n »£$ÒéÜE‹È~¸…¶- —RO ˜dË[À”@vHt4 »"-Ö¸k0©UàÎ÷“sã°¬“xYÔ¢ðd·õ¢ÿœ™1¿+îNJ}¹Çlî •‹üêh@ž{©ÖÀ]6¤v1õp—;î³UðÄç¶FBÈ¿ýêÇK¬ïˆÙ +c ¡¡rÑ( ÈR­ÞÃK)R¹}3Ðêã”és„ÿúý‘}¼wžâ·4ïc‚C&{¯ãKOÆ·àûÞ—fÌV ™È5O³Ý€<ÍR­¦ˆGL†&s4÷ #Ä6²füóÌDu.nœ³h8՞ȔÝONǶË.Ãk7 ¯Tk€Ç©aÇ»ƒwGá)#ûZ‡ð$½ñËúÀ?„z0[N'ëÅNy2jÈîsÎs8F‰ªÜ‘u»ö–d+àJd§tŽWu÷ó±b­ž˜Žç7»ØÁ{ +zöú]Ai¥–Κê{é;%T¹ók}÷0}‡ó/h 4?%¾´o›l[ЭGmì–ð`·Ÿe¹Ûxk\Ñ6B=Šê^§^ê‡^‰HuöÝVw?ò*UÞcO\ Eá(&ï±é‚wîN¦O“È»ÔûÞlp¯£*y‡“ªDl:ûV¨ÛÏ©¢—°&ªû… ðŸûWÈÝÿÁÙ(`™¤sƄÓ鯉àn¶úÆ5©5÷i’ÿ'sÂendstream +endobj +3160 0 obj << +/Type /Page +/Contents 3161 0 R +/Resources 3159 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3158 0 R +/Annots [ 3163 0 R 3164 0 R 3165 0 R 3166 0 R 3167 0 R 3168 0 R 3169 0 R 3170 0 R 3171 0 R 3172 0 R 3173 0 R 3174 0 R 3175 0 R 3176 0 R 3177 0 R 3178 0 R 3179 0 R 3180 0 R 3181 0 R 3182 0 R 3183 0 R 3184 0 R 3185 0 R 3186 0 R 3187 0 R 3188 0 R 3189 0 R 3190 0 R 3191 0 R 3192 0 R 3193 0 R 3194 0 R 3195 0 R 3196 0 R 3197 0 R 3198 0 R 3199 0 R 3200 0 R 3201 0 R 3202 0 R 3203 0 R 3204 0 R 3205 0 R 3206 0 R 3207 0 R 3208 0 R ] +>> endobj +3163 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 754.651 512.306 764.219] +/Subtype /Link +/A << /S /GoTo /D (chapter.7) >> +>> endobj +3164 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (section.7.1) >> +>> endobj +3165 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 727.553 512.306 736.575] +/Subtype /Link +/A << /S /GoTo /D (section.7.2) >> +>> endobj +3166 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 714.003 512.306 723.026] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.2.1) >> +>> endobj +3167 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 686.905 512.306 695.928] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.2.2) >> +>> endobj +3168 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 673.356 512.306 682.379] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.2.3) >> +>> endobj +3169 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 646.257 512.306 655.28] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.2.4) >> +>> endobj +3170 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 632.708 512.306 641.731] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.7.2.4.1) >> +>> endobj +3171 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 619.159 512.306 628.182] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.7.2.4.2) >> +>> endobj +3172 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 605.61 512.306 614.633] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.7.2.4.3) >> +>> endobj +3173 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 592.061 512.306 601.083] +/Subtype /Link +/A << /S /GoTo /D (section.7.3) >> +>> endobj +3174 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 578.511 512.306 587.534] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.3.1) >> +>> endobj +3175 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 564.962 512.306 573.985] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.3.2) >> +>> endobj +3176 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 551.413 512.306 560.436] +/Subtype /Link +/A << /S /GoTo /D (section.7.4) >> +>> endobj +3177 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 537.864 512.306 546.887] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.4.1) >> +>> endobj +3178 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 524.315 512.306 533.337] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.4.2) >> +>> endobj +3179 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 510.765 512.306 519.788] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.4.3) >> +>> endobj +3180 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 497.216 512.306 506.239] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.7.4.3.1) >> +>> endobj +3181 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 483.667 512.306 492.69] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.4.4) >> +>> endobj +3182 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 470.118 512.306 479.141] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.4.5) >> +>> endobj +3183 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 456.569 512.306 465.591] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.4.6) >> +>> endobj +3184 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 443.019 512.306 452.042] +/Subtype /Link +/A << /S /GoTo /D (section.7.5) >> +>> endobj +3185 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 429.47 512.306 438.493] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.5.1) >> +>> endobj +3186 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 415.921 512.306 424.944] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.5.2) >> +>> endobj +3187 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 391.463 512.306 401.031] +/Subtype /Link +/A << /S /GoTo /D (chapter.8) >> +>> endobj +3188 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 377.914 512.306 386.936] +/Subtype /Link +/A << /S /GoTo /D (section.8.1) >> +>> endobj +3189 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 364.364 512.306 373.387] +/Subtype /Link +/A << /S /GoTo /D (section.8.2) >> +>> endobj +3190 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 350.815 512.306 359.838] +/Subtype /Link +/A << /S /GoTo /D (section.8.3) >> +>> endobj +3191 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 337.266 512.306 346.289] +/Subtype /Link +/A << /S /GoTo /D (subsection.8.3.1) >> +>> endobj +3192 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 323.717 512.306 332.74] +/Subtype /Link +/A << /S /GoTo /D (subsection.8.3.2) >> +>> endobj +3193 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 310.168 512.306 319.19] +/Subtype /Link +/A << /S /GoTo /D (section.8.4) >> +>> endobj +3194 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 285.709 512.306 295.278] +/Subtype /Link +/A << /S /GoTo /D (chapter.9) >> +>> endobj +3195 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 272.16 512.306 281.183] +/Subtype /Link +/A << /S /GoTo /D (section.9.1) >> +>> endobj +3196 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [497.163 233.667 512.306 243.962] +/Subtype /Link +/A << /S /GoTo /D (part.3) >> +>> endobj +3197 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 209.209 512.306 218.777] +/Subtype /Link +/A << /S /GoTo /D (chapter.10) >> +>> endobj +3198 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 195.659 512.306 204.682] +/Subtype /Link +/A << /S /GoTo /D (section.10.1) >> +>> endobj +3199 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 182.11 512.306 191.133] +/Subtype /Link +/A << /S /GoTo /D (section.10.2) >> +>> endobj +3200 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 168.561 512.306 177.584] +/Subtype /Link +/A << /S /GoTo /D (section.10.3) >> +>> endobj +3201 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 155.012 512.306 164.035] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.3.1) >> +>> endobj +3202 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 141.463 512.306 150.485] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.3.2) >> +>> endobj +3203 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 127.913 512.306 136.936] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.3.3) >> +>> endobj +3204 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 114.364 512.306 123.387] +/Subtype /Link +/A << /S /GoTo /D (section.10.4) >> +>> endobj +3205 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 100.815 512.306 109.838] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.4.1) >> +>> endobj +3206 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 87.266 512.306 96.289] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.4.2) >> +>> endobj +3207 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 73.717 512.306 82.739] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.4.3) >> +>> endobj +3208 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 60.167 512.306 69.19] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.4.4) >> +>> endobj +3162 0 obj << +/D [3160 0 R /XYZ 85.039 786.531 null] +>> endobj +3159 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3211 0 obj << +/Length 3455 +/Filter /FlateDecode +>> +stream +xÚåœIs·€ïú¬œ†"ƒu€Ó+¯‰RñK®òr‘´Å +Eò ©Øþ÷;@Î4âIE±d—Ë"gééFX ñ¤ÖÿðDrTS5i¤@œâÉü欞¼×W~8ÃþŽ™¿e–Ýóøòìûç‚MpT­&—ïâsT¸“ËÅoÕ“ífJduXºýô÷˟Ξ]Ægª1¥æ±ÿ;ûí÷z²Ð&ütV#ªääƒþ^#¬ÔäæŒqŠ8£þx}vqöK|–»Æ&Nj¨œJÄ%íó¬X?§ͤá ÖØrè« q4Q!ª—ÛÃR£¬j¯¦3ÒTÛÛƒ9¦ÕÕWݶ]ÌÛýt†+¶]èÓ‹n¹·'—{'«ÆëÚ|0¥²£ãÒµ¿)~‚@ŸD¬Æ±¸=Çuï'î˛ܕ^j–‰õ]yúlãJ‰{`Œè }‚îÖ²ÖTëª +ðÅ­²>¬væã\éª*V#Ôçßµsû]Ó\þÓ ¾^x“XoæhoßoIkÄKtkf*ám<Þ·{ÏtûÎ5ÀÃõÒ}ycàMl¿6z{kþÎí5wß®íÚ›e¨ ºßø·aù¢…•Ä +°2·Á°úÀ°JZ#,}6‚’£A=î¶fù°Xu¡¡}Ú̉I%.ÑX>N¤ÀÆ{IˆË±R˜ ¤ kX¢“¦ÆˆE$fd#ŒU¿ž¿¼pþœ¹KãÏëiôù¯+ÓT†9wî‡ønãî3ãž¹lþl»?¬Ä{wëKÍ(Á‹}íŸæÖ€®¡òRÅ¥ +ä’?ax=í0¿‚ÊФ„lô)œb߬.–‡Cò:­nw>q ²kMs¿v½x(ƒY(úH™L2w«¤Ê@–E­fÃå$Á$f¢õf¹[¯æía¥cê™Ä_AL +=c+`Ì*„±oŒ±¤5b5’5Mih“Ý5»¹ïG#Õgú¼ë@»Uèu»ä?d°Þ cÁ&±ØÌÅ0ؾ0Ø’Ö0^êÉ"œ°Â˜?.×»wÛíÚÑüq&º:,"_ÏVˆ¼÷ÓXòI¬@>c“ï“/iMšêÏ:#†Ù¡XèåRÇ>MŒ}ôõÕƯM¤³=luÅ‘Õ|»Ö¬¹‡M×w,À$V˜¹Rr`ß`IkHj„9OÃК¢Ñ7®ÛÝ®oM7mXƒìU·Haê¬áäau¾ÜcI&±Ȩ́0ɾ0É’ÖØ ×éÿdã;áË©¤ÕrnÞµi’:HòÝñ«|f¡ç«å‡ã §Kع銩!lf¢yX¬½gƲNbÖ™×¥€X÷ €Y—´†VËE5oëÐí¥òÉåþÖäóv¶ÝÜ>ýºò­ù¢½1‚WzÄ9¹ç@CñGÍÄ` ¹kA €@‹Z#ÐF!^Ë4tÃn`¼Z/oÇ.†Á¦?6A±éyMþ„'ø`,Õ$V šùW6Õ¾0Õ’ÖHUp¤xF•þU3mçÝv¿Mö*K¹‰}X=opÀX¤I¬€4s.Œ´oŒ´¤K7ÊêÎQkWGHqeº_&Uõc- ?¹€6Ì[MGk3éGÍwyp‡Ùëꆹècäf 7q³=úv½ÿ$+_²±¬’XUæ5)!V}`V%­!"2+š2DÒDO¶7Ƴ7!Ž59†®³c¢a‚É·4#õ.Ë>7÷½Òîœé©Û¿cÕ´.æö‡V‡ëí­»´/&”Yãg˜Æå¦n¹=}ÛòAáÂ=[?Ít­nù’ר^BuO£mÄèg&V¨}þ¦rõë׿’ÖP™’ˆ`’*`ˆâ^|ÒŸÌ/£®c*Ó¥ÃܥΞٹ-ï)£Õw—׫t´^2OXù[쪭}*©æÛ®ÙÌÕ%\™ +Ø-îšÉ¶¹õjïïÞ‡­ÖÜT®§¶2w~Àw<÷,&¹›ZË$CBŒÎÞfbp­ 7k퀽ZK%A‚²‰ðãÃû}Â(©§ó5"uÊ.:¯Ú˜h¥dn²UÛô«ŠUæóííÆÔÑTç›wÛ)µ•Q®6Ÿ;Òê[žºSíU»ŸÚ­>'Ôl“=Ïú›ËÖŸ<ÑúZ€ÌÔó#‘Æ–öš2”0¦ç÷\Gb•<ŸJæZs{p­Ôˆífáâ”ǾËð}‡oÖ&™®ùÚâ’ॱ­,‰ZYF® }À±¡¨5r§ẠÜÉ_¦çÎîw66½qu#´'IÅWÇÜ{h,ó$V`žy_AëÖÀÌKZc<€â.CTW¦Ú¿ãâ²­­mwZG#îÙJÄÜ{h,ó$V`žyfÞ7f^Ò™S‰ˆÏ‰Yæäó™[à‹+ówi¿®ä)GB5y®{†ûœöê÷ÚØzÄ +õ #׃¾p=(i½Wšeb}Ç>Ûí¡©!^} `^%µ‘WMPsÚk3ë|³²¯¾´ëUx)ÿ½÷}LoaBá^›ˆXŠ/CÉi,¤(U`”9«†ö©ôÕÄ +: ,"ŸâžÐ“´Ïé¶Ë7Íf[÷tm’÷­  ¥ +ƒiy®†6< Xò*ªÀ®?É 0äš‚[Î9^Š!Õ]mØùó7n¥áhÓ9z én¨ø"Œ¥’Ä +Tr÷ÔЖ„ `*%µ‘Š zB¥ aÏr· Æ}ö×6i®oûµÐ¬.â¾×¡U¢†°«ùrE•Ä +¨rŸÕІƒ `T%µ“ˆ7§¨¤Gu<èìÓæQ‡p¶µ‡ƒ¥i†¤ÛCX÷6{Šœ`¶±X÷•. +gÍRPñÙ ¼Ác$±ƒÜ0ƒ¾0ƒ’ÚÈ€rTvÂ@yÏ>ÆÚŸÿZÖÏOÏŸû]ÎÝ*úÝ̺ìGX‰€mCRÈÏà­ ‰䞨¡é `%µÑ^oøétºÖqaÉbo~ûÈÌàìës›Õ>ÆÏâ>Œö¾Pc9%±§Üa0§¾0§’ÚÜÂuƒÉ’[6²Ýº]Åhۮغ_û;ý¹vœìq4Ýó.&¢w½ÑTå'ÀûÞÞ‘ÞOR°÷sOÔ øCU§êÁ8f#É_òÐÿiø©Æ¿ÿ;»ée‰”„ö˜ÍãDšý2Œú]½²ùŸãõ÷dÿxUöúendstream +endobj +3210 0 obj << +/Type /Page +/Contents 3211 0 R +/Resources 3209 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3158 0 R +/Annots [ 3213 0 R 3214 0 R 3215 0 R 3216 0 R 3217 0 R 3218 0 R 3219 0 R 3220 0 R 3221 0 R 3222 0 R 3223 0 R 3224 0 R 3225 0 R 3226 0 R 3227 0 R 3228 0 R 3229 0 R 3230 0 R 3231 0 R 3232 0 R 3233 0 R 3234 0 R 3235 0 R 3236 0 R 3237 0 R 3238 0 R 3239 0 R 3243 0 R 3244 0 R 3245 0 R 3246 0 R 3247 0 R 3248 0 R 3249 0 R 3250 0 R 3251 0 R 3252 0 R 3253 0 R 3254 0 R 3255 0 R 3256 0 R 3257 0 R 3258 0 R 3259 0 R 3260 0 R 3261 0 R 3262 0 R 3263 0 R ] +>> endobj +3213 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 754.651 512.306 763.674] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.4.5) >> +>> endobj +3214 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.4.6) >> +>> endobj +3215 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 727.553 512.306 736.575] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.4.7) >> +>> endobj +3216 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 714.003 512.306 723.026] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.4.8) >> +>> endobj +3217 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 700.454 512.306 709.477] +/Subtype /Link +/A << /S /GoTo /D (section.10.5) >> +>> endobj +3218 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 686.905 512.306 695.928] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.5.1) >> +>> endobj +3219 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 673.356 512.306 682.379] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.5.2) >> +>> endobj +3220 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 659.807 512.306 668.829] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.5.3) >> +>> endobj +3221 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 646.257 512.306 655.28] +/Subtype /Link +/A << /S /GoTo /D (section.10.6) >> +>> endobj +3222 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 632.708 512.306 641.731] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.6.1) >> +>> endobj +3223 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 619.159 512.306 628.182] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.6.2) >> +>> endobj +3224 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 605.61 512.306 614.633] +/Subtype /Link +/A << /S /GoTo /D (section.10.7) >> +>> endobj +3225 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 592.061 512.306 601.083] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.7.1) >> +>> endobj +3226 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 578.511 512.306 587.534] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.7.2) >> +>> endobj +3227 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 564.962 512.306 573.985] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.7.3) >> +>> endobj +3228 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 551.413 512.306 560.436] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.10.7.3.1) >> +>> endobj +3229 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 537.864 512.306 546.887] +/Subtype /Link +/A << /S /GoTo /D (section.10.8) >> +>> endobj +3230 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 510.765 512.306 519.788] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.8.1) >> +>> endobj +3231 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 483.667 512.306 492.69] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.8.2) >> +>> endobj +3232 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.314 459.209 512.306 468.777] +/Subtype /Link +/A << /S /GoTo /D (chapter.11) >> +>> endobj +3233 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 445.66 512.306 454.682] +/Subtype /Link +/A << /S /GoTo /D (section.11.1) >> +>> endobj +3234 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 432.11 512.306 441.133] +/Subtype /Link +/A << /S /GoTo /D (section.11.2) >> +>> endobj +3235 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 418.561 512.306 427.584] +/Subtype /Link +/A << /S /GoTo /D (subsection.11.2.1) >> +>> endobj +3236 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 405.012 512.306 414.035] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.2.1.1) >> +>> endobj +3237 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 391.463 512.306 400.486] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.2.1.2) >> +>> endobj +3238 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 377.914 512.306 386.936] +/Subtype /Link +/A << /S /GoTo /D (subsection.11.2.2) >> +>> endobj +3239 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 364.364 512.306 373.387] +/Subtype /Link +/A << /S /GoTo /D (section.11.3) >> +>> endobj +3243 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 350.815 512.306 359.838] +/Subtype /Link +/A << /S /GoTo /D (subsection.11.3.1) >> +>> endobj +3244 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 337.266 512.306 346.289] +/Subtype /Link +/A << /S /GoTo /D (subsection.11.3.2) >> +>> endobj +3245 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 323.717 512.306 332.74] +/Subtype /Link +/A << /S /GoTo /D (section.11.4) >> +>> endobj +3246 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 310.168 512.306 319.19] +/Subtype /Link +/A << /S /GoTo /D (subsection.11.4.1) >> +>> endobj +3247 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 296.618 512.306 305.641] +/Subtype /Link +/A << /S /GoTo /D (subsection.11.4.2) >> +>> endobj +3248 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 283.069 512.306 292.092] +/Subtype /Link +/A << /S /GoTo /D (subsection.11.4.3) >> +>> endobj +3249 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 269.52 512.306 278.543] +/Subtype /Link +/A << /S /GoTo /D (subsection.11.4.4) >> +>> endobj +3250 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 255.971 512.306 264.994] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.4.1) >> +>> endobj +3251 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [499.405 228.872 512.306 237.895] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.4.2) >> +>> endobj +3252 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 215.323 512.306 224.346] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.4.3) >> +>> endobj +3253 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 201.774 512.306 210.797] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.4.4) >> +>> endobj +3254 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 188.225 512.306 197.248] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.4.5) >> +>> endobj +3255 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 174.676 512.306 183.698] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.4.6) >> +>> endobj +3256 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 161.126 512.306 170.149] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.4.7) >> +>> endobj +3257 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 147.577 512.306 156.6] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.4.8) >> +>> endobj +3258 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 134.028 512.306 143.051] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.4.9) >> +>> endobj +3259 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 120.479 512.306 129.502] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.4.10) >> +>> endobj +3260 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 106.93 512.306 115.952] +/Subtype /Link +/A << /S /GoTo /D (subsection.11.4.5) >> +>> endobj +3261 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 93.38 512.306 102.403] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.5.1) >> +>> endobj +3262 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 79.831 512.306 88.854] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.5.2) >> +>> endobj +3263 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 66.282 512.306 75.305] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.5.3) >> +>> endobj +3212 0 obj << +/D [3210 0 R /XYZ 85.039 786.531 null] +>> endobj +3209 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3266 0 obj << +/Length 3477 +/Filter /FlateDecode +>> +stream +xÚíœ[sÛ¶€ßý+tÞ¤™#„¸ñò˜›3éÄmNíœd¦§´¬ØœÈ’ŽDÅÉ¿/n @"6“&±;™NcŠâjý°ÀbŽ2õ•’d¼eN$§£ÙõQ6ºTß¼8¢î‰©{d=óäìèÑq.F4#UVÎÞûß©2"«|tvñÇøéj9aå¸Û?ÛÉŸg¿=?ó?©¦œëŸýÿÑf£ U„_Ž2«rt£®3B«jt}$$'Rp÷yqtzôÿ[ö;1²R}µ¼$²äÝjPUƒ–%É‹|THIrQ˜zPJ‘dBÇ‚L¦¢¬Æ/æmÛ,ÕËÉ”s1Ö—«åt6™ª¿ õaw½ÔßðñEÝÖöêýF?tmÚ+õaî®ëó…ýÄÊl¬5T•þ#³¬û§ï»³ŠJJ„*tŒ±¹Ù‹ß#ó€Ô4ëšçð·y²â°R™LY¸§],öÑ´Zªèy1*#™âë©äÊ<ÏÇïN^)óUtÝîòÝWŠƒŸÆh;Ó ¥Ä´c³ã´»%Ài§ÔRæ|Pý•¢ÚʧLÕ­\k?»^9{®œg³Yi÷Úª;”ýxìß Õ`؆bb ì±ýqìÝàØSj½“«»9uþf;×Ð7[ËÜô´µk¦÷mmgª{ÒÕ%4©½ ®…èÛ>ÏÇ{òT}W_OX1>×Wö)}óñ‰âQ°o@NUs(5+’ ¦ÃiíkÅIaª<¥Lõ¿(ÖªÞ¸Qî\9o16ß5ʬËK÷ýÅ…ûèøÂÞiWîo4DÞlV p^Ït4ñAÿcÄ4ý‹0Ø|[ý…ú6¯Š/„ck7”—J Šì†Sê¨ÇA%t«¼,Ô-`q«ÞµÊ\WÖz¦W·W+CêÂyŠÆ£ï8k;¬Þn´Ë˜¾÷ÃdZÉò¾`‚D#1éžy³aÚS‚T^2’s1R㜂ÚÇÂè8ÍsN„à¾l,‹ÑS¦”²tµ +0ˆ%Æ–ÄvK€L©…îVæ%‘UÅÏÔ^vg£¡ØƒX{l*1ìÝàØSj½ßJ5·vèz›4P¼¤âýÒçìÔœJu¼Ú½êŽdôgëÁCÙ±ÛØÈ8Ûn p¶)µž­ D² %{¢.O­¿m–6¿¤â§›(½ôb³Ò¨µ#ݸÉUpvW13 ¯ÝZòLÞÎÄT`(Jð†ÁiêþºÔ¤…ÆÒ©!xÈ”ŒÛÔÐqc–"ÿm3<ÏšÍ|ÖštÉõ|>H^™ ‡ù~no=žÍæ[—6RÁs»ñK¢X–(*ë²DÉšü¢5yŽ™<üÒ×d‰$U”½e¸Ë8Q…SÿÌõ; ³ÒP b 'Œ àm¢[¼SL©𢬔z²DÎÍÜ*Ógȵs·=@y‘IÆo}ç&ün +ÝNVºOô!€`™°#1öžÕ)¶ÈÒSvR-Œ€¢È ‡L$²A'0Ü™‘Ð ]ÅøÆ‘ýõìØ lOMoy½®Ír a𠬚µn©æͲùd¯Žõƒ0cÕë•ŸmK‚ãZw¢¸3W…¡T‚X‚JlœJ·8•”ZO%g¤„Ô ¦‘ÉI­ûÕú²¥E5ÜÙÔ¨·iŒûeîåj=dK€Œ-J±õ®žà Sj=HQ涖°Š¹×›ú¡óYcFTÓ‘¶f +ùÙw®v)ó cU½ªNÙä÷ž«êPzA,A/6#N¯[œ^J­ ¹$ìã>ÁzªWùý&gβi]¾•)lÆ1Qtf ,Šüø§3ÇPÂA,A865Ë0ÂÝà„Sj½25âUáý;.umØ€ › vM$¼»/Ÿº¤+« `ÓÓû„ÐÕw( –@ÛGØ-Ž0¥Ö#Ì”³B6GyÕ]ìk Íï¹29½f«WBß>©·ñ–ïÆ:2Ò UY¾/W¹¡¼‚X‚Wl8œW·8¯”ZàÅ+5 …4žæCâIs +Ûa.4¾z9_í{N09ì!Æ9`P#1êžuE ö”…šT #%/)‘>^…Ôø¦„úæ*ÚÑxUûˆV§L9øIg¡¼½TwdwœvG=;¡Ó;p^’ ¶Žñ(!¾õ÷§0+ôÝê‰qòúrn·ò¹Æ¡»’ûç·®âC9±Èب Û ÒSeJ-áRgf÷YÒ1uGFÞšø…ÍYû‰¿°ou"pµùàAukÁ>:o>š­®:z’ì›cquŠ%ˆ%°ÄöaØÎŽžàXRj=¡o±,,…eÙ§Gï^ë%ù}þ\å†ò +b ^±áp^Ýà¼RjýðÇ +Â¥O™Â©ÞZ¼üsËÄ^˾j¶­Ï°‡YHȦ½ôã©ílWk»k}SŸ›uǦÕßÖ;åsµ +,ˆ%€Å–cØZ~O p`)µ~ S”ÊL`K°½ùõå;{µ¶;Ê7×0Œ™Í5[8®á%~= ™M›˜3{7<; ©«K—|( Wô¡4‚X‚FlœF·8”ZO#Ë ác8˜ñßf~ãízìrÆ*Lœûýª›=³BéŽ/žêÓ1åø>úøD”ô;÷y®†C¡±´Øz [­í)-¥ ±2'E–h¼šNŠEÓp»†à×7<\™ígʈ´zˆ3:°Å@¼‘ŽwÏÎ(Þž x“j=Þ‚*#¼"í“«_pÉ=Ümœc¾ž@×é÷—ÛÜgVý`®vC±°Ør8°n p`)µ32Y‘<+ö€…P~/†Ò âžM¶1|®®Cñ±¾ØŽ [uï)Ž/¥Öã9Édy€Bþƒe¾ŽWí$²¸‡È\ý†" b d±ípdÝàÈRj}É‘YI"ÝqÄæ½N/ÇûÈÜ,~C§y%¥!–︪òÇ`tuŠ1ˆ%0ÆöÄ1vK€cL©õiIªh ƒ÷3¸‰•šHÍZ‚â¦ý ñYßm[›é]½¹èù\¤ºî¾‡~­5³Ž…½s]‡`˜ÕŽó<*9‘\UUy3‘:[*Mã2ÏîÕRo (K÷¬rH°.箘«÷ZX‚”JtªÇwΠ^,ºcH4FøÜÞK8˜µ3¯ñ¸ú—β?¤î kõ’Fg#±D«wÙæ‡m.è)Á-‡ªô!6’"Ê\õ"€‡LÙÄÞ!{ Àø}>³' ÜçWºKËƳ.6è?⧒E>øEkMl7ú¥¯9@•¡µÁÓ!‚ÞÍY)ñótâaÎJC=,ˆ%<,&€·‰n ðq%¥ÀWÉeܾBâÖ6à 6° )¼Ä(ÐÐUòOé„°B¿÷2+~[Û=‘j|4‘C»[šã6 +°¡„î^Ù÷2Ít´ðÁ,‹ºLòonËÀǺ†›É´ÀWǾÿpéª>dÂAÆFåØÞ®zdJ§Y(#Rîƒ Ùbó*ãÐ ïÑšËGÀ-\ +r‹lƒ +mF¸*Øy¿¤­ãà÷ ‚Tê5ƒÁz\ o> endobj +3268 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 754.651 512.306 763.674] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.11.4.5.4) >> +>> endobj +3269 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (subsection.11.4.6) >> +>> endobj +3270 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 727.553 512.306 736.575] +/Subtype /Link +/A << /S /GoTo /D (section.11.5) >> +>> endobj +3271 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 714.003 512.306 723.026] +/Subtype /Link +/A << /S /GoTo /D (subsection.11.5.1) >> +>> endobj +3272 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 700.454 512.306 709.477] +/Subtype /Link +/A << /S /GoTo /D (subsection.11.5.2) >> +>> endobj +3273 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 686.905 512.306 695.928] +/Subtype /Link +/A << /S /GoTo /D (subsection.11.5.3) >> +>> endobj +3274 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 662.447 512.306 672.015] +/Subtype /Link +/A << /S /GoTo /D (chapter.12) >> +>> endobj +3275 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 648.897 512.306 657.92] +/Subtype /Link +/A << /S /GoTo /D (section.12.1) >> +>> endobj +3276 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 635.348 512.306 644.371] +/Subtype /Link +/A << /S /GoTo /D (section.12.2) >> +>> endobj +3277 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 621.799 512.306 630.822] +/Subtype /Link +/A << /S /GoTo /D (subsection.12.2.1) >> +>> endobj +3278 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 608.25 512.306 617.273] +/Subtype /Link +/A << /S /GoTo /D (section.12.3) >> +>> endobj +3279 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 594.701 512.306 603.724] +/Subtype /Link +/A << /S /GoTo /D (subsection.12.3.1) >> +>> endobj +3280 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 581.151 512.306 590.174] +/Subtype /Link +/A << /S /GoTo /D (subsection.12.3.2) >> +>> endobj +3281 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 567.602 512.306 576.625] +/Subtype /Link +/A << /S /GoTo /D (section.12.4) >> +>> endobj +3282 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 554.053 512.306 563.076] +/Subtype /Link +/A << /S /GoTo /D (subsection.12.4.1) >> +>> endobj +3283 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 540.504 512.306 549.527] +/Subtype /Link +/A << /S /GoTo /D (subsection.12.4.2) >> +>> endobj +3284 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 516.046 512.306 525.614] +/Subtype /Link +/A << /S /GoTo /D (chapter.13) >> +>> endobj +3285 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 502.496 512.306 511.519] +/Subtype /Link +/A << /S /GoTo /D (section.13.1) >> +>> endobj +3286 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 488.947 512.306 497.97] +/Subtype /Link +/A << /S /GoTo /D (section.13.2) >> +>> endobj +3287 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 475.398 512.306 484.421] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.2.1) >> +>> endobj +3288 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 461.849 512.306 470.872] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.2.2) >> +>> endobj +3289 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 448.3 512.306 457.322] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.2.3) >> +>> endobj +3290 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 434.75 512.306 443.773] +/Subtype /Link +/A << /S /GoTo /D (section.13.3) >> +>> endobj +3291 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 421.201 512.306 430.224] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.3.1) >> +>> endobj +3292 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 407.652 512.306 416.675] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.3.2) >> +>> endobj +3293 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 394.103 512.306 403.126] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.3.3) >> +>> endobj +3294 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 380.554 512.306 389.576] +/Subtype /Link +/A << /S /GoTo /D (section.13.4) >> +>> endobj +3295 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 367.004 512.306 376.027] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.4.1) >> +>> endobj +3296 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 353.455 512.306 362.478] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.13.4.1.1) >> +>> endobj +3297 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 339.906 512.306 348.929] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.13.4.1.2) >> +>> endobj +3298 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 326.357 512.306 335.38] +/Subtype /Link +/A << /S /GoTo /D (section.13.5) >> +>> endobj +3299 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 312.808 512.306 321.83] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.5.1) >> +>> endobj +3300 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 299.258 512.306 308.281] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.5.2) >> +>> endobj +3301 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 285.709 512.306 294.732] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.5.3) >> +>> endobj +3302 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 272.16 512.306 281.183] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.5.4) >> +>> endobj +3303 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 258.611 512.306 267.634] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.13.5.4.1) >> +>> endobj +3304 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 245.062 512.306 254.084] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.13.5.4.2) >> +>> endobj +3305 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 231.512 512.306 240.535] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.5.5) >> +>> endobj +3306 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 217.963 512.306 226.986] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.5.6) >> +>> endobj +3307 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 204.414 512.306 213.437] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.5.7) >> +>> endobj +3308 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 190.865 512.306 199.888] +/Subtype /Link +/A << /S /GoTo /D (section.13.6) >> +>> endobj +3309 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 177.316 512.306 186.338] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.6.1) >> +>> endobj +3310 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 150.217 512.306 159.24] +/Subtype /Link +/A << /S /GoTo /D (subsection.13.6.2) >> +>> endobj +3311 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 125.759 512.306 135.327] +/Subtype /Link +/A << /S /GoTo /D (chapter.14) >> +>> endobj +3312 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 112.21 512.306 121.233] +/Subtype /Link +/A << /S /GoTo /D (section.14.1) >> +>> endobj +3313 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 98.661 512.306 107.683] +/Subtype /Link +/A << /S /GoTo /D (section.14.2) >> +>> endobj +3314 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 85.111 512.306 94.134] +/Subtype /Link +/A << /S /GoTo /D (subsection.14.2.1) >> +>> endobj +3315 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 71.562 512.306 80.585] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.14.2.1.1) >> +>> endobj +3316 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 58.013 512.306 67.036] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.14.2.1.2) >> +>> endobj +3267 0 obj << +/D [3265 0 R /XYZ 85.039 786.531 null] +>> endobj +3264 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3319 0 obj << +/Length 3246 +/Filter /FlateDecode +>> +stream +xÚíœÝsÛ6ÀßýWèáfNš9¡Ä7ùt“ÆÉ5mäbgòÐë-)6'²å#©¤ùï߀D-\&qb÷2&Ååû‹Å2xR¨ÿð¤ä¨ ÕD–qŠ'‹«£br¡~ù×vwÌÝ-óäžÏŽ~x*ب*ªÉÙÛðœª@¼“³åoÓÇ›ë)§ýÊþÕÍ~?ûùèÉYxp¢Sªûߣß~/&KÕ„Ÿ +D«ròA}.®ªÉÕãqFÝ÷õÑéѿóìolb¥õ‚Óñ’»yÒ \–HH1‘œ#Á¤éfˆ ŒfxJÑlÎÊjúúºQßþ˜Í)eÓM«ÿ¦ÓçOÕµSûùñºq½¶ß-fs<]¬ôŸ]§ÿ\-í/O›µ³?¨‡åTéàE1ü‹UÕ¨ßö¬Í*†*{6°Q{1±^%VóRóDlhµýg«Q¶ßŽ1R†?Ђ!-{k^m€Å*ö]XÌÁ:ÕÞ̈œ~°&¯¯—êÊžÛëëvµnêsum½²HŸ¯z ïƒR·áé;ͬ üÎḞŒ…Å2pR+Áp†-€áäÔ8DÍ;VíÁáÎÉV›½oæ¯í¬pLŽëÞ©íUõ§`ü3Ì}G´\×ÆÒŠbZ©Ù`ZÃÀ´rj-uu—”p¤^Ÿ86šK_Û™rª¾\Ömâ¸$_Ìîw„Mõq,2+’ÁåíF9„jW+Œ R±}JÒQúÑ`ø ½WÝ:o¶yë–šY©W«…»üº3÷ªWÒ{Éör,§ •A•Ø¦5PËèôÌD)Õ%¼­tÐ-ßϸPë’º¶HƒƒÓúJ“<¯í×77³¹Y’zuçÖ!ÆAöÍÂÞñëFÝPª‡¨»Þ韯/ì/툨¯V½£nDi‰a¾Ñ#$b0„ƒ€´ÄU8H†('{*¿5]ר Õ†pmÓ7H½¶j..]Dg‘™è­>oÖúÖ^›ý£šO\ÞõôðË&ŠeؤF‚Ù [³É©Åı* êÙèX›06œÊÐ7f”›È¬ßêYÓ¸i`yiï¶3ô~&ø]I»QLeAîçóv‹6ŠeЦ6¦B;lŒ6§«]™r¢"xD8‹hÕ´›S!¦OþÐÓçJûIâoÅè?fêÊŶ5ᆙ–UI¿­¯HÒu{,É(–!™š”Jˆä°0ÉœÚà@©"Zì’ÄSìèqÓÕçëtÝyqcw_q.êX¾,î;9×ͱä¢X†\jB˜Ü°0¹œÚ@Žs¾GŽ€ä~Yµ×«µ§hÜ©Œ«J~S>®3cùD± ŸÔP0Ÿa `>9µaù+Rÿ{>Ì-'.£ôƬaK›ÊЩ »ÛÒÞò…^Cd¨7Ô×MçBB·zr^,/bÄ®ˆµùñZ%¢Š‘Ï#æº7–XËKMGKˆØ°0±œZ¿ªñŠ¢‚ËH̯joìFë]×»…ËÄò~ܾ׆¶q¾ý鉳µ¾®sLÈ{î}×GÒLÄ`š»f-šZÒ̪ 4e…xQFšÄÑ<])bŠÏMéïacà–'zÒYˆM’ ‘’9‚_‘®3ÅXºQ,CwÇÌ Ýa `º9µÞ»rÁQÅ]î¼ëK ¶sû.MÝ»\—ö‰m«½ëÙgèy]â{ƒòS0;›ŒÅÅ2˜wì!ÌÃÀ˜sjfN+B²Y8Ì7f‹qå}±ž®m»ñIL¾=·¯ˆÝÙh,ö(–Á¾cû°0öœÚà»i‰J©û…x6¥}P¿<·ƒ`ÕjþþèÊ4¨!Q_èTðâ®mïÇò Rœ©] Ds †™Ñ¦0áêÞ*•n +?ZêØ·1ñTÌǽ2îº^†Ð•“¿øäuÖ ;ŠehïXÄ=lÁ€7- ”M9ÄøáóxÏ[÷•iÐF"R} ’-¼`U‰$X±àìÈJ‰h,„ݼy÷Ö.·>vµaŒwæ´÷mZ|½Yåm7rV%bð¬Ú᎔-½hVmR->?ÈÍfFsh¦É´+—DÙ€]ìBa—‡íM·üåÀ;+Å2àS0øa `ð9µ¼()¸ïQÎf¥ +yl¢Çœ˜,üzl7?‹­-Lò{ý“?9~i܇=9\ôÝÛqsâJÝmÓ2;¦Ô7¬žÙÐjkÆ–w€Òõ{,Ê(–A™ÚF9lŒ2§Ö‡µŒ $¸ˆ(}\ûº ‰ºËMç6ªçµ=Ðw×ç)­b–¸úkë½ï©wßé±£X†cjP˜ã°0ÇœÚÀ‘*t…ŒIàèK0 ÀXðä*€~N-l*±Äâ!¦”¼ ÆRbª©yT*u 0ÕœÚ@Wˆó„*ÎÎÆUÀ¶o5Û4c¸;=µCÖtŃáé:?–gËðL ó¶æ™Sx>3©y²!O— ÔAQ»2塵>Yëœ=ûvÑÍ1vË8Še§Æ†[3ΩõŒiEÔ†´ŠŒ9Èø™ž˜/Üdz3¶ uŽúÛÒÖwÔuÁ¨ïýH ‰ tDz *:ÐhVm*KTáÈS8žÏÏ~=yOüq²f»ÓôŽZ)ñß¡®÷cy© ÎÄ®0ÍzfF§ß¹P¡ŠÓŸ€¿¾¹05@ËôðÚT…I2é´þ¿ÈSx Å2ÄSë3¨4ì@ `æ9µ:ǨÄ:ÿ~bs»³ÑXìQ,ƒ=µ?Œ}Ø{NmðÛ´DDˆÝomOmµ§«YQC`Ý:•5îºÄ•¸»a’›Ù²]lvÈÿp;¬­©Ò5"ýe\̯ïû¸ðÝ=~’jcÆËò1º>ÅÅ2S{‡-€1æÔŒ„!‰iÄèw¶o.Ý:«Í¸¨žm·S|®SD‹Erðf¯i0›+g5mÜovª+Òw6gØMo}qüªíþ9›KÂ?‘šëâXjQ,C-5LmØ‚Ï;q¡EHRvðÄÅßdÚ&ì‰Ë³kµ•]n®êæÚb>›UÊà[“‚rújeÊáû˜Gì.››8•Išñ'Ne²Þ{¢µ'Tº—<)*“–T%Âô–l,)’¾4M„S™ïiø9æ­4rŽ%bðÛ!Ž‰-=cVm/)Â<€'i¾ ¾©÷ÇØëÚl›Ë¦óÆ [ùî¢Ý˜ÒN5>‘ ¯³ÅX¼Q,ƒ7µ3ŒwØoNmÀË+$|ÎQ„S–çuz:Bcõ®Ù»,mé®›êÏϘýp¦v¢]öí^±¯»»ô}‹-Še°¥öcPÉîÀØrj}¼B˜@…/KɉJ€Qw–X¹ +t¨‰X ¸eÓc¿ š| /Bd¢¬†Â¢uþ=-«vOU4oŸæ·‰áÅf«"ÜjÚ«§a‰ëÀX&Q,Ã$5ÌdؘINm`B â¾fL$§#† c¥aÂXBvý9Å⽓‹–3XVêi²t‚KÖ¥¾±O<òjé”ÚÈÔ:]³óø» d&”™Ì1 /hßÔ]ç6z«`ι­˜¿GY¤;r¸DÕxç¤2ÒÞsËx¨‡‡cFgpìG ûÁÈB:"qÉé[2{o'>?ÓcfÞÙ,£-ué¸ÕóoÊÎöv,» •a—Øf7P³ËèôžW•"’ +žÒœ:Ûù$À*ŲïâÍFÔ¸ Û°ë~Ì:ßבè1˜ÝŽAxZÒ˪ ødivžÏ/©~Ê)¥÷ˆ™ëàXfQ,Ã,5« fÃÀÌrj½»Ä‚)vÔ3ûž¾=„ÝÙh,ö(–ÁžÚŸC¯ÓhŒ=§6LUŽÁ,b÷žÖ–™­×iQ½›³çö¥ý$6>i1·Þ ‡ÔQLn»Ô3ŸÚ×Æã •å€s½ .ŠeÀ¥„Á [pKê¯Ê§þ0HÞ–úó7™¶I›úûi£×FWk][Ø'Í¢Ýt¾ˆømo¯ûì_×·þãù6éú–§þº‰´‡×>êGÙû®ìå¾]­¬FãHn©òNúö'ò‰YKì=ÑB‚^gIžô9ùD¬ø‰Ûò‰Xí:ˆÏfÉïùD`â:+¸Q,3qSð˜¶ö¸9µ|U!ák¢dH'~_gêÎD#¡G)˜yj|½3T{µÆ¹õ?õÿLÛ§ÿs˜ñÕµã-NígÔÐbªvVÔ…ÃñìþÙLwSÒâÿ8&'endstream +endobj +3318 0 obj << +/Type /Page +/Contents 3319 0 R +/Resources 3317 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3158 0 R +/Annots [ 3321 0 R 3322 0 R 3323 0 R 3324 0 R 3325 0 R 3326 0 R 3327 0 R 3328 0 R 3329 0 R 3330 0 R 3331 0 R 3332 0 R 3333 0 R 3334 0 R 3335 0 R 3336 0 R 3337 0 R 3338 0 R 3339 0 R 3340 0 R 3341 0 R 3342 0 R 3343 0 R 3344 0 R 3345 0 R 3346 0 R 3347 0 R 3348 0 R 3349 0 R 3350 0 R 3351 0 R 3352 0 R 3353 0 R 3354 0 R 3355 0 R 3356 0 R 3357 0 R 3358 0 R 3359 0 R 3360 0 R 3361 0 R 3362 0 R 3363 0 R 3364 0 R 3365 0 R 3366 0 R ] +>> endobj +3321 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 754.651 512.306 763.674] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.14.2.1.3) >> +>> endobj +3322 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.14.2.1.4) >> +>> endobj +3323 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 727.553 512.306 736.575] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.14.2.1.5) >> +>> endobj +3324 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 714.003 512.306 723.026] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.14.2.1.6) >> +>> endobj +3325 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 700.454 512.306 709.477] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.14.2.1.7) >> +>> endobj +3326 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 686.905 512.306 695.928] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.14.2.1.8) >> +>> endobj +3327 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 673.356 512.306 682.379] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.14.2.1.9) >> +>> endobj +3328 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 659.807 512.306 668.829] +/Subtype /Link +/A << /S /GoTo /D (section.14.3) >> +>> endobj +3329 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 646.257 512.306 655.28] +/Subtype /Link +/A << /S /GoTo /D (subsection.14.3.1) >> +>> endobj +3330 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 632.708 512.306 641.731] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.14.3.1.1) >> +>> endobj +3331 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 619.159 512.306 628.182] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.14.3.1.2) >> +>> endobj +3332 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 605.61 512.306 614.633] +/Subtype /Link +/A << /S /GoTo /D (section.14.4) >> +>> endobj +3333 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 592.061 512.306 601.083] +/Subtype /Link +/A << /S /GoTo /D (subsection.14.4.1) >> +>> endobj +3334 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 578.511 512.306 587.534] +/Subtype /Link +/A << /S /GoTo /D (subsection.14.4.2) >> +>> endobj +3335 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 564.962 512.306 573.985] +/Subtype /Link +/A << /S /GoTo /D (section.14.5) >> +>> endobj +3336 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 551.413 512.306 560.436] +/Subtype /Link +/A << /S /GoTo /D (section.14.6) >> +>> endobj +3337 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 537.864 512.306 546.887] +/Subtype /Link +/A << /S /GoTo /D (subsection.14.6.1) >> +>> endobj +3338 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 524.315 512.306 533.337] +/Subtype /Link +/A << /S /GoTo /D (section.14.7) >> +>> endobj +3339 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 499.856 512.306 509.425] +/Subtype /Link +/A << /S /GoTo /D (chapter.15) >> +>> endobj +3340 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 486.307 512.306 495.33] +/Subtype /Link +/A << /S /GoTo /D (section.15.1) >> +>> endobj +3341 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 472.758 512.306 481.781] +/Subtype /Link +/A << /S /GoTo /D (section.15.2) >> +>> endobj +3342 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 459.209 512.306 468.232] +/Subtype /Link +/A << /S /GoTo /D (section.15.3) >> +>> endobj +3343 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 445.66 512.306 454.682] +/Subtype /Link +/A << /S /GoTo /D (subsection.15.3.1) >> +>> endobj +3344 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 432.11 512.306 441.133] +/Subtype /Link +/A << /S /GoTo /D (subsection.15.3.2) >> +>> endobj +3345 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 418.561 512.306 427.584] +/Subtype /Link +/A << /S /GoTo /D (subsection.15.3.3) >> +>> endobj +3346 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 405.012 512.306 414.035] +/Subtype /Link +/A << /S /GoTo /D (subsection.15.3.4) >> +>> endobj +3347 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 391.463 512.306 400.486] +/Subtype /Link +/A << /S /GoTo /D (subsection.15.3.5) >> +>> endobj +3348 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 377.914 512.306 386.936] +/Subtype /Link +/A << /S /GoTo /D (subsection.15.3.6) >> +>> endobj +3349 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 364.364 512.306 373.387] +/Subtype /Link +/A << /S /GoTo /D (section.15.4) >> +>> endobj +3350 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 350.815 512.306 359.838] +/Subtype /Link +/A << /S /GoTo /D (section.15.5) >> +>> endobj +3351 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 337.266 512.306 346.289] +/Subtype /Link +/A << /S /GoTo /D (subsection.15.5.1) >> +>> endobj +3352 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 323.717 512.306 332.74] +/Subtype /Link +/A << /S /GoTo /D (subsection.15.5.2) >> +>> endobj +3353 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 299.258 512.306 308.827] +/Subtype /Link +/A << /S /GoTo /D (chapter.16) >> +>> endobj +3354 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 285.709 512.306 294.732] +/Subtype /Link +/A << /S /GoTo /D (section.16.1) >> +>> endobj +3355 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 272.16 512.306 281.183] +/Subtype /Link +/A << /S /GoTo /D (section.16.2) >> +>> endobj +3356 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 258.611 512.306 267.634] +/Subtype /Link +/A << /S /GoTo /D (section.16.3) >> +>> endobj +3357 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 245.062 512.306 254.084] +/Subtype /Link +/A << /S /GoTo /D (subsection.16.3.1) >> +>> endobj +3358 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 217.963 512.306 226.986] +/Subtype /Link +/A << /S /GoTo /D (subsection.16.3.2) >> +>> endobj +3359 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 204.414 512.306 213.437] +/Subtype /Link +/A << /S /GoTo /D (section.16.4) >> +>> endobj +3360 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 190.865 512.306 199.888] +/Subtype /Link +/A << /S /GoTo /D (subsection.16.4.1) >> +>> endobj +3361 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 177.316 512.306 186.338] +/Subtype /Link +/A << /S /GoTo /D (subsection.16.4.2) >> +>> endobj +3362 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 163.766 512.306 172.789] +/Subtype /Link +/A << /S /GoTo /D (section.16.5) >> +>> endobj +3363 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 150.217 512.306 159.24] +/Subtype /Link +/A << /S /GoTo /D (subsection.16.5.1) >> +>> endobj +3364 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 125.759 512.306 135.327] +/Subtype /Link +/A << /S /GoTo /D (chapter.17) >> +>> endobj +3365 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 112.21 512.306 121.233] +/Subtype /Link +/A << /S /GoTo /D (section.17.1) >> +>> endobj +3366 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 98.661 512.306 107.683] +/Subtype /Link +/A << /S /GoTo /D (section.17.2) >> +>> endobj +3320 0 obj << +/D [3318 0 R /XYZ 85.039 786.531 null] +>> endobj +3317 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3369 0 obj << +/Length 3934 +/Filter /FlateDecode +>> +stream +xÚÝœÝsÛ6ÀßýWè2©ô ”ñAÞ[â|\:×4»—‡´ŒÅØœJ¢’êäþúÃ7@‘‹„Iì87ÔIpûËH<ËäxV0”ååL±Ï.6'ÙìR^yv‚íK{Ë2ºçÑùÉOO9á •Y9;çŸSfˆ•|v¾z3?m· RÌ÷µù³[üqþóÉ“sÿàH4ÎsõØÿœ¼ù#›­¤ +?Ÿd(/‹Ù<Î.ËÙ愲1šÛß듳“ùg™ktfJÕ‚f¥ÔUÌ–y†Š‚ŽÞƒI¸à²ªŒ!N…¯*É¢ªbLPŽÉÌÝ¤êŠ ´X–t~º^àyµÛ5òÏEµ^,sÎç/»f»o¶—ê—˜Ÿ®¯åž· ù¿nlZæòñ³Hs¥»œ™ƒWq­ÌÍi…ž¨õeù±\†ñ‘Ü¡ GDÈ‚0ùHcQ@÷ +a[ÐÚYP‚2ÉËZKJçO׋¥´äþ ÙÕ;i°œÎ«íJäóGúêV^Ó¿g˜ÊcÙÄ–eIæò1,ËÔZ–ѯÑ?©[n±øصAC ¨¤ÁJs-”ZFņŽŸý‘61Ô`ÞÞšëÁË¿Œ–<±àÏE>¯/D̯ÜƸþÜð&å|ßµòæb¾’×ûFv2K–gÿwЭ…¦BÅÐcëÃЇÀÐSb¥$¸˜ yÖW¾®úÆ×WªÃÜÿÖǪw” À{¸õýæi Ô`ÒÔ¢®É.Àõ +•ùósûÖ¼S}G»±}‡9wºnìx´Xß8YË©ÐL‘0g9F!X}©0(H”‡”aD#N¹1Lù£±œÜôh&íùJXWûÚB£¾íŽ/+K)U—^ªÒUWm꽦ÛºE–ߺ7™ZMåâK%ÐDö‚é ÄÀ2#^y +H¹ƒd ¬¼h£¹ô쬼à•>qÑn6Îsìº +.Óvæø7ã]‹¥È³»ì-†®Ö!FÅ`Š=‹‚G49&Åz‚¢œ‘’~2ÈwŽÒ£J—ÊK7ê êVá®Óvs]í›·Ê ×Í^=õƒì]»ct¶žSÑ…b t± ƒÐ 5€Ñ¥Äzt\N#²< cŸŒnÛrëV o—ö²>Õl͸vØɳTNîIqµF˜Ê5Kp sjsM‰u‘©œú ¨ãšÛÈô¡á£{Äfs-¹­kçb½ñNn¼Û[Ðrþ·ÐÑ«Ž:Ô™ý5e¹2'Îdc‘—ßVË\ÎaX~Çm¥§r Åcƒ2qjsL‰õþ™Ë¿YÄÑœÿÖsŒ®±Ð.Ì43SZi>8«÷rڮȺtëFFí´,ÌÆQÜ׺¨§]Wt.È-вU›J+KЊÍÓjÓJ‰õ´H†¤“Z.ì´~'Ç®ýÚ„*ŠÃ“÷vŽÐ5›:Ì ÍEçu7¦#ÞM +^Þ£ÔÖ{*ÊP,2¶)Ê¡0Ê”XßfÉ%µè“÷ª·ó“º•›.ÈŽï:"k{ÓKöëM©`å¥&&î˜nTÌU¼£{R"Š[€fk8Z(–€[•´¡0´”X•9ʘOe2 íq½¯šµC¥¼NŽ{ÕVÏØÝåþ*vPÿ¸±Ï !P¯geYy·^çj;`T س$ÇÀ @€I±®e¢D,+@7Ü_Y$o”µ×íÛjý‡õ<7õ³I´‚ßMÂë–˜ZLeŠ%˜ÆÆ…™5€™¦Äz¦œ¡’ELÉÓë(¸Œgxqâ»l­1p(–[šðPpJ¬ÌäŒ?+`—Çy¸µ3uÅïÍÆü8RŠä"Ô?㣫g2¦ãkgKû¨eô¬¡ÒDÆq “žÒ×QR°îr9ò0òuT´ÏúˆŽ¼D%a=·Õ¦vžPëh߸/¿ášÔÆCå&µñ”MŽŸmÚ8”ôÑnã)±¾ç*xhât$ŸìÇ:^ØT[›Àb²‡»ûõ˜[꽌¦‚õ¥\#ÃXâaª ™*‘}ƪK~=®ßU*t_ï}æ#Ô%b…wgsÍ.…ùׂq9SkÚCˆÛªaí=”@9;¼uÃÜw°¯7;•ÜÌ?NÃê?G(–àÛ†C©ä `")±‰¼Ypp‹$„ÚÆr‡ëÞ„Ø"hÕ¯¿NcgX±ojçÔ±¿âÇ1ý6~d«9•\(– ›CÇ `r)±nîEËìÉq;÷z¾U¶Ö\¤°¹› ÷RQýïÐYx:ß5Û 7DKQä÷§tF˜È5*sí˜C9­ @®I±Î#iAçyàê¦dñ´ö¸kþR?ëβmA¶gugnÖ ì’¬ÕOO9£!9óÇ‘ª+^¶Ívï¦á²Yddþ£Þ˜dJöª èŒp[ð3C­E¦BÅckÇÀSb=dÆ4@þô9ÚÇQi”ëjlKèêM«š€¾ÙÖpf-ª™èŒÎ0þš~ië7Y(–@ÛŽC Ê `d)±HNÏ27ë:íêÊnÓ;Jg½‰':?Dóꫪ“·EvÏÃOWç©C±ÆØž0Æ¡0Æ”X‘R”a0~úÚ¹[Æé#Žƒçt=)i~xÚÊOåŠ%xƆåÄs¨Ì3%ÖóÌ3D¹<ÝœâLÍ +ÞêõžUÓmg$gûÎì0k“²™êæuz½‹[pûW˜)©:x©Òï«•OøÈS2æÙ™è,»,µwO|bö†k|Ì)ƒžêįƒf¢%ù ±éˆ|ÚóèÕoó6Mµ^ëA•0”•8Tõ>2S… û"+žºÚ„²%+¾‡oÜÒ-­ÄÅä|XT,Ñ¢íM¦EC‹ #À-:%Ö%3I–!œ‡=Øånßêêvnã’î1†O„£sáç¡áUký¾ƒÝ/š“ûÀÔ`*R_*A42- t æ™épbõE¡ž.7ýüÕ5ýúJ½«§? +òðÅùßÜv‰}/½ñ¸þ«qûš~ñ}Áªîí¥É÷bn†oÅëÃ"ãŸGÆÕe"š¨̦o'hé`DNR¬Ç#r”å$àq;%ôz]œrp‹1_âi×£¯]4Kc˜Þ­»9 L…Š% ö¬ ¥§G4€¡¦Äz¨¬D´ˆúP·oâáÚ¼1©§"Ö{6ÕŸ–šë\»0,®¿éW¿Ø¾µ‰îøÕÚÊíkjMœmƒ7·Êôàzè•6‹"/l\neûäe+7•W(–àÕ3Èk¨Ì+%Öq˜2TæžWiƒ¸_Î÷LOcÌÇ“”ËL|ûhçîÖئ¢Åè{  ÷ƒF4€Ñ§ÄzWÍ Ê Ѓk캨¥¡ê¶Þ¿`ñ«ò.Ìï¿sÉÍ©¢_ÆÈVh*£P,Á¨g,ÑP˜QJ¬g¤úÐœF$Þ¶d¿eÕv½óuÕ]Zs¿8èŽÍ§åÃàw#{ñÃï\’þîPWß©C±ž-¡Åš `„)±aÆ ï(•á5<±ƒÍ~y´õáh—aôYˆÈ¿^ëÇ­LfÚÞùâÜü}¨`¿V;󋯂ÊÖk*ªP,ªg3(ý?¢Œ*%Ö¡*1¹¤\ìòÚ1Rït/¬w:”´½Ü/æã»ÊùÞiµu©?õó¢ÝnÃîBû²ŒÉUuÑ–#ª3 *˜â½îò…Nü1šXA³u˜H%”‚¡ô¬1Š‘¤dúïÅÉIxq»6Y#›ï«ø ^QûMÇ›«: + %™Út„:ÁmüøB(¿ë^ÐÖzê÷ä|©Ä÷äb{BKCñð÷ä2ý×W(âyúWÇÂJ„¦ä¾³øˆÒ_ª3r¬SÁ'+¿$™­ûä/¹R©EV¿ä1Ÿøè® .26öÕ]ù/wßßüüo(ûo÷RÙ +`ɈÓ:Ë¢."[y˜œØØ›"ÿéøÏõendstream +endobj +3368 0 obj << +/Type /Page +/Contents 3369 0 R +/Resources 3367 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3158 0 R +/Annots [ 3371 0 R 3372 0 R 3373 0 R 3374 0 R 3375 0 R 3376 0 R 3377 0 R 3378 0 R 3379 0 R 3380 0 R 3381 0 R 3382 0 R 3383 0 R 3384 0 R 3385 0 R 3386 0 R 3387 0 R 3388 0 R 3389 0 R 3390 0 R 3391 0 R 3392 0 R 3393 0 R 3394 0 R 3395 0 R 3396 0 R 3397 0 R 3398 0 R 3399 0 R 3400 0 R 3401 0 R 3402 0 R 3403 0 R 3404 0 R 3405 0 R 3406 0 R 3407 0 R 3408 0 R 3409 0 R 3410 0 R 3411 0 R 3412 0 R 3413 0 R 3414 0 R 3415 0 R 3416 0 R 3417 0 R 3418 0 R 3419 0 R ] +>> endobj +3371 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 754.651 512.306 764.219] +/Subtype /Link +/A << /S /GoTo /D (chapter.18) >> +>> endobj +3372 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (section.18.1) >> +>> endobj +3373 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 727.553 512.306 736.575] +/Subtype /Link +/A << /S /GoTo /D (section.18.2) >> +>> endobj +3374 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 714.003 512.306 723.026] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.2.1) >> +>> endobj +3375 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 700.454 512.306 709.477] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.2.2) >> +>> endobj +3376 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 686.905 512.306 695.928] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.2.3) >> +>> endobj +3377 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 673.356 512.306 682.379] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.2.4) >> +>> endobj +3378 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 659.807 512.306 668.829] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.2.5) >> +>> endobj +3379 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 646.257 512.306 655.28] +/Subtype /Link +/A << /S /GoTo /D (section.18.3) >> +>> endobj +3380 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 632.708 512.306 641.731] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.3.1) >> +>> endobj +3381 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 619.159 512.306 628.182] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.3.2) >> +>> endobj +3382 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 605.61 512.306 614.633] +/Subtype /Link +/A << /S /GoTo /D (section.18.4) >> +>> endobj +3383 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 592.061 512.306 601.083] +/Subtype /Link +/A << /S /GoTo /D (section.18.5) >> +>> endobj +3384 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 578.511 512.306 587.534] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.5.1) >> +>> endobj +3385 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 564.962 512.306 573.985] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.5.2) >> +>> endobj +3386 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 551.413 512.306 560.436] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.5.3) >> +>> endobj +3387 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 537.864 512.306 546.887] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.5.4) >> +>> endobj +3388 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 524.315 512.306 533.337] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.5.5) >> +>> endobj +3389 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 510.765 512.306 519.788] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.5.6) >> +>> endobj +3390 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 497.216 512.306 506.239] +/Subtype /Link +/A << /S /GoTo /D (section.18.6) >> +>> endobj +3391 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 483.667 512.306 492.69] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.6.1) >> +>> endobj +3392 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 470.118 512.306 479.141] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.6.2) >> +>> endobj +3393 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 456.569 512.306 465.591] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.6.3) >> +>> endobj +3394 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 443.019 512.306 452.042] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.6.4) >> +>> endobj +3395 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 429.47 512.306 438.493] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.6.5) >> +>> endobj +3396 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 415.921 512.306 424.944] +/Subtype /Link +/A << /S /GoTo /D (section.18.7) >> +>> endobj +3397 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 402.372 512.306 411.395] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.7.1) >> +>> endobj +3398 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 388.823 512.306 397.845] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.7.2) >> +>> endobj +3399 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 375.273 512.306 384.296] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.18.7.2.1) >> +>> endobj +3400 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 348.175 512.306 357.198] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.18.7.2.2) >> +>> endobj +3401 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 334.626 512.306 343.649] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.18.7.2.3) >> +>> endobj +3402 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 321.077 512.306 330.099] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.18.7.2.4) >> +>> endobj +3403 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 307.527 512.306 316.55] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.18.7.2.5) >> +>> endobj +3404 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 280.429 512.306 289.452] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.18.7.2.6) >> +>> endobj +3405 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 266.88 512.306 275.903] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.18.7.2.7) >> +>> endobj +3406 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 253.331 512.306 262.354] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.18.7.2.8) >> +>> endobj +3407 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 239.781 512.306 248.804] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.18.7.2.9) >> +>> endobj +3408 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 212.683 512.306 221.706] +/Subtype /Link +/A << /S /GoTo /D (section.18.8) >> +>> endobj +3409 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 199.134 512.306 208.157] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.8.1) >> +>> endobj +3410 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 185.585 512.306 194.608] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.8.2) >> +>> endobj +3411 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 172.036 512.306 181.058] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.8.3) >> +>> endobj +3412 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 158.486 512.306 167.509] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.8.4) >> +>> endobj +3413 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 144.937 512.306 153.96] +/Subtype /Link +/A << /S /GoTo /D (section.18.9) >> +>> endobj +3414 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 131.388 512.306 140.411] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.9.1) >> +>> endobj +3415 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 117.839 512.306 126.862] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.9.2) >> +>> endobj +3416 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 104.29 512.306 113.312] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.9.3) >> +>> endobj +3417 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 90.74 512.306 99.763] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.9.4) >> +>> endobj +3418 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 77.191 512.306 86.214] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.9.5) >> +>> endobj +3419 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 63.642 512.306 72.665] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.9.6) >> +>> endobj +3370 0 obj << +/D [3368 0 R /XYZ 85.039 786.531 null] +>> endobj +3367 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3422 0 obj << +/Length 3747 +/Filter /FlateDecode +>> +stream +xÚåœYs7€ßõ+¸zÙaU㜣ö!eK¶K©(«äõC’‡1IK\SfHù¨üùEãÎö8v"%å²HÑÓþp4’ –ÿȤ³jR”9ŒLæ·Gxr-¿y~DL‰™)2 Ê<¹:zô,ç‚Q…«ÉÕkwŸ +#Qå“«ÅOÙI³™Ò2Û/õËnúËÕwGO¯ÜÕ„1¸í¯G?ý‚' iÂwG±ªœ¼“ï1"U5¹=â‚!Á™ù¼>º<ú»—þŽO´ÔP-+‘(Y¿DÕ ò>E^L +!PÎ UR¢ +h:cyž=~ •iV‹)ÉV›ë錗"ÛË7Kýþv:#Y³ÛëOóF}¾•®PŸÏAl7We6òýϘðë»V¾«÷«f³Ó¥š×ðʳ½½éÉze¼Nœ0®ì¨t¥Œ)8Ex¨ ´×ýæÇ UX©Y Öo‡÷Ö­¢:4A‚dð ßuÑ´ZBK”R­|µœec”¦TäÙ´Æxvv»mUs4ýL]¼šÊÔLgÐZ×;Õ&d›dåƒ`û9Ü“Ær÷b îQî} âÜSjÝ $¯zæM‰äúòF 2ôùm€x+/´Ð*ÕHöítV ÷vTˆá•¾‹V‹$°:ÿF‘vµÆqÆT9”˜ Ò¤šæI»”?Ì#Œ±ì"èÆËV_ØUQ¸PÏáY}½„É£÷™®óXjN*.ðf…cìzêãø:-Á¼,ä% daz¾”W ·Š¸?ZwŒ¤ˆÅñv\å;`ApR­#\pÄ óCÂ=ÞÊ©´^Ë·k´é„h3&ădj0–©K0 gÚ· Î4¥Ö†NyŽQ‰™cJtèôx±j4ûÁF’Û;Ø·oìP îŠMgÖÓ.˾o®-öw«=LÈÍùê…jvð>³7¨çZ@²¢ü‹3µ Ì‹%€…ž«H Xß‚8°”ZŒˆ +î€ÑƒX·†…×Â…9¥òi81ÚW½‘ˆKÌ~dk]2–²KPÝ]Ñå¾qÊ)µŽ2“C.ö”™¦|}îº FUX Ãëñɺީ®ETgª×Çú»°1¨Nk¢©}£_/ëÛ)-²W7Ï@’ɆQKSñ±,½X‚eèÔ8˾q–)µŽ%•kác[®Y^ÜI¿Z«|8ýÆ&LbîÙæ5 ¤ím€e^Ï÷+<Á(p +âíRª Üìƒi/æfߟòÇ@š|&*S¯±¨¼XU賊ÅPõ-ˆ£J©u¨pŽä‡JhT'A’ +œ÷:T«Üj'¾ÍÂ.;äW t¥µtoeJÞâA…9Æ cÁz±ØÐÃq°} â`Sjmè**†°(°&[p¦±]wzM‡È&Kd"˜­hMƒÝ 5Ôû;5˜FvO–ºM˜Õ4lL°8f1›e}1¯Kàíø9Š·oAoJ­Ã‹1*óx©ÁûoÞµoW–ß;¹òaäžuįÚxe,h/–Ýñxtß‚8è”Z;¬ó²@Ì%ßfÖŸÔ:27)çƒcЯ{¹ª‹¹ÉV~¡n¥·&äƒÙµÂâÞ‘µnI6‹“íº8FvÀ‚(Ù¤ZÛ…y!_]ÂM’µ#ô÷+ùFý½Öc³M~íLþ +X-‚´³z·†.ÿJMòó»­ÝŸ@ö Ìô˜Þ£]A뀱L½X‚iǹ"Æ´oAœiJ­cšcD±ðLí°| lܾüÚ,¿w.‰üA ƒúr¹ßë&`æç×6£åÂeZ÷£©óXŒ^,±ãÏ(ƾqŒ)µ#ÏQ.r‘ŒçjÉkèid·[—{ßí¤ŸIµâä«#3õ‹Ì‹%u|—Çõ-ˆ#K©uó$cˆ`›ªQÀ`ž|¼x;¹Œmí¢gi†Í“fÓ™*Uk:Ë ÿˬj¬KÆRöb Êw1Ê} â”Sj]Ç”h…(Û9óĬY #ÖÖë ºéæ²Â]¡·;ð'ÙñÈ-õvílߨ­¡ðšÝ^ +ö*ììLKöÕ9šJåèÅ;rì[ç˜Rë8âa›áŽvž”£ œ“y¤vêJÒaEV«Ñ²ÌÌÇãƒÔ¦†1sƒíúñ.xîË+r"–K£àì Éþ׫츭ÕÖ¿ QÏb'mÃ͆a4û/$DÝzѸÓ[pÇ®n3Ø0ý¥j‹Fb¾ó‡Iä…’Ò¯ÖÊXE£OMbñVf ¥[Ù€ÑV–Tk[+JTßÈì,9H×9Ó³¶±õwçËýM£ÃîChª¡¨˜önvî'ìà¨Wñ%™é +ŽEæ¤ÄBו1`=õq^ W.Ë^ÜðzúV¨k·ß¿Ú¯í>/Ï–›úUR«ôŠDbÔ†ëyÉz=z–ç1—¨(Ki=˜Qo¥ÚùTЬ>Ș>j¦Bš³_îg»} ï—ðG[êžÝ +BF‡SsÏÈVóTㆱT½XkÇÅQ®} â`SjYAPI²Â½ºim/1ü`翾µÇ;Ö«ºu@}F@»è ®ê²Êl¬›zᇬlý² 2e*[²OÓOzc‰y±±Žëb§“,ˆK©µá´œlÍ]ú˜›púÅNïÌTØ®W:3uYémùu½ÑŸÕ)­·ê\r7—e^B*ZM»ô…ßôKpÞn½^]ûÔò»ƒó^Î9ÿ†£šª©@¸"©Z’nvûËy»ÚšMJ}¤ÚäKÍg=÷ÚÉ[7Ϋœe”£‚ŒÎœb‰Æi +}¤qö-ˆ7ΔZ7œÈÂ$ç¾qÚUÀóÓ3Û…mD¥c°0¢ú-86Ø"ü´þWïáL ùƒ™ÚæÅÀÏQ;{;`AXJ­F«åDx`6ÜâÓÎLTö&ã » +8¥tþL:¹ÈïO¿³u‰1‹c ýÇ8`AcR­ÃXr„ó£ ¨_lÙûþyiH±èÈÌïQÈeõ\i«i€}þ ~¢ö+w«¹,+ÿ£šúŽEèÅ_&ö-ˆ#L©u ŒÉ=BcG&H×Çžßu 3_´¨îûY[ñ±,½X‚eàTŠcÇm,ˆ³L©u,EŽª¼ð,mT²ÒO«ðxk˜š pc:æeóZQ„5“z–¬5±øgf©„Ú•añ)2£çÒwUÝÓ½²d^äGeê5•K  +|FqìXÔ€qT)µ—«YRzTyºÛuž9 4§v©ÒÁj“×Pâg,ðDæ§òñOžé„™’¯`XžÛìFžHÿ25 Í‹% Þ£8¶A;`AZJ­ƒF+T敇V„IJýˆImÜ~·³O¥¬×džÏ ©.ã¶ïíF„Nn\žØ]œBWáü÷1æ%âÅD×PÛ—° N$¥Ö!¹,){DÔÓxv¿Û‘qK~ç]›Òcšê@3Óíw°2¸zÒEÑâ‹t S·±¸¼XWà·®¾q\)µ6‰ çBT¸ùI˜‚{€ë$<‰òlµ–3D¸=ó¸CÇQO‹ì͉c}` "ý²ú6. ÕI%˜zç&öÔlj&tÚþGÊ +QJ?ƒŸ3yj •ÑÙª½¸ÐGõ½SH’=t³pA J~ïXÚÚ„ˆÅi†ž¥8¶k>`A”gR­ZÙS©J? +4µ˜Û¹UÜwîTü(ïkµ Õ‹% Þ¥8¶í5`AjJ­ƒšÃ‘ræ¡Úez·ŸiNË_ïVfP%Ùm°Õ(òAP낱T½X‚jà^Šc{(Ä©¦Ô:ª¼D¢¨º•{{pR{­—Z/ÿ‡~­cƲöb ÖÓ¬ûÄY§Ô:ÖL L¹gmWöÛݾ1';åMîõ¡¤¯Ûxf,l/–€xâØnÆ€qØ)µ6%ˆÂÃÎØm½SE‹¼ø{ð5ÎË׋%øŽ¦$–r° Î7¥ÖñŪhîùÚ4Â궶ÏkÊXj;)ûêÜ©>ó¯ÚCù©É?¡©ïX„^,0ð%%±Lë€q„)µ¡ÔÎÂ…¬M;èÞi]â§ía¶Sñ6q³Éºý2Eù0:£©öH^*Î1phc_}”bJ§…XbTÒbÕË=©UÆáZШÔ„Q„þeFWã‚‘@½Thà\Jbiõ¾ú(ДNÿ+]ˆeŒÀú)ùùÝv×Ào‡¨œÑ£gÁÏ_š«Á1€— 5'‰·;òÁfÔ ß»!1Ù¿FßÄ=9ùAw>ͤ©¾…G©ÊOÿÉ-U›Ñ¿¸e¥R?¸åüD þÞÖ¡úøËŒ ’>Õ,ÿ3ûk–Ÿÿ¾îÁg+Wedµ OÁæŸÈ‹3³,ê7<óS¿¦P`ñÿ–ÇIoendstream +endobj +3421 0 obj << +/Type /Page +/Contents 3422 0 R +/Resources 3420 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3471 0 R +/Annots [ 3424 0 R 3425 0 R 3426 0 R 3427 0 R 3428 0 R 3429 0 R 3430 0 R 3431 0 R 3432 0 R 3433 0 R 3434 0 R 3435 0 R 3436 0 R 3437 0 R 3438 0 R 3439 0 R 3440 0 R 3441 0 R 3442 0 R 3443 0 R 3444 0 R 3445 0 R 3446 0 R 3447 0 R 3448 0 R 3449 0 R 3450 0 R 3451 0 R 3452 0 R 3453 0 R 3454 0 R 3455 0 R 3456 0 R 3457 0 R 3458 0 R 3459 0 R 3460 0 R 3461 0 R 3462 0 R 3463 0 R 3464 0 R 3465 0 R 3466 0 R 3467 0 R 3468 0 R 3469 0 R 3470 0 R ] +>> endobj +3424 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.9.7) >> +>> endobj +3425 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 727.553 512.306 736.575] +/Subtype /Link +/A << /S /GoTo /D (section.18.10) >> +>> endobj +3426 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 714.003 512.306 723.026] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.10.1) >> +>> endobj +3427 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 700.454 512.306 709.477] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.10.2) >> +>> endobj +3428 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 686.905 512.306 695.928] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.10.3) >> +>> endobj +3429 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 673.356 512.306 682.379] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.10.4) >> +>> endobj +3430 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 659.807 512.306 668.829] +/Subtype /Link +/A << /S /GoTo /D (section.18.11) >> +>> endobj +3431 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 646.257 512.306 655.28] +/Subtype /Link +/A << /S /GoTo /D (section.18.12) >> +>> endobj +3432 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 632.708 512.306 641.731] +/Subtype /Link +/A << /S /GoTo /D (section.18.13) >> +>> endobj +3433 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 619.159 512.306 628.182] +/Subtype /Link +/A << /S /GoTo /D (section.18.14) >> +>> endobj +3434 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 605.61 512.306 614.633] +/Subtype /Link +/A << /S /GoTo /D (section.18.15) >> +>> endobj +3435 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 592.061 512.306 601.083] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.15.1) >> +>> endobj +3436 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 564.962 512.306 573.985] +/Subtype /Link +/A << /S /GoTo /D (subsection.18.15.2) >> +>> endobj +3437 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 540.504 512.306 550.072] +/Subtype /Link +/A << /S /GoTo /D (chapter.19) >> +>> endobj +3438 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 526.955 512.306 535.978] +/Subtype /Link +/A << /S /GoTo /D (section.19.1) >> +>> endobj +3439 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 513.406 512.306 522.428] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.1.1) >> +>> endobj +3440 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 499.856 512.306 508.879] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.1.2) >> +>> endobj +3441 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 486.307 512.306 495.33] +/Subtype /Link +/A << /S /GoTo /D (section.19.2) >> +>> endobj +3442 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 472.758 512.306 481.781] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.2.1) >> +>> endobj +3443 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 459.209 512.306 468.232] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.2.2) >> +>> endobj +3444 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 445.66 512.306 454.682] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.2.3) >> +>> endobj +3445 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 432.11 512.306 441.133] +/Subtype /Link +/A << /S /GoTo /D (section.19.3) >> +>> endobj +3446 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 418.561 512.306 427.584] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.3.1) >> +>> endobj +3447 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 391.463 512.306 400.486] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.3.2) >> +>> endobj +3448 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 377.914 512.306 386.936] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.3.3) >> +>> endobj +3449 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 364.364 512.306 373.387] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.3.4) >> +>> endobj +3450 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 350.815 512.306 359.838] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.3.5) >> +>> endobj +3451 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 323.717 512.306 332.74] +/Subtype /Link +/A << /S /GoTo /D (section.19.4) >> +>> endobj +3452 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 310.168 512.306 319.19] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.4.1) >> +>> endobj +3453 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 296.618 512.306 305.641] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.4.2) >> +>> endobj +3454 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 283.069 512.306 292.092] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.4.3) >> +>> endobj +3455 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 269.52 512.306 278.543] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.4.4) >> +>> endobj +3456 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 255.971 512.306 264.994] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.4.5) >> +>> endobj +3457 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 242.422 512.306 251.444] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.4.6) >> +>> endobj +3458 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 228.872 512.306 237.895] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.4.7) >> +>> endobj +3459 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 215.323 512.306 224.346] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.4.8) >> +>> endobj +3460 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 201.774 512.306 210.797] +/Subtype /Link +/A << /S /GoTo /D (section.19.5) >> +>> endobj +3461 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 188.225 512.306 197.248] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.1) >> +>> endobj +3462 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 174.676 512.306 183.698] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.2) >> +>> endobj +3463 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 161.126 512.306 170.149] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.3) >> +>> endobj +3464 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 147.577 512.306 156.6] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.4) >> +>> endobj +3465 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 134.028 512.306 143.051] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.5) >> +>> endobj +3466 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 120.479 512.306 129.502] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.6) >> +>> endobj +3467 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 106.93 512.306 115.952] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.7) >> +>> endobj +3468 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 93.38 512.306 102.403] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.8) >> +>> endobj +3469 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 79.831 512.306 88.854] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.9) >> +>> endobj +3470 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 66.282 512.306 75.305] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.10) >> +>> endobj +3423 0 obj << +/D [3421 0 R /XYZ 85.039 786.531 null] +>> endobj +3420 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3474 0 obj << +/Length 3914 +/Filter /FlateDecode +>> +stream +xÚÝœYs7€ßõ+Xz" Ž¹ò’r${ãìÆ«µärª’<ŒHJš5É‘É¡äÏ/g“3€=Žf+åN³þ€F£Ñ:JätT¤$áå(/2’r:š­N’Ñüä'ÔÜ15·LÑ=?\Ÿœ=ÉĈ&¤LÊÑõ­ûž2!i™®ç¿ŽÏ›õ„ãv¡_¶“߯:y|í¾©¦œÃ×¾>ùõ÷d4—Møé$!¼,Foåû„в­NDÊI*¸ù{yruò÷]ú31ÒR}½HyAÒ‚w»ASÔ *¿'ÏòQž¦$¹ê-IJ(%ÊÅøú~1™rùæ¼Y=,'t,ÿ¤²ú⥼PÏÚÝFþ16&“iš$èE”e÷â_üìÅhˆRRd®çnîFúÍsdU+5Eb]«~7X•Ñô° ©4²ÓÓ‚.M}k\­ƒ)Iä°ð0™†¹ªW +™é¡úf+±qþ5)|ÀÆC{±`déàn €cj`&ç¶(`®Ÿ>¯€ë[€| +S”äÝÔÚ%ÕòýúnÊþï(“ ¥ìÅ"”‘¹#”»-SŽ©u”åUOXÂÕ]Ö³ª­å,¦ã³f2•pgÚ/·Ó­z³±®ºZÙ°Qøõ@A9ÊŒ~Sh²‡Ci‘,cµ¨}­aH!UPB‰ÀŒRÍèlÜlÛ«Ù¦X­p‰(4}ý¢ÚÎôU¹¦>¨¹Ú¬·zý-IXk//¶ò-Õr·ù‚µÓË+£ÍøÅF~ƒ(>…îËPN*Ä[‰Ñ<Ĥ£>Œ%¢Ó’ÉŠ\^¢M¦Ñ\Ô¿%”/6ÊÞ`5erˆf6¾‘)/Ú‰üÿ[0ßÂÜ&Û,ÿ +b9¬-³ÝöYÉ 9;»l“TþOþ ÒÀq6Uèôí·X6/“ašþ¢j=ïQÆRÈ ú–µÿÚ7ÐnVŽÏåûpQŽ€®†)ãœ$Y1šRîÜ؃eû«B–‰ãtù_Æùd¹ Ë´ÌøЉdz1Œ‹€AŠ€é¶ &¦Öá)2ÏÅ.vÖÜ,t~«~ƒgÐOÍÝïã-$$Ÿ\°Z©Á¿uY¹1YJüU‰.PN3Zü5w§»4’“Š0òÆŠ ꨊètžŽ¥ò^—,BžŽ1ùârÜè¼ýávNßñüéåwú¶µìÆøI½l-Èò§°ÆÁ+^Úàï?õ‹úâem¥Ì,S€1>ÞmúK`6Fšn$;–”t/›XŠßÖvßz®3S—j`N5ümŽž`XäÙàD"‹ ]s“»,4v»-Þ˜Zë^DYF™½Öï;€*{.ÀŸALQÖiï¬ccî·¬ÈrIMÓoIÍvq 5$¦†Í¦ÖÓ‚ µ¨ZG­$˸§Æ>'5³È+·. üUBó¯LÍtq(5/¡†Ì¡ÖmA˜ZL­])DN ¥.+Xš•¢/Ľž\úôU½®–&8r+À¾Þ¢XùúÊŸV[¼d+×Ü¿”Iöå š…èÅ"‘5åR‚ØmAbL­›ziNdDí!:‡‰r•J[¼×WT£š›åb¥Ã¿'Ó©¡œ¼X„2X„S·aN1µŽ“$¡™çd]äKØÐ@D–fãjÓ(s3Y`‚˜³38 n¶&õþ£.°P•T&yû¯zU·Ì¡ZÞg ÿÊÒtp(3/a†ŒaÖmA˜YL­cÆ"²Ü3³ ³…üθ6 åôçꮶq+v“m³^œ~/ãŽ<=ò€Òvx(C/aˆŒaØmA˜aL­cH3RRÄPXÿØ­•Ò6rGa60P¿’PØKÈOïõ§ëF¿®$s9_ÿ á ü­NYš·±]á?õÇ ïr×úŠwÔÛ}× +.T/ðFG9Û|<—÷–:ô9ÚÍÊš '<œãBb‘¡inúÀÐì¶ <4cjmüÅ *S—ã’7L˜TW‹Ö•É Ù= ¼•®¿Bt÷”]—véðm §M5ŸLs‘Ýé5À@¦H,Ì—1`ÚÓ‚ Ó¨Zënxž–#¤”ôÔU™ îk¸ªù|»ºé©¡J3’p[%×¹nùs„Ýúx ƒÚlqÛz)=–¼A’ƒ¹¢­M3¶“Š°öF î¨“Žèt 3FrFi†J*¶à©Ú˜í½ZnÔ»µÕ)MÈ™BUümwj«@$Ôø°ÇZDÞAËoâˆmLJrôbȨ’Ý„QÆÔ:–BÌ1KSÕî]®Ê”V3È?èHýÎpµåO§Ú[OÔÎê¬Æ³ë3öêì—ËSˆØóf`<”‹0@Æ`,TÊÜÓ‚0ƒ˜ZÇ€§$c 10uçÏõ‘js·ƒýa«fá Àœ À{˜ªÂV}¾Yàsœ@’øI½w‘¤GåX+ ëÅ"`‘…ËB`»-ƒ©u`#IÎXS¬þhözWï|b æ©ŠÖ_ôÇ9Oમ*ͳã‰Vm§‡rôbŽÈ Œ…J|{ZæSë8&I™@MeûcØã^Ú%tŽ®4è8Q8ö' +'KÖ‰ª)È{_ +·á1`Η”;…7ûîté¨øù£ëÇÇ¢QBS$ÕGf`eozÈè{ãz-##OS}}®SDnÒT¶B¡îÍ2ˆlë¹ôŸs•cs0Ûÿ³ ‰…g¶-c¡ìžg[T­CZP"FjJ°_‚„_bð<1Ñ¥|£·òÍjý[/à˜]Á–×Tˆ"_w6„t»K,yj‚¬ãYèObõ¯ƒôÍjžÛ™ÈYøPG9ys€c~$¸õ‰tŒ&íÞaRܬ*S›B4~‡-tü½Ü GS–“"œÇDb‘ÁdnÒƒ)TþÝÓ‚ð`Š©uƒ)„ïíJMù÷óÙ5žÊM¨Õ\e ]ÙÒ©ÿ%Øk8$¨&®:<Ї=BQ-¿íùP˜^,Y•ñPYbO Â0cjL!Ý{^àCB&Ù@š¶B‚á¸øfÿ”áßà0Ú‡] %àük3ÝJÌ‹Eˆ!Ó1ªÇéiA˜XL­#Ær"g;&F5±ë9>FÕ·R'@8¸Ÿ°,û랎ka6= +Ó‹E`"«2:4ïiAfL­ƒ)¸,߃É4Ìíâ¦V¥f¯Nî^a%úÃ̬Ú$ úæéÞÂçv¨í¬|ÛÝLWÖé2¹[KøGVÒO„dz4’‹@BÖb<”YïiARL­ƒ”$#F\32¹ÖN.m¯fÌ”0Ö‡^œCéÐ1Í.ÝË¡ÜœT›·_„ZG}ZD§eFái1NÂÁ“>íÉÒL:õéïU¨ÊÐ Sk…P‘X˜*¶pkO ‚\£jØœ“„ãÌ<®À>]oÛj¹ÄÂí½{ÀO_iªÛƒpÊÙª±ÊU¹d`ž°/ÎÏtv(?/ᇠÉx(;ÞÓ‚0¿˜ZÇ/-‰(ö¼i¦ù=RÆoê9NâÍ6u[ÏlýCoV\ìMµ={Þm‡ý*ï©å ¡1ýŠÆ‹EÐ EÐt[FSkO©HIÉ=ªO{æU8±v¸OvÙq÷[ýU¥&ÐN~¥¼í½/ðÛù*ý®Pšõz›a‘þµ©e:;”Ÿ‹ðC†d¦‹ÀDVeˆ)¦Ó=À¬ ´À”Ì™ðϺZ|gÃÇóF-^«JyÎ¥š .·ß{ªob»¶Qdm^iª_—uÛ¢yÕâ’ø‘XþÑQ¥éÉÐÇ—9©Èã˼> endobj +3476 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 754.651 512.306 763.674] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.11) >> +>> endobj +3477 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.12) >> +>> endobj +3478 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 727.553 512.306 736.575] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.13) >> +>> endobj +3479 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 714.003 512.306 723.026] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.14) >> +>> endobj +3480 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 700.454 512.306 709.477] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.15) >> +>> endobj +3481 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 673.356 512.306 682.379] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.16) >> +>> endobj +3482 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 659.807 512.306 668.829] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.17) >> +>> endobj +3483 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 646.257 512.306 655.28] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.18) >> +>> endobj +3484 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 632.708 512.306 641.731] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.19) >> +>> endobj +3485 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 619.159 512.306 628.182] +/Subtype /Link +/A << /S /GoTo /D (section.19.6) >> +>> endobj +3486 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 605.61 512.306 614.633] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.6.1) >> +>> endobj +3487 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 592.061 512.306 601.083] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.6.2) >> +>> endobj +3488 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 578.511 512.306 587.534] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.6.3) >> +>> endobj +3489 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 564.962 512.306 573.985] +/Subtype /Link +/A << /S /GoTo /D (section.19.7) >> +>> endobj +3490 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 551.413 512.306 560.436] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.7.1) >> +>> endobj +3491 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 537.864 512.306 546.887] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.7.2) >> +>> endobj +3492 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 510.765 512.306 519.788] +/Subtype /Link +/A << /S /GoTo /D (section.19.8) >> +>> endobj +3493 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 497.216 512.306 506.239] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.8.1) >> +>> endobj +3494 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 483.667 512.306 492.69] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.8.2) >> +>> endobj +3495 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 470.118 512.306 479.141] +/Subtype /Link +/A << /S /GoTo /D (section.19.9) >> +>> endobj +3496 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 456.569 512.306 465.591] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.9.1) >> +>> endobj +3497 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 443.019 512.306 452.042] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.9.2) >> +>> endobj +3498 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 429.47 512.306 438.493] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.9.3) >> +>> endobj +3499 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 402.372 512.306 411.395] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.9.4) >> +>> endobj +3500 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 388.823 512.306 397.845] +/Subtype /Link +/A << /S /GoTo /D (section.19.10) >> +>> endobj +3501 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 375.273 512.306 384.296] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.1) >> +>> endobj +3502 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 361.724 512.306 370.747] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.2) >> +>> endobj +3503 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 348.175 512.306 357.198] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.3) >> +>> endobj +3504 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 334.626 512.306 343.649] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.4) >> +>> endobj +3505 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 321.077 512.306 330.099] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.5) >> +>> endobj +3506 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [495.133 307.527 513.49 316.55] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.6) >> +>> endobj +3507 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 293.978 512.306 303.001] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.7) >> +>> endobj +3508 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 266.88 512.306 275.903] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.8) >> +>> endobj +3509 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 253.331 512.306 262.354] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.9) >> +>> endobj +3510 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 239.781 512.306 248.804] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.10) >> +>> endobj +3511 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 226.232 512.306 235.255] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.11) >> +>> endobj +3512 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 212.683 512.306 221.706] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.12) >> +>> endobj +3513 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 199.134 512.306 208.157] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.13) >> +>> endobj +3514 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 185.585 512.306 194.608] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.14) >> +>> endobj +3515 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 172.036 512.306 181.058] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.15) >> +>> endobj +3516 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 158.486 512.306 167.509] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.10.16) >> +>> endobj +3517 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 144.937 512.306 153.96] +/Subtype /Link +/A << /S /GoTo /D (section.19.11) >> +>> endobj +3518 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 131.388 512.306 140.411] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.11.1) >> +>> endobj +3519 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 117.839 512.306 126.862] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.11.2) >> +>> endobj +3520 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 104.29 512.306 113.312] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.11.3) >> +>> endobj +3521 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 90.74 512.306 99.763] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.11.4) >> +>> endobj +3522 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 77.191 512.306 86.214] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.11.5) >> +>> endobj +3523 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 63.642 512.306 72.665] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.1) >> +>> endobj +3475 0 obj << +/D [3473 0 R /XYZ 85.039 786.531 null] +>> endobj +3472 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3526 0 obj << +/Length 3701 +/Filter /FlateDecode +>> +stream +xÚÕ\msÛ6þî_¡ÉÜL¨›Žx#Èû–:ɵ¶qÏN{3m?Ð-ó*›.Eå¥÷ç‹w‹¦õÙžNjŠÄr—ûøW€²•Zbc”÷ï N#´Ü7KØ%QX0f—nšVëÈEJ‡U@.ªÈuvÙöšW„Ã+8Šò +˜ð +Ú¶ð‡@Ãé_¯;øù~ ?ifξuí;¸bÈ¡ÕE×kþ8®R–Èþ5\•×‹’Þ?î‰^¡©ÔÒ" ZɳwPê¶Ö8bª•rŒßgSLz=/YÖíz —fƒä’á  ¶4þõf£z*Î~ƒ«­û¹ŠñDÝõu»i ¡€U6tú×)ô +XyGÏ·1^ýtpè/¿Ì‚>Aî‡_E)$fx*DZ8Ïl#͵*µDù–Tk9W†('û¤ãšt2ö`ˆz¤,‰cI>ÆxöðÒPH2êÂŒJï/›Þº4Çh­_ÃYÅ™œ1„ +”\šf¼TšwM¯[Þ2›rÄ°0 e0±„ÑáBFädìVÀ€¡°^Á ¹‘ÃU,Q§ô)G &ál2-½X‚–¦‘¢%Ëc´[§eJ­£%¥HälŸ–Ą̂=†zqD1”1† 5o>6‚y‰¡Ü(lÀÙ!˜:³:„Vá8æI¦‚ãÅà^J€3¶ NJ­‡È¤Šæ¥çøl}©†g€¥*Ul0Oy{fZoL„ŒG°ƒÁ¾j†joLôÉkÁá‡Ivºu4Ý ’­%B£Á•,Ðð—Òš§ÑùóÉ“ùåÅü2îà×Ø‚8¿Rj-¿xEQÎGét¥øõ™ú]j¿hns!*3<ÁÐÄsæ6‡’h8¿½ìv`Ôn®"ĽlT‘í|lq¬ÒA%µT èîÆC|”*øÃPŒ‹ +ñ|rRˆÅ)fiŠáÅX¥XR­£XÁQÅË}ŠÉ†siµ"#üÑÔ‰xéFJý nЫéíGÝ^1¸‘O³á'ð¥"ˆBêj5àÇ‹m²l³…Ä©ÌT¸k5¯±š +ƒ5Šh.‚uíï6;+0}¬±Œs‚˜j*ѼX‚h¦ÑD['ZJ­#-QYŒx†5Ï^¹P û»c+*?lÂÍ6ƒ¯£šÌø³³VsÌ­˜ðåA8>±¢ÌLíôÝëË–]oh4˜1²y×.MdûVSpeæQüñòŠp‰Øä´:KðÊ4Ò¼"1^-ˆó*¥ÖñJ6Å(­ÆÄ°÷À‰fs¡’c_T2ûêz;¸JŽšÿÀÁ‰¢Š¯ÎÁ9&ªî£ÿ«œš³o_r|v¹ÇsRŸ»šŸlùL dû."r¸gî‰> $#´¤ÆÎÚ»s "ZÉ~|ЀëºmZ¯‰U%"x 5 éâ­U‚цҽцڂîþP™NˆšIRôŸ¤oÍ…N½–ç*Æ'ö!û,ûP ïC¡Ÿâ}è€Ñ>”Tëà)*ŠQí3 «ˆ6‡3M}À¸âç²»‚?WÍõªY)8w+3PEqC5H ¨KP cñT¼X„À„Ñc â ¤Ô:–žeú˜t…p¯‹ŠÝî"pBu˜âoÚu=týGŸ[2³WÐsþÓé•­RewLv¬¯aNesò¸Ù4ç}=D§ùUœÛõ¾·î–K›Tª)œ`â)Ö’HNŽ'3Ì‹%fÝÁ°±q†¥ÔbNeˆ>†rÎÁ ºiû^ßÎ}Nv©g5Ý 2µK¿k·í`çÐ%.þdÿG8ͳO…Ó‹%à üš€slAΔZLLÀ 9b…¯Èá…LMD½ æ­Åï¯h€è{~(yñ8»èçàmœ3o/–À;pýT0½XÍÀ³ 8ÇÄñL©ušIE¨™L]@Ö#2]¿¨Uö­)tÔv«›Yfò$#Ð-5´Í‡›M­²'ØOÊ8Шlžx*ˆ^,bàMŠˆc â ¦ÔÚ’ ¥É®±b†ÕúhQå£g7 +Ÿ¦¿pÕ©áÙÞ6ÌÊ­vªNÊJöøFUó°Sñób üG&ð[Ç/¥ÖáGÊÝÇOoÿÒmgØÛ£ò,,ô¶×:BÐ_¾S?ž½1èn‡ºìNîÖÖ„¡Ú/(ÿcXçbáÅXNI`1¶ ŽEJ­Ã"/'l 쉽æ\`|nv©\shêëµê»úªùüÑëOî?æ§bæŘÎ#LÄ0[Ç,¥ÖbF@½àû˜é}ÌËÝͶ“Ic«Pú›éF n«ßÌüã¦ÉƴѲæäÊïk^ö®EñÉη–Nt~ w~è…¸óXu~R­s~‰##çëý¼"ø ¹q†€óqfgýÿìçœÈŽÁŠ—Ù[µÎÒþœc¶T™ƒZïg2uŒ˜{ÔjùûR­Iúi'ä˜!è»lRߊ!i{*’^,dàRÂbo° ŽdJ­C²¨Å>’zëodGäËÀÅPCín®ìâ˜[~Tõak7¦¬ A./?Dô³Ï86/–€-ð_¶±qØRjlœ!$å6ŒXýîjkB¤k/픫m«›Nm‡ö-„.¥*Ø:…{½ å¿Ô]‡ÞÜ eö_ýG6êôÌ0áu8þVöÇÈ¢Ù“4þÛ&fŽ²ì®TPnú¥+ä¾Uû4?èýŸ8|–#!&—é±L#M Ø–ÿÄ ”RëD"¤Ú'PyÇ”G%÷õPŸ› knbºn®X+5hž@vñJî´º?XÌ3L…Å‹%` ü“€elA–”Z›š D!BXÈŸ›šK å¢BØ/Iö•½¶µ{ e¡ÇäEÁèÝ ™'š +’K€x+ÒØ‚8H)µ¶ Fò\"ã0bºæ÷Õ@x±\v»qšöÞˆv‰®¢•Å“\˜2Ž˜ +­“J ë]LxlŸæX}ׄNÛ÷0¼å]âWS;m†[ îLûËn€8X&œýdà´˜ˆg 4t.á±Ý],ˆBšTë0唘šxz¬ö´šru:ÛkØîê>}öÅRïì²]Úî +á >ó¬Sáób ø?&à[‡/¥ÖÁÇ+ÄÊ0ÔšÅÄ«î\ ˆÍÁpaÀípºTÚ›aÿS¾q¯©ÿ¨ºùʽó·>Þ´îs V~r²hmŸ +‡KÀø%ÇØ‚8)µÆQEC8ÌRà­}7¶.*AÝ îüp‡œ÷ˆÃŸíXØ{-‚›M&´@%x*0yÓ­÷¶þ€É§u ¼þ/|l‹AŒ\þÙ'‘+å²ý{ßA®±qr¥Ô:rQ‚hÉrqM.Ó‹]-á|c‘ƒmíj™pÐ/¹\éQZ¶,({’#°ñÁTX½XÖÀ¿„Çvê° kJ­ƒ—¨¤<€Õl¼T9Ên€9”}ŸöVaI½V– ðPTOy~e\1]/–@7psݱqtSjº9G$xµ‰!¡Ñ}ãßìíJwÒ{ÇÒÏ©Õ>>—±nTÆO [㈩Øz±¶“ íû9`AÛ”Z›æV êKŒ\§¹/VP7lÝK(Üoë¡éUÝç9y +ŸQø ŒC&Bì¥â®Žþ §„Nx 9ŽÒ2@ÏÔ*¼ÇU…e´õN­L{xN-‚ƒÉd·~Ï´lÕžqoßåŠ~ÂD=Óä/˜X©ÔLœ·âÕb¶Ë©URDr~è«òŸ^ìøC't_Pd%ªÊè›Böd¦¾‡c³²ñÙšFÅÿ4LöÊendstream +endobj +3525 0 obj << +/Type /Page +/Contents 3526 0 R +/Resources 3524 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3471 0 R +/Annots [ 3528 0 R 3529 0 R 3530 0 R 3531 0 R 3532 0 R 3533 0 R 3534 0 R 3535 0 R 3536 0 R 3537 0 R 3538 0 R 3539 0 R 3540 0 R 3541 0 R 3542 0 R 3543 0 R 3544 0 R 3545 0 R 3546 0 R 3547 0 R 3548 0 R 3549 0 R 3550 0 R 3551 0 R 3552 0 R 3553 0 R 3554 0 R 3555 0 R 3556 0 R 3557 0 R 3558 0 R 3559 0 R 3560 0 R 3561 0 R 3562 0 R 3563 0 R 3564 0 R 3565 0 R 3566 0 R 3567 0 R 3568 0 R 3569 0 R ] +>> endobj +3528 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.2) >> +>> endobj +3529 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 714.003 512.306 723.026] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.3) >> +>> endobj +3530 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 686.905 512.306 695.928] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.4) >> +>> endobj +3531 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 673.356 512.306 682.379] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.5) >> +>> endobj +3532 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 646.257 512.306 655.28] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.6) >> +>> endobj +3533 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 632.708 512.306 641.731] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.7) >> +>> endobj +3534 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 605.61 512.306 614.633] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.8) >> +>> endobj +3535 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 578.511 512.306 587.534] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.9) >> +>> endobj +3536 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 551.413 512.306 560.436] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.10) >> +>> endobj +3537 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 524.315 512.306 533.337] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.11) >> +>> endobj +3538 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [522.044 510.765 540.4 519.788] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.12) >> +>> endobj +3539 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 497.216 512.306 506.239] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.13) >> +>> endobj +3540 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 483.667 512.306 492.69] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.14) >> +>> endobj +3541 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 456.569 512.306 465.591] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.11.5.15) >> +>> endobj +3542 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 443.019 512.306 452.042] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.11.6) >> +>> endobj +3543 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 429.47 512.306 438.493] +/Subtype /Link +/A << /S /GoTo /D (section.19.12) >> +>> endobj +3544 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 415.921 512.306 424.944] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.12.1) >> +>> endobj +3545 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 402.372 512.306 411.395] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.12.2) >> +>> endobj +3546 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 388.823 512.306 397.845] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.12.3) >> +>> endobj +3547 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 375.273 512.306 384.296] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.12.4) >> +>> endobj +3548 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 361.724 512.306 370.747] +/Subtype /Link +/A << /S /GoTo /D (section.19.13) >> +>> endobj +3549 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 348.175 512.306 357.198] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.13.1) >> +>> endobj +3550 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 334.626 512.306 343.649] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.13.1.1) >> +>> endobj +3551 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 321.077 512.306 330.099] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.13.1.2) >> +>> endobj +3552 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 307.527 512.306 316.55] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.13.1.3) >> +>> endobj +3553 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 293.978 512.306 303.001] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.13.1.4) >> +>> endobj +3554 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 280.429 512.306 289.452] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.13.1.5) >> +>> endobj +3555 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 266.88 512.306 275.903] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.13.1.6) >> +>> endobj +3556 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 239.781 512.306 248.804] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.13.1.7) >> +>> endobj +3557 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 226.232 512.306 235.255] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.13.1.8) >> +>> endobj +3558 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 212.683 512.306 221.706] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.13.2) >> +>> endobj +3559 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 199.134 512.306 208.157] +/Subtype /Link +/A << /S /GoTo /D (section.19.14) >> +>> endobj +3560 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 185.585 512.306 194.608] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.14.1) >> +>> endobj +3561 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 172.036 512.306 181.058] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.14.2) >> +>> endobj +3562 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 158.486 512.306 167.509] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.14.3) >> +>> endobj +3563 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 144.937 512.306 153.96] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.14.4) >> +>> endobj +3564 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 131.388 512.306 140.411] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.14.5) >> +>> endobj +3565 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 117.839 512.306 126.862] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.14.6) >> +>> endobj +3566 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 104.29 512.306 113.312] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.14.7) >> +>> endobj +3567 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 90.74 512.306 99.763] +/Subtype /Link +/A << /S /GoTo /D (section.19.15) >> +>> endobj +3568 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 77.191 512.306 86.214] +/Subtype /Link +/A << /S /GoTo /D (section.19.16) >> +>> endobj +3569 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 63.642 512.306 72.665] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.16.1) >> +>> endobj +3527 0 obj << +/D [3525 0 R /XYZ 85.039 786.531 null] +>> endobj +3524 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3572 0 obj << +/Length 3396 +/Filter /FlateDecode +>> +stream +xÚíœKsÛF€ïúÜyà,æ ;NœŠ³^KYmU6ˆ„$”)B!AËù÷;ïìñÂ.;zlR‰HpÝè¯çÕ3<)Ô¿xRrTÐj"K8Å“ÅíI1¹V¿üp‚]‰¹+2OÊ|w~ò÷W‚Mpª¢šœ_…ûT╘œ/›¾èÖ3RNûÆþÙÎ~?ÿéäûópãD5¦Tßö“ß~/&KeÂO'¢U9¹WŸ „«jr{Â8EœQ÷}urvòÏp/û›X©cOÁi‰xI‡yòXÝG +9‘œ#Á¤y\!,A3LÙôíf†§ÍlŽ§óE·^¶ê[ßvëíl^ñbŠfs^˜?¬ª’oGÿäŠ|îoŸ)~@†U UL/ ü¹¹žØï{©y"6ôðá½µ‡ ç‡&pŒ‘‚tÄ‚!Y[4¯6€e*D"XjÁ¾©U˜VÓ]½šÍ)¥:zÿS`v½S„7u¯A«xžK&%I÷ØcIF± ÉÄ¥„ ˆäИdN-&%R©U9«I‰fJûôâÆWе¶D5S"æÂ|*ŒÔºëm‘ýû—¨’®DßÙ`ØmýMÏê[ݘ]ÖöºÿýN· +­mçÒ_ØôůoÕOg +!ß2* 8pNQ, L -€ã §6ĺêc ´1ðzíêp½ÕÐØoÝ•ý{>+étÓí.˜UƒÔ?êƒr\…Ù·iÀ¿B«áV¾‹ÚŠd0;gïk…ñBªBc]`ÄRºØ¶Õ±Ž»ÞX×4_u«½^ÚÏ/u«=›«j¹Ð¥u[~k"ÂVÕجSÆlÓm0cÊŒîÍÀ¨‡yftz¤¢”êN˜ºÕFr¿Ï²Þ¾·®4§½ø£!¿RWîT,ªG<ÀòÞ 7ƒé¦ž†ñ±ä›UK†(' `:²ÒþجXÊåã@{gŒåÅ2|Ggø-€ùæÔúîVˆ• |+ÛåžÞ)fDª–u©‡Bgz8þ@;Ðo×ÿzgåÅ2ü„KˆÿИNm¨ßL"ÂYÂ'3c7ÖÝêúúÈø[JTâÒ®¯63N¦Ýí‘A8áˆìÊ©1ôÙþxûBéÁÓ¥í2¶¶)©û¾^è 7kHR‹š.ÆÇÁ…¨:Œ¥Å2T÷f¨-€©æÔªTý-Rª®[~Ó%­u¡Ûk=|îCƒÞ*ÞvÐ}Sü‹xè ´{î±(£XeâSÂKåÐeNm@I +„9OPºØÏ{œË•…JžÝ„Ar×›zumøA}ܵKßk¯ äfkÔ5‘¨)­„öc¯+ÚŸzXÖ.tE_KæËúk:OŽªˆª©žÍµ&”™Gšc¦“«Æ Û•nå‚Ç0øJÑZ¤þ­Q,­®‰VÁ hZGkN­V^QTp™D+³Ñzêæðÿø £¥Ù|h} ÞïOçû›æ ÕrØöûHÓ…t‘›š»m· -&ðW#çs$¹D &—º¨Ë8bÁ€- ”Mæ„©‰Üñ<ºι(¯br†)^L”R2ñ…Œm…N²°é™ê§ßÏ(žÖ—+NÈé¿^Ù·ºƒ/¦ËݪÙ}I̓D½YšÂy+îhŒ”ÐH:¹ÓÀ)ŒD¤þš[@9´åèøšsUš©Á•¢Á¦¯f%³á_÷&%ÝøaŸ6}ç’ž®–¸º×+yjk辰õ)ŠeêSJ‡¡`K˜UÀ3Œ¸ÇNö—í6d®L.sÛêtcâÙÏ­¬¿Æ€Êà`ø‡ºaô°ÂžHTqìÑS‡þõz±ÒØ—~:c†@¶ëÒƒ²ÝÊWuÝw1þ< ;_ÅÅ2àSìG‡Àðsjëζ ¿nò©ÓzgR)zA©àÙWBîü3yË O}#Z#Ï© È‹•œFäÄ!o>öËC#ˆ’',È|r›„º›<¾Ibîn5Oî54’èy—º%F&¡(È£ °1 ¥‰‹FE]γ‡÷þDÔ -€£.§ÖG+%¢EuÔEÝUýÞ̱‘W”ˆ¿(ôܽæÉÍŽÅF¢b{¦º¼²Ï3ùD@EåÓžì'ŽYÿÞ;G,#0«6D T}rSG s¸iÌ(W'Ì3/,Å3ìí¼‹ÆRbê©ûaêC `ê9µºP½NÁ#u›¾îëÕû™ž =+ÈÎ#c!G± äÔÛÊ:±†œSë'1jFŠ2s“›ØÑ“—târºÛù0ãj¬Û®jŸ”Ö¿„Œ³ÝÀsÓlÔ%!é#ì¼1pËN= ZΩ µ˜ª™I!#`?My©ê°NÞ»½V8£å¯ÀÎcùF± ßÔÑ0ß¡0ßœÚÀWˆó„¯Ÿ“|°¨z­Ç\åsì’gÆÂŽbØ©×aØC `Ø9µ¡µ.*ŠÒÃ段~Ñ™ÑõmçÖ^¾×‰æYÖ-6&Ï)¿è}4{Ë`OýcZðeK6´Ä*6ò+6®Œ± Û›×ë¾¹ÞÔv­i[…Ÿ»k%BNÏvzïÕ¹Iõ¿Mo¯î¶vG€*{Ñ®/ÛõXωFýË9¹'Ø¿Ÿum¸6Þ\Ë™„IþD ••šÔ~"¯OE©(bïÑÿ/è­mÞK#k["׶=pH -Ù¬Úžë*I´&žSë‡Ô”HD}ž'+;f'V½¹nÜa¡_íÔIÅìi¦½OÆbŽbÌ©¿ËÂ<´ÆœS*6¦¨ôûüpH}ìh¸0ÕyP±/ô  Û¼×ä ªm¹óÏXäQ,ƒ<õ=Œ|hŒ<§6Ôì¢@$Ž’c2äMëûòM·í®\ý~g·/v}ã7§ufQÃl–vøç6±Õ«•ŠI‹‡PYÝcŽ%Å2äRÂä†Àärj=9R +$ý6Gœ¤9Ž“;]ô­Ý€hñ¼l+U¶ï6ÚRgéÉ–íÂ÷ÏD<„&×?òHŠ‰LqÏ%(±¤˜U(JÕ™ò„¢_Êü¥¾õ'uÝ–ÑE8Ê §û¶_ÌTÝ»Ñ+Lü÷¤Þc±F± ÖÔ¿0Ö¡0֜ڀ•WHøÔ§Æê×ßꥀÝõumÏìZš§»>9ëM*5}ZÔ}ë“Wol»ÜÛ'%ðƒ@çžs,º(–A—úF7´F—SÐ1 +^Ft~‘ï×­kíNsnÇ~þÁžE¸³ß^¿tT5®•Û¡ípVeæbèx,Ã(–a˜:³$á0ÃœÚÀÄ‹*2Žá;[}LMêý8Åžµò{ëyEžÚTÅ»c,á(–!œº&<´&œSë§*D¿Ü"t›øæ3¤!õk|löñz·1¹ +[¦ q2â<0–iÊ M| ¨‡ft†[pÄpäé§!Ù£iQ+ñD Î%c© àÄÙ0àzpF§Œ+ŒJ‘&{Mòæˆ^x%Õm2Ò)…â©BönI9ƒ1ï¹¼¤ç#€ ³jiYšõ·@š¦ÉÂfÖü9Ûs}åÆž¼Ýº³r;Õ;Weù˜É:7Œ%Å2dSÃd‡Àdsjqi;],˜"L÷Èâ©nªYYù÷ŒéQÔnÓô½ » §)¯’Iìé›ïNi!¾÷c©D± •Ô=0•¡0•œÚ@…cD0; B *j²ÞšJxßö¦/Õ9ä{U3Fº²å,=ŒÝÉTuåÞ­é˜Êê~\µ—æÍr›¶q{+:ó² SÆi?ÛôØÏV\wáDC·R7Ñ«Âç”FT"!Fg‚±L¹B6Œ óËG,€Ã(§6„ac~FÔ…Ñ/gg>ÑöBè3Ìn°}úúßz +Å1÷xc‰E± ±Ôu0±¡0±œÚ@L]âBc™æØT{û´èÖªšWòÁ¾.Ì?ÞXbQ,C,u] ½³óˆ0±œZO¬’¨ÀòwÀ~êÚµÀl/Ók;Iým“ó.—Rþ2©ðÛ—/ìÅew[ë»K)?†³|$‹(£H}’ªAätz%EL”„ãpÖן¢ÓÝÝЭ½`È.k·<¶æ{7ðµßÚþo³yIùU÷#™D)˜IêÉP=È$§Ó3ªð!阼j?1˜Œ]Û#çá­âÖ'yX»Ûw£gwz) ÿkÞublì«N‚TæM'‰ËJð½iõð{N2:=&.Õ¦2Óç\-¤ã­Þ9púF/bÑ¿æX®}¢±ç#ƒTæxd⫲ßÆq¨>³‘S© âØNNõõo˜ýü—‡ý ¬DU ÌõYp!Ù„rĨ{}Þ0øÜKÊ]¡ÄâÿMÄÊendstream +endobj +3571 0 obj << +/Type /Page +/Contents 3572 0 R +/Resources 3570 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3471 0 R +/Annots [ 3574 0 R 3575 0 R 3576 0 R 3577 0 R 3578 0 R 3579 0 R 3580 0 R 3581 0 R 3582 0 R 3583 0 R 3584 0 R 3585 0 R 3586 0 R 3587 0 R 3588 0 R 3589 0 R 3590 0 R 3591 0 R 3592 0 R 3593 0 R 3594 0 R 3595 0 R 3596 0 R 3597 0 R 3598 0 R 3599 0 R 3600 0 R 3601 0 R 3602 0 R 3603 0 R 3604 0 R 3605 0 R 3606 0 R 3607 0 R 3608 0 R 3609 0 R 3610 0 R 3611 0 R 3612 0 R 3613 0 R 3614 0 R 3615 0 R 3616 0 R 3617 0 R 3618 0 R 3619 0 R 3620 0 R 3621 0 R 3622 0 R ] +>> endobj +3574 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 754.651 512.306 763.674] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.16.2) >> +>> endobj +3575 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.16.3) >> +>> endobj +3576 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 727.553 512.306 736.575] +/Subtype /Link +/A << /S /GoTo /D (section.19.17) >> +>> endobj +3577 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 714.003 512.306 723.026] +/Subtype /Link +/A << /S /GoTo /D (section.19.18) >> +>> endobj +3578 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 700.454 512.306 709.477] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.18.1) >> +>> endobj +3579 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 686.905 512.306 695.928] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.18.2) >> +>> endobj +3580 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 673.356 512.306 682.379] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.18.3) >> +>> endobj +3581 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 659.807 512.306 668.829] +/Subtype /Link +/A << /S /GoTo /D (section.19.19) >> +>> endobj +3582 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 646.257 512.306 655.28] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.19.1) >> +>> endobj +3583 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 632.708 512.306 641.731] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.19.2) >> +>> endobj +3584 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 605.61 512.306 614.633] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.19.3) >> +>> endobj +3585 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 592.061 512.306 601.083] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.19.4) >> +>> endobj +3586 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 567.602 512.306 577.171] +/Subtype /Link +/A << /S /GoTo /D (chapter.20) >> +>> endobj +3587 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 554.053 512.306 563.076] +/Subtype /Link +/A << /S /GoTo /D (section.20.1) >> +>> endobj +3588 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 540.504 512.306 549.527] +/Subtype /Link +/A << /S /GoTo /D (section.20.2) >> +>> endobj +3589 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 526.955 512.306 535.978] +/Subtype /Link +/A << /S /GoTo /D (section.20.3) >> +>> endobj +3590 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 513.406 512.306 522.428] +/Subtype /Link +/A << /S /GoTo /D (subsection.20.3.1) >> +>> endobj +3591 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 499.856 512.306 508.879] +/Subtype /Link +/A << /S /GoTo /D (subsection.20.3.2) >> +>> endobj +3592 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 486.307 512.306 495.33] +/Subtype /Link +/A << /S /GoTo /D (subsection.20.3.3) >> +>> endobj +3593 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 472.758 512.306 481.781] +/Subtype /Link +/A << /S /GoTo /D (subsection.20.3.4) >> +>> endobj +3594 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 459.209 512.306 468.232] +/Subtype /Link +/A << /S /GoTo /D (subsection.20.3.5) >> +>> endobj +3595 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 445.66 512.306 454.682] +/Subtype /Link +/A << /S /GoTo /D (section.20.4) >> +>> endobj +3596 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 432.11 512.306 441.133] +/Subtype /Link +/A << /S /GoTo /D (subsection.20.4.1) >> +>> endobj +3597 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 418.561 512.306 427.584] +/Subtype /Link +/A << /S /GoTo /D (subsection.20.4.2) >> +>> endobj +3598 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 405.012 512.306 414.035] +/Subtype /Link +/A << /S /GoTo /D (section.20.5) >> +>> endobj +3599 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 380.554 512.306 390.122] +/Subtype /Link +/A << /S /GoTo /D (chapter.21) >> +>> endobj +3600 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 367.004 512.306 376.027] +/Subtype /Link +/A << /S /GoTo /D (section.21.1) >> +>> endobj +3601 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 353.455 512.306 362.478] +/Subtype /Link +/A << /S /GoTo /D (section.21.2) >> +>> endobj +3602 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 339.906 512.306 348.929] +/Subtype /Link +/A << /S /GoTo /D (section.21.3) >> +>> endobj +3603 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 326.357 512.306 335.38] +/Subtype /Link +/A << /S /GoTo /D (subsection.21.3.1) >> +>> endobj +3604 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 312.808 512.306 321.83] +/Subtype /Link +/A << /S /GoTo /D (section.21.4) >> +>> endobj +3605 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 299.258 512.306 308.281] +/Subtype /Link +/A << /S /GoTo /D (subsection.21.4.1) >> +>> endobj +3606 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 285.709 512.306 294.732] +/Subtype /Link +/A << /S /GoTo /D (subsection.21.4.2) >> +>> endobj +3607 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 272.16 512.306 281.183] +/Subtype /Link +/A << /S /GoTo /D (subsection.21.4.3) >> +>> endobj +3608 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 258.611 512.306 267.634] +/Subtype /Link +/A << /S /GoTo /D (subsection.21.4.4) >> +>> endobj +3609 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 245.062 512.306 254.084] +/Subtype /Link +/A << /S /GoTo /D (subsection.21.4.5) >> +>> endobj +3610 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 231.512 512.306 240.535] +/Subtype /Link +/A << /S /GoTo /D (subsection.21.4.6) >> +>> endobj +3611 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 217.963 512.306 226.986] +/Subtype /Link +/A << /S /GoTo /D (section.21.5) >> +>> endobj +3612 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 204.414 512.306 213.437] +/Subtype /Link +/A << /S /GoTo /D (subsection.21.5.1) >> +>> endobj +3613 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 190.865 512.306 199.888] +/Subtype /Link +/A << /S /GoTo /D (subsection.21.5.2) >> +>> endobj +3614 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 177.316 512.306 186.338] +/Subtype /Link +/A << /S /GoTo /D (subsection.21.5.3) >> +>> endobj +3615 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 163.766 512.306 172.789] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.21.5.3.1) >> +>> endobj +3616 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 136.668 512.306 145.691] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.21.5.3.2) >> +>> endobj +3617 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 123.119 512.306 132.142] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.21.5.3.3) >> +>> endobj +3618 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 109.57 512.306 118.593] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.21.5.3.4) >> +>> endobj +3619 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 96.02 512.306 105.043] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.21.5.3.5) >> +>> endobj +3620 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 82.471 512.306 91.494] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.21.5.3.6) >> +>> endobj +3621 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 68.922 512.306 77.945] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.21.5.3.7) >> +>> endobj +3622 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 55.373 512.306 64.396] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.21.5.3.8) >> +>> endobj +3573 0 obj << +/D [3571 0 R /XYZ 85.039 786.531 null] +>> endobj +3570 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3625 0 obj << +/Length 3151 +/Filter /FlateDecode +>> +stream +xÚíœ_S9Àßù~´ÒHš=]±a“ݽƒå¶rU{ûààÁqÅ`ÎBòíOÿ%[£&ÚÙT*eã™v·ú§–Z-ÉËdÔr„©5m8%£‹«=<šË+¯öˆ½cßÞ²ÝóÃùÞÁËšF‹Ñù¥ÿõè|öÇøÅêzRµã¾3/›ÉŸç¿ìýxî¿8RM(U_û¿½?þÄ£™4á—=Œ¨hGwò=FDˆÑÕãqFíß˽³½ûï2×ØÈH µ‚Óñ–¦Í tm‡ ü“xz=™7¿E¾wRû‘XêûÝïÖ¾Õ® œ$ñ X27·Âj=rV!,;EÞxäW“}2¾RÈ)¥ã'd¼^¯Öòe#?!Õß +»õQ)ö `ýŸÇžZ`§m…jÊF’b|x8pÔ÷ÒȾáM«pÜ5H%uV#{¶¬’>l|8{?½V㢛ÉnP×ãõW×O(ßM(¯Ô»õ;sñxz=wWÝuŸº–êvy3@‡RÓŸ›·¿Ï8“æœé¿'ñ«jT5òM…Huϼ@8âDÜ]˜InÄùØèz9iÙ¸Sž›ö·*²:T”§×3o?è«×òš~ó_L˜|/g9Wß\|Y/•ÆWâ+&ï©ùaRëÀ×*#`|eÁÿÖ™Qµï ï3X ¬ïUÂ`ÿÒàp&?ÕãðB¾¹^lúõ´WoõDÌŸdç‘BÈ‘Xò–·³,ÈBÕzÈMd8:È4ùÈAÞ¼ëW7­å§rpÔ·Ú\Q šäaá<[ëˆR¶A `;9Ï6µ ÏRKdJÝÔͨ®)b2íölÕØ­æ´]ºÇŠ£žæôLèIJÈ—*ªU"¥î;YO/ÔÅ· ?¬oγZ*mG)š  ‰}”G“ZG©õaÇj…OL˜ »™…TÌB¤W:‘þµš»Vµn¬]Üô.ç sApñ'OçRÀA {ZðàÔ‚<`H­=Z#Êxìbïp¦fD?sU7*{ZØ÷zc˜Þ¹)³»RéUoî½5‹{v~õrfæ5éUnMøc ¶­¥ø‚€/ö£hrøR òø µ>>%³Fx|üû’r»õQ)ö `ýŸÇžZðyKJ.ZDi¯)ÝMÚ6j•g7½š=U„›Õ¥][ê•æ…šDoõrHgHÍøT/4—j(¸PaÞm2ËËȤOX_‚ ØùFãÛ6ãÛè›>g‰É…¼•Ôp´ñ–¡¦mG¿/1ãÍy©0Þ"±|¼mÈ÷‰Ô‚ì0 ªõà‚*ÙM,x·Ä|±îä"ñzn [Ú•)Åèe¤½â£Nö‰S3-.CZ¨ÎÒÈôdV®±¥ü‚À/vdž_jAž¤Öe9œ7¨n#~.Ëy­œÙJA¹³Q+>›Hy]hP‹gµZt /eÄ–±S…ȱL-ȳ„Ôz–L&©, ¬”'ç,zuåã2pšëG£/K¸­è¢gšZ +ÏKì"'æÑ%êó䤵ƒ(U;wd‹«Hd­°k}=lê…C¯’ÕÞr›ñj±tK’J°'6Wæ(Úv—b bÇȧãÈÔ‚3ÑôZ¯Õ +r¥ 6+Œ?˜ÌËNÍë©J›V—F¯w?e2µt×ü¬¯NTo{8Z¶i¥´‚@+r@+µ O RëS$sê-Z!ðgW:¤&숩Y™+ç¯.c Õ?3ôrÖ|Q,¶ ¥X‚€%ò€%µ Rë’Jé|©Þcq%mW®öyåá…vª.¯˜ºÉÁï[µ•'”Rþ²Î …d#±<ÙØÅ“ Ù ²dAµnxdM¨`¬K7ϦWŠÕ›©-Ëè[¿î,éóI+#Nv…sÓ™xÔ‚Ïp£Â9¡”k¸F¦8·“?`Až+¤Ös­+Ôº"ŸâzOîy`滆±G °âh]Ê1ˆ#‡S ò!µž#¨²gÈ4G:Ÿ§j;ñ…J<Û§2ˆ>cëRÆA `9`œZg ©õ³+å¨a¾úév®Î>ú†«Èèµát­Kw7[¥œ­=-“¢êÁùÂ$¢?Eÿjv5ÖïÝÝd_´ø±¸ÙF–r b·È·Ô‚<7H­ç¦ÎîÏíûŽÆvë£RìA ÀùŸâÜFó€yìZ?$c‰Ÿµ»K™v“[[®92‘è*í'«Þ­ST +¥ºÅ;µNlžåhl}QŠ7ˆx#?xS >oʶ Eø÷«ì=º0³]udWü’¦9Σv¤Ö+µ²´%ZùɽGƒöOØš‚LÝþ>ãC–ñaøžÏÙ—R^Æõ=Giƒ%.â\÷}_j0¬œ— +Ã*ˇULè©ÙQTëÁóaw`‹…£«é•ÏMNõÉ(2ŠM›¿Åé\SJ;ˆ´#·´S ò´!µnŽ¤L=‚ÑΔ^¬®m$Ïo£S¬ú˜Üjg³ñ@*Ç…Ÿ¦ºdëKì5c4幦•Ò +b­Èm­Ô‚<-H­«ºÒJ ᪮–V¨º†ê€¢±SÏ3` ±ü«Dl”mU)¨ €Š<€J-ȃ‚ÔzP¤FŒ±P•5¼C¼U?¶áóû&>QžD˜^©Tœ>20ÛºR`A yŽâܙŠòÀ µ®Pë]y`Ô;^|pþ–Yã°=÷6˜>éi6Ó…ªV ÊŠ«C‘X¾ ¹›à.4`A¶ j]ªŽWô]ˆÙ.t´ØLß,ã<*£ò‡ÌÓa:T’noìfuk–¡½ªÕÇÆ6¤”MØDNؤäÙ@j]šSÕª\åŽÝsÂãÅr±õ@qö½™¬>™ßîlnþ¬®È”èÊ~ÖböE˜Ø”2 b“È9×9&©y&Z/L¾ºG'ÙîÙ‚9r0ï<ëz6û?VºéšSJ(ˆ„"W„R ò„ µžåˆ0±CÊbüá¨×ªN ãp•ñ°f`µøª3mT)§ pŠFqî(â€yNZÏI=ì¿C‰”d²î;&#y,"ÚüRN áÝ°ØÕ'‘WègÜ"å~ ð­òéÚ-јeçz“ Ê+oô¡´èa¨ÎÔäÕvüZ¨Lô@ç–òf“[ÊÏ]©±ªÜsTû:«¤LÛg•›^ÏP*…¤OôêÃt7"_9.®ÙEbù.çnÒŽäŽý Xív Z×ñH+?âQ‡¹ŽÔENš‹¹LWÔ_¿‰s„Oèƒçîy+»éW!QU5£Fö`ùN „¬Å¥‚!ò%¹:ä!@jÝ(Lê1L· ÀùŒŸ-“Ñ@?™šyÆ89Ô#û»ø"I¦kA)” @‰¼@I-ÈCÔz(2BZÎv ¸æLå$3ëoÝmm§>ÑÏë1¹&ìy o¶Å¥ƒ1ò&1µ Rë!2Œ(Þ…è2œ+}ØŒI·ÿs ¨ûЩB'y–s”mq)Ä @Œ¼IIîÆ€yˆZ±ªQÃùDWyÕÙ¡íìç#u¿þvÒ ÛîR”A @ù@™ZG ©u[„D¦‘ö+ŽíSƳi¿Šž³¸LtkÌ¿í­Bç¢RêA  ¹ žZ§©uÔ…@5÷%4¶ó¼âû!øñþWþíy†qgª&O=tm‹ ©<ÂÈ—y‚©ú,@H§ã§~±ûr›;wÔ]NU sÙç*Зjy`ó¢¡-Œx³Q=í&š'ŽÕ:¢kÊc\LIî Tª>‹ÒéÖ~M…8°’O{l*Ô8ÎÇŒmóK{ÌK?=›‡™ªÏÿð Ó?V%Æb fXBþäÂîS7†Õ}‡ëô,F7ó? â¢úþZû?²Q›KŸ¢òRÀCTÁy©zàlE¼©‡ÇÉÿ¦4öY?èêر‰6S/àU#Y³åˆQ³ &é¯|Ø~µ7Eÿ¥¢fendstream +endobj +3624 0 obj << +/Type /Page +/Contents 3625 0 R +/Resources 3623 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3471 0 R +/Annots [ 3627 0 R 3628 0 R 3629 0 R 3630 0 R 3631 0 R 3632 0 R 3633 0 R 3634 0 R 3635 0 R 3636 0 R 3637 0 R 3638 0 R 3639 0 R 3640 0 R 3641 0 R 3642 0 R 3643 0 R 3644 0 R 3645 0 R 3646 0 R 3647 0 R 3648 0 R 3649 0 R 3650 0 R 3651 0 R 3652 0 R 3653 0 R 3654 0 R 3655 0 R 3656 0 R 3657 0 R 3658 0 R 3659 0 R 3660 0 R 3661 0 R 3662 0 R 3663 0 R 3664 0 R 3665 0 R 3666 0 R 3667 0 R 3668 0 R 3669 0 R 3670 0 R 3671 0 R 3672 0 R 3673 0 R 3674 0 R ] +>> endobj +3627 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 754.651 512.306 763.674] +/Subtype /Link +/A << /S /GoTo /D (section.21.6) >> +>> endobj +3628 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (section.21.7) >> +>> endobj +3629 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 716.643 512.306 726.212] +/Subtype /Link +/A << /S /GoTo /D (chapter.22) >> +>> endobj +3630 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 703.094 512.306 712.117] +/Subtype /Link +/A << /S /GoTo /D (section.22.1) >> +>> endobj +3631 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 689.545 512.306 698.568] +/Subtype /Link +/A << /S /GoTo /D (section.22.2) >> +>> endobj +3632 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 675.996 512.306 685.019] +/Subtype /Link +/A << /S /GoTo /D (section.22.3) >> +>> endobj +3633 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 662.447 512.306 671.469] +/Subtype /Link +/A << /S /GoTo /D (subsection.22.3.1) >> +>> endobj +3634 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 648.897 512.306 657.92] +/Subtype /Link +/A << /S /GoTo /D (section.22.4) >> +>> endobj +3635 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 635.348 512.306 644.371] +/Subtype /Link +/A << /S /GoTo /D (subsection.22.4.1) >> +>> endobj +3636 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 621.799 512.306 630.822] +/Subtype /Link +/A << /S /GoTo /D (section.22.5) >> +>> endobj +3637 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 597.341 512.306 606.909] +/Subtype /Link +/A << /S /GoTo /D (chapter.23) >> +>> endobj +3638 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 583.792 512.306 592.814] +/Subtype /Link +/A << /S /GoTo /D (section.23.1) >> +>> endobj +3639 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 570.242 512.306 579.265] +/Subtype /Link +/A << /S /GoTo /D (section.23.2) >> +>> endobj +3640 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 556.693 512.306 565.716] +/Subtype /Link +/A << /S /GoTo /D (subsection.23.2.1) >> +>> endobj +3641 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 543.144 512.306 552.167] +/Subtype /Link +/A << /S /GoTo /D (subsection.23.2.2) >> +>> endobj +3642 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 529.595 512.306 538.618] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.23.2.2.1) >> +>> endobj +3643 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 516.046 512.306 525.068] +/Subtype /Link +/A << /S /GoTo /D (subsection.23.2.3) >> +>> endobj +3644 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 502.496 512.306 511.519] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.23.2.3.1) >> +>> endobj +3645 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 488.947 512.306 497.97] +/Subtype /Link +/A << /S /GoTo /D (section.23.3) >> +>> endobj +3646 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 475.398 512.306 484.421] +/Subtype /Link +/A << /S /GoTo /D (subsection.23.3.1) >> +>> endobj +3647 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 461.849 512.306 470.872] +/Subtype /Link +/A << /S /GoTo /D (subsection.23.3.2) >> +>> endobj +3648 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 448.3 512.306 457.322] +/Subtype /Link +/A << /S /GoTo /D (subsection.23.3.3) >> +>> endobj +3649 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 434.75 512.306 443.773] +/Subtype /Link +/A << /S /GoTo /D (section.23.4) >> +>> endobj +3650 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 421.201 512.306 430.224] +/Subtype /Link +/A << /S /GoTo /D (section.23.5) >> +>> endobj +3651 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 407.652 512.306 416.675] +/Subtype /Link +/A << /S /GoTo /D (subsection.23.5.1) >> +>> endobj +3652 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 383.194 512.306 392.762] +/Subtype /Link +/A << /S /GoTo /D (chapter.24) >> +>> endobj +3653 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 369.645 512.306 378.667] +/Subtype /Link +/A << /S /GoTo /D (section.24.1) >> +>> endobj +3654 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 356.095 512.306 365.118] +/Subtype /Link +/A << /S /GoTo /D (section.24.2) >> +>> endobj +3655 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 342.546 512.306 351.569] +/Subtype /Link +/A << /S /GoTo /D (subsection.24.2.1) >> +>> endobj +3656 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 328.997 512.306 338.02] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.24.2.1.1) >> +>> endobj +3657 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 315.448 512.306 324.471] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.24.2.1.2) >> +>> endobj +3658 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 288.349 512.306 297.372] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.24.2.1.3) >> +>> endobj +3659 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 274.8 512.306 283.823] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.24.2.1.4) >> +>> endobj +3660 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 261.251 512.306 270.274] +/Subtype /Link +/A << /S /GoTo /D (subsection.24.2.2) >> +>> endobj +3661 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 247.702 512.306 256.725] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.24.2.2.1) >> +>> endobj +3662 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 234.153 512.306 243.175] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.24.2.2.2) >> +>> endobj +3663 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 220.603 512.306 229.626] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.24.2.2.3) >> +>> endobj +3664 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 193.505 512.306 202.528] +/Subtype /Link +/A << /S /GoTo /D (subsection.24.2.3) >> +>> endobj +3665 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 179.956 512.306 188.979] +/Subtype /Link +/A << /S /GoTo /D (subsection.24.2.4) >> +>> endobj +3666 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 166.407 512.306 175.429] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.24.2.4.1) >> +>> endobj +3667 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 152.857 512.306 161.88] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.24.2.4.2) >> +>> endobj +3668 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 139.308 512.306 148.331] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.24.2.4.3) >> +>> endobj +3669 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 125.759 512.306 134.782] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.24.2.4.4) >> +>> endobj +3670 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 112.21 512.306 121.233] +/Subtype /Link +/A << /S /GoTo /D (section.24.3) >> +>> endobj +3671 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 98.661 512.306 107.683] +/Subtype /Link +/A << /S /GoTo /D (section.24.4) >> +>> endobj +3672 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 85.111 512.306 94.134] +/Subtype /Link +/A << /S /GoTo /D (section.24.5) >> +>> endobj +3673 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 71.562 512.306 80.585] +/Subtype /Link +/A << /S /GoTo /D (subsection.24.5.1) >> +>> endobj +3674 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 58.013 512.306 67.036] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.24.5.1.1) >> +>> endobj +3626 0 obj << +/D [3624 0 R /XYZ 85.039 786.531 null] +>> endobj +3623 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3677 0 obj << +/Length 3303 +/Filter /FlateDecode +>> +stream +xÚíœ[w·€ßõ+øÖå!\w}ɱ§qê[-¥î9I(‰’XK¤ËKd÷×wp‡¸‹‘×WYõɉIí.0ƒùf€ÁeÉFþc£V*ô¨ik¢\íÑÑ9ÜùÛóOLü#“왇G{û?ÕrÄ(ÑTŽÎb=š¥ëÑÑéoÕÁr1æmµ™¹õø£_öÅŠ3ÑLSíö~ûƒŽNA…_ö(º]ÃwJ˜Ö£«=©QRø¿/÷÷þër÷äÈ•êk…-Q­è6ƒ©¬ êiêfÔ(EjÙØvpIád<u]==„O!ªWcVͧðïrÌ›êzm.ËêÙ‘ ÷[Q-Wpÿõz3ÝÌÁ)hÕ(j?¤ÖÙ_7?°{X|ÇøRK¢eÚ1Ùê|侼̌JM²b]#îÖmŒ(˜ØUA1F€C]xîQ\ld'9¡à‘x?vœÒ·pmÿ_/Æ®Ú7ùW é›>”f*†ÐÌÌ*˜*ÑìjP¦‰‰e¼%ubáSIhÖ`.%t.Wã «®L\¦€ÜjeÎàdüë±ùŒ^SÂîm4{*†`Ïì/XSÂÞÕ Œƒ®FäÌðÏK3’\í®\üNàÂlí®,3ó¥5ÀªÙÆý±}ã>k,§Ökæðuqî.¿±×§L^†zÎÌ••»ýï­ó(VùêÀá n÷àïTÑðàÔ}œ¹»¬º†›ÌXk$¤mÜ„Áåµ]ÏVû¾×±åÁÏWK#êÍþú‡ñ¤ÖÍ7ä±%¯¤ŒH5Ø)c)Ä'Ý3·¸dG|Ù#™Á!ë¶K,9eȦ¾ zöüÈ}Ù:ÿs¼ >güæÜ]{±²œÏÉöÎÁ ÍH/+VÆ—›R°¶À¯Gƒ"@Tl$ØH"OC^pp1µpæ ÏgsááÎΦ&*/7îï78ïõÁÐä¡S1„bfN„bWƒEÑrR 9‚°?}éÀ¤–š´ZFÝ8ÍQ3Bù(Ü~°oXØKæî‰Ëå;ö¶±I7ÔÌÂ9-Ö’­‘9-9ÕÔ1œäÐU5æOln·«Ko*V ˆßï‚U™OÅ~·ÒyÓ –ÕÌmÓÅ© ›‡öî" >„`F8Ñšß·d,XihÌ¥bHÌewèjPî91±<ç¤Ñ<÷àÌwvbæPîüdz逛˜Ð'Ûõ:„•IÔëZßÓ ÷gnºñk¾ì¿1 mKNÜGŽ­™9ÍíÃåmÓ|!R¡YIeÅʤr“ Î ¤z4(’BņXS1Ù&Rarñèm4þ›uÂÈzßß¹YéìÊ]:°S‹Œ‹E7w¥”Ý@ mŠ/Cðev¼´FÕ£A&6ZÝ¥õ |)Ð|ùWe«ù¹]cåå&.®l¼%Ž&=’_•o×PT©‚*³‚ª«A&6¢RñÊ]T¼U$Sú° +—ŽÌlsGm!ôËQÊ­{róþ‰¯j’ÕÕm–’(&n4k}e2²cÛm¯}ïÌ•üL+Ø%×IZr¬±»ußâ:] Ê®ƒ‰4Érà°zàÍMÂxiãץΟÌÕ”.Å^:˘j­ïj^äZ=c(„@ŒÖ¼´„ב]Xññ†hÅ@龜¹„\ÿä7ŠFvúoÒùIÌo ÂõÜ>yl¯šj²^šñ—5Ÿ’ˆoÈP&©B%3Â¥«A™ &6²a’HÊç`Ï©›E^›ïË•_S°)ÐâÄ\»XÙ¨šÿ·—O\w••Ïdwû캆 MF%>ªÓöuM²ÊzzíZ½Óìn¯m}§͇„vÉu’Vƒ\kÌnÝÎuJë=”]tJI«Ä ×És¯þ³ÎüÇÏkïl¡—6·Í-ý‰BØ+=”C*†pÈ "¸.qèjP怉 dÛAw9ð[9<5¦=Ï—nfÁù8©ÿÜã]hÇ@4Y±2šÜFe4=Ñ b#šzY%wÐæiXµu}$Ò¡º6]’ÝS÷°4m­¾PFš3”P*†ÊL%DiµGƒ2!Ll$TS©Ú!$=¡¿ÏVÇÂ7nõÜîW¯#¬BX=ög¯ldùå×[Jö¡@¼öC¤bÌ2®e ˜Ø°â-%Œã*.~Šï§Nz°{ ÅžŠ!Ø3û#Ø»”±cbC*… Œ6 {Xóî™ês +IœHe>&m uM²ÊºZrUÀ×\Ë0åðGÚܺ„ñÊå±_/wOÙÞë{¤äbɃ\ ³ânÝ·¸XWƒ[ö¯5¾-)|É{÷¯ÃCÖk·ýxá{s;Û¬wœ|ó€_Ž…Üb¹¸˜mÆ‚Â%øÇÞ´ûÛ¯}G¥¯ç› ÷í|›UÇÓ¦v¦ð{lj£ÍÛ©ÑY¾´ÈžÕTÜÔžpÂ8~jYÒšÀïî…†§Ãný}g»?ƒ•FcV¬9²OôhPìðQ±|Ë¡<^Çí‡S»©ýúÜæZÛEÊ©XufGû+ç!³‚™êý¡ìL2r,…0NÆFwÄ— #2#àº%4Û«c"÷lzåç;nõo½¼ÜÆI¾aþ§~HͧH¿ÚÕ‚·ûOÌØ««í[¿úgð¢_‚Ó¨{¢_nÍ64z(ÃT ˜Z]¢ØÕ Œ23¡ÌØšq ™Ùþl㶩/ü¼Èu¿Ðíß±pûL¨½]†¢NÅÔ™ÍÔ] ʨ1±µ4—xBÍwQ¯Âx aû'9Y.Ìv‹â÷Ž­7ÄP¶©Â632ôi%¶] Êl1±‘-oˆ«µ†­@ÂØ“…Dﾯ·ÆPÀ©8³4¸«A0&6†9jKe,w‡C)Õ¦ îð Ù(»±wÚˆöÐõ¦J7CèffFèv5(ÓÅÄÆlŠRÂS¾,;Ù”!ÇKà¸M»)Óux3ÂvÛ§a»tsa×-üNÀ¡[ÿßÍkÓ”î›)­y]Ï­s¾¶%Íùihù¦ ¥•Š!´2³ Q:°Ð£A™&6Ä"okÒÐ:Ñ +9ÓÑ…Çõl¶yøø¹ßíNÜüÇ<Õ²»f¡•ÁeÅÊàr +QÀõhP‡ŠàÈoUŽï‚{b¶Í~~~xäÙeo¥0Êä7Ük†¶Å™Š!83»"8»”qbb#N¥IV• Îô@€vdú8ß÷¹÷aäü~Ï[‚M†bNÅÌ™½…(DèÑ Œ1ËšPÕ&Ì!õùñ™Ò'î}Õ¥»Ìk©MÓÜW¼ÞCñ¦bÞÌÎÞ®e¼˜ØˆWp¢¨NxÃ¥WK|µ¸`½†‚MÅ°™…°] Ê`1±!©å¬%:¶êûVoug¢¡Ðc)„y2¾¥1]ñeâˆÌÉTÉð?õ/Â<ôa|Ï[Là O÷³.f–ú—M~ "dÎaçÀì¸Öw!\]S‡‚‹¥pɈ¸Žø28DfÇ4#m‘ yñ?훈«wéhßeü©;Íqo4Ù+~öNùŽ»“ôÂŒ®ùÝéqC£2ÌŠ•!æ-SìÑ ˆ96­ÝæŽCBl¶¢Íi¿ëâV Všk3ÿ;‹8Kug7!4gñå|wæ:nMÅWeæ8”Y*†0ËŒ‡0ëjðqïÝv­ºå½ûðÛ¸s ¿.æ'î§Z«NgûSs(aµžuÌÈd½Ç‘T³­Ñdé ̬&ìÈAÃ[ôÈSŒ0^ãY“”MõýÈA y+ ¤T ¤Œâ] Ê&6‚GjÂjϼº°/mzØ~‡Ëwsn‰|ºrýá&zD:˜»uïß»Äåtö|ÖÍ75±fJ:CHg&GHw5(“ÆÄFÒö¼^H‡³;ƒœlîAOWadÖéû4“ Ö +<C€g–G€w5(ÇÄàZ“Z5·Œ3I{DÓg17~Ãð?[-¯ü«Á—>šñ¥ï™}³¾ý†1{› ¤œJ•!gÖ²tœ¨+¾ˆ“›ß*¥m Ö +~™Ú׶³ôÃ_1= ¶_7Ðÿ ÞN©§Reê2õ®ør>§(U} ü/Â/~øOÓ¦“¨-Ñm!¹7oIÖ ˜ ·ißó“Zþ'lýC™Æÿ¢þ¿Vendstream +endobj +3676 0 obj << +/Type /Page +/Contents 3677 0 R +/Resources 3675 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3471 0 R +/Annots [ 3679 0 R 3680 0 R 3681 0 R 3682 0 R 3683 0 R 3684 0 R 3685 0 R 3686 0 R 3687 0 R 3688 0 R 3689 0 R 3690 0 R 3691 0 R 3692 0 R 3693 0 R 3694 0 R 3695 0 R 3696 0 R 3697 0 R 3698 0 R 3699 0 R 3700 0 R 3701 0 R 3702 0 R 3703 0 R 3704 0 R 3705 0 R 3706 0 R 3707 0 R 3708 0 R 3709 0 R 3710 0 R 3711 0 R 3712 0 R 3713 0 R 3714 0 R 3715 0 R 3716 0 R 3717 0 R 3718 0 R 3719 0 R 3720 0 R 3721 0 R 3722 0 R 3723 0 R 3724 0 R 3725 0 R ] +>> endobj +3679 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 754.651 512.306 763.674] +/Subtype /Link +/A << /S /GoTo /D (subsection.24.5.2) >> +>> endobj +3680 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (subsection.24.5.3) >> +>> endobj +3681 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 727.553 512.306 736.575] +/Subtype /Link +/A << /S /GoTo /D (section.24.6) >> +>> endobj +3682 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 700.454 512.306 709.477] +/Subtype /Link +/A << /S /GoTo /D (subsection.24.6.1) >> +>> endobj +3683 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 686.905 512.306 695.928] +/Subtype /Link +/A << /S /GoTo /D (subsection.24.6.2) >> +>> endobj +3684 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 673.356 512.306 682.379] +/Subtype /Link +/A << /S /GoTo /D (subsection.24.6.3) >> +>> endobj +3685 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 648.897 512.306 658.466] +/Subtype /Link +/A << /S /GoTo /D (chapter.25) >> +>> endobj +3686 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 635.348 512.306 644.371] +/Subtype /Link +/A << /S /GoTo /D (section.25.1) >> +>> endobj +3687 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 621.799 512.306 630.822] +/Subtype /Link +/A << /S /GoTo /D (section.25.2) >> +>> endobj +3688 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 608.25 512.306 617.273] +/Subtype /Link +/A << /S /GoTo /D (subsection.25.2.1) >> +>> endobj +3689 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 594.701 512.306 603.724] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.25.2.1.1) >> +>> endobj +3690 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 581.151 512.306 590.174] +/Subtype /Link +/A << /S /GoTo /D (subsection.25.2.2) >> +>> endobj +3691 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 567.602 512.306 576.625] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.25.2.2.1) >> +>> endobj +3692 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 554.053 512.306 563.076] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.25.2.2.2) >> +>> endobj +3693 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 540.504 512.306 549.527] +/Subtype /Link +/A << /S /GoTo /D (subsection.25.2.3) >> +>> endobj +3694 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 526.955 512.306 535.978] +/Subtype /Link +/A << /S /GoTo /D (subsection.25.2.4) >> +>> endobj +3695 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 513.406 512.306 522.428] +/Subtype /Link +/A << /S /GoTo /D (subsection.25.2.5) >> +>> endobj +3696 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 499.856 512.306 508.879] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.25.2.5.1) >> +>> endobj +3697 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 486.307 512.306 495.33] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.25.2.5.2) >> +>> endobj +3698 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 472.758 512.306 481.781] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.25.2.5.3) >> +>> endobj +3699 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 459.209 512.306 468.232] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.25.2.5.4) >> +>> endobj +3700 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 445.66 512.306 454.682] +/Subtype /Link +/A << /S /GoTo /D (section.25.3) >> +>> endobj +3701 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 432.11 512.306 441.133] +/Subtype /Link +/A << /S /GoTo /D (subsection.25.3.1) >> +>> endobj +3702 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 407.652 512.306 417.22] +/Subtype /Link +/A << /S /GoTo /D (chapter.26) >> +>> endobj +3703 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 394.103 512.306 403.126] +/Subtype /Link +/A << /S /GoTo /D (section.26.1) >> +>> endobj +3704 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 380.554 512.306 389.576] +/Subtype /Link +/A << /S /GoTo /D (section.26.2) >> +>> endobj +3705 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 367.004 512.306 376.027] +/Subtype /Link +/A << /S /GoTo /D (section.26.3) >> +>> endobj +3706 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 353.455 512.306 362.478] +/Subtype /Link +/A << /S /GoTo /D (subsection.26.3.1) >> +>> endobj +3707 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 339.906 512.306 348.929] +/Subtype /Link +/A << /S /GoTo /D (subsection.26.3.2) >> +>> endobj +3708 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 326.357 512.306 335.38] +/Subtype /Link +/A << /S /GoTo /D (subsection.26.3.3) >> +>> endobj +3709 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 312.808 512.306 321.83] +/Subtype /Link +/A << /S /GoTo /D (subsection.26.3.4) >> +>> endobj +3710 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 299.258 512.306 308.281] +/Subtype /Link +/A << /S /GoTo /D (section.26.4) >> +>> endobj +3711 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 285.709 512.306 294.732] +/Subtype /Link +/A << /S /GoTo /D (subsection.26.4.1) >> +>> endobj +3712 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 272.16 512.306 281.183] +/Subtype /Link +/A << /S /GoTo /D (subsection.26.4.2) >> +>> endobj +3713 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 258.611 512.306 267.634] +/Subtype /Link +/A << /S /GoTo /D (subsection.26.4.3) >> +>> endobj +3714 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 245.062 512.306 254.084] +/Subtype /Link +/A << /S /GoTo /D (subsection.26.4.4) >> +>> endobj +3715 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 231.512 512.306 240.535] +/Subtype /Link +/A << /S /GoTo /D (subsection.26.4.5) >> +>> endobj +3716 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 217.963 512.306 226.986] +/Subtype /Link +/A << /S /GoTo /D (section.26.5) >> +>> endobj +3717 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 204.414 512.306 213.437] +/Subtype /Link +/A << /S /GoTo /D (subsection.26.5.1) >> +>> endobj +3718 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 190.865 512.306 199.888] +/Subtype /Link +/A << /S /GoTo /D (subsection.26.5.2) >> +>> endobj +3719 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 177.316 512.306 186.338] +/Subtype /Link +/A << /S /GoTo /D (subsection.26.5.3) >> +>> endobj +3720 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 152.857 512.306 162.426] +/Subtype /Link +/A << /S /GoTo /D (chapter.27) >> +>> endobj +3721 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 139.308 512.306 148.331] +/Subtype /Link +/A << /S /GoTo /D (section.27.1) >> +>> endobj +3722 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 125.759 512.306 134.782] +/Subtype /Link +/A << /S /GoTo /D (section.27.2) >> +>> endobj +3723 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 112.21 512.306 121.233] +/Subtype /Link +/A << /S /GoTo /D (section.27.3) >> +>> endobj +3724 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 98.661 512.306 107.683] +/Subtype /Link +/A << /S /GoTo /D (section.27.4) >> +>> endobj +3725 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 85.111 512.306 94.134] +/Subtype /Link +/A << /S /GoTo /D (section.27.5) >> +>> endobj +3678 0 obj << +/D [3676 0 R /XYZ 85.039 786.531 null] +>> endobj +3675 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3728 0 obj << +/Length 2687 +/Filter /FlateDecode +>> +stream +xÚíœÍsÛ6Àïþ+t¤B‰/8í8N›¦“6ÞµÒº=Ð2#«•D—¢“fÿúÅ7 ‘€Åf2UÔL&#Jðßxxx '¹ø'Œ‚óIÉ +@1œ,6ùd)€¦ÄÌ™ežÍ/¾ù® ˜žóÉük‡ç€òb2¿û%»j¶SIJ®Ö»é¯ó.¾»†ÑcÙì¿üšOî„ +?\äs6ù ®s9Ÿl.Å€l¾¯/n.þíÚÒ÷ÈD×z +’s¡k9™á0FË@Ä@QâQ))Ý£¢…Ùãt³ùS‘ͧfõâ~»úã±îÙƒp,Ú²õv9Ñÿ GNkzТT|(—Bx ·o ß× 3 +L„“ €Pö„‡Í‰èð k +©ÞÁµ‡ý~µ¼×öò}µZ èÕíj½’ð§8Ï>jOûZyÝnÕl£nÖ+pŒ›M©{Т¶$‰YÒ·”v³(ífsxÁÓ£«³1qöûêfmÖj#G[P->ÚB"ñ>2 A´•%€LŽ: úßð`ÃDDVB3*<1a{WôJñf IÍ^þ,-Fiö£WËV;by-B:5ö´odh³;q{»ì[*b­@¤%ué´¾‡mjKÒ˜%}S©Ñ†*B°ph"dDÈF¨q‡V RD¾ifÊ(•síÎÞ<,ÛêNÚN™ó]Ûl´»QFß›ßVBÃ?õ¯]£Ë©8s†¸ƒ<ââ¼JGx¸”þûíi‹1‹»v>%Š,äI÷…+µƒ)wîíê¾j…]vÒ€µŒ.¿ú6ãŒÉÆú6_-áÛBñþÑ× B&ź^çº^`CÈ×·¶4ëZÎw2|\4[).ÛªŸ+åÑD@Ù<7*„<ªÆc©új ª¡yãTûÄ©¦ÄZª”B<²T±¡z-S ÕNqý ¯›Ö.ªÅ•ÙïòÇZÎN%/Î{,[¤T‹Sß3”ú€Ÿ¶* D'g⳨-¤tƒz*vB-³Ÿæò.ÑóèõsùåjhR•±þ~ýü*2³z1µ&Ÿê Emð2fpßҧ̮´#ªÀOŒ@ÂÇÔšÙή×jɵ•+oµˆ±çVå/ìz¼Sìý›NÍȺ%Š¿Èg,2vÀùj‰Z;ο¯AÔÍ&ÅBŠAY”Š)À¬ð%fµ€¾Æ Ùoè¢[½W®U~‘Éq}ZÐ>sc ±Ì}µóÐøqæ} âÌSb!3AÀð>s˜Ið„ñìy³©V&&zUIäÕ<ûØ ò9ÌOlÞŒa3Ï8›¯–ÀÚ°¶¾ql)±[Îbå6d°ÝÔ­Ÿ­q¹÷ÒM·µM›N•ã•wž¯ÚzÑ5íÇaÆ8GŸŽy’±p|µœÐJq8} âpRb-)¾Äì6p^5K»Ì¸Y´rf|ëR1œNtagŸr$¸ ZÜž €Ð +.)Öc‚ãàˆw-ÖF.×µæ÷ãjéŽß\µuÕ©d ÿ^0æ)Æ‚ñÕ`B ÅÁô5ˆƒI‰u`Šä€ 5\ÞìTÒî…Ÿ({Ñ6r·èAÿ|¹PKó¨÷Ÿ§&n§0ôÃÅåj%hf‹ÃꉳJÈ´A$¡rKãB&†¼élôø`Œ/¦¢—[?¦jµf]£lb•Á²…3EFñ©;EýôcYºZ –]icÙg™iW}„ÐeÓÌú: õZ2U_Z–ãóζXÃŒåLŽØÚ3zœ4yzWÈ¡N‰uã€säYÛÅßÐÿ]c#Ky¨e¡|k½3«AÊð¼Æ³v‹ÖWK  mGÛ× Ž6%Ö¡…‚=Zç“«œ Õ!%óåæa]oK=KÙ3qûJÞ‘+‰fµ°+‚ùé4;– ¯– š’ÂÁ¾O¤By:ŠEÄŸJ…ÚBJ7dŽ ½r”]Ê£fsÇœÙÓgfírrkQ%Lõí·òøD}«¿\ªLÝF%ñV»Î9~{ˆ­Q»¾Í:’ ”?"?š|Ôƒ5…Ø1• ¥h~4O¦Fuœ$qI±É:äR£_O-í Jk¥‘ƒ2¨”{âÝ¡¯AÔ­&ÅZ·Š ˜ÍØ¡ ]úíVDZ‡3¦ˆbœŠ¡$&ǹîï¤+5óè£\Ô¢Ç|IS¥5ÀX¦¾Z‚ihÜ8Ó¾q¦)±Ž)aãÒ3uSe½xl÷¶1$P( ´““£Xuª3ibzsóJ@J¡?ó°cùùj ~¡!iìlÓ€q~)±Ž& dÌóÆßüÞd?eÄÚG÷}³1÷õ¦òR|ã~Q 9ûìcqúj œ¡]iì€Õ€qœ)±'#8‰ÁùbÝÈ#ÕÚ ÆºëVÒë.åúç¶ñdí0­¯–@Ú8Ž¶¯AmJ¬C›— °™D‰–ZO»·Yqã6‘U†a+ó‚œ`c±€}µàÐÒqÀ} â€Sb-`$ÄCâù6ŸÐª¸H¿ Ôî1w:j¿: +> ¾Æ#ñúZqº¡™iìlN_|”mJ¦CËä‹]г-›eß®þW©#Z´<¤Æc™új ¨¡ãTûı¦Ä:®E r{ÐKreC\;½ ÝÆK%åç3^%ÆÂõÕpC+Çáö5ˆÃM‰upÅ'á\~÷ç•õÂÌ&ŒcK˳;Ìcí1±¯–@Ú:Ž¸¯AqJ¬CŒ¹ƒŒD¦PuˆQžU:SÿA‘mZÄ%x«í²îõHN¨yú±@}µÐвq } >åU”‹M¿©cÊH½ä{:%39Ù¶y¼]×»{™›Í³&õBŽsÌû8)¥ZÔÆŠeó }æ—q`¹¿G2˜<·…”ÎX'ÏçA~ܾȽ¸¯Õ›ÜëÕN½e8œòD‘òN*xТ¶iì(SÐÒ_Lyê2˜ò†E° ‚]Êû¥êýÎýŒÔæ ÞHÒùn¹|øç¾tcm7ÒKÕâ^jK¼“OïNÙi')ÖuÂã®;Øc—úÍ Ù6ö܇~ W¬àá?½±ÓXô¾Z}È Ž¾¯A}J¬C € ±èí›9.Þp‡~vj_ }éÎZll'ðÕ ¤Ac¾4ˆw‚”X× Ä,\rj;1@øZ­MŠö^-~n¡t2H‘s©>:ò/™`çŠÝØh,v_-=´bØûÄ/VÑÒP¤ þcû×þúŸèqñ†|/…E ŠJÑ¿ÈËÍXíÚ`¿S‹@š2l ÿ37Žmendstream +endobj +3727 0 obj << +/Type /Page +/Contents 3728 0 R +/Resources 3726 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3770 0 R +/Annots [ 3730 0 R 3731 0 R 3732 0 R 3733 0 R 3734 0 R 3735 0 R 3736 0 R 3737 0 R 3738 0 R 3739 0 R 3740 0 R 3741 0 R 3742 0 R 3743 0 R 3744 0 R 3745 0 R 3746 0 R 3747 0 R 3748 0 R 3749 0 R 3750 0 R 3751 0 R 3752 0 R 3753 0 R 3754 0 R 3755 0 R 3756 0 R 3757 0 R 3758 0 R 3759 0 R 3760 0 R 3761 0 R 3762 0 R 3763 0 R 3764 0 R 3765 0 R 3766 0 R 3767 0 R 3768 0 R 3769 0 R ] +>> endobj +3730 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 754.651 512.306 764.219] +/Subtype /Link +/A << /S /GoTo /D (chapter.28) >> +>> endobj +3731 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (section.28.1) >> +>> endobj +3732 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 727.553 512.306 736.575] +/Subtype /Link +/A << /S /GoTo /D (section.28.2) >> +>> endobj +3733 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 703.094 512.306 712.663] +/Subtype /Link +/A << /S /GoTo /D (chapter.29) >> +>> endobj +3734 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 689.545 512.306 698.568] +/Subtype /Link +/A << /S /GoTo /D (section.29.1) >> +>> endobj +3735 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [490.587 651.052 512.306 661.347] +/Subtype /Link +/A << /S /GoTo /D (part.4) >> +>> endobj +3736 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 626.594 512.306 636.162] +/Subtype /Link +/A << /S /GoTo /D (chapter.30) >> +>> endobj +3737 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 613.044 512.306 622.067] +/Subtype /Link +/A << /S /GoTo /D (section.30.1) >> +>> endobj +3738 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 599.495 512.306 608.518] +/Subtype /Link +/A << /S /GoTo /D (section.30.2) >> +>> endobj +3739 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 585.946 512.306 594.969] +/Subtype /Link +/A << /S /GoTo /D (section.30.3) >> +>> endobj +3740 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 561.488 512.306 571.056] +/Subtype /Link +/A << /S /GoTo /D (chapter.31) >> +>> endobj +3741 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 547.938 512.306 556.961] +/Subtype /Link +/A << /S /GoTo /D (section.31.1) >> +>> endobj +3742 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 534.389 512.306 543.412] +/Subtype /Link +/A << /S /GoTo /D (subsection.31.1.1) >> +>> endobj +3743 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 520.84 512.306 529.863] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.31.1.1.1) >> +>> endobj +3744 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 507.291 512.306 516.314] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.31.1.1.2) >> +>> endobj +3745 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 493.742 512.306 502.764] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.31.1.1.3) >> +>> endobj +3746 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 480.192 512.306 489.215] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.31.1.1.4) >> +>> endobj +3747 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 466.643 512.306 475.666] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.31.1.1.5) >> +>> endobj +3748 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 453.094 512.306 462.117] +/Subtype /Link +/A << /S /GoTo /D (subsection.31.1.2) >> +>> endobj +3749 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 439.545 512.306 448.568] +/Subtype /Link +/A << /S /GoTo /D (section.31.2) >> +>> endobj +3750 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 425.996 512.306 435.018] +/Subtype /Link +/A << /S /GoTo /D (subsection.31.2.1) >> +>> endobj +3751 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 412.446 512.306 421.469] +/Subtype /Link +/A << /S /GoTo /D (subsection.31.2.2) >> +>> endobj +3752 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 387.988 512.306 397.556] +/Subtype /Link +/A << /S /GoTo /D (chapter.32) >> +>> endobj +3753 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 374.439 512.306 383.462] +/Subtype /Link +/A << /S /GoTo /D (section.32.1) >> +>> endobj +3754 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 360.89 512.306 369.913] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.1.1) >> +>> endobj +3755 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 347.341 512.306 356.363] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.1.2) >> +>> endobj +3756 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 333.791 512.306 342.814] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.1.3) >> +>> endobj +3757 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 320.242 512.306 329.265] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.1.4) >> +>> endobj +3758 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 306.693 512.306 315.716] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.1.5) >> +>> endobj +3759 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 293.144 512.306 302.167] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.1.6) >> +>> endobj +3760 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 279.595 512.306 288.617] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.1.7) >> +>> endobj +3761 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 266.045 512.306 275.068] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.1.8) >> +>> endobj +3762 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 252.496 512.306 261.519] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.1.9) >> +>> endobj +3763 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 238.947 512.306 247.97] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.1.10) >> +>> endobj +3764 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [490.587 200.454 512.306 210.749] +/Subtype /Link +/A << /S /GoTo /D (part.5) >> +>> endobj +3765 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 175.995 512.306 185.564] +/Subtype /Link +/A << /S /GoTo /D (chapter.33) >> +>> endobj +3766 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 162.446 512.306 171.469] +/Subtype /Link +/A << /S /GoTo /D (section.33.1) >> +>> endobj +3767 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 148.897 512.306 157.92] +/Subtype /Link +/A << /S /GoTo /D (section.33.2) >> +>> endobj +3768 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 135.348 512.306 144.371] +/Subtype /Link +/A << /S /GoTo /D (section.33.3) >> +>> endobj +3769 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 121.799 512.306 130.822] +/Subtype /Link +/A << /S /GoTo /D (section.33.4) >> +>> endobj +3729 0 obj << +/D [3727 0 R /XYZ 85.039 786.531 null] +>> endobj +3726 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3773 0 obj << +/Length 3090 +/Filter /FlateDecode +>> +stream +xÚíœ[sÛ¶€ßý+ôêÁ(q#‰óÒq’6q'Isb'íLÛZ¦mM,É¡è\þ}±¸S`3i]+ÉdQ–Xî· x’ËxRq”S1)«qŠ'³Å^>9—¿<Ùæľ)²”yx¼÷ÃÏ›à‰\LŽÏÜuDŽ¸(&ǧdVË)©²®Ñëé_Ç¿ìýtì.T)…˾Ûûã¯|r*Uøe/GTT“ò8GXˆÉbqŠ8£æûåÞÑÞÿݵôol¢¥¶ÝË…ÔµœìÓUÛZ“ +e!o•sT°ÒÝ*Ƀ[Ř ŠÉÄ‚{¥ M÷Ë–õå§õ|Š³åùtŸeV/OõÁzu)O¿ŸÛÖò[½8©õ·«)ÅY;ÝÇÙêÊ5‹½˜ ²ÞI ›þ¥=ŸèƒWáíêÂé;Ù¸¢º‘‚nÖË1Þ¨wh\R RÊ‚0¹Á‹€)œB˜‡¦5JFP.AÓbi\ÂXöx^Ÿ/¥qVk0TfžÁ‘üJ)˺•,Vf«Kù½U&¥˜ðÁó|ø‘úíEþEñm¿ œ!Á¼¥&x…–ÚĆ6¯}ƒ_ 5À7EÓÕ:øò“3aáÿp¹îêËK׶¤U¼hº©$þ:˜UûVŸ}²œw«V<ÐçdW¤>kóùâXþ6­¨’TN$}ªV^e‹ËKh1Sz.³üªû`OžÁ6"]\@7Bþ'Ú#Aɲ,οoü—œYúÃXGÖ" '–gopà~­qçUå7Ljqë·Ôøíëu®r&çú:*š½~õLzŽüÞ0¾ÃKi,f'• ˜¿`1؃êã¼uZäEUÊSØ2g†ù“¦ëæ0Rë‘éFtðÚ¯´œµ«…>ê.}°€"õ +é0Až»œ¯;ÏÊûÖšb$Ù@,Ž¶gæ(Û-Dá&«utKÙŒ9±t¹¡ûÔ6èNçr(R'Væ˜öÀ²l!¡ºËC-ß©þÙÚc,b/–@Úºà1ÄC ˆiEPA™ FeƒäU:Ò/˜@•`éHßRºqé¿j C0{çÂú‡×ç±È=¨ë‘{R³+j£1£ù+}Iä.ƒT–ô†&C Dm/Ì]ä~¨ç€­Šžöåáéµ ÞuÀG*è*ïÛØv‡=¨±ÝØæåÅÍ+ä÷”¡ñ4U­sBP)œ;7>.›¶6Ñ(Ϥ0L¾aøÆRcá{±üBþPƒ8üTµ~.a……oâÇÍɵ.›÷Ð540i'â[vc­±àÅ’ˆ;ÀPƒ¸¤ªµÀG…(­°þ`дÐðu/À²¦UƒC nP”ß k¬‘ü±8ÿˆ¢ŒðߢA”²ZÇ_Fb˜U–¿Ÿþ®žAZä"œìØ`ºÖ>q N² 'SWò°ÕQĬY›4LÙó™ mL3–¶KÐͧ=Ô N;U­£]Tˆ ai†öK ]w3ø¸^UYÜïF{‡^`L6Ö ¼X Bq/j0œP•%ÂL¬‹L#0dé©ÔŒæç¼7iÁHpN§l!ÐìÍ!XŒóìà +Z2Ì©ò¬5Ù-Ȇþ±Ù2›ÂˆWlÔ•4š.VmóšÚhUÌhþR© %[Ũœž–²€lSô†…(žßb!ÊÒJëééS9/ÍUŽBvŒª[•Ÿ³ÕB矴m/!;QÙœ8xþð 2o ”¸Å¼5©òƵÆ"fæüYqâù-Vœ˜×:ܼõ`¦æ¨n˜ñçH-ÜÁØuGúäzuÝÚ­IúÌÌLwêμŸ×z|{ôFÚœåäžç{¬QFvOX¼{ê<æ[4ˆRÉj1§HÆV‹KÀHC#Hf(`=Hˆâ+]v±6‹Ù‹%0÷ìÅ<Ô Ž9U­Ã\ÈêE€™̪åAœ/k}ç®aòê+͹X „ˆÅ¡÷¬…¾Eƒ(ôdµ6Ú¥•üÌ™‡n'5V U‘d{¶tÏlZ@úE!w «—h´«<ž·v7ˬ[µŸÌ¯¯®ô^·¶“C7çÿ$1s{c‰y±±Ðt%Žj'–ªÖ†GÒ9æ¼G̵›[í$Îøï 9îY˜ÁPëÄúÛ)/²ú<iÏÔ~Fyð¸9™ÃVÈ¢7ª~scÉx±™ÐDq2C âdRÕ:2¼@E^l!wEæ•ÁÙÓ6 öe€ÌÝŒäÅ€BKÅ 5ˆJUëF8FQÎ]¶Ó.*AGU·]l„[›ú(CDoÍ— Òÿ¹¢»9¶ÛŒÅíŸC»—$†{¨AwªZ7¶xà¶cÛ6àgjip¡¿¨FÚt§h¶ZžIÕåNeåìeéÅ,C£ÆY5ˆ³LUëXbŽ¯ÔàËöÇ’²”¾Ó ¶ÖM/@¾œêͱyÖvõ‰ÞÓÞÁ×O‘UÆ ¦[¬2&õÚ¸¢V+¶k<¸Ò—¬2’’£ê†É9)¤Ås›ðq‹ŒO_¾þ]z;Ñî®9YslNX¼9õQD}c¨A´MVë<€ç¨r)?—P=zô«y2ÁùG0 ÿÎßk,/–àßå?Ô Î?U­ã/¡S—ô[b_þ ü{Ð÷c®±àÅÐCõ€¡qHUë<€ÈX˜Û„“KÐnÎûe_ðl®¶$\´™—ƒokõj·¨v*ÈÿE%vqç5ÆX¾^,Á·gèØE[4ˆóMUëøÊSÄî +ýžWÕÀ1Þ¥†z‡íÜm¬x±„ô€Äö¾oÑ î©jí\ 9Iâ…÷—·hÞ]ÛÔ Þs¤¾ÍÃ0¯ÔÂjmSîÁQ8#ènµnk‚‘T±8Õ¾ycT·h¥š¬Ö¶n\Q„]ÎÓÍ‚Ô»=êv.缜Óï­»ïÆhcýÀ‹%ü $êC â~ªÖµîB î’¡¨p­û™y0ö[·3b¾¸Ò å®ó[‹~û¿¡l‡pk‰±p½XnÏÊQ¸C âpSÕ:¸¼@y^y¸6MùDd";™»Slâ+ì ))` ìð®Pk…±`½XlÏÂQ°C ¾,™…)Fœ§sY¦ŒÒ¬Ò©¬#ÿš&÷6§UwÑ´úðÑ¡ÿó‘Ùb¯Ö›e{Üëp‹,WJáþõ´%cOyøëDS\y2»µ¡Èö±WÖl6³õ¼žéIL·Z›]Ò@î…`²ü¦½åW>þáñ­ßÔ‚¬±ãÌñí²ÿѪך¶lmÎêWØFÌ.[íõÁ¶/ÊoøI~k²±Ô½X‚|ˆ#N¨AÜRÕÚAQÀâÀ<þe(¼ÔK¨wlñÒêÜjùgŽÙ¹Ýç”ïü@ôõ.µûìJŸ€Âҭ٤Ωýò¢iI¦?jÕùN(S7¾Ë,ª+}VíÄP[þ͘l{ü1²'îÞºmìýK%¢ãw¿y©Äû—t™´_«/º0ŒÙ6,É?jŸùüwFºÁUHT‘Ä-'2,Ù_§úæÈp_Ÿl¼¢¶P ñßo³¦endstream +endobj +3772 0 obj << +/Type /Page +/Contents 3773 0 R +/Resources 3771 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3770 0 R +/Annots [ 3775 0 R 3776 0 R 3777 0 R 3778 0 R 3779 0 R 3780 0 R 3781 0 R 3782 0 R 3783 0 R 3784 0 R 3785 0 R 3786 0 R 3787 0 R 3788 0 R 3789 0 R 3790 0 R 3791 0 R 3792 0 R 3793 0 R 3794 0 R 3795 0 R 3796 0 R 3797 0 R 3798 0 R 3799 0 R 3800 0 R 3801 0 R 3802 0 R 3803 0 R 3804 0 R 3805 0 R 3806 0 R 3807 0 R 3808 0 R 3809 0 R 3810 0 R 3811 0 R 3812 0 R 3813 0 R 3814 0 R 3815 0 R 3816 0 R 3817 0 R 3818 0 R ] +>> endobj +3775 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 754.651 512.306 764.219] +/Subtype /Link +/A << /S /GoTo /D (chapter.34) >> +>> endobj +3776 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (section.34.1) >> +>> endobj +3777 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 714.003 512.306 723.026] +/Subtype /Link +/A << /S /GoTo /D (section.34.2) >> +>> endobj +3778 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 700.454 512.306 709.477] +/Subtype /Link +/A << /S /GoTo /D (section.34.3) >> +>> endobj +3779 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 686.905 512.306 695.928] +/Subtype /Link +/A << /S /GoTo /D (section.34.4) >> +>> endobj +3780 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 673.356 512.306 682.379] +/Subtype /Link +/A << /S /GoTo /D (section.34.5) >> +>> endobj +3781 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 648.897 512.306 658.466] +/Subtype /Link +/A << /S /GoTo /D (chapter.35) >> +>> endobj +3782 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 635.348 512.306 644.371] +/Subtype /Link +/A << /S /GoTo /D (section.35.1) >> +>> endobj +3783 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 621.799 512.306 630.822] +/Subtype /Link +/A << /S /GoTo /D (section.35.2) >> +>> endobj +3784 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 608.25 512.306 617.273] +/Subtype /Link +/A << /S /GoTo /D (section.35.3) >> +>> endobj +3785 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 594.701 512.306 603.724] +/Subtype /Link +/A << /S /GoTo /D (section.35.4) >> +>> endobj +3786 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 581.151 512.306 590.174] +/Subtype /Link +/A << /S /GoTo /D (section.35.5) >> +>> endobj +3787 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 567.602 512.306 576.625] +/Subtype /Link +/A << /S /GoTo /D (section.35.6) >> +>> endobj +3788 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [490.587 529.109 512.306 539.404] +/Subtype /Link +/A << /S /GoTo /D (part.6) >> +>> endobj +3789 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 504.651 512.306 514.219] +/Subtype /Link +/A << /S /GoTo /D (chapter.36) >> +>> endobj +3790 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 491.102 512.306 500.124] +/Subtype /Link +/A << /S /GoTo /D (section.36.1) >> +>> endobj +3791 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 477.552 512.306 486.575] +/Subtype /Link +/A << /S /GoTo /D (subsection.36.1.1) >> +>> endobj +3792 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 464.003 512.306 473.026] +/Subtype /Link +/A << /S /GoTo /D (subsection.36.1.2) >> +>> endobj +3793 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 450.454 512.306 459.477] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.36.1.2.1) >> +>> endobj +3794 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 436.905 512.306 445.928] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.36.1.2.2) >> +>> endobj +3795 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 423.356 512.306 432.378] +/Subtype /Link +/A << /S /GoTo /D (section.36.2) >> +>> endobj +3796 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 409.806 512.306 418.829] +/Subtype /Link +/A << /S /GoTo /D (section.36.3) >> +>> endobj +3797 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 396.257 512.306 405.28] +/Subtype /Link +/A << /S /GoTo /D (section.36.4) >> +>> endobj +3798 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 382.708 512.306 391.731] +/Subtype /Link +/A << /S /GoTo /D (subsection.36.4.1) >> +>> endobj +3799 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 369.159 512.306 378.182] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.36.4.1.1) >> +>> endobj +3800 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 355.61 512.306 364.632] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.36.4.1.2) >> +>> endobj +3801 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 342.06 512.306 351.083] +/Subtype /Link +/A << /S /GoTo /D (section.36.5) >> +>> endobj +3802 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 328.511 512.306 337.534] +/Subtype /Link +/A << /S /GoTo /D (subsection.36.5.1) >> +>> endobj +3803 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 314.962 512.306 323.985] +/Subtype /Link +/A << /S /GoTo /D (subsection.36.5.2) >> +>> endobj +3804 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 301.413 512.306 310.436] +/Subtype /Link +/A << /S /GoTo /D (section.36.6) >> +>> endobj +3805 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 276.955 512.306 286.523] +/Subtype /Link +/A << /S /GoTo /D (chapter.37) >> +>> endobj +3806 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 263.405 512.306 272.428] +/Subtype /Link +/A << /S /GoTo /D (section.37.1) >> +>> endobj +3807 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 249.856 512.306 258.879] +/Subtype /Link +/A << /S /GoTo /D (section.37.2) >> +>> endobj +3808 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 236.307 512.306 245.33] +/Subtype /Link +/A << /S /GoTo /D (section.37.3) >> +>> endobj +3809 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 222.758 512.306 231.781] +/Subtype /Link +/A << /S /GoTo /D (section.37.4) >> +>> endobj +3810 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 209.209 512.306 218.231] +/Subtype /Link +/A << /S /GoTo /D (section.37.5) >> +>> endobj +3811 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 195.659 512.306 204.682] +/Subtype /Link +/A << /S /GoTo /D (subsection.37.5.1) >> +>> endobj +3812 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 182.11 512.306 191.133] +/Subtype /Link +/A << /S /GoTo /D (section.37.6) >> +>> endobj +3813 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 168.561 512.306 177.584] +/Subtype /Link +/A << /S /GoTo /D (subsection.37.6.1) >> +>> endobj +3814 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 155.012 512.306 164.035] +/Subtype /Link +/A << /S /GoTo /D (subsection.37.6.2) >> +>> endobj +3815 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 130.553 512.306 140.122] +/Subtype /Link +/A << /S /GoTo /D (chapter.38) >> +>> endobj +3816 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 117.004 512.306 126.027] +/Subtype /Link +/A << /S /GoTo /D (section.38.1) >> +>> endobj +3817 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 103.455 512.306 112.478] +/Subtype /Link +/A << /S /GoTo /D (section.38.2) >> +>> endobj +3818 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 76.357 512.306 85.379] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.2.1) >> +>> endobj +3774 0 obj << +/D [3772 0 R /XYZ 85.039 786.531 null] +>> endobj +3771 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3821 0 obj << +/Length 2228 +/Filter /FlateDecode +>> +stream +xÚí›[“ÛÄ€ßý+ô†\…'s—æ‰*6BAÙ¥òØ;f?~ÁÃKÛvoïÁ…[+OÊ›=|K>‡/(.¸„Ǿ(‚èçÚ¹ã¦3¢¡ŒñAÑŒ±²íì'EØ‹[ÿDÕl¦´*¯õÕÓ™’U õë®Ttwö#÷Ê? ~H\A½¹,*N>‡¿[öâM^j‰ â´lU}j‚ àhr΂a ÚWójCÒ: 4qÈNã1^Î[k/_Z¦K2{{ó¾îV.ô¹ŽËÕïúYxd‹Ü®ÛfnŸÜém÷~¥cry6!µÚ›õʧùI<®.cñôb<±ŸÒx†¤ñäÔøRV ž:4 å¼|»Òë|¹³Þ¹Õ|:{mò| +–]{Ðlà­º,ÇþJþ7Ƶ"°ÞÃi¨ÇZÓ@SªB®a‚xÄ“¸Tûi·°èÖÍ~±‹òêêBß¼Öiðòµ}來fôF7¨ï]Îèdk7¶”ïW7]»kouñò°-¤­âXHA*Ã)r^Õ@}šVF§&ë +‘ž˜ï¤Ÿ/Ö ±CLB®-Ý5¯.;ž{#Ðõ fcPîî4ÆVósm¢áúN¿°Õ,—ü_éë|ÝG¢ŒÄÒ,üš„yÆ‚$ͬڀ³âˆ Úãô}Œ‚40Ýbº…Åðööíý¬Þ5¦-^›&ú/.Ä#¦øzŽE׋eÐÅ>¬T +ÝЂ4ºœÚ€NbTcÖ£ãE³<ôP%ðÐÙ×ޞ㨇s¸“R=òA§¯úXš½X†fìÖ4Í¡iš9µ&¯¼§)N{Â3=_ãZÓùâ¶9hÈ~ðiú¾= OªA#¬ØcBèê;a/–Aû2phAaNm@ÈàG¥Cx Nh%¦»sͤÞoô½™(˜‘«ègó?Œí•ö(U=Èóí¼2t/–{< zhAtN­ŸHŠaÔÊ3³Ï”xö™ª§0µ¡ÿâ„âáæ#Þ7cq÷bܱßÓ¸‡¤qçÔ†¼ÆÁ_›<åµ ^ ºË€>ò8NZSëóZ(†° "“×cìVòÝï«×G¿Öïèihí§¡ÜÈÔÇØ{c$àH, øØÓ)Àg,HΪ €+…®=`™üêÊ~Â|ˆ”ÅJ|í·wÑXê½X†ú‘û“Ô‡ ¨³š"Éxøêì惇>B ­*R‡¡ ”þ%c›/)^^6›ëF7õ$6ƒUwÛNaÝmš­Éx讦Š”‡íj»z”™êôÚ³Žd6Œs¶ž”hÝHRnìK¸†S‰hšß€‚"Eë{òŠ$¼ëˆËª‹6ôƒM·ÚµÛž‚ÈG“˜SÆ=c3Ê eò©w{: Nu§[дÂÀ™VH âISGú²5ã ·úª;{·Î áïW=ÁŸt竱Ø{± ø˜CýЂ4üœÚ€Ÿ@k‹©Çïw_Þ˜Q­Ý¿¢v5~õ¿ÅcÞ_yÀ(p.½X& +bé(ZŽ‚œÚ£Z0~öû}ãö¸ÿجöz¼¤žà;O…ß‹eàÇjš‚?´ ?§ÖÃçu…ðýé»ÖíTÛ= ;ãÕû>T×è—Ò °;&×køvÓ´<,âƒ@æ„ÉråOGÚ%‡n«œ‚?Ôò¸¯ðX†½X†aìÌ4ái†9µ!–ûõY`H,˶ëôé‚>}5‘k{ýbet©úÓH\硱Ð{± ôØûièC îY¯ó«ã¬&(Ú=»8îÞÑ–ql×ÆŸ¿Ò)ziWÇõ#sñüýôbªÏ©˜îÙòÐ5zÐ>üú°š/Ëå½9bµ> endobj +3823 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 741.102 512.306 750.125] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.2.2) >> +>> endobj +3824 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 727.553 512.306 736.575] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.2.3) >> +>> endobj +3825 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 714.003 512.306 723.026] +/Subtype /Link +/A << /S /GoTo /D (section.38.3) >> +>> endobj +3826 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 700.454 512.306 709.477] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.3.1) >> +>> endobj +3827 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 686.905 512.306 695.928] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.3.2) >> +>> endobj +3828 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 673.356 512.306 682.379] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.3.3) >> +>> endobj +3829 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 659.807 512.306 668.829] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.3.4) >> +>> endobj +3830 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 646.257 512.306 655.28] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.3.5) >> +>> endobj +3831 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 632.708 512.306 641.731] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.3.6) >> +>> endobj +3832 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 619.159 512.306 628.182] +/Subtype /Link +/A << /S /GoTo /D (section.38.4) >> +>> endobj +3833 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 605.61 512.306 614.633] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.4.1) >> +>> endobj +3834 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 592.061 512.306 601.083] +/Subtype /Link +/A << /S /GoTo /D (section.38.5) >> +>> endobj +3835 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 578.511 512.306 587.534] +/Subtype /Link +/A << /S /GoTo /D (section.38.6) >> +>> endobj +3836 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 554.053 512.306 563.621] +/Subtype /Link +/A << /S /GoTo /D (chapter.39) >> +>> endobj +3837 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 540.504 512.306 549.527] +/Subtype /Link +/A << /S /GoTo /D (section.39.1) >> +>> endobj +3838 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 526.955 512.306 535.978] +/Subtype /Link +/A << /S /GoTo /D (section.39.2) >> +>> endobj +3839 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 513.406 512.306 522.428] +/Subtype /Link +/A << /S /GoTo /D (section.39.3) >> +>> endobj +3840 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 499.856 512.306 508.879] +/Subtype /Link +/A << /S /GoTo /D (section.39.4) >> +>> endobj +3841 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 486.307 512.306 495.33] +/Subtype /Link +/A << /S /GoTo /D (section.39.5) >> +>> endobj +3842 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 472.758 512.306 481.781] +/Subtype /Link +/A << /S /GoTo /D (section.39.6) >> +>> endobj +3843 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 459.209 512.306 468.232] +/Subtype /Link +/A << /S /GoTo /D (section.39.7) >> +>> endobj +3844 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 445.66 512.306 454.682] +/Subtype /Link +/A << /S /GoTo /D (section.39.8) >> +>> endobj +3845 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 432.11 512.306 441.133] +/Subtype /Link +/A << /S /GoTo /D (section.39.9) >> +>> endobj +3846 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 418.561 512.306 427.584] +/Subtype /Link +/A << /S /GoTo /D (section.39.10) >> +>> endobj +3847 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 405.012 512.306 414.035] +/Subtype /Link +/A << /S /GoTo /D (section.39.11) >> +>> endobj +3848 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 380.554 512.306 390.122] +/Subtype /Link +/A << /S /GoTo /D (chapter.40) >> +>> endobj +3849 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 367.004 512.306 376.027] +/Subtype /Link +/A << /S /GoTo /D (section.40.1) >> +>> endobj +3850 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [492.314 342.546 512.306 352.114] +/Subtype /Link +/A << /S /GoTo /D (chapter.41) >> +>> endobj +3851 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 328.997 512.306 338.02] +/Subtype /Link +/A << /S /GoTo /D (section.41.1) >> +>> endobj +3852 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 315.448 512.306 324.471] +/Subtype /Link +/A << /S /GoTo /D (section.41.2) >> +>> endobj +3853 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [493.95 301.899 512.306 310.921] +/Subtype /Link +/A << /S /GoTo /D (section.41.3) >> +>> endobj +3822 0 obj << +/D [3820 0 R /XYZ 85.039 786.531 null] +>> endobj +3819 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3856 0 obj << +/Length 241 +/Filter /FlateDecode +>> +stream +xÚuP±N1 Ýï+<&CLÇN²"•ªL Ùà Z„T®R¹ÿ U‡28ò{ÏïÙ¾=‚,è¹@ÊŠÂÏ׆lZQ%Æö_Ýêg,1¯’'1¡dîœÛ:ÜÜÁ£*C=@È„œHPL‘ ¾<šËdFËÞœgëX“ÙY2hŸêý·:bÊ©«]*¨Í"ÌÄ_âí~²ŽÌþ<»VÍnúhê¹7[‹ÌqœßZ9õÆÔg›úzÉ5aÑ°¶–onPBù‹þ»< F¾ìNä±øÒÓ³WdQX8=}׉¤]¸_ï2èÚó7ö`œendstream +endobj +3855 0 obj << +/Type /Page +/Contents 3856 0 R +/Resources 3854 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3770 0 R +>> endobj +3857 0 obj << +/D [3855 0 R /XYZ 85.039 786.531 null] +>> endobj +6 0 obj << +/D [3855 0 R /XYZ 85.039 547.583 null] +>> endobj +3854 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3860 0 obj << +/Length 3458 +/Filter /FlateDecode +>> +stream +xÚ…ZëoãÈ ÿ¾EXù+z?®Š<6w.6Ù`íb¯è¨l+¶[rGãÍùîŸ/_3’c%‡b‰Ãáp8òGjý3þùgYìza~–f‰‡þÙbûÁ;[ÁÈO|áˆâУžÇftœ®¥ƒ<²Æ8 "7Ê"乞}¸¼ ¼³Às“$<›=ù~à†~p–乧éÙlù/ÇwGã8öœÉÈwj­FcßiFãÐs–û…®šž“ÔÑHKgŠãÅxçÅèß³¿ø4³:ˆ +Fø{ZöxHK?>ó=7÷ò#-a»Iœ–ÿ9Ÿ<ÆA:‡Q9Í_"gJ/KÕê¢^òø˺Ðo€©"*HÎ-êìY3£ý²ìÙ Rp9ydRÑò¯^—´çqÓ1íyOz”jƒ¬È¦1,¤ŠºÝ¡ùœF¡áwØ Ï΋f.ù9¸(iGÓž€¥ ÅõÛ¾Ò½£cýRóÌ07‡ a²=êh"XtŽ‚VüL¦ÕʬG6Öka¬äW“K£,ëüH^5?Ø3*ež–y#¾Ë¸æ¦Ä Ò“¡ømKg Œ¿1£Ñ¼fIÓÑk§Ø.]º¬û¹"›ìQLØÂÉu=·)YéfU‚“(~{©4r5{Í‚±þHûJ7Á‚ùy›»Ç +]2q@W¢?Ì.ÏóðO8 ýÔÞð¯Üóû—2Ês)£ V‡Pȼà¼@‰áÑ7KÒß—%“§4ìså’ÍÑ6~Ù+ô¦f^løU#DÀc@±¯CQLóPè‰$«ÓÀÞvh f¥Ší–cš$Œº8B¤ÄÉ… 4ªZQ¨+6¸E_¥dçfW&r‹ÙJ Ø·´®ü³QB´BY«Ò\£ûFîˆ!ägïfËa²›¹a”ôóF%nžå’Ý(¿E¹sMæ]ÀêÏ+ÕìÁcÞP!Š\?ÏßW¢ãy;}Ť¯0éâÂÂ\Ñ0'+4äÛ!œÁªFxÓùÄŽÈû‚w‰Ï‰ÓLÁ²ÿýw64:ˆZò€*ŸJ¥zñ ‰”½ÃÌ +¹½ùtùÃ7Åq—gk“…€ƒãÇOEgx¸­LภV8<'ϵÊısÓlw{mï6P>QHþŽ$ÕÔÛ’SÛåWšµmèšÇ å%9A‚Œ¡€vSƒµLáK,ššç`jÑ{prø=0SwpÆÀNV¯Œ€8¡²·£ÀìÄ΄PCO\bÚA#¬ªšÕ:0‹ |¥2 +H7× Ÿ¯$om6Íåϼ¨‘úpsÅL¾ëñï^ì=”š# ¥;ttƒ›ïõÐI™ÔŽK\©.të’,¡*a _Ô ‚ÏMm÷“ÓRæÅ>S'éÜ>Ž²]y¾­»ÄGÃ'þÿÊ 1ú?Á´ÒægœÖtëïëxSƒ`NÑ668yRÞ¼œ„á/ßµý†÷”¹‰‰8gÑYºÐÕ\ðŽPžƒ pi>ÝØ”(RC×»@J×)$•!A•Ë²5©zU—Kšùp«Ø$®íMÃ¥À,½ý1›­ñ²ø¡óe„Š’÷!Œðç'ÊûÆ"ßÜH€E»¨$9³ì›ÁÖVd>ל†SçEdÒµ‚‘[l>!hüúxãòø}µPMÛ×Ïs‰°d#\ß®?ÓúÏâ$˜dL ÷€ò®gÛÒ% +’]Íðù†{œc9äÑ áyàìw=C=\»j9Úaý²P-³ìŠ–#-e?Àô /H5Ö¥$rЂŠ‹M;E%co±Ïy)a[ŠÂ˜?©"¸ÃID.¸7†Ã|1Xm˜b÷BŠå÷!Ñ^Ð ‡û{[)ÁY㟛¶—ÀS@)çüô‡û>–¾1ðYPîI¨t—»ž¸zäá’Öö!¢·GïõvðrŒT³‚Jjbê¹j™¥Éë·t3¥ÜíŽbm×Ô¥»3ÂKÐPtaA¢ZDM-‰ŸEuÜ·zÞ(íÐÕY¨ ­AŒÚ=×õÔ909”ïMµU}{Ì3EpÍ´B 3]åÆúu/|Ÿ“7É>¨|S&J[öÍ@ßÏT‚•Þ¼Æf`2çä]ãÇ¥ÙÒmÄ÷Iͱ *¯ÒU)F¿Ã“-ðº!Ût¡ö¤‡ùQ‘Ë»$éå-Øò;À˜*Æq˜pµñmUÌšÖIÅ[`ˆ‚ã V·Ä´ ’¨Ò.ØKc°ëê{‰¨)„Â…¥×KŒ1!µ¦¡¤Ú‘þ–Êp~Ew#ˆU7­(M%ÇÃÄl΃¡Þ2pËâH³ ±ö´¦ÅvNKòk«÷˜û„KˆOå ?ÜOù`ÈãI5¦“…¿ËU9fAm)§oÚ4Šl¿ðDñ¼ò7ÍæXh'+|6áNtv<Çñip¨ U±a!‚µmnätñLw0ÂïÉð"áÛºø.m”¹µ<@Y‚×mM°PÒ¸dÅ%î¢ÿòK¯ºÃÓ<0Ò¹¶ÔÕiE¥ÔÙU#ã[$«u]Šf㘿­+¾ÚC0^“¡ñ£Û²¢6&bpAƒè^)vûÊwzx)üÀ®Å«ƒ„¡UY—r8-"p1ÚÕƱýÚñb‹eFþDlìþ8Öð¬Zv,.èõ¹< ábØÀÚÖ£(€6^ÊZëò`žªúdüí6§Ÿ.”fï¶9{Ÿß4 ç÷€{¸5-~ÃÇï$è:êœK3çJ5ümœ'dKu¡RÓ­;ô¡þÚŽdJªjðFø•kQ-©[MÝúÒOÆ«ƒ(é:³½O¨½Ö²tý<— ÛŠ¼.õ9óJ1ô±7 ¹“Ћ&$PCJznE½*—C ï#¸NøŠðã7=3‹Ü8ŒßwÌŽçm¿ž?qË÷V¯|½ØSö»­l«cA•¦Ô6à§qå7&û0°^Ûï‘ ‰¤·Be›8€‘¢ûË£ÿ›àw`ìÇz—ÿ´P-ìÄÜ9¶ÿ‰W5õÝI˜¢îR/v¦À2-Ow@¼}˜Ê­3WŽ¾óo-` åÃsÛl( W¦©lÛJ—Åò¸„ü6y˜šºn ¥…±…GíÍDÛ±žeè%n'Fn=_/‡œwøΚÿµÍ‘endstream +endobj +3859 0 obj << +/Type /Page +/Contents 3860 0 R +/Resources 3858 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3770 0 R +>> endobj +3861 0 obj << +/D [3859 0 R /XYZ 85.039 786.531 null] +>> endobj +3862 0 obj << +/D [3859 0 R /XYZ 85.039 766.606 null] +>> endobj +10 0 obj << +/D [3859 0 R /XYZ 85.039 766.606 null] +>> endobj +2947 0 obj << +/D [3859 0 R /XYZ 85.039 676.205 null] +>> endobj +14 0 obj << +/D [3859 0 R /XYZ 85.039 562.8 null] +>> endobj +3863 0 obj << +/D [3859 0 R /XYZ 85.039 533.396 null] +>> endobj +18 0 obj << +/D [3859 0 R /XYZ 85.039 192.444 null] +>> endobj +3864 0 obj << +/D [3859 0 R /XYZ 85.039 163.04 null] +>> endobj +3858 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3867 0 obj << +/Length 4019 +/Filter /FlateDecode +>> +stream +xÚ¥ÛRÛHö¯pñ²¢*I­kòHØef l0“‡™y¶l+È‘d;?¿çÖ-É–MÕnQ”ûrÔçtŸûév'ü¹“8°•L¢8´åNfë#g²„™¹q* §=˜óéÑÙeèO\ÇNœd2]˜uÇ’p2ÿa]üëãíôóדS¥”åÚ'§Q[W7Ó¯'^l}ùt1½:9u­/'®uƒ@¾5ýÂÀw¯aðg?žü5ýåèóÔÓ#ØU +‰ùqôÇ_Îd„ÿräØ*‰'/Ðvl7I&ë#?Pvà+éGwGÿ6kñœ?á¯Æöî{¡íEÐPŽÇþ(Œëz¶r=8  °C?2äöÈõb;ŒÂ‰ÂúÓq£íý¹Ê‡Mzkí"d]|AŸJì ø®n/ÞŸœz!묮JäÃ+ôǾ›¬%Ÿtõåvû%KJ +ÁF *òcMæøfLpæmP‚ϾÐwx=DùÚ0_×dfÁO5 ò†¡D´±YV-/šŽ¨ÍÜ +Ç«â6Bú¼eëž“•W,¬Þ¶%wIWqb¯%ï4³Rp7^°äh'?.¶¦x[䑲h\PW\Ðù +—ËÅí²iÓ’ô¦F¢}8üPK®°›0/ةȨ-óÄÏšGçÚ +<#lVTOZãH½pQã7¡MÍù5wØÁRû-sï‘GÈÀ¯›Ä +7æ†ÀÎX‘«…a>žt¹<²5Òp¬c»’F +„WKDÄ5{ÈÛwH/°¢å fNÉ!ÁÝ>Éb•^¹W>2±ÚŒâq‰JÉã"OtÒySÉð+I:Šp½·ÈâÍ®Å;GÝ¿á[ãO@tcwÆÚÕÖUÑð +nÛ›sqîG.£àYd‰&›jdòk°¾[sdQT±Ú´L1O­ÈöÍYtjÁÿ÷‡^VbRÆ°g:àã; ¶¶„#ÄKlìßÎ.°r†ñ–V÷6‚“ƒSÇ={!|äÁŒ†ä7F6ñœ£Çp”æø{Ü" +0x‹Ë”ÐÐ)×é?Ô¿)ÿ<œ°Pb›hwØ4àoFr¯í*–<ñ  "®×ò˜qCÕ¦˜óÐJÓ(¢àD X¥[HMçùMwìu+æ‹–­NxÖ7”·´eÚ (k¾f{PÕ`j˜Q4Š„¿ %e,µý•Ä5°àÓÒÂÓ˜½µÀ×¼T‡M~"öߥpØÅw&ŸX[÷%GÏ-iˆlµ¬Õ³€%¯ÖBÜÄà)•9 ¯<Žl­sü¾È»!ôÆnVH +†hÊhs"çhQwwFG‘NBDر`ü)yŒA†g)O ÷€ûfgÝp³ÈiCÃO?ß_ñÀKNlªHW"æ s8ÛÅsY—a—+¢ñîaëTAáÚEÁ!Õ,Ý4½•õƒúY§½¾†›“’?´-ã©.Z•dò½ûªÜ™*¶ãðp`ÖÁìËæ°ì6‰Ê¶‘e=dÚ°~†mÞ_aLæû½ìvÍ&óµ%ƒÁã~)Q™Ò9_1p»ê‘Óÿ!$4ù<³G¶v_Î;HwpÖaÒå[¶Øb¢¡!)WÏßë<gÉ™d³ü‰‚“]â,&×çøˆÕµwîÙîZÐ ÖUV<Ä`„v-î&7V™¸‘†v§ÔÉõoÿ¼/‚ʸAG“®3V«Tà†ö%@Û9ß3d€‹å +PñlTKõ"6B0«j™àÈtÄ‘P€ÏM0ñ¡#a+x&u ÓÀSdY˜cAÂÅ#"¾ ™S¦€r÷Ê u¶Èêš,ôˆzøÕ9¶¯sLƒªE+ÈrÇ7ç—ÇïÆ4‡ööŤyršßˆïsæ±>ËéðL™tøúýxWæÊ4s‡ÑÎÉ{‹°p’ I©æ®6•1$ “Ù”ŒÑ¨œ‘-ˆ£kv|ºiW8OéÔöWä|åØ~v[= ý~K½á¸"ϵƒoÌuõñÝœc±$ qßX!ÁÖ™ôÚÇÛy„G £Ñ ›^Ü0&ì ãx,YfJîRê‹'œW¢þ‘rà +¥þ¥áEÛ± +•ÎaØHl4#I…‹c›ÀáÈ~wÒ Ûö 4¨U>²~¢®õÉrØ2vnøìê%Þæñ /˜òOÍ™Z`j¬›¨]i-Áp5\zàŒÏs¤ ¦ÌÛ ÀN¿47¯©ZîZæûë©QLÂSô½Ö‹‘ôBæF­Îc' +ݵ!Ú¥=û±É¹ŠZdÆGbŸbgëÜhŠ«í˜fˆKCƒˆR5(6Á·úW;ê`US‡÷Ð¥ Óªd4õ­O6œLsuk±qØ&u’ÁXüôT)=ƒƒ‡ëp¡Õw"JÙròÑšB>I˜J‚³$>»þ,U%™Vzå•Ú:%WŽ)¨±ö]gºEñ ‚®jýqÆ3ú ñûF4=HÜ·‚BØ?°ý†½%,p×1žó™ c^@Çù@!К@$€ïŸ©bÀíûO·Üè2Hêº*zÇ‹¡˜Û8¡àSÚ¦æ~dHȳ©óØ„aˆM*ôË:]3u^âwõvhu^â ΋§\S¼éšÈÀKÔPwpÀÖôR™Êj>2\npd¹ÌâB¥><ü +ƒ„]æ€YEÙŒÇ]´í'§¡“Ù¤¡ràoa@ OUlDšp8â2#ÈË! +4¾]ÝÜItïd R0ˆ¬²•é|Ƶ䶋%Øð€º¹CÙî±ùÎÐ‰àˆ¶ ôÒ‰ƒs 6k«ê„H–'ÕÀ¯—¸Öw\Çq¹…¸Ø.Z8ÐüÝ%œQŒ õç¦ËxÙº@ࣻfÇñ8@tŸ²6¥‚Dw%¢º+Åœî©ÄDëî 9@~ì$ +‡= ý!‡z#ä8ˆPBŽ|c!Gß7ï×÷|Û7Àx\‹J®ƒ†“Cœ÷Ça€[ +Yw&é +@éE†v«ç°÷pìÚ¾÷Ö w@NX€Þ:áCõ oã=á¾oêÿ+×T~©C%6¬§b‡\”r,®©¶­NNq“Àw\Å^§ºt‚fCÁ†’ÐF‰Å¤¢ScbÕ¼ËÆ{”÷aã.¥‹¡‡”»×¬‰¹Fþ[Þ´²/>Ô-7’²UÂð%/L–Å•ÜS#ߎ0”8 +ä©NÔKøÚç¯@ŸöÀG¼µ&Òµ¢†êèïÏÎ^^^ô…·ä¸¼_›ÜØr›H¤íćDn‰ž†9LÚöJrd»LÌxʳ÷> endobj +3869 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [173.74 248.031 284.915 260.933] +/Subtype/Link/A<> +>> endobj +3868 0 obj << +/D [3866 0 R /XYZ 85.039 786.531 null] +>> endobj +22 0 obj << +/D [3866 0 R /XYZ 85.039 232.98 null] +>> endobj +3870 0 obj << +/D [3866 0 R /XYZ 85.039 204.182 null] +>> endobj +3865 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3873 0 obj << +/Length 3971 +/Filter /FlateDecode +>> +stream +xÚ¥ZëoÛ8ÿž¿Âˆ Ôª$êÙý”f»wY4i¯É¢8ì.°Š­ØjdÉ+ÉMr÷Ïß¼HѶœÜA`>†äp8œùÍPþă?’F®§²I’Æn¤üÉ|}âM–Ðó×_(fB2³hÞßž¼ý)'¾çf^6¹½7ódžeñävñ«sñ·óÏ·¾LgJ)Çw§³$IËëÛ/Ó u>ýøËÅíåtæ;Ÿ¦¾sD¡sû‰‰oί ñ=öžO¿ýùäíaÇbØW +™ùóä×ß½ÉÿùÄsU–N¡ì¹~–MÖ'a¤Ü(TR¯NnNþnæâ¾p£Æö©ÔRu¸y?²6ï« ¨¢IEn&´ûß3Þ­ªTû´ö„÷ì+¯zGÒZp›H«îHäeOâZ¡¸˜@sºl5›.-:ócWMÀ_¸6´ôù2'ÝÙ Å}œu(…Û MiÚ>ç)±=pú†ë¦/˜’„•ëî«ŠôåíÔ”aƪX“TyB-7YÕo NC„÷³Ôô3 èæBGÅ*úÜõTX‹lgríI‘%à vVùp,Ø’Ò­‚ÃÖXÁ~qø»_ñŠK9ØZ¨òN~y‹'¬æ8ß‚)6-ŸH[:sù4+¤fØ¥E€åcdß^\þtÃóªÔºÄÇjoWêvUÐeOÐœH6Iw;aƒÎö©¨¹åWݶú^È 2ÿ?M±Ÿ†µ¹Ži­­Pµ£èZõH@»"/ËȪ*œuü |í»0 Ü,‰'qâƒÆ*6üØÑ.…â‹å4õÌ"?tûs¢œ¾‘XIiTâ¹1]ŽAŒtp `¢¾ik0ï÷™õÃ&Î&q”¸©Žz)M3³ˆF¼T˜¹1´h"äáqUj¡áÝ–@¾£R-ðª¡c}cÇ ­Wï¹Í>-ìã{ë4Õ•ÆG­‰eßµ1 ôû³ÜØîqó1xÖ +_Ä% m:€ÞÐUaL›öWùÁ$”†mÚwC@#p pp3`µ¯Š~…÷nUS5ËçcìpŒQð2;ÍÈ;Q–¹žÜ¦)Øœ6'‡fìsõIø@}XÉ×9ÁeHI|Ã/šb!h¶Úãb½¹:|X(&[ÈË¢.jèÉî cù›Á•²BcÏÚˆ:43+üçH°­*F¶kw>¦0t.Ål1?Õ±ˆr7Ñ"î«ñFæ½$R3A—à+ÖÌY +þ"®Ä¢’¼`·ýõFÏÍZïtÇÄ+—Á;Ç} +‚™/ÅŸÛ¢ëO¹†ç¢“3J|  px€øôÜ¥¹ë@vs оÃ0E¼Ê=:„øçÀ¾¯%r¤ûW`¢¼ÌÙñdÐirå{ J·B§M2vøq/F×Ä¢y ØÞOèñž<ï$O„;˜C;ÒÂvà@‹€ò¡J G` Žlã!ì¨@Ø¡ˆ‰cú¾uôžï˜*†1à8ãUÑ":®ŠšèU|qAQŃõÆTÑ^ïÔê0™.›¾Ì{R‹ØùÜ6ýT‡ë|éQ¡N™xÆD‹¤µ6~C†Šn&${˜¦!C çਛy%D†5ü;äEÐDàqNÌÞIÄ—¬ª‘÷ünʦJ—ïY»ÅL÷ÝÈòãÏÐ|Á×埧dÍ ýgùLqDük®û®Ç4“M[h0È­3þ“JŽŠU1„¢•ô꼇 äÕ7¸¨BI)¶ˆ'óüºäÔ¹*çmÓ5÷/—Uv@H¨ãaÀ¯âÒÀ0Ö>ãlÛŽ9džÿÏœkJÎð&*!Ùu <X™0ö#ATR**±Xæòãù5W®¨/_û‘ІDÜ [MøB¬]˜-TUQ/‹·_¸W2‡ÂL~¾P¥Du&CøBv à.ld׋{À­%Ö rE.v€Ü§±¸¾pŸ²²ÀÏp:n¸X±]7`ŽûÌ$¹Ü7äÿûÐ^ß²±üx%Ñõƒ!vØ‹ tN,¤=@»uPûoNÈ7`¢Š\€Ç1­’ ~×M´EtÜDk¢WLô‹ Š‰>XoÌDÛë …”h8¸²À¹éó¶GUè‘vÆ áœ$+ùÒ/xgxC¡¨çí3ÚhŽ#2>WBcP®›^Î*ùœÍ7Íc€ÌAF8HÃÂý˜^iƒ›eXÐp³ÁBìLùÚD.ö¢ƒ%¡s½­*¦ÑÉ؆«æ*Ìu\ü¼±0)^F%7ßÜr÷Œ=žúaÖš—ýÏgÝ?°f&³ŒÄG’ e·À®n©ö=8ªÅ +t0Ž_Ñâè-¢×´ø¥µï¯7ªÅÖz&YÇ’Ú) +®]4u=äùÞ±¯8 h8âlüæ<¶[™D7Ô$s˜"A*è©K)ê=¡!œW€#´X ÉÎ>¸äY‰ Cíg¡Ã¹#冠 2õÈÌ‘ÕOp@4*HS”ÇL²£ Rj79 +ÒèYoèÚFåüs˜r2rÀ&þÇ&Ž‹R¡‘—t|ç/Ü`íM‚ïM9ä®É"}Ø@pÚ锄xhÓ&g)BÙüOùºdಙÀÐ1ƒG†Ÿ 1¥JCPbC Še·;kß>sG³=ȇ^äfÜ,/u£${-Ñ-Ô3‹|$ѽ7'é|(HC Lé£Ú£(,‡3áùæ+Ý j)7öGâ„2÷/l×?Q“ Ã$ëø…’Ù@3rawçÁE1œÄÎ%j[’âÓØŽÅ³s[¬zOdæbä‘6±¿]®t]PÊëfŽ¹@~Ý´` +Q^Oø½'{›I’GS’aè¹Þž åµjÃú|‡I¶gÉNõÅæXš=ˆ8ÔÓÚÉñ${&®/—ïF’dÿ°¡La³ÜÇ–a*?{yýæxZ=7‰Øÿñ•Ÿ IùàÔî6Ô‹áÎËKÌg¦ylíð¡VÊÈ~EL(‘×ä˜K|6 Œ+:h™”_p9¯µ9Ò>7OÝŸë㊞F°oU'>d8Þ¤ÞÁWÆê0(Pø +‰¯*¡à]£>ûAvtk ÷¶4ÇH)/Šä +a•Â^,luŠÞS´÷ÃgL7䳉p7 ùú(vø%Ÿé9 J“ifk}R‡r(û³©¼‰Dô–¶íè!„ò½øÈn½1¨ˆŸ–CgmLÌóŠçúÙº%j­¹f%—›¼ÆâŠÃ…¶ £ú=¿¤„•añ{@sÏßo§õ‚ŸŸW2i¿ÅÑ¡î{… +>›§îaÔ>…ßýMFiÇTæÑ3ÜßHl8bA×àLjµ¶‡X[Ù•RH¬Œ,^r‚çøèQ ?ò}ç+–›¶ÓÏ:È@½{·ŽœöBC!¶ÎqfåÙê¥Ä³rgfQèôðÊÆøÚÔ+“A3ýÊþĵ;¼K!¹$8ÏIëÍ*gB2¼?ã蜣…ô— zµ'@›¹@sÈP‚ƒ‘§hâ3ÃÒ‘JþÀ-9ÿ¬«-iu»óØ ð@m¥˜5±T˜òÒÏøBNQ˜Š´AÄE‰;¼9D°šŽu½ÝQò‘[ÛÕg‘$ƒáÌ=i)ãèÏ÷ŸÈ2þ$âÉä}3þŒeKç•ñÔ³vˆÈöµR¯§e¼p|&Ï×`ág6x*J**§¹9è÷>á—tAIw6t|–çò•€ÝÞv ï¨H®œ²ÙÚé ³mŸ™šLf>|·“Ê—A™³,úÝ1 +âo:>±ÏÀþ]on5™¯ ñª!±_´À®³Éa\»ÿmª’¸¤=•®*óä`'´êâqx¾dÃD©›VU¢#;¤gYsöej"»¹q¸¥IhY)K@áØ–×d~z|Î^ûŽ¾1RI¦¿É"ŸKdPJ(0´XáµÒW®µ?Ãü®v;ñC²o’ÌŠ¡Â:¶5t\°a[=|ßøæ¨3”ˆÔq… ¢hËQè0N.Ú®ÏkÉ¥!}‰ßbƒ+|eVÛ´á¬_>œüˆ>ÿL¨}m!ÓoË‘'_”áXy}$tP‘ªÑˆþY$ÿ×'Â&þS7K|Õ‰'¡fÏ ˆöÖŸrüo+œÚ!endstream +endobj +3872 0 obj << +/Type /Page +/Contents 3873 0 R +/Resources 3871 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3881 0 R +/Annots [ 3875 0 R 3876 0 R 3878 0 R 3879 0 R ] +>> endobj +3875 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [481.98 668.246 512.306 679.935] +/Subtype/Link/A<> +>> endobj +3876 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 654.697 146.975 666.386] +/Subtype/Link/A<> +>> endobj +3878 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [404.926 305.462 512.306 317.151] +/Subtype/Link/A<> +>> endobj +3879 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 291.306 153.369 304.208] +/Subtype/Link/A<> +>> endobj +3874 0 obj << +/D [3872 0 R /XYZ 85.039 786.531 null] +>> endobj +26 0 obj << +/D [3872 0 R /XYZ 85.039 639.254 null] +>> endobj +3877 0 obj << +/D [3872 0 R /XYZ 85.039 609.849 null] +>> endobj +30 0 obj << +/D [3872 0 R /XYZ 85.039 262.92 null] +>> endobj +3880 0 obj << +/D [3872 0 R /XYZ 85.039 233.516 null] +>> endobj +3871 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3884 0 obj << +/Length 1474 +/Filter /FlateDecode +>> +stream +xÚ¥WYsÛ6~ׯÐäÅÐLD“Ͼtr7™ÄNc¥N’™R"-!¡…€¬¨ýóÝ d[ÎKÇc Ø]ìña(‡ð‹4e9΋,He4^¬Gáx œW£ÈILÈôHæéltþ2KÆQ”a9ž]zÊ0HËl<«?‰g¿=y?{ña2•RŠ(˜Ló¼¯/f&q!.Ÿ|6{=™Fâr‰ JÄì’…¯ž¼âSä>™|™½½˜ î9I‰Î|}úŽkpüÍ( dYŒw°ƒ¨,ÇëQ’Ê M¤Û·£«Ñïƒ.æ%c>u*öTAZÈûÁGéQðQ2ŠÇyšY’Sô»UÓM¦q »‚` f‹³¾arßTm»çµžOâRÜ(½5ŸÃ4z Ô,ƉMWã"‚cUmÕZ>­Ì}k3ûI!`ŸD‰økR$BoY`Qug–UÚµ‘¼×è8sø*D³@V55x'€Ï4BøJ +wÛ·nz8PFbÑô¶R +:­€Ý/¶k¶R¡4ÑÑMò.秌ƒý‰ XíP8à'k•ˆ-^­ólÉD4å–•“‡ +ð8)w]úØÂß3,T0æ°À{LD”®:¾/Vc›þF5;”¢âC4ž/qzϘû®ZVÿRÍ‘î+¿ß¸v’0‰‹»ð$i„ùmtî c™Ç0ûÊÙÏ+Y\Y)Øbà&L²ãyÁwQÄ[dÔ…Kh k¼i±«Žœ‡ÁóÀCÄëø©3™‡iQÅœ<³•2ÜhA«ŠÀó}éžÿŒ¼Ûà€Ü÷j¹¢I‰¬XÄa(Yèy…Wy£jÞ¾mXkǧ˜¾-Gõ”`cbyìTîH­€kbøtÁ§ ¬÷‡¦§Öþ@I7=Q-FÑ°IX"–}å°fÕ|/Ž"ÆĦY‘ÓDP0Uv¾­mX¦ã9.xB‘‡ñ¡®ý¤Ý+o¶fx©4lžÉ‡ç ‹“ú”ú)G¹6LÂýèüh–¡¯.>â"/Ñù¾!r,žìr‹$ÛxŒ ˆ¼UÃèéÌPba!þÀa7€M»C¤u̧ …0òM”‰me)&XòèÍprƒdÞ*³¢‘9cþp|q,]X"ÆâJ_SõCÑS¦êƒ¤5=jêÉ`S(ÌáåO·®›(øÃoº\´j1Œfsd•ÞÅàgõ$ÍD¥ZžŒÎYÌp”¤7ƒµXe¿œŸïv;ßÚ—ÜKêžËóû–èóüš^ŒðØ6x SÈ4HøËÝFÿ æÿú53´›¤ʇºMçA–'Þ¼½8»ë°ÿÕsßãÿ~-gªendstream +endobj +3883 0 obj << +/Type /Page +/Contents 3884 0 R +/Resources 3882 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3881 0 R +/Annots [ 3886 0 R ] +>> endobj +3886 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [131.316 644.136 458.066 655.826] +/Subtype/Link/A<> +>> endobj +3885 0 obj << +/D [3883 0 R /XYZ 85.039 786.531 null] +>> endobj +34 0 obj << +/D [3883 0 R /XYZ 85.039 628.693 null] +>> endobj +3887 0 obj << +/D [3883 0 R /XYZ 85.039 602.079 null] +>> endobj +3882 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3890 0 obj << +/Length 2666 +/Filter /FlateDecode +>> +stream +xÚ•YYÛF~÷¯Ðæ%0â°^ ìƒÄYoÖë 3y?P¥!†’ÊdþýÖÕMR— 0lv—ª«»ª¾:¨fü©Y‡‘Égi–„±Q³ÕîM4ÛÂÊOo”PØØ„±µ0¾°¸p«‹D‡‘M/ÒÈ‹TÛÐfiÞ=¾¹¯£™ŽÂ$1³ÇÍL)¥gIž‡qšÎןÎqÿnæF/ó…IÒ Ÿ/TÐà8 >컾¨ç*¨y­Ø¯yáqž« ìzž~xûñÝÛù—Çÿ¼ùñÑ‹%R¹ý.ÍÚ„&Õ7O•¤I¨£x|*eCc“É©â,ÔÀˆO¥ð\6>áQ–}QÁ ö8¦Ávr–4ð« à¸õ˜ª+vð¶,®.ŽáÊÍí 4tÏTæQ>9€1aÎò¿«öE ›¾ÎV›àÃb5×ið<“ Ø–,+,ê Ùð³Ã9Ug(+MmÉ ª=pX!A}„Ѻ\3Ì3a½kP“H[ì‘Å+/ü(tÿ’½Z~þ¶¯df ì*Úº‡Q[-‘_5¸aˆ7†*VhÀ9ìñ©D¡Œ±Ðë®áQ×ìÍÃɧÇî„%ü“檺XÖ#>ý©– ZJjf øIÅýp¡Ý +ů#…9êňü\c§<ñ`ýÓ Å‰*ð OÍ®< âNijÀJ*LÄ;¡¹-Ô)'Š5°Ð9P©‰>€Õh‹z!›#¾¤Á¾$ÃZó*´Áa¬šÝ¡’kÆwt P )7¨zÔ¾Ðá4ƒ–,®¼ƒù$H‘rIhŒ°ï³lôtv-&É,ᆣ$Ì4¡/Öx0ÑšP/Fä´v¯¡8Hvú_}ÉáôÄ%QÑ”×hïxE|Šé{ZmOE#À¡l,ù™B…䶸'|Fê4+qÎúŒ½:©_žÄOà&øqQ·e±~å劽vYó¬Wíÿ]ž¨§;Èl3º't碯6µØÁk×—;fô‚l‹Ž_è¾Ë2Þ/#Ç‘†Ž*×1¶Ü— +\ LZ{Qq_”6ŠÐ”ö¼86„)‚”Bp WqϦ—ñ`õ@Ú7<»„G†4*Èâ¹akòvÄ=|¹`~ õGþMɃ¦÷n Œñƒ‘ +î.`æ T’;Í Ž°{^î~¢žeæ©êx4‘³å9Aû§/<·id‘To»‚æ TÈÅγ8d;X£þám+88RPx%|Æ6 eo†ÏÍõø¹U˜E.þk‰ÿ?4û?"e·h°ÓàïÃ:½ýÅQGáªÙƒ­§ ΩkRkpNß–z ¹ôã( -ûðƒ‹ß³Chm8fS0åS Ûˆ2´ ²®oZŒéZb:>ÅÈ@þû÷f²5dS8Œh×n''&ÂiDù­:ÜßcBºµ°EÑófGçÃ8PyåéÖý «Ö¥È +ò] ²À4Ëd¯û²_݃~–Å=Š'¨âäfŠW×I˜èD˜5í¥ýLháÚe»c×Þ×ͪ¨eÓºZÞ߸•$a”¹ DG‡tø÷yfØImÄj+öüR:Ëë HŒ…;YWâ>§+¾=c5]³€ ®y´•ë-ë 3åSAh‡ð ’q(X€`÷üt©ñ%÷ýXxQùœ­L Õ ¼\¡r×8ÍÔ Pb[ãëÙjBZqž­Qh1Jò/Ý3.S€)Vò6°¸« +Ùbž+_Xòk©vž‡‘¶"\ ”¼œÌ¦Qh=¹·MU——“Ùاªh ãNӺ܆'é+kIÚž¥²Ã슻Þy‡Š+OoåÇ—òbQÖ‹ª\ÿ)3a–f“Ó¾ŸgVš 9×çïF¾òœ»ÚÝgÔÆ8©Aµ(´\[8–ÔÇ8[öئÃÆm7Ä£(øŒcçª_FÌÈsZiœ@*:á½-7¥cÖ|2P#¾ýUúò¬i¤À  ƒÒ@Ý|­ßå¨#ò iÛ Or{º"WƒöF%ú©PÚ&”÷v9K ÍmQN9ùfÖ…tU#§övº:¢ñùôYºªLÏtšO»ïÓ¯¯øñƒ›ZðæòV×()ù›Ç‹/åØBh²/ý—ƒ÷™€Y»»v<[~»\Ñ\ÏÆÄÿTNRûï)º*íì-}Ép¡—F¡c„´R:Ø·Qæ¢J.•\]I±*_".ÇL¤ z‚!î?SßÐgˆ#ltž·UÑ’œÍúƒ’P¾tÄ›œ2¦±/R†Û@e»£Î\Ê-S…­°®?àOé­¥„¢ã—O? ‰ýøc',HÊ3uÕõŽ¸äAÝ“ê¨ÎC~'‘~(‚ÜKX¹&Rƒåñ†»TÒØ= í.//ÛÖa½À['_ŽÂoÝÆœ„n,š%d —“ØáüÙ5}ÏQLí4ûï|ôÏjåJ:\¨‡óï`v>q,–.ƒ—”°Ü}"jšZ¹jIq·ß^*çÞÖÜ k–½ù8"¹TwΞø«Ò¶¨¤ýùâBƒ7cÆ Zß ¦üòRN UFÉ·$41¸ó‹\¨Û­™||¼Š*é…o#tœ8v™éÙ— pè837öü?Ýüe)endstream +endobj +3889 0 obj << +/Type /Page +/Contents 3890 0 R +/Resources 3888 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3881 0 R +/Annots [ 3893 0 R 3894 0 R 3897 0 R ] +>> endobj +3893 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [313.377 617.253 415.127 628.943] +/Subtype/Link/A<> +>> endobj +3894 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [367.537 603.704 509.276 615.394] +/Subtype /Link +/A << /S /GoTo /D (compiling) >> +>> endobj +3897 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [169.225 164.014 247.309 175.704] +/Subtype /Link +/A << /S /GoTo /D (securing-samba) >> +>> endobj +3891 0 obj << +/D [3889 0 R /XYZ 85.039 786.531 null] +>> endobj +38 0 obj << +/D [3889 0 R /XYZ 85.039 766.606 null] +>> endobj +2948 0 obj << +/D [3889 0 R /XYZ 85.039 676.205 null] +>> endobj +42 0 obj << +/D [3889 0 R /XYZ 85.039 676.205 null] +>> endobj +3892 0 obj << +/D [3889 0 R /XYZ 85.039 644.68 null] +>> endobj +46 0 obj << +/D [3889 0 R /XYZ 85.039 547.614 null] +>> endobj +3895 0 obj << +/D [3889 0 R /XYZ 85.039 517.412 null] +>> endobj +50 0 obj << +/D [3889 0 R /XYZ 85.039 449.416 null] +>> endobj +3896 0 obj << +/D [3889 0 R /XYZ 85.039 428.219 null] +>> endobj +54 0 obj << +/D [3889 0 R /XYZ 85.039 149.745 null] +>> endobj +3898 0 obj << +/D [3889 0 R /XYZ 85.039 129.151 null] +>> endobj +3888 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3901 0 obj << +/Length 3087 +/Filter /FlateDecode +>> +stream +xÚÝ]“Û¶ñý~…Ú 5cñü@Úqê¤qƱÜun:Ix%±¦H…¤|ö¿ï~‘%ê’™æ¡íd‹Åb±»Ø/œZðŸZ¤‘h»HÒØ´Z¬7Áb3¿Q‚±”•ƒóÕýÍí7±Y¨À·]Üo:6ð#/î7?yûöåûû¯\®´Ö^è/WI’zß¾[†©÷ÀÀûwüûúíÝý2ÕÞË7oðòí+ÁX®”÷õRy€@€»—ßÃ×W~¹üåþ»›¯ïN³(­‘Ï_o~ú%XlàLßݾ¶éâ Ư¬]nL¤ýÈhù.oîn~hñœYðª9±ô+e}FÏ‹.Žý8ˆÑ…0«|E(:¥B_«p‘D‘›„dú 0ER‹¢À»{XÚlHäÊ©eõ³lŒ8ĆŠ lhÀŽ4±û6NIašz°ÕâÐzþ$ÞÓ2L¼üqõ3Y‹šÉ7#n…úîòf›­s†vû¬ã•û¼<Žä>#f}â©u]ý(³»S# Ûì€[Ñ> Ú9ÅnO{2¡ª–Á#þx9Š¤²R ½ˆ™!öÇe{YQf%‡ µ ¼¢B£³Àñ£"#©÷˜ñô1[ãç"±¼ZÖÊ©ABeÖmá§n/Uy'øì¡ßRH³8Y"X÷‹p?EzïË\¤ïÑX:c“g¾@ÃY´aêOH+ëxö@§«åÈ',>‰•ŽJ§¨v/TT¬>`?Ù¦x†hÈ–kD¨€*ÝáiZ¹6È‚z¶ +ç S ¹5œO$¦ê‹¼F çO4ˆõ„4×HkÏ ;øFQƒ ô_=µ~7ƒu4Ñ °Ç€­˜‚›B4€«Ää í±©é Úæ²:«6<8‚å%^]Tb–+äN}vŸM¢üPÙEloñ+8ÑìãG× öÊA§»­Ý»}Ne·ïºã—··$Ú•ŽRÀM&Â-ëuVîë¶ûÒêöœMeCßX½ˆÓÀO£xÖïô8+iÆñœQ½ѦÁ~Ì%û kºÁÈZ›N‰àÑÛ€u.êj/ëªì £zËè]?µ®ÉàñVž:ÔÎŽ~0²†µŽã† ¬Ó%¹Ë*U±õ^*csîoO±åߺÖ!P—;Ö ÕU_.Ft½Ýô" +åMÁ7JÓ¥oòÞ¼Æ+w8’gÉñ£‘ë‚ɪ)/2k\SfWÒ\^=¶ž·5’ cÕ»s‚‹PSÅЬëØ_í¿æßÉå4ä½Á‹m‰ƒƒ,¥#}f‚¯‘¡÷B¼®ª|ÍÛ0ˆ=oDöO¬¼,%Ûq9ã\Gš„bü49íS‹/ Ä›L\ê.g4pŃç &[†OŽ<“ÏÕ¨áÐÄ^}ä`%Ÿ$2À>f-ûʺÙðL[`1Ú ~fí€H»>±ëÚ´3!á©(K6ƒGòO}L ^\[*ªËȱ. -«ªÇÓöv¶Ïy0\͆VøWÒ—†Ïf/#ÊC_›ØM^"ð%ì%‡Ò˜> ¶‰Sv¤cÐ *ªí(7Ù1ˆ™…A»Ï–š”'m2ý˜QÔƒÌ@°èƨMÀåÐŽkóæ#œ~þxQjÁÇ=Ÿ98—|8`œøVóünvæL#?  KžHj—,¾,z[sõ»zÃ:uŒÓq°hžÙaÌ+"pxáÄþIA®½ B Q(7ü¹ËÅKã¹2º,áf¶Zý4Cò~²eÜ>YƒÌ§ \ªÏ×pƒëÆœ‹¨°ÿó“ˆ#å½ÞNPùcSW_,…‹ÑÞQZ>‚5ÐrüÈ»ý`N˜Ãµò‹°uÝ4âoÓÏ’×±\PTGÊßñ¨œnr.„JDƒi߶á¸áÙuÖ'‹e/Àšζëä!\óBöí2ý4¹›ñp#Höh ­H É1WcQ A¸Râ ÞdÕ÷” f;7­ËB"–Pÿ9ˆ‚þ''‘£ çÃÃÃPÕÕœ5F‰¢Ôã¸ÀÒ«Qø<µ=Cˆ_棻.ÄrZ÷a +(ñ("§Q1g§ÂÁ€“zRÂ`"ÈK(TÂènܵéí×S?jQ48'(GƆ‰1 +\ ^ƒ(‹ ÊaBÊ;Cð†ìýq4¹}èíÑÏn âÄ +Ò\™änŽÃJ´¡htEÀ +þš'¹Vêæ|XDnW(°}A‚{òºÉ;°ÁVØBrÒ7Ån)Þ¶†Z‚%†©afêˆ E£æ[bŒ + M e ™F<¢8‰h}’eÿ`ðê- +à}k!ÄÍfHMBa¯ÏÉÂWÿø3ÙQQÒÙVenY ™J ÐïïWkL¨bæÐMœ~¯¢“ÛˆtêjuçVÁZ.Kïfé ïé•€ˆÝšg¢ƒs=âú‰J%⛹ˆ/Ù" "ú¨$V"y,þTáô'YN†Wݵ£èØ´ÏeĹÛ ž.ŽÿÈØ~{ëFu¨å°ºÍz]K¹"×bû=™ç±€¢«üÌA²¿"û@ëdJ +.œg7å&}†#¬Ti8õÑßÝY’X¦»3öE+BŠƒkÒà†Úl!\Ô@¼Aá¬å‹âylÇr?fDH𱾃ý¤ @Z›^K}h ØKã'¶‡:±’0Õ~šÆƒþ}°ë팙맃ûÄmJçÞÓ11ak$žÜª„»Zû‰]ïqjûxΊB—1SÒ:ÝÄ 9¦ŒøÓ¾>°ëüÅu RIá1#†0¸¢‡"?UýuñÅíÇ¡¯¢i½þ VŸNLyù§ìpì3JøÆ#šÐ¸%|Q±^|âI3h.¸ö‘3g´²‚gú¦Ø%ŲޡàÐM¸'ô¶CŠ0%Áì¬Oåu‹çäå8&_ΈwfÝæŠ&QÞí¶É7W|ª†ýmð|xpp®‡‡Ð¦~l­„‡è÷„‡-%…ÔÄò‘^½CèÝ >lvý°¨ì§qüöþÅz±Rã>úwÂBøF‚Î$oCùÌ)­aÞ÷1B§éo†ž0I|•<zœëMÿ0Š}?cS•„ƒ áúJ´^7ô¥6C¾ø¡•D‚t½ûæô7ÁSf‡oÀÓ°AÍ]ûæÌ?¼~ûêÝÃÝ øUS2J]!ó—»N}“läb¹T' çÚ̱¥H”ôfˆÊHnˤ=«®ÏIëK©¨kRƒÅ81š°p +×™O4|”v¼(¹Wé¬:ƒÿMÒ»S§æƒ ô>¹(5ëPáKbr)×UÀÿ75tl¨òqÂÅ$q9ëŒ'TÏ?ÂŽ(×Ã…ŠHž" ±„‹nÈ@Àæújz—Þ^}'½ÂWuõ…`>Psp Eiƒ.ÿ¯×øŽñµõ7q®{pe4½¢Ðý¦Ö„Ž›yµ$aø”7AIÿÓ¸B×qä íìØ]¶6Ck ò²ÃÎÀO5»܇ª{å _žæœ&žæU‘íª!ÉâèsÆŠc„%.+ÒìqžgÊh_!Äa€òt¬G9}#ï Ü|±eè©Ä¹cK»€zÎTe#¤;I+”3S­ü4˜6$ÜäÊÄp5$i§1>{B½@ͲìßijqKÂ0ß/Th}kÌoéJ°WúŒ®Îh"Ë/+*¾>ªÂ¬yâÇPÜ¿û÷_½oêGªØÒIA Û^vt°ÎJa¨Ü3]þ‘†à<Â×zz§»ììåPäRÃæÒÖÊúAh&}áÓzÝ¿!À‰¶TcZ,kZ(QKú# kèÝÁwÎÛá~Ó2¿ZJ}Ô¿Bó“’•§èº¡û©ÊKÌ)@ª‹_Ǩ:ƒç¦ñ!¯+Hû³6 Üg²=r͵‰Ý¿r”BtJ ©þoäzaRÇxúPÖôåt=T™Ýµ7# FÏ^vøǼýG4voRߦá¼íDPƉ陡À‘ž3éÔR=Ãñ¿ëÛendstream +endobj +3900 0 obj << +/Type /Page +/Contents 3901 0 R +/Resources 3899 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3881 0 R +/Annots [ 3904 0 R 3905 0 R 3910 0 R 3911 0 R ] +>> endobj +3904 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [470.223 690.985 512.306 702.977] +/Subtype/Link/A<> +>> endobj +3905 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 677.738 193.489 689.428] +/Subtype/Link/A<> +>> endobj +3910 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [293.723 140.375 341.14 152.065] +/Subtype /Link +/A << /S /GoTo /D (diagnosis) >> +>> endobj +3911 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [225.07 126.826 427.223 138.516] +/Subtype /Link +/A << /S /GoTo /D (problems) >> +>> endobj +3902 0 obj << +/D [3900 0 R /XYZ 85.039 786.531 null] +>> endobj +58 0 obj << +/D [3900 0 R /XYZ 85.039 766.606 null] +>> endobj +3903 0 obj << +/D [3900 0 R /XYZ 85.039 748.602 null] +>> endobj +62 0 obj << +/D [3900 0 R /XYZ 85.039 610.22 null] +>> endobj +3906 0 obj << +/D [3900 0 R /XYZ 85.039 578.694 null] +>> endobj +66 0 obj << +/D [3900 0 R /XYZ 85.039 453.924 null] +>> endobj +3907 0 obj << +/D [3900 0 R /XYZ 85.039 425.126 null] +>> endobj +70 0 obj << +/D [3900 0 R /XYZ 85.039 313.904 null] +>> endobj +3908 0 obj << +/D [3900 0 R /XYZ 85.039 266.376 null] +>> endobj +74 0 obj << +/D [3900 0 R /XYZ 85.039 183.05 null] +>> endobj +3909 0 obj << +/D [3900 0 R /XYZ 85.039 154.252 null] +>> endobj +3899 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F56 2890 0 R /F14 2895 0 R /F11 2898 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3914 0 obj << +/Length 2306 +/Filter /FlateDecode +>> +stream +xÚµkoã6ò{~…Ñ/•k•EŠ,pX¤Ûí5E›Í]ŒÛÚUl®-œ-¥’Ü4ÿ¾ó d9–Íb±9çMÎXNü“«c¡Ü$³&ÖJNÛ 1YÁÊ¿.dÀ˜”Ùç›ùÅWß™t"Eì„›Ì?õtœˆµ3“ùòçèÝ÷—7ó÷ÿ™Î”RQOgYf£ï?L}dàü¯®oçS«¢ËdÀåõ·c:“Ñû©Œ·—?Áì_Nÿpñ~Þs:E*…|þ~ñó¯b²™~¸±rvòcKç&Û‹T«X§*Ì7·ÿîiñZ:á]cjé0fÒÅ.ÑçUgLl„éU—Àj«Ô ê¤Lb%“I¦ulÒŒt—Ä(L§.zWm· qU‚ü&‹Þ×u5U"ª›SÒ*gÙÙã;R,Ù³£dœ8MìÌ×~:Kl}BV6› +øP”0[ñÂï;{4KÓ.4¼—K$QÑÐê·…•oyPrΫžpI‹ßvÍT­É·Ó$‹îr^ÚæÅfÏ€Š6Eèsà_óZàA.þ@-3‰ft$f¾Ê‰d|J·ÜÁœWmÒZÆNë¡fµHjohI´¶ÑÇõ#ÚÙD9ٳћŠÛ¼| س½ƒ±Œ– ¹ŸÂ¸®´ð " ¦qÉçmQ® ¿­Õýøö„ B(ö¬¤œÓNdL;eIÔßn§¢™RmÀ´y‹#MŽ]¨, ü»bîfÇÑ9p_^òüòê ¸C#³ÿ}Z)Ñq+¯Ù•R Ú[Ó¬àctTí+9jÉdŒ–÷&e_ÏƼæO|lûM[íV: › À˜âX2eMô€„ò†'¤‡¦Í7Œ +¢ÈQ…Œ³ßml‹¶%&–ãzØÔ…’¼#¡YvfÝÎ9ÈÇ~@ÐÓòvDÚ],AKž'þÏ{Ò½¯ _.zö`%縬ðèGÝOÑ_ï6¸‚ó‡X…ï€å‚%íÎ55 +‚¤SuÉ®u‰É©;8ÿê;m>©[k@”£ùcK9Õ‰h†¤nv¼åÀM»nCP$jô¤b Ù{¨ W´UïWxYÝã¬ZÕ9Š¨ …­9q6<%ŠˆËvÄe–xÉ`B øl™¾òÍð Ú² uN³>ì©>‘Ï:òõmU²Å¾þ’¤ âeûíŠÈež ;4$›¿j<ÉI”áS[r¸6¬ @E ù¬óZ@^¿©|,›¸nOÎìù6R³'7{áßb¸¦Ñ‡)¥9¤°ì±}8ºh™*€yæJÏ—_Uú³&bG>à9Hut¹¡Ì fè‡Áà%ù +…EgKº]k38IpjîCáùÿ»L‰è`úô›2¯»þ]ó27ŒÅ·_²Û«¡ÛCÄ+ Ëo‘«r‡vÕ‰ŽþÁŸT8ãò'ßV»²å1z~ñ¦©y|ç)&p´–!ÜÝ×]]hˆÄÆ.R8Ž/›"ìÄ7Ýéi©4ð§$ÜŸ7¾ àܬP‰üoQ·;Ô±Ô™ŽL:»Cå&öþÔ®ëe0¼ŒÁkÜ>N >²ÙÞááP + +§H'L8ZZ€ZÈ,ðvÝ™”Ý*IyHÜ(@tR¤Ç´u*ÅH.Œ8&!Òó쥙;Ç^G\»ì˜?k²óÄ¥xñT'éñôâúÄ¥Ó¬Õ6yÆjêVY2F;{†¶P/ÑŠülÄ­KÍq“#ž: õØSd£ÄÍkËØÏE\fFŒ×‡xpiñê´;­—~6âÒY›¾qgIvp€s2y=ú³ãmŨzÒgNÐ/I¾^v§z«Ý(ñäâ/K‰‹ÓDž'ŽiéN#åˆÊSq^-%'N—?ŸW-^áO_øœø:Üó6•o@wo¬JºF뛑gý *×L‘€»†ž¨È.<ƒ%x.^ÒùÊ3p™‡ç"þ›âèA˜@ò}¹©»J²î[1tÆ F ghzžç\qV%ž¡ÔÂXèN©]ÐhÙ^ÓtžñDdšª;zw%ÖšëâÍ°PWhë-ÉC¥P±È©Eº’TEßV[l Ñø]E,µ5÷Â|Ýħê¦+x 'Î@…ƒÕÑ®æYóØ´¡¾†yÖ‰ƒÃës ñamÆмa +9O?^]ß’£Veƒ‰´· +Ü¿ÇEr½Ê7Æâ2Çó„Ê DûbMÂŽî µÚøS5TQv½‹–ŒÀ¥*6—¨ÖFå¯P}¨Â.yi¯R„îUŠý)IóˆFe Â74™ú*@yXÊùÃJŽGþkÝ&Gš#{µ†šñ@§èuJ¾‰Sקbê6aÝRˆ  r±÷V…Í +ªë»¢´ Å!5 +([lü ½ÆA(¬øý°UK"žtߧqnŸš]ièÜ[JœeG~"Éò©žŽ;ìOaxú’·6÷9uGÊ@3çOOîç#å6/|¢Ò™YÀäy_ŸÌˆ‹Má9Ž¹7¶è“\éiÜ1¯C¾ìø žŠæœW°S×tí;X]cã‚úpYç£Ahr €r¬úà†»»ö PŽŠa¤n1˜ ¦·ˆØ;þb3jÃdã½íyÁÆåsŽàãK S X¥À|ºá G)¬„ ìŠÐÙ€ÛýÐé…3¤Ã J!|mêç +¥ã”{Úćÿ,òßú¬ÿ) µ±³Éø/ÞpPÖwÌÐ#Ô=eX+k«F8þ ­Á§endstream +endobj +3913 0 obj << +/Type /Page +/Contents 3914 0 R +/Resources 3912 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3881 0 R +>> endobj +3915 0 obj << +/D [3913 0 R /XYZ 85.039 786.531 null] +>> endobj +78 0 obj << +/D [3913 0 R /XYZ 85.039 766.606 null] +>> endobj +3916 0 obj << +/D [3913 0 R /XYZ 85.039 744.844 null] +>> endobj +82 0 obj << +/D [3913 0 R /XYZ 85.039 700.36 null] +>> endobj +3917 0 obj << +/D [3913 0 R /XYZ 85.039 679.163 null] +>> endobj +3912 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3920 0 obj << +/Length 647 +/Filter /FlateDecode +>> +stream +xÚ­”MSÛ0†ïþ.ÈoõaYRoBá«ÅN‡áàÆ&õ$Äà2ý÷ݵ7@(‡Ö¥Õjõî#­DÈñ¡ÕÀ• MA+NîNqäS z¸w‰7|ö²àÃaš„‚ƒã.Ìn‡8Žƒvi˜×lÿht™¿D±RŠIˆbc,;ºˆ¤eß¼1»ðÿãó«,²ŠNO½at~Ð{D±`ãH0tè W£3ìí‘yÝd'Á8”nä"”"Áõ  Ìé$à œ WØæ œ ï‚D+Љêûóà*ø<ÄòcIègmòöˆ…'õßÑ¥)¤<ÐIà´&tBHPB†FkHÓ±“`ó$jZsvŒíÝ;$¦lZ¶”}[¡m1%›a;õ=6+/™ÈÄ¢ºtþ..Ñ[‘ÄëXñF°×éH-Áñ,ú~^£@Î&³W­!ÍÿØÇzG SÀz&°º÷ò>Fqb;Œf^ÍqYxÄmíÿ~j¬3Êç~_¾ж\úÎrH—v¥Ÿq[GhkˆžËÁ¤(ZPB^E^MIQ–}Ý$Áñ1·@Â,7M¤\Q;_ú5÷óÅ¢î—Ê—¢š.|·)Ëe[;¾_õöögÙ'ƒÞõtùVE)ʼsÄÿøtÈ…Þ¸†#.®»d¿SÅ׸pãK›€âÝ€GY°ù$’†ÍüHAû@\žèÐO¨EºUÂ* ++*¤õî+šZ7h™U]… mR7MÙÍl)×_´81Mv–ÏèN*½c­Sµ^¢Ýíw; ,h1Œ oàRÿ¼¤…]îßî¦9Õ£•Û‘ki 5ÉZ Wü¥`­,h«¶(þ çqTÂendstream +endobj +3919 0 obj << +/Type /Page +/Contents 3920 0 R +/Resources 3918 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3881 0 R +>> endobj +3921 0 obj << +/D [3919 0 R /XYZ 85.039 786.531 null] +>> endobj +86 0 obj << +/D [3919 0 R /XYZ 85.039 766.606 null] +>> endobj +3922 0 obj << +/D [3919 0 R /XYZ 85.039 732.329 null] +>> endobj +3918 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3925 0 obj << +/Length 407 +/Filter /FlateDecode +>> +stream +xÚ}R=sÛ0 Ýý+8’ƒP‚àçÚ»$—]ª-—AåHW[òÙÌÿ/IÑqÜÚ> "ˆ¼÷ “éCæ H +Ìy †½íV’½§ÌÓ ++B£u:_I6§lcHí®b*Gã”íuÆ|oWß•dJ‚µÄÚ CT@¨˜ Œs¬]¿pÑ#ù£ äÝ1Š†¬ã¿b—ãC 7³ ÉK‡~9< ä»}Ç~Šâµý±zh?U=60öšbÉE@ŽîÚ±Nz÷Õj m/ìÊ©j³!øOÑ ŸcKY-ºË~Æv4 %.؉ ,äí0E£‚ãoBy>tû˜ž¨ÏBùÞòõ¸^“Èâð®û“áýõvœ„ +<ÎK‡Tpê~è·¥iw,¿dX“âÏqi}Bí·]f™úJ¹™«ˆ2À‚HéßÛÚùpR[+2OW2åóÌ0¯b(nçMZ¢³4"*“¯TíÓ¤º¼"¥Á”-F¸1 2 ébnå ý&$-PÚ·Š) ÿRò`<Ýáü ¯MÐ×endstream +endobj +3924 0 obj << +/Type /Page +/Contents 3925 0 R +/Resources 3923 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3928 0 R +>> endobj +3926 0 obj << +/D [3924 0 R /XYZ 85.039 786.531 null] +>> endobj +90 0 obj << +/D [3924 0 R /XYZ 85.039 766.606 null] +>> endobj +2949 0 obj << +/D [3924 0 R /XYZ 85.039 672.187 null] +>> endobj +94 0 obj << +/D [3924 0 R /XYZ 85.039 672.187 null] +>> endobj +3927 0 obj << +/D [3924 0 R /XYZ 85.039 647.469 null] +>> endobj +3923 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3931 0 obj << +/Length 252 +/Filter /FlateDecode +>> +stream +xÚuP»N1ìï+\úŠ[v½Ûm ¨¸(N!D)H¤Kàû±“ƒ è%ÛÚÍì 9,‡\R@Î.&erËݺ w M Q)ÿ°ûA»À ²¤YÒdÒ©DÐÄ•³è›«Û€. ˜±ëß]ˆLÌi0ˆB®{ö-“ZF?ÚŽ-úûò`¹ÉCûÚ?œ4bŠU££@DË^ñQäi5~­ÚŽüX%Ì_ï¶/H²þ<ΆÃf·=‹:öE{³ÜWõæ¦ÿ 1e‹-ÌÅÄâÊ4ä¿è¿e°‚ð¹ RGsÍÁhÀjnâÔ.7ÒÒxmó,téù ÀdÍendstream +endobj +3930 0 obj << +/Type /Page +/Contents 3931 0 R +/Resources 3929 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3928 0 R +>> endobj +3932 0 obj << +/D [3930 0 R /XYZ 85.039 786.531 null] +>> endobj +98 0 obj << +/D [3930 0 R /XYZ 85.039 547.583 null] +>> endobj +3929 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3935 0 obj << +/Length 3140 +/Filter /FlateDecode +>> +stream +xÚZÝ“£¸ß¿brO¸jM‰ßËÕîe7Ù«ì¥*ãÔ>$y` ¶É`ã^ïü÷é/ ±šªAH-u«ÕÝúuãð)€¿ð)‹ý@­žÒ,ñc>mŒüù](:V~¬5´g—ft™D~ ÓYá±L#íëL#ÍÇõ»?~Ž‚§(ð“D=­·Oaù*Œž’ÕÊÓôi]üÓÓþbÇ÷\¶ßËv±TIê­«Ð{;ÁKà•÷åÇ‚ÏåæÜV‹Ðë0üÆ_á½fè0áßëßÞ}Z[áD¶dûqrWú„„ã§0ðWÁj$AU¹j™Šc³¯£†ùÚZöµå¼´Ö«nǬ°9Õöþîκa(L† à¹ç9Õ–ŸÄ€Ù¹ÌP€†ùzÞX7Z¹3BHªŒèØØç.Ç5 ôÕa´²Y c2'Ÿ²bóÍz#Sa°Æ“q~¼BŠã&ZCÚØÔ¤Ø5¿UÇéð‹!ýMí&ë1]ÞöF˜û`QÔ/b¦'?Ћ!ÿYƉ÷ ¨…ÔF?Z´9[+Á)ëǦUî–ü°lãlù "›"•Ñ8¶!Y¿§‰òW>týÀ6h¸®Ä¿e®'4qÍùñJõeF7ds<§ÉE·8ÒìåJÃw²K ©Xƈ#ï|â§p¨™ÙaìäfÅ"LÀçT—×8©íh»G.s¡ß# ¹¤£8DËeAðå:{ê-¡C y™’ÝtÕÇÀã´‡Ê-ÿœMh¶Îw}ªHûŘkI + ?w×U«Ë(ôã$~ ËèŽ.…è‘.ï14ºœò›Õ¥Ão„SÄdÊÚêtÊ0l¨N;€»9µÀÖÄ5&­ìyáCÓ–L»ËúºäÁœJ {qúj#Ÿóˆ^†¹¼Tsn(åG),¼8‡ìxš Ó”z\…6 ±­Uü*ßš L‹È¼Ã¡`=g)áJû:Iï[ŠCtÛR ÑK¹ËP,åŠßœ¥¸üþ¯sJ×#LDŸí¨ÞW'QÆ g,ôYÉÔ‹1Œå}þ’w÷€Ma”v,núd˜ÁÂ즢;š¢Gš¾ÇÐhzÊoVÓ?ªƒ¨D¡~š³UL$qà”θœAå ™†”gid¥k +ÄM\œ“„NÒ #…|í¬8ã&¬˜D¦¢JÁƒNµœ©wž;SQ:õÈ‚Î5aÏYv–¦±‹xÔRC^[L +Ô»¡æ‚¯c«ÄñvÀ¾ôÕO'6ÌŒ3Jé)ž`‹Â<9,,g‚Ë€è":pA‡Cº¥Cóý›þ +òÆo9Z€²@ìíªÝQjOz#_M¨ô¬o5†ò%vû ÌÑ¡$ÞÂÓ +ø~æ6FÎæ<ÓXÍb&‚àÇ­¯a¤ülþ2ö³Csû«FÄ~¶Êä«F$_5žñp!w~åñ¯\HÅ7d +”Ù}™šÛŸ22¸A5ÿjåÃägÝ8ö}­6ö‡ˆK§‰òjS·~R²†¼•°—€)W³$p §„9¬ÆŸ•)‚¾Ü/ +FÎÙ‡qÄŸoÜ”<ˆ·Ííp+4¢í=nl§Ìæb­Ãlörç/áçS11¥Zò¢›f5^ ¦‚ÄWqb–CÁ”š²ŒUÒ«;<ÿœ<8dendstream +endobj +3934 0 obj << +/Type /Page +/Contents 3935 0 R +/Resources 3933 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3928 0 R +>> endobj +3936 0 obj << +/D [3934 0 R /XYZ 85.039 786.531 null] +>> endobj +3937 0 obj << +/D [3934 0 R /XYZ 85.039 766.606 null] +>> endobj +102 0 obj << +/D [3934 0 R /XYZ 85.039 766.606 null] +>> endobj +2950 0 obj << +/D [3934 0 R /XYZ 85.039 672.187 null] +>> endobj +106 0 obj << +/D [3934 0 R /XYZ 85.039 508.603 null] +>> endobj +3938 0 obj << +/D [3934 0 R /XYZ 85.039 481.989 null] +>> endobj +110 0 obj << +/D [3934 0 R /XYZ 85.039 123.831 null] +>> endobj +3939 0 obj << +/D [3934 0 R /XYZ 85.039 92.305 null] +>> endobj +3933 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3942 0 obj << +/Length 3740 +/Filter /FlateDecode +>> +stream +xÚZ[sÛ¶~÷¯Ð[å™&ðÖ7çÒÓtš´'vÛé´}`$Úf#‘*IÅÍ¿?{J”’“ÉÄ¢€°»ØýöBéEÿô"OTdŠE–§*1z±Ú^D‹˜ùÏ…Š+!¹ +hžß]\—Ú…ŽT‹»{¿O©¤Hwë?–/¾¿ùùîÕ»Ë+cÌҪ˫,Ë—·—z cZëå¯¯à™¦íòî÷ŸñÛ-ß¼}É·8øâòJ/y÷úîw|óÓK¦ýëWwžÑ@m ²ùÏÅE‹5ˆôÃE¤L‘/žà9Rº(Û ›•X#ß7·ÿõ{ñœ]ðª9­À¸*`îÊD*ÏíÎaçÖë$6A«I¢R›y­ê$ЪNmœ`h‡[”k¼''é)Q¸üK„›LÓD™<=o·Ñi»uDŸ±Û³ŠÝ7g·áy·(¡lÖ]6àµÚÙÂTpHª D6üL ãÖÝ#Ð&Q¼$øzĽvCÕõn”Ûâ²O»?ð¤ó˜$’8†€QÆ=ƒQk–Ïé¶V¸ôÃ~Ç”gVñ¶%±–#&wÎ2°6@a*IH„Ûî‘©w8bŽÁ_YˆzÍʉ3»Ü1={3[ÝT x¼Š$½o»m9ÔÀ"ŒÅËŽ¨J¤_;U ñm),£W†÷_µ Ø‚E¢=.ðû˜å=ŠÅÓ¾•ÓÞJ±|Ïí=%ñrxtöÞ£ ‰¡Of?„&"fØfjÈO¬Îø®q™Gˆr=#ZUÃ÷^ö†+i0Z}â9¢C¡Ù*0ÒuåCµæZþ/dšm%Û²f!²ÕF¶»/·õÏ+»™Ÿj–LÚI}x)8O×[Ñ­ËVku"Jòr³™àHBþäUƦä‚ +IfT³Á¤Bk/ÐÞ—ÀSšã­ö]=\RŽ¼õ˜íØìO±—iøÌÏó7ÒÌ„cÐ  ^£ž +´kp‹ºç/¬.º$ge"‘S6<ßïýeOhœƒâ3*ß±+µ=-,È^M‘±W.—߸S9,j<ºóĶ%«YW=ïPvŽbéM´_9c¯ß¾‹ÓjÆ€n[mÀ­h[ë€{jKßš5`ŀȩ—ΗqŽ¸‡…ä¤pÌ÷Òðך`iG©è60¾žw©œ;±Ïò‚ÃÄ–¥Y o¥ìðä=šò]?ˆÊø÷HØ\Ú(%7ÄÏ•@«Æ€d*œS¼ÅÏdùI½æÕ=Ï­Üyµx;B³Ìßñ \ÑÈHýTC¦K¬ôõT##«’µ„ €s‰ðö+Y»ï«9LXµ£ÎËzT7€€€„hDFÒÕ€båÐJNàñ“ìk*6Ÿ0°Èä:6ð +ôrL:(°]¿xýÝ-4nã¯þ´Ý´òæ)žð¨ݬ!:šh«N6õöÏm#˜K'³â~~Œ'ˆ]½¬B«µYèØdòbmߢˆPÖ¦XHÒl^€’QÖ_nq ”¯eMZPujãÇK`ºúXmx¯ ð@"Y·^Æñq±Vvd’Ûïñ´›w¯€ëÜœÝ:MUŲ¡66Ëß.sKúJ#Àþ{Êù’‚Œ‡¦GØÆÂÑ'Íhˆ¸”ë€e y–Î29öJЉY­¸.Çí€ë~ŽíD:›²Mö‡ÕÛ¯¯Dá6…°c& +ß:dð®É–PÌG wòUlìkF†B«DŸâþŒ…ÊMâ.-@@8w×9„üˆÜ1xƒ®ÁÏ'Ý¿5æDç‡Ú, Q¢úN. ½¨uƒ¼o’Bæ‡Ì•ïáâ$‰ÕÊ$6D@I ÅAç¬W]Kúiï)ÌÐÄ!ØK±“×üGÑ¿ü$y•$½”?™‚jIôJ¦û€>Ù“£G¶”ÔÏWf0õg”D üÑLA^]’wÊZŠÐ¥0\n®f pã°>N´~˜ /8W;‰"˜Ú¥$âÔº\iÑ(«“ "ì•c2`\XrV€vTnxù}¹ž!,å¡ÈÆÞï¶>JÎà\lìñhD$žü?Éäñhö“¼##xÍ k)‰–¾l*tx3—NÏ0(YJî÷SSÔ35%óûŽ'.µÐly!ê É9f€2·Ê¦É!.C +ÊXYð‹©È^2¨#=Q_¨ €S¸b¨Ä—/‚Uˆ’¢£j0Rk)KŠôZ³AâpXñÈ‘øÁ£âš9K«Q©ö±B@‹­H¤!Ÿ†Áu5ZY¬ò\ЋbÝMB‚ÅÄ°«æ¢"$ +‹©¥MŒñà4“©,rVûlfGœ×3QöÐb¡îøÂ]^þ„8wƒ[½†‡·3»A8É£/Ýû3 =e¹ß ?Ú UX]¯¯w—ê÷_g%µ9„$wv˜úÎdðíÎÕðtcxå`M'l̯òyNˆ[X‘"¯”~±ùÇp§‚E3(G rêÊióãd>xƒ€¦)¼yÎϧ*pÌBªÍ¦g*Aj°âM=v€¦d›¡ìéã÷'bfÏ8(›pb +ï´a-×rrG¥Né(¡x„}€NøAµUDÚ0¯€Ú5^¶;Šâ•t[sþ(”Œ)Ó#d¶ +\ËŒTž:G£6Í%}™±2 W €…{þ.ÝWf‘À3ÈF±wL«hä@|_Dfr87ö\é¯ÀfÏ“%$fZp÷¢õ¬P„©‰Úå˜j_:¾t7Ôç89±%š«y"KqÙÒâ2X[£E-E¡Å8AÖÅØÜ“Â àËÞkö·J¶s™Z,õyÝU+ªé–Ä•øÁ#˜ù îxª)?Íä6]EÉ‘ +ó_ägšHöd$÷Á‡‰Š&3aºj’ƒœŽÇF$ñ©)RÎ×P$m‚$2cÒå6<½÷½1®Hì£QÇäŽxƃïéf”@þ[—?¤p+XF3œìâÛ,ŒÆp} +’ +°Ä7C}ñŽƒÔ^„íÆÊVñÄkÖ==»I<« +÷x]¥‹ÛòàgÃII€Œ#âÖÓîÅjæÍj.%9½Æ©—Ÿ¹IáMÜ[Ç3ߟŠ1À¾ÓàöqŸ²a*I‘ž±ts°zâîðý‰Ót ¡#³õ +ÏL¥výÍÇ +ë×½ÏÕØÖt¡©¤¢µõ`tº¹g©Ê²ôl÷0 ñíM­ +¼‹±{†OÚ›z©±‚Ãÿ¥G­wÜÓü‘Óå-»Œ Q }:Åe©$:߃ hN÷8c«Øðk#ßÈSi<™r|+Wo\'QâQæ÷c~Û”\÷_σ-ÓÆܸÓÝfñ4úÁÁ땽ý2ìòøéS âuìJÏÔÏèû±¼â’À§šñ‰BKLõ‘·=ž¸:Öô£„Aêk)²mÊà€.çqçŒ0{¦M¦•É]¥.•U¬©¾h÷.¶S¡Fj ŸømñHGNÂAÂF\FÈfÕ¡nYy…QQjŽË` +$Y"I°<‹}àqø½«ÝkJüÎHŽ¿ÀðWEËdÚÇxþ¼)¹X»õ»à— µ¼X­d²nøsL¶Ž`ܪ4K”Ld)QšÍ’´‚šÙ÷08‡Ã,99xQ‰êͤ!}õ-?1Ó-ß Éu ÌÐë\<—üýøÕ/Û*J%›É,Ö> endobj +3943 0 obj << +/D [3941 0 R /XYZ 85.039 786.531 null] +>> endobj +114 0 obj << +/D [3941 0 R /XYZ 85.039 589.64 null] +>> endobj +3944 0 obj << +/D [3941 0 R /XYZ 85.039 560.235 null] +>> endobj +118 0 obj << +/D [3941 0 R /XYZ 85.039 276.776 null] +>> endobj +3945 0 obj << +/D [3941 0 R /XYZ 85.039 253.458 null] +>> endobj +3946 0 obj << +/D [3941 0 R /XYZ 85.039 169.378 null] +>> endobj +3947 0 obj << +/D [3941 0 R /XYZ 85.039 155.222 null] +>> endobj +3940 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3950 0 obj << +/Length 2940 +/Filter /FlateDecode +>> +stream +xÚÍË’Û6ò>_¡#UaH€à#U>$¶³ëT&ñFãu¹’8Çb™"'$åñü}ú>$r¼[›ÃVÊ€n4ýFs‚•ÿ«Ä*ߤ«8‰”5Ájw¼òWò«@06‚²á|{uýC®_¥~ºº½ï餾²i´ºÝÿæ½üçwoo_ÿºÞc¼P­7qœxÛuàÁZÞ¿_ØÀ¡wûá-ζŒüÝϯx°ÅÅ—ëMà½ûõÍí^¼ùåãþqûãÕëÛžÑÑUcÍ?¯~ûÃ_íáJ?^ùʤÉêƾ +Òtu¼ +­Q642/¯¶Wÿêi1,\ñ®9©X“(›˜K±v$– ÐÊz[«¢0&¹œÚ¼©²c~ýµxµöq­¯nö(¢Äx·‡|½ ÃØÛ•E^!¬Ãyäí;«pb½#M +€§^‡¿„r\ëØ;tÊ®xÀ!•áZwrÅ.ëŠZ¶ìj^Ì¿t-#1-\s Râº;…¢euÇžõÄ:ùÝ·þû0ªW¢:‡Šü£½ùý’JÀÊVß3.ãÀ/²üPöìá›u<Ù×ë œœ 힧`¢–ŒB‡*ð£çí{À!EjN‘ „$’Pg*Íœ¼×ãûE±÷²®~÷ƒðã©Á «ª«% ™çYp–m-JµŠÖÚwýƒcj­B ÆM(íñN Ü3Þ„b˜ªÐ:¼‡¬AMÝå]Þ8õ8Ý´ h™N褱 +¬:ïZÚk淋…Ÿó§±·Íq¾;5(¦îi†Ÿ4R0`2EûíÌÍ6:ŒUj’ÕÆøÊOØáÚ‰ÅÕÖ{Á?è…3Gl"¥c3Ù~{`[lšìNlxŸßgìp1tàD÷‘qZšûÊ®6#O½C‰np]£%iõeÉ€£Àª@'ÏZǧ7à@¥ÖN¬Ã7ÊøzlÀÍ×úÞö­Mà5ŽÏ(ò~õD¨’"b<-1éƒãøy&œe¶‰V±ÏâÿåÓ7àô©öP†5J타öîqÞð˜¤N‘¢Éy¥¤€óÞ€hÉBžÖoáö!P}S ÖaDƒ÷ã¶sy¢3 Kãè;/C0‘jZtL¹¼Ÿ‰½ z ëÁ¶ƒn:Çy¶CÑpðà^Qzo:Æx,ÊR DŹgPÆëHŽ.ñjVÖΔ‰J'g<5S/}Þè†.xt ù:ÿoè ƒaÅÆfµ·; ‘çŽéŽƒiGô…‰ëXŸDâœ(¡Z’‚){Äž;.UµäVNO”2‹]Ñ¡ˆq™½¹Úó,ãM' šæq^|tÜ£|p¡ON8©8qúø†ÂšÄç3}MÇb€_072Š$˜­˜ñÏŒò–DÃb\'€Ì©tçØs¤}g·éYpÚ¦’;ؽÑGñmŸ { .1®NŸ’=²tÈy0£š‚„ÝØxÇ<«d(é&ÖÞ#hâÝe<=d£æ_‘Ã'×'Ùö( UI¬Þ¦›;fÝwìýpÉé•ô€¼×w†qrJwnÆÚkÇײì5 X.±ÇˆÂj!:­œ9þ4 Ì ,\>S]T…‚Xko9ñHس·•ã·õQÐv5Žy³+²’ilo¾“o„'aµ=Ià¹Ô ©’ÈÏ·ü›íºSV:YEÖ“úwÎÿ¤é +Ù“ЮsÔ$4Áhœ dÈç †œyBZ ò¨á; +ä3÷›¤ï{tÕGNF$Z^ÍËŒ„˨–â‹l/×ušòØsVoy<ôÞD+â¾ ,ä´l‚X¯)»ôä}yŇ ©^Ô~}±™ãöß0 +EZ*òGu’(âz&x +±T4$L"*'‚ôDO ! Õì³Ë(¹BLGšbâ`XDyáÚ ¿;qù=DZ¹xl\åd"”œ\–y)øqiÈkƒ8òjqj„ô—¯O%‹y3¾Ÿ½¸ªO\žÐ ~»^ÍG—Ç4W„Þlù÷ü&!­CÇõMÎ; c³!R• †ç&Ü5œ:‡˜R6Ôñ™GQÁå{–‡Î=†0¤é^s3–Õpy—xŸ‹½{àõ^ží7$¿RÞ›µ˜à=•Þ¥Xq¼c÷"¶Äö$2À+ÔíãüFfÀ©a0Ì™¨³h7¥ƒ'tM_2E1J~”6:AÑÍ<’"x”¹7YÞ¶R Qºnóîô0SE¡Š´‘M£8Vñ¡H➇gFš>±ž0YÈ>WÃð¼ŒFèrm|HÛîþObØ1¾AôDnUÝðüä¬2õ¹¸ŸÏk éƒD+€Åì 0 Ð4®0ßúñ…V‰[; Ù‰×ä;€µ<:~úìy”[ü˜µzfÖeÑbýtÑK¥ë”zUò¦’4'=~§’F)V·3V$*íŸóôšPvÌP‚QÎ|,Ô3¢ÈM£½D±¤¯–quÎlƒ0P6Jfë|äßÕùü¸§1ýþ½ +X‡ÚqB)ªq¤£È‡Ž!c›©®*v½ ñy¢Á†–5LKƒ‰ì44RsÎhc¼˜i©a¨âØþGÝ"Û+±,ú-2ŽûÀ€Ïä{äO +<@`KÄE)u¨ÈüÔ¸=ߤ¤oÒTpÒP™0™ +‹ê¹-j,Æ. :Ÿ±j¬:–üÒø ñvMÁ`É'SåO\ž¡÷|n†?Ö;f{²ã*™-,“•œ$â×*•Lœ½ÂxÉ‘äˆ-ô\Éa2&º¬Ù]‹Ë•w®^\jN.ø|ßg„³Ü]5°äKߧoNý-ÝUˆÏ*Ižop–[S¾U˜ÿ×îꂘD߯¶Xû$}~UßW:L¾ÒhµZùà"_m´rXýJ§5¡ýo˾Þk©­b¸é×ɤ7Ê0¤„Æ}íIÈ õâ5;ê†?ih$Ž†‡ãÄkDÅ3ü¾§º{ïêÑǾ_¤ç}®åÃ%g\ó–²°uQæ»/+X¢„ɸc3®YÃóad%œž÷.¨b‘HÜQ(t¯VBú,C…ظ`ˆÁ)I¼ô–:ñ‰rìnþ•BŠ²UË9Ê>ñŠ~*â¼¹Ï.ò`šékrÆEû>«3“¿¼S.~æ ÈUàSÏyùg¹KÄjªI 2Ò%Ué\ mq(»TÀO ¸q­7xýð +–ï8mðBß]Ð3é]wR£:`áºQªRø}öºÎrPƒø™€ƒÚ´r4ñ¸FÆ)å“LZšîEl¸F´¹ +!¼`øÅ(¸½=Ã2¶'•ö§84º&LG¬zxÈ!ê"PpöbŽü¥ô¢7÷’&À¥›Ó¤XHÜÛ²o0Ó"*4ãG×GsÏy-Û ŽÂÛ¤¦CXŸáSìÌK•“]FÙV'Ò@’åìäê€iG(ÆG žò'š4Ó¾ã8Ê€Wݹª~üÖÍ÷.ߟ>d^>º^¢8\wߎ›º”͓Ȳ`µ˜fÃç?ep–«~1O\ôo©R,þž÷ª…ÿ"šýæ¯m]gð3oÆY™Š,›¸)D6kæ«âÕ›œ÷ð×R 4ÍçÙO–s±þ“¥ñ.iבÖÈsê’È5ðÐcöE×7Œé¿Òó³¨D-KNŽãïœÒ ãŽbÇOö——Å„Ö“8ý/K&Th_0|»T÷YšÙêðö?ý¡Ho!<Â=f­Žá}:fycÏvPrÉñ_Z ,endstream +endobj +3949 0 obj << +/Type /Page +/Contents 3950 0 R +/Resources 3948 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3928 0 R +>> endobj +3951 0 obj << +/D [3949 0 R /XYZ 85.039 786.531 null] +>> endobj +122 0 obj << +/D [3949 0 R /XYZ 85.039 724.106 null] +>> endobj +3952 0 obj << +/D [3949 0 R /XYZ 85.039 704.117 null] +>> endobj +126 0 obj << +/D [3949 0 R /XYZ 85.039 615.128 null] +>> endobj +3953 0 obj << +/D [3949 0 R /XYZ 85.039 593.932 null] +>> endobj +130 0 obj << +/D [3949 0 R /XYZ 85.039 323.557 null] +>> endobj +3954 0 obj << +/D [3949 0 R /XYZ 85.039 300.841 null] +>> endobj +134 0 obj << +/D [3949 0 R /XYZ 85.039 184.754 null] +>> endobj +3955 0 obj << +/D [3949 0 R /XYZ 85.039 162.893 null] +>> endobj +138 0 obj << +/D [3949 0 R /XYZ 85.039 107.848 null] +>> endobj +3956 0 obj << +/D [3949 0 R /XYZ 85.039 87.253 null] +>> endobj +3948 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3960 0 obj << +/Length 3060 +/Filter /FlateDecode +>> +stream +xÚ¥koÛ8ò{~…±‡d bE‘z-p8¤u÷6»›¤×8W»‹B±åD­m¥’Ü$ÿþæAÊ”%§{W…)r8Î{†‘“þÉI‰@e“$E¤äd±9 &·°ò¯i |â;0¯æ'/ŠõD" ²É|ÕáÉeñd¾üÝ{ýóéÛù›wS_)åi1õ“$õ®¦Òƒ9)¥÷Ÿ70¦eíÍ?¼Å¯+>½˜ñà +'_O}é]¿;›àÉóËÃþ9ÿåäͼ#Ô¹ŠT +ÉüròûŸÁd Wúå$*K'0„̲ÉæDGJDZ™ïõÉÕÉ¿;\¼¦'¼kŒ+‘JE”ª![Tä°EF)3It(@„liŠÅ®.Û§©…‘÷þYV›¼Üâ»/ñðŒ ªúóm]íî{à?lóMñ±Z}¼˜ä­?àÞ—?I÷p_iú*Aš¾³íÔÓÄ«j`ᲨùkUÑ öÚ»æüH½Mœoï`¦Âoi€*Þõ0 ¢Ï/`&Ãí/]å›)l¸Éù³!Lù§Í!ÛôµÜkÑÂsË­%Ì`>¿â‰÷åvI„¾ÄÐ÷|s}âaDW¾˜³Žãn»€ÿ¸ï‰Ê0_z £ZGÞo\6¼ËþÒaÛ‚wäfrU­×Lp£ùñP#¥ …’á$N¤P±Õ# ã;@¤G=QÊ0±Ž;Lx/)çÀAÛž=ŽA¾qšÊ@·£Þi— ¥Ap_”…Ò c²šÄ +Åâhx™k†¿4^T[ië +·îôâ.gÞ®)··æ ”‚9誨Yqj^;Ïñ´ü¶·= +¼¥´d˜|Äš6ùEEJβÔ^¾ µ¨P/˜6–1Ù:BØÑk\2zmhG寵ãèòß=#„— Êÿ¹ã¬üŸ=ÍÊß9í¢xlÑÊ#0y´I•›„Áõ¶|½ü­$îyºyjZbІ¿iüÈÌ”Þb×?²×ê»Ì,i¹xl]UíßF|[˜ŠXŨ٠ToîQ'òK>ÒÿÄ¿³ËóÓ³‹C~éîªá0ãù¡D˜Œ ßâzž³:ID†}Ξž¿aߥT"2•ôTÖG?Kï-\nöz q8 4ŸÈø».`Pù®Íú³``G?ÐxQÐä, ”…²Š–䈰3%‚(ù_d½-ZfÈ><ÀÉtÒ5/ؔ۲iëÝUUÿý>oH1P?«zéЋÓÖª}Cb˜RºADÙ ŒÙw”…É_H9T”Qz4&ðT¡–BÃÂ1<´+<<²à‡‚´<§©v’£’Rdx#¤LDœíIÉ>þ¢nµÈbxU×Q(4(0àœ|™HŠaœ1]`1šxy¶‘“Y”NzÄ2^ßAÌj—öÒ¨Xd:™D¤—1g2§˜.¨È«Vü{•OÉÓH£{¡„¼dÕ†'ð‘‡ÆŸ—ÖG™#(@äè;ßY>Uþ§ªtøs ‡Aèb®Mô ôŠ‘µ‰/3*aùÓŽs"i#Ò“³°/Ýg4D Qr;æTt.àV•ch”I6›´ ô—ø‰þÙ_~dÓ¦…šßÎ^»³×ü{ºììÍÛ›rz”ŽÓ†/ƒ"¤t/ùŠ™BâëÖÁ˜IW8Ì%ŸS̃¬M?Ï¿ò8ãb‘Æá!ãÈáà9¡ÿ›{äg$æÌ38·•™ÛvQ“õ²Éñ.õ¯>”£À(bL©ñ·2œ3c*WO¼‰t§Kr2>NœŸÂÌHÌ”àÂt8Qø ~_Ì4¸|ÙÐøÁ+ˆ‚êÇLˆ¢ÀÁ~Ì$ÛÃì-1¶¯’5÷ð.!~^¥àŸñ»å.—ï Þ%”~¥º;q?‘V*+€Ô’ ‡RßîjÇ!ñ¥JZíö°+¬lª ˜¬u$¿JbiH—:ÝÈÉW#Ú©3ºÃ!ë°s¦W›ª5$Vµ87£~”`Jæû~ L~Õ%:6ái{@8‚£‡^³Ä‰·Ÿ©Š<è±`MSû®‰‹z]ÝVÛýñû›™S×¥ÃØeà*.áë‘Ô„xHÄFwZ"ÌfPO&DFN5iÐíƒOBbn D³ë&b%À_Ò…Ý‚2¤=¯´êøuŠ³kÒÜsW¬×dkÏ:âÜ”ŠÀ¯¦Æi½,ÚÅK“ÞŒµÇ °Ëc–YSí‘#›Œ˜Å)æaD¶] b †ì4¸T¨9ì†Ø.Bõ·wÆ™ë³YÃ# 3h Àœ53óYÙSùÓíEÀç¦0…Wg5ƒ3Ï +—ÍQ“¿ßÇš¬ aîTî“-cA½Jê÷$ˆ'aÞ;"gÏKõ­)Þ¹ýí;à#þ÷'Ò‰ Ên˜oLÎ¥¹äײxû4RI—®AwÄÂãc""ž9Cg…üÖZqȯ14Õ¦ESïŒ}(A G¤3t~»ÀÊgǹ¹¥ +"À‡è¶Ü±âåS¶'¼@w× cC…S·îîÛ£VHЪ ŒH"£ÇÁÑ8›gï³%X¤ϱ|‰R[0Žœ,*ÔšâZá‘k3ûkQ¨IÕ]ÌÚ^Pl;¡× þád>âNs~zE¯êv¤­BÆ0Y¾¯Ÿ8Ó´%Ñ®¹uQRéj‘û\oî]Ãʳ…;K ¨™Ñæh'ÿ]¹÷O. ´Ójô þ³Œ¿ëDº E§"KÃñ% +'ÚCïHñ!ÁöI†ÿìYÿendstream +endobj +3959 0 obj << +/Type /Page +/Contents 3960 0 R +/Resources 3958 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3928 0 R +/Annots [ 3970 0 R 3971 0 R ] +>> endobj +3957 0 obj << +/Type /XObject +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/note.pdf) +/PTEX.PageNumber 1 +/PTEX.InfoDict 3973 0 R +/Matrix [1 0 0 1 0 0] +/BBox [0 0 27 27] +/Resources << +/ProcSet [ /PDF ] +/ExtGState << +/R4 3974 0 R +>>>> +/Length 3975 0 R +/Filter /FlateDecode +>> +stream +xœeU9²,GôûeË@@Q ‡!é¡%bd(dèúʤ—÷ÿ(žÑ¯ +’$¡T¬)ÿ®ïë¯ãïãÇ_¢ýþÏaíÏc‹®½Ú¿G—=ûÌöÓ1ÄF¬lÖ]töö×ãqu‰Ý¦‹÷5š”<8Ç—ý:\;âúãñ‰üéÆ&ÞЇ h—õ:ÀÀX=&02²oÒCó eD3PMtð1CrZûbœ7³}t€mA£d«·íä'ÐWŠ!è®»½KO(°ƒÔ¤‡tÙKb•^¦Ìì »å*’ÎÕBêFåmY¸™`Uõ´™Õ -¿nÜž í½³`*TûÞ£jg“¾=Ås–A½R?Ô =}³Ú§l +¤Ï’ÃigÙ¥—ÇáC6uéíÛ&”\Ê GTœ„Méêö–KòlÜ’Fyu|?é%åiÈ¥K”êNÊq{vˆ*êèJE¢]8hÍò¤p0R±ˆ$Á(+Á nÖN¬ +qª„Ñ«ò^ÿï>‹«>÷— .13×…Óƒ!¶3¢SËAÕ”ih¥Å¨Š^…(€<Îm䦽ªšÛÆlLÊâ³ò7ÙaÆ´Ëdô 6(WðÚºK +г2"ïE9~  +n*Œ1½÷¨¾x¥Æˆpîâ‹&XîÃœ§³±è\íD¤ßä0}#XŒûž˜‹¸À>#^V°¡|2Îi‰9ÊÎr)`˜¢Xh¡Ò& „hb—H°Œe"Ãêʱ„£~Ï“a³tŒºìZDß!#Z¶ÚÂk! e'jÝ=§ _tsÙ¬ûÍ&­Nå@‚i¬ˆ3t%kÐE„\H–YZxÿ/U¥Ç™åë—Φ@±¯iW H +þrÓGçX5¾ûû8‡´ÕªOª«t–Ô³$Ây°‰—BÒ›ÀÄ5©/¨vp÷o`kA“ôr ±ñœÓ4N.4Žæ&F°ÑTÆG%V½ Î'ÌØR5¬BÔ‹`qUžv-UÍ=ëÆåQv2ë_ ”¿­qq‚~èr¯Ú5ÌJ¼ð˜°h»P¡õ‹kÜàéÚýªå>Ò¸D °o»Îi¸CrT]¿MJ¥ ÆÖ¹’°;¿ö‹ûóZ¼¬ å[Ç-œÁ¤ŸBx¿ýpü|üÈÂendstream +endobj +3973 0 obj +<< +/Producer (AFPL Ghostscript 6.50) +>> +endobj +3974 0 obj +<< +/Type /ExtGState +/Name /R4 +/TR /Identity +/OPM 1 +/SM 0.02 +/SA true +>> +endobj +3975 0 obj +1049 +endobj +3970 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [191.71 248.336 283.127 260.026] +/Subtype /Link +/A << /S /GoTo /D (winbind) >> +>> endobj +3971 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [394.643 234.787 476.35 246.477] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> +>> endobj +3961 0 obj << +/D [3959 0 R /XYZ 85.039 786.531 null] +>> endobj +3962 0 obj << +/D [3959 0 R /XYZ 85.039 682.791 null] +>> endobj +3963 0 obj << +/D [3959 0 R /XYZ 85.039 657.814 null] +>> endobj +142 0 obj << +/D [3959 0 R /XYZ 85.039 209.09 null] +>> endobj +3972 0 obj << +/D [3959 0 R /XYZ 85.039 185.108 null] +>> endobj +3958 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3978 0 obj << +/Length 2895 +/Filter /FlateDecode +>> +stream +xÚ¥ZYÛ8~ï_áG7°V$‘Ô1Àgõì2™“ív8#?·üþ¯¼Æ‰ñšªA-Uƒ-oI9Àu}ÇÎ ús…‘—€–Q í)vÖ^F6:]¿ü–Ï%t!ûQ¼~Qþðýp©³¹+ÏÓ‹¡öbØáI;bQ t¦žNõ*JC/JRb±Î³òÌ…fý3?«Kí}õåuÕx^>ý‚}6Úžç5ùîRíã`êóò½‘©7‘ÆàÊ÷ü„-½=ˆýîQಬÐÐ_‹Óï ½Y±´Îôø–!å#w8ãJuþצu¾ÿ‰™È>å!Û7Ìu“×_pEÁw$KhÕ÷b]à´G¨cr>ê¹·¢u[Éó@#«‡°O˜ª•I/‰)Öx¨~XqãCÏ,õ¦G>ºñšÈñMuÌ0ò“7–ÃAä5‡â<æNù‰— +½í&NiižæIEဧ촟l¨/ ÿWuXêïl=Z·~¾k‹/(½Xïc²Î ]Ú +mù(ºÊAIñz„22hÏ©Êtê'Ufižæ[ÇÚ ƒtÀwC,óÕ©¡x€éüx¶÷•ÃÑ:çVq¢ ¬Îå¾:Èê=JaC’|´hu-l¡j`£ÑUgZeh‰½T«'Q¬Gã€d1¦´FC: ¢>ЄYã¯o%¢bo¨È8Èe{­|BøÃ7>týÖXÊ×ù—¼ÄfD“j È< ȃ%‘´ò‚0yZ¤Žf9ôx& I$”áZŸökß :YÑ + +âÁbE^ˆY»ÐNÚ,éµÌï[nΖ½§Ôxdz"n£è´¶,úÕz61rÂNÐtÆH‘Yà"køåTÉ®»ìœÝ]#¼tu?“P2p]t6„¼BÂüÃc/…íãLÔÁ€žÓ8B’úëWµL@JIçáäHÆ5%º«ãQD @“{{ûnË k|^lçÒ(š¾8†ã,ÏZŠŽœ‹ŽÖšJ»ÀÎϲè¡+›fƒ-Àòo€\ûÎÃåàCóꢓxþÔê¬âãµÂÅMÂ&LÃ5I—¥bRl:㨠í8¦L—I¢Æ3 5Ë}wÎ13Ê8Ø•í% ðíë!·ë[ÓA›Ó*û-¾Ï˜8m8sˆ½ì÷]Hɦˆ`œri%ÙJ`ªC¨XÁÙ:üaKôæ/›Â!ï Rp觬 +x… òZš–èí;|&“âƒÍ +Ù\…~º¤ñÉ°Ò^ +H0!a[£¬ÑsF¼¦óÔ~özašCz5_I¹ãÁ&•Š \lõ³L¯B&'OJAä©HÓÓ(>N½B9R3uÚ4š/Åq`¤ù4î8Ñ>'n•q©@›Öˆ,äÉh”†éIÊ´g°ü®,rg˜Ø²ÊªÚ›²@!"] †xXžÊ¼c†ê©oz\i`¥M4Õ´&²79#VJN -r—6•ßâ»”(êûxœz‘°ý›Æ+£ÞÛËyæ&20IˤL–w1Ýìê¢ç5²‘À åÚ‚N +Ú˜QiœLŒôjçî§5†#AÆ9¢‘WF­oM~’Ë­g !mÝÕ_egSu!¸¦k¡ag=IÚ´èŒfm›Ï­åªâgY=cÄx½1‰îL'ä)Ìêh"Ðwö€YG'Fº*EÌð Ž}¥Ðõwj2wô„‘ï+αuZ×BžP¨Mes‡ß0‰XÁØè<}ž¯îqÀF¶Æ"c†N§»´ÄtLÓ› ¬’‰f!¬ÁpNF¦Þå\3 8w¨YB‚.µMEŽg·RÚ"74:¥È–Xvª´PYI €`/Š€(³W»ã如N¦X Œ‘›ÂXÿØM+céA=­±nñó9X, ,y¦gôpQ%¡E8¹WÀÝú¸)úüt(L–‡J›¥ ¼²‘;|;IÕ¢úñ­Æq®ì5Íc/´[B-™@G7Z½´3‹ëÕ$ÝÕÔ¶0SÝêKzÁuÜa lºY“„!‚pßÀÖœ‚LèÇ0MÂ@/ðµúB`Ëà$”‰Ü0h±âV›—Ä™±Ú2˨ˆë¢¢Làj.g®³«ºí¶ÌO»ú‘\_|9Mùúh– +©¢{%õAËÒÑ–”ošá‘Û ñàôˆ?ø`¾¯äaÙå\óˆþ‡l«Tr2ƒ”àÇ2ð˜a—Af.èÐÏÂT/ NÄ~ðìÔiSo˜R…v$&ƒ>!=hèšozeƒ±Â¾°YÂœçb$ ÷¤‹lì²y7ß»0Ù…o§Álº¯SÚf¾Ciß‚ÿ´(¢ÁŸû4õ ¶°Ÿ—"C6¼'Ü¥ÎD]ñsǼŒÍz¾+þ¨Ù,FnM¥ýÉÝòC*/N3•™ÑžÙëÂ×åôGò}ƒw¥3…™ ½(NdÒ½i‹lR£ËQð¨Gî´……¤k¼¿PÜ̬Ÿb›Ö9Ø¿ýb+¸s$}ähle5Ê!¸5@o§’‚–"/Öá@M"q@÷±‹âž&®xž1¨ˆp&× 1}°äoKÔ)MJ€=•JòY%“ŠáLŽØv5ÅÜ©·+-&ÈÎ…0‘ ´ÂîÄMDŽAˆ.¦îümüjÌ­‘IìÍ¡X_ºÅß=lãöÖe\úõËxm9à”fexǛɠ+þ‰ÕÙ’aZ…f¦ÀƒDTÕ> endobj +3981 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [209.297 585.761 309.974 597.45] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> +>> endobj +3982 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [330.926 585.761 472.531 597.45] +/Subtype /Link +/A << /S /GoTo /D (ads-member) >> +>> endobj +3979 0 obj << +/D [3977 0 R /XYZ 85.039 786.531 null] +>> endobj +146 0 obj << +/D [3977 0 R /XYZ 85.039 738.261 null] +>> endobj +3980 0 obj << +/D [3977 0 R /XYZ 85.039 717.666 null] +>> endobj +150 0 obj << +/D [3977 0 R /XYZ 85.039 557.943 null] +>> endobj +3983 0 obj << +/D [3977 0 R /XYZ 85.039 536.082 null] +>> endobj +3976 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3988 0 obj << +/Length 3214 +/Filter /FlateDecode +>> +stream +xÚ¥kÛ6òûþ +#Ÿd VDQ¥÷!¯Þm‘lz]ç‚ -Å–m5²äHr6Û_ó"%ÛÚíáŠ`Cr8‡ó¤¬füS³4öÍLšø±V³Õþ*˜maæŸWJ0‚²á¼X^=û1‰f*ð³ ›-7ŽNøq–Ì–ë_½—ÿzþóòõ/ó…ÖÚ‹üù˜Ի+`J)ï?¯¡OÓ‘·üø3ŽnùùÍ+îÜ"ðå|¡¼÷¿\/?2ðí»WŒûûò§«×KÇèè(JkdóëÕ¯¿³5駫À×Y:»ƒ~à«,›í¯¢Xûq¤e\]Ý^ýÛÑâ¹hÆ«¦¤…‰è„€þÛé8#ÑLmÌ*Žü04Ò¡UÐážE?¥³P*ôµ +g‹D)?K‡Ë2á !qŒ—¥”ñ“,œ8eº­›dÚ£¨‹sÁZôÄ€P š³¯3åQ–iÆõéÃÁðìz¯f¯àtvÂ,Ó]Œ³*i–Š?‹ÌÌ„©¯EÌ~ØÈi=_DiB:•ï?ç<*;l×\×e Í–AЇ£0ô˜¾Ö¾2XBÊnaÍ7’EËD;¬ŽmÙÏÃÔ»gzûf¾€Ñº`²§lÊ7J YXÆaá6êx¿º/s˜©h”Žü4MA@¨„èw9ßÖÐìæxMÔ?äÈPK" Z=ð|yÊ” –¹9äÌüw‡«›yhˆÄirÚö›¥tr0ù‘I칺ñŠž¤EôwwÄf±Â¹²à /{qýî–®’TéääûœÖà‘ËÖE±ñj:këlÞ=È#óÚ-Ë‚Ññ¸GÀ1¯ò¾ljîÚõÀM¥ +T +—ìø%Ëø«œô‡¬uàïæ¢-ÅÄ  +=“Ú3¯9#4ÆÛ©¶Ùóঠ1½žžPk{‹ˆP±r5_PBâ3ÀDuVùÑÞ¢ÝÉÊ©³—«]S®W+–¶|?ØÁI+;¼H•MÉ Q/åF`ÒhY!Qneß:í¼HÖkFDyR§nú Áº³ê5SyV½é^Ð’j‚ µ8ó6¸ JW'Þ6k)Ú·¬ZÆׇڻ–™‚¢¨W4û¡ ƒ F:!Kgqy +g¸„9Òa“Ž(2~–<æ‡`!ƒÑQÏ=OìÅæ2鎲lDܲÑHÅŠ.׺Iärή0î¬Jå=Ž•9Žú†[{UlÃx}jÄ_êá®æžwÜÞá h¦ý²¥û;xæä<þyDŠŒòc8Ø(Êý ‰‘Yef¶pÑþÿäÀ0¤šÒ>šOÅ+¥‰vQ/ ÆáCyœ†~˜qÔ‹|탌b_¡ÚF™÷ú{¾?T ã½lêßmmÞ[iêò¤8þÍã:Nø’)Aœ3¾÷]YoÑ4Rïí-·ÈîÖ ²s×1ìf‰­a-€1¹lÉב#ç«yÌzçBXÝ80Å'—zcµ[’ïÕwî‹~'ÑF”Æß(VÔ‚Í^:9zuÙ32K¾H¸0 °MSU¬âÖ’z@Ëi‡À,È è(z|…”\Š/ØöWM½™83H²—ÓTU ²îò‡ êQ째F~rö¯½?ôè cHºî®i×ÿÁÍGÎEXé8'º?ÁnèÌZÂ'hã•On8ø„þS³ù”zõòÉä¹#¾ìÑ–»¢…3‡eÎçÇ>%l’æ `§Cqé¾c¼Ð"_¹.H%èº7÷ö&y‘‹­”WÀyÇ©FZŒbÔɹÂsËù +Íað )Rdœƒ¤Bn•ærd ³Û‰o½ÔñosHòªD½Žbâ[àÆÇD3ðÞa˜ÔQ2b¨c«9tZ{0䪺g +e KÓîmèØœ4rô {]È®¹P<ä{À¤³€¡ÛÍYSfÂÛ\jÍ^2eÂÙ’Ýn9HZŽ+{(@{ÊS’wF^ãîJá«ã¹?0¿éz‰I›8ðÒ9eÑê"øšØjuÆ9ëQy Ú²\[o‘‰A?#OCø ÞŠ;ª#ùv=݈‘¬ Pg©P¾êíyoTË—BP‚&Õ ®rJwèêÒ·Û|‹( +BðwUÅ=)e¤ŒßA ÔuZ%µ¹ß–a9/㬢يÞ"è8äElS$›rëÂa]÷×Û»µåf2y¡*=ˆgßôšà`h3yYu< [·øÛ¡B ·EèNçTÜ7·UŠ(ERrg­ƒ–-÷8~bSk8F‚~$´¾dv§ Í•³‹0Ñì“"¥sŒ¢†#ƒ%‹k.M£’b{d‰­Ñ3…”ñV­ì™3^Wö á—çG¨TJ+~Þ솈æfîªâ³ç#/Ú>§À¬CöLGÖsI‘“ Ú yèÊÕè?hË]1éÕ£ww±?ôuT¥K†%Ó!ƒ@Ë. éVâ¤ÊúÄ WÕœÉÀ€ P:ÄNÇEι˒ã¿G*a˜J”„„. €V$”ŽÐÎŽjkÃ0L¼5/*„F[|EÜ’î—6àë„i‘±±›äŒÙõhšÊ× xvP~Vì”6‹ë/ýûeò{adØ…5âòSÔ PÍq»C„t$À†š£lA³TµbG4C• Eö04µ†ÛC[ˆåqèË,ÁªÙRj‰»}Fø=ÃëÆ|ázû⽄^ÿx;¡É«ª”ë®|"é³Ê™èѬ„ãê(=¢dœö‡ÆøQbë’H +’Û"ßWp÷쯡"ù@á”áËå5˜;Í5i±BÃÅZûñùrÛºŒ`ê$&òóø‹õ‡ßã‰&Ä :`)RÕ’†–m›ëç©>2ö¹”จl¡œL;[_óôtB¹´Cþ”Š³I9¬ACªµ#‡^¹PËï\Ï\|鸤'ÕéÜkî¹Û;rRtf¿ø"çb@Åãß‚8Èý/Xwæ赣ʷ7o1ûSüéâ¾çáTk9ƒ‚¬·"†Ü£ÊhŠì¸*röÅ÷~ô¤ØS–Ro'JNh€ŸÎúͽË`%Ù|0ðCRúÙ͹vҫѦÑ×=£u;ò:•£c_©Æy4ÝRùç˜|oŸQppWÂÁt¼œÍ|ªp¢t´ßT(ÃHÙüýábBëŒDÄ‘ØY\²xܲ\=Ô9®vj¿0ÁK˵„ LSÆâÏíHn3²×]Ú*ÄÄÛßѾvk®«´{ejHr£X8¼†‹.pê£âÅV{DŠOl:ýƒòèfˆqrŒ5C.RNZ (?E<3.×xزiíCµ`’I½]ÞqGOayj©!Z[TÎï™’Drd¥“|h*Ã/¥<¢Câãs_¬ÏD.zaø™_ó©ÅÊ!¸üŒÄWűšdÒs»ïW#$vÝã*LÁ¯'Ž’¼z˜‹uä+ýø†Œr¹ßI¨Ð™§ñÉ~ÏEÅß¾Š¸׳ËڰΦxïo®_âwËalp;*ðƒ}Ë5/ú!Hg—®f„IkÜ'ï«™”ãüõåÂqÒó\ïÎmº›Od îºð»›1q]Ò#×%Hu]mh¯ë|¿Éëí·tß¡.K¨0sß±8«¤ìlHÖÚ“PŽ‰›|Ü:⽆O2-OsÞߣ—™á`„äIpà'Æb= +‹ˆ×ë¡„°kÎö‡Rlê³ š¼[ÒùüD¿tѨ*f½²O•AàÀ63 A~vÀÚ± +“wxRfýM_1*|óþ͆P‘¶£,‡¿ëÉ«(n枀9zÖ.§> qIyò8ŃS‡€8á–?Cqÿ•ý‰ô9E¿§2=¶µN¸swâÿx*çæÉ>ß–«'> endobj +3989 0 obj << +/D [3987 0 R /XYZ 85.039 786.531 null] +>> endobj +154 0 obj << +/D [3987 0 R /XYZ 85.039 590.863 null] +>> endobj +3993 0 obj << +/D [3987 0 R /XYZ 85.039 573.124 null] +>> endobj +158 0 obj << +/D [3987 0 R /XYZ 85.039 295.394 null] +>> endobj +3994 0 obj << +/D [3987 0 R /XYZ 85.039 263.868 null] +>> endobj +3986 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R /F20 2865 0 R /F66 3242 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3997 0 obj << +/Length 3339 +/Filter /FlateDecode +>> +stream +xÚ¥Ù’Û6ò}¾BT•ÅχԖÉÆ©²µ'ñ¦’<`$ŽÄ5Y’š±þ~ûJ”ý°årênFߘpÀ¿p•'~ ŠU–§~¢ÂÕ¶¹ V{Àüó&ŠlšWw7?ü”Æ«0ð‹ XÝ=ØuŠÀOŠtu·ûÓ{ýóË_ïn?®7J)/ö×›,˽OëÐX†Þï·0&tìÝýñ+þúÄÄ/ß¿áÁ'¾^oBï·oïþ`à»o˜öï»_nnï,£ÎQB¥ÍÿÞüùw°ÚÁ‘~¹ |Uä«g~X«æ&N”ŸÄJ~×7Ÿnþe×b\¼âYKRITî'¹ºK˜8b ÃÈWa´Ê’ÄOãŒäòO™ÞçªÝÁ9ºu”{ÏxÆá¡7ôÈ£D×µ¡PyH€•D]2ä ±e?T]+ ´ë®â=Q÷ Žz\o`N×ÃpäEZëªeÎFšòU¸@œhËçu”ñ¼ÝÀï×Qáð*@,›¥VÐ)wåƒ>⪣OX‘‰KB‚H3®ÈÇÄuÓÜÛâ~ueÛ"nŠ@#'|tjw_¼r÷ÀP”sßÑÑi¯=ƒÛrdÑšS}ax£‘¶j÷²£\ ¬xÐ8ÃÝøž„Y +›xÔÍÂY+d¡¢8μØŒa€ßÔkp2p²<Žå€@ºBήÍ(½Ï‡²å%FÀdÝã`îçé‘ï±Á³Œ²èØ1’H +…c8·ÕŽrÇk’è*9°sÍ kÛµm¹A÷@EÌܬàÇAG I)³Ròv(ñîñ‘1ˆÀ½^À¶AaÙ¹ۺ*YxÝÞhņ aÔ÷(Üj8”²Û4;fM"§86Ü*õsѳR½^Pæ­Þ¢ŽP(肶 KÀω‘–ÁwÄ{@o6·¼ÉÝU#ø|˜t|'‘÷®ÚöÝÐ!ä œ‘Çûãºíž®&QÓÕ%±cnŒ[6ZÆ5Ýð®DYç +_B×Ëlâ§ÓÒ“ñLšDäú«od†6Ü’lÅá;ÝOî=ÖÈ*¹Ä”äv`ô¨âßH¨@ùS•zw‡j`²›R·ƒYVËäg²ó­úr_ c2 L4¯1–ý½Ó>é¥ôU‘%!®/7r}èyê’¡Vµä7{¢È=-®19ZÄ]žXög¦<×>u/Hf$rÝ\¬Êïþ(¨ž]=Cr}iÍK +@¬éŸª-iw:·y@¢·´— ¿/üN"&Ùêi€"÷¾Ó£¬[ ³0|®êšéH\ò£z௽S íKºÀn,îOÙ=²÷¨¶Z¸†ãã‘Ä‹stL)‘h&i;¹˜Å¨ p{ï[^$ôN£Ñ'0€'*0 + D®§ݵ¬^™ï°^ÿ +Â÷®Æ²GÄ Ã@ógÏçsg"b\ˆøfH‰™–½©ãÊ$1@Z¶N]è*A'A‰3¡e2ÑIZdMìI­o®ºÈ;ŠoA6χ*Ô·8HÑŽuSŽ¥¹ƒ‰éNtË4÷F¥ã wlsÇX +Š0E󅡺ï²5D†‹ÊLŽAãF’óDqÅ×ër:; +â·cÞ½b¨Ø¸Ò)Äcpj“6ÂdÝ®Å^ÓÅÛIM¦òÐõÆ|À=ö4¨›jm$T™“k6 tu†SŠsúw¯”Tx• •/\<3ŒŽæT¨¬‘B3š}¶QhÏì˜ô凟”›oljŸ‡ùj£?ÈsbeñL2H¢ôú©¬yø#ªv,÷‹Þdݳ¿;ó,íߨ˜o›øà´ÿiVxÖþȵ1`+)Œ –Þk†ˆ„‘©\w•åF7J^×ÞŒ/´÷“[çÐ-pô×ä‡È_[À%;»?ù‘/GÖO„¡9\Slh“íÇ‘¤FwOþE›àˆ@² ’}¶ºf8ÑœŒz—Ötðmw´Žc“…©÷ŠŽ¶ÕœÚÂýüöþí¿yÆdñ};Åü‘&A´y}»YPŠ0µFg£kÍÈY`Ô ¾xm–\3“:C¨Z8áô´ì1/KB#´ÜQDZVB(.[3ˆbM/þ`dáçÆQá.´<Ç^L@N—±¿-Ë]y=Mý¹³•RéÆMNØÃ«É &}”‰¥r8Z¸W¡NAÆR&4ú‹©³ +)n¦$ÐÕWŠµ0ÜZu¢__æ"•è²Y /!õfù‡¨(Ŧh 8¹Wòé¬%ÂMQA‡(ÍGßdJ;Ã_T¼° +ÂͪDòL„CÚe¶ÝžádÙOâ@¨>þ¾;Ž°ÜŒÁG˜€Ö‚˜RSüµè€á棸`5ÅÙ×j\ v´¦fñj%%Y'… 2ÂÁ³Ò×l×è¯Uƒ‹›…縺ˆÄú¾Þ-ÚàªLº+pÇ©BúS—ã8E®Š•~šº}ž4…ÀØ× ݱ¦ã_F‡(óóBHµÙÞÄ>ÒE›ììR¦RÅqì½ïFásJÝ:ô,Çe(b? "×ô?`&K­E²Ô )0&sÚU#B×êšç¼1m;ÏýÖDÌh’8|·=dÉÿ+Høb±’§t`À^S"Ä)‘»hÎ3“©I0HˆÅx½XÚ×¥ e;À!ÍF\vmQÊŒ"/~ =PÁÜð¥.Â,ŽLY€H>Žtmè:œ+J + +²ˆªIØ˹LÝí¹è„Ô­"«0÷œr¥_ò9' Ôë2í¯Ž訮;Ž¥i‰Ž¤¹M]Ù*G-º"«p œÍg\&ª@!ON·N·»¥¸ÜŸŒÖϲU°ðVÌ@z”4îZ“·rV ­žÕM$=ŠµÏ̲æ82Ù×hZB¨ÍØ°®kÓ'²¹j]qÀJRÙ¢|»òQ2©»ñ”ê8]#ë +¤Œƒ¯&m{"bÛbãYu?/ë5 å`ƒ²ESÅ]èºäa%Hë{Y´4æ"಻™iY"=ªlvXÇPLtÃÈÈ©—0šnˆôàËÝ*~ÓD¼€­…ìm¥FÎëÄhI¸Ú½›¢gšVÎ$$€:%0nƒ%ð¥R•19h¹cÓÇPnÒ$Álˆ“ID׶(ßÍ«rN¥m`ã«%Å´ucì”~0¡¥¬4°­³ 1øWžL¢\ùEž~óõÇ¡¡gŽ°±¯âÔ}æˆÒܳ˜$û ]gá½îšÆÄ°îÛ¾ïÖ¿ûá;²Ê7Ù™h®¿ºD±òó(â>ë:9–EbŸYèf˜nªa´²ŸäÞÛ‘‰IQáûá ¹:úÞ"/äáEˆ¥™/|ÈŠ º'i.ÊÄ?뉿SþÉä Ø#Åþ`2G0DP•­í19PöBÀ&p°¬fs ÑI%ÞKFÌ·s§Ô#ZJÏ  ©Ù ‘§Þ:ÐÝÑtÎ0Üb#ËôÔ®’™CYïºæ²\»ºìÑûJ*ôÒñÜ“ÙOŒ‚•4Vœ*¶M)ñø»Yf´qlUצýEÇ0NbʯNãt;Úë5¹Ì(RRWñØÛüSSúóoЊ~®gBÝî˜|.ö”}yÀ䦓ú&Šœ¼'Ï߶â¤Í¥ìkÂ,ÎŽ÷h"ÞœºäZ•E5~Ì©†­ér¦Ço—ˆîZþNÏRÑYk± NÓrÆß5ƒÚ&¼Ó­Ä{Zïa¾¿›âªdjˆšNÝU;ëù‘äÞYh×I.riy'š{DïVx‡Ž5gê%R'žù M—€›.N·%à8˜…Gøií—ÊR†iéIŸŠIL]cê`\ÐlÆvƒ¾4Ùp€’¹JÑÛô‰{’¸1æÀ.Ú,=&S NïUy·ê —òÐ&[KÞp&;Ç%!¸›ªÂJR IEŸç8Báp4~-OÃÜâè›Ù¡±yBèÈè˜Ã õ£0™ò„Ð I‹¡^²Oí˜3€‡S¦NÉÐ48käj!·¿ýøküÊ6ßäw¢¹žHq…œ’¯såIr6­Ûú»´Ò%],Ï^‡å¡žþ®ÅÚøR+Aù*—ö¨@n•Ö«ÆÓB3!ü¨…ܾìºj ÌŸˆ˜çjrkOUgýï FÜS]Çm‘y¦Zõöé¹ï&?¸‰å§Y8tãì*3n'÷m3‰$3 •íORzŽ}qÌìSn&Å`iF?¥ €üQ6°~jþ¦—ÍŸˆ3×â³y½›e\ž#S¦ï®·B¨e¶¾¢h*ñcþ“£s=ƒÿ,™ÿëÏ‘¬¶Æ9$áѲ²&Qwfð*Tqΰù³¥KŽÿ“àt‡endstream +endobj +3996 0 obj << +/Type /Page +/Contents 3997 0 R +/Resources 3995 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3984 0 R +>> endobj +3998 0 obj << +/D [3996 0 R /XYZ 85.039 786.531 null] +>> endobj +162 0 obj << +/D [3996 0 R /XYZ 85.039 283.986 null] +>> endobj +3999 0 obj << +/D [3996 0 R /XYZ 85.039 257.371 null] +>> endobj +166 0 obj << +/D [3996 0 R /XYZ 85.039 118.042 null] +>> endobj +4000 0 obj << +/D [3996 0 R /XYZ 85.039 99.17 null] +>> endobj +3995 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4003 0 obj << +/Length 1937 +/Filter /FlateDecode +>> +stream +xÚ­XYoÛF~ׯ`ŸJі܃ÇCäjÔI« ‚$´D[„%Ò!©¸ù÷k)Ê–”- ™ËÝÙÙ9¾9–qÁ_dNE&Ò,QÎÄÁb3‰‚+Xy1‰…b&$³Í“ùä·ßÄ‘Ê£<˜_|òH¹< æËOáÓ—ßÍŸ¿ŸÎŒ1¡UÓYšfáù4a.Žãðïç0¦eÎ?¾Ã·s&~üæÎqòét‡½5ÿÈ“goŸ1í—ùëÉóù èH•ØóëäÓ—(X‚J¯'‘2yÜÂ8Rqž›‰uF9kä}=9Ÿü9ðâ5ð®CVq&S.3÷Í»‘YâX+ë uN%6%»t%*Ô~›ê,,[° ,|Óô ]f›_x­EÔ%.Ú°¸˜Ît6SøÇûy~Æ~UÁ†_œÓÃD_ÕWL°)‹ºó´…œx^lßP¼v[­×h]ðq2RÆıJШEß~g’}}S•ÂHHf·e¡vZÔM¿òšµÈ%˜ƒ¡e1>§ýçg@ô„"Fƒ ¯7¾ŠŽIª^”Gr²"Ü.Jžj.™|Û•~ãv'F\{4ß_‹¾jj¤Òa±nêR›NTÆ`;7;ˆ†ÕXåÎížYæHo«œA4BÃEáöT’†tÑõÔ€ÌÏ€ï.ÐiIB¾ƒ™g¤9QV5O=…ÔÐ6àYØÞ>:¦ÈqR¡ÍqÄ'¹V:I¡ùªd¬˜1¥Ö*M­`¥Û\¨ES_À”ÍUyº›1ˆE8õäÉÄ ºÈsäs€¸ó;/>äDzوE`ŒP ulÁ7oazÎã¶,Öka°›K¬Á +…K²Ù]ÈIlVA»Ð$`§Z¹4c\³{¯:1è0|<¹t¢Ã§ ãܼÖæ!X ²­*Ù+Áˆ§àÆ9 nÞŠ¼:±<.˜/Ÿ²ðH‘Š+Þ&#ùÈV^DÚËâ~ÖjL»’³ñmR}ÖRv˜8Y,zÞP•Ì3()Scή…+¥Cø¤îC‡ïËbɤ`@æ$†E£]ÂiÛ– »¿R¬(6:âÅi1n¨²²3q|‹²-å, Aö¢†ÂK[ÿ¹Aëµ¥÷»… çåÀª¼ C í„uD1T•1ÆKíUÀƒ÷#DzêÙˆü>$ïòD톴‚ž°é± 7=ë^xxšÓ˜âZȱ0‚4.Ê(s|Zë%õE·”Ì`í²iy°A×P2Ö.QIfÇÙtŒ‘tÃ%¡r8ð]jT¤O·È#šã©Ì¹\E©§2+© òÇÑ‹xé±|çõGÓù\¿_ÒërAm ¿I%£Î ÈÞa.,:Üz;5$ø×.%7–í·²=¦-X*µ§Ó܈æxšÃ>Ù¦1V¾,GŽ2‡Š Éçp“wGÀ8‡ravŒØç¥ÓÃ]þÌóš˜P%·*‰Üž*ߦJʺZîìçÈEð‹Y=Šgt %% òµ(~U ­;è¼½áÙ¶÷Ä4ÅɶfºÖ/ÎØb}ir]u+BðSU½˜z©ÚïมȰ)3{iŒ°µÃ㛂ëõ ÆeÒeù‹Ë#€,õ$Ôf_­xç+~`ƒ†O”n60þÅn;ê·óP¨ÊÉFêÞÙ¥å"ÈWnڨѣé7a7Ü·´d°›Î+TÈÚ‹õ¶ë½•u¦ïhÅÃêÏâìÜÉ¢§”´S¬)ü®$#Iö!Oà€ Iµ§8.QuhÚk?ê‹!”9¹í +I7ê$ êpWC¥¢TœïrâØæ©‚)êçýèÌU±À·kÑ@õÆ;`1|:}{ŸRàýX >sßiÄÑ’r¦žØZw +ý}E ×4®ßKñéŽUÖ,âÛ5jËêñך]õ+ÊA[ª ôU ¾’@®?êËŒSöðø±öÿéSàÐîXèK3}ÓN§*žN„¡Ö.º+°ÿdx_â¹+Éendstream +endobj +4002 0 obj << +/Type /Page +/Contents 4003 0 R +/Resources 4001 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3984 0 R +/Annots [ 4007 0 R ] +>> endobj +4007 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [285.267 598.718 366.899 610.408] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> +>> endobj +4004 0 obj << +/D [4002 0 R /XYZ 85.039 786.531 null] +>> endobj +170 0 obj << +/D [4002 0 R /XYZ 85.039 726.833 null] +>> endobj +4005 0 obj << +/D [4002 0 R /XYZ 85.039 705.84 null] +>> endobj +174 0 obj << +/D [4002 0 R /XYZ 85.039 661.355 null] +>> endobj +4006 0 obj << +/D [4002 0 R /XYZ 85.039 642.483 null] +>> endobj +178 0 obj << +/D [4002 0 R /XYZ 85.039 573.021 null] +>> endobj +4008 0 obj << +/D [4002 0 R /XYZ 85.039 549.704 null] +>> endobj +4001 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4011 0 obj << +/Length 3253 +/Filter /FlateDecode +>> +stream +xÚ¥Û’Û¶õÝ_±y +5ã¥I€×ô!SÛqê$õzf7ㇶX‰’Ð¥H•¤Ö޿﹤$Jí$³3".À98÷ƒo"ø‹oŠ4Œty“Y˜êøf¹{Ýl`æçW±@$©Ó$öÌä­›½ÍT%ù,Œœq›«$LŠaÞ>¼zóAE7* +³Lß<¬oâX…:V7YY†ižß<¬þ¤áâ6M£à}»3vÍâVgyð®m†®­ÿzøåÕOþ9Æmp “ a’f7q–Qy„ ”Á bò°­·*‹‚Ÿ¾‡è#Bq°ÄΦeЮê·Êtm6? Žo>Äét{]„ +¯Söíp­Êã;Ó,T¼pïë¶ÅF˜ý¾ƒãZ³\¨<ØòàßïùûÅ"*«~íq,'äËFñ§ížè7ˆ×Í­ _àaI}µl­uXO\ç6ZAÃ>ÖÜÕPÅQܱÇƲm–·‡‘Á¶MüK€[3|ßó’;˜ûõ5ñˆAµ4‡^6´Ïlì3âK»õ<4lÆ£Ó 0Þ:~r_Wt‰ƒÜ$R1½)‘Ûî÷€C3À¢Cƒ´ x¿¸&M‚¡å¯`Š9MOdÛ~0@8ÊjT­È¤^„Á‰ƒßU¦®eã¯xˆid[ÕûÉ\{@*Vãñ¹ß§«º$cžm/LšP)\%2´öÞî~: Ö°ØxNÖÖt ìDAÓx³nñâ Îàeyvî +\Ï_S©«é Ï‹$ÜÖÆIO„„§èÅÙf4ÈÁ™•[Ññ°È›Ö +æž¾íOº{à _Ö˜'/· +P–eØák[BPÌ„÷±cp : ”‡FÿÅIçD_ ‘g͈o( ÚÑïJ”îœbÓî%¨>ïFAF¨ßîï$ +MoI%I³2Mú` ÿx,ë¿SXpÁàð†!첸½7iðòPS‹„ÆQRÚuÓÝ «•P´³Î"à5áiÜÈà%“QƒßûÊD!X¯²‚‰‚ï,QY4•£ F‚`–ì(6jûD6„°‡>É|EúÉJÛðYv<ßPR^fŒâé`ï´Ñc?1‚Cå•@»Ùx‰ïyLôZ;ãLM¤':%™Ä•›†mrOÞ66rÌ,›y®íøÛ¿ôÁì¸OrÔâJdÑE·#þ,œn³ôaQh”ä$Am€ +6 æ°]pŽ G&·Ô²EæE[fiÎhÒ<Ûúî5Ê4³7øBR¶òà=¯¿êÖì1™sYðÕñÍÙ{Ú™ñ)8'„—8 ¡F}d‚4Û¶zIà"Ÿh+LìÌÆ.M-Ö” ¾wGÎX&AõmrSËAl8C´TßÖÎ#b×Ôõhšëº¿hL?, +p‘ìxÏÍÓ˜Á®¸˜E3Ôµc²#”~8M$\deXæÅ\&¡â°ˆ‹ 9Q¬“0Öë)Ë8I )Rý–Ý?ºx$ð;ï>¶o>~æ¡S£íêEÒ,LTùÇi×_¡A€†OÕð‘üxwÏáUcœ=ìXJÚú ùÁE¤âÞýò+(3 bü׫Œ˜«¥|h+ñ‹wŽ '­³X«2Ôó9ôÿ‡ö¸þ +Þ„ˆûŠãlÒnÿÜQú°ŸšÑÓ_¢$Nüø”Œë¯P"@3‚ÿÁÖ•#J(zo}Ú·ÚN|ègvâ„o*x'«’Ü·¸JaêïxöÛ›ß,q¯ãÛÅ›ˆT¨´úã71®¿rD<¤Þí2k]ˆ£UÌæPÅÓ`Šú:«èÜ6*,k+2.¸à@ÕµÓ ÖH(L@ ïh¸{1Ò„Ãy÷gKV¶¹K ÄR€Ì= u–Ð7Õ¬ï%N÷ ´Çàò4ã”›ÇlA¤5núŒ!2ñÜ…óÜåè£;Ês]µ§\¾aåIÞq|yg9Ç“ð„Ê; ÐÛÝDùRì2zX5 ž¡³n¹,Qsw)Ñ5t" +pÜoA¨ÓÈ"O ò£éDqÝó—":?“#GóA°^h#ûÊùpÅ—º÷¸jº³øfnçÂpî«‘…±«;— ÌªúÏÁ Oäñlã•¡ˆGËWpV×UÀº†ƒ o WW\‘‚榒±öÐñ¹g©=áâ/…âGáë1MT¢³ÍÒúŒt¦•sQ\ºQ)ÅZÄ© ³£z¤Êô”‚áGÜGÌNøîJWݺZ¤ áƒ‹f_xöîWþÿ¨¾ðTñÈ«VOUÿÝ\…²HÃ$Ï݉Í9ÆDåf+‰.Îr6-ÚEò®áZ¢,Ÿ©lÍsIòX´4?ݦ,‹×ÌÆ÷¨&˜c¤)†*Wã^eôgZœ#•Ï‘5¦kX‰©QÒÅâŒígX ã¼®’y®Èÿ”*Ø–Û™ Lu˜%Z 9ÕÈ)mç‹ÉrˆøÒó]šKþåèô##ñHxZ¸Ì»â) Öb÷<ÁUÊDRtûàîbàŽ¯¦¹p`°ØòŒÌ‚Ô› ¸”‡æ‚L„y¬KÔ˜†ÓÈÉ¥£ž˜zFMÉ ¯¦é8fu×GînLcûãºÄŒ%ý²zÍJT¶ç¯“\lw$e¥Ój[™$.Àw7r{'¢÷#ZÜ5®2–—R+ÌŧÀwk|µô{©pÁV“"Àw¸‹â4àÇ45çÖ%Ÿ±i}F£X±µ:“Uœaz„t夰Ò*XÞËÒ•l:léUÁœ!Ôyb,¿«Kiûkž4¾ÒãkŠÓi.JHÆÒÖÉq(g® ßú1?¦ê2¥Ç'à¸$„®òÍZHQ ÈjŠò¿ƬÐØl‡íY†5×$áø@„e~O,ʉ4K-§ ÅzÆ÷…ž³”ŽÁ˜¨«ÏY÷°†+ɦÏY +âíBË»ZLU’2ø°ÐQP™á@¹•H©2¼­šŠŠ·TÒ¸„oz9B¸esOmqƒÇ)D•Ù´±CãB^m+¶è©“õHžq”lò +*Øe‡mß®ÅëòµÒ1†@èlI™´^~œó‡çZøQ +¯†?#W¯gÜG +©‚{ñ»áì&‚ö¦áÖ]3sn…9ìÃëPŸ¢ÒWsï±|wÇíµ/ñn Œ bÅ6¡H4JÆÊ ÉV¢Þ‘”"ÈJho[WÌ€M‡5A.'KB=yC„[‰½ÙY ’ö _e’b Ö ý8æ¬L“¹kÅ@¤¯(àð’«¡GgXظ§óg,=#‘5®*_Éß4•CãõQHq1´AÏ‹k:ÊBfn;D%‰OLuB,åÌÿ<åendstream +endobj +4010 0 obj << +/Type /Page +/Contents 4011 0 R +/Resources 4009 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3984 0 R +>> endobj +4012 0 obj << +/D [4010 0 R /XYZ 85.039 786.531 null] +>> endobj +182 0 obj << +/D [4010 0 R /XYZ 85.039 766.606 null] +>> endobj +2951 0 obj << +/D [4010 0 R /XYZ 85.039 676.205 null] +>> endobj +186 0 obj << +/D [4010 0 R /XYZ 85.039 231.642 null] +>> endobj +4013 0 obj << +/D [4010 0 R /XYZ 85.039 205.027 null] +>> endobj +4009 0 obj << +/Font << /F20 2865 0 R /F56 2890 0 R /F15 2876 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4016 0 obj << +/Length 3702 +/Filter /FlateDecode +>> +stream +xÚ­ÛvÛ6òÝ_¡·¥Î©h‚àµonœ¶îÆI6q6»§íMÑ67”¨”/ß¹„$J~螇¸ ƒÁÜ!5 àŸše±è|–f‰k5+WgÁìf~9S±…óÓÍÙùÏI4SŸùìæÎâÉ?ΓÙÍòwïͯoÞ~š/´Ö^ìÏišy—æÊ»¾¸zÏÃoæ åáÐûl}š‡™÷áÝüÏ›ßÎÞÞX"•ÖHÀ÷³ßÿ fK ö·³À×y6{‚và«<Ÿ­Î¢Xûq¤¥ßœ}>û—ÅÅsÑŒWM7 +?L±ûY˜½¾Žs:ôÔvÁl¡¢ÀOÒô(Znð]< ¥B_«p¶H‚ÀÂÄ^CΔòó8ÆkP*õ“<œ¥aêDZ¦{xßdoµÏXžÄ‘Ÿ%ÄÙÙ÷™òƒ(Ï5Ã8m:Àx08¿Z©Ùe ”Îvˆe¼ 1«2GfTœøy”ÎÒ þ¥Ll…„(Oó0õZluß@ZÂØ+q®ÓÔµ6çêyº½Ãoâsœ£¡ëÏüýŠ`5.X¶ŒÛ,K¼ËvUÔßârÛÕ„xá Þð±î`¼]¯¸; ?éŠQ¦r:ÀjÛó ‘ +½Ûùv«°£íF8±¢û ÿ&å {ÏÀCË_;‹â¶©Üéл·‹’ØSõöjx0–°ÃÂ%;&ª ä #XÂŽ:÷î抉* ›·Ð語§7t1íc½¬–þîùB>Ÿòð7Œ‰®å±m+¹\µÈüŽi£Žm òãÿÛ¬@¥"nWÃP¯ïq 浶”ªÌHÕ}×âÚ C!Ū’%­Y*p8à Øg]°àñuä] ÙÆ}Gä5rìhÂfÀóndrÝ®y%9Ì¥ÏÞÞ1à.Û~àžÜ=f-cxÂDBbwÜÑ+Ã9{É5 8CþÄAY4 ˆÄá ¶4ðVEùP¯uÊ%e»µÚ XÔœ¹FÞÇÆ•+¾*^lùf%¯ã-ð.èk$G”¦_l¬…“%ízßÔé,óS𠉋“ã©î^¬Ù'Çè…~hÀöq"[öï +ˆ¹¦Ã¬Xí@º•Ÿ‚·pyéªHÿŠ±o§3ð0!l*_á¤Û20 hÂææÚW‰E„›ß±,°C^q…DšTSæWʧ¿OZ”*?ÜŽ[ú^]©W°Àuùßs½£ËŒóÜOÂtäHìr$Ô~ªY QFð%Þ<H‰š†}Û`Žn×%é+\uSµÙž×"ÌØ^WOÜ ›Ë­9‚±ÏÅ +qß ÍV F=a§ôã¡óæãÅIîìc…²`bD;,Èà2‹ YðG ÒƒAΕ>½!ƒî·Ãr ·–Å;û}u½³pñýMÄ[ÜëF{ßåIû1œñ4OF < ×xrjCÓýý&yâìw±\Î%lÉ ó ,~ÕõÜ|¬Ñç©vh|é­ „ùkò—Å=÷SPci°›îÉk…ÞuÇ‚·,Ö gc]’[N+ /ÜÁý>F‡÷ +q\SW´tà{¶jŽJÚbtCÂgòw¼~ ׆ԵͷZààC!Úè!úºÇy Aa +Åi6Er+Fˆ´×¥‰PZ¢¥E-þ![RØPÝNøÁ¾Æ( ó.̹TÌgj)¤€^S Æ«iyKêj•×0ð@Jo±µ@ ÍkV…p;÷• r÷vá r¡›Ëx«ckh`|ÛKƒ¢deø |øÎ=õÄ1¯)B,˜†•s}’Ä‘)dÌb͇ {¿•ñ2d×&úG:‡¥ÒWz:¡ÐôšBŸÚÐ(ôþ~“ +íìwŧì¬ü.·6ìFAK!z¬6$¨<(òš‚$¯—Ü ±mÈålÌ춷¢…°n8h. +Æ1ž+¶F*h.‡¨“€ Ôph­ô-Ðk¿qÏf\ËÞŸ+ÌBr‰—£<áC‘ëÂÞ“ºÙH',ü¸ö*<-âCEÆMS”´ÖŒË~Åšçß]âê‹<ŠÖªŠ[q?̱Nv|í*ÛõÙVÝ€†ØÀu’ 2K”£qa¤<%>A(×9zy2F0DÕÁÆeÝ”fÞnäûL¦‚1@5oêRŒ‡r‘ˆœŒÝá…< êû‡æ…5®çû06ð¨žEQê«ð´š0ǵL`^Q²S»‰Žío6¥bÎfW+Ð N>Yò)ÉçlvÛ4Øɼ/ëºý3‘X0aPÑ¢G‚Áz.@Õ°öQ *Dã)û4Œ²¦Šj&£êÈÚaÈH—P“=,S©!¥ٲͤ uC BÛ!Mqs®™@‚Øô-·ÚˆjÏýí†q°('Ê1Â²àŽ¿xꮄî¶éœómÙfÔœÐýg$€%·o·GÜ$‚Í’EЊË`on˜ `µ›ÈÙè@%( Ä®j¬loGþðÈ—µuè”;zK–x -ñuÑ7ÖÙÿ?Øÿá†ÌVDõX/Gý†9¬ +‰SôŽQ:áë eÉi­t€Ž«¥zE/On(Šy°ß”fºû}¾¸Fa‰&LK¼¥äŠ:”:mÏì©xþ‚êoãI´{’<Û‹Œî¨Îáß´®¶è7È÷nkÒØÁد sÒ.èG M34˜Ü’:5×WsRýíXëxá ªgñb¹nœ&xþs’8¢&‘Ä)MBöžôávD2LýL),„•V:.41àl¸`—+?K²]·†÷Äé{‰ +Ò~8ëÀ}©é•6´1DÁ׉M…Öc`øRÃÖºå^9¬¶jùñ‚ÝWà›ÔéµÆ)LU;mì"Â;1[åK¹Sž:îX÷mw”%^þÌßsüÄTuºÿùÈß_íñpr,ãp±½Æ× ÝV†V•¨ÑÁ»JÆé/‚Ü5•%’Ô™ÃÂãÞyW½›é†v´Û˜³¦W •Ç£Ø‡” ¡´p•ÚÒcê/\½ ‡²Â1ãQ©ÚÄS± OÐ[@N8#F†ã÷œ?×R>ÏS¯g5nª Õ_WΆyY’,w ²18Û´÷†98×c³ääð«ÁÖ7_xÝRjÍ5[\À¹;Š£Vܱž;(3‘B) ¿q“´±/f°ñ.±‡uI®I`Š©2¸0zIË]AªÖ<ÔµIY¤¾kµc(¡3ƸúØYU-(gVðHo"»u)hŠÍ#?׫‹©³©¢¹òs_ÅYà9*)P¸*Ì&n·Øk¶à=·‰c12HSag"ÔX|8|·ÃXžsIÁ7¶†kWrÆ+°‚„ â[XEñ#|ÍýQ“ÄiHÂóÌ{[È$Ÿ‚X#ŽŠ›Ê‚þÔ㜼A"ïÉ’ïÛZÊ úËi¯ÔŠ*Ù—2@Ž»±!8Œ×ò-xºàÔ Fzc¤Â…ÖMa’`¢=UÉ0µ\ª…sÃæ²ý˜VáÛUg*[{èÙ—¡½¸7Œ#? +ôLeŸªü•‡A½pÀcà}œxŒ_Ì-×",ì©÷ß*uàCXãlqŠ Èi2€k~$;dŒ‘Ë|¼8ï×@Ìî²ÝQ*I¥|Ž62Ø..ýSóÀ犟qp“*jE HÛž²ù‚òÎ-çpéùXU?ïMXyNeôÛs +"k~ã*ÆDÌ–'8^Ãe˜í3Ëfª|ëFœWÑjñ£Ö1Ó§Œªc?š6ðÇxÿÖïTíÏn£ \ó‘8LÁºE†> endobj +4018 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [387.747 631.127 454.872 644.029] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> +>> endobj +4019 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [155.951 618.184 190.52 629.874] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> +>> endobj +4020 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [253.407 177.601 331.566 189.291] +/Subtype /Link +/A << /S /GoTo /D (groupmapping) >> +>> endobj +4017 0 obj << +/D [4015 0 R /XYZ 85.039 786.531 null] +>> endobj +4014 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4023 0 obj << +/Length 3625 +/Filter /FlateDecode +>> +stream +xÚ¥ZYÛ8~ï_á·•X‘xèÈ['=»›Å$“M,fçAmËmMdË#ÉÝé¿uQ¢mÙ½À HK"‹d±XõÕAdzþų̆‘Îgi–„Vdzåö&š=BÏ?nb¡XÉ£yóöÅQ˜Gùì~=Ì“G¡Í“Ùýê·àÃ?o¿Üÿôu¾ÐZ6œ/Ò4 î~™ÇÁ§ÛŸ¹ùÃ|Øôùß¾ÎUüòóü÷ûÝüt?°à1k üyóÛïÑlÌþë& +užÍžá= +ã<ŸmoŒÕ¡5Z¾ë›o7ÿæâ>3ãQSû5* U +/: +³ÌLÒı +u¬@(Ö†‰I¡Ä¾Pb•…IšÌJå¿Qœžî/Ö66óæ:_IÎÖK=‡6³Gëõ«‡®ØâŠÀœõˆuj 2"ªÅ|¡røˆƒ8jW´ðxᎼ}ñPt%7 I±œ«4øŽgVîV<´ß%<ã™VÐP×nâóG‡½}ƒ«”ø*3 ýÎMV2ãG»T6ÝåÂù¾ÅOMVNíÓ†¹¶B½Bâ¶\ŽK¿à8k8ª\§(hPœˆ+`Ã(RÁœœÁ½”øi‚eQ×åj‚¿Ô„J¹÷s òèºÕC'1ÁžIAEÜ1 ‘Ä&¸ß”¼$Ë™}á`Ê-;'7á«gŠfÍO:ˆªc^»×M»-úqcµ¬èF¸s$áÄ*3°–#áÀ`ë€DYìø£™–øzº$¶4À¼µÁŽïeßqÇ 3ø±tsíYaPì.–Ëf‹£· 5³b:ýAòJÆÓ¬2ªo $¬úªA±5í+:ÚоÆ:ó(UúÑó©éâaôÝ=¯¸—eç–$ÏzKîÛ3ãí¶’©K&’3ü1'¥•Ó\•2iAB]6‡Ý\å ¦6`¦ìQªMÝñLþQÉ–,íèÓ7Ù_é(P Ž&«ì¸‹a×ðGFŒ/õ(ÔVº°‰öÖpæÀ©žH?Ã3<tL²Ô<¾Ž ÑeuD¯ èÕAO×›DP½zUì§!ÔÄ¡ÉSBÁÁÝ"v¥iðóÊæö ~%'ctzè¹?DÓ³Á—¹ÓšŽ§tjƒïþ´iÀ“¶| -·õ[Ãa-"Ý~e%¨!\ÅAȦ.[ò £||† ›@Aå»·ok6>€@d­a$GS˃¦ågM–¹ß¾]·ÄT°jB²¤C‹mðõež™ dåÞ¢üŒ(í°ÏD9š1T±Ø¾ÎØ:¶¤qʲÇ}£á|€IÒÇ£YÂ;"X…§ñˆßÃ)Îøå«gäŽx1R3¨ø&q2#rz;áÔ­»55f/´Ý!ç8)œ°¬ó(L´Ïò9’«ŒB0¦™ö%_ŠÒ\•`z#KmùX´+v Ü"^žNFn x®g8‚¦Z–žû‘8ý`Už§pžÂaYcG/128wq.J‹4f%åöª‡°e¹Jÿð´9•Z¦àuÕbš\œ‡FE0¿1yzÃÎ'é$ S/jÐc€(K0C›ïQ¦)Ëç†sR‘ùñV™Ü€+ÃÉaÎÙŸ³8Œ04Óxï´qcÔðöã6žÝ5ÀéìˆYžwáMÌ*”ù>Ã&anҙȇø÷.ÔјW?cœ’» +½Á¸|ìÇ>ß`zn{@jvU’Ž;ºžs)hlÇ¥»ÃC×Ó‹ Èé«¢®]:IÈA3”ÜBqëš›FóÌù]¤SZIg9ü[qOÕñTþàþF•‡æ›×”-,,Tˆ À¾]ù|Ð £Äl¨'¸{“3ûD[(¼v³ÁLc?Ìäü$uzÃó<ÁY ÅqhLÊnM¾2É¡úž£þnBð"RônF\=ž1–Æ2 xc‰¶"ì~H6\¬­°òT¶‹¶Z9LJ£ëæ+4;§È †ýDP=•;~­vL4”Åô†§&Œ”„5ÝöAœ4ûû\ZK\”MêÈխƺ†Õ,<Ê!V¨›GÊ"p{¸CàÏå*{`âöB„=i-û%Ã!-DútèÞ8Ö!3é(Ÿ†”‹bÍmC½vü”Ôƒµœb-Òåˆód|nŠ'i)ð‘€â­ Š‚dªî…±GàÖQæ`0”ÍìšÎ$XÂ÷†eÚ¡6 ,QIJY Ž~ázøÕ¿hÓ¼›ŽSÂ= ª˜˜õnÝš @©›©ß4 KàÔgFü¼‡Ö9 iµ8>®Òi¯2‰Q†”ËþØ+h$´(nø:Ô2‘«sqa¤Œ½(å3— <´ »žoú ®ýiŒ¥—ÿ5ÿ‹ª«RH­¨pj®^«hc(örÎJA¯Ä(aÏÊþQ- 11˜" æ{¢p‰úŽJ°ÆgÜ5[ªebÛ‡f×·$ÕúÂÍŠ›þ*Ÿ#Íy\6ðåa$Ù/cY*OÇ"Vžqh]-šXx°'U©+Fx¤Ðn9™ØKÞñT¸G|>w ã†ñýÃIUÛÚ¼'Ýf$l99š¾¼ôÅXiß1M#sSÖ]ÔÛ±èeÐ)·/Ci¢Z"žcÇ®è)ƒ´`aÒ,x_®¹Jn,—]äý¡-ØR JÃ+‰¼¹ì +4…âœU¹f*2jö*ƒ _´¢A!à}OƒñÄ›©Xc㢠¸­Ø+uµ¥|A°_-¥ƒÜ²œœDÏ´:&Hnu‹½ÕëcWùªÄ„I¬¯j¨G3X’£²†*« ƒHFKŠƒÍÉF,"ÎoÑ„|³A>[n¾ŸçŠ¶©©Pu]…\N±ë !ÎB•^/)­\^);¢W +AÞ\ AgëÙ‰B¿Þ +¶EûÂG{çó‡Éc¾õ(FbÔ+≮ˆCˆ^ǵ8N×›‡·Þ{)¡Éï¯J¤Ìë¢D"Ф\¿"‘‘èŠD„è5‰\[ÐIät½I‰xëÝÞ}»"‚g4¬Kå’ûé `PÀáæúK[m]ùÁ]6j{dË\ ùž‰¬"¯`Ù¨Ï „±ÆxÂ]0Sy¾/wøe_S¸ÿBfÎI4õuFÀ¦í‡2’±”üQÉ.Á ]ÕÁó×jÌþ@9¤Óñ0¯¸Ð€k›$ø|oøe¨EÀû¥ë>èRQôƒÝÂèì‘¥²—i¹¶]õrSŽñY[¢·699ŸCÏ”þÎMð9ܺÂj[¹†S(ÛKN†.¡u:\.âû¶Ø¹ÎŽ¯^į0?xOn-ªG[òªOÂsÝÔßyXݸ¾~Ë@h_-û¢/‰6;^ß»Y_\øª¢ÂÀªÿ›,0œ#vW»óhyø¾äX½³Ó(“ž‡”/¼Þp+Œbƒ¯,‹í^¨=Pã…ø‘(á°BÙ®i +î•›Œèdgý”Ðbš4Q¸e€Ûeẩœ|jÆ}CÛñÞ¾sÁÀ&YpÛ1¯J ÔîQÒG¿,H‡L›89¦4 È(ŸÀ©F;þê?P;P¦˜EsmZn!¹»o°[á€<ÕľÏÏŠËø.Qs%ÑÝ’ìYS}£l§.ÿøæÀ] "ƒ%Û`ÕŽM\Ïi‹®o®ø1„“8~W×·á¤Vy*i®ý×Ìœ»ìõ5ÁÇ~b¯$=ÈÅ‹ÕS5\«E k†pÔj‰OY†ƒ"Aû–\+¿Æ°Þ¯1`ç&GÐMß5r…"m/żSëU_ôfˆA•nëf7.'ˆÍùnéS)7%œzàE¢—ö–î–½óÂàB†º)z/¯ëåŒ8">î8à{œ4Ä~7’ÊÕMÊNŸ§è4Ã7@DfàÀ)‹è i{˜fÙ˜ É+™cXþ ð?𻙧WG¤wsNÞ®tà_LÅÃÙ¡®Òµ¶ŠB&÷ÏŠ[…eÆÖý„)–Ÿ0É­?6œ @©`¸k}¬À>^xب/«“‰PQn?ñ;ªÅ·á·HTÌñn঒d=Á–Â_úeâǘ,̳ a§Uø{1ã˜A±}Ê0„O‰é ŽÿMÖë‡endstream +endobj +4022 0 obj << +/Type /Page +/Contents 4023 0 R +/Resources 4021 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4028 0 R +/Annots [ 4025 0 R ] +>> endobj +4025 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [241.412 559.852 391.634 571.542] +/Subtype /Link +/A << /S /GoTo /D (passdb) >> +>> endobj +4024 0 obj << +/D [4022 0 R /XYZ 85.039 786.531 null] +>> endobj +190 0 obj << +/D [4022 0 R /XYZ 85.039 344.408 null] +>> endobj +4026 0 obj << +/D [4022 0 R /XYZ 85.039 322.646 null] +>> endobj +194 0 obj << +/D [4022 0 R /XYZ 85.039 264.613 null] +>> endobj +4027 0 obj << +/D [4022 0 R /XYZ 85.039 243.416 null] +>> endobj +4021 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F66 3242 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F20 2865 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4031 0 obj << +/Length 3884 +/Filter /FlateDecode +>> +stream +xÚ­ZÝsÛ6÷_á·R3 øÙ{rìÞµ&ñÕžÉCÛH¢mN(R!©8þïo¿Bewæn2Ž@`,°‹Ýß. .#ø§.‹4Œty™Y˜ju¹Þ^D—Ðòï %K!Yz4ïï/þñ¯,¹TQXFååýƒ§ŒÂ´Ì.ï7×?_ÝÞÿôûb©µÒp±Ìó"¸ù´PÁ‡«_>rõõb©¬úx¥ßq|úmñ×ý¯?Ý;<&•ÖÈÀ׋?þŠ.7Àì¯Q¨ËâòÊQ¨Êòr{‘¤:L-ßÍÅÝÅÜXÜ–\r¯¹õ¦ºÓBŸ.X¥Þ‚•ŠC­âËë±ë_˜Š&”"Ã;Xv¤a¿+!ýÅòºk—´¨¥¿ª”u´Ë$Ê‚¡b†P3£œ4jQ»Š «IaLÃ(½Ú-Òô¢ É&@ñã>Û-W­­,°©iªžv–“Ä o +·À}GòÙchT-|³d\ÓWfFô¤ˆEDœÐèMõhF*¡~ç%Ÿ‚¦àì¦EÜ“î*زÄF _øK„™N ùÕ3rZ’®%ÐMnZÎæˆ$®¹Éí\é4Ë kÒŠûÑþånÀý`éø›†e½¬p‰H¼A›>™?¦ŸÌÈ¥'Ò.²AT?M>˜-÷81i²ŸGÞPƒ¥c_&4)–RVUøeçPñcà1i»»úÀp味èë=Lw|ÉzÏÈÝ…!u{d…G@Àõ‡¾ Å ÈoNŒŸ*ŒÝü|_=²Ã¥óˆîüûŸ‘JšŠªi.:)‰†ÝÎÈ;Ób±@Ç î8`ÏAE ­q&»èÁ|« wídƒ›(Ëð0ñ(žiçˆhÑ´ž.{g†áÙN{ãßZR{lËã•¿-Ò ºtë|¡¸™Ì ­¦A±mH±éfð1HbdØ®v‹UwxÞ !Õ0àfŠIQÐlÌÎ~[ &0öj0ú8R`;´¿Òï[$”Ò<ؾ _k÷è(1z„PK@¦±0Ú3R„9`h +Ô„™uê2wTõe\'E‰pÊXðYF€àQEG¶Þi ™OQ–ýK: ‹ÜŽÚ¡³Î³àýÍ5Ž p΀#O 0P²Ã©øƒðCnÁ +«zÍFj‡ ÃùŒÿuýÙ\…y–û&(: múÌ"8__÷|’Æ@œ ȯ xñ—ú„ç°j$oJEÓ‚úâAêyè¦{œfÁ>_Q;ìd2²ì +|ð¥SûõdlŠ\ì\Q·7@~-Þ[>µük¸ýÌÖ ¯ìqëvt#%A:—ï‘T¦¤jrqvºØ‘† 'žë¦aòŸ™…n;Þ8<%€VÂ)û:ÜÇu©¸®­ìRsTOE®Ô“tw{ýuoKƒèƒ¶ú·ÐÆ*Y–¡ïØáûõéN†èMŠF+žQY¡4!J¬%…ÄÊZÈpÙ8 ×®öà —ÐÍj|⊦3è‹$TMÀ†]q‹B†e€#9“nvÛÎ!¢¸d ‹”†ixk™åý‚±ò\< %»‘X¶Š]ˤh +ë¶â Ô_*Æz+ÃÐÜÎXZÙî@¡–A'î7Ò¿ã_ÐÌw§¬MñrÑíMlNìÓÂûX4„µÁ’‚…¡À¦± ”È$ ֑ÒÂ/•8¶¢¹ò3a'nºó}¹–ÞOd– d?~º—[îvOØ™‰”€’°mâ?±Ÿ5&q:i<”ùdÃ:ßÛâÉ%F®tªC†¬ÈÞPdò•€<î{Þ‹Ô9tœ€±1Õ0¢˜Æ™.Û‰70yÍj˜ÀkRªÉç<×Cõ÷Òü ¦tŽéb“£Šer–É;6^µµ2 ü’$ØÙm2d8`0VdÂ)ǺØ3A—g¶¹Pª$F¯¸–0/üÚXÂêñt>‹‰”à“7R¬™/>Æ”‰¢œ–·è4Ýå +†¡^5•/Š,à`ÞÉ«œ6í¬ÁZÃu¢L™ ÚúÛ#µKù<Š” +²ºƒ9=¡]ËúVè€2'%ýÈY6£B'4ŠÙ` ö#9žð+Ñ®l˜Œaøç8QsÐã8ù‚³ØAgú·LÁÞ—ƒ\–wÏ´Ã|ž ûtsxÚpÄ(ZGŠ»4M'§Ï„$ 'UÐbL …ﾪÛA”›G‰6Œ6¦¡ˆD³u"êБ/fõ掿æ©+ ˆM_ýxœ!¶ÙX]ÀÔ³i]K²œh8«ë§±U\„YžÙqpk€üd:„J¿:SOv€°•.ôHýÉnûãc¥G¥ ¦ÔZÕÚkÀÝ=s/(­;»ó0q°{ÉÛíK¤³‰Rw3zÚP‰'‰$8Ó^ê¨1Œ„pñœ`rÆ…zC2Ñ+¢¢·dóÚ„V8GóÍKÇ›ÏÆAÿ™Äa’Šä“—âq€…NÁj4Ö-Pþ‡«9Á°³v äTùB:²:¦¸þœ ÒÄø AMD¯JˆÞÔkZAÍ7/(o¾«˜;?TÛF¦dµàûN®?À6ÎKF|CäD“Gñ†æÊ;$Ð0å:#Uü»žd_$“lÊša;8PÂxÇ¥ÞL·½8eaÆ7Öõ¤ ªÕ +•§¡+>0²Êä7Þ὞Iäb·Îf#­¹–Ì#G¦ƒ¯†â<ÍžU/PûL¿e¡'¢WÔKˆÞR¯×&´êu4ß¼zyóÝtîÛÍòjx¤aûƒ,ÁCÎ*U™†i¦<Oü‰z¡£gmŠµMél …‚_wó‡µ4r& +à ‡ýˆìH€m=Ik¤)$ÇÎã¥,…£œÏ™v‘ôÉÅ UÞ…ždoI-FÊ™N;ÖZÌ@i‚ 2ž¯—ÃLv€šMfe¡ÎúMuqÅ“Lѽë#Dãr™QðÅÑÀ$qELÁA#TÄÓR±‰.¯²hÊIGïq]-óll&?ÌÃ8s7ùßá©ž¬Nšø0¼j¹ù „p°rÃp,’s9_ê;ð/Kc\ÃÈ=÷’¢iŠGæ­ËÞE°Ø.¬þl9f´P[¶•Ìî–vŠ³ðô$¤=âëÕ ®"Ô+Z…75êWÝsÆšòq½xN¶ÈgC<¾)I9xIÒƒäë%¨#a# Xž»I› D +Ú=—¸›ô 7-zÓH3ȯ´b¤™¤GÛbu;Åw Ï0]aœ¹úuG.Ž8xîš0ÖAõ}Ýì7AŠÄÊÆmÊ¢@*»Låu'„×k4ÉV‚ÃöðÊpeüܹԣdZHºÂËÎé6ßšÄê•øÞ¸T›é't4:¸{,Q§Sô–€S ]?ž,ŠøI=éÀõœa§÷Ëb0ûN²uLÑ Ö ?ÝY-½²NTìÝu*íaÚ]Ùy™¾ui×BèeÌ⣛TKÊ ¬„Ù‘†7Ò‹,¤¢;>RfÑšlpœÞ6èPvd/+®nPµµÅ”ç +`3B¥ÔQ†2ÿíÎ]BœßEªÌNFKÑg}¶îQ»ÓÕSÆ ËTÿ]ö­¯ýk`z$Äü¶fÜSŽ/§Ÿ{'˜Î»~&=]?CãðD÷† ß/…_ñm7òÚ§ j0Óóž ·îåMßìäR_ ÷èPY¶ÜF17Ÿùkn 1ìw.½ÔÙI)CLºÑIeÀŠ À3N!±£=K’ƒ¢J#|Á>¾;ÍÍL§L޹Ьk;ù`ž0&I0I…ÛÇSš†qFé›{ŸÄ‰g“)fÚ[o® ìKêÒo£‹Œía&²äqï¥Ç÷ù´ÕÞðVûù|?8¬­¸w$_»¸:zÁ*;,5wpbÙÛ¡RÍLvÞé¥À!Þ9»Ë¼Ìq(ÉX—¹,g¯¿‡ûTâߟäºápR3Ì]"gE§D,í\Øtjœ3ˆ³”MV /òÀjëƒ+Ùv½`­¡_ûFcÍ^vk»K]¤‚f'4³™a¶HÂ$Ó2ñç®ÿòÈÎ Þ)—)Äi)Ä3yXz†W’‰$ø.ÐÞÞZ¦Â¾t; T‚‘#Îíü”ŒÝð3̾5ÁûÓnÄG¤½Mºžl–5eol–‚b¦sÙQ¡ÓmJT˜¸ÇsÛtΖÁqOæÃvøã•üOï€aIŠ°,ây»’Æy˜å‰e×$Ç Û÷§ÿa£üÇendstream +endobj +4030 0 obj << +/Type /Page +/Contents 4031 0 R +/Resources 4029 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4028 0 R +>> endobj +4032 0 obj << +/D [4030 0 R /XYZ 85.039 786.531 null] +>> endobj +198 0 obj << +/D [4030 0 R /XYZ 85.039 149.668 null] +>> endobj +4033 0 obj << +/D [4030 0 R /XYZ 85.039 128.471 null] +>> endobj +4029 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4036 0 obj << +/Length 3355 +/Filter /FlateDecode +>> +stream +xÚÕÙrÛFò]_ÁÊË‚U&ÌàLÕ>(’+‰e­Ä”R•ä& k ʲöë·¯ÁA‚tŠ~Ù-—…9zfº{úºþ¹“È·OÂ(°}íNë3g²„™ŸÎ\˜ ȬóÃüìüÇÀ›¸Ž;ñdþÔî;¶“yú‡uùöân~}?i­-ßžÎÂ0²®ÞO]ëÝÅÍ-_Ng®…C·slÝOUd½ÿuú×üç³ëy‹BIWkDàÓÙ9“ýù̱uM^ íØnOÖgž¯mßÓÒ/ÎÎþÕîÅsÞ„WÑëëÈö#½O°ë÷v•¶•r'¡ïÛÅ7[ *Š¬iYUÕs‘âPh}˜Î€´ ;±UâÔ6Kz»J¶H1p4èàF¶r"À ·~¬êËzê+ØsÃÐtüèѼÎ52Sέ›U¾aLòÇ?㟪 OÆx”U{V¡Eû,ò¤à™EUþé¸`¿|®“mŽd”ˆÌdæÂùÀ<¹ÕY@[ÔÓ™§RZšOy k„HˆÉ*/»qA†–<´@Ð +å34jd#Î5ikà(w ½’ýÊl‹g¼L°ª†‰²é*øæ• ¹J†IˆJg@ߢ"Ì×UYÀšWt•õÜÁ)÷Ó„ 2xªjn ï¶ÿÀÝ](Áeлt¿’ÑEmë×iäY >Aä’„ÑòF¨dàbö¬×„~ÿ´–ÝpX§}¢IïÁÏO¬Ž¿ÝÁíû¡µ­øûÁˆ†ö# ¯€†¤féLÇ3ó÷Ýö… õ§x‡uE÷œf&ò­‹e’—o€a¡oý{pÏ^hö¼¨»§›,²¤þ~̇ڕX×—ÊÜ(Yd£±BQ†.J2öR’A–ãkk  ]ës…¶ãsÆÃIùÊ€`D`Ùâ¹&­yËHô ‡‹“i”`A‹#sò¾³ˆ´è@ȱy÷PÁæá`÷«j Œ&¡í»™Ø•-ÂBRˆÃÆ¿ dÂsÃ25T>&)D죔,X;ÅU))@ò!aC,Ô í=«pàÀ´fÏÑ)0#›º¢aVï”ý / Íî •ò{Þ!žPŠ¢j *1B¡íÂoÖsx²é.O` U¡°šðXly¦eÌrõ†ò¡¢ÌWh]HØ.…µQá78X/«¼EÀ 7vZ½Q ³i%ÚÖbç^‹´%ÁvÁ†`AÌF­ñÿw‘®©› §É wÁE;óf„Ø—íŸòbƾ¥0Ù‡‘*h´ Ø]oóûâ ƒ:¾“?ñ"óM™4R!}ÇFö%o¶°ÀEî»\Ð…Hr|^Rd’˜ÿ‡Æƒ+ö}2[5 uÁˆÁF‹æY« í¸õÑ&~Â+ÊåL&§ÐËÖ=±Æ1„¬–è/´‡Ò‹›‹Ý¦@Kv5ìÃ6a/ó5v–Kv€ &üÙxÛ$M#ÁÙ˜‘o$å2³wS×U¶vÕÄ÷]Ûc÷ÕAû1e*c9Ûnp8× UìÃ-W;ûÌ Vx¹vä«6•;#1Ú"ŒôC;ˆwÚdUHímÅŒ”(mH*ƒ{oÇœžL>M€l/¦ À´‰€Ž08¿Y»“« +0 å}g½9ï‰ú®2òIs+#Âè‡PŠžKÒÜr‰C1ÝzÏp‘·‚yŠO`úÝ=æeJò7ýÒð&†8wÎ]å8_¿Ã‚;nÞQ°0 ²†ä:'cEéLl´!ÏJô:ö¬f% [¬{Qnì›aiø•°Æ šýçB¶¾âÜ 1Álþ.£¡ý 'Ǿù‘cÚ üÖÃõåo÷°âZ"]ÜázÈ. ÙiüæÁ§˜ÐÛùõ•-O<Áj‹®£ B‰Æ1€žEÐ]$˜æõ-4AÑ{`l4®8%IÈ’ƒõÓ¡‹“%Ïæ[Þ–M5m°/†œÝÊ©EþÑä©l*pœB±1.k²Š^‡»Ù&ˆH:KŠªÌÐ"óóÂØbÌY´oÝì/ðšèl¿s"O½ÔÖ¼£§â5…‡Èv²H¸Å×,(§†Ö ÁµÓ0§ÐG_‚ßG2½w‚`·s 屯E¶Ÿ ˆTÜ]ÁâK¾|®jÀ•¿ƒ±n>†CÁ¡í±qÎ0â® %¿ßõ#±¼‹þ0¶j†5:mí)¤‰r#öëûʪ=ÛYï–\-™ùæªÜŽWÄo2ðXœKHˆÔùåÝùÅÖUXeøD3tìȪ½rœÜø!øþÆîé<èÖa‚1êšr.Ä657ÕäKŠ!¶{,i«%þÕœúŠØÜW…Ìbuô^ +K8ùO†îŠj5¹¨Cñ[yêtŽtëpD€D.Hdz ºà +jÇœBæ(ˆŽnÛ2(ŽÞ3+«â¹.FÞ<F (‡ýC×ráy`d5õ¹rÄß +ðqììˆ,ø¡nõݵÆÖúñ±ë™˜¯œFvÅ8ue@{e* @þ8 ô¬~D QUlÔdNWµ©µ‡ý2! Þ°ÌdËÁÛÁ drà`ÛJ{¬30ÇñÞÝ ñ>ªK`ø]OŸ®KÝú#L ~qòìjIίÙq6‡,';½ëd¼]'s‡~´zÊ6\]òsÐbŠ1„8ÝõÖf:â‚°üE&R•{ +’u(ÀÜ]]ɲ‚‹0±E1Le_Іù"—2Ú ©3&KÞ9¨ŽG^ialŒ *WÐßP‰›ceùç&Yf9*Û‹ƒÓ9Ú­?ÂQú›Nýv¿ÀŽöøUlþÚˆ½'³Ã9Jì}yÝú#ä ÕsSNXPú±ÈZê—ðgÉU Í¥b“§K¥LžïDÿöKk‡éõ|ˆ»ÃÓéíÖ¡W€ö®“bÝåNØÅð^^c·>ðôÚÚpzïƒE’ÚÈ㢄1iÏ|zîâÀ:°!)¥¯¯£.q C·—8P¬=Rçh´Lå°–Uuö /$§—ßQmB¦öM`¿®Çýàœ¡eáeË)Úõûƒ÷Ž_uzTÚ[äÞè66wãÈÃÓ#ÑÞúÃ\0@ÿ±9þB©Óã‰Þú# *ïE\^`ýJ5É'a7Y Ìеîë +Œ‘®À÷œQŒß·l`‚üóno³¶n_æc5:óØ»MöˆMiðI× äéŸÖ(¶áÜl±HÛm»IjzRYäzúÁ1s ×)cs¥dã¸úÐ^=L&T%Ý“ê°BjäìHT—È×¼ö•¬›…þéÒÓ­?"=„øßS%ø®Öt?Óý1Æ! srÔéî¿·þô7ÍâÃkû¼•­ù.$’AhºÚW†äW¦”ÂÅò°ÑsCÛ Owù½õGh z(›-ˆuï'Jüæ$ˆºŸøñXÇ@)Y5ã ¹ Ãß]î&w¤ w2òÝþÖWÄ¿:Ú 6•î~ÿÄŽ $¾–ü”ÇÚy½'8ÜML¾X×4R𧺽{ÀQü5ˆ±ÇÐîÅöŠC>ø´ODûtåéŽN ól¼Â/?QÕ¾íéQ¯ÿyëoúõjûc\+C&_…vjƒ Òâù»›_¹îcü_Õ!SÓendstream +endobj +4035 0 obj << +/Type /Page +/Contents 4036 0 R +/Resources 4034 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4028 0 R +/Annots [ 4038 0 R 4039 0 R 4040 0 R 4041 0 R ] +>> endobj +4038 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [372.214 454.382 454.872 467.283] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> +>> endobj +4039 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [155.951 441.438 176.004 453.128] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> +>> endobj +4040 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [430.884 336.518 476.755 349.42] +/Subtype /Link +/A << /S /GoTo /D (NetworkBrowsing) >> +>> endobj +4041 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [138.589 322.969 301.915 335.87] +/Subtype /Link +/A << /S /GoTo /D (integrate-ms-networks) >> +>> endobj +4037 0 obj << +/D [4035 0 R /XYZ 85.039 786.531 null] +>> endobj +4034 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4044 0 obj << +/Length 3078 +/Filter /FlateDecode +>> +stream +xÚ¥]sÛ6òÝ¿BÔLEóÉÞ܃c'M:‰í‹ÝéC›Š¤%^(Q%);þ÷·_ H‰¶ç&Ó©,‹ýÞæÁþ,Ö®&³(6®ýY¶9óf+XùíÌŒ… ,8ïîÏÎ?5ó=7ñ’ÙýCO'ñ\˜Ù}þ—sùñâöþý×ù" CG»óEÅÎÕÍÜw¾\|ºfðå|á;º¾ÇÑ×y;7Ÿçßî?{ß³0`ÒCdàŸ³¿¾y³˜ýýÌsÃ$ž=ÁØsý$™mΔ]­B™Wgwgÿéiñššñ®)yU`Ü ‚Aè¹q¬¦pßý†SûýP› /­]£¢^_¾èËWÇzf‘Payš(·ðg…êQNŠãœUµA ]•ÛqCÍ+°@³o œ7ŒfÎê= nQ»]{¬]ßÜÐfQ \ê·Õê„Œ<¥^ä÷Aþøe:´Ë:<²èc: ËÕ€Ҕîµ°ÃM´&-ú‘k`@ +L…Z¼®AÔ….N%et£×#ÃÎþ™ù0L’Qcbÿ Î?müÙU |ÎF¬2ÙÅ.<\7Cpæ$ˆÕ¯u +¼’ùz«ûƹmê¿=_UE‹óÈA¤-z¯»ç–e£]ç×E7"ç -[ãŸæ;ÓØͯ«’Ì_ÎQ0hy5%ÔB&èDé6+rl‹nª#cb´$ÄížÔè˜Ë7ö€mɬ5è¢]Yo©«weÖâ8qºuÊÆÁ 3Áœáœõ±h”–ÂúÄ’a >¨™‰ÀK"J ¼Ô¬ÄZ_i±ôS ÓD™{S0G_ÈøgEêd5-‚Øv¨­ !l»Œ=Hf1ø`ìƚΠ‚³ MxT¬Üò±EÂS%axÊM Ƚ¢-‹ýúéÇ4I[ä†àsÏàH±¶êZ±³§Êí*O¿ª ‹ó; æ¤hÄN¶Nw}.hÐõcåÔüÛ­Ë–¹¤ +ölo…jÔœ5E—˜ÙWkôÈÊÅ#ÿH©ˆö†Á¥ôÈÉq¾­;(2òwŒqÀf4Œ¢ê™Û±Td%:`ÆÀ®¶T‰ÆFÚf)³Û«K¤-ÿ’0ûl=Ë„åC ž¥X ™…òÓUÚRèlþYnYc¨™–aX½g‹é(eŠa9ËjH2x™…$w]BE¾«Á¦‡´ÿE+•^±À}ÉÏU¶qEò´ÿBaB7ü™F·õYÛ¬+[©©úÈ”äƦ®*ë>R½K1S*èw_Þ_~úpÇ3)ô¨è¢±¥ìûëKE^G‰êéF¯p€Äª‘€±k"ÓSBÁE£“¹ zõ@é”NΛꔆç}%ÉW¨Hò¢ŽÂ;ÐT.ªj¤ÒR‡­UkC.@¹Ý^T²I–Rž‚Á¨­ÂñeÍí† +õà¿=í‘Λz¿Z# zY:±{÷é掑–´žæ£ªª9G¥,lf ò¸ t‰j¼¸Dwyf…Å­0¿&†´‹ÑëT}õ5ZÎ-l‡„Ð0h9 úÑ˪­0{!àŠ@ÊaiÛ góÖO³ÎW·à¥Úô +PÀ jÎ2ÚP†ƒŸ??]ßñÈvµ#£òÒèT‚ôQÛ[fúµ`<¢°tHä\áýCŽ!ÿ µv.ˆ±®”ÓN…¹*{Åf]Ý<ƒ'ø/F4¾VoDÝ镨¤·¢îµmÔŸ7uƒónÎû ì2§æ4†„0,"8¾~“ûÏ7¿Ýàõ.†F+3AˆI³nŸV¶ÚbÊ?F–(ûGhɤ`ŸÒâf ©ìx„‹ûm;a¬‹ˆã(v2ü¡ÀÞS'Á´¤Îyˆ†à¶“^¡®Zèb_9÷ë™SàJå6«R.sÛàøsº¥8Ú2µÏõª–!'¡†|’»ðVG¶ó§ èù+Þ;*¿ýÞ¾´ãà³0LVI!é]wJ+; v\cÏÏê='¼7Žá€Áã5JÔ¸ûg…Òr1G›×¢npPúÍëQ2@z9J,ÒQòê%'çMEÉð¼Ó(Á‹¼h5Gº‘+KÁãEƒ×ï1v`‡Nã†Fѯgb¢þaŽ=,:fäKÿÇNKÙ èŸ +rñnÄÃÀìkŒ*õ‡Mzè]F.¸4=ËV!›IÇâ£bÕjß'A È›ïÓ Ï\3öÝ {W£ “õ9Œ×¾ÚÖ”%z¶ŒÆ …hÅ«&ÎvˆhƒÎ˜CÐÁx¨SÚÐÇZ&Ok;`sÍ(Ätì`_S4Q;¢ \Ÿ0fxw4¡Gè<È}Î} gW†ÒUõ\C9®9UùTºQœ¥*`™ÄSZõªÂ„3éC‡E§ðJyΖÝBì J`„1ïa; +UAc•ÖÔ’#îÂ!w‰ Ñ„½v³t¡©˜C{®ñCÁ£;´uLøÕøBZ"¨¸ÐõÇj˜ærjG@p[( v@ÎÑpý!e-í)R‚OY¦Ao^Û h/¤w\KyÚ›w2À¶y8>xÎÒ\u}ëTÍŽ3"vŽD»e8y=õ†Â©(–ç¼–5%ÒÑíIdÀ€Š=¨.eË(Y*o{2ïÍ cÊ:%Åá3ƒ­hxâDKTj^Îl·™"\yU_²ÙîP.ùªÊ5Lù ÷ÀˆÌý¨ò•Ôk„A^b–ìÆ^:@+ùêŽÃT@)ÿ =Å_ºAeÚ<Ä—Íá–:„?Ô2(»©Na%RUþÉYçüÔÖ|_ùýŽ<ÙôE ,îÛ¤öbÂóSó¶¼@ÊTž^ñ2VžÏôs¾T7ßñ: —ÝT—C¡«Eô4·—‹EÙÖx“ÇIÎ(í9‚û:²bf+d3ïùÎVVH/ˆ–±.v}RîÄÃÖv}rÒ’s´È[—}=z²$®èÕG¸Þœö;½›C´?­Éyi2¡>óc¼6EÊ£ÑKžü etˆ7—¡;ßï_IíC9RVc‰Ž,¾„ô²Œx( H¨a`US|ôÍî„þ© 'ÔÄ]ï/H(î? f E7Du¸êe=¶é  ’Ù^Q{ÇZ æS™ËC,,-G*bXÕ_Ÿ;b$âkqòTâ˧rþ‹xÛñÄê…È”*ÖaXͽ¤•SÎ}–ÊåÖRêܾ"…ÐM%úÕ/]jùXTn¨ ràF¡³$î´⃡‚|KŽ±™Ûï1&r.çä*të®±ý†l±à%¼.ýH7;ôgC†æ¦ŠlÎ]ô´AbÜ ˆ^•b€3ѹZ1"åÃvO¡ê*× …¥g¬‰w<£tåivèÞÝ€UyæCœ” ‹¾W!lб +Ö-@ðáRyQߪ,ïÉÝ![vtÑ@õbDÛQ/òc;½¤m!·ÅvXC<ø´Á1ž«âøíþFiùˆx.纬“'ùeœv]ÑgÎŽaôÔáIíüð]ÅNã¹¼¡€ã6Íj¯^l_ûä {0g§ã¯˜*·=7Ü-àÆ2 ²r;xCœjþBhÒ@ oë&q•V‚·±—»tU¸|zä¹Gg,ìèøÍ“ÕƒQòW ~¶ŒþO®¨°ñÒnôÅÕžÎSöÎ_'Næ#òˆ3èt9üµªêeZ}#)ƒàp­aWü×]œwi‹wh¶ÐªR›JãXYM5%PÍ–eÝ2wR8ú7ÿÜÞüv3õ½Žºì†È×_¯?]Xô r½$2÷Gkù¡€ÃÁ—4[—[9ó"×ÎJ’}/¶ùDÔ µËu -aôWuù²M7¿ˆÜ›å.mÛ§\æUžî«›çöŸê0ý±LVû¢í&$Grù’q–ÌâHãFTNò$‚·ëz_ ªù4Ѹí‡AnïCV5õ…$Ž´üÄZS?µ“M€5uU<Õˆu£Nu½kŠ‡¢¡Ï¦ÇGÈ®ç¢}©jWñ?©8®#ð?3ôSÿÜ¢¯F*v¸7N# Z7‘²Ì LÊ3¬Ã®ˆáÇÿ[âNendstream +endobj +4043 0 obj << +/Type /Page +/Contents 4044 0 R +/Resources 4042 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4028 0 R +/Annots [ 4046 0 R 4047 0 R 4048 0 R ] +>> endobj +4046 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [380.998 669.256 454.872 680.945] +/Subtype /Link +/A << /S /GoTo /D (ProfileMgmt) >> +>> endobj +4047 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [155.951 655.707 181.035 667.396] +/Subtype /Link +/A << /S /GoTo /D (ProfileMgmt) >> +>> endobj +4048 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [203.943 655.707 296.401 667.396] +/Subtype /Link +/A << /S /GoTo /D (PolicyMgmt) >> +>> endobj +4045 0 obj << +/D [4043 0 R /XYZ 85.039 786.531 null] +>> endobj +202 0 obj << +/D [4043 0 R /XYZ 85.039 316.95 null] +>> endobj +4049 0 obj << +/D [4043 0 R /XYZ 85.039 285.424 null] +>> endobj +4042 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R /F66 3242 0 R /F35 2880 0 R /F20 2865 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4052 0 obj << +/Length 799 +/Filter /FlateDecode +>> +stream +xÚ¥VQo›0~çWð2-©11°©šº¶[Wmm×æeJû@ÁIÐÀÎlÓ,ÿ~6Ø ÒFš"‚í»ó}÷Ýù°gùóì¹FvN\=;),`/¤ä«åi G«8 ÏSkôeâÛp#ÙÓùvŸ¸(šØÓt68¿:»›^Þá¹C'ÂÁÅíÐü8ûvS/Ÿo –n¦jt?‡ƒÛïçéµu9ÝBh€ô TþX³'`§ìµ\…öZŽëE‘]X>‚.ò¡žçÖƒõs»W-óíÚª/^C…°0D€=4v}í!wâUÄ)-⌠4Fƒ"æ³z|Z¿6˜«È¤ÇS ¢Ê(§Iœc3\ !+›µã¤d™Ø˜™Yðzö(J.êYÉ;m›ÓXxMx¨òtPý0*L¶Y œÖÓUÌùš²TãŠÖƒúÅðŸ2c¸ÀDCSÖR¸»8ßE”ây\梅ææûØ5µI/ŽüF-~ËÕŠ2mßLnN”ô%³Géèl®—Øp#¨ ¨YÚepÅè<Ë1ÿÔ[LÒ§‰W,[Î=è«çÝú7»T+åa¨2ÞJŒBô^/-i¡•R™ÌDÂÖ“´³_Ò2×Ë™f÷YË +Z’méÄâS–½àVW^·ØÝcE d@/ò TŒ¨ÿuF4M¯œÁN²ù¦ÅÌ̲¤QZ7aÙªSæy¾ã“wO ö#–†þ½40œÇbKÃÉÉÅíÃÉÉ~ ˜‚K­7#XTÈžLNÔÁ|•º&úÓFlnR¤•¥3Wݱ‡%‚Ìylª¢öÖæ¡ytJ£y¾k3 H èJhœîëTþ¨älTõÙ‹çx”gÏ#³K†c]”ä›#zøZ¶HOžñ6GDÄi‘‘·ê£DÙÑ5€n­ÌŒ¨KFÚåÿU=nÄ I‰Ø+÷ã8!´G?‘†ù]ûݲúºg»wtÍ‚Ú¬çn‘ë×Wƒýï¹|jÿumØÞ‚üÐÂñöNà5ïH¦uøŒ +Éö›ëEñ?;¥uîendstream +endobj +4051 0 obj << +/Type /Page +/Contents 4052 0 R +/Resources 4050 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4028 0 R +>> endobj +4053 0 obj << +/D [4051 0 R /XYZ 85.039 786.531 null] +>> endobj +4050 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4056 0 obj << +/Length 2698 +/Filter /FlateDecode +>> +stream +xÚ¥ksÛ¸ñ»…¾•š91ă¯vòÁ±’67®“&êtnrùK´Ì EêHÊ>÷×w =Ó6“q,‹}ï“þ‰I‡‘Ê'i–„±“åæ*š¬aå¯WÂbÌ,ÊÌÃy³¸zõ.Ñ…y”O< +ã<™,V_‚›¿]\¼ý4)¥‚8œÎÒ4 æ¦"øûõû;ßLg"@ÐÝGŸ¦2 >ÜN¿.~¾z»Xð˜J!¿_}ùMVÀìÏWQ¨òlò ã(y>Ù\éX…±Vv^]}¾úÇ@‹×ô„w’WË$”) $àÈÿâ8ç$ô©ã"$“…Zê³thWtxÄèê€ÎL*!'³8NÃ4ÓƒR9"ÌãÍ D&¹œ¤ e§d‡»ôÛ£z‹CÅ:ôD'¡Î‰æä÷‰#çŠq¼1 0 +F€Wï7b2o€ÓɳLwæ&fEæùŒˆ“0×é$•Y("AÌ.§ÈçLIÞOgàÍ“m§H‹‹ª/ðÓ¼c¤ù†(´% +Â牱0@ÞUO:Úßó¤y€¯ÈƒíwOéÍtØF8´åuŒfèg9 µ*~„®‘¡TÁFH$„Û§¢ýSÇK›†Ä]Yb¿[­q–,aÐÔSq"ƒL-q”¬©*’ùÙaÖk¦sQ¨c¶ÛÚCiË8 +â¼+ê¾4UÇ‘lª¦fTü‰½z§bßØi(2ð¥Â,UDÿ¹i¿­ÛfÒÅ2^óçîúÓÝûëSZl6¦¬©jÖMÝííû¥Ø“!>Ú³1]_´—ö؃ºb¹kËþeõŸì%±ö|xvB®Á‡“40«LʾljT{ÅÐ nŒêLö ¤–Lƒçš¡¥ý²%€(}2!°*»~ÏâxüAè·û0zÒ±ìcì°£ƒeÇB3ógCly¾±Ä Íf[‘ä$õSÙ’O°|u¦Š0=z)í2$¦a‘§“ÙÚÿÿ´½ŸnU–ŒlÏ©¥ +¥(6!³Ö/Z«ã)ÈX=¡»ƒX(E8è< °¯Ìƒ¾³ñÖð"c³Eo0d¸òßv;ùƒ’cdš{&„{rIŽ­1­Ñö­é]ú8*,t 0“§»Q1#+Fï)& “4(¡b€ôèD¥¡¤_>QŽÏÛ3„[fñÞyoÑ÷–.Á½l{—žVÓ™²aGÚ|F=5íŠÃB‹ ;Œ&-â€UZðRQƒŠÙ~HHƒ“,ÞM3°fË;6M[ðhUô¦¬:ž@0Ð׆5%hœ£ Ù~‘ÑDzûéDx¶ÅCa#v*3ÍH™€/¡+EñJ»¶õú“¯VFžyØ'ÔºO9¸^r¨ïØUÙ½Þ£ªšÖ»ó0ætnzsoº!S€6É—·=§T_•èPCgé±uäç2ù³=N˜r¯wÞã=¤óï¾ãñ´tÞ)÷Ï[¸4µêiHãÖ_F§Æy>fƒ­M=­]pÇTemǃÉÇ+^z4‡)ÆV†/uÑ»}_½³ÈâmqÖØÛ§ú;‘.À"}Ï—t8<祿óÈZ¤¶§ÄxسÃarIýä’Bç…cgÚÂiŸºœß·CcÐù¤©òóò™Ã~hìà_´¾âÔÓñ1˪,jôÇÍå%•ƒP±4XÚ@它%[†!¯ZS«ÓùMȃCÚ¤T€(­ËÈn@4²áäá §is9-›]Ç°;Û·S"¥þÞ´ƒˆC7tª$Õ/] Ø.…t±Ÿ¿ÊzYíV^õÀ’;4×`4ÎÇå*+èÅZœß#iìþ\/e£q õC¼†g.¾ZË0QÉÅÛ¹‡C¾*aU‡J'|-´Q&u˜Fœ,âPãýAçÁg³¹7Ü^Ï‘ÏÜPι§3Ö­pý¦©û¶©ÎñiÉ_äsÄ9SŽÏÚµ˜Ë8p‡6¹73棠ìø‹¦éylj,ê ™ÓÔ<©ifi¯x4¡ý#Öµ]sº`Åå9Ú‚©´½ðYŸ‡Ç7\ï=â§ÏïÛ]EŽÝð¤^²‹È,!öd–™I`Íñ…óùÀÊß¾0ô#ÅÆƸùܦ¤H,rˆ1¸ï +¸»«à‰[Zìm´7•e„®”-“íšÍðp µ²¥Ü‹Æ _²‡ÌF”©(f0w½8|Û$Öëu(-žÙ ”±5æ‚´n¬”-ß‚ ºMji¿|ïJ÷¨ÛLÑhéÐý¬ÅÛí‘Ù85–pÓq¼±;±úK¸–S»_c¿´ö—Û¢-ým¦BPÕ¬^Z¦Ò¦…Y‡(—‚‚ñW¬Þ}Xð pG Þ²gàghƒ’c÷jf¸¦øî#¯À;¿/Ð’®œ”¶¶µNb“'9 +Âgü©­¿à®ñ»«V z¡\½ãɪ°Oµ]%¥Á×Ôü˜ÂTv¶i¤ûG ÈR•½‡JR—ÔAssy Xío%Ä¥Šb¾FEÉèŠ0~Ø!‘][PùŠmo c>ZL3{9­mìMž‡ÊO/MpN[Pôìß΢dlÆœ˜ˆ|Î]8ˆMeÙ,L¿êè©× Wq6ÆL–HçÑÔ믢´x÷£÷xáB…·ž¯Q +R¶Î㋹ßÃ9_£d¦Ã$Ó¶FŶFÙZ„ •¶QÎÇÁ]ÑOUú†ÿš©‚$önÑñÖÍX»ø àñ íŒ82a–ë‹âx8çK™L ”)áõç`ÛnZ†<ó›Ëäµð=ÙØ‚kçaì<Žoíkù²ýÒ³9Ör×uCçØö}"Š}S/Í®³Ð²·ÞŠÖäqÕ ïõîx'_ ±â`Ç4u®JÄ×­õX\ÛR×óE–ä¶ y¯‹£¿—Þv¯^šŠžÖlÈ1ÓtLËÅ\éwq’œÒ¯Ýlø3ççº e¥©†&öR,H™‡*¿Ü¯y8C,xÏøÖyDÆI>Æ‚t!óýÆìŽßÑû]D6öÆÃæ¥\çq(õå öpÎ{½È“0O¹V^cúÓR .‹ã¡'ÉI­\ªµ”þõfíÎ^ièÁ½`àðÎl/š´êݸP>Bü5Š#~³MI™JhASË"¶7èü(˜ø©×—-UôXÉ»œC5€³ù¤9„R${‘ñÁ2-sqäaytB §’í=Øp[$¶´;E0>ð ÈÏ%^PpDÍÂÑÉ à—q¤÷šÁ¿Pmë†z"æéjÃ;ÛÓ ÒØêã® uõL(QÐXœëÛ[¼1T¿ÑÛƒNÑúØŽá+Ç]—½K%‚_óç®±XÎÑŽÓØ `zKáÈ:ëB‹0JäÅñp†X? ±.Ô~¬ [þÞþa†Žó®eBÆj¾ÃâˆC,îÿv¹ +ÅËU¨l6ú²®š{S}%íÑo â~¬9±éį5膸‘&Åû8¿ùÉþpÔ쯼™ßtèi縫“wUøcž~è‡æñÆ›…yvæ‘2£'©vÌ tvÈp¬²0ÎÔ ŽÿФuHendstream +endobj +4055 0 obj << +/Type /Page +/Contents 4056 0 R +/Resources 4054 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4028 0 R +/Annots [ 4058 0 R ] +>> endobj +4058 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [177.134 510.155 365.46 521.844] +/Subtype /Link +/A << /S /GoTo /D (passdb) >> +>> endobj +4057 0 obj << +/D [4055 0 R /XYZ 85.039 786.531 null] +>> endobj +206 0 obj << +/D [4055 0 R /XYZ 85.039 442.636 null] +>> endobj +4059 0 obj << +/D [4055 0 R /XYZ 85.039 413.9 null] +>> endobj +210 0 obj << +/D [4055 0 R /XYZ 85.039 300.495 null] +>> endobj +4060 0 obj << +/D [4055 0 R /XYZ 85.039 271.091 null] +>> endobj +214 0 obj << +/D [4055 0 R /XYZ 85.039 229.396 null] +>> endobj +4061 0 obj << +/D [4055 0 R /XYZ 85.039 208.199 null] +>> endobj +218 0 obj << +/D [4055 0 R /XYZ 85.039 141.062 null] +>> endobj +4062 0 obj << +/D [4055 0 R /XYZ 85.039 118.346 null] +>> endobj +4054 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R /F66 3242 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4065 0 obj << +/Length 3051 +/Filter /FlateDecode +>> +stream +xÚ¥YÝsÛÆ×_Á·‚3!„´ÓÇVk§±ìFÊ8™$ ‘ˆ@‚@+úݽ(’n'Œ»Ý½½½ý¾c8 è_8É?ˆóIšÍý$'ËíU0YæŸW¡RÌ”d6¢ùöþêús3 ?òÉýƒã“~’Ï'÷«_¼×o_}¼¿ùa:‹ãØKüé,M3ï͇iè½õîVÀ¯§³Ðèö£¦Qæ}ø~úÛýwW7÷N„‘aC€ÏW¿üLV$ìwWçÙä‰Ææùd{e’ØOL¬óúêîêߎ—àÌDV;og~’ŧŽ“ÑÃ(÷Mn&©‰ü€8áÄ¿ìʾnÖÍî7œ`¦~˜Ã;æL±l¶Ûr×OgI”x—ÏmÙ?5í£L¾ÇrÞ•í—jY2«àˆË¾è7G,®¿íu]-®»b»(®­㥠¯\ÊNwoXü\vgvZ´ÍSW‹º<¹¹`¢y’ûA–~ÕF4¬Ö(«5Œü8Œ&s“îE­4òÉEB?"'"É<ö• ‰ÏSïnOßÀ+—UQ2÷^])£æAhÞßÉ÷SE|v«fJ ž:ýôQhß‚i³Õ•7«ª±(ñÜIMì›ðìI£ÔRòŸÙwט‚ 9ç®0GÐŽÙð¢€ØÈH©¹Ì¬ZgIûùOB?0y ÍhÌòÇbÀõ»m8yÓ¤“#a…ïlĘ…%eŽ<%™û¹I'IúíaÙÎIæ}‚¼ÖÖ”RØÖI.¶&üÈÖe[#ꀢ³(¥Ã…®ÚÁzo +š|Ñ…ýF.ªºê±Ù³"aø{S ÄL‰ÒÆ“UäÆô)Ç5Aì½A >‹ :myh „ Sa{bÉ'w’d±G13OïGp¨«GÀËohE²ºÀòSµ[áŒ`U–ÿ!ßë3Yá=‹@LÈ›„IjTç8–ê\5hÒÄû‰ eø¶ÙŠ3ñÌ© Ýñ‰°”Óïë²çëgYUa±|Tæ윛©:è Q‹Åt¬ŠI#–¡âC9RÍN@>‘·ãíz9ýÇšÂý—A`ÈýH “Q`ýù0E&ót2sÕéÏgŽã˜§(Â踎Å~Ñ9ò„ë"”v¿FÌÜ[ØpÀÄ„µ •° £ê²hÿJ™çÞ»=³î˜$Pd +·rX hŽVÂ|{M'8ŽTú¾•(5œ‘‘‰$PiU¯ÒbZ×—ë¶èÅfzº±@+ÐP¤àÓSœ¢Nñ¨F'ÈÍŠ³œ=Ž<§ï |'Ä_côiJVlG\ŠšõÂÝÙÈI[ê$oÁ­úMÑ«£m*uJ$™‚Ç© 6©zdç ¾ú܃š(.:Íxà±j„øÖv¾÷¢G»¥RSæ¯ù|k™×U×+ox$hKõ³Z¦ÅÎf:ÃýÏ¥€è7Övsï®ØbÑ¢˜qä󙊭à¶Ä?J‡4rì©Q&6ªZ™}>ØѱíÜ=%ÅZh7VëÀ‹ã%tîGd€n*»!oCÍ2{÷<½wýçZ»¿ôâCþ"¿X±,,˜¡¯£ëç™ùj;¢¹ÜÁÆDmâ七ÿl‹MmkèÊ*¨Ñ@^Ëô}yéLYä§Aöõ3 4gŠ„=ÓÜPcÈGz½¦÷ G™P›ÂxŒÏ\Ò¿XnÝ6‡½@‹¶ªòBrèTÊ<`ÖE1–ØÚ–cƒ³j'Ìú²Ývf¬6€è&¤E›O9À°dÁùihS„Æ•î9ç‰Çåç× Œ9˜ÛrÇI3˜sŸÙÉs$òÒ@­(dÛ +zîFjeXì¡7”ÅŠUP€‹4EØ9‡²GÀ¡€å’ÔnÉuúr% ÊÝÌéyVè&qZô€ä‰\Ù¢ùQ_‰­HcÔ A·†n|b¥Ät'hVZYÈÇ…Ö¨ojqïbïU-Z"oÑ9³õÉe\9.y;ÍÛk«õ†It.ºRñÚ<Ÿž—ª”(—EƒŠRM3ä‡î(£‘ãTJ±)Ÿ…¦; ó€ÔV׊,0#Z¾Z¢Äš´Œ«¶‘ÀGUÏüå~.8lc!3ÿôÖ0$êX²ÛJÌ_jÝc‡ªt²s匫|­Ë`ˆ)ÌØ`ŸM¶ÎŒuï]µ}q«"ÂÛûëè_§Eu@õWwxùùVÆ˺r¨=!u«­eÅàÛ7B\ÈÔªc[‰­0VÜ{É÷’L +阙=#m·Ïº)Y±•¡”ëVñ+h¥7F§Ò$?J‡ŒÖÌ’æP¯d…uï}Ê¡+ìýˆ/–Çþe/xÅp_e{ ÝjÚ-ƒQa¯J£Ì÷(Ä£´Çbk/mf5IÌmÜa·Ô^ ×(“DrG¥¯Ø¥“®y%Ä(ë"åÓw¯T•ýrß낧>åa)Ÿ`QK¡ál§,vBËm¹ŒÇ.ÁŠƒ¢_ÙÔ*2Œµ[ÙÖ +ÐY&4x 4g; 8“uŽ¿k6;4àq†…™½ô„pÜ„XÊáèîB­}|Øù…Ù\GH¸ã#Kšè›¾¨µÍçûmÛo8ßÀ†š´‘•¤"@;{†½„-¼×ïäœä“¯•+:‹írm.;ïÎ5ÃÚÿ‰jx9>#%AJéâìkì»sÙ +V$ #î@ +¹Î‚*VÛj ï[Î^rÝð]Ï";§+>Q­ùMžXâT3|d¯ÊsnÓ¹jÁ¿¡ókrmŽ-ö|æÐ]ÏÁY­hiH‹R}]Îo)&â;øg!¿a…uUŒŸ¨·)e(ƒN×h{8ºiÀaFß?~WÀ(’W‚Ó6díáEÄ.pe¹3í†_B‰&Ж;ŽÀ^Oi`àš`c]˜ÕJz’üÜW¹®tÞW« »ÇVÔBÀô‘¼ô~ÏâPRí‹ÞÕýˆôô]/ñɵGLGq(/JDWn©xô­DHl¤³Þ¡â—·ÄŒY{QÔ_¨˜Ðúñø ïªúr¥r.Z1%†~¤•óHiJl:WÑŸÏ÷‰Q&ÎÛÔG‰g%Í„ÜCù–2•1Ð]è&~ì¸ý‡ÿö›Ò=˜Ñô¡,úCËêɢѓ2¡–Hæˆ¦í“ Ã{Ž+ب'TÚ$e‘7¨¹’·a,´)–†_ªÂÉ'ƒ;Í%ˆ‹IZ3³nø7¼Ô˜ÑóVLYòlêפʼnü8AŸEÑÛªŠ)rymï B]ɇ= À&Ñöit٥ƅ÷Õnc­ÿ»5íÂkÞ½âsMô'Šù¿~ÁwOV¯pÑù«$Jýyj¬0°„É_ +lé?•ø?3ñendstream +endobj +4064 0 obj << +/Type /Page +/Contents 4065 0 R +/Resources 4063 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4069 0 R +>> endobj +4066 0 obj << +/D [4064 0 R /XYZ 85.039 786.531 null] +>> endobj +222 0 obj << +/D [4064 0 R /XYZ 85.039 659.087 null] +>> endobj +4067 0 obj << +/D [4064 0 R /XYZ 85.039 636.371 null] +>> endobj +226 0 obj << +/D [4064 0 R /XYZ 85.039 398.984 null] +>> endobj +4068 0 obj << +/D [4064 0 R /XYZ 85.039 375.662 null] +>> endobj +4063 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R /F15 2876 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4072 0 obj << +/Length 4115 +/Filter /FlateDecode +>> +stream +xÚ¥[ëoÜ6ÿî¿ÂÀp2«’H½îÄy´.ê$»—Ú~wµ¶š]É•´qüßw^¤(­´îá â’C3¿yOøžf±¨ü4Í?VáéjwœÞAË·'¡Pœ ɹCsqsòÍÛDŸ†ŸùéÍÆŽ“~œ'§7럽Wß½üpóæãÙ¹RÊ‹ý³ó4ͼ×ïÏBïêåå;®~uvzXõîKÏ¢Ì{ÿÃÙ¯7ߟ¼¹±Sp&*…øýäç_ƒÓ5Löû“ÀWyvúåÀóütw¢cåÇZÉïíÉõÉ¿íXܦO¹×Üzc•ùq¦Æ΂Ã0òU¦qì':¥÷÷°’Rµ¼¾¨hËMÙRm ¿VX(»Ø®½µéÐ}î›îS ÙšË]_´=wÔ±ÆÚ›‡¸sâÒyˆKÌiJW×Ð;L¼OU½n‰Wüô¿ßa]³+ùWy絛€CÃS¦úJz½{ƒ…Ø+n·Ò¥oð›z¿™.ط溂IÖÍ®¨d¤¢^sÛºA^¥ \7=W?Pm cìª×Ë9\VÜcØŠŽ +)³ÞpÙò‚-M ƼkjZ¾lÜø09\”< ôÆÃÓQHCX‹û_¯ð$î+<¬;l¼Š÷ѱ@'Þ Ý/A¨ï°s[ôN‡zá`]ßîpPSè˜h [Ú mÇ3yDFM òå*J^µŽ<…PÖ~Ž´Ÿ¹¥˜ÙÒ˜Ö{ßà˜"‚,ŸpÐzM£D©÷Øquþj¾¹zô«mÅRÙ‘G†eË[·“>2"ÍNâïS7ê”dÚÏá;§˜†æÜ!šQÌ2±#áâBÿ€ŸÒ€%ÇÙ1É3ÜT`¸ÝÐÉ«h´5Z…ÞmÛksÌE×wLöKtd@Ò›¾—¤Š t[$2R±^²t¢Ñأ٘!T°®3âz[¤‘*ó•ÞU Óet’`¤ïÊþ‡†tHÚc<ûÆÜóz»jïÆ +#|Ûo'Ûs ŒÅº ÀââÒ„kn¬‹´¾~Ofƒ•7tŽ@ÊÏ’ æ‹óüçŒzg¾†#âö¿„«™1ÂÌ’Í!DègA*E?ÌœÔIiÔ#=Ý° \Ìå{XJ”*o[ (<á´-¡8¨eÌ¥š%•¤m7 +Þ£:ØulEðGlË1(FX°gkÌ÷®;¡®¦+¶^_h’h¤¢,ñï+;gŽ O `¶›3#Tùw,u´(‰[3®@ÁÅ/ ‚ƒb‰´å9‰]%Ù/Ã?t©j3ÆÀyÓ!eë-+>[×w‰r÷ôëšIÔŒ`Šë7ÿ~Í¡`¨ÄŒã/Bœ +ü4Lž¸èÄ ²‹!î;qG¹ˆs¸‘À*, ,6ÁqÖBÔÔ~VˆzJ§|„Dv&ç?%ÌY£“¤séFR¡cÍ5·Rš +iº¾‚¤{<\ÇÔ#>üÄ0‡ÌÄÑrÄ7ž¸q"T‡óé2"(R«<‚®@÷ê¯LÑÝí 8á}gü²‰2ü5ºÄýà'Зåð. Ógäg :"?B„‹V‹òsŒ‘Ÿ£ÜŒü8ÜX~Â|ì=„(;`>HnàÇÚú/ì&æìP戭Ÿ>ƒoü£`ƒ±La–é÷½Å»%ˆü%c•E ißV†V Ofa¦çbÕ!Ì À5ó¾³àþ7‘”­ƒe«¶Â˜ _<Ý8… #ÌŸ®C´|º†gª—N÷(;9ÝãÜät]nì…zì…J Kƒ°×%{½ìòb/ò…ðK²ÀåÁýÀÞ9Ï¢•v4ÙÖ²hå¬0p#¦**—ÞÌÌ1SÈ%™Wmä‹f3ÉÉ·Á/¹º{CeÉÙÍ«ùÇ-™^²»Á`oÉ$3ÙÑfÄrÍ-f‘X.¿2í{Cº6ŒÈË ¢Á3œ³ §#ò^nz0§ Æ»2áÇT¾§îþºêϲã¶MÛì&¦Ýq#Q!ËeUP±Ÿ¥á3ª0Q!ÂåÅ‹ªpŒQ…£ÜŒ*8ÜèÒq, ÒÐXÇT½’¬Ži þÀ^€û¶ì/ë Ã!6YrÁN{hi4q¡ðT3C²¼•_Ä/å®shÈÖ¤¥iUc}8¨ “¤³9´MSRN^ð|ÖÜÀóÈÄX“Étû‘Âbr) :¸[»fåš®«!µÂƒ «ÏL˜ä:¿DÒó\ƒÜx®P1{ A6q½c¸LÊj9Ç…UÃ’ÀI +¨ØQVÇ8Ù\ƒ:Õ“a7Iè%dʬ ºGs¸>{N©c7Þв\fjãÐ?ÿI 9/Oº\ýˆþË ÿBj-nÑà™—ŽÏŽs¦_cI’”XÕ–«¾iŸÎ2½ìGë,ô“4>Ñ2<"Ü d Ž²x8ÎMàÁåÆð¤cx€ßc4™ó¡Q‡ËS‘H0jÜIãØpb çã’äPýJéÍ2‘$r‚Ȫ0ÂÿìÊ(h$ÞK´¾qLÉ.ôb°îûVÒ\ØÐà˜è®i8rŠ‘¡†èV(ôXè•w Ú¬MÚ7m¹ž ~#‡ÓÒ&yâ?VõCÛl0Óxþ&0TžÛð—öärÃÛ!ÙPØ2†pØ5ÊžD¹ös•Ž}®VÐbŽnøÄ ÑÅ¡T¥!¬p»$y_®—¡#J}fÏ@Ç@t:„çœ.BÇ1v:Žr3Ðápcèˆ&žEM # +ÉEô(6"Eþ*»f96¸Š-îH4…hèbH48ÞX?¤‘À +5†ay<¿¨¦¾ËöVdk“ÚÞ—@"Ä|ÙÁNœ10ý‰Åg÷1{‚2k¾¸ÙÞò«º ”ŠÃœÅky2”½’ô\KÿÖd«°IÞ6E&•Âùnb\õ6ñÆ'²&I`ÊCP&#™|ÞaÐ1ÊóPB‘¯g¯šGa»ÏC²#ÜðÜ·OÿÃ<ÅJ$3É[I@åÇ ȽåVÆú`YÎÏükM‰Q.Óaá—ƒBJuÖþŠ-¿ÜjK~æb^@©˜nYf"»<…)17òß½üøfîB>‚ùš´g‘}Ù·,a°Ö!Ý8a–j_ÛÄÆèʈYæGö +Â×ÌÑpfásÏê´Ÿ@Gw¿ÝÙ[2sªNNÄ ·"Øü› ó{ç¹—­Å|ö© +" îßRË%ç'ÓV†v+3”û)Of—)‰Cg¬æËU¿kL.(СU6y|¾Ó.€˜Ÿø-¶,3ükµm˜5+ø›Õp=Æ/G¬¿—QÖå-–É€/AÒHa5!À^T8Sp §ñ»åg‹ZUš7Œâqð3~µ€}èz›%‡ß·íظõüÈŽ‡©z£3¡ñ=0Ar×6d8€úq”‚ŠÆI©B m"l*d¤‚?¯_ù\ÿé¾’°Bx@é®`e:×èì/©;Ÿ>›K_«[Á_-.ŒVzö9¥ü™>¢¦Îis-™–§neoÉÉ-Ôq.ïïŒÛ%¯[^ÏØOûúÔÆÂ6ÆfÅ„‚ã re\º¾ªW=«ia ¯Qñr†Ÿæsß×s/Féy g•t4XÏ@¬g0À5·?wòªLl“£ëP +AïÌRŠ]ãϬý¿”Ç̽ÖC¯Ùo×\ÕJ†V,3|Ë)3 ±µ¨&Va”€_ë~Ø'Ú t zí‡AL×÷è/<„ ™úÓogƈ? ’c•‡(î[@~0ƒOŒaâäŠ^Q¢%7‰™PÒ‡a0ÄÍa8yCrû±æ;@ó[æ²5¡¼JÞV HhIœþnY.XeûÒLC + ‡!6 ºá꜊pò˜½¼(ñ7×­B{[qϤÇs*ŠDvâ½ÆgX\Ô±}Q‚å×W>—Þ¢Ý'5£Ð–Sj„_ê6õ ¬’ùšã*™'žæ£Áë‹Gñ䦙QòÀiUÃ,­ TÔ²Ö6T_€V2 ©Ø×óPp*çñý5… §4ø¬ÙÂé8Jý$Õf2Ó ›¿º8œñEendstream +endobj +4071 0 obj << +/Type /Page +/Contents 4072 0 R +/Resources 4070 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4069 0 R +>> endobj +4073 0 obj << +/D [4071 0 R /XYZ 85.039 786.531 null] +>> endobj +4074 0 obj << +/D [4071 0 R /XYZ 85.039 695.734 null] +>> endobj +4075 0 obj << +/D [4071 0 R /XYZ 85.039 641.538 null] +>> endobj +4076 0 obj << +/D [4071 0 R /XYZ 85.039 614.439 null] +>> endobj +4077 0 obj << +/D [4071 0 R /XYZ 85.039 587.947 null] +>> endobj +4078 0 obj << +/D [4071 0 R /XYZ 85.039 547.299 null] +>> endobj +4079 0 obj << +/D [4071 0 R /XYZ 85.039 493.102 null] +>> endobj +4080 0 obj << +/D [4071 0 R /XYZ 85.039 438.906 null] +>> endobj +230 0 obj << +/D [4071 0 R /XYZ 85.039 251.478 null] +>> endobj +4081 0 obj << +/D [4071 0 R /XYZ 85.039 230.887 null] +>> endobj +4070 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F11 2898 0 R /F14 2895 0 R /F35 2880 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4084 0 obj << +/Length 3362 +/Filter /FlateDecode +>> +stream +xÚ¥ZësÛÆÿ®¿‚qÓØ1a¼é¤KtRebÙØÉt’|8‰´¢ÿ¾û:à ‚ò‡Ú3æ=öîvïöñÛ…Ý…ÝEÚŽŸ.â$²Cß]dû g±…™ï/\¡X ÉÊ ¹Ú\¼ù. +®c§NºØ< û¤Ž¦Ñb“ÿb]ÿëíÇÍ»Ÿ–+ß÷­Ð^®â8±Ö–®õþíÍ-_/W®…C·lý´ôëÃËß6?\¼Û ,Lº¾ üqñËoÎ"f¸pl?MÐvl7Mû‹ ôí0ð¥_]Ü]ü{؋炯š“7ô;LüSÝÐØõ|ÛóÜE†vÄ$ñmƒü?.W^Z÷*[z±õ {Õ7<Úï +n”]‡Av‰¬æI3oj˜øÕqƒ-R´%v·¼RñÏÚãi÷Ò]_Ër.£ŠÉª=míØÊe¦žZͬR5wºi³c ceg=áÃ,Vr +o2%É¿]®'¶Ž¼WÀ{GQdÝ<ðŒâƒiìîš®çVÙáobeMR£´Ç¶Èye¶G*…×!|Ó¶ï¡ÅsÂÂgÓ³>/ÃÈRU™«žŸ*püQN"žkžƒëê˦æáVýqÔ­®ï^äçðMÓ˜P—Ðïy÷’Ÿ›Š'T&süB=Óû6{aª÷Æö¬‚8\ÖšªžVVú.ò#›ô¬ÌðOÓ‚ûN + +:&í™!.:!Ì™5O?,syüSÍ&ÒázG´±Õ:–º݃}Ž|84žç÷Ž› ÚúœÌÐ2¤C-³M©C:Mÿ +Wâ&dxø«· v¹§£ð¹|9ŠtéEñ ‰ÃMÇ·ñ@£ø'oöŠ” ¦´]g=ŠÜTUÑ¢™¤Éè9p‘^·©ÏAÝkäô]QѪ¾˜yJ\ìép²Â57´$— +ÝѶYíȶ¥õÃ`¼K Ô +°méQ¼#=|«øŽzä’ÎAÚ#š4öø) î°BÈ Úýîd¶¦ð8| d§N…û™ü`>êPSäÀßA`ð:¨§;”M €FUÕ*âÎNÉz%Ëñ†Çf õ Âù5¤côz\4î!C| hÒ§Ý~Øp yƒÎNá¹l<8“0±Öbè|ÎCBð´dK¢NÞðoÝôÆlÑù@d]áUÖ_‘3ÞÿÚtÚDºÅHôÝšö]±qúSÞ 3èrÓøû°$ï0>Sb¼r<úBZZ þVáÅ?ñðýÒKu;×Âl]öÈl#ÛíF.NÂ{Œk GÞR‡ Ùý}"‹R'©õ@ûRz¨˜=¢ìƒ£ë÷WÜxà°š:è¸1¸;hSŒÎ¹=XÿØÉ4úi5¶ ÉoùgD/ä!cÏÚìtXtñ²Žá±–¾’m¸†ˆ\\©ªŠÔáTÌîx8„MÛë§ÈYïµÇ,¸K^ GßËšcŸªa’Ønò"œI\z0Ø~¸t=Ûw½EÃo”·3É÷¤`nû½¡·Û4l߉“«s~׶ÍÒ§`)¾gŽO9`†Q‡, qü—¥ˆ\;ŒÂ‰®¢Áb±¹†®E~<ÿ¸[U³gŠœeøbǼ˜8èKûúRH–„›ŒY¼•íæ`Ÿ"Ê™ƒü‚X#Í ô×by±íx>‰õM­K ¹ˆCä%‘±y‰kôÙ—h!"ƒëd9èÒQj7µ²Vtq$’ÇBíÕ`¡’©bĈO q»ã”Õ£qz¿A¤Uɺñw¤ à¹òhu‘>€Øf²œGSk<ÿãÂÿÏÄŽnÖ_qâ…¦øE'nÐœMÙ‘.±É›Æ¦m!©o‚ÁÐ+äñ¿ËÔe§¹"ÉÏÓØ…‚BJ”5H†3mIÐYsF³¬md†þyÅÛ@£x(  ];ðÇM¯¸h)@⬌Nbˆ_”q¤9ÝÔ±ñÂÕ*ŽPÂK¬â¸®áà€)œeRx8’v?1=:k„úH¯¨æŒÃ¤‹[|[•_É`œâjBu.\Q¤Âz•|˜è(&á<}|KÜ1XBû Q"kD }7­;"lÈ"©­þªà¥Ñ¤ˆTøøTOßsŸ^÷¡—ÇFÕlyj ?;þ>ö×Lû¯±PÃ×ÀdÌ°Íú*_# ¢Mw¬úIQY¦:L¢©è-Ùn¾/ëR[9¢z½Ïã¤øIy°Ó²Á¡œ ¦ÇR®y¥È6Ÿ—FÆøÙXT”ñÇZY•‚Ÿyh¬RCóf-fHü7­YŒ$·6«þRËlåÑEp»ÇîǪW÷ª“5šg~„¶F‘ã\Ä!AnøàäéàÒÝW‘¸Ñ€NP&!?røŒûX|lž^ +ŽêKÑÄ‚iOÞÒ3>ÑnÚºaœcáUªè¼iÚÓ:Êð>Apò ×ügU¤€ãä-ßûÕ͇;“JŠü6a.~´¡4B7ï}ÄÁP-@.šºŒø•ªq€47mÚVJ2alq ~_é‹ÚÏ}°ëŒbA +pqª|“e }^Ù–µªž}æƒöi/4Èâh+:tŠ<Ííf –‘4U9¾.'8õÐÊŠ³ÛÌy®Iƒµ3C#èÁ[Â^çÆ÷-Ò<$_KI~¸}èŒßVÚ +rÚM¤^”Óª o¼×†s½_hZNM8:Ue1\ žC¹nUöeÑ}¡~w–×ÁÕJ*ßóxåÌ[á-ݬg¾öe’Ð¥sùÅôV>#ýs‰ áY˜ƒTåÒ¦ã¹ìbðTX OYضiú¿<Ë)¶E_5™ªº2çË?®oß¾wy.aíÀ÷ç?LÈÅþ_ÿh¬%v +ùÑ,ªÁ +šnîs†õÿ:åøÕµ ¨endstream +endobj +4083 0 obj << +/Type /Page +/Contents 4084 0 R +/Resources 4082 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4069 0 R +>> endobj +4085 0 obj << +/D [4083 0 R /XYZ 85.039 786.531 null] +>> endobj +234 0 obj << +/D [4083 0 R /XYZ 85.039 588.18 null] +>> endobj +4086 0 obj << +/D [4083 0 R /XYZ 85.039 561.565 null] +>> endobj +238 0 obj << +/D [4083 0 R /XYZ 85.039 561.565 null] +>> endobj +4087 0 obj << +/D [4083 0 R /XYZ 85.039 539.908 null] +>> endobj +242 0 obj << +/D [4083 0 R /XYZ 85.039 430.597 null] +>> endobj +4088 0 obj << +/D [4083 0 R /XYZ 85.039 379.384 null] +>> endobj +246 0 obj << +/D [4083 0 R /XYZ 85.039 223.271 null] +>> endobj +4089 0 obj << +/D [4083 0 R /XYZ 85.039 201.411 null] +>> endobj +4082 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4092 0 obj << +/Length 2060 +/Filter /FlateDecode +>> +stream +xÚ¥ÙŽÛFò]_!$†,šG7§…ãñîNvc'~HòÐ)‰k +IYñߧ®¦¨ƒöÃb0`wUuuuÝ%îÁŸ?O´ë…éokkgµ³–õ8új±GVñ2¥Z''&_ºžÝI žl¯¥hÛ¹S~ùº„ªéEÅgù•Ÿ  [üÆgã"Œ‹ Rwku <è6!º1ÃsÞ´ø•EZS–_øNð—šIÎö±ÎÎ.Bq:¨ Öûbóϵ©¤Á-{ô¯ËDÛæ$~ϺHBŒ|­ À›?É­˜é/ÍE#‰ÆAl÷"´²Y1Ö0C“¤ÁV˜CXô §‰ ©èN$ET"±BöwÜúžq”ÇMêºê´ru- +îªõÁtÝ)c‹Bý–E&üÝóU)õ˜7XC¼…FÀ3Yä¨P„µa4¤6—W˜Yð;( óã¯û/ +mþÁ¥±ŽâjœÂò¬è©êøÐ3n +”ï‹)kÞ ¹™rÂÎRä¼èÎï8H*àIœ +û¢¤$Ì)\ê%  K©R>dëc›[ÞèE´¢ºÆxnsì }ŸÜÞPå÷&„4OIïd}@¾#ïêxzÿÌæ)'NÐ&1ØðçáŃì 7ˆélAx]ÃߢçïïžöâZR°rø7õüªER‘vugE®úv7ºA|¿—^ZNËÕm#¥¢ÄM@uL‚ +¬A/Xðr“A†;¾ªó¹Íæä RLå£Ø&w#iܦBN·Ô †ÉÒ;l_±}6¯0îpyʤO¡òÄk¶°­ “®ˆ¥„3Ÿ¬ +Ï š>P©#æm%’«†$0,4Œkóe]JX½õÄÿ¢3ã†Â‡ƒu(ƒÐ‘åC‘š!©®kë-‚©ø9Ÿ:ÞJž§˜:¡_Û”ؘU‚dÏ €\S™ªmùq-¾Z•:㳂ª„³~7eq6RÆxcŽÔHz{Ññ!´4€¥}T…™.ˆ.« +^T.†¦$á‘Fê/É4©ÕQbà”·µ½ï•«ŸÅ&î%ÚÞçF¡µÑpg¦Q0~k¦ÑLO‡*Ü4õÇÓ¡–éð#u8f=qÉ3=tB½(ÁµÝìŠújøÄ3™­BW3Œxl*c‰·-&'âÌžüÕ«Á.&Á„Ä;áÐiÇApRš¡-jê—ÌEĤñi\œc;³Ë¼¦a´9 +Y%‚çI™r#ôgšYmÛ… ¬@VÈ€û8ì9' ù+ö¿a 3ÍôЩÂÄU¢êlupž‡Öçñ†¦n5ѱå‰g9¦šHhc—·ÌG%¯âQï¤I¦!»«Š;N›ad䟷ò@"=÷»§ñ9´•_Q¾—ºQ¨¾®ü3Ítt„)ÄD£#’èøPcÇqöÞÈÙ’JNg§*ê#'jùÙÂly¢4¤L{#hpfúYö’Qœ'!côÝ•gc>9·¶­DÆí/(ß=’>+ûK2xÓÔ}Û”äI"Ò‡Ú|6E)îõÝ„jÃÄwcø~Mµ#ši¿#ßõw¯A‚À—±ŒÓCà ù6à4â’¬€bÁÊ705¹Û±ÞäŒh„ ×mXÔR縔ñÔHˆÓ^xP7G ëê4Oâ¯dAä±;šRF8@ +‹ Í‡>í‹òÜ•M¨U»êþ}ðϬþ¯Ÿ:GEÁM“à¾it»Q¬¬0äôÁµÀö'Ñ[‰ÿù†ZHendstream +endobj +4091 0 obj << +/Type /Page +/Contents 4092 0 R +/Resources 4090 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4069 0 R +>> endobj +4093 0 obj << +/D [4091 0 R /XYZ 85.039 786.531 null] +>> endobj +250 0 obj << +/D [4091 0 R /XYZ 85.039 726.833 null] +>> endobj +4094 0 obj << +/D [4091 0 R /XYZ 85.039 691.892 null] +>> endobj +254 0 obj << +/D [4091 0 R /XYZ 85.039 486.938 null] +>> endobj +4095 0 obj << +/D [4091 0 R /XYZ 85.039 449.673 null] +>> endobj +258 0 obj << +/D [4091 0 R /XYZ 85.039 409.634 null] +>> endobj +4096 0 obj << +/D [4091 0 R /XYZ 85.039 374.693 null] +>> endobj +4090 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4099 0 obj << +/Length 3322 +/Filter /FlateDecode +>> +stream +xÚ¥ZKã6¾Ï¯0rYˆ5’¨‡•[÷ÌÎf‚ì4Ãf´¤v -KŽéé¿õ"EÙro‹ZY$‹Åz|Ur¸ à/Üì?Pù&Û§~¢ÂMqzlŽ0òw¡Pĉò“8†öÊàÎŒîÒÈâl•FöØeQìÇûiîÞ½ÿ›(ðÓTm7aù*Œ6ižûI–mÊy©¿Ý%IàÝëâyzÓy»Siæ}ÜîB¯;A®[îú/];â@ß5Û?üôîï–a Í?Ißdq&!Ãd~ä á¨)!‡÷nùˆ»÷ÐŒTì½n£½×Mø¢¼¢kñu>£Ü›„¤zš¨KhÕ푉ñ0‘Š¼ñ©¸g@¢ªÀÿcMGüå»Ä ‹žô3n%o4s"ÃÖí'=òº 5“³,×Çùõ¡©P  ]ˆ—œÓ‰_êñi»‹ÃÏö{Æ@{œzsÐüøªO¸ÍA^?v'º.l±à´®iª^&ø̼Òn –hñð˜qo‰T‰g~üâÎc¥ü(I6iœûa@ŠÉCýqúj,Ô;‡üZ.×DyÜ>Ö%GI‚þ¸ ]©¡¼Í…ÕCºš0Å„ƒrÐç±êý[¦~ž¿m¤1Ò0öUœ.¶B?Ü'b¤!šiœ{Ÿ¶*ð*=N}5°YÞµ%7ØNÚ +fn±'«¾ÉÞLs[2I–ú{¥ˆ½2&¥4»¶’Æ#>Ð!é8uÃÈ-2Mà7E΋ NF +¼ä'´QÓ^–ÅŽŽ›Ãt:‘y’ò²ƒ˜â8ò>¼g ¤h°2¹í¤ÿ¤Ç‘—å÷2[jmÉ®rÐ8òÊTO–-nàâhÓпÐh´Õ¼ÔMÃÓ‡Ñ6Q½ÆÓ¾pGa§Q«™X¤¡ÇÎIN¢‘ äïùÑÉYôùŒkvZ–xá'³ÇØ=l÷JüÛé¦R1HãÛyv ŨǚØCNâ=»’’ŸÃÞªÑÎé„îUÜ(ß7tú¬@ÐÈ|Rš8õ|ä÷κ-Ô•úO»Œu÷H\%! æ,8$¡êv±úÊéµµöºšwG1Ä"Ð8hD Éäס…V§œH²ä™}eÂiàXËhî»Q7Í+÷•hªêÙ–1 Luy«¡‡ªÆÞWÔ‹¶ >Ÿ•BÌùñWäà·‡_ùµ܃²gÑÍ2P¢~+¸[41ð4î75ùô>ßƪœÓ}Ïýb94Ÿ$Ž† +;G‰ž-Ó³JB£d™ÕêÉö|dZ§–›'îL൮£®8*ð´ßƒ$8LäL®o–|@‡&Ÿ­¬Â¶Öä˜}X/d¿Rãov=x´¯Žº·p{îùº ²Âm!˜ÑLº6¦ZÆ4¸×, ¼Ï2hì(†ÛU”³^ŸÍjz삤ؠí¦¦ä®§Åá ÍÇÚ{+‰a´"F&…¥h¹ÏÂ|‘H«Ä>mâ))xÁxU +qË,YíÅÎY{¯J~]Œy2—1ë@ª¼Ñ¹Mê8“wÑ&¸‹†Z\Áˆ( ¦›xúù>çh‰ýQ(\`c¨wùuà¼\ñS÷´µ þÈÙ-£hÏÃÑá‚=å~_°wÌ ÍÛL)@[€ —©¢©lTE·„L±ÔÆ‘ôÿÈ}Ý$¢6ŠÆž:úê©&\ìÞ {Ÿ]þÊ“¥·eßQ(ƒ«'Ï úðÇdQê(ÎAÍ¡Ú³ÏÁ¶I +­ÐQvüì&YNðí`âjœÐœ›Áµ+æBó‡stá“D>Â~FŠŽ3c+„•§¤Êø\D·<ãè–C¨.FŽlØxLó” Ïãð +ºÇn:.^ns‰ü™w ×LWáž@nâ a©“îñâ“hÞâ©Ý6tñBÓ ðîxÆRÐñåãnv¡Ñ]xXLAʘ}SiÙöç¸ÞÝî½+ØoOd87üàA~|¶!ŠT¦Ê­ânaî}Ýô12Ù!!òî½{l„ÞL:£4ì÷Ì7 V‚1ÍÁD}6©s¤³2p¡ qÂË“H*²Àÿ'€, ®ÇQÄC8$ÿe.ÐêqøX/“Iƒ@F“wB—<žþøÄ/euì+ ,‘"}# %…nôìnyÝîcX ‘5‰0Ëp)«/ÁÞëDgwP9öPÏ^Ó%’;VM(Áº+sh[èCîÎ¥Ûzp°ïm7ðE1F²pŠQž2›Û YgØ+áD •Ž]K»‚Ž{²«XY¤¶AæH‘=ƒu}@à'6TâZÚ`èSÝînz‰£Òˆ’ŠÁð9¯ÁV[ÙâAÀ(.HÁ¤‚QqGÇØŒÚg©Ÿ ˆck íÃeK@‹h 1bÃ)T ²Î ͤhîîÞ¨ 2Zf+ ؔά†4íýڨ͕\'!þÅxŒBY)‚ÂLƒµä‹€uüNèO¨¯-zàrK÷•«ÁG¸$¿ü¸\’ÙEBhîíØÍj=+Є¯w¿0AIÞY´YR$M”§îÇòv‹" Ú6D@®ÖÇûQ¾ÅÞÔ&¶ÕM=³…Ÿ}îq>Í6ÀËô<Àkôì°Lç’­à(éE×?ÛtL /BQͺqf³‘ä ‰¥*A ¨â.ÖIhœœ”±5ƒdÇø’w]{ñÊ@¨š½‚°]JxMö¶²Èk`_æ)äøzØ^r‰a€%Ð9É2­@ò ¨/­Íá‘Z.¡ãú|%ÚÌŽz-"ˆÈÒÙL2€:‡Á:£ÂàòLàQFEN|ˆ$¸Ð0¯éúyÒá¼ðB±}€Í&m½$ã2)̵xYIGížä„Wêxl^Ž;ŽÐv® ‹N,²nƒà#O¹V¢ˆ¯#²AÎla:ôjÕL Qã{î° "2±$â(Õ£¦ìNIèÆy¨ç×Ç›!i&9˜°è Ž½5wf¾ÇKê&«úÐAþ„óBQgq›0!U”_¸Š¹tÁ†É½VÃòÜûM:ôã]Ÿxƒ±êEÂÐ_XÿopÞyuÅ•4¼ˆ»_|–Êgþ4!š‰ì¾ Ar¦î=-Í2ºÁ¹™ÎX•óur?• +«“-ÓåsZÃ5Té«eýn¡ýKO›Ó¾ß+çdŒöï3Ÿ_Ìg]‹ý3Eʼnýj©GÇN¢l/Q×TÒÛcUòMÐlã.émÍEbÿ-=Á1†B¸‘ªI[Wpò¬BÏÛÌÞB¾Ç먎&oŠ7-ç« ÖÃx3"CÂ4ÔeÕ“QaÑoŸ;²ÍùT“ i³ÅD{®€âSÊT'Sdo†Ó ®@ª?&Ikm•)zm‘KUºËy÷­Ë•†¤ +Mlvü„[¾ ØÍ0•2TMCñ&ðn1id:Åmƾ¥›£Âx5­ÓðNN)ƒ´¸= g„•Jüñ=ËÐÈO{‘0›J~ÝßaÚ™<ógF%%¸V‡UåÚt×W€wt³žf„Þ¸ÖûOYä~T¹–í=`YH™Ÿ)ù}þØm©VEa4‡@¹%pŒÈ†€vßáç!v¬âiq*Âu­;+3èýõŒí«ïDæûN˜f¾J÷«µ%C³sˆ¸¶»‡Šö~š¥v%јìjGû¡z{C&¹ÞoñeJå~²Oû}]Ôm~À**:gLă.¿ŸÃÈE’Äãµ@r'ŽSAɸ¢Š’)E‘tp’€Ë:ÒuMFpÑL.ðìŠæÝõÇËš§dÊŸ0•îz8g…3V‹%ø8É´‘”cE¡æu¬/H_¦9Ýí¯‚Iz ”xjp"‚šr…]Ž’‹£ —úl€>Í ”1¸ t.z0Æwr–¤žlBÍR|³æ”ÌÿË"Ã5îŽ`SÃ(ªñA¾ XÇõ­¦T•ðÁ-K}B0ç·-e&zÃR„è¿YÊ[K¹ÜoÕRœýÄ(“ÿ¸øv™ªDò‹¢K‰vFµò .5Ö´N¶GÄEßI}Ï5"îùÎjçÈT '·^pÇŸ¬O&­¯ûê;€¸ug†IÎÀUaŽt™÷Ò^‡ø›©ø2s€ŽÇ^о¸K`¹óQÀO˜]‘Í¢~Â6±Ñ”‹âõÂ¥´u!Ž•þõÝÓÔQÿ$ xwè•Ï+¦ê‡¿.°_oax†]ÏÜq+¯§Áeáʬ.å/V¶˜í,±¿—õô?4ðõ ºáÈÎàI#u:ðOù\[D\s2¥"œ%¢-ìw{BW<Ö€WDöH¿»˜á›|b¤±z0Žƒ}âçQS)}aŸŠ#Â`©úçúï5TâÇJ¹¦~óg3éÊwž õÁÍr(»D]ýxFíÁ-¨7öüì½_kendstream +endobj +4098 0 obj << +/Type /Page +/Contents 4099 0 R +/Resources 4097 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4069 0 R +/Annots [ 4101 0 R 4103 0 R ] +>> endobj +4101 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [432.259 645.989 512.306 657.679] +/Subtype /Link +/A << /S /GoTo /D (samba-pdc) >> +>> endobj +4103 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [249.04 478.871 330.742 490.561] +/Subtype/Link/A<> +>> endobj +4100 0 obj << +/D [4098 0 R /XYZ 85.039 786.531 null] +>> endobj +262 0 obj << +/D [4098 0 R /XYZ 85.039 766.606 null] +>> endobj +2952 0 obj << +/D [4098 0 R /XYZ 85.039 672.187 null] +>> endobj +266 0 obj << +/D [4098 0 R /XYZ 85.039 616.997 null] +>> endobj +4102 0 obj << +/D [4098 0 R /XYZ 85.039 590.382 null] +>> endobj +4097 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F14 2895 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4106 0 obj << +/Length 3558 +/Filter /FlateDecode +>> +stream +xÚ¥Ù’Û¸ñ}¾Bo¡ª<4IðôÛøØÄíìhË©ÚÝŒDi˜‘H-Iy<¿}%Jv’R©F£Ñ7Îø…³<ñU̲<õΖ»«`¶‘¿_…q- ×ÌëÅÕËŸÒx~³ÅÚâ)?)ÒÙbõ›÷æ7Ÿï~™_+¥¼ÔŸ_gYî½¾™G¹÷柿~æþ·Ÿnç¡wó~~z¹ëͧ‹_æQæ}‚‘ó??_½[Xr‚C¥˜?¯~û#˜­€ðŸ¯_ùì ÚÅlw'ÊOb%ïÛ«»«Y\<ÏxÖÔÞã(õ£ *ðó<ž„ ÃÈWa J?3Ë ÐePå~š¥3„ú=³ãý…*†Í\§ 2Èéz‰»ž*ü$OFëÝêGä~É|>tÔˆ½fÍm÷\/¹Ù7<Ô”x6{hl«¥îeÎïA`ßa»å+xiðÔžjhÁpÈ€Ëf_•Ýx¡þÑbŽ…^G‹Ôó¨ðúJ J½ÄÎesà~³p#-4¡CîS€%pmò¦Ý`‡ãeûí;Æ÷Ó>~9Ë-¥ïuç<–¦?²BËf'j°2]+cmþwKp‡'먻Ñn"¾{[ĨË. Bó‡õ5ÏY_Y†CÕ6K”wCŠšg<5*ªyq†·E8&¹H(÷ˆçÐÉÒ›kD`10~OUNìc+g¨·dâpØ»f_¡SO ï-ž“z0Û,[\2ŽpIä.¿ Ãö½:|Ñ÷[iõ,EØl½c´ë¶‘Vš‘ÒÖ |3±‚"”gŠÈÄeQ26VG7íZ”„9cŒÊB<¥µ(•a’&ÊI1ìã‹a™CJÁhì«8%%³“Â3Ï#â D4@pÈ{ve´7>T5M½×,ŠÐµiAÔÐ7¯xè}½næ*ðÚîqJSŸ£LMPD—i`& ”О也D¢[ +)D ‰"µß4,“¨%Ív[¶ÜÇŠOÍ)åŠÒ˜ÍºîÝ9à\îÅí„X3ì·Ê˧/Km›M#ÄXKõçÁ´º^(aÙÅV ÑqJ Nyœ]ñ†]¯Q¦Ð)¦AàÝV˶éš5šÆ<ñ>èú–œ²Þ 9ØÅâ +÷¯o-Ð!—û*Q  xr:82ƒx¡‘¡Ø ¶`Ͼµ¦ž"Ò´~**³|Ž!”Û“ŽQ\R9†ÆòÁÏ"àRïé,ªmEÔ<ÏóU+\PÔ‚3Ø5ÐÑÖäÖ›Í3ϧE×ýàÛ–l¬dþcM¤<ÕüjàMŠm䲞²õË^NŸÌ³ð+RlŒÎ™v'~y0ûFÉ{v{ÇÏ/8¹–hùOa. Ñ\(? ŒÎEË€ÄÄ-ú|œ²D¨å +|Z”öñtêÅÛ³ËoÚméš‘ÔÉ“3…Oa+úPÒãèÛÁþ㎯Ý-spaõ´A‰œbãɘ 2â,%*ñ©ùáR‚ïkdN»ã$Ÿö¸²l˜`D˜‰áä¸p]ñOÎqT$¨ñ@Â]„í[?Š;N¥aMNy).@B«È$é±÷É'iÀ~‘V vÒéHªR™ä¨22þq!ϲÿ`¤2óîʱD!kÂÖ Ü¡Šøp3ÎÈ8‹¡¸2ú^rÿƒÎ ÈVnŒfGq*A$á{0V‡Œ‘ã; ‚WNE+RïˤJd´c|’,!`/ÖH3çipÒÜL) ÀÌYÃgîä¨k··¹ç7î'{Øšå°‡²\xvƒ½­–²& °|ÙÉxiè~kˆÛ9é°a¡ÇA öWã{ƒP×8ñ«PÖqÏ`õúVâR\¨œ°Ò%ß )Uy1<‰ã¿ìà-„ MB¿@ƒ0¸÷Xe¾Êâ!4 ½ã“$ ÓǘO‚ŽÐ=v~Äö"Æñcc˜°Ç„ +¦‡B4=gv¢à L¸¸—æ|°‡©Ÿe§6^öì"UPh'Tæ`|Ç­!ÕhFS¾P³bu U@b|É(¾:þýŸ¹÷™Ôa-…c«1'F’HÜAŽ##óݸ¢,Öv¿KʸÂÄ웚ÁìAÛø¢Œc8ìÆÁ½F‹‡Hç ÉŽÕe[Ê$Ý +–¢‡Xq®@"ø~}Š®ªÅÙ™mžóC˜a­ïØ.ÖMÏ waâ™ÏQb*–Ôél²rƒ04i=AÊÃ|ÁQ}!'ú*kîú¦-W‘L–Ç)¥³Å‰`BåáQ !Hv,'áà›Û Ý´ü¼+—‡–"4{ÏÜy³´Ù2wÜ’0èÍ1Ö©Ë#©¥Õ ¡¹¯£J`Mܲm‘–¨HAmØs¡^FEÆÉô·eh9Ýærqø$^Ù©F…=€cÇ f§x@œhÚúÐ;æŠê°|HÉÓóç¡ìú k/(Î(W½àí%?&4+G}«Znéx$>Øeõ#Ü8ˆí”Ιè:ÍOÂUÙÊã%‘ëÝ'lPúl Þ–Ž;n(ZIÄŸU$6 FäVæð²‡S³ËS€”„" UשEˆ#ݼ’EY4èjèjf CÓ:ÉvÛ÷ E2+ZsÃXô¡cñ­¬¦öŒà¿Ž ŒùÅö­¶µg›¹Ã„›ñí€Ð¾B¥”½„ã²[Žu#KŒ¶ÏÎcãHƒt=¶Â8 "¯Ux†Ôü…c½LYæ¤#´Ñ¥©a“ɾmœ[ìqˆ>çº@¼£Ø»'Å6¤ëߖۃM¤ +/Çæ[EʸµH +cðÜ붷ùɧ–ÕÈËFŽÎÁª‡A1þÖq×@Ãcßì)¹úÑeÎ †nÚ©ÌŠ@ò®E¾èž"&”ué;Ù2vj£OÇt >—×kŸ5O¡ê@ ªauk:aÂ8€#ÒLö‘D¦ÀºmŒnàìÆŸØ$ÝH¥æ*fIÆ@lØM%€¸ÚÉø¶ÚU}÷‚ÈiàRT •*µuã°2nC3ƒp¢‚E3$PØrÊè™K`2}5”f##o²i +éÇ*IXâÉ"ba¿#™CFLµ8|yz¨xãe•fF§ eNóÄ”mÒiãï qÊ!$2L59jaˆ«fdÞhÚb"4CiÈŒÓ ŠÓˆúèXµL˜j\­ªd%“Â1‘Á;•›Û]É[0[8ºËÅêã7³ªz/†+Ä–\¯À*N3”fìèAÏ\·ÈŠi‰ÉòSþ@..ç‰3MhŸå“có7l²m'öܺUÕŽÑWòœ:¢ïlÄ1*¸BZLu=0KÙ`]ÁÜ Ái-÷"ƸÝXåC  lÑwyà;_Q „£‰cVá’\”Sœð`Ã^º=FŸ{w7·>éœú[#C­Ô“M¼mâežð]c÷FÍ©ÍÍjað&±džy&ºËmÎD¼üI¹éyEø¥g¯d|ùŠ× ‰@Ô87@ÔA²O‘à®J¿ƒÄ,r÷ÜõåNExâÄÏÃü‰aXWÁâ©ÜO2%P+äSËEK)L’8ª4/l‡CåÒƒHrd¬6F¾S™¤« t즆QxRåbåƒÉáa³h‘ +àšŸÖå¢d£ÙÂÎQÞ‘-”àͽÎÀ×F>öBjõ[©Qnib“Öùò •ïgöÓ—î· æ*ÀýÄåÔ\2o¬.Nm0¯b”×UýÁÜ¿u cÕ@ <¨¬kÉ9HÂÑJ&@¦Yµöª‹–ìøQ ›~x±|›Sú‚]–[9qëú¼E›àaè½:÷ýDD~˜—? p€ÎAa€¾ó ÅÅ劓õ¦>¢p×û$¶m¨>¤|—ž9ßCÀød •›ÌýÃçÖ~¥ MY@ŽS\èšöO4ÄG16EL¨ßZV;;ºÔ“—;'…QÏÏÔ (ö7Îö%\\äÛ¹_Ãög,÷¼áv%37e]¶zk¾+16¤leå{ú*Â^®ÄÊ{_󈽮Pt…x.êl_x¿}Óñ¡²”¬+Ñ#wÐ÷\îÔÑ“®˜°‰õ’ÑE0¢ç0K3µ¬¤€xñµ*SÜÛ£‡è€kò«‡Iɲ_¦¹W7Ëû +œ by¬ðçÕþ¯Ï/‡Êzîù™¯’(Ž 1¸½$>&8AO—« ŠÿØäˆGendstream +endobj +4105 0 obj << +/Type /Page +/Contents 4106 0 R +/Resources 4104 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4069 0 R +>> endobj +4107 0 obj << +/D [4105 0 R /XYZ 85.039 786.531 null] +>> endobj +270 0 obj << +/D [4105 0 R /XYZ 85.039 630.814 null] +>> endobj +4108 0 obj << +/D [4105 0 R /XYZ 85.039 599.289 null] +>> endobj +274 0 obj << +/D [4105 0 R /XYZ 85.039 449.2 null] +>> endobj +4109 0 obj << +/D [4105 0 R /XYZ 85.039 428.004 null] +>> endobj +4104 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4112 0 obj << +/Length 3567 +/Filter /FlateDecode +>> +stream +xÚ¥ÙnãÈñÝ_! /4°â’lžAø˜Mf“™qÖ +&ÀdÚ-K‘’ÇŸººÙ”(o€À€ÙGuwUuÝ­pÀ_¸È?PÅ"ËS?Qáb½¿ +[˜ùËU(KY:0·««JãEøEP,VÏvŸ"ð“"]¬6_¼»¿Þ<¬Þýr½TJy©½Ì²Ü»½¹Žrïîoÿ|àñûO®Cïæýõ2ô>òÐݧ«_®£Ìû3¿þºúùêÝÊ¢ã *…È|»úò5XlñŸ¯_ùâÚÅb'ÊOb%ýúêñêv/ž‹¼jŽö8Jý(ƒ† +ü¬þ¤á@¹éq$ëºa}@€„]ŽŒ¬™˜¡ÈÐ'4–aê+0ÌøMTNØ°l'¹÷Kï︽áÑD\σƒÜkÞÙš$cöƒ×_îfŒ|áØã štŸ;ï›sÚò;oTA@´´´,Òà½e¹¨è3Sʦε½þ•veQ\ªƒ³¹1“4ÞòÚ5»_ðÝëÒ¬(yêЉÊE:ûKžE5ü#ÞÜî_vX]K^¦wÛ6@r’gl¹ÑX”`ÅäÞ\ƒAØxìl ‡sã"·„ÃÏ0Ú!‰Ê2ظŕæX Õfœûá v-ʯ$j¹ÏþÀQËÈrÀg¨N÷“ä£Rë—O©Äe¬Úh61<¡k³„D‚ÛL ܉sÀÁª1xšÓ#‚1±V3G1IU˜ž‹ŽY$‘—aÆòíyÚ ÎOLX‡f' +52û@^„öAëC­ötÊGǃ-9 Ùaj ³g³Ûœ92–gfîŠC´{‘6\fǘèm»‘-wÂÊ ÆÓ ½LÝl& ý ò¯€CýëéLÈàÀº%k ð‰ ­ŸdCqæq"ËÉDŽ…Nâøs'2€/dÙ­•…i”rúŠÅ mÂIìHv²Œ¢ÀO!s,œk+X/1L ‚ù„¥(À$n9ò. ¿ùv4×۲Έ p¼ +æîè +¹ÊxN3„1å?Êä?0au;k-g»ºÆ¶ ‚8ÌfcB)@~§DQ‘šU=·Ø>wß«5¥˜Òt7¢‰›×ºãp)+à‡ÀÉ/ò\ùMÊJfÈlf-‡ØÒ‘¨:Ž¨~à}@%€Õ¸vS•&©GHW½ÏR!64mSrŠnJ +ƒUðû»ÞQj-yýH Ì8hKz‘‹yɹȓ#Ï|n½·GT=·vÐ~œ5ª0YªÁ®«¶âëÚî:— AŽ@)e!"C*KO¼$Ì +ã¨Ù3Œ¦‹·>XÖI&+Ó{aIVð«ùsKtcËÆ-={šƒˆ'*=t¤­#`½ì¯/ÕƒTXŒÊí;Çwm];):Nïu£·“ú ÙŸ` Ÿ£@â30¼ÆSâ62ßò+wŠv^ §yâ@ÂRµ‚b+¸è’6¥…DuÓ`"5l?Ž™œËÐ+>ÇÓ[w왫\O&Võþ…²q ªo×¹*«FˆH±W¹Ÿ¦ŠhJýÈB?ĸ=.¼wà”r3*Íؾ`ã®m0!Ú; +ó/ ©Šø½‰¤3Sû5Hf¹¤É‘k#_¾J\Æ—’ç^äG „7¡©lGÕ¤s]AMÞr­ãÁÊ·Ô¦lcD67AŒß]ˆúñ x4:NE¤ð>WÍÔÎ%Uwu%‹z4 &£ëõ}CVb ƒ*‚½ü ïÕóØÇU,K¢ P<ÆizÿzàïÙÂgÉꪖ­*Uz?]ç1ne¢Û=žð¤y7R45æû4X6T=ªEÅΫ‡¢RBdáQâ9Ú½¨ ÚhÝé})‰•q²\æzaÉ/Ûº}"f]²ûátIÔ+)fÅÎÊ•¦(ã&ÏýþÉ_·Íó\]øqbbôE2FÎHÉ[Sþ«‡ƒlh†ßÏœ Á¥òÃœ_‚œŸ0^ TØv-æMI”xä¤)·7sÖF¤a ¥üÓYöZö¿±ˆD·Ÿ[tBû߉ÔÕG‰A:vn;©-“?l¶R›ž”^¨hÍ`_v-_pÿuò`¢,ÀLáý"¶Ùïtghjy)ËÍ´Àíø~{!feË:t!Ìx©èùÀ†5ÃÀ:‡d4†™"$œ%_8¥!3¨‡q$²²%YÎÚ±¤y-jI‰±«˜Ñ´4,Ö\6âØ®leªs¸‚KFˆsÓ3¡ç:£ðvçz:'á¾#“×LÊl5zƒ)F÷{ª›)®æqyO‹ÂF‡ºÔ}É/7¶ˆóìzøÀ† Ê”÷ÎÏå±s÷«ÐÓE¤Àuºžé¶ nüâ¾|2ðÒ>w4';N ÇÆ*œkàCÕ JIûQî¢tæñämDNöAD.…QXøQ¨Þô®Œ B¿@©½kd¾ÊS7ˆ0Hïf=TßÅùßcTMÑ R \¥©wÏÖüšëL&:fxdðà›¾80—£‚0Oý¬ˆøEXâó³4¡+QíK×ñá‘¿ŸI€‡ +0àF©A4’5'¬a+ 7 ™ÏI +"|%{T ë‹Ñ ÜÄÌ5 +œ«b[’Y= ª|5&”4¿ò„¼7A‹ëçCçt%Åp•©œÈö¶äm +e¢(åðdÇÐòº £XÔÀ1r\ÙáeG)ßÒ~“&ð;#=žkçÑw,ƒj)dŽøã3\áV›NŒaæ=še©¤ +*¶1‡ˆr±âa[Ó+ºáôÍ£ñˆ€ó&íf&8…¾Â¼^S=yæ'Ò‚ÅØÊšAFÆ’É/¢ñNòС'ŒaS?% ’Ùð<¶ŸÍJ,_'é î²/u#MSv˜)°º·¡R¬^÷-·H*±ññÓJæ(ïÂF/_þ˜ß  XxhZÆ^ª¤¸ð{šäH- 7kóÎcùB›žêÑÛu¢K?P¸d™Cˆ÷²üíä̹l™óÂÏÕ$7Sb˜?sª ÆöÛ‘"â +£²ç1ý[¦™dºã¡V¦Ø Ck¸ø$…ÿFs?âøó‚óÌÇõ&½#Èeƒž‚³’·þwc­0NñŸÍé–§ÓÂyN9áǯfø“_™àÌÝÄ×ô° +dùbóÃÜ87.çº:çÔÛÉ«9áÑòתÚv9[úŒ Æj,öÄ*ó>–U«ß£ÑzäyI b•x åFÈ{#¡{è²Ré!Fþa&¸Ïý87¿ ׳{øª0©ÏŸf¶’"ûÁaó)=Ÿß*æ- M±¥û±•îWG/Ô?V³N°ÿ_?Ÿ+&¹_䢎$Êü4‹ 2H~’œ…*÷“\Í`ü_òÅÕ¹endstream +endobj +4111 0 obj << +/Type /Page +/Contents 4112 0 R +/Resources 4110 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4118 0 R +/Annots [ 4115 0 R ] +>> endobj +4115 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [430.463 233.482 509.276 245.171] +/Subtype /Link +/A << /S /GoTo /D (samba-pdc) >> +>> endobj +4113 0 obj << +/D [4111 0 R /XYZ 85.039 786.531 null] +>> endobj +278 0 obj << +/D [4111 0 R /XYZ 85.039 410.091 null] +>> endobj +4114 0 obj << +/D [4111 0 R /XYZ 85.039 389.497 null] +>> endobj +282 0 obj << +/D [4111 0 R /XYZ 85.039 219.213 null] +>> endobj +4116 0 obj << +/D [4111 0 R /XYZ 85.039 198.016 null] +>> endobj +286 0 obj << +/D [4111 0 R /XYZ 85.039 103.781 null] +>> endobj +4117 0 obj << +/D [4111 0 R /XYZ 85.039 80.463 null] +>> endobj +4110 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F35 2880 0 R /F11 2898 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4121 0 obj << +/Length 3439 +/Filter /FlateDecode +>> +stream +xÚµZmã¶þ¾¿b|¨ tu’H½E‹}¹ô6Íím³R ÉÙÖÚÂÉ’O’³wùõ7RôZö(ŠàbŠ‘ÃáÌ<G^ð_x™Å~ òË4KüX…—ËíEp¹†‘^„"q%"WŽÌÍüâÍw‰¾ ?òËù³'ü8O.ç«_¼Ûw×ó·?ή”R^âÏ®Ò4ón®gQæÝþë§Gî¿ûð~z×÷³«Ð{à®ÛógQê}€‘f¿Í¿¿x;·ê8 +‡J¡2Ÿ.~ù-¸\âß_¾Ê³Ëh~˜ç—Û +?ÖJžë‹§‹Û¹xL_ò[S{UæÇ™:Þ|;›ÃÈWat™Æ±Ÿè”v¿è@û¶X-‹÷6ÀÞtêµ ÿ0¸)±y5 +ήÀ,K”,ji »äWaèÿ×vÁŒ:K¼ù†GñýÇ;hßr»¨û–_ïÊuÅ+—]/‹òŠ©·o*xåÓ^x™›ûOãÒÅ;K4?˜â*DKå´³§k<²¾Æa0FèCƒ¥ãÞAÙ¿‰€k­Ì×Y,ãß„‹‰)¢ÀO‚DDþ>1Ø;¶k¼TÃôN#Ù`ª¼Ÿïž¸‹LPv¿£ùʬ' +¬'rîF©ƒlýe§‘òÞ_iæ‘£ýÿswJšb+ºáq’Ò-ºÖ–}ç Ò• +c?ôÁYuåVà=Aä=£ÇuÜÄ“tÁØn‹ªÁvè½/úü¢ãçn£«’;ÂS_š¾¿‚L˜{OÙµuéL^ ü°ÁHÀFÓRÕ¬yê¡åþ•üòâHÑÐy\Mxá8…Ò9ì³.XÝw -ÿ{³ÁN;‚jY UÛ€Ê*VÞb?ãàŒƒ1(¡ý#„â±kûöyàÙŒ°]mwu¹5gÞPàûUÛ>í«Î,Ý»;ˆÇ àjJÃÎe^HÛ„-?/¦Nc§œb!>K­Ìå®ÑøâVž¶ÅS,±di\Ç8Œ ãñîÖ?‘Ì¿àèçÑ¡œÁhèç¸ÿ1g&iäG*#“$~äƒBÃÎà];SîZ%)9<‰5¡+AwÑŸg +­ È*¡÷fè:cÿ5u³â6žêЛÁè3<=z\¶Íž[›#ëþqjë¢ñÙ­2§á"‰C€ E[¿-¢<÷Þ?ñïϤيÏïa®¹ñ†e¢ ø|ÐñŸGþ}ìÚgëyäM8[Û ´àø =e‘ìk£ëâp%¿ì0ý +ßæ„#ÃaÀ›ëS‘IA¾DKqã˜TL‰'OƒÛí­ãeqðŒ2<@XS°òÄÒ&øñÎ4èÉò.ºÙS¦ÜÈ4&î°“ThyB +¹º.;“|y +Ái£(òîþ]Ù½—ÅÞaSIkA™Md[2뚟 +þ9@eì8+ìïd“Ñy _w-f·¼N@EÊ{BÆ%g÷ +›T¦ü$Oþ4¾-'1è”>ƒoî>c—PLtÒ#ÚQ)°;ðÞ@^Ùsÿ°)HBÜÓYæmx ¼ŸF$‘E¯²ÌPÉ +ërž‹}ä·Ÿ;q{^N¦ú´· ¢³;O(¿ÿG öBš™„3H= TKaÃ.@€éì)¦JªÛu+C9¥°Í™8e¹m>˔ײ /7Ú»§¼ÍDaiŒÝUƒx(nÒ{Ö„¦eˆR‰ý†¡NínÌÇYd·…m6kfxZÍë¥ [\ÌÈp¯c“f;xN3ç“A&å!Ðê3Ì!0x,×!­0·{‰ŠÇ;2»w–æ‚Í´=t…Ì¡ÐÞ›C)»¿ôüÂÒ(É^û@§>Ï/ÿÄÁ+¶ +ä†` ;¡¹û1·¯àlj ¥&£C£–´K— ˜þÎñÕfb»·Æø^JĉÂs+„ä÷Y ¸\W+‚0Ì)þ€«¯¨#cùƒö•N\#`äQ*üAá™ûº‘„Ûïß-wæp‹XOùž·Ó±t#R¬÷ê Õ!Á%*=¯ú(sÿužùAªIJ¹¢Ð‰F1&'#LÅ£e1‘™â~”všòÛ×ÚÛU³n²É¤úFæÊbýõÁý$ó“4±3¡þ`·ôhE¥áŽ~~A9^ïÀ^*‡Kx|°_á€ÀÛ3°Ýßq›8€Šµåȱk§XH6(nø– uŽ£qH078ÚbåÜ´wƒ™zçt`²(P#ÜN„Ó¨H"9´ìì &f¦’@I"1µ¼³£ ÍÑ6”oÞsUåÝýÃ[Ÿàó;sœ`¯ç… ™y¸;`PÀÆaF*8C¿ÜĶ¨ãD~¯š%’ ˆ¼'NR°½¹,tfa?æ&±òüìÌ ”EW[HE°Ö&Þƒ\~H®L|a[ãŠ&ÿc›1—§4m"^ðËæn¬Kúð+‚g('æ>Þì_µ¶Ç)ÞôŒ[0 X-Dw@û§Êð<±ÙZž”íÈšfô5÷ñºÐppØêHÓÂÂE,3‰òtÜ>´¡‰îJýB@ó±Ú„mp؉=áí*JG6º‘W¤™¹0|”ŒŸ|WDD1±íŠ”4pÜׂó0ÁÚ"£=]F甪(Ò”/üüD! =†Ôb»„!<ó³%Ð&ÿ0y&§óY•þÊmó^X¸š$—ëM%ùתþƒ¼W wqàŽNýØ´†{)•8J::1À㣂‰£`,&N4IǜԕOûŒc´=—Ÿ«~0¾†7F’Sˆæ bvœxL]OÜòLiáœË +E(?S÷r?04½ùNäøÔ3÷€ŒÑ¼kÛá€ó(߸Ñí–Ü@Ò,ãÆ©(ñã0;qŽÐiŒ3B_Á¸³ +Æ­7…qîzs¦Ö©÷SS}æ–Ã!¹cU Ų?‘—J[&•µtÄìì¿4L…»}¢úÃ^AÒ:Ø·7ÞE­Ìm ‡£àQ¸Í9z2¬:Áµ…›¶:€Î]‚Ø2SeH¨å°|³“«ßËŠGÙY¡£”v×”‰àA÷1Eʸ¶ˆƒ#âf˜§mF¦ÒÁj¿ÇÛŸ6dL°§•_[Șt2Ðá+è…a¾“4<:꣕¡l,¶±(÷ö¦¾K/›²)4ÇñÅ–ÒáÚ¦o.&z[¬J,Ö‚€#1ºŽÂñ#Ö{ <‹‹í~½!x=Þ*GslÂ1fM±Á¸ŒgS¯¸Ç,„m'ê µ´8€¡g¹4.ÌAÁ,6^%šØã]±(zšÆ-ìSõEš¿Ä2G©á™J"õÞÂ*´8ÎÞ›ÌeŠ Tþå!—7yN¢ÊÄ >lKl¾ñ®xŠA¦"½¿43G”ýèëØN>¾^÷¢óõ<þp‡Š_ËWξ­÷×`¹ãðàƪÉVã¹ÚS×þ)°‹ÂÌ#}ì¡Ó`g„¾vg°;Zo +ìÜõì"¤x{ȼEÁˆbdê@÷Ž Åò")uà¯-ãCWîj·,´ân v‘©`ƒr¼;•eØ€#¯‘NŽûšR`kQQÄÃU…p¸)}$Ó<E;Éñ·Æ–½«Z˜»YÎà¯}”€©©z#ÆÚSªH'~ššZn¿])WÙ8ö³Ì|N¥{Ivòщ>›ˆÂñþâD~g‡ÉŠP:”Ðê7Hÿ(ß›Ûq˜™¨ÜØ9½’2RÂï¢k?š›!>[²Òל¸°Âr%ó»"•,3mšy¶ÆmRS¡ËvËõµfåå&¸Íõã çÀ_ë´äLª*í¥.¨Ù|½Ë\(ÒEØù +Ó@ÞÉ#Úýâêð€žÇ¸Ò»ééÆ0k!MÈŠ?L5zTþ«Œ×²`~Põsï†EˆÕ¦V>ÜÛÎ',GètÂ2B_IXg”„u´ÞTÂr×»n 4e ^PL!>×':Šn¥3ÃÈ3aÏ™Ëȳ”Ò“ýÞÌé §yf"žw|lSz§’Êvp- +[ļ”>"`P;$‡‹fcÂ=GÛÚSíë”FæÙql–î¦&=-»jg>­Â,´o”³¨Z4kŠUÌ€­LRɧ÷)_§i÷UÈy2Må"'+8~¹&ñÃF€\…LLU¨FèFgbI *ÊÒA±W¯PŸþ¢ÝS!.3wQå Ýjp¨ÙͤÛ,¡L––âÉ·'l¨b_«É#†ì²ÿÓŸ©Ù“ЙŸg'N"ŽRH‰Ú(ƒ''¯6Îv¬ñÐÿˆ¢endstream +endobj +4120 0 obj << +/Type /Page +/Contents 4121 0 R +/Resources 4119 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4118 0 R +>> endobj +4122 0 obj << +/D [4120 0 R /XYZ 85.039 786.531 null] +>> endobj +290 0 obj << +/D [4120 0 R /XYZ 85.039 686.185 null] +>> endobj +4123 0 obj << +/D [4120 0 R /XYZ 85.039 665.192 null] +>> endobj +294 0 obj << +/D [4120 0 R /XYZ 85.039 538.238 null] +>> endobj +4124 0 obj << +/D [4120 0 R /XYZ 85.039 508.834 null] +>> endobj +298 0 obj << +/D [4120 0 R /XYZ 85.039 105.893 null] +>> endobj +4125 0 obj << +/D [4120 0 R /XYZ 85.039 84.697 null] +>> endobj +4119 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F11 2898 0 R /F20 2865 0 R /F14 2895 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4128 0 obj << +/Length 3338 +/Filter /FlateDecode +>> +stream +xÚ¥ZëoÛFÿî¿BÀ}D,—KrÉÃõ +ÇI[÷‘øjŠC¯(‰¶ ‹¤JRçø¿¿yí’”)§@ ÚÇìîÌì<~;´ZðO-ÒØt¶0iâÇZ-¶ÕE°¸‡™ï.”P¬„d5¢y·¾øêÛ$Z¨ÀÏ‚l±¾sûdgÉb½ûÍ»úþòfýá—åJkí%þreLê½»\†©wõã¿oxüý§Ÿ—Ê»¼^®”÷‘‡®>}\ÿ² ÷ f~Zþ¾þáâÃÚ±3bXiÌüqñÛïÁbŒÿpø:KOÐ|•e‹ê"ŠµGZúû‹Û‹¹½x.Zðª9Ùcúqª_ +¯ã‘ð*Ìü(‹& +ývB韚öñ¾mŽ‡å*cïkþ¹½ü4"Áö+…§gD½kª¼¬™¦Ê»¾h'Ëêæ köÍ}Sw“5ÏE‡‹¾úVY]%~h@øAÊœâ‘μþ¡€Fx¿Ýï› è>ßÿ¾êðbŠ-þßÃPÙÔLÓÜ ‹è”©B"í+`3 ºjão›ún†8ðe„Žö„½ñ ËË;<ùý•Ï½õòÐaGžÑ– +éö8WpûÝû+a³ÞÃè3io‘Ÿ˜x¢Ä¶¸/AÝxJ{¢†:¯¤·»+—"„K ÊŒÂD¤øÇŒ˜©¥±ÌÿMmçöÈÀ#!ùçÌÀs˜Z‚§¤rûëõÇ[â+kÿGÊiÑï’4W‚¢*Ö HC 7-]ù¾¨˜$ïXgÊ(p€l¢3«iÚ"¯èDH¼[tg1òÓÔ×ú‚š¢¿¨¦ÐckP('ò”óÏÇ¢wýé;±'¾‰M¾h¤ Éòž;vuE֑רϞWô Om–+ˆS²˜L‰¥h‹¨/™t2Qß7z†5©öª¦-¸ÅG×ÜijÑp™o1’å×\gœioçØk€‡¼Í™ÏžÉœuzol˜À]T>Ø;Ž}Í;ÔÍîß5-lA®…,¸ ‡6ºÖËXT7 ™0ËX3A0Q¼b +šIfþ´mföa‹ yÍ2”oœe<=”[¼†æ-ïä—Ž¨þò£H(2”æsÒ-S‰Ù@‹,%@Šî;Q°òØ ±·c¡zYS9A1¸X4 K7¸¶¬òöYÒ¤½DÌ ›bÛìÉcíQþ™Tg)©æµÜ>¢¡ôÂläƒU³æB_«p§¡oÀûÁÄУ Ø©*Œ#È]b¼mÛ,5@wŽÙåUvbçä"…¬" +‰ËnäE¥tìoΆÝæÖŽí׶ÿ$”îóÁ¨qËqq#S£Í +É­/“7¿qÔxæΫƒ»6Ë5&¼\Ö<-%¤`xÈyùK‡k‹;r,°‡¾¡ìy?ҞŇŸpiÞ‚Ç=O°LÐ@ûb ÛQØ#w×û0nüPÊH' ¤ÀtÖÐBãÇyýfghÊÏâxr³*ö“t°3å)4¶8ð~†`ˆ˜Á|Vlt—Ûms¬{«Ò$ñ—TAº€ùâó¡lAoyò‰6 …Co›‹é^s×|sN@¸Á“šó¦e@2L^³–3ÈÁ ¤á½µ«Š‡ŸÊýÍ!Ã\ —µ¥»ÀËk…ࡨ'8¿=¶<&³Ù€«è¬¼ë8*)ÌbHøß éÀ²*rÌlãÐØ6‡²µïˆñjl¦1É®qÛÛÒµXòø©ð¢cÏméÒ.åZ’ͮǩñ—xè=†"Ns„k!câå~ðŧƒ]¥ŒÍÙyNe=pAì»~Æ#s¾—/Æb…(QNÓäM»ÃÑ€øÖwy?R0’“‚±AA¨iK$«7Vpê¡¿"¡SWNTŽ·C‚%󙉓Ç*…Ǹ·H¾£—r[|bý1 + jM|Ò*ѼsREG1ŽpÆŽç‘ÂoOÆŠ­W–#OmÙ;mU‚qÛñëà +Äí4ÂÛ§ÎhqÒ­=wF´´¦+1}¢f£„Ü÷LBÎ SCLG ŒÖ¸TÄ œ9­0”lyÁ©RqŒ2,üv}ÞʾÁ±)Q¡ÛÖ¬Zw¶e¤ìßt3‚¢ÊìØ3²Bcá­¢CÏíÊ%è]pÊâWZB7ùÄü”˜} ßä äõŽ©º²ÞÊ˜Õ ¶WR®îÉ´°A2Cÿ"kr8r¹‰‘êCBíaRæ?‹˜iìßå4‹É# mVLÕ™[„¬Ø&ñâ8l@ðÜïÇûÒ£]fú¾¨½lL 8ÅG?ÐlL/l  %öŽ¡=o¾s ó:ãtÇÒâËP› ‚Aø‡tœµsìjھذn|øš3MÈ·EPõ(øáïË £DÁø,Sì ‚ã$ýæhCuÏûÂÈnÃ+7¹Ü¥h¤š·ìûÝÑZ)’Ò§[öö„}]^qß…VÜ«Þѽ3L)#]ß“—"ºJ8é$à§Ü}>D2 +½ŸÞcçòFf#2Maˆj¤]äNŒ„ +o¹EÎBrÿŦft±õô¤/ÇÂyt¤#x1„é«èhDsþiøàcü +þ»bµ&Þm^O(rj¶™„Ÿú0Èàñ(àÏ\˜,)ÜäžÅ7ìpðk‘àÇuÄ›÷WçÀ ˆá_ƒ#šó`P™o þZöŒoµ>ÍÐ +34ê$|Ë­š_ZœGò¾t&}”±1rfPD¹ÍÉ9iŠqh?\;㩇©1k)Øx¦Aél(hâŒ/­éîHññƒwHRUŽƾG,Œ0«(T\ú£ ñòq —¯—ðT*Ðq²´ L{Ìx¤}Ïà %!ÅÏü]Ñv¶n¾d]÷•<„ñÆ€æJv{)—Kô.9z÷£øMFG§½åXKÁ­Ÿ¾¶&lóNò°m3ð(:[ìƒk1ù£e÷@è|üÞïä¢5ZÐÙøí,1L²×,§µ¼E)‡Gqh x™†iS±Œf´yÏ@ÐTqØ—¶ö”÷㦺$sÄ#lD’œ:û8*û|#愤]ß´ù}ñ2–34¨Hð×¥•²bE=Xí³kÜ·E7”yvKwŸŒ¡Ñ5•X—Ó*î`…§Å¹šÆ ,Û—\yÂ>Áá ; ±mïÆ:uoó¹ûäÈ àâšË ÷…ÔÜ«Ú›á‡üÅ¢›„,B*eëóEaY[ÎC¿¸ OÉÿ,á!Æ@ÒçU©MX¥p7`ºF†¤Ãnh§Wg“r5}ùPÙ# +Cz‹†Z> @ŸÞ!¢Šh1äŽrŸo¸Y Lcý\…Þõ¯ro,Xyór+êŽÂvçÞ’d1X³®¤ÀÒˆ=»] ½‡ó?ñìBáJÆ•1lãW¶˜Óñ`‹Fb; €¦¶¶Œã›B³-l%n¯sĪB1,ZOŸ ضF¼!k6±s`Be\3~5»Žh΃ Ô&ÌÆ`B ˜øž +•OœéwͤäbQÞK©°êé®Úл^ÐþŽI\ÁäfP©ö£àõÚçˆæwvî3†™58m˜Âø½¼3g’*nõ ‡ò5ǹ&ÛP²³ÆŠÈ!3ÞÉ{øÔ[?ŠÉ¿á›«Làžî‰—×÷rL)ËÈšk;X “6œÆj¢pza‹¦ ÑôÌ£RH`D·A*ŸTÒ‘n¡Cö‰Æ¹›ñeCƒó¸~ƒ·üžtŒ’­à£É_0˜À ¤' á™›»žÊÐ,çî¶.¸RÅ5²œWœ;›Ç°Ò)#Eht.LºJFP•8æj+E@H4²9  –êg†c4=.‰ „Á’^iqŒHWsÂm; çÚ`éV“Ò°NH=.å©Ä]áÒSè,!DPõ¶}Fv‡¬SÓ™¶u/m«bÈkëü@Ç’qÇ…{TÓ +üX`¿U\ i¸)¯Ü¡7ÏX‡°g ”à ̉OA³É¼›¥À #6m¬=âØŽM™ãÒ¤RMÀ±Ñn¯K²óÞ +´m÷\o1”I›Ýp5\YëlÀ7â +Ýw8ꥄŒ­i×K¡àÑû3rÞòz„¦¬S4¢;ÚÊ7fê éBä ~#Õ#"£l¡µ8ôüÅ3IÆÉ"‰|£ì_a4õþyæ³h¨ý4²ßMÇÊ€ÄÑR`&ÑïÆ_ÎŒ@=¬- cÊÖ}f2£h ;Ù˜ë˜gHS?N¦>ùšcü’3¶8­£Ÿ-CÄ~Ätšbƒ…ô—þhÈ%ê(õ³4œÏÓø™+1‘e%‹Í)Ãö‹^rüÑs +ãendstream +endobj +4127 0 obj << +/Type /Page +/Contents 4128 0 R +/Resources 4126 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4118 0 R +>> endobj +4129 0 obj << +/D [4127 0 R /XYZ 85.039 786.531 null] +>> endobj +302 0 obj << +/D [4127 0 R /XYZ 85.039 598.606 null] +>> endobj +4130 0 obj << +/D [4127 0 R /XYZ 85.039 571.991 null] +>> endobj +306 0 obj << +/D [4127 0 R /XYZ 85.039 527.507 null] +>> endobj +4131 0 obj << +/D [4127 0 R /XYZ 85.039 506.31 null] +>> endobj +310 0 obj << +/D [4127 0 R /XYZ 85.039 344.328 null] +>> endobj +4132 0 obj << +/D [4127 0 R /XYZ 85.039 321.011 null] +>> endobj +314 0 obj << +/D [4127 0 R /XYZ 85.039 197.555 null] +>> endobj +4133 0 obj << +/D [4127 0 R /XYZ 85.039 176.359 null] +>> endobj +4126 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F11 2898 0 R /F20 2865 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4136 0 obj << +/Length 988 +/Filter /FlateDecode +>> +stream +xÚ¥VKsÛ6¾ëWðVpÆD ‚àãÔ‘e·MšØnÌ:i°Ùœ’‚KBÑøßw Òr¬¸‡Ž'^pw±ØoŸ#¢~DT)žÊ:*«‚+)¢u¿H£{°ü²Á# .É‘Ïy³øñç"DÊë´Žší§N¹ª‹¨Ù|f«_—7Íå§8‘R²‚ÇIYVì|g[ýöÇ é/®?Æ‚-ßʼn`W¤Z]_5Ÿâ¬d×`ùiÞ/.›9£„…”˜Ì?‹Ï_Òh‰¿_¤\ÖUt€sÊE]Gý"W’«\†ïnq»ø}ŽE¶<¢[§°+YqUÉ×à…:/2ɳLD¥R¼ÈK~9ÆIV–lÔíOÓ$¶æ@×¾›à{‡‚TmÁfsšªbûчÝR÷ö6\ë{°èÈÂKx +9` ¿±è>î.ä²uðþ+J£ÃaöÚ€–gÃöè5¶ãÃîB"ãîG‡í‰’PŠD`=k_¯×Éîñv#¶7e‡¶UYÍî-I»wá°EYaú‚=áÝõÝŒ×a¼Îµ˜ÿ=]³—šÄWbx¢8wCœ™õE×¢Ì%k¦zâK½¯ÍsY1Ø- ~qÔ{YI^ +ÆQï¬#Ÿó‘LNÇ ¨ïCc ìfãóÉYW’y °{j§`3jP~¸Àž,ýe`£©ußY!¸(äÛ[þìã=«àµR~ÐEƥȢ¢®¹”´æÏ9¼ ¿¥R¶ÒXé¢`ïP”lcéÓava2Ñ §1ãÁ£‹Eð"% „f,o~úš)‰·ÐùœXÛ MYñ2Mó`¨ã”’–GÌ5Xôn<`íÍ@ßSž+öç%œoÃLÝêÝîp~É÷1Ì“õ7¨$̆Ts2ÿIl@9åiZKB¨ä(ÖkôR¼Èä ôf¦)×uþ© {,°¸ý.€F€~27Ó|¢»³¡Z$ð‚™+Ù®5G–æÐñb1p²«0Ù)ý­!luà½ÛÌdÒU7Z:mm‡£e±ø‡‰;¶füÄùÏæÄFÐ:À{zª5tîµ ‡­G·v¤#i¾Î> endobj +4137 0 obj << +/D [4135 0 R /XYZ 85.039 786.531 null] +>> endobj +318 0 obj << +/D [4135 0 R /XYZ 85.039 711.163 null] +>> endobj +4138 0 obj << +/D [4135 0 R /XYZ 85.039 692.291 null] +>> endobj +4134 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4141 0 obj << +/Length 3066 +/Filter /FlateDecode +>> +stream +xÚ…ÙŽÛ8ò=_ј'«uP×¼,:Éfäh {‘f÷m©m%¶dHr'ùû©‹eÉnˆ)²È*Ö]ÅoøÞä‰ÄÅM–§~‡7›Ã›àf +ÿx +„Jb?Q +Æ ‹k³ºN#?PÙ"ŒàXg‘òU®æíã›ÛQp~šÆ7Ï7aùqݤEá'YvóXþéeþj$÷¾=èzzÍj§™÷©:ÀÇ|„^Õõ»ú¸úÿã¿ßüýÑ¢Œi‘øIz•¦„H +“›0ð‹ ˜”&~˜…D‘tDYâ}*ªÕ:ô«(Gzà¢æ R÷ü«ù§GèŸ$Þ·jƒ.*¯}f —z½ç/‚h˜¡QÕáðwÄ•yÈ38/48èqôö섈ËX"æi/£¡åߣî`ÃPoê£*ä&pi¢h º¶†ÃT!\?Ì¯Í =-t/+gÙ¥â€÷Fĵšî‚8[¢®N¤"8p§ŒÀéTºùÆ0¯Áù¿xq̯¡ú9[°U7%/Íøƒø‰êS/Ø„|÷Ê Ýx£À'–0nCéà†#Qg¾àEÊå±e˜÷¸$Ô é½AØÝŠø`O# JH#Ñt¼€¢ï,ušî¼iO|Åž.˜zí°3ª‡ÔüÀAm$.jÃÑÖas{Ú— ‚mZŠãxÔ8V“Ëã7^ÚÿalñÖÍ–§5ÿ¼ÔÓMljh^}n;t#âïSoÏ#ò}"RŒÐ¥ôq‡Æ¤¢ ¶ïôq ¦Á˜mgYñœþ‰eðÕ!/C¯äÒ1$,d‰hdãêQ$3h]Ñ¡Õàz)¾ç¬EŒ%Ç„¶ŠZ/ÜèA³¡b¦*2°W!•§N[ÞáñN¥@éx¡DÇaæÓƒ|% +K£œ?z9ÉÚ×F]Xx ‰ëZÒÿ -âæSg@û êÈû†G× ±lËSBxÙ®4 yƒþ;˼¯;#pø@)ÆP±3£Æ d2zÒòH¿þ†äÞ[^Ö¤,¸…Íí€ÎÔÌÃ@Ë©(\#ëرÓ!K¤Ù©Ñî«~Öý Û­QÍÂõÌq$>š‚˜¸éjá­À[OŸ/ÄÌÞ"5ÊÃy +ŽÇ»™æZ.ãxÝç–Ø×Úh€ª%!çè f’ßÅKF …^œ<Óxœ À¥$2Hù!NVò}ž ãÜšÆί»ŸÎD³Ãßó†°ŸßòO?´}Šˆ ÅÅv“,ÒÉŠðsj±g½d §­%õĒㇳ çXëŠÃåüÙä©Ê-3.¦¨–ôu ›€[¢\é·¶–‘™14!OÝÔM2ž—ˆµ.š„ôPØ„µÒ©6Äzñ|Ù©ù§á”ÖXœZ¬=paÌħiôå –.“³và¯8e7 E{¸Û #ðý¾vBvÛýâÍV 0Ö²SóOÃþË=cYøyp¦fê‹Hüs~ܪp®©®B¼¹w­Dè1wS%œëD2;ê°Ø,8âbI´qZéòeÏ z[õœG[%ã4ô!'Y ·fíq¼Un¼r?…\Áá Êg3Œ±òÃø:B™ã›Ä÷¸ð“<™àûd õ‚QıI–¿[«'…æ´¢D–n+ã‡Mn&I–£=V¬Rƒ ÓÊWÍ%Ö«ÌÏ‹×X?]a½½Æúk ëÏñ-²ÞÁ7fÁ½È9À„´"Æ I`»ãÞOÙd+ +lj[ñÒ(ÇÆ­½z[ŸyÛíe„ÇYº8©…fa郉øã¹Gy¹†Ã"¶çìh/Ÿç­œ4 ¸ûÄU7†Øëæ©®ßm¸'qZ¹5wH^_7`Æÿp®$禟t/¸ñpjë¸jŽ ?¨3¸»â±T˜]hÎÁÂ,ùUaνP™”`TàmaæÄ?B6ö\oýû/*Ä4÷³(ر¾à¦ Þs‡uhEŒÐôÚÄ6{GÂ9‰¿¦Ë|7ýã Ö~» €qâ+PWGÿ.êá:WÃt4NRsÞ!)ÎQ&qa:¾‚ó/éendstream +endobj +4140 0 obj << +/Type /Page +/Contents 4141 0 R +/Resources 4139 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4118 0 R +>> endobj +4142 0 obj << +/D [4140 0 R /XYZ 85.039 786.531 null] +>> endobj +322 0 obj << +/D [4140 0 R /XYZ 85.039 766.606 null] +>> endobj +2953 0 obj << +/D [4140 0 R /XYZ 85.039 674.702 null] +>> endobj +326 0 obj << +/D [4140 0 R /XYZ 85.039 525.576 null] +>> endobj +4143 0 obj << +/D [4140 0 R /XYZ 85.039 498.961 null] +>> endobj +330 0 obj << +/D [4140 0 R /XYZ 85.039 139.947 null] +>> endobj +4144 0 obj << +/D [4140 0 R /XYZ 85.039 96.006 null] +>> endobj +4139 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4147 0 obj << +/Length 3915 +/Filter /FlateDecode +>> +stream +xÚ­ZYsÜ6~ׯ˜ò¦Êœ”†"Á[o¶•¬ŠäÊV%y † ×3ä„œ±¬ýõÛ@ðìÝl¹äÁÑ@_7è/<øç/ÒÈõ‚l‘¤±þb½?ówÐó÷3_(VB²²h^Þœ]ü‡ ßs3/[ÜlÌ<™çFY¼¸)~s^½~ñáæ‡_–« œÄ]®’$u®Þ/}çí‹7ï¸ùío¡þr¹ò ðËõë7–ÜütöÃaÀbÑ\þϳßþð°úÓ™çYº¸‡²çúY¶ØŸ…QàFa õÝÙõÙ?Ì\Ü.xÔÜn£ u£4˜n׬íú*p•òI¹q˜Ð~o¶år¦Ê9ä]‡;º_ªÔiÚ[}§ÙðoÎD{¤È×H²­jØ» >¶§îÈÅ|½F¢æ½5šöc'%ú  Ãwôê´ôò¶,¤©Ä¶u[Ê›¦e^ˆ¶\ŸÚ}±’ ®|<¥ŒvµnˆÓ=®B>+b*?VPnêåJe™s_·\:ny+ç9WÍ>¯„âUÃ;hqÔnW¶ !ÀͶê˜qTÎUáùÔâ:GûÀ›’ׇfä›Wmø÷ЖŸ‘”H`Á Œ&­iƒÞ`k´üD,7mõoG±ÄsSˆ<š¢Ûߺ0û†é'y.Æf¥Þ<)>‚RÁã*E&èüª®dêüȼq•}Ï•'†2T +uCPsŸ“maë§|WÅóןh{źŽÅ¹«í/†¶®¡ãŽ¦Ö.§”ÞÕÃÒ*­äÈáwz—2y~ÌoóN[Ÿž¹ÀÙæšåÝKíдíjØk×s0ˆ,}ÜeËÅ íp/(Ÿ{7üKî™@ T +à‹KÜ’ê0h*~’¹ž%(É÷ÅœdDnš¤BXP¡÷óßo+í6qYV*¶_ ‡Â–¶ü+JžÅé4䨾°8ìš»ªæ⛫s‘!ÉAù#…_¸bÁ÷^! +AÏJ±ƒ–§Dåþøæ +~üsn!”ƒ…£^áçùy›×#Ä÷Ø_Î*çº}@­8!ÌXMr†û÷xñt‡E +ƒpÍ-adäŠùŽ4Ã\a ÓR¢ªÐPÙçO£whDSºKøV:lGØJ X¡R+iÅÍ;[y¸r®%LÃ3Y½·Xù`óâp;·š¡Ö +·f-i¡ðŠw%«¿Öö)V!žÍ±|k,úhLzž$ÙW,COô„e¢¯Y†§Ô–a¼Þ¬e°ÖCøŠ}Êwœ²…ãAÆš•õµR¼í.~æäÉq–|;§¤R@‰Um…' :¯ËÖ¤Ö°²§LU¿ MŠ±ýTxv,±gF8:cÏLj: v¿<í3r-t´û>IKÇ*$}¦kÖéò~é„ {€F˜ÆÏÅß`_)ê&ÛÊ’e+›»¤Wflä€Wõi<,W{]ÚJ¡‡ãº ÒýPiçœ2~`Ï+¯th±bkõ#ÃM$¯Íø?EÈ:GIYóé6M(o#U“rŸ|ŸYÖƒg%VŸvÍã‹ÉÄÁséWr™k >pЋbz5Í^‡$ +âêBlélúd¯ŒîjqèŸ×­ ]¨y ƒHzô‹ÊÌ·*ö]/zò뎞„4IA§ïfhq6ƨ0s•bMJ\åÂÊ>b’ˆü 8v^õ(–Üü¢Ï×[¶„P¿Y‚HðÇ8è(žè±{l²ü“Ûèif,‚ÞZ"e¥XB“E­f±­;–.Q¢ÎÃ8€ÝÜ +všÕ˜ sþ;lëíNRÅ°Ë{ÄN£/<¯=0½Ñ$<ö$$A€½”SX=ÞK,Y5ågƒS?ñÜ$Ìþ§à4Š•| ‚ °?Nz5¢Vz쬥b\¤()- òW*‡#K|®K@£÷3¬¨ÌMMHÝ´ +§ H£KŽÚÐBgÎó¼(°”ö‰ßyÎ} “÷Œã±ÁD´X¡^yRn÷lý±ÃJ¨È°Fæ\­Gé´ö1Æa­ËyÜ›Ù×ÈMƒr´ëŸmȯAF.ˆ¢ü’CD_Žž(%æ…1”%Òù`5µý&TåÀ]^ÎIÓä]¸mšãßæ.Ô9Й¶‹S×^t·$Ö½Ð]!ìZÝñ¯/öVÒqQ”Ÿ/ÌFv;!§åò³ù88@EmŸðkŸg2«`º‹[:Ö‹ Ùiù¸…E ðI ÁøMŒ‘Q¤ÀF§ ?öÜ4ý†Oá &Iæ?„[é¹VÖd33ŠÜ 0 Ò6lñ»™ëZÊõGÍßtad",?¸Ú Ÿ¿çÏBÁéÅ°&Àaø—ÎBϵ²&›ž… +•›~ÕDƒÃ@ “DÃë|/ÊóýËë+ûñ/¢Á{ý¤m¾ ÑŠ·Öš7H2•}9q i}V25‚J)7T:_½F¸¥‡ÜÙ<~’éǯ=¯ì£Íé'A¥‚ÿþÆGäe˜ÃYåüûlúÑÃøâCßMÀÃûÊsLù—.^æZY“Í]|¾*1+š‹¿üþÒ÷|øó.ÓKþéüjwçï|uOaÖúìIÏõôžÂ:ÕtO—c#x‰¶” XÝpÀYÕÏÄ~©Äõ¼xüåÎLÒ:Ë},Ýò5©Ä$ôaLõ>ŠLsóGn&ùH/|%÷LBïŒ?ÆËû7ÆX¿ÆeGK`Þ¿{&õáÐ&tT˜ñõG½õó£þxÉw5´z[ÉmȇB¹IIéÛàsöà÷¹b¦y|à |6tÛRgDÊ©™…>ÄR1ó™?uL|†tæí‰Oé 9‹Ñ±Î|à"$füyÑèýíÇsnã]ŸvEÿ:Ø«Ž,BíÅþ·‰Pl™[„`Ez’ød­vÜVq]>v‘òwçã¨þxëé›t»„©›¥j^_#е8 53¸µØ3¬¿]Ÿrü”†ƒ.endstream +endobj +4146 0 obj << +/Type /Page +/Contents 4147 0 R +/Resources 4145 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4118 0 R +>> endobj +4148 0 obj << +/D [4146 0 R /XYZ 85.039 786.531 null] +>> endobj +334 0 obj << +/D [4146 0 R /XYZ 85.039 261.05 null] +>> endobj +4149 0 obj << +/D [4146 0 R /XYZ 85.039 242.178 null] +>> endobj +4145 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F35 2880 0 R /F66 3242 0 R /F20 2865 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4153 0 obj << +/Length 3486 +/Filter /FlateDecode +>> +stream +xÚ¥ksÛÆñ»~›f¦àLáoó³qÙ®¥Ô餙D@$"P@èáþúîë¤Óz<w{{{ûÞÕ,€j–Å~æ³4Kü8T³åö,˜­`å¯gJ ²p`^\¿I¢™ +ü<ÈgW7OøqžÌ®Ê_¼—ß?ÿpõúã|†¡—úóEšfÞ«÷så]<ûŽ§/^_Àû‹ùBy¯aðñòû·æ¿^ýpöúÊà¨Âÿýì—_ƒY ¤þpøažÍaø*ÏgÛ³(ý8 +å}svyöw‹‹×¢mf~œ…‡× cçºJi?Tz–FÚÞ·lïî>ûìéYÄð_=ÛËuÝTÿnêåmSl«gçeõpÞÜo6Ïίëæü¦Øì*¼íù5BΣEøA–îç×ó…N½væ:óªï€yäÁ8·®{MµÏ:¾&¤@n Ô—yú:æÜÂàZ8Ȉ1#Úu N•=‰o8"ó¶Q±EqW@¦aÆEƒ/ÊÃKff&áå3¿”ÕŽ ;Du××Ì^CÖâ(ôn`±íx¶_ÏåÐ[nꊰõµگ|¾(vDÎy7[äÊ×1\R¡žäD>bæÒ~ÀùßÚíÝ=Œ{Zê`ꥩGWC‘d ’†(ØI¨}Ú™ä™%úëD"¸² ‘„±©ÄžH"ažE±W\•Ä‚v£û¾Ú Ï#P-”ؽYíy’õPöZÃø±¢ñöý%CŽE í ?ûµLD75ã°&1(ú*ˆX1‘Ü·ptJ‚/¿µÂeØ_âT$p‰%Ç%*ˆ ¥jïÊùæÛo%_{ק¥¦¸»3¯ŠîWV%ƒâèn8±'FìÀ d‡Ù‚wFJ7¨,;JRkx^D +­À™È{¬Qn^nZï*ân»Âsëÿ1ÀJ¿®w<*vŒAW‚„©8Ýw#À}KÆóL£O70~˹ƻ×Ý +¾èq2›pjÙv]E¸™³mSšãW ñSS?ñ¦‚N]¶÷pfîõ¼¼ÆKààz 0Ž6,qÒlÑW%Ø|¤•U(`¹ÐúÓ\¤rYY¸clµ¢f=¼í²““ úÈ9Jd—y×…¹Ï>yÞx1fÔ°}Ú\`I¼hË|)jò·ÍêÃ#Ê·Úl· Ë¥áí°I®‹ Ã4aJ;÷t"‹…f±wWìvtfÛ•ì#ã<ó®’pï̉®ƒ•²5Š/÷»/…C¤v}àZÃ&P˜@àLÁáQxÇ…n%@o 89Ï8qœç>N¼ýn;çq ·C&<–ÿ +â ƒ?jŸ (J!;Ø#h/ß00dŒ|xC\ÊãKöhÛl†e°cÍ !…É1…œçnmŽ¼®ºêg£´&%]Ûö™é®|MÂ,ùuQÈsËO›é`XùC Í#’ĤSÚæòPå‘ŸCúljŸç_/ ®…ƒì× +⤆ÜÎ9ñ2e7€OQÁÑ 8 û‹@H0ù-ÆT»‘-"âîúH°¯”Bfª%dâÞêQŽ$›‘¤2ä=Gä2T|ö`Ÿ6¨˜@°²ó™¢wb* KêPÝ( ¬‡àðQŠñéÆD9]RgÝïÎ:x㊽û‰ 2RIºcbŒÿ€&Ä9#Sº€þ,‰ý$>Ž‡v€‡G|_§„(Èhr2Q£S©‚Θë…ÔO@— ,ðÓœ…ôCË¡ä™ gø{cVAO³X‚ (ð›™WoA3IPèÀç $>Õfž¤9°i€\Ðç\qö;ð&WKøÏSfÑÄùÛ­ž½jáö³íbÀË6•¹6…¶¥³(Mü ŽÀû_¨q÷¥/”ççû!C²8ýœÒ”,ͧŠÂÄRr€ØKùGšo§m(ÉY›9医ê â–RÍ’Ï­wS$£b¯úý¾~ÀÓ6Ö–z^!ËPÑñ«LÁ ìFźHÁ)% ×B ò†w +‚O¤¸^²¿Ÿ¢ùà‚è‡W/y€Ü„+òf_VÝCÕ1‹«XUx­<¼7xy…ˆB²0M¶öõVF…$V0|\×ËõQ6&ÙX^xGPd¬™ìÊÖ]%¯“•àÓ¡á“öÂÛãºt†áÍ¡hr®Ð`ê7”~ÝÈÉ’ꈅ{¯Û‚Ì1¦4† ‹-š&¹al<9,¹±1cE'`¸0ÑÞw &o‘'àù€ˆQ 6MÕ!?®7• o-‡\®V¨E*{KQÃÌ=Y¥ÃÉ*µ£2Vµtß ¥ÿK9T$ýšF"•‡QÀòŽ-m1A¦ÔLàÛÄo#e¤ï9.䬺8¨›µZà6Ñà´ëv<Åh诤˜¬P!f\0ÊÖ^ïSÙÔ±P}m¸‘°C[áa{ßóy•‡Þ¦À¤¸[ÉrY­ºÊ€ÞðÓÒK²=uCujHg¸ÀNƒl^ +]„Üm°Ê›boàª6œáO\âŸó ‰–Ü°xà.|´øˆRÆ6Uù§ƒ„7U~ ߉…_Z1~«<-l·îÿ÷pÊ h}²ÏêÌWij™FœÃ=è°Ÿ¥Ì>Àì5fsqàý´#ÅY±—ywñà% ¶K†÷‹9=ìSÇ®ìy)¾íò6’©¸õJÖ—âIiB úíàÔç·&_±)O7VóâÓ½_f"ažè,òË“·¨×:’E­¦šc4ÓI{_0Dï—Ä/E';0?í>›¨efZ9¦hŠ•¸–ñ~ˆq’OÕRÂûÅ%»ªO5µ"Lÿ=JI¸Ú“*6ÜÚæA!¦š ÍH>5Q&¢°ÃÆnxžÜA¢‡¾­—)Éz¢‡­wÌÊÛ9Ä ¾0@-‹Í¦*¹²:ÏA‡1¹CÂ/?ÎìýÇÕû÷?^riÎøŸypXÃå‰Ào÷¥ÐÌ¡ðH²K>¹WÀMqs¥ZÞ÷Ø,‹ò˜œ*®p[`rn%õMQHšX=1ö³Àš|-Ê“¡÷…+”àY¦Lp 5Í ºü±ªèæÕÓTÙšäØš+Í$WµŸ§„ ¿“š,LÁtâk.VaõôQþK 6ì*HןÂ)ÖHW¯öô¿¤ÖzÕ\Yc_~ýÆ4Ñ]òð“Í Žµ[Œd„Ýí®gVV õÏ´› ‘ݧ6‰A†ðÄ) e.«§ë/í`7‚ÅP ÊÓÔ»£:U²vŠË~L ½ìlz¿‘d fQƒSm!“âM÷„>Õú{W=Ýïüi±Æ™Ÿ‚[d±X-&:Öâ‹ñY8ÆûÖË®åý Gq 7åVÞ5¿ìêÞ$HŸhsÃóHæÒlz8c y|‘„'Eû[U‚¸¬E…j÷’Æ©A‰©VH;Yƒï²Æˆ/T¤ 8¸5rk€+^æDGV?Ë5}„`pRT Ù¡Ö༨÷ÕÁò§ó‹ê\ÁÓùÏ0Ç9Ú§þ± ï!nW:æóÍžøãÔ´±ùJîa»êNù‘Rí˜õ¥ÕjþŽÕYæ +Ë(|è|ÒÚ·ú5¹oj„'Cߘ°åök€…’Øí÷·…¹ÒÄÆ…£ë;éˆ[˜Ê@µüÀãe¥Æ$íZ{œÒÀäsL}!]A±Òro ê]š¬ px”Û˜^l`„y‹ ’#½!•À3'“Ûªq€&² Éh”XLxauØ‹ +#_…§c/œBΚţÓÞ ªN¶Û÷NÙº«à¦Ã²gbÂêô^? Œ÷yI ¤;ªzÑ1.B$Ê¢è \€NpQ€ðp}”‹§Ž3\dýÔ +Á +Î?ÖåŠý(œLÔà?³ñ«~Yh[e~|?òi9ÖP0§‘!† èàW戇ÿ‚þÂËendstream +endobj +4152 0 obj << +/Type /Page +/Contents 4153 0 R +/Resources 4151 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4163 0 R +/Annots [ 4155 0 R ] +>> endobj +4150 0 obj << +/Type /XObject +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/warning.pdf) +/PTEX.PageNumber 1 +/Matrix [1 0 0 1 0 0] +/BBox [0 0 31 31] +/Resources << +/ProcSet [ /PDF ] +>> +/Length 557 +/Filter [/FlateDecode] +>> +stream +xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù +ä +6\>RgÈbÏWÖ¹j[†› +WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream +endobj +4155 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [369.053 626.992 448.095 639.894] +/Subtype/Link/A<> +>> endobj +4154 0 obj << +/D [4152 0 R /XYZ 85.039 786.531 null] +>> endobj +338 0 obj << +/D [4152 0 R /XYZ 85.039 328.177 null] +>> endobj +4156 0 obj << +/D [4152 0 R /XYZ 85.039 297.885 null] +>> endobj +4157 0 obj << +/D [4152 0 R /XYZ 85.039 175.943 null] +>> endobj +4158 0 obj << +/D [4152 0 R /XYZ 85.039 160.272 null] +>> endobj +4159 0 obj << +/D [4152 0 R /XYZ 85.039 148.844 null] +>> endobj +4160 0 obj << +/D [4152 0 R /XYZ 85.039 119.625 null] +>> endobj +4161 0 obj << +/D [4152 0 R /XYZ 85.039 106.075 null] +>> endobj +4162 0 obj << +/D [4152 0 R /XYZ 85.039 94.647 null] +>> endobj +4151 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R >> +/XObject << /Im2 4150 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4166 0 obj << +/Length 3224 +/Filter /FlateDecode +>> +stream +xÚ¥koÛ8ò{~…±‡d V$‘Ôc÷ö€n·]\v{M= ÛŠ¥$ÚØ–W’›æßß¼(Q¶äpRäp8Λ ü„‹ÔøÊIûF…‹õö"XÜÃÌ?.BX ÈÊùéæâòm¬aàgA¶¸¹ëñdo²xqS|ò^ýüòý͛˕RÊKüå*IRïõoËлzùîW¾zsß?-W¡÷:®~÷~ùùæ—‹77=‰¡R¸ýŸŸ>‹Hýå"ðU–.ž øa–-¶Ú(ßh%ß›‹ë‹õ¸xN/xÕÔi-Ä*Ìü,2ç9Ç~Ä=G"˜ ýÌäHF¾ +£EbŒë„X’ø‘ÇTÀ cï»ßðà» uØ{(±û»è<LŠïUSæ]Uïø«¾ã—¯ª]Éß7Ë,ôšCÛágì½D,ëu}ØuíGá¨*Rç8ÀÐCã\zDÐFÑož ñÚ’(¨w~ÇÞï ò-ßM¹F€z»%@š) € +yþi%^¾ŒRï™èàÐÒ²Àip—Þó¦Û|Ë`„†…–®9ÀG‹ð#É×LÝa‡;t<‹ •´mµEˆ=Ìl„€®FFV!Ȉ¡ãæ›Mž–+j¯ÃÓëÐx×x;[¤å{<È,AÒ¿àùâ…5·Ç‡t݃Ú2\ÞòÄ®¤ÑÂN<ýôPî,E<…À„|SYX9:U‚-ëzt–:<žÃŠz›ÓŸ&E>\ˆkÜs·”QªåhkÜýG”w¬J½Ûœ?·€¥Ž¯!ÝkÌxPìûÁ«¦ly\°³Ø!PCPíÆA¯vIÍ=Cý{W}µ{ð +DÆ,{LÐqWçe‘&Ö׈ù%Ú»[ÒÎÔÏð­«Ö BÏ<´&E' +’áæ¢Ä5HÛWYyrè„/!{ag@Ýö$ÊUYüÀÔw¼øUþy¨z¦µ7 Zü{ê{ÄÙ‰|.dÇJ+Cš‰­ˆ‡kj"0Y-â8ñA­ØÖàDs/«c¡Wø©Ù9ÆIzXLƒµ$q(÷*f~¬›jO†öˆB@œŒ)<²†æ<] +ºq<¦«Þ£m!ã”UHÁå[å.Õ)ô l†kÚí­¿c¸ÑÚøi˜ºTÅ%åìSb‡<±ó»ºc‘…û÷äó`ÈPX[Šì›Ä°YKÅ6«ùg×uCŠ…&ÒU±ÅJ2‹àÓö X×­™GÈM[sï–ÎP2éFYð /"T½˜ƒ‚ÏÚŸŸè½¥F•ìŸïø»üšo÷ÙÌê)ÑÃÍÄP?çÿ³"í;ÈùˆϽu*·þÄ-÷¦B~²€|ºßÔ·ùæ3“žøaHÿ „ +‘ñþæû~S¢-ʆ‡Pë°ÝçM¾-»²iæïÚKº[/àG‹ +ÑqÿGn.msÙÞV;è”M¿l%íeQ~¹Ü6¾ç6 h1ÜÁ=ÊN«+nÿz˜ DŒÑ~¤gf>Ö2:ð£8tc--±ÖUþhÍ;†G¹DSW×Ü~$Í,ÈÐ/Uè=µ2Ž0x ®o;7ù†û×x+ #¥|ç¼Íkqò^ïåj2‘Wåöƒ Ы9ÞD1í|æÀÌilX¦N–dÞ¾©I{×,ÝqŠ8uG +mþØ«5|ç %ÎADÿ‘& Ö-äZ°Ñ¨›Ç]Hñ,œ‰‚·ì(‘†Dž ÃhÒó±éä—¥‹nªÁ³‘r?Uh~†6ëÖ2¹0Cû@û‘Ħ › +¤<µßÏÜ”Nbà¹>{SL/Å'7¥cˆ¹Å,÷R¢ë Ù]°„Ú#˜EAð•åî?ï¹}¿$†ÑweÛ² Ê7s”ˆg)`æeLëÈO8ûûø0„™Ä`Î(pH‡¶¿Q%ñàÆ‚¯»–ºš[¿¥õf„f&ž%³Îtmì-Xc)‘¹#[¡÷‚'OäÆ„¿Ðâ©·ûn*L•IEGÒ¯'“wöyKÞB´¥°rM.$OŠq>+*Òÿ¥Ú”÷½,Ã0ñZöŽ¢=Ñ3*%ıµ ™ARíþÂè~•)J,u–L$80˜ÛjWõ^¹ +Àª¹ÎR"¢ç.Á´Wøt,ŸïÁ¨Ô¢tRÚÁã6öÅAfö,Ëp«¦ƒ$ìŸkópÔŠÏ=†3 +’ ´%œœ'͘¤¯°˜¨>ô)g戮¶ g(G)_ÁÀ½ö4%\á,5õ~,·ÖĪ§ +3öîHÞ7¼»wÜÍw§9,ŠÚ¸±IæjèT +4¢îåŽw³دuW~Qhà½ÅP4%Ð,(\ ç¶Ùfü˜˜äm½£„ÜQü€µ0§¥-• (›+xÑEMVžÓyý ÉDœ“g´RH}ØÐC`:—þ1ïh½¨hÀ¾ š ¥G \YA4‡Š-Ö„ BV{8lå¢OjŸ Ü<âãëñ +´f1Ȭþ­JA¶§’s\–ÝúÏðTL¤'±êSâBïaÆÌ‘‘òvù¶dseG9W¬g®CYó½Êmôˆ ‘p\}kŠ‡0}e ÷—‰£ÇŽ,y;{÷kº¥0vÔ=Œ%WÁü {èƒ)® ²³²“„KúQÖ"Ý(½m¹·ÍL`bÛ§MTÛA’å¦Y«|Ô·Ì{wÇU'mËË롨Ôð K¡ä§qì +‰!cÑr»ÍÒ iÅ?Ý„D¡Ÿ‘ÀvNÀ2‘$~’Æ®""+Ó}ËU¢¶¢ê[†·²w _ÁƒtÕ™Ûzéë t‹÷Î6T{XÍß{^Z9y´›‹f}(3¡+Aà+ýí4Þ>„L·'»›“ÛÆ4NØ0ÚŒsAÌÊDk0sÎ÷l…äæ’­Îú²_•_¶½Ó: îªeG;c¨I=±ìÅ Úž‡èc¢4ò{o÷̨½Øöõ*[ÐëÝ%UÑŽ¥¸7¾3u<ìZéÙVh(wë晪9Õ,Y’ÃÃFw½x˜áʨycøÄOö™û“Qà!WÃUy€::'ÆôAàÝX#kFUlÁTÂ6áDp `OÏl&âÁ©‰2³VêÝjPØh‰¡ÂŠT„lIäÀŠX ë*I–*~Ê |CÉdnËÓX毢ïÜú3II¤3?RçÓ)f>ŠTâ§A­äÖ…hÇ~¸e)e©€•„ª(~é‹£~¦äò`K¨!n¹= ™ûÍóèué²Ð(f˃ÝW¿>[Vz\ÇÁ%üâŒ=*¬Ôýëy×?PcqdÎÛ‡öUr¾éÀÌ{û y¥ÆÎ^‰³‡SÞæ3Ⱥsû gþ’eÃEö_éQ™Ô£ÐXe`Á7UÙ³2 +ã² /i‹Ü·<[ˆ¤Dë´¥×Âvú(«²Ø×ß ±p žiîÜqßd-ðj€žxúcÄã¿vȾš(¸23† tüpD± C`¯CðÉ% ÄY*û§Ì×›¬»“²ÿàc)\’ï»R‚àñØœ\+ãk5)VðËÆíÿú‡¦¡>lÅä¹M”øq¢-1xî8:a±JÁÚ¨ Šÿ Ëþ&Žendstream +endobj +4165 0 obj << +/Type /Page +/Contents 4166 0 R +/Resources 4164 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4163 0 R +/Annots [ 4169 0 R 4174 0 R ] +>> endobj +4169 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [211.976 664.189 306.903 675.879] +/Subtype/Link/A<> +>> endobj +4174 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [395.47 69.841 512.306 81.53] +/Subtype /Link +/A << /S /GoTo /D (domain-member-server) >> +>> endobj +4167 0 obj << +/D [4165 0 R /XYZ 85.039 786.531 null] +>> endobj +342 0 obj << +/D [4165 0 R /XYZ 85.039 766.606 null] +>> endobj +4168 0 obj << +/D [4165 0 R /XYZ 85.039 746.277 null] +>> endobj +346 0 obj << +/D [4165 0 R /XYZ 85.039 554.208 null] +>> endobj +4170 0 obj << +/D [4165 0 R /XYZ 85.039 519.268 null] +>> endobj +350 0 obj << +/D [4165 0 R /XYZ 85.039 476.904 null] +>> endobj +4171 0 obj << +/D [4165 0 R /XYZ 85.039 456.309 null] +>> endobj +354 0 obj << +/D [4165 0 R /XYZ 85.039 249.234 null] +>> endobj +4172 0 obj << +/D [4165 0 R /XYZ 85.039 230.761 null] +>> endobj +358 0 obj << +/D [4165 0 R /XYZ 85.039 104.375 null] +>> endobj +4173 0 obj << +/D [4165 0 R /XYZ 85.039 86.508 null] +>> endobj +4164 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4178 0 obj << +/Length 3139 +/Filter /FlateDecode +>> +stream +xÚÍÙrãÆñ]_Á7ƒ) `fp¸*Zq{“•”+®”툄$Ä !eý}úܤìX•réAs4zúšž>è/<øó±q=•,¢8tòÛý™·¸‡¿ù±UæýæìÝס^øž›xÉbs×âI<×$áb³ûÞ¹øæüzóáór¥”r"w¹Š¢ØY_-}çÓù·—¼üéÃ'˜¿_®|ç >ß|óíõòÇÍdz›–€‰¾RxüÏgßÿè-v@êÇ3ÏUI¼x†±çúI²ØŸi£\£•Ì‹³›³¶¸xO/ø«9n-ÄÊOÜ$0§%†nè…­DØÕ®Ò!JÄ÷WùÁ"2Æ uD"‰\r0:qÖÈr¹žÓü²#%‘á2®ÞÂL+޺ɪ_h«:&9ä$µ Q뛞þZj•ï‰!j7y ç'ÆÙ—ËU;»Œ§åÿ¯‘$ m {D*î=häµÀ^“—ÞFƒÄ!è²àJÎhûMºÇ½ÛTÎN·K@ø²ƒ€Ü9Y~¸·0–4ûQ¶Ço™’då£~bøÐ1}:Ù-I%+Ô Æ«5¹}Bfò){᯶¤Â®4Ù¯ (V' +mÉ<Á·LFzémïëÕöž¯ñ´¼ÁK9µy Ùñ$-`Rðø‰±‹m ñOK¸˜ÄCıì§|?ç`Ó¡²‚ĉvvìóÄ8w0¬P¸“ò¿mïÜN‹â…ñì2dã`éØñê”4”¡%M¸EÄUvŸï ¤+ãlpü`©Ñ„){;¶Z‹KyË?µR‡…mÉ[qÇ.§(u/t.7êæ%’1«»`:põÏxe±cè]¹çË ã†­á%~QÞ¿´/ØÚûÐÙ}õ%Þq¬&oÕˆè°UÒT‘ˆ±DÐ_ò]†d‹½«ÄŽU”0g°x¾e~@þ–Ü^çU¶mÊê…¡&Öåóõð šàuÍ÷–J9åÓ ÿÿŽîÏŽ({®ù¨Àó<ž»‹EÚd•‹ð²„}ÏÄ£>ìÜ[í% nœ>U(]œ£µï9õCù„JÂñ-ÂÈþ¶Èp–V¼Õ<¤ã •ây”ÕC“ÓAâÉZ¤éö'že9+oê UÇS!WÆÄÀÔdÔÊb5ÃezxáGr—×M•ßIÄ*ZÁ}Í -Y%8°‡ ä‡æ‹ðûJ@¸•ŠÇ +¶š‘ÛGˆ§ÇGâ¡ê NCºI»× +åèÙ,ñêÂŽu„@ê MÙ0&dr{ÿ±^Æ9¿(ö×ʉV®ˆ ì€p¡sŽ¯Ñ4ñ.™î]3ßxðÅ7T6YúGüËShð½Œõ›Pˆ:ó5ܹ¶tò‡u ‡¼’Ã<¥:­å¼iÄU˜ïè1 þþîr#4=¿íq×vwØ[¨ûé­¾{´¯¯>Õò[P6PsòçR³Ñ® +Íi5›ØjºÈõ‹.¹^_°~/é>7ïG·œüq½w§¿…ÞOñÒê½ÇÌV‘ƒcÊ òþÌÊ×ð¶øÑiåkí‚«›×>ùõ5Ì/x>rõÝz*G7Ž†·0Sµ&Ðg骭•¯/|ÎJPÊuõ÷ë‹à¨…¼õoü +@\›#A$ø¼Äÿc'tÖée¨¸Y?Pnø šÑß·¯óªû1ËO0ùǺõF€˜Áä©nx&5OŸKx° °G‰jxZ¤$&Öû[w[B¾: '5†ýZà°ºjËÒqmÀƒœ¤(x4L®pEÊ?8¬m5•Ëb¸tèåpˆ±++ó¾äL\›Š!΂ANÕVÅùʈ 2¦lh®òqñ@™×=&p¥P¼Ð8)JnÇõEœ[AÏ”‚€#~ƒ·‹Ärp£ºˆAÕC W=ð™ªÇç1îƤ„Ú Õˆ”q-0¯¢xãE.µt–¤i(j’ààûû¢¼E?ò‚,|¨©ÀÕç¬-ÂûÑo°EHè|£lðVYºûj)dÁeƒüÁ5â»ê …Ù@Ölãü•ÿu6v¤rÖCp™ý*ÅI®´Ö„¾\Òþz<íF¨žÀ¸ï¿f)½êÏ(j„“Z)$Ýê§ûŠ,öqB‡1®?¤b’™"Ä+'ƒ¢" NnM%`CW[oÁ50¼ä·d"\ðí™H¿rT•¾!£3M< ·]J\úº"ÓÚê ý¥LlÁ¹±´÷"2Þ¡rm¡E[öÂ/ÓJR¢ËsïΔ…þ‹zõ:ÌÒ‚|aɳjÆ´m“ ­ÉÒSí´ív2ÍM6u]‰ ·¡ƒ¶½çã)ЫøŒYŒp"WÙa[½<Šï·ä7õ3Þ*dïfêX؈¼qyB`N¯‰«¼h@[ž¬njj +8QJ\ÌKVÏS๑± ¤ú–jcÀŒ‹Á0è;=Œ¹à-‡eݧ:«¬)Ê5µ+§±½Êî¢YØÖR9‡T›O?#Á™36KcMMÅ~AHIÇÐ ù?G´Úö(’°ûÕ7q +ºÔûÙNŸsÛBÀ#š&ëêŠBOy´s¹•_E¤Òt¦ö764#n[ÒZyýâi¸6½ß=Ôø#DõcÞ¥´R”ýmCÌ&A2Š•œ ~³±´Í™†a2Ûh`2ï„ÆVÓDºúÒŠAo·ÑšŠ ³JéCìÔ%o÷Òìm,ÉYÑ„^±Th£•F¾i›1iEÌ샴(LŠ¼MYøó¼#cÐ[´ˆå<¨S¼üdŸí¥€ªè¦Éo1¶iw©Š2—–îKúe>ÓÃκ¾è§ +d„G3‡ó^Óÿ’è—A‹2¯Ž ÛAuiÕ‰'ä¶Z‰âJÝk2íx‰LCãOLжKl‚må‡-ØÒ´?ÝØÛ õö´nÃyÝð¨RÖÖ_»+x;-µe öTz˜Ÿa›Ê>LöX!Ü›†ï:sÃç%íµ®[cŸ3‚ ¼ë¨C6ç*½ßç#ÿr¤¡¤Œ«ùÇ}ÓRÀ+u¤ßY +ˆ!8Ò_6 +†‘¶Ä C¡š«§˜XÍPü_†Ú}> endobj +4180 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [215.483 606.235 334.938 617.924] +/Subtype /Link +/A << /S /GoTo /D (samba-pdc) >> +>> endobj +4184 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [226.58 380.651 265.633 393.553] +/Subtype/Link/A<> +>> endobj +4185 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [203.74 321.487 256.096 334.389] +/Subtype/Link/A<> +>> endobj +4186 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [289.289 249.077 378.732 261.07] +/Subtype/Link/A<> +>> endobj +4187 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [250.286 221.676 327.4 234.578] +/Subtype/Link/A<> +>> endobj +4179 0 obj << +/D [4177 0 R /XYZ 85.039 786.531 null] +>> endobj +362 0 obj << +/D [4177 0 R /XYZ 85.039 766.606 null] +>> endobj +4175 0 obj << +/D [4177 0 R /XYZ 85.039 744.844 null] +>> endobj +366 0 obj << +/D [4177 0 R /XYZ 85.039 551.795 null] +>> endobj +4181 0 obj << +/D [4177 0 R /XYZ 85.039 530.598 null] +>> endobj +4182 0 obj << +/D [4177 0 R /XYZ 85.039 516.864 null] +>> endobj +4183 0 obj << +/D [4177 0 R /XYZ 309.697 522.837 null] +>> endobj +4176 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F56 2890 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4190 0 obj << +/Length 3631 +/Filter /FlateDecode +>> +stream +xÚ¥ZëÛÆÿ~…Š¢°œx|? +ÅÅv’3zŽë»Ô-’|Ø#)‰)E^HÊgý÷×.—å(ôAËÝáîìì<~3KoáÂÏ[¤‘ãÙ"Ic' +¼E¾¿r[ùþÊŠµ¬-šo¯n¾‹Ã…ç:™›-7fžÌu¢,^<?/_ÿpûáñíÇÕ:‚eâ¬ÖI’.ßü¸ò–÷·wï¹ûþí=<»Z{Ë·ÐøøðÃ݇կï®Þ>,½ Àå¿úùWwQ«ï®\'ÈÒÅ ´]Ç˲Åþ*Œ' +y®¯®þaæâ±pÁoÍí6 +R'Jƒóíz‘µ]Ïß÷I9q˜Ð~wU¿Z‡Q²Üã~Êa;jWk?]ܯêº]Áã Ñ¥Ë Pû•Ÿ,Ÿ°ÅDC˃èêi"î/±ýérl õûãå°+ù…^í¥µ'Ú—Ú©¦Òíe¸õþ‘ÿ äRVè”ÿb-{]{(°ÌÞ`àÂÃnÜ™Ÿ-ËŠvK3tÜ…[êZU䊘 |»íøÜ¡ (~óÓÝûnjP$# Âý4<ÞvE)Ë‘Ø`ô× ‘@+ð èÚý^5ÈÖ_‘û›ï[×*®ã¦)m¦kÛáÏ«uäG˦¸ñ±Š­õÿ¿ùñþÛ×Ò÷Óm±¯šª:5´Ý_žUß¿ ,hÁ©qÙë±mÝm€Û4ÒB8ghÁh]">Yþ|0ÚŒ–©U·EÙ°ÍòùòZ¨ìøß´Ò±­>ãpÙh^Æ–Më£á7ɾeू£¥î'mmØÝ>¡eÀ+eÁ†—%N˜ÆÕÙt¬ÅçÛöa'p$¼“~ÿä€>ofvFNêi:±ðØuâ,™,t‹†˜¹Ë—3ˆmÕñæÂÌ3 +é-«fËÃÈýNHõÞÃ4CásC!y!Ä;=—»$ÍÀÆ'í˜X|ÎE[6ÓýâFî ×i6’KŽj.6@jÞ œY'LJøl¿tYqœ‰gÍÙÊ0gœ±›ÅŽ©G1ðã·÷Lt⯀i*™ ¥âáÖ¯¹_ Ç,‡î§*ä<ò–”6Ÿs}c'˼ÑfŒ+rüLÚg<½ªm”k^ô8 +–·¸Oc°tDd³Èà ¹°]â„öù£@»n·$nØ ] u=õ$€¶#a­ô?õxïk?m9 Mâÿœ»41ØN¨øè™rG‡ŽŠ‡í¦Ì9èª;2-2ÕUŸQgjÒ€­Ð³{†e‹‚Z½È ÊÞ¢:Yɸi”o,ïpÚÍÌéÒK•xdýßòQ=2“C=ãïű@«/%LRèÃÄö^æQ[jÌyù3z×’W"_ªM[üª3ë¶c'ñc­[ÝÜ"ltϦõðöã?½Wü€¢Äÿ®Tõ^Æïÿýñííßï_ͬ»ö|SÖuÐÔ‚c­‰ðdÂä!T­I1!Žâ±…!Á´‰dM²aªx1Æ"°Á0ð\â@·ŠÌÔÔk‹üfžÎ‰[ƒx‹Î0%çrÂCÖ¸ñ”‡€«i¾¾ràeN Ú^y¯DªÏ¤G( +í» w´†'Z`ƒªjíÕ4®ÌÆûþ ° àœŸ;†¢¹†…ŒSüX‡¡co ݽ9OŽÍV‰Y´£cû+éÅÀÏ;…¯&kÝòÔúý\¯PŽÏfaê΃{±¡;…d³n ¢i%7(Rb㉠w¹i 7Èšâ"èdÉúY:ÁyÔ±µA?w »Ž¸Ùîô3¯ãgÙYLÅq‰—íA³œ»0!‚RÍVæ%·ÛÖ±·5Gw„U(žK¡ž¢7*…çÏC'ÿÂh+KÉn‰Ë@vrvÔgÎv•Ñ¡@çLès3 Mžk9pxxÀœ.]>)~ä˜Þ±~ +}Ås·²"ÿaêRÏÿ™²=Ë%áÞª®ÌY™V¿ó²ãlEÅ`©­¸7™§Ù\Á#Äȸ#*F]ŒŠ˜N`ÑRÖÜÕ[`„ÕÇÿ1äÜúî¦nsUßÀŸÔÍ3„d0¹›¾Ì»rè¡xš ®miâM’p²D}žtÁý©b›ƒ@£‡žðñÈíΤõ”ЋDÈ + üõ D±‚@a-l<áÑÍ’ãÄí$‡Æžv‹¢8^Þ M’s혰ñã2Òj +áསpÖ[®ü°¶ÖLÏN6?t9LæHÿ±1‰³ô +/«=^I+\c¼"ýšÊ”^«dÎEÃIÚ†œ )}<СdN½…„iQe¼e‘¾áÿO„A +û%êÏRq²~ÌwØ!¼œ0w=ª§,Þ’áƶß“2€¯ ®k€)cÀ+~ä; DxP!kàÆÄ„zm‘ÏXÃÉœÈî'NŸX*g\D!ØOlsq¦íšæÖŽR'ð³ÉÚcÊþÌ€ Daª>Ð&ž Øk}ô=®`À˜â¿þØsÙm/’‰²bK´±»¶«ûaì¸Þô–B²Õj+(ô§÷wÿâÖ')4àoF¿­ŠÞ¾l»¤šDB$o,¤+ˆäl^°ãçi…ë¼ôóÈE‰ˆQûçUKÞ7pÍ“Z•§/ö õºæ‘Y€‡\uˆäê{ŒóÀ%v!d•ò¦ƒò$ŽËcÈ+Ë‹:¼”Ìzk?ኈŸó#ùb:ÏbÙ Séº ¶_zg—«AÇk|ïã|Í”V-©ÑŒÖLF þË/ú®œ³%ZL×´ =:3|š83Cª†…ù‚y¤)`,g%ìÓŽ¨`R‚ÚÐM"ˆï´Ô%<’ Ú­M«è¬Kj? +¸Ú JŒtÏukª(»%ù,™È‚©ˆÌpªC?·Ï®¬Ù¬EÉ×g:ÔD£?‰åÛ•ÓG ØÁ°ˆø£lQHųðd"<™¼" 4±‚W9úˆL~ÒÄJH`*Via†îi°qžòàj“(×ÏWÛø1AJovZß’æZw€ÄÈ3òvJf”š …³ýÃ¥idÏÅ…â$º$WÊ\ÜŸ2„¥ÔK3–jÀÊ™L.s_üð}Ò‡7lIãGcaÐ.ërT*Œ'‰—¦±˜úõÜ=_Aº[¼æê)ÖàyX×è +Î87@¸çç%T*§¶ /Ø(×e®Çòu®”×]†(îe(”|{èŠ€àŸ j’(‰ºèó¶iÊ\b"B›gNµ›i1{4§ú:âó$,˜h£1“®sÕm³µ{"ö¯Ê:G["@W«~èÍ}—$"s6¬=NÑñÍ|0&v8’›–\²Êý2SNõtüð‡Ï)?Þó=®l·å·6|YJ€FòSµY‰¹Pãì&Rae|œˆ?ÎsßµºÒˆqmú—2Æoº×RO5Ýb$tÚÚ=С÷Ïü‰t_ž¯ÐdT_ÂñÉ7= l;qéZ)­tÚ ­«™d&²dzÂý¹é‹fbZ®¯­õç ‘kƒ·¼ù–î"—O”ê©¡¾óÀ¬¼çQQ8«§’ÿ¹›v“ãg§ØäüêȺN‡öa4ëÙ \èK[YÑ¡ÙIŸ|ïtzRãWT°0q˜ÛåXR3Ûˆ¼y}iJþäj6^ŒHq®Š9a0[Dt²ÓÿëóGSŠ S'K/\ýF~âÄ +3(Ú8> endobj +4192 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [285.619 542.708 316.703 555.61] +/Subtype/Link/A<> +>> endobj +4194 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [262.823 290.269 345.582 301.958] +/Subtype/Link/A<> +>> endobj +4195 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [212.608 249.621 255.813 261.311] +/Subtype /Link +/A << /S /GoTo /D (winbind) >> +>> endobj +4191 0 obj << +/D [4189 0 R /XYZ 85.039 786.531 null] +>> endobj +370 0 obj << +/D [4189 0 R /XYZ 85.039 380.004 null] +>> endobj +4193 0 obj << +/D [4189 0 R /XYZ 85.039 358.808 null] +>> endobj +4188 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4198 0 obj << +/Length 2129 +/Filter /FlateDecode +>> +stream +xÚ­XYoÛH~÷¯àÛR@Ôî‹×óàÄžOÆIÖò"dó@K´L„"’Š£]ÌŸ:šuÚ˜ C}TWWUW}UEåIøS^i/ŠCåMgÒ›ÃοΔ£;’ñ€æõÝÙùÏ¡õ”‰L¼»‡žO"E„ÞÝì“ÿæ—‹wW·£±1ÆÄhE±ù~¤ü›‹ëw¼|suó×£±ò¯`p;ùåúÃèóݯgWw½•1xý׳OŸ¥7Q=“Â$±÷c)T’x‹3XãæÅÙäìß=/Þ³Ÿ:¤m`bÄf_] ÔUÚ­•mDú^”3TJúÿ•Ê– MZëQlýW¸ Ó)ªÙæ°SÎy)/ùDû˜ñB“.ÈÍiYfµ;ݸ_wäÝþj¿Éêo#ãå×¼—®ÚÇ‘â¥r¤¸”îNÛÞé.o+GÍÓ—oÐòÞØi9Vhª„T[«•B1T 3E,¬,ÓÚ­TüËZÁVº‚ƒ0+QP%móªdš:[nŒ¤ +(»c0¸O™´!Ë8mk&™gm/;µb!•£‰ü|–•cRMn)ÕæøP@ílƒCbÅÒ§Gz¨jøYìï6«) +ñÈ32@ŒÈ6Çñªéß#JüÉõå+±”@PäMË#²lуÂ|^W¨Âr«ÚQ 6ïGcùYQ•óæ†Õ+³¬%Ånh)¥…QÚ Ñ×eø|l™ ¡ø>[pw ë68ʆI`Ã#G½ÍeÜÉ4e(L¸ ÀHƒ¼"  +@‰0É##LÀ€ó®B7ãøÙSÔ‘køÕùÞWO i“Ä0Í`LòoÔ¢…óë…ò.+ÔÛ–ùŽŒ-â!Z¡H%B«DÔ(ìÍjŠþ#cv±äÝkKð•ì{;¤@ÏÍ vÁ§«… rRwžFà© Tà‚>^7ns‰t¾÷˜Íx…ˆXo.þØãÉý§Z¤óô„#{VÖR‹$F+ÇB[ÃøŠõÜQܶ£È÷m·ËEø-G…Wß?¢®J[°0Û“'°"”Þ’gï;šg¤ +¨pK +Š{×Ở¢@sÅžŒ–"„¼ù2uÔ§EÛ剢]VŒòºCLדsÂXœ¤°ÝcžÚÓ‚Ÿª(> endobj +4200 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [201.985 624.519 255.917 637.421] +/Subtype/Link/A<> +>> endobj +4201 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [319.668 624.519 442.172 637.421] +/Subtype/Link/A<> +>> endobj +4199 0 obj << +/D [4197 0 R /XYZ 85.039 786.531 null] +>> endobj +374 0 obj << +/D [4197 0 R /XYZ 85.039 584.069 null] +>> endobj +3985 0 obj << +/D [4197 0 R /XYZ 85.039 559.517 null] +>> endobj +378 0 obj << +/D [4197 0 R /XYZ 85.039 517.822 null] +>> endobj +4202 0 obj << +/D [4197 0 R /XYZ 85.039 496.625 null] +>> endobj +382 0 obj << +/D [4197 0 R /XYZ 85.039 174.763 null] +>> endobj +4203 0 obj << +/D [4197 0 R /XYZ 85.039 154.767 null] +>> endobj +4196 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F35 2880 0 R /F73 3992 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4206 0 obj << +/Length 3111 +/Filter /FlateDecode +>> +stream +xÚ­ZësÛÆÿ®¿‚“N§d§„q8ùERÇõ£–<™N’ IˆH€@kÔ¿¾ûÛ½@¤Ý¸“qx½½Ý½}CjâÓj’Ï×é$N"Ïh5Y¬ÏüÉ=íüx¦,ÄÜ‚Ì0ßßœ½ø! +'Ê÷R?ÜÜuxRß3i4¹Yþ:½øéüÝÍÕûÙ\k=½Ù<Ž“éåÛ™š¾>ùF–__½¦ù÷³¹š^ÑàýõO/ßÍ~¿ùùìê¦#`@¢Ò×<ûõw²$R>ó=&“'ûžJÓÉú,4Ú3¡¶óÕÙõÙ¿:\²NäÔ·F'žIô!»Ê ØUö‚@Mbc¼(Œ™ß›Y¢§y^ÚÙ<ôÓéó,H¦Õ¶–Ù¢*óUHlÞÓ‚ò§·³0¼¹¬Š²ßÉdñ‘× +‹íÃ5‹èÍùë«ï0pB;ÿçkÈÊ%Ét­ì± Íò^ö˜¬--Ô¹\Ñ>Ð$k!ìÉÜ26WNÊÜô´ã6fÍo`XÓâRö‹¿á4[,°“oZÚË1´·8õ,c¾:—¿0‘ïû²÷êòÂÛW¥O«`y‘o>¯Ú¤¬…càÓ˦^W$>ä1t°‡eîhšGZ{qtjD¯—Ãj¢b/J‰rß÷B²`ßT3Vˆà€QLèÅAœ“åùašjŒ™þž-^xñr­&—Q:Ù!VðΈE§“¡N›ÈKI—£`uÚ>U@ª]çÙja +¶mZ™ÝâÇAAÇ6ÇòþPÖ‰Œ°Í€4¢ VÙdòT¬V2ºÏ­1ar‘Áʪ•ã0¥R»¯yy!“;‹ºíïhuÜæM;ÔL°ExÖ¢OØÓÅÊjè}Þ¶̈õ¼,Úœ¬dsQç˼¤¥•p‡µŽíZÈ8Ðç0Vž!™TçÏ+"t]¥ñdÞ¹´¯²@щ¯71òÙÆD_Ê™…>fb&ˆ¼PéÓ&fÒÄKHŸ¿ÐÄ z‚ÿ»…õx˜‰/Š$HÞ¢{biꌩ…ê«%+b}*±›SÎ}úäÅ-{d «?åu# kçø]`r—ÄîFÞx.>@u«²øOçÁ)t‡:˜þñ4MÄN@;Û*aq¶:°9ÃR,ÓÆïbÙo¾ñ?ú¿ú–ÐRFp±ª˜åÅ£6Ìõf„°bR+™Ý׎¨L^‹OLGnAr–QëÂ)PîX-Í™Og¹XnF\Eqç¢UnŽe÷\0ö%˜"_¤Eîy¹°."®Å ØU‰º¥ „ ûd7Öy¹m%‡8ê6æðçkÇm¤_gï»–JLΙ Œ7Kít*ôõ4[5F½ùPi±˜—ÍÖ¾è›.á½.€„›R&K‹2“ŸN>áY‰ÅvIëo®feuîq»U).qÁø%¼³„/—œYI‚t˜R‰!TP¨ÄïhEàÎyxt¾bÕ?hšS$Q¬} ñÔi^‚Ì˨°Ñ'™ BMwꯦblÄâ´œ—tqÓã€ÑÉÆÞ3`1/È",åáSùˆ½É[Nï_¾%éêXOËlq(‰{±êØ,h|!c¸ +˜W.æ07Q´‹a%¤‰tìúQhïªäÂ7‰¨‹’ðc•ù ý‡£Ò"¡2P”Y‚HÍ­þÑ åG^bÀh/ÄØqF,+ã%(½*Aþ)‡Får[Ùà>¦5x†b5l˜S¡S”QŽÌ"öÕd@ÑÙæ€ìÝØ%žÚ!ú:“Ôj©‘Â/Rƒj& +ú:Ú~Õ¸—o K…r×9Û‡lWá¤;àuánëÒÖNéç* ?@„ïÔ\ì}´m]àuݯùöuöèî¤ê~±Ê¹é‚>'½>Z¹M‹‰½Q6ïÄ j}åhsÙ¥øu´ +Š[[6XfûÑØèØá:BÛ3Y=V']©Õr3Ùq4âïnª4ðRiÖ×ßÐqýu@÷¬fŠ—Àh3Óèf¯7\ÏÐÂ]Å+2Ù6ÎõsU³¯µZÒ'‰u0Äîj-b¾Šwˆí{’AÈÅ*K jˆ®3É»qßã¾ë°ínº‡ÆxY­³Âîo×B 4>Åá$zسŸâæVOµ‘„vØö8 ïÞ_áózh˜¸ox åëW]§%‘*®­’¸>O&?Û¦Ï-Óþ3…íÔ.÷èvô: ÒØ@GÍü?‚‡hë*éÈšî‹…T²V؆ëù¢+%\ ýhzyQáܾ•d׶¾¹Øe»ùF`îªUïžåÊ-;ñ|ìãᇦ÷ãÃý‚óßÞÍmk¼Å#‡š…~~‘œ^ŠZ éýN£ÅªÈ»Çµt´ÐáéÜœÝ`Ï€·­±áße¨”ÊXm[ce9Ò<³#Ø-ÍFð‰Ã5‚Šü3©Åô@q_Žâ°÷Ò ·é\ëñRV{—GŒˆ¿¾ïbz¨m:„ǧÚ@ô+‚Ðëÿ„1`ཪm+¨î:ÿF è÷‘¿1Kç•2ù9øˆš?‹)#½ªÐ zŸ~—ö‹0#—†Õ[;x\Yhéâ|ÁžWÒ–¶9Zå‘õhòGÿD&_õ2g /M‚qÏf¨ÀˆâЃGˆ¢}‚Ý_ÒRü_…HmÇendstream +endobj +4205 0 obj << +/Type /Page +/Contents 4206 0 R +/Resources 4204 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4163 0 R +/Annots [ 4208 0 R 4209 0 R 4210 0 R 4211 0 R ] +>> endobj +4208 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [489.95 414.026 512.306 425.715] +/Subtype /Link +/A << /S /GoTo /D (ads-test-smbclient) >> +>> endobj +4209 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 400.477 183.828 412.166] +/Subtype /Link +/A << /S /GoTo /D (ads-test-smbclient) >> +>> endobj +4210 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [214.276 400.477 356.796 412.166] +/Subtype /Link +/A << /S /GoTo /D (ads-create-machine-account) >> +>> endobj +4211 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [380.57 400.477 476.48 412.166] +/Subtype /Link +/A << /S /GoTo /D (ads-test-server) >> +>> endobj +4207 0 obj << +/D [4205 0 R /XYZ 85.039 786.531 null] +>> endobj +386 0 obj << +/D [4205 0 R /XYZ 85.039 372.659 null] +>> endobj +4212 0 obj << +/D [4205 0 R /XYZ 85.039 351.462 null] +>> endobj +390 0 obj << +/D [4205 0 R /XYZ 85.039 270.776 null] +>> endobj +4213 0 obj << +/D [4205 0 R /XYZ 85.039 250.181 null] +>> endobj +394 0 obj << +/D [4205 0 R /XYZ 85.039 150.632 null] +>> endobj +4214 0 obj << +/D [4205 0 R /XYZ 85.039 127.314 null] +>> endobj +4204 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4218 0 obj << +/Length 3383 +/Filter /FlateDecode +>> +stream +xÚ­koÛFò»…Ð/¡€ˆ%wùì—±«[8ñÅ.r‡^£EÚæ™"}$ÇÿþæµKJ¤à1÷1;;;;ï•¿ðàŸ¿HB×Óé"N"7Ôþb½9ñ0ó·_ V²Á¼»=ùñ},|ÏM½tq{oñ¤ž¦Ñâ6ÿÃ9ûåôúöâÓr¥µvbw¹ŠãÄ9ÿ¸ô«ÓË<|uqýwË•ï\@ãÓÍ/—×Ë?o=¹¸µŒHôµÆíÿ{òÇŸÞ"R=ñ\&‹h{®Ÿ¦‹ÍIj7 ´ô«“›“¿[\<,xÕÜiC¸a¢§ÇõÃÑq}_¹ÚW‹8 Ý(ˆé¼çe¾\©(t^—*qš-wŠ‘“q¿/×8ý„ +@Ô#óˆeÎßÌ,ðŽ…ºm:¸ÑHø½+LóžLÝ7Qw¼dÛm3¼ã·ØE’|g+ „MD0•÷Â^X×CóQ¶]=ñ·y&jj^Oì†ïÏŠªÊÚØ0Çf´â·¢½3šÅGEX­'Û]§S¤d !°¡{@<£ uSÏÌa}Štè¦q:Ö§HôéCÓ‹6 A–¥a€9¢"~èjÑé.M†3¾“0Y™ëy¹ž‘8\Ì7e]Z8dpÖ£ã$Þ]FÝ .mp:—…=+sY'#5–fû¾ŒçgLIYw}VUoQX5IήÍ3Â~N Ì¥£´åÃ#ÝlKvÖ[ÄHcChLÉ¿)hêûªx3B ëF]ôŠØYËòéá0{iÉO> Að}Ùó°¸b AyߢšmEü©^„£bÇYv´Ã<‡UÄÂÓ ×ú¢æÙn{×­Ûr/¨’-Iüƒ …@Ó9†à†@.ªC1lUR ¢½| +G8}²±A…V$/rž„a¸ ±'yîÌÉ22^ee±ô}±y™ƒ^LáhÃÍ,_Ú5Œì’R‰{²Ëƒæ^§W‰¹£Ž!˜AîÅ %e®¡ â4żðý¡eM#æq¸Eavõ/ÇÌð†A! ÉG·È÷|?ˆ’?tKq°§‡hÑ ÷¼4°í–sŒæ!@d¢+hÐd›\ÊÏÅ&‡âp_È +±i/kt6äZUá¼MOÖÙ]®  fX‰:ƒq7“Á¡2´ ¦"m´¡<2×Çb„Löìšj+©ð.@ó=)6¿Ø:Ÿkzü®Ü°âÆ®ú¾¤``ë$=†Ö– KÑʵRo0·‘µÕ¢›1é&Œ›;‡©Ù;ÚÚokãšöÉ µ`k‹’-¹`R{ÁA|Y8d3ÖUækë¦`,ó>0ð róŽW&F0‡3)âP4¸dßñ%“:ËÈ#GÎ"¨g÷|šçܸÊÖVƒ±Oµ0ÐßyâR>øž£?CÀg1$;ˆKxÑŒ?×±NŸ‹×í2¢ïªc‹Ÿpëý° b;ˆ<?ñ +Qù‘ÎÜJJÇÃCö4(gÖ2P²†¶«È‰§AOXŒ𢄤| BmÁÆßàé6ÂD@øXÖ&›»dbÇ’“­YP¶Ë¡”¤KÔ@'/ª¢·f;Õ¬@ÔÈó±E‡V·M‘—PÇKbÈŇ â‰À…°ô¥Dsƒ"ÍPòŸ¦”ytjSÙ·Nc1ƒ¾—ü!c¥ãt(lĉñˆÒ›D@0Fl¥c)D§Äfû'„û‰ÍŒä m䇸§×@ã÷àñZì´²™“mÆvûê2r”Œª9ÆÍûéô0™UÔæ¯Ü)¾‚gï˜k9v5¸èÙ¤ñ¥ðàŠ/¹÷T  ”BB>M´É²§ÎçG ¾¼›Öu`ÎqOÚ-ÉÏ“ _XBÞB“ + 8¨Ê¿ù¯ùJaŠ0†â{²™•ÌÔ k/) Eÿîòã ðÍËÌzà©Œ˜èS‡¦>ƒÑ.,¾¢ƒ)[!A +&ÚÆ¡+VÀ™íÞ›ŠÃY•Äñ¹„€\#Dï.Þ#äÇOÜ7É€¹cLI(´5ÑÇkÛBmW1WêÌè¶Yf’Úë!£Üfïž$&€0Å,•`L÷¥\Ó´š±Ù7¼b8.Ùê ¶¦Ê¹1Ë+¯sÞ–Ô²XðšP’JæLUçY?i¬/™‹´€•‡\­ +b*¥sO#˜Ã®ViíÆa8vµJ\-8U[øǸ$£`í#/»ãTÅ?¿Çt9#u9”3+í»Áñpa9œ1+à™ÏÁÂ鎜RlÆŸ9 +ÃÊó¾bËs¸Äé;ÿ¸æþ5Å—÷’`sE¾`ö¯Ǹdé±LáÀ [}ñLPr±ÓC6‘Δsù .4:QŠà × ~¦v œ›Î–¸ËçžÉ ð¾öE‰¢D½Szô"øHÂÄnsç®›ú~&œ =W¥‰ÀaÎr3•Ë{)óE±«c=q§¶*ø‘.’pŠjõ‘ó\I6!@É#Îîi<ó.2öÇ©œWN ]i2zœ1Å\`¹9QÂ&åbYO2dd&‚lÇ$á'dGµnKzš‘ÇGzï +lv*/I0äAÈŠÜ«±°€öM;gbËšsG†««ÅÝVò³@9¤Óo:î4Ï»• +`Q|Ak.k|H0Ü%„\ˆQä´ÁWœ«U‚^tAÀ§â³—ÑðýXMÅG{òP +_+Q ^ìøÞ[y½ÉÑŒ}õ†ˆšmùr€z”mÈd‹¹Äi—¥îÌ¢•÷Æ÷8ÐW5Xˆ(¥Z-Ó/dÅD!M6ƒ‡ÝɃçŒ3¹âTJí&ya“ûÞUbäÂöÑÖk)„ý´ï4»Ã‚¾š*4 «†Ýæø·%¾J\P}ƒG®6žl§××GwcˆÉf;>ZCŽ˜„ãÍ8†‹@­.Rw÷• GÈ3©BÂu¿ÅÚ—š`€Xöux¦|‹÷”p)¦‡=‹ænøIFòA{­Á[E§ð~2rÍÕd×> endobj +4219 0 obj << +/D [4217 0 R /XYZ 85.039 786.531 null] +>> endobj +398 0 obj << +/D [4217 0 R /XYZ 85.039 726.833 null] +>> endobj +4215 0 obj << +/D [4217 0 R /XYZ 85.039 703.515 null] +>> endobj +402 0 obj << +/D [4217 0 R /XYZ 85.039 649.927 null] +>> endobj +4220 0 obj << +/D [4217 0 R /XYZ 85.039 628.934 null] +>> endobj +406 0 obj << +/D [4217 0 R /XYZ 85.039 556.177 null] +>> endobj +4221 0 obj << +/D [4217 0 R /XYZ 85.039 529.562 null] +>> endobj +410 0 obj << +/D [4217 0 R /XYZ 85.039 405.903 null] +>> endobj +4222 0 obj << +/D [4217 0 R /XYZ 85.039 384.91 null] +>> endobj +414 0 obj << +/D [4217 0 R /XYZ 85.039 247.702 null] +>> endobj +4223 0 obj << +/D [4217 0 R /XYZ 85.039 224.385 null] +>> endobj +4216 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F35 2880 0 R /F14 2895 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4227 0 obj << +/Length 820 +/Filter /FlateDecode +>> +stream +xÚ¥UMSÛ0½ûWøh"¬OËÜ€†3´‰rPC<8vj; üûîJrâôÔÉÄÖ®žvß>­,&𣡖$áY˜jE$§a¾ ’ðf¾Ô#&2aÎgÁÉ¥!MH–dáìe'KˆÌT8›?EWgw³é}<áœG)‰'iª£/ßcÝž]sîÛé-Øçñ„FSÜ?\]ßÅϳ›`:ÛQ¤œcúßÁÓsÎêMžépã„Ð, —œHÁ½]Ám,7'B·êXµ‚)ÂRð„h-Žb(e„S’HI”H·’б$”i¢R ÔägBÓÏõQ. °pë0¡ƒæ“ã|<#R˽|³EO˜’ÑÒä1K£ˆ\Öððî•oÖà¨æèQÝônð ^é€3s€Ì éçíÁ9$xĨå»tö£ë‹¥_žïÕ1ÓQß¹ ÐC`òE9¹äãzx¢IÊ(€•œ}~²2]·™;¬R#ìdƒT°Á™kÀ¦…Øm,±\xä}ùDzÕÑ™·›úÔEÛSš˜‹!ñÅ¢°Ò½ÁJ®¢%4ýÈÀ<ÝW¸póµYúÙÜ7W¹¥4z5•óì$£CùpzélcÌ›5è—òÀ:œx¢ã¢1%œ5AET§pʲ,º~‚]d#dB>ïÎÀMé˪ìqc>œRí5'\z¬»8ªkæó# +I$õø²sirSU¶`<è†Ý`™-Íf·ôxÔ­[¯+;ÁG qâ°¥­&4ÕD«CQ@ +¥ >H}´eë½=æû°Q^½§ñ¨Ï¬ü¦vÆöl !¾]»Íö¼†ˆ–h· D° ÈÉ™f$ÓÜKøh%oÿ¡5œzÁ<²ñmöfé%áœɤ“DZ ´Bà„"£DE›²ªp$Ý°a·A‘7ÞS»±Æz³+[GÑ:Wn0hW¸9‚¦5y_´> +ÒxôÆJ„Çßg.w‰\»qkº•É­¼‡ÕîíŒõ%GÀñ;„K"Üòù â¿®—í])4l;þ–,…{A d³ÒŸ K®ácÎ0þ $£Êoendstream +endobj +4226 0 obj << +/Type /Page +/Contents 4227 0 R +/Resources 4225 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4224 0 R +>> endobj +4228 0 obj << +/D [4226 0 R /XYZ 85.039 786.531 null] +>> endobj +4225 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4231 0 obj << +/Length 3070 +/Filter /FlateDecode +>> +stream +xÚ…ZKsÜF¾ûWèHUyh¾{“{×[IÖ)•Ãf-5Ã5‡Ô’œÈú÷ àCó1C*¥Ãt£Ñ/4@ù7ýù7Yìza~“f‰‡þMqzçÝhäïï|åˆâУˆÚ+ƒ;;ºK׋ÒUÝc—‘eó||x÷ásàÝž›$áÍÃÓïnè7Iž»qšÞ<ìÿídîí.Ž=ç~0Í~wW·My» “ŧ_ßéþ,»þö?ÿ|÷éaÜM7³Ë¼užœÇo|Ïͽ|qºX'ržûáÖwìQ¨É§ÉB§Çiˆðçm9c¯Ç°é&ÖŠ§íËçÛ]‚„†'Ì8í~¤‘öÄ<†¦Éw~hÁص5 Ö—;µÊ6K,Ñ”ó¿ÜÒn-3~c‰æžóp,_Yr$Ï/˜ËMGƒky”;ŸoCÏ)Ípîø¸a’BK¹ñ±lJ~V>Ý°åDìªooƳíDâ$tò|N$J½K½±PUßEI>Ù˜~>Mø   “±ËËV5ý5“lJQÎ=Œ™)ûªÌP’³8txTuÑg½å•íÑ®ÕðhøÖžBŸY‰Í>[]ñqÀÐÓeÚÓs]~Ç€š;1ÃŽn qî —íå¤qï¹Eª^öÏÕ dk@¡ó·˜-ç0:RmÏÎóãäq¯o6±X¾±h>õV:b2VZðžbøY†eW)œZå¥çèNtw>u#æcÕjæؾp¤ð358?¥ ‹ùûð^ü;{[m#†Åm1׆ä¡'>¶ÙìDiÅ…Ÿª¶k÷üÁÄþ„Fê{h-Hé õC{1¥/Ø©<]ÊÞû©ìʦЉ’ìÙªâ$v~iw@V4\°·ái/V#`M4¤fYk˜Ú«’æq:ÝÒ™­ ñÇ^œÄPë”–*ï0)¦è^B;=Þù”ƒ!Tâ[; ÕÆ0HíýèFWxR ÆSuÿKÓ¥åÎ,XS“îŽÆÄ¢#r‡9½õ ˜rÂFûråòjFõdÿx_#XГ«XÝ©oè5À[_1ڶѰ۷õù/<Ç]ÓÂg±>gzj8[‡ ê(¸#pM§3£À"†¿ô|—ªÀ"j·Æij …Ã8vc?“cÿRxÑ Ÿ|ßêŒüz úh±ÕŒ9Ð OYT½˜qB<4º€:¨zàWW5øéJØõPþ¥?g<“«æ‚$…æDdÿ„湃×äÏo3e .bÜ0ƒ¾ŒN£A¦ øríy9'JÒ±zº²ô†•ñÚòÄ‚(”0ìY$¨äÜcú­Yš|d›ò@¡$7ÛªòZð]~¶ÎÑÏÚžGšBAÄ^Û¢'aœ`ï8r¾Þf¡s÷3:ì·¾Ší`#î»ÕôAæü¬€ë,e9ÑtutŒýDåÑn¬‹í_ªA!Á¸«­-¬™Üv-ü]UX“°bƵ$lÎ#öÞÂÕž;;C>‡E)›ÇPïÌ1â ×Â"˜ XÚ")YQyMs‰¶ª=ì[ý˜€ ÍHçÎR_õ£™—ôõ­•Cܽo¿B¢ÏøÔÖ4ýX#"5ÌÆcúÑJÅ"Ì&ïÓgH‹Úb—Ï>uÄ°!þNë¯ÚÄ5ª»4àÔÂl¨²¥¢þo,Šêû‡ŸP³:ÇÜÁ]Un(Oà~6}¯ß|÷`\$hÌÂêˆ4>œ§ñ”Y»Qžkÿ¡Š²Ø~%åOR7Mem»•Õva–»Aê/„"‹öG³o_Ö Ü|ÜŸµü=>¸ŸÆi¨ö¢ÜCýk¤Zþø8|± ©ÔZ#Ó¥%íJ7·h0å§yôî+†(¿¡7…è÷ú¨Äïô63·5ƒ”êÿ¬¥Øï}å/â§Øa¢<8¿£Þöx $¬ƒò¡æh½ì_>ßà”êçZ0Û@MÄ;~hâu6Ý쬽V¥ŠÝ( çEªíbÕÈz]«¢´×%×k—c %ùå–1×n²ð=ÿI®¼endstream +endobj +4230 0 obj << +/Type /Page +/Contents 4231 0 R +/Resources 4229 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4224 0 R +>> endobj +4232 0 obj << +/D [4230 0 R /XYZ 85.039 786.531 null] +>> endobj +418 0 obj << +/D [4230 0 R /XYZ 85.039 766.606 null] +>> endobj +2954 0 obj << +/D [4230 0 R /XYZ 85.039 676.205 null] +>> endobj +422 0 obj << +/D [4230 0 R /XYZ 85.039 603.448 null] +>> endobj +4233 0 obj << +/D [4230 0 R /XYZ 85.039 576.833 null] +>> endobj +426 0 obj << +/D [4230 0 R /XYZ 85.039 395.682 null] +>> endobj +4234 0 obj << +/D [4230 0 R /XYZ 85.039 366.278 null] +>> endobj +4229 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4237 0 obj << +/Length 2744 +/Filter /FlateDecode +>> +stream +xÚ¥ÛrÛ¶òÝ_¡i_è™ +&^;s|çÒiÛi'“æi™ E*$eGö€L)‡¸,»‹½KÎ|ø“³4¾ÊfI‹HÉÙr}æÏV°óæLjˆ¹™;0ÿ½?»x‡3é‹ÌÏf÷Oæ‹(‹g÷ÅgïêíåÍýõíù\)å¥â|ž$©ww.½ûóTy—ï_Í/ÿðþš÷ï®aãö\Jéýy}{wþåþ·³ë{K„C¦T +Iøvöù‹?+€ÜßÎ|¡²tö c_È,›­ÏÂH‰(Tz^ŸÝýÏââ½pƧ¦86s™‰,ˆNK%ŽEìÇV*ì†B…1JEÊ@(Ì’(q˜XR¡@Q˜y×ßóõ¦¾KAœxWmó·/Ãնˇó¹ô*Øj›c¢ˆ‘FéiÚF¢MF΋YÚ”Am÷@J†ÞC[#aíyxÏUÃo”HØw˜çkm`T—=îE^Þ1/8.x(½¾Z5eÁ‡‡¿Ê«š~S9À}r@n—Äöp¤ÞB¿ø|Õ»x¼V“”÷xlǸ½šCiIÔçs”%ˆh.ñ}3bùï]= Ê« ÕOHBYójû€ßÀ[ve>TO†>ZË›‚x/~AX°;tHFâÛeÉHFšj‚ÝÇ0xÔøñæÖªȹ"Úbg‘Ó·§íŽ©ì(iJ"ðϵ(å¯l%>Œ8¢\1ØYzÚŒ Ví¥È¢ÈU­8 E–†£ÚKO¢îG¾w[>”]Ù,µê¿"Öaì{ËíºltÛðÞ]Ù=“G(ÕWœ$u„9nqV›²p´!¢b-‚N"1¨^¨ A +Òæ)hD1o|1­ÁëmRÌr|'RÐGÜxrý'û=~"_ˆ¸IòF_´¤iI¨zm?úËxIFÀ˜FËOÿN7%Ú€w-†«’wzDÏVC{à›ëªÑˆ€Ý²ÌÊDÈ4>|᧜ü î1ˆ¼7u»Èkoò._—€bJÁ?¯ò m>¹·ÿÜv_W]»Ý0®ÿðçOon?|¼™ÀÁcQµ=ƒ59*‡sîöúõ«Wwî9{_.·]5ìö ïÞ^Þ^OÜZ,f‘/¿–¹œs«mÙç Ñ„õÜC2 „ŒS!…¤£s#Œ >äy$,T€—¢b–íÏÒW?Éè¯ wQ~߀[˜e^Âľ|>•ý”VJ„Q¸§ï(ŒÎ1HS/7¶ ªi®—”U–怣̗÷Hùœ†nl*§9¶¤ âA£hù{‹@­X¤÷ËÁNÂwŽ1ÈA©£K9èça†÷|¹xô¤2Ù§7)#·£jíhÑ\pþŒ<’Ö£FÅÇÕÞÅÍ+q¬sÎÃÐ`½QMcÌ7†È5;^#HˆÚ€4é<ÔýšýçK­ÇØõ¹ñšáb¸ª+¾)~t)0<’ïN9K'YF!šÂiæ ^]0[_I;½Ø•ß¶ìêM„Ū?ÈO¤¸?ñäÏKóGé†ìXUèóKâœo¼bëâs[|`‹ï¼¡ óTÙüwE¶sŠJËÀ‚Ì«†Q¡Ô×ú[FÉ‹[óeò‹Á¹"ûcîÔhš­fЄ“¤PÚh€ìL<å_ïÞßé°`ƒ›—Ñ¥²JI†ŽÆ°iÒuR[$[*y\èBÑ”âÓp,oW‘<]°:0Ç3wå'"Š7stæ~N²#c‹c嶺Ðeš4½jVÇ(ó#„ê4e#Ìñ<=€º#KÔ©<]¥”}qÖšr•j%¨ÆŠ’ëMÇvŒI¯{ÄT¿€8Ép1*Ò–ÞÙÑ‹nù0)>ªA‹¹É›alŒ» + +RC“´¥cÝ¿´<£Yæ2«r6÷¡äDgIàJô¥¾/‚Cù äPq]2ê=|Yû"¡JÅ“Ok`æÐÄÛ؉-&$E¾Ðq©B!Õéëä·©LDi´w»T°-tõ]eÝ fx¦~sì™J¤m?ðŒ=é7”œ©ȾÝTìì†ÊÚc‚ 2‘@Ä?-Èè„ 5²ä©ëŒ OÞféÜÆ‚Ì¢CAÂJ¿±]ÈjÓU­Çèë3xÝ:qË^ô+´ é¶ ­xÔÖ­æ‚=£Î¢—OPcÑ +cÀ€ÉÕÇLo¦Jç¿ýÈ¿¡ÂšÒ)ã©NÝÏÿ1ˆ=™&><ŽŒE ¨+Ç[Ýjƃ[ç ôÜù‡8É+"ýDÄyƒ”Jß ïŒ~^ÆÒ¥é….˜Ó”(&Y²G‰nn¤6ƒÐCkl¨íʱÞj¨6_“€˜'ÌßX‰ˆ8Í~`%#Ð +Ñ@Hª:j%§®3Vrò6c%Îm—”Zféž®rJ˜e¦¢ÆÕù<æìhTëìh¬¼:y% ËKÃæ’f×Qüì qøÕP8^ BC&f¾›¬Ð¸£ÄðÀ˶3Ý)ãU'z›\¨à‚Qè6ˆ6'.ÈKkr¦TmhðÊͱ4ôh +Ü#z"ÿÜ6n3Ƙú”®É$ÑTm„9®iES´Swi=;y•V3ç*Ò² ÊÆ5• XÉ ³ØßW \°¯ļÑôC^×ÔLJm›RÛ_`Q7Çø‚~iT³Ú LDÑí§Ý¤KaàëÃ讨[ +kÔo…ÓÖ•´† í3‰µµ_RíVëTúŠÒþecŒæ¿ƒ#ïþÂ,lš5€;*éi—F•xŒ™|(§ä†vÛñÀe‡WŽ,nÙp„øúÓ¶kk† iÀ?˜ÖìÚ>œÚ¸ùO»è5¹íT¯M†xKÓk{Ê»‹~Ó¶õEŸ¯ùdÃ-Eî—²|a…vï‡ÚPaðöq`ê'?¢nùNõüýì÷Ûź†Ñh¸`ÇwÜ€# ¢ÑòýÈX¾¯Ó:Ãh;*®CïnqŸ:Îà–íÚØ ¥'‰.­ÛǵÎu³wÌ7·@MtÑœøN +Þ¦%Šwëv«·1÷XmíÏjIݶn‡¾0ÉÜŠÒÁ ñ_ãÒ~:æNrŠ}<ԕů?¨¸¹nòEÍ^Ä‘z—ÀÅΚ‘”³†Ði£)#ªÉšþ™ÒõK°­<ÃTdi0íX£ qbÓÄ?$Üx_5AñÿUð endstream +endobj +4236 0 obj << +/Type /Page +/Contents 4237 0 R +/Resources 4235 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4224 0 R +/Annots [ 4244 0 R ] +>> endobj +4244 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [233.71 212.514 308.157 225.416] +/Subtype /Link +/A << /S /GoTo /D (CUPS-printing) >> +>> endobj +4238 0 obj << +/D [4236 0 R /XYZ 85.039 786.531 null] +>> endobj +430 0 obj << +/D [4236 0 R /XYZ 85.039 766.606 null] +>> endobj +4239 0 obj << +/D [4236 0 R /XYZ 85.039 742.055 null] +>> endobj +434 0 obj << +/D [4236 0 R /XYZ 85.039 686.81 null] +>> endobj +4240 0 obj << +/D [4236 0 R /XYZ 85.039 667.938 null] +>> endobj +438 0 obj << +/D [4236 0 R /XYZ 85.039 321.515 null] +>> endobj +4241 0 obj << +/D [4236 0 R /XYZ 85.039 298.197 null] +>> endobj +4242 0 obj << +/D [4236 0 R /XYZ 85.039 256.885 null] +>> endobj +4243 0 obj << +/D [4236 0 R /XYZ 85.039 241.215 null] +>> endobj +4245 0 obj << +/D [4236 0 R /XYZ 85.039 213.511 null] +>> endobj +4246 0 obj << +/D [4236 0 R /XYZ 85.039 187.018 null] +>> endobj +4235 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4249 0 obj << +/Length 1504 +/Filter /FlateDecode +>> +stream +xÚ¥WÝoÛ6÷_!t{1˜EêkÀ²ÎmWtm渊´²¥8B,Ñ•è¸öÇïŽG)R¬dÆ 摼oGqǃ?îÄóDâDqÈÁM9ñœ-켞pË1³,³ϯ«ÉüU(î±ÄKœÕM§'ñX„Î*»v_¾¹¸\-–Ó™ÂÙtE±{5åîj ÷âýo³‹wÞ/hÿjË)çÜý´X^M¿®ÞN«Î‰ž›\táÛäú«çdàîÛ‰ÇD;G =Æ“Ä)'2,ÂÎw“«ÉŸ.Ú“IE,ýùÂcq,Gy8÷™à>¤%X(£.-¼ŸîÇ,ŒB§e¼|ñxô8>.$æôt$–s{AßžHX{«Û|:“^à~¬ +Hò÷ù»¢šú±{À í4§FwKš—f¿Ñ4»Mqz?VSŠþÏ_aßt,™ õŒÑí!qÃ5pPæ‹À2¥› Uè‰qIC•„A.ʱº‘ܽ"=ìà×úu£j$¤«o1°†V‹Í:3ŸG * ǃ‡æ¢‚Ý ªŽ ̉H#u7W„—,‚Š'Ç+µ9ßUæ7;*=E¾å‡°¤ˆ±ð¥‘á«@bØNýÖ >ÔuñF“wUZÚ]­hå@ñ>œ›T qÂ4š„Ú…öØpÁʪ¢q7:¤HÝØ ‰Ù†:ˆÜuJ+xh^`ÂÉE¤o”ɨB;G£ÃÚþL9ýœxæFy1ÕåÓYஆBÙ§uI³YcÇ{ÿ¢a[ç{¢^PeêNL¿Ik*n¯@G C·LïÚ:†™I‡I–Yˆàä9”»¦]eÑФ_!±k9òïE£-Ca- NÀé_.˜ïÓÆØ=Æ:ÃÕÀÍR®1çöXñ€¼ÁÉ|ño$©’ù²­³y®7sÔÌFr +Ëš8;ƒ h¡ä~áó ×czôZ¦½g ZÐ;³7z}{ôDðQ˜ã5§§Þmö ©¨aáx[lpé–¦½ €”å)v;¢¨GØYØÔFøÐøt#RW+¥ Ä(ï²¢&r~ŸÖóf¯ÔnÞ¤å:ñ£'¸¹UÇŠH• ÿMW©2‹`?ÕGýŒŽÄä%ø$,TÚVËëZC334à'´׃l†ýzk¿šè‰<æÇŽª¾ÛÖê`ñõþøüzùáãåH U®×…²0M©'w¹Z^}Zò¹&ß ÌOö«7ËÅ3bX¶&žuº¹Ë«l ×=/†±BýZÇš¼¾Ïë O|ÆØqÆmnm2L©P£¸Þ×E…y|2]¸y¥š/vö.­ôhDp!úBÏÕ Ec}±•’•E5P€5b¨×ÕÝ@às>êZK–ÿ[Þ¢ÚX7‡ý7»¢KXVå‘% +}]«c“Ÿyõ^=ñaà‡ÐÂäÙï—é!>ìJ&dhzˆíl>tÆö¢ÅL"fÊÄ}‰0¨U!hEÕ ”zÌ«åYwxFZZëÔ¦_ ]Kó‰¡TwH+ea°Pw\lêFãëÇð¥™ÝDµe"”4Àu§—6;Äú;Z§î€mi>uªñi Û‚ôƮ՗Ù÷øP4ŽŠÍïšà}oZÀ©±ÏMeA¿ÉÏߟMÑÓMi îFíºhM`{Jí–í`@•Æ\·ViÕöÒÜ4=ØjßÅK©H¶{F°'ŠALÒ7ëãZ€ +ý}Ïv%c–ÄþxAPHa$[g0×ìp bxH‰ÿ‹´éóendstream +endobj +4248 0 obj << +/Type /Page +/Contents 4249 0 R +/Resources 4247 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4224 0 R +>> endobj +4250 0 obj << +/D [4248 0 R /XYZ 85.039 786.531 null] +>> endobj +442 0 obj << +/D [4248 0 R /XYZ 85.039 269.569 null] +>> endobj +4251 0 obj << +/D [4248 0 R /XYZ 85.039 240.833 null] +>> endobj +4247 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4254 0 obj << +/Length 439 +/Filter /FlateDecode +>> +stream +xÚ}RMÓ0½÷Wøhb<ÄW¬@b/DâÂ&ÝDÛ&Uן±ãP +mU)Ï›™÷æÙÀý€ÕV* Ì×NZö´ß(öLÈÃJ…±(­1_«­œ–Êø«5…£òÚHS›Tó¶Ù¼ù ÓJ:‡¬Ù2-4s!Hë=kºo‘ÈŠ”å2éÃiìú”ß¼oþìPVpÞHç¯Ú”† Dw-p¤õ߀‘hÜ…Hƒœ+@2Áþ˜´Ïñ¦´Òt—ý\“ÙÁ2P´x¸`WA*ÀÌÞ #y«ƒçOB×|h‘\ì“’cÊ;ÞÝL"©[Š÷íK*ï—ÓX²ã$tàq^Nq †uú±ßå¡íkþ£ jþ1.£×ªÃ®M,S_(·s‡Bu øôsW&Vµ¥#ñ´é×›‡ô~CÞvÞÒSA> endobj +4255 0 obj << +/D [4253 0 R /XYZ 85.039 786.531 null] +>> endobj +446 0 obj << +/D [4253 0 R /XYZ 85.039 766.606 null] +>> endobj +2955 0 obj << +/D [4253 0 R /XYZ 85.039 651.298 null] +>> endobj +450 0 obj << +/D [4253 0 R /XYZ 85.039 651.298 null] +>> endobj +4256 0 obj << +/D [4253 0 R /XYZ 85.039 622.563 null] +>> endobj +4252 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4259 0 obj << +/Length 248 +/Filter /FlateDecode +>> +stream +xÚuP»N1ìï+¶ô^v½»~”€AEqPD¹Qp‘¢À÷cÑ è%ÛòŒgv†êbȆ$RŽh°~ﶹëxf¨ šj½/€þõA2Í‹¤ÙÄ›&´,s5t· Æ(0¼BH‚… ,DLÊ0ŒOî±v«^Èí½—˜Ü}=踳ÃþexøQRL95%_2†Tý´`fùVº?WSïÙ­ë§M»ŒM0ºëÝôL¬Ûö¶_Þ*¾›šjw3#Ì 4&,1,…¤j'-”¿è¿Uˆ¡Ê©‰š› •6¿PD±3§Ÿä|"«}·.OBçž_p`c‡endstream +endobj +4258 0 obj << +/Type /Page +/Contents 4259 0 R +/Resources 4257 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4261 0 R +>> endobj +4260 0 obj << +/D [4258 0 R /XYZ 85.039 786.531 null] +>> endobj +454 0 obj << +/D [4258 0 R /XYZ 85.039 547.583 null] +>> endobj +4257 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4264 0 obj << +/Length 3000 +/Filter /FlateDecode +>> +stream +xÚ¥Y[sã¶~ϯðyª<+º_úÖl»t&Ù=ãÌìCÛÚ–mèâ•ädóï‹ )9vr:™‰HøÐþÌ£?–Å®æ³4KÜ8ôgëúÊ›íhä÷+_ψâУˆÚft‘®¥çè=i¹QaÎíãÕÍçÀ›ž›$áìq;óýÀ ý`–乧éìqó§ã{î|Çž³TõÜwVj¾“Ô¹‘Ï=‘–ÒüV6›vúÎË|á;=ˆ‰óP 39ôžÐö4ÿûñ’mAå^Â{Ýòˆ0éËf'<~ñXÒN›‹®~{´ziµ’”tˆÃ5ŸÌaÍýxFºå^~¢y˜ºi”³4ûZD±Cz-‚ÔY³ $GFÑ̃ŒTãëVzªlæ¢|”¸Ô¯¨ÏFØÈLèÑlé_ÛÕj(i“•ÞêeNUuJUòÙª^ï7tj™OèFÎîXndì;´z«ú`w_sûðQ°æ­†ïˆÁÓÌYu-h/=†Y^ȵîÚ¾—voŒ±j̃R l„×ÚNºŠmØAýÞ¸ ¿`¿¶{Úu-X4ù//öÌÊM[[ãúñá—™ç|#ÚhË :â#?e÷…´W|š,2ìùb2ˆPIw‹]ÑèŒn}[A290Œ´[ù>Ã-&Ü}Y‚;»ö#glz÷Uú +µù²:ÿ'…’«¯Â˜Ð+Ot¿ºZ^ý×2ƒù"ß ²ð]>¼Ê#>Ò2ÓOù,ŒT‹(HÝ0ˆ-¬¤Iìæq,°’ºIN²Ç±ÅŸÙC+¶„êgªÊô( Ü(až³ï3Ÿ@=ÏC™3i³£bL¸¹«ýÙ¯-I:;Vø.&Œ³)Ɖ›Óõ‡ž{ {ÏžP +8®­E~èžçIË=Ú•‚Š…„:¯ç°WâŒè¯8Ü +™Îƒ-ÖÿåùÑîØ™5ÈuÀíö K:Ã;òÉÿÊa!,¾À¿rÄ&8ÜÎux†!ÅÉsÑIëñÓ×›;ú:ÏBÄhK„A½R‹Púʨ]©Á,UUßJ«? 'l–Ž!vO„=@WfƒðH| |#(‰Š ‹˜ˆlü½‰„sâ‰m41L†bÚÆúm€1±µ?Á7't÷Š¹L¤ŽYè bzÿMÙ«à „:“ÒJ …Js2l^eXP“}¤—Å[±©t9raR_ôóØC)â'z骽6 5µZïK}m¡ß({©ëyÑ|.éö h‡_Ëh°ŒiÿBmöß¡|ÖÜ~--®­ ýÈp¢¥xYxΣ¾ŒÀ`ÛV•·¸ðÄ‘GIÎÀ©¡ômDêïO“ħG3øDé¼ò=qìdI_ry¾Ü‘ôí°¼i þƒôÖ{°°}æº âRHÑL¸+ûÞ¢Ô'`ÉgÈü ˜÷ót¶uÿêZ ïvƒ4¤¯ïfyôayh„Ó Ú\Ê»¦yd˜G®—F&ƒæ\%ÊÏÈ 5ùDÖŒ;—·ESþt"u9Ï5l?’o2çý<7Lr7 ã—m]´ ‚4M†×GRÊ€ŠmÑ1"£Ç·9¾{=|””VšT£…øh/Ývû3ô¹ùœ$QºfòŒÎC'Ûp O¤| ïŠ!Ïôfy*Cm×ëd„†hd(뢿†&‰üsa¶™ Ù ¸ëȨB%!Jt&“€3¢¹GèÆ¡ ] Õí”Ï‹þR4±}²L¤ïdÔ§k¤åÀÄ¢Ö ¸ ¸ÈƒSîPg¢a‹î{¥¥ãWÔÇâž®Í9ÎœroSöÇ@% “/ÊÁÑqýGŽéÔc¼ÀMÃP“+FÍ)L‚èd»Ïó,â4?¢ËHªÑ™"(œHÊ{›D$”,Ò5. ²…4O²Fmjž]öRDâfèøqÎyldb?ÐÕ|Z”1ùX븨âxEÁaÄZÝ©>Û¢ Lx)‰" W'ƒ 4 +.¦dC]ëŠ*\Ϙâ óã­Pöü­^a3r¬Œ 3Ú/…-¦Diè¼ì[¡ÕJÌPHzÄŒ¥ÇùùŸ[U€^Gp P*í;ºœ” Ć`Š3véJª¯üï(…hNñßIC5ÊÇ+ŸæIfÇ&¹ ¢ˆJ«,&ñ‚Öæ.Ø‹)Z c5©môšïs< ÅyªR«Fí +]þHñ±ï¨Ú>Ÿý «Ê¦Nä’Ù£þ4|-Tóž¤ra³ÊÐä Ì®|ÒUz_ÊäÂzÙŸôüO'æ>¼qâžÔ²ÚAÈ@-»;€ªË +‚(=ï…Ïx/£ÚÎhË5CR%C(îºveß +8jRä2þËh ˆªªRý<_¤T ~e§ —HUÉ$ÕO„\š5lƒ/"ôþVÚxŽ\ëtö>®÷ú1Oíô·•ãÛž+…ÇøXz’'Ö¼‡’ˆAʤ1ߺ8Þõ±Øcdûæz ÷ndØê‘Ê«2¾x>I›i˜<ìåv§wíŽÏ†X;æò h°ÏÃy.w’ÊSQNíã`鈎À<ºÚo„ø…S­ƒI¸ˆ²|µ×PQ‹EAní¨âòø “j”éKFjFÜ8ÐÏ=u¥/‡Ø7¯ýö—Hx}å†}½8اÚ8óþ,ï%O@èr²“'§Y#çâƒ:A šBªéÜÃä Ûª7•‘Hj7…}’ÉuÅFߧFrn™# VJ?±PFÈ!op&óƒèG›(ÿ¿ S*A1È3?ƒ´ý•!wt¥(àJÎi`Mú*S,Éê õ›a7­DSçØëÊ•ò ýøc…œèQïÈO}_u5ª‹TÅ?²¤èw¯“»o|KoÌûËË/‡³,[W¥vþ]LÃjP q&:ëm&8˜: \EŒîÚEx°•ïYHë%ò‘_‚PBõm)„)B‘ û§˜ÙƒI¨ßC­ea0R‚5Ìcs¯ì™üÕ‹#?ämÓO3vîKüöÔn‡Ÿt¦§oƒqª¶ùe-õ ³ò®4)?êGÙObû‹Pþèž,M'ã#l%e@̦GH]> hJqê;E(¶ŠU+ G e’Vûæ¦dz›¼¾Ê?>æ:-ÅŒ¦µÙ_kØM²…ødŠ½œMôÎÓSìFáÉ/¬ï¿@Ù©çP¡—¸aœv Þn‡™gá{þà“”endstream +endobj +4263 0 obj << +/Type /Page +/Contents 4264 0 R +/Resources 4262 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4261 0 R +>> endobj +4265 0 obj << +/D [4263 0 R /XYZ 85.039 786.531 null] +>> endobj +4266 0 obj << +/D [4263 0 R /XYZ 85.039 766.606 null] +>> endobj +458 0 obj << +/D [4263 0 R /XYZ 85.039 766.606 null] +>> endobj +2956 0 obj << +/D [4263 0 R /XYZ 85.039 647.281 null] +>> endobj +462 0 obj << +/D [4263 0 R /XYZ 85.039 405.033 null] +>> endobj +4267 0 obj << +/D [4263 0 R /XYZ 85.039 383.271 null] +>> endobj +4262 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F66 3242 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4270 0 obj << +/Length 2310 +/Filter /FlateDecode +>> +stream +xÚ­YÛrÛ8}÷Wè-ÔÔˆ& ^ó²Oœ¬gÊ—µåÝš™Z¢-n(BCRvü÷Û7€”Dy²žM*%èºO7ˆ?ñà¯?I#×SÙ$Ic7Rþd±>ñ&0òùĉ™ˆÌ2gó“ÓOq8ñ=7ó²ÉüÁΓyn”Å“ùòW秿¸™Ÿ™Î”RHNgI’:·Sßùpyö»Cç”G/oñ7pî.®>^OƒÔ¹»å«óù~_ù…;ξÐ'Ë\\}æÞÏÿ¼øx>ý}þóÉùÜ>pÍW +Íþãä×ß½É\üùÄsU–Nž¡í¹~–MÖ'a¤Ü(Tò]ÜžüÃÎÅcᄵÆPŠTêF©:„É0ùrƒÀŸ$QäÆaB8ÝTI1ùNÞèOæÔºã>üèVy‡-ð:/PðŠàIœ²e‘âÛ¢Ú¶åÂB3á”/¬”³H[4OåÂN ãfÖ|³Añ’[îÓu%êhˆhéÅ +¤öKÛkÖ…LfâíÌGÈ2r±_Ïf 5·¯Šî U/®Ñ#_ÁRàBïGýóŸðãôN/n¦©r\î¿­»²†±%)?£ ~äž÷GOy­Ýð/Ù2\¥ÉBi/òM¾(;}a•NóLݶ©ÉIoÇ=ý›ç+y»‰6Ó(ëš÷? t ·ÑipøGÆ°¬ù÷yU‚Ìb$`!õ,vröÆ­hHÔõ×}ˆš¢*ž¦Qìäõ‚ ÂØ£]—¯qî{lÍpH bˆ!Ù Õ XÙµ#>@¼rèäU«];"ÁOÓ4dWÓx?e §6ÉNø>O §¯-jÄ" hA‹ôöÉ#·¬AÁí{B½ Ùe¢¥ BèxEcKûÍ‹¼ÒXó~:O È0ZʤW×sn4Ftv4Íÿ@˦XÂÔ>3“Í+@mÛJƒ§œWBsŒ«rê‚b^ÅmÞ¼pwŸ<ÊY1š(p\ÍŽT¤ª+4¥+uí¡Å8NÝDE¯2þ@†¨,€ÑÐUaLTæ®òƒIŒÔ0€Ià +’ÌZ±T;g š¦§Ê‡=ZÖ;fYä¹IøºaVd„b]Aæú Sì9CãVðµn;nq¾`z#Ùý÷ m(#;y1ÈyݲŒe4ûAó¼°0ïÜš?ÚBâ3 ãÀ¹ä4F™}Ã᜺dÿ6ïÈæä%&´ñc&–©­àØ?²ç榯¦¿|\áȽÀJsƒöÓy*„c¢^ò|vsÚø3Lœ…^o¶hX $L´ˆÛŒ†åsþÁäMW.¶µþÔM°.â}á-*äŠ|2gîýÑØ“ k&梥­p5 ‘{ØhW6 +(bÃvk<Ï›B†­šßä ÚQh”l••e A Pm8}—7¢ßшۇ¼+èÜ™” ÂMe*\·ƒ.-ír½!S ]Ê8æ þblò… väü#ë¿ð¹*¾YÕ€K65_ õà˜"²C¢b<(Y¤ë +áyÈ']éGKË­{”lç+aS»ìp>}g0K#ëè”·u'¿l s‡Nþi®Ðï¥0u-zùW¢lçUÅ Ãë;g¥9⬾Ïô@ ½dª¿O…†Ä ætÓL‘a໩ŸBsŒ(}BÑ Ui¯?”*ƒ’5²‹ ª—r"a©YÖK&”÷|;€,·`—õÂö |,¡2l $E)Íh…A9¨Ø¸ŽÎñªá(jʇS*|;j½þ+¨‰¡–÷¬ö°€Ô¨kMåî¢ØuŠ·%4+ÞV‚û™x5{pͯk ò7É¢·Õë¿”!P×uS»u#=kÉ*ܳµ‘2Bߟ8Ir|Ìàþ¯òÎÂj4…S\W&LÄ6RIÍ®=íQø¼Ð ¿_¯ÿ +|"´ÃypÚYe::D¸6ÄOÜÄ»8Œ' ä2£-¬‡j.Э¥a ²uv·K…ë!QG‘ 3ϳøÍHô#i„þg$MyžßW{ÕS™®ìur»ÆfÔí{;ÿâFÖZbܹ +ö~=Š^’¸~˜¼½^ÿôDèÿˆÞB×v+/ºÝ±\>s„ø±¤ÖHîr»*é7Riog$Ãû/V3IŒ¯Èå"—R%‰%û±eŠUÜþ®Zž ¸fpÊäUÙvÜZçuþXXîàú&1UbïÞ×P w52áX¡c +‰ÔP†€Øé'5ŒP1N2)J×ë{‘Ù‰bP‹eðQª®>Šº²xÜ692mihwCø‹Éô–O¸î£Ä'Ê}ß\îÈS^U×抑R-øNæЃk­ÕÙÅ¡Ì~?â/ä«{1ü*7Vœ‘g–ËZ`“´ïGî³ý?\NCn§þŽà2UË¿UñTT,ë»!TæCÙjÍBtÜã r¸®)k¨‰žòJÂ=˜+.»iŠ‡¢i°ìÄÏuN¥Ôá´"^éžeß#ºÔë«Ø=Ù¯îÓBÀ?œ³¨WøÒ$VÞ› oA +Ñ(‰ëe,~•¯e¾/}ÞÓ÷%ÖàËï +Øw…­¶+Ñ{’Ý,Åß™Ñ%ó˜.øõçXE‡æаñs`IJnMõ·—§žËC‰ÙHÄ›^Ÿq_‹î@r»Ùè¦;n´gÀJë¯#„wrf"å¹^šì=í©ŒŸ$`Cçô>à ^¼Á[åmÑ_×Q‹_ð-[D2âæ#¯¦y#ŸDÝô¦°”§i¢ |ùfBÖêà CÈDöêRc‚6rªð«È€ÄÂnp%øF-zÒßw?¼“ŽFÔí»¾2Ðã9÷6 ¤èÕ>བc"Ѹü€OUÿ溚'#þÊ3çH¬åÅY ½X +ÓŸ30B«åCÿx¨;[f÷…ùÃîÛ%Ÿt8²w4íî Ï7šn„²ƒÈ£ |ýŒ‚ƒ;42Ï¥¹U·m.ÍK7¬Ù½ëÏ¡ÿh<š=uªÈ Õèþ1zé?‡ì³d˜ºYŒ—QðLœ(c º˜Dû›ÿD:´ø¿p^ †endstream +endobj +4269 0 obj << +/Type /Page +/Contents 4270 0 R +/Resources 4268 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4261 0 R +>> endobj +4271 0 obj << +/D [4269 0 R /XYZ 85.039 786.531 null] +>> endobj +466 0 obj << +/D [4269 0 R /XYZ 85.039 668.735 null] +>> endobj +4272 0 obj << +/D [4269 0 R /XYZ 85.039 639.937 null] +>> endobj +4268 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4275 0 obj << +/Length 3692 +/Filter /FlateDecode +>> +stream +xÚ¥Z[s£È~÷¯ÐÛ⪦¹4·ñÌì®73òÖ¤jw„,2@ãøßçܺi!ä¤*å*Óôõô¹~ç µàO-²Ä¢|‘fÚO"µØ®‚ÅŒü|¥dÆR¦,9·W7?éx¡?òÅãÎî“~’ëÅãöwïý/ï?~¹^FQäÁÌëešfÞêZyï>ݾÃîØ»áÑO+|†Þ×»ûŸ¯ÃÌûºâû_ñýó—¿rÇízå9w÷?sïÏ¿Ý}øxýçã¯W-áÎÕT!ÙÿºúýÏ`±…+þzøQž-^ ø*χ«8‰ü$Žä½¾Z]ýÝîÅcñ‚WÍqÉÌXªÜÏÃämNjíë@[N†0ûQ¬‘“J…~¤ÂEš$¾ŽSb%p/þ%qî}¸^*¯&ö›cßój›K7—Þ$eœC¤¨Äª%%R~˜'DÊOU‡‡#C ­×ë,ò~¼^†:ñŠº†Fœ‘<ñùék¶ð¿½Sï¥ÇîÜk £¤PŽ/ø¯í¾UØýÄ3ŽæŒR– Ú|ºåöA¬ÌHÍwÜAÞøü’÷ÅSÉKnë™·Á™ß`ÅýkX]ðA[^z }zê+ž–ÈZàØR¡tsâÓ âˆ3  ‰ŠpS+ëÌ]"8ãP࡯ä”OÕ¯Bø߃1Óìy×4äÇž¸ËuFg^`FrIâ=bûýìB¤8…ýÞ]Š6DIêýöá]¾Âë#ÐBUh–ÀÝÜp#ÞS;¢Æ]É»–|Öš”XÎjà)àsfäD<0É!u§Ý·Ý¢ï«±ÏD[Á7Ðg†¯TÝ<ðú’‚ð9&!ƒvvM&Žô„çXâØr‡MŸ¡M°6Eª:ÙšTþXSö¼$ šhÍšÏxìÄ +ðÓÖ4]tà펓ñaÊ)P›‰ÄA2¢yeËü \eã.([ÌU¸óSW»È{ßB¡ŸéK€QŠ N Aªî??2o û¹ŽO˜3¢|ÐІQ¢Éº×1ÌÏðõ—§Ì_x®˜©wFüƒVg„‰è´€'$=ËSSq"×ïV°w+‡¢tÀëë(!ŒÎ Qêo.YšÄNIråu_ôç*“œ2…*¨¤ t°®~”KqŠòáÐ*©y1xÅùXgŒÜBbI&*¶ M˜œ@Ö¦LB¶Ì3O'5 +ç Üa¬‡™¢Ü®„½…áT ÛÍ„4kM™æ%ò[F~àÜo…V—…Móu ¼_Úç‘WèHñjû"‚{•`#*‰Ybd-ì2 +~œ—·lš +w†&៬%±gÆ·qÇ—­·ayqÇx[{„Ñ⫲¿h_ª§½x6 °>dY A‹¼¤ÀbЦD馕ÝF–pá“:?­Œo%H +ºò¹~§°²Ä‡vëˆíÑ.íÝs~+ß爎SÈìßþnî̹üÝ\E@)ÿꧬzüÁDœ@H䬺ûמmçÐsÇÑ(¾€1iòTGcO©”‹òÆÖ•xû–¾+À˜8æÆ7ú(WqÖ’…’ìÃìçYÅuçŽðùٰÔùƒ'ÿx8D>F«Ð°— E³^ Àà±Î’CŠÙ6²QÕØï¸&ÓHì•æ+<«à‡À ΢âœáb.S‰R?¶nÊasƒ<ëç>'¦>$„¶.@™““<öÓäô£dÛ1 #lƒ O·õå,ó>´‡¢yoyK0exå»”ŽD„íV\Î,É!‚Jòã—A—âÄñeú!Æe;ùÍ‘qøÝèÌwûbí”C—18pApú„Àè^ ¼‰ÀÕD*ðˆ)g“tÜP5¸'˜ÌØnÊ¢«¥ÍQ?&_ü進a?>¦2µî-÷G{Ÿ×SŽ(‚žá` .wpŠ¼ÝºààˆK6L ±Ÿkñ°»ù5ˆ¸àV¾0ÎT¤xÄpÉíF‰óO§,XÈÍÿ¯ŸCZ7g~ž…ó^0 S_§±!Yê)ÁI”ù ˜ã9Åÿsž_Öendstream +endobj +4274 0 obj << +/Type /Page +/Contents 4275 0 R +/Resources 4273 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4261 0 R +>> endobj +4276 0 obj << +/D [4274 0 R /XYZ 85.039 786.531 null] +>> endobj +470 0 obj << +/D [4274 0 R /XYZ 85.039 766.606 null] +>> endobj +4277 0 obj << +/D [4274 0 R /XYZ 85.039 744.844 null] +>> endobj +474 0 obj << +/D [4274 0 R /XYZ 85.039 673.261 null] +>> endobj +4278 0 obj << +/D [4274 0 R /XYZ 85.039 651.4 null] +>> endobj +478 0 obj << +/D [4274 0 R /XYZ 85.039 162.781 null] +>> endobj +4279 0 obj << +/D [4274 0 R /XYZ 85.039 140.92 null] +>> endobj +4273 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4282 0 obj << +/Length 3652 +/Filter /FlateDecode +>> +stream +xÚÍÙrÛFò]_Á·%«LÇàÊ›m9ŽvcÙ±äÕneó‘ˆ2I(hE¿}Í`@T6zØr¹L÷L÷ôô5Ý7sáŸ7KBÇ ÒYœDNx³ÕîÌÝäÙ'KAYZ8o¯Ï^ÿ©™ç:©›Î®ïÌ:©ë„i4»^ÿ:÷Ó›Ï×ï¿,–AÌs±Œãd~µðæo>¾}ƒÃjþš¡¯ðןß\\žZøÉü抗ï¯oðýÓ—ðÀÛ/ôÊ8—xôÃ׋ó÷‹ß®ÿ~öþÚ0nmÍ dû÷³_sgkØâßÏ\'H“Ù#<»Ž—¦³Ý™ +'T¼oÏ®Î~1k1LÍx֔ qÂ$è‹É -1y~àø¾7‹ÃЉTLrºÙ€HòÅÒ›ïa7JÍ3ú©ÀûMûu‰›~¬q,œû®ûC_óÏ¿>óoýTãR^s'k6 ¿> DiJV9Í)·ß‘D.3™+eIßÃ@¶ÃAäUBdN`¶”Ý.=YJ[¼øÌç”­×0[ÈÕ¿¿epù tòð0&ˆ(MùÓ‚°Æ¡‘µ`L“äDÓÔD6µ!‹&‘\æÍÛ ´µO Ë>Û t•Ñ,6ÿAÙ$ÊI½S²i‘&d#HÈ­•Í9-›IjZ6µ_Ú%UðPäV|0bº‰I«NW:`á¼1ñÄžDÁ ñ´Hâ$d8Ï9-žIjZ<µaºEY•Ùz•™øÜÑqãå7°+Qle‘U<òõüó¨ÜÂ|¥:!·iBn‚„;‰Få6ENËm’š–›Eígí\@@¾ï£ƒ¡ß|Bh:º†ãâè÷ç?‘-^_9<€’Q¼Ö*ktFBPÌÓÂÞ>N’“Q2|f€ûKQ2|f”Œÿ_¢¤oGÉÙ2HSÇ Q+0ÏN´@@ôm†¬bW2d|‚ YE)eÈøºÂüªü¾è&ËŠæo²H'ûE[‚qO¼Ù0(ãñó§6C.V2†. qjããlÏåé½ ¤Îÿ^$`¸˜îFÂ:<Ü•Õ +ùpcÞEcØàcA,ÁSÆ?ÀR¶#^ŸyÑa^T™ã›Î¹ô5\áõPÓ)Ü‹zCÛ¤ÛÙSþÈŸ¯Ê=f£÷ð’À=9½°9‚X {ëýPVkË*-ÀƒÄ­pÇ\5…Þ¾ŸtóÀ5WMY=ᨠÙpè¾9Ç;)À¶Ù*g|rKÊ“k%à|,VUY—w^ÏáDî†üÕVÖ¢tƒ<L4ŒÝoxË»Ña%’¹1麨L4 ‚˜ë©ð[—ì_1¾¶d|þ¨ ±Ž€$vXœ+§:KÃ'©´D}°ôŒ²rIjÌiîäP±G†)Q~ëûñΑ۵sxòÎhq¾#Ή‚ΊXMìF0€A<ÀïA{g|áÊÉ%˜b¦×AÀYþ!ÿðô[îím•Ë/d[~Êг’ðËzèÙ7V¸—¬ØSìR©MÁìy»9o#«‡¶JÞcòç8¬¨Ðù¥Œ÷œ¯Æ•åZG /Ü6Há 8C5çÒ9´IeÁÄ•1 ìV÷#ÌÔÚîTwæ'«7P‹‰”üÛKd®Îf™<¤±lLýÄ%<}çNDÈ,È>¦Ñé#èÄIq€‚mX{%ï@E'mlj¾ÎïÈ<¶(൒-«µ4Y(HêÙ~½Ã,)S¨/¤Y2ÚåbωÒå- ‰ÃI§ô€eƒ82+I— )ÔLŒ.ü'[m7$mKO¹Ž!°Çs'*83k÷Èó…ž=ô LQì$n‡ñÿ;Yëwt$Ú¬vm땳£3]®µÕ_p#ûÎNê¢Ñy¹Ët¦C ò×ÐñÕq6^HÎÿPqÑ•u•ÌM?®5j™Àq}…ªÖ׌÷ùüÕÀ«:EÛù&{§(5Úç»uÂôD­ÑBšPbA:¥Äã_V‰yTb‹ç“JÜ.øJ<ÉVb‹»QâëEƒ— }ЮPÜðs”úK7öØwQSÝ^fun¯¾­R@?^Þfr~—ÁÕ¾¼ïÜ›%?ªMÓ³«ÐkÚø&{±£Ò]g iB“é”&|YM>æyP“-žOjr»à hò$wZ“-îP“ÔÕK¬‚s]4CÊéEŽRZ¥D"Cp©Ðd·Ûüy¶á¹=žôð±ëà&-[ø\qžݸõm{5“~Ï­³ü Ù½é}@š$ŠŽ%/.ááµ]fï­|§0ÕÉzT÷ýtüó£ûÒ¸îk¤º?AðEu¿ÇóîÛ<ŸÒ}kÁ¿®ûÓ܉îÛÜ¡î?Vt¢e] ji:œVR?rbÖuð=+;SU’ºÖ ÒÔ¯ øDõ´T=ű!=ÅqN§ñ‰î÷Spl¥kÍ…Õ תp¹N?;Ýë€iû\VÂá=O | +Ç>@:FK~ýŠ"+~? åÅZ— ¤>ÕmŸš›‚Ÿø6ÆBš0ì;îÎ×cüÃÍ6Qþ4ÿ-Îx#†¾êæÜê#9RÏ|­SôGý…Qp@ߘÌ7…é” o®÷mez€·,ä‘>ütÅ/ø5 +ÍUÔ¿+ò°·œj搜Üp;‰¡ºbƒ£u¯²ß/½rk•›•Fé?” ZZÚhVZŠ¾\0|Ìœ2lWâ#µ0é«dO·”¥wþÇ‚Ø“Ë Œîòfö²æå´õ!ðqÃÕYn·#´á’Àä9_õä=ôùASQ_ +°ãì›)?@ÃFï63"„B Æ$Û¯‹vEçöÈâ9BžaGÔ˜—R~qBÙé  +Ä_Dè‚úA›?y}Ôêoxƒ·@?VÇràн$ÅòšñÏͶ˜ *ôZL„ÔùæÿžXÔî1JùÕ{ÅgüûÕ×Wü~ô™0ɹùqA–ßýNd ¸/ÅÉâ®ó ²ß¶§/Íqkÿ“þ—úºÎŸÛ_ìúš¬+®Æ÷â½cýJ›• Fž(!° :RøÏøK¾bõ•4ñf¡^8Vš”XÜKsôŸ¹ô9þ/ãøTendstream +endobj +4281 0 obj << +/Type /Page +/Contents 4282 0 R +/Resources 4280 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4261 0 R +>> endobj +4283 0 obj << +/D [4281 0 R /XYZ 85.039 786.531 null] +>> endobj +4284 0 obj << +/D [4281 0 R /XYZ 85.039 736.988 null] +>> endobj +4285 0 obj << +/D [4281 0 R /XYZ 85.039 722.833 null] +>> endobj +4286 0 obj << +/D [4281 0 R /XYZ 85.039 709.89 null] +>> endobj +4287 0 obj << +/D [4281 0 R /XYZ 85.039 698.462 null] +>> endobj +4288 0 obj << +/D [4281 0 R /XYZ 85.039 682.791 null] +>> endobj +4289 0 obj << +/D [4281 0 R /XYZ 85.039 669.242 null] +>> endobj +482 0 obj << +/D [4281 0 R /XYZ 85.039 501.341 null] +>> endobj +4290 0 obj << +/D [4281 0 R /XYZ 85.039 480.75 null] +>> endobj +486 0 obj << +/D [4281 0 R /XYZ 85.039 163.443 null] +>> endobj +4291 0 obj << +/D [4281 0 R /XYZ 85.039 134.039 null] +>> endobj +4280 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F56 2890 0 R /F20 2865 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4294 0 obj << +/Length 3833 +/Filter /FlateDecode +>> +stream +xÚ¥]sÛ6òÝ¿BT§¦A‚Ÿ÷–Ôiê^ãäbuüÐö’h‹gŠTI*©ÿ}÷ (Q¹ÎÜdb» `]ì,ü Yì+/Ò,ñc,6û+µxÌû«@(®…äÚ¡y»ººù1‰òs•/VOvž\ùqž,VÛß¼~zóiõîóòZkíåò:M3ïaxo>¼}ƒàÈ»aì‡ü†ÞãÝýíÇe˜yŒ¸·zÄþÇÏÿfÀÛÏÔeš»û÷ }ÿëÝí»å«Ÿ¯Þ­,ãÎÖ­‘í?¯~ûC-¶°ÅŸ¯”¯ólñÚÊò|±¿ŠbíÇ‘–~}õpõ;㢚;¥Xg~œéóc +b瘂Pûa,Ò8ö“(¥sºk`aà »¡·)zi}]^ÞN¬ÄFÇ Dm'ͪçoØ–›Ð¼»àN_v_ð¸ìß#<òŠºæuq`±G¬ÌØ™Ÿ«~芡™Y¦è kfN3Oá0bæ‘,®eûמaN{®Sß¾íñplLÑ®ímÛFv Ð5®õŠíÐûõöS¬ßµÅvƒëÂéAT,Ò™·ÚÑ™MÕ·u1”2ùt£€îJÚÖGÀ UÛðCËh4„ÛMQsŸFá˜õ5íPMöÖ”qJ$MmN³§óI¼_>üôoÁŠ‹¢¦™Ë-#ˆøÖ n‰Ìb¯)ö<§Àr÷I[˜lÛ¹KC“þâ!Eh]<îe³Žw¬x&ýÌàá@ÖGÚ;t¤{0þ 4ª-xÒd4yAéQšÐ¶ +^Ù劲¤³‡9Xh€D ì­2»ªMc§BÚ}ᬷ&A–Üyj»M…³Ö‚­šÿšÛ ôÙº›iïUƒó |ÛÂ4f5ÁÆZŽ!ãmõfña«}Â/ v»’øl!D+ˆèG¼pÍ–gêJÅÃA´Ý þ®buì+ÜòóÈ p|ócœ8VG«ØOUûÀ À²´¤Pœ¦=641U×f”+øCÑç;”pøtF3—üñÔrE*ƽG*BKÿ€-mdÉ‚ì[ñU@zçVÀ­ŠŒDª2Ã#Àx^ˆÛeª "3"'á /Ò{™l AP]Šk4lƒáB^2h]‰ÆÒ*bª¼¯Õ°ãÛ‘4M#ˆwd6 W2Žïar êPPï…¨†ž'Ù¼!¢@}N=™¾kƒÙð–ñlˆœDÓ嶇ªvôvΦ‘½A=Ú0›âØ “¹‚ïÓ±1'‡ìT_lŒ*´½±]F®ÉâA{ªå@ùÒŸk_Ã[ÜKgt?ŠrÜ"k´Ù%²à_–yrlÉ­UDâ¢aöf£ Îñµ"UÖP¼ˆÁÁ$æm Ïé6ŽÖ£tÁXן`/ZêI¿fl iZ¬éò7Û¦ÄÊŸí“ìªgtÓÜ(ê®,¶¯Ü)ÿÕÌ£"+Ò-WFr_oïÀwñ\fwFd¦ {3ô )gKŽ6Ô£*Gœ”uÉ +„šX:Ø• 4²z" «bä°/*Aî%6 »š˜Á9E¼z)„2œwÈiѶó]옋 ˜÷*jæÆS v+_6 ØúÈn²H7Gt5ˆÏâQ†£”õªekFQã wÇFAl¥5 ÝŒÃñ~Sîœ'Ú§þ‘ÞE +“Ȳg‹][S+%¯Eñ„÷$h¯.Hݪ­­î²ù­¼/F‹ýSé”G¯øÔ’žl %lù•—*ú—‹b§¤4>ô}êÚ=·~Á%P\¼­0(Aׇ¨í\$#ÿÚ W»¢y&Oþ̨õ„YŠ[­DdDd Çõ\"X”¶Îºj ÃM„ƒ€rì¿ž0î¥Ð*ù²Þ €|/±EPž”y¡È°¦˜ Ðíz(*6Z¥ ”·±G“[³‘(?Ù0âoaÖÛ³'XY#ÓópŠ ÊÉ@ÉèÄD?çñø‰SA ©è;q¿¸èÁussÏA¥vy€ ­y²þ€•íÊšœnÊ Ûr°Ù›è£)9§éì)è4G¹à™ÎÝTc?Ã<“˜4w.·ÈaçÇgÝyû*£%þÆ6ÅÓñ“ù(„…ï`ðgGXëþ*вª`à±—È„SP[‹„óœx +‚‘<ß©¦óïò®´*•sôvª}‰†/Pt™unò9 à°»r> +÷˜2’„fpŒP[óÎíê+ÊQOi15çY6o)Tn® ¾‚D¿±-ˆ²fC +¢z& ÿÎÂ5·Ok×”S}*æùXꇺ’»³gÙ"÷V9ÑŠ!Št¾g®Áù˜ºAûR„€Ã÷6BÊ1Èg,\l'æ‰\ÓÁÇ®BoMw”©‹ºo™tkV>ð¥ (çm.Xîé“=ý²Œc>ܺXÓ­³^–X„/kêK'²’PvŒ˜Ë ¡r4YÈ°÷Éhâ)µG Øni1Ž¡oL—Zþ\ÌÈÞ4ÆSäÀiÛü®‚ï…UyÀ|¡™ÅÎzŒc_zñæ°ÕÙ\À–PÌ.ñ†Üh®¦zh}bNz:Žã»¡5‰¥›¤®&4Á ù?ŽeÊSc9Œp•,bo!%‹´ÑKŒ/§e²ƒè­uàö¦PD‡Dt/†"Š]D›;Õ!â@&žáìù1V“KVSà™¿ånÑF©±ðsàKÒvtûY¦6}9ŠŠ!xÿ‹IDmÅJÚnc“O\áµaÖ‘¡¬zÑ0ıÛÎ}ƒ±fb¸9K/æàíè°·,žyÔŸ» Eéì—R¸<)¢š>)¢DIjbdŒÆz ± +»§4ø¼²‘ŸASÍ–TDgبŸr¤Ýy²ÄW‰a¨ß¯}¸ÑO3ëÅÊ#C‡WÞ:V0¡¯Âlr˜&#7VÀÅ’¶£Cص¹M„ÖÄDö‚³éF4MxÃhÊÏæeLg“<þØ‚Ù83]ŠÔq.DÞlçü+qª`–?6^@ÀŒ+Ã:S]éѱ>sŒbTšï—9083''4¸6^œ Ký*ëR„´}æÃu4õ„ÓËÚŽ6ú|£kSZC‹Tt…Y±þ +m*¾t=Õ„1 –Nˆnzò¶V“º\QR8³“AF(ñQ N=P89)á3´è/Õ^Åï¨l®tÖš My1uf£®™!?)d±©Â˜Ø gªäÛïȺÔ[îŽÕ +EY)ðÑsªìB5V¥›é‰!!PÈ:7gBB?È‚‹&ý`ÕúKµuó(­gÍ.€å¥ ¨X0Tyâ¬M8\K<"Ù/ëIÏ Ãׇµ°ën|;^¯Šk:0,ÉíPÖ®æ—Ü¡¨)Æ¢Æôeq“ Ó‹ØÚPb¢rhŽþsÛ á“ ýcIÀ»ÖÌÛ×”« sÿ¸"Ä^:­W!`ÓvDx5åçÍ8‚›=7Ý·¶®Õ’ë!ˆµª†Ó ›¾~hIA!Be/SÏ=}9¿*™ò…µp{ƚדóíl™t­ÜZ{b7#IWi hÊ´g̦=Ö£O4ÐùRܸ½ø~Ɔaà‡yÙ¸)‡ÍÍ®ÅÐaÆ ¦~˜ÊïîÊ¢½Ô®ÑˆÏ?#‡iêÇYöÍr‡†ž~CÀ~ŽÆ‹¯¬VÃ$öÓ$$6€»È‡­ô ¼‡r8Ó‚CLü>.u@àZyï?üõƒß‚äk/ñô¶íG:ý6Û#ÍÌ‹µa;Šý áëÕŒžX$†‚®tˆeønäEî[©ã͈hm_ a´i’"·àÏlÌ ³Úhƒ6oâ7zlœÔzó°'ü-)%Äæ ü;/‚¡¥+抃æwðyÏ¿BQd¿§ç\[ljà{¿âïíIžNµHtšGXÚ y,kmoO àt´8ŠêF€=µCÎFÃ\^“sçÉH« ™Æ­T‡u¦¼¦œí·6g©Ùé‡UWJÈØ™99$uÐ1p"o Øüîþãê;ž€«3ëÙàgò‹‚Œ7ŸºÊЊNl'`oRÈ\]åS/ok[Ž”ßA„9Ø€z`×þ¼CU`eÁo!_”crž®C([(toí.ö&j¸´àCÍñQÏãYùðÍ€º\Ñg«Ï/«ô°ÚPYý,.âlŠoÒ£ütZDØ¥¢>âHHJJ +oZ]\½Õc½Bé³r6ÂœY¦½¹:ù…Ò'•èð´\5÷ÉÆX-¹-µÈxÖÖô†U1Ì£“?ÌzŽ’ó +d,‘ÕPmªCa_,AGãÚöeH ª>˜Ÿ£ð¯q*ѱ‰ÛÙ·0À­åi‘Æš +X›®GÎ?³€yÓ¡ +§{²y4›`!¼tÊÌN5ôÜ^cÕ’·s×O# ²®üàæ,|7¯}’,_k¢_é˜õB'â”zÀ‚)¨:s¿TœnìÍ XÎÁqâLS)óÙêéó .}ÑÈŽÜæÑIïiÀx&ìOc®w{©î4ý‹¼mPh)O1üx’˲ôk èQ¡~åÎè•éùܘY5S觙œûÍÃÏßB~0ÓÊãÏ$”b;ů<àsÉ\iÜ+òŽ$™¤V’$›‰G8ý‹Ð÷“qö~$ç¯Uz¬®¹—ƒÒtÊ’}z€öx-;Ì*= ÚÃXˆ‡®Yx>úí¹ni3õnAÅyŽ1¯ktŠý,Èþw‘.Êý(ŽÎ‹t˜ ýëBp¯cˆÛõ\lÿyÿׯ^m†e~ž…ó B¦~’F†d?ÍN6¿Ž=çøo!Dendstream +endobj +4293 0 obj << +/Type /Page +/Contents 4294 0 R +/Resources 4292 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4261 0 R +>> endobj +4295 0 obj << +/D [4293 0 R /XYZ 85.039 786.531 null] +>> endobj +490 0 obj << +/D [4293 0 R /XYZ 85.039 277.588 null] +>> endobj +4296 0 obj << +/D [4293 0 R /XYZ 85.039 256.392 null] +>> endobj +4292 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4299 0 obj << +/Length 2418 +/Filter /FlateDecode +>> +stream +xÚÕYKoÛH¾ûWè¶0¢ÙÍgvˆã$ëÄÎÆ^dL´DYÂP¤‡¤Æã?õj²)QÉ‹:°ÕÕUÕ_=º¥füÔ,‹ý 4³4Kü8T³åî,˜=ÀÌ»3% !Y84wgço“h¦ßfv·îù˜ÀM2»[}ö^ÿëÕ‡»7ç‹0 = œ/Ò4ónçÊ{õþâGÞ9Ͼ¿Å¯ö>]]_ÞÌuæ}ºå‰ë7wŸ°óñg¸øH]¦¹º~Ç£ïþsuùfþå7w½àŽj* QìßÎ> f+Pñ§³ÀM6{‚và+cf»³(ý8 +¥_žÝžý»çÅsÑŒWMY)3?ÎÂc3…±c&¥™h–ƱŸD)ÙiUïòm5_Ä:övyÛ ·ÿÁŸç¢EÍÎß*—Ñ"ñu +»…dÌçnS€5²Ä[‰ç|¡¼-4+ÖØöØ¿oj´âS[à„ ¶›zKÊwó²­™ç#Œ6źhšü ž…É|< +îtV€ ™%mZŠ¸»³2!p´É@ÑÙB´\(´¹!ÝÖ5®‰#oÛµØH<^‡ºÅ öþ¾fļ Åñ®d®nV¤24»š¿ùr®So+¶ÅïsQxv´—lÀvédå†ÙãĺFýÊAp2òƒìöØmY{4|Ïl[±øl" ûüPÖ÷92úBJ#uyïe·­+x½æ¯ÈAx+Iý$L -ßÝû˺ZOà&üÅ‘Ðý¨¨ÅÀœà»0†ƒ€–½°*•õqð¢5Œ¸bõÂuu˳eñ{QŽè“ø%¾¤ñ%B1!kcèß7tàŒ9ðBf^è,©'Œ;»C›ï¤ÅÛ,qÅf+xÆñ¼=Xaò–ùÛÍ”gq ½*"X®yÁ3N‚gŸr¯¦ø Ý~Û>Ѹ$1Q\tÈWÌ€s2 +Ð-ªvß”)¸Žò6y'Žn¥-Xž4Å™°hÂŽ¯Òî#E¦h©æ×BÈc(§,ò^U°„²_j¼Otè«~œ»¾ÃÎõÏ0sþßç: Ä[“P(‚Ýux$â†vÆãѱ¨0r!ÆЈßUÍ” +Û:"#!ýÓ¶,yòPPœ5ð܈) "÷_‚8ÈK:«zÿ°±[õT"YWT« %;ÉEEǦàüS“Z5{åÊIwuc#E¼!g˜ÌÆ°‘„/¯û[ËäHSË>í^ÇIQ¤¨û½3»évUȬ•ußÊö¤tÁ°3(Bhïnž…v6ݯ6!eøc+Üæ;¤¸ÏÙˆìþ Ñ”b8§NÖÁ¸ +€þýž{žsaÁ¹M@/%õm)ç9æ¼Ú&;­8ÙiÇ`ŒòÝåøÂmArÑJGIŽ6ßLw¡òµÒß!Ý%¡eÑ(|#ÝUõÿq¶ã„~Iu‘0í•ŒÑl[îH^^S”§y +´1xB%C.Bã9Ê.a’"ï ØD€>šÄžÝtϼ¼¯¾00!Üütù´í6Œ,gG,¯ÖŒ §Á©`äɆӭ»ÒŒ€'ryjbB° mª&†ùQŠÁÅÓÅ&ŽÃÄ,:q©’„ãìý‘«Cÿ1G>ùŽ»W6Ñ L9$$ ,$Åà‹™”B—ŸØØÕ)ùªNpmŠHƒS'öØ؃Y'„WŒ¸ïýe¾omÆÁ~ÅšôA:àT‡SkÊtäü±ò¦îåR»,lY”ü•€Ù‘};Hó4–Wv¿°¯I&í•VÆW9 Æg%à¸,xsO &)÷?XxÛ4Çi–בT&!v;‡íP(àEüɽ<IÞ×+FGöÁMKçÚ¢˜í©zò +#¼‰œbÒ€ +ùàu8s3Xaÿ¨ôt&Ò‰‡b§ònb¿^K±Ó²£"—¡`7öêÜ¡ïøÙ)Ÿº"è£ZQa!äÖØYæ2ºê +¶XÑ; + % ᚪÓO‹è„îzG…ØÏõaq€c®3aâ‚.ã l &;Ùb¢jÛ )®Îe+‡[à‚õ±SIý¶Õ46®$¾/¾,ë(ð#‡òA§ÚOLúë‡ñ’ø/V“.‚ïi:Hý8ûêKá@B/`&•oPÐ5´´Bé¦Lè'¡&!À€‘–Õ˜S·„'„F’zOá{yƒÇüŸ±qkž¹ oªç¡œÊƒÌ´üÊ(? ¾®€CCŒ@Ñk†@ á,ÕNxI¡T#Áh¾ZõoDÐu7t§ë#öT²/2áÏ'â´"0S€êKîÏ‘åH, +{T:¦èK?HÊÿ#ŒáQèŒò>~n%þÌ9¨àóát©GkZ&Jë85 +;Ð?¸“("è^<óìªXç{ôC,µ‰,Ç£K)Œ¡Uðû¡A«q Féž'<ÁZNå½–§‡†ï;$˜Qý=Û9z=L@U²6XNYãÖLdÃN^: úÌaíd‚ÉäŠãk»11Ãtæl×Ùc¸‰5¸Oß±„Ep¯–»|­Ç…û. ÔÛ®ù›óÇÉ7|Þ8xtù„±¦xØö*ɨ“œ¡}yð¦F:eœåøix¬ßuÑ‘ë_ÝÈß?¥ApƇ†Ë +WHr-Á]Þâ!J¥‰D÷¿O„ÿ î‚6K¨‹)¡¯2{ ýç78à­_®ý5D^ò°«”ò0_Mæ3RðñõPa-T”ø™—oçà/t{RzüFÞòØÁ½G){£V!D•4œ9F÷b)ŒN64Ù“ãq +Oðµb‡*tß=”¦üPªœ÷XA稬Š_B4ÜFÆ`¤§X¯&ÿ’À5î É_øF| nñβÙöÅ¡¢GbŠRôžÑFI|ðžC\øsäK8(ÞÞûRO?ª8§žþ×Q'n/hTkP÷¼&t€´~D B=%§g/‚ +‚yœ¸•Ž}“…t¨Ð(øÝc‰6QTißD™-¾FÅú§#ñŠþRí¦UxT»–BLôP¡¸vüñD½Æ~Ä– ÁL–ÿO-öEG” õtÍC¬JÒÈ +ƒò¦æP`ûä±ÄÅ–J1endstream +endobj +4298 0 obj << +/Type /Page +/Contents 4299 0 R +/Resources 4297 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4302 0 R +>> endobj +4300 0 obj << +/D [4298 0 R /XYZ 85.039 786.531 null] +>> endobj +494 0 obj << +/D [4298 0 R /XYZ 85.039 207.58 null] +>> endobj +4301 0 obj << +/D [4298 0 R /XYZ 85.039 184.262 null] +>> endobj +4297 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F11 2898 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4305 0 obj << +/Length 3070 +/Filter /FlateDecode +>> +stream +xÚ¥ZÝ“Û¶¿¿B}£f|4‚_éù±S'Í¥õ]æ\?PubB‘W’òåþûîHP¤ÎÉt<¶`±»¿ýaiµ +àZ¥‘„Ù*Ic? +Õj{¼ +V0òý•‰k¹vdÞÝ_½ý›• +ü,ÈV÷ûAOøQ¯îwŸ½¿ÿãæ_÷ï?­¯Ã0ô@r}$©w·VÞÍOïn°Ûxoyô§;üÕÞÃÇÛï~^ëÔ{¸ãÛ÷÷ØþùÓÜñî5Yæãí÷Üûý/¿{¿þrÿÃÕûûaáÎÖTâ²ÿ{õùK°ÚÁ¸ +ü0KWÏðø*ËVÇ+…~dBiWWwWÿtñ˜Yñ¬%+EaêGi87S9fR:óMfV‰Ñ~šÐN»æ˜—õú:Ò‘wÌ»¾hùùoüS7¸1xɵÂ5d4§j¶yuqÊKÑ-Ìyj‹}ѶÅî΋hZÓñ`U|-ª‰x¡ôÛÊÝáuìëÌ~&¤áãN)õxjÍ Æ{.A¯òÜê9ä(óÿ)¸'矻üˆivNnY°å¾ÿÊ€s=°³ç¾þ=¤)öŠªØ⬾lj»†þÀrÇ|»Ö‰‡Òe V N›*é`×ØB;]˶]+w§MÍâ +¡c=îÇ_ôÂÎë>„dqì¨h”÷Xq×SÞæÇ¢çÝË´F¤|FíE»  ƒ4Zyï^ø-;XeSâZ¹ƒ¶Yvܘ¬™Ì–×ò¾ˆÕÅ‚ƒY;™öÐî¬ZìÑ^³Ç_å‘ýÐÜ©w(Su,ÔòžŸžË +Æ*nlàÕ°ZGs,¸³j¨—Û¬˜š&µlñyC¹—7öCñ¼•e·Ð{ÂEÕla›Ö©ý¡5ïØÐT{»¢Ï˪ãnt줷”ÒÉ q:í±wK^y†`¡R€E«b)Q1" +´+~øä_;Ò„?“è<Óèl‡l[âÎyNÄÑz^.EâÉÚ‡GKäÐl~˜°A[6èŽöηÁb(ÏQ•E^ß”R„ô*V‰¯bÞÕ°Leƒr!bžtœ¹.Ÿž?Gìħ¸ïöž/ú4²O£Rr³A¾8®G{¶"Üìí$Ö‚Ï6AÐx-ªªŠÈè’›ºè»7q)¯÷»Ml°ã'ÀV+G žž ++‘¬žq"™å¥ãQ KnpèÔ„  *¢ª^xï€(ØØ¡ÛÑ>ò Ƽ(tš{j›ãîä¿YÇÕ)aäšAd·gÛ³S ‘Ð_TNøñ‘¥!® ŽZ$¬0â¦Ú™ Ñ¡0’óôŠ<ŸÀ‰v…G•ª @‘žy„܆lÌ2¼Ø¾—·Ì7¿o'üF^Ô<ûBº…ÖÀ~?îûüHËÝäÕt‰µìeû$åü «ÑZùq˜ÀÊ(7þ¶©÷ äÀû‰ŒÈa¾®$³Â:þº øZëhF'þ_Šþ]ZdXßfK‹Ó.³¥à?5qèC^~•z;2F•ŸáîFø3h]°.Lh|°mI?Šù]-„0Ý’ƒà£“ÄôD«â„iXL ¢…t$m¡°ØáÂV °I_ßÊ(sÉNý4azüpàh +µ:çèÕZüLëIâó¸Çþ²ãßÝ@¦$>É:xê<›#Ÿ­BHN)l|ÀÈ¿ƒâ_v²¸6Ä$ꤨÏw× Þ³•ÕW‹”÷~Íi%!žFòr›`†h ,ùÛW=A,#ÎË b¢ÕðC#'Ú»“‹xŒÃ^T#íʆg¢‹îâÆBG›I”™>¨é#mØý;¨A [ë{&Àˆ<Ï’­MŸ©·ézîèì ›Sµ“ÁéÍ„ MæÐûÀ¹#àä!cÊŒ’»bŸ£±*y Þes±œâUdÞ©³ÉXZæ¹9DG-ÝèÁ É£x%Å®¨·‘”ÃñžÜÓçÔ1.W »¶€ü<¥a/…6ÿ:8eÏ9Ÿzs²íš³u]p»]W¼Î¡2—CAƒ C-×1ì™,(5üøLé:K'AÖñ\føô+2NTJ‚dø-‚ ++'{W¬ú±Â\'bhh"l22ÎÓPG¾JôÆ,+LbHJ™›h.ä=ûQ‰> ¾ÙÂÏ¡¤K«%xV•Ì~ñZôDð£Ó䉈½D£Uˆà/Œ;ÂMp$46éˆ*f88rÌ-fàx)¯xf²`˜j^ô%2†lq’ ݈“Í…S>¥]‘cÀщ­üÒÌ‘ßa_üÎÁðÔâÎõ’fMý +æu¨%ŽÝ_+.øî ˜ØÄ|ë†ßó[·a$Ô&ò47éŽÝìx€™µ"Ê ñ×¹‡äÒõ÷ܘ¦ ”u½á+øæ$4†ê¦ç7a¥ á6²cö(´OV{ÿVÿxñpWØ’ ¹‰ñnÜú[8»ã Y# Ó¹m™>Û,Ó6Uuv4âX„:‹J” õEl¹·Lõ˜ÿ^ÚTu:Š#\VY +<ê(š3B®I%nM*=,¾›zÈp¥*ÞÝ,G)3ƒ(@‹ÁÎ’ H©’àªßç-•OžÞ › +ÓP¤+zÑ?d£LÒ€¥¡¨Á¹B\:cÄ·5_: F®ð"ÌÁ-ÅJ¤ú6w°ƒasMÊøðF‘Zâ9Áò—jÁŠ°IܤóšåÖ‰Yë0’ÚÂ4†Q”ì,8•C»óÝ×uÛCÍ ±Ê94±5cãëXOAl‚4F‡p*”/û‚u–diè'jìÈÍ©gÇR䂧Ü^ºµ!¶ÓH¿\>ì‹ñæ®×ð’y‘ mªBÿ¾¯\¬ÓÛ¥ž9f©‰ÑÝRq@y諸VaÌX@Ãá1r qÆ®4€­F6"Òt60„#°Ck`‡Ì'À®§ã…;hYøŠZÎ,b¡F¶s{¿tICãr=Ù$ör´(©Ð…r'þkˆmÑù7{’8mèÚÐs““6z)( +Ž±}ñiÝØ3)¡…z9ÊÂHûQöí(³!ý¯É$’˜½Ä™Ÿ$Êŧ1Yµ„_´*ÏÈv+ÉØf¬‘„F +Ä’¸„&§ÊÄ ‹pM '•]l`UG”u’ð2’-œ]Ÿ•—Iÿ³R1ê@Õ„nÙxî“ë#öB‰Fy¯²`ü®0ýÐq–TÌàŸ?ÌȆ/fL²Q8CìÛL1æ §Ž p¢X)//åãÆxéjH뱨wœeu家”bÆR^’€StXNÒñkv/@XrV$N’ y`8ÊôŸrñH…“£ÏGÒÁ‹›]=°S ,„>8„M,# +r—ã`Ó¤ +B(¼ìAi°\€Hq|~Ü34<4ÕØ¢;x2Ü«Znýóæ–'ZÀ•öl/!4þ2¤ÇŽi›ø@±I j¤ƒJ—øÆ3Þ1¡R6F,u©—' n{ái,WÛèjòÝ.]oy[Så½õšÐ°­q_Ž>úr”Ñ^ñ÷‰Q¸ëÊ •”¡‹>bÀ/PûµðÔÚ17aaÇÜc{Ý´4¸›ªÍ{º´pE¨ŸŽ-ûU0FªQ“c[>6ßèôKK⺀ôïíGªœX;hF’ #&Ö¦‰-Ú®—OR“M:ŸzrÑ•¿Ü!!âÏ>C š"kúÁ(u>¥ ›}‹µ€Å>g亠j¸D£û½8Póc ù£L¤ƒ£»%4Œ}vbw)À‡Á˜õ3¸£-è#øqbìbÐéìÆý¯0óÿ7UäØendstream +endobj +4304 0 obj << +/Type /Page +/Contents 4305 0 R +/Resources 4303 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4302 0 R +/Annots [ 4307 0 R ] +>> endobj +4307 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [310.193 627.598 512.306 639.288] +/Subtype /Link +/A << /S /GoTo /D (browse-force-master) >> +>> endobj +4306 0 obj << +/D [4304 0 R /XYZ 85.039 786.531 null] +>> endobj +498 0 obj << +/D [4304 0 R /XYZ 85.039 463.421 null] +>> endobj +4308 0 obj << +/D [4304 0 R /XYZ 85.039 440.103 null] +>> endobj +4303 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4311 0 obj << +/Length 3233 +/Filter /FlateDecode +>> +stream +xÚ¥]oã6ò=¿ÂèK`­Š"©}Ø\·½ôÐlo“"8ôöA±[XÛÊIrÓüû›/R”-{8,6"‡Cr8œoZÍbø§f¹b]̲<¬V³åî*ž­aäç+% AY87Wßý”š™Š£".fÏ~"Žl‘ÎVÌÿö÷÷¿=|øt½ÐZÏóz‘eùüþZÍßÿzóÁfþþzßdþx{÷ãÇë$Ÿ?ÞóÀ݇‡GìüôÜ|¢.ãÜÞýÌП¿ýñÃõç‡_®>fš†Ú‘R™œsÔž²-“±Že"i´2e”V™R¨hø;œ˜H“†;R9{F~I[#inÚ/kRà 3Ni )S#6 ÚþÚ·i âvÇOz{&á‡yŠfU@7òÀð™è©K`U~Ü8 „– +,m 6Ø%Ce•˜h„† ÆEa%n¸â¶Ÿ7²€0ð4²Sí;€‚õÄ [FEóUÉ~lÃ[áì©|•{’ãþ%í¯vrRØ훕øwlã]¹ª¸×’À­7Û7ì§Ì™?I7Û7F9²UÛ?ÍA¯im\ƒ9ÒÁòŠÇž[± ØÙ¢ADû¸•‰Ãi¨rZ¦j‰\¨)ëÔôþ[¾ÿî€+°'ùدx ï#bLÃ,)—½Ãªv"ƒ,ˆho¸æµfCô!cë΋¡.UÄRÏpûŒ†Åz¯DwJ¦‰‡©ÄnO.‡šOÄÈJàiŒí9-:6áfÌ D¸exwX¯«ÎÙŠcÒÊm'‹Ù/f”7ÝY‰ÜV‚ƒª‰“õzÃʹÿæà@rT ›þèl+F©{þ¾º˜aß1Jµ­ØëÕ)Þ±€9Åyþ$Øyi«çªõq‰ ©j&<”N!€KœI~«º)“œE*OEháÅf 'Q>6OëJìâ‰Á…‚Sñ±dNWKâAÜ·ë˶GE}ùŠÒ:ÿ„­R¼$¶E0%I!\lÅXtŒ‚Ö¥öög‹û­|€¤k+vÖaU…O©)uV æ¡gÜÊ B×{,ì:Ž“‘Zþ<æ-®qwV4Ù=:òA’mÁ¾mÕ5ÞΙ4žßUý -øV¾g¤À'‰Ê/òD±‚ÃðÀ,có³gCÌåÍÍ0¶aDŒ‡C žåj)ŠŽõÍ„™l™°ç­6ˆÑDj~ƒÛ’‹…'z' M%"ä<…íl6™1ºìÁHèØÚCèûýq6â²›äQž¤“éˆÃYHùH‚ùSêW¢<*:ÙOÈ/oÇ(_Ù "›ÛÑnB8çBôc?çmÉ_çí±1 E±Cn½¤ô»d ÈŸ+ãm[N ‚¬ðÄ×æ§I#:¡8ìTˆjq‘Áåâv0h=¸#숗o¾ *oÄ%’{ “d Ÿä«B™XEØÛË"3 ]AÂ&gEæÒvNd.îæD&Ø­Æ|Ô¼'ü,·uåü>ö7å šè!S?–K7Ž8kØÓdævÅJvæÅíIR¶x­1îÇã¬ÙpðBai2D´¥‡Î‡¼ì}È·{é§ä†äÓÄ’‡.9:¤4”Ý mš®ç‰ª‰ÃD[‘œp´…d!¤ô±¢˜8Bèö%J) +Lr„LZC£\N;³xÃöã¬ÍóÔAÓ™†iŽÄõ¤‘N }­Î%|Ç"¿áJB&áõ+µïíÊ(Ü¥n”Þï‹SÔ¡5‚Þ Y.$nEK½¿ÔsYåñöî>{½SwC«ùY‹nŒ‚0F_VÏé¼z:¤‹ýâv¢ž—wõ wx˜dÉ”¥B°‹¬ƒÁ“v=ÉœéD”e˜xàc-¶ù­óµ„@$xˆ/Õ4ç,gn_ÓL‚âTf7œ?Û¡·Æœ³õ!°ËÆY®­xKJGSS“esêí´9)—…c¯5K¶qÎÁzQ4S¢h}n‚Kœ+Ì2MfGQ¼ÉZ2ÎØ<œ/[-'Uí£?XÆsòÛŽ·¿1v¹BÛzÛ†c¥|ë^¾Ž’™ã$~LýNI29¥q:Ï"m¿CHç5Î!]tˆ·»¼›h\¸Û+…—IV£ÏÈ%fÅñ• tç±C^¹zÏqÀ¿‰:åñtm¸ð^®ê6Ãæ—Ë ˜ê‹Co';“ÆËåüOy@ÌÝuºPµ“(¶¦: .87ðÎΤÖ×*aPäSç§Õ ZÈ%ãÐfýAÔ±þfÃß¡ ä9´’40ááÜ€žÓÃí¹6—p…]'ÖåŒIJ~‹×&á:€ÀB­¹Å,0/2CZnüØ2­xœÔ +Ç)%#O Ð0)ÈÖs~z²º¸¿IÃËE­‡ÖçgU{©©Áp}ØtTZªP2m}:L<á@–é$¹ø„àœz‚´ 2òŠçžž¬<=I Í€zLÀÜö֤ܺ> å÷Ä\­ZQ4\Ý9úeÛ‹ô8矠’"ò5§aø“g©=µ4íÆ%ï³äÏ7ñ7Üx’Š4Ì_1>ËåÊÕ4J’Tœ‡ UëôŸ`XþpµqìW•;zmÂN-„’/ÍÓ!¢ZÉlr£yê(Š©Fr^¹¤™;í}¶º¾­} ú/mÃq1y!|^²iNµ’z¿#"[_áljô…zðeÍãÁZùÉsðñq‚)p’®Ðó!„t&v—çä¼r?m@‘ñ·»‡q¡VêG¹‹ ø  +hÉÑAßfÍy#¿ÍÄ^ÛL,\Ó$6_èTB-Jpî·S‡s"yN×RŸu%À9¯ëI’E±Q#]OÝ33Õúše4ÙÜS™@ÍŸËåY5Neê²8Ô8N#cØ ÞaXÝ$6Ÿ˜Žv¥/Ð×^é;^Äç‰f"àô·ª‚ÂI9ÃùmøºP.G•>|DÃx^ý°C‚„ç@ˆÆ£m'ª,ñ¸Œb¼%•O†Jœ +4^+ï{ a­†>£ØÜq†Ö§"µ½-q”§ZªÔ@ íÇî DÌÞr²¼m-Ür!›$R*ÏjúUפQê_1/½ê‘q¹ƒ*êíúÀA7×ÐM¥IqÆ@îÎi—JMç— àœ×.ecˆ{íH»2Ñ®ß;qþ©DIáï6>U;ïhßï÷Ía¿”ÞKy ·×‚9ÿce²(¿ükžå¼*¬ ~ÉQ`¼Í„a»DÂèL/%Óå‚ä"—¢ÈÑ5« %ªøŸî9ÎRÁ£ŸOà6>ˆÂŽ¸ëoGá7@ÙA-kŠ°ÞVíù‘ÛÞ¤Ó9@Cø!_žÈ'C›ǽSG…~Ä" ·üÜ`Õ¤A8?æX5ñ0»â’l«ÜB>æј\­O‘ñ}!¿T‚ý€3—M½–>Ë8v¶ȃ(\ +Z[ºkÿ†ˆhu÷ýäeÓ×BÇ /™<=ðlbYˆhaìý ÀD"Zqç*zŽÖÑæ3w£èllÁ*Lj-üçÿ_¿óÊcrp¬É´òXp¨if1xÜ\lu©®ž ø¿YÇzUendstream +endobj +4310 0 obj << +/Type /Page +/Contents 4311 0 R +/Resources 4309 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4302 0 R +>> endobj +4312 0 obj << +/D [4310 0 R /XYZ 85.039 786.531 null] +>> endobj +502 0 obj << +/D [4310 0 R /XYZ 85.039 766.606 null] +>> endobj +4313 0 obj << +/D [4310 0 R /XYZ 85.039 746.277 null] +>> endobj +4314 0 obj << +/D [4310 0 R /XYZ 85.039 540.254 null] +>> endobj +4315 0 obj << +/D [4310 0 R /XYZ 85.039 513.155 null] +>> endobj +4316 0 obj << +/D [4310 0 R /XYZ 85.039 452.981 null] +>> endobj +4317 0 obj << +/D [4310 0 R /XYZ 85.039 400.906 null] +>> endobj +506 0 obj << +/D [4310 0 R /XYZ 85.039 329.322 null] +>> endobj +4318 0 obj << +/D [4310 0 R /XYZ 85.039 310.45 null] +>> endobj +510 0 obj << +/D [4310 0 R /XYZ 85.039 240.989 null] +>> endobj +4319 0 obj << +/D [4310 0 R /XYZ 85.039 217.671 null] +>> endobj +514 0 obj << +/D [4310 0 R /XYZ 85.039 164.083 null] +>> endobj +4320 0 obj << +/D [4310 0 R /XYZ 85.039 140.765 null] +>> endobj +4309 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4323 0 obj << +/Length 3496 +/Filter /FlateDecode +>> +stream +xÚ¥ZKsÛ8¾ûWè¶tÕ!€Tí!ÞÉd½;ÙØ)×ÖÌh‰–X‘H)Çñ¿ß~¤$Ê{HMe„Gh4úñuÓzÃz–;›b–å©rFÏÛ³x¶‚™gZ(æB2Ñ\Üž½ù-µ3«".f·aŸ"V®Hg·ËߣüóÝçÛ÷_ÎçƘ(ÏçY–G7ç:zwuñ‡mô†g¯nð7‰î.¯ýtžäÑÝ O\¿¿½Ãþ§/ÿæ‹/ÔešËë<úáëå¯ïÏÿ¼ý×ÙûÛÀøèjÚdû¯³ßÿŒgK¸â¿ÎbeŠ|ö íX题mϬ3ÊY#ýÍÙÍÙÂ^ëZ6·EJ\õÜ|®Ñ£ØÂA¨Xò*2 lØ–‰o´z%ãõ7±8Ü€ùzá)yßMÛ-úWúEI•S®téÀã/#K«Åü¶Á;@gQ>õbvÈT¹õbŒ„î¾Ý{©Û†‡Q¹ÚûMµ• K‚S0Ó¯CÅîày%÷ÚÖÁ‘-Õ ¬í’TÅ.{5Ñ;תÀ(?²smUbH6`}±BŽJéâèk/ú–f¬OðK1_¼jCQ•ì¥ó‚añãc‰(À®êN]™ŠÓׯ2ÐLø +¹Š-ŒJ9Þ¶pn?nCÿÞ#@ê§QO¼âÌcÉ| +\L9âã„Ag…*4²ˆõ[ÈÚæaàÛ\¥±§#<§618I3<”@¶† 4 ö\ØG´KÞ&I ‚KÅ~ "ý¢U‚ŽW"ƒtk_“ª6¢ü $`º&Ä›ˆ3¼Ô™zrh +H¸ [È ÏÙ©Å07¼(Aìˆ!˜R,£éKaÜ›¨°ð h¯?žç&úïl ½L¼^šèfï¬Ïȥ㱠)ì¬{òh--Œ1d΂äÂ>õ·yÚ Hʦj=<¥É c)ÞJø¡ô„¶lø—d‹ @½âw3Œ0~ïÇÚ² +x +<3¹¯fcZÒyïKÈ«üÁ~&à  Ox3ÀŠ{Ræ ýÚ°ÛBÛ¾…àPÝ¿0‘¹çîDV FHˆmÞþ8»ž0¨½]ó!cVŠ8$²„5 6r6d +}˜@⿬#$†ë}¶&kHjcÂq¦†}~Zh >ÀßjC2+$”ÀHX{â±çÏxœKNãÄÑ»¾ò¨AX%NÅc3¥{Õ hB<±Ê@*òñ[Ž­Ýäi€Eµ™o†@*RîZžÙ–ßBí¶^—C¥” 8Ï_#?-Ί¾8Ôd2¤©"I+ÁA/6Ÿú±; GÔ>ƒò™š9t5ňƒ*Ê„y¼°DP3Ò‡Ügyñ$NäÇD-?ÂÞa†kLAžŽA3œÃc~uÏÝ’°‹ B>ò݆´ã~ð¾{~©ê†©6¡t¹"”‡º +Ø•!¡miÏGp*IœJ‹ôç\ ì5m6áM®LªÃ‰Ç.xfßÒÕC)Ï’É°ÄäÖÇuë ¹N³,Ï 1Ä'î“ÏsCAÖ8sæÃäœÇ& EXt˜›,”L¯Sþ|9âkP¢¹‹uôŽ€ý ¯’Ž3¯T1(6Ç Ö:JØáêTÃßP{pð´öØØDõÐ$ç±'@܆³8lõÁÄ).ÛqՆΧ/2ÐÐÎ/Ú;Ýg’ÌF ü\Qa„È0|䉻f$Ÿ.÷lÈFÞ a›$FÊçÒŒœË^H¨Ìä]š~Ý,¨~³ / TãLéÓ1E¦Ø‚FióŸ2¿×|´Ù„éıÊöy¢)ÓÁ™€°-)e—©¤re*MÜž¶j-Hƒ Ñ器ŽMxY_À.JÙê4âJ+VÇS£·ÁnÙ3åÑ^xbUí¸AN{_39¦€bÞ G”Z×÷þÈÂŒ 2•JQ)¡äd´â^]mÚ7Zž–añ9'lÙ¸*êr6Â×*^ãGÈsÜéÐ SüåBvâu{õbëAæ)œ Cƒú«ûv„ë¡–H&YÆÆÁÄî‘LÊ=ÛUÛð¬Üâ;²çQR¾f‰VEFa­²?g²Ó5•e¿€€¡àßħÈE׆êÁq]ƒÆÙ_¬XCÔ1»ÖZ–“½ RâQÒ}ø=ðb0–7 B$@‰z;ïáB ”“êB:ÊDwK¦¹ƒ&%&“)8`\•'Ék)øÜÓŒ%ô½Æí-˜ÎØ^€ý¾pÑ6 IvEßžªåTeYçJ;ŸÓo¶øA¶Ÿ*,™!Sá–›1§¯úTÚ„ÖQñ×Ð_ô l\•´™¸+ò%o4*9öLL`ÓŽŒ8ã×FådOœ&œöÿBÂתÈANÁg7 +D°¤W¤ÁÜÛî¤<#`˜ãñ© ZÔö2Èz”ˆ¿]pFýQ¡3|_ƒáMv„-, zôBŠÔÔ}ÐA=d@Z2n¡öÇ«‹¿õêd4¢iü¼O¼ NZñ„¥ºãæó0,ÌC‹1›I}å†~¥J%4ð,ÛmI/ [qÕñæ¾Ìƒ …5§,ÿÕ×a] þñíê/ÂBuÎæ NTU\ &³žwž2ìÿrì˜ãÿ0‰„‡endstream +endobj +4322 0 obj << +/Type /Page +/Contents 4323 0 R +/Resources 4321 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4302 0 R +>> endobj +4324 0 obj << +/D [4322 0 R /XYZ 85.039 786.531 null] +>> endobj +518 0 obj << +/D [4322 0 R /XYZ 85.039 526.057 null] +>> endobj +4325 0 obj << +/D [4322 0 R /XYZ 85.039 504.86 null] +>> endobj +522 0 obj << +/D [4322 0 R /XYZ 85.039 347.155 null] +>> endobj +4326 0 obj << +/D [4322 0 R /XYZ 85.039 317.75 null] +>> endobj +4321 0 obj << +/Font << /F64 3112 0 R /F66 3242 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4330 0 obj << +/Length 3349 +/Filter /FlateDecode +>> +stream +xÚ¥Zmoã6þž_áû´°Ñê…z; lºi›Þm¶·I»(zý Ø²£®l¥’¼¹üû›gfHË–ÜWÈ!9çf>ý³,öü(Ÿ¥YâÅQ0[lÎüÙšF¾9 tÆ…N¹̹º?{óubfïå~>»_9<¹ïÅy2»_þ<ÿêÛ·ßß_<¿ˆ¢hN3Ï/Ò4›ßó·ï¯Þlæodôý¾áüÓÍí»ça6ÿt'·×÷ŸÐÿðñŸ¸úÈ]™ssû@¿ùáæÝõù/÷ß]ß;ÂG ¢dÿvöó/þlIGüîÌ÷¢<›=SÛ÷‚<ŸmÎLy±‰´_ŸÝýÛá’13“US\Š£Ì‹³h̦ °)B/ +ÂYÇ^bRæS±]ž_?Åéï¤õXÖOħ½|ÞSó±D;›ÿëý•4úF¦VËr nôÕŠ¦½È`…%¯:é¼{åIëJ‡—4Jø‚ùüÀP{[õ}š­¢Æ~•®~®êZvz>ÓyÓÒàgj¶5oI|'\`QÎGz®úGªaóŸÇ!ö[×¥€žAzÓ~^m³Ã¡Ak”Îo›^çôE/xúGáÍè +»Ç¦`ô½=Z+àF ÊŸ»!üÓêöÃý·"GØ ™8̲‘A>µ|¢šဖ°J‘µåªl[KÂR‘2<.›Ò:%šåž¾Ÿ˜YK!5ü:õö^–¾k68«ãϽåEÍt ÏVu¶”ÇV{ÆhÈh”‡†xEQÆ8h7æm¹Øµ¸¾ì|‘¾/³y»QÄG~¬jÙØä#È$¯¤=A_§Ó»lBn½ëËVú‹F¶cêÚ‚®Ñöµ[al7:oÌÇ­«®SRmeé¦è+(` XU¿œgqkU¡‡ ûâæþ¼YÑ7ËT›Ã,‡ +a½vT⥷hÚ¶\ô„›»v#îTŠèúÇk‚~Äî?骺*-“Ñ¿ÿêû77ßË짶Q£q¾Þ¦–Ñb…º=´ç¹˜8ÐMIåJÊ­ãµZŒõ®-—z9*ÞÔÜu|IùàÂr–í`¹½SY’kþ:ÊöMŽ³ù[>Ñ‹î48¡“€B;¢»ÔØ6½½a¦U¥w‘£ƒŸ y½;·Š°<%í„a'²'´S_ä5´¦9 +¶Ô˨ØHŒÚ]Ù Ÿ«*ì,¶»}‘åb­ŠåÂ3‡ü +€yN«Ø P´åš$¸™Ÿ¯Ãα3¥qhªP–÷4t qû‘7õÖ¥®èÇç­³¨(„ûÍN'²‰ K}ºø­lRlèéÊ×è¦d¹À&£ìŽ)å›ÇaùXwY +ÂÄß[¶ue9Lf<è˜o´ +ù¨‚ÆùèNe:î-؃¢Òζ€C ü`lË¥Û¸ë Ø&‹6ŸÉ©ñ&Eß—Ìk8¹^'>([€¨?ßNÜß^:‰› +\ÂR¬Ó³u«,„ ©%GÔ´¥tY&‹¡# ÎYN8¢‹å• w2,#÷Ö´vÍIcxcÄþ‘ÑØȯ•mB*ÂXº&w×ã“ÁЫQ‡Ñ_ÝyzÐ5Hã¹ÚvºØ÷ô$ÚêÜKa¤º+_§ÉYåéTo¾Ž†q[dB/Lì±:m<:ÖJ&x$²‘dÜÀñ4óŸ×uÃÇ®»_"qÁÊû'¸ùcó¦"QXvÎ’M,d&ë­Ÿ©‰pq: h¨¥SÕ(øéØÊì×ûHL¯x ìóÝW…I—ºÈ{ðlÄá-Oºñù‘\N³k§.#óBŠ¡ÿð.Lî™Øè¼Ó—‚~‘M'.b˜QØè=ŽRÏ$ñ§Qœs:4•RøœYÅñi4¼È'4ÒâÙÉ– KùÐÀË÷iG¹^‰´#õ’œ M³y³f2'$#çIB6¥XÖ™ÉM +ä³ßè4y`(áoÐæsìÇ€77›hö®!ŠgD Þ‹bI–²a²'^NI’É3/H"¦ú–oè Ëdf#ŠdÔ±@g™LD=;«ý(X@/åóâdUg÷Íš»0¡ÓN`ìœË±S* ë$™ÞRR†'ö°-GÏj®Yvõ¹zß–ƒš*QMìãŽû×Ü÷¯4¼—ˆv+‹þIÌO~aé‚®Ót÷‰=RÉûJ¶XmײüAœu*™³ŽE< -Ô@ÏÌ·Y©®È*/¹7ź^œnáoÇ’fÒÀ‹éÚ÷Rüÿ«´.ÈÓÙ–åMKIrÈðSZú©ÔïÕGLDSú(jjÂÀ3¹È2Iz 1 ,Á+–}/7B*‰°_˜fRN5ÍIÊÞP‚„‰b‡ èèIöûtîçœ.Pß÷2âè¼æˆŽ5‚XÁþ™>cN@ &9Åxd©…ÃO §baÚiŸxlér2LA¢kñN; 8µÁÆF°@áRŒˆ²ö²œƒ±Tq Zz9ÊDô|°Ðe%A¶wƹ«zéàÂòpÌC]™ÏúAcŽht +Ó[Ç'ükXO)výâ¨A ;jlb2½j8•^MËøÐÍÂQNÃ<–ð(7'£ÄxÙŸòÇ~4áÃ<™Ë>Æ +˜œ¹¶ò°èmU-+9Ë*…È¿“­ c.;YZ~q2tô/e7>&bmhß´²íˆTþÄp…!J&4ƒÈ.ÚŠK‰d‚°3¤ö©t9§Zê.õÙ¥E[lÊQ!¦-ËçuˆÙÑ\™Š£x~£äíå’:SYÜTøçÅ0ÏçM½Pˆê e†¯å3ƒ[´¤8<[ÒV.´ JšX å-×Ô=$Ï׺VâºÝz]j’¹<܆;\Ì\·ÅÒFæþty‘IÉe.´Ô¢U‚ T½“ôµºþV&:Qê~bùó"àºÜ×üxo e‰¥+¡à·>È bÍâù+Îö_I‡ëaØ–Ù×å”ÔuÆÙš8—ŸÌiÞÙræy˜Å6]ÏŒMè2Ö#Æ4K~)¢9ÁÁ9< }vCå“Œ2 …?¤ngäphH¨Ù_Ý|¸ÀVUC±Ê (GŠKS‚­q$§çváæµ@$Ñ–‚ÑZA6Ñ—î»[}YIQ3"ê”2tec>K8ú{+èb‹8?rÁ½†ˆaj{)Æì„Á€¹b$:n¯¥a GñQŽåˆÐF¦Ý~¸WÌÎ7RGä”®fÁjLûî¯Vót̺”Ïð^O±wà®´bËßVAÔ±nX¡c«ÁéøA½áÏdä&”:½–2|>ñQ÷ñNd)ìÓØÝ0ÍÆ·K…ß&>ÐÐÞÔRÇiW ê²ê¿£P$ö;Ž¦¸ì"!bµ>\“Í/ä#à +;°¹Æ¤|` ,µ6½Û¨±ÓJ;æز=ϳçè ®nY“föu³\eƒw””Y °Ýù÷üýEpp˜Î4œ¦CFëjÁÏ-ਈ¾¥5zÔKF•ík)ºÃšXjl‡"˜ŒãQ¶Q…c¨«ªc šÍ†Ñl¢Ñl"OšH4Kt7›§ºüïT$»{pÒ9H}ûDYÙ—ªe +6?Ä™I2 ™LƒùûjÑ6]³ÒµHó\Y‘§„î9 䢵Tµ;B,3ì˦ķ€´åSí’ãÂ=Kbˆ#›¦Wéiêîõ8íÖ¾B‹‡’¤Ú‚X*[%EŠï†?}µ¨ž +~¢0”GÌ08ðuËbdÛ†²ñ^×vòU»ÖI6SS°ïw\í°=Š¥/NÜcÎÄð92bWƒ¸2¥Ô4³¡÷?&ÏÌ3Y¬ã&÷T€Öñå°ÖÆáèfzð°€” +J!zô].IeL&,ÁôçÇJbéʦ†Žiî…É¡qR[$ªRQ«¡'ÐP0¨;JÄûvÃ1îRV;‚1¼·ïÔ±n’šò¦+ö:pþ1ˆÇ5T}Øi€‰ývíà-6—"ÐÞùN$f[­ë„úÊñv6ðô‘ Ä3çDÄ9–Go [?¦B.À/UÚRçR¹—êh(û“>ôíj˜j +5ƦåY~”ë#h&Ë„ZWÛƒß䇺‘ª»Z£ESüÈA+¦­ƒ®ÊéZ[{F~Wt\j£aÆ_úÍѾ`—yyN×ëâ0õ’ÔXbÀý,:&Øþ6iLñÿ1ˆ31endstream +endobj +4329 0 obj << +/Type /Page +/Contents 4330 0 R +/Resources 4328 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4302 0 R +>> endobj +4327 0 obj << +/Type /XObject +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/important.pdf) +/PTEX.PageNumber 1 +/Matrix [1 0 0 1 0 0] +/BBox [0 0 31 31] +/Resources << +/ProcSet [ /PDF ] +>> +/Length 557 +/Filter [/FlateDecode] +>> +stream +xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù +ä +6\>RgÈbÏWÖ¹j[†› +WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream +endobj +4331 0 obj << +/D [4329 0 R /XYZ 85.039 786.531 null] +>> endobj +526 0 obj << +/D [4329 0 R /XYZ 85.039 430.791 null] +>> endobj +4332 0 obj << +/D [4329 0 R /XYZ 85.039 412.123 null] +>> endobj +4328 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F11 2898 0 R >> +/XObject << /Im3 4327 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4335 0 obj << +/Length 2899 +/Filter /FlateDecode +>> +stream +xÚ¥koÛÈñ»…ûP +hr—ËGq9@‰Ä×Xq-Œ"ÍZ¢m”¨#©þ÷×’”D»i‹ æîìììì¼gå<øçbãz:Eqèí–ëot+ŸN|Á˜ʤ‡ó~qrú1 F¾ç&^2ZܵtÏ5I8Z¬¾9>O¯ç×ã‰ÖÚÌñ$Šbg>öéåû)‚ç”W/çøUÎÍÅììëXÅÎÍœfç‹œ½þ;Þ_Ó”q.fŸú鋳óñ÷Åï'ç‹–ñÞÕ|­‘í?O¾}÷F+¸âï'ž«“xôcÏõ“d´> ŒvM e^œÌOþÑÒâµ`Ä»†¤dtìšX‹Iy=1ù¾rµ¯F‘1nD$§«*_ƒPÒ±öœêy<1 + ³ñÄy>NªY…×<ýè›=ª¡„0‚ôþåùAV¬Æ“À§¼Ãoè4oÜcÇÄn†²ïC¹iª²`®ÆXÚdÅDÎó{Û¢Àõ@û¼í·º±ÄFÖgÄyƒôžðŠ%Ýóî7D:¹(õHÛ£¯ª²)Á|g |ûN=DÑø ÏŸ¥¸øp5Dc¢#ß áÊí ù©‹ïé€_Ð_˜¸:NdÛ*Gc(Êûm;vpºÁaäÜ䘬J´þ'YN ¯•~CÄYãàá5¯Ï.ãX;%›¬(x”ògž®qã­Lk¶: ÷Á2ã­%›“Ü8ÚÎÅØgœt…ÜT´³®²M·0KƒçÏyG¨ ):°âÕ‰¬ŽwÝ•EÁ—œ'Î=/$5ÁB¡/³Lão÷Ey›âæï à«.›¼Ü0–KB*Xkº¯5oïÂõúÖ]–›»õ‰˜ çó!º œ¿ PŸhåªHÁ×s½8¦½pEØa‰M‰Æïøóë&]g<,e•€_PB•Õõo¼MB8EË)ž²*p@IZ+ýu€Vßø™…¦VáW3øe]V­ê£Ÿî¼ç³Ï5¡=+¯ù¤,·&+ÅÃ,—ÏЈvv>‘EªflA½Œ ‹~h£ÝéAdwâ >ä O‡{–Áž©¼©yp›¯8ã¡jz¢€¿.Q’«öéÌÊÐ4˜&Ý*md‚þ€"ÀIk÷8¹„ñóOf_a&ã÷çø œùyË7 ëüúÀ •ŠÜ$´JyÝÜ}›»§âS0g]€ÿÞR$àpØ!«8v=_À)xí_«ÀIQÊ´ŠÇ1Ç\­­m J¬awc”ÿ$À\ïxùñËN´˜BÃ+·h +N 'ÑÔÆ%<‘c‘°Rï¶[@Å-;ßõHg‚Un‘Š>tˆâxáý ÓÞ +‚Ý +lìÝ€WÅÄ!óß8ð1 ez±lÐ3•ë+_Ê-J…/LÖe´á4CbY1ˆ’*ƒS’vîÒ\F”äá[7iÕ¸âiJ¹¡'†`8ySàšè É΃(}ˆ*Ø×r4ºBP ²$!R„¨ò²æ•;ráijúolªÁÅÝ–×–UYÛ˜ŽÔv·äŠ Oo«6OÕ`¬`d¡¢ïшNEÞ‚é²nä’ÇQ`•5(:G%¾,ái÷–Æ|O"W³ãW8b jJ§ˆÜÊñ…*à8AA´»oh²êè281oaJua=ýغÑæ'J…ûtº2—f üF΃o®T3°yÀ ˆh¤lJ,‘H‰ì¢ïwmU"g¦rÀ6­de\¦Š/<ÐrsV®YîÀµ,1:&Ðè#Ú¬í:WÊ(ž[—±z$´¾e…$ͪå +gm3$uê$`=F¨GXÕcÍ4Y\D½§OÀÅŽ/·¬Ý-ãGnèG¯ö=œ¶9òݸkŽŒ§ÝkpãÂ}8Œ»Ü¯©Ãйζ8C‡È—)yÜå=ßÕyÁ‡<¨:˜Á †,qÐi+æ‰æh̆cñZr~`sŒÚt¿ ¦9>Jî­ÊÝýC/yaWÓ@ò§¬ ¤èÊ"Ïߧ*Û« ªçÙD¾£]ääèÏã8à}ÈVÉ™®à ¤ýNÙJ„‹»éØ°»‘“U۪虱–©½zk‹ƒ8âËÁÞÛN‚­1îÝXbt¶b@*‡ær¦e‚š6• Ɔ1°R°©᫬KœÜH_kIÈ8ÆjèÀ§}ê"‘ÍPC¼‹É\jœ´"¤©ÜÃÁºm`e͈«®ŽÅJDéPîT°SäOöZ4î§Rl)Úm9+â)é†imÓûLN¦è‹°6>¤øwÉ…ò ÅHÞÖ ½ö -´³Ô®dY•tïÖ6¸—Ðc·*I÷sM‘íG¾ê¨ìj`š‡© ¥xs@%9e%:&•¢(Ä8LWjŠª/xý5¬‡ór$ @\Ê7{¡LK(›ã•—Å$:@Š<ß4UžÕ/1&ô^e¬Ãy9‚A±á†ŠøšR‡Þ:pS·œ§ç¨œ¬%äž×¥<Æú( ö<ÅÓ9u<|ÅਟB2¹Ý‘Q“±Ã©«²Ó,¥Ý6N™Às¦dä+–ú’‰‡(%þ¨Ø,JQ ûÖ€°”?E¾éö‡]¢oìÖåî*m†:#ãƾ}¦Ãš(¸@}ÞB ;Óqc`Ø„k»Â¿ó‘D x-äOwuuZ”@ö´N×·éé”æõPÑÄ0´œI…xžëÇ{‚<KHœFÌ0âÃx® +ôOˆ£ÿ.Ò¤6‚é`/j`SVVkž”wCo%>Œ©è=c¼™M/ÏYüóêü ¿‚,_x0=;»>ŸÏÿʳ_¦ŸæÜyûO/Ò[@|Dº<êxË0ŒgYóþâëœqz o¢d G[=àpžGÒ¢ìnÏZC»ïAÇnorÎ%“¡h]NŠ.÷a‰O»‡S|oë²@çk©áÈ>A;o¯Ž­‘+£E¨A¹"f.ôËP¡& +ë’%™´ƒÜ7µip—eÕÖIC·©·6 mìRÒ**[:Á Êîóº©lzQ6ÑÁ4òø4gÌ´²O=ûƒ1©ÁÁ…¤ôB n•:8Ôórö+/;SÉ`](¤õÌÖCÁŒ_R%þH€Ë§ÓòQœ±ÈÙ…Ÿí±*r½„}s9=»œÎ~ñ´xˆï£’XG±Ì!Køaìú®b@^E>iv—î‘YË[YçÝš 6-Ï) WídRožÚ'€î¡ ®Gã^IŠm©ÈåŦ‹û…Is\Œ,¨ùþ²ÿÂà½*»~t9”÷?‰¬GqñP¢÷Qí¯¼^ù¨l9JÜÛúú M¥îk„H–ræ„aï¡S3Àú¯FR[sENÍ^Te&RÞtü€ÒuÂ9+íèƒë «üuŠÌˆ)sÙ–Š#û­¡H1I%o³«:íIõÐçYô)=mÏ…þ¸-Z#ëUšÖH8IŽ}¹.ôý2lòjùÕÃiëÂZÊ°_~ùžr¯mqC*eç3¿BâëÍÕÈWEŸóMóRI˜$ÐPǯ²Ô¡¼\FÐvÏhx¬âÄ[ü¶ÐˆŠ<1çXT3¤fãÅ_uè÷ÜÖ–)?´ ¹ý˜òÌX]a5î5=¶àADòúlåNnvÜö —%;pÞê±É¥Ä@>Á†H,_'³'¶‹MÛ5È3y›©Õš_¿8Šq£VV/>hãü3ô¡¢à?sòýDÝ5PËÅjXÝbt–¼z2lÊ>æøßT7·Ùendstream +endobj +4334 0 obj << +/Type /Page +/Contents 4335 0 R +/Resources 4333 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4302 0 R +>> endobj +4336 0 obj << +/D [4334 0 R /XYZ 85.039 786.531 null] +>> endobj +530 0 obj << +/D [4334 0 R /XYZ 85.039 517.617 null] +>> endobj +4337 0 obj << +/D [4334 0 R /XYZ 85.039 494.3 null] +>> endobj +534 0 obj << +/D [4334 0 R /XYZ 85.039 425.041 null] +>> endobj +4338 0 obj << +/D [4334 0 R /XYZ 85.039 406.169 null] +>> endobj +538 0 obj << +/D [4334 0 R /XYZ 85.039 118.219 null] +>> endobj +4339 0 obj << +/D [4334 0 R /XYZ 85.039 88.815 null] +>> endobj +4333 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F11 2898 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4342 0 obj << +/Length 3180 +/Filter /FlateDecode +>> +stream +xÚ¥ÉrÛFö®¯`r°Ê„ÐÝXU5ËR%Ö2]òT’D€"J   eÿý¼­P$5)»RzyýúíK3jâÁj®g’I‡n`Ôd±>ò&°óþH ÄL@f#˜ÓùÑñ/¡?Qž›xÉd¾ìñ$ž$ádžýá¼ûõíÍüüãtfŒqr:‹¢Ø¹*çíåé[\öcÞ½¼Å¯vî.®Î®§:vînyãê|~‡óë¿óÂéGš2ÌÅÕ{^}ÿéâì|ú×ü·£óyOøˆ5e ’ý÷Ñy“ XüíÈsMOžaì¹*I&ë#?0nà™—G·Gÿéqñž?áSû¤d!f*q¼.É0tC/ì%©aW¹I $•Ò®Qzú‰¤º 8B Ϲ+`ReõÔxÎs 2#ç*ïhŠ`C9Ít¦œG,ª ›¦îp±†©ç,ê²=$3`Æh³ ¹:2»«•ÿÿ¥j‚„,bŸT=Eâzña4tÈ4<èm,3+±Yè+×cÙ“\#½%×È «ÂRLr½›Âª“6JÅôBöL*W³éOþV壡à£111ðF Çk=9«ÜÉÅŒw6BL«xäS*JÁÂȸ‘fŠÏ@w¾Ǹžã@;›6ç•u=Õ(]9²Ð­R´«+YýÓ <¯?¡'YZ€IXpþ¢câ÷ŽøÀèðç-ï­qŒWÍP|¨T…®½‹UQå;fæGÊ €É‘¾_ýha*‰&3<–ü˜EŽm |N>ª‚±f4X¿VTÌ)F48_P…³^£Òº%cá6ï_òô©Aò#Ö‹®å’>|ó2ÇÕE׋oXÉU.Oy€”V#?»<%_:$¹œB¼Ä”Ÿ8*€/ÄpÒ‰ +A6ÓÞO|2&€iédÇ¢ÐZÉ:$rI°A¬5ˆ²ãQT).ZþneÆ'P¥¸šåÉ®œ7YH@“åÍ6-OMOýݲ¼ZälË)™åúgs5[ÃMD&Œöóh4©¸C¤½¶E‘ù,2c£Ñeº"ÜruƒŽRU}:P,EÒ5:^Ê‹–¼»q´k¥™Ù ˆ»ç¢,‘ôÞëZÇa,RvòŒ÷[I½8¿ë°À•Z×­ègí†T™Þ—vû…àÚpý Š Œ øº/¿1Jœ¥Äš¥„̯åG—ð®.‹î_SqôPvå92åGzäV”T"%á„uÈÞˆ™$2du2ü™Leó@Ôu|®Þt?óÈŠñwõhí‰|œ.„ÐÀ§ÃÈ y•ÆC´Á¥+fœ#.TPQQ,”4úyQ1‚¸AêSfë^/r.(£*”·dhí,R›p} +¿)$Œ’¨€€ç–—“¯üµÆ`=•q£Uá/I%?ß“Lj¸˜¶æïnŽ/npì9ÇpptÜÀ¡Ïû”^Ù|ùÓÍBLoK8^á•|7Â\\Ãæ-¯åUzO‡˜¸ ð +;PMÁgØÛ»QäÆš•¶¬ õþˆhÄ;,îÈÂg9á*²Ácv¹Þµš±0q:"2#£\ã-å>êÔFãŠOfžÄN«ö ¬‚©KÞµÑÏÞ‘Ÿo‚ àöV4YÀr!71Õ¸QÏÛDÿ"Š1Gz›Aý"õ³$ ¹«¼b8N°ôá¶Oy¼N‘ÂocÄÅ>%gë‡eÃl;#n¢‡%£Ä¶Lú„˜]…^Ü|½£4L Fí¦„}¶ÙÂl¢…e•5æR˜žpS€Ûy„^[/S +®¡6éžÂ^0x[Ñ»ìÈ÷±šJX“2|—×çfve“·Rƒ^`\PÎ4‘s‹üÆÎ}ÊÀâ.|¬â±t(W9«Ô¯Ex<”ÚÒ`T–R ÚH'›â0ÙW#HV3¢qŠsR´¤EIiîø—07»i4œÕä¨qè$:7è+‰íQÇm.ÓK1w€M›i í„Ç˼‘Å€,ìP½߇¼ÊÎò° AypD1Á œC( d}ÅåkÎÐE!d¶›Ü86ÀѾÛÇÄñNøo°îò žçÉô3¥Ÿ €èƉö<Ã#(4$áa3`·²æf“*˜€ƒ |x³Dp 7 b¤·•“½¸p§ TÈÚ®w­‰ä™Ä,/øbÔc$*S˜¥é2]lCÊA^=ð›MÇç +ù¶«šú±Œ§÷xoÎãæ ÿfQ" é¶cGÜõÞÚ{³t²%äÏ8‰öJ›Áò¯]^qŠnY‰öq‹Dµkñ)îfs^¸±–QÍ_–Á*ý"Yñ§§LN—çUGµ) ^2r[IM*زß]þ®æ>eÜØyO.a½Á=‘—AP[ÉehìÜb1Nþó…2L3’õ‘0£Ç(Á!S£d¨©¤jYЈ(íyêàˆŽ6ªlpÛý†MV´Ç"ÙÈ Ø;Dcñk˜¢ýmMI®éâ‘a¹‘‹m¯£`xðÄ‚•w¿­û[‰jÛO;þÏqŠš6]æm'µ?þR6¸ƒÖCä%r`ƒŠø²´¹ +·ÈUDz==#Á~º=ç9ÖŒW¦ ÍÿÊ•ìÜðãïüúÝõ‡Ÿ<]º±÷úKöæðû+üsãÀßzÕòþz•®s~uý8ddu#év®©[>@¤à~•ÈfÏ” 倫6L5'w[AÂmZDn;B)Íoy½^0¶‡·Rp„ÚØJ3¬>é³m’D~Ǫ̾Â0¬®J*ÎpÖ?uÙ>O§üᇮ@ÆYÝ’½ëkæaÕ÷™íþ{#ÝJôu•K¯*¡Öö½ê©/:¾`ÌÁèÑÉp^êR&¨!œè(v#õÞéÁ|ïk£E5píꂘ«¢ÄÞGQeö­/…l’ï²nÖ£Š(íÛù“Ý—m1 Pr½÷¥_¹±Šù{ÇJ•ñ]e€ðáü+5‰ÄA •HWXhŸˆZl—bü± ´ÝG°%,:H¿»á_*þýÃùWè ¤ÿÃå¯ÔÔÎoO$ I“¹Ã—~Íx@_“##¶Fòd’â܃üÑð7œ…?BþN›:ÍiÛ cƒ[OútvÓ¿ûr†C§²ñÓ@U‹ú䉺.mݻԬDJMÝÚ¥|]w6ÙÐÃZzgìýä”ËÔЅΖ¾ýù¾ìò¦âž`¸Ð— ‘VÃÃç+ …;>)ù$«íFQÒ2—´‘1g‡Ýʃ|’D߯¶á<©ÍìU›!óÇy·8^Õm×îÉéþf§á„<á€Yˆ,Z2Ù7bªƒJGo÷½©b5öf˼5ÆzŒ¡íáˆé)ÊÇRùîiqíˆh‹c’†¯Õ–ˆÍCZTqìú~üÝZ?ì|ˆ~ÝÇÆb0Ø”eû áSŸõô˜¨è‚••]@{|z±Öä/i"¿±RÒ¯ûž–¶‹˜öÁ[¡<2æ~Ó?õ6Rüí2B¹ü„ÃçV¼…«çz1‡¾&Ð\#ÿÍŸç¢jyT®92Óä~AºÅ!®¾ò°D—²%×;‰ÀõÍÞòþ±¼~è|éÛ(’ø@èÈ #߃ÇÁK‚Á)!Þ™=ÿ"—œendstream +endobj +4341 0 obj << +/Type /Page +/Contents 4342 0 R +/Resources 4340 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4346 0 R +>> endobj +4343 0 obj << +/D [4341 0 R /XYZ 85.039 786.531 null] +>> endobj +542 0 obj << +/D [4341 0 R /XYZ 85.039 766.606 null] +>> endobj +4344 0 obj << +/D [4341 0 R /XYZ 85.039 746.277 null] +>> endobj +546 0 obj << +/D [4341 0 R /XYZ 85.039 326.801 null] +>> endobj +4345 0 obj << +/D [4341 0 R /XYZ 85.039 305.808 null] +>> endobj +4340 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R >> +/XObject << /Im2 4150 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4349 0 obj << +/Length 2826 +/Filter /FlateDecode +>> +stream +xÚ¥ÙnÛHòÝ_!ÌËR@D“ìæ5À>ÄqfÖ³Çk‡™y EJ"ÂCKRÖæï·®&[W`a¬î®®®ª®³åÏ<øógIèz*ÅIä†ÊŸ­êo¶•_o|ÁXʹ[ÞÜþé™ï¹©—Ζë‘Nê¹aÍ–ùλ¼}Z¾ÿ4_(¥Àœ/â8qžç¾óöÃÝ[œÖÎ-¯~xÆoà|~x¼ÿ8çó3/<¾_~ÆñÇOÿ䉻O4dœ‡Ç_yö×ßîßÏÿZþvó~92n‰æ+…lÿç濼Y"þvã¹*Mf€=×OÓY}£Cå†Zɸºy¾ù÷H‹×ôŒw]ÒR¨7LÔ¹šTh©É÷WùÁ,Öë%ÔS“ÕÅ|¡Ó}[½Ê íò¢cðïü9”MÏPUoÛ~€Æ¡ó§zEUÖe“ …`¼¬²~`0krpàú¨¨Û_ü#¾Z(Ïõ’˜ØZn ¾£n @ßYí«u^ö?3¡#(ý°€È -à©Ø,Ôw¸g¥¶EçIèü„¤~BX;Ý(=c Û¼Š0(´|E[“q] ÛARŠìÜ÷D+ç^ý+éÈù½¸ü//àÍ’ÏÀPÔrtËßVj\ÙPõºh0I?)ÙG«LI`s– +A®)´©Ã<»/èLÀ ,ig\ÂI‘c âÈÉxܨXá®mF.Ø×LptT€dÖŒÅûÈô«Ò +q>öy ¾Z„—âŠúž©eü©JŒ`¡JGf`ÐÚ–¡Ý“O{G†Z6| Ž…‡_ÞÀK‰ë}» 6À‹\®ÑZÜpÀø¤¢„"cˆÐ{™$p Æy3âP°êŒ•C6PÈä°ÍdOÖ p|Í0:~åˆi–x!I×þéùJ0ˆ¡!ƒùZ"…BâÉùm+«»R®€fú1z¿–¢{^ÀŠZåuU÷´ e¶¤y¤£­ð3¢›[HÐQ• àr‹ã½è +°Ka2§ Xpö¸|ÍM ¸rlÙ¬ª=™/ŽÃs}k•â]+Åm ÷æoB‚ itݱÕV|H6{-ãu…ß¼edEÇù®œ¬ÿÒcå†DTŠ¬ öºo» Û¿´/ q¼“ŒýÕpK{“ Ñ~qqO„Á¬ÀâñÃÃ=”xrïÚmjCú€$ŽM܈¡b» œÜf½a‚®O8qG»_ª¢†3V\.­)rDµµRÏYL¾d¼uCGox¼D‘d\ðÂÀΪl“Zík#vê ”Qfª*¬}(¬)^擬8­œÀó8¸l€Ä‰~Á¨$OL¶ñŒb,ö_¡wNŒ‚'®¡zc’6‘Ä-îœn®"äÖ€C•Æ…ˆÃ +bPŸ;Åp‡Ô>¢øiìp~0†3K\÷ôn|šCYæòÚgë&hbÅÖ³›=ó“ÃX +¥™36Y ‚j_s$ÔR°¬ºNg½XU&¢Qì¢Ð +9«¯ùXW°‰á­íÙÌ „Þží9û¸Dǹý×=òöéöíý3©K@\1Q +|©ŸKB,ëãq¶*Œšr^'Bí5ù°Šô=çÎŒ7d;”èö +Ôùøq‰@h'@ž(׌Á-ÎŒAb š<µÆA4†Ä?Ž´<ÇÔør¥,ÇïÃÓÊòœ´Cõ6æ†|ôêÓº›8…ùU;ðêž óŠÞÚ­ ±M3çª;6ÿ$85˜Y¾c£Góâ)2RØ]4’%ržg¯‚* a"ãôêBÞÊÆs#ºœc\¶“†7[ê`e’±%ë^\óêzŒ‰9å†0âÌ‚Õgh“5NŽ„{Û…‚?|ƒ¹6µ¦ñ DD;è™*‘ à×Ø×}üëNÀë1ÖRLýœß?ä²ÑøU ¿äþ \ôņ~,yoU•2–d•)”:/Tª8ˆyz<‘ºV +™c¸@~Ëf-ý¤øDšJ nI9Ã&`* Žô˱üh j8[„ÜŠYøâdÊ DÊkd!Yœ-03å0äarX‘°£4¿lì¥{¾Öà©0qÓïtxÎØâùnŠÎ05IJÇ.ÀV‹ç;>Ö£!WèÜܯ!çîöúýn‡iÔ¡ž®Kþhì6 ¡Cqr…w­¡?O¾Íû„s½ÁSAä†>¿ÒXQÎ:[•U9ð+VÀšD© s‡ó³¯TnH¡”½)†wl[m7¹ìã‚>žPdÙÔ.Kô +ͯ œYxíòÇY«3–±10±#‹&::NHí8¡ëü‰!µŸúúåÚÓBèƒò Sse,ÃQÛ:ÆC©øB [ ;‚PM5¦<ÿ“'ý¤ŽSH½©íeÝ +I,×èc÷4ÍÓ¦kézŒçåRêš® ›LCh–WRÐSï—ò¶æh0I²iqÚ±*5ûW^ðnõròï†ÍNöqöÄ _V’¯&d[Û˜ÌIÛ(aÕ·­ÄóhÐË—[0ªXœ­3yìxlu]\zÈ<+ÞQ–’‘Þ~G œ’¦ŸSzÉšþÛωt•Ô±©ÈZµö¸\•ãKfÏ3kb´–åsƒBgÂ0ö$³Ðâ0†®ÖòÆŒç&–ãa™>ëÕ­‚6Ÿ4¹—»V 5P&> iÙOoÕ8"e+MÁÉ´j°ÈM)Ú­Õ¡ Zø×ñQÍ>–ý:™^p–ʃ§‹¯¼±ÎŒ'À]¼FKüÖ1S(eŸõ°ƒ}dºFMíÈYœ’Z¿­OÊ-î?³aÊ©1=®Ðð¤¡/€E´¿½¤Ï«:ƒçâ’œŒp¥¨D½TT^u»Ç–Œ1R–áÂ@Á\ý–BN•ó …Èœ4ðì3·[ØÖf~÷8Tm'}`¶Òå%©ÍÃÍãRyNì ÍîrõiËG™ñ¸R¶ªÐ\Z[Ÿ"É~<ѦŠ¼Ø0µUÆu1UQŒjâˆßZ_ùí5{½¼u5ÿÐzZ!Â?ëäÿúv¬35”ÈIp¹Ì ƒØ »fð’è”aócí9ÇÿTuÜendstream +endobj +4348 0 obj << +/Type /Page +/Contents 4349 0 R +/Resources 4347 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4346 0 R +>> endobj +4350 0 obj << +/D [4348 0 R /XYZ 85.039 786.531 null] +>> endobj +550 0 obj << +/D [4348 0 R /XYZ 85.039 607.39 null] +>> endobj +4351 0 obj << +/D [4348 0 R /XYZ 85.039 576.773 null] +>> endobj +554 0 obj << +/D [4348 0 R /XYZ 85.039 358.939 null] +>> endobj +4352 0 obj << +/D [4348 0 R /XYZ 85.039 337.742 null] +>> endobj +4347 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4355 0 obj << +/Length 3730 +/Filter /FlateDecode +>> +stream +xÚ¥koÛFò»…PD4w—Ïû–Wsn'»çm?P-¡H…¤âúßß¼vIITP\ÄÜÇìîì¼gVjÀ?5K#?0Ù,Ic?2j¶Ú]³ ̼¿R±ÅæõýÕõOq8SŸÙìþÑí“~”ųûõïÞ›¿útÿîó|aŒñr¾H’Ô»›+ïՇׯp8ô®yöÃ~µ÷psûöã\§ÞÃOܾ»ÀþÇÏ¿ðÀëÏÔe˜›Û÷<úþ×›·ïæÞÿ|õîÞ!>ºš2ÑþzõûŸÁl Wüù*ðM–Ξ ø*Ëf»«02~éWWwWÿq{ñ\8ãUST +uìë`ôß8ÎD‘jê¸`¶PQèk\܇V°·,øñ> ¥´o”ž-b¥ü,˜—èŽD2O©Ä3=Kà–A”÷n`T?_(¯8%¬ +|aÏÙ×™òƒ0Ë ÃŒÚtáb4p}³S³· `:;B–÷]Œ6&dU:’4Å~&³D§¾ +#»CD—ó…N¼5üÍ´·Â‘îPs'S¸Ë0ÙÔ*ܦ-dUÞá×ÀBø(ïánnïx²+°Ûü7×z àÑÊ;ô¼¶dÂQ³ã•uÓK£ £‹ÿv9ŠqûŒô%–£Œet¡¾x“xÝžîDÇ­JÄ×Ý«ªž/Ð1£¨–ï–xóàû<‡}º,ƒ=ð½`Š·ßŠt4TšÔ'ÊzÝ ŽO¯¹½_N`{G‹amy ž#íWpÚú[^ǯ½æq‚g +R_Ap¾F ·Æ¼Ä¾ãe˜ÄÞÊòÙA»Ê)9ÑåÛg¼Qà Å#c +½›'œß•Ù#°{{¸_3ªw.#H4X3ˆãϵˆ0+êoeÛÔ»¢q #Qüx:~×rÍ÷ÄùWm!S·„xä{¢û‘h}ñ ÓÀ+{†ByÄu-‹a³#½)êõ˜t×oóþ2åàat$vØï·siÇÞ‡Ò²¼mºæ‘˜ÚÐ'|‘èa8I3v\ßãŸeY•}ÉŠƒb +®ä†%÷Íy‰%í¢©«)µ)ˆ(|.ù6ØlYÛâØÂÝ0—Ž¡2Þ¯ªÆ̈¼^ó,!CC2=¡AxE1bŠn^mFî£*ã÷H•q`$øl 'oàŸð0Q~ÖtäþAG¦²d¶pÎñÿw|Ç+JÍࢱÐ0Q³(K@w8ܸŸ§@j μ ‘ çÎIÁfŒ¬n‰LØ ­²³#:#tûƒƒ¸C§.œâC¯§-i‹ö bˆ@;\âü1Ó‘C^½Œ‚ÚSYU²Òj`aOÌH´Õ- ÎBÈ0F¿ý²iI,Ði¤0°ïK´ ؆KÃâëŸÌ˜ŒYæë‚Ú£Û-}°¥ wDî0õ³88rMi†vO퉺=¡Ý óžHF‰˜ÇHÝå;œ1ÇEË‘‹kvôíxFöÛÊÆÍ£/d0‰¯c}¢FÌ4Š ˜Íªk¸µE6Ь$h™€{gŽZØ~lÚ#p¶+#¼qЪ'žX|/ç5à’Œsq°cÙ3xõxrnØ:'«<‘Î3N³‡ 5àÅÖŠLËc´)½tÂÔcÐÄÞ -­ØþkrKpü쬕Óbû¥eádGn1lÚÑS¶@²Òýæ«Ü4:/&ìßž¬; SªûxàRw†Ghbí§Éq@pKäÔI0­Ø)‘š¼×¢l³Ú€‚ÁÈYaCó%®ÒÞàê£iîО¤0‡Š“ܸëIìÀù}Ï—•E¸‘/nölo|iŸ8àKÁQï(-¡ìžI:®\…Ú#Küz*L’CܽûüßwŸ'XcR?Hí>$/¡D€²À|3$9Jì†@oËž…uXÜ¥L„bB +°ø°‰ÌÉ,Pë²ÛW9“qg¶È\W¨*;hRt`r§$V(ÖsÇé‰Tks1ÜöæeÅú‹+$ïçÄð(ÿ4ÊY`E·6b)ë=÷¶ù"Èk(¡½©še^1äæP ö$sŹ²‹cú‹’Ö¹´#2ÀGl àÔŒ! -mÀLlŒ–10Þgv …œŽzTKÐÖ@âÖé@û!>ÁÀ›y@j\¸9SÌ:a^jÍvPÄQx´å ¯qºœ*¨¬mÖ‹VŽóУº;W ¶Hªj±¦p8e6 9x;˜Úq¤(òxʴЦÆLMë6KÙ9× ÜqIgãø\³Ç—ÁÚÆåTûz’dl‘JÔ’Ö€/ÏÛyŒÐ?‚(° mQÚZêVò‰œC$iX—ÃÅ[®¨_ÛÜ âHÒN ¥.ƒ‚ŽäYÎ; KÞ%æ*Àÿ’¨BQ³®`‹¬!*@ÄËï”÷LM'tWx(£q¨é6‚6Ð8ý):Ù¬÷îÚ(WعùôFx1¶Ã:LüLÛè÷Çin%FÙðxË4‡w‘š„ +u¡ °Å¤ìŠ—HŒˆ¢ ÿ0ÇÊFG)XÃ#»Å|ïXÕ¨¸÷i–«ñiˆ¸W[ñö,öxΪg£qÙñ{‡pxêëë7X³úéŽáV$»TìÃ.„Ì6ìJJ…Ëí°CÎì\ÙpÇ|Il¬¨Êª{Žu"Øl¬è ¤‹[¤’ÌÕ¦˜í|¿ +Üêùä€ LÔ¡º’Â3_©l‚‡a¤åëΖºÂ +Ë~“‹UH1”åÂLôÐæØ÷7DÜTâ l±]N)ö¡>e¹Cö‰†È6E‰h/ò%`¾¤ÞíÇ{ž³Ú)ÛÏ]Çž°$ì0šã~Wp³å.+q‡•èAwæâQO3œs ¾'N@‚p\ 0\J…+àâÉi^FÃNs‘c‹ #DÌCœÇ2q¥=¯mòµÍ|óN`hhí"éŽÜ ºeÀ%õ»œ¾ðl%nì¢ÙZ¯é¹¦ÃL±¹ø‘§¶á°íX'q#?›â"žJ¸‡uBÎiýà*Òç£7š$0Úã©"éÀy˜¨!ûŒ³äo¤ï‘Ÿ*kèȆNçÅh’D7/Á\NÚÑ´F‘>JÚ$í¯!g‚(b.«sÎÜóUÛ Ï°Ý–µM“.à +—’çÊ˸0—sx­c@Ÿ w„ÓJ’Y6=Ðh‹ªÈ]è6?•ÿpXá=ÁÞ$ä+óm®à(…‚žÀ“€wÜvÅ´½¥ÚžDHÒRÁcOœÅ~¯£s#}Zˆ¦B@<ÎPñppU,€í]Yœ–Ñõ<ÄÑ!øã5…i£÷“‚…˜sÉOáØtÅE<\êÞ|:wZ9 +6åÌ­Å÷°Uo·`ÑEÞcÁäÀÒj;å«{Î¥KQ&ŠY°^Êé\1Nê™Ë}ÏUÑ ‡5ˆöÀØÄ àƒ¦èÃ't7zdâìTz®yàþ ±¯o>`NJ®²Ê¹wˬcá +LÌèîó–Î +JgÐŒÀBu—jÃöI,1ù éísÒdhM˜j¥">D¡*&!±*’Æ£àÀFÁybßJ¥#¡06- +Îå¸c4"Øà·g“D'9<Ú¤D“k;—^ÆVøF•w2W–úaœÓ—?oíJW™†ÁÛ¢}óQ&¸HÅh ºUÅc_‹x =Drôâæóó€”}Âq˜y³àû~ ]‰ uW墤¡¼…£Z ®™ŽIGFÒIºëÞ¶øÑ—®Ë¡ÚßóÌ×Ã0(»žŒh˜2ÀÀò FIŽòœŸl‚XʾŸê"‹uBâ ö°£_aÀà¯o?1О½1U?ñàžçéQ‹¦T¦’\ÀŒ2 OQ)L‡zÜáan̦G¯¤¶ÜÙòÚÉ1>Ŧ`ð(ÜÂ…­øžfª´O•2£èéÊhÅG"4ÑQegFFžS˜(OÚ£GŠ¯ƒÁTStr¨(¡Ö…”P”Dâ1RóÒJÞL¾qTFYÍ·T•êl.m…OŸr3:Éõ“tÀ‘Úh ŽlKÇ3-–à±åB.hcZñìÄ,Õ©r\%»0„ Ú†ØÝØÒ$<ËS`š³ÄF· Tšs†adãL7Ò.µ…yhÑ›NÏ4¹ëÂ}%: +ß!Òm*@«l¸µã‹x×”uN¥ß¹¬a‡rõ‚}èO9{ƒ~K•©qFஞò0ù맗ž•Lä‡üÓºÓ þó‘ÿègw.tÄèTOGŽ‘Nü8 -2xÇ49E82)ýœàãÿïÞeendstream +endobj +4354 0 obj << +/Type /Page +/Contents 4355 0 R +/Resources 4353 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4346 0 R +>> endobj +4356 0 obj << +/D [4354 0 R /XYZ 85.039 786.531 null] +>> endobj +558 0 obj << +/D [4354 0 R /XYZ 85.039 512.424 null] +>> endobj +4357 0 obj << +/D [4354 0 R /XYZ 85.039 493.552 null] +>> endobj +562 0 obj << +/D [4354 0 R /XYZ 85.039 258.772 null] +>> endobj +4358 0 obj << +/D [4354 0 R /XYZ 85.039 238.182 null] +>> endobj +4353 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R /F66 3242 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4361 0 obj << +/Length 3268 +/Filter /FlateDecode +>> +stream +xÚ­ZYoÛH~÷¯Ð[(̈a_ds_qœd< +YÛ‹<Ì ´¬ØD$Ñ+Q1Ìߺšl‰T6˜l‚„}VWWWu´Ô$ƒ¿jâ]š™rRøܾ¹žÎŒ1 ŒœÎŠÂ'7S•¼º:…Í6yɽW7øÕÉÇËùÅû©öÉÇ¹ýˆõ÷×ÿà†ókªò˜Ëù;n}÷¯Ë‹7Ó?n={sÛ1mMƒlÿçì·?²É=lñ׳,5¥ŸùÔla£¥nhop÷Ï;So áûªE˜ÕPߎ›©¼‡Ö;K”[éjþ>ãÊÍö3ÖtBdší6Œ^´«¯So/Õjųְ Ì{œ"KZ††ð&IW?€KìŸßгƒÝíø…˜¡tòPsuÃU:RB T¹Ã_y@ÅMÐÿËk$÷Ûwa“‘ªU°\ h”LOjCÀ¯¸›yó{¦,jÐ)TmÝ[¿g.û„š$Ôà(J' mîG¶Êgŧ“[g=e Ì]‘~NJÁo_xIò†òRî§ÃÐÖj™™T‚„ 3æË–”£×ß\~Ù¶|7¨ÛQ<£Û”Š*¹uŠÍœïâý9Ú^½c¼Â­lsp 0îå[_p«SëL¦ó_ߥ‹fó‰Ç-S묌ÃSX…ë–žÀ±q H ¢£1„=:‹±Gép’:Í c4ô)¬lRø ‡™üBŠ15 +¤ +)ðþÁ¹'K:Át0mz¨&dZ½›%ºpÃ1L!‹m¸ÊuXæZ÷ôgBä‘=Á%·ÞRWoÚ“AÆSEÞ{YŠY¯îծݱ³5ËM™Ü œóðÖà‡­(Ä=ØHŽ3Œ©[‰Ú`1ôÃ-äÐpÈ,ËMk²( ”Û*¶Š2µ5oeÌ¡ÍÒÃzà<‹e·Që’WlšöhûpBp‡qpl\“iD±Cmè¤Tüݬp*4÷X84^,,–ƒó£’ȘaÛ˜e''ë>*Æ +YpŸõ!›WìÉUk©I<ÝŸ@ÓÄtyVd¨q8 $Ø·[“§U/j +&¾¾Ø MqšB²Ï“«£ƒÂ¡suìÁZ]¤y¡&Fg©÷ß‘}0u㹇Y 5‹ˆ }] ÷»´¶[‘î9³×ˆÄjc‡&%2%Ÿ–.QðBÛõ°6#%¶V% ë¯øùØuU‘dÉÖ`ý¼ó5{gA"<êÇs©ûhV@PPOŇó¬1ç€Íj¾57Àò]ì­K¹ãÌHpÙåì‘”ÄoG\  7rð|õãƒ×%úñÁk¡FQLtiÒ‚C±¿|ðÖ,"6 +•á­§iá†wQ°ðÜ+#ÏvÄI ðud¥)Ù`¾€ $€¡>­ÚÁE÷–n/÷qÈyÒØCn ®Ð‡IË'A¼ã•š­Œ%EË‹ðä ÃØ+iCOÕöc†›?Ô6Lž*IÍêøÄ:õ±’ÀU±K[/B¨aa¡Û{e: Òc¡U’Õí²«¤ü÷²ZxײºÇy;`arÈñ¨ía8„͇1 ñç“·˜ÑmÆ4¡ \kÐ48¢ðÌh â(¶¿¨öÄIó ”¬Ûª­"ºüÒÎF®äq?T5×ɦZóëŸfË•‡”ÍbY>âÀˆ/¨—Ç /Wc‚ ©4i{¹\\Ç¿‡XTûp$ô‡SðôìE?KŒdð'ó£îÓ;>HÜ¥W_ŒHl'óÙXoåÐRIj`/K=G¯Ä![œÕŠšAÆÌGüéܸÔòžŽ_Îá‹ç‡~Õ½¿[Ÿ–^Ÿ;)qi3xÞbaùáÔãÿD*¸endstream +endobj +4360 0 obj << +/Type /Page +/Contents 4361 0 R +/Resources 4359 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4346 0 R +>> endobj +4362 0 obj << +/D [4360 0 R /XYZ 85.039 786.531 null] +>> endobj +566 0 obj << +/D [4360 0 R /XYZ 85.039 686.185 null] +>> endobj +4363 0 obj << +/D [4360 0 R /XYZ 85.039 663.47 null] +>> endobj +4359 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4366 0 obj << +/Length 4128 +/Filter /FlateDecode +>> +stream +xÚÝ\msÛ¸þî_¡o•;'ñÆ—›Ngì8Msmœôâ›|¸ÞÚbbMd)‘äËå~}w± ”H(±ÑN¦“™ˆÀåƒÅîbÉ}L1É៘T&ËU=)«"3JLnîNòÉ;èyv"xÄŒ‡Ì‚1çW'ßÿ­Ð‘gu^O®Þz9už™º˜\Í™>ùûÙ««§?ΔRSy:+ËjúúTLÏ^œŸa³ž~O½/^㯜¾y~yñòTVÓ7¯©ãòéÕ<ùÓ?¨áü'{Jcž_>£Ög??¿xzúëÕ'O¯<ð`jB)„ýñä—_óɦøãIž©ºš|‚ã<u=¹;ÑFeF+>_ž¼>ù——E}zBW iɨ*3•:T“0š„™rR“º´zºÞ€JÖ8£O§31ݶ§3YÓ嚷زÛb‹™Þ68è7üǬðÊõ^Ãt´xÅŠšæнش7»ågj°âÚ–»g$dw ÃÚðÖ×p³ÞÌùæ͆;ošå²SãŸ,€Õ¬¹ßÁÁíz³Àßf·p ÅôOÐáÒ8-̪²¶S?Ãa€_U‚`,¶tòÁNf*XíiéøzC:£9Q[_g¶eH§ë÷tÚpóÛõrIZ/­lûwnò¾.ì›ÖݛÌÂ]µ|ñgIJ¾§“Ot²œÛyÏ&¾mjÐâb…¿ÚË°¶cåÀìÈ:°{óž¯ÚÅ»[l¹¦ nní|¬Úìÿs·xÛnO–<ð½]&7’a,vt÷5Ÿ7ôó¡ÙìP½7A.›ƒâ𕾠Ž%„;«†¼§€-è\d#Ž[Ôufä¡ß–uÉ~«öüVø-Þ4«k9ä²BiˆUxlfÊ"±ÿë\Š:+T9™UÕÎ:¹)'w£Ü œïÕi]L›ë¥7VN}/D˜"ÓE ÷ÃË~Ø׬dV–j8DÉcPöî³/ ow¾ïS¢·÷×è…íŽB­µÇß›»ËS?Dì£Ô¹ÊêÊ ¡<@«¤Î4ÄÏ<+Ê26ÒdÚè‰*!]fµè¯ç9âÓù¾ +f£d|,ë¾Jg*ïûÁ“QýiLx,*ŽÎÈ<«´ê¡»øŽ^0g@a±HUgº–‰,²±H„¸žŽn)<8ñV‘4k‘°TñBûÔ;´SÈÑÂËM‘´D@ú}"@y)G÷ •fŸè„Eö‰×ùè>‘@[Ý6Ñ–ß%¢Úò>™@[OÆ´å}2À…»„}ûsˆOç™iVÓÉ:‚O+ÐiÕ_Íq|¥ÌD™H,ë¾”îûê“Q|&×<ø%ÁçdÅñ°cúø.Fcnoè…ÜúÛ +¹¨ %ã1üÁÔå`ÌU£1·œ"èÆ`ú¨à¼T£Q—G¥‰º°HÔ p]ŒFÝúêÂnL_>îFõåãn}uq7¦/w\>îªÑ¸›Ÿ»Q|.îøÎÇñ¹¸›Ÿ»Q|.îøžŒâóq7¾.îÆðù¸ówSøCâÀKoÞoâ+&w‡ (ç^F´($,„E•ð¬X‘ó®wø2,7ÓÝmƒ/Es=¥_Ô0àÄÕ0V§²žò€f¹¤+¨šsIf/〆ë0*/¸`ð_¿mš]‹†&r|‹nGöKÔæ`p©aÅ2o6ëí–d6ÙçÑ"Åú-™³¯ºàÛà!¸£õKWÖ‚h3moî,: ȇäPÌNgEi¦g[ºl˵Šu7Ü|˜Û(aày^NŒ'ÓêqÏ“NÖ,6ÛE îcü)Ó·ðnùE)S…† jw-5ZÀ q-æ¦YÒùŽk¶ø~Õžû:—°¡Õ’y‘U£ecÝFçuWÜÙ’€·Xba ý\`Ý«>xÕ]÷Zמ÷Ëkܸ[óê}^Ý`ïífË·øƒ'…5ŸÝv7¿>¶se÷ Å¶âi¯ºµË®¦Ï٠澜E帰†dì|½³ipñ^Ÿñ¸š~„öûvóyØÞQ©Þ<¿|MGN¡bÚU+7Ô…¥ÀÓAË1ûxq¡¬ÔãlŒeÍa6–›¬TÚßÑÆq,›R¿¸áŸ¿¢ß•8ß´[Ò µÑ ÝbÉœ:>-@¡,Ǻ$…H_´”}¯nwç(äùKÖ$ê¹±† +áëõðóŒªõ?¿â:—C«Ñ™®ºþ2P « 0Ü/·DÀ†S9 ="ùE>½ºå1b]yÔ¶xÙp³¯¿ëêÉíÆ)*45Vy=½Xß¡+‘Î*|ýØ×Yè^S]Ñ¿ìÛ¶£å ¼ì†ýYˆj¢ë"+hW|x:Ͳf°tZävuƒlzCf‡0¿u{DKä_xÄ‘ƒœ‹§gëïnáÒüªßµØ¹[ÈÊ7^ûÂ6\°³ +›{bÁ ñ²§î—+W©ÆõÑC®,Š" è´R6ŒN¬Y l ™(ê¬RÂßÑmï=–X}¼Ä², !{>÷ö¸åNÜ™±ÏíÌØÆhÛ{Á\çƒÖ†ívË@9írÉ¢í¢2ät4í0Z®ÌvÏѽ!oëç+–¡µŸ8àLlLèÖ:œ·7x‹å~¾9D$GmÈé߯úTª™6Ì—¹Çe1Ú@¨¸Á{Uw_8ž»ÙE/#SEy‘ÙÆŽ3ÕºØøš–%¡pt&Þ«¢Ÿ­¬ïc.¼¢kïXIüØؼ¿g©‡³¾\U¤1²¥v~¿ô¡{k›Â˜› øÐ`½qµø£Ù-l’ 26íÇûv»£±6éÃ_ž½ž¨$LjJ(LjJ¥8NRÂMRŠoêݳ‚gTUŠè»g…)9'&_JR +ä&xõEé^=‡0LRJ‚Û¿Žâv¯€CÜ1’Rh‰+Ï:‡Gš/®Ìðè1SÌëLI7E¯¿Š¤~8ÊÎc0½-8ÇIJnT’2H l¼ â%)%ÑWç1}yˆêË•.RèË—A¢úre×q’R|Ž¤ÇÇ$¥ßq’R|Ž¤ÇÇ$¥ž½#)¥€çHJQtŽ¤¢{IIIHòTÈ";a‹äA–¤y5̈(­W&ȲŽ„í Õß¾¶ú3¾B ²cÔL6u²â@m Lô€ž@É +`õkÌ­C+¥Å(•Ì¼¬ˆ Ð÷òÍ«x„|[x…N€’EÅQBš+¤Q^x”£ÉMŠ=çNndQZëhr#ë:ÓZ~¯.œ ¹‰ÂtÉMˆsœYçF%InaãÉMˆk”Y—D_>¹‰êË%7q}9ÏO¡/E¢úra$Äå“9–Ü$Áç’›8>Nnzëé’9–Ü$Áç’›8>NnB|OFõÇI +x.¹‰¢sÉMˆîaÉ„àUÕ*‘EvÂ"Ƀ’#ª! D)ÒeYG€Tªî=?“¼2I€:Yq ˜ä(Sõ€>Êr*]|©9”2S©È¿°ˆ9ð ~ +ás@¿,ÒeYG€â½²î}Ê,hº“dú/üIóVQ¢öTü­¢4È.¾ŽÑNðZ1 +Óg;ÎqF«•&Ûé„E²×(£5‰¾ºl'¦/ŸíDõåƒI}uÁ$¦/L\Ç­Ið9Fk3ZC|Ç­Ið9Fk3ZC|Ç­)ðyFkŸc´FýÁÇÝþ8îþ¯­R£¢Ž0Z¥Ô`ü·]¾ÀÎuP&(i¹ÐÐ=ÖSµig»·ÔîxȆ«1Ý'Bì*6‹]³[¤;;¦¹#’ZvH½ðß) +*A[zœ| ZíÂó9 +3½ßÒ »ûÆ’bßQ?•ôMw±¡–Ñom`ß—|k£à/fãœ^ènÍw•túiAô‡ãŸ )òŽ*ajfc@ãÖ-¡£½l©ÝB2µC¾»ýÎ+jddXF…SE½! ±3 +[Ö+üÄŒíóP¿^°§ŽäÚgP™o°Böî/œ¬Y l`Ÿ6vóÒß‘éf8••'AŒLˆ§ìçãÖCÂ2öôâ&C>UIÓ[ƒo1 ¼ÃÓº@ÃÃVKˆHMVˆb"„ YXcY³@Ø@6KUÕþŽž‡›Î7!£ ˆ[gÆ™]8Iœñ>OZïû [˜ ò< Zç=7?ùð¤R†ô€ ØÝ”ƒÛǸ§ø$ ªÆe-©j–5 „ qOeVŠÚßѽ$}Òâ»–”“Ì!ËÅõÔÉ}ò¶1ýÏ~ž¨[‰œ­0G+ìýEÈÃQ]”ø÷–·FÌËõ¶õWrÜÎ3ÈTû»/ lúû†¼B”%”UÕÐÓF^XfŽø¶¼~¤ÒIÖ,6 tXÈ@ÜJ®,:÷§ j„7f¿U99NñЈ¤$e þQÑeÅçƒ12ÇOÔzB@›Õœpþ¶¸ifû(«€XÕCŽŠCˆ;FaDiú¬ï.!>úG…ݱ¾Ñ|lÿ£mÿ ™:’™½|L›.ÓîϺ´ùãÊ{xÏÃñô÷`: ¯Y¨˜¤AxwIږƸ‹†ÿv +{$ýz'vçíîc³4'¢e¬Ûì…Ìí%³Ú˜«­>‘Œé9¾j*ù!òúÞ1uµÿr!¶«±/Àá8èˇOLG¸q_÷Ĥ+x4}Í^fE©œzU=vâ×ÿ,Yûendstream +endobj +4365 0 obj << +/Type /Page +/Contents 4366 0 R +/Resources 4364 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4346 0 R +>> endobj +4367 0 obj << +/D [4365 0 R /XYZ 85.039 786.531 null] +>> endobj +4368 0 obj << +/D [4365 0 R /XYZ 85.039 697.528 null] +>> endobj +4369 0 obj << +/D [4365 0 R /XYZ 282.773 703.501 null] +>> endobj +4370 0 obj << +/D [4365 0 R /XYZ 85.039 384.975 null] +>> endobj +4371 0 obj << +/D [4365 0 R /XYZ 282.773 390.948 null] +>> endobj +4364 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F11 2898 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4374 0 obj << +/Length 3756 +/Filter /FlateDecode +>> +stream +xÚÍœMsãƆïú`%jÅ2E:"•Íæק{¦g0 €†(S.W™$0h<èé¼½X1Ëá?1«L–«zVVEf”˜Ý<œä³Ï°çûA-Ôdµ9¿>ùö»BÏDžÕy=»¾ qê<3u1»¾ýi~ñ—³¿_¿ýpºPJÍ¡åé¢,«ùÕ©˜Ÿ½??ÃÍzþ­Ûûþ +?åüã»Ë7?žÊjþñÊí¸|{ýÿøá¯nÃùûÓµywù½Ûúý?ß½y{úËõ'o¯xtiB)Äþ×ÉO¿ä³[¸ÄNòLÕÕì |Ï3Q׳‡mTf´¢ßë“«“„XnŸž¹£†²ä[,dž•RöOWÖ%NœNõN—Ï"«k9t&¡4¤¸‚þÈLYÄ-?›uV¨1E&uÛ…¦ˆºÐ·ò°¯OëbÞ|ZŸ.Ä| ¹®lO*Lõ·ß  领óáa>ì Yɬ,Õ,èSR›eç<‡‘ðtç[,ˆ/; •µ{ú•¶Yî]…,qך‡ßÖ§¡‰:¤Ô¹ÊêÊ Qöh•Ôôv]e9tÓÒdÚèY¥³B¾®±(po=Æ”C÷Zw£´ÃYÖ™j8˵È4l(•ÊdYÙ$_=Aæ>m\úÄ|ßëbUdyUÍ¢¸/‡ôÁxJ©%î`ÕÂ{€nì†ýòñ[U%ÌEnŒçV5,d‡ûo«]/¥FU™¨t4,-¡Ílæ°W•¢Ñ°½|.µ)Å¢„Ñ!*¾av‚Y|¨ÅX)Fq_J‘¥ ¥Øb^ö¹`^)M¸–É.Àêµhc @y–Ë2†º+ÿ$¹ +åÏæ*”?—+—Y•«¹ò¡Ø\i!²î§ÔÙ7 YT=§áòt’Žô¡x8]fµètä9Âé|®‚+Q2 …âáàÞ¦òNé_ŒfΔ-)Ø(‹f@ŒUZÅho¾A$¸•Ê6‰pO¨ÂÜde%•aŒ©Cj„\o!"íu)û•XBùTi)Ö ¯²Ãwösnò?Áÿ‚ÊR €š\gÕeP‹5o#: ç¨«èýÅt\r¬ +ŠZÂyeš*ˆ‚WodUœe]çC Æd¦0i@)Ö¨©²JUÐ7=PÕ¯"“€úX<(VCnLôl¨PótÊA–CYeE•èÞcÊÖ²{V„+Ó`ÚH IêRu /žY×Y©«4˜‹łɥ耶5;&“¤Ž¯_-Âuö³E¸m]Špx1¥dExQè¬TfP…ËQÞ~9e«Â9L¯ÂcÎþ,éµ³o•D‡GÁÆ…xÌu>ªÄSä«Uâ\¾¼çóæ»ùjç;._a¾‹¸‚—cj< Ÿ—ã<éñNzA.Çy>¯Èy>’ä1ßÅhþHI§À󢜥óª<¦{™,/Œ€¹¹HT‘m0¦"©QOöQ Âô J‘”bM€š:ƒ"Oƒ¢¤Î+“ÔÇâAQ)Su@/†Y¥ Wfª<¿¨TÕÐcªõT¯•:ՀòHJ±&@ ŽÇºúAá¶Í«7¡Äj'å’£íW—¯v¤}Xª5¦v¢À ÖYÌ v"ξ¾j‡Z¥Q;m0FíD\oÆÔN’|µÃæ+¨6_a6I¯v6áòf“ˆ+¨5ªvRðµÃòyµñµ£FÕN +¾ vX>¯v"¾‹Ñüyµ“/¨Ž.¨x4¼Lí@P¡dˆÅÔ£ks¬ÔI@”Gé…NKyŒÎy=e+sÊ rZÊ׉S™I4+µ±Æ‹€ÚôŽb¤¤.“PR(žŠÀȲ£n<§[LÀ–9N¿ú>oñqôaÜT*Ëu¢¿HDÁ˜J FËrxñ1 ¦[|ä!iñ1†¼x$-&Áô‹,¨_|ŒA§“¨¤Äç•pòÀ> ÁÄëÎIu™É|dKÀ]Ub:µÈ”pVŠïV¨Ó›õúëi¥çø7ˆ¢˜ïïv× ZÖÛÓ…,ç7¨ä›5l¡ðÐDìïOÐ~{ +;ì¬ä§íw¸™¾Û#m1vtدý¢SpAÊä×Ô…ZD±toi2PÛj³_{°^G—õÝS7._ÍçR +ûª¶1äÓ6Þß/Ýô% ÑE|»Ý>Ø•´ùÝû<âotgu¬:´Ý¦¬ïœÐ&+áqÔ€`*‹×åÌÇZDÁ†®jŸ&œÑO(Âa6›[÷åË +Ó†ß} Ü,}’þ×gMH¹M”Ë„ßk¯{·Ú|vÛ}™µ‡…d-7¸eÿ¸ò§ØeØ3*.uÛpA·x~,U÷V∱N(eŠyã>¨[šÛSìtÚÔàFüŠÝ±ºsn¶îÓ^@sƒH÷«Pù>*¥A™²Íȃíèö²ˆÇ~ÚDÜã^L{hûs.ˆøjNY‡m{Ø}Od7­W»ýκ+Ú¦#ïäÁþj¾ýÕÝ°Ùê×ÐOºï]¤yHWøT%1vªIc§9ÎØ©áþ-·ú:©Í¸­S¿ØÖÙž~ÜÕy€8hêŒ_èéÔcžÎ>☥S€®¯J=íé¬a:­ÍÊÔ© 0Iþxø‡}U•G™:£¸ L,¥_ÕŠ1_lêLÂV—Xn¿ºss¦Î$h¿Ç +k‘f…UÁ£N)K¾A‘€ˆ8ÎÕN°ÂÊb†ZŒ8Çm¾U’Ö(Øø +kÌ5êìL’¯0Ø|…1ÀæË?v¦ÈWx„eóåac®iwg>¿ÂÊóÑ +kÌ7mðLÂçWXy>ZaíÔÛ”Ç3ž_aeéü +kL÷²V ­S-ù·±˜ztmžéñLAç-ž,sxFpÇ<P'GIöΈò•îN- ÈS­¨EÁ˜î§FGº;“€zw'JîÎôwg +а¼Ê‚úõÕ”_`5þÓ9>Ù¥ª†6S Ôè(sgL·¾ÊCÒúj y„¹3 ¦__eAýúj :½¾šD#ýí +„¬P‚ãª*à6ª3wFSˆqÓ‹ñ˜sÜÜé[%ãQ°q1sš;“ä«ã\¾¼çóåç¨ù +ó›/?ßÅ\ÓæÎ$|^Œó|$Æ;ý9iîLÂçÅ8ÏGb<æ›4w¦Àóbœ¥ób<¦ãSèV% Ô© +² Æ$5:ÒðÔ;xP²<Ä GxR€Ó ê]1(o{˜|4Sïþ‰ÌçQ0¦¨Ñ‘Ö‡$ ÞûÀƒ:óCÌ9è~Õç)Pƒ>gQ½>Y_ùö•Ò»Xy\A´Á˜‚ FG ô$˜N ó$ÐcÈ#zL/ÐYP/ÐcÐgôºéüO HtFñ~d¥$Ì +Õq~ä(pÎbqŽû‘}«4½ ÆôˆkÔœ$_A ³ù +ÍW˜ïä«ï¸|…ù.âšö#'á åó=â›ö#'á åó=â›ô#§À £ = /Z-W¢ÊŠ:ÑryŒ©Hjt¬BO: êzzŒBOÚ*t4(ôôµ +=7™H%ÐC,¦\›cåyÊ Î9Jç-äqÎ䜭4g8ƒ2oA_éL– WŠ<ÑÊyl¼|££œÉI00ç!I˜ÇG8““`za΂zaƒN ó$zéwp&ÿg²¬ò¬,ïL–ÆdÒÝjùèL;gbú²B-þÓ—ÛÐæÛÖEƒvãÖ7 [¼Y  Ó6y$C> l7‹æÉ6Ù>®ö;kB…6ÍÃÒz¦²gäy~e9¿·î\Œ¸ú¯u{ÚHÛ b—jþÉú§É2†Æ¬àì\n\ ‰ßƒ ¾wlÀ¥´YãvçV…/d×¼AŸ6p§ónœŽ—xG—ëø"ɯ ‰»Ù:Wíj㧔¤ýÖ5 3ßx—÷# ÖOÞ¥ŠmÑ‘º¢ÞÜÝoq×ú–Úù,á¾Æm#ÃZsû•~“Õ^íñhHõvãº'ÆwSó»;²>BÝ,©"íI;EòÊgëKw +¬¦fµÞEìËvÏv½vIt–d8®MV/=/¨0´àiFà?‰YÿŸ¾Í"j44r <!^¸ÈzçS0•(þt®ÉÄÙܨA/Åg»„aâ=͹žo1ë¹r/ l~sù~ô{7nïÒÛ¢qøØ-»Õí²! ‹ÜX ø¦q)]’ü“·²Â1èsÅq]²}üÕ¸ÃñÒ|~ ±†õKÔW¹«;ŽýnÇ!Ó´¾í[7ÿÜùZi¨:Övø¦êݹªp¿ÚA³wì46ì8¦);é,ý$QbEŠ9Y¯7ËÕgëúveû„ûîÉžmÿOläë¦Yk°èÊÜÞdù¢k1EG0]r´è¸Óù¢cÏæ‹.:Û™í™ýÒöío˜YLzU»ù>a +½v³÷UøvA0ÇÂf÷ZÀ{á°¶êBù*öïìÜï›·Qhº@ŸG.ÛiO뻾oÂ`é\;Ø»Mš‰±ó’@Iw+šAïìm覫•”½–ÙþÃd¢¸4<•f¢¸ÚFLqQ#L-.ît¾¸Ø³ùâŠÎfo²˜o©‚f‡¶…Ķ‘ùZÙ›¾5õ´§Pî üzç:ÉÆZº/ß]^¹ot_'áó‹²¢ þõ"sï±Q…ÀG*~@Á÷ˬ;‹ºéuðuÚç¦l ´áð0Ü9ôvÒ‹ð âW×ì‰Þà9b±Úm×p¿u'r¯=Ù—mÜÉv{·ãr¹?Ç ï~„]Wñ5ºt£Lpø">‘ ËNäëúžv.±Sh†Ø¹MV â—Ýêaµnðݵ"·n´ßìݬ܉ùÞÚ«YÑMÀ:Ȳ=Ü /»Û}¼-—WÔ­ƒlä5e2­Ô°xŸxSâ8ñ®+xJûÇe™¥ö0H_çCO@¦RÄÿWgß¡endstream +endobj +4373 0 obj << +/Type /Page +/Contents 4374 0 R +/Resources 4372 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4346 0 R +>> endobj +4375 0 obj << +/D [4373 0 R /XYZ 85.039 786.531 null] +>> endobj +4376 0 obj << +/D [4373 0 R /XYZ 85.039 763.817 null] +>> endobj +4377 0 obj << +/D [4373 0 R /XYZ 282.773 769.79 null] +>> endobj +4378 0 obj << +/D [4373 0 R /XYZ 85.039 485.925 null] +>> endobj +4379 0 obj << +/D [4373 0 R /XYZ 282.773 491.899 null] +>> endobj +4380 0 obj << +/D [4373 0 R /XYZ 85.039 209.499 null] +>> endobj +4381 0 obj << +/D [4373 0 R /XYZ 85.039 182.401 null] +>> endobj +4382 0 obj << +/D [4373 0 R /XYZ 85.039 155.303 null] +>> endobj +4372 0 obj << +/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4385 0 obj << +/Length 1870 +/Filter /FlateDecode +>> +stream +xÚ¥XKoÛ8¾ûW½¬ ¬UI¤^§EÓ¦mºH²[»m´M[ÞJbJÉ òïw¤l'v.‹¢59r^ß<ÔxÁŸx\¤a$Êq^da*âñ²Eã œ|ÅŽcêX¦<óÑë÷™ÇQXFåx¾Þ)£0-³ñ|õ5xûñÍ_óËÏ“©"ÎÉ4Ï‹`6‰ƒ7×o,ƒ×|z=Ãß$¸»ºyw;IŠànÆ7—ó;Üß~þ“ ŸiË]ó/Šo—ÆZ½$»˜º4í·(–(dgé‰-ùh¸˜7$¬¿¸º1¡U“cugêÝô„ôL€7¤”ÁÌÐ H?eÝ‚^‡DB£”¥@’^¨y­,¶¦×á˜eeÅËõcÏ2€>Ë4=Y–Ë°,äèã Æ ¦Qð‘€þÀ¸_*J€ ¢j¶š7༔Ôîà^Åœ .XÌT³P¼¼Ñ=²9'fƒብZú sÂI!¤(í][Ê‚´§÷Š2°g,Â3‚1¦éBýqÎaiæ`ñ‹ÛóœÏËLF¡” )&"Xê7 xL `´ ¢|›ó.‘…ƒ.¬q§ÎñRÌ åvoMí¨ª®ùÞ‚ïa:P6j>¯·,`Œ|•B´­ˆÞbÊ8 ¾´+.Xˆ ™ŒmTí„oí!쨀o[§â!¬¹ +mQ\‘RiHŠ,èÔZ󪧴¥%ÅÇ:ΖÝC–¯\B€­óʼð°%s[œÙ¹ÊÛ¯¡†ÕÌE˜CÈU¼'¼áCØé”s~Œå‰€¼‹+¼~ ´™ÓŠÀ‡§>䇞ç°ÿa—a©÷¹Fª$gàioxÏFºC«È¿­{°¸ˆ@ Ó»£¾¢:ã7.”ŠäÊ;1p –›Û9/åë9îH)m{¥õ¨”ÓH9ÌfwÊ®ÆÙL`Ñ–]ç¬+ÑþÔô¼¶SSuO×X®ðˆÄeÁ1AÚ #ùÁ8¦å®Òîî1fˆä„i¢ö]Í]ðåOv•Ž“àFdé´0)6¬Ò–÷Þ3Ô浃ÜWµœ“ˆ[·)TÀþà³Ák¸á +@¬KÓˆ%¸õâ‰sX —Û>{±ƒ +ó +SæH‡‡ÖÖÛ®ç&ÃÝßdÂ~jÀ”CJEÇ>É„pé„ jÅ!ÚAt0®Ö½„¨£ß ‡PBy¹Z3íqÂA¡ÕPÍÜ¥ô.O2½fø„¢R{«¸ÿIòsEžéY‘Z{ãóË¥ËQÉät!¼Á‘Þ—¼úè³í H3CªM\HÏÂù†~†ÞÆf½z^ÉÒ$á Ö+ƒÊ—ñS…SQ„i!Nhü==¯Ôendstream +endobj +4384 0 obj << +/Type /Page +/Contents 4385 0 R +/Resources 4383 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4390 0 R +>> endobj +4386 0 obj << +/D [4384 0 R /XYZ 85.039 786.531 null] +>> endobj +570 0 obj << +/D [4384 0 R /XYZ 85.039 766.606 null] +>> endobj +4387 0 obj << +/D [4384 0 R /XYZ 85.039 744.844 null] +>> endobj +574 0 obj << +/D [4384 0 R /XYZ 85.039 686.81 null] +>> endobj +4388 0 obj << +/D [4384 0 R /XYZ 85.039 651.666 null] +>> endobj +578 0 obj << +/D [4384 0 R /XYZ 85.039 500.506 null] +>> endobj +4389 0 obj << +/D [4384 0 R /XYZ 85.039 468.293 null] +>> endobj +4383 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4393 0 obj << +/Length 3103 +/Filter /FlateDecode +>> +stream +xÚ¥YKoãF¾ûW9Q@D³Ù|؃“ÙâIö`I”DÛÜP¢BRcûßo}UÕ$%уÅ.c6»‹ÕUÕÕ_=dý3‹,ö›/Ò,ñck›ÝU°x¢•Ÿ®ŒRD±õã(¢ñÌâÊ­®’Тt–F÷X¥aäGYšï®® ƒEøIb cBßšp‘乧éâaû»gŒ¿\ÅqàÝl6Íqß/W6I½Û¥ñöÍÒ^»+úŠ^›½,}X®ŒWôźèh¶Ä[·üóáç«> â¨4nŸ¯ <¡aM¼0Ÿù‰À¤y',ð}±[†™·.Vv¹ŠãA¸Ä8Р.yXîAÓwBQàxûòEÞ7¬È‹uUÓ£êAþ&«=”•á ¦›ö/ùž?#3(ƒ# ÚVwªß„æ¥êŸeDR¦LS÷•H¦Âl„–ä[XŒ²28朕\,ý…?lbìºí訓yÏ4gsh¼‚€]Øa]ë +ëjóÐÛ4,ÈZîÝIv²Ö<âx‡B8¨º[aO Fªbì·,uÝ`æEÙ܃PváCaš©R1ë´-ŸÚâÅ©ìLÏ?;/z…ˆkXçš‚uÇ8ñXÌMQ3tdx8¦¼Àâmù¥b3óWõ›°­_+Ó5[Q%Ã?Wå—ÁöJÆ'_ëfrΘ¾»Ÿ9¿Ï =˜)Ìsº`}å˜âýCÕ:Õ7}Ó¾-³È£Ž¬¥®DlÐñ°n‡¾l1—‘-ÅmáS¯TÚþY™ïëùà‘Ý$`-ŠÑrX,ö[<³ë?ýªoft{*ac‰ÁKïˆW,™× å uzŸ™éížr¼´¤‰HoÓ”œöغsÓ)æD4[§˜˜²n;½‚§t§Äh…Oì·´–¥ÀðgGA±"ˆZYt|Úòïc©º±DØä|ËVEkË ©§»UeÄv«}­Ø9ó¾T[>°p0f˜[B%\…é°cº»êOmÑë·ä‚LséuÖûø  rs'ãK êT +Ýåd1gòþòb;Ñ£Àî¸+ÂÏC«ÚB<¥¤°2xvµÂOû +0pýK%‡ó*Ó3ò +ãÐû¼Ì¬Û›p¡.ÝÎîa~ER_ÿ˜$“àbcãçAJ|D|‹Bˆà,ü*èè¦'x³ŒÜNìeB´8øŸnhhdß“ –E¾ Œn»)gX&(˜„P@ïW ±Ú£«l3\ +Êýs¡ÓÅ^Ÿ[Á_u=yLÓÊ"Ý°Za•Þ¶%Û·ÚŽ:÷Ui§Ê;ܤïÙ5÷£8Uýúíº#_º´‚Mý4´J5îd“b©5LÓ|Wíu†…Ãx‡7Õ#}ôÆ×áiFD“d~bÜîßp†…d2ô» +Ç´¦7•€GLüh¢Ó4牲ÔèFÄQà§Ä›š¿¯~ÿ3Xl)ùùù*ðmž-^hø&Ï»+ëÛ(Ö·úêþê_“ŒOy­&Ì8;:Ñ"ÊŸ2ŠaGè²?ߪۦ™d§ÀóDPÖ3w‘ŸdîÈøFÂEº!Zb¦€ßh 3÷Sœµ2Ç7Ÿž8$‡Ø;=Ú0‡3/ytM}rLþÚ…r¼À)+Þœ »ÑÉã$<à€crcY›©â³€gãxê4¸q¤\‘™÷ c,ù …„)š›‹ESA³yÛÔ<‰ØçãÇ}IfØ4 Â]‘ Kb~$ Xz–T•W ‰¦ûKHîš‹Y€lVÒ¹!ŽlŽÍff’:õ¡ä>¢Ê”¬Ò>4¼sa@ß=rTÛÉê$ ²åž„†¡Ã°Æ°p{?iÔT&CN‘!RÔ_xÝ‘s®Ë|ä4Ve²Ý± žW`[,ònSu,˜©­§ ØJƒŽŠôüø+Í=(‹²VÉ[ù|87¬>‡2AmD)GOèD3ú"Õ Ì¢‡æ£=²½KuÅÅzIÕ@ÈØs™ٻúÓžKB+­|çOÈŒ›ãA¨ïo?t2?ßHœxŸ:¨‡™‘¡c+_™33Xr Ô³M²il7£ÁcYô\<¹Ü±pY¼$•äqÇNÞ†£”ö’Mb‹c;ø•µz«hPW:b+Èå'–®=£>G.v +d<)nýs¤wUid ?Ãø¿@ú˜jÜ<™Åz2MšP¿Ï†? +ˆŒ”ú,b8™8[™ÔÿiHâú9`åtê'9 NÏ44ïa·d°¸ÐSÈmŠ¾Cž‹¿†Æyn…f2fñG­xâúvgtq"«ð]MKíŸMctœøy”.,e è~ÈUw)™øð0@Ö; N'Sœ†ýú /Ýñ0"&ü­í•ªÙ¯8íä·± k.§yO4'áÂx«Kä-´Äºðš(5~Lªô¿Ÿ6Êäéb…ÏòÿÏI!?L-=I®<új³Æ†Ä'J§Ý%Q“L›5Öd~œå®»Äý¥(÷~D3 7¿å¨ƒè¼ +ƒïË}ùG`"¾èï5“Û¯Ê7Ò¼ßL +óÈíL3ɆÉY¥Aé¼8huÓLMœpÓC’W‰-7jd…ÈägÕiû œ¯SC‰?¯BqKV3 :)élE7½I¿ÆxßIú`MsY£~O zÒ +¥;<«•fÞd8JÊztmV\¼ …û˜{Fç¨$~g‹0üdö4Åj œíò0™ÿ†h_TÚ¥|XRÑZ¾²Ñ¾»!I}“&_A)ÎD8õ§4!×78ÞQö  {¦Ñöè"%±RôruBSgÜ3‰&)Íâ þ*õpŽz˜ÏNåÀÌjö~]ö›k4ô^¶3y~’øi+i×ÃíÞ´7éÄp-?ɤCºÞ&=ñ :TºÒi{¿"]¬×½ ‰¥$úÈ¢HkRP( ?`“Ëð3ZèA¸îˆËè46tU¹QÚH†K€U 7ŇÞAÏ&ïd‰*:1JÊr ÷|“1ÚQQš\´£°&uGå<ÅÕb3xv8¸v+§uÒx©ä&ùï¡ŠÉBzF_Ç• ÑûÈâˆø¦ðÖ)%åÓårPz"Åx3ùvV +¥¹â\2d ù‰/ù'à…ï@fOºñQ†ô\/ŠtÐÆßhøKéÝdZ.dCwVÀJâ°b·~T(QËB×=@׺+âªÈUòô²+Ø#ä:¢MM ÞiÞ €Òäܧ¥;‚ »É¼DÌ Ò-ûì­L>úòµ×df´xäß4[iN»d4ªö›ú8yã +sÜÑì½ ?3Lo]·öÅ8-ýÂê®P©ôz]ú1*)4‰Ëý¦};L‚›Äü_¤NK}—>¤R‹j·Y«q€>s+…<8wr5¯k?%=t}#YÆ\î´w=4F†ž®8”ydYŠ™º Ýóøá¼å›±÷¨«ÍžãÆ.à k‰ÝíV¡Íºß’¹<@h9ýÚÚ`¨ˆ;7êKåª=§™ÙIŒ†%äg·ð¤¿áK6u;ù™nÒx±S£Ñ)ä¤åóžõůyÚ‡yä¬uÚÊ[oeѽÓ>qõ\ìGÖNCäûeÝ@z(-uKaJi`ˆ<<ß2¶¨ íWöü­endstream +endobj +4392 0 obj << +/Type /Page +/Contents 4393 0 R +/Resources 4391 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4390 0 R +>> endobj +4394 0 obj << +/D [4392 0 R /XYZ 85.039 786.531 null] +>> endobj +582 0 obj << +/D [4392 0 R /XYZ 85.039 766.606 null] +>> endobj +2957 0 obj << +/D [4392 0 R /XYZ 85.039 676.205 null] +>> endobj +586 0 obj << +/D [4392 0 R /XYZ 85.039 329.547 null] +>> endobj +4395 0 obj << +/D [4392 0 R /XYZ 85.039 307.786 null] +>> endobj +4391 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4398 0 obj << +/Length 3864 +/Filter /FlateDecode +>> +stream +xÚ¥ZÝÛ6ß¿Â(8­‘Ôgß6»Í]Šl’v·¸Ú>È–ÖV#[Ž$×»ÿýÍIQ¶ì<‚¬$rH‡óñ›¡Å,€b–F~ ²Y’Æ~¤Älµ½ fkèù×Ð M²phÞ>ݼy‡3øYÍžžíý|óÓ“åÓÙ‰P +¹üzóûŸÁ¬€ý|ø*KgGx|‘e³íM)? +•þ®oo~±sq_8ãQSB •ðÍ*ðÓ4œ¤Aì§Q +’‹"?+98’BúJÈ™!BÑÕE¾ï`—ùöt—9KêonSùñäf¦op%¾HÆÜ­ší>ïá„âÄû#ˆ`ô1ß.ó…ôáUrLJû¹ +¼ÛÏø{w4¤ZV@PWý\ O÷§âÔ‡Cqx:«&9ã[Dß*Ù«xÄ÷Ó¦lËùB&«:~æø¼}Þu¨ZGÔ·¦-¸u™¯ðû þ)±{ÜÈñl!UâËňš’Ñü;‚ªÙÍaxý…„oy]78ɱÃoÜág_Ñãƒhú‚©›=.ï•-ÌÌu¬úž‹åKÕÁø5}ÒC “Øp>sï•}£ À d:Ä ¥ì¸zK~då„5—s’¢ðàôéü_" >ÿ,㉈‹M¹Å÷œ©Ê—ÞrD4¨ Í|EFp`·ã’®tadÕñsß’hÿFÊ¢œÚÕ¾ÅqÛ¼­êWà&M½¼Ãg†Làc[­AÖfr$è'hBý."áióÍa½Ñ¬J8ºÒ“á~m˼ã©2š +G<7ÈÆŠê.ËvÙŽˆk20pœ½‘úþڒ¸|<ØÐûØ ô¨ÃœœÒé7³þ7À +ÈŽÊrÍ;³ô‘ ÏM•öW8˜µ|§ÛWù>Ǿ +œNefêÈë¼ynmpcùXârIâ½ÍçRz«/å%…FÚ¹díæã(ôS WCCt9"äd}(»þÌMŠ(#y}MMs¶æÈQŠH@̯ùÄ +$3u¤Ç®{|æ°©j}Ì_5ÕØ ‡˜ª-¿âñWmYðܹ^Ãø|¯s:\TdÒ£IÇE”ãòVÕQ1Á,¤÷Þ™‚T—´êo\¼(í¢zE«¸È+kv*}!â±kD3†˜@v¶+jÍ2„µõß]Ï4ùŠt¼9Ìuqû r%÷u܉þB[†jŒ[â;^£×¾…&¡ŽæÐŽl zêÊ +¿HŸæîÜpÜTì€'\d¥ÍqðùÚ~žqáVÛXkƒûéÝÚ¿h "Ø~â+¶ ‰èŠe—oÏ!’~d×Õ4g‹Ž!– “Ñšl a”ùG!±{¯&V%¸/çG[Ñ™Á Ì£Ô+òžôµ¾Ôë\Ðzì#-Á‘5{öU^sGG”¨ƒgoÍi‚]¤RØpÊFú„'â\\Wr Ï}ümOüÞ*ÔË|Y—Ü`”6@uªû +%chP2 #€Š]*R³½€=d+êºÔ³ º¬Ê ¨Øû|Ç­ßó£Ù•ú¥PémÓêøõöþ¡¦ H]qÎÄÝΟ +8qÂåIå§Y¤kâ”ËK}™JM…±êˆ‚ 8*^ž)ld—×´®ÒÄ)»(|iêb‚‡~, CÝv¹ŸG¨Iݱ˜à `pÆš˜â+¨ÒÖ L`âó‡ßµf€û‹Ãô’<3æñ¥7Üî4ð‚¾Ô{xäçh‰Â: Ç _æ½a/üöxûÀ/§|Q›u¢ 7ä< ¹í]ŽB{åV?;u¤÷:Ê("êÛŠ‚Ú¶X!+ ‹°6ûÄà"RRê¬v«ÚúKbWF¡×Ç‹à8¨o€c‡è286Dãšá@Ž}‘F×Ö4g ŸäЗҹ 3BFx KÛR1I}gg€­—€(öqX£¡p äÿÉôM »¦ò/i ÄþéJ†$Žó½QÔ !\mòŽ‹.9ï°B@ß&CãY¤ÇFWEÕ7´ŸH†2LoD>¶Dè†(º˜0[D.”˜&J$)Þ$× +†He#©â)ŽØqEÄà3~ïF5@jáô¦Üæà ¢(í0©²×rpª+ˆm˜hEF;Ò‘?Éñ¹3i0JõP8µT%QÒÓ¯j¤ÐaàÇ—/9î͇{Åy˜M?“¦ê¡èjï¯ÌÉxX“Ú¬:qWQYxDÅIÒá…VF‘úQšŽÀ;Æ‹øBfcÙâ÷p¢2¤uåÖ©÷ ž »9¯qŽJ šö•3±Ž58mù²g…ïøÛâ\x·YÏßbÙÛM‰í´²>Á ž<ýãÄ¢þž ]£ +ÐãÀC +Ã* +Š€È'òagšŽ ž'%mTß ãé φc¶x^—- +àðìt¨Z6Ÿ_¹ã;i&ö1¯ý9H´SuÔ˜õ=WJéëè ¹i¶šæŸ)£é2Žs:~»ÇJÕ´Ú΀lÄ)÷áby sqg&…w×´Zdà™0®gþë­gƒV{¬X³&²ÒIHuÈA:fÊ=Ã|AW†%|R×F'xøŽú\éìdGnçiÆóñâí9Ðe<]òÓ˜€+æ © R’ ÐŒC³ ¦HSäÈ–ÆزnK’ž‰¯PòúÛÃ/ `9+¾4¢Ë@ÃÑi¾"ÌøZ£ó§Ë=Ì©^ùÀŸKòHCX–«_ðÊ*£[xg0<‘ÅÉU¶ ÍÛã|(SâÛdÉi¬ïkôdNÙ•F<§±.à ìX¦-Â怖>&µ»}0·"ÂO.õ½K9+ð1öL¯Ü¨ó[´ú*DÞr;E²$d5 WI ῵Žß…æQœ™*~—‰•KÅuè3 ³^§f£ˆèèèªò3ëA+ ´/·Õ}«÷&ÉÓ©²™‹â Û +ºc*AéÔ._ë‡kQ$À*ë%.R ¯›õ+gflGÂ9¦YvÝv¢Ë¶cˆPD/[d}d9ÿ}¸h7xnäø5¼)'¯Ì%`rHůrlhÎ8™ äĆÆß:w×2VCÀÕ4ÐŽ%Ç|Ù[¥3uPä¡7ÇotK Ok8÷iQ´0ååIâúc´ )©š0?ðH Ø`ªÔug^>¨®WRA/°éKp%ïÀñêÙI{ô¤Ö8ðã ËBú*Ø9彚ûNê¶'®cp~ð+¼hs1³MüÄ”&ãì%i€3Q[x,F¶—ÜHI¿) êÊiâ‹Ð Ü=Þ’yÅ’eÁEȵ AkRS£úgdz³C±/%ï¹X2gϤ.+Ü?…¼Q$[„25x¼¤ÈüT%#áÜ?ÝŸ:Š‹×WÛj½qÜÇèZ›qÄÁŒ÷—Fòcߤ/k ¯Íuµ3뛚xÈ{êíP,¾Õ£ @'@ß›½Îû²Œ-Ÿøzõ|¨™‚¯²ìv Æ¿)pçê³¢ºjÕ¦yN#Ã9×ÓF¡ï% å$½CŽö6 Aø[§³?“{…¬DŽ~¡€—”.è£ìÓùY€¾ uJkÕÔÑflŒe•%m:žñfè Õ%çüv¡1ˆ­a{ýW6¯½]DœøAôŸ9D—£‹!Â=ì*ŒûúÐ]*Å)¡§«Ëkš³åÇ… $óC%FË“‚‡Yì}|ÿˆwtYä%ü4?Þ(ØìvB†¤:øBð㛲c”o’Zç/šm^í¸1×Ôº¬¹PÝ€Mþ`+×?‹É[*š¸÷ ú§6ŸŒÖÀDDz/Ú'ðï³°±àAkò%ðºÒâ÷²Õˆ¥³^bâ7ŒB…~†WéÐXåàï*‡ÈèǸY!ð÷Y”#>Í!ç/W›]E÷Ç>Þ£#y&Ÿ‚HÝ\Á]àOO{•¿fB{4Yè'©àòy]pQàxzc“…Þª®†_KÈÌs§‡Ð•> endobj +4399 0 obj << +/D [4397 0 R /XYZ 85.039 786.531 null] +>> endobj +590 0 obj << +/D [4397 0 R /XYZ 85.039 134.944 null] +>> endobj +4400 0 obj << +/D [4397 0 R /XYZ 85.039 108.33 null] +>> endobj +4396 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F66 3242 0 R /F35 2880 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4403 0 obj << +/Length 3458 +/Filter /FlateDecode +>> +stream +xÚ¥ZÝÛ6߿¸—hZ•DR}9$isMÑlÚ®‹Ü¡íƒl˶°²åHr“ýïo¾HIkiï ÈŠ"‡äÌp>~9\ð/\¤ÆT¶HÒØ7*\lŽ7Áb#ÿº …b)$ËÍ«ÕÍ·ob½? ²ÅjçÖÉßdñbµýÃ{ýãË_V?üv»TJyaèß.“$õ^ÞF©÷úõûßïV8¢½·wo°ëýoïnCM•·zûþŽÇ¾ÇèÓÞ +^¾º]Í=þpû×꧛VŽÏ$¡RÈåÇ›?þ +[觛ÀWYºøíÀ³lq¼ÑFùF+y¯nîo~ukñ˜^ð¬)¥•ú&U×Z Í@+a¤ü( +‰1~¬RË]ñé6J¼¢¹]FQä}*O[§Æ¾O-ö)oS•Å EïZ&jQîé­8mšG˜sî +é9ç-‘|ÂIuƒ ÊR&hë%nòª²~ÎO@sÄnhQõÈ0ž >y{(heX'D/–"Ý2De$RÛþ +¤ÉT¤½îP`ÀˆMñ 6c¯<µÑä[&ªwü²  +ÚºŠŠù½¶Ùí-î”AäÙ¢·”]YKóyÔýg*Ö†x2ùfM7ôŽ{àÉ Ô¦÷ $­¬Æe_1/xoœŒÐ½a6:vHá/ïòYkÙÕx‚q^´AÓ;ðÛø€¡ƒl#G‹‰CtHê<Õ7žrƒ‚šÌ#&`8—EOÕ>ËKë1¼ ›Ö~Ðò1´ùûï@/™8zÝ’þ$è®jrþMnUYhS$46ߦƒ> ö„ÁkÃV`tÓ­O`V«ë§¬/ý¢¥<I-Ý…KX„9ä1Œ§2ÙHÇòb‚ž€–艠ONchC»¢ r$Þ–í,@"ö-G…ϼ²¸ß(n…øÃÁÞþ “^±Oç;%kFØ!d‰(¾Ÿcú +z*Ž:ãÓ*¤ÔûÇô-…‹—RÖü,¦ÀÅñ?XAè¯õðŽEÐgn B-ÖApC'”Ά@ôEË3&‚!ô +Ž{&É‚÷cl1Ú‹VˆƒŠGnmêK…‹öÎd52X–Ò…¤ÃkaBü©pÀß–G1Vá9¿ålaƶLè,ÈH#•Ãm¼ŸpÆæ‹Í=ál厾öþL„B5… +ŸŠ3aL³>j¢ F`W¬ÊK%å0=ÆñÑ¢K±$Ü8ç ! @·žä*ïØKë>œF×›jˆƒ÷²º ÒÊýû@Úßq_-Or]läöêÑ ÑçT°v!ÅIxžíYrÜñ5›ïoZY;hÛÀ)¿¸7h$hNk„2è{Y¼kŠ¼³7ì}Œ^®/´(cVÅâ{דˆKœ!øÿ‹›qn2¸ŽÃ _ÿÁƒ¨Ǹ†×#w_º¹î^ƒàÖ@c›ŸêššPÀ¢‰Q5T–£ ò–Ÿäõeà)\ëA…Nì½ Eu)'aʸ×ÒbL dS¯J¹¢0(a%Mõ‚sVÉÕý ÏBù[ªÅ©QÕ§Té`„$uÞßq§ øÒ«þ|ë(Ú¾˜ãŽk48Æ÷• 0yê ï‘v>ë¯Ú²t¶LuÔϸC-þÈÕ*,šÐæ›Ú^ÀÖá63_Ù ¾GôÌÔU/£8“ü‹@Fp´*ã9w^Gkì¢ +$îè)8Rö%¶ºr×X¤qÈ£ì#z#› #ñQ™l>.³ÌWÍèÖ;¨%  ê<Ñ]–ŠTG9Ý$ÊûýÄ—´ŽÐ§8k%õKZ“ ´J©5R”*£½ÇxÎ×®X˜°¿À¬ÑÅ´NÛ]$èQ÷'Ô̵sx wÇ[_-×;W⨸©g¸º: ‹V$Êš!XÃo÷„$¡Aú}l»â8¨´a$êåénõ Ó}@}ØÛ7°™‘*\·Á 1k‚L½å¬9$Çr>µpã¾€$g³MÁ}géMñƒ3S~ÚSÆNì5F¶ÅŽ +¬UÇïºÎ^—©¯æ§«‡Ñ>`{·6yÛµ¼.D_G)ÇŽ¹]&e€¡hGN|d +9.æ¥oAP n ÷84m÷i¡Ál–†ø…¢´œ@LËOœŸ +é(Æ®†[NWeFru”>ù„=³ðÆÚ ŽJ¶mœqžIJpBAûÃDÍûÉDàéâì¾l»æ‘W$Ì4\º$9Sˆrõ${ÈR™º÷=SQ–û˜övuU¹¯jýåNÛÓs‹‹œ|ˆ‚'¬î¹ùì®w ìÛÖütA&Ðý þ̈§nd€>òPz Ìšº«—³ñtSóµF>¯(|HÒÇDÑäQJ_¹]Fà®+‡U-‘*gÒ­x¹ öØ™b@S»O‡âß=-ìØ‚LdŒŸD“P£ÐOÚSUŸPi?T‹å`þDÕGe¾IÛóîžYþ8|/í»Â},;zàþÛ ¿+Œv—Q¶„'Ñzí\¬ä»=vNV T‚.A¾\m¤eñC(ÓŽü0ù +ÝõóŸÑM%ƒ“ˆd*Q‡š(@ç´ØVæ‹„¡¿h‰VËSòð"óœF¢Ô£ìË5ÒÏF#B4«‘”eùƒó×_³Ì†Æ¾âôÜôgXeš9Nßs¼…)„þ]Ãó?‘P&£_sLýDâw’ù©Žf—¡I,Ã-¡¯²´> endobj +4404 0 obj << +/D [4402 0 R /XYZ 85.039 786.531 null] +>> endobj +594 0 obj << +/D [4402 0 R /XYZ 85.039 575.671 null] +>> endobj +4405 0 obj << +/D [4402 0 R /XYZ 85.039 554.474 null] +>> endobj +4401 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4408 0 obj << +/Length 3536 +/Filter /FlateDecode +>> +stream +xÚ­Érã6öî¯Ðm¨ªˆ&®G·íÎ8/i¹Ó3•ä@K´Ì´D*$e·ÿ~Þ’(©+“r¹ËÛ@<øS£$t=Žâ$rC­F³Õ™7ZÀÈgJ &2éÁ|x<;ÿ#幩—ŽŸí:©ç†i4zœÿæ\þûâáñúÓx¢µv”rÇ“8Nœ‹±Ÿ8——÷Ÿïq$pnî>b×ý§Û±‚ÑD;7÷w! =Æ-$Ô,-"ÜŸÀ9ì +D§j¹]Ða³'h.sînå˜ØΞ‹eÑâ~ï¼*q~‘ÀÔñL*îGÆe5°§ V+à…œ./gõ;Ž´tÀ9÷Z ·p¾YVå¢X;7eÃÓ3Äæ 'œŽ; ”‡2 ‡g`7Ë·ûg7c7Ë|Qµ?ó¢íñox)!¸Ìü".í¨–&]bjõö_ƒý¶þ³Ö¤·Ø¾-ð4IbwD²U{f)A½ãæX¼Ô‰SE˜Á­Cí±Ÿ”U‡ÊMaó>××YÓ¼¡ÂU5Ù[P¤¬œ“\¢$,\š: æ·hT¶õ«g ÇÐ@Ç[Af.K•YÏyœÅ½ƒÏ¹‡Ä›©œsÌòœ U©Ê„5LRçËK^çÝ2¢3h¬¶Ðg!†Ll¶ë|Bª=ž£)kr]m/2 +4™l*®P­ÉN±”ÓR‹¢iëwüŠÐÌ%HìEnWÌyd ‡G¢ò—=ÿ–)Ú曎­Žè Þ¯xfl|âΙ<Ÿ£UTÊy|…£+Â0+å“PËZþ@2âòt:ìÈÙ÷gÒÊ®Ì[6†i_å(UY]Ÿ¡ÁiŒQóRm–Âh©[KÂS¡—ÀÎyÑp.Wò ‹Žß½Ð{ª«¯tÖ¾÷Wåò[,s°ÎlKeO^A°4ï붃SŽY8!†`ïÛ˜œ©,"‚-ñVC¸n;{OŒ¼g¼4jö{Å3ã1a€½§ z³Á¿üî)-dá‘L~6m5©ó}â¡l`|þl¶ …ŶO C»ïúEÏúÅÌ7ë5Asð‘„{úîÓ•—M¢îxÐ6(luÃl ?j-Š£‘B\AKâ½Ì‚3ƒÞZ“‡½ý†’‡þ~(ƒØıc­ F¡Ø±íïHäÉпa£¬6²ºT'ˆäXíÀ¶µ·Æ"ã²_³I:˜[WyWe7gcBoŽdƒ%²ó˜5Ævd‡$´Ã‘YV +Øþ6MË9” Ýgb@õ÷/9×¢"?¹`P²{è¾$Å6"wûÛM:V{0”WIä‘\Þz@‡åÍ·£Š¼íí7$oýý:y#"qºƒ”Ý1¬ w“”!¹l6ƒ¤k«ÚäãYÉùŠâ¸7ïÒ3 (KÕªªßù»¨dœ“¤¯‡cT~Bá{@G @§plCÀÝýÐÛ«\üJ çŠc«!ÿj9†X_E2ñ«Í–_òÑwÅ¿/ÔÇk5+– Œ‚£7 ]¢sÉ®ÛÕÉPº« Ê­Ô ƒ&)Ôð¡ïÔ´Ô3é7Ú”0 è‰Bg“1°É %ÜÁÆn\}Å3/; dGÀ 7£•ƒY¡d€MÓkgiä—Z ÐfŠæm¶6rÅŒœSßH f’ƒ’û%¶Òa+Jªk"ÉjÝZŽ÷l¸ŽÓÎS 3Ÿ+ip”† v…Œ³Ž$9tÂxÒ­ç2 !ŽKÍÙ5$ìšwÈ(¢'†¾å‚ÂÈRŒœ‡%æÆ4M3c( ½ÓY7< ŽóJàåìÏZzLÞ‚“‹f?1b-ÑÌer¦…¹‹•sÀó°ÙñBWEñ ³Ó1;tÊìÛИÝýÍNo¿ëÃyËÏÚóÝ(qÛ†Bco«êÉ¥ŠȬ•R$y [ù3þó)ëà›jSÛB¯I¢´ØŒí ±9È'*7RÉq>õ€óÉàÓÑ …O{û ñ©¿ßßã“¡ÏëÊW+¸†ÉµgEClüïÃÕåù‡«K¨˜ÅyÝUÿ†tCnãGG3ÌáLCG¾ >c'Óð¿#Ó(ј¡CR¤ÊØ‚qÒ!þ +Í'žSL6tä¹Qâÿ¿É†|×÷ÒÂ%@§„«[ë°píî7(\½ýþ‰àc’u;»ý`‚ÂùÖ +Ú¹»—Û¾ÁòŠv¤ÂEa"‰,…‰‰>Žk¤gt‚!æ?æ;Žìf¸±³Ù 3ºÍ>7]42[ ­‡*G˜‹Tt™VmÊÉÑ!!‘šßLšS¿³n«ž5·Î% .«E–h.ÚõAV(ð3JàEt„tŠÇ64ìØÝo½ý>sˆ²yÁßânåŒ}š†äÍšDSÔ“ÉH›/{ù63© +FûÚø»p7Ʋ–Ƈýb6涢ÁÁ€ï…Bä©wr„^UOÔœ*zÜT{ÇèRŠÐW‚‰ñ%]†­å«Ëh‰ÿ<‹Î”ptº<ä{üx¯rõ`¬ïQnŠÄè|‰™–×øò<¡çÜfëµ-(€?ù¨¹uƒ„`’S%å¤X¼aÇô„©“·èuÈÿäyÉS1úœrÁ9ÂÞì¥a$²»•Å·CØÇžëùÁqì;˜é7؇ÊCö¼×½ ãÛaõYÃ@§CsþsA¡ÅÆؼÕøkƒcu§1³8î¥Zf¹¹ MľõÇQ§>ß\¡z8FΟRŠE»)-D|ýý_èZw(Cí®¤ü0‚ô;àÆ9ÿð3lqN"`ˆ ®Hån?$Dü0t¦yw?o/lqàÆܘ"~*¸¡è "5e¤\Y+[áOo¹¶ÉðkajÌÙleçv75û[•\ñT§¸hxÈH#4‡1ôù¥Í}-Íç’QåìIAàßö¯ +Ù },j›ôb8B^à-ò’«hF.1¤Ä1½¸åO>Ä¿˜Íì턽Hþ[zNq¤Å +²õ¬¥«x¥x@S a#2eš¸w‡AÕÛnÆä Zœc­e^E%‡À¹hxr¯< =65Àö|Þ¿hs»û ÷EŒDäl%F"ˆý]zcC/é„|¢,ènb ¨–[à¥|Ù7FO æÜß+ÔÀ>æå¥ï Ànóú9›É|*1ÁPóZe—lHf"_^Xø½§z@:à¥jdÊý”M`û¦ä_y´}ƒˆÔÑQ*b©=ž‹[ÐòC™‡ >>µÀZÓŒò9øÆ-I= =$£Ð=T­ßZFëߧÉÁûªîž  gGj{š’ iõÎÄ’½ûHÙ5A5E%Á†y-ÍÏ&¾¥ÐV!z¦Ç YèI‘ÉZÌËý{?¦®—†rïWÌÑtò[ t§^зcäåðú_{‘€NüT;‹bÎ+o¹\˜ÀVžÜÖ×,A(-©¨Ï¯uh¢îOŒbÈLµLlVO.öy`ƒ ”§m‡%7_Ñã³%‡RÈܣΟÉÉÛ!ß<.ÂS/øAZÖd&qŠ)ø,‡}g£—h7¶/93¾¢¯6-—æºHš‚l¥öi@eÂɾƒ‰™Qkãî†gs^‰O…ö«$Ë0ôöÒùaêØu„JíÚIz®±|…­!}©!/mM%‘Ý‘þþ›$SmÝ@–à_›·‡ÿñª ƒÄM“wC¡‚æ0ˆ\î8Ô ¤IzàÄÿæÊsMendstream +endobj +4407 0 obj << +/Type /Page +/Contents 4408 0 R +/Resources 4406 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4390 0 R +>> endobj +4409 0 obj << +/D [4407 0 R /XYZ 85.039 786.531 null] +>> endobj +598 0 obj << +/D [4407 0 R /XYZ 85.039 547.705 null] +>> endobj +4410 0 obj << +/D [4407 0 R /XYZ 85.039 524.989 null] +>> endobj +602 0 obj << +/D [4407 0 R /XYZ 85.039 373.626 null] +>> endobj +4411 0 obj << +/D [4407 0 R /XYZ 85.039 353.637 null] +>> endobj +606 0 obj << +/D [4407 0 R /XYZ 85.039 284.175 null] +>> endobj +4412 0 obj << +/D [4407 0 R /XYZ 85.039 262.979 null] +>> endobj +4406 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F14 2895 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4415 0 obj << +/Length 2942 +/Filter /FlateDecode +>> +stream +xÚµÛrÛ¸õÝ_¡‡Î¬41$@€dÞo²õ6qÒXžíÌvh‰¶Øð⥨¸þûžx‘('›¤£Às¿ÁÁ̇_0‹çëdÅÖ3:˜­Ë3v+¿œ±åæÕêìùÎßKüd¶ºíÎI|Ï$v¶Úü>?ÿûË«×K­õ<¼Å2ŠâùË…Šçççï¯/W¸Î/.ßàÔûï¬Æz¾ºxÉk?ã +Ì…ó.¼|µX̾¾Zü±úõìõªÃs@I 5bùçÙïø³ Pôë™ïé$ž=ÀØ÷‚$™•g¡Ñž µ¼gWgÿìÎâµpÆ»¦˜â –Aâ%Ê<Í8k=ëÛŽq +VCO‡ÊÓšEÆx6ŒˆsÀ, ì2aÄÅk x]ï+·ÀkçïÒ*½Ëʬ¢÷ø“óÆþ¼.v§xc”›øid{B60)wÈêÀS‰!d¯Ò¥t“.õb©@h÷€mSãÜç|ã ÑÞñZ‹Ó !® +ôâß¾ñü d§c"ÞoaÝð¸d’ñ´¬ÂsZ>¢¾åõë}©áÙ´Úð L×ø½mGUƒÂÔRXJç~ÁxÁ|µÍè5C6w–Ê:!j;yÕL&Çë´(² î{þÆØç"íÅ 2Ù• ­æ7÷éOyø§mè~(ðHËñ‘Ê÷¬uGÞƒèÕ|sCl“·g†Ê³q"V`ËKÄ[Ï[bOƒ,‹Õ€HZÌ{Z÷ÈÄN¨ ƒo²ÏÈFšB¾Ô÷%;!Ì îlå<ÒÏÙRù ç¡ñ÷ò=¸eáÿ’A:iÝÒѳ>£gEf[87¿ç…¼â…1fEá‰[Ò!€(«çÙà£À®Êä„àõ!Gºä冖dGÊÕùÛç+üà?ø;¿\_ •ÇèÎRø¢ž¶üRÈÚ§¿—¨³û5"»ˆü“p™7ËàÝ?âCdwtˆš_®B^ü¹&n¤dðWìö½ŸzWu(XÁ|üÇyгÆyäµC°K¢ðE°Ëi뇑ÐE08v²€Q¬ƒ†Sa2РÇz¶ìçv:Ï@(w@ÄÏÍIyk«…$@¾aNº$ÅU(õjÑå1â#AçuŠHž&ùv"ûýO)@HÁr¦6› SC…Å=.9D÷öch ã(úfRûí§)$!«Ò›b’PÌ+âˆ$âdü›¨o¤ìwÙï‚N"‰æ; t!%ì!±Æ ƒÿ#±6GðüfbûýO+@äƒ2ª¡bÎ2áyy˜¾};匴gÃcÚCÒ)âÂØ ìw×ï‚8B¹éÁtåU ¬òʾ”£ÄYÕ~'œY̘ UZ,«N, N,¤§Ñìí¨É&yj³ïóÍa@Yjï¬S—ˆ°’Pm×”i1rìÂåÿt(ºÄøQJKIXôÈÉj/4€8!?æ¾Øß ®R‚£±™€ï‹ ]½{Å™¾Íٺɦº#ˉ¾ÁÖ£3 ÎüÖŽÙ™ëÆaÈ#Á }^;O‹}oIœÛâh96½mÞº*¶Ý7=ÿ1༿ï¼t§QÍàÄP‰ôº¯óS..¾Š×—Ø +1òØ‘•è9:nw|Ìî3lo Ì·œöò¹@Æ„J +¢ÐÑ 3Žë2ÏåÒu©v°kë&“oS·‰IzP9<ÃѪ°—)Î ‹EÊb'’vbÊ}¬W’Îiì‰&¸:u@¼féð­«Ô³aÍóD±)ª´èÜ@ßìé¾;êúŒÊ€ W×Äý¶í+FjOæ”S®_sI»á)ŸaSÒŠncâ’l\0ž'¸œŒcœ©Q ŠGžN‹ÂU¸ÆxSsì.ð[~öœ£Ö©,ÒÞŠ_ðžÔý”$G¿k9|‰)*±ìêeìøà楈UIuÕoÐG¸ Öé`c›ºÖ"nJåèúžš?u…Þ'Òænßõæ¸^A…ñÅ5Šû#™cÓîQÊ:µ+Œ`L÷ˆ-ì5ª´$(Ð)ÜQï\f„¡4>¥*Q@ò`Ï/ùnË#ªÑ`+ç6P¹ï¯}`4é‚Ž©è…] w(j¦98É[uìlŽÃ[IKß©dþq< ’¾å c~ƽ qGiøÄ Ahr€xðaYG³‡NiQÔŠF[ÙñÔ¡(úœR;^ë}gpȲj;Fm‘)6ܺÈ70Sñc®3R#3p­a’ú]ݶÎ>8£ûÊOävýeÏl’$ÆõŨ‘cAù)¿«¯©çË· Zû‰ß\:g]kßA8;Å T‹´t")rj¯Êm>¯//þÅ£}ßj#|°£&@=«yA\ÇÌÀJlã#Ÿu²9«¼è‹ÍYÓu“úæìBzßÇýYÝõg×l#eZm†·u±e÷˜BãyáxÀù0ê­ +Æé¦Ì«ÜÕ6t“wº#dzÁ} ‰7Œw9ìÇ >°‘:2¶l¹Í\KmbMäÓ¹rápg”ŠºL³G]KÍÍÒ¾3GýyfËÉ0Óçº6ž—u#w›¬MóbÇÓÔÔ„ÉŽ7â&D­"Ï×ñ_¸ðĆÓ&»¥Ò >ź9«ˆQxæž #q÷OÖ; À>)¢ÇÔw¢8~é® •—Dãæ’=wAÕµÃ&.g6&Oßÿ`N_$%ðD†÷Hêð /y¾äõE³s ÃˤSI $ÎOcÚAžcº«(¼ã¯¿r¶^dákŒBª#=ºÅWN–#§¼¿ôi$ì4 +#Ý'n¸tƒÖ$ãaBZ÷6QyutéYäÚÝm(²jE‡×-¤@BàÀîoR‰Í.þÓ½ìT´ ¹÷ÿ +7µ2ß×JQchúþÓŸ‰-|×Ðt*Æ^«é‹INÂFÚ!ƒT%öa£cÏÄzãÿ8ÁQendstream +endobj +4414 0 obj << +/Type /Page +/Contents 4415 0 R +/Resources 4413 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4390 0 R +>> endobj +4416 0 obj << +/D [4414 0 R /XYZ 85.039 786.531 null] +>> endobj +610 0 obj << +/D [4414 0 R /XYZ 85.039 766.606 null] +>> endobj +4417 0 obj << +/D [4414 0 R /XYZ 85.039 742.055 null] +>> endobj +614 0 obj << +/D [4414 0 R /XYZ 85.039 661.833 null] +>> endobj +4418 0 obj << +/D [4414 0 R /XYZ 85.039 638.515 null] +>> endobj +618 0 obj << +/D [4414 0 R /XYZ 85.039 103.595 null] +>> endobj +4419 0 obj << +/D [4414 0 R /XYZ 85.039 83.004 null] +>> endobj +4413 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F66 3242 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4422 0 obj << +/Length 2115 +/Filter /FlateDecode +>> +stream +xÚ­Ùr›Èö]_¡‡û€ª¦išEU÷Á‰í‰3qâ+•©Êä¡H¦Ì¢ ÈŽÿ~ÎÒ  g2K¹dš>ûÒ§ÏAL]øÓH9®Œ§a8JŠé²œ¸Ó5@~™ƒa{çõbrvøSá:±O«Oì:*¦‹ô«õæíùíâòÓÌ–RZB83; #ë|æEÖ›7?X Ä·®?\áÖÇO73ÐHZ‹ëvØó­Î_ÏlÀ¹Ä˻ٷŻÉåbÐsÏ!%jùÿÉ×oî4‹ÞM\GÆÑô Ö®#âxZN|%åKó^Lî&ÿx1ÌŸ2Õ˜S|/p¼Òu¢ÈÃñ„‰–côBú &8U)'ðÃÁ©Bí9UÈØQ‘šöHèU¦`þ+öj“•è‘Ýôˆÿ2ö[Ý0¼¬g6ì"E¾zæ½-¼´H•$½Ä·e½­CGà#ß +á9RxÓÐ÷wÜ#?gíŽþÖ$´¶ÈÛ.¯@¥56¢½ Ο è©èL:u“rÜ$\z +Kï^Ütn4â\8 ¦¤˜ÀÁÆÁ¡<‚ „‚CyÓeÍ‹GË®í»ýº((j@öÔßD@†øÄÓŽÏì».7…¡BѾrzâÆîÀíã—6ój…‚†ÜczÝq\‡|7¶Ú®n²ÔlDm.=K¸Nt”­.Ùü>gŸP0ºš´ZUM-ÔÇ»{úZ¡Kçi‡…!4˜† 4[IjB ® äק€ˆ.˾çH›ï…ÒMŸ„HyI“ 4 zЩ0huÂJ}½mOOßÓ ý>¬“Ýt¶Îû¹öi4¶†ˆ]P Zß{rë$&ÐýÑ«MV¾Ð†ÒËÞ*\nxvoÛœYØêÇ +X¶ æÉ©è«OìA :^Àdo¶(m· M›ž}*Ú%p6LG@0Ò<Âîi>¶¯¸)Mp¼2d{=ûI¯Ú3A.4”vùÆä…rGE @PÚâ“NbB£kVìݽ‰R)†L¿Â¯‰µÉW¤åƽO¬†¾¤˜"úö( IÑmè(þ58ŠÔI“þ;‡Ó³”RBêDóTÐŽ5ÀîAïûu]Ô‰.Zn,ûæx%ÆÇj¬Ð0%=PYÀ—ÿš»3Å!`~–uË3X$úŒ)˜;–Ó“pJX©}B¼Þfm÷BÙ•Êñù‹ìqÕ…Ÿì?«ýý¯µCíö#'Ž¼ñÒ­¼Ð  ®eд8™jendstream +endobj +4421 0 obj << +/Type /Page +/Contents 4422 0 R +/Resources 4420 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4426 0 R +/Annots [ 4424 0 R ] +>> endobj +4424 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [437.587 654.697 464.58 666.386] +/Subtype /Link +/A << /S /GoTo /D (XMLpassdb) >> +>> endobj +4423 0 obj << +/D [4421 0 R /XYZ 85.039 786.531 null] +>> endobj +622 0 obj << +/D [4421 0 R /XYZ 85.039 286.107 null] +>> endobj +4425 0 obj << +/D [4421 0 R /XYZ 85.039 257.371 null] +>> endobj +4420 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4430 0 obj << +/Length 3671 +/Filter /FlateDecode +>> +stream +xÚ¥ZK“Û6¾Ï¯PåªÊ⟩ÚÃø‘¬S±Çk+ëC’%r4¬P¤BRž™¿ýJ”|ØryH  Ñèþúù þù‹4r=•-’4v#å/¶ûo±ƒž_n|¡X ÉÊ¢y½¾¹ý9¾çf^¶X?˜y2ϲx±.þpÞüûîÓúÝçåJ)åø¾»\%IêÜ-ƒÔyóæþ÷kì ÷ƦûÏ–>ô¦ÊY¿¿ÿÈ}o±ÚBgw¯—+ ù„ï¾,ÿZÿzónmø´vâ+…\þsóÇ_Þ¢€ýzã¹*KOðî¹~–-ö7a¤Ü(Tò]ß|¹ù™‹ûšŠ¦Xù™›ÑuÁű{±\½¾›E +Î÷WùÁ"‰"7’ô†.leEžó©†¼j@(q ¢È|§|. @&ºÊÑHCù‘u”†#Ô‘"ŽîëX(QüpáEÎ7<š²ë«¶žc§}àÎ/ù»79våÐU%(¸éØÛ“U8ÇCÛÁß=6çC¯mýØÞîy‰á±”pLõ<7òšù&ïK”7J „°òáÜ"Ú“0„ã|Ž8¬®_–« œ¾%VJþjaÝŽ_ÿôü°$yôØ Fþðcx\Ê E”ðU—¸øíÏj"å4s£$–—ÛrØÞöù~“ßöûÍ!ïû§‚Mìfq&ƒ@^3ó®ù“i¯L˜‚ö§šÚ%­@åÝ4IXTaF]_õñÙ„~ìPV=6ôO(¼¶+¸£l¶Ý ö¨ÔTõü,ª>ßÔz"à+èP‰Ó´L€†ýá5¾'N&Lº­P’[™Nv:/±1öÈÌÔœòÄ%k0¥8SÎûfek‚l¯h`ŽÊe¨hjžÓZLtZ){îË;T®¸kÜËq;èÕqŽoUÎtZ!”D•/aʦ‘ËS2”ZP½ØÙò>¹áþ OðTi^óí–ô•ef“ÕÐÏéKä`ì–¾\T„1¥5Ž¹dóAwVa²¤v?ñÇ}ÃØÿÊLìøÌ-ý‹H|ß3ÐÓîIðQ  ÀkAèRò‹†Bp÷Á½€€q¬\?Ž¯" Es“ãȘTL“{Ä*mXp‰³bx~G0ÐYÜôi©<´2xm—Š°Š•Þ2è±4/l*Ì€§ôú¦FšË°+ßõ”6E^µËQ}«‘œÄûŠ7õ„œÙƪ¹CÀì»w§\qä&qbV#¶±£Û Ågkšze‘ŸïàtNq7l:x È©%V%èù?^ôûS~U‚¡øS~OĬi®s©ÒÔ Øm.+œñ‹?.ÅFO¬1‚àÅX#· ¢~˜1E8è$ÒtxV_ ˆ§ëéÀI‚Ò…€‚9AŶ=²ããÆËN{Iªxà[Ä¥G™§ç§v¿ ª>èO„¶ÿá=$"[ÁÁì+²ÀyÌûGÆ+¡žœ#˜, k4;Ä„´Ò욉T +Žœ qAÄy¶Yl™E8Ñ®çysìÔ¶lFè/Ôƒ“)eÖJÚ09?Ç Ý ƒK} z‘ÁæH“ÀM£pîHq€¡5D ¥œn˜¸I6uÑìüOÊ +n:²jìãȼpñmaTDÉw(:ìZžaxÔ ùÍ«ks}ðHñ€šÑÉzcyÏŸ„8~Ú)'/ÜXç!,\dΑ dNQ%÷P8 ÄGæƧžsµ@©šã¥óQŠÏGñ˜ñ2í±Ï›Bψ‡qæG4TF1$~8 šfe1„“h,ucM$g›œ­¨BÈZ®/È$çëM@^AT™F“õÖ1«X‡£]?ð·ñ³±ŽCT$±¼Ô-Fû7Æ6‡‘”âs"2Ê RäYIö&*:ƉpÊ’Ï«ÂQ-Àa®õ—ŠU¦á1#oƒqDb“xž D½Fn”#¯Ï¨ó‚hz<ùa3âBŒ8Ü0ÝuÏJØñWAÑ>¥cóÒlôü 1M˜B”JL#E˜“IßÊ?{œóñÚŒ +kÊšŒ'à˜ƒìrW¿ÕiÔ‚Ë9¯LtàcÂƹMKÃaýVÏT†þ²ýAÐß1?CsÅú˜æ{Æwe5m{'‹ÍšÞ¸Ø ZB‚ÆÎú šüTâùö¨sø›96KLְϵBTieBRLfcÍ#yÕsÅci%qBiÕè8„<ÇÙºœð´ –‘¸´”œ°KÙãg::gtRÅ4ÿ•ÖÖª6ÇÑ­Heê,ï‹çLóh®ä†¢2å©-È@ ;TéI)<.:ˆó=–ÏšEK£Û1ýÍfï¨x)+ŽRäŒAÅ?—5L`\ʼ‚§¸B»±CPê,óFØЋY…AŠ~ÌÊ%¸aö y£lBÎN`ê +™üFAdfû ÂÔ‚›¹Ø‡,ÅV¸Á‚¯íÊ"öAÄ’!»DœÿîÓ{=‹€TeÔ ZÍtÚ€‚žW©\<§ÛÇZç4;òªŸ CIÓömSK"‰‹#2>†-£·“°Ûe¼YOªž=­A‘à¾ÅF«d¾…¶œ:t'”zÓ@ñ ®ò¬Qº†NwFãî¦Õ +^õcœ”¿ŸŒòY97‹÷ã-ká$_㙥Ì.#-B[ÛéØ©íÚ.×ñ”q+ÚP) ª4–“1t›»¿TžW^æÆ^pµ’mÑ\.ÏYâ&I<)Ï+)ÏÃù Èæ9Яq`Ñ\®¥IB÷gËD¯;[Šö±ä1¹Âë®)«Ø  ¾ïsS嬨”€ý è“ Ûå†?¨¡bþŒœH‡ßB?]šÿÀªkŒ= ɯ(ÔÒ·ró0ÏT9ïÙ{RHN=TÉ$4²…Br®T\îîGa¹+ÿ9V„êvâˉŸ¡4‡nzJ¤(Ú1úù?Þ¯yÒQ\ú.¸Ù(­Ü÷È’Öò6"^ñK‡ƒW3¦¸ïXT¦‹›À’iÌ L¨&€…Æ òø…G{(b‹¾™À’PÃîP`E%§fÕå¾kº š¢’ $>F¼þ¢^r2›ºœQ(Š?SAÄm^"+çø>‹‡ÂWÙ?¾r­ç›ô|2æ}ûúí›q:¹ÃX>ÐÖF3?ïèfMäPs :½Š%²ƒQâ¹û% 8wµ)¤îo˜Gr@& ³ˆ-Çu%à³`/‘MZÕÕÀ!ù8ƒÍ×D8n˜ÉOœlÿØë1ò“k +±2aTËp´³ùyŸãÇ!ø¯«.g$¹ìóüH¹~N|^(>8½¤3ÔV8ÇJä¹I–]çe¤¹ìþ|¸Qéb©%†ûæ…7ñC"‹jL7$QÀgA°ÉZB]æ ­ð=„ð]ïÓ²S$)FŸƒŸd®¼âL„L¿Fó$ß"„â¡xæÇ!ǃ‡4ŽëYÊ®›Ô‘ç<€±FŽ?m0^ÒÔªöV¡Ãú ”¸Ù›Î7Zë×Ͷ>š­ýt©jå{ {½^¶²ˆ.×­4Ñw +WW”ÊÕÙzs¥+{½;¬ "«\ÿøÌWR‘ +ÆÓá¼^²nsLã/l˜‹¯°½jä +ËÔ¶ÂïŽ~ŒæK‚ϯt)Ù“°xþÚÅ÷;šÝÔ\Î5ìíiqˆãi¶[™ÔÅ’d¹*üÎUåHsùh…æ;'{m59ØÓÅæÎÕZìNò:—¼‘ëÖ ÿÉ·|‚ð‰¿S"·7Éô.&‘ò/BO™…ÿ| +ÿׯE hb¹;½ Ê|€|CÍ n9KOŽT +rQ3ÿkKendstream +endobj +4429 0 obj << +/Type /Page +/Contents 4430 0 R +/Resources 4428 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4426 0 R +/Annots [ 4434 0 R ] +>> endobj +4434 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [264.771 627.931 385.537 639.62] +/Subtype/Link/A<> +>> endobj +4431 0 obj << +/D [4429 0 R /XYZ 85.039 786.531 null] +>> endobj +626 0 obj << +/D [4429 0 R /XYZ 85.039 766.606 null] +>> endobj +4432 0 obj << +/D [4429 0 R /XYZ 85.039 748.602 null] +>> endobj +630 0 obj << +/D [4429 0 R /XYZ 85.039 663.166 null] +>> endobj +4433 0 obj << +/D [4429 0 R /XYZ 85.039 642.273 null] +>> endobj +634 0 obj << +/D [4429 0 R /XYZ 85.039 309.602 null] +>> endobj +4435 0 obj << +/D [4429 0 R /XYZ 85.039 290.73 null] +>> endobj +638 0 obj << +/D [4429 0 R /XYZ 85.039 164.95 null] +>> endobj +4436 0 obj << +/D [4429 0 R /XYZ 85.039 143.754 null] +>> endobj +4428 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4439 0 obj << +/Length 3629 +/Filter /FlateDecode +>> +stream +xÚ¥koã6ò{~…Q° +°R$‘zõp¸K“}¤—Mrk/Ú¢íÅ–mueË•äfóïo¤DI~wbQäp8Λò&.üy“8p\‘L¢8táMæ› w²‚‘ž‚°ˆmÀü0»¸zʉç:‰›LfËOâ:ANf‹_­›×O³wŸ/m!„åyÎ¥E±u}éÇÖÍÍã—‡ŽHëîá=v=~þtéÁh,¬ÙÝãÝâôIk†×?\Ú3ÀwÓËßg?^¼›µt;ñ„@*ÿ¼øõww²€ýxá:"‰'/Ðv/I&› 'B½Ó‹ÿ´¸xLNxÖ!¦"v‚XŒ¹âW<_8¾ïM¢ pB[fëìÒ–ž´jÜL6Çßr [ZpwÞdlÖ<Ýr×ó¥íGVƽ霧lv0§Èëu¶ÐPÀ¬WnïaŒðçˆyÅ÷ÌÎ'~{˜N±!¬t»àÆñø¿lhZx±/I†µƒlŸØj‹¶‡|Jh_÷žêf¾õ®”Uu^nkî)—øô¬fÕ¸“@Xˆ5®à7­òLÁÑæhãÜm1<7)m‡(Y0ÄÞ«rÃO()×·Š“rÙ %/ø“V +Ñonà¥GFžã{ >Òw\}æ8P­Ägãô5´m€Óé óô‡8‘Kë¦Ù}uÅ\A °Q///Î.]μÜ\ ©ô@Ø¢0œD~LI¦†±  ’9À„K_PKYŸJd–A·Èâ²Ú¤ &÷¥|.å¾á÷f­€;aþÍõäjOgÛÍC`øVžhb`íÒ9Ñ×Ë ´ÒñÈ&e±&†EÒ‘ìñ«_ZËŸäÙÁn¸÷»VðA<ÞòØôµf=ƒñëÅ&ßæZcš–è¿Ãp[²*-Ê›´j² +qÈÐzÀ7Ÿ‰Øe¹xU3n° ÷˜îšg†ßÓ\&> Úy.éq:Ï· ¦BºÖÃJîwâ’ +f©V¡aL¬¦Š†/"Ç…#Ž\xtF~5°ÝAEd€‘¤ù Ô€×éÚHK^¯È_”[$ôêŸ?oŠ»Å?`س±#ƒÄ·eâÙáHùÂÀI|Ù£} Õä$Å2LœPø&ÅËRsl]‚°)µ‹€êiÝM]â–¯x“üúö•[øŠÒ]^‚̽¨¤*ØJq›Z5Já8¡4KÙ~j/ ½iív^7U Éê£fÐåoM°´Û{Û/µ«ÖÞ£®Y~”evF¦Åóáù“PN$çý§rõ‡ü'ö%ô¢£hh’ h¸¥ ûXlM“ÀZ¾ôÛS| ×IPÀ”y‘&@¹ðÈe3ûP2ÿQkFeðÖdË=ùsâ9®LÁ F›ÈïvEWwor[¡“­ŒÖîð²€Æ¦Õ ` â€Ð`/Tñ4œ£„˜€ãuæÒo´@¡¨ ø Ó÷¥ùÆó¬øíFºyNáA*'¸»ž¯éì7©Ã®_ÃÙ +€„­aóÂN?§M"<óX´@ÖEàZ[Bü‚/`>çÚî©å¦i­aÃpÔ®¹½-UgkÇaö–»-1„x¯u#ÛÒö$e±Ù‹·ïy;‡;ÉQÂLol‡Ë<ùœÏ9'p˜†Dþïò*ä%àÿqÚÿ©r¦²ÄN,Å鈢['ötDŠR&ßZ(vï7pl©;#Ï8'cÿ̇fb¸¶†ŠfŸ{òì‰ c%Ï> #bª”°—(u¯<Àö5t#yExŸ¦Dðœ¶ø«£¡¨‘)ÐÖ<Ç2ØÇî~‘7(å6- +&ÇêŽ<sB˳•ÀùQÀÐLäNI8èÄËÃÍc+ž‚N=>at8¹ÓÖŒ*­ë¾Ä/Œå@F‘DÓ +¾°ZrÓ"Þ´ v§‹W~ï4P°&ûp¬šäœÇT4ÕÆ:DbŸ¥s ¡Â{|Çx†ëcK²kjEÐV)ð:Õ=ü H½¬¾*Ücý<,9®N§´ã>µofFJÈy'¸ë¢Èxp¾ÇˆDÐÕ)b§p>ø%õЈÑ%í°òS˜,@*Ú=hÈ"fÞìÛSªpä€Ï[¸9*+â[öè8f|h'Ì-t?`¬—øÔ‚"0Z&agõmjÈAkÏ#Q‚„HÜýà ˆ6D"Ù3D±Fa‹‰/­($äó§dñz=Ã'ÀvÆAo½Ç]çtpû÷½€É…Ø.äLnاåxŒ­ GdõrÄ!N#GÄL°ÜeÛb‘î Â^²A6܃Pío|á3èRÌÓºN Ä™S@ç¬ÃuüÀ†ë<0c½ü‰r¥mÖðz(KÀ¡Û¨WœšÆàày†aoGgÎSA¨îŸç§qžùŽ(wà¿ž§»Œ2üî4ûuhpé5ÌF*—/¥p’„ýÅì•^Ù„t¶1'ŸˆæP±Ïp¸ðZ±E ŸZ鸬ÅË:oMÃbÎécØQ…Qñið$mÚ°;×Y±CõW$¤lÎŽÙ ?‚,/:#ÒÐ ‘V@çDúÔ‚Z¤‡ëic=,— }Ç…½õŽÊ¥†>³ô'.Ýž°ýt Œ¦ª…­m ýñ?ÍGfÇ…<+ŒN²CÃœ&J€ñ“®èµÁ†lýZËŠŸh©ºÃþÉë\-%KÑ É¨JŒÓýq&1qã3òÓtN~N-¨åg¸ÞAù1Ö£r²ð‹êéðäòÁÊ,½y±¥xÔF +Â|·­Íbâ)²Oîq³¨ OS>ĉ”ßݾ»¾ÿy$]À÷ ³4Ìé5…©JDoͦÍCSTÆáuÁÌ"ã¤YI±.Õ$‘gma=«j…En6dr´Ž–¯*-‹(³ùVUböTìTÆ2e©åœí&E┿÷ã‘Û’tƒÚ7%+ åë¿*7,5á§Ê®;G.LDì;I䟼ú1`ˆÏ¾kJ¥Ò©±”´qÏs¤‹‚PcEY&ÖtOµNd… š +?gña„û„wÚg‚ßæBrøÉaâH_œ&¹ƒ9 HšäºCBß#EŒoa𥎇 æÆÕˆ*|· U(G• ˜Ñ¦Pì‹Ò< ¢Ë€ØVÑ·â0nstBŒ@šàCQl·0ûãt‘¯|ÂF=l„£ì ûThÍ‹¼­à{‘?“dQ‚®ï…ìX +kfa$œlêê áÑŒ‹5GfMJR¨Åt¨ÞrPYj=d ±ÔØï›ú|Ò„É|,{á ¾Óî°aîÎÒÄÛ;<ø±T÷G° Ž_8Ê|ËEY8ªÿÂÄT7Œ°^„ÊDZÔÕ†S¥r°¼P}YE:Ö…pL Ÿõª6* ¾:¤ZDÇS¬P• ÝòDB[éÒBÙ•'¾)¤OFvIX÷Ïm}ZÕ·¡W4¾élûþÂ-¥£˜ü}:)@!B@Ýä!ð,Üè]²)hÛ?PóàDöü°_ñf*uÁBÇQQ‰g«†–é/÷ÛæØV£Ä™§·ÚÁ·Þ>d=q"ú±,œ®ï[¬5ò¶øT BP%Ó÷»:¶Û8sÎ"ÌÆ^e’ˆ„íùìŒcîGÉ/:@B°»»í -T\¯e@ËÁ@“aœÎÂPU;– „#_©<Û£æ!Xm k†,èÛƒV‚koR(Jíz¸}¼²Š£°‘+}æy|ªÖ}¼»}Cñ®ºÝ‰œPxýëú‚#›©5ÚÏ‚bã[(€B·¿V3¦†Åãú°,Ã0UÆa…ãm>V÷:{£Ä… ä5Oh¿ŒZaÝL/Wr³¶ˆXíÔöéËF߯»mPd' W:–”à•å=~4¢2Át[)Þ0PÏZ5y/(ùÙ•à @èòÛr.d8%%|ËÛát;}Ëá•„^žö¹É›i• ä*†T{ïµfÞg•-—høš*'¤j•»´13ìCË€‘áˆýX†íúÐÇ2=ŒHóÊ¿þËt³XÈ•< ž‰!d3©V<ÈIxN…›"päá¢2ü·7ÿû”m 'c'9v%ø Û‘ÔÄ ½I2ŠÅÕ‡–cŠÿ üõè>endstream +endobj +4438 0 obj << +/Type /Page +/Contents 4439 0 R +/Resources 4437 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4426 0 R +/Annots [ 4441 0 R 4442 0 R 4443 0 R 4444 0 R 4445 0 R 4446 0 R 4447 0 R 4449 0 R 4451 0 R ] +>> endobj +4441 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [470.223 738.375 512.306 751.276] +/Subtype/Link/A<> +>> endobj +4442 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 724.825 187.762 737.727] +/Subtype/Link/A<> +>> endobj +4443 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [236.019 697.727 466.92 710.629] +/Subtype/Link/A<> +>> endobj +4444 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [205.71 470.662 345.156 482.654] +/Subtype/Link/A<> +>> endobj +4445 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [265.68 457.112 479.579 469.105] +/Subtype/Link/A<> +>> endobj +4446 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [161.013 424.339 303.763 436.029] +/Subtype/Link/A<> +>> endobj +4447 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [290.138 410.79 335.01 422.48] +/Subtype/Link/A<> +>> endobj +4449 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [405.626 307.184 509.276 318.874] +/Subtype /Link +/A << /S /GoTo /D (bugreport) >> +>> endobj +4451 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [232.649 62.109 313.884 73.799] +/Subtype/Link/A<> +>> endobj +4440 0 obj << +/D [4438 0 R /XYZ 85.039 786.531 null] +>> endobj +642 0 obj << +/D [4438 0 R /XYZ 85.039 382.972 null] +>> endobj +4448 0 obj << +/D [4438 0 R /XYZ 85.039 362.378 null] +>> endobj +646 0 obj << +/D [4438 0 R /XYZ 85.039 292.916 null] +>> endobj +4450 0 obj << +/D [4438 0 R /XYZ 85.039 272.321 null] +>> endobj +4437 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R /F20 2865 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4454 0 obj << +/Length 2572 +/Filter /FlateDecode +>> +stream +xÚ¥YÛnÛH}÷WÈC(À¢ÉæýÑq’Y{ÖV€fæ"i›‰TH*¶ÿ~ëTuS¤D%ì5««»ëzºªíÎúçÎâÀv¼dÅ¡xî,Ûœ9³GšùíÌÕ Ͳð¼[ž]| ý™ë؉“Ì–ý>‰cI8[æZW¿_þ±üp7_xžg¹®=_DQl]ÎUl]]Ý~¹YbÆ·®o>‚t{÷¯¹K³±g-¯oodî=fˆæ[KL\¾›/ˆçž?ÜÏÿ^~:û°ìåhâz¤üvöçßÎ,'>9¶—ijg;¶›$³Í™xvà{ú{}vöï~/™óg²jÊ(ÛAì[Å Vq•g+å΢ °C?b³|Ú‘ø-éæ Eú¥­üvO… xrÕW[âMù»}Îeö/Çõ‰ºfæÄ*e7 7ÓjNc½wW¶ìꆘ몦lxYG£²®„ÿù óÙ\EÖ“ÞaY¶kÙÁÕ‡ÉYúüT8{ýŠæm /]|ô†FYèáÂ…‘6ÊEÑeÛ´…–¼bdÆ0²c? õ¨`™®yEXœÏ~¤¬–Ôô}ß*[üdJã6Ý@UŠ°I7—DËêl#ëêÕ|Ör™¦³eŠtÈÚé£È[vƒðŒXätÒc¶Ð¢uýrsý +ï@Y»–Okä+ÍX´ö3Û^VD©›MÚÁ?®E™8Èšözý ÝýX¿¤ß¢Þt +lŒ{¿¼ûrµürwùyÊ ®íº†Ó˜¬È$”-4X“EsÏì0«Î~r(ø`)'¶22-h3R¸q°ºV.äºçˆËïe#¥ëõk?Å¿ã©3rÄs£ÅãÍ^!d¼0L¬ßkXø–+¾ÏålxÂå"*ec£wJµ$K`ËŠ&]˱HÉb‹âŽh°Â9SØÀ>Eþ†ð9Ñ\œd™¯«ÆXï¾N·B|.;=Í•[¶WÝ–/—QŽãÿìEóí:ÐʪȅÀÀ Ã;Fæ+å9‘=ÔM{sùÄqEè.¿>¹‘ø_…–›“Ûò±’å‰ÍG) +ïž¿ +'ýŽ£ÁWü.SûüÁW:i‰£üaü"yÈ+«\}:Oy`ʘòF¶˜ŸP$ï‘Š,Ä‘ïŠÅ|×·*Y_ˆKÒæU¦Yyšf 1ÏÓà§pF«Eü$L\ÿÂD|8á~ØÄ‹|:¼·XY‘aì +FœfÒL'˜m2†G6\t$h„DÇ†Ï cø BiJ½êRs¾{/ +`/\:<Ö8Ké¡‘@d8^€‹ãôÕãx$8‰”b¼?ãÖ Ùœq"þ+™^CU“ +ü0)£ðm…‰Ñ0B„o=òg·v?Ë /ƒÁÈØDgwÌP&Ø£|'€ )‰½ÍÕÕd¦;þؽù’è0þA Í]®]'4vÚ®íä+]Ø1zJ1a\ >K1÷¾ëæþ^ëG5ùø.«¶# ðÉ¡ŒÁGn°ç'TÉêÆþz€÷~„ú‘¨Ð”¡Š.iÎÞïeËö|Ϫä×Ä… Ð6éWVI¯EƒlÒ«5»BUDD-Ö@S¸°p`çT(à5™q#ÑT,W~{ó’ÎçBZa3‚qbRH'($J5âƒ(9ƒÑš‚~”6:áûY>úæú^Ïls.Vé Áp¬VUtýeÌß*]“V¦¦ÄaëQø–øM…h¿cKmužñmÓƒ[‡á.ëvMaŸè'‚PÙ*üac´gá@9ÃÀU¶çªY8vì)Ö—z!ߦƒ}ÛLú‰u a(šàAH·sWgcQí]Ž©2ð8u!±¿ž‚0ಮ4k›¶ºÆÁ—)åŒêp»•¢®Ø¤Âˆ­¼¨–߶¿hErHŠ» ›iwçv®’ðX6Rˆ ƒs®C]ÁrœbrõEƒmÔÉ Å“4/èÛâ —‘)Ì1‹YSÄE¹ðK®ï] Ž¼löÞ‚dý†Šì$NL7÷’n¶ë¢½øüž˜³4'ëVŸªŸ¤Ï’AîÑ Ð$~ÓѸÜ)÷ùÙí«i•÷/ožÚ—8 3<¬×ò`YrÓCR8C +wBÕÁ%ÖƒŽòù"ï´ôi3¾²ZY¼I¹ÜÀk¤–fòê^L6àû'j·Þˆ3~Ö¯]èÔÜÚåÂß÷Óåjýº'Eúë°` Wƒ•Û£¢ÿÖp½ºÕÝ¡>tÿµ†ù%?-ù4,\W P\Ƴ¹ÊŠCîØN¦±ìv‹^EªÞ£ÜÍ‹áªW¨x´é׊oP;X‘‘×\—NkÛíy»[ï— Ó»_ÑžZ1Ñ[zíËŸ×[Kú_4ø¿þôÖ7¨ÔŸ&±šîOE·Û ÃMµãJlþFw,òÿÎÍ>ôendstream +endobj +4453 0 obj << +/Type /Page +/Contents 4454 0 R +/Resources 4452 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4426 0 R +>> endobj +4455 0 obj << +/D [4453 0 R /XYZ 85.039 786.531 null] +>> endobj +650 0 obj << +/D [4453 0 R /XYZ 85.039 562.26 null] +>> endobj +4456 0 obj << +/D [4453 0 R /XYZ 85.039 541.666 null] +>> endobj +4452 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4459 0 obj << +/Length 1324 +/Filter /FlateDecode +>> +stream +xÚ¥]OÛHð=¿ÂR_ ¯?»R   §¶:mìMpk{ÃÚV ¿þfvÖiB EœPÈìì|n˜åÁ³âÈõ‚ÄÇ#7 +˜•–ÏZÁͧ3Ž!qvhNçƒãóQh1ÏM¼Äš/·rÏ’‘5ϾÚÿ:¹žŸÝ lÆÜ¡3ÇöÉÐí¯n§s¼ í‹é9¢®n¾ ÜÆ=¿¸šÒÝoÚs¼89:@3³Ùðûüóàl¾µsÇhåýàëwÏÊÀ£ÏÏ ’ØÚì¹,I¬rF…9ƒÙàï­,º -âê JÄn‡Q ¢¨0æ»ó­q¹£p¬ÃòîÝЉüÈVâ¾Í•ÈèÔHú®ÛõZª†ëlñïJ45/×›Š—è1hw—hay•‰"ns؇|JÔGu»8÷=¶ÖP“M}çbÀ³²{ÅÂ*Ï +Ç¥Z»}f‘Òª§Û >déÿú±õ{'Ænûý+1ò}×g[côJ÷ØS‹»_e‡&ÿŽÛØendstream +endobj +4458 0 obj << +/Type /Page +/Contents 4459 0 R +/Resources 4457 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4426 0 R +>> endobj +4460 0 obj << +/D [4458 0 R /XYZ 85.039 786.531 null] +>> endobj +654 0 obj << +/D [4458 0 R /XYZ 85.039 417.524 null] +>> endobj +4461 0 obj << +/D [4458 0 R /XYZ 85.039 396.93 null] +>> endobj +4457 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4464 0 obj << +/Length 2251 +/Filter /FlateDecode +>> +stream +xÚ¥YKsÛ8¾ûW¨*{ jC˜>Råƒ'›¤2‰'ÖÌa³9@"åh–"’ŠF³µÿ}»Ñ EJ”äZU*„n6>|ì >òàEŠy2…QÀ”ä£ÙòÊ=äWÜj¸VÅíèÜM®®ßþˆ{,öâÑdÞÚ‰=¦â`4I¾:¯ßÝ>LÞ|»RJ‡s6vÃ0rnÇ"r^¿þüÛ§ J|çý§·8õùË/cÒH:“÷Ÿ?‘ì%0ç;ÜÞ]ÐyÅ7ão“Wo&-ÎÎN¸”ˆòÇÕ×oÞ(}¸ò˜Œ£ÑÆãqÀS›¢Lì“ÿy||wûß™üç/q}§ïŠX¯ë%O>ʾüïç¿þþÚº~Ë{ÄÒÈ•ó"âuò=%§Yƒ{Tè(°ú.9!l.AAÂï Uàô&'ÕÓ±‹ZøÈOücÍí´×üMH•[•§4OK]§VÖ€·Ã'‚¯‚|qñBäU¦W+]áS›d`³Ç|ˆ)Rf†YWúèYªG°a@Ü™YÖnÏ‚0‚Y±D\K'8á4¨Æ-¦(ÍI”Ú*ÕÝY‘#1µU±SW(N1ßSýxÿþ-þåqLgV° …]$»Gïím°yÃý%ÕõTW#ªzçõ\âoÖ?_$ôÅýi?3ú\ä‹:KôŠ%‹ù9G‹ŒÕ{À.¹t×¢¦ñ"'µãÚÊ %+¹ïlqïúGI:)Ã=tŸ@ýÆ­¢p6ÆŸÆæ=]“@'éµ®S;;3k¦Æý*š3SöÍáÊEFóÙ¢ñÓú%΄)G¹ß´€ÐaL¼Täüˆ68³±k°³/«›®›Ô¨DÞŸÏ×RŦ´ åk“hBªãvÌSØ¡Q£Þ·ã6¨\ …,ôÛ¬ +ÌbL˜ÕCÄ+&}rŠO¾“uwJê¾ï3£ÍÑgl[’Nglðïöe&®ß/ùè¾ £V²ëv °<ê:° +X ¥Ç‘ +aÀÞ¥s“æJôå9z9Õ4œ™×  û±Îd| ߶âà(·Ñ +Z$ìþ³õXPh|Ý|ÉS#J蛉ø$çëA©›l›TN´ ã¡_-mž53+L]×3–.r³,ŒhR9ØHàÖ]9J8Æy“£ÓY™Ö«“©Í]’ƒÊ{dU¤®†4…áEÛp¾Õ©)¢Û¾:’Åô¶Ê¢¨_ÀžÙuÊ f­s o ¿’„µ'¦>æ}¦ ã®×EŽ5è ±Í¡9”C„Öï‡ûH©"‹è4¶ÞPï'}(߶w¢ +…X¡±&Ýta¡Ð¸q©—&dê´¬hZ—öaM-Š +½È m±Å$" +(°–¨6eP´ç4[ä¸èÖªÚI¦%}£ºSVÐÿ‘ZaÕ*½ÄxÇÅ4ILOe+F?L§Xà–ÃXB‹aŠ<}éD0|«Ö¸Õõ]e ï+ߊA®II£µºXBSjò‘6ÌmIˆxÖ‹,¡J&cÿør¶ïCk«vIRC.PÃ鬃U×,u¹hú¥¦6uÆsSãó“…OÄ釬-C%ò°î™‹Cé  µ„`ÁÓÃ%ÔyjAe<Ô#N”OVò¥‹JBHGjUÏï­Væ,Hœ¶sæئÿÿn{Š|×XßXš¡%kÚ½|eZ¦lcQ)ušÊP2Ç<{‚9ÍvºÁ9¶­Ò9¶w¶.e{Õ ÛT&€>C$u‚ÔñPÀ þL7Œ+ÑÆÂiê M‡â s¤sŽ¸ÖÒ¥¼íA¤m©ÇZ§™ÅéüÀ󼘉Hœë‚Ob¹|yÐðŸaÏ*£ogëRþöQ ØAuèw¶€5ÀñŸ€£úÞS€Ý0v£g’'ân£0L¢U:GâÎÖ¥$î£$±ƒªG"ö-YÝšòÁ€¼ð8\Òß³ÝPÀ å­Ò9w¶.epÕ ƒT=ÍùËMä|77!Í­ÎýòÀ'…ä, ÂSð¯ØìàYŽˆJœ£Ô*£tgëRJ÷Q RÚAÕ£t]µÇ<Œó#D<à§@»qÌ"?~¦ozpüîȇ‰´JçˆÜÙº”È}TƒDvPõˆLÒ,­­?&%&¤ +}­«çWhEÌê4ƒÒ;¶.dðÕƒ]T=Û‹&Û> endobj +4467 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 293.701 286.551 305.391] +/Subtype/Link/A<> +>> endobj +4468 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 280.152 176.46 291.841] +/Subtype/Link/A<> +>> endobj +4469 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 266.603 210.278 278.292] +/Subtype/Link/A<> +>> endobj +4470 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 253.054 190.036 264.743] +/Subtype/Link/A<> +>> endobj +4471 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 239.504 187.278 251.194] +/Subtype/Link/A<> +>> endobj +4472 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 225.955 232.763 237.645] +/Subtype/Link/A<> +>> endobj +4473 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 212.406 213.157 224.095] +/Subtype/Link/A<> +>> endobj +4474 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 198.857 208.46 210.546] +/Subtype/Link/A<> +>> endobj +4475 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 185.308 223.49 196.997] +/Subtype/Link/A<> +>> endobj +4476 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 171.758 204.975 183.448] +/Subtype/Link/A<> +>> endobj +4465 0 obj << +/D [4463 0 R /XYZ 85.039 786.531 null] +>> endobj +658 0 obj << +/D [4463 0 R /XYZ 85.039 369.622 null] +>> endobj +4466 0 obj << +/D [4463 0 R /XYZ 85.039 351.883 null] +>> endobj +4462 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F14 2895 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4479 0 obj << +/Length 1939 +/Filter /FlateDecode +>> +stream +xÚ¥XYs›H~ׯPykרÊ @Gªü Ía;•ØÞˆÔîV6#É$À"ûßowÏ Y8{”KfŽžžî¯Op‡ü¹Ãy`;Þb8›OíÀs‡Q6p†[ع¸šb¬IÆ-š_ÃÁù›©?t{á,†á¦á³pì`1†ñ'ëåÕò.|ýa4ö<Ïr]{4žÍæÖr4™[/_Þ~¼ qÇ·®oÞàÒí‡÷#vçž^ßÞ¨½W¸k¾âÆò×ÑhV@øz5ú¾¼9[š¸ž‡R~|úì cÐèíÀ±½Å|¸ƒ±c»‹Å0øg¾§çé`5ø­á¥öü¡:u ”À›ÛÁÜ{ŠŠ´Pq}úóá,ì©?#Xr^­!Gã`X9˸]¨G¸\]…¯/oQ;¸iì¢ :¸å×m)ê¢sàfùáæziÈ'3Û‰‘ü'µŸÆL(yÊ*«IÁJ¸ºâ¥ì]´Æ|“äZ¼ê^^Ýè¡žµÔ»{ž«Ñ:Éã$ßvéqRò¨壚J^~oIÑÒWKšƒ“0Ð +lDi'²+š™ç¢ÒwÀuFñD )³µ‰|né:c}` ¡f™TýâdµÔ\×Üh` $ö§p É­oïÌ™¨äU±;í‚D‚îñêY÷%3Ø¥iWñZդܨz½9 >Ù; ‹3Ã,ÎOÔà;KkÞ±PÐ&ºgù–ŸZ£k®]’¦Ú*ܘÂhm€,9@iѺG¼NœDùÅŠek¦¦ïYζ¼<õEÁE‘ò³8º¸QnOúCæÕ1¿_­Þ©(ªDä‡>®”ƒ[ÿ·ïµê_`œS±Ùœžç©X©}«J¥Y6Ž*òÓýAVV§ ]ü=‹¢”i»î=ý A>æ{x±·¯ñ®5‹¾ò<î0Åëðø|q~®â|Œ ïÓ‹B”Õç#"þKž›:_³4µÉ®6U#´w­úí{“&Ý¥ÌÆó*1!çc˜v-@Ûfrࡹ詹/cÑ}ã|̨IV]Ö›Mò`‚!> ¥†ÏºÉ úD¯×íJaþý:¼ºýªÉ·Ö¥­«ÌÇwïÚì¸ì¦<í}ÏzÝq%48§w§ÏÛç8“Õ£¬x&û‘Ë&×yƒd‰:¯L2…Ú’±}”›ŒóîÕòî8Ž”V1 +%?t SgŒyy頄żbI*·Õ^ö$–ÕÿäÏÅmÁ£dóØë"ÿ ¦KÎJû/ÒZ+á<µÕÉÉÌ[žó"þPã~º)€USß5vâkoQÛ3i4²£©Áu_ü\ë¤ëˆõ#J!¹(  -•k™¼|ÒÓ¶N‚‰=uŸoÀ[4ÔjNœv«éNlÏ 'ÞÂv¦Òšn߆fÙ·§Çþzih £ÖDü(¼éT¥o:³.K\‡.SodTH3H|}’{Sèq ùž†$wƒc’»sÛŸª&y‰r]Êz1ª$ás|/¨Ìåg(Q1#ºøFIZnïͦšP"#–!°ÑˆÆøbñäuT`E +,°-n“}q ±ÚÀú#’¡§ ïE3Éð3/ XÂhÄ5sصJµÀ‘õ̺¤ÂFî±f$*¤$¤¨J¦|NÑ‹Ì ‚5Îñs–ªÑ.ˆ¶‹yé¡êOÕaU…˜&k¤ªHP©Ú5mÌ6ñ{!Ÿ{’TÑ‚C¹Þq;ÒF©(qLJ2¬në’«µ=®8»Y­ŽÅ!åjoãG‘÷ê ‹ñB” ¦¨ÛbÄ-ªT²f¨ ¬Á¡3µa\†TKñ›Ë9¯¢s* ¹b‰Ì6ŠL˼¥ŒÉgDÛú×O9¹Þ¤p«¢²2©G՜Ҥˆ”SOâMç–‡…ËA9gºÐ#åV%õ¢]›ð`¶÷] ’ØÒ²š' +xd»FsªX‰¡eº»Åìqý‡¹H»‹Ý—BzÓEÅ)Yq–K Å#«ÔÞJ§&\RÛS‰ES+¯‡ØCèІµBet™<\"ÞJq 1ÉÌàMÁ×(§P`½ÁogØfâ)xn»³Æॾ&9öù%Šî&7¹¨ 4j°&—æ™QOõ Ô]›hܦ‚€HµÇ*?öHn\¤†Ù7Æ–Oi?¼ÀöÕç¾Ãî~J›ÿõ)°éaü¹½˜OŽ·0Úì‰ÛC½—ãJl¾>ùoÞ†3endstream +endobj +4478 0 obj << +/Type /Page +/Contents 4479 0 R +/Resources 4477 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4482 0 R +>> endobj +4480 0 obj << +/D [4478 0 R /XYZ 85.039 786.531 null] +>> endobj +662 0 obj << +/D [4478 0 R /XYZ 85.039 252.611 null] +>> endobj +4481 0 obj << +/D [4478 0 R /XYZ 85.039 229.895 null] +>> endobj +4477 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4485 0 obj << +/Length 3475 +/Filter /FlateDecode +>> +stream +xÚ¥ZëÛ6ÿ¾…‘âù°V%‘zØ›W“"MrÙ=‡¶´–ìU+KŽ$¯³ÿýÍ‹mË»ÁŠÔ9$‡Ã™ß<¸þ̃ÿüYºžJgq¹¡ògËÍ…7[ÃÈϾP,„daѼ¼½øñm¤g¾ç¦^:»] 뤞¦Ñì6ÿÝyõîúóí›/ó…RÊñ}w¾ˆãĹž‰óêÕ§¼Åí¼ÿø»>}ùuîÃh¢œÛ÷Ÿ>òØk>íÜâÀõËùhn€ðÍÍüÏÛ_.ÞÜ|Z'ñ•B.¿^üþ§7ËáD¿\x®J“ÙÚžë§éls¡Cå†ZÉwuqsñ¯a-Ó3ž5%C±ðS7 §EnäEƒàÏœï®òƒY†n¤c’K»pHíÆ µP§ÎM'_Bßm ­~®<çÅNVçÜè` ÛÜe7Ùæz¹lvuNNx€ zšñ‘†÷Ã)ÆP‡Š¿½/ZàT%ž“µÀ‰´{¼Æý<ˆ:âÔ)7Ûùú$ê³Ç{’< ww²†Lm‹ JþËÝqì-íqàž·ÅÙÔ™ÃwÙ-±gÍ]Y¯y´¿/¸AýÅ@Ö–Äó#6+!ÊhïŠ$µðA¢¾»Çw7ÈÜÓnMk¡YXD|{¶½úAâFq4¬„‡øÃóã“•szzC&9Ù/ŠìýTê†Ix°ßÇâ®6<Ò,¸X‚GDmÑ“¶Ó>  Qf©áA£‚Qº—Ï8šut•û9©ZE žÑ/_Äyº¬ïQ#Ë;Ô^Ö˜‡¡“á.;ºÀTƒÃ,f¦e¢¬æpb]Ô¬" 9 )ŠNé<Ëöq+‹ûNÎ +òqî3u4ÄìáÉ›ú¬Dqì&Qü´XDçõÀ=£On(zp¼ß¤ØûÕßða5Ȫªa¡zNÝÔ‹,7Oö½ƒ-^Tà3jÀÈCYì¥GÛÕFTn©Ì •ÁžR?V¾wâܾvP¢ä2‰¹*ÒôªÄ 's+'Îvb¿Ø¹Ï:"SA:b,´—©MÖ2ë×7r´}E%.…—bÄW<\-‘: À&†¡]7(-îÐp¯ÁrySgFr‹¶Œäµç›¥Züòœ}IcÍ®çï¼hI¼×5w­c£iË5ܶöHÄmUd²R_|“5Ht|5õ„¾ˆtä¼ÅP¢ÚMÓ +7´âªi7Y_6µìTŸ¢ü ;à‘ó¢Ïʪãr:q>` ó#E6]™oéVÌÞ.gJs¾s aà´ãV¦Ñ2%Éï‹c£T‘rã(EçF Ef<Ô®gÜøbÙ§¡^Xä§nýxM<7DÈyµ” +N÷^„fŒdG`ÅܾÎúì.ëNX!¶ÒbáG„äi6ôb€ØdZò"’Òµ(Å÷VŠó]âU`G¶í‹–­qB[)àÑëÀïf#àcd -4ÑA€°©1tèzvv¬Á®4ÉN:g¢ZK4€«œ¸“Uˆ¶bxT¶ð.i@v›;wÙÔ«  =WC‹é¶È=º/Ü%·µ/ÛUˆ +šñ“Ì9HµèµÅׇ-@j‚ ˆŠMðå³iâfÛÞ,Ÿ3Í‹kdâ^è¡—ÍéèH%G§+Þ¥Á•ÒçÏñ)^\s'îv/\åÅ*C¢ªçeì¸SV\MÈ,ÒõŒh#MH5\?0RÝßµ@ ^PêÜ Am6x€¢U ¯ØÎËAÑ–=†€Ð‡&Ñ™Nbç7܆wÝ°V&]Ÿ¶×V\q²Á0ÒóÜ’É°…³¹;^1@Ñ &’yúbã´ç¦'¥ëo?ÜpÇÈXEÎèªÝÉ‹œ)9‹Ñ%AhœVÖ²ˆÛÛ*[JßÞ t—»Þ×ÖÆ%Ïoí£™{cô..FÉïø#k%vïú–”r]=òH.éFC‰D¶.$Ê# çñìŽDJÐĸ¤žÈ@”؆¢6¶Ww€@ +»É>|ç,¶}lúÂ8V’©õ!£Ô ¬eWÖ6xè]6â|EiØeo!ÉÆ°&QX¿„)ˆÉp/sšNîú xlP\õÃÍÙмþ¡ê(pö‰KXgèö5øÿw ò²Ÿ› È2m2Bˊ̺‡ÆTQÌG9j_boÅ_,1ÊÊ];Ëñ’·bkmÏ,¯H8Ðg¤M•ÛÁ\9;$Ò`¾›üÐó >hÀè\6„þdn‡G+9æ#`2¾S"¿1u/ +á«óì€aLü+’ÃÞ¸óà ëÖàõ©n†&Æ«÷ms ËË¥Û>Ð`!0°±3ÛIzìõ!/£¬š›t3ÅÈÓÔÀ*'yÆ =jИzZÑ+Ö\Ñmoøƒlª]œÕV^ŠTÚbÍaè¹x-ÃÄ‹H·¢°e‡ÔyI罨º„½·2H´Ì$¼{šJ› Í—j±fo´jHÍM:6žê+×ú> E ?›¸©2N´«²m~6ˆ‰Ý VBùÓÄR‹4rÌw•çz g–?ü0_„AHÙãž›dßØxQQ AÃù± +›yýBú–Ë¢ë.ùã3.êGnaÎúHB£¯ª›2X^D6ndaH»+H=!½ÛCZwY÷¦I+`B®“Ç»GÃÜÕ‹e}uƒ>î¹FÎ/›ÝÕ¶h¶Uq™/¯À–õ_ µ›v-ÇÙƒ?)&êV²ò?ù§ÆM× U˜?Á“õB‹æ|¡Sií¦©:*t&Rè”U£¬T3Ñá!”’õQ¹dwO‰0|¯š¹bLÄIÜú¨à@Cík2 +ª†v玧7‰Ÿ9ÞHs>!Q¦¢ñf#dR®d–ì*!CÐ4Àq:!à²4`<†o¦Næ ì}j®*SC‚Ī@Ï€ôÓÙ|ˆÎFÎU/">+H.Ú= ‡Ý­q’ŽlSô¨Æcý'×?Át«Ì_{Žt‚+¬ƒ¹“„‚å HûèPX«3ËóççׯÎB1³¬™”ë°,ÝŒ‚ÉJÚbEu>Ì-ù=ÍÆ‚YéYÆ®z&7´‹øT£×CnQ›AÜwÂ-ŸS›s’_+7 ‡‘ƒè! i›ª£ˆ£3@zêžu†Ó‡¡xŠs 6àE‰ÅùaÒÍ ­Ø%³Ý‚¤MEE*h¾‡‡0È¥™CÖeíq +;ÇHóðõNœ!’XŠ“1qÖñHÆ?Ÿ-Éáðk¶_b“LˆUclt¯‘fÓÀuèD¦P)Å+ ꈙSð=©6³a$‰õx’ÃH0ÀlZ²ô$-Œ:8núg±hÌ‹„,\®Ìã¶cÁÒ°$5 ‹ ogçÚ.ö‚,SEì@{®ïë)m |7ñh>Uo¶æOÀ²Ô› —JH@ïšMq–§ rÃé÷ŽïãiœÿOBD<-‡w½­T›)ª?Ë ÈÝó£ÿÁqþ +2X5k².áí,c~šºzú…໳æŸgÌ!c÷p¯[ŸOm=ý8ìÑæR²9®ñ!-êMkÕ°°{Ï…þÇ(!60Í°C-`xLc;óhe²Ât¬g #Æ„ÆòÄ“ –Øž1σºWìÙ"Wã-Õ8[¦(¾e !Á»{Úä!»,Ëïï7ïnßÀ¢?â)÷„£fSʱoÞeIà5Óáó~ìl‡^@L„žB˜ÆOtäü- !vö÷X¾Àk(5Q'˜ôJR ûÍ+ð"W{&—¨ë‰lCZLñ‹ø¡E1µDèj¸YaÇ|QZgN•(‰úèÌüðMïÝDª@æÂ%=_ùE¿ê‚ÉÙRÆM‡!‰œßìWs¯÷øãÛjÜAO/›¡” ”/$“$ÿ7ZÍ &5€Ññ'ùéÄÊ$“`ŒPPé|±"š‹t›øu?De2 ùÙœ“2]_:o³¡¤ý@Š—G·‡ôÄ𽚠V˾CvŒ1œ®Aô¢Õ3Úa.в–%Ñßòø¿Öœ÷\•ç#˜Â6œÏvbÔqM°Ê®‰PDã›wh ¥-Sªe‰“Ãçj‰|çÅŽÊXWÓÌ^À]Y%³fKáf¡&"É.ñ>8+½ä‡ôñeÔÁ~hçQ–æ˜'¦ñLaÊ*àÁ’Ìø\Y}>æR1Xb3òÝq!ýIŠÈé[ixè/Í”™Äæï8â“Ä’‘‰xè R±/@…§ï28­v 'Ê¥Gö,ûnBû·¸7?3()•$ äSeEI´6%´ö&¨-I"‘TI°AŽÓéA^Qtä•°‡Ò¢Hó&Þ2`Ø*¶â`–nÌž<8«3öM)u#µÏ{»´ÙŒ¹gk¥ÂYm>¤ìNî±’×qX ³¼×îÞ§‰ë©c¨Pg¡â×O/ÿ3å{h%‡À Î¹»b æ5ñôÄ%"Oð‘sEW«É<þ±Lÿ¯¿“J#:qÓäLe$„3þÀ Õ}<}ò0¬íÔËÿ©@ÈEendstream +endobj +4484 0 obj << +/Type /Page +/Contents 4485 0 R +/Resources 4483 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4482 0 R +/Annots [ 4488 0 R 4490 0 R ] +>> endobj +4488 0 obj << +/Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 378.519 512.306 387.541] +/Rect [362.773 616.958 512.306 629.86] /Subtype /Link -/A << /S /GoTo /D (section.2.4) >> +/A << /S /GoTo /D (passdb) >> +>> endobj +4490 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [234.557 293.576 421.201 306.478] +/Subtype /Link +/A << /S /GoTo /D (samba-pdc) >> +>> endobj +4486 0 obj << +/D [4484 0 R /XYZ 85.039 786.531 null] +>> endobj +666 0 obj << +/D [4484 0 R /XYZ 85.039 766.606 null] +>> endobj +4487 0 obj << +/D [4484 0 R /XYZ 85.039 746.481 null] +>> endobj +670 0 obj << +/D [4484 0 R /XYZ 85.039 358.542 null] +>> endobj +4489 0 obj << +/D [4484 0 R /XYZ 85.039 335.826 null] +>> endobj +4483 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4493 0 obj << +/Length 1448 +/Filter /FlateDecode +>> +stream +xÚ­WÛnÛ8}÷WèQ*…7Ý +ôÁ±nŠ6ÍÖ.vndI±•È¢V’뺋ý÷!%ß"§M»0‚PœápfÈ3sH ?j®Cxhø縜ñj@ŒH^h«a·*öÎålpqå ƒ'$¡1»ÛÙ ‰ã†ž1K>™£ß†·³ÉË望”:–íû9´X`ŽFï?ÞÌP"Ìë›+œzÿáEApsvýþFËÆ(9aÎP0¼´lЙ‚âdj}ž½Lf;?"¡œ£—>}&F½‡‡±1qh«p¹ã +Þ~çƒéà÷--†^Õ—”Næ¡2÷éÄyžão—8FG)s8e†ïºŽ'|•9H–p Há„5W„æäk´*s˜J!1žo¾__áÈ3'ESaV2ÖZz'-NÍJDú_ òh5¦ÑjÇr]4爑1ïéˆö:*"êöEÄAÛå*¢Ù'¸–cÒb¾¹É +.´ CßI¨Ü…Ï ž¼¬0¬¢UiƒFiÖ,qä›Mg8+â|]g²ÐóòNOïä¥eÖ²V¹úŠW-Æ!f·j´–œC¾]ó^gÄÒB—#µ´~‰i»¸âGû ˜*à¤x –˜k®³äÕbÖ {¡'äúU™Ê2O_$ñ«2²â^ª±¬h2mS¼\¡2T4·Q]od•´?„ +¸Q£ñ…žï…˜\ )wùÕÈï±Qn’wëº-£b‘¶f¾8\¹¾U¶ŠªíëJ®Ëëq»‚2B{tóÕ‰ƒ®ËB§—“ñ$džc~)¸{éRAÄdrhÃíü{ÕÍ4mº­üü2Ñ·¡\Èb–­ºHHŽœß§q3ÊÁ³V«~|ùOÖÀIµºú¼zT²øAÞÝlÞŸFVÇÍU-:>}üÓ²…£ÏgÂúÓ­vµs–†„xý‡>ŠŠ£3'úî¡Õöæóöîú`VDjžKȦ+2 + Äq­‡Q¡ÿ·¾+4›j«§îd¥€RmÃ7msf`n+ØRh‹V¸5œ›*^ªøÇ +rm)û¸Új&ÚL©­ÖÙW[åÅn£=8š^3Цþ½#üç-ðÓƒ¿ßÿ8ªš´ú9üÿÈmO² mo¢Öë´ŠòDGj÷ÿ¹Ï©îL–xFçù3 ~æÖuZäàŸ¸Ú–Í¿—å;–Þ¾AþŸ.ñ£üºÊÍz5O«VpÚwxqñ¬3“‹¬˜.Ó> endobj +4494 0 obj << +/D [4492 0 R /XYZ 85.039 786.531 null] +>> endobj +674 0 obj << +/D [4492 0 R /XYZ 85.039 766.606 null] +>> endobj +4495 0 obj << +/D [4492 0 R /XYZ 85.039 746.481 null] +>> endobj +678 0 obj << +/D [4492 0 R /XYZ 85.039 141.755 null] +>> endobj +4496 0 obj << +/D [4492 0 R /XYZ 85.039 119.039 null] +>> endobj +4491 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4499 0 obj << +/Length 3455 +/Filter /FlateDecode +>> +stream +xÚ­kÛ6òûþ +p@e ÖJ$õ*î>äò¸KÑ&iw‹¶HóA¶µ¶Yr$¹Ûý÷7/J´-;A[,Qäh83œ7Îø giä:›%iìG:œ­v7Ál+ÿ½ b! æ?÷7·¯b3 ? ²ÙýÀ' ü(‹g÷ë÷Þóÿ={wÿòÇùBkí…¡?_$Iê=›«Ô{þüíOoîqÅx¯ß¼Â©·?~?a5ÕÞýë·oxí®ÀœñîqáÙæ €¹À—wó÷ßÞ¼¼èt8 µF*?ݼÿÌÖÀÑ·7¯³töãÀ³l¶»1‘ö#£å½º¹»ùaÀÅkfÆ_M ÅèÐOT4[èÀOS3 ±ŸF)H.ŠüØ$ƒäTàH. •¯C5³@(º§¹½™íNÙ UâÇð¥ƒó|c9Û8ŒÜuì«äx㟷sÙ¸ž/T¦½~[àÀx‡Ž¦[~[áÁló 7B'ÍoKìó®ÃùGlÚ5~ g(ï°ˆÄÙ¼/½ÛWÚ¥K…p’*V¢º¨±%ÄC~=+öµ2²^í®`Šߤ¡@æõzäþ)¨fä' Þµ$£Oö—Q›Ì7‘%â· 4E…Ì“xü³ãITJ¸¯ëÕtE¯ˆ„Ùœ«“ñ ˜ËÕýæl¿ui€°ÝýÞ¢‚TOììÁOŸz¬ýX'_rè1ŽR稦TÈW¡ú’s' Òyù4à›ë'ÁWNp‹¦qœî¢•'ñå]dýh—cÙ›ã]F¹§Çr§ ²i Nõ;ö¯ïxzIZÙ VK d:U^E¦Þ[,ì*ÎŽ¢ý犖çcá“VÈÊ—DVsèGª@0³…Çš°q‰ÌúÁ+6+kEÄ”4ë~[²A™Øx òÑ—MÍ %Mk<ÍäHÊïó(öò²Bž—ÈÂÀÊž%Þ´=¹o8E×U øNÕ ü83³8Mà\ÃÏG0ͪ;¿×ÂA6¡6‰ö³8vDê^þBÑøŒ:D>Èúo¡ÎâºN +2 숺_ÎÈ +aÑüMd ®ÏEÎ%:"ëû·pê/^¿úõŒ¼€ gú[È\Ÿ!/ò}DÞ;Ì žÝaÞôó Ÿ­,4°ž*`V—2d ç^%ú‡¦ÝålLèÂW¹ Øvò¡A¥''KhŠ%&í +D D ©cÍþÚ@üèx> ½pÀÏY>ʼn¬t;´ò¥ĬÐ,â挌Í(,—šïka>CdŒ9"a—×äR9Aò/ä«1|˜%ÉÕÌÛ"LègèÇC ÷‹9À?FQà}ÿt÷Ãw—ö×™ŸB¶uuÿf‰ØýÁ.¢ˆSÿ—âûÉãf^×ð³yèÙÁâÔ®ÎmxeUñêŠVq.¯bÃóø *DšÈù±i‹¼ça]<ò \9ƇHy¨ø}Ó–¦æŸÖ¶>:_±Öb#/àÉ¢‹ÕîÃ"?;ˆ—ÆK<ðªÞÇ!:à®k^–0…ˆ,ã4~À§B{Ù±®," +kM'FB¡4gªx¦×ò¤YÊ^y;îUÖÃ^.߬8ƒY™ˆ[Ež„²®/  ˆ’ŸkÚ–yâq›÷B)|ÞíG”«ãöŠd«ºÀ9’.L„ÂØîâŘc}Ç 4›£žx¢lÍ3ÞK{´ÁÄY¯šý²,O¢Ô[R>i<ûö@Ù¾®g +“ŠäV7=ÏæÝû½à"^` O¸^ÙDX(†£ˆÂÍ*Bâ fQÐeß[^#á¬ï+!e]ô˜ÌÐfd$۹ʼ§)n7™#‹ +jò~˦µ[¶ӻ¼Ý”u^ñÛÒªª´TЇEPð§¨ÿ‡ê#ÏZ–õ†¡Ëº•°q¥G²›ºã/º-©_µfÐmQíy4à\ÛL¶RÚ]YÛ±|7xøà0pÜ +ªf‚Ór·¯,’H + çs8sðÖâj÷Ô‰º^ŠQ‘R~š˜«1¹\E™L|¤°5ŒxÏÙ‹³*¸ãD$Sý’/ó®¸D#d‹`á×ia.Ç1“PÓ)¢ñWì:Á‘.8“b >x +Ü åC8èle„€TpÁ󉪨ƒÀ²Õ¼ÔsÑóÜl@÷…Ÿ¾¯ì>O aËÛþ½à!æìC:mø)%ßòTX’Lf,“%µ¸²s±Qñꊕr³'«ØŸ*æÿ· +XÓ…×%ËcÁ +h0¤VæHíÅ6\a®ÊƒQ^Z’?´Ã®æå:ß±_€ Cž²_\÷¢”ø5@3˜-ú„üPõ²ž£Ã« +ô.A +±iÜŠMr¢=‘Ä`‘tŠ?r°Þ¢»Ý¯—·»§îSÅÿK¢n0½>ìö½ •øaj#«†ÃJ^ŠÏÔ¶›§3%b¡rœCsÏóŸƒ[*çC ’¿•$†+4Ô¢” 㶠ï˶X3:Tó  rDï'+`Øʧñí$œ¢Ή÷À¿™fpTÃü| èI‡‹&yxêò¾…¼ªwÞ÷CóŽÞ µ™p±ÖÿŒþ‹·û¼ßÞöÍm—ï–ùíÅã´§6á¼L¦¤Ò«Î˹ì`uõG O¬²¶©Q-7è’/;M‘N¡øN¯_80—Ý©N? øl$wƒP´¯PQ6¥ŠUN åD¤fguÞ6œ45ä ¤È¼–Hq½Êýf,U)qaTNi¬sÇMe¦ã + ¤—š–kaÒ>Ë£«ÏÖD—âHkF£ êM`ðTNtÓ’âÒo±Ӈ.åöqYakmîbµ¥¸!ah,À‡4áƒð6ÇØ.{·[úà1¦ÚבŸ†Ö«LÙßBex’Ò]H&C?©GYæ«D2¾ü›ïŒ¢ ÐP‚îƒc´ß@áV÷åC‰Av +ôœD° ?Ö±`u +H<»µèÊ…ÂgË Cúnàà†ÊÇ`¾d³C\á†R@3Š•×+)0@Ý Ôxru«@Û™²ççš)~ÓÙœö+Y[A¾YJ°AJKªtõX¯-&Ô¯\·6”?­Ìiç˜ú¤“Š3¨l(XÔ Ü^f¨>¯WC`p÷:gi,û©Ó¾ÑÑ_Ê:ÕÂÁ5щ!tjØp2é:;ò^ ñâËqኩÎR!á%N^âTdήƒ.ä_¡§ YŠ3?Mã¿Öã\ ÙÔµ §Ì°ã%QpñÌnC ¦-‹nè’{³·z|ÈìšNüÒàwGi¢ Txº¡Ö)Ö® Ô\"ÄZ UsÕ3–ÇGÆŒúízs¢ëb"¡abz⡱bæЀ5­ÖÀïžl…ë7:½lúÉ+›’ óš_É4Úæ°Ù2ìôE!ÞdÆIø>6ƒÐž9W„•JdHª{¿ßT „êOt’Â1oç—X‰äS©1_ sQF—øSZ9Q–Ù—ÐÐG á‘@Ÿê®Ð´UægŽ'ꨵ™øq”‡žœÕü<‡Yˆy5…ÒóüÅ~‚ŸÐ)õLgŸ€•,4xÙΘ˜y£‰Û×;5{ѹ³#ŠïÂAÌÖ–ºÖÅ~f’Y©Q¢9Þ‘Û\Ù²"Ó{QÎ…9êW+ÏüvrÏ}\š£¾%MÚ÷®çoŠµÌ××î°UúaxA5Ó£è.®5‘ŠR¿$ \·©Ž: ð*=ºph‡ro²8êAžê<–ú/ŠFöiâ›ôØ£³Àu†å8u9a„ûÈwÀË]nóP2Nž¼Ú°Y,ÏK³Y;´|2cáÅ”íÐfÃYJa7Œ$·íM˜§†ùy¥rt9ƒrùcØ \hǹGSŸ9 +“ ßÌfŽMþy G'fÉl1ü†æÏ;cwéK?hQ-ºS†dñ&ß ¿OI”´$AB9ö†¿*A_Ž“ýbã¶*àõ5bþʹ +ƵÍš¬6ä¼)ièí‡ìPS©1v5íGBòXªõÅpKpK‡=x R]}Ž‹¥ËK×0ª(¬€y¤†Âxä†q( ÇøhRoOrC—0´ØTtCC”Ï7Ü^1 èìCïf’& ¤(ð¸ Æe’FÚßœWlyFÚ8C©gë;lwoKþ5cþŒ¸8œnµ¥¶‘fã¹¥Òå†çÑ)èñè×R)÷È÷R§âÏ›¨bpð¦ÜøÃv‘ÊœîbšŽ¢Å—¼²lMã㌔o º†±=ükþ€SÚêÑ-:íáÁô⸆•bÒöj0A#Þ¤©üÐb±no{]Í£o«ùàx†â·ªx‚¯LNo“G)]ñËק:¢Ÿ&M´)àŸ¶¿Vúó¿Û/)]—O:ì}«p †š/A|Jq¤S?‚ÒåœäÿžŽº×endstream +endobj +4498 0 obj << +/Type /Page +/Contents 4499 0 R +/Resources 4497 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4482 0 R +/Annots [ 4501 0 R ] +>> endobj +4501 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [306.528 668.246 350.4 679.935] +/Subtype/Link/A<> +>> endobj +4500 0 obj << +/D [4498 0 R /XYZ 85.039 786.531 null] +>> endobj +682 0 obj << +/D [4498 0 R /XYZ 85.039 653.977 null] +>> endobj +4502 0 obj << +/D [4498 0 R /XYZ 85.039 632.78 null] +>> endobj +686 0 obj << +/D [4498 0 R /XYZ 85.039 522.874 null] +>> endobj +4503 0 obj << +/D [4498 0 R /XYZ 85.039 502.28 null] +>> endobj +690 0 obj << +/D [4498 0 R /XYZ 85.039 402.428 null] +>> endobj +4504 0 obj << +/D [4498 0 R /XYZ 85.039 382.136 null] +>> endobj +4497 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im2 4150 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4507 0 obj << +/Length 2443 +/Filter /FlateDecode +>> +stream +xÚÅY[Û¶~ß_ᇬ ¬XQ$u ЇmNÒ“"—¶ëHó ÛZ¯O$k£K7Û_æBêb[n>b‘g†3ß gå"€r‘¨t'‘0J.6åU°ØÁÊWÒRø–ÄÑü°ºúîu¤2i.V÷=Ÿ4&«í'ïån^½úué+¥<)ÅÒãÄ»]†‰÷òå‡ïW¸¢½7ï_ãÔ‡_ß-%¬&Ê[½ùðž×þ+0§½.Üþ°ôæ_Ý-?¯~ºzµêåi"•B)¿^}ú,¶ ÑOWPi²x‚ï@È4]”WÚ(a´²ãâêîê—ž¯éï:gGáËT¤¡¹l¸(Qõ† ƒ‘ᤠ…’á"6FD:&˱´%P`5£Sïc³‡ñÕßi¢È{,²~ªÍ¿µ8{Y“ÍÓR^…ÿÕÛ†éyÄTùaS??¶ù¶ß„;¤Û1gYT9Œ.«:ЪҜSUµQ¤êv†Ô¨Aöê°+žyr‹ +Òʦêp-ÛåìíCÎ$]cgª{žx,n@DZfÁYÐù<át6¹áù‡ +'h6Çõß髶«ÏDÝñ`“ŽŽ!Êh+§¢/AyÃj¡8I2b‘Äöô®Øò°Ø±#e[ñ/³‡þ‚I”î [»x¤3H®ø&zK{ ‹ûmÎŒö¿RàM_ ˜ôJ“ŠIl¹«$Ã[E²kÒ×+¬SÒ8; Z&ö®÷[ÇŸÄãñÔ¼~)‰eœ +Êð!åáš·“`ùúýÇ·o¯ùû·ÀOûöÝ£³Ûi”3ƒ¯ðÙUmN&bÉ$¤ØÖ²C[NŒâÀZù@Ju¬tp̓tpù$þºÓà•GN8^åíÖ‡*>£vŽÀ®÷/o—)„Ók J áË‘ŸèîUG‹(ÐBéäÏK)%âHŸ-¤|ÇË1#šÈ«)"ÙˆB£â7(£Å¥"„sÇÀpMwPi U*  T£1Èôw°¬ü¯Sù¥ás8Ð)@D×3 ,£DMtù€p~cý3·Qpšµ&©{È_Øs)PöÕ¡±ù†û8ƒ™>ï=ð™Ä©õÀfØööœŽp¬Ç]Þ—GC€¾{Æšý—·¶®CÏM¼MWZÍHf^C0ÆТ¨­œ¦– —*»®¯!¡6mú‘ªm3‡áFžÉËeúˆ¦Çp)R úóŒÒB'ÉÃ#Dpxÿ}÷vîx»ëâñÍ<ä°t’ré¼zØÛ{¦Ë­q·]1ثοvèA5¹Œ%.ÁèßœSá´´YËaöÍŠ"ßΖ+—O;‡ŸövÔP“Óu#Ô­í‘H£xaJ­ÿJ¤†ñù7›ïxù#f§–DŸ u ªð­,Ž“Ú¬mÑNÏ6$Ûšj³Ýyì=EÅ_FuUö™j É™Á&ÂÚæG›ËnFo é‚PM‚+‰E §¶þ×™ „º¡‹‹Vvþ%··Gû£œ*¿@8)†ürÙ¬HxË|OÊ°‡¼¶÷mѨȇú·/³ÆÕñˆñ¨H]7b4­;Wûªö¨pøzT¼oa_²ûÑ…µ.~ 2PB†¡5ïœùÕ_7ÿ~0ÿR’æÖ~çqCk)¤ºüäÑô°…i4ã†P¡q°elÍù²*KzssÕøª®¹ÐÌÉcÙœ‘' Ò= ÔeaA4½ˆ±bÓÄz$¬ô¤ÅØX±äµÃ3¨yùaÒ*ÛA§®vN)ŸÉ>6yÝÚ +~Þeå:³Ÿ·ïfÔ0ìH/j8¢™‡q§"ÙY¦ +¸zDÿ×Al3àÎÕ‰:ˆ($pÉ…~»Ÿª™ªc q‹d"¢÷Ä•ÈÄ,n<à‹7fîÂÌnÜT%¿ŒiþŽc6¢p†+ª'Ú3˜utrU£…ÿÿ u9—ª•Ž.§êͼ)‹PÆ7 +gÝ(ÃXíDÐZ>„BnŸc€óÛ­k˜Dá¯{n=ÕÕ¸7·Î6_]~pokz·µ”×Ô¢›‹x0%ø‹Ú4\LF" +¹R¸Å‰!ÏʹkDc.Ëþ©Ž‰­á¥éã gÖ„¢¹Mô©sâï™nkO¡.^‰ƒh( +È5q¹}@;àöÿuMËse5>,†ôÂå;ô½¬êc;TKÃEVþØÿá +nëáÕb:/Œ# ÙM¹PDÞŸAv|Ñ+G7Ê•*TGÝ­z œ§°à ‰/¶¬kØ}à¹öHfW9åBj@†ó'¦Í6¶ÏÉÁ³üF‰…ËrfǤ¤(xF…“P:V®*+¶£ž+[vÜ÷±«œ›lŠdÄœô¿,·v»îë¾ò¤QE‹¢åÒoÄöl®…L@vˆ á¨ý´+ªuV4Ÿ¹øD9QN1Ó»Ã,lBC¡H@‡ƒïù.ZÞÛƒMVÚÁ®Ë›öÔ¥ìI'/ %´Ñ¡{o…c€†½ëdĈ!¶'߇Q4ÒÚ†ã±ë;€ /ÍãñUœ¸š©ÆÂ5ûª±Z#n’ÄÜ"©£iw@ƒ%M_µ¼/²$/¸(³ÕN5Ž¡0‰ÛJµ¯­îÚ¼¶/u€Q¦^8È—hÏÖÊo¸ùFÅà¤ÕÎeµ ¯‰Ûu¶ÄÊÚ¡À> endobj +4508 0 obj << +/D [4506 0 R /XYZ 85.039 786.531 null] +>> endobj +694 0 obj << +/D [4506 0 R /XYZ 85.039 766.606 null] +>> endobj +4509 0 obj << +/D [4506 0 R /XYZ 85.039 746.481 null] +>> endobj +698 0 obj << +/D [4506 0 R /XYZ 85.039 649.314 null] +>> endobj +4510 0 obj << +/D [4506 0 R /XYZ 85.039 629.326 null] +>> endobj +702 0 obj << +/D [4506 0 R /XYZ 85.039 546.315 null] +>> endobj +4427 0 obj << +/D [4506 0 R /XYZ 85.039 527.443 null] +>> endobj +706 0 obj << +/D [4506 0 R /XYZ 85.039 441.136 null] +>> endobj +4511 0 obj << +/D [4506 0 R /XYZ 85.039 414.522 null] +>> endobj +710 0 obj << +/D [4506 0 R /XYZ 85.039 414.522 null] +>> endobj +4512 0 obj << +/D [4506 0 R /XYZ 85.039 391.204 null] +>> endobj +714 0 obj << +/D [4506 0 R /XYZ 85.039 351.165 null] +>> endobj +4513 0 obj << +/D [4506 0 R /XYZ 85.039 327.847 null] +>> endobj +4505 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4516 0 obj << +/Length 717 +/Filter /FlateDecode +>> +stream +xÚ¥TMsÚ0½ûWøy&Või[餤M¦MÚàžÒ0à ÆĘIø÷Ý•„K(É¥Ã0Zí¾]½}+™‡ ~<Ì4eÒ„i–P-y8®Î ò%à{H¼‡9˃‰ +9£†™0Ÿöu £Ú$a>¹#ç_?òámK) ç4ŠÓ4#ƒHdäüüæ×uŽE.¯/Ðusû=âÍ$É/o®]ì3FÀ§HŽÁYfÀá(ºÏ¯‚aÞóÜë„K‰,Ÿ‚»{N £«€Qi²ðlF¹1a(-©VÒïÁ(øÙ×r1º¬c¢ì17Ôý¾pIB–ô ˆrj´Fá8Tr¦ZÓD¥V9ˆj +MJÐLkFŠM7A’”Ôe7oÀäd²FOB&n[úí²éò9’Œ4„Zíñ-¹ü±ïòÿ‹±ü¹Þ|Ï_ZKËÿrÅ"5d‹ãk6¸ÉH‰4^ «Õ¢Wݬ­ƒ­1RvnS,üÄ5fíâظH¡ñ‡\-Ô(|´lOÁm™mÀk[û’uièµu®è,–TÏ`eË—c´«ßŒ«]‰Ë(Ö˜Âв´=¬…£@_-æp/´U¡\bû]»u/ Yºu—Ž÷{Q-w‡À¨•RdûÙG´5Œ6vòV[”Mn,u{ ðÉ-3 ¿j½¶±¢¦–š¥¨Œå˜Ï+,Ãqë=°Ë—bì%CH³ŠœJ0ÔuÕyP3Å©yG»#ñƦ귮Ÿ‚’L±™Ö÷éƺ^;Õ9 ]@}ŒDÖO¤'ÔU ŠxŠ.¸öó²-m·ñ‘v+/Ë?7nþn2^(ºdﾧð6Ó&õ¾ 0”;Ü«w!Õ"õ¸Ã«zx#v×@Õ²¤o¼UxaÊ}ÙŸ*ü]“ÿõÕë¼Ê¨ÉÄñ÷®… ‚÷dìçŠe‡ŒµÌ¨ÎäÊö[t¹endstream +endobj +4515 0 obj << +/Type /Page +/Contents 4516 0 R +/Resources 4514 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4482 0 R +>> endobj +4517 0 obj << +/D [4515 0 R /XYZ 85.039 786.531 null] +>> endobj +718 0 obj << +/D [4515 0 R /XYZ 85.039 766.606 null] +>> endobj +4518 0 obj << +/D [4515 0 R /XYZ 85.039 748.602 null] +>> endobj +4514 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4521 0 obj << +/Length 3326 +/Filter /FlateDecode +>> +stream +xÚÍ[[sÛ6~÷¯Ðäe©™%.¼ o®´î4i6v§™iû@K²¥n¥èxóï÷\¢HÙ“r3™ÌD$ppp|çJXŽbø'Gy"bmGYžŠDËÑt}î¡çÇ3é(&ŽdÐüpsöÝëÔŒd,llG7w5‹Ä¦£›ÙÑÅOçïn^½O´Ö‘”b<ɲ<:«<º¸øõ··7Øc¢«·¯±é×÷oÆzsÝ\ýú–û.±ÚLtƒç?Œ'@s „¯®ÇÝü|öꦖ3X‰Ô¥üûì¿âÑ VôóY,´ÍGð iíh}f-£Ýûêìúìß5/î3#Õµ)žb¢b‘)u<]f37nM§¦‹G)¬U]3%V( óäBæíßZ4iŒP™†K‘ê¤>°$ ÌSy"<±›±M£âv…»<‡ÈéÜ$îôw¯eŒNRaR óá°ïÛG¡âL 8’ÒÓIy0O›NGªªr 0¸}¨Æ$«Œö ™åUT-æÜ°/Öc•E·@W\ëó)O·›±²QÅ4ÛÛñ$I¢ÿx^ÓŠ¨V8f0ÿ3Nbhûå9ž¿ƒGh‘íå›Ì +m:—´ ‘&M4 ŠsŠ8tj„…½ÿGÄ™X¤&ëeCƒb`ÃOD·¸4¦!ÆÓõêð ­5ÓJÄ)›†Õú]±ß?nËY{ï4.•jpürñ<³#ù0¦e&lžX- +°ÙÑ/çoßœ£AJu´±ˆAŸZe:¹Å†Ï•²¨³`Š}µ-ç´XRv<K!•R:*øgŠÀ¢Ñe1­‹%ö¨¨œïÊùžZ6¤"¹ÝðÀí“9> äÿ"¯ƒz¹.V¡¬N{Ф PÝ‹öY$Žæ,Ò$£ ÀAЛƒÞllÆñzSømئz +¼ÃÀÛ¯¼|»išFèdñw×X²G„ض„†ö%Ñ¢Ø/ø pŒ$·h Ë8ÔA—€Å~qƤ‡ÈE.µa.™ ôï»ú©†³E8–‘±lLÂœ³çaÙ©ÓÓ`älÀœ[`–¹Èåi,+lfhÃv³_Š}u=¯zÁ\3ˇÒuC9xBnÞüÞCJ':ª–kêNØëC A|NøÛ"f{Ní0l¦n„´YÌ}‹ùæÖN‹(ôч!‰[ò±#k-(UBKOYlf]Ì”H•v$‡†¥ƒ™ò¼ úAãûÿW.úÁLd +ñR*t‚|oÛœƒñ›‚ŠßX «~+L.…²ÉsErÔ= +“èLH™Ö˜8Vå¼ùÓiõzUÜïû&`øåÒÕÓ¯[eùjÈ8GcŠš!%¿O /Ê=·íN%ÆÄ 2hìQ/8¤qúó÷CQz…8T”[l/Èü$¤UÈÕ¨èhÿ %/]F¹A)MATž0¡ñÏX&¸ÏÄ‚‹xwŽ†‡í;|ÀoßÂXéÙ$”¨¿„žÌF¿»0Þyž}Ð G@ûiq[¶Ìõ8TàÙ=M:„Ù!Ç’g /1±Ê¢+â¹Ü®ñ­ ÝY‘‚?ì+~Ì‘I{ûè/àôrùi»žwL?£é!¹Qà€çãø%xs7:Étt£¯k_ý‰ŽÐ@^’øÖ+D’0oPKp‰üg8/í[yØŠ%èµ8ƒhÐÀ§[Ò3ErÔ}&GhœÂõšœDe”ø“—ÙÞo77K>áN“Ó0üré“Ó¯Óä„ò]9gp+ŸÆ `fõà)Èž§emx&ØŸ™œ5¿QØY/8†XëÀþˆ­á0؈­Pêt— •§56îîN‚£á88Zòuƒ#ðë‚cˆµþÀ1”å06*3'Ña¬Zs0ðq9ýø<–À£-`'û6±¡mFšKN߸¼J%ÜÏøYTŒ±FÝôÍ>£b‘_Ÿ2Íú”É"ú:Vc¿âÆ[Ì~=u¯œH‰•7üõUgpG²­ùåŇï_tõ¸˜c9*‰Uô8AÄ_:l_y…ea±«LÃ}Hv¸Â²`ᬼŠ\iK­˜ÁWr+¦ÛÍ×(½éA +4=eMg‡4Ùz6BÛÒ[œ«ö(.«ö¡!Tjà° +"½Ì<;pÔ=FHiÐ_súƒ²FȘsbÐß»åj~Ê +,¿\¾Ú +µì´B¡„½•±}·µiëÀ ¹UüEhãÃÞQ–[O•aÐ +«Q3—cÿUëz>¶G>©e§‰êŽ/µº›,&1²˜¿4<¬VLQ +¬[ÇÚ­¶4’™9Òâv¿]¹ûE]@«6&OÉ|”‹8ÞKRoOaQ9T§êØAû¿>Ì€çþÎÙ‹Þ)IÏ187üUÔõ S4Šn|˜¡@w˜(Ì ÞÈù¾#Z9Òv ³q(±F¯ŽØÁK/ ¤ +êùé“÷h¹µÂ>q‹D©DØÔ¸ÀïÖ´éRð†Û?­Vð–lÝúGŽ1µŠ3¼vÎA=;úd„u¬‘Zç™\' §áþ®²è‹‰kË‘Bþ€!?þÖ×ZŒ¥+!üÍlγeÙÜÝÛ–Ÿ¹ÕÇÈíáh{º2^5ë{¾]ˆ_'ñ•Â‰4Ò"låpõà ©Ò,ººc:Ÿ»©ûÌ™ûúŽ†PÒ%xˆ¶¯ ׂí#jüQ­ô;VsÇÛ¡½Ó2ܹúX»B ¿‰îJ {X͸©Ù¾¥“‚!“‡É“:K}VJ¤>º<žî( M(vÓ$1YVlÛÌ eÍ%¦ÜþŽCð¥Žbñ…SÆħ• åEî‚Exƒù›MÇe ÷»s+?1?æ£Ði}¥£ƒ ^ãL<ˆçLT.R>Áĸþ$XÇE] {ìgÈ3#ßJÕuèKñuêb=؈¡Ž¨) @ˆ‡× Áö*ÀíµâàTRz‡´èñ„TÛ­ùðF2ì\žùEûDñ™ÉöG¬tä»bâDS§Ùè ×R§)_JÓY¶7ÓBÕ‡–šƒãcŒ¹ôçÀY:] è B¥Ck˜¥³¨J‹8;õù™û âÛ­U穈ãÓ¥jÃöq-úïÛòãÞÝ#ìqª ÓJÕ- ;}j b÷Õ^º€ÕxW¼N0…üº)^ùö–¿8³ +*×äÏ°kv +.C,}`´¨LÄöÙ"9ê¾Ïæ¹H¤:}=à¤Ù ,{ïî6Œ¾\¨æcù¡TÝ×αêd@ªàÂcɦ”/€“çöÀ9­ænº4+å‡ ¥ZÐÔ”5ŠIǥǠª‘ýÌÍt|8Ðbêðþêòô=žöràHÌi)bùÄÇðãÊeoår]”Ÿ,·»«ËÞêbÍsøµìùÖZKXC' nkÓßÀ4¸0YàÂ'þ%w˜Àà„_Îú‚®Ò>ƒï¾¤«e;ÆÝ[ÔM‹v0Às-i€ ü†¿ðéats2É”Bj.϶ëbÙë ^xÖ`Ýæ‘d|Ä…ñ7%eg„ÜŸ^qY³òàè=ÿ!5ðùkX|çÁ¡=¢‹ÿpHÜ¥‘Ý3<¾gÍÜ/¥ôø³D)¡¤a ©9䑱í:¦$מ*ùäendstream +endobj +4520 0 obj << +/Type /Page +/Contents 4521 0 R +/Resources 4519 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4525 0 R +>> endobj +4522 0 obj << +/D [4520 0 R /XYZ 85.039 786.531 null] +>> endobj +4523 0 obj << +/D [4520 0 R /XYZ 85.039 763.817 null] +>> endobj +4524 0 obj << +/D [4520 0 R /XYZ 207.409 769.184 null] +>> endobj +4519 0 obj << +/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4528 0 obj << +/Length 958 +/Filter /FlateDecode +>> +stream +xÚÍWMs›H½ó+¸ª–1=ß“›íØ»ImìMLNÞÐW¢Šd%W*ÿ~»@X8%³U.ÓM÷ëyozf Lñ¡U,.4V3% œ®ƒ4ü‚–?¨=’Ú%éøœeÁÉ¥–!¤Ì¥.Ìm—2åt˜Ín£ó¿NÿÉ.>Ɖ"`qbŒNcn£óóëOWYdôöê’†®?¾­VDÙÛë+o{C“QF†Ó³8AŸt¼¸‰?gï‚‹¬ÅÙ©„ ”?‚ÛÏi8ÊÞ)Ά?ñ9eà\¸¤LIQ¿¯‚›àCËÛdè¿:4)G"€3 n?Ÿq¦Î'vò‰½|i˜sŽJe8s qú™2ºë°ûßbe˜S +AjYlSºÃXãÕ8eYìt”OV4Ís¤ÀVÄqšê“KP¯•fR;ÌGŸ½Þå‚s`©ƒ°`e㳇òQžÝH”î,/àrê¥U½¬I)6ÝÜ-üèæ;ª¤\nîð¯ðjZlî½”öëæÃßþ}Äb6ñCšÆÜDß(h¶[¨ÔŠimºW°@e¦–‡ úZ>諘T2TÀ„TÏS2)‹¬®7LõQŠaüSíý8JÛ¤@‚>Ì•\ (( LY¨¨º\ÎW{“&PSxØ v<²&Ø04(vka;Gm ¹åÜÿ»0•° ¬&qHfÒ¶”gsªF¢”£YÛaJ¹a›*MÛrC³"hÞ–øúo +r~ÿºZ„¿ª¥ôGW~1}Ýe¯¶ÉÇÀP)­:µTÐ*wùºªéÿÚÖ¸ Nð°* ?^n|+yEåá3Ö;ÍWæU¯|Æ(ñÏh-!uLsÖ†ÐV§ŸïyQ ý$ë澿l]çxÆ1ŸÇ£Ë½(º„ÃˈAº33ÂG×CQyß÷ÑÔ0Â’,§YòÝzfóEþ@hËúTPâK³ª‹|M›~µý÷.èQ +x¹û°À WÃAgãŽÓÇ,/óI{äš÷Êd c ™ ÕÊd[Õ*ÿ nûB†÷¹a™`Vò#Û~µ»â‘ñ½"Ù‚C$C%µ"éÔ4¤!RÝ«1`¿ä=SÙ'¶¼}Z÷ä‰À·ŠU—h3Áÿì–þî«êÌHdoêKgùÕWRiîÑí۔ʫ/Ô7–wKºP~y¼göÞAƨsdÁœuèf6ŽÁàùˆÎçxB¯¿•c{†µX ?̼âœqpH“õµ =D”B†j¯äÿ‹ó ÷endstream +endobj +4527 0 obj << +/Type /Page +/Contents 4528 0 R +/Resources 4526 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4525 0 R +>> endobj +4529 0 obj << +/D [4527 0 R /XYZ 85.039 786.531 null] +>> endobj +4530 0 obj << +/D [4527 0 R /XYZ 85.039 472.12 null] +>> endobj +4531 0 obj << +/D [4527 0 R /XYZ 221.091 478.093 null] +>> endobj +4526 0 obj << +/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4534 0 obj << +/Length 2696 +/Filter /FlateDecode +>> +stream +xÚåœ]sÛ6†ïý+tWéB(ñE¹ÙÉ—·î¤IS+³Ý^(–bk"K^IŽ›_€aY<¢è“Îìt¦¦Hˆ|_àxp…2÷šeÒL‘3-ùàêö,\»+ÿ>ãe‰qYdœ”y59ûù½ŸÀ5¼x§>üñÛˆ»«…N.>¼×ÞÀwN 'páå«ÑØ•¹tß^Žþšüzövu&N¸” ògþ• fÎѯg“¶<¸ãŒqk·gJK¦•,?/Ï.Ï>Æ{…kj¾u¨RªãB1aôÓÇkÊÇɽÇÉ'Ëcά‡žTdLeî†i“§öÿFi<× ”åV°¼(b{éO˜›ÈSb眄þà$$+¸Áq†.V8ÂÓW8®ƒŽŠ-_ʳåŽÚ Yµ& +Ä0‡±Ôâ Œ(ýŒ=ÿ=èê#³­ó¥‹&ÆÜ,ŠI#æLY©Ž!–„º#ˆJ†ËévŽ¶þþƒ +À¹6Kz ÜÙj™Ý-Gê0ϺÔt{ètžÌÜa·?‚¹‚ˆ¹¼`…P(tÚͯ•,N‚ŽsŦ«ê +ßLaºvýˆ¸·}©&j)ØüWð=2|J}¶_ô¹ˆE +ü­ªÝ Ü*~}E–o¡Ä= {ð‰ +ÀZ0€˜ý`êÿ ”ö@Ê°N;ÅÒX@éþª£ïÜûQø†óM’•ª¡rçnÛتµ„s¨³ÈVbíÛHçÃéƦ7``Œ ­QÊ(4Çü ª¹J ¤šï¡¦‡™ÙýÖÕüôvÞ”E!ÑúÒ(šewY%¹úƒ(sÃT™«GP†+këήBý–sr3ĵ + +ˆ1OâÄT7ˆ)4×cš#ĉæjU$Ôút±Š8C…—ÙìE]|{ºù>¬¿4âNáªÇ³%å`V€òžœ£‘kùV[› ›†q¸VÏÊÇfMHØh%Pç±W$Ö;õ +ͱW šc¯H4W½¢¡= 'ÝãT¹2œÙ˜•qœè£i¨/\ZÌþ¥Ù>Sžh âQGÌ©¥n0Sh®aÆ4W0§šÏa=*{Ñ2â~Éâ¾½‘n +=ŽÆa±PºsÁxv4¿‰!Ì°­Ñ´Y´]}…öZÃ¥‡PÈ^eÒyç'|e* +ñŒNUk¦èTX ÄNUWA·>E!¹îS˜äاjÉ~m·j3|(§Û]ÕMðS¨î1üð㘕¡ð»3ÂÝٶȔ{b|ÒnlmÈr,¦Ëð¡3ð‰NàQ×øÄv'âI4GâQÍ‘øD󿚘&ÑÕãÙ­03Ï’ºÑ× ù ÛpÊ>@Ù ÛA3Ô^o꯼škx1ͼ©æ ¶¡Â//Þ4rM!¹Ç³Z‘+fr|‚ð;E¦=¯!͹¾¿+¡^ÌÚ¬f%ϧÀs1NìtØBs1¦9bœh®0~\ßÂr{> endobj +4535 0 obj << +/D [4533 0 R /XYZ 85.039 786.531 null] +>> endobj +4536 0 obj << +/D [4533 0 R /XYZ 85.039 700.264 null] +>> endobj +4537 0 obj << +/D [4533 0 R /XYZ 228.576 706.237 null] +>> endobj +4532 0 obj << +/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4540 0 obj << +/Length 2868 +/Filter /FlateDecode +>> +stream +xÚ¥Ymoã6þž_áû&µ"‘ÔÛ}Û6ÝÅ·Û;$‹= íÅVlÝÊ’+É›äßß<3¤$Ûrp‡"@H‘Cr8œ—gÆá" ¿p‘F~ ³E’Æ~¤ÃÅz,¶4óá&´&Ò~d õg&Wnv+?0É,=c•(ã›Ô€æLJ›Û÷*X¨Àc½xxZ„¡òu¨q–ùQ’,6¿y4´\EQà}Z†^~8”õv¹Òqâ}ºG{_ËzÓ,uè=/W¡×É`^o„êK]Òº—å¿#+:= bÞøC úæxè0yóóÃÀ¬å5Nˆ±H¿y _'Œa@Gd'×щŸ˜ŒO½ïq¶/kjé&Êhï¹ìwè)ï>ß/Uâ=‚f¥ Á8ôêâYè¶ms¤™ƒ|íIô5Ýè Óõº/›:¯0×/Uê½ÊdÙI›cìû2"!•UŽ£ªBfúFÚ5ÓÒDNÞÛé¼ëXbô•zërådâõåv9Ž^ò+(Ò=@Z0ϸXÁ;Ö˜ ðpDJo‡Y»W<Èô=M~ùË™\ú_>ü·É +>2ôHUL¨½‡]1n‰‘¬„š©0$¬­›=öP—ËÛ0,Œ +K6tJ»÷BZ–’Ö†ž©·ƒ"¡¦’OÞ€x§å$"+ŽŽm·1V¢ÝÛ%ôokiÝI´ÂŽœ=ÇDôÙJ;UŒRå‡Q +}ýóæ·?‚ņtû—›À×Yºx¦~à‡Y¶ØßèˆL0‹íwusó¯a3HI‘Jëèê>¼* }¤'äælŸ•ãŠ<y5šQ¢ˆc?‹"1£Ä3â=Îü ¯ðuI£dG5n —pq_»&P~’fØxñ']& ÑL3íó-ÆÛñÀíǽZÜ5Äîâ„cÙw5ÙX ?~û9BrŠ~…Ìñƒ}@•ÞïAhÚ®—ø'ÑB~Þ ìVlŽ&G+tOÛÀzÒÌjYæ;KÚ³ÒÓˆ³!êBïIýÙgâÛ-Î¥‰åûÇ|F÷ÿy÷¹“Åì7Ðö;ðÐã#Ô}p,v”‹?bò|ãî%#‘ã Ý]n7…=$rÃÂ.l‹}óÝYï§6gŸÝ®9V04ö ú°ž4ñª¦Þ­ öFÝaŽ‡`×ÛæN0E_ˆ§åóÙAÊ3㪫0‹ý4‰OnL në*¨Ý–ß ;²³ªìúáb‰Â¢¶“)9–ÿ[É·Ý®<ÞI6â·½†RÊ7Id/y×ìs,‰Tä½Ûì˺›ËÊ­á[Db»°­Ó׬KÄø2Þó®\碌…8ø~DUYO—ïfŽp¦Ða}¹Ýõ|6v˜$R¶vS—í7¶¤»ÏE1xÒN<ñïAð)ÔßOXq¬ú‰cojèÑ®¼=qÁ´2\Îxb“„~D™¸¼¿àAá¦Ã,Y¬dÝ_r뤾J4µ¡ŸfæMÜc4ÅÁŠÆ…Æ×&žâC…äÊ-Œ äLæ½_êÀ+òþØ€´­ýXÔäÉÏs —¹mßäo¤¹ŽË4,LØcà•zä +WfXU£†R+¶E‰WƒW"K£WoZYÅ6Ií ~ÂZØ{¡€ °Ãb`da+õ??!¸•o/20b?æX7Ç;ˆ¤Î¡Ë” ‡€ + àè±ì[ eõ*Z<–sŠ>#ª¡›ï¥7¢ž/PòòåödŠ"Ћ OXľ3°è`‰{ˆ)³ 4 y-¦ÅhÖ^'(…!tàã 1 N¤ñbñsmeÐ/¥3Î"”N.Á(Íñk`­§@ÞÌ bŠ_Lü÷äšâø>A~B´Ž¼~é [Sa)ù¨á¨_5Ög@z²F‚9‹êÐâB&Dr;–Tátï)_ÛÉnÐÇòÐ[pŽ,)¡\@B$Ž:‹Ç¡-ßó{¹qJ ñf….ÄŽÈ»Dó!3º2Yh*po üSŠÇâÚ±Þ¨8£=æó!ëÈ­-ªØ—¼’g·E1ZìLØ ÈM„áÿp¡ÔO”£›$k1ƒ XÁùëCöuð‚‡Þ^M´ù›¼ Ë…F}c¹l°¦-x=`ì—W']˜=·p]èP&üB ÄjÅ2^d†%ùê,¥‡Áè’ø„FvL9:YmÿNΧ˜lÃâÝ8³0ö ¾¬Jn +&úA„ÅS­!¬¬’t"=FL›ÍŒ  ”Å™¥œÛ xÁÏâôD\~j$rÕüë©À¼±«TGNùÛ[›%QÌ2£‰]È€ÎO'É E8Âifcàè€4$»áUsn7LÆ{%^ï9¤Ò.Ï% +•¬¬3Ýñï?îœuoñMqý +A”†kµ•¥`îKVUš(÷ñbŒL1ò8¡$å“W¦ÆÌx’¯‰÷ñÉÎ;Ǭ̉ƒ”ÙÍ0R8‡K£Ÿ}°,V•8䚇¶¿ æo…)‰"åi;v²z åI<ßÍ1>M…íÃ@Ì™Ef7áÀš¯G+·ÊNwdQÔ²…€ ¬j Œ<Ü<Éhn¿\ ¡“x“*Im|BçV‹ÀeºW[ÛÑCRx p*2²Ÿ9Þ”uQ´®¢dHs>Mc*—ÙyÍäzÆè° fN¹f¢ëÖž¸B&’œ =Ïd&‘"½Œ“¤ 1hQãÓÔØÀ¢_gƒ¢äšXguV€Mšˆ›pl^BªÛ”zj†zª——˜* üÈ¿³R»«ŸÛÊ ”e€ÇçåúñG‰æt±Hxi›ï6Ä|ë_©F„Úø:y»Z2¡¹^- ÃÔâ¡Z¢lµäÎe¯ÝúH1„úM}»Ã›¬Œ4× #Aq©Z=Aª0¤ëá\ø1J¦.Ïh«xDt+U<#ulŒäÒØ_bà äUÒô öäÜÚ¼ JrºmóýŒç8³ñ¬¤¥(äAéQÈÃ÷±›"6%Lr\¶ÑFvïY"•æ>vQi2jöiÒF”»tSØ1Qjík¥ÏRG{à 3¥ž½ 0I³Ô7¤bóနO +åwÎ $‡ã\ö•×"¥np¯gK‹aÔŸw¯CÀ–½LL¶r€Ï¢ä ²`»¼ûÖAã)#.\F*öÞ=–Ó_1ç•^G”´œüH{U÷GÒKÕ×öc5lÇFªó3#MÖ“ê7ý/Ø™žendstream +endobj +4539 0 obj << +/Type /Page +/Contents 4540 0 R +/Resources 4538 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4525 0 R +>> endobj +4541 0 obj << +/D [4539 0 R /XYZ 85.039 786.531 null] +>> endobj +722 0 obj << +/D [4539 0 R /XYZ 85.039 766.606 null] +>> endobj +2958 0 obj << +/D [4539 0 R /XYZ 85.039 647.281 null] +>> endobj +726 0 obj << +/D [4539 0 R /XYZ 85.039 432.131 null] +>> endobj +4542 0 obj << +/D [4539 0 R /XYZ 85.039 410.369 null] +>> endobj +730 0 obj << +/D [4539 0 R /XYZ 85.039 134.374 null] +>> endobj +4543 0 obj << +/D [4539 0 R /XYZ 85.039 107.759 null] +>> endobj +4538 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F56 2890 0 R >> +/XObject << /Im2 4150 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4546 0 obj << +/Length 2737 +/Filter /FlateDecode +>> +stream +xÚ¥ÙrÛFò]_Áõ>¬! ƒÃUÞ-Åò¡T¢x-y•­$ Q° @ÀHúûík鬷\æèéî黇jâÁ?5‰ëédÅ¡k´šÌ‹#o²„wGJ f2Àüp}tú6 &Ês/™\ßuxÏ5I8¹^üæ¼~öáúÍÇéLkí(ß΢(v~ž*çìÃø{1)çòïãòo..Ï™ú±s# g—ç<øtyñ+Þ}D€_>}¸šþqýãÑ›ëŽÝÁ…”ÖÈì×£ßþð& ¸ØGž«“xòcÏUI2)Ž£]h™¯Ž®ŽþÕáâ½`§ÆdctìšXï +G™pÜ^+ã†ADÒi«é,ð|g>õ#çnŸ–Ë —´ÓâTÆ Üie’– (§Í YªjFcÑ}ÉWpbÅ“ß=ãY€9J÷ªGì)‹uê'Î3ƒ=Ô€8"ðŒ@Þ©×%œ.sü»ä¥ªâ÷Vx8væé +Õ"š)”`B7.R¾kŽh2— DFC°kBfçø /_ D4oÚ:má>Ê9fˆu“á.ÞÐhØçÕ”?íh'·ÄU&pÕtb6‚U.Š¼DæèÖmM’¯êFˆ-ëj K'0­. i ¯ºÏläBÄü}Vç- ÖFáÅ +¹Ñ%ÜGJ8ô@ÈПù*[Òu𢠉‹;Mãg|&zÁ ’œè‚ Ô´š¶|oÆEÐh;ø½%Íg ,˜IüYŠ“íz¨ZC7D‰¢WZ‰j½_{Ç ºÄKã5•s"`8¼ݧ ïeOé¼]=[*Hzi!IRKRF+ÇìñÚ=Þk‡7÷VL`å:Aå¯ U0¼¡«-*$úˆÄß¹¼Æ3œ +œïyO<̬HRÞXTEš ‰bCâ¬JTà…r€zq^‘|ñØ>㳦F·~Æãw–Œ3q‡ÄïÝÖ>œ¿æEò)XHQ™‹l! ¯ \Ÿæßò¨d`„´ç# (âªþÒ´i›W%ºŠœ7è¸Ã2ñÁtG=7„oz¾q||.rG€Ž‰°=Ã,~mµC=àÎ(w¯5æ9CIâÞv¸€QÝ… r%«Nœ="̆éÂ"Åýå2/—<¯Ê]²hq]{!o»†DhˆBwÕjŶßeXe.³‡†§ Î"ó:ïÌ9Hb‘Ïòœm*¿ø" +ÅÕ+ÔûBÊûX9°uÆ}˜ã$ð#ª6ؼâμƜ¥³ª:úø… ‹¥ ×?·k›çCO»¡ŠF+ 3T >V +a‡ ¹Sî=@‘s˜ƒ|ƒšN Š1Ô¶’…Sþ¬© €?O[!±aͱ¶.ƒte7‡©Ó·zƒ¶QP°³Hô4k秜þrƒK¹~d!±|9ãÎÚc ôà3â4yË_Œª¬È=º2P±za|XW ýº²@Èž¿OWɉ®S] ©¥ Êä‘dò„ýšÓ~2Ô‰{—‡ðŸºœH[ž\Ñ´|B‰'c!ÝF¥ª¦EˆÍF%ÎÛiPyŠÇÈ–žØ™g« &ò;æý™"üz_ìÇ*¸g­Ú:áÄN‘{ñ[*ÌpP¤€ü5Ï2FW4Í8qõ_°ÍG±@>æÖ +%”W_ú0œéòÕËš3_…è3 êÙɆ‹—O/ç¿ü\e'pßò„®·Ï¨‰Ì7Œº:`Ô„|è½F}ˆœ5êƒÔ¬Q¨ýœ¢ÅR½cÙ‹D<6‚U¼Ú8Œ_ ˜Ïª+”v;¶¿°»LêaõÅmŽk +z”„)‡veìÍùl·..ÐÇõ RÑᦚëªjÿ¾ãhZ½( œ‘ŸÓ~K¯^Ø„…‹äšxœ¬Ëü‰aDb»6;áS»gœ¯xáªÍº¨³t¸ ¨úL;2Ȉ\ù¤`-³a_‰L¨kÛð†Òȶ§4h0`¤|–Wó²Ûƒ +7ª)—ø{ÎÙŠPV¼9¨7‚°ÏZµ,´¶âlˆ àË© +GjlEbé|c'>1"DË·„ûÊùräBý+A P×ÜI¾}˜]©lÀ‰Â€¾Fs†¸´¥fÉÏÌ´ C6ˆâê}D§Üb¥›£¯I°$u"¢ÅÀ³xOÕÿ·]¹3÷CîPñûÀá²iò[8.¡ðKN€NTê'ÀÊ-I½NkYùtIïJ¿òLZiZDýy˜Ü2\‹FÔÃár×ÃáÁS^ƒŽ“Øñ¾B’ÏPsMQ6€™]“ã(ú=7¸!ï[áFMö¦ã4æ2_ðucØ÷v˜„A}8袋‡%ÍÈã¼꿘w»÷ÍíŸ$M%ïJkjEÿÛuö=Có‹Tæ.±} ñèyËoQ‚’àÇÊïõOæ¥ÛÛn“~÷T°*q uNï[NÓ£Ú½u'Mw’ZÇÝ[ÖT^7zGŠ;Ò„ûÖõjÁIƒþ°äÝöžJ.½‘z`.b¾j<êgñFÝMÙŠíHG[Ou»W¶}ØÃuæoÛ8Ü°2’ç–`Ø‹qÕ‡‹ÜŽe8¹*ö%»Äÿk†«óÅ+å¡Ëm仳ù¼Z—-¸ÏNžKçóv,Ë…Ô5 “ÜZ$š“‹Rt“Õ®¦ès/aèã—äü…‹¬³(Š`ï-­¬»gz˜*ññ×µÏßۼ튓-‡(7il[¶Ä¡WKê×Ù2HÏ{Côô5ÚZs™DÊ=1Ž÷U'‹lð "¯sƧúþžŠ0@Êa ƒF–ËJ“11šzEe\€Æ¢QóàÐÇ‹sá +¢>K gc–§ƒNß1èOco5„4AgÄP&ôlC­À_^ÚÑoåà–š H_°’l'× ô|Ñ'pÄI^2øöէᢅKÅ-oßrx¸ê ^Öû˜kˆcÝðuÆnMÁ}ÝÚrE«høÖä•X Vüü¡UØó§XÆø泘"µzLrÛúΚ¯-R"Â`NÏFL(]·HÛ|Ný¿´a>˜=²Û2Š;ŠÓ\ŠùíÃHE'ëE&eFÞlÆ)¡»ç!•`3wø® õ(>ì*7A^úqT¹¡°KÐé+|š™ãÑ{$'YÌ­ºÐaK”Šg¹®Y@{8„/ÿbµŸÁdÿL*Œ\ûºZ•ïË@ø†“UŽNëûƒ×J?•P\Wò€ƒkƒ÷.Y‘´}bøƒõ Üã_®ÒÛ´ÉxÁf(gOd9óuKØ–¸M8ì|í~"=5å ßôM¦ Šunè«œ¼n,@Q%‘`•:ä}gÆbjÖ¶R±5©œö¤9†cœ‚Zg_ž#ùïXûÕsÓfÅ ›³?š4¼†ÕÓÕLÍÌÌWø¼*µçÏ”IB“‚@‘È}ÏçÊ +ÏÎþÁß湡}$žì6“ßCÖ¨ªÜ„~“ê'~ú¢z”(¾p}ƒæ»uÖ´ßI4%ºDŒ{œ\7wrøÏ þ_?Yw¡"ˆÝʯÑPa|ˆ[ªc†"™ÒÛÛ߶wYþ/?·Íendstream +endobj +4545 0 obj << +/Type /Page +/Contents 4546 0 R +/Resources 4544 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4525 0 R +>> endobj +4547 0 obj << +/D [4545 0 R /XYZ 85.039 786.531 null] +>> endobj +4548 0 obj << +/D [4545 0 R /XYZ 85.039 615.045 null] +>> endobj +4549 0 obj << +/D [4545 0 R /XYZ 85.039 600.89 null] +>> endobj +4550 0 obj << +/D [4545 0 R /XYZ 85.039 529.894 null] +>> endobj +734 0 obj << +/D [4545 0 R /XYZ 85.039 199.481 null] +>> endobj +4551 0 obj << +/D [4545 0 R /XYZ 85.039 178.285 null] +>> endobj +4544 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4554 0 obj << +/Length 1711 +/Filter /FlateDecode +>> +stream +xÚµXkoÛ6ýî_¡u 5-Šz耴I½Ëcu‚h‹V–e[ˆ%j’\'À~üî%)Y¶$w}¡@L‘Wäṇ¼G¥šÿ¨æÙÄ`¾æz±ÕÂd`hK™ ¨Š©Q#æÅí`üʱ4jßðµÛE=oÛw´Ûù;ýå§7·ço†#ƘNM2¹®§_©~zs/†#ª_Mä8vOeóíÅÕÙõÐôô·ªãôêL6î®.þ–­É ¸¾»™?ܾœßÖp¢Œ!Øï>Ú6öz`æ{ÚÚ¡¾¯%ËfĶ˜z^¦ƒ¿ê¹ä˜¥É·º¸±™GlµÉ¡vƒj2bšTsm›8–+Øy5ô,çr;!RÁ“l•öXúøˆ°· bh® ÙÍSÜïø•í4§§6˜bâ4*!&_æð"ßdIÉ—ö0¹ñíêgF-"…¨ärÁæX)Lié½aü¡28 RÙÈ‚eDú2Ââ0ó¸Äv1‚EF-Â,GnÓ$ŒšškRb™Rcز-_ÉÓ÷µ–›!%ÒÆ—ãêÓ0³²èCF=XÕ=ŽlÓ‘_…Ìñ]b¸–@vþåøÃuÌh°Í1©†äƒÖlÅ¢§—eçRÅ‚4!(+ûðÛ&\dþqü»˜#âdŒxŽLÝ©JBÄ£Êýs/.Hž¤ý; +o£ÇÓ±l„Êý@2·J‹*‘»„µõP®T'P94]ƒiTþózrd*Å·J)x\¡h'}Röï¶+뻪°ƒJÀZ••O|Ÿu¥Â{ž5€Ø®ÓŒ8ü­gBÙðáž9†O\ËëÎ\U‰kå¡æWdB—Z-\\®GµÆJ-8UÌq8‡3!œB&KH °hÍI±jað,Êë€Ð†"C[H˜Ý6¶íƒì%_Ïât< äê˜0.c_Â15mýÏ6„Ú°¡´…ÍM§KÙLyžà-ƒíâ±(£¤Ô“p¾&Í{ÑkíɬL²ežF.À±ŒçÏ?…xÈ0|•á¸êßjá(kÏ׌7j†‘ZøÉÉÕ±`Ÿú)¹â[5Á*H—Ñ=iT]\þnWÔ­Ù©ê}ïýË©ü}§s¾-Ô¤Q¹åù}Ív”vU—0ëfd÷LfÁ}›þ*E`“¬"ª²3nð9~JÇ +Òï­µ¿L`•›<= `rq&Úü–oÖó¦ÊÖòidY”’&¢p¥È*õÒó«m=× s(_÷wý>³\W#æXà‚Ž;afQbÒ ßYŸîqÓ“g+ +Y"¢Œ¶}¬å«ö±‘,¹**MQV.6€Â w–°FŸ+3ý…tQª‹w¶x¹q,[keaÖ\¾|/ßÁš_;2ªŸtìcdyb##Ó'¾r­õíÐÐu!,ªl?WòË‚rõ±äñ¦A¥‚LáU¼`ÅøoËž\›G½£ž¡ÓïyLÀ»{–Ǭ,‹F˜ÇA§ƒ©®ÌÐdçu.Aãxì{PƒB©eG½‹éw:¦åÏ•×ÁEZYbt£²= ]S^y[ûiK_ ÓùýÜ0Ùa^Ù Ú KÈá»4Æ’<þ3ÚÛ<ÈQÌ,*IÍç\¸`ƒ)ÿ"je§Êñ_7à)!¢´Á2F¥­»®É}tâ“­²R Tsó´òÌ•W+äã¹°qqÕvJø3õ9x`ÏNÞ%ÇéæÅ3¹Î͘øR©Ü×ô %z÷ThñÕZ üdO ŸÇ uC¦¥{þäŒ'AœV%H,T©Û@.dL +Ã@aߺÐ]N­u6ØûW™l¢¢ìØŸñùãw®#¨Š‹2JÞ±•œó²]N¿fŸGÑϤeÚ0x×YÔÃØÀï¥? ù¦²Jý ¦áVz„÷UYé_h¶<¾>Ý7yüåí¬³>?b‹±n;¢öýcìÔ_ß3»+† .ä5Qç ~ ®þ“¯ ù?y^L»endstream +endobj +4553 0 obj << +/Type /Page +/Contents 4554 0 R +/Resources 4552 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4525 0 R +>> endobj +4555 0 obj << +/D [4553 0 R /XYZ 85.039 786.531 null] +>> endobj +738 0 obj << +/D [4553 0 R /XYZ 85.039 736.632 null] +>> endobj +4556 0 obj << +/D [4553 0 R /XYZ 85.039 707.834 null] +>> endobj +742 0 obj << +/D [4553 0 R /XYZ 85.039 665.684 null] +>> endobj +4557 0 obj << +/D [4553 0 R /XYZ 85.039 645.094 null] +>> endobj +4558 0 obj << +/D [4553 0 R /XYZ 318.781 623.298 null] +>> endobj +4559 0 obj << +/D [4553 0 R /XYZ 85.039 366.461 null] +>> endobj +746 0 obj << +/D [4553 0 R /XYZ 85.039 282.418 null] +>> endobj +4560 0 obj << +/D [4553 0 R /XYZ 85.039 259.1 null] +>> endobj +4552 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4563 0 obj << +/Length 2004 +/Filter /FlateDecode +>> +stream +xÚ¥XKsœF¾ï¯ØJ.l•wÌÃãàƒ’ØŠS±¬Øërª’Ђ$*À˜µ¬Ÿ~Ì«e•¤R.‹¡3=Ý_?X¹öáŸ\§Jøa¶NÒX¨P®÷ÍÊ_ßçr%­ÄÖŠlg2ßíV/ßÄÑZú"ó³õîvÜ'ó…Êâõ®øÍûþÇ‹ëÝë›m†ž Äf›$©÷n#½‹ëkøûv³•ÞÕ%ó‘ü‘—Ÿß^ýð~¤ÞgK¸¸úŸ®ÞþÊ«Ë(ðþÓõÇÍ»ŸV¯w£¹³ É0DcÿZýö‡¿.àb?­|féúÖ¾Y¶nV‘ +…ŠBû^¯>®~÷b^´f­%ߨ0* Oª™s$Ü>”Á:QJÄQBÞiK³Ùª@yw½>tMÞñ[£‹êö‘×­!Þ«o>”]]ís£ûáfÚê+3‹¼lt‹^‹¶ Îþó×ú¡ì™öi(NwD¼G|K̼(Xüu{Wµ%¨Ï­QK’ïòþÏÒèª "{Ùê¦\<ýÌ GÍñz£ap/é+v±Éæm }ß3]ùªX²ê_Ÿ6]îij{o¥JÔÂqê?žÆî“‚øè(ë¶móò·ÛàIdeY ‚\½uמÅ÷Í&<²!쪽%Ý7¹© ¹€–z}y—÷EôöŽ¥ø>°8 ¸H|Oß²,rÈÙ*ž;;“B¦X;Æü ¥Ƴ8ȧJ2ˆL`uøΞ®ù˜®.ó16`G_Þ–ö$I6òíѺ&ç:/"ˆÃ£ûwù])ÎS¥‘©ôÙî0“¡7aÏ  Š!mR=Î÷¾×Mƒ>h ®Þë¾×›Ð÷¸,Ùc·yÖžI†ì‘KYÉD$§Üv ÔF­ªÆ:˜éeOKl¿±dIŽåGª+cê‰9â³ïðO5f2ÌÆÍyq ÝðOÞÛM§”1=æ +x.Ê”÷¶µl~ô%€þ¤˜ð‰¨íÀ¡‡HÆëå!‘Lℳ…³²ú‚fX•1›Q‰„˜KFi0DìðMR2 5? ‰„%_¹®Àœ="™4‰Ú£M˜ÖlÀ”Ã`»q–¡!$í"À^<ÔèóÇ…ÊmÊa¬I8;Øhr«AÄ®^·Ú…5Œ¼£f ùýŽI. æ¬WÑ^˜mø–sõÃkŒ~-v{ÿãGg3-JBñcØ$2晄ÌSs\G±Œ%SžIOb²F.Š¢Â +†™v‰­ÂÁ1Ž¡†àת>—x‘Ê„TÙóöM2ç/Š|‘¦Ÿ%[ûž{æøÞ˃wõº^ßÀEê²aþÃ}Ù²‚ ËBÉMSáKW>©3"„‹¥^¨b‘ÀŠE)Œ´ºva/Ø”¢Á·7õ#ËÞØ"€”ÌHü˜ŽÑðÜVß(I 0jaäöìÑ ¦’‘EÚ÷Ug³P5ÖŽ0´µXX”»®bÕ÷.¥«ÎŒÈµª“ïŽ¦Ö ˆD0únhnÄ^C_§¾Š,*%@"·T5US˪¸¬á2·Š¹1eÃ…ˆe§’Ái¢°rVþ~gÀlñ¹j‘«¹úÚ¬>ÃæÜàï§I©u=„üšÛÕ=6iŒXYMõÃ.·Q@íÎV_Ëbè ¶†ìET{[eNw‚›½tˆÈg¸éŽÑD›¥`V?Ò;Ô¡¢2»… ï¸ â4–»…¹óÁRø.šÎ*Î[æ<àMtÿ'¶c×òýÀ¨ÙF`ßDk?`zÁhö”¡áf] 7ÓxëÚ‡(7‰F^›7®Õ²‰ã(ê†Û¦›zÆRh0^0sfbýÌCž +¨…òˆÈ`.A5l¤‘ö‰:÷×—?WÔö_+UÓRöï*”ZåæHü4£6ö`7#¢ÃØf0ØmÿW°ÔªtÍkpE +ÚÆ‘3xÈU¹0»Œ£%О”'$5%g{ÇOT,ó¾®hP…ïf3u'°i\ö/xèeœ;%{>ÙRõ–¬Iƒ'wÅŸ$¤ùýép20í{277nŠãt‚ÇIç<&p‚öðm±(¹]qv·OfÄ›ÁTæ0;÷–§Ã`©`ÚbÁ²¶tK? @F¼ÀšÌ4!‘Þ0 l+´[Êa.ÅXtUWvÔ+X9çñIhr{i~Ò÷+oî&ÈäÈe3Ù1Õ`MM/zz;·Ý¹Ù*ô¥€”{nv™DÎÏVAš‰$<ž­‚…ÙŠl‡™ +m×8W=Ì­K*Ü%ûn-¼fÅ<sžêã]15¦Á Æ&T8;»P`"ÿùÙm&s~vƒÏJ!Cö9M7©w“oCŒTä\}è—‡DyWïwL¶»éÞ0e¬ +Oæ@r´ÊØí{ÝðË 5þX*Ÿi:/Vo¯9åø넸}¡™M·ÛÓ„ol&Øì,‚”ˆø7ŧ„ÿ Äÿõ{ã4C§"ƒþÅ0¨ €±l4†`(ÕS‹Ý“§&ÿ Yün'endstream +endobj +4562 0 obj << +/Type /Page +/Contents 4563 0 R +/Resources 4561 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4568 0 R +>> endobj +4564 0 obj << +/D [4562 0 R /XYZ 85.039 786.531 null] +>> endobj +750 0 obj << +/D [4562 0 R /XYZ 85.039 557.958 null] +>> endobj +4565 0 obj << +/D [4562 0 R /XYZ 85.039 531.344 null] +>> endobj +754 0 obj << +/D [4562 0 R /XYZ 85.039 473.31 null] +>> endobj +4566 0 obj << +/D [4562 0 R /XYZ 85.039 452.113 null] +>> endobj +758 0 obj << +/D [4562 0 R /XYZ 85.039 301.56 null] +>> endobj +4567 0 obj << +/D [4562 0 R /XYZ 85.039 280.363 null] +>> endobj +4561 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4571 0 obj << +/Length 3117 +/Filter /FlateDecode +>> +stream +xÚYYÛÈ~÷¯˜G +°dÞGÞ¼‡ÞÍ3†$yèi‰ŠÔ’Ôùõ©¯ªºII”±`Ô¬®¾ªëøª:¸óé/¸Ë“wYžn’(¸ÛÞùw;êùû»@9â$Ú$qLí…εí]§áƳE]c…ñ&Îcðüôðîçп ýMšFwßï‚ ÜDAx—Å&ɲ»‡òß^mVë$ñ½Oõ*ðšêýj¥©÷KÝWÛ±[E¾×¿”y¦-¥q¿7«(ðúJ>?n·Õ0¬þûðÚÊšÖ/ü”§þ¹kǾk¸ëݯn³º×4‹7iüð83>NÜ>-Pœ'Ê6Y\ðšËçU’Ò^é0ÛÕ:ð*Út˜%ÞoD¸G3ö¾Õè-»U˜{/h©w"ÊÀüý  ·Æ÷Îúç©j1`lÞd–#~¼ +cú#‹î•?Jé~Ù?·þã1Ë5ÌS¯¬{âeFo¯s±hÑöXVEàÚåXÓÖXäÔ˜‘~êŽç¼î;~鎪¡;õ[žw.Le—*…ë¹6Ò¸7œåÑkI|4Ûn–Gì׫èªéçÿ*á¨[a÷2{˜…Ø^k×êÏ»ïM´¡c»=Ëqá”ÕëQVÝŽ¤”qÚ[‹âÂû†s·²U<.ä¶ùAëú'sÏ”‡º­í•Žƒ!ië¾Y4ºï#. Ím×âžOƒ•¦éùcÇr,YivK‹ýiá4f+ +8è¥ÄA,*Ù‰"A­`ÜÁ€ÆËž7+5÷&N˜h?ŠÞÉÉt æã‹z.ÿ{+®gH¯¬„¬§ìWº¯Ä{©i JÄ}eÛ4òz-B…Îñ–ÏÏ7@Âç?Ó€(ÍIjN¸ôõ²¯aˆH;Ž,±ÚʱpÕ;á“K€z;“Æ=¦…÷Ow ì¾Ña¥lMúÏ“ÝI{9ƒ_pȵtz³$Ñ^·jxˆZ×0[ìîýh±ÿú7Ö2hÃ|êºæÌ_YM_I¾¹h·Ø 6Zcµ•s„QºèŠ¢X]M€QlÀÔþn²Ó AîüÎt‰ú۽Юœ"-'Ë<×|7íAW壬Î""HÙEDAÆ—jú±ÞžÝ¨ç.”²&™²DqͨªŒ>™+¥] 'ÃçùŸÐNX^@°f¸׉q8 ¾<\ä0ÝÐK=جåYºE£†M€µ®ÜH|¼Í(¢-Œß Î>Ò sD§˜Ý(Ô"u C|­!tÖTßt…KeŒÎc‘S!«þE‹#}`QÑ9Ä9aÌŠælj¶bà†™SÐJ,B‰$rV­‹@à´#öjRü!ÑP†s”.…ÎSõóÀª¬?Ôî(+?W‘Q?9ïõM­Q *21lŽa‘Z_*¢¶fÏŸ¼‰Ã™ +ù|é´öÁ~ˆìC‡zת]ÄKukôêÖQ’ãæe¶>YL+¢z$¥6u;#k u L“Y0ò°:åfuŠ‰li +ƒ);ö錽Aà£Ð/ßÒÏ_tµÓ2]]íïPõ[ë–Ms–¾ÈÀ“¢ÒñÈNŠ§íäUˆdó™|!tSž1ƒ@6P"·é ƒ‹4§¹RòÔì`,e°ï0ß3äÂ.’û,—Hÿ ×8yW¬‡>YcÿÒ–f¬Ù“’|˜.ŽÀ#›Wm‘ -$ÚƒÐÊq¨Áw)AÔè¡xLSÊ ü^Ê.ï÷éëö’än\ŸixñU‡›®éAà43œ²—Ö j+è“hhÌŸ«/âÓ6±Š®´_0¾€¬^<hL¯,T™-‘ª°Y;U×á|#[õ•ì(yg@×Fg¶)ê’ËšŸn¨àÄInSŒ$›²Ïu$üÊæ ‡h0T4L8¬„xƦQþª9ÎtØB–ÆGCMßè,7ÛA¾Œãx¥ãÛÑŒõTŠz#3>ʘ©Ày;s¢Â“>V®”.—'†=' íÓæFÑ=ŒƒM…?,ºÏxìBo¢8ÝÃ0¶ï x\xŸðZ@žðÔ»œ0M§gƒŸª¶âºæÊÈý…ñ÷Æ?~ Šb“Æò¶1+sG$Ønʻ՘PÅ”¾¦• šMâ%Þ¤z­/]/qHE*œ*D¤Ìi!J@Ñu‰”Y¦5;©MÞ.&§üp^„ªt +-â£í¼µÅ½ý…º3§ÚÐqj+4@ãr:£”z¸œt )9óׂÀ\®šéOF&ã¿ac>eáüŠ®C)Íijd9’Büü”Dß™¼­ÈŸñ~‰áÓ* k@Ú’Ícß¼å ErŠ¤?X~^²<듨T<ßo˜oÒ,u3aÃtéÙÕŠQ¼ ¢/(,Wë¥é|½¨Ø$yr¶åõzAˆEjõ™N>Ķ¨ñ À~-™Êg„tÿºRÁz$¹r˜ï€üË‹±Wû!«e×2ØIüO›;›ê0¸â£Èí»ª(|ÆÞñ)&3°­€—ÔÖÕ4ñ}®²6 ¤äg¾Nu˜èeßý•×—BÒÍâìõ ŸÓcÈ‚ ðàØÒ(Fé”_- Ñi®‹Ý±ÂnÀ«<³æoŽ xbÒW0…‡?->d©ƒd(G3 ö¥] ²Y¡6ËÎ,6KíªAfÜtý(v…Yz6QÓíì:8½¶´ZµVE[OóN’ ‹=öREœ_ #óýëš'ròIfƒÍþkËéa‹ç®ËéÙ˜pª¸ô¹P Ñ0¯a8JÄ—}…ê—pvúËO£’I!óðÛ(ÊiñL+Ñv¯h¼ÍOàòØyZø¥[±×Ë2¹+y úÐÒÛ§ù¦9ÎlÜ-ô¦•L+“@ÊÜ>ÁÄÚÛ[X,J6qÍãÅMØ3±^#Â×›4tÓ1( ÒË5“(§àý`Ñÿ\òúendstream +endobj +4570 0 obj << +/Type /Page +/Contents 4571 0 R +/Resources 4569 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4568 0 R +>> endobj +4572 0 obj << +/D [4570 0 R /XYZ 85.039 786.531 null] +>> endobj +762 0 obj << +/D [4570 0 R /XYZ 85.039 766.606 null] +>> endobj +2959 0 obj << +/D [4570 0 R /XYZ 85.039 651.298 null] +>> endobj +766 0 obj << +/D [4570 0 R /XYZ 85.039 241.932 null] +>> endobj +4573 0 obj << +/D [4570 0 R /XYZ 85.039 213.197 null] +>> endobj +4569 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F14 2895 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4576 0 obj << +/Length 3870 +/Filter /FlateDecode +>> +stream +xÚ¥ZYsÛ8~÷¯Ð#U1$Ásß²žd'S‰ãœÍlÍÌ,Ñw$QCR±ýï·/’hy«¶R1ÉF£Ñ_P<‰à_<)³0RÕ¤(ó0Sñd±½Š&+hùÇU,3a™y<¿»zû!O'qVQ5¹{°rª(̪|r·ü-¸þùÝíÝû¯Ó™R*ˆU8E|˜ÆÁÇé,>½‡·7ÜúÓǯï¯ï¾|–*ø7“ÞÝü„/i0¶Ÿß}}/äiR×ØÿûÏçL¾þrs÷›¾|šOÿ¸ûåêý€7ÅX)Tÿ¯«ßþˆ&K˜ê/WQ¨ªròïQWÕd{•f*ÌR%ß›«ùÕ?­,nK'ÜklµÒ$“^T–e:ÊÇI¨â–4ËÂ<-ì’Æþ’ÆIæE>1L¸¦¿Gqq:¿X¥0±‰'ë|@f9/ÏýñTfev4Þ\oï§YhXæ¬ ækÝágÍŸ?Õ Oºk†¦Ýõ¨Ì ó$F82¬WE²>4WÁ¢Ýa7ؽաƒ¿ÍnÅ =J'áiž}= ÐÔs›ÞAËÒ +À­ºvÄžÙ’žÚD2ÊW&IUXd(…ÊôÛûä<ŒhÁÆå…𡦧”H'5võ0MŠàui»?QÒd–Ti˜'ùÑÄõrÛ úM?tzh;X¼$ +hÄ0-ú¨ñã‰eÇA·hz\â$ Z”þÿÔݬk–†¥Çæ8Z~¢x=4ÌÈ$OsÔ?÷õÜró~:åy¸)QAA^NøCJ|z·dï]‡Íõxwך4Eí¡ëá´gIÜ!ûšæRòØ›uî‰Ä–5oñ37ñ°¹,nx˜ÙÁt³l ÌJ‹’4L]ÕÔq`Š dtlSœ55ÑŽjá“P`GÛ¶«ýif4ËMó§(‘dUðhúâÇç9>Ëà;™4nTKæÑsóÍ?fëNZê'o/"íØKl„&Úá+KØ,Û-д«?:ÔI©ŽR±f:Ëu?ŒX}‡ŸùȦ5ªÿÌ*àÒâ8z-릖½ ›W‘ +s8Y¾9 fÓãL!MÓàn]3Vßë¾Y0¶·û †Œ ¾Í)G¶vXÓÉùëà>r +Ràû²îi³;”…[ š‰uÝÕÍ.<ƒLà¼HC•%—AÚcz¤ Ó+ }q@éÓñFAÚï2HƒÇ̃ëO¯ãó/Ö4ñ4d;Œ½+ˆ†¨ÒŠsf0¤í©Sƒ&»©¹+¢1>?£æ×ï„K´G€‡Ûè䳯Íð0Ê;Ü~TœšZ‘ˆN¢Ú°® ·¸‚ƒˆþÍHõ—4‘DPIÀ°´A+ÚÔÇ»”§µkê¾ã'†(z‹êâh2ø(øF3`Ÿ™õ¡~ô‡¬Û½‡Ñ[mW¾RpöaD…½h60èö<-ÓàÍ9f=“Lœq”ñÌ£4èê­nèØ‘Öˆ4B伶ÑàÄÖÖ2€áçJ`úÜK—–Ù{ ’a‹¦³¹àM‘=PG/.Ôߣ,êì9è83Šƒ;2‹L±f°8ßåù8ýíÃPË+í<É3˜$QÄ7ÓöØ"C#.'ËpölW;^ E»Ýƒ- +Ò8­Y>ö18D=¬[Ú陵ÆËå!ü’ÓH¦× éÒ€’NƇ$o¼ÏsŸï¸‡èÊa»ùÐ eÂC „aMxÕVk&|Û5OøV·Øó ƒæ qð«/ä@5r;)˜Ë¡§—Œ¬ · íËüã¯üʼnª”ʉ@ê7²§·ŸØOLnz~ZÜh0ôåæ“d1ÄHc)D*Ñ‚Œ¶î6Ï´2«ómOB3=P„¬TŽA‡šŒ´úÃ~ja¸z¦:ûÛ"e*øøÀýqðvxsʶãV,ÐÚ¢d:xÔöØ Nm¸Åpƒø[þàøŠÎ No£qYÎ ±"n&ŠÅ07Ì’àúÐu^`‡a 1²=¤* 8„å „´Ø´«gfÚÓ€ÃCkÃÙž(HÃÓmœwC¦Æ‘ΓùpŽßoÉÁ`Î÷ÌYM&WïXÀÕ© +³Àû^< òe@x ¼ Êø‘Ì®$³Ã&öÝ®ÞV +\ámß™xóNk)ýÝŽâð›¾ÝÈa-7çC¦C^*F£À³¢¼°Ì¯­›=¾)ëL ‰äGã\(±ÇIÒ‚$—Þ±”`÷÷˜ bx†–^—a Lòþ`yú‘iÕ;0H³+K±»DÁVц8‰CNÔk?ÔÓÖZÅew³îj“z`S³cCÙj>2H³¦ïÇQŠ†È¶ÇÅä¾Òb2’‘ðå°÷Ì“‚dÿ¨×=Ò +2€èriÇã!|O âË4'|¯“E¨XÐ)Á ¢´ `ò"˜c’¹å÷w‹EMþ>‡ð³Ý±ŸAEfóË +vw>Ü[õ2¼\¶¸åƒÂ‰ËZºs…ïÛÖD3i 1ÑÖ®ª¶› +t‹E‹v…EÊT¸‰ žýðƒNƒ^ºaȪ{-„†Ú¸vÞáåíó|dãOcg„«›»”_Þ2:%QôÄoBøõ–Ÿ8f½=Ê–SÂjz í 7ÁÐ¥ÃÄnuÃE U›ÁK¯¢@’|l¦Ò bó¸V¡•Ä©K¡U¬©à¹ïZ[L sNè‰â„ %©5'SâU‰áÈ[ÆÊó+?šŽ"JÚ19È!ÏêCÓÙ4—åS¸+£ö¦¢Ñ6£Á'$³€¿ùE0=š®!§¿‘g{øÕ7+ +1pmÖú°e)deÖACÅÖH•Ò¡fƌ°ÍL¡­áÈåO¦hsÍ^¤D¬Æï¹—ÕŒÕ|êÍ~jãáABì{ +Ü—+Éέ?ÃL[pN …õNÒ‚—°K•q˜féEhðx,vÅa…±†•Waž”xÅAŒ†9êœA +œ0Ü4A­ÔíîÃœñìÃý©Â2COQp8—Æ‹LD±ËmɤȆ RÔØœs€ÙH]ž³ãy!‡neJ¸­÷xèãì8ĤHÈÔVÒ8g.¤#'õxAYœ›È˜©~•ÚÈäží1â$C*B_;µ#1*é£`~Šùî÷¸KÁj‚Ê8gèŽoT|1K¿òÇcÚ YªÈ^Q‘ N*Ÿ±)AÂËë¥RÁŽƒôÜPš ƒlkÍâüB#p`^€O31Â82 “«’Äîpad¬ðjêÏä"V¨j&öƒ ¬ÝcR`öÿ×ê̶c'ÞñsdÙ,ï¸ÜËRÙ‰!Ó9vÉ]+r0"¢ƒ‚=iÇ̸έœOÖ+B{a= FJ¨²:Éj€Ð·[ËÏY¦{G?9JŽ`IzÉêlÉÁU¶ ÝDuØGÔÄyã¹Ò‚våŠ2ÌÐi+±Sw&Ž9÷b^Nf¾ÁwµlM AUw‚….ºŠCem± hRHfµ)$œ«ó›ÃŸ¤æΧå‚KÏ4œZ¢*ÐüA£º¸¸I½¾¸àq$£oÍš`¿Ç#W°6—™ØDI0<ë'Šøñ6鈾¬÷¤­¯íÝ&7˜¦ï)Ç2UÞ3 è׋º‹“®þÑP•Ù_ç·¡eæö’óÂe(Ä\1ßÖV÷zU‡Ì]$÷,ÆÛo¬Pz›ò‰ð³(]ŠXÜRÓ‚CÜ4l±¤àpkšcѤax¡ÃvZÂŒò°ÌÊI\aôBÌdxf“ Ï‚&ÄŠßè­‰ÝözQŸ ^daœÇ—ž³Á#¶2 ËühlŠÊòüÖ\e~èLÞò3?yÅœŸž/çøh;˜ŽHØÚCC¸ +0öL$øBÙYÊ]8¯ÓŒ_„´i‚¿>¾é^ ¾ÇO!ZÞD®Þ`!25•¼¤².?…€{§·Ö‡(O;äs6´ÄQ¢øÍj:-7½¦Ú&Rd`,ñ¨Œ|ð-->¿Û+Ú’Oq9L£„“\£³b _iŽoO«44‹:7rQv¶èéKÊj4 þ 0¸Ð:Š}‡šˆóGßü‚q&>»fE¹öÐoÆrîö¾¯;ç…$°Ðæ2•3Cåo~ê®6WœÔšËÝÝ uš=y©ŽãÒwñ‚s½ÏlG E¤³QŠ™? pª&Àøòs!É°àmªe%ÅDÅ:¹ýo­zo^„Ž¤ +“¬x:Óè&úí“¦å aÍÐüà|,ôùL§* +s€‹: Ï™N'·ùQ—Ù‘N)ÅɬõS“1SUT\uæ[¿†÷•-ĺ{ +*#¡˜o¦Ž5&á‚Ìlo\‚n8*ša!PAR‚™æ{dËe¨¸‚÷…Mý7¼mUAÉ4ÆÒTpK1±‰hû<=£“2?te%à!¦‰û+W†æˆœ F~çÀw-|ÝîV¦ï°fçùúÓjŸŸVƒÔô;9‚°€òvëîHíÚÿh ÊžþŒÂ[xøúx¤7¢¥-ÆâH“iÏTR8Á`þmP,W+…C÷ÌÍÞÓmué,(9²ˆ„Îêâ~Àd¥fêÐrK9«Òeδ쉗Îá+ºÆÁÖKL3‰QÓT|> endobj +4577 0 obj << +/D [4575 0 R /XYZ 85.039 786.531 null] +>> endobj +770 0 obj << +/D [4575 0 R /XYZ 85.039 493.201 null] +>> endobj +4578 0 obj << +/D [4575 0 R /XYZ 85.039 463.797 null] +>> endobj +774 0 obj << +/D [4575 0 R /XYZ 85.039 381.454 null] +>> endobj +4579 0 obj << +/D [4575 0 R /XYZ 85.039 360.258 null] +>> endobj +4574 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F66 3242 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4582 0 obj << +/Length 4079 +/Filter /FlateDecode +>> +stream +xÚÍ[ÝsÛ¸÷_¡ÞK虈!>øu/Ÿ“´¹Iâ6öÍõæz´HY¬)RGRqüßw?´(%í¹3?‹°ûÃî‹þÄ" ý@¥‹8‰üP‰Åj{,î å/gÂP, ÉÒ¡ùáæìÕÛH/Dà§Aº¸Y|ÒÀÓhq“ÿê]þõâo7o>/•RžPþù2Žïí¹ðÞ/…÷þ ”^rëëwŸÞ\Þ\}:O”÷ W]||í]Ù_/>½1Õç2ñ.±ÿ%ö¿¾æêË«7Ÿ°éêýõùo7?ž½¹&àLQ(…âÿ~öëoÁ"‡©þxø*MP|‘¦‹í™•je¾«³ë³¿¼¸M/¸×Üj…*ñÃD.—å*ªp‡¡é˜Ö«¬aBN­¨»²/?ã| +˜_xÿ „†ÖÊ|"e¶%R®¨ ¢9_B‡æ~åñ%¥ô>à"…©÷34”uN¤2ö:î›} SÓoÊŽ»Ü¢ \΋u¶Çz⫼›MÉc–&«;\~XŠ¥À•Jifýåí‘Mì]ƒàÀô6ãOj¢Ñ¯o¸n•µ-T?òW¿)¸°kIW×Ñ,iÝAÖvᄇ6E–F†ýj[¦,qò¾æ"JŠKØV*Wú¬-f&øñê†õ°Îœ}ƒo”˜x\þ å-¿0A³ã•o¡#T×w\M{ìúbË}ŠšÅmì¼%1© +öâPœË(/Z`¦fý‚€&ØTÍü¡¬ïÐø‚È˪Š qnD¸' ß™¡æ§F¢:ÛÒ”Cxûž«›ÚPvÀ¸²…÷”I~t†§ísEIrÔsÓ[ƒŠ:zþ=¿z«\+cLU°ë‡_Þ¾{ÿÆ¿ùÇ jgè}x|[V…ßéù{û¸¶ßÄijIì§Â²ºnpøÐ[áÈU‘µÕãy¢¬´N½w5·fôÙ)b‘-lIóZJ-ü$”“Éyö¸€éÔª^ZnèvÙÊ­æÀr¹5mQð`[F—¹Àz šI³$¢/($)X¥?/#!½p#‘¬ ~Üñs¤¥JP¡Ç=[eµÏuMf©¼‡ ŠL$k0JÚì«œ«®y7krÓ ‡Zs‘µÚúMkg^˜¦ÖȀ͚°üÅH¼‹º{ÿ%êdýÇnd;TÖ£QÓðs U_ÊHC(¤ì:·]Ïß% +Š¥[`3ˆh/[ÑRšníöBSÏè…]‘˜Úü‘¡zßñº—.ͨ­A_¶)`e +XÑ•·ÕXe5â¡’`æ ­ ¤ƒ´€8K¢¬¶'‚,eëTS”MÍ•´ö 9×Ü2º9}TJZ#œ{žUþÓóZØM²ˆ”òã@Ïž²–féÑ)+ת…ô•'œýë²-VË*ðZœVÊ[ì2úΰ×Õ‚“+–ÚÄI© ÉP¨‘·BL„"} B$.Ê"5Û¯¯ ¨¶Éî6[¡ÝCÍ’&Pe݆›^Äs6 Å$TñêL } ¨Ìí/xäÌŒ›ñg^& +KÚ2Dà)àKp'¸WTå¶ì ´I K< ‹ì1êÞñ—“ŠO¬–Ô*kó%)PeD Þ‹W/¸gf8”ý SÊKB +R7} +j°ò~EI0º28ê,ôm6øgˆ?F =•1”:¯ìŠ Æø8º²±tTóÃTùAŸÖ|‡è¸æ["ÒüÖZÝç‚ÿ]^Ô}‰È¶b÷£©´>H|Ê“"Yš‘¦z/àˆ ÄD$Ò{@ã9LBë¨!„`Û~Õ›†Iv;ߦí™QÆí¸SÁ%¨mÖü›·4{ëŸ!›ˆÌ½ ©˜¤±W•÷LMæFÎ|ÀÁ‡%Ž¦Ž×÷s¾Eì ™Cêɵ¬)v­{°“;-·æewÏ¥!{_ÒdŒlIÚ±! ÛòCáãÿò‰}ø@ÚÖæ¨Å"Ë#d=¹\•j—æÐ3§›·™Žã´­:ØáóƒØâ²:‚ã‘Þ!96P,¯6LÞíW8¤ùrÜ@êõÈî +{ÃÂègPJ €%Ì:o›}ÝùÌvh„]ålrÎpX®f¬”]ž?Hà= +vñ¢ÄáêfBÂã 'T1 £6——ãQ{òëh‹µJ– ¸1Ãì:]é$'sG†eO’ž)0Q½a³ÿµ·:eš*¤¿·"lð…1öjúxä¥Qd€Ð_™ÀgÚ:!‘ölÌE¦$-»®ÂÅe;n…"„P|ØNk±{Ò†:öqBËÂ}† Ç¨‚ÁVŽè‰êMÔc2 –=z:A…ÄŸþ N7éZ7vÙ1ž³}8ÆEâiÌ…4ֿƲˆmS›yc—u³ç#Œ¾Èê&ã[—È9>¬94¨9×BŸ] mqq´p"-MŸ«y9¤&Ï p9ˆÇTȆüüyçõ q*{J£´LØõˆìÔºßñïÓÉØuãöÏçaÈKX6û™¨8ɤ‚CvD+ÎÆ8GßKÖ'b¬bŽK©×63q +~ «€|(uü1.|¬>æ2Ôd7Å0Ã%M*ǃ9ÝQjˆe¢æœ÷åt,|!¾Å8DÇqÃኽ§Í½§Ü[dBŒd6ØôËË}?ÁÄ~¤ôI‘,ÍHOb˜PWODb_n*TÃ Ç +|‘9`]³Èû®¢ÐçÞP“¯sLŠÎ`:E/qý{ڨ︙ÀJ67·LîD: zWý~*cŠÅ9òË æ(¬`Ȇ%‰m™h#Ë ñàÁúוáÖ“£š»`Ú³¾·MÛá@îü2^²ñïsJÃÙx/œ­™H™Î7ðé­Aš!”ÆL±µ.s¶`#MPaŒ+µ‡’ÄõC4…šµ«†C7±„&„UOAí‘kíÖ¿dĦYÙÄg*Á9p¡ÌÚFc9ºjÀ܉‡®ÇšB “]}2¼ðaÒyÈä ‡fÈMÍ ŒiÊmê×?DºëGLßrHK…¹p#qŒL*«GôŠø¤’‘=©°yij(Š1Í ?f/Z´Y6œp†Â|Yòܳ–+Èa!áë]ϼ2{AýÓ!E‹=vãý‘¯lˆ2 õ4ãxoà©v¥µ@¾ËÊê| ·N¶sÛ´…s{“&|Ó¡ôäàÓq[}ã¬F¾¢<^&$4tÈTGñèRB™ºeµIaÍ$Í 5DÈŒ}eº#Æш­ãR#1ŠXbÖfZX±Ê§ì4?Å<5_Z÷›<Ð b)‡’Í SÇæ Á+ VUlùX¥Ã +-ÂÀûÕÙÝ€K ¯­!c.Ÿ±óöeÑ3VÛžs¤™¹°·b†¡ˉ1ËØž×qê\Îá×mÖÑùŽÈ6½èm0)ƒõ¤2Æ'i´[&çYMÉŠ÷r&"cK›$Æ +Nʾxɸ”U1|`Òá`I—È3¹JørHVÝtwúð)EœÆæ)…zò”B<¥@Å„õ–s{‚·±Ð²½‰#—àéïJÁæŠr—I4ìâ4[d¨,íây +¡Ãme“~ =Vs"‘¯£Ô¬Í÷‡‰˜ÈQ¼p˜IÄ0Í”Óèê 'Š®("B¹k³Úa¯âŒ…ô㜺¯Ì ÞbNÐþÉ”tˆ¯yÄÜ”¦¦  ‚G°¢@ž¢Å‹%½P¯å|Ž3‚Û16Ô)6\2ÔS.#Ú—áH…¯¡/;È›r±"wuF‚$Y8Üþ{Ñ,³Ó²I-A5õD¸6ˆqãñáå¿šâ#r‹êðd„ûBEÏ3 Ëìô$T +bIŒ¯N‹‹¯®D¢ŸG\Ô8¡ÃÅrxåõ‡54|)ô'õS¤Ú‡(Çž|†Çttdø *zJ:«¡®x[Bë¦ÊGg÷ˆ">‡¤ƒž’ÔªáDÒ{Î\|ƒ¼VŸCÞÿ">T +t×"uZ„øÄ>(N¨áÈí9ôð”lƒ":µVéÜ7èâsˆ;*ã)qmtÅÝþçÚøOÔ1ýÿRÇH’ÊTÇü7³‚½µ;¦#³çÐÆS¢ Úx ¹ë¼µã÷p»ö0'ÿ žÏ!ÿ¨ž§äÔs”Ÿr+ŸM®„ž‚}«üƒ²>‡üÏŒàÔÎûôБa*þð2†Èëd€*dp:Œ˜lJõ$ŒV&Œ~[OÈãñÎhæAÜÅj‘´yÚãsâ¾mª#Á àrEéiÉGšã¡uŠ×Ï©¬9Ó]=;­ôȇr˜TŸåœØß±¶œxÂÆÒæѯëùÅô]hRG|T™z‰É²†Û8¿Œ%:(bÊíõ#'ÌcÊ“ M‘ú4}·Ïªîè›Ë 5ÏV×îNs7aêàŇyNŽ[[Ú±˜X¸ËÚœ³4LçfA…°7-Á±&gÓÛ²Ò¡Mmøo3Î õ€A£Dt÷ÃI½y³3ûƒgç +Z%oðUOYŒbèV/0WÒØa¸lÂÎœ0Á®ãUS2<±K¶µ’Óº’'›enø53?@Îì¢áˆ ÿŽ/°Ì²±‰’¿ó +¯ ~Uj ¾r¦} V£9o4¡”¾ƒ0dî"™CTüg”C‘ÿ ˜#¡endstream +endobj +4581 0 obj << +/Type /Page +/Contents 4582 0 R +/Resources 4580 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4568 0 R +>> endobj +4583 0 obj << +/D [4581 0 R /XYZ 85.039 786.531 null] +>> endobj +778 0 obj << +/D [4581 0 R /XYZ 85.039 287.543 null] +>> endobj +4587 0 obj << +/D [4581 0 R /XYZ 85.039 266.952 null] +>> endobj +4588 0 obj << +/D [4581 0 R /XYZ 85.039 238.862 null] +>> endobj +4589 0 obj << +/D [4581 0 R /XYZ 236.167 244.835 null] +>> endobj +782 0 obj << +/D [4581 0 R /XYZ 85.039 128.42 null] +>> endobj +4590 0 obj << +/D [4581 0 R /XYZ 85.039 107.224 null] +>> endobj +4580 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R /F56 2890 0 R /F74 4586 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4593 0 obj << +/Length 1766 +/Filter /FlateDecode +>> +stream +xÚ½Y[Sã6~ϯÈÎÌÊX–å 3Û)åÒe‡Y¶íe(Nlˆ‹gB‡éo¯ŽÎ±I‚ ÙnhÖ‹d#}ç"[ŸdÞuô?Þ ¥íˆ¨„¾-ïǧ{£%?w8i0RaK:?õ;»Ç¾×åŽ9Q·]9¶Œün?¹´>ìî÷˜ÂâÂî± ­ã·NzŒ[§Gºö¥‡'çGý³ó^(¬?°iÿÓ!T<ëB«}Ø??¢æžZÐÿú_\`óÁÙ§þ9ˆÎN/zWý£~íÀ’‹\0ÿkçòÊé&ÚÕÇQؽ×uÇæQÔw<)lé ºÏ;_ê±Pæu±WS´¤mŠçáâr)\œ»¶àn7Òö½ÀÄkXŒÁ¯©v+O¡¶Ð¾®u­â!4d ÊT–Î@"¬\ßg·àvŠ ŸuÃÙÅÉïØqßt‚6·¨ËA1}¥Ë"G½Ól¦Hü§# ñ©é¥ï9*%–õ…J'IšŠO•`Ë`®ÿªñttH‡ˆEÆCúï×cÛF‹â²¬úeÎ.vO3c/Œ«Ãáú®îÆ= +ÜÆ“*ÜJÀ€25>«Ìy ¡i«ÃmS]VZŽ«°¢0+&¤mùþ¹)R#Ö,U*›Ü ®–ñ9­,”ŽÀÈ´„Á RŒfϬÁé™ÅäBOüâJ×Jbã,7¾BE'Ñ  qÊ“_!É‘¥0úÑx—*ýzž§3fuˆXƒæO#æz>d€pC÷ºZh_tnɶ˜J˜›Ež{ƒ²§[x¸{,Vf|`óÐíê°ÛN„îþ5R?^—ERìý³;SóëëzLºÒÊgX²Ø/#ú׎(Vù:¢$ÀµYù"`ÈÝVïx½‚hê®ïð ÚS´a®?­^š)Å5f;¤»éµC®¾5_vÓñ…ˆ6Å”­˜kï³Ýô8×ïŽ !ý–é³þº~‘G‚»›"-N6ÐCcVˆ;óm7DcBÓ¯?Ҽɒ¨°¥ùx$´Å$N5•$Ý2Ö´iñr-EN§M£nž^S»*¨wv32 xß^ù^øDi³šËV¼Vï²<ß±&Èã`€A^õaOÿ¹%[çhHböem©Þ$-iëvS@Χ&ðÝ¿‰Wuö>¨´¦þÔaC›NSZ‹qc¤D:U6NÉ­Š½Ò†¤àelØvú|w!Ÿ2º­1C«¹—æĸ32 i|òD–çS¢ä@…÷šˆ¯»2[>žÿº‡Óñó\aE2b¼Ù2 µ‹$‹oJðn`Cå¬ÿ±VâLfÒÜ`%Q—4øÂ¥3`]a èùêª2:mj´ÜÅ<…—ÇY¹‚¶CØ~é­×ùgâjöTW  š`ñHÔ¿ ·Äâ‹Å¶T(&fŠpÛ“Þòy$ÿiz\1óÛZŸû¾ÅÑ ‹ ÓA<ÁÊÑ"ÎU•ØßcíZ'köFö¡Y7å·23†˜ñÊ4VéÚRóªu3ÎÓ8yG«ÔßÀ¶úûsÂØ+ð›çá›Æ^EÞjèYÛï­ÂÍØÆß?Õû¸ÿWöúNf+kÑìa<(òlXEtrÛ0kØf¿f„¤^@ˆp‰[ZK÷ gÒËð\k)¬èu[Æptåéå:®5„5ÀÕoæ5;Âs±@Àpfà3:‹«zjRÓ0¼aºT#"ºnú}…1²»žô­8O+jbsª§‡Ù1y„Ú§³þÊà|¯weÄJjÖçÄ%Ò&H‰«T‡stj¸Ã@g§:Ôš£¸Œ‡*-[O_÷sšªÁq›GlISY½¤²å)QÇlB•m—ÊÄž8ÖUÅl‰TÁM\¦†¼ú@¡Ë{l7¬FB;Áü%IåýpLdŽÄn !pi2–ã¡¥qùöy`éD#½Ë†È6‡pâú¾ºÓ>NëIðFy‰{+¤_ ZÕ¡êa1Ž!,P¿XfÛf ì–ÏBÚ~¥Xÿ´ ÿc†¾ë Fý9Ç í(t›?OH×µ]^qâ> endobj +4594 0 obj << +/D [4592 0 R /XYZ 85.039 786.531 null] +>> endobj +4591 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4597 0 obj << +/Length 3499 +/Filter /FlateDecode +>> +stream +xÚ­ZY“Û6~Ÿ_¡7SUC<óæØ“Ä©¬õL*ÙJRµ‰±B‘³$eyþýö’¨Iªvíáh4>>4G-"ø¯yF¦Xdy&F-Öû›hñ3ßÝ(¡X ÉÊ£ùæþæ«oÓx¡¢°ˆŠÅýÖñ)¢0)ÒÅýæ·àí÷o~º¿ý´\ceÂå*ËòàÛ¥ +Þ/W*øñZ¯yöÝûO·oï?~Zæ&ø½ùðqpdß¿ùt+ÃKoqý[\wÇÃo?~¸ÿ„S¼[þqÿÃÍí½;€wDe ŠÿŸ›ßþˆ8ê7QhŠ|q„vª¢XìoâÄ„Il¤ßÜÜÝüÓñâ¹xÁ«æ´e)V: +3­/·ËŠL¶3gÛ™‹í¢ÅJ…E¡çvRIªvÌÂ$K}Šó_'›Ž£DZeIêxºI•x7)D–oòö ¨ºÜ£ÖŸ ÕT|3p§:„¾úú\å¥ÅÂÛèBKó²4çœ^çÛš;ç²ä&Œ#='Ë¥LB{!“ñeRª*³ÈàWå$Òª?~éW_V«H•dIðªl‡¯—«D'Áý®âFwl«ž›¿GItª~¬Ë–}Un^sóØ×c%íêKµ>Œt< f#Sh;‰0Ú]ûîð4Ó[e»¹ä1§„UŸ«þ¹k…[Õ Õ³ï¹±é,ÏçqW·"t=î¸UW|1Ͳù»Q4x‚úßüÔ­43¡Jô¼q) ¬Õ"u¨S¾Iº,“Ç`I#hl¬³p, þí#¢ þ:`k|…s& N5òbÐ?£ªß×£ivíÀ“Û®çè –0ëïýƒb‘Ò=.Ñĉ–î ÷éà¢{áTÒ +4³ØÞ1£q¡¤h\¯é‚Wrhß`ȸPN^pdê•.â ²G¤™‰£Cá±]®iŽ(ð±ÅcÊüÏÜ3ƒ±ëkËm`“·ì¾øÛ‚I" ›·Ÿiè=ó‚zË¿VqHð{¤âfêÖ"J)RÀLÝ3[‚Xy/ª ™u” *ñ™;;Ô®6Ñ$Ö(ÛÀØÅw-¯r*¢¡£ %K¼fR<þ¯öøHŽÖC”C%¬`“-`òç;nÛ}/® %º<)î9Èž˜8Ù„ñrÖK>ó0’Hr¼ñ¬‡ƒÄ/;»ìoR5Ùrª-Ó5&dâóõÈ ¼ "¢Õ2Ø —’çæn LeNs¾ñJØÔþþåx}=MìK”ÉŠÄwÈ3¨Þ¶n*øsÉà +ø\sTÐƪBEµa³6EB—†¿ý¤"›¯ªàPóÌ+“¬éH®n<å6:×4í.VÐJÁt~ÁKwd7£eQqcîÖI`>‚–cAÀa±P”¶š1¥òAÜÎ( ZÆ_eƒ +6y¦€j'd'CžòÌÄ4‚ ÆÀÖ›ª©,…,$-( (m¹—1´ÉÿàYpìØd¿•š=£RrFn“)£5ûéÞƚ˳nI‚Á;ÈZ œ‚±­¢Í¬KÈðwÜà ‚èä«qÿ$“©Âx)V‚í# +JæÚlV¨ÉòÎwé„"Ö™frÃà#žweOØ8¨Gª’G²5„ +8úþ>Ôb/äh,¸Ëž›{™.ÍÅs3öÜü%ÏÍRÏ†íª¦™|šÎJ{ÁñxÍ9ÎPtQ"765²ÅºxF:3þ²Á™Üy ¶I…H>i ‡1ÿªà+ +ÈÅI@Æ Qn°ÁF^¹ Àŧ¬Îy¼!j¡&=G”Â[¼ß±ÝFdØpÇÄÎg¾làƒÁ]Õ VÞ6y +›JÛ»)ð=2-™:ëµ ÎdãŽlÐ@ƒ”K—B>·“½F^P Rœ–™WÝ{wAáBØ‚ë 763ÀüH:RÓŽ÷K”t@PbÉ]ÏØQ³nÕ÷Ø0ͤEdôÐHkÖÇžBÇÙ(ã2àéÎQÊÀ–¶ÜcG³‘¤.ô†( žÈ÷1O +æiÊþZ:î* +:kþ=´gÊÉãÈa$›‚Nù‘»tãy V_ÖÍa¨'k†„ÞîÑ÷"^8D(Jfr‚ypü¸ë^‰àOdQyËkÀÌÃÀ8k‰¥¸q'ñÓeh{—|fÙ–&Ìs°‰Aâ´µ) uj€õ dØý½@¬S2;ªy ¢ᯠÀ÷â•©B“iPn°é«~…ÿ˜ôä“ÂH¥BÉAQØ3è([é:•h±i@?éuŠÒ»lŒ~WСÚ7?¼¼"W*ǧ[æizY@&³´’MTâ¡8•J8J}UPš>Œ<)÷ÁBMÅ“wBÛ½'¸{þœ`•”²+ h8ƒ‚ö”9Ï…”p{Jî…Þ4hêÁOZ3Лf«V„„•è-7ÝQt~Á‘‹:=ƒh€bÜÛØVñ) ý² #ÏE 8ɽÀ« +@ ‰`F .¡m™_œê±Ž0©³½°t±†£WGžsš&›E1.»ýš'ßo“.ÍáìÂu×ng"\„*²t^%ÄDæÄakÊa²µ +Ø|Cn'zAJ ”ÒìÙÀ²;ª›ÉÀŽ(æëÈ„yšŸ¾ ³'Dà¸&&ìß±Å\Æú -d/ª˜`)µd@§Ûâ¯@v€;iÈ«ž8H‹”OãT‚ƒþSS•UÞ<à¶^Ñ̶cbdéø{ +¤ žÊGÁâú—÷™¦ã¿qI˜«\è®y¢.’Peñ‹fíÑ8OTaIy2kƒûÅ™ç‰*Px Iü<,´á+0.4¾#í¸7ã7 C™ù W„(FÚ¼,óDsݬ€g’ùçéU¥€høµ²˜€—I+™wv7La¹˜tB=@õÄ• ²XëDÚý3Óȳ¯ýÐ`úPÿ¾ef^í{õx èU“ â½ö4ƒZìo;ɲ×^<Om*ù.ߘ$a+…_vºµ/I,ë$–´Édó@”=÷»'É2¥(übÉ•˜Érö*ËÍ«,M-k0uvÎý’d¤\$I +qÙį{ÏÕe·襬‘ÑKS4T]Ö6Rk©é ¡÷”H]nÝQ=ðsMSbíœg‰›<@vÚÄZWZÜ‘(ƒÅtóT_™ª"•û0|--!¹ˆ,¸í3ט&| ¡Æ½¸¦²»{<5¿ä̹1~€Â¼9K‚¯µ 4ÞÉ"­,‹‰“tÏ]OEM÷’êE@z•²e×6"§CxéÒs»ì窉T]ßq™Áù«Ñ:xš` +œò´ž².Ý—öu©<©Åz4~öÝ‚ÆøgØqÎÓRoD9¾«Š4dpÛ]e—\ÖÁÉE‹>µº’G>/°´¦–Ú¢÷b–ç(¿àÍô<€±šÒ ,MøeëV'Ÿ¬€Ò3&¿N„3\°Ï÷ÝR)âZáÿ †«+wGÔ×ÓgŒà*VÊq­÷yÜÙ¯80Sn>×Ã[†*Ìø4ÀE¸T̳„é¦ÃNÁŒ¤or_x;%Wé‰$U¾Ô2͂ƽ\‡ñj…¿ ŽÒ½Kɉãú¸s•z[ï¡‹Š¢™Ó¸`ˆ£,Dek|â˜,‘YçöãD/µ¢©˜•(.ÁVüö;ððt,?m1ДÆÀ[ÏÖómÆ¢O¿Xà +]IjìóÆ]¢Œšr\À_tóžsf½±Å#éw€üV¶k;fï?ál…ÍTÐîÛ@¸R®öÓ¢ÁÛ4dëG¬s³äö¢à×W¾÷™8¡à±åæ´Ÿy`#!š-=ö!Ä{µ¶ÞúËh‚”G~@:Ý ÓÁМܥàßq*e¬ö\–^h)³â7Þzø“[T`Ÿ»’Í¥äa¯v%6wyú¾Úw“09ÊÖ5$a4Óçï¶$ø줇èÁѸ¡2 ?ΦøÂhymº')¾p-즅GL˜ÿ¦õh®cÚ"£8?´Z ­ýûSHûŽ¿áÐÛó™‡~ZEŸvñŠ‡éÝp†x—üÙR/_ÀáÙ_àÞ‰ä:ìͲ0ÔËÐļðMÌI…Ñ›µQ˜²¥%®àˆÍ°{ËE–®5¼Z®Î›è“øFßP2Lr‹:Ø×H*'‚Ì«@U_9ªfdIê¹údÞ¡ÞTìÕè=S&o7à Äwëò±í¡æÐã±ìzþ‚°«µÃ¨¸ÇCoÁ:OU‚/"Áó'ºçi’ ú`ý¼ÏU%’06WþôEýÿùÓ—8‹üÊ_¾$Z‡Z9aÈ]tt.qbò0ÉÍŒÈÿ¯-½endstream +endobj +4596 0 obj << +/Type /Page +/Contents 4597 0 R +/Resources 4595 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4568 0 R +>> endobj +4598 0 obj << +/D [4596 0 R /XYZ 85.039 786.531 null] +>> endobj +4599 0 obj << +/D [4596 0 R /XYZ 320.069 769.79 null] +>> endobj +4600 0 obj << +/D [4596 0 R /XYZ 85.039 675.543 null] +>> endobj +786 0 obj << +/D [4596 0 R /XYZ 85.039 379.216 null] +>> endobj +4601 0 obj << +/D [4596 0 R /XYZ 85.039 353.208 null] +>> endobj +790 0 obj << +/D [4596 0 R /XYZ 85.039 295.174 null] +>> endobj +4602 0 obj << +/D [4596 0 R /XYZ 85.039 273.977 null] +>> endobj +794 0 obj << +/D [4596 0 R /XYZ 85.039 109.874 null] +>> endobj +4603 0 obj << +/D [4596 0 R /XYZ 85.039 88.678 null] +>> endobj +4595 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4606 0 obj << +/Length 3184 +/Filter /FlateDecode +>> +stream +xÚÍZI“Û6¾÷¯Ð‘ªŠhbá67»ã$N%¶Ç­Ôd*Î-±%V$±CRîô¿Ÿ· Z"é[—Âò<ß[1‹à'fYF*Ÿ¥YÆJÌVû«h¶ž¯„¡X’…Gójyõâ‡DÏDæQ>[Þ¹qò(Œód¶\ÿ\ÿôòýòõ‡ùB)Îiš?ÌEðf¾Á/¯¡ô÷~ÿæÃëëå»óLÿ妗o¿Ç‚n€ì§—^›æ¹Ì‚küþ¿¿¹áæëwo—°ëÝ/7ó?—?_½^ºxKJ!û_ýñg4[ÃR¾ŠB•g³(G¡ÈóÙþJÇ*Œµ2õÝÕÍÕ¿ÝXܧgüÕÐnYŠ…ŒÂTÊóéÒ<5Ó©“éÔÙtÑl!Â<—C3 ‘…©–p.aœ&>Åé¿ãMF*L3(¤qJÝeœxGi©,žårž'Aq»Ã/aË3:Q‰[ýâ{_ÃG:Éa>üì_§g!“$ÌE:ó8çÒÐœqùdžÓ‘pºßÚlŲæòM}„Ú=×^!UÑ–¦“àTæ2º¦Þµ§Lk‘‡™CLŸ1¯tJØΆÃÇbiãPÇz&eÊL|,'Ø›CE0 — õÓQzI—y(…Þx|dq6K ÍXÔq÷2Ú=ÞÒ÷¸™ESì 0]Ùœî©"L„œyS}9ßv°iÆU ’"ÅÆ¿/[äpÕT÷®‚uÿ Ö=/W'M*x[w²3”Ä* E¦/³"2¡aJëšÿ h8gàc$ôÎŒ™dA}oƒ†Fè#I +º’iPnæƒfqìõ.Œâ€Éa}uuLê8xIô8À îó|¡U Z´Ša®Šñ¢Uì*‹Ž©`‘вãŠ;$-n±£äž®æÿu̓ò =ò؇ÏḨbV(€Ë…Ì3žù/sR2Ïé<°ÃRb[»-ûº4QTØаzñvvÕ;‚0Ãï,p<ÿ(†°³¯hÜ•“Ù—pL]D¢.¬ÀH&:{.K†zLEàq¤jR%* Åné]'³²ž hù ¡à<¦“ú¾œÝ^'Mñku’ÏðA±\!R,ÔZD 8:ü÷ÛÛ7¿cÉ[Ôdp(ö%·d‹ŽÉh8”•78)BÒ‚@5„½¶ÚPÃé,"*IJPG(rx\å]š~×q5Û¾hù›sÅ°†§ÁC ê(«~á”Võá`RÂKF%œþ­º@Zce>Uî¤ÇÅã‡{añHRðìŸm® õˆxà:•œ6×±AÔ6"žÕoŽ/gØ È$ÇV@<–'å#•ÿ$Ê6þÎ5ÏfeVF¸Û¢€`›±£™'4Úç%C3•Öº— (¯-_w(†GÔ÷S÷Ì` »kSF±`ßy¢á@ †¸8”F:âXtıdÉG£+Ød¥c!"°;Ë­¥±ÿý´wG6¸Øj8Ø0„Æ´’4§±ããÙ¿9XˆÕMÓ‹4ÑOÈu¢+Њ`É픊’€wluĪnÌ­¸'Mx»+÷ÓFò"~¢òËÉô2FRç)D™ÓF2†HTk¶9›ci½-T®õ_c¢ï |Û8ɦ}Ï7覣˜9í^æ=žeçäú+ÓŨ鸑l +þ;·èËéF/Lr¨‡@V´íƤ_ꈦ“ý¿¿•ƒ¸éD™ÄN4h%Â+¶±Ce£žéùÔï þŸªcSh´—òµ—ª[S¤‡,ç¼w…ŽNwvÜR¬Võ‘ãšQé¹.,=2 £üÙ.¦¡“ž$Ó,™”¥¡¦3©h·>Í)ðªú”SòÉ'NýL_Îv/NS|[qêçèW' œDóˆ}.­É’­¹U{mFéÃ2¨€!«q_Lôc¾ î×»zÃYi<Ý›0rðÜV~ªVå¤j¿È–~ËàÔ„oÚÁÓq-œã¨x\Ïvî¼ñ/É)n$=výÔ"G<2¶e¨7Ø–‡ñw`W°sÑ1}R‘+†•Ì_6z~íUÛçp¸pˆ‰bÇY#uSYÝË9¥|±X#ö;~á$ÖÐþlgÄP VÆIr=X%C±‘oÊbííôN½Q¿œE‡ÓIN=&Yy¢}§œü?UždùIybɦ‹ÐÒoLFèÀ]Î](0^X8Tïͧ+vZ›`—âÁèÕ$qïÕ¬(UþÖs¥’„ðz`ÚŽülÜeËÎtJVÅ#Yï[@¥_È93M… ìdßaø¯xPî§;ƒ¢ë(!õ›µÀ +I!X²»s>i}2ï2øOGgó£rxD}ÃAÒ‰MÃÊ¡JÓ0Â%c(P“À~¼ Ä“ÜY ôÙûàbkçùGìX«HZ/—.,•?T…Ql/,Ûým~ùÝÀŦÎC!„¡ÛsD*)»Ul(&íwìØ×MÉ¥ê0·ùŒ²C¼Úô@Êú®9_8å~hç$Ûð·ª÷œ_¶!ö?ØžA¼¼æ½ÉÁ—lD«bw&+±ŸQîu–Ѹ´¾†²#°—e3.,—8üoØÍRN.Ó¢’0MxC­ÿ¿~þÝ—7Å<­I†üx›Ë¯Œ-þ?‰X E¸ìX´[JãîÖ\õRdbØ×GªŽµ<Ò ‡O†gàfì+SºÙÇoŠà–ÄÓþ“E#“Ì·½Ÿs ¼a/¿I&ü<. ütÎðƒÿøÅÖÂ>ë@a«ç@az‹û%/=öü¦vr…õšÏÆ•Ù® £LÁ®ÆCj0ØW>3é˜é0KG¢8!`*ÄŒ”ç¬[È ÉL«¢)ïŽÆ +߇)aP¯Ð¹…ê¦!¯÷hí5Vöi3ê_Q†dWy…!Õ–[jsML‚Z‚/Í0õ¡äê­ƒKÆ·U㮌±—MåºåÇH(BG•-“틱œóU¸6yÈUgô "jg fÁJ5HÎÌŒÌh°¹Ùêã‚ÿÞÛûæ\‚Î%m[àF<ö +›£â=¿ÃéÇäû¶'ƒ÷õÞtù‚‚4º}Kå1<¬¼ûtitÖi++ÃH¦–.5‰ Â’ ¹ wóç¥vΠ(ö¸ +—‰â€?y(AÙÄÓO{‚µ„Næè"õ°?L2ΘÁºUSâãÆt̯d°V%ñYÊúhP\Ï)ŠCü ½03óÛ¡§XôhÆEO€[e| KÊ[$xÕJGRÏé îÔ†;ŠÆP¬ùTVÇ}é½dI<ë.ÜLbç&3’D|Ûb0LÞOyXÐòs [òC“šCшÑÚÀáòeÔQ¬YTš®pÈŽ€Y² MÅ® ¢'^"R¸V†ô–…šÈ9…#†ë +R|÷õ"ƒ_òõØŽ;ªÞ-¯VEŸˆBÂún QiBÖG!/Øví#ñ‰L€"6#øKuÎSgösø*ÌbP¡¦!èHœ”èPጇ@ƒ[)Ñ”zȃ—´åè•­É4\ׇŽŽÝ&øP^(‚Îíb®„Ñ!£¢cæ›ä»§°ê2IäTæ…Ek_ðã h(víÉ;ŠnË [2t©NW;ðß'(ñt覥)¹ë¦Øã·æ%‡}Xe&ß–î,÷ƒÃúo/‘7óèˆd«2™PR?mx÷¡áUÚ¼Ú iºó2,¥š‚I ˆ(•xF­0[×T+ãZòñÙÛ,÷­y°Æ$U×–»;4ÿIfBwÈz÷–åÓñ ¦¡·e@5t|Z¸T:(4ŽÖ3Ï4CŬ‡+µ¡ø•sñ?$êk§2[n~»Ô/dýóâ÷÷fïñ_q':cssü¥Á' 5ÜBô8lÛ £^Å ˆjØáû̃àÿÏáÓx–rXrb)C)3$ñR ¹Íq¦Xþjðiendstream +endobj +4605 0 obj << +/Type /Page +/Contents 4606 0 R +/Resources 4604 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4612 0 R +>> endobj +4607 0 obj << +/D [4605 0 R /XYZ 85.039 786.531 null] +>> endobj +4608 0 obj << +/D [4605 0 R /XYZ 85.039 763.817 null] +>> endobj +4609 0 obj << +/D [4605 0 R /XYZ 266.917 769.79 null] +>> endobj +798 0 obj << +/D [4605 0 R /XYZ 85.039 209.51 null] +>> endobj +4610 0 obj << +/D [4605 0 R /XYZ 85.039 190.639 null] +>> endobj +802 0 obj << +/D [4605 0 R /XYZ 85.039 131.43 null] +>> endobj +4611 0 obj << +/D [4605 0 R /XYZ 85.039 104.816 null] +>> endobj +4604 0 obj << +/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4615 0 obj << +/Length 3260 +/Filter /FlateDecode +>> +stream +xÚí[[sÛ6~÷¯ÐÛJ3CÜH°o©ãlÓi“¬íNºÓö’h‹S]¼"×ÿ¾çPD2iÊÙñììt‘À!p|ß¹°ÅðŸYÅ*¥6‰Œ£ùú"ÝCÍ?/„“˜:‘i óííÅË7‰‰8Êâlt{×´“Å‘É’Ñíâ—ñåw¯>Ü^]O¦J©±PÑdš¦vüf"Æo'S1þá +ž^píë·×W—·ï¯'VÿÍE¯Þ½Æ=¾±ï^]_¹â‰´ãKüþ¿¿¹áâË÷ïn¯±êý7“ßn¿¿¸ºm Q(…êÿçâ—ßâцúýE©ÌŽá9ŽD–ÖÚ¨ÈhåÞW7ÿjÚâ:=â¯ÚfËKLe¥Ržw—f©ëNt§Îº‹GSe™lë †•H Ë™4 NÕDGI’Â'&‰¤>¬¤I‚•ôR^—òv’%ã|¶Ây/`Æ--¨Â™~ùF˜àkøH'ô‡Ÿ}sºR©ÈÆj(p¦¥—9Óò¨ŸÓ–°»7åjÂúlòÍÂa ÊÊ]1GÝëíÞžXâÃDf(-ÆX¸Æ‡²ªÊ톿û6¯h¸®™K(|Õ»íª:–62ÊŒiÖÙðT +k ¥úEM¤I¡£ŒY÷õ°EamÖÙ }C3üä¤[9X™ER¨ö• ‡5v” +ÉÔ²)8LÏ&Í}¾ËiÖ‹ºØN©"J„]}½Þ¾±~Å•*Iq¤øë‚@0ß•€‘ºÇ”!ôj~R¤Æï¶5aê $FÙHX=̈p±…6£icˆþ68Ì@Ø&’‰iŸâLæ'"‹ÀãÏw4[y]ðô òê÷N<š}Ê*‘F™µ¡¶×¤ì[´¤s ï[D½¤:²‹*l,Qœ g«õ,šo7w-öSgÄz–[ç[ù}ujˆ)P|ˆ¶_ª’“î@T’j LÖ¨ØDÊJšµE kÀ°šƒÁrÀêUÐÃ׫ۀªWßT·KB +9¯ó¿¯¹`áñVqñ¾"§OË’Äcrole?á?Å®ÆiØܳàë÷,áø_@s] ×åø§woæ’6%@àŸ—¾pÃ…Àæ¼.7PzÏS3罺% +|rÉmC¨E6¾)àUp«jû ”Å))pæÇ¥±cvÓóý­'2õ¸ä¬dÍŸ3kÀ‹‰Tõ²&I4X6ŽÖÛŠ‰òk,ôª ;Œ+_tòæÐǼéÓØó&Tù +†Q)®3Ÿ¬ðEÑgcAØ ƒDòÕj‹ytR9ï'ÂAÉÉ=.·-Ð]bX¨b¨Þ•µ 7chdNÀäpÁI—böDñØÏîq}À°òÍU,aNèÖ€ÝÍ´À%w‰q÷ nÈÇ$eÝÿ!Öîãßd22íÇ¿„H§ñŽ,ÊÜ'80‡dËÜó‘ ì CÐádèU¿!ÃAÿÛ%â@ Œp$Mdíã!Ýžæ%¢1´ë‚Ø€­TÌ~ÙÞq`ͱôg.=”`Î؃=?q“ky¾!t+–#öæî£GJçVü’¯‘³9þóä¤g¾U|aêºOÿÎ[ô"òĹWÊÇ¡.ß›QOü|à +ÍòNB ²þÏ™PBX+z e¬„Xw0Ê{ð (óÑG'©Aª¾!xR…cø?«¾”UçÝShFÛH…Œ²½ŒbñŸ3£|±êO•Ð’ýbFµÃ!Õz]ØA¡!ØÖ7¼†mÁøÂ]"B±õ9±ÒÜ1±ˆ‡FI;/X1£@ÌÉûqâø‘ˆ½s´rÞ¤ úð“?R ¹ DCCG]”xwË"óUY°~\NA&”C’N›CûUîS®ó]:¥Të(Î⶜eã˜x‰»ˆ2ĺ=c¢èÄXúwL -ÙA”Š-Æø¶¬Ðg=PÐ÷œèIÉ`(ÿmN¤:Eô¥Ús"¥t ‹‘(òßyçÁ\>à<Šêë¨ Æ>aå8‚zö·¡.Ó(ξêNº ê`5øtB]›,1çÀK\Ó…C9Nûüí"ŸátcúÐÉ×k|ÀtŸÊӡΫÆ[UŒ"4™cíªÙÚàA×IÚxÝm×,ȱTA™¿Êb—1g®å?Ü6æý›¹«ÙÞõ禌#&„é¼öf[û8ÆÅH(ŒÞ×!¦ú9›f°UZ'ýxU€”8ëÀ+ù[0Êïä¸*Þ'©:|èv«Ü7ˆÁÁ(ž9‚m +m|áižo·ð|À­¥IDZn6pm¡{4™&q2þé|]þÂ6®‹bvÞû.9ªòÑcÙ¾ÚçØt7y†Xå=u’CFQ÷RGá}Š„Ÿ¼³¥)t ã˜ñ'{SZ…º‹6M‡¦GyO™P{N¥µUm»²P:? t´Õ“ÔËà´M[—osêè2*~ôÙïjÕ‚Ô`¾æDóoÜbÝòï:à™ÀÓ—dÖ(Wº5áó?(øXnÚ6i͆3â#¨Ã"Ι2®n~zR¾jú­«N¢ °®Ï™&ÂFÊ|†(:‹ŒHùx•3¦–¸ç 0èdrô©ÜÐ#Ðù8÷õ Fxûà_{Ší‚ó ç6Ž’`Ž(šíFÿK70þ¬°i»ß„ù4ö7/ôÜ‘I;J! +€£´0äÌðò» ?&…±láwU®Ëš›³]ªÊ0„à +Ê +í¼þq9ËWKpýHߺOà©î¬rAG¥C9íˆâ‰îÙvꜚ°«ªw%ß½áhê0zj±¼Å]NÙ("7Ö~¶nÎ ¡ŒÐ ¿8 +üÍW«&éu5Ny›ñ=UÎðŒ«ÂcÃók26‘Hü}Ž«OÅîi»)ÚîÍÅ‘”^îÍ|ß~åzð¦BGWöklâ²ø¦ØçãKÿEàD^ÐœL¥Áëöhj.—”ÔÜŸ^˜»†|ÚÄ7¯¢»"„ß½r†@Zœtçž$Ư%út| +Lð‰el +'ý¯$Üòó./”kþÇ.!nÅÝ*‡a:ãp϶+NcIøpA¢FqkYwkf+³›,2JB»]â’#\x+ëªXÝáíeÏGÁèñu™®jpIÓò<Èç‡M*¬rT„Çêk;q^7"E…½aˆ¯dj¨Ü‡îðYÍÒñ;×Pد%Ÿ¿ò¡ášËÎMjî½ô4M,Äή»Ê7}¢šóÒ½ª…–þܦrXð‰Ž€·›uÀ—.Ð(nQµ'Ÿùó¿–tj<ƒë8ð1RÒ½Z§ áNʶÔÝXÕ¢òŸ«0M§endstream +endobj +4614 0 obj << +/Type /Page +/Contents 4615 0 R +/Resources 4613 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4612 0 R +>> endobj +4616 0 obj << +/D [4614 0 R /XYZ 85.039 786.531 null] +>> endobj +4617 0 obj << +/D [4614 0 R /XYZ 85.039 763.817 null] +>> endobj +4618 0 obj << +/D [4614 0 R /XYZ 233.803 769.79 null] +>> endobj +806 0 obj << +/D [4614 0 R /XYZ 85.039 114.268 null] +>> endobj +4619 0 obj << +/D [4614 0 R /XYZ 85.039 93.071 null] +>> endobj +4613 0 obj << +/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4622 0 obj << +/Length 3419 +/Filter /FlateDecode +>> +stream +xÚÍÛrÛ6öÝ_¡·¥¦BâÂKÞR'Ù¦“ÄÞسm§ÛX¢lŽ)ÑKÒuü÷=ð&‘L&ÑCÇ3xpœ;,|ø ±¾JQ +£‚Åzwæ/n¡çßgÃX9”Uç§ë³oC½|‘øÉâzÛΓøÂ$áâzó‡wþó«Ëë7Ÿ–+¥”(±\EQì½]Þ»å*ðÞ¿ÖÜûúݧ7çן–±ò~gЫ¯±¡½+@ûùÕ§7¼”±wŽãÏqüÕƒÏ/>^®‹÷WË?¯9{sÝn ·Å@)$ÿÿgüé/6°Õ_Î|¡’xñm_I²Øi£„ÑÊ}çgWgÿiçâ>½àQcÜj0VÒ‘”ÇËEIä–SË©£åüÅ*I"ÇV +L"¤‚…"a¢°qøÛÒ&µ2R0Ä„Bêî(MØ;Ê«A³¼^&¡gord| +,éD5²úÅÛÀôFà Ár8êåáQ(?ðzëÙà9Xæp&\[yW:±(ö(u ð"¯ŽÈ‰¡ô(9ǼK…x®Òˆ8™E6B½}ùNC ÀÞdräÃ4ÜrØÃY:V¥çitÄ&^DÊ,’7,rféåR&ž-íŽD¡NË#¦¹è-õít7“Í® è€ „¿N+¤p]fpøuû úWlU^­@ÊûXÔ$;GbbT,‚XŸfGxØ6‹UkB¾K8Œxôµ$9ì á£PD*çq €H¯a}[ÛÊÙ†Ûû*«³¿PdR°í¡J¼M£“[hØǼftLP‡Uݨ¤®ó¡lUN'ųé)Å€Œ AìmëÛyÔ +â,“T‰$Ž\º¾Ë€>†«ŒÝÓg{ ¼;[sŸÍsnüÏtžr{ow)ãæÅrÛ/îaÐ÷>e͘èŒFy³'NêÐxÙµgù³;>üªúGÇ Ýï[ƒ +î;V‘÷6ËQ±°û á Ç+74­´‚Ãn‘æ²uºAxÔM–›‰'nP'ë¬r0æó¿¯ÀÁ7v„‚2¥eS·§ kù–|ÁŽ­@ã0°ýÁ…¿"=ûMƒž*î[çYÊvPL‡“HÙ‰ƒŒ„Ÿ|5I„O ᆖ³Æ! Cp ý­Ùü2ÿHŠ<[?Oji7ÿ·Ûiéµ–öÉ=oO,P ‚•9»eâ„ãM»Æî» Uâ–áä yWô½ât8à!A-œüBäA0b‘Ô_iÒ)‘c±$v6D!©B÷¹¡Ç1œHºÉrÒµŒ]ã´(Ÿâ(N,ÊÚ¡Ž¿–$‡=%Ê>ì3 çEYAhh:# +]3£[V±yÙo&Eº[çÛ‰îDzŽêV¤{d¿ÊóV¢´ ½ºÀ_°ôäKÒu¶}fˆåŸuAjgW›4Ïv›ièȳªæV±s2(UÎÚÖäÆ3HAƳ‘E?Ç)7Ž;GíRG,ê8¨xÌ7 ²ùbYü÷ìæíЖ]É1aÖéRJû¢8&À4sZúOqjÿ`é7a$@væ„ß$±PrÂ_±!a×[g;gpJ¶"Ú G +¦'Ô [ðZ0G}£}ò9úÒD÷¡F9Å ?0‰†%ŸŸ?3c,6 °×ò z±{°4!XÕÕˆìeNÔ Ÿ•ýµñs[”ÜøoV=ÚœÛç?üÀ§F®I'ÜM°·6ÛƒZ¯ÜÅDì8îlùƒŠH|rš¼& )Œö1Ç|?v6ØAÐEà/‡4ßíXZÑ= ÿpFZ$gµÝ=ðœʶøkÐò?s‹C’=<•Y:ŒÂMw×MÍG Fh¸¼ÀhêÝo€ùN7vnfôÖF * +zy{š6ª‚a5˜Èl€ßMžŠ¶bà½YÙ°Wé± ák"„%Æî7ÓYD›±z“3û++PµËiÝ<…pX9ã@Èä«IrØÊ©•/â0˜WN_Š0’Äý­½wñ²¹xp™1Iìý¤ŠöVùv’[¥¹UÑÑ(Q¥‘wÏú!dþeÊFì±ý„HÖy©P{(‚‚Öf?1iRÞ\,ønÞ[¹Aè•cÞj—‘U\ *Ö””&KýÂXÇÊA¼†pÒ[øm6 +ò̵¥Ýḃó 2##Ügñ°:Ö®´´­ê‘ÏI ¼w[¬9Ä\º8 ¤dØ-ª¹eå®d÷ü[³Ÿf“´aFk¤ï8œuÞØÙØ™ @!V¥Ÿx,«ˆFÔí]S4Çî¶æƒÔ Ìœ±Äþ†UÄüy„ºbO¦‘’=Ì°Ù7UÙþ–Áõ”C;-u +}^p›Lv{뢄ÊÕKFïhë »¼ÈÖvÒDÿÁqµŠ!°Ö QL¬¼Ãcßô˜WÔ]bOZR¹ú(r5Û¤3|j$C” “Ø£÷qùìî“Øß>VÛ_b<-]Y”3nÜf›ÔU ~ó™5¸De—q4ðÁ2N<úpæ`Uº2Ɉî`,¢^ ÷”Vï–÷­IÛ0‚u}ÌöM?‡Þªà^Ò@  äªfµÌéÊì_Y•Ý8c8šŸä”Nìþi‘èDZ£c…ówxM—(銺ÖEXÅY>YOìM| +ñž#³ï>è°¤NØ£§Æo +ƒœNÔ$Ëšýþ>·BXJË^ L‚‡%aÄŽSnË?½ªJ¶»E½Â "YÑä`ã¨>`H[Kî&V(o²-qú{þœ ^2à˜6šIÔ!UÐþ×ah=YJš/Öœä”O¬®z’ª»’à£ùª»^Ä1—±'œÀlúÚ[ã•÷YŠ[Mé‘üž‹‹:$YÆßC±B….Ø@[œ„€tP[먫0&ÆÓmï®ø‚‰oªg¬0r ÇîñÀ0¾j&ºqÙè¨4ž‚“'q0<{h’ +“ßÿ>¬ž4³O‡d¢…é …ôûÏ ÃU :2V B\¶ÃÇ%¸ˆÓsM ȦUÀå1W[øˆíkÍw¤¿b/¡”¦«¦dâÅä +Î?’±O9»‰gäíD³‰P ?H\í‘‚y.lÐý’¡‡´>t'¥TØgý*ä¾³{{ë&ÆÚ^“«p’‡$s­¸tÛŒåÏ=Ocù‡Š„‘wCužk¼ Èœéè&;1ÞÇëãÄíª—É(ñ>xo¬e8ÕËäc¿«èÓ› · ã ®ŠpXá €.ÀÒŒ0X2fï[rˆFäq]»Q7t3plÈ?ªDCx‡«bk$@U 2D»~tWEyß^m]åøÂÊ¿/cÍgŸè^! > +<‹Úfî³Mãhvþ½êž7žŒø@õ:{Û‡mÙžo­½íFn7û‰;å[È{"ÚàÜ;…rWém¯Ïq¢6Ž(øn`ËO:°Õ»ÆL›¬'…ýæËvÅ>qÚ ~]f£§fÜêïäݾªË%¤p *pBGÞ®QÐ 1ôºmLÓœUiDÕ¥("lg"{u䥳Ùåå «©D˜Ø V{oñ¨9Çš¥nN¨¨Fö5¿$„SÇØà]3×ÏÎ7jÔ=Òƒø<¬¾ ¬³iðÁwu]Õ/øµ›‘’Ï.Ûg­¾¤åÍêý¬+4Þ–eâbWÞuE™GFbÚrA² ½M +e¤{¡xS’¥Á;,Žø¯zgÈè㤅Âg±²‰H¤¢æ•äÕ]*¢^Œp|å½Î˜G+Š–T|ø¨x‰è§ö‡äù¡›Ù•ºËg4:bR#Œá„ï4¢CšÑ‡„kËI˜[®ÑˆÙÕè­ö±±^Jƽš]SìC(;À¨WÝKþ3éÂHEu×ÖIƒ™Ïœkâ +FaOücop+€ÕÕf;*"GE<-JúÂ(íNð²,ðµª[=~à«fÀ ‚ioX»µ#ýŒ¡1È ‹)—?ñåÊžÁ“´á]¹\ôD€“Z.QJÊü5øþ[™î¤på–ÉDuôØ ßcaƒq¤ÕÙ:t—·©CÆç¤2Añ®?dÆúð +G:59æý­ó=Í[îÜ•ì‚Ž62d{ôlüØ¡LÇÀ ¤³<å\,}ÿó‹ßp9A8Ž$žÏ;”éÈ6‚'àÚÝ”ïS¿‡—]ÚÐ ½`Ú.‰Xø\ÕxI‡‡éÂøf½ÿf›á¹+¢\Ú÷Ý5¾ßÊ.´eO›#«ùœó-cb^xUÍ-‰Var7¨¸ç®}©Ø ”ä >jZ.oó¹*ECÛ·†8¨Íj›KÊ'Fí0Ê{KáaÉÃÓÏv÷§4¹$1ÜsÇaè‹Ó#¯ørB”Z©ñ<ð Ì¿*ìîób¥‰ôßH)dÐCR.ÕX6mb5BòßJ,hWendstream +endobj +4621 0 obj << +/Type /Page +/Contents 4622 0 R +/Resources 4620 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4612 0 R +>> endobj +4623 0 obj << +/D [4621 0 R /XYZ 85.039 786.531 null] +>> endobj +4624 0 obj << +/D [4621 0 R /XYZ 85.039 763.817 null] +>> endobj +4625 0 obj << +/D [4621 0 R /XYZ 307.409 769.79 null] +>> endobj +810 0 obj << +/D [4621 0 R /XYZ 85.039 294.572 null] +>> endobj +4626 0 obj << +/D [4621 0 R /XYZ 85.039 273.841 null] +>> endobj +4627 0 obj << +/D [4621 0 R /XYZ 85.039 208.822 null] +>> endobj +4628 0 obj << +/D [4621 0 R /XYZ 85.039 166.053 null] +>> endobj +814 0 obj << +/D [4621 0 R /XYZ 85.039 110.14 null] +>> endobj +4629 0 obj << +/D [4621 0 R /XYZ 85.039 88.94 null] +>> endobj +4620 0 obj << +/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F20 2865 0 R /F72 3966 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4632 0 obj << +/Length 3116 +/Filter /FlateDecode +>> +stream +xÚ¥ÛrÛ¸õÝ_¡Gj!Àë>tÆë8]ïÆN«“ídó@K”Ä EjEʶþ¾ç@”H)mw2cÀÎçŽÈ‘ÿä( …¯ÓQœD"Ôr4[_ù£%¬üãJˆ‰™t`~ž^½}#é‹ÔOGÓ…;'õE˜F£éü«wóËõ§éíçñDkíI-Æ“8N¼÷céÝ'Òûp £7¼úîîóíÍôãçq¢½óÔõÃ;Þ#€ýrýùÖLUâÝàþÜÿøÈÓ7¦Ÿqéã‡Çñ·é¯W·SÇ@‡E©5’ÿçÕ×oþh¬þzå &£ûB¦éh}„Z„6ßåÕãÕ?ÝY¼Œx×´Bˆ0Ñ}qÉ°#.)•ÐRâ0Q“¼¶0´\!-p%Co†|–8=«ØûγuÅ¿í*çAƒ`+€Ê¶ùœ§u9‡‰W¶FÎ2…-vÒœÑÐGigg- +ïí{åwhU>0FÀRù¸ÊÆÚgb+ܳä-GìéXÈP™øƒóÜõIˆ}G±9ïÓXÃA[ܽ†ÍEÓàߺj c‘*Kh` o +rÈÑDÇp i<šH¼Ô”`æù"ÛÁyeËŠõ¥¨àk^ã­¼4¬‘Óà­òýW†ØŒ'°–o×HÈ„(á… ÅZòN\0ôEQW¶J‹È·²½}ηûºÊ b¥VïÇIàíÊÒè> DÁ{®K&ÑÒЩ‰1¤¨ˆ`îU„Jqæ}®ÃÈ3ÃjVÍyPf-ÞƒC`¶äÁ¬^çÌ-}¾p＋'ÚšäU[pØHJ‹KFCpL&^¯7xÉ}†deKB0a6Œˆº\¬–±!¾b ¡½› °Fs‹z˲£À×Þ=ë¢1™š6Õ $À¬wÑ;$©]†{hêÒœõ‡ú÷÷7ð#£™®Š†×:"À;]òô „ŠGω?Ÿ9 ‰±'diP¡ìYÝØ×”³!ÝÕ (7(­í Uè}滆 'Fõä±kÇoüûÀÉ2JZ#»ž¯‹ªhÚmÖÏ9Ÿ:­ë²9@*Àîô¿ÄpƒjA:Â¥ÀeÐ~,t¤N´¡j J©W‚bÕ˜Èãsî*`j¬”·›µ©zÀæ4ÚXÏy%¾ŒfÒˆ +cCäNB"¤èáÓ„µËèäØt +q+<Âv½hAd¾ +, ²"•Ck-ª%/ᔞäóP?Ñt@¾@²ëÎÉ'Æe­á›*ÛŒÑàÍDØðˆTØ‚¡ë³è:Ô÷ ;€‹as›¯BNØÕk¸rkTÇN‰(”‡@§À1“ßÈËœÈ +¨:ÀÖÁ«|†ÑÆ÷Ù3¤)xغ¥ ŽZŽ3Öy–WŸ @ˆVI'ÎØîÈ ‡ÎÆp þš¼!"Aˆ²^.;>BCÌúyp=&Æ }Äeüƒ)F½Æ™Ip¶ƒ/>hÆ\}ˆH=¼Ö-°ÖbÀUF{N"øNà óµkì¦b~H:ð0ú×;”âÜ€ž`´Jb"0£ m^PÇjŒ späƒ[# hòˆQœ K%4ˆÙ­ã‚“~ Õf¸2óz‘;7xð"uo|qéÔÖlËÊ­Êíý[tÓsÎ +“#˜ n[;33^†ÏˆÙ¤ÄR<.i\š…Ö‰>VÖ ~)7Kj˜j¸í²S£{Òç¼i˜já‡ñeoÚ:ïM-JCó¦Ñoz›ñ¦]ld‰ïÒ•@ý’­Q´O/5N$Vâìa ¯¡áM$E_q†VŠ­Êx¾¯#©±íyäPûŽk¦Ø¦lº5ÚÁ+×*•Çy=ñÇYŠ´™q‡¸÷ìg et¤¡U¶6Ρ^°/à¸|e(öT-Û/æ´(˜E3çDˆÎ :9=%¾´Ž Wý¤B¥6÷xê~Žqwýoä=ØÔQÍJ R ) ¥6žjøª’D¤ b|Ú׿}òø©HBCªüµ5 PÑÛJ”=7¸ÔeÐÌÐê¾Á8ÑQäMÇ);$ª%\Ñr„;ŠD’t«;­ÙѱiÛÒÃ]ô î(Ðv‰;åw@ˆ;>rˆ¨5“89©NÉÇE1TJÄÈ<ß1CJìÐÇt“¿*ó…A½¡Há4å¼£‚¼!€Ó/;ªÐGe€6}ÖQ]BgÕElÖQu°71Fc£Nl ìQPÕƒŸ'‚!§€! £ßS™OúU>îªOOmVœ™$ÝüÃ\aº ^hç0îŠW ÐÔq]܆›Š°¿àÀ×4ÔJ˜è؇À”C¨]§¬Ý0ÅvÌÝŠ(ee>]CŠÕfOƒî7Ú¹§§XúÅÿSK#õ…ìdzHÞ]ËT†îÊ^ ~°®Ms‚oźß"Âqÿ£%Û‡Äh>7ƒÉ2ÇýØÆq’   +:µpѹµg™FUÒoT%½FúÎÀ÷Þ™´Nyø8µ GîŸN®;çfòÅai.£“»zj–,LúcYµý ÍuübGžèkÖ»`j¢¬Zæfn{ÈÆ°À“‡4Nwª$«æÆÏ1AæÒ–§QÔ²À…<3ØøËP³Ç¶ÐYÏ$Z¨(ýqÿS‡)õp‡úŸ(K ©ÎŸC»|8‡G žœœsð…:„#pÎ Kp)RŒ]Ø%Å®ÃY ôx_Æ0 +D½G,?{ìš=~ ”¯ðàÑŸÀK*ìéâ¿Î˜˜80GoïÖjô®jGGó¹“ÎÁìN“®•7i‚ 2RDñÏ&?'ÍÉðª\΋ͥ]Ii~äÝqb DȾÛô;Iø€ü“™nçþ¥-X.ù4Xl±z²õF¿Õ¢B ²–ÃÉ.« Ùµ.®¼ÐU¬*ê]ËŽáuýL-œlWFïÐá5»ÿ(­ ´»²aÆÝ%:{Þn~»D \pdËÎJï ;ç:»åÆŒW¬; õ•„xE7™ ¦ŠÍÕÂ@Ùߌ÷ÍÛÊ8E¹-àxYeíñžïT˜£uSZt˜~úøÐo n˜v^ó¼âPˆ±ÁgßBß?¡‰ÂµÊ±§Š¶²MWS r'Lu¤ˆ]€RÖ¡æLÒEÞ¾Ž` ÊnäÖKÆ]3Â×/Mçݳ@÷¿ZVµiðBàŒ}}tg$,[žÓ6Ê"–+üš¼"ö–[ÊD6šž¤ÀUôcE l®Ì…(VÙ³ÁÁ7ƹHO(4? +¤È+‘ÌG„ëZ;È(p,ÓÇ«–\ŽãM›|5åB³¬YÑ2;–“%mÄîź^Ðb)B`ÿàÿ‚¯Ç€"ñŽšýÿ¬X(ÐΉ’"Iƒ‹–À§H‚ÄyjÌÇ¡!·î¼Ài¥ ša!£¼Ñl‚”_B €øByÙ½„ÀÜõlÆéÔK®‘Ž ¸"Ù~-ÕUxÖ«³ßX¤Z›Ö2Tßõ†ª®|›=Qo®pîϼfj_A€ìPøô(r®l…¥»ÐQp$œNàeá@Á±.êGb ’NŸï$¥áïáîwYNÖäàüËñ¡Û6Ư‡)ÿ>æ³ÝÖ5Œ™q’Þ;;™•õ²9# (êá/¿^w`Î?Ç*мB%'o`P¹ø{ès¯bŠh¾Ëk[~Ü1DÌ zY¬—üùÄù=÷Ê»0}Ä•ç"áêà@/œœæˆu±wu<vÕQ^^îí.ÂUãÂï‡Ð^Îaã9¥üä8ðT÷PSWTc‘@€F®˜rt.Ê¢µÉ˜³qy•¦çðÛî¢) àwÆbÓeæJ2ï Éùv¾ñ;D\-‡ÙUÝ´ý7Hɾ^ppR¨÷èõ¤²VƒSä—ßà[Vj»Ñ´…ˆm SyäÓAÎ{“9Á4¥~8°Tâ;[¥›ëÙ4ô@(ˆšÒ¾Öº#ðè`†z4ý5 +µé¾÷Ñ…a³Ø(d80,ι±PZ{1ƒä/ý gþÄ5lý!„%1äìTpJ±ý}’ÿð\[lendstream +endobj +4631 0 obj << +/Type /Page +/Contents 4632 0 R +/Resources 4630 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4612 0 R +>> endobj +4633 0 obj << +/D [4631 0 R /XYZ 85.039 786.531 null] +>> endobj +4634 0 obj << +/D [4631 0 R /XYZ 85.039 674.352 null] +>> endobj +4635 0 obj << +/D [4631 0 R /XYZ 85.039 604.485 null] +>> endobj +4636 0 obj << +/D [4631 0 R /XYZ 85.039 563.231 null] +>> endobj +818 0 obj << +/D [4631 0 R /XYZ 85.039 333.848 null] +>> endobj +4637 0 obj << +/D [4631 0 R /XYZ 85.039 291.364 null] +>> endobj +822 0 obj << +/D [4631 0 R /XYZ 85.039 291.364 null] +>> endobj +4638 0 obj << +/D [4631 0 R /XYZ 85.039 270.836 null] +>> endobj +4630 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F35 2880 0 R /F11 2898 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R >> +/XObject << /Im2 4150 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4641 0 obj << +/Length 3722 +/Filter /FlateDecode +>> +stream +xÚÍËrܸñ®¯˜ò‰Så¡ à#7­lo¼å’kö‘Úìš¡4¬å2IYÖߧ_I‰ã8ÙKJ¥"ÐhF¿1jÁŸZe6Œt¾J³$´Z­vdzhu #?ž)ÁØÊf‚óÃöìÕÛĬTæQ¾ÚÞøuò(´y²Úî.þ~þqûæÓz£µ”×›4Í‚·k¼[oTðþ ´^òèëwŸÞ\l?|Zg:ø'ƒÎ/_cÃW€ö÷óOo¼Ž³àç_àü«+_|¸Ü~¡ï¯Öl:{³õ˜Qiä>ûýhµ‡£þt…:ÏVÐŽB•ç«ã™±:´FK¿>»:û‡_‹ÇÌŠg-qËÄI§Ðˆ'þŽí´Í‰eKÛE«ŠÓ0Õöä:4+‚u¸ÅèæÉ:¥âP«xµItšTûKLã•Ran-^¢Ri˜äñ*…SF6¥[¼lÍ2¼|ÊX‡žg3à0¬¹ú¼Radò\3ΤMF€WïŽjõºJW3byÝÍda"Ve‰S6 s“®R8±É-{^×ëy(€è½+{üô ZþþÜT__½œª¹ÿÊ þ‘‡òˆ}ü+R¦.yìKUpe±8^K¯’Uw-ÎlO][×å^hat‡(49Q8pÍ4Ú»õ&N©0µÃe‡ +W¸åÑ5Ð÷Ô@{r6:ZÏà]ÛàöØQA]~¡Á´.³Yð+vkÅû5Œ4ྨ ÑÈÖÀ£çdãþ·÷Rë ½°1a´—Èðj%nÔ^×x¾ ¨^¬’þ—j(jÀ«eüˆÊ‚–pùF¶¥kÄ©û²ª›Ç)Ávd³Î”  ¸Æ#CÚüF#ʯU³§MzÜ÷r+„WéÅ~%}>‹ì·Žàk¿U\±¬Ð*§…!N9)I1%2qhdq;bpÙÓ¦hP [˜s`&&|Ä*î_ÓÂe/‹^;™ÃÎÞ‰ÃPvt1´=Aö<ûú]{äÎ0ŠÐó“\áž´È5Ê2庽垤ѭ߇Om ÈchA±'öé/˜;´©*OWo§ÿw ƒ®Ù Ûì›.2Ë•ªÔ¬8šYW¶ÁIGTÌ7da\‰á2­‚_ªò¡BMÔI¼EµÄ»ÇÎU¹»ï@5©,BÚ†¿Èí$Û„W„)$s8åP¬u2zÂ#&QF¹ùö‰F6Ávj‚åD6KÃ,6t¢·ëÌ°ÐÄ© Š¿&¸Ü"uæUEÑ«ß>2pWWeƒê2¼D1M‚ÞKám]nÈ–ÔÕ1þäåªáÀsIu„¦¥º=Ð2 9¶÷kÅk Î5†¡bøKÄÅ9r;$£Ìnì¶Ý‚”ïñBº’”lhÅzjcÙ~bÓÐm„=Åu®à ‹K–{"ý ÂJžT—è"·ÛŽ±~¾¼àÆ]1 ö…h¥Á O9À¹G€•ïe2)>øaÌæþŽ¢¯çgdŽ§Èq£,ñ +¿ƒ×|–j/‰}…5pîǽHhÙ XFžIŒµaÇ‚.—ß=òÅà¶*¹ÁÆ«ôh…TÂfq¤‡`³ã‡’< +¶Î^‘mT Y¦Ž¥K Àø·c2d " +‘ѱܑ+c{§ô À;Åý +2|Øe{KÎå+Å¿6¸%1ˆ¿FçÁ«,® ª&z²Áuæ +ølL˜€q‹fÏ›<âÆ Ôy¨(X‚«ŠÛü@2.ÚÇ—HÚ#ÂórºMl,ð(ŸÉÒÇ5ÉÎ9òEÀ +UÛ,JFæ^2–v€(Ï(?¿ß»°e@s¹À°L&÷ËmLdˆ |Íɼ3懥²ëÕÝ•q¨ÒDQÐ@·§TCÇašéï'9 “ÈÝÙÄdif¸,”Kî°“Ÿ9„Ò•Uƒ· ¾ähäH–ã$£{™ÞOÙudfà–Ž'·¸œŽ!Ñ"xW~¾/%Ý3èŽôè‹sN N%PdSQPÚa‡²–i>0‚¶7V€=zk^à>“ ¹J+Œß´‹ßô,\c"žµɉ­·acrH±…|5öX5U?tšQ’‘FÌ‚?ÍÆîÃÕøÀ]<:}ÅÄ7ûI(E·²Z]s¬)݆¿s2xkµŠ{dhùÅ=Ñäó "Ίû5¶ê Þ>æÁ€WYfrÄÞ*2S燣xµ7<âo +ÀÀ莡tÓðvܺS"I$®¸lïf—Ü@vã|NŸrøã¢Õ~Äo}X;5«Ð­Ö’E¤,kÍ浡٠Y©¢f<Llñœ˜xeSØ;GQt.Î$äõî;Õ±DCbr:ËÚ•—$“¨ªîpÔn)«0Œ_²"`­79çûý‚åˆu˜¥ù‚åÐÎÌckTKÍ&ä¾#SÏ"[?ò(â!ÂÖ È”HÁw¾®vÇ+ÎŒž£ýŽ2zÇEÏÊrÌ;ÜàùƒG©ìŒÊKlŽÁž´Vq]/½K´ÜTœÇœƒçs¿‘L#1k¨zϪ٭-Z}K÷³s©ÐøÊú*°ç=oF~½®èQŒ”A˜ŠcT€F‚È`kZ¡ÆÉ…„(=SLÕ +8ý0”^ä‡ñTr@®L°à}$R‚¼A%s¯tâ^S ‘S®¤f–.¥RAp…xlìœ꺉›iy&å,rZ4ϽÞø%­è,Mù礒!dx/LÏ®J“šVˆFþ\®hÿ¸; [Á݃Ë\\Š~©:J‚ëMÃOW¸(;b=qn¸Ð“¹I;ªK‰hT Ù± Õg«*¶ØfRkr$ZNŒàÑyðÃÓõ¦¨Ü2†‘ðZ–:œŒ«Ï÷G¶¯c*‰]EáuIB—à«xãßwƒ¯…%R K¸²"7£w슸p¨%`@€ß®•'î:‘Oœ£s:œÁÇöÜù-Ø ŠÍ¢yŽIq•dã0&Å|è¶ð/ɹÊÁè®NšKVPq]”ïa÷æ9²ûõŠ–„Q8O’R•™@dR’­§Ê;¯ëù|{1ipu¥½ 7ü’4¸"á ×<¾¯Àgÿê{ Š¥mhøWŒOõ +þ™oéŽc; ó,^VNÇa¬<1dbbû”b«³Ðfzäã°> endobj +4642 0 obj << +/D [4640 0 R /XYZ 85.039 786.531 null] +>> endobj +826 0 obj << +/D [4640 0 R /XYZ 85.039 617.717 null] +>> endobj +4643 0 obj << +/D [4640 0 R /XYZ 85.039 599.048 null] +>> endobj +830 0 obj << +/D [4640 0 R /XYZ 85.039 448.857 null] +>> endobj +4644 0 obj << +/D [4640 0 R /XYZ 85.039 427.66 null] +>> endobj +834 0 obj << +/D [4640 0 R /XYZ 85.039 128.427 null] +>> endobj +4645 0 obj << +/D [4640 0 R /XYZ 85.039 107.23 null] +>> endobj +4639 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F74 4586 0 R /F35 2880 0 R /F66 3242 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4648 0 obj << +/Length 3747 +/Filter /FlateDecode +>> +stream +xÚ¥Ùrã6òÝ_¡Ò‹©ªˆ!ðzÚr<3‰³3ãìØ»ÉV’Z¢,ÖH¢CÒñx¿~ûHJ¤&[[.—p4Fß šð§fiä:›%iìGZÍVû‹`ö3ß_(X +ȲóÝýÅ·ïb3SŸÙì~ãðdeñì~ý«wýÃÕO÷o?-–ZkOi±L’Ô{·PÞÍb©¼÷o¡õ Ͼ¹ùôöúþöÓ"ÕÞ¿yèêãlïÀ~¸úôV†aê]ãúk\wÇÃ×·ï?áÔíû»Åï÷?^¼½wèQiäÿqñëïÁl Gýñ"ðu–Î^ ø*Ëfû i?2Zú»‹»‹8\lj|06K`÷®D5Ôqìý´Ð oµA¦ãÑ&ˆœg‰ë`F·%ÄSg¦/– -^>p¯&Ũbë¹s©ß>ÖÕó6ÄÊ.Ø,#XKWÿ´#›}¦Îeã6$#´Œ…³ëH{—èQpż.òõœd-ðæ/Îsµ žšõyñ…­ž¯<ײFÔ €Ú'²‡- d=Qʼ}.V›%(¶ò™xwÃfKç+ñv[7Y‹}ß‘6¶/™‡ïGN÷RAZ1sqê]Ö—Ñ$‰wùrI­8Îv‚@¾@û’Ûe+V0>>[ÌÔgè¨çöèß)ÎÉM!‘§Ó†• „>%I뎽, ™ŽÅ 8y‘óW£ò©Ññ‘Œ½Š{ÎÚè㮢‹Ûñ“ÃdÇA²O}“0æÖÁZß4âšLä§ÊÂÑ@¬ƒhw;ñ¶6åÐd©! 7áÐMXA3F®Â€½Ø•MË- +}àw’Ý& +ðpÀE»'s15·%d‚‘UÕ»5ÙÅe’)6 +C¨ñx©älNå÷ì=†¨-xØ .®Àz3œ·pþ…K#î-o )‹±ì§ þôŠÂÐÏ"#0åª:8Äì_¿¶IbüL+Y¿Cñ +¼ÊR+”¡eOˆG±Ÿ„ñÉƵó¿âåœÃ-»äoóU$&T¾Š†¾tS\79O•I‹(¡»¤„ +b§ÿÚ™òÙ%I³ +"_ÅÖæØ “ÏØR6[>ཱུBVp^¶å +·’ò£Fô-Ò–rå8¶ˆM¶šùÁÖ‰pŒí.5Qˆ¸p…½.n;—èÊ&‚<矋 HÑá¨.Eœ –#ï ”ü•|›ðËï–TøÏÉz˜Sý0¿#úah ÆüvìÂØwåÓ2¾¦ƒb!^EÃä5¹tÄó§YLÉgqQ WÕsí/¯°‰ 4÷ ,Rù€^ÙòŒdן¥[örüs°ÂÀ6Ô'2tq˜ `ÄÌk8`–]ÅñëWA§7Þ‡ª¶I½½d*Ü•;‰Kª;ì@WeOÑŸm)•G·¶­ %ç£Äa‡£9pMU4(jr¾ÐL×t’ùÚ„Gu„Pêoì1)ò,V`Ì4t^9[ü ;Míé¤_©/@. ‚{žd2]]ÐQê'ò,ð¦tê Äq IG!_KDò¿»ÐõéÝÏôÊ•8ѼºÚMÁ¢á-—{RWÌÆÁÖù¶ŠqQŠ1F;/¹*¬¥kãç³Y“d³"îHµÓ>*íÚ÷éTþ=ã˜ÀH•XÛú­éL5v®³0˜”XRÃîÈÖî(£~œ r·ÁâJÖS‚þ¦Ö½rg-Šâ~zÖ¥²G/‡AUVŸ°…ª®…ëßÑ@äuϨ“3l\ø­ó GšïžFb¾š®²üéç këSm4'´âa]•T¬Óý¶ì2¤£Ú"Ç•ö‘;ÛP¦–¶~žø +6ï¹Së“Àµ“uÊo DëÒ/˜x@î¼rû¨…Ëü[|É]B¹h¾”LRzCÂØÅØà5w‡Ê™j*šÀT_7³dLY„|HìÇÊuc¥b±É9[XªÄ³Ns”;öX?]ðuaº}×è¦{N„™~Õ„|2½ßÊ[#Ëëª":T_~ñqÛnJçVýÃôÛ„Š\€¹&®×Õ‰Çå'̃}J*%EV漯]NðööÒô¸"—J©G§ PiZÓ ¾d‰dfÇIg¤ü.ÚuÙcép?´¡éùêí…Y“eå:}áL¥ŠIÚ#gÀ‘Íë_ûY2ò:Q:!XÓW'>>Ë» ‹Üà ¼l'EŠô5õr”ü \³Ð-oÊƽɤ=ÈÝ“}¨J–f_q)Yà2<F+‡¿6­Æv]´ù×.fÇÁ\SY,åz/öûåêåé멳ÎYbe2‹ÏÜ)ÏÛ|ª°¦ +•¢[Â?‡â…±ŒP|tÏl!-;MÁ`ÐnÚÝ6`m¶îÀE¸å1''"QH€8†Aâgçßl:*?CFvA•ÊŒÅF<}à:äÚ¾Ê#Y’qÙJ†ƒr{ +£ÅÀE‹O„äU¦üD¥gÖƒ™U¢}cR:ÛÎDà,h7%{t)#¸Ûõ0Ê|íêš“ú@Û _z›rb8år®üðØ'ª Bô¤7ê*¬ËÓ÷Ó☒O"”ý$B…lƒò]õÈ]ç#Sï ¸G£•áaÍjW±Ÿ­›°ˆN‹Ù¡‚`ÞVÃnÿ>)ß¤Ö sY ­ vq’y?†¥š!µÇpS¹k‡dîKAÆ ŽlpÞöjVig zõ©Þ×5X¬-$@êÖH1¬«/Ú‡£Z†ª ?¦™H9¹â:Y#ä=©¨óÕ,.7 ªs2ž|ô+”žÐÁ_ø €Áö9 |–˜!è•M~sµèSÔ ¿onñK3nc‡B.[àL‘õ¥AԽ +d¸˜˜­îã œvëROrþÓ((~Ï®?é(ñÈ—Qø¾ÉIùî‰>ÁÁi—ÎAÛ}‚ƒÑOpp‚4ðu1\M|‚“¥¾Ž’¯}‚ú‰ÇŠäD“ OºƒÂ™™–É [z‹ÖÒ¶²äC¼ÄX[ x‡,ýëOlRÞàz;v6\J‘H† fbóïüŠ¯¨hdñ›Â¾û•ÅzÎ@îUd(,¦¾¢âðÙÄ]š„Ç3x§ÎŽ2#ÄV–ØHßÄV>û¶mìý/ò¶/ó+²ë±tOÇ>ø¥c«Æè;>9jxƒ£Z²OüP†!v.70R;HŸåá«ááÒF›àò" r*̸àŠu9l˧XÐztï:` F‹º¦€šûî.†* 0Á7u±gÖBûI>[ +%@.ÖÏòEήr»í&/w½‡ro¥Ð^—ÒNMÔ•ðbôXœÿ̇ÿë»Vm˜ÔÏÒ‰êT†~¨1G…ñ1ÅöØS’ÿ “ÑÈendstream +endobj +4647 0 obj << +/Type /Page +/Contents 4648 0 R +/Resources 4646 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4612 0 R +>> endobj +4649 0 obj << +/D [4647 0 R /XYZ 85.039 786.531 null] +>> endobj +838 0 obj << +/D [4647 0 R /XYZ 85.039 643.417 null] +>> endobj +4650 0 obj << +/D [4647 0 R /XYZ 85.039 624.943 null] +>> endobj +842 0 obj << +/D [4647 0 R /XYZ 85.039 390.77 null] +>> endobj +4651 0 obj << +/D [4647 0 R /XYZ 85.039 370.175 null] +>> endobj +846 0 obj << +/D [4647 0 R /XYZ 85.039 207.99 null] +>> endobj +4652 0 obj << +/D [4647 0 R /XYZ 85.039 184.672 null] +>> endobj +4646 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4655 0 obj << +/Length 3718 +/Filter /FlateDecode +>> +stream +xÚ¥ZÝsã¶÷_¡ñËÉ3MàWß®—»æÒ̹õ¹Óv’<Ðmq,‰ +IÅvÿúîP"å|ÌÍY °X‹Åîoˆf!ü‹fY„:Ÿ¥YÄ:š-·áìZþv ÅBHÍ_ï.®?%f…Aæ³»‡žOqžÌîV?Î?|÷þwo¯Zëy¤ƒ«EšfóOWÑüóÕ"šÿðJßpë·Ÿo?~¸»¹½Êôü¿\õþË·X0ó¯@öÝûÛR}¥²ùìÿûýÊÕn¾ÜÝbÓÍ_¯~¾ûþâã]¿o‰‘Ö8ý_.~ü9œ­`©ß_„γÙ3”à ÊóÙöÂÄ:ˆ–ïÍÅ׋ö¼¸Í̸ט´bq¦OÅÅž¸¢H:R³4ŽƒÄ¤$¯ò¥Äu-]ùSG ¯$Ìæw명5fÙ|KÍÅ–M5ù¼[C¹è¸ù—_øc dPHçõnó*Ý©gµ?ÀßMÑ•\Û­¥°DæØÖ4åY ÛÍËæú±ÚiÈf³B‘ÃòJ'§Õì¯*Ó”±× UÛVõ'¯Óù¦²œ»r…UɼÚñ/­«d²UUlpÔGþ¼'¶5ü2± ẄkAëèp~ņ–üdžOBó 4ªN Ær³aÒBh@.¼jaÛ¸¡ÈN× ‚’WVG\<0m¶1ÁUË®BwkÚ2 û×—ÏÿáÒÈ´õœv—4 ¨?êçAÏ üIüq©Š†¦¶®¡íßðB"Ü_ì ªÒwÕAËZ6Œš¼­‡sj”™³ö|r±¦ZbŠª-+Ô^S¶Ø„é¼±ãnió~%©ã÷Š<ë­ÌçOI¸¢~ Q,|YÄo+œ sš É"³üóù—;®ð´ «}-£…¦½Nö<ž×eÏš`^ןTèreàt'`Ih‚7g’!PQ:,÷(ñ®«…oÕòï¾a]lË•4t2»Ç¨½XqÏûÏ"RIDQ:Зb{·©ˆ“ŠI½pu—;>ÙF%çyÉ4AèÍb„ +Vd,µÕÊÊ ¾ŠXE¡¥·OÜÓ—&TüZ•ÏL×3‡UÞ×ÓcX<hELõc˜LÁúj®|›é%ÊäÐ6|°±v(q¨@ö‹F*[;ÔŒ¶>Nü­Ç”¥JöþòærL=Ò S‰üFqñúG™Œ¡æ½¸ÛeSÝ»¹°M^hM®j £^½S9‡dI#ß’&h‡è<Ë·ó/ö¯æßbµâÂoØ,âr6m‰#?qâvX£Añ–ü‰æ[WUo?–]ݼr-YÕeo¦æHæÓ­qDYšrë aÅVשæ–íõ:ÅZ> +!cZŠ%§IÔ[–B½zj¶ÙT½§ƒ­ì±RÛ;UaÑtBÓûü»úÜ\¢]=¸$•D¥ ¬¸pùrÉ„÷dÖ‰—Fã)dÜÈÖO ¨úÁŽ10t°Ì™ ;ˆæÔ‹8‘Ê Ø)Æ1$£y¿rCÑ! TSXl‡FÈíÚI-ÖX©I½±ñò[bæ¼V)¬–¼ïìç.¥SSz,ËM¹ìá6wd±¥$Sz®õ†?úãƒÕ#ÙÄÆ;MCía@ÞÛ³ªø]ï¬*•\øZlQ ÷¢=âTYíšIçþïÁN$Öw]…3CW•¨7Ü^¢ØX'Aø<=IØÈŠͲw5)’RX=p¥?æjȘ*ªc=¥1þh:1n4Ä4þ¢l J–±µcíd°à÷^4 ˽UÄÃ[6ó‡Âí®,ðÀ:2@Ð¥ h‚6%1èÈ°ˆiÒc7¡jJ–afÐÛÅ:çÐæaD[ºÞ¶qe1¼™“’ÖÖ Q…”<0¯¡”5oñØZiƒ´““d÷©Ÿ¸y«è<ˆ{Ws[î7`¦Ù*Ò2Ú§…´ø—7\ È„ßò¥Â†ÎjÄîQ°ˆp÷Œ óˆÓSAž[L4¶Ï½ð‰âÈAÙgÈaà |ðN8kn¬_n*f-GkD>¡ +¢XÃr€µ¸5°‹Ž¥ÓÀ®sßSå‚Tíš«I¡f虸Ž4OÎ?¤ì±4uãŸCK\}¹Çq÷Å}0uŽ¶ð¼-ä â‡Z4\µ®×d.ᇇÁÚ­E!2c'ÓA:ŠbW\^Z×PYDáqÙBÄi¦{ßÖ¿–#Ûh þÑ1$—0 –E8»H#–mEAžšl¦£òŒ¶[å9™Í+nq1V’bc¡•oiwô›Ö ‡ª*²‹¸+ž w 0ûæyW6íºÚ¬;Óѹt™v+ ˜ õC°þpJ:öîŲ#i‘±›Emk®ärÉmGØ …©Aää›RÄ „ ¸lJNÚ@y[ ‘}âž{׫ؖž2t.H’  Ÿ•€£™N\“¶³zÁÑÆ“«aá MÃìÁ‹­ ¸¦åjÔ~üÿÏqVAXñŠ¿ ±<ñšK V,ŽêØ"P†fÅõ˜2,È-R¸!£X]æP­ ¶œny²Yž6u˜6†I&æ0‰Qˆ¸Âú‘¿˽—ú:LÇ-Y”AqlS" ÖHÏ^ÿ‘MAïšÅý ´:4¬v`Š°Æ§ÉY†`!ã?1K×ÿÌ,…gùP7ƒÎbc—¬ÜÜ5æŽÐø­Ê© ¥Paö‡àõŸ^€%¬P¼ucS€M­Ôoz4 $Îÿø\ÿ3K¢ñ=‹¶õ‰F¥Ç»bÝ.Ì% -ŽÖ«c®ªàŸCëRŽé‰GoGÜx®“'o%ÕŒõddep<<ÎûÍ+$‘t6‘2•Ì›·áç¶Ø·ƒb6¬ØKï·Ô%~"e‚,ÊÃFh3 ¹ËÅæl®<¹Ds‚m8ûkɲ"XX1Ysý|ýÂÅ®©ö’:át)Ô1“Á †?;éÅ‘0– þÝpéh3 Ò™ƒf:*2¹“‘ñùÜœ öÆ2éþp8À͘ÄCOJ1 |ÛÌ4–ï)© |Z»Vä@1@œYê£ã¥´Áß0á˜Ñ†æQ(n½Ãd©ùéi:æ9mwã|Ôî‚Ê9„ ƒIkKs~*¬Â*{ò‰Î!H‰òùû]?+Pmšf+8+ ƒ82~”殘âX®JÈ×ÁW¯0Åî‘2±ñÉ­WÊ>Æ…r[J¡ãŒ3ßA1zÇeÉÒ33'CýñbŽ†Øø¿ŒÀ‘ß®a\rA”îwiðdºæcÛzIãÊ^å@Œ·œ¡™ÿ!aþÄeæ0Ëä°^~:•FK=”‚ôÇ_b˜i—Ï‹'’P¶rŠDüì#¬ÃÜ sÓFÎdr0¼”P\lv’ NJö1Õta$z5·tŸ{öo‰(£&Jƒ!;¶­Q÷䙬›¤ßÄ•™^¿}˜†YÚB·>G瑬‚™º™¤.E\Û¬¯w$è7œ&8¹¤J\72g¶ŒU²òMÕ²êl¶We.e„{ ­ª7ÌÀR¸TqdÉ×V¥×J …–1føòY´vÄ»I7ÞJÍTª•$oØMK½ðÈGŒÕO +“Áå6é4n1cÆt4œÍñ <“œŸ‚E[*΂4J¦ì¥°ê_%СUž:p™Xù)±\󯉪‡×¾/ä„ëßâã‘þ¢ØÛdäQïSéïO¾±jÎ]Ò¨ÜôÑÒ½ƒà¸0MÓIë÷¥|AÆi:Hv§é8®àS‡-°|âP ÷y(„#RÎsÁ™tÇ“ïÝ2’øc:8‘z穬¿HÓ±cÑ똭0Éß8–zá‘ŸÑI!çɸ[À†cîOW…q Ž§{tn,ÍùIBàd©LrìàÄ‘4´çIø?w )tâÙt¹Vt„œ¢l(Ú¢ÐÛ&ÔVþ=¢‡Œqžq¢Îœ1äï}ôydíeëO‡Œ>æg0»¸)áÛ;`Š¹ÿÔ¥àyøÐÛse¹À(-¨W^¥PűÆdS©€Ì §éó8ß!D…×Ã[Ãò¡Õ¤òŒ†Á½v®i +=ÐUÉ«W’KŠwæÌ™»;Š<ÑÌÂßÝãx°Ú§?ìÝœ\Åy÷Íýk4÷üÈx¸f]X±á bÚÚhD«ìk V±z÷îê—<*q÷AÊ¿Ã'Ø îá‚J<¸¬úK3—rc’ªaL>+$D­¢üPA ôAj +Ã%Ú€AeDd³(Ñô¼á À Ô |0ñ<µŒ8¯Ó UÓbjRÜÓÄ‘€…Ád'ðÄÙZÛÅa •žÆY'tûxBG )%ÔzP4rR”œÀ +a!tVmpøjoäÒ'ŠsÞ#µˆŸøwþ™ ”8+‹ +¾s@¡ßƒ¶k*NáöHÃ]ñþ "*„øtÂzÞ‘ù3SîÑ$Œ&©d¯°ìŒ7užL>šx`-M2–Ô&æ´K¾©ò-£?eäíÒ PϤ…lÊ_Nª,0‹PHöMaݬ\|pÆÞ|BÏB·Y¬wøcï´m”ÁÏ á4¡%6u$š„•…¹åfw¡—¢E‘Rmµ®pjõÈä9“]ÂðU xú‚‰{K^iJˆ…»à·oŒ|ÃʶdOüÎÙ™$öžZU¬< Óz”x `ê,‰.6Y+¦ w&šÐåĸ˜}ÖÈ#8E +mäRÙ`o[¢ÚG£kgÀÔ¿â-lüÓ"ÿlõÿ­ôñbúöNÇá÷ÛÇ&þóâÿÔÛnï +0ȳ ;a+€ä~2t ¨Ò¯"ÀO§üÖQg[endstream +endobj +4654 0 obj << +/Type /Page +/Contents 4655 0 R +/Resources 4653 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4662 0 R +/Annots [ 4658 0 R 4659 0 R 4660 0 R 4661 0 R ] +>> endobj +4658 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [342.345 336.894 409.913 348.584] +/Subtype/Link/A<> +>> endobj +4659 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [452.526 269.148 512.306 280.838] +/Subtype/Link/A<> +>> endobj +4660 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 214.951 206.209 226.641] +/Subtype/Link/A<> +>> endobj +4661 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [427.522 160.754 512.306 172.444] +/Subtype/Link/A<> +>> endobj +4656 0 obj << +/D [4654 0 R /XYZ 85.039 786.531 null] +>> endobj +850 0 obj << +/D [4654 0 R /XYZ 85.039 480.826 null] +>> endobj +4657 0 obj << +/D [4654 0 R /XYZ 85.039 459.63 null] +>> endobj +4653 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4665 0 obj << +/Length 3281 +/Filter /FlateDecode +>> +stream +xÚ­ÛŽÛÆõ}¿BÈ‹© bÈ/)ò®íÄi`·Þ Ò" ZJ¢V„)rCRÙAþ½ç6äH"eÔ)G3gÎ̹̹7\ð_¸Hèl‘¤±ot¸Øn‚Ŭ|} +ÆJPVÎ_ïo>G‹0ð³ [Üï†s²À7Y¼¸ßþèÝ~óÕßï_¼]®´Ö^¨ýå*IRïå2ô^-W¡÷Ý }Æ«Ï_½}q{ÿæí2ÕÞ¿ôÕëç8ˆ¼;@ûæ«·/¼T©w‹ûoqÿ݃oß¼¾‹Ko¾»[þ|ÿíÍ‹ûAGÄPkdÿ—›[õÛ›À×Yºx‚qà‡Y¶8ÜDFû&Ò2¯nînþ1œÅkÑ‚wMiËèÔ7©¾TWhu…JûJ…‹Ä?ŽÒ×ý¾a¢ÄÛ–-ˆV ›¾iß3´cÀ±-a±GYeá€ð¼{dzÇ7ç,zÚÓâJì­=Ûb—¯êy^vø› +öüî™B“yå×¥1^^ÁòQÖóÎî)ð+‘y¢â2t‹´Å†H5È.p¥¢Ð;àîÐ{‡³à\’–qò€[÷0D¥áxGm„9„la^N‘4‰V“D†Ùv9œ<ä‡QÈÖzظjDaƒ1I§`À]Ñó€ô Æ:èéò2}Æ Ï㸞Ë!îžSQbEk¤5ïš‘Q›-Ñ…­O“I[®fÓ©i¢vÉÏí™èr ù)£jÐ/Â2ÐÓ–/ÃPyŠÇñ ÇÛ%ÛDê±KàÒ³ž×PM;8=–}¹9Vyk™ïE—À<Ýùø kï0ªMý sshÐ"kv‰qâhÆ»†n‰¯ÓeýÀ‹ça§c0¡œ,}þR»YRiíg¡F‰ÁÃÚØ1âI:2_…‰à9·A„„{±<+ùF+8ØÆÆ2glØNTªýPMÄv"Š¶_œ×a¨|8x‡‰Ÿ5U)¨ÐOÆSUD¨#(V+gÿD¡3(5Ì@Äaí¬Jÿ?p…Ì~É€ I’Y¶ƒÈýñlû¯°-HÈöyJÓblÁtØ–£0zpxÉl_24˜Ç@UššÇÙ?/ŽEš­p¸˜“h,âìé«Wd’Ä×Aôñ2û¯È$HÓW4Q§âÅY`r~ic!3woR±›8ðc“^mJCÁjÞ`H ««(õSÍ‚^ì ô#ÆЋ@êIª6·.ÇNråhA@<ézŠñ˜è4\'Æð8ñîòÃ:硈`š÷PâÈ¡ë#GC>é?>–/gÔA#$×Õ0âLܦUƒJ}¥¹Ù¸Ë‡:GCÓt<êš¡À‡Y³ã_[iãøùlº°äJ¬ÿŽ½,ù2@|tÇ ’Ùór.4>i‹|+0ÇUï?ä!¯!¹Q¾B–ê÷¯_ýs"kIUi+. »NŠÈ b MÕH¦j0Ìðžë\Xå$E)Y @Ÿ’ mqIÇ­-]>[3 T Y¼OPɨ„* +Nî´‰ ¢iIl½)% ÆòïZöV´°5çñ§ÕLãƒHT£äUóÀÓ±&q÷Ó5©3çÞ*½¬8TÜ£èdLŽ§­1,ö䀈ÅÃ#t³µê›Zúµ,Cý&C£¢²Tz\ÚàÕ!hHÿ¶^ÁU,Zq‘±áwÇ¿9/#»h¨BfŸË¡µTl0$¥=-[ÑVNØH?$[0Ž +króQ/{‘¥äÚw®ZíöV­4¥,¼•b7S£›)5¸Ϩ$RN §´mkзTKÊN7ˆù<°þ¤à呯ף˃m¡·AÏü}Í¥l¬©=!ÜŠR¤cÖfì`lMIUŒ²F9tÆnÅ0´ÒM=æ)ýǶyi}üℹ M;vÍ0¡_ò”ƒ„´öùzÖNÚ±8r$‹ÝÈ]σhfQzws¹ãű»1®áÒaOì= ·;ïq4éÎ#bÿn_++” È?ç[)Õ¯Kift{6ê›Ñ',g°z´±nhRcÃ<ºc[ÒûSó€í +ºyURÊy×qŸ€ÁØPDÐP˜X…7›h% xRP”2g!#*ìy²Î™€pØ0ƒƒbS[`±•"6~hN5tõDÒÑâA¶(PÒS¦©íÉ`Dz¬JªÌàŠ&¥¡ƒÉTò!©#AhjK„ìøuÚé€õõ=sþDÏ!{Eh¨2øY-¨%Nþ‡„ŠúR(f +P´­USWïyŠµêŽöÄŽ÷ÀZ)À'Ȇ·¨DyåArc¬ùáaµða÷ºÂŠÆ¿ i\lDO‹È&Hä—ó½yâP2jo=aWõDûÑX¢ðÒDä}dÂ;’À×*ý€˜$t¼)=Âòx5H×.“jˆ£^â…Ê CÉNÝÁ¦×"hͨÓáA*rùæXm”WÎ[¥±/ûI¯€Ú9²²Üæõ¦¨&$Ö‰ŸÖ5Ú|4ý– òÕL±F@›QvªMåuw”¾* +¥òf›¥Gê¤I(ý0=Õ$‡~âê¡Ç/ êF2!EtÏ-Å¡ívtjyœhFt”ø©ºÞŒ88COù:ŠÝfDkåC•l{²Û±(ón›Ãar ‚žéEÛ6Kàóé ?rÌU~FœùæH‰Çܾ¿,‡á3.Ο_´º*KØÅppG—ÔÚ:‹>BeC–’kÙ¶YGNwƒ¹ 9|ÃØÞ}an­âŽC^VÃc3Ì+)*À,©·QôQé²[˜°Ãš¦•²©ø-?4žø¶9ä¶Ë±íP¾=Xó­+…–_¦šž^!Ø镱OøÊsƒ¾ žÙCù}û¸&›ß8ý”<2ËyPڗë`ì÷öxŽñµô[uQlmƒÕLº§LgO¾¬ê%œâ}}‚ß ”K=áÇxGr^çʆ XKØûðX’J~æPmÉw+˜´ü-«‘µ¡£QÔÞœô"ÄÈ^LBN¯{²¬ב‚ƒE oBþÿjÕÖ€êâ¹ 1Σ ÇŸœŸ—¨P´ActÛgà=¸·r‚2äׇö‘WVoyåì@>å¶$âFöŽ¡·>=£n¸…¯c¢/þTBd#Ùý$šS÷ë˜lÇÈgÌ9ߣÏîç< óùÏæúÚ{y"£2ã<¶¥ƒvgÎ8èšÊª{ nûû‹´)3âR•â&—ïãõI0åI‘ à ®ÃåÊSËzÁiö‚IÞ5üýûK³zBPß8ùä.8+iêOB0ý˜á$JCIOžï¯’“þëÔä…ߥöuãš•}šÔÜñ7R7îN羌O.eç<®H@ÜΪQÇ~l¢¨qDº¢FABÁÔ¬¯‘³j¼JͪѡvWôg*âדzôÈ})¯uŽ?¹_ë%'È«Ò£“Z&Žsž¢¶<~€D-Ç_ðµ”*ëò{+4¬TáÇ2©K ]²×³­Máÿ®óCñŒ¡«þýcÁCÁ[¿á7ûؤ!DŸÖ¶pþû?‚ÿ2U›þ9Š‡F q’˜™sþÑÝ5¢Á@ô÷?ø÷ÿ æî#;Õ.?Ò“aþ1sêïã†Â4Jý,ùnm”òU80CN¥çÛ?¤»dù¿ïÊîendstream +endobj +4664 0 obj << +/Type /Page +/Contents 4665 0 R +/Resources 4663 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4662 0 R +>> endobj +4666 0 obj << +/D [4664 0 R /XYZ 85.039 786.531 null] +>> endobj +854 0 obj << +/D [4664 0 R /XYZ 85.039 560.658 null] +>> endobj +4667 0 obj << +/D [4664 0 R /XYZ 85.039 539.462 null] +>> endobj +858 0 obj << +/D [4664 0 R /XYZ 85.039 347.827 null] +>> endobj +4668 0 obj << +/D [4664 0 R /XYZ 85.039 321.212 null] +>> endobj +862 0 obj << +/D [4664 0 R /XYZ 85.039 277.468 null] +>> endobj +4669 0 obj << +/D [4664 0 R /XYZ 85.039 256.272 null] +>> endobj +4670 0 obj << +/D [4664 0 R /XYZ 85.039 163.752 null] +>> endobj +4671 0 obj << +/D [4664 0 R /XYZ 85.039 148.081 null] +>> endobj +4663 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4674 0 obj << +/Length 1440 +/Filter /FlateDecode +>> +stream +xÚ­XÝSÛF÷_¡‡ÎDž©Žû–ÄL(†܇LšaÙX-ÉÄá¿ïîíÙ9ƒeh’ A{§½ýüíÞ +qø'¢Ì0®ò(Í,3JDãÅ€Gwðæð‰gIžßGƒƒ·VG‚³œçÑhº‘“sfrÊññ»£?G§×ÃD) ņIšfñÛ¡ˆÏ†‰ˆ/Nú•Þžœ]Ÿ®®‡™ŠßÓÖÑå :¾¶wGק~{(³øÏãù›Ú>¾º]ã««‹›áÇÑùàt´q pQ(…æ|øÈ£\=p¦ò,ZÍ™Èóh1ÐF1£•_Ï7ƒ¿6²èŽèÔ®hÁ>Ëá]¢ Ëdö²:¥$Sr·:%‚s0¿WŒ;ÄA Qž{[J"TÎLf¢ÄjÎlª6)Le$ËÁ +­YnM”Ê”£\/òÃ=yÖ5»M ™E™ÑçH0®ó\O@;û¿¹å6Î":iÀÒ(4ÖËMÁÎX‘x™fRF)—€·ÔÙ:š ÑLÈ‹Ûa"Ó¸ùâ׫j>*ËãÎ9³¤íepäMçü¬`gŒÄ§G:p[-ßÕÔô,Ö²Jdn'È=^6¿¶š8v+d|=)JŒ›K$"'w–>"kóЭEü7©«¯(­~øJ»‹¢F‚Ç÷ÅÝ„¶ššž«YAYÁÅrVxª„ÍÜÎbgQ‡gÓøÌ¿À@îw¡QÆÙ´œ¡©ã«|ªrϢ못:ÜÓ1êÇ ýzŽ^ãbÜNŠå¤¤…ó‡Èu ‘.«–>jiŒëŠŒözf“as^![½Ю]BùÕ=5ƒfJO綌LÕN\Z}ž±Õ°§˜Ö©`ÔÉ÷WRPZRGɦY|#03 Au0KMìYçÎ …# ³Z~+Ž{i£5V= „PšeHz®ŽX^Ðæ;O¨íd+ÿí#%«ê§:>˜ˆé7¦î¶hѾƒ·*m3–J a†ØgÔ~&FšxéðâMÛ-¼¹%á ~*s㣠F4ëgº¡¿?žDJhc9^¨kcü»”b6—žiL32hò÷¾7æ3óHôy… +ç¤.œ‘ÈùeH³-nº¹qÕ?¢È¢¦á;)\ +©ÙŠî½û@Ø^¸ÙFݦö—M‘2>/ƨë“ÿT-üë)"i>'p9Õ»` UVù!…²“´«¤MðÇW¬è«a‹µÚ_Âéøì*`!ŒÙþ˜ú xÍ„.ؾÞ«Îð~m¾€Cm[\Õ”•Í'ÔŽR†éŠ ×-nÙ¸©§; ªsàÓžoÚ´~ö€¼nÆYáGU7‚”Ø=ve9Iá‹YoÏ¢ p<ñMÁ} W§~ó™Ä«èyñÇKüt¡Ay§ë%ìø›‡2LïþZ€ÿ¤ì‡þ²ùÛÎXžõ|)aÊÙƒÞ ™?µØ¨ 2¯v˜ü%¤endstream +endobj +4673 0 obj << +/Type /Page +/Contents 4674 0 R +/Resources 4672 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4662 0 R +>> endobj +4675 0 obj << +/D [4673 0 R /XYZ 85.039 786.531 null] +>> endobj +4676 0 obj << +/D [4673 0 R /XYZ 85.039 634.82 null] +>> endobj +4677 0 obj << +/D [4673 0 R /XYZ 85.039 420.461 null] +>> endobj +4678 0 obj << +/D [4673 0 R /XYZ 85.039 303.495 null] +>> endobj +4679 0 obj << +/D [4673 0 R /XYZ 85.039 134.927 null] +>> endobj +4672 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F15 2876 0 R /F35 2880 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4682 0 obj << +/Length 1145 +/Filter /FlateDecode +>> +stream +xÚ¥VÝoÛ6÷_Á=U&–ߢì!KÒ5E‘lŽbèú ØrìÕ¶RIIÿ~wy—Êä"Ídòñ¨Ÿ‰{v1=?]MS¯“¿èèäò “\ƒØû“éy˜ÏÁ©p͆ÁlBèú.Îó2ä³ÞEÙ¡ƒ@Fn{¤Îc}àh©œ!¦áCNöG“ZÐþuGz@U®‹âçZÀ‹^ÃÌHÑ7öô!’ ³*[âÐã\ ù¡ÙñWjD[xíô±…ý¿>ë†B3ðñæÕñ:³JA‡ÎP‹ç[ía$ë#.ÿ ¾¾’ûendstream +endobj +4681 0 obj << +/Type /Page +/Contents 4682 0 R +/Resources 4680 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4662 0 R +>> endobj +4683 0 obj << +/D [4681 0 R /XYZ 85.039 786.531 null] +>> endobj +866 0 obj << +/D [4681 0 R /XYZ 85.039 567.21 null] +>> endobj +4684 0 obj << +/D [4681 0 R /XYZ 85.039 532.27 null] +>> endobj +4680 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4687 0 obj << +/Length 2983 +/Filter /FlateDecode +>> +stream +xÚ¥]oã¸ñ=¿B}“µV"õùØÅu{{èÞ¢_÷áî +(6c +KYINâþúÎ%Ê–s@‹19g†óIE^‘—'A¨ /ËÓ Ñ‘·=Þ…ÞVþ~ Fœè ‰c/,®íê:UAg‹8rÆ:Sqç1â|Øܽÿ¨BO…AšjoóèE‘ +t¤¼´(‚$˼Íî7?ŠƒÕ:IBÿcµŠüÚ¬Ö:Mý²Y­#Ç“_̶]éÐïhžùÿĆ‘¿…Ñ·ªÙ¯þØüt÷·ÍÈŽp“I¤oò;¡»QâEaP„ÅŒ];$d÷KG“qúegËfIῪíJåþ·å©7=‡®==ˆt8l;Þs9aË™gpö²R™ßvßXYõCWm'$QY2¬A°m‹Û¾!f³•æJû›ƒAÍ€Ä믰 Ìë@|ÃÑ…?€uì·ø«üá`ð„ºö¡fi#ÿˆ` \ðrgÊÝ×™á„óŒ!‘†?v­ììÔ±y°d{^løŒûLÇAPð°Š)š®±Û†àÖëäü“+Ÿp¬‰‚j€¸w L'ÖD#4Ò¸ð?¢šr8u#ûd­b™Lc~£˜xìoñ(¤ßäq¹m—I:WÄã}yD%=€1êPÉõ!ä¹Ú¹Ê†µ²®qÉe¤‡ÍkV7Ì&{Êѹ`÷^ЉPK6žjK4åºÊñ>ß3ý¯hÍŽØx‘÷¸»®,Kb+ÂØÑëžñâVè¡z¯Íx:Lä3ŒïÙr¾ËΩ°üó&æÁ{ÆQaøêše'¶×»Æ?Ó‚˺oÉðì]¸ì ¯­U‘úì\ÝßLSçââ,ÈÂäÀ  ædüFJÚ3öìš5D¦,ìCÙ3y¢þºŠX“æi¨Z”.õÌÄ|¹ãÙÑÈua\à«TEÆA!B,í¨Âáå©7{Ã@ ªHüÇScyP‚¶!s÷Ö8KžÞ¾©²sZó-r°V±o;¤ù’pÇ(tÞn +)x5Bo$ÐoÞÓ¼Ü'²ðYN]GI€—<}!ªò‚¼0,ùggh7.t¥ ™1¤´GË \4Œÿr€ £Ü¯†lˆ¦!]5[A%ÅãÝxù_§JÒ¾+0¯‹zŽL"‡ý$¥ÔÕ¶sêe½‘užNñWòTNy +yØ1"»7ªËI1;cù?¶cv3ãÈÔ;ÜœJ<*ísÝv¤·räVb®%“kY/„…1`¥‘x;ÈM¶5C)‡¥,M;ðRÌNý€¬¤¹è#;J3ŒG…pO$n‰MÉRröe•S_²•ÈT¤!ÒFû͹LZ|˜®nIÒ3í"FsEW”C<«Žp¢/˜oÛÒžì¯WE!Á‡± +Aºe 1èi;Áêk¾·‹MhÛ婤~Aвyô˜: í’S@£tDÚ–¼Dÿß¡ø!ÃÜ‚AtE•Ä¼Ïý€9I%)•S€°g…ÏŠ•$»`Û óB”Å܇ h‘ÿ¥ÇigEÝ:Ór(ü%¤#,€®íŒ#ÕPaàY'„;ŠN=OÙì`.S³Ž†Œ… ýy´t††,N!h”(çó*¡ šÔ‰+S‡c+ûÛ˯X3V³œÍ±=£7û%×| øμUurM¿_I¿»•d¬[×ÀÒ¼|Æ΀áSMÊf"3ÆM–]³2Ä$ü>%ÈñåHyÌ_EähPÐÍj‹Î^YÀ=s|èⳈxÃär¿g3–k R Á¿‡IèDbKŠB¬GŒIV£àrFt‚Cì][׺É؆!A•ìwŠKœ¶%˾cÖ`gË|.”÷’5Eÿç—`q‡ë¡1µ_·Ÿm¡wÃl=qYe^õ ¶ŽÖPugTk¿ûíÐÛA]þÓÔÖEî½À8 ¢¢ðŽw:¶µHe^ßÝßýs¤²dyA5~‹ m + {NemY‚º7 Š4€L»AŽ„ @¤0ž)`ˆÕ÷s‹W7Ö¹œ‚®Ò ÏèÀûîEÐË…fgLüObàý§cäýЧތY¦»vs·’»ÝJ’Ä™§u¤™t+íQ"ßc½Â΃´æ쌿ÙrÓÒs æÚy‰:ü´m5’kƒuäx’V£ÉGdñ Íl !¾lãÇë°5¡Xà=úÜ‘z-l!Æ€û,#—SÊ5-vKÛô6Nï\Úx}`àç©›ÙÙ`i»™m]™føËå5ÇY$ sÇtþwCD[ŠÌ[ã¶âÿó ¸”@e~£ /â7_•Ç`%ÉÛÍ9 ²(µÍ¹’æüÁúí ÌÆ âåÜRx“• çv®â"Ðil“Õ‰™< áÀ)…ÀÙIÁ=éO‹y;³€ð‚!°’çBmÌT-œ·àwÊ[°IÎé)!džŠð¤rK©‘Aì{l£?ðxÞÓÝ­%Ì|Ýßñxz(ºîµ +âPIGÛaûkV ºg‚)ÿïÆ*ê),ôÇ)˜ya»içõ L:KŒ ³¼@`fnù‚–¸Yˆç×0ÛÜI3œó«‚X•ƒó΂«”=sÍûâY++ôTÄñ+ò±K‚õMêFúé‚|í:Sn¹ôå8>]+=ðcÖÒÎ4g.æŽTXãTp_ë7É!Ú7{xºtôZ‰T£mg/‡I×é‡j&ç¡Ïf}¡×R5³¥Ñ\ ¿ˆèQ8SËýºÎôR¥³Ø§ÊŸßéW*_yR ŠØþ™¡†Q6ÍA~zæÌôXèÓ6§7`æ4uÄ.“_;· +ÄË-2• ¼ñ_+0«1ùð„íÞ±áFóŒu*é +Æ”…§~äÀðˆ¤‘¯x<–Ò? pè*çj‘: þžz‹"wã†û5—£Mt¬?Ô V´\µ¡x½NÃý™ v{qžÈ£fÕô@|û_sœù5‚¹Ÿ5H´m,Ðù= Q r\È:uÆš4R¢÷p´œÆ=Ý) ‰sLà´Ü ñts Ì¥”¡Þ/Oý†+r§œ×yNú<Õ5ÕÓ’Gd“]h¿'ÃcÊðËA~Þ½–5¯u†›qkQdvi˜¸Š8 'ÓË1Ìz>UìÂcéòb£Éµì%?Œ]Ú<=’-½-]¿ÉÕ6ì;]o³Ìô°wá‹| œ+‘ÜðLB=OOüËTr_ý[+Ñ·‚¤ñ;f¬jãÄÅñQE¬éZlª±ù„uÛòÞÈRØV~¹gs˜ºQ~ËxeŒåp;è:é³ LúÓåkhÏ´P¹¤œÙ'à~:èiÞ,ƒ:ðIqq,ÐJZc..D&sŽCû´Ù’‰õÕø,bêˆ!&=ÖÀ•¢KoØÀJÞ|‘Áq¥3ßOÆV)„Ê®ä|~b¸'Ó¶¨CŠ6íáØù +rFÑ« u¤«y')›¯IÞEæDí‹vËÃÉëaROý´} G>o¾£¸H¥SœWòñ*Vɲ2Ý{|Åt\¯ç‚å"Ý!¥åªì§‡Þ`è&ñÎÇ—3…QÀ¡„ô¥ÐYÌ–6]kõQÁPò b"á‡Î#Ö\qèzd¬’¦ €Ødü–Ÿ½g2hª”ãÇ*¼·,m~?Å#¹ ¬J뛎>h-ÍйÔ]~ —kÈ,:+¢ +1®‰,8 ×HM_\‹ü¢^PMü½¨·tÄú”Ć+oþ4Ó0©Á2#Âñ¯¶p•_t'Û¦Ò¡ÿWLóˆÐ²÷âÞnAæÙ½Øv¹”¢“¨ÖsWâh»$]‘ýäTɇBùROiEÞ¹ ‚¿õZ'A¬µÛ^Þl3'Ôë.S‡:HÕHŽú]]ž™h¨ÔsýÆ¡ÿ$6(7endstream +endobj +4686 0 obj << +/Type /Page +/Contents 4687 0 R +/Resources 4685 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4662 0 R +>> endobj +4688 0 obj << +/D [4686 0 R /XYZ 85.039 786.531 null] +>> endobj +870 0 obj << +/D [4686 0 R /XYZ 85.039 766.606 null] +>> endobj +2960 0 obj << +/D [4686 0 R /XYZ 85.039 672.187 null] +>> endobj +874 0 obj << +/D [4686 0 R /XYZ 85.039 630.546 null] +>> endobj +4689 0 obj << +/D [4686 0 R /XYZ 85.039 603.932 null] +>> endobj +878 0 obj << +/D [4686 0 R /XYZ 85.039 284.675 null] +>> endobj +4690 0 obj << +/D [4686 0 R /XYZ 85.039 262.913 null] +>> endobj +4685 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4693 0 obj << +/Length 4261 +/Filter /FlateDecode +>> +stream +xÚµ;]sܸ‘ïúSy Uåá’ø•ª<Økoâıöl¥\©$Ô eñÌÎ’”µú÷×_’3ª»ìÕ–wÀFh ý Å›þ‹7EFªÜäE¦*ÞìWÑæ+ôüé*Œ­ lœ7·W?ü”éM…eTnnïíì®òmÏC=ùJ£¤ŠGÂqj•óMq’„wkf†ÆŠ´•n ˆŽªÂí<aÑÊÚñhX¶£ÿ4UÕ ƒpðÀ¿DvÛtæˆôU,g*O':éŽÅ|ÏÄŽB[CÒVoYˆ²nuêäi’_FÆ#-I$ú&÷F%,IîU@úŽ_¹oWµíÀMaÿ=_ˆ„ï-$‰E`º HaN…à¸ÒýËD4ÓôÍáDH]j‚ç]iJY˜ð°òØÐxÀë”æÁ›gîÙ›¼ãÕc‹lΣàsuÀ)ï*Æêð[rSCRò„ÕGnÈEįŒgÎ šOõ‘[õ¯'ÜbC"€Í´ÕðÍ*±=SaÈ¿»NÊÀ ­Ü™]Ûw_tëÄÁ#lE8Yãx<¯G’hÖ£óaÔ-ƒæ:±A`ÇùçÙœ€NÜÓ=Ê’×t·°ùdöÙ¶ 8X™Ã¡Ó:êeD 5­ªv––óÄaÀå)ÔŽxfãéŠ&¬Ž†6IfH­èà\ŠŽ+IËIÿ%Yä« ì¨ðàÛÁÄ5’pDéIJ¿ÖüÕ®I8vì:º–'™N±ne†G³†±$×þñ5f–?òâu!ŸÝí*9„òo<ÍWß“¡Ü­Y(x4[k†¥öØU|@ .E|ƽprdrÅ@ÒÓ½ŠwéA†Y‘¸Õ@ñ¶÷µŒèî¾®LÁ(À!­ «° ÐʤV : ?°—PïÂÖkAf~ynþzönÜâæ’$¢ÛÑÉÍBðÎ8&Õ`¤ ¸Gü±\¤9ÉŒ~ÇæhV³õÌ_{lÈÀ¨JÌ!hÂH’ȉ¶‘?îœIèã/I$™a¾ßcÓQ—f­åhµsw£¡³=!Æö8ðwÅ?Ž§ +-ŒS“ÍëþÐ'„§‰_ +Ø‹$;V\æfQ5vDµñ¤æz½ð9yjˆßW a{–Ö(dëÐö¡’ª;s“†É¿\Š;›IQÀ! |‹:¾Þõ‘”N¼fð$–ü}牳„|ãT5ä½)/:Èò°€&ûooß}üÇ<¦Q‘ +ó8ߤy¦QñrP£B­²ÕfkæÚ:“QÄâѤ¢<ŒSeWDÊ>Þ||·â|& µ˜úW+ûƒ@¬H.í.-ÃBÿ6›ã©^Ø[ÑXžy{ûôîõÛÿ½é8 ËLý&›3s]Þ¸B0iéíî˧÷·k¬Sq˜…¿.›IXäÅ¥ y˜eÉo³A™ë… –qÁ¤î_ø°²½8w¸ÃÊ~«J<ÄÂ5ƒ íÉÕWšƒÓn‡Ž[ƒÜû]SµìZ±E8œ@¥Â€»†\ÞÑxü€p0îS1iÃÁ ÊÊ€÷+Çž¨"ÔIzéÒä:„Ù62†eúÞ™këL¶rmò<̳Үˆ”ýô㛵[…El„¥• Æa_¼8ZÁÒßdf®ËûÓ: •xû{{óùœ\Å®\­$ R ñ|ž\Lœ98DO½1,žÒ*p÷ Þ¤* sÍ™³X‡I‚S”7'Ît˜èÙ ;‚·Cî'Ç%;Î\|¸–¨?ØÙ á7ßëþ{S?Û…Ò ˆ—ÓÎJêËì"U™ÆìyÍ]eÊ÷4¦ ͉ŠÖÅ$aøæ4¥N÷ Š52Íäv^š`ükݦÒFy8î gØŸ¹ÐÙ1Ñ|Ï'¨M• vÎræqþnÅË œS”¯Æì§ä«àû{Sqú×_›a¤°/ò²*Õ’—)¢²oQ,)2˜A’ˆâËr”Z…Æä»Lks6ÛæPpvÜÔcïîŒáä°MTcIQèÎ æ–?Ö£uÖH0:.27«ÓsBðP1ß„s·€éÌOähÁ<„\T.Y9Š½'„wGþ­x$;ÖæÀকp?óŸÍAÂeÙ¤L¿bÕGç0j ÌïC±«8ž³y €1딲ģr¥Ý&\eâ¹;p5'Y‡Æ ")g`çás-G Aê´«™®ªƒ³u¬6[èƒDNW]í·Õü¹0˜¤F^\Xp û +¨HÂ4ɽ…9¾+â)kÌ9•ìÅÇ”÷¸i5K6@;‡àdÔ @(,b+c›ùùŠcv›Ýn FGÂè·"žæŽpîšúÚj¼vî-ü|–o: uœ½À· é߉ÜIkm(&©xä¸}KV&S—iœ->+K0™G +qR¥…„á÷SohcÇ @ž¦¹Ü˜@¼:œÃ2ÑH­¥Å”쀶W¸x…ûVÂÇÆdÒ®]ØÜŒZÑu䋦:Ìr?© Ü­»óüŒ àFñ?'¤ ü$\ôL„Ž•2Î32z™ÁY1cd®{êÁœõëq²ÐrϤÀ50Nu¢b³“œâyÞ‚àQš…"æ•`hÚæ0çŒ;wiJj)ì'ñk;†wÍB•iúM•»Ã²\±qFx<›‚¨`?(iÁ—ƒ§¥°Ÿ„´,ØãðO#4ò‹QÈ£LJ¡,ä"”¥ç¯8™ hpYˆ(øu×NéZÉJŸK!-Ò8:eð—Йë[áç–»„÷‘!¦‚ÍQ~eN›œ!+ ©BkïØÁ2xÞÝÙkFØò²NEtW=BÌr—÷$IÐý$ëlR°»~Åô[× Œ7+þßOŽÕ(營\¨E«Ýwä`õ>Ÿ1ÝM57cò½øÑÁ9ʧ~’x§Hǧr,‡s—û‚»¥ð5wAèÌ1+yßkùÐøCnùÞ06 ¿76ËÏaÔqÞ»P +"zý‚wá ×j‰´Zý½Æû.`&©õà—… ÑE’gAÒÂX•eî‘$~Õ©¦Òsjyär@.ž§­8…Sq02ƒq ±ÍõF7I™Ë= Þ†,ì=—ð™—=vGwbˆcŒGh4\_ÕYw%3ÎU]T觔(–”<%€¡:Ayjòõx¸£ZŠ7Ó¶±Î#e¨nªÃõ A ë´ÛT¼S²ëú•¥,’|9>Y®ýÚÜÙê=e°KT9 ›P.pCÃúhÕ][ï±rG~-Q•:øÚW6’£²“â`;åŒ~@ÇtûdŒG3Ö?œÕÉLÏ\—éz,ºTX˜çÖZ @=Ó ÚæhßF@§È]ï˜3ÉxÕܳµ¶Šo +[¦…=k/ñ’ç§Ù°(\ªÜ÷X +Ž8ƒ©Þt¨¢ðÛ£u”CÇúpåkdM{™xlX¡Ñ‰6Ðv#óy%xkõûZ¨‚€L\JZü¡^aÕd›H_¨, ~wgÕ7ÃüßqŸ=TpQ»¾ùJ& tv‹ä &”@+Þº£H<Ø[” Có•äœ*x™òÖž¸—Šû¬FºS™ãÁã—Õ}ÐvåGX]í»ÊÔÚi”l`6ŸÁ»Ï™‚ÔÞ ¡e¾jî„}ù¬Ô7¼buJOC°wOY­}%³_嬉±w¿+¼vqÜ:ÙŽ’»©Úÿ‘IÍQDã(ìXÖÙ %É'éÀÑ`×뾟ÒÑ4Cç=¯ñVcUJp…›”IåñÁyÍ‚)7ª0?¢dÍ©à§Þ9_QVÖ&έ„®Øw6u—¯ yòø ׬vþk¦ÄØQLÛÛº)xkœÃË|aî8ìÀ³®Ÿ—SST¡Üë­¹þüXSl«åbìèNÈ5ИT Ýøg§¾é>äP4*è) çþ¦¬Qן/¨™Ù;ÅÙ`躾ÑpF¡gqžÇ:ÒSÒ-RÓôÆP1Îð`Š-øe ߌ#-6GL QëŒYOþÕÚ[Hyt±@ƒ Î½þ``.÷l›(ãæBl—qëâsÎÜxæšrö5œøQå”ÉÓ+ÃY WßÂsNuœ¡N_pª¤óNµArêäÿâT_$É8Õs’fNu:öH2™YßíÈ@97öõ_Fù`:ÏDÚ˜aKC‡œÉUPÿÊì:qAq]ÿÄ^ÖÌ¾í § ö1]–z¾óŽ—žªrÅËR!è×…YÄýzÝŠßãÄy³i»ã°,`ºiÉ[Oâ™Ì“ÆúìkcÑfÑsÒdJ²ÿ3'nö¾÷œ„ê8Té ÉIé‚„ +•$É›-õpÐ"¥&˵šØ*ñÑú%‚gAÐ"±\º½eÁª…C¤ LTßòåžœhó®ÚQûÚ<•›ÔÜ€;è˜ä/ô„tá  ÷õ¦¢㎃Ëÿ6À,n~™*ÁYPµÌÇ¥GÕßÈ"7'z&TÑË\+7Á„Ÿ+vÞ°±k»aoy‡`6„ ãßÚ—œ1¿vÃßÙªÕ¸¿Jû擼ݻG'i}.øšÞ©ëÀ¦œåu?V6eÝûz¬švB­8E°™^Ñ|wp‹#åÓ=ûõ¶ˆ•iÇßO½Tt‘¡³¥ÒWüÆ÷ØÉúüä^Ù|îölÑfzU&ÅRùÛÜ>¸‘•ÿ' bf3^ ç¹c…)oÓ®›ô«3ff…12G¡¼ì¥]íîqäƤsïlàÓ)!/½}罌K +ÅdžE¨¾nÉöüòØ  â|F¡ÖC; ¿_¼ Á²Ø!ÌŽ‚ÿ’Gp­~x¤´FR:s¹6>ØóØÏ°qöðÐs˜‡fŠ\L‰ÔðD4è2OÁxÍÑÉZ»]õ–ÏÉ”jµ•Rû¬öŽÍß/^²x´^˜‰ìç\&ÿ­è<#ë¸Ô瞨4ÔügKs¥ÿX:þ£?i²¯6t–E²®XÓ$!Å*ÄÐË•Ì)6û´$ùL×4endstream +endobj +4692 0 obj << +/Type /Page +/Contents 4693 0 R +/Resources 4691 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4662 0 R +>> endobj +4694 0 obj << +/D [4692 0 R /XYZ 85.039 786.531 null] +>> endobj +882 0 obj << +/D [4692 0 R /XYZ 85.039 548.572 null] +>> endobj +4695 0 obj << +/D [4692 0 R /XYZ 85.039 527.376 null] +>> endobj +4691 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4698 0 obj << +/Length 3939 +/Filter /FlateDecode +>> +stream +xÚ¥ÙnãFòÝ_aø‰,…÷ñ˜Ìd½;Èdg ä!ÉCK¤$Â<’²göë·®>(QI€…a‘Ý]Ý]]wU3¸÷á/¸Ï“÷Yžn’(¸ßµwþýF~¼ b- kæÏwß}HãûÀß~qÿ¼7ëþ&)ÒûçòWïÝ?¿ÿùùýçÕ:Š"/ˆ7«u–åÞ‡Uà=­Ö÷ñ=Ž„Þ÷?ý€/±÷ù= ½Ã¡OðòYz?~z÷履~\ýþü¯»÷Ï+ï Š§?î~ýÝ¿/ÿÝù›¨ÈïßàÝßEqßÞÅI´IâHÚÍÝ—»ÿ˜µx,¾çYK$H¢|“äÑ R‡AmÂ0¸Ï’d“ÆáÓé´J¯¦3ªÃÓÕð2NõnµŽSßûHÃø³{©»žó»Aâ. ¯a&¸`=¼8ñÔn:«–j¾aGì©ŽŸu{úÓjf^50l`ª­¸±ïœŽÐ­—ÛWj:ÐQ!ŠÄ«Ì{>Êœ GÎ"w¿Â`$@•ÉVV[Þçvz‘ßü †÷ † +8➟f×°½½†Un0T ÃÃ@jj Ô­ÂÜCÀ5¶Æºð’f+gŽÚ­Ú Ñ9`ß#ŽH&˜!8~=4rf¼ k5CK[’Û² ®ÒOµœ‘7ê¾#ù3Úð +;Dþ¨ºš·€…A¾ó˜Ù/oC=á ȵáTŠß¶Š&¿pkêñ™!?ønh>!àþôà >ª’gÑ–S|T™U\^€áI! Gð¦në‰DmàÞõÁú‹7rÏ„;Š#‡¶€~M'ƒ^$->'Ú $ÑÈÊs­¶5=é,ߥǙ!õ`Ža3Ðuly1¢@ oÙŸG@E¡5¯¹Oý[œX©÷Ä ø7?ñÆï˜@(éIŠâ®XVP³Bõô}>‚Ž,X0ýÕ £ºR3eÞ6ˆ‘–jêoêŠ5˜˜Æ©÷´×“…!EËÕBˆ³eÙZö + T#D¿f6žý¬Œ/ªA• IeãàHgLÒY·ÚÜi™îÏlHð‘"ûªÓ¼Î#Vsl‘)E'YÈ©QcßÌÚúh MÐ(ó–ZëQcW +î ¾¦ÃŸ[:ôXBu|íªƒši´¡åÄ°»k²Úe1u"-7K½Á®Y39š¸¡Ð0->ö÷òTeK'©Y/Q²Õ¤ÇcnØb“ŽOòìPF@Iea£·c¬;'3ÈŽáúd£!¯‰ºÕàaý‚EÅÏ %¬Ä^ÕöÝaœxˆ$€å²>9SóŽ )ÖÞ,}|Ô?9IÓpÇ–Ô½â†Ëp2”ÐG!“¡ÉóˆþðTÎ\²SÚ7¨W6ã©Ã ¯52æzg¦ÎÈdðEuã›k°¯ÖŽÉgϪG¾÷Cµ«Km ø#ûM=?wÖV¼@?0]?Ý)‰„Jö¾DŒc³ œµ¸ŽbEªÑœEi‚¬AÕF–¥©÷àø +ŽjŽŠpìÂqàx„ØŽ¨‚ìʲ–§0>v1J¶R2ÖÀ±ß…Ç",Š£Œ(Î\*'C€iy^Á"?SIY'àùðé§~c–àÛ¢ÈèXF4 Î =ök»¯eeTtPÛÆÎeRÃ^Ö¥"ÀT3Œ‡¥@…p‡XýáÓŒÒ؆ þÐe;5Ò¥©c¬}$F#r 59ŠŽ„‹×ydÀsG.·×/Jβ‰!ýû3Ó‹µbíxwZu7ÕÖÞ4´ŸpÚ‰fQ(4ãXs ù‘5ø"ÀqùÆ}e¾³ûm6LÒ`#‚°wü¶Õ®Þ¿P`În.`ËŠ¡ ÉúÐË®ïÄà D.ec5A*o`¢Èž½. }BL“𓜠v¡K@”Ü4Η88p62‰¸aYN‚EiãTyØ? \½—u¶OØePUÍnKŽøÊ ë˜SbcØš¡'ÅÍvA61r¹QĹ ¼Þ³Ž*`ö¾o@d0Þ³ +D³Km[ƒ%¸)3ˆWº‘ŽUsœ$€µÁí°d™ V0dý_’9V>èŸå•¬Dßµr4zÓfÔ¬!“nå(ºÊ”j­è­Â®oÜ0|!€#‡ê®‚j·¹Q2ïpž‹›Šü ѹdš#-óRíæót >^{¨e Ų™‡#“‹£x8Q­{F[‘jà0¼;'kÃj³wóx–ò’ߨ67u÷iÂAÎ!zZHÎÉ}ŠC¿5±‘—†]›Š§¡Ÿœ§o@˜ó8÷Þ3o†o²c{j4ž­ã¬$#DŒÂã4»¦:É˵¸~¼NÃ`‚†ãÉÃЫ^W ¸îæ,þ< ØŸ‡Ì'hNƒ2¥gIÃQ‘À ¹6OÀpÒÉM(„A•#›å lØ“£ LÆ2´t:&:¯¯­Î–BOÉBŠAq[â}v]sMO“íú˜³á€HÆDˆ‘/ÑŒim±Ç$e4oÇÑÁh…“©‚Ãñ3X~&4© ¤C x¥èvëXÄwŽVÒ!Þ«9CÀ%—‚§#yùP“É ÓË´¤adª3¡ ïƒ!À%–œ†ÒÁãm–ÄÁ*Ö+ +DçE̺dgõJ™Ýž,ÈÍ/œ»Ê!~F@µã2À’qžzÊ`«¸ˆ=Všµ6äòp\+>YÔ#AQsy!ØÅ2,;Vë)ØåÛZøOf•Ì—$­8ŠÆJÕ×Z‚L‰»~ÐÚyìõ9¥ô¶AEÊGdƒ±zç©ð :bªwä^¡c„d´%yÊÙ¡’%ây̳ÒÅ5šóFå!Y ©¹ÌEµhWÝE¤ˆÝ!Ú=6ƒ-ëÓõID@£èfUpÉ%6¬\˜Å:ê¸ôd}#„èÒè*"‰8qÿ±q0¬wõLJ™‰,L½0m7M€ê¬$–„ÉYU æJÐwë›.Š}6—8°Áà(6™Vœ%¦Ðƒý#Â)œÍӄˬ+ŸC®ÌVzhŠNY±1ŸÅÀäE³x&1Œ*?µïYÈ‹Lá™IK¦Y>¹¦*βyé)†|¬?Í,vbL%Ø8.ÜxGŒ|à˜1d¯¦þæHWé!ÿ¢H‘·Š×@3j²¨‘ûú¿é¤›Å)‰mÒ’Dœïp­ÆH/¡Ÿó•$b³/ +³NÀ7¼ƒöþ,J 3 ñ˜×ôµèà C\̪ Œ]¤ 8Nê’è¨7¹PŠÄ©-ÑȈ0+øz"ãbFønï ãN“š@ŸØJ‰Ý2 .5å¾KgD&J«ÝPáQWƒÊëÿ’ŸÉmvâüÖ·Ñ„¨´ +²8—C1úUÉؼÔãhØ™¤db;G‰¨©AÙwdÊ/ þ´½ŽWÈ•µÇ!s%ç]tG¨Œ>GÝK‹wŒ§Ù"øxd­Ë®a€Š uïNÌ#<žÈMeïÊ_yUºßd ÉpýE6H°O‘“>F{K~—ÃtcÍ ‰rŠÜ›b9õÀXª– ¦ßøT<0Ó¤K£,Ò£ ›Ì­ãx•ÔøÕÞÛNý•œ+^¿q?»‘ýG­#ZpИ‰Æ™râDÃ!†ŠH¡Øǹ‚"ù.'Ú—ùéuÖH]·¼HY+c¬ÉY‰¦ðû—Ù×™ýf#ÊB;y9Vb_É&m ²Ã¨«(¹o?ðÉ‚å¼™‡àÔ“@Õ 17 'œáÓ…,Õ…S× Äú’ÕqØ7#äÜX¼ã"çÑÒ¥B÷o­¿0\à–š#vŒ³ø0íĤüi6ÿò%ºkçcÕK Þ)^ñDïMÄ-|.ï“ñxá+ E`Ù'*j‘c–¸8Gáå¶ÅèÒG9ALŸ4n¥–÷jîN +ß~gVÜ{ª ù¹:•cê׬´çáZÓÒQí§]N1@ +xÁ/YeáþÌâÑ…£?O#“ÜI +É%Z¢×KÉ:³ˆÂ¿õ¡N±’Ь§º­»‰M€»æ_d‰Ôðt/×ÃtýåÜR›«1c’È ‰—)9°E‡"qº¾¯¾‚Á4>Þx"çÓ"\¼nõÚþzÔrdî¥o;$A̪¹Ôµ\k +î”’27.2ŠyQ¬y]N­ø|g¬Ë6´ì49ÖÇàãÜá`ÓšuhÌ 6·ªˆ\‚‹nÝ=âÐÂÝ#cï©´BÄ¡äèXxÂð¹= Õqžw§ªq’º`4+ÁeNzˆ€eßé +c,:ˆ0¼ÑR9 /¡„±V\nx/‘1]x/‹…£¾Å©0‹ŸÝÜTõÍo¦£dó'Ó—ß9Ã?ŸåÿúœÚ|0ç›"Í·Ò³š“0Ü„A‰DÑ%Æú»ëk”ÿôm­¢endstream +endobj +4697 0 obj << +/Type /Page +/Contents 4698 0 R +/Resources 4696 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4700 0 R +>> endobj +4699 0 obj << +/D [4697 0 R /XYZ 85.039 786.531 null] +>> endobj +4696 0 obj << +/Font << /F64 3112 0 R /F66 3242 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1666 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 351.42 512.306 360.443] -/Subtype /Link -/A << /S /GoTo /D (section.2.5) >> +4703 0 obj << +/Length 3279 +/Filter /FlateDecode +>> +stream +xÚ­Ù’Û6ò}¾BTÕˆá}<:Žc;O*I ’#±†"'$åñäëÓ@P"µ[µ[©X Ðh4úîÆøþó7Yìza¾I³ÄCSœî¼ÍV¾½ób' ; æ뇻¯Þ'ÑÆ÷ÜÜË7Oî¹qžlÊß·ß½ùùáÝ/Û]†Ž¹Û]šfÎû­ï|¿ÝùÎïp%pÞ|ø‘óË;Xz‹Kað‹Ìþøñí¿¾ÿðíöχîÞ=ª,ºý0DšþºûýOoSý?Üyn˜g›{®Ÿç›Ó]‡n…òÝÜ}ºû·ÁÅkцw-±@CìüÜ̓ø6›’ÄM¼Ä°)ð,6ù~à†~°IãØM¢”ø¬ \¸±ïúÀ£8Êw_Š&ÎÈ‹õç +¿_#Iê¼)Šjª’¿>Õ6ôa«aMHܦ{‚!ºýx‰î ãèþø 4=owAæt= Çs‹´HÉXð +á6MG0Å6H'„h¼€0O¸©Fþªþðü.T2bÁpT¼þ‚³G˜­pÐâdæÔ£ü +JÚÚ!I€-j5tÉPcÇPÃQõzI6ŽˆY )ª—3+Éy‡ü¶í|àUL\ e¾#BŠ‚ÈQE!AÄúä(=‚¿òX1ð,i*Ÿ™)°µ¿‡™(Aæ^lŒø^ý¡·óY²oAÔð1’X]¡5ú±óõÄe5,ÐG6¦ý¹²¯åtÿÏÛ8qTsF6…@ì#þÆN÷ß(À/+ 1Àx¬,ȔŪ*4×kÑ„ÄÇà…"œG<‹qNÄ•$`uϳªÆ +ÝHOÕ«±îZžÓ +q}ùš¶ŽZz¼éo>콄úPÈ.üX#+ pª˜LÅì9ñìKÝ4²OµLðSñz©OÄ»+DðºÍ"Ç%Åjm:¿ëNˆÀ œùÑÓÞbìúÚÖ}Ïu8-|Ÿ:ƒt¤‡Ÿ‘Üî,ÛÅuznføæ¸ç]Xl?á¶Ïy&3Ä#LwýIµ…,î§EcËhØÈlºönáÞ,ðpIk­í“6F–6fΓ¨"Ê åÁžuƒ?h³z4’xåiãMTƒˆÿ&á•îŠcN" (7ýò²N’0s#š‡“@ÂÉOç†.ù¬5¦ÚÙ1$q>‘t8Ž Ç¸ÒITÁñûšv­E—$LÜ0½ÐR´S’I4“(ySŒ=Œ®–\'ÊŒ<í̲'çUø´72§˜ËG%çuÏ3q ‹’$Üå½Þ,ÇPh%O®Dßn麶DI«ê^[ÆÉæâ7sÉZRxK™èŒ’AúJ‹Ï„:ïŠtžÜOÎéi@âýHTÄËä€|ʇÀo˜ Û5VmñÊÆ£×ÍRZЖ·ß98Õ¦®øÖO¼ e +Ó6üb‡Ïc½7Èó«8>G%ðÿ‚Ôc£5GœKR½±ÓJÖ(½ñXñ`5ô E‡ü¢¹¾®±\"k¡ÞÒçÕ@^/B“[ê-{<²]öx8ks Æ±" Ô "BÖÐâ,•9þÑ~Ç$U:HŽî(¤ÛIšl>bŽšÄÌH<ϸ­vw•ÅËÕ|ƒtÝŸDa†VÑÓÑžin9ˆ ÖdPÑ’×H±qPM :'ˆgÕèLöÚꮇǷ‚†?µ«|¤üa2tæê‚Fì…cSµœã=­%Q!~oÅO f= ˆ2ÏMò‹, ”,à׶þrÚ?¼ÿă·”®Tí(E&O¼ Uk¾¯Éï­årüÍkõ, J<×ËYW~ÍC ².ç ~ø,a|À¦Â'sIPOG{Øm‡ üfÍ—Šò oçQ°óô OÁØÐõ¯¼@»ÄAÀbƒp¬®bÇH-¤÷<‘Æ39dËÏÊdü^4³rü¦©FqR{6“­@ÝêY"Ïp0 a…]”6Ú-yxu!b@ÆÛWê‰áŒüu6#4!1}wºé!©ªúÉQý)Ãá3˜æoDXÙ!ØËÀsk5^`WêðAcÙ#è,ILÊÄdb.º®p¦kH“ŒÎà—%ȦÔ1¸ò¬×< ò!H}g¼,€|‰z¯¿ôõ(CŠh)¥ªøi¥3Œ/딪à”UU-¯Ùq-˜Á€âW+ž—ìg3vÿ‚qR¼{äKè¼¹R⸄[¹ì›J+Éún$¶ ï X"ñcÝ…â}ºì£èJ"¸UD“î¹Ê®©õ±M¿GÅO3[85NóÉdÒy>Xò)õFæ +²Öôš`õ7²ó+¶!.+ÍAƒÎ­d 6Vàd¨@qcë[jô-}Kµ¾ÁÀN…ïW«ÝqÖCöâ¾¾]­:2W5ð”¿Pú´ÃÂÄw#?ºéü-˜õb¹›%A,’ ö©¡àõ‚ñ(Ãð•Ì~mûª©MEñMÒ=ÚN¨Ãú§­¨éÒM¢Ô âìöM&˜õ8ÎÁ s_| +K4y¬+^éëá‰GåYV´Ñª„µîJàmÕ¨5Áw—»Lõ5)”7õn±oHY ¶+EYV­'–ßéÃ82ÏíEÚ|>U=¿xÂŒ~g—OjB€ãê·Ü–‚«žxæò‰XÞËéiÄ÷œŸUرM1>Û.X&××*ÕHI ;ø”.xŒÃKé«â¡~ÁJV¬Ÿ€–MݳL ü…3ÀcÅôP»kJL ÿÊpúቮÂõœÌ¥³…`­Zˆ'éoH;,ñ¤NÇ6ëäe`²#Ö$ú©&Án!\‡¸¼§w3š´ˆHQBAb=^!»¹zO|ë­Î§7†½´ŸÌ¤¢z»© ý—p|½Ð)%môŸ ‡3l@ï¸IâÍ=Ž ÷ʲL\ü‰YÒµ(9P!ÚT7S5œåÎsÏÌ.Ï:å Àí댸zÙ35Ùô‡,\¼¢eüpöŠ½¼0%þ¦¡©[v+Å{ìFá¢Ó†ÿ™¤ÿéOŬF¶›gÁ²ƒÀ |C 9þ0º¤837ÎÂ’ÿ¤ÃPendstream +endobj +4702 0 obj << +/Type /Page +/Contents 4703 0 R +/Resources 4701 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4700 0 R >> endobj -1667 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 337.871 512.306 346.894] -/Subtype /Link -/A << /S /GoTo /D (section.2.6) >> +4704 0 obj << +/D [4702 0 R /XYZ 85.039 786.531 null] >> endobj -1668 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [497.163 299.378 512.306 309.672] -/Subtype /Link -/A << /S /GoTo /D (part.2) >> +886 0 obj << +/D [4702 0 R /XYZ 85.039 766.606 null] >> endobj -1669 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 274.919 512.306 284.488] -/Subtype /Link -/A << /S /GoTo /D (chapter.3) >> +4705 0 obj << +/D [4702 0 R /XYZ 85.039 746.481 null] >> endobj -1670 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 261.37 512.306 270.393] -/Subtype /Link -/A << /S /GoTo /D (section.3.1) >> +890 0 obj << +/D [4702 0 R /XYZ 85.039 649.92 null] >> endobj -1671 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 247.821 512.306 256.844] -/Subtype /Link -/A << /S /GoTo /D (section.3.2) >> +4706 0 obj << +/D [4702 0 R /XYZ 85.039 629.326 null] >> endobj -1672 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 234.272 512.306 243.295] -/Subtype /Link -/A << /S /GoTo /D (section.3.3) >> +894 0 obj << +/D [4702 0 R /XYZ 85.039 494.239 null] >> endobj -1673 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 220.723 512.306 229.745] -/Subtype /Link -/A << /S /GoTo /D (subsection.3.3.1) >> +4707 0 obj << +/D [4702 0 R /XYZ 85.039 473.644 null] >> endobj -1674 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 196.264 512.306 205.833] -/Subtype /Link -/A << /S /GoTo /D (chapter.4) >> +898 0 obj << +/D [4702 0 R /XYZ 85.039 361.414 null] >> endobj -1675 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 182.715 512.306 191.738] -/Subtype /Link -/A << /S /GoTo /D (section.4.1) >> +4708 0 obj << +/D [4702 0 R /XYZ 85.039 340.213 null] >> endobj -1676 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 169.166 512.306 178.189] -/Subtype /Link -/A << /S /GoTo /D (subsection.4.1.1) >> +902 0 obj << +/D [4702 0 R /XYZ 85.039 176.513 null] >> endobj -1677 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 155.617 512.306 164.64] -/Subtype /Link -/A << /S /GoTo /D (subsection.4.1.2) >> +4709 0 obj << +/D [4702 0 R /XYZ 85.039 158.039 null] >> endobj -1678 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 142.068 512.306 151.09] -/Subtype /Link -/A << /S /GoTo /D (subsection.4.1.3) >> +4701 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1679 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 114.969 512.306 123.992] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.4.1.3.1) >> +4712 0 obj << +/Length 3601 +/Filter /FlateDecode +>> +stream +xÚ¥]sÛ6òÝ¿BÓ'j&bI‚Ÿ}sl'v/±}±r™›¶´DK­¢J—ŒY°úEÈjÙ¢br¥fc6rŽ«ªÍIÁJ%B›4k…ÝóÝ XÂM˳$2¢o·ä'¶5yj¢â;¼/LgE¾ÉKC¼]Ë€}h®¹2צîðol=ÕÕF³ÄŽ£[™r‡~(Q›6ÏÚ+71X¹!ÉClÀø@eÃâ­á£ÛîGµ5 þyf vª›¾fÛG³8${Î9Ò<ÒM‘`„s\¤[Õ-ú¡2×^©ÅÃGŒÁÆcghÈÃ$+ÜÌH +°f Ñ>’WI`Gž2¯èáO‚rI»ô'’ôç=iûuŠ‘Šô.ÝiüûN× ™úÚ ‰ÔÇø–íNòÝáχ‚PÙ‘ãßé푳ó‡bGn’BÙpóëÕ'”(;T!ìL1zóh/ªò‰ñú‰«Xð¶)^”£SKöôÁnb‹2ùŒgMÀbôXljCD·¾ÒÌò…[—.:w0s}eû‘? W½Hl¬+P”°Â4(q_ß»40eüL›\TéJ¡2ä'§ž›"ìZû×êî&Lö•@Ü.,]f:®o\Ü’gÍå z7!ˆÍGlNiï2½L1 +Ö9ßT¸6³Txƒ¡Ç‰ß¸­ˆ¡9nòœ£ÈEvñ¯¸ +ttÐDc•¡r}'é)—|‰ï…|’8Ç®<ÚJ@”Ì•Rù}r:3òRÑ(j2¡DþFœÐtR°³8ê²égƦ##¨„=6Ã\ ¦-îÆ]¬Eñ\ÉÛø¬…‡üI–kk‚e½óOÄÖ…ó²’ÝáÇ0Ê[N<Oš²§žÝ€—"ûÆRÆõõéû‰$G¾Ž?Ö§3ÙLçÃÓè.‚ÛE`Êb_ñŸª~f¹jteQ¡Î_HÉ6ü%[3VA¡½ã{F'‡Øc'ðÞÉÁ×B²¿C…ôR¹µÑ#f‹Í˜Ýµëj75ßìjühïjÃÌÞÙ„ÏÀÃh߀³LÇœ€®vbe͵ªIe>æsB’EêöæiN£ºËdìVl;Qk.ÚÆ+Äw +FAbKYÕ)§§”êv‰uÒ;ñd/ߙÊ+)N­zEÌ&Á+kY´šrÅX\³SdŠ›Œgøt?æœpÁÐ"À#»ÙLµ(¶zþâœ6®ò¥$ZZH0ÐZ@tZ3ÊãàN¸‚Hª. +.©Á9þ¶ÜuPöUlGa2Ý5ά‡Äá½ß¼r½Ø£ÐPBÀª¢ƒ•o»êô†Œr¸ß P‰ÄÁ`¿½šè91øʇÉÚaj»Èü­ÌÂ|·¦þÒ«“Ë´¢JœŽÇ>ªw/°=ï µœZgœ·”~b7­ó½ÍFUÞmö0ð  ‚JT½+É ׋ÎpËL{d énŽjÆuA2÷ ÕtH't#Ho)çÔ†Z;ûûª§·ßùDò$oKzÉÅgpÁIÚAÁ$pÅz¼’ä¥ œãé¹J õŽOwU{8ÇË +{vìwUc)+Ή‡ôÓK®0…w1”™öêŽ1oã +Ì¥–¸Óp™h(2”‹gŽ€Ú=â§T–¤ÌÓµgUìØ‘zCÞçx9¢BÏöBo¿ñ}Ïâj›tT’`°ú'Šxƒ*ÒtCaק(^Áªá=¹ÄÀwpôÝâ¹L¦–Pèw©0»jìøÔ†éú-ÿH;ꔄŽNº‘Ýj×0lKeE?PS_*“iŠ-©rŽe?‰ô¬{™s.U­j¹ŽCI˜)¯ébw"-OÜ +û+s«$H†Mä‘$3ãx­³;ÝÜ cÏš›¼£fÂ{U¡–º‘ÙZõ7—²hÅ'Ë’cMázV·imøk©%§;±„F¢á ßl‹A#C_œ”Þ‡N!„*<`6+g‡ÅÅ‘²·éuQîœÝO±¦žô’!Äëó@w‚{˜í!t[W\±‘òìªÀ¨7Þ/¹…Ÿ.Aü ŽEý/IyFJëÓ¼•žotGahÌ81BW¬nIsݾ!éMáÜædÂƇiìSŒó@Óûy^¯^=ÑCJÂwµóú®68 ÕA÷ÎÒ=ÐE„£d5&Öh¸O;°b\·MÙYö¶÷°ï#*C”š&¿£Èë.– —Ü”8µÛuäö2P××¥KÛšôÊ¥‹NÑ`¥™è”P¨aÓáüªhXuÙ£°oüH ‚À­°.{á7 +Wº ½€`ý·©ëº©¸„Aè:+¶²[ö£åW!G«²Š’Sîg;«\ +ä—Ë;xÖíÝœ!×ç·¯8¿¾y`è=ZÒù—óÏøbËO¼ýzû ¿ýßw_ïúõ9 ø/ é…ŠŸ|Ï/ñÃç‡`„~½½Dø—‡ùÝ€æײâá\ž¿PK¹ÃÞ6¾ó§y@¾¼²‘Åk4`Ožsp«“vƒc1çÅ´Ô¶C=_GO·C{8Çó²®À öò–Dò–Ï967¶MH>.jóŒ_×ùjÍùÇùKŠf[¤Úy+ifŒñî$¶Šßà½Ã9žƒ¸ €8a¤ÖGó“MÞÇT¸5¿u¯qQÌ/#Ä{„ͪV1²çµÓòÂDÄ~ó½]JóƒYv—«z@‰aH +Ú¬Ô»Ó ¿MTŒÜ±‹ªsÙô”>‡xÏW½¶ÙVV6¹Ž¯ˆ·0¯YXhõª,q}øz] .ÆY}Eû±Q7¡p;tNˆkz…æ‘RSᤌèMñu‰Ùnzü.*ݯy•¬Ê2[´ùK§Ì0¦æ[Ÿ´ÁQ¬"ãñðÕÏ'2xOôZTôºÚ-öø¤àt1òcÚYÖõãשÑdŠ[‰‰¯]µÓO辶B¥ö9!Ž l$„íÿ¢@Eî°S9#J¬y¢×£æ§a½¾¤TÿÃ(šuÞ<óˆŸ[’ƒ'[ZoòÞ¬®Qî­ÌÑ[‚t g‡¡ª÷³,¡|~»LÛ'þ)„r‚Ak‘ûÎ¥d ðsÁZf½tŸT•ÕÚNzï%¦òWÞ\Ù"8­Y÷ûº€2¿¸çA[§æF™N>Ou×îıçR¹Öù=~ðâ®MíÅñ^ˆ(’| FÞ»òh„õŽòãâ¶&Lúy ..œ2¸×ÅÙý‡L„=qØ8¼Š89ã?)ÿ)³×>~.0|S6ƒuÚ‰v±r’75¦B~Bvä þ’¯¬…†¤@4þFM‡¥.x_uËÝÙë­âCÇÀ–‰®¹™ä#–¡o!±Á¯3A\?\;Þ"üVg<‘gÙðLR†³»P þìB¹#*•è7C/â_P4Bbï6³¦`sù¥þ4æÇ^!›;&íÉ‘ŸuoøˆÌ c-ódº—cvlj˜™8Ë– ȳGÓJI”>öšŒbžêaºÎ¾ï(+ýMf FVKyz,‰Síó÷ó øŸü¿~\h²)?¶“øHw2ð<Ûs 3”ª`Ÿã@Åv«–ÿ ÓAçendstream +endobj +4711 0 obj << +/Type /Page +/Contents 4712 0 R +/Resources 4710 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4700 0 R >> endobj -1680 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 101.42 512.306 110.443] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.4.1.3.2) >> +4713 0 obj << +/D [4711 0 R /XYZ 85.039 786.531 null] >> endobj -1681 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 87.871 512.306 96.894] -/Subtype /Link -/A << /S /GoTo /D (subsection.4.1.4) >> +906 0 obj << +/D [4711 0 R /XYZ 85.039 766.606 null] >> endobj -1682 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 60.772 512.306 69.795] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.4.1.4.1) >> +4714 0 obj << +/D [4711 0 R /XYZ 85.039 748.602 null] >> endobj -1647 0 obj << -/D [1645 0 R /XYZ 85.039 786.531 null] +910 0 obj << +/D [4711 0 R /XYZ 85.039 595.724 null] >> endobj -1648 0 obj << -/D [1645 0 R /XYZ 85.039 656.613 null] +4715 0 obj << +/D [4711 0 R /XYZ 85.039 577.25 null] >> endobj -1644 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R >> +914 0 obj << +/D [4711 0 R /XYZ 85.039 394.285 null] +>> endobj +4716 0 obj << +/D [4711 0 R /XYZ 85.039 373.69 null] +>> endobj +918 0 obj << +/D [4711 0 R /XYZ 85.039 225.054 null] +>> endobj +4717 0 obj << +/D [4711 0 R /XYZ 85.039 202.338 null] +>> endobj +4710 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1685 0 obj << -/Length 2278 +4720 0 obj << +/Length 3962 /Filter /FlateDecode >> stream -xÚí[ëoÛFÿ®¿B(T4÷Áׇ ¶Ò6iãóÕŒCÛ´HKæÙÂÓ†ÀŽÌ<)­Ãhu)ˆ<ߊ -øô¬(£ëý)à%i2 ÇZÓ‘Â/Íø)­¬ÓU4ÌZ_Ðò$_EiF‹Š§K¸Ë:_ªCËd½EI%4¡bD|ÜoP°ó¸¿EAÞ…‡¢ˆäžÍ}5à6ãò)…"«¯hÇlɃË9ÞU?ûŠvkÃÔÕàó M‘– °½´~O¢XÑ‚YsÅIn?¼ú€R´ žÏlŸ»wÿnbÀ@—…WáÅ5^»ÑlÄ}ëtpå_²X½–ÏžÝ_lîU¨ šR!:L‚ ‘éÈædRÊ…2°-Ñ - =†MNãÈ$)#Á­=¸#Z¥RH ÆâqíÈ‘ú i X'Q™úq -¬ê7 Åtk J°b—´óÝl†¤‡yãÜàöŽÆ´écŽ7ªn¿·L“Öæ27¸×ßWÙæ=u…s;êº>º_צ.ÓÔ§™óK¤&Eodàè’g4™ŸÜ ùçè ÖÁ¹&ø›ñÆH«…±á㟖jü†HJ<ß&>'âûÖ6¡5Mü¢¢:º»ÊÎ É Ï“K`Þ…&ð¦P7e·p½–k9ïo)å3ðúoKýÙM·²›hýV†uFà†/ ›¯*O¿_£_´åàz/Ó¢yp+ ÿ°@Õ€Æ/Ë5÷§Ùl -:ÖœÑôÿøÁ¬Ó§ž_i„‘>’‘4&€î?yyè‰ú¼A}_XóÄGuŠ9_Ætñæ¿£@‚¡Ä«h©t Q­Ï­EªÊä5„O©]³<˪䆶j?j3ßx©j01Þ( fÛê¯m¿÷Wtć6¯OƒkÊÔí5¸D]ÿ/Çãt·\\fýÓ~­?™´fë$ÖJ6–Cßxíì ‚ò4‰i~†ž¶ úzf(¤¦ÏS ÑÕi=e¤y2ù;-j¿° òâ+j#z^W}bÖò$ Oã«l{5å–Gmy4 -á³ërì˜û¶Ó•þêo¯¡Çš@§¸(JÒÝm5‚@0£L–ùœN\qŸ•‚7–àOÇuöõŽ³pW]3Í£1^°¢-Šµš­ü¼€;¢§†QÃÇ ‘9Õ™´¢zï"-hD »:–-uÒ’´v=õ -6@A³ÝWü 2H ã—ƒÉ ©AÓW’ƒOœ 4ií¨7Nð]e_°ÞŠ©d?LeÒãGM%È…æ>¢R õYI`:àSIqš5§0¹—‡î¬c}Ù2-´ñ½½UëÔþTîñ_¿ÅAç¨+Ö§EIÅ<Úi©ÍfCeƒ"7Es㺫ïóI;k–\étƒ«À'éÞ­™ã‰Ó"ªyäâ©qÃ|sOûæUÚ‚|]ö9NTúCÐÆ9ì8ײþ½óé=‹=?w¼‘ô*w¼•[T\?b•‘üäw+D|þO -G÷¬aƒ}È!r:%x~Ëçf¯pŸ°ïí>rÊÛ®@íF³Ó¸¦ŠÊgT@šÙ™4®Ú5%Hß‚VÐ)t¶Õgã^(bÚW®Ý[ùIƒvŠ–©6•wn¢nËŽ®˜.7A9kÕ¯”cß²$ ß*Òáó¡üMì3ÞØç_Èñ!ÒvDE5Ý0qS;¯:ÐE˜²¸Ž‡L1)nà43¦‚NŠü¡ôÉ.ý˜wE%QcUa…Üñd¯Î2âþ$Nâ·5>÷fôa&ª"«Iè4‚<!Qî±æzcR@-ÑJgha»]h1_>X!˜ì)<5êY«ôB_SéÒ)(]üDG¥†¨Q'"»ì(x Éö'/Ò rž^£PrJëäl™šà,2î.æ©M®´j9‹(?q·¬Â2Ñàq7øÎôQ؇‰¨Ë&•Fú°‡0ùMP&ØàG³ç&S.tCèÐ|wæ"ôŸŸ9–ö/éæ¤KêÍUƒ¸Ñ¹JVÇPã±î±/S:7ŒKcâk0«_ÅćI‰…-b;]ýÐfOkÛ¨ ÌÒœ¨s,|°®ñÞ-²_Æ—¶“”ÖÎ)81Ç®­œõHfÈWx2öëþK(Õ&Û­9Ý-*ÎÖ¹ýÀq_4=t°ùù¥…°¸ÇK OÒèæq¼Ç#ð3Õ·ÅçfšÍÄrؘ4;6LR•¾­0ÓZ*udç‹WãÔ/„n„ÍÊä–[Pcć©Ïí2”¯ðøxð™Jë~^x¡/¾ ^~ì„wv‚+ƒý©¤Aý«5Jéæ'k‰þc  Š6{®7Ó|Ý"Êl#Ó%lš‚ŸûŠ‡W?AÚ-/­ÌzZ´ÒºeYeg°Âü`Ð,7úW3U¹&׊ºKþ»…æ–ݾŠÿ€È–¡è”2Î쀊…Ù¡Š‚ßé-Çü…w†ß4Ç@ä¯Q6Ã.ÙFÏÈØ4äÙ¶âpí@úW*Ž­'ÛMÊÕwÙÕ‚»Ý?¼…¡78tÒ{wÿæ§Û÷?\ÿñøãÕÛGC•Cw Òôéê·?üÅèÿñÊ_ª<[jÏcݵ­Q$QÒŒ’&×T4k ùÂŽu_ÖÖÜI2´ÛóGÁ<Ó +V¸r s ó…¬ù³êÉ&5Žº‘ýLЖ¾Ü¢¥“5ŠqtL¡gØwG”È Z›»Êžx{ÑÛf§ê‚¢¡Ú•wÖÔxð¯·+BHëËu¦PÈcÀ»æЗ Kƒ¡#Já¤ÊÅ1#ù8oßÆK#ও“ÂÖ@„á…ÎÍKr¯ä\­´\ð\"b¢×zíZJ/Û‰þ²ôµ×¦}QÏ—â­$ˆ—„J_ŠŠ‘B–*J(F +Â¥ +ÂEœçK ›vŽ£è £Ü{(š…J©wç©ÐV)Rx°G8T´"d1¯É«!ä[4[?ÛýoÄEÂŒ¾«/ì¢U + ¿´#f&êÓ;J£%„¸¡{4:ò @¸XiqÜH86wçp|„²<Òô|$è Y(ŠùîGÛY‹ÝˆEðS|wmYŒGc>‘ù¾ïÝŽîê!»SåÆ@%BóÅY«œ1£óñŸ +r…ìˆHÁ¥Ñ*8ïv]nd°åßFÜ ƒnˆ‹¤G-¸hÚYN˜4aM=!‘é˼¡š£ »-s›²BÏ7Ç!™å¶X“YšY‰{·†£d¬úý<¸®¯‘œ¶3+98 +M áÈa}L9@lËk#›°‡ƒ7üHJ³!-²òt¾=×ÁGYª€Úlˆž½¡úÙ5p¢‚n4¸½æ~B↠½Á/GoÐ(øç@! ñc]ôlœ©¿ïHŒÆpŠºËº2V,Ê2—Çß—ç6—s…HAfÒj ß8ŽJ e¤R²%ËŒSÚKöU©Ý#v{áw v›ÿ6<Ôò'pD¨œƒE Šâ¡NVö›ˆèÐé˜SÄ5¯ ­ãS¹1ÜI*† %g*ÄÁ9ød0Ð؇FáfÙ–Ñ>fÚ%‰fç ws6 +q‚A–š€Xœ Û¾¹2H ÐZi|Q ›EA0•øÀŸ—rè¿ åI{ß³K/Žƒà¤uü\«„úzÑ,²7”=@p­¶çxfRµS|93:Ø€¹2Æm×¾â>sá µŠhv„«àN)1ÃöE[&º$ˆ /?+›sgq®Å;6†ü°Ö[ Ù-Y6 +R¡âÓj¸AÕÖÓ‘{t(”BëÚIKJàí +l‘Á)I%EõðAÎz²²ìÆÈ´:IôœÊ¶–©zj%N$¢jœÊÚTŒ`K ,¥.Ä_²ÚŠR[¦Ê˜$ì;7IŒUG‹4o¾ˆ€`Æ»’{¨¬pÑÚ|Ÿ !?MVu­+ÌBÅv­ØÕ…™6D…¸mDcçÙœUMsÖŒ)À~Ò;ÃbÎÕô„Z·Úº+6<Ïû’ÉÑÅ:R^¶io¸eø$ <•UÏ€Dx¿áªóØdzŒ@Uµô4\ÑŒÂ.Ç.í˜i‡8'•ß:¥R“° +¾ÑfOž)À,_r?î‚Ðg&6Z¯¹ÞatÙ)u©IÖϬùñÞă@‚{zøÍ‘ÙºtòÆG +F²³Ç¥#ÐÙ´ÜŠ‘dÁ9¼´lï9ÕÕΖƤ"0!^/SH¶É€Ý¹Õ2b˜†ó¾ H*ïqOB‰E¼¢å†MŒñ˱ޕ²Mµ®•ý– +PMÑ®eé]A¢"KT²ÂÐ52®«^ZnÂ\V Bº’^4—ÇÊFÐ¥9—MâŒ{ј¶FJ]FÛœÅÖšT⣙äHÈ!ÝžCjó  ë¸Û«B—ibwŽ`ÐuL)_[ŽIDŒ£Æ„z¢¯IÒÉÓT<ªÅÞó¾bƒ1ÑtQœ:j†c-«T²…™J’¦¥¤1•h3L¤$ ù9ŽÆ0Ö’n†aŒÅVJÖúI¥†"KMxõ +ÂÝt½ÌpÞ×d‘f?iïûšg, ¢æ;tÇ+ûiêÍ´ó<ÕO#XkzJùàƒ¤•¡ëˆßwŒÒÜ»â½Ä‰ðÜGû0¤{"߃è­êôC×R|˜cæR[ß9h²bÿoKó^fdýëkYmZl~™ÙõŠÞSQTæû*ùÁÌë•A®Ú"ðvô,Ì÷™cð»¡øf5¢Ôù©8´c_@†\ Äe)pmê8Z€ŽáE^ 4üml>~ØXÑti\¢êËï ¶˜ó¹Aü çÀÂë0òMÉK›W„çL3wkνՃH¿,¡T¯sœz1S'›Ãã¯O£/”÷Ø1üˆv¢À8{5 òuá;byÃ…5³.>@ ZZ“]ÆÊ<-;¿•g Ræ`¬N¶gÛÁ,÷‰ÇøÝ/º4 _‘„v¯õ‹5ʆûÒ”ì Ù@$¹yÛf9Û(1¢Wt÷ãyfÔ&)\5M×J_ê Øto§u\ÂN[öO¥|ËV·°™}3è$¼ï’Ý.|¾÷ ÛÍIñö³ïM ÿ|¼|oúj +IZ`½+ÊÈæìšcZXKVSy/ä;Ï3±[RŽI9´ð±Š~âÄc}Æ>ŸojðöCt˘o8‡†¨¬-‡S~á>K{B?ù !7+ŠO7o²]¼kuÞOíK¬{ã- ùjð•6îƯKO3ý<й—Éâ™> endobj -1690 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 754.651 512.306 763.674] -/Subtype /Link -/A << /S /GoTo /D (subsection.4.1.5) >> +4721 0 obj << +/D [4719 0 R /XYZ 85.039 786.531 null] >> endobj -1691 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 730.193 512.306 739.761] -/Subtype /Link -/A << /S /GoTo /D (chapter.5) >> +922 0 obj << +/D [4719 0 R /XYZ 85.039 615.144 null] >> endobj -1692 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 716.643 512.306 725.666] -/Subtype /Link -/A << /S /GoTo /D (section.5.1) >> +4722 0 obj << +/D [4719 0 R /XYZ 85.039 585.74 null] >> endobj -1693 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 703.094 512.306 712.117] -/Subtype /Link -/A << /S /GoTo /D (section.5.2) >> +4718 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1694 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 689.545 512.306 698.568] -/Subtype /Link -/A << /S /GoTo /D (section.5.3) >> +4725 0 obj << +/Length 2660 +/Filter /FlateDecode +>> +stream +xÚµÛrÛ¸õÝ_¡Ù—J‹!ÀûÎô!gëM·‰»i'Í%RG”¨%é(î×÷Ü@‚"åÝ™¶ã±âç~ÕÌ…?5‹Çõ’Y‡Nà©ÙzåÎòÓ•Œ¥ ,-œW÷W/Þ†þL¹Nâ&³ûM·Oâ:AÎî³/ó×~ù×û›‹¥çyså;‹eÅó· 5¿],Õüý Bôüå‡78ðçoôAw0ø(³ïï^¿»ýðÓâëýÏW7÷UÝÊó¦_¯¾|ugÐÿó•ëxI<;ÁØuT’ÌöW~à9ïÉ{yõéêoÝ^ óg¼jJ;Aìe KJ{ŽÖjú áå¡j›m^;a2ߤ붒q[ñs.–:¬u^|[è˜ß2^ƒp˜©7°¤ª÷éÉùÀjÃϹÊ/û=Ó5# è+ôüVp«#bV´ízgïÔÉl)ü/ +1!¦5¡æ·"ƒÍ}ÐãWãpŸ§tÄ#LÕéJ(@M[¬åÎ{óssÈ‘â–ç@`ô|ÂsªÇšßFv-NŸVﮀ eéžÄü°]hP‚EžŒW†|9!¯2â§Õí6'ÎÝÏÛ´iÊœm–ä ˜"Ó²ÀxúDÇËŽï¸w.Y¸RŽ +½ç=³Ç!«ÔUNd•J;žÒ³0IÏc×oô @‘’Ý9zÞ÷t$¼ ÈD?<Öi[Àû4…a9®z>vX8~c(Œb'òQx{0¢û±nª’m4rê곚)>ŠC.« •Œ@4R4-­\³Ðdj›†E~J÷¸É*å×Òvج8ˆf× $´uU6—†Êñ@5ÏŠ«Çé:—Ÿ8‰ŽÎJ*õ“ùcd x>‰FÐíÝ!âÌHbGç±~äÄnø<±=Î3ºÕh}šˆýç"Ñ>ŠÈÒCï,i"]Á°ó¥#¾œ ¼˜,µ˜˜·¤]ÐpÒZvÁYÍEsÙ y0af?¢x^¼õlÎÀý=×qcVÀžm–¶éWŠ *rT¬hµ† ¹ t0ÿ?Þ¦e3LÊü[^jÆyvÝ™´—¡£#o@Ø=²¥#¿F˜ÒDzÅioJ¾4Oñó©‹Å¸ŠŸïsN7%Úšätš0û=cÌ }àîDŠŒƒ<i‡|vÀI¿lóš¸k ¯|ZÄþüšé‘|eÆc™Ùöò˜4|âsVogs4ù´)dÅ© !1Õ ê[ŽuKo™<Þe>´ÑtöÙ +~ÿòæüf« ü¾yõöÅï³[¬;´Ö½¸ð…-@ƒý|· ä­³¨µql x¸èXWP(í7¼‰„À“rF”Ô<áGslçU*qöŒÑ¥‡?ÈŠBª¤„ÂXMs}Ñf¶±OÉ­— +H‹’ÒŽeçQ‰ƒÏ&݈†SJÖ¥¿®Þb#Æ£®¢­(ó¾´Ä…úù¨,>1‘I|(Žãàù*Á¹œö|xâYÚÓ¿•öÞGæ¥IïQxî|½»”ø|8Øsõóäö8—Ÿ—('Ö¬ÞwD˜ È@Hj ”$¢&Æ.©ÜЉÂè÷®(<0`ôrò¼¥v P¶üÂ5pq¤³U† Ꟃ`àKÚ çÿpûíÈblVÙÞðr?<¯šaöeëôHù¿(‹ÖØ5Â+~’凌ßR~|¦,QÇqjdŸ²èß©ÌО1yãë¼ÁªÎÓp¥øõ´ÍÖá & ˜ˆºúNÉNàœX(ÙÖal;sËcïUèHÇ2ÍÒ亻«‚”­'1o)±²Í3LǾ)ßœ¤Àžî¹#b¥CŸ—a®©…ú^Ï® úúz@Ì»¢ÆUŒû¾‹;8dL)#A¥ûè³#Åœ#3Bï&3  ä‡.Šu[UrwÛŒ÷‰-H£Š'›.gô‘ ß~ä~¯KŽ€JD¹•ö–Èb‘ ]a Ú@BBŸ5³Bcàa0ÐlˆþCj ¹¼Â™»qlÅ}2ÆBßj]ìV®°¡}2û +0‰9 ‡þbÐÏzBÇ<7"FÔ3Õk W}.t¥5ÔÑ4ašk7]¢–mR*ûâó\ÄÀjŠ ¼N\pLŒ „°åU´Û÷…’2¨êÌWèصÅN jŒRwÈNHÚ0RFΗNˆe]Õ5^c©?Æì­®KÅ‹¯z%øÊÄGœÝ 쎲NS,DLcÂ8>…´kÅÏ(qE‰Ï©šç-iúž9ç`HÍÇqÌDrJœ±š¼"À‘¢LÛÝZÅŠœ”N(zCL0VC&@ŽÂ‡ 'Wuw§²cyqÜ'÷ 4Ž'á¸ñäjéb_™×7jZe6××Úˆòï)r§âwmö‡ên“&ÊÝ_ð"€Ú "’”BV¬÷¡V+†^(…´AIñ›2 p^,…ðÄ8*2‰ŒÃP¹Ðr~=¹6µÒšáeɾ€åO&½šÆuQè;A¨l¿»»xé©ÙÔïj|gbJ€Ï[C2 ›²;ÎXCØ™p*‹Ãƒu.C…‰kÒŒ¶Ò”#®Ô6ý%7_)R(âü=6Ò ]‘+_R4Å +5nW°£V±D €Óeѳ.L)l1áÈ$#˽2¿<ÔÒ_QP~¿ïÙ¹rl_È@ö4»Wg})]œ6BƒíãÇÈ¿³=1:áúS Euñ@eZò„áÝ-È +Óší¯è¾4tÅiš1.%¼„tµéúLw÷åK", î‹0\O[‹AT’€Ÿ£e‚™¼zb0tð¤)n×[<åiBýÇÑ& ožºö~øƒ?~Y!«Ä‘ñAu»…¨Ÿñ¼ôÿa,yçìºÎ*ïMÓó}õŠøçÞgJfÍŸKÎú:œ%»fñ(Î'\yB{ó9‚s7&##•œŒ¨e\:㼞ôB¾Ûgp*ƒ® ÇͺLnÊm_Ò7 ‚ás0aÔϤ™¬»>mxº1ÍmåóǶ [û·ùRå†} cÛ³úÏZ\ cVn¾]HF ºËwƒÁG/˜¶ké®çy¹3«[^ÆÒÀ JDˆÙoyÄRFijâp¬é>zA2}qŠ€¾³bK9Õ/€@ê 8è±U¿l¹ì ’Áê5w sk„–åOl „e€‡J~4»]ê©®§<úÿ/;u‘¹Œ¥LRø7¦E7æ›>¿t÷šXˆ˜{ÍOyÛ‡‡©Ò.²&n¼Àñ½ÉïvðÏ»üW_­ûk¨ØIâ ·PÖŽV1tgæEç›ÏÛc’ÿ52À¿endstream +endobj +4724 0 obj << +/Type /Page +/Contents 4725 0 R +/Resources 4723 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4700 0 R >> endobj -1695 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 675.996 512.306 685.019] -/Subtype /Link -/A << /S /GoTo /D (section.5.4) >> +4726 0 obj << +/D [4724 0 R /XYZ 85.039 786.531 null] >> endobj -1696 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 662.447 512.306 671.469] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.4.1) >> +926 0 obj << +/D [4724 0 R /XYZ 85.039 711.163 null] >> endobj -1697 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 648.897 512.306 657.92] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.4.2) >> +4727 0 obj << +/D [4724 0 R /XYZ 85.039 689.966 null] >> endobj -1698 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 635.348 512.306 644.371] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.4.3) >> +930 0 obj << +/D [4724 0 R /XYZ 85.039 661.355 null] >> endobj -1699 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 621.799 512.306 630.822] -/Subtype /Link -/A << /S /GoTo /D (section.5.5) >> +4728 0 obj << +/D [4724 0 R /XYZ 85.039 640.76 null] >> endobj -1700 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 608.25 512.306 617.273] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.5.1) >> +934 0 obj << +/D [4724 0 R /XYZ 85.039 423.851 null] >> endobj -1701 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 567.602 512.306 576.625] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.5.2) >> +4729 0 obj << +/D [4724 0 R /XYZ 85.039 403.257 null] >> endobj -1702 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 554.053 512.306 563.076] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.5.3) >> +4723 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1703 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 526.955 512.306 535.978] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.5.4) >> +4732 0 obj << +/Length 2833 +/Filter /FlateDecode +>> +stream +xÚµYmsÛ¸þî_¡É'êæD“)’éÅñ%¹Kl×V.½Ée:”DY¬)RGRqÜ_ß}vŠ”è\:m'X,€Å¾<»€Ü‘CÿÜQØŽŠGa4µ厖Û3gtO#¯Ï\Í1Ñ,“ÏËùÙùOSä:vìÄ£ùº]'vì žŽæ«OÖÅ›ÙÍüòv}vF+’ÿç3ÇVq4z¤¶c»q<Úžù²_é~~vwö·v-óG2kHŠì R§:PAGn‘0£0쩲¾¤M9ž^`•»¼\>H{åi-Í¿Êç¤"Ù¦ö¦Ùžÿ`7_›sy4ñ;r£ÑÄ m‡¤Ã¢ŸêMR¥ÿûgf2<.Îÿgÿ`§_ÓÃö©Þ˜Ì;ím¢|nN”c;‘ˆq½ËÉNå8p-¬¯ÇZTè¥ø“hÒc’5Òj²m*K»=­9±­¦)‹f$žÒôBX{ +ö|;ô#ÍYoö²,ÖKú‘NCÍ·K*3Ù±Ò&­°> ³Ii%«Òø¾nôÎÍfŒ#H"s++Æ^dÑô/ã`j%¹Ì]—•XÉ•M¾Ñ3ÁíIs ñz±{xʱ*YÞµvÔÈŸúƒtlî—Z·Z`9öBëAè‹vv¢)UúÇ>­Š.ßuŽ÷¬Ò%xËí–ç4yUËN/^] ÏÕõ\(¯W¯/ùâdìªè±,ͯ‘…—be•…˜MY ¸A;Ϊ†Žw\ÿ~O*] ã}^.’’< œ‰œ‹AR»Þ©ã+×ÈÃÿÜñcÛ|Í)rã.XuQsj‚Zë“H*¸„¶z"jÀÃ]0YTi¢›ähIÄh€qÀ±éþNíUºNöyCMwcü)ê‰sŒ1±{ÀÏJp2&;¤ý€µO”&-š M°c~¶%ñÇ÷m„äQÓøä™RËû.D¾ÿ,ò`}A´D4ãjÀÅÈ$6C»özÇÌÞU‹O2îxʳ×ëyS¹&o‰w“J›q!$u¡4Pd‚3Z¢ñŒR¾÷,· žPàúø– Zm4EÐ>èÙ1‹Ãé ƒ´•0òâ{Ž0–KÇqɸ9éY€·Å¯ ï¢h™g©0C“ +&ñ›TX:4Ž4/D­ãt™AdD®"T\`Å'3_›†ÚGÆÑ] 8ìûÖŒT.ò,Kæï£1†±Ðøôhš J<ÆhÐð‰J T 1¶×L¿]FŠÑåj hŒ£±L@ãŽn(›M|cm, Ž©Ý‹¹zîãyì\2xìO4´7½¶/©÷;ø1s%êz I5»wQ6-:˜ ºœ©{øì +Øt‚ƒ•£t »5ø£”mèøXbÕ3a-ôÎ2¾8C(Î ÎÇdqƒ*¬-Hð˜²ráékq 2¡QJ*lýbIЄˆ»nUí¢FÙ&ÅR¶um0íôD•j™X¡zÈÄet[ØF`ðÌM{:TÈŽæ-ÀàC£Ý+9sy +‰Ü-`w; ûÀ©1*/E¾Y‡ÚW‚Í‹‚ÎcŽ?œ 0¤Úµöº„Ô3øU††wX¶i¾üu ¿(–ìózéõ¸‘-pí¶Té}2½o¢¿³~@œ€Ó«´ÈäB¢H€Ê›rô˜Ü§B\ˆ˜­1¨ê\iué7§DL.mx‡]±òÄú´L“ÇrÏF ܇6ʧ6Ë«á£k¦Y7&æ“Hóâ6*Œw&:ËIdè)\'£¢6ˆ×«¹|×É6“çî2 §IâO–PÒÑ‹­Ø’ERë•ú¥¹æ‚Û7¾ÓêE$,ŽÃÆ6MŠnXèË?µZp3v/s_ vÝ”œŒdîÓZ†C,†G°ÚÚ–¢ôìdÌî:<:€b§1wsQKåƒëª„tçf\˜%ÅK]&…Z\_´³ÁÏø AŒüÅ›N\4züXgÒ'ÖZeu{½Ón+y¯fY­º'S’”JYxËf ‹À¿ Bvª¬~84j +ÀHk,„xkgé.ËŠ‹ÃŽ¼x¦tƒ`s¾o…Ót©Oòö‹¿ž¿O(qp<˜z5×øÖì,@ èë)ŒÈ…€”1˜·(¸)e1?Ðoׂ'Œå^æ´×æ}ÝÅœD>'¡¯‰Y[·(™~ +õ´î\‘wy²ÔÛ•ëÞFu_Zd«ÆúæÞÙ·ø|_7ÏÆu’×ì„í—µbtäôƒüڃ1ÔÖ&ì¾Z#”§ï ýkE¤¯Äßb:ÇZ‘—&¿§AœJ¸Ò¯Év—‹ç(~”ÕœýÔ¿÷ ~*%FÖüÊcû:¶Âáñ+ªÁ"†ä1] +yðÖ’Ó>îK–ø­¥1¿I?+¨Ÿ¬¤#æþN°‚ xv¿3xÞñÏ$Àк:¬oœÇÌq%qo*Ðn ¢ž.Dñ5?',IS ¼s›'.S.€`+åU©Ò?U|SAký¸Ô‹Õ#ÜF–7e…¶©¤’|ß«k|Ý'+NiÔé^o\A‘¡7…ÀöåÛã'ú/&ü¯~Ím&üÈŽ#oø]"ð<Ûs[aø=FEÇ›Ÿ}OEþ7ª¼ªendstream +endobj +4731 0 obj << +/Type /Page +/Contents 4732 0 R +/Resources 4730 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4700 0 R >> endobj -1704 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 499.856 512.306 508.879] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.5.5) >> +4733 0 obj << +/D [4731 0 R /XYZ 85.039 786.531 null] >> endobj -1705 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 486.307 512.306 495.33] -/Subtype /Link -/A << /S /GoTo /D (section.5.6) >> +938 0 obj << +/D [4731 0 R /XYZ 85.039 374.974 null] >> endobj -1706 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 472.758 512.306 481.781] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.6.1) >> +4734 0 obj << +/D [4731 0 R /XYZ 85.039 328.305 null] >> endobj -1707 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 448.3 512.306 457.868] -/Subtype /Link -/A << /S /GoTo /D (chapter.6) >> +4730 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F66 3242 0 R /F15 2876 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1708 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 434.75 512.306 443.773] -/Subtype /Link -/A << /S /GoTo /D (section.6.1) >> +4737 0 obj << +/Length 1974 +/Filter /FlateDecode +>> +stream +xÚµXmoÛ6þî_¡20³"©×~ë·Í–&]b Ö¡P,9Ñ"K©$7ð¿ß½²äØ]×vQäñx<>÷ÜQÒñàO:q <8QŠ@Kg¹žxÎŒ¼™H#13"³ÌϋɋסïHO$^â,V½žÄA:‹ìO÷äí«÷‹ùÕt¦µv¥/¦³(ŠÝ×SéžMgÒ=Ÿãˆr_]œbÃw¯æ0t‚C—и2½ç—'¿ž]¼™þµøe2_ôV ì–Z£MŸ&þå9ØÿËÄ:‰'h{B&‰³žø¯Í{9¹žüÖëâ1ßáY‡\èX±~î | •JI' +ú9aqŸÃ>Tì®Óé,Ý¿akuƒ]‘›<©sÜqÝÔ¨ ±Ä†™V´üì ßª*ëé Ë´+êŠUæÙÝOû©7*Ëê)´ŸŒš&¿C’ô5[žô„÷Ö‚f§¡³+~ž‚éi¹±2FÛŠ7GãÌŒf}™ÐÞ³bJ¢ÒMo¡U’=w05ôÜú‘vÁfáßC˽i“sÃøB%n7öO @R |÷¬jy0Í`R¸õŠŸl6h9O«w ŸV×yóÝ7%×ãz2`üÁ3Å3Ü´ ­X¾²ž^òIóù¡ÿ· VòLB#A^®zL‘wŽƒ=›¶¨îx v0ôÝÀpa¼;BPÀ`WÃ:¸¬Õ1p•;Ç ]Ý"|ßsoîóŠe·8‘Übì:HrŒSœFqólйyt“ +ÆŠŸŠ²äÖ=®=Z¡¶Êù¬nuwI}ÐÞŸ0@h:¼çU»ivÃÝ}ÚÁ¤*âF›w{$îxɼå1ˆ>Ã#V5²QͲ;Š»……}ÒÁ^ñ³ç¦PS¹YˆÆÈ·|`ÖoÔùäHáùI¢YfÐ&ûwÛ¢ŽgkéœÖ`©32–õΊ9¡ÇÄ„"DÄ‘P m3€K¤,\"Éy”)ÞÚ®o69õ£%}AÇ“û(†öÜæΖ$wù¸,Ê”¤rŸ³@ÃgËWÏ9rLf(¤f0fE›‚ðmiH¤~œ —â4ÜÁè'šk Æ ì?÷Ù™ŒAÄ÷“ˆ@fà±g8ö#)pö3ߎ@¹L"gÖrßc8{aòå’ DÏW{©:MªŽ1•´5·2fÁ-¿1³Ä‘{×P†"‚ì© úÉ HçÓs䦢ÖK–zVMAß-ÖOf™aÀ‚Ö6èáU]–=ñ˜õ±æ€Ô†Ô FùKœöâµ¹)2_*p¸ÉíoÿñŠûWçß½:y{v1ÿ µ½…šn-NH8OŽÖ>Ù4M^u'uÕ5uyw4 ê»b™·Ø~wõûõú[ïÓ&]ç]Þ´½B + €€º ºêåC{ +‘aaY åÌüÍÇÓ›K¼à«ÇLSø”bë4_¥›²{9š€5Xéž^2³UPG¨\'¡P¾þn.O"òúWF’‘>~•ÄbùË\®c .U_ËåZKÅÑçòâã\®ƒnŒörÆøWIX8LÒ%xôŒœ¡øšQ%XŽS™¢›œ{H‘"[þ݆2Ü]Šs­¢IXCu-Ût=@ÇN^kpñ¡ÂÝíè–N¹¹àÑ)7bG’?&lk0šÔŠ°%ߥ#œYñ3µ Чîr~ÇÍcGi ÂhA*,Ùbº ±w9*Œì­hmQöÂxï||ãú4:”Dw!ëMÛñ”ݽ ^h‰ÜŒŒÏÁ˜,&´Aà|{þ? Máb:ìÃdÌÔ@Ñ~â;* +„ÿ¿L ×ë5ßÍófÌ×#®fmó +Ì0öaj¹cjÖn2Àí–ŸFÚ’ö^ò°ƒA¯ëf™Ÿ”5^äÿ£eÁ—SÈ87±ìP:‘:$žûÞt"¿Æ(|¡”ò„Šþåb •I~m2‰ 2âŸKvz§’¿Ž‰ïiÄSÖ刬phGO¾§lnàÄ05·]1¤;»ÅiöMm1f•7ÎB´PB9ô±jYn²¾¨Ô¤ŸžæûX¦pÞ㯠ÝFÍ´²äda>A'_%"Ny¥Íc¨¢O;0š ¿mn¹3MÜg©¸š}nûЋt¯8ô­ -àacéñ«FÂoGô%fàiز/|?<ôý~ìŽïúÌÝÈ÷cˆ0uøB@ø)™@™×b·Ôɾ/í÷p#50ù|³¿0endstream +endobj +4736 0 obj << +/Type /Page +/Contents 4737 0 R +/Resources 4735 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4739 0 R >> endobj -1709 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 421.201 512.306 430.224] -/Subtype /Link -/A << /S /GoTo /D (section.6.2) >> +4738 0 obj << +/D [4736 0 R /XYZ 85.039 786.531 null] +>> endobj +4735 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4742 0 obj << +/Length 2566 +/Filter /FlateDecode +>> +stream +xÚÍZëoÛFÿî¿Bߎ*ßÞ§ÄqR·NÜ‹}m¬$Ú"L‘.IÅçÿþæµKR©âz8‚„ËÝáÎìÌo;Š»pà»HBÛñÓEœDv軋ÍþÂY<Âʇ W(VB²êѼ½¿øëû(X¸Ž:éâþÁì“:v˜F‹ûí/Öåo~¾¿ú¼\ù¾o¹½\Åqb½_ºÖõråZ7W¸âYo>½ÃA`}¾‚¥K\º…Ág™½¹½üéúÓ‡åo÷?^\Ý©zr»¾2ý~ñËoÎb òÿxáØ~š,^`ìØnš.öAèÛaàË{qqwñw³¯ þê” +B?±ÃÄëÀ {:p=ßö¿»= =ÞO«¬øYµ;­ðP?NAMZûð²S Ói2£¾ ë?OÚÉz#[kà÷=Öª\z©Õ + vN`ŽA¥ä9—I9Jl +ãùì†þé°k†tÊqLš6kìÚ~äŸ1kG4cV!:gÖ9†Ú¬ÇüNšµÇïØ_¼ÿ c;EÍ+¶#šQ¬SìC­Øc~'Ûã×ù‹kpvªö¢Á‰ò¤AmU-O¾´ËÄK·m&_b†¡'šìRß¡v½n–ÓZÍX¯yNÑ$eZMÑó-HÓŠÀðm©§¾¯HÓ‰îæLf¢L¶Ï:•ïر±}G4c{!:gû9†ÚöÇüNÚ¾Ço" Q½QퟋÜø+hq앉@ÖðÐì=<¥ÝFÅ«.> ÊJß„Gl{ôZÕRi”hÏzß“J›ÏÄf,d™6“ÛntÎLÑŒ™„蜙æj3ó;i¦¿¾™¿{<{8#Xàœñʆsi…ñ}Ûð"ú}¨ ø©åý…V]S•G;õ“+û Š¤ +J¬V üqˆÏñ­g °ðe"/áåvXæåµà&†|”ÜaŠœÁþBÅ–®º2S +èÓqø_éKÊ‘u«è€àfV/¬Ò#ÏNã3 443dšsœá¦xÄì$;fƒ<“:T¼¥ä|^˜qŠÑñÊ/£™JmÚƒ_tàêjpÚŠ I©Û•†äãݾY¹4‘âV-òÙIóÒL||k«ñû¹_×Ãú¿_r¶ÔoèAQå[/:&²°tÒ)Yüi”ø¡Äg.Æ=¢œÑ9 Ì1ÔH9æw*=~¬K7Å*œS V„¾Y”LŠ%ÀXÑM&9ÛáˆÀ2ÈnÔn4ph 7À‘*~ru9˜úDf1÷ 7±ö$´*%Ê#T)ÅÌq¡Í”BB¯ÄñŽG÷=™Ÿ N6ÆÍÓz¶Q‡&€Žz-€«úi.BúZyq/½úxˆñÉ6ŠÛe[ìpEìSÔ)‹¥-Y'i¹5’QšÎ厾UΗg¼3ÄžÕÅ÷WþÔ@³-éjƒÓy×èb‚Oº‚À`Æ]µÕª¬ÊìÄáÔö¢‹¬Fý©×¿±* Ö5[•YWzxÖV ž‹vù<ß–aÈηªÍ¦êg6EC:¥X’©íJíà_~߀”=ѧ b¸çùñl¹GCêÁªk§ÙLh n:Wn`6ðuaaèX_–>Õ‡üOWƒãUîUù¥ó$œüYÕjŸµYÝH·V6öbÛI¹(ûG“Ý>?Wu{(ó¦Í77Õæ)ÇÊÈ ãÐú|õáë»/·Ø§w”íqŸî8 ½ËÔ¡h¿×ôÀÛÖ‡Œr |r€W‘íÅ¥áNè$¬«kJùFµææçÆÖË.€×:vf<[gÛœzè„Ó¶’uòtÔêPHmäöÓò1UtâšèQ ãbÊiÓÕ B2øžª‡QX”dRô:v5_”VÓsÅCðOÓâÛQaǽwë\ÀR` Oå]È|VºÙdí þÜ ®*ƒnüÖTœ½$lT¥Ž­ U¡t}€º««µ)œ÷´ÍTuØQÌ:Uf:øN`'Þ0xÐ'!ì÷TùâÙýcrÿ|Òïõγ"v4Ó~ïÅÔ0ÿ3¿çSÿA—¿*Õº¯/ÀÕ›ÿÀÑE´?íé,ÍxA<—ÂÁ8}‚Ó›Òup­Jt4So ÁԈΠ<^dÇM‘‹Éžƒà„Ó?%¡4ÍîÔìý89n@$Tc µªek5šü±ÔzÐEÖxëuñ°IÕE¦ÉÊAÔX‚çåß Èúk<«ì9ª®pR+»cZµÃrU)^Ï!ó²´}%âj÷KgÛ'ã2­ëŶ¥ZZÉ5X*Á¦Ú›Ë19-ÿìG?Ø=iÎÒfG#¨’Ú¡ È¨cÙK¾ÍV$„©ÎÔ©ýðÀÆf½Ê$¬yy“—O÷»º:<îží¼c¡Êð™—yI÷-|[¿R­ŠÃçL\¯É6U¹=ëÎÁÛ¼(Öíð˜ïtÈ÷¨“Þç Ê~OššzupbÌ¢‡–gùVTMRQ ók¹Jð—Ò&Œ’)ïõ Z[ó%衪;ò\ØlM¢–ÄÕðz­˜ó”ƒ©Rg·gv­³~‹éž~Aî7…%½rúÖuv~tU¡Â¾”„‰0´ÿä/Sð—åüSÿ§¡+Q;M&~µ =Ïö\# çRçXbýŸÆ"ÿ¿ êendstream +endobj +4741 0 obj << +/Type /Page +/Contents 4742 0 R +/Resources 4740 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4739 0 R +>> endobj +4743 0 obj << +/D [4741 0 R /XYZ 85.039 786.531 null] +>> endobj +942 0 obj << +/D [4741 0 R /XYZ 85.039 477.837 null] +>> endobj +4744 0 obj << +/D [4741 0 R /XYZ 85.039 458.965 null] +>> endobj +946 0 obj << +/D [4741 0 R /XYZ 85.039 316.648 null] +>> endobj +4745 0 obj << +/D [4741 0 R /XYZ 85.039 297.776 null] +>> endobj +4740 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4748 0 obj << +/Length 3318 +/Filter /FlateDecode +>> +stream +xÚ­ZYsÛ8~÷¯ÐÛRUC‚÷¼Mâ$ã9âÙX»©­™©-X¢,–y($Çÿ~ú]žÝÚ­T"  ÑèãëfÂYÂYžøAT̲<õ“(œ­š«`ö3®B¡XÉ¡y³¼zý>gaàA1[nì>Eà'E:[®óÞþðý¯ËwŸæ‹(Š¼0öç‹,˽÷óл™/Bïçw8£¼ï?^c#ö>½ƒ©·8u O2úóíÛŸn>~˜ÿ±üñêÝÒråðFòôåê·?‚Ùøÿñ*ð£"Ÿ=A;ðâ˜5WqùII¿¾º»ú»Ý‹çâ¯:'‚$Êý$Ne%Ž BUøqϲXùì„BøEû¹j¯ËZ?ÃÕ’,{~ø÷õç[¼ õƒù"Q‰7vüÁ« Á¡\uízÀÛ'‹-hãër£÷õøÓ¥’¼~ºü,R_eÀtøAžÑª»Ý|¡2¯\¡˜«ßƒ0Q—Øp¢ðÆmÉF«š¹Ê½}#3UƒSyàéºîpæ ÿ¡Åk$ɽM×sC3a ›Ãåyl "ÀÏó<ò@b•z7Þ{m¸a††¾Á±[ºGÛjÎLÃ9-ñ }`8óîùŠHÜÃØ+ÞBÄB"LHã–OE-è€þ+ݨg•]Wƒ¾¯ù !î¨ñ”'&ºy}Ë Ý®¹Ñí€Åœ{RûÅ@'Œ_w"Í +|¬æ'6Ð세æÀ-A‡d-¿ÞXQÏç‡?TÄÌsuð𷻺[=¾éKýøYWãU u1ÿ/õ0JþzEëa‰Èz3£ÇšàÌ먜™7•ý6Œkþ¡ƒëÊœJd¶íø·/i_æ´ãç…Y|fM·‹jëýP£ÄЈMš\áK2§h•_@ûB’&à _Œc ¹p“±Å)YN¨ü(T3x!? Ù…ÃloCÞ¯óH$ÛdÔcÙâÝÓÌ»F­ I½ÒÔ{Û!eO”û™ê~ãÔ/Tñ2à q|`\–c•øp2qŒn5pµè„öÜÙ²çʽ¯â¶ãT‹œU]¡t‘,~ ÃÛØ8²§xùÚz¶Õ~` +Ù5®5[ˆ«Æ;-–ßóä=ªöÈmxZÍ­U×÷8a%wätvèX»ûºlP[•ŽBCëƱÓàÈðÜìÆŽicñÍe?ˆO¦39(i:ÐhÓ ’®)å¼ðºÂ%ÀÑ`wkå‚täB`†Le[’? +wtáïèRg\Âçy“§Ëaσç‘• j + ¡pº/ݸ3ðà†dÕpg]~µA»îÌS%Éœ+.Ã68vÙ0a¶%ìg|Ä£ð‰¤=rÃN×2ˆb-”7ìÙ„y=\ô‡hu‡ +>lLø¨p Y©7”rììÁÎ`øeÕ.M\CRs8uœ%6ਣ-Ÿ¬7£cL8b”¬Ô£d4L7^—ßøæø +àG ç§6ÜŒÂ7 2㜲IÛƒœE “}I^¢ª×Ü·À hØgà(‚ˆC6W-ºñ$KbM¼%£*¦ƒ`D‡võty™]AôíC„kñÇjàŸrÌÄ™Û>U#ê +j‰Á,4nÑHo]âZ‚Š¤D«ž´kh¹}±„`ØB^ìXqÜ·¾7"üÚ›²ïÉE?˜̦ÊÜZèzrÂÃé½:z”°07_DJ”2M¡ç@I)°$:zŠÂ[bÛñ×Ì… +Å+îÛ‘Ë…ÁÇ–`âð–GšrÜ2[³úã&JÁº³&Ö$t!Ùäø”‹­àV÷¬êg.¾!Gn@¿„;Âÿ{Áî? Ë]Y·ý xç 6”—à $¤~ Ñý%xàÐ\4Q®ü4  IмíšÆ`C1ïú€K€èæ?²Í‹üL4—áJ”侊`Ý P("oè Χžqe£1I`6FTt³5ùøª4QêÕ9G·-É÷2Ô…<&¦ëqÝM±là!xC Ùèy{6³‘§ž*„ªxŽI`ÖRÕâ^÷äêè:ë•Mò9²Ü È~%n}à,’Ä,ÜUf-Î…§H™á§çø$ ¶Ý¾ž‹7‹'%ÄΦ;Svg¹†\I•À ¦ËíñýF&qœI­Fßײ_·;æj‰–·bìË8†gl Š°yïC¬¤¤Žó)ê®$KpMlY£sc˜q9 +ª7ØÜÜ!q% €}åfàLBr`§ŒÚh8÷™³V¬l}©6 ä ×ø……Ù B[®8¦RQQä™ãG.,ù—‚AˆEÊ,|98D—ƒ!ú‹`ðâ NÎ; Üó®ËS6Š¢Šâl-I"{.& ¦„„A÷KŒŒÑÇ&XòÃ?Þ˜XÐ{Íûßa5ª­2¸öCL^ÚïG@\ÉïCÙbŠYóSánš'¨~¡ )ŽšêôÄ̼ Šä9`HbR:õz¬3tƒ¬!±dSQËh±)‘ôkãâ¨d‰þ‘òЇ-‰9³®Q‚.?NFž8ŸÿèœD+)×ËÍL*ìÀI ËTA«ÆªêJv“O ÐÚïdD푃‘ûÛ3…E¶¡áãQ±_¨è/Œg"zÁx„诌ç¥ñŸwÖxœó–ïãàèipDüŽ-ÕJÕHÐkptKç[V?ŠîDZìj-¹¯©»nH´£ê®qÁ‘xm${ê©2>ºLuSQ¯gªË•ãÊ=0ÔTá+¬&oµ4ŽDÇp“à̽ñÙ°PØ‘ž›zQµ²s:!"l©ù²œÃtÂû‘NáLœ¶ù3LFüc“9Ø/ r±/ÆKö6r¯÷öó¸Pm¥q^Cÿȼã„TU3”ÍRT8&½3z°X"p-E5d›sÓÑJÿ‹Ì£ÏÞÖmG…Ôs‹L|üÈGxh*Ç9{ºSÙn­,L1½Hq ~öxXÔ"ó>Þ.y›cï…km‚PäöK.4mż«±ª}âuk¿?€‘‚äd/0 5ÆÇô)«kíPÙ±SÁ51UàDyMU×\‚x€¿Ï†ÓÇ )å72/ß¿AÖ8t`»¯øs„Öp³ÊÎÔØ"•š u¤3SõÀ +ˆ4Øm$Ù¥¼0fͶ³¥ÖŒ+Ú&•¦.ZËN2É5+³TNƈn’ÑKÒI•žP]¬]&~õÑð—åó?ý7"[s¿ÈÕyGŸ(å«Ð2ÃåØð˜cóÿNYþõf"endstream +endobj +4747 0 obj << +/Type /Page +/Contents 4748 0 R +/Resources 4746 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4739 0 R +>> endobj +4749 0 obj << +/D [4747 0 R /XYZ 85.039 786.531 null] +>> endobj +950 0 obj << +/D [4747 0 R /XYZ 85.039 565.53 null] +>> endobj +4750 0 obj << +/D [4747 0 R /XYZ 85.039 536.126 null] +>> endobj +954 0 obj << +/D [4747 0 R /XYZ 85.039 398.412 null] +>> endobj +4751 0 obj << +/D [4747 0 R /XYZ 85.039 371.798 null] +>> endobj +4746 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4754 0 obj << +/Length 2373 +/Filter /FlateDecode +>> +stream +xÚ¥YëoÛ¶ÿž¿Âè'¨i‘Ô³Ã6¤i»›%MÚ$@1lCA[²-Ä–|%¹Iî_σ’e[N2 A"Š<<<ßyP‘~ä ò…«ãAÂ×r0]¸ƒ9¬üv"-ÅÈ’Œ:4ïïNÆŸo ]»ñànÖò‰]áÇÁà.ùÓ9ûÏé—»7ÑÖÚ‘žŽÂ0r> ¥s>Içò#®(çôê<çæ#,áÒ5 nììåõÙÅùÕoÿï~?ùx×JÕ‘[j2ý÷äÏ¿ÝAòÿ~â +Gƒ»BÆñ`uâùZøž¶ïË“Û“¯-/^ó¼«Ï¾Ž„éCH¿c©c ò¡ï‹À É´­g Q¹?êW—02u–Ïq5tLžØ?~ Uä¤Hù˜å@:g&Sœ^˜å¦h•ÖhÆõaãùŒd$|±±ü’tiÕÓ0òÐVžï:ŸÍ=›ùP‰jS¢¼J ²PÒšÞðÄåpä) +exVf›ÊCÈì-/Aö¤µ v¨ÊË‚ˆ¨"‘±1G'“힒ϨMY[þ6OSJ9„¾’"|Ð-E€žÐ^Ð @ßõEÅM†{^윢@I‚™³çŸÀ¹Ld\Êúr5„Fü¼H[šžžÀ +åEnŒþFš³>8jE¹‹L@í±á,É3MƇ!–”÷<…­EQò˜ò-0ݬÙΆÁ+\«ÊŠó¥gS82§*`ðç^¨ŽÀÒÚ0›”³)oËy­@ìÙS¿¡>é„_*Ü~ˆþfã‚Jfÿ¸U­äVÆ ¡<çQ rÁ‰¶Ç¸#,¼í Ëø†yÊ`8س 0¥* BP33£þƒ½aËï³]׶תD~Ÿ°³ 7`$.ŠÊJŸXm´åû\SÕ<Â68ÉꦲÑPËh‰É_ð¤Ø~@00‚šéú›š€ï.¶R–¬›ÅoWÁÛtº-¶}<>gÓ²¨Š™=ûó-,}¸â—ËlB-oc„'˦a·æ㋲FÿæYUCR¦¥m¢AÀSÉì+×Ûæ”ûÈMnam‹?²‹ç²›·*tCíHù·”ƒeYØn·äù«´æ‰$ž÷åÂË"WâAÍ)Ž¶ _õ"zÉýÛƒ^ˆpìe7®)]D$6I¢ MÅÌ^ aô<6QX?(¬þ±ÞñCÙ¤ïƒ&Cz‘Ý`¡S\Ôq¡œ[Š›Nyo¨Gòžz'J°¨ë5ÜVWU’‹U“[Ä´X—Mù4Nó´i³©Æ3ðDVŒ«º(Aßý§{-LµÞ—݇#]ïʾÿ•ÂÒH¼ë.ÈQr C-¤§IâÏm +h!Hw¹˜sÇÒ–"®êó{¾ßÃè”üÌ~kà Ó_•òâX1«7èZ“Ùð¤¬Ô~Ù€å;ì J“WfÚöfÐKœÛ†>Ο—Tñ¹/8ÈŸÖÿt÷)ߣÏH_ðûbüÍ[DŽÛ£*’n‘U6Éé¡98]—”@¤ÇñÛ}Ç@‹ à‚¥ýXøp‡zS–xÔ¡>„ÔÇ¢ªÍz 5²*>t¼2ê–D[’ÎÌfY#œ­¦Yòóýä§-ô~j<´¯Ü2à +1Ç@îòz¡ÖÐŒ:D‡PÛç„‚5"»! p7r{\ãI碂ÊÓ‚8ê NUq _”óæ¬@ÄýåJoN]d@\¼îï@péò°á…,?ŠÁƒâ‡Žr]AèIý|¢Ú8r6£ŠàhïsÌSE¤ŒD 7£W"rK}‘–æŸ"²ùõ*H²ÇŽA®v ÷ Ü=IKôÏ! ™ê"§k øP™¡ûï4VðÖ@riß¿J+WñË›/ü©Ç1á¼ (—zÿGú†jš¼öž‹m7>wŠ,îÞäYsµ8ÚX2 £p·nƒø˜à°kŒ"çêŽh<‹]äÒ]ÜyJ_õ(›Â)MýìzÊ´h*Œ„j>ÆoC=ê¢wŸg|mW'ñ"¿ãÿÝòý"z­÷Ñ…"„^ €-B¯ÿcBC3êõ wS‹ÞžO´Ö½_á—5üWÿ5i¿@GGš _)hS[aø“Ìš¯Šü–¶hÈendstream +endobj +4753 0 obj << +/Type /Page +/Contents 4754 0 R +/Resources 4752 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4739 0 R +/Annots [ 4758 0 R 4759 0 R 4760 0 R 4761 0 R 4762 0 R 4763 0 R 4764 0 R ] >> endobj -1710 0 obj << +4758 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 407.652 512.306 416.675] -/Subtype /Link -/A << /S /GoTo /D (section.6.3) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [147.71 383.271 511.015 395.264] +/Subtype/Link/A<> >> endobj -1711 0 obj << +4759 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 394.103 512.306 403.126] -/Subtype /Link -/A << /S /GoTo /D (subsection.6.3.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [367.133 356.173 512.306 368.166] +/Subtype/Link/A<> >> endobj -1712 0 obj << +4760 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 380.554 512.306 389.576] -/Subtype /Link -/A << /S /GoTo /D (subsection.6.3.2) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 342.624 331.441 354.616] +/Subtype/Link/A<> >> endobj -1713 0 obj << +4761 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 367.004 512.306 376.027] -/Subtype /Link -/A << /S /GoTo /D (section.6.4) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [367.133 315.525 512.306 327.518] +/Subtype/Link/A<> >> endobj -1714 0 obj << +4762 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 353.455 512.306 362.478] -/Subtype /Link -/A << /S /GoTo /D (section.6.5) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 301.976 331.441 313.969] +/Subtype/Link/A<> >> endobj -1715 0 obj << +4763 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 339.906 512.306 348.929] -/Subtype /Link -/A << /S /GoTo /D (subsection.6.5.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [424.405 274.878 512.306 286.87] +/Subtype/Link/A<> >> endobj -1716 0 obj << +4764 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 326.357 512.306 335.38] -/Subtype /Link -/A << /S /GoTo /D (subsection.6.5.2) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 261.329 388.713 273.321] +/Subtype/Link/A<> >> endobj -1717 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 301.899 512.306 311.467] -/Subtype /Link -/A << /S /GoTo /D (chapter.7) >> +4755 0 obj << +/D [4753 0 R /XYZ 85.039 786.531 null] >> endobj -1718 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 288.349 512.306 297.372] -/Subtype /Link -/A << /S /GoTo /D (section.7.1) >> +958 0 obj << +/D [4753 0 R /XYZ 85.039 683.458 null] >> endobj -1719 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 274.8 512.306 283.823] -/Subtype /Link -/A << /S /GoTo /D (section.7.2) >> +4756 0 obj << +/D [4753 0 R /XYZ 85.039 662.868 null] >> endobj -1720 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 261.251 512.306 270.274] -/Subtype /Link -/A << /S /GoTo /D (section.7.3) >> +962 0 obj << +/D [4753 0 R /XYZ 85.039 521.7 null] >> endobj -1721 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 247.702 512.306 256.725] -/Subtype /Link -/A << /S /GoTo /D (subsection.7.3.1) >> +4757 0 obj << +/D [4753 0 R /XYZ 85.039 492.296 null] >> endobj -1722 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 234.153 512.306 243.175] -/Subtype /Link -/A << /S /GoTo /D (section.7.4) >> +4752 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F11 2898 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1723 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 220.603 512.306 229.626] -/Subtype /Link -/A << /S /GoTo /D (section.7.5) >> +4767 0 obj << +/Length 2964 +/Filter /FlateDecode +>> +stream +xÚYmoÛFþž_á”b–Ëåk¾%iÓ¦¸ +ćÃáz(‰¶ØH¤\Åñ¿¿yff—”eùþ îîìîì¼>36W ý™«*[_•UçÖ\m¯’«;Zùù•QŠ,·qžeôýÌâµ_½.Ò8ÉÊgiôŽë2Íâ¬Ê@óþæÕÓä*M⢰W7·WƤ±5éUQ×q^–W7ÛE&W×yžDŸÛÍqìV&êW×&º[]Û¢ˆ>7‡u³ú÷ͯ¯~º —é]EÇyñ7ÉÕujc[ÚY-Ê46U¹dÕd±ÍŠVó*NËÔ³jÀlVGŸz7Ä¢‰¶Çë†þºýE>fæÃäW&‰ë¤>áÃÚ¸6nvÝ´ºN‹š$e¢Áµ4(“èa•VQ£+sÍf•–ÑŽHZt‹…*rƒ8]ÀÎÏôÙ@½Æ—¤qWò9ú3öm3éžpµ‰ü•úÛ9ùÝPˆ#×týš^~»&ïq`4ŒwËJ4°»š=ñj!T´/Í£?“ÑÔ7RL–T$œVæÙ’nðÎ×48Š¢Õ,Ú` + ÖÌ`»•é];êöæžÈï÷g}’i~†¼ªhÝÈ°ë'×ì÷xŒaZ° w|HÄØ€6æwª®—}G–U-ÈdÜ܃©±!u›V¦ÇöDŒx‹­’oçõ-m:z‘aÀ‚Ûé v]{+Ÿ?ç;æ¼VeÏ ëü¬å¶nßê%0§á(Z‚TeôKËï»^>0e6Ýö %yôúyVšè“ü4^*X|·2÷î‡#dèIš§§Ý€…øœ4˜6æÀg>ƒäåŒO߇3\C¦'¯X‚_`(ý,Ã`°Ö¹˜¦_Ëä N +žÕ?c®-É0¨ed-)Š ªÅË1zýÏU•Ñ£¾W÷²6ƒƒõ¼ïNƸÝÚ”nÿîõ%c qÓ}¨¸H‚}ùjG|NX#Càøøó(“ØÊ»öÝÈS—Ý®qoéÁu)«2?¿k+ÛØžhá Õß$?ûÎ9UϪRŽ+½Ø•Ù"¦ã !úÓ_³qçv¤oÇÍ™Iƒgðc»q Ó³y k ¾r8NBÀ‘a˜œŒ`ãøít<¶äÓ:7‘UUJF­‹Ž –èHã:{ )Œ/] ×[¶pý¤—œ[Ѷó +Ú Â¼hG¼’#%Ùaãd ‘p %æäþÑÓî…”½™~aê½i¯Úp¬²:>^(vÝt~èí„è-ô¥öû5̾(§^ôAcùغI&„’Ò¹¼¨§øBšÍ“:Nª—‘É‚ærºÏj›<óé>Õtÿqe“¨mÜqôÉà¤éÙÊè}Û·,}°9]àÑý šËP +Š¸J<Œnü‹zlu$zËÙ+%gè|©SL‡  )–Ø·ºL`”÷Í~’E΃ÇÉÉHò‚^=¬'5V³0Ý­\Þõò;ŒÛElÆŒ@”b†¸yKAôÜ4«Lƒ Æ=-€TÔ 07`Þè ŠûGY¯àgYj€©…\eI ¼¼ð‰ïý›!%7Z׎²ìݲåô"(á üãô‚K ¼c6)Ÿ¼—…rGð&Ê;/˜ŽGõè)]h=žr„HO2Í øFf½ì_@>ΉrñœÛ‹Hf±)K’Q:¸?fy‘ä6x•a’„‘{¡ƒX×°dÐ 4Ã3qy'úí['a_³9O>gÜ•T)²Å2cdU\¡ªÇ­'rxxžŠz&æ6§Ò*- NB_ìÅ 0÷iJJ¨„¶þ†?’ýNßþ"[›£®Ÿëì'6—‡¥â™…äw[*™A¥9ô$dZ–CêI¦}$gw}…¡yMòñ }ö ¸7Q—"¢‡€éØHŠæ(úÕ|Ö°::*sÁ%ôðþƒ¾âü͉(Œ»óÇ»~à*x'#ðx໋!g™¯º-¾¼r»Š“–†'ÎŽ“ƒKc²Q«çãqB5ïŽÜb‚ë¿"ófè¼Ä±ön#Æ$| `|ЦÚ8 ß”&úIS0°'ö¦¥ }§2•V‘½ãÃÕÅ&Y;;ë¯]ÀÌÚùHíœ<Û—tÄË=´Äü9i'ˆÑt¸nò¿Ûn +¸D®–zn ]}çúûÞyÀ;(ÝÇ¹ç£ —»qn) ã£Ìž@Üàñ8ý‰F˜ââoHr»T¦ý&/×z šËõhJqÞÔ¡ýlµ½YÕ€t»¾Ûx ý±C2ß}ZŸ4›rÊ™“~'< úÚÊø7”IìéúP_Özù—qm-ßþ‰=¶—ÊÛÔ˜8Íë—Ÿ<Ó\.oMUÐTéË[xG} ¡†]ɨ깺E"w` +«~æÃý“öÄ[Sé€âƒÒóS¢{V@±¾‚Å-/=ž–67¯(‰!-ÐL£ç®g 1=×ঔº’ס3;Èïf?ø2”§}Ö¨ +Jpe•sK•,¦Ûo\€ Rn¡…‹¶×c;Pè + ‚(»ÿƒ£“ÑUUýmÑIÐ+›)ˆA Ü3  Û¦‰GL›†s’M­] ®]³lsaÃíÀóÆ$ßleaŽ;“'mäCXYjh’»NX™«/sþœ•Ó4§ 9ì9iv¦ü¿‹g¢Öa0çÚ€±'´¶”ŒŒI4ß‘“þ¬.­6ë‰z×M½J±tLÊ;¸ñxæOO“ ±™'´Â×r°Cp¬²P9– +·Êl¶H šåãríË9š‘VyÞêÔxV5.oÔÈ*\Z-efÂFe  “^ƒ2Hë|´fÅë½_¡ãýâ+Ða·_ø<½ïR¤6ˆªéË‘zA"µ‰kˆa¶guµˆÔ&2ú¯Í¿Oþ_ +ºZˆ¡[&“÷è0jt¾øßD“˜Øüÿj.h.ÇØ*¥ëœæ Òfï[~4êú𯉱bTšõ%¡€îü_‡e!¦ +ª»p©Ææ!¯RØÑï‚žê;çXŽnê¸ê¦ ^ʵ­rh·Üé?wºÓÉ•všGïùuó· “ñç'OÈgƒÄ ÙlZßÈq2h:ƒ‰…hòèVZe-$*m:nûÚwå° P¥áª×ý>H=o63{b-a&=7KÖZ¤á86ÚÌ>½3·UœWö…Kÿ £µÞ]endstream +endobj +4766 0 obj << +/Type /Page +/Contents 4767 0 R +/Resources 4765 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4739 0 R >> endobj -1724 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 207.054 512.306 216.077] -/Subtype /Link -/A << /S /GoTo /D (section.7.6) >> +4768 0 obj << +/D [4766 0 R /XYZ 85.039 786.531 null] >> endobj -1725 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 182.596 512.306 192.164] -/Subtype /Link -/A << /S /GoTo /D (chapter.8) >> +966 0 obj << +/D [4766 0 R /XYZ 85.039 766.606 null] >> endobj -1726 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 169.047 512.306 178.069] -/Subtype /Link -/A << /S /GoTo /D (section.8.1) >> +2961 0 obj << +/D [4766 0 R /XYZ 85.039 672.187 null] >> endobj -1727 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 155.497 512.306 164.52] -/Subtype /Link -/A << /S /GoTo /D (section.8.2) >> +970 0 obj << +/D [4766 0 R /XYZ 85.039 672.187 null] >> endobj -1728 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [497.163 117.004 512.306 127.299] -/Subtype /Link -/A << /S /GoTo /D (part.3) >> +4769 0 obj << +/D [4766 0 R /XYZ 85.039 647.469 null] >> endobj -1686 0 obj << -/D [1684 0 R /XYZ 85.039 786.531 null] +974 0 obj << +/D [4766 0 R /XYZ 85.039 509.087 null] >> endobj -1683 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R >> +4770 0 obj << +/D [4766 0 R /XYZ 85.039 480.351 null] +>> endobj +978 0 obj << +/D [4766 0 R /XYZ 85.039 245.004 null] +>> endobj +4771 0 obj << +/D [4766 0 R /XYZ 85.039 200.456 null] +>> endobj +982 0 obj << +/D [4766 0 R /XYZ 85.039 115.324 null] +>> endobj +4772 0 obj << +/D [4766 0 R /XYZ 85.039 94.128 null] +>> endobj +4765 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1731 0 obj << -/Length 2156 +4775 0 obj << +/Length 2867 /Filter /FlateDecode >> stream -xÚí\ÛRÛV}÷WøQ~°*é\õÔ!дáRL&Iû džØ–+É%ü}÷>7ËF Œ‡$]@k}9ko9ìðv%ów…ä>#a7t‚î9ì„挠Ký€3<ôæ¼óË;uÃÀƒ¸{~©N9~ööói/’^•éMÙûçü÷ÎÛóÚMúÔ§œà]þí|þ'èáýÞ |Ëî ì~ÇÝI‡2â3JÌçqgÐùÓÝE£]}UÃÿÚ§A ÿšèöIàKIÏ ¹O8ÜÄ=Q4ö€S{ì‘—¯R(BÀ•5‡ÊFD¨Ôç,Ýñ­DFÀÖÐtâûX‹ k£2UR†…÷)å?Š‚Ÿ{y+ Š6$†Á߬yÕMQ©<zB¼w=IÉÓ´†Ñ6ÙQEåã¨bBÅ.E»Ÿ)ô‘|ÿ «*í5+ó™Þ~BÒNÎþÀÍá™úðñTjfTŸâÛ(W3ôñpÇ›ÃýˈîÁûàä÷ÞÇj¸äÏ'¨l -< ÚžàÁÝP//ÒU7¤N&ˆ¶J¶`¨Êõö¢×‡ÑL3RÁ5×f’¨«p(ǃ7ërC 7GÉ€rô=J4ôÄæ“ìGí[2À_ -ú¢ÛAœÄóÊÌåg¹ðòye'=Ìç<¦vŽ«Ñdˆ«ƒ"+Õ`féí™ðQ+A—ÛùŽiϸÍpcx€IÅ^eüIè]&©Ú¨9“/xõñ¸yˆiCÎÇÒ0’_®øž35÷'Îtö¦Èó9þVqÅœ7KŠd’Y*ûŒì ^†Z® õR>dÆûí4mÄ\Æ|ëP^o1F­òþx !êëÍ9BtÝs0~RéèÐá‹cï¤VLmŠSé%üÊ‹/‹–zÇû‚ç¾þëéÔI±!ˆ|~ -FÚ˜ìô+-ª–¾&ù7I΂*=Í "È·ßËÓ"0uË°ÔgÙl;J#rœ¼U5z bd -˜ã᫤…µ/˜ï²ñì@Ÿ5¿l]¥/¢h'ºþxÞÖ3'æLS Ç‚¬îlய²O1Lç¨uÀ±4ÃTìÌfmømHY$BgÚaåã9:8Xð“bXŒ‹vîëéÜ7îë« -YŠ“þÍB»qd'õ”ÔQv³¼øÐÊÇje@ââ•8,ÞBÆ¿ZÖ¸k™q9ŸéÜX9­ž¡¬î·¢Šl­íˆ6|w>LÇ„‹q6ÑL.ûBg†¹:3D¯9Kn‰rŸ™$i‘—¥5™‹ÚR]gËD¼BY1Ö 0@Hè¡óŠe¼\ãƸžÛb‘i3!Z\¢—5™éG©E›;¥ñ _˜®©Oª7…?Òá¦BnÊ#êSoÐ#?Eá°ÐO -¶KÕØTLç¢ðÐ[ P\$¥2§êlâÑÚMÁw›š0ÿ`g^D6W¸97œ[ýY‹$»™µç6oA•…‘Ȳ8©ç7‰æTÛ»®Í¹nµ=[ ³‰PMiMçxùH‰³·."¹ciãà«XBkÃÞȽá=Æ=KPˆZ-D`[µkdäèSêUZÜbk,òIÖzÏ$ÜrÚÑz¨ZÜ´¯ìÂUäÐ/;œãý®™Öazªƒ\Щ¥Ôñ„úÛ²NÁ6©I[#;ÕÖÌw¨óÄLȽhƒÄéRx"NˆV<,â° y²Ã®ï^DñÁ:I•!¤‘rj/\Wºš¿¡×……Š|”Ü `œàÀ[r ž°i°X"›ÎYn9Oê|wæ§Z[†e ÿ°b)—Ã%º>èAQEï·Zo{^n™|”†d'­ŒÅëF°Oà àYîE“­¨­÷«F)œ›LîâneûÈ‚àcV÷„¶#÷ð|DY‰á +÷m^äÄ/ˆ¥ë‚ÉV°³]Š_Ð"ÒÜ:˜Hgâ$ ’T¿˜ey8”‚D°ª‚…Ú§ q¼ +lÂidVÕ)B}‰ÃùçYE I04ÚW ¦:unYa¦8„Ü&6ÑËö8ÓIR¬WA´Š8m@›Z/KH1"DE}p™üÖ9Ëß²ØÈâEäð6xæ³&¯:U¨ù0‡ÉFz(¶ >7G ’¾Cúû>:3ò°²«¼Ð&Zs©sGVë}çÀDwŽò÷ÄzÖ§Œz ¥ˆd0ó¢ÉËž‡vir¤¾+´£{g¼/w‡Š2ÌCó•—,U¢<(ÿéŒ ÆXT[ªDA: BÅ?-FxںĿ_}Åó?³Í}õ?c%ÂÿrÙm¤Ã>UÃɶ{\—Õ!´3j8+›(pk”>W-ÁÎÈ¥DÎuI/nz¥£Ó+þÍ‹;Æí€ËjÑÁTû F© T˜ˆ¦ž³í*w‚~Ì¥>Ýq:L! @|æ;§?}&C·}êÝŸdQwu…êwá<…¨¤½ ’Ôå<¢iQ°/ƨSþЧ‰zÙz8ÓþÐDaµÛÀjßå{AÔŒ²e9ï²MÞùF’"èùÇ•GL+˜äeéáL»HbµÊ.ò-x“¤­í2*„Zžrz‚@Äuž8¯xôÍó¤ªa8Ú³I,ù[ò<,s—œ¬PÁ„b‚\åuʘʡ«5 [~1¼S3’Š;±G 3Ö¿†k½eéÞzOE,,spͨâO•¶õƒLöÙ µ\ÃχO?þÊ(‡B^DCRÉÑ‚u+77 º¬‰¹àbÌ–ÝŒ–Lè{Kã˜Ãûe§–²G¿ûGgÆÈÒùÛâ…ö ÖïÊ®RÎÈPR£€ñhOÃ*¯ ]ä åU™‹6Õ…×E$HÅ¿ÇìÞ'ÂÀ®óaÇ:¯bViGà ’ÅNÇ¥éHXõ¹æ,r™ ,ĵžk5¢ôý”ƒ+mqÃõ ;§ðš±¸ÅXÊdŸ?ñH +qÀ¿sáÁrúúÝœqáe\;W÷þñ\õŸØ}Y#R¾ˆ¶K]XÎŒ» ‰Ø¤ñxø ]¤åëð¸Å±dò°ð‹<…°#K¥.f‚Ô5\a\†ùwÖr´2v4·†{GFb^W\â]ªÃ–G¯/¯M*Æsʱμt¥éM[W”ôgÒí˜ðpZ iÓgˆÔI†X¦^—t㸖j¦’{•@3/Ròp¦“{e,5®ýäÞŒ&÷ôq$áNÊ$\PyG ó—&lú2“Êt.MÛ„Sù™ôò!Å +瞊T'×0¥>Ô1?¬áôùŦˆ$øˆFb‰Ã‹ïtIcã<‘·¡ïl<}ÐŽýE4ÉŸúª›,=ëÏÄ}¿-¸·.ª¹l¶‰_:·Nó a¿FÁaEÍŸ—.K”g”xIl¢¼I°¥ï“$òQ,ø>ù¸±M˜]Ç?ˆmóì•èÈ2ç»=¯}àæ…j/Ù$ΪãÑõ5/-²§©‚PêB*XçŸìTä2®²¤ÕAúäE`=õHC©á®qËT2aÃK¢>`n{¯áœ/båý“ +—Ån:‘Xî:»N}âl$·Ñµ[3ˆ^Òî§| —,ÔyÖtÁòåH¯ýH…|V»J^&oÅ+cSæÄ¿ãu|ã9\à0ï¡«ÚžSäkZºA¸p_ú_ºðØ™L(g.­€ñç±úä1{‰ªn›É4Ùù~ÿ³ +ûë®'}ë*Á´Vš‡Ï +ÏA±qÅ“Ä‘Îæ®SÇÑ£ÍøgÆÿ¯ïö}7Å©h¦ÄQÁ¡c†b„1Ï9vø/Yþ/gÚ÷ïendstream +endobj +4774 0 obj << /Type /Page -/Contents 1731 0 R -/Resources 1729 0 R +/Contents 4775 0 R +/Resources 4773 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1621 0 R -/Annots [ 1733 0 R 1734 0 R 1735 0 R 1736 0 R 1737 0 R 1738 0 R 1739 0 R 1740 0 R 1741 0 R 1742 0 R 1743 0 R 1744 0 R 1745 0 R 1746 0 R 1747 0 R 1748 0 R 1749 0 R 1750 0 R 1751 0 R 1752 0 R 1753 0 R 1754 0 R 1755 0 R 1756 0 R 1757 0 R 1758 0 R 1759 0 R 1760 0 R 1761 0 R 1762 0 R 1763 0 R 1764 0 R 1765 0 R 1766 0 R 1767 0 R 1768 0 R 1769 0 R 1770 0 R 1771 0 R 1772 0 R 1773 0 R 1774 0 R 1775 0 R 1776 0 R 1777 0 R 1778 0 R 1779 0 R 1780 0 R 1781 0 R 1782 0 R ] +/Parent 4739 0 R >> endobj -1733 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 754.651 512.306 764.219] -/Subtype /Link -/A << /S /GoTo /D (chapter.9) >> +4776 0 obj << +/D [4774 0 R /XYZ 85.039 786.531 null] >> endobj -1734 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 741.102 512.306 750.125] -/Subtype /Link -/A << /S /GoTo /D (section.9.1) >> +986 0 obj << +/D [4774 0 R /XYZ 85.039 569.693 null] >> endobj -1735 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 727.553 512.306 736.575] -/Subtype /Link -/A << /S /GoTo /D (section.9.2) >> +4777 0 obj << +/D [4774 0 R /XYZ 85.039 548.496 null] >> endobj -1736 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 714.003 512.306 723.026] -/Subtype /Link -/A << /S /GoTo /D (section.9.3) >> +990 0 obj << +/D [4774 0 R /XYZ 85.039 432.613 null] >> endobj -1737 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 700.454 512.306 709.477] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.3.1) >> +4778 0 obj << +/D [4774 0 R /XYZ 85.039 411.416 null] >> endobj -1738 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 686.905 512.306 695.928] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.3.2) >> +994 0 obj << +/D [4774 0 R /XYZ 85.039 160.041 null] >> endobj -1739 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 673.356 512.306 682.379] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.3.3) >> +4779 0 obj << +/D [4774 0 R /XYZ 85.039 138.844 null] >> endobj -1740 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 659.807 512.306 668.829] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.3.4) >> +4773 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1741 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 646.257 512.306 655.28] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.3.5) >> +4782 0 obj << +/Length 2273 +/Filter /FlateDecode +>> +stream +xÚ­YmoÛ¶þž_aû ±"Š”, ؇,ËÖtIo7»†6([Ž…É¢'ÉÍòïïy£,;rîE±­ÈÃCò¼>ç0Q£þªQùNGÓ$ö#­F‹ÍY0z„•_ΔpL„eÒãùq~vñslF*ðÓ ÍWÝ9iàGi<š/?yWo/?̯O´ÖžŠüñd:M¼ÙXy×W¿yÿ ¯Ì.ï~¼ßÏß]Ï»K{b)­ñÊ¿Ï>Ý£%ˆ÷î,ðušŒž`ø*MG›3i?2ZæåÙìì·î,^3#Þ5¤¡ c?œÂ@~’˜!žPù‰J`8´_ib‚…¢ÈÍ´³ŠzR:õ£$9&4ÑÇŸ>€9.”ž¢-Œ7a“ìš|Lâ] ÛŽä¶|‚KWwØ:ë iú.…è`yQcrmKKŠf¤¤‡6äÄ$€¯Ë†¹_îø…Tüj!Ç\ÐPn3Jú@¼Enæ–‚œ-'e‹=æ6$<ÊþxôRÕ¬²\6v× 4C‡¸ocbi>¡‹åÞjÄØØ”oœ•¹+–`&a+e‘·šmÏGDγ¢jZæÍÚ$‡þêN©Å•&Þç²""áWRâ¥ZÑ +·vÜa<7êŠse¿ØfMCF´µÀØÊÖ8'³~ðbá9ØQ`õÚƒ¤áðm\«Ce²«WÚÛäî商›6AHT<"RÒõZ½†z*(,kßعߟÂ4c–ãØÀ%×&€Ïs©¼]zPV?ËE8 ØóIܨ)Š¤¨šôÅ•zCÒ5çõ\p`ˆ„~EÅO±¼³ëéÁ²ªaÞVR1ú/X”EÞY `¥±„¥<pÐ%2 úPÊDSõXZn*¤9§ mÎy’¡¥ßÐÓÂuøecÝCË9 ã±’&‘·»Îÿ¸õ {ìF¸͸÷ç^럮ék(ì.ö Gìª +÷ýçõ&¯øQ’„ØX°œ7ý×òpSî¥cÛ i¯øÛµ‹H½à´—62”EÓJø"øž±G)õ¡¡º”ÞCš²Ó8kluê­µÒ‡vìÕwGçô[ ’È7ÉÁc)–ÇÒû9Jq ”»¯!¿˜f9t¾Ðöjiô†$3ÐëD¯¿ˆz<§_DÔD‡­_°WÉoø²x¤0£r¤@âÛ»¯0yšQ3±v ê"c”×*u•My+jÛ¥TòËîè|ðî­Ÿ™È5€+DI(õŽ‚°Þê 1 œ>Õ:‰];Ô jãëø°Ïûôö×ë?¿ÜþçêòöËÝåÕÛ›÷ן•6³?góë;]íê:¯Zè@ÚÚ–³¼%"ÏpxÛd÷‚¼)7a[0ÑCQí3μ|óÃò *Ð÷ÿÑn¶´)ï þÑܯNø3˱{Â9#ä1`ÂÖVO8Ã2ø<¼BLt=0W íkÿl‡¾t~<Pbp[“7 ù'ÀÒj+þR4ðrýóÆ»íÞ'"[ÑŠÄ?Ù 4—/ØÆe^»<¦¶-oïÎ÷’Éò¡uô žük€Ÿ»ÙêKpÿò¹öæ}[n]ß‹‚Ã`@¨à^éGÂÿôôFœŒµ´÷H‰›zÀìÂ:#Ïu¬Eãî`£gKz~äx|ìäÒ†â*+ÊÃhÅ^ŠòZ¤‰> endobj -1742 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 632.708 512.306 641.731] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.3.6) >> +4783 0 obj << +/D [4781 0 R /XYZ 85.039 786.531 null] >> endobj -1743 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 619.159 512.306 628.182] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.3.7) >> +998 0 obj << +/D [4781 0 R /XYZ 85.039 667.526 null] >> endobj -1744 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 605.61 512.306 614.633] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.3.8) >> +4784 0 obj << +/D [4781 0 R /XYZ 85.039 646.33 null] >> endobj -1745 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 592.061 512.306 601.083] -/Subtype /Link -/A << /S /GoTo /D (section.9.4) >> +1002 0 obj << +/D [4781 0 R /XYZ 85.039 356.428 null] >> endobj -1746 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 578.511 512.306 587.534] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.4.1) >> +4785 0 obj << +/D [4781 0 R /XYZ 85.039 333.11 null] >> endobj -1747 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 564.962 512.306 573.985] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.4.2) >> +4780 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1748 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 551.413 512.306 560.436] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.4.3) >> +4789 0 obj << +/Length 3186 +/Filter /FlateDecode +>> +stream +xÚ¥Zëܶÿ~ÅæCa­‘•%QÔ#@P8›8hœÔwF +$¢[évUk¥¤õÞå¯ï¼HQû¸¶(¶(r8ÎãÇjÃEá"Ó~ òEš%¾Váb½» ùî&Š•¬šoîn^ý-‰aàçA¾¸{°|òÀ×y²¸+õ¾ýþõÏwoÞ/WJ)/Ôþr•¦™w» ½7ß~xÿöÝwx»áž#²°>Ùr§ŒñÖÜÕ´Mø|hZ3‹ûº9¥¡m€KÜiuÝáðgügV¥%"x&*y6"šë‘$¹ŸEÚ`„ŒøÕbt8¼éûn©¯®É#lž•g¢¹ŽI @•F$ÏÛX=ŠÐ¯¸ÑIÇ V*dœ<h¦ŽT9rÇžÀbÄ8 ѳT¤<ö4ÏoAžôÅXÓVaÊ‘ÔOÞ¡S‰Sã2÷jR,°9ÖÆb8hˆ:±?¶wk7[½slêOÂ$¥ëoq@z ‰Ë±¼8tDMP 6%“àÊÝÈí{ŠzbyÖ%9¢ÒTªyZf +ƒ:IS:/ù5²«yÎÁˆP¼ØèÆÉ'o~4§ > ŒýE IÓȳËì-nñ£\Õd/è H†gÏu ¯ø%ôf°åNæYEÀ¾Š8©b‡B&ÛŠ!û¦zœ‚5B1+LÞ£zºû¦ÚÉb÷YìêîÀq?€}4t1r‹|¤è-büc·A£ÕÃ.Úõ·7D7fÖQ¸˜äÕ-‹ÒŠÄ Êl«$(¸ï2pkŽ¤6kÌ»»¸»?&ÏÝ +A|l݈¡2Æ€wFŸëé”)IÍ´z‘ù"ººÈ0Òc ÓÅqöä×@T§ÊϲüYÐrh,ˆ†~®µ Z:‰ü Qˆ†^ˆHªïvwç“·np›U;2¢NS?‰™ ×à-* ­„Ίí-Ø,IÐj`áªF[K žq%rR<˪(¯©! ü,x>ëvh®c·ŽC?N2RÃ!–óò3'›oâ ðnNnáÌ -“mÄ‘÷ÞzP|OÞ¿C„÷Ã#¿þè KÑ"tw ©~€Á‡Žt7"a;ŒrÆdF̲z(T/¡56“¡¦£½CíýR#¢#êt‚ =ãHcȺ"çõ¡›OjòéEº©¸§kMø ó¾ÉšÙ3¤$â0Üt•r¹/(µþÄ$EY`ç(Vit}o±ëçK¸\–$ì`r6¬¦¢Ôà/½b¶TÓ> 5¡ ¢@ÓPns´Æw½'tÚlOÂýTA¨ +eãz®|w8+V ž‡±–Ü;$½ŠHSO'k]šÀ©¬9w³$ g‘=…ûEË›!Ò § ub_¬lw=ò’Z ŸÔTÖlWíz®8[wÀ¹Û@nÒãf÷7%Ç”OjEpüñnÛŒ`´ÖéúO¶,D&““!‚o)0‘ÂROù‚¤Ð¤>F¬HŒ{öGW½ÈÓ8<™¾×âJPÜ´¿à1f”ÙóY§CsÀc(ÁÏ<ÿeûĺ.!}è° ¨€l.da|Ûí$î´-T&#ƒr] S>€¸äpýëµB)ŸªøùN4×10:¦þþË2‹ÉÓ“Ã%PKR)wßÈ+y+Œs~Zí¹·¦òªþ\ããP42Õø?é{zPµ¸®Cƒî)§ÙÌÙ„âOÜ)Z!–ƒ=+^ LJY>y€ŠÊ)©ÇÎœ1)bçš·ÌI¯i(G›9% TîùÌ6x”óú¼Ôâ +GKîArÎíÎÈqåò p¡T{w³R,ÉlVÂl”ƒ+MM.e9Jš:âÓV/è€Ã½5É +NÚ%ºK‰\•#Ø«0#Áæ +€NNœa:å²ä%w¼ä „§—üºcüزÈtAýS +/²GP˜²U±‡0 +: ¸ß¨ö‚>.Ov¸UzÈ´swËÈWµ\Þ­ ’¼Z)£å©fÇ0ã{¤S‘ïÀ=ÍT ‘ANÁ¨c»r +÷^ê±®Â`ò_\; ~ÿ0Lçmì=>ýù'ãZ´¢c"ô²­Mö®ÍšÐ0±å™]œ,ȼŸØ¿µvCmªzJf{8‘ˆþÄŽ3aŠfóÉíìô‘ݧ ³þü’uÈ>^H¾îÆ1+!…À²úâÅõ“ž -Aðd_E™ù!'ÐNãñ‰‹p1M?R2xµ©Š 3 y ãö•œîÔ›–ƒFéima”%G¬0™!ö˜FkžÅt¾¬9Ó)Ã{yUÓSJ©L„˜n=¯í±k=5›õáÝÛZ}Ķšž†Ñ–UZn2p*¥?¢A‘CSrUX?HI979‰ž©ÿ@KTÕl6“;FW€¦"ÅÔï,¾E\Å«$_rWõÈaÏ9OäŽ_ªÈÉšU47¦+¹u†·jÑêh3Ü™xÊÜ@õÖH›l€ª“j´¾SáK™?Jgð9pß;hdM†‘Qá’­{¡èÛ¢Áàÿ‡x‰bêÂ\ DÚQ “1áÉALWÜ!€–Ì4±ÊÉ#^wpnC|•™8îrEmûK{ßO—dÙ0<]͉ײ…k᱕ÝZê¤uÉeOíøZÊj0éŒÜxMçû³i„™WND;bÓ -nÄ¥6âÒkДð@‡nr»HMÅû•«ëØùXR´RØÅ + Y0'WC{w¶“k<¾µÇ ǧéq0ñp2/!™6œœFµs-ˆÃçvŽCÇå\×gÁÁÏW»f¹äqè´Ê,§»GØœD +÷•È¸u’‹€!Z¼8Hœ{ùn‘Vr‹› f;À41i× +Áæ0ÉÈ•¶ ± ´®ÜaíËß`¦\ø5õêj¬yãè†Q&wãQ’C!gc ¿áDi`]Û,¶ŠrbñœŽ»©¹s+S¬0kRÍ5«]u5¤2 ° FâÁI±¿äÔÿ¸¹&Ìí.ÅBHÕl²8ì1å<Ò B˜òÌ"ÙÕéR³îeÊq[µÜr¨³ÓbâÍ/¶¦Æ7þ~™Ÿt|íˆ"ÁtÍÔÝ÷R›»kÏ«Zå/§z{0å¼I“§½ÀËy‚¢ŒßÛ^ó»Ye*"”§´‰¶‹À¢©™Æ.Oe… «Î-Í@ð®Ãä$ŠœÂ_¬.£(qr[|›Ê°O“[ÃÄê¿h[ùŒBÔtyŒ-Qz²‡ƒ$¸Œ¯ +ÅN¤σæ¦I…ç.•¸I=} ¸dØ™5äV½*ºŠ;S^S·ÓËWÈùäv˜úa-Vxg—ó­Üch8g¿æÇ_nyæìê`•øQªd¦“„š{wó9Á NnLáš{£¹ý¿$–ðVdüK…ÏPW—,Îÿ( Ã„+“Ó,ÊB'ƒªÅè0Š·0L%†Â_1Ç!cäÁ“Šr.ô‘VŠ¿KŸœijÝÎøŸï>Ê?É5œyt‡·»÷Á7.l1Îü,Í„nW´¼>]:p>}íŠLi?柮œÞÁ?ö¸ÿëg-Óíþˆ!º|ù¤£ÈB+ ݲÅÉ©ÄZe¾ÎÔ‘ÿ gO¼uendstream +endobj +4788 0 obj << +/Type /Page +/Contents 4789 0 R +/Resources 4787 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4786 0 R +/Annots [ 4792 0 R ] >> endobj -1749 0 obj << +4792 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 537.864 512.306 546.887] -/Subtype /Link -/A << /S /GoTo /D (section.9.5) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [237.716 727.875 359.98 739.867] +/Subtype/Link/A<> >> endobj -1750 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 524.315 512.306 533.337] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.5.1) >> +4790 0 obj << +/D [4788 0 R /XYZ 85.039 786.531 null] >> endobj -1751 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 510.765 512.306 519.788] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.5.2) >> +1006 0 obj << +/D [4788 0 R /XYZ 85.039 766.606 null] >> endobj -1752 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 497.216 512.306 506.239] -/Subtype /Link -/A << /S /GoTo /D (section.9.6) >> +4791 0 obj << +/D [4788 0 R /XYZ 85.039 742.055 null] +>> endobj +1010 0 obj << +/D [4788 0 R /XYZ 85.039 685.636 null] +>> endobj +4793 0 obj << +/D [4788 0 R /XYZ 85.039 659.022 null] +>> endobj +1014 0 obj << +/D [4788 0 R /XYZ 85.039 573.889 null] +>> endobj +4794 0 obj << +/D [4788 0 R /XYZ 85.039 553.755 null] +>> endobj +1018 0 obj << +/D [4788 0 R /XYZ 85.039 469.885 null] +>> endobj +4795 0 obj << +/D [4788 0 R /XYZ 85.039 448.688 null] +>> endobj +4787 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4798 0 obj << +/Length 3208 +/Filter /FlateDecode +>> +stream +xÚYÍ’›H¾û)ú6(¢…G;ÚžõîŒwbº7|ØÙh©Âz¹Ýo?ùef’gCª2³ª²²ò_áM@¿ð&KüÀä7›,õÞ”‡7ÁÍŽ0?¿ •"NŒŸÄ1k‡]§‘Ä›E=c½‰b?ÎbмxóöcÜDŸ¦ææáé& #ß„ÑMšç~²ÙÜ?+Ù€e¯u%Sº¥\‘ÆC·âÛ­åz Â¼†(+·¤1Ahaäñî{Z=O¾ïÉ­.ðÕUö¼™Ð߬¢Ü{…ðH(ëOó-{;ð´c”§Þ Æw];ÝË3° ÈÐÊ÷ØWl<û„oBÇV¯‚â3í®c6”Ê-;+¸DGªÀ:‰C(??ÄœIp'QŒ‹F‰·P‘ùý¾Þç“ðLL÷ÈYôCøÛöYõfïJ~ˆàN…H³Ð»³ãK•CÛ½ +qKêj69öåù/wXòî7™=âúüŽÕV:ÛW"N[òƒÏˆK0ùUUƒ+ù Oö°ÇûGiæõ•r‹]"²–êûs-6å(ÚC%£GÝ_¥=:9Ó"Ûà ÚîPLuÕ®è¶B³ÈÐûÁ!Ï5F¡'âE.yÞ·¸ò l:ÉÓ—™ï&®½¯Ðü8÷> b…Os¯áWv;åžbÏR¶!›aäJ²úÔ’g °†Ï"÷ø X±à€¾ÙR·}èú‚ðáíÂ%ñØÆÄеl²êZ€‚4ÂÌFÞÛˆÙ!’{Àΰ±sƒz„eÿ—l2ÿoœöDâ|vû&Nçþ/IŠ™óÙ¡>ÃÇ•!…$'Ó9_aRµ=ˆè}ÕTa̺xÍC»­ÈâDsÝG'†Ë|t†¢R0Ç8 ¼ç¢#;sNí™u t¶‘ïLäÅzh×ㆂƣáËÞ£‚Oœ oéö¡M~½—ó¿Øf;SXîÒA±“#§­Q˜D”d°: ¡[Œl>NÍO£VXvÇðqG,ÀØÓwv_fBh9ð&2­ (¥­-ûJ|=Å—¢NÝi0Él4I"~$“¼´•KQŠµÿמ‡ c¸ÆWq†ªóÍ~¶b›ì¼ˆ½}1Èè4ؤ‘·gviÀ1²’±\ôh!V+ï ”­ìõ„—hJç#Ã)Vâ&²€o^ªÀj=ƒÝoFÎݹ\XtäªfÍ·[/\o)’ˆ#]1EÏáÞxý‘·Þ šý AÇX”ÅÞ­¢Ø`i°›‡7Öa@ù*?ér÷ÚN `?•D¬‚G·ˆ¿¡÷[‡å’lÿzÊÍÌ%Ö#æR+Þkâ,‹èÂØ»sùËV"'‡°Z`|dËq`[±èqÛYP%Åö`;š‘d%BõÕí±†dBCŽw­A_pjõ² „f{¾…’³DÀ3Ѹ3pØ–’Ü k/jÊ}1ÜIþQ–pju¨Úi²Ô@%¸ö ßØû$²¨:6‘¼z$·['aÓ~òõ«l wí??åQÆ3n’™Ö¸W& ÜèØML“?JòX6å¸N©£¼B÷µœô+L‚³ÄbgëŠÜ\¥”JÅ‹ ÷ôq@ù¨¹Ê¾¨kÀÌŒðU(¦¤g+#И?8V+ácëHEuû|Ðtn)!`ƒ3ç˜x1bòhüˆp~¶ìÚ¾}dú®œô±ÿÎjZïÒNz¶k)]Ж+¿1ÀÎh®'$"?Ž\i@åÙ”#q]v4`1– L“ÒÌínMN£ù!³Éõd€ò2?H%aá°Dˆ"°?Q6„êÀEãâûÛØ*ÎM’ÈJ@bå±›Ç9ìªU+dÄ^ux®[uŽÀ²¾a/°cpÕ¸grⵞ!Êöâì…«è)ô—cYǵ`%¤ö(›ŒÃÿ­ RÇúm6“•8r2LµŒ3ZÆ+Ì‹)Ñ Ò)Jê»Ä`)nÒjÇžß/ Ð(wj&ó§"gR±ØKàU;AqÖF²§ÜdW ¨ív\3Ú^tQ õ;ËÛhöµ9I.®¯Öi’{ï¶[f_dHãUÃf $XOâHŠÁ=o#©#»Ì…ºú¹àº!‹fåx†ÇÛµøæhª€A0ì×# E4»kPÈ´K­ÈÅ•‹ +LY^©‰¸î§%춪©¨sg¨q$8 Kï3t|ëϤ÷Ьé­Ë¬Ó--†\H"ï¦Ï†¡zFÃþÔž•1 Ñêza}Þ©1r%üÇI]©n5Š¢§íL^Š`"™{^Ì©à×âšÁ«@ï«îÛxS® ôîî^êB&<­ýᬑ¾ÿªºÇétÎdzÙhì}Õ”½ïö21LfõfÀa>¢‹E£P 1Wrë¢tZÇÅÎ<÷CG„-Ì`ÄÚB«j{°s§bŒj i<¬…Û)V<{6¸ºÝÙÊõ³â˜œq;È!Õe6Æ»%%„¸çwAd’Ú ïÅ·.Í$†SYòbëÚµ3—\V_AŠ„N,–ô–¾ ?ÂÈäð£Ã«R¶“Õ5|IÞ{¯û´µ&‚”ÑÙ©Víx´…zLB4 +/É3P‚D¨>dzåáoµõÔh fµ,«´e£=deó¶“lt5ùÔÈßò§‹þ§Àåq¸n?,å¶@œ+äªó„Ÿý#Æ'³¿£AÓ6kªUOÚ°®ª#³ÚáéŸ#X3MW’˜1ÀFY"ugñ<{Öö !™ÈõK»Jgx#ƒé¹Gë'ªºâö;¦%_VŽªûýÃÝ­À¾üãÓÃU#¹ùöË>p—Àø™ô¥ÑvÒUs0²­ ÏÍ)–Þi|ö‡H—µ;®ÙÂÞÇË©gžùôàÉÑ-õ?6'ýÄë}Å‘ô²¯hã§Ñ¸÷@ãÍù™‰Éü$3?8ô/VvÒžendstream +endobj +4797 0 obj << +/Type /Page +/Contents 4798 0 R +/Resources 4796 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4786 0 R +>> endobj +4799 0 obj << +/D [4797 0 R /XYZ 85.039 786.531 null] +>> endobj +1022 0 obj << +/D [4797 0 R /XYZ 85.039 766.606 null] +>> endobj +3018 0 obj << +/D [4797 0 R /XYZ 85.039 672.187 null] +>> endobj +1026 0 obj << +/D [4797 0 R /XYZ 85.039 578.47 null] +>> endobj +4800 0 obj << +/D [4797 0 R /XYZ 85.039 549.735 null] +>> endobj +1030 0 obj << +/D [4797 0 R /XYZ 85.039 409.231 null] +>> endobj +4801 0 obj << +/D [4797 0 R /XYZ 85.039 379.827 null] +>> endobj +4796 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4804 0 obj << +/Length 3457 +/Filter /FlateDecode +>> +stream +xÚ¥ZKsã6¾ûWèªjÄ%>÷æŒS;ά­Ô’h‰¶¹C‘Z’ÿýö )QJÕnMyˆGht7º?4.ø.²Øt¾H³Äu¸Ø쮂Šôüã*Š•¬F4?®¯þöS-ÂÀσ|±~¶óäçÉb½ýÝûøóõçõíÃr¥µöÂÄ_®Ò4óîî¡íæ×eè}º¾»çÎõrzK•y¿=®¹éáöŸ×Ë ºî~½âŸï>?.ÿ\ÿru»¶œxµF¾þsõûŸÁb {øå*ðuž-Þ øaž/vWQ¬ý8ÒR¯¯¯þeçâ¾hÁ£æÄëÌ3}*‡0É! •¯CµHãØO¢”Ñ•u1TmÛèq§¯P¨ö–+•&Þ€µ›hH gÀ¯"ª¶Þö\^‹Á”Ì€Ž *Ñ^%dMËßj·‡Îº*·2¨;˜Õeš'\Þ+”úÛ‹c&†×’É°ñÆÞp½h¶Lñ#vüó·[T +h¢ürÚï¶Ý•Ý-è=Š"¯*ÿΚ‘$‚lú×jϤZG^Ñ•\(¿ó6(4Z 8q;0Õ€"(š¾ªo¸‘Ò'vDcžîË7à[ÇÞ€‚¡Ÿ`ä#¿ >`z˜ñÖs³ +‚€K×7BÙ—äeÙU$ºwîØ€v¡6”ßMÁõD]X~Fn7F °ѪÙÉ¡—Ú¼Åô´¹ÕÌîHl*Ë=§Îvõ†åËÈd–Ê…a Ü–Ïn£P?*÷®kZ©E³ÌS¯¨k&D-Éތͭ°À2YEÛT›YÏãk]a÷S‘òYeÆF€‡»FHÌòÀÛ4¢ÛYL›nŸÁbŶªcô7¸éËÏwë[n¤E·\þ하é^Hø,ò™'š,x]âq`Ê/$‰¥`3[ +¯¶åH<†»Ó#¬Â–“ܲ‡e{¤¨F«ì°© Ua­( ¼×÷ܲFsÁ"É Xe*8 `5e‚Í€­5Ì`¾°4¦£ +´%«™ŸËb8 êh¶ç™-ˆ(aÅIjL½Çb‡ÒyBk_i$Ò$EÚ ë’Š²`Ïæ@ÂŒ"æ–ŒYºï×wö|îê’Ûï„kã-7LmΕ̂ú9ÝJu4G»gçØC‰Â +”÷V‘D±V±8cØ ñK$¦(ÀwàÜ›2d}RÌ):@$ãÈwUâì¸oW4‹D~ítcŸÙgN<\Æv-—äŠ4ˆ/Twûòùœ¨ÌÏ‚è"|ÑPØTÐù:JÆa3ožkb ƒ‹‚½x÷$vÈX’òÖàkmE|¡ížî+I\ä $6¬l›?‚0z9ðØÍžÙxZèË»r4çÁ@œehSk­€b +ÿ94•“{;¹‚?û¢§ °Õw[nu2Ê$@·ßùÀªâ‚ wÐ&iT%è4;‰ÂÐmR`®¸À¬I…Ì ídÊISŠ¾ÝÄs×›‘êB¿¸•|ïj#dZ)´#Êøþ]tB,Ðã×Îd`0ˆžÃÅ:Ï}o—ÀŸ#9Šu–úYžOP±úŸQ1C¶Sv|–€ äŒÑˆ(ç€éa@1zT€ý"fp‚Ï%£Iöƒæ—.ºyuÛ ð)øªË÷¨ÍyŒ¬cíë˜Y¸Æ<űÁa‹õGè/(7qfÃÈQVè}冶©ß¥kœ˜¥¥¤!á´ã,,M’%ù1Lfä…à @IJÃÄ3Ï:—*öû%'"лx†£0Cót.À%±k’«ÂÎIy,%çL£0u|<™9 ¢Ö.×v;»üàæ3 ¬áŸ»œf01?8ÎBfÄË–9›±ütÍ%ºµ›âÂYŒ:Thï~Q˜¦4®©Üuãº[å°)Ï!lœÃŒìH¥Öîb>ÍŸ +FXi„G0Úr®»”AËÃ|¦—fSÓÇœtSWtùÊÕVšç«2gÙ_…þTÍD~š´½V’y†xe +:Hª‚2ùX¥¦pÑí‡f… +EøZhh®§µØçéŽBðÄ>Ž¡1¹¬83˜Ãàf ± +,!@‚Ëï {¤jÞ›ö±r,ŽŠoÎäRH£(ç9:fŒu(<=µœÝÁ®4!ëUz›b'%Jv»,öqI:~'‘<¿éÐF01d²G¯.ç4d¼€pGÛÑÅ0wÞ§^æ\ÌT1ÜLôåp0¢9Ÿ,T¢&XƒDÍH’…6Áקˆ‹ÝSaR„+8‚ˆÑêr”?r‘r”6<³ ßðò“éˆæ|TS Â(ÊÂSv> ûpœØ \ííÍ) %û®‚37 -­©a¥àÏsQádæ Ú¿Rø“.Þáe(#6jVQó[IÆIójrÊã•ûRz{8c0ôPy¤“Ôbj~‚éFm-—÷Hù,JpJ-<@µ/:ä¿Úíï)~ј†“e§éQœÝùå4<—,#LväÇç2'sN] çcúž¥(’ÇceLHÆbÑZÀä™N;ïGî£0úœ$Ž!晸„ÍrzëVò¿Î¡ÐÛb–Þx¬ý t‚¾rn4åpö™õÖ½B…¼F:¯ƒå}GéÜþ†Á*§{îÞr4ÝtÕÓÉãtGaBrÔUÉðñìxLÑOYéÕ%”}Q.ž¸rS#pAØ•[îz«†×³¯_Hr.)‹Ï_ô¢Bï`"Z“ŽTÂç—¾%Ó•Í¡ä‡פèäÉþGÉcÉcó¿-ƒJ!lpö†T:òHÒ˜÷ÁS¬c^î5ˆˆµîäñ:ôkö +娧.‹Y|ç6>ÛíÈ*1ÓR<($ÅmM†™æ`~Ó°k9ìäBk9a~±iíƒ#€Ižä‚·Yõ|üJë"äZ« ‘½¢á?ó÷ Öú3½utû“ •ÔÆâ0F2ÅÖ¤L°JÇïý¢lúcŒ†{Æïo8¾’Õö|jÌYxÿ ï +G—…÷­êèxïp.P‡¦Ë/Žäüå6Ëý8P£(í^|( ¯ A˳7éþ_Fx&Ý鮫“\ß ÿp©Óì"ÿŽä||N2háð|'y-rÜ[Nÿä‚Œr±ñÁ$©L>< G oâ÷~Æ_Ô|œ·gÈå¸t>U¥$ÀÄFÍë2DÞ> endobj -1753 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 483.667 512.306 492.69] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.6.1) >> +4805 0 obj << +/D [4803 0 R /XYZ 85.039 786.531 null] >> endobj -1754 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 470.118 512.306 479.141] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.6.2) >> +1034 0 obj << +/D [4803 0 R /XYZ 85.039 628.804 null] >> endobj -1755 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 456.569 512.306 465.591] -/Subtype /Link -/A << /S /GoTo /D (subsection.9.6.3) >> +4806 0 obj << +/D [4803 0 R /XYZ 85.039 599.4 null] >> endobj -1756 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 443.019 512.306 452.042] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.9.6.3.1) >> +1038 0 obj << +/D [4803 0 R /XYZ 85.039 571.365 null] >> endobj -1757 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 418.561 512.306 428.129] -/Subtype /Link -/A << /S /GoTo /D (chapter.10) >> +4807 0 obj << +/D [4803 0 R /XYZ 85.039 549.504 null] >> endobj -1758 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 405.012 512.306 414.035] -/Subtype /Link -/A << /S /GoTo /D (section.10.1) >> +1042 0 obj << +/D [4803 0 R /XYZ 85.039 399.12 null] >> endobj -1759 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 391.463 512.306 400.486] -/Subtype /Link -/A << /S /GoTo /D (section.10.2) >> +4808 0 obj << +/D [4803 0 R /XYZ 85.039 363.917 null] >> endobj -1760 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 377.914 512.306 386.936] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.2.1) >> +1046 0 obj << +/D [4803 0 R /XYZ 85.039 255.733 null] >> endobj -1761 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 364.364 512.306 373.387] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.2.2) >> +4809 0 obj << +/D [4803 0 R /XYZ 85.039 224.208 null] >> endobj -1762 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 350.815 512.306 359.838] -/Subtype /Link -/A << /S /GoTo /D (section.10.3) >> +1050 0 obj << +/D [4803 0 R /XYZ 85.039 103.45 null] >> endobj -1763 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 337.266 512.306 346.289] -/Subtype /Link -/A << /S /GoTo /D (section.10.4) >> +4810 0 obj << +/D [4803 0 R /XYZ 85.039 80.132 null] >> endobj -1764 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 323.717 512.306 332.74] -/Subtype /Link -/A << /S /GoTo /D (section.10.5) >> +4802 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1765 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 310.168 512.306 319.19] -/Subtype /Link -/A << /S /GoTo /D (section.10.6) >> +4813 0 obj << +/Length 3468 +/Filter /FlateDecode +>> +stream +xÚ­ZësÛ6ÿî¿B×ëŒé™ˆ%HðÕoNÒ‡{‹åéuzý@‹´ÄF]’ªëÿþö”(§w—d<Äc,‹Ýß.¤füW³,öƒ(Ÿ¥YâÇ‘š-·gÁl=ß)¡˜ ÉÜ¡y½8ûêÛDÏTàçA>[<ØyòÀód¶(ñÞ|ù~ñ͇‹yEžJü‹yšfÞÕ5´½½¹P޻˫kî\\Ì•÷á"̼»Û7}øæÇË‹ º®n®oøû«÷·¿.~8ûfa9sxWQ„|ý~ö˯Á¬„=üpøQžÍž ø*ÏgÛ3G~¬#©oÎnÏþiçâ>=ãQSbˆ£Ì³èX*vä TèG*œ¥qì':%AôkØ@Ñ¿‚å‘÷ŒûlöPÉoYì° ¼=t(†Šë4FÊçÔ±Åq÷8Õ»§òœ'Ù÷õšë)žQj ë8K¼7mUôõnÅdýÚÌÝÚÕz^Ey%ӔͶ¨w\.–Kìix‡S÷<¼îð @(s…2Ëi AÕ>‰Î¼®ÞÖ›¢ÅJêõ 7.n µàF——ªä®-ÖŠ%θfX@[?ËfÏÜÀ&u–z·8ÁããÅXo€—:H­± Qh·ƒÌ1AŽFbkO¥d‚Á4œÓ®`ÜUF,A?kÇGò2Äا ãåEJcfØÖ ^Hl¢…Ú’»šC:÷”st¤/î ÉÆF—‰9LöÈX€+Œ…7G~•ZÇVëÓ±B]<}~>ê~ßsŸ=_šIžÐümÅýýºÊŸHèeC4¸^ð—õ©¦é¹•f±[½lÛ¸ —oZ9¾,ö†ë_o¸%åO‰ƒúY.L„>¡Ùl˜Iñ à hvˆNòüP߀`=ɱjA[õä[vS¤Ûó²oìaOÞàöàtœ§¤Ñ¿á9caÃʇ]¹@“Í`v°ìè% +ë™[Ié4Ý9¡Û™-=É\F¬„܈w¸ÞŒìztµ(cmÛYX]³u)«G£QŠÖ.Í]ÕAâ5;þŽ¼560Ol ”^Q±DE®_±S2è©A³B2¾cçÓàzJYê‡êâ,–¢2¤ÞŸØx­X@&@­<æf T$³]"$ÄÃßä¶?²0ìïHß“ö‹¬ÿÄåÝH„ =såX­å$99#ÐïGÿ’ÌQ¶l€bÉD¨m¥h¨k}!Êœ‰ù1Ñt’5M ·ÆTo(‚j€<2~vb1bd…]îáÒ~2dD€æ+ÌòÁ‡Yf¿C Š¤&vÄg'8QžZˆ½f78ñاl’eNfAad”hšz+%„DrìÁwé¢lñêZ¿wÔ$ó(û6ŒŸ©àQ=pŶÊø¼g–!‰$cßg\/¹Oj­‰ªÙK çÒè]YYè¹ÐŒGR¬Ï¶&“ñVœAÑhüB.(k³t¹‚0FážXV%lA\Ru€GÈùaK®þ-~UNܶ3G‘E=Œ9Áû'r`Qùaübún ¡¬šEÓÉZE™òÓƒQ•øMBH·<ðn dçÐɉŠ è)QQqE +€½§©÷–Ôi‹:Ê7fj²ø‹›hNçÞ¢œFJøUCHZ¥!hw_ÿQ÷µ¹ÿ4‹AÀrÇF¥z"<ŽÃÛM•+%&ðrÅ¡Õ+β z{nr2©½ž{ÇERØé$«R5²kSfÙmÆù$…!$G+‘,–áüРÝ3ÄÄ–÷o¡ü˱g¢c(.¦Ñ¹á h¾˜Æ56£ +±Æœq߀ˆ›aИy@‡]%áf±áIü"1uàn$L6$8©üÈ°8Îß÷µõX„˜S`'.áK)“ì%k£™Qh·ž Û(\¹RŒœ+”›ÝɨԊá\²ïa–·oØSOç~,öl +áœ×(R‡ÓÈ3ù ,ßQv +KïÈ€a12ŽƒÁ³KÅy‚â¥zzÔ#ðÌŒ\N"40+* ÿ2þ‹ö˜$Ñ«)$ãÇéàcS†~v`ªÊcgÁ†zjá$ö#»0¦šu8D |ÑÃl÷þD)Ù=‰ùt˜Ma¾( , žÀ|™Ÿj#«¤BNƒ· Ó`/Iü»Ã3ÎüÛ…»£Ÿ,„´§Ïá™ëeC\Ä}.×7?Þ|â¾¹>â/Õ~’&Ÿ‡?™ëü¥©Ÿƒ +»üÉoDÐáãoDx¤ð.Í? f®—yŒíkçÔð»=ú€#-Ô Oá?‡f®—9ÔÀjÀº.‡—xßÞPÀ€?·¹»^pì@W‡PF¢Æ¯ªl4óÈOóø0ȧ E’ŽÓ,«áÇ&M&é ödjLWt‚/1Ïg~híhôíðN¤F1çqøq¤cÚ!c˜OÇiIf¹i«¢|%£Ñúà1’]p¹vÐËN6„Žºìž ¼C[‹FPàÄb½+LäšÇOï†è©69Ö0€ ŸÖô["äÎÃ*Œ&ŸÔ×C(‹¯"“‰;zâÌAVÅG&Ö +üÌY’ÀÄÝ6IòÈkÙ<?æà‚éðÝíJFÚmôòƉªò±CàŽ0#ˆ'S ïÖtF›’'²ž†˜\O¦è”ö#e"¿[αM½`–?{!™†)½ÔO’±Â¿iv+êý~ˆ þÆhðg4𴹿ЧsÊ@i^±î7w€û´‡ M'²f±¯ùÇo‡I3øã ý_?Œ³©7ùyN›Ÿ8 ýPYf(}¨óCŽÍ/èŽYþzÝÙ.endstream +endobj +4812 0 obj << +/Type /Page +/Contents 4813 0 R +/Resources 4811 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4786 0 R >> endobj -1766 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 296.618 512.306 305.641] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.6.1) >> +4814 0 obj << +/D [4812 0 R /XYZ 85.039 786.531 null] >> endobj -1767 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 283.069 512.306 292.092] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.6.2) >> +1054 0 obj << +/D [4812 0 R /XYZ 85.039 393.25 null] >> endobj -1768 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 269.52 512.306 278.543] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.6.3) >> +4815 0 obj << +/D [4812 0 R /XYZ 85.039 374.682 null] >> endobj -1769 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 255.971 512.306 264.994] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.6.4) >> +4811 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1770 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 242.422 512.306 251.444] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.6.5) >> +4818 0 obj << +/Length 1910 +/Filter /FlateDecode +>> +stream +xÚ¥XKoÛ8¾ûWè(•"Š¢§E¶I[]'›¸ØCÛm)¶P=\IN¿ó e%N‚ÅE#r8Îã›áРàŸpRå2s’4ö•ΦžÎV>΄áð ‹7áùs5;ûGŽü,ÈœÕÝ(' |•ÅÎ*ÿæ¾ÿt~½º¼™{RJWÄþÜK’Ô],vq5î_ç‹%/®æžpoæaê~½]1éæòËù<…¥ÅÕò˜?-®oç?VŸg—«Q³‰îBJÔë×ìÛÀÉÁ†Ï³À—Yê<À8ðE–9õ,RÒW‘4ójv;û{”Åk‘û^rCÆ~˜À žð?'UF¾xé¸Ýé'iøªÚ€î§RزÍAk˜%n±±;}Áb¬àDŒª)Òº>ôÈ<0žw¸ u“2rºr0C$“ÐMûžÉ¨=nvž³RM}$Y ‹ê‹MW ½?äkæ}âÏ8öciY¿"ª +ÿyÄ£Dø +Ø'(úÿ˜DØ‹,q<Ü–ý^š€Ï!ç$|…ŸfÑ›å)Ž•-„ªV#_‚›(8Qbù"áAIRP”T”¹ï Âm'2NÜË¢/·ë_)9VÌ›úyåO"hõ 3? CÒgÑ ”†¢ËQÆf‰ÈM¹aÁ˜^sÊáV” +eÛô„ì}Ïëý®EÔW9o^^­˜n@Ì= E½ +ÃÔš“šb@5æÀÙv?MBÿ°£¤ÝS¸G©h˜!Z­+:'!ü=æ-Lú@Q’ ´ Ÿb{¨´™´‡Ao ÊØP°dV-%ÕXÒ ×h{UÒâ#S5*“ó|‚IÀ]÷”³3zþDbñø‚e›¶áì쌉”Ã%D9Šá*Gûr¡"¿RSâeKËÛ#kÈþ+ S˜*{džô“ºÏ S Ø"Äôˆ|ÀÕ ¦Xªÿ±[œ#)Lf _ÈuST€AJ€!by}Ùlyx«ëµ~ÍH(="MÞ6òÈóz&)ú™àÎãKÉÁ„ãCåÖºáx§‘ûI±»Àß¼.›òžŽÉ5bŸh(÷ø1‚¾œ/{"›ƒF†6„p·[Fêή¡# +ð<ò —+–wLoœÓ[#¢ ½½P‰¾>BÈ‹ P«â0Ì"ÎMå–õ¾²"kú;Ɉy$…š/2Š+ʈøóh\ ÉÛézÛšLhZNLšÀU“{³ °ÎÀqK5ˆ¯<ÍÁÒƒ:ेh±m¦Ë!6§.ØÛz&ÈgwmWSZ¡wÉÇ¢GpB¢4!—tÿ“GzË©ˆÈHCwmp²(Ùu†oÁT®E‡Š« Rpx„_ÂVáÍ ¢n!…Áà’d0þ­Æœ|©"‘f]{ØšÔkÂ,VÍåÉã…Æô•›®íÛ;Ó\ãÅ{Îc"˜yØ·6槂ÍQ(ŸÅ7€ÕXrà +¡is˜Â.*ÁßÐE­µßv;äè¸\k$å6¨¸°¤Ç‚×s ¯ŒTyù~¤ÍfDqÜÓe¦±ÿ“Y‚ªÀ7uq§…4Îù6lˆ¬ à €UÝðÖs¢å8} Ûr²À9Æ(CûÇÜ‹åÈ¡1Úõ#žö?u72’M‡ÓÆ2ËòGfAç6¨o,f!×£gèBJÑÝe¡³n~Ç‹kº.0(c |4õÖ¹šÖp1Ç2a+m%ƾÂilÌ&m +15´G¡=ó³n]ï¿:èlè癳ÀxCO9ŠMÁ®`D†‹ÍŠ•‰J±} f‰¼g&*Ò<;¤y/pÀH=@Ág}T 7\ãž {ºý¥Ä€Âp1¸Ô¤/<5ôµ$à|ïÆ÷Í7`jЪªh¶¯×€ë4º7"öÍ–û2/žÔóö)ª½A&Í﬈"'LÑá?íƒG›5>ípRëQ^ÄzN“ÂôPÏ0êí»sÏ€ÆUÝÚ×Y„×Q;©Ìƒa¢Þñç“š)ðŒæAÏyë{è¹á 6÷’0æß3vÇãjmemô`\MS¼\ðkz†Á@á¤NqÂ>” ãÙä|å„€Lº7ãèˆ9$êµ¹fBèÀŠÓ«Êg=Ö¯‹‹³‹‹žgwØ°£¸ç+.ŽÈ®³mGíÂÍÆj~;ÆÕèe¯}lÇ\Éé`ÊÌiÔn-ê9ðŸ®pöÏêÊâÓ¦oÐ ß)U¨:ÁeÌ.ƒÑ¼tYõ¯µÚRù?Ÿ7¡ðŸuû­_—ÆV6JýŒô9ídUú¡•¡n]Ï5V2õU*_Pù_2_±endstream +endobj +4817 0 obj << +/Type /Page +/Contents 4818 0 R +/Resources 4816 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4786 0 R >> endobj -1771 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 228.872 512.306 237.895] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.10.6.5.1) >> +4819 0 obj << +/D [4817 0 R /XYZ 85.039 786.531 null] >> endobj -1772 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 215.323 512.306 224.346] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.10.6.5.2) >> +1058 0 obj << +/D [4817 0 R /XYZ 85.039 665.133 null] >> endobj -1773 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 201.774 512.306 210.797] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.6.6) >> +4820 0 obj << +/D [4817 0 R /XYZ 85.039 643.372 null] >> endobj -1774 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 188.225 512.306 197.248] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.6.7) >> +1062 0 obj << +/D [4817 0 R /XYZ 85.039 587.459 null] >> endobj -1775 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 174.676 512.306 183.698] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.6.8) >> +4821 0 obj << +/D [4817 0 R /XYZ 85.039 564.141 null] >> endobj -1776 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 161.126 512.306 170.149] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.6.9) >> +4816 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1777 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 147.577 512.306 156.6] -/Subtype /Link -/A << /S /GoTo /D (section.10.7) >> +4824 0 obj << +/Length 2511 +/Filter /FlateDecode +>> +stream +xÚ•YYÛÈ~÷¯‡P€E±ÙÝ< $À8ÞÙ#pÈL°X¬÷’(‰k‘HŽ5Bþ|êjŠÔP3cöQ]]]ÇWÕ-5 àŸš%Öt:‹“È·ZÍÖå»`¶ƒ™ïß)¡0VûÖhOL.Üì" +ýÀÄ“4²Ç"oƒ4ß-ïÃ`~éÙãv¦Tèk΢4õmÏ7¿y*öç k특òªÝ|¡£ØËøó†ŠuS·õ¶ã‘OE c]3_À ´VO6ó NGÞ½?äóßñ SD´Ýùíò’)™Ež3Ûºâч¬\e¸òÝwýùäxQ g±zJ¸öu¾ªžÈÄ~˜¨¡z”ñµ‰FêÑÀ(Šœz*Ȥp0xyÖ=59Êݲ¸Yµaù?æUþ%PçºöÖ„õ«2^hHFeg*¦#ƒÔ”&÷ ­÷ mÕ’ 6WOh(4Œ w_rn‘¬äþ—ÀuÃíO÷°F÷M=ïZt“·¼QÆs%Ù/«d´ÞâW{$A~Ìš¬C)СºÛËö‡zW¬³ƒó…ÞÒI¾ù hÒˆy¥Ö#’/±Êq.«PžßxRš]wuS¸Žv{1¨ƒÚ`Ù™n‰6çΦ›º,”‰lM*…'š¶=îQ)gÇŽC‡z¾€™uÖuÕögyyT·"!L{MN¼j³Y÷§84L`Eƒ0P¹µŠqÂÿêæ+ø)º÷#7± ëÅÞIáÉÐ0½G]íö¹t3¤û6·Ð*p]¶*HÑñAí½gë‘%³¾œBØ´`„l—O8>’áXa56£Öt–m¸µÊhëjMNƒ#yGÊ÷‰¡„Áëý<1t¤0 ÁÕø€%iŸÇ²|A…RØÿt$ï¹ÓäÛ\ÖvõuȆièÛÄά5~¢vq¢Ù Å¿Ñë¨ò—á{ÍðÕL§t(‹òlÈväK8…NQ’¢+4HÇ¡ÕR‘WvÝæ>,—§Ó‰tW:üöÝFu¹ü×ãCÞ|Cz1Ÿò–̺]n(äOF,¶<h²-`ïºÀ¿ºæ¾èƒuy‡kK— ªïñÅ&÷³öøS°h¬Æª¾†G¡y]ÁלPÁì<‹’‡¶ì=V€Ñ2´f¨í§¡šqV£ë2:„ïûÀb‚®–qÈ¡<’ñ¢)Sô:Ëy†Lçµ÷ŸªxæV pœ)<+!F€v±Ëlщ‹‚f ‡Üb"DÖ‡"ËbL’–¢­¹à‰Æ¨SO-Y{Ç Ð¼Y‰„+lÝ ÆG„ d¥^^e+ñì>|þ¸Xe¼ %Ì„uƒ- ƒMb0G]I +Ø9·Óqà¯89÷ ¢} aû¿ƒÙ9b»ÙÎ%s§(¨ò0T:F#ÿ¦®\à gy”X‹C‡Bª”J%½RJÂáHkxlU‡°I˜’„p4À˜²¢'d5Xš\1<Ë|×1p*É8º;Ô«BM¨ÍˆÈa +¢\£+1LûA¬ÞÀ=G½ß.[jU‚Å„^éìr- ¼j,Ç(0Å{GÆu4ÚŠ6§£`0àW9'i–÷z„.P~¦1l<Úråƒ{n™n´¥I|cСÿ\ôCŽ6J{¿R¤<ñvNüÅ®¢b%ga2þ´{Œmi3J°Å`ÚdÌ]ŒÝør¢ G˜ç$LRöMªéådG;àhòçÜ&„òT=31ì¾å6Žz1 ŸH—W<ñe˹¨e¡›¼A×RÁJÆc©®œÈѼ!Kù!\/†²\»Z7L½;– Ëq²¨°íu<…âMÞ–usf:J ‰@!h>ã.ÆJ+6´ŸF#|b„Hï@¨ý.MÉq”¡¤:âVØømϼ+ð@×=¬år†¢ú:—:4¸TÓ¸îÈ*\¢¤já=ª qf ƒ­„Bd¬à4%6$ËŸY™GJï'ÊHE#5É™ + Â[vM”gE FD àÈüã©Z#ø/$„Õ€ÐBä+„ŸÂºgâ“›mûAj_%ÜÌ8 …ºšàf0ÜnòjVtâýžd]ˆuJúhÆ‘«ËÑ™G³5 (äR¡Mý$œ¼ž„(h ÛþiU6g(ƒÛÞ/½©+¦š,NˆÑ¨Á¬ëÜâòØñrª¥àË·.¹ =•%éSò¥ŽúÀò>AÏÏS.Dú*§É”`,v}q¢u_#õõ„–›èU¼“±Ñ}—`±F‘ã8Rs9I,eÐû ? ”­ ¦8J5áÒW¹ír:µc—S×.gF.‡õŸTAR~œ$0“€Ë5yÿj¦ƒ'j¢þÁöárÊ+ÇõLã%•f€9ºL 2Wë%áUý +kš¬Úõ/UÐï/îØù¥¨¸˜¥:”E©}YÞIFS‡Að|³´ý!ggùëÅ–™˜ÆŸûò´UÃ_y7¥@ßž2åÌxt¹yé3®¾Ç_$”òî-æ.ضª¥ÂN·§ÝZ©’KAc`æ,ÄCó[;x‘°‘$gh\’+†e Éx®ú,„1mÊÏç«A­†[qÞ,ÞüÍDC¡¢G¿ùÜüéäBúòþ¦íGaÏŽ~ܱêzO 5¶Mô+›þÞÔËendstream +endobj +4823 0 obj << +/Type /Page +/Contents 4824 0 R +/Resources 4822 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4830 0 R +/Annots [ 4827 0 R 4828 0 R 4829 0 R ] >> endobj -1778 0 obj << +4827 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 134.028 512.306 143.051] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.7.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [291.589 551.093 894.567 563.995] +/Subtype/Link/A<> >> endobj -1779 0 obj << +4828 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 120.479 512.306 129.502] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.7.2) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 483.953 163.096 495.643] +/Subtype/Link/A<> >> endobj -1780 0 obj << +4829 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 106.93 512.306 115.952] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.7.3) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [222.168 470.404 274.124 482.094] +/Subtype/Link/A<> >> endobj -1781 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 93.38 512.306 102.403] -/Subtype /Link -/A << /S /GoTo /D (subsection.10.7.4) >> +4825 0 obj << +/D [4823 0 R /XYZ 85.039 786.531 null] >> endobj -1782 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 79.831 512.306 88.854] -/Subtype /Link -/A << /S /GoTo /D (section.10.8) >> +1066 0 obj << +/D [4823 0 R /XYZ 85.039 766.606 null] >> endobj -1732 0 obj << -/D [1730 0 R /XYZ 85.039 786.531 null] +3019 0 obj << +/D [4823 0 R /XYZ 85.039 647.281 null] +>> endobj +1070 0 obj << +/D [4823 0 R /XYZ 85.039 647.281 null] +>> endobj +4826 0 obj << +/D [4823 0 R /XYZ 85.039 622.563 null] >> endobj -1729 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R >> +4822 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F11 2898 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1785 0 obj << -/Length 2200 +4833 0 obj << +/Length 1457 /Filter /FlateDecode >> stream -xÚí\KoÛF¾ëWèÐT,—»$wOEj7©ƒ&p#¥.æ@KŒLDU>âößwf_¤$&~H¡mY0`Q»$mη3óÍcIúü>\Š~ÄC7 ¤?Yô¼þ f^õˆ>Ãë3× œúeÜûéeè÷‰ç -OôÇŸä)ãéç$[|ú(ǯ{¿Ž72—…ïòOïÃG¯?…?ôºç¹Tðþ5{.¢¿è±€º£úû¼7êýaï¢æX_]Õò¿™'à_‹úC깜³ÖsHèÒnbŸÈ÷Zžˆw0Ìyÿöì¯Á†‘s> ÄIòÁ8‹qÒ~)<8̆Î/8žÂP‰…Œ—SuíÎ,§Ù€zÎu¡ÆÞŽÕç ¼`ó“¤Ð×8åmòl®~Çë‹m¹RÀM€,äèÁ|ÖWï^}ãñ¢`óVÄWwÙ–©º~DÚguC -ò&ˆŒ°"%A»HQ¨>cΟir.gðp”j)ÁÁÏU¼„gÙY eÎ -®ˆ~¨e¯D “Ua¯(¯`8QÃRÈðY$RÊUŽÈ•øwþS'OÓxcÙl[¶q#?h{î-·>o‹ŒÕ9kwÜ’7å>È”ÝZ¦¾–éo>ÖµzÞ2S÷­Fþöƒ'7D.hDE7‚ùx1Á_⑾ø*ΕŒyÄøûç5>˜Ûƒ·?¥mî‰bCÛÖ;"1¯—h†Â½^ªÐyµ¦‰ƒ«8…5züûÊvO—?Ø‚Qc·A-7ö#7ÈMÊ,×J¤M•Ásaœƒ5\pFþááÞŸ ’Nÿ¶jŤ#AÇø2m`rŽf¬Å??|ÙîÊ%üø¡ñ54§­šQc$A²EœáØ¿ -´){“I‹4M?¸ÿ[3j RP5Ì“ "Ðá%7P°&ÇŠE`jlÎtì”Ç“25ôë:»Eg‹É2ð°\Sær3î\ƆAk#Õ..5,ýO\|ÖÎI’·X&e“t„Ì‚¢¾Ù¡Gû—ôˆË2G¥¹¬ÊzP‰}+ÿÒ…ô¡Ö4ßMÐ>Äïß% öU@ ±-ÊnVåÊ -Aü*Ϫ•:|¯V8¾¯8—{wŽs‡¾K|ò­`×÷] -Ÿ;È‚*Yœƒ J¹4p¥Ì”ß¡,šZX+2c—û“‡ÿänßç7h!µÁ¿ÖB´9蕸3­0û!ÒJ/zlÁÍðZ-ÐîÝ”R›mÐjŒ©š*å"Fè‚€1ûþ˜Ý‰”#h&^:ÉËпè›ÀI}„Ã>'Ñ1Xâ´#\L°4JJ€e œP‡S Ì,é'RwÃÐýצ×Qô(ÒHšÓdv”§ÛÖÔ¾h¥âœ o ¥Î<ÎgšÚ„…S)F(}X¢É>i’-«†ob„äñ'­AG@0 Ä‹éTIÐêÄ[“Ê>oX-­˜éŽ ‹×]È맒f¨Ì¸­¨²u^œ_€ø‚àQHx šÛøïÀ¬ôõ€ÆVa¬t…5!&s#P%0¡ˆCw]¤¨­ŒÍš=[4 ‡^­ãgš*gsU¸AÃÄtjO¨ÝÑHQK§.0c— -¦´®Fž-TWk’tÕ?½ä9óª®ò[ùîùšSVc§’1)¦µní¸ËŠôç8ˆx–(£àPà¡`HÕ·Í[‘äkâç"|–ºÑ*l •¥%d3Ä<®³£'óT7õÀwE”Žˆì5£bªÍ§i¦2äØ*ð®÷áÝæY<ÅÞ–à€ô¢`ÌþŠ‘Ìvä“ĶZÕ q'8öÝÉèk¸Ø´ïOÚ˜áÙ§²{1|äN?Dò{œˆ·‚oD{Š(SªšT«"–-v SQôXD¼ï ¸$»@DîÑu‰o¶„4•æe:·%ª“«85o@¸¹!ïñçuˆîÐÍ$@lѳf;ªé)úªi³•’S9ó%µ2ÜK£LjtcçD½A{'«Ülí³î¿Yu´…àB WzK2 ž—…»/8w´p08ð|©Í"]«2┫ºÁžË²£~÷ˆÚw¼Ñc¯šòÔë_6m/·³þê]ߺðàãw -Q |=s¯#KIÖë*ÍM'M¼Ü™Ùyí7³#åøð§œÄx¾N8‰<£•³ØŒ|ç8ŸFJ$&"2éÉ\ÎG¿_G¡£|/õSg¾êô¤©çû3_þp¯>_ü9ŸÞ'ZkWÅÞxljûùv¬ÜÙüæÛ'f\àº_z3ž(÷ên$îí ö·×sf~l™HßÑçå÷ùô#«¸¾ùcÊ_Èÿg6Ÿ~åíün* 4úmükþBš(í™0%ghø^ {4ww© SŒúßÑ_¾³„ }ùžNç¾}O{3 + ªÕ²_f£¿:UÌ ÿ‡“ltâ™DŸfY™^–• +<­'6Ƌ˜Bhªñ$0©û˜aâ^ð_ΔY¶ÁÝ}ÆÛ=¿*–Lj,D¿+Jøÿ”Èw³5|¯…û(Š˜Ÿ¬ÎYdQÚؽÁ¢Ì\ª²–#âÌCŽG1Ü´ú@V”¬ ø.Ÿ˜öÁW8‘JÂÀw¯Yù½Ù Ü[Ýê×¾q·Ï¼¶úµ¹5òw?˜QU±`îšB~ªy‡Nãùg^²î=r„’m q~¥tÚ'"£èDfsѽ#-ó_1oY‰¤æ”Âr—½ãM†w"ÖgœÉvæQ&ýt|ç|XÐ*ãV%®P7ר`B·×y ¾±Ý*e…sÔu—‰š²âÃĹG÷Z‚¢‹@2å?Ð&"l‘æüЫN´‡O¤Sø¹e[ +u2+  XPýöüÔ¤”(K‘8(þb‰Z’š ¨Ò¾çGªU5 Éx¡ …¿\Aä87R‘{± ÔåD«ÛÊÒ©êcn¿›®†(•Å+ÊB!j‘úÓ7>ì^[d‚ÁñG͞¨Í3Ë21°Da›/ª¨¾È…E˜Æ•ë…ACÃöƒ‰6Úb]ä UðAqm²'é/5öæm›€ÜÖ,´,º›_4뜬d¥:‚sì;éÙb3ÈáW:|Z*heÞV`Œ¹ƒdzg:x”^„o>n=j»pCO‡Q¿íFQìùqBé-€;TºWÕfƒq “QìN­­ÆÚÇj<ã¨ð'­1\C¶M0èqëÌ$ +/¢ýKqPAâEqä´BèòO_ÅÇ.)zJ;=]§YäÔÞAyéÞ/s`ïoÂø’›ÝdÚC•Ê<Çö§HJý:æ[N]›ó¶âÞÜ´ÂŊ׌ÅL6)ªŽ ¼ÄÝT[¶×bR”tc“¶€QIxL)ê·g“-‘såƦkH²­£Ì¢¢†õ¥XÈ™—®€lëj†8Š}…@Bâo‘"ܺë;&5¯”58%¯–ØÇêß.únö^®W>y. +òc4r[÷XyEsPËzŸ`v 8©Æ®ŠüàŸ¾î½Ðà¡÷Àý–ÁÜÇöÁݳwµµ„¹ýÓIˆ‹è)´ùo˜Žˆs4˽‰Eד nxg$üÚÔŒQå®DC½Û´íyXêZ0J<ì×KVS}ì „ÖU×-s;éß±´û¬–ì̵™8ôÒäí[ÛËœ¿4‘yçÎÞ²&WvllèÆzÆ®ÇIÈõ¨c[è0m¶ w„ÚEä>é™{N½Ê?ð¹ý¾s•Ù¢)Êù®OOõˆT+^¥–bú­ƒ#m.Ô®V«íúLÎÿÚ$2¥•ð0?8"›x?n›ƒÌí¦a¥*¥ŒÉ¡7²©x¥82!’4aô.9KÅCÉ/¹˜8€²À¡Oи_‘ ËbufÌï¿÷<ÑÃ^æaº¡5MôÀ¥9¶|’¤(;Ôñ]Î <­‡ ç;âÛÿú1ØÍaØ †l˜GTç M&8ö¸ýÕxêò̯Ýendstream +endobj +4832 0 obj << /Type /Page -/Contents 1785 0 R -/Resources 1783 0 R +/Contents 4833 0 R +/Resources 4831 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1836 0 R -/Annots [ 1787 0 R 1788 0 R 1789 0 R 1790 0 R 1791 0 R 1792 0 R 1793 0 R 1794 0 R 1795 0 R 1796 0 R 1797 0 R 1798 0 R 1799 0 R 1800 0 R 1801 0 R 1802 0 R 1803 0 R 1804 0 R 1805 0 R 1806 0 R 1807 0 R 1808 0 R 1809 0 R 1810 0 R 1811 0 R 1812 0 R 1813 0 R 1814 0 R 1815 0 R 1816 0 R 1817 0 R 1818 0 R 1819 0 R 1820 0 R 1821 0 R 1822 0 R 1823 0 R 1824 0 R 1825 0 R 1826 0 R 1827 0 R 1828 0 R 1829 0 R 1830 0 R 1831 0 R 1832 0 R 1833 0 R 1834 0 R 1835 0 R ] +/Parent 4830 0 R >> endobj -1787 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 754.651 512.306 764.219] -/Subtype /Link -/A << /S /GoTo /D (chapter.11) >> +4834 0 obj << +/D [4832 0 R /XYZ 85.039 786.531 null] >> endobj -1788 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 741.102 512.306 750.125] -/Subtype /Link -/A << /S /GoTo /D (section.11.1) >> +1074 0 obj << +/D [4832 0 R /XYZ 85.039 682.284 null] >> endobj -1789 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 727.553 512.306 736.575] -/Subtype /Link -/A << /S /GoTo /D (section.11.2) >> +4835 0 obj << +/D [4832 0 R /XYZ 85.039 656.275 null] >> endobj -1790 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 714.003 512.306 723.026] -/Subtype /Link -/A << /S /GoTo /D (section.11.3) >> +4831 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1791 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 700.454 512.306 709.477] -/Subtype /Link -/A << /S /GoTo /D (section.11.4) >> +4838 0 obj << +/Length 3264 +/Filter /FlateDecode +>> +stream +xÚ¥Ërã6òî¯Pù2T•ÅŸ›Ó<6›Ief¼eÏNª’`‘–˜¡H I٣ݟß~¤,Ú—”«D°Ñht7ý¢Õ"€?µÈb?Ðù"Í”¯³l±Þ]‹ ÌüëB Fk?Ž"ÏL®ìì* ý JgqdUªr_G +qÞÜ^üðS,ÂÀO½¸½_(úZ…‹$üHG‹ÛâwOeþrÇ÷v©¼ÚôðÛWkS/W:I¼ë®@3,WÊ£Ñá©wsØïa¤¼v ?Ý°üóö—‹Þ:~„$üHÍr,V¡öàæ%q’$õ£ žŠ£"09ôåV…òD¹÷ÓR^i†CW"÷= dš‚%xS6åŠpnèŸãŸ)¿È¡C!U¼PŸù ƒaî+‡×¨±j–aæ N£*õ*dPe^{ÀXnxÆðc‡x8m+¯»Šh¬ñ…Ž ðzZ‹»f&Ì4±F<Ö¨ sW®øhÂ, €œ/{"È¡‡šAAplø±®«’uÉïM9àÛ# +ÒâF_éâzkÊ4*„m TOÏ/t.(c‹t{OˆòZCÊo›Þ'yåܧB¿ͦš5›ywfÏ =_,a!¢»w %Â#ogéÈHwÈ +Ï€"D‚Æ­<ì8ÀÔ$´BåMÞµ¤fSdPŠ¬à·ìH¶ÕT¸˜d;{@îÊî +ÖÇ`|Ö4"Ì +ã:Ä >V lŒ7°.Å*@Ža÷‡ÆªWí÷²É$¸&ƒÀGQཆ²à×ýä¶îÂlƒé§‘òÞ3»6D:ž(^v†WÒ3d¨6[·A,ŒÅnºniyËúªI‘°A‚á)²*xŽW&^c/JY•[­ÁðJ¹·)8º·Î¶Q›"¦i­×Y:RN®oÃ!ÑùãM¯DŽ#ÒrvûºüŽî"M½×Ë”PÕæn‚opûa[ŽŽñC”Hò5NoK6·^–vD#b™ùê[:}êç<ÅììÖýŒ|EÙtÝä 1„Ö)ÂÀ¡ó3ïÉ® &ª†‘É –U{ Åì{Z]I?!•%›ž ÉpÅ«¦Îö•Pš«½ÄÓ7ݳ!Î ,Í Ü´ìWa¤ïjæ*ÌCohèü/³±¾†ð~~¼å'y[x~!ÆÄ#uÒ N…Aðèô®!d¢ÌQ <…¾ü@ +¡HÖC» @õ:‰-"ž)ÈèÅžA‡‘ãSVã¡ÈN}†š/ C¸ø$„® 3HçdÞÛº²ëY +Yí<0’(XMÝš‚!w-d#t¥ý`êZ°Éî¦Ò³â•Ã]xê£("ã,ê®=€k9?cÅaYǶovU]y»¼Fb­Ð|…<½ºFz¹D4ð +à@s[ êw6€Xw}£W.|’|r©{ž$n¾[¶ÖòÀ8aƒŽ/m7pŒçݬIOû¡GÖÂD| ÀœéIJjïêrG—+ô^»Šù¶Áœ^ÛõŒ>f.aìÑõáó"Úr^8ÞÑ‹AììX¢$>¹A¸p‘_½8í9¯*‘Ü󘢠3†D{r´€±;à ¼œù 2ø8‘Âåë¢`ÔëIÖ`obÐýü/ÉŒz*.14À•-[R$<ƒÂ•ä-˜1"ô¥ t5çSÉ8DClÓ)Ž÷Ks>vÊsN/Xå‚ï\ö†+ÝEÃÇUð½94LäžLaÇX¤<H€ÚѵB´ºap¶í,úܵ’„f `ˆ˜f@ˆaŽ¿ÚL=‚ûZ üܵh¤\V,$Z=f£„Ùðsmz›Ð…œf⳦³Ú Z‡Npš|M\âØ•S —nRIŒÌÙt?»3×)GiÖ¬·ƒ3+xÀlp?åO<;BþjïzÆù#ˆ4”Î3ùJ˜Æ"þÅNŽ êÇJ’BnÌöBæ ÉR‹ "²µ§Û{œòåªwF"¾PÊ;~‘raFhôΖ+mG—’Ë.x¦Þ4³— +ŠaęΕCÒ+ž¬„PW~;T”#hB:gny:·•åŒÅ1Cg‘Þå…*½ +`¾ýŒý†_Œì—á\Ü'§)x¸ë=ÓÞ1ˆòì¢ì¨˜· rZ†”ÔU0<µ•œ–$(ž-n·TÕƱÇOgÏñ$Ž`7SËô£µ +Úã Clk™9Wn1˜Œž7ì5'•+÷gU6&I@ªâ Ê#*ºs“´wôJÿ>S¹È–„äè(+…1kÅXt¢åú¸]Äûüñýo<Â;ôææ—õ¸Â…(˜DùŽ.ȹ3ƒ™ÿpêDï±.Ùqb?×cx/tÊ­ûcx0)Êg«6ÝfÓsånö{ŒûG~£|žT°9^ÉŒœ^˜EcDyÑC¹ÃrË‚×þÈYc/U÷üGÌ7Deàk“]I‰“”V<ózŸ„òùäv™cƒrÛŒƒÞ»OA1¦Û˜£¯%¯y报ÿ"£#Îó_QTر4 l>újŒ(û§Yƒ¶í^)#$iç SS?Ÿ+N …ã—‰jâ¼p†š—°jš½ +ýÔmž6õ%Ó¶i&Ü’lSêJÔJ|npá÷™ øé› \têPÛBXÚ’÷})òªi&ldUÏ« ?.]sšj’ìšæ’Ø'¼Á|]ŠsÃ=¦Šå^©½ïЉáhæ“ ‚1±å.+Í9ò\Avó¦ÞpÛê©(³~ê¬!GmŒFú!{#mâikŦȈ‰Þ–ž6faÅXÚÆÇ´Žv>Öž.ÏäwêÓµßYA˜u#8dXVð+%OþŒ°·wî©w 3Å›©'Í~„P¤€çå@㯗§`û¡‹Ê0¸Òº`þé}>âoeG9+OöÄrrÒ¶ÒöóœÎ‚‚çâYS¦‚t®£Mu®S0X^’gÞÏÎ9»O_J>ãɘìÚåðWÄâÚmŒšX +}Zd­„ÒñÓà$÷ØhüA£«ÚÃX¤O?0"ÜÇ™˜NNd?öl0+HNëBŸ“"U5OÚ=É‘GÛ4Æù¢â¯;I…£ú¸„bIj.#{Žeõ a/žQcU–*'*ÚîAVJý£Sk@È?F7¬¿:µS¹brp\j–õØïynK®×I‰)Á¬”<ç;3ФÄ+¶]t gÄHF´–«h[(ˆåR¶«HÊo@‰>[÷-õ¦ºÓá±TsNlÒ"`ùó'|ûrû‰_߶&Öò,IÆô‡{ áO8rAòÉ˳æÁ¥ #y2”#(¨$1^Àï 9ˆ”Æn×?>°uà‡'ÿóðlØv˜çA[ÚOBKŒr‹X?Ý0Ö™gúùÿÈ“¹endstream +endobj +4837 0 obj << +/Type /Page +/Contents 4838 0 R +/Resources 4836 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4830 0 R >> endobj -1792 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 686.905 512.306 695.928] -/Subtype /Link -/A << /S /GoTo /D (subsection.11.4.1) >> +4839 0 obj << +/D [4837 0 R /XYZ 85.039 781.388 null] >> endobj -1793 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 673.356 512.306 682.379] -/Subtype /Link -/A << /S /GoTo /D (subsection.11.4.2) >> +1078 0 obj << +/D [4837 0 R /XYZ 85.039 761.463 null] >> endobj -1794 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 659.807 512.306 668.829] -/Subtype /Link -/A << /S /GoTo /D (section.11.5) >> +3020 0 obj << +/D [4837 0 R /XYZ 85.039 667.405 null] >> endobj -1795 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 646.257 512.306 655.28] -/Subtype /Link -/A << /S /GoTo /D (section.11.6) >> +1082 0 obj << +/D [4837 0 R /XYZ 85.039 667.405 null] >> endobj -1796 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 632.708 512.306 641.731] -/Subtype /Link -/A << /S /GoTo /D (section.11.7) >> +4840 0 obj << +/D [4837 0 R /XYZ 85.039 642.687 null] >> endobj -1797 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 608.25 512.306 617.818] -/Subtype /Link -/A << /S /GoTo /D (chapter.12) >> +1086 0 obj << +/D [4837 0 R /XYZ 85.039 180.371 null] >> endobj -1798 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 583.792 512.306 593.36] -/Subtype /Link -/A << /S /GoTo /D (chapter.13) >> +4841 0 obj << +/D [4837 0 R /XYZ 85.039 158.609 null] +>> endobj +4836 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4844 0 obj << +/Length 3294 +/Filter /FlateDecode +>> +stream +xÚ¥Z[sÛ6~÷¯Ðæ%ÔL…’xë[6ÛfÉd½‰3íNÛZ¢e¶”ètRï¯ßs I¼t¶Ói ‡8ç|8WPÁʇÿ‚U)_g«$ ”NÓÕöpå¯ö°òæ*Šlš¿ß^}ûClV¯2?[ÝÞûDÊDzu»ûÙ{ýÏW7·ßXo´Ö^ªõ&IRïõ»W×÷ñúõ«w¸d¼xüpýþv½ ¼ë÷o˜i>ÝÜü ×Ö©ön׿޾½úþ¶«g"d(Óç«ŸõW;ÿ핯t–®¾ÂØW,®@(-ÏÕÕÇ«÷[ñšYñ[cD:UQª/1"ƒ •ÂUù*ò Ð=€è”eÞ±ø£ÃQêm×aâ=ä°Öýëu˜z_ðŸ hùåòÈdû†7 ¼\6Û]^V>·]q`~'héDù™e÷‹ù¯?Ýà©Ã0Pç§ÝCë§ÊÄáòyë(SQž·瘩ÔLoC/ù° „út—•i‡©b™È&’ÄUY±M$*ÎÂUœE@²×í#œLœxÝ:Ž½üØ]*,ïÐ#5¸ùê3h“­ÿsƤǠM|{}ЫÔ ñêDhÞwãlÌ–œº–Å*3É*Žµ2&b‹øRà mtxOmÑ´ßà8öîÀª²±(ô¾¢íæø™êßÙ¤¾·«qöeÇ»üöÔö£Ã#Ðâtä0ä4×[50'‚Yr\ÉÁ‰ÈdðhÛûÏ:5^ýÄ…Ü¡Üã žCÙâ\Ëë%<’2ä†M—âÇ÷¼pÈ»’ä„׶õÜÖŽ¢+Í’šÕ3¿ú`è]÷oçÇm’BF¶Léÿ·K4ý KV|-ûk®`¨0ÀBH õl~ˆ}4­!6†þ‰°³D80d„P àì›üÇ +h1F4ÀêˆgRÞóÊófé@ᡵhwL•óü[²œ;ž»'Ü!˜¹¯+ \ť׉*€†ò“hV[‡f:DI¢RŸýçÓ´1 úÓvK¢·d÷ ÎS…B=ó:&†,Œ­Ã’~[³j8Æ·H3|õ)"£ÃÕ˜b¾¶<½­@Û~·2 å'obèÍøÒŽ¦ä y‹†STÃT±“Í.½ðÓûëŸØ+rÚ®wˆox­{(š‚ý%·9 Æ1ÿÁü°fïL½ºeʼêÝL{ f&o»|_¨ßMe’È$* ãÑ3î#»C4rÈa¤b÷;‘Q_f.mT çÙ1É7ñ::áö#¥¥¯-«^?ÚpŒHKt3dù­È7Ž®hlYèu5SöÁÆîùCÀ“™‚ôÐI²é@4©¡’á$¤sì,¤³Ü,¤·è©w—Û¤X>1Œ’ +´—ãØ«á6ïŠKè C²…O5 —ÀˆfÀ"_O‚5Ç΂5ËÍ‚åp»´¿D… ™ÉùÏ,èÈYc¯¾ç¿#/»¦ö‹tlYº(ŠåM vÆÜ‘ xZuó;àf™˜õI|Ë_µnÒ§àRQŒÚ²¼)ò©ã4™VI˜Í§C4}œ–9š©ãœe'Ç9ÏMŽÓå6N¶UÍ'Ú^šøe0Á´b £|Ÿ—ÇI¸ m Ò´zš°˜¥&±šáe¡šce‘X9AÂèÔc«%­'3Å´«36n¤p/mëÕ›Tbî˜ +Mר¦=ÚIÐ/ªá‘Rü‰ð „ŠÓï…—æÝ>ݵج¡X‡—RùŠ¼?MÕ7íÐ]ûi°pÖÑÌa  +Ožö;{ܳÜìy;ÜnÄä?¡î嶜¡jKNµG ³ƒƒ¤¥­ Ä­u&ˆ@…Ó}tç)7³‡Ô|Sð¢¸:\€w šWˆPádÞ9vÞYn^‡Ûí˜òdì…Ó»å}úÐp†nk(]†NŠ?©Ì'ÄÑð;[(èÜn­¯¤)‰ïàø¢(¦âRªPvŠ3w(r5ÑT˜ijM…C3ÝB3 +â“&*”&ê†]¼³:÷Üñ|(‹œæ‹tAhWGʵ0»jlW k7ØhåøO“¬¦ÒÌO¡u æ5h¦Û%fPÛö.‡ý€ÉbDUü‡<½LN¦¯w1 +fÕøwÈO¨$(HŽ¸ü˜;ºqE`²„acFÐÛ“s75õxÏEoöñÿeË„n${¸Œ¯Ž á9zcÆ$Éàã8ðnª"ÇÈ`|зjåÄø‘×÷çaÁv\þPáØf"G_‚.ˆWîë†g[ŽI(½õîy¶9AöÛѲöµ[º çKi#ÿ×±R‰•­Ÿè®&饴QÍ5ˆ¼W-/í}ô'êι4¡[¦‘ÓâÞ1Öâ²Ô>FéÐ>Âø ž[}—W¼í»‚¥—Gì*¡SÜ“G %ó狘x1rOªÁ¤ßÈÅ囑›ÍTAp“õ|3ª3¾~&Œø> <ÚÈ?TTT{r«ÁfDcÛ×ê¾Z r<ƒ­¼hCòŠ×Q¹1ùƒ8Sq–ˆ|Gä!Š[ý^ Ì ØœŒìü .Ó…«4JWžUfÆ/Ž,ÍÆ!êÃÞep"’º×bÕ;ÄïK¯z»Ñ‹<ï[ Ž}—A,Ô‰Š!!ÍIji.$=Á-„Ö<²I!Œqý:›”-?PÀ D¦ÄZ…a|âÞƒw>sµ³ÏÒº¥1ëÛ»]qOmsÕñól0t:Dh«Š˜wøï—ù=å²PËönJ¼"õ*+ÕàõØò=@Bi™ÂÞ+5õf$Š1Ÿ¾RðÅY¥#ÂãÞhÃÓCîöª8“ YÉiH³Œým®qHì¨{¢„ô€îxkRØwš1 ìyD¿¡Gú¼„AÒÇf„Òf;¢çÈW§†Tgq΂ÔÞT,¥¬˜(VþTu.fâ~"JL2¢éx`‰( +[‘ç÷¥tñx_C™1/‹¥¹åÔ=A–øL–‡ðëxüF‡PÌÖ݈ë›@¥iì¸~˜Å¶Æ°Oc lâ +۾л¾çɧŠgSøOrsEÓÔ|;ËAÀÄÐ …nþrM⧃¶cÛ;¼;0ÌèeUvNå¾Í%ïíÊv{ÚÁ²¡•Ã¥%z']ýÃÂ3µ×ò-%{’}Ên=¤Hs’"»¢ªFÞæ¢jªNÇ(nüùjÖ¡™®ÓC ‰TH[§k[§Ïf(²ãÞÇ­×ïk¡Ç‡Om1%¿°• ™®Æà ‚N-:´0e?¯«Šïˆ†R÷ÛôIð$ÖÎÛƒ”š#6žª4‰„@#Å¡F.˜äI˜‚wKÆÇšÞ†hœ—Ú_=ù|!Ñ I¨¡À\ÒÊ›äIÆå½´|¾QÅ^:V:2§ß¶ ûÅ¢jë¡ÁÃW~ü <2e"ÓLJ£-¼ö§þÔÅâgÿBL»]2}np¤,ûŽyDn Úd©ŠýÓ|þ®¤±ø +Ý-5xWt\ck]Ú {^ âºâßóTÛÚœÍWܦåU#¦°Ý]¾ÁIÍrá—ò^®Ó”ô¦âÎ' [6®ìÈèPèÉð?ŸÓš4âKízæ«O¡ò ×´{‡9¹-Å$îwâ_/ÉÄ}É,C¹/¹à7v_âòËw;*Z†¦Ó†Onyº>´]À §@1¢%P¢P„h ”9†”s~£ 8ü†[÷iøb€Ÿê)¶ÜAøÌ‚9;Z¸½hf aš%df¸Y`Θâ20Ûõ-e~×S¹¸Är± I¨,^Âd šEˆ–P™cha9ç7Š‹ÃKpúÝ }5êìÞJävqß(,\Á:D3xÑs -çüFñpøUu.>1â?'%Ù,™¯ÒXÏc1ÐLC!4 HÌq Ιáà0«Ø>;ñ4ߢ¥Ø;ᮤ›GéÿŒ¿$ ü1ó 4ÓÍ$sÜ’sfc8Ìê6dÕwd'õ:_9>þIO‰µJâ$ši$„f‰9n‚Ä9³1$fnÊݲÖоqçmC’í7—?yéßXÄ)òTß ¿ èi¦qšœæ¸ÙŸœ1ýeÀÀ¬}àAªãÝoÇŠ–þö÷¿dLÍRÜ•.F¿ÑþçBò/ý*xøt¡Uª' +‘( Ai+ uz‘9—×þzøBàÿ‘Hendstream +endobj +4843 0 obj << +/Type /Page +/Contents 4844 0 R +/Resources 4842 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4830 0 R +>> endobj +4845 0 obj << +/D [4843 0 R /XYZ 85.039 781.388 null] >> endobj -1799 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 570.242 512.306 579.265] -/Subtype /Link -/A << /S /GoTo /D (section.13.1) >> +1090 0 obj << +/D [4843 0 R /XYZ 85.039 607.698 null] >> endobj -1800 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 556.693 512.306 565.716] -/Subtype /Link -/A << /S /GoTo /D (section.13.2) >> +4846 0 obj << +/D [4843 0 R /XYZ 85.039 589.029 null] >> endobj -1801 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 543.144 512.306 552.167] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.2.1) >> +4847 0 obj << +/D [4843 0 R /XYZ 85.039 558.748 null] >> endobj -1802 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 529.595 512.306 538.618] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.2.2) >> +4848 0 obj << +/D [4843 0 R /XYZ 85.039 545.805 null] >> endobj -1803 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 516.046 512.306 525.068] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.2.3) >> +4849 0 obj << +/D [4843 0 R /XYZ 85.039 534.377 null] >> endobj -1804 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 502.496 512.306 511.519] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.2.4) >> +4850 0 obj << +/D [4843 0 R /XYZ 85.039 507.278 null] >> endobj -1805 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 488.947 512.306 497.97] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.2.5) >> +4851 0 obj << +/D [4843 0 R /XYZ 85.039 491.608 null] >> endobj -1806 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 475.398 512.306 484.421] -/Subtype /Link -/A << /S /GoTo /D (section.13.3) >> +4852 0 obj << +/D [4843 0 R /XYZ 85.039 464.509 null] >> endobj -1807 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 461.849 512.306 470.872] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.3.1) >> +4853 0 obj << +/D [4843 0 R /XYZ 85.039 450.96 null] >> endobj -1808 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 448.3 512.306 457.322] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.3.2) >> +1094 0 obj << +/D [4843 0 R /XYZ 85.039 422.342 null] >> endobj -1809 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 434.75 512.306 443.773] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.3.3) >> +4854 0 obj << +/D [4843 0 R /XYZ 85.039 401.146 null] >> endobj -1810 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 421.201 512.306 430.224] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.3.4) >> +1098 0 obj << +/D [4843 0 R /XYZ 85.039 247.401 null] >> endobj -1811 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 407.652 512.306 416.675] -/Subtype /Link -/A << /S /GoTo /D (section.13.4) >> +4855 0 obj << +/D [4843 0 R /XYZ 85.039 229.135 null] >> endobj -1812 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 394.103 512.306 403.126] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.4.1) >> +4842 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F35 2880 0 R /F56 2890 0 R /F14 2895 0 R >> +/XObject << /Im3 4327 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1813 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 380.554 512.306 389.576] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.4.2) >> +4858 0 obj << +/Length 3035 +/Filter /FlateDecode +>> +stream +xÚ­ZßÛ6~߿·/•š‘Hý,pÉ"MS$½½d‹âæA¶ä]]dË‘´» Ð?þf8¤DË2¹IAÖ5Ò7ü83œ!,|ø,Òˆù"[$iÀDš.6» q w^]Jb¥DV†Ì‹›‹g?Çá"ðYæg‹›íøžˆ…‘Xܼ«_ž_ß¼|·\ !¼ eËU’¤ÞÕ›çï—÷þõÕó7x+ô®áòÝëßn–«À{ýÛ+’G™ß¯¯ÿ…÷–©ðn–o~½xy3¨5‚ +êôùâÃGQ€þ¿^øLdéâÚ> àöî”bQ(Ôu}ñþâßëè^¸ §æ(yÌx á³4 ge‚€3pà)òYä‡OÉSÀS'ñB !QúA2^ Bˆ…ñ®S@9Å‹L<‘±(Žðú¦Ïk¢ùü¶Õ~ÉS¯§žÿBO³îhjþô#ÿtÀop¢¡o"b–E‘ƒ“QȉrqbÔœLñf91ðî»’†¼©«Òä£haüÕö”h¡-uO™yös ˆU3‚¿‘H%Äû²]¦™÷€o©6—$^WåC‰óÞqXƉ—·9öîàõe_¶ÝOg©÷K“ÌAý(d¡^ ¹¨·jê§x³ÔxwM×+{³ ¼ºA²G |ï°À8ÏvF™ó$(64EÁlŽÌ  À9ÇÉ̼¯#2­$1KRƒŒ…’qq`AÓLÀf9ÁjŒD‡üþvÒ%”76»^æ{¸QŒ®gç"Œ‹ÀAÆ(daC ¹è°j>¦x³„xÀÈŠ'ÞgôY2ò½É‚Ë1ÂŒÅ)w1 +YˆPB."l€šˆ)Þ,ž4¶”fö±ûÛöq?pŒQÈB‹rÑbÔ´Lñfi1ðˆ–Ýßásx«#›1„,<(!6@ÍÃo–o—Q¹L[-eàs•È<… ?ƒ|ÒÅÅ(dáB ¹¸°j.¦x³\x;H嘵˜\t‡|SkªŒ(ƒ,>u¤t†Ðy2´ƒ + "ãoŽ ï”ð™X}S ìÉDì c²¡„\dØ5S¼Y2 <“Œ|YVyš`ýxΑšOOt£(N¡FLdB²”‹, &kŠ7K–g’Uª„ŸïžÆXÙ>•«(d©päl†…+%äâʨ¹šâÍreàÍq•C z’‡…ã©‹ˆQÈB„raÔDLñf‰0ðL"¤5Üÿ¤Ÿ¿º¿Ö]ñ­ß¸^ß2Æ>.Waø´r'â K„£ê3„,t)!]6@M×o–.ïó½.u†’…ø÷d¼Q긨d,ÌŒ‹ šæe6KË6ÃJ«ÝýnÌz¿có}‡ŽªÈ²£„\ìØ5=S¼Y~ ¼oÛ»29™ß“Éwøü:ÿ +OždGÁ¼’þIýݽ¬Qá"õœ•žú+]“ä²Jå =®ÞØßÑbû-ŠKÛn›®ÙÊw¤Þ;z¬éKº¾n‰³)‹ûv|ø*¯kõNÞ[ÜX©ÁmÀ,‹B2¦w×Wrð+.bo'm¨‡'îèÕ…±H¼-òÖ’ÜQ£è¡)àÞÍ]©+s”Ë[Õ+‹."o~¥;H ÚÎQP¸Í‹÷P}]¬àu÷ƒÁk¥£I&‚r¤BKûqmÇäàý£aƒ¢( “TzùFB½•/馴ž¦W475õVš””d$¯kz U Ú ¬/B®ÊégKYë|ƒz~¢ÎÑ‘áAHx,î‹é ÞÈK©®Æ ÉÎl¤Ü,_M£Uäm£°ä–RÙçU­ê G¹ù¨Æ„Û¦F4˜£„¶Ü  CO«mvØñ\Ë1«Í)u+—RìÌÞ|ñâLxÔg +£ˆt7Ú“Ý+„ðÈC*zƒ”q!Œ4Š|ïz)@ üÓJ}hÏ”l‡Ç0Â¥ðå âÄ{‘o>=â5=StÔ}%)P{®‡¼¯Ö²Rõ(õõÜðPÕÀ~fbÈÌÄ75@‘ ˆonq&Ð*³ÈۗاÌqBs +-½v÷wyO’ãþtI÷òBQA÷1Ãß!ÞÑ%69æ°¾P Ov½|­ ÇÍ—a_ûÉ1Ç—&Vù +N‘?ç›/°˜•ˆ€î-þú0†!¬Èîƒt¹fßÑµÔ +‰mÚÊ0Ä‚Þ!“MzíÅ “fîGŒÇ h‚t»5Û4û- Íî9…ZW–YÉ­Ô‚û+GªUz×r¨¬ÕT<”!šCÚœ¡é¿E¹•{žuÏH¡86¢)ô»LŒ¢G¹£ÖcElBX¢B÷}Õìÿq²û1K£tê0?8³+™•!4xä©Á*!9‚ªC‚Ö²žŒ1HÊð(¤Cá_´¥®S{دš¹,…ûœ%àä6%µÌ‰’G³ÈQÉ$=Ròæ®B{J…G¿¡ +ÿ89Õ°é^ŒŽÅØ6Œ­§ú:!Vê‘֜ұ¥á „Åɾ¨7ªEA:ºôë‚û*áeâÈ_6ù!_Ëx ±HZ¼b_*2ï5`‡1ø~…Á<ŒCœ ˜M¡o¢Í=0줚£ÀzàئÜRº4“-]Ý`¿vlÅ)©’ ØŒûWæùF*³‘JæB³9æ!·ãâî.§C=ïÕº¤—@#´á%gÀ8;ë ~&sA»/ŒB_PBã!"8ÁFÎX¹ïé²h«‡R­@NGº|Xmj™ û,Í’# å:!“®6 åÊÿ€\ÓbÁ9¬˜˜zp°‘NNöÕ*Q‰ÂëiÙ}§G¥”LT³'‘?äSÅqtÔM‡ÿϸïûä +ø©Ö#¦+yИê¼ÖÇ´Í訪@Ëlzu°(³64Ku¦ÖÓŠM•¦š:aw=ËÒgè/#˜º:±`¥Ž ßQì8†„…ãï®ìMŽ00\n‡ !Ä0SAa– êÃÔŸÂôdEù —#‚¨Ðìiц!^þHO=B +¼q§^D ŹB‘Çܽ¿`/µ£P´ªBño®P4ñfeœÕNÕoøên°u¤o« 9$®Í…QÆB ɸX± iR&`³œŒ`ßóù]•àrÀÛklÈœOòy±,IŽ’üèéIþ¾¡èZ7û[iU†ŠMù™ ‹#nÀ(s>‰2ˆ²êÄÒXŠB(òÆCmTWö`8ºmóbXJ¡s+S’]`fþ…š¸Àá/eÕÔÞ—:a £hP«$]äô…N2doB[X5 HG[lêÃP >TÍ 3ÅÌÓ¥œVâ%Uõu]8—½Ú=訓’ehìuàMq²Pb4¹dfeHÌ­¹zá°’É·ïåkï÷zo¥TOŒ#D±¾Ò­ü¶A«fDÊ/e[Îe+ú«r‡zˆ(úTd«2HÈš‰ÿ3[2—M]\’MžÖt‡q;Ázk×`dÀ?r(ÒœWÊžci`àë|%fêi¯ÐãÛ!"ÈŽK}µ±uZ-á1ŸT,ñL×&§c‘«¸c„™Yð¨ N…‘úÚhK=¼$ƒªh´ÅM>šÜÊë¶Ì‹¯ô¨öphšÙ\‚ûPc(Ø°Ý*Èýð…\¨}æC­û²Vï”Ø5¦Öà µÇžšÎ ÎJ¨Då?ø#¸¥Ê`UvrüÕ‹ÐÜÑÇ(ÃŽ‹Ú£üÕ¾ëóºÎuÕ|ö[± €h–9Y ¡óË—r¬_V@µ€àÍ­`&ÞÜiÓÙÕ+'眮O?3hçh²p¤„\Ù5GS¼YŽ ¼ÿïç®s9בœû4Îqç:ƒÓÇo”ÑQ|î6:·®ýÓH’…‘ã„d”±|MI2®)-hú[Ê Ø짔#Ø7yÇ>C,×gtƒŒí‹)ãü æ<Úð=Ì1Øüç0Ø7ÐA £¬pi_›Â©ã$_%ˆÂ‡¥pNqø/´ï~ÿçéãf²`é¹(â°äZ™EGÑT_(B#qªðÿŽ~­Yendstream +endobj +4857 0 obj << +/Type /Page +/Contents 4858 0 R +/Resources 4856 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4830 0 R >> endobj -1814 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 367.004 512.306 376.027] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.4.3) >> +4859 0 obj << +/D [4857 0 R /XYZ 85.039 781.388 null] >> endobj -1815 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 353.455 512.306 362.478] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.4.4) >> +1102 0 obj << +/D [4857 0 R /XYZ 85.039 428.19 null] >> endobj -1816 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 339.906 512.306 348.929] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.4.5) >> +4860 0 obj << +/D [4857 0 R /XYZ 85.039 404.872 null] >> endobj -1817 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 326.357 512.306 335.38] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.4.6) >> +1106 0 obj << +/D [4857 0 R /XYZ 85.039 231.197 null] >> endobj -1818 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 312.808 512.306 321.83] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.4.7) >> +4861 0 obj << +/D [4857 0 R /XYZ 85.039 210.607 null] >> endobj -1819 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 299.258 512.306 308.281] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.4.8) >> +4856 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F72 3966 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1820 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 285.709 512.306 294.732] -/Subtype /Link -/A << /S /GoTo /D (subsection.13.4.9) >> +4864 0 obj << +/Length 2747 +/Filter /FlateDecode +>> +stream +xÚ¥YYoÛH~÷¯Ðj†"š÷1À>xƒdâA&ãk8yh‰-‰Šä”mþñ[W“”E{°X‰ØÝÕÕUÕu|]qgüqgIh;~:‹×ö“d¶Þ_8³-¬ütá +ÅBH#š./®>FÁÌuìÔIgËÍÀ'´ƒÐŸ-³{ëý§ëÛå‡ß.¾ï[nb_.â8±Þ¾¾»t­»›÷ןq)°naøÛÍ—ååµn¾üÄôHóûíí¯¸v™øÖòòÛòç‹Ë^¬þ@!E™þ¼¸ÿæÌ2ÿç ÇöÓdöߎíÂòþ„²ÃÀ—qqqwñ¯ž¯3Þ5eC±pS;õ·Í¹vù½™¼(ßÓdÑeí»œM%̯!!¾ã ëˇkC4'ùÆsòvƸÏ_ª9ZM…îœjOs0J=ÓãE‰ÿ¥\ŸŽ8Ÿ›Þj·/ã¨$fŒ¼ ±>ç-ãnlŠ„ôî£<¦eeÈX0èK(Zo–=·öè¾¥®îÔÃsÍÚZ­ ÐótG\’ùt/Â÷|;pßlE $}[r?†ËЉða*LÆm×¢7bèXÿ¾ôðbƒèu'o®Ñû.ŠÙáw~§iÍ@ž•2…Ÿ¿·zþ²åÂ%â²;¥«“Ú^˜¾­ì@ózßÅKa*‘l/€¦OZÂRQð-;VBzão!EQ†{‰)Œ´áHÍ•ÔâG N6º0r•L¬óo(ûäº@ßÏÆÉ=x'÷s1U÷ +Îò&l©õ®;Ä#æc8¦*Ù1Š1É›B´Vâ|ïДDyëÅK©…IqH‹ÝåR_`<ÿðeùz–˸¯ëS"2Þù›ÉdÇ5ön]O=6GÞðp•B¬¨P7º\ku&š£©êù;{d<éYóQÎ4)¦ßÑyýØqÓµsyMS7™ÝË Õ= {AŸ?L)5iØÖ`0è Å©! #-þ”ÒòµæA5Æœ ÷.rA–M/°Lq‹6£o]i|gÛ=b ÎŒ™éÆÁFe2ÖI#+BþpýtªÃWÿ)ÆRë´Àº|Ú ssuºªÃN~ßäÏÿT«Óãÿ½«øwé&¡‹íMøËìÿ¯ÿˆëáOàÛ‰ÿ +ú =Ïö\# !½0z)oè'ýsÿ D8&Mendstream +endobj +4863 0 obj << +/Type /Page +/Contents 4864 0 R +/Resources 4862 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4830 0 R >> endobj -1821 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 261.251 512.306 270.819] -/Subtype /Link -/A << /S /GoTo /D (chapter.14) >> +4865 0 obj << +/D [4863 0 R /XYZ 85.039 781.388 null] >> endobj -1822 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 247.702 512.306 256.725] -/Subtype /Link -/A << /S /GoTo /D (section.14.1) >> +1110 0 obj << +/D [4863 0 R /XYZ 85.039 761.463 null] >> endobj -1823 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 234.153 512.306 243.175] -/Subtype /Link -/A << /S /GoTo /D (section.14.2) >> +4866 0 obj << +/D [4863 0 R /XYZ 85.039 736.911 null] >> endobj -1824 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 220.603 512.306 229.626] -/Subtype /Link -/A << /S /GoTo /D (section.14.3) >> +1114 0 obj << +/D [4863 0 R /XYZ 85.039 323.41 null] >> endobj -1825 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 207.054 512.306 216.077] -/Subtype /Link -/A << /S /GoTo /D (section.14.4) >> +4867 0 obj << +/D [4863 0 R /XYZ 85.039 302.214 null] >> endobj -1826 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 193.505 512.306 202.528] -/Subtype /Link -/A << /S /GoTo /D (section.14.5) >> +4862 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1827 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 179.956 512.306 188.979] -/Subtype /Link -/A << /S /GoTo /D (section.14.6) >> +4870 0 obj << +/Length 1848 +/Filter /FlateDecode +>> +stream +xÚ¥ÙŽÛ6ðÝ_¡¸(V*.)ê,Ї4MÓ-ŠtÛuŠ4´­µ•êp$y¢ß9([ŠµÛ+A"r83œ{†VŽ„¿ÊIB!uêĉ:Iœu9“ÎNÞÌ”Åð,Š7Àùz9»ü6 +%E*Sgy{⊠ÔÎróÎ}õÝËëå럞ÖÚU‰Xxqœ¸¯~xy³PîÍÕ«—?àQà^Ãöç«·Ë…§Ü«·oq~¹¾þωv—‹÷Ëïg¯—G±Ž‚)Êôqöî½t6 ÿ÷3)tš8÷°–BÁq9¡Dh»/f7³ŸŽ¬ø,p˜jÊ¡ND˜èsèp`&Bi'¥e@6Ø7yÕ­Í~á…~èV¦Ìxõ.³n}yÄ á:O¡4)‘oòÖ¬ +KÓîëºhÛƒ·õUVÊ}Ýtu]—¥©6=Ý?$t³ÙYówø½TY‘uÙ¿£iwõ=ŸÂu¼1¸Ïÿ0Íf¤Û¯Y;Á¨n}>Þ4ù]O]öžºztÙ”yõ¤)ŽgDӛݬÇ^“—”æáŒòC½{KI)Ÿðäçç\K¨yµa®ÚÍS¨“Þ¡O±·ñúïõÅçû ^ÞžÛ¦Ø|ŽÛÇ—sqà¾òYiÊ 1>L2Ú›C›ýøÆY{(ÿ)ú(V†ézŽz’¡È³ÞÒàûÑ ¤)Ô?†/³x·«Ë¬}ß3§“„O¬ ö°§JjºÝ¸–Ü™æ’jÄekÊ•9÷àtœÙ4»üV k™§Zz‘dú_±ׇ…ÄÚ]c¹6o2Ú´yñÈû»…Ÿ0°É¡‚ß8pïw°É× ?vwŒØ"NÖAHÃɶE Ô‚5@3æå¾`j€#Ó®°\Ív›lû[1nL‰w­àÜ\´|¾ÉnÍEÇn±*M»Z€+XØ ;¼»> @‚ÍEs…ˆÃÌôßÔ ôÝ  + ´·u³A½ÌîÍ +·õÁn»]ÞòjOppÒ— k:[ŒÒ<ò}LƒŽhƒ’)šÎT…VŒù§5j€º6V\w'`¨˜W FÁ)g…[.žÕkhûO‡ ˜QK !…Œø´G+å ­|Gû‘P~ü÷]Z‡©Óh²Kc(KÈý$"’À†W{ÌÅëeò|J¦ñ±•Ç>È+RÌhå*Q +’vG¤8$²5_v®(£û‘‘B–ÎGG ¤©f”ÁšÄ?iE€Ë«R9ßÔ ¨3’•Ùz'¾$ªJFSG$Ò vü$Ò'I;ŠÝ¶ÛLŒÙýÙèÐsÏáÊÓBâAH¡¹·CèsáƒMþ›Tz˜”)Ö˜˜|Ã-FV]2‘/|ñ@±,¹\Bž²÷”Ŧ—7Õä17üÔw #õvçÞÝœ¡­%_ïxŸ6|…50v5ª~o5@Ð#°z}Ê·…úÓ•jk±Íº;˜Â*†€û^õœ±³jBnH]H:ûî (®‘ck¸ÄÀŒƒÒÔ €ëuM®ØãTÕC*0w°¥zcº¼®˜qó,‹Þ†ÁÝ.ãÅÜCFh&ÜíÍæmŽîÏ:ëRºIxüNÅ-|ðb“nê Ré¿'&æ¾&’¥ÿ¯V`+õc˜×}È›ôÙW/a!O½/Ge€‹…JC+²uZì\-ƒ©××¥E¢6NÃÃïV¤Ú~¹ÂjOå«æ6«n"ø1±¾ƒÊWi”ÅõÝhúÈivp~Ëßy×—?̦œ3¸í§…QÝÁJÎ +@8¿¡™.†ÙŽÏ6Ç aààBêwPIx%/iøb¬mÞ ‰|G ÌTYÊ Wë1­’A¡V±µˆTW¦`PöÐóa½_÷5 X˜–Q oÙ… bÁ ½ìKŽ•GÆ#âÚŽsëäÒ^A^£“šÆ•9Ó ÕwöÞ¢6Óº™8€*sþuáS« lG{uË¥®7Þ±RÏâ%ùôñ*YÉÏÇÃd4-#Q=øÝBOËì‹ÑˆS ®Ê,*Äsé—øyêcf/©ëú€º/ì») <ÃwÓ@ç.ã4´Ç»§µ¤ƒ?ù“ Lõ› 幎Uó'Š1Xߟl*ðµÿ_?G :<½N×óЇ@U½,Ô˜ÂøSyûŸ­Îþ û·Ôeendstream +endobj +4869 0 obj << +/Type /Page +/Contents 4870 0 R +/Resources 4868 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4873 0 R >> endobj -1828 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 166.407 512.306 175.429] -/Subtype /Link -/A << /S /GoTo /D (section.14.7) >> +4871 0 obj << +/D [4869 0 R /XYZ 85.039 781.388 null] >> endobj -1829 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 152.857 512.306 161.88] -/Subtype /Link -/A << /S /GoTo /D (subsection.14.7.1) >> +1118 0 obj << +/D [4869 0 R /XYZ 85.039 205.008 null] >> endobj -1830 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 139.308 512.306 148.331] -/Subtype /Link -/A << /S /GoTo /D (section.14.8) >> +4872 0 obj << +/D [4869 0 R /XYZ 85.039 186.34 null] >> endobj -1831 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 125.759 512.306 134.782] -/Subtype /Link -/A << /S /GoTo /D (section.14.9) >> +4868 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1832 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 112.21 512.306 121.233] -/Subtype /Link -/A << /S /GoTo /D (subsection.14.9.1) >> +4876 0 obj << +/Length 2308 +/Filter /FlateDecode +>> +stream +xÚ¥YÝsÛ8Ï_áæVž©QßîÍ>¤ÝÝ^vzi®qçf§ÛFfl]%ѕ䤹ËJ²£|Ìl;-) ø Å̇¿b–Åž.fi&¼0ËfyuäÏÖ0óþH0…Ë$îˆæíòèä·$š ß[ø‹Ùòzà{QΖ«/λœ^,ý4wÃ0tDæÍÝ4ÍœwN/ç¹<{wú§"ç>?/ç®pÎÎß=Ò|¾¸øˆsó,t–ó¯Ëß~]öÇê7„#,ðLß¾|õg+8ÿïG¾.²Ù-ô}OÀtu‡òâ(äïòèòè_=+š‹f´jJq˜yq>ÔAt âÌá,}/ö#£ƒRËÕ܃ØÙ6EÝ©¦¥¯Ÿ©ùCµ(×ÉobÌÇ #Óu#8—/ £_€ô³}-2§š™s‡ýÔ)*¹.jÙ@ kë6²³=æU¹®S¥j\Þ5L­iJï ÏKôµ]Š,["h.íÌ.õš̹¿Þ•+J@VuƒÌy qæ²|®@e/ŒP—Òˆp%çn çºÁ£Y`ÄÜ]ÁeÑnì qèSÉ· *ƒ¶Å¾†ÑEÚ!ʶ+Ê’WxÜÕ«¹Áâ|«G¬þGkh­prI·Ì©RÔ~ßÁ¼QcÙêŠ{FF§ÊHê“Œ±±ÓdÏú"B9Vô©wuº¢N£¤Ñ¤F*ð•(Š·–êŒP—ñ$Ñõ¯±qt©˜»¬­eÀG¥skò5Œ#Gòâ’äŽly§ZsçjÄb°Xów÷O?d¶{ær oFðFëîodåëFm©çž +ê?tŒcúÒrS0q«ÀœÑ–ñÃÞÏÁÞ5•’õ«WdÈ‘ïù qÈ5±ÿBwŸMsxÁ¹ÀwÁo;Å›h­wø§ëÆJ +RØ`qxj»­l*¾‹ÞˆµìµEµ-•9x¿ñ=5j¸Âc¸}ÿ¡œhÇé¢^‚ÑðK4JÀ©šzÆoŒºÊ˜,tkAÑD6²"ðR ­R?¶%šµqvãÙ–³ñYhÙH±{€54ø3±?×Ç|"œf‚Ð-uÆä£Ø(›5ž½ø¯"³0‡Î‡».œÎžñ(uݲ/_2Œ״]£ >#¬npANE,ÆÞ†T!ä˜EäÀ¯©HhiÜ‘‰„bœ ˆ ó’4é9¡¤€€éƒá’!b>¹!‘<Üo/ò† ˆÏñÞ~çƒPÔÆblÉ +2!Úãƒhh¨ ŠˆÑÇDNƒ—Hß1GAv÷êQ-& øÉ3ZˆžÐ"=§Å§6´Z<ÜoR‹£ýNKcÕÒDŽœ°-q»ÛR neâv^tVÙ’×Ý‘ðº¹5g¶ì>6ZŽ6t^™è¦6æ t§Þ£J#ˆ¼Ï)} zBéLôœÒŸÚÐ*ýp¿I¥öûÜ*BDø( žk“WX,ˆœq½ÌÒ¡!•ÀÌ®ÎMÎC*lh·bµ²yº`Ê>¢âõE .Á%°ØÐâªXo 8Ñ'åÐi,;P\lû9O²4´“ÅÔÚ%ˆL#Ï÷ã=ˆì +“µ”Ä&^嶑OÕÆX%XãÊ%û÷ØhÈ%MV7ßú˜5Ç°Éñ›ÁL™3åh˜ÎáÂsBb[t›3¡fÙò+³MaD–Dðf"…ê#Ät"•Û¬d"Ira(ÊÇbðz¿¾0ØR* +†Ð=ÿV4u˜ü‹q=€Ê¼%ºÁõ0*MgèÞ ³³ÎûtTþtÊ+ÔvçZf8$¿ðÁ÷TªÚ„ÿP,(an ȸXÓŽ¨‚€! [l‚CK‰|l’C´‰Ð¾sjŒ¦C™d  ˜EÎk\“*âp‹eokç!ÐöIƇ|¹æeVæR“1^€áÁe& èœ/Êò ìl„°¹¸4žA%B‰ÆÙ¸²ü8ŠP±•Ø°0£÷06*½³wÛ©Š†1¥ÜÕlV0ÙÒpoÈø[­ñó–¦ÔIJÅ +æŽ÷46…´£…peŒF˜+!ÎiHnMƒ±ÛMÓÐùÅàËOÝD¹@C&$ ´Ò¶d»jÛ×ÜQ˜¶4ûŠ$kB¢Û]Ò‡¶I-®èä76 œ²R’È\åµÉa±; +Ô=êºm'&6§¤*Û„ÑÕœS–AÉÛ#?ulkÐ<ò*Qq$'™!úºI«wœ¶‡Rve™uÜ13yîˆoâÓ1Íûâ×®•õŠn¡¥J5G&>£Ýó–OXã7‡}ÁEk•wä—iaȈH{ABüÏ"åнûˆIƒè$H-sሴõAÇ®uCd#/ *#¨Z_í¬Cö$4bê’QÂÏLÛ2™~ï÷rÒs›4D’d²+úF°•Û-Ûžùbê¾Úðù§ ² _O 'îU†„·ô½z÷æ[#&¦ÄæztQ8l´­Ùd ¯­èM¹µ¨^·Þ„´T÷“IP½S„ˆEí·‰4*Yx~ô²4*KmEØ‚Lû§´ˆ)9HšE}6Eâ0’?’,Dûõb$lžûš£k"â#| aqÅ ’ÂEï½8$ýë”,‹y±´ÏR¥šLÓmÍÔ?=‘·L>ý@õGÞžÊ_žzw09Ì}¹ý~ßnµ.ïWMq£šû­nºöþËð{iî™ÉE£sÕ¶ýÃFKHÀ¼‡äèxÂÄþ}úéüìüý"%RÌ©¹) ð㟟/—Ô»R£yUª)Ô=×L$1m4/=õ×ýW—šÝ ÌIWm÷–Fï? ,›<ææGN=zþÄá:ÝÙë0 îôÕþëÍÔÒ¾ƒí/2¤¹äû¦„m´ÈØLO3{-ª™Õ‡æÑ>õH΢jàh=Ãûš ;´ìá&rµb‰[0ñEè{ÁbªB„Äú/ý|Ñÿ@É{.¦ËÌ8¼@س ("ÎÏkæxpàÿèËsÄendstream +endobj +4875 0 obj << +/Type /Page +/Contents 4876 0 R +/Resources 4874 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4873 0 R >> endobj -1833 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 98.661 512.306 107.683] -/Subtype /Link -/A << /S /GoTo /D (section.14.10) >> +4877 0 obj << +/D [4875 0 R /XYZ 85.039 781.388 null] >> endobj -1834 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 85.111 512.306 94.134] -/Subtype /Link -/A << /S /GoTo /D (section.14.11) >> +4874 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F14 2895 0 R /F56 2890 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1835 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 71.562 512.306 80.585] -/Subtype /Link -/A << /S /GoTo /D (section.14.12) >> +4881 0 obj << +/Length 2439 +/Filter /FlateDecode +>> +stream +xÚ¥koÛFò»…šC +ˆX’»¤ÈýàäÒÆEóÅ*Š"àÖ"%±åC©È¾_óÚ%eI.p‡Àá>ffgç=«pÀ¿p’Æ~ ²É< }•¦“e}LÖ°óóU(3™`Þ,®~ø)Ñ“0ð³ ›,VØ×±š,òÏÞÛ÷×·‹wŸ¦3¥”¦þt6Ÿ§ÞÛ×wÓл»y{ý·´w ÓO7ÓYèÝ|ü™áæ×ÛÛàÞ4UÞbúeñËÕ»…cË,dÈÓ׫Ï_‚Iüÿrø*K'~Ûõ0åÇZɼºº»ú§#Å{zÂXçD«ÔSu*dÆ©ªÉ<ü8Ð$ƒ¼¨Š¾Øîʦ/vÓYÅÞ²­kÓä<ù¯gÌBd!#œnÓx×ävDàPþÇì>}~/º3„Ú.âí|W~³ØµÙž9:&„£cL^—Íe.Ý&!ñ°ÛšeqÄXpÓ<œ`þÑÞwGˆaœÃ%s_Ÿò±½Z6ë#Èû.¿pí³Ê¡Oµ‰Ìì÷ö{‘á÷çÄ^m¿>GìëˆÈ®­ +S—5°ïdsY•…½ÀXÕÇÒ™éÀ²ðˆÄg9®ûB cˆøy‹¹ýðS86ÿ™Ò4œiå'*!ü Á­û-ø±ÙÕìð%Lh¹Û9»{Ä;‡i”\ ¹îõS§ÃÈWa4‰C ~|ÖU-Èl€!O ÇÑ*ŒR?™'–rú¯ œŸ7‡~î4†89ì(,¨ ‚G<>ì~:‹æ^2XÒ£»½Œó2!4/á¿žW:°9Ü_–«GZ¿]ÿŒe! V(˜‹%é…Ú6¼n:FÓFQ–¹‡qU¼âƒJÈ/* üD‡¡èÐ_é๭žžwV £óþ5ôEU± Ëž¿‡M¹D”ÍHä[¢Ü’ÆZGJåN”Ñ¢à­[&½·~Qøì±aâ+Ȳø… D,¿oñ(`øþ&Œ‚âõ–l%ªwž‰?ɤi‘aHÁ+tÆÞT‚!š¦­;S#ʽ™)?à¥CI†Q^¬ òX â›Æ‰gª=[#ݶ7¦J‚§»ÿ)WdƒÒ¦ØX,DÊ{³ïI­3oK¶iX<ßÉbÞ"ë/á%Þ®¨y„VŽ_4ù Ê'‰q€zh‹5]p6ž4ŠøÁÔÛªøŽ¹YŒ·œhqÒ6©óL²#‰ö0—[mþ´––€Œ¦²ç­¥Ù+õ€r'ârÝðÖ ½l‚¼R¤€ !¾°¢ßoyqž€§DqÙ1S;{¸©NnËÙ‚eb廙ˆ|¿x~G*Nâ„ZðV»ï!aÒD±aÑ2€&N ÝcgƒQ©y¹&¾ø‘Ø&w49´ÝÀÉbm*ÌØJê’­âT§ƒTt||²Ò‰‡þGsëžJÏa€{1(Ü}I®ë7<’í¼„€¨ÀðjF '2ÀiUÌH ¨îZì˜aÀÖk’¡í¶ñ9m'É(0*¨~³®ˆWû ’/dÞ×gÓ;Ž%18 ŠÁG÷2@þ“À²YÎúa‘,÷” LV˜ ²¿4Bðà‚'E“Ÿa+Ž|P§àµ«#$0•9¯V(„cKiïF˜=Xg¡…lK*H0˜ÊÀZ ©‚ê3Dí¥² +¡ I“ã(æ,=Jçܹuî“ãZÉ.`é}×ó^ñÜ™NȪs»çt„À¶À±“÷Ø^pƒ£!gÑÅp°Úµ ì„>F³Ì»u1—¡ÞYo˜œ»Éûw«SGq¹(Â@e¿øÀK¬y‰ôÂË5&ˆG¼§ìO»Îê <:Çx‚é‚AùzDŽ£/MH‰ë‚ÏìzÓs(}Ž?÷þ}#f*¢*ÔTŒ +9^JY"r8bO¤"¶?ølÉdzIÑ´dseÁSJÔ*€ÜÕ›²¡j˜€Æ‰ýÞ Îí¿Ä̇©Èfy@v9†S¯ +lêN`ALŸ'º²ãÞaÚÕ+ÞÀÂìôT‘˜íå±B$7<ê}^A÷Î/÷^ÐGáJ”Àøo ÊËÔ±+¸¹L>Ü~²XF–H—®]tD!ôEýâLD°%ň.@t¨AÐd´4¶¾£C¾›¶*xƒoË^×ï(!¬yݬ(¼øñ¯°«XÇ[ãS@û1Ú„}YqNŽ(Oò'Ð^,“ò}³±æŠéj”k[dj(pb¿è 4'·*鸘#2lL0’:.ã<žZ¼2N‘c Ò¡&ÁójÇJÊèÑ1B‚"î“ â\J +´¾0¹“/ž‚¢8öçQøìÖ†Z„vµù’ G—úà8äãCHK˜0 Ú|÷ÐC +²!\©Ô¶*xüÖæÛ9£$\Ü›K?§—® _MÏ‹’öaä ð†-ué†jÜ'Ïßp€9ÓÙBG&üL÷ž + AÅ5>Zº´\é7h‘ê(¶Z‹!!™s]Û¹òCIåðÜ«bî^ÍÐ6­dt ½Q¹WJŒšhøëÒȽ)z±™äß•'M¹ÏbQç ÀyKVA’Ý»6ƒ/+ÕWϽmoMIG“0rÞЉÃDºê³uƶ*mëUöÖR%O¡¬'˜ÖCW-'Î…Ë`³t'ÝTÚ¢k•Mv–Êc |‡ —J4ì%É擇£tuhy‚.þÜû>³Èo?÷ö +ø@äÞW00€÷ÿŽ¿|P£ »u¹Þؘ¨F,Ðcݽuz%1ÉÉ×&Žßð©†zÑ•¦°ì_È:PGEg_?áoõýúâ2—V~ª.¼¡ÆQäG¡å…sœ=å×þJsÂð¸ãŽ·endstream +endobj +4880 0 obj << +/Type /Page +/Contents 4881 0 R +/Resources 4879 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4873 0 R >> endobj -1786 0 obj << -/D [1784 0 R /XYZ 85.039 786.531 null] +4882 0 obj << +/D [4880 0 R /XYZ 85.039 781.388 null] >> endobj -1783 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R >> +1122 0 obj << +/D [4880 0 R /XYZ 85.039 255.721 null] +>> endobj +4883 0 obj << +/D [4880 0 R /XYZ 85.039 226.923 null] +>> endobj +4879 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1839 0 obj << -/Length 2113 +4886 0 obj << +/Length 1898 /Filter /FlateDecode >> stream -xÚí\ÛrÚH}ç+Ø7ñ`YšÝI²É:oÀåTeó K2LE ¯$|ùûíž‹—;`*UA8gºûtO+vÛ‚?vÛwL‹mÏwM‡ÚíhܲÚC¸ò¡e«V›™–ëà¥7ƒÖñ{—´mË ¬ =¸Sñ7ãm6éß(ùQt¾>¶þÔrÄLæR|Ê­oß­v ÿÐÇ–eÒÀoß±eÚAз˜CM‡Quž¶ú­ª§Èk¬-ïZñ]˜ÀWóÚGÔ2}Ÿ­œc»&uá!Õ/"ÖŠ_d;fç(`Æù„ÿkÙ,‰;GÔõŒOÛȆ٤§—ðaIÙ¿oñ¯W.8Ì„cÛˆ³µá*Š»\ãt ç„òºY.µ”JzÉ3^þÑ9ò©³kÔS¸¾çwËPŠê/M…¤áyY+I²”Žzõ3 onoé%¸¿I¨ý5î÷bEÔ«/Ð3ÜÁëö° N_Æt =¿Žp®ª}âc^†²5›§<—úBÏY3>O‘¥ÓBU‚aF˜É“6FW¶1vãÙm%ªßP´V‹X,„£ü‡Ú 'ád(«Rv&åöz){®ÞC·ê=œsõõºN?”Z;T§¢3Joïw£H÷ÙÈ^N,s+é‚E»á+³ªn¤)ã×*óï…CÕ8Á~)H·/·Ö[ÜcYìýhE¸ƒ’sõ‚O®tÏ­¶›r$ºaTÆTG†DYuŸ4?y&2 -×vv?{[ÐïÁ&úÝ“ú½_”(v¡¹×†ºBÔGú•‹é¤”o M3<â³>°í©øà¹T¼7Sñy[Kwµ1DDò2œõ<)0Áñ¤U{£Øƒò|ö\EЀ«ðjÒ}•ª îŽ{µr¸B;’[}V°'ÛáQAÖPQ©ö¾ðÏpå>­§YÈ‹j¢~ÏS$È'ô5 Ï¬§ß¼SàÏò&©=…ß‘© -˜{ ÷Ó¦°,eCVVàtÇÊbÛ–þÌjÈt«Non¯:•f-Ý’Žå¦^³7Û®TU‡‹~†0Õ×*ÿ¥ßwcì•®ø‡‚=[òÝx,w¢Ô&6uÌÚг«:ä¿"ÛØÄX7£iTJ^0V‹¶¸­¯Ö&^óªDµ'ö@¥h‰¢J‹BJK||>§£W·¼pMÃH#^„Ô4 ®ãQµû§üˆ?{ÆOEû;–>…ìµëÖÀk/ÈYÅB8S1X÷Änl¨…Œm`Ë…çìgC,£ø-]½éßW~Y'TB\Î÷T-zµºŽz\¼#ciQ9¿Ïªr|Ó[l¡µwÞ+ýêU"ìû¦ë“ÕÿÛÊŒ‘ þ£æ›–<ŒÞ¥^ Çd`¬s?åô_Dµendstream +xÚ¥XëoÛ6ÿî¿Bß&#J¢,붮E×f‡b节–[«,¹zÄMÿú݃’åXYÓ Akòxwü݃ä¤åŸ´b%\?±¢X +?Ž­t·p­ ¬<[HÃágÂóãjqñKXÒ‰›X«›£%å[«ìýô×Ë«ÕÏo–Žïû¶ŒÅÒ‰¢Ø~úòòz)íëçO/_âR`_ÁôÍóW«¥#í篞1?òüquõ×–±o¯–ïW/?¯FXã†!ALŸïÞ»Vø_,\á'±u€±+$,ïJ¨À7órq½ø}TÅkÅRs.¼Px <àñ‚¯oç«D¨$œÝε©³LÆ„ûh.žïë§Z'Y­sÔKe0ØἜZá¹3»ö­aÂ6Íšâv0ÇW5 ;C½H¸ W=˜ðŠìFåFáeiŒ½â}féÕë2L5æiÌnusÑî뺼h©F9—Y7õ¡ÍÏ60¦žònzzp½þø<ýº,Òcd¹#µUy÷ÅXØ<y6:»»&@0±¿)HW§§ipñðES¤]n _¦iÞÎðkAùp÷íÇêcßtê¿üGòRIù•la»·uÛ™S«Ër¸£Œ€+èofƒ‰X–W§ÉÐõͺþðyÿd¸„ ]xP„çß#Iºß”Àl´ÓÛÞrú!¼4€5Ž¸ËÙ-³†á„ÕSÐÆB·Ç…LÙΩƒFDIix°øö£3~‰ MtÅ¿ùg½Û—æâ¡Â’²‡B + õº‚úSEÊþ“z‡žwTëmøSµcê'܈ÊùÈpHiéíî:ªª7œ)è‹Ø N\iZ(¬Üh(x‚ÝŠny¼or‡ +²wçj°ªœŒyÖ¦+Àñ©Ú××øÚ·cWE6Ô v?`à+û7pš±ÙN=ul²Š&ÂPü7-öNPWs…—i°uþ™Q¤C#Ô•w¼b<Æê«àW›5\Ú«í´0¨RÆr»TÀ[ö9aðlm|‚kðeFY•Ílut–Ý;lLÍ.±V„«·ÁvK.$Aa:˜cÜرg'8Ëo4V}eGx8mRMfຘBd®™n ¨‚¸cãaBej2tUˆ´(Ñb¦ìƒÀ†~¾ªfz›EƒQDNYê[7­YŽ¾‚ML%_›é3P5=Ä÷j¸+ gv3'êQüêÁ'¹'%Ôú”†pÅŒn?ŠŒÈcUÓEâøÐ*nÐ3ÇcÐ2õ€ÝTÆLDN,É¡k¼Ãä »&gAæÝÖ³£Še#¶Áäos+ÈÀ^¬N¶5X„xàãÜ¥^2÷A þ±žÿõÝmü²ø"öŸ¯î9Ë â–ü^Lñ*Ø?ü‡_µendstream endobj -1838 0 obj << +4885 0 obj << /Type /Page -/Contents 1839 0 R -/Resources 1837 0 R +/Contents 4886 0 R +/Resources 4884 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1836 0 R -/Annots [ 1841 0 R 1842 0 R 1843 0 R 1844 0 R 1845 0 R 1846 0 R 1847 0 R 1848 0 R 1849 0 R 1850 0 R 1851 0 R 1852 0 R 1853 0 R 1854 0 R 1855 0 R 1856 0 R 1857 0 R 1858 0 R 1859 0 R 1860 0 R 1861 0 R 1862 0 R 1863 0 R 1864 0 R 1865 0 R 1866 0 R 1867 0 R 1868 0 R 1869 0 R 1870 0 R 1871 0 R 1872 0 R 1873 0 R 1874 0 R 1875 0 R 1876 0 R 1877 0 R 1878 0 R 1879 0 R 1880 0 R 1881 0 R 1882 0 R 1883 0 R 1884 0 R 1885 0 R ] ->> endobj -1841 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 754.651 512.306 764.219] -/Subtype /Link -/A << /S /GoTo /D (chapter.15) >> +/Parent 4873 0 R >> endobj -1842 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] -/Subtype /Link -/A << /S /GoTo /D (section.15.1) >> +4878 0 obj << +/Type /XObject +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/tip.pdf) +/PTEX.PageNumber 1 +/PTEX.InfoDict 4888 0 R +/Matrix [1 0 0 1 0 0] +/BBox [0 0 27 27] +/Resources << +/ProcSet [ /PDF ] +/ExtGState << +/R4 4889 0 R +>>>> +/Length 4890 0 R +/Filter /FlateDecode +>> +stream +xœmYKŽ,¹ Ü×)ríEŽHQ¿Cxaû xf€~ à _ßAefUÛ ú‘’(2$Õå´£ð¿ýóë×ë_¯ßþÇïÿ~ÙñçkžeÌqüçUÏÙk_Ç__í´cVý,½¿n?cÝO¯£ÞÖÙð?ìí‘¿^^*öõ[ãçó‹Ü௰`kº=úq­®öç„Kþz]6\šËĽÁÏ;|½þxýã5æ¹Æ¨Ç²s4ÝŒóy¬rÎZúñý‚!­[¥Æ֘дqú²qÌ8{Ážß¯:ÎÚ¦³ŸËñóÑäÎÜççYß°Àbž§Ýç¿išáŒ7¹š½‹·b ÙÛkÓçAäYå(S+Z9K…­XÐXÃQeÏŠ#Z=½OÞ¥›M­hgYq̆­ƒšSŒFé!¸ø’± w|`ÏÃanÜî±1Îàï×9§1ï43[q®N\ÎB4¶ ûÓM«ñ{, €óq¦Áþ sñ‹Vyq^gðZ1¸ã„ }ЦֆéLþ³™ƒ÷À8GkOkˆX[NG4ëo_…tUAp:]Yò^vFÔ¹ÃC¤à»Ê`öÓq6€Ój Èqo´Ñêr}gH.Ò°¬¹Ôù¾¢"À¶èÛ‰‹à {Ê×Ã3¥ÂØqËXáæ=_8½=e<Ãâ\³ Ó»âiÈÒž¾‚ƒýŒ–ÁCV`Nl°·~Áò Ø߯þå…Ü `b¡I<Í*8²Þ²„QÂB+ػƇ&/òýZ„ø¬÷>Ҭܗn^ØuÀ%”›Q„Ksƒ:yl‹Ç!sßôsÕÔ“ئˆ °ÎqƒUtÈ‚ 2b1gl( Œà#ädl-œÙKóÅ-—ã;²Ð8‹÷K¤¿2®[ñ-ET>lÕ¥)Ìj¼ÃÙ ü€`“•‘{zÞ¾ÍP’ÔÖ[òå°*hÄ]ÏJH¶ÛiÎ'0oÏR³Vj¢7Ð{ÊN(@nÔcϵ÷À®–ÞL’€]båH,úì–3«LáÚ_€O¼®ŒÕÛéͶQɃ`7sþÕÓ,šÇÜî®=h݈³€¢à"ßô¥›Â[cñÆ8¤2‚ˆpÐjA´]Þ¦™ œõD„,8+bˆ4ê®1)…!¼ZûÀHýÉŽký‘ý¬% éÑÀîúNöËú‡˜à¥Õä¸9ŒrORWêü~•Ú;§ à,t#S͉£ä²,vz±YÌ$”Í6Û-“ãg2ÜõEeÆ›ä†bé­Œ7®ðJX’dL©„áC¢` »YyuÏžI¯ö N¡Ÿ9ˆÐðwå¡·<´2”d‹‹8o]I+‹Îs$´û>c +®1˜i¤ ¯I£i¢·°†˜¹=è ÊÏ•…§ÕkÔãÅŠRMâöD<¿†ãµ¥WSxË&‚—rlœÊòžý&Q-ÆŸÝë~x ß%ªÂ…=4êqÆêjsà#‹|æQ“©(5ËdŸ¯— ¡è¢oQ3ƒUzixìIÝ3ô-æ8ç¬÷,¦#çÓœî2‡P{Šâ­&o© +s¨&ÃÄÊÄv¶ ·ìj)¹âÒÐCœM¹ÏæhwC¼²4ƒ§MiˆKWV.\V©qõJ˜Qå|˜ÂdLé=…B½ÝØ=*ë’qí§­Mƒ'*0*2î±gO¾Õ1|:›rËócܤDR®&DðÑ"wv³B\HTˆÚ8!§ƒFø~¯X’ëÒl—³œ&jÔ …à9“ƒPÐQjk!S ¥3‘ò ˆYhÇPÑcU§í|øB*²Þ8inË_ìæ[´ç‹ïGS8“»yö?˜n 2%kvjhXlzDgx|¼ðtúê󨿿 Á$ç]–šˆù¼Ÿ‹F¾Î\o7À0òaNµu™ZzÐ\‚´*n +¬ÉQ0߯+#ÿ±-»=ÀMUxËùëz´Ù_€Ë3û&[(t½zŒeî— “Fò=of¶ä{_h¾‚¥9SŒ]`ô¤ž +®Ë¼«ÂÂìï{š)Þn~\ÇÚ¬£ZqÉp÷ìû15LIcÆ ˜Ô¤9±ô~ûz%“º˜ÏÈgâ^• yöNî³åçióþ‚•Û“:%NkjPñÓ’{øøÙ qo@B%™6•lÑ?Êò»˜«tTMbH +­Pø3øô™×!ý³AŠ<5§!Éçãß[Ž«¹5{Š¸:,RŠ½¥?ôök8ò® #Ž$„6ã?û¥?%lgŒ¢¹_z€j„Ä5ðñŸzÙXÑ9I/¨Ýu›ê:¸ãš÷«(=IeÉŠºî‡”Ÿñþâ{Ìß^ÿŒEZ¢endstream +endobj +4888 0 obj +<< +/Producer (AFPL Ghostscript 6.50) +>> +endobj +4889 0 obj +<< +/Type /ExtGState +/Name /R4 +/TR /Identity +/OPM 1 +/SM 0.02 +/SA true +>> +endobj +4890 0 obj +2934 +endobj +4887 0 obj << +/D [4885 0 R /XYZ 85.039 781.388 null] >> endobj -1843 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 727.553 512.306 736.575] -/Subtype /Link -/A << /S /GoTo /D (section.15.2) >> +4884 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F56 2890 0 R >> +/XObject << /Im4 4878 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1844 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] -/Subtype /Link -/A << /S /GoTo /D (section.15.3) >> +4894 0 obj << +/Length 3910 +/Filter /FlateDecode +>> +stream +xÚ¥ZëoÜ6ÿî¿bkP-+z?è7¯ºR7v®9¤NÞ•m5Zi#iã¦}gæGRÔ®Ö®â%‡Cr83œå/<úç/²ØõÂ|‘f¾fÙbµ9ñw4òêÄWg +åÌÂùñúäéË$Zøž›{ùâúv\'v£8\\¯?8Ï~:¿¼~ñvy†¡ãgîò,M3çÙëó«¥ï\]<;ÍC‘sIÝ·o®—g¾sñæðçÝåå/<¶ÌBçzùñúç“׆,³!‘3MŸO>|ôk¢ÿçÏ ólñ@mÏõixsBD¹qª~}ruò«Y +cѳæX 1ÎüÜ̓øq6%¾%¡aS@£‘F ³É÷7ôƒE{nìEÂ'bML̉£ÜyÎ<(‡¢¢c×åšX‘¤Î‹?·5õ‹¦x˜ÇÚCí-~‡ûRãßÖå÷=CçªÌ´æ®?ÆÆ(uS?zü`#ŽÌ-ù›ƒ‰ëÇìå2‹œ¶®Ûe9UsÑV=ä^ »fÊz&qµëå·’ã…ŽG(8Méé0ŸBÀ·]»A«¸YžÑ²Ñþ£ñï±w´’¹Cl…½î1^x™›&ßòˆc„ì»yÛ¼HòÄÍ {²ïø,éØs®µÄ>ÜÕíMÁþÀU¹˜óÄ%yHÛ|¸gD†¥,ÿ‘úOh0£A–jW5Ë wÙ ÓŠ¥ÎR4kæ*qëÌçû ÉŒó2g æ¿>º®KÄø˳( +œ º=! ­Z`•¦™zEÍ'¢n‹®Ø”“mC¢ãé­VK¸b±åûŠÞÐbá^q‘Úàx5îÔ>z?LÆ+X‹‰ÌP‘™B.²b9sV†È,qny•m¦LÎ!ÒEtœ£{gIc¡ à¾¹r„&”óFØ)k#ק€C‚ESi'"ÿWÔeÖ»@»!˜";éuë¾Å,[,‡ç…¢/…rujº}µ>(¯}äü4Êô±ã‚j„d­F®TË’Ì-kÝÿÝó#¶ÂŠg»z:äÏvŽy£6¿Ñ(4Ží¸OgO”[ÕÏð‚µŸT# £Xte/zãÓå‡Æ„tQ0ÅdÂûÊ€v‡Žp¯hÔ +úbŽÖ´âC|ÅJ£6G,uì»_Œb€u§U A…1Ûmµ¶v0LÐË–hô°âåŒ_–qB,Ú•ì"§+·âÊb(פ“âc„…ùL mA8!XYhI2¤jXDÕÆ[ïØx1tÎ"òf,!þö¢i8Èó+:Ê/ñf¥¹é²ÊxŸ:æWµž»Ç£ì{åéÌ “«j2tN{­ªBO¨Õ¾r%\+dÃË(®´ÈoÕú{úGÍ|Cnòžó½ÄÍâl§ä}Ö“iœ3 ɸÙ_¦‘ÄÀ-CŒ9ß2+êcýÑM¿> )‹Ü˜ÂÙGiR84Mýk¹y2!IøÄ—,Šé:;Ø$é#Ì%m&™ß€°ÝiÑTž5c)xÜvx€ˆ”ÚͦÍU{[‰«Uq£ìC•ágÝ¢€Ä%«:«a‘ç;?2•Ï¹ +X¸Ÿàt—r=o_²"=øï§9Zý ú^—èŠËsçõåÛ§¯/Ÿ+C1Ûk‰É_{¸ÔÚê¢Á"wʾdÍòÈE éħ[¹Pj1,§9bøy­k}Ûis×cŽ%9qƒ”84å+¿E ›‚I¤!‹÷»¤ðY7À«ô¨ñó;–Ü\ôRþ©/è LÛab´v¢ˆ’»{òÀ3Þâ§`WO€ž›ÖÛ7¯`1*/üß«ÿ¨ÁŸ.ß½WÍó‹÷ +åWByóí¢Ù'6úòõ¥2Äa;/––Ñe€‘Â7Dx%À¤ +"œr#üOïDD ©b„ô³®Èý„e§W…¶°F1¹*‘ï¶H]ײwe7#€ÏÆÞ©SÜCl×µ5죽¾’ù¼… s7ÎâE”nßÎm)UrÉ/Îæ¶L,e&Qœ]Gfy´Z}ºÎ™¦Š¢.Ïͬ4(´RŸˆíÑžä®À>#ÇwÄa¶ÂôýëY´‰i]|¦ãä4 +ŽÝ–sŒçÀÓ‹M¼xÞÁ ›fµî™µ0lvfÛl²ìA°ˆÙO•A–AÐ¥!å0áHÓe*ô€6âÃc{þmÄÉw8e†ðm¤h®7Vë‹vR::e¬¡)‡¥z£ÜéÆ]ÜÃKu%ÊlBÜ$‡ I=$ÜoVõÎ\š5€£ ׳ü"֢锞²ý¡œð#F¬Ü¯4ÃN4òPIlʳ‹OÈfì_G+‚âÜM9#°Sú’ÖhƒÿÂùÁØåÌ2Ž[ Fî µ(ØV¢Ó´ +ºf +¢FŠ+Ü­Ä)šº²8N w†ö«Bû±¬g¡ë!Ùjà³¹©XC(¶^‡-’a ñXøƒ•«Iãꗗ׿¢¹â-•“ÔÐAþ90Qê»1é´uCÿÁ…CºÕ<¦,öÿ[!¢ÞMƒ”o¤ëÑï£AYw7Ìòǃ>Är©ÛbØN… ]’~ô}]†R2ØãX@{æÙ¸Ú]瀮Iàø©ë…ñ„®1ò#ûݽV+öÒ¿ÀÇÅàUÇé +ÚÅnh7”2­`BM@i kbW'åBŠîÔ¬™Bˆ„yiJržæÇ’ +B™Î2rå§çˆâ+)Њ!EiÎÞr²žy¶ ö’ô"ÊÜV¨êMªr0{Úñ”^÷+fõ«¢iL˜*;¤0îzEíáíäkmòzŽóÐ9fù‰a*võ“9 \s$òSGŸNÚRqà–h›u?Fvγo:mȤ6Ðãò +1‘sq $“rg§Cýóñ™ÂMGƒ¤®ìž ú1¦èI&,oÑ„µ#õoÊÑÜ«r Ï'uå°nÀ{ˆÂç9p`ɸ5=b•ÀÅXI™fj¦ÌºþŽ%Æ’SÝZ¤M*µ¨æ̸ï1V'kñîÍÅ{8ãYáiÔQêHÅ£0q8ÍÌg¯BÁ¾ÔÕ%ÑIøeVüßLU&kÔ·p¥~º¾mÇLšïíב%+ÈsG=s1‚Ä‹À]5 VÅ8È3}ï[`ðè}‰¶*ŽG!*þ Úè`VZf€¢tO(Ÿq½ŒäÀ$Ÿ‹àé&^¡Sç·Qè2ZÞò<—Rµ@µÂ3‡F¤e¡¿[h»ÃJ³Ûâ^\šG©Lc +5•—:œ;¤& +)?ŽÞm+%èn¢^FÑ5RΕ…Gjàq@÷Ì×´ÈW‰¿Oo’¶eá!ÁÔ5ª'endstream +endobj +4893 0 obj << +/Type /Page +/Contents 4894 0 R +/Resources 4892 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4873 0 R >> endobj -1845 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 700.454 512.306 709.477] -/Subtype /Link -/A << /S /GoTo /D (subsection.15.3.1) >> +4891 0 obj << +/Type /XObject +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/caution.pdf) +/PTEX.PageNumber 1 +/Matrix [1 0 0 1 0 0] +/BBox [0 0 31 31] +/Resources << +/ProcSet [ /PDF ] +>> +/Length 557 +/Filter [/FlateDecode] +>> +stream +xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù +ä +6\>RgÈbÏWÖ¹j[†› +WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream +endobj +4895 0 obj << +/D [4893 0 R /XYZ 85.039 781.388 null] >> endobj -1846 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 686.905 512.306 695.928] -/Subtype /Link -/A << /S /GoTo /D (section.15.4) >> +1126 0 obj << +/D [4893 0 R /XYZ 85.039 761.463 null] >> endobj -1847 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 673.356 512.306 682.379] -/Subtype /Link -/A << /S /GoTo /D (subsection.15.4.1) >> +4896 0 obj << +/D [4893 0 R /XYZ 85.039 736.911 null] >> endobj -1848 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 659.807 512.306 668.829] -/Subtype /Link -/A << /S /GoTo /D (subsection.15.4.2) >> +1130 0 obj << +/D [4893 0 R /XYZ 85.039 708.765 null] >> endobj -1849 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 646.257 512.306 655.28] -/Subtype /Link -/A << /S /GoTo /D (subsection.15.4.3) >> +4897 0 obj << +/D [4893 0 R /XYZ 85.039 686.905 null] >> endobj -1850 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 632.708 512.306 641.731] -/Subtype /Link -/A << /S /GoTo /D (subsection.15.4.4) >> +4892 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R >> +/XObject << /Im5 4891 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1851 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 619.159 512.306 628.182] -/Subtype /Link -/A << /S /GoTo /D (subsection.15.4.5) >> +4900 0 obj << +/Length 4366 +/Filter /FlateDecode +>> +stream +xÚ¥koÜ6ò»…›/'µ,ŠzÞ¡@sE{—¢Ms‹ö惼’w…jWIk×ÿþæEŠzìÅ!€—9Î{uÀ?uÅ~ óë4S¾Î²ëÍþ*¸ÞÂÌ¿®”@Ü +È­óÏû«»ï’èZ~ä×÷ã:±Åúú¾üà}óï×ïî¿ýùæVkí©Ì¿¹MÓÌûæ‡×ïo”÷þÍ7¯À©È{ÝŸß¼½¿¹UÞ›·ÿbx„ùåÝ»Ÿpî&ÓÞýÍÇûﯾ½·hÙ …qútõácp]þß_¾Î³ëgh¾‚éý åÇ‘–~sõþê?v)ž‹®ù«5Ä:óãL/i b‡Jç_§qàÇADDvp‚ºç“šßM{¸ 3oè`®mšªä3?àà ·‡]ÅWïºÀøƒ Ò¨8BÿÏ–5®Qáðf¨Ÿ¨â=ÚG¤ØÝwÚÅ0Ôx Äks:ö¥ˆØä qê‡i(¿±òçÔWAâgqvêÄÏãx•hæÖ"¢…K4úZ…v%Üòx£=àѪΔ¤^Qî‘šî}…?‰÷5Ãع¦a —q S³ÀtB•0Žü$ÕL÷Dú=Òýáæ©ßáÇÒÿVG¹\$ ð Þ¦t˜ÜvíéÈÍ~מ˜-WK=ù´xhø–u¬h‰VÆË ¤V À–· +99'ÔJä a D +Ð÷ŠC‰ íõ„÷ÀcÇ”CüÔ<Ö…n¨+ùX!xÅpEyƒç†Eèš^ñWµ¶‡æ…GŠÿVûcSñô©@W_ÂH’{õ0ÎjUÙÓÑ>S{h*‰ÆÀ<ötŠ¦.¹ûËÛ7¿q i «¹w(örô?ð¶B¯ki©vàYÆ?õjÀi²1ø<¸Ã3ž¿ Qí',ɘÈ]+”_¤rï˜Á9•ÜÔ«¯‘| ³}½Eri$µa2íaNX'ñ 8)3µ|C{(ï5.°1á<fM"²•yϽ—aGwºåÁA&Qëtµåb ëWŽóT#A²”Y?Ì2¯«öí@íÜ›1NÝ]1`³=0ð¨íx è>{`€h”¶“Ô(yG£AêG´2·?¿û†»È»Ìõ‚”e"å5$RÐ{fewÞ"ÊËÓ‘B/À˜;·ç×±%86‘|E'7gÈ"ÀLJ¶3d)d7Z€§û]Ñ;5Õ"[5²2͉°\Ø“Ád 2Ø7®Ô° üÄ3$íþ–m.8 ±g’t(YÙÇyä½A%‘‰yu®šO‚»f©RB Ú˜©Œ6„/7í~/zšƒL»j‹,ËV@GÕa¢û6° · Ô>Õ›î’]U¢°ÁéG\Ú¢\Q†© þÙUd Ÿêæe.MâÖºÎ#<݉or–éã,õs]fzè<Ó ÄÿÔ _oXu…î#vË®~2Ž¦°ü¡]°|¨|Xçf²@lÆð¹¨|‚ê¦0 Á7CÍjñô–^<øŸi˜Š{þRõ+¼J}•}¬XÌzÏkó ƒá!ÜX¼6h Åt7\Y¿ÔŒ`!濆Cåqwþ“w¿½×4Ò¾†ÀËQ¤º‚0Ud›Ù5MrɃ » ´]‹0y|—gw?~+æ‡Þ˜ÅÊê±@ld q O,„8R÷k¡QŠ +J&ÙÛv¨D é€Úr!ÑAhHÿ]ÑôÕÊR çL",p:4é D‘"ŠS?ð§Iâ|z«AYjŒV¡<´ÃÂ9p$»Œpvu(HW Œ&1 uÍe5a׃”´ñÌÏ5(Hêk‡O?J²‹¼‰ò‘­“Pûi`ºÓ*Aþ3s]Î ì·"=Ågby±tÀk+('cà@úX6„ëˆ#u1šÒqhü ¢aÌ,hñ…Þû‚ÂǧZï ¸ð<÷¾Ã䙨X\ŠÖzz!ðòPÔ²A1:$Mq0³àÁ Ë'Ãjˆ±/¬—²½” HB?7ÞïÎ% ^ΔóϤfb­ÕÅœ’cµ·âèÚÑÞAdó) +¢‘…øÞ¸,œ¤¸ØýG¾á÷¢º$Ê8ƒm—®âËØŽ0+ÙÁ6Ê4¶÷;r`’Œ™$½ h3׉K†éÙøW›ºhd„1§ó0öxì(÷Þ<2@±„cç—Ç°fŽ7;ñ7PJé8zEgÐ>8ŸWk¶(Mü`”C`–!3î2áf +CjY[¥Uà8„IÚƈ¶jqpŠ#°ôaL„Mç$ªåÁµhÇ{çôŒX"’º€ÃkZn7"ðž pÃ,N¶„ñð·~¹•Iܱ~ỤÁ s A¤C×ÓÛäµDJ³RÁHWáåã^v¤D P‚©0U€ci +Øp0UؾçEd­µˆÇ®mƒ1„|leª2ʔ㻗ÙB » ·TNµx`H¤XÙsß$úF™ÉæYCW÷û¦"!I¼ÿ’n=‰·7¦× ×UÛ¢+åœöFÚX„ +ˆ­¤¥ÞVˆ©Æ³°šð€h7’!kÛÚœ#A¿k»asBB¤ìµã¯ö§pEMÃÃSÚö<ølSU;Øׇz_È' BíÉæ[L‰â8`jY©h趇B&é@Ž2 ‹ƒ¶ˆ³§y l/Xã "½ã.f<ñºJìÂñŽGI|àd!ß”†Ò¸SqB§‘B†4Áiö¥‡£e:!‡,lDÁ&6Á®O‚S7²­5©Ø“:Ó|³ ¼`,sˆi7Æ8’|s“ÏK”‚b±.9^Fs‚¡¯ËŠ¿y:öN0K€t-0cÝGêž_4I%A¯™†¦ƒ›“«â,ß­dª·â•áÅä0ŠCÀr1Žs€ÎÇqˆ­É3þ6~ûŠ^S Ìmp HR(݆ªnÍiØ!Õ40 §6Lç~2CШ­0§Hž +cÂ,gÃ_«\[œ|mæx¡ +,òø+ù‚Éw¤”iÅGþ-øg ´¸ÿ `OUWWr¡*ü°]ä7)µÎbI2 ÄHucn¯î“'áã £¦¤%;/’ +´fø¼ôhågiþé.H­•ØÆÓ˜þxA˜j!5*Ë|†—˜b³øÃ`5E̪¤‚\°ãœÎ3+ª¤Téø(Óñ÷a½^ñ‘!{k½ŸêMµe‡ìg‰2Z›üѵ;LýTÅó°–eÓ€|–¼o!’§!’HÂiöÐ5aS“±·Ÿ*'k,œ¯õ‘Ý/„lQ8ŸëÞø“:“l©2%W(E¹a¿ÂIÏãB'›‡vH#L ÒîTIÅIÀãÄOŽ„oÊaÏÒÉ™*$¯ƒ&Ü”_$…3õæm¶]¤Ž¸Êß;”8põ#ï﹫‡Ê… P72ˆ,I'Àû}Ø×’}‘`@r§IR‰wI;‡Nª=W&ª¸3)Ò·•vò1Ú3úÔ09õæbSF†ÅÈ6›ÑÕÒÍØÌ7}Ëe¦Ü*tày¼*I8á û¿fG©¥-æ¦5´¶OêÙ¹Q.µÚÂ!æî?LS E„S,àe³d—øAL뙦yä[üùSÝ׆#¹À³R9P&z@¡ä_)[ÄàBÖTàs™²‚Dýt½b% +åë8rƒ (ˆ.A Äi®AüέX˜zòØsŽÁøü! +bï[hþI>~Û¡ˆ{?ŧØ×88ŒD€+Jb.<½å€2±äðÎ3ìXŸ‰rBU8hbŠ±—oÇÄN‰‚ç/(åú /˜jáE³æ¿NsLs*ŽÑ_ýæ¼ä n¿=U½(ñöïÏj©`^ÂE@æ¸ÌÂ4ˆsUæâB‰†(Å8Dö]-V§âÅ­XMæ¯:ðª~ïˆÍcÑ÷Ì¥¤éKÆí9á˧RÐ03̬lì È@Nò#X«H + ½0lS»&å“}6ˆvzãõÆ>¬`7O1æ’,Už:é9èl»Âñ’QÆòÄ«=½A7È!8ßÇ" ®5:óïø‰+üÕ·äæ*ðjñ Ïž§Dæ3–Á‘Õ{„ñ}½ÝÉ[>ìÈòY™Ý,~N¥>Õ6鳕:¹WIæ¾ZÈLêÌ™vM=U}2ï«>Uo\5*ð˜êŽ^`ȵµ/¨l©3•‚Onm ǪI6$qª”³y@»4¿³ªÁ‰_`Ýò ΊNÀÇ0™T¶¼à÷v§éK¬þ…]í—1·ù³÷d”¨d‡›ìäâØol¸~‹_¿“—Ë^ÉÓdÜëÎVUˆsîöíPž)½ëÀWÓˆÁµàñý÷[¾4…Í«6.!>Uzi„s|ÍY ü?cýVBendstream +endobj +4899 0 obj << +/Type /Page +/Contents 4900 0 R +/Resources 4898 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4873 0 R >> endobj -1852 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 605.61 512.306 614.633] -/Subtype /Link -/A << /S /GoTo /D (subsection.15.4.6) >> +4901 0 obj << +/D [4899 0 R /XYZ 85.039 781.388 null] >> endobj -1853 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 592.061 512.306 601.083] -/Subtype /Link -/A << /S /GoTo /D (section.15.5) >> +1134 0 obj << +/D [4899 0 R /XYZ 85.039 516.331 null] >> endobj -1854 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 578.511 512.306 587.534] -/Subtype /Link -/A << /S /GoTo /D (subsection.15.5.1) >> +4902 0 obj << +/D [4899 0 R /XYZ 85.039 494.47 null] >> endobj -1855 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 564.962 512.306 573.985] -/Subtype /Link -/A << /S /GoTo /D (subsection.15.5.2) >> +4898 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1856 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 551.413 512.306 560.436] -/Subtype /Link -/A << /S /GoTo /D (subsection.15.5.3) >> +4905 0 obj << +/Length 4346 +/Filter /FlateDecode +>> +stream +xÚ­[moã6þž_‘æK`£•DR/=‡mÑ—-zÛ½nÅa¯À)¶ µ%W’7õ¿¿y#Eɲs¸‚@9"‡ÃáÌ3C:¾Žà/¾ÎM©â:ËãPåùõjw]?AËwW±PÜ ÉGóÕýÕëoS}Ga×÷c?&ÔF]߯?_ÿæýý7?ßÞ)¥‚8oï²,¾þñ͇Û8øðöë7?b“ÞÃëÏoßÝßÞÅÁÛwß1=ÒüãýûŸ°í6WÁýí¯÷?\}sïØr òôûÕÇ_£ë5ðÿÃUª"¿~†rÆ컦B£•¼o¯>\ýÝuÅmúš¿ZVq˜%æúNEažëEš8JÃÜä '…&ÒNNIäÉ)Ž“PÅɵ%BAíÛ&º‚©§Yð%>Òàx«¢ êçóŽ3&±¹öF9eEhNX:•< se&¬ à£îoï’Â>£ äG tl€ mn“<8î¸þ±í¸ðt€¶ +©úkÚßøù%?ŽøYEý€6h˜.sݬ*ð™Ú¹ŒŒ”øþÉ«|:T»¦±_aMÔŠ×.Ä•‹q šdW•Ûí¨t¬q:P´7ŸC¡‹ ±Ó©ÖL<´ü|€GF<Õ¦êªÏ`6qü+2Ñý†ÄT[ú¶Äz&µß›Š 5 r€H(CC>qÛï[Iÿ†ˆ’àßðò˦p’© °í‘æM¦ø›50šÁ‘Ëåj…ÝáëŠÇÅl¦bRâž+^è¡ÃµX׫¡íŽüMOs„ážÉY •´Hú¢9”;û¶)»ê¯ŸÃ\’8¸ßHmÙôÏný¤ºÿŸ—Õ¨{‹L±„°BƒŒ¨Åp7 o(j¥“óšI¬`°Œ:XînaEJîé¹nzRÐœyDª¨t +¹áz\m|ö›ÇxnÜ9â”…Üã@Ý.\X¯{´qS26ŽëÖê)çÀÖ‘'¶ÛoËš&G¤%«e{¢uý¯(VŽ_‘ +Ì{`z­òÖP)´ü±“4Ôõ ;yÓ³G+£H¹ö•´[˜™ël¿×Q–±.ÀÎ1™ þ‰ó‡•‚†”gW6üb…Çß Ðm0|q2ÆΘ[ÚDO\‡ ¿çâI[jÞoGŽÈî6UÏo2 ÉãûfbÙNç([ËÓ´Ôð4Ø“ «×Xõ\CÏP2×G'Ì>¯Q×°Šb™j`÷k°'%Ö¯¹_°) —:fƒkç:…ló°Èb«æô¼©W8• ëo.¥XßQÛVÃÍ(ÖŽ¼®¹Â­ør»ÁB(ƒ™ŒOÜšxÏT'a_v°#Íyÿ*4bî×ìYÛ†øøØxÉÇQ˜ñEf„dÎÌÔÃE¨´ñ™lnÈFµÝN¼Q®ÉX%Ä÷VUŠ tïY!yä'î&§¤$aªÞw[vÖKØS-é†$5º ì›7ô)Â,hÇŽ}æšüÏÑ}vtZÃÛ¶êÅŽ7øL<Ÿ ìПjk£«Ï…š:ì*ªo/G´ !;ŒïÙÄ:WÁ3ëЂ¥°#•ü¸ÙwµÛåÃÖ +熛Oy n2rƒõA8@º©·¨³­¿}.B6Y{4)àM¡ÚÎXGD¡,"ˆ‚ç®*.Ú*'0J©gb!"T˜ú‘û:ôÎÂÏþS½­žœºÀ#'2ˆŒ +®¾‘þq¬¶AzÅË/Sñ§ýp`)iØD¼«°ô©.¹°ï× ÈÀ7k/«N»%’'écϬ+î ÿ͵nÞÑtÉö•Û¦iÍ?lVk \ h-í…5A\zÆ0ÀÔ*}ú{DçM“%"+ÛYLÆNÂé©g¤šö„§< ¥/ó$4'<Í,TF}žúc#ŸOîÜ"Ørgcʵu ¸ÛÅÒÉŒŸ ÛŒî²Ëñ¦GㄇBAO˜Ú„±Iˆqˆ1 úºcL¼iÄÚÜç|$„±vß¿@ª°K¾>ÞÙ¾î¼ÎN9N¢ ‹ Ç{ŒñØL lNø„ð%/²ÿŸÒ× |ê,ÌõT²  ˜_Y–ªí´3늞lÅÅuiÒ®k¢ôgÌ K9M%[…œÜ% ÐÞs%y5 e—`ÍÈÆÜ‘CwåÓÅz8˜Ôù¦ vLa6|Ét³À:ÿPÚ|v÷£[ö žô^ÓÑÊCås@hÀ(ÏÛ'Fâ5¨­‰5¡nµ­­ÏGïçÁ»v —ÂðA"YüR7…y]ä¯ÿŸ~ÃÝxŸr[_AtXqœ ºvt´;á„ïé´ØãZ×)oÍq] Ѧ` +¥3î¹fÁY¸*X³CÇž»@ˆO‡áuæI ߊ_fSö\µk»Ê~FÁ sÅ +±+_®$ìé?; Oßlû#5fðÅc¢•$X‘{Š)à€¨„êˆix’Bq(¤‚'‚XQòc®X7F,Ê‹ºñ­q%š,>~VÔ½ƒ|X1‚䥕'‚ºíR”@1c/Fù¾* Þßô`ºQ»ôaM;FÖ+ÙÒ@ßU¿KºGÇ‚Šbî$ÄÖ 6þÅ&{̼báïJÂAϸ¨¬ÔýRÜJºå S¡lØ„E¹ ÚŠ"1/·N 8WqÔ‡),Ùzð¯Š×]×ÉE¬ÀHb±èdH×)Äd¯>b3ôÏMl·\ÁqiCA® ;ª'q‰ŸïC¥X/‚5v†nÝ-’àn ý¶ÙØF •…²½>àpXYòãD{¡Î±>llB"NO—¡+”Úgç@„¼a–¼Ò<¢ó ͱ¥Úípêè£.Ë(oíà[3&¨n2XØpåÏ Ì]½*‰F߬VUT’‡Qqy*–æd*³G^L¦2¦u´M"í¬WÊIõvWY-µ€—Ï‚c úgæ¹Dä.DäøJÒ… ¿þT`zÝcZ'ÂÝñ;E¯ûr÷P.¡'ú콞ÒóÐ :º<DNQ:™ÂðL“0ÅUùóib28ZÙJ9Õ”3+Áe3=åq½;O —çŒF¢B§/‘è‚Ñ¢™ÑX³ˆŽü&§áЉs> i"ðAÚçëÍ*HO—¹ObFÞxÈý{߆Q)Q¯<#‡it’ÄdjiNXš¶4s5hIyÐœêÞo»øÜX™'yæ +X¶Á~ìgxÁ…ìY’a¢§áÛQå„,ÝÅ ªá›zÈ@|täJÙçÛ– 6µÜà¢q(ß,Þ@j·hf7 À(vzÓó·cää㽪ÈÝüAÛ«]K9Œ¥dpãò°oßËB“ºóݽÝQ´ûå9rnsÉ¥ì{A¥_½ýéWx6{zë ûAŸuä|Ÿ5¿¼'=¢ó{ÒáŒåÊ)]úÍÛË`H‡I_æDhN8™!*3åÄåê)è\H¡Û6(S*‡UL,Ÿ;Ç÷Ó=vŠJ/ÜdûìÌIoœâMïäâI¯Gsþ?6`‹’tr‚¯åÿ½Ãö(ÿ¯9 *wîjíï"c#Íù#èX) f<ÿ¶LD[ÈžkÃ>òN¢‘ä4Ÿ#9K¤.™f’–ì¸ Meo ½–¾\ +í§KŽ“ùø|µ/fÖò‰[çšUK{j·|Ü3C z“¹ð–^ÆÃMx9I^0SþÆøW3{®(ùaÏ®Ÿ&ãgðö_z9gã]Ê„2ŸIJƒ[Ѥ³+Í–gxà±0í­;Ü¥ó£ƒ1sG|™}šÉ¥a: §/üe嚥kOÔ°x£ x‡â¡¾ÍDpÏþÚ£€£Ì¦/î]*îôä›A¤½fš¤9ŸFïd:1˜gFtòKPãWt +lâé6¸ n!8 —æ*hýZœÁ\a¼—´¯Wtm’3Ù8¨$ýM2U,¬x®….œ_v”f‰ìctN~‘²ÇàDÄžÚ I ì1ã«çÊ>íÌlCºñÐâ>ôÇž±÷Žür´EÚÞ·õxÇG{záF ʵà#NF°‡ñ§:Q|eû¢AâD(r­@HwKð¬ÞÏÀú}{)5|± í$ò`!ý -?‰‘q…KVËŠø‹ƒooÇ;ªÑ,MŸžÜÕ˜ +þÐÙl­=ÇþKô-¡¬±2æû”ÐÖUeO7ŠÂÛð2½¼Ü/, +¹å ϵ<9á¸svqã³¹Â{ýrgÜ%ëüœP¼˜v…–ÄŸúQ”ó•xiLIÝš$ “ØòB> endobj -1857 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 537.864 512.306 546.887] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.15.5.3.1) >> +4906 0 obj << +/D [4904 0 R /XYZ 85.039 781.388 null] >> endobj -1858 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 510.765 512.306 519.788] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.15.5.3.2) >> +1138 0 obj << +/D [4904 0 R /XYZ 85.039 556.978 null] >> endobj -1859 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 497.216 512.306 506.239] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.15.5.3.3) >> +4907 0 obj << +/D [4904 0 R /XYZ 85.039 535.117 null] >> endobj -1860 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 483.667 512.306 492.69] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.15.5.3.4) >> +1142 0 obj << +/D [4904 0 R /XYZ 85.039 165.452 null] >> endobj -1861 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 470.118 512.306 479.141] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.15.5.3.5) >> +4908 0 obj << +/D [4904 0 R /XYZ 85.039 146.58 null] >> endobj -1862 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 456.569 512.306 465.591] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.15.5.3.6) >> +4903 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1863 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 443.019 512.306 452.042] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.15.5.3.7) >> +4912 0 obj << +/Length 4031 +/Filter /FlateDecode +>> +stream +xÚÍ\YoÜF~ׯÐ0–<½$»ye‘Å9,#‡6–7»Hò@ÍPmÎp<äXàŸºØlJœ‘Ó†`@Ó쳪úëªj²ÊÁ¡ÿ‚Ã4R¾Î“4P:MçËÿðZ~8¤ÇLºÌœ>ßœüëûؾÊüìð좟'R&Ò‡g‹ß½ç/ŽOϾûõh¦µö‚TÍ’$õžÿxüê(ð^53®tã$UYìµNÒ”!´*C¤ôš2Žåg¬)ÁBD +(?³(ò½o‹‹|Û¡°å8Å#ÅçÄ"·a \ÔGÚ'QBëûüH£šª·²á¯éøÂl¸Q7v6¬• _Ñbç î]ªªÙÅ|lT’ìçÝvÙm$b+>5ÿG¤Ð±Ð)è÷|cUÓ‚ë ª*yO0«gP0>£µ7Ö¾bVgë+*.ë¦åÒ<'¬Ð)€ÇmCËÈSÙÙòùÇWí¬\ñ<®å'½.j!ª3-`nGNÇšT}¾ä9Š ÏŒW"3 Óóm!V¬j©£‡Ú ë»v¢úUQUÎ˶ºåjÖÿy늪ëU!ë­ºõ„€y½’.·Çæô+W 1cï쪸¯ïa Nc,VõÒf+¦Q)¶‹:sŽêÏ1(\ãêb¶ðaËöSYÄsæÛŠÆ™f¢.ï"б6çÐaQ°B+h©ruÉÕÀûˆ ·*th@\ÿ5¬ð܆ÑÝÍfëÝ|¯!ü\J¿“׺ eÐpeUÂq\pçs¦»b‹ùŒOnoסÇuYU\B¹sÞ¢ûœ5u·{T./-½´¸åˆJ›;*±Ž÷t‰S‚»‡uè'°.ðôÜepþÃ@%è‡RðM6ÅÈ<:Tqh¤ÓØ, DÒ0”e3FJ¨|ÓQ²I4ïòûrdJ€çÞMY´sñ3P5g¯ 1T]EËGÅ$GPœL¬A²„ÍY4Ø‚Ó[âà ‚BþG’$½wBa@ï Ÿ¨(æ7>ÿϵ@îkFÜy§P¬òòæê§5©ýËëj½~=!Ÿ­~ûزðÛÁ34ð°:-&V8r­pš(¸ãˆQ­Öèµ™uN–OŸ®±d¼§ÍN¤M¿‹´le—N¤ìL+ß÷#Íd60þ¤5·ÍûWxÔ·7»@å¬9NÛËAª]Ѿ¶¯éT¾¶~ÝQ±Š3 (¼ +fŒ§¹”OŸŠY×&õžòý.ðþ;4{­pS¥Y{½|ÓÈiZðMªæ 8¦>¸ûÁÇ*²ß;¬Ú »~µ tÙ^Ú-ìvÐþiºŒ•Ö¬Wcìð©á_ß.dM"Šé h4°LªÀ}XQ¨‚$ø¬öÓ!d +ÌícËbÎa«â;Æ;ÁÛ@Íéj.ÉÈ5wÀÒ9´˜» 5 §Ø'3Ú¨ zÀ'3:Ua¨'³”ýšSÀg>À§iéE)‚§ÞžIø|Ì–.ôU€'4*Lâ ,]¿Ú°ÙG»…Cû—Ô:“pú˜ãÇ*„ÛÐ~à@•ÓÏkÉzB¦ÀÔ>¶,¦¶*úø-Ôæw>©ïD8ÛI”ö—À¥ƒ(¾ù½Ù‰¬Iø}ÄöLgXxÀGÒY¬t:•9s–œC{è0ä00„æùj^T5]þv#hn±nÒIªtœ>€ 4TFëO7jÎjS€gí<í_=“°ûˆß<éÈWiò€KP&>«es™àuÔ^¶,°¶XëÜ~£Á¯_¡¾zÄߤG!øZù:r\'“ÆÞ¬Äßq£âì¿ê¸oܯêj±‰“Èçñ¾,Ð:VYø€‹¥O;7•%ìלB™íãÀbÎá`s»Ô~ÓTJu_~0æ‘pIŸñä­| Ü ŸIX}ÌŽTª,yÈ‘Âca&°‚ýbSgé8=é_7“púˆ `˜EÊ$¼PÒÀ—Ÿ}Þ|!À½lYL9l±gUØXÊ.6p7@õ;,a $ Þ“' YBüEKˆÓ¼Áǘ¿ÜX‹È]‹ˆ=KÃ4†Ñi$÷ˆ]ü0 T¤pÒÂ4&û<è¬9ŠÛËAG—ƒpܯèœØ.Øž]êÝîÓrÓ0ûx«0N(c?€Ø,“~ºutV›:ûh·ÐqhÿÂЙ„Ù ¡3Üõ vìz¨UýQD±–(¹ßŽRrðã;ÇŸÍ+”à¢/ò6SÊ6 °‹*Çà9l P9(…6ÜšŸ(ÖsF1tÚO)ú/áeæ9Å1Ñ7ÿ–;ÓVÀó¢læÛ¦±‰*Ø´â߶£¤—“Á”$­gm!¾½Å£ƒÄ{é¦þȩ̀òÌIÁÄ®Ù.—ùæÅ$c¿§àõ Î:5ð‚Á̯¯ø‰Ö`Ы㟠ö\ë˜[:o-£•uYçH×e^®šv$V«*YœóíºãHuL5AìĺãÉ ¼YX:FâN¤¹æ_{†Î—Ý<b:\cìŽ$Óå’qzΉ )iÑÅŠ—µ“M².6¸[:åUSÐRŒ1ïŠ}žSäGL27Ž@ðmœcE36|zþŒƒ)/s5 5¯W#áÃq üH÷É4µÄòª”¯•×°ÞÊêŒòçÛúRÒ˜º|™a8?Ls—[.Æ· ÐBé>³"ÅŒMèÓ¦ÒÛf‹ÛÖU>/P×aس?LÛ9 +8èµ¼ ñ9ñsÎË\Äí®É`Ãηö ¡ŠÅªÿòÏØÉÁú‡ÃQz‰ñ®K JZH´7«7”8tÍ=jÒçœ_•„’»Aùf’ÌW®.Q5¥ a¦=D±¨#˜«¿k¹¼!l~¦îËŸ°J¢òâiW‹T騢 $iî’[û€‘;ðšuk¸"øRV€oð€û¼Ä”#G ;-fè í[ÐQ^ùB¼fönê.* ›÷úìÉÈÝž˜XÁÅ·ÿ<áq÷òÅH!öôaŸÂæ+Î…,Ô–¤˜°9tc¹æ¬ š³óè X#l%ÊvDYÖÖ¿I|¯ä!·œ…-[šŒe!%ô’È—¹ï^ø£XeöÕ7Ÿ[ÞOÌË´ Twý‡‹ÑAñ½ñ…þt':a4ÅÈØÑ¡ÖæmA¶öþ:”B÷sõˆ:ˇ¬ˆ!5à 9ùC#§¥ý>æbM¾ðýMDQ¨cL™¬¿Ï˜l/_¡ÃWÞìØJ‘‚¢]+õÙÆÃt l+–k¾0qJ‘¤=e*ÕÁ@P¿\°>œ×[«) +ÜúŒðk/ i<ˆ[a,¦àA‘ݼµª×O#N^„AçÍN'&º~¨ýåv|óÑr¹W°·\A; díŸÒåšò¶qž·÷}ØŸˆñXâ$˜ôáj½¥Åß­$Ù6÷•kÉR NÉ]¸‡åŠµ÷¦Þv›ÚÙr+AÿŸãô쬸ÙÐÍÉ#Vóâ†þƒ„ÒÞÖ8k4ÙçW÷¹RÉ‹s£Ø]yÝŒâ,VIÚyCmÑ´ëœ>Ù¢÷ó~ÌuŽ•U-]bIw*è&÷–«®Ý„+JÎ&zBE+ ø }×@Ó0•o%ót÷Eî‹S¼Ý‘ý¬á ecÉÏþá¯ü>ê¿â°)ÔFéÙñú6 +Áè-”;›{ï'ä¿ì¸Gð_cEendstream +endobj +4911 0 obj << +/Type /Page +/Contents 4912 0 R +/Resources 4910 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4909 0 R >> endobj -1864 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 429.47 512.306 438.493] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.15.5.3.8) >> +4913 0 obj << +/D [4911 0 R /XYZ 85.039 781.388 null] >> endobj -1865 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 415.921 512.306 424.944] -/Subtype /Link -/A << /S /GoTo /D (section.15.6) >> +1146 0 obj << +/D [4911 0 R /XYZ 85.039 678.921 null] >> endobj -1866 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 402.372 512.306 411.395] -/Subtype /Link -/A << /S /GoTo /D (section.15.7) >> +4914 0 obj << +/D [4911 0 R /XYZ 85.039 657.724 null] >> endobj -1867 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 377.914 512.306 387.482] -/Subtype /Link -/A << /S /GoTo /D (chapter.16) >> +4915 0 obj << +/D [4911 0 R /XYZ 85.039 545.939 null] >> endobj -1868 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 364.364 512.306 373.387] -/Subtype /Link -/A << /S /GoTo /D (section.16.1) >> +4910 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F56 2890 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1869 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 350.815 512.306 359.838] -/Subtype /Link -/A << /S /GoTo /D (subsection.16.1.1) >> +4918 0 obj << +/Length 3757 +/Filter /FlateDecode +>> +stream +xÚ¥koãÆñ»…{¨qpbøX¾4Àå&Òë5v€é}XI´Í„"u$eŸÓ?ßyír)Qr€âàÓ>fwvgç= /ø^æ‰ÄÅe–‡~œç—ëíEpy3ß]„±¥óÍíÅOÕeøEP\ÞÞû$¾JâËÛͯ޻ïß~¸ýö§Å2Žc/ÌýÅ2ËrïÝoo¡wsýîí8¥¼Ðýéúýíbz×ï¿cx„ùùÇâÜ"½ÛÅÇÛ.¾½µÇ²ážéÓůƒË œÿ‡‹À‹üò ÚÂôöå'*–~}qsñ/»Ï©K^5G‚$Îý$i& Â0òã0ºÌ’ÀOEDàzX,£$€N½;¡·n·[¼²n`lÃδÞ@»D€OÐØë¡dÝ ¬*<½öº®aò™gžQîµÝï=wïÚŽŸi|/½ªa¡7h\\Ùs×Á@À‚Gr£«þ™W•[ß³ ‘nÝóáóÔ«zþÕ5G/¢ À·Ê3èÓì} ¿™‡ÿç„W"JZþ¥Ã}†™]]­«ÁÜfè0¥`Åî¸éÜ6O¼5Bµxåÿ¡ºG¸NŒÐ4Ö†Îròá¡äÆž]ãvÏ -[ÛÙߎHuLzwÚvË\>@¿å¦y(ætzPlà)ÛÛ]Y?s Ê`rì¬ð"U=,+™µÌr‡ì¶¯‡Þ?%0Aêaq^ÒGâòfC¿H—ËÓB,±¨ƒt'>`NAÈཛrªæΖfÞ~Ç¿Ï‹8ä—Á^»ˆeî|èðõâ/I½w @™þÄ-Ò"ôóô¼¾r`NËjšÁ›Ôã-ÞÞ †ŒpHU(dWüÙ!ÛX±À‘ßð­VÜ~Ð=7›ð«þ¡ÜðqéÎaö¶¦›Þó4²¹ƒ‡yº{DâÜò Йy’N"„OÂNÄ⧊Ě;+BZÎ0è¾Ç3ÆY +0QAŒmT»z‹Œ¿Â>⤭q+Ðý©KË@ùYú“6îIÜ:þ–/ à/ä…“GP°hÏë֨̇hå™rkÒ^`"Øè§ÔÅA‘ë™13Òz’—ò+c”0É(Ri´ Uš>šŠP‰Ô•è¢²°!7vú=’mkàµâ˜!`€, ZãKÂnвú…ÖëžG]f µ~ïž‚ÀŸ{Ð×ØZ({ßì»u'›W²éŸNéÊO¤n:Þ©´æÌ2Y¶ßF{—+î°EPqÕÞ_%J.µfIÀC®[¡NMGÜÛÚÝñ¨8 ¯##ÓÖ®ôÊÚe4®såDn¼mñ´ ž¥ +b"üƒ´…!ĈÕ<ˆ(ö»¨·UyÕÐsƒv|B”p­4‰HÖZ~zûÎØ:9ôpk°ã0’0æ_Œp5“=AÆg‰ô;~f»;Ú“þ¡Å§ªÅ4•¼(Ýf5¾7‚ ¿ª¡Œc‡Ãcá95Ú­ºŒ#Ç‘§ï¤Êæ¤fqðŒœ‰æfÕì¼aWE4Ž{Û[áàqº°Ù à³lDÊSÜe æÔØ^˜{ªàÎÔ²ÌlT:Ž$Ç“¼áÎÚÏJ2kŸêR&Ĥ.wÛ5^èåVÉÈiø¬ÂŽo;täNVäùÀFȲqv @îypôózQY’yß ó°@„"Ø'•ÆÈ{´väPèl×k´S1,«Èãdô`äId]O–vÜsY5ô^e·?f^äך%%ÎÓQ­ÄÆ+ɸ ›‰¢o,zº”%š×Û<Äì My§I³=¼#éýaiߟ§Fƒbß +7Ò²òؾ¢÷Úÿ{(Æp¼#¥Tê5®"FE0º$…<žV…Ûa3ˆÂƒcÆ2Q[¯D}áVz%*þã·FŽ +,Åu#@¬\ÅPáˆë°G ;×Õx˜ ÃUÍÁÂZ÷snôNãCéûNã…hC‡Í°ÃÄ+¹ƒPºÓÛ’±u² ½ã_£Ä±mxàØŸ‰b#ãÏ\ý2ã¹D¥™@€.é3讜ÙT姆²b«×Ý"ALï~¼Œ^©9p(â¹B"òºa½z™.?&r?ÊÒ 1If©Ök9r AùC[oF×—Y)„Œ³Ìx[I£PW`´ÒÑ ®yCô“„Üd_F™$°æ­Qp9zcÈÉÛÒÝ5§Ãìic˜Õ ëÉ< =G9ÔÊ&Oa”+ M|y¿Þ×íŠêReÝbm&àâÃäÎ’–†‘)KÃÀ=B<ÚÜ… µÞ&ç#ç)³ØæÇ#ET‚ÁLù©,‹KL«È„¨åÑMØÊ]òØÚ°è (ウ•qré'©Hh“s.n¢„V¸ZžAÜÀ@¦3¿º÷Àîø\|2J¶~†G›²+\TYL9°Ê&‰ÉƒÝ0ìA–M A¤~™™}Ý‹éå)Ô1g4U¨$£Ùsø6Ö]Âdd%œYw¥¶×­$É„üÔÐ8™Ãü (GЊoM&8LÈlMA€¶¬¶Na¡˜UA ¡Yø6²]ÂÛXŸ^ÒÓØŒßimR9biª|#ÑGoH)ÎÛTØ„KÐ)“ŒF=Ö2&éTü*` Ì9ìÖÙØ,Óï'µÑû–œô$ròÖI4XMø ã[SýÅUV+<}râ¦ávßZWÀ~~ý ­¸<£“Ķ_5íjRþ½çW<¥ÙvRÒ¸µKU¬FÔz"Žsúçó£èÙàò‰eDÊB4"]5¨ïF®ŠÄyª•3c€õ§³­Û½Q.4ÈâŠÙBnª+0R ˆIÄH ‡XÁZÞ :*øãŒ#åsßÜ”bö»«7=4•ÍC[jªæöU`)X.Õ…A%qU™ +¼$þÖýI”’ÈdN9g0ÿ_»P +3\”Ú†MX«¬ð¸‡‰=Ñ]ä·”Ÿü LÌPn Ø*ÏD¦,²¦´:*“l,´‰M—ñhqÊÊÐÊÞÛQ ++J—Rã7·8ˆÍ6*ûä–à +þAIã ›åRR‚2Õ‰8¾Ü?p +ƒ˜Œ¶xc%_›ì8&8 `U³®÷›Ñ’s';eÕš­žb‚PI&´ bïyTÓo2–†öäQZ0']O×@P›Û/ã3“ôÀoe“]¸Á~#«4ÿ0Á°5z|pVÊñ<+¾*Qêø¶5 ÖÙ‰UÊÂ¥vðUbû–’j’`Å©N%3e/Ù¬ç ®Žq#Á$ Z*poI|ââÀXìTÌO*µŸåˆù™)FL¿Ž*²ão¸`¬ü¬·»º|cøÇ–Nä9qR2ÌE +2¤¥ q„Ó¸ðTÏh¹vOjyá‡)|1lw_›ÁǽK yà‡y8-5L°r=!-üBßÙ@%+FWâ Çp£wؘúÀ´¦Ž |rd©&ÓL²Ë0öú«×,üì4%0{·mŠ¬±¥4˜Ú…-b—æðr¼rìõœ2Çcï†þËÚ'~e— zü4N…i€ôpÅ(!n!Å‚¿ñO¹~h¹õ©”‡= “ñ÷ë¯ùwúŒ_ñ` ïDåYµ3«¢ÛÚíŽ_>‡&‡ȃõ~lmÁM½»‘Åg^çTr¡g+àØ™~¬„mÓW›²³Ÿeàv&4fƾcGd‹;V/OÙ›WhcË4çïêR¾˜J5L’ÛÛm©PCñ8Œ~BèîmöâT\šÍ•f¹(¤`S@i×âÃnR¦¹ÁšÛ™oäâÀf¿óƒ?âÿë«YûðOó³$Šü(4g¡OÓäð¼æëÚ£ÿDÂË0endstream +endobj +4917 0 obj << +/Type /Page +/Contents 4918 0 R +/Resources 4916 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4909 0 R >> endobj -1870 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 337.266 512.306 346.289] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.16.1.1.1) >> +4919 0 obj << +/D [4917 0 R /XYZ 85.039 781.388 null] >> endobj -1871 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 323.717 512.306 332.74] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.16.1.1.2) >> +1150 0 obj << +/D [4917 0 R /XYZ 85.039 706.019 null] >> endobj -1872 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 310.168 512.306 319.19] -/Subtype /Link -/A << /S /GoTo /D (section.16.2) >> +4920 0 obj << +/D [4917 0 R /XYZ 85.039 684.823 null] >> endobj -1873 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 296.618 512.306 305.641] -/Subtype /Link -/A << /S /GoTo /D (section.16.3) >> +4916 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F14 2895 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1874 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 283.069 512.306 292.092] -/Subtype /Link -/A << /S /GoTo /D (subsection.16.3.1) >> +4923 0 obj << +/Length 4132 +/Filter /FlateDecode +>> +stream +xÚ¥ksÛ6ò»…/s7¥n*š$ÀW:ÇI[wòÐÅîäfÚ~ %Úf+‘*IÅÉýúÛHP‚ä7™X °ûÞÂóþ…çYì*?O³ÐWYv¾Üœç0òãY(s™[0¯nÏ.~HôyøyŸßÞ뾎ÕùíêWïê§ËÅ훳¹RÊ 36OÓÌ»z{y3 ½›ë«Ë·8¤½|~¼~;›‡Þõûa~Y,>àØ,SÞíì÷ÛŸÏÞÜh  +9âô×Ù¯¿ç+Àÿç³ÀWyvþíÀaxsHù±Vò½>»9û÷°ésžå"A¬2?ÎÔ! ÂØ¢AF¾ +£ó4ü8ÐD„e³ÁsmŠz 2o '*ÚbSbw_¶Üûy'Ð]•~çÞ + b;›G)7kè[Uø÷'55ÿö%7:+û¾ª ĽàõpiD …e"è® m`·E‹¨mx Ú;€mZ%Þe=G9æ!R+§Ó5fa„%¾•_xÜe]2ƒqBí%.qñƒ²‰ûi”ž~¥´è°ëgó8Š‘zL9üøž.v]{±n–Åú¢+6wÅÅ]U_l¾Ò¬nÙV[™û­üvGD'I?Kó“2oÁ¿#Õ¾Ò‰Íï$Îü»yóHò®ëºù\ôUS#S“Ä«_Iê݉Bï®à¯"Θ®ª—%7#?:†yœøaœžÆ|„9.©‰Ò~œ³¤¾"6ÞfM‹¤¤„¤l»Š$-U€ G~ð-|f¬¤pлâf2N³%Œçuƒ8ñ’F`Òˆc#[õ¦•9Œ ·?‘دœü$»,×UÉ{HÇ~ò±øjS±¯¢Û7(öQžf4£¸æaÐ ’Ù$±È—¤~'° .ôvêwEÍBëÈO“P ·H€Í ¼%îZ¬×FMHåÀä=V£& +„MA7`H2#ØMK7x&X|Ù¬O©¥ˆ +}ù"Õ<„#¤a:¡Ø⊀¯ù-™‰–;žËš[£=øÊÝ#™B3HÈ4ö^ÑZ„N=8Xðð°¬,_rtøٚ×eÁ¥3 IÍ`#Ò3Ä„ .asZ*¢¤r‡¨n‰œ Má~s¾(QdA½Dãð>I Ž gÏ=V÷(¿@/Q…p墮:ê"ÒDGNq i'Û­4ªÍv]òBÔ|FI+¢+Çé´ïnæW.±MÁvä"¶¿q€`¤òß;ÖÔÚסQ‡¨å¦Aë¼{‹ þYÒþY¡Â·ü PÊ»*@8c–ØÎPvUeñˆQˆF6Wp˜1G +|Ä8‚D4ÓdPXmœCÄÃ@ùyj0¿YàŒ8>¼½¹q AaB*Ð5èKZq_ct` Ò¶ä§dÏx߈‹DM§Æ¡=ðiAÙÑ^îöQ|i±¢(%¬r!+¡­ÜÕKìB)ZW=.úÕÚ†DòsµBÁÎ; `ˆ`ýº|âÒuñ©Ä 8—Rÿ^/×»!hé^î;.ãpb•Aty.3·€ØuÙf‡ž –‡0=Ø\[¨NoÈ ‡ûM$OåúÅ“ýnöýU%Ì_lˆú×놘ź¥`< Á“L#váôãAœKv ~ ôåñEž]pü|AÀóÉ«¬+Ãã*mÞNR3—.JÌ +]hê“*5D m¡‡qàDÞ7Ù8ô(‰ü,-]þ¹Ÿ$êqNˆ‹='.§64ⲿŸS\¬ý~Ù¢Yi}[.¡yî” + ÇWm5 —$3øŒÝ·Å懮< Ðï²,‚DF‡ÆŽ^’-&&'‡놴<ó'ìúoA–zåàdžùAZ~âð'䩘FÐE¶Ó1fP¬Î!Ž*çÉ¢×*slïòS¾T¢ŸFl"Çœý(Ámy_š½›}þGp”}CØŠà@û -Q0Ðs üPö×D$I {äúË‹ ðß–èü®ÙµK+(ýºì÷qÕ:ñãTMqÝVsÃý•žUHE~ ‰ÿI…´€Ž+¤zF!On( +y°ŸK!íýö;ò l“ba£¶<ø–ˆ‰Ú®Dû%œÇ˜,4:N‰ðà+¤ø{oz*ô¯%j_X¢P¶ÄFZ{oèñÝüÜÜu(ÇÈ ov¼ìigßç¬= XìoŒ=ÇP+æPˆï° óú=¬(F ­”:ôó0}F)G J)@Ï)å© RîïçTJk¿¥4­qN‡–fÀ‚‰?[Ž©F‡®0μ+b@ÏÞ$™\ô¿…›\Ä‘¤#à(ÊvoÈ›«·ä߈ÙÌΈ<ÔÔ…#¯ï G‰½?Œ.{JIŽó¸¹Ä3|NðQ€žãã© ÷÷sòÑÚï|gd71ºHCÌ&õЪï„{uîûkgè& ¬ALJ‰v­Å6!0šÒǶÁî‡Géz§MÒA£à+µ¬-§M£º*ÈJßNtÌv[,»±Lk“dý€âQÕ÷Tÿg¹ÐÞÊfÒÚocÌ,­lª—•¬~h_ s×`™QV1mìҊ︺[UåáÒ´~±.˜$R0ƒïVªÂæ +£øþ±è¹õ‰Š`<¼¿Åb +NýCÿYp7ªuÛÜ—´hg +nŽ“Mî'=&ÄεH6Ä-¬‰aÒÁÑúŠ;z™²£â/rÙ(´»¾ .Z‚ÓùîƒOÕ‹ûH|¿ãJ|[L®îp.ˆ ÁLí8”½,ÞRi¶TÆ*®Å(&bà·¨M¥1ч~>‘*ÞÖ{·‰‰›5‰¦’ºJØÖ°À 2ƒŸÂgèÜ/Ë î9”×I*`E¾îÙç$dåªùò£™ +€¦û#’£\ª1ØuPéÇQ.ÇáV–Ÿgx2™Ãr²È \`k^ˆ×w¡Bÿº|0ª€#DQBh&öÔ€’,Ë[”ôªéÈ6-ûnjUØÍHé}©¢}T5ÙFÇcñãb·¦u•)„·›J¼©MÇ‹ +I«‡e{Lȃí}'…}È«‘ž‘Tµ0ðÄŸw|A4DˆÐ~aû• nݽÙÜ`Ÿ;¹×8õÐ\%ÂbO|ݶžÿYK-Øå|’Ä[&®åÍç²ýÚÔ¥û2Fãë‚{à w+×òzÜšm'Èá# óã6‰ò—{IGII‡ãÕþêü “@á,û—ý”u(­Ñï‹Îèú̇7༇`ÓqÇ©2ðÓwÜÌp; %ŠõxÇEDöí|èÑíQxW¬uÏWñ¯AŸ(¦ÀÆy[ƒ²êÁÖ+…Èc¦Ä\¥à …ðoj,ƒõo×ñ«“ÇaŽ_á‡yîk™["r§yÀ-¬X‚âaèY6”ŒìäV?Ë!¦æ¼e'W:ôÄV ͼ~°“ðÁwŽEݽtIvø©2’}MV)§0Uƒ–`˜LßW¼+6A[Ø–ãxÁ}ípiH aÅßÈ’’kÕKÉž–Yã 7Ì&U‘º:³yH#0…‰‡Ìf(„庞 0Ž9ÑòüSþ9¡5ä“*­&p —ÑKÁŠÖ•Í;©}àMi+Ó¶ã»øºçÂÅÆaéÀB®2ô*bhFÿ_®²½ò‡²Æ-—Þu÷„NñÃo2®øû(6O'çhIžxï:5 +ZÏ`ÄNø¥Ð†Ös]¸æÚ×¹ § k#`mEç+7¥óÆ(Ž}=dµXÛŒ¢ilq¬)µÒpÀ ™P‰Ã9|3 £=;¨£Á¼Q,­´FòiFËÎQÆ‹áµFÃ+´tË“ÀT-7/Ÿ¤Oàªzˆð¹FÌÝö%`Û¹nE°3Ð`m.Ô#”7ZÅó«+ÙW~X·mÁ$Þ.°Ãlúâq¼8¤Z˜1$é¹ÎD¬¦OûÁ|J01–âl?~„žƒ2O8\ï‡9¾‘Ü_DLÅc\ƒíN¬ñצì9£ýRN``× iDœ™ø©JÓŒDž<`|$€3ïubH¤íO"‹¨GÂÌoù5—S’ÈC£‰w»Wšƒ7ì+¿`‚<œ$gÛbHéšÜ Úæ©ÃdbL®b%„Û;8'íx˜HÛ&uT¢à8AYmá¥íÒ\X’[ß,æÓW:ùÑ +Ý”Zu É¿xDæò#Êuµ:rƒÊÝì‚|ú(ò Iöâ!/² !©ÿP¢úÅ”ýLÉ>šRôf)¤Ò±YÝQyµ“¬TÜ"5%#-øŸh8 +á©UÓk¶Tpl¦’:“4 ÅáS†l +¨±û–²iç-5/åýIÆÄ‹¡÷÷ß­ä_bEîá +­6Ù. dò<%—Eb ²h´£æéX³Y_1©À»«$¹Qòú®!|ÇsÔ–X‹(œòqCL~€÷·–tDB:ð³Ü(øðÆÉ¡å ~qâpO*ˆ¬wöC`ç ïÞHÅÑDD Sj=”=—Ç?Îç'TMÜ÷ScMKF¶wPñÞ»?è@hG±¢>Ci˜%õ™ÜVÈkÖ°ÄÛ“5ªc`ļu>ìR±¦ûì@¸Ðû +ÎVVuÀ™«ÉæˆËá?“òÿzl>D÷£d*w÷àNü(4¸Pæ’$ûøšGéÿ +ïo5endstream +endobj +4922 0 obj << +/Type /Page +/Contents 4923 0 R +/Resources 4921 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4909 0 R +/Annots [ 4926 0 R 4927 0 R ] >> endobj -1875 0 obj << +4926 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 258.611 512.306 268.179] -/Subtype /Link -/A << /S /GoTo /D (chapter.17) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [297.182 492.39 447.569 505.291] +/Subtype/Link/A<> >> endobj -1876 0 obj << +4927 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 245.062 512.306 254.084] -/Subtype /Link -/A << /S /GoTo /D (section.17.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [343.406 465.291 494.306 478.193] +/Subtype/Link/A<> >> endobj -1877 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 231.512 512.306 240.535] -/Subtype /Link -/A << /S /GoTo /D (subsection.17.1.1) >> +4924 0 obj << +/D [4922 0 R /XYZ 85.039 781.388 null] >> endobj -1878 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 217.963 512.306 226.986] -/Subtype /Link -/A << /S /GoTo /D (subsection.17.1.2) >> +1154 0 obj << +/D [4922 0 R /XYZ 85.039 676.879 null] >> endobj -1879 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 204.414 512.306 213.437] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.17.1.2.1) >> +4925 0 obj << +/D [4922 0 R /XYZ 85.039 645.354 null] >> endobj -1880 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 190.865 512.306 199.888] -/Subtype /Link -/A << /S /GoTo /D (subsection.17.1.3) >> +1158 0 obj << +/D [4922 0 R /XYZ 85.039 231.247 null] >> endobj -1881 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 177.316 512.306 186.338] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.17.1.3.1) >> +4928 0 obj << +/D [4922 0 R /XYZ 85.039 212.981 null] >> endobj -1882 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 163.766 512.306 172.789] -/Subtype /Link -/A << /S /GoTo /D (section.17.2) >> +4921 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R /F14 2895 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1883 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 150.217 512.306 159.24] -/Subtype /Link -/A << /S /GoTo /D (subsection.17.2.1) >> +4931 0 obj << +/Length 3742 +/Filter /FlateDecode +>> +stream +xÚ¥Zmoܸþî_±°È*"õ~‡Ms×»r©{všn>È+ÙVowµ'ií¸ýó7RÔJkm D9’Ãyyf¸jÀŸZd±„ù"Í”fÙb½= w0ò㙊•¬š?]½ùs-TàçA¾¸ºøÄ~‡‹«òÚ{÷ÓÛ‹«~]®Â0ôTæ/Wišyï>¼½\*ïòý»·p(ò.àõ×÷¯–+å½ÿø#Ó#ͧ‹‹¿àØ2 ½«å—«ŸÏ~¸²Ë²Âr\Óïg×_‚E ëÿù,ðÃ<[|CôÂá?;¡þd¾¹Ãwç;t®EŠCš}”ú 9Ó÷[ Úƒ‘öÝÌñGàCÚó 5cKUZ iî§Iþ‚@¢g*D/ ô¹ @盨3ßÿ"Ðn{ƒÑcRåë礚úQ`l]ú”¥V¾VÆîZŠGëÙ†~™oÖhÊÛ"{åmhâXí9v§/I|­_8=KóÌá1ÍKg÷ÌlæèŽ&›=¹a2{p3’ᇱ‘Òaße‰g6æ4æ˜Ðe5ÈsG‡zpKd Øs Њƒ3ö¼û„Pê’{ÁÈ–›ÀµB¢î‰Œ©7Ñk ±^CˆG’¦ÖØn¹ýàٛ߿f—˜…~”ª‘Küpñ«£¸U¿öÑýùL¯?¨ˆO€QD±1³­=ñúâ7‰»øBBÅëk’úuÆÞ®ée¡ö„}·ä)6 ²yDÞ´ÿ;&¼-Öý·sÇç“¡_lL't’yeƒ/!ðmG††=¸À‡ªÅ `å'†;Ex#x#Å*‚çžá°o¬¥V°éMÒY h´ˆhS͹]N= œéÈûÞAeî (Ò¢HÚ(¾ÞàVþM».±_{k‹’P:O³V’dL ~¼¹Dq aÝ?YOƒgE9CYlÔ›õ) k4 ‚;j–Ñò 'e`:c&4ÕÞue<Ê(=Щi³='~¥´¬¥1RR›ðÐæš™ÝÛœê§nAæQúÆÀ;”üíÉ*w…Ž¿|¤ô‹5‘)M2ƒ" ÑÄ]Wßl†9)ÂàÆP¨š‡–à´ÉÖö­ÅÓ¤Œ‘SLUàœ·L¾«D|ʳ ÿDzC õl]¡¡h­aTù9z‡!'!j«”srhÁ‡I5(A fwEú˜¤˜‡'JIBl);†¡ËjMÑ^òx¶´[„´ÍƒÍ¡ÿ–(G€7 +Å*<µÃ0ñÀ‰gw8ÐÐãd¦êö°ª€;¼Fˆ½ ѽ®8ÃâÔ{èHÒ« +ÚãLPСŸg&4þ k0à'@”C¥œÝÃsš‰C'6©¼‘[§ö57¶EYq«îåƈ*`5þŠ}æda®¥Ø ?%¯Ul%Í$¢>rê®÷ì¸IJ•©Ô¸È¯-Èýf†–» ¼›#¤KQìDÖ8u#ý¯•;å2:@"RÇ1Ú>çž©ãR¶ùbkdPl‡FB.Ÿ½øC½2Ô¶*úJ Š +¢Dc\g\ Xï3x8¾v†ò¯ütò^îx¼‚8}]pÿ\…‡í¾‘È-DÉ.Æ”aĉ֨πu>“Ñ–¶65Zaür¤ ñ0Jxò£xÖ(Ao>øo!ä‡Ñ'™†ì.Qù#Çûš NLB‚á°P—•LÏÛ/pS+r(&! )×®¯å> —u/< ÑÏlu_tÝã’*ˆÊ)6¢|Úªä€ê€C8 "•ÔC–©g‘ ÌâàC¼¦änVª¡5‰_h+Qàý$xÎ|!çƒAE;áö¼s÷É°ôRª +¡ÓÞî-JÙŠºƧƒ†nLê€5AãȃvÁ}Ñ‚u Û‚.6c7Ì +ú+µÐµiHv\˜–C2†á.SÍ#øÅ’S4üS¾B2?þD²Ã±5!ùMÑÕÊW)’µd”¨h=µ@; w(Û4)—æµCЗuã0gfNRz´e Œ¬À©&‡Ä/*ò PDHhÆfM:yo9•x¢ñÄ?Û›^ô‘¥8ˆÊ Ÿ”!36êH% ¥­õ#ñ`nfD-òÜ å‚/RáxsÆYªÉÒÔj ¾ êàÓ–·ñ…+h$#CæN9›K€X“L{WF‘lA‹<n÷.cÌÝzs( D¥)ïçyì4ñÎ ^i¤¬5æÒ#£Ó S †.!rS$Ù9ù ¾[4¿m\·'æº#qn âÔF°=ÜÄR09/Ž’Ç„ÏG)æf)v=ã¢X?‚Á­B? -½ǘ€3&´ftÔ1x€è³W}ºÂÇŒ6)ÑØÀ€ûÀêØ qجñÈIˆÓ^>Ë(ˆF÷;N%||b{ +Ä´N¤?Â=ØeqÒY……ö(âR¼êI¼Âõèʆ½ ÒZˆí ÄïðZŸ˜(¾ãP;Ýõã}µãˆ„~@Or4€‚NCó¥”ëDôPÁöáD‘E8vuÈW7š/¢ý ƒAð,rCAŽPÌ“p"¯êZvÊn®]öœ,œBO”i²JF1¡œ%¨8÷ŒberEè bÆ:±aG³ôº>Åš“p vbM`-¹Z•ˆÁ‡5¢~_{&D F¢ZjIHôIÞ}èØ)#ä! +a7†<4Áê.ðÑY<÷±ÿ8J›øŽñξ8,™à°—ÅjøòûfwŽy7ßV…pú?øz‹X7ÆMqÉ.‹¥z {AIoŸÉxÆu³9Ghäd­ 2dvL ‚óÖÙc§®.etÇ3aê…GAåIf)ä3Ný’I’yÞÙ|}¤˜ôÑð YG¢”³ebÿ¿°”ÑõS¿Œ¡ÆV¿N•&à¼üX§Ï&îÍéÒ„NµMÜMi"”ÒÄ;LѸă’¥­9Å +Ú}ok˜`ý¢:µâ$÷ãüùbŠCsú:†Md,«÷t;°`K +ÖðÆÉû© ¤îæ2¾â~ŽÁÙ$)°7c9cL$™øþøÇÐ%pó5;ù'ªàxˆTÊÆñ~ G½k†Xx¿;,9? UFnR @‘®Á»ã›ÁšÐœi*éæR„6¯ö‡ºC[¿’¯G^IéEqháZÂdFÓË%GÖËÞÁ¯s‰Ó*Lç.ͼ±{ƒ}›Ž?@,ù +#¨!1U{ð)¬ØJKî\OVÆ´\ŒÃ&£ hürÉÏIHL³q-;z[œløVj§ ‚Ž™Ã-vä(QrÔ£Ù9BÚéãÚJ†àáØRÿ쥆Œ±‡RRToîÎi$p#3²ÓnMÅû¿í“UUãLéûíÌF«¯Q{¹•¡ßÜHY*² *ÜÞša×KC—FìE€ó«‹kz2FüEüÌ&<.ÄðjfÊÐ=¾WàÛDñEî^þ¥I6hçGLÍaSr×Öh=dõ­ì7Ü›Çóhé\Êä0î,_E¥ ÞTNØÝÑUà ÿ%š¤*|º“N°©áX™ÒÜdÓs?âÒ:wŠ¯ƒSàÁ8 ü!~shy×xÿi³2CÂ)<4ŽJšP"æK›ƒM ãï æÓRØCÆ(Ð}A‚:çwuE{C¯¥Î¹[0˜)T8§|ü[®¶¢ËXÖñJ(¸0F×Ú†eÈò†nØSÌW‡ª;º1QcøM9~Hìc%÷ËáèRßO!ü¯ÂÀ2¾û¾¾Û f0ŠÆß-„ãRöwàŸ4â´í i +¾à‰à“N»¾(·è§ñå®màP³»g‰`ûFh)SãÏé)… ïÁNBÒ%&Õœo”uÑowÐpù¥ÙWm_WQ±£mÐ}b«®õv‘¬î±lI³l‹'3#?ÎG> endobj -1884 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 136.668 512.306 145.691] -/Subtype /Link -/A << /S /GoTo /D (subsection.17.2.2) >> +4932 0 obj << +/D [4930 0 R /XYZ 85.039 781.388 null] >> endobj -1885 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 123.119 512.306 132.142] -/Subtype /Link -/A << /S /GoTo /D (section.17.3) >> +1162 0 obj << +/D [4930 0 R /XYZ 85.039 551.001 null] +>> endobj +4933 0 obj << +/D [4930 0 R /XYZ 85.039 529.14 null] +>> endobj +1166 0 obj << +/D [4930 0 R /XYZ 85.039 286.527 null] >> endobj -1840 0 obj << -/D [1838 0 R /XYZ 85.039 786.531 null] +4934 0 obj << +/D [4930 0 R /XYZ 85.039 262.545 null] >> endobj -1837 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R >> +4929 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R /F20 2865 0 R /F56 2890 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1888 0 obj << -/Length 2242 +4937 0 obj << +/Length 3292 /Filter /FlateDecode >> stream -xÚí\[sÚH~çWð¶âY}•úi*ïd<[Ne³™ª™yAÆ”y‘ØÄÿ~Ïé2È6,ÀI¹ÊÈÝ’Pß¹÷‘I;‚ÒND1ÕŽ -FÚƒi+j`æC‹Ø3¢6#)pêç~ëìIÛ$ -U¤Úýk}Jøgð>Ÿuh”™ù(:÷ký³_¹I—‡\2¼Ë[þµ‡ðE¿µ¢©¤ýŽ£(Õž¶¸`¡àÌþ=iõZÿöw1s¼m®ªyÖ.çét<Á"ƒeÂÍʳ¢Ó…ûpW -?D­<5·Á)¯xyÝÜ*sA­C|Àzk¬ˆž»å™LÄZº¥]mÀ²OôÒ)ªßUjø¥D²€´Ñbž–cdof¦®ó¹åJ3ãÁ¯élMÆ3¼˜IØ3«XsXE¬6¥ |;°I€ˆóDûüŒFÑ7æïÚŠÌAkpE Q]ÄAÔeçè@2]…YlŠ2µ(Ñ‚8ÌQ¸¿FF•ÅüÌ|\ZÑý½Ðöú1éFKÞ¥‚ -Ú¢I¡fîËñ7‡ÖF„X#€‹X€sgø!5ø‰¦Ã]ƒFÄ\c‘ǼÊÀÊÚœ‡1ýƒâó¬0øÐçÄ;j÷R/N@ ¸ƒóq‘^MÐk¸£ä¦:VµrF{p¼¸ƒ_-÷92XB,•È·£`[»hj]t){?Û¸y]æí9^…#£š4pæΓ_à ¸ó©K"~`G,›ñ´ê‡·ðµO/+Ad»*âGïdC¶€>çÁ›ƒ/„ƒšßv´e_Æš\ªÓ s’&QfO  ®2:ûãS5ž¹Î4ÌÅX[…tr«È[EtkKË\2tƒàÌ]ɪ¨¾uW&(™+pUq•øýáÏô,J0I‚/ -¢3âÀÉ&ÄqÊh~p@_ -šÐÕÁ ãú«ÁMQj3‘ SÇ™¿Nb·k$ÈîⳉWáVzV}0øñü.Œz×{­Ï™Z#Xo!+Ùa/›ÿO‹– mË|/aâƒÂh3!¯á˜_ -áÖ6?白çXSH¼LµYi œ>ˆŒú„AF¡ÃÊ æÔŠÔ¨5 ©sÆ=ô®C‹––+QóÒ5Iø)eH;P@›¤ÀyêiŽújÔyáVÐÚì[†•r‚Iê©PàÒÓ™5 -½‹s°Jž^1úXˆH¶#‚ÚÍc¨‡i©Sü{cîjc,‰›¯ÆÙó ³”½Ÿg€ÎFg—è6féÈ…ÇHÝMæÁŒÑÕòµ$Ñ -vRn98Ï®S¬âLÊÇ*h×WZŸ^WF­î5ÀG¢âcµh;SÃɹßB»ìYØ1ÐwÈÇÕš’M…8åt¬yFè¶Êò`ŸíW'ÿ›îñàyïæë[šÙÐ\5žyõz¾pøÓþ=uSrM7“k›‘áBªÙGùf]]™/|ßnúecì0–UÇwfîçt€²|;‚°÷Á¸J'»j jT>Ùú$˜zƒõJ½Ç˜¯¯õqg¥¸ðûˆËŽ -ÐÚÀÛ2Ú Äƒ2z}㘻pÐ#™Ú°»¼É<´L×|ÝjuüW$¢± J!àq0×™J²ÛD·w…$ËÅ( \pæ _Ì:T%ÜìßïÑĘV!å<Ñr »1áqU߀Âc*^§QÍànq’Wz³¨úí8±¬Ø²lh¿t ¯0æJW–ÿQ<¶Ys—ÅW´où|¨·ßÿ®àôȼòqnؼT®¶4¾°QµlÕþ”•žÈ}¤¿ ~ï]Â]UÚªêÝA~’™sCzÍÖ›O»Ìš/ët¼q³ñÅŠ½´{h ¼È€ ñ[lCŸn¾s/NèIÞäd¹„Ú!— ‘É%>u Þ]šÄÁÚ%Ý€½LÌÜuÞa¦Œ'â»èËRÌ4&÷ö½[¦u¾©~‡Ç àuæï80ÜÞ²I”†.Y1ܺéÂÔ{ ¦Ex¥É–¼ð¨FÐ×7Bš0ç<5•·V©¯¼é¸ÌPŒ•>–éfF˜'ä U9$oˆêy ^k„mK’Uì5¹Ÿ pìf®Ñ•fR/W=ôéOYY%4ÛiÖðô+]à¥âúºìÌÓK+LoŒ~ Óø9¨¿„ëU&¨å»°+^½ßÕ‘»¬‡oÆ°%ØfF•×êtSv {زþÖ%žôY<ÑëÎ/oÀÞ{Kµ†¡`ôh›šÖ¿K’– ß|M•Ób›ZwL`ƒRù8°‰ÇÞ|!ã&ñu]0ÿÊæ¶wÕBòÂCýˆH_ØwuG+/>?'§g²œ®¼z>.J]7¸Zøé"€q¶†k²úª•[÷¾.`^z%Ÿ êßúµYþw §I†ƒxÃq1Lº×â¯kY–'¬"V»8?RÖ× o«T‰T6xÒ’4ƽζ(¾‰×3N€1—ÜfßÊáêW -r—Hî’‹ÒçrÑŠ¸Hz²B°IbLrÆ,bÁp6óL»Ä{çup°—Ž¿'m~YSò œÅ²þß-5}‡ÿÄ“0JÔffcm-"Pñp)ÿ“Yý|endstream -endobj -1887 0 obj << +xÚ¥ZëÛ6ÿ¾…±(PˆµI½ +hš´×-zi®»Eïæƒlkm]dq+É»ñó¢~lh‚„ÔpH ‡3?ÎŒÎøÎÒÈt6KÒÐ×i:[í®‚ÙFþq +ÇBX#žïï¯n~ŒÍ, ü,Èf÷Ã:‘o"=»_ðÞüôúýý¿ÍZk/Lýù"IRïÍ/¯ïæ¡wwûæõ/8d¼÷ðøÛí»ûù"ônßýƒù‘ç÷÷ïűyª½ûùÇûŸ¯~¸ïÅê_"d(Ó_W>³5ÈÿóUàë,=C?ðCÞ]P~d´<6eÝMû70S©ëx¶ñsøð‡GnX%~e£¾º8}ew»¢îæ‹HE޷ܼçwòÃÛ¦|êûö¹®l¾æ§×M‘Ó²ÁdÅǼÛN–»)ºÕM›ï–ùÍškÏÌZ6ö¹-òeULæŠsÌ›}ÑŠÈöÓKü±ƒœ"²­«Ãÿ±þsSv"GU¶Så|WwùzWÖ¯ø±±¶Ãn~ Çg¹P ÙÌ:ðƒ4¡U}˜/T”y+´T»ÓlÚû°”JŒw˜«é ^^ÁxKœL¨á™¸‹5/ÓÉkÇMË<ÒmóNx·BZ—2z«Î6®ó‘då% +r8šÉÇŠ¤Ç¼Eò ƒvB¶'{«±ø ÊkÙKmÍŽ ‹Ð>ö{]~fêŸAh€^É@{ ½tnË;ÿ‚ûFqâG:{wF<äs +FC?CÛ@ŸS¾Õ,Š"?Å7Œ}xµȉ¢FÃvñ¿…ã¾i÷ î.Ž½w'¬-ì|xìùQã5±ƒ÷]±êÜèåÂÖ"å'J¿¼µ‡¶NáD¶¦#? A<~µ‹©ÈxeËmÎ iÿ­’õ¿*Áy¤ ëíJ;[©ÄìóªµlØSÍóèþQ¦£uɾ £xl¯â‘ ßÛîæZÏ€¡ ·à5’Hlí-ò ÷[¾hJ—9ö‹æ 9Ù§ñÎh`Ž_b÷ ô?¨=¼è‹&6‘}ÁGL—½Ñ1 1Pïˆ1Æ@¤7¼#…ÑÝšár°h,# ™¯“øEωŒݨXùqNd$#à]¸ëO䤩v20B¦ÞJ@IöÁñˆÇdÜð `+o:…æEÁRÆã ‚jˆÖßF–ÜÉY+ÚwcwÌ2 ,ÞÝþ›{2 ¯‡ŒÝ¤8ý !÷x¾l:ñUj¾`Ó æ!LäztöíZ|DÏ—|©ñ.Ó©í‰p+Yø²pÂs"ÜÔ.~„§cáz»Ð D^ù':)‡L@ê ýsñÒÛ-ňÂuÍ O=–K +ö®y˜€4 ¼wà#„‚xb8ý“£ÓœÍÏpÉÁ…¹ 6ŸvL}Ë78[)áuLFŒíä†^Äò~²ý{‹§~»(Dæ:ˆȜæç5wÚ®$˜L#ïz×Çô¼ô5³0Ç#KM]œs8–†Ÿ÷½ŽÐu6"ú¶8«S8¯a €ã¾eÍcó ÏKƹ6 †Át•§Õç[Á²‘Ãëœ;o TÉ€'ëBœ­7ëܲ1Œkç¨ï&Äþ¯Î :¥I3™°²¤ãGiIÔ_:ÐÅ+8‰½ë·¿Þ1a)Çzý|Í$ÛpË!:r¿±µXP˜@æ­â#}®/úÌË™'ØBó‰1dŒfÈrÍä>pɼ½`••>E|ÅŸñ¶ªlS4¡p›RÉ¡hÄtŠÓ(•F¼ÁTGpç€ Uœ\Ja +§‘Û‹âω8Ó ;‹ý(H&â àƒÖ+Š•GN[9Z§ÄI¢(ÌÎ(\Z1L ;ù»F¼âõNB4ày «À8àÛ»Ó&µ ?9„³c¼×+z_Ñ2,’ E±Ÿ©) +ír„L¤)ItJÁyïÛ>ßÆœØrÛg%‚+JIæ=dR‰‰'I^’„År³¶L£Ûø§ gÂлwÊ‘šâ¯ýPØ9P:Yg±&ÓqÑmlÄ| ›T3èè⨿¿ûZÅZö}PIɬºu¡0;à•¬²H*Ìà*P8U¨)Π͆ëkLÝuâÝ>0Óø ™Â‘.EâLà‹¥8[m₇h»Ïää°ÝætÁ P¸\³õˆeÚ}òÀ~®r0 Ë\V´m÷ÊqcþR0ƒ[Mà'(€V¶}ˆ=…ùQÍ4ì03É—KŸ° _«ó¥OP”èÑpý^Z‡f°÷ût…“ +,ñc¸{b$j\­1ÆÏb= ¸‰étÞYNcB>»ÉV…c!•Q4ûkúÉ2Í<£>m`Ønnwáì­IgcaeÝÅha†·t o©ñàJô%²º—ã6)ŸÕ^ñ0±°r¦úÍ|‘Ö`FjRÍ…ÅGâHø£Ö“4ÇÞaÿžûS'À·åxA5lžÆ€X»Xw4&%›ÇÖ9 =ä{g˘ϔ8vWL¤©[a¿Ã»‰“ˆê8„Iòíã\á¦øLw¼jÇ5*.%Š‚”ÿ®¥W`Ñ`,œÛêyå뜅y çüŒ®Œ-~bÀ–òõ›ZÊhÛOÒ;•ÞÁ¹V..‹íèx˜@7UËý¼jÜð¥ë“—ªFé)§ªÁšO€™$ܤ· +â¨Ø{kwyYŸ–Ë!.êðm¶ª\ÁÈ„ o4L9ªjÖt^¡˜´•ÝØzJâã†ÎE …1Ò*´­\ÞPbÂþêŒúÕÉ-­(n|.¥­­0ôQœã#Ènøuˆ®Ä€ ôôZ*óŸ1äÜp†BÓ?mHSûÇs¶Z?• ÝL\*Ç<_ÁÍõ¼-¸Boz_¦‡ÿç¾uL¸|ÎSŒ$à£óÆ4ú^‚Ì /ŠUŠ™ÓJe·µ\ë9ó¥cØ +Ê¡¬7˜9ÈâC®Õ1µ…Œç00ôwV¦ãsâåR1UÙ± ‚®A¥†K 5ó­ðÀû›ûü±£ Ñ(~#…êÀ‚Ž (¹‹ÕZ¾ÁYSï?s@?»ÿšÂ©ÔiÍ.Y¥žIºÉ¥@ƒÒ1.¹–¨ ú»üñÔƒ(,HÒã`(%‰÷=E±Ðù}âôI"ÉpˆÔgÚ©÷aS±xÕG&L*ñ8ƒ "‘…^Zaxƒ‘ŒþÓ%ò§úm÷Ç£<öä¯=ªIí[ž·¹« Æ}”{¹3'ùªD*Ž¬íWÂ,—ˆœ¡ˆ±oÑ O-»“hÆ$!äÙl6ü(âÍló²¿Äú‰J0Zðcý…c¦ü8üB}Qx†š”³ÑÍQµè€E¥3Y[P9hxÑ™Š³ s”³e~L„!» \ý„ûtEÖ_£m‰8R_‚ƒñq™å0 ™Ým0‹œx÷tÉóW gÜ “G_Ù¸%¬ŒËg&œU3e…RšÔù6~&Ó/E“r%Üì¯]ÇzÂËUÐE ®ç›Í$[‡ï£¦ í(Š—ºÃ3U‡¹€Ÿ/ûÍ],Ä‘…ш6ð\64ááá.ê¤(É5º‰Í}W36¬w½jðähÇmûAl^’Ô±K:-[F‘ÆéXR€ŒéÒEV @üíC_‘£Ò$j•Œ±eÖA¹Ì×̸¾`†Š +ÍÂOµÏâ©´¹q%)Œø—c||ùÄû/ {”6ÇŸö|Ú7î—Cà‡g€äœ§]?“mv²ÊèsÓµðU­øO!æŠ87%jyúÈzÛþ#rCð0Ç{èü7j@úsîáïÿoý°¦ÿÎm´ŸŽ¾àOl!RÊW¡“…¾ßÇé±¼î8'ÿ B³+endstream +endobj +4936 0 obj << /Type /Page -/Contents 1888 0 R -/Resources 1886 0 R +/Contents 4937 0 R +/Resources 4935 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1836 0 R -/Annots [ 1890 0 R 1891 0 R 1892 0 R 1893 0 R 1894 0 R 1895 0 R 1896 0 R 1897 0 R 1898 0 R 1899 0 R 1900 0 R 1901 0 R 1902 0 R 1903 0 R 1904 0 R 1905 0 R 1906 0 R 1907 0 R 1908 0 R 1909 0 R 1910 0 R 1911 0 R 1912 0 R 1913 0 R 1914 0 R 1915 0 R 1916 0 R 1917 0 R 1918 0 R 1919 0 R 1920 0 R 1921 0 R 1922 0 R 1923 0 R 1924 0 R 1925 0 R 1926 0 R 1927 0 R 1928 0 R 1929 0 R 1930 0 R 1931 0 R 1932 0 R 1933 0 R 1934 0 R 1935 0 R 1936 0 R ] +/Parent 4909 0 R >> endobj -1890 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 754.651 512.306 764.219] -/Subtype /Link -/A << /S /GoTo /D (chapter.18) >> +4938 0 obj << +/D [4936 0 R /XYZ 85.039 781.388 null] >> endobj -1891 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] -/Subtype /Link -/A << /S /GoTo /D (section.18.1) >> +1170 0 obj << +/D [4936 0 R /XYZ 85.039 567.539 null] >> endobj -1892 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 727.553 512.306 736.575] -/Subtype /Link -/A << /S /GoTo /D (subsection.18.1.1) >> +4939 0 obj << +/D [4936 0 R /XYZ 85.039 545.678 null] >> endobj -1893 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.18.1.1.1) >> +4935 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R /F74 4586 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1894 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 700.454 512.306 709.477] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.18.1.1.2) >> +4942 0 obj << +/Length 2940 +/Filter /FlateDecode +>> +stream +xÚ­YëoÛÈÿî¿Bp „ºF4¹Ëg?Õõ]îä5Vp)|AAK´ED"’ŠcàþøÎof—¤vŠK¡ÚÇìì¼gvè<úù£$t=ŽâÄwu’ŒæëotO;?Ÿøbb@&˜ÎNÎ^EÁÈ÷ÜÔKG³»Oè¡Í7ÎÅ/çÓÙOïÆ­µã'îxljsñæüzì;×—ço°8Sš¾»¼š'¾syõ³Àæýtú{ãD;³ñÇÙë“ŸfYÝ…DB +š>ŸÜ|ôF ¢ÿõ‰çê4=ÐØs}Ú^ŸQnh3_\Ÿü«C%{ÁHNA¨7Lô¡ üp _§ŽâÐsC/`!dÄNè9«<[%1s¹ïœþƒÆ§2žUâ,³šV²9„Ðæõï^èËɬ\Ð Hm“c`\M›/l™×¹¬2";^­hRUì<àÆ`ð=XlEk¡çsh ~"ÂËK@Ò˜øVÊÌå_™Þ|Ó¸¦O”RN[á_;íRÁøž—² ×f+ßloÇàeþ¢ØÓš„5©¼z< LOç¿¤Í p–…ÈÐÜ¿ÌeTæ–áž.ål7ô;‹Œø>äéwÏV–N0OÆÎt¢:Ž°ÆD`žÕ9™v˜*窪×$ñG~IÕV&iBFPI“6[ƒµ’ÿª´GËlmnÉtÃW±õÂë¬-¾]¢£UWC–Bæˆ §&Ø(€‚IDA  ‘¢”f°0‹ÌaÞ¶b·àQGÎÅ2ŸƒƒOƒ¹ŒYrùà죘* z-Ë<Y¯ QbÁZ6÷±èŸÙÍ>Ym[S•½œ00`hͤÚ¸ yfØî7c•:²šag¶iÍÒAv$ ÍÒú”ï°çòÎÂãî`aþ3ù+Ù'&uÅLW­ÕAObê´dÂ:&_!Øe^>ÃäþY1Ÿˆ qÉú\-dš­Cÿ-›¹9º6ˆ;Iê¹Åë[îWÕ­ñOlmê¢3ã¼rQoš¼/ÀÆÖb:¯»G»†s"þwwÓxͪÒ@to–î ÆZVoU÷ðl›wð;p…5%ÞJÀ¢m@Ë÷[Žuå½l-‰#çf3ÖžSeû×O1¡c×óâç™èaŽ¤8Ë„Ÿºç3—^khÖ©Æ™üýÆÚZT0¥‡FBÒ>ö6`¸û” ?µ„5ƒHB%ím/Ñ„¯5gÄe“î’’Óß õ‚Ì;Â7î ß‹‡6{ hÒD <²EoWœú68(òÍU‘[çPVKf¢ËkÈ߃` ¦ØÙvÁRç5S‘µbì@.ùÒ%r›EÎ{ÀqËBsEK9Áš(`ÞÀòPHÐ*å DvÈèM§„Ï“EM‚4qúäKlŒ5” …‹$˜êXT€å÷œ°¾ÊÄÒÓV0ä MŽãäŒi'Ù4în2šñê^háÉÜ9[Šïãd^ÕƳ%íW\O…‘ØRH¢Ì8¡-e•­#4l`Ð vcÎצæŠ%ÀÀŠAp¤L«Ák*,š·Û.4ðx?r®3¶£ÛLPÞUÀ·ëµ9‰É±y†K”"f7áž¹h "©5òÕŠî +È×^m û+ ímÐKã²—¶@³hè_r•Œo6UÙN`$Xìó%ðàŽVÔ³º{)µçÅs–˾͖ L?ˆË5írRä‡OþÕÒ&jÁ8…b` ¯‘)ѶJŒC‹´S``áÇbaA²sWe±î©âX +­vïþÿÍSùøœø¶1±¾ü¤l·àRäE+³®sE +æW‚dƒÐ*Ž†L^3ÃÃpÎ-EØB]M¡%BØÇß¡Fe£í0ºŠEÜʼ[ÖX Æ;Á‰#“’"ÍìÛÔƒqï݆c+p[[NŽp·#ć¢Yʨ=ÇÒÙ+=L˜¤í¹^›°*éy2ùÛd·†±«b54Þ?&“ß´úD b2È¿Ð?ø£TÃÀxAy+¯ÍÄàÿ”Òë¢z0«È«øÿšD§G¬—\^Þ˜Ò½çýÉ;Òð,MžÂ®Õù›é/ç$÷X}/ç«Í2ûÏù‡éÓ—ýz9½f`ï;ïzxž÷ô=ÓéÅÿE/Óê!¯§§û…š-°t”¸~|»±¡ÃÔ ©œ<ÖØiàzqò$>å x¼‡gb©šø1íGQW’é+ÜØR¢= ¨Â•&лü3|ŒŸ 5'Θ’ºyâéÀ©Œ«Çv¥!Uº‘Ç…õè3±š’h4à ÇÌcÏ;/œ]®õèÇŠ˜íð#x'ÄRì&Ãb7ŒÜ4ˆG¬ã®Ø èÁÆé¡^ô ^…ÎñÏo£…Ë_™#’Å øþrìØ#B' ³qÙ7¿ÈdqY5x6†…¦2¤HŒI²Ð­…ÊEÑönmÛ;uÆ üšD¤±ÛüïŠ1¢Q©vý8<ú °0“yØ8ôcM¦åw˜L&>¸1Nܘ,ïÙ Ìá;jMW© g¶îñé‘ÍÉÖ¼³!_ÛÞ„â+HIÒ%íHK*kåhk¥x¤…k®¡¸¸£e\Rur¦…5Õ2Ȥ/Çê×Lñž.q!Fkž}ÊÚú; ?ì:Ðt§óÃýIR<Ñžú†F{ g4j€¾©Ñçnì4ºã1.´ ¼pyY#.dÄÎçƒvAi +¬ÝýÖ6ü Öof±£_,ˆs5‘­nu\v¨rãw…éa˜×Z=à7Ò´(äóá G"~Ñõý¨!h]”r~G^‘ï*Ž™8Ø5P¨\_!,BƒÀߢMSxC-^€ra#§â¡s!Àû>„5cìt i¹ŠESg6Mßx&€þx· `v/³½X<Õ»åê¯Hx@jèTé7"D9Û½,Êœ_ŸÀrcÄ û Φe7Ñš Ñ]õZÛ«3ó œ™ðÚ>é!ùTÂò%¹‰Í*ôÚv¨òA€¶è ¤Š<3Fƒò Úç4ÿùÈخڃÞVûnH61HëßQ% ñS +݇”?_º K²öè©O.d©J!z¥”¢%˜¿-­ù@tÊTñ~*‘vøPÄÜv5LÏ…Ý€ÅÆ  Ûãj¦è¦îfؾâg0Z2Tr“ùŒC YÓHhžÛÖiÖQ5[±£E º&E÷Ö{ùäkåž‹u¨„S¦ûm7l¡ Å?éñL}¢í³S~¢©`þ„TÕŸš63EÜ€ÖÞÊ(7±mÏNCô¥Nb‚Í•±bí6íQEË|ß¹bÓû¥ôA)æ,+I_Ô³¡ Lì CQÐóïÚ"6…wÐ#û*oAƒ¥Æ´]A½¼§+þ(—7Gîõ=Ÿ,:6èÌg:Å…ZÝÉÚtA4zԲ߷Xly€jÍ”w€Dyçò³‰,ynŽ÷&L(–»öKÛ+cRSê¯sñ7‰ôn¼‘XeZ ëJ¾Ñ þâžÑi?1…MâmsL®^ä*ßJbŠ'.¿‚úÏ—4xÙf_û~Åž8ÓÈõ«iƒ-òšãlêüŸ€Åƒ“˜òwxViˆD*,¸/Ëß0h 9NZÿ4¡ò‰E¢<å*+ Ãn–°`š#ˬ|ÈZi#Ø@=ü‚±‹B ¿š#‹i Æ­»OVÝ]2¶ µµ‘ã=~z¬¨ôX1åŒî¿ëcy÷ Ðn¢Óãa9T$ZßÒÂ_:¢tŸ^ûQý€àÿ^ˆ×%endstream +endobj +4941 0 obj << +/Type /Page +/Contents 4942 0 R +/Resources 4940 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4945 0 R >> endobj -1895 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 673.356 512.306 682.379] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.18.1.1.3) >> +4943 0 obj << +/D [4941 0 R /XYZ 85.039 781.388 null] >> endobj -1896 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 659.807 512.306 668.829] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.18.1.1.4) >> +1174 0 obj << +/D [4941 0 R /XYZ 85.039 651.823 null] >> endobj -1897 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 646.257 512.306 655.28] -/Subtype /Link -/A << /S /GoTo /D (subsection.18.1.2) >> +4944 0 obj << +/D [4941 0 R /XYZ 85.039 629.962 null] >> endobj -1898 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 632.708 512.306 641.731] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.18.1.2.1) >> +4940 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R /F73 3992 0 R >> +/XObject << /Im3 4327 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1899 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 619.159 512.306 628.182] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.18.1.2.2) >> +4948 0 obj << +/Length 4128 +/Filter /FlateDecode +>> +stream +xÚ¥ZmoÜ6þî_á +TjUõÚûP¸Iš¦È%¹ÆAzHóA^im5»+WÒ:ñýú›gfHI»²SàÄK‘Cr8|8odxпð4OüÀ§Yú&ÏOWÛ“àôšZžŸ„Jq®$皟.O¾ÿ9OÃÀ/‚âôr=Ž“øqbN/«Þ“_.Þ\>ûíìÜã…¹vže¹÷äåÅÛ³Ð{ûâÉÅK4ÅÞúüíū˳óÐ{ñê¹ÐƒæÝ›7¯Ñv–ïòìãå¯'Ï.[nBb¡O|øœVÄÿ¯'oŠüô3•?¤æí 1å'±ÑïÍÉÛ“»¡¤->•^K"°çaáQò¸˜ÒÐSãÄQkì›8…˜Â0òMfIà'AÌr"Ñd$œ$.¼»~(7´æMCvÈ5É#M½§(w¨½«¹ØK}³Z”2ïÃ홡z4rçá›É,Ný"Ì_ÅHë“Éf»UD©&¯â?Ø¥vvÇ™wSžE¹w‡?5j +¯ß¯V`­îñ·_ï±ÈÍ=soÕÕåÀ˪¤ÿpSKˇێ›F‚¸²¿)Q«#S#÷ù‘ð•ÞÅ®* ¨ÜžE™w…’ß ØKYǽsš^;5C¡‘,ÎClyÁk[µ»?‚0¾Ó]94íŽ +4_’%Þs?Í¿¹Wa³Øû Âz ½É2ïüC8&K½²«¥£´S +æf*ðt/EÞa¢ÊOJ…¯–X2¾0qIò"¶éL¦“m2Qä‡ášQ)z!s ÚÔ½t›ínBRíµ«ëŠ%‚9ý0¹$ÜÆ|…†ä €­0ön!#ÙåZ¶Mˆ°M„ÚZ°Ñ ñ¸“¡÷ª2òümˆ‘]ÔiÖe'C4vÈ^~y²¡aDIM©“ñÀÛÛ|Ü+ñdJsd޻ݳtvlGH$\æ±eh2Û12v¼&¥µ¶è}}#Ÿ,úýs/‹•m¥ŠU{k™Ù°bˆ‹Š‘~çp€ÅšÄíÓ´ã±êÀ|b°õ:m•!ô³\10—à)ª\7º¯Áa*°½]€…!0™H©Á{«L\ÊÕdMå  1¡ŸÎ$Æ›–8ø¹bñRaàå¯p^?Qéê;êRˆ„åXZñ¡BS˜4ð6vSË~À©ˆBï=ƨ…ô³Õ‹ ªØ±,?ËGÕØmZíû^¤«TŽ7ƒn £„O“=DϤ%ø¿W€cíÛìD¿/`iC¼’šT¶b'?ðyÓ:*~óñ‡C­oµu‡~ž.8Ks>!½?5òa”ûi–º‘À5á3;šÑÄ„•Ç'’ãùfvÆ~’'³ùö=Ë’Ìb”æNf(¿…¶Ï½«Ÿ™Çæ¦ÝnŒÏ ›¥fíÜlÕ Œ÷dz<Â,÷“"TÀw·Ð2芬³¨7CúlIƒ~–íù¹!&™#žûî,‚Ú½Öõ{Q£–í’ìöœQ¾Iã\þ’àÆ‚¾«XXŽlbWPV•  +ôw`LÁï©“ȵϮZ6 +ý(ŒF½ñw†söËz(ð]£k»d—;§÷îՋߥôgªí>'ˆÏ^»ûçƒH'‡+K‹¯ }$zéJô5¤?6¡Eúá|‹HŸÌ×±9Ú1hwÒÿ€6Åçï^È70° Ù³„öÝîáÒ¬~”ôq–DÙ „€Ó Í¢Ó^%ù!涃ühbSH.0ZUÙ&Ó½ÇFý— .f*ŒÉ XÌqTàá ~χ¿ÝmG–úyžÍÇ«Ëï£OßÿþFDvôEC”/#†©ž¶ÔOŒ¨xXtNSoS²<*··¬DȤτMÎ9«ä–½Î+¸¸hlµQc§ ØËzÔøvÌõAÿvg‡T2Uü]¹[) güZW L‘?¹ÙêòDþSyõ¾Î‘æá`‹<ßDéˆÆ8*$Òk˜yò+¸Š­œºœª:b81kùT¼D7Œ´vèãø)’ø©uƒ«Úû2ªDŽA<×>Kj&6´•–nÝ‚ï +§\”bh•½•´8‹vJÕEàçÉ,6ü·X#ùïÏ¨ß—Û {úÖÁŽ)Fø܈CÆDì»ÎbWª$W‘)q„¤tÛ‰ÄXˆ“±*vÆÔA—ªRÞæzgmu% ƒŽ:8#¾%ئyäýt¯£Õë’ãäá;*¶íØmtnϹ‹R°"){)ëÆ¢ádC _¥õØCAL9ú¶j©Ykt(gñI˜“'¼­u.%ì]ªŸŠ»O?¯Þ½|) "ã5bÁÚŽÁKÚ÷ÃÂz'Ñ&ivà“7mw]Wô©gïKyi½j¢ÞHÔ²*7 &-¤P…þÚ4C|9›fhÀ÷ ´hÙ ‘ùv±3Éï5uf ¼ÀBA 6ŠGÀöxZ`ª˜ø¹™¹›zs+*w? ¸jÜ;ªÊþ“ضÝÿ‹FBê<â#Q!*ÁPßdÔ¨ A:*ädòQÊ8·›¦’σ#*‰¶¥ìÆžë%©cöéW¢ìqŠ~èʆBmð¶n;‰¼Ø Á®ïÄžÛ¹dž¤2Id•cT§š‰NEùí̈¡fbÄôˆZ†õ ˜¾E3¹áß0s‘OJýÐÌYÝЋ †s¶y·åŸ@*TØ蜤ÂÎ4&mwª'…33aÁ…?7y¢ÇuS¯DA/*!û¹%µóJœëáû ëKImº0,ˆ&ç,G «›‘kÊS€ÀmlîmDŠA~Ô¨'/ϼƒ$‡;+Ý2*êª_|‚ÇŽ½"=—¢&HT$è™ÈÖ­jûR~þÚ×ûZŒÁç—¨º‘ƶ¶fj/飲ŒâÜ—ûÊÛÌ|»4%و㱀£Ô'™º,î˜êd¢R$@AÏrœ°¥Ö(f¿ˆeñ€úýFsÔ¦PÑKîÔ`ø®íTBa8Ȧšt;qÍÊëÚzþI0ˆ 7ÆŸ+ÉÃl¤iÌ[ØœŽ²POë»fÅnib½ õ×Ùå0ØT Ê¹ èTñ¾Ün4yá±Î£¨®t¼äßÄ‘$ Ý©S01ÔªAÀ#îi<"u¢Ò1LÓKOÍù?‡å Õc[_=pX(áíäþ¡ÝpXIM·ôåS%»ºivÒAuшã›M¤ÿ´zgwðÁ®B)k”%;NsJ³ÍÒa²€—2ê¬Õ\òÐŽåõbË&+áô}ÉfÃ˹4²±ÆSâ·À}a;›IòyA-¦\ +Ô‡(øëx’0óÃÌ:ÿ MHûŽ= ù);XéÜ(²Ç{%ê‰ r]ÆåU»4}>‰§ø4³èkY¦;n«6ªáCQnZxß`õõnÉwnÓãôaw_,Œ‰ü8Ÿç"X&Ýu}¨Åª­æ€É‹JÈ5¶Ž£1—/‡W ~ÌÁŠoΙŠ}€³Àû79âtÅMÝÕ8HñxœMl\ê^’±úqäTëõ,ð XŠ*[ +‹à~·“,ŠY^täè¸8MÓAö=VCLvÕ¸X5o!ÌtßL<»Qp‘R˪Uµµ +’îÁkƒ(‹ý8 O¦NˆN¦Z¢¯$SP“©Gó-%S§ó ëC¾AÀ{“‡‹oÔ:¦¦së„åÖ=æÄßùþV(7 ÔŠ$ j¾ÇßpDšxß½¿”OÍ"¿È¬#ðb׈]–íÕLDëÇxac¨¯ˆ¹ã@òLf³¢2â÷RýêR Äÿûö †í§#éÒ;y½c£^T•º\á(¿½ãûØÅdü“ÎDªrÆã —WA'*ñãÞm°¨‚vP‘E/ƒT[Þ÷Àæ³î÷.áºÖ°í¸Ö•¥®øõÈ'zI:PF ×¹†raÌ~‹ËÖ+:@Ã~ñO1¹[Z}‘¾ æ±®ó $œ”‘Ÿ1©Æ>öM‡\*ève ù¶ki1i’vL}£ý[ù]ˆP½˜N7ñ|ÀÓôRßÎ/,Ý]ªy¶{r·cÈ?‡C;LÂÑ1%h³+G{z©q;ð%O5=?Êa~­MžæL3ÿlr0„2°àó“õH3Ý÷7å…dÝäiàB¶‰:¸M/¯d"¾û™¤Å0çA6IÐLÈÜ<ærãÊCÆî¢K.ăÞÛ €{¼‘O^ÅEyzðd0Ês¼ºsw&«¾:és +ÉüÈ/CÜ@û?õçÐ'°A¹Ó÷eƒ^7SU)OùZDÙnP (Ë5‡Þb/Ú‚+?P”.F‡ +Çé]ªäPpëj¢R4hÙé,c’‹¹ÔèúŽ0’:û³ɲ Z©²÷ÑšSÀÇ [¥&©TÍZ-gÀi +ØÆnäoi1 +ó…ƒeS€^¿gÅ}êLú½@ÝŒöRk8W‡ÁäòK\:í®™8hÑKˆA ¥ãà™ÐµòâaV<ôfâCÃYyÌ)TãäÇ˪4üÛl”\cñÍ ¢½M-¶\ƒ²ÑVI8YMs˜þƒƒ&˜t¿nfÏ ©š5ÆAvÇLž`†¸ä’ë¯åûh²!ÑâCú/kü¿ÞR»;íØø¹yàµKE~Z^øæ> ù%g’œtsÌðÿ`FEendstream +endobj +4947 0 obj << +/Type /Page +/Contents 4948 0 R +/Resources 4946 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4945 0 R >> endobj -1900 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 605.61 512.306 614.633] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.18.1.2.3) >> +4949 0 obj << +/D [4947 0 R /XYZ 85.039 781.388 null] >> endobj -1901 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 578.511 512.306 587.534] -/Subtype /Link -/A << /S /GoTo /D (subsection.18.1.3) >> +1178 0 obj << +/D [4947 0 R /XYZ 85.039 761.463 null] >> endobj -1902 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 564.962 512.306 573.985] -/Subtype /Link -/A << /S /GoTo /D (subsection.18.1.4) >> +4950 0 obj << +/D [4947 0 R /XYZ 85.039 736.114 null] >> endobj -1903 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 551.413 512.306 560.436] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.18.1.4.1) >> +1182 0 obj << +/D [4947 0 R /XYZ 85.039 553.141 null] >> endobj -1904 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 537.864 512.306 546.887] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.18.1.4.2) >> +4951 0 obj << +/D [4947 0 R /XYZ 85.039 532.55 null] >> endobj -1905 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 524.315 512.306 533.337] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.18.1.4.3) >> +4946 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R /F56 2890 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1906 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 510.765 512.306 519.788] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.18.1.4.4) >> +4954 0 obj << +/Length 4108 +/Filter /FlateDecode +>> +stream +xÚ­Z{ÛÆÿÿ>Å!ma*°h-àøâä‚Ô¹Úç:…k´DIÄQ¤BR¾»~úÎcwIJ”œ¸µ¹;»;;;ßÌR\ð_\&¡¨ô2N„¯’är±½.×Ðóý…0sC2Ð|{{ñìe¤/Eà§Azy»êç }ªËÛå{ïÅÏon¿{=›+¥<‘ø³y'Þ‹Ÿž¿™ ïÍõ‹ç?a—önàõõõ«ÛÙ\xׯ¾gz¤y{só3öÍåÝÎ>ÜþxñÝ­cË-,¤ÈÓ¯ï?—KàÿÇ‹ÀWiryÏ/ {{Lù¡Væ½¼xsñw7÷éK5%K1©ŸÊð¼˜"áëH91Iè~†(&!¤¯„¼ŒÃÀMrÑÄ>ìS‚„Â0ðÞä]WTkC{WMñ)oZ~YÕ3%¼†_ò‡¢í +gIoš¢êí}Ñmø©ÙÁ¯ð@º(q@Ž’®ºSÕ‰/âôü{Ú£ªàö(Sn‚=Þn`Q™Ä^‹kç ü[WÀË’›ïg2ñ²™Œ½Gnè ¯ÆÇÄ£=¶]V–ܵk ¡¨pl—Û–Ôö ÛHnQÕLô~8ò¸1pÑ’d:ÃÁÆŠjË ûÿò¼<˜>ÍÂÈËÊâ`3 ld ¢› ÔÅV$ÿˆÔ¸¾,ëÊ<­šzËOÝ&g yûêúnZ`p”UKn(iG9¨ŽÖÚ#B¾‹–GâfSäR—,$iÍRõ~Æú„ :¡0FØHÇÕå»öχÚâN9³Ó&aiæ¢ }‘¡éÈÍD6á­§´/Ôùå˜ä3«©Ô“p´Ú:ë»±&¥•äÐ jó£Ö O.öê}7¢’^C3ü +´û¢±.¹o‰’¶ÊMÿ +„.ó–W°zˆlei§X°?൸‡ŒÆwõ|BÙÖ90×|sêð¢XùRÄço@túð,.*OÞÙåÌá_ÍÞpµe¾ãã ]-Pq…0¶#äÈ3Ðùr¿“ÒÎMà›±Ê{»¦÷$è5¦Ýd˜YøÔ°¹É !ížõeY ºˆ®pÆ(PÂ`¸“¶ø$å” ùȾ…,-˜wŽ +´Fêg/Ãh 4­ü(a +Úng EÀªDôÆ6uM”ÒìãéIìÈÏhˆ£9£ LƒKê“úqf-«ç–²ÚÑ/5VŽ # üHE_¨:•öˆawŒ’[ƒ º#pêìA¨±SÓ6ï~ÓÙKØ°ž>{ÒVS>«7¬„Å fšcé»Y¢=Ç%b6ä’Wøî2±4KëCîeE™›n·tŬjƒQòls˜­×«‘ÐgšyÛŽ^w3u1-4YXUÙaí¬lýá:k²5rží6ÖÍú'`s˜€ B}6h\jp›ÃXû‘ŒRÉN½ëe^uÅêÑ$³#x¹bó)79ÂK 9æNðKÈBΧ3šÓP? 5P †ú˜®a(cŠ²h7x¬qĈ Û‡ +;8ZÇ8¾ŸÃ!¡ö)4&èÑîyô†°¶ ñ8†üæ=ªŠa¤FU芺 ;Á6€‚×ûÒX¼ 03¯ÙíÌòÛ/®ø÷~S,°}c—"3"äÙ°±cØ„a¨á·!æ0°UN#ôÞtè‹––¡ÞþÕðldø1dlË_ûEµš0xNB÷!Þ‰™««ƒÓyœ\‘“gI­ÌïŒÁ>¶Æ5¤ @3Ÿš7”UŽy[2€‘’–0ñØÑØÐ UÝñ« r¦†-x˜@M49r3(ªÅxHbÄAFGKC²-ÖârbEb¬°žæ]#ï"õÞVSà{E ¯Ûãn3>F”î#ò¦"ÏúTP¸GnéõŽqçØCÇ.#“¸£´yí@0ôd Ý[uyÅ-‡3iëPvÇ €ìÅæ%Ç’K¿žoÖ¡{¯›­]‰ÍÒ¥ØÈSg¹Í::²€'Û“#’V£àa F¼.´mà ¤büà‡y•mÝY!ò¾wù'Ïn¬ž Séφ욺Ñ,ü–j +íɆ¿8¹£mÆŠnb‹ùC×äìÊG[˜Qª’!'Ùqìd½‚ÄØ…pŽØšÆA™ÂüDfòWŸˆ¬÷ÉÐYå¹ÆY YEà +L÷cð¥®q|[‹õ°üH«QE(¾£zZ]AŒÐ2r§N:h|Ècn¤qFcyáߌG½£c]²j¶ÜÐ0gÈ>sb£_—T»òÀÇ#Ìð5»-à³ S W£zÃMrQ‘Àja{8w †ÚàC+uüëRÎÜYu®|ÂAZüÄ£ÝÊ yL†_Õ]nÜ$¡¶¬c—6P“°ÇpùÈá…½•í¬GÃ148—ÈÂZREÌxXvL–ÕW°·yPéRùÊFÐæÝÈãòÍ5žž?¶Év¿3Ñ­é8TêT ÆVtzý˜9É0ðÖµsÐC’ÐFÛ7ßs§ Ùð¸É3ãl¯-ï”ü%‰¸q¼!è$Û)]8 %¥/ÐAr[3;5‡}¾–ñ·Â¦¸”.°«_ À¹Í2›W¼#­â»ƒgòžŸýrcJ¥GGà H!µõŒSþå9ª¬y’ñ±~,¹m¥ÛØú4· –¶”¶ÀS¯)Wü)ÿÀÂóÁA#OhÉIA¡ÓþÚ†UlÓc“|6ÀÐâI¬ÍÂ+ +Þ[Cg€ì”×ÁÙ'-ÃÆQ²¢’AM馩9áÍ›®ÈÛ©´Ra¡èU‘á±Ô¨¦B“©O¯ ]&ú=º{œFÏ®…™¨!í²³B̘´JL¬À•J>ÈúŽ_ÉÀo_ï Y_ZW¼39¦ÐG‡FŒD|Á)e¶5þˆÅ 9r`åËÎ Cƒú讣ŠÆd½ïQ,¼R.µ‚Ë”<⢭*\³ÄÖ­3 {îÉoâÛJ‚pY¾«<Í椄RÌÈF¨ƒÜ8ŽÀHÔ—Œy˜ŒŒNS¾Â*@cá'%ª¡6QRÔ´­`=Eÿõe¹ñ “¡-Á\eg0}pfzû©Ð¿{úu…Ç¿¶Ó—ý¾Ç܇~E¿{ú\²°s+äÓµ£0µÜÓŽªKxÉÖÊGçíÀø_ò·›HüÄÎeÃ)àÉת¥}òðH± YžòB¤¾¤œaÐ{;5ÄÌ*1kykK››•6'¶6tÿC׫[ãðÅØ¿À‡ÄFaNâË$I б¹”‰½½; HC0¥ÌQ4£û¾®³ƒ:Ê/˜Òäº9›ßÐ5ÇpºÊ¯çN"åç˜;ctÀyÍ gÞmú˜0¿¿îT¼³"Æî>¤àEš`Õ·8´ó•%<8dVöy±é¢pÕm̈Âü"BC|ÛçËãÐŽÑD®Œ*å«P|iýÞ…½= +¶(m‘>ÑÏ6¾Þó 12A˜~©ÐsÌJŠµ>yÝýv‰†*´Sö~’ZGAêa§?¿k*ë[Þ×X.ÎÔ*ÏÞ€g–zú +P ¹mñ ‚9aµT½ŒF²P~XY¨)ÏA$°q¾ò’¡q,bïºâ¥\l•!ùÀÞ-¸+^©MØ…mÊîó§ì‰(ðCw/rûöõ·?–Uµˆ})ørŸŽ?ÿU +(¢'¿I™Û¹æƒÉø³›Ñµ8s 0–Y|,; Ê + ‹…”ó›*ʪ^Ù(‘ø*I§¢y÷‘· O(,7/ø—@àª{ÀÈÂ,2W!ŠÍm-ôS©63$ÿfÌØFØèqºZ}ÛÚ#¥`Gýe¶ë(R¹8ð¾E’ÛwäWIUp²ë ³ÉÐéÀæþ´½N†‡%ÕgÆNO -ÉB8»E'¤¥ýŽQe°ÿHm”ˆüTÃ!ZHuú[Ô†ðî”ÚعæƒÉŽëöŠðXêV4jC[¹ß ÁÒXÛ,öªên™Ï?]»AO^"j1Ô7+ ¤"en ¤­ƒ>1QB‚Œ=ÌOœ÷ ƒ}@‰CöZc`§%ô±N`va«Ø}Í?™% l¼¹c_àsÅÇ&ÖHÈÞW*—Ü‚óï+3M5! .1u%wúk¢ìŠO“.YúIðeÉÁà$Ú¡PRþ‘`.5 +‡²/ÿ¢£ M!‚¿c0i4®í‡Pø2¹ÕáªìY‘süÃ7âB †øÌð.ƼÇn×òóÊ×.>ï쩲ov<-ì»ëlápìª>:4ØG"Â#e,¶]j¶fêÁÖ-2e´Ç%ÄH¹#=ŠÍ]†L8yÇß2_Ñwe‚ܶdü3¨1$üšèc’+7‘VmÎcøƒ¶þKðþ=ªÊ–ÃÄPâ½DxR7<½»8À9ÈõšyûÂÞj’‘Ÿ„Ñ—j«Û]âu‘'ÑÉDdt›Iƒ”Vßæ‹)­TË vT3þ…w¬çÆê@¾‹=_î)Ž<U³_(óAÓHq̧öÚP >àˆµ7ìÈ8ÌÁük¾úÂ[£Hƒ–ؼ'6`7V÷§ýX¥3Y{Š‡…sx[¶ðÝOšû:5AßW"c“À/Wârs÷ Ö³h +Òò–ß-]¶ïê­¡²ùtó]Ë+_îmzL)ï8üâDxWÓPÍ*2ÕýaÆ ‘8ø”>~•½ø#1®Ü˜+üyo¯jSµÆÌ5’À(g?ƒÚ!Ò×}£™•@¶f’´Ô}-¾±·½ÇîÑõ/ÙäÃòq»ËùÁÇ ûR¶½á6¾;7&ª-ù{Í +ðZ– +dÁuÝý%‚1/è.¢ã×ùÛ'WYu—ýéþ=1m þ}b2*ÜÀûW?äÅ2/?æÍš®Šu±ÍÚΤBü„˜ðæ b°¯¸A™¹ Kÿ›a+~+ žw|o¼]2á_øçÿÉ‚=ûAÊß½À¶FȉX[Æ߇$ú0¡±æ£k³ð€«kú\”Ö ³¸Ô!Dx¨ÿ},è¶ ÉÞË©ù‡S¾”n‰¿dÏN|¢ N~ï\Nþ§Ïëݧ$Zù‰:HC) ‘2/ôíK,ù U⇉:fø¿j·#endstream +endobj +4953 0 obj << +/Type /Page +/Contents 4954 0 R +/Resources 4952 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4945 0 R >> endobj -1907 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 497.216 512.306 506.239] -/Subtype /Link -/A << /S /GoTo /D (section.18.2) >> +4955 0 obj << +/D [4953 0 R /XYZ 85.039 781.388 null] >> endobj -1908 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 483.667 512.306 492.69] -/Subtype /Link -/A << /S /GoTo /D (section.18.3) >> +1186 0 obj << +/D [4953 0 R /XYZ 85.039 761.463 null] >> endobj -1909 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 470.118 512.306 479.141] -/Subtype /Link -/A << /S /GoTo /D (section.18.4) >> +4956 0 obj << +/D [4953 0 R /XYZ 85.039 741.134 null] >> endobj -1910 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 456.569 512.306 465.591] -/Subtype /Link -/A << /S /GoTo /D (subsection.18.4.1) >> +4957 0 obj << +/D [4953 0 R /XYZ 85.039 711.743 null] >> endobj -1911 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 443.019 512.306 452.042] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.18.4.1.1) >> +4958 0 obj << +/D [4953 0 R /XYZ 85.039 684.645 null] >> endobj -1912 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 429.47 512.306 438.493] -/Subtype /Link -/A << /S /GoTo /D (subsection.18.4.2) >> +4959 0 obj << +/D [4953 0 R /XYZ 85.039 656.94 null] >> endobj -1913 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 415.921 512.306 424.944] -/Subtype /Link -/A << /S /GoTo /D (subsection.18.4.3) >> +4960 0 obj << +/D [4953 0 R /XYZ 85.039 630.448 null] >> endobj -1914 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 391.463 512.306 401.031] -/Subtype /Link -/A << /S /GoTo /D (chapter.19) >> +1190 0 obj << +/D [4953 0 R /XYZ 85.039 586.054 null] >> endobj -1915 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 377.914 512.306 386.936] -/Subtype /Link -/A << /S /GoTo /D (section.19.1) >> +4961 0 obj << +/D [4953 0 R /XYZ 85.039 565.459 null] >> endobj -1916 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 364.364 512.306 373.387] -/Subtype /Link -/A << /S /GoTo /D (section.19.2) >> +4952 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R /F11 2898 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1917 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 350.815 512.306 359.838] -/Subtype /Link -/A << /S /GoTo /D (subsection.19.2.1) >> +4964 0 obj << +/Length 2325 +/Filter /FlateDecode +>> +stream +xÚÅYëo›Xÿž¿ÂŠFZ,Å„ûà5ß²I:ñ4q³»™U[ˆÁ6*pÿ÷{Œc:©íDUÊ}œ{^÷<~`1pàŸ®í¨pàÂVA0˜­ŽœÁv~;†bdHFšONßxz ;tÂÁt¾ããÚÚUƒiüÑ:¿:»^¾Ž”R–ìáÈ÷ëüúìn(¬»ñùÙ5nië¦ïÇ“ép$¬ñä7¦Gš··ïpo(k:ü<ýýèrÚªÕ +BÔéëÑÇÏÎ ý?rlƒ';¶€íÕ(e»Z™yvtwôŸ–ïéŸês«Û Ô¡”ÛñðB Òßul×Ñ䄳r¶LëdVoÊä×áÈ•®õñ>Íãâ©âÚÏçÀûŒ6‚À‘@}B:Q¦IÉ$·Q½lxœÿúI(}?žL¦8¸ÛVu²RÇÕº(2\¼ÿ÷òý*ùGàáˆH®.&ã;Gü'öÅõu¯Ü¨Žæi–ü yq¼ +ÅŒ®×ñž@—ƒ¥ÈçéâJd ?ü…‰WI¶þ9¯®o[Ò·ˆ*òi²Nò8Ék”ZýxÏ~ë*²ØñdÜs¡?SêÛ››4-sã¨~ ±³×'ó×»,“8¦Pêc¿Š±ÙúÄþY&‹½Jõ³Es<Û<Ûq–ýÃRÑÍ“é›ýªÌRoŠ<­‹2Vm'èWnm²²?ª·ë}ÒÓ7¢‹FÚ³•hA+ÛSÿ‚˜b3i7°VÑPúÖ–'yQ§³ä&¡cÕ˨ÆåЪù,ÓŠ'q ³ôq(+A˜TòÑedö¿np¿Nxñã!…Ås<ºYáÿC°~M1g#¤Ó1B90”˜ŒõH¿læXpG8{úä 7Õã?°C@B|ø“ã:créH…Žoϳ_rг@<!áãM®H¯ÎpU¤H…KÊZòÁ€O$]ÿ”*sjå[g1*Nð˜gUuå‹$ÛmÑšÏîNzü €94~(‘:–P™ÒÚz“fCTòÐ ®k»~hN¦[^«£Å"‰Ų̀êQ"¶ôÜ^Ø­^ØUvkåíP»êe^ˆBa¸Ù¶ œÀQ^àYÅã0ùSëJ4.3ÛW]ŵp[2-´ù¿`§æÙ2­ÇÎþ¶eiHªÍzH1ëtÛf}^`\¢[–æhUŒðÜ,Ê2t.Ýý'Úá•YÌ0ÐÅéˆ=clíÆ qÒs¦Äp¥•æM´Õ ¤¹¢˜=ã:Ž5%¦Sc­0çÌʦ2`& ÅÀ¤-oÒYYTżæ)‡2Þ“ìÐ= ƒÓ›KÞ\£ +Q Ä«Êî)Fã9ج=÷8öù."Jôšwë‚wÀÑkJú¢lvÚ(d½ñÖ}½Ç.OÈÕšSÃpÚs†¡0ìpüÒ×W¾`Ë2iRÚH847Šcªoi‘ƒ ¢eô\h€ +LÔà7cåIíï0t[5‘œÕä—N_:ŽsúÇ-Ÿ™eiÂ^¬°„0yaüJžÀ…È°A½òxW‡È’C nÏA¯¿$°%?„~΢œQV<¢òV™ŒÁ…Öƒá3óPÇ,6´¹,x†…JÅaaRØJ4RNš–éÚ¡çïyj)¢ éz98ˆL›ã•$éú§úÖ‡É9¨ç”¡”Bò9¹aÅ»=WŽË—°ðLµ©(±ý÷¡‘è[¦È|1цKˆf{Zc+!×Q³iJÅsO¾tCšIT \{JM áÞ¬ùI¡Å{Õ†aOœRÑç@MgËÇÎ1*æ¼ÐænúÔLÀM!mX+¶áP¿ØgΠ?7YÆLצ¿°’ÊäHDÌflYÅ_Åv%zÅDOM×g¦Š€\ÐîÇ8á4ä8Ês&ÙÿVåt(À¼‹w÷wWïî¦=ܼöñÁÏ} Î[C¶Ö¿ôpPšðð_sqwÊ@K?d"ÓI×ö¥¿^|ËûåçF!$¤¦H–þ•òðz?8b¸Ú–Òû&:å1¹ÿ‚ϨÑj$m @ëÍwI_‚ÆvˆUîZø¶èPj—˜Q +päºo*“ <¦4ò|ÛÑa¨˜¦3&v†ÑÂéx%h:ØS–ùŽ:ŒIYtÓõìPû)[jþ’¼¢*ÔàN)1ƒ¹!ž‘œ“ô¡´â95|ÞSÎ`•‰¹?W|žÛRDX#bCý¢äᢦƒã ˆé¨'§«Ú T†•”â®Ú•«cìªRÙ$û¬nmÝ2Qs%‘áKE +žDKyL@U˜{t¹e…þ°OãëfH|ð³ó/¸_²xujq–æü|é%DLjhs÷Þ€ÍWÊ êŸ§ùbŸÍ[V/o Ïz|ySP‰‹Àù‹ÞÝ£nïF³%Ýä¢ÕXc O×5 –i–ð´f"ölše<å·Ln8' }ÝÀŽ¤GÑ·lrÇx% wú#brö¢ç„NçLZÓ»>ŽR³kðhóж½˜IÚ÷ ßé`BÇ:‹WiŽ õ¤…w¼‘£E5ˆîÑ}µSR«p4G:½8¯iLX·ÈÖ!^ðõÓDLÍóðy«0Ä7û’gô b¼@Óöc” Î(“êÛÈ€ . %9–›gºÈ1÷pqÞ€ò’çèaú€/s £ò’\¹6­”1)d(ŒÄ½î iżŒyÎR ¾ 9Ï{ +Ć÷Ž`EéƒÄAëѾ°](Žÿ-û’Nâ¹ïìcøMúø³˜²5ô—?Á›þ]¿Ðµ¿Aje*ÜuŽ½þ-¥-=+hìjáË—Îl~Éc¢ŽÂÿúeB +endstream +endobj +4963 0 obj << +/Type /Page +/Contents 4964 0 R +/Resources 4962 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4945 0 R >> endobj -1918 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 323.717 512.306 332.74] -/Subtype /Link -/A << /S /GoTo /D (subsection.19.2.2) >> +4965 0 obj << +/D [4963 0 R /XYZ 85.039 781.388 null] >> endobj -1919 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 310.168 512.306 319.19] -/Subtype /Link -/A << /S /GoTo /D (section.19.3) >> +4962 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1920 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 296.618 512.306 305.641] -/Subtype /Link -/A << /S /GoTo /D (subsection.19.3.1) >> +4968 0 obj << +/Length 3219 +/Filter /FlateDecode +>> +stream +xÚ¥ZmsÛ6þî_áëõÆt¦‚€¯íd:Nœ4î%Ž/v.¹I=Z¤mN$Q%©8¾ûó·o )‹rÛi2±A`±v»Ï.¢÷}ø«÷“Pù6Ý­l’ìÏ{þþ Œü´§…b"$“ͳ‹½éË(Ø×¾Jýtÿâºçª ´ûù'ïù«£³‹ï'ÖZO'êplj÷üõÑù¡öÎOž½Æ¡À;ƒÏw'§‡íœþÄôHóþìì-Ž&Ö»8¼¼øyïÅE·­nAØBŠ{úmïÓ¥¿ŸÃþÞó•M“ý;hûJÃðb6¥ÂÀÊ÷|ï|ï_+ öyÖ˜ÅD§*5áãbŠ´ +"Û‰Éø1im”Õf?}úÉ D+8§Qd©÷¼šÏ¡£˜µåòäÅ^{[pã¸.¿5·_–DÖð×u]-°yw|(—yuhµw‡¢mx춫æµÒõiuh}¯.—í·—<óü6Ãy5Ò»$Ä*ŽãÇeÑÓ,t8& “rÈâ´:4 î×ú1ü‚vÁí%”¶“cGäµÿž¬ŠŽ´Øâᵇr™ !Iy åaJ§Cú_|ÌI†–,7I»…æÔ‘}¦1áäv»>W‡ðã~D<9äPHp rpy(p{Ûr Rƒa¹ÐÉï‚­7ðæ¥ÓFKfqÃÁÅ„ÃE^’Ù`mÇ–³ùšn¾°@±.‹«Ú™Gö¹aÊëªæF]dyv…tó²¥;ø=oÔ7:‘‚KP>„QÜo]UíßÁ盌á +l X¶ü9^¼÷ìí¯Ϧ+ôÌ¿h|ËC“÷ÇÙòsö¯ðç¶ä‡¾‡ãtåt¬tb6D8™ñăYÎÖ|L¢©ùaA>»^?ù5/Ô“ÃI”ÀgÇnÓboó'«•0y•»ü•/žähdÌíôÉÑú«:~ýú€ØL@±&Þà•åy!¬à|E}Í +ù\=±éB¤V‘ÏW3¸Àƒ~†<°\dÍç§ð©øŸQþÈΪä ÿZUMÙB$ÙBZ¿­ÉÙa³.šUµld€£+¶Ü|•pÇ/ €ÝCz¸›6s\-²rùôÓñ‹¿xýöìÍ‹Ó‹K¦{þô…í»†;B¥e輨!ð?6¾/K¿>:åÆ›l™Ýõ嘜¶¯ËyÑë-Õ3ªZá¡·j±àÐⵛΪkÀsn„;±qˆxàúºXí‘Y2ƒ-D˜ \ÇæˆbÎæ܇¡µ¬²„ý[€xŠݦÞ° ð‚|›œ}(œn£º¢¨0¿G¸x€©°%CixԙõHÕÞf­k‰´-2 ÂnìPè¦øÖð|°Žb€pñ0ÈJ¤¸`ÐæXVnb$\A ë„mMëH]è]e–†M¬JÐâ¨Á¿¶T@rj +§Ù¬føfc‹à€A,´™bQNØBæÕÒ…sTC„Þ™Jð‘Á¬(MºÉÔP¦È1#Í52„à“ø|-:CiðE¹Ü¾Ó¼ÅßÖ=xtúdlP-^8HÒáˆEÕJ×Â&Œå@·w‚NšN`›9‹E!¡½€@„@Ièàn‚κ­å‰_qV8g7~(‰!Ä°m¾Ç$éd€®ŠÌÿ¦pI– ÒaŒ\ñVèê¸AF–¡Ü HœÓå“QÆO&èÓƒ9öNö4ðy4«gx6r­¨vȦ˪õ\Rr¿°(\Pb±,D»®«ÓûŠUÕ"Cºi8M“éÇ3îè…Üè ½w¬Õb ‰ ‹·ƒƒB»÷ZðÑAIG¡Iû¤«š1wwv X×nbæ   ÙŽ[ cïà HtêOñ+êzEÚag‰Rã½]ÎdŽCøئ•pªÜœÕÜí´-¾Ã|h“œò!$¯×”mƒ}“¤*ðCqäB“ N=¥äÚÇc­ÖcRšª$ú I¼Qª¬¯7󮶻7CP%W™uIÁ†’ú«ÜÏ9ç$ 5ž‰ ÝÚñR0ã] +I‚©Þ‚“n³Î/¨õ¸ÔúÑzË€fwí R0ÂP{²R{:&уù[)•­dÔڻḠ+˜tA–è7jRª‚éjA?™¤¢DüZl}{¹ë°&Rad?lO³»¸dýDE)ûêó +ïa˜’“fW‹ßAR±Í7 +ÂãME>ò†»éq×­ô9C€þaq©æáÞxžv\†3ûªH*s‡%TŒŸ€Y°‡Á5øÚµHBøfhzzòkbs{Ë­Vrô ?zį[Øx²bÉLò¶ìËaÐk6Ë^\»gúRæ‰O®™ž*bºCRD‘Í›Š[›` 72ƒ4»øñµ”5o4/»‹4ƒk^¢üMI Ãv(åè$·GˆŒ¸‹šHô´Ÿs=R˜ #+1B»¹?äZRâ¹µºØc®Q±l0«b²f½’©hP:ñ·á‡$)f¸}æ^žÖè;2¢ŠN·ÖÀ€«†[õ ×F »È`¶1¡ñS¥ãT\ì´hgÓ&[\eÓœ@3‰pËœï8 ; 1 sªQnâ£ù +uQ<ºŽUšnâËæ¶þàN—]îÄv¬¼~ÿÐÝ87a åžcîÆ‘Lzv7ÃçmÀÍÄ‘ãƒ{‚½Ç[ËÙ@iûèjL±µØ†HmªÂ$.Öa)¸Xã•ÐÍÏ,¢®`·TýBð‘T‰j_®&š2|4Q_‚å ûÐH î>b$R}â©ÑFýÏÍêöŠÝmâ=té &«÷EËÙ+övÁ‰}k"æ oÌ7ì:¡&ï0–ÇheùÛN I¤ÇFz¢GŒDˆ~ÏJ[ЙÉÃõFíd°J`ÐÕò ¶±¤Ä†’toEØŸ†ˆì‚ÈK™„f‚7@þ‚›»,%0××úG-ÐG›G,…0ë˜Æð])MdæÿÆL Ї2Y7Çí‰ÀÉ–=ùßpcÍ#Æ„EH;´&ØD¢UDv Årí×½ çå„Œ\žÔçÍfJ7&ã^¼ÎºìøzXm!ßûÿœ¢DTœ—-$*d3‡_9ú4‚Dö[¶täõgÊü35î‘EÐì¼&H°3“MšXr:ªÉâ—¼½Í% +@_À–ˆþõI3fDW ƒy!®Ä\ïÇ1,Øt¥dÀiË’ úÍXöBæå¼Üï=R„FÅ]ªã²ïFòi‡ÔrSºb +\‘ôA9 WwÛà±îßÝW#y. U’8²Á62zq& x¯;‘‰µ€30‘vè™\… ‚þu.ôl;@ÏØí`'4%ùBÆaÁ ÍB‚at¡Ñlä´&ÖàÿœøÏÁkà̦ï©tp,>Ž•&(cìv©®L$…“SÈsÏÎÄ­PJx7ÿ¿ôœ½yv4yþþì|ì­gº§êÍùAÞ5Ö݃ÎéɹïÊÀ?ô¥f®ùh@š°!‡næ ‚¼Zå;¿ï9€#v½N{õúl‹ëfÙúsL;9=ÙÅõŸoÞ”KákuøçøæYûØnyxc·c ­¯L:Êá¯ÿ—þ K—V%6Ç! +£Ý^(ýíÃýBxÐ`·7üΦÃ`endstream +endobj +4967 0 obj << +/Type /Page +/Contents 4968 0 R +/Resources 4966 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4945 0 R >> endobj -1921 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 283.069 512.306 292.092] -/Subtype /Link -/A << /S /GoTo /D (subsection.19.3.2) >> +4969 0 obj << +/D [4967 0 R /XYZ 85.039 781.388 null] >> endobj -1922 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 258.611 512.306 268.179] -/Subtype /Link -/A << /S /GoTo /D (chapter.20) >> +1194 0 obj << +/D [4967 0 R /XYZ 85.039 761.463 null] >> endobj -1923 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 245.062 512.306 254.084] -/Subtype /Link -/A << /S /GoTo /D (section.20.1) >> +4970 0 obj << +/D [4967 0 R /XYZ 85.039 740.731 null] >> endobj -1924 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 231.512 512.306 240.535] -/Subtype /Link -/A << /S /GoTo /D (subsection.20.1.1) >> +1198 0 obj << +/D [4967 0 R /XYZ 85.039 340.111 null] >> endobj -1925 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 217.963 512.306 226.986] -/Subtype /Link -/A << /S /GoTo /D (subsection.20.1.2) >> +4971 0 obj << +/D [4967 0 R /XYZ 85.039 319.516 null] >> endobj -1926 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 204.414 512.306 213.437] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.20.1.2.1) >> +4966 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1927 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 190.865 512.306 199.888] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.20.1.2.2) >> +4974 0 obj << +/Length 2224 +/Filter /FlateDecode +>> +stream +xÚíY[OãH~çWd{gÕŽ´)êæ+˜¦éffÔ#1­‘‰ ±:±3¶C@ûççœ:e㓵öm»…R—sª¾úÎ¥.ÿÅ pWáÀSA0˜.öøàz>í +1²"£–Ì“½ýOg!“Û§q\¦]5˜Ä×·ÏG—“¿GJ)Gl8òýÀùpv4 +g|úáè »´s Õ_O/&ÑpN/>‘<Ê\]^þŒ}Ã@9“á×ÉO{' ¬fB€"¦?÷®¿òA øÚãL…Á` eÎt/ösµ²õùÞxï—f(êÓÒê¢ÀUsµÍr[©˜ïùßåÌåÚ°\UÑ+]çs/B1Ä ‹“ÛQkg÷¬H [KÎß…Ò¸r€1ˆ2|yÔû,Þ9ê|ù£þQ$wìóÙåÖÈǧc.ŽV,žÏ¡WzÐú|`÷Ù¸¤„h.&'ïäÈe¾ 6pDqœÄ¤‘fURÜFÓÄV—‡@·ð€_Á|l/^¯ú{µÅ¬äR‡=Ѻ ˜z ´ì}Ñ6¢'ô Àú‚ ·×Õl˺ÿÚ.QC­ò}Ÿù½Ð +®9gÞ[À=½8í ·5Ü[ó¿„UÉñW†Ø¿ÏÏÓ¬/·Ï„ »2T¢gN–[–ø.vã¨êËn#jàj¯¯ç¿¡ÚÅïÿ­¥»é/¢u½Wd…Í#Ko´µ¨A+ü­$úXÂù`áÕl#J~ëú¢/·Bá¡ð-àÂÁ­/ÜFñÝ;/ø®Þå ½·^8Föæ¶5[o ¹×;Êõ6D}|í ySÜîÁ~Ðß%ïÕ›°=R÷؃7$ Ç: {{„Ðůkò=Ï$mÁ +â]ö«„Ï»bÿD´o`.Œ´bžò üËÜ ¼Z®×k¸Z ô?ôSÍ0«bi=”¯üoØ6Ïmg~‹¿¾S¡Ðã2Í`¼»¿=‡r^âàV8††"½GѤ(©- Ó•¬¼Ñ]DóyRl`[D™™ÎBÈPç‘®Kv±mÍ"¾OA ¥„týÜ™•g5Ò)v)¸uƒN^VãiŠËŠ4b#C+ h`¡çIIªK™¯JRõp¹û€>(à[çÂNkéLŒ c#ÏÃÍ«M[‘Œæ9hÎ4ªRàa‡gb¦ÄRd wì*5‹0ºæÔIÓ¡•D@$Ö•›¡ +…x ­nÛRj +ÏòÅ1ù®’ºR–ÏTZi¾ Œ€Û¼†¸1¾1£°\³ºµÆè“ÒË3„È@2%Üö¶^àŠ‚yfÆA+\0ÖM®ÅeÆT§5ƒÛ˜:p^Ü%¶ZåôÍK[2o;2ôÈ„4 M2 ¬¾U¶Î…íAiºûa°þ‘FˆŠ)Zy–V6’@fUt|j²ceÈqRZ¨ؾ²2´¸ûííáÿïíoòÞn?dHŸqHÙæ ت(þ»™j[—%ü{r¬ùaó"µ}]‡ü"å»Î±ý°KÇ÷4g¼ÊhôóèÑ6ijàêÀõ”µè¨Bì õ|àÉlEšGË¢¦Ù¥´ ùÎå÷ÁÎqŸ_ˆ…pa„#]“W¹^¯‰‚7Ü=Ñö£gÂzê©´z¯Êm/©y¹n–$\˜O+­9£5=» oÎä‡2ëwúU籇ÉÎþÓ«¾å6Ç­X ^8-¸âVÔX̹É×ÏñÖß|·ÿÛÕ©gendstream +endobj +4973 0 obj << +/Type /Page +/Contents 4974 0 R +/Resources 4972 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4945 0 R >> endobj -1928 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 177.316 512.306 186.338] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.20.1.2.3) >> +4975 0 obj << +/D [4973 0 R /XYZ 85.039 781.388 null] >> endobj -1929 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 163.766 512.306 172.789] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.20.1.2.4) >> +1202 0 obj << +/D [4973 0 R /XYZ 85.039 309.498 null] +>> endobj +4976 0 obj << +/D [4973 0 R /XYZ 85.039 288.903 null] >> endobj -1930 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 150.217 512.306 159.24] -/Subtype /Link -/A << /S /GoTo /D (section.20.2) >> +4972 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F56 2890 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1931 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 125.759 512.306 135.327] -/Subtype /Link -/A << /S /GoTo /D (chapter.21) >> +4979 0 obj << +/Length 2180 +/Filter /FlateDecode +>> +stream +xÚÅioÛFö»…ÐÍÂT!±sò°ä8iÜ&®6–‘’  EÚbB“*IYöþú}oÞ¢(Ù=âbØœãÍ»™g>`ðŸí2ü€»2‹Û#6¸¸…[qæd~ôÃkO 8sCæ×[<ÚUZæñGçå›élþêýp,¥txàǾ8/ßN/†Ü¹8{9}‹[Ê™ÁôýÙù|8æÎÙù0—³Ù/¸7 ¤3~žÿtôjÞ²ÕBäé·£ŸÙ þ:b® ƒÁÆÌå°}{L¹ZI;ÏŽ.ŽþÝ¢¢=5 S‡T eàê@îë@ꎸ®ïù_3W3e”ð&ŽoC¾à¿Æ‰{ú$æœ íLa }í¾”aÂ4s.Öùp¬a÷]ô`—-09ÑÁD‡4ŒITð6æÈz¸Gêìü¬CJr@Å~:qTwè¾ ù· +¤÷é$×}y”ž_že¶êÊÃs¤ï…áß@©LúÎ …ÔÁßà «UÜJxÒ—ÏOé.ߣ¤4ÓÞóøÃéùÙã—„÷t<—KtH½y;ëËÄCßgÏ®½_Ë䆨aG.!Åý¿J Ò#øIÅBß#°«¬X|­h\\Ó·Jÿ›X$žàJ¹4ñY¸&º‹Ò,ºÊCkܾËB"ör]–I^xœ–É¢.Êš¦Ë'.þ\LßLÇ//g8[•i^¿ÀÑ)þx8øë€GHPÖép¬@vçYÇ›ðàI븈jûÓˆ¥~ñôô—“W³ mYx€º1¸’J±–NT÷éH‹Y÷õ4,ª’òKR+›ó·™:ôd“ØæË5á™®J‹°‡O˜žHñGĹ<$g¡ö‚oGï’¡˜lÈPL,Ï£´ÙéëE™Dà¨ÂÍN÷¢_ûj/£mõÆìWL„š0ÿÿ?¼æÝÛ F§/üÁXIדž!}^Ôé°Cåqê%ܵPqRš`rÊ„V¢vnâœp'.S¼ŠÀBÌ'ƬgIE¸WCDT!D’#°%“愦^ZŽwîSÂS®à!Xyd +]¡ìvµ¾ûø˜cç'°Ïª,®Pª« ~?ÍëÆÅ-1Qâ‚ëJ/èúÚªl4pƒ´X£(àÎÀ2wŒ$u„X³¨N \zmã…ÞZs£WßQ¹³Lè0ê%kðZ„×2ì«Vçx(o€6£SÒ³'ƒÀ(¯ ƒÀ)F0 HŒ“5íEeƒ^[þSÃÿˆ Ù1ÐT²Á´àɪ¢õhzÞ î=Ð5²ˆzÅ Ù"Ió{}ÒŒE„X7jLh¾õ¸[¥Ò¥…Xd©už +ôìiYËndÍôI¢,[ìK¹(ÖäD©¸QoCá|Ÿ›1Jø=mb™Âº ¹¹¸³–iÒ¸¾X&·4Úú˜Bu™c <•¥”mÀÖ—Vv!K¿¶xyÇŒ€­uËG» elD°ÂâÉ6Éßöu°e”û†Qî‘“&´T-£– :Á´ds-VdgØA­ã†‰ž”d|AK&ÖáûÁDP\àÞ¦"2¯`å~•--€‘• “uMëedGRH†fËëÿn`wÇɤҎåCJáKñZ¶ò8?ž3ÃJèÔÈï;æ¡ÚÄ*àh™Ž*ôYD”V€õ<¨D·èJ& ÑVL!JÉY6üÃÆ×­ãÑÂC›U-Ä6C›IÒ„NÉhq„©a¯xVhf€ß†‡=R˜Õ‚ñÐÔ(mÍ”á/¢c]&ÿzÞ΋×w¼x™M™3%‹’,ˆ»fÜf¿ê@*B×WÂbŠð!Bȶ5±i´QH•ZpïkN¾D³­á‚ɉðÝ öÒ*xIÈ~µ©pßÀO×g~[7ömXZ*Ì÷Ô«èšBª½\-å~Þ0›"³"¿qinHº*|º+Ó1 Áºöá•\ D¸žO5Ÿ®ï/ÂÕX®Tè¼_ç9E®ç;å +ÃÉY,0„RsuÇåM +ÞgFQ[£ft .§Ÿdºc˜Þñ„–i?pÜ•é ,i*OîÑ®põj³"NL”u³(.ÖI–Ñh7 q%º¢J¹¶~¤y[¨q\­ÈÙ($ð˜Åd¢:¹1¯\Á{š¡fSo£';Œ~ ue)"qÈzQܸF| gmÓQÑTJ[õ>âñŽ¿øL°jTD¥ª­–C*fx¶ùÆ…½jPÕnʹØ^Ét7à÷\xŸ4aŠ®€Héš$…C^Ñ3¨ö·×´e¡[Œð–³³šèoR4R_5u‰›»cž>\]}µ£cÚÀ¹2ÅKR‘æj›”oÒÖ+L4r«@êG*—< +ûVõm¥ugÊA[¨rt„˜ŸžXÄQgkóW;—b[ÝzÅ€®‹,kë€)i7¯.[-š™šJcâ2 9÷ʺ8n-£Ýäc ·ÙKâ´nýpdÑÞDƽ씮ª0Ø–¼Ø\¯ÍMŽ£ûLÜäæ)æÀp_Eýz°”«ÅÂfœŽ/qïŸ÷ðÏ.,è{¼Í:fþÜ"âbcŸ=Ø;Æï}à}g÷±«ÂÙÄ6rlËh²í7¥rî*ÈBOôÍ&½¦Ó¤×šØGî#}‰óK8ò~úaÒkz½Ú‘aŒ=†¦×qõ:££^_qô4S½†Ý¨×ÿlç?¿{—æ†ÛžÚuå¦ë{7βQGáçó×£æíüû¬4ݯc"¶íQèkx»¶³D^´¸ ô_öíû,ò{ö·=€VË×ã½ÃÉŸóçsƒ¥ÿ²˜îWƒîà]Åá¡¢?$Æ7ý¦½:(é2<|sÐB˜†ñb.;¾îóÛü-gáÿ¿k +endstream +endobj +4978 0 obj << +/Type /Page +/Contents 4979 0 R +/Resources 4977 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4982 0 R >> endobj -1932 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 112.21 512.306 121.233] -/Subtype /Link -/A << /S /GoTo /D (section.21.1) >> +4980 0 obj << +/D [4978 0 R /XYZ 85.039 781.388 null] >> endobj -1933 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 98.661 512.306 107.683] -/Subtype /Link -/A << /S /GoTo /D (section.21.2) >> +1206 0 obj << +/D [4978 0 R /XYZ 85.039 309.498 null] >> endobj -1934 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 85.111 512.306 94.134] -/Subtype /Link -/A << /S /GoTo /D (subsection.21.2.1) >> +4981 0 obj << +/D [4978 0 R /XYZ 85.039 289.509 null] >> endobj -1935 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 71.562 512.306 80.585] -/Subtype /Link -/A << /S /GoTo /D (subsection.21.2.2) >> +4977 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1936 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 58.013 512.306 67.036] -/Subtype /Link -/A << /S /GoTo /D (subsection.21.2.3) >> +4985 0 obj << +/Length 2244 +/Filter /FlateDecode +>> +stream +xÚ½YmSÛHþίðííUäªx2¯z!•„…=¾µ©½«ljKHk±%Ÿ,CØ_¿ÝÓ#Y6†¤rI¹4ÓÓÓ¯O÷Œ„èqø/z¡a\E½ L…a/™ïñÞ5¬ü´'ÇÀ± :<ï'{oŽ|ÝœE<êM®Ör ÓFõ&é'ïàx8š|ø¥?PJy"dýA„ÞÁépÜÞøä`xŠKÚÁô—“³I ¼“³Ÿˆy.F£s\ë‡Ê›ô?O~Þû0iÍj‚ Úôß½OŸy/ûÞãLEaïÆœ XžïQÌhåæ³½ñÞ¿ZQ´¦{´kWŒ +™ ÕÃ(Ó‰Š~Ð g†k„ãó“1ÃÕ–Îf¯Ýô÷4cg“£×Çi:D‚ó߫욟Ž~@GA# dØÈ€q° %ª¼¨³ª?0Òx‡U~ÛŒQ„à4^®’$[.¯V³Ù=QòbYdzY–2üæHt-6L„²7Њù*°Z†W5„<Ã\€xŵWOs ,qbð!¼:[4K‘Sà‹ú2ô²ÊqNËPg)±^öÁϱWY‚rÊë8ò?qœµ| ãžÆãxÞ‡M—ÀÓƲh“‘H[Th_ûj§:«ÈòBx=­Œ÷Xeì‚0˜ûÈú^dÖ +©<ŒAIõá0Ù{OÄ$®²+ë+Íï¦MÑZ)Aú´@_‹kG²‘ƒb>ÇGŒáHÑXͽòxUOö%Á8 Ø¸¸v¦´!€qY¥6ìÀ[^­ Ÿ|ÃÃ߸ÐÙ,¥|R\Ddk­œƒ,iBoCÕ’hwè@¹š¡yH ¼Y»Q]Ò3&xmD€À2`*?{PÃ2 +£žo$óñõ*VL+g YƒŽ°‡%ª¸`P­F´k<N.ÆÛ¶)å3ø/b[#ë+¶iθ¶]œ/>ŒÇG§;ê7@o"߬ªÊŠ’1Ïl~—ñuÖæ9ôl‡mÁ¹$€@à"&åf%´ ^RZlÚbØú¼ÅŠ+WK[W¾w`«h=Á婃Žâ‘7ϯ§}Qi†M7¢ÉºŠ£‡$´`µÖͺ…µfë&¡%K¼¢E(4>(ó×À/”í+§»Z—%à´têÃX·[ƒŒòRÛVºdiuÛ^s‡uR¢Ì›¾1^ŒšfDÄpéKâ®ã'Eb£ø1ç…Ê’Vb 8–©ÝÖ©Ûµ¼§Þ¡[á–amlœbü1Ùep°£Ìã;žŽ<0yAO§Ÿ#Q°uÉ @!ëÁÅh¼æ­r2ܶçk¢Sw‰qÙže¸Ë:„8Í—D<>ǽ¿NÎݾŽ0›ó:‡Cà¡'‹Ê¶l ÎÔ‚n1Ý%¬û¥K?ÒÓ¬ŽóZ)q¥-Ô’¦Áç k|Y¼&–üŠž÷ÔiÒ=è`Z4b2GÈköÈÝÅÀe‚åÒÕá±Còn’)èƘïÛ8À=+``´Ä"„î`š%7`ŠïCª0}%½@¼Cë©EÍŽò™ ²Ç·/±š¼,+h:Ç ÜZaÕýu‹©»à«¸€¬BnaÃ# ûŸŒCËbðÑÛ0èˆqŸJùÜåAúÒå<‰-v€xW¶Sú¡=ûÜ5#~Eç"nÙ¼¡¬÷!Vq[S|Ȼݧp=vrR £¶­á’eÏÜz¾VéNìíCAq&áZüÆõÎvïf½[ í•o×ÏgZ6'ò¼Ó?¡²ñ†úÞ°(ëiç¨u€/KÐzø’ž Ž¯â¤†"ÑOä¸vûVNÀvp“e´%ëZ;G ÷Rý®S"»«"]—É­nœy6ÆïÂ%bAК­˜#ÔqÛWÒ£ƒa;lßÜ×P©yj¸¹FWâL?’È, ¹CŒ”Ñmž) iÞZI]Vp²iì½ÚˬU™`¶{þf¶ÍÞ4æ8A€ Ëq^Ñw(5·MwG7¯Ë9›œ*³ÜåHá wGÈ$~ãñþŽˆ ζÅ!_U–õßÝ«ÌütdEMÓ7oÆÃï‡öùÓPž¿ÿ0vxz +¥Ï×z´‚—ùÖ£¸ÞöHµá¾6»õP‰ÍâeVý‘Õš-)êá ˆ—Øù*ú&o „î[¼¹Øåà‘ñÃgz³­çøtÔÑ#> endobj -1889 0 obj << -/D [1887 0 R /XYZ 85.039 786.531 null] +4986 0 obj << +/D [4984 0 R /XYZ 85.039 781.388 null] >> endobj -1886 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R >> +1210 0 obj << +/D [4984 0 R /XYZ 85.039 581.088 null] +>> endobj +4987 0 obj << +/D [4984 0 R /XYZ 85.039 562.614 null] +>> endobj +4983 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1939 0 obj << -/Length 1980 +4990 0 obj << +/Length 3884 /Filter /FlateDecode >> stream -xÚí\ÉrÚJÝó,ÞB,ÕƒºÕ«TâĉSò‰yYÈ •Aò“„ü}îín OX8‰ÊUÖˆúô=÷ÜA¶¤ø®ÇT[Âõi&-¯}GÞ·ˆ=Ãks×>zÓoíì Ú&ž«<ÕîŸéSúÃoÎnšthà‘Yäïý­wý¹‹t¹ËëüßúöÝká‹>¶<—© } ëžK”jOZÜg®Ï™Ý·z­««˜c¼m>µâ^»,àn@¬xnðꦉ¿â¦)q©ËÝN— á$Qáø¢Óõ}ß¾çá‚+5·us±îØ?þ —^€„qâ©`}i ³ó¶Yùü~Íð¡¯I„Ë¿yÉQW0ÞîDS݉ƒ' œ;_÷zcÎ$…3ìg:ŽrÜÉ'ÞUÇNÃÓ1ŒÌX·s\‰®GQ»„d/!\*·/µÞbMè-Ð)Œsháâ,h¬g5<Ò« já¹ÊˆK˜tºj, Óm«’é(8?_­ôXóÒw@½U@"ˆŠ;Ò¼ˆ“sTåi\ãA–æ`w)Â{VXcÄY¯ÈÊÕÓi¡ÉphNÙ+÷#³£‡;~â¥Ìy³»È¢È|#xy½ì…“Ópi˜¸mðËúQnÞ•G$YÞ`Z0\œ"+ -u ]©W8ƒ1—0°Äå4¸Ã>¨&/ô.û Ô]IÃ’&@d¾ô_Ê´~FƒÛ´ïYèæÉ Á+}ÏQZ Í×ÛCp¢ ¶à)ÄÆ ±í'Etž…3r;ì`Oâd˜vq®Ñ.óJ¬w˜»àŸ>¨)î¢cOÎu\Œ*ªBæÛ$[±Ç±}2[±Š­ŽÂ‰U·Ÿ5SçéxZÀsÆš¡A#ÇvšÅ%2[f?ò%Á3ìÀIT9ÓæœkTÐÚ‡dè†È}ò÷’¼+ Ù<í°9ÚÙ‰ -í/vFè/´î…à·Ë=ÑÏz¤xMHÑE¤2j›¹rir'ø´¦vhØ#²Ày6¦³ˆ_>|Ÿ¤L¢äà_*DÌÕS<ˆÉ5νrbþØÐ%E˜ó\Ó¢’an–Ó¼ -üÐÓ£:"•FÐR‹Q-µt : R[pÕ`môAv¡?yŽªmËÎ^Ôb´röý‘죨x³l³‘3 vCc°?xŠËšÆ.ŽûÁ!̽ǽ¾úÿ<Âmú‚ÀêßI8u¡Qzkó>òƒå „1”6r÷”TM(•>û푵‘S,I‘¶§—Ò˜®AgSèÜÇiûœ“ýÛÐQ¬åÉ°l.9ÅMrª ¦U½LPm8l-ÎçràºzŸ™Z–X⸆¢Ñ“MNüÁÓ9 5”Ëy|ÉM.Xf”æ…Y; o—˜L‹h¾æ/TƒÏ³áÖñ‰móLv†Õs †U¼7*¼";zÖ›k!µS8‹:²èC½Ãí1¶ ±†ï­ÅÄü[±ÛG;ú íþc ,…Ù¬Uhhú×~Â! \5Á%ÊlVÿàðŠ z†òtÙ*.,(Jxam)YÖå9ZM8Œ1ë{nŒÓáiQ7¡€$ ®Em;ÀñM€ó%‰Fß3ІÑÎî(ÄÒz–GË­¼OqøcBIƒµ!Žç¦´¾fæúUˆs‚‰ï°°=£sÔ_•3ÂÌHä¢l,Å)nõòTWÎ68Š^ÁRÈ¿d®òƯ¢lÛ€1>µ~;L,Ük|¶é2E˜”¢ µl®2˜±ýÿWø/Êò2WR–¡Î²tbÖÒ±21Þ!ľ-4(=Je,ó1Äx2LL­pF|Ú¢,ëÙ*ÕD2ë‘ó·Ý,ŒëÞ‹ËW°#XÓ$¬|Ž¦/ÎncžúàÂf07çÓŶҖ¢òéoã¼ -L{‚Î’p.^èýæ·¨™ÄmîþyêÒ”FÐÕFxåUšr` ÂF‰iíVõ%àÊ÷ѲtÜéJ6À<˜Ò±ÚBÕ‰]Û"k+Ž'JP`çE<´ðÌBÅ99W¶L܆6hÅé–ƺŽÚº˜{ƒê¤pl±É‹pÖÃÓ+³+}T¾›9ïf›:ò­5iÅÜëR½(³r¶ÌHeWqY³ÚéNxA\µ•bÝÿ»*µÊ«…”JûɆÖ!”#o0hỈ%dú½žËª¾õ‚š³êd³š@*“﯇è-bÍc+% óºB8¬ߧ[ ×#Ë\Rº Á6—+¶RˆSâ¥J¯¤=qÐãÜ ìÅõ}§ßQX„œžŽ£|dâˆT¿§³øÄRÁÓ;ƒˆ¥o"j9{­\IÅÝ£þº@_cì)Q–4Q–iAïšë®í #=—1qz16oZn.®RÉÈ[RÝÃûÉû5‚¤MÈcMšÕÀÀ² -ª^çyëDUJjAà^peÐU5á‰8Îÿ~³ƒ,ëos·ùaøº8endstream -endobj -1938 0 obj << +xÚåZYoãF~÷¯0²† +,šM6/¿,ª¯ê:¾ª¦: à¯:Ìb?ˆòÃ4S~”e‡ËÍApx =ß(¡˜ ÉÜ¡y{upüm¢UàçA~xu3Ìû:Ž¯V¿yï>ž^\}øy6¢ÈS™?›§iæ½ûáôr¦¼Ë³w§?`—ö. úóÙùÕl®¼³óï˜i®/.~¾YyW³ÏWß|¸²Û² ÂrÜÓŸ¿}W°ÿï?ʳÃ'(¾‚îÍlÊu$õõÁåÁ?ìTܧyÔ â(óã,ÚçA;5ÜÛGá™áŽì燀¬£  +ÇUÕˆ‘´JÇ&%Iœë ÃÜW)^)îm HFì})û û%~ni‹ÎÖYV ¸+^þ©BvãŠrž‡7ÔW¤V¨îkhØßÊà†äRÁÉ^“•y°÷%âLc¾7RB#O9' $%w‰ôµÀ3Dû)e&{‹He…¯fJ#V¾ª^Ì ù*¿1þ=¡ BþÅËîÙ… +‰Ný¦ç (N,jæ°‚m_éèßæ©‹ÕènA„¿¨BërÅFY±\Znâ,ªúrr¤a>¸b¤-@JË£¼9‰ˆ}-7bx¿ö¨4Ú‘æž[(tDrù½iÁ…ï_ÿ':X +:VçÙñÐú!Q#kŸôüêâîàø— _Vº \Êðu(ä½ … Ñ_@¡W(´·Þr׳P( +ÂÏAŒlä˜Ñ€2¡ØD¿.>Â:ª c{žn†œÅ™ˆ¡Ôº¡ö]]¾.‰ÏÚéãœÐœ9·ºfµí“žDzaêVdÍÄ™÷Þeª “ö7¤¹ªLíäWP'"ÑÜãÄw´Àà/Råø¯T9.+ ‡Ë‚29g,좄Fœm(KMNte¯¸ãÑÖ…> –©l,3e],FÑ*„*ÖCŠHAغ¶ h%ŒÙIH3„N ev8üÜ𯛀Ã8b1èù—ú–lÓ­»´6À6±b÷Ó0Â×æ¶Q–{IŒèYb”XÔý|o”‰ÆŒ’6± ’t£(~Ñ7O’];¿:â„ÉbÛ2‚$I<=@l6”ØÂØ~Ãø –/|®@ïùÕ„[Ý9Kψ;´6ÕªÀKR!•¯°òžZ!…-„OÉ~.XY÷%[%AN’%†hèTŽW¬‡ä[ÍÑÇpAÈ4öÈên)×rÇiÈ?·N”eäf#ðRöŒKÎR€ ±ìå5ˆ…Ê3°*KRHm´ÔÄR²™ªŠusËUÉéaqaBáP `Å\µÑÐIÆFr +~Þã{Í¥™…ó +@øÌ-(•3×4„JX4Î!°y3I¦%xÏNrDåÊz“~’dW]l„€N -²F;<&ÙL'µ^pÐåàвl;îE+EþøötŽÝï®ñåê¥çdBR[q. ãë(”¬½an‘ãþŠ,ãÑ…Óq}öaf² ­dÏŽ%£vŒ<¥\‹Ìº`.„¸:Mb³žëÀ—§HßâyNçp¢Ë—p&Ø-?Õ¯ÃÌæe”)42_[M0æîbSÓYlH¶…Šk†ÞõùÙ/\¢‹!Ó·y˜q„d؈ÏdHaSÍXá$І“¬&Qí(áª@YÖxœÅ`,Úª0N,OW$v([iJˆ£01OÜ…„S7!kléô”E)4¿Çíöº–¤4uHfJ{_=?ùóóWÜnñS’€í½ÅáÀYkYm¬€0ûƒäÑçS¤¼­èžV·µóÌAê/æT¡•$f²oGZF²KŽ¯m¢ÁÆ 0ÓüúMkÓ ~áÀ¡ZòboøØÛÍ(ˆí8†¶öæ?¸µ!{‚—n1’Í +–’+䶵}ué­)¶—«%çÄm»I“+˜)3çýÌÂ)!+ø‘‰1åR7‡‚ 1LÓC…6ìäPfæs|Ú!I ¸Øèa‘ -x¢DÊ\'™÷–`…VdÓ¯¼ñÌÐÊe‡yÙÖ=pMR¨ÊûmÏOšbçs–|æÒX{fìÑÄî9Œ>8‹@mî,ö´|F§^WÕË’[)/eò½ø'Q2|€'Mïe&³Ä9?Nr€ûFø‘€—…e*#Þ3Í¿þe-‹„ “é;QŠzðA]57ÓÚX ¶<›‰p®ª—ߎk>(òo5õÊû1ø¿ÎPÁôób6`LÜËyÓË‚Èv¹)jW&±ó.›õvSKZóÎ2ÓVnJ¬R—&÷EMo³n;:3MX-K›jÓœmÀnjNó%Ñ7l~›¶73-#bˆÉÁK´å„´65†á7È”0ö~¢T%7“\`a'ˆM`"ä­*4åçé£ ì1YE,ª T³ÏmØŒ6AŸej¢çhFvuEz5q„;z|5èR)gÓ¹¸ïC±=afba׬à <ÆçvX3Ϙˆ\5$§ˆE1oDC±i'ˆ’±§‡NÚRÈÞŒl`ùé®YOÝKønsÛVàøèû¨kz×<;× ù!sEÔ&%ݯʌF°oY©)sÛJìMy_~—xá;…˜D¯~Çáмü‘Š +5àêxç#•L>R9倭ãø3Iøå´øŸ¹0€ÂDá–© +JÊ',òéZJÎÖüQ$ƒs²Èâ“ÞR²Öš_ði¡U[Ùo_ñu/1"Ä78ý:#š—?hQAZí8•Ü<ÿä¹k¹ÁC(O=ÈÁ`ú)ÏØ*ôroIñÍIü"‘gcRZaæ¥%Éìr +*š ©X­ØŒð÷%QèM~q§¾Ê¡–/oøX«Ø|þ‘gfMˆP"僑iN7p&ÚI ¡¸Û'l‚ˆíTyd:@ϵʊ…3ø³óªQºwŠï9wu$á¯Ð©³óÁH»‚ß>O˜]£!ÌYúA–1ošþoü¥_û°¤<}ÏÕù5ö}ý ø›ÈÀûB¼Ä¦ ó)!†ÌäÿéKP« +:ò³(ŸÖ„8äçlÞ „t/Ž5_Œîmøßê&c2endstream +endobj +4989 0 obj << /Type /Page -/Contents 1939 0 R -/Resources 1937 0 R +/Contents 4990 0 R +/Resources 4988 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1836 0 R -/Annots [ 1941 0 R 1942 0 R 1943 0 R 1944 0 R 1945 0 R 1946 0 R 1947 0 R 1948 0 R 1949 0 R 1950 0 R 1951 0 R 1952 0 R 1953 0 R 1954 0 R 1955 0 R 1956 0 R 1957 0 R 1958 0 R 1959 0 R 1960 0 R 1961 0 R 1962 0 R 1963 0 R 1964 0 R 1965 0 R 1966 0 R 1967 0 R 1968 0 R 1969 0 R 1970 0 R 1971 0 R 1972 0 R 1973 0 R 1974 0 R 1975 0 R 1976 0 R 1977 0 R 1978 0 R 1979 0 R 1980 0 R 1981 0 R 1982 0 R 1983 0 R 1984 0 R 1985 0 R 1986 0 R ] +/Parent 4982 0 R >> endobj -1941 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 754.651 512.306 763.674] -/Subtype /Link -/A << /S /GoTo /D (subsection.21.2.4) >> +4991 0 obj << +/D [4989 0 R /XYZ 85.039 781.388 null] >> endobj -1942 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] -/Subtype /Link -/A << /S /GoTo /D (section.21.3) >> +1214 0 obj << +/D [4989 0 R /XYZ 85.039 648.228 null] >> endobj -1943 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 727.553 512.306 736.575] -/Subtype /Link -/A << /S /GoTo /D (subsection.21.3.1) >> +4992 0 obj << +/D [4989 0 R /XYZ 85.039 628.239 null] >> endobj -1944 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] -/Subtype /Link -/A << /S /GoTo /D (subsection.21.3.2) >> +1218 0 obj << +/D [4989 0 R /XYZ 85.039 135.763 null] >> endobj -1945 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 689.545 512.306 699.113] -/Subtype /Link -/A << /S /GoTo /D (chapter.22) >> +4993 0 obj << +/D [4989 0 R /XYZ 85.039 115.169 null] >> endobj -1946 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 675.996 512.306 685.019] -/Subtype /Link -/A << /S /GoTo /D (section.22.1) >> +4988 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F14 2895 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1947 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 662.447 512.306 671.469] -/Subtype /Link -/A << /S /GoTo /D (subsection.22.1.1) >> +4996 0 obj << +/Length 1970 +/Filter /FlateDecode +>> +stream +xÚµXëOÛHÿž¿"Ê]…S‘=¯×O¤ûô=Êq$¨:µUebC¬Ævj;<Ôþæ±vâ½»ïîÌÎÎÎüæ±È¾ ?²ï;ÂTAßó¥P¾ßŸ¦=³ ”·=©9FšeÔâ9˜ô~{ãÚ}iŠÀ ú“«•GØŽêO¢ÆáÑþÙäõùp¤”2¤/†#ÏóÓýñPããÃý$ÙÆLÏO'Ñ4ŽOß2?ò\œý‰´¡¯ŒÉðóä]ïõ¤Q«9TP§o½ŸÍ~ú¿ë™B~ÿƦ@N{ ”pl¥çóÞ¸÷W#ŠivŸwu™ÀQ¾p|µiå´l mW¸žÓ÷S8¦MFM‡#ÇrŒ0Š¢"¹‰ ž>$Y”ß–<ÃËã÷Îw`iÂø“T6^4IT0 ƒô~1 ³*,ïY^¦ñÞÑ«Óã±)¿D±xur²¦VŽ¹MÄQ¥œ÷bÕ›/êÝíùÑÉH“Ž·©CÂN/`Çùþ‡½¶T²ÛžŸïÒ Ÿ¥SVk»£øjm>+âÝ-:uH»É¢õÝóE3ÿãýû$#mÙþÛıAö—w"šÏw[Æ>¼i ÿRÄ×h²7Þ°?:¼8“Бå W¹ý‘m +×öIô4˜÷wþ<&(1,ðGññ;8³¼.[4àøÿ{ÏóØ3ýo:¦¹”ÿÆÿý:ìžQà åBÚ°¿ç•$+«p>#çüöF¶Ó#¤oÈaÏü3h¾ŽlØ{‹y6¼:Ÿã‚k„ó2Ç‘g\AS#æIx‰.(j˜øëg^,gˆi|ÉA³éë4G½ohó5ؘ@Q;6å…Õ™m²t­FLÞ©uô"O¹äl%E-wZåEÂ[b'0ÆZxmr»†×…th祡²êp±å +}#³-VGÒïh¥: rtŽ-,¿H™"–.‘ý!æ&Ð¥a+ײ¦úNŽ«,»ôƒÐö. b·ªçUŽŽÃFÜÍ2ëPXšÞ3"D1P%éçH  Aý…Kg¨X0”®–>`mHzž¢¾bKm›¶ìÇ-j~-³}°´„’V_`W‹N‡žß ±%¼dî“r=ãmªÄ<~“dá¼ö7ôš¶ïçË,c`™È4¦h²ÂIU8˜ñbWPŒ4ᆭÔqcÍ“â§ÃÖ·xèÆ릮oìÁ-®´ã0EŸ_†Ÿ“7æÊ‹-®dqƒèW +P¤|ÍtÑÛ " IU™uÝÎêËMg]‘¹Ò”íHjêÀNÉGEE;Ú©Vã2¥ˆD«•”‚ ìqÅ Yí£8z ù´Ð –9ò'  £¸F;ÐœÈvΡÜ*h )%*¯³ zÎä?M}-44å{\´"æ++I6·ÃI’]Á,¯'|FRiê€Â;Nóâ~@BÝUúô´X`TÆYÅÓÑÅ_ÜÁ?ýjÞ¿úJu·‹³4·w¾Ý/¨ÍçÈÃ÷ÓÓQZÇÝvW›Ò´öD ÿH‡N6åWÁþ À¿ tlËøΟ,Z®ióT¿óìT—YšPðh¶Yˆ„ú \‰r]ô0h^¦ZþK&‚É;Þ`u™€|K²sT÷+Æm¸É¡‹(=¯8 ß7Ô ð¾ÇæIˆm-`Ãêl_à?kôŸþ*ºjûôË[z Dz„%k]¨éóü‡úÖ=ÝPø¡A¡~endstream +endobj +4995 0 obj << +/Type /Page +/Contents 4996 0 R +/Resources 4994 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4982 0 R >> endobj -1948 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 637.988 512.306 647.557] -/Subtype /Link -/A << /S /GoTo /D (chapter.23) >> +4997 0 obj << +/D [4995 0 R /XYZ 85.039 781.388 null] >> endobj -1949 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 624.439 512.306 633.462] -/Subtype /Link -/A << /S /GoTo /D (section.23.1) >> +1222 0 obj << +/D [4995 0 R /XYZ 85.039 404.948 null] >> endobj -1950 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 610.89 512.306 619.913] -/Subtype /Link -/A << /S /GoTo /D (subsection.23.1.1) >> +4998 0 obj << +/D [4995 0 R /XYZ 85.039 384.354 null] >> endobj -1951 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 597.341 512.306 606.364] -/Subtype /Link -/A << /S /GoTo /D (subsection.23.1.2) >> +4994 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F66 3242 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1952 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 583.792 512.306 592.814] -/Subtype /Link -/A << /S /GoTo /D (subsection.23.1.3) >> +5001 0 obj << +/Length 3811 +/Filter /FlateDecode +>> +stream +xÚ¥ZëoÛFÿî¿B0D É]¾rŸ'iÝkR_ì^Q´”i‰gŠTIÊŽ¯ÿüÍk—”EËÅAÌ}ÌîÎÎÎþæ±ògüógIèz*ʼnïª$™-7'Þl=ßœøB±’ňæÝõÉ›‘žùž›zéìúv˜'tu¨f×ù/Îù·g—×¾ÌJ)ÇOÜù"Žçüû³«¹ï\]œŸ}]Ú¹„ê—‹Ï×ó…ï\|þ†é‘æÇËË°ož(çzþïëïN>\[¶ì‚ÀBŠ<ý~òË¿½Yüwâ¹*MfPö\º7'À”j%õêäêäŸv*îÓ35%DnC!š@¿¼œ +S7L£Éå¼ÙÂ÷aÅøy¶i”ópÉïϳ®òƒÙ"Ò±«“ОLÀ7 C<ßÝ( f1¥¾¦£ùÜ€\{xñT®†Ú +–^Ck: SE6WVž<ÙxO¡(“¬¯´BáàçÛ¡é’Ë4¶$Éd7!—L[ær»Ã½Ö$ÕhäæD›ùY, 5±ÖQ‡¥µùé`[1mþÎ,Gƒi¡|â€úuÙ½…­ÃÁˆ†Á<C´1}ñÀxÜR~êÜâéÊ’ævܺ]ã&«¦k¨d Uù _›¬”K M½¤~Ôm;¿]ËœçR.Ôù›ÀŒhp]8¼7+î®øXdY›12àCÖ#wõêApJçx߶¡t{hÙ4¦Í6-—›epÊÝ–[ªÒB)7r¤ñÀvšðôÐÓ÷ +*r®™¥è_Ùñ¨ÕñI +á'§¶{l3M S4f‚©í.AhLÆÈqynðçz¦Ûù« V›žË™ô1ãúY¹ZÓd,²嬕CÊLf)eµM†2 É®ØÐÚ¡ó¥ÈdTS»Ï©8øuQWñÆâÄȹèH´? ßñ,BoÀ‰_=_·]Ï•áBSõè0€³xf ²òÑ- 4ÏßRj7@ôƒ-|è¶tH¢Ë”e >A¹Ù²j“ùÍìÉ£¶uƒžõµn@U1¦5õ ZéžjQ$4˜fjÛÓ°”¡ìœõj·ærÙõaͼf­Ô@®=û2‹)‰@Ð’G§ „ÍÊ·áYX«¶È~›õEõˆˆIwÎs~ B*°²c($ùæäR +ûR¸9ñ«z ¹tè°øèH¸þ®í÷ šAtfƒÃôìÕtSD÷) âàv·Ü’‰“C½kBâ*ǶW=7Ö†…B¨&XÓ!Üä¾ÖJÚ3È'Çí§uÖ㚪bw¸Ã¶È‰a1cªÜàÒx‡å¶G:Ô;O;éæðXíñ8ÖÜfC6¦¨íÌ i:¡hé¹Ù ËI3 +ÅfÔ,·9ßf¥! }“Ôß̉oÐ+ÞuwzaÈ÷ÀbœàçàxPÊ6È'å» ¨#SÑÛ\…œ%µ\È`c„ؤh”zJß¾«p˜ 7ÃMƒéxÝ>茈8`{~¸QÙ™pÛ ÍñÁŠJè_I×ÛÃN•ºaî­÷Ãȵ®'^g‚ÔU©–ƒü,W]¡‡yRüÓÞqæ“;Qh«õ b¦ÈÖ —(Y™?+J»*^å@tD”Bô’(-hDùt½IQŽÖ{׎̂ñš¥ÍÆI®Öäéž“ŒRn¨$3‘Œ½$™c É<]oR2£õö•Œü²²ï&´ p ò"Ѷ˶¬g;N¢1€ž}D¥Ë¾SH’Fô0Áão´áùážÄúáDG„+D/ ÷Ø‚F¸O×›îh½o1Õ +ɸŠ{\ÉÖÖt-–UIgPqðrÑp·C*ù9‘yĤ/‰l :"2!zIdÇ4"{ºÞ¤ÈFë]•Õ T¾ú&V?gßßuÉ­™ˆë#׋¢YµOlk>_ë7Á?$sÞïgÐùR4ô•7üh=ñ>®ÓÑ¥¸¨;óâÏ)eâlŠ5í¹ž8óÙÓ R³¡ðનÄ>å¤à\8|Uðhoµ}ë!_)GJc%&£t&çûT’ʳÏ)o²…d üÄ„Ã|˜»¬DqÓ§¹8o¿‚Æl+è’µ’æx.@Î÷òe‡‘ˆŠÝ$2‚ƒˆ+D?3œ÷;t ÁD õDv°ÞDTEQNúYgﮯ2^õÜ~Š‰Ä=CøÇÄT©fž¢ïm,³šÂQÀapîþÜlpEú¶ÁŒwâ9—èdu1%§8pušþ¹IGسfò ×&íÕ{§zÌøSt \QÀ‚$Ø›æSC:*$åȉR¡PyÊ©qÐS§6.¤ÒQ›­8èò‚ßV&°8Ý»[Ò+Ô Jã–’@ 6Ø@ÒªzÍ îñdXyNïÙ»‡ˆ¬yb‡ýTã`âÒr½ÇƒÚÞæ½åUÂé”/zÀY3çé7ö6ŽÊªS!Ìn$•¨ÃXK’A 8ñ$ßõ}#œ7CþBò(“É#ísd€ßÿP’¦ç +%G8­‘hçÝNšé.®³z‰OÈxâv•¬ôµ )5ì¡\4îgø°gÃRë²UÁóváÓS4ÓüHÐyS™›çž¥G +¤k|Ï(l¾~ˆ‡é?Ö Ë»%kï:Ž¦4Dˆ#·A)=ŽíL.P…'ö1ؼ?Úœo?ʨéqR™rþf®ûÒfîxÆO6S˜‹c¶bêéäÖZ«s@ž“IËòZBGC·ÎúCÏçô³à=…Õ÷xD¶)ë³ÓÑCwñÄžw½ýYNi’Íf+Ù( áÝç/†7)0d%IO•Žö õâšäRP^J$Ú£æT´E­§ï‹ûr)ôŸ†ç™ÂäDµ+Nl· ëÙèPPCGûÒFuK|ç}#/ÏáÑ-˜j–Ó£à»0éRókè ¦¾òsG)ñÿÓDðÃèPM‰/[V¿J›~sWàF§S¾%üg~ÿÒïQí»½†XH¥Ójnà^èwqú”_pÕÀ‹U‡ ÿ¡)nÖendstream +endobj +5000 0 obj << +/Type /Page +/Contents 5001 0 R +/Resources 4999 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4982 0 R >> endobj -1953 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 570.242 512.306 579.265] -/Subtype /Link -/A << /S /GoTo /D (subsection.23.1.4) >> +5002 0 obj << +/D [5000 0 R /XYZ 85.039 781.388 null] >> endobj -1954 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 556.693 512.306 565.716] -/Subtype /Link -/A << /S /GoTo /D (section.23.2) >> +1226 0 obj << +/D [5000 0 R /XYZ 85.039 625.193 null] >> endobj -1955 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 543.144 512.306 552.167] -/Subtype /Link -/A << /S /GoTo /D (subsection.23.2.1) >> +5003 0 obj << +/D [5000 0 R /XYZ 85.039 581.115 null] >> endobj -1956 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 529.595 512.306 538.618] -/Subtype /Link -/A << /S /GoTo /D (subsection.23.2.2) >> +1230 0 obj << +/D [5000 0 R /XYZ 85.039 526.667 null] >> endobj -1957 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 516.046 512.306 525.068] -/Subtype /Link -/A << /S /GoTo /D (subsection.23.2.3) >> +5004 0 obj << +/D [5000 0 R /XYZ 85.039 507.795 null] >> endobj -1958 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 502.496 512.306 511.519] -/Subtype /Link -/A << /S /GoTo /D (subsection.23.2.4) >> +4999 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F56 2890 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1959 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 488.947 512.306 497.97] -/Subtype /Link -/A << /S /GoTo /D (subsection.23.2.5) >> +5007 0 obj << +/Length 4267 +/Filter /FlateDecode +>> +stream +xÚ¥[Y“Û6~Ÿ_1;µUæTÍ0$Á3ûò‘8Îú˜µ•Ên%y EJbY"’òxö×o_A‘’¶R@Ýh4¾n4`ÿÚƒÿüë4r=•]'©ïª4½^ë5´¼¾ò…â^Hî-š‹«ï~ŠÃkßs3/»^¬†q"7ŒÔõ¢øÝyùóó‡Åoï•RŽŸº·÷I’:/ß>ÿtë;ŸÞ¼|þ›Bç>?¾y¿¸½÷7ï_3=ÒüúððÛnSå,nÿ\ürõãˆe‚Êô×Õïz×ÈÿË•çª,½~„²çúм»¡Ü(Tò½½útõ/3·…×ÜkNšâÞÏÜ,ˆÎ«)öÝ0VFM´únE¨&ß\å×I乑’ž@5 ß @CQä9o üîáÃÇÅmæ;ÏߣZ­Ä±ó©Ä¯¾¯€¤Æâšë_a¹üŠÕË«ç]¿žSPKÇdMÍmuùÈ…‡¶ªû²íN)7L]?ÉÎOw ¡éú‘efºAÆU0Ý7(Dê9M[”-Wrüñ} ©êÛ uzMÓ7Üöùö>Hœd8=е‡-ü}âÖ;œrþJÛR÷‘„"çá~ƒá}§h°å±ãÑÞ/¾ þùÝ¿˜b¹­Já*²À©za‡•‡®G¥.î}´ žÛž„kH‚ŽÖª£ò÷Ç +ÖŠ‰³ÌMƒ`VÚæÞ"bÛÏR7Nb3Šñ‡ç'Ž*t}už!“Lù–Ten”F#~ ÓЯ·Qää¸Uì"b«§JÜ0ã.¯ÀZ—·‘+¼ƒ^ ~%w1#7‰éº.ë²Í{Roœ#³À(E¿)¹P´¸¾bѶ\½BNíí¾å-EgÿáEÚI * k¢Yë®üE{tç)ØþȶÕaŽˆ¶Ï÷Útix¬ëªÿÒç6$Õ°(9xEÛšóºàBµ‡=ø7ÆЮPa@^ÿn >euIà&AxÁê¢3V'D—¬îCmuÇüf­Îâ—ó<—¨®f·ßjÕõ¥Ñ šÕŒ5¦¡{±˜”à G©óŠÐç+&Î+X”³„-ejÞ,• +Ü1ÉÔP\¼¶b³l]¶žÀƒ1ÁgÜû±©”qræiÀ + a£M«›šç¨'HuýFë £–Щ:ù­—¨¢²/Á:‚(4¤ØHÜ™žt\æ5½o2ß!–zHïmÉpÇ_4.÷Å£öÕ0¿±o¿§¿zÛ.í]ƒêýpz»×§1ùlÓÒãÞDq›¶“n$Z.à{Çàr@]µe^¯€×9.ôç|]rO…ЩžÄš«´Lùv+\šv¬8bJ‹U,\i»†ˆ=ÑKÃ5hZ½å–"gOã@9å=ŽÎësþ!ݶl:¤ô^Zñ¯ØŽ!C‹”ì×Ø ÇyÜ”µ ŒvÅ6»Û÷ßH¨ÆI‡¢‹sLO9xÁÄAuæ3~°ë›–‚ŽÌÇê3gp¤™å0šš1ÚHÕX°5§DÊVÛ+ö·öt¡¥[5æƒ{aceæaÀ\8-^½`Š"ïÉRòŽí|:Atp:†eCCà»)DEžPG^Ýï%Ørûâó ˜@@•y©ô¸›2vcãë¼Û×Óƒ%!„áá…Á4ú‘`à=N!Ö('^e:Û|†– â¹Ý)ÉÌHèªþTýÑ‚#[GÏb Óà7BS’¡êž‚7Úþ\ñˆ6Ùàš×t=t^QÃ$€Ì/xi«%˜ÙÓm¢}_kÌñ‰”ß ;’j866Jx•²%ñƒ}Î,À=L ÀÓ>ÇŽU‚0Cß“3yä9òÉNo+h€ÜS”€} <-N¯Ãª\5ÂvÝ–Ëöãš¿Ú¶¥@dÆà4 +bÝyIЭÀ £¢©¯ò­D6Å +iC ÿ†ý߉ӑÀû¦À=lÏqUi‘ð€äƒ¦_Qh툘CHZ)BÄZ|àu¬sl|e;b©"}c’m°9le B• +熪{âÃq§BÒôüë1Å í¸T˜ Èš‘Ñ„Ú‚Úã¨U…AH¿¡ _h ØaS¶å÷`¹q6ù#­h¦ÅÉ°×À­ÇÑ©J‰]¾…@¢'®„Ž¡î0@ *Ýz³Kõ‡H0žº-PP¡¼·g‹½=Å’Àï•€m°¯v\ªv;±%п =ŸùRE \üÏ|’ã…ŒExPryX/< +”ˆÇ°¸D¾)Y¿AÅD? ãÈYlªÓSô3Ë@ØuK”ˆ¢‹rXb´/ð©&Z„^ùr©ã `U‘Ïó3GG8Ö(Žì¸½-É¿6½ñ2ž Php S.ø‹¶E'p(_€ÎÀb"P3>zÅé|É"%º­º¥†ë$,gI]ŒBâZ‹ûí–êöëäkÜ ù~Ó±«°á”ÑäFo!¡DÊ ž›ÈA=A„¦ø Ì2çYË +Oa<‡'H5†}äA‹ŠMM-9üøLdÒÉ`_ºYΦÿã`šŠÙàÝI¿AK‡„,ZÓs ƒƒì¾8ÂP—Ïù53¨Ìè’‘ÒGÍ¡cÇ|©„ ’•ÃÎxµÂˆë°[øzž¤ºiÍj,{];b>¸Mj!ì™ÚWùÇ8 Ajš²$Ž£TãC¦°\kkQ7ë£Q$ÐwËJ"\å†Ò‚˜³tœ+Vò †©q=°À¶\‚°ÒpêIsù#Že9T¡ÝŽä×Á‡c¯vu¸+ý„³S¾Á¹Ž;ÆøAkItSoæ åû_ß¾å4­Ç ì ൑ž2M+rþ¥lYz9JMçˉ¿ ù ¨ˆi.)Å2Ã0p~Âx iûð}i¢8‹Ã ˆ'B{ª@¶ZzmbÓBþ…$0>bÇÜ·æàÅÍ%ÿ0“:ÂúW#»›Î]bØ|©6œº4Ïpn1¹8p×µAW8%¼ŒÀ7.t7ñ=•ÉPàø<˼î˜uÕEs8ÄŒ(^èì`¢Æj·'Ä +Ñï 0Ñyl] +™‰C9{‘ë†Iz•¶;§Wa(þÕaI(g€Rò-í³ŽkG©âáô»08 |nÀY™ˆ1¡»™óiusXãVŠÖüá#uĉëŠãCK€™9Ž’vLBó ¡dœ\¹Qצ¼9˜fÁô »Bñ\¤/­ô DØ[‡Á!víx>V¬4‹²#Jñ—#81€üÈßæ0å£Ãx,"!à º[êÓøø­çÌ6Êð,#Po+˜±ÂXÍn3°Ï£Ëty'WLzÖæT­¨¥¤ØNÙ¸Â}eÇY:,^ „( Bqå–ÑúÉJ#®D'o§ÀË»aœœ¿'°ˆNßh¢ ÷gÊ=Á„ßÜ=ÍïEk–À8YDJOá­ Š­k÷â6Z"º üÓ~áËTnÄõYo>c¼æÓn.Ñß“÷/ +Óý~zA¯Ñ½ +Ñ%½žc¨õzÌoV¯¿Ÿ*³®P¹¶ãPêFOé$HWÅÙyXD§u¢‰.èä,CÑÉ„ßœNl~FˆH—@æ”;ÍÊÐ%Õ<,=ëfŒÓ‚é¥UÇ®T€6†Èƒšoe7wa»‘ÉJ¯(XœY’D¹é…»éæÌ‚0Í¥õ8ÃM/dzÙÕ˜ý\­Ñ*·ø3 Ÿm©vp[Xø{„É•$,†´hGaÃ)½Åž\@ÍæŒÞ˜æ’ÞÎpÓz;b6«·ÙG­°{ðÆAGÉFé©7’á™ñ‰ÒòèO!„Þñª¤·€"ßš€˜N&Rm2)ø¹M}7sÞhÅ-ÖØ _ço·Vð]ˆ°&’JmN‡A¨e0"?—Ÿ­è^õ™•Íâõ^êYíåˆA²S ”ë'—¶Î@tÆ„è’œc¨­à˜ß¬XüžëXgZâTÖ¨é{ =‚X®ˆHn  nÙÈú&#ì†Àû€5z-ôÆÞ^…YhðÃ"åSXTvødÊ¥?s·LL9¶®ßªó4óàÉ NŠ{ï±ØPÜÛÊÛŽ Ž\ºœŸäñgDNÝÄßnõ! _­tVÐ §êÄy¬O'·æ¢¶·ã º;·Gý,p£K`,¢Ó{T]Ø£gÊð›Û£6¿×¨£Ô2µÊ0s“D_¼>/¾æôxp9ä„fl3p½Ì—.|þsœÌHÉ=×Ã8pà ´•ù'‹«ü°í;ÚÉîÉ…JR7K¢ 5Y(!º´Pçê…:æ7»P¿—V’B…Ú|•sóÀïWz:ÂWý~-¶.í‘ð–ï¬Õ¾y‹aŸœO—¹œo¸£¼]3¯Æ¬óöÙ}hñuDgÔ-D—Ô}Ž¡V÷1¿YuøEÞ‡¤Mñ9 i!Iœ]nå%’ £¼T€f§oÅ|8Mú‘y±ÇìÓtÇÀ¬3¥mÞ\ôå5=»Á±%¼é‡PÅœñ†|á½ß[ïHªˆ'f‘¤üÌÁÎôå:$m…ÊõÒd Èõ\.%5l4Õù´ui[Z†C©vz.Á ƒ¡ßG*Á]ØÊæmǬ©ÔUÁ…Ó¯EtÆÀ„è’c¨ ì˜ß¬YüèJ¥ß’‰~&–„UüfŒ˜ý_GïÄFQ1=@ÛKøÉZæg˜•gnôî„_ `Mß0IèR¥õ2®àlÕZ¹ì0ó¢j’·+šñðÔËùÒ¤ø[Š:|EFïÍÙÐ Ó{zW†%6a¾ïK$CË›.(¬=…7òV}” Â´ðQ’“–H¤Àb;;m?¹“oË]^Õfaæ‹ïÀ¡TÛ 2Rº¼Eòc8̇£—˜tÅb:YAò`qhõÝp {¦ãÂ4ù[pg}zB¢ã̶τIa.+ñ›.7Byw„cÙÚ£ %~ä¼;ýÈ’nF> endobj -1960 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 464.489 512.306 474.057] -/Subtype /Link -/A << /S /GoTo /D (chapter.24) >> +5008 0 obj << +/D [5006 0 R /XYZ 85.039 781.388 null] >> endobj -1961 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 450.94 512.306 459.963] -/Subtype /Link -/A << /S /GoTo /D (section.24.1) >> +1234 0 obj << +/D [5006 0 R /XYZ 85.039 761.463 null] >> endobj -1962 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 437.39 512.306 446.413] -/Subtype /Link -/A << /S /GoTo /D (section.24.2) >> +5009 0 obj << +/D [5006 0 R /XYZ 85.039 741.134 null] >> endobj -1963 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 423.841 512.306 432.864] -/Subtype /Link -/A << /S /GoTo /D (section.24.3) >> +5005 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1964 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 410.292 512.306 419.315] -/Subtype /Link -/A << /S /GoTo /D (section.24.4) >> +5012 0 obj << +/Length 3762 +/Filter /FlateDecode +>> +stream +xÚ¥ÙrÜÆñ_±¥J•°U\ .ù!¡ŽØtt0";eûÜÅ’ˆ°ÀÀŠb¾>}Í`° J.…9zfzúîžU‹þ©EûA”/ÒLùQ–-Ö»³`q3?œ)X ÈÊyysöÝß½PŸùâf;îû:Ž7›ß¼W?^\ݼù¸\EQä©Ì_®Ò4ó^½½¸^*ïúòÕÅ[œÒÞt?^¾¿Y®”wùþ†G˜Ÿ¯®>àÜ2‹¼›å7?½¹±hÙ…qúïÙo‹ àÿÓYàGy¶x€và+˜ÞR~¬#é×g×gÿ´[ñœ^ðª9ÄQæÇYtJ;4P*ô#.Ò8ðã@ŠõïUöø_5wp=xÃ}‰"&ÎIì§QGâʺ]ÆÊ[/ãÐ+pqÍ ÂÀYj?ÒfÁUW5CÙõ 7ÁL‡@¤\à¶m TÝ”¢¢¼¡]®ÂÔk¹WmÁÇe˜yí‹”Ø&\pþºØ!ÄmÁ{€ãqhà¯Øì`„š‡¾Ä+t :I¼¿#GqÏv‡È.V*Šü ‹±œÈ ͦÅÝXÚ†¿{\%çÀGyw,Cý=à +4Ú0Øaß}â^Ñ3PùeOW%\Ö}6°Ê'$„Z. +Î%C$CÝ#­€tôš¹¢¼Ã†É æi'ž—ÝgD™¥€§kþw/k†Þ]±+«Ž‡ð@a\iÚâÌ7Žf>ïÇÌ àܶ•ýîʦì +C8¦¼së˜%ˆ•& [{@”¦Þëòsµ.¹ýŽEf#]Ú×ÈR—I%òÍÏc¤pØ À{6vHŠÞªöQ4¥É«¶iÊõàûƳI¨Lš˜‰,\æ}hȵ©”ù††;ë–L&7l“ÇÑ#ÀïAL˜(QÉ(L†¶´x‚vlM@E'hCTLî¶æ^Á÷^·Í¦ÊFa@ 8È~k:“|¹ÜÌ%‡,:Ô‹OÂ!S„‚ƒ;¦=™|:xSNd¤Ò[¸ +%¿§’ÆãÄë–—‰×îRJ6·¡%º¤[²ôÃèïÒÍصʘ7#ufÝ‘<¡™­š‰¹]Z[Ì"Y™ýxÕ4~+7TÆÄ×VÙQÎä*Ëü££ˆœŒ${ + +Å—r.RÏ?NO"uŽP#L£v£µc(Mq:ÐfM’”GÙæÞd˜1ñLÃ]¡EǽZn5#û +Bóãé(äaƒÜ܈UcæV™Ÿè¹üp½EÿÈmÏØØ>•Ì…iín‡G3Mbí§Ø¹b`8ö ¹óµ‘èœÃ Ž<û/$4dñQ” ä¯Wø áέUɾ7¾°mŠÚ +‹‘‘—þÅSEw Œ(ÂB ,Œ +Ð 5' +ý ¹×óë,k4@פ$Ý°> 'N5Ìs?„“bÈã8ýv6ùa:Ÿ ¯Ì^+g³S÷¡nΞˆwûH±úë·oùZW”æÞ`]]r?-î…ÎKÔ”nlV ;Ö-.gÎOr û2k{žÂ¢®µ9å•1è.Ë‚?Ç-ð=dEº¶>áQÔB穯ãüÏñHöZ9›ò(Œ?[d€fxôîâò½ÿêJz Çl\•:23˜¾³ùk¸ãØNŠª’t4×If\(p u¾çÁ²,;Þ¦jújSòúb®ÒÆ>˜1!¯?àÒkŒº4ºZ°§-Õ/sþ>Bûõ0D¦µL°?E!|­"Ù IÄŠ@~ƒlªåpé +J*!ð7‰$‘$J6D—WšúÚ›)‡Â+©Å)BIæ‡Êäz(Ý0sP˜SIp7rì`B¤™]ÇðÍã¯FèÌÓé‡ÖÊW:¤ZÒ È$Ñ¢ûxìÙ;î P‰8:JR"K׳‰‰Dzì ae!Ž¶C§' “dHâòlONóPÿMFƒÅ*|ö9¢ì›Ù˜ót¢ÔŠ+¤ÛÁQƒ(ʲD¥eYu¹á9›©jÐ(б¹ N³9œ‚¹U:˜’h}² CX!v«¡çÆon,õ—?dƒû¢+Ï+„81‰€O-éqÉ@!1Z"Rèõ‡ŽZí·&!4O"@ë$Bb7ìSèÀ™g áÖ èÉÓŒ Ë;)Öè©@Pyï\á9ªpoʆò¾Ààœâ˜« :Ö6àêËzËSXÁï-^¯BÅG8¹;Î#'ž“×ÂÌ ` ²‹FÐùÆŽ`§Ðù°— zþÕAfØI¥].iíÝî_]‰ÿÅKbd5ÕGÝXsÁ¿8V:£,˜HÐÎY­30+ˆÕÎ}—P`û°}HLmzrb¤}0î_=ANÏ›¨y”û1„Ëîy¨} ï’k\>ʬeÅ­W›™6 ï¢ +,¾ ˆ¾£‚M9çYÀ"ÙuÄŒ ôá‘Ï­ÎÌŠºúŸ);à8Z¶%/:­Cð8×Ï`Å4ŸÍDª¾Š èÅÊXP´xT’ŠÊf+’%rtÎùÇÅð¤ˆD Äù7DdúŠˆзDäk9>oVDœóF£M«Ôзo+TÅ‘Þ#†ª¹ëyê×:=Êsaप À¶ ó•Ñ¡±¥E“Ð ‡]‹ki7òL†»‚ø†9[!6Áñ’`nÊ=Ü—æ1(¡¿q”±è“ Ü„ °U9lÛZQÑÜïBSÝÅû=ëTÊêЬ ŠI$×…¤Îçæ$c>¥uªµa¢!0E€‹ýÞÔ¾çb³Ô´‰Íä Nqß÷ec/˜siîJîWƒ„Ÿ‘éäç¶ `*±ÝUƒv½¡ípÔTë-¡Ec¶& —MqX„XM†óRøâ—%*¿»}]Råo,µÐWRŸÜ›2ž-p”û™ò½}­«Ðœ†‰×“åŠàZ==áÀ¸›Snd¡Ÿ)c ß’ý~™›•U’;ìÀ‚s!Œ†Óì«(¶I‡â` ÍÝ 2J¥¾²õ =ƒ\:±õÁ€$WJ©EŸ:…8ëØ)étŽt‹éB3ã{ÚÎ장~j_æöÆßµ“>• ç•þsP£gª€§ÓgngÎÓSœË´MTû,§&¡È<—'Ï{»vžgVû‚k•RÊÞ|ÏØT±Ü»çQ$xŽÕõ@l§/g ,”Ü—ˆ±¼ßŸ?)²5Ø—ž<’𨀠+S·´lsôß ¯éDü%ä¥XF™«£ä¹ŸFF0øù(Gq”²viˆx²çÖ«É ¹ hü§½t÷ò +ÞsŸ”%×3ÏaÎZ)OÛ‘yÜØ…RSËü,Οø9îž*Ñ„iÀÇð«'7®½‹z,4ÄÈ/IQÊÎÙJ˜F`ņ7Å÷<ÒèT9.; Æv¦?BIåY”“PaL¤Dl.{¤HõäéýÔÛP–)™äVÊaÂ,[‰_ÎñÞ“?âyoŠ}aªŽï³8h‚>ônµ'ÅL7u[l–ãÃmfì|šZ8~9Bö?zxžÌõÅNZTš.¬„c™—&ó9—$Îü†çª­Šqž“>© ôž“~ÍåŠà½ó± + ~vÅ¡÷P™÷}èLÀ#ÌhôV6°7iš6z†›uÄ#”·Ãb`x—ôGlWõ½YP™=Y¨÷ðçlNIÙäJ®Ü•’½œÔÔT„†I›îñ™…ÕD‚õI’`j?æL,…:;Ͳ¦’Ã¥‘,ñ^äŽ ˆ½ãÛ°³c…fK%0K‘L€l BfD²’¢n|ë>Ò´ïWÄÐù’føál,d‹?õ«J§,êgѹp†~¨ .\">Á×üúòáÿ΂N“endstream +endobj +5011 0 obj << +/Type /Page +/Contents 5012 0 R +/Resources 5010 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5016 0 R >> endobj -1965 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 396.743 512.306 405.766] -/Subtype /Link -/A << /S /GoTo /D (section.24.5) >> +5013 0 obj << +/D [5011 0 R /XYZ 85.039 781.388 null] >> endobj -1966 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 383.194 512.306 392.217] -/Subtype /Link -/A << /S /GoTo /D (section.24.6) >> +1238 0 obj << +/D [5011 0 R /XYZ 85.039 651.823 null] >> endobj -1967 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 369.645 512.306 378.667] -/Subtype /Link -/A << /S /GoTo /D (section.24.7) >> +5014 0 obj << +/D [5011 0 R /XYZ 85.039 632.951 null] >> endobj -1968 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 345.186 512.306 354.754] -/Subtype /Link -/A << /S /GoTo /D (chapter.25) >> +1242 0 obj << +/D [5011 0 R /XYZ 85.039 455.095 null] >> endobj -1969 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 331.637 512.306 340.66] -/Subtype /Link -/A << /S /GoTo /D (section.25.1) >> +5015 0 obj << +/D [5011 0 R /XYZ 85.039 431.777 null] >> endobj -1970 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 318.088 512.306 327.111] -/Subtype /Link -/A << /S /GoTo /D (section.25.2) >> +5010 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F14 2895 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1971 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 304.539 512.306 313.561] -/Subtype /Link -/A << /S /GoTo /D (section.25.3) >> +5019 0 obj << +/Length 4263 +/Filter /FlateDecode +>> +stream +xÚÍ]sÛ6òÝ¿ÂõKè™% ~æ¥ã$mâ6Ó¸oÚ›¶3GK´ÄF"]’²ëûõ·_A‹¢¯Ó{¸é4Àv±ØoÀÁ©ÿ§Y¬|Ÿ¦Y t–.w'þé¾¼; b! æõõÉ—ß$Ñià«ÜÏO¯o‡ubÅúôzõ‹÷æýÅÕõ×?ž/´Ö^©óEšfÞ›ŸÎïÓ囋ø)ò® ûãå÷×ç‹À»üþÃ#Ì?®®>â·óL{×ç¿]{òõµ%Ë"r¤é“_~óOW@ÿ·'¾Òyvúm_ðywD©8ÒÒßž|:ùÁ.ÅߢSž5űr•‡ñ<›’@E‰¶l +ák¤t” ›‚ T:OÓØW±Ÿ€590'Žrï#ò ß”-0!I½wM¿Üݱ­Ë³Ä 0DL;gf‰ Ä!óOdv³¶# aâ­°YÝŸ‡™WÊPC6SjÖ]_l·å +öE¡wÙã§Ø«:†nKÜTë<òÈ-4›wB”¸e‰òs8"媩êç¾@$çz/®Z£™£­$‰Š¢X&V5¬,¶ÐÜ}ÕÔLÕ nDèè7ð±äöÁ· :ë‡}âŠÍ94b?]„q¨bäp€’‘xw¸±0T‘Ÿ +y»âqb¡VQ dS ~f:êCèõ-PPm+½5üeŤeÞÛh +)jiì;Y§êù·±;”e±ßì[†ÿÕ¢Ör‘ǦYDŸvtÄKÙ÷[Í„‘dDÞë}ÏÌ‹b•…̺˜öû€`EÕ+… Àæ-¡è_0 a×> ;Â,2Ôr§Xþ±/H‰$äNãé>pŒøTáÖ72ŸnÍθßWw}Äœ¤QÒ‡%ÊÂç:‡ ¤â×ÇäˆL‡ƒ¸Ý£P²ù#úæ @3Hˆ”?‹Áìx ’Üëö8t‡ëy žk霊"Qá?õ‹žGvE]¬Kn£ààï1¥°:2¹¼-ˆÂž¾Ÿñ(ê!Û籘ž Ó‘ÓHdê{lµžì¯XÝ#eŒ%3ˆQYá×QFhßµåRNÀ뵌B§h‹u[`kÓ}˜tî]Ô²’#ÁÐ#‰g’:žOòÛìî¶"+4XÜS˜Öó´ûó8,ˆ·ÙËĪ#Š÷F>¦¶ö«ûݞĤJGÄø ½Á´ŸÐ2àæ"@\Z-(ÒâHÏ;tظ+îˆ<Ù +Í HÜÁ¿i +Þ6-7ÊÂ¥á÷æF¾ãQ5;î|`åÂ#¬1€æEÄ´"¹8†(…¾DÑà·ý/º¾iKöí¤f_¼îG¼XÎ'K潘c]j r4ƒK‚X%‘ëR/@¿ûÞ§²ïYŽÀ«¾E'[&;‚1ö+ÐLØß¡Çèxà¶9×¾'.™o¶dkYàmkŽå¾ly오ƒ|~¯Ìqç-ܾ&Š2ts]Ï­nìÃJã–FbfW­7Æ‚C÷ÆÈvî«’Ž˜t4óÅb"·6fòŸæÛ-‹3ù…zÝ™ÕÄËf"¯ÍN–6j)€VÀ2 vUÝMYHØ,-yh.Æ^ÙÌ£öî×ë-“¨E9 ±áÀ¦cà÷á^6û-ÛQüØ’upÑ=ƒÜem*ë!Éé ?[™`ŒoµÒ!ÖÑ~`k‰‘(wƒýLÙ€À·á àˆ;lK›L +ÑÌrAÎŽ ?¥ŽÑ‚€_è‡U(`·V;ûŠ ÝîË¥``í,+Ö<åðF+ü +×MÄ#°ª2f‡ŒÄõ·}µèÁ|³ìfÌ$cŸQl›5w +tÄiŠ_×àL÷ìJñã欹e)jvk%ðHær[Q¤óÙ (eq’ ‰AZ«‹|e™‚ŸìÖ°x)á,Ú4«ç¾]µ Rðm_•Ú5¥¦bàr›@"Htþ'é,÷–î/÷Ù¿µƒãPÏ¿=G’8‹(ŽpìIeìÄüÒÔ¶a™ÿÌç ÈVtÐá¸%$Äp ¨v<0ƒ4!Ê^܃¤òåÃí·†àGâbü¢D'B"Q [„Æ,|´ +RÓ¢mÃé+Ü5DršÖlK£ÙIšMºöØaŽ šñž'¢”Ór³’ÙÆ…¨ÛU?%åEÝ=XÍm9%æ€_‹ÀAãìSAÚpC¦†ÞÒ««<6²Wv¹O†cdxø›ó €¡8{Åb’4n¹Ô^bО¡|½8»]) }!B ÷ør΃ãÍž;¬C,m˜õð¼Æ¸cì5§e·,FÔ¿"¡M¨ù÷§ª¿C¨/¾ú‚%k‚üŸ6ç”QP[7ýWÓÊ•D¡(×{“oé,ae*¹í¨[ì­ký WÁ²‹ÄYØ£ÕsÏVxÀÕšZ&9²…©¢ü(ñ} +7+™K–¦ZžÅž{Ú¬¤P´@”Œšá®cã¤+$Ü£b€ƒèÙE®7Ë!q€Þ˜Ý×gš'Õ_K¶ÇÃ#¤³0ë¦5¢ˆ½A­}ÉZ|ò±¼>¥öÍZ+˜zëö˜šÜŒ/Ð]#^БÕ!¥aÆFé°ö‘B">etŠqê]€U8ô^­Q°’gKÈ(N•>R_eq.d‚92›ÏSu‚Pù™©ؤ ŒNG®†½3ò‘*LLS Í­¡¢ˆ *t¦üÀøQQvÓÕŠ¬Ã=lÈ{èÔž —Ž#•>Qµê0(]©©S:bsh—;rÒÈ‘¶G\5AT+ËÁAa×NÊ=>Ò܉˜0‹\'²‘…EOq#|äß <ñàáÍ´QÌZu}k¦ ˆV¦Ê’K Ä ä"× }cqãPÌ0®¸mcf©£¼·Šm²¬Ž7¶JÅ/yØ +"yÁ† Ò´_YÁSä¿üþ|Å¿W4ÏÖG:›‚6u±}õ4ÙÉs8»ø4‚|,ƒÉdG@Ìt²“@`€?O‘!èMªg±˜gÐA’©Ãt„Žs+àxë–2,èŸ;}Ær õ«Cea’·4ªŒ}¶a’:â 4Ú‡4žuÌ”ƒÐ*ˆ†…¯9ˆ9lÖAÌ£3§í ³¢+EÒW|óqö`|ô_s°–JÂä¡€fÈ Y'1‹Î +å,:#”ºÿ'ÊOŸãã4ÃGšwsè,gÑ>:è&DùZí0Kím ¶ïZç +¬å±c~-zªÿ[?¡ƒˆCB¼D¡‚ÙqW¡ÁÃé‘«@: +{–NÔ¿h¸ªyk½ÙÏR®(Kë1 ïôó¿ã1Fu´c’BXž§Ù¼ä8@Ç%Çͺ…YtFræщä¸èÞ85JÙ€þ¨‚Gɬv½+k>zpŠ¨(3WíX€=ÆÇÌWQ˜?ÃÇh†„££|œCgù8‹ÎðÑA7ÏGÃêÛ¾ïáÓ![óTÅiò?‹XÂ$QÙs’iafÊ0HT|”Ÿ3¸,;çpn¸.˜yuù`â)ˆHÖÉÕù²6yîw\=¹3!ÜLx*8œÚ4ͬ¥dzS §h +©ÑèùrÙX“Ü“<Ï^& bÂX+­gc˜d:ÇÍÁB ‰Ü±f• `fq™ÓpÙð…ãÅvõrTb†šëfÑYõEgô×AçXÃ(ð9wôssQ÷Ô¥D +±}«{.Ü-ß_Mð@lôÀw{XiN#±÷»ÝŽó ²‘0)È-“@KÊ#µGÒkS{GBé~ÏÞµ|k,•Êrų?îqÊÙK¾ƒ.šj¹2ãBæHÀ‹VndêƦDëu¹WÕ +‘Àb\Õ­2’°ck£Í~-C|u_ÙÇ@ë²ãk$¹‰ËHKV(ÐÏ$¹Ðq¹3@³qð,:#wóèDî\t+š™t»oɳÐÅSGâ4u¡ø¾Òq&ëÜ }#??Çî,Vqö» v Ðlð8‹Î²{a·ƒî£u£æzçÛÃÐg|Y µó„Ž€‹›N\Š½óµ‰Œ[i;<Ê Ï@çfÌÈñëpðr¾þK‡—†Ê×ñ3‡7ÍžÍF¬³èìáÍ¢3‡ç Ã LÝè$ ïLhºGºÜz(~ñ¦ÙŸÉ† à¿È’ÛK‰à•ñùòKNgÞð,[9Þ‰ø£åS>tñg¯U|&ö@lèÊ‚>“ºA¤|àÖ"HT¬9}Kwˆ±{±›G5ØI‘Ç/w˜K¢â¦[OcFRO¼àA(OâëÅ$¡Û`3ÞðkM˜ZVÈDtq‰o/›ñ¸Æ׺/Þh7µ¼Íà—Be¤å˜<蔳‘g¥«œ ÆoJGoFV2&kYç…qÈ…Hߨ@™Ç3 ý€Sä‚ §Œ9š×ÄõXvœ uäÁ…So'Ì&øŽ^þuÜ{Ø°ÊqÄÒ‘Ð+š[„.íÛ5ùÌ z²@Od]~“#µÃ¾}UÒí]‹^Þò§»‰/Aµ½$Osx¸½å¶’ÛtTÇXžÂï“Gãøe# ~¶“Þˆ|:;/ˆÄƒ$ÊG^«=–n½tñõåPX˜_ºd¥;Rû'ã·NçÙ·:æÂCg<“›æ×DÛOj[à/2ãúo¨²…‡‡Æ»Œ ¨UQðºGž¹ã§«")WS¬:~gõ ¯zßÚ­¾ 6:C(dWÛ¢w'ŠE§@æ6ý*ª¢)©ü-@=ÁªŸ™jݧ—í‚Ò)¾WÂLÂ"y>4U†Í"ôZþŠ¢ÚÛ†Þƒñõ³ ¾uæ°ŸÈñ;1~ˆº¢7—ÓêƒÛ¬\Å¡) _LFh›„†šé?)‰Tì› ¯'׈Uš›5ÌsðÁÀ`hÈa6Z.¹{³OÍU>Vm1|½uèø +l° /'YŽ¯’Pø (ô}Ÿ[¦VŠíŸ¨»²|`¼—ðºÃò©¿:Ñ™ŠìæŸøDeO«ÈjÃ`$—<§ëùh;shhM8ñìYûjº0ÿ3»þÖŸoÙ§Ó@¦÷@TZøøAqœ¢>$ø?s¡Øéendstream +endobj +5018 0 obj << +/Type /Page +/Contents 5019 0 R +/Resources 5017 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5016 0 R >> endobj -1972 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 290.989 512.306 300.012] -/Subtype /Link -/A << /S /GoTo /D (section.25.4) >> +5020 0 obj << +/D [5018 0 R /XYZ 85.039 781.388 null] >> endobj -1973 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 266.531 512.306 276.099] -/Subtype /Link -/A << /S /GoTo /D (chapter.26) >> +1246 0 obj << +/D [5018 0 R /XYZ 85.039 761.463 null] +>> endobj +5021 0 obj << +/D [5018 0 R /XYZ 85.039 739.701 null] +>> endobj +1250 0 obj << +/D [5018 0 R /XYZ 85.039 626.864 null] +>> endobj +5022 0 obj << +/D [5018 0 R /XYZ 85.039 606.274 null] +>> endobj +5023 0 obj << +/D [5018 0 R /XYZ 85.039 427.349 null] >> endobj -1974 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 252.982 512.306 262.005] -/Subtype /Link -/A << /S /GoTo /D (section.26.1) >> +5024 0 obj << +/D [5018 0 R /XYZ 85.039 413.8 null] >> endobj -1975 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 239.433 512.306 248.456] -/Subtype /Link -/A << /S /GoTo /D (section.26.2) >> +5025 0 obj << +/D [5018 0 R /XYZ 85.039 400.25 null] >> endobj -1976 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 225.883 512.306 234.906] -/Subtype /Link -/A << /S /GoTo /D (section.26.3) >> +5026 0 obj << +/D [5018 0 R /XYZ 85.039 373.152 null] >> endobj -1977 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 212.334 512.306 221.357] -/Subtype /Link -/A << /S /GoTo /D (subsection.26.3.1) >> +5027 0 obj << +/D [5018 0 R /XYZ 85.039 359.603 null] >> endobj -1978 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 198.785 512.306 207.808] -/Subtype /Link -/A << /S /GoTo /D (subsection.26.3.2) >> +5028 0 obj << +/D [5018 0 R /XYZ 85.039 346.054 null] >> endobj -1979 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 185.236 512.306 194.259] -/Subtype /Link -/A << /S /GoTo /D (section.26.4) >> +5029 0 obj << +/D [5018 0 R /XYZ 85.039 332.504 null] >> endobj -1980 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 171.687 512.306 180.71] -/Subtype /Link -/A << /S /GoTo /D (section.26.5) >> +5030 0 obj << +/D [5018 0 R /XYZ 85.039 305.406 null] >> endobj -1981 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [490.587 133.194 512.306 143.488] -/Subtype /Link -/A << /S /GoTo /D (part.4) >> +5031 0 obj << +/D [5018 0 R /XYZ 85.039 293.978 null] >> endobj -1982 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 108.735 512.306 118.303] -/Subtype /Link -/A << /S /GoTo /D (chapter.27) >> +5032 0 obj << +/D [5018 0 R /XYZ 85.039 278.308 null] >> endobj -1983 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 95.186 512.306 104.209] -/Subtype /Link -/A << /S /GoTo /D (section.27.1) >> +5033 0 obj << +/D [5018 0 R /XYZ 85.039 264.758 null] >> endobj -1984 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 81.637 512.306 90.66] -/Subtype /Link -/A << /S /GoTo /D (section.27.2) >> +5034 0 obj << +/D [5018 0 R /XYZ 85.039 237.054 null] >> endobj -1985 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 68.088 512.306 77.11] -/Subtype /Link -/A << /S /GoTo /D (section.27.3) >> +5035 0 obj << +/D [5018 0 R /XYZ 85.039 209.956 null] >> endobj -1986 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 54.538 512.306 63.561] -/Subtype /Link -/A << /S /GoTo /D (section.27.4) >> +5036 0 obj << +/D [5018 0 R /XYZ 85.039 197.012 null] >> endobj -1940 0 obj << -/D [1938 0 R /XYZ 85.039 786.531 null] +5037 0 obj << +/D [5018 0 R /XYZ 85.039 183.463 null] >> endobj -1937 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R >> +5017 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1989 0 obj << -/Length 2082 +5040 0 obj << +/Length 3056 /Filter /FlateDecode >> stream -xÚí\YsÚH~çWðfñ€¢9tí¶w§r°ÆΦ*Ƀk+„¿ÝsŠ/lq˜JU4’F‚鯯»“ºÿHݳM‹ùu×sL›‘zoT³ê¸sR#j†Uç¦åØxëð¼öî/‡Ö‰eú–_?¿SÎûߣ$nPÏÈBy˜4~ž¨ýy^xI“›Üaø–ÿjßZõ>|Їše2ß«ßÀØ2‰ï×G5n3ÓæLkÚßù[ä=^—O•|×&·|øjn½É,Óóxéâ˜Ì—ä+¢VÉŠ¨g6š>7Zq0¼›D băF“9®Ä}9˜$C¸|é8 FÝ@žŒi£IŒ¤‹óÂÑ’T˜ +_E^Lu98;¹çËhßEÔk–EB“º0 &¡¥sf: dFˆÉ©—‹…Øåb! ʹqƒ–Lp‘Š¨‡#8eŒYÓ\#¹ã{<Å}¶e-î»÷ˆ)¯øxÙ½E ”qKx–Jµ Ï‚–êW.aË< -Ðq€ Ã:ª ;'Y0æZ k:øf Àë 8IÉ«Ÿß8Ê’ò˜º8êøù\ÿixL<)T4":¡§Ã+äcjvfwñãn´ÚÀuÿ%Q§à—|’/ ¿Wê~É[˜K¬Ñ¥WQÅ‚F¬M!íõ‘)}¼˜„¨— Ó!ºf\œ}<•p‰»1àm¾¡–U‰á -·“0Ë"Œéó¯0Î!’ðÆÈË4ÉQvÊÁ§N’Á® £I†‘ÂÝ]lH%ØØ -›÷Úµê`ŒR€“’as°pcÈ Ò‰+·ü¦ŒhE (P]Û[…{ú’{ž…hC$‘Jf9Ñ<œ^ŽKR‹®‹Kú9—<•yC*A†ý©¦“’DàH wÓÜú6(4}ý`îçäò$ŒÃ4Pa\D‡K€ºGn-È=3üœ‡‡Ýé,šÃk´Ê38êïáÛXøø¼ S4:iÜSáUSÑٓ駠Ç*AO¶–/ z˜á^¹±foDñœ"Äq‘{a˜ÊàÙ '*£vçßcµ*VŽÂªXYW(mÏu6Û`vC×5±–&÷ËK¾”˜ž&µ9&¦¬¦ð¾ÂÊ\Ï1Zc´¤Þ–b±LŒë6\&Ý.З>Hº—>ŠZ|i­¾éRçaâÍ(¿xS æl•Â7³dòù#¬ÿFfÂÁ±¹¼É3GÇ1:x¡õé°õ‚Y‰½¦¬Ö¯³’VOd ¹7E7ÛE~tÑ]É‹“dšê|E%Ó=•Ç4ò+×Q ÝøÑW·èfWW°cûyvl»¢óó(_,PBœPýîͱþìûή•y9,ßõ׌’ý¨Ih=ªKÓ›³*Íp&Ê´SpV 6®ÅöH”#AŸÀ]4Ä@£áž_ -Ã5²NåÓ/‚í ×»@p,{ã$o­ÉQ=Oðô‘‚ï]#Ÿ¤ÞfÂMÁÀ{´4¤Ï2¬«Yœ·ÐyFWElq)Á ’öÂ66 ééä.îÉÇÌÉúª÷‘±iI¶,~;•@¢‹N_±o¦vÿîŠíÕ:P¶Ò†““¶&ÄA&€\8uw=Eª]P:œŠ&]¿ˆJÑT£8@ÖåFa{û¬v2· -žÅs2|”Œdú -°Ìvxh'6ï×nt" ¸Y†ÏÊÚ¯Äù8Jug·—%ézát<–{2Ò "–mo›r+ êBà36µ¸£¦ØWÍe÷îf¢TA‘’E¿_ Û1‚AX —‚ˉÇa7ÂM7Î\@©2V{UŠ–V(Ú3õ1ÞØ!÷ùvIø‰þ]—œ;héAšýοOTôE#W"•»a€ÌßöØóì^%u;wíep]Š²ÿHž ³¾ÙKâKX¶ë¾•b†WEµóbFk¨»lY(‰ñ¬¬ -ÜUšÝU”)ÛQžGEß~ŠP*×ÙVÉûkÞ,ȬWB‰ĆëÂÆSÇÕÐ`„;U‰Á%„íc<9’'º¾ÝÁýÛMx˜ÉóöñÑË•´ YWI›ä%í6òù Ž‹íÅÜ¥Ÿèð™Í©o'$?Ó‘•{äMùyB*ðó¤PÏþ!Øô¿3Î]p2èC¨·Û{˜WöJÏ…Œ>~Ç“Fl–'£ Š¥Í| °;±™~ -îŸX÷ìWßJ¡d¹ÐuvÐ SiŠÉw®G -—‹qĆ…ìu!ö‚ ¹-«R´L‰öc2H”:wz)F„1nUvßFmºZ±s%ö¶ècþ°ªýòŸ¢Aˆ¢L¿;JÃ@v5]²¥båUŠÕVb½õ/í&ç¡ÆI*êúã¹Þd2•å† -·d«µ˜WD_h1M uRå<§ñL—eÞ¤}K{Ö·WÍìÙlwÉ õíØŒä/•þa§Ïbû iå@Ù•X͉Yvv©k”Ø›.ìH²=ö6ù}UÈä>m¾qr:eñFýâ½PrÀ^x‰håýbÎü=/Xö¡²ìÓnÈHYFš]ù›Â Oï^°pã=¯pCW.Üмpó¾}ñ Ð$þVxçmpîU´Zh†;G_Ô›…w¿ÅeÙ{ô6½ü‡QŸO¿á¦,{o}[…ŸÞȲØßÅúO$"÷ôVw€óFi þ4EÖ<I üï{þÛBçyMYðóLæþæ¯ Í[áqTûqjPR –sæó?™³ùendstream -endobj -1988 0 obj << +xÚ½ksÛÆñ»~£´cpÆ„¸ÃË3ý [vªŒk+§ãøD@"j ñ°¬éŸï>ŠÓ¤ÓñȸÇÞÞÞ¾wÌü fiä ™Í’4ðešÎV›#1»…Ž ±Ð æùòèäU¬fð3‘Í–7;<‘¯"9[¼?½X¾¼œ/¤”^úóE’¤Þ‹×§WóÀ»:qú·”wÓËó7Ëù"ðÎßüÀðóîââ-îÍSé-ç—?½\Z²ì…@B†4}>úðQÌ + ÿÇ#áË,ÝÁXøloŽ€(?RRÏ룫£Ÿ,*ÞS3>uˆ‘Lý(•û<"‡Aú2gI$üH(bBÛ”ý|¡Bå kxKÉã¼ØT L«=À¨Ë‡¶ÃMéÝV_æaêíΕ›§0T±w=_„ â¼8ÓvåuàÝ3Š¾d¼4·üÝAUx!/¶sÀx‡´ü*¢eDÞÒ!õx›weƒ ý1 +8²a?ðàb±{^ ø }¢Zåu}ÏuKÔ·Ÿèå· Y òº½íyŽHr$‰YÀ'sÞëëêvMhy™Îþ*‰O*È•¹¾™’´{0lÞÑõE‹ˆîx ò öÏ=±=)R~ñUe'¯¤«qà T2:vVÞäc ÄFaä]tU£‡?çõˆÂÅñ +Ýî—zòªmyÐ6ü½*»/fóyÞóÕå 3°<ë»A˜ânÏ^!7×Hw‚ôãë2Š}•füȈ^É4Æ[íøùÔŽ8Q^S“ +­-¸y9ñ“Ç,;öw|œØP+\ËkØ­5>Ú>>ÀÐ0úE¯Êa¨šÛßÍBz3br…ú€¥8%~˜„úúc44Ó@%S©WçýÀ#Ràûð;»c¹¨Tâå]WYõ†Í\ã¹[— C8à©×¡µâ/ˆuµ•ë'sŸÃ‹é±št÷½ÛnN–hðÝJdVt8f—Q—+öÄŽP¸>ó£8JCEÂJÃ\¾€à¡£Ð°1NœýZ{@¼ž¾ _Hìƒ5f î 4± +v ¢]æ%ê» Ä“;¶1ÜÐò7Èïjf‰ðEL¸u¯ð$ò7ìP‚P Šwï{ž‘ „í÷®k¡=å½Y~Ç@ÐZnÐ_s‘›„ 9£aìÀ>øN}hèîAo ¿…³;Ô&K/T`€ûÎŒ‰ áe2 =´zõ— µ>/ýÇdù0!ì-r®Fëož ¼^te¾aTÃ:׋@!F&\$“‡ocü-NrþXÿͲÓ!ƒQ?Tt4ðà6'×2‰FÚ‹‘ˆ!¾¢&8V†K¤už¾û1 +)Ff}"[¹Å° Ä\ÃlÔÇoÍj¨Ú†=Ø=£ðãù« 4hoùÓªÅX;46¾côèˆ<&ILG6à®ÿîa¦dÒ’X€žÇé·s%©gñÁ\ ( ¥ò…HÅC§àá‘ŸâYª2Ž¬À¦Tà·‚ÀÏP¢˜R%~œ…³(ý,HèùËj»ÿDSqNJ"®Ùçã,“ ㌉ð݃háä|£fg-P8›ÉxbÎûR7ïƒpš©dAø‡ÐÊDÎ!¢±É¦ÉGÃø=å#dƒB\?Œ:Uèýªùå‚£+NÙü! +Þ1ø`'LVí1n¬/×÷å½ÁMK;§×í› ¹ +Ò¢ÁxÚ’sóS.Ê$q¶Em¦8ò¥ªË[ΘV›5… !§ÿLqQ×2„ÓY”9Ç›a¬|Ôõº~z¡WÞÁçüeC~ŽÀO¶8€<îdû4Ÿ4:Ô¨INžœCMc &²‚‘¸:…+ÿñüt¾ù%>æòg]À yQMc>€ë¥÷ù¡è¼ !1þ ·AŒvË]7 ‘úY2aŠ]‚?èË’äõi_ã@¡ iÂþƒxHòdæìŠuˆ)HûŒ‚²Ôiøv–e~jYvBHKP¡ñvT6›÷:[V6HsúÔHé +ðA2éc +£¼Óºoµê¡×m´Z®)ÀˆâB»!g³ùCº‡¶ò;uOüOuOd{Ê÷òZÿ_µNe&$aàÌ´æÑù}Íw¦ªÒƒµPE¨þÓ8~L#Âbycò€Uù¸6¡ô“äuD"udÅS¡ËÄŸÎ+¡î]W«5 NÏL&Ù7Oøq¸·«¦qrÏ5{I*¸¸ƒ|ÎÞ^á ¤ÎAêQöõ˜÷Z¶Ú¾AU1°/Ê0LüÔz•+x€ø€}I…¼Iûÿ}øš¼96>Éü¢EÁWÙ„+\®7£9ãf*³³Nfñ'̆4ÛúãÙÓ"ÄÂL’ÑAžó[Ý6©$»ŒYç¤EœÖ•·U?LÛ0´¥œ¬u­¯XëÓî¶Õ”ÄÞòìyÿ”ûÙصCP v@+ý^k·%!¤Am´¡Úê8W÷~†$¶)ðh&žÅÑ®€gW»`» {€û׸s'´ñ§`8í\qØ•[Î|óÁ ?d2 £350h<Íd¡)”tÑcaºèýxm•Ò•iZî&º@NˆQjŸ +ü‰%Ⱦm–(‘2&HQ/)øç¥Ï£ÑL4”‹ +2‹€=#B‘îà¦é¼Üòꪥ|}\ <ÜÑ@Úi”Ea¹ú¸;wû°âªY~›Wº\¶?Éà—©ŸDš„Qhé4xnZ2hþÐj¾äæ4ägù5'ñX­…=J|`oí¤ ¸¾SO˜¬Ú±Ö´8. ¯t-Ov_õN牻Ïü–%…/Rîvm;|Ï?átÛ(@i":ÅÒúÅ»‹+ž/Þi08ñ×¾\u¥Ä_Tðû¤lÆ ºpHƒžŠF¡'ÓJlS0ðßøã±=¨T2†þ𾂤éNÿJ… ~¿¦ñÇ>bòÛÕáäñys£ÈÒM6(T4•¼ ÿ¢Ý3~¨àì@.¨¯w®YŠ$Ò?˜½xÍMÒÂà¦W¤ÿa‡êá‡Ù¡2þ˜ú?õ³½-&”¤’ô`1…¡†®“äCzÍÏû{ÿF8Çendstream +endobj +5039 0 obj << /Type /Page -/Contents 1989 0 R -/Resources 1987 0 R +/Contents 5040 0 R +/Resources 5038 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1836 0 R -/Annots [ 1991 0 R 1992 0 R 1993 0 R 1994 0 R 1995 0 R 1996 0 R 1997 0 R 1998 0 R 1999 0 R 2000 0 R 2001 0 R 2002 0 R 2003 0 R 2004 0 R 2005 0 R 2006 0 R 2007 0 R 2008 0 R 2009 0 R 2010 0 R 2011 0 R 2012 0 R 2013 0 R 2014 0 R 2015 0 R 2016 0 R 2017 0 R 2018 0 R 2019 0 R 2020 0 R 2021 0 R 2022 0 R 2023 0 R 2024 0 R 2025 0 R 2026 0 R 2027 0 R 2028 0 R 2029 0 R 2030 0 R 2031 0 R 2032 0 R 2033 0 R 2034 0 R 2035 0 R 2036 0 R ] ->> endobj -1991 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 754.651 512.306 764.219] -/Subtype /Link -/A << /S /GoTo /D (chapter.28) >> ->> endobj -1992 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] -/Subtype /Link -/A << /S /GoTo /D (section.28.1) >> ->> endobj -1993 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] -/Subtype /Link -/A << /S /GoTo /D (section.28.2) >> +/Parent 5016 0 R >> endobj -1994 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 700.454 512.306 709.477] -/Subtype /Link -/A << /S /GoTo /D (section.28.3) >> ->> endobj -1995 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 686.905 512.306 695.928] -/Subtype /Link -/A << /S /GoTo /D (section.28.4) >> ->> endobj -1996 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 673.356 512.306 682.379] -/Subtype /Link -/A << /S /GoTo /D (section.28.5) >> +5041 0 obj << +/D [5039 0 R /XYZ 85.039 781.388 null] >> endobj -1997 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 648.897 512.306 658.466] -/Subtype /Link -/A << /S /GoTo /D (chapter.29) >> +1254 0 obj << +/D [5039 0 R /XYZ 85.039 344.943 null] >> endobj -1998 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 635.348 512.306 644.371] -/Subtype /Link -/A << /S /GoTo /D (section.29.1) >> +5042 0 obj << +/D [5039 0 R /XYZ 85.039 326.275 null] >> endobj -1999 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 621.799 512.306 630.822] -/Subtype /Link -/A << /S /GoTo /D (section.29.2) >> +5038 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R /F56 2890 0 R >> +/XObject << /Im4 4878 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2000 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 608.25 512.306 617.273] -/Subtype /Link -/A << /S /GoTo /D (section.29.3) >> +5045 0 obj << +/Length 828 +/Filter /FlateDecode +>> +stream +xÚíW[oÚ0~ϯˆ:MM¤Æµã˜8H{ ´]é:ƺڇ41)–„uì×ÏÆ! % Þ6UÓ@cÛw>Ÿ£ØH…ü‹TJÄŽjS0¥ª+PpÍG•FibÔlŽ†ÊáiËRtÔáø>Áê0iݳÎ`xr©c Q ¶MµîEÇÕ‘æöº ¡²´_^öúCÝ@Z¯ÿQÚ ›«Áà‹ÐékCýfx®œ +XUBÁ˜¾+£¨ÿ¹v¨zÇeWÇ +ˆ…Ëu¤¸Ê×*”ÔYªôj¢€` +Å›`Rã™°Kµ ZKŽ³ðËtƒ˜Dë{1kKqtÜéêH¹—ŒS·È˜߈"U!Î!Q ÓaY˜«8õ˜ÂYJ¨½ô^9#^٠ጅ‹nY6)Æ“0öò*ƒ”Ò5$pàòôÚ-g'Ä  š’:.i¼˜M½¤ðòE°´H¸n{Ý#À?¥šÛ´Uà…í¥6KÓ⌛Í|? +YRÈ¥Ûù|Ô1ºWW®«ÒŒ{¼Ï™Ÿ±ÒÐðåsŸ%óx& Î÷— Ë|µšü8Öä£î³‡qäMòöþ¤P|d-pÍDPÐ]#l‰ß=t±ªïѺWÀr? gE˜&»øßlKÌgá·4šÇ¬ÜÕûAq‹yQL¼¬XK&›ÜOã˜sÛUMûäxF7Ûv·õê»›³"¨5¤$FÊ{ϙԽǶȎÄOÌ;8‰Áû>Ëóñ<ŠUÒÍtE9²u8Ï)üŸÆÍyü0>‡ò— ðŠ¬Úÿ;³Ûô2ÙhòÔÁlŠúò¹kŠ +þ¯>K䭼ؚ(}Û³rxŠêgZ5UC©<ðôøîáÕbO7mm!¶v«&Õ˜Ô$iiÂxÝR-&žóÅ1?$ü`þbb!Î]k·óBÆ*¦eœkˆ¬,/cù^U±–8I«†Ó$ Þ2p‰‘%:65Ù BZ5Ƀâì°Vé“OS×p'ªbA™jÊa²-WΉé4]øO2û¢[IuïâCG±S]9Ö·Ç4‰VXDˆZñ®n/€ãx©Øendstream +endobj +5044 0 obj << +/Type /Page +/Contents 5045 0 R +/Resources 5043 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5016 0 R >> endobj -2001 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 594.701 512.306 603.724] -/Subtype /Link -/A << /S /GoTo /D (section.29.4) >> +5046 0 obj << +/D [5044 0 R /XYZ 85.039 781.388 null] >> endobj -2002 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 581.151 512.306 590.174] -/Subtype /Link -/A << /S /GoTo /D (section.29.5) >> +5043 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2003 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 567.602 512.306 576.625] -/Subtype /Link -/A << /S /GoTo /D (section.29.6) >> +5049 0 obj << +/Length 3504 +/Filter /FlateDecode +>> +stream +xÚ¥ÛrÛ6öÝ_¡Éì5cÑAðÒNÜ4íºÛ&ÞÄYïLÛF¢,n)R!)_öë÷\)yg:GÀÁíÜÏÅ,€b–*?Ù,I…/Ót¶Ü^³ùéBhŒ…FY88ßß]\ýG3øYÍîÖÃ:Ê”œÝ­~óÞþýúöîÝÇùBJé‰ÔŸ/’$õÞþrýi.¼O7o¯Á¡È»…æÇ›÷wó…ðnÞÿÄøˆóùööŽÍSéÝÍÿ¸ûùâÝ=–ݎᙾ^üöG0[Áù¾|™¥³'€_Àðöå«HêvuñéâŸv)‹fN¬ 9•ÆL­Œ9¥×·E˜ðÖ h´¨scØ?l)?…@ÆåANbÀ7&ŽV¸*A·4áõUê'*u½¾Îe(C“q ÅšVÔˉ\-Š¸5¬è(ä_Ðo ±HF³ÎËþšÑi÷Ãm' Ï{Úƒ @÷´éOë¬uÒÓŽö›ò´î~èiɾCÔBF<'½è8Ö°Æ$$/}o’m¥6N1v_‹‹›Ç;‘Ç<)!üÿ¼Ø„Çq<6Å¡PU¶·Y\7†,5¢_%µ•Ûès^sT?Èm®£(íçq®bˆ–)uÞ›»bË—£«ž ±@X|fçï f¼Az…ñg7ÔŒí7Åxw¿=2©jrÍ‹œ8¹j¬ˆ…%hÖõÍAöQ +óô‚Wˆ¼ßæâ ¹ýÛ<ËMR¾=IZð^'jLe-ÎÂ2Îkt=³›!ëÑf“T6Ë;›Ÿ€,s4ÁJ$$‚JÄÑ1~Å.¯T¦°›£7„ÌL}.1·% \KNÂÛ÷Œ;``ÖˆoØYÙ:a¾¡PfºŒ;¯{3ѧ9©?MÅ+¬ÎðR#½ÆÌsnï7ÉNg¿ây‰âMb[cp,3#ÿ,÷mka†)88D)+î8Ö(è¬Ñ0Y© 3ˆÐ¹Ø‘9–4£¢ôŒ˜ ³ÈDû0²$ÝKÖ;ï'RP.vVU7Á|hupÖMû:×eà'é+Ù§ƒt†ëé5®ŸÛÐpýx¿I®;û‘CŸÈçÈå0êG[p,ª¼ÚPäÉÄšÇlEBÑh ÒÊ-÷`“jЬµ¼!j´‰x#ªj‹æ4ø?¨êµ‰Ålu2År8úש~Ú´åòŒ³C¼®T§Üv$£ÃžÃoa Uhõqê²T¡Ûq@Nhî^¶ +ShiË£ô‘×2äáhZSF&©-¶T­y¤eX` »@gÚ²Ðî}M©Âö ®G¯"Œ!Nÿߢ•B 3õU[¬âSèô‡*ŒÙ +Ï®5…&:ºU¶^g3&Õ‡Ëf èœvTêUy×3ÔÔº e‡#1•S†>vë*;°'6=`ûxmñuÏnÂ1è4ñÔVeÓê]ÙÄÔN£p6*ËFÛAìk¬ºtXשwÃœâ{2U]mÚƒÂLø¥ºO¨B»'ÂTXs±:c&¹æ­}ÞšÂIªü‘Šþ9–Èa½Ð 8Úkw)ZmÙ/¡Ó¡iŽV0^û è?ÖP÷ñH¦<Š®öÌãøèu +{rfót¹Æ9Э¬Ï º‡Þ Æ +žOÜjÚ|«7ÒRøçÔ)Ž©z\O£sé[#ÜOVAGtŽc* $úð…¦|æÆ…Z„2ãüذ¨Ø2¢S»¤T㢷Hc?³O]WE¿¼Ú¡¾/óÝ„¦'$Ù&¿¿œXh宵Üï:^ ȉ‚:Š +$“á‘ÔëôÚȶMžèÕj×6LŠ.9_QÅlЪ,åAúÞ7NéØún14o_°HÄÙÕ„"Þo†8(š‚0µDf50 +›{aÿšŠKåü³¬JÇ2_ò[j¹¯Rs^¡c'ùUèë69=ô¸j†׎»jª@ñÔåØÄ(ýØÁé NGb |p¦·¡/ülnεaìçP º£B¨Ök²: 10E uÜå¶8£$FÑóQ_Þ“tó+y¯ÇtJ `Å4àŒ·ŸÒ8×<» šîS;Ø7q³&$ñnÖc£,1­T?ÛBooß9ÐQmVr[¿ýÆ‘õ'ŤèàÖ<ïúÀ˜óØZ°€lùh÷1 ڢ߷Æ>FA@Ä¥_#~½L ¸j ±Ôû†ÂBË{ ñ«Á/Á”w…@<›ˆž_§s¸éð1„æîk×bÏ´=5õ+´$ÿ ‘-ñpCè\Ðó  ;EUÔL™5½ˆå’!{Þ–Š˜µ;vߨ—[š=S) É5nÁñ¡^ÿÁ:¨NÏÿnâŠ_rzb‹ÜWhZa¦†J§ñ”aÓí-ìÕq>ÕŸ N¡¹{ã !”Ö¥®êÅ:|IŒÌó¡âR9É+Fìaix,õ[¬T@Ð,ƒÔÝ1:ú +eáÚ”OŽ3uùµìM\9ĘÚ.›2ÍÄãRBžc?ðØâÃÒ—®Ïû}7ߦ¾LåÄ—;úQ\„H½ònîàœþ@©Ÿfòà{€Hp?—@’ +‰lá{[Kôop åÞ_ SJÚãØ{›×lyb-þLM¶¤Ð·§ +5ï1ÇÍ0kUb´[´E­ÑÞ“¬mMö0uÿÂôøü§bÎéïÒÔuYéƒÍöð6A8 ´]ÆÞñ3©kKó-BìÂ`ÎSÛ˜z®Y¡uMòaq£Ì«î’e¸çï¬pzø­µ7½w^ëòaeÎ×-zú´=ëÊ~ôé nidÛuû¡¨»¬šNgWü¹ ¿CK¸«†Ò…-C›—~óÈuiÂ&[æ¢åO…tÙ测mÝ)%?]¯…?¾â_ú"Ï +R$ýTž(úª0ôCaÎÂZ¤ŽÏk¾Üøà±Gendstream +endobj +5048 0 obj << +/Type /Page +/Contents 5049 0 R +/Resources 5047 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5016 0 R >> endobj -2004 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [490.587 529.109 512.306 539.404] -/Subtype /Link -/A << /S /GoTo /D (part.5) >> +5050 0 obj << +/D [5048 0 R /XYZ 85.039 781.388 null] >> endobj -2005 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 504.651 512.306 514.219] -/Subtype /Link -/A << /S /GoTo /D (chapter.30) >> +1258 0 obj << +/D [5048 0 R /XYZ 85.039 691.864 null] >> endobj -2006 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 491.102 512.306 500.124] -/Subtype /Link -/A << /S /GoTo /D (section.30.1) >> +5051 0 obj << +/D [5048 0 R /XYZ 85.039 671.274 null] >> endobj -2007 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 477.552 512.306 486.575] -/Subtype /Link -/A << /S /GoTo /D (subsection.30.1.1) >> +1262 0 obj << +/D [5048 0 R /XYZ 85.039 120.719 null] >> endobj -2008 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 464.003 512.306 473.026] -/Subtype /Link -/A << /S /GoTo /D (subsection.30.1.2) >> +5052 0 obj << +/D [5048 0 R /XYZ 85.039 99.522 null] >> endobj -2009 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 450.454 512.306 459.477] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.30.1.2.1) >> +5047 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R /F35 2880 0 R /F14 2895 0 R /F74 4586 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im4 4878 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2010 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 436.905 512.306 445.928] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.30.1.2.2) >> +5055 0 obj << +/Length 3652 +/Filter /FlateDecode +>> +stream +xÚ¥ksÛ6ò»…ë»N¨™ˆ&ð•ûä&ië¶I}±Ûô&ÍF¢$Ž)RGRQÜ_ûd®“qËž±»:÷àŸ:×ÓÉy+WÇñùb{æ¯aå‡3%s™`¾»;»ü>4çÊs/9¿[õx×úünùÎyþãÕÍÝË7³¹ÖÚQ±;›GQì<ÿåêv¦œÛëçW¿à’qnàõÍõë»Ù\9ׯ`x„ùíææW\›ÅÚ¹›½¿ûéìå]GV·! Mÿ={÷Þ;_ý?y®NâóŒ=WÁòö ˆr£å½8»=ûw‡Š×Ì95%㇮Á@{n›I¥|W+äxnà™NNj('åÇn…çõ§§¢cö”6®Òç\§2Èé~Áp?¸AŒö»Ûd¸Ýå÷A8€ôµ«G eÖÎæ&}#°Ñ ¸>°%°å6F`¸½zõݪw~û’ +Rp~Ó8Ŭ<02[Ô˜Q–ÌfèRÄ\à +ÓmÆd_Ýõ³ºcòªe4cÁ¿žÑ:ÿ8š²>H"ç_ª=¾„NJT€î•r xK軬®«z6÷}ßÙâÇÊiÒu†Ïg¼§î)WùJ¶|µ/Ú|Wpà΢*ËlÑæUÙðD[ñ3å°ó1«y\Õã¥MZgK×YSíëEÆË~C‚?<úlÜÌp„"“Q›ù_y¹>†Í€†´8G± Õ@‰ÌÐy¦(ªC¶t‰"i ˆ”y#\w<ØÕÙǼÚ7_Ì€,”ÍÓN;5Ê ¼‹h@‚ˆÃÊK>NK‘c[‹œÒuš—î‰wŠ¯‡±ïFAüùx0z<X /ăÏn(ñàd¿©x0Üï%Û>²lŒç¤-øRKF¼Ýµ<‡2Ççj] W²˜òcà9ÌüLô&uâ,ëÀyüæ¢ÃÇ.iF(v=…•‘ÉhVn_¾é"É[èÃÁ|5²]—í?'L…6’1Ý »çÇ#[úëð2ŒqÄ$ÎY†8¢ ’ÚŒU›Øù€ï<&3ÅÁ" *¢ÍQÆ)}ØÈß–dØØãN0å«È혺Ûäâ4 œ)_VU±´Îkûzμ †±›”mñ0òGqöe‡j™¯V‚ + 0 /yZÈ‚ObÔ(»ÓùÛ.m o ê+BÅ*¯5J¡+û”7m³ú¨q4&%BBRNÄ Íri1c†‰¤“rù‚¦L0€d'ŽD©®˜ Dw ß‡n Ù“o+´ ÕŸ_øBfT Ñ•á¬Ñv†³4;5ÊŒ, RŸÈùÏ,6: +8Ðx +ÁÆÙ +ø&ã!$¶qË-‘Òðä:ëÑèÝ0³éèB–î™u‘ÌPA+L*Àª½ÄÁF>åÅÎmºE<8QÀ™ÆºÕþV4‚v3‘ÄhßU•{³A2ñ¡iÓüñTKq#Ó+ Â_Èra§•½@µ–ÚQTmåDSÕÌ8²s¢ž¦ÇNâb¡Ä!PbFR¹ÏEË&Hpç-ठ±¯(¤©E‘~ˆS(?škX ¬BP Ò$|íÌŒÑ3&ô0©SÃI’L[µÛDI¨èÔŽÐDš¶¢}úªå„õÈ'Qìþ_ºdàk6.8@M1ëLc,¿ö§Nnòõ†GK+c´•ýš' šáO +AƒËž0CW#¤µýxÎ1á$HÆ¢% +A™ÍX9yTGr[ñ°5<9ÚÓpHÉAdÑðè,º\#½8U䥌0.á“O\ªÖ@Q r'$mZ Z qø䣼$W©ÛªÃVg¨O¨P[Š†á—mÛŒxÜs$ÊLqk¥Ä4‡ÆMÓ5Ÿ¡4ÎhoLCéÔÐP¼Y~![ºdÂxCÖœñ}–¯$¬Ñ âçØ눨ÈyÃ:BÜE‹ç=”ª¬ ÅñE©#mœ²ÊG+þ !a]ñ¹"Tl®ø´…ãƒÅYS¨Ô±ó9)Ñf+κæœu(Ô$9,Òbv°Ú£ÕÖ3Ò¦ƒ€¬£±NÄ—ò^¾ƒ¥Ý§­×`.§Œ¿¥´fÉô5±U_Ô™ syv °; $²ºŠDW‘sês¬*7Á(½êjD8Ý8äüLÅnâ=`(P¿£ +ö›Î4ú6¶Ú£?…¡¬¬d°@t¶ýP®yöEäÐ9ßÓaŸ51ÄÔû,C=ÌDéh2µ`¡Þ-ÁGA›¤†D”“Éøp²?wq‰=¡Sõ +ÏÜ‚]ÒW2ìÀ„ÀtRkÑ Á—¼†)ïVñ¡ÉtØX%'&h 8…žÈ‚âÇšE‹ûT7aê;"¼Íû"Eé ]au YÛ‹ª|"”Á B­°¥saŸ¦ÂxD¼¯ª切®ŸìÕp¼€‰ ï‚èµ+kóðÎQ7 .“øòÆè§ ­+‚BÖ£cŸt5ú¨¼ #Žl‰þŽ‹æ÷—o¯__z—91VâÙnºfÁq \¡¹Š¢#®`â¿`’«Ÿ­YÔ]À,ìUÅg~ÆÀÅ:u0Ë,î6?•Ìû±fX½<|HIs®Þ§äa°bNä¡ý?âðÒ‘„£¢Â™€ñ'ÛôaBl¾ï†Êö8 +bê™õÞ–fèj>äÆ”ÜÂøòQ@—Ü0Ñ-Sä"x?2Ý‘ŸL˜N'l6SITE±«Ô¸¥x¡±©ãù¤£’l|Žýœô„=Oë !Pðk~Fê*‰]ß$ˆ]O‹=rµÄÅ, ÓòrŸò·S@3qr¬¤zßØC ©´’Ñ&t}O$<¯ïøœðÈù½+¥xÀÉjÕuÜ&/ì—¢da–¨+ˆš”_g¥£´v,Çð1%Ò?±ñýœZøÑ nêÓº~àlÖ’&uEÞi8ÁöÆ¿ F\xï‘Î$¤ÄTêѤçÇ´3••Øp¯evЗL°‚ìw< ÊUÈÏ8?¯ +Γ°™ ½bD}¡ +xŠÞ1îeÖW¤B†™®À„f_“ÍBàyù 뛂òß.lq˜à‰:´ºh;aáaG²˜ß·__üúööÛ‰6'XVÑ2… /äìzóÐ@¦ý <&pc}-ž]USÜØ »;•/!YRîÒLÑâõ-Ì/aaŸŸ@¢ é‹:ÆbG“øqbÜ°UÝ·Ó 8XÆ—]]Qg‰²²žãðŒñÚp&žvi'Îä\É"$ç@h2y› +ÆÎÿ b®±i„±ü°ÉgÜ‹@ ¸|ÈL.¬ Ät,lOâys1اÚn¹s+ê=lO; Ô-ƒ”(åúðÀŒ¶ÌÐN³±µ¾móO™,p‰Ý…–i_/jà¢mÇIjÍÛŠ1py¢®Ó4ó’6Ò?¨“„Š{kÛÂëO[õúpÞu:[Û5Úâ1¶`H;C­‹Á +G[†`»±¶fWSyÅ´.Šœ¤PbqêÄÔ*ˆ¬Ù“ªp£®ßÀgU¥ÐzAÁ&Yã´´WS¹c@F²Þ,Ê#ÄL]&Ió‰v Þ] duÈ)`WÌMÂǧ‰šY8sTe‰F¢Äs~-ÅOA…&ÞÚ8%TçàlÏÞŒðÆȦ¥F¾Tšò[—| +²Š¤s×Sågå¢ÚÛ{l¸uýì½M0Ñ0P‘K2µÜN÷·/ÃÛÛMj/ ì 0TwÓ}u|US÷·¬ÙcT`Ä=—Ó4ÆKÔøæÀO\ûC·ÿ‘[ +`_ätØÏÃÜìSºÝÔ2þ Üóîx£ÏHŽó.Y2 y+<‹þÀÅ×A)oÇ}¥Bæ©'È»*ÎÇ +!ÀóJaœ§-XaöEEœ?zc°ëè7Ã|‹šl8É÷Ú¶‡cä¦FƒªÈ¤‘+»¢àé)_äupâFŒ-ª™ßÕ8¼Ø¨!eqƒÌ“ŠAX¡.oÌŸIàÍ«&om‚~tkµ’RÖîÒWáXbÍ}^î*á¹æ'«¡•BùuÕZá`Ç30âóFŸêüJ²UˆIy™ÉnFÀ1Gú†`êÿ¿Èv6Ûæãs)Þ}¬æ‰Æ›4®¹ÛSd+éåò¤à…ƒ•í5»t!­¢:K›ªl¦~¸áÑ/ð +Ž¢zUµÿ_ì~äjoþ?Ÿ\-·y™7m¶Uým“-ê¬}"0 ÉÊýÖæ@4£öU!þ\ljÉÀüܯe™Ññw1×åJ¢Š&>8­W%¿³¶ž1Ü;ý~B’Cœ¯Á ,ðó´´7ªù›8ð<ßÜNb¹ª›¼Íí¾î0@Ú¼¬Â1–áøü‡ï'n}DܤíÆ¢øSiƒ9á+W8âœGÿ[”^»Ë¢˜ä4mÓU^dÿ/rC³v?í–SøŸWå*_ÿˆü}þ?fÅîo£w7Åîý#C°|?™j“ñ·~}×75dNÉtï1ð}¨®--ÜJ é tì±>%ø-Böendstream +endobj +5054 0 obj << +/Type /Page +/Contents 5055 0 R +/Resources 5053 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5016 0 R >> endobj -2011 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 423.356 512.306 432.378] -/Subtype /Link -/A << /S /GoTo /D (section.30.2) >> +5056 0 obj << +/D [5054 0 R /XYZ 85.039 781.388 null] >> endobj -2012 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 409.806 512.306 418.829] -/Subtype /Link -/A << /S /GoTo /D (section.30.3) >> +1266 0 obj << +/D [5054 0 R /XYZ 85.039 472.088 null] >> endobj -2013 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 396.257 512.306 405.28] -/Subtype /Link -/A << /S /GoTo /D (section.30.4) >> +5057 0 obj << +/D [5054 0 R /XYZ 85.039 451.498 null] >> endobj -2014 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 382.708 512.306 391.731] -/Subtype /Link -/A << /S /GoTo /D (subsection.30.4.1) >> +5053 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F56 2890 0 R /F74 4586 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2015 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 369.159 512.306 378.182] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.30.4.1.1) >> +5060 0 obj << +/Length 942 +/Filter /FlateDecode +>> +stream +xÚ½X[s›8~çW0Ù}À3‹ª ‘7—´©;®—évgÒ<0 ;šÁ‚NÒ¿Â^“‡m¢Œs$s¾ï]²¡ü!›ú’È)„R;ßYÐÞÊ–K î âŽtÞ§Ö»g#"Ùéæ??>ð|b§Åµš'釫™Kq37 ©/çërÖ‹x¾TMž“ÈâÕb•Î\ä,V—Z_é|M’?UÛŒ'ݤŸ­é‘ÖPRˆ§Öõ ´ Éÿ³‰¨}/elÞY’ð=2”Kkmýut¥Û<[[M¥À'ø”œæ€ø£ €ê‡vHù~Ÿ„ V3Q0ÑmxÉÚó™ëcß¹þŽˆ§i‹|¨*Ö ÝïJúFð?4PQÙ>¯ËÝ*EYÞ¨LHZ.R¬£WDÙç-Áõ ÆkÒ‰’`³Qdû¶-š;³ ¹hë"7HVsPdÑ@ˆC£‹5¹¹0ÆêýÐþfMË+q@Á“ŒF>W#öq&*¡e~åCÝ@þéŠdM¦\Í›ü–w,ïöÍÑÍ7.Šê¾ü§úý@ƒ©Ñ0b’dÝí/ô>öÔ³ãZf^ƒ_u¾èsÑnÁC]Lù+±áÛ— ôô÷ü¹>±²~±ûGóq4Ú^SïÀù‘'³¤ +ÔÉ„üp/[)>1WŸú¬n•0x +r¦•”'ÙXöj­®ãB*W•®(¸T#¬aCƒ†bݤ~Ã20ÎZ&I‚\éU»:k˜¾€Ð¯ç©½ìK)vèv™¨ÐTÚ¾ýhÈ[-Õ\mŽósÝn d {2MUu¿é~k ¾Ùh»ýèvÿ¡0}"}áhêC>:æÝ“o‚両$:^‚<\>Æ£¢áS¾‡û”Âÿ¹ á´endstream +endobj +5059 0 obj << +/Type /Page +/Contents 5060 0 R +/Resources 5058 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5062 0 R >> endobj -2016 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 355.61 512.306 364.632] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.30.4.1.2) >> +5061 0 obj << +/D [5059 0 R /XYZ 85.039 781.388 null] >> endobj -2017 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 342.06 512.306 351.083] -/Subtype /Link -/A << /S /GoTo /D (section.30.5) >> +5058 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2018 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 328.511 512.306 337.534] -/Subtype /Link -/A << /S /GoTo /D (subsection.30.5.1) >> +5065 0 obj << +/Length 1317 +/Filter /FlateDecode +>> +stream +xÚ­Wm›Fþî_ᦩ¤Âí ØËEªäø’‹£ËÕ½ó©•’| ÀÙHÀ÷RõÇwfgÁ`ûZ©×œ¢egžyÝåÇ þøPù.“Áp¬¸+•Fë.As1àáˆÓÁ¼] Nß¼!gnÀ‚áânçÇw=_ñgkúa2_¼»¶)¥Å•k;ã±²¦—“›[7³éäUž5‡íõìja;Üš]]1·óù¯¨³•´ö×ÅÇÁ»E›VR0§ïƒÏ_Ù0†ü?˜+5|€gærP¯”ë{Òì³ÁÍà·Öé¼!Yk/•ë+yØéwzÀ¡H“®ÇFº Q^É¥gTÇ™ð;(¼;‚û›^+Ÿ±jé>nbÛ <ŸõE/Øyߦä?Æ~Oò Þ]e›~6(8On§óËOW ÷üNJyŒYÙŽVá6ÚdkÐ4Qøz7=ó_»*)6Ç 6:ϤhÎ1gᶪâò¾ShWr´ÐM™¾3haWrGgáºÖ÷äx=6Þë{#9¨sšßÈ 7Êë¦í;Á¡ï«·“ùŒzNààx6ŸöÁà¹Û²¦¬UhsžÑ&ºO“7yLþí8W›¬…²g@ß×û^ŽŸFƒ¹Kó¤s1ž Ué{4Å|uü¢w³FÔÞ¹ôÇ.Ë&Þé{Þe‡û¾ËÕÐñ¤;’ÄçE$vg/y`}³¡¬„6w…Þ¤¿åʪWÅDËÕ¶ãyÌ:‡M™ÞÛhY’éƽ֬jÜeF¶[+Ú»*…D´à!­W(“µu…)1Ùp^t+˜µòÔÏŸÞT*¼ÛË8{HNj¥qOœžæ´Bt“xZ’$*gà?“4¬h@<¡:BÐÐx©´‡„ wØ¡bMí?5ÆUú§ÁDˆ/Ö,°L«"?£ìq8œ¹d.Sc]MYõtðº¹øš%ï\¢ÔvÛ0²ßåû7´ Cí_¸ôtG&XнkÕú[”¥ òšœžB~øNúÌU§›2Ík4~MZç–Ö“I¼Nó´ªË°.ÊŸáß iÚHýkïD¤~Åôð»¨Ñ©l2MMůS#i€®KëžX¾zƒ×¦[-ðüBðú—¦ÈÍò ÷Ð +1†Ew^!U~¸œÃÏD;SôaåBŠ»[‹Õ–"~ +ŸèA2Z™8“üŒ™`L¡çÂÃÈ€SñÔ "ìWqkh}¤ÕŽ¹b¾Þ 1ü‡0ðËLzÞK«é„¡ í™è .¶Rÿc-ý úT¸¯Æâ?†Ø§kx¥¼Q­gðZ‹1è='DˆÈY‚2n=ØDã@;Df(Ô{¢ÛÖ rN§HŽ@Œ¨@®ªE­f®ÐØV¨AA¹<é +láõó„´¦ÚyëÇÁYþ Ô\îhÓÔ£@[?KÜHìcM§L˜šêú™ –ÉΦŒduA«Î5É´ITÝ*éeÙ°~ˆKÝXZŒ£ÍtšFÈh´ÁCg´iÈôº[Ø- ÿΆ +Ûd²¦@­<à†fVáÉÃu›Ž§ h {ÚùÉnʉFYÓ=Ê7ÄàKãè`xƒÌô|.S5³² uŒ…ê«Ó¹sxƒvã5Þû•¢NgL3ôA¹Ï|LÁäÁ± øO7åEßYí—$¼oJíGTïô…porÁ#àÀ({ù6ßc ÿ âj‘endstream +endobj +5064 0 obj << +/Type /Page +/Contents 5065 0 R +/Resources 5063 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5062 0 R >> endobj -2019 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 314.962 512.306 323.985] -/Subtype /Link -/A << /S /GoTo /D (subsection.30.5.2) >> +5066 0 obj << +/D [5064 0 R /XYZ 85.039 781.388 null] >> endobj -2020 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 290.504 512.306 300.072] -/Subtype /Link -/A << /S /GoTo /D (chapter.31) >> +5063 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2021 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 276.955 512.306 285.977] -/Subtype /Link -/A << /S /GoTo /D (section.31.1) >> +5069 0 obj << +/Length 3589 +/Filter /FlateDecode +>> +stream +xÚ¥koÛÈñ»…ê/G'šäò™ûP8Nrõ!ɹ±ƒ¸; ”HIßÌsàB;ù¶ÀAâܵն/[y™*ßi¦ÊsÚ¾;ÅÙà,¥QêG–@ ¥AÆ  ôKµ:‹f¤ÎsÄÀóãÃUày¿<Á4P: 2§gHW¢X[€ï̛|wèšé ^UÞ—ÇGë!¼Ád½çª_ó\™/¦ðXkÌag³ 04 AwÖ0&`'ËoiÉ ‚òº†á ²¸3óQÐ|Ú>’•9ýZKý­òc§Yâ‡Wï”Í:PÉ8`5\åý݃ÿŠ‘öø¤n¬bAúqd•d“Èüͯþ÷Eôü»Û÷oÿ‹Eà\"§~ T)j$²zçΙ ô¾c9²l˜×Ð0 Û¡X„hórAȨT4*ŸÙ +ÒH27†ØbÁåX®GJ£Âq…t² ù¤¡ÖÄæ‡Q—Ô¥EÃË2çõ Oå2dzÕ=r#K™ÂZfééOãƒeôÒB}œ8Û|c“r¹ÇÌc­»C>YK)zHPkXñ– 2ÅÒùWeØß1PO…gÄWš{1H%©;Jv'"Rg.¨Å”d¦ TÖÃ6=Û å…×ß–ú@øF«ïH„lŽ —†— @š·B-´€#ŽXÐzûîä'´åÈ©zœJœ6%jy\uŒžó£-¿îpŸ–O\2/y‹>9ôd8GºSWÚWÈgÂ>à[ ®—‚”q'/²ÿVcUÞgËSs:?!ÖŠ§û¦.ìsGt윱›ZA LÜÊûmA<¨ÐÄòyú‡ƒ®1âóº”O€9/ŒÒjb¿îŒì5r‘H,K7*m‚bî>W죗ÃoZfOhË÷iÆ„ÉÚßò•,˜÷ü|ÁµšûêHÅÎ}Ãÿ÷½—⑉ꈄ³¶8a9<òœõ&ï«F³EVçeˆ°'Ã0ž:Šq°Ñ¢®D‹º‘®sör0ÿ2Åv Gü«ø±A§† ì† ÃØ6Dœ° ±cȶéy0æLy-–+ŽÇü)îBjó—w–ÃÒêÐ2Ή‚—'+Ø®.ù+6ZrH:²ní°99kY¡¡PÃôȧ©8Ýߎ¦W<‘³ªà¦«m'0|dâ5«jÁq›“¡§öˆ<‚³¨Ó!RÕ}… dÓÉ,Óád@ùþndí†aÈA|ÖM>b¹s +}ùvÁ§€üµiù¹Ì‘¼š3]R*΃ړZr‹²Šcô‚> ™Ô¢ I])Æñ$)€#Ö¢ €dëJÇ ãð¥(÷üp«õ àÕøØ<æ`¾|ˆ96˜Ñ9èçÚÖ$€ýîEÞ??œU]W¶3ÊqƒLŽñÂÀ×MGÓÅÖäjA"s@ŒGŠNâŠÀ6Å#ËAãG9² gž§$s˜~Ôî˜Á¢p˜% àÀûü'òÑ3z¾ÖN:ÊNg•4ñ8#‚Çnc§.A,FÚl6Ì‚ØÊ ¨k~eEßò‹~¹ëL†)Ôu„úÜ(W´ +ÁÖKpÞ€ç´ ™çžÚfÕò±éa'̬$úCö.ÙÕ˜7ÌYïk…ƒ1,ù¹—º)NX” +øõKÇënÜUMnªÎW5Îéú+ç¥{õW"õ×õ·¦*ØŠ+áØ8›†Cgì,@jT5½êSò¼ÂüÕ®¥°Ó1:{k¥Î3¶½ÅÁ,dzÞ´Z¿qv4ˆ0K\È‹Ïña@9]Ü…I µ*û0Š¼IâÌøñ´)X–&·Ô>vhiJB K’8¶'à +þ܃NÔè H)a€L†’´yŸDÎæ0¬õg3Ïœì;yCC]‰å¨p² øC?¢žOV(b¯–ë'E4 ”‡@Ãé#ÏrBÈÈùrRÆ)3y[s Á⢃\j#ÙPfû\¤Ò93bªi¹Zbã#¿®¶ã”ŸöžYùóÀNå•éëòŽêrÏK÷§neP”y1£¹šÝ¯TÙ_0÷í¸ø8i~µ ªtUŸá ~bÒŒ:ôY—ßó`“WGÔ¶'2:1‘©E¢d0.S^ yLwÔ4¬ù­ç²X²§Ž`” ¥äb?ÆD±lc¨¬º¾¿è?× Ø²¤àcƼ‰Ž3¥¹>`(=±žºŸ}º»9þ<ïJ\ÌÏöŒÂTk7·&Ý i³ÑFFM„›/=ž«nÍ`²Xxrv‡ìÛ É¤*£b ¸‚ä ­a£Öº^:Q5íhK‘7"˜¦.¸NðÆ®öe#ÚVÖT‹Ôÿæ*ųKQ˜:4‡ZBŠo”‰/©É¾¢,ðH·Et‡’ø}üSÍ¥nn"F»'ɵ~¬"ØÙ/rq®üV-†°g€1ø–Â\,aº522Gw[°“V‹1Þ:º‘²º´,Ñ‚ú)“N%û~–¸¾>…¶pN7c0”™ëûŽ/͘/k¾*`7'iþ-z<Îýu4‡¬ê¯§è„T-‹Ï7K,œÓ©¾‡nœquœá+Ž[ÈAég-šº>Ê@¬jËÄ=á»V–n÷d\¹ñlTž•ÆÝ(l ä5½¿:<¸!8vFãå˜Æ™YH|tûg>^'±Y ~+9ÚQ…®¯ÎoÈ(Çûí±Zen”F{ûÝÙµ‘áGÄmCx,¬Â”jöšá`àÌ`¨ šö…GE‰Æ]quSéÅ¿ÐK¡SA*œL…S¤¬°8Yt•¥ßé5•"Û‚`GÕ=•ãã.eT°ïzQöÁHg+Hßì¹ µ`÷¬µß¨`ñjXJpÏDèFZ5n»çí ƒõ•ŽœGç¦iÉ êZ$:¶ÜÀþ=€côÅx[™¶‚NˆÊ=)+/Ìõ;¢28g$Å8ßԙݴœ6Ó°Ù¸”2¾žÆçpýÝóU­Ouµ.³àÄÕ:ß½PÑf~;€J=ð³fN)1Çîù^¶ËäfÙJ /‘r†Ù¹¬xŠc«=¼5)¹\íãíõ=¼Ìió ¯Šxm¯¤Eà}ÙmÂweí{%ꌒËBíjhCäA×cÇ—Þ‡4gÃþáAªü€7Î#mááÒ™ÂÕVRˆ/Æá¥\'Kdâßæ…:M±;诘Qr®îT¾ <Œò#š ÿLÛÿõ+¾¡Á¨ÜTpCx9øšÎ8²Cz#•‚¨c‚ÿÊì9endstream +endobj +5068 0 obj << +/Type /Page +/Contents 5069 0 R +/Resources 5067 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5062 0 R +/Annots [ 5074 0 R 5075 0 R ] >> endobj -2022 0 obj << +5074 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 263.405 512.306 272.428] -/Subtype /Link -/A << /S /GoTo /D (subsection.31.1.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [481.678 346.575 512.306 358.567] +/Subtype/Link/A<> >> endobj -2023 0 obj << +5075 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 249.856 512.306 258.879] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.31.1.1.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 333.026 267.943 345.018] +/Subtype/Link/A<> >> endobj -2024 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 236.307 512.306 245.33] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.31.1.1.2) >> +5070 0 obj << +/D [5068 0 R /XYZ 85.039 781.388 null] >> endobj -2025 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 222.758 512.306 231.781] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.31.1.1.3) >> +1270 0 obj << +/D [5068 0 R /XYZ 85.039 761.463 null] >> endobj -2026 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 209.209 512.306 218.231] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.31.1.1.4) >> +5071 0 obj << +/D [5068 0 R /XYZ 85.039 743.459 null] >> endobj -2027 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 195.659 512.306 204.682] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.31.1.1.5) >> +1274 0 obj << +/D [5068 0 R /XYZ 85.039 522.834 null] >> endobj -2028 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 182.11 512.306 191.133] -/Subtype /Link -/A << /S /GoTo /D (subsection.31.1.2) >> +5072 0 obj << +/D [5068 0 R /XYZ 85.039 490.015 null] >> endobj -2029 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 168.561 512.306 177.584] -/Subtype /Link -/A << /S /GoTo /D (section.31.2) >> +1278 0 obj << +/D [5068 0 R /XYZ 85.039 403.708 null] >> endobj -2030 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 155.012 512.306 164.035] -/Subtype /Link -/A << /S /GoTo /D (subsection.31.2.1) >> +5073 0 obj << +/D [5068 0 R /XYZ 85.039 374.304 null] >> endobj -2031 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 141.463 512.306 150.485] -/Subtype /Link -/A << /S /GoTo /D (subsection.31.2.2) >> +1282 0 obj << +/D [5068 0 R /XYZ 85.039 197.117 null] >> endobj -2032 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 117.004 512.306 126.573] -/Subtype /Link -/A << /S /GoTo /D (chapter.32) >> +5076 0 obj << +/D [5068 0 R /XYZ 85.039 175.92 null] >> endobj -2033 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 103.455 512.306 112.478] -/Subtype /Link -/A << /S /GoTo /D (section.32.1) >> +5067 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F56 2890 0 R /F14 2895 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2034 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 89.906 512.306 98.929] -/Subtype /Link -/A << /S /GoTo /D (section.32.2) >> +5079 0 obj << +/Length 3465 +/Filter /FlateDecode +>> +stream +xÚ¥ZYsÜ6~ׯPù‰Sëaxû²¥U[‰ck­qy«²y ‡”†9&9R”_¿}‡äÈ[[.yp4ÐF£ûCƒî¥ÿÜË$´?½Œ×ö“är»¿p. çí…+k!Y4ÿÜ\üðS\ºŽ:éåæ~˜'´ƒÐ¿Üä¿Y×ï®n7o>­Ö¾ï[nb¯ÖqœX×ï¯îV®uws}õ»ëªŸn>lVk׺ùð–é‘æóííGì[%¾µYý¾ùùâÍF‹¥‚)Êôíâ·ßËäÿù±ý4¹|‚²c»Ð½¿¡ì0ð¥^]Ü]üKOÅ}Á%šS¢X»©záy5E®D¾V“½®†!ªÉu=Ûw½Ë8tìÐ HO Ð#,Ô…¡c]·EÖ—õh"Š¬Û¶¬û¢ÅJlýˆJjËGU¿]ù®•mÿ Ÿ‡¢[ÒR<âô¼Ü Éí†Æöj¹½”›@îÍ®X­½Ô· {Û@9±¶ +ØuÜÑÜã¯gmIj ¢^XqyØwh©¶‚Á}ÁtÔž¯h¡Ø^HÓ!Û®¼ØúcF¼XbRÊïWø‰™Ã3Žjj˜!瑽µ#Qšƒ¢5¥ìw(‰Ì–ËzŽû‚eCÍ‚ÂÖ.Z+à?Nè´Å=íE ÌÌÅ›=²!½”2œfv-»ÿŠ=“eU'J–d«Ž(v‘sûSÙï°€t¬??‰èpd{ÔÅW,1i^v=éò+ÎЗ°~x߈|û¦- nØîZ$h¶žYÍàâ"]°ËÀ¬œÑ‰¬n×´ýk(»0”ÚbXñ§“ÕvܘSï¡l-Ž§}Lô>bcb‰î±˜1ÙÃ_8¦D-h3H)ÐÑg-­»ª˜Í¶a®­‹’튩íì>ºA¥¬³{ͨ-ªŒ 2熛?qɺ‘gµeü£dj›j2 +^]¼É>Z.P>s™…†BYw=¬ í%ÎJ‚«!æÚ´ì…sÅ®Äçý•A³ì¯¢È±Q—öW¾ø+rèÀìq¯|ÍžŒü×oý#«~NÈ0¶c/8/ä@³ìœ"?…à Î)ð©abc'2)ïxùìç[UÏÜ–qú¢¬Ï¾fLJG¹ïwYÏ%>S²©Ø ]Žýv,Ú·{ËŒ 4cŸ‘ÏÊÚ|ÆJßm6·¨Q9³ùBt +Y]v{v.°Àõ Ÿ¯S›Ëç°!–M)è37•5ÿj?±ÎH0,ðò±}—uLœÉ ŒØwâ3KãàDŽõùVÞ3å=ZóÜ!Ô|=p +dçý‘97åä\aö'ŽA“åú¸ƒ^Ñã/Ÿ ‚Žc1DGAàš:‚1‡S:¡X—%œFäúÌ#hÁåC­ÜFÎÍH›ñ¸·*®á¼YóÓ®ÔR@ß’:¡ íÅ÷=ëرŸ…4ük:T`wÿ,ÝP!ÄÊàcCY4æ¬ÁÚSóÒBS¶•WjFµ'ÐÙÔ2 E¼V­ÏíeœÒù"dH–"LO?(}íMTÖq‡Žµh1<€ÖªTЉ:æMŽý‘<ÝWËÄhzt^ðªÇ”tX ,<–y¡àÿì ½2é`£ó¬oÐàöY9_lœŒ?q¼NÞ/Ókä™7½t +×½4P@’Êÿ@4`P<äP{×s‰ïùx.è$Ä-§™&c0›×k¾s‹óA©²Ž{žgQ jU2ш¬îæ`²€xªa"Zh‰ø6‰]“æfiQ2Î’tÜI ~Û‚˜7}Áõ»QÊ[4›/¤1‘£ã©1!‡}¦r¸e|ûa7{9³|s•lÂï¹D©™3ìUèGvœ†/¨p :£B!ÂEù‹*<ÇN©ð,7¥BƒÛ÷XòM§Ö[&öx…›ßª›]j ´uxD·£ ŽoýŠIô5R}Âq׋®Øóm/ˆ^pÅÑW,D/¹âs •+>å7ëŠ ~ÿ»ŽÇêEýÞŽPÒ›?ùq`¤Òõ§Ûk±îF¦ç”üÉ[PqÓM\ÂÃkÑ#wø«N–ÙÕ}­uÜXÔ[ˆícQ7€À ­§]Q3e©žGèÜò$·Â=å8›a ¢†£\ÅUv“½pD’-ÃaÍ € ËöRê”d™ºŸc«N,uG„©Øô•Áº"T•­‡^G´³ÍQFtÇ‘÷×é\aæE°Náš3ѱuæ¶-TN:DûÓ* ¯ãšîO ¨G¯Oìú=ßWâÈúB¶'Yà˜@ª/  n«cn:ˆˆŸ’aŸ¢nFmæLøêŠÖ¬(Ðò^’“í½-%yNiJàF ðo.<â3™k%¯„q=—ÃÿB†3àl4ø44¾iiïVªD‰BÚ¥Š¿êš?ä81ˆŒ_L±Vu0ÞgC|þ‚¯ê¤–Þ 97´ë7\Ž: î}'2¬“8®C¡2öXWÏ£@òG­; öÄ)[(™¦…õÓÛ ¶í$ÿÆ[‰-bàʪñQã~2L=qÆõÃ$NØ‹ç殺KY§m»—ë×àÇ´áµLLϨÝJ®lš”ïÏ{\€HÞÊ¥Ne¯ù†'ÙNà2²}y‘»žº¤ÝžÞ`éÛ¼U†gq:Êea §DtV5êæXÖ›î$›H~mÖ ¹ü´ ‡ °åä)\i +ifÎ&6³§#ÿÁÓºây¾93C H¢«ør×Hµ¬ù·ß çÓ#‡m¨5ü lgêzºgÞg²g84zãð]¢XÖÏdxglçÝ/ï•Ä­ «o`ÆAÜׯrEþ  ÐÂÔ2 ˜(Õ&VÇÙkw:„òôë j…•ªÜ—ý›Ä)T!xø éÖÁÆЗIXûÀøé Égn94`jÐsyò•|¶žâ`l22ý˜ÖÀºnÄÎ$u}zZ‘„&»õ×tˆXH“åÌùÔ\´xæ,ì`±ôa3c¼cMŒìj”¯Ì/0†œIÛõKé¾c{³ŸBÂóÿ¿¾&ÕOÜo'þÂ÷”! ÏU²Pö0uNå…{.\äý©Àÿ{©o„endstream +endobj +5078 0 obj << +/Type /Page +/Contents 5079 0 R +/Resources 5077 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5062 0 R >> endobj -2035 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 76.357 512.306 85.379] -/Subtype /Link -/A << /S /GoTo /D (section.32.3) >> +5080 0 obj << +/D [5078 0 R /XYZ 85.039 781.388 null] >> endobj -2036 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 62.807 512.306 71.83] -/Subtype /Link -/A << /S /GoTo /D (section.32.4) >> +1286 0 obj << +/D [5078 0 R /XYZ 85.039 761.463 null] >> endobj -1990 0 obj << -/D [1988 0 R /XYZ 85.039 786.531 null] +5081 0 obj << +/D [5078 0 R /XYZ 85.039 741.134 null] >> endobj -1987 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R >> +1290 0 obj << +/D [5078 0 R /XYZ 85.039 671.875 null] +>> endobj +5082 0 obj << +/D [5078 0 R /XYZ 85.039 650.679 null] +>> endobj +1294 0 obj << +/D [5078 0 R /XYZ 85.039 556.443 null] +>> endobj +5083 0 obj << +/D [5078 0 R /XYZ 85.039 535.45 null] +>> endobj +5084 0 obj << +/D [5078 0 R /XYZ 85.039 374.715 null] +>> endobj +5085 0 obj << +/D [5078 0 R /XYZ 85.039 361.772 null] +>> endobj +5086 0 obj << +/D [5078 0 R /XYZ 85.039 348.223 null] +>> endobj +5077 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2039 0 obj << -/Length 2007 +5089 0 obj << +/Length 3839 /Filter /FlateDecode >> stream -xÚí\[oÚH~çWðV#w®¶ç©J³½¤jw³…ݬÔöÁ'XLiÚþú=g.†!4MH¬Jµ=6cû|ß¹C›þÑf$}ÂU3Œ_rÚì¤yg^7¨½‚4…O‰§^tÏ^¬I‰¯ˆjvÏô%ÝþGï0·Xä‰ÙL[Ÿ»o/» “´…/Ž³|m|üLš}¸ÑÛñ¹Šš°O|ªTsÔ’ûRp{4•kš3_ú­6Â;8ú¯ÕŽ(õàX²°J­nÉîþ|ݹ%Ôxø,„ÝQççM³óáõ3F–§¤Ïqyʹ 5ÚñV[ Háài½NòuÖ¢^ÒjSÏPŽÒxg9÷>àp÷ÍÑÁÀ]‰#Šß•PoA}ª{%b~ÀÅÖ Vµ:ÙäçéÞHòZµöJµ‚RµÞe€gäõP«¾¤ãs£Déh’¼Y‹…Þ7<•Œ.+¢ÎÅÝÊö¡hØ"6r h˜…æ$q+ï6Ô³Ö ²Þ.ª l$«„òÍð1aäú¸cq"ýŒ¬ÃË)0‰ñè4FèB/÷ÍNV ’Üìb¯:æ 7LÑMWc*Á Ò7½Bkƒ1º"ˆh\1 bh§èú³‚ƒ`Â-m ×–=Âû¸—ûM†¥ð–eèÖã9c`PjË¿%z·ï¿¹6.ˆÖ_à3ÆãÐqÁÀ·UÖÞ»2 É{#†Î{¿É¯ 4þ`StЋBÞ‘ËÆŸç>ç‰ÓÐ?cæà¤qð#021˜ó=[aƲÜLºù—ÂlbmÒÀ°ë'·^Ÿ<¶F'^ež:Ø#·.aôqŠnî9Îíé®pró`·éÅ–é%ŸÓK†ô*Ç4a Ërƒª ```·ƒ\Áë€+¸21GÜl>IjYaŽycÇŠ^géS8ÁÈœvxõÙÓ‚Á[áÃSŸÛ0É’ˆùß-³JZ!Ÿ.1KáÞrÉ y32±ŠÈÄ-™´ý! ìé]…t‚ý0ã+9øs3’šLþ›%Só‹‹A26'çƆ‘K±—˜“µäÓÔ²SR3n§ÄÝÙTß«o¦[c¶,«6Ú-Õˆïf°ýp©'·`žXñ’ìôu^«w °ç‰sup0AGiãØÄÚŒ>šµÔ2Ê™)ÇÃÌÕ.p Ë¿ A\]Z9WᶠQñó;H‡X%q$·qä‰ÉN8l2:wãÂX~ çÙlbÔ/ -åc«1½¼ ÿAK‡h ã"™.°½{ˆÇHΣc3dOƒoì¡—üb™¬ËA#3Ëû´—gÓì ý¶{S'¨Jê.zú#&N˜VþþDë‰-\cÌ4L¬ÒĨ5Eéý¬)Šû»@(²|^ÒØ »ŒÇh¾D ö­jÃ+BÃ…‡&B;4ÓáHñäìäzQbmá†ÚÐaRîw½ŒWá}yé}`“RšèKi"õ³³u( 7íÃQ<àÚeUZ —=ÁË[KÔOÎb¬ ]H¤má˜ñ ËÎZÀ–®— I0X˜¤Ì=°Ýᱎ>u,e¢M+;/JæTø8«ü¼’°VlkŸ(ù쉊Zí±ººJ%æ j¥ºNâ÷•êúP@nÐ)F±…¹$ÿ–ö¬w:ÆkbÓ”¶•ª"|\™ìX÷\]vº Sa>–‡«ñ¹|¶ñòávnæ$ýç}³¬Fåîµ&ZK‰ÊÔ8ž¹³¥ªÕ¥:`Ô20ÿ– ˆ.–¡‘!©NåÁp‹bCl0ŒÕ•Í`Ý5›÷Ý—¤âÁâÁïý+ ¹ò•ÅD—œ]‘:ËZÆä£xܳµ-½ÒO/¼µŠÿõ/,Ú̧Œm,KAºÀ¢k˜*˲ÔaV65ðóŸlŒ¡*êeú¿Àå*>µå§L7§ìr*ì@vÝÃDgBJjðv <·¾ñCù)1ª´WH&»¼‚±ÆÐa(Ê/ÓìWßGicýòÍ¡c•@çzÆï2[E6K)M«iLÖßšï”òZ$ƒµ†4í’üH’ÁWÆЭÀ -Ož6Q´ÈÁðZwÆÈÅ£C÷§l Œ¬îJL—k5€; r)`ù‘Á¯˜]ÿ;\·8½îJàn¶P±Lî%ñƒP®ÿûZsPãOc dˆÜŽ!t•…æšK/ó?(È0Lendstream -endobj -2038 0 obj << +xÚ¥koÛFò»…à/GÍåòÙâP¸i¯q›K}µƒÞ¡íZ¤-"©TãþüÍk—¤D)èÃ}ÌîÌÎÎ{¥üS‹$t=.âD¹:Iëí…·x‚™.”@¬d5‚ùöþâêQ°Pž›zéâþqØ'tƒP/îóßœ×o®oï¿ÿe¹ÒZ;*q—«8Nœ×o¯ï–ʹ»y}ý§çº¿Ü¼»_®”sóî†G˜÷··?ãÜ2ÑÎýòû/¾¿·dY„@BŠ4}¼øío‘ý?^x®N“Å3´=WÁôöˆrÃ@K¿º¸»ø—݊炯šcX©ÔMýð<›"呶lòa6pu!›”ò]­üEznèÄ'`RÀ0HkdBž¢Èy‡¢_jÏyÆÿš¥VNû'oÛ²î‹A:ÉzüÆÎ[àYóÔÔÜ{Fˆ†ú ¶š½@½‡¡Ö[þ•ŠÝTó½Ýà¾Ùº/a‹L×¾Æê<bƒ +GÒbÙà%®¯RB{¿)–+?õǦªðK¨/kh>ñÄ?ï𫜟j˜KœçªÈŸhv¾Í:ie-žµ\ãaqÞf¸ä…7z€Oâºæ‘¿]³Ø /ƒõ;FX +È îÑìy°.&ç^ß0È&C‚óª°ŒEÉáþJ‡É™øŽ¯Á÷<[ëª,jœê»¯p1(XtÀ2G°%nõ¦{ÕIJxñ{½ Ep ²ˆj$E„%ÆŸKÐa­†ÛïY†àÌ-à~"´VvÄæ¯v÷¼sàAW†¼ñyñl.erû:pý8”“üî…Þ¡˜©0tcP³,ŽòEÎp¢}ˆ_Fg W#p9=¹ƒ=÷¦ïw_]]uûÝ®i{w[®Û¦k{wÝl¯òâ1ÛW½›u»Ïßtë2ÿû‡‡¯‹zµ\‘³ï¾VIª¼ðôTY«)å" GäÎjHŤFÂ*´A87=›É¬êÌMbo·ƒ›9êزö2~$x0÷ï[ž»Eùh Ú§ƒëÎ*žÉ#]¢!n|ä³ÚéÈ‹Œ6öœî.*ú5êï¦È´„‘Û¨~±hÓÄãYkv«»ÊXk4LЃ(0ô¨¢¥ 4_41ÈgdÎ[·åk'øø—ƒÛ î–eùø 9š’²†Õç;Û¢ß4dCrPÎ3ÑÃ'æ‘5ØjX[ƒ 3¼Ÿ]U#Ëñžð çî30~Ô©Áòo`ÓøAö »d˜Š©Xg²f'Š·FDùyÁfíñxÆP帬üD÷Øv†«Ú‡û¾ûil¿Û†@zìf0FÀðˆÍJ`yvDÞS›õE.Ã5ß²ßÂæ\r«ãÿÏ2 ÄG™øLÀ;:PÁØè:²ž; í‚ÝÍœ”EUÙüi‚-ñ®³‡ª`E¹KIîP¡XÑÆ/á¨1´ €Hm…:–_˜Ú‘¢‘¤íDÍßåwÐÿùŽÁXLÉù}†áKTzAÎÌÿêHC:J‹ì†;žWÚ78†ï±é’ W¯HëKžxó½j_xáÕ73̺FÒRñɹÑ\Ú1Ñ»Ž»H %~L´G»µE?øU˜#ÀQrÌ0`äÇèι”4Ç;pm‚@YÇ rûæ^³\dÍ„9×õI•/>³ +ÕF ‘¬À# «*»ž[H©ŽÁ¸|ζ»jDN’™‚É‘©†žH Bó™cG b¥Y¸´{4uõÂëqYËm4ëÔð?\9Õp¹#tå,qHrgŽò·~æfŸé(´çF.?€ýIFÞÝ»<Ì^ãtœÜ½‡ +sÛ<°Î¼0hÇ&µ`ˆf°8-ÏS´•ìAÁqò'Ð`Ëßí› ¡ˆe>¬ø…OÔì‘kFv|®ŸÊ~IwëÐyà)¯\ žÎ¸ÛퟞxKyôl»ë +(qÎd ã]gÉÃ2ÚÙ2†Ü–O›àºáe1÷ †Á4fg,ÇgjñžCänW‘©É$^ƒ1’Iø>o22· CÒœ±˜r¬·ÏÈ8¼0xÞð-T)[Œœ‘,+ ‹ 5YlXö|±=Š)Æ'b–­ù;³l Ú©têÐpîS™I®˜mqχì•1¡ÊÙK€t@1,³ÄÑ«‡¬³QZPC@âÈŽ¥ÃÈㄪž®A»-qü$…#kÏõ’XŒv³¹ýÍu vŒ4Zhhƒi®É&ãìU^KC¾—¿+à_—m²õ~×AB÷©hq¨¬›¾Xû¢®nn¿»»”¥g$éOQþŸDÜ õË_Â|`‹Å]Æ›¢ŸÏ¡¥uçUi|€È)|­JÐ~"7Ó€6¨‹A¦³6Û’Ÿ±GŸä?^ä&a²T9Ëla@VŒ­6%ƒgD!:Ä,AÏaClSŽêÔ‚hŒ-/ª¢·Vf`¨5>&Ä5ÞÇÄI¢q\Ÿ˜eÉSüÖX˜3¬abÍÇ#d~àZŸE& ‡È8ïcdÑ©”ÅH¦¶’Qp}âØ:‰ÝèD^iÏ=:}pD'¯Oü,>sôC|³gã«AøÅ\f'íü)Äë}I)F@g8 @Är†±ëÁg +ÌÂDG³<|†ø±iÆ÷áÀ œS[-š­ÕY†E »¾þà3  bØË1¿´Gñy|s„ï€_þ„rŠvXUN‡l^ÄÌpífȲæÅk±ƒ¥¹¡N¸ø‰åƒCAWéóäßa&áß[“êè4q°”ìÌm…˜ÜñTÆSRÊrèƒIˆRIC? »YýÊúɬÂÌòSÙì;˜M<Šnêü ®(©Žs‹µø!”Ÿ fWfÕX4P²Ÿ7%åÇ\zÑ +n=˹1êd@H›e«àØhÀXNò?qL`“·ôšGlQÚX¥Y¥mŽ#œâo›±•åðYùÎcÛlOI»¼Ò0í­¯/pÜ5ö7ÒÅvÖ1¼dÚÓ¤­?~ÃÑÎë÷xˆ;)·ãFXç&®‡“«‚( +ÍUqøx(d¾@pEÒŸœÂ–˜rž+ªr[ÖY?6$vùºA )PûçÆyMn[x"2—ø¤äqš ߢmMÒ ½¼$#×àEj(8&ÎgÒ…HÙzÞÎÊ8¬£ªžË¹0ä…G»MCž6çnÝôÜ°åvÞïoLd_à鉿›âؾï»B{Õ<=1!˜}ÕTÔ9eµTêz¡þ‚Õ€ÎX-ú’Õ:‡ÐX­C|³Vk„odµ|ÇçÏ3’ɤŸ¹?q~¶ì6ó B¤ÂS†ævÎÌÄ¡§¼Sæ%Å2ÙÆ=Ç&/VáÃhb¦)wbˆîEb¿-÷9~Áêrgª»+”ü´ÏT‚Üœ3fAʘ•su7Vqpéñƒxò"3*8)û&¨@'MmRÖŽ dØXÛ%FÓØÈ­9ŸóGQBy_ú–¼F?#>ÈF”Øf;#ysGgq.$^õSP“d°’5=ú%†Ã1Ï8ÂkZ>¦#…À[ l±ÕPúôÌ$%Msõî±/²ï‹0F$W*Žb< Ü|,šv ˜—ÝzßYoŠCEÖBÈ,„ð+Ì‘}³Á›j‡½¥N ÿ¢”L7âhôizO9 ñØA¡!Ó*–KÁ +Y†'È»íR㯠Žo1‚LÈ=ͳlÅòã Àš·åAå“3‡¨GÕTìg¤¦ÍJBˆºj²|xüä\î> ü£»çúš<ÏñÏ9ÊQÈlë±è«_sÜû¼±¼ƒÊœ¸ gâôL•Øà«šñ“ÞI£tìÆarÞÅŒ€N»ôs¡¸˜#|s.fŒÏº˜”QógH³±g˜ˆmJ©1î¹?—‚ò´CßM)»Œ­,ÎPhª~8xÓªiÏWŠûŒ_N‚È>¬Ï¼Œ61i”À>B‘@sòJN!l œIXèq…Ä·7Ê·`M— Ï\à +“ ?À%öÚì$¶f½:¿ðÔ0“‡ý™GkŠº%¹(ð¹{ÿåO×ØI ãÓ!ÝY—yÁÓöDqæŸñ cöíÅØNüÍ î=”_p§ Ã…NÉ¿Ö6—¢—+˜1?Õ:2—¦ê¾nömg_ç ×4§&”`sjPŒÍÄ£yó±@’ŒÐRÈï Ø6E®Ž‚IHÊ”²Ãñ)¿Á ø—0‰¤%\ß0ï'Îð€?†©MZ9ª~ËRîÑì)Ì…á/çv“4øSá^ß·.»c¬ø‹ +úV¶BA6›/‰x œ}>¶?Šˆ¼ƒ2‰Sçã¾ØÜäGÊÔ¹”ˆ‹]à ŒÎ>²]âû^š +‘ÇÇt`â=0$8"zBði¤‚À„¿^Ja«%ä_·Ð%Fzü“¦¢æ¡=ýü§:šÌ¾YÎùiÈçÀ†óM\ßâ6¿Îÿp.MÍO_ÍlÁ¼q÷ÆÉÃaõNHƒNÕîxt:<—¾BÓŒˆ4ííÚRýgCŒhb0wäÊîI:8óÛS ÍVˆ¼…ÜÎ_ú-°ýý*ª“>Qf +}Ÿ~¶Ê´ÐoxSuôK@€ËÕÇÿÌtí5endstream +endobj +5088 0 obj << /Type /Page -/Contents 2039 0 R -/Resources 2037 0 R +/Contents 5089 0 R +/Resources 5087 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1836 0 R -/Annots [ 2041 0 R 2042 0 R 2043 0 R 2044 0 R 2045 0 R 2046 0 R 2047 0 R 2048 0 R 2049 0 R 2050 0 R 2051 0 R 2052 0 R 2053 0 R 2054 0 R 2055 0 R 2056 0 R 2057 0 R 2058 0 R 2059 0 R 2060 0 R 2061 0 R 2062 0 R 2063 0 R 2064 0 R 2065 0 R 2066 0 R 2067 0 R 2068 0 R 2069 0 R 2070 0 R 2071 0 R 2072 0 R 2073 0 R 2074 0 R 2075 0 R 2076 0 R 2077 0 R 2078 0 R 2079 0 R 2080 0 R 2081 0 R 2082 0 R 2083 0 R 2084 0 R 2085 0 R ] ->> endobj -2041 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 754.651 512.306 763.674] -/Subtype /Link -/A << /S /GoTo /D (section.32.5) >> +/Parent 5062 0 R +/Annots [ 5092 0 R ] >> endobj -2042 0 obj << +5092 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] -/Subtype /Link -/A << /S /GoTo /D (subsection.32.5.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [154.728 677.397 512.306 690.299] +/Subtype/Link/A<> >> endobj -2043 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 727.553 512.306 736.575] -/Subtype /Link -/A << /S /GoTo /D (section.32.6) >> +5090 0 obj << +/D [5088 0 R /XYZ 85.039 781.388 null] >> endobj -2044 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] -/Subtype /Link -/A << /S /GoTo /D (subsection.32.6.1) >> +1298 0 obj << +/D [5088 0 R /XYZ 85.039 761.463 null] >> endobj -2045 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 700.454 512.306 709.477] -/Subtype /Link -/A << /S /GoTo /D (subsection.32.6.2) >> +5091 0 obj << +/D [5088 0 R /XYZ 85.039 721.768 null] >> endobj -2046 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 675.996 512.306 685.564] -/Subtype /Link -/A << /S /GoTo /D (chapter.33) >> +5087 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F14 2895 0 R /F56 2890 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2047 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 662.447 512.306 671.469] -/Subtype /Link -/A << /S /GoTo /D (section.33.1) >> +5095 0 obj << +/Length 3827 +/Filter /FlateDecode +>> +stream +xÚ¥Zmoã6þž_‘ ¨ÔZ½¿´¸Û½¾¤h·¹nŠ½Ã¶Kqt±-W’7É¿¿yf†”lÉIC‹"‡äœ—g†òÏ=úóϳØõÂü<Í|7̲óåæÌ;_QË÷g¾R,”d1¢ùææìÍwItî{nîåç7wÃ8±ÅáùMùÉy÷ÃÛë›o½\„aèø™{¹HÓÌy÷ÓÛ—¾óáêÝÛŸÐ9×ôúëÕû›Ë…ï\½ÿ^èAóÛõõ/h»ÌBçæò›Ͼ½±lÙ ‰…<ýyöéï¼$þ<óÜ0ÏΩì¹>5oΈ)7ŽB}_Ÿ}8û—JÚ¢sé5·q˜¹qN÷ÀG{àûúÁy{nìE¼ Ÿv´‚¶Þ^™ÓSñïÐú¢Ì)ÛšÞ>£ºÂÂ[©n©’ßw—‹ ušePöMû,$Í<±CÅæ’¨nQ¢í²Üy»îš/‰ œ®Ù w¥ä ÍœÛB^e涫›m'5;æ¨QFúfL'úŽ°ÓlÑ–:¡ëáTh‹>v0ç·ÕŸ{"­Ûª$2?s +yØ¥-x”¾@E/m¼&?•ñuMX)ÕÅ]_µBÙßË0¡Ÿ;vks§·›Häõ¶ë‹õZûn• ìþ}%å¹Ý'Ú=F\7E‰ h3Ìl²úǺ“ .Ú²EòÌD˶ÞéúHš÷bw–Ê˳¼Ð •Ö/Ñmã eY2bÉ Õ#ê²ÁÛãˆašÀ—†Gì^ƒX—Rsñ¨×.³­ÒʼÇÌúlÅv æsÏ?ZÜBH¤˜¢{–ÚGÌ[˜% ‡’Ét½ÔÞYâ1us¨ÌDOµ‘¥¾²3³ Ð8ÅVÞ™->H$0d£çµã§i¤—H¯¨í–º¯UÏéç½À±ò…òºYA¬ƒ,=%®_‚×ûj‰óz¨±¶•4°Ä¢ð_ªÛw: íƒù”÷ÒjÖŒdòȪq–uŽßXm¶¹Ð¥ä1Ÿ)žxd"™Ë}+uÕHmž•¼Þ€•<®ã±7sV­TÐövRâù¾¦CóhÇú/„[l9‚êúγ‹-‘M’ÉTÆr8]5N‚å“žj'ϱl¶¥áº3Uèæ^µº}ɦ˜¶©XË r¸ª°Êÿ“ŽVÀË}Ý©h™ö«c·f|H殳ÞÈÐ,FDâÆÙ27I;’l‹ŸNf #×_žPH¦óx?jŒ³ø`¾+Xƒ(qv{³!ä6DQ¥'],­›JFÖÍ#ßɆꬰ³YÛ¯u†®êÉzsQ«`Õ¡÷}³!!_’€é…öV™nµz,¾#Ù{)–ÂwÜ“GGO/_9ºè…£S¢×Žî¥ ÍÑÏ7{t£ùptA»Ã>QMh+U©Fù‚j±±æduò§º‰ÝòN[Wo¥¨§ÚÈ›˜WªTó %bb&kÙj+IM»Š ªZñ8âüÀ΃š£ÜáP˜G’x`‡w—! ­8Â$%³Ù@šNðè‘ÝÒ—yhN³Q¸qY0DÓ½ù.NF”…ÄiNCƒ„TA¬¥v8~4|â¹I’h§¥˜ü _²ãËBÝÄ-[8uÚ[­ö¢ÒL:¤ŒF©_w_Á† æ(6C«x±TÀF³j õ3Õ“X,†.:[VÚ/ŠôñVAK†h‚ò r®ŒDS3l~FdBj +!8HÆë-ôâYÊ-¦Ün‰fj5ý(¿½þ(C݉O¤ªBËu=¸CT¯ +…÷:Šb”;(d¬qü4cpÔ\¨qÁ²âTÅÔhZ&Œ¡Pt”ú{m;ð~ÜÒÈSO”Ãuz5àÇÆsꔸSñ‡ë²3c¯³Ží…¶ºl©ÛʪÁ¬qH‘S“9Ö«¹´~`d;ÕÒyfåW7_k5…Ój·±î¯î›VãʪgsÅÜ°äP2M3ðlË‚„R]Ъ}p{ÑuƒÌÜÈûX§†ÒnÈÒ¡G™Æt”TþèJÃÕÝ”@¡ @‡Ž•9T‰Gëñºzµ©/Ól¥s!ÆqÅ1oìé¥Ö'[ .ˆSbD"£Lr 0Æþ4¨ˆÅõ÷ ©ö«{©{lë^Ьô[6­5:Ëþh,Úo;鬒ÐÖ8KP² ¢†uµ’xçYÞùìž»¾âMë8uK¼›l‰uß¿{šf?æõ®(¡ogÌqDǬ5³Tx§ç¦áÔdYgYµÚÔa ܈ÔÒ`¡3’óÉŒU@RCd·aMám©±[ÑÀÐ÷u¶¼I&Žë0½±½1—7 1"^ S'*ªZK©Vµ‡ÃÙR«E•T¶Ì{"¢T%òDïG ^›O$šF™;JÕJ¥ìŒjEƒýöþêß3G<¶f +eö·Ãžÿí QrÿE 0œ†)d)Ý4Ï,L ¦ü\“·”@…xL.Þ­É +CÍ—E\H5ŒšxÎw¡{" Ku[,ÂSk S×óò—3Ðœ4¡»Q” Ù Îå\$»½”š‹÷7š¨f3dQ:BÛ8;Î7r—£4-È6MÐä"6É]ôº×©Q¦€Eú‰Kå0J­§P¶&µ+À0¤•SÓs>Ï¡ûAª;àLc¤È ÜÀ}’º¶Zk®·â(?f»Xˆê…|ŠG0ø ³&‹•˜…k(ˆ•0•#lFQÅaþ£Ú8ùÌC›ÈÅŠ8ì âhöërf­ÖOGQ ©Ãžßü!‹±±ˆMÛu;AŒK3¡h=ºàíNŠ6JÁ ç>l:Öl,‚þ¹‚êsÝ(Üì)?×Kå +ÒŽAº¾ÙIÉB#ãmPYV»ÁÛcüydøEQ&'ˆ ˆž†o>wTvé9êÁ\:ßaKàq"BD²ï+´—Ë!t³ÇŽ—B¯žê®7™kT0†,É<=g t«ÍðõÝ!_Ó‘„KÌÉýØä¡sñ‘7):¥› ë¦a/Ì#±÷Ô®“·òvˆ…QC*¡ŽrãzNXg¯…œñM®"Û´æ®#ƒHÏb;^üíÐ3öËœëuUt ìbø†t¶S¡Ø‰>‰;`©Jt³˜1‚a Îbs™`žj~øËÿH#0~ÿEº¼#®–æ2ƒôœÃ¢ ö(wæ¤þÃr³×Û«b;Ü6 Ê1J¹y:$vô÷VŪùœho‡Ø}| ÚÕ·ëãK6›x/ÚºÑÌúI¶oÄ=qîâdž=ðSò¯$kGD§“µ†è•dí‹j²v2ß\²v<Ÿ=Š ¥0§²#ÕkškVúT>K {—RËÐÕ;”43qb. 'Ȉõ5J0²kk?s&wß1“y:„a|O´ãé ›‡ìâ8DÏ™Û_T›HTLÉ—È.¤í¯ #è φ­%²c¦k<ŒBYvךÚe»s1º2‚ìo%õ+tÛ•éc¯&w6ò¬Ê“·~š¸9aþDtZð Ñ+‚ÿâ„*ø“ùæ<‡¦T¬ÆþHô8 åH“ ±Óz\a˜¨g¾ŒåN‘D—1ZØrS¿ì> å¨ýÞ Œ§×óñŒpOø¤Y×òE*[Îd1õ°ÊÀ8Ã)\æOo~þÁT2»q‚sÈ&ab¢Ç‘©ó>-@™ZLTó²€kI„ÿ!U®ë^šø?²£[¢ݬAúy;±úŽ.-P1Nañ Tˆ9t-GB†u s[Cý­3餻¹/å9ôôP?gS0,x¢ý4&ÀÇc¨T÷2³$¾ˆª¬jQfTZ±0@ZОG¡ø¹™ýð³ÕÝ©Å`6µEÿ2Úÿõ«M‘|fá‰ün,ßð¹¾<8æ×|;aøPܯSendstream +endobj +5094 0 obj << +/Type /Page +/Contents 5095 0 R +/Resources 5093 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5062 0 R >> endobj -2048 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 648.897 512.306 657.92] -/Subtype /Link -/A << /S /GoTo /D (section.33.2) >> +5096 0 obj << +/D [5094 0 R /XYZ 85.039 781.388 null] >> endobj -2049 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 621.799 512.306 630.822] -/Subtype /Link -/A << /S /GoTo /D (subsection.33.2.1) >> +1302 0 obj << +/D [5094 0 R /XYZ 85.039 522.122 null] >> endobj -2050 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 594.701 512.306 603.724] -/Subtype /Link -/A << /S /GoTo /D (subsection.33.2.2) >> +5097 0 obj << +/D [5094 0 R /XYZ 85.039 493.324 null] >> endobj -2051 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 567.602 512.306 576.625] -/Subtype /Link -/A << /S /GoTo /D (subsection.33.2.3) >> +1306 0 obj << +/D [5094 0 R /XYZ 85.039 355.61 null] >> endobj -2052 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 554.053 512.306 563.076] -/Subtype /Link -/A << /S /GoTo /D (subsection.33.2.4) >> +5098 0 obj << +/D [5094 0 R /XYZ 85.039 326.206 null] >> endobj -2053 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 540.504 512.306 549.527] -/Subtype /Link -/A << /S /GoTo /D (section.33.3) >> +5093 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2054 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 526.955 512.306 535.978] -/Subtype /Link -/A << /S /GoTo /D (subsection.33.3.1) >> +5101 0 obj << +/Length 2373 +/Filter /FlateDecode +>> +stream +xÚ¥Y_“›FßO¡s¥*¨Êb™AKy£­ø7GJƒ”6Y¯y/áŸg¢¥Õ8ˆœ]ƒ{Ú‰_™–Ö@Ê¿!)«­$xê䶫Œ_6ÄÊÄï¾òf³Jj¡/ªúèÔM?³“ÆDœ +×%:ü^»ŒÉÎ=²V[dÓžó˜øü‚Ò´ï¬@VÅæAdjBŒRß„îפ×YÃ<;$ >äØxŸ©C§i«šü©™©äe»bg#Ë›gX? ”Ú»õÞð¤ÐvÌâ"'EEêlNjV¨Ö~ÀÎj9c|p(0Ô‡úÎ[”: ]*¨¦*Pƒ©qªN¶p +Χ‡¶%•— ¿”)SéÒï.å÷p%²am„uÿÆèíå„O“c×I›‰pÊþw@ø {–’]S/v#þM˜®d 0ý]^;°ËÀÓó3°wÞÞXèuÊ;|HØ[¼ƒ>U¡ïù²NZö>Ñɉ¯#È|ohÈíÏêH‡0ü +Ak<®¥l³ºqÓlÁÌG +O74‘ðRÐN>¤2é·:PÊlÇ " âÍ[Üšv|¹˜n¬ôQÏ·µ‰Îþ ‚Ì.×{^‘}Õ…¶yUò&ZDr˜Ê¸TÎO§½. aýL0“ä(!ðbÅÁß»Ù3ËkEH^6yð€Â zo¤×=€h²’òF{žö"µ§(«ë"!Ô'¡Ñœ+¹Käžã-#»EÜm èü %rlÎ.a)ÐJ~‹¸ñþòι1:Ù:P@õ†¹™=?¾ QðÑŠcm$@=(ËbØ0ᤢ@ó]b½Ÿ¯ó̆><'íç ɉ㆒¸_/…áÓQj2óäÀM©©†RSxÐUÛn~¸½Í J’Æm ~Ì3(EËÌ-³ööT)”Õ}¥NP¢c9Ue%B¸¾OªPýS|Sðkœì5)6ë Ë•2ýû j²n*^QÀá"Í›ù¶!³£A  aÂm¨ÈÌ/ rm›dI®ŽñrÛ°ýæþóì‘EÏzõ|2$¤o8&æ¾ã^hïBðçùWûÒù5ªv•ɯRL P±ЋÃxz9³í Å{³Ê9­B0ƒà‘¡ë¡„Š§<§.‚Wr#ìç%3߉ˆ“Þu­AÍ&"f|ì홉¬“¦€‰Ü5x‡;»à3…nôBIêœÒã¶Î)°XšÂç1 ¥dð.GôÃ4ÜP/Âb€â씬ÝÚ J)å}ªJqœäÍù…µYUu»¦ž0õR¥à.õuc|ø¯Ñ2 ’DÓÅ¥?âD …ï×—_Ó´JÁ«óÀß„ìš³&؇+Ý·„µÆM;®`Øab&o|Ë;Fudð¤ÅåÞÖÌlèP™´‰†^?⮶¶—Wò©GyÙ3ÛÕ$˦µtÚv¼À"=¯³„ibŸ@0†/–Ž†>–€ÛŸú¥¨m&Å=­ÊÃDÀñh;‚Œ£º“~Ä{Æ0¾¨ÀyÙ¦C!¯aBí¦ÙyEyT$4á]ªÊDnp½‹8°\®êP'ôq¤NüsßÕì ‰ü³z‘.b™u‡‡fÃe»fj3©¾Œ×!w«lð%Û­¦ø}¨å–e?ŽçíI½œé‹5W9[qÖUCwÁoʃfùzÞã¹\r83šú'%ÛšÙ¹—s;0xµ}gÛ ¸Hƒâ0ÆïÜÑô†ÞiöÍQ²ÍS)¥=gˆ´KÝG6¨{ÞØ µu@Á>¨‰ÐkñÀ¡9ˆ‚n›På<ÈE]-¡ë&@±úÃNW™m[Væ§ßL¸_•n×,¸á̺ÇEU FÍTÐlER.¿üW¶mLRi/1¾*þ•Ö?‰JkéØNYiF`XG·q†‡}8€úçuu­ Äjp €dŒ§Âv„cì¾MRwcÉdðÜ ŠoøÏzÿ_\84fÊT<œ$&ÜÀït!p‰Õ©¾FE®‰Ô¹Âÿ@  endstream +endobj +5100 0 obj << +/Type /Page +/Contents 5101 0 R +/Resources 5099 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5108 0 R +/Annots [ 5103 0 R ] >> endobj -2055 0 obj << +5103 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 513.406 512.306 522.428] -/Subtype /Link -/A << /S /GoTo /D (subsection.33.3.2) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 652.239 323.852 664.232] +/Subtype/Link/A<> >> endobj -2056 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 499.856 512.306 508.879] -/Subtype /Link -/A << /S /GoTo /D (subsection.33.3.3) >> +5102 0 obj << +/D [5100 0 R /XYZ 85.039 781.388 null] >> endobj -2057 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 486.307 512.306 495.33] -/Subtype /Link -/A << /S /GoTo /D (subsection.33.3.4) >> +1310 0 obj << +/D [5100 0 R /XYZ 85.039 610.001 null] >> endobj -2058 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 472.758 512.306 481.781] -/Subtype /Link -/A << /S /GoTo /D (subsection.33.3.5) >> +5104 0 obj << +/D [5100 0 R /XYZ 85.039 565.453 null] >> endobj -2059 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 459.209 512.306 468.232] -/Subtype /Link -/A << /S /GoTo /D (subsection.33.3.6) >> +1314 0 obj << +/D [5100 0 R /XYZ 85.039 533.344 null] >> endobj -2060 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 445.66 512.306 454.682] -/Subtype /Link -/A << /S /GoTo /D (section.33.4) >> +5105 0 obj << +/D [5100 0 R /XYZ 85.039 506.729 null] >> endobj -2061 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 432.11 512.306 441.133] -/Subtype /Link -/A << /S /GoTo /D (subsection.33.4.1) >> +1318 0 obj << +/D [5100 0 R /XYZ 85.039 464.366 null] >> endobj -2062 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 418.561 512.306 427.584] -/Subtype /Link -/A << /S /GoTo /D (section.33.5) >> +5106 0 obj << +/D [5100 0 R /XYZ 85.039 441.048 null] >> endobj -2063 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 405.012 512.306 414.035] -/Subtype /Link -/A << /S /GoTo /D (section.33.6) >> +1322 0 obj << +/D [5100 0 R /XYZ 85.039 358.24 null] >> endobj -2064 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 380.554 512.306 390.122] -/Subtype /Link -/A << /S /GoTo /D (chapter.34) >> +5107 0 obj << +/D [5100 0 R /XYZ 85.039 323.096 null] >> endobj -2065 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 367.004 512.306 376.027] -/Subtype /Link -/A << /S /GoTo /D (section.34.1) >> +5099 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F56 2890 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2066 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 353.455 512.306 362.478] -/Subtype /Link -/A << /S /GoTo /D (subsection.34.1.1) >> +5111 0 obj << +/Length 3503 +/Filter /FlateDecode +>> +stream +xÚ…ZYsÛF~÷¯Ðê%P•…à\©Ú‡Ø±³JÖ±+–+›}‰H0hYÿ~»ûëÁA‘J¹Êœ£§§»§o(¼è_x‘'~Yúqž_¬¶¯‚‹5íüü*T“Ä~b Ol^»Ýë4ò“„Ñ;®³°ðc2Ì›ÛWß¿‚‹(ðÓ4¾¸½¿ÃÈÃè"-Œobsq[þÇ#ø«ë$ ¼·W¡÷åÓç«ë8ͼO4é®®C¯¦Án¨wk¬>ì÷4 +½öŠþë¬Ö;ݵ[¿³˜Å~põßÛ_^½»ÉT*Ó"ðMx’‘àâ:Šý8‹_ä2M3’„™sâ;]pIb £Âq2Ÿ¦ðnvC× +åa5Ôíî‘zü4‘aàçÁßiˆŽ(]úE’,ˆŒrâ6Ÿz¡¾È{–qe~‡CWõ,ÖÔ³;ž—˜¼áqµ«þ B3ôç8Ñ;^$v‚bÃä‚X,‚bAlùY½¹ÝTL‚!½!Úí¶ÝaþeG,Ôß0ùÔñdwåÞ€•Ï´ðÔó™¡ÚbéÏ y¦)QøQ1])´óF·Vˆßg\8èëøs6Žq2oYåÂÏã|y÷‘ÜÌË7câ‰Û|oHV^5ñî®®£Ì«X.«v+¯ + ¯,;YgQ>aq/ÐíþÐ0ŠŽõ%N½›ÛwlµkŒÿ é¾1—¤·Eæ'¤”×!ù”D*/"¯uw ÿÙ0˜´ŒÌ¿e<‰¼~Sï±Ì§,Z…6UÝaXV÷–ñ4æûN<‰(B½SòßS?w[QúÂ{s˜ð-o­|Ò‹eÝ+Š¡ÆiÉ +“¸30}°{b‘åÞöŠGwÖ+Û`…/!ˆ¶!L”z¿µ,yËâmô$_Ë¿—ÿ;ŒòÂÊ#ßÐvý%Ï èsèÝ2Èð‹ûý$Ä´û¦èpâqY$åŒ úídcm»iËÑÀçãS!FÈN ½gïò®±+¾ÿ穪œ<î·Ë×4)ïqS ÈGèAŸ\òv÷Ý€õG–"?J!2 }H1ñ•æ¦jú­¢º ºiUxâë9ráæAw>þêcKÜ*oš¬å9ãÃÆI—EG*C¿?M= `â(!«"Èö®q§¶¯y=áyÒãÝtj-ËW˜¶»JÑàˆ]\h°Ä´uJNãÇMåÈsÐP.ÛM@e%V¹^#3+¼éŸàúǦgq£4Cÿ‰D#+& + âm?`Ö9Wªx[Þ²ªœŒ %•èë^qì·UÕ4•sò¼,’¬£ÒpŧÙù[1ANx¥eÇœÝ).ë¢ó‡ñ7y†çgûŒY§êm=T%v,Öà8ÉÅÎj‰P¹·u‰‘œ~%†}á¤ç³‚X)œF»‰ób®ˆ¹ç~Qê`< C4Õù*§Gm0µ”)Š^x»©TßXàt§2Ïf)(#$á¾ Ÿ±AòÉØr8q©ëÎî7Nü3ýؤ~F/ö?f0ç›5DƒŸæÉ¢Yi³æã×Jf_ùÙɺϢ^$e‚9ߊ¡¼ÃŠp\M?I‰¿º`Ã%9K÷–e« %ÆÒú<ÕÅF¯Y,ÜWMr˜ýÕÖOJnô»ÚâG›°]„·èyYÐñVµƒÎÐUÏõ¡Ÿ5 ÷\†Ç“ù­5Çx^|t}L61ƒ6vv³ô‚ç7\|kJ}ÿ>Mç=¤ ó)"¢˜˜›Yþ®âÛ©:ýD¼! av•pVÖòÏJÆ .4Êü Š¡¶ +ò¤ b”—§q£娈‰ò¹SÇW­é\¸‰0ݼsm‰÷X8Ãd‘úy>ã1Bït×Z{°ø’ˆr-ÔBcϨúê0{ϳ¶%P@ùQΪ](³R/1: §g4Û“î NåHH9sñƒ—¤ÞJŒ)#%&ÏÔ·Äú˜MmÛ¡’Ü#AsH¡±6K¨hhž”qZbq¡ÅÒãXÞ¹û9ž ûHðº ûºþz6 +NN9@$0°;h©p-Ö"’¯àª)Úº®€œ^MÝ‚ž£•®@’:£Â`Y[ë}ÝÔ´l«:íÔ© ˜8!Ý€-KTÀ­.ÔJZz݉àAÙçxPúyä³ »‰éÍÊ[S¯Ãxý¬Òál¬®•··x½’¬[?¹Á@™£„/‹~>ĤpÆ›ï˜ËÜ[•è nJí4­>L‰Xx皣4Ž;YŒ8@J6 +l¯±ÛÔcµLáôWÚþéÝw=öZô5„ÙÇMÕlÙ¦;ãi@Þ/¾ˆâÈÏŠôoºòúz~¢G~„“9ýõ'öTŸæ‘éˆò•hAÉñw3…yùþcL“†ëÈSŸ\ÔÜÕjZÍŽ®iÆrAºÑdÌ]åÒ`ö}÷ø½ìì˜)]bi?k +Tžfõ¨«¸Ÿ{¿}|‰Îó8%æ#c‰)j®]ßXUzýÞ€®ñ³ÊUUkr0h¥cOÿ²GG¨.±1Ïæ)x¬ñ¤ö+I‰ÆòƒÎL5ƒ*·BK¶ +FÄ¿+¡K¢U{•§£*š\+Úã´˜„ +œv KÑ«¿É(acâpôè°+^AÇ[Ø’ãhêOz*ò¹Bªî-|/ôõ¶nl\H†Ù Ú»ºª—@‚“ô +ãŠä¡º\¤Ýýß°‡¯K[mñUm7©i:¦Sc¨’¯¤‘÷‘}@Vía¬²*v$™AÝDˆ§xBi*È'JüèûóN)âqánphÇÑ÷—¦Mé®gû’ó%î“$èc&é¼K0Ðûþƒò©0ÄÛÔô¬º²#[†{È•"Õ<ÊÏËÞ‚,'íÄj«Øåýh^}Û‹kèt3GÑîtu z^â‘þ³u¬Ç^&¹ë·ccÕð±¦X$c´§U%>è±Ó*„ŠjQðŠèiS/{B +ýµ¶ð7Z¿³çª¯üja^¬x&ó_óÃ0óÃhüPé×ü7è˜1[+Õ:'ºnާƟ$ˆ;NGÏÄú¿üƒØÂF˜¨¸x™“ æ|íVP ÉÒ3a´5 /,³(Z¿¹(f_tª£ZWßñÚ’pÇ 2ŠÐORÍ·ûíOÊv"1O?ÌŒƒ«Æ¦È~IÀ¨˜ò_}È€cíA¼§¶=†Nš E?‹Í¶E± y ˆß8ô¾!~OŸ{x{ìKÀPi{{¿-@`Úƒ~7‘Ùø\qêk4£ø'Ž_£öŠzÌ +Íò¬óä²áöSCâ:£`u¦iN¥"®ºZcð5 aeŽ|Ÿ YÆ q§Ÿ¹Ÿ_1¼8¦Æ8W‡”;%ÿš5É—]À^Ùd.h©M”%~:} .ûòœæ¤!•´…ƒœ»²é“9”DϽžÐîÚ‰÷°+žÎª=,t%9•ÊDºÌ㧪1Ë“›ôø#®1‹*]Û`±Ö‡èúif.ï#ò;cm1õÙh_ÚïC»ÜÔErƧs "þ•¹‹9ß&r§þì$öÓÈ!ƒÇ4Ç&qî'y|þÆÿËaendstream +endobj +5110 0 obj << +/Type /Page +/Contents 5111 0 R +/Resources 5109 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5108 0 R +/Annots [ 5115 0 R 5117 0 R ] >> endobj -2067 0 obj << +5115 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 339.906 512.306 348.929] -/Subtype /Link -/A << /S /GoTo /D (subsection.34.1.2) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [279.296 604.06 310.834 616.962] +/Subtype/Link/A<> >> endobj -2068 0 obj << +5117 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 326.357 512.306 335.38] -/Subtype /Link -/A << /S /GoTo /D (subsection.34.1.3) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [359.407 229.072 410.369 241.974] +/Subtype/Link/A<> >> endobj -2069 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 312.808 512.306 321.83] -/Subtype /Link -/A << /S /GoTo /D (subsection.34.1.4) >> +5112 0 obj << +/D [5110 0 R /XYZ 85.039 781.388 null] >> endobj -2070 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 299.258 512.306 308.281] -/Subtype /Link -/A << /S /GoTo /D (subsection.34.1.5) >> +1326 0 obj << +/D [5110 0 R /XYZ 85.039 761.463 null] >> endobj -2071 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 285.709 512.306 294.732] -/Subtype /Link -/A << /S /GoTo /D (subsection.34.1.6) >> +3021 0 obj << +/D [5110 0 R /XYZ 85.039 667.044 null] >> endobj -2072 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 272.16 512.306 281.183] -/Subtype /Link -/A << /S /GoTo /D (subsection.34.1.7) >> +1330 0 obj << +/D [5110 0 R /XYZ 85.039 667.044 null] >> endobj -2073 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 258.611 512.306 267.634] -/Subtype /Link -/A << /S /GoTo /D (subsection.34.1.8) >> +5113 0 obj << +/D [5110 0 R /XYZ 85.039 642.326 null] >> endobj -2074 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 245.062 512.306 254.084] -/Subtype /Link -/A << /S /GoTo /D (subsection.34.1.9) >> +1334 0 obj << +/D [5110 0 R /XYZ 85.039 642.326 null] >> endobj -2075 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 231.512 512.306 240.535] -/Subtype /Link -/A << /S /GoTo /D (subsection.34.1.10) >> +5114 0 obj << +/D [5110 0 R /XYZ 85.039 621.333 null] >> endobj -2076 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 207.054 512.306 216.622] -/Subtype /Link -/A << /S /GoTo /D (chapter.35) >> +1338 0 obj << +/D [5110 0 R /XYZ 85.039 346.512 null] >> endobj -2077 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 193.505 512.306 202.528] -/Subtype /Link -/A << /S /GoTo /D (section.35.1) >> +5116 0 obj << +/D [5110 0 R /XYZ 85.039 327.64 null] >> endobj -2078 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 179.956 512.306 188.979] -/Subtype /Link -/A << /S /GoTo /D (section.35.2) >> +1342 0 obj << +/D [5110 0 R /XYZ 85.039 132.94 null] >> endobj -2079 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 166.407 512.306 175.429] -/Subtype /Link -/A << /S /GoTo /D (section.35.3) >> +5118 0 obj << +/D [5110 0 R /XYZ 85.039 103.536 null] >> endobj -2080 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 152.857 512.306 161.88] -/Subtype /Link -/A << /S /GoTo /D (section.35.4) >> +5109 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2081 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 139.308 512.306 148.331] -/Subtype /Link -/A << /S /GoTo /D (section.35.5) >> +5121 0 obj << +/Length 3127 +/Filter /FlateDecode +>> +stream +xÚ¥ZëoÛFÿî¿BÅ}8 +ˆ(î.—R i›6Eó¸Ø=à(%ѯ¤(“Tßýó7¯åâ}¶hµÜÎÎÌÎã·C«EÿªEbýÀ¤‹8Q¾I’Ŷº7°òý…Š•¬F4¯®.Ö¯£p¡? ÒÅÕõÀÇú¡5‹«Ý'ï›^~¸úîãreŒñTê/Wqœxßüüa©¼KžýðñÍ»«7ï¾Ç§&•÷ó\~ÿq™޼–_¾}õ’ŸŒ,?_ýxñÝU/i/H•¢˜·Ÿ>‹¨ôãEà›4YÜÁ8ð,W §oC#ÏåÅåÅ_{V¼.ø­9«X“ø61çfQvd¥´o”^Ä6ðm’]¶M¾\)/ë@í–«0´^v AäUYqXêÔëà7—¹ NÜóLxɯ\× O!¯}Îã-ò¬CâýŽÿË…ÛéZÒúZ^ßÃBш ǬÇn©cÞD;a¦,¶YWÔ‡ VX)4RJJýØ ÿ’UÇ2”Æžc#ŠÐžÙq¹Ò&öÖ$JçDYq·‚äí¶ŽˆŒƒ J߯¾^&¡W7X–ïÕå·°µò™ø +î¶mÎ4e~“ÑV÷LulêÜ3«ˆjF›úºL¶ÒQè5ùí©hxRG,&"ú‚´N­3S#š³f~ TXº àùÑØ<Ê»#{åÍ!«ò–_Ag@N Û=“Þȱä‡&¿>-Q_j¤´%»Î-ÑÁ¬6 ¼·ÙoäHLО±#š„•§59[štozƒÐ€Lß :g$¦³È†³F½i!±¦^òH–¤Þk̨7Rîrx«œ;O‹”^¿¶Ñ8@aP#Y•ÁžVÅÞötla»¯ÁI\ó›“ÐN•éDÞ”ØM¼ŒO1™²u”·"óTÞñÂfÁ4  9 +iŸ‹æZ¡><jH˜%>9û‡6`×C>w¡yVBôÒsMb‚â ¤ÕéÄ;Ü0žß°Å×CLðk J`²>5üä’#6œSdµèx¶¼žÏ&d‚$6YD‰öc+yš¡ø8ʨŽz5"§ŒjÆfÈ•ÛwÝñùz]ÖÛ¬Ü×m÷<2j½«·§*?t”²|±L +I;Œ&–ÙwUùPpe¬¯µZDQêë -Žf5"š)8áŽþ#…+‚¢“BÑyªhh3 «ÊO1†‡j™*`D›AáÕ>¦H Þó…ÑohPLSjÂ_tùjc*I8sW oáóHk‡ß’?¢‡‰ý(VOë1Ð<^5#>„èD=.![ƒãm0„ÚÛg˜qÀåY¼òžŸ(ÇÉãsrù"+y…‘ã«ÝGž¤Dj±>s¾’B‚ã&ÏZ)«DY¸D +Å.ŒôCé8± í†å`FÛš"o5“¤ŽÈ´ì2h~¬ëøÀ WJ8 ˆÅ Æçötduë¦c ¢Äzo!x!ÇVž’ ´]V–"¬.ì³;ð ãY†½–lÝS¯rüòÃœVÙ¦pŽò ©i›JywH\hf—_g˜¡J¬ð¡ôƇrê½8%GCF>Õ±mI<¥nHÞ åìøÈH€OghyG29N_2X:´zÆ“"kzpÕú3ê¿ÇØR’ékԫጠ†0Z¹d‹D©·%—Á¨NÓ³Z•ðNëx ÷¿æᙜ´Þòï¡îx@åÀeÇSÙ Ã 0Tìd] IFŠ8ç€z¦,F¤eWPÿÅìQšSÇ)ØÄÆ51R×C6B€ù3€³q¼Èô®”dzñhµü + î)nqû¢ù.j0fÆÇTPü˜!ú:1p)já?H-åEŒ0ÂToð`4¤‡—oöÒ¾ä:­—Ç>: †/Ra¸OÊ÷±%ÿ±üLv†¤qòÅh#~•'Nmo4=(ƒcñ6âå‡7R8Gª¹C«1ìQ6N2ú0E CƒpqSBñŒÀ[¹=!á=“ÜžòSÞJ„„Fº-¥4¸²ÂÍ]áâ_rü«ìØr“XwC‚L0ƹoù„«™pýÛø +UܵXØ¥°Ê¹zZù*p$'¾„£ƒýîy*Äð‹!'©ëSǃs˜Žn +eË2áå³Ü ôUÖóL(?Ôòþ†¢<ç‡c3¾(º{‡ì(j×ânüôþ’Í–¦¾USy,)9\Sá{å³iž):ÉO•O‡íHFâš±ˆÆË'e*ñÄïŠ|爇³§R$^æxw • °ÞŸÏäûüBÇ­?HdwMvh+¸b=_ïë*_ÿv¨±²ƒþÄ?xæ4øõn_l÷¤NÐmSuûªo\`«ÈF w¡ª’'Yn…ð.xu²lïy¥Í;~CD–§íÒº’É…Û9T ©Ó•HþÐ]™ˆ&~¸’IV„­‹›¥Å¬f1ÙŸ{xF:'’K¿I­ŸFñÄ’WtÄ”–%+g’Œ‹ª¿HeCE0rQ©‹ñ—+¼]1HŸ MóÕYSAnµFá>þÏ jc¡ÎÀ5~®AŽaC?1æQ>ôV|xäȧ|VN*`—úJ …XO: p]OAöà½t®àú|¦"“i¨ô¦Îâvã0M ÓŒÆ$ø M¬ßTáâÛ$\L„d¾«cn$ãb#2¬Ž­Ÿp¯ýÑJ}*©^ˆmbÁ6Á¤¥káeÅ(*Ï”|~¦ByÏclpÕVŽœ}@:ŸFZh¸§2i&ãÄ‘ØS˜Ë 8ç.ÐQr5CHNÔp—F´]Q–<ÜÕüË™ _qßp,¢º<³26‘8 ûy }!¼ïiÿß}nwüP£wÒ!€ù¼y6#º˜áÏ$0+¹ëY– 5@H+´¦8Câ`3tú–1âA‚O°~Rb§ÎMߣ´X +cå9ëËÌ¡1îÌ`' Ëošl9ß‚áV!¡ç¿Ó‡†“ÃVh¹’²„“C6Ù°BÃSÍ/ÁirN-ï£ &ß.i;h㤠+€“.ï´wOÆSIïYêtû¥Íà ‚…]Ëob‘¦YêáLQ ]4ˆŽb¡Ãžâ究üË܇nª˜$èïXƒ$ìåÜóoÌù¹¤ïO_BåŠxÅaT¤šzC,ßOÕ“Ô¬Ø팽t¬èšÛGHÅß·f©†+m?I>yK®+iäÇ#9Ï4ùœ§¶§q_äÜ–„²Ôy«9Œ•o¬}¶ÿÅ+·ÅªÿNúÿW48 _Ç~¡Äè'›ÇÊÄÔß~² ®4@ˆ4ž4Áµ4Á/1á·Êq㛡LDØmDQtÓòÌu½Ä’ÁôßЇêËGÚßJG€µÍÓ 4·¿UÐ}™Š-}èÂÀ ¹ôqª¬)þéZŠ!@IÊ@h¹ckìÐqë= .siûóãè{+'‘Õä.YN¿[£8\NN ·q*¡Í\10p&é,ü›˜?—[ÿ:Ñ»¯ Ù¦tWðKm§Øn“µÅ–såä z³ ­ò§®¾!ˆjØ}>Ý”õ&+??ràpӳ߈à?ëý-Bï4 QbùÎdµ†;‘“…}Þ>”×ýÍ™ÀÿTä2´endstream +endobj +5120 0 obj << +/Type /Page +/Contents 5121 0 R +/Resources 5119 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5108 0 R +/Annots [ 5123 0 R 5124 0 R ] >> endobj -2082 0 obj << +5123 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 125.759 512.306 134.782] -/Subtype /Link -/A << /S /GoTo /D (section.35.6) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [309.861 679.338 512.306 691.33] +/Subtype/Link/A<> >> endobj -2083 0 obj << +5124 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 112.21 512.306 121.233] -/Subtype /Link -/A << /S /GoTo /D (section.35.7) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 668.213 136.217 676.872] +/Subtype/Link/A<> >> endobj -2084 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 98.661 512.306 107.683] -/Subtype /Link -/A << /S /GoTo /D (section.35.8) >> +5122 0 obj << +/D [5120 0 R /XYZ 85.039 781.388 null] >> endobj -2085 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 85.111 512.306 94.134] -/Subtype /Link -/A << /S /GoTo /D (section.35.9) >> +1346 0 obj << +/D [5120 0 R /XYZ 85.039 653.944 null] +>> endobj +5125 0 obj << +/D [5120 0 R /XYZ 85.039 630.626 null] +>> endobj +1350 0 obj << +/D [5120 0 R /XYZ 85.039 137.996 null] >> endobj -2040 0 obj << -/D [2038 0 R /XYZ 85.039 786.531 null] +5129 0 obj << +/D [5120 0 R /XYZ 85.039 119.327 null] >> endobj -2037 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R >> +5119 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R /F11 2898 0 R /F66 3242 0 R /F69 5128 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im4 4878 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2088 0 obj << -/Length 226 +5132 0 obj << +/Length 1841 /Filter /FlateDecode >> stream -xÚmP;O1 ÞïWdL†?ò\‘ *C6Äp‚!•C*÷ÿ…s¥@«SGßÃög2¨L‰€RM. ¢yùм)³èG¢@ Aÿ+¤?³ž¥@ eMD5HQ B Ü%·m¸¹g4Š¤$¦íi{}²NÈŽNÐgç%e»udÁ=·‡“#@.¹;|®ª®P¡,æÍnržìî8º7Ùíô¥î¹ƒ -‘=Œó»–ÏL½çp×þÂü. ä\ײ Î†È쵊™@(Ÿn¶d¥h¡býŸ•äzÖÞÌùòØçú MlYÞendstream +xÚåX[oÛ6~÷¯0ò2¨IÔõaÀÒ®MS Y–8膮h‹¶…èâJtüû %˶ÒuЗ!D~çÊC»cþÜqØŽHÆQìÚ"ŽÇ‹bäŒW°r9r ÇÔ°L{ºýÚ‰â5Ì»†¬ˆØbqjôÌâÂ"a +;p|²K^Ét2 ¼ÀÚÔY©UÝðìGþ<©ƒS¦.‚Hh±fåê€u±Ý<Ë»f*e¡žÝåE¶“ð®-šO"UQ¨RȹÈsÜ´j @‘z}°éü‹¬Ï›MUåç,ær`ϼ®v’óüvYõy¿çÙâ̷ڪƠ¯¾Wgúoô}Âú'ªšYdZdåÁ¦ºªô þ2q¤œ¿qû15 ";vãñÔv("’<[gE"J¬ö+Ñ;8xšx±Umq[¥œ®•òlYÕ<˜ËÍ(bÇÚ@–̉—Xo(£¡]–¶¦,aÌ»LiÌM›gWš¿»ŒĨ6,—ˆC»ÄÓäf Ÿlñ‚L65šö 7Ãr É:NbÝüüf2õ#ß’å„”Áñ éÙè»·ÑLþÃq}tŽÔb ‹ó"ÓZ™¨J]8 ¬ˆ¤LQ»‰Y»†y¸3G¹d Ö¥ã0²ÞV8Ý!¿ú‚Câ©Ùà-pÐB¢Zâ^륚g2RŒåam›N¬¡Ð‰ꓧ¼¯¬4Jƒ‰׬N7×£Œ±¡géµ")^0Æ µ)´5DÓèzz «2MP¶ˆb­‚`Bs•¤î +‰®%yíòþŠrƒ! i.uV•gqžÚö²›uë&ˆb³¦i -|×÷¶Cž¼"@ ™3G_ÈÛSRtGÆ"°Žû¾c.2£–ˆ%7)GÈ£PX­ÅE‚ç]˜ ¤²*cS¸‘F­æ?˜º¥„B1sLM­+s42P±Ì»!ÌRDëëÑF™}ZoÇ<¤ˆÃÔ÷cJ&ŽÔ)2§yÅ3c™'œEéµÊŸxå ö€qÕYËëR'd*MàB’eÊró¬T6z,¶îKrÿƒÑDø‰u}õ›Ù˜gʤî‹gRpÒñ€Ñ‡Äƹ¬S”h(„I«šÜµÆúÙáE"Ýë$~¹l…!ÖÝBšô“ŒZšÕ-e¡ss:.~ P?;raàÂIù°÷Ú2ºVh}‡íN¬¹¡ªÇ.¶M/Œå0ô¨»dÁZÂ8>ÌZ07P#.´K2ÛÙq0"1¥3Lèœ1KiúÐáJtÄ;U8!dDiªâ´Ã­¶DPm¶u¦az s˜µf@^˜.—s©YR{±TŃ£(©Ô’GM{•Öì€#WÖÕòHÈ\.<«[¦ƒýÄ‘ñâˆïHº + yÞ¿7›HNÛ@øÒUÎòÁä xŽ|26±IÝŪ,xKfÌó9DY?ÁûÔ§ÝÙܤ=rW%ÛIéá^%ô÷®ƒDÒ$xeºZ>´ Øuë–Á¥ÌR•F©0€³emH;HcܺæÒ¼šwe©`2A Cäè¥'ÞÏåz_™¥‹àX·1 ê(÷·R•¥üÊ´ýÌcš(;‰Ü¯>Üz<ôBñ`Õµ4,¼P\Ï®7sÚŽÇ/7x¬y6@h¾À±ÞWÁñ* úÀ[`Cåê‘çMõÕÅ=‹ª\2ýNiMþÅTX5L\²(žPãøŒ^!4·üŠ{^¯=éuÐ%wzùð"õزoUM½GÎëš ã,ºoWkŠª¸°PTµêµ¨9ª„~ ±ŠS¸Ý¤nlì846Í8Ŧ~þàè% A7ÄØs›lxÚøƒ&±>ê‚bê¶*á ²¿C¨‘ðDõàÛË¢•*UÝ6?Œü]˜£ÙRmäºk: ¤s2ÂFnäƒà°F5•ýбæÛýÖ®à˜û¾ÄŽS¡U™; ÇýGˆ¹Ñè8²'ßÊŠÅíZJFÅr=t#4ü‹A£4¶¬&VŠÚÁ=ŒéÀû±Ï7葯;ò"óò +ùټʫ¹ÌùÑLŠ¿ÇÃ}ïÒoü9aÚb£'<ôä@ÿ]Þýÿ§·ü‘ÌO/ÍF-2™ÿi„þ3wðLj8ˆžpÓ…#ú‘€ì¶3h!'08ÿ• §í‘ÏTpÇöë7üó)ÿéºî€\ŒÅ3—@ày¶ç¶Xøj ñ¶¿äþ 6/D$endstream endobj -2087 0 obj << +5131 0 obj << /Type /Page -/Contents 2088 0 R -/Resources 2086 0 R +/Contents 5132 0 R +/Resources 5130 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2090 0 R +/Parent 5108 0 R >> endobj -2089 0 obj << -/D [2087 0 R /XYZ 85.039 786.531 null] +5133 0 obj << +/D [5131 0 R /XYZ 85.039 781.388 null] >> endobj -6 0 obj << -/D [2087 0 R /XYZ 85.039 547.583 null] +1354 0 obj << +/D [5131 0 R /XYZ 85.039 379.971 null] >> endobj -2086 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R >> +5134 0 obj << +/D [5131 0 R /XYZ 85.039 356.653 null] +>> endobj +5130 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2093 0 obj << -/Length 3344 +5137 0 obj << +/Length 3112 /Filter /FlateDecode >> stream -xÚÍ]oÛÈñ=¿Â0 -„:X4¿)^ -ËŽïTÄŠ©È½>¬$Zb-‘*¹ŠOw¾óµKÊ¢“—>X»³³³;³óÍøüó/F±ë…ÙE:JÜ8ô/–»wÞÅV~zç F‡nE0îYšÕa¸^”öᩤáÅ0ˆÜÌ#ŒñüÝõ}à]ž›$áÅü‰0ç«9¾;ƱçL¾Sêz0ôj0 =guXê¢*aœ¤ŽFX’83\W;À]¨Á¿ç÷aÞÞLŽõ¾u¥0q?´WJâ ߃KfÝ+]Nžà´8uŽºŒïpž8‡r•×V%ÂVŒó²Q8Ó²£:Àž÷õ öœA«ª(×Wg+`¬‘SVBa›ã^U—°‹!ª<ê ÌÜKžÿÁ;nA ÛÊã®K´A©\ßû]¾d4ôñá2bq2 F(Äa˜Žœ‚vÂ0sò«çGÜæ-Ì1,íaX%îÇ;§)nvë¯ÊkÆzªj^üRÐÞ -_s¸PMnDKo© (PÎ-×ažJTÖL{~‹G\O¤þÕ›%Ìž3} ‹äõŸÄÄpR­ÊfãÔ©j`(HR.û´ìcͤ3·y¹:¡QólG ˆ¿1¢¹5¨ÍŠ¶£Ú NÓî"š ÝÉä€D`Ã^ ›èMÎhMWë´¤æÙK¡«:h&Têt(j£&¸ ŸÙÜ+\S:g`Ï] >_žç៰{û˜mÐZ ¨Wæù]£ŒF‰1Êh‡ƒ+d\Ð]€Äð†¨š9]ç«œ×IQ*V¹|Å„(š#…ö•©Z¨-Oµ‘Ü€ø -HVñ9äÕ4/…žP²wêy˜=ʧZ×j·c߀ £Ö„!H*»……ª.ÖÈp©¶È"®¯Ì¥„sÕñ€b8C -7DÚjò cÌ£¼ÒZçÆŠ¶î[±c˜enò­øáÇîÈ÷»!ÍÜ0JNCµ(sÆ–päóº® |¼ynà¦Ù7C©ïÆI`ÏõûâÿÒØa˜¯)p’^W…"4g#$‘â¾ Áðkp€-è(¿ÿÎâD5¨W¼PçOy]wœ)F‡#KäîöÃõgtÒä­]^œoL¬ v>ì$<ýj?`pWï2ìQ4]ãò‚ôÓ^&ŽÛj·?hkÀù@~÷+‚êªÜåÀ®?Ó®]E¶ 1þ‘\?;~!B0‚âF‘5 a/G,«’÷`üÐPeø=2R«í¸ãܬ_É Hc§°& 0A¼Ÿ`I;Ô‚C Ê`]”|«#£Àv3"o€pc38¾‘Ø´ÝV×??ò¡†êôö†‘|×ãÁ¯^ìMsÍ^ŽB*6¯¼ ãÝ÷P&~ã7uëžuÎA_°Îá_®!žÇUiùŠIg)ºâ?©q|5âÜ=Fjâ|Ù´Á–ÏÔÿ•@cTü)sƒq[Õž(;!ÿÍ{˜4å\ Њ¼L+Ž -ùe;;l™y„,Œ×‹|¹­˜•.’¡á -2ØóáÖÆ<¡ºÞ*Pzzò‹{ë|•7&¯Ë|EÈìx‚ÐÚZò8gl¾A+ñCçÓoIz‡I‚8?QH8ìÑ ùI `©‚l3!OYˆû ðÍÙÔNÈ>—g!ï²dR°rgÍL ??Þº¼þP,목ž4OOÉ©mÅjùVjáÚ0´lÍÄGÄê(ùJeCI‘Çi²’T/‰ÿ%ðÌ‚ c²‰³aʱ<ñ£ð»-–6'³Ù) ÚM#“ÜšRYm«õ5ÿŠ¹cB™cua^s/ŠSñƒç©ë¾£(ÆÌšö66Œ¶ -ß0 -éS”8°8;qýQ9÷ŠQ™qš–†”¶øÔ… -ŒŠBNz¹î8tB’hK4çK`‚^Õ»ž§å3rfcöÛèØf]§pbʈúÀl6j-Q`¼•˜ÏW’»ÖLÏ\Ç—”nHK.Ù½!ø¼®¡}² ¼ì'hF³ö’}Þ×ÆŠi-{¸”씯?ÑÏ^R¹0K¨ú86lÕ;| ßg2s@ºÜœ¤¶†‡Ì¼Ën¯(Î. -*P´QyغeH9å§<7 }矨£TD@­Æ‹•íÅèq2Ž:¨¸nκ„–×—(k'mÁå;P¿ÏGcýÓÉ0kL‡¸*À!…yÝ)¶˜Æ뺰ù+Žb¨7Ú¢Ž½Sè"4r¤À,vûm¾ë€Y†UÙ0 >+—¡õp]³ÛFÉm± ᪅ÍQü‡U[Ä@A2ž<þÂCQ§S5£䵘:AcþåJ¨¼|,Ÿ§ ñpd%XÓ/ÓñG:ÿY´ƒŒ©Ñ¦tÖüÜÓô]% -’ž«` -4Çñ-ÿ_ÙãÑÁ™rðÏñ.¯Ý4­°z©ê†QöªaGKò÷éxÎ+RnµÑì´`@~±jtÏ IÀÞa#+òRJkÉ c¥* €  gYqó —Ù0Xlby"jõuK<5ÉKì÷®¨%Çþ\5žB†òxÉ£? á¾jî¡0´M("¸©ªŸI~š«ÐSðšÜ{ Þ—¡0Šn*Q*mbãëO>Í:èâík.x#ŸÕ’J—‚ñ8– ·'Õmðzâú[8”š4¦r1u{äõNó§d¤^•””óLŒ=7 £TBùh—,S -Úö-6öLK9kF˜ÎÆ”ÆLH.ÀEVnSKàçCñ:Üêi|=²{£ ´§œ/hUHR-@hLÆa 9påNŽ#£‘FÁZw«­Û›Sœæc†©ZÉ–+«LÔŸð}ŽÞDWðü,K¤jmÑ·==v ºÐÛש…¤9¹GÕø±©vd8Ÿ”¬K*ð -]ä"ó{|X…æ†h³e} {°—ÿ‘{¬É÷z¬ùלÁVÂ4ÓÆÙZ-ŽšÎIEY`iÊ®j܆–TúÈËŠ•4†üuS|Í1k -¡haêå -} R{Ù@9µ' ýÍkƒù ÜÀWÝ6" 4•o±û‚z«sÚ09ºÙ»XûX3µ[БdBM.oLSË-1$Î_x<(^þ›fq,5“““>‹‰òNÔu|ǾµTuÁ’Ò¶øÃÌa‰.ŸÉ#ü2® gõUZ( +$ªy²µy¢èÌŒ¹¥A‰”Z™{"&q´¡'®ëMç š£wH‰ÛÛ)Ê'Ó÷§ˆBñ¢¯5U'ì¢!4tä± ÏM˜Ð›B {–×ø¹5å…Æ%D˜Ïˆ­º“˜zÑr £xäHGÆÚQG§‘+¥Î¾å"Zë’7&€üeS°m÷åñšm–eAJzÄQÀ,¢~‰ ‰ò˜/4xQG6/HH_?&à­ó2—j¶²…S^m$Ûo/¶hæôŸ€•å‘ï*…kÁyâÓ–”<ï‡çéÒ^ZZ#P=îÕÔRgÔµ^îM1c>¶]²Ž£¸›ÎÄ’ŒÑGóMŽBùŠÛT[Šw…I÷ Û"Ò¹Z–k_&ÓY¯»‰#°ÜMèFiÜ}±³ˆ¡$ôÓｸÌWgaàAzªæ÷¨¦¢Âendstream -endobj -2092 0 obj << +xÚ¥YmoÛFþî_a0BCrùڢť¹6Mи¾Ú¹|h‹ëZZKŒ)R%);ʯ¿™yv)Ê’}w8­–³3»;³3Ï̬ÃÓ€þ…§yâª8ÍòÐWy~:[§ šysZŽ©e™Žx¾¿>yùcŸ†_ÅéõínÄuz=ÿÍ{ýÓ«Ëë~L•R^Xø“i–åÞë—“лõò×·×o/ÞðWLÄÐûpÉÓ¿ü:É•w ¦·»éWï¿…/å“?®ßüp=œt8ªàcþuòÛÁéœTzwøªÈOhø!M¯Nèœ~+û]\ücX +sñ)¤ŽY%Q¹ŸäêÐ,*™%L•Ÿ'Ùi–~Äb—u[Ö}Y/&Ó$J¼oñÓm»{Ö‡Ÿ†¼w±ãéõoµîzÝ?Å žY³Zéz¾'gfË£³‹>~áŸsÝ›?í‡,p[VŸç·g|÷~_ö«õËnu³nk¿j¬ßüªXNS„~JêË‘9ÑhËÉ4Jö›ž[Õºéy‡ÑíôÝvßÿaËOÓóO½›ž¿ÃèËôü‹5Ûô|ößlþõ›·+g9™œŽ-â.isS•³½‹©›#K-6¦³—ÙÜ=ÃC?´eoô»¹ç–K>`Ýšî)^Ó‚EÏWe½'t·iùá²éz{›sSo÷D_þ=/¥«ªyØë7íMó¯Ïë¯ðI¦R~¤‘Èâ²úËÃq$N〮"¥_E¿™ìx½,iÃXåý„¹b”‘ÿð¸Ô•Yê–€ÇðWá9þ¦®¶<ʼ~iZ;yK|M †Õ„–r,†Wì(æ‰aÞ5 7¼0oJëuàaL +ïmUæ¼¢0`º~A;'”û ÏÕ ˆÀï¬ÞcóöK«FðµÒGÍÂ=(Ÿx§œ­o@Óøü=ã +²¡ÇL•=`á}ÚЄÏ(B:H÷ûä–fµu«W²9–彫EQ:ÎOÔ£sÐï•^ñÔ=O‰sÛI²?n{w÷=ëqzGA@ä$Æì#…ã öFã@ÉmÈÁkô¦Ï ,YÙ‹2WšÄÞû¦5¢î‹E[rÛ8 +äü²úøNÀºæmWⓘ†ˆÍ-~ûe)°cÍÙ{ 'ÌD\—ÏîøÎÚþ yô÷ ê¦Ç‡F˜þ†ƒ`ó²îÎ@_´ K¯I*üÆ’6Î]ŠžIñ‹nw¹hÇWU¸öŒ®ÝÙ…7´+§‡ˆQR@ðZ99/\Ëáê™]ˆ&öa¸0=ü‹vkÚ;L^g¹XN¢Â»A$Šu8…0£æX-Õ5o'`•ÚËÒÛiçϬ˜J{L132j°É T¡ÄÇ0]„âBqaA‡)Œ¢”BaEfмcþ$ +ÙsÕ ØÀ’B5+Qòó« ËÈſœ·7]Y›N&B |÷e+'DÕRs®è-CÃ.ÐW´„TÑqHæ+jüÌ*aÑ-xæHå¢> €MEw…ì³ËAÔ /QÒ1w™;‰ƒVðê),¡Eý4Kž ÖÏ€%¡_°Ž‚5"À‰ó–„^ÈO™åµ©û–‹g•°²7ɉÝD5xðÓ÷’{òœ;µÐ»œ«1í´o¦nÌô3àÒšIíPI<¡gH­y?¯çŽçP +¨¿Hе¿×rñäfQ‘Âô+š¨ P%5LÈÄëxbÙ¬ $êGõ‡½>Æ.ò:pç°l:Po¤ «ìÞ {#y +Ðiá2(oì\•“+Y¬ì“°Éœî àÊ +.J +ÏhIîKþÊ-–.6‡’ ÿ¼”‘ ÒP +J¶€N"A ßOÒ±äD;Êûv¢©;ÐÇi™ú.¬ãÐ{³;Ž´ñ-? q&‚ÄÒéñ:îW =¶3E@&67š½3ɤّ,±ìÌÇ€Q!@õå4£Á¬*­½_Ll-LÊÏœ«ØZMí²—œÕ +ï«Œ–Ææ,Rzéff®3)G0õÂ.Ï=ɱú™½/A¹g7B¥ÆšSá-šs}SIáK£¡Yð@êfËs;À¶ù"ÿE< 8ñ¶£n‘i#óØ£è5k]•3—‰ö Ù£²ë”VÖ^†ýBêH&Ù³õðW"ì +/Áº½´ÊÑnCFãM§v(7Cûjœí½Y@Jøea{ö5ß__¡¤D]k?t©L +m™˜ÈÛ„%¡E»/– 5WÕN3ëªÈn$‰V€ê•CòÄ9뜼¹½.5õ|2œ¡Á•™—º7(u¾:rqÔ?‰Z‚\ÑȨkß“¯ñèÄǯúRÂÈ@bÖÔ3)yÛ]'Gì»è³‹i;1ÜÉvòXÃ#‰°• í"ºKÓWÀKûì>Z]w·üÊsD©¥»•}{@iƒgW¹Ç{ØdZéÁ¹oF9$»*å^ +\¨µûyˆèM;gW=^/„™òóôù?~Œxž®‹Â”Š§8Û«‹"W} Ë«—W:‡òžÅ…îP Ùϳ'‹¦©T¡ÕÖD—xígÑ+¹•öÞ´ßØEZ=!é‡]íxã‚Gãv¼°§¶áN"ÿdSÏíïmy/ov¼§ 3?–ÂâéÎN¾F¡P÷ =a÷8÷³ç­î8ž®ÑÂ(÷à ð¾‘'¨> endobj -2094 0 obj << -/D [2092 0 R /XYZ 85.039 786.531 null] +/Parent 5108 0 R >> endobj -2095 0 obj << -/D [2092 0 R /XYZ 85.039 766.606 null] +5138 0 obj << +/D [5136 0 R /XYZ 85.039 781.388 null] >> endobj -10 0 obj << -/D [2092 0 R /XYZ 85.039 766.606 null] +1358 0 obj << +/D [5136 0 R /XYZ 85.039 430.872 null] >> endobj -2096 0 obj << -/D [2092 0 R /XYZ 85.039 676.914 null] +5139 0 obj << +/D [5136 0 R /XYZ 85.039 401.468 null] >> endobj -14 0 obj << -/D [2092 0 R /XYZ 85.039 563.765 null] +1362 0 obj << +/D [5136 0 R /XYZ 85.039 332.675 null] >> endobj -2100 0 obj << -/D [2092 0 R /XYZ 85.039 534.36 null] +5140 0 obj << +/D [5136 0 R /XYZ 85.039 311.478 null] >> endobj -18 0 obj << -/D [2092 0 R /XYZ 85.039 193.665 null] +1366 0 obj << +/D [5136 0 R /XYZ 85.039 173.868 null] >> endobj -2101 0 obj << -/D [2092 0 R /XYZ 85.039 164.26 null] +5141 0 obj << +/D [5136 0 R /XYZ 85.039 141.654 null] >> endobj -2091 0 obj << -/Font << /F20 1617 0 R /F65 2099 0 R /F15 1628 0 R /F41 2104 0 R >> +5135 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2107 0 obj << -/Length 3436 +5144 0 obj << +/Length 2974 /Filter /FlateDecode >> stream -xÚÍZÍWÛH¿óWøqYñ^,ôiYÉ)°Ëì@Ø`6‡™9[¶•È’#Évþù­ª_wK²åÌa.<îêêêú®îÈ¡?w4 mÇGÑtb‡¾;šoNœÑŠvþyâ*gØÎ$ä­‹ÙÉùÕĹŽ;ñh¶Ùâ7ëò_ïïf?Ÿ}ß·\ûlESëúvöùÌ›ZŸ><\ήÏÆ®õé̵n(°fŸ|ÿþ†/x÷ýÙ³_N>Î:W;˜ø|÷÷“ßþpF "ï—Çöãéè™ÆŽíÆñhs„¾¾šç'÷'ÿ1X°Œpjà…ãÀ›Ø^Dß±§Ó`ÆØþ„p6î~wÜhÿ¡„êà>RÞ -;8ÝpçõÝåÛ³±7!þÌ«²`†¾Ç6¼æYK–öO¯e·I«ñ]Åë´<µæÌÚ´®Yn6g^dí -ÈæI“•Å)É+ðâ¿ Ù¤ÍG¼àXM‰y¹a\¾DçyÒ¤üf––ËœŽ…ìz+(RɘxÌ!ûŒ/Ë -Ï` @oxÄÁ†¯yfZÓ”d׳¶U¹âƒ‰œ¬í}v½ˆdé“,C{D¯K–7 “^3åk~Cž +V$à‰?±Æ$_äxq_ý”KlÔÂ* Ùÿ²b…õßÐáE[öm½¡ÐÇ…é÷] -ýÀAœ)«EZµ@—í. Ogáĺ³ä1õ"i#+IdÕ;Fß(-LDÎ2hDlE½Ñ!dÕË÷Ÿ²K‚%¦K£•˜P}Þ(VÉ”Œ‰0Èô¥uSšçñ+#Ÿ´S¥m$| ·³©1̳oò þÑ×XxÎDJ¥˜JQÐ2ÒÒ6[(¼€]­…ÆwCÏ0¦à3òæ:¯ËdCàUAXâ›" +ÌwT?@œë⺔,w àfÝ!§1AA‘Pg‹ÔxÚC±h!ݯ%éáŠÈ ÷<- ¾…ÊñÒ@ÕC ®«XÞ¿F<7—ͳ­d4¦öã]N÷o.ÞáeÞ:äv_+Kc÷¯’JJ³•±Óù')ë1~øp‡A[æÉÔõ£7@Æ&`¾I) ->$Mb>.ô y2]¸!ŸÐ¡Œ¯S ñU•l@žm{›ÆBž{=†aËõ§’@º&Ô{±ß·^0”ÕÂDm¥xÆèz<«Í§ ô5÷øGýÇ‘_eåœöøHS×I‰&ÎTü¦,½J Êñ”ùN©/GʆДŒ—a‘sÐàËõí½Jקi¿*ë#ëQ|e²˜£ÕÛÔCÉ™ñ‡Û{Öø)üÜMúQ„W´kSL'/.T°ÛèäSW8 -½Ø~¾b\—˜¸Žãbĸìù.Ajù80Ü#1_u‡ë¶,…w¡¹M¾¸:Ž‡Ä€oû6‰´ Úï~û=.“qÒ¼?I!‚Àv÷u¥_¼¿Å‹ö?‡òó—¥ú–Òs„é¼ï9Ž€;Iï–iûJ•¥‘ôýP'þã˜çÙNüʾ9~ñÿ&Ãü}fh›aÍ«‡½ÀöB_¬¹Zõ]Ó=•‰ô©¸'ɉ ¾c¡/Ù4ºä=®¹Þ ¼It§€ëñz'©€¯_ù3iÜÔ&•ÌÚâ·)eîùªò˜`zCÉôå¿fu£ÞFvìRzGðœ]d¹)ª=*†¸Xò<â)Ç{é ¿=?~~ÖßbU‡Ûmqù+Ø…Ω„¡m£õB-¹n~AËGÆ¢]²¹V¾J{J]ŸTª£Hkúk¡~¨mJývHñÿ8äú¥úóý½­*¹{[Û+8§r•§6'-û6„j2GŽí»ƒ=±¶kf{ÎÄh±G{íÓÙŽ»6Ð!Ú¬Ïiž4RDN"ë®*¿¦ó¦>n‘v4ýéåžk‡ø“ã&4ã¯( BŠ,ÁJ¥˜œñv§…¢ó "óoXLJçúñ+Ý`U„›gmé+#[þ2L6ñU}ìV…ÌRJ¿¶õÈE‹´ÅA402ÝláY¥ 7}(ûJó8pñïükLG’:JŽÌ?î\qDubê;Öåµ,Ñè¿W÷*ᤠñ±ÖÙ¢ë²xŒÄ©”n“˵ 쌢¤4¶ðï¼#ÑVQ‡{o?| œHU¤ªOœ5è#åK!íðŸŽÈ(ýðuyñ³u¾ŠG:£⦟&&Òݧõ‹\7H‰ëüÝÜ ¬«,W»òaµÕÌ6ÉØ5õ* 7þ‰¤Ì¢ÅñS¦cÌ҂øý×…J|ɵ‘´ù iÊD¦»+ÑÁ|âÉÉÖ%QDºD’Íûûí!^ƒòR øtî©h€x|IAÜ«0—*_n-UlZó#Ž¹@ß·ƒ(þç:õØ¿÷ngOHcÇ-²ãšä†ût*˜žrþþe¢endstream -endobj -2106 0 obj << +xÚ¥ZYsÛF~ׯàú%d•a0ƒËy²oVÙXÖÚty«’<@ÄHĆ$”Vÿ~û$H¥²å*sŽžž™ž>¾nHÍø§fiä:›%©òušÎVÛ‹`v3?^(¡ð„Äм[^\þ=63øYÍ–w=ŸÈ7‘ž-‹_æïÿñöfùáóÂÓZÏUæ/¼$Içï¿Þ,Ôü Þ|¾º^^]ÿˆ=ƒjþõ§?}^¤z¾d¢«ë~úíÇwo¹§ý`ñÛò§‹Ëî¤ÝàTó‹_~ f\駋À×Y:{‚và+˜Þ^À9ýÈhéo.¾\ü«cÅsfÆ«¦¤éÔR}, Ä¢B퇡š%QàG!¹|º[x& æ«…§æÕnU7‡Âùó"Lq¨ŸÏwÜi°cÛýwAŠ(Ž×Øiæ[\x›sÖ¨yÁmÇ6áo%ÍV8þÔðí´)aÜbk‡s­Ì•r€vmy€N’oíkÿÌ“»z +–ÑÛ:/€WÙ–î•o`¡ŽàXx&x:※m±ñ òÖñü wÎñ¿gTT“Í¿­û“ƒ÷Øvz„¬‘G]ò¹mÝȶµåËOôk Ì=ÉÄâþ¶F9Å äãt¤¶†‹F&ž¿?´¨Òï, Ø‹;Žõ~'káË;ï +:°GÚXáû>¢Z¶àui©œRvpZóæð!: À`ú%7 â§0#púqwœðXp¢ähGm|xγ2Éñ~£§×@–h´ß6§‹ïó.€zŽ„¿ù$ô6(9ÖØÄél8ü­`ÑóXám¾B™®¹×Ç$0:‰€L˜ßº'ªi‹ï%tAMÞ fŸK»)çŠí„S«6ŽP‡BÈ ¦@Š$?/0Žì>‚ˆr$.cüÅB ¡ ÎÿÜE5òù¤ý÷pÌ(H)´ðûÆŠus´âÆ +ø¡Ûa'gУ'ã–œ!ßÞæ­980‹C@½ŽtŠ"óHæÁ#ïÀ›5¢£ã«'à@´ãÅ°£ƒ2x@þ´N|¥â‘ØWÕngWˆtüS¦ÁYuŸ7ÑiÓqD/˜ÎÙ ÅtŽö›2á~…„Æx^=ïÀ7¶:lÊB@4 {̆íCïŠc `˜0)²°b¥)¸}‡ÖZå!+š@CÃß!ï*¦Ù¦³Ø¡ýÒnz ‘û÷§P/Úa˜`¼l%ýîÐîíœ&B%øK¦¯n0$TrÈïPvßÝ ‚Ыñº{ÛrãHl‰K‘¶x_0 ´Ç + «>Z?OÜídÜу»é„ ¥n3|¹µÒZÛg¦Ïi³»¦›åÆ8Ö¢‹Ë”ää©CcÐÙ’$ƒ÷¸^âøeøO˜¸ü÷Íq =â­½»¡à/¹Õ±«L ±ÕZ¼À—\ò “óŸ¿|¡=?r†¢VóÏظy?áLT ü(ÖÓÞ0”Éÿ~€9€Óy}É8Ó ½¦§bßÄq`Uc>ŒU·œ6¯IHdÀ×ÜÚ®X3¶ƒ¼GhÈø°1––vø›ÏfÛƒZЇSàÔd˜è,tÐœ†§&‰ý KGðÔ<ýíÿ>t°k…–к¸Ž¶ºqYK2EæŸw8ô?à@íÌhOrÏw•Ì`'ìâpï%ÃÝUk[¯ik›oÿvJbTFOsÇBLó#3WXY8Ñ—Q C¾DÖ§¯Ð¦§ê, «‡½câ0³`äÀeh <;6TS Pÿ ’r˜ŠãDW),ºZÀB‘ê V'˜®”-%{,öé­`ƒOôûBL ‘›ÐÕÝÞO;k]V*€®çsÛ™+¥–›…ä®’SꆸQ~›5Uœ6’ß‚L8l‰ÚÕ­Ÿœº[ÿ–Ãr‡ él¶Ó»ÛAyb$“à»ÝË9?sŒäH:EýîóNq. ã@< jLnµ t¸¼¿9Lz£Xl0Ú‹ èWU]³wj9%!©ëqG +G.¼/J¡›™Ð{º(©Õk)ö¸„òfîå,9™Üè,ð{ õ4§ñ™Ð¼ÏÎí&èìp³)p6ØìÒ¶$êËÕþÁ™çå¶dGïK!Kl`ÚÍI1¤ÆOÍ bèhΈi^Ùݜ6›C¿Ùy1¬¤ÊÒH\}›Q\}W–S]ThÛ¼”¬x²ºKîGó£ +! +Ä]|å>š³é¡ÕZkÛÈs°‘ ³LœX/lÆV<(t­ÚqŠiÐH°½zx íìùq©€€w²–½×ïº*„bPj”“ÎÃáÈ ˆ ?Î^åª0RÉEk7Áù€š`î8m ƒ ËñEñ5zF¿}~`í=ŠŽ°(4²h‹1 u»“D¸úÍíº\HÅ 4 T6HF2Ø”’‰£Kað„5=®R‹¼™L8“8à³>hØZ@¨0@ 7ˆ|•†²8rEʉ3ÕdZ8 ³ÓÂ1üq‡½æû¬ó¾â8ÀÅ+R¼ÙÙ©k‚¨4XŽþs7õT!}8ý¸+|<´WçO2ȯ÷‚`L{Âtˆ(½JÃq IÆFÄD.`{WµL(¨‚;{ÒW÷ŪTÌY"…+©c[Â;3”Â`÷¹ dž8 ËÃŒàMÂlð9 ©¶R+ÁáÀZÀ€­kûà`"0DÈsT¤}“¼ü9Sûa2ý1Ós¬¼ž×qø0±òCX+4døÕý \ï^ýdYG…ÆÏ’?sÔ"–Ö& À'É ~é“lhQl¸EÔáá•»ðlÀ^t1“p”P%~œáˆòÓCÞuåJúöøžLsú,gÌàÅM–i&´éôý¥hàòj«f?TpÎÙè¨ÌÖëùòë¤CÕŠb?ƒgÛf‘(|QrnF±+zàÀOº:Þ‘OòÑ \éjX'ëغÊåQ$:bìÊŽî³Ou_¦Ñ:bz<¸Cè +¶vwG®¤^Ù‰½¼0Ï®ÍÈ/ Ó Œ[´œÜ JO¼)•ÿjÇU¡ƒ3¨ •r‚ì>}è8>†ü4é¼Àq=À$ +RVÈ;ÕüëzŽ¦¤2ˆ²Ý_*üuÓpD>ăøhÌdµ4˜‰dÿ¯¿®è3|í§§P}†~2i†™Ô:ÒCQº¿Â`¢Áÿ8üendstream +endobj +5143 0 obj << /Type /Page -/Contents 2107 0 R -/Resources 2105 0 R +/Contents 5144 0 R +/Resources 5142 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2090 0 R +/Parent 5108 0 R >> endobj -2108 0 obj << -/D [2106 0 R /XYZ 85.039 786.531 null] +5145 0 obj << +/D [5143 0 R /XYZ 85.039 781.388 null] >> endobj -22 0 obj << -/D [2106 0 R /XYZ 85.039 159.815 null] +1370 0 obj << +/D [5143 0 R /XYZ 85.039 665.44 null] +>> endobj +5146 0 obj << +/D [5143 0 R /XYZ 85.039 646.568 null] +>> endobj +1374 0 obj << +/D [5143 0 R /XYZ 85.039 490.045 null] >> endobj -2109 0 obj << -/D [2106 0 R /XYZ 85.039 131.017 null] +5147 0 obj << +/D [5143 0 R /XYZ 85.039 466.063 null] >> endobj -2105 0 obj << -/Font << /F62 1689 0 R /F41 2104 0 R /F15 1628 0 R /F20 1617 0 R >> +5142 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R /F66 3242 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2112 0 obj << -/Length 3359 +5150 0 obj << +/Length 3834 /Filter /FlateDecode >> stream -xÚÕËrÛFò®¯`©¶jÁ*0x:'YŽ¹,Yk2ñ!É"A0(Šùúí× ARv7‡uJUÂ<=Ý=ýÝî lG%ƒ(í@¹ƒéêÌ,`ç‡3W œo;a€[ï&gס7p;q’ÁdN “Ù/ÖÕ—÷“ï?GJ)˵‡£(Š­›»Éç¡[ŸÞÿt5¹Ž\ëÓеîÈ·&Ÿx|y ‹ïp÷røÛäÃÙ÷“ÎÑ#ßöC…gÿ~öËoÎ`ä}8sl•Äƒ-ŒÛM’ÁêÌ”øJæÅÙøì_ ïù~«‡Ã¬Û ì”cDZoXuƒVu\¿’3$¹Ž¼ÄµÒf<^ðÎË¡—X-ÁÔCW ½ÈzB™d5®8VQÁ3¶¦iÁ¥ÆÜ"ÔÿUõcó«¸ÇG9V:EÈ)S"G´ËlÅ£¯>qñYù#m‰;!¬]ꃅ°Ÿðœü¯ïÁE&$€YŽftv[!w»a¬,¸ô0Ž­ "ÊáXß ÌÓP’ÍqXÈ. ç8ô2ºáÉ×MÓòh‹òBBcKVÚŠŸ+ÄV!²î.‹S|qÉ‹‡¶‰È|%nóvIèÚŽ@$Ãç(–«nÊš<†•Ûw×c^d6k¹dûX¥‘íE -;±]Gõ©£Ú*u5jè»ýj#l?‘âVÐÁÙ«ÚW7Ä…ï[?ë(žsU‘´WUÉkdÊG -^f-nÖ5Þj‘ñd¼kdÅóŸIuZ”3*ü+ð¬ðxêîbó ÙLI÷2õ¨ç¾ÐÊ‘¯Ö¼"º×zÃËÚ†pœ³jú*Ôל— ~‹Í«Íù.‹¯Î²'±" »Zó;‚lÈÌÙ0F’q¼a°) Rë49 -ÑWó†´uúN`}̵ÒožqEY†¾‰M1Áéß2o°pùêx«š3ŽvI¶ -++öH3xgSh²Gò„'ù¸ -1>å3Mlö4„sÓ’]ÒŒQ£j°/‹,r]ƒc§ê»Ñθ/ôh¸ŒâݔӅ…”b¼¥:-P±fF¼ˆhƒ¤®‰#:»eà9Ý fs¹F]_f9‚¥µxÀKZ OÓ-f¼@â!¬-*î›>$‘L75¾BZï} -8ÒžKü5âÚY;`!3Þ+}(òf¹Êø^Q±ã_Nç"È ¢[Ì›¶ÎPt-é) ™¦{öHÛa ¹Gõ]너™B^­ûlÍ\ùF€œµ²åå&_”¤… DF^rrÓèže œ–H¦ïE%\ÉEk:s¯ã(‚®Ö¢¢Dß¿Þô]ª”|vxB—þ…O} iÍxM¤U6$rˆ$®¥¸-Д.j sH\²öPH€“ÙËä•+ -»×Cܧ…ýÙ÷‘7¯™Jã"S’2Ø–‚ÔRÞåÇBðJX§µÓ´ 'C*sðÛÊø_¬ÿò‚ËE%š©Âp’®RŠù˜Ñ $ÑõáÒT§pŽ‰.ÐåÃA!y+Þ\deqZ#{´RQ1Ú©¢q¡êdn¥l`’O¤ðƒo‘rˆC§ì”¥xMXY‰sbzŠ7§®ïXEˆ6ò“ZšZÈ¥w-s—³7Èò‚÷)Ôyàí¾Êõ9mžeõÛžîLÛn˜|[Eì9Ù¡‚˜Dá‹dTJ·‚ì¸<çí>¢~y€‘²§¨¶;^¢Üªœ5ËT]JRçé ‡I´(ÊdàÀŽ{ÀepítÝ£!dàpG¾ Ä˽€ñ¿±k8p½JAìãT”‹úçì÷MÖ´ç<Ãëð1øåƒE)ú(ØNt€Ï¯ Œ°»”3Úæü-V51×À¸Ói´Jz%õF†9·rë ¨‘§%ìÊu8ÅÚœö•¸á†­xCSa¥5dªÆ«ÁŽóì8ß!x$äŽÃ¶Ñž-CJûN Š”ß¡¨kÕBŽò„*¤¯‘‰z9Ïžó·jS‡èG ¢EÕæiK×Z÷uÕuMÉ6‰ -rÎÀ#šeÀüÊøgyUt-Ä<”2ÊÈ à·PÑÒB¬[Þ©ø¹¯ÜÑg¤¶Ü:à6$¶­¶ú¼¢x­Å¨Ü˜ÝˆÏYSöJûêÅ[ò÷œ²#ÄÝiÏ…°ÜSÆ5éŠç®íð€û|u¦3.^ñÜEÝî—ìêÎe—:{LLòj›@i_âµì¾Ã¸[·ù´®šjNM)cxp~ èU<ÚŒ³{Ķ‘69.ŒøaÂ_ª!¹P•–žõ0@{šORµ=ý -rÅ”’FшÅ1•/ïxrK{éÂø‚ˆqGìá±Ï¿qveX(Š¬\dŸyWšZ&OÎür³OݤF2=¬Wú7xS#«´ô°RCšâ¨ÃLn)üH}Zží -õ1+ <ö¦ÐðÂÕ’´É˜XÀ‡ôÎ(–È4‚ÿï  3»›°ãûx+ÎÍv½}Azº‹Œzº"õ‰XïÜÌþ›ðSLê.­ òEw'v¸ß–»5Þ6áo'EJâYã6å¶þ{Ïž¾3'鎱 Ï$YMt² -ƒ¬œÖ; ]œ{'|M”øÀ¸¬Z¹˜¤Üõg<& H¸)\ØàൺJL&гÿܧ鸳g.æ߀ "ߺÛÃèî_ÅS£ÙS]KîÖômK‰!C HÌiÁs»ÇZò±ÿ9VPåWz™¨ð.ÂHwØšÐìÉû[%¦a†ÒÞÈ2ž]Ue¹ïF½eW~Z 0!ÂgÊï6KÓ"…™41BÎð¥P½³©¹yĬçƒü=WÈ+K9 ]FN§Ø×_÷»Â)î@‰Huæ ³OÑZ4Ä‹c”ûMìØÊ?L ³©ôËÈŒôWMÕÓv0Š¦Æ%ŽR¡7oîuëð¼ÐáM -Ðu¾oz’…¿Øço€–BDE¬ï[º6ãJÝà™=§«œ“:ŸÍ^B”ÏV”J1"ß©"Qé×”/Ã0o±¶õŽ7ªM˃1+R7m¸ÆŽZMŸÄ¤jä>"y÷bK|ÝIË|Ï£n>—>0®ß^\l·[›¯eª¿Õ:_q­9õ;g"ü ?­Vdº=úž=¥.U:»1-ífûpl¡Ê‰ì0Š£’”èσ¡ÈYôýw¼?3èY'嶗ԹYi‰?(#¾iEUl{žwèòt>,ýó‹Ý ¦†3éLñ¨«$ûf±Ôó¡QsÓÀ@AÚ:ùASb¾·—ÓÏhDÝïwƪÚlÍ3ÓgÂŽký…èÀ« < `àÙ~üõ~t ýèKê -Ñ/:0¢/^àî 5«65ÚÈ !Áyµ# Þÿ#\ðB½Ï?ÈO–úìL_ßb½N5aÅ?q€é wÈ\¼ÁÀÃÚ@¾,p®@©-€]£ÈJó‚;ãi½iór×ãŸ=<¯''w¯ýüÇ -Uì!oÏYöB¸l×íg[Ôv£·ôlÇ ¾ui¿¯¸GÄRgÃ`œ®†KP"MÏ/¹þ¬Ú6}aÔl¨z¤I?&)Óršëo·Ÿ³'þf¹=¯ïÛaø’t“„Ìhä&vâý¿‹ïó×~œæ{v¨ãÊ^u‘nxÌ„É(:þ˜*sÉendstream -endobj -2111 0 obj << +xÚ¥]oÛFòÝ¿Â(D É%)²÷$i›º8§¾XF +´} EZbM‘*IÅqïÏß|ír%Qr‡ ÖîììÎîì|/ýKþù—Iäz*½œ'¾«’är¹¹ð.W0òáÂŒ™ Ì,œw‹‹×?Äá¥ï¹©—^.†u"7ŒÔå"ÿÕyÿãÛ›Å÷Ÿ¦3¥”ã§ît6Ÿ'Îû»›©ïÜ2ôæÓÕÇÅÕÇØ è;w78üó§i¢œ#]}†ß^¿{Ë=åzÓß?]|¿0;5{€]¥¸Í?/~ýÝ»ÌáH?]x®J“Ë'h{®Û ا…JúÕÅíÅ¿ÍR<^ò¬1®D*q£D³%Š-¶ørƒÀ¿œGžy!ñå]¶œªÀy\µÍ®Îñ¯ð#kR +G!.Þݳ‚ÄsîágîÓ™ï”5ðb…`ßÉøgÓ´·:BYîÚúi8Ï3„dØ|Â?™FݶSZ `½½f÷ÜጾØp¿_g5o¢ÇY^ö¸xSg!ÈÃÌG¶¥´ñ¦.`‘Ð œQqº£!uÓcÇ3©óÌí¼xÈví™úYU5¼eš“1t´¹¢e@ßð/¡Ðó`±ª´F»î ^é7/ò¶4ÖФ0}§’mÜãÉê¬}†Àô‡3d}fH⩽½óîñ—^ª@ÑLÚÃ_Ò.;P†0ôźìkÙÐÑsìtÕ Î¡"£]–²Ge¸á_´Lé™É8ZeȤz9…®y4ãŸÉwE]ÂQ§yàßÛ¢ý‚‹óÖ&B¡ïALaöQ#¹Ydž‚{ƒñiµ Ø’È1 Û‘Ûtb¦ï¼Â³ÅÎ2ÛuFäæ!ä5ú5ó a•}l¨é:ná1p4㟪l ßf|×…l2CÁQÄ›BgrW?ÖÄB–8<†ïLFî9ÏÕÈÐ(fMRQäôÙje®úZ°i0y0'"÷ÌDˆ6D‰Ê__úõ÷€ö²ÇEQ·ÓNÿítxã™T±HE(›eS¿n°¹ì š4CMéù¢‡h›{㣛ÇBøƒ;%vô²k£‹ÈÉœ•„ÇGéwHÃÔYáoäqa±uÁm[SŠýBªœwÏèr×±rPIp“n4d¹Ç¡©…z”²)Û¦Û›Ï .~},"!“ñ«‰¯ ½gJ²nºž[72gõºÅÇó~&Îäfû£,µ”âq«Oᨠ†Y('|ñÏ´é„öÀiÚ¦Dœ ¿É Išðç›ú@¼±r tA²”´¡`PVá±e®÷Á +ƒXñåÄh%ƒMÙQƒêðÃa”kÄ’¡”‚øãϸ¹Ï‹Ÿyì=œÊ¸dmeÝã`e±.(CýAÇ°óTbÄ µð2þ1©f·ÔêPnQ2X:cŽ«p~[<­‰\—†[¾°BLE[<ÛOŒKùúȧöŽB“ÖÑ2²î/ŒåT–1hµÛ©µÛ£¡B[뇃ì•ç}{hµåÄbN£&XãÌ,$¶Áá^'qc0Ð ÷ W0?¢¨B×Wç 2Ê1½=›¯R7J¢=z6>Ü]‰ûŸ¼Ís©¥˜„Sðöù{är>Ë?Á¥‰.9í(¯¤\˜3ɇûŽB7›} Ñ*ˆMØ®tüßl¶:GÂqt(Lõ `¬û0ùîãÕ/ {q"ÔÖÔK³¹e¿ª3§j Jùnùgl ÇÔBW{´lHiÝX¥ºÆ¢A Sç®3¯9ès¹.ÛÜKƒŠ5÷Ù»~‘Ž|ÆÕ"žðþ¡U©<_Ð5cŸŸê!Dž»©âðo;U¶“ìM=•ýš[7H’½Ûe‹‘?Á¾k5¾©o|gŠüÔAÁA–Ÿàp +•úç«8ÎéD®ŠØuÞ²ö¢7I"H42S>WIìPfôf:‹=ßùÐpÂÌNËE çü‹u°¾éx +¾8àRåP=€Þ¾×I0ÿfEÅÁAE9#rŸÑ’òPÃl«¢›˜üÞô5Aí±“œ–Ἀ|‰;“|gWí& µõc´¨ñʪä`úŽ“ÊŽ ^ºÓ9‘N€êÓºÔf‹§*ÓÜTF²¼x¯ðÿžø^æ™' ¡\iNr½Wîò˜ ¶‹¶ÏÊŽ1§'r‘Ù6;“n‹9ÖÏH@ÀU‚ÎTDï©p¬¬$:ª *½*y9VúÁe ¯qö"DáZ53þ‘š®Ò%£g¥Ëpâ“”C/E1~Ëàëc„*JY×Ðc,´l´3¨r^K¿Ÿ + (鹤ÊO¸ñ Éï€s:tœ"‡sÔ$p8$67XÄ®™—æ1¿G mí#ä-Ÿ8~5’oþ¥'þb‚Ç×ýÒ‡˜ét}¹¤Å¾Å=XðAuÜÈ+7Á)zȹ½Ö¦ñFž =ÛlUt`æRV®Æ)a ê¸Cqv˜Ì퇔6[ ЊˆXßÆ­H¯jûNÊÄ÷AŸç´Î pŽšÜÿ!±±ë·ˆÝ~`Ù'ì¬÷´/ÐÜùª=XYÔKÊ”q¨røÙgù“/„LÞ™WcY 22~¥®» •|2Y´UYgƒè¦¹Ä HöCó–#•1Ou2l}‚¦‚Ñ8…‚ìý7E’\™¾o¨íÏć⤠MØp·uQ‰áûQLÞœJÐ=7-%Á>Âÿõ©®IACå&êD=* +7ðõ^8ÃO÷«?é=Úðz³5endstream +endobj +5149 0 obj << /Type /Page -/Contents 2112 0 R -/Resources 2110 0 R +/Contents 5150 0 R +/Resources 5148 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2090 0 R -/Annots [ 2116 0 R 2117 0 R ] ->> endobj -2116 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 74.246 402.992 85.935] -/Subtype/Link/A<> ->> endobj -2117 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 52.241 385.241 63.93] -/Subtype/Link/A<> +/Parent 5154 0 R >> endobj -2113 0 obj << -/D [2111 0 R /XYZ 85.039 786.531 null] +5151 0 obj << +/D [5149 0 R /XYZ 85.039 781.388 null] >> endobj -26 0 obj << -/D [2111 0 R /XYZ 85.039 541.704 null] +1378 0 obj << +/D [5149 0 R /XYZ 85.039 570.527 null] >> endobj -2114 0 obj << -/D [2111 0 R /XYZ 85.039 512.906 null] +5152 0 obj << +/D [5149 0 R /XYZ 85.039 549.331 null] >> endobj -30 0 obj << -/D [2111 0 R /XYZ 85.039 116.921 null] +1382 0 obj << +/D [5149 0 R /XYZ 85.039 331.451 null] >> endobj -2115 0 obj << -/D [2111 0 R /XYZ 85.039 90.912 null] +5153 0 obj << +/D [5149 0 R /XYZ 85.039 284.114 null] >> endobj -2110 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F41 2104 0 R /F20 1617 0 R /F65 2099 0 R >> +5148 0 obj << +/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2120 0 obj << -/Length 3225 +5158 0 obj << +/Length 3814 /Filter /FlateDecode >> stream -xÚÕZ[oÛ8~ϯúR¨QwíË Mïh“nân°˜ÚRlMlÉ#Éq¼óç÷Ü(+–œ»X`‚5yxDò|çJ2êÔê4lÇKN£8´OÎV'ÎéF>ž(ápN}Û z;99ûº§Ê±'9ÜË$ýÕºøtþ}òþz4ö<ÏRöhE±õùrr=rcëêÝ‹ÉçÑXYW#e]"“oM®˜ùæüßâèùè·É—“÷“ÎÒcßöC×þãä×ߜӶ÷åı½$>ÝBÛ±U’œ®NüÀ³ß“þòäæäïí,<æŸòWŽ}7´ÝžcDZ?Ä£BÛ aŽ_ Àð/GE‡B¶ȇ‡“âP`†PÍeäú£€ ¬òyˆ­—Ù*+š¼˜ŽAl]íó‡\ýìƒê~–DvàÄòí²cè/|”׈}S®¡½È*º¶ù÷S†ƒÈÖPky( À$Ž;,ßØõ}[E4\;PÁ_Ø/›ºa4o X á3jnÞ|{ûË̱¸jæë|†½…®R1yœ\#¨ëÑF²CÉTÙ±ëUÏ&‘€þÕA½ZeeEk©ˆm^¤%»Lß?dÕè[$¢.Ãr²ò#;A_î¡ü-‡ÏïG'˜ÛQìY„2ÈégË´gºàíNC9ˆÃ䥠 FÉH~º¹¡u;a´íù½üÞiì<äb£€žo•džü>å'2Õ|* -í0 _Šç|g&‚ŒS„%ˆ¬É"cÂ5ZqIÿ5C†éBêQC†ùj™¥ys¿ê!&¶ëÇLBÛâ—b€TÑÒI%–w5õjŠèé#¡3ô~–¡ U®ÿ› !#ˆŽf¨Àv½—b¦-È?PÔ¢„UÃ>Í¢³Z¤Ÿ„¡h  4Š½àçáàk9,‚”«WÕ¦‰ ƒ9„ -ëÅÓ™fhUuCØi›¿.³†òUYQêa2TÉ|AZ(«EÙ†Žt@®Íàÿdü„%Ï?VIxMC½ëÿQ·:8°q-e„føŽX¼»2xÇñ´Ï1D§U¶åêá­®š%PÖ¦é÷ñqk÷íȃ¨¢0° žªÜNÈرR-º.ŒA†öîÜÊAߟXï×9nªœoz5ãØÌèÚQòÜŠ®¢`Ûç†~u» «o^sÙëûʺƒæ¦H5ž:¨2†p8Ör‡ÃŽµ­ÈÊQAØÍkþ%ÖVÑØ#¿*§{³´lßK¤èN™¬‹]g]£‘ÓZÄ•2¸È„-ÍSÞ+ú_c#Dx†TxþKH0ªg¼Õº¼ƒyÝEûÁí,ãz•)T—R ]›Ù‚;yÑ@Yä9‘ «{œšìÓq8F ã¦FÉÜ$ÆO²êNÏx $]Ò^îù³y'T¼’r¬é¦i—̪‚PWˆz_¸¼y~@ü¾¡È…öø¡…ËÕš¬‘Dâ*«k°-8"ÃéÛ Ì1RpkÝBR‘“§ç*½äΚCì´ï9«W”p'–NŒ—UU¡,¼ñˆë–Øj³rAÓM[lRìi.Õ„L†êS‰5[èbžq;oP?~d]ø |G6 ¿xàÁ¥¹;Ek˜ ÏÞÄ $ * ¡ÏàWâóH«Éà±¥ùíEÖ"§†üB«=rdzYdfÕyWÒ€]qfä”6öU¦ZKkZµ[Ó÷HŠpUY@ÜÙ¦<¶îÛ\Íì/îè™BS¦‘^ -áÞG(˜•±ÈC/Ü»Žô-©H¬[“ðI4ÖQÓÝ}^ˆ„ÅŽÃv«6I|2 #jI0‘ Ÿ_h¥ïsžÚ°äŽdŒ­ ]ûìx ãC>ø …lúÀ!éîƒÖHú>“œ¼¦*&•Oq;t @2¦ì|™Ù\xKqlÔ·&uÑÇؘóÚõ„^qÀ—lÖÝù÷NüòÁbó¢¦ ù®²ðö1Ÿ‰-Ñò7îØç¾ -±8‡f97™[Êôýfñòˆ!wyZÚ¤|]t>i8í¸W7(Ä&qè.ö¢súû²–Ó‡¼Üàr”™Á%~ÝwA£‚Æ^Ð)ß»< ¼E³½­.„£ RæYÓ2q£È…çkèܬUn„·†(nàÑ [®ÅåN®cëf Z짖‚ê:hÜq|i6ûÀ‰œ2S=™`UÃkam”`웸‘ÄY¯U÷Q›¤£œ*ǦK² ls[ÐòI€¨-¥ä² iùŠ’Nš+´‚våŽÅ1ñ!3sðl”-àÂÖꉪIÌNˆÕ³Å›£6Çi<Ž’ —Ð8Væ/ mÚ `ÎZìmŒ‹ ÄoçuŸ$­ÁICë§xþõë( -­2å(ÒXuò!NÙðÉ*n³A1ÿöU§§\ŽÁrOI„Nö2F¤èp¡ÜŽSÂr -…rUÇ`€ƒR“§<®¤²z³d¯DRn²^s³Ô"¾€äQÄ:ÝðøŒBÕ¾üÁùšª­e!i>ѤD8ñÑ>2ž ?ã$¤L®Ù%è OÐE¡4Û¬dU,g]O4[þ¶n£¿æH‰]Ð7µ8ši÷šn,wö‘UÊöžÌ¹ÐËÆ,[˜A:÷Çͤ ˜˜Ï‚½€Dõ'däº\QYM*}hUô¤ÂÖEIÊM;…(æù6—KÃéŠ@ÌÒP>_–Õª{àÂÄ.”§@Ac/D©¢””1T;Ü*‹YgÍ\¨z@¿Óåf$Œ|à)2@5¾ï$¦7h×À³1Ø`N• ªÖ»õ“ \`DsÝ^eŠó¤ì;Þp®Ù‹ ã‡i¦Ö—)8P²Çôe¾,éÜåöê>ô^Ç—£,ñt\;Ù£9ˆŒ8\H4$ SžÔ å„$ò³¬jt^,w¶û£$ûÏ/¯:d¸<·©—<<Ñåé3EkZ¶%+nI®:—4Ø”Æ$º¹.´­ù”ÝV¼¦ÎX÷bì«ZõþáÖÔä;ö«K«§ýÙ»‹‚q7öíÀóž¹QSC÷<_sºÍÝH‚Ágy|5£hò0 -$å1ò2¼'ò¸*WÌMºçZ< @rsU ¿¡âGô¼…¯ÿý¦çúßô*’uæ¾1ýµdàTI÷o5}; -âc·š‘k;ž’Û·Ÿ^¾¹?»|‹äòí[ŽÞ4Ë–¨VLAcJAÇ.âœg/á``¿²¾ìÇÍ «½{×ë†âF€Ñ hZ–%ßÖs19$.0´`ì‘+b}×d)¡{á¯æŸw(µ¾‚a6hx] _}Z¡p­Þd•p¤¬Å²8”»ªà¦²ïX—7…îQž–·Ã%>ã-‹ˆ×GœV£Ð©çlP„ªb):n+åÛß\X7»½nK %kh2§Ùð·kvF…ã%ÌõxãqÎÊ°«×Ô³ÇÍ“É6MËÜ>â‘wì”|¨qÀ7Tšp¢ž¬8‡Ž8ĵÔLB«‹BYÊ•"ÞŒ–[5r«]k£©å¾ÇáG»@ü–r£‘u‚Ô« +Wju½¬·ÜÕ=vܺ;ç«ktèXÊžOût¤ý,g®i§¹kPÀ`Ð%¨øÉnT¨g*sÝôg£Fî KÇ‘ šü¤UÑùò¡W¹ª˜/å»ò1™CÖB°ä¡ ²+4‘ç\^ 0WxZ1ïmœ ºx¬ Ðö&¹^xyðdpooÖ-–‘~ß3¡a +òíÔÊ"EvõÉ• 43†Ù¬,ða±ŠVö®èÙ`òAÙœbb{ÄÚߦíÁò†¿V£ L7¬!Ó5¼U¹Ö=Y(h°jS±šµ¤Ë+š·©…K®É¯úf%E™ o'ÝmЫ‘îñQéÚªÄ9tÖH«„o zÒ-¨ë|G«+»¾Õ}#T$¼1±VŒ“Œ(o½" a“£ ‚Ì·o²+PÙ˜4qhy/÷Šh]*Ýó¥ÞÑê„ës1'Þ OÒŠeÕ\¹Ý5µ±¶ÆXà•1Í­ðýDNnbèEö&‚ßé±%f¾ßöàN`_¨[:ÌXŽkÆ¢XMh”l2šS$A—…ß?ÆjËXZek,Ö½³cÙBÀ¾"ç¼cBÜÐu8”ô=e¡‡ àø}0{[¸!T°ñès<8Ë[¤΂ >XÕÚ´(ŽÇUâ÷ŽwÉ4·‰;¯ +®N6‰›ÀáÌŒ<Ú®Dƒí%}ƒ«úÞf5É +ç~ÓÜUÃnÎXñîG˜úè}H¹"_R@Ëk¸‰¯Ång½md‘/: Óò€Âøx¸…ô¤°d;Ò¬hvfM'Skºâ¾h(¬ug£×ý¡Ÿ†3½Dl*Æf®@ÝEA_Ü\Ã4 @{_‚€Àâ€xlW½Ìõ|ÕÄõš4.öZü/˜Xâ(t£Ì—¿{‘×tÍ ^á/–ç¾@Ô0x[Ÿ£§o+ÃxuŽ6¦e*‡* ß*ˆæßú‚{>³ˆ•Š7)ÇpýòÍŒô~â†apZzL»ˆž…ƒèPþùZä%=è4¶€Ñ/lçÜìy‘ÂIN«aâŽg,W (O¼6>¡v?ëzÞÝæÝ3Ü• 2²Ðõ—…ŒW<ºFÆóùˆÈðô .ïc¢ü N™Õ#—ÅÝä\CTuñ¦ãA¸Msª‡®1o·Þâ°Î‹¢3êÃ7ÚÞ,#Ôõí¨º™cQÄ]i2œ $æú¢ÚX((Ë*0ΩXb{›2»CYâFšlÑNîš|¾›ä[r6™óp–!HgmC®Š CÙrјsvªÏx ©‘µ£xŠ-w{³ $@sÿÈìì‰aayj„ÚMø‘‘J•k¶Š´m8vëf,àÆøLë˜ãm¹qj?VbG}Äæ æ½Æí¹1€ÂX Ƶ†ÙÇbâ¹èbSXÕ¯Ù0):åSH¶=…G4§‘p§ ¤ñ û‚„ç@ïE[~e8gì{‰²^Væhh^½}}Jì8v³4|Zìæ4Ì ÃÄæ^¡_J£“KÅk£°sî—(2ýÞcßZœá8þ7ŠÑÈŠiF.…â,¹…¶é(w‘ˆ‰f@ Ñä¤$3³Â)ÄhÞËÜoof”øhÍ^è¼GØé +W^V+ŒQB£LŒßy‰8ŠÀöջÝÄÑzß[tâÔó—M(`‘—[ö¦Óf&¦»Ã¼¬|%føxMϯ¯ðÄ2%'–ù“]qË S›DnìGb/Û%"‹ý=ƒH<†5-¾rCÁõ«®"€ +nš1¹èA‚xjr•êŽ…Úë¶g©Xó¡°'Ì6¨b*Ž¡Fk¡ã†²ï¬'Üœ[À˦٠\/žšæ;MF-#EÞ™<´§c’qa .Qâh’=]oZaÄ]é`9ŠKd‰‰‰×‹IK NR)ÈÖšÁ,v¶-Q9®HPˆ,Ùµ# Ž%F%´¦1QœüO–ORа/ÇÈ°ò _ç^xŠu +p*t*´¢ƒ¹žºÝòÓÔ ãzÙĺpв‚´§žQŸp£2Î_‹p§+Òè¹)alš¥ÃŒ¤`Lš=)8ý wÍ¥®òÚûÇØ +±ƒY…¾9ܶ`KA">Ð~͘*n6[Ï=U³€–˜äH©C¤? ÊˬhþPèWTÕÊN!*WåÉ +ǛŠžD’ÝÛÌèÉbï‘H ë`Í•œ6JB2n"MÝzÎ +D `õ£$¶É©ùÇOˆ®>~ºä:îÿ³!ç -6 ÇÊ *YÖ«9Ð2 ÷Õh¸ï9—>ÃCåºÝp¶öfTºŸž^ÉGæ%0ìYâò'QçZüEB¶c>:¼äº-$‹B³Â­ÝS8µf2Ö£ÁWýhúN&Ò"èÃD°jfùH 6Ùž–)aµ2xPKL!_Y[aA)´†ä£˜¼9/²ña¬0Ÿ%G€£7-V±D† ßÄÈ®³¹£–)> ~Û+y óˆˆfäÜö‘QÀî˜Ö„yX+Í£>vJCBFr ”¹¡X›ËkpûjAùÕ[ zm†ÌºT?ðÝ$2‘à«šr!ºw‘ÁýÈANE¯±û5Ås¾4ó]£Õ‰c²:Fž×œ•*;1v~èfÉ4|c¯@[!»0ø¬ p¥Á +ãË!¥'x?§¶é3æØF l mR¦7Ó:9…1y¤ÝÈ®ÉY®yˆM‡ØìœÒÔ7X×O!xgÿô`en”ų€¨^¸—Éé‡Då.ò)Ÿ•‘j¥Ïõ $58=ñ'áàó d¢H±R¿kØ Üš.UÈØBä¹ø²P®fYÀ4£2-`X5üpµS‹‹$]L„e¾«c*Ò1Ò‹ â“…FnÄ¡Ðí2 )¨ÄC™}K€¯Dò´$ÈšJù¾½á/ ›|ô®&ö˜:'h~ÿLÖÛ¡oìÛXçÞŽAÙ90Rƒ&A0Ù8ä%o‘8ŽKšb/I +lzeò$Û²6Vs¢—\žÌ˜`ðÀâJôÌÌ^V¬\_¼žaçGnênyàFËc 2Ÿ) +‡}U% PVš%“]Á ¯ÒœN"CÆÏLx@”â<2ga¢Ü$Ù¿`†ÐÖ)Éþ¢áÿ·˜+ôÑÙøžû?^U'gOçTT¹q2I©’RÞˆãĹ Þ[_è÷eS-Zó”XšwC›X¹ü ©–º+×݉$‹Lÿä2,Éé‹Ù½$R,ÉXüÄÜ/(¼áxâðíœÎÍ“B"4QöI!±‹ÀZ«ï­`O%/sr{æ·½p³b¬Y»œÈÕ‡¶Ï<Ø>ÐTh:ÁÄÐß´fl1sÓÁp„pH4†­gAø +ÚHÝMÜù(Ù9îbÒ +P@ì—áÝž@ŒG&•„‹MTjû€½¸Ya4²Ù šº+)ˉDPµüfS n¢Ü9|’kº×¥ž~Á I·@‘M XCÛsÒµÇ4¸Di:Ê’ãP ’S ˜óÁ'p~þ^öMˈm9MX@w¥øË–NŠ£_s$É÷ÀûøðlæÁ<ÚÆ ®Œ®fV¡‚ñ3«(’—ÉK«—™L87°wIG®>ëÂn‡""ªŽGSÖÇKœ/]ÑAY^Ù„z˜:7iDèý3©{ÜFJq»sI2¼|øH9üª‡uáGô‹¡¹ƒ¡ÊL¢‹š ï)Ç¿-¸–#4 Švú.x´™«n¸qœ º(M?Ü ™W,cßrÍ“‰b¼ú@y¼ÚNUðÁ¾äìÏzè¡»ð +ù©Ç0¢3vflXÌ#(ÁüÙÐè®ûô¨&öw,È’q2 'ò»Q©È™Â°ž„¤”k‰M^GáÃã§Ëv<ð\?›3ãðÇ[ó—~8$Ü7 ²ygù¹)# …ïýNÑütðHàÿrýRendstream +endobj +5157 0 obj << /Type /Page -/Contents 2120 0 R -/Resources 2118 0 R +/Contents 5158 0 R +/Resources 5156 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2090 0 R -/Annots [ 2122 0 R 2123 0 R 2124 0 R 2125 0 R 2126 0 R 2127 0 R 2128 0 R 2129 0 R 2130 0 R 2132 0 R ] ->> endobj -2122 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 752.53 357.484 764.219] -/Subtype/Link/A<> +/Parent 5154 0 R >> endobj -2123 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 730.014 328.405 741.704] -/Subtype/Link/A<> +5159 0 obj << +/D [5157 0 R /XYZ 85.039 781.388 null] >> endobj -2124 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 707.499 370.677 719.188] -/Subtype/Link/A<> +1386 0 obj << +/D [5157 0 R /XYZ 85.039 665.372 null] >> endobj -2125 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 684.983 289.975 696.673] -/Subtype/Link/A<> +5160 0 obj << +/D [5157 0 R /XYZ 85.039 644.175 null] >> endobj -2126 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 661.861 309.786 674.763] -/Subtype/Link/A<> +1390 0 obj << +/D [5157 0 R /XYZ 85.039 479.466 null] >> endobj -2127 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 639.952 358.538 651.641] -/Subtype/Link/A<> +5161 0 obj << +/D [5157 0 R /XYZ 85.039 459.938 null] >> endobj -2128 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 617.436 379.598 629.126] -/Subtype/Link/A<> +1394 0 obj << +/D [5157 0 R /XYZ 85.039 148.969 null] >> endobj -2129 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 594.921 460.925 606.61] -/Subtype/Link/A<> +5162 0 obj << +/D [5157 0 R /XYZ 85.039 132.625 null] >> endobj -2130 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 572.405 350.768 584.095] -/Subtype/Link/A<> +5156 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2132 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [131.316 229.148 458.066 240.837] -/Subtype/Link/A<> +5165 0 obj << +/Length 2373 +/Filter /FlateDecode +>> +stream +xÚ­X[sÛÆ~ׯàð œ1áÅHŸl7v•IŦ'î$yX ‰ +”¬þúžÛ. mÚÑŒ¸Ø³{®ß¹ÞJÁŸ·J#WÙ*I=7HÓU~ºQ«P>Üxrb+G¶³3ow7¯ßÇáÊSn¦²Õn?ñ‰Ü0 +V»â7çÝßÞÜí¾ÿ´ÙAàx™»Ù&Iê¼ûr·ñœÏ¼{÷éöãîöã| +aÓs¾Ü!ùçO›4pv|èöãD~óÓÛ7ü¸jóÇïwVS«h•¡šÞüö‡Z`Ò7Ê ²tõkåz@>Ý€žnò\ß|¾ùŲbZ¸â[K^1'¶¾rß¿—d‰ˆ .ÄWâÔjëÎÁ’$ß·{ ¬gÄ+uÌ©mà§n‘Ϋ?W“Å&I‚Ÿvà<@H…üúö¯þÚ‚b«_®ãú™›x‘­@TcøÃ8qc …*v}Åñÿ]EJÃ?ï2N^º« ¬ÄÑ’YWæÉ•íìéÅ3 ^ðEÞW‡s_bR‚ ©òú=(:ÝŠ}Wùè<ÿÝ¥®~¬\åeKÊN¾—3WÚ½sÉ ÅýZ5ê¢Ýø©ó40°ÿ=ìÃÖXÁº9pŒ-Ó5?Öðè'N¾ÙzŽ®%z8/WËþÒ”0ð]?óÿ“ß­IA˜¸>äñ6r=oÉh@¬@öþ·4³Ø +?”EÏyˆò@ñ qU’‘ç*ðV˜&ΩÅð⪨~W^œŸë‘ŸGðEËKoÀUGtN‰þzD•P29»#z™Ø¥Î½ +4á~7SçA8 +»9•|¥T'djÔ`šçäº(…«>´¯6ÛÈœ§£!7HŠW‰q¢ +€~bëºÞ›ØÑÿah{ÄIä;ížÁÏS Ý4IÌ_ݶßDžsX@½»*óäà+äO²†êÐ’zÀ•¤Å—·_Yú½{&ôê±jv!RtSàBí8i[ÌdZÑâZ©;ò¿Á1úbë)Ð3Î^¸äË@ªÑÕ̹5 G=4]Fg±r¬ëtÄ‹tK §Fý@ `%à£lX!–ÓÐ*Œ•àXÜW5þŒxë™/ˆe™³îÈ2Æ’ìµgßÑÿ5+ö +CÄGGŽ#†V0u£.o8…ë„.·x!šù—"ç§—æ ¢ü,ä8ᙾƾÊÇù}²Œ4+ë½°j™ÓšÜ°%bÞÓ¥²á#mƒ=¯!³B°À{läè¤[«ˆÑ3ù[ž¯l¸$¾åÉŠ$pÖ_»žj"EÍ›€3H®ÈùGI8y ½é'¡sO(œT2CcƒOE9¿n1x'IR”#Zèq´ïliÆë s”ˆCB]Õ¦‚L¥þ0·•{Àpî:Ò¯í±r)E2®6Ê›ª ¬¿ò}¯OåÓ†îñ ½Ä! äƒúŒÖ‰Dº©ùæªÒã缯:B/mh!ÇÞýÈ‹‚Ü=Ë ;÷g£«ù]Žâˆ­7•PÓ¤U©‹gÞ§*ÒóvG}ïTòÓ+—†‡mì)çï£3ßÊuà ¨¹qÄž€+4¾¡Â`Óºíõ}Í~ÄUcë0EhÔM.¤sǼ©Ýâï)Ѓ +–蛊òRcpÐÈ TH…€µtíökkt´üd‚|7jMúµç÷Öä1 ¼RTV—|lûª”£mÃtò}{îùix8ÑOÁc>Ú׋@Ý/™ÊRAë5ÞÅ!„jÛÏ6’0†ìEÁ¥ÎÊ0Ògg¿òOQ ]­­£é"o™ /§ ›ÒÄÞ”ÑR$°íšS«ì]î/çE^Í} ½„>zhnÅÒ´CdhúæŽúbaZA'ÆÏ& )uº‘U$À´H\*&5ñ2âR7‡³>ˆ9„c ÌáyÍá,”bBXó¹ `¡óÑ×Þsçán +¯C*šWœÛ&w1ƒ”+Ö(åCz©éx\Qј­Âœ:ýÀ§zÞ3ñŽ„ÄN7P&º3 +¨«áˆ‘ÁkTÕ¼Ù åq8×èhq;·£aöÓÌNƒ›D« éxŸ;‚Ø°T‡¤¾bN>‘Âý!S£5èäTˆáÔê°- S$O‰ìhžÌµpAŸÏšÐÀ»Ø-‚©ñÎp4¨¤ü‘ÝÚKÙÛ CviÄhÊùV~î_”d`pmqÑŽ†“ë¢c±”¾’ÑÇÖ¾ŠFœF6½2Ú´sPÿ¼­Û^î’£šò©*ˆ‹ëJŽTj¿p*b0S’¿mbGJ`8Di iÌì(\[Dæ ó`)r‹Ê˜³]°vÄÖI + aì^ò0+„×è’XÙ0 fN8á´…ð-–;ä’⬠¿ /Þühxàiƒšã»HhÇZIWQI7ì)n Ôqæ¡4<òƒõ$Zò@0­ìÙGêÒlŸzâÇíNH“L%ä^uêjëYCcÍùüž5ÿÈ qQñ(šÒóeŠ±M¶ë˱”^Oq/øõjÊ£í¼WCÒÿŽ°"€Âì_®½F, +‹zÖ¯ðV+c°ÇíxˆÛØžèWž»yÊö¦R%ÎO0Kñ‰—DP6¸GÞ±Sú#4o-HZî½÷z –fÜÒÂ̼‹)'oaf!g#uÏ¿ë^£}‡ ;öCw!­å‚ÐמøÆ“¯ñ±œÁDl›’`–ÓTÌE|ùõçIØh§{!ÏÜÕ,Ud”ÕŽ:H.¦'::ðÏh´‚¼=[rIço&9@؇EÍ/wHzà| ¢_þ™C?AN#0R $%¯+aÉ鋱ü6žé+ <ðørÞTô`a”º¶õ©ªñf’M-$Hg喙° šd"3]Õq;g *p™y7OÕÅÔ:àÕîœÏ^Ðaÿ …2Tù³ɵ.ÉdV³I y6‹õ·ì§x$¾šÆŸ^?pk†NÿO×SýUΧ%ÚÀ×éÝ@ Ça†uߧýê[Yó©+¬SÁ ø£Ëd,èÁ§¬~jŸ¿¹TWÅÆôÛâº:™qs¡˜àöý|®å1íÑ~‹’DæÕFDŒãIÆìþbž½ø¬°Ì¼3_çå×ý7_ËåúÙò>‰ðÿç _¸i-à‹|ßõ=£ zÔWW_£ u£4¸Vø_¶¨ô¶endstream +endobj +5164 0 obj << +/Type /Page +/Contents 5165 0 R +/Resources 5163 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5154 0 R >> endobj -2121 0 obj << -/D [2119 0 R /XYZ 85.039 786.531 null] +5155 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 318 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5173 0 R] +/Length 15650 +/Filter /FlateDecode +>> +stream +xÚ퇂Û*EE¨zIüÿ_¾d{Kö%öÚNv&ŶŒ%.g†2,,Ú3LÌ>Ú73¦m´Ç›s$Ö­o§+§9ÚƒÍçNƺõý´aþk"¢¢‹\ˆZˆv悉_BÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ¹µ-r!j!ZäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ¹íQZHÛ6õ^6m~ªY-hõR²:ó~ksEë”õöñ©²ãùlÛ¶ÍÇáÝá¤.?(<̧«‘ Ñž¡¡5›|¡µ>jd®ÑÔ¥>ŒZxßj{iu¨…TWŸjÑÍ'.\MgozùàììxO­n#¢=I z‡ÚwÒ¦u駻KcR™¬ÖÔ'ú¸`’îá™iò³¹¼I@ ã¹½?Ÿ „ÿŽ#1ó-¤[Ê´:&XÔ¯Ýðø¶‡ú®yrºÆLáZ‘ Q whÁAsN5ÓÁóI´‰/ó‹·c´&”±>=UÙœ…f|¢ª„Z|òo:«©8qa­¶Uxs[¼Tj÷© :é©Ö6½\\:T`—À— ±m~ÉŽÕx`4+xáp\)èJwN‹“»–ÂåkÛ<âk\ø‡µ 4•Z©ƒ 3rB¤òu²ÓµÐ&?9''i¶Ú †Ö^xÓ'.,ð„„†ß¡ÿ5z¦ƒ”^j§‡W\ÈöDh…-:ø` ¡PO>’WSÂû:tׂ»v”vÔž.Ÿ—¯#¢îÒÂbm‰ú©‰m Jj»¾´“P}uQé\áÂE ê^¡ítTÿ+zh˜9Vv@ÔÜ š}ÚkmŽ×ä[Æ_s!XzWç§#^ §÷Öâ‰ÖƒOöM¼J§úHZAApî%r!já.-ä­¦º'.Ùo­{ÕÄ–šAãži¥O &=‚ ¨Œ%„Ç›Pþžâ…})¨™Õñ`¡N±s4Œ‘¹Ëå+.(ðŒ’WÓ[.dè´õ§xaö¯¸0;PWyxWpùKG.D-Ü©…*¨ulG§É§ÏÇ^¸PúþTCêƒ\(°c +”’žœ$MGÒ)Ojpü›·ñÂ9üµG­Í…̧ Þ¼há̃¾9 +Vp‘ Q ÷iª›ò§x¡ÄšJÔë&VGüõÅ¿ãBvá ùñTÁKÐÔ)åÖ',B_>¥ñõK§(¼¤Ñ‚; +½pAW¶¸`ô©Ž¾Ä 䢅Z+™Æx!já^-Ô]¡“sÝE{5œÖ†þÿñäÕ¿ŽKhµ718m>j)Te}¹ï;­raŠÐV¼N ¯/$ÊP˜Ë^qAºW\0ã¸È…¨…»¬[2_á¿úTRªDÛ¿*‘,9\h¨ÛÓåÒ娿M½zS7G§~BÕXžG„3ª–óàð^ë«ÓK¼…¢/ãÆSÞ¾T¼9¯OÙ‹åw®ê®p*Ò ÞU¶]ºM+ýz~S}Ó1^ˆZˆæs[{Éþo<¿Mî;ÙÙ~ûr÷CiþÿŽè“YâË,r!Úsµêôý¡JSÌ y$c¹$íúÁ +±¿­±Vÿ°ì²ÖÍ‘X콕ô(KœþõZÍD3ߺ=r!ÚSµÀ¬üH ¥f»ù©BÆ¢w>ÐBî;úãž%ä|VrN2ö3Û´…ô)_käBÔÂÉ2Lò5´KÂÙ÷fi“ N5;ÒÈͲ:dBZ«:l 3äPÚËÀ±âKGL\Âs¯¹@ºpJܯ$ÁÙ*Ú¥"~®º¾­áN®Ý±1Ь]ÒÖˆ&(Ñ–è³ÕKŽé²zé$>^ò¸àÙsðÈ…¨…“ p‘V§™Mp† ð0!äRbbº#GÜ£…0Y®O¥[6ؼ„L³‡yZÈ«ó†ÂÈL¼WâóÑùöjç*N>’ Y÷²p†^á摬ð1=gåc3È'\ˆö<-„¬Ž¦d_*¿„œï*øH•³ŸçµP†d¾Ž$N'©¤‡Ò;&GÅ$µ¡n·˜>’¼¸YJ®Lâ…Ôã~W˜˜3z7àõÚr?áé1dªÏT +Õ}™µî¦né=¦!Vº xùÓWɹµð±­Øc.`‘…Cº +ªeZ€ï{f­0ÈlÞ6äP[·SihãùH[ÜÜZWòJ aÏžy:q¡Ûµ»N‹ù„sˆ¨µªwz=òoOÅü_ +8Ð\• +=nˆ„°íCù*xäBÔÂí±SÒЋäœeSuÒBGÙŽµÝþP²Á°ú(±óŒŽs”ãf ¯cguÙ³'paС¦5&P©Ýl°v+Ü5€¤úÂj&à´¦E÷,+ŽWtÈ©#­}úœà9r!já0ƒ\ºƒƒÓ£'dÆŸµ Ó4ÍB?6ï ›zªRJ› ¸3_T¨ LHÕZÊ“?QaÚƒ ÷é):,2Ç#$HKð‘*ÜóAbÏ+\x*+3P½i¸/S9 –:„Ó´¹µp>+x>fU®ÝÔiÛRÐÀY 'µœ¸ ”¶P1í˜ÃÁÙj1´Zå¸ ‰Ð¶†xXN„¡3hî…Ðì2¾§ÍÑÉ:qABX ŽÜòÐþ/ +.L!XmÐw¿‚c-ºNB«Å!šË¶¡‘ Q ÏЈ5 ·’bIØtA«=Ä ïœ`›Ü"F¨ìª÷–¶Ž„ÀYëB`Jšqv¼,³aóÁ6lÚy±`¶¹ÕbLŒZp +Χ¸Oà58Dö@-Äs¸u÷»Ç'Ðã¹í‰Z0=³ Ç`ÂÖO¸y² ÿNb€ @†m—åЇFŸl>9÷ø¢} {Î}¥¼oÏ® §Ä†Oû@p»g2ù9üw:×D¤ßÃÅÉá7>³'ûqÆ-„ràøÈi‹ÝÈ…hÏw^^m¡ö€Xœ=iÚÐGsE"¢jœu<›ÜŸõññœóF.D-\lþua’ÓsN¹µ-r!j!ZäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ¹µ-r!j!ZäBÔB´È…¨…h‘ Q Ñ"¢¢"¢E-D.<Ôfµ-r!h¡”Q Ñ"І-j!ZäBC&£¢E.|0D-D.< sÔB´È´¢ŒZˆ¹€6}g0D-D.<4b(¢¢E.|÷ˆ!j!rá±`x·¥ä¼°ob4j!rá©`˜­]èw0æ¢"kÛöN õ7ùÉôŸÕ‚$O´é~°xžê\ÎßS rAò'šyÃÓ-yšýÑ®îyýÂ6üE\(Šíi6¼žËH’'~6þ*뽩ži}䛦ôMÄð͹'^òõÉŸªój—‘¡JŠ§YVD.¼ý‰û´0“§Ú|v¹?íòÌ…¿O }j8ߟó—IäÂ;0L?j¡{¦?¼•øcóqزOïó¯p¡Oùþ4ûH ÿözçdýQ ÕþÌ+®Ýé¿ýóZøw¸ð{µðo¯w&¯Àð{´°?@ ‘ ‘ ³—õÎÉþG´PÍd¨""¾RœÀË?¡Ò•e÷鹑 ‘ ´ìÒ”˜? …û,r!rá‘`(Î`ØË暈ȅȅ§€¡ ‘ ‘ ÿr?’Ì.•3‹\øf\à„Ë}—`ä¤rQ ç‘ ·Z™¼ÃoÔÂÜÃðé6è.$p¬Nݘ~˜#p*ŽËï¦ålë­ZHÓ²ói ¶ägÇ3¹ªl‡OqmÖö[M—¥."mu–ÀVðÈ…íe’êšýv-ìã0úøì¨t"{\´·jAP*¼pTPQŸßÕ¨®ùÄVŸâ‚é\¥“L+!˜Æy†‹–Àá;Ë %àÞŠÓk#®²—Iª…üÝZxþ¸³jéâG‹…Ï7Á &r|P)-ÈÓýéŒ,ÄÎ¥J' +\U¬nÇSO¾ÖËBëÕ2©ê“\8´P øZX-Ý]E¸¢«e”Ò%iÙû‘®Ãù^øbþ¾umBMAÕm¦3/¸DP¡ù¾h¡€V{nJðëÑ»ù,^kÁž´0+ô‘lÐBï Àȧª/ +ÜЭÀ­û¸xµ`VäBe¸Z¤?àÄë¡eq|á`˜ ü¦Õ*¥³ê{ê¸1B`ÚPÎ}ÐBëA©+Á§ïû¬°OU*ßhÁ/¶€X|¤¹°;ZºÚS—¶^ ›ŠOÇ .œ´°#FÂ…wÒ•\0··6ráz{ùâ1Žþ ×;Â9§2_0hû…U‹ àÚ3[O³Jqh¸€Þ8Ñ2B?§…n &S¨ÝEã±_ o¦½mÖÌC3{Ò_P‘KorASl¸E>nŸçOê-<Ý· ‰¶Zی󦓥ÈM²,HšG.Ü`—IªsGþB.ðödÅž}:˜†ašÈ̺½‡G8¦@ˆÇ^&’px¶O ž†^§Ohá ÍÓ¯æ#qrºCx˜ƒAø +7+‡»†à=Câ¸ó-ý—ˆ¡Oþ‘<ûL_nœ§ú÷Ûe’ª/åßÈ…´ößG qžêŸÃæc~¤ïÃ…^‡¿ò’~ˆ­Á"®i§À0•æïäÂDŒù1Ót[âÒ_haªš0B3¾Ôäù|~Ò´h{Ñùô¼¬U6ɸÝÁ>´õR7ÃéùæÇ©¼êº‘G.üÚäå‹X³—ˆáïäBéÀlþþ`ŵ0[ßc©é¥¡ç&vÕV%ÖöÕ ö®s=ÞÁ“i¦”sÙ9üa#y·|å‘ WXv™¦_È—JóWr!uE¿ºy×’ä‘Z`¿»E |ÞÀ›ë,¼B‰Z8‚uip0ÃO†àL©Ô¦÷p!Óá+u_÷aú‡ÖžóaØqºv¿ãTr¹p…‘K«Ø_À0èöoäŽúzßÂ+ +!(÷-|àaáùêªèê§\‰ô^‰QFd®õiN¼bÑyäÂ-\ø`˜È…»À:XïâBµâàÂl!Xm_ûHBkÁtX‡?ƒTøjͨÓáîì@ 7d»’ ÿþ£ß|’³œîÖÔ±¢LË4- ­ !ùZŸà¡Ò¬ÉmZ¸ ¼(#>†Kl‹›ÛÞ/”'-ä>TÃ椪[o´ßóª¶gק¥øˆ X¹ÅGºŽ ô‚’¾)ÎÙ‡s.׉în-ˆÔ[dz |~z|9¥WxˆF­7iágë÷sÄð¦ÉÙù\¸Å.“5I7ߧ&=¾]¨ÙÃÛØó=@ÛÏOñÂ|êé´Ö$‘Nß”7ìJ.¨ËÇ)í›ß¸±ºS‰®Øx¯*•“ä ïßf¢Aé š9O~©oÒÂÿrÁì=1kÏ“uXÍI+ã¼=j!|w£‰\¸ —Õ ù¼Æú%¹ÄÔ´§sfËA‹tüœŸŽ&ôW‹¨‘ï¹iÉs¸ –¿þ¦Z(aEH—‡3´³E0½cVSœªŠI²Õô-TP›æó|£VÍ,Ëo_|¤ÿË×z[¼°ÚVnº!½ívê˜ÐÙ\‹Ìaî0ˆ8tN|"ՙȅ뭿ŒoÛ_6é­Ü6 [?´Ð¹¥ØÝÐægïõÛð.dP›.ZÈ AlÓk-¨Çp¡•‰nä`ÓÅ&¦Ð%Im–7“œYá¼*xäÂçÀð—­kC鬃)T%TÄ“(ÃÓ$ƒË únè8ýl±ÙõZ0àõÍN¥]×¥ÁÓ +7\´ðxá@ E¦ti¸Ò ZÐy!f×/Z—E.Übà Å_¶ÞùÂ…¹×nª´²–œµ€ns¥oµÒ‹/A\®„°ifa°Åú\„>%ÜKçغX.7’¥«Õ®e•‘ëO\`Ú&œŒðºØt“W/ü}ë‹Á'àø˜lòE'}ÑT»ŸŠýð á)V?— NÒMÆêçuôj-äa AMÂœØINþœ ©¥þ\؇~ß·oyŸ%¼ïù¼ˆ£p¿öªÂ ÙÇnÃ9iÕëæé·iá ÏG’*ûɳä—Y™®\¿ðòs¾sS)wÚÝ–‡#û~¾‰\¸Ád6?B Û]$Œ¾ò<ÕìgZJ“®ÄKZ™8Oõ~;÷ Ü¥…Ù‰_–©µxŒþÝyªüZ{.Éû<ÎSý<îÒB®S?Ë 3ÅM&TœÙð|eœú9»,šz¾íɘéžkÝ®…[<2lXh>gXÈ4 óÖÂû¶¾¶-L?z79 òxûDÙÛùÕn‘ ƒ¡¿_ Jï¾u‹ÕnÇ›S§µ«<.º ¤,ÓØYµªËÚ…ßÄ…UìžPg­«'?âh\[±ºÌ×Í÷áYÂ;5š +ä©1uøH¯Ä@è91 ïêÈ…kí”à-Í&¨÷:!¨Fëž87æÚú +Xpž¹ +ÏÓÆé„SçÚ~zÝó'¸P/Þ [‚{¶.é7æ KùºZxG"T‘eÔ šú°ÏŽ÷l5åºÚ|‚Ä€1Üd7x ¯b$rájox½W NÕ_€…Ök˜Œ×o>ÕŽLV¯Ù)N¨Q0£.€[t÷i-ÜÌ…ûÒ…³¦‚×ã«…ò=æÌ£í×ÕÂ{.!qT¹”Rt0{­ÔhZ`,uû,ûz0›P4Ù—FÕ <ÓÕÈÎé:ráêVýÞõÎPík\³3BS ß'-¤ ¤p9ÍÜ i¨S-R­­súÓW» •š}ÎÎ!Jëð^§ùŠZÕ×ÕÂ\|ç¹^;WŒñšu¹KSG·Â:Ú­3˜ªœ¦ Ré¼qcb]¹p}³¾ßÍ…ëzM-4ºPÿ¡í/WàŽð²ÓÄÕZ+¬‚"Ó6ËÊtø´næB-Žy»Àìv2½-¼[èó•¹`(&¼Ô9Qb’½ë¨ÍL¶q[²Õ8-G»Ê­Ùp5h-ó´0)‰\¸þ(ïÔ‚Áj~âj!KáúH~búLˆšéF:]ÅöOkáf.`êÔœÍÞ4Ðð“#*M‚T\Ó~.Øq3Ò»"–¯B[:¬3»äE­ÓœA¬ì{P”¨†Jï‚ñÈ…Úu~Ÿ ÆË7\ qbƤFŸúÔjpWÂÚúé‹ÝÎLš…­sàÚçxAñBfÉ—ÕÂñÂL ç;4øœÛfß“ÆÕ¸  Ò.#ã¦o3ׂ\È¥l-ÊD.ÜðÜ·Þëyá·t÷2Í&¸Ãý^}ßõ!UÌ©â]ß7)~ÝC5fŸ`¸ +X 鬅Ÿ<é3`WèGò›¿¬~ŒÂR»b¯õFÕnØblNj]o}«³B7¦qÅ¡Âl2Øzvˆ\¸Á¶á>-ôÿ3ɵh­nü^oçBmÿÜ€Kíj¤rÎἡÞáÞ ×ê«Ä ‡xC%)˜³"!T7¤qNƒ¯d*|¢u +±3cŽöà&©5ráz“Ùtß|¤Eó{p´žq;&u$(2|“3¸¡Äü~’•_W æƒù©GB°²ëÉjö4Åá¶lØIŸ¦˜Ã$UbB¹¾ßYS¤†¯f+"n±¬¿oç}üP ¤J>OèãÎÝÿvœVWÍ‘ú2ó‘^¶oæÇÍy?ÁÁ·c+„í±?ç1^¸ Å_ºÿ†üÿÖ'4ÉÖÂùTÛ¸Þù³`¸Y k™eÙÇyTBâõ>­Òêà^¾>4}"„þÌ<Õÿ»ÎtÝL?Ì\£p™¨úÑr†S×åN“òøëäzÌÚö~J!šÐé¬5ÁŽ¢u5.ä8m£õ,Æ WpY*˜n¦Ó NÞûHÎB 0på°\mL&pšt:$Î :ét–E.<ÕG + šq†*ÄÊv&-&ÊJ ¥Ïh¢èzóU¥—¨‰Ð´`ùC ±é×\`ŒÒ%3’†4‘{ò2ìGÚQ ”‹zcúRè4Ó˜8¯®Þ\&)û•¹pg¼€6b˜ÜjJšîXâOÁÿµ…xY@GO¨Ñãöä9¸€ÉØA žáÙz£þ-.ð}$ivÒ¸žì¤t[cwœ®z¬ê‡x!Áôd|IB9.–Ù‰ÕÆæEÈQg‰ÎÈà”‹ýHÏÒB}^™UÚ ÒiÑXÐA­]ŽÓ¶nÀG%gòáÄ\áãv¯´-«[W¸ý{ñBãðÁªd-“¹ÍŠ¢è×' šN§ <ÜÀ +åH«ó¡OÝ8·ºê×N R€·.“"ž¤…Ξ;Èb€owÖáFOsµß©uV`@ÃÑÔK! Ý)YâX”8¡Ûº´¸Y ÿ\¼pha7|¡ZmÐÒCœ¦ÇÝaæ “:œx«©Q‡p+ŽCpnjLý±¬¦p9¹ð4-¼¶ód†ùÈ%y<œÏ{i¾›ê°èêØÞŸ˜Ô“ºÿ¹qça½dB*º œ£~Ø’$é éaÖ %ëi¬CÚ….#2¤éÞÓzœbXã¸óoÐÂÎÕ«Q…‘ÝØýsãÎüõöÍæœ?óaIøË#þªàyÖêËôÕ8é‹j¡¯ºRå­•øŸãÂÿÙºòOÏa\ø"Z¸Ïþá|ª³È…¿C ‘ ï3ÿ }äÂÓÂ7ysÚÚ£\hÎq¿“î‘_räÂΗüUÎ#>”ÿ+3¶$ráiáXµ€ þ:-o˜­.©…– ¸&!Œ±œz–v¸‘µ€ún9¯á ÇÃBbVšÈ…?£…J³®¢¾VªYZR­÷0¼¹p7xQî<Ëø^&j)xÚíRš^Ùn7å2g×n0C['fÏŠ<• %‘ Š ÂãÔ£bÃe/é²ûÈ…‡p4lß-3›Ë„Bsã¨ÐÕf]ÍkG•"µÚIêúÒ êJ"œ£¤p¥‰\øC\IêôÚésò‰9rá1\È\’9·wlWŒ{U¿ ©˜JðEwÛ®‹0ŠÎ~aœ©§æ-1Ÿê‹¬Õ ˆæ’&2Æ ŠŒjG¥ÒZH¨ì²f»©€ b¢j áà‰euÝî˜Lª•;ß­ˆû/ü).hgUËqòj8í¹ð¨~$Ò +š×BuD-’ÔŒS»TB¡—7͘’QUŒ÷n›±êU*`"ráÏÅ aNR‰[ŽøI°-Æ âBæìVi»‚„ZÀÙÜ’¡d Í#Ù£rg n5ÍU-ƒ$#þ\¼pŠ(™[\ÌÆt*1¾Á‡y|YShaø¡. v†`ºÑb_œ`¶àdÑ7©SB7Dµdç…ËbÞ¼?ØtT wJ4ÛcÌaKïÈ4¹¢gÐGu;Í8/RÞu7tý^5+ïÚf3;ORH‘·¥Ù±‡•,‚Äñ…?£…d¹ä?Ús¡ Á4ÖõøÊ¢…˜ 8MÕ+ÚVnÂPÀḛ Ãk;?­‰&§’;ëL_ø3Zø©‰öZˆó‘®7SQç#}A-¤ô OœtÓ„ÔÇùH_P Óôˆ³D.Üd<ÎSý’>ÒC,r!®_øòZÀL†`ó³µ¹ð-D.O3^\÷ÚÈ…ïÃ…ããpL»>44þ•&ßµÕ%^ÀÞ% ÉI Ϙ\~_-ÌʽûŽ³ñú +§¯+¹ð]¸`ÎÝ©ËS+à¦Áèᬅŕ™«SÅ‚Õ)ÆÜ-…7½”Šùò¬ÏRO;ˆ¥É7Ñ‚|Ÿ!¯¸%#’pWõD.|.Èv;Ýë„Èe¸if_2ÐÆ—TÔÇØAUž¿l*–ª<Óû>?鳨‰Ï3?Ôò+ia*ë¾4^%e‹ûï÷¦ d-¤5&Ç3#ø‡~ª5Kgß·õ/«àCïU†ûõŒP¹ÖªïZþ¦ûé*0D.ÄùH_D ñå'b‡±dh§øçf霱š…MyúcÄ™ãÿ$=6êØÓÚêÖã»AÕ·ú F’KʽÈç#}-(-ŠF»)ÓºídˆŒÔs=¤ºöV«µÇ™mçü£V« §²gº/àEÄi™jÅ1ëj§uÞ‘7ÝWÍTŠ\ˆ\øZX5öø +—š«ôfî¨Î@ é±@Af5-`UÐ@•*£˜.Kx\k‘ŽÚáê·wï€ék*täBäÂ×Ц±õ¨už\ªr«[Êœ™0v´õ‰ÕV@ÛŸ=h笫p7­Ðð˜ÞÅÕÓ•Zˆ\ˆ\øZ èãƒÛ“d-ôàÿà%-Ç<‰fPß«P×Q nÄP¦Äˆ-øRfLŽ™îUrþg¯ú1¾&ò\-¼çBoLäÂïÓ¯ÇÊ„¶àáLõÒžë©Å5ýA P÷A uøGv$Lç¥ÓG +€7)qY/îðAíJO]â…-¼¹n6÷×áÂ,rþL-ð¶å)‰‰\ø]ZXè¯R¶ìRháÒë³QÁŠ>ÄÎÊÀ-D¯üçÆÐQäúа6ÐB«ÝÒ°ª·±ºr0â qAi÷X5ü|OhoèƒÔ¹p… éþ•x–@]œÍ¥‚Ì\‚¿€H!dÆ{P¦ì=!œm.2~øÇ—m²"œ@â$u&ªã4öQ§Wiá÷sax­…W_Oè^n¨S¾ÒBvJÊy6ð.q‰Tv»§dä{ãÛGZˆ\x­lôõRü‘w ®Kñd.Lcûƒ-õËýzy¹ì<äêíŽë¥¯ÎÝÖ"¹(Å-\^ÿ=-·Õ&]Þ©^hþþCæB×m´ã‡ey›³Ó×]N¿] +‰» + ÏæÂ,ÜÕ¦O«ZÇ;®Wß|9]߈p®®;½‹vþ*ìË׽̿LWÖægÇ ³œß™/Ìt¾?™ÂŸïΡå°ã]ßÕôêrÓÞùËý¡Ûû7fêã§Ùnö‘Ö~}{ª~»|Š—OÙ8>ÍÑà«—®ö3Æ Ð<Ðõ ;s ^Ø^Ç Û›xÁŽ$è›Ø¹4œï¯þJЂ[rû°Ã›Ó„¿}ã…+âWíî„/ÔÄ«„_õ#ÕzI âø‰2x£…ú«w¬}¡ñ…ìÑ éOÇx–Ç›ŠýË¿Ñw>çq>ÒoÔÂ7°8)r!já_çBœ§µ¹ðõ¸0fÎ>èLž>0õòV§)j!ráëq¸rý¨|:>ú;Y.óÞÊ1j!ráëqÁ¸Ôp>Á‡Ú_±™5 âЉ _šQ!á²²D f +qÝö—бƒŸ¦cW•é؈åXüLÆ÷n—$haOΑ ß’ TâZg«›;І»l¶¹/uOƒ‡ÂõNòTÍÜæÎ €Ø¡@oÓÒõP÷9xO«ÎähÎZ€†²r ´tá)k «=j¹ZPs¨¨¹ßu–BáÒ %ra”Cã!¾†ZøF¥˜<é eí2áv,¸E²:¸×BÔC:W}äÂ÷ìGª¬6[­L±v¦–¡«žYf«ó2øÑ)a‚\þ¹ï%Án™<…r)¾«ÂQóS\°=¸OŒÉV’éþgZ…ú£š÷k7¡«!ò\â2L¤Ï}¥Bú¡m \ØñË®Å.¥¥þäôðÈ…`žjš|k-LØG†ŽOi „7àîíæwÛ¤¥Ÿ„šÑG*pÏ œÇR2úÙËE.Äyª_] !hiuÝÁ‰F×T®öʦ•++×dp µÀÒÅñ¾sÉÜgW E.Äõ _^ &Ke5n½2wBŒ³'­ DTT4rjVÒt‚&žã^+Ÿœ#"¾fU†Øù#,ý´""¾º|C¯ÕBiÙ§×eD.D.|}-Ìì¯K§ØçŸÏ1¹¹ðõµð{,r!ráËhaÎÞÖ»)yiz*ø yƒæi*n¬Å‘ ‘ _F ܾu„æÓ’“Ø(ípå©VJ¤Í""¾©ÂÌ‘0Gä¸ÿZ “œXã_˜å%H–Ǧ?ÇËG©“¨…£=:&’L¿jœ""¾Œ ݇¥eØ+š)+Z «Ÿ—Âg‚-vœ(?([Žíø°lWS+z/sf)÷JÓÝ. +—?ñŪʓ%ÿU÷È…È…¯ã#¹¡€:\»ip¹¬géì/m)åµ®ä¹Àl\kè±ÝUœå[=®L@TìJùÑ%ı¾Ó…Šd.5k²È…È…ï¢ÝgЄ nÎFÒ†¥Òm^²l„J*Ýh\(°¹¹a.J ?-ç ea¼yTãŠÌÍÒ•àe¥¥N“A©9{õ.LãEXò'«%d³G.D.|Ž ™•¾wòY›OZ°E˜X!y)€yžæcˆ¹PV1ãFµ»–¨ˆ&–6ZµÜý2’¾… “»|¨æ'£€DgÔÂœ•eZ–˜ÙçÆ\Í‘ ß PÕ'šžu3Ôméf¸ +Ì Ü°÷”Ä¥H ;iœ¸PÚ;{–b*ŸÜýr¯¸›¸j7Cºû‰ªëW±þÚgd•YiBƒãª…W¡ƒî[êÙx‡"¾øæš¾u=.Z[†E—“£C®G‰b!˜åc¶´a‰7hgÖž´às[n‚ùBw&p¡óJ ™k¤.ÊøP SÌm‰Ó-\UÁÞ2—„¬Ý}儵ÜüB7k¡ôržq(‹Z säÂßÚ$öÎ~¸ ©Â/™O«—»èRN/z¡ZÒtL‰†ú +ðP.~®«Ÿ…èæýRz.k½Û£¹ 0•@¦à +q[âÂtÎ'U +¼õåÂztÕ ÌÂX¹ðwjáMe;œ“ZÌoæÜmí ü8¾wix•)ùX¢úæÈuÍç­\ÀŒ$uÐB«Çªr9píèCžŸ¢Ñµ´ÔdY¹b6LäÃxv契 ßY ¿úmª}ì9oæÂRtÀßZ/`Åî0ÕZ´P[àÖãµà¬u ÊÏV³+1íaä¿®?äKõàoøó\ÈñÇ®’Þ­'-,ƒNB_Ó£µP΂¸$«z ¤š>¡…ÿåç÷na¹ðûµð»… ³»h¡Ñ]ïTYë$pÁ.ì:O¨^fý”x!pëÌðäÊ Z×qÁ¬E9\¡¹ðG´ Ûæè7;7™ï ~•ß—Ö÷µ …79Áž`ïÓÔ—‚Ve7çëc¹µñ£>ä}Ìhsôظùg–£šxäÂoÖ‚TéoÓ—Ÿ´žºhk +>’ߘµB~F ·ë¦Óù6Tº6;g j»{ø€ã1ÃmEàøS+<ä‘ ¿K ¶úmZøòó‘N3q1ÕârÞúk´^ÃÎÄ̹[Î[¥³·#Å]@hÏÍØÊR)š²]Õ¬”RõN*â¹ð»´pÌÛÞ¡FOÚ,l‘2×jÉKߟgÞÔBµ“—µª« +¼%>¥Ÿ|ž*/44÷€b×ä.'ÊÕ£½Io›Ì-°{¥E;:4.¯•µ¦m¹ð[µ0+Uæ:›µªZx¥ÒZ·8§“­2–V.÷ÔÂAêWuŸJ#ùÏS5™.Q$Ü@íŸçÖõŒb.hbdgÍ¢8l•êbÚYGXmLçÖÚã…ß«ÒÉ0óH7~²cý) ´-¤ ª1©ª¢ãËÜ~"â¾› ·çºÿR\Hôˆõºß6WPF¢ZIZeJ·S!…¶Öê±sïmµ;]Q+û‘~·T¦t>a¥jRÍC6½“ÀoRn)°õ©i‚ÛªXÇ?fQ/6q)‘•ÛTKH˸Q⡆d+ûÊ ´ÀmÛEʯÒBäÂCµPê<.û„¦ ;tZ`£ÑK1S:`ý§ts›_äY’nãBØ%'ËáÖ(çG{¥LÓ 7§µ§÷jaVÌþb–_;ßÝ”êeZ ‚ê&LЂÚå¨ÕN€Eå2äÂjs"ØfÀAZ"~§òuØd£wŸâüÔB>;!+ã~]©®6ðŠ +” )Ü0AÂ0Øs¹öAÙ3:e$Z&ªm"q â¡íØ/g‰\§Û®Ã0ü¼m]ìt/vSáøBËM¡œ=W9!¹Bç©çiqÖµ¤²7T»'©›kÁ#~—&¦ƒN¢”JÔ‚Êq§ÑC ?™ªŽç„'ÂQEý  –~fgž›¸ÐY>‰—P–«Åo¸k\ç…DÕ¾ÖɦÕPºá!Z8¥@À]Š‰/òEM¥ÄÐ…ís8*W«ëùN.à¸s– a-Ë8߇~ß×CX3I Ä ÷b0<Ëz³÷CwþmZg™s.ýÔóvdñrêkp‡p›!³ÉŸKàÆ´äØjb†OùÖ7q¡Ð«×ææ ·l¸­\1Û%M©Ãø_ªqåC´P8;µÔuª”¯´K¸z  t©k½rÝt/^ÍGâæ<øÌ/£Ðð;¼9øò0rá÷há#ãŽåʾ_å¨l«,ÿüYo‹*¦.¯ ¬ò;ti³ÙYÆT˜¯‡²$ÑB@ãèîf¬7ܧ·4Æδ–ù¦ »ðÕî)ÎSý{´à{ÊÄ_ú +‹;Nzú|2æ%«™œËÙ'.÷¶˜p=ÁP\x”¤ÃìTÜŸ{²yÊ&¬îÛýÈ&9R…£*ˆâú…洞§ØM\H]¹Rh¨½à†ñCbGok¹°"±Ëcµ0ÓPÂ^õp¿So´ Øh€ ‹½»)ráKkáÓ“T§ýöWÞÄ…©eLô>x*~SŒAèÚ‚Ó´0F‰s%*/Eò8-xŠ;SpÃÕ$hÀ“Ä*ð‘LäÂ_­1¾ü˜¿¨Üï +,·Ï¸qÜy +eÇc1Í1äŒëPo|¾2^8ú‘µ˜µ1¸P)ß:* ’È4“‘ ³^¦çw¿ZÀU½-Ыõ©\8U1¡»{¾›+ÇÏïjÀl3¸žû¼o1nƒ<”óÌšáýH‘ _Z YQ-ß…—£ªóÝ󲬇,ËkpNʬÎ|Q×)¸#¡À’s?¥ex‘߬…Ûç#Mc韯…XäÂ÷×B㩦Tw»Ò8µVÌoÚŠBèeq™WNu™£µmˆr-lž­U©¯nÞ¬*æS\øÚ\ÀL”‚ä3·‚8•-¡WOÍZÜò]ç <èÙæ>$ÔîÝ­cÏ1ÏväÂ×您C­¯˜¯´RÂ-¸‹³Ç=•#p#Ãiª¦»ð!‡q·Ž5D.D.|q.´a¦4û•íû!ÙG-4vfŽDíÃP¼XeЂq·Ö­È…È…oÁ…ÎÊÍ¥žÛj@-01Mª>¶QïG†Wbƒ Øý¹¹ð×hA5¡?h¡Pµ™`Âo¹àSÜ+ÐÂÀö!%w VL3ÃÌ)×nŽ¹¹ð-´ gÌùþñ~ò¼ÜŽ~u¯Æ¾˜N=ïs’¼ó Xª›;þ#"¾°þ¿Ú~WÙD.D.üZ¨•AŒÞ>¹¹ðµðkïêöÏ‘ ‘ ¥>a‘ ‘ Q ‘ ‘ Q ‘ ‘ Q ‘ ‘ Q ‘ &ráOiañ†/ÿ×·sa—äY&‹×Z(žx¡þµº~xš‘ ?ÓÓßÄ>äž<ѶW=¿ÓðÌ+½Zå'‹g^ÈD.ü¿MeÖ}ù?U•2;Çßëñ¹ð -jáIXäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ¹µ-r!j!ZäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ_BäB´¨…È…h/ZÐy´‡[#"¾Ÿ §ãŸÇÿÑ,âöÛÙgé<6endstream +endobj +5173 0 obj << +/Length 107 +/Filter /FlateDecode +>> +stream +xÚ`ŸÿÒÒÒòòòfff777êêêVVV³³³õõõFFFÂÂÂŽŽŽËËË»»»¤¤¤ + + +ííí|||•••………«««ÞÞÞÙÙÙœœœýýýúúúrrr---âââÕÕÕåååÿÿÿŠ”>­endstream +endobj +5166 0 obj << +/D [5164 0 R /XYZ 85.039 781.388 null] >> endobj -34 0 obj << -/D [2119 0 R /XYZ 85.039 556.962 null] +5167 0 obj << +/D [5164 0 R /XYZ 85.039 758.673 null] >> endobj -2131 0 obj << -/D [2119 0 R /XYZ 85.039 527.558 null] +5168 0 obj << +/D [5164 0 R /XYZ 85.039 758.673 null] >> endobj -38 0 obj << -/D [2119 0 R /XYZ 85.039 213.705 null] +5172 0 obj << +/D [5164 0 R /XYZ 260.019 389.014 null] >> endobj -2133 0 obj << -/D [2119 0 R /XYZ 85.039 187.09 null] +5163 0 obj << +/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R /F66 3242 0 R >> +/XObject << /Im6 5155 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -2118 0 obj << -/Font << /F62 1689 0 R /F41 2104 0 R /F65 2099 0 R /F15 1628 0 R /F20 1617 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -2136 0 obj << -/Length 2385 -/Filter /FlateDecode ->> -stream -xÚ¥XëÛ¸ÿž¿Â½/'±V$õ,ÐIqI÷®¹-²{(×|mÙV IŽ³ÿ}çEYòk/-X“Cj8œÇof¨&ü©IùÉ&Iû‘Q“ÅöM0YÃÊÇ7Jv„‘ñ£0„ñ…Å™[ÅÚÂäÒø:1“™ý, ïŸÞÜ}ÐÁD~›ÉÓŠv>-ÿð´?EQàýÃNòÓ™‰¯›Î”gq{÷uÛåÕTy¯åõ’ž¦™òŠ¶còã»OïßM¿<ýü槧£°"ÉÅ›°l|“è[WP‰Ÿ3¼‚ -}Æã+(¼D˜y(÷¼ËK·Æ1 Ö#Á¯_maw«†»Ú| ³y~í*3í'ivSëÊâ£È*š¨ì E~_Öyç¼Lg¡6Þ†ùbªïyÅ^¾.XÝ©atq«^² .4kÙñùã Kt›#ó £|»-vh“S³ÌO¢tìØ×aEÍt+j¤®{0®Ñp¨Ýã$ñê‚ì¿ä%Ô»Åaæ-ìvWŠ6pŽÎ -ÚCaqç --„êÅ ]Æ¢µrŒâ-ÐãÈ#}Ë¥ÑgàÜg9hsvM@?ÊÒ¡ry ”˃›ÊÍw;‰þ—yWðAH†xb Б–èmxs.Çý­6§)šØûÍo £C´B -qªn‚Oä§J½>ZÀçï¶þO Âõ¾9Ež?ƒ)ÿ7¤<:ÇýqJС!ÔÉðª,š!§à…eŽkÜÖv¶AÄЂøëâ‚ÖÙË0âW¼WΛÐÅ¿…H¥÷,Ž¢€í ׸oÚrYˆp6hèîƒÞÏ€ ’[ÞÝâô9ÏïÚí\âÊmÖÂÖ+æ6Ò–ŽýXÇÂÌ6Î!%_:nß6w•]ä•Z•s:ø -{Ç>ŒœïÍBÈ“¿OSC¡m€-L“Â9 -D^ƒ$PÉ’æ<é6%+Ï„¬h̯ `4N»Eµb¦|)ð™ öU<ÒÉa$K½²ãß}[¢‹âÐÖhë,£lƒ"lû|äuCÁ¹)A%¼îà xT­6¹œ@ -I'ˆ.!1Aäµ{%þªç#>ã®óÙ•ã¤)ò%à[…Þ‚Ô£(]全~p´¸,1úX ŸÅ=‡ž=S)ÙŠô-“Ö³³,iקÿ†xO®¹kúð!Cq ùÌò±š‰½[B5#ÅìZ¨+¬(‘Ú·ø Æ‘lèÅmYÕâW'%¥Ôg%xRï"ûüR¬ö™—‡` -<¬ìJ"}WJã`ƒ-UùŒßDÊö¯rÉÌÝŠ– -é6¬+;Ï«/|ÛÄW©Ýö`›çuc÷P"E:òþÆ?Ÿ~ÿøùá·1´»¯ 8(Έ+ªí9ÓˆV×{êÓ‘}ñ­í˳ÓÒî}ólÿ Ìb º¥á[@†@m°‹ˆ‡ - ”½ïÂêÑXu!þÖ»/С¼ðV—Œ´¤,b^v›~•ù—…ÝSsÓñ¢­ù—#œHš¯dÈæ-:vvt'j©Ö¢ðS²F‹Rrv2 ' !Vvèe’À«sô $ZYü•Å£ºÃø1pg0%s^Pµ4s›~`n˜.Y9†Ã.õéè(åL Qð«í -÷%%AÝ ËÊ©Á -KŽ¾4 - ò[4v_2 »0ðعAPp,€ð8åôÉee.™·uMa#ÛìŠ0,Ñ'Å ™¿Çñg<îÿý×ï‘öëGü¨û&š¢g 'm–Œ6•‡}× ›\®¼~—4ñå -eÐS±*«â:˜È ÔŠî7ì¼—Å*'ô>©Å:+p+æóÀ¤bÎÒ}r©yPaâgÉ­bþR¯À3Õk?R®ߘ1\˜¦!Ë’A´ôö#BL~PŠ‘m$÷d 9½Xtœs´.\5ÑÀ…¸Þ>.v£QËÌ9©fæh™’h¨:çd˜ˆV…_.¹Z°ã\­ÝäîÇ‹*n$5ŪîÂ@ol±Q±¤$0¢›OôâXÆàLYü½ï Åbßô6ÂJÿzszöeê5PIèÇAB¹×¤ñ+}¨ÓQEv@_Ñ»—Ëñcê ¾ÅbsG3W4Šù‚Ÿ`ÇRz€¢×Ü‘éQ³½Q÷+­^©ûÃä•—‡ûîGÌÔ€ÆvÇqÚÐ˪´c´Ô¿ àäXÜâJ!µ7̤ïD27‹U) ±À¬Ÿözj# ö Pªà¬›cÁ©àe%ƒFÓŒŠ²A­@…´…Îy‹™Ì$ôègEÛíðKš5xZÝòäáÙÒ׈ Á,ʪbJU¶Û\ð ²ù¨{UA_+y¢Œ$‚RÅ -+÷ -¡ÔÑÉø@ÐCÉ%Ó…ÊÑõEÓ8|ÞòA­> +stream +xÚ­Ë’Û6ò®¯`| Ue"@ðáœìLâL*ñjgäÊ!É#QcJ”IÊcU~>ýHjÄñnm¶¦j¢~? ½þ¤—êÌKR)tšz«ý,ô¶y;“#°(ÁçÍröÍqäÉPdaæ-7#"£½åú7ÿ»_/–ßßÍ­µ/31’$õ¿{¿˜Kÿžww·ï–·ïÞâW›Ò¿@ð¿îæ©ö—Œtûn¿þåÍkþÒ"œÿ±üiöý²ç´ç¸Êͳßþ½5ˆôÓ,:K½GX‡Bx?>…‰´ý®f÷³÷¤y|jJ+#É2e¾¬¹XŠ(Ö½æ@¥ÈŒAÍI©„–ÊKL(L‘ê€f$@\øú‹¹–~Ýv÷«¦6(Þa®R¿¨éþè1?Â"ñ ¤gÏä#Zkd°EàVUŽ„ÎS„gÕDá5 +Š +$Ú¿)zRe˜Q˜øÝéãŠdØПð_Ýäx)!¦¤¢¾ÍWg>±A1£0E‚¥jTì㩼u¶]ñq¼´)­&P'[¦ánßä¸ÛT–tÁΰ÷ +| +ŒUnø®3ñvb´^…¶"Ž‹ ™„n]°Á£4¼`§hZÞÌ-Ð]A&Á 6š +iåÕWó M#¹cD)bZõä-ÚO¡@$HhTµÃií¡µÛø„o–—Ý`ˆÂrÇ?ÈWYuÁ„°%Þ¬² ¡9¼h»Ê[h½]¾‰;Êæ]X îwæÇcºâƒí±äèÀòýŽ±l04üu!ƒ%|“¶a ”~QÉ!„Hw·¸±ÀNixϺv©€8­*ÇéT$ïXP@‘KN–ú*d%`U†Àiú¤‹(N7¸žH xzÝPØ=Ž­jr‹=*’m +›V˜êy#ge·ÇœŽëcÔÝɆa¶ÂõYM›Ò¹YYš7jr¶äi¹ Œ‹þSZxÎèÈm]‘K>RNÆßu}p Ï!–Ï ™/Õ®þB,ð2Ì\Zšü›Qé©í5åï¡ÔEcK\c¥ßý¯ò4zÈTÅvŠÌ ðœà¦È(„nU4~X”_éøÚÅ[}½)·e_1Ç=ˆëLÍ›Òÿ¹C“Å“JI¡ÒèY:t*:¼btý„NขÔ,E¢‡¾'Q]Z"â xO2HœŠTü®f½J.”—¢Zô0t¢é}ô¤£,ÓŒ3Z“ƒ`´ñÍí^z75pê]0ËtƒanÒÒqv7±È¢Ä3&™Œ‰Ùå +l“SåEÎ9U0è{ôlÛ :Ú³©·hñ|ß2†k¡„òл"´ç–}Úø‹‘{¿Æ¶§¶„üô¼¿â{ns8BJ®¶ ’ÄJ(øÁ\³-¨ÏCm±‹› r:¡¹4Š£ˆ2ˆ‚Í@rŒ&¦™ú/.B§›âµ!Ù]$§Ît¤¤„ðÉ…JÜ(â½!Î5˜7Ï îÌüÁîž)Ÿ˜tWó¦m˜ŠU¹±‡ÑˆXŽke[héOu2]SWx:¡3•]׎WêÕSnÊãÁÄEÃxí Sˆí×ص¯ð +U$Ægv šbnÕ:¼îXÍí.bŸ«£ +!®kñ²¯w½Åh@¸^rfï¶ZB³ÝöZo˜QS5‰ýª¦Ú]¹çÀ¥/Öf÷j}øÚ•¯Ô_íjÛ£Ú;÷ gþàs +`ž¯ªãcõFlbÑ…Ö{hWË^&}¤!øÏúc3q’¨Äª¤rÍõ ñ~¥a"-# Ö­_£MŽ•=åT×N8oúÎ%‚Ør=5FãƤj÷" ú°·¸Ç1­LÝÌ·6iO“e”H˜|3o”€ÿA>Ç¢!³Ä úÙý/2`7¡ I… +“kb \ÄÄô“7=Y±¦ü‰á[) E(áÔï€WºÃ¶ ¦Ô••ËÊñq–@‘Ê2¨R¸£b(¤8WW’ëºâfiŒéðR‘/Ì$PU¢jNZŠ8‘ýLOÙT…JH*JP•´šëZ<{&".ÌÅLô„2²ñC¹=Q;˜ÒK“š˜xb=‡²Ï«+v“P¤`à vG¾À8Wì]Üó”׋¡ÉtM‰}ÔQ¹ºcßܤI ‹Qç*€”¤§£/({‹(6ÐA€§ä7…†(“ÿì­÷(èõ"-ŸyLRZ€O{‰‚~ùúq˜ÃŠOý`i[sí0u¡Á Ñ9/$ŽŽC>"ÐÅÙZ¬ ÞLhÓ†A´ÀÄ%C(I\ÁíM˜¸ëÃ×ñ7霼sÕêÑRªÝ•CóÍs¶ÕÅ÷…3“?¹JPôŒ–V`¾õ0ñ” £|ÄÀ‚^ 5Ðy×ØÓþÏôÐ@ ¿oÐ3U1õŽ CÈÙèŸoo~~ÙëÚµI«Üj~-*º¼9còϼVq•Mû¨UØÿÇG#-Rý̃§QJ(éxA)!=å×hP.¤Í+†ÿ‰tæendstream +endobj +5176 0 obj << /Type /Page -/Contents 2136 0 R -/Resources 2134 0 R +/Contents 5177 0 R +/Resources 5175 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2090 0 R -/Annots [ 2140 0 R 2141 0 R 2144 0 R ] +/Parent 5154 0 R >> endobj -2140 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [313.377 617.253 415.127 628.943] -/Subtype/Link/A<> +5174 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 265 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5183 0 R] +/Length 10989 +/Filter /FlateDecode +>> +stream +xÚí CÛ< †Ø9œÃvî[ýÿÿò“œ´” >ë +‰ ÒÄM[W¯ËgݱÝÛòÞþß&Τû[ØÛýM¼¡…’³èþfs¨#¶»Zöm-ôœOw6ƒZhOlw5V¿©…šóéÎFZˆ8îkó{¸ÀZ¸³É•µð)ZP¬…/§æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0X Ìæk¹À\`-0˜ ¬æsá«i!H2´©-þÇgüï¡Ǫyézœ4/>ƒ®ì7¿º>'sáê=ùËÁÿ&v¿=ï·4N>¥a.ü‘…çµEëWrNfý®÷Tã _AÕ³ÇC¾Uv¾y>Ÿ/¶0>Oœýh.Lö(FûZ_J’Ìšx?Ò«}å&8Ö¶a.ü‰~uݬ´¿8ôÅ +ï¼ tCGæ¥õGƒ0xîbp.¾&ÈñæSb ;k¨ Ÿ‰yø£¹PÁ‘w9/§lù”øì$XȼR†OŸ¨<+‡¹ð^-´G–ïî*ôÙk…ö.“œµ¾UØÝu¥öÚ–òäô^%Âÿn‚3—Åc§ãC) %>S[À÷;táþzúx]üýŽÚÂÃp!9K M $OZ0»á;] _|µä/Í…ÃŒ‘T½X'_—É,æ÷dÀ®µ°íYí¿1äƒ Ñ»Ã:0+Þbœ2 ¶v§Øœ9}Ö©ÆoºcÛxÍNj‚l)N[Öàëmøº¦B)ÅkTÙ\ßG ë—Ó‚lËzJ÷©,'Ìóf„0Z-Ør¿Ô6ÛÕÕQ· +Ê2ðZâªÌH2M«Oq$—¬ŒöÒ¥©Ê*þZP_\ Ú¢Z °¶TSµÞ–e…OЃ&[÷ô^»2ŸŒE+'*¹:|ZBO(B aó‹räB˜8À¯³ÃØ®^ñHÖ` k1¶.;è%~ˤ=w-| . WZP~o“žã3‹%ý=ŠúÒ6îEË@\Pá%†[r: +j¡÷÷X(0eb)^Ó{ -`.ü¤”®±*¤ÐW1‡WÌû(Ú]W‰ïÞ˜¢‚;Ì|©Ò€Te 12赤Ùy¯©zd¬¼Ô‘Fº¹ªhÍýÖEÉ€´`I=›¥ÄÝèøÀ¿• µ™S÷ùè_ƒ eëm¥,(¡\Dks*•Fkæ]]ˆsÉu6¥k¸FP ‡Ù_o×µÉ0íZ(Q*q¼R~7"î¬þt-|].Øu]±ìÀbþ(ƱhñÁÒf9ât¬,QÉ£©T¢Z”+'Ga©¿—5§T ú·â¢º9=1¢’/ò7¯1ÕÇÅ;Ï°ú ½a¿ôƒ¸p±à$ì¸çZ‹yL,HÆô:^(-¦|L°až»n•>û<z¶¯xD¡¶ €;Äo§ôüåÚQòµ6æiÍtåLN«Kb .±³w8ÃêOINÝ\ZŒÔñeÈÕ·vH¼þ\ dë8œÎOÛµÐï͹ñ®…c…²ª°ê…Z¸_»Ò×àÂXy3¨…`ÏXÊñLÌ{VO±³\,–9¡u•?ò$â! +1ÁñÍ¥âÜŽdê3&ïýIÚ~ÐÌÊ\xU “C;Ž½÷c ,N툰è^ Ë°¿ÿ¹·ó©ƒâR°ŠC §] ÎÖtö©iÄ{KyÔˆ‹‹ÂýÄ¡…ëš×§æžZøjñ´ïêç‹Š†jƈž´Pbv/x&&-l#òܬøðR<íHr½h¡õþ—cx/˜àNÑØwnGòïÁ7!mXOñ­žXv-Tç/$Ư¬ß¿¿¶Õg-d{æ£0Ý3.\}¨k-\qa<NϦØyüa\¸jGŠÀ7!{v4Õ +^ W\ r?Ë0ßH b…~*\„,Þ.j¶>ÚTw-4WZQs1‹OîþíHç@Áûv}»ýME˜ë55âÙåø:¶Cõ}Í…u¿CCZpoiá9”õ÷)Ly_-|µþ…f0PœaJ¬A¦ëþAqs·ž¼Úýëª0y¹w7„«8´`~ã‚4{ÓŸ®…ïÀ×Aéd`mƒùX¹“ èv|–˜ÌKÚÔ䪳Å8[ø]i!ǧžÓ#PVhÝ»¹Ð›Xà‡¯¤œ;ÔØÏ‹®´ Mç¼+PþG>ÿÊSWýÎŽB`ò{ÒBäój1@UËUø>ùŒ ×ZÀÃÁƒ½þt-|ÝñHÓÓƒbk€†ºÄÔÌïs]"©›“÷Æj·>Xé´:i}7ñý ôðÕÖÎEYvíÙ{˜Aã‘æ] Ôé@£ ê“ÁÀ;ÞW æ Áðý tS;’ó7`§¶¤Æ½ì8þÞ¹0þ¦mmÙ&æ_ >¯Í|C-ð¼6æsáËpáGjáѹPlÌ6æÂ75æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0X Ìæk¹À\`-0˜ ¬æsµÀ\`.ü`-Ñ'ØT0‹ Yÿåm|s¹Ú« úîh sᱸ—·7e~ÊÀÞ]¡ë;´À\øV\!ɾ¶™÷h!¼{–GÌ…Gã›_Ù\ÿ}µÀ\øf\(Ôö…-U9síN\ø€°´ö?úõ§¦é­´À\`û²\H·©¬è'i ýª /ÌæÂÃs!M×s‰ô+r)[Í\`.<<ÒÊ6j£,‡Õ×…R²ãš?P´âê1U™>Vkb.°}i.tH¡…Ó9ÄjK…N7%ð6ÇQº‰‡î'SM¢PJ«T1Ø { HV0èTeájò±Q›šÂuÍ3%¦Ö¾P:êÍF:ÕI„]¢˜ lÈ!ܼÚXéì8Xg1áQ½B"Q ]XˆL=dB„`À–‚¹Àöp\¨§,KJ½Ò ØFºÂ@ :h¤lìº9ª#é®ÈÁÚµ`‡yN™ lÇ…c¤P+—"BŽ¡²Tˆ Ùt`[!J¨høZB)UÊñÛãqaÌ,ê#‰ÏUÒ5QZ˜d`FjZ‘ö–eYõx%D¥pÿÛcÆ Nd`©áT9õ4˜„ʈ]«=¶ >H ìoxP.dõçZÆ\¸i;…ÊX=ŠÀLA¬BÔ¢Ҹ­¬ qAõ1Z3‹¿ÐÂCr¡ûäqðsá¦ZH] v#d'-ä²v›xËÌÇή‚Ñi-K8æÂsËígƒ¡g.ÜT ›š V–Jè÷ÔtÚA¹¨ÆÀ ¨›4¶Ðªmˆsá.¬Ÿé.íƒká¾ã‘öHX´°n±»ZÂ(K‡h…˜@2–âëû>;?$:#?Ñ]"æÂÍ´ÕÚ5©Ñ”}_sm".Ã. tŠu8JÄc××HUt<ƒ¹ÀZx$. œº:RBi¡”Â_ j_Ò‚():OµûàŒ!æká sá'nçñ©9§‡¹ÀZøÒ\¸ëOækáqç;3˜ Ìæs¹À\`.RÕÁ$¾ €mµ`¶W’LFü-0~rS¡RtUåV=W3vèh;fû_N~0~©n—@ùZîXæsác\ðZX±Ä³Nõ/:¥^楈ã]ºˆgL±ù³q¡õ§rá\꯫wA¡ôáŠR‹C ?–ò$s¹ðN-k0‰ˆðw¦6µTzº¡¨,Ø$[åÏÚ°ÑŸÇ…ìá×9¹ ¨-€©ßpØ`.`õ ³' ñ]3zq_¶Ö ÌæÂû´ƒ.!Çß­Ð5:TC¯SQB^ö`!iˆgñ°ÑŸÉ…ý ÃX¢ócu©†®ÁƧÄØ0A@XâÛMOÎ’ÅÌæÂ;µ`¡Ö2¨´¬¡v³Y'å± S«çàõ|–r‚\}ÚºyØiš¢©&·GG Œ@!ŸÐ,DT–hh½£L'g ©d.0ÞYG[(=€Á EßÙÚX¦K<ÂàjÈ0´= ÊÀ°ó–‹J~ +hÕ‹²† î$Å`­ÖÖÔÒ2{›êBáY"¥}³¿¹À\x• ¢¾Y4Ö¿R)! ³µ´ –ìb¸e;Rå—¡¤G„¤¿qMW‰ Ú^<„¹À\ø.¸Z©”Q ŒRQpMÕ¥É)æføL.¸Ý7¡ÁÂÚ‡ X9ßõf@ï±s¾w¸u%Æ oö½1˜ OýÎ;†ƒ ½ `ÜÒ¹¢æÕ­ƒ)niþ¿ŒÀ¶é<º¥Ÿ/¸£Mu•²ƒì„2 ­O€ºí$"#Ø°5*©1î§6Uæsá½…5jÁvÄ›“lH= k¿®¡Í„Ž{kMßÁ ubìjl?|^ÿÂfÏžWÚê4¬¶ï×1´Å©]íŠbŒ%¬EEdÖäƆ +¹`n¡æÂãsaÛæxI·¸À£¥ÀßéÏH‹¸šM…*f5Ç…ë¡Q©Xš((”ú¼~g).wÐZžäÜÆèé4 C.ð"*¦š“h‚Ƨât-0Ÿ 4ÜŽÆ=Ëó¿S¥µJStÿÌ&RÈØÚùršç/°“ o(#Ó(˜V(õßnmËóÚX _œ o˜Ž¨ÏÍÖê¯wyf.°¾5¶MÄS25âK/1X ßš 4kAˆ¿§sµðÕ¸ iКâþKf0X _Š :(˪¢¹óâþZ¸œ¡Ê\`.üµ\}lçb2ý-¹ ^èÌ\`.ü©’,£í +?8 á³¹  b.0n¤…}°é¡N…Ò#‡»½ÿ nˆš*L´ŸSþÜv}ΉÔ_ÄC}O.|Š˜ Éê@ÞDfÞ¢8«Xom=Ö¹»VÑ8&±NSgãlšºÛÊqÌbµ)5”c(<ÒMŽ“Ò›¦¦¬Û÷´3Ý K¤çºni˜vxW,’zŒ´OÔu$?Ã9.Çlc.0^ÓB¡•R.ƒNÍvµÖñ +}Ûù0ä6-UZZ†v´˜l>Ž˜LÌ¡íÇòB-¡5x® ´«ÀXߧ…›q!‚n¥wR¯#¾wqÚzÛ×£5¨Ú°îŒ%Åô€‡¶¾Å˜mæÂCr¡Ø–ei-$b¶0m®arΕxBåОdc!ŽÀÒE°n"”²…PJÂ$ñX>6›KPEœÞ7^hý¼¶ls’ GŽx¿˜èŠ ɽCJ*isRæsáE-ã§Ï÷r¡Ãˆa3=ÖüU+þ7›ÚÄT=º”s'üãrÓh!†X`i 3êfXeê •MðQwŽöÝ+3ZæT£|‡DûKJÃ/³`ªÙ¯qr°JæsáE-øƒúlQª°£ÛTìçò£0ìQ@Mýq‹…º,˪C7IP7Õ 5í{kÃvvJŒ$™ %QªwoëyS.PL>Œ®¼Ê¢MrÔ‚Û}Cš™­² ˜ Ì…µ/Å<§)£jG@ÈH ‹9ƒZìËFÚ£ÂV®¨i­‰ÕÐŒ–†é-¢_ió6QA‰®øÞížoÊ…Òk!9´ iÕV>´€\p;–‰ÖÕÚÒmŽ­´¸‰S-Šå@+ň9ËjÒÂÁ…÷k¡ÿWZÀ¾ æ +Eâð Œr +##ü<7¨#1³éœj×BªÖNëT Ð Œ­Di‡2‰QBÝ7[˜I!DhÓ©¤sB@A‚@~ .tþÆ-E¡ŸÞ`ªcâ%,O¯…?àBdY’Míÿ4æî‹Gu8&éK×›$~á Ì…Ûsá¹6‘À8«¹‡Vˆ¥"°K6Ú¶L!rlicr ÔRÂHzR• +Ü—àEú§ÔÐâI…íYºTB¯äÜÁ-´ð\èÏu³×4Þh dZ Ö…^ü†Ÿ·}Msáha¼æT±‚]Ñ{ôFŠ0!·Zdà-Z„JQ5PgÂkUús}¡°žôþØù\Hɵ÷…T3;—0Qh°v6Ĉ紇 ¡E÷v!~.<¾ó:!ÔQe5Ö9_{½Æ¿ïr(âÉÚù÷m\?t6a.Ü^ º-çsg@º”¾LWsÒwaä÷]Øʼ«Zl¨»¼Œ)ªnǾ[êwŽÆ¼OfÁu;v}‰ÉuP¿w‹«S-± +ò•†OCI‹_Ôy˜œ‚’‘ªjp6Û}ª¯ÛwÔ¹oÊ…‚ã£T¯½¾MaGÿ ~ÏXC›1n¯…M‹§~±ôH¤ÆÅÇ¡PJè=!ÆÊþ†‚Îùö%q>—úsÊχPÛ=¹ð–MÑž‹ÁŸÄŸ7æÂ.¿fÿ(Q]·ûúfmY·˜6¡låvTƒã¿Ì¸ª«†Ò4"ÉDÍ4Î$­jªm“ £…¹ps-¼¶dXútøÒQúkº«g|©ym#º:q[-˜?×Â@]Mo»ÕTfÓÑ +NksÊ0®É\M[F$==³¦3Hi×lœa½/‚p]sZò©Á:l70Ǚ×V û„~8Ò'rAJéŠZ#¥9ˆO-x9@/1¢i¤_>L8©]6™;ÉSQÛõvJ¼ð>èF`}*‘’¹ðPZ¸Ï|çaÊ‚?ÚÊóæ\0+(Èöh Åç®à+H)½Þ>ˆÖ÷aºëè×|e!­¿¶k!Ü¿ÕiñccgæÂ}íæ\ A.¦ËOö_ ~2XËù©‰îg!PÜ°ž‡L9ë³h×B¶gHÂíH÷ÓBúg‘¯ƒñ–"‡vûz¾£&¥©£í ›C Ò_Ü +iºã¹Âø®Â] Ñ~½d.ÜM —Q¦ŠVÈ 52ö©k4o-â×e3>ºœêâBðë±Ú_¡H •t^ •9º–;|dÖýU¤³ÆýÊ…Š¹p/-¨¢.ö©œMU’%Ù@››/YU¨%©JüI¢Xœ×ÑècÅ\xO;Yµß:€HúÆ^×ãE/$çÛu]‡Ö¿Hìês¼à¸á.ZHŸîõÁÙÂ%U³…æj¼j²ßO‡"e.¼S ©±ú¶ÆÎÒ@&ellA¯·HÑÛ:XÔÒ—ÙØZŸÔ³¼æ5.Ôm.MXæÂ?ׂHΊh®Î€´=Mq;k! +‚ ÌyÙ @©™ ÿ£…þJ §ØìƒZðÈ‚5€N~°l)NbÝK™zÿØ4 +#ƒ}¯• +ëGkWÈ•—LÌ…­UØü(çQ ¹Ðhn†PÐÌF£ +:''(ÝÑWB¬˜ ¯k¡õ#AΦJ¶BGKöµ¢±Æ3zû~<úТ0i¶v–Ñ݆ªÁwU a_ù›Ïõ80þµ Ù +öy ‹í/\°Þñõå9Y{9d.œþÝü…è]‹¢1Þ§­ÞSVÃylj¡§&#ç2ôö XGŠiêÌ ’˜mØÆ멲>‰ éÒo® ¬bk–ô¢“kêê/Äé²Ì­¹LSHÓÅ\`-|.¤Ûj²Eüÿv:´k§zÒÂa]¦¶K¼` ÆpùY2©ß7e!Õ»¥å‚<Öû™\X¢øCZh÷ éË”¹p¥…ÀÔÁÿªAL0žýµ°m[ƒieº]¸P—u]&ír¹7Ms~‡Ò"Øí<_â¹ W|ÿÛ×ÐÂ÷™ï\ïÍà¶øé\HŸL‘¨¯`¯·Šcå‹s¼€á‚¬Àú‰ ³tîX;õHWžÛ”Þ˜5t|)ç-pÿœ _ˆ#ý +Zø>ë`„P·QÂüýµ°Á›{sW¯iaB_LèîÜs6¼:ß¹^Õ‘¨IéÖ§¾6û[ª¨ý‚Jo¶PE`-U¯¡vý›íy¼ÐËÒ¤Ÿ¯…ïÃ…}8`áøí ×7RÔTuxá¼ð¹ûŒÁ&¯-ò¨†£õªMU7–&7_Ú‘Ô¯a@ø®éþ]Lº†¶ˆw+:»èÿ5%ð;¼èY­ç÷Ÿ=¢°n¦HÊh’ÿ„ ­×Û+V¾Ò +ª°à/Ô/ý Xq +õS;Ò¯ZXÌ»:Ûðv™S²DW¾ü\¿üÏ“_¢ùàq¸@M-Xy² þ!êäÛúNùF’º—N¯~ÙÇ+3gO2íkTÈúR_êTzt:d´ðð føÍïuó„’7¸IŠ>®Í{øÿÿ{þà°µ}.tXúˆ²”Ò¼]eüBüî;P§oo +ì[I’×âE‹z͉£ºÝWÅë£éD{ žÕPf»fôPgj©êB-eùkg6†ÎÑ{$!ê Bˆâ¸ñ?qgãåmSôÛùÁ|Ô‘lžÉÓ£p%ïGÎìM Né[j¡Ü‹õÇ·#ýÚ¦ +¦ŒÕÿö¸¹«B—Ík/›}â‘s4Á¥¿õÎõï¨zî®°×±ó›nó{ìlËý­Þ• ‘kªSð›VÔÚ7·Ó‚*Š"Æÿò!´pÃþ…ºxkkfŒ”ë?^$üzóïõ7ô}žç}xî¤þóþÒBùïË·»r!­ #g­Ü¹BWÖÖŠ›iáìv\Xºb̃nûž×ãK¹s~ævZ`.+rqk¡3{ÿ‚ì!+ô{_ÂÑ¿°’úkáo¸PV‰ŸòP€3ðb>Töà‚lbŽ˜ ï4 š6ìê ë<ª¨ó>Ù²V§Yë¨n”ŠëðصS5õ ã:£:ÒTFÿ‚°\{ú”Æj:@äƒPûmÑ'µ;ká,<)ôÙ£)¡d.0^ƒSZŒðþ£Î5áÔ"hþ>W3”ó„û茿jG2á)¯éS†{%i´™Ï‡¨°áŒ.#Ø8!-4])]7ždXÇ=`õü¹"’D¹f.0^qÑËÈÓ† ~xPêíû‚æ4`¥•`{ω:À|5te‚Ñ´ï“éó%±òØ5õñ‚´Öô5^Vt뾬W° s¹ðóñSŽ€š`&-̦ßϤáãÌ ^Pì¼"M`ò—£Óæ=^æ ˜ Ì…‡˜ïÂ@u:%ë©%.P\ ŒçQ ã;×àwÅ$-Hã]?AED°ü¡b.0… Žvÿ K¯DÙcàµPíÎ`Èí¬RIg¡Fü‹O2˜ G|Q.ÄøIcaâ #EÎSx­…ºò²sÁ¿dBZ€C ÌæÂÞä„£§éÿK@ÑØÔ—S)§?¦™[qDµè¤…ÖXR¿ÛE ¥•²#¿E.œÜ“¢}WñŒãæ‚÷ã $«²@½’4ÝfômµDcß­þ=•jÊèÙ\ž§Å2îÆa»>?y-Ôèå¾ß-:kúèžqêH‹¿üÑØ™¹ðh\p~gmc-ô/§M—<›ŠWXÃÞØ>þ-•n!¼âEªªñÓÜnÃÒÖwH-ŒøßdCÔY|ìàà‚£K>6'i/\8ÚT­½9N¬…oÈÔB-Šy.è¯wÏ3Ž#U@åRQCDU¤F‘ú¼»cmŠ`À¿þÎé.×é¹0ZÔÂì=ºµ˜™ÅX¹llˆpð.ø–ÕÚ6ÒvèÃþQf'lU‚¸-rèóOûé sá/´ày±5Kºé4Žgßë¬U/´ÔEl+tÓ;ôvÑ€iá‹9.6’΢–B¥¤e >•ÖˆéóôžñÂ>P[Ф 6"Ý ‹?!µÜxçÕÎ'ò O/áyzBbÝm¹ÃçZÎ\ø¸|T°ÚB‰¡Ã*S=ëM=•³h±è4^WMë&-Ù´¤j© @iUç±Ù°–:^« S&H‰Õ‚©Äý¸ðñŒµ¯Òô§Ûraˆ>×æÂßp!Ä=X[£Ÿw³¬ñ(C&d }TÐh$,ùE…*×Àf&‹#Ž$ÇŠÖZNâ~\ø°au)j‚‚Óm¹Àöã…e™ãJ‘®ÐJ·õPÊ‘F*ÄÆÆz±‰D ¬6/¡1Ž¶aê$MòA-4EÚz-à}äb ®ïß9Vï³ç;Y¼”uǶoË»·#…X‚Î6%„A,âaAϧÕT\†XùzP"F —j!qJìZ0‹ÚD†ŠÐy¯ïÙŽô¶STœ>¦æÂr¡+˺Ì¥°îC §ª3ÛŒá„Ó¢©Iø±Új›íB‹n¿¥BÓ|7áÛTQ Ô®ªi¢›îïÛŽôOÚ%™ ?’ å‰:žÇ"ÛiÚaè [ Ǻ@.¨!i0rF÷ï!“!µ%Ñ"«ûÂHBŒ$iAä½ú&\ø-02^8OvÎ`ÔmlÖm™…›'•+l)Ä™_Š^’tj .¨6Úµpp!§êU„xÐýûµð×\îb¯¶¹ÊWŸ{½†s¹°·©úä*ý©CßV¡i„B?¬%Ö‘¤Â"uX‹ÒDr‚À¥:5½¼æ‚…r#$Bõ½P÷âB`1Öñ¶¾r'aëWž[7Ú–¹À\ø] 4Û¿Lié‹IŽÐÇi¼Â$ +Û7ÆÒk6ÄÁ9qà é\cméŠ òXµ` +%ÂËbÿž †þ+™É_ƒ~õù!ˆWÜ™¹ð¹ *¬]Õ£]Wk*¥ŠÐÚΚR©¥;‰t´Xú†èåº5v56,4z=iÁŽ¢ƒîhsâÄdíø®èù\ÀJ™<ì5§—W®ŒÖ…À\`.œÝqŽç«¦:Ž¢f¡(XC4ÌXñO—f(ÒT/Mµ…§ª–!jc¥¶"^hô^<+Œ¶a´ßÄ$¾'®®í)®Ê½ëÌEeÙ‘:É ÁÿÃ)ÀÇ»·eí»f3šû93˜ LŸ=Òz?‘Òû<ÿ‡‹ãÚF‘ž¤¨…NÑ(CRw‹¢ëÕÁzKSØ`DD+Ø_G’¶«é +y¸¿#-1ž‚—kVÌ…ŸÈ…™ò«I~¼¶úy.ÈP¥zOXÑ«à¬6Ú& ÅI(Qû “§WjVÌ…É…iëHÑ ¸p¶ŒPú'”'·Ïúï-ø™=ûâûJx¥øß»2˜ ¹¼Íö9\0án&ô@q- ïîê'.Ðz`´øÅ•~öÛßh¹À\xÅ­õ^é6íHWñÍpóZhýæË®±/~AZ EbÉ d.0~iTýµ_ìÏ»øðú7áÂø’hžsá˜ØIZÈZ´`øÛ:sáÁ¸¦Q9\§IŲüi¬ –ká_qaÛ«@áï\}=êÔL s¹ð‹7Âõ¼›4ÍÂ%ýÃ&¤ðc;‘ܾáI r5Xî/öw.D@ͨÊìà`.0žÊôþ™T ëŸÕ’RñÑ]ynÄ›çy‡ÿºáJ ø,[×öÒ¦j.d'Â:µë‹›–0~6H ©Ð©N§´ê…ßÁYi·/$—ð0¥µç}?m&zâ)GK‡¥r„@Òœó 6-ðð^ýέµçFÕöZ¯{,> +stream +xÚÁ!@ð +QW4?uO4U”¯éº*J‚ 0#‚$¸Ý½ws~ïs~ß—s6ÆŒ1ÖZÖZJi)E)…‚žs´ÖRÊ”’÷žÂ‹1 +!œsµÖÖƸ÷xïýÄð:Æendstream +endobj +5178 0 obj << +/D [5176 0 R /XYZ 85.039 781.388 null] >> endobj -2141 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [367.537 603.704 509.276 615.394] -/Subtype /Link -/A << /S /GoTo /D (compiling) >> +1398 0 obj << +/D [5176 0 R /XYZ 85.039 761.463 null] >> endobj -2144 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [182.558 186.729 260.642 198.418] -/Subtype /Link -/A << /S /GoTo /D (securing-samba) >> +5179 0 obj << +/D [5176 0 R /XYZ 85.039 741.134 null] >> endobj -2137 0 obj << -/D [2135 0 R /XYZ 85.039 786.531 null] +5180 0 obj << +/D [5176 0 R /XYZ 85.039 431.141 null] +>> endobj +5181 0 obj << +/D [5176 0 R /XYZ 85.039 431.141 null] +>> endobj +5182 0 obj << +/D [5176 0 R /XYZ 270.807 114.482 null] +>> endobj +5175 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F75 5171 0 R /F56 2890 0 R >> +/XObject << /Im1 3957 0 R /Im7 5174 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] +>> endobj +5187 0 obj << +/Length 1390 +/Filter /FlateDecode +>> +stream +xÚ¥WKsÛ6¾ëWðVj¦Dð ²·$Mg¦®b+§$Z¤lNdR!©¸žþùî¤(KrÏPXì.°ÏoaHøSAši²À¥J˜4 V3Üçb¦¼DäE¢‰Ì›åìÕ{JŠLfÁr½?'qb‚eñ%|ûáõbùîzcB•‰yä\¾ý¼˜«ð†w×—WËË« ¤bØTáç²ÿ¾ž§&\²ÐåÕžýú¯7¯™2Bο-?ÎÞ-GKGÀª Íü1ûòM¸ôq&…ÉÒàÖR(`?ÌÀN‘ÄÆÓ›ÙÍìÓxó‵NE%1©HRs•L¢”FéÀ%R$2¦¸,Ñ·fÅF†Ûœªê¹NÞwzÏéïSÎ#>ðFÕá/’ ¼[á÷ž9(Õ´,"Ũš×]p‡ÑÇÂ]*\!¯då'<¨ÙµL}Fvõùˆí¦Zå}Õ c° éð€~[O˜ˆH¤0`9HNpp±›\gl.è:ÖÇ:XµÕ¿ÛÅaŽ×,ÚUõŠ´ì$ß)ÊŸÕŠwXº ë™ÚÕc Z6î›îíèÉØîÉ3„ƒ…ê’N(Nøˆi2ÊûÖPâ§l{f &Cö²üUª¨Íh;Ê6,—3¹¦\RVsZ·«úüÖë¡èzN)'æ>…H¡7­¿¬ô{`à‘Q÷à=:­lx ¹r->׋ Á˜¸Ÿ÷«¼æÞ¤À–uÁT…äöÌQõ?°rpR‡âLÃÚL‹Ø½ˆ={ê1 L%2´fßcúÞÆÜc7±k¨û$‘ázÛA®±¢¹ø¨ŒþÅq)yqÓ¬û9”þ#~ò¹ÁòŠ×†×— ^¬ä·¬S7u´@Ñ¡œzÞG #m¼´î¹»s1p)8‘½„½Ìy¤±V +é‹ôC‰™Ô&%ðÐÆ…÷¸&|Û‰¶M„‚hJR;VÏÒw%V¤©óÒß+Â¢ï¿ …¨ÇP?Xn¾Ù»ÕÐŒ 4¦âÎD­¡0iÝæZtò K•‰D8†?vTk^cKõÛø’ƒJn׈;PQT¼‘Ò¢¢Zø m© ÇÖ¡F*¤òXB"»RÊ‚7¨¿àw„O$¶›¡›H‚be^å—Ž€ñA½;×È¥2K-šB›Våà\ÞÖ@÷ÆR2Vç· ˆrŒYŽ‰½y\:.³>¥›æTÖ•±T^¤YóYg?yÀ9t1 YÇÐØAF;´Zk9o iz‘'Þ¼¥u@…o»©Ußî!Qs0åž"S0è´Þ éœ Jˆ5Œ{7³3{´"ÑÍwÜÈ™Äß»בd×;,}HÀ ¥'÷å +syõÒlš»'!!), +ñ!l|A5؉GÓ`¢¬Ç±0¸(ÿ·Êª·ÔÝ\êô&¸cܦQüšz/šŽë›a”ï=A2¦£~ã“ êÈx•9H¿Ê̳W™9z•¡gð´3§PRkx†)¥ óJ)(¥æ½Ú‚ÁþÉ:—ÁENÓŽ¶1ÙÀ}uù6`Wðé¤ Ä^êýsÐ%A*2è5è Ø:a¡§tš‰DYÊÁÚTÓÀ)‹#/†ÎL…sî”[Gî :ÑD‰¬HìA#žŒf¼¯îvTØ)½Õ͉þ-©µïÿ?ž›«ÊšSæî£ïeŽÌ;¸çùI<’η!5*½:ˆä9 *gT¯#?(Ξsøv:šÕ±Ëâô¥”Œ¾g…‡"˜¬êT4 ˜abgê×þQÁS4„.µ§ïðHðKwŒµ‘š3ï&¬†Ç‰‘B3òhižpø§‰…&ÿIé^yendstream +endobj +5186 0 obj << +/Type /Page +/Contents 5187 0 R +/Resources 5185 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5154 0 R +>> endobj +5184 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 265 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5193 0 R] +/Length 11734 +/Filter /FlateDecode +>> +stream +xÚí]‰b£: 4àƒ€ÍiÀ! üÿ_>É´}ÛnÏmÓVênKˆ!4ÙvlŸnµ?ÿÝŽÝÀwé³MvÀöù&žÁBÅ·èó- `§ÛgZáy, üT>×N±0Ù>ÕræY,X¾OŸl3báÀ·ásmyIŒÄXødË _`éKb$ÆÂgcÁ1¾‚ Ì l;/°^`^`c½À¼ÀÆzyõóëæ6Ö Ì l¬˜ØX/0/°±^`^`c½À¼ÀÆzyõóëæ6Ö Ì l¬˜ØX/0/°±^`^`c½ðfgʘØ~°^˜j´¡–¶}Ò‡ZJ|¦ªÚ¹îñRUñðõ¸îZî'?]ßSuõ°p’2/°^¸ +!848>áBµC,¨‚”óã¥fùàeɾÕÐÉÜ}Ûº…Oá³Ü“yõÂß­€Êg™ˆ‰õÑ>„Œ®W; dKQMÛ-Lʪürª¸ ½ (§pdo Úê­‡°p˜Ñ,ba(Ц4‚¥Ø \c%L·±pù2™.±×ºhÜZO7^ˆ!”D¡-¯mª#8:ù)¹SÉ xQQ•Ÿ¶v¤ Äh=Ìÿ 7Á í=,¨¸6ŠCGÎl\¢?Ç¿ûí­B •@Kõˆ‘±^‘xƒ–!n‰s u<ÇBUÐH„w³…XŸÖJwÓzaÇòbÁÿ‰…†îÔ€þ_ÞÓÑwXÀ:iC›È i³»w‹OG^oð¸1Àp »û¼0ü¿õtã…Nsá…œV¥ÿ 7Á Õm&,TP-bÂX“Ùˆ#†Ö¦›ŠKaßEÊO¦„¤ %z‡7 Ô®kÌß‹Ž­{TUÈé9âN„î‚ùr^0·Ã YæÀl +¬½‡oÐÄvŽ±ªÝ*P0Ôš!a—/`ïNËPT[»j{c¸Ç ‘¼»ùaŒÔ=Š…Šºï Ó¶7w)d ûɼPÜ-Ôâµ[Û´sfaÞé{z˨þ™VÄ‚ïb5Ñ`>>f|¯ŠÏºº`Aî’IŸWÉzáðNŸ.Õýþߎý4JòàÖÅ0Ÿ² +~£°“û„·yÚ€á`M¶hhã…"~óúEXˆÏ);/ øè<~FùþÓyA–ÑÞÏv»{F\Ѧ[}TÞÃÂâZy!; ÝN Øí{(Š‘â–³,÷{œ…zlÑB÷µ£ÈnC/l ¹v®OZK‘æX(ïa¯ªîuB{NCÝ&c‰wõ˜ž›öÐ*p#µ€VãHͤ{Œ´ñ~F?cÈK ¨}ö,‚(zGržB8$mg4?]/Œwzá¸Õ˜ Ý‘‘À|z€… +½È‚^p&,,µ€›ñe}Ud{;Ò|Å´Ÿ1GýEØ쿘n ÙÖcUÆÑDïŠ;ÄxžjŸþ®»÷I´Ÿ!v˜am…wBŽ9…Ø GBe¶ƒð&ãƒKBÄBm#°À@¯1^Ýû/ÆPßûʱ[(¥]EäðÁ­ ˆVR€t& ¿¦éj«9åÖê3“Ò}À TïG¬p b†ú˜úV^rci dÅÕ7Eº,‹a½@ÄÊo¨Ô­Ž/EÜ›™»Þ}ó ÞÈ°àu+ÙŽ5zŒ‘\vàiÆ1žgû +€zam÷Þ8Ÿ¦›Cg÷‡Sx³â¯µ]KÛÐÓñrÿ¬r¸µþ…d{1’.||×þ ¨›I‚ú؃‰|kž>ËY´Ñù³?±¹MáM-ë…Ï6 í_áÍñBæ:]!A?Ž]›èæ¸×ïLuÌÆÊèü§È‹CÏI`FKPÞµOñÂŽé¯ö³ß8ßù`áæúÐÔËnŽSr¶ìxÇ ÔhºK]BÕ6Fu6ŸŽ4øw‘6í<ÞÇ‚ PNÌ._Í Œæ…GÛT/Cé$mdi0K±aO}ú*b/Ã%J*¨[È»:ª¬f+lêæ윕$£'X±@il^_.Q¦Ñ¨Jjê`½ðéø×âÖ±p¼]­‹mäZíjjÑûü‘uÝܦª|v=ÎÇ›¼*ÒÔß)6ï·ý÷4þYôòå…ó#1/°ý^½ð °ÀóÚX/°1/°^`c^`½ÀƼÀzyõóë6æÖ lÌ ¬ؘX/°1/°^`c^`½ÀƼÀzyõóë6æÖ lÌ ¬ؘX/°1/°^`c^xõµÄŸ›ü—þ&½0ÍíZñìJ?‚î%'¾5“^°pËVþ +^(`nŠ[4ÉoÒ äÍZÅ/ᙉÛ3ï‡'°ðCõ‚³×6½ ?ƒ¤QëÍ™RÝ“¼?“n7Øá÷ðÂ÷ÂÂÕ ß ¿’Œ÷´.¤øËQJýS^`,0/Ü”:TUY•e1-æ©2fù·¼` Ì 7€3\ÚÙ\ÿ8TZÙw‡]¬˜n y Å4M‡¢ƒ>z ˜@zÅzyá`!A± ü2C!'¢x 3à–§-߃ÍT| Æ7Ì^„õóÂÏÂÂc£Ì‚õJõ••ö„ ‘·¥•Õ15“„¹\r|-m‘˜5ŸŠ¤²EªX/0/ü8^ Î¹,qÐeÁIë VF‡¸%EÓÑ'¦‚ %„ƒ0„yQ¬˜~*­…nß-¢§}–Œ›Š ³Lu.Í&$ ÓCH<†K.ˆ…$Õ¬˜~Z;R½7#Qݯ’jòÆûÚ¬€C.„Wq@r@œhq ÇLBã_ÛåÀzyá;ð‚EV®÷ùºæg‘LE H³±à×lUUå€n)¡7Ü¿À¼ð3õ‚?OZ±®fꨧ°`š™6 ƒX°"uWú@^h ÷/0/üÐv$…‚xN ªM«j¬ù•Wc…²YG^Xô:I^ ÷/0/üP,¬f©I;£@U˜|i©áˆ[Q;[¨2ÜQÕí‡ócyá–°°¢¹Y%Àµs¹¨E†Dô0åC³®µ&}8/°^`^¸ , {-/À0(@‚“PQ?t@á MŽ4‰8Ò[ÿëæ…ˆÕXÇ­µ´‘غ³ZÛcn’ªîd³ä«i­Ô9¾5ÔU"Öü´Ázyá'aùà2îNyoh¬Q.rãźæÂ(³L¢?ÆÇ#‰7ŒÔc½À¼pûXøËÄuÙÞÿ¾cNë…à ýZk> <ß™±ðW^è¾8ŸM÷s±Àzá›ñB¾0ËÙQBý“y±ð½xaþÊkŸ~2X/|7^pÙ—^û?Å‚Šõcáżðs± –¦ÔŠõcyA-î ýȬÞ†ÕŽ-Ú¨ÿâOO¿•% ó¿ǂR«Êó8*#ß{òËnªKgÃõmÖ oÁÂñÒ28?åÕ¾¬ž<©Ýgaá7ó²ŠE§FÑïèíbÕ¸E„÷‰•†åfÑÚÖ oÇ‚$^8Ø'k€ö/_6 ógaá÷ò‚Ðs19oðwgõÐTžz"Æ(qß±œÇܤUÚ°^x3öZ†ããŽù²Ì Ÿ…Bèl`ÌÅœµ„ѬÃì4×mh/8ÍóÞŒ…ý«”~ªlÕǺªšô|^+ø7›ªêHN§&uªúlçÄ‚9,YQ²³(ª)î_•mòËYN™Žwzil“2/¼ *“ŽÂPÒ<¶$Ë„„2ëÑ÷3Q´YReô‚õÂ;yAÒÚ8Ë6s¶ˆØ ;žûmGJ¬Œ÷™b¦ ä^ÈÎ XÊû):X¢_CLšDR¡A +ÄÍSÜ{b^x /,ÆŒ0£`NƒõKÑ•¦>: G¿æ±Ôã’.qbX/¼U/$hc.¥BÇ\ŒV-Ô‹è]X<–Hq¡\ÄÐÕGUs<ßñB‚¡«N²¥ghÏ\+LCvNCˆ¶£Û5ÁÜã©õgæ…g°0ä +±€+Ä‚PYb;ªY¬ž¯"Z5c¤D?p¬ÞÕŽ,‘á¡ÝBBA[µßô´ùa=¢¤¸¯ˆÈ{pGƒo.EŒ„BÈ°Ú¢M,þÙ¶W0/¼ ê¼AÎv²°P‰;,ä.HK?¶5¬Þˆ…áØ”áêŒk{´3Þ™Õ«ÆìÒŽÔ€-‹²¨‘–Û{.¹óB}mn:m«¦}#!xä1ÜÄ yžNPÐÌ oÅBNXY‹ªY<›ÍÍ17}kæà½Þ¼~Äë…ûzaq!ºhJ ,œµŒx²ÍÉ/«±†‡XØyA>ÄÂÑÅ<>!Ëvß¾œad^x/Ði|n|w¼¤4¾ ÐâËÞ+“Îó«'y²^xÐŽ”ÀLoãí=j¼÷ñΤ"£¹`a\Ðr#ãÂBÅ Š)5yÁ¢bƒÄÊ'X…ɘÞÅ 6;PÃ)JgÄAêÀ&“£v¤\¯”…úÕ}Ϭ¶©Æ¯¤7Ÿœ`“PËz¶è¶JB'»0,gH6C¨¥ "€Ó=^pÔÈZ_±Ð „Z `¨gÄÍy +nv5òÂ9·0ËÍý ¯ZÉ“æ/ˆ-IRüMŽ”BäÊQ…æì©%oQÛÞ·Ìb½°™®Ú˃ªú³¨êÁ&ç‚œn’ŒÍÚJ|Ò[äÈKuçÎYq¤žé‰ªØ]­+ÀHÉzLRÑýÕe5e.Þ®VÛ ™>Êhå…¢m­`ÅóÞ‹…kS™Eö(Ÿó'æ…7‚¡ >·P¾ë´¬>ÃJr__Áô~,0/<êÆBŠƒï̺ÄzáßÊðA:è ó¿Á¡¥Ïw¾},œ•Åú¼ç÷cáwð‚ÊÕfœéÇa8{‰?1/l¶¤dËòÞªžõÂ-báeþļ°-Vh™›ß-›õ¯ÁÂoàpœs`XÕMðëæ…/ÃBa–eÑ’z P6ıE”Þâšô"zKý¹/fÐP¬˜¾%QÌǪg˜õóÂMb¡9 !²X¯ …M{pmzpP +aanµ…Nå3”ZW´OBE!Uíc¹$À(–š4¡ÑÛ™¨«£a½À¼ð ± OMSÊ‘¢_g"ïàäsŸ„Ùh©0¸#¡ÈŒÈdH•ƒ4‹¬%2¾‘#ÍPÏrƒçJ ñ9ëæ…}ößIä:„4Ïõ6UÔAc¾—\kQA²¤i^@ï% ý"¼Û.Þ,'z¼_*Ïý Ì ß uYUå)É1ê—*ÓÒDžuõäåæØyŽÁÒžó¢È(““ÊsK3k+mö•psš™e_2‚•õó­êG©±›žÂ`-X¨6,/ä5çE.–#-Ò%U.Ú +·Pl?ÀB#¸yá·#‘åi ^HÀ­#yLƒ‚QÑ–Ú†•r^ˆe]ÒÅ«¤ ЫTˆu¬AbØt¢©1R#x<ó·Ç)ej „D6Á P@´M÷G°ÈBºtq.É2Ê S„Ê{º?A@Y† ßÏ Œæ…ÛÀBªV“(O¨&!e3ƒºij¨ ÆNîØHèò1€<6za,n3áåý¼Àzyá‹°®¾«–@-H«H(iU×›Utu•Ryœ$*‰…2ÍSªyÓSÊ[w r6¦²Z”¨Â‘õóÂ7Äú¿¾—Å"M·yœk?ë¶ðHÚNšNaL2õ‰!‰mô4%”À¬¸/åLrè©œJuªX/0/|C,<Hwhg®‰!qst—›=çÅý­K :bÖ§VÖ Ì ß ¼¾3cyá&±Àzá»óB_ 5ÇiýËéè—8XiKõØûI¡9à7òcá[óBý—”ÞÑVIÞ±”}¯èxüZ,(õEX/ü:^`‡ScCX?Ù)>ú +ª1ÕÇYD®¯Ûû/ÿ’íìS° hL…ðñgK  ¼ v¥m—‰»ÞL9¬~./Hع'kVÒ‰}õúålY/üx^ˆÉçº"~í/)ü„ãê*½kG¢³êBÒštçy¾¶Ũ`ã…â¢ÀýWbA Õºñ-Ô)imªiçJdˆüŠŠA +Ö Ì ±pðhq»Þž²ë‹Ò°:Ù±ùKk™ë.ŸCK.^xá°½_}1,W%½p,š¦ì ´W½ÐÑ‚i@©`ô6°•õóÂÚù^ûªÙ>!-EÀ ¥Û»–|å6^@•â‚r/4›-/(3Ð,OÄÂÞŒ4 D6»^ Œ“èUÔκÎ䬘iS=Ç +¾Ü´ñ);Òá4 ± ÷uRâñ¨®e\e4ëçû¼`Ï{”õÁXP¯ñXµ:)"ê¦@V(…ˆ¢#,lÑ <ÑpT•×¯hIRêšÝžõÂß-³ÛÂÂü6,(Ú,ëCXP7þ¬iUwü¼%u°ýªFI3 Öœ•…4»Ï Pà¡Pg9ÉÔ”~ÍB:j –¦/G½ÕÂ’_y¡‹)êc‚É•¦ƒN/Æ‚ÇÑ?J8Ãzá¯ÖÀ\ˆoÊ õý5±´£UFM:`H´lo‚Q…>‹y :ìö}ÃL OD^¨0>:€£ƒ‰wšÂ8º2}1”rtÔÞŽdð[X¡.z!jg¥®¡Î‹y¯ÁÅ+æ0f½ð7£^N׈oÉ Su„Q^ u&-¥¬ãR¤Ô{ÌÑÖµÜûÐr­LZÐÙÆ*Á«*Y—‘Rkï(©…,5oƉzŠx©^¨»uÂN 4¥ùÒ¿p¯GF×êÅSa« *¯ò|x ¬Î[¿ûn¸Íù ‡'*eCt£}8Ó± Û.ÆìmH¯¼€Ð0/ûö~ˆññb,”0ôS?€ÍþŽæ…óeô‹;}?^ø×Xp[Î:ù,ˆ<ÏýÞ$$û¡A4HÄ[_%Æ°~GX˜ïaÑb_Ü¿€X°^x ®wW?fÀPÿÝ0­¿›…g¿Õÿ¾âÅdë™þw)‹1K¨½@; ^h¾„šd[›ë½M^0Ù´±'m´½Ù‡'ÙjÕ¶Xsm›;,PB™—7#!¤7ÂÛklX~'/,ýèwvˆK¿ø®¯hóçƒ ‰Ysqtáý>Áßãd‰—ÓBÄ‚“/ ïûŽÉc6Ah“¿›E@7ÃJã5Å«ëá$;ÿN^xʼsôÇI6Ãö÷%†e#éÎwõÌô‚žb£_àå(±Ã’¿ »v>#xö+Às÷¶ü–záU³…´Á¦ß°éÂrêûé z¡¡¸Ä¸ˆ±R½¨iUÏG?æÓ+F#‰ÂEŠ +mSåþ…‹vvùœkûf¼0Üë—x};’RûpŠ—w2¨µéŸÅÂtÌ_1¾C-z³”ûÚ^€…Ïá„¯à…ƒ´Éé”OÇ· («æyîæ®xW›*!áÅ!Ï‹bóº1ª*ßLñx¤g±ÐMŸwmŸÌ 䊨 +³sxÛ­l·7c+ù +$p~¤¯Å‚ù̸ã“y¡ i.ª*C|‰¸öWcÁô²5f]o #}º}*/ †KƒÐö¤QÏ~*h)æ[JÆ㑾>ŒN‚+³Zî¼Û°Íðù<,¨ÛJžÇzá·òB+C'B¶ñ‚„®²áÍÑçSe,|c½@1’nãGZèP1X/ü6^@,t”5Ïm¼`ÃöHCÆX`½ðÛx!ÛyÁG^¨CE“'1X/ü^^ðçÙYK+%WŠ±ÀzáwóÂн÷ÚY/0~†^(·à¨X/°^øå¼°„9ͲÛŸ(ëÆÂ7æ…0# dYT%ÊpÜ¿Àzá÷ñ¹9áùÊ&;7%ÙÛAVé™±Àzá÷ñÂ_;ëÆ·åÆëæÆëæÆëæÆëæ…o‰…»TðÏ•ËÍ“ý_;=‚õóÂMb!M陋ÌòxŠ\¤I¢•xüÿËœ¤X/0/|;,¨tÛò"Ó%ÕrXÔj4Íƃá‘RJÉpy•OϬÖÃzyᱧ۲Sèè…x +KU®¥ë+Ež=š{¬ðìºÏ¬˜n VÐêoYŒÔ5¡‘Š\š rB4°QÀö^Ô¸1ö) Žm§2´‚õóÂwÄB†ŽlÔL‹:“ê471[n³aV£Jeà«#1ˆ\ë…μ¨E#psYŒ‰(UC›³^`^øŽXð{ùR˜¤Æ`iÀj=_*ÊÖÑŠ¥pÒ×0eÂä¦-Ç\‰î GaÚ¹©¡K휈jnkÊi/D…ïu©b½À¼ðý°@+šg‰ƒƒ×.ÈJ:Ê8_nèE¡PPpd½6Þçk^³VBA ”tƒD¸Œ^"(½GëjûF,°^XÚ,müÓ.×=å$7íet§zߪŸÌ wXéiŠÊDUFï}ê:1B—³^ÅœÁ੧uÛC}ÈsZÍsõ™ÜÒè\©!bA"PZ˜WŒ£¯X/¼ ( % ìßÌëGøt]¸¦yé0/\± / •ÈÔ¬A’c”“¦쨼7JGK6˜µ­j*¶ˆ”>.”k&èH0èü•Ã £¨ßÓŽôÛõBëŽH÷êá ,\nC+ý¿ÆÂ¯Ñ ]QUeÑš\¥ûÊ%`¤ƒ™+Ü›†€XFa4Šˆ*kàHíDÈÓ–Ó~ã ¬hÃé=X`½P@FëW0ï>Z ÿ•X/|¨^ð‚®æwXХà¨Ä ùRÄõòìµÃIÄœóâO,ÔïÃë…ÞÐⷬ–$bžë--­N@¶mv,UoC{Ôç´ÏÎê°¤eÕl©U’²JÎSòXø=íHÙµ[-X‰á+Ð*UbiQ7¯Ä &…ZPçn„ü„ª™Ö")Òþ>zZpç1ë…´:'Âoy’1HÒPHÂÂ1Ʋ.¡¬íàØ/àRÔ þŒÈpûÛ1¼»¯âļðú6Õm)R/|>Ïb +6óç:i )aa„ˆTÒ³ T…!^ – +ÔÎH¥-­äƒoB£KLŠ…ù÷aÁ$ÁUÇr­Ð3ØcQS§´‰·>@'­í`NŒÂGRQá]b¤­MdS…ÐÄrÿÂ[±pù–G¬³³ ò\w÷PÃjp×€r"ê…)tÚ©QëoÈTp&BˆyáµXPi¸ÃÂ*¦È´(®ã¢ª¹2M@&ö‰ ÛÚ’fÍ õÃQ×\"ê@íHÄÒ݈‡Ž¸ñ×(‰õ °@ú¹Ç§Ýž7½pNNÕΟ·5P'p°¥äÝx!Þ”ü¾¥™^…uÕ÷¹5K;µ)ù±É“©Oãª>zLð·Ñí¡ßºRB÷‡„^l§z¡uÏU?ªxh:&‹b½ð^,$øMkô÷ˆ…#ÕR]„…%bæ-WûÆ tS².‰·æ…7`ááüj9Uû–Ù·r³ Ç÷.…ó­˜Ú^ãA©æîPÖ ïÇBæê<à—%,4ŠÑøûXè¼wñŽ ¾ß@0/¼ 3k“:^¼"ë…aá\¹ƈTtÃÜÃB…?gÿã±Dåp>1/|ÄÇ`õÂ},$Á‘«B€¥ÛsÁ15¬>à…ü,É·SǼðUXXUÒ¦êCxõÂvDµpü=Ó·ž‹RΉ9ö;D, ËŸ2´EFÈêœÖ0X瘾 û¬hÎôAXhKºAIEÇNøk´µ–44IW•n_|—˜î|øÿK ¿aÍÏ×Ázáß™¯¦ˆŠç=œyáÿPHʇõM¾¼ +bù0,°^x¯¡²cðÄã‘^‹qØÞaCÌ+I¡´¯dÖ ÿÔ?`¨Êóbáwð‚™hÐéÝÄ}aiBÌ ¶÷l[—××ùÿf„ÁÜ{½Œû¾ + çQ:'ÛóGbaþEXX¥´^El%^ÈãÌ +ž–Õ¤:_—Üh½DYTªÑßÍJGàßj‚ŠÀ3l©ÄC X/|Îqp߇báñ‚(æVÌH‡aNDJ™Á¬6«©ª"„*©©€;šU”s‚U¢wxÄÑøKºRÊÐMF™©kg˜ÿ–.Œõ óÂ,x H«dŒuÐI½t0[ ³6B"8 UCe 4©ÇZšåv ÈcVH|Ýаn‡§Ó9ë…ƒ…ßà &³’LT SF™ÁòÌ£× Ü´‹N,à3íjÂÂŒñ“0f^;Hüµ#„6ócÚ!Œ©f½ð,ôÅnÍÇe§ã>˜”£(zæ…7óú—W&NÅ9ü4•íì3CžmAJ}QeëšU 76S¾@ôþÜÀÉ£^ „”ôº‚2;bY•sÿÂ;°PÃÅžXÖχ§Îˆ·gà~UŒTˆ±0¯ÔŽä‘*²­·4óß´æ;‹¦s,‹©±@)¡È †Ò)¡Iˆ…“àþ…waAByØì)^°Öÿ õcáwé…F¬9ò†…q¯”B˜2é¨Íh #ÖôâÇ3•¥a©{‘ ª»¼–Yóì(=Ö Ïò›—ym ôŽ…ߥ yb$šµ¬É’dñÒ­„˜°®ÇȨŲGÄ‚…jI¨HJmª&¯¡Iãk-ÞƒÖ ;/Ü¥Ê3òX s]Q‘WÃ,Ǫ:gò‚¶©ífY7|g(M\˜ÎN~0þÆ ç……;^Øb¤lqèó¹HçõÂŽÊ@ìeX=aa9„É +7‘^¨$d†¯«p|//0òÞ’ e q§¢ƒ®r.ËH/Làð€¡ÐaÌÚÁ ÎÙÁœÛ䃱ð4/ 0Ô_÷ãþ/¨È (“¼×æ)¥…/$G¥” +ÂåhÔ!À(EZʳW.ê0fïãÆBäi£Mñ– I,òí«‹æ ½“jwH-ù²7¥zKþ°÷ñÂ_kÃb!ŽGÚ´3ò‚Sâ„0!;`Î… ›^ >Ôjã8Áw@iXiõ°Lˆý ÁzáXØÍêmׂȩÕô ±í4TgB<.„ìŸ`ái^h_j§ñ±'v4f²­YUj tÓ£”-î‘]],f5‡b‹‘NÇa¨t¾nei‚¿íÛSº½ÄÊc.tU–²Õö™%ªX/<…Š5´õ:‹±°OßÁý†…I9{Á%þ„7hî÷ñÂ÷±—Ì_ðèÙÆÇåG<¥ _àï|[ÍЈmüÝ”™mª–Uûć\Ä`ȇ0™x®íŒ¬Þ§ô½êAn§XôÆbaç…%VÚ·. É'óÂÂÂS+Ô>XåõÂIü’Ͻêu³€X/¼¢éŽVˆ6æÊ !ݱ0B§h¡1ú‚…ù·bá1…=†WÎj`½ðQíHW^Hqw{æ /\°àC„…™ëƒÇX¸—]ï3ûy¾óðBÓöôÓ/w¼RRÕim±yaºò>èn=¯õ[n ó«ó}d +Ö ÏòÂÅJ¼%ò6BL¡Ý÷þ…ˆJ'F£+g€Úü,ül^PoŸêÿª#ë…7`aª.6žE'ó÷±ã9mÊd…áœ5evÖejþBVP‚mŒ”äG^Ûoçs”ÿçËTÙº¶6«ZÊâ¯ù€óD+ôì¾u]–?{ò±zÐßœëÄ>ÖÍzám&¡LÒvígcáó‚éc?³Æ³£¡.a29ÖÈ“Çâ +¡h‹™&Àuiþg °âAÓ“5JXZ—õÂÇ`Á[’óxþl,ü\^P¦¦Ø¢‚:Á()­ h“—æù%…úÿ Oõ&Ðc”„ ª(LºfÄÀ ¥tDpM‚! …Ê5ýf½ðQs<Óé0~ð éßÍ j ‘B·Æõ8E ¥OCPF§&v@‹Eë%IÙ-ôfa¡1´0R†îNkœc@uM–±¬J§*b`YEº@XXé¸Ñ°^ø±ó¿;Ìt'©m1heO¼Ðw$­Æ©h OWмi ,ÊXz—Ä•Ú–â´ rb²ŒÅ¬R!œú¹ôã\8„Mâð€F˜ìÄÀzá›aáçò‚Q(m/ò8ë`VJ4,nA lVøŽLÒõ”a<ñŠƒ®’PÓâ.„ÃI˃¬”Bàêƒ@ +mÖ Ì ·µ8ëé·ÛŽúÉÑÍåêS½HÝœf>íBJ«*œ3M=üN™2d‚PunâLT”+`€zÕù ±ÐT>K$GÙ,‹”ü±vëæ…ÛÀBž`µM¢!Æüi眛傼 Mœ0҄Δ¨˜‡CŠ +`½L[Ї’1¬{¡º@cº“S’wpð9µ#e4½$§¹ 6›6Õì+j³b½À¼p‹XØZTÕÚQ† µÈº ð%y. ¦% [>h:ÿIåÛÔ7#ráEzêÀ¥«ëH,Ó¸môl³îX UAŵ?lX@Yro¡PÖ Ì 7ˆŒtœ”c„·P›ê QHDÕkÔT# KäÓRœÊÅ:ÃÉ\± `!*ØÝ@XÈX/0/Ü&ZŠ‘¨Ñ³ò±“ÀlX ÂB”+÷Ê/‹0 êæ&¦‚ÁwÇïKG3¡•.Ûü>èQ|Ûì ž†õóÂm꽓òH£‹h†r¸Ç èÐÏUV”.5"Î)·pÌÐÝeœ¾F‰2D ‰ˆ ôÄ}, ˆÈQPi¡aŸÇ†#ëæ…mGRNÆèeB |“¢tñ( €Ï‡pX–)t¹‘ ÓetÐSÒ—dÑæc’gÂD3î™a4wXhñ”z)a^D®¥ÜôÝŸm¬˜n Âo= yk ˜«V™4Ìi¾Š2Âh‚ 2Íó´ +Î…î`LÒA8ù¤¢#BפJ©c‡¥êV¬CHðÐS ,tÒgSƒ¢ +Ž‘²ê±^`^¸M, l͜¯É4%JP¡4¥]©^Ô’çÉtÐ4º"étsÒÃk2¦Êˆuœ£Š£‘„jO= ãÀƒ¨ÛB/(Ë¥h'M£À•H0DêGb^¸Q,(Óuûn•±ÂÛ˜Ú—Ÿ2—ʘ­¬2û †ë4›a_jÿX¨±|~92WiŒâñHÌ 7Š…{C‘>Ø"ÔÃOú“X/0/Ü ”Üú/Ö@§þ¹ûË*5[Áó™n «I +ý/°°¦m¢ }:>6AˆõóÂÍ`a5âŸ@çá˜Tõèç°^`^¸,|­±^`^`,°^`^`,°^`^øj,d^Üœy?°^`^øl,ÌEQÞ ¹ß¦n÷Úú_à 7k¿L/Tå­šü%¼ O·jó›ôB·lͯà…og?T/(ÞðϳZæG𷳪¾¹1/|/0n Ì _ Œæ¶¬˜ØX/0/°±^`^`c½À¼ÀÆzyõóëæ6Ö Ì l¬˜ØX/0/°qŒôÛ±pÊØ>Õ^¦ù>}®y:3Û§š{IŒÄOå³ ‚tí“ÍÍÏa¡à§òùO¥û"œ³uendstream +endobj +5193 0 obj << +/Length 105 +/Filter /FlateDecode +>> +stream +xÚÁ¡@PKXBÔÕ†0ƒ(Š’$ü¦‰¢¤‹Šàœ;Eÿ½½wιÖzïåœ1J)k­9ç÷}Zk¥”!$¥dŒcbŒ„Â9‡RšRòÞC­µcç\k­÷xïý `;/endstream +endobj +5188 0 obj << +/D [5186 0 R /XYZ 85.039 781.388 null] >> endobj -42 0 obj << -/D [2135 0 R /XYZ 85.039 766.606 null] +1402 0 obj << +/D [5186 0 R /XYZ 85.039 692.47 null] >> endobj -2138 0 obj << -/D [2135 0 R /XYZ 85.039 676.205 null] +5189 0 obj << +/D [5186 0 R /XYZ 85.039 671.274 null] >> endobj -46 0 obj << -/D [2135 0 R /XYZ 85.039 676.205 null] +5190 0 obj << +/D [5186 0 R /XYZ 85.039 588.986 null] >> endobj -2139 0 obj << -/D [2135 0 R /XYZ 85.039 644.68 null] +5191 0 obj << +/D [5186 0 R /XYZ 85.039 588.986 null] >> endobj -50 0 obj << -/D [2135 0 R /XYZ 85.039 588.261 null] +5192 0 obj << +/D [5186 0 R /XYZ 231.163 272.327 null] >> endobj -2142 0 obj << -/D [2135 0 R /XYZ 85.039 558.857 null] +5185 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F75 5171 0 R /F56 2890 0 R >> +/XObject << /Im8 5184 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -54 0 obj << -/D [2135 0 R /XYZ 85.039 490.063 null] +5196 0 obj << +/Length 3471 +/Filter /FlateDecode +>> +stream +xÚµÙrÛFò]_ÁÒKÀ*Á îÝÚJÙ–,Ë¥h¹–´~Hò‘ ‰”¬|ýö5P„”캶\2æè™éîé{¨&üS“$t=?ĉrý$™,¶'Þd 3'J f2À¼»=ùþCL”ç¦^:¹]õû„nú“ÛåOÎûoç·çŸ§3ß÷•ºÓY'Îû»ùT97<:ÿ|y}{y}½•s7Çé~ž&¾sË@—×ýôÛß½åžïzÓ_n?œßZL-€UŠhþ~òÓ/Þd $}:ñ\?M&Ðö\ÓÛÀÓ _úåÉÍÉ¿ìV<LxÕW¹:††üùq~˜ºaçÁ6qàzAòâ>´Êƒ}¸eÀ÷™)¥]_i@/‰]OEö²b=QÊMÃ/K©ØR=‰ƒØMU@·u[ìžóÓ€E^â†>¡6ù}¢àÜ4õfÐ&Ä{‚hàûËm09«ÃÉ’¼ïl°1!©’D©0rÓ žÄZÞ !y×æSà¼rº ƒ´O×-7f›Slx΢ÞNgÊÙf@-y¬«h±É8ù¯¢žêØi¸ŸA¿,¹}¿‡NQv3„/*T©sºÌ±ûP,èÛÊ‘õ +¹‡©PrRB÷iª§ÞÃÖ¾§‹MÝv-.Z4Àl Ç}ç6j`€&‹±m @Ê/W¼ö Q¬÷Ü!°ÝDÆaZ +¤â‰w£Í\è¯e‹ŒÇñÀ ñiDâOÞÑÿ‚^GÅÚ™Ñög糂þ}ùŸ#À? ±«Ö:ŒP4Ci^‹]Çã4Ro ħZòxYT|±Êyƒ#ÊìÇÓLCàdÖþVTë!¢!áyâQ!G§)É~uõ7fp“s£¨WûÎô 422Hœ9™+èÿì© Ì‘Ë©r®³-b2Iã¡‘œSd»b¾yJŽ‡ÆkòE¦‹–¯Ë pY¦·½pÔÄ­Ž´@¦[e2ç^ŒcìI¼ØaÒè½ÂoœÞ&ØIœü«¡Œ»ò‰ +¦]h¿}¹ä¡&'&ˆžðùH>-«v¨¦ÜCÅÎuþ8‚õ+øé$ lZP»–{ÌŒœ;9·Ì³–KœˆœLÖ¢êe‚!!´$_ïK‘TÊ›²,­H¶N#§bÓCŒÑIâÜcûi{+õÄôzeXWÓ-£=òA¯`ø꽋\'ð0âŽ%;EUt[9™Þ‘¨CcOÒFöz,`Ð8}ûa~uÊí„·jE?ÔŽ &ò%Œé<0ÉM~À¸0röw‰ Æ˜ë0q. ysw }1¿âFÖ2pÛSŽªƒCfŠ0ÆF•,Þ~@p )®x 7¶cº‰R€f^;ªª,ó¯E K”sq}Ç ‡BÕ°´Ã8jh ÐâêÔiê{dö=I¹µÅY‘9YRµ]V–ùr'¢¤h+Gqƒ¡l {S¯}⹜Ô1 åw{.ä»ÉØÉ ”®klÙYæÜ[æhÖØ«äբȇÞnòfÔ¦­j«3‘ïœß̹—9âôt€Ìú8€[æ|-e-^mÉãf>CDš…ÕfC6°d’óªcÐúå—‡{ú/,*e9H#H +ˆ:’Æ!`ÖÑAâ÷~¿ž!“¾2oda†R½ݪ+Ò.ÞÄŠºx 6ŠíŽXxÏŽjËwx¡9—¨©À=rðýµ&[N6ûÖi€ÉÉ +Tg£y>pD A±|ƒàüªA±ÀÖû;ß¼á^©ñ1ã:4o'\+çGÂȹü†ÐI(¾õÊÀ`osþ†Ñü,8+ç£!Gȶ‘@Ô=™UÄž g•Ž-ÒÒp×uƽä#¸Ÿ.ö;Œè|À8T,D3°ÿ³z9 N ÒVd%ÇKÀ4_ca|-tÌLE‘ó^4>àˆŒÈða¨}¬=Š¡Öše \I6žY/E`÷¤WµIµ`«u^åM&«9²„Æ¡4™éUªgàB‘­Ö}"†›Ìt9vh—¤00’(ñjMÈ-óòoàuî« ›D‘1Äú(ؾ½KñU¤ò0»_SäÖq1 /%Aÿ+†)ÄõA“3e™ÿ‚tž1¹,):>uCVÒˆ.Ìøs¶ß‰ž(ç«50q‡ûÝ#Zö±/g¤Tdä°‹»ì œ¦±®á + :¢—±)óRËó;€”,¹~RY<ÆÅE&ÛÒ±;K.íJú“mñ‡¹`_²^ Ù— m—ËÑÐcÕcõŸ<3—©SäÁyk蛕mÍ­*ÛZQK¥Ì…as ¢0³0Å/±¾Ýq´¼–]dsÖ…áŽ6^‚Y¹Nõ‘þã<Ú"“^—d`Ž /*[ ]ر=œÁ°5ÅðøA‰€ê5Ãj–š¿6ŠËîK12E÷¢m¹¬¬çª‚V}& tÓaëÛr§:gÓ™á"ÕÚ¥rn™MÛÊœX°&× “-¸LµD4¼‘(ÌA!ÿ¯Ú˜%] «r#wER`»iœx #S[1£RRÌD¨úÙt¬5VjaõŒÛ_Šj9(Ô‰J†â8|€Qˆ@grßXVë'ŸIÚ±‡’„ÂÃ^ÞÂgpßµ"…ó3~>@/DH# +‘Èíàâd߶¯ê‰\Ë$ßчm<˜™ÝwýŒ(¡ð{T—€¡)âFÀµâÈËÓÕ~Çów—Gö¯¬éÅú\†ñ¢Ý•½•åÍeβo{«ŠÄè›gSSyû,Ïq\_ïP.°NL§K#ùBʈµ¬–Tìí ÖØö†:²? rŸТ÷wTbnú5mÍftc‚ÌG^úHhvÑBdÎ +iÏ Á ÉçÀ v8 _¯„*”ŽOWoF(ÿôþÊ8þe¤¢nf˜QÙci°Oö`ÁÁ;M·Æ‚úFìk‹É{2+åxHhã4qø(½‹dÚÖÈ|ª‘¥T#{fÜQò£×îñK)gî*õ\/úæ·`¥c7öƒ¿ZÑ1à/½GðÕò¬âÈM¥ä0…A¾ŠßŠÖ/= +°Í¬ága_’~ +¶_xÖ¯< 6~ùYX…H¿]ãOTxh’;㸜ÛÝÆÔUÔ qfÁ†+³õ8”ȃ‹ÀÔUÇ¥Uîs®KDz’óÒ:–ã±Ré6#ß‚–( L;ñ-6€Ñ(uùÃÆâc¦–ØqËÔ€DÞ¼câîhŒtñm8ñ@ª‡Ño¾Sdpž»’òP …âKlЛ[µØبTT[ 2þÛË°Íü´²ÎåR¶Hv•£RZ›‚5LUµÜhOïQ¹<“`†éÚYD1*BÇòÀ¥jΊ@îSIéÛƒâˆP·å°ŒâœN¾\ÐR4/¦á’Ù'Åöï˜EÓÓçH._7'‡húqjÑÄv_TˆùeZÆW&vix“%Œöåõ“êH+9PÒ?ÀF-½;vìzLÙ©±>®P2«¥êøü¡àìƒØ֢튲4>ÉÛÙº“~µÞ[¸o°—ÿ— +¸¯ÜÈýü1/¾é‡J}eÙw?/,‡Z»Z¥ßs5ó^{Ás^†~↉/@„ÿÓz)Þendstream +endobj +5195 0 obj << +/Type /Page +/Contents 5196 0 R +/Resources 5194 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5154 0 R >> endobj -2143 0 obj << -/D [2135 0 R /XYZ 85.039 468.867 null] +5197 0 obj << +/D [5195 0 R /XYZ 85.039 781.388 null] >> endobj -58 0 obj << -/D [2135 0 R /XYZ 85.039 172.46 null] +1406 0 obj << +/D [5195 0 R /XYZ 85.039 465.898 null] >> endobj -2145 0 obj << -/D [2135 0 R /XYZ 85.039 151.866 null] +5198 0 obj << +/D [5195 0 R /XYZ 85.039 445.901 null] >> endobj -2134 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R >> +5194 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +/XObject << /Im4 4878 0 R /Im2 4150 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2150 0 obj << -/Length 2895 +5201 0 obj << +/Length 3170 /Filter /FlateDecode >> stream -xÚÝkÛÆñûý -!h -°x\rùò‡—ØN.plǧB( $JbM‘ -Iù|ÿ>óZ>$êÎEÒ- œ–³³³³3³óZ«‰ÿÔ$òmÇ‹'aؾ§&«ý•3ÙÂÌWJ0œ‰¶ÀÇ©ïæWׯw¢;vâÉ|C(óõëûoÞÍ_¾ŸÎ<ϳ\{: ÃÈúñíÔ¬çoù÷öÍÝ|yÖÍë× ¸yóB0¦3e½œ* pwó3|}‡à›éÇùOW/ç=®fÚÖ‡lývõá£3Yç?]9¶G“{;¶ŠãÉþJûžíkO¾ó«»«_Z*<§'¼jäð3ƒ1S±»þŽÚnèHÅ[9¹0§â÷åäÚ Eò}Ǻ[Lc+8ýÉ gB×ylO×±ýX·{*D7°‰R¸KD2v£ÈÊ€‡‡±•àOhÝOÝÐJ—³%Ì$5Š<]w¸*²I«M²JÚì’†WîÒüБ{@ÌòÈS«²øÕQf·ÇJÖÉ·¢}@ -ÚÇÜgÛíÉ„ŠRKü±R”š€åøtȱ?OýÀJ²¸Â#7)¯'i¥x %/]V%‚îYôBÁœÇ²»²» Îä7‘ßoØh´ç××yIËVI¾+ëæyì¨ëoX ³9¼'ŽØ¸ðšyo……TÐâXS8­­û ,Fh)ƒŠd/kËÍÉ«p KÅS"°½°ø‘T‚Z‘ -¶õ/.CȦà7Û I[.Ó»@eáá é’±Õ„ÖÈGò©Øò;=ˆUÙùdtI!dÃÕX"•·½¯[ªçÊ®åMIv(ãôÕssú-š4 ßêà—ü{ÔO¬8p»;BKé8LðYz'ÄË¢HW q¹fßoÞˆ$)ì-¬iï*,%s_2½ ÉYÑ!Eø©RÚ§Ÿåjðʉ\L4‹”Ñr£ñÀæfÕ<==ð$5;–²ZóL] -h•ø™Ô-"ízÏ·}]Xá}–確UÆž™SVœ»ÙUΧ *»Ó¶æ&6~xè)*Za_ -ì3åj;ò¼GsŠÐŽ£Í)´íé`˜Sx˜Nè ‰êo#+&«rY[‰'­z—L=R œ¯FHòsB‚§`ñýF.G?\›VŸáÌ—åÚaühÆ¢lRHs"o,cù R?Éf|;tC™¯Åc´®1ÏƼÂì5«®gƒ=ŠV˜ì»XëÛ*röòO -Lpɵã‚ȈB¾æÏmÚàÀc¿E×âÏ$ ϳ6ª2Ý1BòN±f\“¼@&‘û7ù N¢p]Þˆ -»-±@Ðà+ëv3@åuY|;.:“FIyöw5;Ó´Ùµ¶ƒ9M-¿ŸËªÏ‚œ>HžCtÓòG|'§_œ`ê(¢Á4hÛp”\óì*1ÉSnX2 wicÿéZ—¼c·Lß·BnF˜?É£ M’,pÙ݃6w Âý‘Ëþ:)~¦ü€¬6®¬ò,e ê¿:¾cŽr1‰ m(8 ‹- ª‹9jÖõÃ^Üñ#‹#K¯Dá#ðháçiç‘s±œV†£ -r‰<>yˆ‚éôv -Áñ·8‘%)}±6K((Âènɵ Ö¿ͨFÑàœ Ú‚£sô—ÂTkÊâäÏK®<Ž·Æîý䢋žiª±T™œôœ -=¢Nç†À*€)ø š'¹jÆü—~Û8°=e ±IÐqO>C×i6X [hC6b%Ù Qp¬M ¹5KÌu#¨½ÈP4žöø–h-QÁ¤ºã´Fb8¢´ ®êQ–%üƒñ¹­?(F#t)ÖBˆëu›Ej%a¯Ïñá³ü•áÌhQr;Ùú¼ì˳6™@iú¼õ.žîE|ª 9:§Ÿä‹hD@ù³»~UèÉe1n–¾ðž^鞥 é¾í:ÁS!]…tÉ%%zŠaÅÇÂN‘å¤ü´h ÞÑÓÑÛû¯Dïëë~܆ú +›ëÄh$›ÊE¸½çd„‡ ª¯üC¡±u „&œök*%Õγ3ê‡|Ó{à8:e!ã¸[db|#d]HBøîÎØg¸$û—Ü`_€kê$¹`ö¤qê9(ÊÑ2ª!C‡#7Θ?FÄHð^9[»AN´ÖFS&P¤åÄ×9°7òì(ê\çÒkÞŒ˜ŠŽí¨u±¸MÞ»átTLË*I;€§~‰A"ë±CÏíû ˆŠ¢¥>ö¤líU‡ôѶc7=)k(a‹ ^džaúÃN2¨Ö;¢o;ŽkDÑ/…¤ú8HEùê+¤çÛ‘ŠOz nÚA lè¢o´ë[é—d0)'|£d´«û)'|QK ûƒVÐÊpí’Ój4ÐŒgLåœb^nÑnpØÏÆô6m1$ÁìÍùåËÂÙÍ¡ËžHwdÝŸæÅQÖõ¦J×—ã‡ãؚˣGã‡ÿTüð¿&~l(S¤6€Œôâ-Bïž1p±YlÍ0+â/ÝøÍüY¹JÅÜ" -î' :“¼vå3¥µÂž‹a;Š¾&6AèqŸè…‡½wŠÑ^8ûŽé“–GPUl5mÃsݦŸjÉ'H£Û¯4šïO«>ž²5¸!f`ìnû0¯e~qûæÅÛÅÝíØN¬NÈDÈümÄz#[G-©Ø'• Ôec*?4n­(FˆÊ¨ïÊL¶tR`Ÿ’öz죗­“ZKl¤ôg*vm8EßÓ4|.µ(Ù¨tTÎÿ‹&é9¦QcÀS8ÞNŸþú4‡ª¥ŸÎÛB_²–s¹Â݆üojè@oý 0ÈjNÄ:êû ìôýÇ£B QaÁÍðö·vÉôøºk÷Vš‚/Êâ[Á\Pp -i…žýïVpÜOSâä}B^¶èi06O ò(£ö£'^|i{ÖÉ¡9o\BÙ`k'ägVVÛ Þÿð‹/²d[´YŽÚŒA’2þ‚ëÙqèòÔå=°æ¾á¼’gÊ/6ƒnågü%‡s4j+æiŽÒ¯äìÐSvä »ý.áL`¸’oÓ¸Äߘ;yÎ/g2µ;·a¥"ÛÑ]œü7Å|SPMôÐJc5îE²ÁÁññÙ¼)!è]U.©ÚKl yGé‘ðêBö¥5®0¨0è)…õÚ¸å.‘½¥vì7^=ÛŽ;ˆ]õqµ2-y`{CÕ'¯nŒeA åaNÏò±æ'ÇØ£žŒñŸœi׌€µ("°àš¶ÿƳÒk£òö>kË:LÐ@*kß>ì<´½7„s[vŸ–…¤Áhü8éô4 ÇבFlÿ]]¢µ(ŽZ>æZž wÒ*¤žìðµ©2elÙVwÍùà øCÛ!ŒÄÚöÕ…ÿíÒ™éø%|­§û6ÙfT|æ“Lî1ø;qr|3endstream -endobj -2149 0 obj << +xÚÍZÝ“Û¶¿¿B™éL¨™G?Ò'Çv\gÜóÕ–ëv’<Ð%±G‘ +IÝù¦ÿ|÷ $eI×L‡ŒÇ.€ÝÅîo ëYô,µ*0Ù,Iµ2i:[Ù¾¼ºÒBá ‰?¡ù~quýCÍt ² ›-Öã:VEÖÌ«Ÿ¼ç}v»xùnîc<©¹Ÿ$©÷üÃí\{ïyôöÝë›Åë›WØ‹`P{nñóÛwóÔx &z}3~~ö·ïŸqϨ`þËâÇ«—‹Óà*C6½úé—`¶‘~¼ +”ÉÒÙ´¥áóî +øT62Ò¯®Þ_ý}XŠ¿E3žuN+ŽÂɲÐ>­¹X«(6ƒæBøªUf-jNëPÎ(D¤:X3R nJ³6¥Aç•'Þ2¯¹qè +lÄ^^UÜøXÖ«fn´÷0÷µ×Á$ ýÀkwyß+ž÷)„²å±ÛÛÝ%} +cOJ8Ò„ÚNlc0ÌxãŠFÖ["«(v¶y½®«»"6º=ü¦^AÄþ²Ùáï)K˜ +_z¦CãAIx6ý&^w@Ê}U¿N\ñfŸpâ#Óö[þˆô;^ò°†¡œvìÐl‹V^7íñ,íáÚ-*ôâk4 –óWjºþý²-‘ ä3±ñß`Û[U‡=8ê(´ÞK ºÇI´,ª%‰¼rÍÓrþùP—ŸìúMÉŒbÇw\TUÙmÞL;] $'Αr³uzƒnÝHÊçÀ–›7p[°žË¦Õx*os@ƒŠ´·æ…R^¨iKdÈD¡÷VÜhÊš·ÈwÇŸwbaæòªc´ +j|j笷ì¸Ü][Èäÿ0Õ#myàÎ`_ØéòuQ=r»o¼- + ô%|‡²ÆÅ;6àò™ Ab”ÏÄÄ6Ó¼´7EO:ñéT5Û¦Zákkþí·7ÈoÅgiàfÁ¿÷ +Ü¡ÒÏÍÌÐoÿÌC¬í°01·,7’‘¤²YÙóï¡^nñ»¶ç6ôVLŠg!³ž# #ø*©ãÈ­žÈ„¨D\¼cðfÿY’½tC71ײWî°‡78ùa°Ù–¿¡Øøëvø°Gõ°€ÑóØ¿]Ï­ª¼“•pÛœ?’€+ÞH8º‘PCˆ:,¾l¢Ñ7_£´8JT¨C¨16S6‹Ï†Tc˜(¦סY¬Ã-G~¼Žï¸òm¨ Ó'áQ¸ITœï&RAÌg·h:‘Élœ*m)tÍ~iDYf˜fÒ&ÆGhàúõ.š½h€ÃÙ“¼®?Y˜#F:6VY”Ìâ SZs:±˜§x¤Å§ì]Þñ(;…ŸÞº2ÁdV³ƒ@£ ,‰:dŸÒXð#ÓQ +òB>Ödê½ ÂæF8èÀ¿Ð¸ +!:¾)dâ‡v#ï¦)„PûrÒ…™ºÙ—k”ôýþ;FšôfÇHs}ýðð –‡}§švsÝ]¿ß¯Ô~{rÌ&°*ð™U6>ã?!:=2ì¥i4¬Ä˜0§`kb@ }…•KW<¹å ˜âÖ¿è”Ü!D,q^ÅÂjªÌÄG²ˢC¤bh„„CÕwÜY•Ý¾Ê1T’HÍÖA¢Þñ‚!™f×”ÃÕ²…}-ñ`)ƒ›Dà}Êú' †tã#àç@Gí4G@Î˾ëð¬ßO4¤ÀÙl‚¾_æ1t–ÌüáòU&„«[f¿z™4V±Ž«hB})LŒª8 ŸSÜ04D<ºsõò¶fëÝ\ŠY‘ëS(! JG‡©iûBÈ +ŸY㺗#VÃéÛ˜øýÁ†=l'€[XA> -¹]½wO½G; 0|\‡ô1”|%fºD“Æ’‹®(L}ÛK–6e,¾+t|c 8Tž.j¬‚”Fh…{ô¾nås {€:§ûDV%‘¹"ô9¶!è»0@M–>»,^ÔT'Ç—*ºâYÏk‚ŒvŒ÷†Àáðyï`´f¢(11pz~–`K(äª0S2ÎqÕUqïP¦èxwÝÃ6‹XnJÚ ¿Ÿ\ºˆÖg¾šûr5¹ˆR„ä¡tyÀyJX!Ò< ç4ü(4’>G O.×eànFž¿¹P¿ûÿ½øŸ²? +>ýΉt‡*‰Ÿ(“Ä*1éÿÊ£ ˜t†¿=Yø2*«UGŽL¾ÆP—†“K2t†ÌM+…›øæŽÌ{ÃDëËpFÍ¿Íàl›’Ò€ŠW¸/¨’38žÏ9¹£P+p~’r"ÎÌЫùø牄˜†Üs"DIzÀpB MšLÅL¼»Zî—Ôë·yÏ-&önp•ÌŽxeNhÎgù9°Á(OÆݹ݀sÊðÇ!ÇòOÁarýÌŽ· 4Ž&xõ ßIN’ÅÞ›g7<¼Í¥h’% °Ò™r~_µå=ñ•%ÌGNe‡¬ µ§ñþ<¦<§šÇB0EÌÑÐà’D‚ëݳAÌ'½%Ýjä#ŽàbÂŽ|üxT›ü|½—B$CníÂØ´¾¬ Xràj/õ°ðìâÜŸx;ŸëضÛ:ßgBL’нŠgö Â)›ÐIébˆ› &Q •GÕpõUÎ5‚(¿*ÛbÙùûKSôåá(ÍÇÃ\ÊͲ!Cæ² ¸3D*4þª]¦¾‹Öé)G‘ĺ82ÉQ³íS§:ø;ºëH¨!…ÝHá–j²Â>šðŸi|žK ]²ƒQØÊA'RüÐdŒiFÀ‚Ûè·ÇaÑ°)üæb.>ø$ €£ø @‡O–ÔÃÂô$Ý<ûhøÌÑ£AzîÑK©T”‡ƒŽ $ó€±õô5 njÿûJzy%h¥:ˆÍöÒƒAh æ²ØeéFšË!œDÓƒ¡r–Üð€Tí:îJô)ö<°«e;¹ŸcÉÓp’ù!®3yŠÀáš®øþ€Å¯ØÄë,äìã Ü•õ'¼Å–/«Å¹7ª7‘7§p½)¸1 06@BŽ„+õØ*½½œJ$9Ý›q&Ê×bRŒ—³bûä-@öÄ æj5¼Õ”ãÑ qt™×ßÊÞÓA}î*­¼gqò\UÍdDúŒ#}vtꦑ+8-ð¦®,4§z= Hø ¼.ß¹bôv®JQ1á?}ár m›ÁRp¼ìÝq뻎¿Ð“Ûëôkº€ùO_ëB@ññZ®êã`/英_±õ-ð´áËâŽü­'¾qÆvÈcà{?Øß-9 +4$ÉOc)`ØYó{Ÿjù\ºEe.“…CeÛ„ÐÒè’aYf¸Ó€Â(fX\»æ Åðr÷ÈCâ5B.G©Åß±%ûTpþCÉ*soB“ï2dÜåÂÒ²©‡'¨c·DÝŸÊ™·K$Ý–=ÄíC[àa€ó¾ïsy*¤Xu˜¼€¡ƒŸGA¼¡GÑÓ?¡0>@§(¨ƒLÅF;Œ·ïQ†¯ãBÈ °h ú‡rÐÕ†GžµK'Ѐ@çø b•Fúi~GšË¨ Äa" ÈŸ{ãÒ»$)’*ºgâºHñ)Üÿ °’ã|qì8L§÷ØõÅŽ’§Cl~BdOX1qSŸyÆ c¸lÆ./yµ4Ð'=}æ²p B‹µ0‡×5¯ž¯ðüËž_çØùõO[ÇÑý^QIÒAÜ8ïNÝB;B?¥x€ðR&)ø³\2°I‰àQÙWf~ ì;™„@ðP“Áú©Öc¥×±A#k=²áÀ[a‹Ý¨^Ñ9Ò=åÔƒv–ä!åä1_TÈ÷qõÍfˆÁšß‚ñ·8züÆ‘]ÓÊÔ‰It˜Û&™SšÛ¬^UÎ7;ž“óóµñ¸rðå£Ådm š„2Ïîoô%<›áÀ_ÖÆWýÿ“Áã"£Rs!M²aHÏÌ j? ì—üZ“*›šS†ÿ ƒ~eVendstream +endobj +5200 0 obj << /Type /Page -/Contents 2150 0 R -/Resources 2148 0 R +/Contents 5201 0 R +/Resources 5199 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2162 0 R -/Annots [ 2160 0 R 2161 0 R ] +/Parent 5208 0 R +/Annots [ 5204 0 R 5205 0 R ] >> endobj -2160 0 obj << +5204 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [293.723 140.375 341.14 152.065] -/Subtype /Link -/A << /S /GoTo /D (diagnosis) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [424.243 605.692 454.872 617.685] +/Subtype/Link/A<> >> endobj -2161 0 obj << +5205 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [225.07 126.826 427.223 138.516] -/Subtype /Link -/A << /S /GoTo /D (problems) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [155.951 592.143 306.851 604.136] +/Subtype/Link/A<> >> endobj -2151 0 obj << -/D [2149 0 R /XYZ 85.039 786.531 null] +5202 0 obj << +/D [5200 0 R /XYZ 85.039 781.388 null] >> endobj -62 0 obj << -/D [2149 0 R /XYZ 85.039 766.606 null] +1410 0 obj << +/D [5200 0 R /XYZ 85.039 761.463 null] >> endobj -2152 0 obj << -/D [2149 0 R /XYZ 85.039 748.602 null] +5203 0 obj << +/D [5200 0 R /XYZ 85.039 743.459 null] >> endobj -66 0 obj << -/D [2149 0 R /XYZ 85.039 610.22 null] +1414 0 obj << +/D [5200 0 R /XYZ 85.039 241.642 null] >> endobj -2153 0 obj << -/D [2149 0 R /XYZ 85.039 578.694 null] +5206 0 obj << +/D [5200 0 R /XYZ 85.039 222.973 null] >> endobj -70 0 obj << -/D [2149 0 R /XYZ 85.039 453.924 null] +1418 0 obj << +/D [5200 0 R /XYZ 85.039 125.442 null] >> endobj -2154 0 obj << -/D [2149 0 R /XYZ 85.039 425.126 null] +5207 0 obj << +/D [5200 0 R /XYZ 85.039 96.038 null] >> endobj -74 0 obj << -/D [2149 0 R /XYZ 85.039 313.904 null] +5199 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F73 3992 0 R /F14 2895 0 R >> +/XObject << /Im4 4878 0 R /Im2 4150 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2155 0 obj << -/D [2149 0 R /XYZ 85.039 266.376 null] +5211 0 obj << +/Length 3775 +/Filter /FlateDecode +>> +stream +xÚ¥koÛFò»…Ï@qÔ!b¸K.‡¢@ÚKRMêKœOm?0%³•HIÅqq?þæµË¥D;A } ggfç½V—üS—¹ £¸¸ÌrÆy~¹Ú_D—[Øy}¡b) KæûÛ‹ç¯ÒäREa—·› _Þ® ~øñÅÍíËw‹eÇ*ÂÅ2Ëòà‡7 ¼çÕ›w×oo¯ß¾ÆY‹*øpƒÛ¿¼[äqpË@×oÇío¾Á³8Œ¿ßþtñòÖQêhª +$ó?¿þ]®¥Ÿ.¢0.òË{G¡‚íýК$–ùîâýÅ¿*ÞK.ù«9©˜8MŸ‹EO,Jé0Vú23Qh¢„ä2Ü#pa¢`Ãòãb©ó ÚÁRRíóàÓ¤AÙÕí`zäDžz¸ ¦€:"¤o®êÍKø4ÓÁðpX8C¾šPdò0MŒ|w’QðòÓ è˜‚P5«v¿Xª n`²åõ ;XØá·H%0ÝUòIÏ¿ý˜1&ø£Zá×sª‚5ó4´ V6<¯AÎÏ›„ø€ i&çÙpˆæ‡×ÓYýÄøQ¼=š†˜kÉ ¯ïÚ~觷ëkkÍŸj« ‚ 5³Ü;+Ø«Õñ`Ñ_ñÒo‘‰ÜÅáWÎYÍhV‚õÞàöÁ/œ[‰ +áŸäJTF Žù.tI룣Yô¦dö¤å­Þ¢+{ëR Ô™O ø ?*Ãò•µ1&q»» +Õ>mB“é/hßô„ö З´ï©­öž7«}ÞyVûtžÚ0Ó6kœ;ÍÓ9hž 08+ùçjâ‘ø›5]‡§W¼~Ò%q®´:#ƒ §xŠƒmÕ€§[ñ„/ ¿¢[îf4ëÄ êÏç²ú;ã¥,«Z"Á¹ÙмTiCÊ¿ûrÒYþ)ŒbÙmƒÉE›#†Œ¼EEdIÚ)lÛ8ê™ ­ß¡p›ó0¾r‘ÿÐ_ñÒ#v;’Å¢e×;2u@[ z´oêXHÈŸÂïyLº¯ +Æ$cóð-P â –wø[ÿå鶫<ò¨Ÿ‰)*Ê †ÉúÈ&sȘ‘(ºûº·\¦¹6OˆáÒæ )†ãU{”¼Í¡ 'ÖÒ_—ú”ëÑ?…±O¡ŽU¨3›\hÊ;I]A;Â`O5ÒhƒŠþ œ'›3JE³"ß‘Ú¸Jwer_ŸLnÓ ƒZÓqjrâ3b "N.MšCq–}¹Œ©ùRp)¨–®s߃Y¤à,Ò¾k·L$eÞ¤Ž ª…Ò“7SpŽ…h.žF"@@v[%ÿxú¾’jŽ4K%a©É%Œ²‹Óxb‹ö˜UWã‘f+™õ á+k•à–E2ÆJñ®y.Ÿ* XM¡Š´V`1øÚ×o?È`~ë áÖ-̨X%[ÙÈÉNk—dXí^L m…gtß„1“€>ÛÎnt[x7Ð<ðÇ«} „”¾ÄDôݪa^‘O_æg„ªÞdJØi¸˜/s‚ÉVÃàN¸’ú£(v‘Ì`§Äª€ò¤¡¶ê‰ëœ½`솃ÅãÎsW8.ÇZš@{çü¤2¥˜‡ØšvàÁXBõk3hP‘è‰2“é«à†Â<øx$Ò8Ž"´¾¯¤•¹HØóÖÀÙVË3 ÷wµÊCŒQWq×Ï3æ '÷d°\IRùÍ‘¼À@˜Šú<Àó‘¾Ê•GìàÏù÷JJ;£©)”´AÊAa+Œ®-×¼H‘DÓue=ƒž“ù3ŒX +«/¿˜WMB`OÄû¼¤g‰ºQcÕØÚ\㜱 ‘ï»YZ/nü|D®cGé@bRwAè>¡ô¿x™©Êȵ¨ž÷<÷*xŠ„ûªYSà7^% 㟹ƒ ÇÏ(œÎÍ.…öÛ2¨ •4fλ¶úèD@»©{n V¹fTf*)(ñw ©7¦¡\aY¹”8»œ’GV=\¡ž€‰»›ñÇcë¯úŒæmoÓ¼öE ®ùùüÔÔ;€Ãäîz¸—TýŸPFÚŠôx¥Ý^|¼„©X‡y1ísÙ £ìn²uaF®š¯<ç>$Ýù§ÚËUN®8³ÇÏH"5a®­$^-2T;´"j¤<‡øÛóp6=IòD¾…¼fUÙ “í*6”’ìO;æy +¿àÕŠø ÇB/=ðsŠiú™Õõâ³ß²]Jš–$Pý$Óã¨ñ§Ñ(1a”]&I&I2ŒdéÁÌÄ¢)Š ®¹%wÛs[rRáOz‹äRv®àê±áÅ;OØk,¬/¥óOϸ÷¾nýΧ„郓§õv©Aȸcc[.Ÿ>Œe(vfòi+ ]œ½nÇPÛ7§Õ”KËD{Ù8ŒOs@üz&†¡Â'6 +"QHƒ ã' â{iÞ1¦thÀäâ?ŠE +§í 9Å“PÃßo\ê}â_- LoÈÇŽèçkbeË8Ò ‡’;x=Q|ô„50HW¹`¶£Ä!òº'Ñ+–pÑ™ÀØn¦õ½´Y¬Xw¼<Ær +•¼XËa¬IËŽ§žÕËz¢‹K1ÒNÔÕEÚ˜¢ª‰`6mãúŸ9 +ÏA¡@'ÒÆURð”=tó#ÙM·jÆ(=¦ò÷ç ø¹²Ük#I’äÚH^$žy¬ŠÂ´°ÙûÆó¶KºžÃÜ+Næ‰-…¥º¡àº³ß5€íÚ¸Aý5±Ê™GÂ8÷%ó䃧CMî + ”ΘëCyÐ,0U„&„C±h7 ã£\ +v¸ˆ#zì‰Å»¥©-c2ïU&¯êë„"é?Â@…´býäñR%†`/þØv#°3×è¹/èT&ÖÁøôwÞ(ò0Ò¶ò¼8˜>ß×û*³/’Jå¡2éØóˆÆŽ(·+i0Íê‘L.«…ÂUI€ÊOèÃòp›éBŽúÇ£$iä0žæ'ýL?scÉöØ»b÷KÚÉÒ‘B{éäÙª¥€Â _Ü”’‹òür#ÅäýjS(z÷VcOª”ŽÛ¤P¶q8”ò:m’©ñ™‘hDŸî½u͸¯ŽßìÚmCô êtGg夲à'î¸ÇÆML\±Wq +žŠœçø\¹f4÷wô&À¢du#XëAþë¬Í6qRª#§æLÚ•ì™çrdkÈ)ú‘Õgœs‰ëeG»²n°>Ðåu’Ma€Ú—²xàf0,aï´7™°È­ËzRé1_Ë”ßÍ ø6µM|ð4H‹Y³˜ !ÞåŒrÚÂLû•íÆ{}š3Wìå¹?!x’Þ”GÖFí+¿g }e³³ 5’@þJ£—ÇkìŽþ¤*×ò²A +ó§k2$ã{™<нÌÓ0†$|™Äa§,ÄÃaI!JäùaÉf54ÂVc?@°Eï=ûææ_¯Ègî%T¹¼™÷ ëJɲ鱣A¢ÕšZí:}bSî+^¢æ5ªZ:g>ã”ò8Ô©•mˆŸÓ¥!ovÒ žc"pÖ +nK’óÕHr¹¥üJÛGE[ÂÍE1E©UÑ £\¯{Iy ¦é´¢ rz{gÿZ •¡¤ MI½v9Þ¶ngì’ºâïÈIøp¢sÒ¹€á¥¶°ËÃ7¯F ¸¡”moV<Vò»¨ $ÊBhk¦D|ý9_u` ÙÈÉè“gü)erç2†|ÂÖ¬¯ C:„hÀ/àžS¯tV 2zVH¯dmÍitŒíß"Èsÿuv•a¥Û7i©¶RÀbñ‡¬«:ô<°¿sûǾÓõo£ä;ÙûC¼Fß—@Îî°lø/À M“ö'‘–€ÉS¿Ø#Îù1 \!áàôW]yIÔ›qóF‡ùø÷E ƒ™¤&#úmòzŽ$ Se»a5û¤µçs¿ˆc…‚ZßRJm,`å¶á¡ËœÀl“òõxÚy¸y,‹± +.©‘›@RFodTòœa‰+ÑÜV¢ÅÔõ³­*šÔZÊ7›ã,‚Ü<9c5IöÂĉïÛ™Sò0Ém(Jæ0àC½½ÄïÁ> endobj -78 0 obj << -/D [2149 0 R /XYZ 85.039 183.05 null] +5213 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 538.171 193.25 549.86] +/Subtype/Link/A<> >> endobj -2159 0 obj << -/D [2149 0 R /XYZ 85.039 154.252 null] +5214 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [455.889 456.27 512.306 469.171] +/Subtype/Link/A<> +>> endobj +5215 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 443.327 146.066 455.016] +/Subtype/Link/A<> +>> endobj +5212 0 obj << +/D [5210 0 R /XYZ 85.039 781.388 null] +>> endobj +1422 0 obj << +/D [5210 0 R /XYZ 85.039 374.255 null] +>> endobj +5216 0 obj << +/D [5210 0 R /XYZ 85.039 353.664 null] >> endobj -2148 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R /F41 2104 0 R /F38 2158 0 R >> +5209 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R /F11 2898 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2167 0 obj << -/Length 238 +5219 0 obj << +/Length 2562 /Filter /FlateDecode >> stream -xÚmP»N1ìï+\ÚÅ-ûð³ JTH¸ŠSQ -éø~öîèdÉkíÌŽg– ê!“ “r„ dÖ š­"w ý0|Þë{lÏhË’¡øêͲþ…û52¤T没þ+ /Ðk3Pšv8f§`¡`ùŸñÚ«6sº\þ¹~Ÿ]þendstream +xÚ¥Y[wÛ6~÷¯ÐCÏYj ‚dß;v”Ó¸ÚDÞ>´} %Úâ®Dª"åÄÿ~çP”L¹Ûúä$†ƒÁÌ`.9Šà¥±ˆt6JR)tšŽæë³hô_nΤãKØãy?;»¸¶f$#‘EÙhö°— ëÑlñkpùñÝtöáË8ÔZ2ã0IÒàòn:–ÁW¦N¿Lng“Ûœ ÊànŠŸþ2Nu0c¦Éíþó»ÏïßñL‹hüûìÓÙ‡Y§i§h•¡šœýú{4Z€IŸÎ"¡³tô Æ‘ðy}zŠØh7_}=ûW'Š¿™¯òŠQV¨±HUúçÛé8qf·‹F¡Š¬Ð‘:)‡VE ‡GžýPN(¥ZªQ«L¨xX‰I)²8ÆÃ’26S£D)aðüà´nkpo;ePûÕ³[iḔ9úc$Ed²L3OoLì #ÂÅd-GW5h::P–å†=Á¤¬L{‘%cøh’‘Í-CÊΖcÔ”ÝòÀH” þª Ç<‘-Ûg&–ëÍ8TIPá\ÔæUËŸ0+‹¤æE5wïimÓŽU|ÃhZT¼Ô“Q.šr]®r¤n™ðyÒ?@—â)K«˜L ¥Ï¨ÉL’8(µÂ¡ñYò#Ïêªà˜‚à4ußAJ ™`p Ü| 7«rž·e]Áø‚÷¨›¶AÕçÛrC'M‚"¾M[®V¶)è¸C¥É¥Ó É$S(à&É:ÙH£ã"_¶dJÕB Ål\ß³‹E±@Þ£_^³^“£0üq³UY9‘Ξ—ªÕS¹­«59EÓ[V¢ûUÑ0õž’ŒÇ.¥À{ò|(‹b#£SáñTýÍ0 ½ä^ò¯s§˜…Ì©ü©à yØB`Ð ã ;aœ”UÓ•=öòÂðå»fB'hJå©i¿v!M¡£ó6ðmÙò«à´ÅÕ8¨Hu› Ó<W£C!ù “®.[ µqKÚ¸ \³'IbýÀrXG<¾tÖ•óÕ¦cö92!8p}h"KÊâ¾8<Ï{× ¥®.†í`mí~)Úa°( -©î‡tø›}c˜cç0sæs-§AC_*ßWíõ¸Âó¢®3  ÒŠ:þ’‚8Ø’.[[5å}¹*[cÈ€çìc¸êònL‰ü2õÞ4m½i"[zÚe U‚¶;>ˆ£“ ³ DðPCkÞyjáÔùŽEGY¿¤øƒ„Ú°ÀE\C‰¼€R:^ñÏ™0Ìk®ÐNÝ~¦•&[T9ïb&ëÀÇÀÈ$RÄà‹ØzvC€(¡¯„¸.{; ´ž™7‹I2Óæÿ5¸õIT +5B€Ó^G¥&ƒþ*èý2jo+:…êñ45&qê¡)D¨4†áh|šªW iOðihj,àŒ³åª®þµ(±½è}ØaI5‰+Ëøñ%žB꺤À+Ä>¸f‚Ÿ=dáF™¯7¾›ê^ àd[䋆yWåÝëÝ0!ËæÇ´Š!”9-¬¶î­ »Ð]lˆ·T|H¥»æ–.©2†ÖÚ €¿w¹:ÜG¦ê`Ÿ{ÄêþÃQœÂX¶Ѭ=¨`JDÊçófÑÚ\'B‚Õ½›]¯ Á*øæÝŽ/F´iîørg€n:Š»—ôË8¦wZZr¸Bœ]8ôI ôwœÊ}`Ú^C†1Ò·.eÞ½j)ªÌ +£äÑCåë +º³Äh‡j~ e²ž²*NÜ{Wšs¬ ªKFüü„áÆUóFŶËžÑý2³äC'¡½wˆ-a-ªÈW: 4œS øƒàf2[vŽÕí{ *¾·œ/^ó;;þÄ«·ûtꀩ³lJNÒs^àMêîÖòï%~àç¹ð‡¿žtø„²Ü„§7?Aù³ÜÃMi°Ü<®þjòuæÿ”ò2ªžXëûî’bæäFh¸C÷äN·°^©‡i¯ Ïý› „€Ž§!šMœØëI`­8Æê^šŽ_ÓNBÌH¨lžÁ_Ž 7ý¿[òÀõ©Î†1^¬”PÒë‚žSQr¬o¬ñâ®_*ü?ðçendstream endobj -2166 0 obj << +5218 0 obj << /Type /Page -/Contents 2167 0 R -/Resources 2165 0 R +/Contents 5219 0 R +/Resources 5217 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2162 0 R +/Parent 5208 0 R >> endobj -2168 0 obj << -/D [2166 0 R /XYZ 85.039 786.531 null] +5220 0 obj << +/D [5218 0 R /XYZ 85.039 781.388 null] >> endobj -82 0 obj << -/D [2166 0 R /XYZ 85.039 547.583 null] +1426 0 obj << +/D [5218 0 R /XYZ 85.039 367.956 null] >> endobj -2165 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R >> +5221 0 obj << +/D [5218 0 R /XYZ 85.039 347.365 null] +>> endobj +5217 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R >> +/XObject << /Im1 3957 0 R /Im2 4150 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2171 0 obj << -/Length 2514 +5224 0 obj << +/Length 2599 /Filter /FlateDecode >> stream -xÚÕYKã6¾Ï¯0ú$mYê ‡žÌÌnéÉ í ‡Íضl ­GC’»§‘?¿õ¢^–=‡äÀ“Åb±ªXüªH¹ ~î"lÇOQÚï.¶Å;gq€‘½s…C¾(í™Á•]…ží¨hŽÇ‹l/ò+OÙ‰Cï7ïÖŸ(jR&<èyÔÌ÷šÁs ɺË+Fü?•;AøÀè#Ù,l¤1v»S`£a*µS]šUÛ#ºDº¢ ©†ø²grØVöä¦Ö>‹È(öŠ™ØvƒøZq›øÞ°˜q•íÃÜQ1ãb9£@µUw­1wØƃQ•éY9s¢o”V~à_ìÍ‘< ±ÒÈ[ -‡ì*¶½À“9MËéRE–ÎYYh6)U¬ëdµÄ±=åËô‚–ÑR+ÑÚGÞv·«e:[V0› 0„ R$½d»~n^QÕ²Õ¦OhßQ*œl«Û 6žcÞm•£¨r@Yz»¥kLÔùA2ÐÄ´§ó€Ü¹PjžP!Öœ,¦"s2I“öËZ¾¹~ÌMRÑWWsfœ+¥bëÇ’eÈ)å°þ#‹i!L1²ª9(ÍÌ hͱS*<¯%‘ÈÞV*0U“5Ó†®ÆþÉìõv$\?j¦‚þQìþ8ZTuÊ->€[tÅ‘`¼fd -¹Ö-ô#ßBѸ ³zåÁ’sÇû‘Êf*  5qo˜Ppc$š8Zi6ôÍ”JÛÌÞIëâ®*×µ¦ŒÄTD=üûî—ܤcÏîÌ<Þsã0Á…Ëúõ?þÂn~díRðzìx‹”$ˆ«b˜‘7r{¢†ÙóR@#ÇŽ'О dËÑKe•í.ÙÃg×%Áí©¡ÿŒ0‘°"€­<èš..%ÞkÒ i˜.V7ý>&ÐF-V›¯Þ»o¯V¿ZúJ)O¤ÁÒãÄ{÷åj)¼ÏŸý«ÛŠçô‚WM¡bT˜DâÌ!–É„ 5á’í÷ÛbµEU^Të6oý¦­ól‡Ç¹x/†ËM ¹ðµ +"Ñây37”×.eì=,eâU<°[ú«j€Ë’æ8ðýŒ¦öÐÚæ 6a¦#™ý!×øHäG¿¹Ë·Û¥/#iF3ûªi›u]ì[ØÚÄÆS +¨DzmþضվAnŸ/Ý”¶Æ©‹ý6+JÐeŸØñEÐVw€€Ôpê¬i¹Õ"^ˆ\…¡Å(Û18Øi˜²Ìvvu Û»(^±‘1p*wš–àŸM¥ k–ô?¡Ð[`Ö³š¥h+fÅ×Yç^Uòì¹ o²(Ïy0#9%/¡½p~Ë+³¦Û¡÷e(ƒ§0$Ç9Ž ,æЄ+¦óã5ŸƒÙj¡@Z~(`²D6í/ X)|aà®hXMGR¤ŸD–zmÁ[úR¥^áðd½„ÿ6ù†WÞ,I_;žGÒ批e<‡SÅíÝ–?4Uàv·zu“gí朹T7lçVs–tÁÂ;‡“‰à„+1\à4ç4dÿfýË@ ¹©‚X±ýƒ+4°W­…°nÛPQì}ÊŠ:ßåeÛœKÇóRu$$”;%+”uÔÎB(-#ð+|ØÞetOØ3Þ®bã­IÅw8wM7@÷Üð$Œð6ØÕ6­.xÎëiï{wdè}¨¬eZe¾§Vý6Ñ( ÚÅwÎœÈ(AÕN(Á¶Ø-j™Ù–µwpsî;ÃvU¢_ÄÖ¾vzêor´ÕNoÝvwn ÎAöÈïßµH:˜_g%7öÛé(m[ØÁØP»ì +mñÝ"B›tvX ÍöÜGÈ>ØjVVÃÅ°ËÇB€Gqä]¶8-<ºÍCãzl¢-â®B²NÜc‡Ë;[¼댙¥àà“mœ ‚aìȽ¦Ú »lËc=ö—úù£…Ð~ŒCƒ‡ w‰VžD=x*‰ ^DlÃsèÊð<8õPîè˜"ãIÖR:\µ‘s»ïT´vx¯cÏ.ÉÁ|tH<¼…¢D¬æ0´à¹«&âCO`P Œ±v†H!¡pQKC $ÔàÇîÈByTâ3O qü Üd†c&Dy°lHkcM& 6ë‚y„$`ë^QN$ +’¡4–6þ¡?Ú§}>(# i¤%Ì¡‰,EAÞ¥¥ÁB{®«ò~2/ˆÙqcs§»¼ä"Šß‡sju1{ì1²Í ší“]W6ŦOµÞ}Ái²º<÷ÞÎïj%A&ñr†ª „Š4šÌPATKÌÉmhQÛpËRwñL€"¦1}Ĥ†a,¢$‡Ø³›Yûãó1•Œi©q«Å…B¦Šim»? \\îôâ· +\Œdä}ýÁÆÕ’Q©Ž!ÇÒAœº°fo’‡ÍKÈm±­ö]©Ä;Çö;zƒÐó$íÝд +Ê´GÛœ3Á «š;dôÆæ—¡“¨-ó¦Å0¡# ïli ýؼi«ÜRŠHÒ³¼ŽM´$Šµ4íÆߦ.÷Ìì–äv÷då¡ C£ÆƒójE›3!ç´¼E¨ÀªÒžyuh§¸ë@EÊRQ´ ðLù3hîªÃvc“Tš +©ûè™Ð{Ecýc»?Æë.†"þð%Ü—?|÷Äjx +ÔeO›Q¤í½¸QÞßÕ5o}hrË«-ÚmÎ"¬«}>‡«='Et&·ùðL_Ç×üíÈž 1Õ`- +ðH”žÌ÷? êÒÐcÛ°DÈýª.JL:Ÿ3MEÉtž©¥9b:6È4 ’01u)áþíà +ZñÛåþFXü)¨PjŒóù «COˆáo‰oRôÌÝnôꀎû¶.…à2ðž_{3ºaƒ2 û¢H`S Ð΢¼å~–”Qœ¸T™Â•DbþRD§/աĨÏƳü˜äˆÝø:!ÞÊDŒØuþ"_‰G本.Ö<ö7&æ׶ŒóÑc¯s›jt#´Æ-èÒJÁ ¯…Öf‰yý)lãˆJóØöD3ØZ¢WÌ,Sg0Ï™Ž–¡!ìynÚºÓ¯´ x€Ñ„UOma¥Ô¬(3û6ö½pSûeÖ]”­$¡6Ãæ×NYO¡ +˜(¡^@µ'šAÕ½Õ9¦ªÏ˜N¢:àù¿¡ÊJì³»êñêbäõa3el-r²Žf1¦y `3;¼Æ'áê¾dä÷ˆÇö÷æ]÷—î]û]¨DDQý€tJpÐQ½€eO4¦%z šsL;8Ÿ1ÄsÀs5åí¨"Õ:ggó†)Dj¥å<¢Ó88¢Wà0ËÔáðœéF&#¦ºÿÚÛª#nû†K¶JD£<€GÆY9'‚vŠ*×6aqûí +r~ X:>üÄ8YâüÑ·Yx‰0eû^k×mWÚÛг:ãÎÍ°<$0g¨«?’'²fxÑèT¾²Ë„*Ø®\ŒeJ?J"ï²d–»Š«5vf ½¼¡I•˜,þÞw%Š'{BBŽ˜g =g»DŸÚ¶8ÒE +I…øðkƹí3Tà=çAµ¥[wNrߺð: ªÇÀPþX4­õÁÒ]L_W9.p æ°Ï¨Ø˳ òTö%ÛàøݽòÁ5Q‹ê!X {¦ù:{¼‹þ•y‘Æ ¿û=éçþ ŒðâB_GŽe®,௕š/M‹’?eF¥imKÓWuÞÊt-Ú-Ÿ•£§9]†ôÒð#á-eh‹À™íg…-–A$÷®¨>Ó´Ÿ]A™Ô•-ŒIÿq‡qh¬m©°Æ"#R¸"¿©àñÐÚEK6hv…Z\ò¥Ddž:Õ›ºRë6/ó:k]­³¦u¯‘ y%2k+7y_éP\//ýŽþÂÆ–Ž;a¢ý€3®ožú™xr2å€?>çÿõcl§GZÁC2V##e …“q•aò\^÷£í‘ÀÿgCªendstream +endobj +5223 0 obj << /Type /Page -/Contents 2171 0 R -/Resources 2169 0 R +/Contents 5224 0 R +/Resources 5222 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2162 0 R +/Parent 5208 0 R >> endobj -2172 0 obj << -/D [2170 0 R /XYZ 85.039 786.531 null] +5225 0 obj << +/D [5223 0 R /XYZ 85.039 781.388 null] >> endobj -2173 0 obj << -/D [2170 0 R /XYZ 85.039 766.606 null] ->> endobj -86 0 obj << -/D [2170 0 R /XYZ 85.039 766.606 null] ->> endobj -2174 0 obj << -/D [2170 0 R /XYZ 85.039 672.773 null] ->> endobj -90 0 obj << -/D [2170 0 R /XYZ 85.039 454.238 null] +1430 0 obj << +/D [5223 0 R /XYZ 85.039 560.955 null] >> endobj -2175 0 obj << -/D [2170 0 R /XYZ 85.039 425.503 null] +5226 0 obj << +/D [5223 0 R /XYZ 85.039 540.364 null] >> endobj -94 0 obj << -/D [2170 0 R /XYZ 85.039 111.192 null] +1434 0 obj << +/D [5223 0 R /XYZ 85.039 111.433 null] >> endobj -2176 0 obj << -/D [2170 0 R /XYZ 85.039 82.457 null] +5227 0 obj << +/D [5223 0 R /XYZ 85.039 95.089 null] >> endobj -2169 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F41 2104 0 R /F56 1642 0 R /F65 2099 0 R >> +5222 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R >> +/XObject << /Im4 4878 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2179 0 obj << -/Length 3161 +5232 0 obj << +/Length 1694 /Filter /FlateDecode >> stream -xÚµÙrã6òÝ_áš—¥ªF’í›Çžl’š±½±²©­$IY\S¤†¤ìÑßo_ )™rö¨”ˆ£t7ú†üK~þeºžZ\ÆIä†Ê¿L·Þå#ÌüíÂïR»^âÔÇåŇï¢àÒ÷Ü…·¸\® d™ýê\u¿üôÓl®”r”;›ÇqâÜÞÍ|ç˧ÛëÏW³D9ËŸúÄwßñ÷æa‘ïûÎ?>A›ÖkgùÏ{ì=Ì~_þxñi9Âd®])Dåëů¿{—`ûã…çªErùmÏõ‹Ëí…•j%ýòâáâïý.<§/yÕÁsDnCCyn’èžr?œ ü¥(ËÙ°rV³y89v´“Õ@ÐYC³©·-s왆§ºél‹èf(ƒm$QF«® ƒXÞ†MMúĽ¼’³Š®Íñæ×ÜôpähÃ-…^²b>&Rbª›œ¬h»¦XJD@Æ6'+h ²wà@lð -:¦‹p}# \ ÷Lw m`‹õŠV ö»ÑЌΣ!=К-lËüÝÕ€Ïr†ª 3ˆ@˨¦ˆ¨a;À{0"¯ÅàóÍ,«{ YözFÑÈa”W9W¸å=Š&êRƒ.šQûa2êÎ_Zî÷¥©òî=oT¯yô–XÔýb„™4ysÄZ„¨Q©<ûÀœóÙ*ïR\ÿœà -u÷¥µ‡¦¥kðÀ\­é‚…ÓÕòÝäÜ`ud͵öÇí÷{V0Z[¥u…f÷Ø,~0[[^dZ–î=B[CâýkÔ }]Wó³òÙ5dæÊܲÜ@f3n¬kÙöÌClü„¤¢Z“Ù‹ÈöŽLæÇNcÙôh°™hmynÃDs‡H‡oÚ䦓 ed™èn 瘜JQåv ³7„†«šõ6†Žì¬É––b~:òCì¦skš¬×D+Ö¹§Ñ  Q’ŠCÃ`*”@ÜÄú@*€9í*)åbܼsnHŽÐ29Qì\‹Âú¤)¤øÍ9„¼·0 àÜ0x;¤»ëeL‡u 8aš–§vÈ´U)ˆÈrt·C¯B&àh%u ,q@F.&¬™ÀÉk"hÁFzù4öÒp´}i«–1ìÌáXÉ‘SA…1:„ÍØ ´èªtÄJwh{ ™Ê‰\™nߣÞ) œ9hT΋_l ¤Qž1 ­8€ã颷 -5þ¬Èbækîqô5uâù‹L -Ð …ˆÓÍ N¯©¼®ùÖÜÍžS\SÕÒ°»8À‡!.û±>CƒV[O˜Ë­©ú,9࿱H£5æ°Í>H͸  <åÜC“¯DInžg-ï#l S-’àMx:ÌÈ-š‡ô°!f-†çvÄ£ŽÇÉ{þp\Xfxò°í™z$€RLÐ`Ôû ƒ6å¼@àH®„?O½_:˜i:YÈTa³=ˆßk¨T´6Õ¢)hËyÀFl8øºÀó‡Õ™Œ¢Xaze™È.nÉ…*IŠàÛg1såz.VT"™ªÍ˜ A!nQ]&ý}¸haùƒ+Ä Î)•Ç5˜G•¹Ý\âìlH³v4%`´µÙÚE½3¶•›ùëB37D¦nQL¤b*Ô0Ç#ÑIh@ÐXÄyàÈÃÕ^‡"÷§û†³~£‰«×)­ü‚4Uæ±Z¬xEÇòŒTôª¤cqžÎ¬°ÝQÈ\´Òâ .GŒhš"êó <Ò^,®$°‘¢…ÄFŸ вÝ~¤ƒ‚=†ò½°ì¸!¯Ô„‘¸!ë©Ùr1 Ÿ*P½Û™¶}‘ò¦‚¸u%RÃÁ+ríN„’Äó,„¨±,2¯mp-Q]9d±é†OûlÒc!q,¥Ý®¨‚Èd’Êe¸ÁªµžlË9e™™ò—`ª¢Ý•¤8Dòh÷=*(Ì#çÈÙWÅ7?qsqàF^(8Á­FX'-\Äc–ï$Їƒ_2ô>XØleU‘Ð[ÄCîm*˜™Ý)H½“ü·å>I6H=ÇQ¸Zp`ÁœÄ-ƒ»1D‡s_Ç®Öñæghey5änçƒR:dªyÇlW±”êÇi÷ä1ú†H®ihOd#+R*lÐDŸ€AçV ~†+âÖkUo´ÊQ;„·eïØI­ àt ’i¼ÏH9?T¼ª]j¸IU‹ºÉìå¼—îØ°uÕ4˜T±U1{:´Sô -¡’Ñ+štÒ¤|ˆ…Xµ¤xÈ!±J˜~ßùð¹`NãáöÐvR–¡¾!*ÓzÏ{ôÈGº/¢Ç @€ÕÑi ö ¾†Ž$öQr²BÒ­u1/•-L 5y€zÙ}ž‰uTd eaSHåSS åØÖN¦îíŒ7= -+w‘ 9ÁÓ~‡9òbþê…÷߇¿IœŒÂ_GÎGŒµ°Z=ŠT☸‡'‘ -@ö!/vÈÁwôŒR¤ôú€£ý»SÇT€O Oâtcߣc#a ¹W YR w`Óä_÷½Ãb)Á aã'L 6lrÍUÎ2ã-(Ü€1SY%yU„Ÿ‡†3qê+Úÿœ+²k[ËŽ\=€–]b&$²Ê-ù1\ŸÆOOÛܺ56%ØÙPõÑ£»ÀS謲‹l"¡— øeѾYÅv~Ëõ( ¾èRž¶ˆYÃûØsÿ@˜ÿ‡`§Jæegî3 9S€ @¥‘;gn ÷ü_Ž¥ýG9)BZ¶`xm¯¬&™’ˆ+ =h(z¨éhÜÁxŒÊ¬hA`Ó²6™„p(­*À‡œøˆ'Óå@'•‹:ÃýÀ†»¦Ïöj®¥"¦r´á.°ÍåÖkØÈò>™Šäí&IR‘IRž(é‘Lûƒ a›_nã`$ G U?ŸO‚ïò£hKí`î1½¶›å£…ýL+ûÖŸœ`(•lp\f,©d0‘ääÛºëñÀì‰ß;gf8Â7ÃX½‘]Y¥Ì>Ì›ú}óg„*|?Ãå¿ÞEyÎYiúf¿|õúñÏ!£O󗓧óÁÓÁðÊ¡›_&>É` !½œH‘¸<øc),¯'ৰ&ñóÕäfòv0Åk&à]cY±I.lžœ§EÙƒ´(­UY)¬4”—Ç»BP&üÅ*¼‡¨ +Ø°jù—dÛmë,,Qi‚jsÇÛª[þ}ˆtÖ;ž´¨Vn–<«7%[ª½nwïín ¶Ð4ìm`ØÑ~žSoâÙ OoIc +ࢠ+ɽ4ìj^Þ6äºÑý‰—Ä>òXaú…;¿/7QldŠWƒ#6;عiYühÛ”ñG©Ìª+›ö k¿§Ã\‹m‰’ „Ð@Ç*G^z›è"þÞ é£ACÉö†f‘vaM‰ë[‹^£ÚzËèÌ›¶ž< ¬Á¬š,,x‡˜\ˆ-ùÍkQÞà—*ÉœSºá÷7×kž\Ý\Oé–¦~sù½»€¡•áìÉ3™4|Bþö¾˜ÅÏ_ –Íïýõ®‹c°¢¦´•|+#ÍYÎmÈ·3d±eiÅÀa±ú†®ˆ…‡öØÜkP›¾~êm“FmpúHzP0 +ÆdÜDÿ VÕ"²,ã5á‰5Ýèå6²0n»vÑ ®ŒŒWŸLEžfÞØGiåš(†zâp‹ŽÑ›$PïFÝrAø~@‡]¸,¿V 2·\C%]&z€9Z Lo¬·]Uo8_¨A€ÁÁ¦öTÍeÇÒrÙü¼oKغ,—¼Š§±ñšý…áxF]¡ín /[.>ˆ‚êP…#˜.°ƒkÙ$ö%c¡š`Œ@ÂñpÈ*' ðûjV|ÇÉ¢X­Jo{ʶmWo[¸PÍ´vj>Ш¯0ZJ¼Ö#†Í÷m('w,‚DD¶ZA%8ÉÛ‡o°uÓ¡o¸TqÁ¦‘8EõX7kj*˜.–1تTÒ<ÐÀŒbÀÞ•ä2!ê$K`B"‡VŒØ”¤* §x2zRS»#¨Õkï]åרôò}é‘þ-ÿö¥GèÖʤGYùe9&"s鯫ñëf)»mÓã•I ûjSW'¼‰ZÛƒêq\†‚d¬•39XÙ{ˆ8©…/·KÿÒµ|‡}¯@Ø]`ÐyxÚt +/lÇ¿÷–kjûK‡Ô¹T|õ÷=ô¸Ø‘°@±£¨Æ©J±"(Ó9XȬF‚5îûÌ­d¹ì‹ ñ˜èÞjÍúü†ƒ½¾Jñ”ê n:;§@™Ë<JN(PrF°|€Gé1ö”F$ +ëÁâEêµb£µp–(Rð%Ø ÙÃ,spP¦IbžšÛ~ùrºvÁ“ ÞžsR-µÐy6/x9ráA4)B%ËE–ÙeÞþiæT®…¢¦L–Ó±¸Îâë÷Ä›È {ÔN,£Ϫ»Q†œ˜±549àúSw545êí>û¬ræÜÑ)'vð¬YÓ£ð íéºcøñóC¼FµCBßc8ÙÚSüè¸þøM: Ç%´üiö‡¸› +h·ÀÀÑó‘ȸð¬~ï ­dØY~öI¤  «r«aà‹.^JC¶ôŒœ’ —mdþ‹-P9~PÆÎA æ§ìUø“ìxþ|øÊzì;Å:Kú÷ »´ŸVÀ¸çç8SL<@º¨©C}%îÒ?^ÝØûuª¬ú¯h.ï/#çA[Ðæz·L&H>ž:: }'?|¦ø23nyBeP KÌ”jTêóˆrb¥~ù×ÞÞÎ*O)áššÎk0Ñ“U"PY­>-¿Õ}†7‰È7Þ¼-<«Zõ¾à5héNýíÿNqæð¿47 endstream +endobj +5231 0 obj << /Type /Page -/Contents 2179 0 R -/Resources 2177 0 R +/Contents 5232 0 R +/Resources 5230 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2162 0 R +/Parent 5208 0 R +>> endobj +5228 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 412 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5238 0 R] +/Length 17146 +/Filter /FlateDecode +>> +stream +xÚí]‰b«¸eß1`vðÿ9–7 Mæ¦mÚ@#uÞ»-¶Ž$ÛÒ²  |V¬¾ôJ!¹í`{ ¼¯t„ÒY1Cl”÷•lÖX ÄÇö@y_‰lÛ®ìœÎyå½±Ðð_:SäÄb±€X@Aù€ôP €‚¼€òîX Y”eY6Ê»cAM/̈”÷Æ‚žj›©‰X@yc±zoòˆ7M9®GBycIƒ X¼y.– Zl”7†…[e¼€‚‚‚X@AA,   ^+F\œGÄÂVÒîD}g¿É»ùDb!¶’˜'ê»±ð«X°òóˆ Ž‡êM'†þ õ‰tã_ ÁB3Ïæ:Ï#gÁ‚y +›Áa!>œ§ðÂåg#^€bWÇ»§OÁB3Ó±€X¸ƒ…ò/ã“gñbá ±0ü),<‹ È È ¢IÐFB^@^@^@^@^Ø5‰‹X@^@^À8Ò²“Y}}xMþ/¼9œyö¾z­ÕÈ è/ü,Ð/cÁ¢sŒ¼ð‡xáÝm¤ ‹¾º`3ûÐÀÈ È ïé;wçÅòÂÍ&yó8RËDÿ“&Ø®0ÖGDœ¨¯iAóã¥m‘þ +/¼»4”SÍþ =Ïb“µªçr4}ã¦6³!‰L05äM-ô>­›~\|Ï„E¾ž¼ðgx}gð/¬±J¹Ø–ƒMÎ@þA1\8dög¤ÓL¸‚Kˆ¼€þÂßÂkÏ™Ø]4Iõ†žÍÌñÙ©µÇ‚7Ód1¢ž=S%È …(b¡¼0— Ö-ÓðJ`a6¹ýÍóÔ^ñ$—œÔwF^@^ø_^–¿/&ß "¬Ð–œö¼XÈ0Ž„q¤¿É ¥ðŒ:O¢§@œ’q¦¸öNSE^À8Òÿñ‚\–4®Ï¾>óËå/äŒ#ýa^°5µÀ"d‘þ/„Ueï~jyý…×ò‚}Í + 7—®ãHÏâ…âCN‡® qúïÖÔ@^À8Ò§xÁ^m$OØHÂa#=‡¢™rðÿYx5£ów±€¼ðû¼ Áæ¯`lˆ…{¼Ð¯ž/‹ÁØaäæ3ãHƒÅ%b—ŠßÂñW”óŒ¼p€8R×ç›a˱ûì†Påò«êâ²™| +&¢šùu95fSÚ¶òÜ=nóƒÄ ïñ¶2Å«Tû Ï[³Íž£I;µÿg×#/üF©ß}©KEàqgóÒJ£ÁRé—k1E•û2žçêX¸Ç òM¡^<ªÛFe*¬f=×V? þü ,Ÿ|¨¨ Ò¹–zØÔÕ-ãÆ©\¢ÏG^GÊw…¯¬ ´ÕË:U±|%[3ƒãÄ+KÈ97ñ°pÏ_˜iÌl:ß”¯ÌT°aMžTð²ð +!˜5Nð$,0^Ф3í3ñÕY]»êp]ŒV̨Š³ô;oýã¼`oÆF2uüͲ9æu­V’_iº—ø {,0^ð$z'±\xµ\~Þˆ Ðtë½Ô)¨ÚTyx^€UýÄþ?Oåð3Ó¦¡ì ˆ#%—J=‰ +I¢f(¿TRZBËöò³ñ;oü"f¥#ÙëÇ›Xø|ÁWÅ‘îòB¾ ªå ”Ç P§dóäÁ‚€f§yÁX s/t’ÄRG]‘•¼qba#-1|?@¦ªšTx•µ¹qšd‰&Ö€“gGç…2‹˜±ÝH g¼@ëŒËáX(,ˆS…8_iºcñªÖ2*–h6SÙ—é6ˆÈ9 eÁ ›X®4TÓÐ UÉ)ò*[›9éìܾŒ‹áZü}Z?Š3çÙ¼ÀÌ5 ŸÛˆŠÕ0ˆ3Ä…TòÃü{3HŒìÍ€óUÞÀXS5úTß­7ûª8Ò¼çÔò—^4ÜIÞx,üÏ`Óú¢gðB0éñI)”_Ш¦?Ci‹xs/Û¯¯Q}Ç$Žô/À¸Å±Þ©ŒÊ£ç;i‹X¸Ç ¾¤Má|Ô̺®”ßr:^àŽN´ç¡Ÿõs°p´8ÒÊ £úÒP„[ú;ïzp,ñB:ŸŒüÇN:çŠYÏw< ¿Ë mÉUqÏ ` ò7>/| ^l×â§îç¼Àš$¢1§”÷#uOˆ…Wñ‚­ÂÓrÒË“ àOñÓX¸Öcø?7²M¿÷õ¯ç£QËÔþÞz¤k^¨T: ÐMj6°‚Ⱦlk>='þËž‰…–=;áø$½œÔNçßÃÂËËxÁ ”høÓ¢·ÌžÓ_Øïw¾Ü©’Ý¢t#§ëtŠÜ»fkßç°PwIü~ ö¿{ú3¼Ð /|Vª;XXw<—þjjœ“•ÔH>ÀÛdÚ¯3vL; ¬y³ÁôcX®*Gs4Œ6õ/ÌzJ öyë[®°¤ËÝäfHнX¾@⛳é‰øÝu-9u´´û6ä…›™æ«7(ÁJñúÂÑ-W˜æ÷tólÿyO`S>!7Îø`dÚ i ¾xôMb9ôòÂK°€y¶ïÚH¾>„ia LÛÈ¥’6ÓyZæM ³žt.-Çj`Ð'…׃ {ìm'Â^$cq,f#¹¡Ï'—YB©¼ðwxáOæÙV¾s¯â[Ü\k ºHG‹ÏB*fsùÙÝΗëÅBJé;·ÏŸ'¶,‰©%óa /ü ^  ŒLC Ï¶^êø¶Þq¼¤6Qyÿdò`SmM÷)¾³¼yyá XÈ6Ó%Ÿì¶õº‹ªtžŠ¸Â?€2æ"šT2Q1Õ²ÿýo£#/œÛ_pÿ.âM ØÜ8²õ$\¨¿°TûîÂuö|ô³¸od:+5×rG»,œócyá=âH+ì ë \¬G,½·ßSûÅ‚¬!tS÷\ϵub²ˆ6Q‚¼€q¤Sa¡Ú =V¼Ði^È5/ì°«Æ`WVÅ{^`¿u¹Ì©j / ¿p&,Ô{)»â…ü&/À~3v!—|wÅ \‹\ÛœolãC^À8ÒÁ}çjã;[ñB(+,zù­ä…4q"‚hÍa‡¼€¼p +,lêL­1ÕñÂ&øä‰_%/8ú€5q0Žt",@ +A i/~{€2“%’Óq­PýDgt„½ÉÌ„jÇ9é\ò»őx&‰ÜO†µ7ùàÒ7 ÁhÀš kbW÷Y›‘ –¨‡À³·œtmò»őD”š!Û)6X˜ïÅTkˆ"M ¬Jb6–ÌOdÁ³]¾¥‡Ãq=ú gÁÂâ÷¢ÎT%p¦çrÓQHWI.Æ`‡ /=Å7›ô&#| ó<’JL;˜¢jÕp^, /¼M)MFmÈn”Y*$šŽIª“Ï‚Dn;bW‰Cc˜E—§·†pRà_¢Ì—¶c’œt/òÂÛð«yãHˆäŒ#!þ/ Ð_@^@^Ø4 ÚHÈ È È È È »&Á8òòÆ‘¶M‚X@, / /üÒãK;ä…›¼p‚Î;héA(òÂ8Rs†Îƒd¿çÀÂyä!,´Ç—'òÂi±ðëX ä2? #bá©bÄÅydø7N#OÀBÚ§ëbkAùM9È÷±€‚rWë<ˆ”G±€‚‚X@AA,   PP ((ˆÄ + +b±€‚‚X@AA,   PP ((ˆÄ + +b±€‚‚X@AA, ïKÖžM_ööÙ|g»ïû +žöež½'Ö=ãGÂú/÷QŸ¿#P½BþÛÉ$eÜ1'K›¾ë:Uè6:hSTço „ NK¯Ž…ß“#î_øÅ0Ú`á¼Ëº:Äbyy±€¼€¼€X@^@^@, / /  È È  †o,­ŸeÖ¨TÎw–Åé2¦…ÿ’uá3fGçQ•wÚ³ñ‚ãZ¢‰ÆK]Å—? ‰kŸ¼$]ÿ¼XZ%=¬iÄû6§åR°û½›øŠ2ïÛ³æmg>¸*Í2óÓñB?S®5ÃÄ7·ÿ^`v`5AmΊcž{¦c²ƒrOÈ\ÕÐ¥ö’Úг&,#ùnJ›p~p…¦OæütþB9σìì™ÒüðBö,¹9/:è¾"X|6¤yœï繜͸«†¥šg³K—”±D3~ï6Ö£X°è|>^(g +XÈL£ Iþ/¼ØÐ/Ö“³×àÄà˜8ã_èlê¤Ë·±ðØjåžzÁ 3î­'^pÌ3caÒ6SxHpÈÈ€p$ÍL¥i4ÜWЇ$Mª4Nqjø¡3ˆßƒ!‘G— ’%pÙ­‚$=%/8dîÿPéÝxѺÐüe)Ä«7|—½êÙ‘ûéˬЀÏa6Ü!±¸§N*Î=Ædš–ÐôÒ4/œHÍÛ»=^Ë oËØÅq¶ ˆY_á/ aDçÉ +o‡ÁÎÊ É%Ž#:Ã0a¯ÇÝ°¡ö7k‚Á‚hã©yac’D C=y×\lá+Òµ_hU¾¥ ´>V;œ„?ÎØÈä:ÂøhJùYv<^0̹ðþà¶tžÒšïÞl¬xA¼½àïðBañ=y4O„²Ð‹Ë_ÙT„‘ä² "J’“óB±ê°‘˜ï*Ø`³3¤äæ—þÓwI¬š]f¹ ¿!µýÄÏéL`¸I'Ñ@ëÅX‹i”g¹Ãñx@Œ´ˆQfƒ!í9‡QöÀ ßÍKiü^€—# íe*œ>ööÄkØ‹æ|@Õì—ää¼kŸ‚ä.×Ua"ìû¾ä?ìß ùJ«8’¡·~Ç_<ˆÊŽ*Í&#ªêq$T¢g uù.ì À˜3x$uXÆ#ž1 íßá6n9©Œg‰ß<× ê‘C( ¦2Êé'ç…Ô£³p{€å48˜Öz;6è¢ $¾…z­NrBƒÙfS¢›é°q$ÀBÙªˆ›Ã&ÙvL#xÉaœÚþ©8’üŽJô$ËÖYªÌTüÃ_*0œœX+^ˆ¸ñÃÀ!Âãš|%‰"ç›7RX`cªš×•yƒ û/x ¯åÕT"Êéž²ûÎÉ “ Ca³N4 eDSTÚÂf¯~v^¤‹ÌMiò/å/PC{õs°0…²¥ Þ«–1À3!ÎΙ.üt—ä@¼0IEù´d®']Úé¯ò‚–Êãˆáê+v|]‚É Ôçä¼iWØÖЯW_Z4E¤çܾ‡îò^7¬ŽdK,À8?Ô:/(Âb×,m)m<ájm°0T6He§ç© £À‚µv“ÇëµW円Z6€s&,0ï€u±oø£qà°6råaþ„åH,Psé:Àò'å›(,(¸¸âÕ‘ƒÉ¬å¶ÃÆ ¾zöðô¼ U?aXhy'ªrs> c + T^ЉÁ²a!hfb±2¯qä§{¬ƒ!DOÈ÷5PbÌÙõYã¶Ê›õ$±TRŒò¼ƒ• ÉÀLo`†§ç…»X! +˜0ÿ¡]GUÍ  ݉°Àœ¾i >$âݬ¹ =¾b;w–ga¡%«¥A 2òÓÈœ¥5tä8R¹ŠÂF²ÖNÞ`!p-ñ3þ=^PA@ è‘õf £‚+/òý­äDX°øÃ¥açʧn¯ª'—Ì +žt'[ÆÔÐbËÄš¼…Ø°)|’#Ç‘dTE(Xv‘öÿhé”ï̧¡ZOs,Ñ=w©þ@c?ˆº\ª‘\âÁWî{fb†*6âÓ»óÚ/çÅ9kVD¿GºÂU1Up– î]ækæÜq¤ržß¹³/IÇ8³eÄ`ZAÀÔe.lo>Ør*T.º½·ðõóÎS¢Ô:àS1BÝ‚r~^˜sα`0où]\zöyçÔü~°ôALW<ðN&øÓK„BUªåù_þ’Œ/NhSIà"æ¡ãò'~^àE<˱rÅîXœ%Ä¿ÏÍ Ì)+ïsGf9ÝfËÒÜ[Õ2UÎX¸í2¼œLS–ӱŒŠ¿ÍRDþ¯=O=¿P¾扨C¬µ ø†`f4bã9±ÀPÿÚÍ7³8 ¥ƒÛ‘%–°¾£4$q8±2×8$/xl½ ¥Î„àó¿='ã –§¡Õâ—Mš ^È –®æºƒœº!foµ&/Æ>-ω…Ä÷Çå<òr^ðXg_ +ëÁ¼)!?€´ÎE7Á +ü”±æ?u s…= /æ…ïpðÀBxm¼F“š 51· Š¾î/ý^ØJ¡=Šü‘Û!þ,/ÀQì–ˆH"þ/\̓¼6),g#Ö‚Xx^0Úãò?Á „^'|sy’ÑyX:Ò®/sÛZº"kaÇZ!ñ´gÀ y!œïèò_à…Ô0>¼B긑 –Ÿ 6Ÿ©:7)_$g}OP4ë/¼ ß•ƒaÁá9ä…ca!´ÎŠ•!5†mýà,WõÂÞìTE¸xöD¸8-o@V¸‰yD&V5žùH£ýøRÙÃñB`?Í¿È AEí“b!ðLXlIÞk±‰lïÁ†iC“@J\È|aö}£fÔ 2W=,ÑøV›>/ žjN}&ÇÿÑxÁi>¡n‘ÜOæ;Ú ˜f¦Oýâó ÛL±Ó\ç ൠ\Õ’Vò¡} +ØÈt Zs6Áé6šç¶q7Ÿ—Š5Á{ò‰± Ê,¶B«djXXk5@ºŸ…gKR %'±‡²ËŠäâ¾ÚöùŸ8EÑÇ»ìh¼} ‘¬Oî9¬5ÙD¹èJ<Ž\r­Z‹ôy¹Î. i¹£Vyô4,Œ$ªtBÚ2º¢ˆþ'ÍÑx!zo^ý˜už¿v^ý#С°ÉºrËÅ8›É£Ó:Ëq†h­|;–Äϼº<™Xã8VÜ9§{^p²ž!Y&r¬¹yéõ…ñN¼ ÒRsmÙy—Ó`AW°¹Žƒ%äˆG YP¯,=öS6<‡t°¦yI<<  ®ÕàÙûÀ¹§ñ)x!ڄ߬Fþ§ïà ÖÌ;ÆÏAwÞÿ:GÂsDÎ?çóQÉl‘C5Û¥ÀæÙ°¶9ìQr0~æ¾ a4k'F°¬ïš0]¨“¬‰ …æT:*ü–CÆÍ>}^0ª'€üyscµK */r@øx/½‡„ˆ: Ì{è£B T߉÷eÃœÞK×òí8R¤Uòè'à…¬XÒ–gN‚7é…Üw&/Ów®Î…Á©B=‡Ç‚¥B¥"O£ô,Y!­þ€é^UIÇ$Ü0˲jO‹# íIK=ä·å=b8jIª€¦$ÉûÄ‘TLÕ[ǨþÿˆáHXPU¡$¤÷ Žë –•¶Á]çIxËncJØO~É Å½]á‘Ÿ)ŽÄKUÈÞ‡$ŒMúÅìÿôãHX`#®/ŸÉâ¡!î=ä2%¢KEåRÎP}­8mG¾§I™ëêÍÄ!”¹Hl!õaê/ÜÅ{öfÙḕò&¼R_Ô(IbÙy®Ë£ðÛðl‰ÅBŒE„Mù æ›¢“;ݜƬJVÖósSíI^ØTƒæœX—ç.¶Ù!,P cò@¸[ý¼`mR£3‚Ÿ ^—Ç‘¿!œeUNiXwbP£•ÛUTןÕÅ6÷“"ô­œ>9qö/,¦^Û],¸›æCäÍUÝ{`g 9A]žLê¸(¥¡7³õºŠ`L·aræÄjG0)ùqÈ4>õ™:m#éz@¼üQàJ9LÏ»X°ö¼Ð30Kñ߃Bº.Ëá X²ó†Ãb¡k&á4€ n&nŒ•I¤kl•&¥f/Ô=ÈÍõÉÛÌ3 %M<Ÿ€…ðÔ´JŪ3Å‘ü¯ÓñŒ£ƒ¤}^€àrëŠùvΟ!?Ò8è€~â8÷ZŽo<=qL&×ü­¨ h)Ž8VmfßÕÀ¿<¿°R¡œÆåÔXx¡\dó°MaR@E†ôL¼ªPhÏ‘wÁ¿ˆ]xÌQ׈…¯ l™Èc‡·)|^ò…ÞqIŽÆ _ÐÞ‚,& ¡æP¾¼/@‚¡ +f¢¶÷?»> ÿ+_ÕÆ†× ç ½ 3ç½±ÿh¼h 0IÍž¼ºÚœï¯@ø‹¼pÕy¼^O¶ ¾*~ÃPps$÷«IÚIªÂR« ¢7,oÄ ‹?±Îãkh²æ‡XxD£.¹ãºþÿì9\Œ¡šš†Û~nbö]ûÕ_Ì 38²óÚtbá©rÀüH­îýÀ0‚ 0?bá‰XÀüHˆ”óæ!P ;Iƒg™¸È È gÆBOL Z7’’uÖ'–‹êiÜ¡³ó2¯¢Ò@Qt/>¼ È ˆ…‚/•Ⱥ5ŸšïÂïäj©4V UIõÏn‰ïmÖkãèuX@^x{,\ÄVH'$—ƒF?–×5é庀4ç2ù”Ö¿v!´½Üás-Î4gÈ È ¯Â‚OÄ ™*ŸI^ò«½"ÿ7Àg’[fZC'&óº+ïŽT5ùMÞ)_W¶y±x³—Êï*¶_üÐÎã~ž¹{l4 VÒü¿VµApÓ-€ÃÆë°€¼ðæXˆåP ©¾ÖU€áf+Øÿ ‘醆YdæòåtŒ¢úåuX@^xo,8*õ„³Ë¾ã«ô ÁÅÎsÛZ-^ZGäö:ÈÞÔeÃ>]l¡‘ÞƘ±«c1Ô·a.i–WÖâgìO 3‹¨r[ØEÎ¥b֕뎯ÂòÂ{c!W^¬µc‚HnR¾Èà']Ý$‹&IÜrgA%ý ¶vQâ‹ÂÝi!®&ÜIš¹‚dŽ {"Ëd0Í%Ot*“œ–âëž»ýy±ð „:#Q¼ý*™Á¥…µóM^ÂÒy‘žùfÞO¼ÕbCЈ^rŠ é´Øèp2mØ;DgwçVT@ô<š¨R’šÜƒqEàÉÞ%²{Ž0Ï'veÙB[U¢§;:/¤Yá,ŽÝ—•»6qÕ—ù‡=”Ò. +£f Щ@fê²öècçéXš™¤Ú¸'&H3õ±3·Y;™iˆ—kžTˆÕ¾žTK]à®ó× ­!yc« 3¨Óf¬¤Ò †˜48ž' ‚Ì{§ ¸ùPXwØHnú~¹Çya sœíJb[2¬GëöxõIÕ‰erGCU£ÈžŒ•X¼Ýõ¨hoÐJs2ÞS(í|òaš:¯l9¸vo¤›Ï®s·*cÌ?ƒ¢Ué`Ah’3‰¶boÕ³?›îç¸È {DÖCv¥âxã¦és(_¿/$dfƒVcWL? …YQ£(2B}¹rŽ¯ (ws#ù{4ù'ª\m[äy°í¨JÕ_}a®W8¢!7QÎè?9ã¼Æ‚¨ó0ðWdø•™Uú=“˜iʆ‡QÆñX›Fr¼!Î{ðÓÐTÔ‡•B쟂ýÓBeCç¹XpuŽwöå³_ój|¡P:Ž@Í)LÀ™#ŸœæVXþ뛊ˆ”§%ÎB*z•ÝGÆq= C¤ÌüT×Ï`ÁÚx7`Êiî½û|L^ÝË ;ÖI#ê}1àÿ>/˜*ÞÒŠê<ò`cJÜçb!ÓÚÍWmxœÖ¦4[a2Á_•·õ¶C*ëAfö³cjYvIƸ~uRFñž–~Œr /= æ¨=¯:0 ?½ÙîÇã5ž€c†Ù#ƒ?¾ƒ¿0®ñ‘{Ÿ5€°«G|²Th›¾ºÎŒ5k@&O ÒÄ+pT\m+5²×ÂEXÔ0g¡­*‹« E՗ɇ¡®Ê¨VNWÄÿ,,ô­V-FM>áA$;L—£Ç‘بâɧ„Ò -´)í£ñ…¿Ë æÆwjyA/º„ú›Xˆ”Ãx7£&WNc®J­ªª‚ö:<îc¨3ç\üTŒuÏ›ï˜AkÕNYã*s‡lÁ\Íô'Âj¡V˜bV#—TÙÃñyA=;LŠŽ`L½â:oÖßå…ríG’ò k€)¾‘8ìû6R¦ZýƘ̔Ԍü°÷3^¼çúþEf¹eæÏæsʤ‹<~îíðÇÎC?2Å#æú±ÀJ5S†úÈÊJ™=™ ØÔ.¬çcA9äÜX•€Ã âHöªàn¹ˆ0R/|^P–;ø¤#/ç!‹ºOÆ‚¥^)Ün?X½`‘‘–– +ëìBÔ2Y¶5wRUtgSžŒ~nÕòEªæÚŽŽˆÇúÞ6O¨À|ý|,Èš‰e¥0c7WÕ¤ÏÀ Ópا  ^ ¼WÀ>Ùw6dñef7˜·”°½xJéèà¨a7ìñDjÏò|J‡Ã¨B(!ÍZsÈù¹|¤J}ƒÜìѹKPA5žH%<-Ùåáó± |g¾b$uBÉOºVù8,/(7,ÔePÙ0bú÷à…fã/è1:„¥Ís±0þ{Ùà;{Ó,ñýµÕÇMšÏvCÈW~ìû÷&’e=ÁÑw6>ìhüÈ\›ÄŸ; õP“κÇæ…c¾p,ÉjKCƒoÁ ê5ye’äbËpDaä'b¡ío™F¿"Ñ/­îâsm‰¤s÷Sš°($=:/Hx¦<„géu¼Õ‹gþ8/¨ ^&DÅ6˜ÍM’§bi$}Í.²Í4ôÏcan\À\jK"ßq2²_tÐyg11Xó +†0sž©‘$a&œ + +þRÛ(lt÷ã Œk_3²·¢Á/a@‹‚_¬þ·>Ž¡ß.*eɲH”è‰zzµÀåóÂL«.ƒ¶æç¾è¢œ~,Wõ],´Þ,zhÈÛ(?Š…Éï! Ú$/(x>3Útérx^h&¹ˆ^OjÊÜ„ûGýÃþB/_XôžŽWÒhy2ØHÓ¤¯èf¿!ñòKXh‚Ÿ¸ÎêÕ§†Õ¹ÆÇ1èˆq¤1nib¥èVߘìoûêéÿð¼s5ÛETÎòt,Œ®õ’ýÅé8¦¿ˆ…ùøx¼à¥Ëhì¢kéÀ—:.o & ]ûHœ›áF¬¿ðL,x=Ò?äï¯Gz(ƒXøã¼ðˆüi^@, / / /<×11iyV^`X˜óæ.wç{b!0~Ào ÇhÄÂÑxaìû­y!ÈÍü¯`!áÊíT}÷ÈÙéƒ>ëë;Ûþj~¤4þ\‘ÈãÑ¥Gý=žŸÁ=m®0à…ñw±­ òGkI½ÂRÏånÿþÑ·yÉ$¸EûÖ+Uÿ= +΂DÝ/Ý/­]Ý˶~©l9DtóGM¥`º¾ßÌ’þú™ÊÃuSõi_4üáQíŽÄWM9çÁÂxM ?ìÒv×Ð^ß!ý%ZâÒ4=iA[U<¶EcV -~5™fïê€eêæžiN67Ö‚Âf¾h_uìQU ª$c_Õäj±±oÛl 5§bÝüŠB$ 9--ð o»¤Ð?MJ§ÃÑ÷š·òC:¨5² 7 Ëy2 ’T“,ƒb&u<ËbƒÕj-w¢Ê]©mÌ;0dæ\¹•w³½õ…ÄÐœ +2cÂïx œè±¼…ÃÑBÊ“SÕ°Óv¥ÍÜ÷3mh¼@5ÓŽêFm°‚Ô=fÛF~γïCž&àAÎá"‚mëb0ñæ)ŸIWTe,§H.ü€;C£;öƒùó“ ÍáháÊcø!Z(d®oGä{d6 ³bŒÑ!kdížx2*ßË ó¥$o>H"—7}æÙ3|¹' âùs?Tà)ð~Øõ{$”Ô´çÂBÛü&-ìCIÇ …=1ü-@êHG >¹pœ*’^?F¾l«+¨ºU•4Dš1¢o’¶¥aF§Å™¿ÚtmsÀí”åZµˆÚR>¤o‹—§¹ü¤´­$2ÀÊÍÍ!&e®’Kø2NŪ¥JÏjéhUôꉮp/,–)cÿ¥‚M¶7†6á Rö%H³™ŒØ`!Oùã>„y«m$ÄÂba6¹ðÉ.¨az;}öÅ€½ø¹Tó¹¹ÜÇÂ’zŠ¹N¶á¤k^ØM›Ñ^"gƒÊŽˆ™¸±€XøQ,l&¹{{¹…­É‰U‹å4¾g#q +ñ³^,ĘÆû¼ÀüJ˜P¾ªÃWgÜœw¦ýf†™ù h#!žŽ…©i¦fòÊÚ½ÿáÕ +5!,õ|è`6z¾Üåø ÂX¤ŽAÜô¦aL#bþº­Á²Á‘O—Nºo~äÄÂÓý…ëc;¶å[V^8i»é8`º9qÖ­ÇÝŽ©ô¤ï KÊà#ì»ÍX@,< ׶K°›R^Ä<4〰ê­õ OfâÜ4¢â¾Þ\,gÈšy¶vPjÀ‘ØÌ/Àê3X@ ±ðãX€¥Cý•‡ k¢½¥4mf!¶¼`­BŸ«ýÅÌ'1ÇýüŠºG±€ó ˆ…_Á‚OvÄ06B%-ª¬J²X­ž-‚i»òô¹NÈf¯4¶ë‘ÒI/ˆE ±p,ÀM´E”r’«m¶k0vQÒ] &Å´Ú;j›ÙJ±Ÿ†Þ­G +o­ÙF ±ðR,ÀŠ$óf`ÁfW6óä‚ý“5é8R® ±_›\L¥ß0©mvž&ÀN45Ü*ë¦&»ýÜ¡×ÄÈ ˆ…_“Á÷‡@›‡?ô¬áøÆÊIÙÅÆ‚‚X@AA,   PP ((ˆÄ + +b±€‚‚X@AA, P OÃB` Øÿß‘v0Q“gtFÄÂ÷¾¡¦¬-û>Ú¬2 ê¾ïùr¸¬Û‹Ù¿}µítv „¥kiÌ>ÙÊU’Æô… 9ý¾„‡·ÊíéÿUlþ°ìüðá{&q¾¢O5LZxvò_di@,|GB¾³ ¶ÕoÊ +ðEÔ2 ¯Z¸ÌKßl4d„K`w}0]•¨Ù«]ø¨þPóÀ#»äõÿ#NÏ7EŸÑ†î:]ÇÃ8u?……é^¬!ëÖû{+Ë ½xõ„ca›:Þb!ÒXØ4¶5o°@)QÿQ²R3µíUÍ .Ûþ?……|—Màa¹Ðù9Xpˆ|9‡ÎbáÒl&jßî kncÁܪÀŠšŽöËÎzîe¨—bÁÏ«ð±Ö{çØùþÖ™³¯<šýÉA¢òxüŸw\`^3"¾*lLáüÊxš#)¤3ù€vƪ×3¬ÿ5À s÷#Óÿ"º§¼ãE¿£Až¡ÄXê?ãs[ú©š'ï#*ºI—™–ô1,<—>U¤ü,´ÛæxL?Û~¦ÇŸ¨Ýq{ó ?+îúŽù3ˆáM±0i1^0/D¾Ì‹°óX覵­óÙ+V^¸7ô_*f|•U1Ö¹­L'£ÊÝ%±sé”Èó*ã†á¶[,„y.m$ÞLÓÓ›;Ú3õR«b–¡WÕ|8¿õ«6ƒÊ@‘•ÛI›±KšX?™ÇóD}Ôú9û ×1¥«k™åUMpVWßk ²’=±Wh܈Ù3Nâ:h§47ÍÜX¢¼f¯ÝÖùeqKB¦š?‚SAƪ¤wA,|M2å/3^ Éꜱ6õo`Á²uÈ0ç8ú·ÔËÄÙC¿ö’ _Ìü¼Xe6•š–*¼¯\Á+ë#lv¥Ì{‘NfÈyX‘¡ó"Ï)“¾s«ôœÓ5³@Ýêú嬔2ÎT”­gâ–ûÔÌÊ„fšf/’E!ä æê^rGt¥n–º 5IG½”J©ë"Ñ?·Xd÷0n–y¿ÉEtá¬#|Ìpõ _“RUl‚ìsA¬#I6ûÒþ£ïlùT%Géfj<€…ê$xy D.³xµÜ/ÄÁÌèê"Öð"<iñHUÄ“Òtã Úh²‹ +0{ ”ÎMÑÕDF¸Ø‘ÙŒ»Ø”éÄ$¢5¡í‹Â“u!ápÀ]à'¸âaíQcׂ.bf Š÷f6{êÞ†'0Q 8;°Gñ¢^E8÷×FüõxõjöHy¯ŠU{uT7³‰ ‚Çž±9pX;5ê°ûìpB ~í³¬/áCºœ&Ï ©H _zkSÊä¼À”/WÙ7°À,!S©@?7ËÆFŠ-WËpË_XS=^8žX‹°µeü + +Ùò´xµÌœTýÞFêU:#—ò¤Ù| ïáyS˜idƒk†I<õ •ƒ/{ò¦åI·C1„ËgPþ‚Ä;Íôå ¹S zZ–™ô¬8ÆaŽÅnÅ=øøR(“×2³S@Ü’©¾¥¿ÐÉëR™D¢®|3áíDÝÄ·ÒVðBKçõ!›`ï/À];ÄÂW$TÊÏU5N”‰t‹\´ðN(;XÜžk‹núζ/ÅG×Y–´Â˜BóÛþ¶Õ˜zR+êPÍ"",Š• õUÊ!+¸6{,”êž©÷ÌÄó K„ +*Ž$°4Ú’5‚âY=B$G{Æf‘ð”uRpŽ +Ìݵ- GcezƒÀÂE´K(­Î¦XÖ©Mþ´Ö¦RÍ Š›sñÑeƒwþÚdbaUà…:ø"ÃÁm^ð¥1ÒÁà÷),X²‚ s4 à ôe½°ÍèÍ Ô Ì¬V» ±žKk“‚»ä:¶ÃÂ@tËΆÅp³AÏð @½ãkÍ<%Õ}þ¨•ö¨øieNÚ¾dJߤ¼âîZöÞÂIYÆ`;¿À¾’Ccià¼a|hgwšÄß©æ wÈ›_aQ‡XøŠZÿŽGTOùDæM^¦o¹¦•éÖFʳH‹s{~Ah“ÒNGS ¤çº b¶ªäÜ]ª“&FX˜bD¬díYa?Y\‡»ÕCÏ®°àÒ[•J‚Áq™•oŽx¡ÐC¿UÆ7R³ +â»"YótÖÄß]›óoÍ¡è[ŽWó ÜX,3C¾°U°ÑÑ…„V^PàuÁ p±ð©õK ^` + ÿáÖøM^V®˜Ô)æÏÌ/ˆX3€è ú8ÞŒe)7¸©üѦϵEî™"Ì"° †HÉÑ +Žˆßn‡…îC*ÈÖ­ûFD¢ø÷¼`o&\bþ ±>J\yÒ`ÙD›=h¾«kÙ· "^dæÝ°å6¢^¦cåd"ï•tä›p³r‹C;tˆ…ÏÉ:»&xt ã&Òr‡`¯à<‹OÍ;(Å:±BÕ`T¤ÍÎÎ2o­¸ l¡¶Ôk4†ÖÙ 7«wXˆ®S‡²Ê'éoòBµñ[’7X¼0yŠ§Gkh¸®í®è7‰§miF5ïÜZ¹|­~ühð;:yñÊ úØb™Xf‚Xø‚Ø×¼à@C³±¥^îñ3uØXòÁës¼_ÈmWö±½zð^ åu2'ôÕOz{²‚š}lRó Îj‡¸\‡Ãî°]ñó¯gÒT™?¦ä_¼ (ô/t*:6­ðýÀ µv˜£Á6ë‘8^r?¤¼ƒÍ *³w"žzÇ ±ð5‰u+J^³wt…†ÝæèXŸ îÙ î¿y†<t&YöþÂ…ÿêÍÿZ¶ ÁȵxT$þ w®r´j ˜ïù Fv1à eöíDcáÊ_°÷6ÿ^¨”«ºú ÌUf:{å/¬q1§¥ öë‘7çÙø Aä:7yAû ”gßùÎÜqG,|)Ždïx”ÀªDYå;¼†~7Óñó¼4óĈǾò %;Ù«òø}Þµ7-:yFZj,:Þj +¯ZGgÿ + ›A“{:DÃa6|àw Ê°g'þG^`–|¤IÏÈ‹PŽKuyÑ_ëW¥«aÔh^h£¾5d" eGâcÇ-^P†¡ì¾-BŒ#}}~¡ßó3êK¢ç\oñBÛ̦'.{ Õ:ÞÛÌ0W§:TÔEtvÕfûÛ¥?rÝE–œÜ­ôì¯ ¦Fjò–Ç4Óûó %{Ž€iU ïÈ__éºÀ¦h$«׼R*試^v­zï‚_»–IqÄ\…ä Fs[Åï–kÍîåZ•¼ OPíîn(ç¾üÖz T¼ê"ð;¼]+9;ïZ«øW>‰­1©²x(¾/)¥æ³ûMŽ´Ü¸½‘ä}>ì-:Q[‡×Û‰…Ú‰uG¥Ùø¼³!NQ³º7æaj{ZRs»êˆG¤ ˜:<¬œwŽÔ"¡ŽêÉ€/D3i5/Ì|õa$*ƒ~¸–Ažreu]q/>®ç£1ï IÙ̺Šb¢BO–3XNIî]ÄÂg…顳ã¾ÔK4þ^–ƒo±Ý׶‘KÃT0ñ 5xªAÏá>dòaÿ2ev3KËǘ÷둨´Vg1{h“ªµì÷Š¯ù‰äÍ`ÕOÜ«E@7Ö#•5ÜBZ<´/"Ûä«Œ q:%L5£õá|oÖë‘ö¼ÐëQ˜WjìzÒUåÔµ›õHóTÕðÂÒâ^ÐH_Û¥ZÈT@ ¬¶'ábßäˆÀ²§–åFù°brܵÞYC,|úêlXh)œÈIhÑG½4ÀXÏÕ@ X¯÷;ï(hÖ-Ð hª« nž¯¡D®ë¥\ I2uÊ~mžKTe)9ƒ 戹½¢¦Ívµh¶ßïÜò Ø%\˜ÊøHÌFðwÓEaG/d%ÑfoQóãºM“ Ú2âkJ{ñúÚEÝ[¬hZÆRì  +i©ó"ùšü‹Öù˜Ãs8/4rÅ«aÚJí0„*Ä—dTk|ƒÌûÚÎ.„ºº¶¨ÿdÙ¶XÝoׂCBy`ñkT*Íìz+öž¥‡8ïå~aÝF +ã]zé'/w׸‡[y—ÇÒmc»ØǺŸ¦>ÏìX`ÁOj¯éÕ%G +Š²)Õ¦G<¢o×¾:P6SÉe nU²^Òe¨m®Õc‘÷•³9߯KvËB~X«/bvÓLk •8N5鯖×6ž¾–Ý;ÎÙûU® +‰}_t-g}Írjzñî¬.âü¶«¢Q, ¬¼™òNMh³&-© ¸áëQUêüÞÃfkŽ ¹Ü#¸ +¦Á?"‚ÒõÐnª×´ƒ,Ú¸!í¸ý8ÿ‚LÇ»¹Á ¿jâ \ݹ½¾öÎíÚ« ¯ÿÞ~$pÁ͇òp_Û×Å0ïUký iæiÜcá{R]矉^Ö‹ëüÂKKt0úƒøôûž3æÁøù.L—6^—¢þ9,L¿E°-½…êûm æGúqI Œìf™òÂóyÁùdÆ%Ä•X¿Ó‰ÐÀÛ¥k¬ð’_c¡x%/ø¿ƒzw%jÿýy¶÷ÆÂRÓ_!†È$åFq“*ÿ¾iëªm¾JÖ|¿-QoÿNŠæÖ΋ۆƒùT¿‹…tø‡!HÒå'©wxNºo¬¿€‚‚X@AA,   PP ((ˆÄ + +b±€‚‚X@AA,   PP ˆÄb±€X@A, P ˆÄb±€X@A, P ˆ”×Jzb,ÐÚFAyžóbåÙ‚X@ARœ ¾W¢ <[nÔßûÇ—à¿endstream +endobj +5238 0 obj << +/Length 105 +/Filter /FlateDecode +>> +stream +xÚÁ¡PS˜ÁEQ5(Kš¨]ÖAÖ4UÓAÏýß{Ç眵֭µ”c¬Öº÷.¥|ßg­sžsBÞ{)¥sBÈ9WJc!÷Þ‚bŒ±ÖŠ1RJï½sÆ:{endstream +endobj +5233 0 obj << +/D [5231 0 R /XYZ 85.039 781.388 null] >> endobj -2180 0 obj << -/D [2178 0 R /XYZ 85.039 786.531 null] +5234 0 obj << +/D [5231 0 R /XYZ 85.039 625.245 null] >> endobj -98 0 obj << -/D [2178 0 R /XYZ 85.039 601.595 null] +5235 0 obj << +/D [5231 0 R /XYZ 85.039 625.245 null] >> endobj -2181 0 obj << -/D [2178 0 R /XYZ 85.039 574.98 null] +5236 0 obj << +/D [5231 0 R /XYZ 251.11 161.585 null] >> endobj -102 0 obj << -/D [2178 0 R /XYZ 85.039 516.946 null] +1438 0 obj << +/D [5231 0 R /XYZ 85.039 113.315 null] >> endobj -2182 0 obj << -/D [2178 0 R /XYZ 85.039 495.75 null] +5237 0 obj << +/D [5231 0 R /XYZ 85.039 92.118 null] >> endobj -2177 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F65 2099 0 R /F20 1617 0 R >> -/ProcSet [ /PDF /Text ] +5230 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F75 5171 0 R /F56 2890 0 R /F20 2865 0 R >> +/XObject << /Im9 5228 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -2185 0 obj << -/Length 2830 +5242 0 obj << +/Length 1495 /Filter /FlateDecode >> stream -xڵ˒ã¶ñ¾_1¥ËRU#Á7s‹ËqjS±s˜qù瀑8½©ÔÎÎߧ_A‘œµSåšÀîÐhô[£îøSwyâQq—å©ŸDênþÜó÷J(â$ò“8†ùrg°»4ôƒ8[¢ 3?Ì¢»]ûE@ß=}xø! îÂÀOÓèîé…(Ÿÿöb»K’À{Ôç­òžõv¥™§{SïqØ›ÃÅy “¶)™ì±ìö†ÿ<ýãÃßžF6…‡à=þ¢ÔŠÐò§’;Ç…ËߧŽŠ"o8ÁÁ²Å^_â±û¡j]lÉÈ—+Ì©x~AdwÙ^Ûã.²ª}a‚GÀƒ(ýŒ³=Þìá‡Ôå-L¹rÌ$À m\ oL?¹K äE&äçϽC)wÑ]É'6êªgb¯<økRÝ©ÜÒâ=ÙªÄÏ•rß^Å~§Ó·WøúqáýÜãKÒË7yÛ“ÞFp%##І¾Ü_áŠÛ(ðÞR—_Êz•ËÐÏÞå1T~ÚøîûƒÒE?Ëßñœ_¿È—-HR¾zCY×=SY•€ùÞhnEÄÍ6,¼Qzà•$ûAã®Ãõ°דÁnXUhyh<ú± ËH½aX%++a§#­DM¬š#J= ½§S Òƒ»îšuAw&•óÔ£C^Q[´ä4»çïM²Ä·\ ̨>Ñ"|na 7ÀW ¢ù…lmçž2!ë †D¨Š!Ì3ËbnXNÂÏŠÐÕ±ý–Õx~¿$‡_‰©£ûª0'Áhó¡˜}]• "‹hdÖUö²cË}/ǼV{=ȆÕÀJW¿ J)½OãèɦKÙ²iåÜ&—jáÒ½ÕÂ¥ ’y -‹Ÿo‡GÞU?éã+ªƒÃ2,VˆN¬ p>®å7Ì·c Ø¿MÇ+ã GôÈïœG$ðŸ˜èsC’!ýž*VAü¨ÌVdxhwº9–÷ y¾Ò!»(PlV0‚ c„¢Ä°24.ƼVpu˜¢ZÔÄ1{M¤Ô4°®Õ{„žH¡FöA>|j\ ÏÑœÀowoÈÙ©Âë…í^Æ.ƒæG;¸·MXçÉÿ†‰·oYƒ»¶®^ -êÙÕyÀ±Ú¯XÜ=ë¤Ýw0Ô³ûãºaª¶auMD½p×zbeéÌÊÄ]†ü¶¤ê(/Ûfî ŸëEG¼E!ê ÜÆÜv´ÇÎrà.E‘´®[ëD^h­ká©H¿D#¿ˆ' ”R~/uD•§$ú¹ß²ƒÅúO -œIq1C!t=n‚ßå+‡ñyÓÇOÎr;¼1µ@LáM’N¬¥oÉøLÐËÉ;³iY^pÞÈj a«ó¥Ÿ’hÇ“ Íïcc1öæN˜/\…œ+ÙkE)29‹t®@¿Cn"|Ï “vYÒ½l˜pßžxÖfqòÄ;yÜõe Û‡0¿t-ùöŒmµŽšòØàð\OåTKAÑøMþŒQî8€$ÇÔ¨ÑçRp’ z7M—ê9­@RÈ3wE:Ö‡ Wò,܇üNÊjb¥Òû=}^Øk#¨TWþ&râoZ«—^ nÒá.#»¸æ2I!Ò;#ì™äàÈ.ï§ÝV˜öú –€’ùÝ¥ƒr\$®=iY×´ ¨¬iX/6½ûw“°Ý„hvÝ•“€[ÅÐËŠkC>3ÃWM~ùMöC=tæ­³5 §±Â§$ ½çàI·”Œ£d‘n> -ݳî-Ã2ÙÀ“h.ÃCgxþÍLöÃfáEjŒ¬w"±›¹{ -mºùË­Ÿ„} ¨}£hÉE‰°–ëÎuï¨fQ!÷ã×UÎòrGñÊq¶P²‰M¹“3f“&«d~^kªV/uÉÀ› Þj+嵦i+«wA’òëÐÏ-¾ZêëÒElG°èÐ~©šïæ{&që=ÙÂvBX.hJõMW×VŽˆ¼ÔK\/ZÔ¡m½wâYÕ“{¼ÚI ï–âõR¿XÎKlé¦ü0ü]eh:óóFìb]9 ÕŸ[Tþë3¥Œ 澦­ž¦¥&‘8Ò[Nq zc±5ƒÞkETþñ­ÜÚ’¨N*Bú¦L`4IóĈuº|sƒìmR¡;XF…žŠ­›”(âØ:ÈôlžQÆ­CE©½ôU”ùQÃüV‹5Ã×r"©[ -ñ0•¾×"&îÃn qŸK>z³Ò‘4eK’c:ÂâCSÀ qL'œÓ 5r(õCq‚a]í¾¢BA“[#@ó` -@þ¢’ŠZg'X·WëDæ΃™ñ„T5¾×àF}²”ÁÙ Ðø(Yºþ(@By[–Pâ‘so"1Ä,œ=6…úÕDnz>d@›Î;~‘à©»’rFg«MçÒ$¾1ÃθaO¼ØöHê&¾þÜ!S»ŽI<Ήµ´"Óö'ߘKÃVsí­timË0 JŸù«5=\ÄœÌVã#ã7óÕbQÜž}æ^"š`K{»‘ìo!”"G¯ûÑ ±ÁŒß2‚Æ76DU6Æ'h€òbÞË’0•¤–¸ãrÔ–ãÛ³™†RÙZÔ¼Ç#µ”íö¦ÀVû«hÈB+U~¸ýé‰G½wšQz«‡F÷ø‡ _H)dÇCÕ¾ÙMœNšL<¬ ƒ²??ο+Îý8„„{þåLÚÿ Y~¹?©k“>dÔ^ a¥Î+À¨L¨ªÂÛåï•||31Hµ<›@¬P•mÏB ’rÒTþŒù±.¬Õ‡wsÁ›há'+ÎjÊÃ='2ôŒ$5šWÑo†fÙJå»PŠ°—øQÓAoè\ݺžRßÈ-8€á0¯|buSùðv¥émѲê…Ç1Uçõ¾âfâä7 xvYO­»vÙw–Á©ø«UÉÓ©¤ØC\Caq7¤Ÿ€ðQ -aq@Kägò"&›5" ]Ûuý%š&ÉM¼!Óô¹’™ÿ„+¥m ·pBf²â›Öÿß I|(WÜôq–F†ÊõÍÎTt{H…gÓÞ”ÿ-]ŽEendstream -endobj -2184 0 obj << +xÚ­WKsÛ8 ¾ûWhr’g*šO=º§ô¹îLÛ´qOmŠ-;Úµ-W’»“ýõ ¤¤ØŠ»3»“‰E‘ |øB"àð'‚Ô0®² ISi,wl`åíD8‰È‰D™‹ÉìM¬ÁYƳ`±îÏ1L,V_׿_ß,^žFJ©Pdl%I¾ür3á-ÍÞ|žXÌ?¼Å7 “"ürƒË?OS.Hhþ¡_¾~ÿâšÞãÓï‹w“׋ÎÒΰ*C3L¾~çÁ +\z7áLeiðŒ9°¼›€ÌhåÞ·“Ûɧî(ZÓíCŨ”™TÃ"Ì!$SB‰áÌpmq)÷S™†-xS‘+í=Œ ßàZÕ´·Ëº<ÀtK|ãBo ö”ÇÊ°X‰s—“,q.«—Õ™Ë<ˆà¦Æ¼•| Œ‹gx©HË”eÆBüzœ,L’ %ÒÎh‘ÀKjüòl¾´6a…ù~_Ô´Ôæ +þéNp×k<¡ÞYÜW´t‡Ø>8E¾è0¯©dˆsªø’#9”HžŒRÅËD!r[?r˜œÄÝI”P"9Ó¨4ê²B9×÷fðB%êk¬“[b_kY +wUÇu¾ß¸aµÆ§ù¦hphW4uG0“Ü¡&Ê#u‹ÍaµÀÙ5½>ØZ|¤ÍË©LÂ{ +±-ÑÅãÃ5†Ç§‚µdñpê¼92¼RÏA[p‘™”ƒñ3 +r +ÁyFA~Nd‘Wî¥r‚ã/†÷Y‡éìd-:Âû@"NÇ •?ÏO4£ÓQF$ÆÆë"­BOÓÊ ý‚V:Zé£ÕPßiÛ¾äe¡¤Á›\&£CVóp[m0–ˆù–„°ØåÍmßwÏngs_]]È,C•J‡a4ìšc`{_л-Uä•b&t!KÃ+ +î¹ëh„[G´óŠÂ¼>î½6ªýÅh딥ãxí^èB´Ð¯¢}I¡ö©¾Ñhô-«#%¦MÑ VäŒ0Ö†Ÿ—0B½ þ¨îÜLEÏ’î7ØRÔ­¦ˆã‘¹Å—ÔÂJéuÚmk(ñ¹½"a.õ5¨êUÚæ@ rᤛgö3¯gÀÆÙòxhfXXκ­˜Š!zpßÊø_\‘Ši_þ¬hp˜Eý‘RÇÐl¦F´L|¢_Ðóèÿ.}m d¬: «ÐŸ"}[-x̸#9ÞÍ àáCÃ`XÀTAfåM ÷î–ÀU“H}Ù’^†¾{â‘ß~÷PŠë©RyÅ'Åîº jõl÷`àFoéI©ƒå£d Õ £z ø”º¥)ûyʺz«–ž¦ma bÃãpî”yåua…¨Uû¦¼s¥õRWâ­ëíA¥Øÿ5­-9‘skXxšÖ&–‚pXë}NáÀÆÅ_Då߶ÂÙµ%ì M÷™Å‚llÀ ·è¼mè`ëóáØÒ&ë‘Ka|¾Ÿ¿íÛNª+¹¸5ÇÔ?lû²îôÏ~â™+¶´…Óª+«.·Yv¾°°þ*â8,ÉLƒ}HѽC3¥[ɨe[.mQðº½M¸áÐDþðÜE³¶‘Ì° %•‰Gt¬-väÜ0æ&ÜWNƶ9EûD†(ÎÆ¿7àŸ øp(3©zâ7R2è½-½g_ÿþƒüÌàcÇÆ#endstream +endobj +5241 0 obj << /Type /Page -/Contents 2185 0 R -/Resources 2183 0 R +/Contents 5242 0 R +/Resources 5240 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2162 0 R +/Parent 5208 0 R >> endobj -2186 0 obj << -/D [2184 0 R /XYZ 85.039 786.531 null] +5229 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 418 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5248 0 R] +/Length 21835 +/Filter /FlateDecode +>> +stream +xÚí]‡‚£º¥WÓC'ðÿy-Ù¦’LٹɌôîÛÍÀ†èXÅ*zFDDÄIÏF"""NY6f6ÑŸ§ °`ODDžlÂaˆˆ°@DDX "",ˆˆ DD„""Âaˆˆ°@DDX "",ˆˆ DD„""Âaˆˆ°@DDX "",ˆˆ DD„…ÿ‹cÿB?=ѧ±ÀÎ)IÞµ’(ÖÒΆ`L3­š‚ýüÄk"vû%X¨8ÿgšf×U}GÉ Aëßò}ù÷uHÛŸ€Cïi0Kb·_‚Óy@¾˜}ù?Âgƒ'ez ^7Ä!á}ôÏç•Êÿã§$ú),tÎõ>áz{5›ÿë§*Íô䛢»Þa†CгŽêÿÛ§$z,HæòÍâ +ÕÕ©Ž…B8þ½ñÛ`õW‡°ð&XÞº4?o4ƒãsIRùfî\µ÷À§$zE,€²ôÓ`(¸1s=– Iµ +þÚ¼YÃW{,>%aáe°àŸ™Î+Þº¶? … Ž~ˆmžŸøe0Ӫ״ªêÌÀ_¦üoÁðMX(„ªGXx,øAº§®3MsVpp‚è'"†ñâ«?«n¦V,>~ÅébGø—ò_bÁ¿‚ÿE,”âQ /ƒ§;ô%¬hÒë¬Fýì¦¸ä ‰©¤™ßÝr{¤]ÔŒóßy“*ÿ‚ôU,\ /†óÜgZ*Îû.â—±ÐÈ•ß÷µ3CCÍøßiIQYð#,ü,Ll6°î° Ä‚ÊéLÁØ‹ÿT„…·ÂÂÂZþ¥x,È/Îv„E*m§!,¾ SqQ¬¥½z)†;¦¼æÿ’Œ°ð° ØïÌÆþY,¨9Ww.žõ¨Ÿõ}~?”`ðö¿c ³ïßÝîДM ߉…y™ýAƒá ‘°lȳ~T«#,ü,Ì:úéÞs¢".Ë(zNp0~zYcÇÂÅ–½þ=M*“ˆØ3sNœú1q !,ü,Ì*Ç¡_&j+s¸À —ÀLµéI¡¥f Nï´xÏŠIÉ©Ð$º¢DŠvráÁf‡È/8zKâ¾[Íù  ãŠÙÅi§šUœl¾Ýì/D›™FMŠ\.CwðNx®¢Oé›»§$zY,4çXHÊrË|Iœ/¦v¾Ò2ͼ8›Ó¯Cµ]âYp…]µÝ-öwý~þö)í§Á ¥¦=–E?\—YÀœ»›ÔIà³Ôwä™W³Å+ç¸ÙwNq/Zl{°>˜ÀwÒ&{»Ç_=¤zÊŠ¸÷}±PÞ¦Ôðß~8IþaÍà8·™h—4Ú`yhÉ&B~ªv¶Ë£‹;OU—ý, E£Ü¿·Á –UğسH%Ÿo° ®ÔƃãÜ¿ÿý§$z; ÒPŽRjç0ù'êç8="hÖ\rpË…K*çka¨'i@¾sÕ’›wX`›ÈvÿZ +¾¿ÕÔÄ1˜—vuÝÿÁS½¼í¼]Û"ó,¹Œs÷­™™Î3©7¸¤•‹©ÿ¹ô¢¤rœ³9WÉúÍCÊwu sL¹¿NÈæÆK²‘ „…·ö©nl»bpnjî޳겾ú¢¬À:Cbµ_À.›/ä}«EÑV!!×Od5³t{g3Ô  í¼ë¾G÷°ÐþÇÜŠ!Xô±ÍýYpô”äOzu,Ì{m›X· +\ +˜}ÓÆ–ÎÖÚ +®@œ·MeÎ:–3ÇT0(¶2*j@ +´½Â†YÍý H$©³Ê}è›8Žµt˜­Ãýü¦“{{b‰W;ÙçX¸š(×øýÓ¦ç±fúsÊT¿`áð){âÞÇÂÌÅëekÙ»:A_,Öñ¬79Ûí0('Тµj>}æ¬Á«,—›¢\l-Ž.ö8hËäªrñmчòݘ0(­Œ»¬Üw°à (,¹I;‹²ÅÖNÄS^¶OɈ{_ *ìsk:Wób×mì䤿úG!Ó•kgUk*ît`}ž¿0Å+˳oŸÜ+ç(íWgNyXó©œ?Äl"¾Ä—ýà´± ^UŸ©‡û(rÚk{/,Ì?ä&I%Zî,N´nUfÙš‘UQpã`Ò¤z½uRÝÁ‚ºbU,x3Kv»M-%äV̽xüÅÄö nr+0h„…÷ÅÂ*—§º5§¯~u{m¬ì‹ëÂø¥äøþ|é³Xà`pvU:žÂƒÌ¡>Ú›P²o™Dwjø<Æ‚só”ì8r–°ðFXHâYÿß,é3[†q«…{õ7ΑWv%bü­þp ÓÁÁŒöèqdÓ"fÙw¸<‡…£—Rî—^ 'y ¬hÌeÞüŠ÷Øêðkí É€ÎØÀ| ²zÒõÎiuáÙz?Ú¥»‰_4ÃèƒX8ŽìÖ«aÁÚ5¦Uݶ&ÌšUçU®¿o¤.l'=¡‡Y—½Yim¹ç|€¨7çîôWVS8΂^õWsoÿ뎯˜ƒ +K cA…ìi_+ÌÙH€æQÞXº_eÚ¥o>é}„@ƒyW4Ç€UV‘LÇø-!„.ºf·N' Ýó©ž„“§Ã^ ÉÙVJ%“Z§$)cëlü +`wBF½>U]˜-Ì«¯{MÉ­š} gIÖ­2Ü ïŒß ↕Ñ:' ò—o·*Âq¯ObaÂlˆâ¯oËÏ;{ÔI/°ÿd¡˜û~…{X8 TJÒ\„…7Ã×—¶ÛiÊ\¸—\Öí5‚¥vë¥Ó·7y ¸¢ÇZÜâÁwRvd.<Éw÷k œcáLî(mçMXx',€)zÓ‹DHÜYbû½Âû«@´«YµÑwaÄâÁߪKþÖ?V9Jîîž~'6ïô¥¤·îÂÂ;`AÙÏ×aÎk¼1ï•jöÚq² ÷î†} ½¹ö|mbáÔøOÏ¿ú,œz´[ã™°ðz~¤ƒjó—`ºª9¬ú„º¡êd/«d4ìR½ ”¨Š£ï‚2.«,´¯Êߧ«ÂvwO¿ƒ…Ó—rðÖ ¯†ÇŒw„yèçE-úÇõºJ………×ËÁ9PÀ‚´a߆4fúeSzµH«Í´g+ÑwwµÿÏ`á@š^ ­‡WÝõÔ Ž¼ÞzM"óÀÿ éÑé­öy,ðq–,…UŠPðL1™,\>Œ…Ó·ÎS•°ðzráƒXH›¡2àaëž?Êý—™ñí7b«#—›Šª3¢Œ…Ó"¾}Û„…?‹@CwЕÐP±oĸŒý´‡X ¹ð‹°ð¼ŽtëaóvïýÐgsy¦$Iž…ë¢$ý˜ŽÔ?r­‘½ð±ðŒí|`'Pio<á?“¿P´šV¥æðxà&:=Uˆõ_Ú d;ÿF,ôð©žÜJIñ°uåcA“.ßÇ}æšbÕÎôAŸêåûüHÚí +BXx{,|f¯í€`sljº‰ +?ÆBó\ѼµìJ·àxº7ï÷c¡¿µ² oY¯ëKöÏEÿ$P2Å¿ÞvK8ÆBë<Ý®öfÝgb0>…Ó—©&Ð~”“èŽOæyÎKæ.´›è„c{áòt_…›ýÀG„E¥µ«ñŸÅÂiN‡ +î]ïÞÞ ›ã¨"FOul¯–C,0 +þxÆ7©3̓‡Õ@[ µÓñi,œÅ©Jo¼ „…·ÇÂã¦iÒt^y0¡sºV±»|»Þ…:ö©¦w³ÍÖ¨1÷`,w…“·y¤5Þ Ê{ïßÏáZX9ÅÆgk¦Ê‡8 é±îuwŸïäѪ»ÑWóرp¢$Š%ÂÂûcaöÞŸ†jÏí]ghëœÚ é±I|[šîD~h·zÛñÃ~/ýÓX8áìÃqµ;ß×¾-”ò{b1¨“ËUV豞àâ9ã’(XÀ<Ò¶õ›’áÎãªe{Fïç±p¸…¡²­·/@ÙÓ?Ø8›°ðÝXPCí[eí¬¿ìî’h¸å“âVmR¦Š\ÔxÅôÍÅ?Ò¤4ÿT¿Jº}àÜç±°IÚؽ’ÝóD—û»óDo€.NÛã,U«W÷Išœªkœ¨Þµ7…ù–Z÷¾s©Дï2¥26ü«v¦Ô-püøƒGg«ÃV?ûhÀ Ñ+baN_挵]êãÙ¼]óÑ,HœtÇ'‰jµY®ç~Ý^—uÿ…´Ù”ÛK¢¦›KÒß­¹¿Õ®^ «|ÿ¸æüç°ÀA¸aî9£ïÌpû”D•â´´¢º[·ÍÒgÔ™”ªxñvg‹pé›FëW\Ýlú/øAU¾Ê¢(Ûf“üïßêBÕÑœ—úÉëâ€_Ât\™’-ë{åi.Wî ð”Uó›ø0I5è÷¾Ô_Ÿõçò…øÌ¿ž)y+,pûtÖ}³‹(*J-½¬º“íÞÌ|º3TM‰ç·ýÜ¥j¿ˆ¯N‡®jë¿5D=aÑùêl«`ܪc3Â|çjj8çxÕCj=…¯ØβV ÷o«¹–sëÁÚ=寲‚П +ϲu@·,þ3–YÎר*·rµVÆ™•ñ7cX3eË[ת7ÀÂÒssø/A€»Ž»bN»ÞRœŽ»oþÉ"®­ù}gs/#oû#ûçm9Õ +´²6œ+LẚÂm%ñÏ`AiwøN.Kdç óh³îå³íöòîYY2•Ö8zêYÃq¼rÎGÎÞæ8Ž†ü¢G‹¿} C ÿæó{5Cû°0ųãÆó +ŽÓ¦ïç̽«RFɉvTܾ8í¦»€=v¹®ûðn§àluºÏÇ#5¦sxÿK{îr»^ mÄXå`pö¿p®±Â1“È÷Ü¢´(°öøX8eI® ´8l`-9óT;`úàœ]C¶­ìO¡™¾ ~ÁÌ£rÇ3jüÍS¶¿ +eÈÅÂTXa¦Ö/Ì ­ÄBžBˆA ô#f~,` ÌÛÌe'8‰Ácýå¸ Æa½amÝ`á&z#ªç ‰ÎMÕ˵áÒsö÷›ŸÇB‰xówH;kF­]ï=åû’1Ö€+4¤’¤ž·– ™.AbŒ¶¶‡XˆŒœŸ×]ua.jz=zÓy¹W /DQóÏþ +šmG_ÁB-R&ÍÏ›l‘†™šªÿ 6ÆéÏÓ +à`Çßœéâãñ[sÕý6°!jÌõÍæû]Ë ؼnç|5ÛäøÝø'Xo®=À\›²!´°íƒô\ù‰Í¥ëzýk“¢U#Ž35Áòb¡”öBÆÿK„¼0ÏäB™q½*¬k 'úèq{"=x£ÿÞ +G0Ƨëj_ÀB¬5 üÅ}ÁâJÄ bü¿™Æ±Ó¯êü!ÕÎÙ$‰¡9P0 fÚ%EÓ›Ãå¢j`rcÕ¬šè™9÷óœù5ýAÝoñn´æøiJùæ¢C¹€Ò'ðûwÚÝ)%q/Ÿ²ëãß‚…jÌ™À‚fãúŸdVœ­åBeðË ·‘Xð´ +i^9’‚¤ˆš0ìÑçéÜ/8üžÆJ}Ìùiæ–_À·y’£ºZ5mü”c˜Ÿ·p~' 4¿W&aQ 7Ó`üòyÇ´œ³ö䜟 }.+ñKöøþŸòí¨]Ô¬QKÇŒêùlc/L$Æx%fªwö‚‹g ãO}ÈåŽ#>sã»þ²½@ô´‘ ¤Í[ÂRŽJ’=ÓV.pÙž¤,d|ÝG{Áò2AÃî>žéËë’µ½Ñáì‰/"S=ûm /……+aa–5¤\¨ÄçÜŠ”½'(I\Eš´G~¤È;ð7Åp–Ø»d£•[ðaä‹’Ðj@.¤`'sÀ}+*IÆès,œø‘fùÕø½ÎÏ`XÈòœÿß%,\x],ØR.¤ËÃÆ€·­½À@Iš2«x,Ð÷Fs8h#d§vaäÂË!å¬ÿ™Å¦d/¸­P‡|I,8Û;z¦äYEÎAf } +¼+aä«ÒGB.Lfh!Cn툱Â`ZÉ…›8U[¤sÁÓúš‚É“)áê©ÉAVfÊ $^šÐ*g¹Àrd`.®[¹P…c-r!Ì%Y³#Éà Œe®Y‰­4}C»vGK "tk;³|M–FX ¹ð‚ä°d—yX¡Æ>ÑÅàf:™ç!£j–Õ"cÏ sœwéBҥߔK~hÌDT†aÁÆ´ [”øH.¼ÈÂIŒaQƒ{b%ìâ'1„È°÷ú Œ`1D>ÍÜ/pDê4¨%Œ©[Zw¦ +>7!,\x9bYø%­eE3ž'ÂÉ… ë‡˜ö>®†ÀSMX ¹ð~ä†ßÎmï1/lÂÉ…7£Öó¿ëV†§«èxÓN $ÞŽþÿÀ[ÂÂÿ…‘àLXx",\ ",üŸT´‚~Q]ì¤ýD;íG§$Zû­S:0¯û‚°@ôéjÓä[÷¼˜ löºùýŠ^Uø¤#ô1fjë&6µ/a;Ã#,ýC2`óØ8ŠU4k&ù8<¸ÏðÔxþRdïŒn}ª†ž¥ú0~›°@ômXà0èì;ŒŒy—Sm߯ëYÏQÞx}tŠiïZ†G9–H²£1 D߉…»ä>L§™ LÛ›¾ ·–‚¬9æñCvˆ1Òô_™7†áˆŠwº!ÿ,ëµèJ8 PuD¾ªEluhN„Lþ”Aú%E]жµG=‡ˆZÚö¨M¥e¹0Fè ï¦C©y?†d3àßòhf…øœ5üúÜãŸ5LtsG×Âë£é‚õÓR€°@ô1rFˉË!ë˜3aX³BÇ Ÿlݘ!pÖ‚ÎõzS8!g|s ¸ì¼1K˜æ¶V,Ø£u-Z™Øæ0¸4AŽÛ,Ï“©äØ°‹È!¹gàŸÛÒÇl·zÌÒ"ÖG«L´läB†¨à> ÿ»cnü°UŠC×°EÒ§ðH:Hu‹Rkt°Ù…,ÉDX ú ÉxÏÊ©p,ÔB]7à!V2¶Â‚L3Ç’!˜K“ÌZcš Éi¦d?ÄxG¯X¬E uÈêwÀeYoØ CMV̈\¯‘ö‚0AøvJE~Nk…Md©ë X•¾ƒ)({Ÿœ3ÂÑÇ)Õ1¹xH¦~´P±Çš[™P50ýlÆ“^ÓÒäÚŠ(‰™† €ŒË ª`W ídV~BÖzT±R-¨ ¦I[¹æ§æu»¶W ¹Ô§U¯7WXP. 1„¢ÏPUëæµYÐâ…šŒ¢Ê©(Z1cóÙ*[«u_9cå‚âOΛ¦*_¡…`Ϻa ™ÏÂçÙZcaÊñð´˜+O!à + ír`µ™Àu¤fÆ‚+ýM Sf,pÉ¡ˆ>! kØÊ\¾Ls,ˆ%½-À‚&×\ÁgêyG8rÁ²ÍÜ\P|Ë1l°¡GµnžØãaÁ¿ldpC)Ÿª:¨Šc a³’ Á-ÖÜ ,}”¼1wÒ4ò*q%ÂxÈ °c7/ï+¹ .iJ¨{Zw1èB¹ ª·°÷µÆ‚‰ Íyå×¢NiöÒhI4ÃÂÂjÈà€ÂWÙì±àÌ:ÖŒ…RΑ°@ô!â–.ªBþÈ5úJXºB=—Åè4`õÅvÆ–:`e{|a„© +̹È_öœªÀøXcÁFUú>È„RΠHL­ËÜ~W`­¨>&^h²-l©¥ Ö²‹°@ô¼± Z¨EUˆüÒä¢Ð#4Õ¼¹`Á½ê±`êÄÂE¨Å \àË2€(qá єA $ð#y ²¿û Ê÷„l@G¬óÉê€ôMq3½¶X°d©`bÏn8¨0LX zHœ'³«iä!x-a“Ë ±Àµ•¼¾z¸ ·`!ÊǬö]8êríʬ³1±<¤åvbÁGýêdxá‚ÖÊj’Ü"Îþ5ÔõҬѫ¯:ÖAºòËGp7ÿÓÕn*à ëÙÃâèˆ%t¹¿`>†Ðöôf:!,=!p_8«@-áöì£ùÊùZ‡Ý䬟6û·ûÈœý› ?™¨ìk°…&°09¸ íiÓ |ñw¤íkÃ1Öõš*qÔ»j¼,Å«²`¿{u 1p[Ù`{{ÁÍpp$±?è$jˆ>L…Y×›âª,DZí(ÿÑÀœºCÝ¿¨bùg˾6LÜYˆÒº69wV ž—æÐNhÑW †ÓË ÑPfš6uú¸½Ç8¢°Žá²uWlΟËaˆ7¦øb8 šÓ¸¹<•­…Ãc§4ƒYî2ª§Jôe!{=I,ÿbŒò`'ìÓtT$É8Š˜%,} Ñ?ÇB>þS,VÎ D߀…r……Ë¿‘ ߈÷ vhN„¢¯R¬ËšZëÿ¤ázdèÅ·Ýìâîw˜ ïã DŽ’ãê#„"¢tVýqb:`!´ˆˆþ<…€"""Ø?O/QpIÉh""""""""""""""""""ú·T8RíGô2ˆþ4i¹Ø¤ ó–^ÑŸ¦Æ­<Ï-Q²“ˆèc!‡)B£„¢?/ aˆ°ˆˆH.-¤Ycæ¹^NX ",HŸjFX úÛTºn¹®½ ¢?OîþÆDDƒ¼s,TÝÏ%)ËäÿxIY$Ä DçXЬ” ÚÕòœýðã3·±2 +È"ºƒï'½K.tû¨°æJW-2˜ˆÎ±àxþgTbó̹ü°\(pÜÈqÑ’Ü*'¿³4õ‡±@Dt g¶]yî h[–†—[™!T§ÁËsþ%–Ñ-Œ,Ý“fJu~™#Züépœë6©¡`níÆ&܃_–záèéQ _·zÙ™åù8dTgyæ7úMÃÍæCz5êT‰éæ¹{IŽÆ­Ñåf\½ÙŽ[ð5£XÆ…'Ê®­^‡\ì·å¡7æØœišúj†cìe£e¹¶ÓÔbñÂÑ–Ëp´øe.g¬>ò«øÜKƒ÷AW?þM8æÍt&Çy‰ýÿR¨ÿÆã¥Çlr¹‚*¿N‚ä\ð—„gRã6h”ó¸7ãúbÜì…n=n|6.ÑßÃBL}ü€}L ºvxÐ,°‰e0Z—)q°`âAç2fÀgIfÖ .«ùÇш&̓>°Z®±0ê ërÎ|‰f…]$za¦üžAQØØ|VEú¸çÉÒ¹ aœÝ;Œ§â³ã|mriÖÉÔá¸c8Û„Â8öà8nt4n~ÙŒ[ÜŽKô±P‰ÝQ.ʘל)ÊL¤¿aK=ÙÕ9d¹êêKÉsW]¦«e>^Ó)¡ã +Fƒ[K{¡—<9ˆ‘S讉Iîx²·<63·lÓló)y7ãÆrÜ5<1uOÙ èGêĸ4>?—èba\ÉŽÂØœ1(þßÀNu#[’ñã%gB}Š¢ˆ¯ÏÙ,UF,h5¬P-êmÑÄx-N\%xR`AF +zœ5É‹õž'Î%âZ[ ŒŽs)š¤”ƒEMÂÇ­æq›qƒ…ý¸R7çd«q ÂaAq·J¹ªsΊ 7ƒp>×åÈâñÐŒõ]õâ<¯2¨ wÜÉ\ÎMäÉ|TXPÕ<®–Ù؆Îñnmg7ƒ&°  YÊ#ŠÐ”’#\»Ó‘jöl#Ò1O–qõõŠ@ô§±`.äXPmZ+0FG+³ÝŠ±gHž[ÌŒX.X(WXØÈ…=OJ¹³=Ov{žL ²å  c>dœÇíÕþba+œ=ä¸a°pKRKˆ¤ÿÛ˜¥Ž¶V&JÙÁ…¿Ýɽi¤ôí¨ÓâP6xti¡òçì×ç\˜± t#gÏ“·‘µH˜-J¹)̶‘ƒ1³‰åpÜætÜ\˜±`œéfD æl;ûJ¹V âqæJ2qÜ9Ôƒ§vªù×W©ÿ0iÙ"ÛJ^ò¹ÐÈ…Jº¦Ü=OJøqàSJ>ÜINKŒëÌ㶺\º='*©Ø¹„Âpm)¸ò|ÊŒ3”1b·ygõ©sn@Tx 5ô²‚ÇÆ^T,Ø„Hàæ58òá~f”£Ýjûõ9ïÍ­\€=ˆw +€'Ík»`Áv1ÜOÁ©TÈ9ŠqmþQÛfêãq-ð ÜÈÀ;Œ‹>Õd5.ÑÛQi\™áy†ÐN:ÝóìêcX@wŠØ_°l;nã,ïµZÀD‰;†Y"g ›Ÿ#Ü"nCØ\›Ïã‰y£¥ܾܺvÞÈ> Ë‹Õú<ÛÎPÍÌ‚TàI–/íî/µãë çMQ&Ç-a +–ÍÇoÇuf?Rã¶Üœˆ¸M’Ë¿ð¥@ë*)Fô¦T…9g¾p´L±Âöªñ1,¸ÈsÛÙàp1Òâeö,CË¡´Xbä¡¥›!ÚÖ|º«¸ÖR'‹عc†›Òø9¬ë«2zˆúLš?ð;¤­ÅaPY(~&;z·ºZ5Zò³¶…ÓV˜!ˆ„Æ…»êå2.jD7ã:Ž+õ7×ä÷IKˆÙN-á¾7Ê~2J‘蛩aÿ5²AíÆÜŒJc< B;ÃB | kbŸ˜¦dò¨ÒbJŠ’MqÄÿ^ ¬º](_lÌ)ÌASnÏÖ4‹‰ñ;LQ‰ÇXw(ú†%E‘LøÇ$¾fq¿g˜:ò«õ¹H‡žÍ'7ÃЮƕƒ•ëq‡yÜb=nÔ7‰·Rm=®ð'9aá}I ÅR&¦ôê^õ!,ðë.ˆ…“ËPäüëÍ(M&Ù vºX?Õ‘Œ»ø`§«UK½±\~+׉Pk’ÚÎ|!µ„MÛŸ %7ÍA©ÿwÄM·o+ ¾&ÞuµçãêU[¹¸yøƒãý,ÈhØã¶+7sí”+µç¹®g>‡n;çr¡€»†§VÈwQ—£±“£@øÁ¤äÔ‚§C_ÙŽKôäB&mh«œŠÚC{²ä|d<‰…Ķ§Ä©O2zX`{®ñÏaâZ÷t§üñ7(Æ¥ÌÏß DlÜ1›‡ÃÁžººvêZ{ DD¿B.ˆXð úz*>fɇì"¢ß@ZˆÞæÜ´•[´2ØŽ°@ô×äÂ8zW#þ¯¬Ñs]dª¼JùW ‚}÷huò`ȾKŽXì°`é¸ ?n +–?½TœÞ1Œoöuj#¦ÕÝ©•$†´Gr²¾òH«i%ÜfÎ~à÷ÅBðÝû|=$eh¹w^¯ì‚CÖíC¿} ÝûbÁùv,„“jÐÝ!Fo¥#} QSLÚЩ@¤Ô47Õâ&I´Á\ûý“V„cS4QÒéí$âfŠ:ˆ$ÂKÓ¬ä9m±Nò³9Tl…"]ÂÏ%}eôÚíÆkJ.åµ$ešbÇ=Ò¢È좤qt~¬ìL-Å'1ˆ‡C¹Àâf) Ÿ¿Lï‰!£¶PŠqËù©ˆ^M._ØFiÃ8†ª¯ÏÍŒu°\.ËdÀ^´mÕ.’în/2þ…ê[ á¥c~.ÃðÒo'ãKÍ µEÞ­< ‰-ÄÆávî½¥_,u÷)Å3ñ3×jøtÜ"÷ŒºeW~Zhà {܈Ä@\” „ÉBoE” <ÖÆŽ-Y7‰!ÝÉÀíÊg‡'-´¯8nC¬÷rÛû.œ\Ç€:(:¤×†µvÊz#çƒsõÐQÊtP]¤×„œ?øŸ;00¨*f8¦=xcfÔœí:8?7=— ólþB§ Îû5çH°X+kÌj#纊“–îl—>«Ü†DŠÃ(2ƒO2ã ø² +äßsØy!¤mCìvƒg¹èƒF¹€ê¥árÒ]¬¦ÃtìB¢j1$ÚÎ-?b@ZÆ€¡.p_kôHyzg:Ų^†=ç†Zè]í ÕîâBîï!lc¯ï'Ù˜b ~@/¾„ªJ­…Yt¸¯qjˆG,ô!@R¬S5"çà˽P…XG/…3ùHXÓ4 ˆ<)XiA¾üKÇu˜¨,ÒÄGC¹°˜ZüR~7|°wp=0D¼}JyÁ18ê T( â¬¿ ¢¾ ⌠6e¥±ÕUöÞ|-¬t!DX>š{,J5§8-UCÑ’Û' óÊP‚˜ ª(…!j  +…Q° ™1Θ"Ý_ƒ†H³à }EÍ OÃëãp±P†’ ò1uÌml•6í«ç¹PZ¢pƒRd|ÜFM™èbAhD5ÿ;àʺë&Ýe‚¡ ècdCÀ™ #­± ÜŽî.³ †~b½%®/eF*’ظæm›ð1æjY ”a‰‹”wþí¸cÆÌع©—•j€oU ‹°%Ó,Z¡Æá>‚r‚i|µ=ÈzÚÊ™/ “Ö‚škQŽäB'“˜P¬©Œ¦ìd?“èͱ ö“ BØ®¡—Â*”ŠUR¸ø›·ò¢h‹æ”\ˆ%&‘šÉµîR31gÓ.qË\’-êweó|S¤åH.äseIC=ÀV ÄbŠÂw*÷'¬8fÙÈ…z EæPƒS WX¹¨ µÔ¸Ù¿Íæ úµåW± K¹à¡OÕÎÃÑê'«‚i2á Ù©eÂØN.ÔgrANBå)iOÅžZßµFQN¬ær†KŸASX°MþïË`¦‚«ðª€ÑZ¨aU+,p–Ïõº¯Â\ÂU5Q}À0K”„‹\d$0cSºƒèÅèj_Å‚7/{ 8ד4[­ñ+,,ö‚`sWØÎâ\U¤h%Ph°eØÈ¥1ZZÒŒŠš[LÕ_&t$…§B+ Ŧçc!R³SÅ]T„]äB,T©DN>²ÄÍ+pl­äBe)Ûc&õŸz-TW,¿Drá•éyÍõܧª‰õ{˜¤Ih¯Î<À‚XêÁ>E¹€T-uUg,èJÜH^Ž¹9œ +3«É q1#mçZò¿+LVS}öïÊ…FžéÀÕ[¹°Ò‘T?\¯‹\ЖROÒKÐcù"f'@Vó– aá5­€/caÌ{£G’3vE¢Ã98fZTe£ £Ë~ÁRFf¬°0ó!jØ«ŒJô,kÔKVÚ°®C¿†’5  ™¬ÈFOc…\Š¤,ÂVÁh͹Yz$€½Í(º"4ïÉ›%…ô•\H¸&—iUÇ)§i“03ÇÇFë¢ ¡U,#–æðúÖ¥þ¦4s)îu¨äÆ®îÀŠ\Ù®^—ŸÂ”Î]mÊlé{3ËGœ•-ÇDŽ°å +ï{†ü7šDÑÉ 9Ü ó¤ëpÄþ8¶Ù sYÏiuXÔ ë9#æ¡(6Ætœ ¨€\ñá#á'3~$œ]¤ËY' B…¦&_C¹äptaIïeœjRÍÖzX¶9Ÿ™5f˜"†´×€à ÓÙ`—–˜Xðe¨C_ŒÉGøxÌOùT{7ó°ËÚÕn–¹ë»Ô:*õÚ¦Ÿ™¦g™÷º‰}AR/s¯Èšk³æg‰¥¼Ó=>jQšíe™-TðÞæ¶8v…kuÜ?/ ~žqJ.|.º²Ð=*nÏXˆm§!f'ÎìÄ™xNdØÑ4ïÊ‹ÉðhÝðÇÃãpÖÖ%ÙÅÔð™y5kt¸7Ò˜L=³çWbÐVWãòy5aá…0ijBÝöºò~Øv^E$‹.@gÒ|‰§¯±°½ïáÇéf´õöõv.í¨?5ëÇ'%ºÒ±(Fïåìn×™‚1½Oû‘>IöÚ—Z/5¾’ïßšõ²è¥^}cQ¦Ïëù‘TQ;m´ÚÆ‚¾Æ‚³øU¿?L!2ú×zõ½A¦óëɵéËÍ˾Aõ·~ fø¥㤈XâýXH"¢E.¨Mª${Ý"ÙÓX`å—V·(>Ñ™‹’”i¢ÿU.h±Áɾ>"¢ßh/¤÷<Þ„¢ß.®2ãeš:ˆþ"¹cnC +Khw7ZÚ‡±×®‡ùøÃGËñ&]w9äÎÅÄ.×èCÃOZýA§’iëFDìò«É 1~ÆÀ}çL›>Œ…*mãó>è&²‹ÞÙ›ö2Ýà9rD¯ ¹våKb—ßMšƒñH­c›>Ž3t?*‰|hYh}laÖ¬Ñ$|†ýÁ‚)ªx}¬´::Ê×'º‹öQߧ¶IR”ã¬j\X} "€;*?¤ðð¨[-Ñ#,$ÐàÅl*úJ:¡’¶ªâdù,t‹¨d¬×Xá5cSá ¬Iûùë)®ª­Á´´‡# 3Ç[•#hB(QvG=ŠãH$áµ™¸ÌŽáiHfaAäk•P¯–Ìf ‹m,|7XÉ+“ùW‰…Z¹ÂÕæÂój7¼†JÕª°²³7VÂäæË"0PýÏd} 8M“ÍXã*3‘uˆ8ÁüÖ`[ )€á±–“œš Y`)°€Èä4¼¬¶Ò“½ÎG +($, Û2(±Å9ÏÒQ´ṅËåÔ8¯\ú + ÕUBa ùÏ«uJaÀñdÁB×ô3bJéæ©æꕬS‰I›, œBͻ뜕½K§IUñ² +ååâr,t7Û0,æDUõ X€@þCÌ5¡zx„‰…ËÍa{ËÃ8§™º¹úË‚ÅìÌâË©®j®ÌX%÷ æd#ZY#kq•–(a×XªN©&YgÖ†¹8®W¥#éP¹H }U €K˜Lõ0«Ù^.x:Rw‚¬eùT.ΕjC°€¤ °XG p€2\™ƒe¿¼…þ@ªlåÖh‰çÌXPÒ°P®±€÷Ô Î×"Ì¥Š× SR{/<%F ¶Í $ ¹5àl¯<¾^×RO +–Ü`!• ,§u‹Ås=ðõV.dªÈ’P‚Z¹×Öªôu¬T(,aÎfK"÷ÚDùaYÅËU¼f,°dŠ¦/Q»¹  +íµ€|’ „…3¹ © fÎx²ú;øN3¶Â‚/å o s‹G–þÂjï{¹€ÅèûÕÀùµ8Ó]fkK»Ø/#À¥¯ýHʾn@ï_c¡1Ú,e¶r¡“!Œ5L‰äÂï¡$™’r£`åyDųr¡­Ž+6xº.ŠåÂûhËUXoî/0oôÚ)qB·XàlîÆã†÷0Ýú‘Òp4ØT¸˜R¸4Ua ëdŠ]pKI'º_€f,öøK25™ÄÚŒ….„k™½4}ßÈhÒLÉHrá×P“ÙU†9FC·:TÞ²£/ø‘¸f’¸ã˜ç!úîKo sn;ÀØÒ\òè}Ôrn¡Êz`R#RÕ´P9Z}½×‘°RïÊSŒÁÈù˜¢H˜òÈʯ54©-üÚA¶U¼t”b¦%Þ¿˜¥–uÁ¬qɸnÖraŠ¡~.Š‹Í~$»S†–åºØaªÈÆÜóN÷NO°PyœU;u¦ó…|Šj/Ï3ÕþÙÊ=tÈ\=‘8ÊŒ, &Ûý£4²Þ XK|]„³Îu³7÷fÑÙ,ÐvŽŽÅÝÉa>¯ä Ó&zO, ÊÝ"ý#—:þ2þ-ÕãÇR&ÚŠ5=‘ûNW¤ê£¶óÓ`[ã‡q@.P˜Ñ#ªÂLþm˜èBúóKc:¶},Û2¶rJÏ$z(än†êLm  ¬î¥± ùÓðYÛRz&ÑCÆ’.LˆêAs1vòmœjÂývÛèàÝ·-ô3úËaèOa|ª¾ª†„æžðü/Çko*»²öù¬!“äí±ÀÉËpÇÂöa¯-o^ F>È?ììq·?;ß×™IN²ñLô×umyÅàB¨»±”.yÚFõf³ê±IŸQ)±÷¦*ÌÍÌ +Å®i©çô{âü?°€¡ ø‡÷ØšÜô$ôü öÒgMõ¡e‰²i³)e–UãàÏ4;5Gê,òîrÁŠVíΓ¸}©ý… Žþxi®õD«DÎ#,dUšvfàa…|FE ‡ÄÂô¢C®Ýžjüë…=ñÓ{ËëYÑþÿbá³H?Æ‚JA˜D¿«ÖtwŒe,þ´§°~p7œèå±À®ºk›¢ôW »ºìÉY'½ú¸©»ìßµF•Ô®[GSa¨³’Ôv]{\j†Æø×¢['ÞɈô &Üb¨ùÚ­.ÅqusÅìƒO‰WèÓ;ZÆ +q8üÌ­å‚ây]Ôh3-WÞ¯¨½13®|ÜfÆ‚fÌÓ;¢,¤À¼÷ÆBþU,h*Þ:ƒ.­ã\¢8 ¡†Öš˜ô ÕSƒÑÅï]-Ç `Yv…Öîe„_c¤tóle/À!÷âw¶nĸ«~á1Ír Ç…Û£UÀ-†JœéÅ+,¸k,ØÚ Ðdl~1xñ´²jÑ÷÷zjè04„èµ(êRö5,DÙè¥e1B,3³ì<¬Fµ$ÒÔ­PïÍ ®  *žiùU30ï†3áÐ6A3q£0³†³ ¿ÓÕwXà84#…×Ë3K~gw‹Î÷®Ù£æ×£5ôSœÃ ù™K%±Yÿ5˜¸™zÛP¬¨ç(é*1.bÁáF…Ö²åé¡õœCý :Á‚,‡ð5TX›aÿxh *~…’ \‰1E–|•û‚Ët-²ÒRHüLE…¢4Üc‹'áé†7¶–’Dp·HŒ+La/ÈÂL¢TØl;w¦iF&BÉ‘»k=JàÅ…‹ ܲ¨Åá³Úx  þãXÎÎÈ\êZ`Ê¿H&.E6D¡€Š¡˜Õ˜MKf¶“•Ã°f¶Z·½= qÿ•Ž¯/¾L¡#AbšÌ7C,$Ùxv\¼øT-aGƒ…/F¯Üaa– æ(üâÓÚxI>vÄ& P$HÚЪ4E +L/Ž¢bQ*¡CH>ùÍIZë¸ä‰ÖØΨÒ÷XÀòx×ÆŸ·Ë¬µ»Ç†LÅ(:zÉÜP8;/‹Ã54/ãÿsW¹L«½ðÆ4Ë~‰Ø  O9~yD smYÛbœ_LBý))g,è3Ъ 3OÈdêä‚‚½Ç2”u‰a'ŒShYúN.¤3'÷°¿P¨ræRJÃÞø?#M­ôÜ&èNä‚»q‚ÒS,8Ä&Y.äR)‹He¾wà¼ÿr! Q.x;¹PæcV§… k¹ Ÿs,ðÓVEÄ ”lj\ÀL¥HÉ‘ öFéÂlaçúD.€ +WÀ€Ëx·¯âBlò—± —ð"Ëcµe…ŠùV.{a/|1n¯j,¡\¨çê+gX˜ƒ2;=— h;+ËbÕ£ÍØÈ…>T²­Ôœ{A$ŠF}Òu1"{ácÁóíÙœ3;zˆš\ðÏJ.TÇr¡…^4 P²È…j° ¸`Ÿc¡Æ¨Z¸ÖŸîÈ…+áà +kÙ=ÞÊhfŠ`HlYæ@.0QiÜÀ°“¢Áy±æt)U,Òªÿ8˜7æŽic½/w´j³Î±Ÿ‡ØŸšå¡½ …£Ûu† +,,r´sÃ4Âc,` ·`0v*¸Qá Ï4•‘½³½cfÛz>†×3?4NqƒAW!½õ¤j÷)ÿT@Hþ8 tÝ({K:n5c«¨gäÂTã6²gŠz{‹\Mv=ý\.@M<ÜwŽ§S¹€ñ§­<3\^Úo48qØÉ›nüHó¾ó%Ÿ4]O<9H&FûÎ \© GÕ·® Ù¸@K±É_»¹Qª%S‘â7e‡ç¶0qãu•L=7 åqy|°¸ãJH3ÿ¡u¨Á&Îäã®7‹5~—DŒ;Åx7–:&“g®cXÛnÑš4ƒaÔé:ĖÔ:ü¢àç ¢¢Öa2<%Ó‰,«!.ùëX ºPaH¼ŠÀ , ƒž¬ÂëR &ÂÑô°1aˆèWQ©qj½ÑmáCA/„èÏRo…ÐÙf ù_aNNt¢?­-DŠÑ_¦.\jkQ­¢?M.‰"¢­`°H,‘` ±@D4auUò‹ˆˆ‰"",úEN$""%H,¡` ±@D$‰"" ŽœHDDHìéêôDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD¿™ÒK@DD\Dkw""¢,[ôý] + :+‰ˆþ81°@=„ˆˆ ×"aˆˆ°@DDX "",ˆˆ DD„""Âaˆˆ°@DDX "",ˆˆ DD„""Âaˆˆ°@DDX "",ˆˆ DD„…¥„EeÜ6mŒšo} ç c*Ë¢ˆX’¼8Š¦2‡Ëõêûþõz †T‹…|O„¾ß‚…ιžÐh0»ª)_Qc^|Çñrç¤í0hŠoοÆÄn¿ I·f¤[r€.C_üÏR¶§HèÀÁÄScÿ â}Š&!¶}Y¹°a®Kú?¡õ×ôä+-püóñ?ÇÂ÷ɦ];âÚwÀ2×Eû®¤ç QwŠ$ÇïÙ›`!‰Í³§$z=,€mšþ¸•X¤¾suªÃ¯Ì ”N·oÇÞ â) ¯ƒ…[[áF4¤?+íü~ˆ…ÈtÖ +?úü\ü8‹“½>¡ê^ h7¯lSßéÖhvpnGXH–is[Ƭ4Ø[€=†¾ü ÿ”Á¾ ¥ïüó©>‚hÚÝÿšFÓ´ª üyþaÿa)`x„Mñ»ï›Z±W¬M/ó·Žö/± è«X¸ú„…—‚Óé?¬Y4ó«tœqÉ-¢@âÓ Ž\‘‹-áÑ?›žf +*¿ø”‹aÁ<·XÁ ½z…ᘓ~CõïÌE„…¿ƒ¾*£áþi?…6HÅ.8]“ZüKñâ?aá½°0UÎÿ`1œb¡Ðôýæ\–)?ÓJ2ÂÂÀ‚Z‰ÿ¥Îñ<ª'æ,Yìg%aá`ajœŸg­3,$rÍ¿¿ä§Î{(I„…wà |©¢Gÿ;Øà?¡¯µÊ¯Ú ߉…yâZþïXˆ.ýKùŒZ÷Ä„…ßé˜ñý“jV´šÖWšÖÄÏHV6üô^ÓÚ8J>Š…Ë3X˜D4ú½ ·$Š˜DóÔœ#~®Ö”Úa‰b|Êæü! ï‡MaáHå`M:\d̆s Lí>—š9\œåôjŸÆ8×õZ*•ÿÕ÷ñN.øíÝQ*ˆ¹A†Æ~®«9ßÚ-Ž+¾ˆª`—Ë‹oûè抾”o¥SÞ?O)‘=ìž’èe±ÐH,8·XÀ”š%n ÖâKŸÝ/iÍË:‚N猰A,´Š½ªöÚOõqm\Ñq4ÓL?ç› SŒ OŽ3Ç?U‘0ε›·‰„ðkÍe€Ãû³ËÑS’|x_¹Àúƒ”ßñ»cÿMÑùG§;Ã:˜BYêÛ„Åú*0ïóv|Ò Žs‡{Ùe<à8ˆþøâ¬OÔGÕÖ‚Çà{ÖïŸóæþÇOIXx,ì“Ò+È9{«¡-ª’3DGXØ&<É¥û ø¾‘ųÒèU±°„mVÎæºRw¯§Ë¢Ü&ÿj%gCÆ¥“±µœ½0o¶Á´Û‹†rØÎyXÏy‰+°à·Í.…®}€¿¯ÄŽti•‚4ƒ!ºo/Ô¤#½:âëѾssùøjj1·SYÙ¤ÁÂÝÛEnÎÀávdƒg³(ÖLgŽ£+g¤âÔÉÃC…”.–J;¯äPñ"úæp¼gQ@Êþ.°píqoo^â=ÀÂ5À÷ÂU®†ÁÜ’B›EÑê²>ŧô7OÙ÷¾8f.^{(Ëy™÷»U ¥¨¿8‡¹4’…¹6Tl Ù9a»&žÇl¯”ΡÁ>ç®ÙœÎs3W¾®Bé÷kç@§8O:θæÕQ¯àð97ÕXåûÇéE´¿ðfXP ñæ—ŸcAý}ŒY q6ûaj¬½¡LÓ]ìÐ,Dƒ³-Y3TMñ”íÐÌ<¿uê$½|DµìO«½vH +⇕• +¿ƒ‘F´Ý)Pqïû-BÂÂ{aaÖó7§i3näúœš¿¾@î‘$ÇÍA¥Ú“XXDÒ¢l_†ô1f»Ç¿ ì«nvPé³²y¥’ÝÇ‚s“[¡À°—~„…wÂB嵩µÙ¿¶ç ÷ÚËüåƒë^eš>‹…=ÌxÐüëY”’sŽyƒ'(Îâ=,¬ŒŽµ­"ãfƒ°ðjXàܳ§®ƒZî›Ú[Õ-[æDƒ¿»H»“‚kqÁ’éY?’rXÎ1|Ç7›v¼ŸÇíj½‘ÑÝͽ‡_»c¬l÷î ¯†…94lK›êyÛåQqöp¦ôûš†=ÄGƒûX'ÒÁlÏVþüÁ50Ó¾)÷~¤òƒXð‡èî+I ¯Œ…'ª oƒuÌGÁ¢³>¢8©TŽ3ú.,pö.µmÜë:>°b{f—Áñ’lšë¨±bጱÕ­Åaáí°°¯Ô{(ïwdýfçϼ:AÿÌ^ñSX@/g“ÂØAä©Y*ìO&mwGÞ­§äBs×£»ÙG!,¼ ¦z¿&SPî(<é^rTKì äû°oÂrYÙ¤Ã-vÅÄ4çCñoÝÝ,Ñ;ñH§õ¤0]÷/!,¼d®Ížå[ßTURÛûë‹Ë**Õ¹i{W<| ˆ‡BC<ø0DèÔ>†íƒX8·¡ªÛ;ÞÄv†…ör›ƒ¹bô;?a{»Ã°æSÜOèbAÈÍÜ8—Öª2¯íG°p¦ÞÁB÷hy¨ /Œ…Ë!Ô«ÿ†Á4Í´×â㸷þ1äÞÕj•LÒ›\/.ª†}Pü4æe•2 í-˜§‹ÿuw«ÊßÁÂéKin-«aÁ7YrKw®««ÞåíÖKçpkìh§ø³XçR7g®­,šÙt-?„…“Óï`¡",¼1ÎkÎ?ÀÂêCÅy-{íܺ?‡Û戟Ç´N&] ü•Òû4N_J¼7¡ /ˆ…Ö†| UÞü­«©¨Ž6‹¹…~Ù'l~ KŽòòhÑýí…ïÂö aáoaár~, 1N·uþ&øËX˜£1ðÿc¡%¹ð ±ðŒŽtc;ÏšR¡A_µ½xØ…FŸb!aQQ>æç›26ÿ¿ŽDöÂoÄBÿÛù¸ZWÜ›Ánsl»[qŒ…bƒà Þ‘b`aMöT!Öi;k·é<„…·ÇÂû ñ£2õ<±ÝÛ¦SbA1ƒk5ãìöݯÊôAŸêDZ>U´¿ð›°Ð<ö?©E°»w†±usÞÜ:™ç ÍýPÐ#=N±Yb>ìçó=Xè͈öâ«?Üà©-i=ôÁQÙ1b•»ÿxq¿Ù|hðoS(>…ÓÀŠGúXˆÛ¡æóÑ?…yÐë ³P=…êYÅ.ºTkb•1ýY,œ,Rœê¯ÄB¢’ûµG¦ëvOXr×Î5aAå–>‘t#TÓÃ3a¦‰Bví‹X8“Y”¿ð+±03Z÷À¢˜y6‰ÊVKÍ)_+õâħZ=Û¡S…-±uÅa–Š¢‘ªŒüg±p*³ŽbÆ ï…æQoÀn·¯TÉÆí}§ÓC,̉ÖÁƒm%ò ë!Ûm” 'nd“ò%éíŠeg¾ë{ÛÈñ­ú °°ã’ļ[žbÏyÉÕßåUYSoö} '‰míц aáý±0ç3‡¬²¨õżò‡dlÄÌfGö KÄý’ó³.ÕÜ0Þa½²[cÿóX8„é ÎͶ´ŠTéˆkß Kémv¨ï·XU)½{V6|¢b8ºž‚¡OÕ¤£ú¨«Ç=äNõy,>¤v¨U*,˜Äµï‹…¥|ÐA{U~ÍHéa ÅÍ‚½)¿¢úuɱ®!Jþ‹†h®›½±BHws]qÓî X8ÈS¯dï#¾<ܨ!zy,Ì ·ºÊÜ®gýÃÏ‚d¸YÍ#ó`j ã6d¢Z•œÐ-=äö¶˜Oaµl Wg_p¹91ùÙs]I‰^ K¡mÇÜ°ËÜlàXAá«ùîwW[mÛE|.*3`£„UšÝ¢%Aמ mVy¨I±ê†r[xU2|;Ü–‡ý +®Îu]9$Ñ®'ý殤7OIôFXH–BÔ—jnF­šÐ–”†Ž8«¤Î¤œ{—l£›‡ÑÕìRs¨nõÕÃ*ºª× Ùz7¬ é9ªÊŒÓK¥ ””ÕåÀêý°Ù‰¼kç7\óSú×a÷”ïO‘1L¬†ùiTéa¸ËT Ãü²“.€Ï&Ú#uì­°°´YÀ&U•Ö4MßKs²ks₤ÎNãçkZº„æíñjÛËl=ÅmgÍMuÕËëa}ûyœ³VLá >UÙ®ÍLáþéà/Ö~tªð‰‡~“`0FsŠóqfE–ã…kËÖÈ!oŽc8¨%-þ[éãLÖ²ŠÕÎ`a†…—EùÒÜòÝu$\.¸Q±Ûmræ }tÒKw“t9ÒÁ“jÕ]ñf +ñôX0U7.IÇåšöž€¯5­~AªB—kÖ8fò§KÃ-F}Ä‚åIÒç·^?ÇÉÿ7ÍA>ÿp•ÃÒSöo¬ˆU¿ÎžLúë}48§×þêœM¹œ¾ þµìææV’½û”ïM^È#.±S|ÊP`!ób– ú3¿N +[€ÎT)|I9æàCÎÝ4ßñ÷dPøÅ?Eâ©»–âá¸IWLß‚¿<À%ýጊÍS>›\ñ”Ž.üLVèJ^Œr+[Ë…<)/2+l± X$K,&,âÿH¦R› Ô$Ö¤a–D‘ŸOcšr} üYÓ]ÝF¬Ö¥”æ ûX¯õˆOÊÁY5"ßï_%1ðŠj8CO×`ÕåvÎû’±“x7Î)Do÷C¹ñߎ³ëq¶âó§\©mý¯Á‚ |X¨Ã]sÔ=8ÖJ,d†ä}{4¬¹PxáZµaøOÓ²'#7m~ÐnNÈS]žÅ_ÀBê_€®ÝL¶²‚D~ÉðaHËóÛ%qøÎæüKwR:obý , ÿ ’)‰´N„üùŠ@;Nï·¼bqãåó¦dì$ßÍI `%¾½Ëè4¨ “\w§+;?uyÊ_˜TZV)°zBIÒGÓ[Ë…¬s|Uyž†'Xˆt‹C0æ‰ÀW VEèÙÙhÁ«òÃ1ã㇧é2ZÚt$.|¾æÁb±ùœo ÑTû°›fܧæ κª¹Wb˜•Z•¦iÕ7Ç•W~BŠƒC%Ì`0Ó>~ªûùxþÃÁ£‚SÄ؇/û®9ìä‚\ÑGçô‹ªºaߎ $ œ%·öÂTã9ú˜6áΧZïlgÏÄóõÑÃçü.†øÌÙ_¶‰¾ÕZtî4µúk$Ù³ÆÏÆT 팅6´ +¾æç“&±’vrâüL~¹ g ÛÁã€ñF½ïºN³%& /†Ÿ°€ª½!åB:’TXù´“ Œó²É?Ø '~¤Ù§š×©Bù¢óO +lÙ,HrÂÉ…Ç— éÄd®" ‹½€JÎ-k-|´¿Pî$ì}t$ ~?×0lþ?Ã!,\xq åçÙT¤d/š0osþ÷c¹À-Š6µi¯#Òüœ $^×vvg¹ÿȳiÚÙ yý±\àrÆ=2O€#lø}ÑY5Ù¡AX ¹ðªd +^ÈÍBGè\˜œ1 «i– ^jJŠLy-¸Jƒ1Þ%ƒýJ€Ãaeó/ŒíÐt;",\x=*,Ø2€Ø¼ØHÀžâÅ^fyÑï}ªã¬ÿ2†/ÊGܼƒ½¶1÷øuð¯!-O†Â^q ÂÉ…4`/\ô’?&vÖÁ¡Œ3¾–é äÛp}ë¹\Ô™—Éÿ²9<12Ë\­+C¤ÎÃÜoYsóÐò® )¥xÂÉ…—£þÔçÿA’É~ÞhÎþ#¶ÚŸgw›qH.¼¹ãwWɘŽÅôH.¼i¡÷]·Šln 8J÷² $ÞŒŒ9‰óËjR¾$ÁÙ$H.¼±úÛJ ¥õ\( MKÂÉ¢aáÿ¡Nfä zYߧx¿©'å»à`1#,¼ÐÏ!ékÕYܳQcMæº÷Ü™–ÿ`$ÍûŽ* +U'»™jA1 °ð§ íî=ÏÊ%7!L:ìÜçQÅ>ƒ%þ5™¹óø‘÷¬íä°‘a`­ÂÂßÆ‚ãÝñ×`.Xdëw×Û$ÏÙK`ÁɧéâÛQŽ@f¹þ:îR6>áØÔB}z,\?®šæ# +½úè]~iµmÛèWž9ºuËÙ0L©­×包JÔQ+Û®…Y׶n_"(èlvP$Ã×ÌÊÐmQŒ³r¢’ß^VB7Æ©Z®¦'9õ†®²Ž›Z7ânƒÍ×2yãÊWõNYò«„¶ÅCN^±ì0$)Ÿ¡P0[CVFëù©NuÓòQb˜§8 ¾„ú],0Ym;Lƒ¡*§ˆåcÇ ðW”VN1Û¿“;Äèe/‚à}×ÃÏ1ÔV±ðkPXÂa°Fu´Wf V-ÔYÎÌt<žq#‡¸È>nX˜hÙaY¹§Š nl¹+,015>›ÂqÒ8{´ñžÀz±'&¿¨fœUq| åÔ€gŠÄÝònªðCÀo$Ìsö +¼ž_¡ar+† +mՆ♯¤z´ê¾âõJÓ¡^Ö…óXß×Ö¨OÅ%í!,Ë¿¬5Óóø&ÌëNÜ}* rHW‰ÅöÓÅ!Ìp´µ.WX°áFC6º+,Øpẋøb {Þë4Îð‹îUªyCE¯4ÝTÃ;c~ÑR>­ˆ™0[†:w„ežŸîÀ}\1)݉n¹ ¡žJ X‚´>È‹#,üÊD0– +Dr g§°à +öÓ×XUKá/éWºbk´eS±z2Ìãœ#«xh ˜\“ ÆîÛW± RDN1ÿŒ[šm‹8 :k¢}péضÈ/mø•~1õØà:­ëf2Åf‰¡^t×*ƒtrì¹ç¸)ºîò¿Ù|w~Rm@é¯B5‡‰ÆfÑ`ÛAÃP|ÅŽj½Öä½`ú«¡ˆórÏÏ•‡Š‹m×r; ç§Öü×ãõ%*M°Eú2)}¬#C]ƒ¹@ñH€‚UÝ­È +_´Ááýö³JÇù:ŠÏ5(Nõ¯a½+òñŸb!¡ü…?A—U`\d…ÕkÎR ¾ ©|Æaêaá·Qê-?=ÓÝö5géd÷q"Ýý¾!u¶ÏPb™;ˆˆ¨ÑC†°@DDX "Úa!³‰ˆþ> +stream +xÚ`ŸÿÛÛÛttt•••ÃÃÃ"""‚‚‚®®®gggWWW±±±¸¸¸ùùùõõõèèèýýýÍÍÍCCC444ñññµµµìììÑÑÑ£££áááåååÉÉÉÕÕÕ½½½²²²ÿÿÿ`a?[endstream +endobj +5243 0 obj << +/D [5241 0 R /XYZ 85.039 781.388 null] >> endobj -106 0 obj << -/D [2184 0 R /XYZ 85.039 766.606 null] +5244 0 obj << +/D [5241 0 R /XYZ 85.039 733.638 null] >> endobj -2187 0 obj << -/D [2184 0 R /XYZ 85.039 676.735 null] +5245 0 obj << +/D [5241 0 R /XYZ 85.039 733.638 null] >> endobj -110 0 obj << -/D [2184 0 R /XYZ 85.039 644.816 null] +5246 0 obj << +/D [5241 0 R /XYZ 257.292 263.979 null] >> endobj -2188 0 obj << -/D [2184 0 R /XYZ 85.039 615.412 null] +1442 0 obj << +/D [5241 0 R /XYZ 85.039 117.572 null] >> endobj -114 0 obj << -/D [2184 0 R /XYZ 85.039 508.283 null] +5247 0 obj << +/D [5241 0 R /XYZ 85.039 96.678 null] >> endobj -2189 0 obj << -/D [2184 0 R /XYZ 85.039 484.966 null] +5240 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F75 5171 0 R /F56 2890 0 R /F14 2895 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R >> +/XObject << /Im10 5229 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -2190 0 obj << -/D [2184 0 R /XYZ 85.039 397.416 null] +5252 0 obj << +/Length 1713 +/Filter /FlateDecode +>> +stream +xÚ­XI“Ó8¾çW¸¸ŒSEŒeY^æÖ0ÐÓô„&}"V×x ¶ÓÐüzÞ"/Yzæ0STu¤·émúžŒp|ø'œDy¾L8žLg]Î|g œë™° +²˜È¼\Í^¼‰BGø^ê§Îj3ÚQ^¨¤³Ê>¹¯þ¼Z®^ßÍRJW¤Þ|ljûê~9îG¦.ïnnW7·×¸ (Üû%²ÿº›'Ò]±ÐÍíȾzÿòŠwÒóç_Vog¯Wƒ§ƒàUŠn~›}úâ;„ôvæ{2Mœï°ö=ìr~z*”v_Ì>Î> ¦˜:¬u)+J&žJäyZ„š¤EˆÀ“"pbå{Ê)/¥™/„««y¸Ý|$‘ÛÕüû~b×à&v÷o“³˜þ +›Â@à uoº–å5ZÊU²JÞÛk‘oš´a­êQ·[S™FLà üÙãÞ­[«Ní¬¿›º)õ¸æEY7KùYL_Já¶l̬{_u‘ÿ¤d( }M¦BOúPRmæ +ÄÛÎÀ RÅnÖäýkYó(Õ‘ô’0°šÏ¹uºz‰+j†[G-Œå×Lá,t–š™‡|M.({® +ðÙ!˜Z³âÍÚ‘—¨®;í=Õ›Aàù‰8oÎ8msÊ“æ”g͉ù….õe@7ŠÖæYóöRÐM‰—*j^ç›3ೇqœÂAq@”PÄ°ITÏ~qS +áüQƒg·s¸Rá )†{+΂bC­Â(ö"¨^@¿Ü'Ÿ}åkø#NS'à>ûPÙ@FÞ1D=_¯²uÈ5mµ»èÛ|{h° B¬èR›Aƒ¾Í~?õ5/† Ï}soEN};:åÄžµœÓ•ì¨%× Þ¤}wÜÆHë{±´W ÚÓ6vèÞá]B²íÔ pù&Ÿ„†Ð}É?d|ˆF*€ÁñÐâR¼Ð¬©øox±ß-ô²ÁÍ¡°êý1 Œ˜kÈ5‚÷ؽ!7­“„väÀká†>dh&d*Ÿ3Fà…Íɇ÷ýlaWŒlàF +L ý×h@4Lc¶^óaòXª- d¯eŽ®2^Ð$ ›è&R†Á†ÄCk{Ó²`¢=Zq0¹³RäLQpójËÒï«Å¥IÓ5F—8*.ÙXoš4Oy6-äZ Õçšb@½÷°$.^³b‡*Cþ”·ã1ÌÖŠÎ3KqGH¹7W·WL£$!)ïZ¦Lg ÝíÉŒÁÁbœ‹„~êÖüMÜu}hz ³ÖuÙ¹0|ñ‹G–®'ça©!QìÃÂٽñŒûcÛV2©¦À,õ߶¹q—[Õ‡£†d¦áRØÃ5žhå•ùqâ iíLW7=7¤ðáx‚ºö‰¦Tux¨- +FEwbô oÆŽôw8·S÷ðƒ·½W¸¾Çun§­$ÄI+1mp¬Û™Ü.÷Í’Y®¤› ^íóKM¼«…õ$ÑØ#¯ÖsHÒ®¦\Õ}™eÌ—¦æe6.Û;<ŠÝW(:<ºÁ.”4uukmØZÚ-w^ÿdGþŒDÛ¦Mkñ +ùmGx‚lìL$5ô‚Ë/ÝØŸÜݸ5ÿBĈRô½Teµíl¤QˆÕoxœˆÜÊôP‚»Îš8v”4ãO}èXàqf2K÷ü´të’.M¾&ÿZæà%¯ø¤^w—ª×§ûpŠ`—®gc¸ð"Э{OU¨+æÖ•52I1læ+]­il-PíÌuä+õ¾4ý÷ò©4`‡‡#®¸H"ÊhŽ­.\z£!d ðtШÉÀ•~x3@gÒÆi ìÄ0ý\éƒ ¼&ogªÕ%%Ì~¾ßÓ›|ËNèþH¤i‹IHÁrR>A¨ð\[CÜäaf(V¶ßi;t. ×L²`½Â0¦úOœ p°DšJM +Ïöø èaÍq=ïeóÿ"†Æ"ÌסåÌôÀdÚм.ys}{ooÀyù|¶BR@«§M1îÆÏVØ䤪(zID‘âKN#åh" ïþêŒ^«ŒH 7IÚ'n(äÒg'®Þ€Öòå>Ö…o1é{AzùÉjðÿ> endobj -2191 0 obj << -/D [2184 0 R /XYZ 85.039 374.7 null] +5239 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 418 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5258 0 R] +/Length 26233 +/Filter /FlateDecode +>> +stream +xÚì]‡‚£8 ¥7Ó{ äÿÿò$7 ´™›bíÞÞ cˆžU¬Ò˜š4ijÌY“&M@¦9›‰¥IÓ§ÄD,XWMšþ7çžžúÚ!n åÂïÑ‘®vy/(i 'õð/ ûÁnoOl#TNŸnX¥"6Ç‚CZJãN.<ˆ~`™çAo}k8á:‰`ñû²ÙÅNŠ§®¹c«~¼¹bo…ÝÀóÒ£wÒãÙdàûÎáî)5}[, w°Ð:©ˆŽcr^hŸ¯„½zÛÓ/ûÔ›>½àŽ®Øîfû»2^µNû0+Ï–céAŒðR®³(Ϲy2w–/ô‰{š+Ás9b.)é½x…Ƕ=zãWä ¼›ö”Û‡ôCsïw·αÐÞ¦Ô‡'ŒÚiYÞf¢]ŒqÃ%””l"ä&É%b«íý bx·sÂvÿnè}j®ʉÃÂm<Q™.áö1oÇïÓòÞSjú®ö™Ž„i(G‰€†£ytÊ“L´tØ`á`Dco»¼`qœì3è»Á'î7‘íÁ¥]ßÜVSãÇ`ûR>ÿÁSjú®:’´·kÛž&—•é­>?†§éÂ(¸dáHï¥õ§i@°*÷GX06Ée¨qŠPÞì P–ûãñ5~(Ž}ªkÜš±~ó—=«®ëk Ë (J‚T¨{ï®ö ™(¸¼‘Õܯ¢‰Ý_™óVEáXXä®ûF4Þ“ x’Máp^tzGMC_0È&%×À¹ ÷;ráì¥,Á­BªåÂÃBP¦Ó¡r}$"%¤ú=ÊÐ §ý4,\Y?’ËÊ}ˆß–x¶‚Ø}Û=¹p4(ôJ\Z.ü0,€ò°ÝNVè½ä2g¯¬µ[½‡ù>/`q7!‚Û8ì­;Ç~2(÷ž§÷ ¹p&w„Ž“– ? è™ ÷ËÿK¬±÷ªÆRøñøYX xˆY¿ªà ‘c¿†ûE¹°Ù‘<\-~D÷Ë‘Ç~x¼Ä7Ú±z3æû´IÿYX`x06ÕOŸ/žÿôs¹p¾‰oßÏZ.ü?ÒÅKÓÐ1ìÊ¡O¨¢Nö*:Æ´Üï{çâá ,póÁSÇãçÙ2ñ÷«ÊßÉ_8})öͤ– ß AO;jïp0×ëj÷û¸j÷V< ýçaoc¬›ÒÊ"Ý?ULæYíßy Ã)´\ø6Xxù«x „Ç\«^r´=Fáp«†½ ]3–,—°p;rátÆÂÏj¹ð±¾‰…;f¨p5mÜóý»c¸S"@ñnR.> wüHƹÚxó¶µ\ø~:Ò‹wpÞÄ¢Á9Ú„ìv>†¸Þ_Ü? ÆÝÜÿcŠµ\øÅrá©?0oÓ£&åNÿ‰X¸ ¡øÿ傶~£\xÁv>Ü‚ƒÆýmwžÈ_ Æ :éã=‚›èÀ7mçO´íGú›¶s| WZJ’Oœ´Í=Æ‚ÍËm<ž°(;/‰uÏvÚzW.<ö©êý…ߤ#½µ×vÀ¯ˆ‡U:l¶±±0Ow%a¡ÎO÷æ}[.œ¾ã6}BË……åÁ¢=ˆÁ8³+Ô’)Ó#,óó EÇ(“6û3°ðξ³˜À¢åÂ/²dlÞøW“Ô„tpl/xO÷U¸Ñã)vÄ°eñm?ÒYN‡L­– ¿È^vèys³ýLôÏr9°*±Ð?_Yø†õ‡BÐFm- EÞÃÛ~¤³8U±€l4A-~ºŽô¸iš0Wfß“Á>©úèÜrø‰OUºJiý²eÛ°_ƒÏÖmV:»½?ß• §2ëÈÈÒráçcA„\žÆ'ï3Ý'L±ñB{b<‹Ñèü¡õÌë7©` ïFž +F\ð®\8}›GöŠ– ?Þ^ÞûG9\J&= ~=Y3ã>ÆÂZYØxòÑúskúîÞ– 'JÒ¡XÒXøñöÂZyûdy¾)R¿Ü=?>·œcÿÔ£þ R~Ø·zÛñÃÞ¾x[.œ¼NçȱF. ?]GŽþ‹A˜ w‚âDÏ?pñœq IŸƒ¬Ü§VïèïX,Û½oË…ãœQ+yûˆ– ? Ò¡s¤}“ƒ; ñ("ž)¬‘KWÀwú~!Ö%»ðMx/h6×w:_……7䂪¸«‰8ÄðŽúA6 7Imx“j ®ápº1 ¶¡põ°í¿:†cçôý(ÉBm1×Þ@êœeýdU +}D.ÐŽ+ò!û5³(¹GOùKÈ.2xÁÅ8Ù&c‡–žOc·/‡ÛgJw7ÜS§¨‚Õf ’·5’ŽºŸI ;5Ûtα-ë'oäÈûrwkKÙ;Y Ù·ëÀ¨Þ?å¯.²“ ¬[Ié±YÙN~þr{u‹´Üq£Ú¤é@«*o¸÷œsÇMÓ× MλéÊ°Ç.Wµïn +[îýx¤!,Æ/½åÔ…v¹\~§ Ý ßƒ\ðs¾þ;scªrÁ´8›'sr†Òs—¥Q–²!²ü¹F jTÂÞ×PÁÏ kBŸ5ã×ëHwX2(Ãø…ÓѶO=UÇ#½‡ÐÚ΢ºO<ÆëõäB><*÷q<£ÝS.¿ +mjÏu)|§cJR5§¦*Lg6qMïÍÂ9ÃÂdú³_\"ns¸sÿ™ RŠ­í«SÌ`]ÌEH- ?þ_°@[`Þd.£ª<žð¡wT£<®7l«53n¢7F@Ãp¸£l,·¥inKƾ/‚ñ¶½ºOfd_î=å§IƒØ÷¶þE7nåBÏ”$ÇB¦Ôü[K»÷ ÚÎ ½+8k¶ú+Éæ Ò͹öÉÜÁwe¸Õ{r!ä)“áûO;a »v¬1ήËÄHÙéëù¥çœ8’c>4Rt«sC¨¶Þÿ¬1ÏŠ`ì+­ÎáÞ\ÂßMp‚…ˆ}|³Í§Îmû“ƒ§üeÐ5ò*ˆÀ‚Aacnå°kBåE¸p?’¤hg/¸ôÌM—I†›0y‘)¼Ž…ض‡Áìé#ÏK˘z´ø*ÆÿŸÞEž¯A3 í„`à†¡cò$Y`0vsä[l&b Oèܘ]Ê/£×u‘cïæDÀ´ìCµUµ"èÔ˜‹srìñÁdœôÞSþds`/×nð€?¨ráJAÒw06ÃB׸ŒœR +€ /w¹)nÎHÆišúZúmßÁ§ÑØbW«a˜Æþ¹Óã…ž“‡ç?lÞ“–v|gΟôö¹<}KÇoŸz%¿³Ñ¹Ë–ê•$Rt`låU’¹ºÚó?éIöÜx–Ço¶f¶7'ݳÿ+4íå‚&Em¡rŒd`ùDÀV.  äEx5úT-@LB?ßbÁt3 ×M4¾. Š\¨¥\;i@ìå*I}Ñõ圉–·qUu¤’þwF Z.|Â…\È4’»îz+zÓÏÑ*~,®p¦o2¹W欵áCúó57#-¾+Ìœ¥r”$YúF.€ÚSø`' ¹ÐŒ¢³r¿²4õG]£¹`Z—;ûõµº4 ƒSàÿ–Èë5´\ø~4øE+± Àý¶žÆ`0¹àͪ>,(ÉÀär¿ üÂãDó\DTP¼PÏ«ïZæÜÙKsf¹þìöt¯­ÕXÐrá[ϸwÕv”gk•™>+³mcÌ6•™Ú¿]`våœü"ÃàôJÑP“j,V 4gK‚!-L-¾#¥Œw¹¿˜yÜ™÷¸ï•”_йLãT·^æ‰)LîJÿÑà¬flGÄÈo½ú Z.|2ýÏ ±2ØvóêGzl¼k,h¹ðmçqâÕ³ÐXÐráçQãV¼áˆÙq½ÀB­± å£© ?k¨²ÉE¼ŒÙ Z.hz4´\Ф± å‚&…óåX1,||NÌŒ„jÒôí7IÈ>yZ²Ï-ÖXøcr¡òKøÖýòÎ)È#m×ÝŸZ4§îîW<ÐCLÂÓîãðúpÂøŽLcá;YbJ_ž“CíîA†£Â;_•1ó%8^Òe>Ÿêù¡ë©¹)ÖÐdèr·ï ±ðLjbÁ‰ÎÓ¾C,ô—à.LI‘=º“7g_ð<æc,8{Ÿ*)fzÄ,…¿Ž…»j¾(ÈuŸ¿ï_y_"²ùõ- BÓ©1J<ÑXø­ŠW™u™àbg¸ÎàÂϨèôVMj³céñ ûÙ3\ÊJ½ç•¬–FãÏY÷–…[U$7Ùa0šÖÉ`ÄI(Rq“0ÑQ7CoåcdvYÉâæ.pb¸‘ $ÂkGË¢&µ‡S¸4vÇ#º+f[&Ÿ°¸æˆyÓÙv+Hr¸ªÈM1g½â8ÄÊ׬ÆŸ±l†&õønà­åCA4~%ÅæìÅZúqážÞ†âEÚÎ OAâ½\H¸3(€ÿLéÝêé߸`a«À¿8èÄ%L„9ω(³Iç`­D¶ó0]‡‚y8È°˜€ð#]'1ªÆ¯CÔ˜ *3,Ð4Ç+ÖØí}ÆœÀßöŠ…pîV¯iT^Ù)r¡>cIÄêø[˜©E-¦ivm@Aå‚8°õ“->ÛáX%–@.Øb2ƒÆÂo¤”rSã2,X+¸»„l°à‰´/\y±œ\çV;¹`ò½å¥ØaÁa¼=È~ÆNçœXÊŠñæŠéÝÈ…µŠŒ7ä&µ5\ˆÔ €K锢Fʹð¬³;Šýq W ¥âu7XÀG—r¡?h,ü27R17Xƒ“öÕÊNÖrý U‹üLIÑ7 +¶§³Óa`DÉ€› ßãºI@»öZÈy„ÔÍ\a;“jM Z¿~EÈÏqÞ UÈÚx$£·ó:ú3ÎÂè°Ée=p-qœâB'ESø[™<%,hÐ]è•ÆÂ/¢ÞH±o:i{j;©32Ûúg®šË31CtHSn;Ú)†ô³ãÄ°{‘Ë3:oÈEØ5};^Ã5ŽŸÖ‹Ó[1°CzÂ(âûZ1Þ«ÇáP{1R,Óo7Î?ÃPî,©ÌUèíPüÜؽe\Ð[Ñiðd":)…ê­°\˜³¤ÕXø­ÆÃú5…ÿM[»5w£]ãâk‡¥l4ÛW…ß…Þ×X8ÂÂào,4~«ƒõWÈ…á_bÁݽ…ßIC½Šÿ>Š¾i[ô°¾—64FÑø‰·Ú¯­»KúÖXФIcA“&Mš44iº‹…¦o5iúãÔ7ˆÙõJ“¦¿K>bA“&Måx©&MšRÏÑF“&Mš4iÒ¤I“&Mš4iÒ¤I“&Mÿ–H™×yÿy£~šþ4ÙÛ¤ñ»X¿ Mš.ºûh,húãr¡˜Ók­ 44ýy¹€¹”å¦v¹&MU.\µ\ФIËMš8ŠÙÌܬÓrA“Ö‘¸OÕÔXÐô·‰ÔMUÌ]ÓÔD¿ Mž\Þ-O“¦¿N™Æ‚&M š4i,hÒ¤± I“Æ‚&M š4} Kt¼ÿïïEËÂEŒ#š›ÆÐ_¯“aãŸ÷b¨tnÖýþ}ÓõcT§ÙíÙ„Ö‡ìm»×ì ±pt¼8æù£Îa*9—S$$4uÈohðS#²†´Ér3cƒÌÙ/L6þàúxvQß0¨ëï[€»vMWlÉ©43khSæ|ÊžvJ—¦¢4;ü2ûë8,‚…ÚaßÀByÆò°*ŽwÌgÎsVY™?› GÔGOiûzwöÍ®3 Ÿõ\žº¹Èš®Ù—Ì{, ÝÍIù¬`¡œ7Ù5EG±°^Ø~fO)Mß‚œ.O‹y6=ºbfØ&¹î_ÅBKYå¥Ã»±KÑzsîh‘C§˜³ ÂEvRîHC‚[ 1×Ò§aå«pÁãÆî÷€é­YÁÂo£¾Å¬¹›mï8ZGúeˬßáòa3ïÙlàÇæU,äëê?®Ò«Ì2*âfý`å®~ÜXØ‚ ‘O7XheWq¸®ƒUS +9¤òù¥›;ƒ…¶šý\á¤bÅBæ›·XpV,ô;ô¿ ³ lx™Aý­¨rúw¤ÿ!úŽöcMÍ0íü¢A&ž²Ú1 —ä&2YŸ›¾oFÈ5aæ•EÁ•ª˜ ”ó¾m§Kˆ*¤žR¹Æ±\ÜßàéŒNSn„K3,xs^¶XÈfw1%ò9±n°w ’Uˆœ…‰6q]€d›tø`º.ȯ pfœï0†ë/wj¾b!d=eëÙô;Loæ³çt‘¢wÑ%°’éÏÁµ~=h]´~aYE§3¹eÀT«y6vvlj\¸ÒNKÕ\D·ÎŸ¾õ©ØŒääí¦.2zŠƒp,8¾ ƒí±à<]˜{*â=hl>˜«ùèwÈ…Œ¯‡î5»¡f.ÈÅFêŸÃBÂñš‰˜j6û«íÏ]ê„ÌvnføÑèðÚ€`¤¶\…]¦+ÆÙÊ£ŒáÏ° Ê…ˆªPX͈¢[gV_Üø‘ÊÞíF¬êÈ^èF6÷‘ 8!¢9?³®ßþ;°Ðpå4b •E<Èy Ù|aX  ªF5p¸€žk¯Z{Iyï®\0­ªª\á9š*šhTX7é§Åü R.PTçöÍnµ}brÁbo£L´KéwèHŒ1‚9)0DðT7€Y<…ŽqRÍ?ý€aöcÆÃã¸u¤½ɘùæD&™Ì—ñ\àäWüÄ6µPûê€óIKào.²¹À„ä1¨O5c^³y`rŒ­,Ò8øm:R\Ù#KÆe|72Žãs:RÏ—ÞšïQ%pÎÀù± ÞËà„hÈ éܱß,i€™vX¨ä„;Š3Êó– ™‰íµ +£ÂÐŒô+t¤9k‘ÿAAwé±yg¯øP.H©’:’í ¹ƒúµÑ‘nä‚#"wUN”û˜8l"/KøÞ[µÆä" Ölç: `÷ý¹\ÈŽåBíû"T½šc{ba,¤\ @Ì;íHú%rÁ÷ t„:4:ù>û—°œä1,PŽ¤¶³*l¾Ýeø°žÈÂ…@«oöSq +š-Î̾ó°Å‚á³Ð{ oû‘È€Ô‚mBÚ§äBÒ¥Šš‘~‡½šEáREi¨ºôƒ;[G‡X¨¤O5¡šõ©®rå üÒfÈJ[¹PÎ&Á+ÀZ¿ö®\Ýé…~Þbí Ÿr=Æd„äÚ.Óé¶XÀP½I»›ù ¹ÔÆ Kõ;?ÒêLBÅkݶ3è]9Zi/T³Ù^UNÓÏÖ‘`M‹Wî'íݘ‚C,¤b¯ÍŸÍÆä{m +b;®[н´­\p0õ:føy·Q»9¨½ ®Ð ¸u× ÂlÜÍk,hÒ„´›i,hÒtÅèŸÿ ÓZêëJⳆûø û$Þ§üǺ!‹ÆÂçݶí:™á|µT»5׋ωˆ‹½'NªXèÇJ¡¯cS#ÕÜ•:^¬ª¶¿ 4¦GÐQµº»Š ‘ý¤njž]tlꯤ #ö3VFkž}ë ±°nôå‹É’Îç`á¹ ”,x¯í×kú!dƒ\ð ̽Ï;/fëÿÀÂËôIXßÅ‚– ¿’X°jÃB’› +¤÷±0¸Z½¡›°Z` XǹY¦Es"ºF‘à‡™Çu$øŤÁ¥e^¯‘;”xíRÃõì .ejÔeEá²È꾄ãÑFG²-¼cM­iÃíÄͿÑ.Sí‚ÏÁÓs‹É€í²NÙÉÂÁ…óÙ͘f4 'Á†Ë£‘-ôH•5âÃð&§Þ Ò[×? „—n50y <ݹ™}–dS^ínö1Õ3tŒÓf_æŒfÐ’À€…n. +VÖ¥Áü‚lÆê[¬ªX0›…ov´vMPÀ«rfZ`ÕÇNÁBX°ä |øn¾š"ÉL(å-rÍÇd‡Ã]šÒG«› 4݆óg¿¼òùû0OÀ1ñ$Ÿæ2¹P²{aÄw Ÿ}xš˜³[fº¢ÞĂͪÿ°Üý¨²€†§t$jõŽæŒUŽÚÂo±*cK«Sî`õÕš²QF÷Pø`†L4ö‘?‡|—bd¡µð¼y6íkŸÌ]+Ê¥ÆF¹¿bt3Ȧ>ÀÊÂ}7"‰NhA˜/:V³¬‹¿ˆÍ¦‹bj]uX[š0”ðrf×ÉEnïMüK‘E´ +Ú@+€7\.þœkÛ`i˜ƒ6¼%È„ÅÜfßiú)Xph±•++fG­h5ÙëŽ$ä>,·4òô™šU:¥ÕV*Y¼ÛbæH^an[ª±V “ .[U „¥ÇuµLI™¦¢¼p³bÁæ™C8ÐÂ2žµ°jÉÊ·*^+ƒ=jؤÜ^€)b@¬Ñ|€uÊŠ– bÁeuB( ¨\àZeÕˆIÇÄ©ËVú`ƒ¯ Óÿt¹Ð¼$Z¿h@5ž¯g{bÓš×î\$›êìåì7)Û%k¹VFó¥¹\È9s¥Ò:¥b +oBÚËŠqfßøTé[y3£óMõKp:NåZqnlŠ_ÌDÏÇ)g2%[­ŒGÉeÐ@º¢<|&UL fòg§'-±ò‡¦EÞÆ^ÈnëÆÝ÷#eÀÙ *‡qí(Ÿ.µ‹ú9bÁF ÓU«„é¬õè–dõ#Y 5I,ð¿–”±fZÓÓ8ƒç!¾b;VFïXSÛ´«DµÿÓË*>€Õø²W?’˜r¶¦øãìD™Šq0°]“ŽÎä@j‘x"¼àFrt'>Ý;¦—¦o*ÌÉ~ Ñœô… \,¬Ž–ÏÊ6)ÝbSp¨+ć¹ì±@åÂ1ª¹Ë¹Ä™Y`»‰tYÍPçØRÅ—[w10Ý\­3Ô4›:Ï^Š)ß`!ç7ˆÊ +Ó’ra*â©ç*b^!ŸnæiîúYß]ãÑý…ÐxcÁöM¬Ätv#d´(QI‘õòÚlbµ_ÎèX\p$˜–—<¥x­TÏ0|Ö)MÙ_¸€©Š¹Î™X†ã2[ †EØö¸Šo|ÅCd¢YNå‚íÏ–=¢>¶Á‚ ׊úgÐ`VvÈ°`Ê‚T«Rå‚íûºÀ¥=–ýûûÎfá‚b<‰üsE•ïÖuÉVïªMG¨ØÓ\¨¤Íéq[—fQƒÞ6«^héÑŠ^ hDÇ‘UܵJ'“Ç/j%‡¦0mm†QxÏÝc¡dÏB›8Ü•¹ Ÿ ++Š\;Vy¼o2ÞôÓ¨-±#Çuô¬*z# ø å`åå(—¨|#挅\‹ºçì{+\¶A­no¦À ƒ€ÿ+†Y—òâD‹ü)XÈø4PW§Criîù²u“#d¥˜(ÂBœm9wè7ðü=Zvq>UÞ¶Å)зD-û’n5€K€*°$ç@¯›}þ^:Æ‚ãÓå3g¦âRÌf]g~ÌŠÎú Y—4±ÎJL¬¯u„ÐÖàCä$µüÄ¥äè,‹Uå®.¬ªPöBàá/C.®fßMšbuí[0fç«SÇÅÛÀÐ9UŠ€eÖ9r¿Á…G’ù8 ôP%¹ '„.ÜÄ‚{uRóÊ’ÂgŒSl’l~5öVÓÇBOw`ÅdxÇDWQ¾t¸Ïu´KškàP«•‡Ö,bæ5ͱ|{D• „C¶Pç–YcC&P duÈ®-n›—n* ¬›—È¥>)¶žûŠÞÐÎW§iðœŽrj˜5è”k˜Ñp |úŒðóBõ)Tk4³mœCQµYò˜í¾¦n%ÚÀÍdÕórïÒÒÞ(ÝEsÌ_Õ·jÍ:{;ÄVW#í2¡³Íº‰UÁæ züOzg„ƒtô¶¡!Y†™Öœ^mzí ~GÊépûMðCëÐ1Õ^¢Äç´v˦<²Yô¢É(†Ø¯ýb,õ¤ÑííéüƒV<¤¦¿……Ï"5TG‚jÒX¸J¹ IÓ_ÅB¦`AgŽiúËXpòÕ£»D¡~ßšþ,4iú¿©' š4]1ÏÅÕXФéúJsžc,,V–•!†I ÝøÇzh9üŸsiF³)ë'K†õQ=}dnQòVç8)5ƒý ú`­0‚›¶õ‡bÎu´>!jŸ'øÜ ´±ÀxÛ³ö ØîöÚ6ï†Etó[¶|¨vdÔôÿ“ŽváºæDu}a+éæ5-J4Xs¢§wò¤\ØgF_ÖÎsXHç"5ZÚàÕd ÉÍ'a!/¢{¸L1üÃ|2ümtMÃ…ê·±à¼s™£]Ãß‹šgªë@Ë‚ë^YgÌyöëµVXL I0¶Ÿ5óA”å!”æá ù§aá.™ï,ÔÕ«åù>*-¾üÂ5S`Ós-ÇnnBDz N3wQˆªŽY:5Ms7|ß73÷¹ÐÇÉœÙõÅÆ‚ˆ…Öš]›¥¤‡FéôFÛ‡éªoF°°£Ñ˜®ö%e ì+I/,‰b¡åÍ +í4åI½‘^R*ÆnŽ–®a¹ÊaÀ™àLÃã¿ÄJ÷ÃÎ\ÜÙؘ½Í®dÿƒßÔÑqDÇK­\èËÈÝVÏñLqÜ‘‡ñçPË…oˆŒÆ”eÐœ{ž*™`X%³êÙ¤E¿°€M[Œ÷Ï`ÁƈLø ‰Æµ­ZþÈÅbšºãøV£ô^NyÒPáÖU"~Í. qŸ¶ÀÓh†ÌGiì컣¸gÌHèhx(‹†uiçqÓèfŸW¥GoÆHçÊõ®Ì§â‘Ö‡ydrôçy¡sÌl 5ÍM¥ø Á¶tp);ÓOÆæÁb_ÍZcá»a.ñqéHíÂÀÚDX=¢ç~$Z|‚ñ{pµOŠç`aªÍ¹«ò«´1w² +±¨PWG.Í&|ù]!ÄLèÏn”»”)ÓÙ÷Ý4§é#ìŠ.ÙÜÅ ôŸ©›Íhj5>pø`ÁÏIÜÓšh†“Ž¢Í…{¹yFË5©óÛÙ¸;›2V†'] ê :º‹£#Ôª(7+‰Õ0 Tq9Σ¢ M‰g–Hå,[cÀÑP5ÕXøfXàÊw?¤uÓÑìc—–£h™ñ‹ÖphÕ4UÕaÆîZXë{Á½^W,pÛÙbb†®‹!+rC§%[x×”ŠÔÉÄÖëéb¾b¡¢¬ÕãUÓ9eQj/ôÅl_Ÿ2~Ü1ßÍåd¹n†TX¸I±˜&ŸQSéŠE<øè4á“æÁˆë’`\èä…Ÿ ²µ¦YC¤ñ2²I´^ ³„4ÿ}3Û™­ÈT è +ä¢Öbò<õ‘üYP…XŸÆB´ÃµEb<]ŽÃÙWœóóÔÓà»”WejXšpɘ´èW,ô3Z±²W˜PÖ6h/z/Z~"çÆûyÓe|zòͰЬ~$š¡LŠ®ó[x^œ‹±á2aŠ\ˆø䈘‡•¡ì1?Óãb$T +ä ß 9WNÌ$„64:—caðýt0lÃbäŽ| °Ò'92xÈë¸H¾¨ê2>ÖÞbi’´ÂÄ‚áê&WF–I‘ºÊQÅˆÖ Ϻ/ÃMA©b·çÄ…9çÜ®XØè=êH~¶Éýæ>UQà,vè™-®!~–óüÎ.ÂG¶à¸1Ú§úå‚Ë8¹ÇLüÙ®ØÔvë/èÓ'È…TJ¸÷¶°ûÈ,Ý‚aYX¦hì|–—†l'±°ÁQ@[A‘ºÊêM×bžq„…­\ ÷Nfç7É𳾣ó{4Õ\KÙt¼õ­^¨í\P¡²3Zô˜“‹’5¶Æ·ĂɖÌrë8bß,¥±¬F—è1ñq¹æ²†a:a¼Ãhô¦u‰/ª\(™\XøÒk¬XpÓ¥†+«r0T¹}Æ€ Ù=/¦¢Í‚ØsûÈþ Ýa…ùzë‰ù銪óŒ)0¸Í¦´ Ÿ–ªéí=]¾A9t¤Ÿ4.…jîœvÀŒú«U4Æàd¬"°Ÿ„èq!¤¾“ËY/ 76XàU[Xí!Ñ'1WC€ÅÈŠ…ddy[(:» 3êSlVê,äB®>ÍÅ7‘ËéŒãBš+ãÕÆÄfÌöÏV)d6‚?õë<âë@S i)ÖšŸÝÛ ž ÛAÓ÷ÃÂb¢\Ÿ‹ X;bž³ŒçµÂ°ÂDL¹ªÿ®&óÑÙ†ðXíj«£>UÚ)/;¦µ'¬´‹ð#qi†;x³ß²ÇQ°@‡§%+˜{ç¾\¨ÔŒhî|êy¢ê¡±Ž>Š +~¹Š…†‰¦ìºøóÀîWÈ2“(Ø ^Ž,gåÀy³…oE"_¬7q®K„’ˆ*·ò([ƹUöØw¦q-A@"ï},”sçaÝ;¿n‰a"_ìäÂœ÷ýàÎ sâ/YX˜kB"ÊQ+.%LÅlý„•†[œ‹ëŒT.ôÙlã”Ðj`¹tÑV.$³JS|äÓ¾"Ô— R'á£`ù"$cØ­I§&›6‹V}›ÌX¨2š‹”£c…ó»’^ #±ôþÂo¥ÇXðØNtF»…`ŸsÙ+ +6­™} —ôó>ÝUÆýÙG‰S¥ætO ÛÝXT_Éé2bá£Àƒ³Ê«¬[Ï°°Ýks¨+Mi’Q$ø¶Å:zÛ/(CWŸªOûîÐp­ˆõã©úX8ŸË¶o1A§éx¤¿„£B1à~ndÑH‰ÆèñÌt#Ô»K7í×ÌàĨ²Ñv^*3£ÚHç;QfV6ÛNpø?0^ešì§°1qß8ÅßúÈukPó5‚!YîDʚñ[^Š 9í«–ºîZÁ+¤Kú¨r®Êè=paöJEäBjKÙñÍ°è;Ô›º‚¦ˆÒÍŸ]–:)tñwMZ.P+£é§`Á)Ö$ ÑôP“¦¿ˆ…^­<írÑôÙd\úk;¬[Çýоt= †¯Á‚&Mÿ–H—]¯®ï)j¹ûÒ}gj,hú d¡*2,¼X´úr\/BcAÓÏ"‡J ÓåUo¥yزþ], QÒ4¢é¹ZAøÔFé}Ùf;þYÓq®-;â°¶Ìv™{DsËï&—úéU,œpËÏÒÃ2]ïa6•šeâ¼ûD]–>¸I¶OÛ{³ÇËŠl*Û$<½€>„…“ê´ÓõW“훌o˲+Ì—>#ös²Ðv‹"c_¿]uÿ4rí¤Èr·b«dâbpPQ´Ÿ„…Øœ}7 +Ó¤`ý3›'°P>6pŒb¯÷%ü†³ouÙ¤L¿£‡XoÎ"ÝYwbþÕ”°hiøâ}Œ ËF^õ%š³Â/ +û–bxÑÑ6iX%Ìâg –<Ó5¡| 0¶‡FX:À3r!Œ…þÆ»­/VßH6ÒÍ’óŸææX/:4ý,ÊXÖ‰ ìÝcyψ§Q>BG¢ +¡#÷­C³¯\®[˜¸’Š\ƒÅ?hZˆ,¯Q[Ål¶(T +ß´€•%O’bö¶ç7À²™œë]YkòØ<¡ÉmfRÓj\y7wnЯ°ÐP—€Å‘õ´Xá§f(x0–Yx=Ið¢pU‚ŠÚ”ÖWݪ(:‹(pß.°ªéû“#s(CÉá*x‡z£Ê:ô¤äkûLz‚°l[ÿÀ¬<°0*UÄÄÏV¢1Y3X˜^´usÑŒz—•£¡ +X/G!kœ±<ìõ“. V˜¡×/W‡çÅ5T¤ùÆÎ^g–šãGÊgm$Ìbq€kkú¹r­8ãßv¶bÁ]åB…šI–g*âÂú‚£¸~ ¼J+Ë„O˜T±×|igf¹]5UÓ4YÑ2E^Oà‡°ås…?sd–°Îs¥‹v6HgV=©‘)¡«AP`5k5L3Ùpí¯çeŽx%IM¿“ ©#Q- Ç”Å ­JP×cZB±VÚ*ƒ¹ +í~xV.p“›Ý(a' ¾,äb0‡ ]§™kŸ—öÂu½•Ü±ÌéÖú\ÔÔ®BÅzQ®—ê4Ýžba ‘ìk\,ZÒ 7æE.h,ü^š¸k$c‰½À‹Ó­½à²YP‰‚+´{㨤ê$7¡ +ž°q_îN´¼Y\FQ@¯çZò2)¸ðqP¸¬ê–!`¸uäRÉsÙýT.¸K õº›Æ¡ºß†ˆy²BóvsMߟzSøT “/nä/ fÑŠ&4ŒÀeµT¹0sEÐÛçcu­÷Å]ʯ!¥8PÏÓ÷%²þÖ^À€?ÒPn?·+DçdÄuøI˜U#+åuí=:Q,5FpW^—lùÕ”¾íiä"êæáb+d¡Û>Jî÷ùÊŽ¯‰úÓ´“Ó¦šWZ€xò©iƒî g•Õ³ÖX¼ n‚»™¼¾gµÆø)´Ø:¿œô¢}>sê[›”‰" ŠnÖù¿^0ïôå6òFìØþaÌÚq Fe]çRì¤uCµ¥pôagd¼$W™Ñÿ.E¬]™Éûˆ{®ü9ÍLK`=Êq“ˆm.Û.-0iÚngZÙTv‘·ëLÖ +Ýq-Z3Ç1øNôPÁ”"­!ýr2üw–»,a8dûŒÖŠA±Xð‡½·µÌRç§(ñt·g©Æþ@šw†îÇÛ#ýK³Öôã)ªÆ×/ªFèEmãíá…1@XšþçŸÚ-©.Ý«éË)[í|#%ÛÓXÐôå䬽 ¿Q.Xèë\M_Nî7 ×~˜ô7£é :EX“ ßN,hÒô¿ák± I“"´XФ‰ +-4ib‚A‹Mš¨`ÐbA“&&´XФ É)t˜&MH½£C;5iÒ¤I“&Mš4iÒ¤I“&Mš4iÒ¤I“&Mš4iÒ¤I“&M׫㥚4iJ=Çœ5iÒdš³_hÒôçÉG,¸¶¡IÓ'ÛE,4ý¤IÓ§±¡X ‹&MœˆÆ‚&M š4i,hÒ¤± I“Æ‚&M š4i,hÒ¤± I“Æ‚&M š4i,hÒ¤± I“Æ‚&M š4i,hÒ¤± I“Æ‚&M š4i,hÒô3±#ýÀ‡êÄ5}C,L-R<_±Ÿ³Þ3Üwrf|^CŸí°Äô¦ø£ˆú¤‰iú‘X@.²4J€,ü'Jásdªx¨à;àÀ*j`ÁâgZµÂ?±Ýäôð-ÑÃuÐL"'¾'›Z#·¬<ÚÌÛK/QmY¥ý·ÆCSŸÌJN 'FÑö?¢¡ Ííÿ mœ&VütÙðU”Xå01 (QÈiò 1œIY4Ï7X°.Þ#*a‘OÒ¸=刨JJ8ïpâU4´¯c¡ +Î*MÚ.ÿ×â K@ÒØZMût,Ä­cYÑ-?q®BMܸ]c;‰è%iýè™^½ÅBU^4·çpŽ§ÔJ.ééÄTßâ—±ðĬØÄJ ^Ìÿ‚„Dlek-é³±€kë)8ªà†ãÁâXH"ò †š‚'¹.·ÒžŽ§ÒŠÒ{W¦‘¼¨Ç<*|r+üz0´t ,CcᓱÒ6¹x +ã¥BPÓíyJÅ“r!}C.ðû'Þ âŽ*s”X<•[“ü50¼‚ +6ï«Á_.¥¥åÂçbõ£<]jpbQBo‰d+jÄ7öÇBù ¹wW.œ¨å*Oßò\[&:ñœ¹¥ê:R ïb]È{XØšã'3ƒñ¿X2L^•ã÷Rj¹ð¹XˆÛÐ*SEäWKäEøK¹Âd†O” ež×7ò< +Ö%$“³½ I-Á“Þ%—NUôòTU]®Ÿ½Æ¬ ^ÞT‡d%¹¢Rz_Í“-_»´\ød,´ix U¡;I¸¡48š¦ Aûoì…4iê%¸Æ#r¬EÅâdóÛ#×Z‰gØ0eBÿ[ì°¶Öç*«W. ©•ÛÎ¥QmUµDCš×_ºÝr!«åÂçb¤Ò“šoN›àÜÏ*¡Aí@EGú \ð¬´GVþµñ`OKnw›)ªS±ð'!F]Ä«M_Ÿ¬Î_p&­r! ÆÃmÛa^ER4|­–´bAË…OĬ­‚a`Ù vx'4'O剺*ráƒö‚g]ŽÀ@ †½|ùëÅ“Q VL‚éöò‰„Rn\*§} ©uþX°J8‰@)¼—¯ ÈÐráŸ`¡Ík±è×–q| 1jÁSé†g?Ï^H±À¦¸Dµ¸½Š9qŒxIykÑŠý×Ê…ûo—ZJÌê+¹RË…°›¥Æا[»’§¼ÍʬêH³¼;XX&!TPt âêxÛwQ2Äg¾Ga›/0ë³X€÷Rq¡úøh¹ðͱ v´ìödŽTö¯‘ Ô¦ ÄúëL{É»£¬·Bv¤VÚ¾Žëê×–bø/U’´\øX€ïÒ;ñWžð”º2ÿ{{áF“SÖ_!Ò63º5‡øÊÖ5y  ­­ÿÁ­ªåÂçca5œð¢²ý”Vë*üy~¤ô„*§\Þ Ç^^ß¹”Ôõ#EêžéĉÔÞîçq,üOOy^Åéç'?)t{Ék§ÿ",´+ÆÂ/%Hš×òÔÏÛ_x€ÅX®¿y"¶„¨Âh¿;óNù#¾»ó¼Ž¤¼–êXQCGXl‹¾óvLîçÛáé?Û^àÒÛ¨ ²b¡=K´‹'Òò‘ð®g ®fê¡OŸÈ¯ÃÓXˆcéf©ùÇ9xi5Reÿ*{NvÍj»ž `=ó ¥ç½ªÏëH+Ô`®Á(1!ŠoW[I^ÓitTÜ.F¨ËÍíÒYö;ý¶¸“»¬ú«1ÜŒD§ÄÝw>gŸÜ˜ŸNSHgjÕ‘1µ ­So螨ìá¾(x³F|«#ý[{A^~YwÅ’ ¢¢½'Qª$O0¾Ê}C.<Æ‚TÞlóvr"ŒhÉ£€E>Qü™' FípIðô’ž”J’l³‘Hä·6 Wm+#Òì,¦¸5")¢ËW@ÑX§üÝ:.Àcªµ@çÑ/¹v¦?†édÙÅV§±0:)T¾›/” õ-RKˆŠ;qY9ðDš:¯Û OèHžåÈ…¸u€£‹íKC/°ð @1ŒeE4pM¸`6’âàó'¥í"ÒŠ/e›“v‰,xÝÊ}S/ÈqkþFãbPNa9™ì„grÁ$ƒ¼Š~…žô,âE„þ?ã|—(r†i³1ýeöÂ2I¹ ¿öÉ©žÚGã1äó÷Úð]çµÐ2w+)†€ä‡IF^YõM¶]k×Vy”œW& +ËûmÎÙ`1˜”77NÓÜÊ÷wå¾r­ÄVb•™ø/ÉéµÒ9Þ’Ûü…ä‹íÅ´îxIH>s{ބˉw¸œìRBöh¨“ÝêççÞYÕª­a›Ô q\VÇÙMž—ìsð&& õf`ï…í˜_i÷=ääS¦ù¢ý…5†O‰%¹ŒS²JûÑðÂ^›0£‹«5Öeö(çé}È­ ç¸9Ý ¤r!U?a¤È…xº$·¿³L;Ú¡XÈeüÁåážÍ¯Ä‚·Þ+k'XøÇû Â6H“\>×äXkÎV¼h?ië÷iIÊEúXÖNÄÚÌS£Ð‰Tçk6ÆVäıˆl)ÀIpztñöñÁ©(ŠDÚ]ÀKàH# +Ì£Dr~ÀGªsuÑÓ\ˆ¾ÑÄ“¾»:þX,på{ü&Ó$_c/HÕ`“Û¦( ð%[ujÇä3vŠžÅB,;Ó9–¦¾çÕUR—)¦Fk®™Q˜R1©&¸ÜÖ ¤¡ã„ ¸È`yùÖÚ J¬ÄjØk*‹VFóc·Iׇ +K½9 –‹”_ê‚/äB”Ñ;q8C ºú[~$¹¨¿²%ûÿÈ…É© ØƆŒ7‡õ´Ì­ªŽœ{KŸª#ÅÓ´2^´‰e_µÏ ©¥åD&£¬|SkõÝI³ÃË­”eRÑz˜Nb]ö¢Û†!–û ü†G¶¶0©ŠŒ‰´è8 ¸q°¶rĻԈ-tnç÷caœ”Þݬúöº'xËsj⿇+/à!´—éKå­#éÔkâÜÆÔ\#hƒä¢:Þâ‰Øu-¡Óº2J‡•'Ÿñ#]z¬œºû‹83@ùŠÇ&.ecQ[—½IßÆ·Þa©ìûɸåî@‰²Èx¤]}¤uè®—m6® »ß˜ÅÓj2Ã2ÃRã–ØÑo©Aö4*éF"– ÿÊ^`ëïªdï6Xãh­[ l,E ê“(Þƒƒ¢#YipC%µn-0„W6ÚxH'ÎÚßz²ù¶ˆ’:±×xKÛ<k““8U©J¦y²L·t®(ëI«`¡J‰"–¿……5”Æû¸Žôa¹ŽíÙa^IÇû­ôˆá)òƒº— çe‘Ÿ“ /Ž³¡$©£(ðÒµ@RµñT®Å=ŽüsÒ6X£6b®Ú­((2¨µ¹aa#d´âa.ŠÄTnV¹°ý^~ ½Ž…pz Ÿ”Zµî Ía°‡/k¹‰“Ž•ÍòŽ <‚1X/£A­tL›­T.vÊ'+{l +…h¶°Ü±6¬Ž±ú%ËÌ f9¹ç+YÒ*Þö%þ,x÷B,¿X.xùa¢:/7õ‘ŽÚTŒv8 w°"ûÖL/µål_u[º ;ò¼<öB‰4í•ccžF‚ªüt»ÜÀK {ã +=” rq+­Cu_e/DÊï—Ä\|,|°žª÷pýõ+%Ç&ÅÒbùGpU&±ÂøßÔôÒ,è}²¹àbÞna_«`Ô&é-ºŸkÑ3ºÉQ8– m½ŠÞ3Çá·®„Ù–í_ÆBú XH¾¬žjZÞ”°TØe2¨y‰‡´¬¢— +Ã?‡…4½ª[ŒuŠíc­ƒVºÛ`¼} b»í‘#5ëH.¬›gßç$\I€Ð*þÉ¿Ì^°>­žêÃ:ÛÕ½rÙÈ~FZƒe›—·Á¡^¼’$¯`Ḵ+]\ñf‘ÑÞËì<˜ïÔŽå-ñUx‰•§t»ðîWw$&Ç +¼mXû¥Â3>¤Õ.÷NÔ*íGúì…K0hÒGýölÖ.(-xðòW6RW,ðxFeÈ +­IVE©¿b–#\§ØHó&÷vXX÷Õ+kš%2´wÆ>” âûˆn‚Ü ­]V¬” ÊÆߟĂ”Iù :Ò¿é¿€M².À–÷”– ºh¯-eEÁŠÛé˜Ú›ý…ºÁèö‡Æ×åž[I‘<ÜŸ³´¤MåÄÖ°„¡†bÓ¼À³gLgÛ#‡rAÔ§IëêÄûæMºÍŠ•ránnàÀ‚L_Hrò¿Ë…ã²î¸­•TÕKmÑ(Â2®SPÒƒÛ+oÿˆ75Iy3Ã`€ +ÃUî4ªrû!ÿ # /t£ì{Ü—ðn’&YŒ›"ÿÖÙná±\Èåõñš5’EÈ…ûõ~?Vwô ¥ƒþÕþÂYuwt(:/oc´ÐdÃ)#§©Foâ‘6ÍlIZkêƒîT0 #d Àõe°i‘²Á]˜vIJw ëо}úC¹°ÆƦ§ä ü]H¹ð[b´ßÅÂ$ƒ#ßJ|ÅdE?eß97ö…ݱ< +¢òV ¨BvdÉ”H9EÌ =B–}+nS1s%wò>bšÉ_Õ9Ao½ÃX@0ÜìbÑ‘¼²°‹éc¹ ŸpDÈÜ!Ò?ŽùFŸv"Üëù,ˆx¤”ìÕxtÄ|(tÃBs‘i)óa”òÜ[:À¸›–H‰Ô> ódžj²tƒ/Î;,,˜¥|»öæ!ì²öäšnúD»/q]+±Pþq,ˆb Ï‰–ï;^Öíé!Œ“§óÏáù  :ܸ€õv1Hû@–tO"¨­C,`¥0°Í­¨LÓÛ¬ýüѾ³"‚ò>Q¥åÂŽ›d2OýL2@'b©khŒôFIü¤¡¾Ç»rÁH1xÌã9yJúKˆ?¦#1u¦¼Þ©vÀCap)±\Æy{NÜÉ1Øþy@`—t¿A’å/¨rA–LëU"…A˹ª ƒá©ª,zS¹_/]à³û¸ÜíÆÞÛr8¼ÂàéÉææVéaàËÛrÖ9£î™‡4R' +,:oÀ¡ÿ¶‘•ç;¯&ƒw“‹¦TÇ@ƒƒ{ÀR¿leWâTÛ³M‰ÅÁìíD­›¡Ö;ŽG¶ sz@ûü…?/лx¹<»Õ²¦„*¥$‹s>»;+=ˆ“ß^˜ž•ûybŽƒÍ*ònþ If~œï,[µÝVNÏ +êŠ`µì?ì!¶W=8Q šwОëxßYŒûBš¢– 7JÒMâ쉊tSIaÍ*|Pgmµ˜¶ä}{¡•Vû£š2!^®àk?Õ»òëuóZ§ +¼Ãæ¢j¯£$_nkr¬Xؾk$u3‚DÔP3ž÷e ÆójZ.¬¯Oô_x¼–¬ácje±•—ïo0(ÝÃ7õåÞ— R¿{ØWïñZ›gjÂÈÆ 7ûkœW^/%„§üÖ§Ó†¥·© YJ‘y¦Ö +8” éÃ>E1aÙýZ.{w¼ÛÊU'bÁ»M´Œ•ª÷ †6¬ŽÊó|D.ÈÊ¢©Ä™Ï×E|¦VÊÔô0V£ª£uR-¦]CÂè¨Ð;ú„½­Šwf/ˆ2ÞY¡¯ØŽš!׶Z.œ+>X]öC]ŽÊ²¬}ÜîÚ°k¹Ê­.õ¾\ùòa,˜ û'ã’Ÿª›·öSÜjþ²fÞIì§"JùàÀ¢9u55¹'R×4“㼶‡&‰\š9]çb$-5Ÿ»I «kd·º* +Ar®¥®·Ùå™|`¡Íó§Jίu'žŽ¹y®nY Hn|›·ëþvޢ؞ü¼M]ìâíª,íE¯²Œœä;¯e0 >Vz ‚(jD0¦– ËÁº~¹TáÞI2¾>M6L«~·.äáåûýéì;ƒÚ%sîe¼éÕyº‚òsõT×G?éawè'Še>ç* ^)ò0!mUC•òÇùÎkòòáW!7ZR9’– ǼYéIÝv%g[¿m¦29SLd©Ç½»ér™JöNû‹Q"Ë{¾ó“ýÔB[ës=ˆc'žuã’yÈGí‘dœ0þ]ÛYmþ~T0Dö}OW¹¡åÂá¶îEG)3q;¬nÌEËB0hä@!ðŽ}ñ 8sqç›lN½ ¬Ò{µÙù³ý¤¤dG<°ÚµòŠ±!áE=j•6ÖË —mP¥l˜•F‰}ßQï’– §Z’G«§´{/7¼¯Û$€C†ˆ¬ÈÞµ‚Š'bäë׿çÇÅ©*½H0’Ó¸) AËO–«ƒóõ~m÷YdmMw+ã?âÖd`õÛ+Šµà¡½ö0,^n®lÕ>¥/k¾>àUû +¹@“•½n,PNãÂðßxû;~³=þUX@-Iéb¤óASjÉàÔ•üúŽjZW:S9 :±1ù £ NnÕÁªVïvž>"T…EC•‡4ó'…Ö[;LÅâŒú­<Ý‹D©ó½ +Lµiö†³qYQòmàeN;Þ†cÛÂf´Ò¶°ÇVO©X¼ºž0Z—´76Tž›ŠÝ­l׳Õ¿— qÂıP¾TåX‰|ñïþƒA!åUO_€Œ$[Y +“eóÔ€ ×vaŽ¬RŠùH•]h#Œ¿ iXˆuSÖîGuï>–¿€úrklÜ]BlXl80äÁqœOÒ‘hÌzºïê´Æ|¤ub¹®ÖÉY'5o¿-»Ø²Lf¸ˆÅh”ÒÄÛ#GÙèó@îagÐ’/Q«Ã‹°ÿ'¨%‹Sê©_ HäGÄ6‹Ž;zãÅ-º´ ³sZtÉ©Ö0‹Ì˜HUtœŠLªŒ­Æ_€… 0Í}ÐIRcOlê]κ}­^"åòK”ðfÝ–•Ô‘ÒXµLn¶ >$p]Vû²zó뽕B^MoÔ„y¸\N‡ê¿Ô:SPÝZ()ŒK]1)åñSª°*ªf‰ö`4YZx6¶m|Dæ  +‹‹`]¥†•”žƒ B¬iÆ¿Gï²)ØýÏåÂdæÐÅ]Cà@á #essM_DGƾ™“ë$ì"°‘0ø·%@<' $ÿ1þ€›ó»<…å€îÔ$—è>K¦ArX#ûÃùÎ 9lì½q^•í{µ…Ÿ`‘UÕWWÔç½ÍÂ"ª­°õ®U§.èéi)Yë²ÛÕI-õä9lì×µMÕñ­lþçrTsNÄB5gø-´áœ™ª\0Ý™†ÿ€¼h|ŸÊ…fÜëYI7›U±$²Öi¢¶¬ŒÔ5³hB¦l‡<33Ú?ÔÇDÙ±|  ôƒ•¥Ç/; $Î=~¢——§_6Ò; ú°\À÷YÉñÖÖý© êνt¢ÆmyÓ.ˆ{&j£[2êŽoJ.éa¡ðºJ÷žîxƒ¶ÍVFkׇ µwjê¿– `-àªX¸>jÿS• f9›íDåE¹ÊFbGÍy®- +§¦>›3†Ãî0Á«3A›g´ÂI.”±·±€;j%"Ý1Ae;‚”ÃôKÞÖ@¡-9Àh'Œú’5Æq<&sF–m¥ÿ·±°ˆb¸+zˆ¼0µ¯ìøáåƒï–Jî44†ö7Ê‚èý.øÌC6s`3¼õôÁžŸÕZÕ}ó=`β² +×ÆÒn·ùù žlqQhÜ}û8Ê„û¶8Òч±ȱÏJvÇŸõúOö"3jS,ôî\CQ ËV.´¨$ /@MâöB»ÛwŽÛ±€vC8:~aãYtïŽà :DþË#þ¨Ou¯‹®õûߨáKF"íôµ .XÜÇ¿üvß{¯½ˆxñÄUñʸ×Mžçß<~œQOêD±ºMŸ_[¹#H®¬ïB.4ý.)n©\ VóÔ.«XÙPpÊâOÆ‚&MŸ',.R6¯]ÍÄ‚*bÀzÞö*ÆéEåÂgv`\*M5žEÀF,ä I–AÆei,húvX®@@S¹Ð"ÿvÅÐîåBkw~‹}{#„`@¹âÎô»aZ(bÀŠ9ã®{¡t£iÙjƒ š¾ ‘šFX´ å\ø ™ör!†í`±o¥\ öB3¢O,8% àªÇq´Àš£ÙO{Òƒ5€±Ópˆ54}7Bö¶'.&XÄAUšì\ˆ‰7Ï°ØãÉ46¯0;ö§#$™ý,j1Pc¦! (æ"ÉÝÙ÷À¦†ÿ5‘ÕͦcTÇG÷Ú4iúƳ9{ƒQøá„ë¿ 6„” Ä‹[fÁºî/0=Z§›q§ªÔ>†³\#Yq‹v*º‘44}_%©!Àì4ä4¶qÿ%ŽÐ†CšìÐAÈtc!Žej¨lï´vP:1Õèm”6ÝŽ‰% 0€{8ZGÒô ô"T’xÓŽ‰íƒÐ_Ø¡˜¹~ZÆÒôc£Jÿ*%„€` Ü\X˜/µ¡©´Þ&ágÇ›½M߆Æz®?‰ãÁ+3žÇк"è\ÒXÐô,†ÂøœX§É.0ÕeaÜ…Æ‚¦Ÿe1„æ'õ—ªsyîà¹O•øÑXÐôL†eø´¡Vc %O MßKMú¼‘âÕXÐtÊIOtÌ~tFü0ì1Žÿ¯ÀÈýÜ44½‰…6~ÌÉñàñÿ…ö¬Ã„³-Rª± éˆ}’."üsÞ%®.ŸŒ,»ëø¡Å¿îß)5›‹†Ö8†ãdwnk,hz :g³ÕO¼êÄ!¦º°ˆ—·Ü&qý­S1£ÿ_¦ÄmTœ4cÂTQ¢± ép{jŠ\ïlÑÇ@!ÄvUÝ“ ñÐuËôÿbaÊæÑ4 E§V\ÑXøƒ¶!ã8R?ãDÚ ~aÕ‰ñgÛÀrì{ôÀbø¿²mÍ9ìãxìYŒ#$èùì—XKÔã"˜lÖÆ-œ*" àÄ~ƒ:5¼6æWQw(­õ5ò#Óz/qM ÷ÇŒ…výˆÍcñ@ĕ׉ßMDqL0‹v¿Ï­±ðçhjÃÊÍšhh—ÉIB;É\ü9òh)Ý,q0) ±§I8W‰ëZX7*nÃÄÍÜÜn'#)æ¦6†<·c0Nƒc†fP†ÅF¤áÓDC̪4ÁéQë5Y“² £°Ê§T°0µiãâµ0™—ì §ó08õ‚Fp;ä®Ë‡ç&p ‰›Ø“œ–­÷ªÌÅòáFÞÍníLX•ËÍjç˜ÖFê6éÔ4×GcáÏBahXŒ³iLX2Ť•³€kì¢pñg°vinØÈÄÚœßò£6žX¸óÜ9c@…Ö+jm:Ý¥ã¤+z>Š‰é˜ƒßÒ²¾cû»¹…!Õ Žæg+¦Áå3#3D0içá83-öŽŸ"Û‹CÃe~Jäì`<6PQŽ!=­å³#yÞ-hX7Ê ¢±ðw¤j."ÇuÝ"cÜ‘Û¡9gK‹<®aX3K±äX ?7ŽÓÀÑ>ŸýÚq.±ËbN¼b!Îæ.7Ò ³k€»|3Í-‚5ì2ª"TDdkÚ¹—ÔY:‚oáU ˆÀ"2<˜ ÛF,Œ €3¼£E@ûwCãký¤Êó³Æ]”Ù‘|îJ#„áìέRƒÔp7öXkf.ª¬liI&…?,̹ìÛöŠE Qߎƒÿ.j{Ó‰%À.¨z8 +ë=üWÃWšw ÇÓžÖõËþ;!ÃëÃHzZ•”¦ŽÄñdÂâ lÛ ÞoÂ@‹‰%½üO`s˜C˜ fî°z’ s4á}:ÆPÌÆ•ôiç¼UbÁ%cÛâìZrEû¡|%dÈL‡P{±•Ã§}óž÷­¬$°î1h,ü5¹08á,ßÂ:L,¸ \ÐÀBŠ 8¦ZJ¹Ð£jƒ:¶9±.ú‹.MÊ÷æ 9À_n¬LoÄ óÙŠULD 0?>tø-øÀ¨ç€ý*°€¢œ.Á`û, ƒÆ¿þËÒ`ɘ×ô6÷FøÝIc1»eŸÑŽ±ð#ÑÚJpvåö( è_먉m Ï_JÂÜÍ +6 t»‰ C‚½€|AóG‰…tf 1èÐ!c˜7Yç[·–[Ás bòô1„ÍÈŠá‚»LqW`Ý% åEL61+€•.Âê¨|in%äyšp@„½ °€7ˆé¦Çí]Ù’£:  a±ÙÁ,æÿÿòêÈfé¹ó8]ÕSX/©N0Õ:‘ŽdK …ýmÒ ib¢ÙIÒ|>Ï5C;z.B*XEZ7±$‹VŠüB–}ÏçÑ}íWé±ðZÑ9Îþ¦ShýÂÈX Ÿqé°Þ€¾u ˆp [ªÒA jÝÖŒøÃ|?×6p'Õl·ä#Bò0i‚¦yÚ +5ƒf7¢m#Ä2‡í+aá<|cÎ+/,Òb¥—:«ÁÍÛb­,îR§=aLÇ#8v:†ý9Š4mS’¶z{ž>%— o…‚˜ö°Ü„GÀG%ˆ–ƒûó~aáCÖ†£ÁK°,‚²‹Ñûé´u¼0Î/ þ° ‘èÈâÚßÙ¡_ˆ¨#Ýþç””ãÎÒaap~¡$*¢E´R,Ð6çlNí*n“1Ë¥Š´c$bGK HÛü‰…Øû…7GH"fiæÈb!TÆ-àÎÕÊAË$Ößù‚ìÒÔv¥• àñ•/À„WD=O,ÈÚN7 ¯3ŽxûéÎÏ–/mN¾@Ú¤ÝÂX0äs …þr홈œW&@7Ò– ]œCþåÔnGÓt=@- ªÅÊýêQW¤õË ÜeÉcá­X K^ffYႆ °Ï1_ªöÆ‚óH*È…I…Ÿ™H ic&ä¬æ.uy¤œþöIÑghõ¥¦kc…Ó]ÝÚ @h–Ò¢´Æ#ÒÑO‘ÜiæÆ‚tšÇÂ;c¤8Ýëª*™c i¿ -Ñ®/ÔE"v¹ë šÂò¤+0€\A˜UÍÄcÉ”§1°µ¶qo£¬ q¾øáÈÁDò427Záö Äà {Y1q}-Œ¤ÒýÞ–i“pÞ3*Æ4jP²žÇ.Vg¹†¿»©#¤Ýæ´Cw¼±èFt£S’¯ ©Ðu Æ‚ÞXXû§é{,¼ sÎpE.ðß(˜G}azÓíȬ¹Ò;åD[¹¢¹Â÷Å܉nTæ¼ïHmQ´iAW’_(&j°mò&*YÉãËÍY»ÚeÐŽ2*슸hb¥$”/°É=—Ía¾WØ«=ƒÔØó©¥â Ó®süB¼Êßö‡²µ=gÀj^i+ôr6îºÚo]kôq7±>w~Ù}j§ËjÛìlÿèãÅSh ¾ôâêõ¥œúp»¿ÜÜÚK;yµuïhyíSµÆßïߧêåäŽ×DÆ‚þJž¾!½Ü~9]á±ðr,„O,ä? É7aÃN/6`®Ë JŒI`~¢–¦©‹o©á(ýyg/Öo~Äغ?z†ïÀ¨Zåû`x¹ìái Jý ZþÅÛßÉ‹—?²'/^XèI/^^.s,LýèÅËË¥ŸìŽ/^¼ìázñâ…düj«Oíendstream +endobj +5258 0 obj << +/Length 107 +/Filter /FlateDecode +>> +stream +xÚ`ŸÿÓÓÓCCC‚‚‚ÛÛÛËËËgggµµµ°°°Â£££ñññççç‹‹‹¸¸¸WWW›››!!!­­­|||“““tttììì555ùùùáááõõõêêê²²²åååÿÿÿ$<îendstream +endobj +5253 0 obj << +/D [5251 0 R /XYZ 85.039 781.388 null] >> endobj -118 0 obj << -/D [2184 0 R /XYZ 85.039 222.665 null] +5254 0 obj << +/D [5251 0 R /XYZ 85.039 720.089 null] >> endobj -2192 0 obj << -/D [2184 0 R /XYZ 85.039 202.075 null] +5255 0 obj << +/D [5251 0 R /XYZ 85.039 720.089 null] >> endobj -2183 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F65 2099 0 R >> -/ProcSet [ /PDF /Text ] +5256 0 obj << +/D [5251 0 R /XYZ 248.731 250.429 null] +>> endobj +5250 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F75 5171 0 R /F56 2890 0 R >> +/XObject << /Im11 5239 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -2196 0 obj << -/Length 3291 +5262 0 obj << +/Length 1786 /Filter /FlateDecode >> stream -xÚ¥]ã¶ñ}…á'ÈêD‰ú*‡MîÒn»´Ýmƒ"ɃÖÖÚÂÉ’O’o³ùõ/R”-]Š‡[‘Cr8Î7­VüS«,öƒ(_¥YâÇ‘Zm7Áj#½Q2#Xi?HbúæñæÍwI¸RŸùêñ™¦<î~ö¾ýÛÝßßýssE‘§ýÍmšfÞÃFywC¨öîðz›,òî>¼½½ûáÇïx N…åJ)ïßðýõñû›w ·Ú×I„4|ºùù×`µ2¿¿ ü(ÏV/Ð|•ç«ãŽ#?Ö‘ô뛇›X,<¦W¼j椷:Lü0…FøY¦í‘UùÀ™gž7‘Vû*4˜ëÊ2¤LƒR>Ò%§‚åóOÖvrÐJN䊲î6Lsá„ÛM˜zvÞñ|Ä?Ô|Z±ô7ÜÎÝØ)öEÕôƒŒÊžo‰º úƒCKú“€ñ¹g9€yj€V¡w,!’ x8£°´çfÇPؽ±t¸ró)]åÃEFg׃ð(̽¡Úƒ9;Î,zþ‡BÖ:’ã_š<à0˜¢hu›ä`ùÂ9sefq¹N­± -aLù9Ò;+í+¶‰Ð¸Ä÷PvŸK”®$õ~(?—¨*I`¾:à,†Ì6Q¢¾D^èGaüEê2ø~Ù’~GbYÔ5jT–Jøò™Ä§c`]~¶ÒT¯Æb²= ¡pµ¯›L£l'p“÷̲\1Ì!ugoI:ÁŠžgùhÍ ÝGÜí©pé˜ÒÛ•"·ˆhèG;cy b Œ&óCöÃHIšF"¹ÁVe¾=/Bã‚}§Ž!µAÀ$Õ ;¸bôÖ ÿ+¥lGn&åBIÁ#kfýíѽ”ÃùDÞfÆË “//ÜvÕÓ¸*‘¹)r ‡1‰ §×‚Ý…‹Çãm’mƒÙ؈9yƒÄ|Ç4†"¤É¡#È»ÑB\Y^Ø)>4Mħ¤1 Êãi0ù4€Öíž\4äxUh¯gÌ6LêÏšOF–a]_6äïš=÷Ëߊí@ê‡;²sÁ[½9]1'Ìæ`§’ﾕÆs'ž8 -‚ñ8Ë:rO‘wÿ<ƒïRÛh^¾ Y°u¡â„`FfÄ‘=\Ñ–Ô¡¤ËÑ*Ú×€K&!hJgFÒÉh‰ -šuÁØõÈ ¡¬5§àÚí]Ž¾¼’‰êÝâÚ–ðe«ƒÎë‚:ôMW& =Wëø-rzM;ž´#ù÷ß^ƒÀÝ  YOU,e‹¹›#cMnÒx÷4ÿACÖžQnC(¡ Øq¢Wb÷€dïÈÑ`èð74‰ɠøQ»ÉðÈ -c {mVVýWhæCfºÃÑ×hľdšˆ*üïÇUu¹Ÿ GbØ™ƒ hÍû10 -Qs·’ù³F1«ÊûŠƒf3lR¤¯&ÂbÃ,hl É• ^ -÷•EÔŸO'2ëm7Œ[–Ͷ{%-`yÖ ¦Á]‹.¡Ç\ÄIuòø"Ê#;µ'¯s]ZÏp>4&Œ„þK¸EÁ€í˜-è®éÈ €u`_òJ¡g˜ˆ?B¤ l!ü$7ùul==«ã10F DÞ ‰CË#ú²F&d¥¹g—m ½ž8AH‰Ž †‘£8?x#‘ˆŽT¾[Nœ‰U-cÆÛ¢1D˜¶´=F×',›âÉÆ+ä?2ÚÖšzÔeGfF‡ÀÙI@<(Qç®D٠зncÂöùÌRüÉQƒÀîy„T„¡l…ë9È`uÝ["ÙxòŒçø%PºžóŸÂ)H¼ÈXBŽÕ³’w¡;ËA‡M³I›¤’ÜÝŒÊdq.¦vâD|¤v¯²ä( —ÎÜPH » }l¸ŠsF¯c¨~ãŽ{JèNôAšÑÃu$² -ƒ{ Ð,œ0ܵÁÛ×èIHÚóþ ˆe'« Óè[*Kè„„¨¨:<ç\4ÐWVjq\Ç¢)öåq!“Ïâ$SF$?|BÝå Ö=T&%‡(ù#ÎØuã­2`ÛžÉE¡÷ÄályN&mx -]Ú«å΢×\['! 9‰0SÞ×ü¹ -$x,áÞ¹É9 ¶6AX{€À«(çHz–-䯉÷2öô•Á •*Œ_iH4šk -ý®Ü¥œøÈþbW®1'bÏ7 þ=[ @€Ñ-t-ϺÉ\4ÁÔ8»Æ›“~k‡$ïI ŸÎe?<>­½ˆ¶> .âлäÌí Ò‡Ê{´Â…삤·çÚpgüÆRË«DkŠš¡'°lÇr0d!h&Ë@ðB ƒC_¯yïñ¡#¥o:áDW\[ä„]‰dQ…Hê+¼k+Ì_¥è +ˆ… GΛ• ÄÈÔ Òâ„öipÿât¾[™`Õ]^&LxpÕa!tðçøÂ7ó¶´Gž:{äTgÆÏO$÷úú—žÁù»Ä 0Šq4&ª_Õt7–ä‹´$¸n„ÖPˆ:Y?}Œñ;ZpñL×·8‰TF5õëþLѼ«¯ÓôËþrøqžÌ–ý‘– ðƒå×ZnÉì)–زU–øYšÛbV:WiûÐrŽ yóʼnâÐ’1¬>­”À=D<ê´‰ÎqÞÜÕêm ­F¢¢Üa÷0õµ©R3%6)øq}8sëÈÊ“ÈÔ‡Ë϶†‰õ6°ÑD BAá TæÉøDš¸FN®¦ë>6œ˜6 .z¦jBv%¾Ê YýÖâjn¥þœ¤~ª“‰˜5Ò\P¥~n1ÑÎ(ì:“"Uµo¸[  Ùq›Ž¬4j Á6/¥c÷%¹xíD\i–c -Î\ÃÅ -Bî’…;˜áf62Å© ‘2ˆcò'™{Ë ¦á׬ƒ MTl8çXö*3R¯g@'Þex’ À€¥;G£Ìö퀻ª/¬`hóz%T„h¬{ºlÊÐÁå§ Û×þÎ\ †?3bQa5·f’•šª)ûé|¡_JMIg“x /úã•5Š”E ‰®<üs¶3$MW·ö)òÿ7oc%>ðÓ/¾d~Ìì3Á•™°Ï -ÓCÒoÛs˜=²J¬=?€{£Z4ŸÛMÄå „—å±.{“‘¦ÞO´j×â;‹À>”ô¬ð‚xñG¸gÑGYÝw…É^T¨þàåA§ðˆû¥µ"Kµ%3€/6h ­0V&ŠXG×þ†gÊȲC!Ø8©ȺR^MTÈÓDžeSî¹4mÙ^¢ìÆFsåÌ…*v‚ÌšûøZø1„*@2•@xñÃûÏŠŸBq -…*ø\·öIB e2”ëÊBfåo·ØLt¿÷ {6!Ï:ÍfÌÓ BÊ{*zû¶,DˆÆeÂ8§7&¡56«6Èl¨„vV¿»Èåñ%P,d<Ù†TÁXüDøiâ.ÚúK5XÈ[f*ù$™ªœ3¡”¡Ö-`È‹V0f‘§Ç%Ûd›N’¢Á¼rÜûãÛw΄ȼêÀ[|—€±~èØbÖDcà‡ƒ•|ÝHžOu1Û:Ø]³¿ ˆ!ÁÀB‚Dåó?Ø´î×R:ô“h À¾È÷P_Ò)s&Wù_Ž½`×endstream -endobj -2195 0 obj << +xÚ­WIÛ6¾ûW¨¹T"YI-z˜,“8@'“ÄÓK’ƒÆÖØj,K±äSôÇ÷-ÔbYžK‹Æ$ßãÛø½”°|øV¬=_&V OƱµ*f¾µÉÛ™0®Qq:/—³ùu¨,á{‰ŸXˇގö”–ÖrýÅ~õîêvùæ“ãJ)m‘xŽE±ýêîÖög^½ý´¸Y.nÞâLÁ¢°ïnQüá“K{ÉJ‹›^|õûË+žIÏw¾-ßÏÞ,»H» ªÃü1ûòÍ·ÖÒû™ïÉ$¶~ÂØ÷ˆ‹Äéi%Í|7û<ûØ™b™²x×TUZ 7ð½(ÎÝEIdÜÉ‘;yæη\1Ë)OAeŒ³pZ-WêØK4Ålý°z>GE 8ŠZ‘*‚Iµâù¢õº„Ȭ瀸½H葶ÀWâù«0òBÉ(ôŸðÕ×~ +ÿÄø D¤½P‡àÐê©ÄÎl÷¸ƒM¬õ0[Æ0®óÍñjb‚a„Ñ̯!Ö~[x~€5Aýãp¥<08n_£sÞ‰Ÿ±%j“»[D¶ë¸Â>À ­qÔdF…k¥ã±½>ÂpEÒ÷¬q¬óý†‡o·¸ÎêUk1¯šqJ +O>|òºÔ$T' ZÚb*y@o ÿ­åz˜IŒMMWPp •~äùQB¬Ò•åùîèÐN7óÃϼٖX°†ç«rÿÕ˱j `–¤5ì +Œ‹­];±²eá¸Ú×ö_h9;Ô9V[ûÊüéç0Q¡Ýlóš—·iÍ(”mºGŠ°×0îKt„„&l<¢Œu`xÜC8%ªåM6°vnÿ Ùd93!å{'H1¸æRZîD^›CÚdkÇUB€ÀDAÑhñ´ÇÈ›’.# Ä>µö¾Ä ?Å´6Ù’«EfnîÌ“)ë†,®yÅ'ƒ".që‚Zx£ÎY#‰@ Ãj¸Í(Eÿ$¹gUÝ”‡´†¶y†½‚ +µC'Æ2T-±±šAŒ©bOqô8OyOÕ.3ãm¶Û™!çAaþ¸´Jw»œÎ˜Ùä„„•x³É¦žà¡¼Ø“5©^ù̩ÀS‘4Ênýú ¸ý#Z¼ÂáoTÑcEµ;wåJYÆ'åªRbš‚P5óH±½Àùô‹Vö#–‡‰Hë"ºDѺìAYïmØBÝ¢½­4ª¦üC²ŽÎV¼³fñìg"üNÐÜ°Úã¼FR +`ð¾ä®‚tÜ-ÿþ³Ál³Š[èR9˜¡xS• P£26Ÿ3Á¶U¡I‘o¶Ô3<Ý—fе(òNz¿ã†Ç v“zßpP{¥”}W1Çã¹4Fýô ˆß-dàˆëœý/žCø2HTôäÓn C”€V°>=åP*Ü£Ús°99Ú§†-€{›²ÂS #;ݯyЋéÛÜ£—BR’ðéP{Ë·ƒˆ!¾ ¤P¯ø8Jd»–j´ï#kÒoÓ2@€È„LÂÔl>63¦~¡« 'yÁ—#®—hÚ?mj4í#ïµ€L» žà*í`w0Æõ¼oe‡—5oá¹èâ]—¯1‚1“þ©E‘ò¿Í Gkøx2Dÿèí@qÒ)‚§òÁ˜žÍù9¶À7 7îØ¿ß¼¸@BÀÃPÉ'éa s™É\‰B„'L&c‚"Ày}©ˆ´˜­þÄo¡]_KÈc…2jd»½/>ŸþÄè\&7PÖð±Ò};¸tÙæü€Åȼ,Püј7„è•Ë"c-ê?È@QÑRo´Í×T‘³‡Z#Äñ÷J­›æ†Ý÷Q¯?BàCÚþ°Ÿ€Mx{„ +@÷уOtØ°àeCHxíà”è~ç]¢³ù.¿Ÿ·%X›hlΠã¸m_8nŒ¾Éš2E¸VÄüa2Þ#†ì?™{Îäîy÷7\©¬ªË=Ò•LD_öU+;uW%qî ß)¬„ôr<ö¨¸ÅèhGþR¶¶þ>í«{<åó —¾$Ó_ˆæ,ÿŸ/D%½X&Ó]ˆðÑÆ‚5D0ŽWËØÓ±<ø_ uÓendstream +endobj +5261 0 obj << /Type /Page -/Contents 2196 0 R -/Resources 2194 0 R +/Contents 5262 0 R +/Resources 5260 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2162 0 R +/Parent 5257 0 R >> endobj -2193 0 obj << +5249 0 obj << /Type /XObject -/Subtype /Form -/FormType 1 -/PTEX.FileName (./xslt/figures/note.pdf) -/PTEX.PageNumber 1 -/PTEX.InfoDict 2209 0 R -/Matrix [1 0 0 1 0 0] -/BBox [0 0 27 27] -/Resources << -/ProcSet [ /PDF ] -/ExtGState << -/R4 2210 0 R ->>>> -/Length 2211 0 R +/Subtype /Image +/Width 780 +/Height 348 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5269 0 R] +/Length 23954 /Filter /FlateDecode >> stream -xœeU9²,GôûeË@@Q ‡!é¡%bd(dèúʤ—÷ÿ(žÑ¯ -’$¡T¬)ÿ®ïë¯ãïãÇ_¢ýþÏaíÏc‹®½Ú¿G—=ûÌöÓ1ÄF¬lÖ]töö×ãqu‰Ý¦‹÷5š”<8Ç—ý:\;âúãñ‰üéÆ&ÞЇ h—õ:ÀÀX=&02²oÒCó eD3PMtð1CrZûbœ7³}t€mA£d«·íä'ÐWŠ!è®»½KO(°ƒÔ¤‡tÙKb•^¦Ìì »å*’ÎÕBêFåmY¸™`Uõ´™Õ -¿nÜž í½³`*TûÞ£jg“¾=Ås–A½R?Ô =}³Ú§l -¤Ï’ÃigÙ¥—ÇáC6uéíÛ&”\Ê GTœ„Méêö–KòlÜ’Fyu|?é%åiÈ¥K”êNÊq{vˆ*êèJE¢]8hÍò¤p0R±ˆ$Á(+Á nÖN¬ -qª„Ñ«ò^ÿï>‹«>÷— .13×…Óƒ!¶3¢SËAÕ”ih¥Å¨Š^…(€<Îm䦽ªšÛÆlLÊâ³ò7ÙaÆ´Ëdô 6(WðÚºK -г2"ïE9~  -n*Œ1½÷¨¾x¥Æˆpîâ‹&XîÃœ§³±è\íD¤ßä0}#XŒûž˜‹¸À>#^V°¡|2Îi‰9ÊÎr)`˜¢Xh¡Ò& „hb—H°Œe"Ãêʱ„£~Ï“a³tŒºìZDß!#Z¶ÚÂk! e'jÝ=§ _tsÙ¬ûÍ&­Nå@‚i¬ˆ3t%kÐE„\H–YZxÿ/U¥Ç™åë—Φ@±¯iW H -þrÓGçX5¾ûû8‡´ÕªOª«t–Ô³$Ây°‰—BÒ›ÀÄ5©/¨vp÷o`kA“ôr ±ñœÓ4N.4Žæ&F°ÑTÆG%V½ Î'ÌØR5¬BÔ‹`qUžv-UÍ=ëÆåQv2ë_ ”¿­qq‚~èr¯Ú5ÌJ¼ð˜°h»P¡õ‹kÜàéÚýªå>Ò¸D °o»Îi¸CrT]¿MJ¥ ÆÖ¹’°;¿ö‹ûóZ¼¬ å[Ç-œÁ¤ŸBx¿ýpü|üÈÂendstream -endobj -2209 0 obj -<< -/Producer (AFPL Ghostscript 6.50) ->> -endobj -2210 0 obj -<< -/Type /ExtGState -/Name /R4 -/TR /Identity -/OPM 1 -/SM 0.02 -/SA true +xÚì]‰b«*Å÷ ùÿ¿|3h³6]ÞmÚ2ͽ¶FÑÄ9Ì>ãèRÂ/a; .ØfÛ¶‡ýnç“15Û¶œ ªð4.z³nÛí´Ã6‡m §'»Óùº-¶ÓÛÇ«ÇÛé±<‚mÇ×-žîoÛO[·¶´1ÆÛNÇm· ƒÛv;½ƒÃScžNŒ ùi‹§O»aÚÝéfI}߈…hÛ¶ÝnËa;o[`êbX·!l´ZOðv¾;}?LÛ`;Ý_O;l%œN¶m[¾N·m|Ú6¶Þ¶¦‡u;m§WÛU«Ý鸥°Í¶m²H\†u‹§ 8Ý߶Ùî4ÜÚ»vô-3èÆÄñnËÏ™¹Ðë¶Þ¸0ߘ8ß¾gfü;ºÀBºnņ±a]`!;m¾bÁlX ;,ˆæÝéýÆÔó¶õ¯±€[ÑlXhNX8œn„ð} éö±àmìÔÞ ÕN.è&ä&ø”.!•ï° OÛ½\Èß ìö‚È…å ó˜Sž¿‡dûB:R¿mņqÒŽ:R½r!êHû‰íNï7,ˆd8mãNɹ…ºnÕ¦#©M.,Òíôl»ê¥’Ã6,°õ¦<éF‡­ $Û6Þ†±§Oi:9,|©oÃBNíPð`ëí¶lým;ÂM–§m ì“ŸȴévzÛjÛ&Û6Es¶`­ÖåiÛªm» “Ý8=߶xú´mCJåº aÛᾎÛ`; ·Ávó¸9ÐàéÅvú¶EÀ’~ÝúÛÕñð p#þ“¹£ÝÓ@Áç°ðç°Ð:,\DZºoå¯aá`ð::QèäŸł{ê×rÁÙ  Ñfø::Q“:?Ò_Ä‚£;äì‡G+9¹à°àÈaÁaÁ‘ßÆñ}qàŒjÆuöŸÃBëâ Wt_¨Ãâ‚TóÿÞA1N¾ŸÀ45‘úÃ4EX„ÊaáIrñ…œx?È/)J&òex¸@VC’<¨6 +rŸ|ÔyÏK}å°àäÂ¥Ž4œÇÚü*¸"àR|ÉÕš)9cÂ"©Î®WÉGeCˆ§?‹å§ gra™ðÁ(ûí+Õ4uQÔÛ£š¦Ì„M}8IMÓ:èûO=~MêÁÁÇ«ÏrVG’±`™ÔÿÑPx•·†DÕ nÛ/ÑQW¼ Ä›}g/ìä‚Ç´ÆZåž#'Í’HP˜1|oE·¸0IŒï‹pý„±ÐšÃпŤ·æX_w¦ë”ź‹C¦ããK„JÄñ±'¾Éø‡ÁPPÆèµ\¨?ÕK«äÓ`ða”=¦íRyä%‰p7}X./±ð°&ÏÓ£=ˆéj™Z:–·Ó­'yÔ øš&]>­¾=]§ö†£±™òÏñé%üéDišäÕôɯ¿ñ`œTnY?Y +Üרpòì…òú£Xxîí‘ gw!¬„ ÌP¬3Ý@F[b– S>ÝĜв0$ƒy2°Ô¨Žz(gýrJ¦ÙV…•I4YQf…å&Ißb§vø€ç¾S¦’}j*#D=l¿‹CTiË…Ze>œ ˆxë$,ûå³X¸ ðƒóè ÁR¼T¾¿–JWt|è.Ë2=u‡Eî°p®qèeÓ´©¬r±0Ã/šeéÁÕPJJ…_pÑD:ˆ‘JE¯<-xÎ$e:FþE=#YåçWE6À¡¼i¨ L$€Žž ÒiæÙßBû9/¨æ ¦úLÃNN*mÛ»Q&A”ÉžJߢ²×áa‚rL‚Á u¤¹—I“ +Þ ¦ +É)“ïe¦ {áZí¶ÚL•~)j 9¹q¡ ü]g ç”˃Š½Ê…x d`mKÖ€½0 |U‘F À¸!šÊt¤ç{S ^‚Æ8¡2a➢T›\€ãL1gs 2˜½C¹$XúÌx¡áŒ~©*ÓôKŠNÈ'&@6ਾ^­sukAE¥ÝÄêHq‰ÅË~‚rx(Ø€íAGŠEwa+|  üR.\« îŽÔWba´FÈ•žù sXxyò Owö‚䜷ö“˜Ûš~Sé¾ï9(Mí׺3BÀž¡ó5Ì^Øv¬,MYÏt³a›ŠBÈdtáÇܤg11µH x\€XX­d`êD™XçÙ 0P«›J‹¸“Â×–Æ%åÂz[ÉtdDX(lÓ/Z6h¾‹w|ÁŸ$¾xK.˜å æë ,L7Qg÷zÃÂÿÍÿeY âBzvWkÊ¡¶þÖb<4n +‚#VwÒ”Ò,†|àjÃìèO,4³æ4¹À°×D£‚aÌ„²X°}\|`˜ë vÀ_LJßb¡Q+j‹˜s,”ˆe|*u…X°×ÑÉ*)h+¢U.Ò¶–)Õ{±êñ…k¹`š`<çmU„Es›m• +‹úò=‹…ssa¹é .ôþFÕáøwS? Œ77N¬.â LhAs˜ðm3n–zÔi6Ý)•À\ ›¤ºk±Àl;‡…» Eú€…tÀFpµ1“ Ú&TŒ,4 Ìß"­Ym”î³vpï ðlÔ‘æ=J]Ð +ÏF íýh°XÐ!³r*X± 8ÜU-«Z÷a¡¸_¸!Ttá¾o–ÄËst‡úWÒ¢H½Þ:{¯ð}Lj`ëG,\¡®‰‚È;¸þ:œ—œ°Ø¤0 5ÁMäƒjx»&žáÈ$‰àá6NCßOÖ^üm,ã ©–´r1ŠÁÔχ4ñÍsT »g 00Ù•C 6© A é¥d€½!\Õ!б¸ÌZP‰’aµƒD‡z#¤×ÑÑ!WBĽövþ6Øý\œb ³zDÌå 6ÛG/Õm ßY)c*³NQ2ÔÑ@Ú!ŽÀWÈ<ýl 0VMºh°¼ OÈ‹…Ó~5yÁ1:v”.üü¯«òÿŽ‡@l×@×tÛeT«óyî û«d½Éõ«(Ü>‡…פX|ÇU ù”\ {Û¹öVV:E‹Oêw½îðv‘d{]Æ)p›Mi Å#Cyãv˜^G[NX˜¢ $yqwƳ<ëúBUh=1_ç©ewùÆBÀØUfÃ+aá;r'†ÅÛö‚¿ó©nRÁ_ÃÅd~§ý+b=¤ÞVVÊÚΰݔ p›=ÿn¬•&•gßoBïÄÓ ÈÔ^šzÖ3{!Ö‘×c‰ÅŒ§V3\…Öv>ÝÇŸ÷©¾Õã·=š7åÉwnÿ•ÓN¶ƒµEóð8_§Ì¥UJ›~¤S`DIzK<¬û1µµÁ©~ I4›ÌYÐes-öTE´‡«ó©:z WraY3‡Š»ï36m.Ñ}¹òz™ƒÉz»RŽiìS0,ƒž%­ZågEÀrÒÌ··¢$™îaÁŒ'wâ!÷Òðj\ra>XgÑŠ…½êZ.\žx@ŽÃµô>GÎk¼«ºò§ÝvpyiÓþBßž|ÞÑÓ äàBT²t먽|rž½]¶†• ›¬Ÿæxg ?ׂ.ëöUmG΋½“ˆØsÚ +•ñ2…¢9ÝÏ ,ØAu^'Qœìg'˜Þ=±°‡ô•\ð.µ­C‡Ã>¨ä8GaíA:'_=ïu’%]Sòz~)è/´ïQzCôÖ†ówžÄ}v}`šKx*£æ²LŒ'×JÊã>†/ÜoûÒ7î‹|“–}¶©IÙ·ëäÄfà¸&î3Ä‚_–1à•-Æ Ê2°Eߦ¦`#_³²“¬ï@§0z<æ—½¿´ˆh²¾„ûi‚>î-Ylê¸l}ÁHK¬¦MñÊL™²êû yYNp%àŠÈÃ:^N|M÷ó"xUö†É1•5¼_¸„h:°÷r£N`‡dUÕ“p¸ƒ”Ý Ûr˜ æótfõ¹Õ^²®éiú¡ŒAð‡r¦šÄ1‹NRYÎ\Øo:Ú™­¿N!M/²®è2ãÔJ•l5½Œ»¡T£§fiVÆ*‡>Îî+ +»%Æ¢yLõbÏ:ía¤¹Õkáb–¢á<ëõBF¶Ã`à0šŸÈ8Ô‚XL&“Ž˜W×€ð’ð5 ó8 +—lÖä‘•1nÖ;W;¶òvVíÍ4¢ähšŽÝ3š'±°:`Óƒñp`i;—×w±pžäz).’j§Óm;,\`¡Àê2›r ’˜If¨›ÛŒo2lÕ*0y.– +ä…Y†¼‘³É¤eñBÛ™¶Êq´ã$9açveð'@ h(Œ6˜¬]efm°S~DÉmöªãxž‘-›«uâc1cJd‡ AK^©œ Ñæx1QГʕ`ê“( ‹aiu¤õš ÄõEGmß¾}£Þ9Ù-º:-䌧ýêFÀÖ?qíÎ7”{~Ø<‹AØr*¶¡ðø\ÝÇÂ?_Ê…‹ M'qæ°`Îó‘ˆ,lÎM…†I\Ä ð…w´íf©LB™›D +GJÆùVëéáG,D˜®Wró,çp<àqFCm¿y¦9ãò¤ö£šncÂA¼Føh˜PúíÀ9—rÁœÓø„…^ÛÇËl‚^à*„”\‹]üÐÃIŸ1‚ Üý†…þˆ€BÔ&š¯ßÃ-éQaÜMÅe§”4»T%Ì :ÙÂobÁØÆ'-É»_3q…«¸ó…[ØaáÂ^Ð;,ÔkB熫#{M1ÓÝ rIãj¨L‚0ɲj¶O«”}œé£IêaICÉIñˆ~͹Þ-4æŽùLΰÿôŒPÃÏeÁè¹,€)!+ø—tCœÍY@кµ:ÃÂDV©0L ¿×y/NÎ#Ï&~ÎäÂR‹½ñ¤ê)-ßÎGz  yµ³…Çw`a‹Üy',4“ —UB —&ZÖG)=— ð+ +,TÙ{WîA, »2À26f+Íà_(ði5ºD‹àˆšfcþô:˜/Ñ(±PŠô<ÆõeivSˆ­ѳrS°C饸–'í*õì$€……kIkÄB&¤\‡ áfàkI9Ós ïóð8Y6¯ ‘áLHš6ØzîîiLs9pã VÁZˆw¸˜šäº‡ä›Ë¬4z)ƒ­Îçä—J5›ù! {:(xøaœhWÕvLßsh±u¿8\éà z"¾ìO¬¢ovª.’Ãÿ¸OµÐ4íêÇCèËŒx:Sƒ¦XúE+ñ+Uíà+É_RàÛ©(uã å„©ø,€µAGŠ0)¨ä ¦ÿxZa¶]#¬«*²‰Á?.šV'¤ÔÄ×óÒØü.\Žit«2º„Ìú{ÓaV ¹.Ì8TFót®eÚ+¨T™ü á¿K!ûzâ-H¨)•úîÖ÷bÁŒ^uV‹¶·Oö ~Á„‡âˆ“ºâççõU~áÝkü}hž^»§îéHÅ´ëYæÕŽ&ձŘÃ|u’`·l³èÅæ/S˜•Á¼(_{IfƒRÒ®Ûc”š¢^«¸·7­äB°ba´PO×­µjÇm=„iuˆÙjè°«*èHÓÐE`AˆøÐúªY¼^×Óû~i;ðšÏ# +ÄB`td;Ub®T­=Ô± §¦€,³!‹¢^ؼý ‚(BwhR/ß퉒‹ŒŒ:‰ò­IWî±v“FùEU~á{ùV/êÓuCJClÙ›}; O6ù¡ÍÒq ¸ïü<ÖFÖ{DU颒bSÞ<å°€X¡ ub&=ÙD¼^’!ƒI[mãòR8³"[fpØXh@:aÁ®…`)`Ö6µYØJØ:¶ÑéÉBK–6[T´Þ à +,^™¨Ê&&×uªÁ _ß_ÖÝZÓ"—ðX‡ ÁZ4V@(YÙÐ1eÓdáB¥=.˜Š>¿ ;{¡yºoP1â¢=Ë­ud›bÁ÷¦ñªÉASB³ 4u¸LX(qãðcŒ6Md¥«ÛÜßø1î ÷‘NËaÞG¡œ\°³ `X,,ýšç¬,z¬°œÎåB-ûÂD(4ê `JcEïmõN,­?gZ³ïV,4€…«öÃaÎl/àvA%+‰›L5þZÆ,xXX˜p¢ŸbeíP˜cu Êì¹ 2Õ°µRh• ½­¸VXF‘5&å'䯠´úß4ùéX¨C7ÄN¶0Y:é.Œ†@áüƒ2^Ú6ÛÀ]‘’]ÛP÷µ/†:G,è0•8ÎdÚ_Àüž†,dkû»–­G´˜lãb:R%ð}±hPûY3ôaŠ +@#–º¡b +9ê`miáÕ4Ì„"Dš‚ñöBȹªàZñàx³`‘(IÃPGå’êw`¡¦ì¬ößaáo`¡ÛÕòÔ´0K a“ 8cq2tµœm+òŠL‚!SqF[¶ø}c=8AæÞj1Œ„TÉz„fiµè‚v="`JÁ˜,1vlSŒ+gŽ¦mM΀×p-à $„èS‚ãVU‡+UÓ VRàöõp&(ͪ‰áNg{ÿèR>¼KßÈÛôyá_pXø{ñ… ÝWí4ÉÓ¯'=³^}G÷OÝZ„57gäCÿ°C@}}]üM]~<@­}a"»Ca«¦Ü÷äjŽÃÖïÒ‚/×_pXø;X ?ö‡[œéG¨/ú`8,üu¹ðH•«öÏ_Š0øN‡'ÂʲsXøsX û’ŽNäì…?‡Gwè×É…¹ª¾~ª&WKdçÒÂ͘4M²®S~ŽÕÜ  ¯A$YWùüZjiS®öf<ÄØO±Ñk“h¡•ÒZ­ª¼ÒaÁaá7S(}°8±u›â€…N*%q1c“h]×:ÆÂñÕËM÷ÍÎJ +‡…W¢ó†¤ÃÂÛS¬QÁìžà튆-;)…ZìZò¥n3L'h/+9ePŽ­Iãþe°ðÚk~ÙZ'ž ,}éfXö”¶¨#Õ2ã>ðs ŠZ·éa­õQH/peï4hÀD£¯zÚÄœÁ‚«ý¿…ߘƒñ¿¨HÚÃÜ´D…H¨• µÌ)5'ä‚ä\¬ë\`ƒÂ˜<æ¦ +Óíãaj+_IGrñ…ÛXprá J1!¸çJF‘0l• : +„â±’`/dõaÍ<Ûq·ا³Eþ—=„”·Vrráå䂳Þ&»¸FÏ ëAMb›\ˆÎEZ£\Øe |èÄ´½í@MÅ´8,8{áw|QX×Õã +b:`@aº'(b…ËžZwi˜°•ÄxC:Ž›‚¼ fιóaSã'¾ï°ðÑv]˜ûŸäÂl¢— (jiã kõz<°Æð†‰5gÀîª×LÈåz]KçS}9rXx‚°Âû”c¿X2‹×4ÞbêÛ£7Í֯Ú(@Ï*Áð\ÒÙz¯ËàOßsXxurö¤DõüÁan5ò W“ ?’<ú|Z‡¿¶¸ÊJ‡‡…_i>7ï=¶i^ aš¦£{¤çO£ìûÖaỾýo\ÇÓÅÚ®æ¬kû5ö‚Ê&Õ]•¨(]÷ˆNâ_F\|üÚ·d@íï"ó^ .î|C–ÿª¸s¡2\p\È’[MÍûœ°[·þÝ4õ7¬‰–žîÂ7ÞÕJP.ÖöZÜócó‘l_qì/n7øÕ²2)òäÖØœ4ÈàžYû×v mjB×:Óy³–À…uª·Ø°"8Ï7v²ß®€ Ì~ßkG›—G­Éñt8ªVár8Ø’ÆÐÎÉ…Wf¨Ÿš›—2©ÙdbÊ$OŒO{)*ÀBPpßiÖžéý ü¶4ª•šã•¥–öY'س*a í8dJ)膅XhV(̲¦™){&Ù‚m>åÆÊvOjL%lOöLHî)>°:x/f†Óý†–ºZÓ®ÓA$p¤röÂëRM)ë ½Ðp>&šÂü‡To`KÿŒ®áêäÂËɇ…ïò\|rFYìÀùÓð¢(qXø.r>ÕW#!ÖÕÆý[ +*í°ðbÄGßCÚé)¯f4„$$îõ /¢÷9rô½vbQ‡~¾žÒÞ} Ž:­µ{îçdëÚÜ×ðçÈÅn˜ +  .î|¡#aÜÙ} N.8Zû#¹¯ÁÉG¦Û¹t_ߣ)ò"ß} ¯@I4¹ïÁ‘#ûàò92‚…pºÙk’וeû…¯®pßé#,PÛoÅÑ+ÄW’ÒŸñ¹›åæ“ÿ;D–I‡…RßÅÂDFòU¯¢ú)X°µÿßb/ ƒËÑü>z_@,ñ«èaá{â΋/¸:–üV,Ü‹/ôCJ–/£ðÇ`áÛâÎÜEz^W.|1~ˆóüÛò‘¸Ëø3Xpö‚àSD{š=°þ¢\hRßO9{áûÈaáeé¯Ú  Žœ½à°àè+ì…1,Š°°›btrÁaáÇQ\úöÂ8Æ´ âeŒû>ÇŸ,TÛ–±ÃŸ£Gëx¾GG •]9È¥q©³p¼‚ÃÏ‘ ¡‹/üI*¿ Ä×™R½^„ÏæOã/ .¾ðW±À¾À^£!!E&—\HÞŽ9ç< jÜY;¹àäÂÇí…м°ŽåDHÎtŸPJóð‡Êât$'>£#M²¯ —Õã9©‹"ü©öBÍØ÷dÉ9,|+Myt·öÿ]ñ…0ÖŒK¹”š–2.\|Áaá7Ñûâ “{­áms2ºø‚ÃÂo¢þ}:RY¤’…c4º¸³ÃÂ/“ ï‰/Äœsæ—ä°ðDZ’añÓü†|¤Æw9Û‘’²,óOÚ ãªa…ÿ ò³ëÚ\-ÏŸ¤G>Õ'í…1 ¦3aô£ I¡«ýwXø±XxNGÃ@ƒ™`,Æ¢ãðË–‘tD…‹;;,¼>>“4†KÀR !0
samba@samba.org
- - - -Abstract - + -Last Update : Mon Sep 30 15:23:53 CDT 2002 +Last Update : Fri Jun 6 00:45:54 CEST 2003 @@ -45,7 +44,7 @@ the internals of various parts of samba and the SMB protocol. It's still incompl The most recent version of this document can be found at http://devel.samba.org/. Please send updates to Jelmer Veenrooij. +url="mailto:jelmer@samba.org">Jelmer Vernooij. @@ -55,7 +54,20 @@ distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt - + + + + + + Attributions + + + &attributions-dev; + + + + + @@ -69,6 +81,7 @@ url="http://www.fsf.org/licenses/gpl.txt">http://www.fsf.org/licenses/gpl.txthttp://www.fsf.org/licenses/gpl.txt -BOOL smb_register_passdb(const char *name, pdb_init_function init, int version); +NTSTATUS smb_register_passdb(int version, const char *name, pdb_init_function init); @@ -99,21 +99,21 @@ The prototype for these functions is: -int init_module(void); +NTSTATUS init_module(void); This function should call one or more -registration functions. The function should return non-zero on success and zero on -failure. +registration functions. The function should return NT_STATUS_OK on success and +NT_STATUS_UNSUCCESSFUL or a more useful nt error code on failure. For example, pdb_ldap_init() contains: -int pdb_ldap_init(void) +NTSTATUS pdb_ldap_init(void) { - smb_register_passdb("ldapsam", pdb_init_ldapsam, PASSDB_INTERFACE_VERSION); - smb_register_passdb("ldapsam_nua", pdb_init_ldapsam_nua, PASSDB_INTERFACE_VERSION); - return TRUE; +smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam); +smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_nua", pdb_init_ldapsam_nua); + return NT_STATUS_OK; } diff --git a/docs/docbook/devdoc/rpc_plugin.xml b/docs/docbook/devdoc/rpc_plugin.xml index c83742a247..287e35b0be 100644 --- a/docs/docbook/devdoc/rpc_plugin.xml +++ b/docs/docbook/devdoc/rpc_plugin.xml @@ -50,12 +50,17 @@ rpc_pipe_register_commands(). This function takes the following arguments: -int rpc_pipe_register_commands(const char *clnt, const char *srv, +NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size); +version +Version number of the RPC interface. Use the define SMB_RPC_INTERFACE_VERSION for this +argument. + + clnt the Client name of the named pipe diff --git a/docs/docbook/docbook.txt b/docs/docbook/docbook.txt index 84848fd88f..dfce2fd61b 100644 --- a/docs/docbook/docbook.txt +++ b/docs/docbook/docbook.txt @@ -1,61 +1,74 @@ !== -!== docbook.txt for Samba HEAD +!== docbook.txt for Samba 3.0 !== !== Author: David Bannon, D.Bannon@latrobe.edu.au November, 2000 !== Updates: Gerald (Jerry) Carter, jerry@samba.org, Feb. 2001 !== Updates: Jelmer Vernooij, jelmer@samba.org, Aug, 2002 +!== Updates: Jelmer Vernooij, jelmer@samba.org, Jun, 2003 What are DocBook documents doing in the Samba Distribution ? ----------------------------------------------------------- -We are planning to convert all of the samba docs to SGML/DocBook V4.1 +We have converted all samba docs to XML/DocBook V4.2 in order to make them easier to maintain and produce a nicer looking product. This short note (strange isn't it how it always starts out as a short note -and becomes a long one ?) will explain very briefly how and why we are -doing this. +and becomes a long one ?) will explain very briefly how and why we have +done this. The format ---------- +If you are new to xml, regard an xml file as 'source code'. You don't +read it directly, but use it to create other formats (like the txt and html +included in ../txtdocs and ../htmldocs). -If you are new to sgml, regard an sgml file as 'source code'. You don't -read it directly, use it to create other formats (like the txt and html -included in ../txt and ../html). - -Docbook is a particular SGML style, particularly suited to producing -technical manuals. In the two documents I have produced so far I have used -DocBook 4.1, it seems that products like RedHat Linux is still include only -version 3.1, the differences are minor. The Linux Documentation Project is -using a modified version of 3.1 but are really geared up to make multi -paged documents, something we want to avoid for logistic reasons. +Docbook is a particular XML style, particularly suited to producing +technical manuals. For more information on DocBook tags and format, see "DocBook: The Definitive Guide" by Walsh and Muellner, (c) O'Reilly Publishing. -This book covers DocBook V3.1 and is available on-line +This book covers DocBook V4.2 and is available on-line at http://www.docbook.org/ The Output ---------- - -The current Samba CVS tree contains the SGML/DocBook source files as well +The current Samba CVS tree contains the XML/DocBook source files as well as the following autogenerated formats: * man pages * HTML - * ASCII text (where appropriate) * PDF +The following formats are not available in CVS but can be generated by +the build scripts: + + * PostScript + * DVI + * LaTeX + * ASCII text The Tools --------- To generate the docs, you need to have the following packages installed: -* docbook-utils -* htmldoc + * docbook-utils + * xsltproc + * pngtopnm and pnmtops (from the netpbm utilities) + +For generating PDF (thru LaTeX): + * pdflatex + +For generating PostScript (thru LaTeX): + * latex + * dvips + +For generating ASCII: + * xmlto This directory now contains a ./configure script and Makefile to support the automated building of man pages (including HTML versions), and -the building of the Samba-HOWTO-Collection (HTML,PDF,PS,Text versions). +the building of the Samba-HOWTO-Collection and the +Samba Developers Guide (HTML,DVI,TeX,PDF,PS,Text versions). diff --git a/docs/docbook/faq/errors.xml b/docs/docbook/faq/errors.xml index 97619ce704..398286e3c9 100644 --- a/docs/docbook/faq/errors.xml +++ b/docs/docbook/faq/errors.xml @@ -45,7 +45,7 @@ SMB password encryption. enable SMB password encryption in Samba. See the encryption part of the samba HOWTO Collection -disable this new behaviour in NT. See the section about +disable this behaviour in NT. See the section about Windows NT in the chapter "Portability" of the samba HOWTO collection @@ -98,79 +98,4 @@ before exporting it with Samba. - -Why can users access home directories of other users? - - - -We are unable to keep individual users from mapping to any other user's -home directory once they have supplied a valid password! They only need -to enter their own password. I have not found *any* method that I can -use to configure samba to enforce that only a user may map their own -home directory. - - - - -User xyzzy can map his home directory. Once mapped user xyzzy can also map -*anyone* elses home directory! - - - -This is not a security flaw, it is by design. Samba allows -users to have *exactly* the same access to the UNIX filesystem -as they would if they were logged onto the UNIX box, except -that it only allows such views onto the file system as are -allowed by the defined shares. - - - -This means that if your UNIX home directories are set up -such that one user can happily cd into another users -directory and do an ls, the UNIX security solution is to -change the UNIX file permissions on the users home directories -such that the cd and ls would be denied. - - - -Samba tries very hard not to second guess the UNIX administrators -security policies, and trusts the UNIX admin to set -the policies and permissions he or she desires. - - - -Samba does allow the setup you require when you have set the -"only user = yes" option on the share, is that you have not set the -valid users list for the share. - - - -Note that only user works in conjunction with the users= list, -so to get the behavior you require, add the line : - -users = %S - -this is equivalent to: - -valid users = %S - -to the definition of the [homes] share, as recommended in -the smb.conf man page. - - - - - -Until a few minutes after samba has started, clients get the error "Domain Controller Unavailable" - -A domain controller has to announce on the network who it is. This usually takes a while. - - - - -I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs -Your loopback device isn't working correctly. Make sure it's running. - - - diff --git a/docs/docbook/faq/features.xml b/docs/docbook/faq/features.xml index 66b05379cc..72a8e9c97f 100644 --- a/docs/docbook/faq/features.xml +++ b/docs/docbook/faq/features.xml @@ -2,66 +2,6 @@ Features - -How can I prevent my samba server from being used to distribute the Nimda worm? - -Author: HASEGAWA Yosuke (translated by TAKAHASHI Motonobu) - - -Nimba Worm is infected through shared disks on a network, as well as through -Microsoft IIS, Internet Explorer and mailer of Outlook series. - - - -At this time, the worm copies itself by the name *.nws and *.eml on -the shared disk, moreover, by the name of Riched20.dll in the folder -where *.doc file is included. - - - -To prevent infection through the shared disk offered by Samba, set -up as follows: - - - - -[global] - ... - # This can break Administration installations of Office2k. - # in that case, don't veto the riched20.dll - veto files = /*.eml/*.nws/riched20.dll/ - - - - -By setting the "veto files" parameter, matched files on the Samba -server are completely hidden from the clients and making it impossible -to access them at all. - - - -In addition to it, the following setting is also pointed out by the -samba-jp:09448 thread: when the -"readme.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}" file exists on -a Samba server, it is visible only as "readme.txt" and dangerous -code may be executed if this file is double-clicked. - - - -Setting the following, - - veto files = /*.{*}/ - -any files having CLSID in its file extension will be inaccessible from any -clients. - - - -This technical article is created based on the discussion of -samba-jp:09448 and samba-jp:10900 threads. - - - How can I use samba as a fax server? diff --git a/docs/docbook/faq/general.xml b/docs/docbook/faq/general.xml index 54c620b382..df0d23ce02 100644 --- a/docs/docbook/faq/general.xml +++ b/docs/docbook/faq/general.xml @@ -1,13 +1,6 @@ General Information - -Where can I get it? - -The Samba suite is available at the samba website. - - - What do the version numbers mean? diff --git a/docs/docbook/faq/install.xml b/docs/docbook/faq/install.xml index f8341dc65a..84b13f14d3 100644 --- a/docs/docbook/faq/install.xml +++ b/docs/docbook/faq/install.xml @@ -1,89 +1,6 @@ Compiling and installing Samba on a Unix host - -I can't see the Samba server in any browse lists! - -See Browsing.html in the docs directory of the samba source -for more information on browsing. - - - -If your GUI client does not permit you to select non-browsable -servers, you may need to do so on the command line. For example, under -Lan Manager you might connect to the above service as disk drive M: -thusly: - - net use M: \\mary\fred - -The details of how to do this and the specific syntax varies from -client to client - check your client's documentation. - - - - -Some files that I KNOW are on the server don't show up when I view the files from my client! -See the next question. - - - -Some files on the server show up with really wierd filenames when I view the files from my client! - -If you check what files are not showing up, you will note that they -are files which contain upper case letters or which are otherwise not -DOS-compatible (ie, they are not legal DOS filenames for some reason). - - - -The Samba server can be configured either to ignore such files -completely, or to present them to the client in "mangled" form. If you -are not seeing the files at all, the Samba server has most likely been -configured to ignore them. Consult the man page smb.conf(5) for -details of how to change this - the parameter you need to set is -"mangled names = yes". - - - - -My client reports "cannot locate specified computer" or similar - -This indicates one of three things: You supplied an incorrect server -name, the underlying TCP/IP layer is not working correctly, or the -name you specified cannot be resolved. - - - -After carefully checking that the name you typed is the name you -should have typed, try doing things like pinging a host or telnetting -to somewhere on your network to see if TCP/IP is functioning OK. If it -is, the problem is most likely name resolution. - - - -If your client has a facility to do so, hardcode a mapping between the -hosts IP and the name you want to use. For example, with Lan Manager -or Windows for Workgroups you would put a suitable entry in the file -LMHOSTS. If this works, the problem is in the communication between -your client and the netbios name server. If it does not work, then -there is something fundamental wrong with your naming and the solution -is beyond the scope of this document. - - - -If you do not have any server on your subnet supplying netbios name -resolution, hardcoded mappings are your only option. If you DO have a -netbios name server running (such as the Samba suite's nmbd program), -the problem probably lies in the way it is set up. Refer to Section -Two of this FAQ for more ideas. - - - -By the way, remember to REMOVE the hardcoded mapping before further -tests :-) - - - - My client reports "cannot locate specified share name" or similar @@ -107,106 +24,6 @@ to specify a service name correctly), read on: - -Printing doesn't work - -Make sure that the specified print command for the service you are -connecting to is correct and that it has a fully-qualified path (eg., -use "/usr/bin/lpr" rather than just "lpr"). - - - -Make sure that the spool directory specified for the service is -writable by the user connected to the service. In particular the user -"nobody" often has problems with printing, even if it worked with an -earlier version of Samba. Try creating another guest user other than -"nobody". - - - -Make sure that the user specified in the service is permitted to use -the printer. - - - -Check the debug log produced by smbd. Search for the printer name and -see if the log turns up any clues. Note that error messages to do with -a service ipc$ are meaningless - they relate to the way the client -attempts to retrieve status information when using the LANMAN1 -protocol. - - - -If using WfWg then you need to set the default protocol to TCP/IP, not -Netbeui. This is a WfWg bug. - - - -If using the Lanman1 protocol (the default) then try switching to -coreplus. Also not that print status error messages don't mean -printing won't work. The print status is received by a different -mechanism. - - - - -My client reports "This server is not configured to list shared resources" - -Your guest account is probably invalid for some reason. Samba uses the -guest account for browsing in smbd. Check that your guest account is -valid. - - -See also 'guest account' in smb.conf man page. - - - - -Log message "you appear to have a trapdoor uid system" - -This can have several causes. It might be because you are using a uid -or gid of 65535 or -1. This is a VERY bad idea, and is a big security -hole. Check carefully in your /etc/passwd file and make sure that no -user has uid 65535 or -1. Especially check the "nobody" user, as many -broken systems are shipped with nobody setup with a uid of 65535. - - -It might also mean that your OS has a trapdoor uid/gid system :-) - - -This means that once a process changes effective uid from root to -another user it can't go back to root. Unfortunately Samba relies on -being able to change effective uid from root to non-root and back -again to implement its security policy. If your OS has a trapdoor uid -system this won't work, and several things in Samba may break. Less -things will break if you use user or server level security instead of -the default share level security, but you may still strike -problems. - - - -The problems don't give rise to any security holes, so don't panic, -but it does mean some of Samba's capabilities will be unavailable. -In particular you will not be able to connect to the Samba server as -two different uids at once. This may happen if you try to print as a -"guest" while accessing a share as a normal user. It may also affect -your ability to list the available shares as this is normally done as -the guest user. - - - -Complain to your OS vendor and ask them to fix their system. - - - -Note: the reason why 65535 is a VERY bad choice of uid and gid is that -it casts to -1 as a uid, and the setreuid() system call ignores (with -no error) uid changes to -1. This means any daemon attempting to run -as uid 65535 will actually run as root. This is not good! - - - - Why are my file's timestamps off by an hour, or by a few hours? @@ -297,37 +114,4 @@ zones. - -How do I set the printer driver name correctly? -Question: - On NT, I opened "Printer Manager" and "Connect to Printer". - Enter ["\\ptdi270\ps1"] in the box of printer. I got the - following error message - - - - You do not have sufficient access to your machine - to connect to the selected printer, since a driver - needs to be installed locally. - - - - Answer: - - In the more recent versions of Samba you can now set the "printer -driver" in smb.conf. This tells the client what driver to use. For -example: - - printer driver = HP LaserJet 4L - -With this, NT knows to use the right driver. You have to get this string -exactly right. - -To find the exact string to use, you need to get to the dialog box in -your client where you select which printer driver to install. The -correct strings for all the different printers are shown in a listbox -in that dialog box. - - - diff --git a/docs/docbook/faq/sambafaq.xml b/docs/docbook/faq/sambafaq.xml index d5dc3ae40f..3c6fc85916 100644 --- a/docs/docbook/faq/sambafaq.xml +++ b/docs/docbook/faq/sambafaq.xml @@ -1,12 +1,11 @@ - - - ]> @@ -34,9 +33,7 @@ and the old samba text documents which were mostly written by John Terpstra. &general; &install; -&config; &clientapp; &errors; &features; -&printing; diff --git a/docs/docbook/global.ent b/docs/docbook/global.ent index 0ff0c9a5cf..bb1e586cb8 100644 --- a/docs/docbook/global.ent +++ b/docs/docbook/global.ent @@ -463,14 +463,19 @@ an Active Directory environment. + + + + + @@ -493,13 +498,16 @@ an Active Directory environment. + + - - - + + + Currently NOT implemented."> +root# "> diff --git a/docs/docbook/manpages/.cvsignore b/docs/docbook/manpages/.cvsignore index 2d6c32d7f2..90c11de0f9 100644 --- a/docs/docbook/manpages/.cvsignore +++ b/docs/docbook/manpages/.cvsignore @@ -1 +1 @@ -smb.conf.5.xml \ No newline at end of file +smb.conf.5.xml diff --git a/docs/docbook/manpages/net.8.xml b/docs/docbook/manpages/net.8.xml index c7874e68fd..9787f4e0b0 100644 --- a/docs/docbook/manpages/net.8.xml +++ b/docs/docbook/manpages/net.8.xml @@ -4,15 +4,6 @@ %globalentities; - - --F flags - -FIXME. Defaults to 0x21 - -'> - diff --git a/docs/docbook/manpages/pdbedit.8.xml b/docs/docbook/manpages/pdbedit.8.xml index 6d5127a855..8f7582dcb5 100644 --- a/docs/docbook/manpages/pdbedit.8.xml +++ b/docs/docbook/manpages/pdbedit.8.xml @@ -20,7 +20,7 @@ pdbedit - -l + -L -v -w -u username @@ -34,7 +34,6 @@ -x -i passdb-backend -e passdb-backend - -g -b passdb-backend -g -d debuglevel @@ -67,12 +66,12 @@ OPTIONS - -l + -L This option lists all the user accounts present in the users database. This option prints a list of user/uid pairs separated by the ':' character. - Example: pdbedit -l + Example: pdbedit -L sorce:500:Simo Sorce samba:45:Test User @@ -88,7 +87,7 @@ samba:45:Test User It causes pdbedit to list the users in the database, printing out the account fields in a descriptive format. - Example: pdbedit -l -v + Example: pdbedit -L -v --------------- username: sorce @@ -123,7 +122,7 @@ Profile Path: \\BERSERKER\profile smbpasswd 5 for details) - Example: pdbedit -l -w + Example: pdbedit -L -w sorce:500:508818B733CE64BEAAD3B435B51404EE:D2A2418EFC466A8A0F6B1DBB5C3DB80C:[UX ]:LCT-00000000: samba:45:0F2B255F7B67A7A9AAD3B435B51404EE:BC281CE3F53B6A5146629CD4751D3490:[UX ]:LCT-3BFA1E8D: @@ -152,8 +151,6 @@ samba:45:0F2B255F7B67A7A9AAD3B435B51404EE:BC281CE3F53B6A5146629CD4751D3490:[UX - - -h homedir This option can be used while adding or @@ -199,8 +196,40 @@ samba:45:0F2B255F7B67A7A9AAD3B435B51404EE:BC281CE3F53B6A5146629CD4751D3490:[UX - - + + + -G SID|rid + + This option can be used while adding or modifying a user account. It + will specify the users' new primary group SID (Security Identifier) or + rid. + + Example: -G S-1-5-21-2447931902-1787058256-3961074038-1201 + + + + + -U SID|rid + + This option can be used while adding or modifying a user account. It + will specify the users' new SID (Security Identifier) or + rid. + + Example: -U S-1-5-21-2447931902-1787058256-3961074038-5004 + + + + + -c account-control + This option can be used while adding or modifying a user + account. It will specify the users' account control property. Possible + flags that can be set are: N, D, H, L, X. + + + Example: -c "[X ]" + + + -a This option is used to add a user into the @@ -216,8 +245,16 @@ retype new password - - + + -r + This option is used to modify an existing user + in the database. This command needs a user name specified with the -u + switch. Other options can be specified to modify the properties of + the specified user. This flag is kept for backwards compatibility, but + it is no longer necessary to specify it. + + + -m This option may only be used in conjunction @@ -280,18 +317,6 @@ retype new password - - -g - If you specify -g, - then -i in-backend -e out-backend - applies to the group mapping instead of the user database. - - This option will ease migration from one passdb backend to - another and will ease backing up. - - - - -b passdb-backend Use a different default passdb backend. @@ -315,6 +340,7 @@ account policy value for bad lockout attempt is 0 + -C account-policy-value Sets an account policy to a specified value. @@ -347,7 +373,7 @@ account policy value for bad lockout attempt is now 3 VERSION - This man page is correct for version 2.2 of + This man page is correct for version 3.0 of the Samba suite. @@ -365,14 +391,7 @@ account policy value for bad lockout attempt is now 3 were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed. - - The original Samba man pages were written by Karl Auer. - The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 - release by Jeremy Allison. The conversion to DocBook for - Samba 2.2 was done by Gerald Carter. The conversion to DocBook - XML 4.2 for Samba 3.0 was done by Alexander Bokovoy. + diff --git a/docs/docbook/manpages/rpcclient.1.xml b/docs/docbook/manpages/rpcclient.1.xml index c6775d9721..688eef14e8 100644 --- a/docs/docbook/manpages/rpcclient.1.xml +++ b/docs/docbook/manpages/rpcclient.1.xml @@ -299,7 +299,7 @@ Comma Separated list of Files Execute an EnumPrinters() call. This lists the various installed and share printers. Refer to the MS Platform SDK documentation for more details of the various flags and calling options. Currently - supported info levels are 0, 1, and 2. + supported info levels are 1, 2 and 5. diff --git a/docs/docbook/manpages/samba.7.xml b/docs/docbook/manpages/samba.7.xml index 6abde609b9..1339f0bb87 100644 --- a/docs/docbook/manpages/samba.7.xml +++ b/docs/docbook/manpages/samba.7.xml @@ -13,7 +13,7 @@ - Samba + samba A Windows SMB/CIFS fileserver for UNIX @@ -341,21 +341,14 @@ Contributors to the project are now too numerous to mention here but all deserve the thanks of all Samba - users. To see a full list, look at - ftp://samba.org/pub/samba/alpha/change-log + users. To see a full list, look at the + change-log in the source package for the pre-CVS changes and at - ftp://samba.org/pub/samba/alpha/cvs.log + url="http://cvs.samba.org/"> + http://cvs.samba.org/ for the contributors to Samba post-CVS. CVS is the Open Source source code control system used by the Samba Team to develop Samba. The project would have been unmanageable without it. - - In addition, several commercial organizations now help - fund the Samba Team with money and equipment. For details see - the Samba Web pages at - http://samba.org/samba/samba-thanks.html. diff --git a/docs/docbook/manpages/smbcontrol.1.xml b/docs/docbook/manpages/smbcontrol.1.xml index a0fda2b315..7bcb7420ba 100644 --- a/docs/docbook/manpages/smbcontrol.1.xml +++ b/docs/docbook/manpages/smbcontrol.1.xml @@ -254,6 +254,13 @@ sent to smbd. + + reload-config + Force daemon to reload smb.conf configuration file. Can be sent + to smbd, nmbd, or winbindd. + + + diff --git a/docs/docbook/manpages/smbmount.8.xml b/docs/docbook/manpages/smbmount.8.xml index 356b4f8f61..f3f7d1a99b 100644 --- a/docs/docbook/manpages/smbmount.8.xml +++ b/docs/docbook/manpages/smbmount.8.xml @@ -48,11 +48,11 @@ typically this output will end up in log.smbmount. The smbmount process may also be called mount.smbfs. - NOTE: smbmount + smbmount calls smbmnt 8 to do the actual mount. You must make sure that smbmnt is in the path so - that it can be found. + that it can be found. @@ -144,6 +144,7 @@ password = <value> fmask=<arg> sets the file mask. This determines the permissions that remote files have in the local filesystem. + This is not a umask, but the actual permissions for the files. The default is based on the current umask. @@ -152,6 +153,7 @@ password = <value> dmask=<arg> Sets the directory mask. This determines the permissions that remote directories have in the local filesystem. + This is not a umask, but the actual permissions for the directories. The default is based on the current umask. diff --git a/docs/docbook/manpages/wbinfo.1.xml b/docs/docbook/manpages/wbinfo.1.xml index f9bd247997..075ce140cc 100644 --- a/docs/docbook/manpages/wbinfo.1.xml +++ b/docs/docbook/manpages/wbinfo.1.xml @@ -35,7 +35,7 @@ --sequence -r user -a user%password - -A user%password + --set-auth-user user%password --get-auth-user -p @@ -207,7 +207,7 @@ - -A username%password + --set-auth-user username%password Store username and password used by winbindd during session setup to a domain controller. This enables winbindd to operate in a Windows 2000 domain with Restrict diff --git a/docs/docbook/manpages/winbindd.8.xml b/docs/docbook/manpages/winbindd.8.xml index f19b7b8242..d41620b707 100644 --- a/docs/docbook/manpages/winbindd.8.xml +++ b/docs/docbook/manpages/winbindd.8.xml @@ -24,7 +24,7 @@ -F -S -i - -B + -Y -d <debug level> -s <smb config file> -n @@ -159,12 +159,11 @@ group: files winbind - -B - Dual daemon mode. This means winbindd will run - as 2 threads. The first will answer all requests from the cache, - thus making responses to clients faster. The other will - update the cache for the query that the first has just responded. - Advantage of this is that responses stay accurate and are faster. + -Y + Single daemon mode. This means winbindd will run + as a single process (the mode of operation in Samba 2.2). Winbindd's + default behavior is to launch a child process that is responsible for + updating expired cache entries. diff --git a/docs/docbook/projdoc/AccessControls.xml b/docs/docbook/projdoc/AccessControls.xml index 38c3475d34..44780501fe 100644 --- a/docs/docbook/projdoc/AccessControls.xml +++ b/docs/docbook/projdoc/AccessControls.xml @@ -9,7 +9,7 @@ Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of resources shared via Samba do not behave in the manner they might expect. MS Windows network -adminstrators are often confused regarding network access controls and what is the best way to +administrators are often confused regarding network access controls and what is the best way to provide users with the type of access they need while protecting resources from the consequences of untoward access capabilities. @@ -45,7 +45,7 @@ This is an opportune point to mention that it should be borne in mind that Samba provide a means of interoperability and interchange of data between two operating environments that are quite different. It was never the intent to make Unix/Linux like MS Windows NT. Instead the purpose was an is to provide a sufficient level of exchange of data between the two environments. -What is available today extends well beyond early plans and expections, yet the gap continues to +What is available today extends well beyond early plans and expectations, yet the gap continues to shrink. @@ -66,7 +66,7 @@ shrink. Samba honours and implements Unix file system access controls. Users who access a Samba server will do so as a particular MS Windows user. - This information is passed to the Samba server as part of the logon orr + This information is passed to the Samba server as part of the logon or connection setup process. Samba uses this user identity to validate whether or not the user should be given access to file system resources (files and directories). This chapter provides an overview for those @@ -110,7 +110,7 @@ shrink. operating system supports them. If not, then this option will not be available to you. Current Unix technology platforms have native support for POSIX ACLs. There are patches for the Linux kernel that provide - this also. Sadly, few Linux paltforms ship today with native ACLs and + this also. Sadly, few Linux platforms ship today with native ACLs and Extended Attributes enabled. This chapter has pertinent information for users of platforms that support them. @@ -142,14 +142,15 @@ at how Samba helps to bridge the differences. It is good news that Samba does this to a very large extent and on top of that provides a high degree of optional configuration to over-ride the default behaviour. We will look at some of these over-rides, - but for the greater part we will stay withing the bounds of default behaviour. Those wishing to explore + but for the greater part we will stay within the bounds of default behaviour. Those wishing to explore to depths of control ability should review the &smb.conf; man page. - - File System Feature Comparison - - Name Space + + File System Feature Comparison + + Name Space + MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, Unix file names may be 1023 characters long. In MS Windows file extensions indicate particular file types, @@ -158,10 +159,12 @@ at how Samba helps to bridge the differences. What MS Windows calls a Folder, Unix calls a directory, - + + - - Case Sensitivity + + Case Sensitivity + MS Windows file names are generally Upper Case if made up of 8.3 (ie: 8 character file name and 3 character extension. If longer than 8.3 file names are Case Preserving, and Case @@ -176,28 +179,32 @@ at how Samba helps to bridge the differences. Consider the following, all are unique Unix names but one single MS Windows file name: - + MYFILE.TXT MyFile.txt myfile.txt - + So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in Unix they can. So what should Samba do if all three are present? Answer, the one that is lexically first will be accessible to MS Windows users, the others are invisible and unaccessible - any other solution would be suicidal. - + + - - Directory Separators + + Directory Separators + MS Windows and DOS uses the back-slash '\' as a directory delimiter, Unix uses the forward-slash '/' as it's directory delimiter. This is transparently handled by Samba. - + + - - Drive Identification + + Drive Identification + MS Windows products support a notion of drive letters, like C: to represent disk partitions. Unix has NO concept if separate identifiers for file partitions since each @@ -205,20 +212,24 @@ at how Samba helps to bridge the differences. The Unix directory tree begins at '/', just like the root of a DOS drive is specified like C:\. - + + - - File Naming Conventions + + File Naming Conventions + MS Windows generally never experiences file names that begin with a '.', while in Unix these are commonly found in a user's home directory. Files that begin with a '.' are typically either start up files for various Unix applications, or they may be files that contain start-up configuration data. - - - - Links and Short-Cuts + + + + + Links and Short-Cuts + MS Windows make use of "links and Short-Cuts" that are actually special types of files that will redirect an attempt to execute the file to the real location of the file. Unix knows of file and directory @@ -228,10 +239,11 @@ at how Samba helps to bridge the differences. Symbolic links are files in Unix that contain the actual location of the data (file OR directory). An operation (like read or write) will operate directly on the file referenced. Symbolic links are also referred to as 'soft links'. A hard link is something that MS Windows is NOT familiar with. It allows - one physical file to be known simulataneously by more than one file name. + one physical file to be known simultaneously by more than one file name. - - + + + There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort @@ -246,13 +258,20 @@ at how Samba helps to bridge the differences. There are three basic operations for managing directories, create, delete, rename. - - Action MS Windows Command Unix Command - ------ ------------------ ------------ - create md folder mkdir folder - delete rd folder rmdir folder - rename rename oldname newname mv oldname newname - + + Managing directories with unix and windows + + + ActionMS Windows CommandUnix Command + + + + createmd foldermkdir folder + deleterd folderrmdir folder + renamerename oldname newnamemv oldname newname + + +
@@ -268,11 +287,11 @@ at how Samba helps to bridge the differences. - Unix/Linux file and directory access permissions invloves setting three (3) primary sets of data and one (1) control set. + Unix/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. A Unix file listing looks as follows:- - - jht@frodo:~/stuff> ls -la + + jht@frodo:~/stuff> ls -la total 632 drwxr-xr-x 13 jht users 816 2003-05-12 22:56 . drwxr-xr-x 37 jht users 3800 2003-05-12 22:29 .. @@ -293,8 +312,8 @@ at how Samba helps to bridge the differences. -r-xr-xr-x 1 jht users 206339 2003-05-12 22:32 mydata05.lst -rw-rw-rw- 1 jht users 41105 2003-05-12 22:32 mydata06.lst -rwxrwxrwx 1 jht users 19312 2003-05-12 22:32 mydata07.lst - jht@frodo:~/stuff> - + jht@frodo:~/stuff> + @@ -305,6 +324,7 @@ at how Samba helps to bridge the differences. The permissions field is made up of: + JRV: Put this into a diagram of some sort [ type ] [ users ] [ group ] [ others ] [File, Directory Permissions] [ d | l ] [ r w x ] [ r w x ] [ r w x ] | | | | | | | | | | | @@ -324,20 +344,24 @@ at how Samba helps to bridge the differences. Any bit flag may be unset. An unset bit flag is the equivalent of 'Can NOT' and is represented as a '-' character. - - Example File + + + Example File + -rwxr-x--- Means: The owner (user) can read, write, execute the group can read and execute everyone else can NOT do anything with it - + + + - Additional posibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = Unix Domain Socket. + Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = Unix Domain Socket. - The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x),r + The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x), execute only if the file is a directory or already has execute permission for some user (X), set user or group ID on execution (s), sticky (t). @@ -356,7 +380,7 @@ at how Samba helps to bridge the differences. - When a directory is set drw-r----- this means that the owner can read and create (write) files in it, but because + When a directory is set drw-r----- this means that the owner can read and create (write) files in it, but because the (x) execute flags are not set files can not be listed (seen) in the directory by anyone. The group can read files in the directory but can NOT create new files. NOTE: If files in the directory are set to be readable and writable for the group, then group members will be able to write to (or delete) them. @@ -379,17 +403,17 @@ Before using any of the following options please refer to the man page for &smb. User and group based controls can prove very useful. In some situations it is distinctly desirable to affect all - file system operations as if a single user is doing this, the use of the force user and - force group behaviour will achieve this. In other situations it may be necessary to affect a + file system operations as if a single user is doing this, the use of the force user and + force group behaviour will achieve this. In other situations it may be necessary to affect a paranoia level of control to ensure that only particular authorised persons will be able to access a share or - it's contents, here the use of the valid users or the invalid users may + it's contents, here the use of the valid users or the invalid users may be most useful. As always, it is highly advisable to use the least difficult to maintain and the least ambiguous method for controlling access. Remember, that when you leave the scene someone else will need to provide assistance and - if that person finds to great a mess, or if they do not understand what you have done then there is risk of + if that person finds too great a mess, or if they do not understand what you have done then there is risk of Samba being removed and an alternative solution being adopted. @@ -482,7 +506,7 @@ Before using any of the following options please refer to the man page for &smb. The following file and directory permission based controls, if misused, can result in considerable difficulty to diagnose the cause of mis-configuration. Use them sparingly and carefully. By gradually introducing each one by one undesirable side-effects may be detected. In the event of a problem, always comment all of them out and then gradually - re-instroduce them in a controlled fashion. + re-introduce them in a controlled fashion. File and Directory Permission Based Controls @@ -539,13 +563,13 @@ Before using any of the following options please refer to the man page for &smb. hide unreadable - Prevents clients from seeing the existance of files that cannot be read. + Prevents clients from seeing the existence of files that cannot be read. hide unwriteable files - Prevents clients from seeing the existance of files that cannot be written to. Unwriteable directories are shown as usual. + Prevents clients from seeing the existence of files that cannot be written to. Unwriteable directories are shown as usual. @@ -653,10 +677,10 @@ Before using any of the following options please refer to the man page for &smb. This section deals with how to configure Samba per share access control restrictions. - By default samba sets no restrictions on the share itself. Restrictions on the share itself + By default, Samba sets no restrictions on the share itself. Restrictions on the share itself can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can connect to a share. In the absence of specific restrictions the default setting is to allow - the global user Everyone Full Control (ie: Full control, Change and Read). + the global user Everyone Full Control (ie: Full control, Change and Read). @@ -669,8 +693,8 @@ Before using any of the following options please refer to the man page for &smb. Samba stores the per share access control settings in a file called share_info.tdb. The location of this file on your system will depend on how samba was compiled. The default location - for samba's tdb files is under /usr/local/samba/var. If the tdbdump - utility has been compiled and installed on your system then you can examine the contents of this file + for Samba's tdb files is under /usr/local/samba/var. If the tdbdump + utility has been compiled and installed on your system, then you can examine the contents of this file by: tdbdump share_info.tdb. @@ -678,7 +702,7 @@ Before using any of the following options please refer to the man page for &smb. Share Permissions Management - The best tool for the task is platform dependant. Choose the best tool for your environmemt. + The best tool for the task is platform dependant. Choose the best tool for your environment. @@ -692,13 +716,13 @@ Before using any of the following options please refer to the man page for &smb. Instructions - Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu - select Computer, then click on the Shared Directories entry. + Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu + select Computer, then click on the Shared Directories entry. - Now click on the share that you wish to manage, then click on the Properties tab, next click on - the Permissions tab. Now you can Add or change access control settings as you wish. + Now click on the share that you wish to manage, then click on the Properties tab, next click on + the Permissions tab. Now you can add or change access control settings as you wish. @@ -708,14 +732,14 @@ Before using any of the following options please refer to the man page for &smb. Windows 200x/XP - On MS Windows NT4/200x/XP system access control lists on the share itself are set using native + On MS Windows NT4/200x/XP system access control lists on the share itself are set using native tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder, - then select 'Sharing', then click on 'Permissions'. The default Windows NT4/200x permission allows - Everyone Full Control on the Share. + then select Sharing, then click on Permissions. The default + Windows NT4/200x permission allows Everyone Full Control on the Share. - MS Windows 200x and later all comes with a tool called the 'Computer Management' snap-in for the + MS Windows 200x and later all comes with a tool called the Computer Management snap-in for the Microsoft Management Console (MMC). This tool is located by clicking on Control Panel -> Administrative Tools -> Computer Management. @@ -723,21 +747,22 @@ Before using any of the following options please refer to the man page for &smb. Instructions - After launching the MMC with the Computer Management snap-in, click on the menu item 'Action', - select 'Connect to another computer'. If you are not logged onto a domain you will be prompted + After launching the MMC with the Computer Management snap-in, click on the menu item Action, + select Connect to another computer. If you are not logged onto a domain you will be prompted to enter a domain login user identifier and a password. This will authenticate you to the domain. - If you where already logged in with administrative privilidge this step is not offered. + If you where already logged in with administrative privilege this step is not offered. - If the Samba server is not shown in the Select Computer box, then type in the name of the target - Samba server in the field 'Name:'. Now click on the [+] next to 'System Tools', then on the [+] - next to 'Shared Folders' in the left panel. + If the Samba server is not shown in the Select Computer box, then type in the name of the target + Samba server in the field Name:. Now click on the [+] next to + System Tools, then on the [+] next to Shared Folders in the + left panel. Now in the right panel, double-click on the share you wish to set access control permissions on. - Then click on the tab 'Share Permissions'. It is now possible to add access control entities + Then click on the tab Share Permissions. It is now possible to add access control entities to the shared folder. Do NOT forget to set what type of access (full control, change, read) you wish to assign for each entry. @@ -745,10 +770,10 @@ Before using any of the following options please refer to the man page for &smb. - Be careful. If you take away all permissions from the Everyone user without removing this user + Be careful. If you take away all permissions from the Everyone user without removing this user then effectively no user will be able to access the share. This is a result of what is known as - ACL precidence. ie: Everyone with NO ACCESS means that MaryK who is part of the group Everyone - will have no access even if this user is given explicit full control access. + ACL precedence. ie: Everyone with no access means that MaryK who is part of the group + Everyone will have no access even if this user is given explicit full control access. @@ -789,19 +814,19 @@ Before using any of the following options please refer to the man page for &smb. From an NT4/2000/XP client, single-click with the right mouse button on any file or directory in a Samba mounted drive letter or UNC path. When the menu pops-up, click - on the Properties entry at the bottom of + on the Properties entry at the bottom of the menu. This brings up the file properties dialog - box. Click on the tab Security and you - will see three buttons, Permissions, - Auditing, and Ownership. - The Auditing button will cause either + box. Click on the tab Security and you + will see three buttons, Permissions, + Auditing, and Ownership. + The Auditing button will cause either an error message A requested privilege is not held by the client to appear if the user is not the NT Administrator, or a dialog which is intended to allow an Administrator to add auditing requirements to a file if the user is logged on as the NT Administrator. This dialog is non-functional with a Samba share at this time, as the only - useful button, the Add button will not currently + useful button, the Add button will not currently allow a list of users to be seen. @@ -809,7 +834,7 @@ Before using any of the following options please refer to the man page for &smb. Viewing file ownership - Clicking on the "Ownership" button + Clicking on the Ownership button brings up a dialog box telling you who owns the given file. The owner name will be of the form : @@ -819,14 +844,14 @@ Before using any of the following options please refer to the man page for &smb. the Samba server, user is the user name of the UNIX user who owns the file, and (Long name) is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database). Click on the Close - button to remove this dialog. + GECOS field of the UNIX password database). Click on the + Close button to remove this dialog. If the parameter nt acl support is set to false then the file owner will - be shown as the NT user "Everyone". + be shown as the NT user "Everyone". - The Take Ownership button will not allow + The Take Ownership button will not allow you to change the ownership of this file to yourself (clicking on it will display a dialog box complaining that the user you are currently logged onto the NT client cannot be found). The reason @@ -840,8 +865,8 @@ Before using any of the following options please refer to the man page for &smb. and allow a user with Administrator privilege connected to a Samba server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS - or Samba drive. This is available as part of the Seclib - NT security library written by Jeremy Allison of + or Samba drive. This is available as part of the Seclib + NT security library written by Jeremy Allison of the Samba Team, available from the main Samba ftp site. @@ -849,12 +874,14 @@ Before using any of the following options please refer to the man page for &smb. Viewing File or Directory Permissions - The third button is the "Permissions" + The third button is the Permissions button. Clicking on this brings up a dialog box that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed in the form : - "SERVER\user (Long name)" + "SERVER\ + user + (Long name)" Where SERVER is the NetBIOS name of the Samba server, user is the user name of @@ -864,7 +891,7 @@ Before using any of the following options please refer to the man page for &smb. If the parameter nt acl support is set to false then the file owner will - be shown as the NT user "Everyone" and the + be shown as the NT user "Everyone" and the permissions will be shown as NT "Full Control". @@ -875,23 +902,23 @@ Before using any of the following options please refer to the man page for &smb. File Permissions - The standard UNIX user/group/world triple and + The standard UNIX user/group/world triplet and the corresponding "read", "write", "execute" permissions - triples are mapped by Samba into a three element NT ACL + triplets are mapped by Samba into a three element NT ACL with the 'r', 'w', and 'x' bits mapped into the corresponding NT permissions. The UNIX world permissions are mapped into - the global NT group Everyone, followed + the global NT group Everyone, followed by the list of permissions allowed for UNIX world. The UNIX owner and group permissions are displayed as an NT - user icon and an NT local - group icon respectively followed by the list + user icon and an NT local + group icon respectively followed by the list of permissions allowed for the UNIX user and group. As many UNIX permission sets don't map into common - NT names such as "read", - "change" or "full control" then - usually the permissions will be prefixed by the words - "Special Access" in the NT display list. + NT names such as read, + "change" or full control then + usually the permissions will be prefixed by the words + "Special Access" in the NT display list. But what happens if the file has no permissions allowed for a particular UNIX user group or world component ? In order @@ -910,14 +937,14 @@ Before using any of the following options please refer to the man page for &smb. Directories on an NT NTFS file system have two different sets of permissions. The first set of permissions is the ACL set on the directory itself, this is usually displayed - in the first set of parentheses in the normal "RW" + in the first set of parentheses in the normal "RW" NT style. This first set of permissions is created by Samba in exactly the same way as normal file permissions are, described above, and is displayed in the same way. The second set of directory permissions has no real meaning - in the UNIX permissions world and represents the - "inherited" permissions that any file created within + in the UNIX permissions world and represents the + inherited permissions that any file created within this directory would inherit. Samba synthesises these inherited permissions for NT by @@ -931,32 +958,32 @@ Before using any of the following options please refer to the man page for &smb. Modifying file and directory permissions is as simple as changing the displayed permissions in the dialog box, and - clicking the OK button. However, there are + clicking the OK button. However, there are limitations that a user needs to be aware of, and also interactions with the standard Samba permission masks and mapping of DOS attributes that need to also be taken into account. If the parameter nt acl support is set to false then any attempt to set - security permissions will fail with an "Access Denied" - message. + security permissions will fail with an "Access Denied" + message. - The first thing to note is that the "Add" + The first thing to note is that the "Add" button will not return a list of users in Samba (it will give - an error message of "The remote procedure call failed - and did not execute"). This means that you can only + an error message of The remote procedure call failed + and did not execute). This means that you can only manipulate the current user/group/world permissions listed in the dialog box. This actually works quite well as these are the only permissions that UNIX actually has. - If a permission triple (either user, group, or world) + If a permission triplet (either user, group, or world) is removed from the list of permissions in the NT dialog box, - then when the "OK" button is pressed it will + then when the OK button is pressed it will be applied as "no permissions" on the UNIX side. If you then view the permissions again the "no permissions" entry will appear as the NT "O" flag, as described above. This allows you to add permissions back to a file or directory once - you have removed them from a triple component. + you have removed them from a triplet component. As UNIX supports only the "r", "w" and "x" bits of an NT ACL then if other NT security attributes such as "Delete @@ -966,15 +993,15 @@ Before using any of the following options please refer to the man page for &smb. When setting permissions on a directory the second set of permissions (in the second set of parentheses) is by default applied to all files within that directory. If this - is not what you want you must uncheck the "Replace - permissions on existing files" checkbox in the NT - dialog before clicking "OK". + is not what you want you must uncheck the Replace + permissions on existing files checkbox in the NT + dialog before clicking OK. If you wish to remove all permissions from a user/group/world component then you may either highlight the - component and click the "Remove" button, - or set the component to only have the special "Take - Ownership" permission (displayed as "O" + component and click the Remove button, + or set the component to only have the special Take + Ownership permission (displayed as "O" ) highlighted. @@ -984,16 +1011,20 @@ Before using any of the following options please refer to the man page for &smb. There are four parameters to control interaction with the standard Samba create mask parameters. - These are : + These are : - security mask - force security mode - directory security mask - force directory security mode + + security mask + force security mode + directory security mask + force directory security mode + - Once a user clicks "OK" to apply the + + + Once a user clicks OK to apply the permissions Samba maps the given permissions into a user/group/world - r/w/x triple set, and then will check the changed permissions for a + r/w/x triplet set, and then will check the changed permissions for a file against the bits set in the security mask parameter. Any bits that were changed that are not set to '1' in this parameter are left alone @@ -1050,12 +1081,15 @@ Before using any of the following options please refer to the man page for &smb. If you want to set up a share that allows users full control in modifying the permission bits on their files and directories and doesn't force any particular bits to be set 'on', then set the following - parameters in the &smb.conf; file in that share specific section : + parameters in the &smb.conf; file in that share specific section : + - security mask = 0777 - force security mode = 0 - directory security mask = 0777 - force directory security mode = 0 + + security mask = 0777 + force security mode = 0 + directory security mask = 0777 + force directory security mode = 0 + @@ -1075,13 +1109,13 @@ Before using any of the following options please refer to the man page for &smb. What this can mean is that if the owner changes the permissions to allow themselves read access using the security dialog, clicks - "OK" to get back to the standard attributes tab - dialog, and then clicks "OK" on that dialog, then + OK to get back to the standard attributes tab + dialog, and then clicks OK on that dialog, then NT will set the file permissions back to read-only (as that is what the attributes still say in the dialog). This means that after setting - permissions and clicking "OK" to get back to the - attributes dialog you should always hit "Cancel" - rather than "OK" to ensure that your changes + permissions and clicking OK to get back to the + attributes dialog you should always hit Cancel + rather than OK to ensure that your changes are not overridden. @@ -1099,10 +1133,12 @@ are examples taken from the mailing list in recent times. Users can not write to a public share + We are facing some troubles with file / directory permissions. I can log on the domain as admin user(root), - and theres a public share, on which everyone needs to have permission to create / modify files, but only + and there's a public share, on which everyone needs to have permission to create / modify files, but only root can change the file, no one else can. We need to constantly go to server to - chgrp -R users * and chown -R nobody * to allow others users to change the file. + chgrp -R users * and chown -R nobody * to allow others users to change the file. + @@ -1112,77 +1148,99 @@ are examples taken from the mailing list in recent times. Example Solution: - - Go to the top of the directory that is shared - + + Go to the top of the directory that is shared + - - Set the ownership to what ever public owner and group you want - - find 'directory_name' -type d -exec chown user.group {}\; - find 'directory_name' -type d -exec chmod 6775 'directory_name' - find 'directory_name' -type f -exec chmod 0775 {} \; - find 'directory_name' -type f -exec chown user.group {}\; - - + + Set the ownership to what ever public owner and group you want + + find 'directory_name' -type d -exec chown user.group {}\; + find 'directory_name' -type d -exec chmod 6775 'directory_name' + find 'directory_name' -type f -exec chmod 0775 {} \; + find 'directory_name' -type f -exec chown user.group {}\; + + - - Note: The above will set the 'sticky bit' on all directories. Read your - Unix/Linux man page on what that does. It causes the OS to assign to all - files created in the directories the ownership of the directory. - + + The above will set the 'sticky bit' on all directories. Read your + Unix/Linux man page on what that does. It causes the OS to assign + to all files created in the directories the ownership of the + directory. + + + + - - - Directory is: /foodbar - chown jack.engr /foodbar + Directory is: /foodbar + + $ chown jack.engr /foodbar + + - Note: This is the same as doing: - chown jack /foodbar - chgrp engr /foodbar + + This is the same as doing: + + $ chown jack /foodbar + $ chgrp engr /foodbar + + + + + Now do: - Now do: - chmod 6775 /foodbar - ls -al /foodbar/.. + + $ chmod 6775 /foodbar + $ ls -al /foodbar/.. + - You should see: - drwsrwsr-x 2 jack engr 48 2003-02-04 09:55 foodbar + + + You should see: + + drwsrwsr-x 2 jack engr 48 2003-02-04 09:55 foodbar + + + + - Now do: - su - jill - cd /foodbar - touch Afile - ls -al - + Now do: + + $ su - jill + $ cd /foodbar + $ touch Afile + $ ls -al + - You should see that the file 'Afile' created by Jill will have ownership + You should see that the file Afile created by Jill will have ownership and permissions of Jack, as follows: - + -rw-r--r-- 1 jack engr 0 2003-02-04 09:57 Afile - + - Now in your smb.conf for the share add: + Now in your &smb.conf; for the share add: force create mode = 0775 - force direcrtory mode = 6775 + force directory mode = 6775 - - Note: The above are only needed IF your users are NOT members of the group + + The above are only needed if your users are not members of the group you have used. ie: Within the OS do not have write permission on the directory. - + + - An alternative is to set in the smb.conf entry for the share: + An alternative is to set in the &smb.conf; entry for the share: force user = jack force group = engr @@ -1193,6 +1251,16 @@ are examples taken from the mailing list in recent times. + + I have set force user and Samba still makes <emphasis>root</emphasis> the owner of all the files + I touch! + + When you have a user in 'admin users', Samba will always do file operations for + this user as root, even if force user has been set. + + + + diff --git a/docs/docbook/projdoc/AdvancedNetworkAdmin.xml b/docs/docbook/projdoc/AdvancedNetworkAdmin.xml index e6e7347290..ee1f351e41 100644 --- a/docs/docbook/projdoc/AdvancedNetworkAdmin.xml +++ b/docs/docbook/projdoc/AdvancedNetworkAdmin.xml @@ -4,14 +4,33 @@ April 3 2003 -Advanced Network Manangement +Advanced Network Management -This section attempts to document peripheral issues that are of great importance to network +This section documents peripheral issues that are of great importance to network administrators who want to improve network resource access control, to automate the user environment, and to make their lives a little easier. + +Features and Benefits + + +Often the difference between a working network environment and a well appreciated one can +best be measured by the little things that makes everything work more +harmoniously. A key part of every network environment solution is the ability to remotely +manage MS Windows workstations, to remotely access the Samba server, to provide customised +logon scripts, as well as other house keeping activities that help to sustain more reliable +network operations. + + + +This chapter presents information on each of these area. They are placed here, and not in +other chapters, for ease of reference. + + + + Remote Server Administration @@ -20,20 +39,20 @@ environment, and to make their lives a little easier. -Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains', + Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains', the 'Server Manager'? -Microsoft distributes a version of these tools called nexus for installation on Windows 9x / Me -systems. The tools set includes: +Microsoft distributes a version of these tools called nexus for installation +on Windows 9x / Me systems. The tools set includes: - - Server Manager - User Manager for Domains - Event Viewer - + + Server Manager + User Manager for Domains + Event Viewer + Click here to download the archived file ftp://ftp.microsoft.com -The Windows NT 4.0 version of the 'User Manager for +The Windows NT 4.0 version of the 'User Manager for Domains' and 'Server Manager' are available from Microsoft via ftp from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE + + +Remote Desktop Management + + +There are a number of possible remote desktop management solutions that range from free +through costly. Do not let that put you off. Sometimes the most costly solutions is the +most cost effective. In any case, you will need to draw your own conclusions as to which +is the best tool in your network environment. + + + + Remote Management from NoMachines.Com + + + The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003. + It is presented in slightly edited form (with author details omitted for privacy reasons). + The entire answer is reproduced below with some comments removed. + + + + +> I have a wonderful linux/samba server running as PDC for a network. +> Now I would like to add remote desktop capabilities so that +> users outside could login to the system and get their desktop up from +> home or another country.. +> +> Is there a way to accomplish this? Do I need a windows terminal server? +> Do I need to configure it so that it is a member of the domain or a +> BDC,PDC? Are there any hacks for MS Windows XP to enable remote login +> even if the computer is in a domain? +> +> Any ideas/experience would be appreciated :) + + + + + Answer provided: Check out the new offer from NoMachine, "NX" software: + http://www.nomachine.com/. + + + + It implements a very easy-to-use interface to the remote X protocol as + well as incorporating VNC/RFB and rdesktop/RDP into it, but at a speed + performance much better than anything you may have ever seen... + + + + Remote X is not new at all -- but what they did achieve successfully is + a new way of compression and caching technologies which makes the thing + fast enough to run even over slow modem/ISDN connections. + + + + I could test drive their (public) RedHat machine in Italy, over a loaded + internet connection, with enabled thumbnail previews in KDE konqueror + which popped up immediately on "mouse-over". From inside that (remote X) + session I started a rdesktop session on another, a Windows XP machine. + To test the performance, I played Pinball. I am proud to announce here + that my score was 631750 points at first try... + + + + NX performs better on my local LAN than any of the other "pure" + connection methods I am using from time to time: TightVNC, rdesktop or + remote X. It is even faster than a direct crosslink connection between + two nodes. + + + + I even got sound playing from the remote X app to my local boxes, and + had a working "copy'n'paste" from an NX window (running a KDE session + in Italy) to my Mozilla mailing agent... These guys are certainly doing + something right! + + + + I recommend to test drive NX to anybody with a only a remote interest + in remote computing + http://www.nomachine.com/testdrive.php. + + + + Just download the free of charge client software (available for RedHat, + SuSE, Debian and Windows) and be up and running within 5 minutes (they + need to send you your account data, though, because you are assigned + a real Unix account on their testdrive.nomachine.com box... + + + + They plan to get to the point were you can have NX application servers + running as a cluster of nodes, and users simply start an NX session locally, + and can select applications to run transparently (apps may even run on + another NX node, but pretend to be on the same as used for initial login, + because it displays in the same window.... well, you also can run it + fullscreen, and after a short time you forget that it is a remote session + at all). + + + + Now the best thing at the end: all the core compression and caching + technologies are released under the GPL and available as source code + to anybody who wants to build on it! These technologies are working, + albeit started from the command line only (and very inconvenient to + use in order to get a fully running remote X session up and running....) + + + + To answer your questions: + + + + + You don't need to install a terminal server; XP has RDP support built in. + + + + NX is much cheaper than Citrix -- and comparable in performance, probably faster + + + + You don't need to hack XP -- it just works + + + + You log into the XP box from remote transparently (and I think there is no + need to change anything to get a connection, even if authentication is against a domain) + + + + The NX core technologies are all Open Source and released under the GPL -- + you can today use a (very inconvenient) commandline to use it at no cost, + but you can buy a comfortable (proprietary) NX GUI frontend for money + + + + NoMachine are encouraging and offering help to OSS/Free Software implementations + for such a frontend too, even if it means competition to them (they have written + to this effect even to the LTSP, KDE and GNOME developer mailing lists) + + + + + + + Network Logon Script Magic @@ -62,14 +227,16 @@ There are several opportunities for creating a custom network startup configurat No Logon Script Simple universal Logon Script that applies to all users - Use of a conditional Logon Script that applies per user or per group attirbutes + Use of a conditional Logon Script that applies per user or per group attributes Use of Samba's Preexec and Postexec functions on access to the NETLOGON share to create a custom Logon Script and then execute it. User of a tool such as KixStart -The Samba source code tree includes two logon script generation/execution tools. See examples directory genlogon and ntlogon subdirectories. +The Samba source code tree includes two logon script generation/execution tools. +See examples directory genlogon and +ntlogon subdirectories. @@ -77,7 +244,7 @@ The following listings are from the genlogon directory. -This is the genlogon.pl file: +This is the genlogon.pl file: #!/usr/bin/perl @@ -159,9 +326,9 @@ Those wishing to use more elaborate or capable logon processing system should ch - http://www.craigelachie.org/rhacer/ntlogon - http://www.kixtart.org - http://support.microsoft.com/default.asp?scid=kb;en-us;189105 + http://www.craigelachie.org/rhacer/ntlogon + http://www.kixtart.org + http://support.microsoft.com/default.asp?scid=kb;en-us;189105 @@ -174,10 +341,21 @@ Printers may be added automatically during logon script processing through the u rundll32 printui.dll,PrintUIEntry /? -See the documentation in the Microsoft knowledgebase article no: 189105 referred to above. +See the documentation in the Microsoft knowledgebase article no: 189105. - + +Common Errors + + +The information provided in this chapter has been reproduced from postings on the samba@samba.org +mailing list. No implied endorsement or recommendation is offered. Administrators should conduct +their own evaluation of alternatives and are encouraged to draw their own conclusions. + + + + + diff --git a/docs/docbook/projdoc/Bugs.xml b/docs/docbook/projdoc/Bugs.xml index d782920457..b2b8d5c67e 100644 --- a/docs/docbook/projdoc/Bugs.xml +++ b/docs/docbook/projdoc/Bugs.xml @@ -2,11 +2,7 @@ &author.jelmer; - - - Samba Team - - + Someone; Tridge or Karl Auer perhaps? 27 June 1997 @@ -15,7 +11,8 @@ Introduction -Please report bugs using bugzilla. +Please report bugs using + bugzilla. Please take the time to read this file before you submit a bug @@ -78,12 +75,12 @@ time, and exactly what the results were. If the bug has anything to do with Samba behaving incorrectly as a server (like refusing to open a file) then the log files will probably be very useful. Depending on the problem a log level of between 3 and -10 showing the problem may be appropriate. A higher level givesmore +10 showing the problem may be appropriate. A higher level gives more detail, but may use too much disk space. -To set the debug level use log level = in your +To set the debug level use the log level in your &smb.conf;. You may also find it useful to set the log level higher for just one machine and keep separate logs for each machine. To do this use: @@ -100,24 +97,25 @@ then create a file /usr/local/samba/lib/smb.conf.machine where machine is the name of the client you wish to debug. In that file put any &smb.conf; commands you want, for example -log level= may be useful. This also allows you to +log level may be useful. This also allows you to experiment with different security systems, protocol levels etc on just one machine. -The &smb.conf; entry log level = -is synonymous with the entry debuglevel = that has been -used in older versions of Samba and is being retained for backwards +The &smb.conf; entry log level +is synonymous with the parameter debuglevel that has +been used in older versions of Samba and is being retained for backwards compatibility of &smb.conf; files. -As the log level = value is increased you will record +As the log level value is increased you will record a significantly increasing level of debugging information. For most -debugging operations you may not need a setting higher than 3. Nearly -all bugs can be tracked at a setting of 10, but be prepared for a VERY -large volume of log data. +debugging operations you may not need a setting higher than +3. Nearly +all bugs can be tracked at a setting of 10, but be +prepared for a VERY large volume of log data. @@ -126,8 +124,8 @@ large volume of log data. Internal errors -If you get a "INTERNAL ERROR" message in your log files it means that -Samba got an unexpected signal while running. It is probably a +If you get a INTERNAL ERROR message in your log files +it means that Samba got an unexpected signal while running. It is probably a segmentation fault and almost certainly means a bug in Samba (unless you have faulty hardware or system software). @@ -151,21 +149,24 @@ files. This file is the most useful tool for tracking down the bug. To use it you do this: -gdb smbd core + + $ gdb smbd core + adding appropriate paths to smbd and core so gdb can find them. If you -don't have gdb then try dbx. Then within the debugger use the -command where to give a stack trace of where the problem -occurred. Include this in your mail. +don't have gdb then try dbx. Then within the debugger +use the command where to give a stack trace of where the +problem occurred. Include this in your report. -If you know any assembly language then do a disass of the routine +If you know any assembly language then do a +disass of the routine where the problem occurred (if its in a library routine then disassemble the routine that called it) and try to work out exactly where the problem is by looking at the surrounding code. Even if you -don't know assembly then incuding this info in the bug report can be +don't know assembly, including this info in the bug report can be useful. @@ -177,8 +178,10 @@ useful. Unfortunately some unixes (in particular some recent linux kernels) refuse to dump a core file if the task has changed uid (which smbd does often). To debug with this sort of system you could try to attach -to the running process using gdb smbd PID where you get PID from -smbstatus. Then use c to continue and try to cause the core dump +to the running process using +gdb smbd PID where you get +PID from smbstatus. +Then use c to continue and try to cause the core dump using the client. The debugger should catch the fault and tell you where it occurred. @@ -198,4 +201,3 @@ exactly what version you used. - diff --git a/docs/docbook/projdoc/CUPS-printing.xml b/docs/docbook/projdoc/CUPS-printing.xml index 7e302000e6..252da6f4ef 100644 --- a/docs/docbook/projdoc/CUPS-printing.xml +++ b/docs/docbook/projdoc/CUPS-printing.xml @@ -1,799 +1,5244 @@ - - &author.jht; + KurtPfeifle -
kpfeifle@danka.de
+ Danka Deutschland GmbH +
kpfeifle@danka.de
+ + + + CiprianVizitiu + +
CVizitiu@gbif.org
 + drawings - (25 March 2003) + + (3 June 2003) -CUPS Printing Support +CUPS Printing Support in Samba 3.0 + + + + Introduction + + + Features and Benefits + + + The Common Unix Print System (CUPS) has become very popular. All + big Linux distributions now ship it as their default printing + system. But to many it is still a very mystical tool. Normally it + "just works" (TM). People tend to regard it as a sort of "black box", + which they don't want to look into, as long as it works OK. But once + there is a little problem, they are in trouble to find out where to + start debugging it. Also, even the most recent and otherwise excellent + printed Samba documentation has only limited attention paid to CUPS + printing, leaving out important pieces or even writing plain wrong + things about it. This demands rectification. But before you dive into + this chapter, make sure that you don't forget to refer to the + "Classical Printing" chapter also. It contains a lot of information + that is relevant for CUPS too. + + + + CUPS sports quite a few unique and powerful features. While their + basic functions may be grasped quite easily, they are also + new. Because they are different from other, more traditional printing + systems, it is best to try and not apply any prior knowledge about + printing upon this new system. Rather try to start understand CUPS + from the beginning. This documentation will lead you here to a + complete understanding of CUPS, if you study all of the material + contained. But lets start with the most basic things first. Maybe this + is all you need for now. Then you can skip most of the other + paragraphs. + + + + + + Overview + + + CUPS is more than just a print spooling system. It is a complete + printer management system that complies with the new IPP + (Internet Printing Protocol). IPP is an industry + and IETF (Internet Engineering Task Force) + standard for network printing. Many of its functions can be managed + remotely (or locally) via a web browser (giving you a + platform-independent access to the CUPS print server). In addition it + has the traditional commandline and several more modern GUI interfaces + (GUI interfaces developed by 3rd parties, like KDE's + overwhelming KDEPrint). + + + + CUPS allows creation of "raw" printers (ie: NO print file + format translation) as well as "smart" printers (i.e. CUPS does + file format conversion as required for the printer). In many ways + this gives CUPS similar capabilities to the MS Windows print + monitoring system. Of course, if you are a CUPS advocate, you would + argue that CUPS is better! In any case, let us now move on to + explore how one may configure CUPS for interfacing with MS Windows + print clients via Samba. + + + -Introduction - + Basic Configuration of CUPS support + + + Printing with CUPS in the most basic smb.conf + setup in Samba 3.0 (as was true for 2.2.x) only needs two + settings: printing = cups and printcap + = cups. CUPS itself doesn't need a printcap file + anymore. However, the cupsd.conf configuration + file knows two related directives: they control if such a file should + be automatically created and maintained by CUPS for the convenience of + third party applications (example: Printcap + /etc/printcap and PrintcapFormat + BSD). These legacy programs often require the existence of + printcap file containing printernames or they will refuse to + print. Make sure CUPS is set to generate and maintain a printcap! For + details see man cupsd.conf and other CUPS-related + documentation, like the wealth of documents on your CUPS server + itself: http://localhost:631/documentation.html. + + + + Linking of smbd with libcups.so + + + Samba has a very special relationship to CUPS. The reason is: Samba + can be compiled with CUPS library support. Most recent installations + have this support enabled, and per default CUPS linking is compiled + into smbd and other Samba binaries. Of course, you can use CUPS even + if Samba is not linked against libcups.so -- but + there are some differences in required or supported configuration + then. + + + + If SAMBA is compiled against libcups, then printcap = + cups uses the CUPS API to list printers, submit jobs, + query queues, etc. Otherwise it maps to the System V commands with an + additional -oraw option for printing. On a Linux + system, you can use the ldd utility to find out + details (ldd may not be present on other OS platforms, or its function + may be embodied by a different command): + + + + transmeta:/home/kurt # ldd `which smbd` + libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000) + libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000) + libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) + [....] + + + + The line libcups.so.2 => /usr/lib/libcups.so.2 + (0x40123000) shows there is CUPS support compiled + into this version of Samba. If this is the case, and printing = cups + is set, then any otherwise manually set print command in + smb.conf is ignored. This is an + important point to remember! + + + Should you require -- for any reason -- to set your own + print commands, you can still do this by setting printing = + sysv. However, you'll loose all the benefits from the + close CUPS/Samba integration. You are on your own then to manually + configure the rest of the printing system commands (most important: + print command; other commands are + lppause command, lpresume command, lpq command, lprm + command, queuepause command and queue resume + command). + + + + Simple <filename>smb.conf</filename> Settings for CUPS + + + To summarize, here is the simplest printing-related setup + for smb.conf to enable basic CUPS support: + + + + + [global] + load printers = yes + printing = cups + printcap name = cups + + [printers] + comment = All Printers + path = /var/spool/samba + browseable = no + public = yes + guest ok = yes + writable = no + printable = yes + printer admin = root, @ntadmins + + + + + This is all you need for basic printing setup for CUPS. It will print + all Graphic, Text, PDF and PostScript file submitted from Windows + clients. However, most of your Windows users would not know how to + send these kind of files to print without opening a GUI + application. Windows clients tend to have local printer drivers + installed. And the GUI application's print buttons start a printer + driver. Your users also very rarely send files from the command + line. Unlike UNIX clients, they hardly submit graphic, text or PDF + formatted files directly to the spooler. They nearly exclusively print + from GUI applications, with a "printer driver" hooked in between the + applications native format and the print data stream. If the backend + printer is not a PostScript device, the print data stream is "binary", + sensible only for the target printer. Read on to learn which problem + this may cause and how to avoid it. + + + + +More complex <filename>smb.conf</filename> Settings for +CUPS + -The Common Unix Print System (CUPS) has become very popular, but to many it is -a very mystical tool. There is a great deal of uncertainty regarding CUPS and how -it works. The result is seen in a large number of posting on the samba mailing lists -expressing frustration when MS Windows printers appear not to work with a CUPS -backr-end. +Here is a slightly more complex printing-related setup +for smb.conf. It enables general CUPS printing +support for all printers, but defines one printer share which is set +up differently. + +> /tmp/smbprn.log ;\ + echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ;\ + echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log :\ + rm %f + public = no + guest ok = no + writeable = no + printable = yes + printer admin = kurt + hosts deny = 0.0.0.0 + hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60 +]]> + + -This is a good time to point out how CUPS can be used and what it does. CUPS is more -than just a print spooling system - it is a complete printer management system that -complies with HTTP and IPP protocols. It can be managed remotely via a web browser -and it can print using http and ipp protocols. +This special share is only there for my testing purposes. It doesn't +even write the print job to a file. It just logs the job parameters +known to Samba into the /tmp/smbprn.log file and +deletes the jobfile. Moreover, the printer +admin of this share is "kurt" (not the "@ntadmins" group); +guest access is not allowed; the share isn't announced in Network +Neighbourhood (so you need to know it is there), and it is only +allowing access from three hosts. To prevent CUPS kicking in and +taking over the print jobs for that share, we need to set +printing = sysv and printcap = +lpstat. + + + + +Advanced Configuration -CUPS allows to creation of RAW printers (ie: NO file format translation) as well as -SMART printers (ie: CUPS does file format conversion as required for the printer). In -many ways this gives CUPS similar capabilities to the MS Windows print monitoring -system. Of course, if you are a CUPS advocate, you would agrue that CUPS is better! -In any case, let us now move on to explore how one may configure CUPS for interfacing -with MS Windows print clients via Samba. +Before we dive into all the configuration options, let's clarify a few +points. Network printing needs to be organized and setup +correctly. Often this is not done correctly. Legacy systems +or small LANs in business environments often lack a clear design and +good housekeeping. + +Central spooling vs. "Peer-to-Peer" printing + -CUPS is a newcomer in the UNIX printing scene, -which has convinced many people upon first trial already. However, it has quite a few -new features, which make it different from other, more traditional printing systems. +Many small office or home networks, as well as badly organized larger +environments, allow each client a direct access to available network +printers. Generally, this is a bad idea. It often blocks one client's +access to the printer when another client's job is printing. It also +might freeze the first client's application while it is waiting to get +rid of the job. Also, there are frequent complaints about various jobs +being printed with their pages mixed with each other. A better concept +is the usage of a "print server": it routes all jobs through one +central system, which responds immediately, takes jobs from multiple +concurrent clients at the same time and in turn transfers them to the +printer(s) in the correct order. + - + +CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients - -Configuring &smb.conf; for CUPS + +Most traditionally configured Unix print servers acting on behalf of +Samba's Windows clients represented a really simple setup. Their only +task was to manage the "raw" spooling of all jobs handed to them by +Samba. This approach meant that the Windows clients were expected to +prepare the print job file in such a way that it became fit to be fed to +the printing device. Here a native (vendor-supplied) Windows printer +driver for the target device needed to be installed on each and every +client. + -Printing with CUPS in the most basic &smb.conf; -setup in Samba-3 only needs two settings: printing = cups and -printcap = cups. While CUPS itself doesn't need a printcap -anymore, the cupsd.conf configuration file knows two directives -(example: Printcap /etc/printcap and PrintcapFormat -BSD), which control if such a file should be created for the -convenience of third party applications. Make sure it is set! For details see -man cupsd.conf and other CUPS-related documentation. +Of course you can setup CUPS, Samba and your Windows clients in the +same, traditional and simple way. When CUPS printers are configured +for RAW print-through mode operation it is the responsibility of the +Samba client to fully render the print job (file). The file must be +sent in a format that is suitable for direct delivery to the +printer. Clients need to run the vendor-provided drivers to do +this. In this case CUPS will NOT do any print file format conversion +work. + + + +Driver Installation Methods on Windows Clients -If SAMBA is compiled against libcups, then printcap = cups uses the -CUPS API to list printers, submit jobs, etc. Otherwise it maps to the System V commands -with an additional -oraw option for printing. On a Linux system, -you can use the ldd command to find out details (ldd may not be -present on other OS platforms, or its function may be embodied by a different command): +The printer drivers on the Windows clients may be installed +in two functionally different ways: + +manually install the drivers locally on each client, +one by one; this yields the old LanMan style +printing; it uses a \\sambaserver\printershare +type of connection. + +deposit and prepare the drivers (for later download) on +the print server (Samba); this enables the clients to use +"Point'n'Print" to get drivers semi-automatically installed the +first time they access the printer; with this method NT/2K/XP +clients use the SPOOLSS/MS-RPC +type printing calls. + + -transmeta:/home/kurt # ldd `which smbd` - libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000) - libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000) - libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) - libdl.so.2 => /lib/libdl.so.2 (0x401e8000) - libnsl.so.1 => /lib/libnsl.so.1 (0x401ec000) - libpam.so.0 => /lib/libpam.so.0 (0x40202000) - libc.so.6 => /lib/libc.so.6 (0x4020b000) - /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) - +The second method is recommended for use over the first. + + + + +Explicitly enable "raw" printing for +<emphasis>application/octet-stream</emphasis>! -The line "libcups.so.2 => /usr/lib/libcups.so.2 -(0x40123000)" shows there is CUPS support compiled into this version of -Samba. If this is the case, and printing = cups is set, then any -otherwise manually set print command in &smb.conf; is ignored. +If you use the first option (drivers are installed on the client +side), there is one setting to take care of: CUPS needs to be told +that it should allow "raw" printing of deliberate (binary) file +formats. The CUPS files that need to be correctly set for RAW mode +printers to work are: - - -CUPS - RAW Print Through Mode + +/etc/cups/mime.types + + +/etc/cups/mime.convs + - -When used in raw print through mode is will be necessary to use the printer -vendor's drivers in each Windows client PC. +Both contain entries (at the end of the respective files) which must +be uncommented to allow RAW mode operation. +In/etc/cups/mime.types make sure this line is +present: - + + + + application/octet-stream + + -When CUPS printers are configured for RAW print-through mode operation it is the -responsibility of the Samba client to fully render the print job (file) in a format -that is suitable for direct delivery to the printer. In this case CUPS will NOT -do any print file format conversion work. +In /etc/cups/mime.convs, +have this line: + + + application/octet-stream application/vnd.cups-raw 0 - + + + -The CUPS files that need to be correctly set for RAW mode printers to work are: +If these two files are not set up correctly for raw Windows client +printing, you may encounter the dreaded Unable to +convert file 0 in your CUPS error_log file. + - - /etc/cups/mime.types - /etc/cups/mime.convs - +editing the mime.convs and the +mime.types file does not +enforce "raw" printing, it only +allows it. + + +Background + + +CUPS being a more security-aware printing system than traditional ones +does not by default allow a user to send deliberate (possibly binary) +data to printing devices. This could be easily abused to launch a +"Denial of Service" attack on your printer(s), causing at the least +the loss of a lot of paper and ink. "Unknown" data are tagged by CUPS +as MIME type: application/octet-stream and not +allowed to go to the printer. By default, you can only send other +(known) MIME types "raw". Sending data "raw" means that CUPS does not +try to convert them and passes them to the printer untouched (see next +chapter for even more background explanations). + + -Both contain entries that must be uncommented to allow RAW mode -operation. + +This is all you need to know to get the CUPS/Samba combo printing +"raw" files prepared by Windows clients, which have vendor drivers +locally installed. If you are not interested in background information about +more advanced CUPS/Samba printing, simply skip the remaining sections +of this chapter. + + + +Three familiar Methods for driver upload plus a new one -Firstly, to enable CUPS based printing from Samba the following options must be -enabled in your &smb.conf; file [globals] section: +If you want to use the MS-RPC type printing, you must upload the +drivers onto the Samba server first ([print$] +share). For a discussion on how to deposit printer drivers on the +Samba host (so that the Windows clients can download and use them via +"Point'n'Print") please also refer to the previous chapter of this +HOWTO Collection. There you will find a description or reference to +three methods of preparing the client drivers on the Samba server: + - printing = CUPS +the GUI, "Add Printer Wizard" +upload-from-a-Windows-client +method; + +the commandline, "smbclient/rpcclient" +upload-from-a-UNIX-workstation +method; - printcap = CUPS +the Imprints Toolset +method. -When these parameters are specified the print directives in &smb.conf; (as well as in -samba itself) will be ignored because samba will directly interface with CUPS through -it's application program interface (API) - so long as Samba has been compiled with -CUPS library (libcups) support. If samba has NOT been compiled with CUPS support then -printing will use the System V AT&T command set with the -oraw -option automatically passing through. + +These 3 methods apply to CUPS all the same. A new and more +convenient way to load the Windows drivers into Samba is provided +provided if you use CUPS: + +the cupsaddsmb +utility. + + -Cupsomatic (an enhanced printing utility that is part of some CUPS implementations) -on the Samba/CUPS server does *not* add any features if a file is really -printed "raw". However, if you have loaded the driver for the Windows client from -the CUPS server, using the "cupsaddsmb" utility, and if this driver is one using -a "Foomatic" PPD, the PJL header in question is already added on the Windows client, -at the time when the driver initially generated the PostScript data and CUPS in true -"-oraw" manner doesn't remove this PJL header and passes the file "as is" to its -printer communication backend. +cupsaddsmb is discussed in much detail further below. But we will +first explore the CUPS filtering system and compare the Windows and +UNIX printing architectures. + + + + +Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download -NOTE: editing in the "mime.convs" and the "mime.types" file does not *enforce* -"raw" printing, it only *allows* it. + +Still reading on? Good. Let's go into more detail then. We now know +how to set up a "dump" printserver, that is, a server which is spooling +printjobs "raw", leaving the print data untouched. + -Print files that arrive from MS Windows printing are "auto-typed" by CUPS. This aids -the process of determining proper treatment while in the print queue system. +Possibly you need to setup CUPS in a more smart way. The reasons could +be manifold: + - - Files generated by PCL drivers and directed at PCK printers get auto-typed as - application/octet-stream. Unknown file format types also - get auto-typed with this tag. - - - - Files generated by a Postscript driver and directed at a Postscript printer - are auto-typed depending on the auto-detected most suitable MIME type as: - - - * application/postscript - * application/vnd.cups-postscript - - - +Maybe your boss wants to get monthly statistics: Which +printer did how many pages? What was the average data size of a job? +What was the average print run per day? What are the typical hourly +peaks in printing? Which departments prints how +much? + +Maybe you are asked to setup a print quota system: +users should not be able to print more jobs, once they have surpassed +a given limit per period? + +Maybe your previous network printing setup is a mess +and shall be re-organized from a clean beginning? + +Maybe you have experiencing too many "Blue Screens", +originating from poorly debugged printer drivers running in NT "kernel +mode"? - + +These goals cannot be achieved by a raw print server. To build a +server meeting these requirements, you'll first need to learn about +how CUPS works and how you can enable its features. + -"application/postscript" first goes thru the "pstops" filter (where the page counting -and accounting takes place). The outcome will be of MIME type -"application/vnd.cups-postscript". The pstopsfilter reads and uses information from -the PPD and inserts user-provided options into the PostScript file. As a consequence, -the filtered file could possibly have an unwanted PJL header. +What follows is the comparison of some fundamental concepts for +Windows and Unix printing; then is the time for a description of the +CUPS filtering system, how it works and how you can tweak it. + +GDI on Windows -- PostScript on Unix + -"application/postscript" will be all files with a ".ps", ".ai", ".eps" suffix or which -have as their first character string one of "%!" or ">04<%". +Network printing is one of the most complicated and error-prone +day-to-day tasks any user or an administrator may encounter. This is +true for all OS platforms. And there are reasons for this. -"application/vnd.cups-postscript" will files which contain the string -"LANGUAGE=POSTSCRIPT" (or similar variations with different capitalization) in the -first 512 bytes, and also contain the "PJL super escape code" in the first 128 bytes -(">1B<%-12345X"). Very likely, most PostScript files generated on Windows using a CUPS -or other PPD, will have to be auto-typed as "vnd.cups-postscript". A file produced -with a "Generic PostScript driver" will just be tagged "application/postscript". +You can't expect for most file formats to just throw them towards +printers and they get printed. There needs to be a file format +conversion in between. The problem is: there is no common standard for +print file formats across all manufacturers and printer types. While +PostScript (trademark held by Adobe), and, to an +extent, PCL (trademark held by HP), have developed +into semi-official "standards", by being the most widely used PDLs +(Page Description Languages), there are still +many manufacturers who "roll their own" (their reasons may be +unacceptable license fees for using printer-embedded PostScript +interpreters, etc.). + + + +Windows Drivers, GDI and EMF -Once the file is in "application/vnd.cups-postscript" format, either "pstoraster" -or "cupsomatic" will take over (depending on the printer configuration, as -determined by the PPD in use). +In Windows OS, the format conversion job is done by the printer +drivers. On MS Windows OS platforms all application programmers have +at their disposal a built-in API, the GDI (Graphical Device +Interface), as part and parcel of the OS itself, to base +themselves on. This GDI core is used as one common unified ground, for +all Windows programs, to draw pictures, fonts and documents +on screen as well as on +paper (=print). Therefore printer driver developers can +standardize on a well-defined GDI output for their own driver +input. Achieving WYSIWYG ("What You See Is What You Get") is +relatively easy, because the on-screen graphic primitives, as well as +the on-paper drawn objects, come from one common source. This source, +the GDI, produces often a file format called EMF (Enhanced +MetaFile). The EMF is processed by the printer driver and +converted to the printer-specific file format. -A printer queue with *no* PPD associated to it is a "raw" printer and all files -will go directly there as received by the spooler. The exeptions are file types -"application/octet-stream" which need "passthrough feature" enabled. -"Raw" queues don't do any filtering at all, they hand the file directly to the -CUPS backend. This backend is responsible for the sending of the data to the device -(as in the "device URI" notation as lpd://, socket://, smb://, ipp://, http://, -parallel:/, serial:/, usb:/ etc.) +To the GDI foundation in MS Windows, Apple has chosen to +put paper and screen output on a common foundation for their +(BSD-Unix-based, did you know??) Mac OS X and Darwin Operating +Systems.Their Core Graphic Engine uses a +PDF derivate for all display work. - -"cupsomatic"/Foomatic are *not* native CUPS drivers and they don't ship with CUPS. -They are a Third Party add-on, developed at Linuxprinting.org. As such, they are -a brilliant hack to make all models (driven by Ghostscript drivers/filters in -traditional spoolers) also work via CUPS, with the same (good or bad!) quality -as in these other spoolers. "cupsomatic" is only a vehicle to execute a ghostscript -commandline at that stage in the CUPS filtering chain, where "normally" the native -CUPS "pstoraster" filter would kick in. cupsomatic by-passes pstoraster, "kidnaps" -the printfile from CUPS away and re-directs it to go through Ghostscipt. CUPS accepts this, -because the associated CUPS-O-Matic-/Foomatic-PPD specifies: + + +
Windows Printing to a local Printer + + + + +
 + - - *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic" - + +Unix Printfile Conversion and GUI Basics -This line persuades CUPS to hand the file to cupsomatic, once it has successfully -converted it to the MIME type "application/vnd.cups-postscript". This conversion will not -happen for Jobs arriving from Windows which are auto-typed "application/octet-stream", -with the according changes in "/etc/cups/mime.types" in place. - +In Unix and Linux, there is no comparable layer built into the OS +kernel(s) or the X (screen display) server. Every application is +responsible for itself to create its print output. Fortunately, most +use PostScript. That gives at least some common ground. Unfortunately, +there are many different levels of quality for this PostScript. And +worse: there is a huge difference (and no common root) in the way how +the same document is displayed on screen and how it is presented on +paper. WYSIWYG is more difficult to achieve. This goes back to the +time decades ago, when the predecessors of X.org, +designing the UNIX foundations and protocols for Graphical User +Interfaces refused to take over responsibility for "paper output" +also, as some had demanded at the time, and restricted itself to +"on-screen only". (For some years now, the "Xprint" project has been +under development, attempting to build printing support into the X +framework, including a PostScript and a PCL driver, but it is not yet +ready for prime time.) You can see this unfavorable inheritance up to +the present day by looking into the various "font" directories on your +system; there are separate ones for fonts used for X display and fonts +to be used on paper. + + + +Background -CUPS is widely configurable and flexible, even regarding its filtering mechanism. -Another workaround in some situations would be to have -in "/etc/cups/mime.types" entries as follows: +The PostScript programming language is an "invention" by Adobe Inc., +but its specifications have been published to the full. Its strength +lies in its powerful abilities to describe graphical objects (fonts, +shapes, patterns, lines, curves, dots...), their attributes (color, +linewidth...) and the way to manipulate (scale, distort, rotate, +shift...) them. Because of its open specification, anybody with the +skill can start writing his own implementation of a PostScript +interpreter and use it to display PostScript files on screen or on +paper. Most graphical output devices are based on the concept of +"raster images" or "pixels" (one notable exception are pen +plotters). Of course, you can look at a PostScript file in its textual +form and you will be reading its PostScript code, the language +instructions which need to be interpreted by a rasterizer. Rasterizers +produce pixel images, which may be displayed on screen by a viewer +program or on paper by a printer. + + - - application/postscript application/vnd.cups-raw 0 - - application/vnd.cups-postscript application/vnd.cups-raw 0 - - + +PostScript and Ghostscript -This would prevent all Postscript files from being filtered (rather, they will go -thru the virtual "nullfilter" denoted with "-"). This could only be useful for -PS printers. If you want to print PS code on non-PS printers an entry as follows -could be useful: +So, Unix is lacking a common ground for printing on paper and +displaying on screen. Despite this unfavorable legacy for Unix, basic +printing is fairly easy: if you have PostScript printers at your +disposal! The reason is: these devices have a built-in PostScript +language "interpreter", also called a Raster Image +Processor (RIP), (which makes them more expensive than +other types of printers); throw PostScript towards them, and they will +spit out your printed pages. Their RIP is doing all the hard work of +converting the PostScript drawing commands into a bitmap picture as +you see it on paper, in a resolution as done by your printer. This is +no different to PostScript printing of a file from a Windows origin. - - */* application/vnd.cups-raw 0 - - +Traditional Unix programs and printing systems -- while +using PostScript -- are largely not PPD-aware. PPDs are "PostScript +Printer Description" files. They enable you to specify and control all +options a printer supports: duplexing, stapling, punching... Therefore +Unix users for a long time couldn't choose many of the supported +device and job options, unlike Windows or Apple users. But now there +is CUPS.... ;-) + + -and would effectively send *all* files to the backend without further processing. +
Printing to a Postscript Printer + + + + +
 -Lastly, you could have the following entry: +However, there are other types of printers out there. These don't know +how to print PostScript. They use their own Page Description +Language (PDL, often proprietary). To print to them is much +more demanding. Since your Unix applications mostly produce +PostScript, and since these devices don't understand PostScript, you +need to convert the printfiles to a format suitable for your printer +on the host, before you can send it away. + - - application/vnd.cups-postscript application/vnd.cups-raw 0 my_PJL_stripping_filter - + +Ghostscript -- the Software RIP for non-PostScript Printers -You will need to write a "my_PJL_stripping_filter" (could be a shellscript) that -parses the PostScript and removes the unwanted PJL. This would need to conform to -CUPS filter design (mainly, receive and pass the parameters printername, job-id, -username, jobtitle, copies, print options and possibly the filename). It would -be installed as world executable into "/usr/lib/cups/filters/" and will be called -by CUPS if it encounters a MIME type "application/vnd.cups-postscript". +Here is where Ghostscript kicks in. Ghostscript is +the traditional (and quite powerful) PostScript interpreter used on +Unix platforms. It is a RIP in software, capable to do a +lot of file format conversions, for a very broad +spectrum of hardware devices as well as software file formats. +Ghostscript technology and drivers is what enables PostScript printing +to non-PostScript hardware. -CUPS can handle "-o job-hold-until=indefinite". This keeps the job in the queue -"on hold". It will only be printed upon manual release by the printer operator. -This is a requirement in many "central reproduction departments", where a few -operators manage the jobs of hundreds of users on some big machine, where no -user is allowed to have direct access. (The operators often need to load the -proper paper type before running the 10.000 page job requested by marketing -for the mailing, etc.). +
Ghostscript as a RIP for non-postscript printers + + + + +
 - + +Use the "gs -h" command to check for all built-in "devices" of your +Ghostscript version. If you specify e.g. a parameter of +-sDEVICE=png256 on your Ghostscript command +line, you are asking Ghostscript to convert the input into a PNG +file. Naming a "device" on the commandline is the most important +single parameter to tell Ghostscript how exactly it should render the +input. New Ghostscript versions are released at fairly regular +intervals, now by artofcode LLC. They are initially put under the +"AFPL" license, but re-released under the GNU GPL as soon as the next +AFPL version appears. GNU Ghostscript is probably the version +installed on most Samba systems. But it has got some +deficiencies. Therefore ESP Ghostscript was developed as an +enhancement over GNU Ghostscript, with lots of bug-fixes, additional +devices and improvements. It is jointly maintained by developers from +CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat and Debian. It includes +the "cups" device (essential to print to non-PS printers from CUPS). + + - -CUPS as a network PostScript RIP + +PostScript Printer Description (PPD) Specification -This is the configuration where CUPS drivers are working on server, and where the -Adobe PostScript driver with CUPS-PPDs is downloaded to clients. +While PostScript in essence is a Page Description +Language (PDL) to represent the page layout in a +device independent way, real world print jobs are +always ending up to be output on a hardware with device-specific +features. To take care of all the differences in hardware, and to +allow for innovations, Adobe has specified a syntax and file format +for PostScript Printer Description (PPD) +files. Every PostScript printer ships with one of these files. -CUPS is perfectly able to use PPD files (PostScript -Printer Descriptions). PPDs can control all print device options. They -are usually provided by the manufacturer -- if you own a PostSript printer, -that is. PPD files are always a component of PostScript printer drivers on MS -Windows or Apple Mac OS systems. They are ASCII files containing -user-selectable print options, mapped to appropriate PostScript, PCL or PJL -commands for the target printer. Printer driver GUI dialogs translate these -options "on-the-fly" into buttons and drop-down lists for the user to -select. +PPDs contain all information about general and special features of the +given printer model: Which different resolutions can it handle? Does +it have a Duplexing Unit? How many paper trays are there? What media +types and sizes does it take? For each item it also names the special +command string to be sent to the printer (mostly inside the PostScript +file) in order to enable it. -CUPS can load, without any conversions, the PPD file from -any Windows (NT is recommended) PostScript driver and handle the options. -There is a web browser interface to the print options (select -http://localhost:631/printers/ and click on one "Configure Printer" button -to see it), a commandline interface (see man lpoptions or -try if you have lphelp on your system) plus some different GUI frontends on Linux -UNIX, which can present PPD options to the users. PPD options are normally -meant to become evaluated by the PostScript RIP on the real PostScript -printer. +Information from these PPDs is meant to be taken into account by the +printer drivers. Therefore, installed as part of the Windows +PostScript driver for a given printer is the printer's PPD. Where it +makes sense, the PPD features are presented in the drivers' UI dialogs +to display to the user as choice of print options. In the end, the +user selections are somehow written (in the form of special +PostScript, PJL, JCL or vendor-dependent commands) into the PostScript +file created by the driver. + +A PostScript file that was created to contain device-specific commands +for achieving a certain print job output (e.g. duplexed, stapled and +punched) on a specific target machine, may not print as expected, or +may not be printable at all on other models; it also may not be fit +for further processing by software (e.g. by a PDF distilling program). + + + + +CUPS can use all Windows-formatted Vendor PPDs + -CUPS doesn't stop at "real" PostScript printers in its -usage of PPDs. The CUPS developers have extended the PPD concept, to also -describe available device and driver options for non-PostScript printers -through CUPS-PPDs. +CUPS can handle all spec-compliant PPDs as supplied by the +manufacturers for their PostScript models. Even if a +Unix/Linux-illiterate vendor might not have mentioned our favorite +OS in his manuals and brochures -- you can safely trust this: +if you get hold of the Windows NT version of the PPD, you +can use it unchanged in CUPS and thus access the full +power of your printer just like a Windows NT user could! + +To check the spec compliance of any PPD online, go to http://www.cups.org/testppd.php +and upload your PPD. You will see the results displayed +immediately. CUPS in all versions after 1.1.19 has a much more strict +internal PPD parsing and checking code enabled; in case of printing +trouble this online resource should be one of your first pitstops. + + + +For real PostScript printers don't use the +Foomatic or cupsomatic +PPDs from Linuxprinting.org. With these devices the original +vendor-provided PPDs are always the first choice! + + + +If you are looking for an original vendor-provided PPD of a specific +device, and you know that an NT4 box (or any other Windows box) on +your LAN has the PostScript driver installed, just use +smbclient //NT4-box/print\$ -U username to +access the Windows directory where all printer driver files are +stored. First look in the W32X86/2 subdir for +the PPD you are seeking. + + + + +CUPS also uses PPDs for non-PostScript Printers + -This is logical, as CUPS includes a fully featured -PostScript interpreter (RIP). This RIP is based on Ghostscript. It can -process all received PostScript (and additionally many other file formats) -from clients. All CUPS-PPDs geared to non-PostScript printers contain an -additional line, starting with the keyword *cupsFilter. -This line -tells the CUPS print system which printer-specific filter to use for the -interpretation of the accompanying PostScript. Thus CUPS lets all its -printers appear as PostScript devices to its clients, because it can act as a -PostScript RIP for those printers, processing the received PostScript code -into a proper raster print format. +CUPS also uses specially crafted PPDs to handle non-PostScript +printers. These PPDs are usually not available from the vendors (and +no, you can't just take the PPD of a Postscript printer with the same +model name and hope it works for the non-PostScript version too). To +understand how these PPDs work for non-PS printers we first need to +dive deeply into the CUPS filtering and file format conversion +architecture. Stay tuned. + + + + +The CUPS Filtering Architecture -CUPS-PPDs can also be used on Windows-Clients, on top of a -PostScript driver (recommended is the Adobe one). +The core of the CUPS filtering system is based on +Ghostscript. In addition to Ghostscript, CUPS +uses some other filters of its own. You (or your OS vendor) may have +plugged in even more filters. CUPS handles all data file formats under +the label of various MIME types. Every incoming +printfile is subjected to an initial +auto-typing. The auto-typing determines its given +MIME type. A given MIME type implies zero or more possible filtering +chains relevant to the selected target printer. This section discusses +how MIME types recognition and conversion rules interact. They are +used by CUPS to automatically setup a working filtering chain for any +given input data format. -This feature enables CUPS to do a few tricks no other -spooler can do: +If CUPS rasterizes a PostScript file natively to +a bitmap, this is done in 2 stages: - act as a networked PostScript RIP (Raster Image Processor), handling - printfiles from all client platforms in a uniform way; - act as a central accounting and billing server, as all files are passed - through the pstops Filter and are therefor logged in - the CUPS page_log. - NOTE: this - can not happen with "raw" print jobs, which always remain unfiltered - per definition; - enable clients to consolidate on a single PostScript driver, even for - many different target printers. +the first stage uses a Ghostscript device named "cups" +(this is since version 1.1.15) and produces a generic raster format +called "CUPS raster". + + +the second stage uses a "raster driver" which converts +the generic CUPS raster to a device specific raster. - - -Windows Terminal Servers (WTS) as CUPS clients + +Make sure your Ghostscript version has the "cups" device compiled in +(check with gs -h | grep cups). Otherwise you +may encounter the dreaded Unable to convert file +0 in your CUPS error_log file. To have "cups" as a +device in your Ghostscript, you either need to patch GNU +Ghostscript and re-compile or use ESP Ghostscript. The +superior alternative is ESP Ghostscript: it supports not just CUPS, +but 300 other devices too (while GNU Ghostscript supports only about +180). Because of this broad output device support, ESP Ghostscript is +the first choice for non-CUPS spoolers too. It is now recommended by +Linuxprinting.org for all spoolers. + -This setup may be of special interest to people -experiencing major problems in WTS environments. WTS need often a multitude -of non-PostScript drivers installed to run their clients' variety of -different printer models. This often imposes the price of much increased -instability. In many cases, in an attempt to overcome this problem, site -administrators have resorted to restrict the allowed drivers installed on -their WTS to one generic PCL- and one PostScript driver. This however -restricts the clients in the amount of printer options available for them -- -often they can't get out more then simplex prints from one standard paper -tray, while their devices could do much better, if driven by a different -driver! +CUPS printers may be setup to use external +rendering paths. One of the most common ones is provided by the +Foomatic/cupsomatic concept, from Linuxprinting.org. This +uses the classical Ghostscript approach, doing everything in one +step. It doesn't use the "cups" device, but one of the many +others. However, even for Foomatic/cupsomatic usage, best results and +broadest printer model support is provided by ESP Ghostscript (more +about cupsomatic/Foomatic, particularly the new version called now +foomatic-rip, follows below). + +MIME types and CUPS Filters + -Using an Adobe PostScript driver, enabled with a CUPS-PPD, -seems to be a very elegant way to overcome all these shortcomings. The -PostScript driver is not known to cause major stability problems on WTS (even -if used with many different PPDs). The clients will be able to (again) chose -paper trays, duplex printing and other settings. However, there is a certain -price for this too: a CUPS server acting as a PostScript RIP for its clients -requires more CPU and RAM than just to act as a "raw spooling" device. Plus, -this setup is not yet widely tested, although the first feedbacks look very -promising... +CUPS reads the file /etc/cups/mime.types +(and all other files carrying a *.types suffix +in the same directory) upon startup. These files contain the MIME +type recognition rules which are applied when CUPS runs its +auto-typing routines. The rule syntax is explained in the man page +for mime.types and in the comments section of the +mime.types file itself. A simple rule reads +like this: - + - -Setting up CUPS for driver download - - -The cupsadsmb utility (shipped with all current -CUPS versions) makes the sharing of any (or all) installed CUPS printers very -easy. Prior to using it, you need the following settings in &smb.conf;: - - - [global] - load printers = yes - printing = cups - printcap name = cups - - [printers] - comment = All Printers - path = /var/spool/samba - browseable = no - public = yes - guest ok = yes - writable = no - printable = yes - printer admin = root - - [print$] - comment = Printer Drivers - path = /etc/samba/drivers - browseable = yes - guest ok = no - read only = yes - write list = root - - - -For licensing reasons the necessary files of the Adobe -Postscript driver can not be distributed with either Samba or CUPS. You need -to download them yourself from the Adobe website. Once extracted, create a -drivers directory in the CUPS data directory (usually -/usr/share/cups/). Copy the Adobe files using -UPPERCASE filenames, to this directory as follows: - - - - ADFONTS.MFM - ADOBEPS4.DRV - ADOBEPS4.HLP - ADOBEPS5.DLL - ADOBEPSU.DLL - ADOBEPSU.HLP - DEFPRTR2.PPD - ICONLIB.DLL - - - -Users of the ESP Print Pro software are able to install -their "Samba Drivers" package for this purpose with no problem. + application/pdf pdf string(0,%PDF) + + + + +This means: if a filename has either a +.pdf suffix, or if the magic +string %PDF is right at the +beginning of the file itself (offset 0 from the start), then it is +a PDF file (application/pdf). +Another rule is this: - + + application/postscript ai eps ps string(0,%!) string(0,<04>%!) - -Sources of CUPS drivers / PPDs + + + +Its meaning: if the filename has one of the suffixes +.ai, .eps, +.ps or if the file itself starts with one of the +strings %! or %!]]>, it +is a generic PostScript file +(application/postscript). + + + +There is a very important difference between two similar MIME type in +CUPS: one is application/postscript, the other is +application/vnd.cups-postscript. While +application/postscript is meant to be device +independent (job options for the file are still outside the PS file +content, embedded in commandline or environment variables by CUPS), +application/vnd.cups-postscript may have the job +options inserted into the PostScript data itself (were +applicable). The transformation of the generic PostScript +(application/postscript) to the device-specific version +(application/vnd.cups-postscript) is the responsibility of the +CUPS pstops filter. pstops uses information +contained in the PPD to do the transformation. + + + +Don't confuse the other mime.types file your system might be using +with the one in the /etc/cups/ directory. + + + +CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI and a +lot of image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster, +PNM, PBM, SGI-RGB and some more) and their associated MIME types +with its filters. + + + + +MIME type Conversion Rules + + +CUPS reads the file /etc/cups/mime.convs +(and all other files named with a *.convs +suffix in the same directory) upon startup. These files contain +lines naming an input MIME type, an output MIME type, a format +conversion filter which can produce the output from the input type +and virtual costs associated with this conversion. One example line +reads like this: + + + + + application/pdf application/postscript 33 pdftops + + + + +This means that the pdftops filter will take +application/pdf as input and produce +application/postscript as output, the virtual +cost of this operation is 33 CUPS-$. The next filter is more +expensive, costing 66 CUPS-$: + + + + + application/vnd.hp-HPGL application/postscript 66 hpgltops + + + + +This is the hpgltops, which processes HP-GL +plotter files to PostScript. + + + + + application/octet-stream + + + + +Here are two more examples: + + + + + application/x-shell application/postscript 33 texttops + text/plain application/postscript 33 texttops + + + + +The last two examples name the texttops filter +to work on "text/plain" as well as on "application/x-shell". (Hint: +this differentiation is needed for the syntax highlighting feature of +"texttops"). + + + + +Filter Requirements + + +There are many more combinations named in mime.convs. However, you +are not limited to use the ones pre-defined there. You can plug in any +filter you like into the CUPS framework. It must meet, or must be made +to meet some minimal requirements. If you find (or write) a cool +conversion filter of some kind, make sure it complies to what CUPS +needs, and put in the right lines in mime.types +and mime.convs, then it will work seamlessly +inside CUPS! + + + +The mentioned "CUPS requirements" for filters are simple. Take +filenames or stdin as input and write to +stdout. They should take these 5 or 6 arguments: +printer job user title copies options [filename] + + + +Printer +The name of the printer queue (normally this is the +name of the filter being run) + + +job +The numeric job ID for the job being +printed + + +Printer +The string from the originating-user-name +attribute + + +Printer +The string from the job-name attribute + + +Printer +The numeric value from the number-copies +attribute + + +Printer +The job options + + +Printer +(Optionally) The print request file (if missing, +filters expected data fed through stdin). In most +cases it is very easy to write a simple wrapper script around existing +filters to make them work with CUPS. + + + + + + +Prefilters + + +As was said, PostScript is the central file format to any Unix based +printing system. From PostScript, CUPS generates raster data to feed +non-PostScript printers. + + + +But what is happening if you send one of the supported non-PS formats +to print? Then CUPS runs "pre-filters" on these input formats to +generate PostScript first. There are pre-filters to create PS from +ASCII text, PDF, DVI or HP-GL. The outcome of these filters is always +of MIME type application/postscript (meaning that +any device-specific print options are not yet embedded into the +PostScript by CUPS, and that the next filter to be called is +pstops). Another pre-filter is running on all supported image formats, +the imagetops filter. Its outcome is always of +MIME type application/vnd.cups-postscript +(not application/postscript), meaning it has the +print options already embedded into the file. + + + +
Prefiltering in CUPS to form Postscript + + + + +
+ + + + +pstops + + +pstopsis the filter to convert +application/postscript to +application/vnd.cups-postscript. It was said +above that this filter inserts all device-specific print options +(commands to the printer to ask for the duplexing of output, or +stapling an punching it, etc.) into the PostScript file. + + + +
Adding Device-specific Print Options + + + + +
+ -On the internet you can find now many thousand CUPS-PPD -files (with their companion filters), in many national languages, -supporting more than 1.000 non-PostScript models. +This is not all: other tasks performed by it are: - ESP PrintPro - (http://wwwl.easysw.com/printpro/) - (commercial, non-Free) is packaged with more than 3.000 PPDs, ready for - successful usage "out of the box" on Linux, IBM-AIX, HP-UX, Sun-Solaris, - SGI-IRIX, Compaq Tru64, Digital Unix and some more commercial Unices (it - is written by the CUPS developers themselves and its sales help finance - the further development of CUPS, as they feed their creators) - the Gimp-Print-Project - (http://gimp-print.sourceforge.net/) - (GPL, Free Software) provides around 120 PPDs (supporting nearly 300 - printers, many driven to photo quality output), to be used alongside the - Gimp-Print CUPS filters; - TurboPrint - (http://www.turboprint.com/) - (Shareware, non-Freee) supports roughly the same amount of printers in - excellent quality; - OMNI - (http://www-124.ibm.com/developerworks/oss/linux/projects/omni/) - (LPGL, Free) is a package made by IBM, now containing support for more - than 400 printers, stemming from the inheritance of IBM OS/2 KnowHow - ported over to Linux (CUPS support is in a Beta-stage at present); - HPIJS - (http://hpinkjet.sourceforge.net/) - (BSD-style licnes, Free) supports around 120 of HP's own printers and is - also providing excellent print quality now; - Foomatic/cupsomatic (http://www.linuxprinting.org/) - (LPGL, Free) from Linuxprinting.org are providing PPDs for practically every - Ghostscript filter known to the world, now usable with CUPS. + +selecting the range of pages to be printed (if you choose to +print only pages "3, 6, 8-11, 16, 19-21", or only the odd numbered +ones) + + + +putting 2 or more logical pages on one sheet of paper (the +so-called "number-up" function) + + +counting the pages of the job to insert the accounting +information into the /var/log/cups/page_log + + + + +pstoraster -NOTE: the cupsomatic trick from Linuxprinting.org is -working different from the other drivers. While the other drivers take the -generic CUPS raster (produced by CUPS' own pstoraster PostScript RIP) as -their input, cupsomatic "kidnaps" the PostScript inside CUPS, before -RIP-ping, deviates it to an external Ghostscript installation (which now -becomes the RIP) and gives it back to a CUPS backend once Ghostscript is -finished. -- CUPS versions from 1.1.15 and later will provide their pstoraster -PostScript RIP function again inside a system-wide Ghostscript -installation rather than in "their own" pstoraster filter. (This -CUPS-enabling Ghostscript version may be installed either as a -patch to GNU or AFPL Ghostscript, or as a complete ESP Ghostscript package). -However, this will not change the cupsomatic approach of guiding the printjob -along a different path through the filtering system than the standard CUPS -way... +pstoraster is at the core of the CUPS filtering +system. It is responsible for the first stage of the rasterization +process. Its input is of MIME type application/vnd.cups-postscript; +its output is application/vnd.cups-raster. This output format is not +yet meant to be printable. Its aim is to serve as a general purpose +input format for more specialized raster drivers, +that are able to generate device-specific printer data. -Once you installed a printer inside CUPS with one of the -recommended methods (the lpadmin command, the web browser interface or one of -the available GUI wizards), you can use cupsaddsmb to share the -printer via Samba. cupsaddsmb prepares the driver files for -comfortable client download and installation upon their first contact with -this printer share. +
Postscript to intermediate Raster format + + + + +
 + +CUPS raster is a generic raster format with powerful features. It is +able to include per-page information, color profiles and more to be +used by the following downstream raster drivers. Its MIME type is +registered with IANA and its specification is of course completely +open. It is designed to make it very easy and inexpensive for +manufacturers to develop Linux and Unix raster drivers for their +printer models, should they choose to do so. CUPS always takes care +for the first stage of rasterization so these vendors don't need to care +about Ghostscript complications (in fact, there is currently more +than one vendor financing the development of CUPS raster drivers). + + + +
CUPS-raster production using Ghostscript + + + + +
+ + + +CUPS versions before version 1.1.15 were shipping a binary (or source +code) standalone filter, named "pstoraster". pstoraster was derived +from GNU Ghostscript 5.50, and could be installed besides and in +addition to any GNU or AFPL Ghostscript package without conflicting. + + +From version 1.1.15, this has changed. The functions for this has been +integrated back into Ghostscript (now based on GNU Ghostscript version +7.05). The "pstoraster" filter is now a simple shell script calling +gs with the -sDEVICE=cups +parameter. If your Ghostscript doesn't show a success on asking for +gs -h |grep cups, you might not be able to +print. Update your Ghostscript then! + + -<command>cupsaddsmb</command> +imagetops and imagetoraster + +Above in the section about prefilters, we mentioned the prefilter +that generates PostScript from image formats. The imagetoraster +filter is used to convert directly from image to raster, without the +intermediate PostScript stage. It is used more often than the above +mentioned prefilters. Here is a summarizing flowchart of image file +filtering: + -The cupsaddsmb command copies the needed files -for convenient Windows client installations from the previously prepared CUPS -data directory to your [print$] share. Additionally, the PPD -associated with this printer is copied from /etc/cups/ppd/ to -[print$]. +
Image format to CUPS-raster format conversion + + + + +
 - -root# cupsaddsmb -U root infotec_IS2027 -Password for root required to access localhost via -SAMBA: [type in password 'secret'] - + + + +rasterto [printers specific] + + +CUPS ships with quite some different raster drivers processing CUPS +raster. On my system I find in /usr/lib/cups/filter/ these: +rastertoalps, rastertobj, rastertoepson, rastertoescp, +rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo, +rastertoescp, rastertohp and +rastertoprinter. Don't worry if you have less +than this; some of these are installed by commercial add-ons to CUPS +(like rastertoturboprint), others (like +rastertoprinter) by 3rd party driver +development projects (such as Gimp-Print) wanting to cooperate as +closely as possible with CUPS. + -To share all printers and drivers, use the -a -parameter instead of a printer name. +
Raster to Printer Specific formats + + + + +
 + + +CUPS Backends -Probably you want to see what's going on. Use the --v parameter to get a more verbose output: +The last part of any CUPS filtering chain is a "backend". Backends +are special programs that send the print-ready file to the final +device. There is a separate backend program for any transfer +"protocol" of sending printjobs over the network, or for every local +interface. Every CUPS printqueue needs to have a CUPS "device-URI" +associated with it. The device URI is the way to encode the backend +used to send the job to its destination. Network device-URIs are using +two slashes in their syntax, local device URIs only one, as you can +see from the following list. Keep in mind that local interface names +may vary much from my examples, if your OS is not Linux: + +usb + +This backend sends printfiles to USB-connected printers. An +example for the CUPS device-URI to use is: +usb:/dev/usb/lp0 + + +serial + +This backend sends printfiles to serially connected printers. +An example for the CUPS device-URI to use is: +serial:/dev/ttyS0?baud=11500 + + +parallel + +This backend sends printfiles to printers connected to the +parallel port. An example for the CUPS device-URI to use is: +parallel:/dev/lp0 + + +scsi + +This backend sends printfiles to printers attached to the +SCSI interface. An example for the CUPS device-URI to use is: +scsi:/dev/sr1 + + +lpd + +This backend sends printfiles to LPR/LPD connected network +printers. An example for the CUPS device-URI to use is: +lpd://remote_host_name/remote_queue_name + + +AppSocket/HP JetDirect + +This backend sends printfiles to AppSocket (a.k.a. "HP +JetDirect") connected network printers. An example for the CUPS +device-URI to use is: +socket://10.11.12.13:9100 + + +ipp + +This backend sends printfiles to IPP connected network +printers (or to other CUPS servers). Examples for CUPS device-URIs +to use are: +ipp:://192.193.194.195/ipp +(for many HP printers) or +ipp://remote_cups_server/printers/remote_printer_name + + +http + +This backend sends printfiles to HTTP connected printers. +(The http:// CUPS backend is only a symlink to the ipp:// backend.) +Examples for the CUPS device-URIs to use are: +http:://192.193.194.195:631/ipp +(for many HP printers) or +http://remote_cups_server:631/printers/remote_printer_name + + +smb + +This backend sends printfiles to printers shared by a Windows +host. An example for CUPS device-URIs to use are: +smb://workgroup/server/printersharename +Or +Smb://server/printersharename +or +smb://username:password@workgroup/server/printersharename +or +smb://username:password@server/printersharename. +The smb:// backend is a symlink to the Samba utility +smbspool (doesn't ship with CUPS). If the +symlink is not present in your CUPS backend directory, have your +root user create it: ln -s `which smbspool` +/usr/lib/cups/backend/smb. + + + -Probably you want to see what's going on. Use the --v parameter to get a more verbose output: +It is easy to write your own backends as Shell or Perl scripts, if you +need any modification or extension to the CUPS print system. One +reason could be that you want to create "special" printers which send +the printjobs as email (through a "mailto:/" backend), convert them to +PDF (through a "pdfgen:/" backend) or dump them to "/dev/null" (In +fact I have the system-wide default printer set up to be connected to +a "devnull:/" backend: there are just too many people sending jobs +without specifying a printer, or scripts and programs which don't name +a printer. The system-wide default deletes the job and sends a polite +mail back to the $USER asking him to always specify a correct +printername). - -Note: The following line shave been wrapped so that information is not lost. - -root# cupsaddsmb -v -U root infotec_IS2027 - Password for root required to access localhost via SAMBA: - Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir W32X86;put - /var/spool/cups/tmp/3cd1cc66376c0 W32X86/infotec_IS2027.PPD;put - /usr/share/cups/drivers/ - ADOBEPS5.DLL W32X86/ADOBEPS5.DLL;put /usr/share/cups/drivers/ADOBEPSU.DLLr - W32X86/ADOBEPSU.DLL;put /usr/share/cups/drivers/ADOBEPSU.HLP W32X86/ADOBEPSU.HLP' - added interface ip=10.160.16.45 bcast=10.160.31.255 nmask=255.255.240.0 - added interface ip=192.168.182.1 bcast=192.168.182.255 nmask=255.255.255.0 - added interface ip=172.16.200.1 bcast=172.16.200.255 nmask=255.255.255.0 - Domain=[TUX-NET] OS=[Unix] Server=[Samba 2.2.3a.200204262025cvs] - NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86 - putting file /var/spool/cups/tmp/3cd1cc66376c0 as - \W32X86/infotec_IS2027.PPD (17394.6 kb/s) (average 17395.2 kb/s) - putting file /usr/share/cups/drivers/ADOBEPS5.DLL as - \W32X86/ADOBEPS5.DLL (10877.4 kb/s) (average 11343.0 kb/s) - putting file /usr/share/cups/drivers/ADOBEPSU.DLL as - \W32X86/ADOBEPSU.DLL (5095.2 kb/s) (average 9260.4 kb/s) - putting file /usr/share/cups/drivers/ADOBEPSU.HLP as - \W32X86/ADOBEPSU.HLP (8828.7 kb/s) (average 9247.1 kb/s) - - Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir WIN40;put - /var/spool/cups/tmp/3cd1cc66376c0 WIN40/infotec_IS2027.PPD;put - /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;put - /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV;put - /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP;put - /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD;put - /usr/share/cups/drivers/ICONLIB.DLL WIN40/ICONLIB.DLL;put - /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;' - added interface ip=10.160.16.45 bcast=10.160.31.255 nmask=255.255.240.0 - added interface ip=192.168.182.1 bcast=192.168.182.255 nmask=255.255.255.0 - added interface ip=172.16.200.1 bcast=172.16.200.255 nmask=255.255.255.0 - Domain=[TUX-NET] OS=[Unix] Server=[Samba 2.2.3a.200204262025cvs] - NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40 - putting file /var/spool/cups/tmp/3cd1cc66376c0 as - \WIN40/infotec_IS2027.PPD (26091.5 kb/s) (average 26092.8 kb/s) - putting file /usr/share/cups/drivers/ADFONTS.MFM as - \WIN40/ADFONTS.MFM (11241.6 kb/s) (average 11812.9 kb/s) - putting file /usr/share/cups/drivers/ADOBEPS4.DRV as - \WIN40/ADOBEPS4.DRV (16640.6 kb/s) (average 14679.3 kb/s) - putting file /usr/share/cups/drivers/ADOBEPS4.HLP as - \WIN40/ADOBEPS4.HLP (11285.6 kb/s) (average 14281.5 kb/s) - putting file /usr/share/cups/drivers/DEFPRTR2.PPD as - \WIN40/DEFPRTR2.PPD (823.5 kb/s) (average 12944.0 kb/s) - putting file /usr/share/cups/drivers/ICONLIB.DLL as - \WIN40/ICONLIB.DLL (19226.2 kb/s) (average 13169.7 kb/s) - putting file /usr/share/cups/drivers/PSMON.DLL as - \WIN40/PSMON.DLL (18666.1 kb/s) (average 13266.7 kb/s) - - Running command: rpcclient localhost -N -U'root%secret' - -c 'adddriver "Windows NT x86" - "infotec_IS2027:ADOBEPS5.DLL:infotec_IS2027.PPD:ADOBEPSU.DLL: - ADOBEPSU.HLP:NULL:RAW:NULL"' - cmd = adddriver "Windows NT x86" - "infotec_IS2027:ADOBEPS5.DLL:infotec_IS2027.PPD:ADOBEPSU.DLL: - ADOBEPSU.HLP:NULL:RAW:NULL" - Printer Driver infotec_IS2027 successfully installed. - - Running command: rpcclient localhost -N -U'root%secret' - -c 'adddriver "Windows 4.0" - "infotec_IS2027:ADOBEPS4.DRV:infotec_IS2027.PPD:NULL: - ADOBEPS4.HLP:PSMON.DLL:RAW: ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"' - cmd = adddriver "Windows 4.0" "infotec_IS2027:ADOBEPS4.DRV: - infotec_IS2027.PPD:NULL:ADOBEPS4.HLP:PSMON.DLL:RAW: - ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL" - Printer Driver infotec_IS2027 successfully installed. - - Running command: rpcclient localhost -N -U'root%secret' - -c 'setdriver infotec_IS2027 infotec_IS2027' - cmd = setdriver infotec_IS2027 infotec_IS2027 - Succesfully set infotec_IS2027 to driver infotec_IS2027. - - root# - - - -If you look closely, you'll discover your root password was transfered unencrypted over -the wire, so beware! Also, if you look further her, you'll discover error messages like -NT_STATUS_OBJECT_NAME_COLLISION in between. They occur, because -the directories WIN40 and W32X86 already -existed in the [print$] driver download share (from a previous driver -installation). They are harmless here. - - - -Now your printer is prepared for the clients to use. From -a client, browse to the CUPS/Samba server, open the "Printers" -share, right-click on this printer and select "Install..." or -"Connect..." (depending on the Windows version you use). Now their -should be a new printer in your client's local "Printers" folder, -named (in my case) "infotec_IS2027 on kdebitshop" - - - -NOTE: -cupsaddsmb will only reliably work i -with CUPS version 1.1.15 or higher -and Samba from 2.2.4. If it doesn't work, or if the automatic printer -driver download to the clients doesn't succeed, you can still manually -install the CUPS printer PPD on top of the Adobe PostScript driver on -clients and then point the client's printer queue to the Samba printer -share for connection, should you desire to use the CUPS networked -PostScript RIP functions. + +Not all of the mentioned backends may be present on your system or +usable (depending on your hardware configuration). One test for all +available CUPS backends is provided by the lpinfo +utility. Used with the -v parameter, it lists +all available backends: + + + + lpinfo -v + + - + +cupsomatic/Foomatic -- how do they fit into the Picture? - -The CUPS Filter Chains + +"cupsomatic" filters may be the most widely used on CUPS +installations. You must be clear about the fact that these were not +developed by the CUPS people. They are a "Third Party" add-on to +CUPS. They utilize the traditional Ghostscript devices to render jobs +for CUPS. When troubleshooting, you should know about the +difference. Here the whole rendering process is done in one stage, +inside Ghostscript, using an appropriate "device" for the target +printer. cupsomatic uses PPDs which are generated from the "Foomatic" +Printer & Driver Database at Linuxprinting.org. + -The following diagrams reveal how CUPS handles print jobs. +You can recognize these PPDs from the line calling the +cupsomatic filter: - -######################################################################### -# + + + *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic" + + + + +This line you may find amongst the first 40 or so lines of the PPD +file. If you have such a PPD installed, the printer shows up in the +CUPS web interface with a foomatic namepart for +the driver description. cupsomatic is a Perl script that runs +Ghostscript, with all the complicated commandline options +auto-constructed from the selected PPD and commandline options give to +the printjob. + + + +However, cupsomatic is now deprecated. Its PPDs (especially the first +generation of them, still in heavy use out there) are not meeting the +Adobe specifications. You might also suffer difficulties when you try +to download them with "Point'n'Print" to Windows clients. A better, +and more powerful successor is now in a very stable Beta-version +available: it is called foomatic-rip. To use +foomatic-rip as a filter with CUPS, you need the new-type PPDs. These +have a similar, but different line: + + + + + *cupsFilter: "application/vnd.cups-postscript 0 foomatic-rip" + + + + +The PPD generating engine at Linuxprinting.org has been revamped. +The new PPDs comply to the Adobe spec. On top, they also provide a +new way to specify different quality levels (hi-res photo, normal +color, grayscale, draft...) with a single click (whereas before you +could have required 5 or more different selections (media type, +resolution, inktype, dithering algorithm...). There is support for +custom-size media built in. There is support to switch +print-options from page to page, in the middle of a job. And the +best thing is: the new foomatic-rip now works seamlessly with all +legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR etc.), providing +for them access to use PPDs for their printing! + + + + +The Complete Picture + + +If you want to see an overview over all the filters and how they +relate to each other, the complete picture of the puzzle is at the end +of this document. + + + + +<filename>mime.convs</filename> + + +CUPS auto-constructs all possible filtering chain paths for any given +MIME type, and every printer installed. But how does it decide in +favor or against a specific alternative? (There may often be cases, +where there is a choice of two or more possible filtering chains for +the same target printer). Simple: you may have noticed the figures in +the 3rd column of the mime.convs file. They represent virtual costs +assigned to this filter. Every possible filtering chain will sum up to +a total "filter cost". CUPS decides for the most "inexpensive" route. + + + +The setting of FilterLimit 1000 in +cupsd.conf will not allow more filters to +run concurrently than will consume a total of 1000 virtual filter +cost. This is a very efficient way to limit the load of any CUPS +server by setting an appropriate "FilterLimit" value. A FilterLimit of +200 allows roughly 1 job at a time, while a FilterLimit of 1000 allows +approximately 5 jobs maximum at a time. + + + + +"Raw" printing + + +You can tell CUPS to print (nearly) any file "raw". "Raw" means it +will not be filtered. CUPS will send the file to the printer "as is" +without bothering if the printer is able to digest it. Users need to +take care themselves that they send sensible data formats only. Raw +printing can happen on any queue if the "-o raw" option is specified +on the command line. You can also set up raw-only queues by simply not +associating any PPD with it. This command: + + + + + lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E + + + + +sets up a queue named "rawprinter", connected via the "socket" +protocol (a.k.a. "HP JetDirect") to the device at IP address +11.12.1.3.14, using port 9100. (If you had added a PPD with +-P /path/to/PPD to this command line, you would +have installed a "normal" printqueue. + + + +CUPS will automatically treat each job sent to a queue as a "raw" one, +if it can't find a PPD associated with the queue. However, CUPS will +only send known MIME types (as defined in its own mime.types file) and +refuse others. + + + + +"application/octet-stream" printing + + +Any MIME type with no rule in the +/etc/cups/mime.types file is regarded as unknown +or application/octet-stream and will not be +sent. Because CUPS refuses to print unknown MIME types per default, +you will probably have experienced the fact that printjobs originating +from Windows clients were not printed. You may have found an error +message in your CUPS logs like: + + + + + Unable to convert file 0 to printable format for job + + + + +To enable the printing of "application/octet-stream" files, edit +these two files: + + + +/etc/cups/mime.convs + +/etc/cups/mime.types + + + +Both contain entries (at the end of the respective files) which must +be uncommented to allow RAW mode operation for +application/octet-stream. In /etc/cups/mime.types +make sure this line is present: + + + + + application/octet-stream + + + + +This line (with no specific auto-typing rule set) makes all files +not otherwise auto-typed a member of application/octet-stream. In +/etc/cups/mime.convs, have this +line: + + + + + application/octet-stream application/vnd.cups-raw 0 - + + + + +This line tells CUPS to use the Null Filter +(denoted as "-", doing... nothing at all) on +application/octet-stream, and tag the result as +application/vnd.cups-raw. This last one is +always a green light to the CUPS scheduler to now hand the file over +to the "backend" connecting to the printer and sending it over. + + + Editing the mime.convs and the +mime.types file does not +enforce "raw" printing, it only +allows it. + + + +Background + + +CUPS being a more security-aware printing system than traditional ones +does not by default allow one to send deliberate (possibly binary) +data to printing devices. (This could be easily abused to launch a +Denial of Service attack on your printer(s), causing at least the loss +of a lot of paper and ink...) "Unknown" data are regarded by CUPS +as MIME type +application/octet-stream. While you +can send data "raw", the MIME type for these must +be one that is known to CUPS and an allowed one. The file +/etc/cups/mime.types defines the "rules" how CUPS +recognizes MIME types. The file +/etc/cups/mime.convs decides which file +conversion filter(s) may be applied to which MIME types. + + + + + +PostScript Printer Descriptions (PPDs) for non-PS Printers + + +Originally PPDs were meant to be used for PostScript printers +only. Here, they help to send device-specific commands and settings +to the RIP which processes the jobfile. CUPS has extended this +scope for PPDs to cover non-PostScript printers too. This was not +very difficult, because it is a standardized file format. In a way +it was logical too: CUPS handles PostScript and uses a PostScript +RIP (=Ghostscript) to process the jobfiles. The only difference is: +a PostScript printer has the RIP built-in, for other types of +printers the Ghostscript RIP runs on the host computer. + + + +PPDs for a non-PS printer have a few lines that are unique to +CUPS. The most important one looks similar to this: + + + + + *cupsFilter: application/vnd.cups-raster 66 rastertoprinter + + + + +It is the last piece in the CUPS filtering puzzle. This line tells the +CUPS daemon to use as a last filter "rastertoprinter". This filter +should be served as input an "application/vnd.cups-raster" MIME type +file. Therefore CUPS should auto-construct a filtering chain, which +delivers as its last output the specified MIME type. This is then +taken as input to the specified "rastertoprinter" filter. After this +the last filter has done its work ("rastertoprinter" is a Gimp-Print +filter), the file should go to the backend, which sends it to the +output device. + + + +CUPS by default ships only a few generic PPDs, but they are good for +several hundred printer models. You may not be able to control +different paper trays, or you may get larger margins than your +specific model supports): + + + +deskjet.ppd +older HP inkjet printers and compatible + + + +deskjet2.ppd +newer HP inkjet printers and compatible + + + +dymo.ppd +label printers + + + +epson9.ppd +Epson 24pin impact printers and compatible + + + +epson24.ppd +Epson 24pin impact printers and compatible + + + +okidata9.ppd +Okidata 9pin impact printers and compatible + + + +okidat24.ppd +Okidata 24pin impact printers and compatible + + + +stcolor.ppd +older Epson Stylus Color printers + + + +stcolor2.ppd +newer Epson Stylus Color printers + + + +stphoto.ppd +older Epson Stylus Photo printers + + + +stphoto2.ppd +newer Epson Stylus Photo printers + + + +laserjet.ppd +all PCL printers. Further below is a discussion +of several other driver/PPD-packages suitable fur use with CUPS. + + + + + + +Difference between <emphasis>cupsomatic/foomatic-rip</emphasis> and +<emphasis>native CUPS</emphasis> printing + + +Native CUPS rasterization works in two steps. + + + + +First is the "pstoraster" step. It uses the special "cups" +device from ESP Ghostscript 7.05.x as its tool + + + +Second comes the "rasterdriver" step. It uses various +device-specific filters; there are several vendors who provide good +quality filters for this step, some are Free Software, some are +Shareware/Non-Free, some are proprietary. + + + +Often this produces better quality (and has several more +advantages) than other methods. + + + +
cupsomatic/foomatic processing versus Native CUPS + + + + +
+ + + +One other method is the cupsomatic/foomatic-rip +way. Note that cupsomatic is not made by the CUPS +developers. It is an independent contribution to printing development, +made by people from Linuxprinting.org (see also http://www.cups.org/cups-help.html). +cupsomatic is no longer developed and maintained and is no longer +supported. It has now been replaced by +foomatic-rip. foomatic-rip is a complete re-write +of the old cupsomatic idea, but very much improved and generalized to +other (non-CUPS) spoolers. An upgrade to foomatic-rip is strongly +advised, especially if you are upgrading to a recent version of CUPS +too. + + + +Both the cupsomatic (old) and the foomatic-rip (new) methods from +Linuxprinting.org use the traditional Ghostscript print file +processing, doing everything in a single step. It therefore relies on +all the other devices built-in into Ghostscript. The quality is as +good (or bad) as Ghostscript rendering is in other spoolers. The +advantage is that this method supports many printer models not +supported (yet) by the more modern CUPS method. + + + +Of course, you can use both methods side by side on one system (and +even for one printer, if you set up different queues), and find out +which works best for you. + + + +cupsomatic "kidnaps" the printfile after the +application/vnd.cups-postscript stage and +deviates it through the CUPS-external, system wide Ghostscript +installation: Therefore the printfile bypasses the "pstoraster" filter +(and thus also bypasses the CUPS-raster-drivers +"rastertosomething"). After Ghostscript finished its rasterization, +cupsomatic hands the rendered file directly to the CUPS backend. The +flowchart above illustrates the difference between native CUPS +rendering and the Foomatic/cupsomatic method. + + + + +Examples for filtering Chains + + +Here are a few examples of commonly occurring filtering chains to +illustrate the workings of CUPS. + + + +Assume you want to print a PDF file to a HP JetDirect-connected +PostScript printer, but you want to print the pages 3-5, 7, 11-13 +only, and you want to print them "2-up" and "duplex": + + + +your print options (page selection as required, 2-up, +duplex) are passed to CUPS on the commandline; + +the (complete) PDF file is sent to CUPS and autotyped as +application/pdf; + +the file therefore first must pass the +pdftops pre-filter, which produces PostScript +MIME type application/postscript (a preview here +would still show all pages of the original PDF); + +the file then passes the pstops +filter which applies the commandline options: it selects the pages +2-5, 7 and 11-13, creates and imposed layout "2 pages on 1 sheet" and +inserts the correct "duplex" command (as is defined in the printer's +PPD) into the new PostScript file; the file now is of PostScript MIME +type +application/vnd.cups-postscript; + +the file goes to the socket +backend, which transfers the job to the printers. + + + +The resulting filter chain therefore is: + + + +pdftops --> pstops --> socket + + + +Assume your want to print the same filter to an USB-connected +Epson Stylus Photo printer, installed with the CUPS +stphoto2.ppd. The first few filtering stages +are nearly the same: + + + +your print options (page selection as required, 2-up, +duplex) are passed to CUPS on the commandline; + +the (complete) PDF file is sent to CUPS and autotyped as +application/pdf; + +the file therefore first must pass the +pdftops pre-filter, which produces PostScript +MIME type application/postscript (a preview here +would still show all pages of the original PDF); + +the file then passes the "pstops" filter which applies +the commandline options: it selects the pages 2-5, 7 and 11-13, +creates and imposed layout "2 pages on 1 sheet" and inserts the +correct "duplex" command... (OOoops -- this printer and his PPD +don't support duplex printing at all -- this option will be ignored +then) into the new PostScript file; the file now is of PostScript +MIME type +application/vnd.cups-postscript; + +the file then passes the +pstoraster stage and becomes MIME type +application/cups-raster; + +finally, the rastertoepson filter +does its work (as is indicated in the printer's PPD), creating the +printer-specific raster data and embedding any user-selected +print-options into the print data stream; + +the file goes to the usb backend, +which transfers the job to the printers. + + + +The resulting filter chain therefore is: + + + +pdftops --> pstops --> pstoraster --> rastertoepson --> usb + + + + +Sources of CUPS drivers / PPDs + + +On the internet you can find now many thousand CUPS-PPD files +(with their companion filters), in many national languages, +supporting more than 1000 non-PostScript models. + + + +ESP +PrintPro (http://wwwl.easysw.com/printpro/) (commercial, +non-Free) is packaged with more than 3000 PPDs, ready for +successful use "out of the box" on Linux, Mac OS X, IBM-AIX, +HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital Unix and some +more commercial Unices (it is written by the CUPS developers +themselves and its sales help finance the further development of +CUPS, as they feed their creators). + +the Gimp-Print-Project +(http://gimp-print.sourceforge.net/) (GPL, Free Software) +provides around 140 PPDs (supporting nearly 400 printers, many driven +to photo quality output), to be used alongside the Gimp-Print CUPS +filters; + +TurboPrint +(http://www.turboprint.com/) (Shareware, non-Free) supports +roughly the same amount of printers in excellent +quality; + +OMNI +(http://www-124.ibm.com/developerworks/oss/linux/projects/omni/) +(LPGL, Free) is a package made by IBM, now containing support for more +than 400 printers, stemming from the inheritance of IBM OS/2 Know-How +ported over to Linux (CUPS support is in a Beta-stage at +present); + +HPIJS +(http://hpinkjet.sourceforge.net/) (BSD-style licenses, Free) +supports around 150 of HP's own printers and is also providing +excellent print quality now (currently available only via the Foomatic +path); + +Foomatic/cupsomatic +(http://www.linuxprinting.org/) (LPGL, Free) from +Linuxprinting.org are providing PPDs for practically every Ghostscript +filter known to the world (including Omni, Gimp-Print and +HPIJS). + + + +The cupsomatic/Foomatic trick from Linuxprinting.org works +differently from the other drivers. This is explained elsewhere in this +document. + + + + +Printing with Interface Scripts + + +CUPS also supports the usage of "interface scripts" as known from +System V AT&T printing systems. These are often used for PCL +printers, from applications that generate PCL print jobs. Interface +scripts are specific to printer models. They have a similar role as +PPDs for PostScript printers. Interface scripts may inject the Escape +sequences as required into the print data stream, if the user has +chosen to select a certain paper tray, or print landscape, or use A3 +paper, etc. Interfaces scripts are practically unknown in the Linux +realm. On HP-UX platforms they are more often used. You can use any +working interface script on CUPS too. Just install the printer with +the -i option: + + + + + lpadmin -p pclprinter -v socket://11.12.13.14:9100 -i /path/to/interface-script + + + + +Interface scripts might be the "unknown animal" to many. However, +with CUPS they provide the most easy way to plug in your own +custom-written filtering script or program into one specific print +queue (some information about the traditional usage of interface scripts is +to be found at http://playground.sun.com/printing/documentation/interface.html). + + + + + +Network printing (purely Windows) + + +Network printing covers a lot of ground. To understand what exactly +goes on with Samba when it is printing on behalf of its Windows +clients, let's first look at a "purely Windows" setup: Windows clients +with a Windows NT print server. + + + +From Windows Clients to an NT Print Server + + +Windows clients printing to an NT-based print server have two +options. They may + + + +execute the driver locally and render the GDI output +(EMF) into the printer specific format on their own, +or + +send the GDI output (EMF) to the server, where the +driver is executed to render the printer specific +output. + + + +Both print paths are shown in the flowcharts below. + + + + +Driver Execution on the Client + + +In the first case the print server must spool the file as "raw", +meaning it shouldn't touch the jobfile and try to convert it in any +way. This is what traditional Unix-based print server can do too; and +at a better performance and more reliably than NT print server. This +is what most Samba administrators probably are familiar with. One +advantage of this setup is that this "spooling-only" print server may +be used even if no driver(s) for Unix are available it is sufficient +to have the Windows client drivers available and installed on the +clients. + + + +
Print Driver execution on the Client + + + + +
+ + + + +Driver Execution on the Server + + +The other path executes the printer driver on the server. The clients +transfers print files in EMF format to the server. The server uses the +PostScript, PCL, ESC/P or other driver to convert the EMF file into +the printer-specific language. It is not possible for Unix to do the +same. Currently there is no program or method to convert a Windows +client's GDI output on a Unix server into something a printer could +understand. + + + +
Print Driver execution on the Server + + + + +
+ + + +However, there is something similar possible with CUPS. Read on... + + + + + +Network Printing (Windows clients -- UNIX/Samba Print +Servers) + + +Since UNIX print servers cannot execute the Win32 +program code on their platform, the picture is somewhat +different. However, this doesn't limit your options all that +much. In the contrary, you may have a way here to implement printing +features which are not possible otherwise. + + + +From Windows Clients to a CUPS/Samba Print Server + + +Here is a simple recipe showing how you can take advantage of CUPS +powerful features for the benefit of your Windows network printing +clients: + + + + +Let the Windows clients send PostScript to the CUPS +server. + +Let the CUPS server render the PostScript into device +specific raster format. + + + +This requires the clients to use a PostScript driver (even if the +printer is a non-PostScript model. It also requires that you have a +"driver" on the CUPS server. + + + +Firstly, to enable CUPS based printing through Samba the +following options should be set in your smb.conf file [globals] +section: + + + +printing = CUPS + +printcap = CUPS + + + +When these parameters are specified, all manually set print directives +(like print command =..., or lppause +command =...) in smb.conf (as well as +in samba itself) will be ignored. Instead, Samba will directly +interface with CUPS through it's application program interface (API) - +as long as Samba has been compiled with CUPS library (libcups) +support. If Samba has NOT been compiled with CUPS support, and if no +other print commands are set up, then printing will use the +System V AT&T command set, with the -oraw +option automatically passing through (if you want your own defined +print commands to work with a Samba that has CUPS support compiled in, +simply use printing = sysv). + + + +
Printing via CUPS/samba server + + + + +
+ + + + +Samba receiving Jobfiles and passing them to CUPS + + +Samba must use its own spool directory (it is set +by a line similar to path = /var/spool/samba, +in the [printers] or +[printername] section of +smb.conf). Samba receives the job in its own +spool space and passes it into the spool directory of CUPS (the CUPS +spooling directory is set by the RequestRoot +directive, in a line that defaults to RequestRoot +/var/spool/cups). CUPS checks the access rights of its +spool dir and resets it to healthy values with every re-start. We have +seen quite some people who had used a common spooling space for Samba +and CUPS, and were struggling for weeks with this "problem". + + + +A Windows user authenticates only to Samba (by whatever means is +configured). If Samba runs on the same host as CUPS, you only need to +allow "localhost" to print. If they run on different machines, you +need to make sure the Samba host gets access to printing on CUPS. + + + + + +Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs + + +PPDs can control all print device options. They are usually provided +by the manufacturer; if you own a PostScript printer, that is. PPD +files (PostScript Printer Descriptions) are always a component of +PostScript printer drivers on MS Windows or Apple Mac OS systems. They +are ASCII files containing user-selectable print options, mapped to +appropriate PostScript, PCL or PJL commands for the target +printer. Printer driver GUI dialogs translate these options +"on-the-fly" into buttons and drop-down lists for the user to select. + + + +CUPS can load, without any conversions, the PPD file from any Windows +(NT is recommended) PostScript driver and handle the options. There is +a web browser interface to the print options (select http://localhost:631/printers/ +and click on one Configure Printer button to see +it), or a commandline interface (see man lpoptions +or see if you have lphelp on your system). There are also some +different GUI frontends on Linux/UNIX, which can present PPD options +to users. PPD options are normally meant to be evaluated by the +PostScript RIP on the real PostScript printer. + + + +PPDs for non-PS Printers on UNIX + + +CUPS doesn't limit itself to "real" PostScript printers in its usage +of PPDs. The CUPS developers have extended the scope of the PPD +concept, to also describe available device and driver options for +non-PostScript printers through CUPS-PPDs. + + + +This is logical, as CUPS includes a fully featured PostScript +interpreter (RIP). This RIP is based on Ghostscript. It can process +all received PostScript (and additionally many other file formats) +from clients. All CUPS-PPDs geared to non-PostScript printers contain +an additional line, starting with the keyword +*cupsFilter . This line tells the CUPS print +system which printer-specific filter to use for the interpretation of +the supplied PostScript. Thus CUPS lets all its printers appear as +PostScript devices to its clients, because it can act as a PostScript +RIP for those printers, processing the received PostScript code into a +proper raster print format. + + + + +PPDs for non-PS Printers on Windows + + +CUPS-PPDs can also be used on Windows-Clients, on top of a +"core" PostScript driver (now recommended is the "CUPS PostScript +Driver for WindowsNT/2K/XP"; you can also use the Adobe one, with +limitations). This feature enables CUPS to do a few tricks no other +spooler can do: + + + + +act as a networked PostScript RIP (Raster Image +Processor), handling printfiles from all client platforms in a uniform +way; + +act as a central accounting and billing server, since +all files are passed through the pstops filter and are therefore +logged in the CUPS page_log file. +NOTE: this can not happen with "raw" print jobs, +which always remain unfiltered per definition; + +enable clients to consolidate on a single PostScript +driver, even for many different target printers. + + + +Using CUPS PPDs on Windows clients enables these to control +all print job settings just as a UNIX client can do too. + + + + + +Windows Terminal Servers (WTS) as CUPS Clients + + +This setup may be of special interest to people experiencing major +problems in WTS environments. WTS need often a multitude of +non-PostScript drivers installed to run their clients' variety of +different printer models. This often imposes the price of much +increased instability. + + + +Printer Drivers running in "Kernel Mode" cause many +Problems + + +The reason is that in Win NT printer drivers run in "Kernel +Mode", this introduces a high risk for the stability of the system +if the driver is not really stable and well-tested. And there are a +lot of bad drivers out there! Especially notorious is the example +of the PCL printer driver that had an additional sound module +running, to notify users via soundcard of their finished jobs. Do I +need to say that this one was also reliably causing "Blue Screens +of Death" on a regular basis? + + + +PostScript drivers generally are very well tested. They are not known +to cause any problems, even though they run in Kernel Mode too. This +might be because there have so far only been 2 different PostScript +drivers the ones from Adobe and the one from Microsoft. Both are +very well tested and are as stable as you ever can imagine on +Windows. The CUPS driver is derived from the Microsoft one. + + + + +Workarounds impose Heavy Limitations + + +In many cases, in an attempt to work around this problem, site +administrators have resorted to restrict the allowed drivers installed +on their WTS to one generic PCL- and one PostScript driver. This +however restricts the clients in the amount of printer options +available for them; often they can't get out more than simplex +prints from one standard paper tray, while their devices could do much +better, if driven by a different driver! ) + + + + +CUPS: a "Magical Stone"? + + +Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very +elegant way to overcome all these shortcomings. There are, depending +on the version of Windows OS you use, up to 3 different PostScript +drivers available: Adobe, Microsoft and CUPS PostScript drivers. None +of them is known to cause major stability problems on WTS (even if +used with many different PPDs). The clients will be able to (again) +chose paper trays, duplex printing and other settings. However, there +is a certain price for this too: a CUPS server acting as a PostScript +RIP for its clients requires more CPU and RAM than when just acting as +a "raw spooling" device. Plus, this setup is not yet widely tested, +although the first feedbacks look very promising. + + + + +PostScript Drivers with no major problems -- even in Kernel +Mode + + +More recent printer drivers on W2K and XP don't run in Kernel mode +(unlike Win NT) any more. However, both operating systems can still +use the NT drivers, running in Kernel mode (you can roughly tell which +is which as the drivers in subdirectory "2" of "W32X86" are "old" +ones). As was said before, the Adobe as well as the Microsoft +PostScript drivers are not known to cause any stability problems. The +CUPS driver is derived from the Microsoft one. There is a simple +reason for this: The MS DDK (Device Development Kit) for Win NT (which +used to be available at no cost to licensees of Visual Studio) +includes the source code of the Microsoft driver, and licensees of +Visual Studio are allowed to use and modify it for their own driver +development efforts. This is what the CUPS people have done. The +license doesn't allow them to publish the whole of the source code. +However, they have released the "diff" under the GPL, and if you are +owner of an "MS DDK for Win NT", you can check the driver yourself. + + + + + + Setting up CUPS for driver Download + + +As we have said before: all previously known methods to prepare client +printer drivers on the Samba server for download and "Point'n'Print" +convenience of Windows workstations are working with CUPS too. These +methods were described in the previous chapter. In reality, this is a +pure Samba business, and only relates to the Samba/Win client +relationship. + + + +<emphasis>cupsaddsmb</emphasis>: the unknown Utility + + +The cupsaddsmb utility (shipped with all current CUPS versions) is an +alternative method to transfer printer drivers into the Samba +[print$] share. Remember, this share is where +clients expect drivers deposited and setup for download and +installation. It makes the sharing of any (or all) installed CUPS +printers very easy. cupsaddsmb can use the Adobe PostScript driver as +well as the newly developed CUPS PostScript Driver for +WinNT/2K/XP. Note, that cupsaddsmb does +not work with arbitrary vendor printer drivers, +but only with the exact driver files that are +named in its man page. + + + +The CUPS printer driver is available from the CUPS download site. Its +package name is cups-samba-[version].tar.gz . It +is preferred over the Adobe drivers since it has a number of +advantages: + + + +it supports a much more accurate page +accounting; + +it supports banner pages, and page labels on all +printers; + +it supports the setting of a number of job IPP +attributes (such as job-priority, page-label and +job-billing) + + + +However, currently only Windows NT, 2000, and XP are supported by the +CUPS drivers. You will need to get the respective part of Adobe driver +too if you need to support Windows 95, 98, and ME clients. + + + + +Prepare your <filename>smb.conf</filename> for +cupsaddsmb + + +Prior to running cupsaddsmb, you need the following settings in +smb.conf: + + + + + [global] + load printers = yes + printing = cups + printcap name = cups + + [printers] + comment = All Printers + path = /var/spool/samba + browseable = no + public = yes + guest ok = yes # setting depends on your requirements + writable = no + printable = yes + printer admin = root + + [print$] + comment = Printer Drivers + path = /etc/samba/drivers + browseable = yes + guest ok = no + read only = yes + write list = root + + + + + +CUPS Package of "PostScript Driver for WinNT/2k/XP" + + +CUPS users may get the exactly same packages fromhttp://www.cups.org/software.html. +It is a separate package from the CUPS base software files, tagged as +CUPS 1.1.x Windows NT/2k/XP Printer Driver for SAMBA +(tar.gz, 192k). The filename to download is +cups-samba-1.1.x.tar.gz. Upon untar-/unzip-ing, +it will reveal these files: + + + + +# tar xvzf cups-samba-1.1.19.tar.gz + + cups-samba.install + cups-samba.license + cups-samba.readme + cups-samba.remove + cups-samba.ss + + + + +These have been packaged with the ESP meta packager software +"EPM". The *.install and +*.remove files are simple shell scripts, which +untars the *.ss (the *.ss is +nothing else but a tar-archive, which can be untar-ed by "tar" +too). Then it puts the content into +/usr/share/cups/drivers/. This content includes 3 +files: + + + + +# tar tv cups-samba.ss + + cupsdrvr.dll + cupsui.dll + cups.hlp + + + + +The cups-samba.install shell scripts is easy to +handle: + + + + +# ./cups-samba.install + + [....] + Installing software... + Updating file permissions... + Running post-install commands... + Installation is complete. + + + + +The script should automatically put the driver files into the +/usr/share/cups/drivers/ directory. + + + +Due to a bug, one recent CUPS release puts the +cups.hlp driver file +into/usr/share/drivers/ instead of +/usr/share/cups/drivers/. To work around this, +copy/move the file (after running the +./cups-samba.install script) manually to the +right place. + + + + + cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/ + + + + +This new CUPS PostScript driver is currently binary-only, but free of +charge. No complete source code is provided (yet). The reason is this: +it has been developed with the help of the Microsoft Driver +Developer Kit (DDK) and compiled with Microsoft Visual +Studio 6. Driver developers are not allowed to distribute the whole of +the source code as Free Software. However, CUPS developers released +the "diff" in source code under the GPL, so anybody with a license of +Visual Studio and a DDK will be able to compile for him/herself. + + + + +Recognize the different Driver Files + + +The CUPS drivers don't support the "older" Windows 95/98/ME, but only +the Windows NT/2000/XP client: + + + + + [Windows NT, 2000, and XP are supported by:] + cups.hlp + cupsdrvr.dll + cupsui.dll + + + + +Adobe drivers are available for the older Windows 95/98/ME as well as +the Windows NT/2000/XP clients. The set of files is different for the +different platforms. + + + + + [Windows 95, 98, and Me are supported by:] + ADFONTS.MFM + ADOBEPS4.DRV + ADOBEPS4.HLP + DEFPRTR2.PPD + ICONLIB.DLL + PSMON.DLL + + [Windows NT, 2000, and XP are supported by:] + ADOBEPS5.DLL + ADOBEPSU.DLL + ADOBEPSU.HLP + + + + +If both, the Adobe driver files and the CUPS driver files for the +support of WinNT/2k/XP are present in , the Adobe ones will be ignored +and the CUPS ones will be used. If you prefer -- for whatever reason +-- to use Adobe-only drivers, move away the 3 CUPS driver files. The +Win95/98/ME clients use the Adobe drivers in any case. + + + + +Acquiring the Adobe Driver Files + + +Acquiring the Adobe driver files seems to be unexpectedly difficult +for many users. They are not available on the Adobe website as single +files and the self-extracting and/or self-installing Windows-exe is +not easy to locate either. Probably you need to use the included +native installer and run the installation process on one client +once. This will install the drivers (and one Generic PostScript +printer) locally on the client. When they are installed, share the +Generic PostScript printer. After this, the client's +[print$] share holds the Adobe files, from +where you can get them with smbclient from the CUPS host. A more +detailed description about this is in the next (the CUPS printing) +chapter. + + + + +ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP" + + +Users of the ESP Print Pro software are able to install their "Samba +Drivers" package for this purpose with no problem. Retrieve the driver +files from the normal download area of the ESP Print Pro software +athttp://www.easysw.com/software.html. +You need to locate the link labelled "SAMBA" amongst the +Download Printer Drivers for ESP Print Pro 4.x +area and download the package. Once installed, you can prepare any +driver by simply highlighting the printer in the Printer Manager GUI +and select Export Driver... from the menu. Of +course you need to have prepared Samba beforehand too to handle the +driver files; i.e. mainly setup the [print$] +share, etc. The ESP Print Pro package includes the CUPS driver files +as well as a (licensed) set of Adobe drivers for the Windows 95/98/ME +client family. + + + + +Caveats to be considered + + +Once you have run the install script (and possibly manually +moved the cups.hlp file to +/usr/share/cups/drivers/), the driver is +ready to be put into Samba's [print$] share (which often maps to +/etc/samba/drivers/ and contains a subdir +tree with WIN40 and +W32X86 branches): You do this by running +"cupsaddsmb" (see also man cupsaddsmb for +CUPS since release 1.1.16). + + + +You may need to put root into the smbpasswd file by running +smbpasswd; this is especially important if you +should run this whole procedure for the first time, and are not +working in an environment where everything is configured for +Single Sign On to a Windows Domain Controller. + + + +Once the driver files are in the [print$] share +and are initialized, they are ready to be downloaded and installed by +the Win NT/2k/XP clients. + + + + + +Win 9x/ME clients won't work with the CUPS PostScript driver. For +these you'd still need to use the ADOBE*.* +drivers as previously. + + + +It is not harmful if you still have the +ADOBE*.* driver files from previous +installations in the /usr/share/cups/drivers/ +directory. The new cupsaddsmb (from 1.1.16) will +automatically prefer "its own" drivers if it finds both. + + + +Should your Win clients have had the old ADOBE*.* +files for the Adobe PostScript driver installed, the download and +installation of the new CUPS PostScript driver for Windows NT/2k/XP +will fail at first. You need to wipe the old driver from the clients +first. It is not enough to "delete" the printer, as the driver files +will still be kept by the clients and re-used if you try to re-install +the printer. To really get rid of the Adobe driver files on the +clients, open the "Printers" folder (possibly via Start +--> Settings --> Control Panel --> Printers), +right-click onto the folder background and select Server +Properties. When the new dialog opens, select the +Drivers tab. On the list select the driver you +want to delete and click on the Delete +button. This will only work if there is not one single printer left +which uses that particular driver. You need to "delete" all printers +using this driver in the "Printers" folder first. You will need +Administrator privileges to do this. + + + +Once you have successfully downloaded the CUPS PostScript driver to a +client, you can easily switch all printers to this one by proceeding +as described elsewhere in the "Samba HOWTO Collection": either change +a driver for an existing printer by running the "Printer Properties" +dialog, or use rpcclient with the +setdriver sub-command. + + + + + + +What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver? + + +You are interested in a comparison between the CUPS and the Adobe +PostScript drivers? For our purposes these are the most important +items which weigh in favor of the CUPS ones: + + + +no hassle with the Adobe EULA + +no hassle with the question Where do I +get the ADOBE*.* driver files from? + +the Adobe drivers (on request of the printer PPD +associated with them) often put a PJL header in front of the main +PostScript part of the print file. Thus the printfile starts with +<1B >%-12345X or +<escape>%-12345X instead +of %!PS). This leads to the +CUPS daemon auto-typing the incoming file as a print-ready file, +not initiating a pass through the "pstops" filter (to speak more +technically, it is not regarded as the generic MIME type +application/postscript, but as +the more special MIME type +application/cups.vnd-postscript), +which therefore also leads to the page accounting in +/var/log/cups/page_log not +receiving the exact number of pages; instead the dummy page number +of "1" is logged in a standard setup) + +the Adobe driver has more options to "mis-configure" the +PostScript generated by it (like setting it inadvertently to +Optimize for Speed, instead of +Optimize for Portability, which +could lead to CUPS being unable to process it) + +the CUPS PostScript driver output sent by Windows +clients to the CUPS server will be guaranteed to be auto-typed always +as generic MIME type application/postscript, +thusly passing through the CUPS "pstops" filter and logging the +correct number of pages in the page_log for +accounting and quota purposes + +the CUPS PostScript driver supports the sending of +additional standard (IPP) print options by Win NT/2k/XP clients. Such +additional print options are: naming the CUPS standard +banner pages (or the custom ones, should they be +installed at the time of driver download), using the CUPS +page-label option, setting a +job-priority and setting the scheduled +time of printing (with the option to support additional +useful IPP job attributes in the future). + +the CUPS PostScript driver supports the inclusion of +the new *cupsJobTicket comments at the +beginning of the PostScript file (which could be used in the future +for all sort of beneficial extensions on the CUPS side, but which will +not disturb any other applications as they will regard it as a comment +and simply ignore it). + +the CUPS PostScript driver will be the heart of the +fully fledged CUPS IPP client for Windows NT/2K/XP to be released soon +(probably alongside the first Beta release for CUPS +1.2). + + + + + +Run "cupsaddsmb" (quiet Mode) + + +The cupsaddsmb command copies the needed files into your +[print$] share. Additionally, the PPD +associated with this printer is copied from +/etc/cups/ppd/ to +[print$]. There the files wait for convenient +Windows client installations via Point'n'Print. Before we can run the +command successfully, we need to be sure that we can authenticate +towards Samba. If you have a small network you are probably using user +level security (security = user). Probably your +root has already a Samba account. Otherwise, create it now, using +smbpasswd: + + + + + # smbpasswd -a root + New SMB password: [type in password 'secret'] + Retype new SMB password: [type in password 'secret'] + + + + +Here is an example of a successfully run cupsaddsmb command. + + + + + # cupsaddsmb -U root infotec_IS2027 + Password for root required to access localhost via SAMBA: [type in password 'secret'] + + + + +To share all printers and drivers, use the +-a parameter instead of a printer name. Since +cupsaddsmb "exports" the printer drivers to Samba, it should be +obvious that it only works for queues with a CUPS driver associated. + + + + +Run "cupsaddsmb" with verbose Output + + +Probably you want to see what's going on. Use the +-v parameter to get a more verbose output. The +output below was edited for better readability: all "\" at the end of +a line indicate that I inserted an artificial line break plus some +indentation here: + + + +You will see the root password for the Samba account printed on +screen. If you use remote access, the password will go over the wire +unencrypted! + + + + + # cupsaddsmb -U root -v infotec_2105 + Password for root required to access localhost via SAMBA: + Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir W32X86;put \ + /var/spool/cups/tmp/3e98bf2d333b5 W32X86/infotec_2105.ppd;put \ + /usr/share/cups/drivers/cupsdrvr.dll W32X86/cupsdrvr.dll;put \ + /usr/share/cups/drivers/cupsui.dll W32X86/cupsui.dll;put \ + /usr/share/cups/drivers/cups.hlp W32X86/cups.hlp' + added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 + Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a] + NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86 + putting file /var/spool/cups/tmp/3e98bf2d333b5 as \W32X86/infotec_2105.ppd (2328.8 kb/s) \ + (average 2328.8 kb/s) + putting file /usr/share/cups/drivers/cupsdrvr.dll as \W32X86/cupsdrvr.dll (9374.3 kb/s) \ + (average 5206.6 kb/s) + putting file /usr/share/cups/drivers/cupsui.dll as \W32X86/cupsui.dll (8107.2 kb/s) \ + (average 5984.1 kb/s) + putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp (3475.0 kb/s) \ + (average 5884.7 kb/s) + + Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows NT x86" \ + "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \ + RAW:NULL"' + cmd = adddriver "Windows NT x86" "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll: \ + cups.hlp:NULL:RAW:NULL" + Printer Driver infotec_2105 successfully installed. + + Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir WIN40;put \ + /var/spool/cups/tmp/3e98bf2d333b5 WIN40/infotec_2105.PPD; put \ + /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;put \ + /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV;put \ + /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP;put \ + /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD;put \ + /usr/share/cups/drivers/ICONLIB.DLL + WIN40/ICONLIB.DLL;put /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;' + added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 + Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a] + NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40 + putting file /var/spool/cups/tmp/3e98bf2d333b5 as \WIN40/infotec_2105.PPD (2328.8 kb/s) \ + (average 2328.8 kb/s) + putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM (9368.0 kb/s) \ + (average 6469.6 kb/s) + putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV (9958.2 kb/s) \ + (average 8404.3 kb/s) + putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP (8341.5 kb/s) \ + (average 8398.6 kb/s) + putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD (2195.9 kb/s) \ + (average 8254.3 kb/s) + putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL (8239.9 kb/s) \ + (average 8253.6 kb/s) + putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL (6222.2 kb/s) \ + (average 8188.5 kb/s) + + Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows 4.0" \ + "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP: \ + PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL, \ + ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"' + cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL: \ + ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP, \ + PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL" + Printer Driver infotec_2105 successfully installed. + + Running command: rpcclient localhost -N -U'root%secret' \ + -c 'setdriver infotec_2105 infotec_2105' + cmd = setdriver infotec_2105 infotec_2105 + Successfully set infotec_2105 to driver infotec_2105. + + + + +If you look closely, you'll discover your root password was transfered +unencrypted over the wire, so beware! Also, if you look further her, +you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in +between. They occur, because the directories WIN40 and W32X86 already +existed in the [print$] driver download share +(from a previous driver installation). They are harmless here. + + + + +Understanding cupsaddsmb + + +What has happened? What did cupsaddsmb do? There are five stages of +the procedure + + + + +call the CUPS server via IPP and request the +driver files and the PPD file for the named printer; + +store the files temporarily in the local +TEMPDIR (as defined in +cupsd.conf); + +connect via smbclient to the Samba server's + [print$] share and put the files into the + share's WIN40 (for Win95/98/ME) and W32X86/ (for WinNT/2k/XP) sub + directories; + +connect via rpcclient to the Samba server and +execute the "adddriver" command with the correct +parameters; + +connect via rpcclient to the Samba server a second +time and execute the "setdriver" command. + + + +Note, that you can run the cupsaddsmb utility with parameters to +specify one remote host as Samba host and a second remote host as CUPS +host. Especially if you want to get a deeper understanding, it is a +good idea try it and see more clearly what is going on (though in real +life most people will have their CUPS and Samba servers run on the +same host): + + + + + # cupsaddsmb -H sambaserver -h cupsserver -v printername + + + + + +How to recognize if cupsaddsm completed successfully + + +You must always check if the utility completed +successfully in all fields. You need as a minimum these 3 messages +amongst the output: + + + + +Printer Driver infotec_2105 successfully +installed. # (for the W32X86 == WinNT/2K/XP +architecture...) + +Printer Driver infotec_2105 successfully +installed. # (for the WIN40 == Win9x/ME +architecture...) + +Successfully set [printerXPZ] to driver +[printerXYZ]. + + + +These messages probably not easily recognized in the general +output. If you run cupsaddsmb with the -a +parameter (which tries to prepare all active CUPS +printer drivers for download), you might miss if individual printers +drivers had problems to install properly. Here a redirection of the +output will help you analyze the results in retrospective. + + + +It is impossible to see any diagnostic output if you don't run +cupsaddsmb in verbose mode. Therefore we strongly recommend to not +use the default quiet mode. It will hide any problems from you which +might occur. + + + + +cupsaddsmb with a Samba PDC + + +You can't get the standard cupsaddsmb command to run on a Samba PDC? +You are asked for the password credential all over again and again and +the command just will not take off at all? Try one of these +variations: + + + + + # cupsaddsmb -U DOMAINNAME\\root -v printername + # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -v printername + # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -h cups-server -v printername + + + + +(Note the two backslashes: the first one is required to +"escape" the second one). + + + + +cupsaddsmb Flowchart + + +Here is a chart about the procedures, commandflows and +dataflows of the "cupaddsmb" command. Note again: cupsaddsmb is +not intended to, and does not work with, "raw" queues! + + + +
cupsaddsmb flowchart + + + + +
+ + + + +Installing the PostScript Driver on a Client + + +After cupsaddsmb completed, your driver is prepared for the clients to +use. Here are the steps you must perform to download and install it +via "Point'n'Print". From a Windows client, browse to the CUPS/Samba +server; + + + + +open the Printers +share of Samba in Network Neighbourhood; + +right-click on the printer in +question; + +from the opening context-menu select +Install... or +Connect... (depending on the Windows version you +use). + + + +After a few seconds, there should be a new printer in your +client's local "Printers" folder: On Windows +XP it will follow a naming convention of PrinterName on +SambaServer. (In my current case it is "infotec_2105 on +kde-bitshop"). If you want to test it and send your first job from +an application like Winword, the new printer will appears in a +\\SambaServer\PrinterName entry in the +dropdown list of available printers. + + + +cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher +and Samba from 2.2.4. If it doesn't work, or if the automatic printer +driver download to the clients doesn't succeed, you can still manually +install the CUPS printer PPD on top of the Adobe PostScript driver on +clients. Then point the client's printer queue to the Samba printer +share for a UNC type of connection: + + + + + net use lpt1: \\sambaserver\printershare /user:ntadmin + + + + +should you desire to use the CUPS networked PostScript RIP +functions. (Note that user "ntadmin" needs to be a valid Samba user +with the required privileges to access the printershare) This would +set up the printer connection in the traditional +LanMan way (not using MS-RPC). + + + + +Avoiding critical PostScript Driver Settings on the +Client + + +Soooo: printing works, but there are still problems. Most jobs print +well, some don't print at all. Some jobs have problems with fonts, +which don't look very good. Some jobs print fast, and some are +dead-slow. Many of these problems can be greatly reduced or even +completely eliminated if you follow a few guidelines. Remember, if +your print device is not PostScript-enabled, you are treating your +Ghostscript installation on your CUPS host with the output your client +driver settings produce. Treat it well: + + + +Avoid the PostScript Output Option: Optimize +for Speed setting. Rather use the Optimize for +Portability instead (Adobe PostScript +driver). + +Don't use the Page Independence: +NO setting. Instead use Page Independence +YES (CUPS PostScript Driver) + +Recommended is the True Type Font +Downloading Option: Native True Type over +Automatic and Outline; you +should by all means avoid Bitmap (Adobe +PostScript Driver) + +Choose True Type Font: Download as Softfont +into Printer over the default Replace by Device +Font (for exotic fonts you may need to change it back to +get a printout at all) (Adobe) + +Sometimes you can choose PostScript Language +Level: in case of problems try 2 +instead of 3 (the latest ESP Ghostscript package +handles Level 3 PostScript very well) (Adobe). + +Say Yes to PostScript +Error Handler (Adobe) + + + + + +Installing PostScript Driver Files manually (using +rpcclient) + + +Of course you can run all the commands which are embedded into the +cupsaddsmb convenience utility yourself, one by one, and hereby upload +and prepare the driver files for future client downloads. + + + +prepare Samba (a CUPS printqueue with the name of the +printer should be there. We are providing the driver +now); + +copy all files to +[print$]: + +run rpcclient adddriver +(for each client architecture you want to support): + +run rpcclient +setdriver. + + + +We are going to do this now. First, read the man page on "rpcclient" +to get a first idea. Look at all the printing related +sub-commands. enumprinters, +enumdrivers, enumports, +adddriver, setdriver are amongst +the most interesting ones. rpcclient implements an important part of +the MS-RPC protocol. You can use it to query (and command) a Win NT +(or 2K/XP) PC too. MS-RPC is used by Windows clients, amongst other +things, to benefit from the "Point'n'Print" features. Samba can now +mimic this too. + + + +A Check of the rpcclient man Page + + +First let's have a little check of the rpcclient man page. Here are +two relevant passages: + + + +adddriver <arch> <config> Execute an +AddPrinterDriver() RPC to install the printer driver information on +the server. Note that the driver files should already exist in the +directory returned by getdriverdir. Possible +values for arch are the same as those for the +getdriverdir command. The +config parameter is defined as follows: + + + +Long Printer Name:\ +Driver File Name:\ +Data File Name:\ +Config File Name:\ +Help File Name:\ +Language Monitor Name:\ +Default Data Type:\ +Comma Separated list of Files + + +Any empty fields should be enter as the string "NULL". + +Samba does not need to support the concept of Print Monitors +since these only apply to local printers whose driver can make use of +a bi-directional link for communication. This field should be "NULL". +On a remote NT print server, the Print Monitor for a driver must +already be installed prior to adding the driver or else the RPC will +fail + + + +setdriver <printername> <drivername> +Execute a SetPrinter() command to update the +printer driver associated with an installed printer. The printer +driver must already be correctly installed on the print server. + + + See also the enumprinters and enumdrivers commands for +obtaining a list of installed printers and drivers. + + + + + +Understanding the rpcclient man Page + + +The exact format isn't made too clear by the man +page, since you have to deal with some parameters containing +spaces. Here is a better description for it. We have line-broken the +command and indicated the breaks with "\". Usually you would type the +command in one line without the linebreaks: + + + + + adddriver "Architecture" \ + "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\ + LanguageMonitorFile:DataType:ListOfFiles,Comma-separated" + + + + +What the man pages denotes as a simple <config> +keyword, does in reality consist of 8 colon-separated fields. The +last field may take multiple (in some, very insane, cases, even +20 different additional files. This might sound confusing at first. +Note, that what the man pages names the "LongPrinterName" in +reality should rather be called the "Driver Name". You can name it +anything you want, as long as you use this name later in the +rpcclient ... setdriver command. For +practical reasons, many name the driver the same as the +printer. + + + +True: it isn't simple at all. I hear you asking: +How do I know which files are "Driver +File", "Data File", "Config File", "Help File" and "Language +Monitor File" in each case? -- For an answer you may +want to have a look at how a Windows NT box with a shared printer +presents the files to us. Remember, that this whole procedure has +to be developed by the Samba Team by overhearing the traffic caused +by Windows computers on the wire. We may as well turn to a Windows +box now, and access it from a UNIX workstation. We will query it +with rpcclient to see what it tells us and +try to understand the man page more clearly which we've read just +now. + + + + +Producing an Example by querying a Windows Box + + +We could run rpcclient with a +getdriver or a getprinter +subcommand (in level 3 verbosity) against it. Just sit down at UNIX or +Linux workstation with the Samba utilities installed. Then type the +following command: + + + + + rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3' + + + + +From the result it should become clear which is which. Here is an +example from my installation: + + + + +# rpcclient -U'Danka%xxxx' W2KSERVER -c'getdriver "DANKA InfoStream Virtual Printer" 3' + cmd = getdriver "DANKA InfoStream Virtual Printer" 3 + + [Windows NT x86] + Printer Driver Info 3: + Version: [2] + Driver Name: [DANKA InfoStream] + Architecture: [Windows NT x86] + Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRIPT.DLL] + Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\INFOSTRM.PPD] + Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRPTUI.DLL] + Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRIPT.HLP] + + Dependentfiles: [] + Dependentfiles: [] + Dependentfiles: [] + Dependentfiles: [] + Dependentfiles: [] + Dependentfiles: [] + Dependentfiles: [] + + Monitorname: [] + Defaultdatatype: [] + + + + +Some printer drivers list additional files under the label +"Dependentfiles": these would go into the last field +ListOfFiles,Comma-separated. For the CUPS +PostScript drivers we don't need any (nor would we for the Adobe +PostScript driver): therefore the field will get a "NULL" entry. + + + + +What is required for adddriver and setdriver to succeed + + +From the manpage (and from the quoted output +of cupsaddsmb, above) it becomes clear that you +need to have certain conditions in order to make the manual uploading +and initializing of the driver files succeed. The two rpcclient +subcommands (adddriver and +setdriver) need to encounter the following +pre-conditions to complete successfully: + + + +you are connected as "printer admin", or root (note, +that this is not the "Printer Operators" group in +NT, but the printer admin group, as defined in +the [global] section of +smb.conf); + +copy all required driver files to +\\sambaserver\print$\w32x86 and +\\sambaserver\print$\win40 as appropriate. They +will end up in the "0" respective "2" subdirectories later -- for now +don't put them there, they'll be automatically +used by the adddriver subcommand.! (if you use +"smbclient" to put the driver files into the share, note that you need +to escape the "$": smbclient //sambaserver/print\$ -U +root); + +the user you're connecting as must be able to write to +the [print$] share and create +subdirectories; + +the printer you are going to setup for the Windows +clients, needs to be installed in CUPS already; + +the CUPS printer must be known to Samba, otherwise the +setdriver subcommand fails with an +NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by +Samba you may use the enumprinters subcommand to +rpcclient. A long-standing bug prevented a proper update of the +printer list until every smbd process had received a SIGHUP or was +restarted. Remember this in case you've created the CUPS printer just +shortly ago and encounter problems: try restarting +Samba. + + + + +Manual Commandline Driver Installation in 15 little Steps + + +We are going to install a printer driver now by manually executing all +required commands. As this may seem a rather complicated process at +first, we go through the procedure step by step, explaining every +single action item as it comes up. + + + +First Step: Install the Printer on CUPS + + + +# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P /home/kurt/canonIR85.ppd + + + + +This installs printer with the name mysmbtstprn +to the CUPS system. The printer is accessed via a socket +(a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root +for this step + + + + +Second Step (optional): Check if the Printer is recognized by +Samba + + + + # rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn + + flags:[0x800000] + name:[\\kde-bitshop\mysmbtstprn] + description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn] + comment:[mysmbtstprn] + + + + +This should show the printer in the list. If not, stop and re-start +the Samba daemon (smbd), or send a HUP signal: kill -HUP +`pidof smbd`. Check again. Troubleshoot and repeat until +success. Note the "empty" field between the two commas in the +"description" line. Here would the driver name appear if there was one +already. You need to know root's Samba password (as set by the +smbpasswd command) for this step and most of the +following steps. Alternatively you can authenticate as one of the +users from the "write list" as defined in smb.conf for +[print$]. + + + + +Third Step (optional): Check if Samba knows a Driver for the +Printer + + + +# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver + drivername:[] + +# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv + servername:[\\kde-bitshop] + printername:[\\kde-bitshop\mysmbtstprn] + sharename:[mysmbtstprn] + portname:[Samba Printer Port] + drivername:[] + comment:[mysmbtstprn] + location:[] + sepfile:[] + printprocessor:[winprint] + +# rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost + result was WERR_UNKNOWN_PRINTER_DRIVER + + + + +Neither method of the three commands shown above should show a driver. +This step was done for the purpose of demonstrating this condition. An +attempt to connect to the printer at this stage will prompt the +message along the lines: "The server has not the required printer +driver installed". + + + + +Fourth Step: Put all required Driver Files into Samba's +[print$] + + + +# smbclient //localhost/print\$ -U 'root%xxxx' \ + -c 'cd W32X86; \ + put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD; \ + put /usr/share/cups/drivers/cupsui.dll cupsui.dll; \ + put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \ + put /usr/share/cups/drivers/cups.hlp cups.hlp' + + + + +(Note that this command should be entered in one long single +line. Line-breaks and the line-end indicating "\" has been inserted +for readability reasons.) This step is required +for the next one to succeed. It makes the driver files physically +present in the [print$] share. However, clients +would still not be able to install them, because Samba does not yet +treat them as driver files. A client asking for the driver would still +be presented with a "not installed here" message. + + + + +Fifth Step: Verify where the Driver Files are now + + + +# ls -l /etc/samba/drivers/W32X86/ + total 669 + drwxr-sr-x 2 root ntadmin 532 May 25 23:08 2 + drwxr-sr-x 2 root ntadmin 670 May 16 03:15 3 + -rwxr--r-- 1 root ntadmin 14234 May 25 23:21 cups.hlp + -rwxr--r-- 1 root ntadmin 278380 May 25 23:21 cupsdrvr.dll + -rwxr--r-- 1 root ntadmin 215848 May 25 23:21 cupsui.dll + -rwxr--r-- 1 root ntadmin 169458 May 25 23:21 mysmbtstprn.PPD + + + + +The driver files now are in the W32X86 architecture "root" of +[print$]. + + + + +Sixth Step: Tell Samba that these are +<emphasis>Driver</emphasis> Files +(<command>adddriver</command>) + + + +# rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \ + cupsdrvr.dll:mysmbtstprn.PPD: \ + cupsui.dll:cups.hlp:NULL:RAW:NULL" \ + localhost + + Printer Driver mydrivername successfully installed. + + + + +Note that your cannot repeat this step if it fails. It could fail even +as a result of a simple typo. It will most likely have moved a part of +the driver files into the "2" subdirectory. If this step fails, you +need to go back to the fourth step and repeat it, before you can try +this one again. In this step you need to choose a name for your +driver. It is normally a good idea to use the same name as is used for +the printername; however, in big installations you may use this driver +for a number of printers which have obviously different names. So the +name of the driver is not fixed. + + + + +Seventh Step: Verify where the Driver Files are now + + + +# ls -l /etc/samba/drivers/W32X86/ + total 1 + drwxr-sr-x 2 root ntadmin 532 May 25 23:22 2 + drwxr-sr-x 2 root ntadmin 670 May 16 03:15 3 + + +# ls -l /etc/samba/drivers/W32X86/2 + total 5039 + [....] + -rwxr--r-- 1 root ntadmin 14234 May 25 23:21 cups.hlp + -rwxr--r-- 1 root ntadmin 278380 May 13 13:53 cupsdrvr.dll + -rwxr--r-- 1 root ntadmin 215848 May 13 13:53 cupsui.dll + -rwxr--r-- 1 root ntadmin 169458 May 25 23:21 mysmbtstprn.PPD + + + + +Notice how step 6 did also move the driver files to the appropriate +subdirectory. Compare with the situation after step 5. + + + + +Eighth Step (optional): Verify if Samba now recognizes the +Driver + + + +# rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost | grep -B2 -A5 mydrivername + + Printer Driver Info 3: + Version: [2] + Driver Name: [mydrivername] + Architecture: [Windows NT x86] + Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll] + Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD] + Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll] + Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp] + + + + +Remember, this command greps for the name you did choose for the +driver in step Six. This command must succeed before you can proceed. + + + + +Ninth Step: Tell Samba which Printer should use these Driver +Files (<command>setdriver</command>) + + + +# rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost + + Successfully set mysmbtstprn to driver mydrivername + + + + +Since you can bind any printername (=printqueue) to any driver, this +is a very convenient way to setup many queues which use the same +driver. You don't need to repeat all the previous steps for the +setdriver command to succeed. The only pre-conditions are: +enumdrivers must find the driver and +enumprinters must find the printer. + + + + +Tenth Step (optional): Verify if Samba has this Association +recognized + + + +# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver + drivername:[mydrivername] + +# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv + servername:[\\kde-bitshop] + printername:[\\kde-bitshop\mysmbtstprn] + sharename:[mysmbtstprn] + portname:[Done] + drivername:[mydrivername] + comment:[mysmbtstprn] + location:[] + sepfile:[] + printprocessor:[winprint] + +# rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost + [Windows NT x86] + Printer Driver Info 3: + Version: [2] + Driver Name: [mydrivername] + Architecture: [Windows NT x86] + Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll] + Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD] + Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll] + Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp] + Monitorname: [] + Defaultdatatype: [RAW] + Monitorname: [] + Defaultdatatype: [RAW] + +# rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn + name:[\\kde-bitshop\mysmbtstprn] + description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn] + comment:[mysmbtstprn] + + + + +Compare these results with the ones from steps 2 and 3. Note that +every single of these commands show the driver is installed. Even +the enumprinters command now lists the driver +on the "description" line. + + + + +Eleventh Step (optional): Tickle the Driver into a correct +Device Mode + + +You certainly know how to install the driver on the client. In case +you are not particularly familiar with Windows, here is a short +recipe: browse the Network Neighbourhood, go to the Samba server, look +for the shares. You should see all shared Samba printers. +Double-click on the one in question. The driver should get +installed, and the network connection set up. An alternative way is to +open the "Printers (and Faxes)" folder, right-click on the printer in +question and select "Connect" or "Install". As a result, a new printer +should have appeared in your client's local "Printers (and Faxes)" +folder, named something like "printersharename on Sambahostname". + + + +It is important that you execute this step as a Samba printer admin +(as defined in smb.conf). Here is another method +to do this on Windows XP. It uses a commandline, which you may type +into the "DOS box" (type root's smbpassword when prompted): + + + + + C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n \\sambacupsserver\mysmbtstprn" + + + + +Change any printer setting once (like "portrait" +--> "landscape"), click "Apply"; change the setting +back. + + + + +Twelfth Step: Install the Printer on a Client +("Point'n'Print") + + + + C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn" + + + + +If it doesn't work it could be a permission problem with the +[print$] share. + + + + +Thirteenth Step (optional): Print a Test Page + + + + C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn" + + + + +Then hit [TAB] 5 times, [ENTER] twice, [TAB] once and [ENTER] again +and march to the printer. + + + + +Fourteenth Step (recommended): Study the Test Page + + +Hmmm.... just kidding! By now you know everything about printer +installations and you don't need to read a word. Just put it in a +frame and bolt it to the wall with the heading "MY FIRST +RPCCLIENT-INSTALLED PRINTER" - why not just throw it away! + + + + +Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your +Success + + + +# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd + + + + + + +Troubleshooting revisited + + +The setdriver command will fail, if in Samba's mind the queue is not +already there. You had promising messages about the: + + + + + Printer Driver ABC successfully installed. + + + + +after the "adddriver" parts of the procedure? But you are also seeing +a disappointing message like this one beneath? + + + + + result was NT_STATUS_UNSUCCESSFUL + + + + +It is not good enough that you +can see the queue in CUPS, using +the lpstat -p ir85wm command. A +bug in most recent versions of Samba prevents the proper update of +the queuelist. The recognition of newly installed CUPS printers +fails unless you re-start Samba or send a HUP to all smbd +processes. To verify if this is the reason why Samba doesn't +execute the setdriver command successfully, check if Samba "sees" +the printer: + + + + +# rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep ir85wm + printername:[ir85wm] + + + + +An alternative command could be this: + + + + +# rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' + cmd = getprinter ir85wm + flags:[0x800000] + name:[\\transmeta\ir85wm] + description:[\\transmeta\ir85wm,ir85wm,DPD] + comment:[CUPS PostScript-Treiber for WinNT/2K/XP] + + + + +BTW, you can use these commands, plus a few more, of course, +to install drivers on remote Windows NT print servers too! + + + + + +The printing <filename>*.tdb</filename> Files + + +Some mystery is associated with the series of files with a +tdb-suffix appearing in every Samba installation. They are +connections.tdb, +printing.tdb, +share_info.tdb , +ntdrivers.tdb, +unexpected.tdb, +brlock.tdb , +locking.tdb, +ntforms.tdb, +messages.tdb , +ntprinters.tdb, +sessionid.tdb and +secrets.tdb. What is their purpose? + + + +Trivial DataBase Files + + +A Windows NT (Print) Server keeps track of all information needed to serve +its duty toward its clients by storing entries in the Windows +"Registry". Client queries are answered by reading from the registry, +Administrator or user configuration settings are saved by writing into +the Registry. Samba and Unix obviously don't have such a kind of +Registry. Samba instead keeps track of all client related information in a +series of *.tdb files. (TDB = Trivial Data +Base). These are often located in /var/lib/samba/ +or /var/lock/samba/ . The printing related files +are ntprinters.tdb, +printing.tdb,ntforms.tdb and +ntdrivers.tdb. + + + + +Binary Format + + +*.tdb files are not human readable. They are +written in a binary format. "Why not ASCII?", you may ask. "After all, +ASCII configuration files are a good and proofed tradition on UNIX." +-- The reason for this design decision by the Samba Team is mainly +performance. Samba needs to be fast; it runs a separate +smbd process for each client connection, in some +environments many thousand of them. Some of these smbds might need to +write-access the same *.tdb file at the +same time. The file format of Samba's +*.tdb files allows for this provision. Many smbd +processes may write to the same *.tdb file at the +same time. This wouldn't be possible with pure ASCII files. + + + + +Losing <filename>*.tdb</filename> Files + + +It is very important that all *.tdb files remain +consistent over all write and read accesses. However, it may happen +that these files do get corrupted. (A +kill -9 `pidof smbd` while a write access is in +progress could do the damage as well as a power interruption, +etc.). In cases of trouble, a deletion of the old printing-related +*.tdb files may be the only option. You need to +re-create all print related setup after that. Or you have made a +backup of the *.tdb files in time. + + + + +Using <emphasis>tdbbackup</emphasis> + + +Samba ships with a little utility which helps the root user of your +system to back up your *.tdb files. If you run it +with no argument, it prints a little usage message: + + + + +# tdbbackup + Usage: tdbbackup [options] <fname...> + + Version:3.0a + -h this help message + -s suffix set the backup suffix + -v verify mode (restore if corrupt) + + + + +Here is how I backed up my printing.tdb file: + + + + +# ls + . browse.dat locking.tdb ntdrivers.tdb printing.tdb share_info.tdb + .. connections.tdb messages.tdb ntforms.tdb printing.tdbkp unexpected.tdb + brlock.tdb gmon.out namelist.debug ntprinters.tdb sessionid.tdb + + kde-bitshop:/var/lock/samba # tdbbackup -s .bak printing.tdb + printing.tdb : 135 records + + kde-bitshop:/var/lock/samba # ls -l printing.tdb* + -rw------- 1 root root 40960 May 2 03:44 printing.tdb + -rw------- 1 root root 40960 May 2 03:44 printing.tdb.bak + + + + + + +CUPS Print Drivers from Linuxprinting.org + + +CUPS ships with good support for HP LaserJet type printers. You can +install the generic driver as follows: + + + + +lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd + + + + +The -m switch will retrieve the +laserjet.ppd from the standard repository for +not-yet-installed-PPDs, which CUPS typically stores in +/usr/share/cups/model. Alternatively, you may use +-P /path/to/your.ppd. + + + +The generic laserjet.ppd however does not support every special option +for every LaserJet-compatible model. It constitutes a sort of "least +denominator" of all the models. If for some reason it is ruled out to +you to pay for the commercially available ESP Print Pro drivers, your +first move should be to consult the database on http://www.linuxprinting.org/printer_list.cgi. +Linuxprinting.org has excellent recommendations about which driver is +best used for each printer. Its database is kept current by the +tireless work of Till Kamppeter from MandrakeSoft, who is also the +principal author of the foomatic-rip utility. + + + +The former "cupsomatic" concept is now be replaced by the new, much +more powerful "foomatic-rip". foomatic-rip is the successor of +cupsomatic. cupsomatic is no longer maintained. Here is the new URL +to the Foomatic-3.0 database:http://www.linuxprinting.org/driver_list.cgi. +If you upgrade to foomatic-rip, don't forget to also upgrade to the +new-style PPDs for your foomatic-driven printers. foomatic-rip will +not work with PPDs generated for the old cupsomatic. The new-style +PPDs are 100% compliant to the Adobe PPD specification. They are +intended to be used by Samba and the cupsaddsmb utility also, to +provide the driver files for the Windows clients also! + + + +foomatic-rip and Foomatic explained + + +Nowadays most Linux distros rely on the utilities of Linuxprinting.org +to create their printing related software (which, BTW, works on all +UNIXes and on Mac OS X or Darwin too). It is not known as well as it +should be, that it also has a very end-user friendly interface which +allows for an easy update of drivers and PPDs, for all supported +models, all spoolers, all operating systems and all package formats +(because there is none). Its history goes back a few years. + + + +Recently Foomatic has achieved the astonishing milestone of 1000 +listed printer models. Linuxprinting.org keeps all the +important facts about printer drivers, supported models and which +options are available for the various driver/printer combinations in +its Foomatic +database. Currently there are 245 drivers +in the database: many drivers support various models, and many models +may be driven by different drivers; it's your choice! + + + +690 "perfect" Printers + + +At present there are 690 devices dubbed as working "perfectly", 181 +"mostly", 96 "partially" and 46 are "Paperweights". Keeping in mind +that most of these are non-PostScript models (PostScript printers are +automatically supported supported by CUPS to perfection, by using +their own manufacturer-provided Windows-PPD...), and that a +multifunctional device never qualifies as working "perfectly" if it +doesn't also scan and copy and fax under GNU/Linux: then this is a +truly astonishing achievement. Three years ago the number was not +more than 500, and Linux or UNIX "printing" at the time wasn't +anywhere near the quality it is today! + + + + +How the "Printing HOWTO" started it all + + +A few years ago Grant Taylor +started it all. The roots of today's Linuxprinting.org are in the +first Linux Printing +HOWTO which he authored. As a side-project to this document, +which served many Linux users and admins to guide their first steps in +this complicated and delicate setup (to a scientist, printing is +"applying a structured deposition of distinct patterns of ink or toner +particles on paper substrates" ;-), he started to +build in a little Postgres database with information about the +hardware and driver zoo that made up Linux printing of the time. This +database became the core component of today's Foomatic collection of +tools and data. In the meantime it has moved to an XML representation +of the data. + + + + +Foomatic's strange Name + + +"Why the funny name?", you ask. When it really took off, around spring +2000, CUPS was far less popular than today, and most systems used LPD, +LPRng or even PDQ to print. CUPS shipped with a few generic "drivers" +(good for a few hundred different printer models). These didn't +support many device-specific options. CUPS also shipped with its own +built-in rasterization filter ("pstoraster", derived from +Ghostscript). On the other hand, CUPS provided brilliant support for +controlling all printer options through +standardized and well-defined "PPD files" (PostScript Printers +Description files). Plus, CUPS was designed to be easily extensible. + + + +Grant already had in his database a respectable compilation +of facts about a many more printers, and the Ghostscript "drivers" +they run with. His idea, to generate PPDs from the database info +and use them to make standard Ghostscript filters work within CUPS, +proved to work very well. It also "killed several birds with one +stone": + + + +It made all current and future Ghostscript filter +developments available for CUPS; + +It made available a lot of additional printer models +to CUPS users (because often the "traditional" Ghostscript way of +printing was the only one available); + +It gave all the advanced CUPS options (web interface, +GUI driver configurations) to users wanting (or needing) to use +Ghostscript filters. + + + + +cupsomatic, pdqomatic, lpdomatic, directomatic + + +CUPS worked through a quickly-hacked up filter script named cupsomatic. +cupsomatic ran the printfile through Ghostscript, constructing +automatically the rather complicated command line needed. It just +required to be copied into the CUPS system to make it work. To +"configure" the way cupsomatic controls the Ghostscript rendering +process, it needs a CUPS-PPD. This PPD is generated directly from the +contents of the database. For CUPS and the respective printer/filter +combo another Perl script named "CUPS-O-Matic" did the PPD +generation. After that was working, Grant implemented within a few +days a similar thing for two other spoolers. Names chosen for the +config-generator scripts were PDQ-O-Matic +(for PDQ) and LPD-O-Matic +(for - you guessed it - LPD); the configuration here didn't use PPDs +but other spooler-specific files. + + + +From late summer of that year, Till Kamppeter +started to put work into the database. Till had been newly employed by +MandrakeSoft to +convert their printing system over to CUPS, after they had seen his +FLTK-based XPP (a GUI frontend to +the CUPS lp-command). He added a huge amount of new information and new +printers. He also developed the support for other spoolers, like +PPR (via ppromatic), +GNUlpr and +LPRng (both via an extended +lpdomatic) and "spoolerless" printing (directomatic).... + + + +So, to answer your question: "Foomatic" is the general name for all +the overlapping code and data behind the "*omatic" scripts.... -- +Foomatic up to versions 2.0.x required (ugly) Perl data structures +attached the Linuxprinting.org PPDs for CUPS. It had a different +"*omatic" script for every spooler, as well as different printer +configuration files.. + + + + +7.13.1.5.The <emphasis>Grand Unification</emphasis> +achieved... + + +This all has changed in Foomatic versions 2.9 (Beta) and released as +"stable" 3.0. This has now achieved the convergence of all *omatic +scripts: it is called the foomatic-rip. +This single script is the unification of the previously different +spooler-specific *omatic scripts. foomatic-rip is used by all the +different spoolers alike. Because foomatic-rip can read PPDs (both the +original PostScript printer PPDs and the Linuxprinting.org-generated +ones), all of a sudden all supported spoolers can have the power of +PPDs at their disposal; users only need to plug "foomatic-rip" into +their system.... For users there is improved media type and source +support; paper sizes and trays are easier to configure. + + + +Also, the New Generation of Linuxprinting.org PPDs doesn't contain +Perl data structures any more. If you are a distro maintainer and have +used the previous version of Foomatic, you may want to give the new +one a spin: but don't forget to generate a new-version set of PPDs, +via the new foomatic-db-engine! +Individual users just need to generate a single new PPD specific to +their model by following +the steps outlined in the Foomatic tutorial or further +below. This new development is truly amazing. + + + +foomatic-rip is a very clever wrapper around the need to run +Ghostscript with a different syntax, different options, different +device selections and/or different filters for each different printer +or different spooler. At the same time it can read the PPD associated +with a print queue and modify the print job according to the user +selections. Together with this comes the 100% compliance of the new +Foomatic PPDs with the Adobe spec. Some really innovative features of +the Foomatic concept will surprise users: it will support custom paper +sizes for many printers; and it will support printing on media drawn +from different paper trays within the same job (in both cases: even +where there is no support for this from Windows-based vendor printer +drivers). + + + + +Driver Development outside + + +Most driver development itself does not happen within +Linuxprinting.org. Drivers are written by independent maintainers. +Linuxprinting.org just pools all the information, and stores it in its +database. In addition, it also provides the Foomatic glue to integrate +the many drivers into any modern (or legacy) printing system known to +the world. + + + +Speaking of the different driver development groups: most of +the work is currently done in three projects. These are: + + + +Omni +-- a Free Software project by IBM which tries to convert their printer +driver knowledge from good-ol' OS/2 times into a modern, modular, +universal driver architecture for Linux/Unix (still Beta). This +currently supports 437 models. + +HPIJS -- +a Free Software project by HP to provide the support for their own +range of models (very mature, printing in most cases is perfect and +provides true photo quality). This currently supports 369 +models. + +Gimp-Print -- a Free software +effort, started by Michael Sweet (also lead developer for CUPS), now +directed by Robert Krawitz, which has achieved an amazing level of +photo print quality (many Epson users swear that its quality is +better than the vendor drivers provided by Epson for the Microsoft +platforms). This currently supports 522 models. + + + + +Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and +commercial Unix + + +Linuxprinting.org today is the one-stop "shop" to download printer +drivers. Look for printer information and tutorials +or solve printing problems in its popular forums. But +it's not just for GNU/Linux: users and admins of commercial UNIX +systems are also going there, and the relatively new Mac +OS X forum has turned out to be one of the most frequented +fora after only a few weeks. + + + +Linuxprinting.org and the Foomatic driver wrappers around Ghostscript +are now a standard toolchain for printing on all the important +distros. Most of them also have CUPS underneath. While in recent years +most printer data had been added by Till (who works at Mandrake), many +additional contributions came from engineers with SuSE, RedHat, +Connectiva, Debian and others. Vendor-neutrality is an important goal +of the Foomatic project. + + + +Till Kamppeter from MandrakeSoft is doing an excellent job in his +spare time to maintain Linuxprinting.org and Foomatic. So if you use +it often, please send him a note showing your appreciation. + + + + +Foomatic Database generated PPDs + + +The Foomatic database is an amazing piece of ingenuity in itself. Not +only does it keep the printer and driver information, but it is +organized in a way that it can generate "PPD" files "on the fly" from +its internal XML-based datasets. While these PPDs are modelled to the +Adobe specification of "PostScript Printer Descriptions" (PPDs), the +Linuxprinting.org/Foomatic-PPDs don't normally drive PostScript +printers: they are used to describe all the bells and whistles you +could ring or blow on an Epson Stylus inkjet, or a HP Photosmart or +what-have-you. The main "trick" is one little additional line, not +envisaged by the PPD specification, starting with the "*cupsFilter" +keyword: it tells the CUPS daemon how to proceed with the PostScript +print file (old-style Foomatic-PPDs named the +cupsomatic filter script, while the new-style +PPDs now call foomatic-rip). This filter +script calls Ghostscript on the host system (the recommended variant +is ESP Ghostscript) to do the rendering work. foomatic-rip knows which +filter or internal device setting it should ask from Ghostscript to +convert the PostScript printjob into a raster format ready for the +target device. This usage of PPDs to describe the options of non-PS +printers was the invention of the CUPS developers. The rest is easy: +GUI tools (like KDE's marvellous "kprinter", +or the GNOME "gtklp", "xpp" and the CUPS +web interface) read the PPD too and use this information to present +the available settings to the user as an intuitive menu selection. + + + + + +foomatic-rip and Foomatic-PPD Download and Installation + + +Here are the steps to install a foomatic-rip driven "LaserJet 4 Plus" +compatible printer in CUPS (note that recent distributions of SuSE, +UnitedLinux and Mandrake may ship with a complete package of +Foomatic-PPDs plus the foomatic-rip utility. going directly to +Linuxprinting.org ensures you to get the latest driver/PPD files): + + +Surf to http://www.linuxprinting.org/printer_list.cgi + + +Check the complete list of printers in the database: +http://www.linuxprinting.org/printer_list.cgi?make=Anyone + + +There select your model and click on the +link. + +You'll arrive at a page listing all drivers working +with this model (for all printers, there will always be +one recommended driver. Try this one +first). + +In our case ("HP LaserJet 4 Plus"), we'll arrive here: +http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus + + +The recommended driver is "ljet4". + +There are several links provided here. You should +visit them all, if you are not familiar with the Linuxprinting.org +database. + +There is a link to the database page for the "ljet4": +http://www.linuxprinting.org/show_driver.cgi?driver=ljet4 +On the driver's page, you'll find important and detailed information +about how to use that driver within the various available +spoolers. + +Another link may lead you to the homepage of the +driver author or the driver. + +Important links are the ones which provide hints with +setup instructions for CUPS (http://www.linuxprinting.org/cups-doc.html), +PDQ (http://www.linuxprinting.org/pdq-doc.html), +LPD, LPRng and GNUlpr (http://www.linuxprinting.org/lpd-doc.html) +as well as PPR (http://www.linuxprinting.org/ppr-doc.html) +or "spooler-less" printing (http://www.linuxprinting.org/direct-doc.html +). + +You can view the PPD in your browser through this +link: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1 + You can also (most importantly) +generate and download the PPD: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=0 + + +The PPD contains all the information needed to use our +model and the driver; this is, once installed, working transparently +for the user. Later you'll only need to choose resolution, paper size +etc. from the web-based menu, or from the print dialog GUI, or from +the commandline. + +Should you have ended up on the driver's page (http://www.linuxprinting.org/show_driver.cgi?driver=ljet4), +you can choose to use the "PPD-O-Matic" online PPD generator +program. + +Select the exact model and check either "download" or +"display PPD file" and click on "Generate PPD file". + +If you save the PPD file from the browser view, please +don't use "cut'n'past" (since it could possibly damage line endings +and tabs, which makes the PPD likely to fail its duty), but use "Save +as..." in your browser's menu. (Best is to use the "download" option +from the web page directly). + +Another very interesting part on each driver page is +the Show execution details button. If you +select your printer model and click that button, you will get +displayed a complete Ghostscript command line, enumerating all options +available for that driver/printermodel combo. This is a great way to +"Learn Ghostscript By Doing". It is also an excellent "cheat sheet" +for all experienced users who need to re-construct a good command line +for that damn printing script, but can't remember the exact +syntax. ;-) + +Some time during your visit to Linuxprinting.org, save +the PPD to a suitable place on your harddisk, say +/path/to/my-printer.ppd (if you prefer to install +your printers with the help of the CUPS web interface, save the PPD to +the /usr/share/cups/model/ path and re-start +cupsd). + +Then install the printer with a suitable commandline, +e.g.: + + + + +lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd + + + +Note again this: for all the new-style "Foomatic-PPDs" +from Linuxprinting.org, you also need a special "CUPS filter" named +"foomatic-rip".Get the latest version of "foomatic-rip" from: http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0 + + +The foomatic-rip Perlscript itself also makes some +interesting reading (http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=1), +because it is very well documented by Till's inline comments (even +non-Perl hackers will learn quite a bit about printing by reading +it... ;-) + +Save foomatic-rip either directly in +/usr/lib/cups/filter/foomatic-rip or somewhere in +your $PATH (and don't forget to make it world-executable). Again, +don't save by "copy'n'paste" but use the appropriate link, or the +"Save as..." menu item in your browser. + +If you save foomatic-rip in your $PATH, create a symlink: +cd /usr/lib/cups/filter/ ; ln -s `which +foomatic-rip`. For CUPS to discover this new +available filter at startup, you need to re-start +cupsd. + + + +Once you print to a printqueue set up with the Foomatic-PPD, CUPS will +insert the appropriate commands and comments into the resulting +PostScript jobfile. foomatic-rip is able to read and act upon +these. foomatic-rip uses some specially encoded Foomatic comments, +embedded in the jobfile. These in turn are used to construct +(transparently for you, the user) the complicated ghostscript command +line telling for the printer driver how exactly the resulting raster +data should look like and which printer commands to embed into the +data stream. + + + +You need: + + + + +A "foomatic+something" PPD -- but it this not enough +to print with CUPS (it is only one important +component) + +The "foomatic-rip" filter script (Perl) in +/usr/lib/cups/filters/ + +Perl to make foomatic-rip run + +Ghostscript (because it is doing the main work, +controlled by the PPD/foomatic-rip combo) to produce the raster data +fit for your printermodel's consumption + +Ghostscript must (depending on +the driver/model) contain support for a certain "device", representing +the selected "driver" for your model (as shown by "gs +-h") + +foomatic-rip needs a new version of PPDs (PPD versions +produced for cupsomatic don't work with +foomatic-rip). + + + + + +Page Accounting with CUPS + + +Often there are questions regarding "print quotas" wherein Samba users +(that is, Windows clients) should not be able to print beyond a +certain amount of pages or data volume per day, week or month. This +feature is dependent on the real print subsystem you're using. +Samba's part is always to receive the job files from the clients +(filtered or unfiltered) and hand it over to this +printing subsystem. + + + +Of course one could "hack" things with one's own scripts. But then +there is CUPS. CUPS supports "quotas" which can be based on sizes of +jobs or on the number of pages or both, and are spanning any time +period you want. + + + +Setting up Quotas + + +This is an example command how root would set a print quota in CUPS, +assuming an existing printer named "quotaprinter": + + + + + lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 -o job-page-limit=100 + + + + +This would limit every single user to print 100 pages or 1024 KB of +data (whichever comes first) within the last 604,800 seconds ( = 1 +week). + + + + +Correct and incorrect Accounting + + +For CUPS to count correctly, the printfile needs to pass the CUPS +"pstops" filter, otherwise it uses a "dummy" count of "1". Some +printfiles don't pass it (eg: image files) but then those are mostly 1 +page jobs anyway. This also means that proprietary drivers for the +target printer running on the client computers and CUPS/Samba, which +then spool these files as "raw" (i.e. leaving them untouched, not +filtering them), will be counted as "1-pagers" too! + + + +You need to send PostScript from the clients (i.e. run a PostScript +driver there) to have the chance to get accounting done. If the +printer is a non-PostScript model, you need to let CUPS do the job to +convert the file to a print-ready format for the target printer. This +will be working for currently about 1,000 different printer models, +see http://www.linuxprinting.org/printer_list.cgi). + + + + +Adobe and CUPS PostScript Drivers for Windows Clients + + +Before CUPS-1.1.16 your only option was to use the Adobe PostScript +Driver on the Windows clients. The output of this driver was not +always passed through the "pstops" filter on the CUPS/Samba side, and +therefore was not counted correctly (the reason is that it often, +depending on the "PPD" being used, wrote a "PJL"-header in front of +the real PostScript which caused CUPS to skip pstops and go directly +to the "pstoraster" stage). + + + +From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver for +Windows NT/2K/XP clients" (which is tagged in the download area of +http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). It does +not work for Win9x/ME clients. But it guarantees: + + + + +to not write an PJL-header + +to still read and support all PJL-options named in the +driver PPD with its own means + + that the file will pass through the "pstops" filter +on the CUPS/Samba server + +to page-count correctly the +printfile + + + +You can read more about the setup of this combination in the manpage +for "cupsaddsmb" (which is only present with CUPS installed, and only +current from CUPS 1.1.16). + + + + +The page_log File Syntax + + +These are the items CUPS logs in the "page_log" for every +single page of a job: + + + +Printer name + +User name + +Job ID + +Time of printing + +the page number + +the number of copies + +a billing information string +(optional) + +the host which sent the job (included since version +1.1.19) + + + +Here is an extract of my CUPS server's page_log file to illustrate the +format and included items: + + + + + infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13 + infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13 + infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13 + infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13 + DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33 + + + + +This was job ID "401", printed on "infotec_IS2027" by user "kurt", a +64-page job printed in 3 copies and billed to "#marketing", sent +from IP address 10.160.50.13. The next job had ID "402", was sent by +user "boss" from IP address 10.160.51.33,printed from one page 440 +copies and is set to be billed to "finance-dep". + + + + +Possible Shortcomings + + +What flaws or shortcomings are there with this quota system? + + + +the ones named above (wrongly logged job in case of +printer hardware failure, etc.) + +in reality, CUPS counts the job pages that are being +processed in software (that is, going through the +"RIP") rather than the physical sheets successfully leaving the +printing device. Thus if there is a jam while printing the 5th sheet out +of 1000 and the job is aborted by the printer, the "page count" will +still show the figure of 1000 for that job + +all quotas are the same for all users (no flexibility +to give the boss a higher quota than the clerk) no support for +groups + +no means to read out the current balance or the +"used-up" number of current quota + +a user having used up 99 sheets of 100 quota will +still be able to send and print a 1,000 sheet job + +a user being denied a job because of a filled-up quota +doesn't get a meaningful error message from CUPS other than +"client-error-not-possible". + + + + +Future Developments + + +This is the best system currently available, and there are huge +improvements under development for CUPS 1.2: + + + +page counting will go into the "backends" (these talk +directly to the printer and will increase the count in sync with the +actual printing process: thus a jam at the 5th sheet will lead to a +stop in the counting) + +quotas will be handled more flexibly + +probably there will be support for users to inquire +their "accounts" in advance + +probably there will be support for some other tools +around this topic + + + + +Other Accounting Tools + + +PrintAnalyzer, pyKota, printbill, LogReport. + + + + + +Additional Material + + +A printer queue with no PPD associated to it is a +"raw" printer and all files will go directly there as received by the +spooler. The exceptions are file types "application/octet-stream" +which need "passthrough feature" enabled. "Raw" queues don't do any +filtering at all, they hand the file directly to the CUPS backend. +This backend is responsible for the sending of the data to the device +(as in the "device URI" notation: lpd://, socket://, +smb://, ipp://, http://, parallel:/, serial:/, usb:/ etc.) + + + +"cupsomatic"/Foomatic are not native CUPS drivers +and they don't ship with CUPS. They are a Third Party add-on, +developed at Linuxprinting.org. As such, they are a brilliant hack to +make all models (driven by Ghostscript drivers/filters in traditional +spoolers) also work via CUPS, with the same (good or bad!) quality as +in these other spoolers. "cupsomatic" is only a vehicle to execute a +ghostscript commandline at that stage in the CUPS filtering chain, +where "normally" the native CUPS "pstoraster" filter would kick +in. cupsomatic by-passes pstoraster, "kidnaps" the printfile from CUPS +away and re-directs it to go through Ghostscript. CUPS accepts this, +because the associated CUPS-O-Matic-/Foomatic-PPD specifies: + + + + + *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic" + + + + +This line persuades CUPS to hand the file to cupsomatic, once it has +successfully converted it to the MIME type +"application/vnd.cups-postscript". This conversion will not happen for +Jobs arriving from Windows which are auto-typed +"application/octet-stream", with the according changes in +/etc/cups/mime.types in place. + + + +CUPS is widely configurable and flexible, even regarding its filtering +mechanism. Another workaround in some situations would be to have in +/etc/cups/mime.types entries as follows: + + + + + application/postscript application/vnd.cups-raw 0 - + application/vnd.cups-postscript application/vnd.cups-raw 0 - + + + + +This would prevent all Postscript files from being filtered (rather, +they will through the virtual nullfilter +denoted with "-"). This could only be useful for PS printers. If you +want to print PS code on non-PS printers (provided they support ASCII +text printing) an entry as follows could be useful: + + + + + */* application/vnd.cups-raw 0 - + + + + +and would effectively send all files to the +backend without further processing. + + + +Lastly, you could have the following entry: + + + + + application/vnd.cups-postscript application/vnd.cups-raw 0 my_PJL_stripping_filter + + + + +You will need to write a my_PJL_stripping_filter +(could be a shellscript) that parses the PostScript and removes the +unwanted PJL. This would need to conform to CUPS filter design +(mainly, receive and pass the parameters printername, job-id, +username, jobtitle, copies, print options and possibly the +filename). It would be installed as world executable into +/usr/lib/cups/filters/ and will be called by CUPS +if it encounters a MIME type "application/vnd.cups-postscript". + + + +CUPS can handle -o job-hold-until=indefinite. +This keeps the job in the queue "on hold". It will only be printed +upon manual release by the printer operator. This is a requirement in +many "central reproduction departments", where a few operators manage +the jobs of hundreds of users on some big machine, where no user is +allowed to have direct access (such as when the operators often need +to load the proper paper type before running the 10,000 page job +requested by marketing for the mailing, etc.). + + + + +Auto-Deletion or Preservation of CUPS Spool Files + + +Samba print files pass through two "spool" directories. One is the +incoming directory managed by Samba, (set in the path = +/var/spool/samba directive in the +[printers] section of +smb.conf). The other is the spool directory of +your UNIX print subsystem. For CUPS it is normally +/var/spool/cups/, as set by the cupsd.conf +directive RequestRoot /var/spool/cups. + + + +CUPS Configuration Settings explained + + +Some important parameter settings in the CUPS configuration file +cupsd.conf are: + + + + +PreserveJobHistory Yes + +This keeps some details of jobs in cupsd's mind (well it keeps the +"c12345", "c12346" etc. files in the CUPS spool directory, which do a +similar job as the old-fashioned BSD-LPD control files). This is set +to "Yes" as a default. + + +PreserveJobFiles Yes + +This keeps the job files themselves in cupsd's mind +(well it keeps the "d12345", "d12346" etc. files in the CUPS spool +directory...). This is set to "No" as the CUPS +default. + + +"MaxJobs 500" + +This directive controls the maximum number of jobs +that are kept in memory. Once the number of jobs reaches the limit, +the oldest completed job is automatically purged from the system to +make room for the new one. If all of the known jobs are still +pending or active then the new job will be rejected. Setting the +maximum to 0 disables this functionality. The default setting is +0. + + + + +(There are also additional settings for "MaxJobsPerUser" and +"MaxJobsPerPrinter"...) + + + + +Pre-conditions + + +For everything to work as announced, you need to have three +things: + + + +a Samba-smbd which is compiled against "libcups" (Check +on Linux by running "ldd `which smbd`") + +a Samba-smb.conf setting of +"printing = cups" + +another Samba-smb.conf setting of +"printcap = cups" + + + +In this case all other manually set printing-related commands (like +"print command", "lpq command", "lprm command", "lppause command" or +"lpresume command") are ignored and they should normally have no +influence what-so-ever on your printing. + + + + +Manual Configuration + + +If you want to do things manually, replace the "printing = +cups" by "printing = bsd". Then your manually set commands may work +(haven't tested this), and a "print command = lp -d %P %s; rm %s" +may do what you need. + + + + + +When <emphasis>not</emphasis> to use Samba to print to +CUPS + + +[TO BE DONE] + + + + +In Case of Trouble..... + + +If you have more problems, post the output of these commands +to the CUPS or Samba mailing lists (choose the one which seems more +relevant to your problem): + + + + + grep -v ^# /etc/cups/cupsd.conf | grep -v ^$ + grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;" + + + + +(adapt paths as needed). These commands leave out the empty +lines and lines with comments, providing the "naked settings" in a +compact way. Don't forget to name the CUPS and Samba versions you +are using! This saves bandwidth and makes for easier readability +for experts (and you are expecting experts to read them, right? +;-) + + + +Where to find Documentation + + +[TO BE DONE] + + + + +How to ask for Help + + +[TO BE DONE] + + + + +Where to find Help + + +[TO BE DONE] + + + + + +Appendix + + +Printing <emphasis>from</emphasis> CUPS to Windows attached +Printers + + +From time to time the question arises, how you can print +to a Windows attached printer +from Samba. Normally the local connection +"Windows host <--> printer" would be done by USB or parallel +cable, but this doesn't matter to Samba. From here only an SMB +connection needs to be opened to the Windows host. Of course, this +printer must be "shared" first. As you have learned by now, CUPS uses +backends to talk to printers and other +servers. To talk to Windows shared printers you need to use the +smb (surprise, surprise!) backend. Check if this +is in the CUPS backend directory. This resides usually in +/usr/lib/cups/backend/. You need to find a "smb" +file there. It should be a symlink to smbspool +which file must exist and be executable: + + + + + # ls -l /usr/lib/cups/backend/ + total 253 + drwxr-xr-x 3 root root 720 Apr 30 19:04 . + drwxr-xr-x 6 root root 125 Dec 19 17:13 .. + -rwxr-xr-x 1 root root 10692 Feb 16 21:29 canon + -rwxr-xr-x 1 root root 10692 Feb 16 21:29 epson + lrwxrwxrwx 1 root root 3 Apr 17 22:50 http -> ipp + -rwxr-xr-x 1 root root 17316 Apr 17 22:50 ipp + -rwxr-xr-x 1 root root 15420 Apr 20 17:01 lpd + -rwxr-xr-x 1 root root 8656 Apr 20 17:01 parallel + -rwxr-xr-x 1 root root 2162 Mar 31 23:15 pdfdistiller + lrwxrwxrwx 1 root root 25 Apr 30 19:04 ptal -> /usr/local/sbin/ptal-cups + -rwxr-xr-x 1 root root 6284 Apr 20 17:01 scsi + lrwxrwxrwx 1 root root 17 Apr 2 03:11 smb -> /usr/bin/smbspool + -rwxr-xr-x 1 root root 7912 Apr 20 17:01 socket + -rwxr-xr-x 1 root root 9012 Apr 20 17:01 usb + +# ls -l `which smbspool` + -rwxr-xr-x 1 root root 563245 Dec 28 14:49 /usr/bin/smbspool + + + + +If this symlink doesn't exist, create it: + + + + +# ln -s `which smbspool` /usr/lib/cups/backend/smb + + + + +smbspool has been written by Mike Sweet from the CUPS folks. It is +included and ships with Samba. It may also be used with print +subsystems other than CUPS, to spool jobs to Windows printer shares. To +set up printer "winprinter" on CUPS, you need to have a "driver" for +it. Essentially this means to convert the print data on the CUPS/Samba +host to a format that the printer can digest (the Windows host is +unable to convert any files you may send). This also means you should +be able to print to the printer if it were hooked directly at your +Samba/CUPS host. For troubleshooting purposes, this is what you +should do, to determine if that part of the process chain is in +order. Then proceed to fix the network connection/authentication to +the Windows host, etc. + + + +To install a printer with the smb backend on CUPS, use this command: + + + + +# lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename -P /path/to/PPD + + + + +The PPD must be able to direct CUPS to generate +the print data for the target model. For PostScript printers just use +the PPD that would be used with the Windows NT PostScript driver. But +what can you do if the printer is only accessible with a password? Or +if the printer's host is part of another workgroup? This is provided +for: you can include the required parameters as part of the +smb:// device-URI. Like this: + + + + + smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename + smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename + smb://username:password@WINDOWSNETBIOSNAME/printersharename + + + + +Note that the device-URI will be visible in the process list of the +Samba server (e.g. when someone uses the ps -aux +command on Linux), even if the username and passwords are sanitized +before they get written into the log files. So this is an inherently +insecure option. However it is the only one. Don't use it if you want +to protect your passwords. Better share the printer in a way that +doesn't require a password! Printing will only work if you have a +working netbios name resolution up and running. Note that this is a +feature of CUPS and you don't necessarily need to have smbd running +(but who wants that? :-). + + + + +More CUPS filtering Chains + + +The following diagrams reveal how CUPS handles print jobs. + + + +######################################################################### +# # CUPS in and of itself has this (general) filter chain (CAPITAL # letters are FILE-FORMATS or MIME types, other are filters (this is # true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro): # -# SOMETHNG-FILEFORMAT -# | +# SOMETHNG-FILEFORMAT # | # V -# somethingtops -# | +# somethingtops # | # V # APPLICATION/POSTSCRIPT # | -# | # V # pstops # | -# | # V # APPLICATION/VND.CUPS-POSTSCRIPT # | -# | # V # pstoraster # as shipped with CUPS, independent from any Ghostscipt # | # installation on the system # | (= "postscipt interpreter") -# | # V # APPLICATION/VND.CUPS-RASTER # | -# | # V -# rastertosomething (f.e. Gimp-Print filters may be plugged in here) +# rastertosomething (e.g. Gimp-Print filters may be plugged in here) # | (= "raster driver") -# | # V # SOMETHING-DEVICE-SPECIFIC # | -# | # V # backend # # -# ESP PrintPro has some enhanced "rastertosomething" filters as compared to +# ESP PrintPro has some enhanced "rastertosomething" filters as compared to # CUPS, and also a somewhat improved "pstoraster" filter. # # NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rastertosomething is noted. +# CUPS and ESP PrintPro plug-in where rastertosomething is noted. # ######################################################################### - + - + ######################################################################### # # This is how "cupsomatic" comes into play: # ========================================= # -# SOMETHNG-FILEFORMAT -# | +# SOMETHNG-FILEFORMAT # | # V -# somethingtops -# | +# somethingtops # | # V # APPLICATION/POSTSCRIPT # | -# | # V # pstops # | -# | # V # APPLICATION/VND.CUPS-POSTSCRIPT ----------------+ -# | | # | V # V cupsomatic # pstoraster (constructs complicated # | (= "postscipt interpreter") Ghostscript commandline # | to let the file be # V processed by a -# APPLICATION/VND.CUPS-RASTER "-sDEVICE=s.th." +# APPLICATION/VND.CUPS-RASTER "-sDEVICE=s.th." # | call...) -# | | # V | -# rastertosomething V +# rastertosomething V # | (= "raster driver") +-------------------------+ # | | Ghostscript at work.... | # V | | # SOMETHING-DEVICE-SPECIFIC *-------------------------+ # | | -# | | # V | -# backend >------------------------------------+ -# | +# backend <------------------------------------+ # | # V # THE PRINTER # # # Note, that cupsomatic "kidnaps" the printfile after the -# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it through +# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it gh # the CUPS-external, systemwide Ghostscript installation, bypassing the -# "pstoraster" filter (therefor also bypassing the CUPS-raster-drivers -# "rastertosomething", and hands the rasterized file directly to the CUPS +# "pstoraster" filter (therefore also bypassing the CUPS-raster-drivers +# "rastertosomething", and hands the rasterized file directly to the CUPS # backend... # # cupsomatic is not made by the CUPS developers. It is an independent @@ -801,140 +5246,118 @@ The following diagrams reveal how CUPS handles print jobs. # Linuxprinting.org. (see also http://www.cups.org/cups-help.html) # # NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rastertosomething is noted. +# CUPS and ESP PrintPro plug-in where rastertosomething is noted. # ######################################################################### - + - + ######################################################################### # # And this is how it works for ESP PrintPro from 4.3: # =================================================== # -# SOMETHNG-FILEFORMAT -# | +# SOMETHNG-FILEFORMAT # | # V -# somethingtops -# | +# somethingtops # | # V # APPLICATION/POSTSCRIPT # | -# | # V # pstops # | -# | # V # APPLICATION/VND.CUPS-POSTSCRIPT # | -# | # V # gsrip # | (= "postscipt interpreter") -# | # V # APPLICATION/VND.CUPS-RASTER # | -# | # V -# rastertosomething (f.e. Gimp-Print filters may be plugged in here) +# rastertosomething (e.g. Gimp-Print filters may be plugged in here) # | (= "raster driver") -# | # V # SOMETHING-DEVICE-SPECIFIC # | -# | # V # backend # # NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rastertosomething is noted. +# CUPS and ESP PrintPro plug-in where rastertosomething is noted. # ######################################################################### - + - + ######################################################################### # # This is how "cupsomatic" would come into play with ESP PrintPro: # ================================================================ # # -# SOMETHNG-FILEFORMAT -# | +# SOMETHNG-FILEFORMAT # | # V -# somethingtops -# | +# somethingtops # | # V # APPLICATION/POSTSCRIPT # | -# | # V # pstops # | -# | # V # APPLICATION/VND.CUPS-POSTSCRIPT ----------------+ -# | | # | V # V cupsomatic # gsrip (constructs complicated # | (= "postscipt interpreter") Ghostscript commandline # | to let the file be # V processed by a -# APPLICATION/VND.CUPS-RASTER "-sDEVICE=s.th." +# APPLICATION/VND.CUPS-RASTER "-sDEVICE=s.th." # | call...) -# | | # V | -# rastertosomething V +# rastertosomething V # | (= "raster driver") +-------------------------+ # | | Ghostscript at work.... | # V | | # SOMETHING-DEVICE-SPECIFIC *-------------------------+ # | | -# | | # V | -# backend >------------------------------------+ -# | +# backend <------------------------------------+ # | # V # THE PRINTER # # NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rastertosomething is noted. +# CUPS and ESP PrintPro plug-in where rastertosomething is noted. # ######################################################################### - + - + ######################################################################### # # And this is how it works for CUPS from 1.1.15: # ============================================== # -# SOMETHNG-FILEFORMAT -# | +# SOMETHNG-FILEFORMAT # | # V -# somethingtops -# | +# somethingtops # | # V # APPLICATION/POSTSCRIPT # | -# | # V # pstops # | -# | # V # APPLICATION/VND.CUPS-POSTSCRIPT-----+ -# | # +------------------v------------------------------+ # | Ghostscript | # | at work... | @@ -945,18 +5368,14 @@ The following diagrams reveal how CUPS handles print jobs. # | | # +------------------v------------------------------+ # | -# | # APPLICATION/VND.CUPS-RASTER >-------+ # | -# | # V -# rastertosomething +# rastertosomething # | (= "raster driver") -# | # V # SOMETHING-DEVICE-SPECIFIC # | -# | # V # backend # @@ -967,46 +5386,41 @@ The following diagrams reveal how CUPS handles print jobs. # "gs -h" needs to show up a "cups" device. pstoraster is now a # calling an appropriate "gs -sDEVICE=cups..." commandline to do # the job. It will output "application/vnd.cup-raster", which will -# be finally processed by a CUPS raster driver "rastertosomething" -# Note the difference to "cupsomatic", which will *not* output +# be finally processed by a CUPS raster driver "rastertosomething" +# Note the difference to "cupsomatic", which will not output # CUPS-raster, but a final version of the printfile, ready to be # sent to the printer. cupsomatic also doesn't use the "cups" # devicemode in Ghostscript, but one of the classical devicemodes.... # # NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rastertosomething is noted. +# CUPS and ESP PrintPro plug-in where rastertosomething is noted. # ######################################################################### - + - + ######################################################################### # # And this is how it works for CUPS from 1.1.15, with cupsomatic included: # ======================================================================== # -# SOMETHNG-FILEFORMAT -# | +# SOMETHNG-FILEFORMAT # | # V -# somethingtops -# | +# somethingtops # | # V # APPLICATION/POSTSCRIPT # | -# | # V # pstops # | -# | # V # APPLICATION/VND.CUPS-POSTSCRIPT-----+ -# | # +------------------v------------------------------+ # | Ghostscript . Ghostscript at work.... | # | at work... . (with "-sDEVICE= | -# | (with . s.th." | +# | (with . s.th." | # | "-sDEVICE=cups") . | # | . | # | (CUPS standard) . (cupsomatic) | @@ -1015,779 +5429,379 @@ The following diagrams reveal how CUPS handles print jobs. # | . | # +------------------v--------------v---------------+ # | | -# | | # APPLICATION/VND.CUPS-RASTER >-------+ | # | | -# | | # V | -# rastertosomething | +# rastertosomething | # | (= "raster driver") | -# | | # V | # SOMETHING-DEVICE-SPECIFIC >------------------------+ # | -# | # V # backend # # # NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rastertosomething is noted. +# CUPS and ESP PrintPro plug-in where rastertosomething is noted. # ########################################################################## - - - - - - -CUPS Print Drivers and Devices - - -CUPS ships with good support for HP LaserJet type printers. You can install -the driver as follows: - - - - lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd - - - -(The "-m" switch will retrieve the "laserjet.ppd" from the standard repository -for not-yet-installed-PPDs, which CUPS typically stores in -/usr/share/cups/model. Alternatively, you may use -"-P /absolute/filesystem/path/to/where/there/is/PPD/your.ppd"). - + + -Further printing steps - - -Always also consult the database on linuxprinting.org for all recommendations -about which driver is best used for each printer: - - -http://www.linuxprinting.org/printer_list.cgi - - -There select your model and click on "Show". You'll arrive at a page listing -all drivers working with your model. There will always be *one* -recommended one. Try this one first. In your case -("HP LaserJet 4 Plus"), you'll arrive here: - - -http://www.linuxprinting.org/show_printer.cgi?recnum=75104 - - -The recommended driver is "ljet4". It has a link to the page for the ljet4 -driver too: - - -http://www.linuxprinting.org/show_driver.cgi?driver=ljet4 - - -On the driver's page, you'll find important and detailed info about how to use -that driver within the various available spoolers. You can generate a PPD for -CUPS. The PPD contains all the info about how to use your model and the driver; -this is, once installed, working transparently for the user -- you'll only -need to choose resolution, paper size etc. from the web-based menu or from -the print dialog GUI or from the commandline... - - - -On the driver's page, choose to use the "PPD-O-Matic" online PPD generator -program. Select your model and click "Generate PPD file". When you safe the -appearing ASCII text file, don't use "cut'n'past" (as it could possiblly corrupt -line endings and tabs), but use "Save as..." in your browser's menu. Save it -at "/some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd" - - - -Then install the printer: - - - "lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E \ - -P /some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd" - +Trouble Shooting Guidelines to fix typical Samba printing +Problems -Note, that for all the "Foomatic-PPDs" from Linuxprinting.org, you also need -a special "CUPS filter" named "cupsomatic". Get the latest version of -"cupsomatic" from: +This is a short description of how to debug printing problems +with Samba. This describes how to debug problems with printing from +a SMB client to a Samba server, not the other way around. -http://www.linuxprinting.org/cupsomatic - - -This needs to be copied to /usr/lib/cups/filter/cupsomatic -and be made world executable. This filter is needed to read and act upon the -specially encoded Foomatic comments, embedded in the printfile, which in turn -are used to construct (transparently for you, the user) the complicated -ghostscript command line needed for your printer/driver combo. + +Win9x client can't install driver +For Win9x clients require the printer names to be 8 +chars (or "8 plus 3 chars suffix") max; otherwise the driver files +won't get transferred when you want to download them from +Samba. + +testparm +Run testparm: It will tell you if +smb.conf parameters are in the wrong +section. Many people have had the "printer admin" parameter in the +[printers] section and experienced +problems. "testparm" will tell you if it sees +this. + +"cupsaddsmb" keeps asking for a root password in a +neverending loop +Have you security = user? Have +you used smbpasswd to give root a Samba account? +You can do 2 things: open another terminal and execute +smbpasswd -a root to create the account, and +continue with entering the password into the first terminal. Or break +out of the loop by hitting ENTER twice (without trying to type a +password). + +"cupsaddsmb" gives "No PPD file for printer..." +message (but I swear there is one!) + + + +Have you enabled printer sharing on CUPS? This means: +do you have a <Location +/printers>....</Location> section in CUPS +server's cupsd.conf which doesn't deny access to +the host you run "cupsaddsmb" from? It could be +an issue if you use cupsaddsmb remotely, or if you use it with a +-h parameter: cupsaddsmb -H +sambaserver -h cupsserver -v printername. + +Is your +"TempDir" directive in +cupsd.conf +set to a valid value and is it writeable? + + + +I can't connect client to Samba printer. +Use smbstatus to check which user +you are from Samba's point of view. Do you have the privileges to +write into the [print$] +share? + +I can't reconnect to Samba under a new account +from Win2K/XP +Once you are connected as the "wrong" user (for +example as "nobody", which often occurs if you have map to +guest = bad user), Windows Explorer will not accept an +attempt to connect again as a different user. There won't be any byte +transfered on the wire to Samba, but still you'll see a stupid error +message which makes you think that Samba has denied access. Use +smbstatus to check for active connections. Kill the +PIDs. You still can't re-connect and get the dreaded +You can't connect with a second account from the same +machine message, as soon as you are trying? And you +don't see any single byte arriving at Samba (see logs; use "ethereal") +indicating a renewed connection attempt? Shut all Explorer Windows. +This makes Windows forget what it has cached in its memory as +established connections. Then re-connect as the right user. Best +method is to use a DOS terminal window and first +do net use z: \\SAMBAHOST\print$ /user:root. Check +with smbstatus that you are connected under a +different account. Now open the "Printers" folder (on the Samba server +in the Network Neighbourhood), right-click the +printer in question and select +Connect... + +Avoid being connected to the Samba server as the +"wrong" user +You see per smbstatus that you are +connected as user "nobody"; while you wanted to be "root" or +"printeradmin"? This is probably due to map to guest = bad +user, which silently connects you under the guest account, +when you gave (maybe by accident) an incorrect username. Remove +map to guest, if you want to prevent +this. + +Upgrading to CUPS drivers from Adobe drivers on +NT/2K/XP clients gives problems +First delete all "old" Adobe-using printers. Then +delete all "old" Adobe drivers. (On Win2K/XP, right-click in +background of "Printers" folder, select "Server Properties...", select +tab "Drivers" and delete here). + +I can't use "cupsaddsmb"on a Samba server which is +a PDC +Do you use the "naked" root user name? Try to do it +this way: cupsaddsmb -U DOMAINNAME\\root -v +printername (note the two backslashes: the first one is +required to "escape" the second one). + +I deleted a printer on Win2K; but I still see +its driver +Deleting a printer on the client won't delete the +driver too (to verify, right-click on the white background of the +"Printers" folder, select "Server Properties" and click on the +"Drivers" tab). These same old drivers will be re-used when you try to +install a printer with the same name. If you want to update to a new +driver, delete the old ones first. Deletion is only possible if no +other printer uses the same driver. + +Win2K/XP "Local Security +Policies" +Local Security Policies may not +allow the installation of unsigned drivers. "Local Security Policies" +may not allow the installation of printer drivers at +all. + +WinXP clients: "Administrator can not install +printers for all local users" +Windows XP handles SMB printers on a "per-user" basis. +This means every user needs to install the printer himself. To have a +printer available for everybody, you might want to use the built-in +IPP client capabilities of WinXP. Add a printer with the print path of +http://cupsserver:631/printers/printername. +Still looking into this one: maybe a "logon script" could +automatically install printers for all +users. + +"Print Change Notify" functions on +NT-clients +For "print change notify" functions on NT++ clients, +these need to run the "Server" service first (re-named to +File & Print Sharing for MS Networks in +XP). + +WinXP-SP1 +WinXP-SP1 introduced a Point and Print +Restriction Policy (this restriction doesn't apply to +"Administrator" or "Power User" groups of users). In Group Policy +Object Editor: go to User Configuration --> +Administrative Templates --> Control Panel --> +Printers. The policy is automatically set to +Enabled and the Users can only Point +and Print to machines in their Forest . You probably need +to change it to Disabled or Users can +only Point and Print to these servers in order to make +driver downloads from Samba possible. + +I can't set and save default print options for all +users on Win2K/XP + +How are you doing it? I bet the wrong way (it is not +very easy to find out, though). There are 3 different ways to bring +you to a dialog that seems to set everything. All +three dialogs look the same. Only one of them +does what you intend. You need to be +Administrator or Print Administrator to do this for all users. Here +is how I do in on XP: - -You can have a look at all the options for the Ghostscript commandline supported -by your printer and the ljet4 driver by going to the section "Execution details", -selecting your model (Laserjet 4 Plus) and clicking on "Show execution details". -This will bring up this web page: - + -http://www.linuxprinting.org/execution.cgi?driver=ljet4&printer=75104&.submit=Show+execution+details +The first "wrong" way: - -The ingenious thing is that the database is kept current. If there -is a bug fix and an improvement somewhere in the database, you will -always get the most current and stable and feature-rich driver by following -the steps described above. - + +Open the Printers +folder. - -Till Kamppeter from MandrakeSoft is doing an excellent job here that too few -people are aware of. (So if you use it often, please send him a note showing -your appreciation). +Right-click on the printer +(remoteprinter on cupshost) and +select in context menu Printing +Preferences... - -The latest and greatest improvement now is support for "custom page sizes" -for all those printers which support it. +Look at this dialog closely and remember what it looks +like. + + - -"cupsomatic" is documented here: - +The second "wrong" way: -http://www.linuxprinting.org/cups-doc.html + +Open the Printers +folder. - -More printing tutorial info may be found here: - +Right-click on the printer (remoteprinter on +cupshost) and select in the context menu +Properties -http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/ +Click on the General +tab - -Note, that *all* the Foomatic drivers listed on Linuxprinting.org (now -approaching the "all-time high" number of 1.000 for the supported models) -are using a special filtering chain involving Ghostscript, as described -in this document. - +Click on the button Printing +Preferences... - -Summary - You need: +A new dialog opens. Keep this dialog open and go back +to the parent dialog. + + - - - A "foomatic+something" PPD is not enough to print with CUPS (but it is *one* important component) - The "cupsomatic" filter script (Perl) in /usr/lib/cups/filters/ - Perl to make cupsomatic run - Ghostscript (because it is called and controlled by the PPD/cupsomatic combo in a way to fit your printermodel/driver combo. - Ghostscript *must*, depending on the driver/model, contain support for a certain "device" (as shown by "gs -h") - - +The third, the "correct" way: (should you do +this from the beginning, just carry out steps 1. and 2. from second +"way" above) - -In the case of the "hpijs" driver, you need a Ghostscript version, which -has "ijs" amongst its supported devices in "gs -h". In the case of -"hpijs+foomatic", a valid ghostscript commandline would be reading like this: - + +Click on the Advanced +tab. (Hmmm... if everything is "Grayed Out", then you are not logged +in as a user with enough privileges). - - gs -q -dBATCH -dPARANOIDSAFER -dQUIET -dNOPAUSE -sDEVICE=ijs \ - -sIjsServer=hpijsPageSize -dDuplex=Duplex Model \ - -rResolution,PS:MediaPosition=InputSlot -dIjsUseOutputFD \ - -sOutputFile=- - - +Click on the Printing +Defaults... button. - -Note, that with CUPS and the "hpijs+foomatic" PPD (plus Perl and cupsomatic) -you don't need to remember this. You can choose the available print options -thru a GUI print command (like "glp" from ESP's commercially supported -PrintPro software, or KDE's "kprinter", or GNOME's "gtklp" or the independent -"xpp") or the CUPS web interface via human-readable drop-down selection -menus. - +On any of the two new tabs, click on the +Advanced... +button. - -If you use "ESP Ghostscript" (also under the GPL, provided by Easy Software -Products, the makers of CUPS, downloadable from -http://www.cups.org/software.html, -co-maintained by the developers of linuxprinting.org), you are guaranteed to -have in use the most uptodate, bug-fixed, enhanced and stable version of a Free -Ghostscript. It contains support for ~300 devices, whereas plain vanilla -GNU Ghostscript 7.05 only has ~200. +A new dialog opens. Compare this one to the other, +identical looking one from "B.5" or A.3". + + + -If you print only one CUPS test page, from the web interface and when you try to -print a windows test page, it acts like the job was never sent: - - - Can you print "standard" jobs from the CUPS machine? - Are the jobs from Windows visible in the Web interface on CUPS (http://localhost:631/)? - Most important: What kind of printer driver are you using on the Windows clients? - - -You can try to get a more detailed debugging info by setting "LogLevel debug" in -/etc/cups/cupsd.conf, re-start cupsd and investigate /var/log/cups/error_log -for the whereabouts of your Windows-originating printjobs: - - - - what does the "auto-typing" line say? which is the "MIME type" CUPS thinks is arriving from the Windows clients? - are there "filter" available for this MIME type? - are there "filter rules" defined in "/etc/cups/mime.convs" for this MIME type? - - +Do you see any difference? I don't either... However, only the last +one, which you arrived at with steps "C.1.-6." will save any settings +permanently and be the defaults for new users. If you want all clients +to get the same defaults, you need to conduct these steps as +Administrator (printer admin in +smb.conf) before a client +downloads the driver (the clients can later set their own +per-user defaults by following the +procedures A. or B. +above). + +What are the most common blunders in driver +settings on Windows clients? +Don't use Optimize for +Speed: use Optimize for +Portability instead (Adobe PS Driver) Don't use +Page Independence: No: always +settle with Page Independence: +Yes (Microsoft PS Driver and CUPS PS Driver for +WinNT/2K/XP) If there are problems with fonts: use +Download as Softfont into +printer (Adobe PS Driver). For +TrueType Download Options +choose Outline. Use PostScript +Level 2, if you are having trouble with a non-PS printer, and if +there is a choice. + +I can't make cupsaddsmb work +with newly installed printer +Symptom: the last command of +cupsaddsmb doesn't complete successfully: +cmd = setdriver printername printername result was +NT_STATUS_UNSUCCESSFUL then possibly the printer was not yet +"recognized" by Samba. Did it show up in Network +Neighbourhood? Did it show up in rpcclient +hostname -c 'enumprinters'? Restart smbd (or send a +kill -HUP to all processes listed by +smbstatus and try +again. + +My permissions on +/var/spool/samba/ get reset after each +reboot +Have you by accident set the CUPS spool directory to +the same location? (RequestRoot +/var/spool/samba/ in cupsd.conf or +the other way round: /var/spool/cups/ is set as +path in the [printers] +section). These must be different. Set +RequestRoot /var/spool/cups/ in +cupsd.conf and path = +/var/spool/samba in the [printers] +section of smb.conf. Otherwise cupsd will +sanitize permissions to its spool directory with each restart, and +printing will not work reliably. + +My printers work fine: just the printer named "lp" +intermittently swallows jobs and spits out completely different +ones +It is a very bad idea to name any printer "lp". This +is the traditional Unix name for the default printer. CUPS may be set +up to do an automatic creation of "Implicit Classes". This means, to +group all printers with the same name to a pool of devices, and +loadbalancing the jobs across them in a round-robin fashion. Chances +are high that someone else has an "lp" named printer too. You may +receive his jobs and send your own to his device unwittingly. To have +tight control over the printer names, set BrowseShortNames +No. It will present any printer as "printername@cupshost" +then, giving you a better control over what may happen in a large +networked environment. + +How do I "watch" my Samba server? +You can use tail -f +/var/log/samba/log.smbd (you may need a different path) to +see a live scrolling of all log messages. smbcontrol smbd +debuglevel tells you which verbosity goes into the +logs. smbcontrol smbd debug 3 sets the verbosity to +a quite high level (you can choose from 0 to 10 or 100). This works +"on the fly", without the need to restart the smbd daemon. Don't use +more than 3 initially; or you'll drown in an ocean of +messages. + +I can't use Samba from my WinXP Home box, while +access from WinXP Prof works flawlessly +You have our condolences! WinXP home has been +completely neutered by Microsoft as compared to WinXP Prof: you can +not log into a WinNT domain. It cannot join a Win NT domain as a +member server. While it is possible to access domain resources, users +don't have "single sign-on". They need to supply username and password +each time they connect to a resource. Logon scripts and roaming +profiles are not supported. It can serve file and print shares; but +only in "share-mode security" level. It can not use "user-mode +security" (what Windows 95/98/ME still can +do). + +Where do I find the Adobe PostScript driver files +I need for "cupsaddsmb"? +Use smbclient to connect to any +Windows box with a shared PostScript printer: smbclient +//windowsbox/print\$ -U guest. You can navigate to the +W32X86/2 subdir to mget ADOBE* +and other files or to WIN40/0 to do the same. -- +Another option is to download the *.exe packaged +files from the Adobe website. + - - - - -Limiting the number of pages users can print - - -The feature you want is dependent on the real print subsystem you're using. -Samba's part is always to receive the job files from the clients (filtered -*or* unfiltered) and hand it over to this printing subsystem. - - - -Of course one could "hack" things with one's own scripts. - - - -But there is CUPS (Common Unix Printing System). CUPS supports "quotas". -Quotas can be based on sizes of jobs or on the number of pages or both, -and are spanning any time period you want. - - - -This is an example command how root would set a print quota in CUPS, -assuming an existing printer named "quotaprinter": - - - - lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 \ - -o job-page-limit=100 - - - -This would limit every single user to print 100 pages or 1024 KB of -data (whichever comes first) within the last 604.800 seconds ( = 1 week). - - - -For CUPS to count correctly, the printfile needs to pass the CUPS "pstops" filter, -otherwise it uses a "dummy" count of "1". Some printfiles don't pass it -(eg: image files) but then those are mostly 1 page jobs anyway. This also means, -proprietary drivers for the target printer running on the client computers and -CUPS/Samba then spooling these files as "raw" (i.e. leaving them untouched, not -filtering them), will be counted as "1-pagers" too! - - - -You need to send PostScript from the clients (i.e. run a PostScript driver there) -for having the chance to get accounting done. If the printer is a non-PostScript model, -you need to let CUPS do the job to convert the file to a print-ready format for the -target printer. This will be working for currently ~1.000 different printer models, see - - - - http://www.linuxprinting.org/printer_list.cgi - - - -Before CUPS-1.1.16 your only option was to use the Adobe PostScript -Driver on the Windows clients. The output of this driver was not always -passed thru the "pstops" filter on the CUPS/Samba side, and therefor was -not counted correctly (the reason is that it often --- depending on the -"PPD" being used --- did write a "PJL"-header in front of the real -PostScript which made CUPS to skip the pstops and go directy to -the "pstoraster" stage). - - - -From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver -for Windows NT/2K/XP clients" (it is tagged in the download area of -http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). -It is *not* working for Win9x/ME clients. But it: - - - - it guarantees to not write an PJL-header - it guarantees to still read and support all PJL-options named in the driver PPD with its own means - it guarantees the file going thru the "pstops" filter on the CUPS/Samba server - it guarantees to page-count correctly the printfile - - - -You can read more about the setup of this combination in the -manpage for "cupsaddsmb" (only present with CUPS installed, only -current with CUPS 1.1.16). - - - -These are the items CUPS logs in the "page_log" for every single *page* of a job: - - - -Printer name -User name -Job ID -Time of printing -the page number -the number of copies -a billing info string (optional) - - - - -Here is an extract of my CUPS server's page_log file to illustrate -the format and included items: - - - - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 1 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 2 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 3 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 4 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 5 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 6 2 #marketing - - - -This was Job ID "40", printed on "infotec_IS2027" by user "kurt", a 6-page job -printed in 2 copies and billed to "#marketing"... - - - -What flaws or shortcomings are there? - - - - the ones named above - - - CUPS really counts the job pages being *processsed in software* - (going thru the "RIP") rather than the physical sheets successfully - leaving the printing device -- if there is a jam while printing - the 5th sheet out of 1000 and the job is aborted by the printer, - the "page count" will still show the figure of 1000 for that job - - - - all quotas are the same for all users (no flexibility to give the - boss a higher quota than the clerk) no support for groups - - - - no means to read out the current balance or "used-up" number of current quota - - - - a user having used up 99 sheets of 100 quota will still be able to send and print a 1.000 sheet job - - - - a user being denied a job because of a filled-up quota doesn't get a meaningful - error message from CUPS other than "client-error-not-possible". - - - - -But this is the best system out there currently. And there are -huge improvements under development: - - - - page counting will go into the "backends" (these talk - directly to the printer and will increase the count in sync with the - actual printing process -- a jam at the 5th sheet will lead to a stop in the counting) - - quotas will be handled more flexibly - - probably there will be support for users to inquire their "accounts" in advance - - probably there will be support for some other tools around this topic - - - -Other than the current stage of the CUPS development, I don't -know any other ready-to-use tool which you could consider. - - - -You can download the driver files from -http://www.cups.org/software.html. -It is a separate package from the CUPS base software files, tagged as "CUPS 1.1.16 -Windows NT/2k/XP Printer Driver for SAMBA (tar.gz, 192k)". The filename to -download is "cups-samba-1.1.16.tar.gz". Upon untar-/unzip-ping it will reveal -the files: - - - - - cups-samba.install - cups-samba.license - cups-samba.readme - cups-samba.remove - cups-samba.ss - - - - -These have been packaged with the ESP meta packager software "EPM". The -*.install and *.remove files are simple shell script, which untars the -*.ss (which is nothing else than a tar-archive) and puts its contents -into /usr/share/cups/drivers/. Its contents are 3 files: - - - - - cupsdrvr.dll - cupsui.dll - cups.hlp - - - - -Due to a bug one CUPS release puts the cups.hlp -into /usr/share/drivers/ instead of -/usr/share/cups/drivers/. To work around this, copy/move -the file after running the "./cups-samba.install" script manually to the right place: - - - - cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/ - - - - - -This new CUPS PostScript driver is currently binary-only, but free -no source code is provided (yet). The reason is this: it has -been developed with the help of the Microsoft Driver Developer Kit (DDK) -and compiled with Microsoft Visual Studio 6. It is not clear to the driver -developers if they are allowed to distribute the whole of the source code -as Free Software. However, they will likely release the "diff" in source -code under the GPL, so anybody with a license of Visual Studio and a DDK -will be able to compile for him/herself. - - - -Once you have run the install script (and possibly manually moved the -"cups.hlp" file to "/usr/share/cups/drivers/"), the driver is ready to be -put into Samba's [print$] share (which often maps to "/etc/samba/drivers/" -and contains a subdir tree with WIN40 and W32X86 branches), by running -"cupsaddsmb" (see also "man cupsaddsmb" for CUPS 1.1.16). [Don't forget to -put root into the smbpasswd file by running "smbpasswd" should you run -this whole procedure for the first time.] Once the driver files are in the -[print$] share, they are ready to be downloaded and installed by the -Win NT/2k/XP clients. - - - - - Win 9x/ME clients won't work with this driver. For these you'd - still need to use the ADOBE*.* drivers as previously. - - - - It is not harming if you've still the ADOBE*.* driver files from - previous installations in the "/usr/share/cups/drivers/" directory. - The new cupsaddsmb (from 1.1.16) will automatically use the - "newest" installed driver (which here then is the CUPS drivers). - - - - Should your Win clients have had the old ADOBE*.* files and the - Adobe PostScript drivers installed, the download and installation - of the new CUPS PostScript driver for Windows NT/2k/XP will fail - at first. - - - It is not enough to "delete" the printer (as the driver files - will still be kept by the clients and re-used if you try to - re-install the printer). To really get rid of the Adobe driver - files on the clients, open the "Printers" folder (possibly via - "Start --> Settings --> Control Panel --> Printers"), right-click - onto the folder background and select "Server Properties". A - new dialog opens; select the "Drivers" tab; on the list select - the driver you want to delete and click on the "Delete" button. - (This will only work if there is no single printer left which - uses that particular driver -- you need to "delete" all printers - using this driver in the "Printers" folder first.) - - - - - Once you have successfully downloaded the CUPS PostScript driver - to a client, you can easily switch all printers to this one - by proceeding as described elsewhere in the "Samba HOWTO - Collection" to change a driver for an existing printer. - - - -What are the benefits with the "CUPS PostScript driver for Windows NT/2k/XP" -as compared to the Adobe drivers? - - - - - - no hassle with the Adobe EULA - - - - no hassle with the question "where do I get the ADOBE*.* driver files from?" - - - - the Adobe drivers (depending on the printer PPD associated with them) - often put a PJL header in front of the core PostScript part of the print - file (thus the file starts with "1B%-12345X" - or "escape%-12345X" - instead of "%!PS"). This leads to the CUPS daemon autotyping the - arriving file as a print-ready file, not requiring a pass thru the - "pstops" filter (to speak more technical, it is not regarded as the - generic MIME type "application/postscript", but as the more special - MIME type "application/cups.vnd-postscript"), which therefore also - leads to the page accounting in "/var/log/cups/page_log" not receiving - the exact mumber of pages; instead the dummy page number of "1" is - logged in a standard setup) - - - - the Adobe driver has more options to "mis-configure" the PostScript - generated by it (like setting it inadvertedly to "Optimize for Speed", - instead of "Optimize for Portability", which could lead to CUPS being - unable to process it) - - - - the CUPS PostScript driver output sent by Windows clients to the CUPS - server will be guaranteed to be auto-typed as generic MIME type - "application/postscript", thusly passing thru the CUPS "pstops" filter - and logging the correct number of pages in the page_log for accounting - and quota purposes - - - - the CUPS PostScript driver supports the sending of additional print - options by the Win NT/2k/XP clients, such as naming the CUPS standard - banner pages (or the custom ones, should they be installed at the time - of driver download), using the CUPS "page-label" option, setting a - job-priority and setting the scheduled time of printing (with the option - to support additional useful IPP job attributes in the future). - - - - the CUPS PostScript driver supports the inclusion of the new - "*cupsJobTicket" comments at the beginnig of the PostScript file (which - could be used in the future for all sort of beneficial extensions on - the CUPS side, but which will not disturb any other application as those - will regard it as a comment and simply ignore it). - - - - the CUPS PostScript driver will be the heart of the fully fledged CUPS - IPP client for Windows NT/2k/XP to be released soon (probably alongside - the first Beta release for CUPS 1.2). - - - - - - - -Advanced Postscript Printing from MS Windows - - -Let the Windows Clients use a PostScript driver to deliver poistscript to -the samba print server (just like any Linux or Unix Client would also use -PostScript to send to the server) - - - -Make the Unix printing subsystem to which Samba sends the job convert the -incoming PostScript files to the native print format of the target printers -(would be PCL if you have an HP printer) - - - -Now if you are afraid that this would just mean using a *Generic* PostScript -driver for the clients that has no Simplex/Duplex selection, and no paper tray -choice, but you need them to be able to set up print jobs, with all the bells -and whistles of your printers:- - - - - Not possible with traditional spooling systems - - - But perfectly supported by CUPS (which uses "PPD" files to - describe how to control the print options for PostScript and - non-PostScript devices alike... - - - - -CUPS PPDs are working perfectly on Windows clients who use Adobe PostScript -drivers (or the new CUPS PostScript driver for Windows NT/2K/XP). Clients can use -them to setup the job to their liking and CUPS will use the received job options -to make the (PCL-, ESC/P- or PostScript-) printer behave as required. - - - -If you want to have the additional benefit of page count logging and accounting -then the CUPS PostScript driver is the best choice (better than the Adobe one). - - - -If you want to make the drivers downloadable for the clients then "cupsaddsmb" is -your friend. It will setup the [print$] share on the Samba host to be ready to serve -the clients for a "point and print" driver installation. - - - -What strings are attached? - - -There are some. But, given the sheer CPU power you can buy nowadays, -these can be overcome easily. The strings: - + +An Overview of the CUPS Printing Processes -Well, if the CUPS/Samba side will have to print to many printers serving many users, -you probably will need to set up a second server (which can do automatic load balancing -with the first one, plus a degree of fail-over mechanism). Converting the incoming -PostScript jobs, "interpreting" them for non-PostScript printers, amounts to the work -of a "RIP" (Raster Image Processor) done in software. This requires more CPU and RAM -than for the mere "raw spooling" task your current setup is solving. It all depends -on the avarage and peak printing load the server should be able to handle. +
CUPS Printing Overview + + + + +
 - + - -Auto-Deletion of CUPS spool files - - -Samba print files pass thru two "spool" directories. One the incoming directory -managed by Samba, (set eg: in the path = /var/spool/samba directive in the [printers] -section of &smb.conf;). Second is the spool directory of your UNIX print subsystem. -For CUPS it is normally "/var/spool/cups/", as set by the cupsd.conf directive -"RequestRoot /var/spool/cups". - - - -I am not sure, which one of your directories keeps the files. From what you say, -it is most likely the Samba part. - - - -For the CUPS part, you may want to consult: - - - -http://localhost:631/sam.html#PreserveJobFiles -http://localhost:631/sam.html#PreserveJobHistory -http://localhost:631/sam.html#MaxJobs - - - -There are the settings described for your CUPS daemon, which could lead to completed -job files not being deleted. - - - -"PreserveJobHistory Yes" -- keeps some details of jobs in -cupsd's mind (well it keeps the "c12345", "c12346" etc. files -in the CUPS spool directory, which do a similar job as the -old-fashioned BSD-LPD control files). This is set to "Yes" -as a default. - - - -"PreserveJobFiles Yes" -- keeps the job files themselves in -cupsd's mind (well it keeps the "d12345", "d12346" etc. files -in the CUPS spool directory...). This is set to "No" as the -CUPS default. - - - -"MaxJobs 500" -- this directive controls the maximum number -of jobs that are kept in memory. Once the number of jobs -reaches the limit, the oldest completed job is automatically -purged from the system to make room for the new one. If all -of the known jobs are still pending or active then the new -job will be rejected. Setting the maximum to 0 disables this -functionality. The default setting is 0. - - - -(There are also additional settings for "MaxJobsPerUser" and -"MaxJobsPerPrinter"...) - - - -For everything to work as announced, you need to have three things: - - - - - - a Samba-&smbd; which is compiled against "libcups" (Check on Linux by running ldd `which smbd`) - - - - a Samba-&smb.conf; setting of printing = cups - - - - another Samba-&smb.conf; setting of printcap = cups - - - - - -Note, that in this case all other manually set printing-related -commands (like "print command", "lpq command", "lprm command", -"lppause command" or "lpresume command") are ignored and they -should normally have no influence what-so-ever on your printing. - - - -If you want to do things manually, replace the "printing = cups" -by "printing = bsd". Then your manually set commands may work -(haven't tested this), and a "print command = lp -d %P %s; rm %s" -may do what you need. - - - -You forgot to mention the CUPS version you're using. If you did -set things up as described in the man pages, then the Samba -spool files should be deleted. Otherwise it may be a bug. On -the CUPS side, you can control the behaviour as described -above. - - - -If you have more problems, post the output of these commands: - - - - - grep -v ^# /etc/cups/cupsd.conf | grep -v ^$ - grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;" - - - - -(adapt paths as needed). These commands sanitize the files -and cut out the empty lines and lines with comments, providing -the "naked settings" in a compact way. - - diff --git a/docs/docbook/projdoc/Compiling.xml b/docs/docbook/projdoc/Compiling.xml index 9638663dde..279be2fdb4 100644 --- a/docs/docbook/projdoc/Compiling.xml +++ b/docs/docbook/projdoc/Compiling.xml @@ -1,20 +1,17 @@ - - - Samba Team - - &author.jelmer; + Someone; Jerry perhaps? - (22 May 2001) + 22 May 2001 18 March 2003 How to compile SAMBA -You can obtain the samba source from the samba website. To obtain a development version, +You can obtain the samba source from the +samba website. To obtain a development version, you can download samba from CVS or using rsync. @@ -45,8 +42,8 @@ This chapter is a modified version of the instructions found at The machine samba.org runs a publicly accessible CVS repository for access to the source code of several packages, -including samba, rsync and jitterbug. There are two main ways of -accessing the CVS server on this host. +including samba, rsync, distcc, ccache and jitterbug. There are two main ways +of accessing the CVS server on this host. @@ -80,11 +77,12 @@ just a casual browser. To download the latest cvs source code, point your -browser at the URL : http://www.cyclic.com/. +browser at the URL : +http://www.cyclic.com/. and click on the 'How to get cvs' link. CVS is free software under the GNU GPL (as is Samba). Note that there are several graphical CVS clients which provide a graphical interface to the sometimes mundane CVS commands. -Links to theses clients are also available from http://www.cyclic.com. +Links to theses clients are also available from the Cyclic website. @@ -94,16 +92,17 @@ samba source code. For the other source code repositories on this system just substitute the correct package name - - + + Retrieving samba using CVS + + Install a recent copy of cvs. All you really need is a copy of the cvs client binary. - - + - + Run the command @@ -111,14 +110,16 @@ on this system just substitute the correct package name cvs -d :pserver:cvs@samba.org:/cvsroot login + + + When it asks you for a password type cvs. - + - - + Run the command @@ -134,18 +135,19 @@ on this system just substitute the correct package name - CVS branches other then HEAD can be obtained by using the -r - and defining a tag name. A list of branch tag names can be found on the - "Development" page of the samba web site. A common request is to obtain the - latest 2.2 release code. This could be done by using the following userinput. + CVS branches other then HEAD can be obtained by using the + and defining a tag name. A list of branch tag names + can be found on the "Development" page of the samba web site. A common + request is to obtain the latest 3.0 release code. This could be done by + using the following command: - cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_2_2 samba + cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_3_0 samba - + - + Whenever you want to merge in the latest code changes use the following command from within the samba directory: @@ -154,8 +156,8 @@ on this system just substitute the correct package name cvs update -d -P - - + + @@ -166,16 +168,16 @@ on this system just substitute the correct package name Accessing the samba sources via rsync and ftp - pserver.samba.org also exports unpacked copies of most parts of the CVS tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. + pserver.samba.org also exports unpacked copies of most parts of the CVS + tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at + rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. See the rsync homepage for more info on rsync. - The disadvantage of the unpacked trees - is that they do not support automatic - merging of local changes like CVS does. - rsync access is most convenient for an - initial install. + The disadvantage of the unpacked trees is that they do not support automatic + merging of local changes like CVS does. rsync access is most convenient + for an initial install. @@ -183,11 +185,10 @@ on this system just substitute the correct package name Verifying Samba's PGP signature -In these days of insecurity, it's strongly recommended that you verify the PGP signature for any -source file before installing it. According to Jerry Carter of the Samba Team, only about 22% of -all Samba downloads have had a corresponding PGP signature download (a very low percentage, which -should be considered a bad thing). Even if you're not downloading from a mirror site, verifying PGP -signatures should be a standard reflex. +In these days of insecurity, it's strongly recommended that you verify the PGP +signature for any source file before installing it. Even if you're not +downloading from a mirror site, verifying PGP signatures should be a +standard reflex. @@ -195,38 +196,39 @@ signatures should be a standard reflex. With that said, go ahead and download the following files: - - $ wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc - $ wget http://us1.samba.org/samba/ftp/samba-pubkey.asc - + +$ wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc +$ wget http://us1.samba.org/samba/ftp/samba-pubkey.asc + The first file is the PGP signature for the Samba source file; the other is the Samba public PGP key itself. Import the public PGP key with: - - $ gpg --import samba-pubkey.asc - + + $ gpg --import samba-pubkey.asc + And verify the Samba source code integrity with: - - $ gzip -d samba-2.2.8a.tar.gz - $ gpg --verify samba-2.2.8a.tar.asc - + + $ gzip -d samba-2.2.8a.tar.gz + $ gpg --verify samba-2.2.8a.tar.asc + -If you receive a message like, "Good signature from Samba Distribution Verification Key..." -then all is well. The warnings about trust relationships can be ignored. An example of what -you would not want to see would be: +If you receive a message like, "Good signature from Samba Distribution +Verification Key..." +then all is well. The warnings about trust relationships can be ignored. An +example of what you would not want to see would be: - + gpg: BAD signature from "Samba Distribution Verification Key" - + @@ -238,28 +240,28 @@ you would not want to see would be: configure Samba for your operating system. If you have unusual needs then you may wish to run - root# ./configure --help + &rootprompt;./configure --help first to see what special options you can enable. Then executing - root# make + &rootprompt;make will create the binaries. Once it's successfully compiled you can use - root# make install + &rootprompt;make install to install the binaries and manual pages. You can separately install the binaries and/or man pages using - root# make installbin + &rootprompt;make installbin and - root# make installman + &rootprompt;make installman Note that if you are upgrading for a previous version @@ -267,7 +269,7 @@ you would not want to see would be: the binaries will be renamed with a ".old" extension. You can go back to the previous version with - root# make revert + &rootprompt;make revert if you find this version a disaster! @@ -281,35 +283,38 @@ you would not want to see would be: the MIT kerberos development libraries (either install from the sources or use a package). The - heimdal libraries will not work. + Heimdal libraries will not work. the OpenLDAP development libraries. If your kerberos libraries are in a non-standard location then - remember to add the configure option --with-krb5=DIR. + remember to add the configure option + . - After you run configure make sure that include/config.h it generates contains lines like this: + After you run configure make sure that + include/config.h it generates contains lines like + this: - + #define HAVE_KRB5 1 #define HAVE_LDAP 1 - If it doesn't then configure did not find your krb5 libraries or - your ldap libraries. Look in config.log to figure out why and fix - it. + If it doesn't then configure did not find your krb5 libraries or + your ldap libraries. Look in config.log to figure + out why and fix it. Installing the required packages for Debian On Debian you need to install the following packages: - - libkrb5-dev - krb5-user - + + libkrb5-dev + krb5-user + @@ -318,11 +323,11 @@ you would not want to see would be: On RedHat this means you should have at least: - - krb5-workstation (for kinit) - krb5-libs (for linking with) - krb5-devel (because you are compiling from source) - + + krb5-workstation (for kinit) + krb5-libs (for linking with) + krb5-devel (because you are compiling from source) + in addition to the standard development environment. @@ -337,10 +342,10 @@ you would not want to see would be: - Starting the smbd and nmbd + Starting the &smbd; and &nmbd; - You must choose to start smbd and nmbd either - as daemons or from inetdDon't try + You must choose to start &smbd; and &nmbd; either + as daemons or from inetd. Don't try to do both! Either you can put them in inetd.conf and have them started on demand by inetd, or you can start them as @@ -350,26 +355,28 @@ you would not want to see would be: the bit about what user you need to be in order to start Samba. In many cases you must be root. - The main advantage of starting smbd - and nmbd using the recommended daemon method + The main advantage of starting &smbd; + and &nmbd; using the recommended daemon method is that they will respond slightly more quickly to an initial connection request. Starting from inetd.conf - NOTE; The following will be different if + + The following will be different if you use NIS, NIS+ or LDAP to distribute services maps. + Look at your /etc/services. What is defined at port 139/tcp. If nothing is defined then add a line like this: - netbios-ssn 139/tcp + netbios-ssn 139/tcp similarly for 137/udp you should have an entry like: - netbios-ns 137/udp + netbios-ns 137/udp Next edit your /etc/inetd.conf and add two lines something like this: @@ -386,11 +393,13 @@ you would not want to see would be: Some unixes already have entries like netbios_ns (note the underscore) in /etc/services. You must either edit /etc/services or - /etc/inetd.conf to make them consistent. + /etc/inetd.conf to make them consistent. + On many systems you may need to use the - interfaces option in &smb.conf; to specify the IP address - and netmask of your interfaces. Run ifconfig + interfaces option in &smb.conf; to specify the IP + address and netmask of your interfaces. Run + ifconfig as root if you don't know what the broadcast is for your net. &nmbd; tries to determine it at run time, but fails on some unixes. @@ -402,9 +411,9 @@ you would not want to see would be: arguments, or you should use a script, and start the script from inetd. - Restart inetd, perhaps just send - it a HUP. If you have installed an earlier version of - nmbd then you may need to kill nmbd as well. + Restart inetd, perhaps just send + it a HUP. If you have installed an earlier version of &nmbd; then + you may need to kill &nmbd; as well. @@ -428,11 +437,29 @@ you would not want to see would be: To kill it send a kill signal to the processes - nmbd and smbd. + &nmbd; and &smbd;. If you use the SVR4 style init system then you may like to look at the examples/svr4-startup script to make Samba fit into that system. + + +Common Errors + + +I'm using gcc 3 and I've compiled Samba-3 from the CVS and the +binaries are very large files (40 Mb and 20 Mb). I've the same result with + ? + + + + +The dwarf format used by GCC 3 for storing debugging symbols is very inefficient. +Strip the binaries, don't compile with -g or compile with -gstabs. + + + + diff --git a/docs/docbook/projdoc/DOMAIN_MEMBER.xml b/docs/docbook/projdoc/DOMAIN_MEMBER.xml index ecb8a3afb3..0af934faab 100644 --- a/docs/docbook/projdoc/DOMAIN_MEMBER.xml +++ b/docs/docbook/projdoc/DOMAIN_MEMBER.xml @@ -4,40 +4,48 @@ &author.jht; &author.jeremy; &author.jerry; + + + &author.tridge; + &author.jelmer; Domain Membership -Domain Membership is a subject of vital concern, Samba must be able to participate -as a member server in a Microsoft Domain security context, and Samba must be capable of -providing Domain machine member trust accounts, otherwise it would not be capable of offering -a viable option for many users. +Domain Membership is a subject of vital concern, Samba must be able to +participate as a member server in a Microsoft Domain security context, and +Samba must be capable of providing Domain machine member trust accounts, +otherwise it would not be capable of offering a viable option for many users. -This chapter covers background information pertaining to domain membership, Samba -configuration for it, and MS Windows client procedures for joining a domain. Why is -this necessary? Because both are areas in which there exists within the current MS -Windows networking world and particularly in the Unix/Linux networking and administration -world, a considerable level of mis-information, incorrect understanding, and a lack of -knowledge. Hopefully this chapter will fill the voids. +This chapter covers background information pertaining to domain membership, +Samba configuration for it, and MS Windows client procedures for joining a +domain. Why is this necessary? Because both are areas in which there exists +within the current MS Windows networking world and particularly in the +Unix/Linux networking and administration world, a considerable level of +mis-information, incorrect understanding, and a lack of knowledge. Hopefully +this chapter will fill the voids. Features and Benefits -MS Windows workstations and servers that want to participate in domain security need to +MS Windows workstations and servers that want to participate in domain +security need to be made Domain members. Participating in Domain security is often called -Single Sign On or SSO for short. This chapter describes the process -that must be followed to make a workstation (or another server - be it an MS Windows NT4 / 200x +Single Sign On or SSO for short. This +chapter describes the process that must be followed to make a workstation +(or another server - be it an MS Windows NT4 / 200x server) or a Samba server a member of an MS Windows Domain security context. -Samba-3 can join an MS Windows NT4 style domain as a native member server, an MS Windows -Active Directory Domain as a native member server, or a Samba Domain Control network. +Samba-3 can join an MS Windows NT4 style domain as a native member server, an +MS Windows Active Directory Domain as a native member server, or a Samba Domain +Control network. @@ -50,31 +58,34 @@ Domain membership has many advantages: - Domain user access rights and file ownership / access controls can be set from - the single Domain SAM (Security Accounts Management) database (works with Domain member - servers as well as with MS Windows workstations that are domain members) + Domain user access rights and file ownership / access controls can be set + from the single Domain SAM (Security Account Manager) database + (works with Domain member servers as well as with MS Windows workstations + that are domain members) - Only MS Windows NT4 / 200x / XP Professional workstations that are Domain members + Only MS Windows NT4 / 200x / XP Professional + workstations that are Domain members can use network logon facilities - Domain Member workstations can be better controlled through the use of Policy files - (NTConfig.POL) and Desktop Profiles. + Domain Member workstations can be better controlled through the use of + Policy files (NTConfig.POL) and Desktop Profiles. - Through the use of logon scripts users can be given transparent access to network + Through the use of logon scripts, users can be given transparent access to network applications that run off application servers - Network administrators gain better application and user access management abilities - because there is no need to maintain user accounts on any network client or server, - other than the central Domain database (either NT4/Samba SAM style Domain, NT4 Domain - that is back ended with an LDAP directory, or via an Active Directory infrastructure) + Network administrators gain better application and user access management + abilities because there is no need to maintain user accounts on any network + client or server, other than the central Domain database + (either NT4/Samba SAM style Domain, NT4 Domain that is back ended with an + LDAP directory, or via an Active Directory infrastructure) @@ -84,7 +95,8 @@ Domain membership has many advantages: MS Windows Workstation/Server Machine Trust Accounts -A machine trust account is an account that is used to authenticate a client machine +A machine trust account is an account that is used to authenticate a client +machine (rather than a user) to the Domain Controller server. In Windows terminology, this is known as a "Computer Account." @@ -113,10 +125,10 @@ as follows: - A Domain Security Account (stored in the passdb backend - that has been configured in the &smb.conf; file. The precise nature of the - account information that is stored depends on the type of backend database - that has been chosen. + A Domain Security Account (stored in the + passdb backend that has been configured in the + &smb.conf; file. The precise nature of the account information that is + stored depends on the type of backend database that has been chosen. @@ -127,15 +139,17 @@ as follows: - The two newer database types are called ldapsam, tdbsam. - Both store considerably more data than the older smbpasswd - file did. The extra information enables new user account controls to be used. + The two newer database types are called ldapsam, + tdbsam. Both store considerably more data than the + older smbpasswd file did. The extra information + enables new user account controls to be used. - A corresponding Unix account, typically stored in /etc/passwd. - Work is in progress to allow a simplified mode of operation that does not require - Unix user accounts, but this may not be a feature of the early releases of Samba-3. + A corresponding Unix account, typically stored in + /etc/passwd. Work is in progress to allow a + simplified mode of operation that does not require Unix user accounts, but + this may not be a feature of the early releases of Samba-3. @@ -146,20 +160,22 @@ There are three ways to create machine trust accounts: - Manual creation from the Unix/Linux command line. Here, both the Samba and corresponding - Unix account are created by hand. + Manual creation from the Unix/Linux command line. Here, both the Samba and + corresponding Unix account are created by hand. - Using the MS Windows NT4 Server Manager (either from an NT4 Domain member server, or using - the Nexus toolkit available from the Microsoft web site. This tool can be run from any - MS Windows machine so long as the user is logged on as the administrator account. + Using the MS Windows NT4 Server Manager (either from an NT4 Domain member + server, or using the Nexus toolkit available from the Microsoft web site. + This tool can be run from any MS Windows machine so long as the user is + logged on as the administrator account. - "On-the-fly" creation. The Samba machine trust account is automatically created by - Samba at the time the client is joined to the domain. (For security, this is the - recommended method.) The corresponding Unix account may be created automatically or manually. + "On-the-fly" creation. The Samba machine trust account is automatically + created by Samba at the time the client is joined to the domain. + (For security, this is the recommended method.) The corresponding Unix + account may be created automatically or manually. @@ -167,26 +183,26 @@ There are three ways to create machine trust accounts: Manual Creation of Machine Trust Accounts -The first step in manually creating a machine trust account is to manually create the -corresponding Unix account in /etc/passwd. This can be done using -vipw or other 'add user' command that is normally used to create new -Unix accounts. The following is an example for a Linux based Samba server: +The first step in manually creating a machine trust account is to manually +create the corresponding Unix account in /etc/passwd. +This can be done using vipw or another 'add user' command +that is normally used to create new Unix accounts. The following is an example for a Linux based Samba server: -root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" -s /bin/false machine_name$ +&rootprompt;/usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" -s /bin/false machine_name$ -root# passwd -l machine_name$ +&rootprompt;passwd -l machine_name$ -On *BSD systems, this can be done using the 'chpass' utility: +On *BSD systems, this can be done using the chpass utility: -root# chpass -a "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin" +&rootprompt;chpass -a "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin" @@ -196,9 +212,9 @@ home directory. For example a machine named 'doppy' would have an /etc/passwd entry like this: - + doppy$:x:505:501:machine_nickname:/dev/null:/bin/false - + Above, machine_nickname can be any @@ -218,9 +234,9 @@ as shown here: - -root# smbpasswd -a -m machine_name - + +&rootprompt;smbpasswd -a -m machine_name + @@ -235,11 +251,11 @@ the corresponding Unix account. Manually creating a machine trust account using this method is the equivalent of creating a machine trust account on a Windows NT PDC using - the "Server Manager". From the time at which the account is created - to the time which the client joins the domain and changes the password, - your domain is vulnerable to an intruder joining your domain using - a machine with the same NetBIOS name. A PDC inherently trusts - members of the domain and will serve out a large degree of user + the Server Manager. From the time at which the + account is created to the time which the client joins the domain and + changes the password, your domain is vulnerable to an intruder joining + your domain using a machine with the same NetBIOS name. A PDC inherently + trusts members of the domain and will serve out a large degree of user information to such clients. You have been warned! @@ -249,16 +265,19 @@ the corresponding Unix account. Using NT4 Server Manager to Add Machine Accounts to the Domain -If the machine from which you are trying to manage the domain is an MS Windows NT4 workstation -then the tool of choice is the package called SRVTOOLS.EXE. When executed in the target directory -this will unpack SrvMge.exe and UsrMgr.exe (both are Domain Management tools for MS Windows NT4 -workstation. +If the machine from which you are trying to manage the domain is an +MS Windows NT4 workstation +then the tool of choice is the package called SRVTOOLS.EXE. +When executed in the target directory this will unpack +SrvMge.exe and UsrMgr.exe (both are +Domain Management tools for MS Windows NT4 workstation. -If your workstation is any other MS Windows product you should download the Nexus.exe package -from the Microsoft web site. When executed from the target directory this will unpack the same -tools but for use on MS Windows 9x/Me/200x/XP. +If your workstation is any other MS Windows product you should download the +Nexus.exe package from the Microsoft web site. When executed +from the target directory this will unpack the same tools but for use on +MS Windows 9x/Me/200x/XP. @@ -268,29 +287,32 @@ Launch the srvmgr.exe (Server Manager for Domains) and follow Server Manager Account Machine Account Management - From the menu select Computer + From the menu select Computer - Click on "Select Domain" + Click on Select Domain - Click on the name of the domain you wish to administer in the "Select Domain" panel - and then Click OK. + Click on the name of the domain you wish to administer in the + Select Domain panel and then click + OK. - Again from the menu select Computer + Again from the menu select Computer - Select "Add to Domain" + Select Add to Domain - In the dialog box, click on the radio button to "Add NT Workstation of Server", then - enter the machine name in the field provided, then Click the "Add" button. + In the dialog box, click on the radio button to + Add NT Workstation of Server, then + enter the machine name in the field provided, then click the + Add button. @@ -334,8 +356,8 @@ The procedure for making an MS Windows workstation of server a member of the dom with the version of Windows: - - Windows 200x XP Professional + + Windows 200x XP Professional When the user elects to make the client a domain member, Windows 200x prompts for @@ -353,9 +375,9 @@ with the version of Windows: The name of the account that is used to create domain member machine accounts can be - anything the network administrator may choose. If it is other than root + anything the network administrator may choose. If it is other than root then this is easily mapped to root using the file pointed to be the &smb.conf; parameter - username map = /etc/samba/smbusers. + username map = /etc/samba/smbusers. @@ -363,73 +385,84 @@ with the version of Windows: encryption key for setting the password of the machine trust account. The machine trust account will be created on-the-fly, or updated if it already exists. - + + - Windows NT4 + + Windows NT4 If the machine trust account was created manually, on the Identification Changes menu enter the domain name, but do not - check the box "Create a Computer Account in the Domain." In this case, - the existing machine trust account is used to join the machine to - the domain. + check the box Create a Computer Account in the Domain. + In this case, the existing machine trust account is used to join the machine + to the domain. If the machine trust account is to be created on-the-fly, on the Identification Changes menu enter the domain - name, and check the box "Create a Computer Account in the Domain." In - this case, joining the domain proceeds as above for Windows 2000 - (i.e., you must supply a Samba administrative account when + name, and check the box Create a Computer Account in the + Domain. In this case, joining the domain proceeds as above + for Windows 2000 (i.e., you must supply a Samba administrative account when prompted). - + + - Samba - Joining a samba client to a domain is documented in - the Domain Member chapter. - - + + Samba + + Joining a Samba client to a domain is documented in + the Domain Member Server section of this chapter chapter. + + - + Domain Member Server -This mode of server operation involves the samba machine being made a member -of a domain security context. This means by definition that all user authentication -will be done from a centrally defined authentication regime. The authentication -regime may come from an NT3/4 style (old domain technology) server, or it may be -provided from an Active Directory server (ADS) running on MS Windows 2000 or later. +This mode of server operation involves the Samba machine being made a member +of a domain security context. This means by definition that all user +authentication will be done from a centrally defined authentication regime. +The authentication regime may come from an NT3/4 style (old domain technology) +server, or it may be provided from an Active Directory server (ADS) running on +MS Windows 2000 or later. -Of course it should be clear that the authentication back end itself could be from any -distributed directory architecture server that is supported by Samba. This can be -LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory Server, etc. +Of course it should be clear that the authentication back end itself could be +from any distributed directory architecture server that is supported by Samba. +This can be LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory +Server, etc. -Please refer to the section on Howto configure Samba as a Primary Domain Controller -and for more information regarding how to create a domain machine account for a -domain member server as well as for information regarding how to enable the samba -domain member machine to join the domain and to be fully trusted by it. +Please refer to the Domain Control chapter +for more information regarding how to create a domain +machine account for a domain member server as well as for information +regarding how to enable the Samba domain member machine to join the domain and +to be fully trusted by it. Joining an NT4 type Domain with Samba-3 -Assumptions: - - NetBIOS name: SERV1 - Win2K/NT domain name: DOM - Domain's PDC NetBIOS name: DOMPDC - Domain's BDC NetBIOS names: DOMBDC1 and DOMBDC2 - +
Assumptions + + + NetBIOS name:SERV1 + Win2K/NT domain name:DOM + Domain's PDC NetBIOS name:DOMPDC + Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2 + + +
@@ -439,24 +472,25 @@ now use domain security. Change (or add) your -security = line in the [global] section +security line in the [global] section of your &smb.conf; to read: - security = domain +security = domain Next change the -workgroup = line in the [global] section to read: +workgroup line in the [global] +section to read: - workgroup = DOM +workgroup = DOM @@ -472,13 +506,13 @@ You must also have the parameter Finally, add (or modify) a -password server = line in the [global] +password server line in the [global] section to read: - password server = DOMPDC DOMBDC1 DOMBDC2 +password server = DOMPDC DOMBDC1 DOMBDC2 @@ -498,12 +532,12 @@ set this line to be: - password server = * +password server = * -This method, allows Samba to use exactly the same mechanism that NT does. This +This method allows Samba to use exactly the same mechanism that NT does. This method either broadcasts or uses a WINS database in order to find domain controllers to authenticate against. @@ -513,20 +547,21 @@ In order to actually join the domain, you must run this command: - - root# net join -S DOMPDC -UAdministrator%password - + +root# net join -S DOMPDC -UAdministrator%password + -If the -S DOMPDC argument is not given then -the domain name will be obtained from smb.conf. +If the argument is not given then +the domain name will be obtained from &smb.conf;. As we are joining the domain DOM and the PDC for that domain (the only machine that has write access to the domain SAM database) -is DOMPDC. The Administrator%password is +is DOMPDC, we use it for the option. +The Administrator%password is the login name and password for an account which has the necessary privilege to add machines to the domain. If this is successful you will see the message: @@ -551,7 +586,7 @@ trust account on the PDC beforehand. This command goes through the machine account password change protocol, then writes the new (random) machine account password for this Samba server into a file in the same directory -in which an smbpasswd file would be stored - normally : +in which an smbpasswd file would be stored - normally: @@ -588,8 +623,8 @@ NT server in the same way as a Windows 95 or Windows 98 server would. -Please refer to the Winbind -paper for information on a system to automatically +Please refer to the Winbind chapter +for information on a system to automatically assign UNIX uids and gids to Windows NT Domain users and groups. @@ -604,11 +639,11 @@ domain PDC to an account domain PDC). -In addition, with security = server every Samba +In addition, with security = server every Samba daemon on a server has to keep a connection open to the authenticating server for as long as that daemon lasts. This can drain the connection resources on a Microsoft NT server and cause it to run -out of available connections. With security = domain, +out of available connections. With security = domain, however, the Samba daemons connect to the PDC/BDC only for as long as is necessary to authenticate the user, and then drop the connection, thus conserving PDC connection resources. @@ -624,8 +659,8 @@ as the user SID, the list of NT groups the user belongs to, etc. Much of the text of this document -was first published in the Web magazine -LinuxWorld as the article LinuxWorld as the article Doing the NIS/NT Samba. @@ -634,19 +669,19 @@ the NIS/NT Samba. - + Samba ADS Domain Membership -This is a rough guide to setting up Samba 3.0 with kerberos authentication against a -Windows2000 KDC. +This is a rough guide to setting up Samba 3.0 with Kerberos authentication against a +Windows2000 KDC. A familiarity with Kerberos is assumed. Setup your <filename>smb.conf</filename> -You must use at least the following 3 options in smb.conf: +You must use at least the following 3 options in &smb.conf;: @@ -657,17 +692,18 @@ You must use at least the following 3 options in smb.conf: In case samba can't figure out your ads server using your realm name, use the -ads server option in smb.conf: +ads server option in smb.conf: ads server = your.kerberos.server -You do *not* need a smbpasswd file, and older clients will be authenticated as if -security = domain, although it won't do any harm and allows you -to have local users not in the domain. I expect that the above required options will -change soon when we get better active directory integration. +You do not need a smbpasswd file, and older clients will be authenticated as +if security = domain, although it won't do any harm and +allows you to have local users not in the domain. It is expected that the above +required options will change soon when active directory integration will get +better. @@ -675,15 +711,14 @@ change soon when we get better active directory integration. Setup your <filename>/etc/krb5.conf</filename> - -Note: you will need the krb5 workstation, devel, and libs installed - - The minimal configuration for krb5.conf is: + [libdefaults] + default_realm = YOUR.KERBEROS.REALM + [realms] YOUR.KERBEROS.REALM = { kdc = your.kerberos.server @@ -697,37 +732,37 @@ making sure that your password is accepted by the Win2000 KDC. -The realm must be uppercase or you will get "Cannot find KDC for requested -realm while getting initial credentials" error +The realm must be uppercase or you will get Cannot find KDC for +requested realm while getting initial credentials error. Time between the two servers must be synchronized. You will get a -"kinit(v5): Clock skew too great while getting initial credentials" if the time -difference is more than five minutes. +kinit(v5): Clock skew too great while getting initial credentials +if the time difference is more than five minutes. You also must ensure that you can do a reverse DNS lookup on the IP address of your KDC. Also, the name that this reverse lookup maps to -must either be the netbios name of the KDC (ie. the hostname with no -domain attached) or it can alternatively be the netbios name +must either be the NetBIOS name of the KDC (ie. the hostname with no +domain attached) or it can alternatively be the NetBIOS name followed by the realm. The easiest way to ensure you get this right is to add a /etc/hosts entry mapping the IP address of your KDC to -its netbios name. If you don't get this right then you will get a -"local error" when you try to join the realm. +its NetBIOS name. If you don't get this right then you will get a +local error when you try to join the realm. -If all you want is kerberos support in &smbclient; then you can skip +If all you want is Kerberos support in &smbclient; then you can skip straight to Test with &smbclient; now. Creating a computer account and testing your servers -is only needed if you want kerberos support for &smbd; and &winbindd;. +is only needed if you want Kerberos support for &smbd; and &winbindd;. @@ -739,7 +774,7 @@ is only needed if you want kerberos support for &smbd; and &winbindd;. As a user that has write permission on the Samba private directory (usually root) run: - net join -U Administrator%password + &rootprompt;net join -U Administrator%password @@ -748,12 +783,12 @@ As a user that has write permission on the Samba private directory - "ADS support not compiled in" + ADS support not compiled in Samba must be reconfigured (remove config.cache) and recompiled - (make clean all install) after the kerberos libs and headers are installed. + (make clean all install) after the Kerberos libs and headers are installed. - net join prompts for user name + net join prompts for user name You need to login to the domain using kinit USERNAME@REALM. USERNAME must be a user who has rights to add a machine @@ -776,7 +811,7 @@ folder under Users and Computers. On a Windows 2000 client try net use * \\server\share. You should -be logged in with kerberos without needing to know a password. If +be logged in with Kerberos without needing to know a password. If this fails then run klist tickets. Did you get a ticket for the server? Does it have an encoding type of DES-CBC-MD5 ? @@ -788,8 +823,8 @@ server? Does it have an encoding type of DES-CBC-MD5 ? On your Samba server try to login to a Win2000 server or your Samba -server using &smbclient; and kerberos. Use &smbclient; as usual, but -specify the -k option to choose kerberos authentication. +server using &smbclient; and Kerberos. Use &smbclient; as usual, but +specify the -k option to choose Kerberos authentication. @@ -803,7 +838,7 @@ install, to create the right encoding types -w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in +W2k doesn't seem to create the _kerberos._udp and _ldap._tcp in their defaults DNS setup. Maybe fixed in service packs? @@ -815,7 +850,7 @@ their defaults DNS setup. Maybe fixed in service packs? In the process of adding / deleting / re-adding domain member machine accounts there are -many traps for the unwary player and there are many "little" things that can go wrong. +many traps for the unwary player and there are many little things that can go wrong. It is particularly interesting how often subscribers on the samba mailing list have concluded after repeated failed attempts to add a machine account that it is necessary to "re-install" MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type @@ -830,7 +865,7 @@ networking functions. easily overcome. Problem: A Windows workstation was reinstalled. The original domain machine account was deleted and added immediately. The workstation will not join the domain if I use the same machine name. Attempts to add the machine fail with a message that the machine already -exists on the network - I know it doen't. Why is this failing? +exists on the network - I know it doesn't. Why is this failing? @@ -846,14 +881,14 @@ the old account and then to add the machine with a new name. Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a -message that, "The machine could not be added at this time, there is a network problem. -Please try again later." Why? +message that, The machine could not be added at this time, there is a network problem. +Please try again later. Why? -You should check that there is an add machine script in your &smb.conf; +You should check that there is an add machine script in your &smb.conf; file. If there is not, please add one that is appropriate for your OS platform. If a script -has been defined you will need to debug it's operation. Increase the log level +has been defined you will need to debug it's operation. Increase the log level in the &smb.conf; file to level 10, then try to rejoin the domain. Check the logs to see which operation is failing. diff --git a/docs/docbook/projdoc/Diagnosis.xml b/docs/docbook/projdoc/Diagnosis.xml index 150f071b78..7e3656c0f3 100644 --- a/docs/docbook/projdoc/Diagnosis.xml +++ b/docs/docbook/projdoc/Diagnosis.xml @@ -5,7 +5,7 @@ Wed Jan 15 -The samba checklist +The Samba checklist Introduction @@ -129,7 +129,7 @@ run ping. -If you get a message saying "host not found" or similar then your DNS +If you get a message saying host not found or similar then your DNS software or /etc/hosts file is not correctly setup. It is possible to run samba without DNS entries for the server and client, but I assume @@ -143,10 +143,12 @@ in question, perhaps by allowing access from another subnet (on Linux this is done via the ipfwadm program.) + -Note: Modern Linux distributions install ipchains/iptables by default. +Modern Linux distributions install ipchains/iptables by default. This is a common problem that is often overlooked. + @@ -165,7 +167,7 @@ temporarily remove any hosts allow, hosts deny -If you get a "connection refused" response then the smbd server may +If you get a connection refused response then the smbd server may not be running. If you installed it in inetd.conf then you probably edited that file incorrectly. If you installed it as a daemon then check that it is running, and check that the netbios-ssn port is in a LISTEN @@ -180,7 +182,7 @@ this network super daemon. -If you get a "session request failed" then the server refused the +If you get a session request failed then the server refused the connection. If it says "Your server software is being unfriendly" then its probably because you have invalid command line parameters to &smbd;, or a similar fatal problem with the initial startup of &smbd;. Also @@ -203,7 +205,7 @@ the following &smb.conf; file entries: In the above, no allowance has been made for any session requests that -will automatically translate to the loopback adaptor address 127.0.0.1. +will automatically translate to the loopback adapter address 127.0.0.1. To solve this problem change these lines to: @@ -213,7 +215,7 @@ To solve this problem change these lines to: -Do NOT use the bind interfaces only parameter where you +Do not use the bind interfaces only parameter where you may wish to use the samba password change facility, or where &smbclient; may need to access a local service for name resolution or for local resource @@ -224,7 +226,8 @@ fixed soon). Another common cause of these two errors is having something already running -on port 139, such as Samba (ie: smbd is running from inetd already) or +on port 139, such as Samba +(ie: &smbd; is running from inetd already) or something like Digital's Pathworks. Check your inetd.conf file before trying to start &smbd; as a daemon, it can avoid a lot of frustration! @@ -233,7 +236,7 @@ to start &smbd; as a daemon, it can avoid a lot of frustration! And yet another possible cause for failure of this test is when the subnet mask and / or broadcast address settings are incorrect. Please check that the network interface IP Address / Broadcast Address / Subnet Mask settings are -correct and that Samba has correctly noted these in the log.nmb file. +correct and that Samba has correctly noted these in the log.nmbd file. @@ -286,10 +289,10 @@ Run the command nmblookup -d 2 '*' This time we are trying the same as the previous test but are trying it via a broadcast to the default broadcast address. A number of -Netbios/TCPIP hosts on the network should respond, although Samba may +NetBIOS / TCP/IP hosts on the network should respond, although Samba may not catch all of the responses in the short time it listens. You -should see "got a positive name query response" messages from several -hosts. +should see got a positive name query response +messages from several hosts. @@ -332,18 +335,18 @@ as follows: Once you enter the password you should get the smb> prompt. If you -don't then look at the error message. If it says "invalid network -name" then the service "tmp" is not correctly setup in your &smb.conf;. +don't then look at the error message. If it says invalid network +name then the service "tmp" is not correctly setup in your &smb.conf;. -If it says "bad password" then the likely causes are: +If it says bad password then the likely causes are: - you have shadow passords (or some other password system) but didn't + you have shadow passwords (or some other password system) but didn't compile in support for them in &smbd; @@ -369,8 +372,7 @@ If it says "bad password" then the likely causes are: - you enabled password encryption but didn't create the SMB encrypted - password file + you enabled password encryption but didn't map unix to samba users @@ -394,7 +396,7 @@ list of available shares on the server. -If you get a "network name not found" or similar error then netbios +If you get a network name not found or similar error then netbios name resolution is not working. This is usually caused by a problem in nmbd. To overcome it you could do one of the following (you only need to choose one of them): @@ -407,12 +409,12 @@ to choose one of them): add the IP address of BIGSERVER to the wins server box in the - advanced tcp/ip setup on the PC. + advanced TCP/IP setup on the PC. enable windows name resolution via DNS in the advanced section of - the tcp/ip setup + the TCP/IP setup @@ -421,7 +423,7 @@ to choose one of them): -If you get a "invalid network name" or "bad password error" then the +If you get a invalid network name or bad password error then the same fixes apply as they did for the smbclient -L test above. In particular, make sure your hosts allow line is correct (see the man pages) @@ -436,7 +438,7 @@ name and password. -If you get "specified computer is not receiving requests" or similar +If you get specified computer is not receiving requests or similar it probably means that the host is not contactable via tcp services. Check to see if the host is running tcp wrappers, and if so add an entry in the hosts.allow file for your client (or subnet, etc.) @@ -448,16 +450,16 @@ the hosts.allow file for your client (or subnet, etc.) Run the command net use x: \\BIGSERVER\TMP. You should -be prompted for a password then you should get a "command completed -successfully" message. If not then your PC software is incorrectly +be prompted for a password then you should get a command completed +successfully message. If not then your PC software is incorrectly installed or your smb.conf is incorrect. make sure your hosts allow and other config lines in &smb.conf; are correct. It's also possible that the server can't work out what user name to -connect you as. To see if this is the problem add the line user = -username to the [tmp] section of +connect you as. To see if this is the problem add the line user = +username to the [tmp] section of &smb.conf; where username is the username corresponding to the password you typed. If you find this fixes things you may need the username mapping option. @@ -465,7 +467,7 @@ fixes things you may need the username mapping option. It might also be the case that your client only sends encrypted passwords -and you have encrypt passwords = no in &smb.conf; +and you have encrypt passwords = no in &smb.conf; Turn it back on to fix. @@ -484,7 +486,7 @@ master browser for that workgroup. If you don't then the election process has failed. Wait a minute to see if it is just being slow then try again. If it still fails after that then look at the browsing options you have set in &smb.conf;. Make -sure you have preferred master = yes to ensure that +sure you have preferred master = yes to ensure that an election is held at startup. @@ -500,9 +502,9 @@ of the server and get a list of shares. If you get a "invalid password" error when you do then you are probably running WinNT and it is refusing to browse a server that has no encrypted password capability and is in user level security mode. In this case either set -security = server AND -password server = Windows_NT_Machine in your -&smb.conf; file, or make sure encrypted passwords is +security = server AND +password server = Windows_NT_Machine in your +&smb.conf; file, or make sure encrypted passwords is set to "yes". diff --git a/docs/docbook/projdoc/Further-Resources.xml b/docs/docbook/projdoc/Further-Resources.xml index 9f193e3b8d..4294ffa38a 100644 --- a/docs/docbook/projdoc/Further-Resources.xml +++ b/docs/docbook/projdoc/Further-Resources.xml @@ -7,6 +7,9 @@ Further Resources + + Websites + @@ -74,6 +77,102 @@ + + + PDF version of the Troubleshooting Techniques chapter + from the second edition of Sam's Teach Yourself Samba in 24 Hours + (publishing date of Dec. 12, 2001) + + + + + Slide presentations by Samba Team members + + + + + + Introduction to Samba 3.0 by Motonobu Takahashi + (written in Japanese). + + + + + Understanding the Network Neighborhood, by team member + Chris Hertel. This article appeared in the May 2001 issue of + Linux Magazine. + + + + + + Samba 2.0.x Troubleshooting guide from Paul Green + + + + + + Ten Years of Samba + + + + + + Samba Authenticated Gateway HOWTO + + + + + + An Introduction to Samba + + + + + + What is CIFS? + + + + + + WFWG: Password Caching and How It Affects LAN Manager + Security at Microsoft Knowledge Base + + + + + + + Related updates from Microsoft + + + + + Enhanced Encryption for Windows 95 Password Cache + + + + + + Windows '95 File Sharing Updates + + + + + + Windows for Workgroups Sharing Updates + + + + + + + + Books + + + diff --git a/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml b/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml index af6ddff9bf..a13a43675b 100644 --- a/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml +++ b/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml @@ -5,100 +5,309 @@ Jean FrançoisMicouleau &author.jerry; + &author.jht; +Mapping MS Windows and Unix Groups -Configuring Group Mapping + + Starting with Samba-3, new group mapping functionality is available to create associations + between Windows group SIDs and UNIX groups. The groupmap subcommand + included with the &net; tool can be used to manage these associations. + - -Starting with Samba 3.0 alpha 2, new group mapping functionality -is available to create associations between Windows SIDs and UNIX -groups. The groupmap subcommand included with -the net tool can be used to manage these associations. - + + + The first immediate reason to use the group mapping on a Samba PDC, is that + the domain admin group has been removed and should no longer + be specified in &smb.conf;. This parameter was used to give the listed users membership + in the Domain Admins Windows group which gave local admin rights on their workstations + (in default configurations). + + - -The first immediate reason to use the group mapping on a Samba PDC, is that -the domain admin group &smb.conf; has been removed. -This parameter was used to give the listed users membership in the "Domain Admins" -Windows group which gave local admin rights on their workstations (in -default configurations). - + +Features and Benefits - -When installing NT/W2K on a computer, the installer program creates some users -and groups. Notably the 'Administrators' group, and gives to that group some -privileges like the ability to change the date and time or to kill any process -(or close too) running on the local machine. The 'Administrator' user is a -member of the 'Administrators' group, and thus 'inherit' the 'Administrators' -group privileges. If a 'joe' user is created and become a member of the -'Administrator' group, 'joe' has exactly the same rights as 'Administrator'. - + + Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to + arbitrarily associate them with Unix/Linux group accounts. + - -When a NT/W2K machine is joined to a domain, the "Domain Adminis" group of the -PDC is added to the local 'Administrators' group of the workstation. Every -member of the 'Domain Administrators' group 'inherit' the -rights of the local 'Administrators' group when logging on the workstation. + + Group accounts can be managed using the MS Windows NT4 or MS Windows 200x MMC tools + so long as appropriate interface scripts have been provided to &smb.conf;. + + + + Administrators should be aware that where &smb.conf; group interface scripts make + direct calls to the Unix/Linux system tools (eg: the shadow utilities, groupadd, + groupdel, groupmod) then the resulting Unix/Linux group names will be subject + to any limits imposed by these tools. If the tool does NOT allow upper case characters + or space characters, then the creation of an MS Windows NT4 / 200x style group of + Engineering Managers will attempt to create an identically named + Unix/Linux group, an attempt that will of course fail! + + + + There are several possible work-arounds for the operating system tools limitation. One + method is to use a script that generates a name for the Unix/Linux system group that + fits the operating system limits, and that then just passes the Unix/Linux group id (GID) + back to the calling Samba interface. This will provide a dynamic work-around solution. + + + + Another work-around is to manually create a Unix/Linux group, then manually create the + MS Windows NT4 / 200x group on the Samba server and then use the net groupmap + tool to connect the two to each other. + + + + + +Discussion + + + When installing MS Windows NT4 / 200x on a computer, the installation + program creates default users and groups, notably the Administrators group, + and gives that group privileges necessary privileges to perform essential system tasks. + eg: Ability to change the date and time or to kill (or close) any process running on the + local machine. + + + + The 'Administrator' user is a member of the 'Administrators' group, and thus inherits + 'Administrators' group privileges. If a 'joe' user is created to be a member of the + 'Administrator' group, 'joe' has exactly the same rights as 'Administrator'. + + + + When an MS Windows NT4 / W200x is made a domain member, the "Domain Admins" group of the + PDC is added to the local 'Administrators' group of the workstation. Every member of the + 'Domain Administrators' group inherits the rights of the local 'Administrators' group when + logging on the workstation. + + + + The following steps describe how to make Samba PDC users members of the 'Domain Admins' group? + + + + + create a unix group (usually in /etc/group), let's call it domadm + + + add to this group the users that must be Administrators. For example + if you want joe, john and mary, your entry in /etc/group will + look like: + + + + domadm:x:502:joe,john,mary + + + + + Map this domadm group to the "Domain Admins" group by running the command: + + + + + &rootprompt;net groupmap add ntgroup="Domain Admins" unixgroup=domadm + + + + + The quotes around "Domain Admins" are necessary due to the space in the group name. + Also make sure to leave no whitespace surrounding the equal character (=). + + + + + Now joe, john and mary are domain administrators! + + + + It is possible to map any arbitrary UNIX group to any Windows NT4 / 200x group as well as + making any UNIX group a Windows domain group. For example, if you wanted to include a + UNIX group (e.g. acct) in a ACL on a local file or printer on a domain member machine, + you would flag that group as a domain group by running the following on the Samba PDC: + + + + + &rootprompt;net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct + + + + + Be aware that the RID parameter is a unsigned 32 bit integer that should + normally start at 1000. However, this rid must not overlap with any RID assigned + to a user. Verifying this is done differently depending on on the passdb backend + you are using. Future versions of the tools may perform the verification automatically, + but for now the burden is on you. + + + + Example Configuration + + + You can list the various groups in the mapping database by executing + net groupmap list. Here is an example: + + + + + &rootprompt; net groupmap list + System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin + Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin + Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser + Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest + + + + + For complete details on net groupmap, refer to the net(8) man page. + + + + + + + +Configuration Scripts + + + Everyone needs tools. Some of us like to create our own, others prefer to use canned tools + (ie: prepared by someone else for general use). + + + + Sample &smb.conf; add group script + + + A script to great complying group names for use by the Samba group interfaces: + + + + + smbgrpadd.sh + + +#!/bin/bash + +# Add the group using normal system groupadd tool. +groupadd smbtmpgrp00 + +thegid=`cat /etc/group | grep smbtmpgrp00 | cut -d ":" -f3` + +# Now change the name to what we want for the MS Windows networking end +cp /etc/group /etc/group.bak +cat /etc/group.bak | sed s/smbtmpgrp00/$1/g > /etc/group + +# Now return the GID as would normally happen. +echo $thegid +exit 0 + + + + The &smb.conf; entry for the above script would look like: + + add group script = /path_to_tool/smbgrpadd.sh %g + + + + + + + Script to configure Group Mapping + + + In our example we have created a Unix/Linux group called ntadmin. + Our script will create the additional groups Engineers, Marketoids, Gnomes: + + -The following steps describe how to make samba PDC users members of the -'Domain Admins' group? - + +#!/bin/bash - -create a unix group (usually in /etc/group), - let's call it domadm -add to this group the users that must be Administrators. For example - if you want joe,john and mary, your entry in /etc/group will - look like: +net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin +net groupmap modify ntgroup="Domain Users" unixgroup=users +net groupmap modify ntgroup="Domain Guests" unixgroup=nobody +net groupmap modify ntgroup="Administrators" unixgroup=root +net groupmap modify ntgroup="Users" unixgroup=users +net groupmap modify ntgroup="Guests" unixgroup=nobody +net groupmap modify ntgroup="System Operators" unixgroup=sys +net groupmap modify ntgroup="Account Operators" unixgroup=root +net groupmap modify ntgroup="Backup Operators" unixgroup=bin +net groupmap modify ntgroup="Print Operators" unixgroup=lp +net groupmap modify ntgroup="Replicators" unixgroup=daemon +net groupmap modify ntgroup="Power Users" unixgroup=sys - - domadm:x:502:joe,john,mary - +#groupadd Engineers +#groupadd Marketoids +#groupadd Gnomes - +#net groupmap add ntgroup="Engineers" unixgroup=Engineers type=d +#net groupmap add ntgroup="Marketoids" unixgroup=Marketoids type=d +#net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d + + -Map this domadm group to the "Domain Admins" group - by running the command: + + Of course it is expected that the administrator will modify this to suit local needs. + For information regarding the use of the net groupmap tool please + refer to the man page. + - root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm - - The quotes around "Domain Admins" are necessary due to the space in the group name. Also make - sure to leave no whitespace surrounding the equal character (=). - + - + -Now joe, john and mary are domain administrators! + +Common Errors -It is possible to map any arbitrary UNIX group to any Windows NT -group as well as making any UNIX group a Windows domain group. -For example, if you wanted to include a UNIX group (e.g. acct) in a ACL on a -local file or printer on a domain member machine, you would flag -that group as a domain group by running the following on the Samba PDC: +At this time there are many little surprises for the unwary administrator. In a real sense +it is imperative that every step of automated control scripts must be carefully tested +manually before putting them into active service. -root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct + + Adding Groups Fails + + + This is a common problem when the groupadd is called directly + by the Samba interface script for the add group script in + the &smb.conf; file. + + + + The most common cause of failure is an attempt to add an MS Windows group account + that has either an upper case character and/or a space character in it. + + + + There are three possible work-arounds. Firstly, use only group names that comply + with the limitations of the Unix/Linux groupadd system tool. + The second involves use of the script mentioned earlier in this chapter, and the + third option is to manually create a Unix/Linux group account that can substitute + for the MS Windows group name, then use the procedure listed above to map that group + to the MS Windows group. + + + -Be aware that the rid parmeter is a unsigned 32 bit integer that should -normally start at 1000. However, this rid must not overlap with any RID assigned -to a user. Verifying this is done differently depending on on the passdb backend -you are using. Future versions of the tools may perform the verification automatically, -but for now the burden in on you. + + Adding MS Windows Groups to MS Windows Groups Fails -You can list the various groups in the mapping database by executing -net groupmap list. Here is an example: + + Samba-3 does NOT support nested groups from the MS Windows control environment. + -root# net groupmap list -System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin -Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin -Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser -Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest - + -For complete details on net groupmap, refer to the -net(8) man page. + diff --git a/docs/docbook/projdoc/Integrating-with-Windows.xml b/docs/docbook/projdoc/Integrating-with-Windows.xml index 9f0de0a56a..8d07b8a3fd 100644 --- a/docs/docbook/projdoc/Integrating-with-Windows.xml +++ b/docs/docbook/projdoc/Integrating-with-Windows.xml @@ -24,6 +24,26 @@ NetBIOS over TCP/IP then this section may help you to resolve networking problem + +Features and Benefits + + +Many MS Windows network administrators have never been exposed to basic TCP/IP +networking as it is implemented in a Unix/Linux operating system. Likewise, many Unix and +Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP based +networking (and may have no desire to be either). + + + +This chapter gives a short introduction to the basics of how a name can be resolved to +it's IP address for each operating system environment. + + + + + +Background Information + Since the introduction of MS Windows 2000 it is possible to run MS Windows networking without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS @@ -48,6 +68,7 @@ Use of DHCP with ADS is recommended as a further means of maintaining central co over client workstation network configuration. + Name Resolution in a pure Unix/Linux world @@ -67,13 +88,13 @@ The key configuration files covered in this section are: <filename>/etc/hosts</filename> -Contains a static list of IP Addresses and names. +Contains a static list of IP addresses and names. eg: - + 127.0.0.1 localhost localhost.localdomain 192.168.1.1 bigbox.caldera.com bigbox alias4box - + The purpose of /etc/hosts is to provide a @@ -85,9 +106,9 @@ IP addresses. Network packets that are sent over the physical network transport layer communicate not via IP addresses but rather using the Media -Access Control address, or MAC address. IP Addresses are currently +Access Control address, or MAC address. IP addresses are currently 32 bits in length and are typically presented as four (4) decimal -numbers that are separated by a dot (or period). eg: 168.192.1.1 +numbers that are separated by a dot (or period). eg: 168.192.1.1. @@ -97,10 +118,10 @@ as two digit hexadecimal numbers separated by colons. eg: -Every network interfrace must have an MAC address. Associated with +Every network interface must have an MAC address. Associated with a MAC address there may be one or more IP addresses. There is NO relationship between an IP address and a MAC address, all such assignments -are arbitary or discretionary in nature. At the most basic level all +are arbitrary or discretionary in nature. At the most basic level all network communications takes place using MAC addressing. Since MAC addresses must be globally unique, and generally remains fixed for any particular interface, the assignment of an IP address makes sense @@ -133,7 +154,7 @@ interface. The /etc/hosts file is foundational to all -Unix/Linux TCP/IP installations and as a minumum will contain +Unix/Linux TCP/IP installations and as a minimum will contain the localhost and local network interface IP addresses and the primary names by which they are known within the local machine. This file helps to prime the pump so that a basic level of name @@ -178,13 +199,13 @@ This file tells the name resolution libraries: /etc/host.conf is the primary means by which the setting in /etc/resolv.conf may be affected. It is a critical configuration file. This file controls the order by -which name resolution may procede. The typical structure is: +which name resolution may proceed. The typical structure is: - + order hosts,bind multi on - + then both addresses should be returned. Please refer to the @@ -205,7 +226,7 @@ file typically has resolver object specifications as follows: - + # /etc/nsswitch.conf # # Name Service Switch configuration file. @@ -219,14 +240,14 @@ file typically has resolver object specifications as follows: hosts: files nis dns # Alternative entries for host name resolution are: - # hosts: files dns nis nis+ hesoid db compat ldap wins + # hosts: files dns nis nis+ hesiod db compat ldap wins networks: nis files dns ethers: nis files protocols: nis files rpc: nis files services: nis files - + Of course, each of these mechanisms requires that the appropriate @@ -244,12 +265,12 @@ Starting with version 2.2.0 samba has Linux support for extensions to the name service switch infrastructure so that linux clients will be able to obtain resolution of MS Windows NetBIOS names to IP Addresses. To gain this functionality Samba needs to be compiled -with appropriate arguments to the make command (ie: make -nsswitch/libnss_wins.so). The resulting library should +with appropriate arguments to the make command (i.e.: make +nsswitch/libnss_wins.so). The resulting library should then be installed in the /lib directory and the "wins" parameter needs to be added to the "hosts:" line in the /etc/nsswitch.conf file. At this point it -will be possible to ping any MS Windows machine by it's NetBIOS +will be possible to ping any MS Windows machine by its NetBIOS machine name, so long as that machine is within the workgroup to which both the samba machine and the MS Windows machine belong. @@ -265,10 +286,10 @@ which both the samba machine and the MS Windows machine belong. MS Windows networking is predicated about the name each machine is given. This name is known variously (and inconsistently) as the "computer name", "machine name", "networking name", "netbios name", -"SMB name". All terms mean the same thing with the exception of +or "SMB name". All terms mean the same thing with the exception of "netbios name" which can apply also to the name of the workgroup or the domain name. The terms "workgroup" and "domain" are really just a -simply name with which the machine is associated. All NetBIOS names +simple name with which the machine is associated. All NetBIOS names are exactly 16 characters in length. The 16th character is reserved. It is used to store a one byte value that indicates service level information for the NetBIOS name that is registered. A NetBIOS machine @@ -280,7 +301,7 @@ the client/server. The following are typical NetBIOS name/service type registrations: - + Unique NetBIOS Names: MACHINENAME<00> = Server Service is running on MACHINENAME MACHINENAME<03> = Generic Machine Name (NetBIOS name) @@ -292,7 +313,7 @@ The following are typical NetBIOS name/service type registrations: WORKGROUP<1c> = Domain Controllers / Netlogon Servers WORKGROUP<1d> = Local Master Browsers WORKGROUP<1e> = Internet Name Resolvers - + It should be noted that all NetBIOS machines register their own @@ -311,8 +332,8 @@ wants to locate a domain logon server. It finds this service and the IP address of a server that provides it by performing a lookup (via a NetBIOS broadcast) for enumeration of all machines that have registered the name type *<1c>. A logon request is then sent to each -IP address that is returned in the enumerated list of IP addresses. Which -ever machine first replies then ends up providing the logon services. +IP address that is returned in the enumerated list of IP addresses. +Whichever machine first replies then ends up providing the logon services. @@ -372,7 +393,7 @@ frustrating for users - but it is a characteristic of the protocol. The MS Windows utility that allows examination of the NetBIOS name cache is called "nbtstat". The Samba equivalent of this -is called "nmblookup". +is called nmblookup. @@ -392,7 +413,7 @@ to IP address mapping. It typically looks like: - + # Copyright (c) 1998 Microsoft Corp. # # This is a sample LMHOSTS file used by the Microsoft Wins Client (NetBIOS @@ -401,7 +422,7 @@ It typically looks like: # This file contains the mappings of IP addresses to NT computernames # (NetBIOS) names. Each entry should be kept on an individual line. # The IP address should be placed in the first column followed by the - # corresponding computername. The address and the comptername + # corresponding computername. The address and the computername # should be separated by at least one space or tab. The "#" character # is generally used to denote the start of a comment (see the exceptions # below). @@ -433,7 +454,7 @@ It typically looks like: # centralized lmhosts file to be maintained on a server. # It is ALWAYS necessary to provide a mapping for the IP address of the # server prior to the #INCLUDE. This mapping must use the #PRE directive. - # In addtion the share "public" in the example below must be in the + # In addition the share "public" in the example below must be in the # LanManServer list of "NullSessionShares" in order for client machines to # be able to read the lmhosts file successfully. This key is under # \machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares @@ -469,7 +490,7 @@ It typically looks like: # so keeping the number of comments to a minimum will improve performance. # Therefore it is not advisable to simply add lmhosts file entries onto the # end of this file. - + @@ -492,10 +513,10 @@ every way the equivalent of the Unix/Linux /etc/hosts file. This capability is configured in the TCP/IP setup area in the network -configuration facility. If enabled an elaborate name resolution sequence -is followed the precise nature of which is dependant on what the NetBIOS -Node Type parameter is configured to. A Node Type of 0 means use -NetBIOS broadcast (over UDP broadcast) is first used if the name +configuration facility. If enabled, an elaborate name resolution sequence +is followed the precise nature of which is dependant on how the NetBIOS +Node Type parameter is configured. A Node Type of 0 means that +NetBIOS broadcast (over UDP broadcast) is used if the name that is the subject of a name lookup is not found in the NetBIOS name cache. If that fails then DNS, HOSTS and LMHOSTS are checked. If set to Node Type 8, then a NetBIOS Unicast (over UDP Unicast) is sent to the @@ -509,7 +530,7 @@ lookup is used. WINS Lookup -A WINS (Windows Internet Name Server) service is the equivaent of the +A WINS (Windows Internet Name Server) service is the equivalent of the rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores the names and IP addresses that are registered by a Windows client if the TCP/IP setup has been given at least one WINS Server IP Address. @@ -520,19 +541,19 @@ To configure Samba to be a WINS server the following parameter needs to be added to the &smb.conf; file: - + wins support = Yes - + To configure Samba to use a WINS server the following parameters are needed in the &smb.conf; file: - + wins support = No wins server = xxx.xxx.xxx.xxx - + where xxx.xxx.xxx.xxx is the IP address @@ -542,4 +563,114 @@ of the WINS server. + +Common Errors + + +TCP/IP network configuration problems find every network administrator sooner or later. +The cause can be anything from keyboard mishaps, forgetfulness, simple mistakes, and +carelessness. Of course, no one is every deliberately careless! + + + + My Boomerang Won't Come Back + + + Well, the real complaint said, "I can ping my samba server from Windows, but I can + not ping my Windows machine from the samba server." + + + + The Windows machine was at IP Address 192.168.1.2 with netmask 255.255.255.0, the + Samba server (Linux) was at IP Address 192.168.1.130 with netmask 255.255.255.128. + The machines were on a local network with no external connections. + + + + Due to inconsistent netmasks, the Windows machine was on network 192.168.1.0/24, while + the Samba server was on network 192.168.1.128/25 - logically a different network. + + + + + + Very Slow Network Connections + + + A common causes of slow network response includes: + + + + Client is configured to use DNS and DNS server is down + Client is configured to use remote DNS server, but remote connection is down + Client is configured to use a WINS server, but there is no WINS server + Client is NOT configured to use a WINS server, but there is a WINS server + Firewall is filtering our DNS or WINS traffic + + + + + + Samba server name change problem + + + The name of the samba server was changed, samba was restarted, samba server can not be + pinged by new name from MS Windows NT4 Workstation, but it does still respond to ping using + the old name. Why? + + + + From this description three (3) things are rather obvious: + + + + WINS is NOT in use, only broadcast based name resolution is used + The samba server was renamed and restarted within the last 10-15 minutes + The old samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation + + + + To find what names are present in the NetBIOS name cache on the MS Windows NT4 machine, + open a cmd shell, then: + + + + + C:\temp\>nbtstat -n + + NetBIOS Local Name Table + + Name Type Status + ------------------------------------------------ + SLACK <03> UNIQUE Registered + ADMINISTRATOR <03> UNIQUE Registered + SLACK <00> UNIQUE Registered + SARDON <00> GROUP Registered + SLACK <20> UNIQUE Registered + SLACK <1F> UNIQUE Registered + + + C:\Temp\>nbtstat -c + + NetBIOS Remote Cache Name Table + + Name Type Host Address Life [sec] + -------------------------------------------------------------- + FRODO <20> UNIQUE 192.168.1.1 240 + + C:\Temp\> + + + + + In the above example, FRODO is the Samba server and SLACK is the MS Windows NT4 Workstation. + The first listing shows the contents of the Local Name Table (i.e.: Identity information on + the MS Windows workstation), the second shows the NetBIOS name in the NetBIOS name cache. + The name cache contains the remote machines known to this workstation. + + + + + + diff --git a/docs/docbook/projdoc/InterdomainTrusts.xml b/docs/docbook/projdoc/InterdomainTrusts.xml index 2c492d4ac0..31f9697bf3 100644 --- a/docs/docbook/projdoc/InterdomainTrusts.xml +++ b/docs/docbook/projdoc/InterdomainTrusts.xml @@ -15,6 +15,25 @@ some background information regarding trust relationships and how to create them possible for Samba-3 to NT4 trust (and vice versa), as well as Samba3 to Samba3 trusts. + +Features and Benefits + + +Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4 style +trust relationships. This imparts to Samba similar scalability as is possible with +MS Windows NT4. + + + +Given that Samba-3 has the capability to function with a scalable backend authentication +database such as LDAP, and given it's ability to run in Primary as well as Backup Domain control +modes, the administrator would be well advised to consider alternatives to the use of +Interdomain trusts simply because by the very nature of how this works it is fragile. +That was, after all, a key reason for the development and adoption of Microsoft Active Directory. + + + + Trust Relationship Background @@ -76,13 +95,15 @@ There are two steps to creating an interdomain trust relationship. NT4 as the Trusting Domain (ie. creating the trusted account) -For MS Windows NT4, all domain trust relationships are configured using the Domain User Manager. -To affect a two way trust relationship it is necessary for each domain administrator to make -available (for use by an external domain) it's security resources. This is done from the Domain -User Manager Policies entry on the menu bar. From the Policy menu, select Trust Relationships, then -next to the lower box that is labelled "Permitted to Trust this Domain" are two buttons, "Add" and -"Remove". The "Add" button will open a panel in which needs to be entered the remote domain that -will be able to assign user rights to your domain. In addition it is necessary to enter a password +For MS Windows NT4, all domain trust relationships are configured using the +Domain User Manager. To affect a two way trust relationship it is +necessary for each domain administrator to make available (for use by an external domain) it's +security resources. This is done from the Domain User Manager Policies entry on the menu bar. +From the Policy menu, select Trust Relationships, then +next to the lower box that is labelled Permitted to Trust this Domain are two +buttons, Add and Remove. The Add +button will open a panel in which needs to be entered the remote domain that will be able to assign +user rights to your domain. In addition it is necessary to enter a password that is specific to this trust relationship. The password needs to be typed twice (for standard confirmation). @@ -94,10 +115,11 @@ typed twice (for standard confirmation). A trust relationship will work only when the other (trusting) domain makes the appropriate connections -with the trusted domain. To consumate the trust relationship the administrator will launch the +with the trusted domain. To consummate the trust relationship the administrator will launch the Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the -"Add" button that is next to the box that is labelled "Trusted Domains". A panel will open in -which must be entered the name of the remote domain as well as the password assigned to that trust. +Add button that is next to the box that is labelled +Trusted Domains. A panel will open in which must be entered the name of the remote +domain as well as the password assigned to that trust. @@ -126,21 +148,21 @@ between domains in purely Samba environment. In order to set the Samba PDC to be the trusted party of the relationship first you need to create special account for the domain that will be the trusting party. To do that, you can use the 'smbpasswd' utility. Creating the trusted domain account is very -similiar to creating a trusted machine account. Suppose, your domain is +similar to creating a trusted machine account. Suppose, your domain is called SAMBA, and the remote domain is called RUMBA. The first step will be to issue this command from your favourite shell: -deity# smbpasswd -a -i rumba +&rootprompt; smbpasswd -a -i rumba New SMB password: XXXXXXXX Retype SMB password: XXXXXXXX Added user rumba$ -where -a means to add a new account into the -passdb database and -i means: ''create this +where means to add a new account into the +passdb database and means: ''create this account with the InterDomain trust flag'' @@ -153,18 +175,21 @@ After issuing this command you'll be asked to enter the password for the account. You can use any password you want, but be aware that Windows NT will not change this password until 7 days following account creation. After the command returns successfully, you can look at the entry for the new account -(in the stardard way depending on your configuration) and see that account's name is +(in the standard way depending on your configuration) and see that account's name is really RUMBA$ and it has 'I' flag in the flags field. Now you're ready to confirm the trust by establishing it from Windows NT Server. -Open 'User Manager for Domains' and from menu 'Policies' select 'Trust Relationships...'. -Right beside 'Trusted domains' list box press 'Add...' button. You will be prompted for +Open User Manager for Domains and from menu +Policies select Trust Relationships.... +Right beside Trusted domains list box press the +Add... button. You will be prompted for the trusted domain name and the relationship password. Type in SAMBA, as this is your domain name, and the password used at the time of account creation. -Press OK and, if everything went without incident, you will see 'Trusted domain relationship -successfully established' message. +Press OK and, if everything went without incident, you will see +Trusted domain relationship successfully +established message. @@ -181,9 +206,11 @@ The very first thing requirement is to add an account for the SAMBA domain on RU -Launch the Domain User Manager, then from the menu select 'Policies', 'Trust Relationships'. -Now, next to 'Trusted Domains' box press the 'Add' button, and type in the name of the trusted -domain (SAMBA) and password securing the relationship. +Launch the Domain User Manager, then from the menu select +Policies, Trust Relationships. +Now, next to Trusted Domains box press the Add +button, and type in the name of the trusted domain (SAMBA) and password securing +the relationship. @@ -197,7 +224,7 @@ Using your favourite shell while being logged in as root, issue this command: -deity# net rpc trustdom establish rumba +&rootprompt;net rpc trustdom establish rumba @@ -207,8 +234,8 @@ Do not worry if you see an error message that mentions a returned code of password you gave is correct and the NT4 Server says the account is ready for interdomain connection and not for ordinary connection. After that, be patient it can take a while (especially -in large networks), you should see the 'Success' message. Congratulations! Your trust -relationship has just been established. +in large networks), you should see the Success message. +Congratulations! Your trust relationship has just been established. @@ -219,4 +246,48 @@ the secrets.tdb file. + +Common Errors + + +Interdomain trust relationships should NOT be attempted on networks that are unstable +or that suffer regular outages. Network stability and integrity are key concerns with +distributed trusted domains. + + + + Tell me about Trust Relationships using Samba + + + Like many, I administer multiple LANs connected together using NT trust + relationships. This was implemented about 4 years ago. I now have the + occasion to consider performing this same task again, but this time, I + would like to implement it solely through samba - no Microsoft PDCs + anywhere. + + + + I have read documentation on samba.org regarding NT-style trust + relationships and am now wondering, can I do what I want to? I already + have successfully implemented 2 samba servers, but they are not PDCs. + They merely act as file servers. I seem to remember, and it appears to + be true (according to samba.org) that trust relationships are a + challenge. + + + + Please provide any helpful feedback that you may have. + + + + These are almost complete in Samba 3.0 snapshots. The main catch + is getting winbindd to be able to allocate UID/GIDs for trusted + users/groups. See the updated Samba HOWTO collection for more + details. + + + + + + diff --git a/docs/docbook/projdoc/IntroSMB.xml b/docs/docbook/projdoc/IntroSMB.xml index 38e40ae239..bc9fa9ce1b 100644 --- a/docs/docbook/projdoc/IntroSMB.xml +++ b/docs/docbook/projdoc/IntroSMB.xml @@ -6,10 +6,10 @@ Introduction to Samba - + "If you understand what you're doing, you're not learning anything." -- Anonymous - + Samba is a file and print server for Windows-based clients using TCP/IP as the underlying @@ -132,7 +132,7 @@ thinking? If you plan on getting help, make sure to subscribe to the Samba Mailing List (available at -http://www.samba.org). Optionally, you could just search mailing.unix.samba at http://groups.google.com +http://www.samba.org). @@ -157,7 +157,7 @@ related to Samba: SMBFS and CIFS VFS. These are both available in the Linux ker CIFS VFS (Common Internet File System Virtual File System) is the successor to SMBFS, and is being actively developed for the upcoming version of the Linux kernel. The intent of this module - is to provide advanced network file system functionality including support for dfs (heirarchical + is to provide advanced network file system functionality including support for dfs (hierarchical name space), secure per-user session establishment, safe distributed caching (oplock), optional packet signing, Unicode and other internationalization improvements, and optional Winbind (nsswitch) integration. @@ -171,8 +171,9 @@ nothing to do with acting as a file and print server for SMB/CIFS clients. -There are other Open Source CIFS client implementations, such as the jCIFS project -(jcifs.samba.org) which provides an SMB client toolkit written in Java. +There are other Open Source CIFS client implementations, such as the +jCIFS project +which provides an SMB client toolkit written in Java. @@ -226,9 +227,9 @@ up a single file. In general, SMB sessions are established in the following orde -A good way to examine this process in depth is to try out SecurityFriday's SWB program -at http://www.securityfriday.com/ToolDownload/SWB/swb_doc.html. It allows you to -walk through the establishment of a SMB/CIFS session step by step. +A good way to examine this process in depth is to try out +SecurityFriday's SWB program. +It allows you to walk through the establishment of a SMB/CIFS session step by step. @@ -236,8 +237,8 @@ walk through the establishment of a SMB/CIFS session step by step. Epilogue - -"What's fundamentally wrong is that nobody ever had any taste when they + +What's fundamentally wrong is that nobody ever had any taste when they did it. Microsoft has been very much into making the user interface look good, but internally it's just a complete mess. And even people who program for Microsoft and who have had years of experience, just don't know how it works internally. @@ -246,16 +247,16 @@ mess that fixing one bug might just break a hundred programs that depend on that bug. And Microsoft isn't interested in anyone fixing bugs -- they're interested in making money. They don't have anybody who takes pride in Windows 95 as an operating system. - + - + People inside Microsoft know it's a bad operating system and they still continue obviously working on it because they want to get the next version out because they want to have all these new features to sell more copies of the system. - + - + The problem with that is that over time, when you have this kind of approach, and because nobody understands it, because nobody REALLY fixes bugs (other than when they're really obvious), the end result is really messy. You can't trust @@ -265,11 +266,11 @@ fine and then once in a blue moon for some completely unknown reason, it's dead, and nobody knows why. Not Microsoft, not the experienced user and certainly not the completely clueless user who probably sits there shivering thinking "What did I do wrong?" when they didn't do anything wrong at all. - + - + That's what's really irritating to me." - + -- Linus Torvalds, from an interview with BOOT Magazine, Sept 1998 @@ -280,15 +281,10 @@ That's what's really irritating to me." Miscellaneous - -This chapter was lovingly handcrafted on a Dell Latitude C400 laptop running Slackware Linux 9.0, -in case anyone asks. - - - + -This chapter is Copyright © 2003 David Lechnyr (david at lechnyr dot com). +This chapter is Copyright 2003 David Lechnyr (david at lechnyr dot com). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation. A copy of the license is available at http://www.gnu.org/licenses/fdl.txt. diff --git a/docs/docbook/projdoc/NT4Migration.xml b/docs/docbook/projdoc/NT4Migration.xml index 585cfe6a47..8c2d0e19f3 100644 --- a/docs/docbook/projdoc/NT4Migration.xml +++ b/docs/docbook/projdoc/NT4Migration.xml @@ -16,8 +16,8 @@ Samba-3 based domain control. In the IT world there is often a saying that all problems are encountered because of -poor planning. The corrollary to this saying is that not all problems can be anticpated -and planned for. Then again, good planning will anticpate most show stopper type situations. +poor planning. The corollary to this saying is that not all problems can be anticipated +and planned for. Then again, good planning will anticipate most show stopper type situations. @@ -44,26 +44,14 @@ should know precisely why the change is important for the o Possible motivations to make a change include: - - - Improve network manageability - - - Obtain better user level functionality - - - Reduce network operating costs - - - Reduce exposure caused by Microsoft withdrawal of NT4 support - - - Avoid MS License 6 implications - - - Reduce organisation's dependency on Microsoft - - + + Improve network manageability + Obtain better user level functionality + Reduce network operating costs + Reduce exposure caused by Microsoft withdrawal of NT4 support + Avoid MS License 6 implications + Reduce organisation's dependency on Microsoft + It is vital that it be well recognised that Samba-3 is NOT MS Windows NT4. Samba-3 offers @@ -77,61 +65,31 @@ MS Windows 2000 and beyond (with or without Active Directory services). What are the features that Samba-3 can NOT provide? - - - Active Directory Server - - - Group Policy Objects (in Active Direcrtory) - - - Machine Policy objects - - - Logon Scripts in Active Directorty - - - Software Application and Access Controls in Active Directory - - + + Active Directory Server + Group Policy Objects (in Active Directory) + Machine Policy objects + Logon Scripts in Active Directory + Software Application and Access Controls in Active Directory + The features that Samba-3 DOES provide and that may be of compelling interest to your site includes: - - - Lower Cost of Ownership - - - Global availability of support with no strings attached - - - Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system) - - - Creation of on-the-fly logon scripts - - - Creation of on-the-fly Policy Files - - - Greater Stability, Reliability, Performance and Availability - - - Manageability via an ssh connection - - - Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam) - - - Ability to implement a full single-signon architecture - - - Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand - - + + Lower Cost of Ownership + Global availability of support with no strings attached + Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system) + Creation of on-the-fly logon scripts + Creation of on-the-fly Policy Files + Greater Stability, Reliability, Performance and Availability + Manageability via an ssh connection + Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam) + Ability to implement a full single-sign-on architecture + Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand + Before migrating a network from MS Windows NT4 to Samba-3 it is vital that all necessary factors are @@ -164,7 +122,7 @@ and network bandwidth. A physical network segment may house several domains, each of which may span multiple network segments. Where domains span routed network segments it is most advisable to consider and test the performance implications of the design and layout of a network. A Centrally located domain controller that is being -designed to serve mulitple routed network segments may result in severe performance problems if the +designed to serve multiple routed network segments may result in severe performance problems if the response time (eg: ping timing) between the remote segment and the PDC is more than 100 ms. In situations where the delay is too long it is highly recommended to locate a backup controller (BDC) to serve as the local authentication and access control server. @@ -212,20 +170,20 @@ make sure that users will never be interrupted by the stupidity of complexity. Logon Scripts -Please refer to the section of this document on Advanced Network Adminsitration for information +Please refer to the section of this document on Advanced Network Administration for information regarding the network logon script options for Samba-3. Logon scripts can help to ensure that all users gain share and printer connections they need. Logon scripts can be created on-the-fly so that all commands executed are specific to the -rights and privilidges granted to the user. The preferred controls should be affected through -group membership so that group information can be used to custom create a logong script using -the root preexec parameters to the NETLOGON share. +rights and privileges granted to the user. The preferred controls should be affected through +group membership so that group information can be used to custom create a logon script using +the root preexec parameters to the NETLOGON share. -Some sites prefer to use a tool such as kixstart to establish a controlled +Some sites prefer to use a tool such as kixstart to establish a controlled user environment. In any case you may wish to do a google search for logon script process controls. In particular, you may wish to explore the use of the Microsoft knowledgebase article KB189105 that deals with how to add printers without user intervention via the logon script process. @@ -241,7 +199,7 @@ Management. -Profiles may also be managed using the Samba-3 tool profiles. This tool allows +Profiles may also be managed using the Samba-3 tool profiles. This tool allows the MS Windows NT style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file to be changed to the SID of the Samba-3 domain. @@ -283,39 +241,39 @@ Samba-3 set up as a DC with netlogon share, profile share, etc. Samba must NOT be running - rpcclient NT4PDC -U Administrator%passwd + rpcclient NT4PDC -U Administrator%passwd lsaquery Note the SID returned - net getsid -S NT4PDC -w DOMNAME -U Administrator%passwd + net getsid -S NT4PDC -w DOMNAME -U Administrator%passwd Note the SID - net getlocalsid + net getlocalsid Note the SID, now check that all three SIDS reported are the same! - net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd + net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd - net rpc vampire -S NT4PDC -U administrator%passwd + net rpc vampire -S NT4PDC -U administrator%passwd - pdbedit -l + pdbedit -L Note - did the users migrate? - initGrps.sh DOMNAME + initGrps.sh DOMNAME - net groupmap list + net groupmap list Now check that all groups are recognised - net rpc campire -S NT4PDC -U administrator%passwd + net rpc vampire -S NT4PDC -U administrator%passwd - pdbedit -lv + pdbedit -Lv Note - check that all group membership has been migrated @@ -356,7 +314,7 @@ based solution fit into three basic categories. Planning for Success -There are three basic choices for sites that intend to migrate from MS Windwows NT4 +There are three basic choices for sites that intend to migrate from MS Windows NT4 to Samba-3. @@ -440,6 +398,7 @@ No matter what choice you make, the following rules will minimise down-stream pr Samba Implementation Choices + Authentication database back end Winbind (external Samba or NT4/200x server) @@ -447,13 +406,13 @@ Authentication database back end External server could use Active Directory or NT4 Domain Database type - smbpasswd, tdbsam, ldapsam, MySQLsam + smbpasswd, tdbsam, ldapsam, mysqlsam Access Control Points On the Share itself (Use NT4 Server Manager) On the file system Unix permissions on files and directories - Posix ACLs enablement in file system? + Enable Posix ACLs in file system? Through Samba share parameters Not recommended - except as only resort diff --git a/docs/docbook/projdoc/NetworkBrowsing.xml b/docs/docbook/projdoc/NetworkBrowsing.xml index 8648bfa256..c87ede5906 100644 --- a/docs/docbook/projdoc/NetworkBrowsing.xml +++ b/docs/docbook/projdoc/NetworkBrowsing.xml @@ -10,7 +10,7 @@ This document contains detailed information as well as a fast track guide to implementing browsing across subnets and / or across workgroups (or domains). -WINS is the best tool for resolution of NetBIOS names to IP addesses. WINS is +WINS is the best tool for resolution of NetBIOS names to IP addresses. WINS is NOT involved in browse list handling except by way of name to address resolution. @@ -32,10 +32,10 @@ hope it never returns!. -For many MS Windows network administrators that statement sums up their feelings about -NetBIOS networking precisely. For those who mastered NetBIOS networking it's fickle -nature was just par for the course. For those who never quite managed to tame it's -lusty features NetBIOS is like Paterson's Curse. +For many MS Windows network administrators, that statement sums up their feelings about +NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle +nature was just par for the course. For those who never quite managed to tame its +lusty features, NetBIOS is like Paterson's Curse. @@ -49,7 +49,7 @@ features which make it such a persistent weed. In this chapter we explore vital aspects of SMB (Server Message Block) networking with -a particular focus on SMB as implmented through running NetBIOS (Network Basic +a particular focus on SMB as implemented through running NetBIOS (Network Basic Input / Output System) over TCP/IP. Since Samba does NOT implement SMB or NetBIOS over any other protocols we need to know how to configure our network environment and simply remember to use nothing but TCP/IP on all our MS Windows network clients. @@ -98,11 +98,12 @@ The technologies (or methods) employed in making all of this work includes: -The samba application that controls/manages browse list management and name resolution is +The Samba application that controls browse list management and name resolution is called nmbd. The configuration parameters involved in nmbd's operation are: + Browsing options: ----------------- * os level @@ -128,9 +129,9 @@ called nmbd. The configuration parameters involved in nmbd' -For Samba the WINS Server and WINS Support are mutually exclusive options. Those marked with +For Samba, the WINS Server and WINS Support are mutually exclusive options. Those marked with an '*' are the only options that commonly MAY need to be modified. Even if not one of these -parameters is set nmbd will still do it's job. +parameters is set nmbd will still do it's job. @@ -141,7 +142,7 @@ parameters is set nmbd will still do it's job. Firstly, all MS Windows networking uses SMB (Server Message Block) based messaging. SMB messaging may be implemented with or without NetBIOS. MS Windows 200x supports -NetBIOS over TCP/IP for backwards compatibility. Microsoft are intent on phasing out NetBIOS +NetBIOS over TCP/IP for backwards compatibility. Microsoft is intent on phasing out NetBIOS support. @@ -151,7 +152,7 @@ support. Samba implements NetBIOS, as does MS Windows NT / 200x / XP, by encapsulating it over TCP/IP. MS Windows products can do likewise. NetBIOS based networking uses broadcast messaging to -affect browse list management. When running NetBIOS over TCP/IP this uses UDP based messaging. +affect browse list management. When running NetBIOS over TCP/IP, this uses UDP based messaging. UDP messages can be broadcast or unicast. @@ -164,7 +165,7 @@ implements browse list collation using unicast UDP. -Secondly, in those networks where Samba is the only SMB server technology +Secondly, in those networks where Samba is the only SMB server technology, wherever possible nmbd should be configured on one (1) machine as the WINS server. This makes it easy to manage the browsing environment. If each network segment is configured with it's own Samba WINS server, then the only way to @@ -183,11 +184,11 @@ the use of the remote announce and the As of Samba 3 WINS replication is being worked on. The bulk of the code has been committed, but it still needs maturation. This is NOT a supported feature of the Samba-3.0.0 release. Hopefully, this will become a supported feature -of one of the samba-3 release series. +of one of the Samba-3 release series. -Right now samba WINS does not support MS-WINS replication. This means that +Right now Samba WINS does not support MS-WINS replication. This means that when setting up Samba as a WINS server there must only be one nmbd configured as a WINS server on the network. Some sites have used multiple Samba WINS servers for redundancy (one server per subnet) and then used @@ -260,7 +261,7 @@ force register with a Dynamic DNS server in Windows 200x / XP using: With Active Directory (ADS), a correctly functioning DNS server is absolutely -essential. In the absence of a working DNS server that has been correctly configured +essential. In the absence of a working DNS server that has been correctly configured, MS Windows clients and servers will be totally unable to locate each other, consequently network services will be severely impaired. @@ -323,7 +324,7 @@ The following are some of the default service records that Active Directory requ _ldap._tcp.Site.gc.ms-dcs.DomainTree - Used by MS Windows clients to locate site configuration dependant + Used by MS Windows clients to locate site configuration dependent Global Catalog server. @@ -346,11 +347,11 @@ is enabled, or if DNS for NetBIOS name resolution is enabled, etc. -In the case where there is no WINS server all name registrations as +In the case where there is no WINS server, all name registrations as well as name lookups are done by UDP broadcast. This isolates name resolution to the local subnet, unless LMHOSTS is used to list all names and IP addresses. In such situations Samba provides a means by -which the samba server name may be forcibly injected into the browse +which the Samba server name may be forcibly injected into the browse list of a remote MS Windows network (using the remote announce parameter). @@ -389,7 +390,7 @@ inability to use the network services. -Samba supports a feature that allows forced synchonisation +Samba supports a feature that allows forced synchronisation of browse lists across routed networks using the remote browse sync parameter in the smb.conf file. This causes Samba to contact the local master browser on a remote network and @@ -418,7 +419,7 @@ to collate the browse lists from local master browsers on all the subnets that have a machine participating in the workgroup. Without one machine configured as a domain master browser each subnet would be an isolated workgroup, unable to see any machines on any other -subnet. It is the presense of a domain master browser that makes +subnet. It is the presence of a domain master browser that makes cross subnet browsing possible for a workgroup. @@ -426,7 +427,8 @@ cross subnet browsing possible for a workgroup. In an WORKGROUP environment the domain master browser must be a Samba server, and there must only be one domain master browser per workgroup name. To set up a Samba server as a domain master browser, -set the following option in the [global] section of the &smb.conf; file : +set the following option in the [global] section +of the &smb.conf; file : @@ -438,7 +440,7 @@ set the following option in the [global] section of the &smb.conf; file : The domain master browser should also preferrably be the local master browser for its own subnet. In order to achieve this set the following -options in the [global] section of the &smb.conf; file : +options in the [global] section of the &smb.conf; file : @@ -462,7 +464,7 @@ workgroup. Any MS Windows NT/2K/XP/2003 machine should be able to do this, as will Windows 9x machines (although these tend to get rebooted more often, so it's not such a good idea to use these). To make a Samba server a local master browser -set the following options in the [global] section of the +set the following options in the [global] section of the &smb.conf; file : @@ -482,9 +484,9 @@ master browser. -The local master parameter allows Samba to act as a -local master browser. The preferred master causes nmbd -to force a browser election on startup and the os level +The local master parameter allows Samba to act as a +local master browser. The preferred master causes nmbd +to force a browser election on startup and the os level parameter sets Samba high enough so that it should win any browser elections. @@ -492,7 +494,7 @@ parameter sets Samba high enough so that it should win any browser elections. If you have an NT machine on the subnet that you wish to be the local master browser then you can disable Samba from becoming a local master browser by setting the following -options in the [global] section of the +options in the [global] section of the &smb.conf; file : @@ -513,8 +515,8 @@ options in the [global] section of the If you are adding Samba servers to a Windows NT Domain then you must not set up a Samba server as a domain master browser. -By default, a Windows NT Primary Domain Controller for a Domain -name is also the Domain master browser for that name, and many +By default, a Windows NT Primary Domain Controller for a domain +is also the Domain master browser for that domain, and many things will break if a Samba server registers the Domain master browser NetBIOS name (DOMAIN<1B>) with WINS instead of the PDC. @@ -539,11 +541,11 @@ of the &smb.conf; file : If you wish to have a Samba server fight the election with machines -on the same subnet you may set the os level parameter +on the same subnet you may set the os level parameter to lower levels. By doing this you can tune the order of machines that will become local master browsers if they are running. For more details on this see the section -Forcing samba to be the master browser +Forcing Samba to be the master browser below. @@ -552,7 +554,7 @@ If you have Windows NT machines that are members of the domain on all subnets, and you are sure they will always be running then you can disable Samba from taking part in browser elections and ever becoming a local master browser by setting following options -in the [global] section of the &smb.conf; +in the [global] section of the &smb.conf; file : @@ -568,10 +570,10 @@ file : -Forcing samba to be the master +Forcing Samba to be the master -Who becomes the master browser is determined by an election +Who becomes the master browser is determined by an election process using broadcasts. Each election packet contains a number of parameters which determine what precedence (bias) a host should have in the election. By default Samba uses a very low precedence and thus loses @@ -579,44 +581,44 @@ elections to just about anyone else. -If you want Samba to win elections then just set the os level global +If you want Samba to win elections then just set the os level global option in &smb.conf; to a higher number. It defaults to 0. Using 34 would make it win all elections over every other system (except other samba systems!) -A os level of 2 would make it beat WfWg and Win95, but not MS Windows +A os level of 2 would make it beat WfWg and Win95, but not MS Windows NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32. The maximum os level is 255 -If you want samba to force an election on startup, then set the -preferred master global option in &smb.conf; to "yes". Samba will +If you want Samba to force an election on startup, then set the +preferred master global option in &smb.conf; to yes. Samba will then have a slight advantage over other potential master browsers that are not preferred master browsers. Use this parameter with -care, as if you have two hosts (whether they are windows 95 or NT or -samba) on the same local subnet both set with preferred master to -"yes", then periodically and continually they will force an election +care, as if you have two hosts (whether they are Windows 95 or NT or +Samba) on the same local subnet both set with preferred master to +yes, then periodically and continually they will force an election in order to become the local master browser. -If you want samba to be a domain master browser, then it is -recommended that you also set preferred master to "yes", because -samba will not become a domain master browser for the whole of your +If you want Samba to be a domain master browser, then it is +recommended that you also set preferred master to yes, because +Samba will not become a domain master browser for the whole of your LAN or WAN if it is not also a local master browser on its own broadcast isolated subnet. -It is possible to configure two samba servers to attempt to become +It is possible to configure two Samba servers to attempt to become the domain master browser for a domain. The first server that comes -up will be the domain master browser. All other samba servers will +up will be the domain master browser. All other Samba servers will attempt to become the domain master browser every 5 minutes. They -will find that another samba server is already the domain master +will find that another Samba server is already the domain master browser and will fail. This provides automatic redundancy, should the current domain master browser fail. @@ -624,36 +626,36 @@ the current domain master browser fail. -Making samba the domain master +Making Samba the domain master The domain master is responsible for collating the browse lists of multiple subnets so that browsing can occur between subnets. You can -make samba act as the domain master by setting domain master = yes +make Samba act as the domain master by setting domain master = yes in &smb.conf;. By default it will not be a domain master. -Note that you should NOT set Samba to be the domain master for a +Note that you should not set Samba to be the domain master for a workgroup that has the same name as an NT Domain. -When samba is the domain master and the master browser it will listen +When Samba is the domain master and the master browser, it will listen for master announcements (made roughly every twelve minutes) from local master browsers on other subnets and then contact them to synchronise browse lists. -If you want samba to be the domain master then I suggest you also set -the os level high enough to make sure it wins elections, and set -preferred master to "yes", to get samba to force an election on +If you want Samba to be the domain master then I suggest you also set +the os level high enough to make sure it wins elections, and set +preferred master to yes, to get Samba to force an election on startup. -Note that all your servers (including samba) and clients should be +Note that all your servers (including Samba) and clients should be using a WINS server to resolve NetBIOS names. If your clients are only using broadcasting to resolve NetBIOS names, then two things will occur: @@ -676,15 +678,15 @@ using broadcasting to resolve NetBIOS names, then two things will occur: -If, however, both samba and your clients are using a WINS server, then: +If, however, both Samba and your clients are using a WINS server, then: your local master browsers will contact the WINS server and, as long as - samba has registered that it is a domain master browser with the WINS - server, your local master browser will receive samba's ip address + Samba has registered that it is a domain master browser with the WINS + server, your local master browser will receive Samba's IP address as its domain master browser. @@ -723,16 +725,16 @@ option in &smb.conf; to configure them. -Use of the <command>Remote Announce</command> parameter +Use of the Remote Announce parameter -The remote announce parameter of +The remote announce parameter of smb.conf can be used to forcibly ensure that all the NetBIOS names on a network get announced to a remote network. -The syntax of the remote announce parameter is: +The syntax of the remote announce parameter is: remote announce = a.b.c.d [e.f.g.h] ... -_or_ +or remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ... @@ -742,12 +744,12 @@ where: a.b.c.d and e.f.g.h is either the LMB (Local Master Browser) IP address -or the broadcst address of the remote network. +or the broadcast address of the remote network. ie: the LMB is at 192.168.1.10, or the address could be given as 192.168.1.255 where the netmask is assumed to be 24 bits (255.255.255.0). When the remote announcement is made to the broadcast -address of the remote network every host will receive +address of the remote network, every host will receive our announcements. This is noisy and therefore undesirable but may be necessary if we do NOT know the IP address of the remote LMB. @@ -769,18 +771,18 @@ name resolution problems and should be avoided. -Use of the <command>Remote Browse Sync</command> parameter +Use of the Remote Browse Sync parameter -The remote browse sync parameter of +The remote browse sync parameter of smb.conf is used to announce to -another LMB that it must synchronise it's NetBIOS name list with our +another LMB that it must synchronise its NetBIOS name list with our Samba LMB. It works ONLY if the Samba server that has this option is -simultaneously the LMB on it's network segment. +simultaneously the LMB on its network segment. -The syntax of the remote browse sync parameter is: +The syntax of the remote browse sync parameter is: remote browse sync = a.b.c.d @@ -798,11 +800,11 @@ remote LMB or else is the network broadcast address of the remote segment. WINS - The Windows Internetworking Name Server -Use of WINS (either Samba WINS _or_ MS Windows NT Server WINS) is highly -recommended. Every NetBIOS machine registers it's name together with a -name_type value for each of of several types of service it has available. -eg: It registers it's name directly as a unique (the type 0x03) name. -It also registers it's name if it is running the lanmanager compatible +Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly +recommended. Every NetBIOS machine registers its name together with a +name_type value for each of several types of service it has available. +eg: It registers its name directly as a unique (the type 0x03) name. +It also registers its name if it is running the LanManager compatible server service (used to make shares and printers available to other users) by registering the server (the type 0x20) name. @@ -821,7 +823,7 @@ that wants to log onto the network can ask the WINS server for a list of all names that have registered the NetLogon service name_type. This saves broadcast traffic and greatly expedites logon processing. Since broadcast name resolution can not be used across network segments this type of -information can only be provided via WINS _or_ via statically configured +information can only be provided via WINS or via statically configured lmhosts files that must reside on all clients in the absence of WINS. @@ -848,18 +850,18 @@ errors. To configure Samba as a WINS server just add -wins support = yes to the smb.conf +wins support = yes to the smb.conf file [globals] section. To configure Samba to register with a WINS server just add -"wins server = a.b.c.d" to your smb.conf file [globals] section. +wins server = a.b.c.d to your &smb.conf; file [globals] section. -Never use both wins support = yes together -with wins server = a.b.c.d +Never use both wins support = yes together +with wins server = a.b.c.d particularly not using it's own IP address. Specifying both will cause &nmbd; to refuse to start! @@ -871,7 +873,7 @@ Specifying both will cause &nmbd; to refuse to start! Either a Samba machine or a Windows NT Server machine may be set up as a WINS server. To set a Samba machine to be a WINS server you must add the following option to the &smb.conf; file on the selected machine : -in the [globals] section add the line +in the [globals] section add the line @@ -888,13 +890,13 @@ least set the parameter to 'no' on all these machines. -Machines with wins support = yes will keep a list of +Machines with wins support = yes will keep a list of all NetBIOS names registered with them, acting as a DNS for NetBIOS names. -You should set up only ONE wins server. Do NOT set the -wins support = yes option on more than one Samba +You should set up only ONE WINS server. Do NOT set the +wins support = yes option on more than one Samba server. @@ -903,22 +905,22 @@ To set up a Windows NT Server as a WINS server you need to set up the WINS service - see your NT documentation for details. Note that Windows NT WINS Servers can replicate to each other, allowing more than one to be set up in a complex subnet environment. As Microsoft -refuse to document these replication protocols Samba cannot currently +refuses to document these replication protocols, Samba cannot currently participate in these replications. It is possible in the future that a Samba->Samba WINS replication protocol may be defined, in which case more than one Samba machine could be set up as a WINS server but currently only one Samba server should have the -wins support = yes parameter set. +wins support = yes parameter set. After the WINS server has been configured you must ensure that all machines participating on the network are configured with the address of this WINS server. If your WINS server is a Samba machine, fill in -the Samba machine IP address in the "Primary WINS Server" field of -the "Control Panel->Network->Protocols->TCP->WINS Server" dialogs +the Samba machine IP address in the Primary WINS Server field of +the Control Panel->Network->Protocols->TCP->WINS Server dialogs in Windows 95 or Windows NT. To tell a Samba server the IP address -of the WINS server add the following line to the [global] section of +of the WINS server add the following line to the [global] section of all &smb.conf; files : @@ -936,8 +938,8 @@ machine or its IP address. Note that this line MUST NOT BE SET in the &smb.conf; file of the Samba server acting as the WINS server itself. If you set both the -wins support = yes option and the -wins server = <name> option then +wins support = yes option and the +wins server = <name> option then nmbd will fail to start. @@ -966,14 +968,41 @@ section of the documentation to provide usage and technical details. Static WINS Entries -New to Samba-3 is a tool called winsedit that may be used to add -static WINS entries to the WINS database. This tool can be used also to modify entries -existing in the WINS database. +Adding static entries to your Samba-3 WINS server is actually fairly easy. +All you have to do is add a line to wins.dat, typically +located in /usr/local/samba/var/locks. -The development of the winsedit tool was made necessary due to the migration -of the older style wins.dat file into a new tdb binary backend data store. +Entries in wins.dat take the form of + + +"NAME#TYPE" TTL ADDRESS+ FLAGS + + +where NAME is the NetBIOS name, TYPE is the NetBIOS type, TTL is the +time-to-live as an absolute time in seconds, ADDRESS+ is one or more +addresses corresponding to the registration and FLAGS are the NetBIOS +flags for the registration. + + + +A typical dynamic entry looks like: + +"MADMAN#03" 1055298378 192.168.1.2 66R + + +To make it static, all that has to be done is set the TTL to 0: + + +"MADMAN#03" 0 192.168.1.2 66R + + + + +Though this method works with early Samba-3 versions, there's a +possibility that it may change in future versions if WINS replication +is added. @@ -1002,7 +1031,7 @@ one protocol on an MS Windows machine. Every NetBIOS machine takes part in a process of electing the LMB (and DMB) every 15 minutes. A set of election criteria is used to determine the order -of precidence for winning this election process. A machine running Samba or +of precedence for winning this election process. A machine running Samba or Windows NT will be biased so that the most suitable machine will predictably win and thus retain it's role. @@ -1040,7 +1069,8 @@ The safest rule of all to follow it this - USE ONLY ONE PROTOCOL! Resolution of NetBIOS names to IP addresses can take place using a number of methods. The only ones that can provide NetBIOS name_type information -are: +are: + WINS: the best tool! @@ -1049,26 +1079,28 @@ are: -Alternative means of name resolution includes: +Alternative means of name resolution includes: + -/etc/hosts: is static, hard to maintain, and lacks name_type info +/etc/hosts: is static, hard to maintain, and lacks name_type info DNS: is a good choice but lacks essential name_type info. Many sites want to restrict DNS lookups and want to avoid broadcast name -resolution traffic. The "name resolve order" parameter is of great help here. -The syntax of the "name resolve order" parameter is: +resolution traffic. The name resolve order parameter is +of great help here. The syntax of the name resolve order +parameter is: name resolve order = wins lmhosts bcast host -_or_ +or name resolve order = wins lmhosts (eliminates bcast and host) The default is: -name resolve order = host lmhost wins bcast +name resolve order = host lmhost wins bcast where "host" refers the the native methods used by the Unix system to implement the gethostbyname() function call. This is normally @@ -1082,7 +1114,7 @@ controlled by /etc/host.conf, /etc/nsswitch.conf< SMB networking provides a mechanism by which clients can access a list -of machines in a network, a so-called browse list. This list +of machines in a network, a so-called browse list. This list contains machines that are ready to offer file and/or print services to other machines within the network. Thus it does not include machines which aren't currently able to do server tasks. The browse @@ -1093,7 +1125,7 @@ document. MS Windows 2000 and later, as with Samba 3 and later, can be -configured to not use NetBIOS over TCP/IP. When configured this way +configured to not use NetBIOS over TCP/IP. When configured this way, it is imperative that name resolution (using DNS/LDAP/ADS) be correctly configured and operative. Browsing will NOT work if name resolution from SMB machine names to IP addresses does not function correctly. @@ -1107,7 +1139,7 @@ that can NOT be provided by any other means of name resolution. -Browsing support in samba +Browsing support in Samba Samba facilitates browsing. The browsing is supported by &nmbd; @@ -1121,7 +1153,7 @@ Samba can also act as a domain master browser for a workgroup. This means that it will collate lists from local browse masters into a wide area network server list. In order for browse clients to resolve the names they may find in this list, it is recommended that -both samba and your clients use a WINS server. +both Samba and your clients use a WINS server. @@ -1134,17 +1166,17 @@ that is providing this service. Nmbd can be configured as a WINS server, but it is not -necessary to specifically use samba as your WINS server. MS Windows +necessary to specifically use Samba as your WINS server. MS Windows NT4, Server or Advanced Server 2000 or 2003 can be configured as -your WINS server. In a mixed NT/2000/2003 server and samba environment on +your WINS server. In a mixed NT/2000/2003 server and Samba environment on a Wide Area Network, it is recommended that you use the Microsoft -WINS server capabilities. In a samba-only environment, it is +WINS server capabilities. In a Samba-only environment, it is recommended that you use one and only one Samba server as your WINS server. To get browsing to work you need to run nmbd as usual, but will need -to use the workgroup option in &smb.conf; +to use the workgroup option in &smb.conf; to control what workgroup Samba becomes a part of. @@ -1152,7 +1184,7 @@ to control what workgroup Samba becomes a part of. Samba also has a useful option for a Samba server to offer itself for browsing on another subnet. It is recommended that this option is only used for 'unusual' purposes: announcements over the internet, for -example. See remote announce in the +example. See remote announce in the &smb.conf; man page. @@ -1161,7 +1193,7 @@ example. See remote announce in the Problem resolution -If something doesn't work then hopefully the log.nmb file will help +If something doesn't work then hopefully the log.nmbd file will help you track down the problem. Try a debug level of 2 or 3 for finding problems. Also note that the current browse list usually gets stored in text form in a file called browse.dat. @@ -1175,7 +1207,7 @@ hit enter and filemanager should display the list of available shares. Some people find browsing fails because they don't have the global -guest account set to a valid account. Remember that the +guest account set to a valid account. Remember that the IPC$ connection that lists the shares is done as guest, and thus you must have a valid guest account. @@ -1199,16 +1231,14 @@ in &smb.conf;) Browsing across subnets -Since the release of Samba 1.9.17(alpha1) Samba has been -updated to enable it to support the replication of browse lists -across subnet boundaries. New code and options have been added to -achieve this. This section describes how to set this feature up -in different settings. +Since the release of Samba 1.9.17(alpha1), Samba has supported the +replication of browse lists across subnet boundaries. This section +describes how to set this feature up in different settings. To see browse lists that span TCP/IP subnets (ie. networks separated -by routers that don't pass broadcast traffic) you must set up at least +by routers that don't pass broadcast traffic), you must set up at least one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing NetBIOS name to IP address translation to be done by doing a direct query of the WINS server. This is done via a directed UDP packet on @@ -1242,6 +1272,7 @@ Consider a network set up as follows : + (DMB) N1_A N1_B N1_C N1_D N1_E @@ -1265,7 +1296,7 @@ Consisting of 3 subnets (1, 2, 3) connected by two routers (R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume for the moment that all these machines are configured to be in the -same workgroup (for simplicities sake). Machine N1_C on subnet 1 +same workgroup (for simplicity's sake). Machine N1_C on subnet 1 is configured as Domain Master Browser (ie. it will collate the browse lists for the workgroup). Machine N2_D is configured as WINS server and all the other machines are configured to register @@ -1312,15 +1343,20 @@ you looked in it on a particular network right now). - -Subnet Browse Master List ------- ------------- ---- -Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E + + Browse subnet example 1 + + + SubnetBrowse MasterList + -Subnet2 N2_B N2_A, N2_B, N2_C, N2_D - -Subnet3 N3_D N3_A, N3_B, N3_C, N3_D - + + Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E + Subnet2N2_BN2_A, N2_B, N2_C, N2_D + Subnet3N3_DN3_A, N3_B, N3_C, N3_D + + +
 @@ -1333,7 +1369,7 @@ Now examine subnet 2. As soon as N2_B has become the local master browser it looks for a Domain master browser to synchronize its browse list with. It does this by querying the WINS server (N2_D) for the IP address associated with the NetBIOS name -WORKGROUP<1B>. This name was registerd by the Domain master +WORKGROUP<1B>. This name was registered by the Domain master browser (N1_C) with the WINS server as soon as it was booted. @@ -1350,19 +1386,22 @@ are done the browse lists look like : - -Subnet Browse Master List ------- ------------- ---- -Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, - N2_A(*), N2_B(*), N2_C(*), N2_D(*) + + Browse subnet example 2 + + + SubnetBrowse MasterList + -Subnet2 N2_B N2_A, N2_B, N2_C, N2_D - N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) - -Subnet3 N3_D N3_A, N3_B, N3_C, N3_D + + Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*) + Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) + Subnet3N3_DN3_A, N3_B, N3_C, N3_D + + +
Servers with a (*) after them are non-authoritative names. - @@ -1381,55 +1420,54 @@ the browse lists look like. - -Subnet Browse Master List ------- ------------- ---- -Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, - N2_A(*), N2_B(*), N2_C(*), N2_D(*), - N3_A(*), N3_B(*), N3_C(*), N3_D(*) - -Subnet2 N2_B N2_A, N2_B, N2_C, N2_D - N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) + + Browse subnet example 3 + + + SubnetBrowse MasterList + -Subnet3 N3_D N3_A, N3_B, N3_C, N3_D - N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), - N2_A(*), N2_B(*), N2_C(*), N2_D(*) + + Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) + Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) + Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*) + + +
Servers with a (*) after them are non-authoritative names. - At this point users looking in their network neighborhood on -subnets 1 or 3 will see all the servers on all sunbets, users on +subnets 1 or 3 will see all the servers on all subnets, users on subnet 2 will still only see the servers on subnets 1 and 2, but not 3. Finally, the local master browser for subnet 2 (N2_B) will sync again -with the domain master browser (N1_C) and will recieve the missing +with the domain master browser (N1_C) and will receive the missing server entries. Finally - and as a steady state (if no machines are removed or shut off) the browse lists will look like : - -Subnet Browse Master List ------- ------------- ---- -Subnet1 N1_C N1_A, N1_B, N1_C, N1_D, N1_E, - N2_A(*), N2_B(*), N2_C(*), N2_D(*), - N3_A(*), N3_B(*), N3_C(*), N3_D(*) - -Subnet2 N2_B N2_A, N2_B, N2_C, N2_D - N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) - N3_A(*), N3_B(*), N3_C(*), N3_D(*) - -Subnet3 N3_D N3_A, N3_B, N3_C, N3_D - N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), - N2_A(*), N2_B(*), N2_C(*), N2_D(*) + + Browse subnet example 4 + + + SubnetBrowse MasterList + + + + Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) + Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) + Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*) + + +
Servers with a (*) after them are non-authoritative names. - @@ -1475,17 +1513,17 @@ If either router R1 or R2 fails the following will occur: Common Errors -Many questions are sked on the mailing lists regarding browsing. The majority of browsing +Many questions are asked on the mailing lists regarding browsing. The majority of browsing problems originate out of incorrect configuration of NetBIOS name resolution. Some are of particular note. -How can one flush the Samba NetBIOS name cache without restarting samba? +How can one flush the Samba NetBIOS name cache without restarting Samba? -Sambas' nmbd process controls all browse list handling. Under normal circumstances it is -safe to restart nmbd. This will effectively flush the samba NetBIOS name cache and cause it +Samba's nmbd process controls all browse list handling. Under normal circumstances it is +safe to restart nmbd. This will effectively flush the Samba NetBIOS name cache and cause it to be rebuilt. Note that this does NOT make certain that a rogue machine name will not re-appear in the browse list. When nmbd is taken out of service another machine on the network will become the browse master. This new list may still have the rogue entry in it. If you really @@ -1496,5 +1534,19 @@ This may take a long time on some networks (months). + + +My client reports "This server is not configured to list shared resources" + + +Your guest account is probably invalid for some reason. Samba uses the +guest account for browsing in smbd. Check that your guest account is +valid. + + +See also guest account in the &smb.conf; man page. + + + diff --git a/docs/docbook/projdoc/Other-Clients.xml b/docs/docbook/projdoc/Other-Clients.xml index b9f4cf3a93..d05c58c89d 100644 --- a/docs/docbook/projdoc/Other-Clients.xml +++ b/docs/docbook/projdoc/Other-Clients.xml @@ -14,7 +14,7 @@ Macintosh clients? -Yes. Thursby now have a CIFS Client / Server called DAVE +Yes. Thursby now has a CIFS Client / Server called DAVE @@ -27,10 +27,10 @@ enhanced, and there are bug-fixes included). Alternatives - There are two free implementations of AppleTalk for -several kinds of UNIX machnes, and several more commercial ones. +several kinds of UNIX machines, and several more commercial ones. These products allow you to run file services and print services natively to Macintosh users, with no additional support required on -the Macintosh. The two free omplementations are +the Macintosh. The two free implementations are Netatalk, and CAP. What Samba offers MS @@ -54,14 +54,11 @@ packages, Samba, and Linux (and other UNIX-based systems) see Basically, you need three components: - - The File and Print Client ('IBM Peer') - - TCP/IP ('Internet support') - - The "NetBIOS over TCP/IP" driver ('TCPBEUI') - - + + The File and Print Client ('IBM Peer') + TCP/IP ('Internet support') + The "NetBIOS over TCP/IP" driver ('TCPBEUI') + Installing the first two together with the base operating system on a blank system is explained in the Warp manual. If Warp @@ -113,41 +110,27 @@ packages, Samba, and Linux (and other UNIX-based systems) see - - Are there any other issues when OS/2 (any version) - is used as a client? - - When you do a NET VIEW or use the "File and Print - Client Resource Browser", no Samba servers show up. This can - be fixed by a patch from - http://carol.wins.uva.nl/~leeuw/samba/fix.html. - The patch will be included in a later version of Samba. It also - fixes a couple of other problems, such as preserving long - filenames when objects are dragged from the Workplace Shell - to the Samba server. - - How do I get printer driver download working for OS/2 clients? - First, create a share called [PRINTDRV] that is + First, create a share called [PRINTDRV] that is world-readable. Copy your OS/2 driver files there. Note that the .EA_ files must still be separate, so you will need to use the original install files, and not copy an installed driver from an OS/2 system. Install the NT driver first for that printer. Then, - add to your smb.conf a parameter, os2 driver map = - filename". Then, in the file + add to your &smb.conf; a parameter, os2 driver map = + filename. Then, in the file specified by filename, map the name of the NT driver name to the OS/2 driver name as follows: - nt driver name = os2 "driver - name"."device name", e.g.: - HP LaserJet 5L = LASERJET.HP LaserJet 5L + nt driver name = os2 driver name.device name, e.g.: + + + HP LaserJet 5L = LASERJET.HP LaserJet 5L You can have multiple drivers mapped in this file. @@ -167,8 +150,8 @@ packages, Samba, and Linux (and other UNIX-based systems) see Use latest TCP/IP stack from Microsoft -Use the latest TCP/IP stack from microsoft if you use Windows -for workgroups. +Use the latest TCP/IP stack from Microsoft if you use Windows +for Workgroups. The early TCP/IP stacks had lots of bugs. @@ -176,10 +159,16 @@ for workgroups. Microsoft has released an incremental upgrade to their TCP/IP 32-Bit VxD drivers. The latest release can be found on their ftp site at -ftp.microsoft.com, located in /peropsys/windows/public/tcpip/wfwt32.exe. +ftp.microsoft.com, located in /peropsys/windows/public/tcpip/wfwt32.exe. There is an update.txt file there that describes the problems that were -fixed. New files include WINSOCK.DLL, TELNET.EXE, WSOCK.386, VNBT.386, -WSTCP.386, TRACERT.EXE, NETSTAT.EXE, and NBTSTAT.EXE. +fixed. New files include WINSOCK.DLL, +TELNET.EXE, +WSOCK.386, +VNBT.386, +WSTCP.386, +TRACERT.EXE, +NETSTAT.EXE, and +NBTSTAT.EXE. @@ -210,10 +199,11 @@ Often WfWg will totally ignore a password you give it in a dialog box. There is a program call admincfg.exe on the last disk (disk 8) of the WFW 3.11 disk set. To install it -type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE Then add an icon -for it via the "Progam Manager" "New" Menu. This program allows you -to control how WFW handles passwords. ie disable Password Caching etc -for use with security = user +type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE. +Then add an icon +for it via the Program Manager New Menu. +This program allows you to control how WFW handles passwords. ie disable Password Caching etc +for use with security = user @@ -221,7 +211,7 @@ for use with security = user Case handling of passwords -Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf(5) information on password level to specify what characters samba should try to uppercase when checking. +Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf(5) information on password level to specify what characters samba should try to uppercase when checking. @@ -230,7 +220,7 @@ for use with security = user To support print queue reporting you may find that you have to use TCP/IP as the default protocol under -WfWg. For some reason if you leave Netbeui as the default +WfWg. For some reason if you leave NetBEUI as the default it may break the print queue reporting on some systems. It is presumably a WfWg bug. @@ -240,15 +230,16 @@ It is presumably a WfWg bug. Speed improvement -Note that some people have found that setting DefaultRcvWindow in -the [MSTCP] section of the SYSTEM.INI file under WfWg to 3072 gives a +Note that some people have found that setting DefaultRcvWindow in +the [MSTCP] section of the +SYSTEM.INI file under WfWg to 3072 gives a big improvement. I don't know why. -My own experience wth DefaultRcvWindow is that I get much better +My own experience with DefaultRcvWindow is that I get much better performance with a large value (16384 or larger). Other people have -reported that anything over 3072 slows things down enourmously. One +reported that anything over 3072 slows things down enormously. One person even reported a speed drop of a factor of 30 when he went from 3072 to 8192. I don't know why. @@ -270,18 +261,19 @@ Microsoft Web site for all currently available updates to your specific version of Windows 95. - -Kernel Update: KRNLUPD.EXE -Ping Fix: PINGUPD.EXE -RPC Update: RPCRTUPD.EXE -TCP/IP Update: VIPUPD.EXE -Redirector Update: VRDRUPD.EXE - + +Kernel Update: KRNLUPD.EXE +Ping Fix: PINGUPD.EXE +RPC Update: RPCRTUPD.EXE +TCP/IP Update: VIPUPD.EXE +Redirector Update: VRDRUPD.EXE + -Also, if using MS OutLook it is desirable to install the OLEUPD.EXE fix. This +Also, if using MS Outlook it is desirable to +install the OLEUPD.EXE fix. This fix may stop your machine from hanging for an extended period when exiting -OutLook and you may also notice a significant speedup when accessing network +Outlook and you may also notice a significant speedup when accessing network neighborhood services. @@ -290,7 +282,7 @@ neighborhood services. Configure the win95 TCPIP registry settings to give better -performance. I use a program called MTUSPEED.exe which I got off the +performance. I use a program called MTUSPEED.exe which I got off the net. There are various other utilities of this type freely available. @@ -312,7 +304,7 @@ likely occur if it is not. In order to serve profiles successfully to Windows 2000 SP2 clients (when not operating as a PDC), Samba must have -nt acl support = no +nt acl support = no added to the file share which houses the roaming profiles. If this is not done, then the Windows 2000 SP2 client will complain about not being able to access the profile (Access @@ -320,7 +312,7 @@ Denied) and create multiple copies of it on disk (DOMAIN.user.001, DOMAIN.user.002, etc...). See the smb.conf(5) man page for more details on this option. Also note that the -nt acl support parameter was formally a global parameter in +nt acl support parameter was formally a global parameter in releases prior to Samba 2.2.2. @@ -343,17 +335,17 @@ the security descriptor for the profile which contains the Samba server's SID, and not the domain SID. The client compares the SID for SAMBA\user and realizes it is different that the one assigned to DOMAIN\user. Hence the reason -for the "access denied" message. +for the access denied message. -By disabling the nt acl support parameter, Samba will send +By disabling the nt acl support parameter, Samba will send the Win2k client a response to the QuerySecurityDescriptor trans2 call which causes the client to set a default ACL for the profile. This default ACL includes -DOMAIN\user "Full Control" +DOMAIN\user "Full Control"> This bug does not occur when using winbind to create accounts on the Samba host for Domain users. diff --git a/docs/docbook/projdoc/PAM-Authentication-And-Samba.xml b/docs/docbook/projdoc/PAM-Authentication-And-Samba.xml index 4b5179acc7..660efdd295 100644 --- a/docs/docbook/projdoc/PAM-Authentication-And-Samba.xml +++ b/docs/docbook/projdoc/PAM-Authentication-And-Samba.xml @@ -1,46 +1,462 @@ &author.jht; - (Jun 21 2001) + + StephenLangasek + +
vorlon@netexpress.net
+ + + May 31, 2003 -PAM Configuration for Centrally Managed Authentication +PAM based Distributed Authentication + + +This chapter you should help you to deploy winbind based authentication on any PAM enabled +Unix/Linux system. Winbind can be used to enable user level application access authentication +from any MS Windows NT Domain, MS Windows 200x Active Directory based domain, or any Samba +based domain environment. It will also help you to configure PAM based local host access +controls that are appropriate to your Samba configuration. + + + +In addition to knowing how to configure winbind into PAM, you will learn generic PAM management +possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage. + + + +The use of Winbind require more than PAM configuration alone. Please refer to the Winbind chapter. + -Samba and PAM - - -A number of Unix systems (eg: Sun Solaris), as well as the -xxxxBSD family and Linux, now utilize the Pluggable Authentication -Modules (PAM) facility to provide all authentication, -authorization and resource control services. Prior to the -introduction of PAM, a decision to use an alternative to -the system password database (/etc/passwd) -would require the provision of alternatives for all programs that provide -security services. Such a choice would involve provision of -alternatives to such programs as: login, +Features and Benefits + + +A number of Unix systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, +now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication, +authorization and resource control services. Prior to the introduction of PAM, a decision +to use an alternative to the system password database (/etc/passwd) +would require the provision of alternatives for all programs that provide security services. +Such a choice would involve provision of alternatives to such programs as: login, passwd, chown, etc. -PAM provides a mechanism that disconnects these security programs -from the underlying authentication/authorization infrastructure. -PAM is configured either through one file /etc/pam.conf (Solaris), -or by editing individual files that are located in /etc/pam.d. +PAM provides a mechanism that disconnects these security programs from the underlying +authentication/authorization infrastructure. PAM is configured either through one file +/etc/pam.conf (Solaris), or by editing individual files that are +located in /etc/pam.d. - - - If the PAM authentication module (loadable link library file) is located in the - default location then it is not necessary to specify the path. In the case of - Linux, the default location is /lib/security. If the module - is located outside the default then the path must be specified as: - - - auth required /other_path/pam_strange_module.so - - - + +On PAM enabled Unix/Linux systems it is an easy matter to configure the system to use any +authentication backend, so long as the appropriate dynamically loadable library modules +are available for it. The backend may be local to the system, or may be centralised on a +remote server. + + + +PAM support modules are available for: + + + + /etc/passwd- + + There are several PAM modules that interact with this standard Unix user + database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so + and pam_userdb.so. + + + + Kerberos- + + The pam_krb5.so module allows the use of any Kerberos compliant server. + This tool is used to access MIT Kerberos, Heimdal Kerberos, and potentially + Microsoft Active Directory (if enabled). + + + + LDAP- + + The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend + server. Commonly used LDAP backend servers include: OpenLDAP v2.0 and v2.1, + Sun ONE iDentity server, Novell eDirectory server, Microsoft Active Directory. + + + + NetWare Bindery- + + The pam_ncp_auth.so module allows authentication off any bindery enabled + NetWare Core Protocol based server. + + + + SMB Password- + + This module, called pam_smbpass.so, will allow user authentication off + the passdb backend that is configured in the Samba &smb.conf; file. + + + + SMB Server- + + The pam_smb_auth.so module is the original MS Windows networking authentication + tool. This module has been somewhat outdated by the Winbind module. + + + + Winbind- + + The pam_winbind.so module allows Samba to obtain authentication from any + MS Windows Domain Controller. It can just as easily be used to authenticate + users for access to any PAM enabled application. + + + + RADIUS- + + There is a PAM RADIUS (Remote Access Dial-In User Service) authentication + module. In most cases the administrator will need to locate the source code + for this tool and compile and install it themselves. RADIUS protocols are + used by many routers and terminal servers. + + + + + +Of the above, Samba provides the pam_smbpasswd.so and the pam_winbind.so modules alone. + + + +Once configured, these permit a remarkable level of flexibility in the location and use +of distributed samba domain controllers that can provide wide are network bandwidth +efficient authentication services for PAM capable systems. In effect, this allows the +deployment of centrally managed and maintained distributed authentication from a single +user account database. + + + + + +Technical Discussion + + +PAM is designed to provide the system administrator with a great deal of flexibility in +configuration of the privilege granting applications of their system. The local +configuration of system security controlled by PAM is contained in one of two places: +either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory. + + + +PAM Configuration Syntax + + +In this section we discuss the correct syntax of and generic options respected by entries to these files. +PAM specific tokens in the configuration file are case insensitive. The module paths, however, are case +sensitive since they indicate a file's name and reflect the case dependence of typical file-systems. +The case-sensitivity of the arguments to any given module is defined for each module in turn. + + + +In addition to the lines described below, there are two special characters provided for the convenience +of the system administrator: comments are preceded by a `#' and extend to the next end-of-line; also, +module specification lines may be extended with a `\' escaped newline. + + + +If the PAM authentication module (loadable link library file) is located in the +default location then it is not necessary to specify the path. In the case of +Linux, the default location is /lib/security. If the module +is located outside the default then the path must be specified as: + + + + +auth required /other_path/pam_strange_module.so + + + + +Anatomy of <filename>/etc/pam.d</filename> Entries + + +The remaining information in this subsection was taken from the documentation of the Linux-PAM +project. For more information on PAM, see + +http://ftp.kernel.org/pub/linux/libs/pam The Official Linux-PAM home page. + + + +A general configuration line of the /etc/pam.conf file has the following form: + + + + +service-name module-type control-flag module-path args + + + + +Below, we explain the meaning of each of these tokens. The second (and more recently adopted) +way of configuring Linux-PAM is via the contents of the /etc/pam.d/ directory. +Once we have explained the meaning of the above tokens, we will describe this method. + + + + service-name- + + The name of the service associated with this entry. Frequently the service name is the conventional + name of the given application. For example, `ftpd', `rlogind' and `su', etc. . + + + + There is a special service-name, reserved for defining a default authentication mechanism. It has + the name `OTHER' and may be specified in either lower or upper case characters. Note, when there + is a module specified for a named service, the `OTHER' entries are ignored. + + + + module-type- + + One of (currently) four types of module. The four types are as follows: + + + + + auth: this module type provides two aspects of authenticating the user. + Firstly, it establishes that the user is who they claim to be, by instructing the application + to prompt the user for a password or other means of identification. Secondly, the module can + grant group membership (independently of the /etc/groups file discussed + above) or other privileges through its credential granting properties. + + + + account: this module performs non-authentication based account management. + It is typically used to restrict/permit access to a service based on the time of day, currently + available system resources (maximum number of users) or perhaps the location of the applicant + user `root' login only on the console. + + + + session: primarily, this module is associated with doing things that need + to be done for the user before/after they can be given service. Such things include the logging + of information concerning the opening/closing of some data exchange with a user, mounting + directories, etc. + + + + password: this last module type is required for updating the authentication + token associated with the user. Typically, there is one module for each `challenge/response' + based authentication (auth) module-type. + + + + + control-flag- + + The control-flag is used to indicate how the PAM library will react to the success or failure of the + module it is associated with. Since modules can be stacked (modules of the same type execute in series, + one after another), the control-flags determine the relative importance of each module. The application + is not made aware of the individual success or failure of modules listed in the + /etc/pam.conf file. Instead, it receives a summary success or fail response from + the Linux-PAM library. The order of execution of these modules is that of the entries in the + /etc/pam.conf file; earlier entries are executed before later ones. + As of Linux-PAM v0.60, this control-flag can be defined with one of two syntaxes. + + + + The simpler (and historical) syntax for the control-flag is a single keyword defined to indicate the + severity of concern associated with the success or failure of a specific module. There are four such + keywords: required, requisite, sufficient and optional. + + + + The Linux-PAM library interprets these keywords in the following manner: + + + + + required: this indicates that the success of the module is required for the + module-type facility to succeed. Failure of this module will not be apparent to the user until all + of the remaining modules (of the same module-type) have been executed. + + + + requisite: like required, however, in the case that such a module returns a + failure, control is directly returned to the application. The return value is that associated with + the first required or requisite module to fail. Note, this flag can be used to protect against the + possibility of a user getting the opportunity to enter a password over an unsafe medium. It is + conceivable that such behavior might inform an attacker of valid accounts on a system. This + possibility should be weighed against the not insignificant concerns of exposing a sensitive + password in a hostile environment. + + + + sufficient: the success of this module is deemed `sufficient' to satisfy + the Linux-PAM library that this module-type has succeeded in its purpose. In the event that no + previous required module has failed, no more `stacked' modules of this type are invoked. (Note, + in this case subsequent required modules are not invoked.). A failure of this module is not deemed + as fatal to satisfying the application that this module-type has succeeded. + + + + optional: as its name suggests, this control-flag marks the module as not + being critical to the success or failure of the user's application for service. In general, + Linux-PAM ignores such a module when determining if the module stack will succeed or fail. + However, in the absence of any definite successes or failures of previous or subsequent stacked + modules this module will determine the nature of the response to the application. One example of + this latter case, is when the other modules return something like PAM_IGNORE. + + + + + The more elaborate (newer) syntax is much more specific and gives the administrator a great deal of control + over how the user is authenticated. This form of the control flag is delimited with square brackets and + consists of a series of value=action tokens: + + + + [value1=action1 value2=action2 ...] + + + + Here, value1 is one of the following return values: success; open_err; symbol_err; service_err; + system_err; buf_err; perm_denied; auth_err; cred_insufficient; authinfo_unavail; user_unknown; maxtries; + new_authtok_reqd; acct_expired; session_err; cred_unavail; cred_expired; cred_err; no_module_data; conv_err; + authtok_err; authtok_recover_err; authtok_lock_busy; authtok_disable_aging; try_again; ignore; abort; + authtok_expired; module_unknown; bad_item; and default. The last of these (default) can be used to set + the action for those return values that are not explicitly defined. + + + + The action1 can be a positive integer or one of the following tokens: ignore; ok; done; bad; die; and reset. + A positive integer, J, when specified as the action, can be used to indicate that the next J modules of the + current module-type will be skipped. In this way, the administrator can develop a moderately sophisticated + stack of modules with a number of different paths of execution. Which path is taken can be determined by the + reactions of individual modules. + + + + + ignore: when used with a stack of modules, the module's return status will not + contribute to the return code the application obtains. + + + + bad: this action indicates that the return code should be thought of as indicative + of the module failing. If this module is the first in the stack to fail, its status value will be used + for that of the whole stack. + + + + die: equivalent to bad with the side effect of terminating the module stack and + PAM immediately returning to the application. + + + + ok: this tells PAM that the administrator thinks this return code should + contribute directly to the return code of the full stack of modules. In other words, if the former + state of the stack would lead to a return of PAM_SUCCESS, the module's return code will override + this value. Note, if the former state of the stack holds some value that is indicative of a modules + failure, this 'ok' value will not be used to override that value. + + + + done: equivalent to ok with the side effect of terminating the module stack and + PAM immediately returning to the application. + + + + reset: clear all memory of the state of the module stack and start again with + the next stacked module. + + + + + Each of the four keywords: required; requisite; sufficient; and optional, have an equivalent expression in + terms of the [...] syntax. They are as follows: + + + + + + required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad] + + + + requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die] + + + + sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore] + + + + optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore] + + + + + + Just to get a feel for the power of this new syntax, here is a taste of what you can do with it. With Linux-PAM-0.63, + the notion of client plug-in agents was introduced. This is something that makes it possible for PAM to support + machine-machine authentication using the transport protocol inherent to the client/server application. With the + [ ... value=action ... ] control syntax, it is possible for an application to be configured + to support binary prompts with compliant clients, but to gracefully fall over into an alternative authentication + mode for older, legacy, applications. + + + + + module-path- + + The path-name of the dynamically loadable object file; the pluggable module itself. If the first character of the + module path is `/', it is assumed to be a complete path. If this is not the case, the given module path is appended + to the default module path: /lib/security (but see the notes above). + + + + The args are a list of tokens that are passed to the module when it is invoked. Much like arguments to a typical + Linux shell command. Generally, valid arguments are optional and are specific to any given module. Invalid arguments + are ignored by a module, however, when encountering an invalid argument, the module is required to write an error + to syslog(3). For a list of generic options see the next section. + + + + Note, if you wish to include spaces in an argument, you should surround that argument with square brackets. For example: + + + +squid auth required pam_mysql.so user=passwd_query passwd=mada \ + db=eminence [query=select user_name from internet_service where \ + user_name='%u' and password=PASSWORD('%p') and \ + service='web_proxy'] + + + + Note, when using this convention, you can include `[' characters inside the string, and if you wish to include a `]' + character inside the string that will survive the argument parsing, you should use `\['. In other words: + + + +[..[..\]..] --> ..[..].. + + + + Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the + side of caution) to make the authentication process fail. A corresponding error is written to the system log files + with a call to syslog(3). + + + + + + + + + +Example System Configurations The following is an example /etc/pam.d/login configuration file. @@ -50,43 +466,50 @@ of the login process. Essentially all conditions can be disabled by commenting them out except the calls to pam_pwdb.so. - - #%PAM-1.0 - # The PAM configuration file for the `login' service - # - auth required pam_securetty.so - auth required pam_nologin.so - # auth required pam_dialup.so - # auth optional pam_mail.so - auth required pam_pwdb.so shadow md5 - # account requisite pam_time.so - account required pam_pwdb.so - session required pam_pwdb.so - # session optional pam_lastlog.so - # password required pam_cracklib.so retry=3 - password required pam_pwdb.so shadow md5 - + +PAM: original login config + + +#%PAM-1.0 +# The PAM configuration file for the `login' service +# +auth required pam_securetty.so +auth required pam_nologin.so +# auth required pam_dialup.so +# auth optional pam_mail.so +auth required pam_pwdb.so shadow md5 +# account requisite pam_time.so +account required pam_pwdb.so +session required pam_pwdb.so +# session optional pam_lastlog.so +# password required pam_cracklib.so retry=3 +password required pam_pwdb.so shadow md5 + + + + + +PAM: login using pam_smbpass -PAM allows use of replacable modules. Those available on a -sample system include: +PAM allows use of replaceable modules. Those available on a sample system include: $/bin/ls /lib/security - - pam_access.so pam_ftp.so pam_limits.so - pam_ncp_auth.so pam_rhosts_auth.so pam_stress.so - pam_cracklib.so pam_group.so pam_listfile.so - pam_nologin.so pam_rootok.so pam_tally.so - pam_deny.so pam_issue.so pam_mail.so - pam_permit.so pam_securetty.so pam_time.so - pam_dialup.so pam_lastlog.so pam_mkhomedir.so - pam_pwdb.so pam_shells.so pam_unix.so - pam_env.so pam_ldap.so pam_motd.so - pam_radius.so pam_smbpass.so pam_unix_acct.so - pam_wheel.so pam_unix_auth.so pam_unix_passwd.so - pam_userdb.so pam_warn.so pam_unix_session.so - + +pam_access.so pam_ftp.so pam_limits.so +pam_ncp_auth.so pam_rhosts_auth.so pam_stress.so +pam_cracklib.so pam_group.so pam_listfile.so +pam_nologin.so pam_rootok.so pam_tally.so +pam_deny.so pam_issue.so pam_mail.so +pam_permit.so pam_securetty.so pam_time.so +pam_dialup.so pam_lastlog.so pam_mkhomedir.so +pam_pwdb.so pam_shells.so pam_unix.so +pam_env.so pam_ldap.so pam_motd.so +pam_radius.so pam_smbpass.so pam_unix_acct.so +pam_wheel.so pam_unix_auth.so pam_unix_passwd.so +pam_userdb.so pam_warn.so pam_unix_session.so + The following example for the login program replaces the use of @@ -102,37 +525,37 @@ hashes. This database is stored in either Samba implementation for your Unix/Linux system. The pam_smbpass.so module is provided by Samba version 2.2.1 or later. It can be compiled by specifying the ---with-pam_smbpass options when running Samba's -configure script. For more information + options when running Samba's +configure script. For more information on the pam_smbpass module, see the documentation in the source/pam_smbpass directory of the Samba source distribution. - - #%PAM-1.0 - # The PAM configuration file for the `login' service - # - auth required pam_smbpass.so nodelay - account required pam_smbpass.so nodelay - session required pam_smbpass.so nodelay - password required pam_smbpass.so nodelay - + +#%PAM-1.0 +# The PAM configuration file for the `login' service +# +auth required pam_smbpass.so nodelay +account required pam_smbpass.so nodelay +session required pam_smbpass.so nodelay +password required pam_smbpass.so nodelay + The following is the PAM configuration file for a particular Linux system. The default condition uses pam_pwdb.so. - - #%PAM-1.0 - # The PAM configuration file for the `samba' service - # - auth required pam_pwdb.so nullok nodelay shadow audit - account required pam_pwdb.so audit nodelay - session required pam_pwdb.so nodelay - password required pam_pwdb.so shadow md5 - + +#%PAM-1.0 +# The PAM configuration file for the `samba' service +# +auth required pam_pwdb.so nullok nodelay shadow audit +account required pam_pwdb.so audit nodelay +session required pam_pwdb.so nodelay +password required pam_pwdb.so shadow md5 + In the following example the decision has been made to use the @@ -142,21 +565,21 @@ thus allow the smbpasswd passwords to be changed using the passwd program. - - #%PAM-1.0 - # The PAM configuration file for the `samba' service - # - auth required pam_smbpass.so nodelay - account required pam_pwdb.so audit nodelay - session required pam_pwdb.so nodelay - password required pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf - + +#%PAM-1.0 +# The PAM configuration file for the `samba' service +# +auth required pam_smbpass.so nodelay +account required pam_pwdb.so audit nodelay +session required pam_pwdb.so nodelay +password required pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf + PAM allows stacking of authentication mechanisms. It is also possible to pass information obtained within one PAM module through to the next module in the PAM stack. Please refer to the documentation for your particular system implementation for details regarding the specific -capabilities of PAM in this environment. Some Linux implmentations also +capabilities of PAM in this environment. Some Linux implementations also provide the pam_stack.so module that allows all authentication to be configured in a single central file. The pam_stack.so method has some very devoted followers @@ -165,8 +588,12 @@ life though, every decision makes trade-offs, so you may want examine the PAM documentation for further helpful information. + + + + -PAM Configuration in smb.conf +smb.conf PAM Configuration There is an option in smb.conf called -When Samba is configured to enable PAM support (i.e. ---with-pam), this parameter will +When Samba-3 is configured to enable PAM support (i.e. +), this parameter will control whether or not Samba should obey PAM's account and session management directives. The default behavior is to use PAM for clear text authentication only and to @@ -188,12 +615,53 @@ authentication mechanism needed in the presence of SMB password encryption. -Default: obey pam restrictions = no +Default: obey pam restrictions = no -Password Synchronisation using pam_smbpass.so +Remote CIFS Authentication using winbindd.so + + +All operating systems depend on the provision of users credentials acceptable to the platform. +Unix requires the provision of a user identifier (UID) as well as a group identifier (GID). +These are both simple integer type numbers that are obtained from a password backend such +as /etc/passwd. + + + +Users and groups on a Windows NT server are assigned a relative id (rid) which is unique for +the domain when the user or group is created. To convert the Windows NT user or group into +a unix user or group, a mapping between rids and unix user and group ids is required. This +is one of the jobs that winbind performs. + + + +As winbind users and groups are resolved from a server, user and group ids are allocated +from a specified range. This is done on a first come, first served basis, although all +existing users and groups will be mapped as soon as a client performs a user or group +enumeration command. The allocated unix ids are stored in a database file under the Samba +lock directory and will be remembered. + + + +The astute administrator will realize from this that the combination of pam_smbpass.so, +winbindd, and a distributed passdb backend, such as ldap, will allow the establishment of a +centrally managed, distributed user/password database that can also be used by all PAM (eg: Linux) aware +programs and applications. This arrangement can have particularly potent advantages compared with the use of +Microsoft Active Directory Service (ADS) in so far as reduction of wide area network authentication traffic. + + + +The rid to unix id database is the only location where the user and group mappings are +stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd +to determine which user and group ids correspond to Windows NT user and group rids. + + + + + +Password Synchronization using pam_smbpass.so pam_smbpass is a PAM module which can be used on conforming systems to @@ -203,10 +671,6 @@ under some Unices, such as Solaris, HPUX and Linux, that provides a generic interface to authentication mechanisms. - -For more information on PAM, see http://ftp.kernel.org/pub/linux/libs/pam/ - - This module authenticates a local smbpasswd user database. If you require support for authenticating against a remote SMB server, or if you're @@ -214,52 +678,42 @@ concerned about the presence of suid root binaries on your system, it is recommended that you use pam_winbind instead. - + Options recognized by this module are as follows: + + Options recognized by pam_smbpass + + + debuglog more debugging info + auditlike debug, but also logs unknown usernames + use_first_passdon't prompt the user for passwords; take them from PAM_ items instead + try_first_passtry to get the password from a previous PAM module, fall back to prompting the user + use_authtoklike try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only) + not_set_passdon't make passwords used by this module available to other modules. + nodelaydon't insert ~1 second delays on authentication failure. + nulloknull passwords are allowed. + nonullnull passwords are not allowed. Used to override the Samba configuration. + migrateonly meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication. + smbconf=filespecify an alternate path to the &smb.conf; file. + + +
+ - debug - log more debugging info - audit - like debug, but also logs unknown usernames - use_first_pass - don't prompt the user for passwords; - take them from PAM_ items instead - try_first_pass - try to get the password from a previous - PAM module, fall back to prompting the user - use_authtok - like try_first_pass, but *fail* if the new - PAM_AUTHTOK has not been previously set. - (intended for stacking password modules only) - not_set_pass - don't make passwords used by this module - available to other modules. - nodelay - don't insert ~1 second delays on authentication - failure. - nullok - null passwords are allowed. - nonull - null passwords are not allowed. Used to - override the Samba configuration. - migrate - only meaningful in an "auth" context; - used to update smbpasswd file with a - password used for successful authentication. - smbconf=< file > - specify an alternate path to the smb.conf - file. - - - + Thanks go to the following people: + + Andrew Morgan, for providing the Linux-PAM + framework, without which none of this would have happened - * Andrew Morgan < morgan@transmeta.com >, for providing the Linux-PAM - framework, without which none of this would have happened - - * Christian Gafton < gafton@redhat.com > and Andrew Morgan again, for the - pam_pwdb module upon which pam_smbpass was originally based + Christian Gafton and Andrew Morgan again, for the + pam_pwdb module upon which pam_smbpass was originally based - * Luke Leighton < lkcl@switchboard.net > for being receptive to the idea, + Luke Leighton for being receptive to the idea, and for the occasional good-natured complaint about the project's status - that keep me working on it :) - - * and of course, all the other members of the Samba team - <http://www.samba.org/samba/team.html>, for creating a great product - and for giving this project a purpose - - --------------------- - Stephen Langasek < vorlon@netexpress.net > - + that keep me working on it :) +. + The following are examples of the use of pam_smbpass.so in the format of Linux @@ -268,7 +722,7 @@ tool on other platforms will need to adapt this appropriately. -Password Synchonisation Configuration +Password Synchronisation Configuration A sample PAM configuration that shows the use of pam_smbpass to make @@ -277,18 +731,18 @@ is changed. Useful when an expired password might be changed by an application (such as ssh). - - #%PAM-1.0 - # password-sync - # - auth requisite pam_nologin.so - auth required pam_unix.so - account required pam_unix.so - password requisite pam_cracklib.so retry=3 - password requisite pam_unix.so shadow md5 use_authtok try_first_pass - password required pam_smbpass.so nullok use_authtok try_first_pass - session required pam_unix.so - + +#%PAM-1.0 +# password-sync +# +auth requisite pam_nologin.so +auth required pam_unix.so +account required pam_unix.so +password requisite pam_cracklib.so retry=3 +password requisite pam_unix.so shadow md5 use_authtok try_first_pass +password required pam_smbpass.so nullok use_authtok try_first_pass +session required pam_unix.so + @@ -302,20 +756,20 @@ password migration takes place when users ftp in, login using ssh, pop their mail, etc. - - #%PAM-1.0 - # password-migration - # - auth requisite pam_nologin.so - # pam_smbpass is called IFF pam_unix succeeds. - auth requisite pam_unix.so - auth optional pam_smbpass.so migrate - account required pam_unix.so - password requisite pam_cracklib.so retry=3 - password requisite pam_unix.so shadow md5 use_authtok try_first_pass - password optional pam_smbpass.so nullok use_authtok try_first_pass - session required pam_unix.so - + +#%PAM-1.0 +# password-migration +# +auth requisite pam_nologin.so +# pam_smbpass is called IF pam_unix succeeds. +auth requisite pam_unix.so +auth optional pam_smbpass.so migrate +account required pam_unix.so +password requisite pam_cracklib.so retry=3 +password requisite pam_unix.so shadow md5 use_authtok try_first_pass +password optional pam_smbpass.so nullok use_authtok try_first_pass +session required pam_unix.so + @@ -327,18 +781,18 @@ private/smbpasswd is fully populated, and we consider it an error if the smbpasswd doesn't exist or doesn't match the Unix password. - - #%PAM-1.0 - # password-mature - # - auth requisite pam_nologin.so - auth required pam_unix.so - account required pam_unix.so - password requisite pam_cracklib.so retry=3 - password requisite pam_unix.so shadow md5 use_authtok try_first_pass - password required pam_smbpass.so use_authtok use_first_pass - session required pam_unix.so - + +#%PAM-1.0 +# password-mature +# +auth requisite pam_nologin.so +auth required pam_unix.so +account required pam_unix.so +password requisite pam_cracklib.so retry=3 +password requisite pam_unix.so shadow md5 use_authtok try_first_pass +password required pam_smbpass.so use_authtok use_first_pass +session required pam_unix.so + @@ -350,40 +804,71 @@ pam_krb5. This could be useful on a Samba PDC that is also a member of a Kerberos realm. - - #%PAM-1.0 - # kdc-pdc - # - auth requisite pam_nologin.so - auth requisite pam_krb5.so - auth optional pam_smbpass.so migrate - account required pam_krb5.so - password requisite pam_cracklib.so retry=3 - password optional pam_smbpass.so nullok use_authtok try_first_pass - password required pam_krb5.so use_authtok try_first_pass - session required pam_krb5.so - + +#%PAM-1.0 +# kdc-pdc +# +auth requisite pam_nologin.so +auth requisite pam_krb5.so +auth optional pam_smbpass.so migrate +account required pam_krb5.so +password requisite pam_cracklib.so retry=3 +password optional pam_smbpass.so nullok use_authtok try_first_pass +password required pam_krb5.so use_authtok try_first_pass +session required pam_krb5.so + + + -Distributed Authentication +Common Errors -The astute administrator will realize from this that the -combination of pam_smbpass.so, -winbindd, and a distributed -passdb backend, such as ldap, will allow the establishment of a -centrally managed, distributed -user/password database that can also be used by all -PAM (eg: Linux) aware programs and applications. This arrangement -can have particularly potent advantages compared with the -use of Microsoft Active Directory Service (ADS) in so far as -reduction of wide area network authentication traffic. +PAM can be a very fickle and sensitive to configuration glitches. Here we look at a few cases from +the Samba mailing list. + + pam_winbind problem + + + I have the following PAM configuration: + + + + +auth required /lib/security/pam_securetty.so +auth sufficient /lib/security/pam_winbind.so +auth sufficient /lib/security/pam_unix.so use_first_pass nullok +auth required /lib/security/pam_stack.so service=system-auth +auth required /lib/security/pam_nologin.so +account required /lib/security/pam_stack.so service=system-auth +account required /lib/security/pam_winbind.so +password required /lib/security/pam_stack.so service=system-auth + + + + + When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie". + I've tried with user "scienceu+pitie" also. + + + + Answer: The problem may lie with your inclusion of pam_stack.so + service=system-auth. That file often contains a lot of stuff that may + duplicate what you're already doing. Try commenting out the pam_stack lines + for auth and account and see if things work. If they do, look at + /etc/pam.d/system-auth and copy only what you need from it into your + /etc/pam.d/login file. Alternatively, if you want all services to use + winbind, you can put the winbind-specific stuff in /etc/pam.d/system-auth. + + + + diff --git a/docs/docbook/projdoc/PolicyMgmt.xml b/docs/docbook/projdoc/PolicyMgmt.xml index 2ae3fa5ea7..12289df7c3 100644 --- a/docs/docbook/projdoc/PolicyMgmt.xml +++ b/docs/docbook/projdoc/PolicyMgmt.xml @@ -3,8 +3,51 @@ &author.jht; April 3 2003 + System and Account Policies + +This chapter summarises the current state of knowledge derived from personal +practice and knowledge from samba mailing list subscribers. Before reproduction +of posted information effort has been made to validate the information provided. +Where additional information was uncovered through this validation it is provided +also. + + + +Features and Benefits + + +When MS Windows NT3.5 was introduced the hot new topic was the ability to implement +Group Policies for users and group. Then along came MS Windows NT4 and a few sites +started to adopt this capability. How do we know that? By way of the number of "booboos" +(or mistakes) administrators made and then requested help to resolve. + + + +By the time that MS Windows 2000 and Active Directory was released, administrators +got the message: Group Policies are a good thing! They can help reduce administrative +costs and actually can help to create happier users. But adoption of the true +potential of MS Windows 200x Active Directory and Group Policy Objects (GPOs) for users +and machines were picked up on rather slowly. This was very obvious from the samba +mailing list as in 2000 and 2001 there were very few postings regarding GPOs and +how to replicate them in a Samba environment. + + + +Judging by the traffic volume since mid 2002, GPOs have become a standard part of +the deployment in many sites. This chapter reviews techniques and methods that can +be used to exploit opportunities for automation of control over user desktops and +network client workstations. + + + +A tool new to Samba-3 may become an important part of the future Samba Administrators' +arsenal. The editreg tool is described in this document. + + + + Creating and Managing System Policies @@ -21,7 +64,7 @@ affect users, groups of users, or machines. For MS Windows 9x/Me this file must be called Config.POL and may be generated using a tool called poledit.exe, better known as the Policy Editor. The policy editor was provided on the Windows 98 installation CD, but -dissappeared again with the introduction of MS Windows Me (Millenium Edition). From +disappeared again with the introduction of MS Windows Me (Millennium Edition). From comments from MS Windows network administrators it would appear that this tool became a part of the MS Windows Me Resource Kit. @@ -55,194 +98,193 @@ What follows is a very brief discussion with some helpful notes. The information here is incomplete - you are warned. - -Windows 9x/Me Policies - - -You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. -It can be found on the Original full product Win98 installation CD under -tools/reskit/netadmin/poledit. Install this using the -Add/Remove Programs facility and then click on the 'Have Disk' tab. - - - -Use the Group Policy Editor to create a policy file that specifies the location of -user profiles and/or the My Documents etc. stuff. Then -save these settings in a file called Config.POL that needs to -be placed in the root of the [NETLOGON] share. If Win98 is configured to log onto -the Samba Domain, it will automatically read this file and update the Win9x/Me registry -of the machine as it logs on. - - - -Further details are covered in the Win98 Resource Kit documentation. - - - -If you do not take the right steps, then every so often Win9x/Me will check the -integrity of the registry and will restore it's settings from the back-up -copy of the registry it stores on each Win9x/Me machine. Hence, you will -occasionally notice things changing back to the original settings. - + + Windows 9x/Me Policies - -Install the group policy handler for Win9x to pick up group policies. Look on the -Win98 CD in \tools\reskit\netadmin\poledit. -Install group policies on a Win9x client by double-clicking -grouppol.inf. Log off and on again a couple of times and see -if Win98 picks up group policies. Unfortunately this needs to be done on every -Win9x/Me machine that uses group policies. - - - - -Windows NT4 Style Policy Files - - -To create or edit ntconfig.pol you must use the NT Server -Policy Editor, poledit.exe which is included with NT4 Server -but not NT Workstation. There is a Policy Editor on a NT4 -Workstation but it is not suitable for creating Domain Policies. -Further, although the Windows 95 Policy Editor can be installed on an NT4 -Workstation/Server, it will not work with NT clients. However, the files from -the NT Server will run happily enough on an NT4 Workstation. - - - -You need poledit.exe, common.adm and winnt.adm. -It is convenient to put the two *.adm files in the c:\winnt\inf -directory which is where the binary will look for them unless told otherwise. Note also that that -directory is normally 'hidden'. - + + You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. + It can be found on the Original full product Win98 installation CD under + tools/reskit/netadmin/poledit. Install this using the + Add/Remove Programs facility and then click on the 'Have Disk' tab. + - -The Windows NT policy editor is also included with the Service Pack 3 (and -later) for Windows NT 4.0. Extract the files using servicepackname /x, -i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, -poledit.exe and the associated template files (*.adm) should -be extracted as well. It is also possible to downloaded the policy template -files for Office97 and get a copy of the policy editor. Another possible -location is with the Zero Administration Kit available for download from Microsoft. - + + Use the Group Policy Editor to create a policy file that specifies the location of + user profiles and/or the My Documents etc. Then save these + settings in a file called Config.POL that needs to be placed in the + root of the [NETLOGON] share. If Win98 is configured to log onto + the Samba Domain, it will automatically read this file and update the Win9x/Me registry + of the machine as it logs on. + - -Registry Tattoos + + Further details are covered in the Win98 Resource Kit documentation. + - With NT4 style registry based policy changes, a large number of settings are not - automatically reversed as the user logs off. Since the settings that were in the - NTConfig.POL file were applied to the client machine registry and that apply to the - hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known - as tattooing. It can have serious consequences down-stream and the administrator must - be extremely careful not to lock out the ability to manage the machine at a later date. + If you do not take the right steps, then every so often Win9x/Me will check the + integrity of the registry and will restore it's settings from the back-up + copy of the registry it stores on each Win9x/Me machine. Hence, you will + occasionally notice things changing back to the original settings. + + Install the group policy handler for Win9x to pick up group policies. Look on the + Win98 CD in \tools\reskit\netadmin\poledit. + Install group policies on a Win9x client by double-clicking + grouppol.inf. Log off and on again a couple of times and see + if Win98 picks up group policies. Unfortunately this needs to be done on every + Win9x/Me machine that uses group policies. + - - - -MS Windows 200x / XP Professional Policies + + + Windows NT4 Style Policy Files - -Windows NT4 System policies allows setting of registry parameters specific to -users, groups and computers (client workstations) that are members of the NT4 -style domain. Such policy file will work with MS Windows 2000 / XP clients also. - + + To create or edit ntconfig.pol you must use the NT Server + Policy Editor, poledit.exe which is included with NT4 Server + but not NT Workstation. There is a Policy Editor on a NT4 + Workstation but it is not suitable for creating Domain Policies. + Further, although the Windows 95 Policy Editor can be installed on an NT4 + Workstation/Server, it will not work with NT clients. However, the files from + the NT Server will run happily enough on an NT4 Workstation. + - -New to MS Windows 2000 Microsoft introduced a new style of group policy that confers -a superset of capabilities compared with NT4 style policies. Obviously, the tool used -to create them is different, and the mechanism for implementing them is much changed. - + + You need poledit.exe, common.adm and winnt.adm. + It is convenient to put the two *.adm files in the c:\winnt\inf + directory which is where the binary will look for them unless told otherwise. Note also that that + directory is normally 'hidden'. + - -The older NT4 style registry based policies are known as Administrative Templates -in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security -configurations, enforce Internet Explorer browser settings, change and redirect aspects of the -users' desktop (including: the location of My Documents files (directory), as -well as intrinsics of where menu items will appear in the Start menu). An additional new -feature is the ability to make available particular software Windows applications to particular -users and/or groups. - + + The Windows NT policy editor is also included with the Service Pack 3 (and + later) for Windows NT 4.0. Extract the files using servicepackname /x, + i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, + poledit.exe and the associated template files (*.adm) should + be extracted as well. It is also possible to downloaded the policy template + files for Office97 and get a copy of the policy editor. Another possible + location is with the Zero Administration Kit available for download from Microsoft. + - -Remember: NT4 policy files are named NTConfig.POL and are stored in the root -of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password -and selects the domain name to which the logon will attempt to take place. During the logon -process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating -server, modifies the local registry values according to the settings in this file. - + + Registry Spoiling - -Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of -a Windows 200x policy file is stored in the Active Directory itself and the other part is stored -in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active -Directory domain controllers. The part that is stored in the Active Directory itself is called the -group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is -known as the group policy template (GPT). - + + With NT4 style registry based policy changes, a large number of settings are not + automatically reversed as the user logs off. Since the settings that were in the + NTConfig.POL file were applied to the client machine registry and that apply to the + hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known + as tattooing. It can have serious consequences down-stream and the administrator must + be extremely careful not to lock out the ability to manage the machine at a later date. + - -With NT4 clients the policy file is read and executed upon only as each user logs onto the network. -MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine -startup (machine specific part) and when the user logs onto the network the user specific part -is applied. In MS Windows 200x style policy management each machine and/or user may be subject -to any number of concurently applicable (and applied) policy sets (GPOs). Active Directory allows -the administrator to also set filters over the policy settings. No such equivalent capability -exists with NT4 style policy files. - - -Administration of Win2K / XP Policies + + + + MS Windows 200x / XP Professional Policies -Instructions - -Instead of using the tool called "The System Policy Editor", commonly called Poledit (from the -executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console -(MMC) snap-in as follows: - - - -Go to the Windows 200x / XP menu Start->Programs->Administrative Tools - and select the MMC snap-in called "Active Directory Users and Computers" - - + + Windows NT4 System policies allows setting of registry parameters specific to + users, groups and computers (client workstations) that are members of the NT4 + style domain. Such policy file will work with MS Windows 2000 / XP clients also. + - -Select the domain or organizational unit (OU) that you wish to manage, then right click -to open the context menu for that object, select the properties item. - + + New to MS Windows 2000 Microsoft introduced a new style of group policy that confers + a superset of capabilities compared with NT4 style policies. Obviously, the tool used + to create them is different, and the mechanism for implementing them is much changed. + - -Now left click on the Group Policy tab, then left click on the New tab. Type a name -for the new policy you will create. - + + The older NT4 style registry based policies are known as Administrative Templates + in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security + configurations, enforce Internet Explorer browser settings, change and redirect aspects of the + users' desktop (including: the location of My Documents files (directory), as + well as intrinsics of where menu items will appear in the Start menu). An additional new + feature is the ability to make available particular software Windows applications to particular + users and/or groups. + - -Now left click on the Edit tab to commence the steps needed to create the GPO. - - + + Remember: NT4 policy files are named NTConfig.POL and are stored in the root + of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password + and selects the domain name to which the logon will attempt to take place. During the logon + process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating + server, modifies the local registry values according to the settings in this file. + - -All policy configuration options are controlled through the use of policy administrative -templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. -Beware however, since the .adm files are NOT interchangible across NT4 and Windows 200x. -The later introduces many new features as well as extended definition capabilities. It is -well beyond the scope of this documentation to explain how to program .adm files, for that -the adminsitrator is referred to the Microsoft Windows Resource Kit for your particular -version of MS Windows. - + + Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of + a Windows 200x policy file is stored in the Active Directory itself and the other part is stored + in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active + Directory domain controllers. The part that is stored in the Active Directory itself is called the + group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is + known as the group policy template (GPT). + - - -The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used -to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you -use this powerful tool. Please refer to the resource kit manuals for specific usage information. - - + + With NT4 clients the policy file is read and executed upon only as each user logs onto the network. + MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine + startup (machine specific part) and when the user logs onto the network the user specific part + is applied. In MS Windows 200x style policy management each machine and/or user may be subject + to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows + the administrator to also set filters over the policy settings. No such equivalent capability + exists with NT4 style policy files. + - - + + Administration of Win2K / XP Policies + + + Instead of using the tool called The System Policy Editor, commonly called Poledit (from the + executable name poledit.exe), GPOs are created and managed using a + Microsoft Management Console (MMC) snap-in as follows: + + + + Go to the Windows 200x / XP menu Start->Programs->Administrative Tools + and select the MMC snap-in called Active Directory Users and Computers + + + + + Select the domain or organizational unit (OU) that you wish to manage, then right click + to open the context menu for that object, select the properties item. + + + + Now left click on the Group Policy tab, then left click on the New tab. Type a name + for the new policy you will create. + + + + Now left click on the Edit tab to commence the steps needed to create the GPO. + + + + + All policy configuration options are controlled through the use of policy administrative + templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. + Beware however, since the .adm files are NOT interchangeable across NT4 and Windows 200x. + The later introduces many new features as well as extended definition capabilities. It is + well beyond the scope of this documentation to explain how to program .adm files, for that + the administrator is referred to the Microsoft Windows Resource Kit for your particular + version of MS Windows. + + + + + The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used + to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you + use this powerful tool. Please refer to the resource kit manuals for specific usage information. + + + + + @@ -272,8 +314,8 @@ applied to the user's part of the registry. MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally, acquire policy settings through Group Policy Objects (GPOs) that are defined and stored in Active Directory -itself. The key benefit of using AS GPOs is that they impose no registry tatooing effect. -This has considerable advanage compared with the use of NTConfig.POL (NT4) style policy updates. +itself. The key benefit of using AS GPOs is that they impose no registry spoiling effect. +This has considerable advantage compared with the use of NTConfig.POL (NT4) style policy updates. @@ -293,27 +335,37 @@ Common restrictions that are frequently used includes: - -With Windows NT4/200x + + Samba Editreg Toolset - -The tools that may be used to configure these types of controls from the MS Windows environment are: -The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). -Under MS Windows 200x/XP this is done using the Microsoft Managment Console (MMC) with approapriate -"snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor. - - + + Describe in detail the benefits of editreg and how to use it. + - -With a Samba PDC + - -With a Samba Domain Controller, the new tools for managing of user account and policy information includes: -smbpasswd, pdbedit, net, rpcclient.. The administrator should read the -man pages for these tools and become familiar with their use. - + + Windows NT4/200x - + + The tools that may be used to configure these types of controls from the MS Windows environment are: + The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). + Under MS Windows 200x/XP this is done using the Microsoft Management Console (MMC) with appropriate + "snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor. + + + + + Samba PDC + + + With a Samba Domain Controller, the new tools for managing of user account and policy information includes: + smbpasswd, pdbedit, net, rpcclient. + The administrator should read the + man pages for these tools and become familiar with their use. + + + @@ -342,7 +394,7 @@ reboot and as part of the user logon: - Execution of start-up scripts (hidden and synchronous by defaut). + Execution of start-up scripts (hidden and synchronous by default). @@ -354,7 +406,7 @@ reboot and as part of the user logon: - An ordered list of User GPOs is obtained. The list contents depends on what is configured in respsect of: + An ordered list of User GPOs is obtained. The list contents depends on what is configured in respect of: Is user a domain member, thus subject to particular policies @@ -381,4 +433,32 @@ reboot and as part of the user logon: + + +Common Errors + + +Policy related problems can be very difficult to diagnose and even more difficult to rectify. The following +collection demonstrates only basic issues. + + + +Policy Does Not Work + + +Question: We have created the config.pol file and put it in the NETLOGON share. +It has made no difference to our Win XP Pro machines, they just don't see it. IT worked fine with Win 98 but does not +work any longer since we upgraded to Win XP Pro. Any hints? + + + +ANSWER: Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based +platforms. You need to use the NT4 Group Policy Editor to create a file called NTConfig.POL so that +it is in the correct format for your MS Windows XP Pro clients. + + + + + + diff --git a/docs/docbook/projdoc/Portability.xml b/docs/docbook/projdoc/Portability.xml index 72c3d20547..205d384843 100644 --- a/docs/docbook/projdoc/Portability.xml +++ b/docs/docbook/projdoc/Portability.xml @@ -1,6 +1,8 @@ &author.jelmer; + Portability @@ -14,14 +16,14 @@ platform-specific information about compiling and using samba. HP's implementation of supplementary groups is, er, non-standard (for -hysterical reasons). There are two group files, /etc/group and -/etc/logingroup; the system maps UIDs to numbers using the former, but +hysterical reasons). There are two group files, /etc/group and +/etc/logingroup; the system maps UIDs to numbers using the former, but initgroups() reads the latter. Most system admins who know the ropes -symlink /etc/group to /etc/logingroup (hard link doesn't work for reasons -too stupid to go into here). initgroups() will complain if one of the -groups you're in in /etc/logingroup has what it considers to be an invalid -ID, which means outside the range [0..UID_MAX], where UID_MAX is (I think) -60000 currently on HP-UX. This precludes -2 and 65534, the usual 'nobody' +symlink /etc/group to /etc/logingroup +(hard link doesn't work for reasons too stupid to go into here). initgroups() will complain if one of the +groups you're in in /etc/logingroup has what it considers to be an invalid +ID, which means outside the range [0..UID_MAX], where UID_MAX is (I think) +60000 currently on HP-UX. This precludes -2 and 65534, the usual nobody GIDs. @@ -35,8 +37,8 @@ allowed range. -On HPUX you must use gcc or the HP Ansi compiler. The free compiler -that comes with HP-UX is not Ansi compliant and cannot compile +On HPUX you must use gcc or the HP ANSI compiler. The free compiler +that comes with HP-UX is not ANSI compliant and cannot compile Samba. @@ -46,14 +48,15 @@ Samba. SCO Unix -If you run an old version of SCO Unix then you may need to get important +If you run an old version of SCO Unix then you may need to get important TCP/IP patches for Samba to work correctly. Without the patch, you may encounter corrupt data transfers using samba. The patch you need is UOD385 Connection Drivers SLS. It is available from -SCO (ftp.sco.com, directory SLS, files uod385a.Z and uod385a.ltr.Z). +SCO (ftp.sco.com, directory SLS, +files uod385a.Z and uod385a.ltr.Z). @@ -121,8 +124,10 @@ _seteuid: after creating the above files you then assemble them using -as seteuid.s -as setegid.s + + $ as seteuid.s + $ as setegid.s + that should produce the files seteuid.o and @@ -155,7 +160,7 @@ You should then remove the line: By default RedHat Rembrandt-II during installation adds an -entry to /etc/hosts as follows: +entry to /etc/hosts as follows: 127.0.0.1 loopback "hostname"."domainname" @@ -181,7 +186,7 @@ Corrective Action: Delete the entry after the word loopback Disabling Sequential Read Ahead using vmtune -r 0 improves -samba performance significally. +Samba performance significantly. @@ -193,9 +198,9 @@ samba performance significally. Locking improvements Some people have been experiencing problems with F_SETLKW64/fcntl -when running samba on solaris. The built in file locking mechanism was +when running Samba on Solaris. The built in file locking mechanism was not scalable. Performance would degrade to the point where processes would -get into loops of trying to lock a file. It woul try a lock, then fail, +get into loops of trying to lock a file. It would try a lock, then fail, then try again. The lock attempt was failing before the grant was occurring. So the visible manifestation of this would be a handful of processes stealing all of the CPU, and when they were trussed they would @@ -209,8 +214,7 @@ has not been released yet. The patch revision for 2.6 is 105181-34 -for 8 is 108528-19 -and for 9 is 112233-04 +for 8 is 108528-19 and for 9 is 112233-04 diff --git a/docs/docbook/projdoc/Problems.xml b/docs/docbook/projdoc/Problems.xml index eb43b63b63..16e4c8ad54 100644 --- a/docs/docbook/projdoc/Problems.xml +++ b/docs/docbook/projdoc/Problems.xml @@ -26,15 +26,15 @@ general SMB topics such as browsing. One of the best diagnostic tools for debugging problems is Samba itself. -You can use the -d option for both smbd and nmbd to specify what -'debug level' at which to run. See the man pages on smbd, nmbd and +You can use the for both &smbd; and &nmbd; to specify what +debug level at which to run. See the man pages on smbd, nmbd and smb.conf for more information on debugging options. The debug level can range from 1 (the default) to 10 (100 for debugging passwords). Another helpful method of debugging is to compile samba using the -gcc -g flag. This will include debug +gcc -g flag. This will include debug information in the binaries and allow you to attach gdb to the running smbd / nmbd process. In order to attach gdb to an smbd process for an NT workstation, first get the workstation to make the @@ -51,10 +51,10 @@ typing in your password, you can attach gdb and continue. Some useful samba commands worth investigating: - - testparam | more - smbclient -L //{netbios name of server} - + + $ testparm | more + $ smbclient -L //{netbios name of server} + An SMB enabled version of tcpdump is available from @@ -91,18 +91,18 @@ NT Server 4.0 Install CD and the Workstation 4.0 Install CD. -Initially you will need to install 'Network Monitor Tools and Agent' +Initially you will need to install Network Monitor Tools and Agent on the NT Server. To do this - Goto Start - Settings - Control Panel - - Network - Services - Add + Goto Start - Settings - Control Panel - + Network - Services - Add - Select the 'Network Monitor Tools and Agent' and - click on 'OK'. + Select the Network Monitor Tools and Agent and + click on OK. - Click 'OK' on the Network Control Panel. + Click OK on the Network Control Panel. Insert the Windows NT Server 4.0 install CD @@ -124,13 +124,13 @@ install CD. - Goto Start - Settings - Control Panel - - Network - Services - Add + Goto Start - Settings - Control Panel - + Network - Services - Add - Select the 'Network Monitor Agent' and click - on 'OK'. + Select the Network Monitor Agent and click + on OK. - Click 'OK' on the Network Control Panel. + Click OK on the Network Control Panel. Insert the Windows NT Workstation 4.0 install @@ -138,15 +138,15 @@ install CD. -Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* -to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set -permissions as you deem appropriate for your site. You will need +Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* +to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set +permissions as you deem appropriate for your site. You will need administrative rights on the NT box to run netmon. To install Netmon on a Windows 9x box install the network monitor agent -from the Windows 9x CD (\admin\nettools\netmon). There is a readme +from the Windows 9x CD (\admin\nettools\netmon). There is a readme file located with the netmon driver files on the CD if you need information on how to do this. Copy the files from a working Netmon installation. @@ -155,35 +155,19 @@ Netmon installation. -Useful URL's +Useful URLs -Home of Samba site - http://samba.org. We have a mirror near you ! - - The Development document -on the Samba mirrors might mention your problem. If so, -it might mean that the developers are working on it. - See how Scott Merrill simulates a BDC behavior at http://www.skippy.net/linux/smb-howto.html. -Although 2.0.7 has almost had its day as a PDC, David Bannon will - keep the 2.0.7 PDC pages at - http://bioserve.latrobe.edu.au/samba going for a while yet. - -Misc links to CIFS information - http://samba.org/cifs/ - -NT Domains for Unix - http://mailhost.cb1.com/~lkcl/ntdom/ - FTP site for older SMB specs: ftp://ftp.microsoft.com/developr/drg/CIFS/ + @@ -256,7 +240,7 @@ smb.conf in their attach directory? -How to get off the mailinglists +How to get off the mailing lists To have your name removed from a samba mailing list, go to the same place you went to to get on it. Go to Desktop Profile Management + +Features and Benefits + + +Roaming Profiles are feared by some, hated by a few, loved by many, and a Godsend for +some administrators. + + + +Roaming Profiles allow an administrator to make available a consistent user desktop +as the user moves from one machine to another. This chapter provides much information +regarding how to configure and manage Roaming Profiles. + + + +While Roaming Profiles might sound like nirvana to some, they are a real and tangible +problem to others. In particular, users of mobile computing tools, where often there may not +be a sustained network connection, are often better served by purely Local Profiles. +This chapter provides information to help the Samba administrator to deal with those +situations also. + + + + Roaming Profiles @@ -44,7 +68,7 @@ This section documents how to configure Samba for MS Windows client profile supp NT4/200x User Profiles -To support Windowns NT4/200x clients, in the [global] section of smb.conf set the +To support Windows NT4/200x clients, in the [global] section of smb.conf set the following (for example): @@ -62,17 +86,18 @@ where %L translates to the name of the Samba server and %u translates to the use -The default for this option is \\%N\%U\profile, namely \\sambaserver\username\profile. -The \\N%\%U service is created automatically by the [homes] service. If you are using +The default for this option is \\%N\%U\profile, +namely \\sambaserver\username\profile. +The \\N%\%U service is created automatically by the [homes] service. If you are using a samba server for the profiles, you _must_ make the share specified in the logon path -browseable. Please refer to the man page for smb.conf in respect of the different -symantics of %L and %N, as well as %U and %u. +browseable. Please refer to the man page for &smb.conf; in respect of the different +semantics of %L and %N, as well as %U and %u. MS Windows NT/2K clients at times do not disconnect a connection to a server -between logons. It is recommended to NOT use the homes +between logons. It is recommended to NOT use the homes meta-service name as part of the profile share path. @@ -82,7 +107,7 @@ meta-service name as part of the profile share path. Windows 9x / Me User Profiles -To support Windows 9x / Me clients, you must use the "logon home" parameter. Samba has + To support Windows 9x / Me clients, you must use the logon home parameter. Samba has now been fixed so that net use /home now works as well, and it, too, relies on the logon home parameter. @@ -90,7 +115,7 @@ on the logon home parameter. By using the logon home parameter, you are restricted to putting Win9x / Me profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your &smb.conf; file: +can use. If you set the following in the [global] section of your &smb.conf; file: logon home = \\%L\%U\.profiles @@ -105,7 +130,7 @@ of your home directory called .profiles (thus making them h Not only that, but net use /home will also work, because of a feature in Windows 9x / Me. It removes any directory stuff off the end of the home directory area and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for logon home. +specified \\%L\%U for logon home. @@ -114,7 +139,7 @@ specified \\%L\%U for logon home. You can support profiles for both Win9X and WinNT clients by setting both the -logon home and logon path parameters. For example: +logon home and logon path parameters. For example: @@ -127,27 +152,32 @@ You can support profiles for both Win9X and WinNT clients by setting both the Disabling Roaming Profile Support -A question often asked is "How may I enforce use of local profiles?" or -"How do I disable Roaming Profiles?" + A question often asked is How may I enforce use of local profiles? or + How do I disable Roaming Profiles? There are three ways of doing this: - - - In smb.conf: affect the following settings and ALL clients - will be forced to use a local profile: - - logon home = - logon path = - - - - MS Windows Registry: by using the Microsoft Management Console - gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This - of course modifies registry settings. The full path to the option is: + + + In &smb.conf; + + Affect the following settings and ALL clients + will be forced to use a local profile: + + logon home = + logon path = + + + + + + MS Windows Registry: + + By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This of course modifies registry settings. The full path to the option is: + Local Computer Policy\ Computer Configuration\ @@ -156,17 +186,20 @@ There are three ways of doing this: User Profiles\ Disable: Only Allow Local User Profiles - Disable: Prevent Roaming Profile Change from Propogating to the Server + Disable: Prevent Roaming Profile Change from Propagating to the Server - - + + - - Change of Profile Type: From the start menu right click on the - MY Computer icon, select Properties, click on the "User Profiles - tab, select the profile you wish to change from Roaming type to Local, click Change Type. - - + + Change of Profile Type: + + From the start menu right click on the + My Computer icon, select Properties, click on the User Profiles + tab, select the profile you wish to change from Roaming type to Local, click Change Type. + + + Consult the MS Windows registry guide for your particular MS Windows version for more @@ -191,12 +224,13 @@ Microsoft MS Windows Resource Kit for your version of Windows for specific infor When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders "Start Menu", "Desktop", "Programs" and "Nethood". +as are folders Start Menu, Desktop, +Programs and Nethood. These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options "preserve case = yes", "short preserve case = yes" and -"case sensitive = no" in order to maintain capital letters in shortcuts +versions stored in c:\windows\profiles\username on subsequent logins, +taking the most recent from each. You will need to use the [global] +options preserve case = yes, short preserve case = yes and +case sensitive = no in order to maintain capital letters in shortcuts in any of the profile folders. @@ -209,19 +243,19 @@ and deny them write access to this file. - On the Windows 9x / Me machine, go to Control Panel -> Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer + On the Windows 9x / Me machine, go to Control Panel -> Passwords and + select the User Profiles tab. Select the required level of + roaming preferences. Press OK, but do _not_ allow the computer to reboot. - On the Windows 9x / Me machine, go to Control Panel -> Network -> - Client for Microsoft Networks -> Preferences. Select 'Log on to - NT Domain'. Then, ensure that the Primary Logon is 'Client for - Microsoft Networks'. Press OK, and this time allow the computer + On the Windows 9x / Me machine, go to Control Panel -> Network -> + Client for Microsoft Networks -> Preferences. Select Log on to + NT Domain. Then, ensure that the Primary Logon is Client for + Microsoft Networks. Press OK, and this time allow the computer to reboot. @@ -247,15 +281,15 @@ supports it), user name and user's password. Once the user has been successfully validated, the Windows 9x / Me machine -will inform you that 'The user has not logged on before' and asks you -if you wish to save the user's preferences? Select 'yes'. +will inform you that The user has not logged on before' and asks you + if you wish to save the user's preferences? Select yes. Once the Windows 9x / Me client comes up with the desktop, you should be able -to examine the contents of the directory specified in the "logon path" -on the samba server and verify that the "Desktop", "Start Menu", -"Programs" and "Nethood" folders have been created. +to examine the contents of the directory specified in the logon path +on the samba server and verify that the Desktop, Start Menu, +Programs and Nethood folders have been created. @@ -286,32 +320,31 @@ they will be told that they are logging in "for the first time". instead of logging in under the [user, password, domain] dialog, - press escape. + press escape. - run the regedit.exe program, and look in: + run the regedit.exe program, and look in: - - HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList + + HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), + contents of this key (likely to be c:\windows\profiles\username), then delete the key ProfilePath for the required user. + - [Exit the registry editor]. - - + [Exit the registry editor]. - - - WARNING - before deleting the contents of the + + + Before deleting the contents of the directory listed in the ProfilePath (this is likely to be c:\windows\profiles\username), ask them if they have any important files stored on their desktop or in their start menu. @@ -324,11 +357,11 @@ they will be told that they are logging in "for the first time". system file) user.DAT in their profile directory, as well as the local "desktop", "nethood", "start menu" and "programs" folders. - + - search for the user's .PWL password-caching file in the c:\windows + search for the user's .PWL password-caching file in the c:\windows directory, and delete it. @@ -341,8 +374,8 @@ they will be told that they are logging in "for the first time". - check the contents of the profile path (see "logon path" described - above), and delete the user.DAT or user.MAN file for the user, + check the contents of the profile path (see logon path described + above), and delete the user.DAT or user.MAN file for the user, making a backup if required. @@ -351,7 +384,7 @@ they will be told that they are logging in "for the first time". If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as ethereal or netmon.exe, and +and / or run a packet trace program such as ethereal or netmon.exe, and look for error messages. @@ -370,12 +403,12 @@ differences are with the equivalent samba trace. When a user first logs in to a Windows NT Workstation, the profile NTuser.DAT is created. The profile location can be now specified -through the "logon path" parameter. +through the logon path parameter. There is a parameter that is now available for use with NT Profiles: -"logon drive". This should be set to H: or any other drive, and +logon drive. This should be set to H: or any other drive, and should be used in conjunction with the new "logon home" parameter. @@ -389,23 +422,23 @@ for those situations where it might be created.) In the profile directory, Windows NT4 creates more folders than Windows 9x / Me. -It creates "Application Data" and others, as well as "Desktop", "Nethood", -"Start Menu" and "Programs". The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and +It creates Application Data and others, as well as Desktop, Nethood, +Start Menu and Programs. The profile itself is stored in a file +NTuser.DAT. Nothing appears to be stored in the .PDS directory, and its purpose is currently unknown. -You can use the System Control Panel to copy a local profile onto +You can use the System Control Panel to copy a local profile onto a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN +up the correct location in the System Control Panel for you). The +NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN turns a profile into a mandatory one. The case of the profile is significant. The file must be called -NTuser.DAT or, for a mandatory profile, NTuser.MAN. +NTuser.DAT or, for a mandatory profile, NTuser.MAN. @@ -417,78 +450,78 @@ You must first convert the profile from a local profile to a domain profile on the MS Windows workstation as follows: - - - Log on as the LOCAL workstation administrator. - + + + Log on as the LOCAL workstation administrator. + - - Right click on the 'My Computer' Icon, select 'Properties' - + + Right click on the My Computer Icon, select Properties + - - Click on the 'User Profiles' tab - + + Click on the User Profiles tab + - + Select the profile you wish to convert (click on it once) - + - - Click on the button 'Copy To' - + + Click on the button Copy To + - - In the "Permitted to use" box, click on the 'Change' button. - + + In the Permitted to use box, click on the Change button. + - + Click on the 'Look in" area that lists the machine name, when you click here it will open up a selection box. Click on the domain to which the profile must be accessible. You will need to log on if a logon box opens up. Eg: In the connect - as: MIDEARTH\root, password: mypassword. - + as: MIDEARTH\root, password: mypassword. + - + To make the profile capable of being used by anyone select 'Everyone' - + - - Click OK. The Selection box will close. - + + Click OK. The Selection box will close. + - - Now click on the 'Ok' button to create the profile in the path you + + Now click on the Ok button to create the profile in the path you nominated. - - + + -Done. You now have a profile that can be editted using the samba-3.0.0 -profiles tool. +Done. You now have a profile that can be edited using the samba-3.0.0 +profiles tool. -Under NT/2K the use of mandotory profiles forces the use of MS Exchange +Under NT/2K the use of mandatory profiles forces the use of MS Exchange storage of mail data. That keeps desktop profiles usable. - - + + This is a security check new to Windows XP (or maybe only Windows XP service pack 1). It can be disabled via a group policy in Active Directory. The policy is: -"Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders" +Computer Configuration\Administrative Templates\System\User +Profiles\Do not check for user ownership of Roaming Profile Folders -...and it should be set to "Enabled". +...and it should be set to Enabled. Does the new version of samba have an Active Directory analogue? If so, then you may be able to set the policy through this. @@ -500,36 +533,35 @@ the following (N.B. I don't know for sure that this will work in the same way as a domain group policy): - + - + On the XP workstation log in with an Administrator account. - - - Click: "Start", "Run" - Type: "mmc" - Click: "OK" - - A Microsoft Management Console should appear. - Click: File, "Add/Remove Snap-in...", "Add" - Double-Click: "Group Policy" - Click: "Finish", "Close" - Click: "OK" - - In the "Console Root" window: - Expand: "Local Computer Policy", "Computer Configuration", - "Administrative Templates", "System", "User Profiles" - Double-Click: "Do not check for user ownership of Roaming Profile - Folders" - Select: "Enabled" - Click: OK" - - Close the whole console. You do not need to save the settings (this + + + Click: Start, Run + Type: mmc + Click: OK + + A Microsoft Management Console should appear. + Click: File, Add/Remove Snap-in..., Add + Double-Click: Group Policy + Click: Finish, Close + Click: OK + + In the "Console Root" window: + Expand: Local Computer Policy, Computer Configuration, + Administrative Templates, System, User Profiles + Double-Click: Do not check for user ownership of Roaming Profile Folders + Select: Enabled + Click: OK + + Close the whole console. You do not need to save the settings (this refers to the console settings rather than the policies you have - changed). + changed). - Reboot - + Reboot + @@ -551,13 +583,13 @@ on again with the newer version of MS Windows. If you then want to share the same Start Menu / Desktop with W9x/Me, you will need to specify a common location for the profiles. The smb.conf parameters -that need to be common are logon path and -logon home. +that need to be common are logon path and +logon home. -If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory. +If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory. @@ -584,35 +616,35 @@ NT4/200x. The correct resource kit is required for each platform. Here is a quick guide: - + - -On your NT4 Domain Controller, right click on 'My Computer', then -select the tab labelled 'User Profiles'. - + +On your NT4 Domain Controller, right click on My Computer, then +select the tab labelled User Profiles. + - + Select a user profile you want to migrate and click on it. -I am using the term "migrate" lossely. You can copy a profile to +I am using the term "migrate" loosely. You can copy a profile to create a group profile. You can give the user 'Everyone' rights to the profile you copy this to. That is what you need to do, since your samba domain is not a member of a trust relationship with your NT4 PDC. - + - Click the 'Copy To' button. +Click the Copy To button. - In the box labelled 'Copy Profile to' add your new path, eg: - c:\temp\foobar + In the box labelled Copy Profile to add your new path, eg: + c:\temp\foobar - Click on the button labelled 'Change' in the "Permitted to use" box. + Click on the button Change in the Permitted to use box. - Click on the group 'Everyone' and then click OK. This closes the - 'chose user' box. + Click on the group 'Everyone' and then click OK. This closes the + 'choose user' box. - Now click OK. - + Now click OK. + Follow the above for every profile you need to migrate. @@ -657,7 +689,7 @@ Resource Kit. Windows NT 4.0 stores the local profile information in the registry under the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList @@ -697,7 +729,7 @@ file in the copied profile and rename it to NTUser.MAN. -For MS Windows 9x / Me it is the User.DAT file that must be renamed to User.MAN to +For MS Windows 9x / Me it is the User.DAT file that must be renamed to User.MAN to affect a mandatory profile. @@ -707,7 +739,7 @@ affect a mandatory profile. Creating/Managing Group Profiles -Most organisations are arranged into departments. There is a nice benenfit in +Most organisations are arranged into departments. There is a nice benefit in this fact since usually most users in a department will require the same desktop applications and the same desktop layout. MS Windows NT4/200x/XP will allow the use of Group Profiles. A Group Profile is a profile that is created firstly using @@ -717,7 +749,7 @@ to the group profile. -The next step is rather important. PLEASE NOTE: Instead of assigning a group profile +The next step is rather important. Please note: Instead of assigning a group profile to users (ie: Using User Manager) on a "per user" basis, the group itself is assigned the now modified profile. @@ -747,18 +779,19 @@ advantages. MS Windows 9x/Me -To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System -Policy Editor or change the registry directly. +To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System +Policy Editor or change the registry directly. -To enable default per user profiles in Windows 9x / Me, launch the System Policy Editor, then -select File -> Open Registry, then click on the Local Computer icon, click on Windows 98 System, -select User Profiles, click on the enable box. Do not forget to save the registry changes. +To enable default per user profiles in Windows 9x / Me, launch the System Policy Editor, then +select File -> Open Registry, then click on the +Local Computer icon, click on Windows 98 System, +select User Profiles, click on the enable box. Do not forget to save the registry changes. -To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive +To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive HKEY_LOCAL_MACHINE\Network\Logon. Now add a DWORD type key with the name "User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0. @@ -798,7 +831,7 @@ profile, the changes are written to the user's profile on the server. On MS Windows NT4 the default user profile is obtained from the location %SystemRoot%\Profiles which in a default installation will translate to C:\WinNT\Profiles. Under this directory on a clean install there will be -three (3) directories: Administrator, All Users, Default User. +three (3) directories: Administrator, All Users, Default User. @@ -821,8 +854,8 @@ When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft the following steps are followed in respect of profile handling: - - + + The users' account information which is obtained during the logon process contains the location of the users' desktop profile. The profile path may be local to the @@ -832,35 +865,35 @@ the following steps are followed in respect of profile handling: settings in the All Users profile in the %SystemRoot%\Profiles location. - + - + If the user account has a profile path, but at it's location a profile does not exist, then a new profile is created in the %SystemRoot%\Profiles\%USERNAME% directory from reading the Default User profile. - + - + If the NETLOGON share on the authenticating server (logon server) contains a policy file (NTConfig.POL) then it's contents are applied to the NTUser.DAT which is applied to the HKEY_CURRENT_USER part of the registry. - + - + When the user logs out, if the profile is set to be a roaming profile it will be written out to the location of the profile. The NTuser.DAT file is then re-created from the contents of the HKEY_CURRENT_USER contents. Thus, should there not exist in the NETLOGON share an NTConfig.POL at the - next logon, the effect of the provious NTConfig.POL will still be held + next logon, the effect of the previous NTConfig.POL will still be held in the profile. The effect of this is known as tatooing. - - + + MS Windows NT4 profiles may be Local or Roaming. A Local profile @@ -892,59 +925,58 @@ are controlled by entries on Windows NT4 is: - - HKEY_CURRENT_USER - \Software - \Microsoft - \Windows - \CurrentVersion - \Explorer - \User Shell Folders\ - +HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\ The above hive key contains a list of automatically managed folders. The default entries are: - - - Name Default Value - -------------- ----------------------------------------- - AppData %USERPROFILE%\Application Data - Desktop %USERPROFILE%\Desktop - Favorites %USERPROFILE%\Favorites - NetHood %USERPROFILE%\NetHood - PrintHood %USERPROFILE%\PrintHood - Programs %USERPROFILE%\Start Menu\Programs - Recent %USERPROFILE%\Recent - SendTo %USERPROFILE%\SendTo - Start Menu %USERPROFILE%\Start Menu - Startup %USERPROFILE%\Start Menu\Programs\Startup - - + + + User Shell Folder registry keys default values + + + NameDefault Value + + + AppData%USERPROFILE%\Application Data + Desktop%USERPROFILE%\Desktop + Favorites%USERPROFILE%\Favorites + NetHood%USERPROFILE%\NetHood + PrintHood%USERPROFILE%\PrintHood + Programs%USERPROFILE%\Start Menu\Programs + Recent%USERPROFILE%\Recent + SendTo%USERPROFILE%\SendTo + Start Menu %USERPROFILE%\Start Menu + Startup%USERPROFILE%\Start Menu\Programs\Startup + + +
+ The registry key that contains the location of the default profile settings is: + - - HKEY_LOCAL_MACHINE - \SOFTWARE - \Microsoft - \Windows - \CurrentVersion - \Explorer - \User Shell Folders - + +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders + + The default entries are: - - Common Desktop %SystemRoot%\Profiles\All Users\Desktop - Common Programs %SystemRoot%\Profiles\All Users\Programs - Common Start Menu %SystemRoot%\Profiles\All Users\Start Menu - Common Startup %SystemRoot%\Profiles\All Users\Start Menu\Progams\Startup - + + Defaults of profile settings registry keys + + + Common Desktop%SystemRoot%\Profiles\All Users\Desktop + Common Programs%SystemRoot%\Profiles\All Users\Programs + Common Start Menu%SystemRoot%\Profiles\All Users\Start Menu + Common Startup%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup + + +
 @@ -981,7 +1013,7 @@ login name of the user. - This path translates, in Samba parlance, to the smb.conf [NETLOGON] share. The directory + This path translates, in Samba parlance, to the &smb.conf; [NETLOGON] share. The directory should be created at the root of this share and must be called Default Profile. @@ -992,7 +1024,7 @@ default profile. -On loging out, the users' desktop profile will be stored to the location specified in the registry +On logging out, the users' desktop profile will be stored to the location specified in the registry settings that pertain to the user. If no specific policies have been created, or passed to the client during the login process (as Samba does automatically), then the user's profile will be written to the local machine only under the path C:\Documents and Settings\%USERNAME%. @@ -1031,49 +1063,43 @@ are controlled by entries on Windows 200x/XP is: - - HKEY_CURRENT_USER - \Software - \Microsoft - \Windows - \CurrentVersion - \Explorer - \User Shell Folders\ - +HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\ The above hive key contains a list of automatically managed folders. The default entries are: - - - Name Default Value - -------------- ----------------------------------------- - AppData %USERPROFILE%\Application Data - Cache %USERPROFILE%\Local Settings\Temporary Internet Files - Cookies %USERPROFILE%\Cookies - Desktop %USERPROFILE%\Desktop - Favorites %USERPROFILE%\Favorites - History %USERPROFILE%\Local Settings\History - Local AppData %USERPROFILE%\Local Settings\Application Data - Local Settings %USERPROFILE%\Local Settings - My Pictures %USERPROFILE%\My Documents\My Pictures - NetHood %USERPROFILE%\NetHood - Personal %USERPROFILE%\My Documents - PrintHood %USERPROFILE%\PrintHood - Programs %USERPROFILE%\Start Menu\Programs - Recent %USERPROFILE%\Recent - SendTo %USERPROFILE%\SendTo - Start Menu %USERPROFILE%\Start Menu - Startup %USERPROFILE%\Start Menu\Programs\Startup - Templates %USERPROFILE%\Templates - - + + + Defaults of default user profile paths registry keys + + NameDefault Value + + AppData%USERPROFILE%\Application Data + Cache%USERPROFILE%\Local Settings\Temporary Internet Files + Cookies%USERPROFILE%\Cookies + Desktop%USERPROFILE%\Desktop + Favorites%USERPROFILE%\Favorites + History%USERPROFILE%\Local Settings\History + Local AppData%USERPROFILE%\Local Settings\Application Data + Local Settings%USERPROFILE%\Local Settings + My Pictures%USERPROFILE%\My Documents\My Pictures + NetHood%USERPROFILE%\NetHood + Personal%USERPROFILE%\My Documents + PrintHood%USERPROFILE%\PrintHood + Programs%USERPROFILE%\Start Menu\Programs + Recent%USERPROFILE%\Recent + SendTo%USERPROFILE%\SendTo + Start Menu%USERPROFILE%\Start Menu + Startup%USERPROFILE%\Start Menu\Programs\Startup + Templates%USERPROFILE%\Templates +
+ -There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all -the others are of type REG_EXPAND_SZ. +There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all +the others are of type REG_EXPAND_SZ. @@ -1084,21 +1110,20 @@ write the Outlook PST file over the network for every login and logout. To set this to a network location you could use the following examples: + - - %LOGONSERVER%\%USERNAME%\Default Folders - - -This would store the folders in the user's home directory under a directory called "Default Folders" +%LOGONSERVER%\%USERNAME%\Default Folders + +This would store the folders in the user's home directory under a directory called Default Folders You could also use: + - - \\SambaServer\FolderShare\%USERNAME% - +\\SambaServer\FolderShare\%USERNAME% -in which case the default folders will be stored in the server named SambaServer -in the share called FolderShare under a directory that has the name of the MS Windows + + in which case the default folders will be stored in the server named SambaServer +in the share called FolderShare under a directory that has the name of the MS Windows user as seen by the Linux/Unix file system. @@ -1112,12 +1137,9 @@ MS Windows 200x/XP profiles may be Local or Roami A roaming profile will be cached locally unless the following registry key is created: - - - HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\ - "DeleteRoamingCache"=dword:00000001 - +HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\"DeleteRoamingCache"=dword:00000001 + In which case, the local cache copy will be deleted on logout. @@ -1127,7 +1149,7 @@ In which case, the local cache copy will be deleted on logout. Common Errors -THe following are some typical errors/problems/questions that have been asked. +The following are some typical errors/problems/questions that have been asked. @@ -1159,17 +1181,172 @@ In any case, you can configure only one profile per user. That profile can be either: - - - A profile unique to that user - - - A mandatory profile (one the user can not change) - - - A group profile (really should be mandatory ie:unchangable) - - + + A profile unique to that user + A mandatory profile (one the user can not change) + A group profile (really should be mandatory ie:unchangable) + + + + + +Can NOT use Roaming Profiles + + + + I dont want Roaming profile to be implemented, I just want to give users + local profiles only. +... + Please help me I am totally lost with this error from past two days I tried + everything and googled around quite a bit but of no help. Please help me. + + + +Your choices are: + + + + + Local profiles + + I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out + + + + + Roaming profiles + + + can use auto-delete on logout option + requires a registry key change on workstation + + + Your choices are: + + + + Personal Roaming profiles + + - should be preserved on a central server + - workstations 'cache' (store) a local copy + - used in case the profile can not be downloaded + at next logon + + + + + Group profiles + - loaded from a central place + + + + Mandatory profiles + + - can be personal or group + - can NOT be changed (except by an administrator + + + + + + + + + + +A WinNT4/2K/XP profile can vary in size from 130KB to off the scale. +Outlook PST files are most often part of the profile and can be many GB in +size. On average (in a well controlled environment) roaming profile size of +2MB is a good rule of thumb to use for planning purposes. In an +undisciplined environment I have seen up to 2GB profiles. Users tend to +complain when it take an hour to log onto a workstation but they harvest +the fruits of folly (and ignorance). + + + +The point of all the above is to show that roaming profiles and good +controls of how they can be changed as well as good discipline make up for +a problem free site. + + + +Microsoft's answer to the PST problem is to store all email in an MS +Exchange Server back-end. But this is another story ...! + + + +So, having LOCAL profiles means: + + + If lots of users user each machine - lot's of local disk storage needed for local profiles + Every workstation the user logs into has it's own profile - can be very different from machine to machine + + +On the other hand, having roaming profiles means: + + The network administrator can control EVERY aspect of user profiles + With the use of mandatory profiles - a drastic reduction in network management overheads + User unhappiness about not being able to change their profiles soon fades as they get used to being able to work reliably + + + + + +I have managed and installed MANY NT/2K networks and have NEVER found one +where users who move from machine to machine are happy with local +profiles. In the long run local profiles bite them. + + + + + + + + Changing the default profile + + +When the client tries to logon to the PDC it looks for a profile to download +where do I put this default profile. + + + +Firstly, your samba server need to be configured as a domain controller. + + + + server = user + os level = 32 (or more) + domain logons = Yes + + + +Plus you need to have a [netlogon] share that is world readable. +It is a good idea to add a logon script to pre-set printer and +drive connections. There is also a facility for automatically +synchronizing the workstation time clock with that of the logon +server (another good thing to do). + + + +To invoke auto-deletion of roaming profile from the local +workstation cache (disk storage) you need to use the Group Policy Editor +to create a file called NTConfig.POL with the appropriate entries. This +file needs to be located in the netlogon share root directory. + + +Oh, of course the windows clients need to be members of the domain. +Workgroup machines do NOT do network logons - so they never see domain +profiles. + + + +Secondly, for roaming profiles you need: + + logon path = \\%N\profiles\%U (with some such path) + logon drive = H: (Z: is the default) + + Plus you need a PROFILES share that is world writable. + diff --git a/docs/docbook/projdoc/SWAT.xml b/docs/docbook/projdoc/SWAT.xml index f238e8e1b0..1ea0789661 100644 --- a/docs/docbook/projdoc/SWAT.xml +++ b/docs/docbook/projdoc/SWAT.xml @@ -4,7 +4,7 @@ April 21, 2003 -SWAT - The Samba Web Admininistration Tool +SWAT - The Samba Web Administration Tool There are many and varied opinions regarding the usefulness or otherwise of SWAT. @@ -17,7 +17,7 @@ management. -SWAT Features and Benefits +Features and Benefits There are network administrators who believe that it is a good idea to write systems @@ -25,7 +25,7 @@ documentation inside configuration files, for them SWAT will aways be a nasty to does not store the configuration file in any intermediate form, rather, it stores only the parameter settings, so when SWAT writes the smb.conf file to disk it will write only those parameters that are at other than the default settings. The result is that all comments -will be lost from the smb.conf file. Additionally, the parameters will be written back in +will be lost from the &smb.conf; file. Additionally, the parameters will be written back in internal ordering. @@ -40,8 +40,8 @@ and only non-default settings will be written to the file. SWAT should be installed to run via the network super daemon. Depending on which system -your Unix/Linux system has you will have either an inetd or -xinetd based system. +your Unix/Linux system has you will have either an inetd or +xinetd based system. @@ -86,7 +86,7 @@ A control file for the newer style xinetd could be: -Both the above examples assume that the swat binary has been +Both the above examples assume that the swat binary has been located in the /usr/sbin directory. In addition to the above SWAT will use a directory access point from which it will load it's help files as well as other control information. The default location for this on most Linux @@ -98,14 +98,16 @@ location using samba defaults will be /usr/local/samba/swat Access to SWAT will prompt for a logon. If you log onto SWAT as any non-root user the only permission allowed is to view certain aspects of configuration as well as access to the password change facility. The buttons that will be exposed to the non-root -user are: HOME, STATUS, VIEW, PASSWORD. The only page that allows -change capability in this case is PASSWORD. +user are: HOME, STATUS, VIEW, +PASSWORD. The only page that allows +change capability in this case is PASSWORD. -So long as you log onto SWAT as the user root you should obtain +So long as you log onto SWAT as the user root you should obtain full change and commit ability. The buttons that will be exposed includes: -HOME, GLOBALS, SHARES, PRINTERS, WIZARD, STATUS, VIEW, PASSWORD. +HOME, GLOBALS, SHARES, PRINTERS, +WIZARD, STATUS, VIEW, PASSWORD. @@ -122,35 +124,35 @@ administration of Samba. Here is a method that works, courtesy of Markus Krieger Modifications to the swat setup are as following: - - + + install OpenSSL - + - + generate certificate and private key - - root# /usr/bin/openssl req -new -x509 -days 365 -nodes -config \ - /usr/share/doc/packages/stunnel/stunnel.cnf \ - -out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem - + +&rootprompt;/usr/bin/openssl req -new -x509 -days 365 -nodes -config \ + /usr/share/doc/packages/stunnel/stunnel.cnf \ + -out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem + - + remove swat-entry from [x]inetd - + - + start stunnel - - root# stunnel -p /etc/stunnel/stunnel.pem -d 901 \ - -l /usr/local/samba/bin/swat swat - - + +&rootprompt;stunnel -p /etc/stunnel/stunnel.pem -d 901 \ + -l /usr/local/samba/bin/swat swat + + -afterwards simply contact to swat by using the URL "https://myhost:901", accept the certificate +afterwords simply contact to swat by using the URL https://myhost:901, accept the certificate and the SSL connection is up. @@ -167,19 +169,19 @@ document) as well as the O'Reilly book "Using Samba". Administrators who wish to validate their samba configuration may obtain useful information -from the man pages for the diganostic utilities. These are available from the SWAT home page +from the man pages for the diagnostic utilities. These are available from the SWAT home page also. One diagnostic tool that is NOT mentioned on this page, but that is particularly useful is ethereal, available from http://www.ethereal.com. - + SWAT can be configured to run in demo mode. This is NOT recommended as it runs SWAT without authentication and with full administrative ability. ie: Allows -changes to smb.conf as well as general operation with root privilidges. The option that -creates this ability is the -a flag to swat. DO NOT USE THIS IN ANY -PRODUCTION ENVIRONMENT - you have been warned! - +changes to smb.conf as well as general operation with root privileges. The option that +creates this ability is the flag to swat. Do not use this in any +production environment. + @@ -193,16 +195,16 @@ in smb.conf. There are three levels of exposure of the parameters: - Basic - exposes common configuration options. + Basic - exposes common configuration options. - Advanced - exposes configuration options needed in more + Advanced - exposes configuration options needed in more complex environments. - Developer - exposes configuration options that only the brave + Developer - exposes configuration options that only the brave will want to tamper with. @@ -210,18 +212,18 @@ in smb.conf. There are three levels of exposure of the parameters: To switch to other than Basic editing ability click on either the Advanced or the Developer dial, then click the -Commit Changes button. +Commit Changes button. After making any changes to configuration parameters make sure that you click on the -Commit Changes button before moving to another area otherwise +Commit Changes button before moving to another area otherwise your changes will be immediately lost. SWAT has context sensitive help. To find out what each parameter is for simply click the -Help link to the left of the configurartion parameter. +Help link to the left of the configuration parameter. @@ -230,17 +232,17 @@ SWAT has context sensitive help. To find out what each parameter is for simply c Share Settings -To affect a currenly configured share, simply click on the pull down button between the -Choose Share and the Delete Share buttons, +To affect a currently configured share, simply click on the pull down button between the +Choose Share and the Delete Share buttons, select the share you wish to operate on, then to edit the settings click on the -Choose Share button, to delete the share simply press the -Delete Share button. +Choose Share button, to delete the share simply press the +Delete Share button. -To create a new share, next to the button labelled Create Share enter +To create a new share, next to the button labelled Create Share enter into the text field the name of the share to be created, then click on the -Create Share button. +Create Share button. @@ -249,17 +251,17 @@ into the text field the name of the share to be created, then click on the Printers Settings -To affect a currenly configured printer, simply click on the pull down button between the -Choose Printer and the Delete Printer buttons, +To affect a currently configured printer, simply click on the pull down button between the +Choose Printer and the Delete Printer buttons, select the printer you wish to operate on, then to edit the settings click on the -Choose Printer button, to delete the share simply press the -Delete Printer button. +Choose Printer button, to delete the share simply press the +Delete Printer button. -To create a new printer, next to the button labelled Create Printer enter +To create a new printer, next to the button labelled Create Printer enter into the text field the name of the share to be created, then click on the -Create Printer button. +Create Printer button. @@ -268,26 +270,26 @@ into the text field the name of the share to be created, then click on the The SWAT Wizard -The purpose if the SWAT Wizard is to help the Microsoft knowledgable network administrator +The purpose if the SWAT Wizard is to help the Microsoft knowledgeable network administrator to configure Samba with a minimum of effort. -The Wizard page provides a tool for rewiting the smb.conf file in fully optimised format. +The Wizard page provides a tool for rewriting the smb.conf file in fully optimised format. This will also happen if you press the commit button. The two differ in the the rewrite button ignores any changes that may have been made, while the Commit button causes all changes to be affected. -The Edit button permits the editing (setting) of the minimal set of -options that may be necessary to create a working samba server. +The Edit button permits the editing (setting) of the minimal set of +options that may be necessary to create a working Samba server. -Finally, there are a limited set of options that will determine what type of server samba +Finally, there are a limited set of options that will determine what type of server Samba will be configured for, whether it will be a WINS server, participate as a WINS client, or -operate with no WINS support. By clicking on one button you can elect to epose (or not) user +operate with no WINS support. By clicking on one button you can elect to expose (or not) user home directories. @@ -298,7 +300,7 @@ home directories. The status page serves a limited purpose. Firstly, it allows control of the samba daemons. -The key daemons that create the samba server environment are: smbd, nmbd, winbindd. +The key daemons that create the samba server environment are: &smbd;, &nmbd;, &winbindd;. @@ -319,8 +321,8 @@ free files that may be locked. The View Page -This page allows the administrator to view the optimised smb.conf file and if you are -particularly massochistic will permit you also to see all possible global configuration +This page allows the administrator to view the optimised &smb.conf; file and, if you are +particularly masochistic, will permit you also to see all possible global configuration parameters and their settings. @@ -337,7 +339,7 @@ this tool to change a local password for a user account. When logged in as a non-root account the user will have to provide the old password as well as -the new password (twice). When logged in as root only the new password is +the new password (twice). When logged in as root only the new password is required. diff --git a/docs/docbook/projdoc/Samba-BDC-HOWTO.xml b/docs/docbook/projdoc/Samba-BDC-HOWTO.xml index 552834e929..52e53a51c7 100644 --- a/docs/docbook/projdoc/Samba-BDC-HOWTO.xml +++ b/docs/docbook/projdoc/Samba-BDC-HOWTO.xml @@ -10,16 +10,16 @@ Before you continue reading in this section, please make sure that you are comfortable with configuring a Samba Domain Controller as described in the -Domain Control Chapter. +Domain Control chapter. Features And Benefits -This is one of the most difficult chapters to summarise. It matters not what we say here +This is one of the most difficult chapters to summarise. It does not matter what we say here for someone will still draw conclusions and / or approach the Samba-Team with expectations -that are either not yet capable of being delivered, or that can be achieved for more +that are either not yet capable of being delivered, or that can be achieved far more effectively using a totally different approach. Since this HOWTO is already so large and extensive, we have taken the decision to provide sufficient (but not comprehensive) information regarding Backup Domain Control. In the event that you should have a persistent @@ -46,7 +46,7 @@ The use of a non-LDAP backend SAM database is particularly problematic because D servers and workstations periodically change the machine trust account password. The new password is then stored only locally. This means that in the absence of a centrally stored accounts database (such as that provided with an LDAP based solution) if Samba-3 is running -as a BDC, the PDC instance of the Domain member trust account password will not reach the +as a BDC, the BDC instance of the Domain member trust account password will not reach the PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs this results in overwriting of the SAM that contains the updated (changed) trust account password with resulting breakage of the domain trust. @@ -74,7 +74,7 @@ lets consider each possible option and look at the pro's and con's for each theo - Passdb Backend is tdbsam based, BDCs use cron based "net rcp vampire" to + Passdb Backend is tdbsam based, BDCs use cron based "net rpc vampire" to suck down the Accounts database from the PDC @@ -131,7 +131,7 @@ provided this capability. The technology has become known as the LanMan Netlogon -When MS Windows NT3.10 was first released it supported an new style of Domain Control +When MS Windows NT3.10 was first released, it supported an new style of Domain Control and with it a new form of the network logon service that has extended functionality. This service became known as the NT NetLogon Service. The nature of this service has changed with the evolution of MS Windows NT and today provides a very complex array of @@ -142,11 +142,11 @@ services that are implemented over a complex spectrum of technologies. MS Windows NT4 Style Domain Control -Whenever a user logs into a Windows NT4 / 200x / XP Profresional Workstation, +Whenever a user logs into a Windows NT4 / 200x / XP Professional Workstation, the workstation connects to a Domain Controller (authentication server) to validate the username and password that the user entered are valid. If the information entered does not validate against the account information that has been stored in the Domain -Control database (the SAM, or Security Accounts Manager database) then a set of error +Control database (the SAM, or Security Account Manager database) then a set of error codes is returned to the workstation that has made the authentication request. @@ -177,7 +177,7 @@ There are two situations in which it is desirable to install Backup Domain Contr - On the local network that the Primary Domain Controller is on if there are many + On the local network that the Primary Domain Controller is on, if there are many workstations and/or where the PDC is generally very busy. In this case the BDCs will pick up network logon requests and help to add robustness to network services. @@ -198,7 +198,7 @@ has the PDC, the change will likely be made directly to the PDC instance of the copy of the SAM. In the event that this update may be performed in a branch office the change will likely be stored in a delta file on the local BDC. The BDC will then send a trigger to the PDC to commence the process of SAM synchronisation. The PDC will then -request the delta from the BDC and apply it to the master SAM. THe PDC will then contact +request the delta from the BDC and apply it to the master SAM. The PDC will then contact all the BDCs in the Domain and trigger them to obtain the update and then apply that to their own copy of the SAM. @@ -225,7 +225,7 @@ Server Manager for Domains. Since version 2.2 Samba officially supports domain logons for all current Windows Clients, including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some -parameters in the [global]-section of the smb.conf have to be set: +parameters in the [global]-section of the &smb.conf; have to be set: @@ -235,9 +235,9 @@ parameters in the [global]-section of the smb.conf have to be set: -Several other things like a [homes] and a [netlogon] share also need to be set along with +Several other things like a [homes] and a [netlogon] share also need to be set along with settings for the profile path, the users home drive, etc.. This will not be covered in this -chapter, for more information please refer to the chapter on Domain Control. +chapter, for more information please refer to the chapter on Domain Control. @@ -251,7 +251,7 @@ As of the release of MS Windows 2000 and Active Directory, this information is n in a directory that can be replicated and for which partial or full administrative control can be delegated. Samba-3 is NOT able to be a Domain Controller within an Active Directory tree, and it can not be an Active Directory server. This means that Samba-3 also can NOT -act as a Backup Domain Contoller to an Active Directory Domain Controller. +act as a Backup Domain Controller to an Active Directory Domain Controller. @@ -280,7 +280,7 @@ by doing a NetBIOS name query for the group name SAMBA<#1c>. It assumes th of the machines it gets back from the queries is a domain controller and can answer logon requests. To not open security holes both the workstation and the selected domain controller authenticate each other. After that the workstation sends the user's credentials (name and -password) to the local Domain Controller, for valdation. +password) to the local Domain Controller, for validation. @@ -306,8 +306,12 @@ Several things have to be done: To retrieve the domain SID from the PDC or an existing BDC and store it in the - secrets.tdb, execute 'net rpc getsid' on the BDC. - + secrets.tdb, execute: + + + &rootprompt;net rpc getsid + + The Unix user database has to be synchronized from the PDC to the @@ -316,14 +320,18 @@ Several things have to be done: whenever changes are made, or the PDC is set up as a NIS master server and the BDC as a NIS slave server. To set up the BDC as a mere NIS client would not be enough, as the BDC would not be able to - access its user database in case of a PDC failure. + access its user database in case of a PDC failure. NIS is by no means + the only method to synchronize passwords. An LDAP solution would work + as well. - The Samba password database in the file private/smbpasswd has to be - replicated from the PDC to the BDC. This is a bit tricky, see the - next section. + The Samba password database has to be replicated from the PDC to the BDC. + As said above, though possible to synchronise the smbpasswd + file with rsync and ssh, this method is broken and flawed, and is + therefore not recommended. A better solution is to set up slave LDAP + servers for each BDC and a master LDAP server for the PDC. @@ -343,14 +351,13 @@ Finally, the BDC has to be found by the workstations. This can be done by settin -Essential Parameters for BDC Operation workgroup = SAMBA domain master = no domain logons = yes -in the [global]-section of the smb.conf of the BDC. This makes the BDC +in the [global]-section of the &smb.conf; of the BDC. This makes the BDC only register the name SAMBA<#1c> with the WINS server. This is no problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to be registered by more than one machine. The parameter 'domain master = @@ -365,7 +372,7 @@ name is reserved for the Primary Domain Controller. Common Errors -As this is a rather new area for Samba there are not many examples thta we may refer to. Keep +As this is a rather new area for Samba there are not many examples that we may refer to. Keep watching for updates to this section. @@ -379,7 +386,12 @@ are not copied back to the central server. The newer machine account password is written when the SAM is copied from the PDC. The result is that the Domain member machine on start up will find that it's passwords does not match the one now in the database and since the startup security check will now fail, this machine will not allow logon attempts -to procede and the account expiry error will be reported. +to proceed and the account expiry error will be reported. + + + +The solution: use a more robust passdb backend, such as the ldapsam backend, setting up +an slave LDAP server for each BDC, and a master LDAP server for the PDC. @@ -419,10 +431,16 @@ has to be replicated to the BDC. So replicating the smbpasswd file very often is As the smbpasswd file contains plain text password equivalents, it must not be sent unencrypted over the wire. The best way to set up smbpasswd replication from the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport. -Ssh itself can be set up to accept *only* rsync transfer without requiring the user +Ssh itself can be set up to accept only rsync transfer without requiring the user to type a password. + +As said a few times before, use of this method is broken and flawed. Machine trust +accounts will go out of sync, resulting in a very broken domain. This method is +not recommended. Try using LDAP instead. + + diff --git a/docs/docbook/projdoc/Samba-PDC-HOWTO.xml b/docs/docbook/projdoc/Samba-PDC-HOWTO.xml index e8c60c8d6d..f208e16d28 100644 --- a/docs/docbook/projdoc/Samba-PDC-HOWTO.xml +++ b/docs/docbook/projdoc/Samba-PDC-HOWTO.xml @@ -17,7 +17,7 @@ <emphasis>The Essence of Learning:</emphasis> There are many who approach MS Windows networking with incredible misconceptions. -That's OK, because it give the rest of us plenty of opportunity to be of assistance. +That's OK, because it gives the rest of us plenty of opportunity to be of assistance. Those who really want help would be well advised to become familiar with information that is already available. @@ -33,34 +33,34 @@ that in some magical way is expected to solve all ills. -From the Samba mailing list one can readilly identify many common networking issues. +From the Samba mailing list one can readily identify many common networking issues. If you are not clear on the following subjects, then it will do much good to read the sections of this HOWTO that deal with it. These are the most common causes of MS Windows networking problems: - - Basic TCP/IP configuration - NetBIOS name resolution - Authentication configuration - User and Group configuration - Basic File and Directory Permission Control in Unix/Linux - Understanding of how MS Windows clients interoperate in a network - environment - + + Basic TCP/IP configuration + NetBIOS name resolution + Authentication configuration + User and Group configuration + Basic File and Directory Permission Control in Unix/Linux + Understanding of how MS Windows clients interoperate in a network + environment + -Do not be put off, on the surface of it MS Windows networking seems so simple that any fool +Do not be put off; on the surface of it MS Windows networking seems so simple that any fool can do it. In fact, it is not a good idea to set up an MS Windows network with inadequate training and preparation. But let's get our first indelible principle out of the way: It is perfectly OK to make mistakes! In the right place and at the right time, mistakes are the essence of learning. It is very much -not Ok to make mistakes that cause loss of productivity and impose an avoidable financial +not ok to make mistakes that cause loss of productivity and impose an avoidable financial burden on an organisation. -Where is the right place to make mistakes? Only out of harms' way! If you are going to +Where is the right place to make mistakes? Only out of harm's way! If you are going to make mistakes, then please do this on a test network, away from users and in such a way as to not inflict pain on others. Do your learning on a test network. @@ -73,7 +73,7 @@ to not inflict pain on others. Do your learning on a test network. -In a word, Single Sign On, or SSO for short. This to many is the holy +In a word, Single Sign On, or SSO for short. To many, this is the holy grail of MS Windows NT and beyond networking. SSO allows users in a well designed network to log onto any workstation that is a member of the domain that their user account is in (or in a domain that has an appropriate trust relationship with the domain they are visiting) @@ -90,8 +90,8 @@ The benefits of Domain security are fully available to those sites that deploy a Network clients of an MS Windows Domain security environment must be Domain members to be able to gain access to the advanced features provided. Domain membership involves more than just setting the workgroup name to the Domain name. It requires the creation of a Domain trust account -for the workstation (called a machine account). Please refer to the chapter on Domain Membership -for more information. +for the workstation (called a machine account). Please refer to the chapter on +Domain Membership for more information. @@ -106,20 +106,20 @@ The following functionalities are new to the Samba-3 release: Adding users via the User Manager for Domains. This can be done on any MS Windows client using the Nexus toolkit that is available from Microsoft's web site. - At some later date Samba-3 may get support for the use of the Microsoft Manangement + At some later date Samba-3 may get support for the use of the Microsoft Management Console for user management. Introduces replaceable and multiple user account (authentication) - back ends. In the case where the back end is placed in an LDAP database + back ends. In the case where the back end is placed in an LDAP database, Samba-3 confers the benefits of a back end that can be distributed, replicated, - and highly scalable. + and is highly scalable. Implements full Unicode support. This simplifies cross locale internationalisation - support. It also opens up the use of protocols that samba-2.2.x had but could not use due + support. It also opens up the use of protocols that Samba-2.2.x had but could not use due to the need to fully support Unicode. @@ -140,7 +140,7 @@ The following functionalities are NOT provided by Samba-3: Active Directory Domain Control ability that is at this time purely experimental AND that is certain to change as it becomes a fully supported feature some time - during the samba-3 (or later) life cycle. + during the Samba-3 (or later) life cycle. @@ -149,24 +149,26 @@ Windows 9x / Me / XP Home clients are not true members of a domain for reasons o in this chapter. The protocol for support of Windows 9x / Me style network (domain) logons is completely different from NT4 / Win2k type domain logons and has been officially supported for some time. These clients use the old LanMan Network Logon facilities that are supported -in Samba since approximately the samba-1.9.15 series. +in Samba since approximately the Samba-1.9.15 series. Samba-3 has an implementation of group mapping between Windows NT groups -and Unix groups (this is really quite complicated to explain in a short space) this is -discussed more fully in a chapter dedicated to this topic.. +and Unix groups (this is really quite complicated to explain in a short space). This is +discussed more fully in the Group Mapping chapter. -A Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store +Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store user and machine trust account information in a suitable backend data store. With Samba-3 there can be multiple back-ends for this including: + + - smbpasswd - the plain ascii file stored used by + smbpasswd - the plain ASCII file stored used by earlier versions of Samba. This file configuration option requires a Unix/Linux system account for EVERY entry (ie: both for user and for machine accounts). This file will be located in the private @@ -176,8 +178,8 @@ there can be multiple back-ends for this including: tdbsam - a binary database backend that will be stored in the private directory in a file called - passwd.tdb. The key benefit of this binary format - file is that it can store binary objects that can not be accomodated + passdb.tdb. The key benefit of this binary format + file is that it can store binary objects that can not be accommodated in the traditional plain text smbpasswd file. These permit the extended account controls that MS Windows NT4 and later also have. @@ -194,13 +196,13 @@ there can be multiple back-ends for this including: ldapsam_compat - An LDAP back-end that maintains backwards compatibility with the behaviour of samba-2.2.x. You should use this in the process - of mirgrating from samba-2.2.x to samba-3 if you do not want to rebuild your LDAP + of migrating from samba-2.2.x to samba-3 if you do not want to rebuild your LDAP database. -Read the chapter about the User Database for details +Read the chapter about Account Information Database for details regarding the choices available and how to configure them. @@ -220,8 +222,8 @@ to the default configuration. Basics of Domain Control -Over the years public perceptions of what Domain Control really is has taken on an -almost mystical nature. Before we branch into a brief overview of Domain Control +Over the years, public perceptions of what Domain Control really is has taken on an +almost mystical nature. Before we branch into a brief overview of Domain Control, there are three basic types of domain controllers: @@ -238,22 +240,22 @@ there are three basic types of domain controllers: The Primary Domain Controller or PDC plays an important role in the MS Windows NT4 and Windows 200x Domain Control architecture, but not in the manner that so many expect. There is folk lore that dictates that because of it's role in the MS Windows -network that the PDC should be the most powerful and most capable machine in the network. +network, the PDC should be the most powerful and most capable machine in the network. As strange as it may seem to say this here, good over all network performance dictates that the entire infrastructure needs to be balanced. It is advisable to invest more in the Backup Domain Controllers and Stand-Alone (or Domain Member) servers than in the PDC. -In the case of MS Windows NT4 style domaines it is the PDC seeds the Domain Control database, -a part of the Windows registry called the SAM (Security Accounts Management). It plays a key +In the case of MS Windows NT4 style domains, it is the PDC seeds the Domain Control database, +a part of the Windows registry called the SAM (Security Account Manager). It plays a key part in NT4 type domain user authentication and in synchronisation of the domain authentication database with Backup Domain Controllers. With MS Windows 200x Server based Active Directory domains, one domain controller seeds a potential -hierachy of domain controllers, each with their own area of delegated control. The master domain +hierarchy of domain controllers, each with their own area of delegated control. The master domain controller has the ability to override any down-stream controller, but a down-line controller has control only over it's down-line. With Samba-3 this functionality can be implemented using an LDAP based user and machine account back end. @@ -262,9 +264,9 @@ LDAP based user and machine account back end. New to Samba-3 is the ability to use a back-end database that holds the same type of data as the NT4 style SAM (Security Account Manager) database (one of the registry files). -The samba-3 SAM can be specified via the smb.conf file parameter -passwd backend and valid options include -smbpasswd, tdbsam, ldapsam, nisplussam, xmlsam, mysqlsam, plugin, guest. +The Samba-3 SAM can be specified via the smb.conf file parameter +passwd backend and valid options include +smbpasswd, tdbsam, ldapsam, nisplussam, xmlsam, mysqlsam, guest. @@ -272,23 +274,23 @@ The Backup Domain Controller or BDC plays a key role in ser authentication requests. The BDC is biased to answer logon requests in preference to the PDC. On a network segment that has a BDC and a PDC the BDC will be most likely to service network logon requests. The PDC will answer network logon requests when the BDC is too busy (high load). -A BDC can be promoted to a PDC. If the PDC is on line at the time that the BDC is promoted to -PDC the previous PDC is automatically demoted to a BDC. With Samba-3 this is NOT an automatic -operation, the PDB and BDC must be manually configured and changes need to be made likewise. +A BDC can be promoted to a PDC. If the PDC is on line at the time that a BDC is promoted to +PDC, the previous PDC is automatically demoted to a BDC. With Samba-3 this is NOT an automatic +operation; the PDC and BDC must be manually configured and changes need to be made likewise. -With MS Windows NT4 it is an install time decision what type of machine the server will be. -It is possible to change the promote a BDC to a PDC and vica versa only, but the only way +With MS Windows NT4, it is an install time decision what type of machine the server will be. +It is possible to change the promote a BDC to a PDC and vice versa only, but the only way to convert a domain controller to a domain member server or a stand-alone server is to reinstall it. The install time choices offered are: - Primary Domain Controller - The one that seeds the domain SAM - Backup Domain Controller - One that obtains a copy of the domain SAM - Domain Member Server - One that has NO copy of the domain SAM, rather it obtains authentication from a Domain Controller for all access controls. - Stand-Alone Server - One that plays NO part is SAM synchronisation, has it's own authentication database and plays no role in Domain security. + Primary Domain Controller - The one that seeds the domain SAM + Backup Domain Controller - One that obtains a copy of the domain SAM + Domain Member Server - One that has NO copy of the domain SAM, rather it obtains authentication from a Domain Controller for all access controls. + Stand-Alone Server - One that plays NO part is SAM synchronisation, has it's own authentication database and plays no role in Domain security. @@ -300,14 +302,14 @@ Active Directory domain. New to Samba-3 is the ability to function fully as an MS Windows NT4 style Domain Controller, excluding the SAM replication components. However, please be aware that Samba-3 support the -MS Windows 200x domain control protcols also. +MS Windows 200x domain control protocols also. At this time any appearance that Samba-3 is capable of acting as an ADS Domain Controller is limited and experimental in nature. -This functionality should not be used until the samba-team offers formal support for it. -At such a time, the documentation will be revised to duely reflect all configuration and +This functionality should not be used until the Samba-Team offers formal support for it. +At such a time, the documentation will be revised to duly reflect all configuration and management requirements. @@ -329,14 +331,14 @@ other than the machine being configured so that the network configuration has a for it's workgroup entry. It is not uncommon for the name WORKGROUP to be used for this. With this mode of configuration there are NO machine trust accounts and any concept of membership as such is limited to the fact that all machines appear in the network neighbourhood to be logically -groupped together. Again, just to be clear: WORKGROUP MODE DOES NOT INVOLVE ANY SECURITY MACHINE -ACCOUNTS. +grouped together. Again, just to be clear: workgroup mode does not involve any security machine +accounts. Domain member machines have a machine account in the Domain accounts database. A special procedure must be followed on each machine to affect Domain membership. This procedure, which can be done -only by the local machine Adminisistrator account, will create the Domain machine account (if +only by the local machine Administrator account, will create the Domain machine account (if if does not exist), and then initializes that account. When the client first logs onto the Domain it triggers a machine password change. @@ -344,8 +346,9 @@ Domain it triggers a machine password change. When running a Domain all MS Windows NT / 200x / XP Professional clients should be configured as full Domain Members - IF A SECURE NETWORK IS WANTED. If the machine is NOT made a member of the -Domain, then it will operate like a workgroup (stand-alone) machine. Please refer to the chapter -on Domain Membership for information regarding HOW to make your MS Windows clients Domain members. +Domain, then it will operate like a workgroup (stand-alone) machine. Please refer the +Domain Membership chapter for information regarding + HOW to make your MS Windows clients Domain members. @@ -353,85 +356,40 @@ The following are necessary for configuring Samba-3 as an MS Windows NT4 style P NT4 / 200x / XP clients. - - - Configuration of basic TCP/IP and MS Windows Networking - - - - Correct designation of the Server Role (security = user) - - - - Consistent configuration of Name Resolution (See chapter on Browsing and on - MS Windows network Integration) - - - - Domain logons for Windows NT4 / 200x / XP Professional clients - - - - Configuration of Roaming Profiles or explicit configuration to force local profile usage - - - - Configuration of Network/System Policies - - - - Adding and managing domain user accounts - - - - Configuring MS Windows client machines to become domain members - - + + Configuration of basic TCP/IP and MS Windows Networking + Correct designation of the Server Role (security = user) + Consistent configuration of Name Resolution (See chapter on Browsing and on + MS Windows network Integration) + Domain logons for Windows NT4 / 200x / XP Professional clients + Configuration of Roaming Profiles or explicit configuration to force local profile usage + Configuration of Network/System Policies + Adding and managing domain user accounts + Configuring MS Windows client machines to become domain members + The following provisions are required to serve MS Windows 9x / Me Clients: - - - Configuration of basic TCP/IP and MS Windows Networking - - - - Correct designation of the Server Role (security = user) - - - - Network Logon Configuration (Since Windows 9x / XP Home are not technically domain - members, they do not really particpate in the security aspects of Domain logons as such) - - - - Roaming Profile Configuration - - - - Configuration of System Policy handling - - - - Installation of the Network driver "Client for MS Windows Networks" and configuration - to log onto the domain - - - - Placing Windows 9x / Me clients in user level security - if it is desired to allow - all client share access to be controlled according to domain user / group identities. - - - - Adding and managing domain user accounts - - + + Configuration of basic TCP/IP and MS Windows Networking + Correct designation of the Server Role (security = user) + Network Logon Configuration (Since Windows 9x / XP Home are not technically domain + members, they do not really participate in the security aspects of Domain logons as such) + Roaming Profile Configuration + Configuration of System Policy handling + Installation of the Network driver "Client for MS Windows Networks" and configuration + to log onto the domain + Placing Windows 9x / Me clients in user level security - if it is desired to allow + all client share access to be controlled according to domain user / group identities. + Adding and managing domain user accounts + Roaming Profiles and System/Network policies are advanced network administration topics -that are covered separately in this document. However, these are not necessarily specific +that are covered in the Profile Management and +Policy Management chapters of this document. However, these are not necessarily specific to a Samba PDC as much as they are related to Windows NT networking concepts. @@ -441,7 +399,7 @@ A Domain Controller is an SMB/CIFS server that: - Advertises and registers itself as a Domain Controller (Through NetBIOS broadcasts + Registers and advertises itself as a Domain Controller (through NetBIOS broadcasts as well as by way of name registrations either by Mailslot Broadcasts over UDP broadcast, to a WINS server over UDP unicast, or via DNS and Active Directory) @@ -458,8 +416,8 @@ A Domain Controller is an SMB/CIFS server that: -For samba to provide these is rather easy to configure. Each Samba Domain Controller must provide -the NETLOGON service which samba calls the domain logons functionality +For Samba to provide these is rather easy to configure. Each Samba Domain Controller must provide +the NETLOGON service which Samba calls the domain logons functionality (after the name of the parameter in the &smb.conf; file). Additionally, one (1) server in a Samba-3 Domain must advertise itself as the domain master browser. This causes the Primary Domain Controller to claim domain specific NetBIOS name that identifies it as a domain master browser for its given @@ -557,12 +515,12 @@ There are a couple of points to emphasize in the above configuration. Encrypted passwords must be enabled. For more details on how - to do this, refer to the User Database chapter. + to do this, refer to Account Information Database chapter. The server must support domain logons and have a - [netlogon] share + [netlogon] share @@ -579,12 +537,12 @@ There are a couple of points to emphasize in the above configuration. Samba ADS Domain Control -Samba-3 is not and can not act as an Active Directory Server. It can not truely function as +Samba-3 is not and can not act as an Active Directory Server. It can not truly function as an Active Directory Primary Domain Controller. The protocols for some of the functionality -the Active Directory Domain Controllers is have been partially implemented on an experiemental +the Active Directory Domain Controllers is have been partially implemented on an experimental only basis. Please do NOT expect Samba-3 to support these protocols - nor should you depend on any such functionality either now or in the future. The Samba-Team may well remove such -experiemental features or may change their behaviour. +experimental features or may change their behaviour. @@ -602,8 +560,8 @@ an integral part of the essential functionality that is provided by a Domain Con All Domain Controllers must run the netlogon service (domain logons -in Samba. One Domain Controller must be configured with domain master = Yes -(the Primary Domain Controller), on ALL Backup Domain Controllers domain master = No +in Samba). One Domain Controller must be configured with domain master = Yes +(the Primary Domain Controller); on ALL Backup Domain Controllers domain master = No must be set. @@ -611,18 +569,15 @@ must be set. Example Configuration - A minimal configuration to support Domain Logons - - [globals] + [global] domain logons = Yes domain master = (Yes on PDC, No on BDCs) [netlogon] - comment = Network Logon Service + comment = Network Logon Service path = /var/lib/samba/netlogon guest ok = Yes browseable = No - @@ -677,7 +632,7 @@ which are the focus of this section. -When an SMB client in a domain wishes to logon it broadcast requests for a +When an SMB client in a domain wishes to logon, it broadcasts requests for a logon server. The first one to reply gets the job, and validates its password using whatever mechanism the Samba administrator has installed. It is possible (but very stupid) to create a domain where the user @@ -710,7 +665,7 @@ worthwhile to look at how a Windows 9x/ME client performs a logon: a NetLogon request. This is sent to the NetBIOS name DOMAIN<#1c> at the NetBIOS layer. The client chooses the first response it receives, which contains the NetBIOS name of the logon server to use in the format of - \\SERVER. + \\SERVER. @@ -730,7 +685,7 @@ worthwhile to look at how a Windows 9x/ME client performs a logon: - The client then connects to the NetLogon share and searches for this + The client then connects to the NetLogon share and searches for said script and if it is found and can be read, is retrieved and executed by the client. After this, the client disconnects from the NetLogon share. @@ -740,7 +695,7 @@ worthwhile to look at how a Windows 9x/ME client performs a logon: The client then sends a NetUserGetInfo request to the server, to retrieve the user's home share, which is used to search for profiles. Since the - response to the NetUserGetInfo request does not contain much more then + response to the NetUserGetInfo request does not contain much more than the user's home share, profiles for Win9X clients MUST reside in the user home directory. @@ -750,7 +705,7 @@ worthwhile to look at how a Windows 9x/ME client performs a logon: The client then connects to the user's home share and searches for the user's profile. As it turns out, you can specify the user's home share as - a sharename and path. For example, \\server\fred\.winprofile. + a sharename and path. For example, \\server\fred\.winprofile. If the profiles are found, they are implemented. @@ -758,7 +713,7 @@ worthwhile to look at how a Windows 9x/ME client performs a logon: The client then disconnects from the user's home share, and reconnects to - the NetLogon share and looks for CONFIG.POL, the policies file. If this is + the NetLogon share and looks for CONFIG.POL, the policies file. If this is found, it is read and implemented. @@ -782,7 +737,7 @@ The main difference between a PDC and a Windows 9x logon server configuration is -A Samba PDC will act as a Windows 9x logon server, after all it does provide the +A Samba PDC will act as a Windows 9x logon server; after all, it does provide the network logon services that MS Windows 9x / Me expect to find. @@ -816,12 +771,12 @@ For this reason, it is very wise to configure the Samba DC as the DMB. Now back to the issue of configuring a Samba DC to use a mode other -than security = user. If a Samba host is configured to use +than security = user. If a Samba host is configured to use another SMB server or DC in order to validate user connection requests, then it is a fact that some other machine on the network -(the password server) knows more about the user than the Samba host. +(the password server) knows more about the user than the Samba host. 99% of the time, this other host is a domain controller. Now -in order to operate in domain mode security, the workgroup parameter +in order to operate in domain mode security, the workgroup parameter must be set to the name of the Windows NT domain (which already has a domain controller). If the domain does NOT already have a Domain Controller then you do not yet have a Domain! @@ -830,7 +785,7 @@ then you do not yet have a Domain! Configuring a Samba box as a DC for a domain that already by definition has a PDC is asking for trouble. Therefore, you should always configure the Samba DC -to be the DMB for its domain and set security = user. +to be the DMB for its domain and set security = user. This is the only officially supported mode of operation. @@ -844,15 +799,15 @@ This is the only officially supported mode of operation. I cannot include a '$' in a machine name -A 'machine name' in (typically) /etc/passwd -of the machine name with a '$' appended. FreeBSD (and other BSD +A 'machine account', (typically) stored in /etc/passwd, +takes the form of the machine name with a '$' appended. FreeBSD (and other BSD systems?) won't create a user with a '$' in their name. The problem is only in the program used to make the entry. Once made, it works perfectly. -Create a user without the '$' using vipw to edit the entry, adding -the '$'. Or create the whole entry with vipw if you like, make sure you use a unique User ID! +Create a user without the '$'. Then use vipw to edit the entry, adding +the '$'. Or create the whole entry with vipw if you like; make sure you use a unique User ID! @@ -868,9 +823,9 @@ to a share (or IPC$) on the Samba PDC. The following command will remove all network drive connections: - -C:\WINNT\> net use * /d - + + C:\WINNT\> net use * /d + Further, if the machine is already a 'member of a workgroup' that @@ -884,15 +839,15 @@ does not matter what, reboot, and try again. The system can not log you on (C000019B).... I joined the domain successfully but after upgrading -to a newer version of the Samba code I get the message, "The system +to a newer version of the Samba code I get the message, The system can not log you on (C000019B), Please try again or consult your -system administrator" when attempting to logon. +system administrator when attempting to logon. This occurs when the domain SID stored in the secrets.tdb database is changed. The most common cause of a change in domain SID is when -the domain name and/or the server name (netbios name) is changed. +the domain name and/or the server name (NetBIOS name) is changed. The only way to correct the problem is to restore the original domain SID or remove the domain client from the domain and rejoin. The domain SID may be reset using either the net or rpcclient utilities. @@ -901,10 +856,10 @@ SID may be reset using either the net or rpcclient utilities. The reset or change the domain SID you can use the net command as follows: - - net getlocalsid 'OLDNAME' - net setlocalsid 'SID' - + +&rootprompt;net getlocalsid 'OLDNAME' +&rootprompt;net setlocalsid 'SID' + @@ -914,8 +869,8 @@ The reset or change the domain SID you can use the net command as follows: exist or is not accessible. -When I try to join the domain I get the message "The machine account -for this computer either does not exist or is not accessible". What's +When I try to join the domain I get the message The machine account +for this computer either does not exist or is not accessible. What's wrong? @@ -929,13 +884,17 @@ admin user system is working. Alternatively if you are creating account entries manually then they have not been created correctly. Make sure that you have the entry -correct for the machine trust account in smbpasswd file on the Samba PDC. +correct for the machine trust account in smbpasswd file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, make sure that the account name is the machine NetBIOS name with a '$' appended to it ( i.e. computer_name$ ). There must be an entry -in both /etc/passwd and the smbpasswd file. Some people have reported +in both /etc/passwd and the smbpasswd file. + + + +Some people have also reported that inconsistent subnet masks between the Samba server and the NT -client have caused this problem. Make sure that these are consistent +client can cause this problem. Make sure that these are consistent for both client and server. @@ -945,10 +904,18 @@ for both client and server. I get a message about my account being disabled. -At first be ensure to enable the useraccounts with smbpasswd -e -%user%, this is normally done, when you create an account. +Enable the user accounts with smbpasswd -e username +, this is normally done as an account is created. + + + Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable" + + A domain controller has to announce on the network who it is. This usually takes a while. + + + diff --git a/docs/docbook/projdoc/ServerType.xml b/docs/docbook/projdoc/ServerType.xml index ecfeb41735..c740fbefb1 100644 --- a/docs/docbook/projdoc/ServerType.xml +++ b/docs/docbook/projdoc/ServerType.xml @@ -10,8 +10,8 @@ This chapter provides information regarding the types of server that Samba may be configured to be. A Microsoft network administrator who wishes to migrate to or to -use Samba will want to know what within a Samba context, terms familiar to MS Windows -adminstrator mean. This means that it is essential also to define how critical security +use Samba will want to know what, within a Samba context, terms familiar to MS Windows +administrator mean. This means that it is essential also to define how critical security modes function BEFORE we get into the details of how to configure the server itself. @@ -31,21 +31,21 @@ features and benefits. These may be for or against Samba. Two men were walking down a dusty road, when one suddenly kicked up a small red stone. It -hurt his toe and lodged in his sandle. He took the stone out and cursed it with a passion +hurt his toe and lodged in his sandal. He took the stone out and cursed it with a passion and fury fitting his anguish. The other looked at the stone and said, that is a garnet - I can turn that into a precious gem and some day it will make a princess very happy! The moral of this tale: Two men, two very different perspectives regarding the same stone. -Like it or not, Samba is like that stone. Treated the right way and it can bring great -pleasure, but if you are forced upon it and have no time for it's secrets then it can be +Like it or not, Samba is like that stone. Treat it the right way and it can bring great +pleasure, but if you are forced upon it and have no time for its secrets then it can be a source of discomfort. Samba started out as a project that sought to provide interoperability for MS Windows 3.x -clients with a Unix server. It has grown up a lot since it's humble beginnings and now provides +clients with a Unix server. It has grown up a lot since its humble beginnings and now provides features and functionality fit for large scale deployment. It also has some warts. In sections like this one we will tell of both. @@ -92,22 +92,22 @@ So now, what are the benefits of features mentioned in this chapter? Server Types -Adminstrators of Microsoft networks often refer to there being three +Administrators of Microsoft networks often refer to three different type of servers: Domain Controller - - Primary Domain Controller - Backup Domain Controller - ADS Domain Controller - + + Primary Domain Controller + Backup Domain Controller + ADS Domain Controller + Domain Member Server - - Active Directory Member Server - NT4 Style Domain Member Server - + + Active Directory Member Server + NT4 Style Domain Member Server + Stand Alone Server @@ -125,26 +125,27 @@ presented. Samba Security Modes -In this section the function and purpose of Samba's security -modes are described. An acurate understanding of how Samba implements each security +In this section the function and purpose of Samba's security +modes are described. An accurate understanding of how Samba implements each security mode as well as how to configure MS Windows clients for each mode will significantly reduce user complaints and administrator heartache. -There are in the SMB/CIFS networking world only two types of security: USER Level -and SHARE Level. We refer to these collectively as security levels. In implementing these two security levels samba provides flexibilities +In the SMB/CIFS networking world, there are only two types of security: USER Level +and SHARE Level. We refer to these collectively as security levels. In implementing these two security levels Samba provides flexibilities that are not available with Microsoft Windows NT4 / 200x servers. Samba knows of five (5) ways that allow the security levels to be implemented. In actual fact, Samba implements -SHARE Level security only one way, but has for ways of implementing -USER Level security. Collectively, we call the samba implementations -Security Modes. These are: SHARE, USER, DOMAIN, ADS, and SERVER +SHARE Level security only one way, but has four ways of implementing +USER Level security. Collectively, we call the Samba implementations +Security Modes. These are: SHARE, USER, DOMAIN, +ADS, and SERVER modes. They are documented in this chapter. -A SMB server tells the client at startup what security level -it is running. There are two options share level and +A SMB server tells the client at startup what security level +it is running. There are two options: share level and user level. Which of these two the client receives affects the way the client then tries to authenticate itself. It does not directly affect (to any great extent) the way the Samba server does security. This may sound strange, @@ -157,8 +158,8 @@ available and whether an action is allowed. User Level Security -We will describeuser level security first, as its simpler. -In user level security the client will send a +We will describe user level security first, as it's simpler. +In user level security, the client will send a session setup command directly after the protocol negotiation. This contains a username and password. The server can either accept or reject that username/password combination. Note that at this stage the server has no idea what @@ -180,7 +181,7 @@ specified in the session setup. It is also possible for a client to send multiple session setup -requests. When the server responds it gives the client a uid to use +requests. When the server responds, it gives the client a uid to use as an authentication tag for that username/password. The client can maintain multiple authentication contexts in this way (WinDD is an example of an application that does this). @@ -207,14 +208,14 @@ This is the default setting since samba-2.2.x. Share Level Security -Ok, now for share level security. In share level security the client authenticates +Ok, now for share level security. In share level security, the client authenticates itself separately for each share. It will send a password along with each tree connection (share mount). It does not explicitly send a -username with this operation. The client is expecting a password to be associated -with each share, independent of the user. This means that samba has to work out what +username with this operation. The client expects a password to be associated +with each share, independent of the user. This means that Samba has to work out what username the client probably wants to use. It is never explicitly sent the username. Some commercial SMB servers such as NT actually associate passwords directly with -shares in share level security, but samba always uses the unix authentication scheme +shares in share level security, but Samba always uses the unix authentication scheme where it is a username/password pair that is authenticated, not a share/password pair. @@ -230,7 +231,7 @@ level security. They normally send a valid username but no password. Samba recor this username in a list of possible usernames. When the client then does a tree connection it also adds to this list the name of the share they try to connect to (useful for home directories) and any users -listed in the user = &smb.conf; line. The password is then checked +listed in the user = &smb.conf; line. The password is then checked in turn against these possible usernames. If a match is found then the client is authenticated as that user. @@ -247,8 +248,8 @@ The &smb.conf; parameter that sets Share Level Security is: -Plese note that there are reports that recent MS Widows clients do not like to work -with share mode security servers. You are strongly discouraged from use of this parameter. +Please note that there are reports that recent MS Windows clients do not like to work +with share mode security servers. You are strongly discouraged from using share level security. @@ -258,7 +259,7 @@ with share mode security servers. You are strongly discouraged from use of this Domain Security Mode (User Level Security) -When samba is operating in security = domain mode this means that +When Samba is operating in security = domain mode, the Samba server has a domain security trust account (a machine account) and will cause all authentication requests to be passed through to the domain controllers. @@ -274,58 +275,48 @@ This method involves addition of the following parameters in the &smb.conf; file - encrypt passwords = Yes security = domain workgroup = "name_of_NT_domain" - password server = * -The use of the "*" argument to password server will cause samba to locate the -domain controller in a way analogous to the way this is done within MS Windows NT. -This is the default behaviour. - - - -In order for this method to work the Samba server needs to join the MS Windows NT +In order for this method to work, the Samba server needs to join the MS Windows NT security domain. This is done as follows: - - On the MS Windows NT domain controller using - the Server Manager add a machine account for the Samba server. - + + On the MS Windows NT domain controller, using + the Server Manager, add a machine account for the Samba server. + - Next, on the Unix/Linux system execute: - - smbpasswd -r PDC_NAME -j DOMAIN_NAME (samba 2.x) + Next, on the Unix/Linux system execute: + + &rootprompt;smbpasswd -j DOMAIN_NAME -r PDC_NAME (samba-2.x) - net join -U administrator%password (samba-3) - - - - + &rootprompt;net join -U administrator%password (samba-3) + + As of Samba-2.2.4 the Samba 2.2.x series can auto-join a Windows NT4 style Domain just by executing: - - smbpasswd -j DOMAIN_NAME -r PDC_NAME -U Administrator%password - + +&rootprompt;smbpasswd -j DOMAIN_NAME -r PDC_NAME -U Administrator%password + As of Samba-3 the same can be done by executing: - - net join -U Administrator%password - -It is not necessary with Samba-3 to specify the DOMAIN_NAME or the PDC_NAME as it figures this -out from the smb.conf file settings. + +&rootprompt;net join -U Administrator%password + +It is not necessary with Samba-3 to specify the DOMAIN_NAME or the PDC_NAME as it +figures this out from the &smb.conf; file settings. Use of this mode of authentication does require there to be a standard Unix account -for the user in order to assign a uid once the account has been authenticated by +for each user in order to assign a UID once the account has been authenticated by the remote Windows DC. This account can be blocked to prevent logons by clients other than -MS Windows through things such as setting an invalid shell in the +MS Windows through means such as setting an invalid shell in the /etc/passwd entry. @@ -335,6 +326,11 @@ presented in the Winbind Overview chapter in this HOWTO collection. + +For more information of being a domain member, see the Domain +Member section of this Howto. + + @@ -342,7 +338,7 @@ in this HOWTO collection. ADS Security Mode (User Level Security) -Both Samba 2.2 and 3.0 can join an active directory domain. This is +Both Samba 2.2 and 3.0 can join an Active Directory domain. This is possible even if the domain is run in native mode. Active Directory in native mode perfectly allows NT4-style domain members, contrary to popular belief. The only thing that Active Directory in native mode @@ -362,21 +358,22 @@ AD-member mode can accept Kerberos. Example Configuration - - + realm = your.kerberos.REALM security = ADS - encrypt passwords = Yes + -The following parameter may be required: + + The following parameter may be required: + + ads server = your.kerberos.server - - + -Please refer to the Domain Membership section, Active Directory Membership for more information -regarding this configuration option. +Please refer to the Domain Membership and Active Directory +Membership sections for more information regarding this configuration option. @@ -386,28 +383,28 @@ regarding this configuration option. Server Security (User Level Security) -Server level security is a left over from the time when Samba was not capable of acting -as a domain member server. It is highly recommended NOT to use this feature. Server level -security has many draw backs. The draw backs include: +Server security mode is a left over from the time when Samba was not capable of acting +as a domain member server. It is highly recommended NOT to use this feature. Server +security mode has many draw backs. The draw backs include: - - Potential Account Lockout on MS Windows NT4/200x password servers - Lack of assurance that the password server is the one specified - Does not work with Winbind, particularly needed when storing profiles remotely - This mode may open connections to the password server, and keep them open for extended periods. - Security on the samba server breaks badly when the remote password server suddenly shuts down - With this mode there is NO security account in the domain that the password server belongs to for the samba server. - + + Potential Account Lockout on MS Windows NT4/200x password servers + Lack of assurance that the password server is the one specified + Does not work with Winbind, particularly needed when storing profiles remotely + This mode may open connections to the password server, and keep them open for extended periods. + Security on the Samba server breaks badly when the remote password server suddenly shuts down + With this mode there is NO security account in the domain that the password server belongs to for the Samba server. + -In server level security the samba server reports to the client that it is in user level +In server security mode the Samba server reports to the client that it is in user level security. The client then does a session setup as described earlier. -The samba server takes the username/password that the client sends and attempts to login to the -password server by sending exactly the same username/password that -it got from the client. If that server is in user level security and accepts the password -then samba accepts the clients connection. This allows the samba server to use another SMB -server as the password server. +The Samba server takes the username/password that the client sends and attempts to login to the +password server by sending exactly the same username/password that +it got from the client. If that server is in user level security and accepts the password, +then Samba accepts the clients connection. This allows the Samba server to use another SMB +server as the password server. @@ -418,21 +415,21 @@ passwords in encrypted form. Samba supports this type of encryption by default. -The parameter security = server means that Samba reports to clients that +The parameter security = server means that Samba reports to clients that it is running in user mode but actually passes off all authentication requests to another user mode server. This requires an additional -parameter password server that points to the real authentication server. +parameter password server that points to the real authentication server. That real authentication server can be another Samba server or can be a Windows NT server, the later natively capable of encrypted password support. -When Samba is running in server level security it is essential that -the parameter password server is set to the precise netbios machine +When Samba is running in server security mode it is essential that +the parameter password server is set to the precise NetBIOS machine name of the target authentication server. Samba can NOT determine this from NetBIOS name -lookups because the choice of the target authentication server arbitrary and can not -be determined from a domain name. In essence a samba server that is in -server level security is operating in what used to be known as +lookups because the choice of the target authentication server is arbitrary and can not +be determined from a domain name. In essence, a Samba server that is in +server security mode is operating in what used to be known as workgroup mode. @@ -454,8 +451,8 @@ This method involves the additions of the following parameters in the &smb.conf; -There are two ways of identifying whether or not a username and password pair was valid -or not. One uses the reply information provided as part of the authentication messaging +There are two ways of identifying whether or not a username and password pair was valid. +One uses the reply information provided as part of the authentication messaging process, the other uses just an error code. @@ -469,7 +466,7 @@ certain number of failed authentication attempts this will result in user lockou Use of this mode of authentication does require there to be a standard Unix account -for the user, this account can be blocked to prevent logons by other than MS Windows clients. +for the user, though this account can be blocked to prevent logons by non-SMB/CIFS clients. @@ -481,15 +478,15 @@ for the user, this account can be blocked to prevent logons by other than MS Win Seamless Windows Network Integration -MS Windows clients may use encrypted passwords as part of a challenege/response +MS Windows clients may use encrypted passwords as part of a challenge/response authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or clear text strings for simple -password based authentication. It should be realized that with the SMB protocol +password based authentication. It should be realized that with the SMB protocol, the password is passed over the network either in plain text or encrypted, but not both in the same authentication request. -When encrypted passwords are used a password that has been entered by the user +When encrypted passwords are used, a password that has been entered by the user is encrypted in two ways: @@ -499,10 +496,10 @@ is encrypted in two ways: The password is converted to upper case, - and then padded or trucated to 14 bytes. This string is + and then padded or truncated to 14 bytes. This string is then appended with 5 bytes of NULL characters and split to form two 56 bit DES keys to encrypt a "magic" 8 byte value. - The resulting 16 bytes for the LanMan hash. + The resulting 16 bytes form the LanMan hash. @@ -530,29 +527,29 @@ is definitely not a good idea to re-enable plain text password support in such c -The following parameters can be used to work around the issue of Windows 9x client +The following parameters can be used to work around the issue of Windows 9x clients upper casing usernames and password before transmitting them to the SMB server when using clear text authentication. - passsword level = integer + password level = integer username level = integer By default Samba will lower case the username before attempting to lookup the user in the database of local system accounts. Because UNIX usernames conventionally -only contain lower case character, the username level parameter +only contain lower-case characters, the username level parameter is rarely needed. -However, passwords on UNIX systems often make use of mixed case characters. +However, passwords on UNIX systems often make use of mixed-case characters. This means that in order for a user on a Windows 9x client to connect to a Samba server using clear text authentication, the password level -must be set to the maximum number of upper case letter which could -appear is a password. Note that the server OS uses the traditional DES version +must be set to the maximum number of upper case letters which could +appear in a password. Note that the server OS uses the traditional DES version of crypt(), a password level of 8 will result in case insensitive passwords as seen from Windows users. This will also result in longer login times as Samba has to compute the permutations of the password string and @@ -560,7 +557,7 @@ try them one by one until a match is located (or all combinations fail). -The best option to adopt is to enable support for encrypted passwords where ever +The best option to adopt is to enable support for encrypted passwords wherever Samba is used. Most attempts to apply the registry change to re-enable plain text passwords will eventually lead to user complaints and unhappiness. @@ -572,15 +569,15 @@ passwords will eventually lead to user complaints and unhappiness. We all make mistakes. It is Ok to make mistakes, so long as they are made in the right places -and at the right time. A mistake that causes lost productivity is seldom tollerated. A mistake +and at the right time. A mistake that causes lost productivity is seldom tolerated. A mistake made in a developmental test lab is expected. Here we look at common mistakes and misapprehensions that have been the subject of discussions -on the samba mailing lists. Many of these are avoidable by doing you homework before attempting -a Samba implementation. Some are the result of misundertanding of the English language. The -English language has many terms of phrase that are potentially vague and may be highly confusing +on the Samba mailing lists. Many of these are avoidable by doing you homework before attempting +a Samba implementation. Some are the result of misunderstanding of the English language. The +English language has many turns of phrase that are potentially vague and may be highly confusing to those for whom English is not their native tongue. @@ -588,10 +585,10 @@ to those for whom English is not their native tongue. What makes Samba a SERVER? -To some the nature of the samba security mode is very obvious, but entirely -wrong all the same. It is assumed that security = server means that Samba -will act as a server. Not so! See above - this setting means that samba will try -to use another SMB server as it's source of user authentication alone. +To some the nature of the Samba security mode is very obvious, but entirely +wrong all the same. It is assumed that security = server means that Samba +will act as a server. Not so! See above - this setting means that Samba will try +to use another SMB server as its source of user authentication alone. @@ -600,8 +597,8 @@ to use another SMB server as it's source of user authentication alone. What makes Samba a Domain Controller? -The &smb.conf; parameter security = domain does NOT really make Samba behave -as a Domain Controller! This setting means we want samba to be a domain member! +The &smb.conf; parameter security = domain does NOT really make Samba behave +as a Domain Controller! This setting means we want Samba to be a domain member! @@ -610,8 +607,28 @@ as a Domain Controller! This setting means we want samba to be a domain member! What makes Samba a Domain Member? -Guess! So many others do. But whatever you do, do NOT think that security = user -makes Samba act as a domain member. Read the manufacturers manual before the warranty expires! +Guess! So many others do. But whatever you do, do NOT think that security = user +makes Samba act as a domain member. Read the manufacturers manual before the warranty expires! See +the Domain Member section of this Howto for more information. + + + + + + +Constantly Losing Connections to Password Server + + +Why does server_validate() simply give up rather than re-establishing its connection to the +password server? Though I am not fluent in the SMB protocol, perhaps the cluster server +process passes along to its client workstation the session key it receives from the password +server, which means the password hashes submitted by the client would not work on a subsequent +connection, whose session key would be different. So server_validate() must give up. + + + +Indeed. That's why security = server is at best a nasty hack. Please use security = domain. +security = server mode is also known as pass-through authentication. diff --git a/docs/docbook/projdoc/Speed.xml b/docs/docbook/projdoc/Speed.xml index e2ede62ac7..659cd6e31b 100644 --- a/docs/docbook/projdoc/Speed.xml +++ b/docs/docbook/projdoc/Speed.xml @@ -9,9 +9,10 @@ &author.jelmer; + &author.jht; -Samba performance issues +Samba Performance Tuning Comparisons @@ -28,7 +29,7 @@ SMB server. If you want to test against something like a NT or WfWg server then you will have to disable all but TCP on either the client or server. Otherwise you may well be using a totally different protocol -(such as Netbeui) and comparisons may not be valid. +(such as NetBEUI) and comparisons may not be valid. @@ -58,11 +59,11 @@ performance of a TCP based server like Samba. The socket options that Samba uses are settable both on the command -line with the -O option, or in the smb.conf file. +line with the option, or in the &smb.conf; file. -The socket options section of the &smb.conf; manual page describes how +The socket options section of the &smb.conf; manual page describes how to set these and gives recommendations. @@ -75,7 +76,7 @@ much. The correct settings are very dependent on your local network. The socket option TCP_NODELAY is the one that seems to make the biggest single difference for most networks. Many people report that -adding socket options = TCP_NODELAY doubles the read +adding socket options = TCP_NODELAY doubles the read performance of a Samba drive. The best explanation I have seen for this is that the Microsoft TCP/IP stack is slow in sending tcp ACKs. @@ -86,7 +87,7 @@ that the Microsoft TCP/IP stack is slow in sending tcp ACKs. Read size -The option read size affects the overlap of disk +The option read size affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger than this value then the server begins writing @@ -114,9 +115,9 @@ pointless and will cause you to allocate memory unnecessarily. Max xmit -At startup the client and server negotiate a maximum transmit size, +At startup the client and server negotiate a maximum transmit size, which limits the size of nearly all SMB commands. You can set the -maximum size that Samba will negotiate using the max xmit = option +maximum size that Samba will negotiate using the max xmit = option in &smb.conf;. Note that this is the maximum size of SMB requests that Samba will accept, but not the maximum size that the *client* will accept. The client maximum receive size is sent to Samba by the client and Samba @@ -139,7 +140,7 @@ In most cases the default is the best option. Log level -If you set the log level (also known as debug level) higher than 2 +If you set the log level (also known as debug level) higher than 2 then you may suffer a large drop in performance. This is because the server flushes the log file after each operation, which can be very expensive. @@ -150,20 +151,20 @@ expensive. Read raw -The read raw operation is designed to be an optimised, low-latency +The read raw operation is designed to be an optimised, low-latency file read operation. A server may choose to not support it, -however. and Samba makes support for read raw optional, with it +however. and Samba makes support for read raw optional, with it being enabled by default. -In some cases clients don't handle read raw very well and actually +In some cases clients don't handle read raw very well and actually get lower performance using it than they get using the conventional read operations. -So you might like to try read raw = no and see what happens on your +So you might like to try read raw = no and see what happens on your network. It might lower, raise or not affect your performance. Only testing can really tell. @@ -174,14 +175,14 @@ testing can really tell. Write raw -The write raw operation is designed to be an optimised, low-latency +The write raw operation is designed to be an optimised, low-latency file write operation. A server may choose to not support it, -however. and Samba makes support for write raw optional, with it +however. and Samba makes support for write raw optional, with it being enabled by default. -Some machines may find write raw slower than normal write, in which +Some machines may find write raw slower than normal write, in which case you may wish to change this option. @@ -192,31 +193,78 @@ case you may wish to change this option. Slow logins are almost always due to the password checking time. Using -the lowest practical password level will improve things. +the lowest practical password level will improve things. -LDAP +Client tuning -LDAP can be vastly improved by using the -ldap trust ids parameter. +Often a speed problem can be traced to the client. The client (for +example Windows for Workgroups) can often be tuned for better TCP +performance. Check the sections on the various clients in +Samba and Other Clients. + +Samba performance problem due changing kernel + + +Hi everyone. I am running Gentoo on my server and samba 2.2.8a. Recently +I changed kernel version from linux-2.4.19-gentoo-r10 to +linux-2.4.20-wolk4.0s. And now I have performance issue with samba. Ok +many of you will probably say that move to vanilla sources...well I tried +it too and it didn't work. I have 100mb LAN and two computers (linux + +Windows2000). Linux server shares directory with DivX files, client +(windows2000) plays them via LAN. Before when I was running 2.4.19 kernel +everything was fine, but now movies freezes and stops...I tried moving +files between server and Windows and it's terribly slow. + + + +Grab mii-tool and check the duplex settings on the NIC. +My guess is that it is a link layer issue, not an application +layer problem. Also run ifconfig and verify that the framing +error, collisions, etc... look normal for ethernet. + + + -Client tuning +Corrupt tdb Files -Often a speed problem can be traced to the client. The client (for -example Windows for Workgroups) can often be tuned for better TCP -performance. Check the sections on the various clients in -Samba and Other Clients. +Well today it happened, Our first major problem using samba. +Our samba PDC server has been hosting 3 TB of data to our 500+ users +[Windows NT/XP] for the last 3 years using samba, no problem. +But today all shares went SLOW; very slow. Also the main smbd kept +spawning new processes so we had 1600+ running smbd's (normally we avg. 250). +It crashed the SUN E3500 cluster twice. After a lot of searching I +decided to rm /var/locks/*.tdb. Happy again. + + + +Q1) Is there any method of keeping the *.tdb files in top condition or +how to early detect corruption? + + + +A1) Yes, run tdbbackup each time after stopping nmbd and before starting nmbd. + + + +Q2) What I also would like to mention is that the service latency seems +a lot lower then before the locks cleanup, any ideas on keeping it top notch? + + + +A2) Yes! Same answer as for Q1! + diff --git a/docs/docbook/projdoc/StandAloneServer.xml b/docs/docbook/projdoc/StandAloneServer.xml index d8f5992191..206b2f88ce 100644 --- a/docs/docbook/projdoc/StandAloneServer.xml +++ b/docs/docbook/projdoc/StandAloneServer.xml @@ -5,10 +5,10 @@ Stand-Alone Servers -Stand-Alone servers are independant of Domain Controllers on the network. +Stand-Alone servers are independent of Domain Controllers on the network. They are NOT domain members and function more like workgroup servers. In many cases a stand-alone server is configured with a minimum of security control -with the intent that all data served will be readilly accessible to all users. +with the intent that all data served will be readily accessible to all users. @@ -53,26 +53,27 @@ USER mode. No special action is needed other than to create user accounts. Stand-alone servers do NOT provide network logon services. This means that machines that -use this server do NOT perform a domain log onto it. Whatever logon facility -the workstations are subject to is independant of this machine. It is however -necessary to accomodate any network user so that the logon name they use will +use this server do NOT perform a domain logon to it. Whatever logon facility +the workstations are subject to is independent of this machine. It is however +necessary to accommodate any network user so that the logon name they use will be translated (mapped) locally on the stand-alone server to a locally known -user name. There are several ways this cane be done. +user name. There are several ways this can be done. Samba tends to blur the distinction a little in respect of what is a stand-alone server. This is because the authentication database may be -local or on a remote server, even if from the samba protocol perspective -the samba server is NOT a member of a domain security context. +local or on a remote server, even if from the Samba protocol perspective +the Samba server is NOT a member of a domain security context. Through the use of PAM (Pluggable Authentication Modules) and nsswitch (the name service switcher) the source of authentication may reside on another server. We would be inclined to call this the authentication server. -This means that the samba server may use the local Unix/Linux system password database -(/etc/passwd or /etc/shadow), may use a local smbpasswd file, or may use +This means that the Samba server may use the local Unix/Linux system password database +(/etc/passwd or /etc/shadow), may use a +local smbpasswd file, or may use an LDAP back end, or even via PAM and Winbind another CIFS/SMB server for authentication. @@ -99,9 +100,7 @@ nobody. No home directories are shared, that are no users in the /etc/ Unix system database. This is a very simple system to administer. - - Share Mode Read Only Stand-Alone Server # Global parameters [global] workgroup = MYGROUP @@ -115,13 +114,12 @@ Unix system database. This is a very simple system to administer. path = /export guest only = Yes - In the above example the machine name is set to REFDOCS, the workgroup is set to the name of the local workgroup so that the machine will appear in with systems users are familiar with. The only password backend required is the "guest" backend so as to allow default -unprivilidged account names to be used. Given that there is a WINS server on this network +unprivileged account names to be used. Given that there is a WINS server on this network we do use it. @@ -143,11 +141,11 @@ on your system. The print spooling and processing system on our print server will be CUPS. - (Please refer to the chapter on printing for more information). + (Please refer to the CUPS Printing chapter for more information). - All printers will that the print server will service will be network + All printers that the print server will service will be network printers. They will be correctly configured, by the administrator, in the CUPS environment. @@ -161,20 +159,20 @@ on your system. In this example our print server will spool all incoming print jobs to /var/spool/samba until the job is ready to be submitted by -samba to the CUPS print processor. Since all incoming connections will be as -the anonymous (guest) user two things will be required: +Samba to the CUPS print processor. Since all incoming connections will be as +the anonymous (guest) user, two things will be required: -Enablement for Anonymous Printing +Enabling Anonymous Printing The Unix/Linux system must have a guest account. The default for this is usually the account nobody. To find the correct name to use for your version of Samba do the following: - - testparm -s -v | grep "guest account" - + +$ testparm -s -v | grep "guest account" + Then make sure that this account exists in your system password database (/etc/passwd). @@ -183,17 +181,16 @@ the anonymous (guest) user two things will be required: The directory into which Samba will spool the file must have write access for the guest account. The following commands will ensure that this directory is available for use: - - mkdir /var/spool/samba - chown nobody.nobody /var/spool/samba - chmod a+rwt /var/spool/samba - + +&rootprompt;mkdir /var/spool/samba +&rootprompt;chown nobody.nobody /var/spool/samba +&rootprompt;chmod a+rwt /var/spool/samba + - Simple Central Print Server # Global parameters [global] workgroup = MYGROUP diff --git a/docs/docbook/projdoc/UNIX_INSTALL.xml b/docs/docbook/projdoc/UNIX_INSTALL.xml index 3dff9a5528..e919ff8c57 100644 --- a/docs/docbook/projdoc/UNIX_INSTALL.xml +++ b/docs/docbook/projdoc/UNIX_INSTALL.xml @@ -33,7 +33,7 @@ Configuring samba (smb.conf) - Samba's configuration is stored in the smb.conf file, + Samba's configuration is stored in the &smb.conf; file, that usually resides in /etc/samba/smb.conf or /usr/local/samba/lib/smb.conf. You can either edit this file yourself or do it using one of the many graphical @@ -67,19 +67,19 @@ This will allow connections by anyone with an account on the server, using either - their login name or "homes" as the service name. + their login name or "homes" as the service name. (Note that the workgroup that Samba must also be set.) Make sure you put the smb.conf file in the same place - you specified in theMakefile (the default is to + you specified in the Makefile (the default is to look for it in /usr/local/samba/lib/). For more information about security settings for the - [homes] share please refer to the chapter + [homes] share please refer to the chapter Securing Samba. @@ -88,7 +88,7 @@ It's important that you test the validity of your smb.conf - file using the testparm program. If testparm runs OK + file using the &testparm; program. If testparm runs OK then it will list the loaded services. If not it will give an error message. @@ -97,7 +97,7 @@ - Always run testparm again when you change smb.conf! + Always run testparm again when you change &smb.conf;! @@ -115,7 +115,7 @@ To launch SWAT just run your favorite web browser and - point it at "http://localhost:901/". Replace + point it at http://localhost:901/. Replace localhost with the name of the computer you are running samba on if you are running samba on a different computer than your browser. @@ -160,7 +160,7 @@ would be the name of the host where you installed &smbd;. The aservice is any service you have defined in the &smb.conf; - file. Try your user name if you just have a [homes] + file. Try your user name if you just have a [homes] section in &smb.conf;. @@ -212,19 +212,23 @@ The following questions and issues get raised on the samba mailing list over and Why are so many smbd processes eating memory? + Site that is running Samba on an AIX box. They are sharing out about 2 terabytes using samba. Samba was installed using smitty and the binaries. We seem to be experiencing a memory problem -with this box. When I do a svmon -Pu the monitoring program shows that smbd has several +with this box. When I do a svmon -Pu the monitoring program shows that &smbd; has several processes of smbd running: + + Is samba suppose to start this many different smbd processes? Or does it run as one smbd process? Also is it normal for it to be taking up this much memory? + - + Inuse * 4096 = amount of memory being used by this process Pid Command Inuse Pin Pgsp Virtual 64-bit Mthrd @@ -251,34 +255,40 @@ Inuse * 4096 = amount of memory being used by this process 19110 smbd 8404 1906 181 4862 N N Total memory used: 841,592,832 bytes - + -ANSWER: Samba consists on three core programs: -nmbd, smbd, winbindd. nmbd is the name server message daemon, -smbd is the server message daemon, winbind is the daemon that +Samba consists on three core programs: +&nmbd;, &smbd;, &winbindd;. &nmbd; is the name server message daemon, +&smbd; is the server message daemon, &winbindd; is the daemon that handles communication with Domain Controllers. If your system is NOT running as a WINS server, then there will be one (1) single instance of - nmbd running on your system. If it is running as a WINS server then there will be + &nmbd; running on your system. If it is running as a WINS server then there will be two (2) instances - one to handle the WINS requests. -smbd handles ALL connection requests and then spawns a new process for each client +&smbd; handles ALL connection requests and then spawns a new process for each client connection made. That is why you are seeing so many of them, one (1) per client connection. -winbindd will run as one or two daemons, depending on whether or not it is being +&winbindd; will run as one or two daemons, depending on whether or not it is being run in "split mode" (in which case there will be two instances). + + + I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs + Your loopback device isn't working correctly. Make sure it's running. + + diff --git a/docs/docbook/projdoc/VFS.xml b/docs/docbook/projdoc/VFS.xml index 225411b427..67f1b39a99 100644 --- a/docs/docbook/projdoc/VFS.xml +++ b/docs/docbook/projdoc/VFS.xml @@ -2,169 +2,213 @@ &author.jelmer; &author.jht; - AlexanderBokovoy TimPotter - SimoSorce + SimoSorceoriginal vfs_skel README + AlexanderBokovoyoriginal vfs_netatalk docs + StefanMetzmacherUpdate for multiple modules Stackable VFS modules -Introduction and configuration +Features and Benefits -Since samba 3.0, samba supports stackable VFS(Virtual File System) modules. +Since Samba-3, there is support for stackable VFS(Virtual File System) modules. Samba passes each request to access the unix file system thru the loaded VFS modules. This chapter covers all the modules that come with the samba source and references to some external modules. - -You may have problems to compile these modules, as shared libraries are -compiled and linked in different ways on different systems. -They currently have been tested against GNU/linux and IRIX. - - -To use the VFS modules, create a share similar to the one below. The -important parameter is the vfs object parameter which must point to -the exact pathname of the shared library objects. For example, to log all access -to files and use a recycle bin: + - - [audit] - comment = Audited /data directory - path = /data - vfs object = /path/to/audit.so /path/to/recycle.so - writeable = yes - browseable = yes - - + +Discussion -The modules are used in the order they are specified. +If not supplied with your platform distribution binary Samba package you may have problems +to compile these modules, as shared libraries are compiled and linked in different ways +on different systems. They currently have been tested against GNU/Linux and IRIX. -Further documentation on writing VFS modules for Samba can be found in -the Samba Developers Guide. - - - - - -Included modules +To use the VFS modules, create a share similar to the one below. The +important parameter is the vfs objects parameter where +you can list one or more VFS modules by name. For example, to log all access +to files and put deleted files in a recycle bin: - -audit -A simple module to audit file access to the syslog -facility. The following operations are logged: - -share -connect/disconnect -directory opens/create/remove -file open/close/rename/unlink/chmod - + +[audit] + comment = Audited /data directory + path = /data + vfs objects = audit recycle + writeable = yes + browseable = yes + - - -extd_audit -This module is identical with the audit module above except -that it sends audit logs to both syslog as well as the smbd log file/s. The -loglevel for this module is set in the smb.conf file. +The modules are used in the order in which they are specified. -The logging information that will be written to the smbd log file is controlled by -the log level parameter in smb.conf. The -following information will be recorded: +Samba will attempt to load modules from the lib +directory in the root directory of the samba installation (usually +/usr/lib/samba/vfs or /usr/local/samba/lib/vfs +). -Extended Auditing Log Information - - - Log LevelLog Details - File and Directory Operations - - - 0Creation / Deletion - 1Create / Delete / Rename / Permission Changes - 2Create / Delete / Rename / Perm Change / Open / Close - - -
- - - - -recycle -A recycle-bin like module. When used any unlink call -will be intercepted and files moved to the recycle -directory instead of being deleted. - +Some modules can be used twice for the same share. +This can be done using a configuration similar to the one below. -Supported options: - - - vfs_recycle_bin:repository - FIXME - - - - vfs_recycle_bin:keeptree - FIXME - - - - vfs_recycle_bin:versions - FIXME - - - - vfs_recycle_bin:touch - FIXME - - - - vfs_recycle_bin:maxsize - FIXME - - - - vfs_recycle_bin:exclude - FIXME - - - - vfs_recycle_bin:exclude_dir - FIXME - - - - vfs_recycle_bin:noversions - FIXME - - + +[test] + comment = VFS TEST + path = /data + writeable = yes + browseable = yes + vfs objects = example:example1 example example:test + example1: parameter = 1 + example: parameter = 5 + test: parameter = 7 + - - - -netatalk - -A netatalk module, that will ease co-existence of samba and -netatalk file sharing services. - + -Advantages compared to the old netatalk module: - -it doesn't care about creating of .AppleDouble forks, just keeps them in sync -if share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically - - + +Included modules - + + audit + + + A simple module to audit file access to the syslog + facility. The following operations are logged: + + share + connect/disconnect + directory opens/create/remove + file open/close/rename/unlink/chmod + + + + + + + extd_audit + + + This module is identical with the audit module above except + that it sends audit logs to both syslog as well as the smbd log file/s. The + loglevel for this module is set in the smb.conf file. + + + + The logging information that will be written to the smbd log file is controlled by + the log level parameter in smb.conf. The + following information will be recorded: + + + Extended Auditing Log Information + + + Log LevelLog Details - File and Directory Operations + + + 0Creation / Deletion + 1Create / Delete / Rename / Permission Changes + 2Create / Delete / Rename / Perm Change / Open / Close + + +
+ + + + + fake_perms + + + This module was created to allow Roaming Profile files and directories to be set (on the Samba server + under Unix) as read only. This module will if installed on the Profiles share will report to the client + that the Profile files and directories are writable. This satisfies the client even though the files + will never be overwritten as the client logs out or shuts down. + + + + + + recycle + + + A recycle-bin like module. When used any unlink call + will be intercepted and files moved to the recycle + directory instead of being deleted. + + + Supported options: + + + recycle:repository + FIXME + + + + recycle:keeptree + FIXME + + + + recycle:versions + FIXME + + + + recycle:touch + FIXME + + + + recycle:maxsize + FIXME + + + + recycle:exclude + FIXME + + + + recycle:exclude_dir + FIXME + + + + recycle:noversions + FIXME + + + + + + + + netatalk + + + A netatalk module, that will ease co-existence of samba and + netatalk file sharing services. + + + Advantages compared to the old netatalk module: + + it doesn't care about creating of .AppleDouble forks, just keeps them in sync + if a share in &smb.conf; doesn't contain .AppleDouble item in hide or veto list, it will be added automatically + + + + @@ -179,52 +223,60 @@ to have his or her own CVS tree). -No statemets about the stability or functionality of any module +No statements about the stability or functionality of any module should be implied due to its presence here. - -DatabaseFS + + DatabaseFS - -URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php - + + URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php + -By Eric Lorimer. + By Eric Lorimer. - -I have created a VFS module which implements a fairly complete read-only -filesystem. It presents information from a database as a filesystem in -a modular and generic way to allow different databases to be used -(originally designed for organizing MP3s under directories such as -"Artists," "Song Keywords," etc... I have since applied it to a student -roster database very easily). The directory structure is stored in the -database itself and the module makes no assumptions about the database -structure beyond the table it requires to run. - + + I have created a VFS module which implements a fairly complete read-only + filesystem. It presents information from a database as a filesystem in + a modular and generic way to allow different databases to be used + (originally designed for organizing MP3s under directories such as + "Artists," "Song Keywords," etc... I have since applied it to a student + roster database very easily). The directory structure is stored in the + database itself and the module makes no assumptions about the database + structure beyond the table it requires to run. + - -Any feedback would be appreciated: comments, suggestions, patches, -etc... If nothing else, hopefully it might prove useful for someone -else who wishes to create a virtual filesystem. - + + Any feedback would be appreciated: comments, suggestions, patches, + etc... If nothing else, hopefully it might prove useful for someone + else who wishes to create a virtual filesystem. + - + - -vscan -URL: http://www.openantivirus.org/ + + vscan - -samba-vscan is a proof-of-concept module for Samba, which -uses the VFS (virtual file system) features of Samba 2.2.x/3.0 -alphaX. Of couse, Samba has to be compiled with VFS support. -samba-vscan supports various virus scanners and is maintained -by Rainer Link. - + URL: http://www.openantivirus.org/ - + + samba-vscan is a proof-of-concept module for Samba, which + uses the VFS (virtual file system) features of Samba 2.2.x/3.0 + alphaX. Of course, Samba has to be compiled with VFS support. + samba-vscan supports various virus scanners and is maintained + by Rainer Link. + + + +Common Errors + + +There must be some gotchas we should record here! Jelmer??? + + + diff --git a/docs/docbook/projdoc/locking.xml b/docs/docbook/projdoc/locking.xml index 437f7756d9..0e508f682a 100644 --- a/docs/docbook/projdoc/locking.xml +++ b/docs/docbook/projdoc/locking.xml @@ -62,7 +62,7 @@ that are specified when a file is open. -Record locking semantics under Unix is very different from record locking under +Record locking semantics under Unix are very different from record locking under Windows. Versions of Samba before 2.2 have tried to use the native fcntl() unix system call to implement proper record locking between different Samba clients. This can not be fully correct due to several reasons. The simplest is the fact @@ -82,33 +82,34 @@ All other locks can not be seen by unix anyway. Strictly a SMB server should check for locks before every read and write call on a file. Unfortunately with the way fcntl() works this can be slow and may overstress -the rpc.lockd. It is also almost always unnecessary as clients are supposed to +the rpc.lockd. It is also almost always unnecessary as clients are supposed to independently make locking calls before reads and writes anyway if locking is important to them. By default Samba only makes locking calls when explicitly asked -to by a client, but if you set strict locking = yes then it +to by a client, but if you set strict locking = yes then it will make lock checking calls on every read and write. -You can also disable by range locking completely using locking = no. +You can also disable byte range locking completely using locking = no. This is useful for those shares that don't support locking or don't need it (such as cdroms). In this case Samba fakes the return codes of locking calls to tell clients that everything is OK. -The second class of locking is the deny modes. These +The second class of locking is the deny modes. These are set by an application when it opens a file to determine what types of access should be allowed simultaneously with its open. A client may ask for -DENY_NONE, DENY_READ, DENY_WRITE or DENY_ALL. There are also special compatibility -modes called DENY_FCB and DENY_DOS. +DENY_NONE, DENY_READ, +DENY_WRITE or DENY_ALL. There are also special compatibility +modes called DENY_FCB and DENY_DOS. Opportunistic Locking Overview -OPPORTUNISTIC LOCKING (Oplocks) is invoked by the Windows file system +Opportunistic locking (Oplocks) is invoked by the Windows file system (as opposed to an API) via registry entries (on the server AND client) for the purpose of enhancing network performance when accessing a file residing on a server. Performance is enhanced by caching the file @@ -129,7 +130,7 @@ locally on the client which allows: Lock caching: - + The client caches application locks locally, eliminating network latency @@ -149,8 +150,8 @@ other processes. The redirector sees that the file was opened with deny none (allowing concurrent access), verifies that no other process is accessing the file, checks that - oplocks are enabled, then grants deny-all/read-write/ex- - clusive access to the file. The client now performs + oplocks are enabled, then grants deny-all/read-write/exclusive + access to the file. The client now performs operations on the cached local file. @@ -339,7 +340,7 @@ exposes the file to likely data corruption. -If files are shared between Windows clients, and either loca Unix +If files are shared between Windows clients, and either local Unix or NFS users, then turn opportunistic locking off. @@ -408,7 +409,7 @@ the share. Beware of Force User -Samba includes an smb.conf parameter called "force user" that changes +Samba includes an &smb.conf; parameter called force user that changes the user accessing a share from the incoming user to whatever user is defined by the smb.conf variable. If opportunistic locking is enabled on a share, the change in user access causes an oplock break to be sent @@ -425,7 +426,7 @@ Avoid the combination of the following: - force user in the &smb.conf; share configuration. + force user in the &smb.conf; share configuration. @@ -447,8 +448,9 @@ Samba provides opportunistic locking parameters that allow the administrator to adjust various properties of the oplock mechanism to account for timing and usage levels. These parameters provide good versatility for implementing oplocks in environments where they would -likely cause problems. The parameters are: oplock break wait time, -oplock contention limit. +likely cause problems. The parameters are: +oplock break wait time, +oplock contention limit. @@ -541,7 +543,7 @@ Level1 Oplocks (aka just plain "oplocks") is another term for opportunistic lock -Level2 Oplocks provids opportunistic locking for a file that will be treated as +Level2 Oplocks provides opportunistic locking for a file that will be treated as read only. Typically this is used on files that are read-only or on files that the client has no initial intention to write to at time of opening the file. @@ -558,7 +560,7 @@ Unless your system supports kernel oplocks, you should disable oplocks if you ar accessing the same files from both Unix/Linux and SMB clients. Regardless, oplocks should always be disabled if you are sharing a database file (e.g., Microsoft Access) between multiple clients, as any break the first client receives will affect synchronisation of -the entire file (not just the single record), which will result in a noticable performance +the entire file (not just the single record), which will result in a noticeable performance impairment and, more likely, problems accessing the database in the first place. Notably, Microsoft Outlook's personal folders (*.pst) react very badly to oplocks. If in doubt, disable oplocks and tune your system from that point. @@ -581,7 +583,7 @@ measurable speed benefit on your network, it might not be worth the hassle of de Example Configuration -In the following we examine two destinct aspects of samba locking controls. +In the following we examine two distinct aspects of Samba locking controls. @@ -622,7 +624,7 @@ you may want to play it safe and disable oplocks and level2 oplocks. -Diabling Kernel OpLocks +Disabling Kernel OpLocks Kernel OpLocks is an &smb.conf; parameter that notifies Samba (if @@ -639,12 +641,11 @@ basis in the &smb.conf; file. -Example: + [global] - kernel oplocks = yes - -The default is "no". +kernel oplocks = yes +The default is "no". @@ -676,7 +677,7 @@ enabled on a per-share basis, or globally for the entire server, in the interval for Samba to reply to an oplock break request. Samba recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Wait Time can only be -configured globally in the smb.conf file: +configured globally in the &smb.conf; file: @@ -701,7 +702,7 @@ the entire server, in the &smb.conf; file: [global] oplock break contention limit = 2 (default) - [share_name] +[share_name] oplock break contention limit = 2 (default) @@ -722,7 +723,7 @@ operating system known as Opportunistic Locking. When a wor attempts to access shared data files located on another Windows 2000/XP computer, the Windows 2000/XP operating system will attempt to increase performance by locking the files and caching information locally. When this occurs, the application is unable to -properly function, which results in an Access Denied +properly function, which results in an Access Denied error message being displayed during network operations. @@ -939,8 +940,8 @@ our Knowledge Base. In some sites locking problems surface as soon as a server is installed, in other sites -locking problems may not surface for a long time. Almost without exeception, when a locking -problem does surface it will cause embarassment and potential data corruption. +locking problems may not surface for a long time. Almost without exception, when a locking +problem does surface it will cause embarrassment and potential data corruption. @@ -979,6 +980,26 @@ so far: + + locking.tdb error messages + + + + > We are seeing lots of errors in the samba logs like: + > + > tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic + > 0x4d6f4b61 at offset=36116 + > + > What do these mean? + + + + + Corrupted tdb. Stop all instances of smbd, delete locking.tdb, restart smbd. + + + + diff --git a/docs/docbook/projdoc/msdfs_setup.xml b/docs/docbook/projdoc/msdfs_setup.xml index a86cd74235..c21c9ec6bf 100644 --- a/docs/docbook/projdoc/msdfs_setup.xml +++ b/docs/docbook/projdoc/msdfs_setup.xml @@ -14,49 +14,54 @@ 12 Jul 2000 - Hosting a Microsoft Distributed File System tree on Samba - - Instructions - - The Distributed File System (or Dfs) provides a means of - separating the logical view of files and directories that users - see from the actual physical locations of these resources on the - network. It allows for higher availability, smoother storage expansion, - load balancing etc. For more information about Dfs, refer to - Microsoft documentation. - - This document explains how to host a Dfs tree on a Unix - machine (for Dfs-aware clients to browse) using Samba. - - To enable SMB-based DFS for Samba, configure it with the - --with-msdfs option. Once built, a - Samba server can be made a Dfs server by setting the global - boolean - host msdfs parameter in the smb.conf - file. You designate a share as a Dfs root using the share - level boolean - msdfs root parameter. A Dfs root directory on - Samba hosts Dfs links in the form of symbolic links that point - to other servers. For example, a symbolic link - junction->msdfs:storage1\share1 in - the share directory acts as the Dfs junction. When Dfs-aware - clients attempt to access the junction link, they are redirected - to the storage location (in this case, \\storage1\share1). - - Dfs trees on Samba work with all Dfs-aware clients ranging - from Windows 95 to 2000. +Features and Benefits + + + The Distributed File System (or DFS) provides a means of separating the logical + view of files and directories that users see from the actual physical locations + of these resources on the network. It allows for higher availability, smoother + storage expansion, load balancing etc. + + + + For information about DFS, refer to + + Microsoft documentation at http://www.microsoft.com/NTServer/nts/downloads/winfeatures/NTSDistrFile/AdminGuide.asp. + + + + This document explains how to host a DFS tree on a Unix machine (for DFS-aware + clients to browse) using Samba. + + + + To enable SMB-based DFS for Samba, configure it with the --with-msdfs + option. Once built, a Samba server can be made a DFS server by setting the global + boolean host msdfs + parameter in the smb.conf file. You designate a share as a DFS + root using the share level boolean + msdfs root parameter. A DFS root directory on Samba hosts DFS + links in the form of symbolic links that point to other servers. For example, a symbolic link + junction->msdfs:storage1\share1 in the share directory acts + as the DFS junction. When DFS-aware clients attempt to access the junction link, + they are redirected to the storage location (in this case, \\storage1\share1). + + + + DFS trees on Samba work with all DFS-aware clients ranging from Windows 95 to 200x. + - Here's an example of setting up a Dfs tree on a Samba - server. + + Here's an example of setting up a DFS tree on a Samba server. + # The smb.conf file: [global] - netbios name = SAMBA + netbios name = SMOKEY host msdfs = yes [dfs] @@ -68,49 +73,47 @@ In the /export/dfsroot directory we set up our dfs links to other servers on the network. - root# cd /export/dfsroot - root# chown root /export/dfsroot - root# chmod 755 /export/dfsroot - root# ln -s msdfs:storageA\\shareA linka - root# ln -s msdfs:serverB\\share,serverC\\share linkb - + + &rootprompt;cd /export/dfsroot + &rootprompt;chown root /export/dfsroot + &rootprompt;chmod 755 /export/dfsroot + &rootprompt;ln -s msdfs:storageA\\shareA linka + &rootprompt;ln -s msdfs:serverB\\share,serverC\\share linkb + You should set up the permissions and ownership of - the directory acting as the Dfs root such that only designated + the directory acting as the DFS root such that only designated users can create, delete or modify the msdfs links. Also note that symlink names should be all lowercase. This limitation exists to have Samba avoid trying all the case combinations to get at the link name. Finally set up the symbolic links to point to the network shares you want, and start Samba. - Users on Dfs-aware clients can now browse the Dfs tree + Users on DFS-aware clients can now browse the DFS tree on the Samba server at \\samba\dfs. Accessing links linka or linkb (which appear as directories to the client) takes users directly to the appropriate shares on the network. - - - Notes - - - Windows clients need to be rebooted - if a previously mounted non-dfs share is made a dfs - root or vice versa. A better way is to introduce a - new share and make it the dfs root. - - - Currently there's a restriction that msdfs - symlink names should all be lowercase. - - - For security purposes, the directory - acting as the root of the Dfs tree should have ownership - and permissions set so that only designated users can - modify the symbolic links in the directory. - - - + +Common Errors + + Windows clients need to be rebooted + if a previously mounted non-dfs share is made a dfs + root or vice versa. A better way is to introduce a + new share and make it the dfs root. + + + Currently there's a restriction that msdfs + symlink names should all be lowercase. + + + For security purposes, the directory + acting as the root of the DFS tree should have ownership + and permissions set so that only designated users can + modify the symbolic links in the directory. + + + - diff --git a/docs/docbook/projdoc/passdb.xml b/docs/docbook/projdoc/passdb.xml index 78aee30448..3a33e9f1e7 100644 --- a/docs/docbook/projdoc/passdb.xml +++ b/docs/docbook/projdoc/passdb.xml @@ -17,20 +17,20 @@ Account Information Databases -Samba-3 implements a new capability to work concurrently with mulitple account backends. +Samba-3 implements a new capability to work concurrently with multiple account backends. The possible new combinations of password backends allows Samba-3 a degree of flexibility and scalability that previously could be achieved only with MS Windows Active Directory. This chapter describes the new functionality and how to get the most out of it. -In the course of development of Samba-3 a number of requests were received to provide the +In the course of development of Samba-3, a number of requests were received to provide the ability to migrate MS Windows NT4 SAM accounts to Samba-3 without the need to provide matching Unix/Linux accounts. We called this the Non Unix Accounts (NUA) capability. The intent was that an administrator could decide to use the tdbsam -backend and by simply specifying "passdb backedn = tdbsam_nua, guest" +backend and by simply specifying "passdb backend = tdbsam_nua, guest" this would allow Samba-3 to implement a solution that did not use Unix accounts per se. Late -in the development cycle the team doing this work hit upon some obstacles that prevents this +in the development cycle, the team doing this work hit upon some obstacles that prevents this solution from being used. Given the delays with Samba-3 release a decision was made to NOT deliver this functionality until a better method of recognising NT Group SIDs from NT User SIDs could be found. This feature may thus return during the life cycle for the Samba-3 series. @@ -73,16 +73,22 @@ as follows: provide the extended controls that are needed for more comprehensive interoperation with MS Windows NT4 / 200x servers. + + + This backend should be used only for backwards compatibility with older + versions of Samba. It may be deprecated in future releases. + - ldapsam_compat (Samba-2.2 LDAP Compatibilty): + ldapsam_compat (Samba-2.2 LDAP Compatibility): There is a password backend option that allows continued operation with a existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension. This option is provided primarily as a migration tool, although there is - no reason to force migration at this time. + no reason to force migration at this time. Note that this tool will eventually + be deprecated. @@ -94,8 +100,24 @@ Samba-3 introduces the following new password backend capabilities: New Backends + guest: + + + This is always required as the last backend specified. + It provides the ability to handle guest account requirements for access to + resources like IPC$ which is used for browsing. + + + + tdbsam: + + This backend provides a rich database backend for local servers. This + backend is NOT suitable for multiple domain controller (ie: PDC + one + or more BDC) installations. + + The tdbsam password backend stores the old smbpasswd information PLUS the extended MS Windows NT / 200x @@ -106,7 +128,7 @@ Samba-3 introduces the following new password backend capabilities: - The inclusion of the tdbssam capability is a direct + The inclusion of the tdbsam capability is a direct response to user requests to allow simple site operation without the overhead of the complexities of running OpenLDAP. It is recommended to use this only for sites that have fewer than 250 users. For larger sites or implementations @@ -117,15 +139,19 @@ Samba-3 introduces the following new password backend capabilities: ldapsam: + + This provides a rich directory backend for distributed account installation. + + Samba-3 has a new and extended LDAP implementation that requires configuration of OpenLDAP with a new format samba schema. The new format schema file is - included in the ~samba/examples/LDAP directory. + included in the examples/LDAP directory of the Samba distribution. - The new LDAP implmentation significantly expands the control abilities that - were possible with prior versions of Samba. It is not possible to specify + The new LDAP implementation significantly expands the control abilities that + were possible with prior versions of Samba. It is now possible to specify "per user" profile settings, home directories, account access controls, and much more. Corporate sites will see that the Samba-Team has listened to their requests both for capability and to allow greater scalability. @@ -147,16 +173,14 @@ Samba-3 introduces the following new password backend capabilities: Allows the account and password data to be stored in an XML format - data file. This backend is NOT recommended for normal operation, it is - provided for developmental and for experimental use only. We recognise - that this will not stop some people from using it anyhow, it should work - but is NOT officially supported at this time (and likely will not be - at any time). + data file. This backend can not be used for normal operation, it can only + be used in conjunction with pdbedit's pdb2pdb + functionality. The DTD that is used might be subject to changes in the future. The xmlsam option can be useful for account migration between database - backends. Use of this tool will allow the data to be edited before migration + backends or backups. Use of this tool will allow the data to be edited before migration into another backend format. @@ -171,15 +195,6 @@ Samba-3 introduces the following new password backend capabilities: - plugin: - - - This option allows any external non-Samba backend to interface directly - to the samba code. This facility will allow third part vendors to provide - a proprietary backend to Samba-3. - - - @@ -199,7 +214,7 @@ Samba-3 introduces the following new password backend capabilities: - These passwords can't be converted to unix style encrypted passwords. Because of that + These passwords can't be converted to unix style encrypted passwords. Because of that, you can't use the standard unix user database, and you have to store the Lanman and NT hashes somewhere else. @@ -208,9 +223,9 @@ Samba-3 introduces the following new password backend capabilities: In addition to differently encrypted passwords, windows also stores certain data for each user that is not stored in a unix user database. e.g: workstations the user may logon from, the location where the users' profile is stored, and so on. Samba retrieves and stores this - information using a "passdb backend". Commonly available backends are LDAP, plain text + information using a passdb backend. Commonly available backends are LDAP, plain text file, MySQL and nisplus. For more information, see the man page for &smb.conf; regarding the - passdb backend = parameter. + passdb backend parameter. @@ -248,23 +263,12 @@ Samba-3 introduces the following new password backend capabilities: although they may log onto a domain environment: - - - MS DOS Network client 3.0 with the basic network redirector installed - - - - Windows 95 with the network redirector update installed - - - - Windows 98 [se] - - - - Windows Me - - + + MS DOS Network client 3.0 with the basic network redirector installed + Windows 95 with the network redirector update installed + Windows 98 [se] + Windows Me + @@ -277,13 +281,13 @@ Samba-3 introduces the following new password backend capabilities: The following versions of MS Windows fully support domain security protocols. - - Windows NT 3.5x - Windows NT 4.0 - Windows 2000 Professional - Windows 200x Server/Advanced Server - Windows XP Professional - + + Windows NT 3.5x + Windows NT 4.0 + Windows 2000 Professional + Windows 200x Server/Advanced Server + Windows XP Professional + All current release of Microsoft SMB/CIFS clients support authentication via the @@ -346,6 +350,32 @@ Samba-3 introduces the following new password backend capabilities: + + + Mapping User Identifiers between MS Windows and Unix + + + Every operation in Unix/Linux requires a user identifier (UID), just as in + MS Windows NT4 / 200x this requires a Security Identifier (SID). Samba provides + two means for mapping an MS Windows user to a Unix/Linux UID. + + + + Firstly, all Samba SAM (Security Account Manager database) accounts require + a Unix/Linux UID that the account will map to. As users are added to the account + information database, Samba-3 will call the add user script + interface to add the account to the Samba host OS. In essence, all accounts in + the local SAM require a local user account. + + + + The second way to affect Windows SID to Unix UID mapping is via the + idmap uid, idmap gid parameters in &smb.conf;. + Please refer to the man page for information about these parameters. + These parameters are essential when mapping users from a remote SAM server. + + + @@ -353,10 +383,10 @@ Samba-3 introduces the following new password backend capabilities: Samba-3 provides two (2) tools for management of User and machine accounts. These tools are -called smbpasswd and pdbedit. A third tool is under +called smbpasswd and pdbedit. A third tool is under development but is NOT expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK GUI tool that looks much like the MS Windows NT4 Domain User Manager - hopefully this will -be announced in time for samba-3.0.1 release timing. +be announced in time for the Samba-3.0.1 release. The <emphasis>smbpasswd</emphasis> Command @@ -369,7 +399,7 @@ be announced in time for samba-3.0.1 release timing. smbpasswd works in a client-server mode where it contacts the - local smbd to change the user's password on its behalf.This has enormous benefits + local smbd to change the user's password on its behalf. This has enormous benefits as follows: @@ -383,47 +413,30 @@ be announced in time for samba-3.0.1 release timing. smbpasswd can be used to: - - - add user or machine accounts - - - - delete user or machine accounts - - - - enable user or machine accounts - - - - disable user or machine accounts - - - - set to NULL user passwords - - - - manage interdomain trust accounts - - + + add user or machine accounts + delete user or machine accounts + enable user or machine accounts + disable user or machine accounts + set to NULL user passwords + manage interdomain trust accounts + To run smbpasswd as a normal user just type: - + $ smbpasswd - Old SMB password: <secret> - - For secret type old value here - or hit return if + Old SMB password: secret + + For secret type old value here - or hit return if there was no old password - - New SMB Password: <new secret> - Repeat New SMB Password: <new secret> - + + New SMB Password: new secret + Repeat New SMB Password: new secret + @@ -464,19 +477,11 @@ be announced in time for samba-3.0.1 release timing. manage the passdb backend. pdbedit can be used to: - - - add, remove or modify user accounts - - - - listing user accounts - - - - migrate user accounts - - + + add, remove or modify user accounts + listing user accounts + migrate user accounts + The pdbedit tool is the only one that can manage the account @@ -495,9 +500,8 @@ be announced in time for samba-3.0.1 release timing. a tdbsam password backend. This listing was produced by running: - - pdbedit -Lv met - + + $ pdbedit -Lv met Unix username: met NT username: Account Flags: [UX ] @@ -518,8 +522,9 @@ be announced in time for samba-3.0.1 release timing. Password last set: Sat, 14 Dec 2002 14:37:03 GMT Password can change: Sat, 14 Dec 2002 14:37:03 GMT Password must change: Mon, 18 Jan 2038 20:14:07 GMT - - + + + @@ -540,8 +545,8 @@ backends of the same type. For example, to use two different tdbsam databases: -In smb.conf [globals] - passdb backend = tdbsam:/etc/samba/passdb.tdb, \ +[globals] + passdb backend = tdbsam:/etc/samba/passdb.tdb, \ tdbsam:/etc/samba/old-passdb.tdb, guest @@ -551,11 +556,11 @@ In smb.conf [globals] Plain Text - Older versions of samba retrieved user information from the unix user database + Older versions of Samba retrieved user information from the unix user database and eventually some other fields from the file /etc/samba/smbpasswd or /etc/smbpasswd. When password encryption is disabled, no - SMB specific data is stored at all. Instead all operations are conduected via the way - that the samba host OS will access it's /etc/passwd database. + SMB specific data is stored at all. Instead all operations are conducted via the way + that the Samba host OS will access its /etc/passwd database. eg: On Linux systems that is done via PAM. @@ -565,8 +570,8 @@ In smb.conf [globals] smbpasswd - Encrypted Password Database - Traditionally, when configuring "encrypt - passwords = yes" in Samba's smb.conf file, user account + Traditionally, when configuring encrypt + passwords = yes in Samba's smb.conf file, user account information such as username, LM/NT password hashes, password change times, and account flags have been stored in the smbpasswd(5) file. There are several disadvantages to this approach for sites with very large numbers of users (counted @@ -592,12 +597,12 @@ In smb.conf [globals] And finally, the amount of information which is stored in an smbpasswd entry leaves no room for additional attributes such as a home directory, password expiration time, - or even a Relative Identified (RID). + or even a Relative Identifier (RID). - As a result of these defeciencies, a more robust means of storing user attributes + As a result of these deficiencies, a more robust means of storing user attributes used by smbd was developed. The API which defines access to user accounts is commonly referred to as the samdb interface (previously this was called the passdb API, and is still so named in the Samba CVS trees). @@ -620,10 +625,10 @@ In smb.conf [globals] - As a general guide the Samba-Team do NOT recommend using the tdbsam backend for sites + As a general guide the Samba-Team does NOT recommend using the tdbsam backend for sites that have 250 or more users. Additionally, tdbsam is not capable of scaling for use - in sites that require PDB/BDC implmentations that requires replication of the account - database. Clearly, for reason of scalability the use of ldapsam should be encouraged. + in sites that require PDB/BDC implementations that requires replication of the account + database. Clearly, for reason of scalability, the use of ldapsam should be encouraged. @@ -650,8 +655,15 @@ In smb.conf [globals] System Administration; Gerald Carter, O'Reilly; Chapter 6: Replacing NIS". Refer to http://safari.oreilly.com/?XmlId=1-56592-491-6 for those who might wish to know - more about configuration and adminstration of an OpenLDAP server. + more about configuration and administration of an OpenLDAP server. + + + + + This section is outdated for Samba-3 schema. Samba-3 introduces a new schema + that has not been documented at the time of this publication. + This document describes how to use an LDAP directory for storing Samba user @@ -687,7 +699,7 @@ In smb.conf [globals] The LDAP ldapsam code has been developed and tested using the OpenLDAP 2.0 and 2.1 server and client libraries. The same code should work with Netscape's Directory Server and client SDK. However, there are bound to be compile errors and bugs. These should not be hard to fix. - Please submit fixes via . + Please submit fixes via Bug reporting facility. @@ -698,13 +710,13 @@ In smb.conf [globals] Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in - examples/LDAP/samba.schema. The sambaAccount objectclass is given here: + examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: -objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILIARY - DESC 'Samba Auxilary Account' +objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY + DESC 'Samba Auxiliary Account' MUST ( uid $ rid ) MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $ logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $ @@ -723,8 +735,8 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILIARY Just as the smbpasswd file is meant to store information which supplements a - user's /etc/passwd entry, so is the sambaAccount object - meant to supplement the UNIX user account information. A sambaAccount is a + user's /etc/passwd entry, so is the sambaSamAccount object + meant to supplement the UNIX user account information. A sambaSamAccount is a STRUCTURAL objectclass so it can be stored individually in the directory. However, there are several fields (e.g. uid) which overlap with the posixAccount objectclass outlined in RFC2307. This is by design. @@ -735,7 +747,7 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILIARY In order to store all user account information (UNIX and Samba) in the directory, - it is necessary to use the sambaAccount and posixAccount objectclasses in + it is necessary to use the sambaSamAccount and posixAccount objectclasses in combination. However, smbd will still obtain the user's UNIX account information via the standard C library calls (e.g. getpwnam(), et. al.). This means that the Samba server must also have the LDAP NSS library installed @@ -749,21 +761,21 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILIARY OpenLDAP configuration - To include support for the sambaAccount object in an OpenLDAP directory + To include support for the sambaSamAccount object in an OpenLDAP directory server, first copy the samba.schema file to slapd's configuration directory. The samba.schema file can be found in the directory examples/LDAP in the samba source distribution. - -root# cp samba.schema /etc/openldap/schema/ - + +&rootprompt;cp samba.schema /etc/openldap/schema/ + Next, include the samba.schema file in slapd.conf. - The sambaAccount object contains two attributes which depend upon other schema + The sambaSamAccount object contains two attributes which depend upon other schema files. The 'uid' attribute is defined in cosine.schema and the 'displayName' attribute is defined in the inetorgperson.schema file. Both of these must be included before the samba.schema file. @@ -776,7 +788,7 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILIARY ## schema files (core.schema is required by default) include /etc/openldap/schema/core.schema -## needed for sambaAccount +## needed for sambaSamAccount include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/samba.schema @@ -786,13 +798,13 @@ include /etc/openldap/schema/nis.schema - It is recommended that you maintain some indices on some of the most usefull attributes, - like in the following example, to speed up searches made on sambaAccount objectclasses + It is recommended that you maintain some indices on some of the most useful attributes, + like in the following example, to speed up searches made on sambaSamAccount objectclasses (and possibly posixAccount and posixGroup as well). - + # Indices to maintain ## required by OpenLDAP index objectclass eq @@ -810,12 +822,11 @@ index displayName pres,sub,eq ##index gidNumber eq ##index memberUid eq -index rid eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub - + @@ -823,9 +834,9 @@ index default sub - + ./sbin/slapindex -f slapd.conf - + @@ -833,25 +844,97 @@ index default sub - -root# /etc/init.d/slapd restart - + +&rootprompt;/etc/init.d/slapd restart + + + + + + + Initialise the LDAP database + + + Before you can add accounts to the LDAP database you must create the account containers + that they will be stored in. The following LDIF file should be modified to match your + needs (ie: Your DNS entries, etc.). + + + + +# Organization for Samba Base +dn: dc=plainjoe,dc=org +objectclass: dcObject +objectclass: organization +dc: plainjoe +o: Terpstra Org Network +description: The Samba-3 Network LDAP Example + +# Organizational Role for Directory Management +dn: cn=Manager,dc=plainjoe,dc=org +objectclass: organizationalRole +cn: Manager +description: Directory Manager + +# Setting up container for users +dn: ou=People,dc=plainjoe,dc=org +objectclass: top +objectclass: organizationalUnit +ou: People + +# Setting up admin handle for People OU +dn: cn=admin,ou=People,dc=plainjoe,dc=org +cn: admin +objectclass: top +objectclass: organizationalRole +objectclass: simpleSecurityObject +userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz + + + The userPassword shown above should be generated using slappasswd. + + + + The following command will then load the contents of the LDIF file into the LDAP + database. + + + + +$ slapadd -v -l initldap.dif + + + + + Do not forget to secure your LDAP server with an adequate access control list, + as well as an admin password. + + + + + Before Samba can access the LDAP server you need to store the LDAP admin password + into the Samba-3 secrets.tdb database by: + +&rootprompt; smbpasswd -w secret + + + + Configuring Samba - The following parameters are available in smb.conf only with --with-ldapsam - was included when compiling Samba. The following parameters are available in smb.conf only if your + The following parameters are available in smb.conf only if your version of samba was built with LDAP support. Samba automatically builds with LDAP support if the LDAP libraries are found. - passdb backend ldapsam:url + passdb backend = ldapsam:url ldap ssl ldap admin dn ldap suffix @@ -870,51 +953,51 @@ index default sub use with an LDAP directory could appear as - - - ## /usr/local/samba/lib/smb.conf - [global] - security = user - encrypt passwords = yes + + +## /usr/local/samba/lib/smb.conf +[global] + security = user + encrypt passwords = yes - netbios name = TASHTEGO - workgroup = NARNIA + netbios name = TASHTEGO + workgroup = NARNIA - # ldap related parameters + # ldap related parameters - # define the DN to use when binding to the directory servers - # The password for this DN is not stored in smb.conf. Rather it - # must be set by using 'smbpasswd -w secretpw' to store the - # passphrase in the secrets.tdb file. If the "ldap admin dn" values - # change, this password will need to be reset. - ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org" + # define the DN to use when binding to the directory servers + # The password for this DN is not stored in smb.conf. Rather it + # must be set by using 'smbpasswd -w secretpw' to store the + # passphrase in the secrets.tdb file. If the "ldap admin dn" values + # change, this password will need to be reset. + ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org" - # Define the SSL option when connecting to the directory - # ('off', 'start tls', or 'on' (default)) - ldap ssl = start tls + # Define the SSL option when connecting to the directory + # ('off', 'start tls', or 'on' (default)) + ldap ssl = start tls - # syntax: passdb backend = ldapsam:ldap://server-name[:port] - passdb backend ldapsam:ldap://funball.samba.org + # syntax: passdb backend = ldapsam:ldap://server-name[:port] + passdb backend = ldapsam:ldap://funball.samba.org, guest - # smbpasswd -x delete the entire dn-entry - ldap delete dn = no + # smbpasswd -x delete the entire dn-entry + ldap delete dn = no - # the machine and user suffix added to the base suffix - # wrote WITHOUT quotes. NULL siffixes by default - ldap user suffix = ou=People - ldap machine suffix = ou=Systems + # the machine and user suffix added to the base suffix + # wrote WITHOUT quotes. NULL suffixes by default + ldap user suffix = ou=People + ldap machine suffix = ou=Systems - # Trust unix account information in LDAP - # (see the smb.conf manpage for details) - ldap trust ids = Yes + # Trust unix account information in LDAP + # (see the smb.conf manpage for details) + ldap trust ids = Yes - # specify the base DN to use when searching the directory - ldap suffix = "ou=people,dc=samba,dc=org" + # specify the base DN to use when searching the directory + ldap suffix = "ou=people,dc=samba,dc=org" - # generally the default ldap search filter is ok - # ldap filter = "(&(uid=%u)(objectclass=sambaAccount))" - - + # generally the default ldap search filter is ok + # ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))" + + @@ -922,14 +1005,14 @@ index default sub Accounts and Groups management - As users accounts are managed thru the sambaAccount objectclass, you should - modify your existing administration tools to deal with sambaAccount attributes. + As users accounts are managed through the sambaSamAccount objectclass, you should + modify your existing administration tools to deal with sambaSamAccount attributes. - Machines accounts are managed with the sambaAccount objectclass, just - like users accounts. However, it's up to you to store thoses accounts - in a different tree of you LDAP namespace: you should use + Machines accounts are managed with the sambaSamAccount objectclass, just + like users accounts. However, it's up to you to store those accounts + in a different tree of your LDAP namespace: you should use "ou=Groups,dc=plainjoe,dc=org" to store groups and "ou=People,dc=plainjoe,dc=org" to store users. Just configure your NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration @@ -937,8 +1020,8 @@ index default sub - In Samba release 3.0, the group management system is based on posix - groups. This means that Samba makes usage of the posixGroup objectclass. + In Samba release 3.0, the group management system is based on POSIX + groups. This means that Samba makes use of the posixGroup objectclass. For now, there is no NT-like group system management (global and local groups). @@ -946,12 +1029,12 @@ index default sub - Security and sambaAccount + Security and sambaSamAccount There are two important points to remember when discussing the security - of sambaAccount entries in the directory. + of sambaSamAccount entries in the directory. @@ -969,13 +1052,13 @@ index default sub - To remedy the first security issue, the "ldap ssl" smb.conf parameter defaults - to require an encrypted session (ldap ssl = on) using - the default port of 636 + To remedy the first security issue, the ldap ssl &smb.conf; parameter defaults + to require an encrypted session (ldap ssl = on) using + the default port of 636 when contacting the directory server. When using an OpenLDAP server, it is possible to use the use the StartTLS LDAP extended operation in the place of LDAPS. In either case, you are strongly discouraged to disable this security - (ldap ssl = off). + (ldap ssl = off). @@ -990,102 +1073,106 @@ index default sub following ACL in slapd.conf: - - - ## allow the "ldap admin dn" access, but deny everyone else - access to attrs=lmPassword,ntPassword - by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write - by * none - - + + +## allow the "ldap admin dn" access, but deny everyone else +access to attrs=lmPassword,ntPassword + by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write + by * none + + - LDAP special attributes for sambaAccounts + LDAP special attributes for sambaSamAccounts - The sambaAccount objectclass is composed of the following attributes: + The sambaSamAccount objectclass is composed of the following attributes: - - lmPassword: the LANMAN password 16-byte hash stored as a character - representation of a hexidecimal string. - - ntPassword: the NT password hash 16-byte stored as a character - representation of a hexidecimal string. - - pwdLastSet: The integer time in seconds since 1970 when the + + + Attributes in the sambaSamAccount objectclass (LDAP) + + + lmPasswordthe LANMAN password 16-byte hash stored as a character + representation of a hexadecimal string. + ntPasswordthe NT password hash 16-byte stored as a character + representation of a hexadecimal string. + pwdLastSetThe integer time in seconds since 1970 when the lmPassword and ntPassword attributes were last set. - + - acctFlags: string of 11 characters surrounded by square brackets [] + acctFlagsstring of 11 characters surrounded by square brackets [] representing account flags such as U (user), W(workstation), X(no password expiration), I(Domain trust account), H(Home dir required), S(Server trust account), - and D(disabled). + and D(disabled). - logonTime: Integer value currently unused + logonTimeInteger value currently unused - logoffTime: Integer value currently unused + logoffTimeInteger value currently unused - kickoffTime: Integer value currently unused + kickoffTimeInteger value currently unused - pwdCanChange: Integer value currently unused + pwdCanChangeInteger value currently unused - pwdMustChange: Integer value currently unused + pwdMustChangeInteger value currently unused - homeDrive: specifies the drive letter to which to map the + homeDrivespecifies the drive letter to which to map the UNC path specified by homeDirectory. The drive letter must be specified in the form "X:" where X is the letter of the drive to map. Refer to the "logon drive" parameter in the - smb.conf(5) man page for more information. + smb.conf(5) man page for more information. - scriptPath: The scriptPath property specifies the path of + scriptPathThe scriptPath property specifies the path of the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path is relative to the netlogon share. Refer to the "logon script" parameter in the - smb.conf(5) man page for more information. + smb.conf(5) man page for more information. - profilePath: specifies a path to the user's profile. + profilePathspecifies a path to the user's profile. This value can be a null string, a local absolute path, or a UNC path. Refer to the - "logon path" parameter in the smb.conf(5) man page for more information. + "logon path" parameter in the smb.conf(5) man page for more information. - smbHome: The homeDirectory property specifies the path of + smbHomeThe homeDirectory property specifies the path of the home directory for the user. The string can be null. If homeDrive is set and specifies a drive letter, homeDirectory should be a UNC path. The path must be a network UNC path of the form \\server\share\directory. This value can be a null string. Refer to the logon home parameter in the &smb.conf; man page for more information. - + - userWorkstation: character string value currently unused. - + userWorkstationcharacter string value currently unused. + - rid: the integer representation of the user's relative identifier - (RID). + ridthe integer representation of the user's relative identifier + (RID). - primaryGroupID: the relative identifier (RID) of the primary group - of the user. + primaryGroupIDthe relative identifier (RID) of the primary group + of the user. - domain: domain the user is part of. - + domaindomain the user is part of. + +
+ The majority of these parameters are only used when Samba is acting as a PDC of - a domain (refer to the Samba as a primary domain controller chapter for details on + a domain (refer to the Samba as a primary domain controller chapter for details on how to configure Samba as a Primary Domain Controller). The following four attributes - are only stored with the sambaAccount entry if the values are non-default values: + are only stored with the sambaSamAccount entry if the values are non-default values: - - smbHome - scriptPath - logonPath - homeDrive - + + smbHome + scriptPath + logonPath + homeDrive + - These attributes are only stored with the sambaAccount entry if + These attributes are only stored with the sambaSamAccount entry if the values are non-default values. For example, assume TASHTEGO has now been - configured as a PDC and that logon home = \\%L\%u was defined in - its smb.conf file. When a user named "becky" logons to the domain, + configured as a PDC and that logon home = \\%L\%u was defined in + its &smb.conf; file. When a user named "becky" logons to the domain, the logon home string is expanded to \\TASHTEGO\becky. If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", this value is used. However, if this attribute does not exist, then the value @@ -1097,7 +1184,7 @@ index default sub - Example LDIF Entries for a sambaAccount + Example LDIF Entries for a sambaSamAccount The following is a working LDIF with the inclusion of the posixAccount objectclass: @@ -1112,7 +1199,7 @@ index default sub lmPassword: 552902031BEDE9EFAAD3B435B51404EE pwdLastSet: 1010179124 logonTime: 0 - objectClass: sambaAccount + objectClass: sambaSamAccount uid: guest2 kickoffTime: 2147483647 acctFlags: [UX ] @@ -1123,7 +1210,7 @@ index default sub - The following is an LDIF entry for using both the sambaAccount and + The following is an LDIF entry for using both the sambaSamAccount and posixAccount objectclasses: @@ -1135,7 +1222,7 @@ index default sub lmPassword: 552902031BEDE9EFAAD3B435B51404EE primaryGroupID: 1201 objectClass: posixAccount - objectClass: sambaAccount + objectClass: sambaSamAccount acctFlags: [UX ] userPassword: {crypt}BpM2ej8Rkzogo uid: gcarter @@ -1151,7 +1238,7 @@ index default sub pwdCanChange: 0 pwdMustChange: 2147483647 ntPassword: 878D8014606CDA29677A44EFA1353FC7 - + @@ -1164,7 +1251,7 @@ index default sub using pam_ldap, this allows changing both unix and windows passwords at once. - The ldap passwd sync options can have the following values: + The ldap passwd sync options can have the following values: @@ -1182,8 +1269,7 @@ index default sub only Only update the LDAP password and let the LDAP server worry - about the other fields. This option is only available when - the LDAP library supports LDAP_EXOP_X_MODIFY_PASSWD. + about the other fields. This option is only available when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD. @@ -1192,23 +1278,18 @@ index default sub - - ldap trust ids - - - LDAP Performance can be improved by using the ldap trust ids parameter. - See the smb.conf manpage for details. - - - - MySQL - Stuff goes here! + Every so often someone will come along with a great new idea. Storing of user accounts in an + SQL backend is one of them. Those who want to do this are in the best position to know what the + specific benefits are to them. This may sound like a cop-out, but in truth we can not attempt + to document every nitty little detail why certain things of marginal utility to the bulk of + Samba users might make sense to the rest. In any case, the following instructions should help + the determined SQL user to implement a working system. @@ -1219,7 +1300,8 @@ index default sub for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump contains the correct queries to create the required tables. Use the command : - mysql -uusername -hhostname -ppassword databasename > /path/to/samba/examples/pdb/mysql/mysql.dump + $ mysql -uusername -hhostname -ppassword \ +databasename < /path/to/samba/examples/pdb/mysql/mysql.dump @@ -1228,7 +1310,7 @@ index default sub This plugin lacks some good documentation, but here is some short info: - Add a the following to the passdb backend variable in your smb.conf: + Add a the following to the passdb backend variable in your &smb.conf;: passdb backend = [other-plugins] mysql:identifier [other-plugins] @@ -1236,71 +1318,84 @@ index default sub The identifier can be any string you like, as long as it doesn't collide with the identifiers of other plugins or other instances of pdb_mysql. If you - specify multiple pdb_mysql.so entries in 'passdb backend', you also need to + specify multiple pdb_mysql.so entries in passdb backend, you also need to use different identifiers! - Additional options can be given thru the &smb.conf; file in the [global] section. + Additional options can be given through the &smb.conf; file in the [global] section. - - - identifier:mysql host - host name, defaults to 'localhost' - identifier:mysql password - identifier:mysql user - defaults to 'samba' - identifier:mysql database - defaults to 'samba' - identifier:mysql port - defaults to 3306 - identifier:table - Name of the table containing users - - + + + Basic smb.conf options for MySQL passdb backend + + + FieldContents + + + identifier:mysql hosthost name, defaults to 'localhost' + identifier:mysql password + identifier:mysql userdefaults to 'samba' + identifier:mysql databasedefaults to 'samba' + identifier:mysql portdefaults to 3306 + identifier:tableName of the table containing users + + +
+ - Since the password for the mysql user is stored in the + Since the password for the MySQL user is stored in the &smb.conf; file, you should make the the &smb.conf; file - readable only to the user that runs samba. This is considered a security + readable only to the user that runs Samba This is considered a security bug and will be fixed soon. - Names of the columns in this table(I've added column types those columns should have first): + Names of the columns in this table (I've added column types those columns should have first): - - - identifier:logon time column - int(9) - identifier:logoff time column - int(9) - identifier:kickoff time column - int(9) - identifier:pass last set time column - int(9) - identifier:pass can change time column - int(9) - identifier:pass must change time column - int(9) - identifier:username column - varchar(255) - unix username - identifier:domain column - varchar(255) - NT domain user is part of - identifier:nt username column - varchar(255) - NT username - identifier:fullname column - varchar(255) - Full name of user - identifier:home dir column - varchar(255) - Unix homedir path - identifier:dir drive column - varchar(2) - Directory drive path (eg: 'H:') - identifier:logon script column - varchar(255) - - Batch file to run on client side when logging on - identifier:profile path column - varchar(255) - Path of profile - identifier:acct desc column - varchar(255) - Some ASCII NT user data - identifier:workstations column - varchar(255) - - Workstations user can logon to (or NULL for all) - identifier:unknown string column - varchar(255) - unknown string - identifier:munged dial column - varchar(255) - ? - identifier:user sid column - varchar(255) - NT user SID - identifier:group sid column - varchar(255) - NT group ID - identifier:lanman pass column - varchar(255) - encrypted lanman password - identifier:nt pass column - varchar(255) - encrypted nt passwd - identifier:plain pass column - varchar(255) - plaintext password - identifier:acct control column - int(9) - nt user data - identifier:unknown 3 column - int(9) - unknown - identifier:logon divs column - int(9) - ? - identifier:hours len column - int(9) - ? - identifier:unknown 5 column - int(9) - unknown - identifier:unknown 6 column - int(9) - unknown - - + + + MySQL field names for MySQL passdb backend + + + FieldTypeContents + + + identifier:logon time columnint(9) + identifier:logoff time columnint(9) + identifier:kickoff time columnint(9) + identifier:pass last set time columnint(9) + identifier:pass can change time columnint(9) + identifier:pass must change time columnint(9) + identifier:username columnvarchar(255)unix username + identifier:domain columnvarchar(255)NT domain user is part of + identifier:nt username columnvarchar(255)NT username + identifier:fullname columnvarchar(255)Full name of user + identifier:home dir columnvarchar(255)Unix homedir path + identifier:dir drive columnvarchar(2)Directory drive path (eg: 'H:') + identifier:logon script columnvarchar(255)Batch file to run on client side when logging on + identifier:profile path columnvarchar(255)Path of profile + identifier:acct desc columnvarchar(255)Some ASCII NT user data + identifier:workstations columnvarchar(255)Workstations user can logon to (or NULL for all) + identifier:unknown string columnvarchar(255)unknown string + identifier:munged dial columnvarchar(255)? + identifier:user sid columnvarchar(255)NT user SID + identifier:group sid columnvarchar(255)NT group ID + identifier:lanman pass columnvarchar(255)encrypted lanman password + identifier:nt pass columnvarchar(255)encrypted nt passwd + identifier:plain pass columnvarchar(255)plaintext password + identifier:acct control columnint(9)nt user data + identifier:unknown 3 columnint(9)unknown + identifier:logon divs columnint(9)? + identifier:hours len columnint(9)? + identifier:unknown 5 columnint(9)unknown + identifier:unknown 6 columnint(9)unknown + +
+ Eventually, you can put a colon (:) after the name of each column, which @@ -1362,7 +1457,7 @@ index default sub - pdbedit -e xml:filename + $ pdbedit -e xml:filename @@ -1371,22 +1466,7 @@ index default sub To import data, use: - pdbedit -i xml:filename -e current-pdb - - - - Where filename is the name to read the data from and current-pdb to put it in. - - - - For example: To migrate (copy) the smbpasswd database into a tdbsam database: - - - - - then execute (as root): - pdbedit -i smbpasswd -e tdbsam - + $ pdbedit -i xml:filename @@ -1394,11 +1474,64 @@ index default sub Common Errors - -Put stuff here -- People forget to put their users in their backend and then complain samba - won't authorize them - + + Users can not logon - Users not in Samba SAM + + + People forget to put their users in their backend and then complain Samba won't authorize them. + + + + + + Users are being added to the wrong backend database + + + A few complaints have been received from users that just moved to Samba-3. The following + &smb.conf; file entries were causing problems, new accounts were being added to the old + smbpasswd file, not to the tdbsam passdb.tdb file: + + + + + [globals] + ... + passdb backend = smbpasswd, tdbsam, guest + ... + + + + + Samba will add new accounts to the first entry in the passdb backend + parameter entry. If you want to update to the tdbsam, then change the entry to: + + + + + [globals] + ... + passdb backend = tdbsam, smbpasswd, guest + ... + + + + + + + auth methods does not work + + + If you explicitly set an 'auth methods' parameter, guest must be specified as the first + entry on the line. Eg: auth methods = guest sam. + + + + This is the exact opposite of the requirement for the passdb backed + option, where it must be the LAST parameter on the line. + + + + diff --git a/docs/docbook/projdoc/printer_driver2.xml b/docs/docbook/projdoc/printer_driver2.xml index da3eb838f2..11231e6c9a 100644 --- a/docs/docbook/projdoc/printer_driver2.xml +++ b/docs/docbook/projdoc/printer_driver2.xml @@ -1,1037 +1,3494 @@ - &author.jerry; - PatrickPowell + KurtPfeifle -
papowell@lprng.org
+ Danka Deutschland GmbH +
kpfeifle@danka.de
 - (3 May 2001) + &author.jerry; + May 32, 2003 -Printing Support +Classical Printing Support -Introduction - -Beginning with the 2.2.0 release, Samba supports -the native Windows NT printing mechanisms implemented via -MS-RPC (i.e. the SPOOLSS named pipe). Previous versions of -Samba only supported LanMan printing calls. - -The additional functionality provided by the new -SPOOLSS support includes: - - - Support for downloading printer driver - files to Windows 95/98/NT/2000 clients upon demand. - - - Uploading of printer drivers via the - Windows NT Add Printer Wizard (APW) or the - Imprints tool set (refer to http://imprints.sourceforge.net). - - - Support for the native MS-RPC printing - calls such as StartDocPrinter, EnumJobs(), etc... (See - the MSDN documentation at http://msdn.microsoft.com/ - for more information on the Win32 printing API) - - - Support for NT Access Control Lists (ACL) - on printer objects - - Improved support for printer queue manipulation - through the use of an internal databases for spooled job - information - +Features and Benefits -There has been some initial confusion about what all this means -and whether or not it is a requirement for printer drivers to be -installed on a Samba host in order to support printing from Windows -clients. As a side note, Samba does not use these drivers in any way to process -spooled files. They are utilized entirely by the clients. +Printing is often a mission-critical service for the users. Samba can +provide this service reliably and seamlessly for a client network +consisting of Windows workstations. -The following MS KB article, may be of some help if you are dealing with -Windows 2000 clients: How to Add Printers with No User -Interaction in Windows 2000 +A Samba-3.0 print service may be run on a Standalone or a Domain +member server, side by side with file serving functions, or on a +dedicated print server. It can be made as tight or as loosely secured +as needs dictate. Configurations may be simple or complex. Available +authentication schemes are essentially the same as described for file +services in previous chapters. Overall, Samba's printing support is +now able to replace an NT or Windows 2000 print server full-square, +with additional benefits in many cases. Clients may download and +install drivers and printers through their familiar "Point'n'Print" +mechanism. Printer installations executed by "Logon Scripts" are no +problem. Administrators can upload and manage drivers to be used by +clients through the familiar "Add Printer Wizard". As an additional +benefit, driver and printer management may be run from the command line +or through scripts, making it more efficient in case of large numbers +of printers. If a central accounting of print jobs (tracking every +single page and supplying the raw data for all sorts of statistical +reports) is required, this is best supported by CUPS as the print +subsystem underneath the Samba hood. -http://support.microsoft.com/support/kb/articles/Q189/1/05.ASP +This chapter deals with the foundations of Samba printing, as they +implemented by the more traditional UNIX (BSD- and System V-style) +printing systems. Many things apply to CUPS, the newer Common UNIX +Printing System, too; so if you use CUPS, you might be tempted to jump +to the next chapter -- but you will certainly miss a few things if you +do so. Better read this chapter too. - + + +Most of the given examples have been verified on Windows XP +Professional clients. Where this document describes the responses to +commands given, bear in mind that Windows 2000 clients are very +similar, but may differ in details. Windows NT is somewhat different +again. + + + -Configuration - - -[print$] vs. [printer$] +Technical Introduction -Previous versions of Samba recommended using a share named [printer$]. -This name was taken from the printer$ service created by Windows 9x -clients when a printer was shared. Windows 9x printer servers always have -a printer$ service which provides read-only access via no -password in order to support printer driver downloads. +Samba's printing support always relies on the installed print +subsystem of the Unix OS it runs on. Samba is a "middleman". It takes +printfiles from Windows (or other SMB) clients and passes them to the +real printing system for further processing. Therefore it needs to +"talk" to two sides: to the Windows print clients and to the Unix +printing system. Hence we must differentiate between the various +client OS types each of which behave differently, as well as the +various UNIX print subsystems, which themselves have different +features and are accessed differently. This part of the Samba HOWTO +Collection deals with the "traditional" way of Unix printing first; +the next chapter covers in great detail the more modern +Common UNIX Printing System +(CUPS). + +CUPS users, be warned: don't just jump on to the next +chapter. You might miss important information contained only +here! - + + +What happens if you send a Job from a Client + -However, the initial implementation allowed for a -parameter named printer driver location -to be used on a per share basis to specify the location of -the driver files associated with that printer. Another -parameter named printer driver provided -a means of defining the printer driver name to be sent to -the client. +To successfully print a job from a Windows client via a Samba +print server to a UNIX printer, there are 6 (potentially 7) +stages: - - + +Windows opens a connection to the printershare + +Samba must authenticate the user + +Windows sends a copy of the printfile over the network +into Samba's spooling area + +Windows closes the connection again + +Samba invokes the print command to hand the file over +to the UNIX print subsystem's spooling area + +The Unix print subsystem processes the print +job + +The printfile may need to be explicitly deleted +from the Samba spooling area. + + + + -Creating [print$] +Printing Related Configuration Parameters -In order to support the uploading of printer driver -files, you must first configure a file share named [print$]. -The name of this share is hard coded in Samba's internals so -the name is very important (print$ is the service used by -Windows NT print servers to provide support for printer driver -download). +There are a number of configuration parameters in + controlling Samba's printing +behaviour. Please also refer to the man page for smb.conf to +acquire an overview about these. As with other parameters, there are +Global Level (tagged with a "G" in the listings) and +Service Level ("S") parameters. -You should modify the server's smb.conf file to add the global -parameters and to create the -following file share (of course, some of the parameter values, -such as 'path' are arbitrary and should be replaced with -appropriate values for your site): + +Service Level Parameters +These may go into the +[global] section of +. In this case they define the default +behaviour of all individual or service level shares (provided those +don't have a different setting defined for the same parameter, thus +overriding the global default). + + +Global Parameters +These may not go into individual +shares. If they go in by error, the "testparm" utility can discover +this (if you run it) and tell you so. + + + - -[global] - ; members of the ntadmin group should be able - ; to add drivers and set printer properties - ; root is implicitly a 'printer admin' - printer admin = @ntadmin - -[print$] - path = /usr/local/samba/printers - guest ok = yes - browseable = yes - read only = yes - ; since this share is configured as read only, then we need - ; a 'write list'. Check the file system permissions to make - ; sure this account can copy files to the share. If this - ; is setup to a non-root account, then it should also exist - ; as a 'printer admin' - write list = @ntadmin,root - - -The -write list is used to allow administrative -level user accounts to have write access in order to update files -on the share. See the smb.conf(5) -man page for more information on configuring file shares. - -The requirement for guest -ok = yes depends upon how your -site is configured. If users will be guaranteed to have -an account on the Samba host, then this is a non-issue. - - -Author's Note - - -The non-issue is that if all your Windows NT users are guaranteed to be -authenticated by the Samba server (such as a domain member server and the NT -user has already been validated by the Domain Controller in -order to logon to the Windows NT console), then guest access -is not necessary. Of course, in a workgroup environment where -you just want to be able to print without worrying about -silly accounts and security, then configure the share for -guest access. You'll probably want to add map to guest = Bad User - in the [global] section as well. Make sure -you understand what this parameter does before using it -though. --jerry - - + +Parameters Recommended for Use -In order for a Windows NT print server to support -the downloading of driver files by multiple client architectures, -it must create subdirectories within the [print$] service -which correspond to each of the supported client architectures. -Samba follows this model as well. +The following &smb.conf; parameters directly +related to printing are used in Samba-3. See also the +&smb.conf; man page for detailed explanations: + -Next create the directory tree below the [print$] share -for each architecture you wish to support. + + List of printing related parameters in Samba-3 + +Global level parameters: +addprinter command (G) +deleteprinter command (G) +disable spoolss (G) +enumports command (G) +load printers (G) +lpq cache time (G) +os2 driver map (G) +printcap name (G), printcap (G) +show add printer wizard (G) +total print jobs (G) +use client driver (G) + - -[print$]----- - |-W32X86 ; "Windows NT x86" - |-WIN40 ; "Windows 95/98" - |-W32ALPHA ; "Windows NT Alpha_AXP" - |-W32MIPS ; "Windows NT R4000" - |-W32PPC ; "Windows NT PowerPC" - +Service level parameters: +hosts allow (S) +hosts deny (S) +lppause command (S) +lpq command (S) +lpresume command (S) +lprm command (S) +max print jobs (S) +min print space (S) +print command (S) +printable (S), print ok (S) +printer name (S), printer (S) +printer admin (S) +printing = [cups|bsd|lprng...] (S) +queuepause command (S) +queueresume command (S) +total print jobs (S) + + + - -ATTENTION! REQUIRED PERMISSIONS - -In order to currently add a new driver to you Samba host, -one of two conditions must hold true: +Samba's printing support implements the Microsoft Remote Procedure +Calls (MS-RPC) methods for printing. These are used by Windows NT (and +later) print servers. The old "LanMan" protocol is still supported as +a fallback resort, and for older clients to use. More details will +follow further beneath. - - - The account used to connect to the Samba host - must have a uid of 0 (i.e. a root account) - - The account used to connect to the Samba host - must be a member of the printer - admin list. - + + + +Parameters for Backwards Compatibility -Of course, the connected account must still possess access -to add files to the subdirectories beneath [print$]. Remember -that all file shares are set to 'read only' by default. +Two new parameters that were added in Samba 2.2.2, are still present +in Samba-3.0. Both of these options are described in the +&smb.conf; man page and are disabled by +default. Use them with caution! - + +disable spoolss(G) + This is +provided for better support of Samba 2.0.x backwards capability. It +will disable Samba's support for MS-RPC printing and yield identical +printing behaviour to Samba 2.0.x. + + +use client driver (G) + was provided +for using local printer drivers on Windows NT/2000 clients. It does +not apply to Windows 95/98/ME clients. + + + + +Parameters "for backward compatibility only", use with caution -Once you have created the required [print$] service and -associated subdirectories, simply log onto the Samba server using -a root (or printer admin) account -from a Windows NT 4.0/2k client. Open "Network Neighbourhood" or -"My Network Places" and browse for the Samba host. Once you have located -the server, navigate to the "Printers..." folder. -You should see an initial listing of printers -that matches the printer shares defined on your Samba host. + +disable spoolss (G) + +use client driver (S) + + + -Setting Drivers for Existing Printers - -The initial listing of printers in the Samba host's -Printers folder will have no real printer driver assigned -to them. This defaults to a NULL string to allow the use -of the local Add Printer Wizard on NT/2000 clients. -Attempting to view the printer properties for a printer -which has this default driver assigned will result in -the error message: +Parameters no longer in use -Device settings cannot be displayed. The driver -for the specified printer is not installed, only spooler -properties will be displayed. Do you want to install the -driver now? +Samba users upgrading from 2.2.x to 3.0 need to be aware that some +previously available settings are no longer supported (as was +announced some time ago). Here is a list of them: + +"old" parameters, removed in Samba-3 + -Click "No" in the error dialog and you will be presented with -the printer properties window. The way to assign a driver to a -printer is to either - - +The following &smb.conf; parameters have been +deprecated already in Samba 2.2 and are now completely removed from +Samba-3. You cannot use them in new 3.0 installations: + - Use the "New Driver..." button to install - a new printer driver, or - - Select a driver from the popup list of - installed drivers. Initially this list will be empty. - +printer driver file (G) +total print jobs (G) +postscript (S) +printer driver (S) +printer driver location (S) - -If you wish to install printer drivers for client -operating systems other than "Windows NT x86", you will need -to use the "Sharing" tab of the printer properties dialog. - -Assuming you have connected with a root account, you -will also be able modify other printer properties such as -ACLs and device settings using this dialog box. - -A few closing comments for this section, it is possible -on a Windows NT print server to have printers -listed in the Printers folder which are not shared. Samba does -not make this distinction. By definition, the only printers of -which Samba is aware are those which are specified as shares in -smb.conf. - -Another interesting side note is that Windows NT clients do -not use the SMB printer share, but rather can print directly -to any printer on another Windows NT host using MS-RPC. This -of course assumes that the printing client has the necessary -privileges on the remote host serving the printer. The default -permissions assigned by Windows NT to a printer gives the "Print" -permissions to the "Everyone" well-known group. - + + + - -Support a large number of printers - -One issue that has arisen during the development -phase of Samba 2.2 is the need to support driver downloads for -100's of printers. Using the Windows NT APW is somewhat -awkward to say the list. If more than one printer are using the -same driver, the rpcclient's -setdriver command can be used to set the driver -associated with an installed driver. The following is example -of how this could be accomplished: - - -$ rpcclient pogo -U root%secret -c "enumdrivers" - -Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3] - -[Windows NT x86] -Printer Driver Info 1: - Driver Name: [HP LaserJet 4000 Series PS] - -Printer Driver Info 1: - Driver Name: [HP LaserJet 2100 Series PS] - -Printer Driver Info 1: - Driver Name: [HP LaserJet 4Si/4SiMX PS] - -$ rpcclient pogo -U root%secret -c "enumprinters" - -Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3] - flags:[0x800000] - name:[\\POGO\hp-print] - description:[POGO\\POGO\hp-print,NO DRIVER AVAILABLE FOR THIS PRINTER,] - comment:[] - - -$ rpcclient pogo -U root%secret -c "setdriver hp-print \"HP LaserJet 4000 Series PS\"" - -Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3] -Successfully set hp-print to driver HP LaserJet 4000 Series PS. + +A simple Configuration to Print with Samba-3 + + +Here is a very simple example configuration for print related settings +in the file. If you compare it with your +own system's , you probably find some +additional parameters included there (as pre-configured by your OS +vendor). Further below is a discussion and explanation of the +parameters. Note, that this example doesn't use many parameters. +However, in many environments these are enough to provide a valid + which enables all clients to print. + + + + [global] + printing = bsd + load printers = yes + + [printers] + path = /var/spool/samba + printable = yes + public = yes + writable = no - + +This is only an example configuration. Many settings, if not +explicitly set to a specific value, are used and set by Samba +implicitly to its own default, because these have been compiled in. +To see all settings, let root use the testparm +utility. testparm also gives warnings if you have +mis-configured certain things. Its complete output is easily 340 lines +and more. You may want to pipe it through a pager program. + + +The syntax for the configuration file is easy to grasp. You should +know that is not very picky about its +syntax. It has been explained elsewhere in this document. A short +reminder: It even tolerates some spelling errors (like "browsable" +instead of "browseable"). Most spelling is case-insensitive. Also, you +can use "Yes|No" or "True|False" for boolean settings. Lists of names +may be separated by commas, spaces or tabs. + -Adding New Printers via the Windows NT APW - +Verification of "Settings in Use" with <command>testparm</command> + -By default, Samba offers all printer shares defined in smb.conf -in the "Printers..." folder. Also existing in this folder is the Windows NT -Add Printer Wizard icon. The APW will be show only if +To see all (or at least most) printing related settings in Samba, +including the implicitly used ones, try the command outlined below +(hit "ENTER" twice!). It greps for all occurrences of "lp", "print", +"spool", "driver", "ports" and "[" in testparm's output and gives you +a nice overview about the running smbd's print configuration. (Note +that this command does not show individually created printer shares, +or the spooling paths in each case). Here is the output of my Samba +setup, with exactly the same settings in +as shown above: - - The connected user is able to successfully - execute an OpenPrinterEx(\\server) with administrative - privileges (i.e. root or printer admin). - - - show - add printer wizard = yes (the default). - - + +&rootprompt;testparm -v | egrep "(lp|print|spool|driver|ports|\[)" + Load smb config files from /etc/samba/smb.conf.simpleprinting + Processing section "[homes]" + Processing section "[printers]" + + [global] + smb ports = 445 139 + lpq cache time = 10 + total print jobs = 0 + load printers = Yes + printcap name = /etc/printcap + disable spoolss = No + enumports command = + addprinter command = + deleteprinter command = + show add printer wizard = Yes + os2 driver map = + printer admin = + min print space = 0 + max print jobs = 1000 + printable = No + printing = bsd + print command = lpr -r -P'%p' %s + lpq command = lpq -P'%p' + lprm command = lprm -P'%p' %j + lppause command = + lpresume command = + printer name = + use client driver = No + + [homes] + + [printers] + path = /var/spool/samba + printable = Yes + + -In order to be able to use the APW to successfully add a printer to a Samba -server, the add -printer command must have a defined value. The program -hook must successfully add the printer to the system (i.e. -/etc/printcap or appropriate files) and -smb.conf if necessary. - - - -When using the APW from a client, if the named printer share does -not exist, smbd will execute the add printer -command and reparse to the smb.conf -to attempt to locate the new printer share. If the share is still not defined, -an error of "Access Denied" is returned to the client. Note that the -add printer program is executed under the context -of the connected user, not necessarily a root account. - - - -There is a complementary delete -printer command for removing entries from the "Printers..." -folder. - - - -The following is an example add printer command script. It adds the appropriate entries to /etc/printcap.local (change that to what you need) and returns a line of 'Done' which is needed for the whole process to work. - - - -#!/bin/sh - -# Script to insert a new printer entry into printcap.local -# -# $1, printer name, used as the descriptive name -# $2, share name, used as the printer name for Linux -# $3, port name -# $4, driver name -# $5, location, used for the device file of the printer -# $6, win9x location - -# -# Make sure we use the location that RedHat uses for local printer defs -PRINTCAP=/etc/printcap.local -DATE=`date +%Y%m%d-%H%M%S` -LP=lp -RESTART="service lpd restart" - -# Keep a copy -cp $PRINTCAP $PRINTCAP.$DATE -# Add the printer to $PRINTCAP -echo "" >> $PRINTCAP -echo "$2|$1:\\" >> $PRINTCAP -echo " :sd=/var/spool/lpd/$2:\\" >> $PRINTCAP -echo " :mx=0:ml=0:sh:\\" >> $PRINTCAP -echo " :lp=/usr/local/samba/var/print/$5.prn:" >> $PRINTCAP - -touch "/usr/local/samba/var/print/$5.prn" >> /tmp/printadd.$$ 2>&1 -chown $LP "/usr/local/samba/var/print/$5.prn" >> /tmp/printadd.$$ 2>&1 - -mkdir /var/spool/lpd/$2 -chmod 700 /var/spool/lpd/$2 -chown $LP /var/spool/lpd/$2 -#echo $1 >> "/usr/local/samba/var/print/$5.prn" -#echo $2 >> "/usr/local/samba/var/print/$5.prn" -#echo $3 >> "/usr/local/samba/var/print/$5.prn" -#echo $4 >> "/usr/local/samba/var/print/$5.prn" -#echo $5 >> "/usr/local/samba/var/print/$5.prn" -#echo $6 >> "/usr/local/samba/var/print/$5.prn" -$RESTART >> "/usr/local/samba/var/print/$5.prn" -# Not sure if this is needed -touch /usr/local/samba/lib/smb.conf -# -# You need to return a value, but I am not sure what it means. -# -echo "Done" -exit 0 - +You can easily verify which settings were implicitly added by Samba's +default behaviour. Don't forget about this point: it may +be important in your future dealings with Samba. + - + testparm in Samba-3.0 behaves differently from 2.2.x: used +without the "-v" switch it only shows you the settings actually +written into ! To see the complete +configuration used, add the "-v" parameter to testparm. + -Samba and Printer Ports +A little Experiment to warn you -Windows NT/2000 print servers associate a port with each printer. These normally -take the form of LPT1:, COM1:, FILE:, etc... Samba must also support the -concept of ports associated with a printer. By default, only one printer port, -named "Samba Printer Port", exists on a system. Samba does not really a port in -order to print, rather it is a requirement of Windows clients. +Should you need to troubleshoot at any stage, please always come back +to this point first and verify if "testparm" shows the parameters you +expect! To give you an example from personal experience as a warning, +try to just "comment out" the load printers" +parameter. If your 2.2.x system behaves like mine, you'll see this: + +&rootprompt;grep "load printers" /etc/samba/smb.conf + # load printers = Yes + # This setting is commented ooouuuuut!! + +&rootprompt;testparm -v /etc/samba/smb.conf | egrep "(load printers)" + load printers = Yes + + + -Note that Samba does not support the concept of "Printer Pooling" internally -either. This is when a logical printer is assigned to multiple ports as -a form of load balancing or fail over. +Despite my imagination that the commenting out of this setting should +prevent Samba from publishing my printers, it still did! Oh Boy -- it +cost me quite some time to find out the reason. But I am not fooled +any more... at least not by this ;-) + +&rootprompt;grep -A1 "load printers" /etc/samba/smb.conf + load printers = No + # This setting is what I mean!! + # load printers = Yes + # This setting is commented ooouuuuut!! + +&rootprompt;testparm -v smb.conf.simpleprinting | egrep "(load printers)" + load printers = No + + + -If you require that multiple ports be defined for some reason, -smb.conf possesses a enumports -command which can be used to define an external program -that generates a listing of ports on a system. +Only when setting the parameter explicitly to +"load printers = No" +would Samba recognize my intentions. So my strong advice is: - + +Never rely on "commented out" parameters! - +Always set it up explicitly as you intend it to +behave. +Use testparm to uncover hidden +settings which might not reflect your intentions. - - The Imprints Toolset - - The Imprints tool set provides a UNIX equivalent of the - Windows NT Add Printer Wizard. For complete information, please - refer to the Imprints web site at - http://imprints.sourceforge.net/ as well as the documentation - included with the imprints source distribution. This section will - only provide a brief introduction to the features of Imprints. - - - - What is Imprints? - - Imprints is a collection of tools for supporting the goals - of - - - Providing a central repository information - regarding Windows NT and 95/98 printer driver packages - - - Providing the tools necessary for creating - the Imprints printer driver packages. - - Providing an installation client which - will obtain and install printer drivers on remote Samba - and Windows NT 4 print servers. - - - - - - - Creating Printer Driver Packages - - The process of creating printer driver packages is beyond - the scope of this document (refer to Imprints.txt also included - with the Samba distribution for more information). In short, - an Imprints driver package is a gzipped tarball containing the - driver files, related INF files, and a control file needed by the - installation client. - - - - - The Imprints server - - The Imprints server is really a database server that - may be queried via standard HTTP mechanisms. Each printer - entry in the database has an associated URL for the actual - downloading of the package. Each package is digitally signed - via GnuPG which can be used to verify that package downloaded - is actually the one referred in the Imprints database. It is - not recommended that this security check - be disabled. - - - - The Installation Client - - More information regarding the Imprints installation client - is available in the Imprints-Client-HOWTO.ps - file included with the imprints source package. - - The Imprints installation client comes in two forms. - - - a set of command line Perl scripts - - - a GTK+ based graphical interface to - the command line perl scripts - - - The installation client (in both forms) provides a means - of querying the Imprints database server for a matching - list of known printer model names as well as a means to - download and install the drivers on remote Samba and Windows - NT print servers. - - The basic installation process is in four steps and - perl code is wrapped around smbclient - and rpcclient. - - -foreach (supported architecture for a given driver) -{ - 1. rpcclient: Get the appropriate upload directory - on the remote server - 2. smbclient: Upload the driver files - 3. rpcclient: Issues an AddPrinterDriver() MS-RPC -} - -4. rpcclient: Issue an AddPrinterEx() MS-RPC to actually - create the printer - - - One of the problems encountered when implementing - the Imprints tool set was the name space issues between - various supported client architectures. For example, Windows - NT includes a driver named "Apple LaserWriter II NTX v51.8" - and Windows 95 calls its version of this driver "Apple - LaserWriter II NTX" - - The problem is how to know what client drivers have - been uploaded for a printer. As astute reader will remember - that the Windows NT Printer Properties dialog only includes - space for one printer driver name. A quick look in the - Windows NT 4.0 system registry at - - HKLM\System\CurrentControlSet\Control\Print\Environment - - - will reveal that Windows NT always uses the NT driver - name. This is ok as Windows NT always requires that at least - the Windows NT version of the printer driver is present. - However, Samba does not have the requirement internally. - Therefore, how can you use the NT driver name if is has not - already been installed? - - The way of sidestepping this limitation is to require - that all Imprints printer driver packages include both the Intel - Windows NT and 95/98 printer drivers and that NT driver is - installed first. - - - + - + +You can have a working Samba print configuration with this +minimal : + - -Diagnosis + +&rootprompt;cat /etc/samba/smb.conf-minimal + [printers] - -Introduction + -This is a short description of how to debug printing problems with -Samba. This describes how to debug problems with printing from a SMB -client to a Samba server, not the other way around. For the reverse -see the examples/printing directory. +This example should show you that you can use testparm to test any +filename for fitness as a Samba configuration. Actually, we want to +encourage you not to change your + on a working system (unless you know +exactly what you are doing)! Don't rely on an assumption that changes +will only take effect after you re-start smbd! This is not the +case. Samba re-reads its every 60 +seconds and on each new client connection. You might have to face +changes for your production clients that you didn't intend to apply at +this time! You will now note a few more interesting things. Let's now +ask testparm what the Samba print configuration +would be, if you used this minimalistic file as your real +: + +&rootprompt; testparm -v /etc/samba/smb.conf-minimal | egrep "(print|lpq|spool|driver|ports|[)" + Processing section "[printers]" + WARNING: [printers] service MUST be printable! + No path in service printers - using /tmp + + lpq cache time = 10 + total print jobs = 0 + load printers = Yes + printcap name = /etc/printcap + disable spoolss = No + enumports command = + addprinter command = + deleteprinter command = + show add printer wizard = Yes + os2 driver map = + printer admin = + min print space = 0 + max print jobs = 1000 + printable = No + printing = bsd + print command = lpr -r -P%p %s + lpq command = lpq -P%p + printer name = + use client driver = No + [printers] + printable = Yes + + + -Ok, so you want to print to a Samba server from your PC. The first -thing you need to understand is that Samba does not actually do any -printing itself, it just acts as a middleman between your PC client -and your Unix printing subsystem. Samba receives the file from the PC -then passes the file to a external "print command". What print command -you use is up to you. +testparm issued 2 warnings: + +because we didn't specify the +[printers] section as printable, +and + +because we didn't tell it which spool directory to +use. + + + -The whole things is controlled using options in smb.conf. The most -relevant options (which you should look up in the smb.conf man page) -are: +However, this was not fatal, and Samba-3.0 will default to values that +will work here. But, please!, don't rely on this and don't use this +example! This was only meant to make you careful to design and specify +your setup to be what you really want it to be. The outcome on your +system may vary for some parameters, since you may have a Samba built +with a different compile-time configuration. +Warning: don't put a comment sign at +the end of a valid line. It +will cause the parameter to be ignored (just as if you had put the +comment sign at the front). At first I regarded this as a bug in my +Samba version(s). But the man page states: Internal whitespace +in a parameter value is retained verbatim. This means that a +line consisting of, for example, - - [global] - print command - send a file to a spooler - lpq command - get spool queue status - lprm command - remove a job - [printers] - path = /var/spool/lpd/samba - + +printing = lprng #This defines LPRng as the printing system" + -The following are nice to know about: +will regard the whole of the string after the "=" +sign as the value you want to define. And this is an invalid value +that will be ignored, and a default value used instead.] + + - - queuepause command - stop a printer or print queue - queueresume command - start a printer or print queue - + +Extended Sample Configuration to Print with Samba-3 -Example: - +Here we show a more verbose example configuration for print related +settings in an . Below is a discussion +and explanation of the various parameters. We chose to use BSD-style +printing here, because we guess it is still the most commonly used +system on legacy Linux installations (new installs now predominantly +have CUPS, which is discussed entirely in the next chapter of this +document). Note, that this example explicitly names many parameters +which don't need to be stated because they are set by default. You +might be able to do with a leaner . + + +if you read access it with the Samba Web Administration Tool (SWAT), +and then write it to disk again, it will be optimized in a way such +that it doesn't contain any superfluous parameters and comments. SWAT +organizes the file for best performance. Remember that each smbd +re-reads the Samba configuration once a minute, and that each +connection spawns an smbd process of its own, so it is not a bad idea +to optimize the in environments with +hundreds or thousands of clients. - print command = /usr/bin/lpr -r -P%p %s - lpq command = /usr/bin/lpq -P%p %s - lprm command = /usr/bin/lprm -P%p %j - queuepause command = /usr/sbin/lpc -P%p stop - queuepause command = /usr/sbin/lpc -P%p start + [global] + printing = bsd + load printers = yes + show add printer wizard = yes + printcap name = /etc/printcap + printer admin = @ntadmin, root + total print jobs = 100 + lpq cache time = 20 + use client driver = no + + [printers] + comment = All Printers + printable = yes + path = /var/spool/samba + browseable = no + guest ok = yes + public = yes + read only = yes + writable = no + + [my_printer_name] + comment = Printer with Restricted Access + path = /var/spool/samba_my_printer + printer admin = kurt + browseable = yes + printable = yes + writeable = no + hosts allow = 0.0.0.0 + hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60 + guest ok = no -Samba should set reasonable defaults for these depending on your -system type, but it isn't clairvoyant. It is not uncommon that you -have to tweak these for local conditions. The commands should -always have fully specified pathnames, as the smdb may not have -the correct PATH values. +This also is only an example configuration. You +may not find all the settings in your own + (as pre-configured by your OS +vendor). Many configuration parameters, if not explicitly set to a +specific value, are used and set by Samba implicitly to its own +default, because these have been compiled in. To see all settings, let +root use the testparm +utility. testparm also gives warnings if you have +mis-configured certain things.. + + + +Detailed Explanation of the Example's Settings -When you send a job to Samba to be printed, it will make a temporary -copy of it in the directory specified in the [printers] section. -and it should be periodically cleaned out. The lpr -r option -requests that the temporary copy be removed after printing; If -printing fails then you might find leftover files in this directory, -and it should be periodically cleaned out. Samba used the lpq -command to determine the "job number" assigned to your print job -by the spooler. +Following is a discussion of the settings from above shown example. + +The [global] Section + -The %>letter< are "macros" that get dynamically replaced with appropriate -values when they are used. The %s gets replaced with the name of the spool -file that Samba creates and the %p gets replaced with the name of the -printer. The %j gets replaced with the "job number" which comes from -the lpq output. +The [global] section is one of 4 special +sections (along with [[homes], +[printers] and +[print$]...) It contains all parameters which +apply to the server as a whole. It is the place for parameters which +have only a "global" meaning (G). It may also contain service level +parameters (S) which then define default settings for all other +sections and shares. This way you can simplify the configuration and +avoid setting the same value repeatedly. (Within each individual +section or share you may however override these globally set "share +level" settings and specify other values). + +printing = bsd + this causes Samba to use default print commands +applicable for the BSD (a.k.a. RFC 1179 style or LPR/LPD) printing +system. In general, the "printing" parameter informs Samba about the +print subsystem it should expect. Samba supports CUPS, LPD, LPRNG, +SYSV, HPUX, AIX, QNX and PLP. Each of these systems defaults to a +different print command (and other queue control +commands). +The printing parameter is +normally a service level parameter. Since it is included here in the +[global] section, it will take effect for all +printer shares that are not defined differently. Samba-3.0 no longer +supports the SOFTQ printing system. + + +load printers = yes + this tells Samba to create automatically all +available printer shares. "Available" printer shares are discovered by +scanning the printcap file. All created printer shares are also loaded +for browsing. If you use this parameter, you do not need to specify +separate shares for each printer. Each automatically created printer +share will clone the configuration options found in the +[printers] section. (A load printers += no setting will allow you to specify each UNIX printer +you want to share separately, leaving out some you don't want to be +publicly visible and available). + +show add printer wizard = +yes this setting is normally +enabled by default (even if the parameter is not written into the +). It makes the Add Printer Wizard icon +show up in the Printers folder of the Samba host's +share listing (as shown in Network Neighbourhood or +by the net view command). To disable it, you need to +explicitly set it to no (commenting it out +will not suffice!). The Add Printer Wizard lets you upload printer +drivers to the [print$] share and associate it +with a printer (if the respective queue exists there before the +action), or exchange a printer's driver against any other previously +uploaded driver. + +total print jobs = 100 + this setting sets the upper limit to 100 print jobs +being active on the Samba server at any one time. Should a client +submit a job which exceeds this number, a no more space +available on server type of error message will be returned by +Samba to the client. A setting of "0" (the default) means there is +no limit at all! + + +printcap name = /etc/printcap + + this tells Samba where to look for a list of +available printer names. (If you use CUPS, make sure that a printcap +file is written: this is controlled by the "Printcap" directive of +cupsd.conf). + + +printer admin = @ntadmin + members of the ntadmin group should be able to add +drivers and set printer properties ("ntadmin" is only an example name, +it needs to be a valid UNIX group name); root is implicitly always a +printer admin. The "@" sign precedes group names in +. A printer admin can do anything to +printers via the remote administration interfaces offered by MS-RPC +(see below). Note that the printer admin +parameter is normally a share level parameter, so you may associate +different groups to different printer shares in larger installations, +if you use the printer admin parameter on the +share levels). + + +lpq cache time = 20 + this controls the cache time for the results of the +lpq command. It prevents the lpq command being called too often and +reduces load on a heavily used print server. + + +use client driver = no + if set to yes, this setting only +takes effect for Win NT/2k/XP clients (and not for Win 95/98/ME). Its +default value is No (or False). +It must not be enabled on print shares +(with a yes or true setting) which +have valid drivers installed on the Samba server! For more detailed +explanations see the man page of &smb.conf;. + + + -Debugging printer problems +The [printers] Section -One way to debug printing problems is to start by replacing these -command with shell scripts that record the arguments and the contents -of the print file. A simple example of this kind of things might -be: +This is the second special section. If a section with this name +appears in the &smb.conf;, users are able to +connect to any printer specified in the Samba host's printcap file, +because Samba on startup then creates a printer share for every +printername it finds in the printcap file. You could regard this +section as a general convenience shortcut to share all printers with +minimal configuration. It is also a container for settings which +should apply as default to all printers. (For more details see the +&smb.conf; man page.) Settings inside this +container must be share level parameters (S). - - print command = /tmp/saveprint %p %s - - #!/bin/saveprint - # we make sure that we are the right user - /usr/bin/id -p >/tmp/tmp.print - # we run the command and save the error messages - # replace the command with the one appropriate for your system - /usr/bin/lpr -r -P$1 $2 2>>&/tmp/tmp.print - + +comment = All printers + the comment is shown next to +the share if a client queries the server, either via Network +Neighbourhood or with the net view command to list +available shares. + + +printable = yes + please note well, that the +[printers] service must be +declared as printable. If you specify otherwise, smbd will refuse to +load at startup. This parameter allows +connected clients to open, write to and submit spool files into the +directory specified with the path parameter for +this service. It is used by Samba to differentiate printer shares from +file shares. + +path = /var/spool/samba +this must point to a directory used by Samba to spool +incoming print files. It must not be the same as the spool +directory specified in the configuration of your UNIX print +subsystem! The path would typically point to a directory +which is world writeable, with the "sticky" bit set to it. + + +browseable = no + this is always set to no if +printable = yes. It makes the +[printer] share itself invisible in the +list of available shares in a net view command or +in the Explorer browse list. (Note that you will of course see the +individual printers). + + +guest ok = yes - -Then you print a file and try removing it. You may find that the -print queue needs to be stopped in order to see the queue status -and remove the job: + +if set to yes, then no password is required to +connect to the printers service. Access will be granted with the +privileges of the guest account. On many systems the +guest account will map to a user named "nobody". This user is in the UNIX +passwd file with an empty password, but with no valid UNIX login. +(Note: on some systems the guest account might not have the +privilege to be able to print. Test this by logging in as your +guest user using su - guest and run a system print +command like - +lpr -P printername /etc/motd + + + +public = yes + this is a synonym for guest ok = +yes. Since we have guest ok = yes, +it really doesn't need to be here! (This leads to the interesting +question: What, if I by accident have to contradictory settings +for the same share? The answer is: the last one encountered by +Samba wins. The "winner" is shown by testparm. Testparm doesn't +complain about different settings of the same parameter for the same +share! You can test this by setting up multiple lines for the "guest +account" parameter with different usernames, and then run testparm to +see which one is actually used by Samba.) + + +read only = yes +this normally (for other types of shares) prevents +users creating or modifying files in the service's directory. However, +in a "printable" service, it is always allowed to +write to the directory (if user privileges allow the connection), but +only via print spooling operations. "Normal" write operations are not +allowed. + +writeable = no + +synonym for read only = yes + + + -h4: {42} % echo hi >/tmp/hi -h4: {43} % smbclient //localhost/lw4 -added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0 -Password: -Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7] -smb: \> print /tmp/hi -putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s) -smb: \> queue -1049 3 hi-17534 -smb: \> cancel 1049 -Error cancelling job 1049 : code 0 -smb: \> cancel 1049 -Job 1049 cancelled -smb: \> queue -smb: \> exit - + +Any [my_printer_name] Section -The 'code 0' indicates that the job was removed. The comment -by the smbclient is a bit misleading on this. -You can observe the command output and then and look at the -/tmp/tmp.print file to see what the results are. You can quickly -find out if the problem is with your printing system. Often people -have problems with their /etc/printcap file or permissions on -various print queues. +If a section appears in the , which is +tagged as printable = yes, Samba presents it as +a printer share to its clients. Note, that Win95/98/ME clients may +have problems with connecting or loading printer drivers if the share +name has more than 8 characters! Also be very careful if you give a +printer the same name as an existing user or file share name: upon a +client's connection request to a certain sharename, Samba always tries +to find file shares with that name first; if it finds one, it will +connect to this and will never ultimately connect to a printer with +the same name! + + +comment = Printer with Restricted Access + the comment says it all. + + +path = /var/spool/samba_my_printer + here we set the spooling area for this printer to +another directory than the default. It is not a requirement to set it +differently, but the option is available. + + +printer admin = kurt + the printer admin definition is different for this +explicitly defined printer share from the general +[printers] share. It is not a requirement; we +did it to show that it is possible if you want it. + + +browseable = yes + we also made this printer browseable (so that the +clients may conveniently find it when browsing the Network +Neighbourhood). + + +printable = yes +see explanation in last subsection. + + +writeable = no +see explanation in last subsection. + + +hosts allow = 10.160.50.,10.160.51. +here we exercise a certain degree of access control +by using the hosts allow and hosts deny parameters. Note, that +this is not by any means a safe bet. It is not a way to secure your +printers. This line accepts all clients from a certain subnet in a +first evaluation of access control + + +hosts deny = turbo_xp,10.160.50.23,10.160.51.60 + +all listed hosts are not allowed here (even if they +belong to the "allowed subnets"). As you can see, you could name IP +addresses as well as NetBIOS hostnames +here. + + +guest ok = no +this printer is not open for the guest account! + + + -What printers do I have? +Print Commands -You can use the 'testprns' program to check to see if the printer -name you are using is recognized by Samba. For example, you can -use: +In each section defining a printer (or in the +[printers] section), a print +command parameter may be defined. It sets a command to +process the files which have been placed into the Samba print spool +directory for that printer. (That spool directory was, if you +remember, set up with the path +parameter). Typically, this command will submit the spool file to the +Samba host's print subsystem, using the suitable system print +command. But there is no requirement that this needs to be the +case. For debugging purposes or some other reason you may want to do +something completely different than "print" the file. An example is a +command that just copies the print file to a temporary location for +further investigation when you need to debug printing. If you craft +your own print commands (or even develop print command shell scripts), +make sure you pay attention to the need to remove the files from the +Samba spool directory. Otherwise your hard disk may soon suffer from +shortage of free space. + - - testprns printer /etc/printcap - + +Default Print Commands for various Unix Print Subsystems -Samba can get its printcap information from a file or from a program. -You can try the following to see the format of the extracted -information: +You learned earlier on, that Samba in most cases uses its built-in +settings for many parameters if it can not find an explicitly stated +one in its configuration file. The same is true for the +print command. The default print command varies +depending on the printing =... parameter +setting. In the commands listed below, you will notice some parameters +of the form %X where X is +p, s, J etc. These letters stand for +"printername", "spoolfile" and "job ID" respectively. They are +explained in more detail further below. Here is an overview (excluding +the special case of CUPS, which is discussed in the next chapter): - - testprns -a printer /etc/printcap + + + + +If this setting is active... +...this is used in lieu of an explicit command: + + + + +printing = bsd|aix|lprng|plp +print command is lpr -r -P%p %s + + +printing = sysv|hpux +print command is lp -c -P%p %s; rm %s + + + printing = qnx +print command is lp -r -P%p -s %s + + +printing = bsd|aix|lprng|plp +lpq command is lpq -P%p + + +printing = sysv|hpux +lpq command is lpstat -o%p + + +printing = qnx +lpq command is lpq -P%p + + +printing = bsd|aix|lprng|plp +lprm command is lprm -P%p %j + + +printing = sysv|hpux +lprm command is cancel %p-%j + + +printing = qnx +lprm command is cancel %p-%j + + +printing = bsd|aix|lprng|plp +lppause command is lp -i %p-%j -H hold + + +printing = sysv|hpux +lppause command (...is empty) + + +printing = qnx +lppause command (...is empty) + + +printing = bsd|aix|lprng|plp +lpresume command is lp -i %p-%j -H resume + + +printing = sysv|hpux +lpresume command (...is empty) + + +printing = qnx +lpresume command (...is empty) + + + + - testprns -a printer '|/bin/cat printcap' - + +We excluded the special CUPS case here, because it is discussed in the +next chapter. Just a short summary. For printing = +CUPS: If SAMBA is compiled against libcups, it uses the +CUPS API to submit jobs, etc. (It is a good idea also to set +printcap = cups in case your +cupsd.conf is set to write its autogenerated +printcap file to an unusual place). Otherwise Samba maps to the System +V printing commands with the -oraw option for printing, i.e. it uses +lp -c -d%p -oraw; rm %s With printing = +cups , and if SAMBA is compiled against libcups, any +manually set print command will be ignored! + + + +Having listed the above mappings here, you should note that there used +to be a bug in recent 2.2.x versions which +prevented the mapping from taking effect. It lead to the +"bsd|aix|lprng|plp" settings taking effect for all other systems, for +the most important commands (the print command, the +lpq command and the lprm +command). The lppause command and the +lpresume command remained empty. Of course, these +commands worked on bsd|aix|lprng|plp but they didn't work on +sysv|hpux|qnx systems. To work around this bug, you need to +explicitly set the commands. Use testparm -v to +check which command takes effect. Then check that this command is +adequate and actually works for your installed print subsystem. It is +always a good idea to explicitly set up your configuration files the +way you want them to work and not rely on any built-in defaults. + -Setting up printcap and print servers +Setting up your own Print Commands -You may need to set up some printcaps for your Samba system to use. -It is strongly recommended that you use the facilities provided by -the print spooler to set up queues and printcap information. +After a print job has finished spooling to a service, the +print command will be used by Samba via a +system() call to process the spool file. Usually +the command specified will submit the spool file to the host's +printing subsystem. But there is no requirement at all that this must +be the case. The print subsystem will probably not remove the spool +file on its own. So whatever command you specify on your own you +should ensure that the spool file is deleted after it has been +processed. -Samba requires either a printcap or program to deliver printcap -information. This printcap information has the format: +There is no difficulty with using your own customized print commands +with the traditional printing systems. However, if you don't wish to +"roll your own", you should be well informed about the default +built-in commands that Samba uses for each printing subsystem (see the +table above). In all the commands listed in the last paragraphs you +see parameters of the form %X These are +macros, or shortcuts, used as place holders for +the names of real objects. At the time of running a command with such +a placeholder, Samba will insert the appropriate value +automatically. Print commands can handle all Samba macro +substitutions. In regard to printing, the following ones do have +special relevance: - - name|alias1|alias2...:option=value:... - + +%s, %f - the path to the spool +file name + +%p - the appropriate printer +name + +%J - the job name as +transmitted by the client. + +%c - the number of printed +pages of the spooled job (if known). + +%z - the size of the spooled +print job (in bytes) + + -For almost all printing systems, the printer 'name' must be composed -only of alphanumeric or underscore '_' characters. Some systems also -allow hyphens ('-') as well. An alias is an alternative name for the -printer, and an alias with a space in it is used as a 'comment' -about the printer. The printcap format optionally uses a \ at the end of lines -to extend the printcap to multiple lines. +The print command MUST contain at least one occurrence of +%s or %f. -- The +%p is optional. If no printer name is supplied, +the %p will be silently removed from the print +command. In this case the job is sent to the default printer. -Here are some examples of printcap files: +If specified in the [global] section, the print +command given will be used for any printable service that does not +have its own print command specified. If there is neither a specified +print command for a printable service nor a global print command, +spool files will be created but not processed! And (most importantly): +print files will not be removed, so they will start filling your Samba +hard disk. - - -pr just printer name - - -pr|alias printer name and alias - - -pr|My Printer printer name, alias used as comment - - -pr:sh:\ Same as pr:sh:cm= testing - :cm= \ - testing - - -pr:sh Same as pr:sh:cm= testing - :cm= testing - - +Note that printing may fail on some UNIXes from the "nobody" +account. If this happens, create an alternative guest account and +supply it with the privilege to print. Set up this guest account in +the [global] section with the guest +account parameter. -Samba reads the printcap information when first started. If you make -changes in the printcap information, then you must do the following: +You can form quite complex print commands. You need to realize that +print commands are just passed to a UNIX shell. The shell is able to +expand the included environment variables as usual. (The syntax to +include a UNIX environment variable $variable +in or in the Samba print command is +%$variable.) To give you a working +print command example, the following will log a +print job to /tmp/print.log, print the file, then +remove it. Note that ';' is the usual separator for commands in shell +scripts: - + +> /tmp/print.log; lpr -P %p %s; rm %s +]]> + - -make sure that the print spooler is aware of these changes. -The LPRng system uses the 'lpc reread' command to do this. - + +You may have to vary your own command considerably from this example +depending on how you normally print files on your system. The default +for the print command parameter varies depending on the setting of +the printing parameter. Another example is: + - -make sure that the spool queues, etc., exist and have the -correct permissions. The LPRng system uses the 'checkpc -f' -command to do this. + + print command = /usr/local/samba/bin/myprintscript %p %s + + + + + +Innovations in Samba Printing since 2.2 + + +Before version 2.2.0, Samba's print server support for Windows clients +was limited to the level of LanMan printing +calls. This is the same protocol level as Windows 9x PCs offer when +they share printers. Beginning with the 2.2.0 release, Samba started +to support the native Windows NT printing mechanisms. These are +implemented via MS-RPC (RPC = Remote +Procedure Calls ). MS-RPCs use the +SPOOLSS named pipe for all printing. + + + +The additional functionality provided by the new SPOOLSS support includes: + + + +Support for downloading printer driver files to Windows +95/98/NT/2000 clients upon demand (Point'n'Print); - -You now should send a SIGHUP signal to the smbd server to have -it reread the printcap information. +Uploading of printer drivers via the Windows NT +Add Printer Wizard (APW) or the +Imprints tool set (refer to http://imprints.sourceforge.net); - - +Support for the native MS-RPC printing calls such as +StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation +at http://msdn.microsoft.com/ +for more information on the Win32 printing API); - -Job sent, no output +Support for NT Access Control +Lists (ACL) on printer objects; + +Improved support for printer queue manipulation +through the use of internal databases for spooled job information +(implemented by various *.tdb +files). + + -This is the most frustrating part of printing. You may have sent the -job, verified that the job was forwarded, set up a wrapper around -the command to send the file, but there was no output from the printer. +One other benefit of an update is this: Samba-3 is able to publish +all its printers in Active Directory (or LDAP)! -First, check to make sure that the job REALLY is getting to the -right print queue. If you are using a BSD or LPRng print spooler, -you can temporarily stop the printing of jobs. Jobs can still be -submitted, but they will not be printed. Use: +One slight difference is here: it is possible on a Windows NT print +server to have printers listed in the Printers folder which are +not shared. Samba does not make this +distinction. By definition, the only printers of which Samba is aware +are those which are specified as shares in +. The reason is that Windows NT/200x/XP Professional +clients do not normally need to use the standard SMB printer share; +rather they can print directly to any printer on another Windows NT +host using MS-RPC. This of course assumes that the printing client has +the necessary privileges on the remote host serving the printer. The +default permissions assigned by Windows NT to a printer gives the +"Print" permissions to the well-known Everyone +group. (The older clients of type Win9x can only print to "shared" +printers). - - lpc -Pprinter stop - + +Client Drivers on Samba Server for <emphasis>Point'n'Print</emphasis> -Now submit a print job and then use 'lpq -Pprinter' to see if the -job is in the print queue. If it is not in the print queue then -you will have to find out why it is not being accepted for printing. +There is still confusion about what all this means: Is it or +is it not a requirement for printer drivers to be installed on a Samba +host in order to support printing from Windows clients? The +answer to this is: No, it is not a +requirement. Windows NT/2000 clients can, of +course, also run their APW to install drivers +locally (which then connect to a Samba served +print queue). This is the same method as used by Windows 9x +clients. (However, a bug existed in Samba 2.2.0 +which made Windows NT/2000 clients require that the Samba server +possess a valid driver for the printer. This was fixed in Samba +2.2.1). -Next, you may want to check to see what the format of the job really -was. With the assistance of the system administrator you can view -the submitted jobs files. You may be surprised to find that these -are not in what you would expect to call a printable format. -You can use the UNIX 'file' utitily to determine what the job -format actually is: +But it is a new option to install the printer +drivers into the [print$] share of the Samba +server, and a big convenience too. Then all +clients (including 95/98/ME) get the driver installed when they first +connect to this printer share. The uploading or +depositing of the driver into this +[print$] share, and the following binding of +this driver to an existing Samba printer share can be achieved by +different means: - - cd /var/spool/lpd/printer # spool directory of print jobs - ls # find job files - file dfA001myhost - + +running the APW on an +NT/200x/XP Professional client (this doesn't work from 95/98/ME +clients); + +using the Imprints +toolset; + +using the smbclient and +rpcclient commandline tools; + +using cupsaddsmb(only works for +the CUPS printing system, not for LPR/LPD, LPRng +etc.). + + -You should make sure that your printer supports this format OR that -your system administrator has installed a 'print filter' that will -convert the file to a format appropriate for your printer. +Please take additional note of the following fact: Samba +does not use these uploaded drivers in any way to process spooled +files. Drivers are utilized entirely by the clients, who +download and install them via the "Point'n'Print" mechanism supported +by Samba. The clients use these drivers to generate print files in the +format the printer (or the Unix print system) requires. Print files +received by Samba are handed over to the Unix printing system, which +is responsible for all further processing, if needed. + + + +The [printer$] Section is removed from Samba-3 + +<parameter>[print$]</parameter> vs. <parameter>[printer$]</parameter> + + + +Versions of Samba prior to 2.2 made it possible to use a share +named [printer$]. This name was taken from the +same named service created by Windows 9x clients when a printer was +shared by them. Windows 9x printer servers always have a +[printer$] service which provides read-only +access (with no password required) in order to support printer driver +downloads. However, Samba's initial implementation allowed for a +parameter named printer driver location to be +used on a per share basis. This specified the location of the driver +files associated with that printer. Another parameter named +printer driver provided a means of defining the +printer driver name to be sent to the client. These parameters, +including the printer driver file parameter, +are now removed and can not be used in installations of Samba-3.0. +Now the share name [print$] is used for the +location of downloadable printer drivers. It is taken from the +[print$] service created by Windows NT PCs when +a printer is shared by them. Windows NT print servers always have a +[print$] service which provides read-write +access (in the context of its ACLs) in order to support printer driver +down- and uploads. Don't fear -- this does not mean Windows 9x +clients are thrown aside now. They can use Samba's +[print$] share support just fine. + -Job sent, strange output +Creating the [print$] Share -Once you have the job printing, you can then start worrying about -making it print nicely. +In order to support the up- and downloading of printer driver files, +you must first configure a file share named +[print$]. The "public" name of this share is +hard coded in Samba's internals (because it is hard coded in the MS +Windows clients too). It cannot be renamed since Windows clients are +programmed to search for a service of exactly this name if they want +to retrieve printer driver files. -The most common problem is extra pages of output: banner pages -OR blank pages at the end. +You should modify the server's file to +add the global parameters and create the +[print$] file share (of course, some of the +parameter values, such as 'path' are arbitrary and should be replaced +with appropriate values for your site): + + [global] + ; members of the ntadmin group should be able to add drivers and set + ; printer properties. root is implicitly always a 'printer admin'. + printer admin = @ntadmin + [....] + + [printers] + [....] + + [print$] + comment = Printer Driver Download Area + path = /etc/samba/drivers + browseable = yes + guest ok = yes + read only = yes + write list = @ntadmin, root + + -If you are getting banner pages, check and make sure that the -printcap option or printer option is configured for no banners. -If you have a printcap, this is the :sh (suppress header or banner -page) option. You should have the following in your printer. +Of course, you also need to ensure that the directory named by the +path parameter exists on the Unix file system. - - printer: ... :sh - + + + +Parameters in the [print$] Section + + +[print$] is a special section in +. It contains settings relevant to +potential printer driver download and local installation by clients. + + + +comment = Printer Driver +Download Area + the comment appears next to the share name if it is +listed in a share list (usually Windows clients won't see it often but +it will also appear up in a smbclient -L sambaserver + output). + +path = /etc/samba/printers + this is the path to the location of the Windows +driver file deposit from the UNIX point of +view. + +browseable = no + this makes the [print$] share +"invisible" in Network Neighbourhood to clients. However, you can +still "mount" it from any client using the net use +g:\\sambaserver\print$ command in a "DOS box" or the +"Connect network drive" menu from Windows +Explorer. + +guest ok = yes +this gives read only access to this share for all +guest users. Access may be used to download and install printer +drivers on clients. The requirement for guest ok = +yes depends upon how your site is configured. If users +will be guaranteed to have an account on the Samba host, then this is +a non-issue. + + +The non-issue is this: if all your Windows NT users are guaranteed to +be authenticated by the Samba server (for example if Samba +authenticates via an NT domain server and the NT user has already been +validated by the Domain Controller in order to logon to the Windows NT +session), then guest access is not necessary. Of course, in a +workgroup environment where you just want to be able to print without +worrying about silly accounts and security, then configure the share +for guest access. You'll probably want to add map to guest += Bad User in the [global] section +as well. Make sure you understand what this parameter does before +using it. + + +read only = yes +as we don't want everybody to upload driver files (or +even change driver settings) we tagged this share as not +writeable. + +write list = @ntadmin,root +since the [print$] was made +read only by the previous setting, we need to create a "write list" +also. UNIX groups (denoted with a leading "@" character) and users +listed here are allowed write access (as an exception to the general +public's "read-only" access), which they need to update files on the +share. Normally you will want to only name administrative level user +accounts in this setting. Check the file system permissions to make +sure these accounts can copy files to the share. If this is a non-root +account, then the account should also be mentioned in the global +printer admin parameter. See the + man page for more information on +configuring file shares. + + + + + + +Subdirectory Structure in [print$] -If you have this option and are still getting banner pages, there -is a strong chance that your printer is generating them for you -automatically. You should make sure that banner printing is disabled -for the printer. This usually requires using the printer setup software -or procedures supplied by the printer manufacturer. +In order for a Windows NT print server to support the downloading of +driver files by multiple client architectures, you must create several +subdirectories within the [print$] service +(i.e. the Unix directory named by the path +parameter). These correspond to each of the supported client +architectures. Samba follows this model as well. Just like the name of +the [print$] share itself, the subdirectories +*must* be exactly the names listed below (you may leave out the +subdirectories of architectures you don't want to support). -If you get an extra page of output, this could be due to problems -with your job format, or if you are generating PostScript jobs, -incorrect setting on your printer driver on the MicroSoft client. -For example, under Win95 there is a option: +Therefore, create a directory tree below the +[print$] share for each architecture you wish +to support. + - Printers|Printer Name|(Right Click)Properties|Postscript|Advanced| +[print$]--+-- + |--W32X86 # serves drivers to "Windows NT x86" + |--WIN40 # serves drivers to "Windows 95/98" + |--W32ALPHA # serves drivers to "Windows NT Alpha_AXP" + |--W32MIPS # serves drivers to "Windows NT R4000" + |--W32PPC # serves drivers to "Windows NT PowerPC" +Required permissions + -that allows you to choose if a Ctrl-D is appended to all jobs. -This is a very bad thing to do, as most spooling systems will -automatically add a ^D to the end of the job if it is detected as -PostScript. The multiple ^D may cause an additional page of output. +In order to add a new driver to your Samba host, one of two conditions +must hold true: - + +The account used to connect to the Samba host must +have a UID of 0 (i.e. a root account) - -Raw PostScript printed +The account used to connect to the Samba host must be +named in the printer adminlist. + + -This is a problem that is usually caused by either the print spooling -system putting information at the start of the print job that makes -the printer think the job is a text file, or your printer simply -does not support PostScript. You may need to enable 'Automatic -Format Detection' on your printer. +Of course, the connected account must still possess access to add +files to the subdirectories beneath +[print$]. Remember that all file shares are set +to 'read only' by default. + + +Once you have created the required [print$] +service and associated subdirectories, go to a Windows NT 4.0/2k/XP +client workstation. Open Network Neighbourhood or +My Network Places and browse for the Samba host. +Once you have located the server, navigate to its Printers and +Faxes folder. You should see an initial listing of printers +that matches the printer shares defined on your Samba host. + + - -Advanced Printing + +Installing Drivers into [print$] -Note that you can do some pretty magic things by using your -imagination with the "print command" option and some shell scripts. -Doing print accounting is easy by passing the %U option to a print -command shell script. You could even make the print command detect -the type of output and its size and send it to an appropriate -printer. +You have successfully created the [print$] +share in ? And Samba has re-read its +configuration? Good. But you are not yet ready to take off. The +driver files need to be present in this share, +too! So far it is still an empty share. Unfortunately, it is not enough +to just copy the driver files over. They need to be set +up too. And that is a bit tricky, to say the least. We +will now discuss two alternative ways to install the drivers into +[print$]: - + + +using the Samba commandline utility +rpcclient with its various subcommands (here: +adddriver and setdriver) from +any UNIX workstation; + +running a GUI (Printer +Properties and Add Printer Wizard) +from any Windows NT/2k/XP client workstation. + + + + +The latter option is probably the easier one (even if the only +entrance to this realm seems a little bit weird at first). + -Real debugging +Setting Drivers for existing Printers with a Client GUI + + +The initial listing of printers in the Samba host's +Printers folder accessed from a client's Explorer +will have no real printer driver assigned to them. By default, in +Samba-3 (as in 2.2.1 and later) this driver name is set to a NULL +string. This must be changed now. The local Add Printer +Wizard, run from NT/2000/XP clients, will help us in this +task. + + + +However, the job to set a valid driver for the printer is not a +straightforward one: You must attempt to view the printer properties +for the printer to which you want the driver assigned. Open the +Windows Explorer, open Network Neighbourhood, browse to the Samba +host, open Samba's Printers folder, right-click the printer icon and +select Properties.... You are now trying to view printer and driver +properties for a queue which has this default NULL driver +assigned. This will result in an error message (this is normal here): + + + Device settings cannot be displayed. The driver +for the specified printer is not installed, only spooler properties +will be displayed. Do you want to install the driver +now? -If the above debug tips don't help, then maybe you need to bring in -the bug guns, system tracing. See Tracing.txt in this directory. +Important:Don't click Yes! Instead, +click No in the error dialog. +Only now you will be presented with the printer properties window. From here, +the way to assign a driver to a printer is open to us. You have now the choice +either: + + +select a driver from the pop-up list of installed +drivers. Initially this list will be empty. +Or + +use the New Driver... button to +install a new printer driver (which will in fact start up the +APW). + + + +Once the APW is started, the procedure is exactly the same as the one +you are familiar with in Windows (we assume here that you are +familiar with the printer driver installations procedure on Windows +NT). Make sure your connection is in fact setup as a user with +printer admin privileges (if in doubt, use +smbstatus to check for this). If you wish to +install printer drivers for client operating systems other than +Windows NT x86, you will need to use the +Sharing tab of the printer properties dialog. + + + +Assuming you have connected with an administrative (or root) account +(as named by the printer admin parameter), +you will also be able to modify other printer properties such as ACLs +and default device settings using this dialog. For the default device +settings, please consider the advice given further below. + + + + +Setting Drivers for existing Printers with +<command>rpcclient</command> + + +The second way to install printer drivers into +[print$] and set them up in a valid way can be +done from the UNIX command line. This involves four distinct steps: + + + +gathering the info about the required driver files +and collecting the files together; + +deposit the driver files into the +[print$] share's correct subdirectories +(possibly by using smbclient); + +running the rpcclient +commandline utility once with the adddriver +subcommand, + +running rpcclient a second +time with the setdriver +subcommand. + + + +We will provide detailed hints for each of these steps in the next few +paragraphs. + + + +Identifying the Driver Files + + +To find out about the driver files, you have two options: you could +investigate the driver CD which comes with your printer. Study the +*.inf file on the CD, if it is contained. This +may not be the possible, since the *.inf file might be +missing. Unfortunately, many vendors have now started to use their own +installation programs. These installations packages are often some +sort of Windows platform archive format, plus, the files may get +re-named during the installation process. This makes it extremely +difficult to identify the driver files you need. + + + +Then you only have the second option: install the driver first on a +Windows client *locally* and investigate which file names and paths it +uses after they are installed. (Note, that you need to repeat this +procedure for every client platform you want to support. We are going +to show it here for the W32X86 platform only, a +name used by Microsoft for all WinNT/2k/XP clients...) + + + +A good method to recognize the driver files this is to print the test +page from the driver's Properties Dialog +(General tab). Then look at the list of driver +files named on the printout. You'll need to recognize what Windows +(and Samba) are calling the Driver File , the +Data File, the Config File, +the Help File and (optionally) the +Dependent Driver Files (this may vary slightly +for Windows NT). You need to remember all names (or better take a +note) for the next steps. + + + +Another method to quickly test the driver filenames and related paths +is provided by the rpcclient utility. Run it with +enumdrivers or with the +getdriver subcommand, each in the +3 level. In the following example, +TURBO_XP is the name of the Windows PC (in this +case it was a Windows XP Professional laptop, BTW). I had installed +the driver locally to TURBO_XP while kde-bitshop is +the name of the Linux host from which I am working. We could run an +interactive rpcclient session; +then we'd get an rpcclient /> prompt and would +type the subcommands at this prompt. This is left as a good exercise +to the reader. For now we use rpcclient with the + parameter to execute a single subcommand +line and exit again. This is the method you would use if you want to +create scripts to automate the procedure for a large number of +printers and drivers. Note the different quotes used to overcome the +different spaces in between words: + + + +&rootprompt;rpcclient -U'Danka%xxxx' -c 'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP + cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3 + + [Windows NT x86] + Printer Driver Info 3: + Version: [2] + Driver Name: [Heidelberg Digimaster 9110 (PS)] + Architecture: [Windows NT x86] + Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.DLL] + Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.ppd] + Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.DLL] + Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.HLP] + + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.DLL] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.INI] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1KMMin.DLL] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.dat] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.cat] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.def] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hre] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.vnd] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hlp] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de_reg.HLP] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01Aux.dll] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.NTF] + + Monitorname: [] + Defaultdatatype: [] + + + + +You may notice, that this driver has quite a big number of +Dependentfiles (I know worse cases however). Also, +strangely, the Driver File is here tagged as +Driver Path.... oh, well. Here we don't have yet +support for the so-called WIN40 architecture +installed. This name is used by Microsoft for the Win95/98/ME platforms. +If we want to support these, we need to install the Win95/98/ME driver +files in addition to those for W32X86 +(i.e. the WinNT72000/XP clients) onto a Windows PC. This PC +can also host the Win9x drivers, even if itself runs on Windows NT, +2000 or XP. + + + +Since the [print$] share is usually accessible +through the Network Neighbourhood, you can also use the UNC notation +from Windows Explorer to poke at it. The Win9x driver files will end +up in subdirectory "0" of the "WIN40" directory. The full path to +access them will be +\\WINDOWSHOST\print$\WIN40\0\. + + + more recent drivers on Windows 2000 and Windows XP are +installed into the "3" subdirectory instead of the "2". The version 2 +of drivers, as used in Windows NT, were running in Kernel Mode. +Windows 2000 changed this. While it still can use the Kernel Mode +drivers (if this is enabled by the Admin), its native mode for printer +drivers is User Mode execution. This requires drivers designed for +this. These type of drivers install into the "3" subdirectory. + + + + +Collecting the Driver Files from a Windows Host's +[print$] Share + + +Now we need to collect all the driver files we identified. in our +previous step. Where do we get them from? Well, why not retrieve them +from the very PC and the same [print$] share +which we investigated in our last step to identify the files? We can +use smbclient to do this. We will use the paths and +names which were leaked to us by getdriver. The +listing is edited to include linebreaks for readability: + + + +&rootprompt;smbclient //TURBO_XP/print\$ -U'Danka%xxxx' \ + -c 'cd W32X86/2;mget HD*_de.* \ + hd*ppd Hd*_de.* Hddm*dll HDN*Aux.DLL' + added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 + Got a positive name query response from 10.160.50.8 ( 10.160.50.8 ) + Domain=[DEVELOPMENT] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager] + Get file Hddm91c1_de.ABD? n + Get file Hddm91c1_de.def? y + getting file \W32X86\2\Hddm91c1_de.def of size 428 as Hddm91c1_de.def (22.0 kb/s) (average 22.0 kb/s) + Get file Hddm91c1_de.DLL? y + getting file \W32X86\2\Hddm91c1_de.DLL of size 876544 as Hddm91c1_de.DLL (737.3 kb/s) (average 737.3 kb/s) + [...] + + + + +After this command is complete, the files are in our current local +directory. You probably have noticed that this time we passed several +commands to the parameter, separated by semi-colons. This +effects that all commands are executed in sequence on the remote +Windows server before smbclient exits again. + + + +Don't forget to repeat the procedure for the WIN40 +architecture should you need to support Win95/98/XP clients. Remember, the +files for these architectures are in the WIN40/0/ subdir. Once we are +complete, we can run smbclient ... put to store +the collected files on the Samba server's +[print$] share. + + + + +Depositing the Driver Files into [print$] + + +So, now we are going to put the driver files into the +[print$] share. Remember, the UNIX path to this +share has been defined previously in your +. You also have created subdirectories +for the different Windows client types you want to support. Supposing +your [print$] share maps to the UNIX path +/etc/samba/drivers/, your driver files should now +go here: + + + +for all Windows NT, 2000 and XP clients into +/etc/samba/drivers/W32X86/ but +*not*(yet) into the "2" subdir! + +for all Windows 95, 98 and ME clients into +/etc/samba/drivers/WIN40/ -- but *not* +(yet) into the "0" subdir! + + + +We again use smbclient to transfer the driver files across the +network. We specify the same files and paths as were leaked to us by +running getdriver against the original +Windows install. However, now we are going to +store the files into a Samba/UNIX print server's +[print$] share... + + + +&rootprompt;smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c 'cd W32X86; put HDNIS01_de.DLL; \ + put Hddm91c1_de.ppd; put HDNIS01U_de.DLL; \ + put HDNIS01U_de.HLP; put Hddm91c1_de.DLL; \ + put Hddm91c1_de.INI; put Hddm91c1KMMin.DLL; \ + put Hddm91c1_de.dat; put Hddm91c1_de.dat; \ + put Hddm91c1_de.def; put Hddm91c1_de.hre; \ + put Hddm91c1_de.vnd; put Hddm91c1_de.hlp; \ + put Hddm91c1_de_reg.HLP; put HDNIS01Aux.dll; \ + put HDNIS01_de.NTF' + added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 + Got a positive name query response from 10.160.51.162 ( 10.160.51.162 ) + Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a] + putting file HDNIS01_de.DLL as \W32X86\HDNIS01_de.DLL (4465.5 kb/s) (average 4465.5 kb/s) + putting file Hddm91c1_de.ppd as \W32X86\Hddm91c1_de.ppd (12876.8 kb/s) (average 4638.9 kb/s) + putting file HDNIS01U_de.DLL as \W32X86\HDNIS01U_de.DLL (20249.8 kb/s) (average 5828.3 kb/s) + putting file HDNIS01U_de.HLP as \W32X86\HDNIS01U_de.HLP (9652.8 kb/s) (average 5899.8 kb/s) + putting file Hddm91c1_de.DLL as \W32X86\Hddm91c1_de.DLL (23777.7 kb/s) (average 10400.6 kb/s) + putting file Hddm91c1_de.INI as \W32X86\Hddm91c1_de.INI (98.6 kb/s) (average 10329.0 kb/s) + putting file Hddm91c1KMMin.DLL as \W32X86\Hddm91c1KMMin.DLL (22931.5 kb/s) (average 10501.7 kb/s) + putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (2462.8 kb/s) (average 10393.0 kb/s) + putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (4925.3 kb/s) (average 10356.3 kb/s) + putting file Hddm91c1_de.def as \W32X86\Hddm91c1_de.def (417.9 kb/s) (average 10290.1 kb/s) + putting file Hddm91c1_de.hre as \W32X86\Hddm91c1_de.hre (22571.3 kb/s) (average 11338.5 kb/s) + putting file Hddm91c1_de.vnd as \W32X86\Hddm91c1_de.vnd (3384.6 kb/s) (average 10754.3 kb/s) + putting file Hddm91c1_de.hlp as \W32X86\Hddm91c1_de.hlp (18406.8 kb/s) (average 10839.8 kb/s) + putting file Hddm91c1_de_reg.HLP as \W32X86\Hddm91c1_de_reg.HLP (20278.3 kb/s) (average 11386.3 kb/s) + putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll (14994.6 kb/s) (average 11405.2 kb/s) + putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF (23390.2 kb/s) (average 13170.8 kb/s) + + + + +Phewww -- that was a lot of typing! Most drivers are a lot smaller -- +many only having 3 generic PostScript driver files plus 1 PPD. Note, +that while we did retrieve the files from the "2" subdirectory of the +"W32X86" directory from the Windows box, we don't +put them (for now) in this same subdirectory of the Samba box! This +re-location will automatically be done by the +adddriver command which we will run shortly (and +don't forget to also put the files for the Win95/98/ME architecture +into the WIN40/ subdirectory should you need +them). + + + + +Check if the Driver Files are there (with smbclient) + + +For now we verify that our files are there. This can be done with +smbclient too (but of course you can log in via SSH +also and do this through a standard UNIX shell access too): + + + +&rootprompt;smbclient //SAMBA-CUPS/print\$ -U 'root%xxxx' -c 'cd W32X86; pwd; dir; cd 2; pwd; dir' + added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 + Got a positive name query response from 10.160.51.162 ( 10.160.51.162 ) + Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a] + + Current directory is \\SAMBA-CUPS\print$\W32X86\ + . D 0 Sun May 4 03:56:35 2003 + .. D 0 Thu Apr 10 23:47:40 2003 + 2 D 0 Sun May 4 03:56:18 2003 + HDNIS01Aux.dll A 15356 Sun May 4 03:58:59 2003 + Hddm91c1KMMin.DLL A 46966 Sun May 4 03:58:59 2003 + HDNIS01_de.DLL A 434400 Sun May 4 03:58:59 2003 + HDNIS01_de.NTF A 790404 Sun May 4 03:56:35 2003 + Hddm91c1_de.DLL A 876544 Sun May 4 03:58:59 2003 + Hddm91c1_de.INI A 101 Sun May 4 03:58:59 2003 + Hddm91c1_de.dat A 5044 Sun May 4 03:58:59 2003 + Hddm91c1_de.def A 428 Sun May 4 03:58:59 2003 + Hddm91c1_de.hlp A 37699 Sun May 4 03:58:59 2003 + Hddm91c1_de.hre A 323584 Sun May 4 03:58:59 2003 + Hddm91c1_de.ppd A 26373 Sun May 4 03:58:59 2003 + Hddm91c1_de.vnd A 45056 Sun May 4 03:58:59 2003 + HDNIS01U_de.DLL A 165888 Sun May 4 03:58:59 2003 + HDNIS01U_de.HLP A 19770 Sun May 4 03:58:59 2003 + Hddm91c1_de_reg.HLP A 228417 Sun May 4 03:58:59 2003 + 40976 blocks of size 262144. 709 blocks available + + Current directory is \\SAMBA-CUPS\print$\W32X86\2\ + . D 0 Sun May 4 03:56:18 2003 + .. D 0 Sun May 4 03:56:35 2003 + ADOBEPS5.DLL A 434400 Sat May 3 23:18:45 2003 + laserjet4.ppd A 9639 Thu Apr 24 01:05:32 2003 + ADOBEPSU.DLL A 109568 Sat May 3 23:18:45 2003 + ADOBEPSU.HLP A 18082 Sat May 3 23:18:45 2003 + PDFcreator2.PPD A 15746 Sun Apr 20 22:24:07 2003 + 40976 blocks of size 262144. 709 blocks available + + + + +Notice that there are already driver files present in the +2 subdir (probably from a previous +installation). Once the files for the new driver are there too, you +are still a few steps away from being able to use them on the +clients. The only thing you could do *now* is to retrieve them from a +client just like you retrieve ordinary files from a file share, by +opening print$ in Windows Explorer. But that wouldn't install them per +Point'n'Print. The reason is: Samba doesn't know yet that these files +are something special, namely printer driver +files and it doesn't know yet to which print queue(s) these +driver files belong. + + + + +Running <command>rpcclient</command> with +<command>adddriver</command> + + +So, next you must tell Samba about the special category of the files +you just uploaded into the [print$] share. This +is done by the adddriver command. It will +prompt Samba to register the driver files into its internal TDB +database files. The following command and its output has been edited, +again, for readability: + + + +&rootprompt;rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL: \ + Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP: \ + NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ + Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ + Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ + HDNIS01Aux.dll,HDNIS01_de.NTF, \ + Hddm91c1_de_reg.HLP' SAMBA-CUPS + + cmd = adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL: \ + HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ + Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ + Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ + HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP" + + Printer Driver dm9110 successfully installed. + + + + +After this step the driver should be recognized by Samba on the print +server. You need to be very careful when typing the command. Don't +exchange the order of the fields. Some changes would lead to a +NT_STATUS_UNSUCCESSFUL error +message. These become obvious. Other changes might install the driver +files successfully, but render the driver unworkable. So take care! +Hints about the syntax of the adddriver command are in the man +page. The CUPS printing chapter of this HOWTO collection provides a +more detailed description, if you should need it. + + + + +Check how Driver Files have been moved after +<command>adddriver</command> finished + + +One indication for Samba's recognition of the files as driver files is +the successfully installed message. +Another one is the fact, that our files have been moved by the +adddriver command into the 2 +subdirectory. You can check this again with +smbclient: + + + +&rootprompt;smbclient //SAMBA-CUPS/print\$ -Uroot%xxxx -c 'cd W32X86;dir;pwd;cd 2;dir;pwd' + added interface ip=10.160.51.162 bcast=10.160.51.255 nmask=255.255.252.0 + Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a] + + Current directory is \\SAMBA-CUPS\print$\W32X86\ + . D 0 Sun May 4 04:32:48 2003 + .. D 0 Thu Apr 10 23:47:40 2003 + 2 D 0 Sun May 4 04:32:48 2003 + 40976 blocks of size 262144. 731 blocks available + + Current directory is \\SAMBA-CUPS\print$\W32X86\2\ + . D 0 Sun May 4 04:32:48 2003 + .. D 0 Sun May 4 04:32:48 2003 + DigiMaster.PPD A 148336 Thu Apr 24 01:07:00 2003 + ADOBEPS5.DLL A 434400 Sat May 3 23:18:45 2003 + laserjet4.ppd A 9639 Thu Apr 24 01:05:32 2003 + ADOBEPSU.DLL A 109568 Sat May 3 23:18:45 2003 + ADOBEPSU.HLP A 18082 Sat May 3 23:18:45 2003 + PDFcreator2.PPD A 15746 Sun Apr 20 22:24:07 2003 + HDNIS01Aux.dll A 15356 Sun May 4 04:32:18 2003 + Hddm91c1KMMin.DLL A 46966 Sun May 4 04:32:18 2003 + HDNIS01_de.DLL A 434400 Sun May 4 04:32:18 2003 + HDNIS01_de.NTF A 790404 Sun May 4 04:32:18 2003 + Hddm91c1_de.DLL A 876544 Sun May 4 04:32:18 2003 + Hddm91c1_de.INI A 101 Sun May 4 04:32:18 2003 + Hddm91c1_de.dat A 5044 Sun May 4 04:32:18 2003 + Hddm91c1_de.def A 428 Sun May 4 04:32:18 2003 + Hddm91c1_de.hlp A 37699 Sun May 4 04:32:18 2003 + Hddm91c1_de.hre A 323584 Sun May 4 04:32:18 2003 + Hddm91c1_de.ppd A 26373 Sun May 4 04:32:18 2003 + Hddm91c1_de.vnd A 45056 Sun May 4 04:32:18 2003 + HDNIS01U_de.DLL A 165888 Sun May 4 04:32:18 2003 + HDNIS01U_de.HLP A 19770 Sun May 4 04:32:18 2003 + Hddm91c1_de_reg.HLP A 228417 Sun May 4 04:32:18 2003 + 40976 blocks of size 262144. 731 blocks available + + + + +Another verification is that the timestamp of the printing TDB files +is now updated (and possibly their filesize has increased). + + + + +Check if the Driver is recognized by Samba + + +Now the driver should be registered with Samba. We can easily verify +this, and will do so in a moment. However, this driver is +not yet associated with a particular +printer. We may check the driver status of the +files by at least three methods: + + + +from any Windows client browse Network Neighbourhood, +find the Samba host and open the Samba Printers and +Faxes folder. Select any printer icon, right-click and +select the printer Properties. Click on the +Advanced tab. Here is a field indicating the +driver for that printer. A drop down menu allows you to change that +driver (be careful to not do this unwittingly.). You can use this +list to view all drivers know to Samba. Your new one should be amongst +them. (Each type of client will only see his own architecture's +list. If you don't have every driver installed for each platform, the +list will differ if you look at it from Windows95/98/ME or +WindowsNT/2000/XP.) + +from a Windows 2000 or XP client (not WinNT) browse +Network Neighbourhood, search for the Samba +server and open the server's Printers folder, +right-click the white background (with no printer highlighted). Select +Server Properties. On the +Drivers tab you will see the new driver listed +now. This view enables you to also inspect the list of files belonging +to that driver (this doesn't work on Windows NT, but only on +Windows 2000 and Windows XP. WinNT doesn't provide the "Drivers" +tab).. An alternative, much quicker method for Windows +2000/XP to start this dialog is by typing into a DOS box (you must of +course adapt the name to your Samba server instead of SAMBA-CUPS): + + + rundll32 printui.dll,PrintUIEntry /s /t2 /n\\SAMBA-CUPS + + +from a UNIX prompt run this command (or a variant +thereof), where SAMBA-CUPS is the name of the Samba +host and "xxxx" represents the actual Samba password assigned to root: + + +rpcclient -U'root%xxxx' -c 'enumdrivers' SAMBA-CUPS + + +You will see a listing of all drivers Samba knows about. Your new one +should be amongst them. But it is only listed under the [Windows NT +x86] heading, not under [Windows 4.0], +since we didn't install that part. Or did *you*? -- You will see a listing of +all drivers Samba knows about. Your new one should be amongst them. In our +example it is named dm9110. Note that the 3rd column +shows the other installed drivers twice, for each supported architecture one +time. Our new driver only shows up for +Windows NT 4.0 or 2000. To +have it present for Windows 95, 98 and ME you'll +have to repeat the whole procedure with the WIN40 architecture and subdirectory. + + + + + +A side note: you are not bound to specific driver names + + +You can name the driver as you like. If you repeat the +adddriver step, with the same files as before, but +with a different driver name, it will work the same: + + + +&rootprompt;rpcclient -Uroot%xxxx \ + -c 'adddriver "Windows NT x86" \ + "myphantasydrivername:HDNIS01_de.DLL: \ + Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP: \ + NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ + Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ + Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ + HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP' SAMBA-CUPS + + + cmd = adddriver "Windows NT x86" + "myphantasydrivername:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:\ + HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ + Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ + Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ + HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP" + + Printer Driver myphantasydrivername successfully installed. + + + + +You will also be able to bind that driver to any print queue (however, +you are responsible yourself that you associate drivers to queues +which make sense to the target printer). Note, that you can't run the +rpcclient adddriver command +repeatedly. Each run "consumes" the files you had put into the +[print$] share by moving them into the +respective subdirectories. So you must precede an +smbclient ... put command before each +rpcclient ... adddriver" command. + + + + +La Grande Finale: Running <command>rpcclient</command> with +<command>setdriver</command> + + +Samba still needs to know which printer's driver +this is. It needs to create a mapping of the driver to a printer, and +store this info in its "memory", the TDB files. The rpcclient +setdriver command achieves exactly this: + + + +&rootprompt;rpcclient -U'root%xxxx' -c 'setdriver dm9110 myphantasydrivername' SAMBA-CUPS + cmd = setdriver dm9110 myphantasydrivername + Successfully set dm9110 to driver myphantasydrivername. + + + +Ahhhhh -- no, I didn't want to do that. Repeat, this time with the +name I intended: + + + +&rootprompt;rpcclient -U'root%xxxx' -c 'setdriver dm9110 dm9110' SAMBA-CUPS + cmd = setdriver dm9110 dm9110 + Successfully set dm9110 to driver dm9110. + + + +The syntax of the command is rpcclient +-U'root%sambapassword' -c 'setdriver +"printername" +"drivername' +SAMBA-Hostname . -- +Now we have done *most* of the work. But not yet all.... + + + +the setdriver command will only succeed if the printer is +known to +Samba already. A bug in 2.2.x prevented Samba from recognizing freshly +installed printers. You had to restart Samba, or at least send a HUP +signal to all running smbd processes to work around this: +kill -HUP `pidof smbd`. + + + + + +"The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure) + + +A famous philosopher said once: The Proof of the Pudding lies +in the Eating. The proof for our setup lies in the printing. +So let's install the printer driver onto the client PCs. This is not +as straightforward as it may seem. Read on. + + + +The first Client Driver Installation + + +Especially important is the installation onto the first client PC (for +each architectural platform separately). Once this is done correctly, +all further clients are easy to setup and shouldn't need further +attention. What follows is a description for the recommended first +procedure. You work now from a client workstation. First you should +guarantee that your connection is not unwittingly mapped to +bad user "nobody". In a DOS box type: + + +net use \\SAMBA-SERVER\print$ /user:root + + +Replace root, if needed, by another valid +printer admin user as given in the definition. +Should you already be connected as a different user, you'll get an error +message. There is no easy way to get rid of that connection, because +Windows doesn't seem to know a concept of "logging off" from a share +connection (don't confuse this with logging off from the local +workstation; that is a different matter). You can try to close +all Windows file explorer and Internet Explorer +windows. As a last resort, you may have to reboot. Make sure there is +no automatic re-connection set up. It may be easier to go to a +different workstation and try from there. After you have made sure you +are connected as a printer admin user (you can check this with the +smbstatus command on Samba) do this from the +Windows workstation: + + + +Open Network +Neighbourhood + +Browse to Samba server + +Open its Printers and +Faxes folder + +Highlight and right-click the printer + +Select Connect... (for WinNT4/2K +it is possibly Install...) + + + +A new printer (named printername on +samba-server) should now have appeared in your +local Printer folder (check Start -- +Settings -- Control Panel +-- Printers and Faxes). + + + +Most likely you are now tempted to try and print a test page. After +all, you now can open the printer properties and on the "General" tab, +there is a button offering to do just that. But chances are that you +get an error message saying Unable to print Test +Page. The reason might be that there is not yet a +valid Device Mode set for the driver, or that the "Printer Driver +Data" set is still incomplete. + + + +You must now make sure that a valid "Device Mode" is set for the +driver. Don't fear -- we will explain now what that means. + + + + +IMPORTANT! Setting Device Modes on new Printers + + +In order for a printer to be truly usable by a Windows NT/2K/XP +client, it must possess: + + + +a valid Device Mode generated by +the driver for the printer (defining things like paper size, +orientation and duplex settings), and + +a complete set of +Printer Driver Data generated by the +driver. + + + +If either one of these is incomplete, the clients can produce less +than optimal output at best. In the worst cases, unreadable garbage or +nothing at all comes from the printer or they produce a harvest of +error messages when attempting to print. Samba stores the named values +and all printing related info in its internal TDB database files +(ntprinters.tdb, +ntdrivers.tdb, printing.tdb +and ntforms.tdb). + + + +What do these two words stand for? Basically, the Device Mode and the +set of Printer Driver Data is a collection of settings for all print +queue properties, initialized in a sensible way. Device Modes and +Printer Driver Data should initially be set on the print server (that is +here: the Samba host) to healthy values so that the clients can start +to use them immediately. How do we set these initial healthy values? +This can be achieved by accessing the drivers remotely from an NT (or +2k/XP) client, as is discussed in the next paragraphs. + + + +Be aware, that a valid Device Mode can only be initiated by a +printer admin, or root (the reason should be +obvious). Device Modes can only correctly be set by executing the +printer driver program itself. Since Samba can not execute this Win32 +platform driver code, it sets this field initially to NULL (which is +not a valid setting for clients to use). Fortunately, most drivers +generate themselves the Printer Driver Data that is needed, when they +are uploaded to the [print$] share with the +help of the APW or rpcclient. + + + +The generation and setting of a first valid Device Mode however +requires some "tickling" from a client, to set it on the Samba +server. The easiest means of doing so is to simply change the page +orientation on the server's printer. This "executes" enough of the +printer driver program on the client for the desired effect to happen, +and feeds back the new Device Mode to our Samba server. You can use the +native Windows NT/2K/XP printer properties page from a Window client +for this: + + + + Browse the Network Neighbourhood + +Find the Samba server + +Open the Samba server's Printers and + Faxes folder + +Highlight the shared printer in question + +Right-click the printer (you may already be here, if you +followed the last section's description) + +At the bottom of the context menu select +Properties.... (if the menu still offers the +Connect... entry +further above, you need to click that one first to achieve the driver +installation as shown in the last section) + +Go to the Advanced tab; click on +Printing Defaults... + +Change the "Portrait" page setting to "Landscape" (and +back) + +(Oh, and make sure to apply +changes between swapping the page orientation to cause the change to +actually take effect...). + +While you're at it, you may optionally also want to +set the desired printing defaults here, which then apply to all future +client driver installations on the remaining from now +on. + + + +This procedure has executed the printer driver program on the client +platform and fed back the correct Device Mode to Samba, which now +stored it in its TDB files. Once the driver is installed on the +client, you can follow the analogous steps by accessing the +local Printers folder too if you are +a Samba printer admin user. From now on printing should work as expected. + + + +Samba also includes a service level parameter name default +devmode for generating a default Device Mode for a +printer. Some drivers will function well with Samba's default set of +properties. Others may crash the client's spooler service. So use this +parameter with caution. It is always better to have the client +generate a valid device mode for the printer and store it on the +server for you. + + + + +Further Client Driver Install Procedures + + +Every further driver may be done by any user, along the lines +described above: Browse network, open printers folder on Samba server, +right-click printer and choose Connect.... Once +this completes (should be not more than a few seconds, but could also take +a minute, depending on network conditions), you should find the new printer in +your client workstation local Printers and +Faxes folder. + + + +You can also open your local Printers and Faxes folder by +using this command on Windows 2000 and Windows XP Professional workstations: + + +rundll32 shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder + + + +or this command on Windows NT 4.0 workstations: + + + +rundll32 shell32.dll,Control_RunDLL MAIN.CPL @2 + + + +You can enter the commands either inside a DOS box window +or in the Run command... field from the +Start menu. + + + + +Always make first Client Connection as root or "printer admin" + + +After you installed the driver on the Samba server (in its +[print$] share, you should always make sure +that your first client installation completes correctly. Make it a habit for +yourself to build that the very first connection from a client as +printer admin. This is to make sure that: + + + + + a first valid Device Mode is +really initialized (see above for more explanation details), and +that + + the default print settings of your printer for all +further client installations are as you want them + + + +Do this by changing the orientation to landscape, click +Apply, and then change it back again. Then modify +the other settings (for example, you don't want the default media size +set to Letter, when you are all using +A4, right? You may want to set the printer for +duplex as the default; etc.). + + + +To connect as root to a Samba printer, try this command from a Windows +2K/XP DOS box command prompt: + + +runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n \\SAMBA-SERVER\printername" + + + +You will be prompted for root's Samba-password; type it, wait a few +seconds, click on Printing Defaults... and +proceed to set the job options as should be used as defaults by all +clients. Alternatively, instead of root you can name one other member +of the printer admins from the setting. + + + +Now all the other users downloading and installing the driver +the same way (called Point'n'Print) will +have the same defaults set for them. If you miss this step you'll +get a lot of helpdesk calls from your users. But maybe you like to +talk to people.... ;-) + + + + + +Other Gotchas + + +Your driver is installed. It is ready for +Point'n'Print installation by the clients +now. You may have tried to download and use it +onto your first client machine now. But wait... let's make you +acquainted first with a few tips and tricks you may find useful. For +example, suppose you didn't manage to "set the defaults" on the +printer, as advised in the preceding paragraphs? And your users +complain about various issues (such as We need to set the paper +size for each job from Letter to A4 and it won't store it!) + + + +Setting Default Print Options for the Client Drivers + + +The last sentence might be viewed with mixed feelings by some users and +admins. They have struggled for hours and hours and couldn't arrive at +a point were their settings seemed to be saved. It is not their +fault. The confusing thing is this: in the multi-tabbed dialog that pops +up when you right-click the printer name and select +Properties..., you can arrive at two identically +looking dialogs, each claiming that they help you to set printer options, +in three different ways. Here is the definite answer to the "Samba +Default Driver Setting FAQ": + + +<quote>I can't set and save default print options +for all users on Win2K/XP! Why not?</quote> + + +How are you doing it? I bet the wrong way.... (it is not very +easy to find out, though). There are 3 different ways to bring you to +a dialog that seems to set everything. All three +dialogs look the same. Only one of them +does what you intend. +Important: you need to be Administrator or Print +Administrator to do this for all users. Here is how I reproduce it in +on XP Professional: + + + +The first "wrong" way: + + +Open the Printers +folder. + +Right-click on the printer +(remoteprinter on cupshost) and +select in context menu Printing +Preferences... + +Look at this dialog closely and remember what it looks +like. + + + + +The second "wrong" way: + + + Open the Printers +folder. + +Right-click on the printer (remoteprinter on +cupshost) and select in the context menu +Properties + +Click on the General +tab + +Click on the button Printing +Preferences... + +A new dialog opens. Keep this dialog open and go back +to the parent dialog. + + + + +The third, the "correct" way: (should you do +this from the beginning, just carry out steps 1. and 2. from second +"way" above) + + +Click on the Advanced +tab. (Hmmm... if everything is "Grayed Out", then you are not logged +in as a user with enough privileges). + +Click on the Printing +Defaults... button. + +On any of the two new tabs, click on the +Advanced... button. + +A new dialog opens. Compare this one to the other, +identical looking one from "B.5" or A.3". + + + + + +Do you see any difference in the two settings dialogs? I don't +either. However, only the last one, which you arrived at with steps +C.1.-6. will permanently save any settings which will then become the +defaults for new users. If you want all clients to have the same +defaults, you need to conduct these steps as administrator +(printer admin in ) +before a client downloads the driver (the clients +can later set their own per-user defaults by +following the procedures A. +or B. above...). (This is new: Windows 2000 and +Windows XP allow per-user default settings and +the ones the administrator gives them, before they set up their own). +The "parents" of the identically looking dialogs have a slight +difference in their window names: one is called +Default Print Values for Printer Foo on Server +Bar" (which is the one you need) and the other is +called "Print Settings for Printer Foo on Server +Bar". The last one is the one you arrive at when you +right-click on the printer and select Print +Settings.... This is the one what you were +taught to use back in the days of Windows NT! So it is only natural to +try the same way with Win2k or WinXP. You wouldn't dream +that there is now a different "clicking path" to arrive at an +identically looking, but functionally different dialog to set defaults +for all users! + + +Try (on Win2000 and WinXP) to run this command (as a user +with the right privileges): + + + +rundll32 printui.dll,PrintUIEntry /p /t3 /n\\SAMBA-SERVER\printersharename + + + +to see the tab with the Printing Defaults... +button (the one you need). Also run this command: + + + +rundll32 printui.dll,PrintUIEntry /p /t0 /n\\SAMBA-SERVER\printersharename + + + +to see the tab with the Printing Preferences... +button (the one which doesn't set system-wide defaults). You can +start the commands from inside a DOS box" or from the Start +-- Run... menu. + + + + + + +Supporting large Numbers of Printers + + +One issue that has arisen during the recent development phase of Samba +is the need to support driver downloads for 100's of printers. Using +Windows NT APW here is somewhat awkward (to say the least). If you +don't want to acquire RSS pains from such the printer installation +clicking orgy alone, you need to think about a non-interactive script. + + + +If more than one printer is using the same driver, the +rpcclient setdriver command can be used to set the +driver associated with an installed queue. If the driver is uploaded +to [print$] once and registered with the +printing TDBs, it can be used by multiple print queues. In this case +you just need to repeat the setprinter subcommand +of rpcclient for every queue (without the need to +conduct the adddriver again and again). The +following is an example of how this could be accomplished: + + + +&rootprompt;rpcclient SAMBA-CUPS -U root%secret -c 'enumdrivers' + cmd = enumdrivers + + [Windows NT x86] + Printer Driver Info 1: + Driver Name: [infotec IS 2075 PCL 6] + + Printer Driver Info 1: + Driver Name: [DANKA InfoStream] + + Printer Driver Info 1: + Driver Name: [Heidelberg Digimaster 9110 (PS)] + + Printer Driver Info 1: + Driver Name: [dm9110] + + Printer Driver Info 1: + Driver Name: [myphantasydrivername] + + [....] + + + +&rootprompt;rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters' + cmd = enumprinters + flags:[0x800000] + name:[\\SAMBA-CUPS\dm9110] + description:[\\SAMBA-CUPS\dm9110,,110ppm HiVolume DANKA Stuttgart] + comment:[110 ppm HiVolume DANKA Stuttgart] + [....] + + + +&rootprompt;rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 "Heidelberg Digimaster 9110 (PS)"' + cmd = setdriver dm9110 Heidelberg Digimaster 9110 (PPD) + Successfully set dm9110 to driver Heidelberg Digimaster 9110 (PS). + + + +&rootprompt;rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters' + cmd = enumprinters + flags:[0x800000] + name:[\\SAMBA-CUPS\dm9110] + description:[\\SAMBA-CUPS\dm9110,Heidelberg Digimaster 9110 (PS),110ppm HiVolume DANKA Stuttgart] + comment:[110ppm HiVolume DANKA Stuttgart] + [....] + + + +&rootprompt;rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 myphantasydrivername' + cmd = setdriver dm9110 myphantasydrivername + Successfully set dm9110 to myphantasydrivername. + + + +&rootprompt;rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters' + cmd = enumprinters + flags:[0x800000] + name:[\\SAMBA-CUPS\dm9110] + description:[\\SAMBA-CUPS\dm9110,myphantasydrivername,110ppm HiVolume DANKA Stuttgart] + comment:[110ppm HiVolume DANKA Stuttgart] + [....] + + + +It may be not easy to recognize: but the first call to +enumprinters showed the "dm9110" printer with an +empty string where the driver should have been listed (between the 2 +commas in the "description" field). After the +setdriver command succeeded, all is well. (The +CUPS Printing chapter has more info about the installation of printer +drivers with the help of rpcclient). + + + + +Adding new Printers with the Windows NT APW + + +By default, Samba exhibits all printer shares defined in +&smb.conf; in the +Printers... folder. Also located in this folder +is the Windows NT Add Printer Wizard icon. The APW will be shown only +if: + + + +...the connected user is able to successfully execute +an OpenPrinterEx(\\server) with administrative +privileges (i.e. root or printer admin). + + + Try this from a Windows 2K/XP DOS box command prompt: + + + +runas /netonly /user:root rundll32 printui.dll,PrintUIEntry /p /t0 /n \\SAMBA-SERVER\printersharename + + + +and click on Printing Preferences... + + +... contains the setting +show add printer wizard = yes (the +default). + + + +The APW can do various things: + + + +upload a new driver to the Samba +[print$] share; + +associate an uploaded driver with an existing (but +still "driverless") print queue; + +exchange the currently used driver for an existing +print queue with one that has been uploaded before; + +add an entirely new printer to the Samba host (only in +conjunction with a working add printer command; +a corresponding delete printer command for +removing entries from the Printers... folder +may be provided too) + + + +The last one (add a new printer) requires more effort than the +previous ones. In order to use the APW to successfully add a printer +to a Samba server, the add printer command must +have a defined value. The program hook must successfully add the +printer to the Unix print system (i.e. to +/etc/printcap, +/etc/cups/printers.conf or other appropriate +files) and to if necessary. + + + +When using the APW from a client, if the named printer share does not +exist, smbd will execute the add printer +command and reparse to the +to attempt to locate the new printer share. If the share is still not +defined, an error of Access Denied is +returned to the client. Note that the add printer +command is executed under the context of the connected +user, not necessarily a root account. A map to guest = bad +user may have connected you unwittingly under the wrong +privilege; you should check it by using the +smbstatus command. + + + + +Weird Error Message <errorname>Cannot connect under a +different Name</errorname> + + +Once you are connected with the wrong credentials, there is no means +to reverse the situation other than to close all Explorer windows, and +perhaps reboot. + + + +The net use \\SAMBA-SERVER\sharename +/user:root gives you an error message: Multiple +connections to a server or a shared resource by the same user +utilizing the several user names are not allowed. Disconnect all +previous connections to the server, resp. the shared resource, and try +again. + +Every attempt to "connect a network drive" to +\\SAMBASERVER\\print$ to z: is countered by the +pertinacious message. This network folder is currently +connected under different credentials (username and password). +Disconnect first any existing connection to this network share in +order to connect again under a different username and +password. + + + +So you close all connections. You try again. You get the same +message. You check from the Samba side, using +smbstatus. Yes, there are some more +connections. You kill them all. The client still gives you the same +error message. You watch the smbd.log file on a very high debug level +and try re-connect. Same error message, but not a single line in the +log. You start to wonder if there was a connection attempt at all. You +run ethereal and tcpdump while you try to connect. Result: not a +single byte goes on the wire. Windows still gives the error +message. You close all Explorer Windows and start it again. You try to +connect - and this times it works! Windows seems to cache connection +info somewhere and doesn't keep it up to date (if you are unlucky you +might need to reboot to get rid of the error message). + + + + +Be careful when assembling Driver Files + + +You need to be very careful when you take notes about the files and +belonging to a particular driver. Don't confuse the files for driver +version "0" (for Win95/98/ME, going into +[print$]/WIN/0/), driver version "2" (Kernel Mode +driver for WinNT, going into [print$]/W32X86/2/ +may be used on Win2K/XP too), and driver version +"3" (non-Kernel Mode driver going into +[print$]/W32X86/3/ can not +be used on WinNT). Very often these different driver versions contain +files carrying the same name; but still the files are very different! +Also, if you look at them from the Windows Explorer (they reside in +%WINDOWS%\system32\spool\drivers\W32X86\) you +will probably see names in capital letters, while an "enumdrivers" +command from Samba would show mixed or lower case letters. So it is +easy to confuse them. If you install them manually using +rpcclient and subcommands, you may even succeed +without an error message. Only later, when you try install on a +client, you will encounter error messages like This +server has no appropriate driver for the printer. + + + +Here is an example. You are invited to look very closely at the +various files, compare their names and their spelling, and discover +the differences in the composition of the version-2 and -3 sets +Note: the version-0 set contained 40 (!) +Dependentfiles, so I left it out for space +reasons: + + + +&rootprompt;rpcclient -U 'Administrator%secret' -c 'enumdrivers 3' 10.160.50.8 + + Printer Driver Info 3: + Version: [3] + Driver Name: [Canon iR8500 PS3] + Architecture: [Windows NT x86] + Driver Path: [\\10.160.50.8\print$\W32X86\3\cns3g.dll] + Datafile: [\\10.160.50.8\print$\W32X86\3\iR8500sg.xpd] + Configfile: [\\10.160.50.8\print$\W32X86\3\cns3gui.dll] + Helpfile: [\\10.160.50.8\print$\W32X86\3\cns3g.hlp] + + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\aucplmNT.dll] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\ucs32p.dll] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\tnl32.dll] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\aussdrv.dll] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cnspdc.dll] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\aussapi.dat] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cns3407.dll] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\CnS3G.cnt] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\NBAPI.DLL] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\NBIPC.DLL] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcview.exe] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcdspl.exe] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcedit.dll] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcqm.exe] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcspl.dll] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cfine32.dll] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcr407.dll] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\Cpcqm407.hlp] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcqm407.cnt] + Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cns3ggr.dll] + + Monitorname: [] + Defaultdatatype: [] + + Printer Driver Info 3: + Version: [2] + Driver Name: [Canon iR5000-6000 PS3] + Architecture: [Windows NT x86] + Driver Path: [\\10.160.50.8\print$\W32X86\2\cns3g.dll] + Datafile: [\\10.160.50.8\print$\W32X86\2\IR5000sg.xpd] + Configfile: [\\10.160.50.8\print$\W32X86\2\cns3gui.dll] + Helpfile: [\\10.160.50.8\print$\W32X86\2\cns3g.hlp] + + Dependentfiles: [\\10.160.50.8\print$\W32X86\2\AUCPLMNT.DLL] + Dependentfiles: [\\10.160.50.8\print$\W32X86\2\aussdrv.dll] + Dependentfiles: [\\10.160.50.8\print$\W32X86\2\cnspdc.dll] + Dependentfiles: [\\10.160.50.8\print$\W32X86\2\aussapi.dat] + Dependentfiles: [\\10.160.50.8\print$\W32X86\2\cns3407.dll] + Dependentfiles: [\\10.160.50.8\print$\W32X86\2\CnS3G.cnt] + Dependentfiles: [\\10.160.50.8\print$\W32X86\2\NBAPI.DLL] + Dependentfiles: [\\10.160.50.8\print$\W32X86\2\NBIPC.DLL] + Dependentfiles: [\\10.160.50.8\print$\W32X86\2\cns3gum.dll] + + Monitorname: [CPCA Language Monitor2] + Defaultdatatype: [] + + + + +If we write the "version 2" files and the "version 3" files +into different text files and compare the result, we see this +picture: + + + +&rootprompt;sdiff 2-files 3-files + + ucs32p.dll + > tnl32.dll + aussdrv.dll aussdrv.dll + cnspdc.dll cnspdc.dll + aussapi.dat aussapi.dat + cns3407.dll cns3407.dll + CnS3G.cnt CnS3G.cnt + NBAPI.DLL NBAPI.DLL + NBIPC.DLL NBIPC.DLL + cns3gum.dll | cpcview.exe + > cpcdspl.exe + > cpcqm.exe + > cpcspl.dll + > cfine32.dll + > cpcr407.dll + > Cpcqm407.hlp + > cpcqm407.cnt + > cns3ggr.dll +]]> + + + +Don't be fooled though! Driver files for each version with identical +names may be different in their content, as you can see from this size +comparison: + + + +&rootprompt;for i in cns3g.hlp cns3gui.dll cns3g.dll; do \ + smbclient //10.160.50.8/print\$ -U 'Administrator%xxxx' \ + -c "cd W32X86/3; dir $i; cd .. ; cd 2; dir $i"; \ + done + + CNS3G.HLP A 122981 Thu May 30 02:31:00 2002 + CNS3G.HLP A 99948 Thu May 30 02:31:00 2002 + + CNS3GUI.DLL A 1805824 Thu May 30 02:31:00 2002 + CNS3GUI.DLL A 1785344 Thu May 30 02:31:00 2002 + + CNS3G.DLL A 1145088 Thu May 30 02:31:00 2002 + CNS3G.DLL A 15872 Thu May 30 02:31:00 2002 + + + + +In my example were even more differences than shown here. Conclusion: +you must be very careful to select the correct driver files for each +driver version. Don't rely on the names alone. Don't interchange files +belonging to different driver versions. + + + + +Samba and Printer Ports + + +Windows NT/2000 print servers associate a port with each +printer. These normally take the form of LPT1:, +COM1:, FILE:, etc. Samba +must also support the concept of ports associated with a printer. By +default, only one printer port, named "Samba Printer Port", exists on +a system. Samba does not really need such a "port" in order to print; +it rather is a requirement of Windows clients. They insist on being +told about an available port when they request this info, otherwise +they throw an error message at you. So Samba fakes the port +information to keep the Windows clients happy. + + + +Note that Samba does not support the concept of "Printer Pooling" +internally either. Printer Pooling assigns a logical printer to +multiple ports as a form of load balancing or fail over. + + + +If you require that multiple ports be defined for some reason or +another (My users and my Boss should not know that they are +working with Samba), possesses a +enumports command which can be used to define +an external program that generates a listing of ports on a system. + + + + +Avoiding the most common Misconfigurations of the Client Driver + + +So - printing works, but there are still problems. Most jobs print +well, some don't print at all. Some jobs have problems with fonts, +which don't look good at all. Some jobs print fast, and some are +dead-slow. We can't cover it all; but we want to encourage you to read +the little paragraph about "Avoiding the wrong PostScript Driver +Settings" in the CUPS Printing part of this document. + + + + + +The Imprints Toolset + + +The Imprints tool set provides a UNIX equivalent of the +Windows NT Add Printer Wizard. For complete information, please +refer to the Imprints web site +athttp://imprints.sourceforge.net/ +as well as the documentation included with the imprints source +distribution. This section will only provide a brief introduction +to the features of Imprints. + + +Attention! Maintainer required + + +Unfortunately, the Imprints toolset is no longer maintained. As of +December, 2000, the project is in need of a new maintainer. The most +important skill to have is decent perl coding and an interest in +MS-RPC based printing using Samba. If you wish to volunteer, please +coordinate your efforts on the samba-technical mailing list. The +toolset is still in usable form; but only for a series of older +printer models, where there are prepared packages to use. Packages for +more up to date print devices are needed if Imprints should have a +future. + + +What is Imprints? + + +Imprints is a collection of tools for supporting these goals: + + + +Providing a central repository information regarding +Windows NT and 95/98 printer driver packages + +Providing the tools necessary for creating the +Imprints printer driver packages. + +Providing an installation client which will obtain +printer drivers from a central internet (or intranet) Imprints Server +repository and install them on remote Samba and Windows NT4 print +servers. + + + + +Creating Printer Driver Packages + + +The process of creating printer driver packages is beyond the scope of +this document (refer to Imprints.txt also included with the Samba +distribution for more information). In short, an Imprints driver +package is a gzipped tarball containing the driver files, related INF +files, and a control file needed by the installation client. + + + + +The Imprints Server + + +The Imprints server is really a database server that may be queried +via standard HTTP mechanisms. Each printer entry in the database has +an associated URL for the actual downloading of the package. Each +package is digitally signed via GnuPG which can be used to verify that +package downloaded is actually the one referred in the Imprints +database. It is strongly recommended that this security check +not be disabled. + + + + +The Installation Client + + +More information regarding the Imprints installation client is +available in the Imprints-Client-HOWTO.ps file +included with the imprints source package. + + + +The Imprints installation client comes in two forms. + + +a set of command line Perl scripts + +a GTK+ based graphical interface to the command line Perl +scripts + + + +The installation client (in both forms) provides a means of querying +the Imprints database server for a matching list of known printer +model names as well as a means to download and install the drivers on +remote Samba and Windows NT print servers. + + + +The basic installation process is in four steps and perl code is +wrapped around smbclient and rpcclient + + + + + foreach (supported architecture for a given driver) + + rpcclient: Get the appropriate upload directory on the remote server + smbclient: Upload the driver files + rpcclient: Issues an AddPrinterDriver() MS-RPC + + + + rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer + + + +One of the problems encountered when implementing the Imprints tool +set was the name space issues between various supported client +architectures. For example, Windows NT includes a driver named "Apple +LaserWriter II NTX v51.8" and Windows 95 calls its version of this +driver "Apple LaserWriter II NTX" + + + +The problem is how to know what client drivers have been uploaded for +a printer. An astute reader will remember that the Windows NT Printer +Properties dialog only includes space for one printer driver name. A +quick look in the Windows NT 4.0 system registry at + + + + HKLM\System\CurrentControlSet\Control\Print\Environment + + + +will reveal that Windows NT always uses the NT driver name. This is +ok as Windows NT always requires that at least the Windows NT version +of the printer driver is present. However, Samba does not have the +requirement internally. Therefore, how can you use the NT driver name +if is has not already been installed? + + + +The way of sidestepping this limitation is to require that all +Imprints printer driver packages include both the Intel Windows NT and +95/98 printer drivers and that NT driver is installed first. + + + + + +Add Network Printers at Logon without User Interaction + + +The following MS Knowledge Base article may be of some help if you +need to handle Windows 2000 clients: How to Add Printers +with No User Interaction in Windows 2000. ( http://support.microsoft.com/default.aspx?scid=kb;en-us;189105 +). It also applies to Windows XP Professional clients. + + + +The ideas sketched out below are inspired by this article. It +describes a commandline method which can be applied to install +network and local printers and their drivers. This is most useful +if integrated in Logon Scripts. You can see what options are +available by typing in a command prompt ("DOS box") this: + + +rundll32 printui.dll,PrintUIEntry /? + + +A window pops up which shows you all of the commandline switches +available. An extensive list of examples is also provided. This is +only for Win 2k/XP. It doesn't work on WinNT. WinNT has probably some +other tools in the respective Resource Kit. Here is a suggestion about +what a client logon script might contain, with a short explanation of +what the lines actually do (it works if 2k/XP Windows clients access +printers via Samba, but works for Windows-based print servers too): + + + +rundll32 printui.dll,PrintUIEntry /dn /n "\\sambacupsserver\infotec2105-IPDS" /q +rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\infotec2105-PS" +rundll32 printui.dll,PrintUIEntry /y /n "\\sambacupsserver\infotec2105-PS" + + + +Here is a list of the used commandline parameters: + + + +/dn +deletes a network printer + +/q +quiet modus + +/n +names a printer + +/in +adds a network printer connection + +/y +sets printer as default printer + + + + +I have tested this with a Samba 2.2.7a and a Samba-3alpha24 +installation and Windows XP Professional clients. Note that this +specific command set works with network print queues (installing +local print queues requires different parameters, but this is of no +interest here). + + + +Line 1 deletes a possibly existing previous network +printer infotec2105-IPDS (which had used native +Windows drivers with LPRng that were removed from the server which was +converted to CUPS). The /q at the end eliminates +"Confirm" or error dialog boxes popping up. They should not be +presented to the user logging on. + +Line 2 adds the new printer +infotec2105-PS (which actually is same physical +device but is now run by the new CUPS printing system and associated +with the CUPS/Adobe PS drivers). The printer and its driver +must have been added to Samba prior to the user +logging in (e.g. by a procedure as discussed earlier in this chapter, +or by running cupsaddsmb). The driver is now +auto-downloaded to the client PC where the user is about to log +in. + +Line 3 sets the default printer to this new network +printer (there might be several other printers installed with this +same method and some may be local as well -- so we decide for a +default printer). The default printer selection may of course be +different for different users. + + + +Note that the second line only works if the printer +infotec2105-PS has an already working print queue +on "sambacupsserver", and if the printer drivers have successfully been +uploaded (via APW , +smbclient/rpcclient or +cupsaddsmb) into the +[print$] driver repository of Samba. Also, some +Samba versions prior to version 3.0 required a re-start of smbd after +the printer install and the driver upload, otherwise the script (or +any other client driver download) would fail. + + + +Since there no easy way to test for the existence of an installed +network printer from the logon script, the suggestion is: don't bother +checking and just allow the deinstallation/reinstallation to occur +every time a user logs in; it's really quick anyway (1 to 2 seconds). + + + +The additional benefits for this are: + + + +It puts in place any printer default setup changes +automatically at every user logon. + +It allows for "roaming" users' login into the domain from +different workstations. + + + +Since network printers are installed per user this much simplifies the +process of keeping the installation up-to-date. The extra few seconds +at logon time will not really be noticeable. Printers can be centrally +added, changed, and deleted at will on the server with no user +intervention required on the clients (you just need to keep the logon +scripts up to date). + + + + +The <command>addprinter</command> command + + +The addprinter command can be configured to be a +shell script or program executed by Samba. It is triggered by running +the APW from a client against the Samba print server. The APW asks the +user to fill in several fields (such as printer name, driver to be +used, comment, port monitor, etc.). These parameters are passed on to +Samba by the APW. If the addprinter command is designed in a way that +it can create a new printer (through writing correct printcap entries +on legacy systems, or execute the lpadmin command +on more modern systems) and create the associated share in +, then the APW will in effect really +create a new printer on Samba and the UNIX print subsystem! + + + + +Migration of "Classical" printing to Samba-3 + + +The basic "NT-style" printer driver management has not changed +considerably in 3.0 over the 2.2.x releases (apart from many small +improvements). Here migration should be quite easy, especially if you +followed previous advice to stop using deprecated parameters in your +setup. For migrations from an existing 2.0.x setup, or if you +continued "Win9x-style" printing in your Samba 2.2 installations, it +is more of an effort. Please read the appropriate release notes and +the HOWTO Collection for 2.2. You can follow several paths. Here are +possible scenarios for migration: + + + +You need to study and apply the new Windows NT printer +and driver support. Previously used parameters "printer +driver file", " printer driver" and +"printer driver location" are no longer +supported. + +If you want to take advantage of WinNT printer driver +support you also need to migrate the Win9x/ME drivers to the new +setup. + +An existing printers.def file +(the one specified in the now removed parameter printer +driver file = ...) will work no longer with Samba-3.0. In +3.0, smbd attempts to locate a Win9x/ME driver files for the printer +in [print$] and additional settings in the TDB +and only there; if it fails it will not (as 2.2.x +used to do) drop down to using a printers.def +(and all associated parameters). The make_printerdef tool is removed +and there is no backwards compatibility for this. + +You need to install a Windows 9x driver into the +[print$] share for a printer on your Samba +host. The driver files will be stored in the "WIN40/0" subdirectory of +[print$], and some other settings and info go +into the printing-related TDBs. + +If you want to migrate an existing +printers.def file into the new setup, the current +only solution is to use the Windows NT APW to install the NT drivers +and the 9x drivers. This can be scripted using smbclient and +rpcclient. See the Imprints installation client at: + + + +http://imprints.sourceforge.net/ + + + +for an example. See also the discussion of rpcclient usage in the +"CUPS Printing" section. + + + + +Publishing Printer Information in Active Directory or LDAP + + +We will publish an update to this section shortly. + + + + +Common Errors and Problems + + +Here are a few typical errors and problems people have +encountered. You can avoid them. Read on. + + + +I give my root password but I don't get access + + +Don't confuse the root password which is valid for the Unix system +(and in most cases stored in the form of a one-way hash in a file +named /etc/shadow) with the password used to +authenticate against Samba!. Samba doesn't know the UNIX password; for +root to access Samba resources via Samba-type access, a Samba account +for root must be created first. This is often done with the +smbpasswd command. + + + + +My printjobs get spooled into the spooling directory, but then get lost + + +Don't use the existing Unix print system spool directory for the Samba +spool directory. It may seem convenient and a saving of space, but it +only leads to problems. The two must be separate. + + diff --git a/docs/docbook/projdoc/samba-doc.xml b/docs/docbook/projdoc/samba-doc.xml index a4394d263f..91002c9133 100644 --- a/docs/docbook/projdoc/samba-doc.xml +++ b/docs/docbook/projdoc/samba-doc.xml @@ -9,10 +9,6 @@ - - SAMBA Team -
samba@samba.org
 - &person.jelmer; &person.jht; &person.jerry; @@ -28,7 +24,7 @@ The most recent version of this document can be found at http://www.samba.org/ on the "Documentation" page. Please send updates to Jelmer Vernooij, -John H Terpstra or +John H. Terpstra or Gerald (Jerry) Carter. @@ -38,7 +34,7 @@ or without their knowledge contributed to this update. The size and scope of thi project would not have been possible without significant community contribution. A not insignificant number of ideas for inclusion (if not content itself) has been obtained from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. -Please keep publishing your Unofficial HOWTO's - they are a source of inspiration and +Please keep publishing your Unofficial HOWTOs - they are a source of inspiration and application knowledge that is most to be desired by many Samba users and administrators. @@ -50,6 +46,14 @@ version 2. A copy of the license is included with the Samba source distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt + + + Attributions + + &attributions; + + + @@ -67,6 +71,7 @@ PLEASE read this. &IntroSMB; &UNIX-INSTALL; +&FastStart; @@ -84,6 +89,7 @@ section carefully. &Samba-BDC-HOWTO; &DOMAIN-MEMBER; &StandAloneServer; +&ClientConfig; @@ -112,6 +118,15 @@ Samba has several features that you might want or might not want to use. The cha &Samba-PAM; &IntegratingWithWindows; &unicode; +&Backup; +&HighAvailability; + + + +Migration and Updating +&upgrading; +&NT4Migration; +&SWAT; @@ -124,12 +139,13 @@ Samba has several features that you might want or might not want to use. The cha Appendixes &Compiling; -&NT4Migration; &Portability; &Other-Clients; -&SWAT; &SPEED; +&DNS-DHCP-Configuration; &Further-Resources; + + diff --git a/docs/docbook/projdoc/securing-samba.xml b/docs/docbook/projdoc/securing-samba.xml index 204fceeb4a..bed4e4ee56 100644 --- a/docs/docbook/projdoc/securing-samba.xml +++ b/docs/docbook/projdoc/securing-samba.xml @@ -3,7 +3,7 @@ &author.tridge; &author.jht; - 17 March 2003 + May 26, 2003 Securing Samba @@ -16,209 +16,354 @@ important security fix. The information contained here applies to Samba installations in general. - - - -Using host based protection - -In many installations of Samba the greatest threat comes for outside -your immediate network. By default Samba will accept connections from -any host, which means that if you run an insecure version of Samba on -a host that is directly connected to the Internet you can be -especially vulnerable. +A new apprentice reported for duty to the Chief Engineer of a boiler house. He said, "Here I am, +if you will show me the boiler I'll start working on it." Then engineer replied, "You're leaning +on it!" -One of the simplest fixes in this case is to use the hosts allow and -hosts deny options in the Samba &smb.conf; configuration file to only -allow access to your server from a specific range of hosts. An example -might be: - - - - hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24 - hosts deny = 0.0.0.0/0 - - - -The above will only allow SMB connections from 'localhost' (your own -computer) and from the two private networks 192.168.2 and -192.168.3. All other connections will be refused as soon -as the client sends its first packet. The refusal will be marked as a -'not listening on called name' error. +Security concerns are just like that: You need to know a little about the subject to appreciate +how obvious most of it really is. The challenge for most of us is to discover that first morsel +of knowledge with which we may unlock the secrets of the masters. -User based protection +Features and Benefits -If you want to restrict access to your server to valid users only then the following -method may be of use. In the smb.conf [globals] section put: +There are three level at which security principals must be observed in order to render a site +at least moderately secure. These are: the perimeter firewall, the configuration of the host +server that is running Samba, and Samba itself. - - valid users = @smbusers, jacko - - -What this does is, it restricts all server access to either the user jacko -or to members of the system group smbusers. +Samba permits a most flexible approach to network security. As far as possible Samba implements +the latest protocols to permit more secure MS Windows file and print operations. - - - - -Using interface protection - -By default Samba will accept connections on any network interface that -it finds on your system. That means if you have a ISDN line or a PPP -connection to the Internet then Samba will accept connections on those -links. This may not be what you want. +Samba may be secured from connections that originate from outside the local network. This may be +done using host based protection (using samba's implementation of a technology +known as "tcpwrappers", or it may be done be using interface based exclusion +so that &smbd; will bind only to specifically permitted interfaces. It is also +possible to set specific share or resource based exclusions, eg: on the IPC$ +auto-share. The IPC$ share is used for browsing purposes as well as to establish +TCP/IP connections. -You can change this behaviour using options like the following: - - - - interfaces = eth* lo - bind interfaces only = yes - - - -This tells Samba to only listen for connections on interfaces with a -name starting with 'eth' such as eth0, eth1, plus on the loopback -interface called 'lo'. The name you will need to use depends on what -OS you are using, in the above I used the common name for Ethernet -adapters on Linux. - - - -If you use the above and someone tries to make a SMB connection to -your host over a PPP interface called 'ppp0' then they will get a TCP -connection refused reply. In that case no Samba code is run at all as -the operating system has been told not to pass connections from that -interface to any samba process. +Another method by which Samba may be secured is by way of setting Access Control Entries in an Access +Control List on the shares themselves. This is discussed in the chapter on File, Directory and Share Access +Control. -Using a firewall - - -Many people use a firewall to deny access to services that they don't -want exposed outside their network. This can be a very good idea, -although I would recommend using it in conjunction with the above -methods so that you are protected even if your firewall is not active -for some reason. - +Technical Discussion of Protective Measures and Issues -If you are setting up a firewall then you need to know what TCP and -UDP ports to allow and block. Samba uses the following: - - - - UDP/137 - used by nmbd - UDP/138 - used by nmbd - TCP/139 - used by smbd - TCP/445 - used by smbd - - - -The last one is important as many older firewall setups may not be -aware of it, given that this port was only added to the protocol in -recent years. +The key challenge of security is the fact that protective measures suffice at best +only to close the door on known exploits and breach techniques. Never assume that +because you have followed these few measures that the Samba server is now an impenetrable +fortress! Given the history of information systems so far, it is only a matter of time +before someone will find yet another vulnerability. + + Using host based protection + + + In many installations of Samba the greatest threat comes for outside + your immediate network. By default Samba will accept connections from + any host, which means that if you run an insecure version of Samba on + a host that is directly connected to the Internet you can be + especially vulnerable. + + + + One of the simplest fixes in this case is to use the hosts allow and + hosts deny options in the Samba &smb.conf; configuration file to only + allow access to your server from a specific range of hosts. An example + might be: + + + + hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24 + hosts deny = 0.0.0.0/0 + + + + The above will only allow SMB connections from 'localhost' (your own + computer) and from the two private networks 192.168.2 and + 192.168.3. All other connections will be refused as soon + as the client sends its first packet. The refusal will be marked as a + not listening on called name error. + + + + + + User based protection + + + If you want to restrict access to your server to valid users only then the following + method may be of use. In the &smb.conf; [globals] section put: + + + + valid users = @smbusers, jacko + + + + What this does is, it restricts all server access to either the user jacko + or to members of the system group smbusers. + + + + + + + Using interface protection + + + By default Samba will accept connections on any network interface that + it finds on your system. That means if you have a ISDN line or a PPP + connection to the Internet then Samba will accept connections on those + links. This may not be what you want. + + + + You can change this behaviour using options like the following: + + + + interfaces = eth* lo + bind interfaces only = yes + + + + This tells Samba to only listen for connections on interfaces with a + name starting with 'eth' such as eth0, eth1, plus on the loopback + interface called 'lo'. The name you will need to use depends on what + OS you are using, in the above I used the common name for Ethernet + adapters on Linux. + + + + If you use the above and someone tries to make a SMB connection to + your host over a PPP interface called 'ppp0' then they will get a TCP + connection refused reply. In that case no Samba code is run at all as + the operating system has been told not to pass connections from that + interface to any samba process. + + + + + + Using a firewall + + + Many people use a firewall to deny access to services that they don't + want exposed outside their network. This can be a very good idea, + although I would recommend using it in conjunction with the above + methods so that you are protected even if your firewall is not active + for some reason. + + + + If you are setting up a firewall then you need to know what TCP and + UDP ports to allow and block. Samba uses the following: + + + + UDP/137 - used by nmbd + UDP/138 - used by nmbd + TCP/139 - used by smbd + TCP/445 - used by smbd + + + + The last one is important as many older firewall setups may not be + aware of it, given that this port was only added to the protocol in + recent years. + + + + + + Using a IPC$ share deny + + + If the above methods are not suitable, then you could also place a + more specific deny on the IPC$ share that is used in the recently + discovered security hole. This allows you to offer access to other + shares while denying access to IPC$ from potentially untrustworthy + hosts. + + + + To do that you could use: + + + +[ipc$] + hosts allow = 192.168.115.0/24 127.0.0.1 + hosts deny = 0.0.0.0/0 + + + + this would tell Samba that IPC$ connections are not allowed from + anywhere but the two listed places (localhost and a local + subnet). Connections to other shares would still be allowed. As the + IPC$ share is the only share that is always accessible anonymously + this provides some level of protection against attackers that do not + know a username/password for your host. + + + + If you use this method then clients will be given a access denied + reply when they try to access the IPC$ share. That means that those + clients will not be able to browse shares, and may also be unable to + access some other resources. + + + + This is not recommended unless you cannot use one of the other + methods listed above for some reason. + + + + + + NTLMv2 Security + + + To configure NTLMv2 authentication the following registry keys are worth knowing about: + + + + + + [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] + "lmcompatibilitylevel"=dword:00000003 + + 0x3 - Send NTLMv2 response only. Clients will use NTLMv2 authentication, + use NTLMv2 session security if the server supports it. Domain + controllers accept LM, NTLM and NTLMv2 authentication. + + [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0] + "NtlmMinClientSec"=dword:00080000 + + 0x80000 - NTLMv2 session security. If either NtlmMinClientSec or + NtlmMinServerSec is set to 0x80000, the connection will fail if NTLMv2 + session security is not negotiated. + + + -Using a IPC$ share deny - - -If the above methods are not suitable, then you could also place a -more specific deny on the IPC$ share that is used in the recently -discovered security hole. This allows you to offer access to other -shares while denying access to IPC$ from potentially untrustworthy -hosts. - - - -To do that you could use: - - - - [ipc$] - hosts allow = 192.168.115.0/24 127.0.0.1 - hosts deny = 0.0.0.0/0 - - - -this would tell Samba that IPC$ connections are not allowed from -anywhere but the two listed places (localhost and a local -subnet). Connections to other shares would still be allowed. As the -IPC$ share is the only share that is always accessible anonymously -this provides some level of protection against attackers that do not -know a username/password for your host. - - - -If you use this method then clients will be given a 'access denied' -reply when they try to access the IPC$ share. That means that those -clients will not be able to browse shares, and may also be unable to -access some other resources. - +Upgrading Samba -This is not recommended unless you cannot use one of the other -methods listed above for some reason. +Please check regularly on http://www.samba.org/ for updates and +important announcements. Occasionally security releases are made and +it is highly recommended to upgrade Samba when a security vulnerability +is discovered. -NTLMv2 Security - - -To configure NTLMv2 authentication the following registry keys are worth knowing about: - +Common Errors - - [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] - "lmcompatibilitylevel"=dword:00000003 - - 0x3 - Send NTLMv2 response only. Clients will use NTLMv2 authentication, - use NTLMv2 session security if the server supports it. Domain - controllers accept LM, NTLM and NTLMv2 authentication. - - [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0] - "NtlmMinClientSec"=dword:00080000 - - 0x80000 - NTLMv2 session security. If either NtlmMinClientSec or - NtlmMinServerSec is set to 0x80000, the connection will fail if NTLMv2 - session security is not negotiated. - +If all of samba and host platform configuration were really as intuitive as one might like then this +section would not be necessary. Security issues are often vexing for a support person to resolve, not +because of the complexity of the problem, but for reason that most administrators who post what turns +out to be a security problem request are totally convinced that the problem is with Samba. - - - -Upgrading Samba - -Please check regularly on http://www.samba.org/ for updates and -important announcements. Occasionally security releases are made and -it is highly recommended to upgrade Samba when a security vulnerability -is discovered. - + + Smbclient works on localhost, but the network is dead + + + This is a very common problem. Red Hat Linux (as do others) will install a default firewall. + With the default firewall in place only traffic on the loopback adapter (IP address 127.0.0.1) + will be allowed through the firewall. + + + + The solution is either to remove the firewall (stop it) or to modify the firewall script to + allow SMB networking traffic through. See section above in this chapter. + + + + + + Why can users access home directories of other users? + + + + We are unable to keep individual users from mapping to any other user's + home directory once they have supplied a valid password! They only need + to enter their own password. I have not found *any* method that I can + use to configure samba to enforce that only a user may map their own + home directory. + + + + + User xyzzy can map his home directory. Once mapped user xyzzy can also map + *anyone* else's home directory! + + + + This is not a security flaw, it is by design. Samba allows + users to have *exactly* the same access to the UNIX filesystem + as they would if they were logged onto the UNIX box, except + that it only allows such views onto the file system as are + allowed by the defined shares. + + + + This means that if your UNIX home directories are set up + such that one user can happily cd into another users + directory and do an ls, the UNIX security solution is to + change the UNIX file permissions on the users home directories + such that the cd and ls would be denied. + + + + Samba tries very hard not to second guess the UNIX administrators + security policies, and trusts the UNIX admin to set + the policies and permissions he or she desires. + + + + Samba does allow the setup you require when you have set the + only user = yes option on the share, is that you have not set the + valid users list for the share. + + + + Note that only user works in conjunction with the users= list, + so to get the behavior you require, add the line : + + users = %S + + this is equivalent to: + + valid users = %S + + to the definition of the [homes] share, as recommended in + the &smb.conf; man page. + + - diff --git a/docs/docbook/projdoc/unicode.xml b/docs/docbook/projdoc/unicode.xml index 2351668e56..d24ec4b5cd 100644 --- a/docs/docbook/projdoc/unicode.xml +++ b/docs/docbook/projdoc/unicode.xml @@ -12,6 +12,32 @@ Unicode/Charsets + +Features and Benefits + + +Every industry eventually matures. One of the great areas of maturation is in +the focus that has been given over the past decade to make it possible for anyone +anywhere to use a computer. It has not always been that way, in fact, not so long +ago it was common for software to be written for exclusive use in the country of +origin. + + + +Of all the effort that has been brought to bear on providing native language support +for all computer users, the efforts of the Openi18n organisation is deserving of +special mention. For more information about Openi18n please refer to: +http://www.openi18n.org/. + + + +Samba-2.x supported a single locale through a mechanism called +codepages. Samba-3 is destined to become a truly trans-global +file and printer sharing platform. + + + + What are charsets and unicode? @@ -44,7 +70,7 @@ communicating. Old windows clients used to use single-byte charsets, named -'codepages' by microsoft. However, there is no support for +'codepages' by Microsoft. However, there is no support for negotiating the charset to be used in the smb protocol. Thus, you have to make sure you are using the same charset when talking to an old client. Newer clients (Windows NT, 2K, XP) talk unicode over the wire. @@ -61,7 +87,7 @@ samba knows of three kinds of character sets: - unix charset + unix charset This is the charset used internally by your operating system. The default is ASCII, which is fine for most @@ -70,14 +96,14 @@ samba knows of three kinds of character sets: - display charset + display charset This is the charset samba will use to print messages on your screen. It should generally be the same as the unix charset. - dos charset + dos charset This is the charset samba uses when communicating with DOS and Windows 9x clients. It will talk unicode to all newer clients. The default depends on the charsets you have installed on your system. @@ -114,24 +140,24 @@ points of attention when setting it up: -You should set mangling method = -hash +You should set mangling method = +hash There are various iconv() implementations around and not all of them work equally well. glibc2's iconv() has a critical problem in CP932. libiconv-1.8 works with CP932 but still has some problems and does not work with EUC-JP. -You should set dos charset = CP932, not +You should set dos charset = CP932, not Shift_JIS, SJIS... -Currently only unix charset = CP932 +Currently only unix charset = CP932 will work (but still has some problems...) because of iconv() issues. -unix charset = EUC-JP doesn't work well because of +unix charset = EUC-JP doesn't work well because of iconv() issues. -Currently Samba 3.0 does not support unix charset -= UTF8-MAC/CAP/HEX/JIS* +Currently Samba 3.0 does not support unix charset += UTF8-MAC/CAP/HEX/JIS* diff --git a/docs/docbook/projdoc/upgrading-to-3.0.xml b/docs/docbook/projdoc/upgrading-to-3.0.xml index 3dc4816664..b4c0732a65 100644 --- a/docs/docbook/projdoc/upgrading-to-3.0.xml +++ b/docs/docbook/projdoc/upgrading-to-3.0.xml @@ -4,7 +4,7 @@ 25 October 2002 -Issues when upgrading from 2.2 to 3.0 +Upgrading from Samba-2.x to Samba-3.0.0 Charsets @@ -31,6 +31,34 @@ In 3.0, the following configuration options have been removed. use rhosts postscript client code page (replaced by dos charset) +vfs path +vfs options + + +Password Backend + + +Effective with the release of samba-3 it is now imperative that the password backend +be correctly defined in smb.conf. + + + +Those migrating from samba-2.x with plaintext password support need the following: +passdb backend = guest. + + + +Those migrating from samba-2.x with encrypted password support should add to smb.conf +passdb backend = smbpasswd, guest. + + + +LDAP using Samba-2.x systems can continue to operate with the following entry +passdb backend = ldapsam_compat, guest. + + + + diff --git a/docs/docbook/projdoc/winbind.xml b/docs/docbook/projdoc/winbind.xml index cb6a56687d..524f05ffa2 100644 --- a/docs/docbook/projdoc/winbind.xml +++ b/docs/docbook/projdoc/winbind.xml @@ -6,11 +6,10 @@ TimPotter Samba Team -
tpot@linuxcare.com.au
+
tpot@samba.org
 &author.tridge; - &author.jht; NaagMummaneni @@ -18,14 +17,15 @@ &author.jelmer; + &author.jht; 27 June 2002 -Unified Logons between Windows NT and UNIX using Winbind +Integrated Logon Support using Winbind - Abstract + Features and Benefits Integration of UNIX and Microsoft Windows NT through a unified logon has been considered a "holy grail" in heterogeneous @@ -223,7 +223,9 @@ of that service should be tried and in what order. If the passwd config line is: - passwd: files example + +passwd: files example + then the C library will first load a module called /lib/libnss_files.so followed by @@ -337,8 +339,8 @@ the winbind services which come with SAMBA 3.0. Introduction -This HOWTO describes the procedures used to get winbind up and -running on my RedHat 7.1 system. Winbind is capable of providing access +This section describes the procedures used to get winbind up and +running on a RedHat 7.1 system. Winbind is capable of providing access and authentication control for Windows Domain users through an NT or Win2K PDC for 'regular' services, such as telnet a nd ftp, as well for SAMBA services. @@ -386,7 +388,7 @@ somewhat to fit the way your distribution works. Requirements -If you have a samba configuration file that you are currently +If you have a Samba configuration file that you are currently using... BACK IT UP! If your system already uses PAM, back up the /etc/pam.d directory contents! If you haven't already made a boot disk, @@ -394,8 +396,8 @@ contents! If you haven't already made a boot disk, -Messing with the pam configuration files can make it nearly impossible -to log in to yourmachine. That's why you want to be able to boot back +Messing with the PAM configuration files can make it nearly impossible +to log in to your machine. That's why you want to be able to boot back into your machine in single user mode and restore your /etc/pam.d back to the original state they were in if you get frustrated with the way things are going. ;-) @@ -428,17 +430,15 @@ install the development packages in pam-devel-0.74-22. Before starting, it is probably best to kill off all the SAMBA -related daemons running on your server. Kill off all smbd, -nmbd, and winbindd processes that may +related daemons running on your server. Kill off all &smbd;, +&nmbd;, and &winbindd; processes that may be running. To use PAM, you will want to make sure that you have the standard PAM package (for RedHat) which supplies the /etc/pam.d directory structure, including the pam modules are used by pam-aware services, several pam libraries, and the /usr/doc and /usr/man entries for pam. Winbind built better in SAMBA if the pam-devel package was also installed. This package includes -the header files needed to compile pam-aware applications. For instance, -my RedHat system has both pam-0.74-22 and -pam-devel-0.74-22 RPMs installed. +the header files needed to compile pam-aware applications. @@ -450,14 +450,14 @@ The first three steps may not be necessary depending upon whether or not you have previously built the Samba binaries. - -root# autoconf -root# make clean -root# rm config.cache -root# ./configure -root# make -root# make install - + +&rootprompt;autoconf +&rootprompt;make clean +&rootprompt;rm config.cache +&rootprompt;./configure +&rootprompt;make +&rootprompt;make install + @@ -473,12 +473,14 @@ It will also build the winbindd executable and libraries. winbind libraries on Linux and Solaris -The libraries needed to run the winbindd daemon +The libraries needed to run the &winbindd; daemon through nsswitch need to be copied to their proper locations, so -root# cp ../samba/source/nsswitch/libnss_winbind.so /lib + +&rootprompt;cp ../samba/source/nsswitch/libnss_winbind.so /lib + @@ -486,19 +488,19 @@ I also found it necessary to make the following symbolic link: -root# ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2 +&rootprompt; ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2 -And, in the case of Sun solaris: - -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1 -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1 -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2 - +And, in the case of Sun Solaris: + +&rootprompt;ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1 +&rootprompt;ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1 +&rootprompt;ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2 + Now, as root you need to edit /etc/nsswitch.conf to -allow user and group entries to be visible from the winbindd +allow user and group entries to be visible from the &winbindd; daemon. My /etc/nsswitch.conf file look like this after editing: @@ -517,7 +519,7 @@ is faster (and you don't need to reboot) if you do it manually: -root# /sbin/ldconfig -v | grep winbind +&rootprompt;/sbin/ldconfig -v | grep winbind @@ -566,11 +568,11 @@ url="http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixbman/baseadmn/ia Several parameters are needed in the smb.conf file to control -the behavior of winbindd. Configure -smb.conf These are described in more detail in +the behavior of &winbindd;. Configure +&smb.conf; These are described in more detail in the winbindd 8 man page. My -smb.conf file was modified to +&smb.conf; file was modified to include the following entries in the [global] section: @@ -580,9 +582,9 @@ include the following entries in the [global] section: # separate domain and username with '+', like DOMAIN+username winbind separator = + # use uids from 10000 to 20000 for domain users - winbind uid = 10000-20000 + idmap uid = 10000-20000 # use gids from 10000 to 20000 for domain groups - winbind gid = 10000-20000 + idmap gid = 10000-20000 # allow enumeration of winbind users and groups winbind enum users = yes winbind enum groups = yes @@ -606,7 +608,7 @@ a domain user who has administrative privileges in the domain. -root# /usr/local/samba/bin/net join -S PDC -U Administrator +&rootprompt;/usr/local/samba/bin/net join -S PDC -U Administrator @@ -631,7 +633,7 @@ command as root: -root# /usr/local/samba/bin/winbindd +&rootprompt;/usr/local/samba/bin/winbindd @@ -640,11 +642,11 @@ run as 2 processes. The first will answer all requests from the cache, thus making responses to clients faster. The other will update the cache for the query that the first has just responded. Advantage of this is that responses stay accurate and are faster. -You can enable dual daemon mode by adding '-B' to the commandline: +You can enable dual daemon mode by adding to the commandline: -root# /usr/local/samba/bin/winbindd -B +&rootprompt;/usr/local/samba/bin/winbindd -B @@ -653,14 +655,14 @@ is really running... -root# ps -ae | grep winbindd +&rootprompt;ps -ae | grep winbindd This command should produce output like this, if the daemon is running - + 3025 ? 00:00:00 winbindd - + Now... for the real test, try to get some information about the @@ -668,7 +670,7 @@ users on your PDC -root# /usr/local/samba/bin/wbinfo -u +&rootprompt;/usr/local/samba/bin/wbinfo -u @@ -676,14 +678,14 @@ This should echo back a list of users on your Windows users on your PDC. For example, I get the following response: - + CEO+Administrator CEO+burdell CEO+Guest CEO+jt-ad CEO+krbtgt CEO+TsInternetUser - + Obviously, I have named my domain 'CEO' and my winbind @@ -695,8 +697,8 @@ You can do the same sort of thing to get group information from the PDC: - -root# /usr/local/samba/bin/wbinfo -g + +&rootprompt;/usr/local/samba/bin/wbinfo -g CEO+Domain Admins CEO+Domain Users CEO+Domain Guests @@ -706,7 +708,7 @@ the PDC: CEO+Schema Admins CEO+Enterprise Admins CEO+Group Policy Creator Owners - + The function 'getent' can now be used to get unified @@ -715,7 +717,7 @@ Try the following command: -root# getent passwd +&rootprompt;getent passwd @@ -729,7 +731,7 @@ The same thing can be done for groups with the command -root# getent group +&rootprompt;getent group @@ -742,14 +744,13 @@ The same thing can be done for groups with the command Linux -The winbindd daemon needs to start up after the -smbd and nmbd daemons are running. +The &winbindd; daemon needs to start up after the +&smbd; and &nmbd; daemons are running. To accomplish this task, you need to modify the startup scripts of your system. They are located at /etc/init.d/smb in RedHat and /etc/init.d/samba in Debian. script to add commands to invoke this daemon in the proper sequence. My -startup script starts up smbd, -nmbd, and winbindd from the +startup script starts up &smbd;, &nmbd;, and &winbindd; from the /usr/local/samba/bin directory directly. The 'start' function in the script looks like this: @@ -822,9 +823,9 @@ stop() { Solaris -Winbind doesn't work on solaris 9, see the Portability chapter for details. +Winbind doesn't work on Solaris 9, see the Portability chapter for details. -On solaris, you need to modify the +On Solaris, you need to modify the /etc/init.d/samba.server startup script. It usually only starts smbd and nmbd but should now start winbindd too. If you have samba installed in /usr/local/samba/bin, @@ -898,8 +899,7 @@ in the script above with: Restarting -If you restart the smbd, nmbd, -and winbindd daemons at this point, you +If you restart the &smbd;, &nmbd;, and &winbindd; daemons at this point, you should be able to connect to the samba server as a domain member just as if you were a local user. @@ -924,7 +924,7 @@ by invoking the command -root# make nsswitch/pam_winbind.so +&rootprompt;make nsswitch/pam_winbind.so @@ -936,7 +936,7 @@ modules reside in /usr/lib/security. -root# cp ../samba/source/nsswitch/pam_winbind.so /lib/security +&rootprompt;cp ../samba/source/nsswitch/pam_winbind.so /lib/security @@ -944,7 +944,7 @@ modules reside in /usr/lib/security. The /etc/pam.d/samba file does not need to be changed. I -just left this fileas it was: +just left this file as it was: @@ -981,8 +981,8 @@ For ftp services to work properly, you will also need to either have individual directories for the domain users already present on the server, or change the home directory template to a general directory for all domain users. These can be easily set using -the smb.conf global entry -template homedir. +the &smb.conf; global entry +template homedir. @@ -1022,8 +1022,8 @@ same way. It now looks like this: -In this case, I added the auth sufficient /lib/security/pam_winbind.so -lines as before, but also added the required pam_securetty.so +In this case, I added the auth sufficient /lib/security/pam_winbind.so +lines as before, but also added the required pam_securetty.so above it, to disallow root logins over the network. I also added a sufficient /lib/security/pam_unix.so use_first_pass line after the winbind.so line to get rid of annoying @@ -1124,7 +1124,19 @@ configured in the pam.conf. - Limitations +Conclusion + + The winbind system, through the use of the Name Service + Switch, Pluggable Authentication Modules, and appropriate + Microsoft RPC calls have allowed us to provide seamless + integration of Microsoft Windows NT domain users on a + UNIX system. The result is a great reduction in the administrative + cost of running a mixed UNIX and NT network. + + + + +Common Errors Winbind has a number of limitations in its current released version that we hope to overcome in future @@ -1137,7 +1149,7 @@ configured in the pam.conf. we require the C library of the target operating system to support the Name Service Switch and Pluggable Authentication Modules systems. This is becoming more common as NSS and - PAM gain support among UNIX vendors. + PAM gain support among UNIX vendors. The mappings of Windows NT RIDs to UNIX ids is not made algorithmically and depends on the order in which @@ -1153,17 +1165,4 @@ configured in the pam.conf. - - - Conclusion - - The winbind system, through the use of the Name Service - Switch, Pluggable Authentication Modules, and appropriate - Microsoft RPC calls have allowed us to provide seamless - integration of Microsoft Windows NT domain users on a - UNIX system. The result is a great reduction in the administrative - cost of running a mixed UNIX and NT network. - - - diff --git a/docs/docbook/smbdotconf/filename/mangledstack.xml b/docs/docbook/smbdotconf/filename/mangledstack.xml index 42083d13a2..5f28e76dd9 100644 --- a/docs/docbook/smbdotconf/filename/mangledstack.xml +++ b/docs/docbook/smbdotconf/filename/mangledstack.xml @@ -1,4 +1,4 @@ - diff --git a/docs/docbook/smbdotconf/filename/mangleprefix.xml b/docs/docbook/smbdotconf/filename/mangleprefix.xml index 5476ed1f08..cbd41f973d 100644 --- a/docs/docbook/smbdotconf/filename/mangleprefix.xml +++ b/docs/docbook/smbdotconf/filename/mangleprefix.xml @@ -1,4 +1,4 @@ - diff --git a/docs/docbook/smbdotconf/generate-context.xsl b/docs/docbook/smbdotconf/generate-context.xsl index 13fb216700..4afba52a86 100644 --- a/docs/docbook/smbdotconf/generate-context.xsl +++ b/docs/docbook/smbdotconf/generate-context.xsl @@ -24,17 +24,11 @@ - - Processing samba:parameter ( - - ) - - - + diff --git a/docs/docbook/smbdotconf/generate-file-list.sh b/docs/docbook/smbdotconf/generate-file-list.sh index 3495f50c43..84c3d5d2fc 100755 --- a/docs/docbook/smbdotconf/generate-file-list.sh +++ b/docs/docbook/smbdotconf/generate-file-list.sh @@ -1,8 +1,8 @@ #!/bin/sh echo "" -find . -type f -name '*.xml' -mindepth 2 | sort -t/ -k3 | - while read ; do - echo "" - done +for I in `find . -type f -name '*.xml' -mindepth 2 | sort -t/ -k3 | xargs` +do + echo "" +done echo "" diff --git a/docs/docbook/smbdotconf/logging/debuglevel.xml b/docs/docbook/smbdotconf/logging/debuglevel.xml index 8bd4b4e0b5..622fbf21a2 100644 --- a/docs/docbook/smbdotconf/logging/debuglevel.xml +++ b/docs/docbook/smbdotconf/logging/debuglevel.xml @@ -1,4 +1,4 @@ - diff --git a/docs/docbook/smbdotconf/printing/printcommand.xml b/docs/docbook/smbdotconf/printing/printcommand.xml index 5444309053..4b9904f6a8 100644 --- a/docs/docbook/smbdotconf/printing/printcommand.xml +++ b/docs/docbook/smbdotconf/printing/printcommand.xml @@ -15,7 +15,7 @@ The print command is simply a text string. It will be used verbatim after macro substitutions have been made: - %s, %p - the path to the spool + %s, %f - the path to the spool file name %p - the appropriate printer diff --git a/docs/docbook/smbdotconf/protocol/nameresolveorder.xml b/docs/docbook/smbdotconf/protocol/nameresolveorder.xml index 897d04ad1c..4e88495489 100644 --- a/docs/docbook/smbdotconf/protocol/nameresolveorder.xml +++ b/docs/docbook/smbdotconf/protocol/nameresolveorder.xml @@ -5,7 +5,8 @@ This option is used by the programs in the Samba suite to determine what naming services to use and in what order - to resolve host names to IP addresses. The option takes a space + to resolve host names to IP addresses. Its main purpose to is to + control how netbios name resolution is performed. The option takes a space separated string of name resolution options. The options are: "lmhosts", "host", @@ -16,7 +17,8 @@ lmhosts : Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has - no name type attached to the NetBIOS name (see the lmhosts(5) for details) then + no name type attached to the NetBIOS name (see the lmhosts(5) for details) then any name type matches for lookup. @@ -26,9 +28,10 @@ , NIS, or DNS lookups. This method of name resolution is operating system depended for instance on IRIX or Solaris this may be controlled by the /etc/nsswitch.conf - file. Note that this method is only used if the NetBIOS name - type being queried is the 0x20 (server) name type, otherwise - it is ignored. + file. Note that this method is used only if the NetBIOS name + type being queried is the 0x20 (server) name type or 0x1c (domain controllers). + The latter case is only useful for active directory domains and results in a DNS + query for the SRV RR entry matching _ldap._tcp.domain. @@ -50,9 +53,18 @@ Default: name resolve order = lmhosts host wins bcast Example: name resolve order = lmhosts bcast host - + This will cause the local lmhosts file to be examined first, followed by a broadcast attempt, followed by a normal system hostname lookup. + + When Samba is functioning in ADS security mode (security = ads) + it is advised to use following settings for name resolve order: + + name resolve order = wins bcast + + DC lookups will still be done via DNS, but fallbacks to netbios names will + not inundate your DNS servers with needless querys for DOMAIN<0x1c> lookups. + diff --git a/docs/docbook/smbdotconf/protocol/usespnego.xml b/docs/docbook/smbdotconf/protocol/usespnego.xml index 88c9f1df7a..7dddbd3f74 100644 --- a/docs/docbook/smbdotconf/protocol/usespnego.xml +++ b/docs/docbook/smbdotconf/protocol/usespnego.xml @@ -5,7 +5,7 @@ This variable controls controls whether samba will try to use Simple and Protected NEGOciation (as specified by rfc2478) with - WindowsXP and Windows2000sp2 clients to agree upon an authentication mechanism. + WindowsXP and Windows2000 clients to agree upon an authentication mechanism. Unless further issues are discovered with our SPNEGO implementation, there is no reason this should ever be disabled. diff --git a/docs/docbook/smbdotconf/security/authmethods.xml b/docs/docbook/smbdotconf/security/authmethods.xml index 0b7965d55b..7c0f5a71e1 100644 --- a/docs/docbook/smbdotconf/security/authmethods.xml +++ b/docs/docbook/smbdotconf/security/authmethods.xml @@ -6,14 +6,24 @@ This option allows the administrator to chose what authentication methods smbd will use when authenticating a user. This option defaults to sensible values based on - security. + security. This should be considered + a developer option and used only in rare circumstances. In the majority (if not all) + of production servers, the default setting should be adequate. Each entry in the list attempts to authenticate the user in turn, until the user authenticates. In practice only one method will ever actually be able to complete the authentication. + Possible options include guest (anonymous access), + sam (lookups in local list of accounts based on netbios + name or domain name), winbind (relay authentication requests + for remote users through winbindd), ntdomain (pre-winbindd + method of authentication for remote domain users; deprecated in favour of winbind method), + trustdomain (authenticate trusted users by contacting the + remote DC directly from smbd; deprecated in favour of winbind method). + Default: auth methods = <empty string> - Example: auth methods = guest sam ntdomain + Example: auth methods = guest sam winbind diff --git a/docs/docbook/smbdotconf/security/lanmanauth.xml b/docs/docbook/smbdotconf/security/lanmanauth.xml index e293242472..0a8fdd3ef3 100644 --- a/docs/docbook/smbdotconf/security/lanmanauth.xml +++ b/docs/docbook/smbdotconf/security/lanmanauth.xml @@ -8,7 +8,23 @@ using the LANMAN password hash. If disabled, only clients which support NT password hashes (e.g. Windows NT/2000 clients, smbclient, etc... but not Windows 95/98 or the MS DOS network client) will be able to connect to the Samba host. + + The LANMAN encrypted response is easily broken, due to it's + case-insensitive nature, and the choice of algorithm. Servers + without Windows 95/98 or MS DOS clients are advised to disable + this option. + Unlike the encypt + passwords option, this parameter cannot alter client + behaviour, and the LANMAN response will still be sent over the + network. See the client lanman + auth to disable this for Samba's clients (such as smbclient) + + If this option, and ntlm + auth are both disabled, then only NTLMv2 logins will be + permited. Not all clients support NTLMv2, and most will require + special configuration to us it. + Default : lanman auth = yes diff --git a/docs/docbook/smbdotconf/security/ntlmauth.xml b/docs/docbook/smbdotconf/security/ntlmauth.xml index b0b3179ab7..96092152c9 100644 --- a/docs/docbook/smbdotconf/security/ntlmauth.xml +++ b/docs/docbook/smbdotconf/security/ntlmauth.xml @@ -4,11 +4,15 @@ xmlns:samba="http://samba.org/common"> This parameter determines whether or not smbd - 8 will attempt to authenticate users using the NTLM password hash. - If disabled, only the lanman password hashes will be used. + 8 will attempt to + authenticate users using the NTLM encrypted password response. + If disabled, either the lanman password hash or an NTLMv2 response + will need to be sent by the client. - Please note that at least this option or lanman auth should - be enabled in order to be able to log in. + If this option, and lanman + auth are both disabled, then only NTLMv2 logins will be + permited. Not all clients support NTLMv2, and most will require + special configuration to us it. Default : ntlm auth = yes diff --git a/docs/docbook/smbdotconf/security/passdbbackend.xml b/docs/docbook/smbdotconf/security/passdbbackend.xml index d755cfc313..1a3a83946a 100644 --- a/docs/docbook/smbdotconf/security/passdbbackend.xml +++ b/docs/docbook/smbdotconf/security/passdbbackend.xml @@ -23,15 +23,6 @@ - - smbpasswd_nua - The smbpasswd - backend, but with support for 'not unix accounts'. - Takes a path to the smbpasswd file as an optional argument. - - See also - non unix account range - - tdbsam - The TDB based password storage backend. Takes a path to the TDB as an optional argument (defaults to passdb.tdb @@ -39,33 +30,11 @@ private dir directory. - - tdbsam_nua - The TDB based password storage - backend, with non unix account support. Takes a path to the TDB as an optional argument (defaults to passdb.tdb - in the - private dir directory. - - See also - non unix account range - - ldapsam - The LDAP based passdb backend. Takes an LDAP URL as an optional argument (defaults to ldap://localhost) - - - ldapsam_nua - The LDAP based passdb - backend, with non unix account support. Takes an LDAP URL as an optional argument (defaults to - ldap://localhost) - - Note: In this module, any account without a matching POSIX account is regarded - as 'non unix'. - - See also - non unix account range - LDAP connections should be secured where possible. This may be done using either Start-TLS (see ldap ssl) or by specifying ldaps:// in @@ -79,15 +48,29 @@ + + mysql - + The MySQL based passdb backend. Takes an identifier as + argument. Read the Samba HOWTO Collection for configuration + details. + + + + guest - + Very simple backend that only provides one user: the guest user. + Only maps the NT guest user to the guest account. + Required in pretty much all situations. + + - Default: passdb backend = smbpasswd unixsam + Default: passdb backend = smbpasswd Example: passdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd guest - Example: passdb backend = ldapsam_nua:ldaps://ldap.example.com guest + Example: passdb backend = ldapsam:ldaps://ldap.example.com guest - Example: passdb backend = mysql:my_plugin_args tdbsam:/etc/samba/private/passdb.tdb + Example: passdb backend = mysql:my_plugin_args tdbsam:/etc/samba/private/passdb.tdb guest diff --git a/docs/docbook/smbdotconf/security/passwordserver.xml b/docs/docbook/smbdotconf/security/passwordserver.xml index e40ff32b75..f854027041 100644 --- a/docs/docbook/smbdotconf/security/passwordserver.xml +++ b/docs/docbook/smbdotconf/security/passwordserver.xml @@ -3,18 +3,22 @@ advanced="1" wizard="1" developer="1" xmlns:samba="http://samba.org/common"> - By specifying the name of another SMB server (such - as a WinNT box) with this option, and using security = domain - or security = server you can get Samba - to do all its username/password validation via a remote server. + By specifying the name of another SMB server + or Active Directory domain controller with this option, + and using security = [ads|domain|server] + it is possible to get Samba to + to do all its username/password validation using a specific remote server. - This option sets the name of the password server to use. - It must be a NetBIOS name, so if the machine's NetBIOS name is - different from its Internet name then you may have to add its NetBIOS - name to the lmhosts file which is stored in the same directory - as the smb.conf file. + This option sets the name or IP address of the password server to use. + New syntax has been added to support defining the port to use when connecting + to the server the case of an ADS realm. To define a port other than the + default LDAP port of 389, add the port number using a colon after the + name or IP address (e.g. 192.168.1.100:389). If you do not specify a port, + Samba will use the standard LDAP port of tcp/389. Note that port numbers + have no effect on password servers for Windows NT 4.0 domains or netbios + connections. - The name of the password server is looked up using the + If parameter is a name, it is looked up using the parameter name resolve order and so may resolved by any method and order described in that parameter. @@ -38,14 +42,14 @@ trust your clients, and you had better restrict them with hosts allow! If the security parameter is set to - domain, then the list of machines in this + domain or ads, then the list of machines in this option must be a list of Primary or Backup Domain controllers for the Domain or the character '*', as the Samba server is effectively in that domain, and will use cryptographically authenticated RPC calls to authenticate the user logging on. The advantage of using security = domain is that if you list several hosts in the password server option then smbd - will try each in turn till it finds one that responds. This + will try each in turn till it finds one that responds. This is useful in case your primary server goes down. If the password server option is set @@ -55,7 +59,7 @@ and then contacting each server returned in the list of IP addresses from the name resolution source. - If the list of servers contains both names and the '*' + If the list of servers contains both names/IP's and the '*' character, the list is treated as a list of preferred domain controllers, but an auto lookup of all remaining DC's will be added to the list as well. Samba will not attempt to optimize @@ -93,6 +97,8 @@ Example: password server = NT-PDC, NT-BDC1, NT-BDC2, * + Example: password server = windc.mydomain.com:389 192.168.1.101 * + Example: password server = * diff --git a/docs/docbook/smbdotconf/security/restrictanonymous.xml b/docs/docbook/smbdotconf/security/restrictanonymous.xml index 803bc06b2b..25d2ba0df6 100644 --- a/docs/docbook/smbdotconf/security/restrictanonymous.xml +++ b/docs/docbook/smbdotconf/security/restrictanonymous.xml @@ -14,12 +14,21 @@ Windows 2000/XP and Samba, no anonymous connections are allowed at all. This can break third party and Microsoft applications which expect to be allowed to perform - operations anonymously. + operations anonymously. + The security advantage of using restrict anonymous = 1 is dubious, as user and group list information can be obtained using other - means. - + means. + + + + + The security advantage of using restrict anonymous = 2 is removed + by setting guest + ok = yes on any share. + + Default: restrict anonymous = 0 diff --git a/docs/docbook/smbdotconf/security/security.xml b/docs/docbook/smbdotconf/security/security.xml index 68c5f2cdd2..030abc1de1 100644 --- a/docs/docbook/smbdotconf/security/security.xml +++ b/docs/docbook/smbdotconf/security/security.xml @@ -212,10 +212,9 @@ does not support them. However note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, it must have a valid smbpasswd file to check - users against. See the documentation file in the docs/ directory - ENCRYPTION.txt for details on how to set this up. + users against. See the chapter about the User Database in the Samba HOWTO Collection for details on how to set this up. - Note this mode of operation has + This mode of operation has significant pitfalls, due to the fact that is activly initiates a man-in-the-middle attack on the remote SMB server. In particular, this mode of operation can cause significant resource consuption on @@ -223,13 +222,13 @@ of the user's session. Furthermore, if this connection is lost, there is no way to reestablish it, and futher authenticaions to the Samba server may fail. (From a single client, till it disconnects). - + - Note that from the client's point of + From the client's point of view security = server is the same as security = user. It only affects how the server deals with the authentication, it does - not in any way affect what the client sees. + not in any way affect what the client sees. Note that the name of the resource being requested is not sent to the server until after @@ -246,6 +245,23 @@ See also the password server parameter and the encrypted passwords parameter. + + SECURITY = ADS + + In this mode, Samba will act as a domain member in an ADS realm. To operate + in this mode, the machine running Samba will need to have Kerberos installed + and configured and Samba will need to be joined to the ADS realm using the + net utility. + + Note that this mode does NOT make Samba operate as a Active Directory Domain + Controller. + + Read the chapter about Domain Membership in the HOWTO for details. + + See also the ads server + parameter, the realm + paramter and the + encrypted passwords parameter. Default: security = USER Example: security = DOMAIN diff --git a/docs/docbook/smbdotconf/vfs/vfsobject.xml b/docs/docbook/smbdotconf/vfs/vfsobject.xml index c68e8d0135..1a45e36c40 100644 --- a/docs/docbook/smbdotconf/vfs/vfsobject.xml +++ b/docs/docbook/smbdotconf/vfs/vfsobject.xml @@ -1,12 +1,12 @@ - This parameter specifies a shared object files that - are used for Samba VFS I/O operations. By default, normal - disk I/O operations are used but these can be overloaded - with one or more VFS objects. - - Default: no value + Synonym for + + vfs objects + . + diff --git a/docs/docbook/smbdotconf/winbind/winbindgid.xml b/docs/docbook/smbdotconf/winbind/winbindgid.xml index a8414e9e8c..e00e576389 100644 --- a/docs/docbook/smbdotconf/winbind/winbindgid.xml +++ b/docs/docbook/smbdotconf/winbind/winbindgid.xml @@ -3,6 +3,8 @@ advanced="1" developer="1" hide="1" xmlns:samba="http://samba.org/common"> + This parameter is now an alias for idmap gid + The winbind gid parameter specifies the range of group ids that are allocated by the winbindd 8 daemon. This range of group ids should have no diff --git a/docs/docbook/smbdotconf/winbind/winbinduid.xml b/docs/docbook/smbdotconf/winbind/winbinduid.xml index 6fee40fcb8..0f61bac13c 100644 --- a/docs/docbook/smbdotconf/winbind/winbinduid.xml +++ b/docs/docbook/smbdotconf/winbind/winbinduid.xml @@ -3,11 +3,12 @@ advanced="1" developer="1" hide="1" xmlns:samba="http://samba.org/common"> - The winbind gid parameter specifies the range of group - ids that are allocated by the winbindd - 8 daemon. This range of ids should have no - existing local or NIS users within it as strange conflicts can - occur otherwise. + This parameter is now an alias for idmap uid + + The winbind gid parameter specifies the range of user ids that are allocated by the + winbindd 8 + daemon. This range of ids should have no existing local or NIS users within it as strange + conflicts can occur otherwise. Default: winbind uid = <empty string> diff --git a/docs/docbook/smbdotconf/winbind/winbindusedefaultdomain.xml b/docs/docbook/smbdotconf/winbind/winbindusedefaultdomain.xml index 5c31a7f9b0..8112331f5e 100644 --- a/docs/docbook/smbdotconf/winbind/winbindusedefaultdomain.xml +++ b/docs/docbook/smbdotconf/winbind/winbindusedefaultdomain.xml @@ -1,4 +1,4 @@ - diff --git a/docs/docbook/smbdotconf/wins/winspartners.xml b/docs/docbook/smbdotconf/wins/winspartners.xml index 9ec277ed2d..13e252b2c0 100644 --- a/docs/docbook/smbdotconf/wins/winspartners.xml +++ b/docs/docbook/smbdotconf/wins/winspartners.xml @@ -1,4 +1,4 @@ - diff --git a/docs/docbook/xslt/db2latex/VERSION.xml b/docs/docbook/xslt/db2latex/VERSION.xml index 6ac59ae4dd..70bbf95e88 100644 --- a/docs/docbook/xslt/db2latex/VERSION.xml +++ b/docs/docbook/xslt/db2latex/VERSION.xml @@ -1,8 +1,6 @@ @@ -17,7 +15,6 @@ -$Id: VERSION.xml,v 1.1 2003/04/30 21:39:49 ab Exp $ diff --git a/docs/docbook/xslt/db2latex/abstract.mod.xsl b/docs/docbook/xslt/db2latex/abstract.mod.xsl index 6fd44bf9f2..a9bc2e02ce 100644 --- a/docs/docbook/xslt/db2latex/abstract.mod.xsl +++ b/docs/docbook/xslt/db2latex/abstract.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: abstract.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/admonition.mod.xsl b/docs/docbook/xslt/db2latex/admonition.mod.xsl index c42d926c16..56042a610e 100644 --- a/docs/docbook/xslt/db2latex/admonition.mod.xsl +++ b/docs/docbook/xslt/db2latex/admonition.mod.xsl @@ -1,8 +1,6 @@ @@ -17,7 +15,6 @@ - $Id: admonition.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/authorgroup.mod.xsl b/docs/docbook/xslt/db2latex/authorgroup.mod.xsl index 6af88ff51a..6ec7460def 100644 --- a/docs/docbook/xslt/db2latex/authorgroup.mod.xsl +++ b/docs/docbook/xslt/db2latex/authorgroup.mod.xsl @@ -1,8 +1,6 @@ @@ -19,7 +17,6 @@ - $Id: authorgroup.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/biblio.mod.xsl b/docs/docbook/xslt/db2latex/biblio.mod.xsl index f26cfb7b2d..9524015b1e 100644 --- a/docs/docbook/xslt/db2latex/biblio.mod.xsl +++ b/docs/docbook/xslt/db2latex/biblio.mod.xsl @@ -1,8 +1,6 @@ @@ -19,7 +17,6 @@ - $Id: biblio.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/block.mod.xsl b/docs/docbook/xslt/db2latex/block.mod.xsl index 98d689989d..49aba64ca2 100644 --- a/docs/docbook/xslt/db2latex/block.mod.xsl +++ b/docs/docbook/xslt/db2latex/block.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: block.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/book-article.mod.xsl b/docs/docbook/xslt/db2latex/book-article.mod.xsl index 594e2f7f2a..042ec556aa 100644 --- a/docs/docbook/xslt/db2latex/book-article.mod.xsl +++ b/docs/docbook/xslt/db2latex/book-article.mod.xsl @@ -1,8 +1,6 @@ diff --git a/docs/docbook/xslt/db2latex/bridgehead.mod.xsl b/docs/docbook/xslt/db2latex/bridgehead.mod.xsl index 0fb75841cd..a09ca15dda 100644 --- a/docs/docbook/xslt/db2latex/bridgehead.mod.xsl +++ b/docs/docbook/xslt/db2latex/bridgehead.mod.xsl @@ -1,8 +1,6 @@ @@ -17,7 +15,6 @@ - $Id: bridgehead.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/callout.mod.xsl b/docs/docbook/xslt/db2latex/callout.mod.xsl index 25ccc95882..ab67cf8e23 100644 --- a/docs/docbook/xslt/db2latex/callout.mod.xsl +++ b/docs/docbook/xslt/db2latex/callout.mod.xsl @@ -1,8 +1,6 @@ @@ -17,7 +15,6 @@ - $Id: callout.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/citation.mod.xsl b/docs/docbook/xslt/db2latex/citation.mod.xsl index ef3493d413..46c69af0eb 100644 --- a/docs/docbook/xslt/db2latex/citation.mod.xsl +++ b/docs/docbook/xslt/db2latex/citation.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: citation.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/common/common.xsl b/docs/docbook/xslt/db2latex/common/common.xsl index 2f0883a7f3..2506bd71ed 100644 --- a/docs/docbook/xslt/db2latex/common/common.xsl +++ b/docs/docbook/xslt/db2latex/common/common.xsl @@ -5,7 +5,6 @@ version='1.0'> @@ -19,7 +17,6 @@ - $Id: component.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/dedication.mod.xsl b/docs/docbook/xslt/db2latex/dedication.mod.xsl index 67012391f8..d8150bdd7f 100644 --- a/docs/docbook/xslt/db2latex/dedication.mod.xsl +++ b/docs/docbook/xslt/db2latex/dedication.mod.xsl @@ -1,8 +1,6 @@ @@ -19,7 +17,6 @@ - $Id: dedication.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/dingbat.mod.xsl b/docs/docbook/xslt/db2latex/dingbat.mod.xsl index 86b2f25b30..84b579515a 100644 --- a/docs/docbook/xslt/db2latex/dingbat.mod.xsl +++ b/docs/docbook/xslt/db2latex/dingbat.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: email.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/errors.mod.xsl b/docs/docbook/xslt/db2latex/errors.mod.xsl index 466f052c7f..37b273c01d 100644 --- a/docs/docbook/xslt/db2latex/errors.mod.xsl +++ b/docs/docbook/xslt/db2latex/errors.mod.xsl @@ -1,9 +1,7 @@ diff --git a/docs/docbook/xslt/db2latex/example.mod.xsl b/docs/docbook/xslt/db2latex/example.mod.xsl index 6f67df52bf..fb973a27e7 100644 --- a/docs/docbook/xslt/db2latex/example.mod.xsl +++ b/docs/docbook/xslt/db2latex/example.mod.xsl @@ -1,8 +1,6 @@ @@ -19,7 +17,6 @@ - $Id: example.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/figure.mod.xsl b/docs/docbook/xslt/db2latex/figure.mod.xsl index f23689608a..823877aa17 100644 --- a/docs/docbook/xslt/db2latex/figure.mod.xsl +++ b/docs/docbook/xslt/db2latex/figure.mod.xsl @@ -1,8 +1,6 @@ @@ -17,7 +15,6 @@ - $Id: figure.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/font.mod.xsl b/docs/docbook/xslt/db2latex/font.mod.xsl index c66d6aab37..20e2814520 100644 --- a/docs/docbook/xslt/db2latex/font.mod.xsl +++ b/docs/docbook/xslt/db2latex/font.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: font.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/footnote.mod.xsl b/docs/docbook/xslt/db2latex/footnote.mod.xsl index 1fb23dfbeb..6e7d39a36a 100644 --- a/docs/docbook/xslt/db2latex/footnote.mod.xsl +++ b/docs/docbook/xslt/db2latex/footnote.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: footnote.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/formal.mod.xsl b/docs/docbook/xslt/db2latex/formal.mod.xsl index 6c3ea3ff55..6908119225 100644 --- a/docs/docbook/xslt/db2latex/formal.mod.xsl +++ b/docs/docbook/xslt/db2latex/formal.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: formal.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/glossary.mod.xsl b/docs/docbook/xslt/db2latex/glossary.mod.xsl index a88fe609c2..f429187aee 100644 --- a/docs/docbook/xslt/db2latex/glossary.mod.xsl +++ b/docs/docbook/xslt/db2latex/glossary.mod.xsl @@ -1,8 +1,6 @@ @@ -19,7 +17,6 @@ - $Id: glossary.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/graphic.mod.xsl b/docs/docbook/xslt/db2latex/graphic.mod.xsl index 89799dbbb9..1c9845c93e 100644 --- a/docs/docbook/xslt/db2latex/graphic.mod.xsl +++ b/docs/docbook/xslt/db2latex/graphic.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: graphic.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/html.mod.xsl b/docs/docbook/xslt/db2latex/html.mod.xsl index fade6e7e78..a94ac3c80f 100644 --- a/docs/docbook/xslt/db2latex/html.mod.xsl +++ b/docs/docbook/xslt/db2latex/html.mod.xsl @@ -1,9 +1,7 @@ @@ -18,7 +16,6 @@ - $Id: index.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/info.mod.xsl b/docs/docbook/xslt/db2latex/info.mod.xsl index 3b8bb5162a..a2a35d4629 100644 --- a/docs/docbook/xslt/db2latex/info.mod.xsl +++ b/docs/docbook/xslt/db2latex/info.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: info.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/inline.mod.xsl b/docs/docbook/xslt/db2latex/inline.mod.xsl index 5661ca4385..5a6d8cc214 100644 --- a/docs/docbook/xslt/db2latex/inline.mod.xsl +++ b/docs/docbook/xslt/db2latex/inline.mod.xsl @@ -1,8 +1,6 @@ @@ -17,7 +15,6 @@ - $Id: inline.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/keywords.mod.xsl b/docs/docbook/xslt/db2latex/keywords.mod.xsl index c3fd7376b5..80d5457199 100644 --- a/docs/docbook/xslt/db2latex/keywords.mod.xsl +++ b/docs/docbook/xslt/db2latex/keywords.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: keywords.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/labelid.mod.xsl b/docs/docbook/xslt/db2latex/labelid.mod.xsl index 7f8206321f..5305e07c5a 100644 --- a/docs/docbook/xslt/db2latex/labelid.mod.xsl +++ b/docs/docbook/xslt/db2latex/labelid.mod.xsl @@ -1,8 +1,6 @@ @@ -20,7 +18,6 @@ - $Id: latex.mapping.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ RamonCasellas diff --git a/docs/docbook/xslt/db2latex/lists.mod.xsl b/docs/docbook/xslt/db2latex/lists.mod.xsl index 29afd0f58d..cdd093b3d0 100644 --- a/docs/docbook/xslt/db2latex/lists.mod.xsl +++ b/docs/docbook/xslt/db2latex/lists.mod.xsl @@ -1,8 +1,6 @@ @@ -19,7 +17,6 @@ - $Id: lists.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/mathelem.mod.xsl b/docs/docbook/xslt/db2latex/mathelem.mod.xsl index 66e7089413..2b085aa98d 100644 --- a/docs/docbook/xslt/db2latex/mathelem.mod.xsl +++ b/docs/docbook/xslt/db2latex/mathelem.mod.xsl @@ -1,8 +1,6 @@ @@ -19,7 +17,6 @@ - $Id: mediaobject.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/msgset.mod.xsl b/docs/docbook/xslt/db2latex/msgset.mod.xsl index aef046f665..52ad63a87c 100644 --- a/docs/docbook/xslt/db2latex/msgset.mod.xsl +++ b/docs/docbook/xslt/db2latex/msgset.mod.xsl @@ -1,9 +1,7 @@ diff --git a/docs/docbook/xslt/db2latex/normalize-scape.mod.xsl b/docs/docbook/xslt/db2latex/normalize-scape.mod.xsl index 15e2e94e25..058695d71d 100644 --- a/docs/docbook/xslt/db2latex/normalize-scape.mod.xsl +++ b/docs/docbook/xslt/db2latex/normalize-scape.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: part-chap-app.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas @@ -56,9 +53,7 @@ @@ -103,9 +98,7 @@ diff --git a/docs/docbook/xslt/db2latex/pi.mod.xsl b/docs/docbook/xslt/db2latex/pi.mod.xsl index fe84aa446e..a4409583c8 100644 --- a/docs/docbook/xslt/db2latex/pi.mod.xsl +++ b/docs/docbook/xslt/db2latex/pi.mod.xsl @@ -1,8 +1,6 @@ @@ -20,7 +18,6 @@ - $Id: pi.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/preamble.mod.xsl b/docs/docbook/xslt/db2latex/preamble.mod.xsl index 3e66f33c16..ec9e5a8afc 100644 --- a/docs/docbook/xslt/db2latex/preamble.mod.xsl +++ b/docs/docbook/xslt/db2latex/preamble.mod.xsl @@ -1,8 +1,6 @@ @@ -15,7 +13,6 @@ - $Id: preamble.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/preface.mod.xsl b/docs/docbook/xslt/db2latex/preface.mod.xsl index 90d30f09cf..d56c0ec5cb 100644 --- a/docs/docbook/xslt/db2latex/preface.mod.xsl +++ b/docs/docbook/xslt/db2latex/preface.mod.xsl @@ -1,8 +1,6 @@ @@ -19,7 +17,6 @@ - $Id: preface.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/procedure.mod.xsl b/docs/docbook/xslt/db2latex/procedure.mod.xsl index 3fca796151..c53cf39c68 100644 --- a/docs/docbook/xslt/db2latex/procedure.mod.xsl +++ b/docs/docbook/xslt/db2latex/procedure.mod.xsl @@ -1,8 +1,6 @@ @@ -19,7 +17,6 @@ - $Id: procedure.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/qandaset.mod.xsl b/docs/docbook/xslt/db2latex/qandaset.mod.xsl index c6363e4782..c93d56e6b3 100644 --- a/docs/docbook/xslt/db2latex/qandaset.mod.xsl +++ b/docs/docbook/xslt/db2latex/qandaset.mod.xsl @@ -1,8 +1,6 @@ - $Id: qandaset.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas James Devenish diff --git a/docs/docbook/xslt/db2latex/refentry.mod.xsl b/docs/docbook/xslt/db2latex/refentry.mod.xsl index dc1a7c440c..52d2b297d5 100644 --- a/docs/docbook/xslt/db2latex/refentry.mod.xsl +++ b/docs/docbook/xslt/db2latex/refentry.mod.xsl @@ -1,8 +1,6 @@ @@ -19,7 +17,6 @@ - $Id: refentry.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/revision.mod.xsl b/docs/docbook/xslt/db2latex/revision.mod.xsl index c1b39cee48..a041aed5c3 100644 --- a/docs/docbook/xslt/db2latex/revision.mod.xsl +++ b/docs/docbook/xslt/db2latex/revision.mod.xsl @@ -1,8 +1,6 @@ @@ -19,7 +17,6 @@ - $Id: revision.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/sections.mod.xsl b/docs/docbook/xslt/db2latex/sections.mod.xsl index f81524d51d..2e74ce3890 100644 --- a/docs/docbook/xslt/db2latex/sections.mod.xsl +++ b/docs/docbook/xslt/db2latex/sections.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: set.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/sgmltag.mod.xsl b/docs/docbook/xslt/db2latex/sgmltag.mod.xsl index 8c0c57d83f..893a2b6d4d 100644 --- a/docs/docbook/xslt/db2latex/sgmltag.mod.xsl +++ b/docs/docbook/xslt/db2latex/sgmltag.mod.xsl @@ -1,8 +1,6 @@ @@ -19,7 +17,6 @@ - $Id: sgmltag.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/synop-oop.mod.xsl b/docs/docbook/xslt/db2latex/synop-oop.mod.xsl index 1b5d660aac..93b29c1229 100644 --- a/docs/docbook/xslt/db2latex/synop-oop.mod.xsl +++ b/docs/docbook/xslt/db2latex/synop-oop.mod.xsl @@ -2,9 +2,7 @@ ]> diff --git a/docs/docbook/xslt/db2latex/synop-struct.mod.xsl b/docs/docbook/xslt/db2latex/synop-struct.mod.xsl index 1fef51e62e..1ffe2fc463 100644 --- a/docs/docbook/xslt/db2latex/synop-struct.mod.xsl +++ b/docs/docbook/xslt/db2latex/synop-struct.mod.xsl @@ -1,8 +1,6 @@ diff --git a/docs/docbook/xslt/db2latex/table.mod.xsl b/docs/docbook/xslt/db2latex/table.mod.xsl index 31085b9093..0edb4ad2cc 100644 --- a/docs/docbook/xslt/db2latex/table.mod.xsl +++ b/docs/docbook/xslt/db2latex/table.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: table.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/texmath.mod.xsl b/docs/docbook/xslt/db2latex/texmath.mod.xsl index 84becee530..47036c56ac 100644 --- a/docs/docbook/xslt/db2latex/texmath.mod.xsl +++ b/docs/docbook/xslt/db2latex/texmath.mod.xsl @@ -1,8 +1,6 @@ @@ -20,7 +18,6 @@ - $Id: texmath.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/vars.mod.xsl b/docs/docbook/xslt/db2latex/vars.mod.xsl index 764c3a0a95..e20fb59ce2 100644 --- a/docs/docbook/xslt/db2latex/vars.mod.xsl +++ b/docs/docbook/xslt/db2latex/vars.mod.xsl @@ -1,8 +1,6 @@ @@ -15,7 +13,6 @@ - $Id: vars.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ CasellasRamon @@ -43,7 +40,6 @@ java @@ -180,7 +176,6 @@ @@ -859,7 +854,6 @@ diff --git a/docs/docbook/xslt/db2latex/verbatim.mod.xsl b/docs/docbook/xslt/db2latex/verbatim.mod.xsl index a5bb09099a..549883869b 100644 --- a/docs/docbook/xslt/db2latex/verbatim.mod.xsl +++ b/docs/docbook/xslt/db2latex/verbatim.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: verbatim.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/docbook/xslt/db2latex/xref.mod.xsl b/docs/docbook/xslt/db2latex/xref.mod.xsl index ecd03153cb..82289b19df 100644 --- a/docs/docbook/xslt/db2latex/xref.mod.xsl +++ b/docs/docbook/xslt/db2latex/xref.mod.xsl @@ -1,8 +1,6 @@ @@ -19,7 +17,6 @@ -$Id: xref.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ CasellasRamon diff --git a/docs/docbook/xslt/html-chunk.xsl b/docs/docbook/xslt/html-chunk.xsl index 2bc8b426b5..00b310610a 100644 --- a/docs/docbook/xslt/html-chunk.xsl +++ b/docs/docbook/xslt/html-chunk.xsl @@ -11,4 +11,4 @@ - \ No newline at end of file + diff --git a/docs/docbook/xslt/html-common.xsl b/docs/docbook/xslt/html-common.xsl index 03fa5d5ec1..ecb8a08662 100644 --- a/docs/docbook/xslt/html-common.xsl +++ b/docs/docbook/xslt/html-common.xsl @@ -19,4 +19,4 @@ ..html - \ No newline at end of file + diff --git a/docs/docbook/xslt/html.xsl b/docs/docbook/xslt/html.xsl index c5d8db89ed..8481a86d24 100644 --- a/docs/docbook/xslt/html.xsl +++ b/docs/docbook/xslt/html.xsl @@ -6,4 +6,4 @@ - \ No newline at end of file + diff --git a/docs/docbook/xslt/latex.xsl b/docs/docbook/xslt/latex.xsl index 158c5879db..8fafd5d140 100644 --- a/docs/docbook/xslt/latex.xsl +++ b/docs/docbook/xslt/latex.xsl @@ -6,7 +6,7 @@ xslt/latex/sambadoc -english,final,titlepage +english,final,titlepage,parskip hyperfigures,hyperindex,citecolor=blue,urlcolor=blue default diff --git a/docs/docbook/xslt/latex/sambadoc.cls b/docs/docbook/xslt/latex/sambadoc.cls index e03dcf7a24..9f3caa5482 100644 --- a/docs/docbook/xslt/latex/sambadoc.cls +++ b/docs/docbook/xslt/latex/sambadoc.cls @@ -13,7 +13,6 @@ \DeclareOption{cpp}{\@usecppsyntaxtrue} \DeclareOption*{\PassOptionsToClass{\CurrentOption}{scrreprt}} \ProcessOptions -%\PassOptionsToClass{12pt}{scrreprt} \LoadClass{scrreprt} @@ -40,6 +39,12 @@ \def\marginpar#1{ \old@marginpar{\def\baselinestretch{1}\em\small #1}} +\renewcommand*{\scr@parskip}{% + \setlength{\parskip}{\baselineskip}% + \addtolength{\parskip}{\z@ \@plus .5\baselineskip}} + +\setlength\parindent{0pt} + %%--Parameters that can be set by the user. \def\samba@listtables{y} \def\samba@listfigures{y} diff --git a/docs/docbook/xslt/lists.mod.xsl b/docs/docbook/xslt/lists.mod.xsl index 5fbd02de3a..49e39d5e7f 100644 --- a/docs/docbook/xslt/lists.mod.xsl +++ b/docs/docbook/xslt/lists.mod.xsl @@ -1,8 +1,6 @@ diff --git a/docs/docbook/xslt/table.mod.xsl b/docs/docbook/xslt/table.mod.xsl index 336cac6dfb..b20752d91d 100644 --- a/docs/docbook/xslt/table.mod.xsl +++ b/docs/docbook/xslt/table.mod.xsl @@ -1,8 +1,6 @@ @@ -18,7 +16,6 @@ - $Id: table.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ Ramon Casellas diff --git a/docs/faq/FAQ-ClientApp.html b/docs/faq/FAQ-ClientApp.html index 3f680b78d7..6e37fbcba5 100644 --- a/docs/faq/FAQ-ClientApp.html +++ b/docs/faq/FAQ-ClientApp.html @@ -1,5 +1,4 @@ - -Chapter 4. Specific client application problems
Chapter 4. Specific client application problems
Prev   Next
Prev Up Next
Chapter 3. Configuration problems Home Chapter 5. Common errors
+

Prev Up Next
Chapter 2. Compiling and installing Samba on a Unix host Home Chapter 4. Common errors
diff --git a/docs/faq/FAQ-Install.html b/docs/faq/FAQ-Install.html index 411656bc76..0bb21ed543 100644 --- a/docs/faq/FAQ-Install.html +++ b/docs/faq/FAQ-Install.html @@ -1,55 +1,4 @@ - -Chapter 2. Compiling and installing Samba on a Unix host
Chapter 2. Compiling and installing Samba on a Unix host
Prev   Next

Chapter 2. Compiling and installing Samba on a Unix host

Table of Contents

I can't see the Samba server in any browse lists!
Some files that I KNOW are on the server don't show up when I view the files from my client!
Some files on the server show up with really wierd filenames when I view the files from my client!
My client reports "cannot locate specified computer" or similar
My client reports "cannot locate specified share name" or similar
Printing doesn't work
My client reports "This server is not configured to list shared resources"
Log message "you appear to have a trapdoor uid system"
Why are my file's timestamps off by an hour, or by a few hours?
How do I set the printer driver name correctly?

I can't see the Samba server in any browse lists!

-See Browsing.html in the docs directory of the samba source -for more information on browsing. -

-If your GUI client does not permit you to select non-browsable -servers, you may need to do so on the command line. For example, under -Lan Manager you might connect to the above service as disk drive M: -thusly: -

-   net use M: \\mary\fred
-

-The details of how to do this and the specific syntax varies from -client to client - check your client's documentation. -

Some files that I KNOW are on the server don't show up when I view the files from my client!

See the next question.

Some files on the server show up with really wierd filenames when I view the files from my client!

-If you check what files are not showing up, you will note that they -are files which contain upper case letters or which are otherwise not -DOS-compatible (ie, they are not legal DOS filenames for some reason). -

-The Samba server can be configured either to ignore such files -completely, or to present them to the client in "mangled" form. If you -are not seeing the files at all, the Samba server has most likely been -configured to ignore them. Consult the man page smb.conf(5) for -details of how to change this - the parameter you need to set is -"mangled names = yes". -

My client reports "cannot locate specified computer" or similar

-This indicates one of three things: You supplied an incorrect server -name, the underlying TCP/IP layer is not working correctly, or the -name you specified cannot be resolved. -

-After carefully checking that the name you typed is the name you -should have typed, try doing things like pinging a host or telnetting -to somewhere on your network to see if TCP/IP is functioning OK. If it -is, the problem is most likely name resolution. -

-If your client has a facility to do so, hardcode a mapping between the -hosts IP and the name you want to use. For example, with Lan Manager -or Windows for Workgroups you would put a suitable entry in the file -LMHOSTS. If this works, the problem is in the communication between -your client and the netbios name server. If it does not work, then -there is something fundamental wrong with your naming and the solution -is beyond the scope of this document. -

-If you do not have any server on your subnet supplying netbios name -resolution, hardcoded mappings are your only option. If you DO have a -netbios name server running (such as the Samba suite's nmbd program), -the problem probably lies in the way it is set up. Refer to Section -Two of this FAQ for more ideas. -

-By the way, remember to REMOVE the hardcoded mapping before further -tests :-) -

My client reports "cannot locate specified share name" or similar

+Chapter 2. Compiling and installing Samba on a Unix host

Chapter 2. Compiling and installing Samba on a Unix host
Prev   Next

Chapter 2. Compiling and installing Samba on a Unix host

Table of Contents

My client reports "cannot locate specified share name" or similar
Why are my file's timestamps off by an hour, or by a few hours?

My client reports "cannot locate specified share name" or similar

This message indicates that your client CAN locate the specified server, which is a good start, but that it cannot find a service of the name you gave. @@ -58,68 +7,7 @@ The first step is to check the exact name of the service you are trying to connect to (consult your system administrator). Assuming it exists and you specified it correctly (read your client's docs on how to specify a service name correctly), read on: -

Many clients cannot accept or use service names longer than eight characters.
Many clients cannot accept or use service names containing spaces.
Some servers (not Samba though) are case sensitive with service names.
Some clients force service names into upper case.

Printing doesn't work

-Make sure that the specified print command for the service you are -connecting to is correct and that it has a fully-qualified path (eg., -use "/usr/bin/lpr" rather than just "lpr"). -

-Make sure that the spool directory specified for the service is -writable by the user connected to the service. In particular the user -"nobody" often has problems with printing, even if it worked with an -earlier version of Samba. Try creating another guest user other than -"nobody". -

-Make sure that the user specified in the service is permitted to use -the printer. -

-Check the debug log produced by smbd. Search for the printer name and -see if the log turns up any clues. Note that error messages to do with -a service ipc$ are meaningless - they relate to the way the client -attempts to retrieve status information when using the LANMAN1 -protocol. -

-If using WfWg then you need to set the default protocol to TCP/IP, not -Netbeui. This is a WfWg bug. -

-If using the Lanman1 protocol (the default) then try switching to -coreplus. Also not that print status error messages don't mean -printing won't work. The print status is received by a different -mechanism. -

My client reports "This server is not configured to list shared resources"

-Your guest account is probably invalid for some reason. Samba uses the -guest account for browsing in smbd. Check that your guest account is -valid. -

See also 'guest account' in smb.conf man page.

Log message "you appear to have a trapdoor uid system"

-This can have several causes. It might be because you are using a uid -or gid of 65535 or -1. This is a VERY bad idea, and is a big security -hole. Check carefully in your /etc/passwd file and make sure that no -user has uid 65535 or -1. Especially check the "nobody" user, as many -broken systems are shipped with nobody setup with a uid of 65535. -

It might also mean that your OS has a trapdoor uid/gid system :-)

-This means that once a process changes effective uid from root to -another user it can't go back to root. Unfortunately Samba relies on -being able to change effective uid from root to non-root and back -again to implement its security policy. If your OS has a trapdoor uid -system this won't work, and several things in Samba may break. Less -things will break if you use user or server level security instead of -the default share level security, but you may still strike -problems. -

-The problems don't give rise to any security holes, so don't panic, -but it does mean some of Samba's capabilities will be unavailable. -In particular you will not be able to connect to the Samba server as -two different uids at once. This may happen if you try to print as a -"guest" while accessing a share as a normal user. It may also affect -your ability to list the available shares as this is normally done as -the guest user. -

-Complain to your OS vendor and ask them to fix their system. -

-Note: the reason why 65535 is a VERY bad choice of uid and gid is that -it casts to -1 as a uid, and the setreuid() system call ignores (with -no error) uid changes to -1. This means any daemon attempting to run -as uid 65535 will actually run as root. This is not good! -

Why are my file's timestamps off by an hour, or by a few hours?

+

Many clients cannot accept or use service names longer than eight characters.
Many clients cannot accept or use service names containing spaces.
Some servers (not Samba though) are case sensitive with service names.
Some clients force service names into upper case.

Why are my file's timestamps off by an hour, or by a few hours?

This is from Paul Eggert eggert@twinsun.com.

Most likely it's a problem with your time zone settings. @@ -173,22 +61,4 @@ time zone is also set appropriately. [[I don't know how to do this.]] Samba traditionally has had many problems dealing with time zones, due to the bizarre ways that Microsoft network protocols handle time zones. -

How do I set the printer driver name correctly?

Question: -“ On NT, I opened "Printer Manager" and "Connect to Printer". - Enter ["\\ptdi270\ps1"] in the box of printer. I got the - following error message - ”

- 

-     You do not have sufficient access to your machine
-     to connect to the selected printer, since a driver
-     needs to be installed locally.
-

-

Answer:

In the more recent versions of Samba you can now set the "printer -driver" in smb.conf. This tells the client what driver to use. For -example:

-     printer driver = HP LaserJet 4L
-

With this, NT knows to use the right driver. You have to get this string -exactly right.

To find the exact string to use, you need to get to the dialog box in -your client where you select which printer driver to install. The -correct strings for all the different printers are shown in a listbox -in that dialog box.

Prev Up Next
Chapter 1. General Information Home Chapter 3. Configuration problems
+

Prev Up Next
Chapter 1. General Information Home Chapter 3. Specific client application problems
diff --git a/docs/faq/FAQ-errors.html b/docs/faq/FAQ-errors.html index c2ec7e719b..f0c4b9aa0c 100644 --- a/docs/faq/FAQ-errors.html +++ b/docs/faq/FAQ-errors.html @@ -1,5 +1,4 @@ - -Chapter 5. Common errors
Chapter 5. Common errors
Prev   Next

Chapter 5. Common errors

Table of Contents

Not listening for calling name
System Error 1240
smbclient ignores -N !
The data on the CD-Drive I've shared seems to be corrupted!
Why can users access home directories of other users?
Until a few minutes after samba has started, clients get the error "Domain Controller Unavailable"
I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

Not listening for calling name

+Chapter 4. Common errors

Chapter 4. Common errors
Prev   Next

Chapter 4. Common errors

Table of Contents

Not listening for calling name
System Error 1240
smbclient ignores -N !
The data on the CD-Drive I've shared seems to be corrupted!

Not listening for calling name

 Session request failed (131,129) with myname=HOBBES destname=CALVIN
 Not listening for calling name
@@ -15,85 +14,39 @@ global section of smb.conf.
 It can also be a problem with reverse DNS lookups not functioning 
 correctly, leading to the remote host identity not being able to
 be confirmed, but that is less likely.
-

System Error 1240

+

System Error 1240

System error 1240 means that the client is refusing to talk to a non-encrypting server. Microsoft changed WinNT in service pack 3 to refuse to connect to servers that do not support SMB password encryption.

There are two main solutions:

enable SMB password encryption in Samba. See the encryption part of -the samba HOWTO Collection
disable this new behaviour in NT. See the section about +the samba HOWTO Collection
disable this behaviour in NT. See the section about Windows NT in the chapter "Portability" of the samba HOWTO collection

-

smbclient ignores -N !

-“When getting the list of shares available on a host using the command -smbclient -N -L +

smbclient ignores -N !

+“When getting the list of shares available on a host using the command +smbclient -N -L the program always prompts for the password if the server is a Samba server. It also ignores the "-N" argument when querying some (but not all) of our NT servers. -” +”

No, it does not ignore -N, it is just that your server rejected the null password in the connection, so smbclient prompts for a password to try again.

-To get the behaviour that you probably want use smbclient -L host -U% +To get the behaviour that you probably want use smbclient -L host -U%

This will set both the username and password to null, which is an anonymous login for SMB. Using -N would only set the password to null, and this is not accepted as an anonymous login for most SMB servers. -

The data on the CD-Drive I've shared seems to be corrupted!

+

The data on the CD-Drive I've shared seems to be corrupted!

Some OSes (notably Linux) default to auto detection of file type on cdroms and do cr/lf translation. This is a very bad idea when use with Samba. It causes all sorts of stuff ups.

To overcome this problem use conv=binary when mounting the cdrom before exporting it with Samba. -

Why can users access home directories of other users?

-“ -We are unable to keep individual users from mapping to any other user's -home directory once they have supplied a valid password! They only need -to enter their own password. I have not found *any* method that I can -use to configure samba to enforce that only a user may map their own -home directory. -” -

“ -User xyzzy can map his home directory. Once mapped user xyzzy can also map -*anyone* elses home directory! -”

-This is not a security flaw, it is by design. Samba allows -users to have *exactly* the same access to the UNIX filesystem -as they would if they were logged onto the UNIX box, except -that it only allows such views onto the file system as are -allowed by the defined shares. -

-This means that if your UNIX home directories are set up -such that one user can happily cd into another users -directory and do an ls, the UNIX security solution is to -change the UNIX file permissions on the users home directories -such that the cd and ls would be denied. -

-Samba tries very hard not to second guess the UNIX administrators -security policies, and trusts the UNIX admin to set -the policies and permissions he or she desires. -

-Samba does allow the setup you require when you have set the -"only user = yes" option on the share, is that you have not set the -valid users list for the share. -

-Note that only user works in conjunction with the users= list, -so to get the behavior you require, add the line : -

-users = %S
-

-this is equivalent to: -

-valid users = %S
-

-to the definition of the [homes] share, as recommended in -the smb.conf man page. -

Until a few minutes after samba has started, clients get the error "Domain Controller Unavailable"

-A domain controller has to announce on the network who it is. This usually takes a while. -

I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

Your loopback device isn't working correctly. Make sure it's running. -

Prev Up Next
Chapter 4. Specific client application problems Home Chapter 6. Features
+

Prev Up Next
Chapter 3. Specific client application problems Home Chapter 5. Features
diff --git a/docs/faq/FAQ-features.html b/docs/faq/FAQ-features.html index 9bcd8437b8..75faf8d9bc 100644 --- a/docs/faq/FAQ-features.html +++ b/docs/faq/FAQ-features.html @@ -1,47 +1,8 @@ - -Chapter 6. Features
Chapter 6. Features
Prev   Next

Chapter 6. Features

Table of Contents

How can I prevent my samba server from being used to distribute the Nimda worm?
How can I use samba as a fax server?
Tools for printing faxes
Making the fax-server
Installing the client drivers
Example smb.conf
Samba doesn't work well together with DHCP!
How can I assign NetBIOS names to clients with DHCP?
How do I convert between unix and dos text formats?
Does samba have wins replication support?

How can I prevent my samba server from being used to distribute the Nimda worm?

Author: HASEGAWA Yosuke (translated by TAKAHASHI Motonobu)

-Nimba Worm is infected through shared disks on a network, as well as through -Microsoft IIS, Internet Explorer and mailer of Outlook series. -

-At this time, the worm copies itself by the name *.nws and *.eml on -the shared disk, moreover, by the name of Riched20.dll in the folder -where *.doc file is included. -

-To prevent infection through the shared disk offered by Samba, set -up as follows: -

-

-[global]
-  ...
-  # This can break Administration installations of Office2k.
-  # in that case, don't veto the riched20.dll
-  veto files = /*.eml/*.nws/riched20.dll/
-

-

-By setting the "veto files" parameter, matched files on the Samba -server are completely hidden from the clients and making it impossible -to access them at all. -

-In addition to it, the following setting is also pointed out by the -samba-jp:09448 thread: when the -"readme.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}" file exists on -a Samba server, it is visible only as "readme.txt" and dangerous -code may be executed if this file is double-clicked. -

-Setting the following, -

-  veto files = /*.{*}/
-

-any files having CLSID in its file extension will be inaccessible from any -clients. -

-This technical article is created based on the discussion of -samba-jp:09448 and samba-jp:10900 threads. -

How can I use samba as a fax server?

Contributor: Gerhard Zuber

Requirements: +Chapter 5. Features

Chapter 5. Features
Prev   

Chapter 5. Features

Table of Contents

How can I use samba as a fax server?
Tools for printing faxes
Making the fax-server
Installing the client drivers
Example smb.conf
Samba doesn't work well together with DHCP!
How can I assign NetBIOS names to clients with DHCP?
How do I convert between unix and dos text formats?
Does samba have wins replication support?

How can I use samba as a fax server?

Contributor: Gerhard Zuber

Requirements:

UNIX box (Linux preferred) with SAMBA and a faxmodem
ghostscript package
mgetty+sendfax package
pbm package (portable bitmap tools)

First, install and configure the required packages. Be sure to read the mgetty+sendfax -manual carefully.

Tools for printing faxes

Your incomed faxes are in: -/var/spool/fax/incoming. Print it with:

+manual carefully.
Tools for printing faxes
Your incomed faxes are in:
+/var/spool/fax/incoming. Print it with:
 for i in *
 do
 g3cat $i | g3tolj | lpr -P hp
@@ -52,9 +13,9 @@ g3cat is in the tools-section, g3tolj is in the contrib-section
 for printing to HP lasers.
 

 If you want to produce files for displaying and printing with Windows, use
-some tools from the pbm-package like the following command: g3cat $i | g3topbm - |  ppmtopcx - >$i.pcx
+some tools from the pbm-package like the following command: g3cat $i | g3topbm - |  ppmtopcx - >$i.pcx
 and view it with your favourite Windows tool (maybe paintbrush)
-
Making the fax-server
fetch the file mgetty+sendfax/frontends/winword/faxfilter and place it in /usr/local/etc/mgetty+sendfax/(replace /usr/local/ with whatever place you installed mgetty+sendfax)
prepare your faxspool file as mentioned in this file
+
Making the fax-server
fetch the file mgetty+sendfax/frontends/winword/faxfilter and place it in /usr/local/etc/mgetty+sendfax/(replace /usr/local/ with whatever place you installed mgetty+sendfax)
prepare your faxspool file as mentioned in this file
 edit fax/faxspool.in and reinstall or change the final
 /usr/local/bin/faxspool too.
 
@@ -63,7 +24,7 @@ if [ "$user" = "root" -o "$user" = "fax"
 
find the first line and change it to the second.

 make sure you have pbmtext (from the pbm-package). This is
 needed for creating the small header line on each page.
-
Prepare your faxheader /usr/local/etc/mgetty+sendfax/faxheader

+
Prepare your faxheader /usr/local/etc/mgetty+sendfax/faxheader

 Edit your /etc/printcap file:
 
 # FAX 
@@ -72,7 +33,7 @@ lp3|fax:\
         :sd=/usr/spool/lp3:\
         :if=/usr/local/etc/mgetty+sendfax/faxfilter:sh:sf:mx#0:\
         :lf=/usr/spool/lp3/fax-log:
-
Now, edit your smb.conf so you have a smb based printer named "fax"
Installing the client drivers

+

Now, edit your smb.conf so you have a smb based printer named "fax"

Installing the client drivers

Now you have a printer called "fax" which can be used via TCP/IP-printing (lpd-system) or via SAMBA (windows printing).

@@ -111,7 +72,7 @@ uses the found number as the fax-destination-number. Now print your fax through the fax-printer and it will be queued for later transmission. Use faxrunq for sending the queue out. -

Example smb.conf

+

Example smb.conf

 [global]
  printcap name = /etc/printcap
  print command = /usr/bin/lpr -r -P %p %s
@@ -127,7 +88,7 @@ queue out.
     create mode = 0700
     browseable = yes
     guest ok = no
-

Samba doesn't work well together with DHCP!

+

Samba doesn't work well together with DHCP!

We wish to help those folks who wish to use the ISC DHCP Server and provide sample configuration settings. Most operating systems today come ship with the ISC DHCP Server. ISC DHCP is available from: @@ -180,14 +141,14 @@ applied to the resulting DHCP offered settings UNLESS the DHCP server also sets a NetBIOS Scope. It may therefore be prudent to forcibly apply a NULL NetBIOS Scope from your DHCP server. The can be done in the dhcpd.conf file with the parameter: -option netbios-scope ""; +option netbios-scope "";

While it is true that the Microsoft DHCP server that comes with Windows NT Server provides only a sub-set of rfc1533 functionality this is hardly an issue in those sites that already have a large investment and commitment to Unix systems and technologies. The current state of the art of the DHCP Server specification in covered in rfc2132. -

How can I assign NetBIOS names to clients with DHCP?

+

How can I assign NetBIOS names to clients with DHCP?

SMB network clients need to be configured so that all standard TCP/IP name to address resolution works correctly. Once this has been achieved the SMB environment provides additional tools and services that act as helper agents in @@ -202,13 +163,13 @@ This can be done, but needs a few NT registry hacks and you need to be able to speak UNICODE, which is of course no problem for a True Wizzard(tm) :) Instructions on how to do this (including a small util for less capable Wizzards) can be found at -

http://www.unixtools.org/~nneul/sw/nt/dhcp-netbios-hostname.html

How do I convert between unix and dos text formats?

+

http://www.unixtools.org/~nneul/sw/nt/dhcp-netbios-hostname.html

How do I convert between unix and dos text formats?

Jim barry has written an excellent drag-and-drop cr/lf converter for windows. Just drag your file onto the icon and it converts the file.

The utilities unix2dos and dos2unix(in the mtools package) should do the job under unix. -

Does samba have wins replication support?

+

Does samba have wins replication support?

At the time of writing there is currently being worked on a wins replication implementation(wrepld). -

Prev Up Next
Chapter 5. Common errors Home Chapter 7. Printing problems
+

Prev Up 
Chapter 4. Common errors Home 
diff --git a/docs/faq/FAQ-general.html b/docs/faq/FAQ-general.html index 0e6cae78d8..4019fb52c6 100644 --- a/docs/faq/FAQ-general.html +++ b/docs/faq/FAQ-general.html @@ -1,7 +1,4 @@ - -Chapter 1. General Information
Chapter 1. General Information
Prev   Next

Chapter 1. General Information

Table of Contents

Where can I get it?
What do the version numbers mean?
What platforms are supported?
How do I subscribe to the Samba Mailing Lists?

Where can I get it?

-The Samba suite is available at the samba website. -

What do the version numbers mean?

+Chapter 1. General Information

Chapter 1. General Information
Prev   Next

Chapter 1. General Information

Table of Contents

What do the version numbers mean?
What platforms are supported?
How do I subscribe to the Samba Mailing Lists?

What do the version numbers mean?

It is not recommended that you run a version of Samba with the word "alpha" in its name unless you know what you are doing and are willing to do some debugging. Many, many people just get the latest @@ -40,11 +37,11 @@ The above system means that whenever someone looks at the samba ftp site they will be able to grab the highest numbered release without an alpha in the name and be sure of getting the current recommended version. -

What platforms are supported?

+

What platforms are supported?

Many different platforms have run Samba successfully. The platforms most widely used and thus best tested are Linux and SunOS.

At time of writing, there is support (or has been support for in earlier versions): -

A/UX 3.0
AIX
Altos Series 386/1000
Amiga
Apollo Domain/OS sr10.3
BSDI
B.O.S. (Bull Operating System)
Cray, Unicos 8.0
Convex
DGUX.
DNIX.
FreeBSD
HP-UX
Intergraph.
Linux with/without shadow passwords and quota
LYNX 2.3.0
MachTen (a unix like system for Macintoshes)
Motorola 88xxx/9xx range of machines
NetBSD
NEXTSTEP Release 2.X, 3.0 and greater (including OPENSTEP for Mach).
OS/2 using EMX 0.9b
OSF1
QNX 4.22
RiscIX.
RISCOs 5.0B
SEQUENT.
SCO (including: 3.2v2, European dist., OpenServer 5)
SGI.
SMP_DC.OSx v1.1-94c079 on Pyramid S series
SONY NEWS, NEWS-OS (4.2.x and 6.1.x)
SUNOS 4
SUNOS 5.2, 5.3, and 5.4 (Solaris 2.2, 2.3, and '2.4 and later')
Sunsoft ISC SVR3V4
SVR4
System V with some berkely extensions (Motorola 88k R32V3.2).
ULTRIX.
UNIXWARE
UXP/DS

How do I subscribe to the Samba Mailing Lists?

+

A/UX 3.0
AIX
Altos Series 386/1000
Amiga
Apollo Domain/OS sr10.3
BSDI
B.O.S. (Bull Operating System)
Cray, Unicos 8.0
Convex
DGUX.
DNIX.
FreeBSD
HP-UX
Intergraph.
Linux with/without shadow passwords and quota
LYNX 2.3.0
MachTen (a unix like system for Macintoshes)
Motorola 88xxx/9xx range of machines
NetBSD
NEXTSTEP Release 2.X, 3.0 and greater (including OPENSTEP for Mach).
OS/2 using EMX 0.9b
OSF1
QNX 4.22
RiscIX.
RISCOs 5.0B
SEQUENT.
SCO (including: 3.2v2, European dist., OpenServer 5)
SGI.
SMP_DC.OSx v1.1-94c079 on Pyramid S series
SONY NEWS, NEWS-OS (4.2.x and 6.1.x)
SUNOS 4
SUNOS 5.2, 5.3, and 5.4 (Solaris 2.2, 2.3, and '2.4 and later')
Sunsoft ISC SVR3V4
SVR4
System V with some berkely extensions (Motorola 88k R32V3.2).
ULTRIX.
UNIXWARE
UXP/DS

How do I subscribe to the Samba Mailing Lists?

Look at the samba mailing list page

Prev Up Next
Samba FAQ Home Chapter 2. Compiling and installing Samba on a Unix host
diff --git a/docs/faq/samba-faq.html b/docs/faq/samba-faq.html index d9c14289b1..368b4b6e41 100644 --- a/docs/faq/samba-faq.html +++ b/docs/faq/samba-faq.html @@ -1,5 +1,4 @@ - -Samba FAQ
Samba FAQ
   Next

Samba FAQ

Samba Team

October 2002

Dedication

+Samba FAQ

Samba FAQ
   Next

Samba FAQ

Samba Team

October 2002

Dedication

This is the Frequently Asked Questions (FAQ) document for Samba, the free and very popular SMB server product. An SMB server allows file and printer connections from clients such as Windows, @@ -8,4 +7,4 @@ corrections to the samba documentation mailinglist at samba-doc@samba.org. This FAQ was based on the old Samba FAQ by Dan Shearer and Paul Blackman, and the old samba text documents which were mostly written by John Terpstra. -

Table of Contents

1. General Information
Where can I get it?
What do the version numbers mean?
What platforms are supported?
How do I subscribe to the Samba Mailing Lists?
2. Compiling and installing Samba on a Unix host
I can't see the Samba server in any browse lists!
Some files that I KNOW are on the server don't show up when I view the files from my client!
Some files on the server show up with really wierd filenames when I view the files from my client!
My client reports "cannot locate specified computer" or similar
My client reports "cannot locate specified share name" or similar
Printing doesn't work
My client reports "This server is not configured to list shared resources"
Log message "you appear to have a trapdoor uid system"
Why are my file's timestamps off by an hour, or by a few hours?
How do I set the printer driver name correctly?
3. Configuration problems
I have set 'force user' and samba still makes 'root' the owner of all the files I touch!
I have just installed samba and I'm trying to log in from Windows, but samba refuses all logins!
How can I make samba use netbios scope ID's
4. Specific client application problems
MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"
How to use a Samba share as an administrative share for MS Office, etc.
Microsoft Access database opening errors
5. Common errors
Not listening for calling name
System Error 1240
smbclient ignores -N !
The data on the CD-Drive I've shared seems to be corrupted!
Why can users access home directories of other users?
Until a few minutes after samba has started, clients get the error "Domain Controller Unavailable"
I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs
6. Features
How can I prevent my samba server from being used to distribute the Nimda worm?
How can I use samba as a fax server?
Tools for printing faxes
Making the fax-server
Installing the client drivers
Example smb.conf
Samba doesn't work well together with DHCP!
How can I assign NetBIOS names to clients with DHCP?
How do I convert between unix and dos text formats?
Does samba have wins replication support?
7. Printing problems
setdriver or cupsaddsmb failes
   Next
   Chapter 1. General Information
+

Table of Contents

1. General Information
What do the version numbers mean?
What platforms are supported?
How do I subscribe to the Samba Mailing Lists?
2. Compiling and installing Samba on a Unix host
My client reports "cannot locate specified share name" or similar
Why are my file's timestamps off by an hour, or by a few hours?
3. Specific client application problems
MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"
How to use a Samba share as an administrative share for MS Office, etc.
Microsoft Access database opening errors
4. Common errors
Not listening for calling name
System Error 1240
smbclient ignores -N !
The data on the CD-Drive I've shared seems to be corrupted!
5. Features
How can I use samba as a fax server?
Tools for printing faxes
Making the fax-server
Installing the client drivers
Example smb.conf
Samba doesn't work well together with DHCP!
How can I assign NetBIOS names to clients with DHCP?
How do I convert between unix and dos text formats?
Does samba have wins replication support?
   Next
   Chapter 1. General Information
diff --git a/docs/htmldocs/Samba-Developers-Guide.html b/docs/htmldocs/Samba-Developers-Guide.html index cc12fe60f8..603c87d574 100644 --- a/docs/htmldocs/Samba-Developers-Guide.html +++ b/docs/htmldocs/Samba-Developers-Guide.html @@ -1,5 +1,22 @@ -SAMBA Developers Guide

SAMBA Developers Guide

SAMBA Team

Abstract

-Last Update : Mon Sep 30 15:23:53 CDT 2002 +SAMBA Developers Guide

SAMBA Developers Guide

SAMBA Team

Attributions.  +

Definition of NetBIOS Protocol and Name Resolution Modes

  • Luke Leighton

Samba Architecture

  • Dan Shearer

The samba DEBUG system

  • Chris Hertel

Coding Suggestions

  • Steve French

  • Simo Sorce

  • Andrew Bartlett

  • Tim Potter

  • Martin Pool

Samba Internals
The smb.conf file

  • Chris Hertel

NetBIOS in a Unix World

  • Andrew Tridgell

Tracing samba system calls

  • Andrew Tridgell

Finding useful information on windows
NT Domain RPC's
Samba Printing Internals

  • Gerald Carter

Samba WINS Internals

  • Gerald Carter

The Upcoming SAM System

  • Andrew Bartlett

LanMan and NT Password Encryption
Modules
RPC Pluggable Modules
VFS Modules
Notes to packagers

  • Jelmer Vernooij

Contributing code

+ +

Abstract

+Last Update : Fri Jun 6 00:45:54 CEST 2003

This book is a collection of documents that might be useful for people developing samba or those interested in doing so. @@ -7,20 +24,20 @@ It's nothing more than a collection of documents written by samba developers abo the internals of various parts of samba and the SMB protocol. It's still incomplete. The most recent version of this document can be found at http://devel.samba.org/. -Please send updates to Jelmer Veenrooij. +Please send updates to Jelmer Vernooij.

This documentation is distributed under the GNU General Public License (GPL) version 2. A copy of the license is included with the Samba source distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt -

Table of Contents

1. Definition of NetBIOS Protocol and Name Resolution Modes
NETBIOS
BROADCAST NetBIOS
NBNS NetBIOS
2. Samba Architecture
Introduction
Multithreading and Samba
Threading smbd
Threading nmbd
nbmd Design
3. The samba DEBUG system
New Output Syntax
The DEBUG() Macro
The DEBUGADD() Macro
The DEBUGLVL() Macro
New Functions
dbgtext()
dbghdr()
format_debug_text()
4. Coding Suggestions
5. Samba Internals
Character Handling
The new functions
Macros in byteorder.h
CVAL(buf,pos)
PVAL(buf,pos)
SCVAL(buf,pos,val)
SVAL(buf,pos)
IVAL(buf,pos)
SVALS(buf,pos)
IVALS(buf,pos)
SSVAL(buf,pos,val)
SIVAL(buf,pos,val)
SSVALS(buf,pos,val)
SIVALS(buf,pos,val)
RSVAL(buf,pos)
RIVAL(buf,pos)
RSSVAL(buf,pos,val)
RSIVAL(buf,pos,val)
LAN Manager Samba API
Parameters
Return value
Code character table
6. The smb.conf file
Lexical Analysis
Handling of Whitespace
Handling of Line Continuation
Line Continuation Quirks
Syntax
About params.c
7. NetBIOS in a Unix World
Introduction
Usernames
File Ownership
Passwords
Locking
Deny Modes
Trapdoor UIDs
Port numbers
Protocol Complexity
8. Tracing samba system calls
9. NT Domain RPC's
Introduction
Sources
Credits
Notes and Structures
Notes
Enumerations
Structures
MSRPC over Transact Named Pipe
MSRPC Pipes
Header
Tail
RPC Bind / Bind Ack
NTLSA Transact Named Pipe
LSA Open Policy
LSA Query Info Policy
LSA Enumerate Trusted Domains
LSA Open Secret
LSA Close
LSA Lookup SIDS
LSA Lookup Names
NETLOGON rpc Transact Named Pipe
LSA Request Challenge
LSA Authenticate 2
LSA Server Password Set
LSA SAM Logon
LSA SAM Logoff
\\MAILSLOT\NET\NTLOGON
Query for PDC
SAM Logon
SRVSVC Transact Named Pipe
Net Share Enum
Net Server Get Info
Cryptographic side of NT Domain Authentication
Definitions
Protocol
Comments
SIDs and RIDs
Well-known SIDs
Well-known RIDS
10. Samba Printing Internals
Abstract
+

Table of Contents

1. Definition of NetBIOS Protocol and Name Resolution Modes
NETBIOS
BROADCAST NetBIOS
NBNS NetBIOS
2. Samba Architecture
Introduction
Multithreading and Samba
Threading smbd
Threading nmbd
nbmd Design
3. The samba DEBUG system
New Output Syntax
The DEBUG() Macro
The DEBUGADD() Macro
The DEBUGLVL() Macro
New Functions
dbgtext()
dbghdr()
format_debug_text()
4. Coding Suggestions
5. Samba Internals
Character Handling
The new functions
Macros in byteorder.h
CVAL(buf,pos)
PVAL(buf,pos)
SCVAL(buf,pos,val)
SVAL(buf,pos)
IVAL(buf,pos)
SVALS(buf,pos)
IVALS(buf,pos)
SSVAL(buf,pos,val)
SIVAL(buf,pos,val)
SSVALS(buf,pos,val)
SIVALS(buf,pos,val)
RSVAL(buf,pos)
RIVAL(buf,pos)
RSSVAL(buf,pos,val)
RSIVAL(buf,pos,val)
LAN Manager Samba API
Parameters
Return value
Code character table
6. The smb.conf file
Lexical Analysis
Handling of Whitespace
Handling of Line Continuation
Line Continuation Quirks
Syntax
About params.c
7. NetBIOS in a Unix World
Introduction
Usernames
File Ownership
Passwords
Locking
Deny Modes
Trapdoor UIDs
Port numbers
Protocol Complexity
8. Tracing samba system calls
9. Finding useful information on windows
Netlogon debugging output
10. NT Domain RPC's
Introduction
Sources
Credits
Notes and Structures
Notes
Enumerations
Structures
MSRPC over Transact Named Pipe
MSRPC Pipes
Header
Tail
RPC Bind / Bind Ack
NTLSA Transact Named Pipe
LSA Open Policy
LSA Query Info Policy
LSA Enumerate Trusted Domains
LSA Open Secret
LSA Close
LSA Lookup SIDS
LSA Lookup Names
NETLOGON rpc Transact Named Pipe
LSA Request Challenge
LSA Authenticate 2
LSA Server Password Set
LSA SAM Logon
LSA SAM Logoff
\\MAILSLOT\NET\NTLOGON
Query for PDC
SAM Logon
SRVSVC Transact Named Pipe
Net Share Enum
Net Server Get Info
Cryptographic side of NT Domain Authentication
Definitions
Protocol
Comments
SIDs and RIDs
Well-known SIDs
Well-known RIDS
11. Samba Printing Internals
Abstract
Printing Interface to Various Back ends -
+
Print Queue TDB's -
+
ChangeID and Client Caching of Printer Information -
+
Windows NT/2K Printer Change Notify -
11. Samba WINS Internals
WINS Failover
12. The Upcoming SAM System
Security in the 'new SAM'
Standalone from UNIX
Handles and Races in the new SAM
Layers
Application
SAM Interface
SAM Modules
SAM Modules
Special Module: sam_passdb
sam_ads
Memory Management
Testing
13. LanMan and NT Password Encryption
Introduction
How does it work?
The smbpasswd file
14. Modules
Advantages
Loading modules
Static modules
Shared modules
Writing modules
Static/Shared selection in configure.in
15. RPC Pluggable Modules
About
General Overview
16. Notes to packagers
Versioning
Modules

Chapter 1. Definition of NetBIOS Protocol and Name Resolution Modes

Luke Leighton

12 June 1997

Table of Contents

NETBIOS
BROADCAST NetBIOS
NBNS NetBIOS

NETBIOS

+

12. Samba WINS Internals
WINS Failover
13. The Upcoming SAM System
Security in the 'new SAM'
Standalone from UNIX
Handles and Races in the new SAM
Layers
Application
SAM Interface
SAM Modules
SAM Modules
Special Module: sam_passdb
sam_ads
Memory Management
Testing
14. LanMan and NT Password Encryption
Introduction
How does it work?
The smbpasswd file
15. Modules
Advantages
Loading modules
Static modules
Shared modules
Writing modules
Static/Shared selection in configure.in
16. RPC Pluggable Modules
About
General Overview
17. VFS Modules
The Samba (Posix) VFS layer
The general interface
Possible VFS operation layers
The Interaction between the Samba VFS subsystem and the modules
Initialization and registration
How the Modules handle per connection data
Upgrading to the New VFS Interface
Upgrading from 2.2.* and 3.0aplha modules
Some Notes
Implement TRANSPARENT functions
Implement OPAQUE functions
18. Notes to packagers
Versioning
Modules
19. Contributing code

Chapter 1. Definition of NetBIOS Protocol and Name Resolution Modes

Luke Leighton

12 June 1997

Table of Contents

NETBIOS
BROADCAST NetBIOS
NBNS NetBIOS

NETBIOS

NetBIOS runs over the following tranports: TCP/IP; NetBEUI and IPX/SPX. Samba only uses NetBIOS over TCP/IP. For details on the TCP/IP NetBIOS Session Service NetBIOS Datagram Service, and NetBIOS Names, see @@ -61,7 +78,7 @@ NetBIOS names are either UNIQUE or GROUP. Only one application can claim a UNIQUE NetBIOS name on a network.

There are two kinds of NetBIOS Name resolution: Broadcast and Point-to-Point. -

BROADCAST NetBIOS

+

BROADCAST NetBIOS

Clients can claim names, and therefore offer services on successfully claimed names, on their broadcast-isolated subnet. One way to get NetBIOS services (such as browsing: see ftp.microsoft.com/drg/developr/CIFS/browdiff.txt; and @@ -73,7 +90,7 @@ find that some of your hosts spend 95 percent of their time dealing with broadcast traffic. [If you have IPX/SPX on your LAN or WAN, you will find that this is already happening: a packet analyzer will show, roughly every twelve minutes, great swathes of broadcast traffic!]. -

NBNS NetBIOS

+

NBNS NetBIOS

rfc1001.txt describes, amongst other things, the implementation and use of, a 'NetBIOS Name Service'. NT/AS offers 'Windows Internet Name Service' which is fully rfc1001/2 compliant, but has had to take specific action @@ -114,7 +131,7 @@ WINS Clients therefore claim names from the WINS server. If the WINS server allows them to register a name, the client's NetBIOS session service can then offer services on this name. Other WINS clients will then contact the WINS server to resolve a NetBIOS name. -

Chapter 2. Samba Architecture

Dan Shearer

November 1997

Table of Contents

Introduction
Multithreading and Samba
Threading smbd
Threading nmbd
nbmd Design

Introduction

+

Chapter 2. Samba Architecture

Dan Shearer

November 1997

Table of Contents

Introduction
Multithreading and Samba
Threading smbd
Threading nmbd
nbmd Design

Introduction

This document gives a general overview of how Samba works internally. The Samba Team has tried to come up with a model which is the best possible compromise between elegance, portability, security @@ -125,7 +142,7 @@ It also tries to answer some of the frequently asked questions such as:

  1. Is Samba secure when running on Unix? The xyz platform? What about the root priveliges issue? -

  2. Pros and cons of multithreading in various parts of Samba

  3. Why not have a separate process for name resolution, WINS, and browsing?

Multithreading and Samba

+

  • Pros and cons of multithreading in various parts of Samba

  • Why not have a separate process for name resolution, WINS, and browsing?

    • Multithreading and Samba

    People sometimes tout threads as a uniformly good thing. They are very nice in their place but are quite inappropriate for smbd. nmbd is another matter, and multi-threading it would be very nice. @@ -142,7 +159,7 @@ smbd multi-threaded. Multi-threading would actually make Samba much slower, less scalable, less portable and much less robust. The fact that we use a separate process for each connection is one of Samba's biggest advantages. -

    Threading smbd

    +

    Threading smbd

    A few problems that would arise from a threaded smbd are:

    1. It's not only to create threads instead of processes, but you @@ -167,7 +184,7 @@ A few problems that would arise from a threaded smbd are:

    2. we couldn't use the system locking calls as the locking context of fcntl() is a process, not a thread. -

    Threading nmbd

    +

    Threading nmbd

    This would be ideal, but gets sunk by portability requirements.

    Andrew tried to write a test threads library for nmbd that used only @@ -194,7 +211,7 @@ packet that arrives. Having a pool of processes is possible but is nasty to program cleanly due to the enormous amount of shared data (in complex structures) between the processes. We can't rely on each platform having a shared memory system. -

    nbmd Design

    +

    nbmd Design

    Originally Andrew used recursion to simulate a multi-threaded environment, which use the stack enormously and made for really confusing debugging sessions. Luke Leighton rewrote it to use a @@ -215,7 +232,7 @@ keeps the idea of a distinct packet. See "struct packet_struct" in nameserv.h. It has all the detail but none of the on-the-wire mess. This makes it ideal for using in disk or memory-based databases for browsing and WINS support. -

    Chapter 3. The samba DEBUG system

    Chris Hertel

    July 1998

    Table of Contents

    New Output Syntax
    The DEBUG() Macro
    The DEBUGADD() Macro
    The DEBUGLVL() Macro
    New Functions
    dbgtext()
    dbghdr()
    format_debug_text()

    New Output Syntax

    +

    Chapter 3. The samba DEBUG system

    Chris Hertel

    July 1998

    Table of Contents

    New Output Syntax
    The DEBUG() Macro
    The DEBUGADD() Macro
    The DEBUGLVL() Macro
    New Functions
    dbgtext()
    dbghdr()
    format_debug_text()

    New Output Syntax

    The syntax of a debugging log file is represented as: 

       >debugfile< :== { >debugmsg< }
@@ -268,7 +285,7 @@ by a newline.
 Note that in the above example the function names are not listed on
 the header line. That's because the example above was generated on an
 SGI Indy, and the SGI compiler doesn't support the __FUNCTION__ macro.
-

    The DEBUG() Macro

    +

    The DEBUG() Macro

    Use of the DEBUG() macro is unchanged. DEBUG() takes two parameters. The first is the message level, the second is the body of a function call to the Debug1() function. @@ -319,7 +336,7 @@ would look like this: [1998/07/30 16:00:51, 0] file.c:function(261) .

    Which isn't much use. The format buffer kludge fixes this problem. -

    The DEBUGADD() Macro

    +

    The DEBUGADD() Macro

    In addition to the kludgey solution to the broken line problem described above, there is a clean solution. The DEBUGADD() macro never generates a header. It will append new text to the current debug @@ -333,7 +350,7 @@ DEBUGADD() macro is the same as that of the DEBUG() macro. This is the first line. This is the second line. This is the third line. -

    The DEBUGLVL() Macro

    +

    The DEBUGLVL() Macro

    One of the problems with the DEBUG() macro was that DEBUG() lines tended to get a bit long. Consider this example from nmbd_sendannounce.c: @@ -368,7 +385,7 @@ within the DEBUGLVL() block.

  • Processing that is only relevant to debug output can be contained within the DEBUGLVL() block. -

    • New Functions

    dbgtext()

    +

    New Functions

    dbgtext()

    This function prints debug message text to the debug file (and possibly to syslog) via the format buffer. The function uses a variable argument list just like printf() or Debug1(). The @@ -377,7 +394,7 @@ and then passed to format_debug_text(). If you use DEBUGLVL() you will probably print the body of the message using dbgtext(). -

    dbghdr()

    +

    dbghdr()

    This is the function that writes a debug message header. Headers are not processed via the format buffer. Also note that if the format buffer is not empty, a call to dbghdr() will not @@ -385,7 +402,7 @@ produce any output. See the comments in dbghdr() for more info.

    It is not likely that this function will be called directly. It is used by DEBUG() and DEBUGADD(). -

    format_debug_text()

    +

    format_debug_text()

    This is a static function in debug.c. It stores the output text for the body of the message in a buffer until it encounters a newline. When the newline character is found, the buffer is @@ -394,7 +411,7 @@ buffer is reset. This allows us to add the indentation at the beginning of each line of the message body, and also ensures that the output is written a line at a time (which cleans up syslog output). -

    Chapter 4. Coding Suggestions

    Steve French

    Simo Sorce

    Andrew Bartlett

    Tim Potter

    Martin Pool

    +

    Chapter 4. Coding Suggestions

    Steve French

    Simo Sorce

    Andrew Bartlett

    Tim Potter

    Martin Pool

    So you want to add code to Samba ...

    One of the daunting tasks facing a programmer attempting to write code for @@ -405,8 +422,8 @@ document will attempt to document a few of the more important coding practices used at this time on the Samba project. The coding practices are expected to change slightly over time, and even to grow as more is learned about obscure portability considerations. Two existing documents -samba/source/internals.doc and -samba/source/architecture.doc provide +samba/source/internals.doc and +samba/source/architecture.doc provide additional information.

    The loosely related question of coding style is very personal and this @@ -536,7 +553,7 @@ The suggestions above are simply that, suggestions, but the information may help in reducing the routine rework done on new code. The preceeding list is expected to change routinely as new support routines and macros are added. -

    Chapter 5. Samba Internals

    8 May 1996

    Table of Contents

    Character Handling
    The new functions
    Macros in byteorder.h
    CVAL(buf,pos)
    PVAL(buf,pos)
    SCVAL(buf,pos,val)
    SVAL(buf,pos)
    IVAL(buf,pos)
    SVALS(buf,pos)
    IVALS(buf,pos)
    SSVAL(buf,pos,val)
    SIVAL(buf,pos,val)
    SSVALS(buf,pos,val)
    SIVALS(buf,pos,val)
    RSVAL(buf,pos)
    RIVAL(buf,pos)
    RSSVAL(buf,pos,val)
    RSIVAL(buf,pos,val)
    LAN Manager Samba API
    Parameters
    Return value
    Code character table

    Character Handling

    +

    Chapter 5. Samba Internals

    8 May 1996

    Table of Contents

    Character Handling
    The new functions
    Macros in byteorder.h
    CVAL(buf,pos)
    PVAL(buf,pos)
    SCVAL(buf,pos,val)
    SVAL(buf,pos)
    IVAL(buf,pos)
    SVALS(buf,pos)
    IVALS(buf,pos)
    SSVAL(buf,pos,val)
    SIVAL(buf,pos,val)
    SSVALS(buf,pos,val)
    SIVALS(buf,pos,val)
    RSVAL(buf,pos)
    RIVAL(buf,pos)
    RSSVAL(buf,pos,val)
    RSIVAL(buf,pos,val)
    LAN Manager Samba API
    Parameters
    Return value
    Code character table

    Character Handling

    This section describes character set handling in Samba, as implemented in Samba 3.0 and above

    @@ -546,7 +563,7 @@ strings to/from DOS codepages. The problem is that there was no way of telling if a particular char* is in dos codepage or unix codepage. This led to a nightmare of code that tried to cope with particular cases without handlingt the general case. -

    The new functions

    +

    The new functions

    The new system works like this:

    1. all char* strings inside Samba are "unix" strings. These are @@ -608,28 +625,28 @@ The new system works like this: parameters is gone.

    2. all vfs functions take unix strings. Don't convert when passing to them -

    Macros in byteorder.h

    +

    Macros in byteorder.h

    This section describes the macros defined in byteorder.h. These macros are used extensively in the Samba code. -

    CVAL(buf,pos)

    +

    CVAL(buf,pos)

    returns the byte at offset pos within buffer buf as an unsigned character. -

    PVAL(buf,pos)

    returns the value of CVAL(buf,pos) cast to type unsigned integer.

    SCVAL(buf,pos,val)

    sets the byte at offset pos within buffer buf to value val.

    SVAL(buf,pos)

    +

    PVAL(buf,pos)

    returns the value of CVAL(buf,pos) cast to type unsigned integer.

    SCVAL(buf,pos,val)

    sets the byte at offset pos within buffer buf to value val.

    SVAL(buf,pos)

    returns the value of the unsigned short (16 bit) little-endian integer at offset pos within buffer buf. An integer of this type is sometimes refered to as "USHORT". -

    IVAL(buf,pos)

    returns the value of the unsigned 32 bit little-endian integer at offset -pos within buffer buf.

    SVALS(buf,pos)

    returns the value of the signed short (16 bit) little-endian integer at -offset pos within buffer buf.

    IVALS(buf,pos)

    returns the value of the signed 32 bit little-endian integer at offset pos -within buffer buf.

    SSVAL(buf,pos,val)

    sets the unsigned short (16 bit) little-endian integer at offset pos within -buffer buf to value val.

    SIVAL(buf,pos,val)

    sets the unsigned 32 bit little-endian integer at offset pos within buffer -buf to the value val.

    SSVALS(buf,pos,val)

    sets the short (16 bit) signed little-endian integer at offset pos within -buffer buf to the value val.

    SIVALS(buf,pos,val)

    sets the signed 32 bit little-endian integer at offset pos withing buffer -buf to the value val.

    RSVAL(buf,pos)

    returns the value of the unsigned short (16 bit) big-endian integer at -offset pos within buffer buf.

    RIVAL(buf,pos)

    returns the value of the unsigned 32 bit big-endian integer at offset -pos within buffer buf.

    RSSVAL(buf,pos,val)

    sets the value of the unsigned short (16 bit) big-endian integer at +

    IVAL(buf,pos)

    returns the value of the unsigned 32 bit little-endian integer at offset +pos within buffer buf.

    SVALS(buf,pos)

    returns the value of the signed short (16 bit) little-endian integer at +offset pos within buffer buf.

    IVALS(buf,pos)

    returns the value of the signed 32 bit little-endian integer at offset pos +within buffer buf.

    SSVAL(buf,pos,val)

    sets the unsigned short (16 bit) little-endian integer at offset pos within +buffer buf to value val.

    SIVAL(buf,pos,val)

    sets the unsigned 32 bit little-endian integer at offset pos within buffer +buf to the value val.

    SSVALS(buf,pos,val)

    sets the short (16 bit) signed little-endian integer at offset pos within +buffer buf to the value val.

    SIVALS(buf,pos,val)

    sets the signed 32 bit little-endian integer at offset pos withing buffer +buf to the value val.

    RSVAL(buf,pos)

    returns the value of the unsigned short (16 bit) big-endian integer at +offset pos within buffer buf.

    RIVAL(buf,pos)

    returns the value of the unsigned 32 bit big-endian integer at offset +pos within buffer buf.

    RSSVAL(buf,pos,val)

    sets the value of the unsigned short (16 bit) big-endian integer at offset pos within buffer buf to value val. -refered to as "USHORT".

    RSIVAL(buf,pos,val)

    sets the value of the unsigned 32 bit big-endian integer at offset -pos within buffer buf to value val.

    LAN Manager Samba API

    +refered to as "USHORT".

    RSIVAL(buf,pos,val)

    sets the value of the unsigned 32 bit big-endian integer at offset +pos within buffer buf to value val.

    LAN Manager Samba API

    This section describes the functions need to make a LAN Manager RPC call. This information had been obtained by examining the Samba code and the LAN Manager 2.0 API documentation. It should not be considered entirely @@ -642,7 +659,7 @@ call_api(int prcnt, int drcnt, int mprcnt, int mdrcnt,

    This function is defined in client.c. It uses an SMB transaction to call a remote api. -

    Parameters

    The parameters are as follows:

    1. +

      Parameters

      The parameters are as follows:

      1. prcnt: the number of bytes of parameters begin sent.

      2. drcnt: the number of bytes of data begin sent. @@ -687,7 +704,7 @@ substructures apply, this string is of zero length.

      The code in client.c always calls call_api() with no data. It is unclear when a non-zero length data buffer would be sent. -

      Return value

      +

      Return value

      The returned parameters (pointed to by rparam), in their order of appearance are:

      1. An unsigned 16 bit integer which contains the API function's return code. @@ -718,7 +735,7 @@ fix_char_ptr() in client.c can be used for this purpose. The third parameter (which may be read as "SVAL(rparam,4)") has something to do with indicating the amount of data returned or possibly the amount of data which can be returned if enough buffer space is allowed. -

      Code character table

      +

    Code character table

    Certain data structures are described by means of ASCIIz strings containing code characters. These are the code characters:

    1. @@ -741,7 +758,7 @@ r pointer to returned data buffer??? L length in bytes of returned data buffer???

    2. h number of bytes of information available??? -

    Chapter 6. The smb.conf file

    Chris Hertel

    November 1997

    Table of Contents

    Lexical Analysis
    Handling of Whitespace
    Handling of Line Continuation
    Line Continuation Quirks
    Syntax
    About params.c

    Lexical Analysis

    +

    Chapter 6. The smb.conf file

    Chris Hertel

    November 1997

    Table of Contents

    Lexical Analysis
    Handling of Whitespace
    Handling of Line Continuation
    Line Continuation Quirks
    Syntax
    About params.c

    Lexical Analysis

    Basically, the file is processed on a line by line basis. There are four types of lines that are recognized by the lexical analyzer (params.c): @@ -768,7 +785,7 @@ ignores them. The latter two line types are scanned for These are the only tokens passed to the parameter loader (loadparm.c). Parameter names and values are divided from one another by an equal sign: '='. -

    Handling of Whitespace

    +

    Handling of Whitespace

    Whitespace is defined as all characters recognized by the isspace() function (see ctype(3C)) except for the newline character ('\n') The newline is excluded because it identifies the end of the line. @@ -783,7 +800,7 @@ the exception of carriage return characters ('\r'), all of which are removed.

  • Leading and trailing whitespace is removed from names and values. -

    • Handling of Line Continuation

    +

    Handling of Line Continuation

    Long section header and parameter lines may be extended across multiple lines by use of the backslash character ('\\'). Line continuation is ignored for blank and comment lines. @@ -806,7 +823,7 @@ line, plus the four preceeding the word 'with' in the second line. Line continuation characters are ignored on blank lines and at the end of comments. They are *only* recognized within section and parameter lines. -

    Line Continuation Quirks

    Note the following example:

    +

    Line Continuation Quirks

    Note the following example:

     	param name = parameter value string \
     \
     with line continuation.
@@ -830,7 +847,7 @@ terminating character, and the rest of the line is ignored.  The lines

    are read as

     	[section name]
     param name = value
-

    Syntax

    The syntax of the smb.conf file is as follows:

    +

    Syntax

    The syntax of the smb.conf file is as follows:

       <file>            :==  { <section> } EOF
   <section>         :==  <section header> { <parameter line> }
   <section header>  :==  '[' NAME ']'
@@ -849,12 +866,12 @@ terminating character, and the rest of the line is ignored.  The lines
 	A parameter line is divided into a NAME and a VALUE.  The *first*
 	equal sign on the line separates the NAME from the VALUE.  The
 	VALUE is terminated by a newline character (NL = '\n').
-

    About params.c

    +

    About params.c

    The parsing of the config file is a bit unusual if you are used to lex, yacc, bison, etc. Both lexical analysis (scanning) and parsing are performed by params.c. Values are loaded via callbacks to loadparm.c. -

    Chapter 7. NetBIOS in a Unix World

    Andrew Tridgell

    April 1995

    Table of Contents

    Introduction
    Usernames
    File Ownership
    Passwords
    Locking
    Deny Modes
    Trapdoor UIDs
    Port numbers
    Protocol Complexity

    Introduction

    +

    Chapter 7. NetBIOS in a Unix World

    Andrew Tridgell

    April 1995

    Table of Contents

    Introduction
    Usernames
    File Ownership
    Passwords
    Locking
    Deny Modes
    Trapdoor UIDs
    Port numbers
    Protocol Complexity

    Introduction

    This is a short document that describes some of the issues that confront a SMB implementation on unix, and how Samba copes with them. They may help people who are looking at unix<->PC @@ -862,7 +879,7 @@ interoperability.

    It was written to help out a person who was writing a paper on unix to PC connectivity. -

    Usernames

    +

    Usernames

    The SMB protocol has only a loose username concept. Early SMB protocols (such as CORE and COREPLUS) have no username concept at all. Even in later protocols clients often attempt operations @@ -899,7 +916,7 @@ in the vast majority of cases. The methods include username maps, the service%user syntax, the saving of session setup usernames for later validation and the derivation of the username from the service name (either directly or via the user= option). -

    File Ownership

    +

    File Ownership

    The commonly used SMB protocols have no way of saying "you can't do that because you don't own the file". They have, in fact, no concept of file ownership at all. @@ -917,7 +934,7 @@ file time comparisons right. There are several possible solutions to this problem, including username mapping, and forcing a specific username for particular shares. -

    Passwords

    +

    Passwords

    Many SMB clients uppercase passwords before sending them. I have no idea why they do this. Interestingly WfWg uppercases the password only if the server is running a protocol greater than COREPLUS, so @@ -939,7 +956,7 @@ This means that it is *VERY* important to ensure that the Samba smbpasswd file containing these password hashes is only readable by the root user. See the documentation ENCRYPTION.txt for more details. -

    Locking

    +

    Locking

    Since samba 2.2, samba supports other types of locking as well. This section is outdated.

    @@ -970,7 +987,7 @@ asking the server to notify it if anyone else tries to do something on the same file, at which time the client will say if it is willing to give up its lock. Unix has no simple way of implementing opportunistic locking, and currently Samba has no support for it. -

    Deny Modes

    +

    Deny Modes

    When a SMB client opens a file it asks for a particular "deny mode" to be placed on the file. These modes (DENY_NONE, DENY_READ, DENY_WRITE, DENY_ALL, DENY_FCB and DENY_DOS) specify what actions should be @@ -984,7 +1001,7 @@ directory or a shared memory implementation. The lock file method is clumsy and consumes processing and file resources, the shared memory implementation is vastly prefered and is turned on by default for those systems that support it. -

    Trapdoor UIDs

    +

    Trapdoor UIDs

    A SMB session can run with several uids on the one socket. This happens when a user connects to two shares with different usernames. To cope with this the unix server needs to switch uids @@ -994,7 +1011,7 @@ a single uid.

    Note that you can also get the "trapdoor uid" message for other reasons. Please see the FAQ for details. -

    Port numbers

    +

    Port numbers

    There is a convention that clients on sockets use high "unprivilaged" port numbers (>1000) and connect to servers on low "privilaged" port numbers. This is enforced in Unix as non-root users can't open a @@ -1017,7 +1034,7 @@ to any of these OSes unless they are running as root. The answer comes back, but it goes to port 137 which the unix user can't listen on. Interestingly WinNT3.1 got this right - it sends node status responses back to the source port in the request. -

    Protocol Complexity

    +

    Protocol Complexity

    There are many "protocol levels" in the SMB protocol. It seems that each time new functionality was added to a Microsoft operating system, they added the equivalent functions in a new protocol level of the SMB @@ -1055,7 +1072,7 @@ published new specifications. These are far superior to the old X/Open documents but there are still undocumented calls and features. This specification is actively being worked on by a CIFS developers mailing list hosted by Microsft. -

    Chapter 8. Tracing samba system calls

    Andrew Tridgell

    Samba Team

    +

    Chapter 8. Tracing samba system calls

    Andrew Tridgell

    Samba Team

    This file describes how to do a system call trace on Samba to work out what its doing wrong. This is not for the faint of heart, but if you are reading this then you are probably desperate. @@ -1081,8 +1098,8 @@ strace as strace is the only portable system tracer (its available for free for many unix types) and its also got some of the nicest features.

    -Next, try using strace on some simple commands. For example, strace -ls or strace echo hello. +Next, try using strace on some simple commands. For example, strace +ls or strace echo hello.

    You'll notice that it produces a LOT of output. It is showing you the arguments to every system call that the program makes and the @@ -1091,7 +1108,7 @@ get lots of output. You'll also find that it produces a lot of "preamble" stuff showing the loading of shared libraries etc. Ignore this (unless its going wrong!)

    -For example, the only line that really matters in the strace echo +For example, the only line that really matters in the strace echo hello output is: 

     write(1, "hello\n", 6)                  = 6
@@ -1100,10 +1117,10 @@ Ok, now you're familiar with strace. To use it on Samba you need to
 strace the running smbd daemon. The way I tend ot use it is to first
 login from my Windows PC to the Samba server, then use smbstatus to
 find which process ID that client is attached to, then as root I do
-strace -p PID to attach to that process. I normally redirect the
+strace -p PID to attach to that process. I normally redirect the
 stderr output from this command to a file for later perusal. For
 example, if I'm using a csh style shell:
-
    strace -f -p 3872 >& strace.out
    or with a sh style shell:
    strace -f -p 3872 > strace.out 2>&1
    
+
    strace -f -p 3872 >& strace.out
    or with a sh style shell:
    strace -f -p 3872 > strace.out 2>&1
    
 Note the "-f" option. This is only available on some systems, and
 allows you to trace not just the current process, but any children it
 forks. This is great for finding printing problems caused by the
@@ -1122,16 +1139,16 @@ numbers and "follow" what happens to an open file until it is closed.
 
    
 Beyond this you will have to use your initiative. To give you an idea
 of what you are looking for here is a piece of strace output that
-shows that /dev/null is not world writeable, which
+shows that /dev/null is not world writeable, which
 causes printing to fail with Samba:
 
     [pid 28268] open("/dev/null", O_RDWR)   = -1 EACCES (Permission denied)
 [pid 28268] open("/dev/null", O_WRONLY) = -1 EACCES (Permission denied)
 
    
-The process is trying to first open /dev/null read-write 
-then read-only. Both fail. This means /dev/null has 
+The process is trying to first open /dev/null read-write 
+then read-only. Both fail. This means /dev/null has 
 incorrect permissions.
-

    Chapter 9. NT Domain RPC's

    Luke Leighton

    <lkcl@switchboard.net>

    Duncan Stansfield

    <duncans@sco.com>

    01 November 97(version 0.0.24)

    Table of Contents

    Introduction
    Sources
    Credits
    Notes and Structures
    Notes
    Enumerations
    Structures
    MSRPC over Transact Named Pipe
    MSRPC Pipes
    Header
    Tail
    RPC Bind / Bind Ack
    NTLSA Transact Named Pipe
    LSA Open Policy
    LSA Query Info Policy
    LSA Enumerate Trusted Domains
    LSA Open Secret
    LSA Close
    LSA Lookup SIDS
    LSA Lookup Names
    NETLOGON rpc Transact Named Pipe
    LSA Request Challenge
    LSA Authenticate 2
    LSA Server Password Set
    LSA SAM Logon
    LSA SAM Logoff
    \\MAILSLOT\NET\NTLOGON
    Query for PDC
    SAM Logon
    SRVSVC Transact Named Pipe
    Net Share Enum
    Net Server Get Info
    Cryptographic side of NT Domain Authentication
    Definitions
    Protocol
    Comments
    SIDs and RIDs
    Well-known SIDs
    Well-known RIDS

    Introduction

    +

    Chapter 9. Finding useful information on windows

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    Table of Contents

    Netlogon debugging output

    Netlogon debugging output

    1. stop netlogon service on PDC

    2. rename original netlogon.dll to netlogon.dll.original

    3. copy checked version of netlogon.dll to system32 directory

    4. set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DBFlag to 0x20000004

    5. start netlogon service on PDC

    Chapter 10. NT Domain RPC's

    Luke Leighton

    Duncan Stansfield

    01 November 97(version 0.0.24)

    Table of Contents

    Introduction
    Sources
    Credits
    Notes and Structures
    Notes
    Enumerations
    Structures
    MSRPC over Transact Named Pipe
    MSRPC Pipes
    Header
    Tail
    RPC Bind / Bind Ack
    NTLSA Transact Named Pipe
    LSA Open Policy
    LSA Query Info Policy
    LSA Enumerate Trusted Domains
    LSA Open Secret
    LSA Close
    LSA Lookup SIDS
    LSA Lookup Names
    NETLOGON rpc Transact Named Pipe
    LSA Request Challenge
    LSA Authenticate 2
    LSA Server Password Set
    LSA SAM Logon
    LSA SAM Logoff
    \\MAILSLOT\NET\NTLOGON
    Query for PDC
    SAM Logon
    SRVSVC Transact Named Pipe
    Net Share Enum
    Net Server Get Info
    Cryptographic side of NT Domain Authentication
    Definitions
    Protocol
    Comments
    SIDs and RIDs
    Well-known SIDs
    Well-known RIDS

    Introduction

    This document contains information to provide an NT workstation with login services, without the need for an NT server. It is the sgml version of http://mailhost.cb1.com/~lkcl/cifsntdomain.txt, controlled by Luke.

    @@ -1162,7 +1179,7 @@ of this protocol is available from: Also used to provide debugging information is the Check Build version of NT workstation, and enabling full debugging in NETLOGON. This is achieved by setting the following REG_SZ registry key to 0x1ffffff: -

    HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

    Incorrect direct editing of the registry can cause your +

    HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

    Incorrect direct editing of the registry can cause your machine to fail. Then again, so can incorrect implementation of this protocol. See "Liability:" above.

    Bear in mind that each packet over-the-wire will have its origin in an @@ -1177,7 +1194,7 @@ Failure to return this error code will make the workstation report that it is already a member of the domain.

  • the cryptographic side of the NetrServerPasswordSet command, which would allow the workstation to change its password. This password is used to generate the long-term session key. [It is possible to reject this -command, and keep the default workstation password].

    • Sources

    cket Traces from Netmonitor (Service Pack 1 and above)
    ul Ashton and Luke Leighton's other "NT Domain" doc.
    FS documentation - cifs6.txt
    FS documentation - cifsrap2.txt

    Credits

    Paul Ashton: loads of work with Net Monitor; understanding the NT authentication system; reference implementation of the NT domain support on which this document is originally based.
    Duncan Stansfield: low-level analysis of MSRPC Pipes.
    Linus Nordberg: producing c-code from Paul's crypto spec.
    Windows Sourcer development team

    Notes and Structures

    Notes

    1. +command, and keep the default workstation password].

    Sources

    cket Traces from Netmonitor (Service Pack 1 and above)
    ul Ashton and Luke Leighton's other "NT Domain" doc.
    FS documentation - cifs6.txt
    FS documentation - cifsrap2.txt

    Credits

    Paul Ashton: loads of work with Net Monitor; understanding the NT authentication system; reference implementation of the NT domain support on which this document is originally based.
    Duncan Stansfield: low-level analysis of MSRPC Pipes.
    Linus Nordberg: producing c-code from Paul's crypto spec.
    Windows Sourcer development team

    Notes and Structures

    Notes

    1. In the SMB Transact pipes, some "Structures", described here, appear to be 4-byte aligned with the SMB header, at their start. Exactly which "Structures" need aligning is not precisely known or documented. @@ -1205,18 +1222,18 @@ into or taken out of the SMB data stream. if the count is non-zero, then the pointer is also non-zero. immediately following the pointer is the count again, followed by an array of container sub-structures. the count appears a third time after the last sub-structure. -

    Enumerations

    MSRPC Header type

    command number in the msrpc packet header

    MSRPC_Request:

    0x00

    MSRPC_Response:

    0x02

    MSRPC_Bind:

    0x0B

    MSRPC_BindAck:

    0x0C

    MSRPC Packet info

    The meaning of these flags is undocumented

    FirstFrag:

    0x01

    LastFrag:

    0x02

    NotaFrag:

    0x04

    RecRespond:

    0x08

    NoMultiplex:

    0x10

    NotForIdemp:

    0x20

    NotforBcast:

    0x40

    NoUuid:

    0x80

    Structures

    VOID *

    sizeof VOID* is 32 bits.

    char

    sizeof char is 8 bits.

    UTIME

    UTIME is 32 bits, indicating time in seconds since 01jan1970. documented in cifs6.txt (section 3.5 page, page 30).

    NTTIME

    NTTIME is 64 bits. documented in cifs6.txt (section 3.5 page, page 30).

    DOM_SID (domain SID structure)

    UINT32

    num of sub-authorities in domain SID

    UINT8

    SID revision number

    UINT8

    num of sub-authorities in domain SID

    UINT8[6]

    6 bytes for domain SID - Identifier Authority.

    UINT16[n_subauths]

    domain SID sub-authorities

    Note: the domain SID is documented elsewhere. -

    STR (string)

    STR (string) is a char[] : a null-terminated string of ascii characters.

    UNIHDR (unicode string header)

    UINT16

    length of unicode string

    UINT16

    max length of unicode string

    UINT32

    4 - undocumented.

    UNIHDR2 (unicode string header plus buffer pointer)

    UNIHDR

    unicode string header

    VOID*

    undocumented buffer pointer

    UNISTR (unicode string)

    UINT16[]

    null-terminated string of unicode characters.

    NAME (length-indicated unicode string)

    UINT32

    length of unicode string

    UINT16[]

    null-terminated string of unicode characters.

    UNISTR2 (aligned unicode string)

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    max length of unicode string

    UINT32

    0 - undocumented

    UINT32

    length of unicode string

    UINT16[]

    string of uncode characters

    OBJ_ATTR (object attributes)

    UINT32

    0x18 - length (in bytes) including the length field.

    VOID*

    0 - root directory (pointer)

    VOID*

    0 - object name (pointer)

    UINT32

    0 - attributes (undocumented)

    VOID*

    0 - security descriptior (pointer)

    UINT32

    0 - security quality of service

    POL_HND (LSA policy handle)

    char[20]

    policy handle

    DOM_SID2 (domain SID structure, SIDS stored in unicode)

    UINT32

    5 - SID type

    UINT32

    0 - undocumented

    UNIHDR2

    domain SID unicode string header

    UNISTR

    domain SID unicode string

    Note: there is a conflict between the unicode string header and the unicode string itself as to which to use to indicate string length. this will need to be resolved.

    Note: the SID type indicates, for example, an alias; a well-known group etc. this is documented somewhere.

    DOM_RID (domain RID structure)

    UINT32

    5 - well-known SID. 1 - user SID (see ShowACLs)

    UINT32

    5 - undocumented

    UINT32

    domain RID

    UINT32

    0 - domain index out of above reference domains

    LOG_INFO (server, account, client structure)

    Note: logon server name starts with two '\' characters and is upper case.

    Note: account name is the logon client name from the LSA Request Challenge, with a $ on the end of it, in upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    account name unicode string

    UINT16

    sec_chan - security channel type

    UNISTR2

    logon client machine unicode string

    CLNT_SRV (server, client names structure)

    Note: logon server name starts with two '\' characters and is upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon client machine unicode string

    CREDS (credentials + time stamp)

    char[8]

    credentials

    UTIME

    time stamp

    CLNT_INFO2 (server, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will beused in subsequent credential checks. the presumed intention is to - maintain an authenticated request/response trail.

    CLNT_SRV

    client and server names

    UINT8[]

    ???? padding, for 4-byte alignment with SMB header.

    VOID*

    pointer to client credentials.

    CREDS

    client-calculated credentials + client time

    CLNT_INFO (server, account, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will be used in subsequent credential checks. the presumed intention is to maintain an authenticated request/response trail.

    LOG_INFO

    logon account info

    CREDS

    client-calculated credentials + client time

    ID_INFO_1 (id info structure, auth level 1)

    VOID*

    ptr_id_info_1

    UNIHDR

    domain name unicode header

    UINT32

    param control

    UINT64

    logon ID

    UNIHDR

    user name unicode header

    UNIHDR

    workgroup name unicode header

    char[16]

    arc4 LM OWF Password

    char[16]

    arc4 NT OWF Password

    UNISTR2

    domain name unicode string

    UNISTR2

    user name unicode string

    UNISTR2

    workstation name unicode string

    SAM_INFO (sam logon/logoff id info structure)

    Note: presumably, the return credentials is supposedly for the server to verify that the credential chain hasn't been compromised.

    CLNT_INFO2

    client identification/authentication info

    VOID*

    pointer to return credentials.

    CRED

    return credentials - ignored.

    UINT16

    logon level

    UINT16

    switch value

    +

    Enumerations

    MSRPC Header type

    command number in the msrpc packet header

    MSRPC_Request:

    0x00

    MSRPC_Response:

    0x02

    MSRPC_Bind:

    0x0B

    MSRPC_BindAck:

    0x0C

    MSRPC Packet info

    The meaning of these flags is undocumented

    FirstFrag:

    0x01

    LastFrag:

    0x02

    NotaFrag:

    0x04

    RecRespond:

    0x08

    NoMultiplex:

    0x10

    NotForIdemp:

    0x20

    NotforBcast:

    0x40

    NoUuid:

    0x80

    Structures

    VOID *

    sizeof VOID* is 32 bits.

    char

    sizeof char is 8 bits.

    UTIME

    UTIME is 32 bits, indicating time in seconds since 01jan1970. documented in cifs6.txt (section 3.5 page, page 30).

    NTTIME

    NTTIME is 64 bits. documented in cifs6.txt (section 3.5 page, page 30).

    DOM_SID (domain SID structure)

    UINT32

    num of sub-authorities in domain SID

    UINT8

    SID revision number

    UINT8

    num of sub-authorities in domain SID

    UINT8[6]

    6 bytes for domain SID - Identifier Authority.

    UINT16[n_subauths]

    domain SID sub-authorities

    Note: the domain SID is documented elsewhere. +

    STR (string)

    STR (string) is a char[] : a null-terminated string of ascii characters.

    UNIHDR (unicode string header)

    UINT16

    length of unicode string

    UINT16

    max length of unicode string

    UINT32

    4 - undocumented.

    UNIHDR2 (unicode string header plus buffer pointer)

    UNIHDR

    unicode string header

    VOID*

    undocumented buffer pointer

    UNISTR (unicode string)

    UINT16[]

    null-terminated string of unicode characters.

    NAME (length-indicated unicode string)

    UINT32

    length of unicode string

    UINT16[]

    null-terminated string of unicode characters.

    UNISTR2 (aligned unicode string)

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    max length of unicode string

    UINT32

    0 - undocumented

    UINT32

    length of unicode string

    UINT16[]

    string of uncode characters

    OBJ_ATTR (object attributes)

    UINT32

    0x18 - length (in bytes) including the length field.

    VOID*

    0 - root directory (pointer)

    VOID*

    0 - object name (pointer)

    UINT32

    0 - attributes (undocumented)

    VOID*

    0 - security descriptior (pointer)

    UINT32

    0 - security quality of service

    POL_HND (LSA policy handle)

    char[20]

    policy handle

    DOM_SID2 (domain SID structure, SIDS stored in unicode)

    UINT32

    5 - SID type

    UINT32

    0 - undocumented

    UNIHDR2

    domain SID unicode string header

    UNISTR

    domain SID unicode string

    Note: there is a conflict between the unicode string header and the unicode string itself as to which to use to indicate string length. this will need to be resolved.

    Note: the SID type indicates, for example, an alias; a well-known group etc. this is documented somewhere.

    DOM_RID (domain RID structure)

    UINT32

    5 - well-known SID. 1 - user SID (see ShowACLs)

    UINT32

    5 - undocumented

    UINT32

    domain RID

    UINT32

    0 - domain index out of above reference domains

    LOG_INFO (server, account, client structure)

    Note: logon server name starts with two '\' characters and is upper case.

    Note: account name is the logon client name from the LSA Request Challenge, with a $ on the end of it, in upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    account name unicode string

    UINT16

    sec_chan - security channel type

    UNISTR2

    logon client machine unicode string

    CLNT_SRV (server, client names structure)

    Note: logon server name starts with two '\' characters and is upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon client machine unicode string

    CREDS (credentials + time stamp)

    char[8]

    credentials

    UTIME

    time stamp

    CLNT_INFO2 (server, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will beused in subsequent credential checks. the presumed intention is to + maintain an authenticated request/response trail.

    CLNT_SRV

    client and server names

    UINT8[]

    ???? padding, for 4-byte alignment with SMB header.

    VOID*

    pointer to client credentials.

    CREDS

    client-calculated credentials + client time

    CLNT_INFO (server, account, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will be used in subsequent credential checks. the presumed intention is to maintain an authenticated request/response trail.

    LOG_INFO

    logon account info

    CREDS

    client-calculated credentials + client time

    ID_INFO_1 (id info structure, auth level 1)

    VOID*

    ptr_id_info_1

    UNIHDR

    domain name unicode header

    UINT32

    param control

    UINT64

    logon ID

    UNIHDR

    user name unicode header

    UNIHDR

    workgroup name unicode header

    char[16]

    arc4 LM OWF Password

    char[16]

    arc4 NT OWF Password

    UNISTR2

    domain name unicode string

    UNISTR2

    user name unicode string

    UNISTR2

    workstation name unicode string

    SAM_INFO (sam logon/logoff id info structure)

    Note: presumably, the return credentials is supposedly for the server to verify that the credential chain hasn't been compromised.

    CLNT_INFO2

    client identification/authentication info

    VOID*

    pointer to return credentials.

    CRED

    return credentials - ignored.

    UINT16

    logon level

    UINT16

    switch value

             switch (switch_value)
         case 1:
         {
             ID_INFO_1     id_info_1;
         }
-

    GID (group id info)

    UINT32

    group id

    UINT32

    user attributes (only used by NT 3.1 and 3.51)

    DOM_REF (domain reference info)

    VOID*

    undocumented buffer pointer.

    UINT32

    num referenced domains?

    VOID*

    undocumented domain name buffer pointer.

    UINT32

    32 - max number of entries

    UINT32

    4 - num referenced domains?

    UNIHDR2

    domain name unicode string header

    UNIHDR2[num_ref_doms-1]

    referenced domain unicode string headers

    UNISTR

    domain name unicode string

    DOM_SID[num_ref_doms]

    referenced domain SIDs

    DOM_INFO (domain info, levels 3 and 5 are the same))

    UINT8[]

    ??? padding to get 4-byte alignment with start of SMB header

    UINT16

    domain name string length * 2

    UINT16

    domain name string length * 2

    VOID*

    undocumented domain name string buffer pointer

    VOID*

    undocumented domain SID string buffer pointer

    UNISTR2

    domain name (unicode string)

    DOM_SID

    domain SID

    USER_INFO (user logon info)

    Note: it would be nice to know what the 16 byte user session key is for.

    NTTIME

    logon time

    NTTIME

    logoff time

    NTTIME

    kickoff time

    NTTIME

    password last set time

    NTTIME

    password can change time

    NTTIME

    password must change time

    UNIHDR

    username unicode string header

    UNIHDR

    user's full name unicode string header

    UNIHDR

    logon script unicode string header

    UNIHDR

    profile path unicode string header

    UNIHDR

    home directory unicode string header

    UNIHDR

    home directory drive unicode string header

    UINT16

    logon count

    UINT16

    bad password count

    UINT32

    User ID

    UINT32

    Group ID

    UINT32

    num groups

    VOID*

    undocumented buffer pointer to groups.

    UINT32

    user flags

    char[16]

    user session key

    UNIHDR

    logon server unicode string header

    UNIHDR

    logon domain unicode string header

    VOID*

    undocumented logon domain id pointer

    char[40]

    40 undocumented padding bytes. future expansion?

    UINT32

    0 - num_other_sids?

    VOID*

    NULL - undocumented pointer to other domain SIDs.

    UNISTR2

    username unicode string

    UNISTR2

    user's full name unicode string

    UNISTR2

    logon script unicode string

    UNISTR2

    profile path unicode string

    UNISTR2

    home directory unicode string

    UNISTR2

    home directory drive unicode string

    UINT32

    num groups

    GID[num_groups]

    group info

    UNISTR2

    logon server unicode string

    UNISTR2

    logon domain unicode string

    DOM_SID

    domain SID

    DOM_SID[num_sids]

    other domain SIDs?

    SH_INFO_1_PTR (pointers to level 1 share info strings)

    Note: see cifsrap2.txt section5, page 10.

    0 for shi1_type indicates a Disk.
    1 for shi1_type indicates a Print Queue.
    2 for shi1_type indicates a Device.
    3 for shi1_type indicates an IPC pipe.
    0x8000 0000 (top bit set in shi1_type) indicates a hidden share.
    VOID*

    shi1_netname - pointer to net name

    UINT32

    shi1_type - type of share. 0 - undocumented.

    VOID*

    shi1_remark - pointer to comment.

    SH_INFO_1_STR (level 1 share info strings)

    UNISTR2

    shi1_netname - unicode string of net name

    UNISTR2

    shi1_remark - unicode string of comment.

    SHARE_INFO_1_CTR

    share container with 0 entries:

    UINT32

    0 - EntriesRead

    UINT32

    0 - Buffer

    share container with > 0 entries:

    UINT32

    EntriesRead

    UINT32

    non-zero - Buffer

    UINT32

    EntriesRead

    SH_INFO_1_PTR[EntriesRead]

    share entry pointers

    SH_INFO_1_STR[EntriesRead]

    share entry strings

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    UINT32

    EntriesRead

    UINT32

    0 - padding

    SERVER_INFO_101

    Note: see cifs6.txt section 6.4 - the fields described therein will be of assistance here. for example, the type listed below is the same as fServerType, which is described in 6.4.1.

    SV_TYPE_WORKSTATION

    0x00000001 All workstations

    SV_TYPE_SERVER

    0x00000002 All servers

    SV_TYPE_SQLSERVER

    0x00000004 Any server running with SQL server

    SV_TYPE_DOMAIN_CTRL

    0x00000008 Primary domain controller

    SV_TYPE_DOMAIN_BAKCTRL

    0x00000010 Backup domain controller

    SV_TYPE_TIME_SOURCE

    0x00000020 Server running the timesource service

    SV_TYPE_AFP

    0x00000040 Apple File Protocol servers

    SV_TYPE_NOVELL

    0x00000080 Novell servers

    SV_TYPE_DOMAIN_MEMBER

    0x00000100 Domain Member

    SV_TYPE_PRINTQ_SERVER

    0x00000200 Server sharing print queue

    SV_TYPE_DIALIN_SERVER

    0x00000400 Server running dialin service.

    SV_TYPE_XENIX_SERVER

    0x00000800 Xenix server

    SV_TYPE_NT

    0x00001000 NT server

    SV_TYPE_WFW

    0x00002000 Server running Windows for

    SV_TYPE_SERVER_NT

    0x00008000 Windows NT non DC server

    SV_TYPE_POTENTIAL_BROWSER

    0x00010000 Server that can run the browser service

    SV_TYPE_BACKUP_BROWSER

    0x00020000 Backup browser server

    SV_TYPE_MASTER_BROWSER

    0x00040000 Master browser server

    SV_TYPE_DOMAIN_MASTER

    0x00080000 Domain Master Browser server

    SV_TYPE_LOCAL_LIST_ONLY

    0x40000000 Enumerate only entries marked "local"

    SV_TYPE_DOMAIN_ENUM

    0x80000000 Enumerate Domains. The pszServer and pszDomain parameters must be NULL.

    UINT32

    500 - platform_id

    VOID*

    pointer to name

    UINT32

    5 - major version

    UINT32

    4 - minor version

    UINT32

    type (SV_TYPE_... bit field)

    VOID*

    pointer to comment

    UNISTR2

    sv101_name - unicode string of server name

    UNISTR2

    sv_101_comment - unicode string of server comment.

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    MSRPC over Transact Named Pipe

    For details on the SMB Transact Named Pipe, see cifs6.txt

    MSRPC Pipes

    +

    GID (group id info)

    UINT32

    group id

    UINT32

    user attributes (only used by NT 3.1 and 3.51)

    DOM_REF (domain reference info)

    VOID*

    undocumented buffer pointer.

    UINT32

    num referenced domains?

    VOID*

    undocumented domain name buffer pointer.

    UINT32

    32 - max number of entries

    UINT32

    4 - num referenced domains?

    UNIHDR2

    domain name unicode string header

    UNIHDR2[num_ref_doms-1]

    referenced domain unicode string headers

    UNISTR

    domain name unicode string

    DOM_SID[num_ref_doms]

    referenced domain SIDs

    DOM_INFO (domain info, levels 3 and 5 are the same))

    UINT8[]

    ??? padding to get 4-byte alignment with start of SMB header

    UINT16

    domain name string length * 2

    UINT16

    domain name string length * 2

    VOID*

    undocumented domain name string buffer pointer

    VOID*

    undocumented domain SID string buffer pointer

    UNISTR2

    domain name (unicode string)

    DOM_SID

    domain SID

    USER_INFO (user logon info)

    Note: it would be nice to know what the 16 byte user session key is for.

    NTTIME

    logon time

    NTTIME

    logoff time

    NTTIME

    kickoff time

    NTTIME

    password last set time

    NTTIME

    password can change time

    NTTIME

    password must change time

    UNIHDR

    username unicode string header

    UNIHDR

    user's full name unicode string header

    UNIHDR

    logon script unicode string header

    UNIHDR

    profile path unicode string header

    UNIHDR

    home directory unicode string header

    UNIHDR

    home directory drive unicode string header

    UINT16

    logon count

    UINT16

    bad password count

    UINT32

    User ID

    UINT32

    Group ID

    UINT32

    num groups

    VOID*

    undocumented buffer pointer to groups.

    UINT32

    user flags

    char[16]

    user session key

    UNIHDR

    logon server unicode string header

    UNIHDR

    logon domain unicode string header

    VOID*

    undocumented logon domain id pointer

    char[40]

    40 undocumented padding bytes. future expansion?

    UINT32

    0 - num_other_sids?

    VOID*

    NULL - undocumented pointer to other domain SIDs.

    UNISTR2

    username unicode string

    UNISTR2

    user's full name unicode string

    UNISTR2

    logon script unicode string

    UNISTR2

    profile path unicode string

    UNISTR2

    home directory unicode string

    UNISTR2

    home directory drive unicode string

    UINT32

    num groups

    GID[num_groups]

    group info

    UNISTR2

    logon server unicode string

    UNISTR2

    logon domain unicode string

    DOM_SID

    domain SID

    DOM_SID[num_sids]

    other domain SIDs?

    SH_INFO_1_PTR (pointers to level 1 share info strings)

    Note: see cifsrap2.txt section5, page 10.

    0 for shi1_type indicates a Disk.
    1 for shi1_type indicates a Print Queue.
    2 for shi1_type indicates a Device.
    3 for shi1_type indicates an IPC pipe.
    0x8000 0000 (top bit set in shi1_type) indicates a hidden share.
    VOID*

    shi1_netname - pointer to net name

    UINT32

    shi1_type - type of share. 0 - undocumented.

    VOID*

    shi1_remark - pointer to comment.

    SH_INFO_1_STR (level 1 share info strings)

    UNISTR2

    shi1_netname - unicode string of net name

    UNISTR2

    shi1_remark - unicode string of comment.

    SHARE_INFO_1_CTR

    share container with 0 entries:

    UINT32

    0 - EntriesRead

    UINT32

    0 - Buffer

    share container with > 0 entries:

    UINT32

    EntriesRead

    UINT32

    non-zero - Buffer

    UINT32

    EntriesRead

    SH_INFO_1_PTR[EntriesRead]

    share entry pointers

    SH_INFO_1_STR[EntriesRead]

    share entry strings

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    UINT32

    EntriesRead

    UINT32

    0 - padding

    SERVER_INFO_101

    Note: see cifs6.txt section 6.4 - the fields described therein will be of assistance here. for example, the type listed below is the same as fServerType, which is described in 6.4.1.

    SV_TYPE_WORKSTATION

    0x00000001 All workstations

    SV_TYPE_SERVER

    0x00000002 All servers

    SV_TYPE_SQLSERVER

    0x00000004 Any server running with SQL server

    SV_TYPE_DOMAIN_CTRL

    0x00000008 Primary domain controller

    SV_TYPE_DOMAIN_BAKCTRL

    0x00000010 Backup domain controller

    SV_TYPE_TIME_SOURCE

    0x00000020 Server running the timesource service

    SV_TYPE_AFP

    0x00000040 Apple File Protocol servers

    SV_TYPE_NOVELL

    0x00000080 Novell servers

    SV_TYPE_DOMAIN_MEMBER

    0x00000100 Domain Member

    SV_TYPE_PRINTQ_SERVER

    0x00000200 Server sharing print queue

    SV_TYPE_DIALIN_SERVER

    0x00000400 Server running dialin service.

    SV_TYPE_XENIX_SERVER

    0x00000800 Xenix server

    SV_TYPE_NT

    0x00001000 NT server

    SV_TYPE_WFW

    0x00002000 Server running Windows for

    SV_TYPE_SERVER_NT

    0x00008000 Windows NT non DC server

    SV_TYPE_POTENTIAL_BROWSER

    0x00010000 Server that can run the browser service

    SV_TYPE_BACKUP_BROWSER

    0x00020000 Backup browser server

    SV_TYPE_MASTER_BROWSER

    0x00040000 Master browser server

    SV_TYPE_DOMAIN_MASTER

    0x00080000 Domain Master Browser server

    SV_TYPE_LOCAL_LIST_ONLY

    0x40000000 Enumerate only entries marked "local"

    SV_TYPE_DOMAIN_ENUM

    0x80000000 Enumerate Domains. The pszServer and pszDomain parameters must be NULL.

    UINT32

    500 - platform_id

    VOID*

    pointer to name

    UINT32

    5 - major version

    UINT32

    4 - minor version

    UINT32

    type (SV_TYPE_... bit field)

    VOID*

    pointer to comment

    UNISTR2

    sv101_name - unicode string of server name

    UNISTR2

    sv_101_comment - unicode string of server comment.

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    MSRPC over Transact Named Pipe

    For details on the SMB Transact Named Pipe, see cifs6.txt

    MSRPC Pipes

    The MSRPC is conducted over an SMB Transact Pipe with a name of -\PIPE\. You must first obtain a 16 bit file handle, by -sending a SMBopenX with the pipe name \PIPE\srvsvc for +\PIPE\. You must first obtain a 16 bit file handle, by +sending a SMBopenX with the pipe name \PIPE\srvsvc for example. You can then perform an SMB Trans, and must carry out an SMBclose on the file handle once you are finished.

    @@ -1254,11 +1271,11 @@ listed below:

             initial SMBopenX request:         RPC API command 0x26 params:
         "\\PIPE\\lsarpc"                  0x65 0x63; 0x72 0x70; 0x44 0x65;
         "\\PIPE\\srvsvc"                  0x73 0x76; 0x4E 0x00; 0x5C 0x43;
-

    Header

    [section to be rewritten, following receipt of work by Duncan Stansfield]

    Interesting note: if you set packed data representation to 0x0100 0000 -then all 4-byte and 2-byte word ordering is turned around!

    The start of each of the NTLSA and NETLOGON named pipes begins with:

    offset: 00

    Variable type: UINT8

    Variable data: 5 - RPC major version

    offset: 01

    Variable type: UINT8

    Variable data: 0 - RPC minor version

    offset: 02

    Variable type: UINT8

    Variable data: 2 - RPC response packet

    offset: 03

    Variable type: UINT8

    Variable data: 3 - (FirstFrag bit-wise or with LastFrag)

    offset: 04

    Variable type: UINT32

    Variable data: 0x1000 0000 - packed data representation

    offset: 08

    Variable type: UINT16

    Variable data: fragment length - data size (bytes) inc header and tail.

    offset: 0A

    Variable type: UINT16

    Variable data: 0 - authentication length

    offset: 0C

    Variable type: UINT32

    Variable data: call identifier. matches 12th UINT32 of incoming RPC data.

    offset: 10

    Variable type: UINT32

    Variable data: allocation hint - data size (bytes) minus header and tail.

    offset: 14

    Variable type: UINT16

    Variable data: 0 - presentation context identifier

    offset: 16

    Variable type: UINT8

    Variable data: 0 - cancel count

    offset: 17

    Variable type: UINT8

    Variable data: in replies: 0 - reserved; in requests: opnum - see #defines.

    offset: 18

    Variable type: ......

    Variable data: start of data (goes on for allocation_hint bytes)

    RPC_Packet for request, response, bind and bind acknowledgement

    UINT8 versionmaj

    reply same as request (0x05)

    UINT8 versionmin

    reply same as request (0x00)

    UINT8 type

    one of the MSRPC_Type enums

    UINT8 flags

    reply same as request (0x00 for Bind, 0x03 for Request)

    UINT32 representation

    reply same as request (0x00000010)

    UINT16 fraglength

    the length of the data section of the SMB trans packet

    UINT16 authlength

    UINT32 callid

    call identifier. (e.g. 0x00149594)

    * stub USE TvPacket

    the remainder of the packet depending on the "type"

    Interface identification

    the interfaces are numbered. as yet I haven't seen more than one interface used on the same pipe name srvsvc

    +

    Header

    [section to be rewritten, following receipt of work by Duncan Stansfield]

    Interesting note: if you set packed data representation to 0x0100 0000 +then all 4-byte and 2-byte word ordering is turned around!

    The start of each of the NTLSA and NETLOGON named pipes begins with:

    offset: 00

    Variable type: UINT8

    Variable data: 5 - RPC major version

    offset: 01

    Variable type: UINT8

    Variable data: 0 - RPC minor version

    offset: 02

    Variable type: UINT8

    Variable data: 2 - RPC response packet

    offset: 03

    Variable type: UINT8

    Variable data: 3 - (FirstFrag bit-wise or with LastFrag)

    offset: 04

    Variable type: UINT32

    Variable data: 0x1000 0000 - packed data representation

    offset: 08

    Variable type: UINT16

    Variable data: fragment length - data size (bytes) inc header and tail.

    offset: 0A

    Variable type: UINT16

    Variable data: 0 - authentication length

    offset: 0C

    Variable type: UINT32

    Variable data: call identifier. matches 12th UINT32 of incoming RPC data.

    offset: 10

    Variable type: UINT32

    Variable data: allocation hint - data size (bytes) minus header and tail.

    offset: 14

    Variable type: UINT16

    Variable data: 0 - presentation context identifier

    offset: 16

    Variable type: UINT8

    Variable data: 0 - cancel count

    offset: 17

    Variable type: UINT8

    Variable data: in replies: 0 - reserved; in requests: opnum - see #defines.

    offset: 18

    Variable type: ......

    Variable data: start of data (goes on for allocation_hint bytes)

    RPC_Packet for request, response, bind and bind acknowledgement

    UINT8 versionmaj

    reply same as request (0x05)

    UINT8 versionmin

    reply same as request (0x00)

    UINT8 type

    one of the MSRPC_Type enums

    UINT8 flags

    reply same as request (0x00 for Bind, 0x03 for Request)

    UINT32 representation

    reply same as request (0x00000010)

    UINT16 fraglength

    the length of the data section of the SMB trans packet

    UINT16 authlength

    UINT32 callid

    call identifier. (e.g. 0x00149594)

    * stub USE TvPacket

    the remainder of the packet depending on the "type"

    Interface identification

    the interfaces are numbered. as yet I haven't seen more than one interface used on the same pipe name srvsvc

     abstract (0x4B324FC8, 0x01D31670, 0x475A7812, 0x88E16EBF, 0x00000003)
 transfer (0x8A885D04, 0x11C91CEB, 0x0008E89F, 0x6048102B, 0x00000002)
-

    RPC_Iface RW

    UINT8 byte[16]

    16 bytes of number

    UINT32 version

    the interface number

    RPC_ReqBind RW

    the remainder of the packet after the header if "type" was Bind in the response header, "type" should be BindAck

    UINT16 maxtsize

    maximum transmission fragment size (0x1630)

    UINT16 maxrsize

    max receive fragment size (0x1630)

    UINT32 assocgid

    associated group id (0x0)

    UINT32 numelements

    the number of elements (0x1)

    UINT16 contextid

    presentation context identifier (0x0)

    UINT8 numsyntaxes

    the number of syntaxes (has always been 1?)(0x1)

    UINT8[]

    4-byte alignment padding, against SMB header

    * abstractint USE RPC_Iface

    num and vers. of interface client is using

    * transferint USE RPC_Iface

    num and vers. of interface to use for replies

    RPC_Address RW

    UINT16 length

    length of the string including null terminator

    * port USE string

    the string above in single byte, null terminated form

    RPC_ResBind RW

    the response to place after the header in the reply packet

    UINT16 maxtsize

    same as request

    UINT16 maxrsize

    same as request

    UINT32 assocgid

    zero

    * secondaddr USE RPC_Address

    the address string, as described earlier

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT8 numresults

    the number of results (0x01)

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT16 result

    result (0x00 = accept)

    UINT16 reason

    reason (0x00 = no reason specified)

    * transfersyntax USE RPC_Iface

    the transfer syntax from the request

    RPC_ReqNorm RW

    the remainder of the packet after the header for every other other request

    UINT32 allochint

    the size of the stub data in bytes

    UINT16 prescontext

    presentation context identifier (0x0)

    UINT16 opnum

    operation number (0x15)

    * stub USE TvPacket

    a packet dependent on the pipe name (probably the interface) and the op number)

    RPC_ResNorm RW

    UINT32 allochint

    # size of the stub data in bytes

    UINT16 prescontext

    # presentation context identifier (same as request)

    UINT8 cancelcount

    # cancel count? (0x0)

    UINT8 reserved

    # 0 - one byte padding

    * stub USE TvPacket

    # the remainder of the reply

    Tail

    The end of each of the NTLSA and NETLOGON named pipes ends with:

    ......

    end of data

    UINT32

    return code

    RPC Bind / Bind Ack

    +

    RPC_Iface RW

    UINT8 byte[16]

    16 bytes of number

    UINT32 version

    the interface number

    RPC_ReqBind RW

    the remainder of the packet after the header if "type" was Bind in the response header, "type" should be BindAck

    UINT16 maxtsize

    maximum transmission fragment size (0x1630)

    UINT16 maxrsize

    max receive fragment size (0x1630)

    UINT32 assocgid

    associated group id (0x0)

    UINT32 numelements

    the number of elements (0x1)

    UINT16 contextid

    presentation context identifier (0x0)

    UINT8 numsyntaxes

    the number of syntaxes (has always been 1?)(0x1)

    UINT8[]

    4-byte alignment padding, against SMB header

    * abstractint USE RPC_Iface

    num and vers. of interface client is using

    * transferint USE RPC_Iface

    num and vers. of interface to use for replies

    RPC_Address RW

    UINT16 length

    length of the string including null terminator

    * port USE string

    the string above in single byte, null terminated form

    RPC_ResBind RW

    the response to place after the header in the reply packet

    UINT16 maxtsize

    same as request

    UINT16 maxrsize

    same as request

    UINT32 assocgid

    zero

    * secondaddr USE RPC_Address

    the address string, as described earlier

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT8 numresults

    the number of results (0x01)

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT16 result

    result (0x00 = accept)

    UINT16 reason

    reason (0x00 = no reason specified)

    * transfersyntax USE RPC_Iface

    the transfer syntax from the request

    RPC_ReqNorm RW

    the remainder of the packet after the header for every other other request

    UINT32 allochint

    the size of the stub data in bytes

    UINT16 prescontext

    presentation context identifier (0x0)

    UINT16 opnum

    operation number (0x15)

    * stub USE TvPacket

    a packet dependent on the pipe name (probably the interface) and the op number)

    RPC_ResNorm RW

    UINT32 allochint

    # size of the stub data in bytes

    UINT16 prescontext

    # presentation context identifier (same as request)

    UINT8 cancelcount

    # cancel count? (0x0)

    UINT8 reserved

    # 0 - one byte padding

    * stub USE TvPacket

    # the remainder of the reply

    Tail

    The end of each of the NTLSA and NETLOGON named pipes ends with:

    ......

    end of data

    UINT32

    return code

    RPC Bind / Bind Ack

    RPC Binds are the process of associating an RPC pipe (e.g \PIPE\lsarpc) with a "transfer syntax" (see RPC_Iface structure). The purpose for doing this is unknown. @@ -1266,7 +1283,7 @@ this is unknown. returned by the SMBopenX Transact response.

    Note: The RPC_ResBind members maxtsize, maxrsize and assocgid are the same in the response as the same members in the RPC_ReqBind. The RPC_ResBind member transfersyntax is the same in the response as the

    Note: The RPC_ResBind response member secondaddr contains the name of what is presumed to be the service behind the RPC pipe. The - mapping identified so far is:

    initial SMBopenX request:

    RPC_ResBind response:

    "\\PIPE\\srvsvc"

    "\\PIPE\\ntsvcs"

    "\\PIPE\\samr"

    "\\PIPE\\lsass"

    "\\PIPE\\lsarpc"

    "\\PIPE\\lsass"

    "\\PIPE\\wkssvc"

    "\\PIPE\\wksvcs"

    "\\PIPE\\NETLOGON"

    "\\PIPE\\NETLOGON"

    Note: The RPC_Packet fraglength member in both the Bind Request and Bind Acknowledgment must contain the length of the entire RPC data, including the RPC_Packet header.

    Request:

    RPC_Packet
    RPC_ReqBind

    Response:

    RPC_Packet
    RPC_ResBind

    NTLSA Transact Named Pipe

    The sequence of actions taken on this pipe are:

    Establish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    Open an RPC Pipe with the name "\\PIPE\\lsarpc". Store the file handle.
    Using the file handle, send a Set Named Pipe Handle state to 0x4300.
    Send an LSA Open Policy request. Store the Policy Handle.
    Using the Policy Handle, send LSA Query Info Policy requests, etc.
    Using the Policy Handle, send an LSA Close.
    Close the IPC$ share.

    Defines for this pipe, identifying the query are:

    LSA Open Policy:

    0x2c

    LSA Query Info Policy:

    0x07

    LSA Enumerate Trusted Domains:

    0x0d

    LSA Open Secret:

    0xff

    LSA Lookup SIDs:

    0xfe

    LSA Lookup Names:

    0xfd

    LSA Close:

    0x00

    LSA Open Policy

    Note: The policy handle can be anything you like.

    Request

    VOID*

    buffer pointer

    UNISTR2

    server name - unicode string starting with two '\'s

    OBJ_ATTR

    object attributes

    UINT32

    1 - desired access

    Response

    POL_HND

    LSA policy handle

    return

    0 - indicates success

    LSA Query Info Policy

    Note: The info class in response must be the same as that in the request.

    Request

    POL_HND

    LSA policy handle

    UINT16

    info class (also a policy handle?)

    Response

    VOID*

    undocumented buffer pointer

    UINT16

    info class (same as info class in request).

    +	mapping identified so far is:
    initial SMBopenX request:
    RPC_ResBind response:
    "\\PIPE\\srvsvc"
    "\\PIPE\\ntsvcs"
    "\\PIPE\\samr"
    "\\PIPE\\lsass"
    "\\PIPE\\lsarpc"
    "\\PIPE\\lsass"
    "\\PIPE\\wkssvc"
    "\\PIPE\\wksvcs"
    "\\PIPE\\NETLOGON"
    "\\PIPE\\NETLOGON"
    Note:	The RPC_Packet fraglength member in both the Bind Request and Bind Acknowledgment must contain the length of the entire RPC data, including the RPC_Packet header.
    Request:
    RPC_Packet
    RPC_ReqBind
    Response:
    RPC_Packet
    RPC_ResBind

    NTLSA Transact Named Pipe

    The sequence of actions taken on this pipe are:

    Establish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    Open an RPC Pipe with the name "\\PIPE\\lsarpc". Store the file handle.
    Using the file handle, send a Set Named Pipe Handle state to 0x4300.
    Send an LSA Open Policy request. Store the Policy Handle.
    Using the Policy Handle, send LSA Query Info Policy requests, etc.
    Using the Policy Handle, send an LSA Close.
    Close the IPC$ share.

    Defines for this pipe, identifying the query are:

    LSA Open Policy:

    0x2c

    LSA Query Info Policy:

    0x07

    LSA Enumerate Trusted Domains:

    0x0d

    LSA Open Secret:

    0xff

    LSA Lookup SIDs:

    0xfe

    LSA Lookup Names:

    0xfd

    LSA Close:

    0x00

    LSA Open Policy

    Note: The policy handle can be anything you like.

    Request

    VOID*

    buffer pointer

    UNISTR2

    server name - unicode string starting with two '\'s

    OBJ_ATTR

    object attributes

    UINT32

    1 - desired access

    Response

    POL_HND

    LSA policy handle

    return

    0 - indicates success

    LSA Query Info Policy

    Note: The info class in response must be the same as that in the request.

    Request

    POL_HND

    LSA policy handle

    UINT16

    info class (also a policy handle?)

    Response

    VOID*

    undocumented buffer pointer

    UINT16

    info class (same as info class in request).

     switch (info class)
 case 3:
 case 5:
@@ -1275,11 +1292,11 @@ DOM_INFO domain info, levels 3 and 5 (are the same).
 }
 
 return    0 - indicates success
-

    LSA Enumerate Trusted Domains

    Request

    no extra data

    Response

    UINT32

    0 - enumeration context

    UINT32

    0 - entries read

    UINT32

    0 - trust information

    return

    0x8000 001a - "no trusted domains" success code

    LSA Open Secret

    Request

    no extra data

    Response

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    return 0x0C00 0034 - "no such secret" success code

    LSA Close

    Request

    POL_HND

    policy handle to be closed

    Response

    POL_HND

    0s - closed policy handle (all zeros)

    return 0 - indicates success

    LSA Lookup SIDS

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    VOID*[num_entries] undocumented domain SID pointers to be looked up. -

    DOM_SID[num_entries] domain SIDs to be looked up.

    char[16]

    completely undocumented 16 bytes.

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_SID2[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    LSA Lookup Names

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    NAME[num_entries]

    names to be looked up.

    char[]

    undocumented bytes - falsely translated SID structure?

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_RID[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    NETLOGON rpc Transact Named Pipe

    The sequence of actions taken on this pipe are:

    tablish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    en an RPC Pipe with the name "\\PIPE\\NETLOGON". Store the file handle.
    ing the file handle, send a Set Named Pipe Handle state to 0x4300.
    eate Client Challenge. Send LSA Request Challenge. Store Server Challenge.
    lculate Session Key. Send an LSA Auth 2 Challenge. Store Auth2 Challenge.
    lc/Verify Client Creds. Send LSA Srv PW Set. Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logon . Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logoff. Calc/Verify Server Creds.
    ose the IPC$ share.

    Defines for this pipe, identifying the query are

    LSA Request Challenge:

    0x04

    LSA Server Password Set:

    0x06

    LSA SAM Logon:

    0x02

    LSA SAM Logoff:

    0x03

    LSA Auth 2:

    0x0f

    LSA Logon Control:

    0x0e

    LSA Request Challenge

    Note: logon server name starts with two '\' characters and is upper case.

    Note: logon client is the machine, not the user.

    Note: the initial LanManager password hash, against which the challenge is issued, is the machine name itself (lower case). there will becalls issued (LSA Server Password Set) which will change this, later. refusing these calls allows you to always deal with the same password (i.e the LM# of the machine name in lower case).

    Request

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    logon client unicode string

    char[8]

    client challenge

    Response

    char[8]

    server challenge

    return 0 - indicates success

    LSA Authenticate 2

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: neg_flags in the response is the same as that in the request.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    LOG_INFO

    client identification info

    char[8]

    client-calculated credentials

    UINT8[]

    padding to 4-byte align with start of SMB header.

    UINT32

    neg_flags - negotiated flags (usual value is 0x0000 01ff)

    Response

    char[8]

    server credentials.

    UINT32

    neg_flags - same as neg_flags in request.

    return 0 - indicates success. failure value unknown.

    LSA Server Password Set

    Note: the new password is suspected to be a DES encryption using the old password to generate the key.

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: the server credentials are constructed from the client-calculated credentials and the client time + 1 second.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    CLNT_INFO

    client identification/authentication info

    char[]

    new password - undocumented.

    Response

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success; 0xC000 006a indicates failure

    LSA SAM Logon

    +

    LSA Enumerate Trusted Domains

    Request

    no extra data

    Response

    UINT32

    0 - enumeration context

    UINT32

    0 - entries read

    UINT32

    0 - trust information

    return

    0x8000 001a - "no trusted domains" success code

    LSA Open Secret

    Request

    no extra data

    Response

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    return 0x0C00 0034 - "no such secret" success code

    LSA Close

    Request

    POL_HND

    policy handle to be closed

    Response

    POL_HND

    0s - closed policy handle (all zeros)

    return 0 - indicates success

    LSA Lookup SIDS

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    VOID*[num_entries] undocumented domain SID pointers to be looked up. +

    DOM_SID[num_entries] domain SIDs to be looked up.

    char[16]

    completely undocumented 16 bytes.

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_SID2[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    LSA Lookup Names

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    NAME[num_entries]

    names to be looked up.

    char[]

    undocumented bytes - falsely translated SID structure?

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_RID[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    NETLOGON rpc Transact Named Pipe

    The sequence of actions taken on this pipe are:

    tablish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    en an RPC Pipe with the name "\\PIPE\\NETLOGON". Store the file handle.
    ing the file handle, send a Set Named Pipe Handle state to 0x4300.
    eate Client Challenge. Send LSA Request Challenge. Store Server Challenge.
    lculate Session Key. Send an LSA Auth 2 Challenge. Store Auth2 Challenge.
    lc/Verify Client Creds. Send LSA Srv PW Set. Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logon . Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logoff. Calc/Verify Server Creds.
    ose the IPC$ share.

    Defines for this pipe, identifying the query are

    LSA Request Challenge:

    0x04

    LSA Server Password Set:

    0x06

    LSA SAM Logon:

    0x02

    LSA SAM Logoff:

    0x03

    LSA Auth 2:

    0x0f

    LSA Logon Control:

    0x0e

    LSA Request Challenge

    Note: logon server name starts with two '\' characters and is upper case.

    Note: logon client is the machine, not the user.

    Note: the initial LanManager password hash, against which the challenge is issued, is the machine name itself (lower case). there will becalls issued (LSA Server Password Set) which will change this, later. refusing these calls allows you to always deal with the same password (i.e the LM# of the machine name in lower case).

    Request

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    logon client unicode string

    char[8]

    client challenge

    Response

    char[8]

    server challenge

    return 0 - indicates success

    LSA Authenticate 2

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: neg_flags in the response is the same as that in the request.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    LOG_INFO

    client identification info

    char[8]

    client-calculated credentials

    UINT8[]

    padding to 4-byte align with start of SMB header.

    UINT32

    neg_flags - negotiated flags (usual value is 0x0000 01ff)

    Response

    char[8]

    server credentials.

    UINT32

    neg_flags - same as neg_flags in request.

    return 0 - indicates success. failure value unknown.

    LSA Server Password Set

    Note: the new password is suspected to be a DES encryption using the old password to generate the key.

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: the server credentials are constructed from the client-calculated credentials and the client time + 1 second.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    CLNT_INFO

    client identification/authentication info

    char[]

    new password - undocumented.

    Response

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success; 0xC000 006a indicates failure

    LSA SAM Logon

    Note: valid_user is True iff the username and password hash are valid for the requested domain. -

    Request

    SAM_INFO

    sam_id structure

    Response

    VOID*

    undocumented buffer pointer

    CREDS

    server credentials. server time stamp appears to be ignored.

    +
    Request
    SAM_INFO
    sam_id structure
    Response
    VOID*
    undocumented buffer pointer
    CREDS
    server credentials.  server time stamp appears to be ignored.
     if (valid_user)
 {
 	UINT16      3 - switch value indicating USER_INFO structure.
@@ -1299,16 +1316,16 @@ else
 
     return    0xC000 0064 - NT_STATUS_NO_SUCH_USER.
 }
-

    LSA SAM Logoff

    +

    LSA SAM Logoff

    Note: presumably, the SAM_INFO structure is validated, and a (currently undocumented) error code returned if the Logoff is invalid. -

    Request

    SAM_INFO

    sam_id structure

    Response

    VOID*

    undocumented buffer pointer

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success. undocumented failure indication.

    \\MAILSLOT\NET\NTLOGON

    +

    Request

    SAM_INFO

    sam_id structure

    Response

    VOID*

    undocumented buffer pointer

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success. undocumented failure indication.

    \\MAILSLOT\NET\NTLOGON

    Note: mailslots will contain a response mailslot, to which the response should be sent. the target NetBIOS name is REQUEST_NAME<20>, where REQUEST_NAME is the name of the machine that sent the request. -

    Query for PDC

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Request

    UINT16

    0x0007 - Query for PDC

    STR

    machine name

    STR

    response mailslot

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x000A - Respose to Query for PDC

    STR

    machine name (in uppercase)

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UNISTR

    domain name

    UINT32

    NTversion (same as received in request)

    UINT16

    LMNTtoken (same as received in request)

    UINT16

    LM20token (same as received in request)

    SAM Logon

    Note: machine name in response is preceded by two '\' characters.

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Note: user name in the response is presumably the same as that in the request.

    Request

    UINT16

    0x0012 - SAM Logon

    UINT16

    request count

    UNISTR

    machine name

    UNISTR

    user name

    STR

    response mailslot

    UINT32

    alloweable account

    UINT32

    domain SID size

    char[sid_size]

    domain SID, of sid_size bytes.

    UINT8[]

    ???? padding to 4? 2? -byte align with start of mailslot.

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x0013 - Response to SAM Logon

    UNISTR

    machine name

    UNISTR

    user name - workstation trust account

    UNISTR

    domain name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    SRVSVC Transact Named Pipe

    Defines for this pipe, identifying the query are:

    Net Share Enum

    0x0f

    Net Server Get Info

    0x15

    Net Share Enum

    Note: share level and switch value in the response are presumably the same as those in the request.

    Note: cifsrap2.txt (section 5) may be of limited assistance here.

    Request

    VOID*

    pointer (to server name?)

    UNISTR2

    server name

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info with 0 entries

    UINT32

    preferred maximum length (0xffff ffff)

    Response

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info (only added if share info ptr is non-zero)

    return 0 - indicates success

    Net Server Get Info

    Note: level is the same value as in the request.

    Request

    UNISTR2

    server name

    UINT32

    switch level

    Response

    UINT32

    switch level

    VOID*

    pointer to SERVER_INFO_101

    SERVER_INFO_101

    server info (only added if server info ptr is non-zero)

    return 0 - indicates success

    Cryptographic side of NT Domain Authentication

    Definitions

    Add(A1,A2)

    Intel byte ordered addition of corresponding 4 byte words in arrays A1 and A2

    E(K,D)

    DES ECB encryption of 8 byte data D using 7 byte key K

    lmowf()

    Lan man hash

    ntowf()

    NT hash

    PW

    md4(machine_password) == md4(lsadump $machine.acc) == +

    Query for PDC

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Request

    UINT16

    0x0007 - Query for PDC

    STR

    machine name

    STR

    response mailslot

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x000A - Respose to Query for PDC

    STR

    machine name (in uppercase)

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UNISTR

    domain name

    UINT32

    NTversion (same as received in request)

    UINT16

    LMNTtoken (same as received in request)

    UINT16

    LM20token (same as received in request)

    SAM Logon

    Note: machine name in response is preceded by two '\' characters.

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Note: user name in the response is presumably the same as that in the request.

    Request

    UINT16

    0x0012 - SAM Logon

    UINT16

    request count

    UNISTR

    machine name

    UNISTR

    user name

    STR

    response mailslot

    UINT32

    alloweable account

    UINT32

    domain SID size

    char[sid_size]

    domain SID, of sid_size bytes.

    UINT8[]

    ???? padding to 4? 2? -byte align with start of mailslot.

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x0013 - Response to SAM Logon

    UNISTR

    machine name

    UNISTR

    user name - workstation trust account

    UNISTR

    domain name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    SRVSVC Transact Named Pipe

    Defines for this pipe, identifying the query are:

    Net Share Enum

    0x0f

    Net Server Get Info

    0x15

    Net Share Enum

    Note: share level and switch value in the response are presumably the same as those in the request.

    Note: cifsrap2.txt (section 5) may be of limited assistance here.

    Request

    VOID*

    pointer (to server name?)

    UNISTR2

    server name

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info with 0 entries

    UINT32

    preferred maximum length (0xffff ffff)

    Response

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info (only added if share info ptr is non-zero)

    return 0 - indicates success

    Net Server Get Info

    Note: level is the same value as in the request.

    Request

    UNISTR2

    server name

    UINT32

    switch level

    Response

    UINT32

    switch level

    VOID*

    pointer to SERVER_INFO_101

    SERVER_INFO_101

    server info (only added if server info ptr is non-zero)

    return 0 - indicates success

    Cryptographic side of NT Domain Authentication

    Definitions

    Add(A1,A2)

    Intel byte ordered addition of corresponding 4 byte words in arrays A1 and A2

    E(K,D)

    DES ECB encryption of 8 byte data D using 7 byte key K

    lmowf()

    Lan man hash

    ntowf()

    NT hash

    PW

    md4(machine_password) == md4(lsadump $machine.acc) == pwdump(machine$) (initially) == md4(lmowf(unicode(machine))) -

    ARC4(K,Lk,D,Ld)

    ARC4 encryption of data D of length Ld with key K of length Lk

    v[m..n(,l)]

    subset of v from bytes m to n, optionally padded with zeroes to length l

    Cred(K,D)

    E(K[7..7,7],E(K[0..6],D)) computes a credential

    Time()

    4 byte current time

    Cc,Cs

    8 byte client and server challenges Rc,Rs: 8 byte client and server credentials

    Protocol

    +
    ARC4(K,Lk,D,Ld)
    ARC4 encryption of data D of length Ld with key K of length Lk
    v[m..n(,l)]
    subset of v from bytes m to n, optionally padded with zeroes to length l
    Cred(K,D)
    E(K[7..7,7],E(K[0..6],D)) computes a credential
    Time()
    4 byte current time
    Cc,Cs
    8 byte client and server challenges Rc,Rs: 8 byte client and server credentials

    Protocol

     C->S ReqChal,Cc
 S->C Cs
 
    @@ -1344,7 +1361,7 @@ S: Ts = Time()
 S->C Cred(Ks,Cred(Ks,Rc+Tc+1)),userinfo(logon script,UID,SIDs,etc)
 C: assert(Rs == Cred(Ks,Cred(Rc+Tc+1))
 C: Rc = Cred(Ks,Rc+Tc+1)
-

    Comments

    +

    Comments

    On first joining the domain the session key could be computed by anyone listening in on the network as the machine password has a well known value. Until the machine is rebooted it will use this session @@ -1365,43 +1382,43 @@ returned by the server. The password OWFs should NOT be sent over the network reversibly encrypted. They should be sent using ARC4(Ks,md4(owf)) with the server computing the same function using the owf values in the SAM. -

    SIDs and RIDs

    +

    SIDs and RIDs

    SIDs and RIDs are well documented elsewhere.

    A SID is an NT Security ID (see DOM_SID structure). They are of the form:

    revision-NN-SubAuth1-SubAuth2-SubAuth3...
    revision-0xNNNNNNNNNNNN-SubAuth1-SubAuth2-SubAuth3...

    currently, the SID revision is 1. The Sub-Authorities are known as Relative IDs (RIDs). -

    Well-known SIDs

    Universal well-known SIDs

    Null SID

    S-1-0-0

    World

    S-1-1-0

    Local

    S-1-2-0

    Creator Owner ID

    S-1-3-0

    Creator Group ID

    S-1-3-1

    Creator Owner Server ID

    S-1-3-2

    Creator Group Server ID

    S-1-3-3

    (Non-unique IDs)

    S-1-4

    NT well-known SIDs

    NT Authority

    S-1-5

    Dialup

    S-1-5-1

    Network

    S-1-5-2

    Batch

    S-1-5-3

    Interactive

    S-1-5-4

    Service

    S-1-5-6

    AnonymousLogon(aka null logon session)

    S-1-5-7

    Proxy

    S-1-5-8

    ServerLogon(aka domain controller account)

    S-1-5-8

    (Logon IDs)

    S-1-5-5-X-Y

    (NT non-unique IDs)

    S-1-5-0x15-...

    (Built-in domain)

    s-1-5-0x20

    Well-known RIDS

    +

    Well-known SIDs

    Universal well-known SIDs

    Null SID

    S-1-0-0

    World

    S-1-1-0

    Local

    S-1-2-0

    Creator Owner ID

    S-1-3-0

    Creator Group ID

    S-1-3-1

    Creator Owner Server ID

    S-1-3-2

    Creator Group Server ID

    S-1-3-3

    (Non-unique IDs)

    S-1-4

    NT well-known SIDs

    NT Authority

    S-1-5

    Dialup

    S-1-5-1

    Network

    S-1-5-2

    Batch

    S-1-5-3

    Interactive

    S-1-5-4

    Service

    S-1-5-6

    AnonymousLogon(aka null logon session)

    S-1-5-7

    Proxy

    S-1-5-8

    ServerLogon(aka domain controller account)

    S-1-5-8

    (Logon IDs)

    S-1-5-5-X-Y

    (NT non-unique IDs)

    S-1-5-0x15-...

    (Built-in domain)

    s-1-5-0x20

    Well-known RIDS

    A RID is a sub-authority value, as part of either a SID, or in the case of Group RIDs, part of the DOM_GID structure, in the USER_INFO_1 structure, in the LSA SAM Logon response. -

    Well-known RID users

    Groupname: DOMAIN_USER_RID_ADMIN

    ????: 0x0000

    RID: 01F4

    Groupname: DOMAIN_USER_RID_GUEST

    ????: 0x0000

    RID: 01F5

    Well-known RID groups

    Groupname: DOMAIN_GROUP_RID_ADMINS

    ????: 0x0000

    RID: 0200

    Groupname: DOMAIN_GROUP_RID_USERS

    ????: 0x0000

    RID: 0201

    Groupname: DOMAIN_GROUP_RID_GUESTS

    ????: 0x0000

    RID: 0202

    Well-known RID aliases

    Groupname: DOMAIN_ALIAS_RID_ADMINS

    ????: 0x0000

    RID: 0220

    Groupname: DOMAIN_ALIAS_RID_USERS

    ????: 0x0000

    RID: 0221

    Groupname: DOMAIN_ALIAS_RID_GUESTS

    ????: 0x0000

    RID: 0222

    Groupname: DOMAIN_ALIAS_RID_POWER_USERS

    ????: 0x0000

    RID: 0223

    Groupname: DOMAIN_ALIAS_RID_ACCOUNT_OPS

    ????: 0x0000

    RID: 0224

    Groupname: DOMAIN_ALIAS_RID_SYSTEM_OPS

    ????: 0x0000

    RID: 0225

    Groupname: DOMAIN_ALIAS_RID_PRINT_OPS

    ????: 0x0000

    RID: 0226

    Groupname: DOMAIN_ALIAS_RID_BACKUP_OPS

    ????: 0x0000

    RID: 0227

    Groupname: DOMAIN_ALIAS_RID_REPLICATOR

    ????: 0x0000

    RID: 0228

    Chapter 10. Samba Printing Internals

    Gerald Carter

    October 2002

    Table of Contents

    Abstract
    +

    Well-known RID users

    Groupname: DOMAIN_USER_RID_ADMIN

    ????: 0x0000

    RID: 01F4

    Groupname: DOMAIN_USER_RID_GUEST

    ????: 0x0000

    RID: 01F5

    Well-known RID groups

    Groupname: DOMAIN_GROUP_RID_ADMINS

    ????: 0x0000

    RID: 0200

    Groupname: DOMAIN_GROUP_RID_USERS

    ????: 0x0000

    RID: 0201

    Groupname: DOMAIN_GROUP_RID_GUESTS

    ????: 0x0000

    RID: 0202

    Well-known RID aliases

    Groupname: DOMAIN_ALIAS_RID_ADMINS

    ????: 0x0000

    RID: 0220

    Groupname: DOMAIN_ALIAS_RID_USERS

    ????: 0x0000

    RID: 0221

    Groupname: DOMAIN_ALIAS_RID_GUESTS

    ????: 0x0000

    RID: 0222

    Groupname: DOMAIN_ALIAS_RID_POWER_USERS

    ????: 0x0000

    RID: 0223

    Groupname: DOMAIN_ALIAS_RID_ACCOUNT_OPS

    ????: 0x0000

    RID: 0224

    Groupname: DOMAIN_ALIAS_RID_SYSTEM_OPS

    ????: 0x0000

    RID: 0225

    Groupname: DOMAIN_ALIAS_RID_PRINT_OPS

    ????: 0x0000

    RID: 0226

    Groupname: DOMAIN_ALIAS_RID_BACKUP_OPS

    ????: 0x0000

    RID: 0227

    Groupname: DOMAIN_ALIAS_RID_REPLICATOR

    ????: 0x0000

    RID: 0228

    Chapter 11. Samba Printing Internals

    Gerald Carter

    October 2002

    Table of Contents

    Abstract
    Printing Interface to Various Back ends -
    +
    Print Queue TDB's -
    +
    ChangeID and Client Caching of Printer Information -
    +
    Windows NT/2K Printer Change Notify -

    Abstract

    +

    Abstract

    The purpose of this document is to provide some insight into Samba's printing functionality and also to describe the semantics of certain features of Windows client printing. -

    +

    Printing Interface to Various Back ends -

    +

    Samba uses a table of function pointers to seven functions. The -function prototypes are defined in the printif structure declared -in printing.h. +function prototypes are defined in the printif structure declared +in printing.h.

    • retrieve the contents of a print queue

    • pause the print queue

    • resume a paused print queue

    • delete a job from the queue

    • pause a job in the print queue

    • result a paused print job in the queue

    • submit a job to the print queue

    Currently there are only two printing back end implementations defined.

    • a generic set of functions for working with standard UNIX printing subsystems

    • a set of CUPS specific functions (this is only enabled if - the CUPS libraries were located at compile time).

    + the CUPS libraries were located at compile time).

    Print Queue TDB's -

    +

    Samba provides periodic caching of the output from the "lpq command" for performance reasons. This cache time is configurable in seconds. Obviously the longer the cache time the less often smbd will be @@ -1454,10 +1471,10 @@ id, smbd uses an in memory TDB to match the former to a number appropriate for old lanman clients.

    When updating a print queue, smbd will perform the following -steps ( refer to print.c:print_queue_update() ): +steps ( refer to print.c:print_queue_update() ):

    1. Check to see if another smbd is currently in the process of updating the queue contents by checking the pid - stored in LOCK/printer_name. + stored in LOCK/printer_name. If so, then do not update the TDB.

    2. Lock the mutex entry in the TDB and store our own pid. Check that this succeeded, else fail.

    3. Store the updated time stamp for the new cache listing

    4. Retrieve the queue listing via "lpq command"

    5. @@ -1488,13 +1505,13 @@ and the job has the printer's device mode associated with it by default.
 Only non-default Device Mode are stored with print jobs in the print
 queue TDB.  Otherwise, the Device Mode is obtained from the printer
 object when the client issues a GetJob(level == 2) request.
-

    +

    ChangeID and Client Caching of Printer Information -

    +

    [To be filled in later] -

    +

    Windows NT/2K Printer Change Notify -

    +

    When working with Windows NT+ clients, it is possible for a print server to use RPC to send asynchronous change notification events to clients for certain printer and print job attributes. @@ -1574,11 +1591,11 @@ RPC. This packet contains client's spooler on which the change occurred

  • The change_low value which was sent as part of the last RFNPCN request from the client

  • The SPOOL_NOTIFY_INFO container with the event information

    • -A SPOOL_NOTIFY_INFO contains: +A SPOOL_NOTIFY_INFO contains:

    • the version and flags field are predefined and should not be changed

    • The count field is the number of entries in the SPOOL_NOTIFY_INFO_DATA array

    -The SPOOL_NOTIFY_INFO_DATA entries contain: +The SPOOL_NOTIFY_INFO_DATA entries contain:

    • The type defines whether or not this event is for a printer or a print job

    • The field is the flag identifying the event

    • the notify_data union contains the new valuie of the attribute

    • The enc_type defines the size of the structure for marshalling @@ -1590,7 +1607,7 @@ handle for notification. Samba currently uses the snum of the printer for this which can break if the list of services has been modified since the notification handle was registered.

    • The size is either (a) the string length in UNICODE for strings, (b) the size in bytes of the security descriptor, or (c) 0 for -data values.

    Chapter 11. Samba WINS Internals

    Gerald Carter

    October 2002

    Table of Contents

    WINS Failover

    WINS Failover

    +data values.

    Chapter 12. Samba WINS Internals

    Gerald Carter

    October 2002

    Table of Contents

    WINS Failover

    WINS Failover

    The current Samba codebase possesses the capability to use groups of WINS servers that share a common namespace for NetBIOS name registration and resolution. The formal parameter syntax is @@ -1632,7 +1649,7 @@ If a timeout occurs when querying a specific WINS server, that server is marked prevent further timeouts and the next server in the WINS group is contacted. Once marked as dead, Samba will not attempt to contact that server for name registration/resolution queries for a period of 10 minutes. -

    Chapter 12. The Upcoming SAM System

    Andrew Bartlett

    1 October 2002

    Table of Contents

    Security in the 'new SAM'
    Standalone from UNIX
    Handles and Races in the new SAM
    Layers
    Application
    SAM Interface
    SAM Modules
    SAM Modules
    Special Module: sam_passdb
    sam_ads
    Memory Management
    Testing

    Security in the 'new SAM'

    One of the biggest problems with passdb is it's implementation of +

    Chapter 13. The Upcoming SAM System

    Andrew Bartlett

    1 October 2002

    Table of Contents

    Security in the 'new SAM'
    Standalone from UNIX
    Handles and Races in the new SAM
    Layers
    Application
    SAM Interface
    SAM Modules
    SAM Modules
    Special Module: sam_passdb
    sam_ads
    Memory Management
    Testing

    Security in the 'new SAM'

    One of the biggest problems with passdb is it's implementation of 'security'. Access control is on a 'are you root at the moment' basis, and it has no concept of NT ACLs. Things like ldapsam had to add 'magic' 'are you root' checks.

    We took this very seriously when we started work, and the new structure @@ -1692,7 +1709,7 @@ actual data store (like the LDAP server).

    Finally, we have generic get_sec_desc() and set_sec_desc() routines to allow external ACL manipulation. These do lookups based on SID. -

    Standalone from UNIX

    +

    Standalone from UNIX

    One of the primary tenants of the 'new SAM' is that it would not attempt to deal with 'what unix id for that'. This would be left to the 'SMS' (Sid Mapping System') or SID farm, and probably administered via @@ -1702,7 +1719,7 @@ Accounts not preexisting in unix would be served up via winbind.

    This is an *optional* part, and my preferred end-game. We have a fare way to go before things like winbind up to it however. -

    Handles and Races in the new SAM

    +

    Handles and Races in the new SAM

    One of the things that the 'new SAM' work has tried to face is both compatibility with existing code, and a closer alignment to the SAMR interface. I consider SAMR to be a 'primary customer' to the this work, @@ -1727,11 +1744,11 @@ have *really* changed. 'conflicting' updates: Currently we don't deal with this (in passdb or the new sam stuff), but the design is sufficiently flexible to 'deny' a second update. I don't foresee locking records however. -

    Layers

    Application

    +

    Layers

    Application

    This is where smbd, samtest and whatever end-user replacement we have for pdbedit sits. They use only the SAM interface, and do not get 'special knowledge' of what is below them. -

    SAM Interface

    +

    SAM Interface

    This level 'owns' the various handle structures, the get/set routines on those structures and provides the public interface. The application layer may initialize a 'context' to be passed to all interface routines, @@ -1742,7 +1759,7 @@ abstraction to the modules below, and arrange for their initial loading.

    We could possibly add ACL checking at this layer, to avoid discrepancies in implementation modules. -

    SAM Modules

    +

    SAM Modules

    These do not communicate with the application directly, only by setting values in the handles, and receiving requests from the interface. These modules are responsible for translating values from the handle's @@ -1750,13 +1767,13 @@ modules are responsible for translating values from the handle's to 'know' things like it's own domain SID, domain name, and any other state attached to the SAM. Simpler modules may call back to some helper routine. -

    SAM Modules

    Special Module: sam_passdb

    +

    SAM Modules

    Special Module: sam_passdb

    In order for there to be a smooth transition, kai is writing a module that reads existing passdb backends, and translates them into SAM replies. (Also pulling data from the account policy DB etc). We also intend to write a module that does the reverse - gives the SAM a passdb interface. -

    sam_ads

    +

    sam_ads

    This is the first of the SAM modules to be committed to the tree - mainly because I needed to coordinate work with metze (who authored most of it). This module aims to use Samba's libads code to provide an @@ -1768,7 +1785,7 @@ the construction of an Samba AD DC.

    We also intend to construct a Samba 2.2/3.0 compatible ldap module, again using libads code. -

    Memory Management

    +

    Memory Management

    The 'new SAM' development effort also concerned itself with getting a sane implementation of memory management. It was decided that we would be (as much as possible) talloc based, using an 'internal talloc @@ -1797,7 +1814,7 @@ NT_USER_TOKEN *access_token, uint32 access_desired, const DOM_SID NTSTATUS sam_enum_accounts(const SAM_CONTEXT *context, const NT_USER_TOKEN *access_token, const DOM_SID *domainsid, uint16 acct_ctrl, int32 *account_count, SAM_ACCOUNT_ENUM **accounts) -

    Testing

    +

    Testing

    Testing is vital in any piece of software, and Samba is certainly no exception. In designing this new subsystem, we have taken care to ensure it is easily tested, independent of outside protocols. @@ -1812,7 +1829,7 @@ of the system, and can load a separate configuration file. A small number of commands are currently implemented, but these have already proved vital in testing. I expect SAM module authors will find it particularly valuable. -

    Example useage:

    $ bin/samtest

    +
    Example useage:
    $ bin/samtest
     > context ads:ldap://192.168.1.96
 
    
 (this loads a new context, using the new ADS module.  The parameter is
@@ -1824,15 +1841,15 @@ the 'location' of the ldap server)
 
    
 Because the 'new SAM' is NT ACL based, there will be a command to
 specify an arbitrary NT ACL, but for now it uses 'system' by default.
-

    Chapter 13. LanMan and NT Password Encryption

    Jeremy Allison

    Samba Team


    - <samba@samba.org>
    -

    19 Apr 1999

    Table of Contents

    Introduction
    How does it work?
    The smbpasswd file

    Introduction

    With the development of LanManager and Windows NT +

    Chapter 14. LanMan and NT Password Encryption

    Jeremy Allison

    Samba Team


    +
    +

    19 Apr 1999

    Table of Contents

    Introduction
    How does it work?
    The smbpasswd file

    Introduction

    With the development of LanManager and Windows NT compatible password encryption for Samba, it is now able to validate user connections in exactly the same way as a LanManager or Windows NT server.

    This document describes how the SMB password encryption algorithm works and what issues there are in choosing whether you want to use it. You should read it carefully, especially - the part about security and the "PROS and CONS" section.

    How does it work?

    LanManager encryption is somewhat similar to UNIX + the part about security and the "PROS and CONS" section.

    How does it work?

    LanManager encryption is somewhat similar to UNIX password encryption. The server uses a file containing a hashed value of a user's password. This is created by taking the user's plaintext password, capitalising it, and either @@ -1860,7 +1877,7 @@ specify an arbitrary NT ACL, but for now it uses 'system' by default. is done on both hashes of the user's password and both responses are returned in the SMB call, giving two 24 byte values.

    The Samba server then reproduces the above calculation, using its own stored value of the 16 byte hashed password (read from the - smbpasswd file - described later) and the challenge + smbpasswd file - described later) and the challenge value that it kept from the negotiate protocol reply. It then checks to see if the 24 byte value it calculates matches the 24 byte value returned to it from the client.

    If these values match exactly, then the client knew the @@ -1869,35 +1886,35 @@ specify an arbitrary NT ACL, but for now it uses 'system' by default. know the correct password and is denied access.

    Note that the Samba server never knows or stores the cleartext of the user's password - just the 16 byte hashed values derived from it. Also note that the cleartext password or 16 byte hashed values - are never transmitted over the network - thus increasing security.

    The smbpasswd file

    In order for Samba to participate in the above protocol + are never transmitted over the network - thus increasing security.

    The smbpasswd file

    In order for Samba to participate in the above protocol it must be able to look up the 16 byte hashed values given a user name. Unfortunately, as the UNIX password value is also a one way hash function (ie. it is impossible to retrieve the cleartext of the user's password given the UNIX hash of it), a separate password file containing this 16 byte value must be kept. To minimise problems with - these two password files, getting out of sync, the UNIX - /etc/passwd and the smbpasswd file, - a utility, mksmbpasswd.sh, is provided to generate - a smbpasswd file from a UNIX /etc/passwd file. -

    To generate the smbpasswd file from your /etc/passwd - file use the following command:

    $ cat /etc/passwd | mksmbpasswd.sh - > /usr/local/samba/private/smbpasswd

    If you are running on a system that uses NIS, use

    $ ypcat passwd | mksmbpasswd.sh - > /usr/local/samba/private/smbpasswd

    The mksmbpasswd.sh program is found in + these two password files, getting out of sync, the UNIX + /etc/passwd and the smbpasswd file, + a utility, mksmbpasswd.sh, is provided to generate + a smbpasswd file from a UNIX /etc/passwd file. +

    To generate the smbpasswd file from your /etc/passwd + file use the following command:

    $ cat /etc/passwd | mksmbpasswd.sh + > /usr/local/samba/private/smbpasswd

    If you are running on a system that uses NIS, use

    $ ypcat passwd | mksmbpasswd.sh + > /usr/local/samba/private/smbpasswd

    The mksmbpasswd.sh program is found in the Samba source directory. By default, the smbpasswd file is - stored in :

    /usr/local/samba/private/smbpasswd

    The owner of the /usr/local/samba/private/ + stored in :

    /usr/local/samba/private/smbpasswd

    The owner of the /usr/local/samba/private/ directory should be set to root, and the permissions on it should - be set to 0500 (chmod 500 /usr/local/samba/private). + be set to 0500 (chmod 500 /usr/local/samba/private).

    Likewise, the smbpasswd file inside the private directory should be owned by root and the permissions on is should be set to 0600 - (chmod 600 smbpasswd).

    The format of the smbpasswd file is (The line has been + (chmod 600 smbpasswd).

    The format of the smbpasswd file is (The line has been wrapped here. It should appear as one entry per line in your smbpasswd file.)

     username:uid:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
 	[Account type]:LCT-<last-change-time>:Long name
-

    Although only the username, - uid, +

    Although only the username, + uid, XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX, - [Account type] and + [Account type] and last-change-time sections are significant and are looked at in the Samba code.

    It is VITALLY important that there by 32 'X' characters between the two ':' characters in the XXX sections - @@ -1910,7 +1927,7 @@ username:uid:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: to 32 ascii hexadecimal digits (0-9, A-F). These are an ascii representation of the 16 byte hashed value of a user's password.

    To set a user to have no password (not recommended), edit the file using vi, and replace the first 11 characters with the ascii text - "NO PASSWORD" (minus the quotes).

    For example, to clear the password for user bob, his smbpasswd file + "NO PASSWORD" (minus the quotes).

    For example, to clear the password for user bob, his smbpasswd file entry would look like :

     bob:100:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
 	[U          ]:LCT-00000000:Bob's full name:/bobhome:/bobshell
@@ -1918,38 +1935,38 @@ bob:100:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
 	their own passwords, you may want to give users NO PASSWORD initially 
 	so they do not have to enter a previous password when changing to their 
 	new password (not recommended). In order for you to allow this the
-	smbpasswd program must be able to connect to the 
-	smbd daemon as that user with no password. Enable this 
-	by adding the line :
    null passwords = yes
    to the [global] section of the smb.conf file (this is why 
+	smbpasswd program must be able to connect to the 
+	smbd daemon as that user with no password. Enable this 
+	by adding the line :
    null passwords = yes
    to the [global] section of the smb.conf file (this is why 
 	the above scenario is not recommended). Preferably, allocate your
 	users a default password to begin with, so you do not have
 	to enable this on your server.
    Note : This file should be protected very 
 	carefully. Anyone with access to this file can (with enough knowledge of 
 	the protocols) gain access to your SMB server. The file is thus more 
-	sensitive than a normal unix /etc/passwd file.

    Chapter 14. Modules

    Jelmer Vernooij

    Samba Team

    <jelmer@samba.org>

    19 March 2003

    Table of Contents

    Advantages
    Loading modules
    Static modules
    Shared modules
    Writing modules
    Static/Shared selection in configure.in

    Advantages

    + sensitive than a normal unix /etc/passwd file.

    Chapter 15. Modules

    Jelmer Vernooij

    Samba Team

    19 March 2003

    Table of Contents

    Advantages
    Loading modules
    Static modules
    Shared modules
    Writing modules
    Static/Shared selection in configure.in

    Advantages

    The new modules system has the following advantages:

    Transparent loading of static and shared modules (no need -for a subsystem to know about modules)
    Simple selection between shared and static modules at configure time
    "preload modules" option for increasing performance for stable modules
    No nasty #define stuff anymore
    All backends are available as plugin now (including pdb_ldap and pdb_tdb)

    Loading modules

    +for a subsystem to know about modules)Simple selection between shared and static modules at configure time"preload modules" option for increasing performance for stable modulesNo nasty #define stuff anymoreAll backends are available as plugin now (including pdb_ldap and pdb_tdb)

    Loading modules

    Some subsystems in samba use different backends. These backends can be either statically linked in to samba or available as a plugin. A subsystem should have a function that allows a module to register itself. For example, the passdb subsystem has: 

    -BOOL smb_register_passdb(const char *name, pdb_init_function init, int version);
+NTSTATUS smb_register_passdb(int version, const char *name, pdb_init_function init);

    This function will be called by the initialisation function of the module to register itself. -

    Static modules

    +

    Static modules

    The modules system compiles a list of initialisation functions for the static modules of each subsystem. This is a define. For example, -it is here currently (from include/config.h): +it is here currently (from include/config.h): 

     /* Static init functions */
 #define static_init_pdb { pdb_mysql_init(); pdb_ldap_init(); pdb_smbpasswd_init(); pdb_tdbsam_init(); pdb_guest_init();}

    These functions should be called before the subsystem is used. That should be done when the subsystem is initialised or first used. -

    Shared modules

    +

    Shared modules

    If a subsystem needs a certain backend, it should check if it has already been registered. If the backend hasn't been registered already, the subsystem should call smb_probe_module(char *subsystem, char *backend). @@ -1959,22 +1976,22 @@ is a slash, smb_probe_module() tries to load the module from the absolute path specified in 'backend'.

    After smb_probe_module() has been executed, the subsystem should check again if the module has been registered. -

    Writing modules

    +

    Writing modules

    Each module has an initialisation function. For modules that are -included with samba this name is 'subsystem_backend_init'. For external modules (that will never be built-in, but only available as a module) this name is always 'init_module'. (In the case of modules included with samba, the configure system will add a #define subsystem_backend_init() init_module()). +included with samba this name is 'subsystem_backend_init'. For external modules (that will never be built-in, but only available as a module) this name is always 'init_module'. (In the case of modules included with samba, the configure system will add a #define subsystem_backend_init() init_module()). The prototype for these functions is: 

    -int init_module(void);
+NTSTATUS init_module(void);

    This function should call one or more -registration functions. The function should return non-zero on success and zero on -failure.

    For example, pdb_ldap_init() contains: 

    -int pdb_ldap_init(void)
+registration functions. The function should return NT_STATUS_OK on success and  
+NT_STATUS_UNSUCCESSFUL or a more useful nt error code on failure.
    For example, pdb_ldap_init() contains: 
    +NTSTATUS pdb_ldap_init(void)
 {
-    smb_register_passdb("ldapsam", pdb_init_ldapsam, PASSDB_INTERFACE_VERSION);
-    smb_register_passdb("ldapsam_nua", pdb_init_ldapsam_nua, PASSDB_INTERFACE_VERSION);
-	return TRUE;
+smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam);
+smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_nua", pdb_init_ldapsam_nua);
+	return NT_STATUS_OK;
 }
-
    Static/Shared selection in configure.in
    
+

    Static/Shared selection in configure.in

    Some macros in configure.in generate the various defines and substs that are necessary for the system to work correct. All modules that should be built by default have to be added to the variable 'default_modules'. @@ -1983,47 +2000,648 @@ For example, if ldap is found, pdb_ldap is added to this variable. On the bottom of configure.in, SMB_MODULE() should be called for each module and SMB_SUBSYSTEM() for each subsystem.

    Syntax:

    -SMB_MODULE(subsystem_backend, object files, plugin name, subsystem name, static_action, shared_action)
-SMB_SUBSYSTEM(subsystem)
+SMB_MODULE(subsystem_backend, object files, plugin name, subsystem name, static_action, shared_action)
+SMB_SUBSYSTEM(subsystem)

    Also, make sure to add the correct directives to -Makefile.in. @SUBSYSTEM_STATIC@ +Makefile.in. @SUBSYSTEM_STATIC@ will be replaced with a list of objects files of the modules that need to -be linked in statically. @SUBSYSTEM_MODULES@ will +be linked in statically. @SUBSYSTEM_MODULES@ will be replaced with the names of the plugins to build.

    You must make sure all .c files that contain defines that can be changed by ./configure are rebuilded in the 'modules_clean' make target. -Practically, this means all c files that contain static_init_subsystem; calls need to be rebuilded. -

    Chapter 15. RPC Pluggable Modules

    Anthony Liguori

    IBM

    <aliguor@us.ibm.com>

    Jelmer Vernooij

    Samba Team

    <jelmer@samba.org>

    January 2003

    Table of Contents

    About
    General Overview

    About

    +Practically, this means all c files that contain static_init_subsystem; calls need to be rebuilded. +

    Chapter 16. RPC Pluggable Modules

    Anthony Liguori

    IBM

    Jelmer Vernooij

    Samba Team

    January 2003

    Table of Contents

    About
    General Overview

    About

    This document describes how to make use the new RPC Pluggable Modules features of Samba 3.0. This architecture was added to increase the maintainability of Samba allowing RPC Pipes to be worked on separately from the main CVS branch. The RPM architecture will also allow third-party vendors to add functionality to Samba through plug-ins. -

    General Overview

    +

    General Overview

    When an RPC call is sent to smbd, smbd tries to load a shared library by the -name librpc_<pipename>.so to handle the call if +name librpc_<pipename>.so to handle the call if it doesn't know how to handle the call internally. For instance, LSA calls -are handled by librpc_lsass.so.. -These shared libraries should be located in the <sambaroot>/lib/rpc. smbd then attempts to call the init_module function within +are handled by librpc_lsass.so.. +These shared libraries should be located in the <sambaroot>/lib/rpc. smbd then attempts to call the init_module function within the shared library. Check the chapter on modules for more information.

    In the init_module function, the library should call rpc_pipe_register_commands(). This function takes the following arguments: 

    -int rpc_pipe_register_commands(const char *clnt, const char *srv,
+NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv,
                                const struct api_struct *cmds, int size);
-
    clnt

    the Client name of the named pipe

    srv

    the Server name of the named pipe

    cmds

    a list of api_structs that map RPC ordinal numbers to function calls

    size

    the number of api_structs contained in cmds

    +

    version

    Version number of the RPC interface. Use the define SMB_RPC_INTERFACE_VERSION for this +argument.

    clnt

    the Client name of the named pipe

    srv

    the Server name of the named pipe

    cmds

    a list of api_structs that map RPC ordinal numbers to function calls

    size

    the number of api_structs contained in cmds

    See rpc_server/srv_reg.c and rpc_server/srv_reg_nt.c for a small example of how to use this library. -

    Chapter 16. Notes to packagers

    Jelmer Vernooij

    Table of Contents

    Versioning
    Modules

    Versioning

    Please, please update the version number in -source/include/version.h to include the versioning of your package. This makes it easier to distinguish standard samba builds +

    Chapter 17. VFS Modules

    Alexander Bokovoy

    Stefan Metzmacher

    27 May 2003

    Table of Contents

    The Samba (Posix) VFS layer
    The general interface
    Possible VFS operation layers
    The Interaction between the Samba VFS subsystem and the modules
    Initialization and registration
    How the Modules handle per connection data
    Upgrading to the New VFS Interface
    Upgrading from 2.2.* and 3.0aplha modules
    Some Notes
    Implement TRANSPARENT functions
    Implement OPAQUE functions

    The Samba (Posix) VFS layer

    The general interface

    +Each VFS operation has a vfs_op_type, a function pointer and a handle pointer in the +struct vfs_ops and tree macros to make it easier to call the operations. +(Take a look at include/vfs.h and include/vfs_macros.h.) +

    +typedef enum _vfs_op_type {
+	SMB_VFS_OP_NOOP = -1,
+
+	...
+
+	/* File operations */
+
+	SMB_VFS_OP_OPEN,
+	SMB_VFS_OP_CLOSE,
+	SMB_VFS_OP_READ,
+	SMB_VFS_OP_WRITE,
+	SMB_VFS_OP_LSEEK,
+	SMB_VFS_OP_SENDFILE,
+
+	...
+
+	SMB_VFS_OP_LAST
+} vfs_op_type;
+

    This struct contains the function and handle pointers for all operations.

    +struct vfs_ops {
+	struct vfs_fn_pointers {
+		...
+		
+		/* File operations */
+		
+		int (*open)(struct vfs_handle_struct *handle,
+			struct connection_struct *conn,
+			const char *fname, int flags, mode_t mode);
+		int (*close)(struct vfs_handle_struct *handle,
+			struct files_struct *fsp, int fd);
+		ssize_t (*read)(struct vfs_handle_struct *handle, 
+			struct files_struct *fsp, int fd, void *data, size_t n);
+		ssize_t (*write)(struct vfs_handle_struct *handle, 
+			struct files_struct *fsp, int fd, 
+			const void *data, size_t n);
+		SMB_OFF_T (*lseek)(struct vfs_handle_struct *handle, 
+			struct files_struct *fsp, int fd, 
+			SMB_OFF_T offset, int whence);
+		ssize_t (*sendfile)(struct vfs_handle_struct *handle, 
+			int tofd, files_struct *fsp, int fromfd, 
+			const DATA_BLOB *header, SMB_OFF_T offset, size_t count);
+
+		...
+	} ops;
+	
+	struct vfs_handles_pointers {
+		...
+		
+		/* File operations */
+		
+		struct vfs_handle_struct *open;
+		struct vfs_handle_struct *close;
+		struct vfs_handle_struct *read;
+		struct vfs_handle_struct *write;
+		struct vfs_handle_struct *lseek;
+		struct vfs_handle_struct *sendfile;
+		
+		...
+	} handles;
+};
+

    +This macros SHOULD be used to call any vfs operation. +DO NOT ACCESS conn->vfs.ops.* directly !!! +

    +...
+	
+/* File operations */
+#define SMB_VFS_OPEN(conn, fname, flags, mode) \
+	((conn)->vfs.ops.open((conn)->vfs.handles.open,\
+	 (conn), (fname), (flags), (mode)))
+#define SMB_VFS_CLOSE(fsp, fd) \
+	((fsp)->conn->vfs.ops.close(\
+	(fsp)->conn->vfs.handles.close, (fsp), (fd)))
+#define SMB_VFS_READ(fsp, fd, data, n) \
+	((fsp)->conn->vfs.ops.read(\
+	(fsp)->conn->vfs.handles.read,\
+	 (fsp), (fd), (data), (n)))
+#define SMB_VFS_WRITE(fsp, fd, data, n) \
+	((fsp)->conn->vfs.ops.write(\
+	(fsp)->conn->vfs.handles.write,\
+	 (fsp), (fd), (data), (n)))
+#define SMB_VFS_LSEEK(fsp, fd, offset, whence) \
+	((fsp)->conn->vfs.ops.lseek(\
+	(fsp)->conn->vfs.handles.lseek,\
+	 (fsp), (fd), (offset), (whence)))
+#define SMB_VFS_SENDFILE(tofd, fsp, fromfd, header, offset, count) \
+	((fsp)->conn->vfs.ops.sendfile(\
+	(fsp)->conn->vfs.handles.sendfile,\
+	 (tofd), (fsp), (fromfd), (header), (offset), (count)))
+
+...
+

    Possible VFS operation layers

    +These values are used by the VFS subsystem when building the conn->vfs +and conn->vfs_opaque structs for a connection with multiple VFS modules. +Internally, Samba differentiates only opaque and transparent layers at this process. +Other types are used for providing better diagnosing facilities. +

    +Most modules will provide transparent layers. Opaque layer is for modules +which implement actual file system calls (like DB-based VFS). For example, +default POSIX VFS which is built in into Samba is an opaque VFS module. +

    +Other layer types (logger, splitter, scanner) were designed to provide different +degree of transparency and for diagnosing VFS module behaviour. +

    +Each module can implement several layers at the same time provided that only +one layer is used per each operation. +

    +typedef enum _vfs_op_layer {
+	SMB_VFS_LAYER_NOOP = -1,	/* - For using in VFS module to indicate end of array */
+					/*   of operations description */
+	SMB_VFS_LAYER_OPAQUE = 0,	/* - Final level, does not call anything beyond itself */
+	SMB_VFS_LAYER_TRANSPARENT,	/* - Normal operation, calls underlying layer after */
+					/*   possibly changing passed data */
+	SMB_VFS_LAYER_LOGGER,		/* - Logs data, calls underlying layer, logging may not */
+					/*   use Samba VFS */
+	SMB_VFS_LAYER_SPLITTER,		/* - Splits operation, calls underlying layer _and_ own facility, */
+					/*   then combines result */
+	SMB_VFS_LAYER_SCANNER		/* - Checks data and possibly initiates additional */
+					/*   file activity like logging to files _inside_ samba VFS */
+} vfs_op_layer;
+

    The Interaction between the Samba VFS subsystem and the modules

    Initialization and registration

    +As each Samba module a VFS module should have a +

    NTSTATUS vfs_example_init(void);

    function if it's staticly linked to samba or +

    NTSTATUS init_module(void);

    function if it's a shared module. +

    +This should be the only non static function inside the module. +Global variables should also be static! +

    +The module should register its functions via the +

    +NTSTATUS smb_register_vfs(int version, const char *name, vfs_op_tuple *vfs_op_tuples);
+

    function. +

    version

    should be filled with SMB_VFS_INTERFACE_VERSION

    name

    this is the name witch can be listed in the +vfs objects parameter to use this module.

    vfs_op_tuples

    +this is an array of vfs_op_tuple's. +(vfs_op_tuples is descripted in details below.) +

    +For each operation the module wants to provide it has a entry in the +vfs_op_tuple array. +

    +typedef struct _vfs_op_tuple {
+	void* op;
+	vfs_op_type type;
+	vfs_op_layer layer;
+} vfs_op_tuple;
+
    op

    the function pointer to the specified function.

    type

    the vfs_op_type of the function to specified witch operation the function provides.

    layer

    the vfs_op_layer in whitch the function operates.

    A simple example:

    +static vfs_op_tuple example_op_tuples[] = {	
+	{SMB_VFS_OP(example_connect),	SMB_VFS_OP_CONNECT,	SMB_VFS_LAYER_TRANSPARENT},
+	{SMB_VFS_OP(example_disconnect),	SMB_VFS_OP_DISCONNECT,	SMB_VFS_LAYER_TRANSPARENT},
+
+	{SMB_VFS_OP(example_rename),	SMB_VFS_OP_RENAME,	SMB_VFS_LAYER_OPAQUE},
+
+	/* This indicates the end of the array */
+	{SMB_VFS_OP(NULL),				SMB_VFS_OP_NOOP,	SMB_VFS_LAYER_NOOP}
+};
+
+NTSTATUS init_module(void)
+{
+	return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "example", example_op_tuples);
+}
+

    How the Modules handle per connection data

    Each VFS function has as first parameter a pointer to the modules vfs_handle_struct. +

    +typedef struct vfs_handle_struct {
+	struct vfs_handle_struct  *next, *prev;
+	const char *param;
+	struct vfs_ops vfs_next;
+	struct connection_struct *conn;
+	void *data;
+	void (*free_data)(void **data);
+} vfs_handle_struct;
+
    param

    this is the module parameter specified in the vfs objects parameter.

    e.g. for 'vfs objects = example:test' param would be "test".

    vfs_next

    This vfs_ops struct contains the information for calling the next module operations. +Use the SMB_VFS_NEXT_* macros to call a next module operations and +don't access handle->vfs_next.ops.* directly!

    conn

    This is a pointer back to the connection_struct to witch the handle belongs.

    data

    This is a pointer for holding module private data. +You can alloc data with connection life time on the handle->conn->mem_ctx TALLOC_CTX. +But you can also manage the memory allocation yourself.

    free_data

    This is a function pointer to a function that free's the module private data. +If you talloc your private data on the TALLOC_CTX handle->conn->mem_ctx, +you can set this function pointer to NULL.

    Some useful MACROS for handle private data. +

    +#define SMB_VFS_HANDLE_GET_DATA(handle, datap, type, ret) { \
+	if (!(handle)||((datap=(type *)(handle)->data)==NULL)) { \
+		DEBUG(0,("%s() failed to get vfs_handle->data!\n",FUNCTION_MACRO)); \
+		ret; \
+	} \
+}
+
+#define SMB_VFS_HANDLE_SET_DATA(handle, datap, free_fn, type, ret) { \
+	if (!(handle)) { \
+		DEBUG(0,("%s() failed to set handle->data!\n",FUNCTION_MACRO)); \
+		ret; \
+	} else { \
+		if ((handle)->free_data) { \
+			(handle)->free_data(&(handle)->data); \
+		} \
+		(handle)->data = (void *)datap; \
+		(handle)->free_data = free_fn; \
+	} \
+}
+
+#define SMB_VFS_HANDLE_FREE_DATA(handle) { \
+	if ((handle) && (handle)->free_data) { \
+		(handle)->free_data(&(handle)->data); \
+	} \
+}
+

    How SMB_VFS_LAYER_TRANSPARENT functions can call the SMB_VFS_LAYER_OPAQUE functions.

    The easiest way to do this is to use the SMB_VFS_OPAQUE_* macros. +

    +...
+/* File operations */
+#define SMB_VFS_OPAQUE_OPEN(conn, fname, flags, mode) \
+	((conn)->vfs_opaque.ops.open(\
+	(conn)->vfs_opaque.handles.open,\
+	 (conn), (fname), (flags), (mode)))
+#define SMB_VFS_OPAQUE_CLOSE(fsp, fd) \
+	((fsp)->conn->vfs_opaque.ops.close(\
+	(fsp)->conn->vfs_opaque.handles.close,\
+	 (fsp), (fd)))
+#define SMB_VFS_OPAQUE_READ(fsp, fd, data, n) \
+	((fsp)->conn->vfs_opaque.ops.read(\
+	(fsp)->conn->vfs_opaque.handles.read,\
+	 (fsp), (fd), (data), (n)))
+#define SMB_VFS_OPAQUE_WRITE(fsp, fd, data, n) \
+	((fsp)->conn->vfs_opaque.ops.write(\
+	(fsp)->conn->vfs_opaque.handles.write,\
+	 (fsp), (fd), (data), (n)))
+#define SMB_VFS_OPAQUE_LSEEK(fsp, fd, offset, whence) \
+	((fsp)->conn->vfs_opaque.ops.lseek(\
+	(fsp)->conn->vfs_opaque.handles.lseek,\
+	 (fsp), (fd), (offset), (whence)))
+#define SMB_VFS_OPAQUE_SENDFILE(tofd, fsp, fromfd, header, offset, count) \
+	((fsp)->conn->vfs_opaque.ops.sendfile(\
+	(fsp)->conn->vfs_opaque.handles.sendfile,\
+	 (tofd), (fsp), (fromfd), (header), (offset), (count)))
+...
+

    How SMB_VFS_LAYER_TRANSPARENT functions can call the next modules functions.

    The easiest way to do this is to use the SMB_VFS_NEXT_* macros. +

    +...
+/* File operations */
+#define SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode) \
+	((handle)->vfs_next.ops.open(\
+	(handle)->vfs_next.handles.open,\
+	 (conn), (fname), (flags), (mode)))
+#define SMB_VFS_NEXT_CLOSE(handle, fsp, fd) \
+	((handle)->vfs_next.ops.close(\
+	(handle)->vfs_next.handles.close,\
+	 (fsp), (fd)))
+#define SMB_VFS_NEXT_READ(handle, fsp, fd, data, n) \
+	((handle)->vfs_next.ops.read(\
+	(handle)->vfs_next.handles.read,\
+	 (fsp), (fd), (data), (n)))
+#define SMB_VFS_NEXT_WRITE(handle, fsp, fd, data, n) \
+	((handle)->vfs_next.ops.write(\
+	(handle)->vfs_next.handles.write,\
+	 (fsp), (fd), (data), (n)))
+#define SMB_VFS_NEXT_LSEEK(handle, fsp, fd, offset, whence) \
+	((handle)->vfs_next.ops.lseek(\
+	(handle)->vfs_next.handles.lseek,\
+	 (fsp), (fd), (offset), (whence)))
+#define SMB_VFS_NEXT_SENDFILE(handle, tofd, fsp, fromfd, header, offset, count) \
+	((handle)->vfs_next.ops.sendfile(\
+	(handle)->vfs_next.handles.sendfile,\
+	 (tofd), (fsp), (fromfd), (header), (offset), (count)))
+...
+

    Upgrading to the New VFS Interface

    Upgrading from 2.2.* and 3.0aplha modules

    1. +Add "vfs_handle_struct *handle, " as first parameter to all vfs operation functions. +e.g. example_connect(connection_struct *conn, const char *service, const char *user); +-> example_connect(vfs_handle_struct *handle, connection_struct *conn, const char *service, const char *user); +

    2. +Replace "default_vfs_ops." with "smb_vfs_next_". +e.g. default_vfs_ops.connect(conn, service, user); +-> smb_vfs_next_connect(conn, service, user); +

    3. +Uppercase all "smb_vfs_next_*" functions. +e.g. smb_vfs_next_connect(conn, service, user); +-> SMB_VFS_NEXT_CONNECT(conn, service, user); +

    4. +Add "handle, " as first parameter to all SMB_VFS_NEXT_*() calls. +e.g. SMB_VFS_NEXT_CONNECT(conn, service, user); +-> SMB_VFS_NEXT_CONNECT(handle, conn, service, user); +

    5. +(Only for 2.2.* modules) +Convert the old struct vfs_ops example_ops to +a vfs_op_tuple example_op_tuples[] array. +e.g. +

      +struct vfs_ops example_ops = {
+	/* Disk operations */
+	example_connect,		/* connect */
+	example_disconnect,		/* disconnect */
+	NULL,				/* disk free *
+	/* Directory operations */
+	NULL,				/* opendir */
+	NULL,				/* readdir */
+	NULL,				/* mkdir */
+	NULL,				/* rmdir */
+	NULL,				/* closedir */
+	/* File operations */
+	NULL,				/* open */
+	NULL,				/* close */
+	NULL,				/* read  */
+	NULL,				/* write */
+	NULL,				/* lseek */
+	NULL,				/* sendfile */
+	NULL,				/* rename */
+	NULL,				/* fsync */
+	example_stat,			/* stat  */
+	example_fstat,			/* fstat */
+	example_lstat,			/* lstat */
+	NULL,				/* unlink */
+	NULL,				/* chmod */
+	NULL,				/* fchmod */
+	NULL,				/* chown */
+	NULL,				/* fchown */
+	NULL,				/* chdir */
+	NULL,				/* getwd */
+	NULL,				/* utime */
+	NULL,				/* ftruncate */
+	NULL,				/* lock */
+	NULL,				/* symlink */
+	NULL,				/* readlink */
+	NULL,				/* link */
+	NULL,				/* mknod */
+	NULL,				/* realpath */
+	NULL,				/* fget_nt_acl */
+	NULL,				/* get_nt_acl */
+	NULL,				/* fset_nt_acl */
+	NULL,				/* set_nt_acl */
+
+	NULL,				/* chmod_acl */
+	NULL,				/* fchmod_acl */
+
+	NULL,				/* sys_acl_get_entry */
+	NULL,				/* sys_acl_get_tag_type */
+	NULL,				/* sys_acl_get_permset */
+	NULL,				/* sys_acl_get_qualifier */
+	NULL,				/* sys_acl_get_file */
+	NULL,				/* sys_acl_get_fd */
+	NULL,				/* sys_acl_clear_perms */
+	NULL,				/* sys_acl_add_perm */
+	NULL,				/* sys_acl_to_text */
+	NULL,				/* sys_acl_init */
+	NULL,				/* sys_acl_create_entry */
+	NULL,				/* sys_acl_set_tag_type */
+	NULL,				/* sys_acl_set_qualifier */
+	NULL,				/* sys_acl_set_permset */
+	NULL,				/* sys_acl_valid */
+	NULL,				/* sys_acl_set_file */
+	NULL,				/* sys_acl_set_fd */
+	NULL,				/* sys_acl_delete_def_file */
+	NULL,				/* sys_acl_get_perm */
+	NULL,				/* sys_acl_free_text */
+	NULL,				/* sys_acl_free_acl */
+	NULL				/* sys_acl_free_qualifier */
+};
+

      +-> +

       
+static vfs_op_tuple example_op_tuples[] = {
+	{SMB_VFS_OP(example_connect),	SMB_VFS_OP_CONNECT,	SMB_VFS_LAYER_TRANSPARENT},
+	{SMB_VFS_OP(example_disconnect),	SMB_VFS_OP_DISCONNECT,	SMB_VFS_LAYER_TRANSPARENT},
+	
+	{SMB_VFS_OP(example_fstat), 	SMB_VFS_OP_FSTAT,	SMB_VFS_LAYER_TRANSPARENT},
+	{SMB_VFS_OP(example_stat),		SMB_VFS_OP_STAT,	SMB_VFS_LAYER_TRANSPARENT},
+	{SMB_VFS_OP(example_lstat), 	SMB_VFS_OP_LSTAT,	SMB_VFS_LAYER_TRANSPARENT},
+
+	{SMB_VFS_OP(NULL),				SMB_VFS_OP_NOOP,	SMB_VFS_LAYER_NOOP}
+};
+

      +

    6. +Move the example_op_tuples[] array to the end of the file. +

    7. +Add the init_module() function at the end of the file. +e.g. +

      +NTSTATUS init_module(void)
+{
+	return smb_register_vfs(SMB_VFS_INTERFACE_VERSION,"example",example_op_tuples);
+}
+

      +

    8. +Check if your vfs_init() function does more then just prepare the vfs_ops structs or +remember the struct smb_vfs_handle_struct. +

      If NOT you can remove the vfs_init() function.
      If YES decide if you want to move the code to the example_connect() operation or to the init_module(). And then remove vfs_init(). + e.g. a debug class registration should go into init_module() and the allocation of private data should go to example_connect().

      +

    9. +(Only for 3.0alpha* modules) +Check if your vfs_done() function contains needed code. +

      If NOT you can remove the vfs_done() function.
      If YES decide if you can move the code to the example_disconnect() operation. Otherwise register a SMB_EXIT_EVENT with smb_register_exit_event(); (Described in the modules section) And then remove vfs_done(). e.g. the freeing of private data should go to example_disconnect(). +

      +

    10. +Check if you have any global variables left. +Decide if it wouldn't be better to have this data on a connection basis. +

      If NOT leave them as they are. (e.g. this could be the variable for the private debug class.)
      If YES pack all this data into a struct. You can use handle->data to point to such a struct on a per connection basis.

      + + e.g. if you have such a struct: +

          
+struct example_privates {
+	char *some_string;
+	int db_connection;
+};
+

      +first way of doing it: +

      +static int example_connect(vfs_handle_struct *handle,
+	connection_struct *conn, const char *service, 
+	const char* user)
+{
+	struct example_privates *data = NULL;
+
+	/* alloc our private data */
+	data = (struct example_privates *)talloc_zero(conn->mem_ctx, sizeof(struct example_privates));
+	if (!data) {
+		DEBUG(0,("talloc_zero() failed\n"));
+		return -1;
+	}
+
+	/* init out private data */
+	data->some_string = talloc_strdup(conn->mem_ctx,"test");
+	if (!data->some_string) {
+		DEBUG(0,("talloc_strdup() failed\n"));
+		return -1;
+	}
+
+	data->db_connection = open_db_conn();
+
+	/* and now store the private data pointer in handle->data
+	 * we don't need to specify a free_function here because
+	 * we use the connection TALLOC context.
+	 * (return -1 if something failed.)
+	 */
+	VFS_HANDLE_SET_DATA(handle, data, NULL, struct example_privates, return -1);
+
+	return SMB_VFS_NEXT_CONNECT(handle,conn,service,user);
+}
+
+static int example_close(vfs_handle_struct *handle, files_struct *fsp, int fd)
+{
+	struct example_privates *data = NULL;
+	
+	/* get the pointer to our private data
+	 * return -1 if something failed
+	 */
+	SMB_VFS_HANDLE_GET_DATA(handle, data, struct example_privates, return -1);
+	
+	/* do something here...*/
+	DEBUG(0,("some_string: %s\n",data->some_string));
+	
+	return SMB_VFS_NEXT_CLOSE(handle, fsp, fd);
+}
+

      +second way of doing it: +

      +static void free_example_privates(void **datap)
+{
+	struct example_privates *data = (struct example_privates *)*datap;
+	
+	SAFE_FREE(data->some_string);
+	SAFE_FREE(data);
+	
+	datap = NULL;
+	
+	return;
+}
+
+static int example_connect(vfs_handle_struct *handle, 
+	connection_struct *conn, const char *service, 
+	const char* user)
+{
+	struct example_privates *data = NULL;
+
+	/* alloc our private data */
+	data = (struct example_privates *)malloc(sizeof(struct example_privates));
+	if (!data) {
+		DEBUG(0,("malloc() failed\n"));
+		return -1;
+	}
+
+	/* init out private data */
+	data->some_string = strdup(conn->mem_ctx,"test");
+	if (!data->some_string) {
+		DEBUG(0,("strdup() failed\n"));
+		return -1;
+	}
+
+	data->db_connection = open_db_conn();
+
+	/* and now store the private data pointer in handle->data
+	 * we need to specify a free_function because we used malloc() and strdup().
+	 * (return -1 if something failed.)
+	 */
+	SMB_VFS_HANDLE_SET_DATA(handle, data, NULL, struct example_privates, return -1);
+
+	return SMB_VFS_NEXT_CONNECT(handle,conn,service,user);
+}
+
+static int example_close(vfs_handle_struct *handle, files_struct *fsp, int fd)
+{
+	struct example_privates *data = NULL;
+	
+	/* get the pointer to our private data
+	 * return -1 if something failed
+	 */
+	SMB_VFS_HANDLE_GET_DATA(handle, data, struct example_privates, return -1);
+	
+	/* do something here...*/
+	DEBUG(0,("some_string: %s\n",data->some_string));
+	
+	return SMB_VFS_NEXT_CLOSE(handle, fsp, fd);
+}
+

      +

    11. +To make it easy to build 3rd party modules it would be usefull to provide +configure.in, (configure), install.sh and Makefile.in with the module. +(Take a look at the example in examples/VFS.) +

      +The configure script accepts --with-samba-source to specify +the path to the samba source tree. +It also accept --enable-developer which lets the compiler +give you more warnings. +

      +The idea is that you can extend this +configure.in and Makefile.in scripts +for your module. +

    12. +Compiling & Testing... +

      ./configure --enable-developer ...
      make
      Try to fix all compiler warnings
      make
      Testing, Testing, Testing ...

      +

    Some Notes

    Implement TRANSPARENT functions

    +Avoid writing functions like this: + +

    +static int example_close(vfs_handle_struct *handle, files_struct *fsp, int fd)
+{
+	return SMB_VFS_NEXT_CLOSE(handle, fsp, fd);
+}
+

    + +Overload only the functions you really need to! +

    Implement OPAQUE functions

    +If you want to just implement a better version of a +default samba opaque function +(e.g. like a disk_free() function for a special filesystem) +it's ok to just overload that specific function. +

    +If you want to implement a database filesystem or +something different from a posix filesystem. +Make sure that you overload every vfs operation!!! +

    +Functions your FS does not support should be overloaded by something like this: +e.g. for a readonly filesystem. +

    +static int example_rename(vfs_handle_struct *handle, connection_struct *conn,
+			char *oldname, char *newname)
+{
+	DEBUG(10,("function rename() not allowed on vfs 'example'\n"));
+	errno = ENOSYS;
+	return -1;
+}
+

    Chapter 18. Notes to packagers

    Jelmer Vernooij

    Table of Contents

    Versioning
    Modules

    Versioning

    Please, please update the version number in +source/include/version.h to include the versioning of your package. This makes it easier to distinguish standard samba builds from custom-build samba builds (distributions often patch packages). For example, a good version would be: 

     Version 2.999+3.0.alpha21-5 for Debian
-

    Modules

    Samba now has support for building parts of samba as plugins. This +

    Modules

    Samba now has support for building parts of samba as plugins. This makes it possible to, for example, put ldap or mysql support in a seperate package, thus making it possible to have a normal samba package not depending on ldap or mysql. To build as much parts of samba as a plugin, run: 

     ./configure --with-shared-modules=rpc,vfs,auth,pdb,charset
-
    +

    Chapter 19. Contributing code

    Jelmer R. Vernooij

    The Samba Team

    Here are a few tips and notes that might be useful if you are + interested in modifying samba source code and getting it into + samba's main branch.

    Retrieving the source

    In order to contribute code to samba, make sure you have the + latest source. Retrieving the samba source code from CVS is + documented in the appendix of the Samba HOWTO Collection. +

    Discuss large modifications with team members

    Please discuss large modifications you are going to make + with members of the samba team. Some parts of the samba code + have one or more 'owners' - samba developers who wrote most + of the code and maintain it. +

    This way you can avoid spending your time and effort on + something that is not going to make it into the main samba branch + because someone else was working on the same thing or because your + implementation is not the correct one. +

    Patch format

    Patches to the samba tree should be in unified diff format, + e.g. files generated by diff -u. +

    If you are modifying a copy of samba you retrieved from CVS, + you can easily generate a diff file of these changes by running + cvs diff -u.

    Points of attention when modifying samba source code

    +

    Don't simply copy code from other places and modify it until it + works. Code needs to be clean and logical. Duplicate + code is to be avoided.
    Test your patch. It might take a while before one of us looks + at your patch so it will take longer before your patch when your patch + needs to go thru the review cycle again.
    Don't put seperate patches in one large diff file. This makes + it harder to read, understand and test the patch. You might + also risk not getting a good patch committed because you mixed it + with one that had issues.
    Make sure your patch complies to the samba coding style as + suggested in the coding-suggestions chapter.

    +

    Sending in bugfixes

    Bugfixes to bugs in samba should be submitted to samba's + bugzilla system, + along with a description of the bug. +

    Sending in feature patches

    Send feature patches along with a description of what the + patch is supposed to do to the + Samba-technical mailinglist and possibly to a samba team member who is (one of the) 'owners' + of the code you made modifications to. We are all busy people + so everybody tends to 'let one of the others handle it'. If nobody + responded to your patch for a week, try to send it again until you + get a response from one of us. +

    Feedback on your patch

    One of the team members will look at your patch and either + commit your patch or give comments why he won't apply it. In the + latter case you can fix your patch and re-send it until + your patch is approved.

    diff --git a/docs/htmldocs/Samba-HOWTO-Collection.html b/docs/htmldocs/Samba-HOWTO-Collection.html index 8334ef82f3..27faf25f17 100644 --- a/docs/htmldocs/Samba-HOWTO-Collection.html +++ b/docs/htmldocs/Samba-HOWTO-Collection.html @@ -1,12 +1,12 @@ -SAMBA Project DocumentationSAMBA Project Documentation

    SAMBA Project Documentation

    SAMBA Team

    <samba@samba.org>

    +">

    SAMBA Project Documentation

    Edited by

    Jelmer R. Vernooij

    John H. Terpstra

    Gerald (Jerry) Carter

    This documentation is distributed under the GNU General Public License (GPL) version 2. A copy of the license is included with the Samba source distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt -

    Monday April 21, 2003

    Abstract

    +

    Attributions.  +

    Introduction to Samba
    How to Install and Test SAMBA
    Fast Start for the Impatient
    Server Types and Security Modes
    Domain Control
    Backup Domain Control
    Domain Membership
    Stand-Alone Servers
    MS Windows Network Configuration Guide
    Samba / MS Windows Network Browsing Guide
    Account Information Databases
    Mapping MS Windows and Unix Groups
    File, Directory and Share Access Controls
    File and Record Locking
    Securing Samba
    Interdomain Trust Relationships
    Hosting a Microsoft Distributed File System tree on Samba
    Classical Printing Support
    CUPS Printing Support in Samba 3.0
    Stackable VFS modules

    • Jelmer Vernooij <jelmer@samba.org>

    • John Terpstra <jht@samba.org>

    • Tim Potter

    • Simo Sorce (original vfs_skel README)

    • Alexander Bokovoy (original vfs_netatalk docs)

    • Stefan Metzmacher (Update for multiple modules)

    Integrated Logon Support using Winbind
    Advanced Network Management
    System and Account Policies
    Desktop Profile Management
    PAM based Distributed Authentication
    Integrating MS Windows networks with Samba
    Unicode/Charsets
    Samba Backup Techniques
    High Availability Options
    Upgrading from Samba-2.x to Samba-3.0.0
    Migration from NT4 PDC to Samba-3 PDC
    SWAT - The Samba Web Administration Tool
    The Samba checklist
    Analysing and solving samba problems
    Reporting Bugs
    How to compile SAMBA
    Portability
    Samba and other CIFS clients
    Samba Performance Tuning
    DNS and DHCP Configuration Guide
    Further Resources

    + +

    Monday April 21, 2003

    Abstract

    This book is a collection of HOWTOs added to Samba documentation over the years. Samba is always under development, and so is its' documentation. This release of the documentation represents a major revision or layout as well as contents. The most recent version of this document can be found at http://www.samba.org/ on the "Documentation" page. Please send updates to -Jelmer Venrooij, -John Terpstra or +Jelmer Vernooij, +John H. Terpstra or Gerald (Jerry) Carter.

    The Samba-Team would like to express sincere thanks to the many people who have with @@ -36,41 +39,54 @@ or without their knowledge contributed to this update. The size and scope of thi project would not have been possible without significant community contribution. A not insignificant number of ideas for inclusion (if not content itself) has been obtained from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. -Please keep publishing your Unofficial HOWTO's - they are a source of inspiration and +Please keep publishing your Unofficial HOWTOs - they are a source of inspiration and application knowledge that is most to be desired by many Samba users and administrators. -

    Table of Contents

    I. General Installation
    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Additional Resources
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba
    Editing the smb.conf file
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
    What If Things Don't Work?
    II. Server Configuration Basics
    3. Nomenclature of Server Types
    Stand Alone Server
    Domain Member Server
    Domain Controller
    Domain Controller Types
    4. Samba as Stand-Alone Server
    User and Share security level
    User Level Security
    Share Level Security
    Server Level Security
    Domain Level Security
    ADS Level Security
    5. -Samba as an NT4 or Win2k Primary Domain Controller -
    Prerequisite Reading
    -Background -
    Configuring the Samba Domain Controller
    Creating Machine Trust Accounts and Joining Clients to the Domain
    Manual Creation of Machine Trust Accounts
    "On-the-Fly" Creation of Machine Trust Accounts
    Joining the Client to the Domain
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." +

    Table of Contents

    I. General Installation
    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your + server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client
    What If Things Don't Work?
    Common Errors
    Why are so many smbd processes eating memory?
    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs
    3. Fast Start for the Impatient
    Note
    II. Server Configuration Basics
    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Seamless Windows Network Integration
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not -exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
    Domain Control for Windows 9x/ME
    Configuration Instructions: Network Logons
    6. -Samba Backup Domain Controller to Samba Domain Control -
    Prerequisite Reading
    Background
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    When is the PDC needed?
    Can Samba be a Backup Domain Controller to an NT PDC?
    How do I set up a Samba BDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Samba as a ADS domain member
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Possible errors
    Test your server setup
    Testing with smbclient
    Notes
    8. Samba as a NT4 or Win2k domain member
    Joining an NT Domain with Samba 3.0
    Why is this better than security = server?
    III. Advanced Configuration
    9. Samba / MS Windows Network Browsing Guide
    What is Browsing?
    Discussion
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing samba to be the master
    Making samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in samba
    Problem resolution
    Browsing across subnets
    10. User information database
    Introduction
    Important Notes About Security
    Advantages of SMB Encryption
    Advantages of non-encrypted passwords
    The smbpasswd Command
    Plain text
    TDB
    LDAP
    Introduction
    Encrypted Password Database
    Supported LDAP Servers
    Schema and Relationship to the RFC 2307 posixAccount
    Configuring Samba with LDAP
    Accounts and Groups management
    Security and sambaAccount
    LDAP specials attributes for sambaAccounts
    Example LDIF Entries for a sambaAccount
    MySQL
    Creating the database
    Configuring
    Using plaintext passwords or encrypted password
    Getting non-column data from the table
    XML
    11. UNIX Permission Bits and Windows NT Access Control Lists
    Viewing and changing UNIX permissions using the NT - security dialogs
    How to view file security on a Samba share
    Viewing file ownership
    Viewing file or directory permissions
    File Permissions
    Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute - mapping
    12. Configuring Group Mapping
    13. Printing Support
    Introduction
    Configuration
    Creating [print$]
    Setting Drivers for Existing Printers
    Support a large number of printers
    Adding New Printers via the Windows NT APW
    Samba and Printer Ports
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints server
    The Installation Client
    Diagnosis
    Introduction
    Debugging printer problems
    What printers do I have?
    Setting up printcap and print servers
    Job sent, no output
    Job sent, strange output
    Raw PostScript printed
    Advanced Printing
    Real debugging
    14. CUPS Printing Support
    Introduction
    Configuring smb.conf for CUPS
    CUPS - RAW Print Through Mode
    CUPS as a network PostScript RIP
    Windows Terminal Servers (WTS) as CUPS clients
    Setting up CUPS for driver download
    Sources of CUPS drivers / PPDs
    cupsaddsmb
    The CUPS Filter Chains
    CUPS Print Drivers and Devices
    Further printing steps
    Limiting the number of pages users can print
    Advanced Postscript Printing from MS Windows
    Auto-Deletion of CUPS spool files
    15. Unified Logons between Windows NT and UNIX using Winbind
    Abstract
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Limitations
    Conclusion
    16. Advanced Network Manangement
    Configuring Samba Share Access Controls
    Share Permissions Management
    Remote Server Administration
    Network Logon Script Magic
    Adding printers without user intervention
    17. System and Account Policies
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    With Windows NT4/200x
    With a Samba PDC
    System Startup and Logon Processing Overview
    18. Desktop Profile Management
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    19. Interdomain Trust Relationships
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    20. PAM Configuration for Centrally Managed Authentication
    Samba and PAM
    PAM Configuration in smb.conf
    Password Synchronisation using pam_smbpass.so
    Distributed Authentication
    21. Stackable VFS modules
    Introduction and configuration
    Included modules
    audit
    extd_audit
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    22. Hosting a Microsoft Distributed File System tree on Samba
    Instructions
    Notes
    23. Integrating MS Windows networks with Samba
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    24. Securing Samba
    Introduction
    Using host based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    25. Unicode/Charsets
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    26. File and Record Locking
    Discussion
    Samba Opportunistic Locking Control
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Additional Reading
    IV. Troubleshooting
    27. The samba checklist
    Introduction
    Assumptions
    The tests
    Still having troubles?
    28. Analysing and solving samba problems
    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URL's
    Getting help from the mailing lists
    How to get off the mailinglists
    29. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches
    V. Appendixes
    30. How to compile SAMBA
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices
    32. Portability
    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    33. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
    Are there any other issues when OS/2 (any version) - is used as a client?
    How do I get printer driver download working - for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    34. SWAT - The Samba Web Admininistration Tool
    SWAT Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    35. Samba performance issues
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning

    List of Tables

    21.1. Extended Auditing Log Information
    31.1. The 3 Major Site Types
    31.2. Nature of the Conversion Choices

    General Installation

    Preparing Samba for Configuration

    This section of the Samba-HOWTO-Collection contains general info on how to install samba +existing set.." when creating a machine trust account.

    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not +exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, +I get a message about my account being disabled.
    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    III. Advanced Configuration
    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    11. Account Information Databases
    Features and Benefits
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and Unix
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon - Users not in Samba SAM
    Users are being added to the wrong backend database
    auth methods does not work
    12. Mapping MS Windows and Unix Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with Unix File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and Unix Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask + parameters
    Interaction with the standard Samba file attribute + mapping
    Common Errors
    Users can not write to a public share
    I have set force user and Samba still makes root the owner of all the files + I touch!
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    Common Errors
    Tell me about Trust Relationships using Samba
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    Parameters for Backwards Compatibility
    Parameters no longer in use
    A simple Configuration to Print with Samba-3
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print with Samba-3
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various Unix Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba-3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with +rpcclient
    "The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure)
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a +different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba-3
    Publishing Printer Information in Active Directory or LDAP
    Common Errors and Problems
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for +CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for +application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download
    GDI on Windows -- PostScript on Unix
    Windows Drivers, GDI and EMF
    Unix Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and +native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many +Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel +Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for +cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Caveats to be considered
    What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver?
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsm completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the +Client
    Installing PostScript Driver Files manually (using +rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Commandline Driver Installation in 15 little Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    When not to use Samba to print to +CUPS
    In Case of Trouble.....
    Where to find Documentation
    How to ask for Help
    Where to find Help
    Appendix
    Printing from CUPS to Windows attached +Printers
    More CUPS filtering Chains
    Trouble Shooting Guidelines to fix typical Samba printing +Problems
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    Common Errors
    21. Integrated Logon Support using Winbind
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    How does one set up roaming profiles for just one (or a few) user/s or group/s?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    My Boomerang Won't Come Back
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    IV. Migration and Updating
    30. Upgrading from Samba-2.x to Samba-3.0.0
    Charsets
    Obsolete configuration options
    Password Backend
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    V. Troubleshooting
    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    Still having troubles?
    34. Analysing and solving samba problems
    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches
    VI. Appendixes
    36. How to compile SAMBA
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    Common Errors
    37. Portability
    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba?
    How do I get printer driver download working + for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Books
    Index

    List of Figures

    19.1. Windows Printing to a local Printer
    19.2. Printing to a Postscript Printer
    19.3. Ghostscript as a RIP for non-postscript printers
    19.4. Prefiltering in CUPS to form Postscript
    19.5. Adding Device-specific Print Options
    19.6. Postscript to intermediate Raster format
    19.7. CUPS-raster production using Ghostscript
    19.8. Image format to CUPS-raster format conversion
    19.9. Raster to Printer Specific formats
    19.10. cupsomatic/foomatic processing versus Native CUPS
    19.11. Print Driver execution on the Client
    19.12. Print Driver execution on the Server
    19.13. Printing via CUPS/samba server
    19.14. cupsaddsmb flowchart
    19.15. CUPS Printing Overview

    List of Tables

    7.1. Assumptions
    10.1. Browse subnet example 1
    10.2. Browse subnet example 2
    10.3. Browse subnet example 3
    10.4. Browse subnet example 4
    11.1. Attributes in the sambaSamAccount objectclass (LDAP)
    11.2. Basic smb.conf options for MySQL passdb backend
    11.3. MySQL field names for MySQL passdb backend
    13.1. Managing directories with unix and windows
    13.2. User and Group Based Controls
    13.3. File and Directory Permission Based Controls
    13.4. Other Controls
    20.1. Extended Auditing Log Information
    24.1. User Shell Folder registry keys default values
    24.2. Defaults of profile settings registry keys
    24.3. Defaults of default user profile paths registry keys
    25.1. Options recognized by pam_smbpass
    31.1. The 3 Major Site Types
    31.2. Nature of the Conversion Choices

    List of Examples

    12.1. smbgrpadd.sh
    13.1. Example File

    General Installation

    Preparing Samba for Configuration

    This section of the Samba-HOWTO-Collection contains general info on how to install samba and how to configure the parts of samba you will most likely need. -PLEASE read this.

    Table of Contents

    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Additional Resources
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba
    Editing the smb.conf file
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
    What If Things Don't Work?

    Chapter 1. Introduction to Samba

    David Lechnyr

    Unofficial HOWTO

    <david@lechnyr.com>

    April 14, 2003

    Table of Contents

    Background
    Terminology
    Related Projects
    SMB Methodology
    Additional Resources
    Epilogue
    Miscellaneous

    +PLEASE read this.

    Table of Contents

    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your + server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client
    What If Things Don't Work?
    Common Errors
    Why are so many smbd processes eating memory?
    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs
    3. Fast Start for the Impatient
    Note

    Chapter 1. Introduction to Samba

    David Lechnyr

    Unofficial HOWTO

    April 14, 2003

    Table of Contents

    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous

    “ "If you understand what you're doing, you're not learning anything." -- Anonymous -

    +”

    Samba is a file and print server for Windows-based clients using TCP/IP as the underlying transport protocol. In fact, it can support any SMB/CIFS-enabled client. One of Samba's big strengths is that you can use it to blend your mix of Windows and Linux machines together without requiring a separate Windows NT/2000/2003 Server. Samba is actively being developed by a global team of about 30 active programmers and was originally developed by Andrew Tridgell. -

    Background

    +

    Background

    Once long ago, there was a buzzword referred to as DCE/RPC. This stood for Distributed Computing Environment/Remote Procedure Calls and conceptually was a good idea. It was originally developed by Apollo/HP as NCA 1.0 (Network Computing Architecture) and only @@ -96,7 +112,7 @@ been dutifully waded through during the information-gathering stages of this pro are *still* many missing pieces... While often tedious, at least the way has been generously littered with occurrences of clapping hand to forehead and muttering 'crikey, what are they thinking? -

    Terminology

    • +

    Terminology

    • SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol.

    • CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently @@ -145,8 +161,8 @@ thinking?

    • W3K: Acronym for Windows 2003 Server

    If you plan on getting help, make sure to subscribe to the Samba Mailing List (available at -http://www.samba.org). Optionally, you could just search mailing.unix.samba at http://groups.google.com -

    Related Projects

    +http://www.samba.org). +

    Related Projects

    There are currently two network filesystem client projects for Linux that are directly related to Samba: SMBFS and CIFS VFS. These are both available in the Linux kernel itself.

    • @@ -157,7 +173,7 @@ related to Samba: SMBFS and CIFS VFS. These are both available in the Linux ker

    • CIFS VFS (Common Internet File System Virtual File System) is the successor to SMBFS, and is being actively developed for the upcoming version of the Linux kernel. The intent of this module - is to provide advanced network file system functionality including support for dfs (heirarchical + is to provide advanced network file system functionality including support for dfs (hierarchical name space), secure per-user session establishment, safe distributed caching (oplock), optional packet signing, Unicode and other internationalization improvements, and optional Winbind (nsswitch) integration. @@ -165,9 +181,10 @@ related to Samba: SMBFS and CIFS VFS. These are both available in the Linux ker Again, it's important to note that these are implementations for client filesystems, and have nothing to do with acting as a file and print server for SMB/CIFS clients.

      -There are other Open Source CIFS client implementations, such as the jCIFS project -(jcifs.samba.org) which provides an SMB client toolkit written in Java. -

    SMB Methodology

    +There are other Open Source CIFS client implementations, such as the +jCIFS project +which provides an SMB client toolkit written in Java. +

    SMB Methodology

    Traditionally, SMB uses UDP port 137 (NetBIOS name service, or netbios-ns), UDP port 138 (NetBIOS datagram service, or netbios-dgm), and TCP port 139 (NetBIOS session service, or netbios-ssn). Anyone looking at their network with a good @@ -196,54 +213,11 @@ up a single file. In general, SMB sessions are established in the following orde SMB Tree Connect: Connect to a share name (e.g., \\servername\share); Connect to a service type (e.g., IPC$ named pipe)

    -A good way to examine this process in depth is to try out SecurityFriday's SWB program -at http://www.securityfriday.com/ToolDownload/SWB/swb_doc.html. It allows you to -walk through the establishment of a SMB/CIFS session step by step. -

    Additional Resources

    Epilogue

    -"What's fundamentally wrong is that nobody ever had any taste when they +A good way to examine this process in depth is to try out +SecurityFriday's SWB program. +It allows you to walk through the establishment of a SMB/CIFS session step by step. +

    Epilogue

    “ +What's fundamentally wrong is that nobody ever had any taste when they did it. Microsoft has been very much into making the user interface look good, but internally it's just a complete mess. And even people who program for Microsoft and who have had years of experience, just don't know how it works internally. @@ -252,12 +226,12 @@ mess that fixing one bug might just break a hundred programs that depend on that bug. And Microsoft isn't interested in anyone fixing bugs -- they're interested in making money. They don't have anybody who takes pride in Windows 95 as an operating system. -

    +”

    “ People inside Microsoft know it's a bad operating system and they still continue obviously working on it because they want to get the next version out because they want to have all these new features to sell more copies of the system. -

    +”

    “ The problem with that is that over time, when you have this kind of approach, and because nobody understands it, because nobody REALLY fixes bugs (other than when they're really obvious), the end result is really messy. You can't trust @@ -267,281 +241,449 @@ fine and then once in a blue moon for some completely unknown reason, it's dead, and nobody knows why. Not Microsoft, not the experienced user and certainly not the completely clueless user who probably sits there shivering thinking "What did I do wrong?" when they didn't do anything wrong at all. -

    +”

    “ That's what's really irritating to me." -

    -- +”

    -- Linus Torvalds, from an interview with BOOT Magazine, Sept 1998 -

    Miscellaneous

    -This chapter was lovingly handcrafted on a Dell Latitude C400 laptop running Slackware Linux 9.0, -in case anyone asks. -

    -This chapter is Copyright © 2003 David Lechnyr (david at lechnyr dot com). +

    Miscellaneous

    +This chapter is Copyright 2003 David Lechnyr (david at lechnyr dot com). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation. A copy of the license is available at http://www.gnu.org/licenses/fdl.txt. -

    Chapter 2. How to Install and Test SAMBA

    Andrew Tridgell

    Samba Team

    <tridge@samba.org>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    Karl Auer

    Table of Contents

    Obtaining and installing samba
    Configuring samba
    Editing the smb.conf file
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
    What If Things Don't Work?

    Obtaining and installing samba

    Binary packages of samba are included in almost any Linux or +

    Chapter 2. How to Install and Test SAMBA

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Karl Auer

    Table of Contents

    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your + server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client
    What If Things Don't Work?
    Common Errors
    Why are so many smbd processes eating memory?
    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

    Obtaining and installing samba

    + Binary packages of samba are included in almost any Linux or Unix distribution. There are also some packages available at the samba homepage.

    If you need to compile samba from source, check the - appropriate appendix chapter.

    Configuring samba

    Samba's configuration is stored in the smb.conf file, - that usually resides in /etc/samba/smb.conf - or /usr/local/samba/lib/smb.conf. You can either + appropriate appendix chapter.

    If you have already installed samba, or if your operating system + was pre-installed with samba, then you may not need to bother with this + chapter. On the other hand, you may want to read this chapter anyhow + for information about updating samba.

    Configuring samba (smb.conf)

    + Samba's configuration is stored in the smb.conf file, + that usually resides in /etc/samba/smb.conf + or /usr/local/samba/lib/smb.conf. You can either edit this file yourself or do it using one of the many graphical tools that are available, such as the web-based interface swat, that - is included with samba.

    Editing the smb.conf file

    There are sample configuration files in the examples - subdirectory in the distribution. I suggest you read them - carefully so you can see how the options go together in - practice. See the man page for all the options.

    The simplest useful configuration file would be - something like this:

    -[global]
-	workgroup = MYGROUP
-
-[homes]
-	guest ok = no
-	read only = no
-

    which would allow connections by anyone with an - account on the server, using either their login name or - "homes" as the service name. (Note that I also set the - workgroup that Samba is part of. See BROWSING.txt for details)

    Make sure you put the smb.conf file in the same place - you specified in theMakefile (the default is to - look for it in /usr/local/samba/lib/).

    For more information about security settings for the - [homes] share please refer to the chapter - Securing Samba.

    Test your config file with - testparm

    It's important that you test the validity of your - smb.conf file using the testparm program. - If testparm runs OK then it will list the loaded services. If - not it will give an error message.

    Make sure it runs OK and that the services look - reasonable before proceeding.

    Always run testparm again when you change - smb.conf!

    SWAT

    + is included with samba. +

    Example Configuration

    + There are sample configuration files in the examples subdirectory in the + distribution. I suggest you read them carefully so you can see how the options + go together in practice. See the man page for all the options. +

    + The simplest useful configuration file would be something like this: +

    + 

    +	[global]
+		workgroup = MYGROUP
+
+	[homes]
+		guest ok = no
+		read only = no
+

    +

    + This will allow connections by anyone with an account on the server, using either + their login name or "homes" as the service name. + (Note that the workgroup that Samba must also be set.) +

    + Make sure you put the smb.conf file in the same place + you specified in the Makefile (the default is to + look for it in /usr/local/samba/lib/). +

    + For more information about security settings for the + [homes] share please refer to the chapter + Securing Samba. +

    Test your config file with testparm

    + It's important that you test the validity of your smb.conf + file using the testparm program. If testparm runs OK + then it will list the loaded services. If not it will give an error message. +

    + Make sure it runs OK and that the services look reasonable before proceeding. +

    + Always run testparm again when you change smb.conf! +

    SWAT

    SWAT is a web-based interface that helps you configure samba. SWAT might not be available in the samba package on your platform, but in a separate package. Please read the swat manpage on compiling, installing and configuring swat from source. -

    To launch SWAT just run your favorite web browser and - point it at "http://localhost:901/". Replace localhost with the name of the computer you are running samba on if you - are running samba on a different computer than your browser.

    Note that you can attach to SWAT from any IP connected +

    + To launch SWAT just run your favorite web browser and + point it at http://localhost:901/. Replace + localhost + with the name of the computer you are running samba on if you + are running samba on a different computer than your browser. +

    + Note that you can attach to SWAT from any IP connected machine but connecting from a remote machine leaves your connection open to password sniffing as passwords will be sent - in the clear over the wire.

    Try listing the shares available on your - server

    $ smbclient -L - yourhostname

    You should get back a list of shares available on + in the clear over the wire. +

    Try listing the shares available on your + server

    $ smbclient -L + yourhostname

    You should get back a list of shares available on your server. If you don't then something is incorrectly setup. Note that this method can also be used to see what shares are available on other LanManager clients (such as WfWg).

    If you choose user level security then you may find that Samba requests a password before it will list the shares. - See the smbclient man page for details. (you + See the smbclient man page for details. (you can force it to list the shares without a password by adding the option -U% to the command line. This will not work - with non-Samba servers)

    Try connecting with the unix client

    $ smbclient - //yourhostname/aservice

    Typically the yourhostname - would be the name of the host where you installed smbd. - The aservice is - any service you have defined in the smb.conf - file. Try your user name if you just have a [homes] + with non-Samba servers)

    Try connecting with the unix client

    $ smbclient + //yourhostname/aservice

    Typically the yourhostname + would be the name of the host where you installed smbd. + The aservice is + any service you have defined in the smb.conf + file. Try your user name if you just have a [homes] section - in smb.conf.

    For example if your unix host is bambi - and your login name is fred you would type:

    $ smbclient //bambi/fred -

    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client

    Try mounting disks. eg:

    C:\WINDOWS\> net use d: \\servername\service -

    Try printing. eg:

    C:\WINDOWS\> net use lpt1: - \\servername\spoolservice

    C:\WINDOWS\> print filename -

    What If Things Don't Work?

    Then you might read the file chapter - Diagnosis and the + in smb.conf.

    For example if your unix host is bambi + and your login name is fred you would type:

    $ smbclient //bambi/fred +

    Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client

    Try mounting disks. eg:

    C:\WINDOWS\> net use d: \\servername\service +

    Try printing. eg:

    C:\WINDOWS\> net use lpt1: + \\servername\spoolservice

    C:\WINDOWS\> print filename +

    What If Things Don't Work?

    Then you might read the file chapter + Diagnosis and the FAQ. If you are still stuck then try to follow - the Analysing and Solving Problems chapter + the Analysing and Solving Problems chapter Samba has been successfully installed at thousands of sites worldwide, - so maybe someone else has hit your problem and has overcome it.

    Server Configuration Basics

    First Steps in Server Configuration

    + so maybe someone else has hit your problem and has overcome it.

    Common Errors

    +The following questions and issues get raised on the samba mailing list over and over again. +

    Why are so many smbd processes eating memory?

    +“ +Site that is running Samba on an AIX box. They are sharing out about 2 terabytes using samba. +Samba was installed using smitty and the binaries. We seem to be experiencing a memory problem +with this box. When I do a svmon -Pu the monitoring program shows that smbd has several +processes of smbd running: +” +

    + “ +Is samba suppose to start this many different smbd processes? Or does it run as one smbd process? Also +is it normal for it to be taking up this much memory? +” +

    +

    +Inuse * 4096 = amount of memory being used by this process
+
+     Pid Command        Inuse      Pin     Pgsp  Virtual   64-bit    Mthrd
+   20950 smbd           33098     1906      181     5017        N        N
+   22262 smbd            9104     1906      5410
+   21060 smbd            9048     1906      181     5479        N        N
+   25972 smbd            8678     1906      181     5109        N        N
+   24524 smbd            8674     1906      181     5105        N        N
+   19262 smbd            8582     1906      181     5013        N        N
+   20722 smbd            8572     1906      181     5003        N        N
+   21454 smbd            8572     1906      181     5003        N        N
+   28946 smbd            8567     1906      181     4996        N        N
+   24076 smbd            8566     1906      181     4996        N        N
+   20138 smbd            8566     1906      181     4996        N        N
+   17608 smbd            8565     1906      181     4996        N        N
+   21820 smbd            8565     1906      181     4996        N        N
+   26940 smbd            8565     1906      181     4996        N        N
+   19884 smbd            8565     1906      181     4996        N        N
+    9912 smbd            8565     1906      181     4996        N        N
+   25800 smbd            8564     1906      181     4995        N        N
+   20452 smbd            8564     1906      181     4995        N        N
+   18592 smbd            8562     1906      181     4993        N        N
+   28216 smbd            8521     1906      181     4954        N        N
+   19110 smbd            8404     1906      181     4862        N        N
+
+   Total memory used:  841,592,832 bytes
+

    +

    +Samba consists on three core programs: +nmbd, smbd, winbindd. nmbd is the name server message daemon, +smbd is the server message daemon, winbindd is the daemon that +handles communication with Domain Controllers. +

    +If your system is NOT running as a WINS server, then there will be one (1) single instance of + nmbd running on your system. If it is running as a WINS server then there will be +two (2) instances - one to handle the WINS requests. +

    +smbd handles ALL connection requests and then spawns a new process for each client +connection made. That is why you are seeing so many of them, one (1) per client connection. +

    +winbindd will run as one or two daemons, depending on whether or not it is being +run in "split mode" (in which case there will be two instances). +

    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

    Your loopback device isn't working correctly. Make sure it's running.

    Chapter 3. Fast Start for the Impatient

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +This chapter did not make it into this release. +It is planned for the published release of this document. +

    Server Configuration Basics

    First Steps in Server Configuration

    Samba can operate in various modes within SMB networks. This HOWTO section contains information on configuring samba to function as the type of server your network requires. Please read this section carefully. -

    Table of Contents

    3. Nomenclature of Server Types
    Stand Alone Server
    Domain Member Server
    Domain Controller
    Domain Controller Types
    4. Samba as Stand-Alone Server
    User and Share security level
    User Level Security
    Share Level Security
    Server Level Security
    Domain Level Security
    ADS Level Security
    5. -Samba as an NT4 or Win2k Primary Domain Controller -
    Prerequisite Reading
    -Background -
    Configuring the Samba Domain Controller
    Creating Machine Trust Accounts and Joining Clients to the Domain
    Manual Creation of Machine Trust Accounts
    "On-the-Fly" Creation of Machine Trust Accounts
    Joining the Client to the Domain
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." +

    Table of Contents

    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Seamless Windows Network Integration
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not -exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
    Domain Control for Windows 9x/ME
    Configuration Instructions: Network Logons
    6. -Samba Backup Domain Controller to Samba Domain Control -
    Prerequisite Reading
    Background
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    When is the PDC needed?
    Can Samba be a Backup Domain Controller to an NT PDC?
    How do I set up a Samba BDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Samba as a ADS domain member
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Possible errors
    Test your server setup
    Testing with smbclient
    Notes
    8. Samba as a NT4 or Win2k domain member
    Joining an NT Domain with Samba 3.0
    Why is this better than security = server?

    Chapter 3. Nomenclature of Server Types

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    Table of Contents

    Stand Alone Server
    Domain Member Server
    Domain Controller
    Domain Controller Types

    Adminstrators of Microsoft networks often refer to there being three -different type of servers:

    • Stand Alone Server

    • Domain Member Server

    • Domain Controller

      • Primary Domain Controller

      • Backup Domain Controller

      • ADS Domain Controller

    A network administrator who is familiar with these terms and who -wishes to migrate to or use Samba will want to know what these terms mean -within a Samba context.

    Stand Alone Server

    -The term stand alone server means that the server -will provide local authentication and access control for all resources -that are available from it. In general this means that there will be a -local user database. In more technical terms, it means that resources -on the machine will either be made available in either SHARE mode or in -USER mode. SHARE mode and USER mode security are documented under -discussions regarding "security mode". The smb.conf configuration parameters -that control security mode are: "security = user" and "security = share". -

    -No special action is needed other than to create user accounts. Stand-alone -servers do NOT provide network logon services, meaning that machines that -use this server do NOT perform a domain logon but instead make use only of -the MS Windows logon which is local to the MS Windows workstation/server. +existing set.." when creating a machine trust account.

    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not +exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, +I get a message about my account being disabled.
    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note

    Chapter 4. Server Types and Security Modes

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Seamless Windows Network Integration
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server

    +This chapter provides information regarding the types of server that Samba may be +configured to be. A Microsoft network administrator who wishes to migrate to or to +use Samba will want to know what, within a Samba context, terms familiar to MS Windows +administrator mean. This means that it is essential also to define how critical security +modes function BEFORE we get into the details of how to configure the server itself. +

    +The chapter provides an overview of the security modes of which Samba is capable +and how these relate to MS Windows servers and clients. +

    +Firstly we should recognise the question so often asked, "Why would I want to use Samba?" +So, in those chapters where the answer may be important you will see a section that highlights +features and benefits. These may be for or against Samba. +

    Features and Benefits

    +Two men were walking down a dusty road, when one suddenly kicked up a small red stone. It +hurt his toe and lodged in his sandal. He took the stone out and cursed it with a passion +and fury fitting his anguish. The other looked at the stone and said, that is a garnet - I +can turn that into a precious gem and some day it will make a princess very happy! +

    +The moral of this tale: Two men, two very different perspectives regarding the same stone. +Like it or not, Samba is like that stone. Treat it the right way and it can bring great +pleasure, but if you are forced upon it and have no time for its secrets then it can be +a source of discomfort. +

    +Samba started out as a project that sought to provide interoperability for MS Windows 3.x +clients with a Unix server. It has grown up a lot since its humble beginnings and now provides +features and functionality fit for large scale deployment. It also has some warts. In sections +like this one we will tell of both. +

    +So now, what are the benefits of features mentioned in this chapter? +

    • + Samba-3 can replace an MS Windows NT4 Domain Controller +

    • + Samba-3 offers excellent interoperability with MS Windows NT4 + style domains as well as natively with Microsoft Active + Directory domains. +

    • + Samba-3 permits full NT4 style Interdomain Trusts +

    • + Samba has security modes that permit more flexible + authentication than is possible with MS Windows NT4 Domain Controllers. +

    • + Samba-3 permits use of multiple account database backends +

    • + The account (password) database backends can be distributed + and replicated using multiple methods. This gives Samba-3 + greater flexibility than MS Windows NT4 and in many cases a + significantly higher utility than Active Directory domains + with MS Windows 200x. +

    Server Types

    Administrators of Microsoft networks often refer to three +different type of servers:

    • Domain Controller

      Primary Domain Controller
      Backup Domain Controller
      ADS Domain Controller

    • Domain Member Server

      Active Directory Member Server
      NT4 Style Domain Member Server

    • Stand Alone Server

    +The chapters covering Domain Control, Backup Domain Control and Domain Membership provide +pertinent information regarding Samba-3 configuration for each of these server roles. +The reader is strongly encouraged to become intimately familiar with the information +presented. +

    Samba Security Modes

    +In this section the function and purpose of Samba's security +modes are described. An accurate understanding of how Samba implements each security +mode as well as how to configure MS Windows clients for each mode will significantly +reduce user complaints and administrator heartache. +

    +In the SMB/CIFS networking world, there are only two types of security: USER Level +and SHARE Level. We refer to these collectively as security levels. In implementing these two security levels Samba provides flexibilities +that are not available with Microsoft Windows NT4 / 200x servers. Samba knows of five (5) +ways that allow the security levels to be implemented. In actual fact, Samba implements +SHARE Level security only one way, but has four ways of implementing +USER Level security. Collectively, we call the Samba implementations +Security Modes. These are: SHARE, USER, DOMAIN, +ADS, and SERVER +modes. They are documented in this chapter. +

    +A SMB server tells the client at startup what security level +it is running. There are two options: share level and +user level. Which of these two the client receives affects +the way the client then tries to authenticate itself. It does not directly affect +(to any great extent) the way the Samba server does security. This may sound strange, +but it fits in with the client/server approach of SMB. In SMB everything is initiated +and controlled by the client, and the server can only tell the client what is +available and whether an action is allowed. +

    User Level Security

    +We will describe user level security first, as it's simpler. +In user level security, the client will send a +session setup command directly after the protocol negotiation. +This contains a username and password. The server can either accept or reject that +username/password combination. Note that at this stage the server has no idea what +share the client will eventually try to connect to, so it can't base the +accept/reject on anything other than: +

    1. The username/password

    2. The name of the client machine

    +If the server accepts the username/password then the client expects to be able to +mount shares (using a tree connection) without specifying a +password. It expects that all access rights will be as the username/password +specified in the session setup. +

    +It is also possible for a client to send multiple session setup +requests. When the server responds, it gives the client a uid to use +as an authentication tag for that username/password. The client can maintain multiple +authentication contexts in this way (WinDD is an example of an application that does this). +

    Example Configuration

    +The smb.conf parameter that sets User Level Security is: +

    +	security = user
+

    +This is the default setting since samba-2.2.x. +

    Share Level Security

    +Ok, now for share level security. In share level security, the client authenticates +itself separately for each share. It will send a password along with each +tree connection (share mount). It does not explicitly send a +username with this operation. The client expects a password to be associated +with each share, independent of the user. This means that Samba has to work out what +username the client probably wants to use. It is never explicitly sent the username. +Some commercial SMB servers such as NT actually associate passwords directly with +shares in share level security, but Samba always uses the unix authentication scheme +where it is a username/password pair that is authenticated, not a share/password pair. +

    +To gain understanding of the MS Windows networking parallels to this, one should think +in terms of MS Windows 9x/Me where one can create a shared folder that provides read-only +or full access, with or without a password. +

    +Many clients send a session setup even if the server is in share +level security. They normally send a valid username but no password. Samba records +this username in a list of possible usernames. When the client +then does a tree connection it also adds to this list the name +of the share they try to connect to (useful for home directories) and any users +listed in the user = smb.conf line. The password is then checked +in turn against these possible usernames. If a match is found +then the client is authenticated as that user. +

    Example Configuration

    +The smb.conf parameter that sets Share Level Security is: +

    +	security = share
+

    +Please note that there are reports that recent MS Windows clients do not like to work +with share mode security servers. You are strongly discouraged from using share level security. +

    Domain Security Mode (User Level Security)

    +When Samba is operating in security = domain mode, +the Samba server has a domain security trust account (a machine account) and will cause +all authentication requests to be passed through to the domain controllers. +

    Example Configuration

    +Samba as a Domain Member Server +

    +This method involves addition of the following parameters in the smb.conf file: +

    +        security = domain
+        workgroup = "name_of_NT_domain"
+

    +In order for this method to work, the Samba server needs to join the MS Windows NT +security domain. This is done as follows: +

    1. On the MS Windows NT domain controller, using + the Server Manager, add a machine account for the Samba server. +

    2. Next, on the Unix/Linux system execute:

      root# smbpasswd -j DOMAIN_NAME -r PDC_NAME (samba-2.x)

      root# net join -U administrator%password (samba-3)

    Note

    +As of Samba-2.2.4 the Samba 2.2.x series can auto-join a Windows NT4 style Domain just +by executing: +

    +root# smbpasswd -j DOMAIN_NAME -r PDC_NAME -U Administrator%password
+

    + +As of Samba-3 the same can be done by executing: +

    +root# net join -U Administrator%password
+

    +It is not necessary with Samba-3 to specify the DOMAIN_NAME or the PDC_NAME as it +figures this out from the smb.conf file settings. +

    +Use of this mode of authentication does require there to be a standard Unix account +for each user in order to assign a uid once the account has been authenticated by +the remote Windows DC. This account can be blocked to prevent logons by clients other than +MS Windows through things such as setting an invalid shell in the +/etc/passwd entry.

    -Samba tends to blur the distinction a little in respect of what is -a stand alone server. This is because the authentication database may be -local or on a remote server, even if from the samba protocol perspective -the samba server is NOT a member of a domain security context. +An alternative to assigning UIDs to Windows users on a Samba member server is +presented in the Winbind Overview chapter +in this HOWTO collection.

    -Through the use of PAM (Pluggable Authentication Modules) and nsswitch -(the name service switcher) the source of authentication may reside on -another server. We would be inclined to call this the authentication server. -This means that the samba server may use the local Unix/Linux system -password database (/etc/passwd or /etc/shadow), may use a local smbpasswd -file (/etc/samba/smbpasswd or /usr/local/samba/lib/private/smbpasswd), or -may use an LDAP back end, or even via PAM and Winbind another CIFS/SMB -server for authentication. -

    Domain Member Server

    -This mode of server operation involves the samba machine being made a member -of a domain security context. This means by definition that all user authentication -will be done from a centrally defined authentication regime. The authentication -regime may come from an NT3/4 style (old domain technology) server, or it may be -provided from an Active Directory server (ADS) running on MS Windows 2000 or later. -

    -Of course it should be clear that the authentication back end itself could be from any -distributed directory architecture server that is supported by Samba. This can be -LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory Server, etc. +For more information of being a domain member, see the Domain +Member section of this Howto. +

    ADS Security Mode (User Level Security)

    +Both Samba 2.2 and 3.0 can join an Active Directory domain. This is +possible even if the domain is run in native mode. Active Directory in +native mode perfectly allows NT4-style domain members, contrary to +popular belief. The only thing that Active Directory in native mode +prohibits is Backup Domain Controllers running NT4. +

    +If you are running Active Directory starting with Samba 3.0 you can +however join as a native AD member. Why would you want to do that? +Your security policy might prohibit the use of NT-compatible +authentication protocols. All your machines are running Windows 2000 +and above and all use full Kerberos. In this case Samba as a NT4-style +domain would still require NT-compatible authentication data. Samba in +AD-member mode can accept Kerberos. +

    Example Configuration

    +	realm = your.kerberos.REALM
+	security = ADS
+

    + The following parameter may be required: +

    +	ads server = your.kerberos.server
+

    +Please refer to the Domain Membership and Active Directory +Membership sections for more information regarding this configuration option. +

    Server Security (User Level Security)

    +Server security mode is a left over from the time when Samba was not capable of acting +as a domain member server. It is highly recommended NOT to use this feature. Server +security mode has many draw backs. The draw backs include: +

    Potential Account Lockout on MS Windows NT4/200x password servers
    Lack of assurance that the password server is the one specified
    Does not work with Winbind, particularly needed when storing profiles remotely
    This mode may open connections to the password server, and keep them open for extended periods.
    Security on the Samba server breaks badly when the remote password server suddenly shuts down
    With this mode there is NO security account in the domain that the password server belongs to for the Samba server.

    +In server security mode the Samba server reports to the client that it is in user level +security. The client then does a session setup as described earlier. +The Samba server takes the username/password that the client sends and attempts to login to the +password server by sending exactly the same username/password that +it got from the client. If that server is in user level security and accepts the password, +then Samba accepts the clients connection. This allows the Samba server to use another SMB +server as the password server. +

    +You should also note that at the very start of all this, where the server tells the client +what security level it is in, it also tells the client if it supports encryption. If it +does then it supplies the client with a random cryptkey. The client will then send all +passwords in encrypted form. Samba supports this type of encryption by default. +

    +The parameter security = server means that Samba reports to clients that +it is running in user mode but actually passes off all authentication +requests to another user mode server. This requires an additional +parameter password server that points to the real authentication server. +That real authentication server can be another Samba server or can be a Windows NT server, +the later natively capable of encrypted password support. +

    Note

    +When Samba is running in server security mode it is essential that +the parameter password server is set to the precise NetBIOS machine +name of the target authentication server. Samba can NOT determine this from NetBIOS name +lookups because the choice of the target authentication server is arbitrary and can not +be determined from a domain name. In essence, a Samba server that is in +server security mode is operating in what used to be known as +workgroup mode. +

    Example Configuration

    +Using MS Windows NT as an authentication server

    -Please refer to the section on Howto configure Samba as a Primary Domain Controller -and for more information regarding how to create a domain machine account for a -domain member server as well as for information regarding how to enable the samba -domain member machine to join the domain and to be fully trusted by it. -

    Domain Controller

    -Over the years public perceptions of what Domain Control really is has taken on an -almost mystical nature. Before we branch into a brief overview of what Domain Control -is the following types of controller are known: -

    Domain Controller Types

    Primary Domain Controller
    Backup Domain Controller
    ADS Domain Controller

    -The Primary Domain Controller or PDC plays an important role in the MS -Windows NT3 and NT4 Domain Control architecture, but not in the manner that so many -expect. The PDC seeds the Domain Control database (a part of the Windows registry) and -it plays a key part in synchronisation of the domain authentication database. +This method involves the additions of the following parameters in the smb.conf file: +

    +        encrypt passwords = Yes
+        security = server
+        password server = "NetBIOS_name_of_a_DC"
+

    +There are two ways of identifying whether or not a username and password pair was valid +or not. One uses the reply information provided as part of the authentication messaging +process, the other uses just an error code.

    -New to Samba-3.0.0 is the ability to use a back-end file that holds the same type of data as -the NT4 style SAM (Security Account Manager) database (one of the registry files). -The samba-3.0.0 SAM can be specified via the smb.conf file parameter "passwd backend" and -valid options include smbpasswd tdbsam ldapsam nisplussam plugin unixsam. -The smbpasswd, tdbsam and ldapsam options can have a "_nua" suffix to indicate that No Unix -Accounts need to be created. In other words, the Samba SAM will be independant of Unix/Linux -system accounts, provided a uid range is defined from which SAM accounts can be created. +The down-side of this mode of configuration is the fact that for security reasons Samba +will send the password server a bogus username and a bogus password and if the remote +server fails to reject the username and password pair then an alternative mode of +identification of validation is used. Where a site uses password lock out after a +certain number of failed authentication attempts this will result in user lockouts.

    -The Backup Domain Controller or BDC plays a key role in servicing network -authentication requests. The BDC is biased to answer logon requests so that on a network segment -that has a BDC and a PDC the BDC will be most likely to service network logon requests. The PDC will -answer network logon requests when the BDC is too busy (high load). A BDC can be promoted to -a PDC. If the PDC is on line at the time that the BDC is promoted to PDC the previous PDC is -automatically demoted to a BDC. -

    -At this time Samba is NOT capable of acting as an ADS Domain Controller. -

    Chapter 4. Samba as Stand-Alone Server

    Andrew Tridgell

    Samba Team

    <tridge@samba.org>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    Table of Contents

    User and Share security level
    User Level Security
    Share Level Security
    Server Level Security
    Domain Level Security
    ADS Level Security

    -In this section the function and purpose of Samba's security -modes are described. -

    User and Share security level

    -A SMB server tells the client at startup what "security level" it is -running. There are two options "share level" and "user level". Which -of these two the client receives affects the way the client then tries -to authenticate itself. It does not directly affect (to any great -extent) the way the Samba server does security. I know this is -strange, but it fits in with the client/server approach of SMB. In SMB -everything is initiated and controlled by the client, and the server -can only tell the client what is available and whether an action is -allowed. -

    User Level Security

    -I'll describe user level security first, as its simpler. In user level -security the client will send a "session setup" command directly after -the protocol negotiation. This contains a username and password. The -server can either accept or reject that username/password -combination. Note that at this stage the server has no idea what -share the client will eventually try to connect to, so it can't base -the "accept/reject" on anything other than: -

    1. the username/password

    2. the machine that the client is coming from

    -If the server accepts the username/password then the client expects to -be able to mount any share (using a "tree connection") without -specifying a password. It expects that all access rights will be as -the username/password specified in the "session setup". -

    -It is also possible for a client to send multiple "session setup" -requests. When the server responds it gives the client a "uid" to use -as an authentication tag for that username/password. The client can -maintain multiple authentication contexts in this way (WinDD is an -example of an application that does this) -

    Share Level Security

    -Ok, now for share level security. In share level security the client -authenticates itself separately for each share. It will send a -password along with each "tree connection" (share mount). It does not -explicitly send a username with this operation. The client is -expecting a password to be associated with each share, independent of -the user. This means that samba has to work out what username the -client probably wants to use. It is never explicitly sent the -username. Some commercial SMB servers such as NT actually associate -passwords directly with shares in share level security, but samba -always uses the unix authentication scheme where it is a -username/password that is authenticated, not a "share/password". -

    -Many clients send a "session setup" even if the server is in share -level security. They normally send a valid username but no -password. Samba records this username in a list of "possible -usernames". When the client then does a "tree connection" it also adds -to this list the name of the share they try to connect to (useful for -home directories) and any users listed in the user = smb.conf -line. The password is then checked in turn against these "possible -usernames". If a match is found then the client is authenticated as -that user. -

    Server Level Security

    -Finally "server level" security. In server level security the samba -server reports to the client that it is in user level security. The -client then does a "session setup" as described earlier. The samba -server takes the username/password that the client sends and attempts -to login to the "password server" by sending exactly the same -username/password that it got from the client. If that server is in -user level security and accepts the password then samba accepts the -clients connection. This allows the samba server to use another SMB -server as the "password server". -

    -You should also note that at the very start of all this, where the -server tells the client what security level it is in, it also tells -the client if it supports encryption. If it does then it supplies the -client with a random "cryptkey". The client will then send all -passwords in encrypted form. You have to compile samba with encryption -enabled to support this feature, and you have to maintain a separate -smbpasswd file with SMB style encrypted passwords. It is -cryptographically impossible to translate from unix style encryption -to SMB style encryption, although there are some fairly simple management -schemes by which the two could be kept in sync. -

    -"security = server" means that Samba reports to clients that -it is running in "user mode" but actually passes off all authentication -requests to another "user mode" server. This requires an additional -parameter "password server =" that points to the real authentication server. -That real authentication server can be another Samba server or can be a -Windows NT server, the later natively capable of encrypted password support. -

    Note

    -Server level security is incompatible with what is known -as schannel or "sign and seal" protocols. This means that -if you want to use server level security you must disable -the use of "sign and seal" on all machines on your network. -

    Configuring Samba for Seemless Windows Network Integration

    -MS Windows clients may use encrypted passwords as part of a challenege/response -authentication model (a.k.a. NTLMv1) or alone, or clear text strings for simple -password based authentication. It should be realized that with the SMB protocol +Use of this mode of authentication does require there to be a standard Unix account +for the user, though this account can be blocked to prevent logons by non-SMB/CIFS clients. +

    Seamless Windows Network Integration

    +MS Windows clients may use encrypted passwords as part of a challenge/response +authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or clear text strings for simple +password based authentication. It should be realized that with the SMB protocol, the password is passed over the network either in plain text or encrypted, but not both in the same authentication request.

    -When encrypted passwords are used a password that has been entered by the user +When encrypted passwords are used, a password that has been entered by the user is encrypted in two ways:

    • An MD4 hash of the UNICODE of the password - string. This is known as the NT hash. -

    • The password is converted to upper case, - and then padded or trucated to 14 bytes. This string is - then appended with 5 bytes of NULL characters and split to - form two 56 bit DES keys to encrypt a "magic" 8 byte value. - The resulting 16 bytes for the LanMan hash. -

    + string. This is known as the NT hash. +

  • The password is converted to upper case, + and then padded or truncated to 14 bytes. This string is + then appended with 5 bytes of NULL characters and split to + form two 56 bit DES keys to encrypt a "magic" 8 byte value. + The resulting 16 bytes form the LanMan hash. +

    • MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0 pre-service pack 3 will use either mode of password authentication. All versions of MS Windows that follow these versions no longer support plain @@ -559,218 +701,365 @@ service connection mapping attempts to revalidate it will fail if the remote authentication server does not support encrypted passwords. This means that it is definitely not a good idea to re-enable plain text password support in such clients.

    -The following parameters can be used to work around the issue of Windows 9x client +The following parameters can be used to work around the issue of Windows 9x clients upper casing usernames and password before transmitting them to the SMB server when using clear text authentication. 

    -	passsword level = integer
-	username level = integer
+        password level = integer
+        username level = integer

    By default Samba will lower case the username before attempting to lookup the user in the database of local system accounts. Because UNIX usernames conventionally -only contain lower case character, the username level parameter +only contain lower case character, the username level parameter is rarely needed.

    -However, passwords on UNIX systems often make use of mixed case characters. +However, passwords on UNIX systems often make use of mixed case characters. This means that in order for a user on a Windows 9x client to connect to a Samba -server using clear text authentication, the password level +server using clear text authentication, the password level must be set to the maximum number of upper case letter which could appear is a password. Note that the server OS uses the traditional DES version -of crypt(), a password level of 8 will result in case +of crypt(), a password level of 8 will result in case insensitive passwords as seen from Windows users. This will also result in longer -login times as Samba has to compute the permutations of the password string and +login times as Samba has to compute the permutations of the password string and try them one by one until a match is located (or all combinations fail).

    -The best option to adopt is to enable support for encrypted passwords -where ever Samba is used. There are three configuration possibilities -for support of encrypted passwords: -

    Use MS Windows NT as an authentication server

    -This method involves the additions of the following parameters in the smb.conf file: -

    -	encrypt passwords = Yes
-	security = server
-	password server = "NetBIOS_name_of_PDC"
-

    -There are two ways of identifying whether or not a username and -password pair was valid or not. One uses the reply information provided -as part of the authentication messaging process, the other uses -just an error code. -

    -The down-side of this mode of configuration is the fact that -for security reasons Samba will send the password server a bogus -username and a bogus password and if the remote server fails to -reject the username and password pair then an alternative mode -of identification of validation is used. Where a site uses password -lock out after a certain number of failed authentication attempts -this will result in user lockouts. -

    -Use of this mode of authentication does require there to be -a standard Unix account for the user, this account can be blocked -to prevent logons by other than MS Windows clients. -

    Domain Level Security

    -When samba is operating in security = domain mode this means that -the Samba server has a domain security trust account (a machine account) and will cause -all authentication requests to be passed through to the domain controllers. -

    Samba as a member of an MS Windows NT security domain

    -This method involves addition of the following parameters in the smb.conf file: -

    -	encrypt passwords = Yes
-	security = domain
-	workgroup = "name of NT domain"
-	password server = *
-

    -The use of the "*" argument to password server will cause samba to locate the -domain controller in a way analogous to the way this is done within MS Windows NT. -This is the default behaviour. -

    -In order for this method to work the Samba server needs to join the -MS Windows NT security domain. This is done as follows: -

    • On the MS Windows NT domain controller using - the Server Manager add a machine account for the Samba server. -

    • Next, on the Linux system execute: - smbpasswd -r PDC_NAME -j DOMAIN_NAME (samba 2.x) - - net join -U administrator%password (samba-3) -

    -Use of this mode of authentication does require there to be a standard Unix account -for the user in order to assign a uid once the account has been authenticated by -the remote Windows DC. This account can be blocked to prevent logons by clients other than -MS Windows through things such as setting an invalid shell in the -/etc/passwd entry. -

    -An alternative to assigning UIDs to Windows users on a Samba member server is -presented in the Winbind Overview chapter -in this HOWTO collection. -

    ADS Level Security

    -For information about the configuration option please refer to the entire section entitled -Samba as an ADS Domain Member. -

    Chapter 5.  -Samba as an NT4 or Win2k Primary Domain Controller -

    Gerald (Jerry) Carter

    Samba Team

    <jerry@samba.org>

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    David Bannon

    Samba Team

    <dbannon@samba.org>

    (26 Apr 2001)

    Table of Contents

    Prerequisite Reading
    -Background -
    Configuring the Samba Domain Controller
    Creating Machine Trust Accounts and Joining Clients to the Domain
    Manual Creation of Machine Trust Accounts
    "On-the-Fly" Creation of Machine Trust Accounts
    Joining the Client to the Domain
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." +The best option to adopt is to enable support for encrypted passwords where ever +Samba is used. Most attempts to apply the registry change to re-enable plain text +passwords will eventually lead to user complaints and unhappiness. +

    Common Errors

    +We all make mistakes. It is Ok to make mistakes, so long as they are made in the right places +and at the right time. A mistake that causes lost productivity is seldom tolerated. A mistake +made in a developmental test lab is expected. +

    +Here we look at common mistakes and misapprehensions that have been the subject of discussions +on the Samba mailing lists. Many of these are avoidable by doing you homework before attempting +a Samba implementation. Some are the result of misunderstanding of the English language. The +English language has many turns of phrase that are potentially vague and may be highly confusing +to those for whom English is not their native tongue. +

    What makes Samba a SERVER?

    +To some the nature of the Samba security mode is very obvious, but entirely +wrong all the same. It is assumed that security = server means that Samba +will act as a server. Not so! See above - this setting means that Samba will try +to use another SMB server as its source of user authentication alone. +

    What makes Samba a Domain Controller?

    +The smb.conf parameter security = domain does NOT really make Samba behave +as a Domain Controller! This setting means we want Samba to be a domain member! +

    What makes Samba a Domain Member?

    +Guess! So many others do. But whatever you do, do NOT think that security = user +makes Samba act as a domain member. Read the manufacturers manual before the warranty expires! See +the Domain Member section of this Howto for more information. +

    Constantly Losing Connections to Password Server

    +Why does server_validate() simply give up rather than re-establishing its connection to the +password server? Though I am not fluent in the SMB protocol, perhaps the cluster server +process passes along to its client workstation the session key it receives from the password +server, which means the password hashes submitted by the client would not work on a subsequent +connection, whose session key would be different. So server_validate() must give up. +

    +Indeed. That's why security = server is at best a nasty hack. Please use security = domain. +security = server mode is also known as pass-through authentication. +

    Chapter 5. Domain Control

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    David Bannon

    Samba Team

    Table of Contents

    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not -exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
    Domain Control for Windows 9x/ME
    Configuration Instructions: Network Logons

    Prerequisite Reading

    -Before you continue reading in this chapter, please make sure -that you are comfortable with configuring basic files services -in smb.conf and how to enable and administer password -encryption in Samba. Theses two topics are covered in the -smb.conf manpage. -

    -Background -

    -This article outlines the steps necessary for configuring Samba as a PDC. -It is necessary to have a working Samba server prior to implementing the -PDC functionality. +existing set.." when creating a machine trust account.

    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not +exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, +I get a message about my account being disabled.
    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

    The Essence of Learning:  +There are many who approach MS Windows networking with incredible misconceptions. +That's OK, because it gives the rest of us plenty of opportunity to be of assistance. +Those who really want help would be well advised to become familiar with information +that is already available. +

    +The reader is advised NOT to tackle this section without having first understood +and mastered some basics. MS Windows networking is not particularly forgiving of +misconfiguration. Users of MS Windows networking are likely to complain bitterly +of persistent niggles that may be caused by broken network or system configuration. +To a great many people however, MS Windows networking starts with a domain controller +that in some magical way is expected to solve all ills. +

    +From the Samba mailing list one can readily identify many common networking issues. +If you are not clear on the following subjects, then it will do much good to read the +sections of this HOWTO that deal with it. These are the most common causes of MS Windows +networking problems: +

    Basic TCP/IP configuration
    NetBIOS name resolution
    Authentication configuration
    User and Group configuration
    Basic File and Directory Permission Control in Unix/Linux
    Understanding of how MS Windows clients interoperate in a network + environment

    +Do not be put off; on the surface of it MS Windows networking seems so simple that any fool +can do it. In fact, it is not a good idea to set up an MS Windows network with +inadequate training and preparation. But let's get our first indelible principle out of the +way: It is perfectly OK to make mistakes! In the right place and at +the right time, mistakes are the essence of learning. It is very much +not ok to make mistakes that cause loss of productivity and impose an avoidable financial +burden on an organisation. +

    +Where is the right place to make mistakes? Only out of harm's way! If you are going to +make mistakes, then please do this on a test network, away from users and in such a way as +to not inflict pain on others. Do your learning on a test network. +

    Features and Benefits

    +What is the key benefit of Microsoft Domain security? +

    +In a word, Single Sign On, or SSO for short. To many, this is the holy +grail of MS Windows NT and beyond networking. SSO allows users in a well designed network +to log onto any workstation that is a member of the domain that their user account is in +(or in a domain that has an appropriate trust relationship with the domain they are visiting) +and they will be able to log onto the network and access resources (shares, files, and printers) +as if they are sitting at their home (personal) workstation. This is a feature of the Domain +security protocols. +

    +The benefits of Domain security are fully available to those sites that deploy a Samba PDC. +

    Note

    +Network clients of an MS Windows Domain security environment must be Domain members to be +able to gain access to the advanced features provided. Domain membership involves more than just +setting the workgroup name to the Domain name. It requires the creation of a Domain trust account +for the workstation (called a machine account). Please refer to the chapter on +Domain Membership for more information. +

    +The following functionalities are new to the Samba-3 release:

    • - Domain logons for Windows NT 4.0 / 200x / XP Professional clients. + Windows NT4 domain trusts

    • - Placing Windows 9x / Me clients in user level security + Adding users via the User Manager for Domains. This can be done on any MS Windows + client using the Nexus toolkit that is available from Microsoft's web site. + At some later date Samba-3 may get support for the use of the Microsoft Management + Console for user management.

    • - Retrieving a list of users and groups from a Samba PDC to - Windows 9x / Me / NT / 200x / XP Professional clients -

    • - Roaming Profiles -

    • - Network/System Policies -

    Note

    -Roaming Profiles and System/Network policies are advanced network administration topics -that are covered separately in this document. -

    -The following functionalities are new to the Samba 3.0 release: -

    • - Windows NT 4 domain trusts + Introduces replaceable and multiple user account (authentication) + back ends. In the case where the back end is placed in an LDAP database, + Samba-3 confers the benefits of a back end that can be distributed, replicated, + and is highly scalable.

    • - Adding users via the User Manager for Domains + Implements full Unicode support. This simplifies cross locale internationalisation + support. It also opens up the use of protocols that Samba-2.2.x had but could not use due + to the need to fully support Unicode.

    -The following functionalities are NOT provided by Samba 3.0: +The following functionalities are NOT provided by Samba-3:

    • - SAM replication with Windows NT 4.0 Domain Controllers + SAM replication with Windows NT4 Domain Controllers (i.e. a Samba PDC and a Windows NT BDC or vice versa)

    • Acting as a Windows 2000 Domain Controller (i.e. Kerberos and - Active Directory) + Active Directory) - In point of fact, Samba-3 DOES have some + Active Directory Domain Control ability that is at this time + purely experimental AND that is certain + to change as it becomes a fully supported feature some time + during the Samba-3 (or later) life cycle.

    -Please note that Windows 9x / Me / XP Home clients are not true members of a domain -for reasons outlined in this article. Therefore the protocol for -support of Windows 9x-style domain logons is completely different -from NT4 / Win2k type domain logons and has been officially supported for some -time. -

    -MS Windows XP Home edition is NOT able to join a domain and does not permit -the use of domain logons. +Windows 9x / Me / XP Home clients are not true members of a domain for reasons outlined +in this chapter. The protocol for support of Windows 9x / Me style network (domain) logons +is completely different from NT4 / Win2k type domain logons and has been officially supported +for some time. These clients use the old LanMan Network Logon facilities that are supported +in Samba since approximately the Samba-1.9.15 series. +

    +Samba-3 has an implementation of group mapping between Windows NT groups +and Unix groups (this is really quite complicated to explain in a short space). This is +discussed more fully in the Group Mapping chapter. +

    +Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store +user and machine trust account information in a suitable backend data store. With Samba-3 +there can be multiple back-ends for this including: +

    • + smbpasswd - the plain ASCII file stored used by + earlier versions of Samba. This file configuration option requires + a Unix/Linux system account for EVERY entry (ie: both for user and for + machine accounts). This file will be located in the private + directory (default is /usr/local/samba/lib/private or on linux /etc/samba). +

    • + tdbsam - a binary database backend that will be + stored in the private directory in a file called + passdb.tdb. The key benefit of this binary format + file is that it can store binary objects that can not be accommodated + in the traditional plain text smbpasswd file. These permit the extended + account controls that MS Windows NT4 and later also have. +

    • + ldapsam - An LDAP based back-end. Permits the + LDAP server to be specified. eg: ldap://localhost or ldap://frodo.murphy.com. + Like the tdbsam, ldapsam permits the storing of extended account attributes + for control of things like: Permitted access times, password activation and + expiry, permitted points of access (workstation names), per user profile + location, and much more. +

    • + ldapsam_compat - An LDAP back-end that maintains backwards + compatibility with the behaviour of samba-2.2.x. You should use this in the process + of migrating from samba-2.2.x to samba-3 if you do not want to rebuild your LDAP + database. +

    +Read the chapter about Account Information Database for details +regarding the choices available and how to configure them. +

    Note

    +The new tdbsam and ldapsam account backends store substantially more information than +smbpasswd is capable of. The new backend database includes capacity to specify +per user settings for many parameters, over-riding global settings given in the +smb.conf file. eg: logon drive, logon home, logon path, etc. +Thus, with samba-3 it is possible to have a default system configuration for profiles, +and on a per user basis to over-ride this for those users who should not be subject +to the default configuration. +

    Basics of Domain Control

    +Over the years, public perceptions of what Domain Control really is has taken on an +almost mystical nature. Before we branch into a brief overview of Domain Control, +there are three basic types of domain controllers: +

    Domain Controller Types

    • Primary Domain Controller

    • Backup Domain Controller

    • ADS Domain Controller

    +The Primary Domain Controller or PDC plays an important role in the MS +Windows NT4 and Windows 200x Domain Control architecture, but not in the manner that so many +expect. There is folk lore that dictates that because of it's role in the MS Windows +network, the PDC should be the most powerful and most capable machine in the network. +As strange as it may seem to say this here, good over all network performance dictates that +the entire infrastructure needs to be balanced. It is advisable to invest more in the Backup +Domain Controllers and Stand-Alone (or Domain Member) servers than in the PDC. +

    +In the case of MS Windows NT4 style domains, it is the PDC seeds the Domain Control database, +a part of the Windows registry called the SAM (Security Account Manager). It plays a key +part in NT4 type domain user authentication and in synchronisation of the domain authentication +database with Backup Domain Controllers. +

    +With MS Windows 200x Server based Active Directory domains, one domain controller seeds a potential +hierarchy of domain controllers, each with their own area of delegated control. The master domain +controller has the ability to override any down-stream controller, but a down-line controller has +control only over it's down-line. With Samba-3 this functionality can be implemented using an +LDAP based user and machine account back end. +

    +New to Samba-3 is the ability to use a back-end database that holds the same type of data as +the NT4 style SAM (Security Account Manager) database (one of the registry files). +The Samba-3 SAM can be specified via the smb.conf file parameter +passwd backend and valid options include +smbpasswd, tdbsam, ldapsam, nisplussam, xmlsam, mysqlsam, guest.

    -Implementing a Samba PDC can basically be divided into 3 broad -steps. -

    1. - Configuring the Samba PDC +The Backup Domain Controller or BDC plays a key role in servicing network +authentication requests. The BDC is biased to answer logon requests in preference to the PDC. +On a network segment that has a BDC and a PDC the BDC will be most likely to service network +logon requests. The PDC will answer network logon requests when the BDC is too busy (high load). +A BDC can be promoted to a PDC. If the PDC is on line at the time that a BDC is promoted to +PDC, the previous PDC is automatically demoted to a BDC. With Samba-3 this is NOT an automatic +operation; the PDC and BDC must be manually configured and changes need to be made likewise. +

      +With MS Windows NT4, it is an install time decision what type of machine the server will be. +It is possible to change the promote a BDC to a PDC and vice versa only, but the only way +to convert a domain controller to a domain member server or a stand-alone server is to +reinstall it. The install time choices offered are: +

      • Primary Domain Controller - The one that seeds the domain SAM

      • Backup Domain Controller - One that obtains a copy of the domain SAM

      • Domain Member Server - One that has NO copy of the domain SAM, rather it obtains authentication from a Domain Controller for all access controls.

      • Stand-Alone Server - One that plays NO part is SAM synchronisation, has it's own authentication database and plays no role in Domain security.

      +With MS Windows 2000 the configuration of domain control is done after the server has been +installed. Samba-3 is capable of acting fully as a native member of a Windows 200x server +Active Directory domain. +

      +New to Samba-3 is the ability to function fully as an MS Windows NT4 style Domain Controller, +excluding the SAM replication components. However, please be aware that Samba-3 support the +MS Windows 200x domain control protocols also. +

      +At this time any appearance that Samba-3 is capable of acting as an +ADS Domain Controller is limited and experimental in nature. +This functionality should not be used until the Samba-Team offers formal support for it. +At such a time, the documentation will be revised to duly reflect all configuration and +management requirements. +

    Preparing for Domain Control

    +There are two ways that MS Windows machines may interact with each other, with other servers, +and with Domain Controllers: Either as Stand-Alone systems, more commonly +called Workgroup members, or as full participants in a security system, +more commonly called Domain members. +

    +It should be noted that Workgroup membership involve no special configuration +other than the machine being configured so that the network configuration has a commonly used name +for it's workgroup entry. It is not uncommon for the name WORKGROUP to be used for this. With this +mode of configuration there are NO machine trust accounts and any concept of membership as such +is limited to the fact that all machines appear in the network neighbourhood to be logically +grouped together. Again, just to be clear: workgroup mode does not involve any security machine +accounts. +

    +Domain member machines have a machine account in the Domain accounts database. A special procedure +must be followed on each machine to affect Domain membership. This procedure, which can be done +only by the local machine Administrator account, will create the Domain machine account (if +if does not exist), and then initializes that account. When the client first logs onto the +Domain it triggers a machine password change. +

    Note

    +When running a Domain all MS Windows NT / 200x / XP Professional clients should be configured +as full Domain Members - IF A SECURE NETWORK IS WANTED. If the machine is NOT made a member of the +Domain, then it will operate like a workgroup (stand-alone) machine. Please refer the +Domain Membership chapter for information regarding + HOW to make your MS Windows clients Domain members. +

    +The following are necessary for configuring Samba-3 as an MS Windows NT4 style PDC for MS Windows +NT4 / 200x / XP clients. +

    Configuration of basic TCP/IP and MS Windows Networking
    Correct designation of the Server Role (security = user)
    Consistent configuration of Name Resolution (See chapter on Browsing and on + MS Windows network Integration)
    Domain logons for Windows NT4 / 200x / XP Professional clients
    Configuration of Roaming Profiles or explicit configuration to force local profile usage
    Configuration of Network/System Policies
    Adding and managing domain user accounts
    Configuring MS Windows client machines to become domain members

    +The following provisions are required to serve MS Windows 9x / Me Clients: +

    Configuration of basic TCP/IP and MS Windows Networking
    Correct designation of the Server Role (security = user)
    Network Logon Configuration (Since Windows 9x / XP Home are not technically domain + members, they do not really participate in the security aspects of Domain logons as such)
    Roaming Profile Configuration
    Configuration of System Policy handling
    Installation of the Network driver "Client for MS Windows Networks" and configuration + to log onto the domain
    Placing Windows 9x / Me clients in user level security - if it is desired to allow + all client share access to be controlled according to domain user / group identities.
    Adding and managing domain user accounts

    Note

    +Roaming Profiles and System/Network policies are advanced network administration topics +that are covered in the Profile Management and +Policy Management chapters of this document. However, these are not necessarily specific +to a Samba PDC as much as they are related to Windows NT networking concepts. +

    +A Domain Controller is an SMB/CIFS server that: +

    • + Registers and advertises itself as a Domain Controller (through NetBIOS broadcasts + as well as by way of name registrations either by Mailslot Broadcasts over UDP broadcast, + to a WINS server over UDP unicast, or via DNS and Active Directory)

    • - Creating machine trust accounts and joining clients to the domain + Provides the NETLOGON service (actually a collection of services that runs over + a number of protocols. These include the LanMan Logon service, the Netlogon service, + the Local Security Account service, and variations of them)

    • - Adding and managing domain user accounts -

    -There are other minor details such as user profiles, system -policies, etc... However, these are not necessarily specific -to a Samba PDC as much as they are related to Windows NT networking -concepts. -

    Configuring the Samba Domain Controller

    -The first step in creating a working Samba PDC is to -understand the parameters necessary in smb.conf. Here we -attempt to explain the parameters that are covered in -the smb.conf man page. -

    -Here is an example smb.conf for acting as a PDC: + Provides a share called NETLOGON +

    +For Samba to provide these is rather easy to configure. Each Samba Domain Controller must provide +the NETLOGON service which Samba calls the domain logons functionality +(after the name of the parameter in the smb.conf file). Additionally, one (1) server in a Samba-3 +Domain must advertise itself as the domain master browser. This causes the Primary Domain Controller +to claim domain specific NetBIOS name that identifies it as a domain master browser for its given +domain/workgroup. Local master browsers in the same domain/workgroup on broadcast-isolated subnets +then ask for a complete copy of the browse list for the whole wide area network. Browser clients +will then contact their local master browser, and will receive the domain-wide browse list, +instead of just the list for their broadcast-isolated subnet. +

    Domain Control - Example Configuration

    +The first step in creating a working Samba PDC is to understand the parameters necessary +in smb.conf. Here we attempt to explain the parameters that are covered in +the smb.conf man page. +

    +Here is an example smb.conf for acting as a PDC: 

    -[global]
-    ; Basic server settings
-    netbios name = POGO
-    workgroup = NARNIA
-
-    ; User and Machine Account Backends
-    ; Choices are: tdbsam, tdbsam_nua, smbpasswd, smbpasswd_nua, ldapsam, ldapsam_nua, ...
-    ;              mysqlsam, xmlsam, guest
-    passdb backend = ldapsam, guest
-
-    ; we should act as the domain and local master browser
-    os level = 64
-    preferred master = yes
-    domain master = yes
-    local master = yes
-    
-    ; security settings (must user security = user)
-    security = user
-    
-    ; encrypted passwords are a requirement for a PDC
-    encrypt passwords = yes
-    
-    ; support domain logons
-    domain logons = yes
-    
-    ; where to store user profiles?
-    logon path = \\%N\profiles\%u
-    
-    ; where is a user's home directory and where should it be mounted at?
-    logon drive = H:
-    logon home = \\homeserver\%u
-    
-    ; specify a generic logon script for all users
-    ; this is a relative **DOS** path to the [netlogon] share
-    logon script = logon.cmd
-
-; necessary share for domain controller
-[netlogon]
-    path = /usr/local/samba/lib/netlogon
-    read only = yes
-    write list = ntadmin
-    
-; share for storing user profiles
-[profiles]
-    path = /export/smb/ntprofile
-    read only = no
-    create mask = 0600
-    directory mask = 0700
+	[global]
+	    ; Basic server settings
+	    netbios name = POGO
+	    workgroup = NARNIA
+
+	    ; User and Machine Account Backends
+	    ; Choices are: tdbsam, smbpasswd, ldapsam, mysqlsam, xmlsam, guest
+	    passdb backend = ldapsam, guest
+
+	    ; we should act as the domain and local master browser
+	    os level = 64
+	    preferred master = yes
+	    domain master = yes
+	    local master = yes
+	    
+	    ; security settings (must user security = user)
+	    security = user
+	    
+	    ; encrypted passwords are a requirement for a PDC (default = Yes)
+	    encrypt passwords = yes
+	    
+	    ; support domain logons
+	    domain logons = yes
+	    
+	    ; where to store user profiles?
+	    logon path = \\%N\profiles\%u
+	    
+	    ; where is a user's home directory and where should it be mounted at?
+	    logon drive = H:
+	    logon home = \\homeserver\%u\winprofile
+	    
+	    ; specify a generic logon script for all users
+	    ; this is a relative **DOS** path to the [netlogon] share
+	    logon script = logon.cmd
+
+	; necessary share for domain controller
+	[netlogon]
+	    path = /usr/local/samba/lib/netlogon
+	    read only = yes
+	    write list = ntadmin
+	    
+	; share for storing user profiles
+	[profiles]
+	    path = /export/smb/ntprofile
+	    read only = no
+	    create mask = 0600
+	    directory mask = 0700

    Note

    The above parameters make for a full set of parameters that may define the server's mode of operation. The following parameters are the essentials alone: @@ -778,6 +1067,7 @@ of operation. The following parameters are the essentials alone: 

     	workgroup = NARNIA
 	domain logons = Yes
+	domain master = Yes
 	security = User

    @@ -787,283 +1077,95 @@ more complete environment. There are a couple of points to emphasize in the above configuration.

    • Encrypted passwords must be enabled. For more details on how - to do this, refer to the User Database chapter. + to do this, refer to Account Information Database chapter.

    • - The server must support domain logons and a - [netlogon] share + The server must support domain logons and have a + [netlogon] share

    • The server must be the domain master browser in order for Windows client to locate the server as a DC. Please refer to the various Network Browsing documentation included with this distribution for details. -

    -Samba 3.0 offers a complete implementation of group mapping -between Windows NT groups and Unix groups (this is really quite -complicated to explain in a short space). -

    Creating Machine Trust Accounts and Joining Clients to the Domain

    -A machine trust account is a Samba account that is used to -authenticate a client machine (rather than a user) to the Samba -server. In Windows terminology, this is known as a "Computer -Account."

    -The password of a machine trust account acts as the shared secret for -secure communication with the Domain Controller. This is a security -feature to prevent an unauthorized machine with the same NetBIOS name -from joining the domain and gaining access to domain user/group -accounts. Windows NT, 200x, XP Professional clients use machine trust -accounts, but Windows 9x / Me / XP Home clients do not. Hence, a -Windows 9x / Me / XP Home client is never a true member of a domain -because it does not possess a machine trust account, and thus has no -shared secret with the domain controller. -

    A Windows PDC stores each machine trust account in the Windows -Registry. A Samba-3 PDC also has to store machine trust account information -in a suitable backend data store. With Samba-3 there can be multiple back-ends -for this including: -

    • - smbpasswd - the plain ascii file stored used by - earlier versions of Samba. This file configuration option requires - a Unix/Linux system account for EVERY entry (ie: both for user and for - machine accounts). This file will be located in the private - directory (default is /usr/local/samba/lib/private or on linux /etc/samba). -

    • - smbpasswd_nua - This file is independant of the - system wide user accounts. The use of this back-end option requires - specification of the "non unix account range" option also. It is called - smbpasswd and will be located in the private directory. -

    • - tdbsam - a binary database backend that will be - stored in the private directory in a file called - passwd.tdb. The key benefit of this binary format - file is that it can store binary objects that can not be accomodated - in the traditional plain text smbpasswd file. -

    • - tdbsam_nua like the smbpasswd_nua option above, this - file allows the creation of arbitrary user and machine accounts without - requiring that account to be added to the system (/etc/passwd) file. It - too requires the specification of the "non unix account range" option - in the [globals] section of the smb.conf file. -

    • - ldapsam - An LDAP based back-end. Permits the - LDAP server to be specified. eg: ldap://localhost or ldap://frodo.murphy.com -

    • - ldapsam_nua - LDAP based back-end with no unix - account requirement, like smbpasswd_nua and tdbsam_nua above. -

    Read the chapter about the User Database -for details.

    Note

    -The new tdbsam and ldapsam account backends store vastly more information than -smbpasswd is capable of. The new backend database includes capacity to specify -per user settings for many parameters, over-riding global settings given in the -smb.conf file. eg: logon drive, logon home, logon path, etc. -

    -A Samba PDC, however, stores each machine trust account in two parts, -as follows: +

    Samba ADS Domain Control

    +Samba-3 is not and can not act as an Active Directory Server. It can not truly function as +an Active Directory Primary Domain Controller. The protocols for some of the functionality +the Active Directory Domain Controllers is have been partially implemented on an experimental +only basis. Please do NOT expect Samba-3 to support these protocols - nor should you depend +on any such functionality either now or in the future. The Samba-Team may well remove such +experimental features or may change their behaviour. +

    Domain and Network Logon Configuration

    +The subject of Network or Domain Logons is discussed here because it rightly forms +an integral part of the essential functionality that is provided by a Domain Controller. +

    Domain Network Logon Service

    +All Domain Controllers must run the netlogon service (domain logons +in Samba). One Domain Controller must be configured with domain master = Yes +(the Primary Domain Controller); on ALL Backup Domain Controllers domain master = No +must be set. +

    Example Configuration

    +	[global]
+		domain logons = Yes
+		domain master = (Yes on PDC, No on BDCs)
 
-
    • A Samba account, stored in the same location as user
-    LanMan and NT password hashes (currently
-    smbpasswd). The Samba account 
-    possesses and uses only the NT password hash.
    • A corresponding Unix account, typically stored in
-    /etc/passwd. (Future releases will alleviate the need to
-    create /etc/passwd entries.) 
    
-
    
-There are two ways to create machine trust accounts:
-
    •  Manual creation. Both the Samba and corresponding
-	Unix account are created by hand.
    •  "On-the-fly" creation. The Samba machine trust
-	account is automatically created by Samba at the time the client
-	is joined to the domain. (For security, this is the
-	recommended method.) The corresponding Unix account may be
-	created automatically or manually. 
    Manual Creation of Machine Trust Accounts
    
-The first step in manually creating a machine trust account is to
-manually create the corresponding Unix account in
-/etc/passwd.  This can be done using
-vipw or other 'add user' command that is normally
-used to create new Unix accounts.  The following is an example for a
-Linux based Samba server:
-
    
-  root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine 
-nickname" -s /bin/false machine_name$ 
-
    
-root# passwd -l machine_name$
-
    On *BSD systems, this can be done using the 'chpass' utility:
    
-root# chpass -a "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin"
-
    
-The /etc/passwd entry will list the machine name 
-with a "$" appended, won't have a password, will have a null shell and no 
-home directory. For example a machine named 'doppy' would have an 
-/etc/passwd entry like this:
-
    -doppy$:x:505:501:machine_nickname:/dev/null:/bin/false
-
    
-Above, machine_nickname can be any
-descriptive name for the client, i.e., BasementComputer.
-machine_name absolutely must be the NetBIOS
-name of the client to be joined to the domain.  The "$" must be
-appended to the NetBIOS name of the client or Samba will not recognize
-this as a machine trust account.
+	[netlogon]
+		comment = Network Logon Service
+		path = /var/lib/samba/netlogon
+		guest ok = Yes
+		browseable = No
+

    The Special Case of MS Windows XP Home Edition

    Note

    +MS Windows XP Home Edition does not have the ability to join any type of Domain +security facility. Unlike, MS Windows 9x / Me, MS Windows XP Home Edition also completely +lacks the ability to log onto a network. +

    +To be completely clear: If you want MS Windows XP Home Edition to integrate with your +MS Windows NT4 or Active Directory Domain security understand - IT CAN NOT BE DONE. +Your only choice is to buy the upgrade pack from MS Windows XP Home Edition to +MS Windows XP Professional. +

    +Now that this has been said, please do NOT ask the mailing list, or email any of the +Samba-Team members with your questions asking how to make this work. It can't be done. +

    The Special Case of Windows 9x / Me

    +A domain and a workgroup are exactly the same thing in terms of network +browsing. The difference is that a distributable authentication +database is associated with a domain, for secure login access to a +network. Also, different access rights can be granted to users if they +successfully authenticate against a domain logon server. Samba-3 does this +now in the same way that MS Windows NT/2K.

    -Now that the corresponding Unix account has been created, the next step is to create -the Samba account for the client containing the well-known initial -machine trust account password. This can be done using the smbpasswd(8) command -as shown here: +The SMB client logging on to a domain has an expectation that every other +server in the domain should accept the same authentication information. +Network browsing functionality of domains and workgroups is identical and +is explained in this documentation under the browsing discussions. +It should be noted, that browsing is totally orthogonal to logon support.

    -root# smbpasswd -a -m machine_name +Issues related to the single-logon network model are discussed in this +section. Samba supports domain logons, network logon scripts, and user +profiles for MS Windows for workgroups and MS Windows 9X/ME clients +which are the focus of this section.

    -where machine_name is the machine's NetBIOS -name. The RID of the new machine account is generated from the UID of -the corresponding Unix account. -

    Join the client to the domain immediately

    - Manually creating a machine trust account using this method is the - equivalent of creating a machine trust account on a Windows NT PDC using - the "Server Manager". From the time at which the account is created - to the time which the client joins the domain and changes the password, - your domain is vulnerable to an intruder joining your domain using - a machine with the same NetBIOS name. A PDC inherently trusts - members of the domain and will serve out a large degree of user - information to such clients. You have been warned! -

    "On-the-Fly" Creation of Machine Trust Accounts

    -The second (and recommended) way of creating machine trust accounts is -simply to allow the Samba server to create them as needed when the client -is joined to the domain.

    Since each Samba machine trust account requires a corresponding -Unix account, a method for automatically creating the -Unix account is usually supplied; this requires configuration of the -add user script -option in smb.conf. This -method is not required, however; corresponding Unix accounts may also -be created manually. -

    Below is an example for a RedHat 6.2 Linux system. -

    -[global]
-   # <...remainder of parameters...>
-   add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u 
-

    Joining the Client to the Domain

    -The procedure for joining a client to the domain varies with the -version of Windows. -

    • Windows 2000

      - When the user elects to join the client to a domain, Windows prompts for - an account and password that is privileged to join the domain. A Samba administrative - account (i.e., a Samba account that has root privileges on the Samba server) must be - entered here; the operation will fail if an ordinary user account is given. - The password for this account should be set to a different password than the associated - /etc/passwd entry, for security reasons. -

      - The session key of the Samba administrative account acts as an - encryption key for setting the password of the machine trust - account. The machine trust account will be created on-the-fly, or - updated if it already exists. -

    • Windows NT

      If the machine trust account was created manually, on the - Identification Changes menu enter the domain name, but do not - check the box "Create a Computer Account in the Domain." In this case, - the existing machine trust account is used to join the machine to - the domain.

      If the machine trust account is to be created - on-the-fly, on the Identification Changes menu enter the domain - name, and check the box "Create a Computer Account in the Domain." In - this case, joining the domain proceeds as above for Windows 2000 - (i.e., you must supply a Samba administrative account when - prompted).

    • Samba

      Joining a samba client to a domain is documented in - the Domain Member chapter. -

    Common Problems and Errors

    I cannot include a '$' in a machine name

    -A 'machine name' in (typically) /etc/passwd -of the machine name with a '$' appended. FreeBSD (and other BSD -systems?) won't create a user with a '$' in their name. -

    -The problem is only in the program used to make the entry. Once made, it works perfectly. -Create a user without the '$' using vipw to edit the entry, adding -the '$'. Or create the whole entry with vipw if you like, make sure you use a unique User ID! -

    I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.

    -This happens if you try to create a machine trust account from the -machine itself and already have a connection (e.g. mapped drive) -to a share (or IPC$) on the Samba PDC. The following command -will remove all network drive connections: -

    -C:\WINNT\> net use * /d -

    -Further, if the machine is already a 'member of a workgroup' that -is the same name as the domain you are joining (bad idea) you will -get this message. Change the workgroup name to something else, it -does not matter what, reboot, and try again. -

    The system can not log you on (C000019B)....

    I joined the domain successfully but after upgrading -to a newer version of the Samba code I get the message, "The system -can not log you on (C000019B), Please try again or consult your -system administrator" when attempting to logon. -

    -This occurs when the domain SID stored in the secrets.tdb database -is changed. The most common cause of a change in domain SID is when -the domain name and/or the server name (netbios name) is changed. -The only way to correct the problem is to restore the original domain -SID or remove the domain client from the domain and rejoin. The domain -SID may be reset using either the net or rpcclient utilities. -

    -The reset or change the domain SID you can use the net command as follows: - -

    -	net getlocalsid 'OLDNAME'
-	net setlocalsid 'SID'
-

    -

    The machine trust account for this computer either does not -exist or is not accessible.

    -When I try to join the domain I get the message "The machine account -for this computer either does not exist or is not accessible". What's -wrong? -

    -This problem is caused by the PDC not having a suitable machine trust account. -If you are using the add user script method to create -accounts then this would indicate that it has not worked. Ensure the domain -admin user system is working. -

    -Alternatively if you are creating account entries manually then they -have not been created correctly. Make sure that you have the entry -correct for the machine trust account in smbpasswd file on the Samba PDC. -If you added the account using an editor rather than using the smbpasswd -utility, make sure that the account name is the machine NetBIOS name -with a '$' appended to it ( i.e. computer_name$ ). There must be an entry -in both /etc/passwd and the smbpasswd file. Some people have reported -that inconsistent subnet masks between the Samba server and the NT -client have caused this problem. Make sure that these are consistent -for both client and server. -

    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.

    -At first be ensure to enable the useraccounts with smbpasswd -e -%user%, this is normally done, when you create an account. -

    Domain Control for Windows 9x/ME

    -A domain and a workgroup are exactly the same thing in terms of network -browsing. The difference is that a distributable authentication -database is associated with a domain, for secure login access to a -network. Also, different access rights can be granted to users if they -successfully authenticate against a domain logon server. Samba-3 does this -now in the same way that MS Windows NT/2K. -

    -The SMB client logging on to a domain has an expectation that every other -server in the domain should accept the same authentication information. -Network browsing functionality of domains and workgroups is identical and -is explained in this documentation under the browsing discussions. -It should be noted, that browsing is totally orthogonal to logon support. -

    -Issues related to the single-logon network model are discussed in this -section. Samba supports domain logons, network logon scripts, and user -profiles for MS Windows for workgroups and MS Windows 9X/ME clients -which are the focus of this section. -

    -When an SMB client in a domain wishes to logon it broadcast requests for a -logon server. The first one to reply gets the job, and validates its -password using whatever mechanism the Samba administrator has installed. -It is possible (but very stupid) to create a domain where the user -database is not shared between servers, i.e. they are effectively workgroup -servers advertising themselves as participating in a domain. This -demonstrates how authentication is quite different from but closely -involved with domains. +When an SMB client in a domain wishes to logon, it broadcasts requests for a +logon server. The first one to reply gets the job, and validates its +password using whatever mechanism the Samba administrator has installed. +It is possible (but very stupid) to create a domain where the user +database is not shared between servers, i.e. they are effectively workgroup +servers advertising themselves as participating in a domain. This +demonstrates how authentication is quite different from but closely +involved with domains.

    Using these features you can make your clients verify their logon via the Samba server; make clients run a batch file when they logon to the network and download their preferences, desktop and start menu. -

    +

    +MS Windows XP Home edition is NOT able to join a domain and does not permit +the use of domain logons. +

    Before launching into the configuration instructions, it is worthwhile to look at how a Windows 9x/ME client performs a logon:

    1. The client broadcasts (to the IP broadcast address of the subnet it is in) - a NetLogon request. This is sent to the NetBIOS name DOMAIN<1c> at the + a NetLogon request. This is sent to the NetBIOS name DOMAIN<#1c> at the NetBIOS layer. The client chooses the first response it receives, which contains the NetBIOS name of the logon server to use in the format of - \\SERVER. + \\SERVER.

    2. The client then connects to that server, logs on (does an SMBsessetupX) and then connects to the IPC$ share (using an SMBtconX). @@ -1071,383 +1173,1150 @@ worthwhile to look at how a Windows 9x/ME client performs a logon: The client then does a NetWkstaUserLogon request, which retrieves the name of the user's logon script.

    3. - The client then connects to the NetLogon share and searches for this + The client then connects to the NetLogon share and searches for said script and if it is found and can be read, is retrieved and executed by the client. After this, the client disconnects from the NetLogon share.

    4. The client then sends a NetUserGetInfo request to the server, to retrieve the user's home share, which is used to search for profiles. Since the - response to the NetUserGetInfo request does not contain much more then + response to the NetUserGetInfo request does not contain much more than the user's home share, profiles for Win9X clients MUST reside in the user home directory.

    5. The client then connects to the user's home share and searches for the user's profile. As it turns out, you can specify the user's home share as - a sharename and path. For example, \\server\fred\.profile. + a sharename and path. For example, \\server\fred\.winprofile. If the profiles are found, they are implemented.

    6. The client then disconnects from the user's home share, and reconnects to - the NetLogon share and looks for CONFIG.POL, the policies file. If this is + the NetLogon share and looks for CONFIG.POL, the policies file. If this is found, it is read and implemented. -

    Configuration Instructions: Network Logons

    -The main difference between a PDC and a Windows 9x logon -server configuration is that +

    +The main difference between a PDC and a Windows 9x logon server configuration is that

    • -Password encryption is not required for a Windows 9x logon server. -

    • -Windows 9x/ME clients do not possess machine trust accounts. -

    -Therefore, a Samba PDC will also act as a Windows 9x logon -server. -

    security mode and master browsers

    + Password encryption is not required for a Windows 9x logon server. But note + that beginning with MS Windows 98 the default setting is that plain-text + password support has been disabled. It can be re-enabled with the registry + changes that are documented in the chapter on Policies. +

  • + Windows 9x/ME clients do not require and do not use machine trust accounts. +

    • +A Samba PDC will act as a Windows 9x logon server; after all, it does provide the +network logon services that MS Windows 9x / Me expect to find. +

    Security Mode and Master Browsers

    There are a few comments to make in order to tie up some loose ends. There has been much debate over the issue of whether or not it is ok to configure Samba as a Domain Controller in security -modes other than USER. The only security mode -which will not work due to technical reasons is SHARE -mode security. DOMAIN and SERVER -mode security is really just a variation on SMB user level security. +modes other than USER. The only security mode +which will not work due to technical reasons is SHARE +mode security. DOMAIN and SERVER +mode security are really just a variation on SMB user level security.

    Actually, this issue is also closely tied to the debate on whether or not Samba must be the domain master browser for its workgroup when operating as a DC. While it may technically be possible to configure a server as such (after all, browsing and domain logons are two distinctly different functions), it is not a good idea to do -so. You should remember that the DC must register the DOMAIN#1b NetBIOS +so. You should remember that the DC must register the DOMAIN<#1b> NetBIOS name. This is the name used by Windows clients to locate the DC. Windows clients do not distinguish between the DC and the DMB. For this reason, it is very wise to configure the Samba DC as the DMB.

    Now back to the issue of configuring a Samba DC to use a mode other -than "security = user". If a Samba host is configured to use +than security = user. If a Samba host is configured to use another SMB server or DC in order to validate user connection requests, then it is a fact that some other machine on the network -(the "password server") knows more about the user than the Samba host. +(the password server) knows more about the user than the Samba host. 99% of the time, this other host is a domain controller. Now -in order to operate in domain mode security, the "workgroup" parameter +in order to operate in domain mode security, the workgroup parameter must be set to the name of the Windows NT domain (which already -has a domain controller, right?) -

    -Therefore configuring a Samba box as a DC for a domain that -already by definition has a PDC is asking for trouble. -Therefore, you should always configure the Samba DC to be the DMB -for its domain. -

    Chapter 6.  -Samba Backup Domain Controller to Samba Domain Control -

    Volker Lendecke

    Samba Team

    <Volker.Lendecke@SerNet.DE>

    (26 Apr 2001)

    Table of Contents

    Prerequisite Reading
    Background
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    When is the PDC needed?
    Can Samba be a Backup Domain Controller to an NT PDC?
    How do I set up a Samba BDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?

    Prerequisite Reading

    -Before you continue reading in this chapter, please make sure -that you are comfortable with configuring a Samba PDC -as described in the Samba-PDC-HOWTO. -

    Background

    -What is a Domain Controller? It is a machine that is able to answer -logon requests from workstations in a Windows NT Domain. Whenever a -user logs into a Windows NT Workstation, the workstation connects to a -Domain Controller and asks him whether the username and password the -user typed in is correct. The Domain Controller replies with a lot of -information about the user, for example the place where the users -profile is stored, the users full name of the user. All this -information is stored in the NT user database, the so-called SAM. -

    -There are two kinds of Domain Controller in a NT 4 compatible Domain: -A Primary Domain Controller (PDC) and one or more Backup Domain -Controllers (BDC). The PDC contains the master copy of the -SAM. Whenever the SAM has to change, for example when a user changes -his password, this change has to be done on the PDC. A Backup Domain -Controller is a machine that maintains a read-only copy of the -SAM. This way it is able to reply to logon requests and authenticate -users in case the PDC is not available. During this time no changes to -the SAM are possible. Whenever changes to the SAM are done on the PDC, -all BDC receive the changes from the PDC. -

    -Since version 2.2 Samba officially supports domain logons for all -current Windows Clients, including Windows 2000 and XP. This text -assumes the domain to be named SAMBA. To be able to act as a PDC, some -parameters in the [global]-section of the smb.conf have to be set: +has a domain controller). If the domain does NOT already have a Domain Controller +then you do not yet have a Domain! +

    +Configuring a Samba box as a DC for a domain that already by definition has a +PDC is asking for trouble. Therefore, you should always configure the Samba DC +to be the DMB for its domain and set security = user. +This is the only officially supported mode of operation. +

    Common Problems and Errors

    I cannot include a '$' in a machine name

    +A 'machine account', (typically) stored in /etc/passwd, +takes the form of the machine name with a '$' appended. FreeBSD (and other BSD +systems?) won't create a user with a '$' in their name. +

    +The problem is only in the program used to make the entry. Once made, it works perfectly. +Create a user without the '$'. Then use vipw to edit the entry, adding +the '$'. Or create the whole entry with vipw if you like; make sure you use a unique User ID! +

    I get told "You already have a connection to the Domain...." +or "Cannot join domain, the credentials supplied conflict with an +existing set.." when creating a machine trust account.

    +This happens if you try to create a machine trust account from the +machine itself and already have a connection (e.g. mapped drive) +to a share (or IPC$) on the Samba PDC. The following command +will remove all network drive connections: +

    +	C:\WINNT\> net use * /d
+

    +Further, if the machine is already a 'member of a workgroup' that +is the same name as the domain you are joining (bad idea) you will +get this message. Change the workgroup name to something else, it +does not matter what, reboot, and try again. +

    The system can not log you on (C000019B)....

    I joined the domain successfully but after upgrading +to a newer version of the Samba code I get the message, The system +can not log you on (C000019B), Please try again or consult your +system administrator when attempting to logon. +

    +This occurs when the domain SID stored in the secrets.tdb database +is changed. The most common cause of a change in domain SID is when +the domain name and/or the server name (NetBIOS name) is changed. +The only way to correct the problem is to restore the original domain +SID or remove the domain client from the domain and rejoin. The domain +SID may be reset using either the net or rpcclient utilities. +

    +The reset or change the domain SID you can use the net command as follows: + +

    +root# net getlocalsid 'OLDNAME'
+root# net setlocalsid 'SID'
+

    +

    The machine trust account for this computer either does not +exist or is not accessible.

    +When I try to join the domain I get the message The machine account +for this computer either does not exist or is not accessible. What's +wrong? +

    +This problem is caused by the PDC not having a suitable machine trust account. +If you are using the add machine script method to create +accounts then this would indicate that it has not worked. Ensure the domain +admin user system is working. +

    +Alternatively if you are creating account entries manually then they +have not been created correctly. Make sure that you have the entry +correct for the machine trust account in smbpasswd file on the Samba PDC. +If you added the account using an editor rather than using the smbpasswd +utility, make sure that the account name is the machine NetBIOS name +with a '$' appended to it ( i.e. computer_name$ ). There must be an entry +in both /etc/passwd and the smbpasswd file. +

    +Some people have also reported +that inconsistent subnet masks between the Samba server and the NT +client can cause this problem. Make sure that these are consistent +for both client and server. +

    When I attempt to login to a Samba Domain from a NT4/W2K workstation, +I get a message about my account being disabled.

    +Enable the user accounts with smbpasswd -e username +, this is normally done as an account is created. +

    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

    + A domain controller has to announce on the network who it is. This usually takes a while. +

    Chapter 6. Backup Domain Control

    John H. Terpstra

    Samba Team

    Volker Lendecke

    Samba Team

    Table of Contents

    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?

    +Before you continue reading in this section, please make sure that you are comfortable +with configuring a Samba Domain Controller as described in the +Domain Control chapter. +

    Features And Benefits

    +This is one of the most difficult chapters to summarise. It does not matter what we say here +for someone will still draw conclusions and / or approach the Samba-Team with expectations +that are either not yet capable of being delivered, or that can be achieved far more +effectively using a totally different approach. Since this HOWTO is already so large and +extensive, we have taken the decision to provide sufficient (but not comprehensive) +information regarding Backup Domain Control. In the event that you should have a persistent +concern that is not addressed in this HOWTO document then please email +John H Terpstra clearly setting out your requirements +and / or question and we will do our best to provide a solution. +

    +Samba-3 is capable of acting as a Backup Domain Controller to another Samba Primary Domain +Controller. A Samba-3 PDC can operate with an LDAP Account backend. The Samba-3 BDC can +operate with a slave LDAP server for the Account backend. This effectively gives samba a high +degree of scalability. This is a very sweet (nice) solution for large organisations. +

    +While it is possible to run a Samba-3 BDC with non-LDAP backend, the administrator will +need to figure out precisely what is the best way to replicate (copy / distribute) the +user and machine Accounts backend. +

    +The use of a non-LDAP backend SAM database is particularly problematic because Domain member +servers and workstations periodically change the machine trust account password. The new +password is then stored only locally. This means that in the absence of a centrally stored +accounts database (such as that provided with an LDAP based solution) if Samba-3 is running +as a BDC, the BDC instance of the Domain member trust account password will not reach the +PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs this results in +overwriting of the SAM that contains the updated (changed) trust account password with resulting +breakage of the domain trust. +

    +Considering the number of comments and questions raised concerning how to configure a BDC +lets consider each possible option and look at the pro's and con's for each theoretical solution: +

    Backup Domain Backend Account Distribution Options

    • + Solution: Passwd Backend is LDAP based, BDCs use a slave LDAP server +

      + Arguments For: This is a neat and manageable solution. The LDAP based SAM (ldapsam) + is constantly kept up to date. +

      + Arguments Against: Complexity +

    • + Passdb Backend is tdbsam based, BDCs use cron based "net rpc vampire" to + suck down the Accounts database from the PDC +

      + Arguments For: It would be a nice solution +

      + Arguments Against: It does not work because Samba-3 does not support the required + protocols. This may become a later feature but is not available today. +

    • + Make use of rsync to replicate (pull down) copies of the essential account files +

      + Arguments For: It is a simple solution, easy to set up as a scheduled job +

      + Arguments Against: This will over-write the locally changed machine trust account + passwords. This is a broken and flawed solution. Do NOT do this. +

    • + Operate with an entirely local accounts database (not recommended) +

      + Arguments For: Simple, easy to maintain +

      + Arguments Against: All machine trust accounts and user accounts will be locally + maintained. Domain users will NOT be able to roam from office to office. This is + a broken and flawed solution. Do NOT do this. +

    Essential Background Information

    +A Domain Controller is a machine that is able to answer logon requests from network +workstations. Microsoft LanManager and IBM LanServer were two early products that +provided this capability. The technology has become known as the LanMan Netlogon service. +

    +When MS Windows NT3.10 was first released, it supported an new style of Domain Control +and with it a new form of the network logon service that has extended functionality. +This service became known as the NT NetLogon Service. The nature of this service has +changed with the evolution of MS Windows NT and today provides a very complex array of +services that are implemented over a complex spectrum of technologies. +

    MS Windows NT4 Style Domain Control

    +Whenever a user logs into a Windows NT4 / 200x / XP Professional Workstation, +the workstation connects to a Domain Controller (authentication server) to validate +the username and password that the user entered are valid. If the information entered +does not validate against the account information that has been stored in the Domain +Control database (the SAM, or Security Account Manager database) then a set of error +codes is returned to the workstation that has made the authentication request. +

    +When the username / password pair has been validated, the Domain Controller +(authentication server) will respond with full enumeration of the account information +that has been stored regarding that user in the User and Machine Accounts database +for that Domain. This information contains a complete network access profile for +the user but excludes any information that is particular to the user's desktop profile, +or for that matter it excludes all desktop profiles for groups that the user may +belong to. It does include password time limits, password uniqueness controls, +network access time limits, account validity information, machine names from which the +user may access the network, and much more. All this information was stored in the SAM +in all versions of MS Windows NT (3.10, 3.50, 3.51, 4.0). +

    +The account information (user and machine) on Domain Controllers is stored in two files, +one containing the Security information and the other the SAM. These are stored in files +by the same name in the C:\WinNT\System32\config directory. These +are the files that are involved in replication of the SAM database where Backup Domain +Controllers are present on the network. +

    +There are two situations in which it is desirable to install Backup Domain Controllers: +

    • + On the local network that the Primary Domain Controller is on, if there are many + workstations and/or where the PDC is generally very busy. In this case the BDCs + will pick up network logon requests and help to add robustness to network services. +

    • + At each remote site, to reduce wide area network traffic and to add stability to + remote network operations. The design of the network, the strategic placement of + Backup Domain Controllers, together with an implementation that localises as much + of network to client interchange as possible will help to minimise wide area network + bandwidth needs (and thus costs). +

    +The PDC contains the master copy of the SAM. In the event that an administrator makes a +change to the user account database while physically present on the local network that +has the PDC, the change will likely be made directly to the PDC instance of the master +copy of the SAM. In the event that this update may be performed in a branch office the +change will likely be stored in a delta file on the local BDC. The BDC will then send +a trigger to the PDC to commence the process of SAM synchronisation. The PDC will then +request the delta from the BDC and apply it to the master SAM. The PDC will then contact +all the BDCs in the Domain and trigger them to obtain the update and then apply that to +their own copy of the SAM. +

    +Thus the BDC is said to hold a read-only of the SAM from which +it is able to process network logon requests and to authenticate users. The BDC can +continue to provide this service, particularly while, for example, the wide area +network link to the PDC is down. Thus a BDC plays a very important role in both +maintenance of Domain security as well as in network integrity. +

    +In the event that the PDC should need to be taken out of service, or if it dies, then +one of the BDCs can be promoted to a PDC. If this happens while the original PDC is on +line then it is automatically demoted to a BDC. This is an important aspect of Domain +Controller management. The tool that is used to affect a promotion or a demotion is the +Server Manager for Domains. +

    Example PDC Configuration

    +Since version 2.2 Samba officially supports domain logons for all current Windows Clients, +including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some +parameters in the [global]-section of the smb.conf have to be set: 

     	workgroup = SAMBA
 	domain master = yes
 	domain logons = yes

    -Several other things like a [homes] and a [netlogon] share also may be -set along with settings for the profile path, the users home drive and -others. This will not be covered in this document. -

    What qualifies a Domain Controller on the network?

    -Every machine that is a Domain Controller for the domain SAMBA has to -register the NetBIOS group name SAMBA#1c with the WINS server and/or -by broadcast on the local network. The PDC also registers the unique -NetBIOS name SAMBA#1b with the WINS server. The name type #1b is -normally reserved for the domain master browser, a role that has -nothing to do with anything related to authentication, but the -Microsoft Domain implementation requires the domain master browser to -be on the same machine as the PDC. -

    How does a Workstation find its domain controller?

    -A NT workstation in the domain SAMBA that wants a local user to be -authenticated has to find the domain controller for SAMBA. It does -this by doing a NetBIOS name query for the group name SAMBA#1c. It -assumes that each of the machines it gets back from the queries is a -domain controller and can answer logon requests. To not open security -holes both the workstation and the selected (TODO: How is the DC -chosen) domain controller authenticate each other. After that the -workstation sends the user's credentials (his name and password) to -the domain controller, asking for approval. -

    When is the PDC needed?

    -Whenever a user wants to change his password, this has to be done on -the PDC. To find the PDC, the workstation does a NetBIOS name query -for SAMBA#1b, assuming this machine maintains the master copy of the -SAM. The workstation contacts the PDC, both mutually authenticate and -the password change is done. -

    Can Samba be a Backup Domain Controller to an NT PDC?

    -With version 2.2, no. The native NT SAM replication protocols have -not yet been fully implemented. The Samba Team is working on -understanding and implementing the protocols, but this work has not -been finished for version 2.2. -

    -With version 3.0, the work on both the replication protocols and a -suitable storage mechanism has progressed, and some form of NT4 BDC -support is expected soon. -

    -Can I get the benefits of a BDC with Samba? Yes. The main reason for -implementing a BDC is availability. If the PDC is a Samba machine, -a second Samba machine can be set up to -service logon requests whenever the PDC is down. -

    How do I set up a Samba BDC?

    +Several other things like a [homes] and a [netlogon] share also need to be set along with +settings for the profile path, the users home drive, etc.. This will not be covered in this +chapter, for more information please refer to the chapter on Domain Control. +

    Active Directory Domain Control

    +As of the release of MS Windows 2000 and Active Directory, this information is now stored +in a directory that can be replicated and for which partial or full administrative control +can be delegated. Samba-3 is NOT able to be a Domain Controller within an Active Directory +tree, and it can not be an Active Directory server. This means that Samba-3 also can NOT +act as a Backup Domain Controller to an Active Directory Domain Controller. +

    What qualifies a Domain Controller on the network?

    +Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS +group name SAMBA<#1c> with the WINS server and/or by broadcast on the local network. +The PDC also registers the unique NetBIOS name SAMBA<#1b> with the WINS server. +The name type <#1b> name is normally reserved for the Domain Master Browser, a role +that has nothing to do with anything related to authentication, but the Microsoft Domain +implementation requires the domain master browser to be on the same machine as the PDC. +

    How does a Workstation find its domain controller?

    +An MS Windows NT4 / 200x / XP Professional workstation in the domain SAMBA that wants a +local user to be authenticated has to find the domain controller for SAMBA. It does this +by doing a NetBIOS name query for the group name SAMBA<#1c>. It assumes that each +of the machines it gets back from the queries is a domain controller and can answer logon +requests. To not open security holes both the workstation and the selected domain controller +authenticate each other. After that the workstation sends the user's credentials (name and +password) to the local Domain Controller, for validation. +

    Backup Domain Controller Configuration

    Several things have to be done:

    • -The domain SID has to be the same on the PDC and the BDC. This used to -be stored in the file private/MACHINE.SID. This file is not created -anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is -stored in the file private/secrets.tdb. Simply copying the secrets.tdb -from the PDC to the BDC does not work, as the BDC would -generate a new SID for itself and override the domain SID with this -new BDC SID.

      -To retrieve the domain SID from the PDC or an existing BDC and store it in the -secrets.tdb, execute 'net rpc getsid' on the BDC. -

    • -The Unix user database has to be synchronized from the PDC to the -BDC. This means that both the /etc/passwd and /etc/group have to be -replicated from the PDC to the BDC. This can be done manually -whenever changes are made, or the PDC is set up as a NIS master -server and the BDC as a NIS slave server. To set up the BDC as a -mere NIS client would not be enough, as the BDC would not be able to -access its user database in case of a PDC failure. -

    • -The Samba password database in the file private/smbpasswd has to be -replicated from the PDC to the BDC. This is a bit tricky, see the -next section. -

    • -Any netlogon share has to be replicated from the PDC to the -BDC. This can be done manually whenever login scripts are changed, -or it can be done automatically together with the smbpasswd -synchronization. -

    -Finally, the BDC has to be found by the workstations. This can be done -by setting + The domain SID has to be the same on the PDC and the BDC. This used to + be stored in the file private/MACHINE.SID. This file is not created + anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is + stored in the file private/secrets.tdb. Simply copying the secrets.tdb + from the PDC to the BDC does not work, as the BDC would + generate a new SID for itself and override the domain SID with this + new BDC SID.

    + To retrieve the domain SID from the PDC or an existing BDC and store it in the + secrets.tdb, execute: + 

    +	root# net rpc getsid
+

  • + The Unix user database has to be synchronized from the PDC to the + BDC. This means that both the /etc/passwd and /etc/group have to be + replicated from the PDC to the BDC. This can be done manually + whenever changes are made, or the PDC is set up as a NIS master + server and the BDC as a NIS slave server. To set up the BDC as a + mere NIS client would not be enough, as the BDC would not be able to + access its user database in case of a PDC failure. NIS is by no means + the only method to synchronize passwords. An LDAP solution would work + as well. +

  • + The Samba password database has to be replicated from the PDC to the BDC. + As said above, though possible to synchronise the smbpasswd + file with rsync and ssh, this method is broken and flawed, and is + therefore not recommended. A better solution is to set up slave LDAP + servers for each BDC and a master LDAP server for the PDC. +

  • + Any netlogon share has to be replicated from the PDC to the + BDC. This can be done manually whenever login scripts are changed, + or it can be done automatically together with the smbpasswd + synchronization. +

    • Example Configuration

    +Finally, the BDC has to be found by the workstations. This can be done by setting: 

    -	workgroup = samba
+	workgroup = SAMBA
 	domain master = no
 	domain logons = yes

    -in the [global]-section of the smb.conf of the BDC. This makes the BDC -only register the name SAMBA#1c with the WINS server. This is no -problem as the name SAMBA#1c is a NetBIOS group name that is meant to +in the [global]-section of the smb.conf of the BDC. This makes the BDC +only register the name SAMBA<#1c> with the WINS server. This is no +problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to be registered by more than one machine. The parameter 'domain master = -no' forces the BDC not to register SAMBA#1b which as a unique NetBIOS +no' forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS name is reserved for the Primary Domain Controller. -

    How do I replicate the smbpasswd file?

    -Replication of the smbpasswd file is sensitive. It has to be done -whenever changes to the SAM are made. Every user's password change is -done in the smbpasswd file and has to be replicated to the BDC. So -replicating the smbpasswd file very often is necessary. -

    -As the smbpasswd file contains plain text password equivalents, it -must not be sent unencrypted over the wire. The best way to set up -smbpasswd replication from the PDC to the BDC is to use the utility -rsync. rsync can use ssh as a transport. ssh itself can be set up to -accept *only* rsync transfer without requiring the user to type a -password. -

    Can I do this all with LDAP?

    The simple answer is YES. Samba's pdb_ldap code supports -binding to a replica LDAP server, and will also follow referrals and -rebind to the master if it ever needs to make a modification to the -database. (Normally BDCs are read only, so this will not occur -often). -

    Chapter 7. Samba as a ADS domain member

    Andrew Tridgell

    Samba Team

    <tridge@samba.org>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    2002/2003

    Table of Contents

    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Possible errors
    Test your server setup
    Testing with smbclient
    Notes

    -This is a rough guide to setting up Samba 3.0 with kerberos authentication against a -Windows2000 KDC. -

    Setup your smb.conf

    You must use at least the following 3 options in smb.conf:

    -	realm = YOUR.KERBEROS.REALM
+

    Common Errors

    +As this is a rather new area for Samba there are not many examples that we may refer to. Keep +watching for updates to this section. +

    Machine Accounts keep expiring, what can I do?

    +This problem will occur when occur when the passdb (SAM) files are copied from a central +server but the local Backup Domain Controllers. Local machine trust account password updates +are not copied back to the central server. The newer machine account password is then over +written when the SAM is copied from the PDC. The result is that the Domain member machine +on start up will find that it's passwords does not match the one now in the database and +since the startup security check will now fail, this machine will not allow logon attempts +to proceed and the account expiry error will be reported. +

    +The solution: use a more robust passdb backend, such as the ldapsam backend, setting up +an slave LDAP server for each BDC, and a master LDAP server for the PDC. +

    Can Samba be a Backup Domain Controller to an NT4 PDC?

    +With version 2.2, no. The native NT4 SAM replication protocols have not yet been fully +implemented. The Samba Team is working on understanding and implementing the protocols, +but this work has not been finished for version 2.2. +

    +With version 3.0, the work on both the replication protocols and a suitable storage +mechanism has progressed, and some form of NT4 BDC support is expected soon. +

    +Can I get the benefits of a BDC with Samba? Yes. The main reason for implementing a +BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to +service logon requests whenever the PDC is down. +

    How do I replicate the smbpasswd file?

    +Replication of the smbpasswd file is sensitive. It has to be done whenever changes +to the SAM are made. Every user's password change is done in the smbpasswd file and +has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary. +

    +As the smbpasswd file contains plain text password equivalents, it must not be +sent unencrypted over the wire. The best way to set up smbpasswd replication from +the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport. +Ssh itself can be set up to accept only rsync transfer without requiring the user +to type a password. +

    +As said a few times before, use of this method is broken and flawed. Machine trust +accounts will go out of sync, resulting in a very broken domain. This method is +not recommended. Try using LDAP instead. +

    Can I do this all with LDAP?

    +The simple answer is YES. Samba's pdb_ldap code supports binding to a replica +LDAP server, and will also follow referrals and rebind to the master if it ever +needs to make a modification to the database. (Normally BDCs are read only, so +this will not occur often). +

    Chapter 7. Domain Membership

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails

    +Domain Membership is a subject of vital concern, Samba must be able to +participate as a member server in a Microsoft Domain security context, and +Samba must be capable of providing Domain machine member trust accounts, +otherwise it would not be capable of offering a viable option for many users. +

    +This chapter covers background information pertaining to domain membership, +Samba configuration for it, and MS Windows client procedures for joining a +domain. Why is this necessary? Because both are areas in which there exists +within the current MS Windows networking world and particularly in the +Unix/Linux networking and administration world, a considerable level of +mis-information, incorrect understanding, and a lack of knowledge. Hopefully +this chapter will fill the voids. +

    Features and Benefits

    +MS Windows workstations and servers that want to participate in domain +security need to +be made Domain members. Participating in Domain security is often called +Single Sign On or SSO for short. This +chapter describes the process that must be followed to make a workstation +(or another server - be it an MS Windows NT4 / 200x +server) or a Samba server a member of an MS Windows Domain security context. +

    +Samba-3 can join an MS Windows NT4 style domain as a native member server, an +MS Windows Active Directory Domain as a native member server, or a Samba Domain +Control network. +

    +Domain membership has many advantages: +

    • + MS Windows workstation users get the benefit of SSO +

    • + Domain user access rights and file ownership / access controls can be set + from the single Domain SAM (Security Account Manager) database + (works with Domain member servers as well as with MS Windows workstations + that are domain members) +

    • + Only MS Windows NT4 / 200x / XP Professional + workstations that are Domain members + can use network logon facilities +

    • + Domain Member workstations can be better controlled through the use of + Policy files (NTConfig.POL) and Desktop Profiles. +

    • + Through the use of logon scripts, users can be given transparent access to network + applications that run off application servers +

    • + Network administrators gain better application and user access management + abilities because there is no need to maintain user accounts on any network + client or server, other than the central Domain database + (either NT4/Samba SAM style Domain, NT4 Domain that is back ended with an + LDAP directory, or via an Active Directory infrastructure) +

    MS Windows Workstation/Server Machine Trust Accounts

    +A machine trust account is an account that is used to authenticate a client +machine +(rather than a user) to the Domain Controller server. In Windows terminology, +this is known as a "Computer Account." +

    +The password of a machine trust account acts as the shared secret for +secure communication with the Domain Controller. This is a security +feature to prevent an unauthorized machine with the same NetBIOS name +from joining the domain and gaining access to domain user/group +accounts. Windows NT, 200x, XP Professional clients use machine trust +accounts, but Windows 9x / Me / XP Home clients do not. Hence, a +Windows 9x / Me / XP Home client is never a true member of a domain +because it does not possess a machine trust account, and thus has no +shared secret with the domain controller. +

    +A Windows NT4 PDC stores each machine trust account in the Windows Registry. +The introduction of MS Windows 2000 saw the introduction of Active Directory, +the new repository for machine trust accounts. +

    +A Samba PDC, however, stores each machine trust account in two parts, +as follows: + +

    • + A Domain Security Account (stored in the + passdb backend that has been configured in the + smb.conf file. The precise nature of the account information that is + stored depends on the type of backend database that has been chosen. +

      + The older format of this data is the smbpasswd database + which contains the unix login ID, the Unix user identifier (UID), and the + LanMan and NT encrypted passwords. There is also some other information in + this file that we do not need to concern ourselves with here. +

      + The two newer database types are called ldapsam, + tdbsam. Both store considerably more data than the + older smbpasswd file did. The extra information + enables new user account controls to be used. +

    • + A corresponding Unix account, typically stored in + /etc/passwd. Work is in progress to allow a + simplified mode of operation that does not require Unix user accounts, but + this may not be a feature of the early releases of Samba-3. +

    +

    +There are three ways to create machine trust accounts: +

    • + Manual creation from the Unix/Linux command line. Here, both the Samba and + corresponding Unix account are created by hand. +

    • + Using the MS Windows NT4 Server Manager (either from an NT4 Domain member + server, or using the Nexus toolkit available from the Microsoft web site. + This tool can be run from any MS Windows machine so long as the user is + logged on as the administrator account. +

    • + "On-the-fly" creation. The Samba machine trust account is automatically + created by Samba at the time the client is joined to the domain. + (For security, this is the recommended method.) The corresponding Unix + account may be created automatically or manually. +

    Manual Creation of Machine Trust Accounts

    +The first step in manually creating a machine trust account is to manually +create the corresponding Unix account in /etc/passwd. +This can be done using vipw or another 'add user' command +that is normally used to create new Unix accounts. The following is an example for a Linux based Samba server: +

    +root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" -s /bin/false machine_name$ +

    +root# passwd -l machine_name$ +

    +On *BSD systems, this can be done using the chpass utility: +

    +root# chpass -a "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin" +

    +The /etc/passwd entry will list the machine name +with a "$" appended, won't have a password, will have a null shell and no +home directory. For example a machine named 'doppy' would have an +/etc/passwd entry like this: +

    +doppy$:x:505:501:machine_nickname:/dev/null:/bin/false
+

    +Above, machine_nickname can be any +descriptive name for the client, i.e., BasementComputer. +machine_name absolutely must be the NetBIOS +name of the client to be joined to the domain. The "$" must be +appended to the NetBIOS name of the client or Samba will not recognize +this as a machine trust account. +

    +Now that the corresponding Unix account has been created, the next step is to create +the Samba account for the client containing the well-known initial +machine trust account password. This can be done using the smbpasswd(8) command +as shown here: +

    +

    +root# smbpasswd -a -m machine_name
+

    +

    +where machine_name is the machine's NetBIOS +name. The RID of the new machine account is generated from the UID of +the corresponding Unix account. +

    Join the client to the domain immediately

    + Manually creating a machine trust account using this method is the + equivalent of creating a machine trust account on a Windows NT PDC using + the Server Manager. From the time at which the + account is created to the time which the client joins the domain and + changes the password, your domain is vulnerable to an intruder joining + your domain using a machine with the same NetBIOS name. A PDC inherently + trusts members of the domain and will serve out a large degree of user + information to such clients. You have been warned! +

    Using NT4 Server Manager to Add Machine Accounts to the Domain

    +If the machine from which you are trying to manage the domain is an +MS Windows NT4 workstation +then the tool of choice is the package called SRVTOOLS.EXE. +When executed in the target directory this will unpack +SrvMge.exe and UsrMgr.exe (both are +Domain Management tools for MS Windows NT4 workstation. +

    +If your workstation is any other MS Windows product you should download the +Nexus.exe package from the Microsoft web site. When executed +from the target directory this will unpack the same tools but for use on +MS Windows 9x/Me/200x/XP. +

    +Launch the srvmgr.exe (Server Manager for Domains) and follow these steps: +

    Procedure 7.1. Server Manager Account Machine Account Management

    1. + From the menu select Computer +

    2. + Click on Select Domain +

    3. + Click on the name of the domain you wish to administer in the + Select Domain panel and then click + OK. +

    4. + Again from the menu select Computer +

    5. + Select Add to Domain +

    6. + In the dialog box, click on the radio button to + Add NT Workstation of Server, then + enter the machine name in the field provided, then click the + Add button. +

    "On-the-Fly" Creation of Machine Trust Accounts

    +The second (and recommended) way of creating machine trust accounts is +simply to allow the Samba server to create them as needed when the client +is joined to the domain. +

    Since each Samba machine trust account requires a corresponding Unix account, a method +for automatically creating the Unix account is usually supplied; this requires configuration of the +add machine script option in +smb.conf. This method is not required, however; corresponding Unix +accounts may also be created manually. +

    +Below is an example for a RedHat Linux system. +

    +[global]
+   # <...remainder of parameters...>
+   add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u 
+

    Making an MS Windows Workstation or Server a Domain Member

    +The procedure for making an MS Windows workstation of server a member of the domain varies +with the version of Windows: +

    Windows 200x XP Professional

    + When the user elects to make the client a domain member, Windows 200x prompts for + an account and password that has privileges to create machine accounts in the domain. + A Samba administrative account (i.e., a Samba account that has root privileges on the + Samba server) must be entered here; the operation will fail if an ordinary user + account is given. +

    + Note: For security reasons the password for this administrative account should be set + to a password that is other than that used for the root user in the + /etc/passwd. +

    + The name of the account that is used to create domain member machine accounts can be + anything the network administrator may choose. If it is other than root + then this is easily mapped to root using the file pointed to be the smb.conf parameter + username map = /etc/samba/smbusers. +

    + The session key of the Samba administrative account acts as an + encryption key for setting the password of the machine trust + account. The machine trust account will be created on-the-fly, or + updated if it already exists. +

    Windows NT4

    + If the machine trust account was created manually, on the + Identification Changes menu enter the domain name, but do not + check the box Create a Computer Account in the Domain. + In this case, the existing machine trust account is used to join the machine + to the domain. +

    + If the machine trust account is to be created + on-the-fly, on the Identification Changes menu enter the domain + name, and check the box Create a Computer Account in the + Domain. In this case, joining the domain proceeds as above + for Windows 2000 (i.e., you must supply a Samba administrative account when + prompted). +

    Samba

    Joining a Samba client to a domain is documented in + the Domain Member Server section of this chapter chapter. +

    Domain Member Server

    +This mode of server operation involves the Samba machine being made a member +of a domain security context. This means by definition that all user +authentication will be done from a centrally defined authentication regime. +The authentication regime may come from an NT3/4 style (old domain technology) +server, or it may be provided from an Active Directory server (ADS) running on +MS Windows 2000 or later. +

    + +Of course it should be clear that the authentication back end itself could be +from any distributed directory architecture server that is supported by Samba. +This can be LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory +Server, etc. + +

    +Please refer to the Domain Control chapter +for more information regarding how to create a domain +machine account for a domain member server as well as for information +regarding how to enable the Samba domain member machine to join the domain and +to be fully trusted by it. +

    Joining an NT4 type Domain with Samba-3

    +

    Table 7.1. Assumptions

    NetBIOS name:SERV1
    Win2K/NT domain name:DOM
    Domain's PDC NetBIOS name:DOMPDC
    Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2

    +

    +First, you must edit your smb.conf file to tell Samba it should +now use domain security. +

    +Change (or add) your +security line in the [global] section +of your smb.conf to read: +

    +

    +security = domain
+

    +

    +Next change the +workgroup line in the [global] +section to read: +

    +

    +workgroup = DOM
+

    +

    +as this is the name of the domain we are joining. +

    +You must also have the parameter +encrypt passwords set to yes + in order for your users to authenticate to the NT PDC. +

    +Finally, add (or modify) a +password server line in the [global] +section to read: +

    +

    +password server = DOMPDC DOMBDC1 DOMBDC2
+

    +

    +These are the primary and backup domain controllers Samba +will attempt to contact in order to authenticate users. Samba will +try to contact each of these servers in order, so you may want to +rearrange this list in order to spread out the authentication load +among domain controllers. +

    +Alternatively, if you want smbd to automatically determine +the list of Domain controllers to use for authentication, you may +set this line to be: +

    +

    +password server = *
+

    +

    +This method allows Samba to use exactly the same mechanism that NT does. This +method either broadcasts or uses a WINS database in order to +find domain controllers to authenticate against. +

    +In order to actually join the domain, you must run this command: +

    +

    +root# net join -S DOMPDC -UAdministrator%password
+

    +

    +If the -S DOMPDC argument is not given then +the domain name will be obtained from smb.conf. +

    +As we are joining the domain DOM and the PDC for that domain +(the only machine that has write access to the domain SAM database) +is DOMPDC, we use it for the -S option. +The Administrator%password is +the login name and password for an account which has the necessary +privilege to add machines to the domain. If this is successful +you will see the message: +

    +Joined domain DOM. +or Joined 'SERV1' to realm 'MYREALM' +

    +in your terminal window. See the +net(8) man page for more details. +

    +This process joins the server to the domain without having to create the machine +trust account on the PDC beforehand. +

    +This command goes through the machine account password +change protocol, then writes the new (random) machine account +password for this Samba server into a file in the same directory +in which an smbpasswd file would be stored - normally: +

    +/usr/local/samba/private/secrets.tdb +

    +This file is created and owned by root and is not +readable by any other user. It is the key to the domain-level +security for your system, and should be treated as carefully +as a shadow password file. +

    +Finally, restart your Samba daemons and get ready for +clients to begin using domain security! +

    Why is this better than security = server?

    +Currently, domain security in Samba doesn't free you from +having to create local Unix users to represent the users attaching +to your server. This means that if domain user DOM\fred + attaches to your domain security Samba server, there needs +to be a local Unix user fred to represent that user in the Unix +filesystem. This is very similar to the older Samba security mode +security = server, +where Samba would pass through the authentication request to a Windows +NT server in the same way as a Windows 95 or Windows 98 server would. +

    +Please refer to the Winbind chapter +for information on a system to automatically +assign UNIX uids and gids to Windows NT Domain users and groups. +

    +The advantage to domain-level security is that the +authentication in domain-level security is passed down the authenticated +RPC channel in exactly the same way that an NT server would do it. This +means Samba servers now participate in domain trust relationships in +exactly the same way NT servers do (i.e., you can add Samba servers into +a resource domain and have the authentication passed on from a resource +domain PDC to an account domain PDC). +

    +In addition, with security = server every Samba +daemon on a server has to keep a connection open to the +authenticating server for as long as that daemon lasts. This can drain +the connection resources on a Microsoft NT server and cause it to run +out of available connections. With security = domain, +however, the Samba daemons connect to the PDC/BDC only for as long +as is necessary to authenticate the user, and then drop the connection, +thus conserving PDC connection resources. +

    +And finally, acting in the same manner as an NT server +authenticating to a PDC means that as part of the authentication +reply, the Samba server gets the user identification information such +as the user SID, the list of NT groups the user belongs to, etc. +

    Note

    +Much of the text of this document +was first published in the Web magazine +LinuxWorld as the article Doing +the NIS/NT Samba. +

    Samba ADS Domain Membership

    +This is a rough guide to setting up Samba 3.0 with Kerberos authentication against a +Windows2000 KDC. A familiarity with Kerberos is assumed. +

    Setup your smb.conf

    +You must use at least the following 3 options in smb.conf: +

    +	realm = your.kerberos.REALM
 	security = ADS
 	encrypt passwords = yes

    In case samba can't figure out your ads server using your realm name, use the -ads server option in smb.conf: +ads server option in smb.conf: 

     	ads server = your.kerberos.server

    -

    Note

    You do *not* need a smbpasswd file, and older clients will - be authenticated as if security = domain, - although it won't do any harm - and allows you to have local users not in the domain. - I expect that the above required options will change soon when we get better - active directory integration.

    Setup your /etc/krb5.conf

    Note: you will need the krb5 workstation, devel, and libs installed

    The minimal configuration for krb5.conf is:

    +
    Note
    
+You do not need a smbpasswd file, and older clients will be authenticated as 
+if security = domain, although it won't do any harm and 
+allows you to have local users not in the domain. It is expected that the above 
+required options will change soon when active directory integration will get 
+better.
+

    Setup your /etc/krb5.conf

    +The minimal configuration for krb5.conf is: +

     	[realms]
 	    YOUR.KERBEROS.REALM = {
 		kdc = your.kerberos.server
 	    }
-

    Test your config by doing a kinit -USERNAME@REALM and +

    +Test your config by doing a kinit +USERNAME@REALM and making sure that your password is accepted by the Win2000 KDC. -

    Note

    The realm must be uppercase or you will get "Cannot find KDC for requested -realm while getting initial credentials" error

    Note

    Time between the two servers must be synchronized. You will get a -"kinit(v5): Clock skew too great while getting initial credentials" if the time -difference is more than five minutes.

    +

    Note

    +The realm must be uppercase or you will get Cannot find KDC for +requested realm while getting initial credentials error. +

    Note

    +Time between the two servers must be synchronized. You will get a +kinit(v5): Clock skew too great while getting initial credentials +if the time difference is more than five minutes. +

    You also must ensure that you can do a reverse DNS lookup on the IP address of your KDC. Also, the name that this reverse lookup maps to -must either be the netbios name of the KDC (ie. the hostname with no -domain attached) or it can alternatively be the netbios name +must either be the NetBIOS name of the KDC (ie. the hostname with no +domain attached) or it can alternatively be the NetBIOS name followed by the realm.

    The easiest way to ensure you get this right is to add a -/etc/hosts entry mapping the IP address of your KDC to -its netbios name. If you don't get this right then you will get a -"local error" when you try to join the realm. +/etc/hosts entry mapping the IP address of your KDC to +its NetBIOS name. If you don't get this right then you will get a +local error when you try to join the realm.

    -If all you want is kerberos support in smbclient then you can skip -straight to Test with smbclient now. +If all you want is Kerberos support in smbclient then you can skip +straight to Test with smbclient now. Creating a computer account and testing your servers -is only needed if you want kerberos support for smbd and winbindd. -

    Create the computer account

    +is only needed if you want Kerberos support for smbd and winbindd. +

    Create the computer account

    As a user that has write permission on the Samba private directory (usually root) run: 

    -	net join -U Administrator%password
-

    -

    Possible errors

    -

    "ADS support not compiled in"

    Samba must be reconfigured (remove config.cache) and recompiled - (make clean all install) after the kerberos libs and headers are installed. -

    net join prompts for user name

    You need to login to the domain using kinit - USERNAME@REALM. - USERNAME must be a user who has rights to add a machine + root# net join -U Administrator%password +

    +

    Possible errors

    +

    ADS support not compiled in

    Samba must be reconfigured (remove config.cache) and recompiled + (make clean all install) after the Kerberos libs and headers are installed. +

    net join prompts for user name

    You need to login to the domain using kinit + USERNAME@REALM. + USERNAME must be a user who has rights to add a machine to the domain.

    -

    Test your server setup

    +

    Test your server setup

    If the join was successful, you will see a new computer account with the NetBIOS name of your Samba server in Active Directory (in the "Computers" folder under Users and Computers.

    -On a Windows 2000 client try net use * \\server\share. You should -be logged in with kerberos without needing to know a password. If -this fails then run klist tickets. Did you get a ticket for the +On a Windows 2000 client try net use * \\server\share. You should +be logged in with Kerberos without needing to know a password. If +this fails then run klist tickets. Did you get a ticket for the server? Does it have an encoding type of DES-CBC-MD5 ? -

    Testing with smbclient

    +

    Testing with smbclient

    On your Samba server try to login to a Win2000 server or your Samba -server using smbclient and kerberos. Use smbclient as usual, but -specify the -k option to choose kerberos authentication. -

    Notes

    You must change administrator password at least once after DC -install, to create the right encoding types

    w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in - their defaults DNS setup. Maybe fixed in service packs?

    Chapter 8. Samba as a NT4 or Win2k domain member

    Jeremy Allison

    Samba Team

    <jra@samba.org>

    Gerald (Jerry) Carter

    Samba Team

    <jerry@samba.org>

    16 Apr 2001

    Table of Contents

    Joining an NT Domain with Samba 3.0
    Why is this better than security = server?

    Joining an NT Domain with Samba 3.0

    Assumptions: - 

    -		NetBIOS name: SERV1
-		Win2K/NT domain name: DOM
-		Domain's PDC NetBIOS name: DOMPDC
-		Domain's BDC NetBIOS names: DOMBDC1 and DOMBDC2
-

    -

    First, you must edit your smb.conf file to tell Samba it should - now use domain security.

    Change (or add) your - security = line in the [global] section - of your smb.conf to read:

    security = domain

    Next change the - workgroup = line in the [global] section to read:

    workgroup = DOM

    as this is the name of the domain we are joining.

    You must also have the parameter - encrypt passwords set to yes - in order for your users to authenticate to the NT PDC.

    Finally, add (or modify) a - password server = line in the [global] - section to read:

    password server = DOMPDC DOMBDC1 DOMBDC2

    These are the primary and backup domain controllers Samba - will attempt to contact in order to authenticate users. Samba will - try to contact each of these servers in order, so you may want to - rearrange this list in order to spread out the authentication load - among domain controllers.

    Alternatively, if you want smbd to automatically determine - the list of Domain controllers to use for authentication, you may - set this line to be :

    password server = *

    This method, allows Samba to use exactly the same - mechanism that NT does. This - method either broadcasts or uses a WINS database in order to - find domain controllers to authenticate against.

    In order to actually join the domain, you must run this - command:

    root# net join -S DOMPDC - -UAdministrator%password

    - If the -S DOMPDC argument is not given then - the domain name will be obtained from smb.conf. -

    as we are joining the domain DOM and the PDC for that domain - (the only machine that has write access to the domain SAM database) - is DOMPDC. The Administrator%password is - the login name and password for an account which has the necessary - privilege to add machines to the domain. If this is successful - you will see the message:

    Joined domain DOM. - or Joined 'SERV1' to realm 'MYREALM' -

    in your terminal window. See the - net(8) man page for more details.

    This process joins the server to the domain - without having to create the machine trust account on the PDC - beforehand.

    This command goes through the machine account password - change protocol, then writes the new (random) machine account - password for this Samba server into a file in the same directory - in which an smbpasswd file would be stored - normally :

    /usr/local/samba/private/secrets.tdb

    This file is created and owned by root and is not - readable by any other user. It is the key to the domain-level - security for your system, and should be treated as carefully - as a shadow password file.

    Finally, restart your Samba daemons and get ready for - clients to begin using domain security!

    Why is this better than security = server?

    Currently, domain security in Samba doesn't free you from - having to create local Unix users to represent the users attaching - to your server. This means that if domain user DOM\fred - attaches to your domain security Samba server, there needs - to be a local Unix user fred to represent that user in the Unix - filesystem. This is very similar to the older Samba security mode - security = server, - where Samba would pass through the authentication request to a Windows - NT server in the same way as a Windows 95 or Windows 98 server would. -

    Please refer to the Winbind - paper for information on a system to automatically - assign UNIX uids and gids to Windows NT Domain users and groups. -

    The advantage to domain-level security is that the - authentication in domain-level security is passed down the authenticated - RPC channel in exactly the same way that an NT server would do it. This - means Samba servers now participate in domain trust relationships in - exactly the same way NT servers do (i.e., you can add Samba servers into - a resource domain and have the authentication passed on from a resource - domain PDC to an account domain PDC).

    In addition, with security = server every Samba - daemon on a server has to keep a connection open to the - authenticating server for as long as that daemon lasts. This can drain - the connection resources on a Microsoft NT server and cause it to run - out of available connections. With security = domain, - however, the Samba daemons connect to the PDC/BDC only for as long - as is necessary to authenticate the user, and then drop the connection, - thus conserving PDC connection resources.

    And finally, acting in the same manner as an NT server - authenticating to a PDC means that as part of the authentication - reply, the Samba server gets the user identification information such - as the user SID, the list of NT groups the user belongs to, etc.

    Note

    Much of the text of this document - was first published in the Web magazine - LinuxWorld as the article Doing - the NIS/NT Samba.

    Advanced Configuration

    Valuable Nuts and Bolts Information

    -Samba has several features that you might want or might not want to use. The chapters in this part each cover specific Samba features. -

    Table of Contents

    9. Samba / MS Windows Network Browsing Guide
    What is Browsing?
    Discussion
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing samba to be the master
    Making samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in samba
    Problem resolution
    Browsing across subnets
    10. User information database
    Introduction
    Important Notes About Security
    Advantages of SMB Encryption
    Advantages of non-encrypted passwords
    The smbpasswd Command
    Plain text
    TDB
    LDAP
    Introduction
    Encrypted Password Database
    Supported LDAP Servers
    Schema and Relationship to the RFC 2307 posixAccount
    Configuring Samba with LDAP
    Accounts and Groups management
    Security and sambaAccount
    LDAP specials attributes for sambaAccounts
    Example LDIF Entries for a sambaAccount
    MySQL
    Creating the database
    Configuring
    Using plaintext passwords or encrypted password
    Getting non-column data from the table
    XML
    11. UNIX Permission Bits and Windows NT Access Control Lists
    Viewing and changing UNIX permissions using the NT - security dialogs
    How to view file security on a Samba share
    Viewing file ownership
    Viewing file or directory permissions
    File Permissions
    Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute - mapping
    12. Configuring Group Mapping
    13. Printing Support
    Introduction
    Configuration
    Creating [print$]
    Setting Drivers for Existing Printers
    Support a large number of printers
    Adding New Printers via the Windows NT APW
    Samba and Printer Ports
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints server
    The Installation Client
    Diagnosis
    Introduction
    Debugging printer problems
    What printers do I have?
    Setting up printcap and print servers
    Job sent, no output
    Job sent, strange output
    Raw PostScript printed
    Advanced Printing
    Real debugging
    14. CUPS Printing Support
    Introduction
    Configuring smb.conf for CUPS
    CUPS - RAW Print Through Mode
    CUPS as a network PostScript RIP
    Windows Terminal Servers (WTS) as CUPS clients
    Setting up CUPS for driver download
    Sources of CUPS drivers / PPDs
    cupsaddsmb
    The CUPS Filter Chains
    CUPS Print Drivers and Devices
    Further printing steps
    Limiting the number of pages users can print
    Advanced Postscript Printing from MS Windows
    Auto-Deletion of CUPS spool files
    15. Unified Logons between Windows NT and UNIX using Winbind
    Abstract
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Limitations
    Conclusion
    16. Advanced Network Manangement
    Configuring Samba Share Access Controls
    Share Permissions Management
    Remote Server Administration
    Network Logon Script Magic
    Adding printers without user intervention
    17. System and Account Policies
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    With Windows NT4/200x
    With a Samba PDC
    System Startup and Logon Processing Overview
    18. Desktop Profile Management
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    19. Interdomain Trust Relationships
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    20. PAM Configuration for Centrally Managed Authentication
    Samba and PAM
    PAM Configuration in smb.conf
    Password Synchronisation using pam_smbpass.so
    Distributed Authentication
    21. Stackable VFS modules
    Introduction and configuration
    Included modules
    audit
    extd_audit
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    22. Hosting a Microsoft Distributed File System tree on Samba
    Instructions
    Notes
    23. Integrating MS Windows networks with Samba
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    24. Securing Samba
    Introduction
    Using host based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    25. Unicode/Charsets
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    26. File and Record Locking
    Discussion
    Samba Opportunistic Locking Control
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Additional Reading

    Chapter 9. Samba / MS Windows Network Browsing Guide

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    July 5, 1998

    Updated: April 21, 2003

    Table of Contents

    What is Browsing?
    Discussion
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing samba to be the master
    Making samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in samba
    Problem resolution
    Browsing across subnets

    -This document contains detailed information as well as a fast track guide to -implementing browsing across subnets and / or across workgroups (or domains). -WINS is the best tool for resolution of NetBIOS names to IP addesses. WINS is -NOT involved in browse list handling except by way of name to address resolution. -

    Note

    -MS Windows 2000 and later can be configured to operate with NO NetBIOS -over TCP/IP. Samba-3 and later also supports this mode of operation. -When the use of NetBIOS over TCP/IP has been disabled then the primary -means for resolution of MS Windows machine names is via DNS and Active Directory. -The following information assumes that your site is running NetBIOS over TCP/IP. -

    What is Browsing?

    -To most people browsing means that they can see the MS Windows and Samba servers -in the Network Neighborhood, and when the computer icon for a particular server is -clicked, it opens up and shows the shares and printers available on the target server. -

    -What seems so simple is in fact a very complex interaction of different technologies. +server using smbclient and Kerberos. Use smbclient as usual, but +specify the -k option to choose Kerberos authentication. +

    Notes

    +You must change administrator password at least once after DC +install, to create the right encoding types +

    +W2k doesn't seem to create the _kerberos._udp and _ldap._tcp in +their defaults DNS setup. Maybe fixed in service packs? +

    Common Errors

    +In the process of adding / deleting / re-adding domain member machine accounts there are +many traps for the unwary player and there are many “little” things that can go wrong. +It is particularly interesting how often subscribers on the samba mailing list have concluded +after repeated failed attempts to add a machine account that it is necessary to "re-install" +MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type +of problem. The real solution is often very simple, and with understanding of how MS Windows +networking functions. easily overcome. +

    Can Not Add Machine Back to Domain

    +Problem: A Windows workstation was reinstalled. The original domain machine +account was deleted and added immediately. The workstation will not join the domain if I use +the same machine name. Attempts to add the machine fail with a message that the machine already +exists on the network - I know it doesn't. Why is this failing? +

    +The original name is still in the NetBIOS name cache and must expire after machine account +deletion BEFORE adding that same name as a domain member again. The best advice is to delete +the old account and then to add the machine with a new name. +

    Adding Machine to Domain Fails

    +Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a +message that, The machine could not be added at this time, there is a network problem. +Please try again later. Why? +

    +You should check that there is an add machine script in your smb.conf +file. If there is not, please add one that is appropriate for your OS platform. If a script +has been defined you will need to debug it's operation. Increase the log level +in the smb.conf file to level 10, then try to rejoin the domain. Check the logs to see which +operation is failing. +

    +Possible causes include: +

    • + The script does not actually exist, or could not be located in the path specified. +

      + Corrective Action: Fix it. Make sure that when run manually + that the script will add both the Unix system account _and_ the Samba SAM account. +

    • + The machine could not be added to the Unix system accounts file /etc/passwd +

      + Corrective Action: Check that the machine name is a legal Unix + system account name. ie: If the Unix utility useradd is called + then make sure that the machine name you are trying to add can be added using this + tool. Useradd on some systems will not allow any upper case characters + nor will it allow spaces in the name. +

    Chapter 8. Stand-Alone Servers

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors

    +Stand-Alone servers are independent of Domain Controllers on the network. +They are NOT domain members and function more like workgroup servers. In many +cases a stand-alone server is configured with a minimum of security control +with the intent that all data served will be readily accessible to all users. +

    Features and Benefits

    +Stand-Alone servers can be as secure or as insecure as needs dictate. They can +have simple or complex configurations. Above all, despite the hoopla about +Domain security they remain a very common installation. +

    +If all that is needed is a server for read-only files, or for +printers alone, it may not make sense to affect a complex installation. +For example: A drafting office needs to store old drawings and reference +standards. No-one can write files to the server as it is legislatively +important that all documents remain unaltered. A share mode read-only stand-alone +server is an ideal solution. +

    +Another situation that warrants simplicity is an office that has many printers +that are queued off a single central server. Everyone needs to be able to print +to the printers, there is no need to affect any access controls and no files will +be served from the print server. Again a share mode stand-alone server makes +a great solution. +

    Background

    +The term stand-alone server means that the server +will provide local authentication and access control for all resources +that are available from it. In general this means that there will be a +local user database. In more technical terms, it means that resources +on the machine will be made available in either SHARE mode or in +USER mode. +

    +No special action is needed other than to create user accounts. Stand-alone +servers do NOT provide network logon services. This means that machines that +use this server do NOT perform a domain logon to it. Whatever logon facility +the workstations are subject to is independent of this machine. It is however +necessary to accommodate any network user so that the logon name they use will +be translated (mapped) locally on the stand-alone server to a locally known +user name. There are several ways this can be done. +

    +Samba tends to blur the distinction a little in respect of what is +a stand-alone server. This is because the authentication database may be +local or on a remote server, even if from the Samba protocol perspective +the Samba server is NOT a member of a domain security context. +

    +Through the use of PAM (Pluggable Authentication Modules) and nsswitch +(the name service switcher) the source of authentication may reside on +another server. We would be inclined to call this the authentication server. +This means that the Samba server may use the local Unix/Linux system password database +(/etc/passwd or /etc/shadow), may use a +local smbpasswd file, or may use +an LDAP back end, or even via PAM and Winbind another CIFS/SMB server +for authentication. +

    Example Configuration

    +The following examples are designed to inspire simplicity. It is too easy to +attempt a high level of creativity and to introduce too much complexity in +server and network design. +

    Reference Documentation Server

    +Configuration of a read-only data server that EVERYONE can access is very simple. +Here is the smb.conf file that will do this. Assume that all the reference documents +are stored in the directory /export, that the documents are owned by a user other than +nobody. No home directories are shared, that are no users in the /etc/passwd +Unix system database. This is a very simple system to administer. +

    +	# Global parameters
+	[global]
+		workgroup = MYGROUP
+		netbios name = REFDOCS
+		security = SHARE
+		passdb backend = guest
+		wins server = 192.168.1.1
+
+	[data]
+		comment = Data
+		path = /export
+		guest only = Yes
+

    +In the above example the machine name is set to REFDOCS, the workgroup is set to the name +of the local workgroup so that the machine will appear in with systems users are familiar +with. The only password backend required is the "guest" backend so as to allow default +unprivileged account names to be used. Given that there is a WINS server on this network +we do use it. +

    Central Print Serving

    +Configuration of a simple print server is very simple if you have all the right tools +on your system. +

    Assumptions:

    1. + The print server must require no administration +

    2. + The print spooling and processing system on our print server will be CUPS. + (Please refer to the CUPS Printing chapter for more information). +

    3. + All printers that the print server will service will be network + printers. They will be correctly configured, by the administrator, + in the CUPS environment. +

    4. + All workstations will be installed using postscript drivers. The printer + of choice is the Apple Color LaserWriter. +

    +In this example our print server will spool all incoming print jobs to +/var/spool/samba until the job is ready to be submitted by +Samba to the CUPS print processor. Since all incoming connections will be as +the anonymous (guest) user, two things will be required: +

    Enabling Anonymous Printing

    • + The Unix/Linux system must have a guest account. + The default for this is usually the account nobody. + To find the correct name to use for your version of Samba do the + following: + 

      +$ testparm -s -v | grep "guest account"
+

      + Then make sure that this account exists in your system password + database (/etc/passwd). +

    • + The directory into which Samba will spool the file must have write + access for the guest account. The following commands will ensure that + this directory is available for use: + 

      +root# mkdir /var/spool/samba
+root# chown nobody.nobody /var/spool/samba
+root# chmod a+rwt /var/spool/samba
+

      +

    +

    +	# Global parameters
+	[global]
+		workgroup = MYGROUP
+		netbios name = PTRSVR1
+		security = SHARE
+		passdb backend = guest
+		wins server = 192.168.1.1
+
+	[printers]
+		comment = All Printers
+		path = /var/spool/samba
+		printer admin = root
+		guest ok = Yes
+		printable = Yes
+		printing = cups
+		use client driver = Yes
+		browseable = No
+

    +

    Common Errors

    +The greatest mistake so often made is to make a network configuration too complex. +It pays to use the simplest solution that will meet the needs of the moment. +

    Chapter 9. MS Windows Network Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +This chapter did not make it into this release. +It is planned for the published release of this document. +

    Advanced Configuration

    Valuable Nuts and Bolts Information

    +Samba has several features that you might want or might not want to use. The chapters in this part each cover specific Samba features. +

    Table of Contents

    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    11. Account Information Databases
    Features and Benefits
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and Unix
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon - Users not in Samba SAM
    Users are being added to the wrong backend database
    auth methods does not work
    12. Mapping MS Windows and Unix Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with Unix File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and Unix Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask + parameters
    Interaction with the standard Samba file attribute + mapping
    Common Errors
    Users can not write to a public share
    I have set force user and Samba still makes root the owner of all the files + I touch!
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    Common Errors
    Tell me about Trust Relationships using Samba
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    Parameters for Backwards Compatibility
    Parameters no longer in use
    A simple Configuration to Print with Samba-3
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print with Samba-3
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various Unix Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba-3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with +rpcclient
    "The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure)
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a +different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba-3
    Publishing Printer Information in Active Directory or LDAP
    Common Errors and Problems
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for +CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for +application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download
    GDI on Windows -- PostScript on Unix
    Windows Drivers, GDI and EMF
    Unix Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and +native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many +Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel +Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for +cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Caveats to be considered
    What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver?
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsm completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the +Client
    Installing PostScript Driver Files manually (using +rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Commandline Driver Installation in 15 little Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    When not to use Samba to print to +CUPS
    In Case of Trouble.....
    Where to find Documentation
    How to ask for Help
    Where to find Help
    Appendix
    Printing from CUPS to Windows attached +Printers
    More CUPS filtering Chains
    Trouble Shooting Guidelines to fix typical Samba printing +Problems
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    Common Errors
    21. Integrated Logon Support using Winbind
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    How does one set up roaming profiles for just one (or a few) user/s or group/s?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    My Boomerang Won't Come Back
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note

    Chapter 10. Samba / MS Windows Network Browsing Guide

    John H. Terpstra

    Samba Team

    July 5, 1998

    Updated: April 21, 2003

    Table of Contents

    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"

    +This document contains detailed information as well as a fast track guide to +implementing browsing across subnets and / or across workgroups (or domains). +WINS is the best tool for resolution of NetBIOS names to IP addresses. WINS is +NOT involved in browse list handling except by way of name to address resolution. +

    Note

    +MS Windows 2000 and later can be configured to operate with NO NetBIOS +over TCP/IP. Samba-3 and later also supports this mode of operation. +When the use of NetBIOS over TCP/IP has been disabled then the primary +means for resolution of MS Windows machine names is via DNS and Active Directory. +The following information assumes that your site is running NetBIOS over TCP/IP. +

    Features and Benefits

    +Someone once referred to the past in terms of: They were the worst of times, +they were the best of times. The more we look back, them more we long for what was and +hope it never returns!. +

    +For many MS Windows network administrators, that statement sums up their feelings about +NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle +nature was just par for the course. For those who never quite managed to tame its +lusty features, NetBIOS is like Paterson's Curse. +

    +For those not familiar with botanical problems in Australia: Paterson's curse, +Echium plantagineum, was introduced to Australia from Europe during the mid-nineteenth +century. Since then it has spread rapidly. The high seed production, with densities of +thousands of seeds per square metre, a seed longevity of more than seven years, and an +ability to germinate at any time of year, given the right conditions, are some of the +features which make it such a persistent weed. +

    +In this chapter we explore vital aspects of SMB (Server Message Block) networking with +a particular focus on SMB as implemented through running NetBIOS (Network Basic +Input / Output System) over TCP/IP. Since Samba does NOT implement SMB or NetBIOS over +any other protocols we need to know how to configure our network environment and simply +remember to use nothing but TCP/IP on all our MS Windows network clients. +

    +Samba provides the ability to implement a WINS (Windows Internetworking Name Server) +and implements extensions to Microsoft's implementation of WINS. These extensions +help Samba to affect stable WINS operations beyond the normal scope of MS WINS. +

    +Please note that WINS is exclusively a service that applies only to those systems +that run NetBIOS over TCP/IP. MS Windows 200x / XP have the capacity to turn off +support for NetBIOS, in which case WINS is of no relevance. Samba-3 supports this also. +

    +For those networks on which NetBIOS has been disabled (ie: WINS is NOT required) +the use of DNS is necessary for host name resolution. +

    What is Browsing?

    +To most people browsing means that they can see the MS Windows and Samba servers +in the Network Neighborhood, and when the computer icon for a particular server is +clicked, it opens up and shows the shares and printers available on the target server. +

    +What seems so simple is in fact a very complex interaction of different technologies. The technologies (or methods) employed in making all of this work includes:

    MS Windows machines register their presence to the network
    Machines announce themselves to other machines on the network
    One or more machine on the network collates the local announcements
    The client machine finds the machine that has the collated list of machines
    The client machine is able to resolve the machine names to IP addresses
    The client machine is able to connect to a target machine

    -The samba application that controls/manages browse list management and name resolution is -called nmbd. The configuration parameters involved in nmbd's operation are: +The Samba application that controls browse list management and name resolution is +called nmbd. The configuration parameters involved in nmbd's operation are: 

    +		
 	Browsing options:
 	-----------------
 		* os level
@@ -1471,70 +2340,131 @@ called nmbd. The configuration parameters involved in nmbd's operation
 		* wins support
 		  wins hook

    -WINS Server and WINS Support are mutually exclusive options. Those marked with an '*' are -the only options that commonly MAY need to be modified. Even if not one of these parameters -is set nmbd will still do it's job. -

    Discussion

    -Firstly, all MS Windows networking is based on SMB (Server Message -Block) based messaging. SMB messaging may be implemented using NetBIOS or -without NetBIOS. Samba implements NetBIOS by encapsulating it over TCP/IP. -MS Windows products can do likewise. NetBIOS based networking uses broadcast -messaging to affect browse list management. When running NetBIOS over -TCP/IP this uses UDP based messaging. UDP messages can be broadcast or unicast. +For Samba, the WINS Server and WINS Support are mutually exclusive options. Those marked with +an '*' are the only options that commonly MAY need to be modified. Even if not one of these +parameters is set nmbd will still do it's job. +

    Discussion

    +Firstly, all MS Windows networking uses SMB (Server Message Block) based messaging. +SMB messaging may be implemented with or without NetBIOS. MS Windows 200x supports +NetBIOS over TCP/IP for backwards compatibility. Microsoft is intent on phasing out NetBIOS +support. +

    NetBIOS over TCP/IP

    +Samba implements NetBIOS, as does MS Windows NT / 200x / XP, by encapsulating it over TCP/IP. +MS Windows products can do likewise. NetBIOS based networking uses broadcast messaging to +affect browse list management. When running NetBIOS over TCP/IP, this uses UDP based messaging. +UDP messages can be broadcast or unicast.

    Normally, only unicast UDP messaging can be forwarded by routers. The -remote announce -parameter to smb.conf helps to project browse announcements +remote announce parameter to smb.conf helps to project browse announcements to remote network segments via unicast UDP. Similarly, the -remote browse sync parameter of smb.conf +remote browse sync parameter of smb.conf implements browse list collation using unicast UDP.

    -Secondly, in those networks where Samba is the only SMB server technology -wherever possible nmbd should be configured on one (1) machine as the WINS +Secondly, in those networks where Samba is the only SMB server technology, +wherever possible nmbd should be configured on one (1) machine as the WINS server. This makes it easy to manage the browsing environment. If each network segment is configured with it's own Samba WINS server, then the only way to get cross segment browsing to work is by using the -remote announce and the remote browse sync -parameters to your smb.conf file. +remote announce and the remote browse sync +parameters to your smb.conf file.

    If only one WINS server is used for an entire multi-segment network then -the use of the remote announce and the -remote browse sync parameters should NOT be necessary. +the use of the remote announce and the +remote browse sync parameters should NOT be necessary.

    As of Samba 3 WINS replication is being worked on. The bulk of the code has -been committed, but it still needs maturation. +been committed, but it still needs maturation. This is NOT a supported feature +of the Samba-3.0.0 release. Hopefully, this will become a supported feature +of one of the Samba-3 release series.

    -Right now samba WINS does not support MS-WINS replication. This means that -when setting up Samba as a WINS server there must only be one nmbd configured -as a WINS server on the network. Some sites have used multiple Samba WINS +Right now Samba WINS does not support MS-WINS replication. This means that +when setting up Samba as a WINS server there must only be one nmbd +configured as a WINS server on the network. Some sites have used multiple Samba WINS servers for redundancy (one server per subnet) and then used -remote browse sync and remote announce -to affect browse list collation across all -segments. Note that this means clients will only resolve local names, -and must be configured to use DNS to resolve names on other subnets in -order to resolve the IP addresses of the servers they can see on other -subnets. This setup is not recommended, but is mentioned as a practical +remote browse sync and remote announce +to affect browse list collation across all segments. Note that this means clients +will only resolve local names, and must be configured to use DNS to resolve names +on other subnets in order to resolve the IP addresses of the servers they can see +on other subnets. This setup is not recommended, but is mentioned as a practical consideration (ie: an 'if all else fails' scenario).

    Lastly, take note that browse lists are a collection of unreliable broadcast messages that are repeated at intervals of not more than 15 minutes. This means that it will take time to establish a browse list and it can take up to 45 minutes to stabilise, particularly across network segments. -

    How Browsing Functions

    -As stated above, MS Windows machines register their NetBIOS names +

    TCP/IP - without NetBIOS

    +All TCP/IP using systems use various forms of host name resolution. The primary +methods for TCP/IP hostname resolutions involves either a static file (/etc/hosts +) or DNS (the Domain Name System). DNS is the technology that makes +the Internet usable. DNS based host name resolution is supported by nearly all TCP/IP +enabled systems. Only a few embedded TCP/IP systems do not support DNS. +

    +When an MS Windows 200x / XP system attempts to resolve a host name to an IP address +it follows a defined path: +

    1. + Checks the hosts file. It is located in + C:\WinNT\System32\Drivers\etc. +

    2. + Does a DNS lookup +

    3. + Checks the NetBIOS name cache +

    4. + Queries the WINS server +

    5. + Does a broadcast name lookup over UDP +

    6. + Looks up entries in LMHOSTS. It is located in + C:\WinNT\System32\Drivers\etc. +

    +Windows 200x / XP can register it's host name with a Dynamic DNS server. You can +force register with a Dynamic DNS server in Windows 200x / XP using: +ipconfig /registerdns +

    +With Active Directory (ADS), a correctly functioning DNS server is absolutely +essential. In the absence of a working DNS server that has been correctly configured, +MS Windows clients and servers will be totally unable to locate each other, +consequently network services will be severely impaired. +

    +The use of Dynamic DNS is highly recommended with Active Directory, in which case +the use of BIND9 is preferred for it's ability to adequately support the SRV (service) +records that are needed for Active Directory. +

    DNS and Active Directory

    +Occasionally we hear from Unix network administrators who want to use a Unix based Dynamic +DNS server in place of the Microsoft DNS server. While this might be desirable to some, the +MS Windows 200x DNS server is auto-configured to work with Active Directory. It is possible +to use BIND version 8 or 9, but it will almost certainly be necessary to create service records +so that MS Active Directory clients can resolve host names to locate essential network services. +The following are some of the default service records that Active Directory requires: +

    • _ldap._tcp.pdc.ms-dcs.Domain

      + This provides the address of the Windows NT PDC for the Domain. +

    • _ldap._tcp.pdc.ms-dcs.DomainTree

      + Resolves the addresses of Global Catalog servers in the domain. +

    • _ldap._tcp.site.sites.writable.ms-dcs.Domain

      + Provides list of domain controllers based on sites. +

    • _ldap._tcp.writable.ms-dcs.Domain

      + Enumerates list of domain controllers that have the writable + copies of the Active Directory data store. +

    • _ldap._tcp.GUID.domains.ms-dcs.DomainTree

      + Entry used by MS Windows clients to locate machines using the + Global Unique Identifier. +

    • _ldap._tcp.Site.gc.ms-dcs.DomainTree

      + Used by MS Windows clients to locate site configuration dependent + Global Catalog server. +

    How Browsing Functions

    +MS Windows machines register their NetBIOS names (ie: the machine name for each service type in operation) on start -up. Also, as stated above, the exact method by which this name registration +up. The exact method by which this name registration takes place is determined by whether or not the MS Windows client/server has been given a WINS server address, whether or not LMHOSTS lookup is enabled, or if DNS for NetBIOS name resolution is enabled, etc.

    -In the case where there is no WINS server all name registrations as +In the case where there is no WINS server, all name registrations as well as name lookups are done by UDP broadcast. This isolates name resolution to the local subnet, unless LMHOSTS is used to list all names and IP addresses. In such situations Samba provides a means by -which the samba server name may be forcibly injected into the browse +which the Samba server name may be forcibly injected into the browse list of a remote MS Windows network (using the -remote announce parameter). +remote announce parameter).

    Where a WINS server is used, the MS Windows client will use UDP unicast to register with the WINS server. Such packets can be routed @@ -1561,21 +2491,21 @@ Any configuration that breaks name resolution and/or browsing intrinsics will annoy users because they will have to put up with protracted inability to use the network services.

    -Samba supports a feature that allows forced synchonisation -of browse lists across routed networks using the remote -browse sync parameter in the smb.conf file. +Samba supports a feature that allows forced synchronisation +of browse lists across routed networks using the remote +browse sync parameter in the smb.conf file. This causes Samba to contact the local master browser on a remote network and to request browse list synchronisation. This effectively bridges two networks that are separated by routers. The two remote networks may use either broadcast based name resolution or WINS -based name resolution, but it should be noted that the remote +based name resolution, but it should be noted that the remote browse sync parameter provides browse list synchronisation - and that is distinct from name to address resolution, in other words, for cross subnet browsing to function correctly it is essential that a name to address resolution mechanism be provided. -This mechanism could be via DNS, /etc/hosts, +This mechanism could be via DNS, /etc/hosts, and so on. -

    Setting up WORKGROUP Browsing

    +

    Setting up WORKGROUP Browsing

    To set up cross subnet browsing on a network containing machines in up to be in a WORKGROUP, not an NT Domain you need to set up one Samba server to be the Domain Master Browser (note that this is *NOT* @@ -1585,13 +2515,14 @@ to collate the browse lists from local master browsers on all the subnets that have a machine participating in the workgroup. Without one machine configured as a domain master browser each subnet would be an isolated workgroup, unable to see any machines on any other -subnet. It is the presense of a domain master browser that makes +subnet. It is the presence of a domain master browser that makes cross subnet browsing possible for a workgroup.

    In an WORKGROUP environment the domain master browser must be a Samba server, and there must only be one domain master browser per workgroup name. To set up a Samba server as a domain master browser, -set the following option in the [global] section of the smb.conf file : +set the following option in the [global] section +of the smb.conf file : 

     	domain master = yes
@@ -1599,7 +2530,7 @@ set the following option in the [global] section of the smb.conf file :
 
    
 The domain master browser should also preferrably be the local master
 browser for its own subnet.  In order to achieve this set the following
-options in the [global] section of the smb.conf file :
+options in the [global] section of the smb.conf file :
 
    
 
     	domain master = yes
@@ -1617,8 +2548,8 @@ workgroup.  Any MS Windows NT/2K/XP/2003  machine should be
 able to do this, as will Windows 9x machines (although these
 tend to get rebooted more often, so it's not such a good idea
 to use these).  To make a Samba server a local master browser
-set the following options in the [global] section of the
-smb.conf file :
+set the following options in the [global] section of the
+smb.conf file :
 
    
 
     	domain master = no
@@ -1631,16 +2562,16 @@ Do not do this for more than one Samba server on each subnet,
 or they will war with each other over which is to be the local
 master browser.
 
    
-The local master parameter allows Samba to act as a
-local master browser.  The preferred master causes nmbd
-to force a browser election on startup and the os level
+The local master parameter allows Samba to act as a
+local master browser.  The preferred master causes nmbd
+to force a browser election on startup and the os level
 parameter sets Samba high enough so that it should win any browser elections.
 
    
 If you have an NT machine on the subnet that you wish to
 be the local master browser then you can disable Samba from
 becoming a local master browser by setting the following
-options in the [global] section of the 
-smb.conf file :
+options in the [global] section of the 
+smb.conf file :
 
    
 
     	domain master = no
@@ -1648,20 +2579,20 @@ options in the [global] section of the
 	preferred master = no
 	os level = 0
 
    
-

    Setting up DOMAIN Browsing

    +

    Setting up DOMAIN Browsing

    If you are adding Samba servers to a Windows NT Domain then you must not set up a Samba server as a domain master browser. -By default, a Windows NT Primary Domain Controller for a Domain -name is also the Domain master browser for that name, and many +By default, a Windows NT Primary Domain Controller for a domain +is also the Domain master browser for that domain, and many things will break if a Samba server registers the Domain master -browser NetBIOS name (DOMAIN<1B>) +browser NetBIOS name (DOMAIN<1B>) with WINS instead of the PDC.

    For subnets other than the one containing the Windows NT PDC you may set up Samba servers as local master browsers as described. To make a Samba server a local master browser set -the following options in the [global] section -of the smb.conf file : +the following options in the [global] section +of the smb.conf file : 

     	domain master = no
@@ -1671,18 +2602,18 @@ of the smb.conf file :

    If you wish to have a Samba server fight the election with machines -on the same subnet you may set the os level parameter +on the same subnet you may set the os level parameter to lower levels. By doing this you can tune the order of machines that will become local master browsers if they are running. For -more details on this see the section -Forcing samba to be the master browser +more details on this see the section +Forcing Samba to be the master browser below.

    If you have Windows NT machines that are members of the domain on all subnets, and you are sure they will always be running then you can disable Samba from taking part in browser elections and ever becoming a local master browser by setting following options -in the [global] section of the smb.conf +in the [global] section of the smb.conf file : 

    @@ -1691,63 +2622,63 @@ file :
         preferred master = no
         os level = 0

    -

    Forcing samba to be the master

    -Who becomes the master browser is determined by an election +

    Forcing Samba to be the master

    +Who becomes the master browser is determined by an election process using broadcasts. Each election packet contains a number of parameters which determine what precedence (bias) a host should have in the election. By default Samba uses a very low precedence and thus loses elections to just about anyone else.

    -If you want Samba to win elections then just set the os level global -option in smb.conf to a higher number. It defaults to 0. Using 34 +If you want Samba to win elections then just set the os level global +option in smb.conf to a higher number. It defaults to 0. Using 34 would make it win all elections over every other system (except other samba systems!)

    -A os level of 2 would make it beat WfWg and Win95, but not MS Windows +A os level of 2 would make it beat WfWg and Win95, but not MS Windows NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32.

    The maximum os level is 255

    -If you want samba to force an election on startup, then set the -preferred master global option in smb.conf to "yes". Samba will +If you want Samba to force an election on startup, then set the +preferred master global option in smb.conf to yes. Samba will then have a slight advantage over other potential master browsers that are not preferred master browsers. Use this parameter with -care, as if you have two hosts (whether they are windows 95 or NT or -samba) on the same local subnet both set with preferred master to -"yes", then periodically and continually they will force an election +care, as if you have two hosts (whether they are Windows 95 or NT or +Samba) on the same local subnet both set with preferred master to +yes, then periodically and continually they will force an election in order to become the local master browser.

    -If you want samba to be a domain master browser, then it is -recommended that you also set preferred master to "yes", because -samba will not become a domain master browser for the whole of your +If you want Samba to be a domain master browser, then it is +recommended that you also set preferred master to yes, because +Samba will not become a domain master browser for the whole of your LAN or WAN if it is not also a local master browser on its own broadcast isolated subnet.

    -It is possible to configure two samba servers to attempt to become +It is possible to configure two Samba servers to attempt to become the domain master browser for a domain. The first server that comes -up will be the domain master browser. All other samba servers will +up will be the domain master browser. All other Samba servers will attempt to become the domain master browser every 5 minutes. They -will find that another samba server is already the domain master +will find that another Samba server is already the domain master browser and will fail. This provides automatic redundancy, should the current domain master browser fail. -

    Making samba the domain master

    +

    Making Samba the domain master

    The domain master is responsible for collating the browse lists of multiple subnets so that browsing can occur between subnets. You can -make samba act as the domain master by setting domain master = yes -in smb.conf. By default it will not be a domain master. +make Samba act as the domain master by setting domain master = yes +in smb.conf. By default it will not be a domain master.

    -Note that you should NOT set Samba to be the domain master for a +Note that you should not set Samba to be the domain master for a workgroup that has the same name as an NT Domain.

    -When samba is the domain master and the master browser it will listen +When Samba is the domain master and the master browser, it will listen for master announcements (made roughly every twelve minutes) from local master browsers on other subnets and then contact them to synchronise browse lists.

    -If you want samba to be the domain master then I suggest you also set -the os level high enough to make sure it wins elections, and set -preferred master to "yes", to get samba to force an election on +If you want Samba to be the domain master then I suggest you also set +the os level high enough to make sure it wins elections, and set +preferred master to yes, to get Samba to force an election on startup.

    -Note that all your servers (including samba) and clients should be +Note that all your servers (including Samba) and clients should be using a WINS server to resolve NetBIOS names. If your clients are only using broadcasting to resolve NetBIOS names, then two things will occur:

    1. @@ -1758,11 +2689,11 @@ using broadcasting to resolve NetBIOS names, then two things will occur: a user attempts to access a host in that list, it will be unable to resolve the NetBIOS name of that host.

    -If, however, both samba and your clients are using a WINS server, then: +If, however, both Samba and your clients are using a WINS server, then:

    1. your local master browsers will contact the WINS server and, as long as - samba has registered that it is a domain master browser with the WINS - server, your local master browser will receive samba's ip address + Samba has registered that it is a domain master browser with the WINS + server, your local master browser will receive Samba's IP address as its domain master browser.

    2. when a client receives a domain-wide browse list, and a user attempts @@ -1770,67 +2701,67 @@ If, however, both samba and your clients are using a WINS server, then: resolve the NetBIOS name of that host. as long as that host has registered its NetBIOS name with the same WINS server, the user will be able to see that host. -

    Note about broadcast addresses

    +

    Note about broadcast addresses

    If your network uses a "0" based broadcast address (for example if it ends in a 0) then you will strike problems. Windows for Workgroups does not seem to support a 0's broadcast and you will probably find that browsing and name lookups won't work. -

    Multiple interfaces

    +

    Multiple interfaces

    Samba now supports machines with multiple network interfaces. If you -have multiple interfaces then you will need to use the interfaces -option in smb.conf to configure them. -

    Use of the Remote Announce parameter

    -The remote announce parameter of -smb.conf can be used to forcibly ensure +have multiple interfaces then you will need to use the interfaces +option in smb.conf to configure them. +

    Use of the Remote Announce parameter

    +The remote announce parameter of +smb.conf can be used to forcibly ensure that all the NetBIOS names on a network get announced to a remote network. -The syntax of the remote announce parameter is: +The syntax of the remote announce parameter is: 

     	remote announce = a.b.c.d [e.f.g.h] ...

    -_or_ +or 

     	remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...

    where: -

    a.b.c.d and -e.f.g.h

    is either the LMB (Local Master Browser) IP address -or the broadcst address of the remote network. +

    a.b.c.d and +e.f.g.h

    is either the LMB (Local Master Browser) IP address +or the broadcast address of the remote network. ie: the LMB is at 192.168.1.10, or the address could be given as 192.168.1.255 where the netmask is assumed to be 24 bits (255.255.255.0). When the remote announcement is made to the broadcast -address of the remote network every host will receive +address of the remote network, every host will receive our announcements. This is noisy and therefore undesirable but may be necessary if we do NOT know -the IP address of the remote LMB.

    WORKGROUP

    is optional and can be either our own workgroup +the IP address of the remote LMB.

    WORKGROUP

    is optional and can be either our own workgroup or that of the remote network. If you use the workgroup name of the remote network then our NetBIOS machine names will end up looking like they belong to that workgroup, this may cause name resolution problems and should be avoided.

    -

    Use of the Remote Browse Sync parameter

    -The remote browse sync parameter of -smb.conf is used to announce to -another LMB that it must synchronise it's NetBIOS name list with our +

    Use of the Remote Browse Sync parameter

    +The remote browse sync parameter of +smb.conf is used to announce to +another LMB that it must synchronise its NetBIOS name list with our Samba LMB. It works ONLY if the Samba server that has this option is -simultaneously the LMB on it's network segment. +simultaneously the LMB on its network segment.

    -The syntax of the remote browse sync parameter is: +The syntax of the remote browse sync parameter is: 

    -remote browse sync = a.b.c.d
+remote browse sync = a.b.c.d

    -where a.b.c.d is either the IP address of the +where a.b.c.d is either the IP address of the remote LMB or else is the network broadcast address of the remote segment. -

    WINS - The Windows Internetworking Name Server

    -Use of WINS (either Samba WINS _or_ MS Windows NT Server WINS) is highly -recommended. Every NetBIOS machine registers it's name together with a -name_type value for each of of several types of service it has available. -eg: It registers it's name directly as a unique (the type 0x03) name. -It also registers it's name if it is running the lanmanager compatible +

    WINS - The Windows Internetworking Name Server

    +Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly +recommended. Every NetBIOS machine registers its name together with a +name_type value for each of several types of service it has available. +eg: It registers its name directly as a unique (the type 0x03) name. +It also registers its name if it is running the LanManager compatible server service (used to make shares and printers available to other users) by registering the server (the type 0x20) name.

    @@ -1845,8 +2776,8 @@ that wants to log onto the network can ask the WINS server for a list of all names that have registered the NetLogon service name_type. This saves broadcast traffic and greatly expedites logon processing. Since broadcast name resolution can not be used across network segments this type of -information can only be provided via WINS _or_ via statically configured -lmhosts files that must reside on all clients in the +information can only be provided via WINS or via statically configured +lmhosts files that must reside on all clients in the absence of WINS.

    WINS also serves the purpose of forcing browse list synchronisation by all @@ -1866,21 +2797,21 @@ lookup attempts by other clients and will therefore cause workstation access errors.

    To configure Samba as a WINS server just add -wins support = yes to the smb.conf +wins support = yes to the smb.conf file [globals] section.

    To configure Samba to register with a WINS server just add -"wins server = a.b.c.d" to your smb.conf file [globals] section. +wins server = a.b.c.d to your smb.conf file [globals] section.

    Important

    -Never use both wins support = yes together -with wins server = a.b.c.d +Never use both wins support = yes together +with wins server = a.b.c.d particularly not using it's own IP address. -Specifying both will cause nmbd to refuse to start! -

    Setting up a WINS server

    +Specifying both will cause nmbd to refuse to start! +

    Setting up a WINS server

    Either a Samba machine or a Windows NT Server machine may be set up as a WINS server. To set a Samba machine to be a WINS server you must -add the following option to the smb.conf file on the selected machine : -in the [globals] section add the line +add the following option to the smb.conf file on the selected machine : +in the [globals] section add the line 

     	wins support = yes
@@ -1891,32 +2822,32 @@ yes.  If you have any older versions of Samba on your network it is
 strongly suggested you upgrade to a recent version, or at the very
 least set the parameter to 'no' on all these machines.
 
    
-Machines with wins support = yes will keep a list of 
+Machines with wins support = yes will keep a list of 
 all NetBIOS names registered with them, acting as a DNS for NetBIOS names.
 
    
-You should set up only ONE wins server.  Do NOT set the
-wins support = yes option on more than one Samba 
+You should set up only ONE WINS server.  Do NOT set the
+wins support = yes option on more than one Samba 
 server.
 
    
 To set up a Windows NT Server as a WINS server you need to set up
 the WINS service - see your NT documentation for details.  Note that
 Windows NT WINS Servers can replicate to each other, allowing more
 than one to be set up in a complex subnet environment.  As Microsoft
-refuse to document these replication protocols Samba cannot currently
+refuses to document these replication protocols, Samba cannot currently
 participate in these replications.  It is possible in the future that
 a Samba->Samba WINS replication protocol may be defined, in which
 case more than one Samba machine could be set up as a WINS server
 but currently only one Samba server should have the 
-wins support = yes parameter set.
+wins support = yes parameter set.
 
    
 After the WINS server has been configured you must ensure that all
 machines participating on the network are configured with the address
 of this WINS server.  If your WINS server is a Samba machine, fill in
-the Samba machine IP address in the "Primary WINS Server" field of
-the "Control Panel->Network->Protocols->TCP->WINS Server" dialogs
+the Samba machine IP address in the Primary WINS Server field of
+the Control Panel->Network->Protocols->TCP->WINS Server dialogs
 in Windows 95 or Windows NT.  To tell a Samba server the IP address
-of the WINS server add the following line to the [global] section of
-all smb.conf files :
+of the WINS server add the following line to the [global] section of
+all smb.conf files :
 
    
 
     	wins server = <name or IP address>
@@ -1925,10 +2856,10 @@ all smb.conf files :
 where <name or IP address> is either the DNS name of the WINS server
 machine or its IP address.
 
    
-Note that this line MUST NOT BE SET in the smb.conf file of the Samba
+Note that this line MUST NOT BE SET in the smb.conf file of the Samba
 server acting as the WINS server itself.  If you set both the
-wins support = yes option and the 
-wins server = <name> option then
+wins support = yes option and the 
+wins server = <name> option then
 nmbd will fail to start.
 
    
 There are two possible scenarios for setting up cross subnet browsing.
@@ -1936,22 +2867,45 @@ The first details setting up cross subnet browsing on a network containing
 Windows 95, Samba and Windows NT machines that are not configured as
 part of a Windows NT Domain.  The second details setting up cross subnet
 browsing on networks that contain NT Domains.
-

    WINS Replication

    -Samba-3 permits WINS replication through the use of the wrepld utility. +

    WINS Replication

    +Samba-3 permits WINS replication through the use of the wrepld utility. This tool is not currently capable of being used as it is still in active development. As soon as this tool becomes moderately functional we will prepare man pages and enhance this section of the documentation to provide usage and technical details. -

    Static WINS Entries

    -New to Samba-3 is a tool called winsedit that may be used to add -static WINS entries to the WINS database. This tool can be used also to modify entries -existing in the WINS database. -

    -The development of the winsedit tool was made necessary due to the migration -of the older style wins.dat file into a new tdb binary backend data store. -

    Helpful Hints

    +

    Static WINS Entries

    +Adding static entries to your Samba-3 WINS server is actually fairly easy. +All you have to do is add a line to wins.dat, typically +located in /usr/local/samba/var/locks. +

    +Entries in wins.dat take the form of + +

    +"NAME#TYPE" TTL ADDRESS+ FLAGS
+

    + +where NAME is the NetBIOS name, TYPE is the NetBIOS type, TTL is the +time-to-live as an absolute time in seconds, ADDRESS+ is one or more +addresses corresponding to the registration and FLAGS are the NetBIOS +flags for the registration. +

    +A typical dynamic entry looks like: +

    +"MADMAN#03" 1055298378 192.168.1.2 66R
+

    + +To make it static, all that has to be done is set the TTL to 0: + +

    +"MADMAN#03" 0 192.168.1.2 66R
+

    +

    +Though this method works with early Samba-3 versions, there's a +possibility that it may change in future versions if WINS replication +is added. +

    Helpful Hints

    The following hints should be carefully considered as they are stumbling points for many new network administrators. -

    Windows Networking Protocols

    Warning

    +

    Windows Networking Protocols

    Warning

    Do NOT use more than one (1) protocol on MS Windows machines

    A very common cause of browsing problems results from installing more than @@ -1959,7 +2913,7 @@ one protocol on an MS Windows machine.

    Every NetBIOS machine takes part in a process of electing the LMB (and DMB) every 15 minutes. A set of election criteria is used to determine the order -of precidence for winning this election process. A machine running Samba or +of precedence for winning this election process. A machine running Samba or Windows NT will be biased so that the most suitable machine will predictably win and thus retain it's role.

    @@ -1981,31 +2935,34 @@ differently from MS Windows NT4. Generally, where a server does NOT support the newer or extended protocol, these will fall back to the NT4 protocols.

    The safest rule of all to follow it this - USE ONLY ONE PROTOCOL! -

    Name Resolution Order

    +

    Name Resolution Order

    Resolution of NetBIOS names to IP addresses can take place using a number of methods. The only ones that can provide NetBIOS name_type information -are:

    WINS: the best tool!
    LMHOSTS: is static and hard to maintain.
    Broadcast: uses UDP and can not resolve names across remote segments.

    -Alternative means of name resolution includes:

    /etc/hosts: is static, hard to maintain, and lacks name_type info
    DNS: is a good choice but lacks essential name_type info.

    +are: +

    WINS: the best tool!
    LMHOSTS: is static and hard to maintain.
    Broadcast: uses UDP and can not resolve names across remote segments.

    +Alternative means of name resolution includes: +

    /etc/hosts: is static, hard to maintain, and lacks name_type info
    DNS: is a good choice but lacks essential name_type info.

    Many sites want to restrict DNS lookups and want to avoid broadcast name -resolution traffic. The "name resolve order" parameter is of great help here. -The syntax of the "name resolve order" parameter is: +resolution traffic. The name resolve order parameter is +of great help here. The syntax of the name resolve order +parameter is: 

     name resolve order = wins lmhosts bcast host

    -_or_ +or 

     name resolve order = wins lmhosts  	(eliminates bcast and host)

    The default is: 

    -name  resolve order = host lmhost wins bcast
+name resolve order = host lmhost wins bcast

    where "host" refers the the native methods used by the Unix system to implement the gethostbyname() function call. This is normally -controlled by /etc/host.conf, /etc/nsswitch.conf and /etc/resolv.conf. -

    Technical Overview of browsing

    +controlled by /etc/host.conf, /etc/nsswitch.conf and /etc/resolv.conf. +

    Technical Overview of browsing

    SMB networking provides a mechanism by which clients can access a list -of machines in a network, a so-called browse list. This list +of machines in a network, a so-called browse list. This list contains machines that are ready to offer file and/or print services to other machines within the network. Thus it does not include machines which aren't currently able to do server tasks. The browse @@ -2014,7 +2971,7 @@ browsing has been problematic for some Samba users, hence this document.

    MS Windows 2000 and later, as with Samba 3 and later, can be -configured to not use NetBIOS over TCP/IP. When configured this way +configured to not use NetBIOS over TCP/IP. When configured this way, it is imperative that name resolution (using DNS/LDAP/ADS) be correctly configured and operative. Browsing will NOT work if name resolution from SMB machine names to IP addresses does not function correctly. @@ -2023,9 +2980,9 @@ Where NetBIOS over TCP/IP is enabled use of a WINS server is highly recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. WINS allows remote segment clients to obtain NetBIOS name_type information that can NOT be provided by any other means of name resolution. -

    Browsing support in samba

    -Samba facilitates browsing. The browsing is supported by nmbd -and is also controlled by options in the smb.conf file. +

    Browsing support in Samba

    +Samba facilitates browsing. The browsing is supported by nmbd +and is also controlled by options in the smb.conf file. Samba can act as a local browse master for a workgroup and the ability to support domain logons and scripts is now available.

    @@ -2033,7 +2990,7 @@ Samba can also act as a domain master browser for a workgroup. This means that it will collate lists from local browse masters into a wide area network server list. In order for browse clients to resolve the names they may find in this list, it is recommended that -both samba and your clients use a WINS server. +both Samba and your clients use a WINS server.

    Note that you should NOT set Samba to be the domain master for a workgroup that has the same name as an NT Domain: on each wide area @@ -2042,34 +2999,34 @@ regardless of whether it is NT, Samba or any other type of domain master that is providing this service.

    Note

    Nmbd can be configured as a WINS server, but it is not -necessary to specifically use samba as your WINS server. MS Windows +necessary to specifically use Samba as your WINS server. MS Windows NT4, Server or Advanced Server 2000 or 2003 can be configured as -your WINS server. In a mixed NT/2000/2003 server and samba environment on +your WINS server. In a mixed NT/2000/2003 server and Samba environment on a Wide Area Network, it is recommended that you use the Microsoft -WINS server capabilities. In a samba-only environment, it is +WINS server capabilities. In a Samba-only environment, it is recommended that you use one and only one Samba server as your WINS server.

    To get browsing to work you need to run nmbd as usual, but will need -to use the workgroup option in smb.conf +to use the workgroup option in smb.conf to control what workgroup Samba becomes a part of.

    Samba also has a useful option for a Samba server to offer itself for browsing on another subnet. It is recommended that this option is only used for 'unusual' purposes: announcements over the internet, for -example. See remote announce in the -smb.conf man page. -

    Problem resolution

    -If something doesn't work then hopefully the log.nmb file will help +example. See remote announce in the +smb.conf man page. +

    Problem resolution

    +If something doesn't work then hopefully the log.nmbd file will help you track down the problem. Try a debug level of 2 or 3 for finding problems. Also note that the current browse list usually gets stored -in text form in a file called browse.dat. +in text form in a file called browse.dat.

    Note that if it doesn't work for you, then you should still be able to -type the server name as \\SERVER in filemanager then +type the server name as \\SERVER in filemanager then hit enter and filemanager should display the list of available shares.

    Some people find browsing fails because they don't have the global -guest account set to a valid account. Remember that the +guest account set to a valid account. Remember that the IPC$ connection that lists the shares is done as guest, and thus you must have a valid guest account.

    @@ -2082,16 +3039,14 @@ server resources.

    The other big problem people have is that their broadcast address, netmask or IP address is wrong (specified with the "interfaces" option -in smb.conf) -

    Browsing across subnets

    -Since the release of Samba 1.9.17(alpha1) Samba has been -updated to enable it to support the replication of browse lists -across subnet boundaries. New code and options have been added to -achieve this. This section describes how to set this feature up -in different settings. +in smb.conf) +

    Browsing across subnets

    +Since the release of Samba 1.9.17(alpha1), Samba has supported the +replication of browse lists across subnet boundaries. This section +describes how to set this feature up in different settings.

    To see browse lists that span TCP/IP subnets (ie. networks separated -by routers that don't pass broadcast traffic) you must set up at least +by routers that don't pass broadcast traffic), you must set up at least one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing NetBIOS name to IP address translation to be done by doing a direct query of the WINS server. This is done via a directed UDP packet on @@ -2105,8 +3060,8 @@ Remember, for browsing across subnets to work correctly, all machines, be they Windows 95, Windows NT, or Samba servers must have the IP address of a WINS server given to them by a DHCP server, or by manual configuration (for Win95 and WinNT, this is in the TCP/IP Properties, under Network -settings) for Samba this is in the smb.conf file. -

    How does cross subnet browsing work ?

    +settings) for Samba this is in the smb.conf file. +

    How does cross subnet browsing work ?

    Cross subnet browsing is a complicated dance, containing multiple moving parts. It has taken Microsoft several years to get the code that achieves this correct, and Samba lags behind in some areas. @@ -2114,6 +3069,7 @@ Samba is capable of cross subnet browsing when configured correctly.

    Consider a network set up as follows :

    + 

                                        (DMB)
              N1_A      N1_B        N1_C       N1_D        N1_E
@@ -2135,7 +3091,7 @@ Consisting of 3 subnets (1, 2, 3) connected by two routers
 (R1, R2) - these do not pass broadcasts.  Subnet 1 has 5 machines
 on it, subnet 2 has 4 machines, subnet 3 has 4 machines.  Assume
 for the moment that all these machines are configured to be in the
-same workgroup (for simplicities sake).  Machine N1_C on subnet 1
+same workgroup (for simplicity's sake).  Machine N1_C on subnet 1
 is configured as Domain Master Browser (ie.  it will collate the
 browse lists for the workgroup).  Machine N2_D is configured as
 WINS server and all the other machines are configured to register
@@ -2172,15 +3128,7 @@ At this point the browse lists look as follows (these are
 the machines you would see in your network neighborhood if
 you looked in it on a particular network right now).
 
    
-
    -Subnet           Browse Master   List
-------           -------------   ----
-Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E
-
-Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
-
-Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D
-
    
+
    Table 10.1. Browse subnet example 1
    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D
    
 
    
 Note that at this point all the subnets are separate, no
 machine is seen across any of the subnets.
@@ -2189,7 +3137,7 @@ Now examine subnet 2.  As soon as N2_B has become the local
 master browser it looks for a Domain master browser to synchronize
 its browse list with.  It does this by querying the WINS server
 (N2_D) for the IP address associated with the NetBIOS name 
-WORKGROUP<1B>.  This name was registerd by the Domain master
+WORKGROUP<1B>.  This name was registered by the Domain master
 browser (N1_C) with the WINS server as soon as it was booted.
 
    
 Once N2_B knows the address of the Domain master browser it
@@ -2202,19 +3150,9 @@ the MasterAnnouncement packet it schedules a synchronization
 request to the sender of that packet.  After both synchronizations
 are done the browse lists look like :
 
    
-
    -Subnet           Browse Master   List
-------           -------------   ----
-Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E, 
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*)
-
-Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
-
-Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D
+
    Table 10.2. Browse subnet example 2
    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D
    
 
 Servers with a (*) after them are non-authoritative names.
-
    
 
    
 At this point users looking in their network neighborhood on
 subnets 1 or 2 will see all the servers on both, users on
@@ -2227,49 +3165,22 @@ it gets both the server entries on subnet 1, and those on
 subnet 2.  After N3_D has synchronized with N1_C and vica-versa
 the browse lists look like.
 
    
-
    -Subnet           Browse Master   List
-------           -------------   ----
-Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E, 
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*),
-                                 N3_A(*), N3_B(*), N3_C(*), N3_D(*)
-
-Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
-
-Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*),
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*)
+
    Table 10.3. Browse subnet example 3
    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)
    
 
 Servers with a (*) after them are non-authoritative names.
-
    
 
    
 At this point users looking in their network neighborhood on
-subnets 1 or 3 will see all the servers on all sunbets, users on
+subnets 1 or 3 will see all the servers on all subnets, users on
 subnet 2 will still only see the servers on subnets 1 and 2, but not 3.
 
    
 Finally, the local master browser for subnet 2 (N2_B) will sync again
-with the domain master browser (N1_C) and will recieve the missing
+with the domain master browser (N1_C) and will receive the missing
 server entries.  Finally - and as a steady state (if no machines
 are removed or shut off) the browse lists will look like :
 
    
-
    -Subnet           Browse Master   List
-------           -------------   ----
-Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E, 
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*),
-                                 N3_A(*), N3_B(*), N3_C(*), N3_D(*)
-
-Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
-                                 N3_A(*), N3_B(*), N3_C(*), N3_D(*)
-
-Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*),
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*)
+
    Table 10.4. Browse subnet example 4
    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)
    
 	
 Servers with a (*) after them are non-authoritative names.
-
    
 
    
 Synchronizations between the domain master browser and local
 master browsers will continue to occur, but this should be a
@@ -2288,259 +3199,554 @@ If either router R1 or R2 fails the following will occur:
 	be able to access servers on its local subnet, by using subnet-isolated
 	broadcast NetBIOS name resolution.  The effects are similar to that of
 	losing access to a DNS server.
-

    Chapter 10. User information database

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    Gerald (Jerry) Carter

    Samba Team

    <jerry@samba.org>

    Jeremy Allison

    Samba Team

    <jra@samba.org>

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    Olivier (lem) Lemaire

    IDEALX

    <olem@IDEALX.org>

    February 2003

    Table of Contents

    Introduction
    Important Notes About Security
    Advantages of SMB Encryption
    Advantages of non-encrypted passwords
    The smbpasswd Command
    Plain text
    TDB
    LDAP
    Introduction
    Encrypted Password Database
    Supported LDAP Servers
    Schema and Relationship to the RFC 2307 posixAccount
    Configuring Samba with LDAP
    Accounts and Groups management
    Security and sambaAccount
    LDAP specials attributes for sambaAccounts
    Example LDIF Entries for a sambaAccount
    MySQL
    Creating the database
    Configuring
    Using plaintext passwords or encrypted password
    Getting non-column data from the table
    XML

    Introduction

    Old windows clients send plain text passwords over the wire. - Samba can check these passwords by crypting them and comparing them - to the hash stored in the unix user database. +

    Common Errors

    +Many questions are asked on the mailing lists regarding browsing. The majority of browsing +problems originate out of incorrect configuration of NetBIOS name resolution. Some are of +particular note. +

    How can one flush the Samba NetBIOS name cache without restarting Samba?

    +Samba's nmbd process controls all browse list handling. Under normal circumstances it is +safe to restart nmbd. This will effectively flush the Samba NetBIOS name cache and cause it +to be rebuilt. Note that this does NOT make certain that a rogue machine name will not re-appear +in the browse list. When nmbd is taken out of service another machine on the network will +become the browse master. This new list may still have the rogue entry in it. If you really +want to clear a rogue machine from the list then every machine on the network will need to be +shut down and restarted at after all machines are down. Failing a complete restart, the only +other thing you can do is wait until the entry times out and is then flushed from the list. +This may take a long time on some networks (months). +

    My client reports "This server is not configured to list shared resources"

    +Your guest account is probably invalid for some reason. Samba uses the +guest account for browsing in smbd. Check that your guest account is +valid. +

    See also guest account in the smb.conf man page.

    Chapter 11. Account Information Databases

    Jelmer R. Vernooij

    The Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Jeremy Allison

    Samba Team

    John H. Terpstra

    Samba Team

    Olivier (lem) Lemaire

    IDEALX

    May 24, 2003

    Table of Contents

    Features and Benefits
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and Unix
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon - Users not in Samba SAM
    Users are being added to the wrong backend database
    auth methods does not work

    +Samba-3 implements a new capability to work concurrently with multiple account backends. +The possible new combinations of password backends allows Samba-3 a degree of flexibility +and scalability that previously could be achieved only with MS Windows Active Directory. +This chapter describes the new functionality and how to get the most out of it. +

    +In the course of development of Samba-3, a number of requests were received to provide the +ability to migrate MS Windows NT4 SAM accounts to Samba-3 without the need to provide +matching Unix/Linux accounts. We called this the Non Unix Accounts (NUA) +capability. The intent was that an administrator could decide to use the tdbsam +backend and by simply specifying "passdb backend = tdbsam_nua, guest" +this would allow Samba-3 to implement a solution that did not use Unix accounts per se. Late +in the development cycle, the team doing this work hit upon some obstacles that prevents this +solution from being used. Given the delays with Samba-3 release a decision was made to NOT +deliver this functionality until a better method of recognising NT Group SIDs from NT User +SIDs could be found. This feature may thus return during the life cycle for the Samba-3 series. +

    Note

    +Samba-3.0.0 does NOT support Non-Unix Account (NUA) operation. +

    Features and Benefits

    +Samba-3 provides for complete backwards compatibility with Samba-2.2.x functionality +as follows: +

    Backwards Compatibility Backends

    Plain Text:

    + This option uses nothing but the Unix/Linux /etc/passwd + style back end. On systems that have PAM (Pluggable Authentication Modules) + support all PAM modules are supported. The behaviour is just as it was with + Samba-2.2.x, and the protocol limitations imposed by MS Windows clients + apply likewise. +

    smbpasswd:

    + This option allows continues use of the smbpasswd + file that maintains a plain ASCII (text) layout that includes the MS Windows + LanMan and NT encrypted passwords as well as a field that stores some + account information. This form of password backend does NOT store any of + the MS Windows NT/200x SAM (Security Account Manager) information needed to + provide the extended controls that are needed for more comprehensive + interoperation with MS Windows NT4 / 200x servers. +

    + This backend should be used only for backwards compatibility with older + versions of Samba. It may be deprecated in future releases. +

    ldapsam_compat (Samba-2.2 LDAP Compatibility):

    + There is a password backend option that allows continued operation with + a existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension. + This option is provided primarily as a migration tool, although there is + no reason to force migration at this time. Note that this tool will eventually + be deprecated. +

    +Samba-3 introduces the following new password backend capabilities: +

    New Backends

    guest:

    + This is always required as the last backend specified. + It provides the ability to handle guest account requirements for access to + resources like IPC$ which is used for browsing. +

    tdbsam:

    + This backend provides a rich database backend for local servers. This + backend is NOT suitable for multiple domain controller (ie: PDC + one + or more BDC) installations. +

    + The tdbsam password backend stores the old + smbpasswd information PLUS the extended MS Windows NT / 200x + SAM information into a binary format TDB (trivial database) file. + The inclusion of the extended information makes it possible for Samba-3 + to implement the same account and system access controls that are possible + with MS Windows NT4 and MS Windows 200x based systems. +

    + The inclusion of the tdbsam capability is a direct + response to user requests to allow simple site operation without the overhead + of the complexities of running OpenLDAP. It is recommended to use this only + for sites that have fewer than 250 users. For larger sites or implementations + the use of OpenLDAP or of Active Directory integration is strongly recommended. +

    ldapsam:

    + This provides a rich directory backend for distributed account installation. +

    + Samba-3 has a new and extended LDAP implementation that requires configuration + of OpenLDAP with a new format samba schema. The new format schema file is + included in the examples/LDAP directory of the Samba distribution. +

    + The new LDAP implementation significantly expands the control abilities that + were possible with prior versions of Samba. It is now possible to specify + "per user" profile settings, home directories, account access controls, and + much more. Corporate sites will see that the Samba-Team has listened to their + requests both for capability and to allow greater scalability. +

    mysqlsam (MySQL based backend):

    + It is expected that the MySQL based SAM will be very popular in some corners. + This database backend will be on considerable interest to sites that want to + leverage existing MySQL technology. +

    xmlsam (XML based datafile):

    + Allows the account and password data to be stored in an XML format + data file. This backend can not be used for normal operation, it can only + be used in conjunction with pdbedit's pdb2pdb + functionality. The DTD that is used might be subject to changes in the future. +

    + The xmlsam option can be useful for account migration between database + backends or backups. Use of this tool will allow the data to be edited before migration + into another backend format. +

    nisplussam:

    + The NIS+ based passdb backend. Takes name NIS domain as an + optional argument. Only works with Sun NIS+ servers. +

    Technical Information

    + Old windows clients send plain text passwords over the wire. Samba can check these + passwords by crypting them and comparing them to the hash stored in the unix user database.

    - Newer windows clients send encrypted passwords (so-called - Lanman and NT hashes) over - the wire, instead of plain text passwords. The newest clients - will only send encrypted passwords and refuse to send plain text - passwords, unless their registry is tweaked. -

    These passwords can't be converted to unix style encrypted - passwords. Because of that you can't use the standard unix - user database, and you have to store the Lanman and NT hashes - somewhere else.

    Next to a differently encrypted passwords, - windows also stores certain data for each user - that is not stored in a unix user database, e.g. - workstations the user may logon from, the location where his/her - profile is stored, etc. - Samba retrieves and stores this information using a "passdb backend". - Commonly - available backends are LDAP, plain text file, MySQL and nisplus. - For more information, see the documentation about the - passdb backend = parameter. -

    Important Notes About Security

    The unix and SMB password encryption techniques seem similar - on the surface. This similarity is, however, only skin deep. The unix - scheme typically sends clear text passwords over the network when - logging in. This is bad. The SMB encryption scheme never sends the - cleartext password over the network but it does store the 16 byte - hashed values on disk. This is also bad. Why? Because the 16 byte hashed - values are a "password equivalent". You cannot derive the user's - password from them, but they could potentially be used in a modified - client to gain access to a server. This would require considerable - technical knowledge on behalf of the attacker but is perfectly possible. - You should thus treat the data stored in whatever - passdb backend you use (smbpasswd file, ldap, mysql) as though it contained the - cleartext passwords of all your users. Its contents must be kept - secret, and the file should be protected accordingly.

    Ideally we would like a password scheme which neither requires - plain text passwords on the net or on disk. Unfortunately this - is not available as Samba is stuck with being compatible with - other SMB systems (WinNT, WfWg, Win95 etc).

    Warning

    Note that Windows NT 4.0 Service pack 3 changed the - default for permissible authentication so that plaintext - passwords are never sent over the wire. - The solution to this is either to switch to encrypted passwords - with Samba or edit the Windows NT registry to re-enable plaintext - passwords. See the document WinNT.txt for details on how to do - this.

    Other Microsoft operating systems which also exhibit - this behavior includes

    These versions of MS Windows do not support full domain - security protocols, although they may log onto a domain environment. - Of these Only MS Windows XP Home does NOT support domain logons.

    MS DOS Network client 3.0 with - the basic network redirector installed
    Windows 95 with the network redirector - update installed
    Windows 98 [se]
    Windows Me
    Windows XP Home

    The following versions of MS Windows fully support domain - security protocols.

    Windows NT 3.5x
    Windows NT 4.0
    Windows 2000 Professional
    Windows 200x Server/Advanced Server
    Windows XP Professional

    Note

    All current release of - Microsoft SMB/CIFS clients support authentication via the - SMB Challenge/Response mechanism described here. Enabling - clear text authentication does not disable the ability - of the client to participate in encrypted authentication.

    MS Windows clients will cache the encrypted password alone. - Even when plain text passwords are re-enabled, through the appropriate - registry change, the plain text password is NEVER cached. This means that - in the event that a network connections should become disconnected (broken) - only the cached (encrypted) password will be sent to the resource server - to affect a auto-reconnect. If the resource server does not support encrypted - passwords the auto-reconnect will fail. USE OF ENCRYPTED PASSWORDS - IS STRONGLY ADVISED.

    Advantages of SMB Encryption

    Plain text passwords are not passed across - the network. Someone using a network sniffer cannot just - record passwords going to the SMB server.
    WinNT doesn't like talking to a server - that does not support encrypted passwords. It will refuse - to browse the server if the server is also in user level - security mode. It will insist on prompting the user for the - password on each connection, which is very annoying. The - only things you can do to stop this is to use SMB encryption. -
    Encrypted password support allows automatic share - (resource) reconnects.

    Advantages of non-encrypted passwords

    Plain text passwords are not kept - on disk, and are NOT cached in memory.
    Uses same password file as other unix - services such as login and ftp
    Use of other services (such as telnet and ftp) which - send plain text passwords over the net, so sending them for SMB - isn't such a big deal.

    The smbpasswd Command

    The smbpasswd utility is a utility similar to the - passwd or yppasswd programs. - It maintains the two 32 byte password fields in the passdb backend.

    smbpasswd works in a client-server mode - where it contacts the local smbd to change the user's password on its - behalf. This has enormous benefits - as follows.

    smbpasswd has the capability - to change passwords on Windows NT servers (this only works when - the request is sent to the NT Primary Domain Controller if you - are changing an NT Domain user's password).

    To run smbpasswd as a normal user just type :

    $ smbpasswd

    Old SMB password: <type old value here - - or hit return if there was no old password>

    New SMB Password: <type new value> -

    Repeat New SMB Password: <re-type new value -

    If the old value does not match the current value stored for - that user, or the two new values do not match each other, then the - password will not be changed.

    If invoked by an ordinary user it will only allow the user - to change his or her own Samba password.

    If run by the root user smbpasswd may take an optional - argument, specifying the user name whose SMB password you wish to - change. Note that when run as root smbpasswd does not prompt for - or check the old password value, thus allowing root to set passwords - for users who have forgotten their passwords.

    smbpasswd is designed to work in the same way - and be familiar to UNIX users who use the passwd or - yppasswd commands.

    For more details on using smbpasswd refer - to the man page which will always be the definitive reference.

    Plain text

    -Older versions of samba retrieved user information from the unix user database -and eventually some other fields from the file /etc/samba/smbpasswd -or /etc/smbpasswd. When password encryption is disabled, no -data is stored at all. -

    TDB

    Samba can also store the user data in a "TDB" (Trivial Database). Using this backend -doesn't require any additional configuration. This backend is recommended for new installations that -don not require LDAP. -

    LDAP

    Introduction

    -This document describes how to use an LDAP directory for storing Samba user -account information traditionally stored in the smbpasswd(5) file. It is -assumed that the reader already has a basic understanding of LDAP concepts -and has a working directory server already installed. For more information -on LDAP architectures and Directories, please refer to the following sites. -

    -Note that O'Reilly Publishing is working on -a guide to LDAP for System Administrators which has a planned release date of -early summer, 2002. -

    -Two additional Samba resources which may prove to be helpful are -

    • The Samba-PDC-LDAP-HOWTO - maintained by Ignacio Coupeau.

    • The NT migration scripts from IDEALX that are - geared to manage users and group in such a Samba-LDAP Domain Controller configuration. -

    Encrypted Password Database

    -Traditionally, when configuring "encrypt -passwords = yes" in Samba's smb.conf file, user account -information such as username, LM/NT password hashes, password change times, and account -flags have been stored in the smbpasswd(5) file. There are several -disadvantages to this approach for sites with very large numbers of users (counted -in the thousands). -

    • -The first is that all lookups must be performed sequentially. Given that -there are approximately two lookups per domain logon (one for a normal -session connection such as when mapping a network drive or printer), this -is a performance bottleneck for large sites. What is needed is an indexed approach -such as is used in databases. -

    • -The second problem is that administrators who desired to replicate a -smbpasswd file to more than one Samba server were left to use external -tools such as rsync(1) and ssh(1) -and wrote custom, in-house scripts. -

    • -And finally, the amount of information which is stored in an -smbpasswd entry leaves no room for additional attributes such as -a home directory, password expiration time, or even a Relative -Identified (RID). -

    -As a result of these defeciencies, a more robust means of storing user attributes -used by smbd was developed. The API which defines access to user accounts -is commonly referred to as the samdb interface (previously this was called the passdb -API, and is still so named in the CVS trees). -

    -There are a few points to stress about that the ldapsam -does not provide. The LDAP support referred to in the this documentation does not -include: -

    • A means of retrieving user account information from - an Windows 2000 Active Directory server.

    • A means of replacing /etc/passwd.

    -The second item can be accomplished by using LDAP NSS and PAM modules. LGPL -versions of these libraries can be obtained from PADL Software -(http://www.padl.com/). More -information about the configuration of these packages may be found at "LDAP, -System Administration; Gerald Carter, O'Reilly; Chapter 6: Replacing NIS". -

    Supported LDAP Servers

    -The LDAP samdb code in 2.2.3 (and later) has been developed and tested -using the OpenLDAP 2.0 server and client libraries. -The same code should be able to work with Netscape's Directory Server -and client SDK. However, due to lack of testing so far, there are bound -to be compile errors and bugs. These should not be hard to fix. -If you are so inclined, please be sure to forward all patches to -samba-patches@samba.org and -jerry@samba.org. -

    Schema and Relationship to the RFC 2307 posixAccount

    -Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in -examples/LDAP/samba.schema. The sambaAccount objectclass is given here: + Newer windows clients send encrypted passwords (so-called Lanman and NT hashes) over + the wire, instead of plain text passwords. The newest clients will send only encrypted + passwords and refuse to send plain text passwords, unless their registry is tweaked. +

    + These passwords can't be converted to unix style encrypted passwords. Because of that, + you can't use the standard unix user database, and you have to store the Lanman and NT + hashes somewhere else. +

    + In addition to differently encrypted passwords, windows also stores certain data for each + user that is not stored in a unix user database. e.g: workstations the user may logon from, + the location where the users' profile is stored, and so on. Samba retrieves and stores this + information using a passdb backend. Commonly available backends are LDAP, plain text + file, MySQL and nisplus. For more information, see the man page for smb.conf regarding the + passdb backend parameter. +

    Important Notes About Security

    + The unix and SMB password encryption techniques seem similar on the surface. This + similarity is, however, only skin deep. The unix scheme typically sends clear text + passwords over the network when logging in. This is bad. The SMB encryption scheme + never sends the cleartext password over the network but it does store the 16 byte + hashed values on disk. This is also bad. Why? Because the 16 byte hashed values + are a "password equivalent". You cannot derive the user's password from them, but + they could potentially be used in a modified client to gain access to a server. + This would require considerable technical knowledge on behalf of the attacker but + is perfectly possible. You should thus treat the data stored in whatever passdb + backend you use (smbpasswd file, ldap, mysql) as though it contained the cleartext + passwords of all your users. Its contents must be kept secret, and the file should + be protected accordingly. +

    + Ideally we would like a password scheme that involves neither plain text passwords + on the net nor on disk. Unfortunately this is not available as Samba is stuck with + having to be compatible with other SMB systems (WinNT, WfWg, Win95 etc). +

    + Windows NT 4.0 Service pack 3 changed the default setting so that plaintext passwords + are disabled from being sent over the wire. This mandates either the use of encrypted + password support or edit the Windows NT registry to re-enable plaintext passwords. +

    + The following versions of MS Windows do not support full domain security protocols, + although they may log onto a domain environment: +

    MS DOS Network client 3.0 with the basic network redirector installed
    Windows 95 with the network redirector update installed
    Windows 98 [se]
    Windows Me

    Note

    + MS Windows XP Home does not have facilities to become a domain member and it can + not participate in domain logons. +

    + The following versions of MS Windows fully support domain security protocols. +

    Windows NT 3.5x
    Windows NT 4.0
    Windows 2000 Professional
    Windows 200x Server/Advanced Server
    Windows XP Professional

    + All current release of Microsoft SMB/CIFS clients support authentication via the + SMB Challenge/Response mechanism described here. Enabling clear text authentication + does not disable the ability of the client to participate in encrypted authentication. + Instead, it allows the client to negotiate either plain text _or_ encrypted password + handling. +

    + MS Windows clients will cache the encrypted password alone. Where plain text passwords + are re-enabled, through the appropriate registry change, the plain text password is NEVER + cached. This means that in the event that a network connections should become disconnected + (broken) only the cached (encrypted) password will be sent to the resource server to + affect a auto-reconnect. If the resource server does not support encrypted passwords the + auto-reconnect will fail. USE OF ENCRYPTED PASSWORDS IS STRONGLY ADVISED. +

    Advantages of Encrypted Passwords

    • Plain text passwords are not passed across + the network. Someone using a network sniffer cannot just + record passwords going to the SMB server.

    • Plain text passwords are not stored anywhere in + memory or on disk.

    • WinNT doesn't like talking to a server + that does not support encrypted passwords. It will refuse + to browse the server if the server is also in user level + security mode. It will insist on prompting the user for the + password on each connection, which is very annoying. The + only things you can do to stop this is to use SMB encryption. +

    • Encrypted password support allows automatic share + (resource) reconnects.

    • Encrypted passwords are essential for PDC/BDC + operation.

    Advantages of non-encrypted passwords

    • Plain text passwords are not kept + on disk, and are NOT cached in memory.

    • Uses same password file as other unix + services such as login and ftp

    • Use of other services (such as telnet and ftp) which + send plain text passwords over the net, so sending them for SMB + isn't such a big deal.

    Mapping User Identifiers between MS Windows and Unix

    + Every operation in Unix/Linux requires a user identifier (UID), just as in + MS Windows NT4 / 200x this requires a Security Identifier (SID). Samba provides + two means for mapping an MS Windows user to a Unix/Linux UID. +

    + Firstly, all Samba SAM (Security Account Manager database) accounts require + a Unix/Linux UID that the account will map to. As users are added to the account + information database, Samba-3 will call the add user script + interface to add the account to the Samba host OS. In essence, all accounts in + the local SAM require a local user account. +

    + The second way to affect Windows SID to Unix UID mapping is via the + idmap uid, idmap gid parameters in smb.conf. + Please refer to the man page for information about these parameters. + These parameters are essential when mapping users from a remote SAM server. +

    Account Management Tools

    +Samba-3 provides two (2) tools for management of User and machine accounts. These tools are +called smbpasswd and pdbedit. A third tool is under +development but is NOT expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK +GUI tool that looks much like the MS Windows NT4 Domain User Manager - hopefully this will +be announced in time for the Samba-3.0.1 release. +

    The smbpasswd Command

    + The smbpasswd utility is a utility similar to the passwd + or yppasswd programs. It maintains the two 32 byte password + fields in the passdb backend. +

    + smbpasswd works in a client-server mode where it contacts the + local smbd to change the user's password on its behalf. This has enormous benefits + as follows: +

    + smbpasswd has the capability to change passwords on Windows NT + servers (this only works when the request is sent to the NT Primary Domain Controller + if changing an NT Domain user's password). +

    + smbpasswd can be used to: +

    add user or machine accounts
    delete user or machine accounts
    enable user or machine accounts
    disable user or machine accounts
    set to NULL user passwords
    manage interdomain trust accounts

    + To run smbpasswd as a normal user just type: +

    + 

    +		$ smbpasswd
+		Old SMB password: secret
+

    + For secret type old value here - or hit return if + there was no old password + 

    +		New SMB Password: new secret
+		Repeat New SMB Password: new secret
+

    +

    + If the old value does not match the current value stored for that user, or the two + new values do not match each other, then the password will not be changed. +

    + When invoked by an ordinary user it will only allow change of their own + SMB password. +

    + When run by root smbpasswd may take an optional argument, specifying + the user name whose SMB password you wish to change. When run as root, smbpasswd + does not prompt for or check the old password value, thus allowing root to set passwords + for users who have forgotten their passwords. +

    + smbpasswd is designed to work in the way familiar to UNIX + users who use the passwd or yppasswd commands. + While designed for administrative use, this tool provides essential user level + password change capabilities. +

    + For more details on using smbpasswd refer to the man page (the + definitive reference). +

    The pdbedit Command

    + pdbedit is a tool that can be used only by root. It is used to + manage the passdb backend. pdbedit can be used to: +

    add, remove or modify user accounts
    listing user accounts
    migrate user accounts

    + The pdbedit tool is the only one that can manage the account + security and policy settings. It is capable of all operations that smbpasswd can + do as well as a super set of them. +

    + One particularly important purpose of the pdbedit is to allow + the migration of account information from one passdb backend to another. See the + XML password backend section of this chapter. +

    + The following is an example of the user account information that is stored in + a tdbsam password backend. This listing was produced by running: + 

    +		$ pdbedit -Lv met
+		Unix username:        met
+		NT username:
+		Account Flags:        [UX         ]
+		User SID:             S-1-5-21-1449123459-1407424037-3116680435-2004
+		Primary Group SID:    S-1-5-21-1449123459-1407424037-3116680435-1201
+		Full Name:            Melissa E Terpstra
+		Home Directory:       \\frodo\met\Win9Profile
+		HomeDir Drive:        H:
+		Logon Script:         scripts\logon.bat
+		Profile Path:         \\frodo\Profiles\met
+		Domain:               MIDEARTH
+		Account desc:
+		Workstations:         melbelle
+		Munged dial:
+		Logon time:           0
+		Logoff time:          Mon, 18 Jan 2038 20:14:07 GMT
+		Kickoff time:         Mon, 18 Jan 2038 20:14:07 GMT
+		Password last set:    Sat, 14 Dec 2002 14:37:03 GMT
+		Password can change:  Sat, 14 Dec 2002 14:37:03 GMT
+		Password must change: Mon, 18 Jan 2038 20:14:07 GMT
+

    Password Backends

    +Samba-3 offers the greatest flexibility in backend account database design of any SMB/CIFS server +technology available today. The flexibility is immediately obvious as one begins to explore this +capability. +

    +It is possible to specify not only multiple different password backends, but even multiple +backends of the same type. For example, to use two different tdbsam databases: +

    -objectclass ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top AUXILIARY
-     DESC 'Samba Account'
-     MUST ( uid $ rid )
-     MAY  ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
-            logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
-            displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
-            description $ userWorkstations $ primaryGroupID $ domain ))
-

    -The samba.schema file has been formatted for OpenLDAP 2.0. The OID's are -owned by the Samba Team and as such is legal to be openly published. -If you translate the schema to be used with Netscape DS, please -submit the modified schema file as a patch to jerry@samba.org -

    -Just as the smbpasswd file is meant to store information which supplements a -user's /etc/passwd entry, so is the sambaAccount object -meant to supplement the UNIX user account information. A sambaAccount is a -STRUCTURAL objectclass so it can be stored individually -in the directory. However, there are several fields (e.g. uid) which overlap -with the posixAccount objectclass outlined in RFC2307. This is by design. -

    -In order to store all user account information (UNIX and Samba) in the directory, -it is necessary to use the sambaAccount and posixAccount objectclasses in -combination. However, smbd will still obtain the user's UNIX account -information via the standard C library calls (e.g. getpwnam(), et. al.). -This means that the Samba server must also have the LDAP NSS library installed -and functioning correctly. This division of information makes it possible to -store all Samba account information in LDAP, but still maintain UNIX account -information in NIS while the network is transitioning to a full LDAP infrastructure. -

    Configuring Samba with LDAP

    OpenLDAP configuration

    -To include support for the sambaAccount object in an OpenLDAP directory -server, first copy the samba.schema file to slapd's configuration directory. -

    -root# cp samba.schema /etc/openldap/schema/ -

    -Next, include the samba.schema file in slapd.conf. -The sambaAccount object contains two attributes which depend upon other schema -files. The 'uid' attribute is defined in cosine.schema and -the 'displayName' attribute is defined in the inetorgperson.schema -file. Both of these must be included before the samba.schema file. +[globals] + passdb backend = tdbsam:/etc/samba/passdb.tdb, \ + tdbsam:/etc/samba/old-passdb.tdb, guest +

    +

    Plain Text

    + Older versions of Samba retrieved user information from the unix user database + and eventually some other fields from the file /etc/samba/smbpasswd + or /etc/smbpasswd. When password encryption is disabled, no + SMB specific data is stored at all. Instead all operations are conducted via the way + that the Samba host OS will access its /etc/passwd database. + eg: On Linux systems that is done via PAM. +

    smbpasswd - Encrypted Password Database

    + Traditionally, when configuring encrypt + passwords = yes in Samba's smb.conf file, user account + information such as username, LM/NT password hashes, password change times, and account + flags have been stored in the smbpasswd(5) file. There are several + disadvantages to this approach for sites with very large numbers of users (counted + in the thousands). +

    • + The first is that all lookups must be performed sequentially. Given that + there are approximately two lookups per domain logon (one for a normal + session connection such as when mapping a network drive or printer), this + is a performance bottleneck for large sites. What is needed is an indexed approach + such as is used in databases. +

    • + The second problem is that administrators who desire to replicate a smbpasswd file + to more than one Samba server were left to use external tools such as + rsync(1) and ssh(1) and wrote custom, + in-house scripts. +

    • + And finally, the amount of information which is stored in an smbpasswd entry leaves + no room for additional attributes such as a home directory, password expiration time, + or even a Relative Identifier (RID). +

    + As a result of these deficiencies, a more robust means of storing user attributes + used by smbd was developed. The API which defines access to user accounts + is commonly referred to as the samdb interface (previously this was called the passdb + API, and is still so named in the Samba CVS trees). +

    + Samba-3 provides an enhanced set of passdb backends that overcome the deficiencies + of the smbpasswd plain text database. These are tdbsam, ldapsam, and xmlsam. + Of these ldapsam will be of most interest to large corporate or enterprise sites. +

    tdbsam

    Samba can store user and machine account data in a "TDB" (Trivial Database). + Using this backend doesn't require any additional configuration. This backend is + recommended for new installations that do not require LDAP. +

    + As a general guide the Samba-Team does NOT recommend using the tdbsam backend for sites + that have 250 or more users. Additionally, tdbsam is not capable of scaling for use + in sites that require PDB/BDC implementations that requires replication of the account + database. Clearly, for reason of scalability, the use of ldapsam should be encouraged. +

    ldapsam

    + There are a few points to stress that the ldapsam does not provide. The LDAP + support referred to in the this documentation does not include: +

    • A means of retrieving user account information from + an Windows 200x Active Directory server.

    • A means of replacing /etc/passwd.

    + The second item can be accomplished by using LDAP NSS and PAM modules. LGPL + versions of these libraries can be obtained from PADL Software + (http://www.padl.com/). More + information about the configuration of these packages may be found at "LDAP, + System Administration; Gerald Carter, O'Reilly; Chapter 6: Replacing NIS". + Refer to + http://safari.oreilly.com/?XmlId=1-56592-491-6 for those who might wish to know + more about configuration and administration of an OpenLDAP server. +

    Note

    + This section is outdated for Samba-3 schema. Samba-3 introduces a new schema + that has not been documented at the time of this publication. +

    + This document describes how to use an LDAP directory for storing Samba user + account information traditionally stored in the smbpasswd(5) file. It is + assumed that the reader already has a basic understanding of LDAP concepts + and has a working directory server already installed. For more information + on LDAP architectures and Directories, please refer to the following sites. +

    + Two additional Samba resources which may prove to be helpful are +

    • The Samba-PDC-LDAP-HOWTO + maintained by Ignacio Coupeau.

    • The NT migration scripts from IDEALX that are + geared to manage users and group in such a Samba-LDAP Domain Controller configuration. +

    Supported LDAP Servers

    + The LDAP ldapsam code has been developed and tested using the OpenLDAP 2.0 and 2.1 server and + client libraries. The same code should work with Netscape's Directory Server and client SDK. + However, there are bound to be compile errors and bugs. These should not be hard to fix. + Please submit fixes via Bug reporting facility. +

    Schema and Relationship to the RFC 2307 posixAccount

    + Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in + examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: +

    +

    +objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY
+    DESC 'Samba Auxiliary Account'
+    MUST ( uid $ rid )
+    MAY  ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
+           logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
+           displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
+           description $ userWorkstations $ primaryGroupID $ domain ))
+

    +

    + The samba.schema file has been formatted for OpenLDAP 2.0/2.1. + The OID's are owned by the Samba Team and as such is legal to be openly published. + If you translate the schema to be used with Netscape DS, please + submit the modified schema file as a patch to + jerry@samba.org. +

    + Just as the smbpasswd file is meant to store information which supplements a + user's /etc/passwd entry, so is the sambaSamAccount object + meant to supplement the UNIX user account information. A sambaSamAccount is a + STRUCTURAL objectclass so it can be stored individually + in the directory. However, there are several fields (e.g. uid) which overlap + with the posixAccount objectclass outlined in RFC2307. This is by design. +

    + In order to store all user account information (UNIX and Samba) in the directory, + it is necessary to use the sambaSamAccount and posixAccount objectclasses in + combination. However, smbd will still obtain the user's UNIX account + information via the standard C library calls (e.g. getpwnam(), et. al.). + This means that the Samba server must also have the LDAP NSS library installed + and functioning correctly. This division of information makes it possible to + store all Samba account information in LDAP, but still maintain UNIX account + information in NIS while the network is transitioning to a full LDAP infrastructure. +

    OpenLDAP configuration

    + To include support for the sambaSamAccount object in an OpenLDAP directory + server, first copy the samba.schema file to slapd's configuration directory. + The samba.schema file can be found in the directory examples/LDAP + in the samba source distribution. +

    +

    +root# cp samba.schema /etc/openldap/schema/
+

    +

    + Next, include the samba.schema file in slapd.conf. + The sambaSamAccount object contains two attributes which depend upon other schema + files. The 'uid' attribute is defined in cosine.schema and + the 'displayName' attribute is defined in the inetorgperson.schema + file. Both of these must be included before the samba.schema file. + 

     ## /etc/openldap/slapd.conf
 
 ## schema files (core.schema is required by default)
 include	           /etc/openldap/schema/core.schema
 
-## needed for sambaAccount
+## needed for sambaSamAccount
 include            /etc/openldap/schema/cosine.schema
 include            /etc/openldap/schema/inetorgperson.schema
 include            /etc/openldap/schema/samba.schema
 include            /etc/openldap/schema/nis.schema
-
 ....

    -It is recommended that you maintain some indices on some of the most usefull attributes, -like in the following example, to speed up searches made on sambaAccount objectclasses -(and possibly posixAccount and posixGroup as well). -

    +
    
+		It is recommended that you maintain some indices on some of the most useful attributes,
+		like in the following example, to speed up searches made on sambaSamAccount objectclasses
+		(and possibly posixAccount and posixGroup as well).
+		
    
+
     # Indices to maintain
-## required by OpenLDAP 2.0
-index objectclass   eq
+## required by OpenLDAP
+index objectclass             eq
 
-## support pb_getsampwnam()
-index uid           pres,eq
-## support pdb_getsambapwrid()
-index rid           eq
+index cn                      pres,sub,eq
+index sn                      pres,sub,eq
+## required to support pdb_getsampwnam
+index uid                     pres,sub,eq
+## required to support pdb_getsambapwrid()
+index displayName             pres,sub,eq
 
 ## uncomment these if you are storing posixAccount and
 ## posixGroup entries in the directory as well
-##index uidNumber     eq
-##index gidNumber     eq
-##index cn            eq
-##index memberUid     eq
-
-# (both fetched via ldapsearch):
-index   primaryGroupID  eq
-index   displayName     pres,eq
-
-

    Configuring Samba

    -The following parameters are available in smb.conf only with --with-ldapsam -was included when compiling Samba. -

    -These are described in the smb.conf(5) man -page and so will not be repeated here. However, a sample smb.conf file for -use with an LDAP directory could appear as +##index uidNumber eq +##index gidNumber eq +##index memberUid eq + +index sambaSID eq +index sambaPrimaryGroupSID eq +index sambaDomainName eq +index default sub +

    +

    + Create the new index by executing: +

    +

    +./sbin/slapindex -f slapd.conf
+

    +

    + Remember to restart slapd after making these changes: +

    +

    +root# /etc/init.d/slapd restart
+

    +

    Initialise the LDAP database

    + Before you can add accounts to the LDAP database you must create the account containers + that they will be stored in. The following LDIF file should be modified to match your + needs (ie: Your DNS entries, etc.). +

    +

    +# Organization for Samba Base
+dn: dc=plainjoe,dc=org
+objectclass: dcObject
+objectclass: organization
+dc: plainjoe
+o: Terpstra Org Network
+description: The Samba-3 Network LDAP Example
+
+# Organizational Role for Directory Management
+dn: cn=Manager,dc=plainjoe,dc=org
+objectclass: organizationalRole
+cn: Manager
+description: Directory Manager
+
+# Setting up container for users
+dn: ou=People,dc=plainjoe,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: People
+
+# Setting up admin handle for People OU
+dn: cn=admin,ou=People,dc=plainjoe,dc=org
+cn: admin
+objectclass: top
+objectclass: organizationalRole
+objectclass: simpleSecurityObject
+userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz
+

    +

    + The userPassword shown above should be generated using slappasswd. +

    + The following command will then load the contents of the LDIF file into the LDAP + database. +

    +

    +$ slapadd -v -l initldap.dif
+

    +

    + Do not forget to secure your LDAP server with an adequate access control list, + as well as an admin password. +

    Note

    + Before Samba can access the LDAP server you need to store the LDAP admin password + into the Samba-3 secrets.tdb database by: + 

    +root#  smbpasswd -w secret
+

    +

    Configuring Samba

    + The following parameters are available in smb.conf only if your + version of samba was built with LDAP support. Samba automatically builds with LDAP support if the + LDAP libraries are found. +

    + These are described in the smb.conf man + page and so will not be repeated here. However, a sample smb.conf file for + use with an LDAP directory could appear as + 

     ## /usr/local/samba/lib/smb.conf
 [global]
@@ -2554,7 +3760,7 @@ use with an LDAP directory could appear as
 
      # define the DN to use when binding to the directory servers
      # The password for this DN is not stored in smb.conf.  Rather it
-     # must be set by using 'smbpasswd -w secretpw' to store the
+     # must be set by using 'smbpasswd -w secretpw' to store the
      # passphrase in the secrets.tdb file.  If the "ldap admin dn" values
      # change, this password will need to be reset.
      ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"
@@ -2563,1648 +3769,7743 @@ use with an LDAP directory could appear as
      # ('off', 'start tls', or 'on' (default))
      ldap ssl = start tls
 
-     passdb backend ldapsam:ldap://ahab.samba.org
+     # syntax: passdb backend = ldapsam:ldap://server-name[:port]
+     passdb backend = ldapsam:ldap://funball.samba.org, guest
 
      # smbpasswd -x delete the entire dn-entry
      ldap delete dn = no
 
      # the machine and user suffix added to the base suffix
-     # wrote WITHOUT quotes. NULL siffixes by default
+     # wrote WITHOUT quotes. NULL suffixes by default
      ldap user suffix = ou=People
      ldap machine suffix = ou=Systems
 
-     # define the port to use in the LDAP session (defaults to 636 when
-     # "ldap ssl = on")
-     ldap port = 389
+     # Trust unix account information in LDAP
+     #  (see the smb.conf manpage for details)
+     ldap trust ids = Yes
 
      # specify the base DN to use when searching the directory
      ldap suffix = "ou=people,dc=samba,dc=org"
 
      # generally the default ldap search filter is ok
-     # ldap filter = "(&(uid=%u)(objectclass=sambaAccount))"
-

    Accounts and Groups management

    -As users accounts are managed thru the sambaAccount objectclass, you should -modify your existing administration tools to deal with sambaAccount attributes. -

    -Machines accounts are managed with the sambaAccount objectclass, just -like users accounts. However, it's up to you to store thoses accounts -in a different tree of you LDAP namespace: you should use -"ou=Groups,dc=plainjoe,dc=org" to store groups and -"ou=People,dc=plainjoe,dc=org" to store users. Just configure your -NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration -file). -

    -In Samba release 3.0, the group management system is based on posix -groups. This means that Samba makes usage of the posixGroup objectclass. -For now, there is no NT-like group system management (global and local -groups). -

    Security and sambaAccount

    -There are two important points to remember when discussing the security -of sambaAccount entries in the directory. -

    • Never retrieve the lmPassword or - ntPassword attribute values over an unencrypted LDAP session.

    • Never allow non-admin users to - view the lmPassword or ntPassword attribute values.

    -These password hashes are clear text equivalents and can be used to impersonate -the user without deriving the original clear text strings. For more information -on the details of LM/NT password hashes, refer to the User Database of the Samba-HOWTO-Collection. -

    -To remedy the first security issue, the "ldap ssl" smb.conf parameter defaults -to require an encrypted session (ldap ssl = on) using -the default port of 636 -when contacting the directory server. When using an OpenLDAP 2.0 server, it -is possible to use the use the StartTLS LDAP extended operation in the place of -LDAPS. In either case, you are strongly discouraged to disable this security -(ldap ssl = off). -

    -Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS -extended operation. However, the OpenLDAP library still provides support for -the older method of securing communication between clients and servers. -

    -The second security precaution is to prevent non-administrative users from -harvesting password hashes from the directory. This can be done using the -following ACL in slapd.conf: + # ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))" +

    +

    Accounts and Groups management

    + As users accounts are managed through the sambaSamAccount objectclass, you should + modify your existing administration tools to deal with sambaSamAccount attributes. +

    + Machines accounts are managed with the sambaSamAccount objectclass, just + like users accounts. However, it's up to you to store those accounts + in a different tree of your LDAP namespace: you should use + "ou=Groups,dc=plainjoe,dc=org" to store groups and + "ou=People,dc=plainjoe,dc=org" to store users. Just configure your + NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration + file). +

    + In Samba release 3.0, the group management system is based on POSIX + groups. This means that Samba makes use of the posixGroup objectclass. + For now, there is no NT-like group system management (global and local + groups). +

    Security and sambaSamAccount

    + There are two important points to remember when discussing the security + of sambaSamAccount entries in the directory. +

    • Never retrieve the lmPassword or + ntPassword attribute values over an unencrypted LDAP session.

    • Never allow non-admin users to + view the lmPassword or ntPassword attribute values.

    + These password hashes are clear text equivalents and can be used to impersonate + the user without deriving the original clear text strings. For more information + on the details of LM/NT password hashes, refer to the + Account Information Database section of this chapter. +

    + To remedy the first security issue, the ldap ssl smb.conf parameter defaults + to require an encrypted session (ldap ssl = on) using + the default port of 636 + when contacting the directory server. When using an OpenLDAP server, it + is possible to use the use the StartTLS LDAP extended operation in the place of + LDAPS. In either case, you are strongly discouraged to disable this security + (ldap ssl = off). +

    + Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS + extended operation. However, the OpenLDAP library still provides support for + the older method of securing communication between clients and servers. +

    + The second security precaution is to prevent non-administrative users from + harvesting password hashes from the directory. This can be done using the + following ACL in slapd.conf: + 

     ## allow the "ldap admin dn" access, but deny everyone else
 access to attrs=lmPassword,ntPassword
      by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write
      by * none
-

    LDAP specials attributes for sambaAccounts

    -The sambaAccount objectclass is composed of the following attributes: -

    • lmPassword: the LANMAN password 16-byte hash stored as a character - representation of a hexidecimal string.

    • ntPassword: the NT password hash 16-byte stored as a character - representation of a hexidecimal string.

    • pwdLastSet: The integer time in seconds since 1970 when the - lmPassword and ntPassword attributes were last set. -

    • acctFlags: string of 11 characters surrounded by square brackets [] - representing account flags such as U (user), W(workstation), X(no password expiration), and - D(disabled).

    • logonTime: Integer value currently unused

    • logoffTime: Integer value currently unused

    • kickoffTime: Integer value currently unused

    • pwdCanChange: Integer value currently unused

    • pwdMustChange: Integer value currently unused

    • homeDrive: specifies the drive letter to which to map the - UNC path specified by homeDirectory. The drive letter must be specified in the form "X:" - where X is the letter of the drive to map. Refer to the "logon drive" parameter in the - smb.conf(5) man page for more information.

    • scriptPath: The scriptPath property specifies the path of - the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path - is relative to the netlogon share. Refer to the "logon script" parameter in the - smb.conf(5) man page for more information.

    • profilePath: specifies a path to the user's profile. - This value can be a null string, a local absolute path, or a UNC path. Refer to the - "logon path" parameter in the smb.conf(5) man page for more information.

    • smbHome: The homeDirectory property specifies the path of - the home directory for the user. The string can be null. If homeDrive is set and specifies - a drive letter, homeDirectory should be a UNC path. The path must be a network - UNC path of the form \\server\share\directory. This value can be a null string. - Refer to the "logon home" parameter in the smb.conf(5) man page for more information. -

    • userWorkstation: character string value currently unused. -

    • rid: the integer representation of the user's relative identifier - (RID).

    • primaryGroupID: the relative identifier (RID) of the primary group - of the user.

    -The majority of these parameters are only used when Samba is acting as a PDC of -a domain (refer to the Samba-PDC-HOWTO for details on -how to configure Samba as a Primary Domain Controller). The following four attributes -are only stored with the sambaAccount entry if the values are non-default values: -

    • smbHome

    • scriptPath

    • logonPath

    • homeDrive

    -These attributes are only stored with the sambaAccount entry if -the values are non-default values. For example, assume TASHTEGO has now been -configured as a PDC and that logon home = \\%L\%u was defined in -its smb.conf file. When a user named "becky" logons to the domain, -the logon home string is expanded to \\TASHTEGO\becky. -If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", -this value is used. However, if this attribute does not exist, then the value -of the logon home parameter is used in its place. Samba -will only write the attribute value to the directory entry if the value is -something other than the default (e.g. \\MOBY\becky). -

    Example LDIF Entries for a sambaAccount

    -The following is a working LDIF with the inclusion of the posixAccount objectclass: -

    -dn: uid=guest2, ou=people,dc=plainjoe,dc=org
-ntPassword: 878D8014606CDA29677A44EFA1353FC7
-pwdMustChange: 2147483647
-primaryGroupID: 1201
-lmPassword: 552902031BEDE9EFAAD3B435B51404EE
-pwdLastSet: 1010179124
-logonTime: 0
-objectClass: sambaAccount
-uid: guest2
-kickoffTime: 2147483647
-acctFlags: [UX         ]
-logoffTime: 2147483647
-rid: 19006
-pwdCanChange: 0
-

    -The following is an LDIF entry for using both the sambaAccount and -posixAccount objectclasses: -

    -dn: uid=gcarter, ou=people,dc=plainjoe,dc=org
-logonTime: 0
-displayName: Gerald Carter
-lmPassword: 552902031BEDE9EFAAD3B435B51404EE
-primaryGroupID: 1201
-objectClass: posixAccount
-objectClass: sambaAccount
-acctFlags: [UX         ]
-userPassword: {crypt}BpM2ej8Rkzogo
-uid: gcarter
-uidNumber: 9000
-cn: Gerald Carter
-loginShell: /bin/bash
-logoffTime: 2147483647
-gidNumber: 100
-kickoffTime: 2147483647
-pwdLastSet: 1010179230
-rid: 19000
-homeDirectory: /home/tashtego/gcarter
-pwdCanChange: 0
-pwdMustChange: 2147483647
-ntPassword: 878D8014606CDA29677A44EFA1353FC7
-

    MySQL

    Creating the database

    -You either can set up your own table and specify the field names to pdb_mysql (see below -for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump -contains the correct queries to create the required tables. Use the command : - -mysql -uusername -hhostname -ppassword databasename > /path/to/samba/examples/pdb/mysql/mysql.dump - -

    Configuring

    This plugin lacks some good documentation, but here is some short info:

    Add a the following to the passdb backend variable in your smb.conf: -

    -passdb backend = [other-plugins] mysql:identifier [other-plugins]

    -

    The identifier can be any string you like, as long as it doesn't collide with -the identifiers of other plugins or other instances of pdb_mysql. If you -specify multiple pdb_mysql.so entries in 'passdb backend', you also need to -use different identifiers! -

    -Additional options can be given thru the smb.conf file in the [global] section. -

    -identifier:mysql host                     - host name, defaults to 'localhost'
-identifier:mysql password
-identifier:mysql user                     - defaults to 'samba'
-identifier:mysql database                 - defaults to 'samba'
-identifier:mysql port                     - defaults to 3306
-identifier:table                          - Name of the table containing users
-

    Warning

    -Since the password for the mysql user is stored in the -smb.conf file, you should make the the smb.conf file -readable only to the user that runs samba. This is considered a security -bug and will be fixed soon. -

    Names of the columns in this table(I've added column types those columns should have first):

    -identifier:logon time column             - int(9)
-identifier:logoff time column            - int(9)
-identifier:kickoff time column           - int(9)
-identifier:pass last set time column     - int(9)
-identifier:pass can change time column   - int(9)
-identifier:pass must change time column  - int(9)
-identifier:username column               - varchar(255) - unix username
-identifier:domain column                 - varchar(255) - NT domain user is part of
-identifier:nt username column            - varchar(255) - NT username
-identifier:fullname column               - varchar(255) - Full name of user
-identifier:home dir column               - varchar(255) - Unix homedir path
-identifier:dir drive column              - varchar(2)   - Directory drive path (eg: 'H:')
-identifier:logon script column           - varchar(255)
-					 - Batch file to run on client side when logging on
-identifier:profile path column           - varchar(255) - Path of profile
-identifier:acct desc column              - varchar(255) - Some ASCII NT user data
-identifier:workstations column           - varchar(255)
-					 - Workstations user can logon to (or NULL for all)
-identifier:unknown string column         - varchar(255) - unknown string
-identifier:munged dial column            - varchar(255) - ?
-identifier:user sid column               - varchar(255) - NT user SID
-identifier:group sid column              - varchar(255) - NT group ID
-identifier:lanman pass column            - varchar(255) - encrypted lanman password
-identifier:nt pass column                - varchar(255) - encrypted nt passwd
-identifier:plain pass column             - varchar(255) - plaintext password
-identifier:acct control column           - int(9) - nt user data
-identifier:unknown 3 column              - int(9) - unknown
-identifier:logon divs column             - int(9) - ?
-identifier:hours len column              - int(9) - ?
-identifier:unknown 5 column              - int(9) - unknown
-identifier:unknown 6 column              - int(9) - unknown
-

    -Eventually, you can put a colon (:) after the name of each column, which -should specify the column to update when updating the table. You can also -specify nothing behind the colon - then the data from the field will not be -updated. -

    Using plaintext passwords or encrypted password

    -I strongly discourage the use of plaintext passwords, however, you can use them: -

    -If you would like to use plaintext passwords, set -'identifier:lanman pass column' and 'identifier:nt pass column' to -'NULL' (without the quotes) and 'identifier:plain pass column' to the -name of the column containing the plaintext passwords. -

    -If you use encrypted passwords, set the 'identifier:plain pass -column' to 'NULL' (without the quotes). This is the default. -

    Getting non-column data from the table

    -It is possible to have not all data in the database and making some 'constant'. -

    -For example, you can set 'identifier:fullname column' to : -CONCAT(First_name,' ',Sur_name) -

    -Or, set 'identifier:workstations column' to : -NULL

    See the MySQL documentation for more language constructs.

    XML

    This module requires libxml2 to be installed.

    The usage of pdb_xml is pretty straightforward. To export data, use: -

    - pdbedit -e xml:filename -

    -(where filename is the name of the file to put the data in) -

    -To import data, use: -pdbedit -i xml:filename -e current-pdb -

    -Where filename is the name to read the data from and current-pdb to put it in. -

    Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists

    Jeremy Allison

    Samba Team

    <jra@samba.org>

    12 Apr 1999

    Table of Contents

    Viewing and changing UNIX permissions using the NT - security dialogs
    How to view file security on a Samba share
    Viewing file ownership
    Viewing file or directory permissions
    File Permissions
    Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute - mapping

    Viewing and changing UNIX permissions using the NT - security dialogs

    Windows NT clients can use their native security settings - dialog box to view and modify the underlying UNIX permissions.

    Note that this ability is careful not to compromise - the security of the UNIX host Samba is running on, and - still obeys all the file permission rules that a Samba - administrator can set.

    Note

    - All access to Unix/Linux system file via Samba is controlled at - the operating system file access control level. When trying to - figure out file access problems it is vitally important to identify - the identity of the Windows user as it is presented by Samba at - the point of file access. This can best be determined from the - Samba log files. -

    How to view file security on a Samba share

    From an NT4/2000/XP client, single-click with the right - mouse button on any file or directory in a Samba mounted - drive letter or UNC path. When the menu pops-up, click - on the Properties entry at the bottom of - the menu. This brings up the file properties dialog - box. Click on the tab Security and you - will see three buttons, Permissions, - Auditing, and Ownership. - The Auditing button will cause either - an error message A requested privilege is not held - by the client to appear if the user is not the - NT Administrator, or a dialog which is intended to allow an - Administrator to add auditing requirements to a file if the - user is logged on as the NT Administrator. This dialog is - non-functional with a Samba share at this time, as the only - useful button, the Add button will not currently - allow a list of users to be seen.

    Viewing file ownership

    Clicking on the "Ownership" button - brings up a dialog box telling you who owns the given file. The - owner name will be of the form :

    "SERVER\user (Long name)"

    Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database). Click on the Close - button to remove this dialog.

    If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone".

    The Take Ownership button will not allow - you to change the ownership of this file to yourself (clicking on - it will display a dialog box complaining that the user you are - currently logged onto the NT client cannot be found). The reason - for this is that changing the ownership of a file is a privileged - operation in UNIX, available only to the root - user. As clicking on this button causes NT to attempt to change - the ownership of a file to the current user logged into the NT - client this will not work with Samba at this time.

    There is an NT chown command that will work with Samba - and allow a user with Administrator privilege connected - to a Samba server as root to change the ownership of - files on both a local NTFS filesystem or remote mounted NTFS - or Samba drive. This is available as part of the Seclib - NT security library written by Jeremy Allison of - the Samba Team, available from the main Samba ftp site.

    Viewing file or directory permissions

    The third button is the "Permissions" - button. Clicking on this brings up a dialog box that shows both - the permissions and the UNIX owner of the file or directory. - The owner is displayed in the form :

    "SERVER\user (Long name)"

    Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database).

    If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone" and the - permissions will be shown as NT "Full Control".

    The permissions field is displayed differently for files - and directories, so I'll describe the way file permissions - are displayed first.

    File Permissions

    The standard UNIX user/group/world triple and - the corresponding "read", "write", "execute" permissions - triples are mapped by Samba into a three element NT ACL - with the 'r', 'w', and 'x' bits mapped into the corresponding - NT permissions. The UNIX world permissions are mapped into - the global NT group Everyone, followed - by the list of permissions allowed for UNIX world. The UNIX - owner and group permissions are displayed as an NT - user icon and an NT local - group icon respectively followed by the list - of permissions allowed for the UNIX user and group.

    As many UNIX permission sets don't map into common - NT names such as "read", - "change" or "full control" then - usually the permissions will be prefixed by the words - "Special Access" in the NT display list.

    But what happens if the file has no permissions allowed - for a particular UNIX user group or world component ? In order - to allow "no permissions" to be seen and modified then Samba - overloads the NT "Take Ownership" ACL attribute - (which has no meaning in UNIX) and reports a component with - no permissions as having the NT "O" bit set. - This was chosen of course to make it look like a zero, meaning - zero permissions. More details on the decision behind this will - be given below.

    Directory Permissions

    Directories on an NT NTFS file system have two - different sets of permissions. The first set of permissions - is the ACL set on the directory itself, this is usually displayed - in the first set of parentheses in the normal "RW" - NT style. This first set of permissions is created by Samba in - exactly the same way as normal file permissions are, described - above, and is displayed in the same way.

    The second set of directory permissions has no real meaning - in the UNIX permissions world and represents the - "inherited" permissions that any file created within - this directory would inherit.

    Samba synthesises these inherited permissions for NT by - returning as an NT ACL the UNIX permission mode that a new file - created by Samba on this share would receive.

    Modifying file or directory permissions

    Modifying file and directory permissions is as simple - as changing the displayed permissions in the dialog box, and - clicking the OK button. However, there are - limitations that a user needs to be aware of, and also interactions - with the standard Samba permission masks and mapping of DOS - attributes that need to also be taken into account.

    If the parameter nt acl support - is set to false then any attempt to set - security permissions will fail with an "Access Denied" - message.

    The first thing to note is that the "Add" - button will not return a list of users in Samba (it will give - an error message of "The remote procedure call failed - and did not execute"). This means that you can only - manipulate the current user/group/world permissions listed in - the dialog box. This actually works quite well as these are the - only permissions that UNIX actually has.

    If a permission triple (either user, group, or world) - is removed from the list of permissions in the NT dialog box, - then when the "OK" button is pressed it will - be applied as "no permissions" on the UNIX side. If you then - view the permissions again the "no permissions" entry will appear - as the NT "O" flag, as described above. This - allows you to add permissions back to a file or directory once - you have removed them from a triple component.

    As UNIX supports only the "r", "w" and "x" bits of - an NT ACL then if other NT security attributes such as "Delete - access" are selected then they will be ignored when applied on - the Samba server.

    When setting permissions on a directory the second - set of permissions (in the second set of parentheses) is - by default applied to all files within that directory. If this - is not what you want you must uncheck the "Replace - permissions on existing files" checkbox in the NT - dialog before clicking "OK".

    If you wish to remove all permissions from a - user/group/world component then you may either highlight the - component and click the "Remove" button, - or set the component to only have the special "Take - Ownership" permission (displayed as "O" - ) highlighted.

    Interaction with the standard Samba create mask - parameters

    There are four parameters - to control interaction with the standard Samba create mask parameters. - These are :

    security mask

    force security mode

    directory security mask

    force directory security mode

    Once a user clicks "OK" to apply the - permissions Samba maps the given permissions into a user/group/world - r/w/x triple set, and then will check the changed permissions for a - file against the bits set in the - security mask parameter. Any bits that - were changed that are not set to '1' in this parameter are left alone - in the file permissions.

    Essentially, zero bits in the security mask - mask may be treated as a set of bits the user is not - allowed to change, and one bits are those the user is allowed to change. -

    If not set explicitly this parameter is set to the same value as - the create mask - parameter. To allow a user to modify all the - user/group/world permissions on a file, set this parameter - to 0777.

    Next Samba checks the changed permissions for a file against - the bits set in the - force security mode parameter. Any bits - that were changed that correspond to bits set to '1' in this parameter - are forced to be set.

    Essentially, bits set in the force security mode - parameter may be treated as a set of bits that, when - modifying security on a file, the user has always set to be 'on'.

    If not set explicitly this parameter is set to the same value - as the force - create mode parameter. - To allow a user to modify all the user/group/world permissions on a file - with no restrictions set this parameter to 000.

    The security mask and force - security mode parameters are applied to the change - request in that order.

    For a directory Samba will perform the same operations as - described above for a file except using the parameter - directory security mask instead of security - mask, and force directory security mode - parameter instead of force security mode - .

    The directory security mask parameter - by default is set to the same value as the directory mask - parameter and the force directory security - mode parameter by default is set to the same value as - the force directory mode parameter.

    In this way Samba enforces the permission restrictions that - an administrator can set on a Samba share, whilst still allowing users - to modify the permission bits within that restriction.

    If you want to set up a share that allows users full control - in modifying the permission bits on their files and directories and - doesn't force any particular bits to be set 'on', then set the following - parameters in the smb.conf file in that share specific section :

    security mask = 0777

    force security mode = 0

    directory security mask = 0777

    force directory security mode = 0

    Interaction with the standard Samba file attribute - mapping

    Samba maps some of the DOS attribute bits (such as "read - only") into the UNIX permissions of a file. This means there can - be a conflict between the permission bits set via the security - dialog and the permission bits set by the file attribute mapping. -

    One way this can show up is if a file has no UNIX read access - for the owner it will show up as "read only" in the standard - file attributes tabbed dialog. Unfortunately this dialog is - the same one that contains the security info in another tab.

    What this can mean is that if the owner changes the permissions - to allow themselves read access using the security dialog, clicks - "OK" to get back to the standard attributes tab - dialog, and then clicks "OK" on that dialog, then - NT will set the file permissions back to read-only (as that is what - the attributes still say in the dialog). This means that after setting - permissions and clicking "OK" to get back to the - attributes dialog you should always hit "Cancel" - rather than "OK" to ensure that your changes - are not overridden.

    Chapter 12. Configuring Group Mapping

    Jean François Micouleau

    Gerald (Jerry) Carter

    Samba Team

    <jerry@samba.org>

    -Starting with Samba 3.0 alpha 2, new group mapping functionality -is available to create associations between Windows SIDs and UNIX -groups. The groupmap subcommand included with -the net tool can be used to manage these associations. -

    -The first immediate reason to use the group mapping on a Samba PDC, is that -the domain admin group smb.conf has been removed. -This parameter was used to give the listed users membership in the "Domain Admins" -Windows group which gave local admin rights on their workstations (in -default configurations). -

    -When installing NT/W2K on a computer, the installer program creates some users -and groups. Notably the 'Administrators' group, and gives to that group some -privileges like the ability to change the date and time or to kill any process -(or close too) running on the local machine. The 'Administrator' user is a -member of the 'Administrators' group, and thus 'inherit' the 'Administrators' -group privileges. If a 'joe' user is created and become a member of the -'Administrator' group, 'joe' has exactly the same rights as 'Administrator'. -

    -When a NT/W2K machine is joined to a domain, the "Domain Adminis" group of the -PDC is added to the local 'Administrators' group of the workstation. Every -member of the 'Domain Administrators' group 'inherit' the -rights of the local 'Administrators' group when logging on the workstation. -

    -The following steps describe how to make samba PDC users members of the -'Domain Admins' group? -

    1. create a unix group (usually in /etc/group), - let's call it domadm

    2. add to this group the users that must be Administrators. For example - if you want joe,john and mary, your entry in /etc/group will - look like:

      -  domadm:x:502:joe,john,mary
-

    3. Map this domadm group to the "Domain Admins" group - by running the command:

      root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm

      The quotes around "Domain Admins" are necessary due to the space in the group name. Also make - sure to leave no whitespace surrounding the equal character (=).

    Now joe, john and mary are domain administrators!

    -It is possible to map any arbitrary UNIX group to any Windows NT -group as well as making any UNIX group a Windows domain group. -For example, if you wanted to include a UNIX group (e.g. acct) in a ACL on a -local file or printer on a domain member machine, you would flag -that group as a domain group by running the following on the Samba PDC: -

    root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct

    Be aware that the rid parmeter is a unsigned 32 bit integer that should -normally start at 1000. However, this rid must not overlap with any RID assigned -to a user. Verifying this is done differently depending on on the passdb backend -you are using. Future versions of the tools may perform the verification automatically, -but for now the burden in on you.

    You can list the various groups in the mapping database by executing -net groupmap list. Here is an example:

    root# net groupmap list
-System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin
-Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
-Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
-Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest
-

    For complete details on net groupmap, refer to the -net(8) man page.

    Chapter 13. Printing Support

    Gerald (Jerry) Carter

    Samba Team

    <jerry@samba.org>

    Patrick Powell

    <papowell@lprng.org>

    (3 May 2001)

    Table of Contents

    Introduction
    Configuration
    Creating [print$]
    Setting Drivers for Existing Printers
    Support a large number of printers
    Adding New Printers via the Windows NT APW
    Samba and Printer Ports
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints server
    The Installation Client
    Diagnosis
    Introduction
    Debugging printer problems
    What printers do I have?
    Setting up printcap and print servers
    Job sent, no output
    Job sent, strange output
    Raw PostScript printed
    Advanced Printing
    Real debugging

    Introduction

    Beginning with the 2.2.0 release, Samba supports -the native Windows NT printing mechanisms implemented via -MS-RPC (i.e. the SPOOLSS named pipe). Previous versions of -Samba only supported LanMan printing calls.

    The additional functionality provided by the new -SPOOLSS support includes:

    • Support for downloading printer driver - files to Windows 95/98/NT/2000 clients upon demand. -

    • Uploading of printer drivers via the - Windows NT Add Printer Wizard (APW) or the - Imprints tool set (refer to http://imprints.sourceforge.net). -

    • Support for the native MS-RPC printing - calls such as StartDocPrinter, EnumJobs(), etc... (See - the MSDN documentation at http://msdn.microsoft.com/ - for more information on the Win32 printing API) -

    • Support for NT Access Control Lists (ACL) - on printer objects

    • Improved support for printer queue manipulation - through the use of an internal databases for spooled job - information

    -There has been some initial confusion about what all this means -and whether or not it is a requirement for printer drivers to be -installed on a Samba host in order to support printing from Windows -clients. As a side note, Samba does not use these drivers in any way to process -spooled files. They are utilized entirely by the clients. -

    -The following MS KB article, may be of some help if you are dealing with -Windows 2000 clients: How to Add Printers with No User -Interaction in Windows 2000 -

    -http://support.microsoft.com/support/kb/articles/Q189/1/05.ASP -

    Configuration

    [print$] vs. [printer$]

    -Previous versions of Samba recommended using a share named [printer$]. -This name was taken from the printer$ service created by Windows 9x -clients when a printer was shared. Windows 9x printer servers always have -a printer$ service which provides read-only access via no -password in order to support printer driver downloads. -

    -However, the initial implementation allowed for a -parameter named printer driver location -to be used on a per share basis to specify the location of -the driver files associated with that printer. Another -parameter named printer driver provided -a means of defining the printer driver name to be sent to -the client. -

    Creating [print$]

    -In order to support the uploading of printer driver -files, you must first configure a file share named [print$]. -The name of this share is hard coded in Samba's internals so -the name is very important (print$ is the service used by -Windows NT print servers to provide support for printer driver -download). -

    You should modify the server's smb.conf file to add the global -parameters and to create the -following file share (of course, some of the parameter values, -such as 'path' are arbitrary and should be replaced with -appropriate values for your site):

    -[global]
-    ; members of the ntadmin group should be able
-    ; to add drivers and set printer properties
-    ; root is implicitly a 'printer admin'
-    printer admin = @ntadmin
-
-[print$]
-    path = /usr/local/samba/printers
-    guest ok = yes
-    browseable = yes
-    read only = yes
-    ; since this share is configured as read only, then we need
-    ; a 'write list'.  Check the file system permissions to make
-    ; sure this account can copy files to the share.  If this
-    ; is setup to a non-root account, then it should also exist
-    ; as a 'printer admin'
-    write list = @ntadmin,root
-

    The -write list is used to allow administrative -level user accounts to have write access in order to update files -on the share. See the smb.conf(5) -man page for more information on configuring file shares.

    The requirement for guest -ok = yes depends upon how your -site is configured. If users will be guaranteed to have -an account on the Samba host, then this is a non-issue.

    Author's Note

    -The non-issue is that if all your Windows NT users are guaranteed to be -authenticated by the Samba server (such as a domain member server and the NT -user has already been validated by the Domain Controller in -order to logon to the Windows NT console), then guest access -is not necessary. Of course, in a workgroup environment where -you just want to be able to print without worrying about -silly accounts and security, then configure the share for -guest access. You'll probably want to add map to guest = Bad User - in the [global] section as well. Make sure -you understand what this parameter does before using it -though. --jerry -

    In order for a Windows NT print server to support -the downloading of driver files by multiple client architectures, -it must create subdirectories within the [print$] service -which correspond to each of the supported client architectures. -Samba follows this model as well.

    Next create the directory tree below the [print$] share -for each architecture you wish to support.

    -[print$]----- - |-W32X86 ; "Windows NT x86" - |-WIN40 ; "Windows 95/98" - |-W32ALPHA ; "Windows NT Alpha_AXP" - |-W32MIPS ; "Windows NT R4000" - |-W32PPC ; "Windows NT PowerPC" -

    ATTENTION! REQUIRED PERMISSIONS

    -In order to currently add a new driver to you Samba host, -one of two conditions must hold true: -

    • The account used to connect to the Samba host - must have a uid of 0 (i.e. a root account)

    • The account used to connect to the Samba host - must be a member of the printer - admin list.

    -Of course, the connected account must still possess access -to add files to the subdirectories beneath [print$]. Remember -that all file shares are set to 'read only' by default. -

    -Once you have created the required [print$] service and -associated subdirectories, simply log onto the Samba server using -a root (or printer admin) account -from a Windows NT 4.0/2k client. Open "Network Neighbourhood" or -"My Network Places" and browse for the Samba host. Once you have located -the server, navigate to the "Printers..." folder. -You should see an initial listing of printers -that matches the printer shares defined on your Samba host. -

    Setting Drivers for Existing Printers

    The initial listing of printers in the Samba host's -Printers folder will have no real printer driver assigned -to them. This defaults to a NULL string to allow the use -of the local Add Printer Wizard on NT/2000 clients. -Attempting to view the printer properties for a printer -which has this default driver assigned will result in -the error message:

    -Device settings cannot be displayed. The driver -for the specified printer is not installed, only spooler -properties will be displayed. Do you want to install the -driver now? -

    -Click "No" in the error dialog and you will be presented with -the printer properties window. The way to assign a driver to a -printer is to either -

    • Use the "New Driver..." button to install - a new printer driver, or

    • Select a driver from the popup list of - installed drivers. Initially this list will be empty.

    If you wish to install printer drivers for client -operating systems other than "Windows NT x86", you will need -to use the "Sharing" tab of the printer properties dialog.

    Assuming you have connected with a root account, you -will also be able modify other printer properties such as -ACLs and device settings using this dialog box.

    A few closing comments for this section, it is possible -on a Windows NT print server to have printers -listed in the Printers folder which are not shared. Samba does -not make this distinction. By definition, the only printers of -which Samba is aware are those which are specified as shares in -smb.conf.

    Another interesting side note is that Windows NT clients do -not use the SMB printer share, but rather can print directly -to any printer on another Windows NT host using MS-RPC. This -of course assumes that the printing client has the necessary -privileges on the remote host serving the printer. The default -permissions assigned by Windows NT to a printer gives the "Print" -permissions to the "Everyone" well-known group. -

    Support a large number of printers

    One issue that has arisen during the development -phase of Samba 2.2 is the need to support driver downloads for -100's of printers. Using the Windows NT APW is somewhat -awkward to say the list. If more than one printer are using the -same driver, the rpcclient's -setdriver command can be used to set the driver -associated with an installed driver. The following is example -of how this could be accomplished:

    -$ rpcclient pogo -U root%secret -c "enumdrivers" -

     
-Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
- 
-[Windows NT x86]
-Printer Driver Info 1:
-     Driver Name: [HP LaserJet 4000 Series PS]
- 
-Printer Driver Info 1:
-     Driver Name: [HP LaserJet 2100 Series PS]
- 
-Printer Driver Info 1:
-     Driver Name: [HP LaserJet 4Si/4SiMX PS]
-

    -$ rpcclient pogo -U root%secret -c "enumprinters" -

    -Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
-     flags:[0x800000]
-     name:[\\POGO\hp-print]
-     description:[POGO\\POGO\hp-print,NO DRIVER AVAILABLE FOR THIS PRINTER,]
-     comment:[]
-				  
-

    -$ rpcclient pogo -U root%secret -c "setdriver hp-print \"HP LaserJet 4000 Series PS\"" -

    -Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
-Successfully set hp-print to driver HP LaserJet 4000 Series PS.
-

    Adding New Printers via the Windows NT APW

    -By default, Samba offers all printer shares defined in smb.conf -in the "Printers..." folder. Also existing in this folder is the Windows NT -Add Printer Wizard icon. The APW will be show only if -

    • The connected user is able to successfully - execute an OpenPrinterEx(\\server) with administrative - privileges (i.e. root or printer admin). -

    • show - add printer wizard = yes (the default). -

    -In order to be able to use the APW to successfully add a printer to a Samba -server, the add -printer command must have a defined value. The program -hook must successfully add the printer to the system (i.e. -/etc/printcap or appropriate files) and -smb.conf if necessary. -

    -When using the APW from a client, if the named printer share does -not exist, smbd will execute the add printer -command and reparse to the smb.conf -to attempt to locate the new printer share. If the share is still not defined, -an error of "Access Denied" is returned to the client. Note that the -add printer program is executed under the context -of the connected user, not necessarily a root account. -

    -There is a complementary delete -printer command for removing entries from the "Printers..." -folder. -

    -The following is an example add printer command script. It adds the appropriate entries to /etc/printcap.local (change that to what you need) and returns a line of 'Done' which is needed for the whole process to work. -

    -#!/bin/sh
+

    LDAP special attributes for sambaSamAccounts

    + The sambaSamAccount objectclass is composed of the following attributes: +

    +

    Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP)

    lmPasswordthe LANMAN password 16-byte hash stored as a character + representation of a hexadecimal string.
    ntPasswordthe NT password hash 16-byte stored as a character + representation of a hexadecimal string.
    pwdLastSetThe integer time in seconds since 1970 when the + lmPassword and ntPassword attributes were last set. +
    acctFlagsstring of 11 characters surrounded by square brackets [] + representing account flags such as U (user), W(workstation), X(no password expiration), + I(Domain trust account), H(Home dir required), S(Server trust account), + and D(disabled).
    logonTimeInteger value currently unused
    logoffTimeInteger value currently unused
    kickoffTimeInteger value currently unused
    pwdCanChangeInteger value currently unused
    pwdMustChangeInteger value currently unused
    homeDrivespecifies the drive letter to which to map the + UNC path specified by homeDirectory. The drive letter must be specified in the form "X:" + where X is the letter of the drive to map. Refer to the "logon drive" parameter in the + smb.conf(5) man page for more information.
    scriptPathThe scriptPath property specifies the path of + the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path + is relative to the netlogon share. Refer to the "logon script" parameter in the + smb.conf(5) man page for more information.
    profilePathspecifies a path to the user's profile. + This value can be a null string, a local absolute path, or a UNC path. Refer to the + "logon path" parameter in the smb.conf(5) man page for more information.
    smbHomeThe homeDirectory property specifies the path of + the home directory for the user. The string can be null. If homeDrive is set and specifies + a drive letter, homeDirectory should be a UNC path. The path must be a network + UNC path of the form \\server\share\directory. This value can be a null string. + Refer to the logon home parameter in the smb.conf man page for more information. +
    userWorkstationcharacter string value currently unused. +
    ridthe integer representation of the user's relative identifier + (RID).
    primaryGroupIDthe relative identifier (RID) of the primary group + of the user.
    domaindomain the user is part of.

    +

    + The majority of these parameters are only used when Samba is acting as a PDC of + a domain (refer to the Samba as a primary domain controller chapter for details on + how to configure Samba as a Primary Domain Controller). The following four attributes + are only stored with the sambaSamAccount entry if the values are non-default values: +

    smbHome
    scriptPath
    logonPath
    homeDrive

    + These attributes are only stored with the sambaSamAccount entry if + the values are non-default values. For example, assume TASHTEGO has now been + configured as a PDC and that logon home = \\%L\%u was defined in + its smb.conf file. When a user named "becky" logons to the domain, + the logon home string is expanded to \\TASHTEGO\becky. + If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", + this value is used. However, if this attribute does not exist, then the value + of the logon home parameter is used in its place. Samba + will only write the attribute value to the directory entry if the value is + something other than the default (e.g. \\MOBY\becky). +

    Example LDIF Entries for a sambaSamAccount

    + The following is a working LDIF with the inclusion of the posixAccount objectclass: +

    + 

    +	dn: uid=guest2, ou=people,dc=plainjoe,dc=org
+	ntPassword: 878D8014606CDA29677A44EFA1353FC7
+	pwdMustChange: 2147483647
+	primaryGroupID: 1201
+	lmPassword: 552902031BEDE9EFAAD3B435B51404EE
+	pwdLastSet: 1010179124
+	logonTime: 0
+	objectClass: sambaSamAccount
+	uid: guest2
+	kickoffTime: 2147483647
+	acctFlags: [UX         ]
+	logoffTime: 2147483647
+	rid: 19006
+	pwdCanChange: 0
+

    +

    + The following is an LDIF entry for using both the sambaSamAccount and + posixAccount objectclasses: +

    + 

    +	dn: uid=gcarter, ou=people,dc=plainjoe,dc=org
+	logonTime: 0
+	displayName: Gerald Carter
+	lmPassword: 552902031BEDE9EFAAD3B435B51404EE
+	primaryGroupID: 1201
+	objectClass: posixAccount
+	objectClass: sambaSamAccount
+	acctFlags: [UX         ]
+	userPassword: {crypt}BpM2ej8Rkzogo
+	uid: gcarter
+	uidNumber: 9000
+	cn: Gerald Carter
+	loginShell: /bin/bash
+	logoffTime: 2147483647
+	gidNumber: 100
+	kickoffTime: 2147483647
+	pwdLastSet: 1010179230
+	rid: 19000
+	homeDirectory: /home/tashtego/gcarter
+	pwdCanChange: 0
+	pwdMustChange: 2147483647
+	ntPassword: 878D8014606CDA29677A44EFA1353FC7
+

    +

    Password synchronisation

    + Since version 3.0 samba can update the non-samba (LDAP) password stored with an account. When + using pam_ldap, this allows changing both unix and windows passwords at once. +

    The ldap passwd sync options can have the following values:

    yes

    When the user changes his password, update + ntPassword, lmPassword + and the password fields.

    no

    Only update ntPassword and lmPassword.

    only

    Only update the LDAP password and let the LDAP server worry + about the other fields. This option is only available when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD.

    More information can be found in the smb.conf manpage. +

    MySQL

    + Every so often someone will come along with a great new idea. Storing of user accounts in an + SQL backend is one of them. Those who want to do this are in the best position to know what the + specific benefits are to them. This may sound like a cop-out, but in truth we can not attempt + to document every nitty little detail why certain things of marginal utility to the bulk of + Samba users might make sense to the rest. In any case, the following instructions should help + the determined SQL user to implement a working system. +

    Creating the database

    + You either can set up your own table and specify the field names to pdb_mysql (see below + for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump + contains the correct queries to create the required tables. Use the command : -# Script to insert a new printer entry into printcap.local -# -# $1, printer name, used as the descriptive name -# $2, share name, used as the printer name for Linux -# $3, port name -# $4, driver name -# $5, location, used for the device file of the printer -# $6, win9x location + 

    $ mysql -uusername -hhostname -ppassword \
+databasename < /path/to/samba/examples/pdb/mysql/mysql.dump

    +

    Configuring

    This plugin lacks some good documentation, but here is some short info:

    Add a the following to the passdb backend variable in your smb.conf: + 

    +			passdb backend = [other-plugins] mysql:identifier [other-plugins]
+

    +

    The identifier can be any string you like, as long as it doesn't collide with + the identifiers of other plugins or other instances of pdb_mysql. If you + specify multiple pdb_mysql.so entries in passdb backend, you also need to + use different identifiers! +

    + Additional options can be given through the smb.conf file in the [global] section. +

    +

    Table 11.2. Basic smb.conf options for MySQL passdb backend

    FieldContents
    identifier:mysql hosthost name, defaults to 'localhost'
    identifier:mysql password 
    identifier:mysql userdefaults to 'samba'
    identifier:mysql databasedefaults to 'samba'
    identifier:mysql portdefaults to 3306
    identifier:tableName of the table containing users

    +

    Warning

    + Since the password for the MySQL user is stored in the + smb.conf file, you should make the the smb.conf file + readable only to the user that runs Samba This is considered a security + bug and will be fixed soon. +

    Names of the columns in this table (I've added column types those columns should have first):

    +

    Table 11.3. MySQL field names for MySQL passdb backend

    FieldTypeContents
    identifier:logon time columnint(9) 
    identifier:logoff time columnint(9) 
    identifier:kickoff time columnint(9) 
    identifier:pass last set time columnint(9) 
    identifier:pass can change time columnint(9) 
    identifier:pass must change time columnint(9) 
    identifier:username columnvarchar(255)unix username
    identifier:domain columnvarchar(255)NT domain user is part of
    identifier:nt username columnvarchar(255)NT username
    identifier:fullname columnvarchar(255)Full name of user
    identifier:home dir columnvarchar(255)Unix homedir path
    identifier:dir drive columnvarchar(2)Directory drive path (eg: 'H:')
    identifier:logon script columnvarchar(255)Batch file to run on client side when logging on
    identifier:profile path columnvarchar(255)Path of profile
    identifier:acct desc columnvarchar(255)Some ASCII NT user data
    identifier:workstations columnvarchar(255)Workstations user can logon to (or NULL for all)
    identifier:unknown string columnvarchar(255)unknown string
    identifier:munged dial columnvarchar(255)?
    identifier:user sid columnvarchar(255)NT user SID
    identifier:group sid columnvarchar(255)NT group ID
    identifier:lanman pass columnvarchar(255)encrypted lanman password
    identifier:nt pass columnvarchar(255)encrypted nt passwd
    identifier:plain pass columnvarchar(255)plaintext password
    identifier:acct control columnint(9)nt user data
    identifier:unknown 3 columnint(9)unknown
    identifier:logon divs columnint(9)?
    identifier:hours len columnint(9)?
    identifier:unknown 5 columnint(9)unknown
    identifier:unknown 6 columnint(9)unknown

    +

    + Eventually, you can put a colon (:) after the name of each column, which + should specify the column to update when updating the table. You can also + specify nothing behind the colon - then the data from the field will not be + updated. +

    Using plaintext passwords or encrypted password

    + I strongly discourage the use of plaintext passwords, however, you can use them: +

    + If you would like to use plaintext passwords, set + 'identifier:lanman pass column' and 'identifier:nt pass column' to + 'NULL' (without the quotes) and 'identifier:plain pass column' to the + name of the column containing the plaintext passwords. +

    + If you use encrypted passwords, set the 'identifier:plain pass + column' to 'NULL' (without the quotes). This is the default. +

    Getting non-column data from the table

    + It is possible to have not all data in the database and making some 'constant'. +

    + For example, you can set 'identifier:fullname column' to : + CONCAT(First_name,' ',Sur_name) +

    + Or, set 'identifier:workstations column' to : + NULL

    See the MySQL documentation for more language constructs.

    XML

    This module requires libxml2 to be installed.

    The usage of pdb_xml is pretty straightforward. To export data, use: +

    + $ pdbedit -e xml:filename +

    + (where filename is the name of the file to put the data in) +

    + To import data, use: + $ pdbedit -i xml:filename +

    Common Errors

    Users can not logon - Users not in Samba SAM

    + People forget to put their users in their backend and then complain Samba won't authorize them. +

    Users are being added to the wrong backend database

    + A few complaints have been received from users that just moved to Samba-3. The following + smb.conf file entries were causing problems, new accounts were being added to the old + smbpasswd file, not to the tdbsam passdb.tdb file: +

    + 

    +	[globals]
+		...
+		passdb backend = smbpasswd, tdbsam, guest
+		...
+

    +

    + Samba will add new accounts to the first entry in the passdb backend + parameter entry. If you want to update to the tdbsam, then change the entry to: +

    + 

    +	[globals]
+		...
+		passdb backend = tdbsam, smbpasswd, guest
+		...
+

    +

    auth methods does not work

    + If you explicitly set an 'auth methods' parameter, guest must be specified as the first + entry on the line. Eg: auth methods = guest sam. +

    + This is the exact opposite of the requirement for the passdb backed + option, where it must be the LAST parameter on the line. +

    Chapter 12. Mapping MS Windows and Unix Groups

    Jean François Micouleau

    Gerald (Jerry) Carter

    Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails

    + Starting with Samba-3, new group mapping functionality is available to create associations + between Windows group SIDs and UNIX groups. The groupmap subcommand + included with the net tool can be used to manage these associations. +

    Warning

    + The first immediate reason to use the group mapping on a Samba PDC, is that + the domain admin group has been removed and should no longer + be specified in smb.conf. This parameter was used to give the listed users membership + in the Domain Admins Windows group which gave local admin rights on their workstations + (in default configurations). +

    Features and Benefits

    + Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to + arbitrarily associate them with Unix/Linux group accounts. +

    + Group accounts can be managed using the MS Windows NT4 or MS Windows 200x MMC tools + so long as appropriate interface scripts have been provided to smb.conf. +

    + Administrators should be aware that where smb.conf group interface scripts make + direct calls to the Unix/Linux system tools (eg: the shadow utilities, groupadd, + groupdel, groupmod) then the resulting Unix/Linux group names will be subject + to any limits imposed by these tools. If the tool does NOT allow upper case characters + or space characters, then the creation of an MS Windows NT4 / 200x style group of + Engineering Managers will attempt to create an identically named + Unix/Linux group, an attempt that will of course fail! +

    + There are several possible work-arounds for the operating system tools limitation. One + method is to use a script that generates a name for the Unix/Linux system group that + fits the operating system limits, and that then just passes the Unix/Linux group id (GID) + back to the calling Samba interface. This will provide a dynamic work-around solution. +

    + Another work-around is to manually create a Unix/Linux group, then manually create the + MS Windows NT4 / 200x group on the Samba server and then use the net groupmap + tool to connect the two to each other. +

    Discussion

    + When installing MS Windows NT4 / 200x on a computer, the installation + program creates default users and groups, notably the Administrators group, + and gives that group privileges necessary privileges to perform essential system tasks. + eg: Ability to change the date and time or to kill (or close) any process running on the + local machine. +

    + The 'Administrator' user is a member of the 'Administrators' group, and thus inherits + 'Administrators' group privileges. If a 'joe' user is created to be a member of the + 'Administrator' group, 'joe' has exactly the same rights as 'Administrator'. +

    + When an MS Windows NT4 / W200x is made a domain member, the "Domain Admins" group of the + PDC is added to the local 'Administrators' group of the workstation. Every member of the + 'Domain Administrators' group inherits the rights of the local 'Administrators' group when + logging on the workstation. +

    + The following steps describe how to make Samba PDC users members of the 'Domain Admins' group? +

    1. + create a unix group (usually in /etc/group), let's call it domadm +

    2. add to this group the users that must be Administrators. For example + if you want joe, john and mary, your entry in /etc/group will + look like: + 

      +		domadm:x:502:joe,john,mary
+

      +

    3. + Map this domadm group to the "Domain Admins" group by running the command: +

      + 

      +		root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm
+

      +

      + The quotes around "Domain Admins" are necessary due to the space in the group name. + Also make sure to leave no whitespace surrounding the equal character (=). +

    + Now joe, john and mary are domain administrators! +

    + It is possible to map any arbitrary UNIX group to any Windows NT4 / 200x group as well as + making any UNIX group a Windows domain group. For example, if you wanted to include a + UNIX group (e.g. acct) in a ACL on a local file or printer on a domain member machine, + you would flag that group as a domain group by running the following on the Samba PDC: +

    + 

    +	root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct
+

    +

    + Be aware that the RID parameter is a unsigned 32 bit integer that should + normally start at 1000. However, this rid must not overlap with any RID assigned + to a user. Verifying this is done differently depending on on the passdb backend + you are using. Future versions of the tools may perform the verification automatically, + but for now the burden is on you. +

    Example Configuration

    + You can list the various groups in the mapping database by executing + net groupmap list. Here is an example: +

    + 

    +		root#  net groupmap list
+		System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin
+		Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
+		Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
+		Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest
+

    +

    + For complete details on net groupmap, refer to the net(8) man page. +

    Configuration Scripts

    + Everyone needs tools. Some of us like to create our own, others prefer to use canned tools + (ie: prepared by someone else for general use). +

    Sample smb.conf add group script

    + A script to great complying group names for use by the Samba group interfaces: +

    +

    Example 12.1. smbgrpadd.sh

     
-#
-# Make sure we use the location that RedHat uses for local printer defs
-PRINTCAP=/etc/printcap.local
-DATE=`date +%Y%m%d-%H%M%S`
-LP=lp
-RESTART="service lpd restart"
-
-# Keep a copy
-cp $PRINTCAP $PRINTCAP.$DATE
-# Add the printer to $PRINTCAP
-echo ""				 			>> $PRINTCAP
-echo "$2|$1:\\" 					>> $PRINTCAP
-echo "  :sd=/var/spool/lpd/$2:\\" 			>> $PRINTCAP
-echo "  :mx=0:ml=0:sh:\\" 				>> $PRINTCAP
-echo "  :lp=/usr/local/samba/var/print/$5.prn:" 	>> $PRINTCAP
-
-touch "/usr/local/samba/var/print/$5.prn" >> /tmp/printadd.$$ 2>&1
-chown $LP "/usr/local/samba/var/print/$5.prn" >> /tmp/printadd.$$ 2>&1
-
-mkdir /var/spool/lpd/$2
-chmod 700 /var/spool/lpd/$2
-chown $LP /var/spool/lpd/$2
-#echo $1 >> "/usr/local/samba/var/print/$5.prn"
-#echo $2 >> "/usr/local/samba/var/print/$5.prn"
-#echo $3 >> "/usr/local/samba/var/print/$5.prn"
-#echo $4 >> "/usr/local/samba/var/print/$5.prn"
-#echo $5 >> "/usr/local/samba/var/print/$5.prn"
-#echo $6 >> "/usr/local/samba/var/print/$5.prn"
-$RESTART >> "/usr/local/samba/var/print/$5.prn"
-# Not sure if this is needed
-touch /usr/local/samba/lib/smb.conf
-#
-# You need to return a value, but I am not sure what it means.
-#
-echo "Done"
+#!/bin/bash
+
+# Add the group using normal system groupadd tool.
+groupadd smbtmpgrp00
+
+thegid=`cat /etc/group | grep smbtmpgrp00 | cut -d ":" -f3`
+
+# Now change the name to what we want for the MS Windows networking end
+cp /etc/group /etc/group.bak
+cat /etc/group.bak | sed s/smbtmpgrp00/$1/g > /etc/group
+
+# Now return the GID as would normally happen.
+echo $thegid
 exit 0
-

    Samba and Printer Ports

    -Windows NT/2000 print servers associate a port with each printer. These normally -take the form of LPT1:, COM1:, FILE:, etc... Samba must also support the -concept of ports associated with a printer. By default, only one printer port, -named "Samba Printer Port", exists on a system. Samba does not really a port in -order to print, rather it is a requirement of Windows clients. -

    -Note that Samba does not support the concept of "Printer Pooling" internally -either. This is when a logical printer is assigned to multiple ports as -a form of load balancing or fail over. -

    -If you require that multiple ports be defined for some reason, -smb.conf possesses a enumports -command which can be used to define an external program -that generates a listing of ports on a system. -

    The Imprints Toolset

    The Imprints tool set provides a UNIX equivalent of the - Windows NT Add Printer Wizard. For complete information, please - refer to the Imprints web site at - http://imprints.sourceforge.net/ as well as the documentation - included with the imprints source distribution. This section will - only provide a brief introduction to the features of Imprints.

    What is Imprints?

    Imprints is a collection of tools for supporting the goals - of

    • Providing a central repository information - regarding Windows NT and 95/98 printer driver packages

    • Providing the tools necessary for creating - the Imprints printer driver packages.

    • Providing an installation client which - will obtain and install printer drivers on remote Samba - and Windows NT 4 print servers.

    Creating Printer Driver Packages

    The process of creating printer driver packages is beyond - the scope of this document (refer to Imprints.txt also included - with the Samba distribution for more information). In short, - an Imprints driver package is a gzipped tarball containing the - driver files, related INF files, and a control file needed by the - installation client.

    The Imprints server

    The Imprints server is really a database server that - may be queried via standard HTTP mechanisms. Each printer - entry in the database has an associated URL for the actual - downloading of the package. Each package is digitally signed - via GnuPG which can be used to verify that package downloaded - is actually the one referred in the Imprints database. It is - not recommended that this security check - be disabled.

    The Installation Client

    More information regarding the Imprints installation client - is available in the Imprints-Client-HOWTO.ps - file included with the imprints source package.

    The Imprints installation client comes in two forms.

    • a set of command line Perl scripts

    • a GTK+ based graphical interface to - the command line perl scripts

    The installation client (in both forms) provides a means - of querying the Imprints database server for a matching - list of known printer model names as well as a means to - download and install the drivers on remote Samba and Windows - NT print servers.

    The basic installation process is in four steps and - perl code is wrapped around smbclient - and rpcclient.

    	
-foreach (supported architecture for a given driver)
-{
-     1.  rpcclient: Get the appropriate upload directory 
-         on the remote server
-     2.  smbclient: Upload the driver files
-     3.  rpcclient: Issues an AddPrinterDriver() MS-RPC
-}
-	
-4.  rpcclient: Issue an AddPrinterEx() MS-RPC to actually
-    create the printer
-

    One of the problems encountered when implementing - the Imprints tool set was the name space issues between - various supported client architectures. For example, Windows - NT includes a driver named "Apple LaserWriter II NTX v51.8" - and Windows 95 calls its version of this driver "Apple - LaserWriter II NTX"

    The problem is how to know what client drivers have - been uploaded for a printer. As astute reader will remember - that the Windows NT Printer Properties dialog only includes - space for one printer driver name. A quick look in the - Windows NT 4.0 system registry at

    HKLM\System\CurrentControlSet\Control\Print\Environment -

    will reveal that Windows NT always uses the NT driver - name. This is ok as Windows NT always requires that at least - the Windows NT version of the printer driver is present. - However, Samba does not have the requirement internally. - Therefore, how can you use the NT driver name if is has not - already been installed?

    The way of sidestepping this limitation is to require - that all Imprints printer driver packages include both the Intel - Windows NT and 95/98 printer drivers and that NT driver is - installed first.

    Diagnosis

    Introduction

    -This is a short description of how to debug printing problems with -Samba. This describes how to debug problems with printing from a SMB -client to a Samba server, not the other way around. For the reverse -see the examples/printing directory. -

    -Ok, so you want to print to a Samba server from your PC. The first -thing you need to understand is that Samba does not actually do any -printing itself, it just acts as a middleman between your PC client -and your Unix printing subsystem. Samba receives the file from the PC -then passes the file to a external "print command". What print command -you use is up to you. -

    -The whole things is controlled using options in smb.conf. The most -relevant options (which you should look up in the smb.conf man page) -are: -

    -      [global]
-        print command     - send a file to a spooler
-        lpq command       - get spool queue status
-        lprm command      - remove a job
-      [printers]
-        path = /var/spool/lpd/samba
-

    -The following are nice to know about: -

    -        queuepause command   - stop a printer or print queue
-        queueresume command  - start a printer or print queue
-

    -Example: -

    -        print command = /usr/bin/lpr -r -P%p %s
-        lpq command   = /usr/bin/lpq    -P%p %s
-        lprm command  = /usr/bin/lprm   -P%p %j
-        queuepause command = /usr/sbin/lpc -P%p stop
-        queuepause command = /usr/sbin/lpc -P%p start
-

    -Samba should set reasonable defaults for these depending on your -system type, but it isn't clairvoyant. It is not uncommon that you -have to tweak these for local conditions. The commands should -always have fully specified pathnames, as the smdb may not have -the correct PATH values. -

    -When you send a job to Samba to be printed, it will make a temporary -copy of it in the directory specified in the [printers] section. -and it should be periodically cleaned out. The lpr -r option -requests that the temporary copy be removed after printing; If -printing fails then you might find leftover files in this directory, -and it should be periodically cleaned out. Samba used the lpq -command to determine the "job number" assigned to your print job -by the spooler. -

    -The %>letter< are "macros" that get dynamically replaced with appropriate -values when they are used. The %s gets replaced with the name of the spool -file that Samba creates and the %p gets replaced with the name of the -printer. The %j gets replaced with the "job number" which comes from -the lpq output. -

    Debugging printer problems

    -One way to debug printing problems is to start by replacing these -command with shell scripts that record the arguments and the contents -of the print file. A simple example of this kind of things might -be: -

    -	print command = /tmp/saveprint %p %s
-
-    #!/bin/saveprint
-    # we make sure that we are the right user
-    /usr/bin/id -p >/tmp/tmp.print
-    # we run the command and save the error messages
-    # replace the command with the one appropriate for your system
-    /usr/bin/lpr -r -P$1 $2 2>>&/tmp/tmp.print
-

    -Then you print a file and try removing it. You may find that the -print queue needs to be stopped in order to see the queue status -and remove the job: +

    +

    + The smb.conf entry for the above script would look like: + 

    +		add group script = /path_to_tool/smbgrpadd.sh %g
+

    +

    Script to configure Group Mapping

    + In our example we have created a Unix/Linux group called ntadmin. + Our script will create the additional groups Engineers, Marketoids, Gnomes: + 

    +#!/bin/bash
 
-h4: {42} % echo hi >/tmp/hi
-h4: {43} % smbclient //localhost/lw4
-added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0
-Password: 
-Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7]
-smb: \> print /tmp/hi
-putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s)
-smb: \> queue
-1049     3            hi-17534
-smb: \> cancel 1049
-Error cancelling job 1049 : code 0
-smb: \> cancel 1049
-Job 1049 cancelled
-smb: \> queue
-smb: \> exit
-

    -The 'code 0' indicates that the job was removed. The comment -by the smbclient is a bit misleading on this. -You can observe the command output and then and look at the -/tmp/tmp.print file to see what the results are. You can quickly -find out if the problem is with your printing system. Often people -have problems with their /etc/printcap file or permissions on -various print queues. -

    What printers do I have?

    -You can use the 'testprns' program to check to see if the printer -name you are using is recognized by Samba. For example, you can -use: -

    -    testprns printer /etc/printcap
+net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin
+net groupmap modify ntgroup="Domain Users" unixgroup=users
+net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
+net groupmap modify ntgroup="Administrators" unixgroup=root
+net groupmap modify ntgroup="Users" unixgroup=users
+net groupmap modify ntgroup="Guests" unixgroup=nobody
+net groupmap modify ntgroup="System Operators" unixgroup=sys
+net groupmap modify ntgroup="Account Operators" unixgroup=root
+net groupmap modify ntgroup="Backup Operators" unixgroup=bin
+net groupmap modify ntgroup="Print Operators" unixgroup=lp
+net groupmap modify ntgroup="Replicators" unixgroup=daemon
+net groupmap modify ntgroup="Power Users" unixgroup=sys
+
+#groupadd Engineers
+#groupadd Marketoids
+#groupadd Gnomes
+
+#net groupmap add ntgroup="Engineers"  unixgroup=Engineers    type=d
+#net groupmap add ntgroup="Marketoids" unixgroup=Marketoids   type=d
+#net groupmap add ntgroup="Gnomes"     unixgroup=Gnomes       type=d

    -Samba can get its printcap information from a file or from a program. -You can try the following to see the format of the extracted -information: -

    -    testprns -a printer /etc/printcap
+
    
+	Of course it is expected that the administrator will modify this to suit local needs.
+	For information regarding the use of the net groupmap tool please
+	refer to the man page.
+

    Common Errors

    +At this time there are many little surprises for the unwary administrator. In a real sense +it is imperative that every step of automated control scripts must be carefully tested +manually before putting them into active service. +

    Adding Groups Fails

    + This is a common problem when the groupadd is called directly + by the Samba interface script for the add group script in + the smb.conf file. +

    + The most common cause of failure is an attempt to add an MS Windows group account + that has either an upper case character and/or a space character in it. +

    + There are three possible work-arounds. Firstly, use only group names that comply + with the limitations of the Unix/Linux groupadd system tool. + The second involves use of the script mentioned earlier in this chapter, and the + third option is to manually create a Unix/Linux group account that can substitute + for the MS Windows group name, then use the procedure listed above to map that group + to the MS Windows group. +

    Adding MS Windows Groups to MS Windows Groups Fails

    + Samba-3 does NOT support nested groups from the MS Windows control environment. +

    Chapter 13. File, Directory and Share Access Controls

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    May 10, 2003

    Table of Contents

    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with Unix File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and Unix Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask + parameters
    Interaction with the standard Samba file attribute + mapping
    Common Errors
    Users can not write to a public share
    I have set force user and Samba still makes root the owner of all the files + I touch!

    +Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of +resources shared via Samba do not behave in the manner they might expect. MS Windows network +administrators are often confused regarding network access controls and what is the best way to +provide users with the type of access they need while protecting resources from the consequences +of untoward access capabilities. +

    +Unix administrators frequently are not familiar with the MS Windows environment and in particular +have difficulty in visualizing what the MS Windows user wishes to achieve in attempts to set file +and directory access permissions. +

    +The problem lies in the differences in how file and directory permissions and controls work +between the two environments. This difference is one that Samba can not completely hide, even +though it does try to make the chasm transparent. +

    +POSIX Access Control List technology has been available (along with Extended Attributes) +for Unix for many years, yet there is little evidence today of any significant use. This +explains to some extent the slow adoption of ACLs into commercial Linux products. MS Windows +administrators are astounded at this given that ACLs were a foundational capability of the now +decade old MS Windows NT operating system. +

    +The purpose of this chapter is to present each of the points of control that are possible with +Samba-3 in the hope that this will help the network administrator to find the optimum method +for delivering the best environment for MS Windows desktop users. +

    +This is an opportune point to mention that it should be borne in mind that Samba was created to +provide a means of interoperability and interchange of data between two operating environments +that are quite different. It was never the intent to make Unix/Linux like MS Windows NT. Instead +the purpose was an is to provide a sufficient level of exchange of data between the two environments. +What is available today extends well beyond early plans and expectations, yet the gap continues to +shrink. +

    Features and Benefits

    + Samba offers a lot of flexibility in file system access management. These are the key access control + facilities present in Samba today: +

    Samba Access Control Facilities

    • + Unix File and Directory Permissions +

      + Samba honours and implements Unix file system access controls. Users + who access a Samba server will do so as a particular MS Windows user. + This information is passed to the Samba server as part of the logon or + connection setup process. Samba uses this user identity to validate + whether or not the user should be given access to file system resources + (files and directories). This chapter provides an overview for those + to whom the Unix permissions and controls are a little strange or unknown. +

    • + Samba Share Definitions +

      + In configuring share settings and controls in the smb.conf file + the network administrator can exercise over-rides to native file + system permissions and behaviours. This can be handy and convenient + to affect behaviour that is more like what MS Windows NT users expect + but it is seldom the best way to achieve this. + The basic options and techniques are described herein. +

    • + Samba Share ACLs +

      + Just like it is possible in MS Windows NT to set ACLs on shares + themselves, so it is possible to do this in Samba. + Very few people make use of this facility, yet it remains on of the + easiest ways to affect access controls (restrictions) and can often + do so with minimum invasiveness compared with other methods. +

    • + MS Windows ACLs through Unix POSIX ACLs +

      + The use of POSIX ACLs on Unix/Linux is possible ONLY if the underlying + operating system supports them. If not, then this option will not be + available to you. Current Unix technology platforms have native support + for POSIX ACLs. There are patches for the Linux kernel that provide + this also. Sadly, few Linux platforms ship today with native ACLs and + Extended Attributes enabled. This chapter has pertinent information + for users of platforms that support them. +

    File System Access Controls

    +Perhaps the most important recognition to be made is the simple fact that MS Windows NT4 / 200x / XP +implement a totally divergent file system technology from what is provided in the Unix operating system +environment. Firstly we should consider what the most significant differences are, then we shall look +at how Samba helps to bridge the differences. +

    MS Windows NTFS Comparison with Unix File Systems

    + Samba operates on top of the Unix file system. This means it is subject to Unix file system conventions + and permissions. It also means that if the MS Windows networking environment requires file system + behaviour that differs from unix file system behaviour then somehow Samba is responsible for emulating + that in a transparent and consistent manner. +

    + It is good news that Samba does this to a very large extent and on top of that provides a high degree + of optional configuration to over-ride the default behaviour. We will look at some of these over-rides, + but for the greater part we will stay within the bounds of default behaviour. Those wishing to explore + to depths of control ability should review the smb.conf man page. +

    File System Feature Comparison

    Name Space

    + MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, Unix file names + may be 1023 characters long. In MS Windows file extensions indicate particular file types, + in Unix this is not so rigorously observed as all names are considered arbitrary. +

    + What MS Windows calls a Folder, Unix calls a directory, +

    Case Sensitivity

    + MS Windows file names are generally Upper Case if made up of 8.3 (ie: 8 character file name + and 3 character extension. If longer than 8.3 file names are Case Preserving, and Case + Insensitive. +

    + Unix file and directory names are Case Sensitive and Case Preserving. Samba implements the + MS Windows file name behaviour, but it does so as a user application. The Unix file system + provides no mechanism to perform case insensitive file name lookups. MS Windows does this + by default. This means that Samba has to carry the processing overhead to provide features + that are NOT native to the Unix operating system environment. +

    + Consider the following, all are unique Unix names but one single MS Windows file name: + + MYFILE.TXT + MyFile.txt + myfile.txt + + So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in Unix + they can. So what should Samba do if all three are present? Answer, the one that is lexically + first will be accessible to MS Windows users, the others are invisible and unaccessible - any + other solution would be suicidal. +

    Directory Separators

    + MS Windows and DOS uses the back-slash '\' as a directory delimiter, Unix uses the forward-slash '/' + as it's directory delimiter. This is transparently handled by Samba. +

    Drive Identification

    + MS Windows products support a notion of drive letters, like C: to represent + disk partitions. Unix has NO concept if separate identifiers for file partitions since each + such file system is mounted to become part of the over-all directory tree. + The Unix directory tree begins at '/', just like the root of a DOS drive is specified like + C:\. +

    File Naming Conventions

    + MS Windows generally never experiences file names that begin with a '.', while in Unix these + are commonly found in a user's home directory. Files that begin with a '.' are typically + either start up files for various Unix applications, or they may be files that contain + start-up configuration data. +

    Links and Short-Cuts

    + MS Windows make use of "links and Short-Cuts" that are actually special types of files that will + redirect an attempt to execute the file to the real location of the file. Unix knows of file and directory + links, but they are entirely different from what MS Windows users are used to. +

    + Symbolic links are files in Unix that contain the actual location of the data (file OR directory). An + operation (like read or write) will operate directly on the file referenced. Symbolic links are also + referred to as 'soft links'. A hard link is something that MS Windows is NOT familiar with. It allows + one physical file to be known simultaneously by more than one file name. +

    + There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort + in the process of becoming familiar with Unix/Linux. These are best left for a text that is dedicated to the + purpose of Unix/Linux training/education. +

    Managing Directories

    + There are three basic operations for managing directories, create, delete, rename. +

    Table 13.1. Managing directories with unix and windows

    ActionMS Windows CommandUnix Command
    createmd foldermkdir folder
    deleterd folderrmdir folder
    renamerename oldname newnamemv oldname newname

    +

    File and Directory Access Control

    + The network administrator is strongly advised to read foundational training manuals and reference materials + regarding file and directory permissions maintenance. Much can be achieved with the basic Unix permissions + without having to resort to more complex facilities like POSIX Access Control Lists (ACLs) or Extended + Attributes (EAs). +

    + Unix/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. + A Unix file listing looks as follows:- + + 

    +	jht@frodo:~/stuff> ls -la
+	total 632
+	drwxr-xr-x   13 jht   users      816 2003-05-12 22:56 .
+	drwxr-xr-x   37 jht   users     3800 2003-05-12 22:29 ..
+	d---------    2 jht   users       48 2003-05-12 22:29 muchado00
+	d--x--x--x    2 jht   users       48 2003-05-12 22:29 muchado01
+	dr-xr-xr-x    2 jht   users       48 2003-05-12 22:29 muchado02
+	drwxrwxrwx    2 jht   users       48 2003-05-12 22:29 muchado03
+	drw-rw-rw-    2 jht   users       48 2003-05-12 22:29 muchado04
+	d-w--w--w-    2 jht   users       48 2003-05-12 22:29 muchado05
+	dr--r--r--    2 jht   users       48 2003-05-12 22:29 muchado06
+	drwxrwxrwt    2 jht   users       48 2003-05-12 22:29 muchado07
+	drwsrwsrwx    2 jht   users       48 2003-05-12 22:29 muchado08
+	----------    1 jht   users     1242 2003-05-12 22:31 mydata00.lst
+	---x--x--x    1 jht   users     1674 2003-05-12 22:33 mydata01.lst
+	--w--w--w-    1 jht   users     7754 2003-05-12 22:33 mydata02.lst
+	--wx-wx-wx    1 jht   users   260179 2003-05-12 22:33 mydata03.lst
+	-r--r--r--    1 jht   users    21017 2003-05-12 22:32 mydata04.lst
+	-r-xr-xr-x    1 jht   users   206339 2003-05-12 22:32 mydata05.lst
+	-rw-rw-rw-    1 jht   users    41105 2003-05-12 22:32 mydata06.lst
+	-rwxrwxrwx    1 jht   users    19312 2003-05-12 22:32 mydata07.lst
+	jht@frodo:~/stuff>
+

    +

    + The columns above represent (from left to right): permissions, no blocks used, owner, group, size (bytes), access date, access time, file name. +

    + The permissions field is made up of: + + 

    +	 JRV: Put this into a diagram of some sort
+	[ type  ] [ users ] [ group ] [ others ]   [File, Directory Permissions]
+	[ d | l ] [ r w x ] [ r w x ] [ r w x  ]
+	  |   |     | | |     | | |     | | |
+	  |   |     | | |     | | |     | | |-----> Can Execute, List files
+	  |   |     | | |     | | |     | |-------> Can Write,   Create files
+	  |   |     | | |     | | |     |---------> Can Read,    Read files
+	  |   |     | | |     | | |---------------> Can Execute, List files
+	  |   |     | | |     | |-----------------> Can Write,   Create files
+	  |   |     | | |     |-------------------> Can Read,    Read files
+	  |   |     | | |-------------------------> Can Execute, List files
+	  |   |     | |---------------------------> Can Write,   Create files
+	  |   |     |-----------------------------> Can Read,    Read files
+	  |   |-----------------------------------> Is a symbolic Link
+	  |---------------------------------------> Is a directory
+

    +

    + Any bit flag may be unset. An unset bit flag is the equivalent of 'Can NOT' and is represented as a '-' character. - testprns -a printer '|/bin/cat printcap' -

    Setting up printcap and print servers

    -You may need to set up some printcaps for your Samba system to use. -It is strongly recommended that you use the facilities provided by -the print spooler to set up queues and printcap information. +

    Example 13.1. Example File

    +		-rwxr-x---   Means: The owner (user) can read, write, execute
+		                    the group can read and execute
+		                    everyone else can NOT do anything with it
+

    + +

    + Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = Unix Domain Socket. +

    + The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x), + execute only if the file is a directory or already has execute permission for some user (X), set user or group ID on execution (s), + sticky (t). +

    + When the sticky bit is set on a directory, files in that directory may be unlinked (deleted) or renamed only by root or their owner. + Without the sticky bit, anyone able to write to the directory can delete or rename files. The sticky bit is commonly found on + directories, such as /tmp, that are world-writable. +

    + When the set user or group ID bit (s) is set on a directory, then all files created within it will be owned by the user and/or + group whose 'set user or group' bit is set. This can be very helpful in setting up directories that for which it is desired that + all users who are in a group should be able to write to and read from a file, particularly when it is undesirable for that file + to be exclusively owned by a user who's primary group is not the group that all such users belong to. +

    + When a directory is set drw-r----- this means that the owner can read and create (write) files in it, but because + the (x) execute flags are not set files can not be listed (seen) in the directory by anyone. The group can read files in the + directory but can NOT create new files. NOTE: If files in the directory are set to be readable and writable for the group, then + group members will be able to write to (or delete) them. +

    Share Definition Access Controls

    +The following parameters in the smb.conf file sections that define a share control or affect access controls. +Before using any of the following options please refer to the man page for smb.conf. +

    User and Group Based Controls

    + User and group based controls can prove very useful. In some situations it is distinctly desirable to affect all + file system operations as if a single user is doing this, the use of the force user and + force group behaviour will achieve this. In other situations it may be necessary to affect a + paranoia level of control to ensure that only particular authorised persons will be able to access a share or + it's contents, here the use of the valid users or the invalid users may + be most useful. +

    + As always, it is highly advisable to use the least difficult to maintain and the least ambiguous method for + controlling access. Remember, that when you leave the scene someone else will need to provide assistance and + if that person finds too great a mess, or if they do not understand what you have done then there is risk of + Samba being removed and an alternative solution being adopted. +

    Table 13.2. User and Group Based Controls

    Control ParameterDescription - Action - Notes
    admin users

    + List of users who will be granted administrative privileges on the share. + They will do all file operations as the super-user (root). + Any user in this list will be able to do anything they like on the share, + irrespective of file permissions. +

    force group

    + Specifies a UNIX group name that will be assigned as the default primary group + for all users connecting to this service. +

    force user

    + Specifies a UNIX user name that will be assigned as the default user for all users connecting to this service. + This is useful for sharing files. Incorrect use can cause security problems. +

    guest ok

    + If this parameter is set for a service, then no password is required to connect to the service. Privileges will be + those of the guest account. +

    invalid users

    + List of users that should not be allowed to login to this service. +

    only user

    + Controls whether connections with usernames not in the user list will be allowed. +

    read list

    + List of users that are given read-only access to a service. Users in this list + will not be given write access, no matter what the read only option is set to. +

    username

    + Refer to the smb.conf man page for more information - this is a complex and potentially misused parameter. +

    valid users

    + List of users that should be allowed to login to this service. +

    write list

    + List of users that are given read-write access to a service. +

    File and Directory Permissions Based Controls

    + The following file and directory permission based controls, if misused, can result in considerable difficulty to + diagnose the cause of mis-configuration. Use them sparingly and carefully. By gradually introducing each one by one + undesirable side-effects may be detected. In the event of a problem, always comment all of them out and then gradually + re-introduce them in a controlled fashion. +

    Table 13.3. File and Directory Permission Based Controls

    Control ParameterDescription - Action - Notes
    create mask

    + Refer to the smb.conf man page. +

    directory mask

    + The octal modes used when converting DOS modes to UNIX modes when creating UNIX directories. + See also: directory security mask. +

    dos filemode

    + Enabling this parameter allows a user who has write access to the file to modify the permissions on it. +

    force create mode

    + This parameter specifies a set of UNIX mode bit permissions that will always be set on a file created by Samba. +

    force directory mode

    + This parameter specifies a set of UNIX mode bit permissions that will always be set on a directory created by Samba. +

    force directory security mode

    + Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory +

    force security mode

    + Controls UNIX permission bits modified when a Windows NT client manipulates UNIX permissions. +

    hide unreadable

    + Prevents clients from seeing the existence of files that cannot be read. +

    hide unwriteable files

    + Prevents clients from seeing the existence of files that cannot be written to. Unwriteable directories are shown as usual. +

    nt acl support

    + This parameter controls whether smbd will attempt to map UNIX permissions into Windows NT access control lists. +

    security mask

    + Controls UNIX permission bits modified when a Windows NT client is manipulating the UNIX permissions on a file. +

    Miscellaneous Controls

    + The following are documented because of the prevalence of administrators creating inadvertant barriers to file + access by not understanding the full implications of smb.conf file settings. +

    Table 13.4. Other Controls

    Control ParameterDescription - Action - Notes
    case sensitive, default case, short preserve case

    + This means that all file name lookup will be done in a case sensitive manner. + Files will be created with the precise filename Samba received from the MS Windows client. +

    csc policy

    + Client Side Caching Policy - parallels MS Windows client side file caching capabilities. +

    dont descend

    + Allows to specify a comma-delimited list of directories that the server should always show as empty. +

    dos filetime resolution

    + This option is mainly used as a compatibility option for Visual C++ when used against Samba shares. +

    dos filetimes

    + DOS and Windows allows users to change file time stamps if they can write to the file. POSIX semantics prevent this. + This options allows DOS and Windows behaviour. +

    fake oplocks

    + Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an + oplock then the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. +

    hide dot files, hide files, veto files

    + Note: MS Windows Explorer allows over-ride of files marked as hidden so they will still be visible. +

    read only

    + If this parameter is yes, then users of a service may not create or modify files in the service's directory. +

    veto files

    + List of files and directories that are neither visible nor accessible. +

    Access Controls on Shares

    + This section deals with how to configure Samba per share access control restrictions. + By default, Samba sets no restrictions on the share itself. Restrictions on the share itself + can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can + connect to a share. In the absence of specific restrictions the default setting is to allow + the global user Everyone Full Control (ie: Full control, Change and Read). +

    + At this time Samba does NOT provide a tool for configuring access control setting on the Share + itself. Samba does have the capacity to store and act on access control settings, but the only + way to create those settings is to use either the NT4 Server Manager or the Windows 200x MMC for + Computer Management. +

    + Samba stores the per share access control settings in a file called share_info.tdb. + The location of this file on your system will depend on how samba was compiled. The default location + for Samba's tdb files is under /usr/local/samba/var. If the tdbdump + utility has been compiled and installed on your system, then you can examine the contents of this file + by: tdbdump share_info.tdb. +

    Share Permissions Management

    + The best tool for the task is platform dependant. Choose the best tool for your environment. +

    Windows NT4 Workstation/Server

    + The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. + Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. + You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below. +

    Procedure 13.1. Instructions

    1. + Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu + select Computer, then click on the Shared Directories entry. +

    2. + Now click on the share that you wish to manage, then click on the Properties tab, next click on + the Permissions tab. Now you can add or change access control settings as you wish. +

    Windows 200x/XP

    + On MS Windows NT4/200x/XP system access control lists on the share itself are set using native + tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder, + then select Sharing, then click on Permissions. The default + Windows NT4/200x permission allows Everyone Full Control on the Share. +

    + MS Windows 200x and later all comes with a tool called the Computer Management snap-in for the + Microsoft Management Console (MMC). This tool is located by clicking on Control Panel -> + Administrative Tools -> Computer Management. +

    Procedure 13.2. Instructions

    1. + After launching the MMC with the Computer Management snap-in, click on the menu item Action, + select Connect to another computer. If you are not logged onto a domain you will be prompted + to enter a domain login user identifier and a password. This will authenticate you to the domain. + If you where already logged in with administrative privilege this step is not offered. +

    2. + If the Samba server is not shown in the Select Computer box, then type in the name of the target + Samba server in the field Name:. Now click on the [+] next to + System Tools, then on the [+] next to Shared Folders in the + left panel. +

    3. + Now in the right panel, double-click on the share you wish to set access control permissions on. + Then click on the tab Share Permissions. It is now possible to add access control entities + to the shared folder. Do NOT forget to set what type of access (full control, change, read) you + wish to assign for each entry. +

    Warning

    + Be careful. If you take away all permissions from the Everyone user without removing this user + then effectively no user will be able to access the share. This is a result of what is known as + ACL precedence. ie: Everyone with no access means that MaryK who is part of the group + Everyone will have no access even if this user is given explicit full control access. +

    MS Windows Access Control Lists and Unix Interoperability

    Managing UNIX permissions Using NT Security Dialogs

    Windows NT clients can use their native security settings + dialog box to view and modify the underlying UNIX permissions.

    Note that this ability is careful not to compromise + the security of the UNIX host Samba is running on, and + still obeys all the file permission rules that a Samba + administrator can set.

    Note

    + All access to Unix/Linux system file via Samba is controlled at + the operating system file access control level. When trying to + figure out file access problems it is vitally important to identify + the identity of the Windows user as it is presented by Samba at + the point of file access. This can best be determined from the + Samba log files. +

    Viewing File Security on a Samba Share

    From an NT4/2000/XP client, single-click with the right + mouse button on any file or directory in a Samba mounted + drive letter or UNC path. When the menu pops-up, click + on the Properties entry at the bottom of + the menu. This brings up the file properties dialog + box. Click on the tab Security and you + will see three buttons, Permissions, + Auditing, and Ownership. + The Auditing button will cause either + an error message A requested privilege is not held + by the client to appear if the user is not the + NT Administrator, or a dialog which is intended to allow an + Administrator to add auditing requirements to a file if the + user is logged on as the NT Administrator. This dialog is + non-functional with a Samba share at this time, as the only + useful button, the Add button will not currently + allow a list of users to be seen.

    Viewing file ownership

    Clicking on the Ownership button + brings up a dialog box telling you who owns the given file. The + owner name will be of the form :

    "SERVER\user (Long name)"

    Where SERVER is the NetBIOS name of + the Samba server, user is the user name of + the UNIX user who owns the file, and (Long name) + is the descriptive string identifying the user (normally found in the + GECOS field of the UNIX password database). Click on the + Close button to remove this dialog.

    If the parameter nt acl support + is set to false then the file owner will + be shown as the NT user "Everyone".

    The Take Ownership button will not allow + you to change the ownership of this file to yourself (clicking on + it will display a dialog box complaining that the user you are + currently logged onto the NT client cannot be found). The reason + for this is that changing the ownership of a file is a privileged + operation in UNIX, available only to the root + user. As clicking on this button causes NT to attempt to change + the ownership of a file to the current user logged into the NT + client this will not work with Samba at this time.

    There is an NT chown command that will work with Samba + and allow a user with Administrator privilege connected + to a Samba server as root to change the ownership of + files on both a local NTFS filesystem or remote mounted NTFS + or Samba drive. This is available as part of the Seclib + NT security library written by Jeremy Allison of + the Samba Team, available from the main Samba ftp site.

    Viewing File or Directory Permissions

    The third button is the Permissions + button. Clicking on this brings up a dialog box that shows both + the permissions and the UNIX owner of the file or directory. + The owner is displayed in the form :

    "SERVER\ + user + (Long name)"

    Where SERVER is the NetBIOS name of + the Samba server, user is the user name of + the UNIX user who owns the file, and (Long name) + is the descriptive string identifying the user (normally found in the + GECOS field of the UNIX password database).

    If the parameter nt acl support + is set to false then the file owner will + be shown as the NT user "Everyone" and the + permissions will be shown as NT "Full Control".

    The permissions field is displayed differently for files + and directories, so I'll describe the way file permissions + are displayed first.

    File Permissions

    The standard UNIX user/group/world triplet and + the corresponding "read", "write", "execute" permissions + triplets are mapped by Samba into a three element NT ACL + with the 'r', 'w', and 'x' bits mapped into the corresponding + NT permissions. The UNIX world permissions are mapped into + the global NT group Everyone, followed + by the list of permissions allowed for UNIX world. The UNIX + owner and group permissions are displayed as an NT + user icon and an NT local + group icon respectively followed by the list + of permissions allowed for the UNIX user and group.

    As many UNIX permission sets don't map into common + NT names such as read, + "change" or full control then + usually the permissions will be prefixed by the words + "Special Access" in the NT display list.

    But what happens if the file has no permissions allowed + for a particular UNIX user group or world component ? In order + to allow "no permissions" to be seen and modified then Samba + overloads the NT "Take Ownership" ACL attribute + (which has no meaning in UNIX) and reports a component with + no permissions as having the NT "O" bit set. + This was chosen of course to make it look like a zero, meaning + zero permissions. More details on the decision behind this will + be given below.

    Directory Permissions

    Directories on an NT NTFS file system have two + different sets of permissions. The first set of permissions + is the ACL set on the directory itself, this is usually displayed + in the first set of parentheses in the normal "RW" + NT style. This first set of permissions is created by Samba in + exactly the same way as normal file permissions are, described + above, and is displayed in the same way.

    The second set of directory permissions has no real meaning + in the UNIX permissions world and represents the + inherited permissions that any file created within + this directory would inherit.

    Samba synthesises these inherited permissions for NT by + returning as an NT ACL the UNIX permission mode that a new file + created by Samba on this share would receive.

    Modifying file or directory permissions

    Modifying file and directory permissions is as simple + as changing the displayed permissions in the dialog box, and + clicking the OK button. However, there are + limitations that a user needs to be aware of, and also interactions + with the standard Samba permission masks and mapping of DOS + attributes that need to also be taken into account.

    If the parameter nt acl support + is set to false then any attempt to set + security permissions will fail with an "Access Denied" + message.

    The first thing to note is that the "Add" + button will not return a list of users in Samba (it will give + an error message of The remote procedure call failed + and did not execute). This means that you can only + manipulate the current user/group/world permissions listed in + the dialog box. This actually works quite well as these are the + only permissions that UNIX actually has.

    If a permission triplet (either user, group, or world) + is removed from the list of permissions in the NT dialog box, + then when the OK button is pressed it will + be applied as "no permissions" on the UNIX side. If you then + view the permissions again the "no permissions" entry will appear + as the NT "O" flag, as described above. This + allows you to add permissions back to a file or directory once + you have removed them from a triplet component.

    As UNIX supports only the "r", "w" and "x" bits of + an NT ACL then if other NT security attributes such as "Delete + access" are selected then they will be ignored when applied on + the Samba server.

    When setting permissions on a directory the second + set of permissions (in the second set of parentheses) is + by default applied to all files within that directory. If this + is not what you want you must uncheck the Replace + permissions on existing files checkbox in the NT + dialog before clicking OK.

    If you wish to remove all permissions from a + user/group/world component then you may either highlight the + component and click the Remove button, + or set the component to only have the special Take + Ownership permission (displayed as "O" + ) highlighted.

    Interaction with the standard Samba create mask + parameters

    There are four parameters + to control interaction with the standard Samba create mask parameters. + These are : + +

    security mask
    force security mode
    directory security mask
    force directory security mode

    + +

    Once a user clicks OK to apply the + permissions Samba maps the given permissions into a user/group/world + r/w/x triplet set, and then will check the changed permissions for a + file against the bits set in the + security mask parameter. Any bits that + were changed that are not set to '1' in this parameter are left alone + in the file permissions.

    Essentially, zero bits in the security mask + mask may be treated as a set of bits the user is not + allowed to change, and one bits are those the user is allowed to change. +

    If not set explicitly this parameter is set to the same value as + the create mask + parameter. To allow a user to modify all the + user/group/world permissions on a file, set this parameter + to 0777.

    Next Samba checks the changed permissions for a file against + the bits set in the + force security mode parameter. Any bits + that were changed that correspond to bits set to '1' in this parameter + are forced to be set.

    Essentially, bits set in the force security mode + parameter may be treated as a set of bits that, when + modifying security on a file, the user has always set to be 'on'.

    If not set explicitly this parameter is set to the same value + as the force + create mode parameter. + To allow a user to modify all the user/group/world permissions on a file + with no restrictions set this parameter to 000.

    The security mask and force + security mode parameters are applied to the change + request in that order.

    For a directory Samba will perform the same operations as + described above for a file except using the parameter + directory security mask instead of security + mask, and force directory security mode + parameter instead of force security mode + .

    The directory security mask parameter + by default is set to the same value as the directory mask + parameter and the force directory security + mode parameter by default is set to the same value as + the force directory mode parameter.

    In this way Samba enforces the permission restrictions that + an administrator can set on a Samba share, whilst still allowing users + to modify the permission bits within that restriction.

    If you want to set up a share that allows users full control + in modifying the permission bits on their files and directories and + doesn't force any particular bits to be set 'on', then set the following + parameters in the smb.conf file in that share specific section : +

    security mask = 0777
    force security mode = 0
    directory security mask = 0777
    force directory security mode = 0

    Interaction with the standard Samba file attribute + mapping

    Samba maps some of the DOS attribute bits (such as "read + only") into the UNIX permissions of a file. This means there can + be a conflict between the permission bits set via the security + dialog and the permission bits set by the file attribute mapping. +

    One way this can show up is if a file has no UNIX read access + for the owner it will show up as "read only" in the standard + file attributes tabbed dialog. Unfortunately this dialog is + the same one that contains the security info in another tab.

    What this can mean is that if the owner changes the permissions + to allow themselves read access using the security dialog, clicks + OK to get back to the standard attributes tab + dialog, and then clicks OK on that dialog, then + NT will set the file permissions back to read-only (as that is what + the attributes still say in the dialog). This means that after setting + permissions and clicking OK to get back to the + attributes dialog you should always hit Cancel + rather than OK to ensure that your changes + are not overridden.

    Common Errors

    +File, Directory and Share access problems are very common on the mailing list. The following +are examples taken from the mailing list in recent times. +

    Users can not write to a public share

    + “ + We are facing some troubles with file / directory permissions. I can log on the domain as admin user(root), + and there's a public share, on which everyone needs to have permission to create / modify files, but only + root can change the file, no one else can. We need to constantly go to server to + chgrp -R users * and chown -R nobody * to allow others users to change the file. + ” +

    + There are many ways to solve this problem, here are a few hints: +

    Procedure 13.3. Example Solution:

    1. + Go to the top of the directory that is shared +

    2. + Set the ownership to what ever public owner and group you want + 

      +			find 'directory_name' -type d -exec chown user.group {}\;
+			find 'directory_name' -type d -exec chmod 6775 'directory_name'
+			find 'directory_name' -type f -exec chmod 0775 {} \;
+			find 'directory_name' -type f -exec chown user.group {}\;
+

      +

      Note

      + The above will set the 'sticky bit' on all directories. Read your + Unix/Linux man page on what that does. It causes the OS to assign + to all files created in the directories the ownership of the + directory. +

    3. + + Directory is: /foodbar + 

      +				$ chown jack.engr /foodbar
+

      +

      Note

      +

      This is the same as doing:

      + 

      +					$ chown jack /foodbar
+					$ chgrp engr /foodbar
+

      +

    4. Now do: + + 

      +				$ chmod 6775 /foodbar
+				$ ls -al /foodbar/..
+

      + +

      You should see: + 

      +				drwsrwsr-x  2 jack  engr    48 2003-02-04 09:55 foodbar
+

      +

    5. Now do: + 

      +				$ su - jill
+				$ cd /foodbar
+				$ touch Afile
+				$ ls -al
+

      +

      + You should see that the file Afile created by Jill will have ownership + and permissions of Jack, as follows: + 

      +		-rw-r--r--  1 jack  engr     0 2003-02-04 09:57 Afile
+

      +

    6. + Now in your smb.conf for the share add: + 

      +		force create mode = 0775
+		force directory mode = 6775
+

      +

      Note

      + The above are only needed if your users are not members of the group + you have used. ie: Within the OS do not have write permission on the directory. +

      + An alternative is to set in the smb.conf entry for the share: + 

      +		force user = jack
+		force group = engr
+

      +

    I have set force user and Samba still makes root the owner of all the files + I touch!

    + When you have a user in 'admin users', Samba will always do file operations for + this user as root, even if force user has been set. +

    Chapter 14. File and Record Locking

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Eric Roseme

    HP Oplocks Usage Recommendations Whitepaper

    Table of Contents

    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Additional Reading

    +One area which causes trouble for many network administrators is locking. +The extent of the problem is readily evident from searches over the internet. +

    Features and Benefits

    +Samba provides all the same locking semantics that MS Windows clients expect +and that MS Windows NT4 / 200x servers provide also. +

    +The term locking has exceptionally broad meaning and covers +a range of functions that are all categorized under this one term. +

    +Opportunistic locking is a desirable feature when it can enhance the +perceived performance of applications on a networked client. However, the +opportunistic locking protocol is not robust, and therefore can +encounter problems when invoked beyond a simplistic configuration, or +on extended, slow, or faulty networks. In these cases, operating +system management of opportunistic locking and/or recovering from +repetitive errors can offset the perceived performance advantage that +it is intended to provide. +

    +The MS Windows network administrator needs to be aware that file and record +locking semantics (behaviour) can be controlled either in Samba or by way of registry +settings on the MS Windows client. +

    Note

    +Sometimes it is necessary to disable locking control settings BOTH on the Samba +server as well as on each MS Windows client! +

    Discussion

    +There are two types of locking which need to be performed by a SMB server. +The first is record locking which allows a client to lock +a range of bytes in a open file. The second is the deny modes +that are specified when a file is open.

    -Samba requires either a printcap or program to deliver printcap -information. This printcap information has the format: -

    -  name|alias1|alias2...:option=value:...
-

    -For almost all printing systems, the printer 'name' must be composed -only of alphanumeric or underscore '_' characters. Some systems also -allow hyphens ('-') as well. An alias is an alternative name for the -printer, and an alias with a space in it is used as a 'comment' -about the printer. The printcap format optionally uses a \ at the end of lines -to extend the printcap to multiple lines. +Record locking semantics under Unix is very different from record locking under +Windows. Versions of Samba before 2.2 have tried to use the native fcntl() unix +system call to implement proper record locking between different Samba clients. +This can not be fully correct due to several reasons. The simplest is the fact +that a Windows client is allowed to lock a byte range up to 2^32 or 2^64, +depending on the client OS. The unix locking only supports byte ranges up to 2^31. +So it is not possible to correctly satisfy a lock request above 2^31. There are +many more differences, too many to be listed here. +

    +Samba 2.2 and above implements record locking completely independent of the +underlying unix system. If a byte range lock that the client requests happens +to fall into the range 0-2^31, Samba hands this request down to the Unix system. +All other locks can not be seen by unix anyway.

    -Here are some examples of printcap files: +Strictly a SMB server should check for locks before every read and write call on +a file. Unfortunately with the way fcntl() works this can be slow and may overstress +the rpc.lockd. It is also almost always unnecessary as clients are supposed to +independently make locking calls before reads and writes anyway if locking is +important to them. By default Samba only makes locking calls when explicitly asked +to by a client, but if you set strict locking = yes then it +will make lock checking calls on every read and write.

    -

    1. -pr just printer name -

    2. -pr|alias printer name and alias -

    3. -pr|My Printer printer name, alias used as comment -

    4. -pr:sh:\ Same as pr:sh:cm= testing - :cm= \ - testing -

    5. -pr:sh Same as pr:sh:cm= testing - :cm= testing -

    +You can also disable by range locking completely using locking = no. +This is useful for those shares that don't support locking or don't need it +(such as cdroms). In this case Samba fakes the return codes of locking calls to +tell clients that everything is OK.

    -Samba reads the printcap information when first started. If you make -changes in the printcap information, then you must do the following: -

    1. -make sure that the print spooler is aware of these changes. -The LPRng system uses the 'lpc reread' command to do this. -

    2. -make sure that the spool queues, etc., exist and have the -correct permissions. The LPRng system uses the 'checkpc -f' -command to do this. -

    3. -You now should send a SIGHUP signal to the smbd server to have -it reread the printcap information. -

    Job sent, no output

    -This is the most frustrating part of printing. You may have sent the -job, verified that the job was forwarded, set up a wrapper around -the command to send the file, but there was no output from the printer. -

    -First, check to make sure that the job REALLY is getting to the -right print queue. If you are using a BSD or LPRng print spooler, -you can temporarily stop the printing of jobs. Jobs can still be -submitted, but they will not be printed. Use: -

    -  lpc -Pprinter stop
-

    -Now submit a print job and then use 'lpq -Pprinter' to see if the -job is in the print queue. If it is not in the print queue then -you will have to find out why it is not being accepted for printing. -

    -Next, you may want to check to see what the format of the job really -was. With the assistance of the system administrator you can view -the submitted jobs files. You may be surprised to find that these -are not in what you would expect to call a printable format. -You can use the UNIX 'file' utitily to determine what the job -format actually is: -

    -    cd /var/spool/lpd/printer   # spool directory of print jobs
-    ls                          # find job files
-    file dfA001myhost
-

    -You should make sure that your printer supports this format OR that -your system administrator has installed a 'print filter' that will -convert the file to a format appropriate for your printer. -

    Job sent, strange output

    -Once you have the job printing, you can then start worrying about -making it print nicely. -

    -The most common problem is extra pages of output: banner pages -OR blank pages at the end. -

    -If you are getting banner pages, check and make sure that the -printcap option or printer option is configured for no banners. -If you have a printcap, this is the :sh (suppress header or banner -page) option. You should have the following in your printer. -

    -   printer: ... :sh
-

    -If you have this option and are still getting banner pages, there -is a strong chance that your printer is generating them for you -automatically. You should make sure that banner printing is disabled -for the printer. This usually requires using the printer setup software -or procedures supplied by the printer manufacturer. -

    -If you get an extra page of output, this could be due to problems -with your job format, or if you are generating PostScript jobs, -incorrect setting on your printer driver on the MicroSoft client. -For example, under Win95 there is a option: -

    -  Printers|Printer Name|(Right Click)Properties|Postscript|Advanced|
-

    -that allows you to choose if a Ctrl-D is appended to all jobs. -This is a very bad thing to do, as most spooling systems will -automatically add a ^D to the end of the job if it is detected as -PostScript. The multiple ^D may cause an additional page of output. -

    Raw PostScript printed

    -This is a problem that is usually caused by either the print spooling -system putting information at the start of the print job that makes -the printer think the job is a text file, or your printer simply -does not support PostScript. You may need to enable 'Automatic -Format Detection' on your printer. -

    Advanced Printing

    -Note that you can do some pretty magic things by using your -imagination with the "print command" option and some shell scripts. -Doing print accounting is easy by passing the %U option to a print -command shell script. You could even make the print command detect -the type of output and its size and send it to an appropriate -printer. -

    Real debugging

    -If the above debug tips don't help, then maybe you need to bring in -the bug guns, system tracing. See Tracing.txt in this directory. -

    Chapter 14. CUPS Printing Support

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    Kurt Pfeifle

    <kpfeifle@danka.de>

    (25 March 2003)

    Table of Contents

    Introduction
    Configuring smb.conf for CUPS
    CUPS - RAW Print Through Mode
    CUPS as a network PostScript RIP
    Windows Terminal Servers (WTS) as CUPS clients
    Setting up CUPS for driver download
    Sources of CUPS drivers / PPDs
    cupsaddsmb
    The CUPS Filter Chains
    CUPS Print Drivers and Devices
    Further printing steps
    Limiting the number of pages users can print
    Advanced Postscript Printing from MS Windows
    Auto-Deletion of CUPS spool files

    Introduction

    -The Common Unix Print System (CUPS) has become very popular, but to many it is -a very mystical tool. There is a great deal of uncertainty regarding CUPS and how -it works. The result is seen in a large number of posting on the samba mailing lists -expressing frustration when MS Windows printers appear not to work with a CUPS -backr-end. -

    -This is a good time to point out how CUPS can be used and what it does. CUPS is more -than just a print spooling system - it is a complete printer management system that -complies with HTTP and IPP protocols. It can be managed remotely via a web browser -and it can print using http and ipp protocols. -

    -CUPS allows to creation of RAW printers (ie: NO file format translation) as well as -SMART printers (ie: CUPS does file format conversion as required for the printer). In -many ways this gives CUPS similar capabilities to the MS Windows print monitoring -system. Of course, if you are a CUPS advocate, you would agrue that CUPS is better! -In any case, let us now move on to explore how one may configure CUPS for interfacing -with MS Windows print clients via Samba. -

    -CUPS is a newcomer in the UNIX printing scene, -which has convinced many people upon first trial already. However, it has quite a few -new features, which make it different from other, more traditional printing systems. -

    Configuring smb.conf for CUPS

    -Printing with CUPS in the most basic smb.conf -setup in Samba-3 only needs two settings: printing = cups and -printcap = cups. While CUPS itself doesn't need a printcap -anymore, the cupsd.conf configuration file knows two directives -(example: Printcap /etc/printcap and PrintcapFormat -BSD), which control if such a file should be created for the -convenience of third party applications. Make sure it is set! For details see -man cupsd.conf and other CUPS-related documentation. -

    -If SAMBA is compiled against libcups, then printcap = cups uses the -CUPS API to list printers, submit jobs, etc. Otherwise it maps to the System V commands -with an additional -oraw option for printing. On a Linux system, -you can use the ldd command to find out details (ldd may not be -present on other OS platforms, or its function may be embodied by a different command): -

    -

    transmeta:/home/kurt # ldd `which smbd`
-        libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000)
-        libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000)
-        libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000)
-        libdl.so.2 => /lib/libdl.so.2 (0x401e8000)
-        libnsl.so.1 => /lib/libnsl.so.1 (0x401ec000)
-        libpam.so.0 => /lib/libpam.so.0 (0x40202000)
-        libc.so.6 => /lib/libc.so.6 (0x4020b000)
-        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
-

    -The line "libcups.so.2 => /usr/lib/libcups.so.2 -(0x40123000)" shows there is CUPS support compiled into this version of -Samba. If this is the case, and printing = cups is set, then any -otherwise manually set print command in smb.conf is ignored. -

    CUPS - RAW Print Through Mode

    Note

    -When used in raw print through mode is will be necessary to use the printer -vendor's drivers in each Windows client PC. -

    -When CUPS printers are configured for RAW print-through mode operation it is the -responsibility of the Samba client to fully render the print job (file) in a format -that is suitable for direct delivery to the printer. In this case CUPS will NOT -do any print file format conversion work. -

    -The CUPS files that need to be correctly set for RAW mode printers to work are: - -

    • /etc/cups/mime.types

    • /etc/cups/mime.convs

    - -Both contain entries that must be uncommented to allow RAW mode -operation. -

    -Firstly, to enable CUPS based printing from Samba the following options must be -enabled in your smb.conf file [globals] section: - -

    • printing = CUPS

    • printcap = CUPS

    - -When these parameters are specified the print directives in smb.conf (as well as in -samba itself) will be ignored because samba will directly interface with CUPS through -it's application program interface (API) - so long as Samba has been compiled with -CUPS library (libcups) support. If samba has NOT been compiled with CUPS support then -printing will use the System V AT&T command set with the -oraw -option automatically passing through. -

    -Cupsomatic (an enhanced printing utility that is part of some CUPS implementations) -on the Samba/CUPS server does *not* add any features if a file is really -printed "raw". However, if you have loaded the driver for the Windows client from -the CUPS server, using the "cupsaddsmb" utility, and if this driver is one using -a "Foomatic" PPD, the PJL header in question is already added on the Windows client, -at the time when the driver initially generated the PostScript data and CUPS in true -"-oraw" manner doesn't remove this PJL header and passes the file "as is" to its -printer communication backend. -

    Note

    NOTE: editing in the "mime.convs" and the "mime.types" file does not *enforce* -"raw" printing, it only *allows* it.

    -Print files that arrive from MS Windows printing are "auto-typed" by CUPS. This aids -the process of determining proper treatment while in the print queue system. - +The second class of locking is the deny modes. These +are set by an application when it opens a file to determine what types of +access should be allowed simultaneously with its open. A client may ask for +DENY_NONE, DENY_READ, +DENY_WRITE or DENY_ALL. There are also special compatibility +modes called DENY_FCB and DENY_DOS. +

    Opportunistic Locking Overview

    +Opportunistic locking (Oplocks) is invoked by the Windows file system +(as opposed to an API) via registry entries (on the server AND client) +for the purpose of enhancing network performance when accessing a file +residing on a server. Performance is enhanced by caching the file +locally on the client which allows: +

    Read-ahead:

    + The client reads the local copy of the file, eliminating network latency +

    Write caching:

    + The client writes to the local copy of the file, eliminating network latency +

    Lock caching:

    + The client caches application locks locally, eliminating network latency +

    +The performance enhancement of oplocks is due to the opportunity of +exclusive access to the file - even if it is opened with deny-none - +because Windows monitors the file's status for concurrent access from +other processes. +

    Windows defines 4 kinds of Oplocks:

    Level1 Oplock:

    + The redirector sees that the file was opened with deny + none (allowing concurrent access), verifies that no + other process is accessing the file, checks that + oplocks are enabled, then grants deny-all/read-write/exclusive + access to the file. The client now performs + operations on the cached local file. +

    + If a second process attempts to open the file, the open + is deferred while the redirector "breaks" the original + oplock. The oplock break signals the caching client to + write the local file back to the server, flush the + local locks, and discard read-ahead data. The break is + then complete, the deferred open is granted, and the + multiple processes can enjoy concurrent file access as + dictated by mandatory or byte-range locking options. + However, if the original opening process opened the + file with a share mode other than deny-none, then the + second process is granted limited or no access, despite + the oplock break. +

    Level2 Oplock:

    + Performs like a level1 oplock, except caching is only + operative for reads. All other operations are performed + on the server disk copy of the file. +

    Filter Oplock:

    + Does not allow write or delete file access +

    Batch Oplock:

    + Manipulates file openings and closings - allows caching + of file attributes +

    +An important detail is that oplocks are invoked by the file system, not +an application API. Therefore, an application can close an oplocked +file, but the file system does not relinquish the oplock. When the +oplock break is issued, the file system then simply closes the file in +preparation for the subsequent open by the second process. +

    +Opportunistic Locking is actually an improper name for this feature. +The true benefit of this feature is client-side data caching, and +oplocks is merely a notification mechanism for writing data back to the +networked storage disk. The limitation of opportunistic locking is the +reliability of the mechanism to process an oplock break (notification) +between the server and the caching client. If this exchange is faulty +(usually due to timing out for any number of reasons) then the +client-side caching benefit is negated. +

    +The actual decision that a user or administrator should consider is +whether it is sensible to share amongst multiple users data that will +be cached locally on a client. In many cases the answer is no. +Deciding when to cache or not cache data is the real question, and thus +"opportunistic locking" should be treated as a toggle for client-side +caching. Turn it "ON" when client-side caching is desirable and +reliable. Turn it "OFF" when client-side caching is redundant, +unreliable, or counter-productive. +

    +Opportunistic locking is by default set to "on" by Samba on all +configured shares, so careful attention should be given to each case to +determine if the potential benefit is worth the potential for delays. +The following recommendations will help to characterize the environment +where opportunistic locking may be effectively configured. +

    +Windows Opportunistic Locking is a lightweight performance-enhancing +feature. It is not a robust and reliable protocol. Every +implementation of Opportunistic Locking should be evaluated as a +tradeoff between perceived performance and reliability. Reliability +decreases as each successive rule above is not enforced. Consider a +share with oplocks enabled, over a wide area network, to a client on a +South Pacific atoll, on a high-availability server, serving a +mission-critical multi-user corporate database, during a tropical +storm. This configuration will likely encounter problems with oplocks. +

    +Oplocks can be beneficial to perceived client performance when treated +as a configuration toggle for client-side data caching. If the data +caching is likely to be interrupted, then oplock usage should be +reviewed. Samba enables opportunistic locking by default on all +shares. Careful attention should be given to the client usage of +shared data on the server, the server network reliability, and the +opportunistic locking configuration of each share. +n mission critical high availability environments, data integrity is +often a priority. Complex and expensive configurations are implemented +to ensure that if a client loses connectivity with a file server, a +failover replacement will be available immediately to provide +continuous data availability. +

    +Windows client failover behavior is more at risk of application +interruption than other platforms because it is dependant upon an +established TCP transport connection. If the connection is interrupted +- as in a file server failover - a new session must be established. +It is rare for Windows client applications to be coded to recover +correctly from a transport connection loss, therefore most applications +will experience some sort of interruption - at worst, abort and +require restarting. +

    +If a client session has been caching writes and reads locally due to +opportunistic locking, it is likely that the data will be lost when the +application restarts, or recovers from the TCP interrupt. When the TCP +connection drops, the client state is lost. When the file server +recovers, an oplock break is not sent to the client. In this case, the +work from the prior session is lost. Observing this scenario with +oplocks disabled, and the client was writing data to the file server +real-time, then the failover will provide the data on disk as it +existed at the time of the disconnect. +

    +In mission critical high availability environments, careful attention +should be given to opportunistic locking. Ideally, comprehensive +testing should be done with all affected applications with oplocks +enabled and disabled. +

    Exclusively Accessed Shares

    +Opportunistic locking is most effective when it is confined to shares +that are exclusively accessed by a single user, or by only one user at +a time. Because the true value of opportunistic locking is the local +client caching of data, any operation that interrupts the caching +mechanism will cause a delay. +

    +Home directories are the most obvious examples of where the performance +benefit of opportunistic locking can be safely realized. +

    Multiple-Accessed Shares or Files

    +As each additional user accesses a file in a share with opportunistic +locking enabled, the potential for delays and resulting perceived poor +performance increases. When multiple users are accessing a file on a +share that has oplocks enabled, the management impact of sending and +receiving oplock breaks, and the resulting latency while other clients +wait for the caching client to flush data, offset the performance gains +of the caching user. +

    +As each additional client attempts to access a file with oplocks set, +the potential performance improvement is negated and eventually results +in a performance bottleneck. +

    Unix or NFS Client Accessed Files

    +Local Unix and NFS clients access files without a mandatory +file locking mechanism. Thus, these client platforms are incapable of +initiating an oplock break request from the server to a Windows client +that has a file cached. Local Unix or NFS file access can therefore +write to a file that has been cached by a Windows client, which +exposes the file to likely data corruption. +

    +If files are shared between Windows clients, and either local Unix +or NFS users, then turn opportunistic locking off. +

    Slow and/or Unreliable Networks

    +The biggest potential performance improvement for opportunistic locking +occurs when the client-side caching of reads and writes delivers the +most differential over sending those reads and writes over the wire. +This is most likely to occur when the network is extremely slow, +congested, or distributed (as in a WAN). However, network latency also +has a very high impact on the reliability of the oplock break +mechanism, and thus increases the likelihood of encountering oplock +problems that more than offset the potential perceived performance +gain. Of course, if an oplock break never has to be sent, then this is +the most advantageous scenario to utilize opportunistic locking. +

    +If the network is slow, unreliable, or a WAN, then do not configure +opportunistic locking if there is any chance of multiple users +regularly opening the same file. +

    Multi-User Databases

    +Multi-user databases clearly pose a risk due to their very nature - +they are typically heavily accessed by numerous users at random +intervals. Placing a multi-user database on a share with opportunistic +locking enabled will likely result in a locking management bottleneck +on the Samba server. Whether the database application is developed +in-house or a commercially available product, ensure that the share +has opportunistic locking disabled. +

    PDM Data Shares

    +Process Data Management (PDM) applications such as IMAN, Enovia, and +Clearcase, are increasing in usage with Windows client platforms, and +therefore SMB data stores. PDM applications manage multi-user +environments for critical data security and access. The typical PDM +environment is usually associated with sophisticated client design +applications that will load data locally as demanded. In addition, the +PDM application will usually monitor the data-state of each client. +In this case, client-side data caching is best left to the local +application and PDM server to negotiate and maintain. It is +appropriate to eliminate the client OS from any caching tasks, and the +server from any oplock management, by disabling opportunistic locking on +the share. +

    Beware of Force User

    +Samba includes an smb.conf parameter called force user that changes +the user accessing a share from the incoming user to whatever user is +defined by the smb.conf variable. If opportunistic locking is enabled +on a share, the change in user access causes an oplock break to be sent +to the client, even if the user has not explicitly loaded a file. In +cases where the network is slow or unreliable, an oplock break can +become lost without the user even accessing a file. This can cause +apparent performance degradation as the client continually reconnects +to overcome the lost oplock break. +

    +Avoid the combination of the following:

    • - Files generated by PCL drivers and directed at PCK printers get auto-typed as - application/octet-stream. Unknown file format types also - get auto-typed with this tag. + force user in the smb.conf share configuration.

    • - Files generated by a Postscript driver and directed at a Postscript printer - are auto-typed depending on the auto-detected most suitable MIME type as: - -

      • * application/postscript

      • * application/vnd.cups-postscript

      -

    + Slow or unreliable networks +

  • + Opportunistic Locking Enabled +

    • Advanced Samba Opportunistic Locking Parameters

    +Samba provides opportunistic locking parameters that allow the +administrator to adjust various properties of the oplock mechanism to +account for timing and usage levels. These parameters provide good +versatility for implementing oplocks in environments where they would +likely cause problems. The parameters are: +oplock break wait time, +oplock contention limit. +

    +For most users, administrators, and environments, if these parameters +are required, then the better option is to simply turn oplocks off. +The samba SWAT help text for both parameters reads "DO NOT CHANGE THIS +PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." +This is good advice. +

    Mission Critical High Availability

    +In mission critical high availability environments, data integrity is +often a priority. Complex and expensive configurations are implemented +to ensure that if a client loses connectivity with a file server, a +failover replacement will be available immediately to provide +continuous data availability. +

    +Windows client failover behavior is more at risk of application +interruption than other platforms because it is dependant upon an +established TCP transport connection. If the connection is interrupted +- as in a file server failover - a new session must be established. +It is rare for Windows client applications to be coded to recover +correctly from a transport connection loss, therefore most applications +will experience some sort of interruption - at worst, abort and +require restarting. +

    +If a client session has been caching writes and reads locally due to +opportunistic locking, it is likely that the data will be lost when the +application restarts, or recovers from the TCP interrupt. When the TCP +connection drops, the client state is lost. When the file server +recovers, an oplock break is not sent to the client. In this case, the +work from the prior session is lost. Observing this scenario with +oplocks disabled, and the client was writing data to the file server +real-time, then the failover will provide the data on disk as it +existed at the time of the disconnect. +

    +In mission critical high availability environments, careful attention +should be given to opportunistic locking. Ideally, comprehensive +testing should be done with all affected applications with oplocks +enabled and disabled. +

    Samba Opportunistic Locking Control

    +Opportunistic Locking is a unique Windows file locking feature. It is +not really file locking, but is included in most discussions of Windows +file locking, so is considered a defacto locking feature. +Opportunistic Locking is actually part of the Windows client file +caching mechanism. It is not a particularly robust or reliable feature +when implemented on the variety of customized networks that exist in +enterprise computing. +

    +Like Windows, Samba implements Opportunistic Locking as a server-side +component of the client caching mechanism. Because of the lightweight +nature of the Windows feature design, effective configuration of +Opportunistic Locking requires a good understanding of its limitations, +and then applying that understanding when configuring data access for +each particular customized network and client usage state.

    -"application/postscript" first goes thru the "pstops" filter (where the page counting -and accounting takes place). The outcome will be of MIME type -"application/vnd.cups-postscript". The pstopsfilter reads and uses information from -the PPD and inserts user-provided options into the PostScript file. As a consequence, -the filtered file could possibly have an unwanted PJL header. -

    -"application/postscript" will be all files with a ".ps", ".ai", ".eps" suffix or which -have as their first character string one of "%!" or ">04<%". -

    -"application/vnd.cups-postscript" will files which contain the string -"LANGUAGE=POSTSCRIPT" (or similar variations with different capitalization) in the -first 512 bytes, and also contain the "PJL super escape code" in the first 128 bytes -(">1B<%-12345X"). Very likely, most PostScript files generated on Windows using a CUPS -or other PPD, will have to be auto-typed as "vnd.cups-postscript". A file produced -with a "Generic PostScript driver" will just be tagged "application/postscript". -

    -Once the file is in "application/vnd.cups-postscript" format, either "pstoraster" -or "cupsomatic" will take over (depending on the printer configuration, as -determined by the PPD in use). +Opportunistic locking essentially means that the client is allowed to download and cache +a file on their hard drive while making changes; if a second client wants to access the +file, the first client receives a break and must synchronise the file back to the server. +This can give significant performance gains in some cases; some programs insist on +synchronising the contents of the entire file back to the server for a single change. +

    +Level1 Oplocks (aka just plain "oplocks") is another term for opportunistic locking. +

    +Level2 Oplocks provides opportunistic locking for a file that will be treated as +read only. Typically this is used on files that are read-only or +on files that the client has no initial intention to write to at time of opening the file. +

    +Kernel Oplocks are essentially a method that allows the Linux kernel to co-exist with +Samba's oplocked files, although this has provided better integration of MS Windows network +file locking with the under lying OS, SGI IRIX and Linux are the only two OS's that are +oplock aware at this time. +

    +Unless your system supports kernel oplocks, you should disable oplocks if you are +accessing the same files from both Unix/Linux and SMB clients. Regardless, oplocks should +always be disabled if you are sharing a database file (e.g., Microsoft Access) between +multiple clients, as any break the first client receives will affect synchronisation of +the entire file (not just the single record), which will result in a noticeable performance +impairment and, more likely, problems accessing the database in the first place. Notably, +Microsoft Outlook's personal folders (*.pst) react very badly to oplocks. If in doubt, +disable oplocks and tune your system from that point. +

    +If client-side caching is desirable and reliable on your network, you will benefit from +turning on oplocks. If your network is slow and/or unreliable, or you are sharing your +files among other file sharing mechanisms (e.g., NFS) or across a WAN, or multiple people +will be accessing the same files frequently, you probably will not benefit from the overhead +of your client sending oplock breaks and will instead want to disable oplocks for the share. +

    +Another factor to consider is the perceived performance of file access. If oplocks provide no +measurable speed benefit on your network, it might not be worth the hassle of dealing with them. +

    Example Configuration

    +In the following we examine two distinct aspects of Samba locking controls. +

    Disabling Oplocks

    +You can disable oplocks on a per-share basis with the following: +

    +

    +[acctdata]
+	oplocks = False
+	level2 oplocks = False
+

    +

    +The default oplock type is Level1. Level2 Oplocks are enabled on a per-share basis +in the smb.conf file. +

    +Alternately, you could disable oplocks on a per-file basis within the share: +

    +

    +	veto oplock files = /*.mdb/*.MDB/*.dbf/*.DBF/
+

    +

    +If you are experiencing problems with oplocks as apparent from Samba's log entries, +you may want to play it safe and disable oplocks and level2 oplocks. +

    Disabling Kernel OpLocks

    +Kernel OpLocks is an smb.conf parameter that notifies Samba (if +the UNIX kernel has the capability to send a Windows client an oplock +break) when a UNIX process is attempting to open the file that is +cached. This parameter addresses sharing files between UNIX and +Windows with Oplocks enabled on the Samba server: the UNIX process +can open the file that is Oplocked (cached) by the Windows client and +the smbd process will not send an oplock break, which exposes the file +to the risk of data corruption. If the UNIX kernel has the ability to +send an oplock break, then the kernel oplocks parameter enables Samba +to send the oplock break. Kernel oplocks are enabled on a per-server +basis in the smb.conf file. +

    +

    +[global]
+kernel oplocks = yes
+

    +The default is "no". +

    +Veto OpLocks is an smb.conf parameter that identifies specific files for +which Oplocks are disabled. When a Windows client opens a file that +has been configured for veto oplocks, the client will not be granted +the oplock, and all operations will be executed on the original file on +disk instead of a client-cached file copy. By explicitly identifying +files that are shared with UNIX processes, and disabling oplocks for +those files, the server-wide Oplock configuration can be enabled to +allow Windows clients to utilize the performance benefit of file +caching without the risk of data corruption. Veto Oplocks can be +enabled on a per-share basis, or globally for the entire server, in the +smb.conf file: +

    +

    <title>Example Veto OpLock Settings</title>
+[global]
+        veto oplock files = /filename.htm/*.txt/
+
+[share_name]
+        veto oplock files = /*.exe/filename.ext/
+

    +

    +Oplock break wait time is an smb.conf parameter that adjusts the time +interval for Samba to reply to an oplock break request. Samba +recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND +UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Wait Time can only be +configured globally in the smb.conf file: +

    +

    +[global]
+          oplock break wait time =  0 (default)
+

    +

    +Oplock break contention limit is an smb.conf parameter that limits the +response of the Samba server to grant an oplock if the configured +number of contending clients reaches the limit specified by the +parameter. Samba recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU +HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break +Contention Limit can be enable on a per-share basis, or globally for +the entire server, in the smb.conf file: +

    +

    +[global]
+          oplock break contention limit =  2 (default)
+
+[share_name]
+         oplock break contention limit =  2 (default)
+

    +

    MS Windows Opportunistic Locking and Caching Controls

    +There is a known issue when running applications (like Norton Anti-Virus) on a Windows 2000/ XP +workstation computer that can affect any application attempting to access shared database files +across a network. This is a result of a default setting configured in the Windows 2000/XP +operating system known as Opportunistic Locking. When a workstation +attempts to access shared data files located on another Windows 2000/XP computer, +the Windows 2000/XP operating system will attempt to increase performance by locking the +files and caching information locally. When this occurs, the application is unable to +properly function, which results in an Access Denied + error message being displayed during network operations. +

    +All Windows operating systems in the NT family that act as database servers for data files +(meaning that data files are stored there and accessed by other Windows PCs) may need to +have opportunistic locking disabled in order to minimize the risk of data file corruption. +This includes Windows 9x/Me, Windows NT, Windows 200x and Windows XP. +

    +If you are using a Windows NT family workstation in place of a server, you must also +disable opportunistic locking (oplocks) on that workstation. For example, if you use a +PC with the Windows NT Workstation operating system instead of Windows NT Server, and you +have data files located on it that are accessed from other Windows PCs, you may need to +disable oplocks on that system. +

    +The major difference is the location in the Windows registry where the values for disabling +oplocks are entered. Instead of the LanManServer location, the LanManWorkstation location +may be used. +

    +You can verify (or change or add, if necessary) this Registry value using the Windows +Registry Editor. When you change this registry value, you will have to reboot the PC +to ensure that the new setting goes into effect. +

    +The location of the client registry entry for opportunistic locking has changed in +Windows 2000 from the earlier location in Microsoft Windows NT. +

    Note

    +Windows 2000 will still respect the EnableOplocks registry value used to disable oplocks +in earlier versions of Windows. +

    +You can also deny the granting of opportunistic locks by changing the following registry entries: +

    +

    +	HKEY_LOCAL_MACHINE\System\
+		CurrentControlSet\Services\MRXSmb\Parameters\
+
+		OplocksDisabled REG_DWORD 0 or 1
+		Default: 0 (not disabled)
+

    +

    Note

    +The OplocksDisabled registry value configures Windows clients to either request or not +request opportunistic locks on a remote file. To disable oplocks, the value of + OplocksDisabled must be set to 1. +

    +

    +	HKEY_LOCAL_MACHINE\System\
+		CurrentControlSet\Services\LanmanServer\Parameters
+
+		EnableOplocks REG_DWORD 0 or 1
+		Default: 1 (Enabled by Default)
+
+		EnableOpLockForceClose REG_DWORD 0 or 1
+		Default: 0 (Disabled by Default)
+

    +

    Note

    +The EnableOplocks value configures Windows-based servers (including Workstations sharing +files) to allow or deny opportunistic locks on local files. +

    +To force closure of open oplocks on close or program exit EnableOpLockForceClose must be set to 1. +

    +An illustration of how level II oplocks work: +

    • + Station 1 opens the file, requesting oplock. +

    • + Since no other station has the file open, the server grants station 1 exclusive oplock. +

    • + Station 2 opens the file, requesting oplock. +

    • + Since station 1 has not yet written to the file, the server asks station 1 to Break + to Level II Oplock. +

    • + Station 1 complies by flushing locally buffered lock information to the server. +

    • + Station 1 informs the server that it has Broken to Level II Oplock (alternatively, + station 1 could have closed the file). +

    • + The server responds to station 2's open request, granting it level II oplock. + Other stations can likewise open the file and obtain level II oplock. +

    • + Station 2 (or any station that has the file open) sends a write request SMB. + The server returns the write response. +

    • + The server asks all stations that have the file open to Break to None, meaning no + station holds any oplock on the file. Because the workstations can have no cached + writes or locks at this point, they need not respond to the break-to-none advisory; + all they need do is invalidate locally cashed read-ahead data. +

    Workstation Service Entries

    +	\HKEY_LOCAL_MACHINE\System\
+		CurrentControlSet\Services\LanmanWorkstation\Parameters
+
+	UseOpportunisticLocking   REG_DWORD   0 or 1
+	Default: 1 (true)
+

    +Indicates whether the redirector should use opportunistic-locking (oplock) performance +enhancement. This parameter should be disabled only to isolate problems. +

    Server Service Entries

    +	\HKEY_LOCAL_MACHINE\System\
+		CurrentControlSet\Services\LanmanServer\Parameters
+
+	EnableOplocks   REG_DWORD   0 or 1
+	Default: 1 (true)
+

    +Specifies whether the server allows clients to use oplocks on files. Oplocks are a +significant performance enhancement, but have the potential to cause lost cached +data on some networks, particularly wide-area networks. +

    +	MinLinkThroughput   REG_DWORD   0 to infinite bytes per second
+	Default: 0
+

    +Specifies the minimum link throughput allowed by the server before it disables +raw and opportunistic locks for this connection. +

    +	MaxLinkDelay   REG_DWORD   0 to 100,000 seconds
+	Default: 60
+

    +Specifies the maximum time allowed for a link delay. If delays exceed this number, +the server disables raw I/O and opportunistic locking for this connection. +

    +	OplockBreakWait   REG_DWORD   10 to 180 seconds
+	Default: 35
+

    +Specifies the time that the server waits for a client to respond to an oplock break +request. Smaller values can allow detection of crashed clients more quickly but can +potentially cause loss of cached data. +

    Persistent Data Corruption

    +If you have applied all of the settings discussed in this paper but data corruption problems +and other symptoms persist, here are some additional things to check out: +

    +We have credible reports from developers that faulty network hardware, such as a single +faulty network card, can cause symptoms similar to read caching and data corruption. +If you see persistent data corruption even after repeated reindexing, you may have to +rebuild the data files in question. This involves creating a new data file with the +same definition as the file to be rebuilt and transferring the data from the old file +to the new one. There are several known methods for doing this that can be found in +our Knowledge Base. +

    Common Errors

    +In some sites locking problems surface as soon as a server is installed, in other sites +locking problems may not surface for a long time. Almost without exception, when a locking +problem does surface it will cause embarrassment and potential data corruption. +

    +Over the past few years there have been a number of complaints on the samba mailing lists +that have claimed that samba caused data corruption. Three causes have been identified +so far: +

    • + Incorrect configuration of opportunistic locking (incompatible with the application + being used. This is a VERY common problem even where MS Windows NT4 or MS Windows 200x + based servers were in use. It is imperative that the software application vendors' + instructions for configuration of file locking should be followed. If in doubt, + disable oplocks on both the server and the client. Disabling of all forms of file + caching on the MS Windows client may be necessary also. +

    • + Defective network cards, cables, or HUBs / Switched. This is generally a more + prevalent factor with low cost networking hardware, though occasionally there + have been problems with incompatibilities in more up market hardware also. +

    • + There have been some random reports of samba log files being written over data + files. This has been reported by very few sites (about 5 in the past 3 years) + and all attempts to reproduce the problem have failed. The Samba-Team has been + unable to catch this happening and thus has NOT been able to isolate any particular + cause. Considering the millions of systems that use samba, for the sites that have + been affected by this as well as for the Samba-Team this is a frustrating and + a vexing challenge. If you see this type of thing happening please create a bug + report on https://bugzilla.samba.org without delay. Make sure that you give as much + information as you possibly can to help isolate the cause and to allow reproduction + of the problem (an essential step in problem isolation and correction). +

    locking.tdb error messages

    + 

    +	> We are seeing lots of errors in the samba logs like:
+	>
+	>    tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic
+	> 0x4d6f4b61 at offset=36116
+	>
+	> What do these mean?
+

    +

    + Corrupted tdb. Stop all instances of smbd, delete locking.tdb, restart smbd. +

    Additional Reading

    +You may want to check for an updated version of this white paper on our Web site from +time to time. Many of our white papers are updated as information changes. For those papers, +the Last Edited date is always at the top of the paper. +

    +Section of the Microsoft MSDN Library on opportunistic locking: +

    +Opportunistic Locks, Microsoft Developer Network (MSDN), Windows Development > +Windows Base Services > Files and I/O > SDK Documentation > File Storage > File Systems +> About File Systems > Opportunistic Locks, Microsoft Corporation. +http://msdn.microsoft.com/library/en-us/fileio/storage_5yk3.asp +

    +Microsoft Knowledge Base Article Q224992 "Maintaining Transactional Integrity with OPLOCKS", +Microsoft Corporation, April 1999, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q224992. +

    +Microsoft Knowledge Base Article Q296264 "Configuring Opportunistic Locking in Windows 2000", +Microsoft Corporation, April 2001, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296264. +

    +Microsoft Knowledge Base Article Q129202 "PC Ext: Explanation of Opportunistic Locking on Windows NT", + Microsoft Corporation, April 1995, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202. +

    Chapter 15. Securing Samba

    Andrew Tridgell

    Samba Team

    John H. Terpstra

    Samba Team

    May 26, 2003

    Table of Contents

    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?

    Introduction

    +This note was attached to the Samba 2.2.8 release notes as it contained an +important security fix. The information contained here applies to Samba +installations in general. +

    +A new apprentice reported for duty to the Chief Engineer of a boiler house. He said, "Here I am, +if you will show me the boiler I'll start working on it." Then engineer replied, "You're leaning +on it!" +

    +Security concerns are just like that: You need to know a little about the subject to appreciate +how obvious most of it really is. The challenge for most of us is to discover that first morsel +of knowledge with which we may unlock the secrets of the masters. +

    Features and Benefits

    +There are three level at which security principals must be observed in order to render a site +at least moderately secure. These are: the perimeter firewall, the configuration of the host +server that is running Samba, and Samba itself. +

    +Samba permits a most flexible approach to network security. As far as possible Samba implements +the latest protocols to permit more secure MS Windows file and print operations. +

    +Samba may be secured from connections that originate from outside the local network. This may be +done using host based protection (using samba's implementation of a technology +known as "tcpwrappers", or it may be done be using interface based exclusion +so that smbd will bind only to specifically permitted interfaces. It is also +possible to set specific share or resource based exclusions, eg: on the IPC$ +auto-share. The IPC$ share is used for browsing purposes as well as to establish +TCP/IP connections. +

    +Another method by which Samba may be secured is by way of setting Access Control Entries in an Access +Control List on the shares themselves. This is discussed in the chapter on File, Directory and Share Access +Control. +

    Technical Discussion of Protective Measures and Issues

    +The key challenge of security is the fact that protective measures suffice at best +only to close the door on known exploits and breach techniques. Never assume that +because you have followed these few measures that the Samba server is now an impenetrable +fortress! Given the history of information systems so far, it is only a matter of time +before someone will find yet another vulnerability. +

    Using host based protection

    + In many installations of Samba the greatest threat comes for outside + your immediate network. By default Samba will accept connections from + any host, which means that if you run an insecure version of Samba on + a host that is directly connected to the Internet you can be + especially vulnerable. +

    + One of the simplest fixes in this case is to use the hosts allow and + hosts deny options in the Samba smb.conf configuration file to only + allow access to your server from a specific range of hosts. An example + might be: + 

    +		hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
+		hosts deny = 0.0.0.0/0
+

    + The above will only allow SMB connections from 'localhost' (your own + computer) and from the two private networks 192.168.2 and + 192.168.3. All other connections will be refused as soon + as the client sends its first packet. The refusal will be marked as a + not listening on called name error. +

    User based protection

    + If you want to restrict access to your server to valid users only then the following + method may be of use. In the smb.conf [globals] section put: + 

    +		valid users = @smbusers, jacko
+

    + What this does is, it restricts all server access to either the user jacko + or to members of the system group smbusers. +

    Using interface protection

    + By default Samba will accept connections on any network interface that + it finds on your system. That means if you have a ISDN line or a PPP + connection to the Internet then Samba will accept connections on those + links. This may not be what you want. +

    + You can change this behaviour using options like the following: + 

    +		interfaces = eth* lo
+		bind interfaces only = yes
+

    + This tells Samba to only listen for connections on interfaces with a + name starting with 'eth' such as eth0, eth1, plus on the loopback + interface called 'lo'. The name you will need to use depends on what + OS you are using, in the above I used the common name for Ethernet + adapters on Linux. +

    + If you use the above and someone tries to make a SMB connection to + your host over a PPP interface called 'ppp0' then they will get a TCP + connection refused reply. In that case no Samba code is run at all as + the operating system has been told not to pass connections from that + interface to any samba process. +

    Using a firewall

    + Many people use a firewall to deny access to services that they don't + want exposed outside their network. This can be a very good idea, + although I would recommend using it in conjunction with the above + methods so that you are protected even if your firewall is not active + for some reason. +

    + If you are setting up a firewall then you need to know what TCP and + UDP ports to allow and block. Samba uses the following: +

    UDP/137 - used by nmbd
    UDP/138 - used by nmbd
    TCP/139 - used by smbd
    TCP/445 - used by smbd

    + The last one is important as many older firewall setups may not be + aware of it, given that this port was only added to the protocol in + recent years. +

    Using a IPC$ share deny

    + If the above methods are not suitable, then you could also place a + more specific deny on the IPC$ share that is used in the recently + discovered security hole. This allows you to offer access to other + shares while denying access to IPC$ from potentially untrustworthy + hosts. +

    + To do that you could use: + 

    +[ipc$]
+	hosts allow = 192.168.115.0/24 127.0.0.1
+	hosts deny = 0.0.0.0/0
+

    + this would tell Samba that IPC$ connections are not allowed from + anywhere but the two listed places (localhost and a local + subnet). Connections to other shares would still be allowed. As the + IPC$ share is the only share that is always accessible anonymously + this provides some level of protection against attackers that do not + know a username/password for your host. +

    + If you use this method then clients will be given a access denied + reply when they try to access the IPC$ share. That means that those + clients will not be able to browse shares, and may also be unable to + access some other resources. +

    + This is not recommended unless you cannot use one of the other + methods listed above for some reason. +

    NTLMv2 Security

    + To configure NTLMv2 authentication the following registry keys are worth knowing about: +

    + 

    +		[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
+		"lmcompatibilitylevel"=dword:00000003
+
+		0x3 - Send NTLMv2 response only. Clients will use NTLMv2 authentication,
+		use NTLMv2 session security if the server supports it. Domain
+		controllers accept LM, NTLM and NTLMv2 authentication.
+
+		[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
+		"NtlmMinClientSec"=dword:00080000
+
+		0x80000 - NTLMv2 session security. If either NtlmMinClientSec or
+		NtlmMinServerSec is set to 0x80000, the connection will fail if NTLMv2
+		session security is not negotiated.
+

    +

    Upgrading Samba

    +Please check regularly on http://www.samba.org/ for updates and +important announcements. Occasionally security releases are made and +it is highly recommended to upgrade Samba when a security vulnerability +is discovered. +

    Common Errors

    +If all of samba and host platform configuration were really as intuitive as one might like then this +section would not be necessary. Security issues are often vexing for a support person to resolve, not +because of the complexity of the problem, but for reason that most administrators who post what turns +out to be a security problem request are totally convinced that the problem is with Samba. +

    Smbclient works on localhost, but the network is dead

    + This is a very common problem. Red Hat Linux (as do others) will install a default firewall. + With the default firewall in place only traffic on the loopback adapter (IP address 127.0.0.1) + will be allowed through the firewall. +

    + The solution is either to remove the firewall (stop it) or to modify the firewall script to + allow SMB networking traffic through. See section above in this chapter. +

    Why can users access home directories of other users?

    + “ + We are unable to keep individual users from mapping to any other user's + home directory once they have supplied a valid password! They only need + to enter their own password. I have not found *any* method that I can + use to configure samba to enforce that only a user may map their own + home directory. + ” +

    “ + User xyzzy can map his home directory. Once mapped user xyzzy can also map + *anyone* else's home directory! + ”

    + This is not a security flaw, it is by design. Samba allows + users to have *exactly* the same access to the UNIX filesystem + as they would if they were logged onto the UNIX box, except + that it only allows such views onto the file system as are + allowed by the defined shares. +

    + This means that if your UNIX home directories are set up + such that one user can happily cd into another users + directory and do an ls, the UNIX security solution is to + change the UNIX file permissions on the users home directories + such that the cd and ls would be denied. +

    + Samba tries very hard not to second guess the UNIX administrators + security policies, and trusts the UNIX admin to set + the policies and permissions he or she desires. +

    + Samba does allow the setup you require when you have set the + only user = yes option on the share, is that you have not set the + valid users list for the share. +

    + Note that only user works in conjunction with the users= list, + so to get the behavior you require, add the line : + 

    +	users = %S
+

    + this is equivalent to: + 

    +	valid users = %S
+

    + to the definition of the [homes] share, as recommended in + the smb.conf man page. +

    Chapter 16. Interdomain Trust Relationships

    John H. Terpstra

    Samba Team

    Rafal Szczesniak

    Samba Team

    April 3, 2003

    Table of Contents

    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    Common Errors
    Tell me about Trust Relationships using Samba

    +Samba-3 supports NT4 style domain trust relationships. This is feature that many sites +will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to +adopt Active Directory or an LDAP based authentication back end. This section explains +some background information regarding trust relationships and how to create them. It is now +possible for Samba-3 to NT4 trust (and vice versa), as well as Samba3 to Samba3 trusts. +

    Features and Benefits

    +Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4 style +trust relationships. This imparts to Samba similar scalability as is possible with +MS Windows NT4. +

    +Given that Samba-3 has the capability to function with a scalable backend authentication +database such as LDAP, and given it's ability to run in Primary as well as Backup Domain control +modes, the administrator would be well advised to consider alternatives to the use of +Interdomain trusts simply because by the very nature of how this works it is fragile. +That was, after all, a key reason for the development and adoption of Microsoft Active Directory. +

    Trust Relationship Background

    +MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure. +The limitations of this architecture as it affects the scalability of MS Windows networking +in large organisations is well known. Additionally, the flat-name space that results from +this design significantly impacts the delegation of administrative responsibilities in +large and diverse organisations. +

    +Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means +of circumventing the limitations of the older technologies. Not every organisation is ready +or willing to embrace ADS. For small companies the older NT4 style domain security paradigm +is quite adequate, there thus remains an entrenched user base for whom there is no direct +desire to go through a disruptive change to adopt ADS. +

    +Microsoft introduced with MS Windows NT the ability to allow differing security domains +to affect a mechanism so that users from one domain may be given access rights and privileges +in another domain. The language that describes this capability is couched in terms of +Trusts. Specifically, one domain will trust the users +from another domain. The domain from which users are available to another security domain is +said to be a trusted domain. The domain in which those users have assigned rights and privileges +is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only, +thus if users in both domains are to have privileges and rights in each others' domain, then it is +necessary to establish two (2) relationships, one in each direction. +

    +In an NT4 style MS security domain, all trusts are non-transitive. This means that if there +are three (3) domains (let's call them RED, WHITE, and BLUE) where RED and WHITE have a trust +relationship, and WHITE and BLUE have a trust relationship, then it holds that there is no +implied trust between the RED and BLUE domains. ie: Relationships are explicit and not +transitive. +

    +New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way +by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE +domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is +an inherent feature of ADS domains. Samba-3 implements MS Windows NT4 +style Interdomain trusts and interoperates with MS Windows 200x ADS +security domains in similar manner to MS Windows NT4 style domains. +

    Native MS Windows NT4 Trusts Configuration

    +There are two steps to creating an interdomain trust relationship. +

    NT4 as the Trusting Domain (ie. creating the trusted account)

    +For MS Windows NT4, all domain trust relationships are configured using the +Domain User Manager. To affect a two way trust relationship it is +necessary for each domain administrator to make available (for use by an external domain) it's +security resources. This is done from the Domain User Manager Policies entry on the menu bar. +From the Policy menu, select Trust Relationships, then +next to the lower box that is labelled Permitted to Trust this Domain are two +buttons, Add and Remove. The Add +button will open a panel in which needs to be entered the remote domain that will be able to assign +user rights to your domain. In addition it is necessary to enter a password +that is specific to this trust relationship. The password needs to be +typed twice (for standard confirmation). +

    NT4 as the Trusted Domain (ie. creating trusted account's password)

    +A trust relationship will work only when the other (trusting) domain makes the appropriate connections +with the trusted domain. To consummate the trust relationship the administrator will launch the +Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the +Add button that is next to the box that is labelled +Trusted Domains. A panel will open in which must be entered the name of the remote +domain as well as the password assigned to that trust. +

    Configuring Samba NT-style Domain Trusts

    +This description is meant to be a fairly short introduction about how to set up a Samba server so +that it could participate in interdomain trust relationships. Trust relationship support in Samba +is in its early stage, so lot of things don't work yet. +

    +Each of the procedures described below is treated as they were performed with Windows NT4 Server on +one end. The remote end could just as well be another Samba-3 domain. It can be clearly seen, after +reading this document, that combining Samba-specific parts of what's written below leads to trust +between domains in purely Samba environment. +

    Samba-3 as the Trusting Domain

    +In order to set the Samba PDC to be the trusted party of the relationship first you need +to create special account for the domain that will be the trusting party. To do that, +you can use the 'smbpasswd' utility. Creating the trusted domain account is very +similar to creating a trusted machine account. Suppose, your domain is +called SAMBA, and the remote domain is called RUMBA. The first step +will be to issue this command from your favourite shell: +

    +

    +root#  smbpasswd -a -i rumba
+	New SMB password: XXXXXXXX
+	Retype SMB password: XXXXXXXX
+	Added user rumba$
+

    + +where -a means to add a new account into the +passdb database and -i means: ''create this +account with the InterDomain trust flag'' +

    +The account name will be 'rumba$' (the name of the remote domain) +

    +After issuing this command you'll be asked to enter the password for +the account. You can use any password you want, but be aware that Windows NT will +not change this password until 7 days following account creation. +After the command returns successfully, you can look at the entry for the new account +(in the standard way depending on your configuration) and see that account's name is +really RUMBA$ and it has 'I' flag in the flags field. Now you're ready to confirm +the trust by establishing it from Windows NT Server. +

    +Open User Manager for Domains and from menu +Policies select Trust Relationships.... +Right beside Trusted domains list box press the +Add... button. You will be prompted for +the trusted domain name and the relationship password. Type in SAMBA, as this is +your domain name, and the password used at the time of account creation. +Press OK and, if everything went without incident, you will see +Trusted domain relationship successfully +established message. +

    Samba-3 as the Trusted Domain

    +This time activities are somewhat reversed. Again, we'll assume that your domain +controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA. +

    +The very first thing requirement is to add an account for the SAMBA domain on RUMBA's PDC. +

    +Launch the Domain User Manager, then from the menu select +Policies, Trust Relationships. +Now, next to Trusted Domains box press the Add +button, and type in the name of the trusted domain (SAMBA) and password securing +the relationship. +

    +The password can be arbitrarily chosen. It is easy to change the password +from the Samba server whenever you want. After confirming the password your account is +ready for use. Now it's Samba's turn. +

    +Using your favourite shell while being logged in as root, issue this command: +

    +root# net rpc trustdom establish rumba +

    +You will be prompted for the password you just typed on your Windows NT4 Server box. +Do not worry if you see an error message that mentions a returned code of +NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the +password you gave is correct and the NT4 Server says the account is +ready for interdomain connection and not for ordinary +connection. After that, be patient it can take a while (especially +in large networks), you should see the Success message. +Congratulations! Your trust relationship has just been established. +

    Note

    +Note that you have to run this command as root because you must have write access to +the secrets.tdb file. +

    Common Errors

    +Interdomain trust relationships should NOT be attempted on networks that are unstable +or that suffer regular outages. Network stability and integrity are key concerns with +distributed trusted domains. +

    Tell me about Trust Relationships using Samba

    + Like many, I administer multiple LANs connected together using NT trust + relationships. This was implemented about 4 years ago. I now have the + occasion to consider performing this same task again, but this time, I + would like to implement it solely through samba - no Microsoft PDCs + anywhere. +

    + I have read documentation on samba.org regarding NT-style trust + relationships and am now wondering, can I do what I want to? I already + have successfully implemented 2 samba servers, but they are not PDCs. + They merely act as file servers. I seem to remember, and it appears to + be true (according to samba.org) that trust relationships are a + challenge. +

    + Please provide any helpful feedback that you may have. +

    + These are almost complete in Samba 3.0 snapshots. The main catch + is getting winbindd to be able to allocate UID/GIDs for trusted + users/groups. See the updated Samba HOWTO collection for more + details. +

    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba

    Shirish Kalele

    Samba Team & Veritas Software


    +
    +

    12 Jul 2000

    Table of Contents

    Features and Benefits
    Common Errors

    Features and Benefits

    + The Distributed File System (or DFS) provides a means of separating the logical + view of files and directories that users see from the actual physical locations + of these resources on the network. It allows for higher availability, smoother + storage expansion, load balancing etc. +

    + For information about DFS, refer to + + Microsoft documentation at http://www.microsoft.com/NTServer/nts/downloads/winfeatures/NTSDistrFile/AdminGuide.asp. +

    + This document explains how to host a DFS tree on a Unix machine (for DFS-aware + clients to browse) using Samba. +

    + To enable SMB-based DFS for Samba, configure it with the --with-msdfs + option. Once built, a Samba server can be made a DFS server by setting the global + boolean host msdfs + parameter in the smb.conf file. You designate a share as a DFS + root using the share level boolean + msdfs root parameter. A DFS root directory on Samba hosts DFS + links in the form of symbolic links that point to other servers. For example, a symbolic link + junction->msdfs:storage1\share1 in the share directory acts + as the DFS junction. When DFS-aware clients attempt to access the junction link, + they are redirected to the storage location (in this case, \\storage1\share1). +

    + DFS trees on Samba work with all DFS-aware clients ranging from Windows 95 to 200x. +

    + Here's an example of setting up a DFS tree on a Samba server. + 

    +# The smb.conf file:
+[global]
+	netbios name = SMOKEY
+	host msdfs   = yes
+
+[dfs]
+	path = /export/dfsroot
+	msdfs root = yes
+

    In the /export/dfsroot directory we set up our dfs links to + other servers on the network.

    +	root# cd /export/dfsroot
+	root# chown root /export/dfsroot
+	root# chmod 755 /export/dfsroot
+	root# ln -s msdfs:storageA\\shareA linka
+	root# ln -s msdfs:serverB\\share,serverC\\share linkb
+

    You should set up the permissions and ownership of + the directory acting as the DFS root such that only designated + users can create, delete or modify the msdfs links. Also note + that symlink names should be all lowercase. This limitation exists + to have Samba avoid trying all the case combinations to get at + the link name. Finally set up the symbolic links to point to the + network shares you want, and start Samba.

    Users on DFS-aware clients can now browse the DFS tree + on the Samba server at \\samba\dfs. Accessing + links linka or linkb (which appear as directories to the client) + takes users directly to the appropriate shares on the network.

    Common Errors

    • Windows clients need to be rebooted + if a previously mounted non-dfs share is made a dfs + root or vice versa. A better way is to introduce a + new share and make it the dfs root.

    • Currently there's a restriction that msdfs + symlink names should all be lowercase.

    • For security purposes, the directory + acting as the root of the DFS tree should have ownership + and permissions set so that only designated users can + modify the symbolic links in the directory.

    Chapter 18. Classical Printing Support

    Kurt Pfeifle

    Danka Deutschland GmbH

    Gerald (Jerry) Carter

    Samba Team

    May 32, 2003

    Table of Contents

    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    Parameters for Backwards Compatibility
    Parameters no longer in use
    A simple Configuration to Print with Samba-3
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print with Samba-3
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various Unix Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba-3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with +rpcclient
    "The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure)
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a +different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba-3
    Publishing Printer Information in Active Directory or LDAP
    Common Errors and Problems
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost

    Features and Benefits

    +Printing is often a mission-critical service for the users. Samba can +provide this service reliably and seamlessly for a client network +consisting of Windows workstations. +

    +A Samba-3.0 print service may be run on a Standalone or a Domain +member server, side by side with file serving functions, or on a +dedicated print server. It can be made as tight or as loosely secured +as needs dictate. Configurations may be simple or complex. Available +authentication schemes are essentially the same as described for file +services in previous chapters. Overall, Samba's printing support is +now able to replace an NT or Windows 2000 print server full-square, +with additional benefits in many cases. Clients may download and +install drivers and printers through their familiar "Point'n'Print" +mechanism. Printer installations executed by "Logon Scripts" are no +problem. Administrators can upload and manage drivers to be used by +clients through the familiar "Add Printer Wizard". As an additional +benefit, driver and printer management may be run from the command line +or through scripts, making it more efficient in case of large numbers +of printers. If a central accounting of print jobs (tracking every +single page and supplying the raw data for all sorts of statistical +reports) is required, this is best supported by CUPS as the print +subsystem underneath the Samba hood. +

    +This chapter deals with the foundations of Samba printing, as they +implemented by the more traditional UNIX (BSD- and System V-style) +printing systems. Many things apply to CUPS, the newer Common UNIX +Printing System, too; so if you use CUPS, you might be tempted to jump +to the next chapter -- but you will certainly miss a few things if you +do so. Better read this chapter too. +

    Note

    +Most of the given examples have been verified on Windows XP +Professional clients. Where this document describes the responses to +commands given, bear in mind that Windows 2000 clients are very +similar, but may differ in details. Windows NT is somewhat different +again. +

    Technical Introduction

    +Samba's printing support always relies on the installed print +subsystem of the Unix OS it runs on. Samba is a "middleman". It takes +printfiles from Windows (or other SMB) clients and passes them to the +real printing system for further processing. Therefore it needs to +"talk" to two sides: to the Windows print clients and to the Unix +printing system. Hence we must differentiate between the various +client OS types each of which behave differently, as well as the +various UNIX print subsystems, which themselves have different +features and are accessed differently. This part of the Samba HOWTO +Collection deals with the "traditional" way of Unix printing first; +the next chapter covers in great detail the more modern +Common UNIX Printing System +(CUPS). + +

    Important

    CUPS users, be warned: don't just jump on to the next +chapter. You might miss important information contained only +here!

    +

    What happens if you send a Job from a Client

    +To successfully print a job from a Windows client via a Samba +print server to a UNIX printer, there are 6 (potentially 7) +stages: +

    1. Windows opens a connection to the printershare

    2. Samba must authenticate the user

    3. Windows sends a copy of the printfile over the network +into Samba's spooling area

    4. Windows closes the connection again

    5. Samba invokes the print command to hand the file over +to the UNIX print subsystem's spooling area

    6. The Unix print subsystem processes the print +job

    7. The printfile may need to be explicitly deleted +from the Samba spooling area.

    Printing Related Configuration Parameters

    +There are a number of configuration parameters in + controlling Samba's printing +behaviour. Please also refer to the man page for smb.conf to +acquire an overview about these. As with other parameters, there are +Global Level (tagged with a "G" in the listings) and +Service Level ("S") parameters. +

    Service Level Parameters

    These may go into the +[global] section of +. In this case they define the default +behaviour of all individual or service level shares (provided those +don't have a different setting defined for the same parameter, thus +overriding the global default).

    Global Parameters

    These may not go into individual +shares. If they go in by error, the "testparm" utility can discover +this (if you run it) and tell you so.

    Parameters Recommended for Use

    The following smb.conf parameters directly +related to printing are used in Samba-3. See also the +smb.conf man page for detailed explanations: +

    List of printing related parameters in Samba-3.  +

    Global level parameters:

    • addprinter command (G)

    • deleteprinter command (G)

    • disable spoolss (G)

    • enumports command (G)

    • load printers (G)

    • lpq cache time (G)

    • os2 driver map (G)

    • printcap name (G), printcap (G)

    • show add printer wizard (G)

    • total print jobs (G)

    • use client driver (G)

    + +

    Service level parameters:

    • hosts allow (S)

    • hosts deny (S)

    • lppause command (S)

    • lpq command (S)

    • lpresume command (S)

    • lprm command (S)

    • max print jobs (S)

    • min print space (S)

    • print command (S)

    • printable (S), print ok (S)

    • printer name (S), printer (S)

    • printer admin (S)

    • printing = [cups|bsd|lprng...] (S)

    • queuepause command (S)

    • queueresume command (S)

    • total print jobs (S)

    +

    +Samba's printing support implements the Microsoft Remote Procedure +Calls (MS-RPC) methods for printing. These are used by Windows NT (and +later) print servers. The old "LanMan" protocol is still supported as +a fallback resort, and for older clients to use. More details will +follow further beneath. +

    Parameters for Backwards Compatibility

    +Two new parameters that were added in Samba 2.2.2, are still present +in Samba-3.0. Both of these options are described in the +smb.conf man page and are disabled by +default. Use them with caution! +

    disable spoolss(G)

    This is +provided for better support of Samba 2.0.x backwards capability. It +will disable Samba's support for MS-RPC printing and yield identical +printing behaviour to Samba 2.0.x.

    use client driver (G)

    was provided +for using local printer drivers on Windows NT/2000 clients. It does +not apply to Windows 95/98/ME clients.

    Parameters "for backward compatibility only", use with caution.  +

    • disable spoolss (G)

    • use client driver (S)

    +

    Parameters no longer in use

    +Samba users upgrading from 2.2.x to 3.0 need to be aware that some +previously available settings are no longer supported (as was +announced some time ago). Here is a list of them: +

    "old" parameters, removed in Samba-3.  +The following smb.conf parameters have been +deprecated already in Samba 2.2 and are now completely removed from +Samba-3. You cannot use them in new 3.0 installations: + +

    • printer driver file (G)

    • total print jobs (G)

    • postscript (S)

    • printer driver (S)

    • printer driver location (S)

    +

    A simple Configuration to Print with Samba-3

    +Here is a very simple example configuration for print related settings +in the file. If you compare it with your +own system's , you probably find some +additional parameters included there (as pre-configured by your OS +vendor). Further below is a discussion and explanation of the +parameters. Note, that this example doesn't use many parameters. +However, in many environments these are enough to provide a valid + which enables all clients to print. +

    + [global]
+         printing = bsd
+         load printers = yes
+
+ [printers]
+         path = /var/spool/samba
+         printable = yes
+         public = yes
+         writable = no
+

    +This is only an example configuration. Many settings, if not +explicitly set to a specific value, are used and set by Samba +implicitly to its own default, because these have been compiled in. +To see all settings, let root use the testparm +utility. testparm also gives warnings if you have +mis-configured certain things. Its complete output is easily 340 lines +and more. You may want to pipe it through a pager program. +

    +The syntax for the configuration file is easy to grasp. You should +know that is not very picky about its +syntax. It has been explained elsewhere in this document. A short +reminder: It even tolerates some spelling errors (like "browsable" +instead of "browseable"). Most spelling is case-insensitive. Also, you +can use "Yes|No" or "True|False" for boolean settings. Lists of names +may be separated by commas, spaces or tabs. +

    Verification of "Settings in Use" with testparm

    +To see all (or at least most) printing related settings in Samba, +including the implicitly used ones, try the command outlined below +(hit "ENTER" twice!). It greps for all occurrences of "lp", "print", +"spool", "driver", "ports" and "[" in testparm's output and gives you +a nice overview about the running smbd's print configuration. (Note +that this command does not show individually created printer shares, +or the spooling paths in each case). Here is the output of my Samba +setup, with exactly the same settings in +as shown above: +

    +root# testparm -v | egrep "(lp|print|spool|driver|ports|\[)"
+ Load smb config files from /etc/samba/smb.conf.simpleprinting
+ Processing section "[homes]"
+ Processing section "[printers]"
+ 
+ [global]
+        smb ports = 445 139
+        lpq cache time = 10
+        total print jobs = 0
+        load printers = Yes
+        printcap name = /etc/printcap
+        disable spoolss = No
+        enumports command =
+        addprinter command = 
+        deleteprinter command = 
+        show add printer wizard = Yes
+        os2 driver map =
+        printer admin =
+        min print space = 0
+        max print jobs = 1000
+        printable = No
+        printing = bsd
+        print command = lpr -r -P'%p' %s
+        lpq command = lpq -P'%p'
+        lprm command = lprm -P'%p' %j
+        lppause command =
+        lpresume command =
+        printer name =
+        use client driver = No
+
+ [homes]
+
+ [printers]
+        path = /var/spool/samba
+        printable = Yes
+
+

    +You can easily verify which settings were implicitly added by Samba's +default behaviour. Don't forget about this point: it may +be important in your future dealings with Samba. +

    Note

    testparm in Samba-3.0 behaves differently from 2.2.x: used +without the "-v" switch it only shows you the settings actually +written into ! To see the complete +configuration used, add the "-v" parameter to testparm.

    A little Experiment to warn you

    +Should you need to troubleshoot at any stage, please always come back +to this point first and verify if "testparm" shows the parameters you +expect! To give you an example from personal experience as a warning, +try to just "comment out" the load printers" +parameter. If your 2.2.x system behaves like mine, you'll see this: +

    +root# grep "load printers" /etc/samba/smb.conf
+ #      load printers = Yes
+        # This setting is commented ooouuuuut!!
+
+root# testparm -v /etc/samba/smb.conf | egrep "(load printers)"
+        load printers = Yes
+
+

    +Despite my imagination that the commenting out of this setting should +prevent Samba from publishing my printers, it still did! Oh Boy -- it +cost me quite some time to find out the reason. But I am not fooled +any more... at least not by this ;-) +

    +root# grep -A1 "load printers" /etc/samba/smb.conf
+        load printers = No
+        # This setting is what I mean!!
+ #      load printers = Yes
+        # This setting is commented ooouuuuut!!
+
+root# testparm -v smb.conf.simpleprinting | egrep "(load printers)"
+        load printers = No
+
+

    +Only when setting the parameter explicitly to +"load printers = No" +would Samba recognize my intentions. So my strong advice is: +

    • Never rely on "commented out" parameters!

    • Always set it up explicitly as you intend it to +behave.

    • Use testparm to uncover hidden +settings which might not reflect your intentions.

    +You can have a working Samba print configuration with this +minimal : +

    +root# cat /etc/samba/smb.conf-minimal
+        [printers]
+
+

    +This example should show you that you can use testparm to test any +filename for fitness as a Samba configuration. Actually, we want to +encourage you not to change your + on a working system (unless you know +exactly what you are doing)! Don't rely on an assumption that changes +will only take effect after you re-start smbd! This is not the +case. Samba re-reads its every 60 +seconds and on each new client connection. You might have to face +changes for your production clients that you didn't intend to apply at +this time! You will now note a few more interesting things. Let's now +ask testparm what the Samba print configuration +would be, if you used this minimalistic file as your real +: +

    +root#  testparm -v /etc/samba/smb.conf-minimal | egrep "(print|lpq|spool|driver|ports|[)"
+ Processing section "[printers]"
+ WARNING: [printers] service MUST be printable!
+ No path in service printers - using /tmp
+
+        lpq cache time = 10
+        total print jobs = 0
+        load printers = Yes
+        printcap name = /etc/printcap
+        disable spoolss = No
+        enumports command =
+        addprinter command =
+        deleteprinter command =
+        show add printer wizard = Yes
+        os2 driver map =
+        printer admin =
+        min print space = 0
+        max print jobs = 1000
+        printable = No
+        printing = bsd
+        print command = lpr -r -P%p %s
+        lpq command = lpq -P%p
+        printer name =
+        use client driver = No
+ [printers]
+        printable = Yes
+
+

    +testparm issued 2 warnings: +

    • because we didn't specify the +[printers] section as printable, +and

    • because we didn't tell it which spool directory to +use.

    +However, this was not fatal, and Samba-3.0 will default to values that +will work here. But, please!, don't rely on this and don't use this +example! This was only meant to make you careful to design and specify +your setup to be what you really want it to be. The outcome on your +system may vary for some parameters, since you may have a Samba built +with a different compile-time configuration. +Warning: don't put a comment sign at +the end of a valid line. It +will cause the parameter to be ignored (just as if you had put the +comment sign at the front). At first I regarded this as a bug in my +Samba version(s). But the man page states: “Internal whitespace +in a parameter value is retained verbatim.” This means that a +line consisting of, for example, +

    +printing = lprng     #This defines LPRng as the printing system"
+

    +will regard the whole of the string after the "=" +sign as the value you want to define. And this is an invalid value +that will be ignored, and a default value used instead.] +

    Extended Sample Configuration to Print with Samba-3

    +Here we show a more verbose example configuration for print related +settings in an . Below is a discussion +and explanation of the various parameters. We chose to use BSD-style +printing here, because we guess it is still the most commonly used +system on legacy Linux installations (new installs now predominantly +have CUPS, which is discussed entirely in the next chapter of this +document). Note, that this example explicitly names many parameters +which don't need to be stated because they are set by default. You +might be able to do with a leaner .

    Tip

    +if you read access it with the Samba Web Administration Tool (SWAT), +and then write it to disk again, it will be optimized in a way such +that it doesn't contain any superfluous parameters and comments. SWAT +organizes the file for best performance. Remember that each smbd +re-reads the Samba configuration once a minute, and that each +connection spawns an smbd process of its own, so it is not a bad idea +to optimize the in environments with +hundreds or thousands of clients.

    + [global]
+         printing = bsd
+         load printers = yes
+         show add printer wizard = yes
+         printcap name = /etc/printcap
+         printer admin = @ntadmin, root
+         total print jobs = 100
+         lpq cache time = 20
+         use client driver = no
+
+ [printers]
+         comment = All Printers
+         printable = yes
+         path = /var/spool/samba
+         browseable = no
+         guest ok = yes
+         public = yes
+         read only = yes
+         writable = no       
+
+ [my_printer_name]
+         comment = Printer with Restricted Access
+         path = /var/spool/samba_my_printer
+         printer admin = kurt
+         browseable = yes
+         printable = yes
+         writeable = no
+         hosts allow = 0.0.0.0
+         hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60
+         guest ok = no
+

    +This also is only an example configuration. You +may not find all the settings in your own + (as pre-configured by your OS +vendor). Many configuration parameters, if not explicitly set to a +specific value, are used and set by Samba implicitly to its own +default, because these have been compiled in. To see all settings, let +root use the testparm +utility. testparm also gives warnings if you have +mis-configured certain things.. +

    Detailed Explanation of the Example's Settings

    +Following is a discussion of the settings from above shown example. +

    The [global] Section

    +The [global] section is one of 4 special +sections (along with [[homes], +[printers] and +[print$]...) It contains all parameters which +apply to the server as a whole. It is the place for parameters which +have only a "global" meaning (G). It may also contain service level +parameters (S) which then define default settings for all other +sections and shares. This way you can simplify the configuration and +avoid setting the same value repeatedly. (Within each individual +section or share you may however override these globally set "share +level" settings and specify other values). +

    printing = bsd

    this causes Samba to use default print commands +applicable for the BSD (a.k.a. RFC 1179 style or LPR/LPD) printing +system. In general, the "printing" parameter informs Samba about the +print subsystem it should expect. Samba supports CUPS, LPD, LPRNG, +SYSV, HPUX, AIX, QNX and PLP. Each of these systems defaults to a +different print command (and other queue control +commands).

    Caution

    The printing parameter is +normally a service level parameter. Since it is included here in the +[global] section, it will take effect for all +printer shares that are not defined differently. Samba-3.0 no longer +supports the SOFTQ printing system.

    load printers = yes

    this tells Samba to create automatically all +available printer shares. "Available" printer shares are discovered by +scanning the printcap file. All created printer shares are also loaded +for browsing. If you use this parameter, you do not need to specify +separate shares for each printer. Each automatically created printer +share will clone the configuration options found in the +[printers] section. (A load printers += no setting will allow you to specify each UNIX printer +you want to share separately, leaving out some you don't want to be +publicly visible and available).

    show add printer wizard = +yes

    this setting is normally +enabled by default (even if the parameter is not written into the +). It makes the Add Printer Wizard icon +show up in the Printers folder of the Samba host's +share listing (as shown in Network Neighbourhood or +by the net view command). To disable it, you need to +explicitly set it to no (commenting it out +will not suffice!). The Add Printer Wizard lets you upload printer +drivers to the [print$] share and associate it +with a printer (if the respective queue exists there before the +action), or exchange a printer's driver against any other previously +uploaded driver.

    total print jobs = 100

    this setting sets the upper limit to 100 print jobs +being active on the Samba server at any one time. Should a client +submit a job which exceeds this number, a “no more space +available on server” type of error message will be returned by +Samba to the client. A setting of "0" (the default) means there is +no limit at all! +

    printcap name = /etc/printcap

    this tells Samba where to look for a list of +available printer names. (If you use CUPS, make sure that a printcap +file is written: this is controlled by the "Printcap" directive of +cupsd.conf). +

    printer admin = @ntadmin

    members of the ntadmin group should be able to add +drivers and set printer properties ("ntadmin" is only an example name, +it needs to be a valid UNIX group name); root is implicitly always a +printer admin. The "@" sign precedes group names in +. A printer admin can do anything to +printers via the remote administration interfaces offered by MS-RPC +(see below). Note that the printer admin +parameter is normally a share level parameter, so you may associate +different groups to different printer shares in larger installations, +if you use the printer admin parameter on the +share levels). +

    lpq cache time = 20

    this controls the cache time for the results of the +lpq command. It prevents the lpq command being called too often and +reduces load on a heavily used print server. +

    use client driver = no

    if set to yes, this setting only +takes effect for Win NT/2k/XP clients (and not for Win 95/98/ME). Its +default value is No (or False). +It must not be enabled on print shares +(with a yes or true setting) which +have valid drivers installed on the Samba server! For more detailed +explanations see the man page of smb.conf. +

    The [printers] Section

    +This is the second special section. If a section with this name +appears in the smb.conf, users are able to +connect to any printer specified in the Samba host's printcap file, +because Samba on startup then creates a printer share for every +printername it finds in the printcap file. You could regard this +section as a general convenience shortcut to share all printers with +minimal configuration. It is also a container for settings which +should apply as default to all printers. (For more details see the +smb.conf man page.) Settings inside this +container must be share level parameters (S). +

    comment = All printers

    the comment is shown next to +the share if a client queries the server, either via Network +Neighbourhood or with the net view command to list +available shares. +

    printable = yes

    please note well, that the +[printers] service must be +declared as printable. If you specify otherwise, smbd will refuse to +load at startup. This parameter allows +connected clients to open, write to and submit spool files into the +directory specified with the path parameter for +this service. It is used by Samba to differentiate printer shares from +file shares.

    path = /var/spool/samba

    this must point to a directory used by Samba to spool +incoming print files. It must not be the same as the spool +directory specified in the configuration of your UNIX print +subsystem! The path would typically point to a directory +which is world writeable, with the "sticky" bit set to it. +

    browseable = no

    this is always set to no if +printable = yes. It makes the +[printer] share itself invisible in the +list of available shares in a net view command or +in the Explorer browse list. (Note that you will of course see the +individual printers). +

    guest ok = yes

    +if set to yes, then no password is required to +connect to the printers service. Access will be granted with the +privileges of the guest account. On many systems the +guest account will map to a user named "nobody". This user is in the UNIX +passwd file with an empty password, but with no valid UNIX login. +(Note: on some systems the guest account might not have the +privilege to be able to print. Test this by logging in as your +guest user using su - guest and run a system print +command like +

    lpr -P printername /etc/motd

    public = yes

    this is a synonym for guest ok = +yes. Since we have guest ok = yes, +it really doesn't need to be here! (This leads to the interesting +question: “What, if I by accident have to contradictory settings +for the same share?” The answer is: the last one encountered by +Samba wins. The "winner" is shown by testparm. Testparm doesn't +complain about different settings of the same parameter for the same +share! You can test this by setting up multiple lines for the "guest +account" parameter with different usernames, and then run testparm to +see which one is actually used by Samba.) +

    read only = yes

    this normally (for other types of shares) prevents +users creating or modifying files in the service's directory. However, +in a "printable" service, it is always allowed to +write to the directory (if user privileges allow the connection), but +only via print spooling operations. "Normal" write operations are not +allowed.

    writeable = no

    +synonym for read only = yes +

    Any [my_printer_name] Section

    +If a section appears in the , which is +tagged as printable = yes, Samba presents it as +a printer share to its clients. Note, that Win95/98/ME clients may +have problems with connecting or loading printer drivers if the share +name has more than 8 characters! Also be very careful if you give a +printer the same name as an existing user or file share name: upon a +client's connection request to a certain sharename, Samba always tries +to find file shares with that name first; if it finds one, it will +connect to this and will never ultimately connect to a printer with +the same name! +

    comment = Printer with Restricted Access

    the comment says it all. +

    path = /var/spool/samba_my_printer

    here we set the spooling area for this printer to +another directory than the default. It is not a requirement to set it +differently, but the option is available. +

    printer admin = kurt

    the printer admin definition is different for this +explicitly defined printer share from the general +[printers] share. It is not a requirement; we +did it to show that it is possible if you want it. +

    browseable = yes

    we also made this printer browseable (so that the +clients may conveniently find it when browsing the Network +Neighbourhood). +

    printable = yes

    see explanation in last subsection. +

    writeable = no

    see explanation in last subsection. +

    hosts allow = 10.160.50.,10.160.51.

    here we exercise a certain degree of access control +by using the hosts allow and hosts deny parameters. Note, that +this is not by any means a safe bet. It is not a way to secure your +printers. This line accepts all clients from a certain subnet in a +first evaluation of access control +

    hosts deny = turbo_xp,10.160.50.23,10.160.51.60 +

    all listed hosts are not allowed here (even if they +belong to the "allowed subnets"). As you can see, you could name IP +addresses as well as NetBIOS hostnames +here. +

    guest ok = no

    this printer is not open for the guest account! +

    Print Commands

    +In each section defining a printer (or in the +[printers] section), a print +command parameter may be defined. It sets a command to +process the files which have been placed into the Samba print spool +directory for that printer. (That spool directory was, if you +remember, set up with the path +parameter). Typically, this command will submit the spool file to the +Samba host's print subsystem, using the suitable system print +command. But there is no requirement that this needs to be the +case. For debugging purposes or some other reason you may want to do +something completely different than "print" the file. An example is a +command that just copies the print file to a temporary location for +further investigation when you need to debug printing. If you craft +your own print commands (or even develop print command shell scripts), +make sure you pay attention to the need to remove the files from the +Samba spool directory. Otherwise your hard disk may soon suffer from +shortage of free space. +

    Default Print Commands for various Unix Print Subsystems

    +You learned earlier on, that Samba in most cases uses its built-in +settings for many parameters if it can not find an explicitly stated +one in its configuration file. The same is true for the +print command. The default print command varies +depending on the printing =... parameter +setting. In the commands listed below, you will notice some parameters +of the form %X where X is +p, s, J etc. These letters stand for +"printername", "spoolfile" and "job ID" respectively. They are +explained in more detail further below. Here is an overview (excluding +the special case of CUPS, which is discussed in the next chapter): +

    If this setting is active......this is used in lieu of an explicit command:
    printing = bsd|aix|lprng|plpprint command is lpr -r -P%p %s
    printing = sysv|hpuxprint command is lp -c -P%p %s; rm %s
    printing = qnxprint command is lp -r -P%p -s %s
    printing = bsd|aix|lprng|plplpq command is lpq -P%p
    printing = sysv|hpuxlpq command is lpstat -o%p
    printing = qnxlpq command is lpq -P%p
    printing = bsd|aix|lprng|plplprm command is lprm -P%p %j
    printing = sysv|hpuxlprm command is cancel %p-%j
    printing = qnxlprm command is cancel %p-%j
    printing = bsd|aix|lprng|plplppause command is lp -i %p-%j -H hold
    printing = sysv|hpuxlppause command (...is empty)
    printing = qnxlppause command (...is empty)
    printing = bsd|aix|lprng|plplpresume command is lp -i %p-%j -H resume
    printing = sysv|hpuxlpresume command (...is empty)
    printing = qnxlpresume command (...is empty)

    +We excluded the special CUPS case here, because it is discussed in the +next chapter. Just a short summary. For printing = +CUPS: If SAMBA is compiled against libcups, it uses the +CUPS API to submit jobs, etc. (It is a good idea also to set +printcap = cups in case your +cupsd.conf is set to write its autogenerated +printcap file to an unusual place). Otherwise Samba maps to the System +V printing commands with the -oraw option for printing, i.e. it uses +lp -c -d%p -oraw; rm %s With printing = +cups , and if SAMBA is compiled against libcups, any +manually set print command will be ignored! +

    +Having listed the above mappings here, you should note that there used +to be a bug in recent 2.2.x versions which +prevented the mapping from taking effect. It lead to the +"bsd|aix|lprng|plp" settings taking effect for all other systems, for +the most important commands (the print command, the +lpq command and the lprm +command). The lppause command and the +lpresume command remained empty. Of course, these +commands worked on bsd|aix|lprng|plp but they didn't work on +sysv|hpux|qnx systems. To work around this bug, you need to +explicitly set the commands. Use testparm -v to +check which command takes effect. Then check that this command is +adequate and actually works for your installed print subsystem. It is +always a good idea to explicitly set up your configuration files the +way you want them to work and not rely on any built-in defaults. +

    Setting up your own Print Commands

    +After a print job has finished spooling to a service, the +print command will be used by Samba via a +system() call to process the spool file. Usually +the command specified will submit the spool file to the host's +printing subsystem. But there is no requirement at all that this must +be the case. The print subsystem will probably not remove the spool +file on its own. So whatever command you specify on your own you +should ensure that the spool file is deleted after it has been +processed. +

    +There is no difficulty with using your own customized print commands +with the traditional printing systems. However, if you don't wish to +"roll your own", you should be well informed about the default +built-in commands that Samba uses for each printing subsystem (see the +table above). In all the commands listed in the last paragraphs you +see parameters of the form %X These are +macros, or shortcuts, used as place holders for +the names of real objects. At the time of running a command with such +a placeholder, Samba will insert the appropriate value +automatically. Print commands can handle all Samba macro +substitutions. In regard to printing, the following ones do have +special relevance: +

    • %s, %f - the path to the spool +file name

    • %p - the appropriate printer +name

    • %J - the job name as +transmitted by the client.

    • %c - the number of printed +pages of the spooled job (if known).

    • %z - the size of the spooled +print job (in bytes)

    +The print command MUST contain at least one occurrence of +%s or %f. -- The +%p is optional. If no printer name is supplied, +the %p will be silently removed from the print +command. In this case the job is sent to the default printer. +

    +If specified in the [global] section, the print +command given will be used for any printable service that does not +have its own print command specified. If there is neither a specified +print command for a printable service nor a global print command, +spool files will be created but not processed! And (most importantly): +print files will not be removed, so they will start filling your Samba +hard disk. +

    +Note that printing may fail on some UNIXes from the "nobody" +account. If this happens, create an alternative guest account and +supply it with the privilege to print. Set up this guest account in +the [global] section with the guest +account parameter. +

    +You can form quite complex print commands. You need to realize that +print commands are just passed to a UNIX shell. The shell is able to +expand the included environment variables as usual. (The syntax to +include a UNIX environment variable $variable +in or in the Samba print command is +%$variable.) To give you a working +print command example, the following will log a +print job to /tmp/print.log, print the file, then +remove it. Note that ';' is the usual separator for commands in shell +scripts: +

    +
+ print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s
+
+

    +You may have to vary your own command considerably from this example +depending on how you normally print files on your system. The default +for the print command parameter varies depending on the setting of +the printing parameter. Another example is: +

    + print command = /usr/local/samba/bin/myprintscript %p %s
+

    Innovations in Samba Printing since 2.2

    +Before version 2.2.0, Samba's print server support for Windows clients +was limited to the level of LanMan printing +calls. This is the same protocol level as Windows 9x PCs offer when +they share printers. Beginning with the 2.2.0 release, Samba started +to support the native Windows NT printing mechanisms. These are +implemented via MS-RPC (RPC = Remote +Procedure Calls ). MS-RPCs use the +SPOOLSS named pipe for all printing. +

    +The additional functionality provided by the new SPOOLSS support includes: +

    • Support for downloading printer driver files to Windows +95/98/NT/2000 clients upon demand (Point'n'Print); +

    • Uploading of printer drivers via the Windows NT +Add Printer Wizard (APW) or the +Imprints tool set (refer to http://imprints.sourceforge.net); +

    • Support for the native MS-RPC printing calls such as +StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation +at http://msdn.microsoft.com/ +for more information on the Win32 printing API);

    • Support for NT Access Control +Lists (ACL) on printer objects;

    • Improved support for printer queue manipulation +through the use of internal databases for spooled job information +(implemented by various *.tdb +files).

    +One other benefit of an update is this: Samba-3 is able to publish +all its printers in Active Directory (or LDAP)! +

    +One slight difference is here: it is possible on a Windows NT print +server to have printers listed in the Printers folder which are +not shared. Samba does not make this +distinction. By definition, the only printers of which Samba is aware +are those which are specified as shares in +. The reason is that Windows NT/200x/XP Professional +clients do not normally need to use the standard SMB printer share; +rather they can print directly to any printer on another Windows NT +host using MS-RPC. This of course assumes that the printing client has +the necessary privileges on the remote host serving the printer. The +default permissions assigned by Windows NT to a printer gives the +"Print" permissions to the well-known Everyone +group. (The older clients of type Win9x can only print to "shared" +printers). +

    Client Drivers on Samba Server for Point'n'Print

    +There is still confusion about what all this means: Is it or +is it not a requirement for printer drivers to be installed on a Samba +host in order to support printing from Windows clients? The +answer to this is: No, it is not a +requirement. Windows NT/2000 clients can, of +course, also run their APW to install drivers +locally (which then connect to a Samba served +print queue). This is the same method as used by Windows 9x +clients. (However, a bug existed in Samba 2.2.0 +which made Windows NT/2000 clients require that the Samba server +possess a valid driver for the printer. This was fixed in Samba +2.2.1). +

    +But it is a new option to install the printer +drivers into the [print$] share of the Samba +server, and a big convenience too. Then all +clients (including 95/98/ME) get the driver installed when they first +connect to this printer share. The uploading or +depositing of the driver into this +[print$] share, and the following binding of +this driver to an existing Samba printer share can be achieved by +different means: +

    • running the APW on an +NT/200x/XP Professional client (this doesn't work from 95/98/ME +clients);

    • using the Imprints +toolset;

    • using the smbclient and +rpcclient commandline tools;

    • using cupsaddsmb(only works for +the CUPS printing system, not for LPR/LPD, LPRng +etc.).

    +Please take additional note of the following fact: Samba +does not use these uploaded drivers in any way to process spooled +files. Drivers are utilized entirely by the clients, who +download and install them via the "Point'n'Print" mechanism supported +by Samba. The clients use these drivers to generate print files in the +format the printer (or the Unix print system) requires. Print files +received by Samba are handed over to the Unix printing system, which +is responsible for all further processing, if needed. +

    The [printer$] Section is removed from Samba-3

    +[print$] vs. [printer$] +.  +Versions of Samba prior to 2.2 made it possible to use a share +named [printer$]. This name was taken from the +same named service created by Windows 9x clients when a printer was +shared by them. Windows 9x printer servers always have a +[printer$] service which provides read-only +access (with no password required) in order to support printer driver +downloads. However, Samba's initial implementation allowed for a +parameter named printer driver location to be +used on a per share basis. This specified the location of the driver +files associated with that printer. Another parameter named +printer driver provided a means of defining the +printer driver name to be sent to the client. These parameters, +including the printer driver file parameter, +are now removed and can not be used in installations of Samba-3.0. +Now the share name [print$] is used for the +location of downloadable printer drivers. It is taken from the +[print$] service created by Windows NT PCs when +a printer is shared by them. Windows NT print servers always have a +[print$] service which provides read-write +access (in the context of its ACLs) in order to support printer driver +down- and uploads. Don't fear -- this does not mean Windows 9x +clients are thrown aside now. They can use Samba's +[print$] share support just fine. +

    Creating the [print$] Share

    +In order to support the up- and downloading of printer driver files, +you must first configure a file share named +[print$]. The "public" name of this share is +hard coded in Samba's internals (because it is hard coded in the MS +Windows clients too). It cannot be renamed since Windows clients are +programmed to search for a service of exactly this name if they want +to retrieve printer driver files. +

    +You should modify the server's file to +add the global parameters and create the +[print$] file share (of course, some of the +parameter values, such as 'path' are arbitrary and should be replaced +with appropriate values for your site): +

    + [global]
+      ; members of the ntadmin group should be able to add drivers and set
+      ; printer properties. root is implicitly always a 'printer admin'.
+      printer admin = @ntadmin
+      [....]
+
+ [printers]
+      [....]
+
+ [print$]
+      comment = Printer Driver Download Area
+      path = /etc/samba/drivers
+      browseable = yes
+      guest ok = yes
+      read only = yes
+      write list = @ntadmin, root
+

    +Of course, you also need to ensure that the directory named by the +path parameter exists on the Unix file system. +

    Parameters in the [print$] Section

    +[print$] is a special section in +. It contains settings relevant to +potential printer driver download and local installation by clients. +

    comment = Printer Driver +Download Area

    the comment appears next to the share name if it is +listed in a share list (usually Windows clients won't see it often but +it will also appear up in a smbclient -L sambaserver + output).

    path = /etc/samba/printers

    this is the path to the location of the Windows +driver file deposit from the UNIX point of +view.

    browseable = no

    this makes the [print$] share +"invisible" in Network Neighbourhood to clients. However, you can +still "mount" it from any client using the net use +g:\\sambaserver\print$ command in a "DOS box" or the +"Connect network drive" menu from Windows +Explorer.

    guest ok = yes

    this gives read only access to this share for all +guest users. Access may be used to download and install printer +drivers on clients. The requirement for guest ok = +yes depends upon how your site is configured. If users +will be guaranteed to have an account on the Samba host, then this is +a non-issue.

    Note

    +The non-issue is this: if all your Windows NT users are guaranteed to +be authenticated by the Samba server (for example if Samba +authenticates via an NT domain server and the NT user has already been +validated by the Domain Controller in order to logon to the Windows NT +session), then guest access is not necessary. Of course, in a +workgroup environment where you just want to be able to print without +worrying about silly accounts and security, then configure the share +for guest access. You'll probably want to add map to guest += Bad User in the [global] section +as well. Make sure you understand what this parameter does before +using it. +

    read only = yes

    as we don't want everybody to upload driver files (or +even change driver settings) we tagged this share as not +writeable.

    write list = @ntadmin,root

    since the [print$] was made +read only by the previous setting, we need to create a "write list" +also. UNIX groups (denoted with a leading "@" character) and users +listed here are allowed write access (as an exception to the general +public's "read-only" access), which they need to update files on the +share. Normally you will want to only name administrative level user +accounts in this setting. Check the file system permissions to make +sure these accounts can copy files to the share. If this is a non-root +account, then the account should also be mentioned in the global +printer admin parameter. See the + man page for more information on +configuring file shares.

    Subdirectory Structure in [print$]

    +In order for a Windows NT print server to support the downloading of +driver files by multiple client architectures, you must create several +subdirectories within the [print$] service +(i.e. the Unix directory named by the path +parameter). These correspond to each of the supported client +architectures. Samba follows this model as well. Just like the name of +the [print$] share itself, the subdirectories +*must* be exactly the names listed below (you may leave out the +subdirectories of architectures you don't want to support). +

    +Therefore, create a directory tree below the +[print$] share for each architecture you wish +to support. +

    +[print$]--+--
+          |--W32X86           # serves drivers to "Windows NT x86"
+          |--WIN40            # serves drivers to "Windows 95/98"
+          |--W32ALPHA         # serves drivers to "Windows NT Alpha_AXP"
+          |--W32MIPS          # serves drivers to "Windows NT R4000"
+          |--W32PPC           # serves drivers to "Windows NT PowerPC"
+

    Required permissions

    +In order to add a new driver to your Samba host, one of two conditions +must hold true: +

    • The account used to connect to the Samba host must +have a UID of 0 (i.e. a root account)

    • The account used to connect to the Samba host must be +named in the printer adminlist.

    +Of course, the connected account must still possess access to add +files to the subdirectories beneath +[print$]. Remember that all file shares are set +to 'read only' by default. +

    +Once you have created the required [print$] +service and associated subdirectories, go to a Windows NT 4.0/2k/XP +client workstation. Open Network Neighbourhood or +My Network Places and browse for the Samba host. +Once you have located the server, navigate to its Printers and +Faxes folder. You should see an initial listing of printers +that matches the printer shares defined on your Samba host. +

    Installing Drivers into [print$]

    +You have successfully created the [print$] +share in ? And Samba has re-read its +configuration? Good. But you are not yet ready to take off. The +driver files need to be present in this share, +too! So far it is still an empty share. Unfortunately, it is not enough +to just copy the driver files over. They need to be set +up too. And that is a bit tricky, to say the least. We +will now discuss two alternative ways to install the drivers into +[print$]: +

    • using the Samba commandline utility +rpcclient with its various subcommands (here: +adddriver and setdriver) from +any UNIX workstation;

    • running a GUI (Printer +Properties and Add Printer Wizard) +from any Windows NT/2k/XP client workstation.

    +The latter option is probably the easier one (even if the only +entrance to this realm seems a little bit weird at first). +

    Setting Drivers for existing Printers with a Client GUI

    +The initial listing of printers in the Samba host's +Printers folder accessed from a client's Explorer +will have no real printer driver assigned to them. By default, in +Samba-3 (as in 2.2.1 and later) this driver name is set to a NULL +string. This must be changed now. The local Add Printer +Wizard, run from NT/2000/XP clients, will help us in this +task. +

    +However, the job to set a valid driver for the printer is not a +straightforward one: You must attempt to view the printer properties +for the printer to which you want the driver assigned. Open the +Windows Explorer, open Network Neighbourhood, browse to the Samba +host, open Samba's Printers folder, right-click the printer icon and +select Properties.... You are now trying to view printer and driver +properties for a queue which has this default NULL driver +assigned. This will result in an error message (this is normal here): +

    Device settings cannot be displayed. The driver +for the specified printer is not installed, only spooler properties +will be displayed. Do you want to install the driver +now?

    +Important:Don't click Yes! Instead, +click No in the error dialog. +Only now you will be presented with the printer properties window. From here, +the way to assign a driver to a printer is open to us. You have now the choice +either: +

    • select a driver from the pop-up list of installed +drivers. Initially this list will be empty. +Or

    • use the New Driver... button to +install a new printer driver (which will in fact start up the +APW).

    +Once the APW is started, the procedure is exactly the same as the one +you are familiar with in Windows (we assume here that you are +familiar with the printer driver installations procedure on Windows +NT). Make sure your connection is in fact setup as a user with +printer admin privileges (if in doubt, use +smbstatus to check for this). If you wish to +install printer drivers for client operating systems other than +Windows NT x86, you will need to use the +Sharing tab of the printer properties dialog. +

    +Assuming you have connected with an administrative (or root) account +(as named by the printer admin parameter), +you will also be able to modify other printer properties such as ACLs +and default device settings using this dialog. For the default device +settings, please consider the advice given further below. +

    Setting Drivers for existing Printers with +rpcclient

    +The second way to install printer drivers into +[print$] and set them up in a valid way can be +done from the UNIX command line. This involves four distinct steps: +

    1. gathering the info about the required driver files +and collecting the files together;

    2. deposit the driver files into the +[print$] share's correct subdirectories +(possibly by using smbclient);

    3. running the rpcclient +commandline utility once with the adddriver +subcommand,

    4. running rpcclient a second +time with the setdriver +subcommand.

    +We will provide detailed hints for each of these steps in the next few +paragraphs. +

    Identifying the Driver Files

    +To find out about the driver files, you have two options: you could +investigate the driver CD which comes with your printer. Study the +*.inf file on the CD, if it is contained. This +may not be the possible, since the *.inf file might be +missing. Unfortunately, many vendors have now started to use their own +installation programs. These installations packages are often some +sort of Windows platform archive format, plus, the files may get +re-named during the installation process. This makes it extremely +difficult to identify the driver files you need. +

    +Then you only have the second option: install the driver first on a +Windows client *locally* and investigate which file names and paths it +uses after they are installed. (Note, that you need to repeat this +procedure for every client platform you want to support. We are going +to show it here for the W32X86 platform only, a +name used by Microsoft for all WinNT/2k/XP clients...) +

    +A good method to recognize the driver files this is to print the test +page from the driver's Properties Dialog +(General tab). Then look at the list of driver +files named on the printout. You'll need to recognize what Windows +(and Samba) are calling the Driver File , the +Data File, the Config File, +the Help File and (optionally) the +Dependent Driver Files (this may vary slightly +for Windows NT). You need to remember all names (or better take a +note) for the next steps. +

    +Another method to quickly test the driver filenames and related paths +is provided by the rpcclient utility. Run it with +enumdrivers or with the +getdriver subcommand, each in the +3 level. In the following example, +TURBO_XP is the name of the Windows PC (in this +case it was a Windows XP Professional laptop, BTW). I had installed +the driver locally to TURBO_XP while kde-bitshop is +the name of the Linux host from which I am working. We could run an +interactive rpcclient session; +then we'd get an rpcclient /> prompt and would +type the subcommands at this prompt. This is left as a good exercise +to the reader. For now we use rpcclient with the +-c parameter to execute a single subcommand +line and exit again. This is the method you would use if you want to +create scripts to automate the procedure for a large number of +printers and drivers. Note the different quotes used to overcome the +different spaces in between words: +

    +root# rpcclient -U'Danka%xxxx' -c 'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP
+  cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3
+
+  [Windows NT x86]
+  Printer Driver Info 3:
+          Version: [2]
+          Driver Name: [Heidelberg Digimaster 9110 (PS)]
+          Architecture: [Windows NT x86]
+          Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.DLL]
+          Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.ppd]
+          Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.DLL]
+          Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.HLP]
+  
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.DLL]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.INI]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1KMMin.DLL]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.dat]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.cat]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.def]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hre]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.vnd]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hlp]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de_reg.HLP]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01Aux.dll]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.NTF]
+  
+          Monitorname: []
+          Defaultdatatype: []
+
+

    +You may notice, that this driver has quite a big number of +Dependentfiles (I know worse cases however). Also, +strangely, the Driver File is here tagged as +Driver Path.... oh, well. Here we don't have yet +support for the so-called WIN40 architecture +installed. This name is used by Microsoft for the Win95/98/ME platforms. +If we want to support these, we need to install the Win95/98/ME driver +files in addition to those for W32X86 +(i.e. the WinNT72000/XP clients) onto a Windows PC. This PC +can also host the Win9x drivers, even if itself runs on Windows NT, +2000 or XP. +

    +Since the [print$] share is usually accessible +through the Network Neighbourhood, you can also use the UNC notation +from Windows Explorer to poke at it. The Win9x driver files will end +up in subdirectory "0" of the "WIN40" directory. The full path to +access them will be +\\WINDOWSHOST\print$\WIN40\0\. +

    Note

    more recent drivers on Windows 2000 and Windows XP are +installed into the "3" subdirectory instead of the "2". The version 2 +of drivers, as used in Windows NT, were running in Kernel Mode. +Windows 2000 changed this. While it still can use the Kernel Mode +drivers (if this is enabled by the Admin), its native mode for printer +drivers is User Mode execution. This requires drivers designed for +this. These type of drivers install into the "3" subdirectory. +

    Collecting the Driver Files from a Windows Host's +[print$] Share

    +Now we need to collect all the driver files we identified. in our +previous step. Where do we get them from? Well, why not retrieve them +from the very PC and the same [print$] share +which we investigated in our last step to identify the files? We can +use smbclient to do this. We will use the paths and +names which were leaked to us by getdriver. The +listing is edited to include linebreaks for readability: +

    +root# smbclient //TURBO_XP/print\$ -U'Danka%xxxx'	\ 
+	-c 'cd W32X86/2;mget HD*_de.*             \
+	hd*ppd Hd*_de.* Hddm*dll HDN*Aux.DLL'
+  added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+  Got a positive name query response from 10.160.50.8 ( 10.160.50.8 )
+  Domain=[DEVELOPMENT] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager]
+  Get file Hddm91c1_de.ABD? n
+  Get file Hddm91c1_de.def? y
+  getting file \W32X86\2\Hddm91c1_de.def of size 428 as Hddm91c1_de.def (22.0 kb/s) (average 22.0 kb/s)
+  Get file Hddm91c1_de.DLL? y
+  getting file \W32X86\2\Hddm91c1_de.DLL of size 876544 as Hddm91c1_de.DLL (737.3 kb/s) (average 737.3 kb/s)
+  [...]
+
+

    +After this command is complete, the files are in our current local +directory. You probably have noticed that this time we passed several +commands to the -c parameter, separated by semi-colons. This +effects that all commands are executed in sequence on the remote +Windows server before smbclient exits again. +

    +Don't forget to repeat the procedure for the WIN40 +architecture should you need to support Win95/98/XP clients. Remember, the +files for these architectures are in the WIN40/0/ subdir. Once we are +complete, we can run smbclient ... put to store +the collected files on the Samba server's +[print$] share. +

    Depositing the Driver Files into [print$]

    +So, now we are going to put the driver files into the +[print$] share. Remember, the UNIX path to this +share has been defined previously in your +. You also have created subdirectories +for the different Windows client types you want to support. Supposing +your [print$] share maps to the UNIX path +/etc/samba/drivers/, your driver files should now +go here: +

    • for all Windows NT, 2000 and XP clients into +/etc/samba/drivers/W32X86/ but +*not*(yet) into the "2" subdir!

    • for all Windows 95, 98 and ME clients into +/etc/samba/drivers/WIN40/ -- but *not* +(yet) into the "0" subdir!

    +We again use smbclient to transfer the driver files across the +network. We specify the same files and paths as were leaked to us by +running getdriver against the original +Windows install. However, now we are going to +store the files into a Samba/UNIX print server's +[print$] share... +

    +root# smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c 'cd W32X86; put HDNIS01_de.DLL; \
+  put Hddm91c1_de.ppd; put HDNIS01U_de.DLL;        \
+  put HDNIS01U_de.HLP; put Hddm91c1_de.DLL;        \
+  put Hddm91c1_de.INI; put Hddm91c1KMMin.DLL;      \
+  put Hddm91c1_de.dat; put Hddm91c1_de.dat;        \
+  put Hddm91c1_de.def; put Hddm91c1_de.hre;        \
+  put Hddm91c1_de.vnd; put Hddm91c1_de.hlp;        \
+  put Hddm91c1_de_reg.HLP; put HDNIS01Aux.dll;     \
+  put HDNIS01_de.NTF'
+ added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+ Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
+ Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+ putting file HDNIS01_de.DLL as \W32X86\HDNIS01_de.DLL (4465.5 kb/s) (average 4465.5 kb/s)
+ putting file Hddm91c1_de.ppd as \W32X86\Hddm91c1_de.ppd (12876.8 kb/s) (average 4638.9 kb/s)
+ putting file HDNIS01U_de.DLL as \W32X86\HDNIS01U_de.DLL (20249.8 kb/s) (average 5828.3 kb/s)
+ putting file HDNIS01U_de.HLP as \W32X86\HDNIS01U_de.HLP (9652.8 kb/s) (average 5899.8 kb/s)
+ putting file Hddm91c1_de.DLL as \W32X86\Hddm91c1_de.DLL (23777.7 kb/s) (average 10400.6 kb/s)
+ putting file Hddm91c1_de.INI as \W32X86\Hddm91c1_de.INI (98.6 kb/s) (average 10329.0 kb/s)
+ putting file Hddm91c1KMMin.DLL as \W32X86\Hddm91c1KMMin.DLL (22931.5 kb/s) (average 10501.7 kb/s)
+ putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (2462.8 kb/s) (average 10393.0 kb/s)
+ putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (4925.3 kb/s) (average 10356.3 kb/s)
+ putting file Hddm91c1_de.def as \W32X86\Hddm91c1_de.def (417.9 kb/s) (average 10290.1 kb/s)
+ putting file Hddm91c1_de.hre as \W32X86\Hddm91c1_de.hre (22571.3 kb/s) (average 11338.5 kb/s)
+ putting file Hddm91c1_de.vnd as \W32X86\Hddm91c1_de.vnd (3384.6 kb/s) (average 10754.3 kb/s)
+ putting file Hddm91c1_de.hlp as \W32X86\Hddm91c1_de.hlp (18406.8 kb/s) (average 10839.8 kb/s)
+ putting file Hddm91c1_de_reg.HLP as \W32X86\Hddm91c1_de_reg.HLP (20278.3 kb/s) (average 11386.3 kb/s)
+ putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll (14994.6 kb/s) (average 11405.2 kb/s)
+ putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF (23390.2 kb/s) (average 13170.8 kb/s)
+
+

    +Phewww -- that was a lot of typing! Most drivers are a lot smaller -- +many only having 3 generic PostScript driver files plus 1 PPD. Note, +that while we did retrieve the files from the "2" subdirectory of the +"W32X86" directory from the Windows box, we don't +put them (for now) in this same subdirectory of the Samba box! This +re-location will automatically be done by the +adddriver command which we will run shortly (and +don't forget to also put the files for the Win95/98/ME architecture +into the WIN40/ subdirectory should you need +them). +

    Check if the Driver Files are there (with smbclient)

    +For now we verify that our files are there. This can be done with +smbclient too (but of course you can log in via SSH +also and do this through a standard UNIX shell access too): +

    +root# smbclient //SAMBA-CUPS/print\$ -U 'root%xxxx' -c 'cd W32X86; pwd; dir; cd 2; pwd; dir'
+ added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+ Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
+ Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+
+  Current directory is \\SAMBA-CUPS\print$\W32X86\
+  .                                   D        0  Sun May  4 03:56:35 2003
+  ..                                  D        0  Thu Apr 10 23:47:40 2003
+  2                                   D        0  Sun May  4 03:56:18 2003
+  HDNIS01Aux.dll                      A    15356  Sun May  4 03:58:59 2003
+  Hddm91c1KMMin.DLL                   A    46966  Sun May  4 03:58:59 2003
+  HDNIS01_de.DLL                      A   434400  Sun May  4 03:58:59 2003
+  HDNIS01_de.NTF                      A   790404  Sun May  4 03:56:35 2003
+  Hddm91c1_de.DLL                     A   876544  Sun May  4 03:58:59 2003
+  Hddm91c1_de.INI                     A      101  Sun May  4 03:58:59 2003
+  Hddm91c1_de.dat                     A     5044  Sun May  4 03:58:59 2003
+  Hddm91c1_de.def                     A      428  Sun May  4 03:58:59 2003
+  Hddm91c1_de.hlp                     A    37699  Sun May  4 03:58:59 2003
+  Hddm91c1_de.hre                     A   323584  Sun May  4 03:58:59 2003
+  Hddm91c1_de.ppd                     A    26373  Sun May  4 03:58:59 2003
+  Hddm91c1_de.vnd                     A    45056  Sun May  4 03:58:59 2003
+  HDNIS01U_de.DLL                     A   165888  Sun May  4 03:58:59 2003
+  HDNIS01U_de.HLP                     A    19770  Sun May  4 03:58:59 2003
+  Hddm91c1_de_reg.HLP                 A   228417  Sun May  4 03:58:59 2003
+                40976 blocks of size 262144. 709 blocks available
+
+  Current directory is \\SAMBA-CUPS\print$\W32X86\2\
+  .                                   D        0  Sun May  4 03:56:18 2003
+  ..                                  D        0  Sun May  4 03:56:35 2003
+  ADOBEPS5.DLL                        A   434400  Sat May  3 23:18:45 2003
+  laserjet4.ppd                       A     9639  Thu Apr 24 01:05:32 2003
+  ADOBEPSU.DLL                        A   109568  Sat May  3 23:18:45 2003
+  ADOBEPSU.HLP                        A    18082  Sat May  3 23:18:45 2003
+  PDFcreator2.PPD                     A    15746  Sun Apr 20 22:24:07 2003
+                40976 blocks of size 262144. 709 blocks available
+
+

    +Notice that there are already driver files present in the +2 subdir (probably from a previous +installation). Once the files for the new driver are there too, you +are still a few steps away from being able to use them on the +clients. The only thing you could do *now* is to retrieve them from a +client just like you retrieve ordinary files from a file share, by +opening print$ in Windows Explorer. But that wouldn't install them per +Point'n'Print. The reason is: Samba doesn't know yet that these files +are something special, namely printer driver +files and it doesn't know yet to which print queue(s) these +driver files belong. +

    Running rpcclient with +adddriver

    +So, next you must tell Samba about the special category of the files +you just uploaded into the [print$] share. This +is done by the adddriver command. It will +prompt Samba to register the driver files into its internal TDB +database files. The following command and its output has been edited, +again, for readability: +

    +root# rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL: \
+  Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
+  NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
+  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
+  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+  HDNIS01Aux.dll,HDNIS01_de.NTF,                     \
+  Hddm91c1_de_reg.HLP' SAMBA-CUPS
+
+ cmd = adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:    \
+  HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
+  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,          \
+  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,        \
+  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
+
+ Printer Driver dm9110 successfully installed.
+
+

    +After this step the driver should be recognized by Samba on the print +server. You need to be very careful when typing the command. Don't +exchange the order of the fields. Some changes would lead to a +NT_STATUS_UNSUCCESSFUL error +message. These become obvious. Other changes might install the driver +files successfully, but render the driver unworkable. So take care! +Hints about the syntax of the adddriver command are in the man +page. The CUPS printing chapter of this HOWTO collection provides a +more detailed description, if you should need it. +

    Check how Driver Files have been moved after +adddriver finished

    +One indication for Samba's recognition of the files as driver files is +the successfully installed message. +Another one is the fact, that our files have been moved by the +adddriver command into the 2 +subdirectory. You can check this again with +smbclient: +

    +root# smbclient //SAMBA-CUPS/print\$ -Uroot%xxxx -c 'cd W32X86;dir;pwd;cd 2;dir;pwd'
+ added interface ip=10.160.51.162 bcast=10.160.51.255 nmask=255.255.252.0
+ Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+
+  Current directory is \\SAMBA-CUPS\print$\W32X86\
+  .                                   D        0  Sun May  4 04:32:48 2003
+  ..                                  D        0  Thu Apr 10 23:47:40 2003
+  2                                   D        0  Sun May  4 04:32:48 2003
+                40976 blocks of size 262144. 731 blocks available 
+
+  Current directory is \\SAMBA-CUPS\print$\W32X86\2\
+  .                                   D        0  Sun May  4 04:32:48 2003
+  ..                                  D        0  Sun May  4 04:32:48 2003
+  DigiMaster.PPD                      A   148336  Thu Apr 24 01:07:00 2003
+  ADOBEPS5.DLL                        A   434400  Sat May  3 23:18:45 2003
+  laserjet4.ppd                       A     9639  Thu Apr 24 01:05:32 2003
+  ADOBEPSU.DLL                        A   109568  Sat May  3 23:18:45 2003
+  ADOBEPSU.HLP                        A    18082  Sat May  3 23:18:45 2003
+  PDFcreator2.PPD                     A    15746  Sun Apr 20 22:24:07 2003
+  HDNIS01Aux.dll                      A    15356  Sun May  4 04:32:18 2003
+  Hddm91c1KMMin.DLL                   A    46966  Sun May  4 04:32:18 2003
+  HDNIS01_de.DLL                      A   434400  Sun May  4 04:32:18 2003
+  HDNIS01_de.NTF                      A   790404  Sun May  4 04:32:18 2003
+  Hddm91c1_de.DLL                     A   876544  Sun May  4 04:32:18 2003
+  Hddm91c1_de.INI                     A      101  Sun May  4 04:32:18 2003
+  Hddm91c1_de.dat                     A     5044  Sun May  4 04:32:18 2003
+  Hddm91c1_de.def                     A      428  Sun May  4 04:32:18 2003
+  Hddm91c1_de.hlp                     A    37699  Sun May  4 04:32:18 2003
+  Hddm91c1_de.hre                     A   323584  Sun May  4 04:32:18 2003
+  Hddm91c1_de.ppd                     A    26373  Sun May  4 04:32:18 2003
+  Hddm91c1_de.vnd                     A    45056  Sun May  4 04:32:18 2003
+  HDNIS01U_de.DLL                     A   165888  Sun May  4 04:32:18 2003
+  HDNIS01U_de.HLP                     A    19770  Sun May  4 04:32:18 2003
+  Hddm91c1_de_reg.HLP                 A   228417  Sun May  4 04:32:18 2003
+                40976 blocks of size 262144. 731 blocks available
+
+

    +Another verification is that the timestamp of the printing TDB files +is now updated (and possibly their filesize has increased). +

    Check if the Driver is recognized by Samba

    +Now the driver should be registered with Samba. We can easily verify +this, and will do so in a moment. However, this driver is +not yet associated with a particular +printer. We may check the driver status of the +files by at least three methods: +

    • from any Windows client browse Network Neighbourhood, +find the Samba host and open the Samba Printers and +Faxes folder. Select any printer icon, right-click and +select the printer Properties. Click on the +Advanced tab. Here is a field indicating the +driver for that printer. A drop down menu allows you to change that +driver (be careful to not do this unwittingly.). You can use this +list to view all drivers know to Samba. Your new one should be amongst +them. (Each type of client will only see his own architecture's +list. If you don't have every driver installed for each platform, the +list will differ if you look at it from Windows95/98/ME or +WindowsNT/2000/XP.)

    • from a Windows 2000 or XP client (not WinNT) browse +Network Neighbourhood, search for the Samba +server and open the server's Printers folder, +right-click the white background (with no printer highlighted). Select +Server Properties. On the +Drivers tab you will see the new driver listed +now. This view enables you to also inspect the list of files belonging +to that driver (this doesn't work on Windows NT, but only on +Windows 2000 and Windows XP. WinNT doesn't provide the "Drivers" +tab).. An alternative, much quicker method for Windows +2000/XP to start this dialog is by typing into a DOS box (you must of +course adapt the name to your Samba server instead of SAMBA-CUPS): +

      rundll32 printui.dll,PrintUIEntry /s /t2 /n\\SAMBA-CUPS

    • from a UNIX prompt run this command (or a variant +thereof), where SAMBA-CUPS is the name of the Samba +host and "xxxx" represents the actual Samba password assigned to root: +

      rpcclient -U'root%xxxx' -c 'enumdrivers' SAMBA-CUPS

      +You will see a listing of all drivers Samba knows about. Your new one +should be amongst them. But it is only listed under the [Windows NT +x86] heading, not under [Windows 4.0], +since we didn't install that part. Or did *you*? -- You will see a listing of +all drivers Samba knows about. Your new one should be amongst them. In our +example it is named dm9110. Note that the 3rd column +shows the other installed drivers twice, for each supported architecture one +time. Our new driver only shows up for +Windows NT 4.0 or 2000. To +have it present for Windows 95, 98 and ME you'll +have to repeat the whole procedure with the WIN40 architecture and subdirectory. +

    A side note: you are not bound to specific driver names

    +You can name the driver as you like. If you repeat the +adddriver step, with the same files as before, but +with a different driver name, it will work the same: +

    +root# rpcclient -Uroot%xxxx                                        \
+      -c 'adddriver "Windows NT x86"                     \
+      "myphantasydrivername:HDNIS01_de.DLL:              \
+      Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
+      NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
+      Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
+      Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+      HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP' SAMBA-CUPS
+  
+
+ cmd = adddriver "Windows NT x86" 
+                 "myphantasydrivername:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:\
+                  HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,           \
+                  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,                    \
+                  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,                  \
+                  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
+
+ Printer Driver myphantasydrivername successfully installed.
+
+

    +You will also be able to bind that driver to any print queue (however, +you are responsible yourself that you associate drivers to queues +which make sense to the target printer). Note, that you can't run the +rpcclient adddriver command +repeatedly. Each run "consumes" the files you had put into the +[print$] share by moving them into the +respective subdirectories. So you must precede an +smbclient ... put command before each +rpcclient ... adddriver" command. +

    La Grande Finale: Running rpcclient with +setdriver

    +Samba still needs to know which printer's driver +this is. It needs to create a mapping of the driver to a printer, and +store this info in its "memory", the TDB files. The rpcclient +setdriver command achieves exactly this: +

    +root# rpcclient -U'root%xxxx' -c 'setdriver dm9110 myphantasydrivername' SAMBA-CUPS
+ cmd = setdriver dm9110 myphantasydrivername
+ Successfully set dm9110 to driver myphantasydrivername.
+

    +Ahhhhh -- no, I didn't want to do that. Repeat, this time with the +name I intended: +

    +root# rpcclient -U'root%xxxx' -c 'setdriver dm9110 dm9110' SAMBA-CUPS
+ cmd = setdriver dm9110 dm9110
+ Successfully set dm9110 to driver dm9110.
+

    +The syntax of the command is rpcclient +-U'root%sambapassword' -c 'setdriver +"printername" +"drivername' +SAMBA-Hostname . -- +Now we have done *most* of the work. But not yet all.... +

    Note

    +the setdriver command will only succeed if the printer is +known to +Samba already. A bug in 2.2.x prevented Samba from recognizing freshly +installed printers. You had to restart Samba, or at least send a HUP +signal to all running smbd processes to work around this: +kill -HUP `pidof smbd`.

    "The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure)

    +A famous philosopher said once: “The Proof of the Pudding lies +in the Eating”. The proof for our setup lies in the printing. +So let's install the printer driver onto the client PCs. This is not +as straightforward as it may seem. Read on. +

    The first Client Driver Installation

    +Especially important is the installation onto the first client PC (for +each architectural platform separately). Once this is done correctly, +all further clients are easy to setup and shouldn't need further +attention. What follows is a description for the recommended first +procedure. You work now from a client workstation. First you should +guarantee that your connection is not unwittingly mapped to +bad user "nobody". In a DOS box type: +

    net use \\SAMBA-SERVER\print$ /user:root

    +Replace root, if needed, by another valid +printer admin user as given in the definition. +Should you already be connected as a different user, you'll get an error +message. There is no easy way to get rid of that connection, because +Windows doesn't seem to know a concept of "logging off" from a share +connection (don't confuse this with logging off from the local +workstation; that is a different matter). You can try to close +all Windows file explorer and Internet Explorer +windows. As a last resort, you may have to reboot. Make sure there is +no automatic re-connection set up. It may be easier to go to a +different workstation and try from there. After you have made sure you +are connected as a printer admin user (you can check this with the +smbstatus command on Samba) do this from the +Windows workstation: +

    • Open Network +Neighbourhood

    • Browse to Samba server

    • Open its Printers and +Faxes folder

    • Highlight and right-click the printer

    • Select Connect... (for WinNT4/2K +it is possibly Install...)

    +A new printer (named printername on +samba-server) should now have appeared in your +local Printer folder (check Start -- +Settings -- Control Panel +-- Printers and Faxes). +

    +Most likely you are now tempted to try and print a test page. After +all, you now can open the printer properties and on the "General" tab, +there is a button offering to do just that. But chances are that you +get an error message saying Unable to print Test +Page. The reason might be that there is not yet a +valid Device Mode set for the driver, or that the "Printer Driver +Data" set is still incomplete. +

    +You must now make sure that a valid "Device Mode" is set for the +driver. Don't fear -- we will explain now what that means. +

    IMPORTANT! Setting Device Modes on new Printers

    +In order for a printer to be truly usable by a Windows NT/2K/XP +client, it must possess: +

    • a valid Device Mode generated by +the driver for the printer (defining things like paper size, +orientation and duplex settings), and

    • a complete set of +Printer Driver Data generated by the +driver.

    +If either one of these is incomplete, the clients can produce less +than optimal output at best. In the worst cases, unreadable garbage or +nothing at all comes from the printer or they produce a harvest of +error messages when attempting to print. Samba stores the named values +and all printing related info in its internal TDB database files +(ntprinters.tdb, +ntdrivers.tdb, printing.tdb +and ntforms.tdb). +

    +What do these two words stand for? Basically, the Device Mode and the +set of Printer Driver Data is a collection of settings for all print +queue properties, initialized in a sensible way. Device Modes and +Printer Driver Data should initially be set on the print server (that is +here: the Samba host) to healthy values so that the clients can start +to use them immediately. How do we set these initial healthy values? +This can be achieved by accessing the drivers remotely from an NT (or +2k/XP) client, as is discussed in the next paragraphs. +

    +Be aware, that a valid Device Mode can only be initiated by a +printer admin, or root (the reason should be +obvious). Device Modes can only correctly be set by executing the +printer driver program itself. Since Samba can not execute this Win32 +platform driver code, it sets this field initially to NULL (which is +not a valid setting for clients to use). Fortunately, most drivers +generate themselves the Printer Driver Data that is needed, when they +are uploaded to the [print$] share with the +help of the APW or rpcclient. +

    +The generation and setting of a first valid Device Mode however +requires some "tickling" from a client, to set it on the Samba +server. The easiest means of doing so is to simply change the page +orientation on the server's printer. This "executes" enough of the +printer driver program on the client for the desired effect to happen, +and feeds back the new Device Mode to our Samba server. You can use the +native Windows NT/2K/XP printer properties page from a Window client +for this: +

    • Browse the Network Neighbourhood

    • Find the Samba server

    • Open the Samba server's Printers and + Faxes folder

    • Highlight the shared printer in question

    • Right-click the printer (you may already be here, if you +followed the last section's description)

    • At the bottom of the context menu select +Properties.... (if the menu still offers the +Connect... entry +further above, you need to click that one first to achieve the driver +installation as shown in the last section)

    • Go to the Advanced tab; click on +Printing Defaults...

    • Change the "Portrait" page setting to "Landscape" (and +back)

    • (Oh, and make sure to apply +changes between swapping the page orientation to cause the change to +actually take effect...).

    • While you're at it, you may optionally also want to +set the desired printing defaults here, which then apply to all future +client driver installations on the remaining from now +on.

    +This procedure has executed the printer driver program on the client +platform and fed back the correct Device Mode to Samba, which now +stored it in its TDB files. Once the driver is installed on the +client, you can follow the analogous steps by accessing the +local Printers folder too if you are +a Samba printer admin user. From now on printing should work as expected. +

    +Samba also includes a service level parameter name default +devmode for generating a default Device Mode for a +printer. Some drivers will function well with Samba's default set of +properties. Others may crash the client's spooler service. So use this +parameter with caution. It is always better to have the client +generate a valid device mode for the printer and store it on the +server for you. +

    Further Client Driver Install Procedures

    +Every further driver may be done by any user, along the lines +described above: Browse network, open printers folder on Samba server, +right-click printer and choose Connect.... Once +this completes (should be not more than a few seconds, but could also take +a minute, depending on network conditions), you should find the new printer in +your client workstation local Printers and +Faxes folder. +

    +You can also open your local Printers and Faxes folder by +using this command on Windows 2000 and Windows XP Professional workstations: +

    rundll32 shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder +

    +or this command on Windows NT 4.0 workstations: +

    +rundll32 shell32.dll,Control_RunDLL MAIN.CPL @2 +

    +You can enter the commands either inside a DOS box window +or in the Run command... field from the +Start menu. +

    Always make first Client Connection as root or "printer admin"

    +After you installed the driver on the Samba server (in its +[print$] share, you should always make sure +that your first client installation completes correctly. Make it a habit for +yourself to build that the very first connection from a client as +printer admin. This is to make sure that: +

    • a first valid Device Mode is +really initialized (see above for more explanation details), and +that

    • the default print settings of your printer for all +further client installations are as you want them

    +Do this by changing the orientation to landscape, click +Apply, and then change it back again. Then modify +the other settings (for example, you don't want the default media size +set to Letter, when you are all using +A4, right? You may want to set the printer for +duplex as the default; etc.). +

    +To connect as root to a Samba printer, try this command from a Windows +2K/XP DOS box command prompt: +

    runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n \\SAMBA-SERVER\printername" +

    +You will be prompted for root's Samba-password; type it, wait a few +seconds, click on Printing Defaults... and +proceed to set the job options as should be used as defaults by all +clients. Alternatively, instead of root you can name one other member +of the printer admins from the setting. +

    +Now all the other users downloading and installing the driver +the same way (called Point'n'Print) will +have the same defaults set for them. If you miss this step you'll +get a lot of helpdesk calls from your users. But maybe you like to +talk to people.... ;-) +

    Other Gotchas

    +Your driver is installed. It is ready for +Point'n'Print installation by the clients +now. You may have tried to download and use it +onto your first client machine now. But wait... let's make you +acquainted first with a few tips and tricks you may find useful. For +example, suppose you didn't manage to "set the defaults" on the +printer, as advised in the preceding paragraphs? And your users +complain about various issues (such as “We need to set the paper +size for each job from Letter to A4 and it won't store it!”) +

    Setting Default Print Options for the Client Drivers

    +The last sentence might be viewed with mixed feelings by some users and +admins. They have struggled for hours and hours and couldn't arrive at +a point were their settings seemed to be saved. It is not their +fault. The confusing thing is this: in the multi-tabbed dialog that pops +up when you right-click the printer name and select +Properties..., you can arrive at two identically +looking dialogs, each claiming that they help you to set printer options, +in three different ways. Here is the definite answer to the "Samba +Default Driver Setting FAQ": +

    “I can't set and save default print options +for all users on Win2K/XP! Why not?”  +How are you doing it? I bet the wrong way.... (it is not very +easy to find out, though). There are 3 different ways to bring you to +a dialog that seems to set everything. All three +dialogs look the same. Only one of them +does what you intend. +Important: you need to be Administrator or Print +Administrator to do this for all users. Here is how I reproduce it in +on XP Professional: + +

    1. The first "wrong" way: + +

      1. Open the Printers +folder.

      2. Right-click on the printer +(remoteprinter on cupshost) and +select in context menu Printing +Preferences...

      3. Look at this dialog closely and remember what it looks +like.

      +

    2. The second "wrong" way: + +

      1. Open the Printers +folder.

      2. Right-click on the printer (remoteprinter on +cupshost) and select in the context menu +Properties

      3. Click on the General +tab

      4. Click on the button Printing +Preferences...

      5. A new dialog opens. Keep this dialog open and go back +to the parent dialog.

      +

    3. The third, the "correct" way: (should you do +this from the beginning, just carry out steps 1. and 2. from second +"way" above) + +

      1. Click on the Advanced +tab. (Hmmm... if everything is "Grayed Out", then you are not logged +in as a user with enough privileges).

      2. Click on the Printing +Defaults... button.

      3. On any of the two new tabs, click on the +Advanced... button.

      4. A new dialog opens. Compare this one to the other, +identical looking one from "B.5" or A.3".

      +

    + +Do you see any difference in the two settings dialogs? I don't +either. However, only the last one, which you arrived at with steps +C.1.-6. will permanently save any settings which will then become the +defaults for new users. If you want all clients to have the same +defaults, you need to conduct these steps as administrator +(printer admin in ) +before a client downloads the driver (the clients +can later set their own per-user defaults by +following the procedures A. +or B. above...). (This is new: Windows 2000 and +Windows XP allow per-user default settings and +the ones the administrator gives them, before they set up their own). +The "parents" of the identically looking dialogs have a slight +difference in their window names: one is called +Default Print Values for Printer Foo on Server +Bar" (which is the one you need) and the other is +called "Print Settings for Printer Foo on Server +Bar". The last one is the one you arrive at when you +right-click on the printer and select Print +Settings.... This is the one what you were +taught to use back in the days of Windows NT! So it is only natural to +try the same way with Win2k or WinXP. You wouldn't dream +that there is now a different "clicking path" to arrive at an +identically looking, but functionally different dialog to set defaults +for all users! +

    Tip

    Try (on Win2000 and WinXP) to run this command (as a user +with the right privileges): +

    +rundll32 printui.dll,PrintUIEntry /p /t3 /n\\SAMBA-SERVER\printersharename +

    +to see the tab with the Printing Defaults... +button (the one you need). Also run this command: +

    +rundll32 printui.dll,PrintUIEntry /p /t0 /n\\SAMBA-SERVER\printersharename +

    +to see the tab with the Printing Preferences... +button (the one which doesn't set system-wide defaults). You can +start the commands from inside a DOS box" or from the Start +-- Run... menu. +

    Supporting large Numbers of Printers

    +One issue that has arisen during the recent development phase of Samba +is the need to support driver downloads for 100's of printers. Using +Windows NT APW here is somewhat awkward (to say the least). If you +don't want to acquire RSS pains from such the printer installation +clicking orgy alone, you need to think about a non-interactive script. +

    +If more than one printer is using the same driver, the +rpcclient setdriver command can be used to set the +driver associated with an installed queue. If the driver is uploaded +to [print$] once and registered with the +printing TDBs, it can be used by multiple print queues. In this case +you just need to repeat the setprinter subcommand +of rpcclient for every queue (without the need to +conduct the adddriver again and again). The +following is an example of how this could be accomplished: +

    +root# rpcclient SAMBA-CUPS -U root%secret -c 'enumdrivers'
+ cmd = enumdrivers
+ 
+ [Windows NT x86]
+ Printer Driver Info 1:
+   Driver Name: [infotec  IS 2075 PCL 6]
+ 
+ Printer Driver Info 1:
+   Driver Name: [DANKA InfoStream]
+ 
+ Printer Driver Info 1:
+   Driver Name: [Heidelberg Digimaster 9110 (PS)]
+ 
+ Printer Driver Info 1:
+   Driver Name: [dm9110]
+
+ Printer Driver Info 1:
+   Driver Name: [myphantasydrivername]
+
+ [....]
+

    + +

    +root# rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters'
+ cmd = enumprinters
+   flags:[0x800000]
+   name:[\\SAMBA-CUPS\dm9110]
+   description:[\\SAMBA-CUPS\dm9110,,110ppm HiVolume DANKA Stuttgart]
+   comment:[110 ppm HiVolume DANKA Stuttgart]
+ [....]
+

    + +

    +root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 "Heidelberg Digimaster 9110 (PS)"'
+ cmd = setdriver dm9110 Heidelberg Digimaster 9110 (PPD)
+ Successfully set dm9110 to driver Heidelberg Digimaster 9110 (PS).
+

    + +

    +root# rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters'
+ cmd = enumprinters
+   flags:[0x800000]
+   name:[\\SAMBA-CUPS\dm9110]
+   description:[\\SAMBA-CUPS\dm9110,Heidelberg Digimaster 9110 (PS),110ppm HiVolume DANKA Stuttgart]
+   comment:[110ppm HiVolume DANKA Stuttgart]
+ [....]
+

    + +

    +root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 myphantasydrivername'
+ cmd = setdriver dm9110 myphantasydrivername
+ Successfully set dm9110 to myphantasydrivername.
+

    + +

    +root# rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters'
+ cmd = enumprinters
+   flags:[0x800000]
+   name:[\\SAMBA-CUPS\dm9110]
+   description:[\\SAMBA-CUPS\dm9110,myphantasydrivername,110ppm HiVolume DANKA Stuttgart]
+   comment:[110ppm HiVolume DANKA Stuttgart]
+ [....]
+

    +It may be not easy to recognize: but the first call to +enumprinters showed the "dm9110" printer with an +empty string where the driver should have been listed (between the 2 +commas in the "description" field). After the +setdriver command succeeded, all is well. (The +CUPS Printing chapter has more info about the installation of printer +drivers with the help of rpcclient). +

    Adding new Printers with the Windows NT APW

    +By default, Samba exhibits all printer shares defined in +smb.conf in the +Printers... folder. Also located in this folder +is the Windows NT Add Printer Wizard icon. The APW will be shown only +if: +

    • ...the connected user is able to successfully execute +an OpenPrinterEx(\\server) with administrative +privileges (i.e. root or printer admin). +

      Tip

      Try this from a Windows 2K/XP DOS box command prompt: +

      +runas /netonly /user:root rundll32 printui.dll,PrintUIEntry /p /t0 /n \\SAMBA-SERVER\printersharename +

      +and click on Printing Preferences... +

    • ... contains the setting +show add printer wizard = yes (the +default).

    +The APW can do various things: +

    • upload a new driver to the Samba +[print$] share;

    • associate an uploaded driver with an existing (but +still "driverless") print queue;

    • exchange the currently used driver for an existing +print queue with one that has been uploaded before;

    • add an entirely new printer to the Samba host (only in +conjunction with a working add printer command; +a corresponding delete printer command for +removing entries from the Printers... folder +may be provided too)

    +The last one (add a new printer) requires more effort than the +previous ones. In order to use the APW to successfully add a printer +to a Samba server, the add printer command must +have a defined value. The program hook must successfully add the +printer to the Unix print system (i.e. to +/etc/printcap, +/etc/cups/printers.conf or other appropriate +files) and to if necessary. +

    +When using the APW from a client, if the named printer share does not +exist, smbd will execute the add printer +command and reparse to the +to attempt to locate the new printer share. If the share is still not +defined, an error of Access Denied is +returned to the client. Note that the add printer +command is executed under the context of the connected +user, not necessarily a root account. A map to guest = bad +user may have connected you unwittingly under the wrong +privilege; you should check it by using the +smbstatus command. +

    Weird Error Message Cannot connect under a +different Name

    +Once you are connected with the wrong credentials, there is no means +to reverse the situation other than to close all Explorer windows, and +perhaps reboot. +

    • The net use \\SAMBA-SERVER\sharename +/user:root gives you an error message: Multiple +connections to a server or a shared resource by the same user +utilizing the several user names are not allowed. Disconnect all +previous connections to the server, resp. the shared resource, and try +again.

    • Every attempt to "connect a network drive" to +\\SAMBASERVER\\print$ to z: is countered by the +pertinacious message. This network folder is currently +connected under different credentials (username and password). +Disconnect first any existing connection to this network share in +order to connect again under a different username and +password.

    +So you close all connections. You try again. You get the same +message. You check from the Samba side, using +smbstatus. Yes, there are some more +connections. You kill them all. The client still gives you the same +error message. You watch the smbd.log file on a very high debug level +and try re-connect. Same error message, but not a single line in the +log. You start to wonder if there was a connection attempt at all. You +run ethereal and tcpdump while you try to connect. Result: not a +single byte goes on the wire. Windows still gives the error +message. You close all Explorer Windows and start it again. You try to +connect - and this times it works! Windows seems to cache connection +info somewhere and doesn't keep it up to date (if you are unlucky you +might need to reboot to get rid of the error message). +

    Be careful when assembling Driver Files

    +You need to be very careful when you take notes about the files and +belonging to a particular driver. Don't confuse the files for driver +version "0" (for Win95/98/ME, going into +[print$]/WIN/0/), driver version "2" (Kernel Mode +driver for WinNT, going into [print$]/W32X86/2/ +may be used on Win2K/XP too), and driver version +"3" (non-Kernel Mode driver going into +[print$]/W32X86/3/ can not +be used on WinNT). Very often these different driver versions contain +files carrying the same name; but still the files are very different! +Also, if you look at them from the Windows Explorer (they reside in +%WINDOWS%\system32\spool\drivers\W32X86\) you +will probably see names in capital letters, while an "enumdrivers" +command from Samba would show mixed or lower case letters. So it is +easy to confuse them. If you install them manually using +rpcclient and subcommands, you may even succeed +without an error message. Only later, when you try install on a +client, you will encounter error messages like This +server has no appropriate driver for the printer. +

    +Here is an example. You are invited to look very closely at the +various files, compare their names and their spelling, and discover +the differences in the composition of the version-2 and -3 sets +Note: the version-0 set contained 40 (!) +Dependentfiles, so I left it out for space +reasons: +

    +root# rpcclient -U 'Administrator%secret' -c 'enumdrivers 3' 10.160.50.8 
+
+ Printer Driver Info 3:
+         Version: [3]
+         Driver Name: [Canon iR8500 PS3]
+         Architecture: [Windows NT x86]
+         Driver Path: [\\10.160.50.8\print$\W32X86\3\cns3g.dll]
+         Datafile: [\\10.160.50.8\print$\W32X86\3\iR8500sg.xpd]
+         Configfile: [\\10.160.50.8\print$\W32X86\3\cns3gui.dll]
+         Helpfile: [\\10.160.50.8\print$\W32X86\3\cns3g.hlp]
+ 
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\aucplmNT.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\ucs32p.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\tnl32.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\aussdrv.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cnspdc.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\aussapi.dat]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cns3407.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\CnS3G.cnt]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\NBAPI.DLL]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\NBIPC.DLL]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcview.exe]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcdspl.exe]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcedit.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcqm.exe]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcspl.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cfine32.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcr407.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\Cpcqm407.hlp]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcqm407.cnt]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cns3ggr.dll]
+ 
+         Monitorname: []
+         Defaultdatatype: []
+
+ Printer Driver Info 3:
+         Version: [2]
+         Driver Name: [Canon iR5000-6000 PS3]
+         Architecture: [Windows NT x86]
+         Driver Path: [\\10.160.50.8\print$\W32X86\2\cns3g.dll]
+         Datafile: [\\10.160.50.8\print$\W32X86\2\IR5000sg.xpd]
+         Configfile: [\\10.160.50.8\print$\W32X86\2\cns3gui.dll]
+         Helpfile: [\\10.160.50.8\print$\W32X86\2\cns3g.hlp]
+ 
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\AUCPLMNT.DLL]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\aussdrv.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\cnspdc.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\aussapi.dat]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\cns3407.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\CnS3G.cnt]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\NBAPI.DLL]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\NBIPC.DLL]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\cns3gum.dll]
+ 
+         Monitorname: [CPCA Language Monitor2]
+         Defaultdatatype: []
+
+

    +If we write the "version 2" files and the "version 3" files +into different text files and compare the result, we see this +picture: +

    +root# sdiff 2-files 3-files
+
+
+ cns3g.dll                     cns3g.dll
+ iR8500sg.xpd                  iR8500sg.xpd
+ cns3gui.dll                   cns3gui.dll
+ cns3g.hlp                     cns3g.hlp
+ AUCPLMNT.DLL                | aucplmNT.dll
+                             > ucs32p.dll
+                             > tnl32.dll
+ aussdrv.dll                   aussdrv.dll
+ cnspdc.dll                    cnspdc.dll
+ aussapi.dat                   aussapi.dat
+ cns3407.dll                   cns3407.dll
+ CnS3G.cnt                     CnS3G.cnt
+ NBAPI.DLL                     NBAPI.DLL
+ NBIPC.DLL                     NBIPC.DLL
+ cns3gum.dll                 | cpcview.exe
+                             > cpcdspl.exe 
+                             > cpcqm.exe
+                             > cpcspl.dll
+                             > cfine32.dll
+                             > cpcr407.dll
+                             > Cpcqm407.hlp
+                             > cpcqm407.cnt
+                             > cns3ggr.dll
+
+

    +Don't be fooled though! Driver files for each version with identical +names may be different in their content, as you can see from this size +comparison: +

    +root# for i in cns3g.hlp cns3gui.dll cns3g.dll; do                  \
+           smbclient //10.160.50.8/print\$ -U 'Administrator%xxxx' \
+           -c "cd W32X86/3; dir $i; cd .. ; cd 2; dir $i";      \
+		   done
+
+  CNS3G.HLP               A   122981  Thu May 30 02:31:00 2002
+  CNS3G.HLP               A    99948  Thu May 30 02:31:00 2002
+
+  CNS3GUI.DLL             A  1805824  Thu May 30 02:31:00 2002
+  CNS3GUI.DLL             A  1785344  Thu May 30 02:31:00 2002
+
+  CNS3G.DLL               A  1145088  Thu May 30 02:31:00 2002
+  CNS3G.DLL               A    15872  Thu May 30 02:31:00 2002
+
+

    +In my example were even more differences than shown here. Conclusion: +you must be very careful to select the correct driver files for each +driver version. Don't rely on the names alone. Don't interchange files +belonging to different driver versions. +

    Samba and Printer Ports

    +Windows NT/2000 print servers associate a port with each +printer. These normally take the form of LPT1:, +COM1:, FILE:, etc. Samba +must also support the concept of ports associated with a printer. By +default, only one printer port, named "Samba Printer Port", exists on +a system. Samba does not really need such a "port" in order to print; +it rather is a requirement of Windows clients. They insist on being +told about an available port when they request this info, otherwise +they throw an error message at you. So Samba fakes the port +information to keep the Windows clients happy. +

    +Note that Samba does not support the concept of "Printer Pooling" +internally either. Printer Pooling assigns a logical printer to +multiple ports as a form of load balancing or fail over. +

    +If you require that multiple ports be defined for some reason or +another (“My users and my Boss should not know that they are +working with Samba”), possesses a +enumports command which can be used to define +an external program that generates a listing of ports on a system. +

    Avoiding the most common Misconfigurations of the Client Driver

    +So - printing works, but there are still problems. Most jobs print +well, some don't print at all. Some jobs have problems with fonts, +which don't look good at all. Some jobs print fast, and some are +dead-slow. We can't cover it all; but we want to encourage you to read +the little paragraph about "Avoiding the wrong PostScript Driver +Settings" in the CUPS Printing part of this document. +

    The Imprints Toolset

    +The Imprints tool set provides a UNIX equivalent of the +Windows NT Add Printer Wizard. For complete information, please +refer to the Imprints web site +athttp://imprints.sourceforge.net/ +as well as the documentation included with the imprints source +distribution. This section will only provide a brief introduction +to the features of Imprints. +

    Attention! Maintainer required.  +Unfortunately, the Imprints toolset is no longer maintained. As of +December, 2000, the project is in need of a new maintainer. The most +important skill to have is decent perl coding and an interest in +MS-RPC based printing using Samba. If you wish to volunteer, please +coordinate your efforts on the samba-technical mailing list. The +toolset is still in usable form; but only for a series of older +printer models, where there are prepared packages to use. Packages for +more up to date print devices are needed if Imprints should have a +future.

    What is Imprints?

    +Imprints is a collection of tools for supporting these goals: +

    • Providing a central repository information regarding +Windows NT and 95/98 printer driver packages

    • Providing the tools necessary for creating the +Imprints printer driver packages.

    • Providing an installation client which will obtain +printer drivers from a central internet (or intranet) Imprints Server +repository and install them on remote Samba and Windows NT4 print +servers.

    Creating Printer Driver Packages

    +The process of creating printer driver packages is beyond the scope of +this document (refer to Imprints.txt also included with the Samba +distribution for more information). In short, an Imprints driver +package is a gzipped tarball containing the driver files, related INF +files, and a control file needed by the installation client. +

    The Imprints Server

    +The Imprints server is really a database server that may be queried +via standard HTTP mechanisms. Each printer entry in the database has +an associated URL for the actual downloading of the package. Each +package is digitally signed via GnuPG which can be used to verify that +package downloaded is actually the one referred in the Imprints +database. It is strongly recommended that this security check +not be disabled. +

    The Installation Client

    +More information regarding the Imprints installation client is +available in the Imprints-Client-HOWTO.ps file +included with the imprints source package. +

    +The Imprints installation client comes in two forms. +

    • a set of command line Perl scripts

    • a GTK+ based graphical interface to the command line Perl +scripts

    +The installation client (in both forms) provides a means of querying +the Imprints database server for a matching list of known printer +model names as well as a means to download and install the drivers on +remote Samba and Windows NT print servers. +

    +The basic installation process is in four steps and perl code is +wrapped around smbclient and rpcclient +

    • + foreach (supported architecture for a given driver) +

      1. rpcclient: Get the appropriate upload directory on the remote server

      2. smbclient: Upload the driver files

      3. rpcclient: Issues an AddPrinterDriver() MS-RPC

      +

    • rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer

    +One of the problems encountered when implementing the Imprints tool +set was the name space issues between various supported client +architectures. For example, Windows NT includes a driver named "Apple +LaserWriter II NTX v51.8" and Windows 95 calls its version of this +driver "Apple LaserWriter II NTX" +

    +The problem is how to know what client drivers have been uploaded for +a printer. An astute reader will remember that the Windows NT Printer +Properties dialog only includes space for one printer driver name. A +quick look in the Windows NT 4.0 system registry at +

    + HKLM\System\CurrentControlSet\Control\Print\Environment +

    +will reveal that Windows NT always uses the NT driver name. This is +ok as Windows NT always requires that at least the Windows NT version +of the printer driver is present. However, Samba does not have the +requirement internally. Therefore, how can you use the NT driver name +if is has not already been installed? +

    +The way of sidestepping this limitation is to require that all +Imprints printer driver packages include both the Intel Windows NT and +95/98 printer drivers and that NT driver is installed first. +

    Add Network Printers at Logon without User Interaction

    +The following MS Knowledge Base article may be of some help if you +need to handle Windows 2000 clients: How to Add Printers +with No User Interaction in Windows 2000. ( http://support.microsoft.com/default.aspx?scid=kb;en-us;189105 +). It also applies to Windows XP Professional clients. +

    +The ideas sketched out below are inspired by this article. It +describes a commandline method which can be applied to install +network and local printers and their drivers. This is most useful +if integrated in Logon Scripts. You can see what options are +available by typing in a command prompt ("DOS box") this: +

    rundll32 printui.dll,PrintUIEntry /?

    +A window pops up which shows you all of the commandline switches +available. An extensive list of examples is also provided. This is +only for Win 2k/XP. It doesn't work on WinNT. WinNT has probably some +other tools in the respective Resource Kit. Here is a suggestion about +what a client logon script might contain, with a short explanation of +what the lines actually do (it works if 2k/XP Windows clients access +printers via Samba, but works for Windows-based print servers too): +

    +rundll32 printui.dll,PrintUIEntry /dn /n "\\sambacupsserver\infotec2105-IPDS" /q
+rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\infotec2105-PS"
+rundll32 printui.dll,PrintUIEntry /y /n "\\sambacupsserver\infotec2105-PS"
+

    +Here is a list of the used commandline parameters: +

    /dn

    deletes a network printer

    /q

    quiet modus

    /n

    names a printer

    /in

    adds a network printer connection

    /y

    sets printer as default printer

    +I have tested this with a Samba 2.2.7a and a Samba-3alpha24 +installation and Windows XP Professional clients. Note that this +specific command set works with network print queues (installing +local print queues requires different parameters, but this is of no +interest here). +

    • Line 1 deletes a possibly existing previous network +printer infotec2105-IPDS (which had used native +Windows drivers with LPRng that were removed from the server which was +converted to CUPS). The /q at the end eliminates +"Confirm" or error dialog boxes popping up. They should not be +presented to the user logging on.

    • Line 2 adds the new printer +infotec2105-PS (which actually is same physical +device but is now run by the new CUPS printing system and associated +with the CUPS/Adobe PS drivers). The printer and its driver +must have been added to Samba prior to the user +logging in (e.g. by a procedure as discussed earlier in this chapter, +or by running cupsaddsmb). The driver is now +auto-downloaded to the client PC where the user is about to log +in.

    • Line 3 sets the default printer to this new network +printer (there might be several other printers installed with this +same method and some may be local as well -- so we decide for a +default printer). The default printer selection may of course be +different for different users.

    +Note that the second line only works if the printer +infotec2105-PS has an already working print queue +on "sambacupsserver", and if the printer drivers have successfully been +uploaded (via APW , +smbclient/rpcclient or +cupsaddsmb) into the +[print$] driver repository of Samba. Also, some +Samba versions prior to version 3.0 required a re-start of smbd after +the printer install and the driver upload, otherwise the script (or +any other client driver download) would fail. +

    +Since there no easy way to test for the existence of an installed +network printer from the logon script, the suggestion is: don't bother +checking and just allow the deinstallation/reinstallation to occur +every time a user logs in; it's really quick anyway (1 to 2 seconds). +

    +The additional benefits for this are: +

    • It puts in place any printer default setup changes +automatically at every user logon.

    • It allows for "roaming" users' login into the domain from +different workstations.

    +Since network printers are installed per user this much simplifies the +process of keeping the installation up-to-date. The extra few seconds +at logon time will not really be noticeable. Printers can be centrally +added, changed, and deleted at will on the server with no user +intervention required on the clients (you just need to keep the logon +scripts up to date). +

    The addprinter command

    +The addprinter command can be configured to be a +shell script or program executed by Samba. It is triggered by running +the APW from a client against the Samba print server. The APW asks the +user to fill in several fields (such as printer name, driver to be +used, comment, port monitor, etc.). These parameters are passed on to +Samba by the APW. If the addprinter command is designed in a way that +it can create a new printer (through writing correct printcap entries +on legacy systems, or execute the lpadmin command +on more modern systems) and create the associated share in +, then the APW will in effect really +create a new printer on Samba and the UNIX print subsystem! +

    Migration of "Classical" printing to Samba-3

    +The basic "NT-style" printer driver management has not changed +considerably in 3.0 over the 2.2.x releases (apart from many small +improvements). Here migration should be quite easy, especially if you +followed previous advice to stop using deprecated parameters in your +setup. For migrations from an existing 2.0.x setup, or if you +continued "Win9x-style" printing in your Samba 2.2 installations, it +is more of an effort. Please read the appropriate release notes and +the HOWTO Collection for 2.2. You can follow several paths. Here are +possible scenarios for migration: +

    • You need to study and apply the new Windows NT printer +and driver support. Previously used parameters "printer +driver file", " printer driver" and +"printer driver location" are no longer +supported.

    • If you want to take advantage of WinNT printer driver +support you also need to migrate the Win9x/ME drivers to the new +setup.

    • An existing printers.def file +(the one specified in the now removed parameter printer +driver file = ...) will work no longer with Samba-3.0. In +3.0, smbd attempts to locate a Win9x/ME driver files for the printer +in [print$] and additional settings in the TDB +and only there; if it fails it will not (as 2.2.x +used to do) drop down to using a printers.def +(and all associated parameters). The make_printerdef tool is removed +and there is no backwards compatibility for this.

    • You need to install a Windows 9x driver into the +[print$] share for a printer on your Samba +host. The driver files will be stored in the "WIN40/0" subdirectory of +[print$], and some other settings and info go +into the printing-related TDBs.

    • If you want to migrate an existing +printers.def file into the new setup, the current +only solution is to use the Windows NT APW to install the NT drivers +and the 9x drivers. This can be scripted using smbclient and +rpcclient. See the Imprints installation client at: +

      +http://imprints.sourceforge.net/ +

      +for an example. See also the discussion of rpcclient usage in the +"CUPS Printing" section.

    Publishing Printer Information in Active Directory or LDAP

    +We will publish an update to this section shortly. +

    Common Errors and Problems

    +Here are a few typical errors and problems people have +encountered. You can avoid them. Read on. +

    I give my root password but I don't get access

    +Don't confuse the root password which is valid for the Unix system +(and in most cases stored in the form of a one-way hash in a file +named /etc/shadow) with the password used to +authenticate against Samba!. Samba doesn't know the UNIX password; for +root to access Samba resources via Samba-type access, a Samba account +for root must be created first. This is often done with the +smbpasswd command. +

    My printjobs get spooled into the spooling directory, but then get lost

    +Don't use the existing Unix print system spool directory for the Samba +spool directory. It may seem convenient and a saving of space, but it +only leads to problems. The two must be separate. +

    Chapter 19. CUPS Printing Support in Samba 3.0

    Kurt Pfeifle

    Danka Deutschland GmbH

    Ciprian Vizitiu

    drawings

    (3 June 2003)

    Table of Contents

    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for +CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for +application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download
    GDI on Windows -- PostScript on Unix
    Windows Drivers, GDI and EMF
    Unix Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and +native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many +Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel +Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for +cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Caveats to be considered
    What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver?
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsm completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the +Client
    Installing PostScript Driver Files manually (using +rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Commandline Driver Installation in 15 little Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    When not to use Samba to print to +CUPS
    In Case of Trouble.....
    Where to find Documentation
    How to ask for Help
    Where to find Help
    Appendix
    Printing from CUPS to Windows attached +Printers
    More CUPS filtering Chains
    Trouble Shooting Guidelines to fix typical Samba printing +Problems
    An Overview of the CUPS Printing Processes

    Introduction

    Features and Benefits

    + The Common Unix Print System (CUPS) has become very popular. All + big Linux distributions now ship it as their default printing + system. But to many it is still a very mystical tool. Normally it + "just works" (TM). People tend to regard it as a sort of "black box", + which they don't want to look into, as long as it works OK. But once + there is a little problem, they are in trouble to find out where to + start debugging it. Also, even the most recent and otherwise excellent + printed Samba documentation has only limited attention paid to CUPS + printing, leaving out important pieces or even writing plain wrong + things about it. This demands rectification. But before you dive into + this chapter, make sure that you don't forget to refer to the + "Classical Printing" chapter also. It contains a lot of information + that is relevant for CUPS too. +

    + CUPS sports quite a few unique and powerful features. While their + basic functions may be grasped quite easily, they are also + new. Because they are different from other, more traditional printing + systems, it is best to try and not apply any prior knowledge about + printing upon this new system. Rather try to start understand CUPS + from the beginning. This documentation will lead you here to a + complete understanding of CUPS, if you study all of the material + contained. But lets start with the most basic things first. Maybe this + is all you need for now. Then you can skip most of the other + paragraphs. +

    Overview

    + CUPS is more than just a print spooling system. It is a complete + printer management system that complies with the new IPP + (Internet Printing Protocol). IPP is an industry + and IETF (Internet Engineering Task Force) + standard for network printing. Many of its functions can be managed + remotely (or locally) via a web browser (giving you a + platform-independent access to the CUPS print server). In addition it + has the traditional commandline and several more modern GUI interfaces + (GUI interfaces developed by 3rd parties, like KDE's + overwhelming KDEPrint). +

    + CUPS allows creation of "raw" printers (ie: NO print file + format translation) as well as "smart" printers (i.e. CUPS does + file format conversion as required for the printer). In many ways + this gives CUPS similar capabilities to the MS Windows print + monitoring system. Of course, if you are a CUPS advocate, you would + argue that CUPS is better! In any case, let us now move on to + explore how one may configure CUPS for interfacing with MS Windows + print clients via Samba. +

    Basic Configuration of CUPS support

    + Printing with CUPS in the most basic smb.conf + setup in Samba 3.0 (as was true for 2.2.x) only needs two + settings: printing = cups and printcap + = cups. CUPS itself doesn't need a printcap file + anymore. However, the cupsd.conf configuration + file knows two related directives: they control if such a file should + be automatically created and maintained by CUPS for the convenience of + third party applications (example: Printcap + /etc/printcap and PrintcapFormat + BSD). These legacy programs often require the existence of + printcap file containing printernames or they will refuse to + print. Make sure CUPS is set to generate and maintain a printcap! For + details see man cupsd.conf and other CUPS-related + documentation, like the wealth of documents on your CUPS server + itself: http://localhost:631/documentation.html. +

    Linking of smbd with libcups.so

    + Samba has a very special relationship to CUPS. The reason is: Samba + can be compiled with CUPS library support. Most recent installations + have this support enabled, and per default CUPS linking is compiled + into smbd and other Samba binaries. Of course, you can use CUPS even + if Samba is not linked against libcups.so -- but + there are some differences in required or supported configuration + then. +

    + If SAMBA is compiled against libcups, then printcap = + cups uses the CUPS API to list printers, submit jobs, + query queues, etc. Otherwise it maps to the System V commands with an + additional -oraw option for printing. On a Linux + system, you can use the ldd utility to find out + details (ldd may not be present on other OS platforms, or its function + may be embodied by a different command): + 

    +				transmeta:/home/kurt # ldd `which smbd`
+				libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000)
+				libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000)
+				libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000)
+				[....]
+

    + The line libcups.so.2 => /usr/lib/libcups.so.2 + (0x40123000) shows there is CUPS support compiled + into this version of Samba. If this is the case, and printing = cups + is set, then any otherwise manually set print command in + smb.conf is ignored. This is an + important point to remember! +

    Tip

    Should you require -- for any reason -- to set your own + print commands, you can still do this by setting printing = + sysv. However, you'll loose all the benefits from the + close CUPS/Samba integration. You are on your own then to manually + configure the rest of the printing system commands (most important: + print command; other commands are + lppause command, lpresume command, lpq command, lprm + command, queuepause command and queue resume + command).

    Simple smb.conf Settings for CUPS

    + To summarize, here is the simplest printing-related setup + for smb.conf to enable basic CUPS support: + 

    +
+				[global]
+				load printers = yes
+				printing = cups
+				printcap name = cups
+
+				[printers]
+				comment = All Printers
+				path = /var/spool/samba
+				browseable = no
+				public = yes
+				guest ok = yes
+				writable = no
+				printable = yes
+				printer admin = root, @ntadmins
+
+

    + This is all you need for basic printing setup for CUPS. It will print + all Graphic, Text, PDF and PostScript file submitted from Windows + clients. However, most of your Windows users would not know how to + send these kind of files to print without opening a GUI + application. Windows clients tend to have local printer drivers + installed. And the GUI application's print buttons start a printer + driver. Your users also very rarely send files from the command + line. Unlike UNIX clients, they hardly submit graphic, text or PDF + formatted files directly to the spooler. They nearly exclusively print + from GUI applications, with a "printer driver" hooked in between the + applications native format and the print data stream. If the backend + printer is not a PostScript device, the print data stream is "binary", + sensible only for the target printer. Read on to learn which problem + this may cause and how to avoid it. +

    More complex smb.conf Settings for +CUPS

    +Here is a slightly more complex printing-related setup +for smb.conf. It enables general CUPS printing +support for all printers, but defines one printer share which is set +up differently. +

    +
+ [global]
+         printing = cups
+         printcap name = cups
+         load printers = yes
+
+ [printers]
+         comment = All Printers
+         path = /var/spool/samba
+         public = yes
+         guest ok = yes
+         writable = no
+         printable = yes
+         printer admin = root, @ntadmins
+ 
+ [special_printer]
+         comment = A special printer with his own settings
+         path = /var/spool/samba-special
+         printing = sysv
+         printcap = lpstat
+         print command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ;\
+                         echo "     `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ;\
+                         echo "     `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log :\
+                         rm %f
+         public = no
+         guest ok = no
+         writeable = no
+         printable = yes
+         printer admin = kurt
+         hosts deny = 0.0.0.0
+         hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60
+
+

    +This special share is only there for my testing purposes. It doesn't +even write the print job to a file. It just logs the job parameters +known to Samba into the /tmp/smbprn.log file and +deletes the jobfile. Moreover, the printer +admin of this share is "kurt" (not the "@ntadmins" group); +guest access is not allowed; the share isn't announced in Network +Neighbourhood (so you need to know it is there), and it is only +allowing access from three hosts. To prevent CUPS kicking in and +taking over the print jobs for that share, we need to set +printing = sysv and printcap = +lpstat. +

    Advanced Configuration

    +Before we dive into all the configuration options, let's clarify a few +points. Network printing needs to be organized and setup +correctly. Often this is not done correctly. Legacy systems +or small LANs in business environments often lack a clear design and +good housekeeping. +

    Central spooling vs. "Peer-to-Peer" printing

    +Many small office or home networks, as well as badly organized larger +environments, allow each client a direct access to available network +printers. Generally, this is a bad idea. It often blocks one client's +access to the printer when another client's job is printing. It also +might freeze the first client's application while it is waiting to get +rid of the job. Also, there are frequent complaints about various jobs +being printed with their pages mixed with each other. A better concept +is the usage of a "print server": it routes all jobs through one +central system, which responds immediately, takes jobs from multiple +concurrent clients at the same time and in turn transfers them to the +printer(s) in the correct order. +

    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients

    +Most traditionally configured Unix print servers acting on behalf of +Samba's Windows clients represented a really simple setup. Their only +task was to manage the "raw" spooling of all jobs handed to them by +Samba. This approach meant that the Windows clients were expected to +prepare the print job file in such a way that it became fit to be fed to +the printing device. Here a native (vendor-supplied) Windows printer +driver for the target device needed to be installed on each and every +client. +

    +Of course you can setup CUPS, Samba and your Windows clients in the +same, traditional and simple way. When CUPS printers are configured +for RAW print-through mode operation it is the responsibility of the +Samba client to fully render the print job (file). The file must be +sent in a format that is suitable for direct delivery to the +printer. Clients need to run the vendor-provided drivers to do +this. In this case CUPS will NOT do any print file format conversion +work. +

    Driver Installation Methods on Windows Clients

    +The printer drivers on the Windows clients may be installed +in two functionally different ways: +

    • manually install the drivers locally on each client, +one by one; this yields the old LanMan style +printing; it uses a \\sambaserver\printershare +type of connection.

    • deposit and prepare the drivers (for later download) on +the print server (Samba); this enables the clients to use +"Point'n'Print" to get drivers semi-automatically installed the +first time they access the printer; with this method NT/2K/XP +clients use the SPOOLSS/MS-RPC +type printing calls.

    +The second method is recommended for use over the first. +

    Explicitly enable "raw" printing for +application/octet-stream!

    +If you use the first option (drivers are installed on the client +side), there is one setting to take care of: CUPS needs to be told +that it should allow "raw" printing of deliberate (binary) file +formats. The CUPS files that need to be correctly set for RAW mode +printers to work are: +

    • /etc/cups/mime.types +

    • /etc/cups/mime.convs

    +Both contain entries (at the end of the respective files) which must +be uncommented to allow RAW mode operation. +In/etc/cups/mime.types make sure this line is +present: +

    +
+ application/octet-stream
+
+

    +In /etc/cups/mime.convs, +have this line: +

    +
+ application/octet-stream   application/vnd.cups-raw   0   - 
+
+

    +If these two files are not set up correctly for raw Windows client +printing, you may encounter the dreaded Unable to +convert file 0 in your CUPS error_log file. +

    Note

    editing the mime.convs and the +mime.types file does not +enforce "raw" printing, it only +allows it. +

    Background.  +CUPS being a more security-aware printing system than traditional ones +does not by default allow a user to send deliberate (possibly binary) +data to printing devices. This could be easily abused to launch a +"Denial of Service" attack on your printer(s), causing at the least +the loss of a lot of paper and ink. "Unknown" data are tagged by CUPS +as MIME type: application/octet-stream and not +allowed to go to the printer. By default, you can only send other +(known) MIME types "raw". Sending data "raw" means that CUPS does not +try to convert them and passes them to the printer untouched (see next +chapter for even more background explanations). +

    +This is all you need to know to get the CUPS/Samba combo printing +"raw" files prepared by Windows clients, which have vendor drivers +locally installed. If you are not interested in background information about +more advanced CUPS/Samba printing, simply skip the remaining sections +of this chapter. +

    Three familiar Methods for driver upload plus a new one

    +If you want to use the MS-RPC type printing, you must upload the +drivers onto the Samba server first ([print$] +share). For a discussion on how to deposit printer drivers on the +Samba host (so that the Windows clients can download and use them via +"Point'n'Print") please also refer to the previous chapter of this +HOWTO Collection. There you will find a description or reference to +three methods of preparing the client drivers on the Samba server: +

    • the GUI, "Add Printer Wizard" +upload-from-a-Windows-client +method;

    • the commandline, "smbclient/rpcclient" +upload-from-a-UNIX-workstation +method;

    • the Imprints Toolset +method.

    +These 3 methods apply to CUPS all the same. A new and more +convenient way to load the Windows drivers into Samba is provided +provided if you use CUPS: +

    • the cupsaddsmb +utility.

    +cupsaddsmb is discussed in much detail further below. But we will +first explore the CUPS filtering system and compare the Windows and +UNIX printing architectures. +

    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download

    +Still reading on? Good. Let's go into more detail then. We now know +how to set up a "dump" printserver, that is, a server which is spooling +printjobs "raw", leaving the print data untouched. +

    +Possibly you need to setup CUPS in a more smart way. The reasons could +be manifold: +

    • Maybe your boss wants to get monthly statistics: Which +printer did how many pages? What was the average data size of a job? +What was the average print run per day? What are the typical hourly +peaks in printing? Which departments prints how +much?

    • Maybe you are asked to setup a print quota system: +users should not be able to print more jobs, once they have surpassed +a given limit per period?

    • Maybe your previous network printing setup is a mess +and shall be re-organized from a clean beginning?

    • Maybe you have experiencing too many "Blue Screens", +originating from poorly debugged printer drivers running in NT "kernel +mode"?

    +These goals cannot be achieved by a raw print server. To build a +server meeting these requirements, you'll first need to learn about +how CUPS works and how you can enable its features. +

    +What follows is the comparison of some fundamental concepts for +Windows and Unix printing; then is the time for a description of the +CUPS filtering system, how it works and how you can tweak it. +

    GDI on Windows -- PostScript on Unix

    +Network printing is one of the most complicated and error-prone +day-to-day tasks any user or an administrator may encounter. This is +true for all OS platforms. And there are reasons for this. +

    +You can't expect for most file formats to just throw them towards +printers and they get printed. There needs to be a file format +conversion in between. The problem is: there is no common standard for +print file formats across all manufacturers and printer types. While +PostScript (trademark held by Adobe), and, to an +extent, PCL (trademark held by HP), have developed +into semi-official "standards", by being the most widely used PDLs +(Page Description Languages), there are still +many manufacturers who "roll their own" (their reasons may be +unacceptable license fees for using printer-embedded PostScript +interpreters, etc.). +

    Windows Drivers, GDI and EMF

    +In Windows OS, the format conversion job is done by the printer +drivers. On MS Windows OS platforms all application programmers have +at their disposal a built-in API, the GDI (Graphical Device +Interface), as part and parcel of the OS itself, to base +themselves on. This GDI core is used as one common unified ground, for +all Windows programs, to draw pictures, fonts and documents +on screen as well as on +paper (=print). Therefore printer driver developers can +standardize on a well-defined GDI output for their own driver +input. Achieving WYSIWYG ("What You See Is What You Get") is +relatively easy, because the on-screen graphic primitives, as well as +the on-paper drawn objects, come from one common source. This source, +the GDI, produces often a file format called EMF (Enhanced +MetaFile). The EMF is processed by the printer driver and +converted to the printer-specific file format. +

    Note

    +To the GDI foundation in MS Windows, Apple has chosen to +put paper and screen output on a common foundation for their +(BSD-Unix-based, did you know??) Mac OS X and Darwin Operating +Systems.Their Core Graphic Engine uses a +PDF derivate for all display work. +

    + +

    Figure 19.1. Windows Printing to a local Printer

    Windows Printing to a local Printer

    +

    Unix Printfile Conversion and GUI Basics

    +In Unix and Linux, there is no comparable layer built into the OS +kernel(s) or the X (screen display) server. Every application is +responsible for itself to create its print output. Fortunately, most +use PostScript. That gives at least some common ground. Unfortunately, +there are many different levels of quality for this PostScript. And +worse: there is a huge difference (and no common root) in the way how +the same document is displayed on screen and how it is presented on +paper. WYSIWYG is more difficult to achieve. This goes back to the +time decades ago, when the predecessors of X.org, +designing the UNIX foundations and protocols for Graphical User +Interfaces refused to take over responsibility for "paper output" +also, as some had demanded at the time, and restricted itself to +"on-screen only". (For some years now, the "Xprint" project has been +under development, attempting to build printing support into the X +framework, including a PostScript and a PCL driver, but it is not yet +ready for prime time.) You can see this unfavorable inheritance up to +the present day by looking into the various "font" directories on your +system; there are separate ones for fonts used for X display and fonts +to be used on paper. +

    Background.  +The PostScript programming language is an "invention" by Adobe Inc., +but its specifications have been published to the full. Its strength +lies in its powerful abilities to describe graphical objects (fonts, +shapes, patterns, lines, curves, dots...), their attributes (color, +linewidth...) and the way to manipulate (scale, distort, rotate, +shift...) them. Because of its open specification, anybody with the +skill can start writing his own implementation of a PostScript +interpreter and use it to display PostScript files on screen or on +paper. Most graphical output devices are based on the concept of +"raster images" or "pixels" (one notable exception are pen +plotters). Of course, you can look at a PostScript file in its textual +form and you will be reading its PostScript code, the language +instructions which need to be interpreted by a rasterizer. Rasterizers +produce pixel images, which may be displayed on screen by a viewer +program or on paper by a printer. +

    PostScript and Ghostscript

    +So, Unix is lacking a common ground for printing on paper and +displaying on screen. Despite this unfavorable legacy for Unix, basic +printing is fairly easy: if you have PostScript printers at your +disposal! The reason is: these devices have a built-in PostScript +language "interpreter", also called a Raster Image +Processor (RIP), (which makes them more expensive than +other types of printers); throw PostScript towards them, and they will +spit out your printed pages. Their RIP is doing all the hard work of +converting the PostScript drawing commands into a bitmap picture as +you see it on paper, in a resolution as done by your printer. This is +no different to PostScript printing of a file from a Windows origin. +

    Note

    Traditional Unix programs and printing systems -- while +using PostScript -- are largely not PPD-aware. PPDs are "PostScript +Printer Description" files. They enable you to specify and control all +options a printer supports: duplexing, stapling, punching... Therefore +Unix users for a long time couldn't choose many of the supported +device and job options, unlike Windows or Apple users. But now there +is CUPS.... ;-) +

    +

    Figure 19.2. Printing to a Postscript Printer

    Printing to a Postscript Printer

    +

    +However, there are other types of printers out there. These don't know +how to print PostScript. They use their own Page Description +Language (PDL, often proprietary). To print to them is much +more demanding. Since your Unix applications mostly produce +PostScript, and since these devices don't understand PostScript, you +need to convert the printfiles to a format suitable for your printer +on the host, before you can send it away. +

    Ghostscript -- the Software RIP for non-PostScript Printers

    +Here is where Ghostscript kicks in. Ghostscript is +the traditional (and quite powerful) PostScript interpreter used on +Unix platforms. It is a RIP in software, capable to do a +lot of file format conversions, for a very broad +spectrum of hardware devices as well as software file formats. +Ghostscript technology and drivers is what enables PostScript printing +to non-PostScript hardware. +

    +

    Figure 19.3. Ghostscript as a RIP for non-postscript printers

    Ghostscript as a RIP for non-postscript printers

    +

    Tip

    +Use the "gs -h" command to check for all built-in "devices" of your +Ghostscript version. If you specify e.g. a parameter of +-sDEVICE=png256 on your Ghostscript command +line, you are asking Ghostscript to convert the input into a PNG +file. Naming a "device" on the commandline is the most important +single parameter to tell Ghostscript how exactly it should render the +input. New Ghostscript versions are released at fairly regular +intervals, now by artofcode LLC. They are initially put under the +"AFPL" license, but re-released under the GNU GPL as soon as the next +AFPL version appears. GNU Ghostscript is probably the version +installed on most Samba systems. But it has got some +deficiencies. Therefore ESP Ghostscript was developed as an +enhancement over GNU Ghostscript, with lots of bug-fixes, additional +devices and improvements. It is jointly maintained by developers from +CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat and Debian. It includes +the "cups" device (essential to print to non-PS printers from CUPS). +

    PostScript Printer Description (PPD) Specification

    +While PostScript in essence is a Page Description +Language (PDL) to represent the page layout in a +device independent way, real world print jobs are +always ending up to be output on a hardware with device-specific +features. To take care of all the differences in hardware, and to +allow for innovations, Adobe has specified a syntax and file format +for PostScript Printer Description (PPD) +files. Every PostScript printer ships with one of these files. +

    +PPDs contain all information about general and special features of the +given printer model: Which different resolutions can it handle? Does +it have a Duplexing Unit? How many paper trays are there? What media +types and sizes does it take? For each item it also names the special +command string to be sent to the printer (mostly inside the PostScript +file) in order to enable it. +

    +Information from these PPDs is meant to be taken into account by the +printer drivers. Therefore, installed as part of the Windows +PostScript driver for a given printer is the printer's PPD. Where it +makes sense, the PPD features are presented in the drivers' UI dialogs +to display to the user as choice of print options. In the end, the +user selections are somehow written (in the form of special +PostScript, PJL, JCL or vendor-dependent commands) into the PostScript +file created by the driver. +

    Warning

    +A PostScript file that was created to contain device-specific commands +for achieving a certain print job output (e.g. duplexed, stapled and +punched) on a specific target machine, may not print as expected, or +may not be printable at all on other models; it also may not be fit +for further processing by software (e.g. by a PDF distilling program). +

    CUPS can use all Windows-formatted Vendor PPDs

    +CUPS can handle all spec-compliant PPDs as supplied by the +manufacturers for their PostScript models. Even if a +Unix/Linux-illiterate vendor might not have mentioned our favorite +OS in his manuals and brochures -- you can safely trust this: +if you get hold of the Windows NT version of the PPD, you +can use it unchanged in CUPS and thus access the full +power of your printer just like a Windows NT user could! +

    Tip

    +To check the spec compliance of any PPD online, go to http://www.cups.org/testppd.php +and upload your PPD. You will see the results displayed +immediately. CUPS in all versions after 1.1.19 has a much more strict +internal PPD parsing and checking code enabled; in case of printing +trouble this online resource should be one of your first pitstops. +

    Warning

    +For real PostScript printers don't use the +Foomatic or cupsomatic +PPDs from Linuxprinting.org. With these devices the original +vendor-provided PPDs are always the first choice! +

    Tip

    +If you are looking for an original vendor-provided PPD of a specific +device, and you know that an NT4 box (or any other Windows box) on +your LAN has the PostScript driver installed, just use +smbclient //NT4-box/print\$ -U username to +access the Windows directory where all printer driver files are +stored. First look in the W32X86/2 subdir for +the PPD you are seeking. +

    CUPS also uses PPDs for non-PostScript Printers

    +CUPS also uses specially crafted PPDs to handle non-PostScript +printers. These PPDs are usually not available from the vendors (and +no, you can't just take the PPD of a Postscript printer with the same +model name and hope it works for the non-PostScript version too). To +understand how these PPDs work for non-PS printers we first need to +dive deeply into the CUPS filtering and file format conversion +architecture. Stay tuned. +

    The CUPS Filtering Architecture

    +The core of the CUPS filtering system is based on +Ghostscript. In addition to Ghostscript, CUPS +uses some other filters of its own. You (or your OS vendor) may have +plugged in even more filters. CUPS handles all data file formats under +the label of various MIME types. Every incoming +printfile is subjected to an initial +auto-typing. The auto-typing determines its given +MIME type. A given MIME type implies zero or more possible filtering +chains relevant to the selected target printer. This section discusses +how MIME types recognition and conversion rules interact. They are +used by CUPS to automatically setup a working filtering chain for any +given input data format. +

    +If CUPS rasterizes a PostScript file natively to +a bitmap, this is done in 2 stages: +

    • the first stage uses a Ghostscript device named "cups" +(this is since version 1.1.15) and produces a generic raster format +called "CUPS raster". +

    • the second stage uses a "raster driver" which converts +the generic CUPS raster to a device specific raster.

    +Make sure your Ghostscript version has the "cups" device compiled in +(check with gs -h | grep cups). Otherwise you +may encounter the dreaded Unable to convert file +0 in your CUPS error_log file. To have "cups" as a +device in your Ghostscript, you either need to patch GNU +Ghostscript and re-compile or use ESP Ghostscript. The +superior alternative is ESP Ghostscript: it supports not just CUPS, +but 300 other devices too (while GNU Ghostscript supports only about +180). Because of this broad output device support, ESP Ghostscript is +the first choice for non-CUPS spoolers too. It is now recommended by +Linuxprinting.org for all spoolers. +

    +CUPS printers may be setup to use external +rendering paths. One of the most common ones is provided by the +Foomatic/cupsomatic concept, from Linuxprinting.org. This +uses the classical Ghostscript approach, doing everything in one +step. It doesn't use the "cups" device, but one of the many +others. However, even for Foomatic/cupsomatic usage, best results and +broadest printer model support is provided by ESP Ghostscript (more +about cupsomatic/Foomatic, particularly the new version called now +foomatic-rip, follows below). +

    MIME types and CUPS Filters

    +CUPS reads the file /etc/cups/mime.types +(and all other files carrying a *.types suffix +in the same directory) upon startup. These files contain the MIME +type recognition rules which are applied when CUPS runs its +auto-typing routines. The rule syntax is explained in the man page +for mime.types and in the comments section of the +mime.types file itself. A simple rule reads +like this: +

    +
+ application/pdf         pdf string(0,%PDF)
+
+

    +This means: if a filename has either a +.pdf suffix, or if the magic +string %PDF is right at the +beginning of the file itself (offset 0 from the start), then it is +a PDF file (application/pdf). +Another rule is this: +

    +
+ application/postscript  ai eps ps string(0,%!) string(0,<04>%!)
+
+

    +Its meaning: if the filename has one of the suffixes +.ai, .eps, +.ps or if the file itself starts with one of the +strings %! or <04>%!, it +is a generic PostScript file +(application/postscript). +

    Note

    +There is a very important difference between two similar MIME type in +CUPS: one is application/postscript, the other is +application/vnd.cups-postscript. While +application/postscript is meant to be device +independent (job options for the file are still outside the PS file +content, embedded in commandline or environment variables by CUPS), +application/vnd.cups-postscript may have the job +options inserted into the PostScript data itself (were +applicable). The transformation of the generic PostScript +(application/postscript) to the device-specific version +(application/vnd.cups-postscript) is the responsibility of the +CUPS pstops filter. pstops uses information +contained in the PPD to do the transformation. +

    Warning

    +Don't confuse the other mime.types file your system might be using +with the one in the /etc/cups/ directory. +

    +CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI and a +lot of image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster, +PNM, PBM, SGI-RGB and some more) and their associated MIME types +with its filters. +

    MIME type Conversion Rules

    +CUPS reads the file /etc/cups/mime.convs +(and all other files named with a *.convs +suffix in the same directory) upon startup. These files contain +lines naming an input MIME type, an output MIME type, a format +conversion filter which can produce the output from the input type +and virtual costs associated with this conversion. One example line +reads like this: +

    +
+ application/pdf         application/postscript   33   pdftops
+
+

    +This means that the pdftops filter will take +application/pdf as input and produce +application/postscript as output, the virtual +cost of this operation is 33 CUPS-$. The next filter is more +expensive, costing 66 CUPS-$: +

    +
+ application/vnd.hp-HPGL application/postscript   66   hpgltops
+
+

    +This is the hpgltops, which processes HP-GL +plotter files to PostScript. +

    +
+ application/octet-stream
+
+

    +Here are two more examples: +

    +
+ application/x-shell     application/postscript   33    texttops
+ text/plain              application/postscript   33    texttops
+
+

    +The last two examples name the texttops filter +to work on "text/plain" as well as on "application/x-shell". (Hint: +this differentiation is needed for the syntax highlighting feature of +"texttops"). +

    Filter Requirements

    +There are many more combinations named in mime.convs. However, you +are not limited to use the ones pre-defined there. You can plug in any +filter you like into the CUPS framework. It must meet, or must be made +to meet some minimal requirements. If you find (or write) a cool +conversion filter of some kind, make sure it complies to what CUPS +needs, and put in the right lines in mime.types +and mime.convs, then it will work seamlessly +inside CUPS! +

    Tip

    +The mentioned "CUPS requirements" for filters are simple. Take +filenames or stdin as input and write to +stdout. They should take these 5 or 6 arguments: +printer job user title copies options [filename] +

    Printer

    The name of the printer queue (normally this is the +name of the filter being run)

    job

    The numeric job ID for the job being +printed

    Printer

    The string from the originating-user-name +attribute

    Printer

    The string from the job-name attribute

    Printer

    The numeric value from the number-copies +attribute

    Printer

    The job options

    Printer

    (Optionally) The print request file (if missing, +filters expected data fed through stdin). In most +cases it is very easy to write a simple wrapper script around existing +filters to make them work with CUPS.

    Prefilters

    +As was said, PostScript is the central file format to any Unix based +printing system. From PostScript, CUPS generates raster data to feed +non-PostScript printers. +

    +But what is happening if you send one of the supported non-PS formats +to print? Then CUPS runs "pre-filters" on these input formats to +generate PostScript first. There are pre-filters to create PS from +ASCII text, PDF, DVI or HP-GL. The outcome of these filters is always +of MIME type application/postscript (meaning that +any device-specific print options are not yet embedded into the +PostScript by CUPS, and that the next filter to be called is +pstops). Another pre-filter is running on all supported image formats, +the imagetops filter. Its outcome is always of +MIME type application/vnd.cups-postscript +(not application/postscript), meaning it has the +print options already embedded into the file. +

    +

    Figure 19.4. Prefiltering in CUPS to form Postscript

    Prefiltering in CUPS to form Postscript

    +

    pstops

    +pstopsis the filter to convert +application/postscript to +application/vnd.cups-postscript. It was said +above that this filter inserts all device-specific print options +(commands to the printer to ask for the duplexing of output, or +stapling an punching it, etc.) into the PostScript file. +

    +

    Figure 19.5. Adding Device-specific Print Options

    Adding Device-specific Print Options

    +

    +This is not all: other tasks performed by it are: +

    • +selecting the range of pages to be printed (if you choose to +print only pages "3, 6, 8-11, 16, 19-21", or only the odd numbered +ones) +

    • +putting 2 or more logical pages on one sheet of paper (the +so-called "number-up" function) +

    • counting the pages of the job to insert the accounting +information into the /var/log/cups/page_log +

    pstoraster

    +pstoraster is at the core of the CUPS filtering +system. It is responsible for the first stage of the rasterization +process. Its input is of MIME type application/vnd.cups-postscript; +its output is application/vnd.cups-raster. This output format is not +yet meant to be printable. Its aim is to serve as a general purpose +input format for more specialized raster drivers, +that are able to generate device-specific printer data. +

    +

    Figure 19.6. Postscript to intermediate Raster format

    Postscript to intermediate Raster format

    +

    +CUPS raster is a generic raster format with powerful features. It is +able to include per-page information, color profiles and more to be +used by the following downstream raster drivers. Its MIME type is +registered with IANA and its specification is of course completely +open. It is designed to make it very easy and inexpensive for +manufacturers to develop Linux and Unix raster drivers for their +printer models, should they choose to do so. CUPS always takes care +for the first stage of rasterization so these vendors don't need to care +about Ghostscript complications (in fact, there is currently more +than one vendor financing the development of CUPS raster drivers). +

    +

    Figure 19.7. CUPS-raster production using Ghostscript

    CUPS-raster production using Ghostscript

    +

    +CUPS versions before version 1.1.15 were shipping a binary (or source +code) standalone filter, named "pstoraster". pstoraster was derived +from GNU Ghostscript 5.50, and could be installed besides and in +addition to any GNU or AFPL Ghostscript package without conflicting. +

    +From version 1.1.15, this has changed. The functions for this has been +integrated back into Ghostscript (now based on GNU Ghostscript version +7.05). The "pstoraster" filter is now a simple shell script calling +gs with the -sDEVICE=cups +parameter. If your Ghostscript doesn't show a success on asking for +gs -h |grep cups, you might not be able to +print. Update your Ghostscript then! +

    imagetops and imagetoraster

    +Above in the section about prefilters, we mentioned the prefilter +that generates PostScript from image formats. The imagetoraster +filter is used to convert directly from image to raster, without the +intermediate PostScript stage. It is used more often than the above +mentioned prefilters. Here is a summarizing flowchart of image file +filtering: +

    +

    Figure 19.8. Image format to CUPS-raster format conversion

    Image format to CUPS-raster format conversion

    +

    rasterto [printers specific]

    +CUPS ships with quite some different raster drivers processing CUPS +raster. On my system I find in /usr/lib/cups/filter/ these: +rastertoalps, rastertobj, rastertoepson, rastertoescp, +rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo, +rastertoescp, rastertohp and +rastertoprinter. Don't worry if you have less +than this; some of these are installed by commercial add-ons to CUPS +(like rastertoturboprint), others (like +rastertoprinter) by 3rd party driver +development projects (such as Gimp-Print) wanting to cooperate as +closely as possible with CUPS. +

    +

    Figure 19.9. Raster to Printer Specific formats

    Raster to Printer Specific formats

    +

    CUPS Backends

    +The last part of any CUPS filtering chain is a "backend". Backends +are special programs that send the print-ready file to the final +device. There is a separate backend program for any transfer +"protocol" of sending printjobs over the network, or for every local +interface. Every CUPS printqueue needs to have a CUPS "device-URI" +associated with it. The device URI is the way to encode the backend +used to send the job to its destination. Network device-URIs are using +two slashes in their syntax, local device URIs only one, as you can +see from the following list. Keep in mind that local interface names +may vary much from my examples, if your OS is not Linux: +

    usb

    +This backend sends printfiles to USB-connected printers. An +example for the CUPS device-URI to use is: +usb:/dev/usb/lp0 +

    serial

    +This backend sends printfiles to serially connected printers. +An example for the CUPS device-URI to use is: +serial:/dev/ttyS0?baud=11500 +

    parallel

    +This backend sends printfiles to printers connected to the +parallel port. An example for the CUPS device-URI to use is: +parallel:/dev/lp0 +

    scsi

    +This backend sends printfiles to printers attached to the +SCSI interface. An example for the CUPS device-URI to use is: +scsi:/dev/sr1 +

    lpd

    +This backend sends printfiles to LPR/LPD connected network +printers. An example for the CUPS device-URI to use is: +lpd://remote_host_name/remote_queue_name +

    AppSocket/HP JetDirect

    +This backend sends printfiles to AppSocket (a.k.a. "HP +JetDirect") connected network printers. An example for the CUPS +device-URI to use is: +socket://10.11.12.13:9100 +

    ipp

    +This backend sends printfiles to IPP connected network +printers (or to other CUPS servers). Examples for CUPS device-URIs +to use are: +ipp:://192.193.194.195/ipp +(for many HP printers) or +ipp://remote_cups_server/printers/remote_printer_name +

    http

    +This backend sends printfiles to HTTP connected printers. +(The http:// CUPS backend is only a symlink to the ipp:// backend.) +Examples for the CUPS device-URIs to use are: +http:://192.193.194.195:631/ipp +(for many HP printers) or +http://remote_cups_server:631/printers/remote_printer_name +

    smb

    +This backend sends printfiles to printers shared by a Windows +host. An example for CUPS device-URIs to use are: +smb://workgroup/server/printersharename +Or +Smb://server/printersharename +or +smb://username:password@workgroup/server/printersharename +or +smb://username:password@server/printersharename. +The smb:// backend is a symlink to the Samba utility +smbspool (doesn't ship with CUPS). If the +symlink is not present in your CUPS backend directory, have your +root user create it: ln -s `which smbspool` +/usr/lib/cups/backend/smb. +

    +It is easy to write your own backends as Shell or Perl scripts, if you +need any modification or extension to the CUPS print system. One +reason could be that you want to create "special" printers which send +the printjobs as email (through a "mailto:/" backend), convert them to +PDF (through a "pdfgen:/" backend) or dump them to "/dev/null" (In +fact I have the system-wide default printer set up to be connected to +a "devnull:/" backend: there are just too many people sending jobs +without specifying a printer, or scripts and programs which don't name +a printer. The system-wide default deletes the job and sends a polite +mail back to the $USER asking him to always specify a correct +printername). +

    +Not all of the mentioned backends may be present on your system or +usable (depending on your hardware configuration). One test for all +available CUPS backends is provided by the lpinfo +utility. Used with the -v parameter, it lists +all available backends: +

    +
+ lpinfo -v
+
+

    cupsomatic/Foomatic -- how do they fit into the Picture?

    +"cupsomatic" filters may be the most widely used on CUPS +installations. You must be clear about the fact that these were not +developed by the CUPS people. They are a "Third Party" add-on to +CUPS. They utilize the traditional Ghostscript devices to render jobs +for CUPS. When troubleshooting, you should know about the +difference. Here the whole rendering process is done in one stage, +inside Ghostscript, using an appropriate "device" for the target +printer. cupsomatic uses PPDs which are generated from the "Foomatic" +Printer & Driver Database at Linuxprinting.org. +

    +You can recognize these PPDs from the line calling the +cupsomatic filter: +

    +
+ *cupsFilter: "application/vnd.cups-postscript  0  cupsomatic"
+
+

    +This line you may find amongst the first 40 or so lines of the PPD +file. If you have such a PPD installed, the printer shows up in the +CUPS web interface with a foomatic namepart for +the driver description. cupsomatic is a Perl script that runs +Ghostscript, with all the complicated commandline options +auto-constructed from the selected PPD and commandline options give to +the printjob. +

    +However, cupsomatic is now deprecated. Its PPDs (especially the first +generation of them, still in heavy use out there) are not meeting the +Adobe specifications. You might also suffer difficulties when you try +to download them with "Point'n'Print" to Windows clients. A better, +and more powerful successor is now in a very stable Beta-version +available: it is called foomatic-rip. To use +foomatic-rip as a filter with CUPS, you need the new-type PPDs. These +have a similar, but different line: +

    +
+ *cupsFilter: "application/vnd.cups-postscript  0  foomatic-rip"
+
+

    +The PPD generating engine at Linuxprinting.org has been revamped. +The new PPDs comply to the Adobe spec. On top, they also provide a +new way to specify different quality levels (hi-res photo, normal +color, grayscale, draft...) with a single click (whereas before you +could have required 5 or more different selections (media type, +resolution, inktype, dithering algorithm...). There is support for +custom-size media built in. There is support to switch +print-options from page to page, in the middle of a job. And the +best thing is: the new foomatic-rip now works seamlessly with all +legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR etc.), providing +for them access to use PPDs for their printing! +

    The Complete Picture

    +If you want to see an overview over all the filters and how they +relate to each other, the complete picture of the puzzle is at the end +of this document. +

    mime.convs

    +CUPS auto-constructs all possible filtering chain paths for any given +MIME type, and every printer installed. But how does it decide in +favor or against a specific alternative? (There may often be cases, +where there is a choice of two or more possible filtering chains for +the same target printer). Simple: you may have noticed the figures in +the 3rd column of the mime.convs file. They represent virtual costs +assigned to this filter. Every possible filtering chain will sum up to +a total "filter cost". CUPS decides for the most "inexpensive" route. +

    Tip

    +The setting of FilterLimit 1000 in +cupsd.conf will not allow more filters to +run concurrently than will consume a total of 1000 virtual filter +cost. This is a very efficient way to limit the load of any CUPS +server by setting an appropriate "FilterLimit" value. A FilterLimit of +200 allows roughly 1 job at a time, while a FilterLimit of 1000 allows +approximately 5 jobs maximum at a time. +

    "Raw" printing

    +You can tell CUPS to print (nearly) any file "raw". "Raw" means it +will not be filtered. CUPS will send the file to the printer "as is" +without bothering if the printer is able to digest it. Users need to +take care themselves that they send sensible data formats only. Raw +printing can happen on any queue if the "-o raw" option is specified +on the command line. You can also set up raw-only queues by simply not +associating any PPD with it. This command: +

    +
+ lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E
+
+

    +sets up a queue named "rawprinter", connected via the "socket" +protocol (a.k.a. "HP JetDirect") to the device at IP address +11.12.1.3.14, using port 9100. (If you had added a PPD with +-P /path/to/PPD to this command line, you would +have installed a "normal" printqueue. +

    +CUPS will automatically treat each job sent to a queue as a "raw" one, +if it can't find a PPD associated with the queue. However, CUPS will +only send known MIME types (as defined in its own mime.types file) and +refuse others. +

    "application/octet-stream" printing

    +Any MIME type with no rule in the +/etc/cups/mime.types file is regarded as unknown +or application/octet-stream and will not be +sent. Because CUPS refuses to print unknown MIME types per default, +you will probably have experienced the fact that printjobs originating +from Windows clients were not printed. You may have found an error +message in your CUPS logs like: +

    +
+ Unable to convert file 0 to printable format for job
+
+

    +To enable the printing of "application/octet-stream" files, edit +these two files: +

    • /etc/cups/mime.convs

    • /etc/cups/mime.types

    +Both contain entries (at the end of the respective files) which must +be uncommented to allow RAW mode operation for +application/octet-stream. In /etc/cups/mime.types +make sure this line is present: +

    +
+ application/octet-stream
+
+

    +This line (with no specific auto-typing rule set) makes all files +not otherwise auto-typed a member of application/octet-stream. In +/etc/cups/mime.convs, have this +line: +

    +
+ application/octet-stream   application/vnd.cups-raw   0   -
+
+

    +This line tells CUPS to use the Null Filter +(denoted as "-", doing... nothing at all) on +application/octet-stream, and tag the result as +application/vnd.cups-raw. This last one is +always a green light to the CUPS scheduler to now hand the file over +to the "backend" connecting to the printer and sending it over. +

    Note

    Editing the mime.convs and the +mime.types file does not +enforce "raw" printing, it only +allows it. +

    Background.  +CUPS being a more security-aware printing system than traditional ones +does not by default allow one to send deliberate (possibly binary) +data to printing devices. (This could be easily abused to launch a +Denial of Service attack on your printer(s), causing at least the loss +of a lot of paper and ink...) "Unknown" data are regarded by CUPS +as MIME type +application/octet-stream. While you +can send data "raw", the MIME type for these must +be one that is known to CUPS and an allowed one. The file +/etc/cups/mime.types defines the "rules" how CUPS +recognizes MIME types. The file +/etc/cups/mime.convs decides which file +conversion filter(s) may be applied to which MIME types. +

    PostScript Printer Descriptions (PPDs) for non-PS Printers

    +Originally PPDs were meant to be used for PostScript printers +only. Here, they help to send device-specific commands and settings +to the RIP which processes the jobfile. CUPS has extended this +scope for PPDs to cover non-PostScript printers too. This was not +very difficult, because it is a standardized file format. In a way +it was logical too: CUPS handles PostScript and uses a PostScript +RIP (=Ghostscript) to process the jobfiles. The only difference is: +a PostScript printer has the RIP built-in, for other types of +printers the Ghostscript RIP runs on the host computer. +

    +PPDs for a non-PS printer have a few lines that are unique to +CUPS. The most important one looks similar to this: +

    +
+ *cupsFilter: application/vnd.cups-raster  66   rastertoprinter
+
+

    +It is the last piece in the CUPS filtering puzzle. This line tells the +CUPS daemon to use as a last filter "rastertoprinter". This filter +should be served as input an "application/vnd.cups-raster" MIME type +file. Therefore CUPS should auto-construct a filtering chain, which +delivers as its last output the specified MIME type. This is then +taken as input to the specified "rastertoprinter" filter. After this +the last filter has done its work ("rastertoprinter" is a Gimp-Print +filter), the file should go to the backend, which sends it to the +output device. +

    +CUPS by default ships only a few generic PPDs, but they are good for +several hundred printer models. You may not be able to control +different paper trays, or you may get larger margins than your +specific model supports): +

    deskjet.ppd

    older HP inkjet printers and compatible +

    deskjet2.ppd

    newer HP inkjet printers and compatible +

    dymo.ppd

    label printers +

    epson9.ppd

    Epson 24pin impact printers and compatible +

    epson24.ppd

    Epson 24pin impact printers and compatible +

    okidata9.ppd

    Okidata 9pin impact printers and compatible +

    okidat24.ppd

    Okidata 24pin impact printers and compatible +

    stcolor.ppd

    older Epson Stylus Color printers +

    stcolor2.ppd

    newer Epson Stylus Color printers +

    stphoto.ppd

    older Epson Stylus Photo printers +

    stphoto2.ppd

    newer Epson Stylus Photo printers +

    laserjet.ppd

    all PCL printers. Further below is a discussion +of several other driver/PPD-packages suitable fur use with CUPS. +

    Difference between cupsomatic/foomatic-rip and +native CUPS printing

    +Native CUPS rasterization works in two steps. +

    • +First is the "pstoraster" step. It uses the special "cups" +device from ESP Ghostscript 7.05.x as its tool +

    • +Second comes the "rasterdriver" step. It uses various +device-specific filters; there are several vendors who provide good +quality filters for this step, some are Free Software, some are +Shareware/Non-Free, some are proprietary.

    +Often this produces better quality (and has several more +advantages) than other methods. +

    +

    Figure 19.10. cupsomatic/foomatic processing versus Native CUPS

    cupsomatic/foomatic processing versus Native CUPS

    +

    +One other method is the cupsomatic/foomatic-rip +way. Note that cupsomatic is not made by the CUPS +developers. It is an independent contribution to printing development, +made by people from Linuxprinting.org (see also http://www.cups.org/cups-help.html). +cupsomatic is no longer developed and maintained and is no longer +supported. It has now been replaced by +foomatic-rip. foomatic-rip is a complete re-write +of the old cupsomatic idea, but very much improved and generalized to +other (non-CUPS) spoolers. An upgrade to foomatic-rip is strongly +advised, especially if you are upgrading to a recent version of CUPS +too. +

    +Both the cupsomatic (old) and the foomatic-rip (new) methods from +Linuxprinting.org use the traditional Ghostscript print file +processing, doing everything in a single step. It therefore relies on +all the other devices built-in into Ghostscript. The quality is as +good (or bad) as Ghostscript rendering is in other spoolers. The +advantage is that this method supports many printer models not +supported (yet) by the more modern CUPS method. +

    +Of course, you can use both methods side by side on one system (and +even for one printer, if you set up different queues), and find out +which works best for you. +

    +cupsomatic "kidnaps" the printfile after the +application/vnd.cups-postscript stage and +deviates it through the CUPS-external, system wide Ghostscript +installation: Therefore the printfile bypasses the "pstoraster" filter +(and thus also bypasses the CUPS-raster-drivers +"rastertosomething"). After Ghostscript finished its rasterization, +cupsomatic hands the rendered file directly to the CUPS backend. The +flowchart above illustrates the difference between native CUPS +rendering and the Foomatic/cupsomatic method. +

    Examples for filtering Chains

    +Here are a few examples of commonly occurring filtering chains to +illustrate the workings of CUPS. +

    +Assume you want to print a PDF file to a HP JetDirect-connected +PostScript printer, but you want to print the pages 3-5, 7, 11-13 +only, and you want to print them "2-up" and "duplex": +

    • your print options (page selection as required, 2-up, +duplex) are passed to CUPS on the commandline;

    • the (complete) PDF file is sent to CUPS and autotyped as +application/pdf;

    • the file therefore first must pass the +pdftops pre-filter, which produces PostScript +MIME type application/postscript (a preview here +would still show all pages of the original PDF);

    • the file then passes the pstops +filter which applies the commandline options: it selects the pages +2-5, 7 and 11-13, creates and imposed layout "2 pages on 1 sheet" and +inserts the correct "duplex" command (as is defined in the printer's +PPD) into the new PostScript file; the file now is of PostScript MIME +type +application/vnd.cups-postscript;

    • the file goes to the socket +backend, which transfers the job to the printers.

    +The resulting filter chain therefore is: +

    +pdftops --> pstops --> socket
+

    +Assume your want to print the same filter to an USB-connected +Epson Stylus Photo printer, installed with the CUPS +stphoto2.ppd. The first few filtering stages +are nearly the same: +

    • your print options (page selection as required, 2-up, +duplex) are passed to CUPS on the commandline;

    • the (complete) PDF file is sent to CUPS and autotyped as +application/pdf;

    • the file therefore first must pass the +pdftops pre-filter, which produces PostScript +MIME type application/postscript (a preview here +would still show all pages of the original PDF);

    • the file then passes the "pstops" filter which applies +the commandline options: it selects the pages 2-5, 7 and 11-13, +creates and imposed layout "2 pages on 1 sheet" and inserts the +correct "duplex" command... (OOoops -- this printer and his PPD +don't support duplex printing at all -- this option will be ignored +then) into the new PostScript file; the file now is of PostScript +MIME type +application/vnd.cups-postscript;

    • the file then passes the +pstoraster stage and becomes MIME type +application/cups-raster;

    • finally, the rastertoepson filter +does its work (as is indicated in the printer's PPD), creating the +printer-specific raster data and embedding any user-selected +print-options into the print data stream;

    • the file goes to the usb backend, +which transfers the job to the printers.

    +The resulting filter chain therefore is: +

    +pdftops --> pstops --> pstoraster --> rastertoepson --> usb
+

    Sources of CUPS drivers / PPDs

    +On the internet you can find now many thousand CUPS-PPD files +(with their companion filters), in many national languages, +supporting more than 1000 non-PostScript models. +

    Note

    +The cupsomatic/Foomatic trick from Linuxprinting.org works +differently from the other drivers. This is explained elsewhere in this +document. +

    Printing with Interface Scripts

    +CUPS also supports the usage of "interface scripts" as known from +System V AT&T printing systems. These are often used for PCL +printers, from applications that generate PCL print jobs. Interface +scripts are specific to printer models. They have a similar role as +PPDs for PostScript printers. Interface scripts may inject the Escape +sequences as required into the print data stream, if the user has +chosen to select a certain paper tray, or print landscape, or use A3 +paper, etc. Interfaces scripts are practically unknown in the Linux +realm. On HP-UX platforms they are more often used. You can use any +working interface script on CUPS too. Just install the printer with +the -i option: +

    +
+ lpadmin -p pclprinter -v socket://11.12.13.14:9100 -i /path/to/interface-script
+
+

    +Interface scripts might be the "unknown animal" to many. However, +with CUPS they provide the most easy way to plug in your own +custom-written filtering script or program into one specific print +queue (some information about the traditional usage of interface scripts is +to be found at http://playground.sun.com/printing/documentation/interface.html). +

    Network printing (purely Windows)

    +Network printing covers a lot of ground. To understand what exactly +goes on with Samba when it is printing on behalf of its Windows +clients, let's first look at a "purely Windows" setup: Windows clients +with a Windows NT print server. +

    From Windows Clients to an NT Print Server

    +Windows clients printing to an NT-based print server have two +options. They may +

    • execute the driver locally and render the GDI output +(EMF) into the printer specific format on their own, +or

    • send the GDI output (EMF) to the server, where the +driver is executed to render the printer specific +output.

    +Both print paths are shown in the flowcharts below. +

    Driver Execution on the Client

    +In the first case the print server must spool the file as "raw", +meaning it shouldn't touch the jobfile and try to convert it in any +way. This is what traditional Unix-based print server can do too; and +at a better performance and more reliably than NT print server. This +is what most Samba administrators probably are familiar with. One +advantage of this setup is that this "spooling-only" print server may +be used even if no driver(s) for Unix are available it is sufficient +to have the Windows client drivers available and installed on the +clients. +

    +

    Figure 19.11. Print Driver execution on the Client

    Print Driver execution on the Client

    +

    Driver Execution on the Server

    +The other path executes the printer driver on the server. The clients +transfers print files in EMF format to the server. The server uses the +PostScript, PCL, ESC/P or other driver to convert the EMF file into +the printer-specific language. It is not possible for Unix to do the +same. Currently there is no program or method to convert a Windows +client's GDI output on a Unix server into something a printer could +understand. +

    +

    Figure 19.12. Print Driver execution on the Server

    Print Driver execution on the Server

    +

    +However, there is something similar possible with CUPS. Read on... +

    Network Printing (Windows clients -- UNIX/Samba Print +Servers)

    +Since UNIX print servers cannot execute the Win32 +program code on their platform, the picture is somewhat +different. However, this doesn't limit your options all that +much. In the contrary, you may have a way here to implement printing +features which are not possible otherwise. +

    From Windows Clients to a CUPS/Samba Print Server

    +Here is a simple recipe showing how you can take advantage of CUPS +powerful features for the benefit of your Windows network printing +clients: +

    • Let the Windows clients send PostScript to the CUPS +server.

    • Let the CUPS server render the PostScript into device +specific raster format.

    +This requires the clients to use a PostScript driver (even if the +printer is a non-PostScript model. It also requires that you have a +"driver" on the CUPS server. +

    +Firstly, to enable CUPS based printing through Samba the +following options should be set in your smb.conf file [globals] +section: +

    • printing = CUPS

    • printcap = CUPS

    +When these parameters are specified, all manually set print directives +(like print command =..., or lppause +command =...) in smb.conf (as well as +in samba itself) will be ignored. Instead, Samba will directly +interface with CUPS through it's application program interface (API) - +as long as Samba has been compiled with CUPS library (libcups) +support. If Samba has NOT been compiled with CUPS support, and if no +other print commands are set up, then printing will use the +System V AT&T command set, with the -oraw +option automatically passing through (if you want your own defined +print commands to work with a Samba that has CUPS support compiled in, +simply use printing = sysv). +

    +

    Figure 19.13. Printing via CUPS/samba server

    Printing via CUPS/samba server

    +

    Samba receiving Jobfiles and passing them to CUPS

    +Samba must use its own spool directory (it is set +by a line similar to path = /var/spool/samba, +in the [printers] or +[printername] section of +smb.conf). Samba receives the job in its own +spool space and passes it into the spool directory of CUPS (the CUPS +spooling directory is set by the RequestRoot +directive, in a line that defaults to RequestRoot +/var/spool/cups). CUPS checks the access rights of its +spool dir and resets it to healthy values with every re-start. We have +seen quite some people who had used a common spooling space for Samba +and CUPS, and were struggling for weeks with this "problem". +

    +A Windows user authenticates only to Samba (by whatever means is +configured). If Samba runs on the same host as CUPS, you only need to +allow "localhost" to print. If they run on different machines, you +need to make sure the Samba host gets access to printing on CUPS. +

    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs

    +PPDs can control all print device options. They are usually provided +by the manufacturer; if you own a PostScript printer, that is. PPD +files (PostScript Printer Descriptions) are always a component of +PostScript printer drivers on MS Windows or Apple Mac OS systems. They +are ASCII files containing user-selectable print options, mapped to +appropriate PostScript, PCL or PJL commands for the target +printer. Printer driver GUI dialogs translate these options +"on-the-fly" into buttons and drop-down lists for the user to select. +

    +CUPS can load, without any conversions, the PPD file from any Windows +(NT is recommended) PostScript driver and handle the options. There is +a web browser interface to the print options (select http://localhost:631/printers/ +and click on one Configure Printer button to see +it), or a commandline interface (see man lpoptions +or see if you have lphelp on your system). There are also some +different GUI frontends on Linux/UNIX, which can present PPD options +to users. PPD options are normally meant to be evaluated by the +PostScript RIP on the real PostScript printer. +

    PPDs for non-PS Printers on UNIX

    +CUPS doesn't limit itself to "real" PostScript printers in its usage +of PPDs. The CUPS developers have extended the scope of the PPD +concept, to also describe available device and driver options for +non-PostScript printers through CUPS-PPDs. +

    +This is logical, as CUPS includes a fully featured PostScript +interpreter (RIP). This RIP is based on Ghostscript. It can process +all received PostScript (and additionally many other file formats) +from clients. All CUPS-PPDs geared to non-PostScript printers contain +an additional line, starting with the keyword +*cupsFilter . This line tells the CUPS print +system which printer-specific filter to use for the interpretation of +the supplied PostScript. Thus CUPS lets all its printers appear as +PostScript devices to its clients, because it can act as a PostScript +RIP for those printers, processing the received PostScript code into a +proper raster print format. +

    PPDs for non-PS Printers on Windows

    +CUPS-PPDs can also be used on Windows-Clients, on top of a +"core" PostScript driver (now recommended is the "CUPS PostScript +Driver for WindowsNT/2K/XP"; you can also use the Adobe one, with +limitations). This feature enables CUPS to do a few tricks no other +spooler can do: +

    • act as a networked PostScript RIP (Raster Image +Processor), handling printfiles from all client platforms in a uniform +way;

    • act as a central accounting and billing server, since +all files are passed through the pstops filter and are therefore +logged in the CUPS page_log file. +NOTE: this can not happen with "raw" print jobs, +which always remain unfiltered per definition;

    • enable clients to consolidate on a single PostScript +driver, even for many different target printers.

    +Using CUPS PPDs on Windows clients enables these to control +all print job settings just as a UNIX client can do too. +

    Windows Terminal Servers (WTS) as CUPS Clients

    +This setup may be of special interest to people experiencing major +problems in WTS environments. WTS need often a multitude of +non-PostScript drivers installed to run their clients' variety of +different printer models. This often imposes the price of much +increased instability. +

    Printer Drivers running in "Kernel Mode" cause many +Problems

    +The reason is that in Win NT printer drivers run in "Kernel +Mode", this introduces a high risk for the stability of the system +if the driver is not really stable and well-tested. And there are a +lot of bad drivers out there! Especially notorious is the example +of the PCL printer driver that had an additional sound module +running, to notify users via soundcard of their finished jobs. Do I +need to say that this one was also reliably causing "Blue Screens +of Death" on a regular basis? +

    +PostScript drivers generally are very well tested. They are not known +to cause any problems, even though they run in Kernel Mode too. This +might be because there have so far only been 2 different PostScript +drivers the ones from Adobe and the one from Microsoft. Both are +very well tested and are as stable as you ever can imagine on +Windows. The CUPS driver is derived from the Microsoft one. +

    Workarounds impose Heavy Limitations

    +In many cases, in an attempt to work around this problem, site +administrators have resorted to restrict the allowed drivers installed +on their WTS to one generic PCL- and one PostScript driver. This +however restricts the clients in the amount of printer options +available for them; often they can't get out more than simplex +prints from one standard paper tray, while their devices could do much +better, if driven by a different driver! ) +

    CUPS: a "Magical Stone"?

    +Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very +elegant way to overcome all these shortcomings. There are, depending +on the version of Windows OS you use, up to 3 different PostScript +drivers available: Adobe, Microsoft and CUPS PostScript drivers. None +of them is known to cause major stability problems on WTS (even if +used with many different PPDs). The clients will be able to (again) +chose paper trays, duplex printing and other settings. However, there +is a certain price for this too: a CUPS server acting as a PostScript +RIP for its clients requires more CPU and RAM than when just acting as +a "raw spooling" device. Plus, this setup is not yet widely tested, +although the first feedbacks look very promising. +

    PostScript Drivers with no major problems -- even in Kernel +Mode

    +More recent printer drivers on W2K and XP don't run in Kernel mode +(unlike Win NT) any more. However, both operating systems can still +use the NT drivers, running in Kernel mode (you can roughly tell which +is which as the drivers in subdirectory "2" of "W32X86" are "old" +ones). As was said before, the Adobe as well as the Microsoft +PostScript drivers are not known to cause any stability problems. The +CUPS driver is derived from the Microsoft one. There is a simple +reason for this: The MS DDK (Device Development Kit) for Win NT (which +used to be available at no cost to licensees of Visual Studio) +includes the source code of the Microsoft driver, and licensees of +Visual Studio are allowed to use and modify it for their own driver +development efforts. This is what the CUPS people have done. The +license doesn't allow them to publish the whole of the source code. +However, they have released the "diff" under the GPL, and if you are +owner of an "MS DDK for Win NT", you can check the driver yourself. +

    Setting up CUPS for driver Download

    +As we have said before: all previously known methods to prepare client +printer drivers on the Samba server for download and "Point'n'Print" +convenience of Windows workstations are working with CUPS too. These +methods were described in the previous chapter. In reality, this is a +pure Samba business, and only relates to the Samba/Win client +relationship. +

    cupsaddsmb: the unknown Utility

    +The cupsaddsmb utility (shipped with all current CUPS versions) is an +alternative method to transfer printer drivers into the Samba +[print$] share. Remember, this share is where +clients expect drivers deposited and setup for download and +installation. It makes the sharing of any (or all) installed CUPS +printers very easy. cupsaddsmb can use the Adobe PostScript driver as +well as the newly developed CUPS PostScript Driver for +WinNT/2K/XP. Note, that cupsaddsmb does +not work with arbitrary vendor printer drivers, +but only with the exact driver files that are +named in its man page. +

    +The CUPS printer driver is available from the CUPS download site. Its +package name is cups-samba-[version].tar.gz . It +is preferred over the Adobe drivers since it has a number of +advantages: +

    • it supports a much more accurate page +accounting;

    • it supports banner pages, and page labels on all +printers;

    • it supports the setting of a number of job IPP +attributes (such as job-priority, page-label and +job-billing)

    +However, currently only Windows NT, 2000, and XP are supported by the +CUPS drivers. You will need to get the respective part of Adobe driver +too if you need to support Windows 95, 98, and ME clients. +

    Prepare your smb.conf for +cupsaddsmb

    +Prior to running cupsaddsmb, you need the following settings in +smb.conf: +

    +
+ [global]
+         load printers = yes
+         printing = cups
+         printcap name = cups
+
+ [printers]
+         comment = All Printers
+         path = /var/spool/samba
+         browseable = no
+         public = yes
+         guest ok = yes           # setting depends on your requirements
+         writable = no
+         printable = yes
+         printer admin = root
+
+ [print$]
+         comment = Printer Drivers
+         path = /etc/samba/drivers
+         browseable = yes
+         guest ok = no
+         read only = yes
+         write list = root  
+
+

    CUPS Package of "PostScript Driver for WinNT/2k/XP"

    +CUPS users may get the exactly same packages fromhttp://www.cups.org/software.html. +It is a separate package from the CUPS base software files, tagged as +CUPS 1.1.x Windows NT/2k/XP Printer Driver for SAMBA +(tar.gz, 192k). The filename to download is +cups-samba-1.1.x.tar.gz. Upon untar-/unzip-ing, +it will reveal these files: +

    +
+# tar xvzf cups-samba-1.1.19.tar.gz 
+
+   cups-samba.install
+   cups-samba.license
+   cups-samba.readme
+   cups-samba.remove
+   cups-samba.ss
+
+

    +These have been packaged with the ESP meta packager software +"EPM". The *.install and +*.remove files are simple shell scripts, which +untars the *.ss (the *.ss is +nothing else but a tar-archive, which can be untar-ed by "tar" +too). Then it puts the content into +/usr/share/cups/drivers/. This content includes 3 +files: +

    +
+# tar tv cups-samba.ss
+
+    cupsdrvr.dll
+    cupsui.dll
+    cups.hlp  
+
+

    +The cups-samba.install shell scripts is easy to +handle: +

    +
+# ./cups-samba.install
+
+   [....]
+   Installing software...
+   Updating file permissions...
+   Running post-install commands...
+   Installation is complete.        
+
+

    +The script should automatically put the driver files into the +/usr/share/cups/drivers/ directory. +

    Warning

    +Due to a bug, one recent CUPS release puts the +cups.hlp driver file +into/usr/share/drivers/ instead of +/usr/share/cups/drivers/. To work around this, +copy/move the file (after running the +./cups-samba.install script) manually to the +right place. +

    +
+   cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/
+
+

    +This new CUPS PostScript driver is currently binary-only, but free of +charge. No complete source code is provided (yet). The reason is this: +it has been developed with the help of the Microsoft Driver +Developer Kit (DDK) and compiled with Microsoft Visual +Studio 6. Driver developers are not allowed to distribute the whole of +the source code as Free Software. However, CUPS developers released +the "diff" in source code under the GPL, so anybody with a license of +Visual Studio and a DDK will be able to compile for him/herself. +

    Recognize the different Driver Files

    +The CUPS drivers don't support the "older" Windows 95/98/ME, but only +the Windows NT/2000/XP client: +

    +
+ [Windows NT, 2000, and XP are supported by:]
+         cups.hlp
+         cupsdrvr.dll
+         cupsui.dll
+
+

    +Adobe drivers are available for the older Windows 95/98/ME as well as +the Windows NT/2000/XP clients. The set of files is different for the +different platforms. +

    +
+ [Windows 95, 98, and Me are supported by:]
+         ADFONTS.MFM
+         ADOBEPS4.DRV
+         ADOBEPS4.HLP
+         DEFPRTR2.PPD
+         ICONLIB.DLL
+         PSMON.DLL
+
+ [Windows NT, 2000, and XP are supported by:]
+         ADOBEPS5.DLL
+         ADOBEPSU.DLL
+         ADOBEPSU.HLP
+
+

    Note

    +If both, the Adobe driver files and the CUPS driver files for the +support of WinNT/2k/XP are present in , the Adobe ones will be ignored +and the CUPS ones will be used. If you prefer -- for whatever reason +-- to use Adobe-only drivers, move away the 3 CUPS driver files. The +Win95/98/ME clients use the Adobe drivers in any case. +

    Acquiring the Adobe Driver Files

    +Acquiring the Adobe driver files seems to be unexpectedly difficult +for many users. They are not available on the Adobe website as single +files and the self-extracting and/or self-installing Windows-exe is +not easy to locate either. Probably you need to use the included +native installer and run the installation process on one client +once. This will install the drivers (and one Generic PostScript +printer) locally on the client. When they are installed, share the +Generic PostScript printer. After this, the client's +[print$] share holds the Adobe files, from +where you can get them with smbclient from the CUPS host. A more +detailed description about this is in the next (the CUPS printing) +chapter. +

    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"

    +Users of the ESP Print Pro software are able to install their "Samba +Drivers" package for this purpose with no problem. Retrieve the driver +files from the normal download area of the ESP Print Pro software +athttp://www.easysw.com/software.html. +You need to locate the link labelled "SAMBA" amongst the +Download Printer Drivers for ESP Print Pro 4.x +area and download the package. Once installed, you can prepare any +driver by simply highlighting the printer in the Printer Manager GUI +and select Export Driver... from the menu. Of +course you need to have prepared Samba beforehand too to handle the +driver files; i.e. mainly setup the [print$] +share, etc. The ESP Print Pro package includes the CUPS driver files +as well as a (licensed) set of Adobe drivers for the Windows 95/98/ME +client family. +

    Caveats to be considered

    +Once you have run the install script (and possibly manually +moved the cups.hlp file to +/usr/share/cups/drivers/), the driver is +ready to be put into Samba's [print$] share (which often maps to +/etc/samba/drivers/ and contains a subdir +tree with WIN40 and +W32X86 branches): You do this by running +"cupsaddsmb" (see also man cupsaddsmb for +CUPS since release 1.1.16). +

    Tip

    +You may need to put root into the smbpasswd file by running +smbpasswd; this is especially important if you +should run this whole procedure for the first time, and are not +working in an environment where everything is configured for +Single Sign On to a Windows Domain Controller. +

    +Once the driver files are in the [print$] share +and are initialized, they are ready to be downloaded and installed by +the Win NT/2k/XP clients. +

    Note

    +

    1. +Win 9x/ME clients won't work with the CUPS PostScript driver. For +these you'd still need to use the ADOBE*.* +drivers as previously. +

    2. +It is not harmful if you still have the +ADOBE*.* driver files from previous +installations in the /usr/share/cups/drivers/ +directory. The new cupsaddsmb (from 1.1.16) will +automatically prefer "its own" drivers if it finds both. +

    3. +Should your Win clients have had the old ADOBE*.* +files for the Adobe PostScript driver installed, the download and +installation of the new CUPS PostScript driver for Windows NT/2k/XP +will fail at first. You need to wipe the old driver from the clients +first. It is not enough to "delete" the printer, as the driver files +will still be kept by the clients and re-used if you try to re-install +the printer. To really get rid of the Adobe driver files on the +clients, open the "Printers" folder (possibly via Start +--> Settings --> Control Panel --> Printers), +right-click onto the folder background and select Server +Properties. When the new dialog opens, select the +Drivers tab. On the list select the driver you +want to delete and click on the Delete +button. This will only work if there is not one single printer left +which uses that particular driver. You need to "delete" all printers +using this driver in the "Printers" folder first. You will need +Administrator privileges to do this. +

    4. +Once you have successfully downloaded the CUPS PostScript driver to a +client, you can easily switch all printers to this one by proceeding +as described elsewhere in the "Samba HOWTO Collection": either change +a driver for an existing printer by running the "Printer Properties" +dialog, or use rpcclient with the +setdriver sub-command. +

    +

    What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver?

    +You are interested in a comparison between the CUPS and the Adobe +PostScript drivers? For our purposes these are the most important +items which weigh in favor of the CUPS ones: +

    • no hassle with the Adobe EULA

    • no hassle with the question “Where do I +get the ADOBE*.* driver files from?”

    • the Adobe drivers (on request of the printer PPD +associated with them) often put a PJL header in front of the main +PostScript part of the print file. Thus the printfile starts with +<1B >%-12345X or +<escape>%-12345X instead +of %!PS). This leads to the +CUPS daemon auto-typing the incoming file as a print-ready file, +not initiating a pass through the "pstops" filter (to speak more +technically, it is not regarded as the generic MIME type +application/postscript, but as +the more special MIME type +application/cups.vnd-postscript), +which therefore also leads to the page accounting in +/var/log/cups/page_log not +receiving the exact number of pages; instead the dummy page number +of "1" is logged in a standard setup)

    • the Adobe driver has more options to "mis-configure" the +PostScript generated by it (like setting it inadvertently to +Optimize for Speed, instead of +Optimize for Portability, which +could lead to CUPS being unable to process it)

    • the CUPS PostScript driver output sent by Windows +clients to the CUPS server will be guaranteed to be auto-typed always +as generic MIME type application/postscript, +thusly passing through the CUPS "pstops" filter and logging the +correct number of pages in the page_log for +accounting and quota purposes

    • the CUPS PostScript driver supports the sending of +additional standard (IPP) print options by Win NT/2k/XP clients. Such +additional print options are: naming the CUPS standard +banner pages (or the custom ones, should they be +installed at the time of driver download), using the CUPS +page-label option, setting a +job-priority and setting the scheduled +time of printing (with the option to support additional +useful IPP job attributes in the future).

    • the CUPS PostScript driver supports the inclusion of +the new *cupsJobTicket comments at the +beginning of the PostScript file (which could be used in the future +for all sort of beneficial extensions on the CUPS side, but which will +not disturb any other applications as they will regard it as a comment +and simply ignore it).

    • the CUPS PostScript driver will be the heart of the +fully fledged CUPS IPP client for Windows NT/2K/XP to be released soon +(probably alongside the first Beta release for CUPS +1.2).

    Run "cupsaddsmb" (quiet Mode)

    +The cupsaddsmb command copies the needed files into your +[print$] share. Additionally, the PPD +associated with this printer is copied from +/etc/cups/ppd/ to +[print$]. There the files wait for convenient +Windows client installations via Point'n'Print. Before we can run the +command successfully, we need to be sure that we can authenticate +towards Samba. If you have a small network you are probably using user +level security (security = user). Probably your +root has already a Samba account. Otherwise, create it now, using +smbpasswd: +

    +
+ #  smbpasswd -a root 
+ New SMB password: [type in password 'secret']
+ Retype new SMB password: [type in password 'secret']
+
+

    +Here is an example of a successfully run cupsaddsmb command. +

    +
+ #  cupsaddsmb -U root infotec_IS2027
+ Password for root required to access localhost via SAMBA: [type in password 'secret']
+
+

    +To share all printers and drivers, use the +-a parameter instead of a printer name. Since +cupsaddsmb "exports" the printer drivers to Samba, it should be +obvious that it only works for queues with a CUPS driver associated. +

    Run "cupsaddsmb" with verbose Output

    +Probably you want to see what's going on. Use the +-v parameter to get a more verbose output. The +output below was edited for better readability: all "\" at the end of +a line indicate that I inserted an artificial line break plus some +indentation here: +

    Warning

    +You will see the root password for the Samba account printed on +screen. If you use remote access, the password will go over the wire +unencrypted! +

    +
+  # cupsaddsmb -U root -v infotec_2105
+  Password for root required to access localhost via SAMBA:
+  Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir W32X86;put   \
+                   /var/spool/cups/tmp/3e98bf2d333b5 W32X86/infotec_2105.ppd;put           \
+                   /usr/share/cups/drivers/cupsdrvr.dll W32X86/cupsdrvr.dll;put            \
+                   /usr/share/cups/drivers/cupsui.dll W32X86/cupsui.dll;put                \
+                   /usr/share/cups/drivers/cups.hlp W32X86/cups.hlp'
+  added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+  Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+  NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86
+  putting file /var/spool/cups/tmp/3e98bf2d333b5 as \W32X86/infotec_2105.ppd (2328.8 kb/s) \
+               (average 2328.8 kb/s)
+  putting file /usr/share/cups/drivers/cupsdrvr.dll as \W32X86/cupsdrvr.dll (9374.3 kb/s)  \
+               (average 5206.6 kb/s)
+  putting file /usr/share/cups/drivers/cupsui.dll as \W32X86/cupsui.dll (8107.2 kb/s)      \
+               (average 5984.1 kb/s)
+  putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp (3475.0 kb/s)          \
+               (average 5884.7 kb/s)
+  
+  Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows NT x86"   \
+                   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:   \
+                   RAW:NULL"'
+  cmd = adddriver "Windows NT x86" "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll: \
+                   cups.hlp:NULL:RAW:NULL"
+  Printer Driver infotec_2105 successfully installed.
+  
+  Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir WIN40;put    \
+                   /var/spool/cups/tmp/3e98bf2d333b5 WIN40/infotec_2105.PPD; put           \
+                   /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;put               \
+                   /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV;put             \
+                   /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP;put             \
+                   /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD;put             \
+                   /usr/share/cups/drivers/ICONLIB.DLL
+  WIN40/ICONLIB.DLL;put /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;'
+  added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+  Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+  NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40
+  putting file /var/spool/cups/tmp/3e98bf2d333b5 as \WIN40/infotec_2105.PPD (2328.8 kb/s)  \
+               (average 2328.8 kb/s)
+  putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM (9368.0 kb/s)     \
+               (average 6469.6 kb/s)
+  putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV (9958.2 kb/s)   \
+               (average 8404.3 kb/s)
+  putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP (8341.5 kb/s)   \
+               (average 8398.6 kb/s)
+  putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD (2195.9 kb/s)   \
+               (average 8254.3 kb/s)
+  putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL (8239.9 kb/s)     \
+               (average 8253.6 kb/s)
+  putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL (6222.2 kb/s)         \
+               (average 8188.5 kb/s)
+  
+  Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows 4.0"      \
+                   "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP:          \
+                   PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL,     \
+                   ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
+  cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:          \
+                   ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,  \
+                   PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"
+  Printer Driver infotec_2105 successfully installed.
+  
+  Running command: rpcclient localhost -N -U'root%secret'                                  \
+                             -c 'setdriver infotec_2105 infotec_2105'
+  cmd = setdriver infotec_2105 infotec_2105
+  Successfully set infotec_2105 to driver infotec_2105.
+
+

    +If you look closely, you'll discover your root password was transfered +unencrypted over the wire, so beware! Also, if you look further her, +you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in +between. They occur, because the directories WIN40 and W32X86 already +existed in the [print$] driver download share +(from a previous driver installation). They are harmless here. +

    Understanding cupsaddsmb

    +What has happened? What did cupsaddsmb do? There are five stages of +the procedure +

    1. call the CUPS server via IPP and request the +driver files and the PPD file for the named printer;

    2. store the files temporarily in the local +TEMPDIR (as defined in +cupsd.conf);

    3. connect via smbclient to the Samba server's + [print$] share and put the files into the + share's WIN40 (for Win95/98/ME) and W32X86/ (for WinNT/2k/XP) sub + directories;

    4. connect via rpcclient to the Samba server and +execute the "adddriver" command with the correct +parameters;

    5. connect via rpcclient to the Samba server a second +time and execute the "setdriver" command.

    +Note, that you can run the cupsaddsmb utility with parameters to +specify one remote host as Samba host and a second remote host as CUPS +host. Especially if you want to get a deeper understanding, it is a +good idea try it and see more clearly what is going on (though in real +life most people will have their CUPS and Samba servers run on the +same host): +

    +
+ # cupsaddsmb -H sambaserver -h cupsserver -v printername
+
+

    How to recognize if cupsaddsm completed successfully

    +You must always check if the utility completed +successfully in all fields. You need as a minimum these 3 messages +amongst the output: +

    1. Printer Driver infotec_2105 successfully +installed. # (for the W32X86 == WinNT/2K/XP +architecture...)

    2. Printer Driver infotec_2105 successfully +installed. # (for the WIN40 == Win9x/ME +architecture...)

    3. Successfully set [printerXPZ] to driver +[printerXYZ].

    +These messages probably not easily recognized in the general +output. If you run cupsaddsmb with the -a +parameter (which tries to prepare all active CUPS +printer drivers for download), you might miss if individual printers +drivers had problems to install properly. Here a redirection of the +output will help you analyze the results in retrospective. +

    Note

    +It is impossible to see any diagnostic output if you don't run +cupsaddsmb in verbose mode. Therefore we strongly recommend to not +use the default quiet mode. It will hide any problems from you which +might occur. +

    cupsaddsmb with a Samba PDC

    +You can't get the standard cupsaddsmb command to run on a Samba PDC? +You are asked for the password credential all over again and again and +the command just will not take off at all? Try one of these +variations: +

    +
+ # cupsaddsmb -U DOMAINNAME\\root -v printername
+ # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -v printername
+ # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -h cups-server -v printername
+
+

    +(Note the two backslashes: the first one is required to +"escape" the second one). +

    cupsaddsmb Flowchart

    +Here is a chart about the procedures, commandflows and +dataflows of the "cupaddsmb" command. Note again: cupsaddsmb is +not intended to, and does not work with, "raw" queues! +

    +

    Figure 19.14. cupsaddsmb flowchart

    cupsaddsmb flowchart

    +

    Installing the PostScript Driver on a Client

    +After cupsaddsmb completed, your driver is prepared for the clients to +use. Here are the steps you must perform to download and install it +via "Point'n'Print". From a Windows client, browse to the CUPS/Samba +server; +

    • open the Printers +share of Samba in Network Neighbourhood;

    • right-click on the printer in +question;

    • from the opening context-menu select +Install... or +Connect... (depending on the Windows version you +use).

    +After a few seconds, there should be a new printer in your +client's local "Printers" folder: On Windows +XP it will follow a naming convention of PrinterName on +SambaServer. (In my current case it is "infotec_2105 on +kde-bitshop"). If you want to test it and send your first job from +an application like Winword, the new printer will appears in a +\\SambaServer\PrinterName entry in the +dropdown list of available printers. +

    Note

    +cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher +and Samba from 2.2.4. If it doesn't work, or if the automatic printer +driver download to the clients doesn't succeed, you can still manually +install the CUPS printer PPD on top of the Adobe PostScript driver on +clients. Then point the client's printer queue to the Samba printer +share for a UNC type of connection: +

    +
+  net use lpt1: \\sambaserver\printershare /user:ntadmin
+
+

    +should you desire to use the CUPS networked PostScript RIP +functions. (Note that user "ntadmin" needs to be a valid Samba user +with the required privileges to access the printershare) This would +set up the printer connection in the traditional +LanMan way (not using MS-RPC). +

    Avoiding critical PostScript Driver Settings on the +Client

    +Soooo: printing works, but there are still problems. Most jobs print +well, some don't print at all. Some jobs have problems with fonts, +which don't look very good. Some jobs print fast, and some are +dead-slow. Many of these problems can be greatly reduced or even +completely eliminated if you follow a few guidelines. Remember, if +your print device is not PostScript-enabled, you are treating your +Ghostscript installation on your CUPS host with the output your client +driver settings produce. Treat it well: +

    • Avoid the PostScript Output Option: Optimize +for Speed setting. Rather use the Optimize for +Portability instead (Adobe PostScript +driver).

    • Don't use the Page Independence: +NO setting. Instead use Page Independence +YES (CUPS PostScript Driver)

    • Recommended is the True Type Font +Downloading Option: Native True Type over +Automatic and Outline; you +should by all means avoid Bitmap (Adobe +PostScript Driver)

    • Choose True Type Font: Download as Softfont +into Printer over the default Replace by Device +Font (for exotic fonts you may need to change it back to +get a printout at all) (Adobe)

    • Sometimes you can choose PostScript Language +Level: in case of problems try 2 +instead of 3 (the latest ESP Ghostscript package +handles Level 3 PostScript very well) (Adobe).

    • Say Yes to PostScript +Error Handler (Adobe)

    Installing PostScript Driver Files manually (using +rpcclient)

    +Of course you can run all the commands which are embedded into the +cupsaddsmb convenience utility yourself, one by one, and hereby upload +and prepare the driver files for future client downloads. +

    1. prepare Samba (a CUPS printqueue with the name of the +printer should be there. We are providing the driver +now);

    2. copy all files to +[print$]:

    3. run rpcclient adddriver +(for each client architecture you want to support):

    4. run rpcclient +setdriver.

    +We are going to do this now. First, read the man page on "rpcclient" +to get a first idea. Look at all the printing related +sub-commands. enumprinters, +enumdrivers, enumports, +adddriver, setdriver are amongst +the most interesting ones. rpcclient implements an important part of +the MS-RPC protocol. You can use it to query (and command) a Win NT +(or 2K/XP) PC too. MS-RPC is used by Windows clients, amongst other +things, to benefit from the "Point'n'Print" features. Samba can now +mimic this too. +

    A Check of the rpcclient man Page

    +First let's have a little check of the rpcclient man page. Here are +two relevant passages: +

    +adddriver <arch> <config> Execute an +AddPrinterDriver() RPC to install the printer driver information on +the server. Note that the driver files should already exist in the +directory returned by getdriverdir. Possible +values for arch are the same as those for the +getdriverdir command. The +config parameter is defined as follows: +

    +Long Printer Name:\
+Driver File Name:\
+Data File Name:\
+Config File Name:\
+Help File Name:\
+Language Monitor Name:\
+Default Data Type:\
+Comma Separated list of Files
+

    Any empty fields should be enter as the string "NULL".

    Samba does not need to support the concept of Print Monitors +since these only apply to local printers whose driver can make use of +a bi-directional link for communication. This field should be "NULL". +On a remote NT print server, the Print Monitor for a driver must +already be installed prior to adding the driver or else the RPC will +fail +

    +setdriver <printername> <drivername> +Execute a SetPrinter() command to update the +printer driver associated with an installed printer. The printer +driver must already be correctly installed on the print server. +

    See also the enumprinters and enumdrivers commands for +obtaining a list of installed printers and drivers. +

    Understanding the rpcclient man Page

    +The exact format isn't made too clear by the man +page, since you have to deal with some parameters containing +spaces. Here is a better description for it. We have line-broken the +command and indicated the breaks with "\". Usually you would type the +command in one line without the linebreaks: +

    +
+ adddriver "Architecture" \
+           "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\
+           LanguageMonitorFile:DataType:ListOfFiles,Comma-separated"
+
+

    +What the man pages denotes as a simple <config> +keyword, does in reality consist of 8 colon-separated fields. The +last field may take multiple (in some, very insane, cases, even +20 different additional files. This might sound confusing at first. +Note, that what the man pages names the "LongPrinterName" in +reality should rather be called the "Driver Name". You can name it +anything you want, as long as you use this name later in the +rpcclient ... setdriver command. For +practical reasons, many name the driver the same as the +printer. +

    +True: it isn't simple at all. I hear you asking: +How do I know which files are "Driver +File", "Data File", "Config File", "Help File" and "Language +Monitor File" in each case? -- For an answer you may +want to have a look at how a Windows NT box with a shared printer +presents the files to us. Remember, that this whole procedure has +to be developed by the Samba Team by overhearing the traffic caused +by Windows computers on the wire. We may as well turn to a Windows +box now, and access it from a UNIX workstation. We will query it +with rpcclient to see what it tells us and +try to understand the man page more clearly which we've read just +now. +

    Producing an Example by querying a Windows Box

    +We could run rpcclient with a +getdriver or a getprinter +subcommand (in level 3 verbosity) against it. Just sit down at UNIX or +Linux workstation with the Samba utilities installed. Then type the +following command: +

    +
+ rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3'
+
+

    +From the result it should become clear which is which. Here is an +example from my installation: +

    +
+# rpcclient -U'Danka%xxxx' W2KSERVER -c'getdriver "DANKA InfoStream Virtual Printer" 3'
+ cmd = getdriver "DANKA InfoStream Virtual Printer" 3
+
+ [Windows NT x86]
+ Printer Driver Info 3:
+         Version: [2]
+         Driver Name: [DANKA InfoStream]
+         Architecture: [Windows NT x86]
+         Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRIPT.DLL]
+         Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\INFOSTRM.PPD]
+         Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRPTUI.DLL]
+         Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRIPT.HLP]
+ 
+         Dependentfiles: []
+         Dependentfiles: []
+         Dependentfiles: []
+         Dependentfiles: []
+         Dependentfiles: []
+         Dependentfiles: []
+         Dependentfiles: []
+ 
+         Monitorname: []
+         Defaultdatatype: []
+
+

    +Some printer drivers list additional files under the label +"Dependentfiles": these would go into the last field +ListOfFiles,Comma-separated. For the CUPS +PostScript drivers we don't need any (nor would we for the Adobe +PostScript driver): therefore the field will get a "NULL" entry. +

    What is required for adddriver and setdriver to succeed

    +From the manpage (and from the quoted output +of cupsaddsmb, above) it becomes clear that you +need to have certain conditions in order to make the manual uploading +and initializing of the driver files succeed. The two rpcclient +subcommands (adddriver and +setdriver) need to encounter the following +pre-conditions to complete successfully: +

    • you are connected as "printer admin", or root (note, +that this is not the "Printer Operators" group in +NT, but the printer admin group, as defined in +the [global] section of +smb.conf);

    • copy all required driver files to +\\sambaserver\print$\w32x86 and +\\sambaserver\print$\win40 as appropriate. They +will end up in the "0" respective "2" subdirectories later -- for now +don't put them there, they'll be automatically +used by the adddriver subcommand.! (if you use +"smbclient" to put the driver files into the share, note that you need +to escape the "$": smbclient //sambaserver/print\$ -U +root);

    • the user you're connecting as must be able to write to +the [print$] share and create +subdirectories;

    • the printer you are going to setup for the Windows +clients, needs to be installed in CUPS already;

    • the CUPS printer must be known to Samba, otherwise the +setdriver subcommand fails with an +NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by +Samba you may use the enumprinters subcommand to +rpcclient. A long-standing bug prevented a proper update of the +printer list until every smbd process had received a SIGHUP or was +restarted. Remember this in case you've created the CUPS printer just +shortly ago and encounter problems: try restarting +Samba.

    Manual Commandline Driver Installation in 15 little Steps

    +We are going to install a printer driver now by manually executing all +required commands. As this may seem a rather complicated process at +first, we go through the procedure step by step, explaining every +single action item as it comes up. +

    First Step: Install the Printer on CUPS

    +
+# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P /home/kurt/canonIR85.ppd
+
+

    +This installs printer with the name mysmbtstprn +to the CUPS system. The printer is accessed via a socket +(a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root +for this step +

    Second Step (optional): Check if the Printer is recognized by +Samba

    +
+ # rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn
+
+        flags:[0x800000]
+        name:[\\kde-bitshop\mysmbtstprn]
+        description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn]
+        comment:[mysmbtstprn]
+
+

    +This should show the printer in the list. If not, stop and re-start +the Samba daemon (smbd), or send a HUP signal: kill -HUP +`pidof smbd`. Check again. Troubleshoot and repeat until +success. Note the "empty" field between the two commas in the +"description" line. Here would the driver name appear if there was one +already. You need to know root's Samba password (as set by the +smbpasswd command) for this step and most of the +following steps. Alternatively you can authenticate as one of the +users from the "write list" as defined in smb.conf for +[print$]. +

    Third Step (optional): Check if Samba knows a Driver for the +Printer

    +
+#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
+         drivername:[]
+ 
+#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv
+        servername:[\\kde-bitshop]
+        printername:[\\kde-bitshop\mysmbtstprn]
+        sharename:[mysmbtstprn]
+        portname:[Samba Printer Port]
+        drivername:[]
+        comment:[mysmbtstprn]
+        location:[]
+        sepfile:[]
+        printprocessor:[winprint]
+ 
+#  rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
+ result was WERR_UNKNOWN_PRINTER_DRIVER
+
+

    +Neither method of the three commands shown above should show a driver. +This step was done for the purpose of demonstrating this condition. An +attempt to connect to the printer at this stage will prompt the +message along the lines: "The server has not the required printer +driver installed". +

    Fourth Step: Put all required Driver Files into Samba's +[print$]

    +
+#  smbclient //localhost/print\$ -U 'root%xxxx'                        \ 
+                              -c 'cd W32X86;                                             \
+                                  put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD;     \
+                                  put /usr/share/cups/drivers/cupsui.dll cupsui.dll;     \
+                                  put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \
+                                  put /usr/share/cups/drivers/cups.hlp cups.hlp'
+
+

    +(Note that this command should be entered in one long single +line. Line-breaks and the line-end indicating "\" has been inserted +for readability reasons.) This step is required +for the next one to succeed. It makes the driver files physically +present in the [print$] share. However, clients +would still not be able to install them, because Samba does not yet +treat them as driver files. A client asking for the driver would still +be presented with a "not installed here" message. +

    Fifth Step: Verify where the Driver Files are now

    +
+#  ls -l /etc/samba/drivers/W32X86/
+ total 669
+ drwxr-sr-x    2 root     ntadmin       532 May 25 23:08 2
+ drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
+ -rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
+ -rwxr--r--    1 root     ntadmin    278380 May 25 23:21 cupsdrvr.dll
+ -rwxr--r--    1 root     ntadmin    215848 May 25 23:21 cupsui.dll
+ -rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
+
+

    +The driver files now are in the W32X86 architecture "root" of +[print$]. +

    Sixth Step: Tell Samba that these are +Driver Files +(adddriver)

    +
+#  rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \
+                                          cupsdrvr.dll:mysmbtstprn.PPD:                  \
+                                          cupsui.dll:cups.hlp:NULL:RAW[:]NULL"             \
+                                          localhost
+
+ Printer Driver mydrivername successfully installed.
+
+

    +Note that your cannot repeat this step if it fails. It could fail even +as a result of a simple typo. It will most likely have moved a part of +the driver files into the "2" subdirectory. If this step fails, you +need to go back to the fourth step and repeat it, before you can try +this one again. In this step you need to choose a name for your +driver. It is normally a good idea to use the same name as is used for +the printername; however, in big installations you may use this driver +for a number of printers which have obviously different names. So the +name of the driver is not fixed. +

    Seventh Step: Verify where the Driver Files are now

    +
+#  ls -l /etc/samba/drivers/W32X86/
+ total 1
+ drwxr-sr-x    2 root     ntadmin       532 May 25 23:22 2
+ drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
+
+ 
+#  ls -l /etc/samba/drivers/W32X86/2
+ total 5039
+ [....]
+ -rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
+ -rwxr--r--    1 root     ntadmin    278380 May 13 13:53 cupsdrvr.dll
+ -rwxr--r--    1 root     ntadmin    215848 May 13 13:53 cupsui.dll
+ -rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
+
+

    +Notice how step 6 did also move the driver files to the appropriate +subdirectory. Compare with the situation after step 5. +

    Eighth Step (optional): Verify if Samba now recognizes the +Driver

    +
+#  rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost | grep -B2 -A5 mydrivername
+
+ Printer Driver Info 3:
+        Version: [2]
+        Driver Name: [mydrivername]
+        Architecture: [Windows NT x86]
+        Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
+        Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
+        Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
+        Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
+
+

    +Remember, this command greps for the name you did choose for the +driver in step Six. This command must succeed before you can proceed. +

    Ninth Step: Tell Samba which Printer should use these Driver +Files (setdriver)

    +
+#  rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost
+ 
+ Successfully set mysmbtstprn to driver mydrivername
+
+

    +Since you can bind any printername (=printqueue) to any driver, this +is a very convenient way to setup many queues which use the same +driver. You don't need to repeat all the previous steps for the +setdriver command to succeed. The only pre-conditions are: +enumdrivers must find the driver and +enumprinters must find the printer. +

    Tenth Step (optional): Verify if Samba has this Association +recognized

    +
+#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
+       drivername:[mydrivername]
+ 
+#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv
+       servername:[\\kde-bitshop]
+       printername:[\\kde-bitshop\mysmbtstprn]
+       sharename:[mysmbtstprn]
+       portname:[Done]
+       drivername:[mydrivername]
+       comment:[mysmbtstprn]
+       location:[]
+       sepfile:[]
+       printprocessor:[winprint]
+ 
+#  rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
+ [Windows NT x86]
+ Printer Driver Info 3:
+       Version: [2]
+       Driver Name: [mydrivername]
+       Architecture: [Windows NT x86]
+       Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
+       Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
+       Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
+       Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
+       Monitorname: []
+       Defaultdatatype: [RAW]
+       Monitorname: []
+       Defaultdatatype: [RAW]
+ 
+#  rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn
+       name:[\\kde-bitshop\mysmbtstprn]
+       description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn]
+       comment:[mysmbtstprn]
+
+

    +Compare these results with the ones from steps 2 and 3. Note that +every single of these commands show the driver is installed. Even +the enumprinters command now lists the driver +on the "description" line. +

    Eleventh Step (optional): Tickle the Driver into a correct +Device Mode

    +You certainly know how to install the driver on the client. In case +you are not particularly familiar with Windows, here is a short +recipe: browse the Network Neighbourhood, go to the Samba server, look +for the shares. You should see all shared Samba printers. +Double-click on the one in question. The driver should get +installed, and the network connection set up. An alternative way is to +open the "Printers (and Faxes)" folder, right-click on the printer in +question and select "Connect" or "Install". As a result, a new printer +should have appeared in your client's local "Printers (and Faxes)" +folder, named something like "printersharename on Sambahostname". +

    +It is important that you execute this step as a Samba printer admin +(as defined in smb.conf). Here is another method +to do this on Windows XP. It uses a commandline, which you may type +into the "DOS box" (type root's smbpassword when prompted): +

    +
+ C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n \\sambacupsserver\mysmbtstprn"
+
+

    +Change any printer setting once (like "portrait" +--> "landscape"), click "Apply"; change the setting +back. +

    Twelfth Step: Install the Printer on a Client +("Point'n'Print")

    +
+ C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn"
+
+

    +If it doesn't work it could be a permission problem with the +[print$] share. +

    Thirteenth Step (optional): Print a Test Page

    +
+ C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn"
+
+

    +Then hit [TAB] 5 times, [ENTER] twice, [TAB] once and [ENTER] again +and march to the printer. +

    Fourteenth Step (recommended): Study the Test Page

    +Hmmm.... just kidding! By now you know everything about printer +installations and you don't need to read a word. Just put it in a +frame and bolt it to the wall with the heading "MY FIRST +RPCCLIENT-INSTALLED PRINTER" - why not just throw it away! +

    Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your +Success

    +
+# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd     
+
+

    Troubleshooting revisited

    +The setdriver command will fail, if in Samba's mind the queue is not +already there. You had promising messages about the: +

    +
+ Printer Driver ABC successfully installed.
+
+

    +after the "adddriver" parts of the procedure? But you are also seeing +a disappointing message like this one beneath? +

    +
+ result was NT_STATUS_UNSUCCESSFUL
+
+

    +It is not good enough that you +can see the queue in CUPS, using +the lpstat -p ir85wm command. A +bug in most recent versions of Samba prevents the proper update of +the queuelist. The recognition of newly installed CUPS printers +fails unless you re-start Samba or send a HUP to all smbd +processes. To verify if this is the reason why Samba doesn't +execute the setdriver command successfully, check if Samba "sees" +the printer: +

    +
+# rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep  ir85wm
+        printername:[ir85wm]
+
+

    +An alternative command could be this: +

    +
+# rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' 
+        cmd = getprinter ir85wm
+        flags:[0x800000]
+        name:[\\transmeta\ir85wm]
+        description:[\\transmeta\ir85wm,ir85wm,DPD]
+        comment:[CUPS PostScript-Treiber for WinNT/2K/XP]
+
+

    +BTW, you can use these commands, plus a few more, of course, +to install drivers on remote Windows NT print servers too! +

    The printing *.tdb Files

    +Some mystery is associated with the series of files with a +tdb-suffix appearing in every Samba installation. They are +connections.tdb, +printing.tdb, +share_info.tdb , +ntdrivers.tdb, +unexpected.tdb, +brlock.tdb , +locking.tdb, +ntforms.tdb, +messages.tdb , +ntprinters.tdb, +sessionid.tdb and +secrets.tdb. What is their purpose? +

    Trivial DataBase Files

    +A Windows NT (Print) Server keeps track of all information needed to serve +its duty toward its clients by storing entries in the Windows +"Registry". Client queries are answered by reading from the registry, +Administrator or user configuration settings are saved by writing into +the Registry. Samba and Unix obviously don't have such a kind of +Registry. Samba instead keeps track of all client related information in a +series of *.tdb files. (TDB = Trivial Data +Base). These are often located in /var/lib/samba/ +or /var/lock/samba/ . The printing related files +are ntprinters.tdb, +printing.tdb,ntforms.tdb and +ntdrivers.tdb. +

    Binary Format

    +*.tdb files are not human readable. They are +written in a binary format. "Why not ASCII?", you may ask. "After all, +ASCII configuration files are a good and proofed tradition on UNIX." +-- The reason for this design decision by the Samba Team is mainly +performance. Samba needs to be fast; it runs a separate +smbd process for each client connection, in some +environments many thousand of them. Some of these smbds might need to +write-access the same *.tdb file at the +same time. The file format of Samba's +*.tdb files allows for this provision. Many smbd +processes may write to the same *.tdb file at the +same time. This wouldn't be possible with pure ASCII files. +

    Losing *.tdb Files

    +It is very important that all *.tdb files remain +consistent over all write and read accesses. However, it may happen +that these files do get corrupted. (A +kill -9 `pidof smbd` while a write access is in +progress could do the damage as well as a power interruption, +etc.). In cases of trouble, a deletion of the old printing-related +*.tdb files may be the only option. You need to +re-create all print related setup after that. Or you have made a +backup of the *.tdb files in time. +

    Using tdbbackup

    +Samba ships with a little utility which helps the root user of your +system to back up your *.tdb files. If you run it +with no argument, it prints a little usage message: +

    +
+# tdbbackup
+ Usage: tdbbackup [options] <fname...>
+ 
+ Version:3.0a
+   -h            this help message
+   -s suffix     set the backup suffix
+   -v            verify mode (restore if corrupt)
+
+

    +Here is how I backed up my printing.tdb file: +

    +
+# ls 
+ .           browse.dat       locking.tdb     ntdrivers.tdb   printing.tdb    share_info.tdb
+ ..          connections.tdb  messages.tdb    ntforms.tdb     printing.tdbkp  unexpected.tdb
+ brlock.tdb  gmon.out         namelist.debug  ntprinters.tdb  sessionid.tdb
+ 
+ kde-bitshop:/var/lock/samba # tdbbackup -s .bak printing.tdb
+ printing.tdb : 135 records
+ 
+ kde-bitshop:/var/lock/samba # ls -l printing.tdb*
+ -rw-------    1 root     root        40960 May  2 03:44 printing.tdb
+ -rw-------    1 root     root        40960 May  2 03:44 printing.tdb.bak
+
+

    CUPS Print Drivers from Linuxprinting.org

    +CUPS ships with good support for HP LaserJet type printers. You can +install the generic driver as follows: +

    +
+lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
+
+

    +The -m switch will retrieve the +laserjet.ppd from the standard repository for +not-yet-installed-PPDs, which CUPS typically stores in +/usr/share/cups/model. Alternatively, you may use +-P /path/to/your.ppd. +

    +The generic laserjet.ppd however does not support every special option +for every LaserJet-compatible model. It constitutes a sort of "least +denominator" of all the models. If for some reason it is ruled out to +you to pay for the commercially available ESP Print Pro drivers, your +first move should be to consult the database on http://www.linuxprinting.org/printer_list.cgi. +Linuxprinting.org has excellent recommendations about which driver is +best used for each printer. Its database is kept current by the +tireless work of Till Kamppeter from MandrakeSoft, who is also the +principal author of the foomatic-rip utility.

    Note

    -A printer queue with *no* PPD associated to it is a "raw" printer and all files -will go directly there as received by the spooler. The exeptions are file types -"application/octet-stream" which need "passthrough feature" enabled. -"Raw" queues don't do any filtering at all, they hand the file directly to the -CUPS backend. This backend is responsible for the sending of the data to the device -(as in the "device URI" notation as lpd://, socket://, smb://, ipp://, http://, -parallel:/, serial:/, usb:/ etc.) -

    Note

    -"cupsomatic"/Foomatic are *not* native CUPS drivers and they don't ship with CUPS. -They are a Third Party add-on, developed at Linuxprinting.org. As such, they are -a brilliant hack to make all models (driven by Ghostscript drivers/filters in -traditional spoolers) also work via CUPS, with the same (good or bad!) quality -as in these other spoolers. "cupsomatic" is only a vehicle to execute a ghostscript -commandline at that stage in the CUPS filtering chain, where "normally" the native -CUPS "pstoraster" filter would kick in. cupsomatic by-passes pstoraster, "kidnaps" -the printfile from CUPS away and re-directs it to go through Ghostscipt. CUPS accepts this, +The former "cupsomatic" concept is now be replaced by the new, much +more powerful "foomatic-rip". foomatic-rip is the successor of +cupsomatic. cupsomatic is no longer maintained. Here is the new URL +to the Foomatic-3.0 database:http://www.linuxprinting.org/driver_list.cgi. +If you upgrade to foomatic-rip, don't forget to also upgrade to the +new-style PPDs for your foomatic-driven printers. foomatic-rip will +not work with PPDs generated for the old cupsomatic. The new-style +PPDs are 100% compliant to the Adobe PPD specification. They are +intended to be used by Samba and the cupsaddsmb utility also, to +provide the driver files for the Windows clients also! +

    foomatic-rip and Foomatic explained

    +Nowadays most Linux distros rely on the utilities of Linuxprinting.org +to create their printing related software (which, BTW, works on all +UNIXes and on Mac OS X or Darwin too). It is not known as well as it +should be, that it also has a very end-user friendly interface which +allows for an easy update of drivers and PPDs, for all supported +models, all spoolers, all operating systems and all package formats +(because there is none). Its history goes back a few years. +

    +Recently Foomatic has achieved the astonishing milestone of 1000 +listed printer models. Linuxprinting.org keeps all the +important facts about printer drivers, supported models and which +options are available for the various driver/printer combinations in +its Foomatic +database. Currently there are 245 drivers +in the database: many drivers support various models, and many models +may be driven by different drivers; it's your choice! +

    690 "perfect" Printers

    +At present there are 690 devices dubbed as working "perfectly", 181 +"mostly", 96 "partially" and 46 are "Paperweights". Keeping in mind +that most of these are non-PostScript models (PostScript printers are +automatically supported supported by CUPS to perfection, by using +their own manufacturer-provided Windows-PPD...), and that a +multifunctional device never qualifies as working "perfectly" if it +doesn't also scan and copy and fax under GNU/Linux: then this is a +truly astonishing achievement. Three years ago the number was not +more than 500, and Linux or UNIX "printing" at the time wasn't +anywhere near the quality it is today! +

    How the "Printing HOWTO" started it all

    +A few years ago Grant Taylor +started it all. The roots of today's Linuxprinting.org are in the +first Linux Printing +HOWTO which he authored. As a side-project to this document, +which served many Linux users and admins to guide their first steps in +this complicated and delicate setup (to a scientist, printing is +"applying a structured deposition of distinct patterns of ink or toner +particles on paper substrates" ;-), he started to +build in a little Postgres database with information about the +hardware and driver zoo that made up Linux printing of the time. This +database became the core component of today's Foomatic collection of +tools and data. In the meantime it has moved to an XML representation +of the data. +

    Foomatic's strange Name

    +"Why the funny name?", you ask. When it really took off, around spring +2000, CUPS was far less popular than today, and most systems used LPD, +LPRng or even PDQ to print. CUPS shipped with a few generic "drivers" +(good for a few hundred different printer models). These didn't +support many device-specific options. CUPS also shipped with its own +built-in rasterization filter ("pstoraster", derived from +Ghostscript). On the other hand, CUPS provided brilliant support for +controlling all printer options through +standardized and well-defined "PPD files" (PostScript Printers +Description files). Plus, CUPS was designed to be easily extensible. +

    +Grant already had in his database a respectable compilation +of facts about a many more printers, and the Ghostscript "drivers" +they run with. His idea, to generate PPDs from the database info +and use them to make standard Ghostscript filters work within CUPS, +proved to work very well. It also "killed several birds with one +stone": +

    • It made all current and future Ghostscript filter +developments available for CUPS;

    • It made available a lot of additional printer models +to CUPS users (because often the "traditional" Ghostscript way of +printing was the only one available);

    • It gave all the advanced CUPS options (web interface, +GUI driver configurations) to users wanting (or needing) to use +Ghostscript filters.

    cupsomatic, pdqomatic, lpdomatic, directomatic

    +CUPS worked through a quickly-hacked up filter script named cupsomatic. +cupsomatic ran the printfile through Ghostscript, constructing +automatically the rather complicated command line needed. It just +required to be copied into the CUPS system to make it work. To +"configure" the way cupsomatic controls the Ghostscript rendering +process, it needs a CUPS-PPD. This PPD is generated directly from the +contents of the database. For CUPS and the respective printer/filter +combo another Perl script named "CUPS-O-Matic" did the PPD +generation. After that was working, Grant implemented within a few +days a similar thing for two other spoolers. Names chosen for the +config-generator scripts were PDQ-O-Matic +(for PDQ) and LPD-O-Matic +(for - you guessed it - LPD); the configuration here didn't use PPDs +but other spooler-specific files. +

    +From late summer of that year, Till Kamppeter +started to put work into the database. Till had been newly employed by +MandrakeSoft to +convert their printing system over to CUPS, after they had seen his +FLTK-based XPP (a GUI frontend to +the CUPS lp-command). He added a huge amount of new information and new +printers. He also developed the support for other spoolers, like +PPR (via ppromatic), +GNUlpr and +LPRng (both via an extended +lpdomatic) and "spoolerless" printing (directomatic).... +

    +So, to answer your question: "Foomatic" is the general name for all +the overlapping code and data behind the "*omatic" scripts.... -- +Foomatic up to versions 2.0.x required (ugly) Perl data structures +attached the Linuxprinting.org PPDs for CUPS. It had a different +"*omatic" script for every spooler, as well as different printer +configuration files.. +

    7.13.1.5.The Grand Unification +achieved...

    +This all has changed in Foomatic versions 2.9 (Beta) and released as +"stable" 3.0. This has now achieved the convergence of all *omatic +scripts: it is called the foomatic-rip. +This single script is the unification of the previously different +spooler-specific *omatic scripts. foomatic-rip is used by all the +different spoolers alike. Because foomatic-rip can read PPDs (both the +original PostScript printer PPDs and the Linuxprinting.org-generated +ones), all of a sudden all supported spoolers can have the power of +PPDs at their disposal; users only need to plug "foomatic-rip" into +their system.... For users there is improved media type and source +support; paper sizes and trays are easier to configure. +

    +Also, the New Generation of Linuxprinting.org PPDs doesn't contain +Perl data structures any more. If you are a distro maintainer and have +used the previous version of Foomatic, you may want to give the new +one a spin: but don't forget to generate a new-version set of PPDs, +via the new foomatic-db-engine! +Individual users just need to generate a single new PPD specific to +their model by following +the steps outlined in the Foomatic tutorial or further +below. This new development is truly amazing. +

    +foomatic-rip is a very clever wrapper around the need to run +Ghostscript with a different syntax, different options, different +device selections and/or different filters for each different printer +or different spooler. At the same time it can read the PPD associated +with a print queue and modify the print job according to the user +selections. Together with this comes the 100% compliance of the new +Foomatic PPDs with the Adobe spec. Some really innovative features of +the Foomatic concept will surprise users: it will support custom paper +sizes for many printers; and it will support printing on media drawn +from different paper trays within the same job (in both cases: even +where there is no support for this from Windows-based vendor printer +drivers). +

    Driver Development outside

    +Most driver development itself does not happen within +Linuxprinting.org. Drivers are written by independent maintainers. +Linuxprinting.org just pools all the information, and stores it in its +database. In addition, it also provides the Foomatic glue to integrate +the many drivers into any modern (or legacy) printing system known to +the world. +

    +Speaking of the different driver development groups: most of +the work is currently done in three projects. These are: +

    • Omni +-- a Free Software project by IBM which tries to convert their printer +driver knowledge from good-ol' OS/2 times into a modern, modular, +universal driver architecture for Linux/Unix (still Beta). This +currently supports 437 models.

    • HPIJS -- +a Free Software project by HP to provide the support for their own +range of models (very mature, printing in most cases is perfect and +provides true photo quality). This currently supports 369 +models.

    • Gimp-Print -- a Free software +effort, started by Michael Sweet (also lead developer for CUPS), now +directed by Robert Krawitz, which has achieved an amazing level of +photo print quality (many Epson users swear that its quality is +better than the vendor drivers provided by Epson for the Microsoft +platforms). This currently supports 522 models.

    Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and +commercial Unix

    +Linuxprinting.org today is the one-stop "shop" to download printer +drivers. Look for printer information and tutorials +or solve printing problems in its popular forums. But +it's not just for GNU/Linux: users and admins of commercial UNIX +systems are also going there, and the relatively new Mac +OS X forum has turned out to be one of the most frequented +fora after only a few weeks. +

    +Linuxprinting.org and the Foomatic driver wrappers around Ghostscript +are now a standard toolchain for printing on all the important +distros. Most of them also have CUPS underneath. While in recent years +most printer data had been added by Till (who works at Mandrake), many +additional contributions came from engineers with SuSE, RedHat, +Connectiva, Debian and others. Vendor-neutrality is an important goal +of the Foomatic project. +

    Note

    +Till Kamppeter from MandrakeSoft is doing an excellent job in his +spare time to maintain Linuxprinting.org and Foomatic. So if you use +it often, please send him a note showing your appreciation. +

    Foomatic Database generated PPDs

    +The Foomatic database is an amazing piece of ingenuity in itself. Not +only does it keep the printer and driver information, but it is +organized in a way that it can generate "PPD" files "on the fly" from +its internal XML-based datasets. While these PPDs are modelled to the +Adobe specification of "PostScript Printer Descriptions" (PPDs), the +Linuxprinting.org/Foomatic-PPDs don't normally drive PostScript +printers: they are used to describe all the bells and whistles you +could ring or blow on an Epson Stylus inkjet, or a HP Photosmart or +what-have-you. The main "trick" is one little additional line, not +envisaged by the PPD specification, starting with the "*cupsFilter" +keyword: it tells the CUPS daemon how to proceed with the PostScript +print file (old-style Foomatic-PPDs named the +cupsomatic filter script, while the new-style +PPDs now call foomatic-rip). This filter +script calls Ghostscript on the host system (the recommended variant +is ESP Ghostscript) to do the rendering work. foomatic-rip knows which +filter or internal device setting it should ask from Ghostscript to +convert the PostScript printjob into a raster format ready for the +target device. This usage of PPDs to describe the options of non-PS +printers was the invention of the CUPS developers. The rest is easy: +GUI tools (like KDE's marvellous "kprinter", +or the GNOME "gtklp", "xpp" and the CUPS +web interface) read the PPD too and use this information to present +the available settings to the user as an intuitive menu selection. +

    foomatic-rip and Foomatic-PPD Download and Installation

    +Here are the steps to install a foomatic-rip driven "LaserJet 4 Plus" +compatible printer in CUPS (note that recent distributions of SuSE, +UnitedLinux and Mandrake may ship with a complete package of +Foomatic-PPDs plus the foomatic-rip utility. going directly to +Linuxprinting.org ensures you to get the latest driver/PPD files): +

    • Surf to http://www.linuxprinting.org/printer_list.cgi +

    • Check the complete list of printers in the database: +http://www.linuxprinting.org/printer_list.cgi?make=Anyone +

    • There select your model and click on the +link.

    • You'll arrive at a page listing all drivers working +with this model (for all printers, there will always be +one recommended driver. Try this one +first).

    • In our case ("HP LaserJet 4 Plus"), we'll arrive here: +http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus +

    • The recommended driver is "ljet4".

    • There are several links provided here. You should +visit them all, if you are not familiar with the Linuxprinting.org +database.

    • There is a link to the database page for the "ljet4": +http://www.linuxprinting.org/show_driver.cgi?driver=ljet4 +On the driver's page, you'll find important and detailed information +about how to use that driver within the various available +spoolers.

    • Another link may lead you to the homepage of the +driver author or the driver.

    • Important links are the ones which provide hints with +setup instructions for CUPS (http://www.linuxprinting.org/cups-doc.html), +PDQ (http://www.linuxprinting.org/pdq-doc.html), +LPD, LPRng and GNUlpr (http://www.linuxprinting.org/lpd-doc.html) +as well as PPR (http://www.linuxprinting.org/ppr-doc.html) +or "spooler-less" printing (http://www.linuxprinting.org/direct-doc.html +).

    • You can view the PPD in your browser through this +link: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1 +

    • You can also (most importantly) +generate and download the PPD: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=0 +

    • The PPD contains all the information needed to use our +model and the driver; this is, once installed, working transparently +for the user. Later you'll only need to choose resolution, paper size +etc. from the web-based menu, or from the print dialog GUI, or from +the commandline.

    • Should you have ended up on the driver's page (http://www.linuxprinting.org/show_driver.cgi?driver=ljet4), +you can choose to use the "PPD-O-Matic" online PPD generator +program.

    • Select the exact model and check either "download" or +"display PPD file" and click on "Generate PPD file".

    • If you save the PPD file from the browser view, please +don't use "cut'n'past" (since it could possibly damage line endings +and tabs, which makes the PPD likely to fail its duty), but use "Save +as..." in your browser's menu. (Best is to use the "download" option +from the web page directly).

    • Another very interesting part on each driver page is +the Show execution details button. If you +select your printer model and click that button, you will get +displayed a complete Ghostscript command line, enumerating all options +available for that driver/printermodel combo. This is a great way to +"Learn Ghostscript By Doing". It is also an excellent "cheat sheet" +for all experienced users who need to re-construct a good command line +for that damn printing script, but can't remember the exact +syntax. ;-)

    • Some time during your visit to Linuxprinting.org, save +the PPD to a suitable place on your harddisk, say +/path/to/my-printer.ppd (if you prefer to install +your printers with the help of the CUPS web interface, save the PPD to +the /usr/share/cups/model/ path and re-start +cupsd).

    • Then install the printer with a suitable commandline, +e.g.: +

      +
+lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd
+
+

    • Note again this: for all the new-style "Foomatic-PPDs" +from Linuxprinting.org, you also need a special "CUPS filter" named +"foomatic-rip".Get the latest version of "foomatic-rip" from: http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0 +

    • The foomatic-rip Perlscript itself also makes some +interesting reading (http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=1), +because it is very well documented by Till's inline comments (even +non-Perl hackers will learn quite a bit about printing by reading +it... ;-)

    • Save foomatic-rip either directly in +/usr/lib/cups/filter/foomatic-rip or somewhere in +your $PATH (and don't forget to make it world-executable). Again, +don't save by "copy'n'paste" but use the appropriate link, or the +"Save as..." menu item in your browser.

    • If you save foomatic-rip in your $PATH, create a symlink: +cd /usr/lib/cups/filter/ ; ln -s `which +foomatic-rip`. For CUPS to discover this new +available filter at startup, you need to re-start +cupsd.

    +Once you print to a printqueue set up with the Foomatic-PPD, CUPS will +insert the appropriate commands and comments into the resulting +PostScript jobfile. foomatic-rip is able to read and act upon +these. foomatic-rip uses some specially encoded Foomatic comments, +embedded in the jobfile. These in turn are used to construct +(transparently for you, the user) the complicated ghostscript command +line telling for the printer driver how exactly the resulting raster +data should look like and which printer commands to embed into the +data stream. +

    +You need: +

    • A "foomatic+something" PPD -- but it this not enough +to print with CUPS (it is only one important +component)

    • The "foomatic-rip" filter script (Perl) in +/usr/lib/cups/filters/

    • Perl to make foomatic-rip run

    • Ghostscript (because it is doing the main work, +controlled by the PPD/foomatic-rip combo) to produce the raster data +fit for your printermodel's consumption

    • Ghostscript must (depending on +the driver/model) contain support for a certain "device", representing +the selected "driver" for your model (as shown by "gs +-h")

    • foomatic-rip needs a new version of PPDs (PPD versions +produced for cupsomatic don't work with +foomatic-rip).

    Page Accounting with CUPS

    +Often there are questions regarding "print quotas" wherein Samba users +(that is, Windows clients) should not be able to print beyond a +certain amount of pages or data volume per day, week or month. This +feature is dependent on the real print subsystem you're using. +Samba's part is always to receive the job files from the clients +(filtered or unfiltered) and hand it over to this +printing subsystem. +

    +Of course one could "hack" things with one's own scripts. But then +there is CUPS. CUPS supports "quotas" which can be based on sizes of +jobs or on the number of pages or both, and are spanning any time +period you want. +

    Setting up Quotas

    +This is an example command how root would set a print quota in CUPS, +assuming an existing printer named "quotaprinter": +

    +
+  lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 -o job-page-limit=100
+
+

    +This would limit every single user to print 100 pages or 1024 KB of +data (whichever comes first) within the last 604,800 seconds ( = 1 +week). +

    Correct and incorrect Accounting

    +For CUPS to count correctly, the printfile needs to pass the CUPS +"pstops" filter, otherwise it uses a "dummy" count of "1". Some +printfiles don't pass it (eg: image files) but then those are mostly 1 +page jobs anyway. This also means that proprietary drivers for the +target printer running on the client computers and CUPS/Samba, which +then spool these files as "raw" (i.e. leaving them untouched, not +filtering them), will be counted as "1-pagers" too! +

    +You need to send PostScript from the clients (i.e. run a PostScript +driver there) to have the chance to get accounting done. If the +printer is a non-PostScript model, you need to let CUPS do the job to +convert the file to a print-ready format for the target printer. This +will be working for currently about 1,000 different printer models, +see http://www.linuxprinting.org/printer_list.cgi). +

    Adobe and CUPS PostScript Drivers for Windows Clients

    +Before CUPS-1.1.16 your only option was to use the Adobe PostScript +Driver on the Windows clients. The output of this driver was not +always passed through the "pstops" filter on the CUPS/Samba side, and +therefore was not counted correctly (the reason is that it often, +depending on the "PPD" being used, wrote a "PJL"-header in front of +the real PostScript which caused CUPS to skip pstops and go directly +to the "pstoraster" stage). +

    +From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver for +Windows NT/2K/XP clients" (which is tagged in the download area of +http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). It does +not work for Win9x/ME clients. But it guarantees: +

    • to not write an PJL-header

    • to still read and support all PJL-options named in the +driver PPD with its own means

    • that the file will pass through the "pstops" filter +on the CUPS/Samba server

    • to page-count correctly the +printfile

    +You can read more about the setup of this combination in the manpage +for "cupsaddsmb" (which is only present with CUPS installed, and only +current from CUPS 1.1.16). +

    The page_log File Syntax

    +These are the items CUPS logs in the "page_log" for every +single page of a job: +

    • Printer name

    • User name

    • Job ID

    • Time of printing

    • the page number

    • the number of copies

    • a billing information string +(optional)

    • the host which sent the job (included since version +1.1.19)

    +Here is an extract of my CUPS server's page_log file to illustrate the +format and included items: +

    +
+        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13
+        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13
+        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13
+        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13
+        DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33
+
+

    +This was job ID "401", printed on "infotec_IS2027" by user "kurt", a +64-page job printed in 3 copies and billed to "#marketing", sent +from IP address 10.160.50.13. The next job had ID "402", was sent by +user "boss" from IP address 10.160.51.33,printed from one page 440 +copies and is set to be billed to "finance-dep". +

    Possible Shortcomings

    +What flaws or shortcomings are there with this quota system? +

    • the ones named above (wrongly logged job in case of +printer hardware failure, etc.)

    • in reality, CUPS counts the job pages that are being +processed in software (that is, going through the +"RIP") rather than the physical sheets successfully leaving the +printing device. Thus if there is a jam while printing the 5th sheet out +of 1000 and the job is aborted by the printer, the "page count" will +still show the figure of 1000 for that job

    • all quotas are the same for all users (no flexibility +to give the boss a higher quota than the clerk) no support for +groups

    • no means to read out the current balance or the +"used-up" number of current quota

    • a user having used up 99 sheets of 100 quota will +still be able to send and print a 1,000 sheet job

    • a user being denied a job because of a filled-up quota +doesn't get a meaningful error message from CUPS other than +"client-error-not-possible".

    Future Developments

    +This is the best system currently available, and there are huge +improvements under development for CUPS 1.2: +

    • page counting will go into the "backends" (these talk +directly to the printer and will increase the count in sync with the +actual printing process: thus a jam at the 5th sheet will lead to a +stop in the counting)

    • quotas will be handled more flexibly

    • probably there will be support for users to inquire +their "accounts" in advance

    • probably there will be support for some other tools +around this topic

    Other Accounting Tools

    +PrintAnalyzer, pyKota, printbill, LogReport. +

    Additional Material

    +A printer queue with no PPD associated to it is a +"raw" printer and all files will go directly there as received by the +spooler. The exceptions are file types "application/octet-stream" +which need "passthrough feature" enabled. "Raw" queues don't do any +filtering at all, they hand the file directly to the CUPS backend. +This backend is responsible for the sending of the data to the device +(as in the "device URI" notation: lpd://, socket://, +smb://, ipp://, http://, parallel:/, serial:/, usb:/ etc.) +

    +"cupsomatic"/Foomatic are not native CUPS drivers +and they don't ship with CUPS. They are a Third Party add-on, +developed at Linuxprinting.org. As such, they are a brilliant hack to +make all models (driven by Ghostscript drivers/filters in traditional +spoolers) also work via CUPS, with the same (good or bad!) quality as +in these other spoolers. "cupsomatic" is only a vehicle to execute a +ghostscript commandline at that stage in the CUPS filtering chain, +where "normally" the native CUPS "pstoraster" filter would kick +in. cupsomatic by-passes pstoraster, "kidnaps" the printfile from CUPS +away and re-directs it to go through Ghostscript. CUPS accepts this, because the associated CUPS-O-Matic-/Foomatic-PPD specifies: -

    +
    +
    *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"
+
 
    
-This line persuades CUPS to hand the file to cupsomatic, once it has successfully
-converted it to the MIME type "application/vnd.cups-postscript". This conversion will not
-happen for Jobs arriving from Windows which are auto-typed "application/octet-stream",
-with the according changes in "/etc/cups/mime.types" in place.
-

    -CUPS is widely configurable and flexible, even regarding its filtering mechanism. -Another workaround in some situations would be to have -in "/etc/cups/mime.types" entries as follows: -

    +This line persuades CUPS to hand the file to cupsomatic, once it has
+successfully converted it to the MIME type
+"application/vnd.cups-postscript". This conversion will not happen for
+Jobs arriving from Windows which are auto-typed
+"application/octet-stream", with the according changes in
+/etc/cups/mime.types in place.
+
    
+CUPS is widely configurable and flexible, even regarding its filtering
+mechanism. Another workaround in some situations would be to have in
+/etc/cups/mime.types entries as follows:
+
    +
    application/postscript           application/vnd.cups-raw  0  -
    application/vnd.cups-postscript  application/vnd.cups-raw  0  -
+
 
    
-This would prevent all Postscript files from being filtered (rather, they will go
-thru the virtual "nullfilter" denoted with "-"). This could only be useful for
-PS printers. If you want to print PS code on non-PS printers an entry as follows
-could be useful:
-
    +This would prevent all Postscript files from being filtered (rather,
+they will through the virtual nullfilter
+denoted with "-").  This could only be useful for PS printers. If you
+want to print PS code on non-PS printers (provided they support ASCII
+text printing) an entry as follows could be useful:
+
    +
    */*           application/vnd.cups-raw  0  -
+
 
    
-and would effectively send *all* files to the backend without further processing.
+and would effectively send all files to the
+backend without further processing.
 
    
 Lastly, you could have the following entry:
-
    +
    +
    application/vnd.cups-postscript  application/vnd.cups-raw  0  my_PJL_stripping_filter
+
 
    
-You will need to write a "my_PJL_stripping_filter" (could be a shellscript) that
-parses the PostScript and removes the unwanted PJL. This would need to conform to
-CUPS filter design (mainly, receive and pass the parameters printername, job-id,
-username, jobtitle, copies, print options and possibly the filename). It would
-be installed as world executable into "/usr/lib/cups/filters/" and will be called
-by CUPS if it encounters a MIME type "application/vnd.cups-postscript".
-
    
-CUPS can handle "-o job-hold-until=indefinite". This keeps the job in the queue
-"on hold". It will only be printed upon manual release by the printer operator.
-This is a requirement in many "central reproduction departments", where a few
-operators manage the jobs of hundreds of users on some big machine, where no
-user is allowed to have direct access. (The operators often need to load the
-proper paper type before running the 10.000 page job requested by marketing
-for the mailing, etc.).
-

    CUPS as a network PostScript RIP

    -This is the configuration where CUPS drivers are working on server, and where the -Adobe PostScript driver with CUPS-PPDs is downloaded to clients. -

    -CUPS is perfectly able to use PPD files (PostScript -Printer Descriptions). PPDs can control all print device options. They -are usually provided by the manufacturer -- if you own a PostSript printer, -that is. PPD files are always a component of PostScript printer drivers on MS -Windows or Apple Mac OS systems. They are ASCII files containing -user-selectable print options, mapped to appropriate PostScript, PCL or PJL -commands for the target printer. Printer driver GUI dialogs translate these -options "on-the-fly" into buttons and drop-down lists for the user to -select. -

    -CUPS can load, without any conversions, the PPD file from -any Windows (NT is recommended) PostScript driver and handle the options. -There is a web browser interface to the print options (select -http://localhost:631/printers/ and click on one "Configure Printer" button -to see it), a commandline interface (see man lpoptions or -try if you have lphelp on your system) plus some different GUI frontends on Linux -UNIX, which can present PPD options to the users. PPD options are normally -meant to become evaluated by the PostScript RIP on the real PostScript -printer. -

    -CUPS doesn't stop at "real" PostScript printers in its -usage of PPDs. The CUPS developers have extended the PPD concept, to also -describe available device and driver options for non-PostScript printers -through CUPS-PPDs. -

    -This is logical, as CUPS includes a fully featured -PostScript interpreter (RIP). This RIP is based on Ghostscript. It can -process all received PostScript (and additionally many other file formats) -from clients. All CUPS-PPDs geared to non-PostScript printers contain an -additional line, starting with the keyword *cupsFilter. -This line -tells the CUPS print system which printer-specific filter to use for the -interpretation of the accompanying PostScript. Thus CUPS lets all its -printers appear as PostScript devices to its clients, because it can act as a -PostScript RIP for those printers, processing the received PostScript code -into a proper raster print format. -

    -CUPS-PPDs can also be used on Windows-Clients, on top of a -PostScript driver (recommended is the Adobe one). -

    -This feature enables CUPS to do a few tricks no other -spooler can do: -

    • act as a networked PostScript RIP (Raster Image Processor), handling - printfiles from all client platforms in a uniform way;

    • act as a central accounting and billing server, as all files are passed - through the pstops Filter and are therefor logged in - the CUPS page_log. - NOTE: this - can not happen with "raw" print jobs, which always remain unfiltered - per definition;

    • enable clients to consolidate on a single PostScript driver, even for - many different target printers.

    Windows Terminal Servers (WTS) as CUPS clients

    -This setup may be of special interest to people -experiencing major problems in WTS environments. WTS need often a multitude -of non-PostScript drivers installed to run their clients' variety of -different printer models. This often imposes the price of much increased -instability. In many cases, in an attempt to overcome this problem, site -administrators have resorted to restrict the allowed drivers installed on -their WTS to one generic PCL- and one PostScript driver. This however -restricts the clients in the amount of printer options available for them -- -often they can't get out more then simplex prints from one standard paper -tray, while their devices could do much better, if driven by a different -driver! -

    -Using an Adobe PostScript driver, enabled with a CUPS-PPD, -seems to be a very elegant way to overcome all these shortcomings. The -PostScript driver is not known to cause major stability problems on WTS (even -if used with many different PPDs). The clients will be able to (again) chose -paper trays, duplex printing and other settings. However, there is a certain -price for this too: a CUPS server acting as a PostScript RIP for its clients -requires more CPU and RAM than just to act as a "raw spooling" device. Plus, -this setup is not yet widely tested, although the first feedbacks look very -promising... -

    Setting up CUPS for driver download

    -The cupsadsmb utility (shipped with all current -CUPS versions) makes the sharing of any (or all) installed CUPS printers very -easy. Prior to using it, you need the following settings in smb.conf: -

    [global]
-		 load printers = yes
-		 printing = cups
-		 printcap name = cups
+You will need to write a my_PJL_stripping_filter
+(could be a shellscript) that parses the PostScript and removes the
+unwanted PJL. This would need to conform to CUPS filter design
+(mainly, receive and pass the parameters printername, job-id,
+username, jobtitle, copies, print options and possibly the
+filename). It would be installed as world executable into
+/usr/lib/cups/filters/ and will be called by CUPS
+if it encounters a MIME type "application/vnd.cups-postscript".
+
    
+CUPS can handle -o job-hold-until=indefinite.
+This keeps the job in the queue "on hold". It will only be printed
+upon manual release by the printer operator. This is a requirement in
+many "central reproduction departments", where a few operators manage
+the jobs of hundreds of users on some big machine, where no user is
+allowed to have direct access (such as when the operators often need
+to load the proper paper type before running the 10,000 page job
+requested by marketing for the mailing, etc.).
+

    Auto-Deletion or Preservation of CUPS Spool Files

    +Samba print files pass through two "spool" directories. One is the +incoming directory managed by Samba, (set in the path = +/var/spool/samba directive in the +[printers] section of +smb.conf). The other is the spool directory of +your UNIX print subsystem. For CUPS it is normally +/var/spool/cups/, as set by the cupsd.conf +directive RequestRoot /var/spool/cups. +

    CUPS Configuration Settings explained

    +Some important parameter settings in the CUPS configuration file +cupsd.conf are: +

    PreserveJobHistory Yes

    +This keeps some details of jobs in cupsd's mind (well it keeps the +"c12345", "c12346" etc. files in the CUPS spool directory, which do a +similar job as the old-fashioned BSD-LPD control files). This is set +to "Yes" as a default. +

    PreserveJobFiles Yes

    +This keeps the job files themselves in cupsd's mind +(well it keeps the "d12345", "d12346" etc. files in the CUPS spool +directory...). This is set to "No" as the CUPS +default. +

    "MaxJobs 500"

    +This directive controls the maximum number of jobs +that are kept in memory. Once the number of jobs reaches the limit, +the oldest completed job is automatically purged from the system to +make room for the new one. If all of the known jobs are still +pending or active then the new job will be rejected. Setting the +maximum to 0 disables this functionality. The default setting is +0. +

    +(There are also additional settings for "MaxJobsPerUser" and +"MaxJobsPerPrinter"...) +

    Pre-conditions

    +For everything to work as announced, you need to have three +things: +

    • a Samba-smbd which is compiled against "libcups" (Check +on Linux by running "ldd `which smbd`")

    • a Samba-smb.conf setting of +"printing = cups"

    • another Samba-smb.conf setting of +"printcap = cups"

    Note

    +In this case all other manually set printing-related commands (like +"print command", "lpq command", "lprm command", "lppause command" or +"lpresume command") are ignored and they should normally have no +influence what-so-ever on your printing. +

    Manual Configuration

    +If you want to do things manually, replace the "printing = +cups" by "printing = bsd". Then your manually set commands may work +(haven't tested this), and a "print command = lp -d %P %s; rm %s" +may do what you need. +

    When not to use Samba to print to +CUPS

    +[TO BE DONE] +

    In Case of Trouble.....

    +If you have more problems, post the output of these commands +to the CUPS or Samba mailing lists (choose the one which seems more +relevant to your problem): +

    +
+   grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
+   grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"
 
-	[printers]
-		 comment = All Printers
-		 path = /var/spool/samba
-		 browseable = no
-		 public = yes
-		 guest ok = yes
-		 writable = no
-		 printable = yes
-		 printer admin = root
-
-	[print$]
-		 comment = Printer Drivers
-		 path = /etc/samba/drivers
-		 browseable = yes
-		 guest ok = no
-		 read only = yes
-		 write list = root
-

    -For licensing reasons the necessary files of the Adobe -Postscript driver can not be distributed with either Samba or CUPS. You need -to download them yourself from the Adobe website. Once extracted, create a -drivers directory in the CUPS data directory (usually -/usr/share/cups/). Copy the Adobe files using -UPPERCASE filenames, to this directory as follows: -

    -		ADFONTS.MFM
-		ADOBEPS4.DRV
-		ADOBEPS4.HLP
-		ADOBEPS5.DLL
-		ADOBEPSU.DLL
-		ADOBEPSU.HLP
-		DEFPRTR2.PPD
-		ICONLIB.DLL
-

    -Users of the ESP Print Pro software are able to install -their "Samba Drivers" package for this purpose with no problem. -

    Sources of CUPS drivers / PPDs

    -On the internet you can find now many thousand CUPS-PPD -files (with their companion filters), in many national languages, -supporting more than 1.000 non-PostScript models. -

    -NOTE: the cupsomatic trick from Linuxprinting.org is -working different from the other drivers. While the other drivers take the -generic CUPS raster (produced by CUPS' own pstoraster PostScript RIP) as -their input, cupsomatic "kidnaps" the PostScript inside CUPS, before -RIP-ping, deviates it to an external Ghostscript installation (which now -becomes the RIP) and gives it back to a CUPS backend once Ghostscript is -finished. -- CUPS versions from 1.1.15 and later will provide their pstoraster -PostScript RIP function again inside a system-wide Ghostscript -installation rather than in "their own" pstoraster filter. (This -CUPS-enabling Ghostscript version may be installed either as a -patch to GNU or AFPL Ghostscript, or as a complete ESP Ghostscript package). -However, this will not change the cupsomatic approach of guiding the printjob -along a different path through the filtering system than the standard CUPS -way... -

    -Once you installed a printer inside CUPS with one of the -recommended methods (the lpadmin command, the web browser interface or one of -the available GUI wizards), you can use cupsaddsmb to share the -printer via Samba. cupsaddsmb prepares the driver files for -comfortable client download and installation upon their first contact with -this printer share. -

    cupsaddsmb

    -The cupsaddsmb command copies the needed files -for convenient Windows client installations from the previously prepared CUPS -data directory to your [print$] share. Additionally, the PPD -associated with this printer is copied from /etc/cups/ppd/ to -[print$]. -

    -root#  cupsaddsmb -U root infotec_IS2027
-Password for root required to access localhost via
-SAMBA: [type in password 'secret']

    -To share all printers and drivers, use the -a -parameter instead of a printer name. -

    -Probably you want to see what's going on. Use the --v parameter to get a more verbose output: -

    -Probably you want to see what's going on. Use the --v parameter to get a more verbose output: -

    -Note: The following line shave been wrapped so that information is not lost.
- 
-root#  cupsaddsmb -v -U root infotec_IS2027
-    Password for root required to access localhost via SAMBA:
-    Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir W32X86;put
-       /var/spool/cups/tmp/3cd1cc66376c0 W32X86/infotec_IS2027.PPD;put
-       /usr/share/cups/drivers/
-       ADOBEPS5.DLL W32X86/ADOBEPS5.DLL;put /usr/share/cups/drivers/ADOBEPSU.DLLr
-       W32X86/ADOBEPSU.DLL;put /usr/share/cups/drivers/ADOBEPSU.HLP W32X86/ADOBEPSU.HLP'
-    added interface ip=10.160.16.45 bcast=10.160.31.255 nmask=255.255.240.0
-    added interface ip=192.168.182.1 bcast=192.168.182.255 nmask=255.255.255.0
-    added interface ip=172.16.200.1 bcast=172.16.200.255 nmask=255.255.255.0
-    Domain=[TUX-NET] OS=[Unix] Server=[Samba 2.2.3a.200204262025cvs]
-    NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86
-    putting file /var/spool/cups/tmp/3cd1cc66376c0 as
-      \W32X86/infotec_IS2027.PPD (17394.6 kb/s) (average 17395.2 kb/s)
-    putting file /usr/share/cups/drivers/ADOBEPS5.DLL as
-      \W32X86/ADOBEPS5.DLL (10877.4 kb/s) (average 11343.0 kb/s)
-    putting file /usr/share/cups/drivers/ADOBEPSU.DLL as
-      \W32X86/ADOBEPSU.DLL (5095.2 kb/s) (average 9260.4 kb/s)
-    putting file /usr/share/cups/drivers/ADOBEPSU.HLP as
-      \W32X86/ADOBEPSU.HLP (8828.7 kb/s) (average 9247.1 kb/s)
-
-    Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir WIN40;put
-      /var/spool/cups/tmp/3cd1cc66376c0 WIN40/infotec_IS2027.PPD;put
-      /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;put
-      /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV;put
-      /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP;put
-      /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD;put
-      /usr/share/cups/drivers/ICONLIB.DLL WIN40/ICONLIB.DLL;put
-      /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;'
-    added interface ip=10.160.16.45 bcast=10.160.31.255 nmask=255.255.240.0
-    added interface ip=192.168.182.1 bcast=192.168.182.255 nmask=255.255.255.0
-    added interface ip=172.16.200.1 bcast=172.16.200.255 nmask=255.255.255.0
-    Domain=[TUX-NET] OS=[Unix] Server=[Samba 2.2.3a.200204262025cvs]
-    NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40
-    putting file /var/spool/cups/tmp/3cd1cc66376c0 as
-      \WIN40/infotec_IS2027.PPD (26091.5 kb/s) (average 26092.8 kb/s)
-    putting file /usr/share/cups/drivers/ADFONTS.MFM as
-      \WIN40/ADFONTS.MFM (11241.6 kb/s) (average 11812.9 kb/s)
-    putting file /usr/share/cups/drivers/ADOBEPS4.DRV as
-      \WIN40/ADOBEPS4.DRV (16640.6 kb/s) (average 14679.3 kb/s)
-    putting file /usr/share/cups/drivers/ADOBEPS4.HLP as
-      \WIN40/ADOBEPS4.HLP (11285.6 kb/s) (average 14281.5 kb/s)
-    putting file /usr/share/cups/drivers/DEFPRTR2.PPD as
-      \WIN40/DEFPRTR2.PPD (823.5 kb/s) (average 12944.0 kb/s)
-    putting file /usr/share/cups/drivers/ICONLIB.DLL as
-      \WIN40/ICONLIB.DLL (19226.2 kb/s) (average 13169.7 kb/s)
-    putting file /usr/share/cups/drivers/PSMON.DLL as
-      \WIN40/PSMON.DLL (18666.1 kb/s) (average 13266.7 kb/s)
-
-    Running command: rpcclient localhost -N -U'root%secret'
-       -c 'adddriver "Windows NT x86"
-       "infotec_IS2027:ADOBEPS5.DLL:infotec_IS2027.PPD:ADOBEPSU.DLL:
-		ADOBEPSU.HLP:NULL:RAW:NULL"'
-    cmd = adddriver "Windows NT x86"
-       "infotec_IS2027:ADOBEPS5.DLL:infotec_IS2027.PPD:ADOBEPSU.DLL:
-       ADOBEPSU.HLP:NULL:RAW:NULL"
-    Printer Driver infotec_IS2027 successfully installed.
-
-    Running command: rpcclient localhost -N -U'root%secret'
-       -c 'adddriver "Windows 4.0"
-       "infotec_IS2027:ADOBEPS4.DRV:infotec_IS2027.PPD:NULL:
-		ADOBEPS4.HLP:PSMON.DLL:RAW: ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
-    cmd = adddriver "Windows 4.0" "infotec_IS2027:ADOBEPS4.DRV:
-		infotec_IS2027.PPD:NULL:ADOBEPS4.HLP:PSMON.DLL:RAW:
-		ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"
-    Printer Driver infotec_IS2027 successfully installed.
-
-    Running command: rpcclient localhost -N -U'root%secret'
-       -c 'setdriver infotec_IS2027 infotec_IS2027'
-    cmd = setdriver infotec_IS2027 infotec_IS2027
-    Succesfully set infotec_IS2027 to driver infotec_IS2027.
-
-    root# 
-

    -If you look closely, you'll discover your root password was transfered unencrypted over -the wire, so beware! Also, if you look further her, you'll discover error messages like -NT_STATUS_OBJECT_NAME_COLLISION in between. They occur, because -the directories WIN40 and W32X86 already -existed in the [print$] driver download share (from a previous driver -installation). They are harmless here. -

    -Now your printer is prepared for the clients to use. From -a client, browse to the CUPS/Samba server, open the "Printers" -share, right-click on this printer and select "Install..." or -"Connect..." (depending on the Windows version you use). Now their -should be a new printer in your client's local "Printers" folder, -named (in my case) "infotec_IS2027 on kdebitshop" -

    -NOTE: -cupsaddsmb will only reliably work i -with CUPS version 1.1.15 or higher -and Samba from 2.2.4. If it doesn't work, or if the automatic printer -driver download to the clients doesn't succeed, you can still manually -install the CUPS printer PPD on top of the Adobe PostScript driver on -clients and then point the client's printer queue to the Samba printer -share for connection, should you desire to use the CUPS networked -PostScript RIP functions. -

    The CUPS Filter Chains

    +(adapt paths as needed). These commands leave out the empty +lines and lines with comments, providing the "naked settings" in a +compact way. Don't forget to name the CUPS and Samba versions you +are using! This saves bandwidth and makes for easier readability +for experts (and you are expecting experts to read them, right? +;-) +

    Where to find Documentation

    +[TO BE DONE] +

    How to ask for Help

    +[TO BE DONE] +

    Where to find Help

    +[TO BE DONE] +

    Appendix

    Printing from CUPS to Windows attached +Printers

    +From time to time the question arises, how you can print +to a Windows attached printer +from Samba. Normally the local connection +"Windows host <--> printer" would be done by USB or parallel +cable, but this doesn't matter to Samba. From here only an SMB +connection needs to be opened to the Windows host. Of course, this +printer must be "shared" first. As you have learned by now, CUPS uses +backends to talk to printers and other +servers. To talk to Windows shared printers you need to use the +smb (surprise, surprise!) backend. Check if this +is in the CUPS backend directory. This resides usually in +/usr/lib/cups/backend/. You need to find a "smb" +file there. It should be a symlink to smbspool +which file must exist and be executable: +

    +
+ # ls -l /usr/lib/cups/backend/   
+ total 253
+ drwxr-xr-x    3 root     root          720 Apr 30 19:04 .
+ drwxr-xr-x    6 root     root          125 Dec 19 17:13 ..
+ -rwxr-xr-x    1 root     root        10692 Feb 16 21:29 canon
+ -rwxr-xr-x    1 root     root        10692 Feb 16 21:29 epson
+ lrwxrwxrwx    1 root     root            3 Apr 17 22:50 http -> ipp
+ -rwxr-xr-x    1 root     root        17316 Apr 17 22:50 ipp
+ -rwxr-xr-x    1 root     root        15420 Apr 20 17:01 lpd
+ -rwxr-xr-x    1 root     root         8656 Apr 20 17:01 parallel
+ -rwxr-xr-x    1 root     root         2162 Mar 31 23:15 pdfdistiller
+ lrwxrwxrwx    1 root     root           25 Apr 30 19:04 ptal -> /usr/local/sbin/ptal-cups
+ -rwxr-xr-x    1 root     root         6284 Apr 20 17:01 scsi
+ lrwxrwxrwx    1 root     root           17 Apr  2 03:11 smb -> /usr/bin/smbspool
+ -rwxr-xr-x    1 root     root         7912 Apr 20 17:01 socket
+ -rwxr-xr-x    1 root     root         9012 Apr 20 17:01 usb
+
+# ls -l `which smbspool`
+ -rwxr-xr-x    1 root     root       563245 Dec 28 14:49 /usr/bin/smbspool
+
+

    +If this symlink doesn't exist, create it: +

    +
+# ln -s `which smbspool` /usr/lib/cups/backend/smb
+
+

    +smbspool has been written by Mike Sweet from the CUPS folks. It is +included and ships with Samba. It may also be used with print +subsystems other than CUPS, to spool jobs to Windows printer shares. To +set up printer "winprinter" on CUPS, you need to have a "driver" for +it. Essentially this means to convert the print data on the CUPS/Samba +host to a format that the printer can digest (the Windows host is +unable to convert any files you may send). This also means you should +be able to print to the printer if it were hooked directly at your +Samba/CUPS host. For troubleshooting purposes, this is what you +should do, to determine if that part of the process chain is in +order. Then proceed to fix the network connection/authentication to +the Windows host, etc. +

    +To install a printer with the smb backend on CUPS, use this command: +

    +
+# lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename -P /path/to/PPD
+
+

    +The PPD must be able to direct CUPS to generate +the print data for the target model. For PostScript printers just use +the PPD that would be used with the Windows NT PostScript driver. But +what can you do if the printer is only accessible with a password? Or +if the printer's host is part of another workgroup? This is provided +for: you can include the required parameters as part of the +smb:// device-URI. Like this: +

    +
+ smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename 
+ smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename
+ smb://username:password@WINDOWSNETBIOSNAME/printersharename
+
+

    +Note that the device-URI will be visible in the process list of the +Samba server (e.g. when someone uses the ps -aux +command on Linux), even if the username and passwords are sanitized +before they get written into the log files. So this is an inherently +insecure option. However it is the only one. Don't use it if you want +to protect your passwords. Better share the printer in a way that +doesn't require a password! Printing will only work if you have a +working netbios name resolution up and running. Note that this is a +feature of CUPS and you don't necessarily need to have smbd running +(but who wants that? :-). +

    More CUPS filtering Chains

    The following diagrams reveal how CUPS handles print jobs. -

    +
     #########################################################################
 #
 # CUPS in and of itself has this (general) filter chain (CAPITAL
 # letters are FILE-FORMATS or MIME types, other are filters (this is
 # true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro):
 #
-# SOMETHNG-FILEFORMAT
-#      |
+# SOMETHNG-FILEFORMAT
 #      |
 #      V
-#     somethingtops
-#      |
+#     somethingtops
 #      |
 #      V
 # APPLICATION/POSTSCRIPT
 #      |
-#      |
 #      V
 #     pstops
 #      |
-#      |
 #      V
 # APPLICATION/VND.CUPS-POSTSCRIPT
 #      |
-#      |
 #      V
 #     pstoraster   # as shipped with CUPS, independent from any Ghostscipt
 #      |           # installation on the system
 #      |  (= "postscipt interpreter")
-#      |
 #      V
 # APPLICATION/VND.CUPS-RASTER
 #      |
-#      |
 #      V
-#     rastertosomething  (f.e. Gimp-Print filters may be plugged in here)
+#     rastertosomething  (e.g. Gimp-Print filters may be plugged in here)
 #      |   (= "raster driver")
-#      |
 #      V
 # SOMETHING-DEVICE-SPECIFIC
 #      |
-#      |
 #      V
 #     backend
 #
 #
-# ESP PrintPro has some enhanced "rastertosomething" filters as compared to
+# ESP PrintPro has some enhanced "rastertosomething" filters as compared to
 # CUPS, and also a somewhat improved "pstoraster" filter.
 #
 # NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
 #
 #########################################################################
-
    +
     #########################################################################
 #
 # This is how "cupsomatic" comes into play:
 # =========================================
 #
-# SOMETHNG-FILEFORMAT
-#      |
+# SOMETHNG-FILEFORMAT
 #      |
 #      V
-#    somethingtops
-#      |
+#    somethingtops
 #      |
 #      V
 # APPLICATION/POSTSCRIPT
 #      |
-#      |
 #      V
 #    pstops
 #      |
-#      |
 #      V
 # APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
-#      |                                          |
 #      |                                          V
 #      V                                         cupsomatic
 #    pstoraster                                  (constructs complicated
 #      |  (= "postscipt interpreter")            Ghostscript commandline
 #      |                                         to let the file be
 #      V                                         processed by a
-# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
+# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
 #      |                                         call...)
-#      |                                          |
 #      V                                          |
-#    rastertosomething                          V
+#    rastertosomething                            V
 #      |    (= "raster driver")     +-------------------------+
 #      |                            | Ghostscript at work.... |
 #      V                            |                         |
 # SOMETHING-DEVICE-SPECIFIC         *-------------------------+
 #      |                                          |
-#      |                                          |
 #      V                                          |
-#    backend >------------------------------------+
-#      |
+#    backend <------------------------------------+
 #      |
 #      V
 #    THE PRINTER
 #
 #
 # Note, that cupsomatic "kidnaps" the printfile after the
-# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it through
+# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it gh
 # the CUPS-external, systemwide Ghostscript installation, bypassing the
-# "pstoraster" filter (therefor also bypassing the CUPS-raster-drivers
-# "rastertosomething", and hands the rasterized file directly to the CUPS
+# "pstoraster" filter (therefore also bypassing the CUPS-raster-drivers
+# "rastertosomething", and hands the rasterized file directly to the CUPS
 # backend...
 #
 # cupsomatic is not made by the CUPS developers. It is an independent
@@ -4212,134 +11513,112 @@ The following diagrams reveal how CUPS handles print jobs.
 # Linuxprinting.org. (see also http://www.cups.org/cups-help.html)
 #
 # NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
 #
 #########################################################################
-
    +
     #########################################################################
 #
 # And this is how it works for ESP PrintPro from 4.3:
 # ===================================================
 #
-# SOMETHNG-FILEFORMAT
-#      |
+# SOMETHNG-FILEFORMAT
 #      |
 #      V
-#     somethingtops
-#      |
+#     somethingtops
 #      |
 #      V
 # APPLICATION/POSTSCRIPT
 #      |
-#      |
 #      V
 #     pstops
 #      |
-#      |
 #      V
 # APPLICATION/VND.CUPS-POSTSCRIPT
 #      |
-#      |
 #      V
 #     gsrip
 #      |  (= "postscipt interpreter")
-#      |
 #      V
 # APPLICATION/VND.CUPS-RASTER
 #      |
-#      |
 #      V
-#     rastertosomething  (f.e. Gimp-Print filters may be plugged in here)
+#     rastertosomething  (e.g. Gimp-Print filters may be plugged in here)
 #      |   (= "raster driver")
-#      |
 #      V
 # SOMETHING-DEVICE-SPECIFIC
 #      |
-#      |
 #      V
 #     backend
 #
 # NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
 #
 #########################################################################
-
    +
     #########################################################################
 #
 # This is how "cupsomatic" would come into play with ESP PrintPro:
 # ================================================================
 #
 #
-# SOMETHNG-FILEFORMAT
-#      |
+# SOMETHNG-FILEFORMAT
 #      |
 #      V
-#    somethingtops
-#      |
+#    somethingtops
 #      |
 #      V
 # APPLICATION/POSTSCRIPT
 #      |
-#      |
 #      V
 #    pstops
 #      |
-#      |
 #      V
 # APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
-#      |                                          |
 #      |                                          V
 #      V                                         cupsomatic
 #    gsrip                                       (constructs complicated
 #      |  (= "postscipt interpreter")            Ghostscript commandline
 #      |                                         to let the file be
 #      V                                         processed by a
-# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
+# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
 #      |                                         call...)
-#      |                                          |
 #      V                                          |
-#    rastertosomething                          V
+#    rastertosomething                            V
 #      |   (= "raster driver")      +-------------------------+
 #      |                            | Ghostscript at work.... |
 #      V                            |                         |
 # SOMETHING-DEVICE-SPECIFIC         *-------------------------+
 #      |                                          |
-#      |                                          |
 #      V                                          |
-#    backend >------------------------------------+
-#      |
+#    backend <------------------------------------+
 #      |
 #      V
 #    THE PRINTER
 #
 # NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
 #
 #########################################################################
-
    +
     #########################################################################
 #
 # And this is how it works for CUPS from 1.1.15:
 # ==============================================
 #
-# SOMETHNG-FILEFORMAT
-#      |
+# SOMETHNG-FILEFORMAT
 #      |
 #      V
-#     somethingtops
-#      |
+#     somethingtops
 #      |
 #      V
 # APPLICATION/POSTSCRIPT
 #      |
-#      |
 #      V
 #     pstops
 #      |
-#      |
 #      V
 # APPLICATION/VND.CUPS-POSTSCRIPT-----+
-#                                     |
 #                  +------------------v------------------------------+
 #                  | Ghostscript                                     |
 #                  | at work...                                      |
@@ -4350,18 +11629,14 @@ The following diagrams reveal how CUPS handles print jobs.
 #                  |                                                 |
 #                  +------------------v------------------------------+
 #                                     |
-#                                     |
 # APPLICATION/VND.CUPS-RASTER >-------+
 #      |
-#      |
 #      V
-#     rastertosomething
+#     rastertosomething
 #      |   (= "raster driver")
-#      |
 #      V
 # SOMETHING-DEVICE-SPECIFIC
 #      |
-#      |
 #      V
 #     backend
 #
@@ -4372,44 +11647,39 @@ The following diagrams reveal how CUPS handles print jobs.
 #       "gs -h" needs to show up a "cups" device. pstoraster is now a
 #       calling an appropriate "gs -sDEVICE=cups..." commandline to do
 #       the job. It will output "application/vnd.cup-raster", which will
-#       be finally processed by a CUPS raster driver "rastertosomething"
-#       Note the difference to "cupsomatic", which will *not* output
+#       be finally processed by a CUPS raster driver "rastertosomething"
+#       Note the difference to "cupsomatic", which will not output
 #       CUPS-raster, but a final version of the printfile, ready to be
 #       sent to the printer. cupsomatic also doesn't use the "cups"
 #       devicemode in Ghostscript, but one of the classical devicemodes....
 #
 # NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
 #
 #########################################################################
-
    +
     #########################################################################
 #
 # And this is how it works for CUPS from 1.1.15, with cupsomatic included:
 # ========================================================================
 #
-# SOMETHNG-FILEFORMAT
-#      |
+# SOMETHNG-FILEFORMAT
 #      |
 #      V
-#     somethingtops
-#      |
+#     somethingtops
 #      |
 #      V
 # APPLICATION/POSTSCRIPT
 #      |
-#      |
 #      V
 #     pstops
 #      |
-#      |
 #      V
 # APPLICATION/VND.CUPS-POSTSCRIPT-----+
-#                                     |
 #                  +------------------v------------------------------+
 #                  | Ghostscript        . Ghostscript at work....    |
 #                  | at work...         . (with "-sDEVICE=           |
-#                  | (with              .            s.th."        |
+#                  | (with              .            s.th."          |
 #                  | "-sDEVICE=cups")   .                            |
 #                  |                    .                            |
 #                  | (CUPS standard)    .      (cupsomatic)          |
@@ -4418,476 +11688,353 @@ The following diagrams reveal how CUPS handles print jobs.
 #                  |                    .                            |
 #                  +------------------v--------------v---------------+
 #                                     |              |
-#                                     |              |
 # APPLICATION/VND.CUPS-RASTER >-------+              |
 #      |                                             |
-#      |                                             |
 #      V                                             |
-#     rastertosomething                            |
+#     rastertosomething                              |
 #      |   (= "raster driver")                       |
-#      |                                             |
 #      V                                             |
 # SOMETHING-DEVICE-SPECIFIC >------------------------+
 #      |
-#      |
 #      V
 #     backend
 #
 #
 # NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
 #
 ##########################################################################
-

    CUPS Print Drivers and Devices

    -CUPS ships with good support for HP LaserJet type printers. You can install -the driver as follows: - -

    • - lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd -

    +

    Trouble Shooting Guidelines to fix typical Samba printing +Problems

    +This is a short description of how to debug printing problems +with Samba. This describes how to debug problems with printing from +a SMB client to a Samba server, not the other way around. +

    Win9x client can't install driver

    For Win9x clients require the printer names to be 8 +chars (or "8 plus 3 chars suffix") max; otherwise the driver files +won't get transferred when you want to download them from +Samba.

    testparm

    Run testparm: It will tell you if +smb.conf parameters are in the wrong +section. Many people have had the "printer admin" parameter in the +[printers] section and experienced +problems. "testparm" will tell you if it sees +this.

    "cupsaddsmb" keeps asking for a root password in a +neverending loop

    Have you security = user? Have +you used smbpasswd to give root a Samba account? +You can do 2 things: open another terminal and execute +smbpasswd -a root to create the account, and +continue with entering the password into the first terminal. Or break +out of the loop by hitting ENTER twice (without trying to type a +password).

    "cupsaddsmb" gives "No PPD file for printer..." +message (but I swear there is one!)

    • Have you enabled printer sharing on CUPS? This means: +do you have a <Location +/printers>....</Location> section in CUPS +server's cupsd.conf which doesn't deny access to +the host you run "cupsaddsmb" from? It could be +an issue if you use cupsaddsmb remotely, or if you use it with a +-h parameter: cupsaddsmb -H +sambaserver -h cupsserver -v printername. +

    • Is your +"TempDir" directive in +cupsd.conf +set to a valid value and is it writeable? +

    I can't connect client to Samba printer.

    Use smbstatus to check which user +you are from Samba's point of view. Do you have the privileges to +write into the [print$] +share?

    I can't reconnect to Samba under a new account +from Win2K/XP

    Once you are connected as the "wrong" user (for +example as "nobody", which often occurs if you have map to +guest = bad user), Windows Explorer will not accept an +attempt to connect again as a different user. There won't be any byte +transfered on the wire to Samba, but still you'll see a stupid error +message which makes you think that Samba has denied access. Use +smbstatus to check for active connections. Kill the +PIDs. You still can't re-connect and get the dreaded +You can't connect with a second account from the same +machine message, as soon as you are trying? And you +don't see any single byte arriving at Samba (see logs; use "ethereal") +indicating a renewed connection attempt? Shut all Explorer Windows. +This makes Windows forget what it has cached in its memory as +established connections. Then re-connect as the right user. Best +method is to use a DOS terminal window and first +do net use z: \\SAMBAHOST\print$ /user:root. Check +with smbstatus that you are connected under a +different account. Now open the "Printers" folder (on the Samba server +in the Network Neighbourhood), right-click the +printer in question and select +Connect...

    Avoid being connected to the Samba server as the +"wrong" user

    You see per smbstatus that you are +connected as user "nobody"; while you wanted to be "root" or +"printeradmin"? This is probably due to map to guest = bad +user, which silently connects you under the guest account, +when you gave (maybe by accident) an incorrect username. Remove +map to guest, if you want to prevent +this.

    Upgrading to CUPS drivers from Adobe drivers on +NT/2K/XP clients gives problems

    First delete all "old" Adobe-using printers. Then +delete all "old" Adobe drivers. (On Win2K/XP, right-click in +background of "Printers" folder, select "Server Properties...", select +tab "Drivers" and delete here).

    I can't use "cupsaddsmb"on a Samba server which is +a PDC

    Do you use the "naked" root user name? Try to do it +this way: cupsaddsmb -U DOMAINNAME\\root -v +printername (note the two backslashes: the first one is +required to "escape" the second one).

    I deleted a printer on Win2K; but I still see +its driver

    Deleting a printer on the client won't delete the +driver too (to verify, right-click on the white background of the +"Printers" folder, select "Server Properties" and click on the +"Drivers" tab). These same old drivers will be re-used when you try to +install a printer with the same name. If you want to update to a new +driver, delete the old ones first. Deletion is only possible if no +other printer uses the same driver.

    Win2K/XP "Local Security +Policies"

    Local Security Policies may not +allow the installation of unsigned drivers. "Local Security Policies" +may not allow the installation of printer drivers at +all.

    WinXP clients: "Administrator can not install +printers for all local users"

    Windows XP handles SMB printers on a "per-user" basis. +This means every user needs to install the printer himself. To have a +printer available for everybody, you might want to use the built-in +IPP client capabilities of WinXP. Add a printer with the print path of +http://cupsserver:631/printers/printername. +Still looking into this one: maybe a "logon script" could +automatically install printers for all +users.

    "Print Change Notify" functions on +NT-clients

    For "print change notify" functions on NT++ clients, +these need to run the "Server" service first (re-named to +File & Print Sharing for MS Networks in +XP).

    WinXP-SP1

    WinXP-SP1 introduced a Point and Print +Restriction Policy (this restriction doesn't apply to +"Administrator" or "Power User" groups of users). In Group Policy +Object Editor: go to User Configuration --> +Administrative Templates --> Control Panel --> +Printers. The policy is automatically set to +Enabled and the Users can only Point +and Print to machines in their Forest . You probably need +to change it to Disabled or Users can +only Point and Print to these servers in order to make +driver downloads from Samba possible.

    I can't set and save default print options for all +users on Win2K/XP

    How are you doing it? I bet the wrong way (it is not +very easy to find out, though). There are 3 different ways to bring +you to a dialog that seems to set everything. All +three dialogs look the same. Only one of them +does what you intend. You need to be +Administrator or Print Administrator to do this for all users. Here +is how I do in on XP: +

    1. The first "wrong" way: -(The "-m" switch will retrieve the "laserjet.ppd" from the standard repository -for not-yet-installed-PPDs, which CUPS typically stores in -/usr/share/cups/model. Alternatively, you may use -"-P /absolute/filesystem/path/to/where/there/is/PPD/your.ppd"). -

      Further printing steps

      -Always also consult the database on linuxprinting.org for all recommendations -about which driver is best used for each printer: -

      http://www.linuxprinting.org/printer_list.cgi

      -There select your model and click on "Show". You'll arrive at a page listing -all drivers working with your model. There will always be *one* -recommended one. Try this one first. In your case -("HP LaserJet 4 Plus"), you'll arrive here: -

      http://www.linuxprinting.org/show_printer.cgi?recnum=75104

      -The recommended driver is "ljet4". It has a link to the page for the ljet4 -driver too: -

      http://www.linuxprinting.org/show_driver.cgi?driver=ljet4

      -On the driver's page, you'll find important and detailed info about how to use -that driver within the various available spoolers. You can generate a PPD for -CUPS. The PPD contains all the info about how to use your model and the driver; -this is, once installed, working transparently for the user -- you'll only -need to choose resolution, paper size etc. from the web-based menu or from -the print dialog GUI or from the commandline... -

      -On the driver's page, choose to use the "PPD-O-Matic" online PPD generator -program. Select your model and click "Generate PPD file". When you safe the -appearing ASCII text file, don't use "cut'n'past" (as it could possiblly corrupt -line endings and tabs), but use "Save as..." in your browser's menu. Save it -at "/some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd" -

      -Then install the printer: -

      -    "lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E \
-          -P /some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"
-

      -Note, that for all the "Foomatic-PPDs" from Linuxprinting.org, you also need -a special "CUPS filter" named "cupsomatic". Get the latest version of -"cupsomatic" from: -

      http://www.linuxprinting.org/cupsomatic

      -This needs to be copied to /usr/lib/cups/filter/cupsomatic -and be made world executable. This filter is needed to read and act upon the -specially encoded Foomatic comments, embedded in the printfile, which in turn -are used to construct (transparently for you, the user) the complicated -ghostscript command line needed for your printer/driver combo. -

      -You can have a look at all the options for the Ghostscript commandline supported -by your printer and the ljet4 driver by going to the section "Execution details", -selecting your model (Laserjet 4 Plus) and clicking on "Show execution details". -This will bring up this web page: -

      http://www.linuxprinting.org/execution.cgi?driver=ljet4&printer=75104&.submit=Show+execution+details

      -The ingenious thing is that the database is kept current. If there -is a bug fix and an improvement somewhere in the database, you will -always get the most current and stable and feature-rich driver by following -the steps described above. -

      Note

      -Till Kamppeter from MandrakeSoft is doing an excellent job here that too few -people are aware of. (So if you use it often, please send him a note showing -your appreciation).

      -The latest and greatest improvement now is support for "custom page sizes" -for all those printers which support it. -

      -"cupsomatic" is documented here: -

      http://www.linuxprinting.org/cups-doc.html

      -More printing tutorial info may be found here: -

      http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/

      -Note, that *all* the Foomatic drivers listed on Linuxprinting.org (now -approaching the "all-time high" number of 1.000 for the supported models) -are using a special filtering chain involving Ghostscript, as described -in this document. -

      -Summary - You need: -

      -

      A "foomatic+something" PPD is not enough to print with CUPS (but it is *one* important component)
      The "cupsomatic" filter script (Perl) in /usr/lib/cups/filters/
      Perl to make cupsomatic run
      Ghostscript (because it is called and controlled by the PPD/cupsomatic combo in a way to fit your printermodel/driver combo.
      Ghostscript *must*, depending on the driver/model, contain support for a certain "device" (as shown by "gs -h")

      -

      -In the case of the "hpijs" driver, you need a Ghostscript version, which -has "ijs" amongst its supported devices in "gs -h". In the case of -"hpijs+foomatic", a valid ghostscript commandline would be reading like this: -

      -       gs -q -dBATCH -dPARANOIDSAFER -dQUIET -dNOPAUSE -sDEVICE=ijs       \
-             -sIjsServer=hpijsPageSize -dDuplex=Duplex Model        \
-             -rResolution,PS:MediaPosition=InputSlot -dIjsUseOutputFD \
-             -sOutputFile=- -
-

      Note

      -Note, that with CUPS and the "hpijs+foomatic" PPD (plus Perl and cupsomatic) -you don't need to remember this. You can choose the available print options -thru a GUI print command (like "glp" from ESP's commercially supported -PrintPro software, or KDE's "kprinter", or GNOME's "gtklp" or the independent -"xpp") or the CUPS web interface via human-readable drop-down selection -menus. -

      -If you use "ESP Ghostscript" (also under the GPL, provided by Easy Software -Products, the makers of CUPS, downloadable from -http://www.cups.org/software.html, -co-maintained by the developers of linuxprinting.org), you are guaranteed to -have in use the most uptodate, bug-fixed, enhanced and stable version of a Free -Ghostscript. It contains support for ~300 devices, whereas plain vanilla -GNU Ghostscript 7.05 only has ~200. -

      -If you print only one CUPS test page, from the web interface and when you try to -print a windows test page, it acts like the job was never sent: +

      1. Open the Printers +folder.

      2. Right-click on the printer +(remoteprinter on cupshost) and +select in context menu Printing +Preferences...

      3. Look at this dialog closely and remember what it looks +like.

      +

    2. The second "wrong" way: -

      Can you print "standard" jobs from the CUPS machine?
      Are the jobs from Windows visible in the Web interface on CUPS (http://localhost:631/)?
      Most important: What kind of printer driver are you using on the Windows clients?

      +

      1. Open the Printers +folder.

      2. Right-click on the printer (remoteprinter on +cupshost) and select in the context menu +Properties

      3. Click on the General +tab

      4. Click on the button Printing +Preferences...

      5. A new dialog opens. Keep this dialog open and go back +to the parent dialog.

      +

    3. The third, the "correct" way: (should you do +this from the beginning, just carry out steps 1. and 2. from second +"way" above) -You can try to get a more detailed debugging info by setting "LogLevel debug" in -/etc/cups/cupsd.conf, re-start cupsd and investigate /var/log/cups/error_log -for the whereabouts of your Windows-originating printjobs: -

      what does the "auto-typing" line say? which is the "MIME type" CUPS thinks is arriving from the Windows clients?
      are there "filter" available for this MIME type?
      are there "filter rules" defined in "/etc/cups/mime.convs" for this MIME type?

    Limiting the number of pages users can print

    -The feature you want is dependent on the real print subsystem you're using. -Samba's part is always to receive the job files from the clients (filtered -*or* unfiltered) and hand it over to this printing subsystem. -

    -Of course one could "hack" things with one's own scripts. -

    -But there is CUPS (Common Unix Printing System). CUPS supports "quotas". -Quotas can be based on sizes of jobs or on the number of pages or both, -and are spanning any time period you want. +

    1. Click on the Advanced +tab. (Hmmm... if everything is "Grayed Out", then you are not logged +in as a user with enough privileges).

    2. Click on the Printing +Defaults... button.

    3. On any of the two new tabs, click on the +Advanced... +button.

    4. A new dialog opens. Compare this one to the other, +identical looking one from "B.5" or A.3".

    +

    +Do you see any difference? I don't either... However, only the last +one, which you arrived at with steps "C.1.-6." will save any settings +permanently and be the defaults for new users. If you want all clients +to get the same defaults, you need to conduct these steps as +Administrator (printer admin in +smb.conf) before a client +downloads the driver (the clients can later set their own +per-user defaults by following the +procedures A. or B. +above).

    What are the most common blunders in driver +settings on Windows clients?

    Don't use Optimize for +Speed: use Optimize for +Portability instead (Adobe PS Driver) Don't use +Page Independence: No: always +settle with Page Independence: +Yes (Microsoft PS Driver and CUPS PS Driver for +WinNT/2K/XP) If there are problems with fonts: use +Download as Softfont into +printer (Adobe PS Driver). For +TrueType Download Options +choose Outline. Use PostScript +Level 2, if you are having trouble with a non-PS printer, and if +there is a choice.

    I can't make cupsaddsmb work +with newly installed printer

    Symptom: the last command of +cupsaddsmb doesn't complete successfully: +cmd = setdriver printername printername result was +NT_STATUS_UNSUCCESSFUL then possibly the printer was not yet +"recognized" by Samba. Did it show up in Network +Neighbourhood? Did it show up in rpcclient +hostname -c 'enumprinters'? Restart smbd (or send a +kill -HUP to all processes listed by +smbstatus and try +again.

    My permissions on +/var/spool/samba/ get reset after each +reboot

    Have you by accident set the CUPS spool directory to +the same location? (RequestRoot +/var/spool/samba/ in cupsd.conf or +the other way round: /var/spool/cups/ is set as +path in the [printers] +section). These must be different. Set +RequestRoot /var/spool/cups/ in +cupsd.conf and path = +/var/spool/samba in the [printers] +section of smb.conf. Otherwise cupsd will +sanitize permissions to its spool directory with each restart, and +printing will not work reliably.

    My printers work fine: just the printer named "lp" +intermittently swallows jobs and spits out completely different +ones

    It is a very bad idea to name any printer "lp". This +is the traditional Unix name for the default printer. CUPS may be set +up to do an automatic creation of "Implicit Classes". This means, to +group all printers with the same name to a pool of devices, and +loadbalancing the jobs across them in a round-robin fashion. Chances +are high that someone else has an "lp" named printer too. You may +receive his jobs and send your own to his device unwittingly. To have +tight control over the printer names, set BrowseShortNames +No. It will present any printer as "printername@cupshost" +then, giving you a better control over what may happen in a large +networked environment.

    How do I "watch" my Samba server?

    You can use tail -f +/var/log/samba/log.smbd (you may need a different path) to +see a live scrolling of all log messages. smbcontrol smbd +debuglevel tells you which verbosity goes into the +logs. smbcontrol smbd debug 3 sets the verbosity to +a quite high level (you can choose from 0 to 10 or 100). This works +"on the fly", without the need to restart the smbd daemon. Don't use +more than 3 initially; or you'll drown in an ocean of +messages.

    I can't use Samba from my WinXP Home box, while +access from WinXP Prof works flawlessly

    You have our condolences! WinXP home has been +completely neutered by Microsoft as compared to WinXP Prof: you can +not log into a WinNT domain. It cannot join a Win NT domain as a +member server. While it is possible to access domain resources, users +don't have "single sign-on". They need to supply username and password +each time they connect to a resource. Logon scripts and roaming +profiles are not supported. It can serve file and print shares; but +only in "share-mode security" level. It can not use "user-mode +security" (what Windows 95/98/ME still can +do).

    Where do I find the Adobe PostScript driver files +I need for "cupsaddsmb"?

    Use smbclient to connect to any +Windows box with a shared PostScript printer: smbclient +//windowsbox/print\$ -U guest. You can navigate to the +W32X86/2 subdir to mget ADOBE* +and other files or to WIN40/0 to do the same. -- +Another option is to download the *.exe packaged +files from the Adobe website.

    An Overview of the CUPS Printing Processes

    +

    Figure 19.15. CUPS Printing Overview

    CUPS Printing Overview

    +

    Chapter 20. Stackable VFS modules

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Tim Potter

    Simo Sorce

    original vfs_skel README

    Alexander Bokovoy

    original vfs_netatalk docs

    Stefan Metzmacher

    Update for multiple modules

    Table of Contents

    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    Common Errors

    Features and Benefits

    +Since Samba-3, there is support for stackable VFS(Virtual File System) modules. +Samba passes each request to access the unix file system thru the loaded VFS modules. +This chapter covers all the modules that come with the samba source and references to +some external modules. +

    Discussion

    +If not supplied with your platform distribution binary Samba package you may have problems +to compile these modules, as shared libraries are compiled and linked in different ways +on different systems. They currently have been tested against GNU/Linux and IRIX.

    -This is an example command how root would set a print quota in CUPS, -assuming an existing printer named "quotaprinter": +To use the VFS modules, create a share similar to the one below. The +important parameter is the vfs objects parameter where +you can list one or more VFS modules by name. For example, to log all access +to files and put deleted files in a recycle bin: + 

    -  lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 \
-       -o job-page-limit=100
+[audit]
+        comment = Audited /data directory
+        path = /data
+        vfs objects = audit recycle
+        writeable = yes
+        browseable = yes

    -This would limit every single user to print 100 pages or 1024 KB of -data (whichever comes first) within the last 604.800 seconds ( = 1 week).

    -For CUPS to count correctly, the printfile needs to pass the CUPS "pstops" filter, -otherwise it uses a "dummy" count of "1". Some printfiles don't pass it -(eg: image files) but then those are mostly 1 page jobs anyway. This also means, -proprietary drivers for the target printer running on the client computers and -CUPS/Samba then spooling these files as "raw" (i.e. leaving them untouched, not -filtering them), will be counted as "1-pagers" too! +The modules are used in the order in which they are specified.

    -You need to send PostScript from the clients (i.e. run a PostScript driver there) -for having the chance to get accounting done. If the printer is a non-PostScript model, -you need to let CUPS do the job to convert the file to a print-ready format for the -target printer. This will be working for currently ~1.000 different printer models, see +Samba will attempt to load modules from the lib +directory in the root directory of the samba installation (usually +/usr/lib/samba/vfs or /usr/local/samba/lib/vfs +). +

    +Some modules can be used twice for the same share. +This can be done using a configuration similar to the one below. + 

    -     http://www.linuxprinting.org/printer_list.cgi
+[test]
+        comment = VFS TEST
+        path = /data
+        writeable = yes
+        browseable = yes
+        vfs objects = example:example1 example example:test
+		example1: parameter = 1
+		example:  parameter = 5
+		test:	  parameter = 7

    -Before CUPS-1.1.16 your only option was to use the Adobe PostScript -Driver on the Windows clients. The output of this driver was not always -passed thru the "pstops" filter on the CUPS/Samba side, and therefor was -not counted correctly (the reason is that it often --- depending on the -"PPD" being used --- did write a "PJL"-header in front of the real -PostScript which made CUPS to skip the pstops and go directy to -the "pstoraster" stage). -

    -From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver -for Windows NT/2K/XP clients" (it is tagged in the download area of -http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). -It is *not* working for Win9x/ME clients. But it: -

    it guarantees to not write an PJL-header
    it guarantees to still read and support all PJL-options named in the driver PPD with its own means
    it guarantees the file going thru the "pstops" filter on the CUPS/Samba server
    it guarantees to page-count correctly the printfile

    -You can read more about the setup of this combination in the -manpage for "cupsaddsmb" (only present with CUPS installed, only -current with CUPS 1.1.16). -

    -These are the items CUPS logs in the "page_log" for every single *page* of a job: -

    Printer name
    User name
    Job ID
    Time of printing
    the page number
    the number of copies
    a billing info string (optional)

    -

    -Here is an extract of my CUPS server's page_log file to illustrate -the format and included items: -

    - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 1 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 2 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 3 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 4 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 5 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 6 2 #marketing -

    -This was Job ID "40", printed on "infotec_IS2027" by user "kurt", a 6-page job -printed in 2 copies and billed to "#marketing"... -

    -What flaws or shortcomings are there? -

    the ones named above
    - CUPS really counts the job pages being *processsed in software* - (going thru the "RIP") rather than the physical sheets successfully - leaving the printing device -- if there is a jam while printing - the 5th sheet out of 1000 and the job is aborted by the printer, - the "page count" will still show the figure of 1000 for that job -
    - all quotas are the same for all users (no flexibility to give the - boss a higher quota than the clerk) no support for groups -
    - no means to read out the current balance or "used-up" number of current quota -
    - a user having used up 99 sheets of 100 quota will still be able to send and print a 1.000 sheet job -
    - a user being denied a job because of a filled-up quota doesn't get a meaningful - error message from CUPS other than "client-error-not-possible". -

    -But this is the best system out there currently. And there are -huge improvements under development: -

    page counting will go into the "backends" (these talk - directly to the printer and will increase the count in sync with the - actual printing process -- a jam at the 5th sheet will lead to a stop in the counting)
    quotas will be handled more flexibly
    probably there will be support for users to inquire their "accounts" in advance
    probably there will be support for some other tools around this topic

    -Other than the current stage of the CUPS development, I don't -know any other ready-to-use tool which you could consider. -

    -You can download the driver files from -http://www.cups.org/software.html. -It is a separate package from the CUPS base software files, tagged as "CUPS 1.1.16 -Windows NT/2k/XP Printer Driver for SAMBA (tar.gz, 192k)". The filename to -download is "cups-samba-1.1.16.tar.gz". Upon untar-/unzip-ping it will reveal -the files: -

    - - cups-samba.install - cups-samba.license - cups-samba.readme - cups-samba.remove - cups-samba.ss - -

    -These have been packaged with the ESP meta packager software "EPM". The -*.install and *.remove files are simple shell script, which untars the -*.ss (which is nothing else than a tar-archive) and puts its contents -into /usr/share/cups/drivers/. Its contents are 3 files: -

    - - cupsdrvr.dll - cupsui.dll - cups.hlp - -

    Caution

    -Due to a bug one CUPS release puts the cups.hlp -into /usr/share/drivers/ instead of -/usr/share/cups/drivers/. To work around this, copy/move -the file after running the "./cups-samba.install" script manually to the right place: -

    - cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/ - -

    Note

    -This new CUPS PostScript driver is currently binary-only, but free -no source code is provided (yet). The reason is this: it has -been developed with the help of the Microsoft Driver Developer Kit (DDK) -and compiled with Microsoft Visual Studio 6. It is not clear to the driver -developers if they are allowed to distribute the whole of the source code -as Free Software. However, they will likely release the "diff" in source -code under the GPL, so anybody with a license of Visual Studio and a DDK -will be able to compile for him/herself. -

    -Once you have run the install script (and possibly manually moved the -"cups.hlp" file to "/usr/share/cups/drivers/"), the driver is ready to be -put into Samba's [print$] share (which often maps to "/etc/samba/drivers/" -and contains a subdir tree with WIN40 and W32X86 branches), by running -"cupsaddsmb" (see also "man cupsaddsmb" for CUPS 1.1.16). [Don't forget to -put root into the smbpasswd file by running "smbpasswd" should you run -this whole procedure for the first time.] Once the driver files are in the -[print$] share, they are ready to be downloaded and installed by the -Win NT/2k/XP clients. -

    Note

    - Win 9x/ME clients won't work with this driver. For these you'd - still need to use the ADOBE*.* drivers as previously. -

    Note

    - It is not harming if you've still the ADOBE*.* driver files from - previous installations in the "/usr/share/cups/drivers/" directory. - The new cupsaddsmb (from 1.1.16) will automatically use the - "newest" installed driver (which here then is the CUPS drivers). -

    Note

    - Should your Win clients have had the old ADOBE*.* files and the - Adobe PostScript drivers installed, the download and installation - of the new CUPS PostScript driver for Windows NT/2k/XP will fail - at first. -

    - It is not enough to "delete" the printer (as the driver files - will still be kept by the clients and re-used if you try to - re-install the printer). To really get rid of the Adobe driver - files on the clients, open the "Printers" folder (possibly via - "Start --> Settings --> Control Panel --> Printers"), right-click - onto the folder background and select "Server Properties". A - new dialog opens; select the "Drivers" tab; on the list select - the driver you want to delete and click on the "Delete" button. - (This will only work if there is no single printer left which - uses that particular driver -- you need to "delete" all printers - using this driver in the "Printers" folder first.) -

    Note

    - Once you have successfully downloaded the CUPS PostScript driver - to a client, you can easily switch all printers to this one - by proceeding as described elsewhere in the "Samba HOWTO - Collection" to change a driver for an existing printer. -

    -What are the benefits with the "CUPS PostScript driver for Windows NT/2k/XP" -as compared to the Adobe drivers? -

    -

    - no hassle with the Adobe EULA -

    - no hassle with the question "where do I get the ADOBE*.* driver files from?" -

    - the Adobe drivers (depending on the printer PPD associated with them) - often put a PJL header in front of the core PostScript part of the print - file (thus the file starts with "1B%-12345X" - or "escape%-12345X" - instead of "%!PS"). This leads to the CUPS daemon autotyping the - arriving file as a print-ready file, not requiring a pass thru the - "pstops" filter (to speak more technical, it is not regarded as the - generic MIME type "application/postscript", but as the more special - MIME type "application/cups.vnd-postscript"), which therefore also - leads to the page accounting in "/var/log/cups/page_log" not receiving - the exact mumber of pages; instead the dummy page number of "1" is - logged in a standard setup) -

    - the Adobe driver has more options to "mis-configure" the PostScript - generated by it (like setting it inadvertedly to "Optimize for Speed", - instead of "Optimize for Portability", which could lead to CUPS being - unable to process it) -

    - the CUPS PostScript driver output sent by Windows clients to the CUPS - server will be guaranteed to be auto-typed as generic MIME type - "application/postscript", thusly passing thru the CUPS "pstops" filter - and logging the correct number of pages in the page_log for accounting - and quota purposes -

    - the CUPS PostScript driver supports the sending of additional print - options by the Win NT/2k/XP clients, such as naming the CUPS standard - banner pages (or the custom ones, should they be installed at the time - of driver download), using the CUPS "page-label" option, setting a - job-priority and setting the scheduled time of printing (with the option - to support additional useful IPP job attributes in the future). -

    - the CUPS PostScript driver supports the inclusion of the new - "*cupsJobTicket" comments at the beginnig of the PostScript file (which - could be used in the future for all sort of beneficial extensions on - the CUPS side, but which will not disturb any other application as those - will regard it as a comment and simply ignore it). -

    - the CUPS PostScript driver will be the heart of the fully fledged CUPS - IPP client for Windows NT/2k/XP to be released soon (probably alongside - the first Beta release for CUPS 1.2). -

    -

    Advanced Postscript Printing from MS Windows

    -Let the Windows Clients use a PostScript driver to deliver poistscript to -the samba print server (just like any Linux or Unix Client would also use -PostScript to send to the server) -

    -Make the Unix printing subsystem to which Samba sends the job convert the -incoming PostScript files to the native print format of the target printers -(would be PCL if you have an HP printer) -

    -Now if you are afraid that this would just mean using a *Generic* PostScript -driver for the clients that has no Simplex/Duplex selection, and no paper tray -choice, but you need them to be able to set up print jobs, with all the bells -and whistles of your printers:- -

    Not possible with traditional spooling systems
    - But perfectly supported by CUPS (which uses "PPD" files to - describe how to control the print options for PostScript and - non-PostScript devices alike... -

    -CUPS PPDs are working perfectly on Windows clients who use Adobe PostScript -drivers (or the new CUPS PostScript driver for Windows NT/2K/XP). Clients can use -them to setup the job to their liking and CUPS will use the received job options -to make the (PCL-, ESC/P- or PostScript-) printer behave as required. -

    -If you want to have the additional benefit of page count logging and accounting -then the CUPS PostScript driver is the best choice (better than the Adobe one). -

    -If you want to make the drivers downloadable for the clients then "cupsaddsmb" is -your friend. It will setup the [print$] share on the Samba host to be ready to serve -the clients for a "point and print" driver installation. -

    Warning

    What strings are attached?

    -There are some. But, given the sheer CPU power you can buy nowadays, -these can be overcome easily. The strings: -

    -Well, if the CUPS/Samba side will have to print to many printers serving many users, -you probably will need to set up a second server (which can do automatic load balancing -with the first one, plus a degree of fail-over mechanism). Converting the incoming -PostScript jobs, "interpreting" them for non-PostScript printers, amounts to the work -of a "RIP" (Raster Image Processor) done in software. This requires more CPU and RAM -than for the mere "raw spooling" task your current setup is solving. It all depends -on the avarage and peak printing load the server should be able to handle. -

    Auto-Deletion of CUPS spool files

    -Samba print files pass thru two "spool" directories. One the incoming directory -managed by Samba, (set eg: in the path = /var/spool/samba directive in the [printers] -section of smb.conf). Second is the spool directory of your UNIX print subsystem. -For CUPS it is normally "/var/spool/cups/", as set by the cupsd.conf directive -"RequestRoot /var/spool/cups". -

    -I am not sure, which one of your directories keeps the files. From what you say, -it is most likely the Samba part. -

    -For the CUPS part, you may want to consult: -

    http://localhost:631/sam.html#PreserveJobFiles
    http://localhost:631/sam.html#PreserveJobHistory
    http://localhost:631/sam.html#MaxJobs

    -There are the settings described for your CUPS daemon, which could lead to completed -job files not being deleted. -

    -"PreserveJobHistory Yes" -- keeps some details of jobs in -cupsd's mind (well it keeps the "c12345", "c12346" etc. files -in the CUPS spool directory, which do a similar job as the -old-fashioned BSD-LPD control files). This is set to "Yes" -as a default. -

    -"PreserveJobFiles Yes" -- keeps the job files themselves in -cupsd's mind (well it keeps the "d12345", "d12346" etc. files -in the CUPS spool directory...). This is set to "No" as the -CUPS default. -

    -"MaxJobs 500" -- this directive controls the maximum number -of jobs that are kept in memory. Once the number of jobs -reaches the limit, the oldest completed job is automatically -purged from the system to make room for the new one. If all -of the known jobs are still pending or active then the new -job will be rejected. Setting the maximum to 0 disables this -functionality. The default setting is 0. -

    -(There are also additional settings for "MaxJobsPerUser" and -"MaxJobsPerPrinter"...) -

    -For everything to work as announced, you need to have three things: -

    - a Samba-smbd which is compiled against "libcups" (Check on Linux by running ldd `which smbd`) -
    - a Samba-smb.conf setting of printing = cups -
    - another Samba-smb.conf setting of printcap = cups -

    Note

    -Note, that in this case all other manually set printing-related -commands (like "print command", "lpq command", "lprm command", -"lppause command" or "lpresume command") are ignored and they -should normally have no influence what-so-ever on your printing. -

    -If you want to do things manually, replace the "printing = cups" -by "printing = bsd". Then your manually set commands may work -(haven't tested this), and a "print command = lp -d %P %s; rm %s" -may do what you need. -

    -You forgot to mention the CUPS version you're using. If you did -set things up as described in the man pages, then the Samba -spool files should be deleted. Otherwise it may be a bug. On -the CUPS side, you can control the behaviour as described -above. -

    -If you have more problems, post the output of these commands: -

    - - grep -v ^# /etc/cups/cupsd.conf | grep -v ^$ - grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;" - +

    Included modules

    audit

    + A simple module to audit file access to the syslog + facility. The following operations are logged: +

    share
    connect/disconnect
    directory opens/create/remove
    file open/close/rename/unlink/chmod

    +

    extd_audit

    + This module is identical with the audit module above except + that it sends audit logs to both syslog as well as the smbd log file/s. The + loglevel for this module is set in the smb.conf file. +

    + The logging information that will be written to the smbd log file is controlled by + the log level parameter in smb.conf. The + following information will be recorded: +

    Table 20.1. Extended Auditing Log Information

    Log LevelLog Details - File and Directory Operations
    0Creation / Deletion
    1Create / Delete / Rename / Permission Changes
    2Create / Delete / Rename / Perm Change / Open / Close

    fake_perms

    + This module was created to allow Roaming Profile files and directories to be set (on the Samba server + under Unix) as read only. This module will if installed on the Profiles share will report to the client + that the Profile files and directories are writable. This satisfies the client even though the files + will never be overwritten as the client logs out or shuts down. +

    recycle

    + A recycle-bin like module. When used any unlink call + will be intercepted and files moved to the recycle + directory instead of being deleted. +

    Supported options: +

    recycle:repository

    FIXME

    recycle:keeptree

    FIXME

    recycle:versions

    FIXME

    recycle:touch

    FIXME

    recycle:maxsize

    FIXME

    recycle:exclude

    FIXME

    recycle:exclude_dir

    FIXME

    recycle:noversions

    FIXME

    +

    netatalk

    + A netatalk module, that will ease co-existence of samba and + netatalk file sharing services. +

    Advantages compared to the old netatalk module: +

    it doesn't care about creating of .AppleDouble forks, just keeps them in sync
    if a share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically

    +

    VFS modules available elsewhere

    +This section contains a listing of various other VFS modules that +have been posted but don't currently reside in the Samba CVS +tree for one reason or another (e.g. it is easy for the maintainer +to have his or her own CVS tree).

    -(adapt paths as needed). These commands sanitize the files -and cut out the empty lines and lines with comments, providing -the "naked settings" in a compact way. -

    Chapter 15. Unified Logons between Windows NT and UNIX using Winbind

    Tim Potter

    Samba Team

    <tpot@linuxcare.com.au>

    Andrew Tridgell

    Samba Team

    <tridge@samba.org>

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    Naag Mummaneni

    <getnag@rediffmail.com>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    27 June 2002

    Table of Contents

    Abstract
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Limitations
    Conclusion

    Abstract

    Integration of UNIX and Microsoft Windows NT through +No statements about the stability or functionality of any module +should be implied due to its presence here. +

    DatabaseFS

    + URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php +

    By Eric Lorimer.

    + I have created a VFS module which implements a fairly complete read-only + filesystem. It presents information from a database as a filesystem in + a modular and generic way to allow different databases to be used + (originally designed for organizing MP3s under directories such as + "Artists," "Song Keywords," etc... I have since applied it to a student + roster database very easily). The directory structure is stored in the + database itself and the module makes no assumptions about the database + structure beyond the table it requires to run. +

    + Any feedback would be appreciated: comments, suggestions, patches, + etc... If nothing else, hopefully it might prove useful for someone + else who wishes to create a virtual filesystem. +

    vscan

    URL: http://www.openantivirus.org/

    + samba-vscan is a proof-of-concept module for Samba, which + uses the VFS (virtual file system) features of Samba 2.2.x/3.0 + alphaX. Of course, Samba has to be compiled with VFS support. + samba-vscan supports various virus scanners and is maintained + by Rainer Link. +

    Common Errors

    +There must be some gotchas we should record here! Jelmer??? +

    Chapter 21. Integrated Logon Support using Winbind

    Tim Potter

    Samba Team

    Andrew Tridgell

    Samba Team

    Naag Mummaneni

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    27 June 2002

    Table of Contents

    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors

    Features and Benefits

    Integration of UNIX and Microsoft Windows NT through a unified logon has been considered a "holy grail" in heterogeneous computing environments for a long time. We present winbind, a component of the Samba suite @@ -4897,7 +12044,7 @@ the "naked settings" in a compact way. Service Switch to allow Windows NT domain users to appear and operate as UNIX users on a UNIX machine. This paper describes the winbind system, explaining the functionality it provides, how it is configured, - and how it works internally.

    Introduction

    It is well known that UNIX and Microsoft Windows NT have + and how it works internally.

    Introduction

    It is well known that UNIX and Microsoft Windows NT have different models for representing user and group information and use different technologies for implementing them. This fact has made it difficult to integrate the two systems in a satisfactory @@ -4918,7 +12065,7 @@ the "naked settings" in a compact way. tasks for the system administrator when maintaining users and groups on either system. The winbind system provides a simple and elegant solution to all three components of the unified logon - problem.

    What Winbind Provides

    Winbind unifies UNIX and Windows NT account management by + problem.

    What Winbind Provides

    Winbind unifies UNIX and Windows NT account management by allowing a UNIX box to become a full member of a NT domain. Once this is done the UNIX box will see NT users and groups as if they were native UNIX users and groups, allowing the NT domain @@ -4942,7 +12089,7 @@ the "naked settings" in a compact way. to provide authentication via a NT domain to any PAM enabled applications. This capability solves the problem of synchronizing passwords between systems since all passwords are stored in a single - location (on the domain controller).

    Target Uses

    Winbind is targeted at organizations that have an + location (on the domain controller).

    Target Uses

    Winbind is targeted at organizations that have an existing NT based domain infrastructure into which they wish to put UNIX workstations or servers. Winbind will allow these organizations to deploy UNIX workstations without having to @@ -4952,12 +12099,12 @@ the "naked settings" in a compact way. be used is as a central part of UNIX based appliances. Appliances that provide file and print services to Microsoft based networks will be able to use Winbind to provide seamless integration of - the appliance into the domain.

    How Winbind Works

    The winbind system is designed around a client/server - architecture. A long running winbindd daemon + the appliance into the domain.

    How Winbind Works

    The winbind system is designed around a client/server + architecture. A long running winbindd daemon listens on a UNIX domain socket waiting for requests to arrive. These requests are generated by the NSS and PAM clients and processed sequentially.

    The technologies used to implement winbind are described - in detail below.

    Microsoft Remote Procedure Calls

    Over the last few years, efforts have been underway + in detail below.

    Microsoft Remote Procedure Calls

    Over the last few years, efforts have been underway by various Samba Team members to decode various aspects of the Microsoft Remote Procedure Call (MSRPC) system. This system is used for most network related operations between @@ -4970,7 +12117,7 @@ the "naked settings" in a compact way. users or groups. Other MSRPC calls can be used to authenticate NT domain users and to change user passwords. By directly querying a Windows PDC for user and group information, winbind maps the - NT account information onto UNIX user and group names.

    Microsoft Active Directory Services

    + NT account information onto UNIX user and group names.

    Microsoft Active Directory Services

    Since late 2001, Samba has gained the ability to interact with Microsoft Windows 2000 using its 'Native Mode' protocols, rather than the NT4 RPC services. @@ -4979,7 +12126,7 @@ the "naked settings" in a compact way. same way as a Win2k client would, and in so doing provide a much more efficient and effective winbind implementation. -

    Name Service Switch

    The Name Service Switch, or NSS, is a feature that is +

    Name Service Switch

    The Name Service Switch, or NSS, is a feature that is present in many UNIX operating systems. It allows system information such as hostnames, mail aliases and user information to be resolved from different sources. For example, a standalone @@ -4996,25 +12143,27 @@ the "naked settings" in a compact way. a UNIX machine running winbind and see all users and groups in a NT domain plus any trusted domain as though they were local users and groups.

    The primary control file for NSS is - /etc/nsswitch.conf. + /etc/nsswitch.conf. When a UNIX application makes a request to do a lookup - the C library looks in /etc/nsswitch.conf + the C library looks in /etc/nsswitch.conf for a line which matches the service type being requested, for example the "passwd" service type is used when user or group names are looked up. This config line species which implementations of that service should be tried and in what order. If the passwd - config line is:

    passwd: files example

    then the C library will first load a module called - /lib/libnss_files.so followed by - the module /lib/libnss_example.so. The + config line is:

    +passwd: files example
+

    then the C library will first load a module called + /lib/libnss_files.so followed by + the module /lib/libnss_example.so. The C library will dynamically load each of these modules in turn and call resolver functions within the modules to try to resolve the request. Once the request is resolved the C library returns the result to the application.

    This NSS interface provides a very easy way for Winbind to hook into the operating system. All that needs to be done - is to put libnss_winbind.so in /lib/ - then add "winbind" into /etc/nsswitch.conf at + is to put libnss_winbind.so in /lib/ + then add "winbind" into /etc/nsswitch.conf at the appropriate place. The C library will then call Winbind to - resolve user and group names.

    Pluggable Authentication Modules

    Pluggable Authentication Modules, also known as PAM, + resolve user and group names.

    Pluggable Authentication Modules

    Pluggable Authentication Modules, also known as PAM, is a system for abstracting authentication and authorization technologies. With a PAM module it is possible to specify different authentication methods for different system applications without @@ -5029,17 +12178,17 @@ the "naked settings" in a compact way. Controller. These users can also change their passwords and have this change take effect directly on the Primary Domain Controller.

    PAM is configured by providing control files in the directory - /etc/pam.d/ for each of the services that + /etc/pam.d/ for each of the services that require authentication. When an authentication request is made by an application the PAM code in the C library looks up this control file to determine what modules to load to do the authentication check and in what order. This interface makes adding a new authentication service for Winbind very easy, all that needs - to be done is that the pam_winbind.so module - is copied to /lib/security/ and the PAM + to be done is that the pam_winbind.so module + is copied to /lib/security/ and the PAM control files for relevant services are updated to allow authentication via winbind. See the PAM documentation - for more details.

    User and Group ID Allocation

    When a user or group is created under Windows NT + for more details.

    User and Group ID Allocation

    When a user or group is created under Windows NT is it allocated a numerical relative identifier (RID). This is slightly different to UNIX which has a range of numbers that are used to identify users, and the same range in which to identify @@ -5052,7 +12201,7 @@ the "naked settings" in a compact way. time, winbind will have mapped all Windows NT users and groups to UNIX user ids and group ids.

    The results of this mapping are stored persistently in an ID mapping database held in a tdb database). This ensures that - RIDs are mapped to UNIX IDs in a consistent way.

    Result Caching

    An active system can generate a lot of user and group + RIDs are mapped to UNIX IDs in a consistent way.

    Result Caching

    An active system can generate a lot of user and group name lookups. To reduce the network cost of these lookups winbind uses a caching scheme based on the SAM sequence number supplied by NT domain controllers. User or group information returned @@ -5063,16 +12212,16 @@ the "naked settings" in a compact way. the PDC and compared against the sequence number of the cached entry. If the sequence numbers do not match, then the cached information is discarded and up to date information is requested directly - from the PDC.

    Installation and Configuration

    + from the PDC.

    Installation and Configuration

    Many thanks to John Trostel jtrostel@snapserver.com for providing the HOWTO for this section.

    This HOWTO describes how to get winbind services up and running to control access and authenticate users on your Linux box using the winbind services which come with SAMBA 3.0. -

    Introduction

    -This HOWTO describes the procedures used to get winbind up and -running on my RedHat 7.1 system. Winbind is capable of providing access +

    Introduction

    +This section describes the procedures used to get winbind up and +running on a RedHat 7.1 system. Winbind is capable of providing access and authentication control for Windows Domain users through an NT or Win2K PDC for 'regular' services, such as telnet a nd ftp, as well for SAMBA services. @@ -5095,17 +12244,17 @@ somewhat to fit the way your distribution works. SAMBA server, this HOWTO is for you. That said, I am no NT or PAM expert, so you may find a better or easier way to accomplish these tasks. -

    Requirements

    -If you have a samba configuration file that you are currently +

    Requirements

    +If you have a Samba configuration file that you are currently using... BACK IT UP! If your system already uses PAM, -back up the /etc/pam.d directory +back up the /etc/pam.d directory contents! If you haven't already made a boot disk, MAKE ONE NOW!

    -Messing with the pam configuration files can make it nearly impossible -to log in to yourmachine. That's why you want to be able to boot back +Messing with the PAM configuration files can make it nearly impossible +to log in to your machine. That's why you want to be able to boot back into your machine in single user mode and restore your -/etc/pam.d back to the original state they were in if +/etc/pam.d back to the original state they were in if you get frustrated with the way things are going. ;-)

    The latest version of SAMBA (version 3.0 as of this writing), now @@ -5120,54 +12269,54 @@ SAMBA machine, PAM (pluggable authentication modules) must be setup properly on your machine. In order to compile the winbind modules, you should have at least the pam libraries resident on your system. For recent RedHat systems (7.1, for instance), that -means pam-0.74-22. For best results, it is helpful to also -install the development packages in pam-devel-0.74-22. -

    Testing Things Out

    +means pam-0.74-22. For best results, it is helpful to also +install the development packages in pam-devel-0.74-22. +

    Testing Things Out

    Before starting, it is probably best to kill off all the SAMBA -related daemons running on your server. Kill off all smbd, -nmbd, and winbindd processes that may +related daemons running on your server. Kill off all smbd, +nmbd, and winbindd processes that may be running. To use PAM, you will want to make sure that you have the -standard PAM package (for RedHat) which supplies the /etc/pam.d +standard PAM package (for RedHat) which supplies the /etc/pam.d directory structure, including the pam modules are used by pam-aware -services, several pam libraries, and the /usr/doc -and /usr/man entries for pam. Winbind built better +services, several pam libraries, and the /usr/doc +and /usr/man entries for pam. Winbind built better in SAMBA if the pam-devel package was also installed. This package includes -the header files needed to compile pam-aware applications. For instance, -my RedHat system has both pam-0.74-22 and -pam-devel-0.74-22 RPMs installed. -

    Configure and compile SAMBA

    +the header files needed to compile pam-aware applications. +

    Configure and compile SAMBA

    The configuration and compilation of SAMBA is pretty straightforward. The first three steps may not be necessary depending upon whether or not you have previously built the Samba binaries. -

    -root# autoconf
-root# make clean
-root# rm config.cache
-root# ./configure
-root# make
-root# make install
-

    -This will, by default, install SAMBA in /usr/local/samba. +

    +root# autoconf
+root# make clean
+root# rm config.cache
+root# ./configure
+root# make
+root# make install
+

    +This will, by default, install SAMBA in /usr/local/samba. See the main SAMBA documentation if you want to install SAMBA somewhere else. It will also build the winbindd executable and libraries. -

    Configure nsswitch.conf and the -winbind libraries on Linux and Solaris

    -The libraries needed to run the winbindd daemon +

    Configure nsswitch.conf and the +winbind libraries on Linux and Solaris

    +The libraries needed to run the winbindd daemon through nsswitch need to be copied to their proper locations, so

    -root# cp ../samba/source/nsswitch/libnss_winbind.so /lib +

    +root# cp ../samba/source/nsswitch/libnss_winbind.so /lib
+

    I also found it necessary to make the following symbolic link:

    -root# ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2 -

    And, in the case of Sun solaris:

    -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1 -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1 -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2 -

    -Now, as root you need to edit /etc/nsswitch.conf to -allow user and group entries to be visible from the winbindd -daemon. My /etc/nsswitch.conf file look like +root# ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2 +

    And, in the case of Sun Solaris:

    +root# ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1
+root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1
+root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2
+

    +Now, as root you need to edit /etc/nsswitch.conf to +allow user and group entries to be visible from the winbindd +daemon. My /etc/nsswitch.conf file look like this after editing: 

     	passwd:     files winbind
@@ -5175,15 +12324,15 @@ this after editing:
 	group:      files winbind

    The libraries needed by the winbind daemon will be automatically -entered into the ldconfig cache the next time +entered into the ldconfig cache the next time your system reboots, but it is faster (and you don't need to reboot) if you do it manually:

    -root# /sbin/ldconfig -v | grep winbind +root# /sbin/ldconfig -v | grep winbind

    -This makes libnss_winbind available to winbindd +This makes libnss_winbind available to winbindd and echos back a check to you. -

    NSS Winbind on AIX

    (This section is only for those running AIX)

    +

    NSS Winbind on AIX

    (This section is only for those running AIX)

    The winbind AIX identification module gets built as libnss_winbind.so in the nsswitch directory of the samba source. This file can be copied to /usr/lib/security, and the AIX naming convention would indicate that it @@ -5193,22 +12342,22 @@ WINBIND: program = /usr/lib/security/WINBIND options = authonly

    can then be added to -/usr/lib/security/methods.cfg. This module only +/usr/lib/security/methods.cfg. This module only supports identification, but there have been success reports using the standard winbind pam module for authentication. Use caution configuring loadable authentication modules as it is possible to make it impossible to logon to the system. More information about the AIX authentication module API can be found at "Kernel Extensions and Device Support -Programming Concepts for AIX": +Programming Concepts for AIX": Chapter 18. Loadable Authentication Module Programming Interface -and more information on administering the modules at +and more information on administering the modules at "System Management Guide: Operating System and Devices". -

    Configure smb.conf

    +

    Configure smb.conf

    Several parameters are needed in the smb.conf file to control -the behavior of winbindd. Configure -smb.conf These are described in more detail in -the winbindd(8) man page. My -smb.conf file was modified to +the behavior of winbindd. Configure +smb.conf These are described in more detail in +the winbindd(8) man page. My +smb.conf file was modified to include the following entries in the [global] section: 

     [global]
@@ -5216,61 +12365,61 @@ include the following entries in the [global] section:
      # separate domain and username with '+', like DOMAIN+username
      winbind separator = +
      # use uids from 10000 to 20000 for domain users
-     winbind uid = 10000-20000
+     idmap uid = 10000-20000
      # use gids from 10000 to 20000 for domain groups
-     winbind gid = 10000-20000
+     idmap gid = 10000-20000
      # allow enumeration of winbind users and groups
      winbind enum users = yes
      winbind enum groups = yes
      # give winbind users a real shell (only needed if they have telnet access)
      template homedir = /home/winnt/%D/%U
      template shell = /bin/bash
-

    Join the SAMBA server to the PDC domain

    +

    Join the SAMBA server to the PDC domain

    Enter the following command to make the SAMBA server join the -PDC domain, where DOMAIN is the name of -your Windows domain and Administrator is +PDC domain, where DOMAIN is the name of +your Windows domain and Administrator is a domain user who has administrative privileges in the domain.

    -root# /usr/local/samba/bin/net join -S PDC -U Administrator +root# /usr/local/samba/bin/net join -S PDC -U Administrator

    The proper response to the command should be: "Joined the domain -DOMAIN" where DOMAIN +DOMAIN" where DOMAIN is your DOMAIN name. -

    Start up the winbindd daemon and test it!

    +

    Start up the winbindd daemon and test it!

    Eventually, you will want to modify your smb startup script to automatically invoke the winbindd daemon when the other parts of SAMBA start, but it is possible to test out just the winbind portion first. To start up winbind services, enter the following command as root:

    -root# /usr/local/samba/bin/winbindd +root# /usr/local/samba/bin/winbindd

    Winbindd can now also run in 'dual daemon mode'. This will make it run as 2 processes. The first will answer all requests from the cache, thus making responses to clients faster. The other will update the cache for the query that the first has just responded. Advantage of this is that responses stay accurate and are faster. -You can enable dual daemon mode by adding '-B' to the commandline: +You can enable dual daemon mode by adding -B to the commandline:

    -root# /usr/local/samba/bin/winbindd -B +root# /usr/local/samba/bin/winbindd -B

    I'm always paranoid and like to make sure the daemon is really running...

    -root# ps -ae | grep winbindd +root# ps -ae | grep winbindd

    This command should produce output like this, if the daemon is running -

    +

     3025 ?        00:00:00 winbindd
-
    
+

    Now... for the real test, try to get some information about the users on your PDC

    -root# /usr/local/samba/bin/wbinfo -u +root# /usr/local/samba/bin/wbinfo -u

    This should echo back a list of users on your Windows users on your PDC. For example, I get the following response: -

    +
     	CEO+Administrator
 	CEO+burdell
 	CEO+Guest
@@ -5278,13 +12427,13 @@ your PDC.  For example, I get the following response:
 	CEO+krbtgt
 	CEO+TsInternetUser
 
    
-Obviously, I have named my domain 'CEO' and my winbind
+Obviously, I have named my domain 'CEO' and my winbind
 separator is '+'.
 
    
 You can do the same sort of thing to get group information from 
 the PDC:
-
    -root# /usr/local/samba/bin/wbinfo -g
+
    +root# /usr/local/samba/bin/wbinfo -g
 	CEO+Domain Admins
 	CEO+Domain Users
 	CEO+Domain Guests
@@ -5299,25 +12448,24 @@ The function 'getent' can now be used to get unified
 lists of both local and PDC users and groups.
 Try the following command:
 
    
-root# getent passwd
+root# getent passwd
 
    
-You should get a list that looks like your /etc/passwd 
+You should get a list that looks like your /etc/passwd 
 list followed by the domain users with their new uids, gids, home 
 directories and default shells.
 
    
 The same thing can be done for groups with the command
 
    
-root# getent group
-

    Fix the init.d startup scripts

    Linux

    -The winbindd daemon needs to start up after the -smbd and nmbd daemons are running. +root# getent group +

    Fix the init.d startup scripts

    Linux

    +The winbindd daemon needs to start up after the +smbd and nmbd daemons are running. To accomplish this task, you need to modify the startup scripts of your system. -They are located at /etc/init.d/smb in RedHat and -/etc/init.d/samba in Debian. +They are located at /etc/init.d/smb in RedHat and +/etc/init.d/samba in Debian. script to add commands to invoke this daemon in the proper sequence. My -startup script starts up smbd, -nmbd, and winbindd from the -/usr/local/samba/bin directory directly. The 'start' +startup script starts up smbd, nmbd, and winbindd from the +/usr/local/samba/bin directory directly. The 'start' function in the script looks like this: 

     start() {
@@ -5375,10 +12523,10 @@ stop() {
         echo ""
         return $RETVAL
 }
-
    Solaris

    Winbind doesn't work on solaris 9, see the Portability chapter for details.

    On solaris, you need to modify the -/etc/init.d/samba.server startup script. It usually +

    Solaris

    Winbind doesn't work on Solaris 9, see the Portability chapter for details.

    On Solaris, you need to modify the +/etc/init.d/samba.server startup script. It usually only starts smbd and nmbd but should now start winbindd too. If you -have samba installed in /usr/local/samba/bin, +have samba installed in /usr/local/samba/bin, the file could contains something like this: 

     	##
@@ -5438,34 +12586,33 @@ in the script above with:
 
     	/usr/local/samba/bin/winbindd -B
 
    
-
    Restarting

    -If you restart the smbd, nmbd, -and winbindd daemons at this point, you +

    Restarting

    +If you restart the smbd, nmbd, and winbindd daemons at this point, you should be able to connect to the samba server as a domain member just as if you were a local user. -

    Configure Winbind and PAM

    +

    Configure Winbind and PAM

    If you have made it this far, you know that winbindd and samba are working together. If you want to use winbind to provide authentication for other services, keep reading. The pam configuration files need to be altered in this step. (Did you remember to make backups of your original -/etc/pam.d files? If not, do it now.) +/etc/pam.d files? If not, do it now.)

    You will need a pam module to use winbindd with these other services. This -module will be compiled in the ../source/nsswitch directory +module will be compiled in the ../source/nsswitch directory by invoking the command

    -root# make nsswitch/pam_winbind.so +root# make nsswitch/pam_winbind.so

    -from the ../source directory. The -pam_winbind.so file should be copied to the location of +from the ../source directory. The +pam_winbind.so file should be copied to the location of your other pam security modules. On my RedHat system, this was the -/lib/security directory. On Solaris, the pam security -modules reside in /usr/lib/security. +/lib/security directory. On Solaris, the pam security +modules reside in /usr/lib/security.

    -root# cp ../samba/source/nsswitch/pam_winbind.so /lib/security -

    Linux/FreeBSD-specific PAM configuration

    -The /etc/pam.d/samba file does not need to be changed. I -just left this fileas it was: +root# cp ../samba/source/nsswitch/pam_winbind.so /lib/security +

    Linux/FreeBSD-specific PAM configuration

    +The /etc/pam.d/samba file does not need to be changed. I +just left this file as it was: 

     	auth    required        /lib/security/pam_stack.so service=system-auth
 	account required        /lib/security/pam_stack.so service=system-auth
@@ -5474,10 +12621,10 @@ The other services that I modified to allow the use of winbind
 as an authentication service were the normal login on the console (or a terminal 
 session), telnet logins, and ftp service.  In order to enable these 
 services, you may first need to change the entries in 
-/etc/xinetd.d (or /etc/inetd.conf).  
+/etc/xinetd.d (or /etc/inetd.conf).  
 RedHat 7.1 uses the new xinetd.d structure, in this case you need 
-to change the lines in /etc/xinetd.d/telnet 
-and /etc/xinetd.d/wu-ftp from 
+to change the lines in /etc/xinetd.d/telnet 
+and /etc/xinetd.d/wu-ftp from 
 
     	enable = no
 
    
@@ -5489,12 +12636,12 @@ For ftp services to work properly, you will also need to either
 have individual directories for the domain users already present on 
 the server, or change the home directory template to a general
 directory for all domain users.  These can be easily set using 
-the smb.conf global entry 
-template homedir.
+the smb.conf global entry 
+template homedir.
 
    
-The /etc/pam.d/ftp file can be changed 
+The /etc/pam.d/ftp file can be changed 
 to allow winbind ftp access in a manner similar to the
-samba file.  My /etc/pam.d/ftp file was 
+samba file.  My /etc/pam.d/ftp file was 
 changed to look like this:
 
     	auth       required     /lib/security/pam_listfile.so item=user sense=deny \
@@ -5506,7 +12653,7 @@ changed to look like this:
 	account    required     /lib/security/pam_stack.so service=system-auth
 	session    required     /lib/security/pam_stack.so service=system-auth
 
    
-The /etc/pam.d/login file can be changed nearly the 
+The /etc/pam.d/login file can be changed nearly the 
 same way.  It now looks like this:
 
     	auth       required     /lib/security/pam_securetty.so
@@ -5520,13 +12667,13 @@ same way.  It now looks like this:
 	session    required     /lib/security/pam_stack.so service=system-auth
 	session    optional     /lib/security/pam_console.so
 
    
-In this case, I added the auth sufficient /lib/security/pam_winbind.so 
-lines as before, but also added the required pam_securetty.so 
+In this case, I added the 
    auth sufficient /lib/security/pam_winbind.so
     
+lines as before, but also added the 
    required pam_securetty.so
    
 above it, to disallow root logins over the network.  I also added a 
-sufficient /lib/security/pam_unix.so use_first_pass
-line after the winbind.so line to get rid of annoying 
+sufficient /lib/security/pam_unix.so use_first_pass
+line after the winbind.so line to get rid of annoying 
 double prompts for passwords.
-
    Solaris-specific configuration

    +

    Solaris-specific configuration

    The /etc/pam.conf needs to be changed. I changed this file so that my Domain users can logon both locally as well as telnet.The following are the changes that I made.You can customize the pam.conf file as per your requirements,but @@ -5598,7 +12745,12 @@ annoying double prompts for passwords.

    Now restart your Samba and try connecting through your application that you configured in the pam.conf. -

    Limitations

    Winbind has a number of limitations in its current +

    Conclusion

    The winbind system, through the use of the Name Service + Switch, Pluggable Authentication Modules, and appropriate + Microsoft RPC calls have allowed us to provide seamless + integration of Microsoft Windows NT domain users on a + UNIX system. The result is a great reduction in the administrative + cost of running a mixed UNIX and NT network.

    Common Errors

    Winbind has a number of limitations in its current released version that we hope to overcome in future releases:

    • Winbind is currently only available for the Linux, Solaris and IRIX operating systems, although ports to other operating @@ -5606,105 +12758,148 @@ configured in the pam.conf. we require the C library of the target operating system to support the Name Service Switch and Pluggable Authentication Modules systems. This is becoming more common as NSS and - PAM gain support among UNIX vendors.

    • The mappings of Windows NT RIDs to UNIX ids + PAM gain support among UNIX vendors.

    • The mappings of Windows NT RIDs to UNIX ids is not made algorithmically and depends on the order in which unmapped users or groups are seen by winbind. It may be difficult to recover the mappings of rid to UNIX id mapping if the file containing this information is corrupted or destroyed.

    • Currently the winbind PAM module does not take into account possible workstation and logon time restrictions that may be been set for Windows NT users, this is - instead up to the PDC to enforce.

    Conclusion

    The winbind system, through the use of the Name Service - Switch, Pluggable Authentication Modules, and appropriate - Microsoft RPC calls have allowed us to provide seamless - integration of Microsoft Windows NT domain users on a - UNIX system. The result is a great reduction in the administrative - cost of running a mixed UNIX and NT network.

    Chapter 16. Advanced Network Manangement

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    April 3 2003

    Table of Contents

    Configuring Samba Share Access Controls
    Share Permissions Management
    Remote Server Administration
    Network Logon Script Magic
    Adding printers without user intervention

    -This section attempts to document peripheral issues that are of great importance to network + instead up to the PDC to enforce.

    Chapter 22. Advanced Network Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors

    +This section documents peripheral issues that are of great importance to network administrators who want to improve network resource access control, to automate the user environment, and to make their lives a little easier. -

    Configuring Samba Share Access Controls

    -This section deals with how to configure Samba per share access control restrictions. -By default samba sets no restrictions on the share itself. Restrictions on the share itself -can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can -connect to a share. In the absence of specific restrictions the default setting is to allow -the global user Everyone Full Control (ie: Full control, Change and Read). -

    -At this time Samba does NOT provide a tool for configuring access control setting on the Share -itself. Samba does have the capacity to store and act on access control settings, but the only -way to create those settings is to use either the NT4 Server Manager or the Windows 200x MMC for -Computer Management. -

    -Samba stores the per share access control settings in a file called share_info.tdb. -The location of this file on your system will depend on how samba was compiled. The default location -for samba's tdb files is under /usr/local/samba/var. If the tdbdump -utility has been compiled and installed on your system then you can examine the contents of this file -by: tdbdump share_info.tdb. -

    Share Permissions Management

    -The best tool for the task is platform dependant. Choose the best tool for your environmemt. -

    Windows NT4 Workstation/Server

    -The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. -Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. -You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below. -

    Procedure 16.1. Instructions

    1. -Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu -select Computer, then click on the Shared Directories entry. -

    2. - Now click on the share that you wish to manage, then click on the Properties tab, next click on - the Permissions tab. Now you can Add or change access control settings as you wish. -

    Windows 200x/XP

    -On MS Windows NT4/200x/XP system access control lists on the share itself are set using native -tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder, -then select 'Sharing', then click on 'Permissions'. The default Windows NT4/200x permission allows -Everyone Full Control on the Share. -

    -MS Windows 200x and later all comes with a tool called the 'Computer Management' snap-in for the -Microsoft Management Console (MMC). This tool is located by clicking on Control Panel -> -Administrative Tools -> Computer Management. -

    Procedure 16.2. Instructions

    1. - After launching the MMC with the Computer Management snap-in, click on the menu item 'Action', - select 'Connect to another computer'. If you are not logged onto a domain you will be prompted - to enter a domain login user identifier and a password. This will authenticate you to the domain. - If you where already logged in with administrative privilidge this step is not offered. -

    2. -If the Samba server is not shown in the Select Computer box, then type in the name of the target -Samba server in the field 'Name:'. Now click on the [+] next to 'System Tools', then on the [+] -next to 'Shared Folders' in the left panel. -

    3. -Now in the right panel, double-click on the share you wish to set access control permissions on. -Then click on the tab 'Share Permissions'. It is now possible to add access control entities -to the shared folder. Do NOT forget to set what type of access (full control, change, read) you -wish to assign for each entry. -

    Warning

    -Be careful. If you take away all permissions from the Everyone user without removing this user -then effectively no user will be able to access the share. This is a result of what is known as -ACL precidence. ie: Everyone with NO ACCESS means that MaryK who is part of the group Everyone -will have no access even if this user is given explicit full control access. -

    Remote Server Administration

    +

    Features and Benefits

    +Often the difference between a working network environment and a well appreciated one can +best be measured by the little things that makes everything work more +harmoniously. A key part of every network environment solution is the ability to remotely +manage MS Windows workstations, to remotely access the Samba server, to provide customised +logon scripts, as well as other house keeping activities that help to sustain more reliable +network operations. +

    +This chapter presents information on each of these area. They are placed here, and not in +other chapters, for ease of reference. +

    Remote Server Administration

    How do I get 'User Manager' and 'Server Manager'?

    -Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains', + Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains', the 'Server Manager'?

    -Microsoft distributes a version of these tools called nexus for installation on Windows 9x / Me -systems. The tools set includes: -

    • Server Manager

    • User Manager for Domains

    • Event Viewer

    +Microsoft distributes a version of these tools called nexus for installation +on Windows 9x / Me systems. The tools set includes: +

    Server Manager
    User Manager for Domains
    Event Viewer

    Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE

    -The Windows NT 4.0 version of the 'User Manager for -Domains' and 'Server Manager' are available from Microsoft via ftp -from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE -

    Network Logon Script Magic

    +The Windows NT 4.0 version of the 'User Manager for +Domains' and 'Server Manager' are available from Microsoft via ftp +from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE +

    Remote Desktop Management

    +There are a number of possible remote desktop management solutions that range from free +through costly. Do not let that put you off. Sometimes the most costly solutions is the +most cost effective. In any case, you will need to draw your own conclusions as to which +is the best tool in your network environment. +

    Remote Management from NoMachines.Com

    + The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003. + It is presented in slightly edited form (with author details omitted for privacy reasons). + The entire answer is reproduced below with some comments removed. +

    +

    +> I have a wonderful linux/samba server running as PDC for a network.
+> Now I would like to add remote desktop capabilities so that
+> users outside could login to the system and get their desktop up from
+> home or another country..
+>
+> Is there a way to accomplish this? Do I need a windows terminal server?
+> Do I need to configure it so that it is a member of the domain or a
+> BDC,PDC? Are there any hacks for MS Windows XP to enable remote login
+> even if the computer is in a domain?
+>
+> Any ideas/experience would be appreciated :)
+

    +

    + Answer provided: Check out the new offer from NoMachine, "NX" software: + http://www.nomachine.com/. +

    + It implements a very easy-to-use interface to the remote X protocol as + well as incorporating VNC/RFB and rdesktop/RDP into it, but at a speed + performance much better than anything you may have ever seen... +

    + Remote X is not new at all -- but what they did achieve successfully is + a new way of compression and caching technologies which makes the thing + fast enough to run even over slow modem/ISDN connections. +

    + I could test drive their (public) RedHat machine in Italy, over a loaded + internet connection, with enabled thumbnail previews in KDE konqueror + which popped up immediately on "mouse-over". From inside that (remote X) + session I started a rdesktop session on another, a Windows XP machine. + To test the performance, I played Pinball. I am proud to announce here + that my score was 631750 points at first try... +

    + NX performs better on my local LAN than any of the other "pure" + connection methods I am using from time to time: TightVNC, rdesktop or + remote X. It is even faster than a direct crosslink connection between + two nodes. +

    + I even got sound playing from the remote X app to my local boxes, and + had a working "copy'n'paste" from an NX window (running a KDE session + in Italy) to my Mozilla mailing agent... These guys are certainly doing + something right! +

    + I recommend to test drive NX to anybody with a only a remote interest + in remote computing + http://www.nomachine.com/testdrive.php. +

    + Just download the free of charge client software (available for RedHat, + SuSE, Debian and Windows) and be up and running within 5 minutes (they + need to send you your account data, though, because you are assigned + a real Unix account on their testdrive.nomachine.com box... +

    + They plan to get to the point were you can have NX application servers + running as a cluster of nodes, and users simply start an NX session locally, + and can select applications to run transparently (apps may even run on + another NX node, but pretend to be on the same as used for initial login, + because it displays in the same window.... well, you also can run it + fullscreen, and after a short time you forget that it is a remote session + at all). +

    + Now the best thing at the end: all the core compression and caching + technologies are released under the GPL and available as source code + to anybody who wants to build on it! These technologies are working, + albeit started from the command line only (and very inconvenient to + use in order to get a fully running remote X session up and running....) +

    + To answer your questions: +

    • + You don't need to install a terminal server; XP has RDP support built in. +

    • + NX is much cheaper than Citrix -- and comparable in performance, probably faster +

    • + You don't need to hack XP -- it just works +

    • + You log into the XP box from remote transparently (and I think there is no + need to change anything to get a connection, even if authentication is against a domain) +

    • + The NX core technologies are all Open Source and released under the GPL -- + you can today use a (very inconvenient) commandline to use it at no cost, + but you can buy a comfortable (proprietary) NX GUI frontend for money +

    • + NoMachine are encouraging and offering help to OSS/Free Software implementations + for such a frontend too, even if it means competition to them (they have written + to this effect even to the LTSP, KDE and GNOME developer mailing lists) +

    Network Logon Script Magic

    This section needs work. Volunteer contributions most welcome. Please send your patches or updates to John Terpstra.

    There are several opportunities for creating a custom network startup configuration environment. -

    \n", _(heading)); last_heading = heading; @@ -523,10 +519,12 @@ static void show_main_buttons(void) ****************************************************************************/ static void ViewModeBoxes(int mode) { - d_printf("

    %s\n", _("Configuration View: ")); + d_printf("

    %s\n", _("Current View Is:  \n")); d_printf("Basic\n", (mode == 0) ? "checked" : ""); d_printf("Advanced\n", (mode == 1) ? "checked" : ""); - d_printf("Developer\n", (mode == 2) ? "checked" : ""); + d_printf("
    %s\n", _("Change View To: ")); + d_printf("\n", _("Basic")); + d_printf("\n", _("Advanced")); d_printf("


    \n"); } @@ -782,6 +780,10 @@ static void globals_page(void) if ( cgi_variable("ViewMode") ) mode = atoi(cgi_variable("ViewMode")); + if ( cgi_variable("BasicMode")) + mode = 0; + if ( cgi_variable("AdvMode")) + mode = 1; d_printf("
    \n"); @@ -793,9 +795,6 @@ static void globals_page(void) case 1: parm_filter = FLAG_ADVANCED; break; - case 2: - parm_filter = FLAG_DEVELOPER; - break; } d_printf("
    \n"); if (have_write_access) { @@ -854,8 +853,14 @@ static void shares_page(void) d_printf("\n"); d_printf("
    No Logon Script
    Simple universal Logon Script that applies to all users
    Use of a conditional Logon Script that applies per user or per group attirbutes
    Use of Samba's Preexec and Postexec functions on access to the NETLOGON share to create +

    No Logon Script
    Simple universal Logon Script that applies to all users
    Use of a conditional Logon Script that applies per user or per group attributes
    Use of Samba's Preexec and Postexec functions on access to the NETLOGON share to create a custom Logon Script and then execute it.
    User of a tool such as KixStart

    -The Samba source code tree includes two logon script generation/execution tools. See examples directory genlogon and ntlogon subdirectories. +The Samba source code tree includes two logon script generation/execution tools. +See examples directory genlogon and +ntlogon subdirectories.

    The following listings are from the genlogon directory.

    -This is the genlogon.pl file: +This is the genlogon.pl file: 

     	#!/usr/bin/perl
@@ -5781,15 +12976,46 @@ This is the genlogon.pl file:

    Those wishing to use more elaborate or capable logon processing system should check out the following sites: -

    http://www.craigelachie.org/rhacer/ntlogon
    http://www.kixtart.org
    http://support.microsoft.com/default.asp?scid=kb;en-us;189105

    Adding printers without user intervention

    +

    http://www.craigelachie.org/rhacer/ntlogon
    http://www.kixtart.org
    http://support.microsoft.com/default.asp?scid=kb;en-us;189105

    Adding printers without user intervention

    Printers may be added automatically during logon script processing through the use of: 

     	rundll32 printui.dll,PrintUIEntry /?

    -See the documentation in the Microsoft knowledgebase article no: 189105 referred to above. -

    Chapter 17. System and Account Policies

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    April 3 2003

    Table of Contents

    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    With Windows NT4/200x
    With a Samba PDC
    System Startup and Logon Processing Overview

    Creating and Managing System Policies

    +See the documentation in the Microsoft knowledgebase article no: 189105. +

    Common Errors

    +The information provided in this chapter has been reproduced from postings on the samba@samba.org +mailing list. No implied endorsement or recommendation is offered. Administrators should conduct +their own evaluation of alternatives and are encouraged to draw their own conclusions. +

    Chapter 23. System and Account Policies

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work

    +This chapter summarises the current state of knowledge derived from personal +practice and knowledge from samba mailing list subscribers. Before reproduction +of posted information effort has been made to validate the information provided. +Where additional information was uncovered through this validation it is provided +also. +

    Features and Benefits

    +When MS Windows NT3.5 was introduced the hot new topic was the ability to implement +Group Policies for users and group. Then along came MS Windows NT4 and a few sites +started to adopt this capability. How do we know that? By way of the number of "booboos" +(or mistakes) administrators made and then requested help to resolve. +

    +By the time that MS Windows 2000 and Active Directory was released, administrators +got the message: Group Policies are a good thing! They can help reduce administrative +costs and actually can help to create happier users. But adoption of the true +potential of MS Windows 200x Active Directory and Group Policy Objects (GPOs) for users +and machines were picked up on rather slowly. This was very obvious from the samba +mailing list as in 2000 and 2001 there were very few postings regarding GPOs and +how to replicate them in a Samba environment. +

    +Judging by the traffic volume since mid 2002, GPOs have become a standard part of +the deployment in many sites. This chapter reviews techniques and methods that can +be used to exploit opportunities for automation of control over user desktops and +network client workstations. +

    +A tool new to Samba-3 may become an important part of the future Samba Administrators' +arsenal. The editreg tool is described in this document. +

    Creating and Managing System Policies

    Under MS Windows platforms, particularly those following the release of MS Windows NT4 and MS Windows 95) it is possible to create a type of file that would be placed in the NETLOGON share of a domain controller. As the client logs onto the network @@ -5797,16 +13023,16 @@ this file is read and the contents initiate changes to the registry of the clien machine. This file allows changes to be made to those parts of the registry that affect users, groups of users, or machines.

    -For MS Windows 9x/Me this file must be called Config.POL and may -be generated using a tool called poledit.exe, better known as the +For MS Windows 9x/Me this file must be called Config.POL and may +be generated using a tool called poledit.exe, better known as the Policy Editor. The policy editor was provided on the Windows 98 installation CD, but -dissappeared again with the introduction of MS Windows Me (Millenium Edition). From +disappeared again with the introduction of MS Windows Me (Millennium Edition). From comments from MS Windows network administrators it would appear that this tool became a part of the MS Windows Me Resource Kit.

    MS Windows NT4 Server products include the System Policy Editor -under the Start -> Programs -> Administrative Tools menu item. -For MS Windows NT4 and later clients this file must be called NTConfig.POL. +under the Start -> Programs -> Administrative Tools menu item. +For MS Windows NT4 and later clients this file must be called NTConfig.POL.

    New with the introduction of MS Windows 2000 was the Microsoft Management Console or MMC. This tool is the new wave in the ever changing landscape of Microsoft @@ -5824,124 +13050,124 @@ be read and understood. Try searching on the Microsoft web site for "Group

    What follows is a very brief discussion with some helpful notes. The information provided here is incomplete - you are warned. -

    Windows 9x/Me Policies

    -You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. -It can be found on the Original full product Win98 installation CD under -tools/reskit/netadmin/poledit. Install this using the -Add/Remove Programs facility and then click on the 'Have Disk' tab. -

    -Use the Group Policy Editor to create a policy file that specifies the location of -user profiles and/or the My Documents etc. stuff. Then -save these settings in a file called Config.POL that needs to -be placed in the root of the [NETLOGON] share. If Win98 is configured to log onto -the Samba Domain, it will automatically read this file and update the Win9x/Me registry -of the machine as it logs on. -

    -Further details are covered in the Win98 Resource Kit documentation. -

    -If you do not take the right steps, then every so often Win9x/Me will check the -integrity of the registry and will restore it's settings from the back-up -copy of the registry it stores on each Win9x/Me machine. Hence, you will -occasionally notice things changing back to the original settings. -

    -Install the group policy handler for Win9x to pick up group policies. Look on the -Win98 CD in \tools\reskit\netadmin\poledit. -Install group policies on a Win9x client by double-clicking -grouppol.inf. Log off and on again a couple of times and see -if Win98 picks up group policies. Unfortunately this needs to be done on every -Win9x/Me machine that uses group policies. -

    Windows NT4 Style Policy Files

    -To create or edit ntconfig.pol you must use the NT Server -Policy Editor, poledit.exe which is included with NT4 Server -but not NT Workstation. There is a Policy Editor on a NT4 -Workstation but it is not suitable for creating Domain Policies. -Further, although the Windows 95 Policy Editor can be installed on an NT4 -Workstation/Server, it will not work with NT clients. However, the files from -the NT Server will run happily enough on an NT4 Workstation. -

    -You need poledit.exe, common.adm and winnt.adm. -It is convenient to put the two *.adm files in the c:\winnt\inf -directory which is where the binary will look for them unless told otherwise. Note also that that -directory is normally 'hidden'. -

    -The Windows NT policy editor is also included with the Service Pack 3 (and -later) for Windows NT 4.0. Extract the files using servicepackname /x, -i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, -poledit.exe and the associated template files (*.adm) should -be extracted as well. It is also possible to downloaded the policy template -files for Office97 and get a copy of the policy editor. Another possible -location is with the Zero Administration Kit available for download from Microsoft. -

    Registry Tattoos

    - With NT4 style registry based policy changes, a large number of settings are not - automatically reversed as the user logs off. Since the settings that were in the - NTConfig.POL file were applied to the client machine registry and that apply to the - hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known - as tattooing. It can have serious consequences down-stream and the administrator must - be extremely careful not to lock out the ability to manage the machine at a later date. -

    MS Windows 200x / XP Professional Policies

    -Windows NT4 System policies allows setting of registry parameters specific to -users, groups and computers (client workstations) that are members of the NT4 -style domain. Such policy file will work with MS Windows 2000 / XP clients also. -

    -New to MS Windows 2000 Microsoft introduced a new style of group policy that confers -a superset of capabilities compared with NT4 style policies. Obviously, the tool used -to create them is different, and the mechanism for implementing them is much changed. -

    -The older NT4 style registry based policies are known as Administrative Templates -in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security -configurations, enforce Internet Explorer browser settings, change and redirect aspects of the -users' desktop (including: the location of My Documents files (directory), as -well as intrinsics of where menu items will appear in the Start menu). An additional new -feature is the ability to make available particular software Windows applications to particular -users and/or groups. -

    -Remember: NT4 policy files are named NTConfig.POL and are stored in the root -of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password -and selects the domain name to which the logon will attempt to take place. During the logon -process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating -server, modifies the local registry values according to the settings in this file. -

    -Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of -a Windows 200x policy file is stored in the Active Directory itself and the other part is stored -in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active -Directory domain controllers. The part that is stored in the Active Directory itself is called the -group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is -known as the group policy template (GPT). -

    -With NT4 clients the policy file is read and executed upon only as each user logs onto the network. -MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine -startup (machine specific part) and when the user logs onto the network the user specific part -is applied. In MS Windows 200x style policy management each machine and/or user may be subject -to any number of concurently applicable (and applied) policy sets (GPOs). Active Directory allows -the administrator to also set filters over the policy settings. No such equivalent capability -exists with NT4 style policy files. -

    Administration of Win2K / XP Policies

    Administration of Win2K / XP Policies

    -Instead of using the tool called "The System Policy Editor", commonly called Poledit (from the -executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console -(MMC) snap-in as follows:

    1. -Go to the Windows 200x / XP menu Start->Programs->Administrative Tools - and select the MMC snap-in called "Active Directory Users and Computers" -

    2. -Select the domain or organizational unit (OU) that you wish to manage, then right click -to open the context menu for that object, select the properties item. -

    3. -Now left click on the Group Policy tab, then left click on the New tab. Type a name -for the new policy you will create. -

    4. -Now left click on the Edit tab to commence the steps needed to create the GPO. -

    -All policy configuration options are controlled through the use of policy administrative -templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. -Beware however, since the .adm files are NOT interchangible across NT4 and Windows 200x. -The later introduces many new features as well as extended definition capabilities. It is -well beyond the scope of this documentation to explain how to program .adm files, for that -the adminsitrator is referred to the Microsoft Windows Resource Kit for your particular -version of MS Windows. -

    Note

    -The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used -to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you -use this powerful tool. Please refer to the resource kit manuals for specific usage information. -

    Managing Account/User Policies

    +

    Windows 9x/Me Policies

    + You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. + It can be found on the Original full product Win98 installation CD under + tools/reskit/netadmin/poledit. Install this using the + Add/Remove Programs facility and then click on the 'Have Disk' tab. +

    + Use the Group Policy Editor to create a policy file that specifies the location of + user profiles and/or the My Documents etc. Then save these + settings in a file called Config.POL that needs to be placed in the + root of the [NETLOGON] share. If Win98 is configured to log onto + the Samba Domain, it will automatically read this file and update the Win9x/Me registry + of the machine as it logs on. +

    + Further details are covered in the Win98 Resource Kit documentation. +

    + If you do not take the right steps, then every so often Win9x/Me will check the + integrity of the registry and will restore it's settings from the back-up + copy of the registry it stores on each Win9x/Me machine. Hence, you will + occasionally notice things changing back to the original settings. +

    + Install the group policy handler for Win9x to pick up group policies. Look on the + Win98 CD in \tools\reskit\netadmin\poledit. + Install group policies on a Win9x client by double-clicking + grouppol.inf. Log off and on again a couple of times and see + if Win98 picks up group policies. Unfortunately this needs to be done on every + Win9x/Me machine that uses group policies. +

    Windows NT4 Style Policy Files

    + To create or edit ntconfig.pol you must use the NT Server + Policy Editor, poledit.exe which is included with NT4 Server + but not NT Workstation. There is a Policy Editor on a NT4 + Workstation but it is not suitable for creating Domain Policies. + Further, although the Windows 95 Policy Editor can be installed on an NT4 + Workstation/Server, it will not work with NT clients. However, the files from + the NT Server will run happily enough on an NT4 Workstation. +

    + You need poledit.exe, common.adm and winnt.adm. + It is convenient to put the two *.adm files in the c:\winnt\inf + directory which is where the binary will look for them unless told otherwise. Note also that that + directory is normally 'hidden'. +

    + The Windows NT policy editor is also included with the Service Pack 3 (and + later) for Windows NT 4.0. Extract the files using servicepackname /x, + i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, + poledit.exe and the associated template files (*.adm) should + be extracted as well. It is also possible to downloaded the policy template + files for Office97 and get a copy of the policy editor. Another possible + location is with the Zero Administration Kit available for download from Microsoft. +

    Registry Spoiling

    + With NT4 style registry based policy changes, a large number of settings are not + automatically reversed as the user logs off. Since the settings that were in the + NTConfig.POL file were applied to the client machine registry and that apply to the + hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known + as tattooing. It can have serious consequences down-stream and the administrator must + be extremely careful not to lock out the ability to manage the machine at a later date. +

    MS Windows 200x / XP Professional Policies

    + Windows NT4 System policies allows setting of registry parameters specific to + users, groups and computers (client workstations) that are members of the NT4 + style domain. Such policy file will work with MS Windows 2000 / XP clients also. +

    + New to MS Windows 2000 Microsoft introduced a new style of group policy that confers + a superset of capabilities compared with NT4 style policies. Obviously, the tool used + to create them is different, and the mechanism for implementing them is much changed. +

    + The older NT4 style registry based policies are known as Administrative Templates + in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security + configurations, enforce Internet Explorer browser settings, change and redirect aspects of the + users' desktop (including: the location of My Documents files (directory), as + well as intrinsics of where menu items will appear in the Start menu). An additional new + feature is the ability to make available particular software Windows applications to particular + users and/or groups. +

    + Remember: NT4 policy files are named NTConfig.POL and are stored in the root + of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password + and selects the domain name to which the logon will attempt to take place. During the logon + process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating + server, modifies the local registry values according to the settings in this file. +

    + Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of + a Windows 200x policy file is stored in the Active Directory itself and the other part is stored + in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active + Directory domain controllers. The part that is stored in the Active Directory itself is called the + group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is + known as the group policy template (GPT). +

    + With NT4 clients the policy file is read and executed upon only as each user logs onto the network. + MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine + startup (machine specific part) and when the user logs onto the network the user specific part + is applied. In MS Windows 200x style policy management each machine and/or user may be subject + to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows + the administrator to also set filters over the policy settings. No such equivalent capability + exists with NT4 style policy files. +

    Administration of Win2K / XP Policies

    + Instead of using the tool called The System Policy Editor, commonly called Poledit (from the + executable name poledit.exe), GPOs are created and managed using a + Microsoft Management Console (MMC) snap-in as follows:

    1. + Go to the Windows 200x / XP menu Start->Programs->Administrative Tools + and select the MMC snap-in called Active Directory Users and Computers +

    2. + Select the domain or organizational unit (OU) that you wish to manage, then right click + to open the context menu for that object, select the properties item. +

    3. + Now left click on the Group Policy tab, then left click on the New tab. Type a name + for the new policy you will create. +

    4. + Now left click on the Edit tab to commence the steps needed to create the GPO. +

    + All policy configuration options are controlled through the use of policy administrative + templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. + Beware however, since the .adm files are NOT interchangeable across NT4 and Windows 200x. + The later introduces many new features as well as extended definition capabilities. It is + well beyond the scope of this documentation to explain how to program .adm files, for that + the administrator is referred to the Microsoft Windows Resource Kit for your particular + version of MS Windows. +

    Note

    + The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used + to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you + use this powerful tool. Please refer to the resource kit manuals for specific usage information. +

    Managing Account/User Policies

    Policies can define a specific user's settings or the settings for a group of users. The resulting policy file contains the registry settings for all users, groups, and computers that will be using the policy file. Separate policy files for each user, group, or computer are not not necessary. @@ -5959,8 +13185,8 @@ applied to the user's part of the registry.

    MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally, acquire policy settings through Group Policy Objects (GPOs) that are defined and stored in Active Directory -itself. The key benefit of using AS GPOs is that they impose no registry tatooing effect. -This has considerable advanage compared with the use of NTConfig.POL (NT4) style policy updates. +itself. The key benefit of using AS GPOs is that they impose no registry spoiling effect. +This has considerable advantage compared with the use of NTConfig.POL (NT4) style policy updates.

    In addition to user access controls that may be imposed or applied via system and/or group policies in a manner that works in conjunction with user profiles, the user management environment under @@ -5968,16 +13194,19 @@ MS Windows NT4/200x/XP allows per domain as well as per user account restriction Common restrictions that are frequently used includes:

    Logon Hours
    Password Aging
    Permitted Logon from certain machines only
    Account type (Local or Global)
    User Rights

    -

    With Windows NT4/200x

    -The tools that may be used to configure these types of controls from the MS Windows environment are: -The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). -Under MS Windows 200x/XP this is done using the Microsoft Managment Console (MMC) with approapriate -"snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor. -

    With a Samba PDC

    -With a Samba Domain Controller, the new tools for managing of user account and policy information includes: -smbpasswd, pdbedit, net, rpcclient.. The administrator should read the -man pages for these tools and become familiar with their use. -

    System Startup and Logon Processing Overview

    +

    Samba Editreg Toolset

    + Describe in detail the benefits of editreg and how to use it. +

    Windows NT4/200x

    + The tools that may be used to configure these types of controls from the MS Windows environment are: + The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). + Under MS Windows 200x/XP this is done using the Microsoft Management Console (MMC) with appropriate + "snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor. +

    Samba PDC

    + With a Samba Domain Controller, the new tools for managing of user account and policy information includes: + smbpasswd, pdbedit, net, rpcclient. + The administrator should read the + man pages for these tools and become familiar with their use. +

    System Startup and Logon Processing Overview

    The following attempts to document the order of processing of system and user policies following a system reboot and as part of the user logon:

    1. @@ -5989,13 +13218,13 @@ reboot and as part of the user logon:

      Apply to the location of machines in a Directory
      Apply only when settings have changed
      Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.

      No desktop user interface is presented until the above have been processed.

    2. - Execution of start-up scripts (hidden and synchronous by defaut). + Execution of start-up scripts (hidden and synchronous by default).

    3. A keyboard action to affect start of logon (Ctrl-Alt-Del).

    4. User credentials are validated, User profile is loaded (depends on policy settings).

    5. - An ordered list of User GPOs is obtained. The list contents depends on what is configured in respsect of: + An ordered list of User GPOs is obtained. The list contents depends on what is configured in respect of:

      Is user a domain member, thus subject to particular policies
      Loopback enablement, and the state of the loopback policy (Merge or Replace)
      Location of the Active Directory itself
      Has the list of GPOs changed. No processing is needed if not changed.

    6. @@ -6007,7 +13236,31 @@ reboot and as part of the user logon:

    7. The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like and NT4 Domain) machine (system) policies are applied at start-up, User policies are applied at logon. -

    Chapter 18. Desktop Profile Management

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    April 3 2003

    Table of Contents

    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP

    Roaming Profiles

    Warning

    +

    Common Errors

    +Policy related problems can be very difficult to diagnose and even more difficult to rectify. The following +collection demonstrates only basic issues. +

    Policy Does Not Work

    +Question: We have created the config.pol file and put it in the NETLOGON share. +It has made no difference to our Win XP Pro machines, they just don't see it. IT worked fine with Win 98 but does not +work any longer since we upgraded to Win XP Pro. Any hints? +

    +ANSWER: Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based +platforms. You need to use the NT4 Group Policy Editor to create a file called NTConfig.POL so that +it is in the correct format for your MS Windows XP Pro clients. +

    Chapter 24. Desktop Profile Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    How does one set up roaming profiles for just one (or a few) user/s or group/s?
    Can NOT use Roaming Profiles
    Changing the default profile

    Features and Benefits

    +Roaming Profiles are feared by some, hated by a few, loved by many, and a Godsend for +some administrators. +

    +Roaming Profiles allow an administrator to make available a consistent user desktop +as the user moves from one machine to another. This chapter provides much information +regarding how to configure and manage Roaming Profiles. +

    +While Roaming Profiles might sound like nirvana to some, they are a real and tangible +problem to others. In particular, users of mobile computing tools, where often there may not +be a sustained network connection, are often better served by purely Local Profiles. +This chapter provides information to help the Samba administrator to deal with those +situations also. +

    Roaming Profiles

    Warning

    Roaming profiles support is different for Win9x / Me and Windows NT4/200x.

    Before discussing how to configure roaming profiles, it is useful to see how @@ -6020,10 +13273,10 @@ profiles are restricted to being stored in the user's home directory.

    Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields, including a separate field for the location of the user's profiles. -

    Samba Configuration for Profile Handling

    +

    Samba Configuration for Profile Handling

    This section documents how to configure Samba for MS Windows client profile support. -

    NT4/200x User Profiles

    -To support Windowns NT4/200x clients, in the [global] section of smb.conf set the +

    NT4/200x User Profiles

    +To support Windows NT4/200x clients, in the [global] section of smb.conf set the following (for example): 

    @@ -6037,54 +13290,55 @@ following (for example):

    where %L translates to the name of the Samba server and %u translates to the user name

    -The default for this option is \\%N\%U\profile, namely \\sambaserver\username\profile. -The \\N%\%U service is created automatically by the [homes] service. If you are using +The default for this option is \\%N\%U\profile, +namely \\sambaserver\username\profile. +The \\N%\%U service is created automatically by the [homes] service. If you are using a samba server for the profiles, you _must_ make the share specified in the logon path -browseable. Please refer to the man page for smb.conf in respect of the different -symantics of %L and %N, as well as %U and %u. +browseable. Please refer to the man page for smb.conf in respect of the different +semantics of %L and %N, as well as %U and %u.

    Note

    MS Windows NT/2K clients at times do not disconnect a connection to a server -between logons. It is recommended to NOT use the homes +between logons. It is recommended to NOT use the homes meta-service name as part of the profile share path. -

    Windows 9x / Me User Profiles

    -To support Windows 9x / Me clients, you must use the "logon home" parameter. Samba has -now been fixed so that net use /home now works as well, and it, too, relies -on the logon home parameter. +

    Windows 9x / Me User Profiles

    + To support Windows 9x / Me clients, you must use the logon home parameter. Samba has +now been fixed so that net use /home now works as well, and it, too, relies +on the logon home parameter.

    By using the logon home parameter, you are restricted to putting Win9x / Me profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your smb.conf file: +can use. If you set the following in the [global] section of your smb.conf file: 

     	logon home = \\%L\%U\.profiles

    then your Windows 9x / Me clients will dutifully put their clients in a subdirectory -of your home directory called .profiles (thus making them hidden). +of your home directory called .profiles (thus making them hidden).

    -Not only that, but net use /home will also work, because of a feature in +Not only that, but net use /home will also work, because of a feature in Windows 9x / Me. It removes any directory stuff off the end of the home directory area and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for logon home. -

    Mixed Windows 9x / Me and Windows NT4/200x User Profiles

    +specified \\%L\%U for logon home. +

    Mixed Windows 9x / Me and Windows NT4/200x User Profiles

    You can support profiles for both Win9X and WinNT clients by setting both the -logon home and logon path parameters. For example: +logon home and logon path parameters. For example: 

     	logon home = \\%L\%u\.profiles
 	logon path = \\%L\profiles\%u
-

    Disabling Roaming Profile Support

    -A question often asked is "How may I enforce use of local profiles?" or -"How do I disable Roaming Profiles?" +

    Disabling Roaming Profile Support

    + A question often asked is “How may I enforce use of local profiles?” or + “How do I disable Roaming Profiles?”

    There are three ways of doing this: -

    • - In smb.conf: affect the following settings and ALL clients - will be forced to use a local profile: - 

      -		logon home =
-		logon path =
-

    • - MS Windows Registry: by using the Microsoft Management Console - gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This - of course modifies registry settings. The full path to the option is: +

      In smb.conf

      + Affect the following settings and ALL clients + will be forced to use a local profile: + 

      +			logon home =
+			logon path =
+

      +

      MS Windows Registry:

      + By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This of course modifies registry settings. The full path to the option is: + 

       	Local Computer Policy\
 		Computer Configuration\
@@ -6093,13 +13347,13 @@ There are three ways of doing this:
 					User Profiles\
 
 	Disable:	Only Allow Local User Profiles
-	Disable:	Prevent Roaming Profile Change from Propogating to the Server
+	Disable:	Prevent Roaming Profile Change from Propagating to the Server

      -

    • - Change of Profile Type: From the start menu right click on the - MY Computer icon, select Properties, click on the "User Profiles - tab, select the profile you wish to change from Roaming type to Local, click Change Type. -

    +

    Change of Profile Type:

    + From the start menu right click on the + My Computer icon, select Properties, click on the User Profiles + tab, select the profile you wish to change from Roaming type to Local, click Change Type. +

    Consult the MS Windows registry guide for your particular MS Windows version for more information about which registry keys to change to enforce use of only local user profiles. @@ -6107,29 +13361,30 @@ profiles. The specifics of how to convert a local profile to a roaming profile, or a roaming profile to a local one vary according to the version of MS Windows you are running. Consult the Microsoft MS Windows Resource Kit for your version of Windows for specific information. -

    Windows Client Profile Configuration Information

    Windows 9x / Me Profile Setup

    +

    Windows Client Profile Configuration Information

    Windows 9x / Me Profile Setup

    When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders "Start Menu", "Desktop", "Programs" and "Nethood". +as are folders Start Menu, Desktop, +Programs and Nethood. These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options "preserve case = yes", "short preserve case = yes" and -"case sensitive = no" in order to maintain capital letters in shortcuts +versions stored in c:\windows\profiles\username on subsequent logins, +taking the most recent from each. You will need to use the [global] +options preserve case = yes, short preserve case = yes and +case sensitive = no in order to maintain capital letters in shortcuts in any of the profile folders.

    The user.DAT file contains all the user's preferences. If you wish to enforce a set of preferences, rename their user.DAT file to user.MAN, and deny them write access to this file.

    1. - On the Windows 9x / Me machine, go to Control Panel -> Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer + On the Windows 9x / Me machine, go to Control Panel -> Passwords and + select the User Profiles tab. Select the required level of + roaming preferences. Press OK, but do _not_ allow the computer to reboot.

    2. - On the Windows 9x / Me machine, go to Control Panel -> Network -> - Client for Microsoft Networks -> Preferences. Select 'Log on to - NT Domain'. Then, ensure that the Primary Logon is 'Client for - Microsoft Networks'. Press OK, and this time allow the computer + On the Windows 9x / Me machine, go to Control Panel -> Network -> + Client for Microsoft Networks -> Preferences. Select Log on to + NT Domain. Then, ensure that the Primary Logon is Client for + Microsoft Networks. Press OK, and this time allow the computer to reboot.

    Under Windows 9x / Me Profiles are downloaded from the Primary Logon. @@ -6147,13 +13402,13 @@ domain and profiles downloaded from it, if that domain logon server supports it), user name and user's password.

    Once the user has been successfully validated, the Windows 9x / Me machine -will inform you that 'The user has not logged on before' and asks you -if you wish to save the user's preferences? Select 'yes'. +will inform you that The user has not logged on before' and asks you + if you wish to save the user's preferences? Select yes.

    Once the Windows 9x / Me client comes up with the desktop, you should be able -to examine the contents of the directory specified in the "logon path" -on the samba server and verify that the "Desktop", "Start Menu", -"Programs" and "Nethood" folders have been created. +to examine the contents of the directory specified in the logon path +on the samba server and verify that the Desktop, Start Menu, +Programs and Nethood folders have been created.

    These folders will be cached locally on the client, and updated when the user logs off (if you haven't made them read-only by then). @@ -6172,24 +13427,10 @@ on the samba server. If you have problems creating user profiles, you can reset the user's local desktop cache, as shown below. When this user then next logs in, they will be told that they are logging in "for the first time". -

    1. - instead of logging in under the [user, password, domain] dialog, - press escape. -

    2. - run the regedit.exe program, and look in: -

      - HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList -

      - you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. - - [Exit the registry editor]. - -

    3. - WARNING - before deleting the contents of the +

      Warning

      + Before deleting the contents of the directory listed in the ProfilePath (this is likely to be - c:\windows\profiles\username), ask them if they + c:\windows\profiles\username), ask them if they have any important files stored on their desktop or in their start menu. Delete the contents of the directory ProfilePath (making a backup if any of the files are needed). @@ -6197,31 +13438,42 @@ they will be told that they are logging in "for the first time". This will have the effect of removing the local (read-only hidden system file) user.DAT in their profile directory, as well as the local "desktop", "nethood", "start menu" and "programs" folders. +

      1. + instead of logging in under the [user, password, domain] dialog, + press escape.

      2. - search for the user's .PWL password-caching file in the c:\windows + run the regedit.exe program, and look in: +

        + HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList +

        + you will find an entry, for each user, of ProfilePath. Note the + contents of this key (likely to be c:\windows\profiles\username), + then delete the key ProfilePath for the required user. +

        [Exit the registry editor].

      3. + search for the user's .PWL password-caching file in the c:\windows directory, and delete it.

      4. log off the windows 9x / Me client.

      5. - check the contents of the profile path (see "logon path" described - above), and delete the user.DAT or user.MAN file for the user, + check the contents of the profile path (see logon path described + above), and delete the user.DAT or user.MAN file for the user, making a backup if required.

      If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as ethereal or netmon.exe, and +and / or run a packet trace program such as ethereal or netmon.exe, and look for error messages.

      If you have access to an Windows NT4/200x server, then first set up roaming profiles and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine the example packet traces provided with Windows NT4/200x server, and see what the differences are with the equivalent samba trace. -

    Windows NT4 Workstation

    +

    Windows NT4 Workstation

    When a user first logs in to a Windows NT Workstation, the profile NTuser.DAT is created. The profile location can be now specified -through the "logon path" parameter. +through the logon path parameter.

    There is a parameter that is now available for use with NT Profiles: -"logon drive". This should be set to H: or any other drive, and +logon drive. This should be set to H: or any other drive, and should be used in conjunction with the new "logon home" parameter.

    The entry for the NT4 profile is a _directory_ not a file. The NT @@ -6231,57 +13483,57 @@ create the full profile path (and the folder with the .PDS extension for those situations where it might be created.)

    In the profile directory, Windows NT4 creates more folders than Windows 9x / Me. -It creates "Application Data" and others, as well as "Desktop", "Nethood", -"Start Menu" and "Programs". The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and +It creates Application Data and others, as well as Desktop, Nethood, +Start Menu and Programs. The profile itself is stored in a file +NTuser.DAT. Nothing appears to be stored in the .PDS directory, and its purpose is currently unknown.

    -You can use the System Control Panel to copy a local profile onto +You can use the System Control Panel to copy a local profile onto a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN +up the correct location in the System Control Panel for you). The +NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN turns a profile into a mandatory one.

    The case of the profile is significant. The file must be called -NTuser.DAT or, for a mandatory profile, NTuser.MAN. -

    Windows 2000/XP Professional

    +NTuser.DAT or, for a mandatory profile, NTuser.MAN. +

    Windows 2000/XP Professional

    You must first convert the profile from a local profile to a domain profile on the MS Windows workstation as follows: -

    • - Log on as the LOCAL workstation administrator. +

      1. + Log on as the LOCAL workstation administrator.

      2. - Right click on the 'My Computer' Icon, select 'Properties' + Right click on the My Computer Icon, select Properties

      3. - Click on the 'User Profiles' tab + Click on the User Profiles tab

      4. Select the profile you wish to convert (click on it once)

      5. - Click on the button 'Copy To' + Click on the button Copy To

      6. - In the "Permitted to use" box, click on the 'Change' button. + In the Permitted to use box, click on the Change button.

      7. Click on the 'Look in" area that lists the machine name, when you click here it will open up a selection box. Click on the domain to which the profile must be accessible.

        Note

        You will need to log on if a logon box opens up. Eg: In the connect - as: MIDEARTH\root, password: mypassword.

      8. + as: MIDEARTH\root, password: mypassword.

    • To make the profile capable of being used by anyone select 'Everyone'

    • - Click OK. The Selection box will close. + Click OK. The Selection box will close.

    • - Now click on the 'Ok' button to create the profile in the path you + Now click on the Ok button to create the profile in the path you nominated. -

    -Done. You now have a profile that can be editted using the samba-3.0.0 -profiles tool. +

    +Done. You now have a profile that can be edited using the samba-3.0.0 +profiles tool.

    Note

    -Under NT/2K the use of mandotory profiles forces the use of MS Exchange +Under NT/2K the use of mandatory profiles forces the use of MS Exchange storage of mail data. That keeps desktop profiles usable. -

    Note

    • +

    Note

    1. This is a security check new to Windows XP (or maybe only Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is:

      "Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders"

      ...and it should be set to "Enabled". +Active Directory. The policy is:

      Computer Configuration\Administrative Templates\System\User +Profiles\Do not check for user ownership of Roaming Profile Folders

      ...and it should be set to Enabled. Does the new version of samba have an Active Directory analogue? If so, then you may be able to set the policy through this.

      @@ -6291,9 +13543,10 @@ the following (N.B. I don't know for sure that this will work in the same way as a domain group policy):

    2. On the XP workstation log in with an Administrator account. -

    3. Click: "Start", "Run"

    4. Type: "mmc"

    5. Click: "OK"

    6. A Microsoft Management Console should appear.

    7. Click: File, "Add/Remove Snap-in...", "Add"

    8. Double-Click: "Group Policy"

    9. Click: "Finish", "Close"

    10. Click: "OK"

    11. In the "Console Root" window:

    12. Expand: "Local Computer Policy", "Computer Configuration",

    13. "Administrative Templates", "System", "User Profiles"

    14. Double-Click: "Do not check for user ownership of Roaming Profile

    15. Folders"

    16. Select: "Enabled"

    17. Click: OK"

    18. Close the whole console. You do not need to save the settings (this +

    19. Click: Start, Run

    20. Type: mmc

    21. Click: OK

    22. A Microsoft Management Console should appear.

    23. Click: File, Add/Remove Snap-in..., Add

    24. Double-Click: Group Policy

    25. Click: Finish, Close

    26. Click: OK

    27. In the "Console Root" window:

    28. Expand: Local Computer Policy, Computer Configuration, + Administrative Templates, System, User Profiles

    29. Double-Click: Do not check for user ownership of Roaming Profile Folders

    30. Select: Enabled

    31. Click: OK

    32. Close the whole console. You do not need to save the settings (this refers to the console settings rather than the policies you have - changed).

    33. Reboot

    Sharing Profiles between W9x/Me and NT4/200x/XP workstations

    + changed).

  • Reboot

    • Sharing Profiles between W9x/Me and NT4/200x/XP workstations

    Sharing of desktop profiles between Windows versions is NOT recommended. Desktop profiles are an evolving phenomenon and profiles for later versions of MS Windows clients add features that may interfere with earlier versions @@ -6305,57 +13558,57 @@ on again with the newer version of MS Windows.

    If you then want to share the same Start Menu / Desktop with W9x/Me, you will need to specify a common location for the profiles. The smb.conf parameters -that need to be common are logon path and -logon home. +that need to be common are logon path and +logon home.

    -If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory. -

    Profile Migration from Windows NT4/200x Server to Samba

    +If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory. +

    Profile Migration from Windows NT4/200x Server to Samba

    There is nothing to stop you specifying any path that you like for the location of users' profiles. Therefore, you could specify that the profile be stored on a samba server, or any other SMB server, as long as that SMB server supports encrypted passwords. -

    Windows NT4 Profile Management Tools

    +

    Windows NT4 Profile Management Tools

    Unfortunately, the Resource Kit information is specific to the version of MS Windows NT4/200x. The correct resource kit is required for each platform.

    Here is a quick guide: -

    • -On your NT4 Domain Controller, right click on 'My Computer', then -select the tab labelled 'User Profiles'. +

      1. +On your NT4 Domain Controller, right click on My Computer, then +select the tab labelled User Profiles.

      2. Select a user profile you want to migrate and click on it. -

        Note

        I am using the term "migrate" lossely. You can copy a profile to +

        Note

        I am using the term "migrate" loosely. You can copy a profile to create a group profile. You can give the user 'Everyone' rights to the profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC.

      3. Click the 'Copy To' button.

      4. In the box labelled 'Copy Profile to' add your new path, eg: - c:\temp\foobar

      5. Click on the button labelled 'Change' in the "Permitted to use" box.

      6. Click on the group 'Everyone' and then click OK. This closes the - 'chose user' box.

      7. Now click OK.

    +domain is not a member of a trust relationship with your NT4 PDC.

  • Click the Copy To button.

  • In the box labelled Copy Profile to add your new path, eg: + c:\temp\foobar

  • Click on the button Change in the Permitted to use box.

  • Click on the group 'Everyone' and then click OK. This closes the + 'choose user' box.

  • Now click OK.

    • Follow the above for every profile you need to migrate. -

    Side bar Notes

    +

    Side bar Notes

    You should obtain the SID of your NT4 domain. You can use smbpasswd to do this. Read the man page.

    With Samba-3.0.0 alpha code you can import all you NT4 domain accounts using the net samsync method. This way you can retain your profile settings as well as all your users. -

    moveuser.exe

    +

    moveuser.exe

    The W2K professional resource kit has moveuser.exe. moveuser.exe changes the security of a profile from one user to another. This allows the account domain to change, and/or the user name to change. -

    Get SID

    +

    Get SID

    You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 Resource Kit.

    Windows NT 4.0 stores the local profile information in the registry under the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

    Under the ProfileList key, there will be subkeys named with the SIDs of the users who have logged on to this computer. (To find the profile information for the user whose locally cached profile you want to move, find the SID for the user with the GetSID.exe utility.) Inside of the appropriate user's subkey, you will see a string value named ProfileImagePath. -

    Mandatory profiles

    +

    Mandatory profiles

    A Mandatory Profile is a profile that the user does NOT have the ability to overwrite. During the user's session it may be possible to change the desktop environment, but as the user logs out all changes made will be lost. If it is desired to NOT allow the @@ -6369,10 +13622,10 @@ For MS Windows NT4/200x/XP the above method can be used to create mandatory prof also. To convert a group profile into a mandatory profile simply locate the NTUser.DAT file in the copied profile and rename it to NTUser.MAN.

    -For MS Windows 9x / Me it is the User.DAT file that must be renamed to User.MAN to +For MS Windows 9x / Me it is the User.DAT file that must be renamed to User.MAN to affect a mandatory profile. -

    Creating/Managing Group Profiles

    -Most organisations are arranged into departments. There is a nice benenfit in +

    Creating/Managing Group Profiles

    +Most organisations are arranged into departments. There is a nice benefit in this fact since usually most users in a department will require the same desktop applications and the same desktop layout. MS Windows NT4/200x/XP will allow the use of Group Profiles. A Group Profile is a profile that is created firstly using @@ -6380,33 +13633,34 @@ a template (example) user. Then using the profile migration tool (see above) the profile is assigned access rights for the user group that needs to be given access to the group profile.

    -The next step is rather important. PLEASE NOTE: Instead of assigning a group profile +The next step is rather important. Please note: Instead of assigning a group profile to users (ie: Using User Manager) on a "per user" basis, the group itself is assigned the now modified profile.

    Note

    Be careful with group profiles, if the user who is a member of a group also has a personal profile, then the result will be a fusion (merge) of the two. -

    Default Profile for Windows Users

    +

    Default Profile for Windows Users

    MS Windows 9x / Me and NT4/200x/XP will use a default profile for any user for whom a profile does not already exist. Armed with a knowledge of where the default profile is located on the Windows workstation, and knowing which registry keys affect the path from which the default profile is created, it is possible to modify the default profile to one that has been optimised for the site. This has significant administrative advantages. -

    MS Windows 9x/Me

    -To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System -Policy Editor or change the registry directly. +

    MS Windows 9x/Me

    +To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System +Policy Editor or change the registry directly.

    -To enable default per user profiles in Windows 9x / Me, launch the System Policy Editor, then -select File -> Open Registry, then click on the Local Computer icon, click on Windows 98 System, -select User Profiles, click on the enable box. Do not forget to save the registry changes. +To enable default per user profiles in Windows 9x / Me, launch the System Policy Editor, then +select File -> Open Registry, then click on the +Local Computer icon, click on Windows 98 System, +select User Profiles, click on the enable box. Do not forget to save the registry changes.

    -To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive -HKEY_LOCAL_MACHINE\Network\Logon. Now add a DWORD type key with the name +To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive +HKEY_LOCAL_MACHINE\Network\Logon. Now add a DWORD type key with the name "User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0. -

    How User Profiles Are Handled in Windows 9x / Me?

    +

    How User Profiles Are Handled in Windows 9x / Me?

    When a user logs on to a Windows 9x / Me machine, the local profile path, -HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList, is checked +HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList, is checked for an existing entry for that user:

    If the user has an entry in this registry location, Windows 9x / Me checks for a locally cached @@ -6420,46 +13674,46 @@ If a User Profile is not found in either location, the Default User Profile from machine is used and is copied to a newly created folder for the logged on user. At log off, any changes that the user made are written to the user's local profile. If the user has a roaming profile, the changes are written to the user's profile on the server. -

    MS Windows NT4 Workstation

    +

    MS Windows NT4 Workstation

    On MS Windows NT4 the default user profile is obtained from the location -%SystemRoot%\Profiles which in a default installation will translate to -C:\WinNT\Profiles. Under this directory on a clean install there will be -three (3) directories: Administrator, All Users, Default User. +%SystemRoot%\Profiles which in a default installation will translate to +C:\WinNT\Profiles. Under this directory on a clean install there will be +three (3) directories: Administrator, All Users, Default User.

    -The All Users directory contains menu settings that are common across all -system users. The Default User directory contains menu entries that are +The All Users directory contains menu settings that are common across all +system users. The Default User directory contains menu entries that are customisable per user depending on the profile settings chosen/created.

    When a new user first logs onto an MS Windows NT4 machine a new profile is created from:

    All Users settings
    Default User settings (contains the default NTUser.DAT file)

    When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain the following steps are followed in respect of profile handling: -

    1. +

      1. The users' account information which is obtained during the logon process contains the location of the users' desktop profile. The profile path may be local to the machine or it may be located on a network share. If there exists a profile at the location of the path from the user account, then this profile is copied to the location - %SystemRoot%\Profiles\%USERNAME%. This profile then inherits the - settings in the All Users profile in the %SystemRoot%\Profiles + %SystemRoot%\Profiles\%USERNAME%. This profile then inherits the + settings in the All Users profile in the %SystemRoot%\Profiles location.

      2. If the user account has a profile path, but at it's location a profile does not exist, - then a new profile is created in the %SystemRoot%\Profiles\%USERNAME% - directory from reading the Default User profile. + then a new profile is created in the %SystemRoot%\Profiles\%USERNAME% + directory from reading the Default User profile.

      3. If the NETLOGON share on the authenticating server (logon server) contains a policy file - (NTConfig.POL) then it's contents are applied to the NTUser.DAT - which is applied to the HKEY_CURRENT_USER part of the registry. + (NTConfig.POL) then it's contents are applied to the NTUser.DAT + which is applied to the HKEY_CURRENT_USER part of the registry.

      4. When the user logs out, if the profile is set to be a roaming profile it will be written - out to the location of the profile. The NTuser.DAT file is then - re-created from the contents of the HKEY_CURRENT_USER contents. - Thus, should there not exist in the NETLOGON share an NTConfig.POL at the - next logon, the effect of the provious NTConfig.POL will still be held + out to the location of the profile. The NTuser.DAT file is then + re-created from the contents of the HKEY_CURRENT_USER contents. + Thus, should there not exist in the NETLOGON share an NTConfig.POL at the + next logon, the effect of the previous NTConfig.POL will still be held in the profile. The effect of this is known as tatooing.

      MS Windows NT4 profiles may be Local or Roaming. A Local profile -will stored in the %SystemRoot%\Profiles\%USERNAME% location. A roaming profile will +will stored in the %SystemRoot%\Profiles\%USERNAME% location. A roaming profile will also remain stored in the same way, unless the following registry key is created: 

      @@ -6467,10 +13721,10 @@ also remain stored in the same way, unless the following registry key is created
 	"DeleteRoamingCache"=dword:00000001

      -In which case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be +In which case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be deleted on logout.

      -Under MS Windows NT4 default locations for common resources (like My Documents +Under MS Windows NT4 default locations for common resources (like My Documents may be redirected to a network share by modifying the following registry keys. These changes may be affected via use of the System Policy Editor (to do so may require that you create your owns template extension for the policy editor to allow this to be done through the GUI. Another way to do this is by way of first @@ -6479,54 +13733,20 @@ creating a default user profile, then while logged in as that user, run regedt32 The Registry Hive key that affects the behaviour of folders that are part of the default user profile are controlled by entries on Windows NT4 is:

      -

      -        HKEY_CURRENT_USER
-                \Software
-                        \Microsoft
-                                \Windows
-                                        \CurrentVersion
-                                                \Explorer
-                                                        \User Shell Folders\
-

      +HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\

      The above hive key contains a list of automatically managed folders. The default entries are:

      - 

      -        Name            Default Value
-        --------------  -----------------------------------------
-        AppData         %USERPROFILE%\Application Data
-        Desktop         %USERPROFILE%\Desktop
-        Favorites       %USERPROFILE%\Favorites
-        NetHood         %USERPROFILE%\NetHood
-        PrintHood       %USERPROFILE%\PrintHood
-        Programs        %USERPROFILE%\Start Menu\Programs
-        Recent          %USERPROFILE%\Recent
-        SendTo          %USERPROFILE%\SendTo
-        Start Menu      %USERPROFILE%\Start Menu
-        Startup         %USERPROFILE%\Start Menu\Programs\Startup
-

      -

      +

      Table 24.1. User Shell Folder registry keys default values

      NameDefault Value
      AppData%USERPROFILE%\Application Data
      Desktop%USERPROFILE%\Desktop
      Favorites%USERPROFILE%\Favorites
      NetHood%USERPROFILE%\NetHood
      PrintHood%USERPROFILE%\PrintHood
      Programs%USERPROFILE%\Start Menu\Programs
      Recent%USERPROFILE%\Recent
      SendTo%USERPROFILE%\SendTo
      Start Menu %USERPROFILE%\Start Menu
      Startup%USERPROFILE%\Start Menu\Programs\Startup

      +

      The registry key that contains the location of the default profile settings is: - -

      -	HKEY_LOCAL_MACHINE
-		\SOFTWARE
-			\Microsoft
-				\Windows
-					\CurrentVersion
-						\Explorer
-							\User Shell Folders
-

      - +

      +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders +

      The default entries are: -

      -	Common Desktop		%SystemRoot%\Profiles\All Users\Desktop
-	Common Programs		%SystemRoot%\Profiles\All Users\Programs
-	Common Start Menu	%SystemRoot%\Profiles\All Users\Start Menu
-	Common Startup		%SystemRoot%\Profiles\All Users\Start Menu\Progams\Startup
-

      -

    MS Windows 200x/XP

    Note

    +

    Table 24.2. Defaults of profile settings registry keys

    Common Desktop%SystemRoot%\Profiles\All Users\Desktop
    Common Programs%SystemRoot%\Profiles\All Users\Programs
    Common Start Menu%SystemRoot%\Profiles\All Users\Start Menu
    Common Startup%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup

    +

    MS Windows 200x/XP

    Note

    MS Windows XP Home Edition does use default per user profiles, but can not participate in domain security, can not log onto an NT/ADS style domain, and thus can obtain the profile only from itself. While there are benefits in doing this the beauty of those MS Windows @@ -6534,7 +13754,7 @@ The default entries are: a global default profile and to enforce it through the use of Group Policy Objects (GPOs).

    When a new user first logs onto MS Windows 200x/XP machine the default profile is obtained from -C:\Documents and Settings\Default User. The administrator can modify (or change +C:\Documents and Settings\Default User. The administrator can modify (or change the contents of this location and MS Windows 200x/XP will gladly use it. This is far from the optimum arrangement since it will involve copying a new default profile to every MS Windows 200x/XP client workstation. @@ -6542,20 +13762,20 @@ workstation. When MS Windows 200x/XP participate in a domain security context, and if the default user profile is not found, then the client will search for a default profile in the NETLOGON share of the authenticating server. ie: In MS Windows parlance: -%LOGONSERVER%\NETLOGON\Default User and if one exits there it will copy this -to the workstation to the C:\Documents and Settings\ under the Windows +%LOGONSERVER%\NETLOGON\Default User and if one exits there it will copy this +to the workstation to the C:\Documents and Settings\ under the Windows login name of the user.

    Note

    - This path translates, in Samba parlance, to the smb.conf [NETLOGON] share. The directory - should be created at the root of this share and must be called Default Profile. + This path translates, in Samba parlance, to the smb.conf [NETLOGON] share. The directory + should be created at the root of this share and must be called Default Profile.

    If a default profile does not exist in this location then MS Windows 200x/XP will use the local default profile.

    -On loging out, the users' desktop profile will be stored to the location specified in the registry +On logging out, the users' desktop profile will be stored to the location specified in the registry settings that pertain to the user. If no specific policies have been created, or passed to the client during the login process (as Samba does automatically), then the user's profile will be written to -the local machine only under the path C:\Documents and Settings\%USERNAME%. +the local machine only under the path C:\Documents and Settings\%USERNAME%.

    Those wishing to modify the default behaviour can do so through three methods:

    • @@ -6571,64 +13791,26 @@ Those wishing to modify the default behaviour can do so through three methods: The Registry Hive key that affects the behaviour of folders that are part of the default user profile are controlled by entries on Windows 200x/XP is:

      -

      -	HKEY_CURRENT_USER
-		\Software
-			\Microsoft
-				\Windows
-					\CurrentVersion
-						\Explorer
-							\User Shell Folders\
-

      +HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\

      The above hive key contains a list of automatically managed folders. The default entries are:

      - 

      -	Name		Default Value
-	--------------	-----------------------------------------
-	AppData		%USERPROFILE%\Application Data
-	Cache		%USERPROFILE%\Local Settings\Temporary Internet Files
-	Cookies		%USERPROFILE%\Cookies
-	Desktop		%USERPROFILE%\Desktop
-	Favorites	%USERPROFILE%\Favorites
-	History		%USERPROFILE%\Local Settings\History
-	Local AppData	%USERPROFILE%\Local Settings\Application Data
-	Local Settings	%USERPROFILE%\Local Settings
-	My Pictures	%USERPROFILE%\My Documents\My Pictures
-	NetHood		%USERPROFILE%\NetHood
-	Personal	%USERPROFILE%\My Documents
-	PrintHood	%USERPROFILE%\PrintHood
-	Programs	%USERPROFILE%\Start Menu\Programs
-	Recent		%USERPROFILE%\Recent
-	SendTo		%USERPROFILE%\SendTo
-	Start Menu	%USERPROFILE%\Start Menu
-	Startup		%USERPROFILE%\Start Menu\Programs\Startup
-	Templates	%USERPROFILE%\Templates
-

      -

      -There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all -the others are of type REG_EXPAND_SZ. +

      Table 24.3. Defaults of default user profile paths registry keys

      NameDefault Value
      AppData%USERPROFILE%\Application Data
      Cache%USERPROFILE%\Local Settings\Temporary Internet Files
      Cookies%USERPROFILE%\Cookies
      Desktop%USERPROFILE%\Desktop
      Favorites%USERPROFILE%\Favorites
      History%USERPROFILE%\Local Settings\History
      Local AppData%USERPROFILE%\Local Settings\Application Data
      Local Settings%USERPROFILE%\Local Settings
      My Pictures%USERPROFILE%\My Documents\My Pictures
      NetHood%USERPROFILE%\NetHood
      Personal%USERPROFILE%\My Documents
      PrintHood%USERPROFILE%\PrintHood
      Programs%USERPROFILE%\Start Menu\Programs
      Recent%USERPROFILE%\Recent
      SendTo%USERPROFILE%\SendTo
      Start Menu%USERPROFILE%\Start Menu
      Startup%USERPROFILE%\Start Menu\Programs\Startup
      Templates%USERPROFILE%\Templates

      +

      +There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all +the others are of type REG_EXPAND_SZ.

      It makes a huge difference to the speed of handling roaming user profiles if all the folders are stored on a dedicated location on a network server. This means that it will NOT be necessary to write the Outlook PST file over the network for every login and logout.

      To set this to a network location you could use the following examples: - -

      -	%LOGONSERVER%\%USERNAME%\Default Folders
-

      - -This would store the folders in the user's home directory under a directory called "Default Folders" - +

      %LOGONSERVER%\%USERNAME%\Default Folders

      +This would store the folders in the user's home directory under a directory called Default Folders You could also use: - -

      -	\\SambaServer\FolderShare\%USERNAME%
-

      - -in which case the default folders will be stored in the server named SambaServer -in the share called FolderShare under a directory that has the name of the MS Windows +

      \\SambaServer\FolderShare\%USERNAME%

      + in which case the default folders will be stored in the server named SambaServer +in the share called FolderShare under a directory that has the name of the MS Windows user as seen by the Linux/Unix file system.

      Please note that once you have created a default profile share, you MUST migrate a user's profile @@ -6636,277 +13818,482 @@ Please note that once you have created a default profile share, you MUST migrate

      MS Windows 200x/XP profiles may be Local or Roaming. A roaming profile will be cached locally unless the following registry key is created: -

      -

      -	HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\
-	"DeleteRoamingCache"=dword:00000001
-

      - +

      HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\"DeleteRoamingCache"=dword:00000001

      In which case, the local cache copy will be deleted on logout. -

    Chapter 19. Interdomain Trust Relationships

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    Rafal Szczesniak

    Samba Team

    <mimir@samba.org>

    April 3, 2003

    Table of Contents

    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain

    -Samba-3 supports NT4 style domain trust relationships. This is feature that many sites -will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to -adopt Active Directory or an LDAP based authentication back end. This section explains -some background information regarding trust relationships and how to create them. It is now -possible for Samba-3 to NT4 trust (and vice versa), as well as Samba3 to Samba3 trusts. -

    Trust Relationship Background

    -MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure. -The limitations of this architecture as it affects the scalability of MS Windows networking -in large organisations is well known. Additionally, the flat-name space that results from -this design significantly impacts the delegation of administrative responsibilities in -large and diverse organisations. -

    -Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means -of circumventing the limitations of the older technologies. Not every organisation is ready -or willing to embrace ADS. For small companies the older NT4 style domain security paradigm -is quite adequate, there thus remains an entrenched user base for whom there is no direct -desire to go through a disruptive change to adopt ADS. -

    -Microsoft introduced with MS Windows NT the ability to allow differing security domains -to affect a mechanism so that users from one domain may be given access rights and privileges -in another domain. The language that describes this capability is couched in terms of -Trusts. Specifically, one domain will trust the users -from another domain. The domain from which users are available to another security domain is -said to be a trusted domain. The domain in which those users have assigned rights and privileges -is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only, -thus if users in both domains are to have privileges and rights in each others' domain, then it is -necessary to establish two (2) relationships, one in each direction. +

    Common Errors

    +The following are some typical errors/problems/questions that have been asked. +

    How does one set up roaming profiles for just one (or a few) user/s or group/s?

    +With samba-2.2.x the choice you have is to enable or disable roaming +profiles support. It is a global only setting. The default is to have +roaming profiles and the default path will locate them in the user's home +directory. +

    +If disabled globally then no-one will have roaming profile ability. +If enabled and you want it to apply only to certain machines, then on +those machines on which roaming profile support is NOT wanted it is then +necessary to disable roaming profile handling in the registry of each such +machine. +

    +With samba-3.0.0 (soon to be released) you can have a global profile +setting in smb.conf _AND_ you can over-ride this by per-user settings +using the Domain User Manager (as with MS Windows NT4/ Win 2Kx). +

    +In any case, you can configure only one profile per user. That profile can +be either: +

    A profile unique to that user
    A mandatory profile (one the user can not change)
    A group profile (really should be mandatory ie:unchangable)

    Can NOT use Roaming Profiles

    +“ + I dont want Roaming profile to be implemented, I just want to give users + local profiles only. +... + Please help me I am totally lost with this error from past two days I tried + everything and googled around quite a bit but of no help. Please help me. +”

    +Your choices are: + + +

    Local profiles

    + I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out +

    Roaming profiles

    +

    can use auto-delete on logout option
    requires a registry key change on workstation

    + + Your choices are: + +

    Personal Roaming profiles

    + - should be preserved on a central server + - workstations 'cache' (store) a local copy + - used in case the profile can not be downloaded + at next logon +

    Group profiles

    - loaded from a central place

    Mandatory profiles

    + - can be personal or group + - can NOT be changed (except by an administrator +

    +

    +

    -In an NT4 style MS security domain, all trusts are non-transitive. This means that if there -are three (3) domains (let's call them RED, WHITE, and BLUE) where RED and WHITE have a trust -relationship, and WHITE and BLUE have a trust relationship, then it holds that there is no -implied trust between the RED and BLUE domains. ie: Relationships are explicit and not -transitive. +A WinNT4/2K/XP profile can vary in size from 130KB to off the scale. +Outlook PST files are most often part of the profile and can be many GB in +size. On average (in a well controlled environment) roaming profile size of +2MB is a good rule of thumb to use for planning purposes. In an +undisciplined environment I have seen up to 2GB profiles. Users tend to +complain when it take an hour to log onto a workstation but they harvest +the fruits of folly (and ignorance).

    -New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way -by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE -domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is -an inherent feature of ADS domains. Samba-3 implements MS Windows NT4 -style Interdomain trusts and interoperates with MS Windows 200x ADS -security domains in similar manner to MS Windows NT4 style domains. -

    Native MS Windows NT4 Trusts Configuration

    -There are two steps to creating an interdomain trust relationship. -

    NT4 as the Trusting Domain (ie. creating the trusted account)

    -For MS Windows NT4, all domain trust relationships are configured using the Domain User Manager. -To affect a two way trust relationship it is necessary for each domain administrator to make -available (for use by an external domain) it's security resources. This is done from the Domain -User Manager Policies entry on the menu bar. From the Policy menu, select Trust Relationships, then -next to the lower box that is labelled "Permitted to Trust this Domain" are two buttons, "Add" and -"Remove". The "Add" button will open a panel in which needs to be entered the remote domain that -will be able to assign user rights to your domain. In addition it is necessary to enter a password -that is specific to this trust relationship. The password needs to be -typed twice (for standard confirmation). -

    NT4 as the Trusted Domain (ie. creating trusted account's password)

    -A trust relationship will work only when the other (trusting) domain makes the appropriate connections -with the trusted domain. To consumate the trust relationship the administrator will launch the -Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the -"Add" button that is next to the box that is labelled "Trusted Domains". A panel will open in -which must be entered the name of the remote domain as well as the password assigned to that trust. -

    Configuring Samba NT-style Domain Trusts

    -This description is meant to be a fairly short introduction about how to set up a Samba server so -that it could participate in interdomain trust relationships. Trust relationship support in Samba -is in its early stage, so lot of things don't work yet. +The point of all the above is to show that roaming profiles and good +controls of how they can be changed as well as good discipline make up for +a problem free site.

    -Each of the procedures described below is treated as they were performed with Windows NT4 Server on -one end. The remote end could just as well be another Samba-3 domain. It can be clearly seen, after -reading this document, that combining Samba-specific parts of what's written below leads to trust -between domains in purely Samba environment. -

    Samba-3 as the Trusting Domain

    -In order to set the Samba PDC to be the trusted party of the relationship first you need -to create special account for the domain that will be the trusting party. To do that, -you can use the 'smbpasswd' utility. Creating the trusted domain account is very -similiar to creating a trusted machine account. Suppose, your domain is -called SAMBA, and the remote domain is called RUMBA. The first step -will be to issue this command from your favourite shell: +Microsoft's answer to the PST problem is to store all email in an MS +Exchange Server back-end. But this is another story ...!

    -

    -deity# smbpasswd -a -i rumba
-	New SMB password: XXXXXXXX
-	Retype SMB password: XXXXXXXX
-	Added user rumba$
-

    +So, having LOCAL profiles means: + +

    If lots of users user each machine - lot's of local disk storage needed for local profiles
    Every workstation the user logs into has it's own profile - can be very different from machine to machine

    + +On the other hand, having roaming profiles means: +

    The network administrator can control EVERY aspect of user profiles
    With the use of mandatory profiles - a drastic reduction in network management overheads
    User unhappiness about not being able to change their profiles soon fades as they get used to being able to work reliably

    -where -a means to add a new account into the -passdb database and -i means: ''create this -account with the InterDomain trust flag'' -

    -The account name will be 'rumba$' (the name of the remote domain) -

    -After issuing this command you'll be asked to enter the password for -the account. You can use any password you want, but be aware that Windows NT will -not change this password until 7 days following account creation. -After the command returns successfully, you can look at the entry for the new account -(in the stardard way depending on your configuration) and see that account's name is -really RUMBA$ and it has 'I' flag in the flags field. Now you're ready to confirm -the trust by establishing it from Windows NT Server. -

    -Open 'User Manager for Domains' and from menu 'Policies' select 'Trust Relationships...'. -Right beside 'Trusted domains' list box press 'Add...' button. You will be prompted for -the trusted domain name and the relationship password. Type in SAMBA, as this is -your domain name, and the password used at the time of account creation. -Press OK and, if everything went without incident, you will see 'Trusted domain relationship -successfully established' message. -

    Samba-3 as the Trusted Domain

    -This time activities are somewhat reversed. Again, we'll assume that your domain -controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA.

    -The very first thing requirement is to add an account for the SAMBA domain on RUMBA's PDC. +I have managed and installed MANY NT/2K networks and have NEVER found one +where users who move from machine to machine are happy with local +profiles. In the long run local profiles bite them. +

    Changing the default profile

    “ +When the client tries to logon to the PDC it looks for a profile to download +where do I put this default profile. +”

    +Firstly, your samba server need to be configured as a domain controller. +

    +	server = user
+    os level = 32 (or more)
+	domain logons = Yes
+

    +Plus you need to have a [netlogon] share that is world readable. +It is a good idea to add a logon script to pre-set printer and +drive connections. There is also a facility for automatically +synchronizing the workstation time clock with that of the logon +server (another good thing to do). +

    Note

    +To invoke auto-deletion of roaming profile from the local +workstation cache (disk storage) you need to use the Group Policy Editor +to create a file called NTConfig.POL with the appropriate entries. This +file needs to be located in the netlogon share root directory.

    +Oh, of course the windows clients need to be members of the domain. +Workgroup machines do NOT do network logons - so they never see domain +profiles.

    -Launch the Domain User Manager, then from the menu select 'Policies', 'Trust Relationships'. -Now, next to 'Trusted Domains' box press the 'Add' button, and type in the name of the trusted -domain (SAMBA) and password securing the relationship. +Secondly, for roaming profiles you need: + + logon path = \\%N\profiles\%U (with some such path) + logon drive = H: (Z: is the default) + + Plus you need a PROFILES share that is world writable. +

    Chapter 25. PAM based Distributed Authentication

    John H. Terpstra

    Samba Team

    Stephen Langasek

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem

    +This chapter you should help you to deploy winbind based authentication on any PAM enabled +Unix/Linux system. Winbind can be used to enable user level application access authentication +from any MS Windows NT Domain, MS Windows 200x Active Directory based domain, or any Samba +based domain environment. It will also help you to configure PAM based local host access +controls that are appropriate to your Samba configuration. +

    +In addition to knowing how to configure winbind into PAM, you will learn generic PAM management +possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage. +

    Note

    +The use of Winbind require more than PAM configuration alone. Please refer to the Winbind chapter. +

    Features and Benefits

    +A number of Unix systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, +now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication, +authorization and resource control services. Prior to the introduction of PAM, a decision +to use an alternative to the system password database (/etc/passwd) +would require the provision of alternatives for all programs that provide security services. +Such a choice would involve provision of alternatives to such programs as: login, +passwd, chown, etc. +

    +PAM provides a mechanism that disconnects these security programs from the underlying +authentication/authorization infrastructure. PAM is configured either through one file +/etc/pam.conf (Solaris), or by editing individual files that are +located in /etc/pam.d. +

    +On PAM enabled Unix/Linux systems it is an easy matter to configure the system to use any +authentication backend, so long as the appropriate dynamically loadable library modules +are available for it. The backend may be local to the system, or may be centralised on a +remote server. +

    +PAM support modules are available for: +

    /etc/passwd

    -

    + There are several PAM modules that interact with this standard Unix user + database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so + and pam_userdb.so. +

    Kerberos

    -

    + The pam_krb5.so module allows the use of any Kerberos compliant server. + This tool is used to access MIT Kerberos, Heimdal Kerberos, and potentially + Microsoft Active Directory (if enabled). +

    LDAP

    -

    + The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend + server. Commonly used LDAP backend servers include: OpenLDAP v2.0 and v2.1, + Sun ONE iDentity server, Novell eDirectory server, Microsoft Active Directory. +

    NetWare Bindery

    -

    + The pam_ncp_auth.so module allows authentication off any bindery enabled + NetWare Core Protocol based server. +

    SMB Password

    -

    + This module, called pam_smbpass.so, will allow user authentication off + the passdb backend that is configured in the Samba smb.conf file. +

    SMB Server

    -

    + The pam_smb_auth.so module is the original MS Windows networking authentication + tool. This module has been somewhat outdated by the Winbind module. +

    Winbind

    -

    + The pam_winbind.so module allows Samba to obtain authentication from any + MS Windows Domain Controller. It can just as easily be used to authenticate + users for access to any PAM enabled application. +

    RADIUS

    -

    + There is a PAM RADIUS (Remote Access Dial-In User Service) authentication + module. In most cases the administrator will need to locate the source code + for this tool and compile and install it themselves. RADIUS protocols are + used by many routers and terminal servers. +

    +Of the above, Samba provides the pam_smbpasswd.so and the pam_winbind.so modules alone. +

    +Once configured, these permit a remarkable level of flexibility in the location and use +of distributed samba domain controllers that can provide wide are network bandwidth +efficient authentication services for PAM capable systems. In effect, this allows the +deployment of centrally managed and maintained distributed authentication from a single +user account database. +

    Technical Discussion

    +PAM is designed to provide the system administrator with a great deal of flexibility in +configuration of the privilege granting applications of their system. The local +configuration of system security controlled by PAM is contained in one of two places: +either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory. +

    PAM Configuration Syntax

    +In this section we discuss the correct syntax of and generic options respected by entries to these files. +PAM specific tokens in the configuration file are case insensitive. The module paths, however, are case +sensitive since they indicate a file's name and reflect the case dependence of typical file-systems. +The case-sensitivity of the arguments to any given module is defined for each module in turn. +

    +In addition to the lines described below, there are two special characters provided for the convenience +of the system administrator: comments are preceded by a `#' and extend to the next end-of-line; also, +module specification lines may be extended with a `\' escaped newline. +

    +If the PAM authentication module (loadable link library file) is located in the +default location then it is not necessary to specify the path. In the case of +Linux, the default location is /lib/security. If the module +is located outside the default then the path must be specified as:

    -The password can be arbitrarily chosen. It is easy to change the password -from the Samba server whenever you want. After confirming the password your account is -ready for use. Now it's Samba's turn. +

    +auth  required  /other_path/pam_strange_module.so
+

    +

    Anatomy of /etc/pam.d Entries

    +The remaining information in this subsection was taken from the documentation of the Linux-PAM +project. For more information on PAM, see + +http://ftp.kernel.org/pub/linux/libs/pam The Official Linux-PAM home page.

    -Using your favourite shell while being logged in as root, issue this command: +A general configuration line of the /etc/pam.conf file has the following form:

    -deity# net rpc trustdom establish rumba +

    +service-name   module-type   control-flag   module-path   args
+

    -You will be prompted for the password you just typed on your Windows NT4 Server box. -Do not worry if you see an error message that mentions a returned code of -NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the -password you gave is correct and the NT4 Server says the account is -ready for interdomain connection and not for ordinary -connection. After that, be patient it can take a while (especially -in large networks), you should see the 'Success' message. Congratulations! Your trust -relationship has just been established. -

    Note

    -Note that you have to run this command as root because you must have write access to -the secrets.tdb file. -

    Chapter 20. PAM Configuration for Centrally Managed Authentication

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    (Jun 21 2001)

    Table of Contents

    Samba and PAM
    PAM Configuration in smb.conf
    Password Synchronisation using pam_smbpass.so
    Distributed Authentication

    Samba and PAM

    -A number of Unix systems (eg: Sun Solaris), as well as the -xxxxBSD family and Linux, now utilize the Pluggable Authentication -Modules (PAM) facility to provide all authentication, -authorization and resource control services. Prior to the -introduction of PAM, a decision to use an alternative to -the system password database (/etc/passwd) -would require the provision of alternatives for all programs that provide -security services. Such a choice would involve provision of -alternatives to such programs as: login, -passwd, chown, etc. -

    -PAM provides a mechanism that disconnects these security programs -from the underlying authentication/authorization infrastructure. -PAM is configured either through one file /etc/pam.conf (Solaris), -or by editing individual files that are located in /etc/pam.d. -

    Note

    - If the PAM authentication module (loadable link library file) is located in the - default location then it is not necessary to specify the path. In the case of - Linux, the default location is /lib/security. If the module - is located outside the default then the path must be specified as: - - 

    -	auth       required      /other_path/pam_strange_module.so
-

    -

    -The following is an example /etc/pam.d/login configuration file. +Below, we explain the meaning of each of these tokens. The second (and more recently adopted) +way of configuring Linux-PAM is via the contents of the /etc/pam.d/ directory. +Once we have explained the meaning of the above tokens, we will describe this method. +

    service-name

    -

    + The name of the service associated with this entry. Frequently the service name is the conventional + name of the given application. For example, `ftpd', `rlogind' and `su', etc. . +

    + There is a special service-name, reserved for defining a default authentication mechanism. It has + the name `OTHER' and may be specified in either lower or upper case characters. Note, when there + is a module specified for a named service, the `OTHER' entries are ignored. +

    module-type

    -

    + One of (currently) four types of module. The four types are as follows: +

    • + auth: this module type provides two aspects of authenticating the user. + Firstly, it establishes that the user is who they claim to be, by instructing the application + to prompt the user for a password or other means of identification. Secondly, the module can + grant group membership (independently of the /etc/groups file discussed + above) or other privileges through its credential granting properties. +

    • + account: this module performs non-authentication based account management. + It is typically used to restrict/permit access to a service based on the time of day, currently + available system resources (maximum number of users) or perhaps the location of the applicant + user `root' login only on the console. +

    • + session: primarily, this module is associated with doing things that need + to be done for the user before/after they can be given service. Such things include the logging + of information concerning the opening/closing of some data exchange with a user, mounting + directories, etc. +

    • + password: this last module type is required for updating the authentication + token associated with the user. Typically, there is one module for each `challenge/response' + based authentication (auth) module-type. +

    control-flag

    -

    + The control-flag is used to indicate how the PAM library will react to the success or failure of the + module it is associated with. Since modules can be stacked (modules of the same type execute in series, + one after another), the control-flags determine the relative importance of each module. The application + is not made aware of the individual success or failure of modules listed in the + /etc/pam.conf file. Instead, it receives a summary success or fail response from + the Linux-PAM library. The order of execution of these modules is that of the entries in the + /etc/pam.conf file; earlier entries are executed before later ones. + As of Linux-PAM v0.60, this control-flag can be defined with one of two syntaxes. +

    + The simpler (and historical) syntax for the control-flag is a single keyword defined to indicate the + severity of concern associated with the success or failure of a specific module. There are four such + keywords: required, requisite, sufficient and optional. +

    + The Linux-PAM library interprets these keywords in the following manner: +

    • + required: this indicates that the success of the module is required for the + module-type facility to succeed. Failure of this module will not be apparent to the user until all + of the remaining modules (of the same module-type) have been executed. +

    • + requisite: like required, however, in the case that such a module returns a + failure, control is directly returned to the application. The return value is that associated with + the first required or requisite module to fail. Note, this flag can be used to protect against the + possibility of a user getting the opportunity to enter a password over an unsafe medium. It is + conceivable that such behavior might inform an attacker of valid accounts on a system. This + possibility should be weighed against the not insignificant concerns of exposing a sensitive + password in a hostile environment. +

    • + sufficient: the success of this module is deemed `sufficient' to satisfy + the Linux-PAM library that this module-type has succeeded in its purpose. In the event that no + previous required module has failed, no more `stacked' modules of this type are invoked. (Note, + in this case subsequent required modules are not invoked.). A failure of this module is not deemed + as fatal to satisfying the application that this module-type has succeeded. +

    • + optional: as its name suggests, this control-flag marks the module as not + being critical to the success or failure of the user's application for service. In general, + Linux-PAM ignores such a module when determining if the module stack will succeed or fail. + However, in the absence of any definite successes or failures of previous or subsequent stacked + modules this module will determine the nature of the response to the application. One example of + this latter case, is when the other modules return something like PAM_IGNORE. +

    + The more elaborate (newer) syntax is much more specific and gives the administrator a great deal of control + over how the user is authenticated. This form of the control flag is delimited with square brackets and + consists of a series of value=action tokens: + 

    +		[value1=action1 value2=action2 ...]
+

    + Here, value1 is one of the following return values: success; open_err; symbol_err; service_err; + system_err; buf_err; perm_denied; auth_err; cred_insufficient; authinfo_unavail; user_unknown; maxtries; + new_authtok_reqd; acct_expired; session_err; cred_unavail; cred_expired; cred_err; no_module_data; conv_err; + authtok_err; authtok_recover_err; authtok_lock_busy; authtok_disable_aging; try_again; ignore; abort; + authtok_expired; module_unknown; bad_item; and default. The last of these (default) can be used to set + the action for those return values that are not explicitly defined. +

    + The action1 can be a positive integer or one of the following tokens: ignore; ok; done; bad; die; and reset. + A positive integer, J, when specified as the action, can be used to indicate that the next J modules of the + current module-type will be skipped. In this way, the administrator can develop a moderately sophisticated + stack of modules with a number of different paths of execution. Which path is taken can be determined by the + reactions of individual modules. +

    • + ignore: when used with a stack of modules, the module's return status will not + contribute to the return code the application obtains. +

    • + bad: this action indicates that the return code should be thought of as indicative + of the module failing. If this module is the first in the stack to fail, its status value will be used + for that of the whole stack. +

    • + die: equivalent to bad with the side effect of terminating the module stack and + PAM immediately returning to the application. +

    • + ok: this tells PAM that the administrator thinks this return code should + contribute directly to the return code of the full stack of modules. In other words, if the former + state of the stack would lead to a return of PAM_SUCCESS, the module's return code will override + this value. Note, if the former state of the stack holds some value that is indicative of a modules + failure, this 'ok' value will not be used to override that value. +

    • + done: equivalent to ok with the side effect of terminating the module stack and + PAM immediately returning to the application. +

    • + reset: clear all memory of the state of the module stack and start again with + the next stacked module. +

    + Each of the four keywords: required; requisite; sufficient; and optional, have an equivalent expression in + terms of the [...] syntax. They are as follows: +

    +

    • + required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad] +

    • + requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die] +

    • + sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore] +

    • + optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore] +

    +

    + Just to get a feel for the power of this new syntax, here is a taste of what you can do with it. With Linux-PAM-0.63, + the notion of client plug-in agents was introduced. This is something that makes it possible for PAM to support + machine-machine authentication using the transport protocol inherent to the client/server application. With the + [ ... value=action ... ] control syntax, it is possible for an application to be configured + to support binary prompts with compliant clients, but to gracefully fall over into an alternative authentication + mode for older, legacy, applications. +

    module-path

    -

    + The path-name of the dynamically loadable object file; the pluggable module itself. If the first character of the + module path is `/', it is assumed to be a complete path. If this is not the case, the given module path is appended + to the default module path: /lib/security (but see the notes above). +

    + The args are a list of tokens that are passed to the module when it is invoked. Much like arguments to a typical + Linux shell command. Generally, valid arguments are optional and are specific to any given module. Invalid arguments + are ignored by a module, however, when encountering an invalid argument, the module is required to write an error + to syslog(3). For a list of generic options see the next section. +

    + Note, if you wish to include spaces in an argument, you should surround that argument with square brackets. For example: + 

    +squid auth required pam_mysql.so user=passwd_query passwd=mada \
+        db=eminence [query=select user_name from internet_service where \
+                     user_name='%u' and password=PASSWORD('%p') and \
+                     service='web_proxy']
+

    + Note, when using this convention, you can include `[' characters inside the string, and if you wish to include a `]' + character inside the string that will survive the argument parsing, you should use `\['. In other words: + 

    +[..[..\]..]    -->   ..[..]..
+

    + Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the + side of caution) to make the authentication process fail. A corresponding error is written to the system log files + with a call to syslog(3). +

    Example System Configurations

    +The following is an example /etc/pam.d/login configuration file. This example had all options been uncommented is probably not usable as it stacks many conditions before allowing successful completion of the login process. Essentially all conditions can be disabled -by commenting them out except the calls to pam_pwdb.so. -

    -	#%PAM-1.0
-	# The PAM configuration file for the `login' service
-	#
-	auth 		required	pam_securetty.so
-	auth 		required	pam_nologin.so
-	# auth 		required	pam_dialup.so
-	# auth 		optional	pam_mail.so
-	auth		required	pam_pwdb.so shadow md5
-	# account    	requisite  	pam_time.so
-	account		required	pam_pwdb.so
-	session		required	pam_pwdb.so
-	# session 	optional	pam_lastlog.so
-	# password   	required   	pam_cracklib.so retry=3
-	password	required	pam_pwdb.so shadow md5
-

    -PAM allows use of replacable modules. Those available on a -sample system include: -

    $/bin/ls /lib/security -

    -	pam_access.so    pam_ftp.so          pam_limits.so     
-	pam_ncp_auth.so  pam_rhosts_auth.so  pam_stress.so     
-	pam_cracklib.so  pam_group.so        pam_listfile.so   
-	pam_nologin.so   pam_rootok.so       pam_tally.so      
-	pam_deny.so      pam_issue.so        pam_mail.so       
-	pam_permit.so    pam_securetty.so    pam_time.so       
-	pam_dialup.so    pam_lastlog.so      pam_mkhomedir.so  
-	pam_pwdb.so      pam_shells.so       pam_unix.so       
-	pam_env.so       pam_ldap.so         pam_motd.so       
-	pam_radius.so    pam_smbpass.so      pam_unix_acct.so  
-	pam_wheel.so     pam_unix_auth.so    pam_unix_passwd.so
-	pam_userdb.so    pam_warn.so         pam_unix_session.so
+by commenting them out except the calls to pam_pwdb.so.
+
    PAM: original login config
    +#%PAM-1.0
+# The PAM configuration file for the `login' service
+#
+auth         required    pam_securetty.so
+auth         required    pam_nologin.so
+# auth       required    pam_dialup.so
+# auth       optional    pam_mail.so
+auth         required    pam_pwdb.so shadow md5
+# account    requisite   pam_time.so
+account      required    pam_pwdb.so
+session      required    pam_pwdb.so
+# session    optional    pam_lastlog.so
+# password   required    pam_cracklib.so retry=3
+password     required    pam_pwdb.so shadow md5
+
    PAM: login using pam_smbpass
    
+PAM allows use of replaceable modules. Those available on a sample system include:
+
    $/bin/ls /lib/security
+
    +pam_access.so    pam_ftp.so          pam_limits.so     
+pam_ncp_auth.so  pam_rhosts_auth.so  pam_stress.so     
+pam_cracklib.so  pam_group.so        pam_listfile.so   
+pam_nologin.so   pam_rootok.so       pam_tally.so      
+pam_deny.so      pam_issue.so        pam_mail.so       
+pam_permit.so    pam_securetty.so    pam_time.so       
+pam_dialup.so    pam_lastlog.so      pam_mkhomedir.so  
+pam_pwdb.so      pam_shells.so       pam_unix.so       
+pam_env.so       pam_ldap.so         pam_motd.so       
+pam_radius.so    pam_smbpass.so      pam_unix_acct.so  
+pam_wheel.so     pam_unix_auth.so    pam_unix_passwd.so
+pam_userdb.so    pam_warn.so         pam_unix_session.so
 
    
 The following example for the login program replaces the use of 
-the pam_pwdb.so module which uses the system 
-password database (/etc/passwd,
-/etc/shadow, /etc/group) with 
-the module pam_smbpass.so which uses the Samba 
+the pam_pwdb.so module which uses the system 
+password database (/etc/passwd,
+/etc/shadow, /etc/group) with 
+the module pam_smbpass.so which uses the Samba 
 database which contains the Microsoft MD4 encrypted password 
 hashes. This database is stored in either 
-/usr/local/samba/private/smbpasswd, 
-/etc/samba/smbpasswd, or in 
-/etc/samba.d/smbpasswd, depending on the 
+/usr/local/samba/private/smbpasswd, 
+/etc/samba/smbpasswd, or in 
+/etc/samba.d/smbpasswd, depending on the 
 Samba implementation for your Unix/Linux system. The 
-pam_smbpass.so module is provided by 
+pam_smbpass.so module is provided by 
 Samba version 2.2.1 or later. It can be compiled by specifying the 
---with-pam_smbpass options when running Samba's
-configure script.  For more information
-on the pam_smbpass module, see the documentation
-in the source/pam_smbpass directory of the Samba 
+--with-pam_smbpass options when running Samba's
+configure script.  For more information
+on the pam_smbpass module, see the documentation
+in the source/pam_smbpass directory of the Samba 
 source distribution.
-
    -	#%PAM-1.0
-	# The PAM configuration file for the `login' service
-	#
-	auth		required	pam_smbpass.so nodelay
-	account		required	pam_smbpass.so nodelay
-	session		required	pam_smbpass.so nodelay
-	password	required	pam_smbpass.so nodelay
+
    +#%PAM-1.0
+# The PAM configuration file for the `login' service
+#
+auth        required    pam_smbpass.so nodelay
+account     required    pam_smbpass.so nodelay
+session     required    pam_smbpass.so nodelay
+password    required    pam_smbpass.so nodelay
 
    
 The following is the PAM configuration file for a particular 
-Linux system. The default condition uses pam_pwdb.so.
-
    -	#%PAM-1.0
-	# The PAM configuration file for the `samba' service
-	#
-	auth       required     pam_pwdb.so nullok nodelay shadow audit
-	account    required     pam_pwdb.so audit nodelay
-	session    required     pam_pwdb.so nodelay
-	password   required     pam_pwdb.so shadow md5
+Linux system. The default condition uses pam_pwdb.so.
+
    +#%PAM-1.0
+# The PAM configuration file for the `samba' service
+#
+auth       required     pam_pwdb.so nullok nodelay shadow audit
+account    required     pam_pwdb.so audit nodelay
+session    required     pam_pwdb.so nodelay
+password   required     pam_pwdb.so shadow md5
 
    
 In the following example the decision has been made to use the 
 smbpasswd database even for basic samba authentication. Such a 
 decision could also be made for the passwd program and would 
 thus allow the smbpasswd passwords to be changed using the passwd 
 program.
-
    -	#%PAM-1.0
-	# The PAM configuration file for the `samba' service
-	#
-	auth       required     pam_smbpass.so nodelay
-	account    required     pam_pwdb.so audit nodelay
-	session    required     pam_pwdb.so nodelay
-	password   required     pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf
+
    +#%PAM-1.0
+# The PAM configuration file for the `samba' service
+#
+auth       required     pam_smbpass.so nodelay
+account    required     pam_pwdb.so audit nodelay
+session    required     pam_pwdb.so nodelay
+password   required     pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf
 
    Note
    PAM allows stacking of authentication mechanisms. It is 
 also possible to pass information obtained within one PAM module through 
 to the next module in the PAM stack. Please refer to the documentation for 
 your particular system implementation for details regarding the specific 
-capabilities of PAM in this environment. Some Linux implmentations also 
-provide the pam_stack.so module that allows all 
+capabilities of PAM in this environment. Some Linux implementations also 
+provide the pam_stack.so module that allows all 
 authentication to be configured in a single central file. The 
-pam_stack.so method has some very devoted followers 
+pam_stack.so method has some very devoted followers 
 on the basis that it allows for easier administration. As with all issues in 
 life though, every decision makes trade-offs, so you may want examine the 
 PAM documentation for further helpful information.
-
    PAM Configuration in smb.conf
    
+

    smb.conf PAM Configuration

    There is an option in smb.conf called obey pam restrictions. The following is from the on-line help for this option in SWAT;

    -When Samba is configured to enable PAM support (i.e. ---with-pam), this parameter will +When Samba-3 is configured to enable PAM support (i.e. +--with-pam), this parameter will control whether or not Samba should obey PAM's account and session management directives. The default behavior is to use PAM for clear text authentication only and to @@ -6916,272 +14303,151 @@ ignores PAM for authentication in the case of The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. -

    Default: obey pam restrictions = no

    Password Synchronisation using pam_smbpass.so

    +

    Default: obey pam restrictions = no

    Remote CIFS Authentication using winbindd.so

    +All operating systems depend on the provision of users credentials acceptable to the platform. +Unix requires the provision of a user identifier (UID) as well as a group identifier (GID). +These are both simple integer type numbers that are obtained from a password backend such +as /etc/passwd. +

    +Users and groups on a Windows NT server are assigned a relative id (rid) which is unique for +the domain when the user or group is created. To convert the Windows NT user or group into +a unix user or group, a mapping between rids and unix user and group ids is required. This +is one of the jobs that winbind performs. +

    +As winbind users and groups are resolved from a server, user and group ids are allocated +from a specified range. This is done on a first come, first served basis, although all +existing users and groups will be mapped as soon as a client performs a user or group +enumeration command. The allocated unix ids are stored in a database file under the Samba +lock directory and will be remembered. +

    +The astute administrator will realize from this that the combination of pam_smbpass.so, +winbindd, and a distributed passdb backend, such as ldap, will allow the establishment of a +centrally managed, distributed user/password database that can also be used by all PAM (eg: Linux) aware +programs and applications. This arrangement can have particularly potent advantages compared with the use of +Microsoft Active Directory Service (ADS) in so far as reduction of wide area network authentication traffic. +

    Warning

    +The rid to unix id database is the only location where the user and group mappings are +stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd +to determine which user and group ids correspond to Windows NT user and group rids. +

    Password Synchronization using pam_smbpass.so

    pam_smbpass is a PAM module which can be used on conforming systems to keep the smbpasswd (Samba password) database in sync with the unix password file. PAM (Pluggable Authentication Modules) is an API supported under some Unices, such as Solaris, HPUX and Linux, that provides a generic interface to authentication mechanisms.

    -For more information on PAM, see http://ftp.kernel.org/pub/linux/libs/pam/ -

    This module authenticates a local smbpasswd user database. If you require support for authenticating against a remote SMB server, or if you're concerned about the presence of suid root binaries on your system, it is recommended that you use pam_winbind instead. -

    +
    
 Options recognized by this module are as follows:
-
-        debug           -       log more debugging info
-        audit           -       like debug, but also logs unknown usernames
-        use_first_pass  -       don't prompt the user for passwords;
-                                take them from PAM_ items instead
-        try_first_pass  -       try to get the password from a previous
-                                PAM module, fall back to prompting the user
-        use_authtok     -       like try_first_pass, but *fail* if the new
-                                PAM_AUTHTOK has not been previously set.
-                                (intended for stacking password modules only)
-        not_set_pass    -       don't make passwords used by this module
-                                available to other modules.
-        nodelay         -       don't insert ~1 second delays on authentication
-                                failure.
-        nullok          -       null passwords are allowed.
-        nonull          -       null passwords are not allowed. Used to
-                                override the Samba configuration.
-        migrate         -       only meaningful in an "auth" context;
-                                used to update smbpasswd file with a
-                                password used for successful authentication.
-        smbconf=< file >  -     specify an alternate path to the smb.conf
-                                file.
-
    +
    Table 25.1. Options recognized by pam_smbpass
    debuglog more debugging info
    auditlike debug, but also logs unknown usernames
    use_first_passdon't prompt the user for passwords; take them from PAM_ items instead
    try_first_passtry to get the password from a previous PAM module, fall back to prompting the user
    use_authtoklike try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only)
    not_set_passdon't make passwords used by this module available to other modules.
    nodelaydon't insert ~1 second delays on authentication failure.
    nulloknull passwords are allowed.
    nonullnull passwords are not allowed. Used to override the Samba configuration.
    migrateonly meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication.
    smbconf=filespecify an alternate path to the smb.conf file.
    
+
    
 Thanks go to the following people:
-
-	* Andrew Morgan < morgan@transmeta.com >, for providing the Linux-PAM
-	framework, without which none of this would have happened
-
-	* Christian Gafton < gafton@redhat.com > and Andrew Morgan again, for the
-	pam_pwdb module upon which pam_smbpass was originally based
-
-	* Luke Leighton < lkcl@switchboard.net > for being receptive to the idea,
+
    Andrew Morgan, for providing the Linux-PAM
+	framework, without which none of this would have happened
    Christian Gafton and Andrew Morgan again, for the
+	pam_pwdb module upon which pam_smbpass was originally based
    Luke Leighton for being receptive to the idea,
 	and for the occasional good-natured complaint about the project's status
-	that keep me working on it :)
-
-	* and of course, all the other members of the Samba team
-	<http://www.samba.org/samba/team.html>, for creating a great product
-	and for giving this project a purpose
-
-	---------------------
-	Stephen Langasek < vorlon@netexpress.net >
-
    
+	that keep me working on it :)
    .
+
    
 The following are examples of the use of pam_smbpass.so in the format of Linux
-/etc/pam.d/ files structure. Those wishing to implement this
+/etc/pam.d/ files structure. Those wishing to implement this
 tool on other platforms will need to adapt this appropriately.
-
    Password Synchonisation Configuration
    
+
    Password Synchronisation Configuration
    
 A sample PAM configuration that shows the use of pam_smbpass to make
 sure private/smbpasswd is kept in sync when /etc/passwd (/etc/shadow)
 is changed.  Useful when an expired password might be changed by an
 application (such as ssh).
-
    -	#%PAM-1.0
-	# password-sync
-	#
-	auth       requisite        pam_nologin.so
-	auth       required         pam_unix.so
-	account    required         pam_unix.so
-	password   requisite        pam_cracklib.so retry=3
-	password   requisite        pam_unix.so shadow md5 use_authtok try_first_pass
-	password   required         pam_smbpass.so nullok use_authtok try_first_pass
-	session    required         pam_unix.so
-
    Password Migration Configuration
    
+
    +#%PAM-1.0
+# password-sync
+#
+auth       requisite    pam_nologin.so
+auth       required     pam_unix.so
+account    required     pam_unix.so
+password   requisite    pam_cracklib.so retry=3
+password   requisite    pam_unix.so shadow md5 use_authtok try_first_pass
+password   required     pam_smbpass.so nullok use_authtok try_first_pass
+session    required     pam_unix.so
+
    Password Migration Configuration
    
 A sample PAM configuration that shows the use of pam_smbpass to migrate
 from plaintext to encrypted passwords for Samba.  Unlike other methods,
 this can be used for users who have never connected to Samba shares:
 password migration takes place when users ftp in, login using ssh, pop
 their mail, etc.
-
    -	#%PAM-1.0
-	# password-migration
-	#
-	auth       requisite        pam_nologin.so
-	# pam_smbpass is called IFF pam_unix succeeds.
-	auth       requisite        pam_unix.so
-	auth       optional         pam_smbpass.so migrate
-	account    required         pam_unix.so
-	password   requisite        pam_cracklib.so retry=3
-	password   requisite        pam_unix.so shadow md5 use_authtok try_first_pass
-	password   optional         pam_smbpass.so nullok use_authtok try_first_pass
-	session    required         pam_unix.so
-
    Mature Password Configuration
    
+
    +#%PAM-1.0
+# password-migration
+#
+auth       requisite   pam_nologin.so
+# pam_smbpass is called IF pam_unix succeeds.
+auth       requisite   pam_unix.so
+auth       optional    pam_smbpass.so migrate
+account    required    pam_unix.so
+password   requisite   pam_cracklib.so retry=3
+password   requisite   pam_unix.so shadow md5 use_authtok try_first_pass
+password   optional    pam_smbpass.so nullok use_authtok try_first_pass
+session    required    pam_unix.so
+
    Mature Password Configuration
    
 A sample PAM configuration for a 'mature' smbpasswd installation.
 private/smbpasswd is fully populated, and we consider it an error if
-the smbpasswd doesn't exist or doesn't match the Unix password.
-
    -	#%PAM-1.0
-	# password-mature
-	#
-	auth       requisite        pam_nologin.so
-	auth       required         pam_unix.so
-	account    required         pam_unix.so
-	password   requisite        pam_cracklib.so retry=3
-	password   requisite        pam_unix.so shadow md5 use_authtok try_first_pass
-	password   required         pam_smbpass.so use_authtok use_first_pass
-	session    required         pam_unix.so
-
    Kerberos Password Integration Configuration
    
-A sample PAM configuration that shows pam_smbpass used together with
-pam_krb5.  This could be useful on a Samba PDC that is also a member of
-a Kerberos realm.
-
    -	#%PAM-1.0
-	# kdc-pdc
-	#
-	auth       requisite        pam_nologin.so
-	auth       requisite        pam_krb5.so
-	auth       optional         pam_smbpass.so migrate
-	account    required         pam_krb5.so
-	password   requisite        pam_cracklib.so retry=3
-	password   optional         pam_smbpass.so nullok use_authtok try_first_pass
-	password   required         pam_krb5.so use_authtok try_first_pass
-	session    required         pam_krb5.so
-

    Distributed Authentication

    -The astute administrator will realize from this that the -combination of pam_smbpass.so, -winbindd, and a distributed -passdb backend, such as ldap, will allow the establishment of a -centrally managed, distributed -user/password database that can also be used by all -PAM (eg: Linux) aware programs and applications. This arrangement -can have particularly potent advantages compared with the -use of Microsoft Active Directory Service (ADS) in so far as -reduction of wide area network authentication traffic. -

    Chapter 21. Stackable VFS modules

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    Alexander Bokovoy

    Tim Potter

    Simo Sorce

    Table of Contents

    Introduction and configuration
    Included modules
    audit
    extd_audit
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan

    Introduction and configuration

    -Since samba 3.0, samba supports stackable VFS(Virtual File System) modules. -Samba passes each request to access the unix file system thru the loaded VFS modules. -This chapter covers all the modules that come with the samba source and references to -some external modules. -

    -You may have problems to compile these modules, as shared libraries are -compiled and linked in different ways on different systems. -They currently have been tested against GNU/linux and IRIX. -

    -To use the VFS modules, create a share similar to the one below. The -important parameter is the vfs object parameter which must point to -the exact pathname of the shared library objects. For example, to log all access -to files and use a recycle bin: - -

    -       [audit]
-                comment = Audited /data directory
-                path = /data
-                vfs object = /path/to/audit.so /path/to/recycle.so
-                writeable = yes
-                browseable = yes
-

    -

    -The modules are used in the order they are specified. -

    -Further documentation on writing VFS modules for Samba can be found in -the Samba Developers Guide. -

    Included modules

    audit

    A simple module to audit file access to the syslog -facility. The following operations are logged: -

    share
    connect/disconnect
    directory opens/create/remove
    file open/close/rename/unlink/chmod

    -

    extd_audit

    -This module is identical with the audit module above except -that it sends audit logs to both syslog as well as the smbd log file/s. The -loglevel for this module is set in the smb.conf file. -

    -The logging information that will be written to the smbd log file is controlled by -the log level parameter in smb.conf. The -following information will be recorded: -

    Table 21.1. Extended Auditing Log Information

    Log LevelLog Details - File and Directory Operations
    0Creation / Deletion
    1Create / Delete / Rename / Permission Changes
    2Create / Delete / Rename / Perm Change / Open / Close

    recycle

    -A recycle-bin like module. When used any unlink call -will be intercepted and files moved to the recycle -directory instead of being deleted. -

    Supported options: -

    vfs_recycle_bin:repository

    FIXME

    vfs_recycle_bin:keeptree

    FIXME

    vfs_recycle_bin:versions

    FIXME

    vfs_recycle_bin:touch

    FIXME

    vfs_recycle_bin:maxsize

    FIXME

    vfs_recycle_bin:exclude

    FIXME

    vfs_recycle_bin:exclude_dir

    FIXME

    vfs_recycle_bin:noversions

    FIXME

    -

    netatalk

    -A netatalk module, that will ease co-existence of samba and -netatalk file sharing services. -

    Advantages compared to the old netatalk module: -

    it doesn't care about creating of .AppleDouble forks, just keeps them in sync
    if share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically

    -

    VFS modules available elsewhere

    -This section contains a listing of various other VFS modules that -have been posted but don't currently reside in the Samba CVS -tree for one reason or another (e.g. it is easy for the maintainer -to have his or her own CVS tree). +the smbpasswd doesn't exist or doesn't match the Unix password. +

    +#%PAM-1.0
+# password-mature
+#
+auth       requisite    pam_nologin.so
+auth       required     pam_unix.so
+account    required     pam_unix.so
+password   requisite    pam_cracklib.so retry=3
+password   requisite    pam_unix.so shadow md5 use_authtok try_first_pass
+password   required     pam_smbpass.so use_authtok use_first_pass
+session    required     pam_unix.so
+

    Kerberos Password Integration Configuration

    +A sample PAM configuration that shows pam_smbpass used together with +pam_krb5. This could be useful on a Samba PDC that is also a member of +a Kerberos realm. +

    +#%PAM-1.0
+# kdc-pdc
+#
+auth       requisite   pam_nologin.so
+auth       requisite   pam_krb5.so
+auth       optional    pam_smbpass.so migrate
+account    required    pam_krb5.so
+password   requisite   pam_cracklib.so retry=3
+password   optional    pam_smbpass.so nullok use_authtok try_first_pass
+password   required    pam_krb5.so use_authtok try_first_pass
+session    required    pam_krb5.so
+

    Common Errors

    +PAM can be a very fickle and sensitive to configuration glitches. Here we look at a few cases from +the Samba mailing list. +

    pam_winbind problem

    + I have the following PAM configuration: +

    +

    +auth required /lib/security/pam_securetty.so
+auth sufficient /lib/security/pam_winbind.so
+auth sufficient /lib/security/pam_unix.so use_first_pass nullok
+auth required /lib/security/pam_stack.so service=system-auth
+auth required /lib/security/pam_nologin.so
+account required /lib/security/pam_stack.so service=system-auth
+account required /lib/security/pam_winbind.so
+password required /lib/security/pam_stack.so service=system-auth
+

    -No statemets about the stability or functionality of any module -should be implied due to its presence here. -

    DatabaseFS

    -URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php -

    By Eric Lorimer.

    -I have created a VFS module which implements a fairly complete read-only -filesystem. It presents information from a database as a filesystem in -a modular and generic way to allow different databases to be used -(originally designed for organizing MP3s under directories such as -"Artists," "Song Keywords," etc... I have since applied it to a student -roster database very easily). The directory structure is stored in the -database itself and the module makes no assumptions about the database -structure beyond the table it requires to run. -

    -Any feedback would be appreciated: comments, suggestions, patches, -etc... If nothing else, hopefully it might prove useful for someone -else who wishes to create a virtual filesystem. -

    vscan

    URL: http://www.openantivirus.org/

    -samba-vscan is a proof-of-concept module for Samba, which -uses the VFS (virtual file system) features of Samba 2.2.x/3.0 -alphaX. Of couse, Samba has to be compiled with VFS support. -samba-vscan supports various virus scanners and is maintained -by Rainer Link. -

    Chapter 22. Hosting a Microsoft Distributed File System tree on Samba

    Shirish Kalele

    Samba Team & Veritas Software


    - <samba@samba.org>
    -

    12 Jul 2000

    Table of Contents

    Instructions
    Notes

    Instructions

    The Distributed File System (or Dfs) provides a means of - separating the logical view of files and directories that users - see from the actual physical locations of these resources on the - network. It allows for higher availability, smoother storage expansion, - load balancing etc. For more information about Dfs, refer to - Microsoft documentation.

    This document explains how to host a Dfs tree on a Unix - machine (for Dfs-aware clients to browse) using Samba.

    To enable SMB-based DFS for Samba, configure it with the - --with-msdfs option. Once built, a - Samba server can be made a Dfs server by setting the global - boolean - host msdfs parameter in the smb.conf - file. You designate a share as a Dfs root using the share - level boolean - msdfs root parameter. A Dfs root directory on - Samba hosts Dfs links in the form of symbolic links that point - to other servers. For example, a symbolic link - junction->msdfs:storage1\share1 in - the share directory acts as the Dfs junction. When Dfs-aware - clients attempt to access the junction link, they are redirected - to the storage location (in this case, \\storage1\share1).

    Dfs trees on Samba work with all Dfs-aware clients ranging - from Windows 95 to 2000.

    Here's an example of setting up a Dfs tree on a Samba - server.

    -# The smb.conf file:
-[global]
-	netbios name = SAMBA
-	host msdfs   = yes
-
-[dfs]
-	path = /export/dfsroot
-	msdfs root = yes
-

    In the /export/dfsroot directory we set up our dfs links to - other servers on the network.

    root# cd /export/dfsroot

    root# chown root /export/dfsroot

    root# chmod 755 /export/dfsroot

    root# ln -s msdfs:storageA\\shareA linka

    root# ln -s msdfs:serverB\\share,serverC\\share linkb

    You should set up the permissions and ownership of - the directory acting as the Dfs root such that only designated - users can create, delete or modify the msdfs links. Also note - that symlink names should be all lowercase. This limitation exists - to have Samba avoid trying all the case combinations to get at - the link name. Finally set up the symbolic links to point to the - network shares you want, and start Samba.

    Users on Dfs-aware clients can now browse the Dfs tree - on the Samba server at \\samba\dfs. Accessing - links linka or linkb (which appear as directories to the client) - takes users directly to the appropriate shares on the network.

    Notes

    • Windows clients need to be rebooted - if a previously mounted non-dfs share is made a dfs - root or vice versa. A better way is to introduce a - new share and make it the dfs root.

    • Currently there's a restriction that msdfs - symlink names should all be lowercase.

    • For security purposes, the directory - acting as the root of the Dfs tree should have ownership - and permissions set so that only designated users can - modify the symbolic links in the directory.

    Chapter 23. Integrating MS Windows networks with Samba

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    (Jan 01 2001)

    Table of Contents

    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup

    + When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie". + I've tried with user "scienceu+pitie" also. +

    + Answer: The problem may lie with your inclusion of pam_stack.so + service=system-auth. That file often contains a lot of stuff that may + duplicate what you're already doing. Try commenting out the pam_stack lines + for auth and account and see if things work. If they do, look at + /etc/pam.d/system-auth and copy only what you need from it into your + /etc/pam.d/login file. Alternatively, if you want all services to use + winbind, you can put the winbind-specific stuff in /etc/pam.d/system-auth. +

    Chapter 26. Integrating MS Windows networks with Samba

    John H. Terpstra

    Samba Team

    (Jan 01 2001)

    Table of Contents

    Features and Benefits
    Background Information
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    My Boomerang Won't Come Back
    Very Slow Network Connections
    Samba server name change problem

    This section deals with NetBIOS over TCP/IP name to IP address resolution. If your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this section does not apply to your installation. If your installation involves use of @@ -7192,7 +14458,15 @@ NetBIOS over TCP/IP then this section may help you to resolve networking problem to NOT run NetBEUI at all. Note also that there is NO such thing as NetBEUI over TCP/IP - the existence of such a protocol is a complete and utter mis-apprehension. -

    +

    Features and Benefits

    +Many MS Windows network administrators have never been exposed to basic TCP/IP +networking as it is implemented in a Unix/Linux operating system. Likewise, many Unix and +Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP based +networking (and may have no desire to be either). +

    +This chapter gives a short introduction to the basics of how a name can be resolved to +it's IP address for each operating system environment. +

    Background Information

    Since the introduction of MS Windows 2000 it is possible to run MS Windows networking without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over @@ -7208,16 +14482,16 @@ disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS req Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR). Use of DHCP with ADS is recommended as a further means of maintaining central control over client workstation network configuration. -

    Name Resolution in a pure Unix/Linux world

    +

    Name Resolution in a pure Unix/Linux world

    The key configuration files covered in this section are: -

    • /etc/hosts

    • /etc/resolv.conf

    • /etc/host.conf

    • /etc/nsswitch.conf

    /etc/hosts

    +

    • /etc/hosts

    • /etc/resolv.conf

    • /etc/host.conf

    • /etc/nsswitch.conf

    /etc/hosts

    Contains a static list of IP Addresses and names. eg: -

    +
     	127.0.0.1	localhost localhost.localdomain
 	192.168.1.1	bigbox.caldera.com	bigbox	alias4box
 
    
-The purpose of /etc/hosts is to provide a 
+The purpose of /etc/hosts is to provide a 
 name resolution mechanism so that uses do not need to remember 
 IP addresses.
 
    
@@ -7225,16 +14499,16 @@ Network packets that are sent over the physical network transport
 layer communicate not via IP addresses but rather using the Media 
 Access Control address, or MAC address. IP Addresses are currently 
 32 bits in length and are typically presented as four (4) decimal 
-numbers that are separated by a dot (or period). eg: 168.192.1.1
+numbers that are separated by a dot (or period). eg: 168.192.1.1.
 
    
 MAC Addresses use 48 bits (or 6 bytes) and are typically represented 
 as two digit hexadecimal numbers separated by colons. eg: 
 40:8e:0a:12:34:56
 
    
-Every network interfrace must have an MAC address. Associated with 
+Every network interface must have an MAC address. Associated with 
 a MAC address there may be one or more IP addresses. There is NO 
 relationship between an IP address and a MAC address, all such assignments 
-are arbitary or discretionary in nature. At the most basic level all 
+are arbitrary or discretionary in nature. At the most basic level all 
 network communications takes place using MAC addressing. Since MAC 
 addresses must be globally unique, and generally remains fixed for 
 any particular interface, the assignment of an IP address makes sense 
@@ -7246,7 +14520,7 @@ When a user or a process wants to communicate with another machine
 the protocol implementation ensures that the "machine name" or "host 
 name" is resolved to an IP address in a manner that is controlled 
 by the TCP/IP configuration control files. The file 
-/etc/hosts is one such file.
+/etc/hosts is one such file.
 
    
 When the IP address of the destination interface has been 
 determined a protocol called ARP/RARP is used to identify 
@@ -7260,14 +14534,14 @@ ff:ff:ff:ff:ff:ff. The reply packet from an ARP request will
 contain the MAC address and the primary IP address for each 
 interface.
 
    
-The /etc/hosts file is foundational to all 
-Unix/Linux TCP/IP installations and as a minumum will contain 
+The /etc/hosts file is foundational to all 
+Unix/Linux TCP/IP installations and as a minimum will contain 
 the localhost and local network interface IP addresses and the 
 primary names by which they are known within the local machine. 
 This file helps to prime the pump so that a basic level of name 
 resolution can exist before any other method of name resolution 
 becomes available.
-

    /etc/resolv.conf

    +

    /etc/resolv.conf

    This file tells the name resolution libraries:

    • The name of the domain to which the machine belongs @@ -7277,21 +14551,21 @@ This file tells the name resolution libraries:

    • The name or IP address of available Domain Name Servers that may be asked to perform name to address translation lookups -

    /etc/host.conf

    -/etc/host.conf is the primary means by +

    /etc/host.conf

    +/etc/host.conf is the primary means by which the setting in /etc/resolv.conf may be affected. It is a critical configuration file. This file controls the order by -which name resolution may procede. The typical structure is: -

    +which name resolution may proceed. The typical structure is:
+
     	order hosts,bind
 	multi on
 
    
 then both addresses should be returned. Please refer to the 
 man page for host.conf for further details.
-

    /etc/nsswitch.conf

    +

    /etc/nsswitch.conf

    This file controls the actual name resolution targets. The file typically has resolver object specifications as follows: -

    +
     	# /etc/nsswitch.conf
 	#
 	# Name Service Switch configuration file.
@@ -7305,7 +14579,7 @@ file typically has resolver object specifications as follows:
 
 	hosts:		files nis dns
 	# Alternative entries for host name resolution are:
-	# hosts:	files dns nis nis+ hesoid db compat ldap wins
+	# hosts:	files dns nis nis+ hesiod db compat ldap wins
 	networks:	nis files dns
 
 	ethers:		nis files
@@ -7324,15 +14598,15 @@ Starting with version 2.2.0 samba has Linux support for extensions to
 the name service switch infrastructure so that linux clients will 
 be able to obtain resolution of MS Windows NetBIOS names to IP 
 Addresses. To gain this functionality Samba needs to be compiled 
-with appropriate arguments to the make command (ie: make 
-nsswitch/libnss_wins.so). The resulting library should 
-then be installed in the /lib directory and 
+with appropriate arguments to the make command (ie: make 
+nsswitch/libnss_wins.so). The resulting library should 
+then be installed in the /lib directory and 
 the "wins" parameter needs to be added to the "hosts:" line in 
-the /etc/nsswitch.conf file. At this point it 
+the /etc/nsswitch.conf file. At this point it 
 will be possible to ping any MS Windows machine by it's NetBIOS 
 machine name, so long as that machine is within the workgroup to 
 which both the samba machine and the MS Windows machine belong.
-

    Name resolution as used within MS Windows networking

    +

    Name resolution as used within MS Windows networking

    MS Windows networking is predicated about the name each machine is given. This name is known variously (and inconsistently) as the "computer name", "machine name", "networking name", "netbios name", @@ -7347,7 +14621,7 @@ name is therefore registered for each service type that is provided by the client/server.

    The following are typical NetBIOS name/service type registrations: -

    +
     	Unique NetBIOS Names:
 		MACHINENAME<00>	= Server Service is running on MACHINENAME
 		MACHINENAME<03> = Generic Machine Name (NetBIOS name)
@@ -7366,7 +14640,7 @@ installations where traditionally the system administrator will
 determine in the /etc/hosts or in the DNS database what names 
 are associated with each IP address.
 
    
-One further point of clarification should be noted, the /etc/hosts 
+One further point of clarification should be noted, the /etc/hosts 
 file and the DNS records do not provide the NetBIOS name type information 
 that MS Windows clients depend on to locate the type of service that may 
 be needed. An example of this is what happens when an MS Windows client 
@@ -7403,7 +14677,7 @@ NBT or NetBT, the NetBIOS over TCP/IP.
 MS Windows machines use a complex array of name resolution mechanisms. 
 Since we are primarily concerned with TCP/IP this demonstration is 
 limited to this area.
-
    The NetBIOS Name Cache
    
+
    The NetBIOS Name Cache
    
 All MS Windows machines employ an in memory buffer in which is 
 stored the NetBIOS names and IP addresses for all external 
 machines that that machine has communicated with over the 
@@ -7420,16 +14694,16 @@ frustrating for users - but it is a characteristic of the protocol.
 
    
 The MS Windows utility that allows examination of the NetBIOS 
 name cache is called "nbtstat". The Samba equivalent of this 
-is called "nmblookup".
-
    The LMHOSTS file
    
+is called nmblookup.
+
    The LMHOSTS file
    
 This file is usually located in MS Windows NT 4.0 or 
-2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains 
+2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains 
 the IP Address and the machine name in matched pairs. The 
-LMHOSTS file performs NetBIOS name 
+LMHOSTS file performs NetBIOS name 
 to IP address mapping.
 
    
 It typically looks like:
-
    +
     	# Copyright (c) 1998 Microsoft Corp.
 	#
 	# This is a sample LMHOSTS file used by the Microsoft Wins Client (NetBIOS
@@ -7438,7 +14712,7 @@ It typically looks like:
 	# This file contains the mappings of IP addresses to NT computernames
 	# (NetBIOS) names.  Each entry should be kept on an individual line.
 	# The IP address should be placed in the first column followed by the
-	# corresponding computername. The address and the comptername
+	# corresponding computername. The address and the computername
 	# should be separated by at least one space or tab. The "#" character
 	# is generally used to denote the start of a comment (see the exceptions
 	# below).
@@ -7470,7 +14744,7 @@ It typically looks like:
 	# centralized lmhosts file to be maintained on a server.
 	# It is ALWAYS necessary to provide a mapping for the IP address of the
 	# server prior to the #INCLUDE. This mapping must use the #PRE directive.
-	# In addtion the share "public" in the example below must be in the
+	# In addition the share "public" in the example below must be in the
 	# LanManServer list of "NullSessionShares" in order for client machines to
 	# be able to read the lmhosts file successfully. This key is under
 	# \machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares
@@ -7506,14 +14780,14 @@ It typically looks like:
 	# so keeping the number of comments to a minimum will improve performance.
 	# Therefore it is not advisable to simply add lmhosts file entries onto the
 	# end of this file.
-
    HOSTS file
    
+

    HOSTS file

    This file is usually located in MS Windows NT 4.0 or 2000 in -C:\WINNT\SYSTEM32\DRIVERS\ETC and contains +C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address and the IP hostname in matched pairs. It can be used by the name resolution infrastructure in MS Windows, depending on how the TCP/IP environment is configured. This file is in -every way the equivalent of the Unix/Linux /etc/hosts file. -

    DNS Lookup

    +every way the equivalent of the Unix/Linux /etc/hosts file. +

    DNS Lookup

    This capability is configured in the TCP/IP setup area in the network configuration facility. If enabled an elaborate name resolution sequence is followed the precise nature of which is dependant on what the NetBIOS @@ -7524,140 +14798,97 @@ cache. If that fails then DNS, HOSTS and LMHOSTS are checked. If set to Node Type 8, then a NetBIOS Unicast (over UDP Unicast) is sent to the WINS Server to obtain a lookup before DNS, HOSTS, LMHOSTS, or broadcast lookup is used. -

    WINS Lookup

    -A WINS (Windows Internet Name Server) service is the equivaent of the +

    WINS Lookup

    +A WINS (Windows Internet Name Server) service is the equivalent of the rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores the names and IP addresses that are registered by a Windows client if the TCP/IP setup has been given at least one WINS Server IP Address.

    To configure Samba to be a WINS server the following parameter needs -to be added to the smb.conf file: -

    +to be added to the smb.conf file:
+
     	wins support = Yes
 
    
 To configure Samba to use a WINS server the following parameters are 
-needed in the smb.conf file:
-
    +needed in the smb.conf file:
+
     	wins support = No
 	wins server = xxx.xxx.xxx.xxx
 
    
-where xxx.xxx.xxx.xxx is the IP address 
+where xxx.xxx.xxx.xxx is the IP address 
 of the WINS server.
-

    Chapter 24. Securing Samba

    Andrew Tridgell

    Samba Team

    <tridge@samba.org>

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    17 March 2003

    Table of Contents

    Introduction
    Using host based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba

    Introduction

    -This note was attached to the Samba 2.2.8 release notes as it contained an -important security fix. The information contained here applies to Samba -installations in general. -

    Using host based protection

    -In many installations of Samba the greatest threat comes for outside -your immediate network. By default Samba will accept connections from -any host, which means that if you run an insecure version of Samba on -a host that is directly connected to the Internet you can be -especially vulnerable. -

    -One of the simplest fixes in this case is to use the hosts allow and -hosts deny options in the Samba smb.conf configuration file to only -allow access to your server from a specific range of hosts. An example -might be: -

    -	hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
-	hosts deny = 0.0.0.0/0
-

    -The above will only allow SMB connections from 'localhost' (your own -computer) and from the two private networks 192.168.2 and -192.168.3. All other connections will be refused as soon -as the client sends its first packet. The refusal will be marked as a -'not listening on called name' error. -

    Using interface protection

    -By default Samba will accept connections on any network interface that -it finds on your system. That means if you have a ISDN line or a PPP -connection to the Internet then Samba will accept connections on those -links. This may not be what you want. -

    -You can change this behaviour using options like the following: -

    -	interfaces = eth* lo
-	bind interfaces only = yes
-

    -This tells Samba to only listen for connections on interfaces with a -name starting with 'eth' such as eth0, eth1, plus on the loopback -interface called 'lo'. The name you will need to use depends on what -OS you are using, in the above I used the common name for Ethernet -adapters on Linux. -

    -If you use the above and someone tries to make a SMB connection to -your host over a PPP interface called 'ppp0' then they will get a TCP -connection refused reply. In that case no Samba code is run at all as -the operating system has been told not to pass connections from that -interface to any samba process. -

    Using a firewall

    -Many people use a firewall to deny access to services that they don't -want exposed outside their network. This can be a very good idea, -although I would recommend using it in conjunction with the above -methods so that you are protected even if your firewall is not active -for some reason. -

    -If you are setting up a firewall then you need to know what TCP and -UDP ports to allow and block. Samba uses the following: -

    -	UDP/137    - used by nmbd
-	UDP/138    - used by nmbd
-	TCP/139    - used by smbd
-	TCP/445    - used by smbd
-

    -The last one is important as many older firewall setups may not be -aware of it, given that this port was only added to the protocol in -recent years. -

    Using a IPC$ share deny

    -If the above methods are not suitable, then you could also place a -more specific deny on the IPC$ share that is used in the recently -discovered security hole. This allows you to offer access to other -shares while denying access to IPC$ from potentially untrustworthy -hosts. -

    -To do that you could use: -

    -	[ipc$]
-	     hosts allow = 192.168.115.0/24 127.0.0.1
-	     hosts deny = 0.0.0.0/0
-

    -this would tell Samba that IPC$ connections are not allowed from -anywhere but the two listed places (localhost and a local -subnet). Connections to other shares would still be allowed. As the -IPC$ share is the only share that is always accessible anonymously -this provides some level of protection against attackers that do not -know a username/password for your host. -

    -If you use this method then clients will be given a 'access denied' -reply when they try to access the IPC$ share. That means that those -clients will not be able to browse shares, and may also be unable to -access some other resources. -

    -This is not recommended unless you cannot use one of the other -methods listed above for some reason. -

    NTLMv2 Security

    -To configure NTLMv2 authentication the following registry keys are worth knowing about: -

    -

    -	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
-	"lmcompatibilitylevel"=dword:00000003
+

    Common Errors

    +TCP/IP network configuration problems find every network administrator sooner or later. +The cause can be anything from keyboard mishaps, forgetfulness, simple mistakes, and +carelessness. Of course, no one is every deliberately careless! +

    My Boomerang Won't Come Back

    + Well, the real complaint said, "I can ping my samba server from Windows, but I can + not ping my Windows machine from the samba server." +

    + The Windows machine was at IP Address 192.168.1.2 with netmask 255.255.255.0, the + Samba server (Linux) was at IP Address 192.168.1.130 with netmask 255.255.255.128. + The machines were on a local network with no external connections. +

    + Due to inconsistent netmasks, the Windows machine was on network 192.168.1.0/24, while + the Samba server was on network 192.168.1.128/25 - logically a different network. +

    Very Slow Network Connections

    + A common causes of slow network response includes: +

    • Client is configured to use DNS and DNS server is down

    • Client is configured to use remote DNS server, but remote connection is down

    • Client is configured to use a WINS server, but there is no WINS server

    • Client is NOT configured to use a WINS server, but there is a WINS server

    • Firewall is filtering our DNS or WINS traffic

    Samba server name change problem

    + The name of the samba server was changed, samba was restarted, samba server can not be + pinged by new name from MS Windows NT4 Workstation, but it does still respond to ping using + the old name. Why? +

    + From this description three (3) things are rather obvious: +

    • WINS is NOT in use, only broadcast based name resolution is used

    • The samba server was renamed and restarted within the last 10-15 minutes

    • The old samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation

    + To find what names are present in the NetBIOS name cache on the MS Windows NT4 machine, + open a cmd shell, then: +

    + 

    +	C:\temp\>nbtstat -n
 
-	0x3 - Send NTLMv2 response only. Clients will use NTLMv2 authentication,
-	use NTLMv2 session security if the server supports it. Domain
-	controllers accept LM, NTLM and NTLMv2 authentication.
+	              NetBIOS Local Name Table
 
-	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
-	"NtlmMinClientSec"=dword:00080000
+	   Name                 Type          Status
+	------------------------------------------------
+	SLACK            <03>  UNIQUE      Registered
+	ADMINISTRATOR    <03>  UNIQUE      Registered
+	SLACK            <00>  UNIQUE      Registered
+	SARDON           <00>  GROUP       Registered
+	SLACK            <20>  UNIQUE      Registered
+	SLACK            <1F>  UNIQUE      Registered
 
-	0x80000 - NTLMv2 session security. If either NtlmMinClientSec or
-	NtlmMinServerSec is set to 0x80000, the connection will fail if NTLMv2
-	session security is not negotiated.
-

    -

    Upgrading Samba

    -Please check regularly on http://www.samba.org/ for updates and -important announcements. Occasionally security releases are made and -it is highly recommended to upgrade Samba when a security vulnerability -is discovered. -

    Chapter 25. Unicode/Charsets

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    TAKAHASHI Motonobu

    <monyo@home.monyo.com>

    25 March 2003

    Table of Contents

    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets

    What are charsets and unicode?

    + + C:\Temp\>nbtstat -c + + NetBIOS Remote Cache Name Table + + Name Type Host Address Life [sec] + -------------------------------------------------------------- + FRODO <20> UNIQUE 192.168.1.1 240 + + C:\Temp\> +

    +

    + In the above example, FRODO is the Samba server and SLACK is the MS Windows NT4 Workstation. + The first listing shows the contents of the Local Name Table (ie: Identity information on + the MS Windows workstation), the second shows the NetBIOS name in the NetBIOS name cache. + The name cache contains the remote machines known to this workstation. +

    Chapter 27. Unicode/Charsets

    Jelmer R. Vernooij

    The Samba Team

    TAKAHASHI Motonobu

    25 March 2003

    Table of Contents

    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets

    Features and Benefits

    +Every industry eventually matures. One of the great areas of maturation is in +the focus that has been given over the past decade to make it possible for anyone +anywhere to use a computer. It has not always been that way, in fact, not so long +ago it was common for software to be written for exclusive use in the country of +origin. +

    +Of all the effort that has been brought to bear on providing native language support +for all computer users, the efforts of the Openi18n organisation is deserving of +special mention. For more information about Openi18n please refer to: +http://www.openi18n.org/. +

    +Samba-2.x supported a single locale through a mechanism called +codepages. Samba-3 is destined to become a truly trans-global +file and printer sharing platform. +

    What are charsets and unicode?

    Computers communicate in numbers. In texts, each number will be translated to a corresponding letter. The meaning that will be assigned to a certain number depends on the character set(charset) @@ -7669,7 +14900,7 @@ with German umlauts, Japanese characters, etc). Usually a charset contains exactly one byte.

    There are also charsets that support even more characters, but those need twice(or even more) as much storage space. These -charsets can contain 256 * 256 = 65536 characters, which +charsets can contain 256 * 256 = 65536 characters, which is more then all possible characters one could think of. They are called multibyte charsets (because they use more then one byte to store one character). @@ -7680,290 +14911,475 @@ A big advantage of using a multibyte charset is that you only need one; no need to make sure two computers use the same charset when they are communicating.

    Old windows clients used to use single-byte charsets, named -'codepages' by microsoft. However, there is no support for +'codepages' by Microsoft. However, there is no support for negotiating the charset to be used in the smb protocol. Thus, you have to make sure you are using the same charset when talking to an old client. Newer clients (Windows NT, 2K, XP) talk unicode over the wire. -

    Samba and charsets

    +

    Samba and charsets

    As of samba 3.0, samba can (and will) talk unicode over the wire. Internally, samba knows of three kinds of character sets: -

    unix charset

    +

    unix charset

    This is the charset used internally by your operating system. - The default is ASCII, which is fine for most + The default is ASCII, which is fine for most systems. -

    display charset

    This is the charset samba will use to print messages - on your screen. It should generally be the same as the unix charset. -

    dos charset

    This is the charset samba uses when communicating with +

    display charset

    This is the charset samba will use to print messages + on your screen. It should generally be the same as the unix charset. +

    dos charset

    This is the charset samba uses when communicating with DOS and Windows 9x clients. It will talk unicode to all newer clients. The default depends on the charsets you have installed on your system. - Run testparm -v | grep "dos charset" to see + Run testparm -v | grep "dos charset" to see what the default is on your system. -

    Conversion from old names

    Because previous samba versions did not do any charset conversion, +

    Conversion from old names

    Because previous samba versions did not do any charset conversion, characters in filenames are usually not correct in the unix charset but only for the local charset used by the DOS/Windows clients.

    The following script from Steve Langasek converts all filenames from CP850 to the iso8859-15 charset.

    -#find /path/to/share -type f -exec bash -c 'CP="{}"; ISO=`echo -n "$CP" | iconv -f cp850 \ +#find /path/to/share -type f -exec bash -c 'CP="{}"; ISO=`echo -n "$CP" | iconv -f cp850 \ -t iso8859-15`; if [ "$CP" != "$ISO" ]; then mv "$CP" "$ISO"; fi' \; -

    Japanese charsets

    Samba doesn't work correctly with Japanese charsets yet. Here are -points of attention when setting it up:

    • You should set mangling method = -hash

    • There are various iconv() implementations around and not +

    Japanese charsets

    Samba doesn't work correctly with Japanese charsets yet. Here are +points of attention when setting it up:

    • You should set mangling method = +hash

    • There are various iconv() implementations around and not all of them work equally well. glibc2's iconv() has a critical problem in CP932. libiconv-1.8 works with CP932 but still has some problems and -does not work with EUC-JP.

    • You should set dos charset = CP932, not -Shift_JIS, SJIS...

    • Currently only unix charset = CP932 +does not work with EUC-JP.

    • You should set dos charset = CP932, not +Shift_JIS, SJIS...

    • Currently only unix charset = CP932 will work (but still has some problems...) because of iconv() issues. -unix charset = EUC-JP doesn't work well because of -iconv() issues.

    • Currently Samba 3.0 does not support unix charset -= UTF8-MAC/CAP/HEX/JIS*

    More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

    Chapter 26. File and Record Locking

    Jeremy Allison

    Samba Team

    <jra@samba.org>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    Table of Contents

    Discussion
    Samba Opportunistic Locking Control
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Additional Reading

    Discussion

    -One area which sometimes causes trouble is locking. -

    -There are two types of locking which need to be performed by a SMB server. -The first is record locking which allows a client to lock -a range of bytes in a open file. The second is the deny modes -that are specified when a file is open. -

    -Record locking semantics under Unix is very different from record locking under -Windows. Versions of Samba before 2.2 have tried to use the native fcntl() unix -system call to implement proper record locking between different Samba clients. -This can not be fully correct due to several reasons. The simplest is the fact -that a Windows client is allowed to lock a byte range up to 2^32 or 2^64, -depending on the client OS. The unix locking only supports byte ranges up to 2^31. -So it is not possible to correctly satisfy a lock request above 2^31. There are -many more differences, too many to be listed here. +unix charset = EUC-JP doesn't work well because of +iconv() issues.

  • Currently Samba 3.0 does not support unix charset += UTF8-MAC/CAP/HEX/JIS*

    • More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

    Chapter 28. Samba Backup Techniques

    John H. Terpstra

    Samba Team

    Table of Contents

    Note
    Features and Benefits

    Note

    +This chapter did not make it into this release. +It is planned for the published release of this document. +If you have something to contribute for this section please email it to +jht@samba.org/ +

    Features and Benefits

    +We need feedback from people who are backing up samba servers. +We would like to know what software tools you are using to backup +your samba server/s. +

    +In particular, if you have any success and / or failure stories you could +share with other users this would be appreciated. +

    Chapter 29. High Availability Options

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +This chapter did not make it into this release. +It is planned for the published release of this document. +

    Migration and Updating

    Table of Contents

    30. Upgrading from Samba-2.x to Samba-3.0.0
    Charsets
    Obsolete configuration options
    Password Backend
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0

    Jelmer R. Vernooij

    The Samba Team

    25 October 2002

    Table of Contents

    Charsets
    Obsolete configuration options
    Password Backend

    Charsets

    You might experience problems with special characters +when communicating with old DOS clients. Codepage +support has changed in samba 3.0. Read the chapter +Unicode support for details. +

    Obsolete configuration options

    +In 3.0, the following configuration options have been removed. +

    printer driver (replaced by new driver procedures)
    printer driver file (replaced by new driver procedures)
    printer driver location (replaced by new driver procedures)
    use rhosts
    postscript
    client code page (replaced by dos charset)
    vfs path
    vfs options

    Password Backend

    +Effective with the release of samba-3 it is now imperative that the password backend +be correctly defined in smb.conf. +

    +Those migrating from samba-2.x with plaintext password support need the following: +passdb backend = guest. +

    +Those migrating from samba-2.x with encrypted password support should add to smb.conf +passdb backend = smbpasswd, guest. +

    +LDAP using Samba-2.x systems can continue to operate with the following entry +passdb backend = ldapsam_compat, guest. +

    Chapter 31. Migration from NT4 PDC to Samba-3 PDC

    John H. Terpstra

    Samba Team

    April 3, 2003

    Table of Contents

    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices

    +This is a rough guide to assist those wishing to migrate from NT4 domain control to +Samba-3 based domain control. +

    Planning and Getting Started

    +In the IT world there is often a saying that all problems are encountered because of +poor planning. The corollary to this saying is that not all problems can be anticipated +and planned for. Then again, good planning will anticipate most show stopper type situations.

    -Samba 2.2 and above implements record locking completely independent of the -underlying unix system. If a byte range lock that the client requests happens -to fall into the range 0-2^31, Samba hands this request down to the Unix system. -All other locks can not be seen by unix anyway. +Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control +environment would do well to develop a detailed migration plan. So here are a few pointers to +help migration get under way. +

    Objectives

    +The key objective for most organisations will be to make the migration from MS Windows NT4 +to Samba-3 domain control as painless as possible. One of the challenges you may experience +in your migration process may well be one of convincing management that the new environment +should remain in place. Many who have introduced open source technologies have experienced +pressure to return to a Microsoft based platform solution at the first sign of trouble.

    -Strictly a SMB server should check for locks before every read and write call on -a file. Unfortunately with the way fcntl() works this can be slow and may overstress -the rpc.lockd. It is also almost always unnecessary as clients are supposed to -independently make locking calls before reads and writes anyway if locking is -important to them. By default Samba only makes locking calls when explicitly asked -to by a client, but if you set strict locking = yes then it -will make lock checking calls on every read and write. +It is strongly advised that before attempting a migration to a Samba-3 controlled network +that every possible effort be made to gain all-round commitment to the change. Firstly, you +should know precisely why the change is important for the organisation. +Possible motivations to make a change include: +

    Improve network manageability
    Obtain better user level functionality
    Reduce network operating costs
    Reduce exposure caused by Microsoft withdrawal of NT4 support
    Avoid MS License 6 implications
    Reduce organisation's dependency on Microsoft

    +It is vital that it be well recognised that Samba-3 is NOT MS Windows NT4. Samba-3 offers +an alternative solution that is both different from MS Windows NT4 and that offers some +advantages compared with it. It should also be recognised that Samba-3 lacks many of the +features that Microsoft has promoted as core values in migration from MS Windows NT4 to +MS Windows 2000 and beyond (with or without Active Directory services).

    -You can also disable by range locking completely using locking = no. -This is useful for those shares that don't support locking or don't need it -(such as cdroms). In this case Samba fakes the return codes of locking calls to -tell clients that everything is OK. +What are the features that Samba-3 can NOT provide? +

    Active Directory Server
    Group Policy Objects (in Active Directory)
    Machine Policy objects
    Logon Scripts in Active Directory
    Software Application and Access Controls in Active Directory

    +The features that Samba-3 DOES provide and that may be of compelling interest to your site +includes: +

    Lower Cost of Ownership
    Global availability of support with no strings attached
    Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system)
    Creation of on-the-fly logon scripts
    Creation of on-the-fly Policy Files
    Greater Stability, Reliability, Performance and Availability
    Manageability via an ssh connection
    Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam)
    Ability to implement a full single-sign-on architecture
    Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand

    +Before migrating a network from MS Windows NT4 to Samba-3 it is vital that all necessary factors are +considered. Users should be educated about changes they may experience so that the change will be a +welcome one and not become an obstacle to the work they need to do. The following are some of the +factors that will go into a successful migration: +

    Domain Layout

    +Samba-3 can be configured as a domain controller, a back-up domain controller (probably best called +a secondary controller), a domain member, or as a stand-alone server. The Windows network security +domain context should be sized and scoped before implementation. Particular attention needs to be +paid to the location of the primary domain controller (PDC) as well as backup controllers (BDCs). +It should be noted that one way in which Samba-3 differs from Microsoft technology is that if one +chooses to use an LDAP authentication backend then the same database can be used by several different +domains. This means that in a complex organisation there can be a single LDAP database, that itself +can be distributed, that can simultaneously serve multiple domains (that can also be widely distributed).

    -The second class of locking is the deny modes. These -are set by an application when it opens a file to determine what types of -access should be allowed simultaneously with its open. A client may ask for -DENY_NONE, DENY_READ, DENY_WRITE or DENY_ALL. There are also special compatibility -modes called DENY_FCB and DENY_DOS. -

    Samba Opportunistic Locking Control

    -Opportunistic locking essentially means that the client is allowed to download and cache -a file on their hard drive while making changes; if a second client wants to access the -file, the first client receives a break and must synchronise the file back to the server. -This can give significant performance gains in some cases; some programs insist on -synchronising the contents of the entire file back to the server for a single change. +It is recommended that from a design perspective, the number of users per server, as well as the number +of servers, per domain should be scaled according to needs and should also consider server capacity +and network bandwidth.

    -Level1 Oplocks (aka just plain "oplocks") is another term for opportunistic locking. +A physical network segment may house several domains, each of which may span multiple network segments. +Where domains span routed network segments it is most advisable to consider and test the performance +implications of the design and layout of a network. A Centrally located domain controller that is being +designed to serve multiple routed network segments may result in severe performance problems if the +response time (eg: ping timing) between the remote segment and the PDC is more than 100 ms. In situations +where the delay is too long it is highly recommended to locate a backup controller (BDC) to serve as +the local authentication and access control server. +

    Server Share and Directory Layout

    +There are few cardinal rules to effective network design that can be broken with impunity. +The most important rule of effective network management is that simplicity is king in every +well controlled network. Every part of the infrastructure must be managed, the more complex +it is, the greater will be the demand of keeping systems secure and functional.

    -Level2 Oplocks provids opportunistic locking for a file that will be treated as -read only. Typically this is used on files that are read-only or -on files that the client has no initial intention to write to at time of opening the file. +The nature of the data that must be stored needs to be born in mind when deciding how many +shares must be created. The physical disk space layout should also be taken into account +when designing where share points will be created. Keep in mind that all data needs to be +backed up, thus the simpler the disk layout the easier it will be to keep track of what must +be backed up to tape or other off-line storage medium. Always plan and implement for minimum +maintenance. Leave nothing to chance in your design, above all, do not leave backups to chance: +Backup and test, validate every backup, create a disaster recovery plan and prove that it works.

    -Kernel Oplocks are essentially a method that allows the Linux kernel to co-exist with -Samba's oplocked files, although this has provided better integration of MS Windows network -file locking with the under lying OS, SGI IRIX and Linux are the only two OS's that are -oplock aware at this time. +Users should be grouped according to data access control needs. File and directory access +is best controlled via group permissions and the use of the "sticky bit" on group controlled +directories may substantially avoid file access complaints from samba share users.

    -Unless your system supports kernel oplocks, you should disable oplocks if you are -accessing the same files from both Unix/Linux and SMB clients. Regardless, oplocks should -always be disabled if you are sharing a database file (e.g., Microsoft Access) between -multiple clients, as any break the first client receives will affect synchronisation of -the entire file (not just the single record), which will result in a noticable performance -impairment and, more likely, problems accessing the database in the first place. Notably, -Microsoft Outlook's personal folders (*.pst) react very badly to oplocks. If in doubt, -disable oplocks and tune your system from that point. +Many network administrators who are new to the game will attempt to use elaborate techniques +to set access controls, on files, directories, shares, as well as in share definitions. +There is the ever present danger that that administrator's successor will not understand the +complex mess that has been inherited. Remember, apparent job security through complex design +and implementation may ultimately cause loss of operations and downtime to users as the new +administrator learns to untangle your web. Keep access controls simple and effective and +make sure that users will never be interrupted by the stupidity of complexity. +

    Logon Scripts

    +Please refer to the section of this document on Advanced Network Administration for information +regarding the network logon script options for Samba-3. Logon scripts can help to ensure that +all users gain share and printer connections they need.

    -If client-side caching is desirable and reliable on your network, you will benefit from -turning on oplocks. If your network is slow and/or unreliable, or you are sharing your -files among other file sharing mechanisms (e.g., NFS) or across a WAN, or multiple people -will be accessing the same files frequently, you probably will not benefit from the overhead -of your client sending oplock breaks and will instead want to disable oplocks for the share. +Logon scripts can be created on-the-fly so that all commands executed are specific to the +rights and privileges granted to the user. The preferred controls should be affected through +group membership so that group information can be used to custom create a logon script using +the root preexec parameters to the NETLOGON share.

    -Another factor to consider is the perceived performance of file access. If oplocks provide no -measurable speed benefit on your network, it might not be worth the hassle of dealing with them. +Some sites prefer to use a tool such as kixstart to establish a controlled +user environment. In any case you may wish to do a google search for logon script process controls. +In particular, you may wish to explore the use of the Microsoft knowledgebase article KB189105 that +deals with how to add printers without user intervention via the logon script process. +

    Profile Migration/Creation

    +User and Group Profiles may be migrated using the tools described in the section titled Desktop Profile +Management.

    -You can disable oplocks on a per-share basis with the following: +Profiles may also be managed using the Samba-3 tool profiles. This tool allows +the MS Windows NT style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file +to be changed to the SID of the Samba-3 domain. +

    User and Group Accounts

    +It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before +attempting to migrate user and group accounts it is STRONGLY advised to create in Samba-3 the +groups that are present on the MS Windows NT4 domain AND to connect these to +suitable Unix/Linux groups. Following this simple advice will mean that all user and group attributes +should migrate painlessly. +

    Steps In Migration Process

    +The approximate migration process is described below. +

    • +You will have an NT4 PDC that has the users, groups, policies and profiles to be migrated +

    • +Samba-3 set up as a DC with netlogon share, profile share, etc. +

    Procedure 31.1. The Account Migration Process

    1. Create a BDC account for the samba server using NT Server Manager

      1. Samba must NOT be running

    2. rpcclient NT4PDC -U Administrator%passwd

      1. lsaquery

      2. Note the SID returned

    3. net getsid -S NT4PDC -w DOMNAME -U Administrator%passwd

      1. Note the SID

    4. net getlocalsid

      1. Note the SID, now check that all three SIDS reported are the same!

    5. net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd

    6. net rpc vampire -S NT4PDC -U administrator%passwd

    7. pdbedit -L

      1. Note - did the users migrate?

    8. initGrps.sh DOMNAME

    9. net groupmap list

      1. Now check that all groups are recognised

    10. net rpc vampire -S NT4PDC -U administrator%passwd

    11. pdbedit -Lv

      1. Note - check that all group membership has been migrated

    +Now it is time to migrate all the profiles, then migrate all policy files. +More later. +

    Migration Options

    +Based on feedback from many sites as well as from actual installation and maintenance +experience sites that wish to migrate from MS Windows NT4 Domain Control to a Samba +based solution fit into three basic categories. +

    Table 31.1. The 3 Major Site Types

    Number of UsersDescription
    < 50

    Want simple conversion with NO pain

    50 - 250

    Want new features, can manage some in-house complexity

    > 250

    Solution/Implementation MUST scale well, complex needs. Cross departmental decision process. Local expertise in most areas

    Planning for Success

    +There are three basic choices for sites that intend to migrate from MS Windows NT4 +to Samba-3. +

    • + Simple Conversion (total replacement) +

    • + Upgraded Conversion (could be one of integration) +

    • + Complete Redesign (completely new solution) +

    +No matter what choice you make, the following rules will minimise down-stream problems: +

    • + Take sufficient time +

    • + Avoid Panic +

    • + Test ALL assumptions +

    • + Test full roll-out program, including workstation deployment +

    Table 31.2. Nature of the Conversion Choices

    SimpleUpgradedRedesign

    Make use of minimal OS specific features

    Translate NT4 features to new host OS features

    Decide:

    Suck all accounts from NT4 into Samba-3

    Copy and improve:

    Authentication Regime (database location and access)

    Make least number of operational changes

    Make progressive improvements

    Desktop Management Methods

    Take least amount of time to migrate

    Minimise user impact

    Better Control of Desktops / Users

    Live versus Isolated Conversion

    Maximise functionality

    Identify Needs for: Manageability, Scalability, Security, Availability

    Integrate Samba-3 then migrate while users are active, then Change of control (ie: swap out)

    Take advantage of lower maintenance opportunity

    Samba Implementation Choices

    +Authentication database back end
+	Winbind (external Samba or NT4/200x server)
+	Can use pam_mkhomedir.so to auto-create home dirs
+	External server could use Active Directory or NT4 Domain
+
+Database type
+	smbpasswd, tdbsam, ldapsam, mysqlsam
+
+Access Control Points
+	On the Share itself (Use NT4 Server Manager)
+	On the file system
+	Unix permissions on files and directories
+	Enable Posix ACLs in file system?
+	Through Samba share parameters
+		Not recommended - except as only resort
+
+Policies (migrate or create new ones)
+	Group Policy Editor (NT4)
+	Watch out for Tattoo effect
+
+User and Group Profiles
+	Platform specific so use platform tool to change from a Local
+	to a Roaming profile Can use new profiles tool to change SIDs
+	(NTUser.DAT)
+
+Logon Scripts (Know how they work)
+
+User and Group mapping to Unix/Linux
+	username map facility may be needed
+	Use 'net groupmap' to connect NT4 groups to Unix groups
+	Use pdbedit to set/change user configuration
+NOTE:
+If migrating to LDAP back end it may be easier to dump initial LDAP database
+to LDIF, then edit, then reload into LDAP
 
-
    -	oplocks = False
-	level2 oplocks = False
-
    
+	OS specific scripts / programs may be needed
+		Add / delete Users
+			Note OS limits on size of name (Linux 8 chars)
+				NT4 up to 254 chars
+		Add / delete machines
+			Applied only to domain members (note up to 16 chars)
+		Add / delete Groups
+			Note OS limits on size and nature
+				Linux limit is 16 char,
+				no spaces and no upper case chars (groupadd)
 
-Alternately, you could disable oplocks on a per-file basis within the share:
+Migration Tools
+	Domain Control (NT4 Style)
+	Profiles, Policies, Access Controls, Security
 
-
    -	veto oplock files = /*.mdb/*.MDB/*.dbf/*.DBF/
+Migration Tools
+	Samba: net, rpcclient, smbpasswd, pdbedit, profiles
+	Windows: NT4 Domain User Manager, Server Manager (NEXUS)
+
+Authentication
+	New SAM back end (smbpasswd, tdbsam, ldapsam, mysqlsam)
 
    
+

    Chapter 32. SWAT - The Samba Web Administration Tool

    John H. Terpstra

    Samba Team

    April 21, 2003

    Table of Contents

    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    +There are many and varied opinions regarding the usefulness or otherwise of SWAT. +No matter how hard one tries to produce the perfect configuration tool it remains +an object of personal taste. SWAT is a tool that will allow web based configuration +of samba. It has a wizard that may help to get samba configured quickly, it has context +sensitive help on each smb.conf parameter, it provides for monitoring of current state +of connection information, and it allows network wide MS Windows network password +management. +

    Features and Benefits

    +There are network administrators who believe that it is a good idea to write systems +documentation inside configuration files, for them SWAT will aways be a nasty tool. SWAT +does not store the configuration file in any intermediate form, rather, it stores only the +parameter settings, so when SWAT writes the smb.conf file to disk it will write only +those parameters that are at other than the default settings. The result is that all comments +will be lost from the smb.conf file. Additionally, the parameters will be written back in +internal ordering. +

    Note

    +So before using SWAT please be warned - SWAT will completely replace your smb.conf with +a fully optimised file that has been stripped of all comments you might have placed there +and only non-default settings will be written to the file. +

    Enabling SWAT for use

    +SWAT should be installed to run via the network super daemon. Depending on which system +your Unix/Linux system has you will have either an inetd or +xinetd based system.

    -If you are experiencing problems with oplocks as apparent from Samba's log entries, -you may want to play it safe and disable oplocks and level2 oplocks. -

    MS Windows Opportunistic Locking and Caching Controls

    -There is a known issue when running applications (like Norton Anti-Virus) on a Windows 2000/ XP -workstation computer that can affect any application attempting to access shared database files -across a network. This is a result of a default setting configured in the Windows 2000/XP -operating system known as Opportunistic Locking. When a workstation -attempts to access shared data files located on another Windows 2000/XP computer, -the Windows 2000/XP operating system will attempt to increase performance by locking the -files and caching information locally. When this occurs, the application is unable to -properly function, which results in an Access Denied - error message being displayed during network operations. +The nature and location of the network super-daemon varies with the operating system +implementation. The control file (or files) can be located in the file +/etc/inetd.conf or in the directory /etc/[x]inet.d +or similar.

    -All Windows operating systems in the NT family that act as database servers for data files -(meaning that data files are stored there and accessed by other Windows PCs) may need to -have opportunistic locking disabled in order to minimize the risk of data file corruption. -This includes Windows 9x/Me, Windows NT, Windows 200x and Windows XP. +The control entry for the older style file might be: +

    +	# swat is the Samba Web Administration Tool
+	swat stream tcp nowait.400 root /usr/sbin/swat swat
+

    +A control file for the newer style xinetd could be:

    -If you are using a Windows NT family workstation in place of a server, you must also -disable opportunistic locking (oplocks) on that workstation. For example, if you use a -PC with the Windows NT Workstation operating system instead of Windows NT Server, and you -have data files located on it that are accessed from other Windows PCs, you may need to -disable oplocks on that system. +

    +	# default: off
+	# description: SWAT is the Samba Web Admin Tool. Use swat \
+	#              to configure your Samba server. To use SWAT, \
+	#              connect to port 901 with your favorite web browser.
+	service swat
+	{
+		port    = 901
+		socket_type     = stream
+		wait    = no
+		only_from = localhost
+		user    = root
+		server  = /usr/sbin/swat
+		log_on_failure  += USERID
+		disable = yes
+	}
+

    +

    -The major difference is the location in the Windows registry where the values for disabling -oplocks are entered. Instead of the LanManServer location, the LanManWorkstation location -may be used. +Both the above examples assume that the swat binary has been +located in the /usr/sbin directory. In addition to the above +SWAT will use a directory access point from which it will load it's help files +as well as other control information. The default location for this on most Linux +systems is in the directory /usr/share/samba/swat. The default +location using samba defaults will be /usr/local/samba/swat.

    -You can verify (or change or add, if necessary) this Registry value using the Windows -Registry Editor. When you change this registry value, you will have to reboot the PC -to ensure that the new setting goes into effect. +Access to SWAT will prompt for a logon. If you log onto SWAT as any non-root user +the only permission allowed is to view certain aspects of configuration as well as +access to the password change facility. The buttons that will be exposed to the non-root +user are: HOME, STATUS, VIEW, +PASSWORD. The only page that allows +change capability in this case is PASSWORD.

    -The location of the client registry entry for opportunistic locking has changed in -Windows 2000 from the earlier location in Microsoft Windows NT. -

    Note

    -Windows 2000 will still respect the EnableOplocks registry value used to disable oplocks -in earlier versions of Windows. -

    -You can also deny the granting of opportunistic locks by changing the following registry entries: +So long as you log onto SWAT as the user root you should obtain +full change and commit ability. The buttons that will be exposed includes: +HOME, GLOBALS, SHARES, PRINTERS, +WIZARD, STATUS, VIEW, PASSWORD. +

    Securing SWAT through SSL

    +Lots of people have asked about how to setup SWAT with SSL to allow for secure remote +administration of Samba. Here is a method that works, courtesy of Markus Krieger

    -

    -	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MRXSmb\Parameters\
-
-		OplocksDisabled REG_DWORD 0 or 1
-		Default: 0 (not disabled)
-

    -

    Note

    -The OplocksDisabled registry value configures Windows clients to either request or not -request opportunistic locks on a remote file. To disable oplocks, the value of - OplocksDisabled must be set to 1. -

    -

    -	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
+Modifications to the swat setup are as following: 
+
    1. 
+	install OpenSSL 
+	
    2. 
+	generate certificate and private key
 
-		EnableOplocks REG_DWORD 0 or 1
-		Default: 1 (Enabled by Default)
+	
      +root# /usr/bin/openssl req -new -x509 -days 365 -nodes -config \
+ 	/usr/share/doc/packages/stunnel/stunnel.cnf \
+	-out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem
+	
    3. 
+	remove swat-entry from [x]inetd 
+	
    4. 
+	start stunnel
 
-		EnableOpLockForceClose REG_DWORD 0 or 1
-		Default: 0 (Disabled by Default)
-

    -

    Note

    -The EnableOplocks value configures Windows-based servers (including Workstations sharing -files) to allow or deny opportunistic locks on local files. -

    -To force closure of open oplocks on close or program exit EnableOpLockForceClose must be set to 1. + 

    +root# stunnel -p /etc/stunnel/stunnel.pem -d 901 \
+	 -l /usr/local/samba/bin/swat swat 
+

    +afterwords simply contact to swat by using the URL https://myhost:901, accept the certificate +and the SSL connection is up. +

    The SWAT Home Page

    +The SWAT title page provides access to the latest Samba documentation. The manual page for +each samba component is accessible from this page as are the Samba-HOWTO-Collection (this +document) as well as the O'Reilly book "Using Samba".

    -An illustration of how level II oplocks work: +Administrators who wish to validate their samba configuration may obtain useful information +from the man pages for the diagnostic utilities. These are available from the SWAT home page +also. One diagnostic tool that is NOT mentioned on this page, but that is particularly +useful is ethereal, available from +http://www.ethereal.com. +

    Warning

    +SWAT can be configured to run in demo mode. This is NOT recommended +as it runs SWAT without authentication and with full administrative ability. ie: Allows +changes to smb.conf as well as general operation with root privileges. The option that +creates this ability is the -a flag to swat. Do not use this in any +production environment. +

    Global Settings

    +The Globals button will expose a page that allows configuration of the global parameters +in smb.conf. There are three levels of exposure of the parameters:

    • - Station 1 opens the file, requesting oplock. -

    • - Since no other station has the file open, the server grants station 1 exclusive oplock. -

    • - Station 2 opens the file, requesting oplock. -

    • - Since station 1 has not yet written to the file, the server asks station 1 to Break - to Level II Oplock. -

    • - Station 1 complies by flushing locally buffered lock information to the server. + Basic - exposes common configuration options.

    • - Station 1 informs the server that it has Broken to Level II Oplock (alternatively, - station 1 could have closed the file). -

    • - The server responds to station 2's open request, granting it level II oplock. - Other stations can likewise open the file and obtain level II oplock. -

    • - Station 2 (or any station that has the file open) sends a write request SMB. - The server returns the write response. + Advanced - exposes configuration options needed in more + complex environments.

    • - The server asks all stations that have the file open to Break to None, meaning no - station holds any oplock on the file. Because the workstations can have no cached - writes or locks at this point, they need not respond to the break-to-none advisory; - all they need do is invalidate locally cashed read-ahead data. -

    Workstation Service Entries

    -	\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
-
-	UseOpportunisticLocking   REG_DWORD   0 or 1
-	Default: 1 (true)
-

    -Indicates whether the redirector should use opportunistic-locking (oplock) performance -enhancement. This parameter should be disabled only to isolate problems. -

    Server Service Entries

    -	\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
-
-	EnableOplocks   REG_DWORD   0 or 1
-	Default: 1 (true)
-

    -Specifies whether the server allows clients to use oplocks on files. Oplocks are a -significant performance enhancement, but have the potential to cause lost cached -data on some networks, particularly wide-area networks. -

    -	MinLinkThroughput   REG_DWORD   0 to infinite bytes per second
-	Default: 0
-

    -Specifies the minimum link throughput allowed by the server before it disables -raw and opportunistic locks for this connection. -

    -	MaxLinkDelay   REG_DWORD   0 to 100,000 seconds
-	Default: 60
-

    -Specifies the maximum time allowed for a link delay. If delays exceed this number, -the server disables raw I/O and opportunistic locking for this connection. -

    -	OplockBreakWait   REG_DWORD   10 to 180 seconds
-	Default: 35
-

    -Specifies the time that the server waits for a client to respond to an oplock break -request. Smaller values can allow detection of crashed clients more quickly but can -potentially cause loss of cached data. -

    Persistent Data Corruption

    -If you have applied all of the settings discussed in this paper but data corruption problems -and other symptoms persist, here are some additional things to check out: + Developer - exposes configuration options that only the brave + will want to tamper with. +

    +To switch to other than Basic editing ability click on either the +Advanced or the Developer dial, then click the +Commit Changes button.

    -We have credible reports from developers that faulty network hardware, such as a single -faulty network card, can cause symptoms similar to read caching and data corruption. -If you see persistent data corruption even after repeated reindexing, you may have to -rebuild the data files in question. This involves creating a new data file with the -same definition as the file to be rebuilt and transferring the data from the old file -to the new one. There are several known methods for doing this that can be found in -our Knowledge Base. -

    Additional Reading

    -You may want to check for an updated version of this white paper on our Web site from -time to time. Many of our white papers are updated as information changes. For those papers, -the Last Edited date is always at the top of the paper. +After making any changes to configuration parameters make sure that you click on the +Commit Changes button before moving to another area otherwise +your changes will be immediately lost. +

    Note

    +SWAT has context sensitive help. To find out what each parameter is for simply click the +Help link to the left of the configuration parameter. +

    Share Settings

    +To affect a currently configured share, simply click on the pull down button between the +Choose Share and the Delete Share buttons, +select the share you wish to operate on, then to edit the settings click on the +Choose Share button, to delete the share simply press the +Delete Share button.

    -Section of the Microsoft MSDN Library on opportunistic locking: +To create a new share, next to the button labelled Create Share enter +into the text field the name of the share to be created, then click on the +Create Share button. +

    Printers Settings

    +To affect a currently configured printer, simply click on the pull down button between the +Choose Printer and the Delete Printer buttons, +select the printer you wish to operate on, then to edit the settings click on the +Choose Printer button, to delete the share simply press the +Delete Printer button.

    -Opportunistic Locks, Microsoft Developer Network (MSDN), Windows Development > -Windows Base Services > Files and I/O > SDK Documentation > File Storage > File Systems -> About File Systems > Opportunistic Locks, Microsoft Corporation. -http://msdn.microsoft.com/library/en-us/fileio/storage_5yk3.asp +To create a new printer, next to the button labelled Create Printer enter +into the text field the name of the share to be created, then click on the +Create Printer button. +

    The SWAT Wizard

    +The purpose if the SWAT Wizard is to help the Microsoft knowledgeable network administrator +to configure Samba with a minimum of effort. +

    +The Wizard page provides a tool for rewriting the smb.conf file in fully optimised format. +This will also happen if you press the commit button. The two differ in the the rewrite button +ignores any changes that may have been made, while the Commit button causes all changes to be +affected. +

    +The Edit button permits the editing (setting) of the minimal set of +options that may be necessary to create a working Samba server. +

    +Finally, there are a limited set of options that will determine what type of server Samba +will be configured for, whether it will be a WINS server, participate as a WINS client, or +operate with no WINS support. By clicking on one button you can elect to expose (or not) user +home directories. +

    The Status Page

    +The status page serves a limited purpose. Firstly, it allows control of the samba daemons. +The key daemons that create the samba server environment are: smbd, nmbd, winbindd. +

    +The daemons may be controlled individually or as a total group. Additionally, you may set +an automatic screen refresh timing. As MS Windows clients interact with Samba new smbd processes +will be continually spawned. The auto-refresh facility will allow you to track the changing +conditions with minimal effort.

    -Microsoft Knowledge Base Article Q224992 "Maintaining Transactional Integrity with OPLOCKS", -Microsoft Corporation, April 1999, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q224992. +Lastly, the Status page may be used to terminate specific smbd client connections in order to +free files that may be locked. +

    The View Page

    +This page allows the administrator to view the optimised smb.conf file and, if you are +particularly masochistic, will permit you also to see all possible global configuration +parameters and their settings. +

    The Password Change Page

    +The Password Change page is a popular tool. This tool allows the creation, deletion, deactivation +and reactivation of MS Windows networking users on the local machine. Alternatively, you can use +this tool to change a local password for a user account.

    -Microsoft Knowledge Base Article Q296264 "Configuring Opportunistic Locking in Windows 2000", -Microsoft Corporation, April 2001, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296264. +When logged in as a non-root account the user will have to provide the old password as well as +the new password (twice). When logged in as root only the new password is +required.

    -Microsoft Knowledge Base Article Q129202 "PC Ext: Explanation of Opportunistic Locking on Windows NT", - Microsoft Corporation, April 1995, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202. -

    Troubleshooting

    Table of Contents

    27. The samba checklist
    Introduction
    Assumptions
    The tests
    Still having troubles?
    28. Analysing and solving samba problems
    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URL's
    Getting help from the mailing lists
    How to get off the mailinglists
    29. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Chapter 27. The samba checklist

    Andrew Tridgell

    Samba Team

    <tridge@samba.org>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    Wed Jan 15

    Table of Contents

    Introduction
    Assumptions
    The tests
    Still having troubles?

    Introduction

    +One popular use for this tool is to change user passwords across a range of remote MS Windows +servers. +

    Troubleshooting

    Table of Contents

    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    Still having troubles?
    34. Analysing and solving samba problems
    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Chapter 33. The Samba checklist

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Wed Jan 15

    Table of Contents

    Introduction
    Assumptions
    The tests
    Still having troubles?

    Introduction

    This file contains a list of tests you can perform to validate your Samba server. It also tells you what the likely cause of the problem is if it fails any one of these steps. If it passes all these tests @@ -7978,16 +15394,16 @@ to solve a problem. If you send one of the samba mailing lists an email saying "it doesn't work" and you have not followed this test procedure then you should not be surprised if your email is ignored. -

    Assumptions

    +

    Assumptions

    In all of the tests it is assumed you have a Samba server called BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP.

    The procedure is similar for other types of clients.

    It is also assumed you know the name of an available share in your -smb.conf. I will assume this share is called tmp. -You can add a tmp share like this by adding the -following to smb.conf: +smb.conf. I will assume this share is called tmp. +You can add a tmp share like this by adding the +following to smb.conf: 

     
 [tmp]
@@ -8002,41 +15418,41 @@ Some commands shown did not exist in earlier versions.

    Please pay attention to the error messages you receive. If any error message reports that your server is being unfriendly you should first check that your -IP name resolution is correctly set up. eg: Make sure your /etc/resolv.conf +IP name resolution is correctly set up. eg: Make sure your /etc/resolv.conf file points to name servers that really do exist.

    Also, if you do not have DNS server access for name resolution please check -that the settings for your smb.conf file results in dns proxy = no. The -best way to check this is with testparm smb.conf. +that the settings for your smb.conf file results in dns proxy = no. The +best way to check this is with testparm smb.conf.

    It is helpful to monitor the log files during testing by using the -tail -F log_file_name in a separate +tail -F log_file_name in a separate terminal console (use ctrl-alt-F1 through F6 or multiple terminals in X). Relevant log files can be found (for default installations) in -/usr/local/samba/var. Also, connection logs from -machines can be found here or possibly in /var/log/samba -depending on how or if you specified logging in your smb.conf file. -

    -If you make changes to your smb.conf file while going through these test, -don't forget to restart smbd and nmbd. -

    The tests

    Procedure 27.1. Diagnosing your samba server

    1. -In the directory in which you store your smb.conf file, run the command -testparm smb.conf. If it reports any errors then your smb.conf +/usr/local/samba/var. Also, connection logs from +machines can be found here or possibly in /var/log/samba +depending on how or if you specified logging in your smb.conf file. +

      +If you make changes to your smb.conf file while going through these test, +don't forget to restart smbd and nmbd. +

    The tests

    Procedure 33.1. Diagnosing your samba server

    1. +In the directory in which you store your smb.conf file, run the command +testparm smb.conf. If it reports any errors then your smb.conf configuration file is faulty.

      Note

      -Your smb.conf file may be located in: /etc/samba -Or in: /usr/local/samba/lib +Your smb.conf file may be located in: /etc/samba +Or in: /usr/local/samba/lib

    2. -Run the command ping BIGSERVER from the PC and -ping ACLIENT from +Run the command ping BIGSERVER from the PC and +ping ACLIENT from the unix box. If you don't get a valid response then your TCP/IP software is not correctly installed.

      Note that you will need to start a "dos prompt" window on the PC to run ping.

      -If you get a message saying "host not found" or similar then your DNS -software or /etc/hosts file is not correctly setup. +If you get a message saying host not found or similar then your DNS +software or /etc/hosts file is not correctly setup. It is possible to run samba without DNS entries for the server and client, but I assume you do have correct entries for the remainder of these tests. @@ -8044,77 +15460,78 @@ you do have correct entries for the remainder of these tests. Another reason why ping might fail is if your host is running firewall software. You will need to relax the rules to let in the workstation in question, perhaps by allowing access from another subnet (on Linux -this is done via the ipfwadm program.) -

      -Note: Modern Linux distributions install ipchains/iptables by default. +this is done via the ipfwadm program.) +

      Note

      +Modern Linux distributions install ipchains/iptables by default. This is a common problem that is often overlooked. -

    3. -Run the command smbclient -L BIGSERVER on the unix box. You +

  • +Run the command smbclient -L BIGSERVER on the unix box. You should get a list of available shares back.

    If you get a error message containing the string "Bad password" then -you probably have either an incorrect hosts allow, -hosts deny or valid users line in your -smb.conf, or your guest account is not -valid. Check what your guest account is using testparm and -temporarily remove any hosts allow, hosts deny, valid users or invalid users lines. +you probably have either an incorrect hosts allow, +hosts deny or valid users line in your +smb.conf, or your guest account is not +valid. Check what your guest account is using testparm and +temporarily remove any hosts allow, hosts deny, valid users or invalid users lines.

    -If you get a "connection refused" response then the smbd server may +If you get a connection refused response then the smbd server may not be running. If you installed it in inetd.conf then you probably edited that file incorrectly. If you installed it as a daemon then check that it is running, and check that the netbios-ssn port is in a LISTEN -state using netstat -a. +state using netstat -a.

    Note

    -Some Unix / Linux systems use xinetd in place of -inetd. Check your system documentation for the location +Some Unix / Linux systems use xinetd in place of +inetd. Check your system documentation for the location of the control file/s for your particular system implementation of this network super daemon.

    -If you get a "session request failed" then the server refused the +If you get a session request failed then the server refused the connection. If it says "Your server software is being unfriendly" then -its probably because you have invalid command line parameters to smbd, -or a similar fatal problem with the initial startup of smbd. Also -check your config file (smb.conf) for syntax errors with testparm +its probably because you have invalid command line parameters to smbd, +or a similar fatal problem with the initial startup of smbd. Also +check your config file (smb.conf) for syntax errors with testparm and that the various directories where samba keeps its log and lock files exist.

    There are a number of reasons for which smbd may refuse or decline a session request. The most common of these involve one or more of -the following smb.conf file entries: +the following smb.conf file entries: 

     	hosts deny = ALL
 	hosts allow = xxx.xxx.xxx.xxx/yy
 	bind interfaces only = Yes

    In the above, no allowance has been made for any session requests that -will automatically translate to the loopback adaptor address 127.0.0.1. +will automatically translate to the loopback adapter address 127.0.0.1. To solve this problem change these lines to: 

     	hosts deny = ALL
 	hosts allow = xxx.xxx.xxx.xxx/yy 127.

    -Do NOT use the bind interfaces only parameter where you +Do not use the bind interfaces only parameter where you may wish to -use the samba password change facility, or where smbclient may need to +use the samba password change facility, or where smbclient may need to access a local service for name resolution or for local resource -connections. (Note: the bind interfaces only parameter deficiency +connections. (Note: the bind interfaces only parameter deficiency where it will not allow connections to the loopback address will be fixed soon).

    Another common cause of these two errors is having something already running -on port 139, such as Samba (ie: smbd is running from inetd already) or -something like Digital's Pathworks. Check your inetd.conf file before trying -to start smbd as a daemon, it can avoid a lot of frustration! +on port 139, such as Samba +(ie: smbd is running from inetd already) or +something like Digital's Pathworks. Check your inetd.conf file before trying +to start smbd as a daemon, it can avoid a lot of frustration!

    And yet another possible cause for failure of this test is when the subnet mask and / or broadcast address settings are incorrect. Please check that the network interface IP Address / Broadcast Address / Subnet Mask settings are -correct and that Samba has correctly noted these in the log.nmb file. +correct and that Samba has correctly noted these in the log.nmbd file.

  • -Run the command nmblookup -B BIGSERVER __SAMBA__. You should get the +Run the command nmblookup -B BIGSERVER __SAMBA__. You should get the IP address of your Samba server back.

    -If you don't then nmbd is incorrectly installed. Check your inetd.conf +If you don't then nmbd is incorrectly installed. Check your inetd.conf if you run it from there, or that the daemon is running and listening to udp port 137.

    @@ -8122,7 +15539,7 @@ One common problem is that many inetd implementations can't take many parameters on the command line. If this is the case then create a one-line script that contains the right parameters and run that from inetd. -

  • run the command nmblookup -B ACLIENT '*'

    +

  • run the command nmblookup -B ACLIENT '*'

    You should get the PCs IP address back. If you don't then the client software on the PC isn't installed correctly, or isn't started, or you got the name of the PC wrong. @@ -8130,86 +15547,85 @@ got the name of the PC wrong. If ACLIENT doesn't resolve via DNS then use the IP address of the client in the above test.

  • -Run the command nmblookup -d 2 '*' +Run the command nmblookup -d 2 '*'

    This time we are trying the same as the previous test but are trying it via a broadcast to the default broadcast address. A number of -Netbios/TCPIP hosts on the network should respond, although Samba may +NetBIOS / TCP/IP hosts on the network should respond, although Samba may not catch all of the responses in the short time it listens. You -should see "got a positive name query response" messages from several -hosts. +should see got a positive name query response +messages from several hosts.

    If this doesn't give a similar result to the previous test then nmblookup isn't correctly getting your broadcast address through its automatic mechanism. In this case you should experiment with the -interfaces option in smb.conf to manually configure your IP +interfaces option in smb.conf to manually configure your IP address, broadcast and netmask.

    If your PC and server aren't on the same subnet then you will need to -use the -B option to set the broadcast address to that of the PCs +use the -B option to set the broadcast address to that of the PCs subnet.

    This test will probably fail if your subnet mask and broadcast address are not correct. (Refer to TEST 3 notes above).

  • -Run the command smbclient //BIGSERVER/TMP. You should +Run the command smbclient //BIGSERVER/TMP. You should then be prompted for a password. You should use the password of the account you are logged into the unix box with. If you want to test with -another account then add the -U accountname option to the end of +another account then add the -U accountname option to the end of the command line. eg: -smbclient //bigserver/tmp -Ujohndoe +smbclient //bigserver/tmp -Ujohndoe

    Note

    It is possible to specify the password along with the username as follows: -smbclient //bigserver/tmp -Ujohndoe%secret +smbclient //bigserver/tmp -Ujohndoe%secret

    -Once you enter the password you should get the smb> prompt. If you -don't then look at the error message. If it says "invalid network -name" then the service "tmp" is not correctly setup in your smb.conf. +Once you enter the password you should get the smb> prompt. If you +don't then look at the error message. If it says invalid network +name then the service "tmp" is not correctly setup in your smb.conf.

    -If it says "bad password" then the likely causes are: +If it says bad password then the likely causes are:

    1. - you have shadow passords (or some other password system) but didn't - compile in support for them in smbd + you have shadow passwords (or some other password system) but didn't + compile in support for them in smbd

    2. - your valid users configuration is incorrect + your valid users configuration is incorrect

    3. - you have a mixed case password and you haven't enabled the password + you have a mixed case password and you haven't enabled the password level option at a high enough level

    4. - the path = line in smb.conf is incorrect. Check it with testparm + the path = line in smb.conf is incorrect. Check it with testparm

    5. - you enabled password encryption but didn't create the SMB encrypted - password file + you enabled password encryption but didn't map unix to samba users

    Once connected you should be able to use the commands -dir get put etc. -Type help command for instructions. You should +dir get put etc. +Type help command for instructions. You should especially check that the amount of free disk space shown is correct -when you type dir. +when you type dir.

  • -On the PC, type the command net view \\BIGSERVER. You will +On the PC, type the command net view \\BIGSERVER. You will need to do this from within a "dos prompt" window. You should get back a list of available shares on the server.

    -If you get a "network name not found" or similar error then netbios +If you get a network name not found or similar error then netbios name resolution is not working. This is usually caused by a problem in nmbd. To overcome it you could do one of the following (you only need to choose one of them):

    1. - fixup the nmbd installation + fixup the nmbd installation

    2. - add the IP address of BIGSERVER to the wins server box in the - advanced tcp/ip setup on the PC. + add the IP address of BIGSERVER to the wins server box in the + advanced TCP/IP setup on the PC.

    3. enable windows name resolution via DNS in the advanced section of - the tcp/ip setup + the TCP/IP setup

    4. add BIGSERVER to your lmhosts file on the PC.

    -If you get a "invalid network name" or "bad password error" then the -same fixes apply as they did for the smbclient -L test above. In -particular, make sure your hosts allow line is correct (see the man +If you get a invalid network name or bad password error then the +same fixes apply as they did for the smbclient -L test above. In +particular, make sure your hosts allow line is correct (see the man pages)

    Also, do not overlook that fact that when the workstation requests the @@ -8218,37 +15634,37 @@ name with which you logged onto your Windows machine. You need to make sure that an account exists on your Samba server with that exact same name and password.

    -If you get "specified computer is not receiving requests" or similar +If you get specified computer is not receiving requests or similar it probably means that the host is not contactable via tcp services. Check to see if the host is running tcp wrappers, and if so add an entry in -the hosts.allow file for your client (or subnet, etc.) +the hosts.allow file for your client (or subnet, etc.)

  • -Run the command net use x: \\BIGSERVER\TMP. You should -be prompted for a password then you should get a "command completed -successfully" message. If not then your PC software is incorrectly -installed or your smb.conf is incorrect. make sure your hosts allow -and other config lines in smb.conf are correct. +Run the command net use x: \\BIGSERVER\TMP. You should +be prompted for a password then you should get a command completed +successfully message. If not then your PC software is incorrectly +installed or your smb.conf is incorrect. make sure your hosts allow +and other config lines in smb.conf are correct.

    It's also possible that the server can't work out what user name to -connect you as. To see if this is the problem add the line user = -username to the [tmp] section of -smb.conf where username is the +connect you as. To see if this is the problem add the line user = +username to the [tmp] section of +smb.conf where username is the username corresponding to the password you typed. If you find this fixes things you may need the username mapping option.

    It might also be the case that your client only sends encrypted passwords -and you have encrypt passwords = no in smb.conf +and you have encrypt passwords = no in smb.conf Turn it back on to fix.

  • -Run the command nmblookup -M testgroup where -testgroup is the name of the workgroup that your Samba server and +Run the command nmblookup -M testgroup where +testgroup is the name of the workgroup that your Samba server and Windows PCs belong to. You should get back the IP address of the master browser for that workgroup.

    If you don't then the election process has failed. Wait a minute to see if it is just being slow then try again. If it still fails after -that then look at the browsing options you have set in smb.conf. Make -sure you have preferred master = yes to ensure that +that then look at the browsing options you have set in smb.conf. Make +sure you have preferred master = yes to ensure that an election is held at startup.

  • >From file manager try to browse the server. Your samba server should @@ -8258,25 +15674,25 @@ of the server and get a list of shares. If you get a "invalid password" error when you do then you are probably running WinNT and it is refusing to browse a server that has no encrypted password capability and is in user level security mode. In this case either set -security = server AND -password server = Windows_NT_Machine in your -smb.conf file, or make sure encrypted passwords is +security = server AND +password server = Windows_NT_Machine in your +smb.conf file, or make sure encrypted passwords is set to "yes". -

    • Still having troubles?

    Read the chapter on -Analysing and Solving Problems. -

    Chapter 28. Analysing and solving samba problems

    Gerald (Jerry) Carter

    Samba Team

    <jerry@samba.org>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    David Bannon

    Samba Team

    <dbannon@samba.org>

    8 Apr 2003

    Table of Contents

    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URL's
    Getting help from the mailing lists
    How to get off the mailinglists

    +

    Still having troubles?

    Read the chapter on +Analysing and Solving Problems. +

    Chapter 34. Analysing and solving samba problems

    Gerald (Jerry) Carter

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    David Bannon

    Samba Team

    8 Apr 2003

    Table of Contents

    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists

    There are many sources of information available in the form of mailing lists, RFC's and documentation. The docs that come with the samba distribution contain very good explanations of -general SMB topics such as browsing.

    Diagnostics tools

    +general SMB topics such as browsing.

    Diagnostics tools

    One of the best diagnostic tools for debugging problems is Samba itself. -You can use the -d option for both smbd and nmbd to specify what -'debug level' at which to run. See the man pages on smbd, nmbd and +You can use the -d option for both smbd and nmbd to specify what +debug level at which to run. See the man pages on smbd, nmbd and smb.conf for more information on debugging options. The debug level can range from 1 (the default) to 10 (100 for debugging passwords).

    Another helpful method of debugging is to compile samba using the -gcc -g flag. This will include debug +gcc -g flag. This will include debug information in the binaries and allow you to attach gdb to the running smbd / nmbd process. In order to attach gdb to an smbd process for an NT workstation, first get the workstation to make the @@ -8289,7 +15705,10 @@ idle timeout) So, in between pressing ctrl alt delete, and actually typing in your password, you can attach gdb and continue.

    Some useful samba commands worth investigating: -

    • testparam | more

    • smbclient -L //{netbios name of server}

    +

    +	$ testparm | more
+	$ smbclient -L //{netbios name of server}
+

    An SMB enabled version of tcpdump is available from http://www.tcpdup.org/. Ethereal, another good packet sniffer for Unix and Win32 @@ -8304,7 +15723,7 @@ The version on the NT Server install CD will only allow monitoring of network traffic directed to the local NT box and broadcasts on the local subnet. Be aware that Ethereal can read and write netmon formatted files. -

    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box

    +

    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box

    Installing netmon on an NT workstation requires a couple of steps. The following are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 4.0, on Microsoft Windows NT @@ -8312,51 +15731,44 @@ Workstation 4.0. The process should be similar for other versions of Windows NT / Netmon. You will need both the Microsoft Windows NT Server 4.0 Install CD and the Workstation 4.0 Install CD.

    -Initially you will need to install 'Network Monitor Tools and Agent' +Initially you will need to install Network Monitor Tools and Agent on the NT Server. To do this -

    • Goto Start - Settings - Control Panel - - Network - Services - Add

    • Select the 'Network Monitor Tools and Agent' and - click on 'OK'.

    • Click 'OK' on the Network Control Panel. +

      • Goto Start - Settings - Control Panel - + Network - Services - Add

      • Select the Network Monitor Tools and Agent and + click on OK.

      • Click OK on the Network Control Panel.

      • Insert the Windows NT Server 4.0 install CD when prompted.

      At this point the Netmon files should exist in -%SYSTEMROOT%\System32\netmon\*.*. -Two subdirectories exist as well, parsers\ +%SYSTEMROOT%\System32\netmon\*.*. +Two subdirectories exist as well, parsers\ which contains the necessary DLL's for parsing the netmon packet -dump, and captures\. +dump, and captures\.

      In order to install the Netmon tools on an NT Workstation, you will first need to install the 'Network Monitor Agent' from the Workstation install CD. -

      • Goto Start - Settings - Control Panel - - Network - Services - Add

      • Select the 'Network Monitor Agent' and click - on 'OK'.

      • Click 'OK' on the Network Control Panel. +

        • Goto Start - Settings - Control Panel - + Network - Services - Add

        • Select the Network Monitor Agent and click + on OK.

        • Click OK on the Network Control Panel.

        • Insert the Windows NT Workstation 4.0 install CD when prompted.

        -Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* -to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set -permissions as you deem appropriate for your site. You will need +Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* +to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set +permissions as you deem appropriate for your site. You will need administrative rights on the NT box to run netmon.

        To install Netmon on a Windows 9x box install the network monitor agent -from the Windows 9x CD (\admin\nettools\netmon). There is a readme +from the Windows 9x CD (\admin\nettools\netmon). There is a readme file located with the netmon driver files on the CD if you need information on how to do this. Copy the files from a working Netmon installation. -

      Useful URL's

      • Home of Samba site - http://samba.org. We have a mirror near you !

      • The Development document -on the Samba mirrors might mention your problem. If so, -it might mean that the developers are working on it.

      • See how Scott Merrill simulates a BDC behavior at +

      Useful URLs

      Getting help from the mailing lists

      + ftp://ftp.microsoft.com/developr/drg/CIFS/

    Getting help from the mailing lists

    There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror -and then click on Support and then click on +and then click on Support and then click on Samba related mailing lists.

    For questions relating to Samba TNG go to @@ -8369,7 +15781,7 @@ not paid and they never guarantee to produce a particular feature at a particular time. Any time lines are 'best guess' and nothing more.

  • Always mention what version of samba you are using and what operating system its running under. You should probably list the -relevant sections of your smb.conf file, at least the options +relevant sections of your smb.conf file, at least the options in [global] that affect PDC support.

  • In addition to the version, if you obtained Samba via CVS mention the date when you last checked it out.

  • Try and make your question clear and brief, lots of long, convoluted questions get deleted before they are completely read ! @@ -8388,15 +15800,16 @@ error messages.

  • (Possibly) If you have a complete netmon trace ( the pipe to the error ) you can send the *.CAP file as well.

  • Please think carefully before attaching a document to an email. Consider pasting the relevant parts into the body of the message. The samba mailing lists go to a huge number of people, do they all need a copy of your -smb.conf in their attach directory?

    • How to get off the mailinglists

    To have your name removed from a samba mailing list, go to the +smb.conf in their attach directory?

    How to get off the mailing lists

    To have your name removed from a samba mailing list, go to the same place you went to to get on it. Go to http://lists.samba.org, -click on your nearest mirror and then click on Support and -then click on Samba related mailing lists. Or perhaps see +click on your nearest mirror and then click on Support and +then click on Samba related mailing lists. Or perhaps see here

    Please don't post messages to the list asking to be removed, you will just be referred to the above address (unless that process failed in some way...) -

    Chapter 29. Reporting Bugs

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    Samba Team

    27 June 1997

    Table of Contents

    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Introduction

    Please report bugs using bugzilla.

    +

    Chapter 35. Reporting Bugs

    Jelmer R. Vernooij

    The Samba Team

    Someone; Tridge or Karl Auer perhaps?

    27 June 1997

    Table of Contents

    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Introduction

    Please report bugs using + bugzilla.

    Please take the time to read this file before you submit a bug report. Also, please see if it has changed between releases, as we may be changing the bug reporting mechanism at some time. @@ -8417,27 +15830,27 @@ that list that may be able to help you. You may also like to look though the recent mailing list archives, which are conveniently accessible on the Samba web pages at http://samba.org/samba/. -

    General info

    +

    General info

    Before submitting a bug report check your config for silly errors. Look in your log files for obvious messages that tell you that you've misconfigured something and run testparm to test your config file for correct syntax.

    -Have you run through the diagnosis? +Have you run through the diagnosis? This is very important.

    If you include part of a log file with your bug report then be sure to annotate it with exactly what you were doing on the client at the time, and exactly what the results were. -

    Debug levels

    +

    Debug levels

    If the bug has anything to do with Samba behaving incorrectly as a server (like refusing to open a file) then the log files will probably be very useful. Depending on the problem a log level of between 3 and -10 showing the problem may be appropriate. A higher level givesmore +10 showing the problem may be appropriate. A higher level gives more detail, but may use too much disk space.

    -To set the debug level use log level = in your -smb.conf. You may also find it useful to set the log +To set the debug level use the log level in your +smb.conf. You may also find it useful to set the log level higher for just one machine and keep separate logs for each machine. To do this use: 

    @@ -8446,26 +15859,27 @@ log file = /usr/local/samba/lib/log.%m
 include = /usr/local/samba/lib/smb.conf.%m

    then create a file -/usr/local/samba/lib/smb.conf.machine where -machine is the name of the client you wish to debug. In that file -put any smb.conf commands you want, for example -log level= may be useful. This also allows you to +/usr/local/samba/lib/smb.conf.machine where +machine is the name of the client you wish to debug. In that file +put any smb.conf commands you want, for example +log level may be useful. This also allows you to experiment with different security systems, protocol levels etc on just one machine.

    -The smb.conf entry log level = -is synonymous with the entry debuglevel = that has been -used in older versions of Samba and is being retained for backwards -compatibility of smb.conf files. +The smb.conf entry log level +is synonymous with the parameter debuglevel that has +been used in older versions of Samba and is being retained for backwards +compatibility of smb.conf files.

    -As the log level = value is increased you will record +As the log level value is increased you will record a significantly increasing level of debugging information. For most -debugging operations you may not need a setting higher than 3. Nearly -all bugs can be tracked at a setting of 10, but be prepared for a VERY -large volume of log data. -

    Internal errors

    -If you get a "INTERNAL ERROR" message in your log files it means that -Samba got an unexpected signal while running. It is probably a +debugging operations you may not need a setting higher than +3. Nearly +all bugs can be tracked at a setting of 10, but be +prepared for a VERY large volume of log data. +

    Internal errors

    +If you get a INTERNAL ERROR message in your log files +it means that Samba got an unexpected signal while running. It is probably a segmentation fault and almost certainly means a bug in Samba (unless you have faulty hardware or system software).

    @@ -8477,44 +15891,49 @@ include it in your bug report. You should also detail how to reproduce the problem, if possible. Please make this reasonably detailed.

    -You may also find that a core file appeared in a corefiles +You may also find that a core file appeared in a corefiles subdirectory of the directory where you keep your samba log files. This file is the most useful tool for tracking down the bug. To use it you do this: -

    gdb smbd core

    +

    +	$ gdb smbd core
+

    adding appropriate paths to smbd and core so gdb can find them. If you -don't have gdb then try dbx. Then within the debugger use the -command where to give a stack trace of where the problem -occurred. Include this in your mail. +don't have gdb then try dbx. Then within the debugger +use the command where to give a stack trace of where the +problem occurred. Include this in your report.

    -If you know any assembly language then do a disass of the routine +If you know any assembly language then do a +disass of the routine where the problem occurred (if its in a library routine then disassemble the routine that called it) and try to work out exactly where the problem is by looking at the surrounding code. Even if you -don't know assembly then incuding this info in the bug report can be +don't know assembly, including this info in the bug report can be useful. -

    Attaching to a running process

    +

    Attaching to a running process

    Unfortunately some unixes (in particular some recent linux kernels) refuse to dump a core file if the task has changed uid (which smbd does often). To debug with this sort of system you could try to attach -to the running process using gdb smbd PID where you get PID from -smbstatus. Then use c to continue and try to cause the core dump +to the running process using +gdb smbd PID where you get +PID from smbstatus. +Then use c to continue and try to cause the core dump using the client. The debugger should catch the fault and tell you where it occurred. -

    Patches

    +

    Patches

    The best sort of bug report is one that includes a fix! If you send us -patches please use diff -u format if your version of -diff supports it, otherwise use diff -c4. Make sure +patches please use diff -u format if your version of +diff supports it, otherwise use diff -c4. Make sure you do the diff against a clean version of the source and let me know exactly what version you used. -

    Appendixes

    Table of Contents

    30. How to compile SAMBA
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices
    32. Portability
    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    33. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
    Are there any other issues when OS/2 (any version) - is used as a client?
    How do I get printer driver download working - for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    34. SWAT - The Samba Web Admininistration Tool
    SWAT Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    35. Samba performance issues
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning

    Chapter 30. How to compile SAMBA

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    (22 May 2001)

    18 March 2003

    Table of Contents

    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon

    -You can obtain the samba source from the samba website. To obtain a development version, +

    Appendixes

    Table of Contents

    36. How to compile SAMBA
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    Common Errors
    37. Portability
    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba?
    How do I get printer driver download working + for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Books

    Chapter 36. How to compile SAMBA

    Jelmer R. Vernooij

    The Samba Team

    Someone; Jerry perhaps?

    22 May 2001

    18 March 2003

    Table of Contents

    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    Common Errors

    +You can obtain the samba source from the +samba website. To obtain a development version, you can download samba from CVS or using rsync. -

    Access Samba source code via CVS

    Introduction

    +

    Access Samba source code via CVS

    Introduction

    Samba is developed in an open environment. Developers use CVS (Concurrent Versioning System) to "checkin" (also known as "commit") new source code. Samba's various CVS branches can @@ -8523,12 +15942,12 @@ detailed in this chapter.

    This chapter is a modified version of the instructions found at http://samba.org/samba/cvs.html -

    CVS Access to samba.org

    +

    CVS Access to samba.org

    The machine samba.org runs a publicly accessible CVS repository for access to the source code of several packages, -including samba, rsync and jitterbug. There are two main ways of -accessing the CVS server on this host. -

    Access via CVSweb

    +including samba, rsync, distcc, ccache and jitterbug. There are two main ways +of accessing the CVS server on this host. +

    Access via CVSweb

    You can access the source code via your favourite WWW browser. This allows you to access the contents of individual files in the repository and also to look at the revision @@ -8536,7 +15955,7 @@ history and commit logs of individual files. You can also ask for a diff listing between any two versions on the repository.

    Use the URL : http://samba.org/cgi-bin/cvsweb -

    Access via cvs

    +

    Access via cvs

    You can also access the source code via a normal cvs client. This gives you much more control over what you can do with the repository and allows you to checkout whole source trees @@ -8545,369 +15964,183 @@ preferred method of access if you are a developer and not just a casual browser.

    To download the latest cvs source code, point your -browser at the URL : http://www.cyclic.com/. +browser at the URL : +http://www.cyclic.com/. and click on the 'How to get cvs' link. CVS is free software under the GNU GPL (as is Samba). Note that there are several graphical CVS clients which provide a graphical interface to the sometimes mundane CVS commands. -Links to theses clients are also available from http://www.cyclic.com. +Links to theses clients are also available from the Cyclic website.

    To gain access via anonymous cvs use the following steps. For this example it is assumed that you want a copy of the samba source code. For the other source code repositories on this system just substitute the correct package name -

    1. +

      Procedure 36.1. Retrieving samba using CVS

      1. Install a recent copy of cvs. All you really need is a copy of the cvs client binary.

      2. Run the command

        - cvs -d :pserver:cvs@samba.org:/cvsroot login -

        - When it asks you for a password type cvs. + cvs -d :pserver:cvs@samba.org:/cvsroot login

      3. - Run the command -

        - cvs -d :pserver:cvs@samba.org:/cvsroot co samba -

        - This will create a directory called samba containing the - latest samba source code (i.e. the HEAD tagged cvs branch). This - currently corresponds to the 3.0 development tree. -

        - CVS branches other then HEAD can be obtained by using the -r - and defining a tag name. A list of branch tag names can be found on the - "Development" page of the samba web site. A common request is to obtain the - latest 2.2 release code. This could be done by using the following userinput. -

        - cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_2_2 samba + When it asks you for a password type cvs.

      4. - Whenever you want to merge in the latest code changes use - the following command from within the samba directory: + Run the command

        - cvs update -d -P -

    Accessing the samba sources via rsync and ftp

    - pserver.samba.org also exports unpacked copies of most parts of the CVS tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. - See the rsync homepage for more info on rsync. + cvs -d :pserver:cvs@samba.org:/cvsroot co samba

    - The disadvantage of the unpacked trees - is that they do not support automatic - merging of local changes like CVS does. - rsync access is most convenient for an - initial install. -

    Verifying Samba's PGP signature

    -In these days of insecurity, it's strongly recommended that you verify the PGP signature for any -source file before installing it. According to Jerry Carter of the Samba Team, only about 22% of -all Samba downloads have had a corresponding PGP signature download (a very low percentage, which -should be considered a bad thing). Even if you're not downloading from a mirror site, verifying PGP -signatures should be a standard reflex. -

    -With that said, go ahead and download the following files: -

    -     $ wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc
-     $ wget http://us1.samba.org/samba/ftp/samba-pubkey.asc
-

    -The first file is the PGP signature for the Samba source file; the other is the Samba public -PGP key itself. Import the public PGP key with: -

    -     $ gpg --import samba-pubkey.asc
-

    -And verify the Samba source code integrity with: -

    -     $ gzip -d samba-2.2.8a.tar.gz
-     $ gpg --verify samba-2.2.8a.tar.asc
-

    -If you receive a message like, "Good signature from Samba Distribution Verification Key..." -then all is well. The warnings about trust relationships can be ignored. An example of what -you would not want to see would be: -

    -     gpg: BAD signature from "Samba Distribution Verification Key"
-

    Building the Binaries

    To do this, first run the program ./configure - in the source directory. This should automatically - configure Samba for your operating system. If you have unusual - needs then you may wish to run

    root# ./configure --help -

    first to see what special options you can enable. - Then executing

    root# make

    will create the binaries. Once it's successfully - compiled you can use

    root# make install

    to install the binaries and manual pages. You can - separately install the binaries and/or man pages using

    root# make installbin -

    and

    root# make installman -

    Note that if you are upgrading for a previous version - of Samba you might like to know that the old versions of - the binaries will be renamed with a ".old" extension. You - can go back to the previous version with

    root# make revert -

    if you find this version a disaster!

    Compiling samba with Active Directory support

    In order to compile samba with ADS support, you need to have installed - on your system:

    • the MIT kerberos development libraries - (either install from the sources or use a package). The - heimdal libraries will not work.

    • the OpenLDAP development libraries.

    If your kerberos libraries are in a non-standard location then - remember to add the configure option --with-krb5=DIR.

    After you run configure make sure that include/config.h it generates contains lines like this:

    -#define HAVE_KRB5 1
-#define HAVE_LDAP 1
-

    If it doesn't then configure did not find your krb5 libraries or - your ldap libraries. Look in config.log to figure out why and fix - it.

    Installing the required packages for Debian

    On Debian you need to install the following packages:

    -

    • libkrb5-dev
    • krb5-user

    -

    Installing the required packages for RedHat

    On RedHat this means you should have at least:

    -

    • krb5-workstation (for kinit)
    • krb5-libs (for linking with)
    • krb5-devel (because you are compiling from source)

    -

    in addition to the standard development environment.

    Note that these are not standard on a RedHat install, and you may need - to get them off CD2.

    Starting the smbd and nmbd

    You must choose to start smbd and nmbd either - as daemons or from inetdDon't try - to do both! Either you can put them in - inetd.conf and have them started on demand - by inetd, or you can start them as - daemons either from the command line or in - /etc/rc.local. See the man pages for details - on the command line options. Take particular care to read - the bit about what user you need to be in order to start - Samba. In many cases you must be root.

    The main advantage of starting smbd - and nmbd using the recommended daemon method - is that they will respond slightly more quickly to an initial connection - request.

    Starting from inetd.conf

    NOTE; The following will be different if - you use NIS, NIS+ or LDAP to distribute services maps.

    Look at your /etc/services. - What is defined at port 139/tcp. If nothing is defined - then add a line like this:

    netbios-ssn 139/tcp

    similarly for 137/udp you should have an entry like:

    netbios-ns 137/udp

    Next edit your /etc/inetd.conf - and add two lines something like this:

    -		netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd 
-		netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd 
-

    The exact syntax of /etc/inetd.conf - varies between unixes. Look at the other entries in inetd.conf - for a guide.

    Note

    Some unixes already have entries like netbios_ns - (note the underscore) in /etc/services. - You must either edit /etc/services or - /etc/inetd.conf to make them consistent.

    Note

    On many systems you may need to use the - interfaces option in smb.conf to specify the IP address - and netmask of your interfaces. Run ifconfig - as root if you don't know what the broadcast is for your - net. nmbd tries to determine it at run - time, but fails on some unixes. -

    Warning

    Many unixes only accept around 5 - parameters on the command line in inetd.conf. - This means you shouldn't use spaces between the options and - arguments, or you should use a script, and start the script - from inetd.

    Restart inetd, perhaps just send - it a HUP. If you have installed an earlier version of - nmbd then you may need to kill nmbd as well.

    Alternative: starting it as a daemon

    To start the server as a daemon you should create - a script something like this one, perhaps calling - it startsmb.

    -		#!/bin/sh
-		/usr/local/samba/bin/smbd -D 
-		/usr/local/samba/bin/nmbd -D 
-

    then make it executable with chmod - +x startsmb

    You can then run startsmb by - hand or execute it from /etc/rc.local -

    To kill it send a kill signal to the processes - nmbd and smbd.

    Note

    If you use the SVR4 style init system then - you may like to look at the examples/svr4-startup - script to make Samba fit into that system.

    Chapter 31. Migration from NT4 PDC to Samba-3 PDC

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    April 3, 2003

    Table of Contents

    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices

    -This is a rough guide to assist those wishing to migrate from NT4 domain control to -Samba-3 based domain control. -

    Planning and Getting Started

    -In the IT world there is often a saying that all problems are encountered because of -poor planning. The corrollary to this saying is that not all problems can be anticpated -and planned for. Then again, good planning will anticpate most show stopper type situations. -

    -Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control -environment would do well to develop a detailed migration plan. So here are a few pointers to -help migration get under way. -

    Objectives

    -The key objective for most organisations will be to make the migration from MS Windows NT4 -to Samba-3 domain control as painless as possible. One of the challenges you may experience -in your migration process may well be one of convincing management that the new environment -should remain in place. Many who have introduced open source technologies have experienced -pressure to return to a Microsoft based platform solution at the first sign of trouble. -

    -It is strongly advised that before attempting a migration to a Samba-3 controlled network -that every possible effort be made to gain all-round commitment to the change. Firstly, you -should know precisely why the change is important for the organisation. -Possible motivations to make a change include: -

    • Improve network manageability

    • Obtain better user level functionality

    • Reduce network operating costs

    • Reduce exposure caused by Microsoft withdrawal of NT4 support

    • Avoid MS License 6 implications

    • Reduce organisation's dependency on Microsoft

    -It is vital that it be well recognised that Samba-3 is NOT MS Windows NT4. Samba-3 offers -an alternative solution that is both different from MS Windows NT4 and that offers some -advantages compared with it. It should also be recognised that Samba-3 lacks many of the -features that Microsoft has promoted as core values in migration from MS Windows NT4 to -MS Windows 2000 and beyond (with or without Active Directory services). -

    -What are the features that Samba-3 can NOT provide? -

    • Active Directory Server

    • Group Policy Objects (in Active Direcrtory)

    • Machine Policy objects

    • Logon Scripts in Active Directorty

    • Software Application and Access Controls in Active Directory

    -The features that Samba-3 DOES provide and that may be of compelling interest to your site -includes: -

    • Lower Cost of Ownership

    • Global availability of support with no strings attached

    • Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system)

    • Creation of on-the-fly logon scripts

    • Creation of on-the-fly Policy Files

    • Greater Stability, Reliability, Performance and Availability

    • Manageability via an ssh connection

    • Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam)

    • Ability to implement a full single-signon architecture

    • Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand

    -Before migrating a network from MS Windows NT4 to Samba-3 it is vital that all necessary factors are -considered. Users should be educated about changes they may experience so that the change will be a -welcome one and not become an obstacle to the work they need to do. The following are some of the -factors that will go into a successful migration: -

    Domain Layout

    -Samba-3 can be configured as a domain controller, a back-up domain controller (probably best called -a secondary controller), a domain member, or as a stand-alone server. The Windows network security -domain context should be sized and scoped before implementation. Particular attention needs to be -paid to the location of the primary domain controller (PDC) as well as backup controllers (BDCs). -It should be noted that one way in which Samba-3 differs from Microsoft technology is that if one -chooses to use an LDAP authentication backend then the same database can be used by several different -domains. This means that in a complex organisation there can be a single LDAP database, that itself -can be distributed, that can simultaneously serve multiple domains (that can also be widely distributed). -

    -It is recommended that from a design perspective, the number of users per server, as well as the number -of servers, per domain should be scaled according to needs and should also consider server capacity -and network bandwidth. -

    -A physical network segment may house several domains, each of which may span multiple network segments. -Where domains span routed network segments it is most advisable to consider and test the performance -implications of the design and layout of a network. A Centrally located domain controller that is being -designed to serve mulitple routed network segments may result in severe performance problems if the -response time (eg: ping timing) between the remote segment and the PDC is more than 100 ms. In situations -where the delay is too long it is highly recommended to locate a backup controller (BDC) to serve as -the local authentication and access control server. -

    Server Share and Directory Layout

    -There are few cardinal rules to effective network design that can be broken with impunity. -The most important rule of effective network management is that simplicity is king in every -well controlled network. Every part of the infrastructure must be managed, the more complex -it is, the greater will be the demand of keeping systems secure and functional. -

    -The nature of the data that must be stored needs to be born in mind when deciding how many -shares must be created. The physical disk space layout should also be taken into account -when designing where share points will be created. Keep in mind that all data needs to be -backed up, thus the simpler the disk layout the easier it will be to keep track of what must -be backed up to tape or other off-line storage medium. Always plan and implement for minimum -maintenance. Leave nothing to chance in your design, above all, do not leave backups to chance: -Backup and test, validate every backup, create a disaster recovery plan and prove that it works. -

    -Users should be grouped according to data access control needs. File and directory access -is best controlled via group permissions and the use of the "sticky bit" on group controlled -directories may substantially avoid file access complaints from samba share users. -

    -Many network administrators who are new to the game will attempt to use elaborate techniques -to set access controls, on files, directories, shares, as well as in share definitions. -There is the ever present danger that that administrator's successor will not understand the -complex mess that has been inherited. Remember, apparent job security through complex design -and implementation may ultimately cause loss of operations and downtime to users as the new -administrator learns to untangle your web. Keep access controls simple and effective and -make sure that users will never be interrupted by the stupidity of complexity. -

    Logon Scripts

    -Please refer to the section of this document on Advanced Network Adminsitration for information -regarding the network logon script options for Samba-3. Logon scripts can help to ensure that -all users gain share and printer connections they need. -

    -Logon scripts can be created on-the-fly so that all commands executed are specific to the -rights and privilidges granted to the user. The preferred controls should be affected through -group membership so that group information can be used to custom create a logong script using -the root preexec parameters to the NETLOGON share. -

    -Some sites prefer to use a tool such as kixstart to establish a controlled -user environment. In any case you may wish to do a google search for logon script process controls. -In particular, you may wish to explore the use of the Microsoft knowledgebase article KB189105 that -deals with how to add printers without user intervention via the logon script process. -

    Profile Migration/Creation

    -User and Group Profiles may be migrated using the tools described in the section titled Desktop Profile -Management. -

    -Profiles may also be managed using the Samba-3 tool profiles. This tool allows -the MS Windows NT style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file -to be changed to the SID of the Samba-3 domain. -

    User and Group Accounts

    -It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before -attempting to migrate user and group accounts it is STRONGLY advised to create in Samba-3 the -groups that are present on the MS Windows NT4 domain AND to connect these to -suitable Unix/Linux groups. Following this simple advice will mean that all user and group attributes -should migrate painlessly. -

    Steps In Migration Process

    -The approximate migration process is described below. -

    • -You will have an NT4 PDC that has the users, groups, policies and profiles to be migrated -

    • -Samba-3 set up as a DC with netlogon share, profile share, etc. -

    Procedure 31.1. The Account Migration Process

    1. Create a BDC account for the samba server using NT Server Manager

      1. Samba must NOT be running

    2. rpcclient NT4PDC -U Administrator%passwd

      1. lsaquery

      2. Note the SID returned

    3. net getsid -S NT4PDC -w DOMNAME -U Administrator%passwd

      1. Note the SID

    4. net getlocalsid

      1. Note the SID, now check that all three SIDS reported are the same!

    5. net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd

    6. net rpc vampire -S NT4PDC -U administrator%passwd

    7. pdbedit -l

      1. Note - did the users migrate?

    8. initGrps.sh DOMNAME

    9. net groupmap list

      1. Now check that all groups are recognised

    10. net rpc campire -S NT4PDC -U administrator%passwd

    11. pdbedit -lv

      1. Note - check that all group membership has been migrated

    -Now it is time to migrate all the profiles, then migrate all policy files. -More later. -

    Migration Options

    -Based on feedback from many sites as well as from actual installation and maintenance -experience sites that wish to migrate from MS Windows NT4 Domain Control to a Samba -based solution fit into three basic categories. -

    Table 31.1. The 3 Major Site Types

    Number of UsersDescription
    < 50

    Want simple conversion with NO pain

    50 - 250

    Want new features, can manage some in-house complexity

    > 250

    Solution/Implementation MUST scale well, complex needs. Cross departmental decision process. Local expertise in most areas

    Planning for Success

    -There are three basic choices for sites that intend to migrate from MS Windwows NT4 -to Samba-3. -

    • - Simple Conversion (total replacement) -

    • - Upgraded Conversion (could be one of integration) -

    • - Complete Redesign (completely new solution) -

    -No matter what choice you make, the following rules will minimise down-stream problems: -

    • - Take sufficient time -

    • - Avoid Panic -

    • - Test ALL assumptions -

    • - Test full roll-out program, including workstation deployment -

    Table 31.2. Nature of the Conversion Choices

    SimpleUpgradedRedesign

    Make use of minimal OS specific features

    Translate NT4 features to new host OS features

    Decide:

    Suck all accounts from NT4 into Samba-3

    Copy and improve:

    Authentication Regime (database location and access)

    Make least number of operational changes

    Make progressive improvements

    Desktop Management Methods

    Take least amount of time to migrate

    Minimise user impact

    Better Control of Desktops / Users

    Live versus Isolated Conversion

    Maximise functionality

    Identify Needs for: Manageability, Scalability, Security, Availability

    Integrate Samba-3 then migrate while users are active, then Change of control (ie: swap out)

    Take advantage of lower maintenance opportunity

    Samba Implementation Choices

    -Authentication database back end
-	Winbind (external Samba or NT4/200x server)
-	Can use pam_mkhomedir.so to auto-create home dirs
-	External server could use Active Directory or NT4 Domain
-
-Database type
-	smbpasswd, tdbsam, ldapsam, MySQLsam
-
-Access Control Points
-	On the Share itself (Use NT4 Server Manager)
-	On the file system
-	Unix permissions on files and directories
-	Posix ACLs enablement in file system?
-	Through Samba share parameters
-		Not recommended - except as only resort
-
-Policies (migrate or create new ones)
-	Group Policy Editor (NT4)
-	Watch out for Tattoo effect
-
-User and Group Profiles
-	Platform specific so use platform tool to change from a Local
-	to a Roaming profile Can use new profiles tool to change SIDs
-	(NTUser.DAT)
-
-Logon Scripts (Know how they work)
-
-User and Group mapping to Unix/Linux
-	username map facility may be needed
-	Use 'net groupmap' to connect NT4 groups to Unix groups
-	Use pdbedit to set/change user configuration
-NOTE:
-If migrating to LDAP back end it may be easier to dump initial LDAP database
-to LDIF, then edit, then reload into LDAP
-
-	OS specific scripts / programs may be needed
-		Add / delete Users
-			Note OS limits on size of name (Linux 8 chars)
-				NT4 up to 254 chars
-		Add / delete machines
-			Applied only to domain members (note up to 16 chars)
-		Add / delete Groups
-			Note OS limits on size and nature
-				Linux limit is 16 char,
-				no spaces and no upper case chars (groupadd)
-
-Migration Tools
-	Domain Control (NT4 Style)
-	Profiles, Policies, Access Controls, Security
-
-Migration Tools
-	Samba: net, rpcclient, smbpasswd, pdbedit, profiles
-	Windows: NT4 Domain User Manager, Server Manager (NEXUS)
-
-Authentication
-	New SAM back end (smbpasswd, tdbsam, ldapsam, mysqlsam)
+	This will create a directory called samba containing the 
+	latest samba source code (i.e. the HEAD tagged cvs branch). This 
+	currently corresponds to the 3.0 development tree. 
+	
    
+	CVS branches other then HEAD can be obtained by using the
+	-r and defining a tag name.  A list of branch tag names 
+	can be found on the "Development" page of the samba web site.  A common
+	request is to obtain the latest 3.0 release code.  This could be done by 
+	using the following command:
+	
    
+	cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_3_0 samba
+	
  • 
+	Whenever you want to merge in the latest code changes use 
+	the following command from within the samba directory: 
+	
    
+	cvs update -d -P
+

    • Accessing the samba sources via rsync and ftp

    + pserver.samba.org also exports unpacked copies of most parts of the CVS + tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at + rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. + See the rsync homepage for more info on rsync. +

    + The disadvantage of the unpacked trees is that they do not support automatic + merging of local changes like CVS does. rsync access is most convenient + for an initial install. +

    Verifying Samba's PGP signature

    +In these days of insecurity, it's strongly recommended that you verify the PGP +signature for any source file before installing it. Even if you're not +downloading from a mirror site, verifying PGP signatures should be a +standard reflex. +

    +With that said, go ahead and download the following files: +

    +$  wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc
+$  wget http://us1.samba.org/samba/ftp/samba-pubkey.asc
+

    +The first file is the PGP signature for the Samba source file; the other is the Samba public +PGP key itself. Import the public PGP key with: +

    +	$ gpg --import samba-pubkey.asc
+

    +And verify the Samba source code integrity with: +

    +	$ gzip -d samba-2.2.8a.tar.gz
+	$ gpg --verify samba-2.2.8a.tar.asc

    -

    Chapter 32. Portability

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    Table of Contents

    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9

    Samba works on a wide range of platforms but the interface all the +If you receive a message like, "Good signature from Samba Distribution +Verification Key..." +then all is well. The warnings about trust relationships can be ignored. An +example of what you would not want to see would be: +

    + gpg: BAD signature from "Samba Distribution Verification Key" +

    Building the Binaries

    To do this, first run the program ./configure + in the source directory. This should automatically + configure Samba for your operating system. If you have unusual + needs then you may wish to run

    root# ./configure --help +

    first to see what special options you can enable. + Then executing

    root# make

    will create the binaries. Once it's successfully + compiled you can use

    root# make install

    to install the binaries and manual pages. You can + separately install the binaries and/or man pages using

    root# make installbin +

    and

    root# make installman +

    Note that if you are upgrading for a previous version + of Samba you might like to know that the old versions of + the binaries will be renamed with a ".old" extension. You + can go back to the previous version with

    root# make revert +

    if you find this version a disaster!

    Compiling samba with Active Directory support

    In order to compile samba with ADS support, you need to have installed + on your system:

    • the MIT kerberos development libraries + (either install from the sources or use a package). The + Heimdal libraries will not work.

    • the OpenLDAP development libraries.

    If your kerberos libraries are in a non-standard location then + remember to add the configure option + --with-krb5=DIR.

    After you run configure make sure that + include/config.h it generates contains lines like + this:

    +#define HAVE_KRB5 1
+#define HAVE_LDAP 1
+

    If it doesn't then configure did not find your krb5 libraries or + your ldap libraries. Look in config.log to figure + out why and fix it.

    Installing the required packages for Debian

    On Debian you need to install the following packages:

    +

    libkrb5-dev
    krb5-user

    +

    Installing the required packages for RedHat

    On RedHat this means you should have at least:

    +

    krb5-workstation (for kinit)
    krb5-libs (for linking with)
    krb5-devel (because you are compiling from source)

    +

    in addition to the standard development environment.

    Note that these are not standard on a RedHat install, and you may need + to get them off CD2.

    Starting the smbd and nmbd

    You must choose to start smbd and nmbd either + as daemons or from inetd. Don't try + to do both! Either you can put them in + inetd.conf and have them started on demand + by inetd, or you can start them as + daemons either from the command line or in + /etc/rc.local. See the man pages for details + on the command line options. Take particular care to read + the bit about what user you need to be in order to start + Samba. In many cases you must be root.

    The main advantage of starting smbd + and nmbd using the recommended daemon method + is that they will respond slightly more quickly to an initial connection + request.

    Starting from inetd.conf

    Note

    The following will be different if + you use NIS, NIS+ or LDAP to distribute services maps.

    Look at your /etc/services. + What is defined at port 139/tcp. If nothing is defined + then add a line like this:

    netbios-ssn     139/tcp

    similarly for 137/udp you should have an entry like:

    netbios-ns	137/udp

    Next edit your /etc/inetd.conf + and add two lines something like this:

    +		netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd 
+		netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd 
+

    The exact syntax of /etc/inetd.conf + varies between unixes. Look at the other entries in inetd.conf + for a guide.

    Note

    Some unixes already have entries like netbios_ns + (note the underscore) in /etc/services. + You must either edit /etc/services or + /etc/inetd.conf to make them consistent. +

    Note

    On many systems you may need to use the + interfaces option in smb.conf to specify the IP + address and netmask of your interfaces. Run + ifconfig + as root if you don't know what the broadcast is for your + net. nmbd tries to determine it at run + time, but fails on some unixes. +

    Warning

    Many unixes only accept around 5 + parameters on the command line in inetd.conf. + This means you shouldn't use spaces between the options and + arguments, or you should use a script, and start the script + from inetd.

    Restart inetd, perhaps just send + it a HUP. If you have installed an earlier version of nmbd then + you may need to kill nmbd as well.

    Alternative: starting it as a daemon

    To start the server as a daemon you should create + a script something like this one, perhaps calling + it startsmb.

    +		#!/bin/sh
+		/usr/local/samba/bin/smbd -D 
+		/usr/local/samba/bin/nmbd -D 
+

    then make it executable with chmod + +x startsmb

    You can then run startsmb by + hand or execute it from /etc/rc.local +

    To kill it send a kill signal to the processes + nmbd and smbd.

    Note

    If you use the SVR4 style init system then + you may like to look at the examples/svr4-startup + script to make Samba fit into that system.

    Common Errors

    “ +I'm using gcc 3 and I've compiled Samba-3 from the CVS and the +binaries are very large files (40 Mb and 20 Mb). I've the same result with +--enable-shared ? +” +

    +The dwarf format used by GCC 3 for storing debugging symbols is very inefficient. +Strip the binaries, don't compile with -g or compile with -gstabs. +

    Chapter 37. Portability

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9

    Samba works on a wide range of platforms but the interface all the platforms provide is not always compatible. This chapter contains -platform-specific information about compiling and using samba.

    HPUX

    +platform-specific information about compiling and using samba.

    HPUX

    HP's implementation of supplementary groups is, er, non-standard (for -hysterical reasons). There are two group files, /etc/group and -/etc/logingroup; the system maps UIDs to numbers using the former, but +hysterical reasons). There are two group files, /etc/group and +/etc/logingroup; the system maps UIDs to numbers using the former, but initgroups() reads the latter. Most system admins who know the ropes -symlink /etc/group to /etc/logingroup (hard link doesn't work for reasons -too stupid to go into here). initgroups() will complain if one of the -groups you're in in /etc/logingroup has what it considers to be an invalid -ID, which means outside the range [0..UID_MAX], where UID_MAX is (I think) -60000 currently on HP-UX. This precludes -2 and 65534, the usual 'nobody' +symlink /etc/group to /etc/logingroup +(hard link doesn't work for reasons too stupid to go into here). initgroups() will complain if one of the +groups you're in in /etc/logingroup has what it considers to be an invalid +ID, which means outside the range [0..UID_MAX], where UID_MAX is (I think) +60000 currently on HP-UX. This precludes -2 and 65534, the usual nobody GIDs.

    If you encounter this problem, make sure that the programs that are failing @@ -8915,17 +16148,18 @@ to initgroups() be run as users not in any groups with GIDs outside the allowed range.

    This is documented in the HP manual pages under setgroups(2) and passwd(4).

    -On HPUX you must use gcc or the HP Ansi compiler. The free compiler -that comes with HP-UX is not Ansi compliant and cannot compile +On HPUX you must use gcc or the HP ANSI compiler. The free compiler +that comes with HP-UX is not ANSI compliant and cannot compile Samba. -

    SCO Unix

    -If you run an old version of SCO Unix then you may need to get important +

    SCO Unix

    +If you run an old version of SCO Unix then you may need to get important TCP/IP patches for Samba to work correctly. Without the patch, you may encounter corrupt data transfers using samba.

    The patch you need is UOD385 Connection Drivers SLS. It is available from -SCO (ftp.sco.com, directory SLS, files uod385a.Z and uod385a.ltr.Z). -

    DNIX

    +SCO (ftp.sco.com, directory SLS, +files uod385a.Z and uod385a.ltr.Z). +

    DNIX

    DNIX has a problem with seteuid() and setegid(). These routines are needed for Samba to work correctly, but they were left out of the DNIX C library for some reason. @@ -8938,7 +16172,7 @@ To fix the problem properly you need to assemble the following two functions and then either add them to your C library or link them into Samba.

    -put this in the file setegid.s: +put this in the file setegid.s: 

             .globl  _setegid
 _setegid:
@@ -8953,7 +16187,7 @@ _setegid:
         clrl    d0
         rts

    -put this in the file seteuid.s: +put this in the file seteuid.s: 

             .globl  _seteuid
 _seteuid:
@@ -8969,9 +16203,12 @@ _seteuid:
         rts

    after creating the above files you then assemble them using -

    as seteuid.s

    as setegid.s

    -that should produce the files seteuid.o and -setegid.o +

    +	$ as seteuid.s
+	$ as setegid.s
+

    +that should produce the files seteuid.o and +setegid.o

    then you need to add these to the LIBSM line in the DNIX section of the Samba Makefile. Your LIBSM line will then look something like this: @@ -8981,9 +16218,9 @@ LIBSM = setegid.o seteuid.o -ln You should then remove the line: 

     #define NO_EID
-

    from the DNIX section of includes.h

    RedHat Linux Rembrandt-II

    +

    from the DNIX section of includes.h

    RedHat Linux Rembrandt-II

    By default RedHat Rembrandt-II during installation adds an -entry to /etc/hosts as follows: +entry to /etc/hosts as follows: 

     	127.0.0.1 loopback "hostname"."domainname"

    @@ -8995,13 +16232,13 @@ is the master browse list holder and who is the master browser.

    Corrective Action: Delete the entry after the word loopback in the line starting 127.0.0.1 -

    AIX

    Sequential Read Ahead

    -Disabling Sequential Read Ahead using vmtune -r 0 improves -samba performance significally. -

    Solaris

    Locking improvements

    Some people have been experiencing problems with F_SETLKW64/fcntl -when running samba on solaris. The built in file locking mechanism was +

    AIX

    Sequential Read Ahead

    +Disabling Sequential Read Ahead using vmtune -r 0 improves +Samba performance significantly. +

    Solaris

    Locking improvements

    Some people have been experiencing problems with F_SETLKW64/fcntl +when running Samba on Solaris. The built in file locking mechanism was not scalable. Performance would degrade to the point where processes would -get into loops of trying to lock a file. It woul try a lock, then fail, +get into loops of trying to lock a file. It would try a lock, then fail, then try again. The lock attempt was failing before the grant was occurring. So the visible manifestation of this would be a handful of processes stealing all of the CPU, and when they were trussed they would @@ -9011,21 +16248,19 @@ Sun released patches for Solaris 2.6, 8, and 9. The patch for Solaris 7 has not been released yet.

    The patch revision for 2.6 is 105181-34 -for 8 is 108528-19 -and for 9 is 112233-04 +for 8 is 108528-19 and for 9 is 112233-04

    After the install of these patches it is recommended to reconfigure and rebuild samba. -

    Thanks to Joe Meslovich for reporting

    Winbind on Solaris 9

    +

    Thanks to Joe Meslovich for reporting

    Winbind on Solaris 9

    Nsswitch on Solaris 9 refuses to use the winbind nss module. This behavior is fixed by Sun in patch 113476-05 which as of March 2003 is not in any roll-up packages. -

    Chapter 33. Samba and other CIFS clients

    Jim McDonough

    IBM

    <jmcd@us.ibm.com>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    5 Mar 2001

    Table of Contents

    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
    Are there any other issues when OS/2 (any version) - is used as a client?
    How do I get printer driver download working - for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1

    This chapter contains client-specific information.

    Macintosh clients?

    -Yes. Thursby now have a CIFS Client / Server called DAVE +

    Chapter 38. Samba and other CIFS clients

    Jim McDonough

    IBM

    Jelmer R. Vernooij

    The Samba Team

    5 Mar 2001

    Table of Contents

    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba?
    How do I get printer driver download working + for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1

    This chapter contains client-specific information.

    Macintosh clients?

    +Yes. Thursby now has a CIFS Client / Server called DAVE

    They test it against Windows 95, Windows NT and samba for compatibility issues. At the time of writing, DAVE was at version @@ -9034,23 +16269,20 @@ the Thursby web site (the speed of finder copies has been greatly enhanced, and there are bug-fixes included).

    Alternatives - There are two free implementations of AppleTalk for -several kinds of UNIX machnes, and several more commercial ones. +several kinds of UNIX machines, and several more commercial ones. These products allow you to run file services and print services natively to Macintosh users, with no additional support required on -the Macintosh. The two free omplementations are +the Macintosh. The two free implementations are Netatalk, and CAP. What Samba offers MS Windows users, these packages offer to Macs. For more info on these packages, Samba, and Linux (and other UNIX-based systems) see http://www.eats.com/linux_mac_win.html -

    OS2 Client

    How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?

    A more complete answer to this question can be +

    OS2 Client

    How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba?

    A more complete answer to this question can be found on - http://carol.wins.uva.nl/~leeuw/samba/warp.html.

    Basically, you need three components:

    • The File and Print Client ('IBM Peer') -

    • TCP/IP ('Internet support') -

    • The "NetBIOS over TCP/IP" driver ('TCPBEUI') -

    Installing the first two together with the base operating + http://carol.wins.uva.nl/~leeuw/samba/warp.html.

    Basically, you need three components:

    The File and Print Client ('IBM Peer')
    TCP/IP ('Internet support')
    The "NetBIOS over TCP/IP" driver ('TCPBEUI')

    Installing the first two together with the base operating system on a blank system is explained in the Warp manual. If Warp has already been installed, but you now want to install the networking support, use the "Selective Install for Networking" @@ -9065,8 +16297,8 @@ packages, Samba, and Linux (and other UNIX-based systems) see to the "Names List", or specify a WINS server ('NetBIOS Nameserver' in IBM and RFC terminology). For Warp Connect you may need to download an update for 'IBM Peer' to bring it on - the same level as Warp 4. See the webpage mentioned above.

    How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?

    You can use the free Microsoft LAN Manager 2.2c Client + the same level as Warp 4. See the webpage mentioned above.

    How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba?

    You can use the free Microsoft LAN Manager 2.2c Client for OS/2 from ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/. @@ -9083,42 +16315,39 @@ packages, Samba, and Linux (and other UNIX-based systems) see or NS2000 driver from ftp://ftp.cdrom.com/pub/os2/network/ndis/ instead. -

    Are there any other issues when OS/2 (any version) - is used as a client?

    When you do a NET VIEW or use the "File and Print - Client Resource Browser", no Samba servers show up. This can - be fixed by a patch from - http://carol.wins.uva.nl/~leeuw/samba/fix.html. - The patch will be included in a later version of Samba. It also - fixes a couple of other problems, such as preserving long - filenames when objects are dragged from the Workplace Shell - to the Samba server.

    How do I get printer driver download working - for OS/2 clients?

    First, create a share called [PRINTDRV] that is +

    How do I get printer driver download working + for OS/2 clients?

    First, create a share called [PRINTDRV] that is world-readable. Copy your OS/2 driver files there. Note that the .EA_ files must still be separate, so you will need to use the original install files, and not copy an installed driver from an OS/2 system.

    Install the NT driver first for that printer. Then, - add to your smb.conf a parameter, os2 driver map = - filename". Then, in the file - specified by filename, map the + add to your smb.conf a parameter, os2 driver map = + filename. Then, in the file + specified by filename, map the name of the NT driver name to the OS/2 driver name as - follows:

    nt driver name = os2 "driver - name"."device name", e.g.: - HP LaserJet 5L = LASERJET.HP LaserJet 5L

    You can have multiple drivers mapped in this file.

    If you only specify the OS/2 driver name, and not the + follows:

    nt driver name = os2 driver name.device name, e.g.:

    + HP LaserJet 5L = LASERJET.HP LaserJet 5L

    You can have multiple drivers mapped in this file.

    If you only specify the OS/2 driver name, and not the device name, the first attempt to download the driver will actually download the files, but the OS/2 client will tell you the driver is not available. On the second attempt, it will work. This is fixed simply by adding the device name to the mapping, after which it will work on the first attempt. -

    Windows for Workgroups

    Use latest TCP/IP stack from Microsoft

    Use the latest TCP/IP stack from microsoft if you use Windows -for workgroups. +

    Windows for Workgroups

    Use latest TCP/IP stack from Microsoft

    Use the latest TCP/IP stack from Microsoft if you use Windows +for Workgroups.

    The early TCP/IP stacks had lots of bugs.

    Microsoft has released an incremental upgrade to their TCP/IP 32-Bit VxD drivers. The latest release can be found on their ftp site at -ftp.microsoft.com, located in /peropsys/windows/public/tcpip/wfwt32.exe. +ftp.microsoft.com, located in /peropsys/windows/public/tcpip/wfwt32.exe. There is an update.txt file there that describes the problems that were -fixed. New files include WINSOCK.DLL, TELNET.EXE, WSOCK.386, VNBT.386, -WSTCP.386, TRACERT.EXE, NETSTAT.EXE, and NBTSTAT.EXE. -

    Delete .pwl files after password change

    +fixed. New files include WINSOCK.DLL, +TELNET.EXE, +WSOCK.386, +VNBT.386, +WSTCP.386, +TRACERT.EXE, +NETSTAT.EXE, and +NBTSTAT.EXE. +

    Delete .pwl files after password change

    WfWg does a lousy job with passwords. I find that if I change my password on either the unix box or the PC the safest thing to do is to delete the .pwl files in the windows directory. The PC will complain about not finding the files, but will soon get over it, allowing you to enter the new password. @@ -9127,28 +16356,30 @@ If you don't do this you may find that WfWg remembers and uses the old password, even if you told it a new one.

    Often WfWg will totally ignore a password you give it in a dialog box. -

    Configure WfW password handling

    +

    Configure WfW password handling

    There is a program call admincfg.exe on the last disk (disk 8) of the WFW 3.11 disk set. To install it -type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE Then add an icon -for it via the "Progam Manager" "New" Menu. This program allows you -to control how WFW handles passwords. ie disable Password Caching etc -for use with security = user -

    Case handling of passwords

    Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf(5) information on password level to specify what characters samba should try to uppercase when checking.

    Use TCP/IP as default protocol

    To support print queue reporting you may find +type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE. +Then add an icon +for it via the Program Manager New Menu. +This program allows you to control how WFW handles passwords. ie disable Password Caching etc +for use with security = user +

    Case handling of passwords

    Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf(5) information on password level to specify what characters samba should try to uppercase when checking.

    Use TCP/IP as default protocol

    To support print queue reporting you may find that you have to use TCP/IP as the default protocol under -WfWg. For some reason if you leave Netbeui as the default +WfWg. For some reason if you leave NetBEUI as the default it may break the print queue reporting on some systems. -It is presumably a WfWg bug.

    Speed improvement

    -Note that some people have found that setting DefaultRcvWindow in -the [MSTCP] section of the SYSTEM.INI file under WfWg to 3072 gives a +It is presumably a WfWg bug.

    Speed improvement

    +Note that some people have found that setting DefaultRcvWindow in +the [MSTCP] section of the +SYSTEM.INI file under WfWg to 3072 gives a big improvement. I don't know why.

    -My own experience wth DefaultRcvWindow is that I get much better +My own experience with DefaultRcvWindow is that I get much better performance with a large value (16384 or larger). Other people have -reported that anything over 3072 slows things down enourmously. One +reported that anything over 3072 slows things down enormously. One person even reported a speed drop of a factor of 30 when he went from 3072 to 8192. I don't know why. -

    Windows '95/'98

    +

    Windows '95/'98

    When using Windows 95 OEM SR2 the following updates are recommended where Samba is being used. Please NOTE that the above change will affect you once these updates have been installed. @@ -9156,25 +16387,26 @@ updates have been installed. There are more updates than the ones mentioned here. You are referred to the Microsoft Web site for all currently available updates to your specific version of Windows 95. -

    1. Kernel Update: KRNLUPD.EXE

    2. Ping Fix: PINGUPD.EXE

    3. RPC Update: RPCRTUPD.EXE

    4. TCP/IP Update: VIPUPD.EXE

    5. Redirector Update: VRDRUPD.EXE

    -Also, if using MS OutLook it is desirable to install the OLEUPD.EXE fix. This +

    Kernel Update: KRNLUPD.EXE
    Ping Fix: PINGUPD.EXE
    RPC Update: RPCRTUPD.EXE
    TCP/IP Update: VIPUPD.EXE
    Redirector Update: VRDRUPD.EXE

    +Also, if using MS Outlook it is desirable to +install the OLEUPD.EXE fix. This fix may stop your machine from hanging for an extended period when exiting -OutLook and you may also notice a significant speedup when accessing network +Outlook and you may also notice a significant speedup when accessing network neighborhood services. -

    Speed improvement

    +

    Speed improvement

    Configure the win95 TCPIP registry settings to give better -performance. I use a program called MTUSPEED.exe which I got off the +performance. I use a program called MTUSPEED.exe which I got off the net. There are various other utilities of this type freely available. -

    Windows 2000 Service Pack 2

    +

    Windows 2000 Service Pack 2

    There are several annoyances with Windows 2000 SP2. One of which only appears when using a Samba server to host user profiles to Windows 2000 SP2 clients in a Windows domain. This assumes that Samba is a member of the domain, but the problem will likely occur if it is not.

    -In order to server profiles successfully to Windows 2000 SP2 +In order to serve profiles successfully to Windows 2000 SP2 clients (when not operating as a PDC), Samba must have -nt acl support = no +nt acl support = no added to the file share which houses the roaming profiles. If this is not done, then the Windows 2000 SP2 client will complain about not being able to access the profile (Access @@ -9182,7 +16414,7 @@ Denied) and create multiple copies of it on disk (DOMAIN.user.001, DOMAIN.user.002, etc...). See the smb.conf(5) man page for more details on this option. Also note that the -nt acl support parameter was formally a global parameter in +nt acl support parameter was formally a global parameter in releases prior to Samba 2.2.2.

    The following is a minimal profile share: @@ -9199,214 +16431,17 @@ the security descriptor for the profile which contains the Samba server's SID, and not the domain SID. The client compares the SID for SAMBA\user and realizes it is different that the one assigned to DOMAIN\user. Hence the reason -for the "access denied" message. +for the access denied message.

    -By disabling the nt acl support parameter, Samba will send +By disabling the nt acl support parameter, Samba will send the Win2k client a response to the QuerySecurityDescriptor trans2 call which causes the client to set a default ACL for the profile. This default ACL includes -

    DOMAIN\user "Full Control"

    Note

    This bug does not occur when using winbind to -create accounts on the Samba host for Domain users.

    Windows NT 3.1

    If you have problems communicating across routers with Windows +

    DOMAIN\user "Full Control">

    Note

    This bug does not occur when using winbind to +create accounts on the Samba host for Domain users.

    Windows NT 3.1

    If you have problems communicating across routers with Windows NT 3.1 workstations, read this Microsoft Knowledge Base article. -

    Chapter 34. SWAT - The Samba Web Admininistration Tool

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    April 21, 2003

    Table of Contents

    SWAT Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    -There are many and varied opinions regarding the usefulness or otherwise of SWAT. -No matter how hard one tries to produce the perfect configuration tool it remains -an object of personal taste. SWAT is a tool that will allow web based configuration -of samba. It has a wizard that may help to get samba configured quickly, it has context -sensitive help on each smb.conf parameter, it provides for monitoring of current state -of connection information, and it allows network wide MS Windows network password -management. -

    SWAT Features and Benefits

    -There are network administrators who believe that it is a good idea to write systems -documentation inside configuration files, for them SWAT will aways be a nasty tool. SWAT -does not store the configuration file in any intermediate form, rather, it stores only the -parameter settings, so when SWAT writes the smb.conf file to disk it will write only -those parameters that are at other than the default settings. The result is that all comments -will be lost from the smb.conf file. Additionally, the parameters will be written back in -internal ordering. -

    Note

    -So before using SWAT please be warned - SWAT will completely replace your smb.conf with -a fully optimised file that has been stripped of all comments you might have placed there -and only non-default settings will be written to the file. -

    Enabling SWAT for use

    -SWAT should be installed to run via the network super daemon. Depending on which system -your Unix/Linux system has you will have either an inetd or -xinetd based system. -

    -The nature and location of the network super-daemon varies with the operating system -implementation. The control file (or files) can be located in the file -/etc/inetd.conf or in the directory /etc/[x]inet.d -or similar. -

    -The control entry for the older style file might be: -

    -	# swat is the Samba Web Administration Tool
-	swat stream tcp nowait.400 root /usr/sbin/swat swat
-

    -A control file for the newer style xinetd could be: -

    -

    -	# default: off
-	# description: SWAT is the Samba Web Admin Tool. Use swat \
-	#              to configure your Samba server. To use SWAT, \
-	#              connect to port 901 with your favorite web browser.
-	service swat
-	{
-		port    = 901
-		socket_type     = stream
-		wait    = no
-		only_from = localhost
-		user    = root
-		server  = /usr/sbin/swat
-		log_on_failure  += USERID
-		disable = yes
-	}
-

    - -

    -Both the above examples assume that the swat binary has been -located in the /usr/sbin directory. In addition to the above -SWAT will use a directory access point from which it will load it's help files -as well as other control information. The default location for this on most Linux -systems is in the directory /usr/share/samba/swat. The default -location using samba defaults will be /usr/local/samba/swat. -

    -Access to SWAT will prompt for a logon. If you log onto SWAT as any non-root user -the only permission allowed is to view certain aspects of configuration as well as -access to the password change facility. The buttons that will be exposed to the non-root -user are: HOME, STATUS, VIEW, PASSWORD. The only page that allows -change capability in this case is PASSWORD. -

    -So long as you log onto SWAT as the user root you should obtain -full change and commit ability. The buttons that will be exposed includes: -HOME, GLOBALS, SHARES, PRINTERS, WIZARD, STATUS, VIEW, PASSWORD. -

    Securing SWAT through SSL

    -Lots of people have asked about how to setup SWAT with SSL to allow for secure remote -administration of Samba. Here is a method that works, courtesy of Markus Krieger -

    -Modifications to the swat setup are as following: -

    • - install OpenSSL -

    • - generate certificate and private key - - 

      -	root# /usr/bin/openssl req -new -x509 -days 365 -nodes -config \
-	 	/usr/share/doc/packages/stunnel/stunnel.cnf \
-		-out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem
-

    • - remove swat-entry from [x]inetd -

    • - start stunnel - - 

      -	root# stunnel -p /etc/stunnel/stunnel.pem -d 901 \
-		 -l /usr/local/samba/bin/swat swat 
-

    -afterwards simply contact to swat by using the URL "https://myhost:901", accept the certificate -and the SSL connection is up. -

    The SWAT Home Page

    -The SWAT title page provides access to the latest Samba documentation. The manual page for -each samba component is accessible from this page as are the Samba-HOWTO-Collection (this -document) as well as the O'Reilly book "Using Samba". -

    -Administrators who wish to validate their samba configuration may obtain useful information -from the man pages for the diganostic utilities. These are available from the SWAT home page -also. One diagnostic tool that is NOT mentioned on this page, but that is particularly -useful is ethereal, available from -http://www.ethereal.com. -

    Note

    -SWAT can be configured to run in demo mode. This is NOT recommended -as it runs SWAT without authentication and with full administrative ability. ie: Allows -changes to smb.conf as well as general operation with root privilidges. The option that -creates this ability is the -a flag to swat. DO NOT USE THIS IN ANY -PRODUCTION ENVIRONMENT - you have been warned! -

    Global Settings

    -The Globals button will expose a page that allows configuration of the global parameters -in smb.conf. There are three levels of exposure of the parameters: -

    • - Basic - exposes common configuration options. -

    • - Advanced - exposes configuration options needed in more - complex environments. -

    • - Developer - exposes configuration options that only the brave - will want to tamper with. -

    -To switch to other than Basic editing ability click on either the -Advanced or the Developer dial, then click the -Commit Changes button. -

    -After making any changes to configuration parameters make sure that you click on the -Commit Changes button before moving to another area otherwise -your changes will be immediately lost. -

    Note

    -SWAT has context sensitive help. To find out what each parameter is for simply click the -Help link to the left of the configurartion parameter. -

    Share Settings

    -To affect a currenly configured share, simply click on the pull down button between the -Choose Share and the Delete Share buttons, -select the share you wish to operate on, then to edit the settings click on the -Choose Share button, to delete the share simply press the -Delete Share button. -

    -To create a new share, next to the button labelled Create Share enter -into the text field the name of the share to be created, then click on the -Create Share button. -

    Printers Settings

    -To affect a currenly configured printer, simply click on the pull down button between the -Choose Printer and the Delete Printer buttons, -select the printer you wish to operate on, then to edit the settings click on the -Choose Printer button, to delete the share simply press the -Delete Printer button. -

    -To create a new printer, next to the button labelled Create Printer enter -into the text field the name of the share to be created, then click on the -Create Printer button. -

    The SWAT Wizard

    -The purpose if the SWAT Wizard is to help the Microsoft knowledgable network administrator -to configure Samba with a minimum of effort. -

    -The Wizard page provides a tool for rewiting the smb.conf file in fully optimised format. -This will also happen if you press the commit button. The two differ in the the rewrite button -ignores any changes that may have been made, while the Commit button causes all changes to be -affected. -

    -The Edit button permits the editing (setting) of the minimal set of -options that may be necessary to create a working samba server. -

    -Finally, there are a limited set of options that will determine what type of server samba -will be configured for, whether it will be a WINS server, participate as a WINS client, or -operate with no WINS support. By clicking on one button you can elect to epose (or not) user -home directories. -

    The Status Page

    -The status page serves a limited purpose. Firstly, it allows control of the samba daemons. -The key daemons that create the samba server environment are: smbd, nmbd, winbindd. -

    -The daemons may be controlled individually or as a total group. Additionally, you may set -an automatic screen refresh timing. As MS Windows clients interact with Samba new smbd processes -will be continually spawned. The auto-refresh facility will allow you to track the changing -conditions with minimal effort. -

    -Lastly, the Status page may be used to terminate specific smbd client connections in order to -free files that may be locked. -

    The View Page

    -This page allows the administrator to view the optimised smb.conf file and if you are -particularly massochistic will permit you also to see all possible global configuration -parameters and their settings. -

    The Password Change Page

    -The Password Change page is a popular tool. This tool allows the creation, deletion, deactivation -and reactivation of MS Windows networking users on the local machine. Alternatively, you can use -this tool to change a local password for a user account. -

    -When logged in as a non-root account the user will have to provide the old password as well as -the new password (twice). When logged in as root only the new password is -required. -

    -One popular use for this tool is to change user passwords across a range of remote MS Windows -servers. -

    Chapter 35. Samba performance issues

    Paul Cochrane

    Dundee Limb Fitting Centre

    <paulc@dth.scot.nhs.uk>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    Table of Contents

    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning

    Comparisons

    +

    Chapter 39. Samba Performance Tuning

    Paul Cochrane

    Dundee Limb Fitting Centre

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files

    Comparisons

    The Samba server uses TCP to talk to the client. Thus if you are trying to see if it performs well you should really compare it to programs that use the same protocol. The most readily available @@ -9416,7 +16451,7 @@ SMB server. If you want to test against something like a NT or WfWg server then you will have to disable all but TCP on either the client or server. Otherwise you may well be using a totally different protocol -(such as Netbeui) and comparisons may not be valid. +(such as NetBEUI) and comparisons may not be valid.

    Generally you should find that Samba performs similarly to ftp at raw transfer speed. It should perform quite a bit faster than NFS, @@ -9428,14 +16463,14 @@ suspect the biggest factor is not Samba vs some other system but the hardware and drivers used on the various systems. Given similar hardware Samba should certainly be competitive in speed with other systems. -

    Socket options

    +

    Socket options

    There are a number of socket options that can greatly affect the performance of a TCP based server like Samba.

    The socket options that Samba uses are settable both on the command -line with the -O option, or in the smb.conf file. +line with the -O option, or in the smb.conf file.

    -The socket options section of the smb.conf manual page describes how +The socket options section of the smb.conf manual page describes how to set these and gives recommendations.

    Getting the socket options right can make a big difference to your @@ -9444,11 +16479,11 @@ much. The correct settings are very dependent on your local network.

    The socket option TCP_NODELAY is the one that seems to make the biggest single difference for most networks. Many people report that -adding socket options = TCP_NODELAY doubles the read +adding socket options = TCP_NODELAY doubles the read performance of a Samba drive. The best explanation I have seen for this is that the Microsoft TCP/IP stack is slow in sending tcp ACKs. -

    Read size

    -The option read size affects the overlap of disk +

    Read size

    +The option read size affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger than this value then the server begins writing @@ -9464,11 +16499,11 @@ The default value is 16384, but very little experimentation has been done yet to determine the optimal value, and it is likely that the best value will vary greatly between systems anyway. A value over 65536 is pointless and will cause you to allocate memory unnecessarily. -

    Max xmit

    -At startup the client and server negotiate a maximum transmit size, +

    Max xmit

    +At startup the client and server negotiate a maximum transmit size, which limits the size of nearly all SMB commands. You can set the -maximum size that Samba will negotiate using the max xmit = option -in smb.conf. Note that this is the maximum size of SMB requests that +maximum size that Samba will negotiate using the max xmit = option +in smb.conf. Note that this is the maximum size of SMB requests that Samba will accept, but not the maximum size that the *client* will accept. The client maximum receive size is sent to Samba by the client and Samba honours this limit. @@ -9478,38 +16513,173 @@ clients may perform better with a smaller transmit unit. Trying values of less than 2048 is likely to cause severe problems.

    In most cases the default is the best option. -

    Log level

    -If you set the log level (also known as debug level) higher than 2 +

    Log level

    +If you set the log level (also known as debug level) higher than 2 then you may suffer a large drop in performance. This is because the server flushes the log file after each operation, which can be very expensive. -

    Read raw

    -The read raw operation is designed to be an optimised, low-latency +

    Read raw

    +The read raw operation is designed to be an optimised, low-latency file read operation. A server may choose to not support it, -however. and Samba makes support for read raw optional, with it +however. and Samba makes support for read raw optional, with it being enabled by default.

    -In some cases clients don't handle read raw very well and actually +In some cases clients don't handle read raw very well and actually get lower performance using it than they get using the conventional read operations.

    -So you might like to try read raw = no and see what happens on your +So you might like to try read raw = no and see what happens on your network. It might lower, raise or not affect your performance. Only testing can really tell. -

    Write raw

    -The write raw operation is designed to be an optimised, low-latency +

    Write raw

    +The write raw operation is designed to be an optimised, low-latency file write operation. A server may choose to not support it, -however. and Samba makes support for write raw optional, with it +however. and Samba makes support for write raw optional, with it being enabled by default.

    -Some machines may find write raw slower than normal write, in which +Some machines may find write raw slower than normal write, in which case you may wish to change this option. -

    Slow Logins

    +

    Slow Logins

    Slow logins are almost always due to the password checking time. Using -the lowest practical password level will improve things. -

    Client tuning

    +the lowest practical password level will improve things. +

    Client tuning

    Often a speed problem can be traced to the client. The client (for example Windows for Workgroups) can often be tuned for better TCP performance. Check the sections on the various clients in -Samba and Other Clients. -

    +Samba and Other Clients. +

    Samba performance problem due changing kernel

    +Hi everyone. I am running Gentoo on my server and samba 2.2.8a. Recently +I changed kernel version from linux-2.4.19-gentoo-r10 to +linux-2.4.20-wolk4.0s. And now I have performance issue with samba. Ok +many of you will probably say that move to vanilla sources...well I tried +it too and it didn't work. I have 100mb LAN and two computers (linux + +Windows2000). Linux server shares directory with DivX files, client +(windows2000) plays them via LAN. Before when I was running 2.4.19 kernel +everything was fine, but now movies freezes and stops...I tried moving +files between server and Windows and it's terribly slow. +

    +Grab mii-tool and check the duplex settings on the NIC. +My guess is that it is a link layer issue, not an application +layer problem. Also run ifconfig and verify that the framing +error, collisions, etc... look normal for ethernet. +

    Corrupt tdb Files

    +Well today it happened, Our first major problem using samba. +Our samba PDC server has been hosting 3 TB of data to our 500+ users +[Windows NT/XP] for the last 3 years using samba, no problem. +But today all shares went SLOW; very slow. Also the main smbd kept +spawning new processes so we had 1600+ running smbd's (normally we avg. 250). +It crashed the SUN E3500 cluster twice. After a lot of searching I +decided to rm /var/locks/*.tdb. Happy again. +

    +Q1) Is there any method of keeping the *.tdb files in top condition or +how to early detect corruption? +

    +A1) Yes, run tdbbackup each time after stopping nmbd and before starting nmbd. +

    +Q2) What I also would like to mention is that the service latency seems +a lot lower then before the locks cleanup, any ideas on keeping it top notch? +

    +A2) Yes! Same answer as for Q1! +

    Chapter 40. DNS and DHCP Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +This chapter did not make it into this release. +It is planned for the published release of this document. +

    Chapter 41. Further Resources

    Jelmer R. Vernooij

    The Samba Team

    David Lechnyr

    Unofficial HOWTO

    May 1, 2003

    Table of Contents

    Websites
    Related updates from Microsoft
    Books

    Websites

    Related updates from Microsoft

    Books

    Index

    diff --git a/docs/htmldocs/bugreport.html b/docs/htmldocs/bugreport.html index b46173f559..9ae4797d31 100644 --- a/docs/htmldocs/bugreport.html +++ b/docs/htmldocs/bugreport.html @@ -1,5 +1,5 @@ - -Chapter 29. Reporting Bugs
    Chapter 29. Reporting Bugs
    Prev Part IV. Troubleshooting Next

    Chapter 29. Reporting Bugs

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    Samba Team

    27 June 1997

    Table of Contents

    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Introduction

    Please report bugs using bugzilla.

    +Chapter 35. Reporting Bugs

    Chapter 35. Reporting Bugs
    Prev Part V. Troubleshooting Next

    Chapter 35. Reporting Bugs

    Jelmer R. Vernooij

    The Samba Team

    Someone; Tridge or Karl Auer perhaps?

    27 June 1997

    Table of Contents

    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Introduction

    Please report bugs using + bugzilla.

    Please take the time to read this file before you submit a bug report. Also, please see if it has changed between releases, as we may be changing the bug reporting mechanism at some time. @@ -20,27 +20,27 @@ that list that may be able to help you. You may also like to look though the recent mailing list archives, which are conveniently accessible on the Samba web pages at http://samba.org/samba/. -

    General info

    +

    General info

    Before submitting a bug report check your config for silly errors. Look in your log files for obvious messages that tell you that you've misconfigured something and run testparm to test your config file for correct syntax.

    -Have you run through the diagnosis? +Have you run through the diagnosis? This is very important.

    If you include part of a log file with your bug report then be sure to annotate it with exactly what you were doing on the client at the time, and exactly what the results were. -

    Debug levels

    +

    Debug levels

    If the bug has anything to do with Samba behaving incorrectly as a server (like refusing to open a file) then the log files will probably be very useful. Depending on the problem a log level of between 3 and -10 showing the problem may be appropriate. A higher level givesmore +10 showing the problem may be appropriate. A higher level gives more detail, but may use too much disk space.

    -To set the debug level use log level = in your -smb.conf. You may also find it useful to set the log +To set the debug level use the log level in your +smb.conf. You may also find it useful to set the log level higher for just one machine and keep separate logs for each machine. To do this use: 

    @@ -49,26 +49,27 @@ log file = /usr/local/samba/lib/log.%m
 include = /usr/local/samba/lib/smb.conf.%m

    then create a file -/usr/local/samba/lib/smb.conf.machine where -machine is the name of the client you wish to debug. In that file -put any smb.conf commands you want, for example -log level= may be useful. This also allows you to +/usr/local/samba/lib/smb.conf.machine where +machine is the name of the client you wish to debug. In that file +put any smb.conf commands you want, for example +log level may be useful. This also allows you to experiment with different security systems, protocol levels etc on just one machine.

    -The smb.conf entry log level = -is synonymous with the entry debuglevel = that has been -used in older versions of Samba and is being retained for backwards -compatibility of smb.conf files. +The smb.conf entry log level +is synonymous with the parameter debuglevel that has +been used in older versions of Samba and is being retained for backwards +compatibility of smb.conf files.

    -As the log level = value is increased you will record +As the log level value is increased you will record a significantly increasing level of debugging information. For most -debugging operations you may not need a setting higher than 3. Nearly -all bugs can be tracked at a setting of 10, but be prepared for a VERY -large volume of log data. -

    Internal errors

    -If you get a "INTERNAL ERROR" message in your log files it means that -Samba got an unexpected signal while running. It is probably a +debugging operations you may not need a setting higher than +3. Nearly +all bugs can be tracked at a setting of 10, but be +prepared for a VERY large volume of log data. +

    Internal errors

    +If you get a INTERNAL ERROR message in your log files +it means that Samba got an unexpected signal while running. It is probably a segmentation fault and almost certainly means a bug in Samba (unless you have faulty hardware or system software).

    @@ -80,34 +81,39 @@ include it in your bug report. You should also detail how to reproduce the problem, if possible. Please make this reasonably detailed.

    -You may also find that a core file appeared in a corefiles +You may also find that a core file appeared in a corefiles subdirectory of the directory where you keep your samba log files. This file is the most useful tool for tracking down the bug. To use it you do this: -

    gdb smbd core

    +

    +	$ gdb smbd core
+

    adding appropriate paths to smbd and core so gdb can find them. If you -don't have gdb then try dbx. Then within the debugger use the -command where to give a stack trace of where the problem -occurred. Include this in your mail. +don't have gdb then try dbx. Then within the debugger +use the command where to give a stack trace of where the +problem occurred. Include this in your report.

    -If you know any assembly language then do a disass of the routine +If you know any assembly language then do a +disass of the routine where the problem occurred (if its in a library routine then disassemble the routine that called it) and try to work out exactly where the problem is by looking at the surrounding code. Even if you -don't know assembly then incuding this info in the bug report can be +don't know assembly, including this info in the bug report can be useful. -

    Attaching to a running process

    +

    Attaching to a running process

    Unfortunately some unixes (in particular some recent linux kernels) refuse to dump a core file if the task has changed uid (which smbd does often). To debug with this sort of system you could try to attach -to the running process using gdb smbd PID where you get PID from -smbstatus. Then use c to continue and try to cause the core dump +to the running process using +gdb smbd PID where you get +PID from smbstatus. +Then use c to continue and try to cause the core dump using the client. The debugger should catch the fault and tell you where it occurred. -

    Patches

    +

    Patches

    The best sort of bug report is one that includes a fix! If you send us -patches please use diff -u format if your version of -diff supports it, otherwise use diff -c4. Make sure +patches please use diff -u format if your version of +diff supports it, otherwise use diff -c4. Make sure you do the diff against a clean version of the source and let me know exactly what version you used. -

    Prev Up Next
    Chapter 28. Analysing and solving samba problems Home Part V. Appendixes
    +

    Prev Up Next
    Chapter 34. Analysing and solving samba problems Home Part VI. Appendixes
    diff --git a/docs/htmldocs/compiling.html b/docs/htmldocs/compiling.html index c62fcf13f2..d8b85602d9 100644 --- a/docs/htmldocs/compiling.html +++ b/docs/htmldocs/compiling.html @@ -1,8 +1,8 @@ - -Chapter 30. How to compile SAMBA
    Chapter 30. How to compile SAMBA
    Prev Part V. Appendixes Next

    Chapter 30. How to compile SAMBA

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    (22 May 2001)

    18 March 2003

    Table of Contents

    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon

    -You can obtain the samba source from the samba website. To obtain a development version, +Chapter 36. How to compile SAMBA

    Chapter 36. How to compile SAMBA
    Prev Part VI. Appendixes Next

    Chapter 36. How to compile SAMBA

    Jelmer R. Vernooij

    The Samba Team

    Someone; Jerry perhaps?

    22 May 2001

    18 March 2003

    Table of Contents

    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    Common Errors

    +You can obtain the samba source from the +samba website. To obtain a development version, you can download samba from CVS or using rsync. -

    Access Samba source code via CVS

    Introduction

    +

    Access Samba source code via CVS

    Introduction

    Samba is developed in an open environment. Developers use CVS (Concurrent Versioning System) to "checkin" (also known as "commit") new source code. Samba's various CVS branches can @@ -11,12 +11,12 @@ detailed in this chapter.

    This chapter is a modified version of the instructions found at http://samba.org/samba/cvs.html -

    CVS Access to samba.org

    +

    CVS Access to samba.org

    The machine samba.org runs a publicly accessible CVS repository for access to the source code of several packages, -including samba, rsync and jitterbug. There are two main ways of -accessing the CVS server on this host. -

    Access via CVSweb

    +including samba, rsync, distcc, ccache and jitterbug. There are two main ways +of accessing the CVS server on this host. +

    Access via CVSweb

    You can access the source code via your favourite WWW browser. This allows you to access the contents of individual files in the repository and also to look at the revision @@ -24,7 +24,7 @@ history and commit logs of individual files. You can also ask for a diff listing between any two versions on the repository.

    Use the URL : http://samba.org/cgi-bin/cvsweb -

    Access via cvs

    +

    Access via cvs

    You can also access the source code via a normal cvs client. This gives you much more control over what you can do with the repository and allows you to checkout whole source trees @@ -33,154 +33,169 @@ preferred method of access if you are a developer and not just a casual browser.

    To download the latest cvs source code, point your -browser at the URL : http://www.cyclic.com/. +browser at the URL : +http://www.cyclic.com/. and click on the 'How to get cvs' link. CVS is free software under the GNU GPL (as is Samba). Note that there are several graphical CVS clients which provide a graphical interface to the sometimes mundane CVS commands. -Links to theses clients are also available from http://www.cyclic.com. +Links to theses clients are also available from the Cyclic website.

    To gain access via anonymous cvs use the following steps. For this example it is assumed that you want a copy of the samba source code. For the other source code repositories on this system just substitute the correct package name -

    1. +

      Procedure 36.1. Retrieving samba using CVS

      1. Install a recent copy of cvs. All you really need is a copy of the cvs client binary.

      2. Run the command

        - cvs -d :pserver:cvs@samba.org:/cvsroot login -

        - When it asks you for a password type cvs. + cvs -d :pserver:cvs@samba.org:/cvsroot login +

      3. + When it asks you for a password type cvs.

      4. Run the command

        - cvs -d :pserver:cvs@samba.org:/cvsroot co samba + cvs -d :pserver:cvs@samba.org:/cvsroot co samba

        This will create a directory called samba containing the latest samba source code (i.e. the HEAD tagged cvs branch). This currently corresponds to the 3.0 development tree.

        - CVS branches other then HEAD can be obtained by using the -r - and defining a tag name. A list of branch tag names can be found on the - "Development" page of the samba web site. A common request is to obtain the - latest 2.2 release code. This could be done by using the following userinput. + CVS branches other then HEAD can be obtained by using the + -r and defining a tag name. A list of branch tag names + can be found on the "Development" page of the samba web site. A common + request is to obtain the latest 3.0 release code. This could be done by + using the following command:

        - cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_2_2 samba + cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_3_0 samba

      5. Whenever you want to merge in the latest code changes use the following command from within the samba directory:

        - cvs update -d -P -

    Accessing the samba sources via rsync and ftp

    - pserver.samba.org also exports unpacked copies of most parts of the CVS tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. + cvs update -d -P +

    Accessing the samba sources via rsync and ftp

    + pserver.samba.org also exports unpacked copies of most parts of the CVS + tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at + rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. See the rsync homepage for more info on rsync.

    - The disadvantage of the unpacked trees - is that they do not support automatic - merging of local changes like CVS does. - rsync access is most convenient for an - initial install. -

    Verifying Samba's PGP signature

    -In these days of insecurity, it's strongly recommended that you verify the PGP signature for any -source file before installing it. According to Jerry Carter of the Samba Team, only about 22% of -all Samba downloads have had a corresponding PGP signature download (a very low percentage, which -should be considered a bad thing). Even if you're not downloading from a mirror site, verifying PGP -signatures should be a standard reflex. + The disadvantage of the unpacked trees is that they do not support automatic + merging of local changes like CVS does. rsync access is most convenient + for an initial install. +

    Verifying Samba's PGP signature

    +In these days of insecurity, it's strongly recommended that you verify the PGP +signature for any source file before installing it. Even if you're not +downloading from a mirror site, verifying PGP signatures should be a +standard reflex.

    With that said, go ahead and download the following files: -

    -     $ wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc
-     $ wget http://us1.samba.org/samba/ftp/samba-pubkey.asc
+
    +$  wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc
+$  wget http://us1.samba.org/samba/ftp/samba-pubkey.asc
 
    
 The first file is the PGP signature for the Samba source file; the other is the Samba public
 PGP key itself. Import the public PGP key with:
-
    -     $ gpg --import samba-pubkey.asc
+
    +	$ gpg --import samba-pubkey.asc
 
    
 And verify the Samba source code integrity with:
-
    -     $ gzip -d samba-2.2.8a.tar.gz
-     $ gpg --verify samba-2.2.8a.tar.asc
+
    +	$ gzip -d samba-2.2.8a.tar.gz
+	$ gpg --verify samba-2.2.8a.tar.asc
 
    
-If you receive a message like, "Good signature from Samba Distribution Verification Key..."
-then all is well. The warnings about trust relationships can be ignored. An example of what
-you would not want to see would be:
-
    +If you receive a message like, "Good signature from Samba Distribution 
+Verification Key..."
+then all is well. The warnings about trust relationships can be ignored. An
+example of what you would not want to see would be:
+
    
      gpg: BAD signature from "Samba Distribution Verification Key"
-

    Building the Binaries

    To do this, first run the program ./configure +

    Building the Binaries

    To do this, first run the program ./configure in the source directory. This should automatically configure Samba for your operating system. If you have unusual - needs then you may wish to run

    root# ./configure --help + needs then you may wish to run

    root# ./configure --help

    first to see what special options you can enable. - Then executing

    root# make

    will create the binaries. Once it's successfully - compiled you can use

    root# make install

    to install the binaries and manual pages. You can - separately install the binaries and/or man pages using

    root# make installbin -

    and

    root# make installman + Then executing

    root# make

    will create the binaries. Once it's successfully + compiled you can use

    root# make install

    to install the binaries and manual pages. You can + separately install the binaries and/or man pages using

    root# make installbin +

    and

    root# make installman

    Note that if you are upgrading for a previous version of Samba you might like to know that the old versions of the binaries will be renamed with a ".old" extension. You - can go back to the previous version with

    root# make revert -

    if you find this version a disaster!

    Compiling samba with Active Directory support

    In order to compile samba with ADS support, you need to have installed + can go back to the previous version with

    root# make revert +

    if you find this version a disaster!

    Compiling samba with Active Directory support

    In order to compile samba with ADS support, you need to have installed on your system:

    • the MIT kerberos development libraries (either install from the sources or use a package). The - heimdal libraries will not work.

    • the OpenLDAP development libraries.

    If your kerberos libraries are in a non-standard location then - remember to add the configure option --with-krb5=DIR.

    After you run configure make sure that include/config.h it generates contains lines like this:

    +	    Heimdal libraries will not work.
  • the OpenLDAP development libraries.

    • If your kerberos libraries are in a non-standard location then + remember to add the configure option + --with-krb5=DIR.

    After you run configure make sure that + include/config.h it generates contains lines like + this:

     #define HAVE_KRB5 1
 #define HAVE_LDAP 1

    If it doesn't then configure did not find your krb5 libraries or - your ldap libraries. Look in config.log to figure out why and fix - it.

    Installing the required packages for Debian

    On Debian you need to install the following packages:

    -

    • libkrb5-dev
    • krb5-user

    -

    Installing the required packages for RedHat

    On RedHat this means you should have at least:

    -

    • krb5-workstation (for kinit)
    • krb5-libs (for linking with)
    • krb5-devel (because you are compiling from source)

    + your ldap libraries. Look in config.log to figure + out why and fix it.

    Installing the required packages for Debian

    On Debian you need to install the following packages:

    +

    libkrb5-dev
    krb5-user

    +

    Installing the required packages for RedHat

    On RedHat this means you should have at least:

    +

    krb5-workstation (for kinit)
    krb5-libs (for linking with)
    krb5-devel (because you are compiling from source)

    in addition to the standard development environment.

    Note that these are not standard on a RedHat install, and you may need - to get them off CD2.

    Starting the smbd and nmbd

    You must choose to start smbd and nmbd either - as daemons or from inetdDon't try - to do both! Either you can put them in + to get them off CD2.

    Starting the smbd and nmbd

    You must choose to start smbd and nmbd either + as daemons or from inetd. Don't try + to do both! Either you can put them in inetd.conf and have them started on demand - by inetd, or you can start them as - daemons either from the command line or in + by inetd, or you can start them as + daemons either from the command line or in /etc/rc.local. See the man pages for details on the command line options. Take particular care to read the bit about what user you need to be in order to start - Samba. In many cases you must be root.

    The main advantage of starting smbd - and nmbd using the recommended daemon method + Samba. In many cases you must be root.

    The main advantage of starting smbd + and nmbd using the recommended daemon method is that they will respond slightly more quickly to an initial connection - request.

    Starting from inetd.conf

    NOTE; The following will be different if - you use NIS, NIS+ or LDAP to distribute services maps.

    Look at your /etc/services. + request.

    Starting from inetd.conf

    Note

    The following will be different if + you use NIS, NIS+ or LDAP to distribute services maps.

    Look at your /etc/services. What is defined at port 139/tcp. If nothing is defined - then add a line like this:

    netbios-ssn 139/tcp

    similarly for 137/udp you should have an entry like:

    netbios-ns 137/udp

    Next edit your /etc/inetd.conf + then add a line like this:

    netbios-ssn     139/tcp

    similarly for 137/udp you should have an entry like:

    netbios-ns	137/udp

    Next edit your /etc/inetd.conf and add two lines something like this:

     		netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd 
 		netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd 
-

    The exact syntax of /etc/inetd.conf +

    The exact syntax of /etc/inetd.conf varies between unixes. Look at the other entries in inetd.conf for a guide.

    Note

    Some unixes already have entries like netbios_ns - (note the underscore) in /etc/services. - You must either edit /etc/services or - /etc/inetd.conf to make them consistent.

    Note

    On many systems you may need to use the - interfaces option in smb.conf to specify the IP address - and netmask of your interfaces. Run ifconfig + (note the underscore) in /etc/services. + You must either edit /etc/services or + /etc/inetd.conf to make them consistent. +

    Note

    On many systems you may need to use the + interfaces option in smb.conf to specify the IP + address and netmask of your interfaces. Run + ifconfig as root if you don't know what the broadcast is for your - net. nmbd tries to determine it at run + net. nmbd tries to determine it at run time, but fails on some unixes.

    Warning

    Many unixes only accept around 5 - parameters on the command line in inetd.conf. + parameters on the command line in inetd.conf. This means you shouldn't use spaces between the options and arguments, or you should use a script, and start the script - from inetd.

    Restart inetd, perhaps just send - it a HUP. If you have installed an earlier version of - nmbd then you may need to kill nmbd as well.

    Alternative: starting it as a daemon

    To start the server as a daemon you should create + from inetd.

    Restart inetd, perhaps just send + it a HUP. If you have installed an earlier version of nmbd then + you may need to kill nmbd as well.

    Alternative: starting it as a daemon

    To start the server as a daemon you should create a script something like this one, perhaps calling - it startsmb.

    +		it startsmb.
     		#!/bin/sh
 		/usr/local/samba/bin/smbd -D 
 		/usr/local/samba/bin/nmbd -D 
-		
    then make it executable with chmod 
-		+x startsmb
    You can then run startsmb by 
-		hand or execute it from /etc/rc.local
+

    then make it executable with chmod + +x startsmb

    You can then run startsmb by + hand or execute it from /etc/rc.local

    To kill it send a kill signal to the processes - nmbd and smbd.

    Note

    If you use the SVR4 style init system then - you may like to look at the examples/svr4-startup - script to make Samba fit into that system.

    Prev Up Next
    Part V. Appendixes Home Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    + nmbd and smbd.

    Note

    If you use the SVR4 style init system then + you may like to look at the examples/svr4-startup + script to make Samba fit into that system.

    Common Errors

    “ +I'm using gcc 3 and I've compiled Samba-3 from the CVS and the +binaries are very large files (40 Mb and 20 Mb). I've the same result with +--enable-shared ? +” +

    +The dwarf format used by GCC 3 for storing debugging symbols is very inefficient. +Strip the binaries, don't compile with -g or compile with -gstabs. +

    Prev Up Next
    Part VI. Appendixes Home Chapter 37. Portability
    diff --git a/docs/htmldocs/diagnosis.html b/docs/htmldocs/diagnosis.html index 35c0ea11ac..ff3099ac72 100644 --- a/docs/htmldocs/diagnosis.html +++ b/docs/htmldocs/diagnosis.html @@ -1,5 +1,4 @@ - -Chapter 27. The samba checklist
    Chapter 27. The samba checklist
    Prev Part IV. Troubleshooting Next

    Chapter 27. The samba checklist

    Andrew Tridgell

    Samba Team

    <tridge@samba.org>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    Wed Jan 15

    Table of Contents

    Introduction
    Assumptions
    The tests
    Still having troubles?

    Introduction

    +Chapter 33. The Samba checklist

    Chapter 33. The Samba checklist
    Prev Part V. Troubleshooting Next

    Chapter 33. The Samba checklist

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Wed Jan 15

    Table of Contents

    Introduction
    Assumptions
    The tests
    Still having troubles?

    Introduction

    This file contains a list of tests you can perform to validate your Samba server. It also tells you what the likely cause of the problem is if it fails any one of these steps. If it passes all these tests @@ -14,16 +13,16 @@ to solve a problem. If you send one of the samba mailing lists an email saying "it doesn't work" and you have not followed this test procedure then you should not be surprised if your email is ignored. -

    Assumptions

    +

    Assumptions

    In all of the tests it is assumed you have a Samba server called BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP.

    The procedure is similar for other types of clients.

    It is also assumed you know the name of an available share in your -smb.conf. I will assume this share is called tmp. -You can add a tmp share like this by adding the -following to smb.conf: +smb.conf. I will assume this share is called tmp. +You can add a tmp share like this by adding the +following to smb.conf: 

     
 [tmp]
@@ -38,41 +37,41 @@ Some commands shown did not exist in earlier versions.

    Please pay attention to the error messages you receive. If any error message reports that your server is being unfriendly you should first check that your -IP name resolution is correctly set up. eg: Make sure your /etc/resolv.conf +IP name resolution is correctly set up. eg: Make sure your /etc/resolv.conf file points to name servers that really do exist.

    Also, if you do not have DNS server access for name resolution please check -that the settings for your smb.conf file results in dns proxy = no. The -best way to check this is with testparm smb.conf. +that the settings for your smb.conf file results in dns proxy = no. The +best way to check this is with testparm smb.conf.

    It is helpful to monitor the log files during testing by using the -tail -F log_file_name in a separate +tail -F log_file_name in a separate terminal console (use ctrl-alt-F1 through F6 or multiple terminals in X). Relevant log files can be found (for default installations) in -/usr/local/samba/var. Also, connection logs from -machines can be found here or possibly in /var/log/samba -depending on how or if you specified logging in your smb.conf file. +/usr/local/samba/var. Also, connection logs from +machines can be found here or possibly in /var/log/samba +depending on how or if you specified logging in your smb.conf file.

    -If you make changes to your smb.conf file while going through these test, -don't forget to restart smbd and nmbd. -

    The tests

    Procedure 27.1. Diagnosing your samba server

    1. -In the directory in which you store your smb.conf file, run the command -testparm smb.conf. If it reports any errors then your smb.conf +If you make changes to your smb.conf file while going through these test, +don't forget to restart smbd and nmbd. +

    The tests

    Procedure 33.1. Diagnosing your samba server

    1. +In the directory in which you store your smb.conf file, run the command +testparm smb.conf. If it reports any errors then your smb.conf configuration file is faulty.

      Note

      -Your smb.conf file may be located in: /etc/samba -Or in: /usr/local/samba/lib +Your smb.conf file may be located in: /etc/samba +Or in: /usr/local/samba/lib

    2. -Run the command ping BIGSERVER from the PC and -ping ACLIENT from +Run the command ping BIGSERVER from the PC and +ping ACLIENT from the unix box. If you don't get a valid response then your TCP/IP software is not correctly installed.

      Note that you will need to start a "dos prompt" window on the PC to run ping.

      -If you get a message saying "host not found" or similar then your DNS -software or /etc/hosts file is not correctly setup. +If you get a message saying host not found or similar then your DNS +software or /etc/hosts file is not correctly setup. It is possible to run samba without DNS entries for the server and client, but I assume you do have correct entries for the remainder of these tests. @@ -80,77 +79,78 @@ you do have correct entries for the remainder of these tests. Another reason why ping might fail is if your host is running firewall software. You will need to relax the rules to let in the workstation in question, perhaps by allowing access from another subnet (on Linux -this is done via the ipfwadm program.) -

      -Note: Modern Linux distributions install ipchains/iptables by default. +this is done via the ipfwadm program.) +

      Note

      +Modern Linux distributions install ipchains/iptables by default. This is a common problem that is often overlooked. -

    3. -Run the command smbclient -L BIGSERVER on the unix box. You +

  • +Run the command smbclient -L BIGSERVER on the unix box. You should get a list of available shares back.

    If you get a error message containing the string "Bad password" then -you probably have either an incorrect hosts allow, -hosts deny or valid users line in your -smb.conf, or your guest account is not -valid. Check what your guest account is using testparm and -temporarily remove any hosts allow, hosts deny, valid users or invalid users lines. +you probably have either an incorrect hosts allow, +hosts deny or valid users line in your +smb.conf, or your guest account is not +valid. Check what your guest account is using testparm and +temporarily remove any hosts allow, hosts deny, valid users or invalid users lines.

    -If you get a "connection refused" response then the smbd server may +If you get a connection refused response then the smbd server may not be running. If you installed it in inetd.conf then you probably edited that file incorrectly. If you installed it as a daemon then check that it is running, and check that the netbios-ssn port is in a LISTEN -state using netstat -a. +state using netstat -a.

    Note

    -Some Unix / Linux systems use xinetd in place of -inetd. Check your system documentation for the location +Some Unix / Linux systems use xinetd in place of +inetd. Check your system documentation for the location of the control file/s for your particular system implementation of this network super daemon.

    -If you get a "session request failed" then the server refused the +If you get a session request failed then the server refused the connection. If it says "Your server software is being unfriendly" then -its probably because you have invalid command line parameters to smbd, -or a similar fatal problem with the initial startup of smbd. Also -check your config file (smb.conf) for syntax errors with testparm +its probably because you have invalid command line parameters to smbd, +or a similar fatal problem with the initial startup of smbd. Also +check your config file (smb.conf) for syntax errors with testparm and that the various directories where samba keeps its log and lock files exist.

    There are a number of reasons for which smbd may refuse or decline a session request. The most common of these involve one or more of -the following smb.conf file entries: +the following smb.conf file entries: 

     	hosts deny = ALL
 	hosts allow = xxx.xxx.xxx.xxx/yy
 	bind interfaces only = Yes

    In the above, no allowance has been made for any session requests that -will automatically translate to the loopback adaptor address 127.0.0.1. +will automatically translate to the loopback adapter address 127.0.0.1. To solve this problem change these lines to: 

     	hosts deny = ALL
 	hosts allow = xxx.xxx.xxx.xxx/yy 127.

    -Do NOT use the bind interfaces only parameter where you +Do not use the bind interfaces only parameter where you may wish to -use the samba password change facility, or where smbclient may need to +use the samba password change facility, or where smbclient may need to access a local service for name resolution or for local resource -connections. (Note: the bind interfaces only parameter deficiency +connections. (Note: the bind interfaces only parameter deficiency where it will not allow connections to the loopback address will be fixed soon).

    Another common cause of these two errors is having something already running -on port 139, such as Samba (ie: smbd is running from inetd already) or -something like Digital's Pathworks. Check your inetd.conf file before trying -to start smbd as a daemon, it can avoid a lot of frustration! +on port 139, such as Samba +(ie: smbd is running from inetd already) or +something like Digital's Pathworks. Check your inetd.conf file before trying +to start smbd as a daemon, it can avoid a lot of frustration!

    And yet another possible cause for failure of this test is when the subnet mask and / or broadcast address settings are incorrect. Please check that the network interface IP Address / Broadcast Address / Subnet Mask settings are -correct and that Samba has correctly noted these in the log.nmb file. +correct and that Samba has correctly noted these in the log.nmbd file.

  • -Run the command nmblookup -B BIGSERVER __SAMBA__. You should get the +Run the command nmblookup -B BIGSERVER __SAMBA__. You should get the IP address of your Samba server back.

    -If you don't then nmbd is incorrectly installed. Check your inetd.conf +If you don't then nmbd is incorrectly installed. Check your inetd.conf if you run it from there, or that the daemon is running and listening to udp port 137.

    @@ -158,7 +158,7 @@ One common problem is that many inetd implementations can't take many parameters on the command line. If this is the case then create a one-line script that contains the right parameters and run that from inetd. -

  • run the command nmblookup -B ACLIENT '*'

    +

  • run the command nmblookup -B ACLIENT '*'

    You should get the PCs IP address back. If you don't then the client software on the PC isn't installed correctly, or isn't started, or you got the name of the PC wrong. @@ -166,86 +166,85 @@ got the name of the PC wrong. If ACLIENT doesn't resolve via DNS then use the IP address of the client in the above test.

  • -Run the command nmblookup -d 2 '*' +Run the command nmblookup -d 2 '*'

    This time we are trying the same as the previous test but are trying it via a broadcast to the default broadcast address. A number of -Netbios/TCPIP hosts on the network should respond, although Samba may +NetBIOS / TCP/IP hosts on the network should respond, although Samba may not catch all of the responses in the short time it listens. You -should see "got a positive name query response" messages from several -hosts. +should see got a positive name query response +messages from several hosts.

    If this doesn't give a similar result to the previous test then nmblookup isn't correctly getting your broadcast address through its automatic mechanism. In this case you should experiment with the -interfaces option in smb.conf to manually configure your IP +interfaces option in smb.conf to manually configure your IP address, broadcast and netmask.

    If your PC and server aren't on the same subnet then you will need to -use the -B option to set the broadcast address to that of the PCs +use the -B option to set the broadcast address to that of the PCs subnet.

    This test will probably fail if your subnet mask and broadcast address are not correct. (Refer to TEST 3 notes above).

  • -Run the command smbclient //BIGSERVER/TMP. You should +Run the command smbclient //BIGSERVER/TMP. You should then be prompted for a password. You should use the password of the account you are logged into the unix box with. If you want to test with -another account then add the -U accountname option to the end of +another account then add the -U accountname option to the end of the command line. eg: -smbclient //bigserver/tmp -Ujohndoe +smbclient //bigserver/tmp -Ujohndoe

    Note

    It is possible to specify the password along with the username as follows: -smbclient //bigserver/tmp -Ujohndoe%secret +smbclient //bigserver/tmp -Ujohndoe%secret

    -Once you enter the password you should get the smb> prompt. If you -don't then look at the error message. If it says "invalid network -name" then the service "tmp" is not correctly setup in your smb.conf. +Once you enter the password you should get the smb> prompt. If you +don't then look at the error message. If it says invalid network +name then the service "tmp" is not correctly setup in your smb.conf.

    -If it says "bad password" then the likely causes are: +If it says bad password then the likely causes are:

    1. - you have shadow passords (or some other password system) but didn't - compile in support for them in smbd + you have shadow passwords (or some other password system) but didn't + compile in support for them in smbd

    2. - your valid users configuration is incorrect + your valid users configuration is incorrect

    3. - you have a mixed case password and you haven't enabled the password + you have a mixed case password and you haven't enabled the password level option at a high enough level

    4. - the path = line in smb.conf is incorrect. Check it with testparm + the path = line in smb.conf is incorrect. Check it with testparm

    5. - you enabled password encryption but didn't create the SMB encrypted - password file + you enabled password encryption but didn't map unix to samba users

    Once connected you should be able to use the commands -dir get put etc. -Type help command for instructions. You should +dir get put etc. +Type help command for instructions. You should especially check that the amount of free disk space shown is correct -when you type dir. +when you type dir.

  • -On the PC, type the command net view \\BIGSERVER. You will +On the PC, type the command net view \\BIGSERVER. You will need to do this from within a "dos prompt" window. You should get back a list of available shares on the server.

    -If you get a "network name not found" or similar error then netbios +If you get a network name not found or similar error then netbios name resolution is not working. This is usually caused by a problem in nmbd. To overcome it you could do one of the following (you only need to choose one of them):

    1. - fixup the nmbd installation + fixup the nmbd installation

    2. - add the IP address of BIGSERVER to the wins server box in the - advanced tcp/ip setup on the PC. + add the IP address of BIGSERVER to the wins server box in the + advanced TCP/IP setup on the PC.

    3. enable windows name resolution via DNS in the advanced section of - the tcp/ip setup + the TCP/IP setup

    4. add BIGSERVER to your lmhosts file on the PC.

    -If you get a "invalid network name" or "bad password error" then the -same fixes apply as they did for the smbclient -L test above. In -particular, make sure your hosts allow line is correct (see the man +If you get a invalid network name or bad password error then the +same fixes apply as they did for the smbclient -L test above. In +particular, make sure your hosts allow line is correct (see the man pages)

    Also, do not overlook that fact that when the workstation requests the @@ -254,37 +253,37 @@ name with which you logged onto your Windows machine. You need to make sure that an account exists on your Samba server with that exact same name and password.

    -If you get "specified computer is not receiving requests" or similar +If you get specified computer is not receiving requests or similar it probably means that the host is not contactable via tcp services. Check to see if the host is running tcp wrappers, and if so add an entry in -the hosts.allow file for your client (or subnet, etc.) +the hosts.allow file for your client (or subnet, etc.)

  • -Run the command net use x: \\BIGSERVER\TMP. You should -be prompted for a password then you should get a "command completed -successfully" message. If not then your PC software is incorrectly -installed or your smb.conf is incorrect. make sure your hosts allow -and other config lines in smb.conf are correct. +Run the command net use x: \\BIGSERVER\TMP. You should +be prompted for a password then you should get a command completed +successfully message. If not then your PC software is incorrectly +installed or your smb.conf is incorrect. make sure your hosts allow +and other config lines in smb.conf are correct.

    It's also possible that the server can't work out what user name to -connect you as. To see if this is the problem add the line user = -username to the [tmp] section of -smb.conf where username is the +connect you as. To see if this is the problem add the line user = +username to the [tmp] section of +smb.conf where username is the username corresponding to the password you typed. If you find this fixes things you may need the username mapping option.

    It might also be the case that your client only sends encrypted passwords -and you have encrypt passwords = no in smb.conf +and you have encrypt passwords = no in smb.conf Turn it back on to fix.

  • -Run the command nmblookup -M testgroup where -testgroup is the name of the workgroup that your Samba server and +Run the command nmblookup -M testgroup where +testgroup is the name of the workgroup that your Samba server and Windows PCs belong to. You should get back the IP address of the master browser for that workgroup.

    If you don't then the election process has failed. Wait a minute to see if it is just being slow then try again. If it still fails after -that then look at the browsing options you have set in smb.conf. Make -sure you have preferred master = yes to ensure that +that then look at the browsing options you have set in smb.conf. Make +sure you have preferred master = yes to ensure that an election is held at startup.

  • >From file manager try to browse the server. Your samba server should @@ -294,10 +293,10 @@ of the server and get a list of shares. If you get a "invalid password" error when you do then you are probably running WinNT and it is refusing to browse a server that has no encrypted password capability and is in user level security mode. In this case either set -security = server AND -password server = Windows_NT_Machine in your -smb.conf file, or make sure encrypted passwords is +security = server AND +password server = Windows_NT_Machine in your +smb.conf file, or make sure encrypted passwords is set to "yes". -

    • Still having troubles?

    Read the chapter on -Analysing and Solving Problems. -

    Prev Up Next
    Part IV. Troubleshooting Home Chapter 28. Analysing and solving samba problems
    +

    Still having troubles?

    Read the chapter on +Analysing and Solving Problems. +

    Prev Up Next
    Part V. Troubleshooting Home Chapter 34. Analysing and solving samba problems
    diff --git a/docs/htmldocs/domain-member.html b/docs/htmldocs/domain-member.html index 5be675a541..59040dfebc 100644 --- a/docs/htmldocs/domain-member.html +++ b/docs/htmldocs/domain-member.html @@ -1,79 +1,528 @@ - -Chapter 8. Samba as a NT4 or Win2k domain member
    Chapter 8. Samba as a NT4 or Win2k domain member
    Prev Part II. Server Configuration Basics Next

    Chapter 8. Samba as a NT4 or Win2k domain member

    Jeremy Allison

    Samba Team

    <jra@samba.org>

    Gerald (Jerry) Carter

    Samba Team

    <jerry@samba.org>

    16 Apr 2001

    Table of Contents

    Joining an NT Domain with Samba 3.0
    Why is this better than security = server?

    Joining an NT Domain with Samba 3.0

    Assumptions: - 

    -		NetBIOS name: SERV1
-		Win2K/NT domain name: DOM
-		Domain's PDC NetBIOS name: DOMPDC
-		Domain's BDC NetBIOS names: DOMBDC1 and DOMBDC2
-

    -

    First, you must edit your smb.conf file to tell Samba it should - now use domain security.

    Change (or add) your - security = line in the [global] section - of your smb.conf to read:

    security = domain

    Next change the - workgroup = line in the [global] section to read:

    workgroup = DOM

    as this is the name of the domain we are joining.

    You must also have the parameter - encrypt passwords set to yes - in order for your users to authenticate to the NT PDC.

    Finally, add (or modify) a - password server = line in the [global] - section to read:

    password server = DOMPDC DOMBDC1 DOMBDC2

    These are the primary and backup domain controllers Samba - will attempt to contact in order to authenticate users. Samba will - try to contact each of these servers in order, so you may want to - rearrange this list in order to spread out the authentication load - among domain controllers.

    Alternatively, if you want smbd to automatically determine - the list of Domain controllers to use for authentication, you may - set this line to be :

    password server = *

    This method, allows Samba to use exactly the same - mechanism that NT does. This - method either broadcasts or uses a WINS database in order to - find domain controllers to authenticate against.

    In order to actually join the domain, you must run this - command:

    root# net join -S DOMPDC - -UAdministrator%password

    - If the -S DOMPDC argument is not given then - the domain name will be obtained from smb.conf. -

    as we are joining the domain DOM and the PDC for that domain - (the only machine that has write access to the domain SAM database) - is DOMPDC. The Administrator%password is - the login name and password for an account which has the necessary - privilege to add machines to the domain. If this is successful - you will see the message:

    Joined domain DOM. - or Joined 'SERV1' to realm 'MYREALM' -

    in your terminal window. See the - net(8) man page for more details.

    This process joins the server to the domain - without having to create the machine trust account on the PDC - beforehand.

    This command goes through the machine account password - change protocol, then writes the new (random) machine account - password for this Samba server into a file in the same directory - in which an smbpasswd file would be stored - normally :

    /usr/local/samba/private/secrets.tdb

    This file is created and owned by root and is not - readable by any other user. It is the key to the domain-level - security for your system, and should be treated as carefully - as a shadow password file.

    Finally, restart your Samba daemons and get ready for - clients to begin using domain security!

    Why is this better than security = server?

    Currently, domain security in Samba doesn't free you from - having to create local Unix users to represent the users attaching - to your server. This means that if domain user DOM\fred - attaches to your domain security Samba server, there needs - to be a local Unix user fred to represent that user in the Unix - filesystem. This is very similar to the older Samba security mode - security = server, - where Samba would pass through the authentication request to a Windows - NT server in the same way as a Windows 95 or Windows 98 server would. -

    Please refer to the Winbind - paper for information on a system to automatically - assign UNIX uids and gids to Windows NT Domain users and groups. -

    The advantage to domain-level security is that the - authentication in domain-level security is passed down the authenticated - RPC channel in exactly the same way that an NT server would do it. This - means Samba servers now participate in domain trust relationships in - exactly the same way NT servers do (i.e., you can add Samba servers into - a resource domain and have the authentication passed on from a resource - domain PDC to an account domain PDC).

    In addition, with security = server every Samba - daemon on a server has to keep a connection open to the - authenticating server for as long as that daemon lasts. This can drain - the connection resources on a Microsoft NT server and cause it to run - out of available connections. With security = domain, - however, the Samba daemons connect to the PDC/BDC only for as long - as is necessary to authenticate the user, and then drop the connection, - thus conserving PDC connection resources.

    And finally, acting in the same manner as an NT server - authenticating to a PDC means that as part of the authentication - reply, the Samba server gets the user identification information such - as the user SID, the list of NT groups the user belongs to, etc.

    Note

    Much of the text of this document - was first published in the Web magazine - LinuxWorld as the article Doing - the NIS/NT Samba.

    Prev Up Next
    Chapter 7. Samba as a ADS domain member Home Part III. Advanced Configuration
    +Chapter 7. Domain Membership
    Chapter 7. Domain Membership
    Prev Part II. Server Configuration Basics Next

    Chapter 7. Domain Membership

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails

    +Domain Membership is a subject of vital concern, Samba must be able to +participate as a member server in a Microsoft Domain security context, and +Samba must be capable of providing Domain machine member trust accounts, +otherwise it would not be capable of offering a viable option for many users. +

    +This chapter covers background information pertaining to domain membership, +Samba configuration for it, and MS Windows client procedures for joining a +domain. Why is this necessary? Because both are areas in which there exists +within the current MS Windows networking world and particularly in the +Unix/Linux networking and administration world, a considerable level of +mis-information, incorrect understanding, and a lack of knowledge. Hopefully +this chapter will fill the voids. +

    Features and Benefits

    +MS Windows workstations and servers that want to participate in domain +security need to +be made Domain members. Participating in Domain security is often called +Single Sign On or SSO for short. This +chapter describes the process that must be followed to make a workstation +(or another server - be it an MS Windows NT4 / 200x +server) or a Samba server a member of an MS Windows Domain security context. +

    +Samba-3 can join an MS Windows NT4 style domain as a native member server, an +MS Windows Active Directory Domain as a native member server, or a Samba Domain +Control network. +

    +Domain membership has many advantages: +

    • + MS Windows workstation users get the benefit of SSO +

    • + Domain user access rights and file ownership / access controls can be set + from the single Domain SAM (Security Account Manager) database + (works with Domain member servers as well as with MS Windows workstations + that are domain members) +

    • + Only MS Windows NT4 / 200x / XP Professional + workstations that are Domain members + can use network logon facilities +

    • + Domain Member workstations can be better controlled through the use of + Policy files (NTConfig.POL) and Desktop Profiles. +

    • + Through the use of logon scripts, users can be given transparent access to network + applications that run off application servers +

    • + Network administrators gain better application and user access management + abilities because there is no need to maintain user accounts on any network + client or server, other than the central Domain database + (either NT4/Samba SAM style Domain, NT4 Domain that is back ended with an + LDAP directory, or via an Active Directory infrastructure) +

    MS Windows Workstation/Server Machine Trust Accounts

    +A machine trust account is an account that is used to authenticate a client +machine +(rather than a user) to the Domain Controller server. In Windows terminology, +this is known as a "Computer Account." +

    +The password of a machine trust account acts as the shared secret for +secure communication with the Domain Controller. This is a security +feature to prevent an unauthorized machine with the same NetBIOS name +from joining the domain and gaining access to domain user/group +accounts. Windows NT, 200x, XP Professional clients use machine trust +accounts, but Windows 9x / Me / XP Home clients do not. Hence, a +Windows 9x / Me / XP Home client is never a true member of a domain +because it does not possess a machine trust account, and thus has no +shared secret with the domain controller. +

    +A Windows NT4 PDC stores each machine trust account in the Windows Registry. +The introduction of MS Windows 2000 saw the introduction of Active Directory, +the new repository for machine trust accounts. +

    +A Samba PDC, however, stores each machine trust account in two parts, +as follows: + +

    • + A Domain Security Account (stored in the + passdb backend that has been configured in the + smb.conf file. The precise nature of the account information that is + stored depends on the type of backend database that has been chosen. +

      + The older format of this data is the smbpasswd database + which contains the unix login ID, the Unix user identifier (UID), and the + LanMan and NT encrypted passwords. There is also some other information in + this file that we do not need to concern ourselves with here. +

      + The two newer database types are called ldapsam, + tdbsam. Both store considerably more data than the + older smbpasswd file did. The extra information + enables new user account controls to be used. +

    • + A corresponding Unix account, typically stored in + /etc/passwd. Work is in progress to allow a + simplified mode of operation that does not require Unix user accounts, but + this may not be a feature of the early releases of Samba-3. +

    +

    +There are three ways to create machine trust accounts: +

    • + Manual creation from the Unix/Linux command line. Here, both the Samba and + corresponding Unix account are created by hand. +

    • + Using the MS Windows NT4 Server Manager (either from an NT4 Domain member + server, or using the Nexus toolkit available from the Microsoft web site. + This tool can be run from any MS Windows machine so long as the user is + logged on as the administrator account. +

    • + "On-the-fly" creation. The Samba machine trust account is automatically + created by Samba at the time the client is joined to the domain. + (For security, this is the recommended method.) The corresponding Unix + account may be created automatically or manually. +

    Manual Creation of Machine Trust Accounts

    +The first step in manually creating a machine trust account is to manually +create the corresponding Unix account in /etc/passwd. +This can be done using vipw or another 'add user' command +that is normally used to create new Unix accounts. The following is an example for a Linux based Samba server: +

    +root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" -s /bin/false machine_name$ +

    +root# passwd -l machine_name$ +

    +On *BSD systems, this can be done using the chpass utility: +

    +root# chpass -a "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin" +

    +The /etc/passwd entry will list the machine name +with a "$" appended, won't have a password, will have a null shell and no +home directory. For example a machine named 'doppy' would have an +/etc/passwd entry like this: +

    +doppy$:x:505:501:machine_nickname:/dev/null:/bin/false
+

    +Above, machine_nickname can be any +descriptive name for the client, i.e., BasementComputer. +machine_name absolutely must be the NetBIOS +name of the client to be joined to the domain. The "$" must be +appended to the NetBIOS name of the client or Samba will not recognize +this as a machine trust account. +

    +Now that the corresponding Unix account has been created, the next step is to create +the Samba account for the client containing the well-known initial +machine trust account password. This can be done using the smbpasswd(8) command +as shown here: +

    +

    +root# smbpasswd -a -m machine_name
+

    +

    +where machine_name is the machine's NetBIOS +name. The RID of the new machine account is generated from the UID of +the corresponding Unix account. +

    Join the client to the domain immediately

    + Manually creating a machine trust account using this method is the + equivalent of creating a machine trust account on a Windows NT PDC using + the Server Manager. From the time at which the + account is created to the time which the client joins the domain and + changes the password, your domain is vulnerable to an intruder joining + your domain using a machine with the same NetBIOS name. A PDC inherently + trusts members of the domain and will serve out a large degree of user + information to such clients. You have been warned! +

    Using NT4 Server Manager to Add Machine Accounts to the Domain

    +If the machine from which you are trying to manage the domain is an +MS Windows NT4 workstation +then the tool of choice is the package called SRVTOOLS.EXE. +When executed in the target directory this will unpack +SrvMge.exe and UsrMgr.exe (both are +Domain Management tools for MS Windows NT4 workstation. +

    +If your workstation is any other MS Windows product you should download the +Nexus.exe package from the Microsoft web site. When executed +from the target directory this will unpack the same tools but for use on +MS Windows 9x/Me/200x/XP. +

    +Launch the srvmgr.exe (Server Manager for Domains) and follow these steps: +

    Procedure 7.1. Server Manager Account Machine Account Management

    1. + From the menu select Computer +

    2. + Click on Select Domain +

    3. + Click on the name of the domain you wish to administer in the + Select Domain panel and then click + OK. +

    4. + Again from the menu select Computer +

    5. + Select Add to Domain +

    6. + In the dialog box, click on the radio button to + Add NT Workstation of Server, then + enter the machine name in the field provided, then click the + Add button. +

    "On-the-Fly" Creation of Machine Trust Accounts

    +The second (and recommended) way of creating machine trust accounts is +simply to allow the Samba server to create them as needed when the client +is joined to the domain. +

    Since each Samba machine trust account requires a corresponding Unix account, a method +for automatically creating the Unix account is usually supplied; this requires configuration of the +add machine script option in +smb.conf. This method is not required, however; corresponding Unix +accounts may also be created manually. +

    +Below is an example for a RedHat Linux system. +

    +[global]
+   # <...remainder of parameters...>
+   add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u 
+

    Making an MS Windows Workstation or Server a Domain Member

    +The procedure for making an MS Windows workstation of server a member of the domain varies +with the version of Windows: +

    Windows 200x XP Professional

    + When the user elects to make the client a domain member, Windows 200x prompts for + an account and password that has privileges to create machine accounts in the domain. + A Samba administrative account (i.e., a Samba account that has root privileges on the + Samba server) must be entered here; the operation will fail if an ordinary user + account is given. +

    + Note: For security reasons the password for this administrative account should be set + to a password that is other than that used for the root user in the + /etc/passwd. +

    + The name of the account that is used to create domain member machine accounts can be + anything the network administrator may choose. If it is other than root + then this is easily mapped to root using the file pointed to be the smb.conf parameter + username map = /etc/samba/smbusers. +

    + The session key of the Samba administrative account acts as an + encryption key for setting the password of the machine trust + account. The machine trust account will be created on-the-fly, or + updated if it already exists. +

    Windows NT4

    + If the machine trust account was created manually, on the + Identification Changes menu enter the domain name, but do not + check the box Create a Computer Account in the Domain. + In this case, the existing machine trust account is used to join the machine + to the domain. +

    + If the machine trust account is to be created + on-the-fly, on the Identification Changes menu enter the domain + name, and check the box Create a Computer Account in the + Domain. In this case, joining the domain proceeds as above + for Windows 2000 (i.e., you must supply a Samba administrative account when + prompted). +

    Samba

    Joining a Samba client to a domain is documented in + the Domain Member Server section of this chapter chapter. +

    Domain Member Server

    +This mode of server operation involves the Samba machine being made a member +of a domain security context. This means by definition that all user +authentication will be done from a centrally defined authentication regime. +The authentication regime may come from an NT3/4 style (old domain technology) +server, or it may be provided from an Active Directory server (ADS) running on +MS Windows 2000 or later. +

    + +Of course it should be clear that the authentication back end itself could be +from any distributed directory architecture server that is supported by Samba. +This can be LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory +Server, etc. + +

    +Please refer to the Domain Control chapter +for more information regarding how to create a domain +machine account for a domain member server as well as for information +regarding how to enable the Samba domain member machine to join the domain and +to be fully trusted by it. +

    Joining an NT4 type Domain with Samba-3

    +

    Table 7.1. Assumptions

    NetBIOS name:SERV1
    Win2K/NT domain name:DOM
    Domain's PDC NetBIOS name:DOMPDC
    Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2

    +

    +First, you must edit your smb.conf file to tell Samba it should +now use domain security. +

    +Change (or add) your +security line in the [global] section +of your smb.conf to read: +

    +

    +security = domain
+

    +

    +Next change the +workgroup line in the [global] +section to read: +

    +

    +workgroup = DOM
+

    +

    +as this is the name of the domain we are joining. +

    +You must also have the parameter +encrypt passwords set to yes + in order for your users to authenticate to the NT PDC. +

    +Finally, add (or modify) a +password server line in the [global] +section to read: +

    +

    +password server = DOMPDC DOMBDC1 DOMBDC2
+

    +

    +These are the primary and backup domain controllers Samba +will attempt to contact in order to authenticate users. Samba will +try to contact each of these servers in order, so you may want to +rearrange this list in order to spread out the authentication load +among domain controllers. +

    +Alternatively, if you want smbd to automatically determine +the list of Domain controllers to use for authentication, you may +set this line to be: +

    +

    +password server = *
+

    +

    +This method allows Samba to use exactly the same mechanism that NT does. This +method either broadcasts or uses a WINS database in order to +find domain controllers to authenticate against. +

    +In order to actually join the domain, you must run this command: +

    +

    +root# net join -S DOMPDC -UAdministrator%password
+

    +

    +If the -S DOMPDC argument is not given then +the domain name will be obtained from smb.conf. +

    +As we are joining the domain DOM and the PDC for that domain +(the only machine that has write access to the domain SAM database) +is DOMPDC, we use it for the -S option. +The Administrator%password is +the login name and password for an account which has the necessary +privilege to add machines to the domain. If this is successful +you will see the message: +

    +Joined domain DOM. +or Joined 'SERV1' to realm 'MYREALM' +

    +in your terminal window. See the +net(8) man page for more details. +

    +This process joins the server to the domain without having to create the machine +trust account on the PDC beforehand. +

    +This command goes through the machine account password +change protocol, then writes the new (random) machine account +password for this Samba server into a file in the same directory +in which an smbpasswd file would be stored - normally: +

    +/usr/local/samba/private/secrets.tdb +

    +This file is created and owned by root and is not +readable by any other user. It is the key to the domain-level +security for your system, and should be treated as carefully +as a shadow password file. +

    +Finally, restart your Samba daemons and get ready for +clients to begin using domain security! +

    Why is this better than security = server?

    +Currently, domain security in Samba doesn't free you from +having to create local Unix users to represent the users attaching +to your server. This means that if domain user DOM\fred + attaches to your domain security Samba server, there needs +to be a local Unix user fred to represent that user in the Unix +filesystem. This is very similar to the older Samba security mode +security = server, +where Samba would pass through the authentication request to a Windows +NT server in the same way as a Windows 95 or Windows 98 server would. +

    +Please refer to the Winbind chapter +for information on a system to automatically +assign UNIX uids and gids to Windows NT Domain users and groups. +

    +The advantage to domain-level security is that the +authentication in domain-level security is passed down the authenticated +RPC channel in exactly the same way that an NT server would do it. This +means Samba servers now participate in domain trust relationships in +exactly the same way NT servers do (i.e., you can add Samba servers into +a resource domain and have the authentication passed on from a resource +domain PDC to an account domain PDC). +

    +In addition, with security = server every Samba +daemon on a server has to keep a connection open to the +authenticating server for as long as that daemon lasts. This can drain +the connection resources on a Microsoft NT server and cause it to run +out of available connections. With security = domain, +however, the Samba daemons connect to the PDC/BDC only for as long +as is necessary to authenticate the user, and then drop the connection, +thus conserving PDC connection resources. +

    +And finally, acting in the same manner as an NT server +authenticating to a PDC means that as part of the authentication +reply, the Samba server gets the user identification information such +as the user SID, the list of NT groups the user belongs to, etc. +

    Note

    +Much of the text of this document +was first published in the Web magazine +LinuxWorld as the article Doing +the NIS/NT Samba. +

    Samba ADS Domain Membership

    +This is a rough guide to setting up Samba 3.0 with Kerberos authentication against a +Windows2000 KDC. A familiarity with Kerberos is assumed. +

    Setup your smb.conf

    +You must use at least the following 3 options in smb.conf: +

    +	realm = your.kerberos.REALM
+	security = ADS
+	encrypt passwords = yes
+

    +In case samba can't figure out your ads server using your realm name, use the +ads server option in smb.conf: +

    +	ads server = your.kerberos.server
+

    +

    Note

    +You do not need a smbpasswd file, and older clients will be authenticated as +if security = domain, although it won't do any harm and +allows you to have local users not in the domain. It is expected that the above +required options will change soon when active directory integration will get +better. +

    Setup your /etc/krb5.conf

    +The minimal configuration for krb5.conf is: +

    +	[realms]
+	    YOUR.KERBEROS.REALM = {
+		kdc = your.kerberos.server
+	    }
+

    +Test your config by doing a kinit +USERNAME@REALM and +making sure that your password is accepted by the Win2000 KDC. +

    Note

    +The realm must be uppercase or you will get Cannot find KDC for +requested realm while getting initial credentials error. +

    Note

    +Time between the two servers must be synchronized. You will get a +kinit(v5): Clock skew too great while getting initial credentials +if the time difference is more than five minutes. +

    +You also must ensure that you can do a reverse DNS lookup on the IP +address of your KDC. Also, the name that this reverse lookup maps to +must either be the NetBIOS name of the KDC (ie. the hostname with no +domain attached) or it can alternatively be the NetBIOS name +followed by the realm. +

    +The easiest way to ensure you get this right is to add a +/etc/hosts entry mapping the IP address of your KDC to +its NetBIOS name. If you don't get this right then you will get a +local error when you try to join the realm. +

    +If all you want is Kerberos support in smbclient then you can skip +straight to Test with smbclient now. +Creating a computer account +and testing your servers +is only needed if you want Kerberos support for smbd and winbindd. +

    Create the computer account

    +As a user that has write permission on the Samba private directory +(usually root) run: +

    +	root# net join -U Administrator%password
+

    +

    Possible errors

    +

    ADS support not compiled in

    Samba must be reconfigured (remove config.cache) and recompiled + (make clean all install) after the Kerberos libs and headers are installed. +

    net join prompts for user name

    You need to login to the domain using kinit + USERNAME@REALM. + USERNAME must be a user who has rights to add a machine + to the domain.

    +

    Test your server setup

    +If the join was successful, you will see a new computer account with the +NetBIOS name of your Samba server in Active Directory (in the "Computers" +folder under Users and Computers. +

    +On a Windows 2000 client try net use * \\server\share. You should +be logged in with Kerberos without needing to know a password. If +this fails then run klist tickets. Did you get a ticket for the +server? Does it have an encoding type of DES-CBC-MD5 ? +

    Testing with smbclient

    +On your Samba server try to login to a Win2000 server or your Samba +server using smbclient and Kerberos. Use smbclient as usual, but +specify the -k option to choose Kerberos authentication. +

    Notes

    +You must change administrator password at least once after DC +install, to create the right encoding types +

    +W2k doesn't seem to create the _kerberos._udp and _ldap._tcp in +their defaults DNS setup. Maybe fixed in service packs? +

    Common Errors

    +In the process of adding / deleting / re-adding domain member machine accounts there are +many traps for the unwary player and there are many “little” things that can go wrong. +It is particularly interesting how often subscribers on the samba mailing list have concluded +after repeated failed attempts to add a machine account that it is necessary to "re-install" +MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type +of problem. The real solution is often very simple, and with understanding of how MS Windows +networking functions. easily overcome. +

    Can Not Add Machine Back to Domain

    +Problem: A Windows workstation was reinstalled. The original domain machine +account was deleted and added immediately. The workstation will not join the domain if I use +the same machine name. Attempts to add the machine fail with a message that the machine already +exists on the network - I know it doesn't. Why is this failing? +

    +The original name is still in the NetBIOS name cache and must expire after machine account +deletion BEFORE adding that same name as a domain member again. The best advice is to delete +the old account and then to add the machine with a new name. +

    Adding Machine to Domain Fails

    +Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a +message that, The machine could not be added at this time, there is a network problem. +Please try again later. Why? +

    +You should check that there is an add machine script in your smb.conf +file. If there is not, please add one that is appropriate for your OS platform. If a script +has been defined you will need to debug it's operation. Increase the log level +in the smb.conf file to level 10, then try to rejoin the domain. Check the logs to see which +operation is failing. +

    +Possible causes include: +

    • + The script does not actually exist, or could not be located in the path specified. +

      + Corrective Action: Fix it. Make sure that when run manually + that the script will add both the Unix system account _and_ the Samba SAM account. +

    • + The machine could not be added to the Unix system accounts file /etc/passwd +

      + Corrective Action: Check that the machine name is a legal Unix + system account name. ie: If the Unix utility useradd is called + then make sure that the machine name you are trying to add can be added using this + tool. Useradd on some systems will not allow any upper case characters + nor will it allow spaces in the name. +

    Prev Up Next
    Chapter 6. Backup Domain Control Home Chapter 8. Stand-Alone Servers
    diff --git a/docs/htmldocs/editreg.1.html b/docs/htmldocs/editreg.1.html index c5a86ee960..fe366f2b03 100644 --- a/docs/htmldocs/editreg.1.html +++ b/docs/htmldocs/editreg.1.html @@ -1,9 +1,9 @@ -editreg

    Name

    editreg — A utility to report and change SIDs in registry files -

    Synopsis

    editreg [-v] [-c file] {file}

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    editreg is a utility that +editreg

    Name

    editreg — A utility to report and change SIDs in registry files +

    Synopsis

    editreg [-v] [-c file] {file}

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    editreg is a utility that can visualize windows registry files (currently only NT4) and apply so-called commandfiles to them.

    OPTIONS

    registry_file

    Registry file to view or edit.

    -v,--verbose

    Increases verbosity of messages. -

    -c commandfile

    Read commands to execute on registry_file from commandfile. Currently not yet supported! +

    -c commandfile

    Read commands to execute on registry_file from commandfile. Currently not yet supported!

    -h|--help

    Print a summary of command line options.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    AUTHOR

    The original Samba software and related utilities diff --git a/docs/htmldocs/findsmb.1.html b/docs/htmldocs/findsmb.1.html index 878c3d78fe..a6013a13ec 100644 --- a/docs/htmldocs/findsmb.1.html +++ b/docs/htmldocs/findsmb.1.html @@ -1,39 +1,39 @@ -findsmb

    Name

    findsmb — list info about machines that respond to SMB - name queries on a subnet

    Synopsis

    findsmb [subnet broadcast address]

    DESCRIPTION

    This perl script is part of the Samba(7) - suite.

    findsmb is a perl script that +findsmb

    Name

    findsmb — list info about machines that respond to SMB + name queries on a subnet

    Synopsis

    findsmb [subnet broadcast address]

    DESCRIPTION

    This perl script is part of the Samba(7) + suite.

    findsmb is a perl script that prints out several pieces of information about machines on a subnet that respond to SMB name query requests. - It uses nmblookup(1) - and smbclient(1) + It uses nmblookup(1) + and smbclient(1) to obtain this information. -

    OPTIONS

    -r

    Controls whether findsmb takes +

    OPTIONS

    -r

    Controls whether findsmb takes bugs in Windows95 into account when trying to find a Netbios name registered of the remote machine. This option is disabled by default because it is specific to Windows 95 and Windows 95 machines only. - If set, nmblookup(1) - will be called with -B option.

    subnet broadcast address

    Without this option, findsmb + If set, nmblookup(1) + will be called with -B option.

    subnet broadcast address

    Without this option, findsmb will probe the subnet of the machine where - findsmb(1) + findsmb(1) is run. This value is passed to - nmblookup(1) - as part of the -B option.

    EXAMPLES

    The output of findsmb lists the following + nmblookup(1) + as part of the -B option.

    EXAMPLES

    The output of findsmb lists the following information for all machines that respond to the initial - nmblookup for any name: IP address, NetBIOS name, + nmblookup for any name: IP address, NetBIOS name, Workgroup name, operating system, and SMB server version.

    There will be a '+' in front of the workgroup name for machines that are local master browsers for that workgroup. There will be an '*' in front of the workgroup name for machines that are the domain master browser for that workgroup. Machines that are running Windows, Windows 95 or Windows 98 will not show any information about the operating system or server - version.

    The command with -r option - must be run on a system without nmbd(8) running. + version.

    The command with -r option + must be run on a system without nmbd(8) running. - If nmbd is running on the system, you will + If nmbd is running on the system, you will only get the IP address and the DNS name of the machine. To get proper responses from Windows 95 and Windows 98 machines, - the command must be run as root and with -r - option on a machine without nmbd running.

    For example, running findsmb - without -r option set would yield output similar + the command must be run as root and with -r + option on a machine without nmbd running.

    For example, running findsmb + without -r option set would yield output similar to the following

     IP ADDR         NETBIOS NAME   WORKGROUP/OS/VERSION 
 --------------------------------------------------------------------- 
@@ -48,8 +48,8 @@ IP ADDR         NETBIOS NAME   WORKGROUP/OS/VERSION
 192.168.35.93   FROGSTAR-PC    [MVENGR] [Windows 5.0] [Windows 2000 LAN Manager]
 192.168.35.97   HERBNT1       *[HERB-NT] [Windows NT 4.0] [NT LAN Manager 4.0]

    VERSION

    This man page is correct for version 3.0 of - the Samba suite.

    SEE ALSO

    nmbd(8), - smbclient(1), and nmblookup(1) + the Samba suite.

    SEE ALSO

    nmbd(8), + smbclient(1), and nmblookup(1)

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar diff --git a/docs/htmldocs/groupmapping.html b/docs/htmldocs/groupmapping.html index 704b799631..39fb34ce62 100644 --- a/docs/htmldocs/groupmapping.html +++ b/docs/htmldocs/groupmapping.html @@ -1,53 +1,178 @@ - -Chapter 12. Configuring Group Mapping

    Chapter 12. Configuring Group Mapping
    Prev Part III. Advanced Configuration Next

    Chapter 12. Configuring Group Mapping

    Jean François Micouleau

    Gerald (Jerry) Carter

    Samba Team

    <jerry@samba.org>

    -Starting with Samba 3.0 alpha 2, new group mapping functionality -is available to create associations between Windows SIDs and UNIX -groups. The groupmap subcommand included with -the net tool can be used to manage these associations. +Chapter 12. Mapping MS Windows and Unix Groups

    Chapter 12. Mapping MS Windows and Unix Groups
    Prev Part III. Advanced Configuration Next

    Chapter 12. Mapping MS Windows and Unix Groups

    Jean François Micouleau

    Gerald (Jerry) Carter

    Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails

    + Starting with Samba-3, new group mapping functionality is available to create associations + between Windows group SIDs and UNIX groups. The groupmap subcommand + included with the net tool can be used to manage these associations. +

    Warning

    + The first immediate reason to use the group mapping on a Samba PDC, is that + the domain admin group has been removed and should no longer + be specified in smb.conf. This parameter was used to give the listed users membership + in the Domain Admins Windows group which gave local admin rights on their workstations + (in default configurations). +

    Features and Benefits

    + Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to + arbitrarily associate them with Unix/Linux group accounts. +

    + Group accounts can be managed using the MS Windows NT4 or MS Windows 200x MMC tools + so long as appropriate interface scripts have been provided to smb.conf. +

    + Administrators should be aware that where smb.conf group interface scripts make + direct calls to the Unix/Linux system tools (eg: the shadow utilities, groupadd, + groupdel, groupmod) then the resulting Unix/Linux group names will be subject + to any limits imposed by these tools. If the tool does NOT allow upper case characters + or space characters, then the creation of an MS Windows NT4 / 200x style group of + Engineering Managers will attempt to create an identically named + Unix/Linux group, an attempt that will of course fail! +

    + There are several possible work-arounds for the operating system tools limitation. One + method is to use a script that generates a name for the Unix/Linux system group that + fits the operating system limits, and that then just passes the Unix/Linux group id (GID) + back to the calling Samba interface. This will provide a dynamic work-around solution. +

    + Another work-around is to manually create a Unix/Linux group, then manually create the + MS Windows NT4 / 200x group on the Samba server and then use the net groupmap + tool to connect the two to each other. +

    Discussion

    + When installing MS Windows NT4 / 200x on a computer, the installation + program creates default users and groups, notably the Administrators group, + and gives that group privileges necessary privileges to perform essential system tasks. + eg: Ability to change the date and time or to kill (or close) any process running on the + local machine. +

    + The 'Administrator' user is a member of the 'Administrators' group, and thus inherits + 'Administrators' group privileges. If a 'joe' user is created to be a member of the + 'Administrator' group, 'joe' has exactly the same rights as 'Administrator'. +

    + When an MS Windows NT4 / W200x is made a domain member, the "Domain Admins" group of the + PDC is added to the local 'Administrators' group of the workstation. Every member of the + 'Domain Administrators' group inherits the rights of the local 'Administrators' group when + logging on the workstation. +

    + The following steps describe how to make Samba PDC users members of the 'Domain Admins' group? +

    1. + create a unix group (usually in /etc/group), let's call it domadm +

    2. add to this group the users that must be Administrators. For example + if you want joe, john and mary, your entry in /etc/group will + look like: + 

      +		domadm:x:502:joe,john,mary
+

      +

    3. + Map this domadm group to the "Domain Admins" group by running the command: +

      + 

      +		root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm
+

      +

      + The quotes around "Domain Admins" are necessary due to the space in the group name. + Also make sure to leave no whitespace surrounding the equal character (=). +

    + Now joe, john and mary are domain administrators! +

    + It is possible to map any arbitrary UNIX group to any Windows NT4 / 200x group as well as + making any UNIX group a Windows domain group. For example, if you wanted to include a + UNIX group (e.g. acct) in a ACL on a local file or printer on a domain member machine, + you would flag that group as a domain group by running the following on the Samba PDC: +

    + 

    +	root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct
+

    +

    + Be aware that the RID parameter is a unsigned 32 bit integer that should + normally start at 1000. However, this rid must not overlap with any RID assigned + to a user. Verifying this is done differently depending on on the passdb backend + you are using. Future versions of the tools may perform the verification automatically, + but for now the burden is on you. +

    Example Configuration

    + You can list the various groups in the mapping database by executing + net groupmap list. Here is an example: +

    + 

    +		root#  net groupmap list
+		System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin
+		Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
+		Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
+		Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest
+

    +

    + For complete details on net groupmap, refer to the net(8) man page. +

    Configuration Scripts

    + Everyone needs tools. Some of us like to create our own, others prefer to use canned tools + (ie: prepared by someone else for general use). +

    Sample smb.conf add group script

    + A script to great complying group names for use by the Samba group interfaces: +

    +

    Example 12.1. smbgrpadd.sh

    +
+#!/bin/bash
+
+# Add the group using normal system groupadd tool.
+groupadd smbtmpgrp00
+
+thegid=`cat /etc/group | grep smbtmpgrp00 | cut -d ":" -f3`
+
+# Now change the name to what we want for the MS Windows networking end
+cp /etc/group /etc/group.bak
+cat /etc/group.bak | sed s/smbtmpgrp00/$1/g > /etc/group
+
+# Now return the GID as would normally happen.
+echo $thegid
+exit 0
+

    -The first immediate reason to use the group mapping on a Samba PDC, is that -the domain admin group smb.conf has been removed. -This parameter was used to give the listed users membership in the "Domain Admins" -Windows group which gave local admin rights on their workstations (in -default configurations). + The smb.conf entry for the above script would look like: + 

    +		add group script = /path_to_tool/smbgrpadd.sh %g
+

    +

    Script to configure Group Mapping

    + In our example we have created a Unix/Linux group called ntadmin. + Our script will create the additional groups Engineers, Marketoids, Gnomes: +

    +

    +#!/bin/bash
+
+net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin
+net groupmap modify ntgroup="Domain Users" unixgroup=users
+net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
+net groupmap modify ntgroup="Administrators" unixgroup=root
+net groupmap modify ntgroup="Users" unixgroup=users
+net groupmap modify ntgroup="Guests" unixgroup=nobody
+net groupmap modify ntgroup="System Operators" unixgroup=sys
+net groupmap modify ntgroup="Account Operators" unixgroup=root
+net groupmap modify ntgroup="Backup Operators" unixgroup=bin
+net groupmap modify ntgroup="Print Operators" unixgroup=lp
+net groupmap modify ntgroup="Replicators" unixgroup=daemon
+net groupmap modify ntgroup="Power Users" unixgroup=sys
+
+#groupadd Engineers
+#groupadd Marketoids
+#groupadd Gnomes
+
+#net groupmap add ntgroup="Engineers"  unixgroup=Engineers    type=d
+#net groupmap add ntgroup="Marketoids" unixgroup=Marketoids   type=d
+#net groupmap add ntgroup="Gnomes"     unixgroup=Gnomes       type=d
+

    -When installing NT/W2K on a computer, the installer program creates some users -and groups. Notably the 'Administrators' group, and gives to that group some -privileges like the ability to change the date and time or to kill any process -(or close too) running on the local machine. The 'Administrator' user is a -member of the 'Administrators' group, and thus 'inherit' the 'Administrators' -group privileges. If a 'joe' user is created and become a member of the -'Administrator' group, 'joe' has exactly the same rights as 'Administrator'. -

    -When a NT/W2K machine is joined to a domain, the "Domain Adminis" group of the -PDC is added to the local 'Administrators' group of the workstation. Every -member of the 'Domain Administrators' group 'inherit' the -rights of the local 'Administrators' group when logging on the workstation. -

    -The following steps describe how to make samba PDC users members of the -'Domain Admins' group? -

    1. create a unix group (usually in /etc/group), - let's call it domadm

    2. add to this group the users that must be Administrators. For example - if you want joe,john and mary, your entry in /etc/group will - look like:

      -  domadm:x:502:joe,john,mary
-

    3. Map this domadm group to the "Domain Admins" group - by running the command:

      root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm

      The quotes around "Domain Admins" are necessary due to the space in the group name. Also make - sure to leave no whitespace surrounding the equal character (=).

    Now joe, john and mary are domain administrators!

    -It is possible to map any arbitrary UNIX group to any Windows NT -group as well as making any UNIX group a Windows domain group. -For example, if you wanted to include a UNIX group (e.g. acct) in a ACL on a -local file or printer on a domain member machine, you would flag -that group as a domain group by running the following on the Samba PDC: -

    root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct

    Be aware that the rid parmeter is a unsigned 32 bit integer that should -normally start at 1000. However, this rid must not overlap with any RID assigned -to a user. Verifying this is done differently depending on on the passdb backend -you are using. Future versions of the tools may perform the verification automatically, -but for now the burden in on you.

    You can list the various groups in the mapping database by executing -net groupmap list. Here is an example:

    root# net groupmap list
-System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin
-Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
-Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
-Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest
-

    For complete details on net groupmap, refer to the -net(8) man page.

    Prev Up Next
    Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists Home Chapter 13. Printing Support
    + Of course it is expected that the administrator will modify this to suit local needs. + For information regarding the use of the net groupmap tool please + refer to the man page. +

    Common Errors

    +At this time there are many little surprises for the unwary administrator. In a real sense +it is imperative that every step of automated control scripts must be carefully tested +manually before putting them into active service. +

    Adding Groups Fails

    + This is a common problem when the groupadd is called directly + by the Samba interface script for the add group script in + the smb.conf file. +

    + The most common cause of failure is an attempt to add an MS Windows group account + that has either an upper case character and/or a space character in it. +

    + There are three possible work-arounds. Firstly, use only group names that comply + with the limitations of the Unix/Linux groupadd system tool. + The second involves use of the script mentioned earlier in this chapter, and the + third option is to manually create a Unix/Linux group account that can substitute + for the MS Windows group name, then use the procedure listed above to map that group + to the MS Windows group. +

    Adding MS Windows Groups to MS Windows Groups Fails

    + Samba-3 does NOT support nested groups from the MS Windows control environment. +

    Prev Up Next
    Chapter 11. Account Information Databases Home Chapter 13. File, Directory and Share Access Controls
    diff --git a/docs/htmldocs/install.html b/docs/htmldocs/install.html index 1c107c0019..154b9705e1 100644 --- a/docs/htmldocs/install.html +++ b/docs/htmldocs/install.html @@ -1,75 +1,155 @@ - -Chapter 2. How to Install and Test SAMBA
    Chapter 2. How to Install and Test SAMBA
    Prev Part I. General Installation Next

    Chapter 2. How to Install and Test SAMBA

    Andrew Tridgell

    Samba Team

    <tridge@samba.org>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    Karl Auer

    Table of Contents

    Obtaining and installing samba
    Configuring samba
    Editing the smb.conf file
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
    What If Things Don't Work?

    Obtaining and installing samba

    Binary packages of samba are included in almost any Linux or +Chapter 2. How to Install and Test SAMBA

    Chapter 2. How to Install and Test SAMBA
    Prev Part I. General Installation Next

    Chapter 2. How to Install and Test SAMBA

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Karl Auer

    Table of Contents

    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your + server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client
    What If Things Don't Work?
    Common Errors
    Why are so many smbd processes eating memory?
    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

    Obtaining and installing samba

    + Binary packages of samba are included in almost any Linux or Unix distribution. There are also some packages available at the samba homepage.

    If you need to compile samba from source, check the - appropriate appendix chapter.

    Configuring samba

    Samba's configuration is stored in the smb.conf file, - that usually resides in /etc/samba/smb.conf - or /usr/local/samba/lib/smb.conf. You can either + appropriate appendix chapter.

    If you have already installed samba, or if your operating system + was pre-installed with samba, then you may not need to bother with this + chapter. On the other hand, you may want to read this chapter anyhow + for information about updating samba.

    Configuring samba (smb.conf)

    + Samba's configuration is stored in the smb.conf file, + that usually resides in /etc/samba/smb.conf + or /usr/local/samba/lib/smb.conf. You can either edit this file yourself or do it using one of the many graphical tools that are available, such as the web-based interface swat, that - is included with samba.

    Editing the smb.conf file

    There are sample configuration files in the examples - subdirectory in the distribution. I suggest you read them - carefully so you can see how the options go together in - practice. See the man page for all the options.

    The simplest useful configuration file would be - something like this:

    -[global]
-	workgroup = MYGROUP
+	is included with samba.
+	
    Example Configuration
    
+	There are sample configuration files in the examples subdirectory in the
+	distribution. I suggest you read them carefully so you can see how the options
+	go together in practice. See the man page for all the options.
+	
    
+	The simplest useful configuration file would be something like this:
+	
    
+	
    +	[global]
+		workgroup = MYGROUP
 
-[homes]
-	guest ok = no
-	read only = no
-	
    which would allow connections by anyone with an 
-	account on the server, using either their login name or 
-	"homes" as the service name. (Note that I also set the 
-	workgroup that Samba is part of. See BROWSING.txt for details)
    Make sure you put the smb.conf file in the same place 
-	you specified in theMakefile (the default is to 
-	look for it in /usr/local/samba/lib/).
    For more information about security settings for the 
-	[homes] share please refer to the chapter 
-	Securing Samba.
    Test your config file with 
-	testparm
    It's important that you test the validity of your
-	smb.conf file using the testparm program. 
-	If testparm runs OK then it will list the loaded services. If 
-	not it will give an error message.
    Make sure it runs OK and that the services look 
-	reasonable before proceeding. 
    Always run testparm again when you change 
-	smb.conf!
    SWAT
    
+	[homes]
+		guest ok = no
+		read only = no
+

    +

    + This will allow connections by anyone with an account on the server, using either + their login name or "homes" as the service name. + (Note that the workgroup that Samba must also be set.) +

    + Make sure you put the smb.conf file in the same place + you specified in the Makefile (the default is to + look for it in /usr/local/samba/lib/). +

    + For more information about security settings for the + [homes] share please refer to the chapter + Securing Samba. +

    Test your config file with testparm

    + It's important that you test the validity of your smb.conf + file using the testparm program. If testparm runs OK + then it will list the loaded services. If not it will give an error message. +

    + Make sure it runs OK and that the services look reasonable before proceeding. +

    + Always run testparm again when you change smb.conf! +

    SWAT

    SWAT is a web-based interface that helps you configure samba. SWAT might not be available in the samba package on your platform, but in a separate package. Please read the swat manpage on compiling, installing and configuring swat from source. -

    To launch SWAT just run your favorite web browser and - point it at "http://localhost:901/". Replace localhost with the name of the computer you are running samba on if you - are running samba on a different computer than your browser.

    Note that you can attach to SWAT from any IP connected +

    + To launch SWAT just run your favorite web browser and + point it at http://localhost:901/. Replace + localhost + with the name of the computer you are running samba on if you + are running samba on a different computer than your browser. +

    + Note that you can attach to SWAT from any IP connected machine but connecting from a remote machine leaves your connection open to password sniffing as passwords will be sent - in the clear over the wire.

    Try listing the shares available on your - server

    $ smbclient -L - yourhostname

    You should get back a list of shares available on + in the clear over the wire. +

    Try listing the shares available on your + server

    $ smbclient -L + yourhostname

    You should get back a list of shares available on your server. If you don't then something is incorrectly setup. Note that this method can also be used to see what shares are available on other LanManager clients (such as WfWg).

    If you choose user level security then you may find that Samba requests a password before it will list the shares. - See the smbclient man page for details. (you + See the smbclient man page for details. (you can force it to list the shares without a password by adding the option -U% to the command line. This will not work - with non-Samba servers)

    Try connecting with the unix client

    $ smbclient - //yourhostname/aservice

    Typically the yourhostname - would be the name of the host where you installed smbd. - The aservice is - any service you have defined in the smb.conf - file. Try your user name if you just have a [homes] + with non-Samba servers)

    Try connecting with the unix client

    $ smbclient + //yourhostname/aservice

    Typically the yourhostname + would be the name of the host where you installed smbd. + The aservice is + any service you have defined in the smb.conf + file. Try your user name if you just have a [homes] section - in smb.conf.

    For example if your unix host is bambi - and your login name is fred you would type:

    $ smbclient //bambi/fred -

    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client

    Try mounting disks. eg:

    C:\WINDOWS\> net use d: \\servername\service -

    Try printing. eg:

    C:\WINDOWS\> net use lpt1: - \\servername\spoolservice

    C:\WINDOWS\> print filename -

    What If Things Don't Work?

    Then you might read the file chapter - Diagnosis and the + in smb.conf.

    For example if your unix host is bambi + and your login name is fred you would type:

    $ smbclient //bambi/fred +

    Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client

    Try mounting disks. eg:

    C:\WINDOWS\> net use d: \\servername\service +

    Try printing. eg:

    C:\WINDOWS\> net use lpt1: + \\servername\spoolservice

    C:\WINDOWS\> print filename +

    What If Things Don't Work?

    Then you might read the file chapter + Diagnosis and the FAQ. If you are still stuck then try to follow - the Analysing and Solving Problems chapter + the Analysing and Solving Problems chapter Samba has been successfully installed at thousands of sites worldwide, - so maybe someone else has hit your problem and has overcome it.

    Prev Up Next
    Chapter 1. Introduction to Samba Home Part II. Server Configuration Basics
    + so maybe someone else has hit your problem and has overcome it.

    Common Errors

    +The following questions and issues get raised on the samba mailing list over and over again. +

    Why are so many smbd processes eating memory?

    +“ +Site that is running Samba on an AIX box. They are sharing out about 2 terabytes using samba. +Samba was installed using smitty and the binaries. We seem to be experiencing a memory problem +with this box. When I do a svmon -Pu the monitoring program shows that smbd has several +processes of smbd running: +” +

    + “ +Is samba suppose to start this many different smbd processes? Or does it run as one smbd process? Also +is it normal for it to be taking up this much memory? +” +

    +

    +Inuse * 4096 = amount of memory being used by this process
+
+     Pid Command        Inuse      Pin     Pgsp  Virtual   64-bit    Mthrd
+   20950 smbd           33098     1906      181     5017        N        N
+   22262 smbd            9104     1906      5410
+   21060 smbd            9048     1906      181     5479        N        N
+   25972 smbd            8678     1906      181     5109        N        N
+   24524 smbd            8674     1906      181     5105        N        N
+   19262 smbd            8582     1906      181     5013        N        N
+   20722 smbd            8572     1906      181     5003        N        N
+   21454 smbd            8572     1906      181     5003        N        N
+   28946 smbd            8567     1906      181     4996        N        N
+   24076 smbd            8566     1906      181     4996        N        N
+   20138 smbd            8566     1906      181     4996        N        N
+   17608 smbd            8565     1906      181     4996        N        N
+   21820 smbd            8565     1906      181     4996        N        N
+   26940 smbd            8565     1906      181     4996        N        N
+   19884 smbd            8565     1906      181     4996        N        N
+    9912 smbd            8565     1906      181     4996        N        N
+   25800 smbd            8564     1906      181     4995        N        N
+   20452 smbd            8564     1906      181     4995        N        N
+   18592 smbd            8562     1906      181     4993        N        N
+   28216 smbd            8521     1906      181     4954        N        N
+   19110 smbd            8404     1906      181     4862        N        N
+
+   Total memory used:  841,592,832 bytes
+

    +

    +Samba consists on three core programs: +nmbd, smbd, winbindd. nmbd is the name server message daemon, +smbd is the server message daemon, winbindd is the daemon that +handles communication with Domain Controllers. +

    +If your system is NOT running as a WINS server, then there will be one (1) single instance of + nmbd running on your system. If it is running as a WINS server then there will be +two (2) instances - one to handle the WINS requests. +

    +smbd handles ALL connection requests and then spawns a new process for each client +connection made. That is why you are seeing so many of them, one (1) per client connection. +

    +winbindd will run as one or two daemons, depending on whether or not it is being +run in "split mode" (in which case there will be two instances). +

    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

    Your loopback device isn't working correctly. Make sure it's running.

    Prev Up Next
    Chapter 1. Introduction to Samba Home Chapter 3. Fast Start for the Impatient
    diff --git a/docs/htmldocs/integrate-ms-networks.html b/docs/htmldocs/integrate-ms-networks.html index 70f446e09d..083aeed9f3 100644 --- a/docs/htmldocs/integrate-ms-networks.html +++ b/docs/htmldocs/integrate-ms-networks.html @@ -1,5 +1,4 @@ - -Chapter 23. Integrating MS Windows networks with Samba
    Chapter 23. Integrating MS Windows networks with Samba
    Prev Part III. Advanced Configuration Next

    Chapter 23. Integrating MS Windows networks with Samba

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    (Jan 01 2001)

    Table of Contents

    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup

    +Chapter 26. Integrating MS Windows networks with Samba

    Chapter 26. Integrating MS Windows networks with Samba
    Prev Part III. Advanced Configuration Next

    Chapter 26. Integrating MS Windows networks with Samba

    John H. Terpstra

    Samba Team

    (Jan 01 2001)

    Table of Contents

    Features and Benefits
    Background Information
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    My Boomerang Won't Come Back
    Very Slow Network Connections
    Samba server name change problem

    This section deals with NetBIOS over TCP/IP name to IP address resolution. If your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this section does not apply to your installation. If your installation involves use of @@ -10,7 +9,15 @@ NetBIOS over TCP/IP then this section may help you to resolve networking problem to NOT run NetBEUI at all. Note also that there is NO such thing as NetBEUI over TCP/IP - the existence of such a protocol is a complete and utter mis-apprehension. -

    +

    Features and Benefits

    +Many MS Windows network administrators have never been exposed to basic TCP/IP +networking as it is implemented in a Unix/Linux operating system. Likewise, many Unix and +Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP based +networking (and may have no desire to be either). +

    +This chapter gives a short introduction to the basics of how a name can be resolved to +it's IP address for each operating system environment. +

    Background Information

    Since the introduction of MS Windows 2000 it is possible to run MS Windows networking without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over @@ -26,16 +33,16 @@ disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS req Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR). Use of DHCP with ADS is recommended as a further means of maintaining central control over client workstation network configuration. -

    Name Resolution in a pure Unix/Linux world

    +

    Name Resolution in a pure Unix/Linux world

    The key configuration files covered in this section are: -

    • /etc/hosts

    • /etc/resolv.conf

    • /etc/host.conf

    • /etc/nsswitch.conf

    /etc/hosts

    +

    • /etc/hosts

    • /etc/resolv.conf

    • /etc/host.conf

    • /etc/nsswitch.conf

    /etc/hosts

    Contains a static list of IP Addresses and names. eg: -

    +
     	127.0.0.1	localhost localhost.localdomain
 	192.168.1.1	bigbox.caldera.com	bigbox	alias4box
 
    
-The purpose of /etc/hosts is to provide a 
+The purpose of /etc/hosts is to provide a 
 name resolution mechanism so that uses do not need to remember 
 IP addresses.
 
    
@@ -43,16 +50,16 @@ Network packets that are sent over the physical network transport
 layer communicate not via IP addresses but rather using the Media 
 Access Control address, or MAC address. IP Addresses are currently 
 32 bits in length and are typically presented as four (4) decimal 
-numbers that are separated by a dot (or period). eg: 168.192.1.1
+numbers that are separated by a dot (or period). eg: 168.192.1.1.
 
    
 MAC Addresses use 48 bits (or 6 bytes) and are typically represented 
 as two digit hexadecimal numbers separated by colons. eg: 
 40:8e:0a:12:34:56
 
    
-Every network interfrace must have an MAC address. Associated with 
+Every network interface must have an MAC address. Associated with 
 a MAC address there may be one or more IP addresses. There is NO 
 relationship between an IP address and a MAC address, all such assignments 
-are arbitary or discretionary in nature. At the most basic level all 
+are arbitrary or discretionary in nature. At the most basic level all 
 network communications takes place using MAC addressing. Since MAC 
 addresses must be globally unique, and generally remains fixed for 
 any particular interface, the assignment of an IP address makes sense 
@@ -64,7 +71,7 @@ When a user or a process wants to communicate with another machine
 the protocol implementation ensures that the "machine name" or "host 
 name" is resolved to an IP address in a manner that is controlled 
 by the TCP/IP configuration control files. The file 
-/etc/hosts is one such file.
+/etc/hosts is one such file.
 
    
 When the IP address of the destination interface has been 
 determined a protocol called ARP/RARP is used to identify 
@@ -78,14 +85,14 @@ ff:ff:ff:ff:ff:ff. The reply packet from an ARP request will
 contain the MAC address and the primary IP address for each 
 interface.
 
    
-The /etc/hosts file is foundational to all 
-Unix/Linux TCP/IP installations and as a minumum will contain 
+The /etc/hosts file is foundational to all 
+Unix/Linux TCP/IP installations and as a minimum will contain 
 the localhost and local network interface IP addresses and the 
 primary names by which they are known within the local machine. 
 This file helps to prime the pump so that a basic level of name 
 resolution can exist before any other method of name resolution 
 becomes available.
-

    /etc/resolv.conf

    +

    /etc/resolv.conf

    This file tells the name resolution libraries:

    • The name of the domain to which the machine belongs @@ -95,21 +102,21 @@ This file tells the name resolution libraries:

    • The name or IP address of available Domain Name Servers that may be asked to perform name to address translation lookups -

    /etc/host.conf

    -/etc/host.conf is the primary means by +

    /etc/host.conf

    +/etc/host.conf is the primary means by which the setting in /etc/resolv.conf may be affected. It is a critical configuration file. This file controls the order by -which name resolution may procede. The typical structure is: -

    +which name resolution may proceed. The typical structure is:
+
     	order hosts,bind
 	multi on
 
    
 then both addresses should be returned. Please refer to the 
 man page for host.conf for further details.
-

    /etc/nsswitch.conf

    +

    /etc/nsswitch.conf

    This file controls the actual name resolution targets. The file typically has resolver object specifications as follows: -

    +
     	# /etc/nsswitch.conf
 	#
 	# Name Service Switch configuration file.
@@ -123,7 +130,7 @@ file typically has resolver object specifications as follows:
 
 	hosts:		files nis dns
 	# Alternative entries for host name resolution are:
-	# hosts:	files dns nis nis+ hesoid db compat ldap wins
+	# hosts:	files dns nis nis+ hesiod db compat ldap wins
 	networks:	nis files dns
 
 	ethers:		nis files
@@ -142,15 +149,15 @@ Starting with version 2.2.0 samba has Linux support for extensions to
 the name service switch infrastructure so that linux clients will 
 be able to obtain resolution of MS Windows NetBIOS names to IP 
 Addresses. To gain this functionality Samba needs to be compiled 
-with appropriate arguments to the make command (ie: make 
-nsswitch/libnss_wins.so). The resulting library should 
-then be installed in the /lib directory and 
+with appropriate arguments to the make command (ie: make 
+nsswitch/libnss_wins.so). The resulting library should 
+then be installed in the /lib directory and 
 the "wins" parameter needs to be added to the "hosts:" line in 
-the /etc/nsswitch.conf file. At this point it 
+the /etc/nsswitch.conf file. At this point it 
 will be possible to ping any MS Windows machine by it's NetBIOS 
 machine name, so long as that machine is within the workgroup to 
 which both the samba machine and the MS Windows machine belong.
-

    Name resolution as used within MS Windows networking

    +

    Name resolution as used within MS Windows networking

    MS Windows networking is predicated about the name each machine is given. This name is known variously (and inconsistently) as the "computer name", "machine name", "networking name", "netbios name", @@ -165,7 +172,7 @@ name is therefore registered for each service type that is provided by the client/server.

    The following are typical NetBIOS name/service type registrations: -

    +
     	Unique NetBIOS Names:
 		MACHINENAME<00>	= Server Service is running on MACHINENAME
 		MACHINENAME<03> = Generic Machine Name (NetBIOS name)
@@ -184,7 +191,7 @@ installations where traditionally the system administrator will
 determine in the /etc/hosts or in the DNS database what names 
 are associated with each IP address.
 
    
-One further point of clarification should be noted, the /etc/hosts 
+One further point of clarification should be noted, the /etc/hosts 
 file and the DNS records do not provide the NetBIOS name type information 
 that MS Windows clients depend on to locate the type of service that may 
 be needed. An example of this is what happens when an MS Windows client 
@@ -221,7 +228,7 @@ NBT or NetBT, the NetBIOS over TCP/IP.
 MS Windows machines use a complex array of name resolution mechanisms. 
 Since we are primarily concerned with TCP/IP this demonstration is 
 limited to this area.
-
    The NetBIOS Name Cache
    
+
    The NetBIOS Name Cache
    
 All MS Windows machines employ an in memory buffer in which is 
 stored the NetBIOS names and IP addresses for all external 
 machines that that machine has communicated with over the 
@@ -238,16 +245,16 @@ frustrating for users - but it is a characteristic of the protocol.
 
    
 The MS Windows utility that allows examination of the NetBIOS 
 name cache is called "nbtstat". The Samba equivalent of this 
-is called "nmblookup".
-
    The LMHOSTS file
    
+is called nmblookup.
+
    The LMHOSTS file
    
 This file is usually located in MS Windows NT 4.0 or 
-2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains 
+2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains 
 the IP Address and the machine name in matched pairs. The 
-LMHOSTS file performs NetBIOS name 
+LMHOSTS file performs NetBIOS name 
 to IP address mapping.
 
    
 It typically looks like:
-
    +
     	# Copyright (c) 1998 Microsoft Corp.
 	#
 	# This is a sample LMHOSTS file used by the Microsoft Wins Client (NetBIOS
@@ -256,7 +263,7 @@ It typically looks like:
 	# This file contains the mappings of IP addresses to NT computernames
 	# (NetBIOS) names.  Each entry should be kept on an individual line.
 	# The IP address should be placed in the first column followed by the
-	# corresponding computername. The address and the comptername
+	# corresponding computername. The address and the computername
 	# should be separated by at least one space or tab. The "#" character
 	# is generally used to denote the start of a comment (see the exceptions
 	# below).
@@ -288,7 +295,7 @@ It typically looks like:
 	# centralized lmhosts file to be maintained on a server.
 	# It is ALWAYS necessary to provide a mapping for the IP address of the
 	# server prior to the #INCLUDE. This mapping must use the #PRE directive.
-	# In addtion the share "public" in the example below must be in the
+	# In addition the share "public" in the example below must be in the
 	# LanManServer list of "NullSessionShares" in order for client machines to
 	# be able to read the lmhosts file successfully. This key is under
 	# \machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares
@@ -324,14 +331,14 @@ It typically looks like:
 	# so keeping the number of comments to a minimum will improve performance.
 	# Therefore it is not advisable to simply add lmhosts file entries onto the
 	# end of this file.
-
    HOSTS file
    
+

    HOSTS file

    This file is usually located in MS Windows NT 4.0 or 2000 in -C:\WINNT\SYSTEM32\DRIVERS\ETC and contains +C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address and the IP hostname in matched pairs. It can be used by the name resolution infrastructure in MS Windows, depending on how the TCP/IP environment is configured. This file is in -every way the equivalent of the Unix/Linux /etc/hosts file. -

    DNS Lookup

    +every way the equivalent of the Unix/Linux /etc/hosts file. +

    DNS Lookup

    This capability is configured in the TCP/IP setup area in the network configuration facility. If enabled an elaborate name resolution sequence is followed the precise nature of which is dependant on what the NetBIOS @@ -342,23 +349,79 @@ cache. If that fails then DNS, HOSTS and LMHOSTS are checked. If set to Node Type 8, then a NetBIOS Unicast (over UDP Unicast) is sent to the WINS Server to obtain a lookup before DNS, HOSTS, LMHOSTS, or broadcast lookup is used. -

    WINS Lookup

    -A WINS (Windows Internet Name Server) service is the equivaent of the +

    WINS Lookup

    +A WINS (Windows Internet Name Server) service is the equivalent of the rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores the names and IP addresses that are registered by a Windows client if the TCP/IP setup has been given at least one WINS Server IP Address.

    To configure Samba to be a WINS server the following parameter needs -to be added to the smb.conf file: -

    +to be added to the smb.conf file:
+
     	wins support = Yes
 
    
 To configure Samba to use a WINS server the following parameters are 
-needed in the smb.conf file:
-
    +needed in the smb.conf file:
+
     	wins support = No
 	wins server = xxx.xxx.xxx.xxx
 
    
-where xxx.xxx.xxx.xxx is the IP address 
+where xxx.xxx.xxx.xxx is the IP address 
 of the WINS server.
-
    Prev Up Next
    Chapter 22. Hosting a Microsoft Distributed File System tree on Samba Home Chapter 24. Securing Samba
    +

    Common Errors

    +TCP/IP network configuration problems find every network administrator sooner or later. +The cause can be anything from keyboard mishaps, forgetfulness, simple mistakes, and +carelessness. Of course, no one is every deliberately careless! +

    My Boomerang Won't Come Back

    + Well, the real complaint said, "I can ping my samba server from Windows, but I can + not ping my Windows machine from the samba server." +

    + The Windows machine was at IP Address 192.168.1.2 with netmask 255.255.255.0, the + Samba server (Linux) was at IP Address 192.168.1.130 with netmask 255.255.255.128. + The machines were on a local network with no external connections. +

    + Due to inconsistent netmasks, the Windows machine was on network 192.168.1.0/24, while + the Samba server was on network 192.168.1.128/25 - logically a different network. +

    Very Slow Network Connections

    + A common causes of slow network response includes: +

    • Client is configured to use DNS and DNS server is down

    • Client is configured to use remote DNS server, but remote connection is down

    • Client is configured to use a WINS server, but there is no WINS server

    • Client is NOT configured to use a WINS server, but there is a WINS server

    • Firewall is filtering our DNS or WINS traffic

    Samba server name change problem

    + The name of the samba server was changed, samba was restarted, samba server can not be + pinged by new name from MS Windows NT4 Workstation, but it does still respond to ping using + the old name. Why? +

    + From this description three (3) things are rather obvious: +

    • WINS is NOT in use, only broadcast based name resolution is used

    • The samba server was renamed and restarted within the last 10-15 minutes

    • The old samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation

    + To find what names are present in the NetBIOS name cache on the MS Windows NT4 machine, + open a cmd shell, then: +

    + 

    +	C:\temp\>nbtstat -n
+
+	              NetBIOS Local Name Table
+
+	   Name                 Type          Status
+	------------------------------------------------
+	SLACK            <03>  UNIQUE      Registered
+	ADMINISTRATOR    <03>  UNIQUE      Registered
+	SLACK            <00>  UNIQUE      Registered
+	SARDON           <00>  GROUP       Registered
+	SLACK            <20>  UNIQUE      Registered
+	SLACK            <1F>  UNIQUE      Registered
+
+
+	C:\Temp\>nbtstat -c
+
+	             NetBIOS Remote Cache Name Table
+
+	   Name                 Type       Host Address     Life [sec]
+	--------------------------------------------------------------
+	FRODO            <20>  UNIQUE      192.168.1.1          240
+
+	C:\Temp\>
+

    +

    + In the above example, FRODO is the Samba server and SLACK is the MS Windows NT4 Workstation. + The first listing shows the contents of the Local Name Table (ie: Identity information on + the MS Windows workstation), the second shows the NetBIOS name in the NetBIOS name cache. + The name cache contains the remote machines known to this workstation. +

    Prev Up Next
    Chapter 25. PAM based Distributed Authentication Home Chapter 27. Unicode/Charsets
    diff --git a/docs/htmldocs/introduction.html b/docs/htmldocs/introduction.html index f54776747c..94419cff04 100644 --- a/docs/htmldocs/introduction.html +++ b/docs/htmldocs/introduction.html @@ -1,6 +1,5 @@ - -Part I. General Installation
    Part I. General Installation
    Prev   Next

    General Installation

    Preparing Samba for Configuration

    This section of the Samba-HOWTO-Collection contains general info on how to install samba +Part I. General Installation

    Part I. General Installation
    Prev   Next

    General Installation

    Preparing Samba for Configuration

    This section of the Samba-HOWTO-Collection contains general info on how to install samba and how to configure the parts of samba you will most likely need. -PLEASE read this.

    Table of Contents

    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Additional Resources
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba
    Editing the smb.conf file
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
    What If Things Don't Work?
    Prev Up Next
    SAMBA Project Documentation Home Chapter 1. Introduction to Samba
    +PLEASE read this.

    Table of Contents

    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your + server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client
    What If Things Don't Work?
    Common Errors
    Why are so many smbd processes eating memory?
    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs
    3. Fast Start for the Impatient
    Note
    Prev Up Next
    SAMBA Project Documentation Home Chapter 1. Introduction to Samba
    diff --git a/docs/htmldocs/lmhosts.5.html b/docs/htmldocs/lmhosts.5.html index 9995b6937a..b96ddf8ddb 100644 --- a/docs/htmldocs/lmhosts.5.html +++ b/docs/htmldocs/lmhosts.5.html @@ -1,6 +1,6 @@ -lmhosts

    Name

    lmhosts — The Samba NetBIOS hosts file

    Synopsis

    lmhosts is the Samba(7) NetBIOS name to IP address mapping file.

    DESCRIPTION

    This file is part of the Samba(7) suite.

    lmhosts is the Samba +lmhosts

    Name

    lmhosts — The Samba NetBIOS hosts file

    Synopsis

    lmhosts is the Samba(7) NetBIOS name to IP address mapping file.

    DESCRIPTION

    This file is part of the Samba(7) suite.

    lmhosts is the Samba NetBIOS name to IP address mapping file. It - is very similar to the /etc/hosts file + is very similar to the /etc/hosts file format, except that the hostname component must correspond to the NetBIOS naming format.

    FILE FORMAT

    It is an ASCII file containing one line for NetBIOS name. The two fields on each line are separated from each other by @@ -22,8 +22,8 @@ and "SAMBASERVER" respectively, whatever the type component of the NetBIOS name requested.

    The second mapping will be returned only when the "0x20" name type for a name "NTSERVER" is queried. Any other name type will not - be resolved.

    The default location of the lmhosts file - is in the same directory as the smb.conf(5) file.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    smbclient(1), smb.conf(5), and smbpasswd(8) + be resolved.

    The default location of the lmhosts file + is in the same directory as the smb.conf(5) file.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    smbclient(1), smb.conf(5), and smbpasswd(8)

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar diff --git a/docs/htmldocs/msdfs.html b/docs/htmldocs/msdfs.html index cb7592214e..d01b8f4c5d 100644 --- a/docs/htmldocs/msdfs.html +++ b/docs/htmldocs/msdfs.html @@ -1,51 +1,62 @@ - -Chapter 22. Hosting a Microsoft Distributed File System tree on Samba

    Chapter 22. Hosting a Microsoft Distributed File System tree on Samba
    Prev Part III. Advanced Configuration Next

    Chapter 22. Hosting a Microsoft Distributed File System tree on Samba

    Shirish Kalele

    Samba Team & Veritas Software


    - <samba@samba.org>
    -

    12 Jul 2000

    Table of Contents

    Instructions
    Notes

    Instructions

    The Distributed File System (or Dfs) provides a means of - separating the logical view of files and directories that users - see from the actual physical locations of these resources on the - network. It allows for higher availability, smoother storage expansion, - load balancing etc. For more information about Dfs, refer to - Microsoft documentation.

    This document explains how to host a Dfs tree on a Unix - machine (for Dfs-aware clients to browse) using Samba.

    To enable SMB-based DFS for Samba, configure it with the - --with-msdfs option. Once built, a - Samba server can be made a Dfs server by setting the global - boolean - host msdfs parameter in the smb.conf - file. You designate a share as a Dfs root using the share - level boolean - msdfs root parameter. A Dfs root directory on - Samba hosts Dfs links in the form of symbolic links that point - to other servers. For example, a symbolic link - junction->msdfs:storage1\share1 in - the share directory acts as the Dfs junction. When Dfs-aware - clients attempt to access the junction link, they are redirected - to the storage location (in this case, \\storage1\share1).

    Dfs trees on Samba work with all Dfs-aware clients ranging - from Windows 95 to 2000.

    Here's an example of setting up a Dfs tree on a Samba - server.

    +Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    Prev Part III. Advanced Configuration Next
    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    Shirish Kalele
    Samba Team & Veritas Software

    
+				
    
+			
    12 Jul 2000
    Table of Contents
    Features and Benefits
    Common Errors
    Features and Benefits
    
+	The Distributed File System (or DFS) provides a means of separating the logical
+	view of files and directories that users see from the actual physical locations
+	of these resources on the network. It allows for higher availability, smoother
+	storage expansion, load balancing etc.
+	
    
+	For information about DFS, refer to
+	
+	Microsoft documentation at http://www.microsoft.com/NTServer/nts/downloads/winfeatures/NTSDistrFile/AdminGuide.asp.
+	
    
+	This document explains how to host a DFS tree on a Unix machine (for DFS-aware
+	clients to browse) using Samba.
+	
    
+	To enable SMB-based DFS for Samba, configure it with the --with-msdfs
+	option. Once built, a Samba server can be made a DFS server by setting the global 
+	boolean  host msdfs
+	parameter in the smb.conf  file. You designate a share as a DFS
+	root using the share level boolean 
+	msdfs root parameter. A DFS root directory on Samba hosts DFS
+	links in the form of symbolic links that point to other servers. For example, a symbolic link
+	junction->msdfs:storage1\share1 in the share directory acts
+	as the DFS junction. When DFS-aware clients attempt to access the junction link,
+	they are redirected to the storage location (in this case, \\storage1\share1).
+	
    
+	DFS trees on Samba work with all DFS-aware clients ranging from Windows 95 to 200x.
+	
    
+	Here's an example of setting up a DFS tree on a Samba server.
+	
     # The smb.conf file:
 [global]
-	netbios name = SAMBA
+	netbios name = SMOKEY
 	host msdfs   = yes
 
 [dfs]
 	path = /export/dfsroot
 	msdfs root = yes
 	
    In the /export/dfsroot directory we set up our dfs links to 
-	other servers on the network.
    root# cd /export/dfsroot
    root# chown root /export/dfsroot
    root# chmod 755 /export/dfsroot
    root# ln -s msdfs:storageA\\shareA linka
    root# ln -s msdfs:serverB\\share,serverC\\share linkb
    You should set up the permissions and ownership of 
-	the directory acting as the Dfs root such that only designated 
+	other servers on the network.
    +	root# cd /export/dfsroot
+	root# chown root /export/dfsroot
+	root# chmod 755 /export/dfsroot
+	root# ln -s msdfs:storageA\\shareA linka
+	root# ln -s msdfs:serverB\\share,serverC\\share linkb
+	
    You should set up the permissions and ownership of 
+	the directory acting as the DFS root such that only designated 
 	users can create, delete or modify the msdfs links. Also note 
 	that symlink names should be all lowercase. This limitation exists 
 	to have Samba avoid trying all the case combinations to get at 
 	the link name. Finally set up the symbolic links to point to the 
-	network shares you want, and start Samba.
    Users on Dfs-aware clients can now browse the Dfs tree 
+	network shares you want, and start Samba.
    Users on DFS-aware clients can now browse the DFS tree 
 	on the Samba server at \\samba\dfs. Accessing 
 	links linka or linkb (which appear as directories to the client) 
-	takes users directly to the appropriate shares on the network.
    Notes
    • Windows clients need to be rebooted 
-			if a previously mounted non-dfs share is made a dfs 
-			root or vice versa. A better way is to introduce a 
-			new share and make it the dfs root.
    • Currently there's a restriction that msdfs 
-			symlink names should all be lowercase.
    • For security purposes, the directory 
-			acting as the root of the Dfs tree should have ownership 
-			and permissions set so that only designated users can 
-			modify the symbolic links in the directory.
    Prev Up Next
    Chapter 21. Stackable VFS modules Home Chapter 23. Integrating MS Windows networks with Samba
    
+	takes users directly to the appropriate shares on the network.

    Common Errors

    • Windows clients need to be rebooted + if a previously mounted non-dfs share is made a dfs + root or vice versa. A better way is to introduce a + new share and make it the dfs root.

    • Currently there's a restriction that msdfs + symlink names should all be lowercase.

    • For security purposes, the directory + acting as the root of the DFS tree should have ownership + and permissions set so that only designated users can + modify the symbolic links in the directory.

    Prev Up Next
    Chapter 16. Interdomain Trust Relationships Home Chapter 18. Classical Printing Support
    diff --git a/docs/htmldocs/net.8.html b/docs/htmldocs/net.8.html index be30dbed05..13e4be81be 100644 --- a/docs/htmldocs/net.8.html +++ b/docs/htmldocs/net.8.html @@ -1,6 +1,6 @@ -net

    Name

    net — Tool for administration of Samba and remote +net

    Name

    net — Tool for administration of Samba and remote CIFS servers. -

    Synopsis

    net {<ads|rap|rpc>} [-h] [-w workgroup] [-W myworkgroup] [-U user] [-I ip-address] [-p port] [-n myname] [-s conffile] [-S server] [-l] [-P] [-D debuglevel]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The samba net utility is meant to work just like the net utility +

    Synopsis

    net {<ads|rap|rpc>} [-h] [-w workgroup] [-W myworkgroup] [-U user] [-I ip-address] [-p port] [-n myname] [-s conffile] [-S server] [-l] [-P] [-D debuglevel]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The samba net utility is meant to work just like the net utility available for windows and DOS. The first argument should be used to specify the protocol to use when executing a certain command. ADS is used for ActiveDirectory, RAP is using for old (Win9x/NT3) @@ -24,15 +24,15 @@ Defaults to trying 445 first, then 139.

    -n <primary NetBIOS name>

    This option allows you to override the NetBIOS name that Samba uses for itself. This is identical -to setting the NetBIOS -name parameter in the smb.conf(5) file. However, a command +to setting the NetBIOS +name parameter in the smb.conf(5) file. However, a command line setting will take precedence over settings in -smb.conf(5).

    -s <configuration file>

    The file specified contains the +smb.conf(5).

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at compile time.

    -S server

    @@ -42,7 +42,7 @@ compile time.

    -S server

    When listing data, give more information on each item.

    -P

    Make queries to the external server using the machine account of the local server. -

    -d|--debug=debuglevel

    debuglevel is an integer +

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -56,11 +56,11 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    COMMANDS

    TIME

    The NET TIME command allows you to view the time on a remote server - or synchronise the time on the local server with the time on the remote server.

    TIME

    Without any options, the NET TIME command +smb.conf(5) file.

    COMMANDS

    TIME

    The NET TIME command allows you to view the time on a remote server + or synchronise the time on the local server with the time on the remote server.

    TIME

    Without any options, the NET TIME command displays the time on the remote server. -

    TIME SYSTEM

    Displays the time on the remote server in a format ready for /bin/date

    TIME SET

    Tries to set the date and time of the local server to that on -the remote server using /bin/date.

    TIME ZONE

    Displays the timezone in hours from GMT on the remote computer.

    [RPC|ADS] JOIN [TYPE] [-U username[%password]] [options]

    +

    TIME SYSTEM

    Displays the time on the remote server in a format ready for /bin/date

    TIME SET

    Tries to set the date and time of the local server to that on +the remote server using /bin/date.

    TIME ZONE

    Displays the timezone in hours from GMT on the remote computer.

    [RPC|ADS] JOIN [TYPE] [-U username[%password]] [options]

    Join a domain. If the account already exists on the server, and [TYPE] is MEMBER, the machine will attempt to join automatically. (Assuming that the machine has been created in server manager) @@ -70,37 +70,37 @@ be created.

    joining the domain.

    [RPC] OLDJOIN [options]

    Join a domain. Use the OLDJOIN option to join the domain using the old style of domain joining - you need to create a trust -account in server manager first.

    [RPC|ADS] USER

    [RPC|ADS] USER DELETE target

    Delete specified user

    [RPC|ADS] USER LIST

    List all users

    [RPC|ADS] USER INFO target

    List the domain groups of a the specified user.

    [RPC|ADS] USER ADD name [password] [-F user flags] [-C comment]

    Add specified user.

    [RPC|ADS] GROUP

    [RPC|ADS] GROUP [misc options] [targets]

    List user groups.

    [RPC|ADS] GROUP DELETE name [misc. options]

    Delete specified group.

    [RPC|ADS] GROUP ADD name [-C comment]

    Create specified group.

    [RAP|RPC] SHARE

    [RAP|RPC] SHARE [misc. options] [targets]

    Enumerates all exported resources (network shares) on target server.

    [RAP|RPC] SHARE ADD name=serverpath [-C comment] [-M maxusers] [targets]

    Adds a share from a server (makes the export active). Maxusers +account in server manager first.

    [RPC|ADS] USER

    [RPC|ADS] USER DELETE target

    Delete specified user

    [RPC|ADS] USER LIST

    List all users

    [RPC|ADS] USER INFO target

    List the domain groups of a the specified user.

    [RPC|ADS] USER ADD name [password] [-F user flags] [-C comment]

    Add specified user.

    [RPC|ADS] GROUP

    [RPC|ADS] GROUP [misc options] [targets]

    List user groups.

    [RPC|ADS] GROUP DELETE name [misc. options]

    Delete specified group.

    [RPC|ADS] GROUP ADD name [-C comment]

    Create specified group.

    [RAP|RPC] SHARE

    [RAP|RPC] SHARE [misc. options] [targets]

    Enumerates all exported resources (network shares) on target server.

    [RAP|RPC] SHARE ADD name=serverpath [-C comment] [-M maxusers] [targets]

    Adds a share from a server (makes the export active). Maxusers specifies the number of users that can be connected to the -share simultaneously.

    SHARE DELETE sharenam

    Delete specified share.

    [RPC|RAP] FILE

    [RPC|RAP] FILE

    List all open files on remote server.

    [RPC|RAP] FILE CLOSE fileid

    Close file with specified fileid on -remote server.

    [RPC|RAP] FILE INFO fileid

    -Print information on specified fileid. +share simultaneously.

    SHARE DELETE sharenam

    Delete specified share.

    [RPC|RAP] FILE

    [RPC|RAP] FILE

    List all open files on remote server.

    [RPC|RAP] FILE CLOSE fileid

    Close file with specified fileid on +remote server.

    [RPC|RAP] FILE INFO fileid

    +Print information on specified fileid. Currently listed are: file-id, username, locks, path, permissions.

    [RAP|RPC] FILE USER

    Note

    Currently NOT implemented.

    SESSION

    RAP SESSION

    Without any other options, SESSION enumerates all active SMB/CIFS -sessions on the target server.

    RAP SESSION DELETE|CLOSE CLIENT_NAME

    Close the specified sessions.

    RAP SESSION INFO CLIENT_NAME

    Give a list with all the open files in specified session.

    RAP SERVER DOMAIN

    List all servers in specified domain or workgroup. Defaults +sessions on the target server.

    RAP SESSION DELETE|CLOSE CLIENT_NAME

    Close the specified sessions.

    RAP SESSION INFO CLIENT_NAME

    Give a list with all the open files in specified session.

    RAP SERVER DOMAIN

    List all servers in specified domain or workgroup. Defaults to local domain.

    RAP DOMAIN

    Lists all domains and workgroups visible on the -current network.

    RAP PRINTQ

    RAP PRINTQ LIST QUEUE_NAME

    Lists the specified print queue and print jobs on the server. -If the QUEUE_NAME is omitted, all -queues are listed.

    RAP PRINTQ DELETE JOBID

    Delete job with specified id.

    RAP VALIDATE user [password]

    +current network.

    RAP PRINTQ

    RAP PRINTQ LIST QUEUE_NAME

    Lists the specified print queue and print jobs on the server. +If the QUEUE_NAME is omitted, all +queues are listed.

    RAP PRINTQ DELETE JOBID

    Delete job with specified id.

    RAP VALIDATE user [password]

    Validate whether the specified user can log in to the remote server. If the password is not specified on the commandline, it will be prompted. -

    Note

    Currently NOT implemented.

    RAP GROUPMEMBER

    RAP GROUPMEMBER LIST GROUP

    List all members of the specified group.

    RAP GROUPMEMBER DELETE GROUP USER

    Delete member from group.

    RAP GROUPMEMBER ADD GROUP USER

    Add member to group.

    RAP ADMIN command

    Execute the specified command on +

    Note

    Currently NOT implemented.

    RAP GROUPMEMBER

    RAP GROUPMEMBER LIST GROUP

    List all members of the specified group.

    RAP GROUPMEMBER DELETE GROUP USER

    Delete member from group.

    RAP GROUPMEMBER ADD GROUP USER

    Add member to group.

    RAP ADMIN command

    Execute the specified command on the remote server. Only works with OS/2 servers. -

    Note

    Currently NOT implemented.

    RAP SERVICE

    RAP SERVICE START NAME [arguments...]

    Start the specified service on the remote server. Not implemented yet.

    Note

    Currently NOT implemented.

    RAP SERVICE STOP

    Stop the specified service on the remote server.

    Note

    Currently NOT implemented.

    RAP PASSWORD USER OLDPASS NEWPASS

    -Change password of USER from OLDPASS to NEWPASS. -

    LOOKUP

    LOOKUP HOST HOSTNAME [TYPE]

    +

    Note

    Currently NOT implemented.

    RAP SERVICE

    RAP SERVICE START NAME [arguments...]

    Start the specified service on the remote server. Not implemented yet.

    Note

    Currently NOT implemented.

    RAP SERVICE STOP

    Stop the specified service on the remote server.

    Note

    Currently NOT implemented.

    RAP PASSWORD USER OLDPASS NEWPASS

    +Change password of USER from OLDPASS to NEWPASS. +

    LOOKUP

    LOOKUP HOST HOSTNAME [TYPE]

    Lookup the IP address of the given host with the specified type (netbios suffix). The type defaults to 0x20 (workstation). -

    LOOKUP LDAP [DOMAIN

    Give IP address of LDAP server of specified DOMAIN. Defaults to local domain.

    LOOKUP KDC [REALM]

    Give IP address of KDC for the specified REALM. -Defaults to local realm.

    LOOKUP DC [DOMAIN]

    Give IP's of Domain Controllers for specified -DOMAIN. Defaults to local domain.

    LOOKUP MASTER DOMAIN

    Give IP of master browser for specified DOMAIN +

    LOOKUP LDAP [DOMAIN

    Give IP address of LDAP server of specified DOMAIN. Defaults to local domain.

    LOOKUP KDC [REALM]

    Give IP address of KDC for the specified REALM. +Defaults to local realm.

    LOOKUP DC [DOMAIN]

    Give IP's of Domain Controllers for specified +DOMAIN. Defaults to local domain.

    LOOKUP MASTER DOMAIN

    Give IP of master browser for specified DOMAIN or workgroup. Defaults to local domain.

    CACHE

    Samba uses a general caching interface called 'gencache'. It can be controlled using 'NET CACHE'.

    All the timeout parameters support the suffixes:

    s - Seconds
    m - Minutes
    h - Hours
    d - Days
    w - Weeks

    -

    CACHE ADD key data time-out

    Add specified key+data to the cache with the given timeout.

    CACHE DEL key

    Delete key from the cache.

    CACHE SET key data time-out

    Update data of existing cache entry.

    CACHE SEARCH PATTERN

    Search for the specified pattern in the cache data.

    CACHE LIST

    +

    CACHE ADD key data time-out

    Add specified key+data to the cache with the given timeout.

    CACHE DEL key

    Delete key from the cache.

    CACHE SET key data time-out

    Update data of existing cache entry.

    CACHE SEARCH PATTERN

    Search for the specified pattern in the cache data.

    CACHE LIST

    List all current items in the cache.

    CACHE FLUSH

    Remove all the current items from the cache.

    GETLOCALSID [DOMAIN]

    Print the SID of the specified domain, or if the parameter is omitted, the SID of the domain the local server is in.

    SETLOCALSID S-1-5-21-x-y-z

    Sets domain sid for the local server to the specified SID.

    GROUPMAP

    Manage the mappings between Windows group SIDs and UNIX groups. @@ -110,14 +110,14 @@ Parameters take the for "parameter=value". Common options include:

    RPC INFO

    Print information about the domain of the remote server, such as domain name, domain sid and number of users and groups. -

    [RPC|ADS] TESTJOIN

    Check whether participation in a domain is still valid.

    [RPC|ADS] CHANGETRUSTPW

    Force change of domain trust password.

    RPC TRUSTDOM

    RPC TRUSTDOM ADD DOMAIN

    Add a interdomain trust account for -DOMAIN to the remote server. -

    RPC TRUSTDOM DEL DOMAIM

    Remove interdomain trust account for -DOMAIN from the remote server. -

    Note

    Currently NOT implemented.

    RPC TRUSTDOM ESTABLISH DOMAIN

    +

    [RPC|ADS] TESTJOIN

    Check whether participation in a domain is still valid.

    [RPC|ADS] CHANGETRUSTPW

    Force change of domain trust password.

    RPC TRUSTDOM

    RPC TRUSTDOM ADD DOMAIN

    Add a interdomain trust account for +DOMAIN to the remote server. +

    RPC TRUSTDOM DEL DOMAIM

    Remove interdomain trust account for +DOMAIN from the remote server. +

    Note

    Currently NOT implemented.

    RPC TRUSTDOM ESTABLISH DOMAIN

    Establish a trust relationship to a trusting domain. Interdomain account must already be created on the remote PDC. -

    RPC TRUSTDOM REVOKE DOMAIN

    Abandon relationship to trusted domain

    RPC TRUSTDOM LIST

    List all current interdomain trust relationships.

    RPC ABORTSHUTDOWN

    Abort the shutdown of a remote server.

    SHUTDOWN [-t timeout] [-r] [-f] [-C message]

    Shut down the remote server.

    -r

    +

    RPC TRUSTDOM REVOKE DOMAIN

    Abandon relationship to trusted domain

    RPC TRUSTDOM LIST

    List all current interdomain trust relationships.

    RPC ABORTSHUTDOWN

    Abort the shutdown of a remote server.

    SHUTDOWN [-t timeout] [-r] [-f] [-C message]

    Shut down the remote server.

    -r

    Reboot after shutdown.

    -f

    Force shutting down all applications. @@ -128,18 +128,18 @@ user of the system can use this time to cancel the shutdown. announce the shutdown.

    SAMDUMP

    Print out sam database of remote server. You need to run this on either a BDC.

    VAMPIRE

    Export users, aliases and groups from remote server to local server. Can only be run an a BDC. -

    GETSID

    Fetch domain SID and store it in the local secrets.tdb.

    ADS LEAVE

    Make the remote host leave the domain it is part of.

    ADS STATUS

    Print out status of machine account of the local machine in ADS. +

    GETSID

    Fetch domain SID and store it in the local secrets.tdb.

    ADS LEAVE

    Make the remote host leave the domain it is part of.

    ADS STATUS

    Print out status of machine account of the local machine in ADS. Prints out quite some debug info. Aimed at developers, regular -users should use NET ADS TESTJOIN.

    ADS PRINTER

    ADS PRINTER INFO [PRINTER] [SERVER]

    -Lookup info for PRINTER on SERVER. The printer name defaults to "*", the -server name defaults to the local host.

    ADS PRINTER PUBLISH PRINTER

    Publish specified printer using ADS.

    ADS PRINTER REMOVE PRINTER

    Remove specified printer from ADS directory.

    ADS SEARCH EXPRESSION ATTRIBUTES...

    Perform a raw LDAP search on a ADS server and dump the results. The +users should use NET ADS TESTJOIN.

    ADS PRINTER

    ADS PRINTER INFO [PRINTER] [SERVER]

    +Lookup info for PRINTER on SERVER. The printer name defaults to "*", the +server name defaults to the local host.

    ADS PRINTER PUBLISH PRINTER

    Publish specified printer using ADS.

    ADS PRINTER REMOVE PRINTER

    Remove specified printer from ADS directory.

    ADS SEARCH EXPRESSION ATTRIBUTES...

    Perform a raw LDAP search on a ADS server and dump the results. The expression is a standard LDAP search expression, and the -attributes are a list of LDAP fields to show in the results.

    Example: net ads search '(objectCategory=group)' sAMAccountName -

    ADS DN DN (attributes)

    +attributes are a list of LDAP fields to show in the results.

    Example: net ads search '(objectCategory=group)' sAMAccountName +

    ADS DN DN (attributes)

    Perform a raw LDAP search on a ADS server and dump the results. The DN standard LDAP DN, and the attributes are a list of LDAP fields to show in the result. -

    Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' SAMAccountName

    WORKGROUP

    Print out workgroup name for specified kerberos realm.

    HELP [COMMAND]

    Gives usage information for the specified command.

    VERSION

    This man page is complete for version 3.0 of the Samba +

    Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' SAMAccountName

    WORKGROUP

    Print out workgroup name for specified kerberos realm.

    HELP [COMMAND]

    Gives usage information for the specified command.

    VERSION

    This man page is complete for version 3.0 of the Samba suite.

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar diff --git a/docs/htmldocs/nmbd.8.html b/docs/htmldocs/nmbd.8.html index b07267fa45..c282bde89d 100644 --- a/docs/htmldocs/nmbd.8.html +++ b/docs/htmldocs/nmbd.8.html @@ -1,76 +1,76 @@ -nmbd

    Name

    nmbd — NetBIOS name server to provide NetBIOS - over IP naming services to clients

    Synopsis

    nmbd [-D] [-F] [-S] [-a] [-i] [-o] [-h] [-V] [-d <debug level>] [-H <lmhosts file>] [-l <log directory>] [-n <primary netbios name>] [-p <port number>] [-s <configuration file>]

    DESCRIPTION

    This program is part of the Samba(7) suite.

    nmbd is a server that understands +nmbd

    Name

    nmbd — NetBIOS name server to provide NetBIOS + over IP naming services to clients

    Synopsis

    nmbd [-D] [-F] [-S] [-a] [-i] [-o] [-h] [-V] [-d <debug level>] [-H <lmhosts file>] [-l <log directory>] [-n <primary netbios name>] [-p <port number>] [-s <configuration file>]

    DESCRIPTION

    This program is part of the Samba(7) suite.

    nmbd is a server that understands and can reply to NetBIOS over IP name service requests, like those produced by SMB/CIFS clients such as Windows 95/98/ME, Windows NT, Windows 2000, Windows XP and LanManager clients. It also participates in the browsing protocols which make up the Windows "Network Neighborhood" view.

    SMB/CIFS clients, when they start up, may wish to locate an SMB/CIFS server. That is, they wish to know what - IP number a specified host is using.

    Amongst other services, nmbd will + IP number a specified host is using.

    Amongst other services, nmbd will listen for such requests, and if its own NetBIOS name is specified it will respond with the IP number of the host it is running on. Its "own NetBIOS name" is by default the primary DNS name of the host it is running on, but this can be overridden with the -n - option (see OPTIONS below). Thus nmbd will + option (see OPTIONS below). Thus nmbd will reply to broadcast queries for its own name(s). Additional - names for nmbd to respond on can be set - via parameters in the smb.conf(5) configuration file.

    nmbd can also be used as a WINS + names for nmbd to respond on can be set + via parameters in the smb.conf(5) configuration file.

    nmbd can also be used as a WINS (Windows Internet Name Server) server. What this basically means is that it will act as a WINS database server, creating a database from name registration requests that it receives and - replying to queries from clients for these names.

    In addition, nmbd can act as a WINS + replying to queries from clients for these names.

    In addition, nmbd can act as a WINS proxy, relaying broadcast queries from clients that do not understand how to talk the WINS protocol to a WINS server.

    OPTIONS

    -D

    If specified, this parameter causes - nmbd to operate as a daemon. That is, + nmbd to operate as a daemon. That is, it detaches itself and runs in the background, fielding - requests on the appropriate port. By default, nmbd + requests on the appropriate port. By default, nmbd will operate as a daemon if launched from a command shell. - nmbd can also be operated from the inetd + nmbd can also be operated from the inetd meta-daemon, although this is not recommended.

    -F

    If specified, this parameter causes - the main nmbd process to not daemonize, + the main nmbd process to not daemonize, i.e. double-fork and disassociate with the terminal. Child processes are still created as normal to service each connection request, but the main process does not exit. This operation mode is suitable for running - nmbd under process supervisors such - as supervise and svscan - from Daniel J. Bernstein's daemontools + nmbd under process supervisors such + as supervise and svscan + from Daniel J. Bernstein's daemontools package, or the AIX process monitor.

    -S

    If specified, this parameter causes - nmbd to log to standard output rather + nmbd to log to standard output rather than a file.

    -i

    If this parameter is specified it causes the server to run "interactively", not as a daemon, even if the server is executed on the command line of a shell. Setting this parameter negates the implicit daemon mode when run from the - command line. nmbd also logs to standard - output, as if the -S parameter had been + command line. nmbd also logs to standard + output, as if the -S parameter had been given.

    -h|--help

    Print a summary of command line options.

    -H <filename>

    NetBIOS lmhosts file. The lmhosts file is a list of NetBIOS names to IP addresses that is loaded by the nmbd server and used via the name - resolution mechanism name resolve - order described in smb.conf(5) to resolve any + resolution mechanism name resolve + order described in smb.conf(5) to resolve any NetBIOS name queries needed by the server. Note that the contents of this file are NOT - used by nmbd to answer any name queries. + used by nmbd to answer any name queries. Adding a line to this file affects name NetBIOS resolution from this host ONLY.

    The default path to this file is compiled into Samba as part of the build process. Common defaults - are /usr/local/samba/lib/lmhosts, - /usr/samba/lib/lmhosts or - /etc/samba/lmhosts. See the lmhosts(5) man page for details on the contents of this file.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the + are /usr/local/samba/lib/lmhosts, + /usr/samba/lib/lmhosts or + /etc/samba/lmhosts. See the lmhosts(5) man page for details on the contents of this file.

    -V

    Prints the version number for +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -84,61 +84,61 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -p <UDP port number>

    UDP port number is a positive integer value. This option changes the default UDP port number (normally 137) - that nmbd responds to name queries on. Don't + that nmbd responds to name queries on. Don't use this option unless you are an expert, in which case you - won't need help!

    FILES

    /etc/inetd.conf

    If the server is to be run by the - inetd meta-daemon, this file + won't need help!

    FILES

    /etc/inetd.conf

    If the server is to be run by the + inetd meta-daemon, this file must contain suitable startup information for the meta-daemon. See the install document for details. -

    /etc/rc

    or whatever initialization script your +

    /etc/rc

    or whatever initialization script your system uses).

    If running the server as a daemon at startup, this file will need to contain an appropriate startup sequence for the server. See the "How to Install and Test SAMBA" document - for details.

    /etc/services

    If running the server via the - meta-daemon inetd, this file + for details.

    /etc/services

    If running the server via the + meta-daemon inetd, this file must contain a mapping of service name (e.g., netbios-ssn) to service port (e.g., 139) and protocol type (e.g., tcp). See the "How to Install and Test SAMBA" - document for details.

    /usr/local/samba/lib/smb.conf

    This is the default location of - the smb.conf(5) server + document for details.

    /usr/local/samba/lib/smb.conf

    This is the default location of + the smb.conf(5) server configuration file. Other common places that systems - install this file are /usr/samba/lib/smb.conf - and /etc/samba/smb.conf.

    When run as a WINS server (see the - wins support - parameter in the smb.conf(5) man page), - nmbd - will store the WINS database in the file wins.dat - in the var/locks directory configured under - wherever Samba was configured to install itself.

    If nmbd is acting as a - browse master (see the local master - parameter in the smb.conf(5) man page, nmbd - will store the browsing database in the file browse.dat - in the var/locks directory + install this file are /usr/samba/lib/smb.conf + and /etc/samba/smb.conf.

    When run as a WINS server (see the + wins support + parameter in the smb.conf(5) man page), + nmbd + will store the WINS database in the file wins.dat + in the var/locks directory configured under + wherever Samba was configured to install itself.

    If nmbd is acting as a + browse master (see the local master + parameter in the smb.conf(5) man page, nmbd + will store the browsing database in the file browse.dat + in the var/locks directory configured under wherever Samba was configured to install itself. -

    SIGNALS

    To shut down an nmbd process it is recommended +

    SIGNALS

    To shut down an nmbd process it is recommended that SIGKILL (-9) NOT be used, except as a last resort, as this may leave the name database in an inconsistent state. - The correct way to terminate nmbd is to send it - a SIGTERM (-15) signal and wait for it to die on its own.

    nmbd will accept SIGHUP, which will cause - it to dump out its namelists into the file namelist.debug - in the /usr/local/samba/var/locks - directory (or the var/locks directory configured + The correct way to terminate nmbd is to send it + a SIGTERM (-15) signal and wait for it to die on its own.

    nmbd will accept SIGHUP, which will cause + it to dump out its namelists into the file namelist.debug + in the /usr/local/samba/var/locks + directory (or the var/locks directory configured under wherever Samba was configured to install itself). This will also - cause nmbd to dump out its server database in - the log.nmb file.

    The debug log level of nmbd may be raised or lowered - using smbcontrol(1) (SIGUSR[1|2] signals + cause nmbd to dump out its server database in + the log.nmb file.

    The debug log level of nmbd may be raised or lowered + using smbcontrol(1) (SIGUSR[1|2] signals are no longer used since Samba 2.2). This is to allow transient problems to be diagnosed, whilst still running at a normally low log level.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    - inetd(8), smbd(8), smb.conf(5), smbclient(1), testparm(1), testprns(1), and the Internet - RFC's rfc1001.txt, rfc1002.txt. + inetd(8), smbd(8), smb.conf(5), smbclient(1), testparm(1), testprns(1), and the Internet + RFC's rfc1001.txt, rfc1002.txt. In addition the CIFS (formerly SMB) specification is available as a link from the Web page http://samba.org/cifs/.

    AUTHOR

    The original Samba software and related utilities diff --git a/docs/htmldocs/nmblookup.1.html b/docs/htmldocs/nmblookup.1.html index 851544f0d8..46c17ce706 100644 --- a/docs/htmldocs/nmblookup.1.html +++ b/docs/htmldocs/nmblookup.1.html @@ -1,16 +1,16 @@ -nmblookup

    Name

    nmblookup — NetBIOS over TCP/IP client used to lookup NetBIOS - names

    Synopsis

    nmblookup [-M] [-R] [-S] [-r] [-A] [-h] [-B <broadcast address>] [-U <unicast address>] [-d <debug level>] [-s <smb config file>] [-i <NetBIOS scope>] [-T] [-f] {name}

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    nmblookup is used to query NetBIOS names +nmblookup

    Name

    nmblookup — NetBIOS over TCP/IP client used to lookup NetBIOS + names

    Synopsis

    nmblookup [-M] [-R] [-S] [-r] [-A] [-h] [-B <broadcast address>] [-U <unicast address>] [-d <debug level>] [-s <smb config file>] [-i <NetBIOS scope>] [-T] [-f] {name}

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    nmblookup is used to query NetBIOS names and map them to IP addresses in a network using NetBIOS over TCP/IP queries. The options allow the name queries to be directed at a particular IP broadcast area or to a particular machine. All queries are done over UDP.

    OPTIONS

    -M

    Searches for a master browser by looking - up the NetBIOS name name with a - type of 0x1d. If + up the NetBIOS name name with a + type of 0x1d. If name is "-" then it does a lookup on the special name - __MSBROWSE__. Please note that in order to + __MSBROWSE__. Please note that in order to use the name "-", you need to make sure "-" isn't parsed as an argument, e.g. use : - nmblookup -M -- -.

    -R

    Set the recursion desired bit in the packet + nmblookup -M -- -.

    -R

    Set the recursion desired bit in the packet to do a recursive lookup. This is used when sending a name query to a machine running a WINS server and the user wishes to query the names in the WINS server. If this bit is unset @@ -24,15 +24,15 @@ where it ignores the source port of the requesting packet and only replies to UDP port 137. Unfortunately, on most UNIX systems root privilege is needed to bind to this port, and - in addition, if the nmbd(8) daemon is running on this machine it also binds to this port. -

    -A

    Interpret name as + in addition, if the nmbd(8) daemon is running on this machine it also binds to this port. +

    -A

    Interpret name as an IP Address and do a node status query on this address.

    -n <primary NetBIOS name>

    This option allows you to override the NetBIOS name that Samba uses for itself. This is identical -to setting the NetBIOS -name parameter in the smb.conf(5) file. However, a command +to setting the NetBIOS +name parameter in the smb.conf(5) file. However, a command line setting will take precedence over settings in -smb.conf(5).

    -i <scope>

    This specifies a NetBIOS scope that -nmblookup will use to communicate with when +smb.conf(5).

    -i <scope>

    This specifies a NetBIOS scope that +nmblookup will use to communicate with when generating NetBIOS names. For details on the use of NetBIOS scopes, see rfc1001.txt and rfc1002.txt. NetBIOS scopes are very rarely used, only set this parameter @@ -43,26 +43,26 @@ smb.conf. If the domain specified is the same as the servers NetBIOS name, it causes the client to log on using the servers local SAM (as opposed to the Domain SAM).

    -O socket options

    TCP socket options to set on the client socket. See the socket options parameter in -the smb.conf(5) manual page for the list of valid +the smb.conf(5) manual page for the list of valid options.

    -h|--help

    Print a summary of command line options.

    -B <broadcast address>

    Send the query to the given broadcast address. Without this option the default behavior of nmblookup is to send the query to the broadcast address of the network interfaces as - either auto-detected or defined in the interfaces - parameter of the smb.conf(5) file. + either auto-detected or defined in the interfaces + parameter of the smb.conf(5) file.

    -U <unicast address>

    Do a unicast query to the specified address or - host unicast address. This option - (along with the -R option) is needed to + host unicast address. This option + (along with the -R option) is needed to query a WINS server.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -76,8 +76,8 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -T

    This causes any IP addresses found in the lookup to be looked up via a reverse DNS lookup into a @@ -90,12 +90,12 @@ never removed by the client. If a NetBIOS name then the different name types may be specified by appending '#<type>' to the name. This name may also be '*', which will return all registered names within a broadcast - area.

    EXAMPLES

    nmblookup can be used to query - a WINS server (in the same way nslookup is - used to query DNS servers). To query a WINS server, nmblookup - must be called like this:

    nmblookup -U server -R 'name'

    For example, running :

    nmblookup -U samba.org -R 'IRIX#1B'

    would query the WINS server samba.org for the domain + area.

    EXAMPLES

    nmblookup can be used to query + a WINS server (in the same way nslookup is + used to query DNS servers). To query a WINS server, nmblookup + must be called like this:

    nmblookup -U server -R 'name'

    For example, running :

    nmblookup -U samba.org -R 'IRIX#1B'

    would query the WINS server samba.org for the domain master browser (1B name type) for the IRIX workgroup.

    VERSION

    This man page is correct for version 3.0 of - the Samba suite.

    SEE ALSO

    nmbd(8), samba(7), and smb.conf(5).

    AUTHOR

    The original Samba software and related utilities + the Samba suite.

    SEE ALSO

    nmbd(8), samba(7), and smb.conf(5).

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. diff --git a/docs/htmldocs/ntlm_auth.1.html b/docs/htmldocs/ntlm_auth.1.html index 956f30641d..d2ee979d4d 100644 --- a/docs/htmldocs/ntlm_auth.1.html +++ b/docs/htmldocs/ntlm_auth.1.html @@ -1,4 +1,4 @@ -ntlm_auth

    Name

    ntlm_auth — tool to allow external access to Winbind's NTLM authentication function

    Synopsis

    ntlm_auth [-d debuglevel] [-l logfile] [-s <smb config file>]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    ntlm_auth is a helper utility that authenticates +ntlm_auth

    Name

    ntlm_auth — tool to allow external access to Winbind's NTLM authentication function

    Synopsis

    ntlm_auth [-d debuglevel] [-l logfile] [-s <smb config file>]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    ntlm_auth is a helper utility that authenticates users using NT/LM authentication. It returns 0 if the users is authenticated successfully and 1 if access was denied. ntlm_auth uses winbind to access the user and authentication data for a domain. This utility @@ -12,15 +12,15 @@

    --workstation=WORKSTATION

    Specify the workstation the user authenticated from

    --challenge=STRING

    challenge (HEX encoded)

    --lm-response=RESPONSE

    LM Response to the challenge (HEX encoded)

    --nt-response=RESPONSE

    NT or NTLMv2 Response to the challenge (HEX encoded)

    --password=PASSWORD

    User's plaintext password

    --request-lm-key

    Retreive LM session key

    --request-nt-key

    Request NT key

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -34,8 +34,8 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -h|--help

    Print a summary of command line options.

    VERSION

    This man page is correct for version 3.0 of the Samba diff --git a/docs/htmldocs/optional.html b/docs/htmldocs/optional.html index 33f7a02b7c..1c300521bc 100644 --- a/docs/htmldocs/optional.html +++ b/docs/htmldocs/optional.html @@ -1,7 +1,26 @@ - -Part III. Advanced Configuration

    Part III. Advanced Configuration
    Prev   Next

    Advanced Configuration

    Valuable Nuts and Bolts Information

    +Part III. Advanced Configuration

    Part III. Advanced Configuration
    Prev   Next

    Advanced Configuration

    Valuable Nuts and Bolts Information

    Samba has several features that you might want or might not want to use. The chapters in this part each cover specific Samba features. -

    Table of Contents

    9. Samba / MS Windows Network Browsing Guide
    What is Browsing?
    Discussion
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing samba to be the master
    Making samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in samba
    Problem resolution
    Browsing across subnets
    10. User information database
    Introduction
    Important Notes About Security
    Advantages of SMB Encryption
    Advantages of non-encrypted passwords
    The smbpasswd Command
    Plain text
    TDB
    LDAP
    Introduction
    Encrypted Password Database
    Supported LDAP Servers
    Schema and Relationship to the RFC 2307 posixAccount
    Configuring Samba with LDAP
    Accounts and Groups management
    Security and sambaAccount
    LDAP specials attributes for sambaAccounts
    Example LDIF Entries for a sambaAccount
    MySQL
    Creating the database
    Configuring
    Using plaintext passwords or encrypted password
    Getting non-column data from the table
    XML
    11. UNIX Permission Bits and Windows NT Access Control Lists
    Viewing and changing UNIX permissions using the NT - security dialogs
    How to view file security on a Samba share
    Viewing file ownership
    Viewing file or directory permissions
    File Permissions
    Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute - mapping
    12. Configuring Group Mapping
    13. Printing Support
    Introduction
    Configuration
    Creating [print$]
    Setting Drivers for Existing Printers
    Support a large number of printers
    Adding New Printers via the Windows NT APW
    Samba and Printer Ports
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints server
    The Installation Client
    Diagnosis
    Introduction
    Debugging printer problems
    What printers do I have?
    Setting up printcap and print servers
    Job sent, no output
    Job sent, strange output
    Raw PostScript printed
    Advanced Printing
    Real debugging
    14. CUPS Printing Support
    Introduction
    Configuring smb.conf for CUPS
    CUPS - RAW Print Through Mode
    CUPS as a network PostScript RIP
    Windows Terminal Servers (WTS) as CUPS clients
    Setting up CUPS for driver download
    Sources of CUPS drivers / PPDs
    cupsaddsmb
    The CUPS Filter Chains
    CUPS Print Drivers and Devices
    Further printing steps
    Limiting the number of pages users can print
    Advanced Postscript Printing from MS Windows
    Auto-Deletion of CUPS spool files
    15. Unified Logons between Windows NT and UNIX using Winbind
    Abstract
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Limitations
    Conclusion
    16. Advanced Network Manangement
    Configuring Samba Share Access Controls
    Share Permissions Management
    Remote Server Administration
    Network Logon Script Magic
    Adding printers without user intervention
    17. System and Account Policies
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    With Windows NT4/200x
    With a Samba PDC
    System Startup and Logon Processing Overview
    18. Desktop Profile Management
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    19. Interdomain Trust Relationships
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    20. PAM Configuration for Centrally Managed Authentication
    Samba and PAM
    PAM Configuration in smb.conf
    Password Synchronisation using pam_smbpass.so
    Distributed Authentication
    21. Stackable VFS modules
    Introduction and configuration
    Included modules
    audit
    extd_audit
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    22. Hosting a Microsoft Distributed File System tree on Samba
    Instructions
    Notes
    23. Integrating MS Windows networks with Samba
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    24. Securing Samba
    Introduction
    Using host based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    25. Unicode/Charsets
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    26. File and Record Locking
    Discussion
    Samba Opportunistic Locking Control
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Additional Reading
    Prev Up Next
    Chapter 8. Samba as a NT4 or Win2k domain member Home Chapter 9. Samba / MS Windows Network Browsing Guide
    +

    Table of Contents

    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    11. Account Information Databases
    Features and Benefits
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and Unix
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon - Users not in Samba SAM
    Users are being added to the wrong backend database
    auth methods does not work
    12. Mapping MS Windows and Unix Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with Unix File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and Unix Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask + parameters
    Interaction with the standard Samba file attribute + mapping
    Common Errors
    Users can not write to a public share
    I have set force user and Samba still makes root the owner of all the files + I touch!
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    Common Errors
    Tell me about Trust Relationships using Samba
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    Parameters for Backwards Compatibility
    Parameters no longer in use
    A simple Configuration to Print with Samba-3
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print with Samba-3
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various Unix Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba-3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with +rpcclient
    "The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure)
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a +different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba-3
    Publishing Printer Information in Active Directory or LDAP
    Common Errors and Problems
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for +CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for +application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download
    GDI on Windows -- PostScript on Unix
    Windows Drivers, GDI and EMF
    Unix Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and +native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many +Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel +Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for +cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Caveats to be considered
    What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver?
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsm completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the +Client
    Installing PostScript Driver Files manually (using +rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Commandline Driver Installation in 15 little Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    When not to use Samba to print to +CUPS
    In Case of Trouble.....
    Where to find Documentation
    How to ask for Help
    Where to find Help
    Appendix
    Printing from CUPS to Windows attached +Printers
    More CUPS filtering Chains
    Trouble Shooting Guidelines to fix typical Samba printing +Problems
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    Common Errors
    21. Integrated Logon Support using Winbind
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    How does one set up roaming profiles for just one (or a few) user/s or group/s?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    My Boomerang Won't Come Back
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    Prev Up Next
    Chapter 9. MS Windows Network Configuration Guide Home Chapter 10. Samba / MS Windows Network Browsing Guide
    diff --git a/docs/htmldocs/pam.html b/docs/htmldocs/pam.html index f8624e94c5..a0221b57e0 100644 --- a/docs/htmldocs/pam.html +++ b/docs/htmldocs/pam.html @@ -1,136 +1,371 @@ - -Chapter 20. PAM Configuration for Centrally Managed Authentication
    Chapter 20. PAM Configuration for Centrally Managed Authentication
    Prev Part III. Advanced Configuration Next

    Chapter 20. PAM Configuration for Centrally Managed Authentication

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    (Jun 21 2001)

    Table of Contents

    Samba and PAM
    PAM Configuration in smb.conf
    Password Synchronisation using pam_smbpass.so
    Distributed Authentication

    Samba and PAM

    -A number of Unix systems (eg: Sun Solaris), as well as the -xxxxBSD family and Linux, now utilize the Pluggable Authentication -Modules (PAM) facility to provide all authentication, -authorization and resource control services. Prior to the -introduction of PAM, a decision to use an alternative to -the system password database (/etc/passwd) -would require the provision of alternatives for all programs that provide -security services. Such a choice would involve provision of -alternatives to such programs as: login, -passwd, chown, etc. +Chapter 25. PAM based Distributed Authentication

    Chapter 25. PAM based Distributed Authentication
    Prev Part III. Advanced Configuration Next

    Chapter 25. PAM based Distributed Authentication

    John H. Terpstra

    Samba Team

    Stephen Langasek

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem

    +This chapter you should help you to deploy winbind based authentication on any PAM enabled +Unix/Linux system. Winbind can be used to enable user level application access authentication +from any MS Windows NT Domain, MS Windows 200x Active Directory based domain, or any Samba +based domain environment. It will also help you to configure PAM based local host access +controls that are appropriate to your Samba configuration.

    -PAM provides a mechanism that disconnects these security programs -from the underlying authentication/authorization infrastructure. -PAM is configured either through one file /etc/pam.conf (Solaris), -or by editing individual files that are located in /etc/pam.d. +In addition to knowing how to configure winbind into PAM, you will learn generic PAM management +possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage.

    Note

    - If the PAM authentication module (loadable link library file) is located in the - default location then it is not necessary to specify the path. In the case of - Linux, the default location is /lib/security. If the module - is located outside the default then the path must be specified as: - - 

    -	auth       required      /other_path/pam_strange_module.so
-

    -

    -The following is an example /etc/pam.d/login configuration file. +The use of Winbind require more than PAM configuration alone. Please refer to the Winbind chapter. +

    Features and Benefits

    +A number of Unix systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, +now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication, +authorization and resource control services. Prior to the introduction of PAM, a decision +to use an alternative to the system password database (/etc/passwd) +would require the provision of alternatives for all programs that provide security services. +Such a choice would involve provision of alternatives to such programs as: login, +passwd, chown, etc. +

    +PAM provides a mechanism that disconnects these security programs from the underlying +authentication/authorization infrastructure. PAM is configured either through one file +/etc/pam.conf (Solaris), or by editing individual files that are +located in /etc/pam.d. +

    +On PAM enabled Unix/Linux systems it is an easy matter to configure the system to use any +authentication backend, so long as the appropriate dynamically loadable library modules +are available for it. The backend may be local to the system, or may be centralised on a +remote server. +

    +PAM support modules are available for: +

    /etc/passwd

    -

    + There are several PAM modules that interact with this standard Unix user + database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so + and pam_userdb.so. +

    Kerberos

    -

    + The pam_krb5.so module allows the use of any Kerberos compliant server. + This tool is used to access MIT Kerberos, Heimdal Kerberos, and potentially + Microsoft Active Directory (if enabled). +

    LDAP

    -

    + The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend + server. Commonly used LDAP backend servers include: OpenLDAP v2.0 and v2.1, + Sun ONE iDentity server, Novell eDirectory server, Microsoft Active Directory. +

    NetWare Bindery

    -

    + The pam_ncp_auth.so module allows authentication off any bindery enabled + NetWare Core Protocol based server. +

    SMB Password

    -

    + This module, called pam_smbpass.so, will allow user authentication off + the passdb backend that is configured in the Samba smb.conf file. +

    SMB Server

    -

    + The pam_smb_auth.so module is the original MS Windows networking authentication + tool. This module has been somewhat outdated by the Winbind module. +

    Winbind

    -

    + The pam_winbind.so module allows Samba to obtain authentication from any + MS Windows Domain Controller. It can just as easily be used to authenticate + users for access to any PAM enabled application. +

    RADIUS

    -

    + There is a PAM RADIUS (Remote Access Dial-In User Service) authentication + module. In most cases the administrator will need to locate the source code + for this tool and compile and install it themselves. RADIUS protocols are + used by many routers and terminal servers. +

    +Of the above, Samba provides the pam_smbpasswd.so and the pam_winbind.so modules alone. +

    +Once configured, these permit a remarkable level of flexibility in the location and use +of distributed samba domain controllers that can provide wide are network bandwidth +efficient authentication services for PAM capable systems. In effect, this allows the +deployment of centrally managed and maintained distributed authentication from a single +user account database. +

    Technical Discussion

    +PAM is designed to provide the system administrator with a great deal of flexibility in +configuration of the privilege granting applications of their system. The local +configuration of system security controlled by PAM is contained in one of two places: +either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory. +

    PAM Configuration Syntax

    +In this section we discuss the correct syntax of and generic options respected by entries to these files. +PAM specific tokens in the configuration file are case insensitive. The module paths, however, are case +sensitive since they indicate a file's name and reflect the case dependence of typical file-systems. +The case-sensitivity of the arguments to any given module is defined for each module in turn. +

    +In addition to the lines described below, there are two special characters provided for the convenience +of the system administrator: comments are preceded by a `#' and extend to the next end-of-line; also, +module specification lines may be extended with a `\' escaped newline. +

    +If the PAM authentication module (loadable link library file) is located in the +default location then it is not necessary to specify the path. In the case of +Linux, the default location is /lib/security. If the module +is located outside the default then the path must be specified as: +

    +

    +auth  required  /other_path/pam_strange_module.so
+

    +

    Anatomy of /etc/pam.d Entries

    +The remaining information in this subsection was taken from the documentation of the Linux-PAM +project. For more information on PAM, see + +http://ftp.kernel.org/pub/linux/libs/pam The Official Linux-PAM home page. +

    +A general configuration line of the /etc/pam.conf file has the following form: +

    +

    +service-name   module-type   control-flag   module-path   args
+

    +

    +Below, we explain the meaning of each of these tokens. The second (and more recently adopted) +way of configuring Linux-PAM is via the contents of the /etc/pam.d/ directory. +Once we have explained the meaning of the above tokens, we will describe this method. +

    service-name

    -

    + The name of the service associated with this entry. Frequently the service name is the conventional + name of the given application. For example, `ftpd', `rlogind' and `su', etc. . +

    + There is a special service-name, reserved for defining a default authentication mechanism. It has + the name `OTHER' and may be specified in either lower or upper case characters. Note, when there + is a module specified for a named service, the `OTHER' entries are ignored. +

    module-type

    -

    + One of (currently) four types of module. The four types are as follows: +

    • + auth: this module type provides two aspects of authenticating the user. + Firstly, it establishes that the user is who they claim to be, by instructing the application + to prompt the user for a password or other means of identification. Secondly, the module can + grant group membership (independently of the /etc/groups file discussed + above) or other privileges through its credential granting properties. +

    • + account: this module performs non-authentication based account management. + It is typically used to restrict/permit access to a service based on the time of day, currently + available system resources (maximum number of users) or perhaps the location of the applicant + user `root' login only on the console. +

    • + session: primarily, this module is associated with doing things that need + to be done for the user before/after they can be given service. Such things include the logging + of information concerning the opening/closing of some data exchange with a user, mounting + directories, etc. +

    • + password: this last module type is required for updating the authentication + token associated with the user. Typically, there is one module for each `challenge/response' + based authentication (auth) module-type. +

    control-flag

    -

    + The control-flag is used to indicate how the PAM library will react to the success or failure of the + module it is associated with. Since modules can be stacked (modules of the same type execute in series, + one after another), the control-flags determine the relative importance of each module. The application + is not made aware of the individual success or failure of modules listed in the + /etc/pam.conf file. Instead, it receives a summary success or fail response from + the Linux-PAM library. The order of execution of these modules is that of the entries in the + /etc/pam.conf file; earlier entries are executed before later ones. + As of Linux-PAM v0.60, this control-flag can be defined with one of two syntaxes. +

    + The simpler (and historical) syntax for the control-flag is a single keyword defined to indicate the + severity of concern associated with the success or failure of a specific module. There are four such + keywords: required, requisite, sufficient and optional. +

    + The Linux-PAM library interprets these keywords in the following manner: +

    • + required: this indicates that the success of the module is required for the + module-type facility to succeed. Failure of this module will not be apparent to the user until all + of the remaining modules (of the same module-type) have been executed. +

    • + requisite: like required, however, in the case that such a module returns a + failure, control is directly returned to the application. The return value is that associated with + the first required or requisite module to fail. Note, this flag can be used to protect against the + possibility of a user getting the opportunity to enter a password over an unsafe medium. It is + conceivable that such behavior might inform an attacker of valid accounts on a system. This + possibility should be weighed against the not insignificant concerns of exposing a sensitive + password in a hostile environment. +

    • + sufficient: the success of this module is deemed `sufficient' to satisfy + the Linux-PAM library that this module-type has succeeded in its purpose. In the event that no + previous required module has failed, no more `stacked' modules of this type are invoked. (Note, + in this case subsequent required modules are not invoked.). A failure of this module is not deemed + as fatal to satisfying the application that this module-type has succeeded. +

    • + optional: as its name suggests, this control-flag marks the module as not + being critical to the success or failure of the user's application for service. In general, + Linux-PAM ignores such a module when determining if the module stack will succeed or fail. + However, in the absence of any definite successes or failures of previous or subsequent stacked + modules this module will determine the nature of the response to the application. One example of + this latter case, is when the other modules return something like PAM_IGNORE. +

    + The more elaborate (newer) syntax is much more specific and gives the administrator a great deal of control + over how the user is authenticated. This form of the control flag is delimited with square brackets and + consists of a series of value=action tokens: + 

    +		[value1=action1 value2=action2 ...]
+

    + Here, value1 is one of the following return values: success; open_err; symbol_err; service_err; + system_err; buf_err; perm_denied; auth_err; cred_insufficient; authinfo_unavail; user_unknown; maxtries; + new_authtok_reqd; acct_expired; session_err; cred_unavail; cred_expired; cred_err; no_module_data; conv_err; + authtok_err; authtok_recover_err; authtok_lock_busy; authtok_disable_aging; try_again; ignore; abort; + authtok_expired; module_unknown; bad_item; and default. The last of these (default) can be used to set + the action for those return values that are not explicitly defined. +

    + The action1 can be a positive integer or one of the following tokens: ignore; ok; done; bad; die; and reset. + A positive integer, J, when specified as the action, can be used to indicate that the next J modules of the + current module-type will be skipped. In this way, the administrator can develop a moderately sophisticated + stack of modules with a number of different paths of execution. Which path is taken can be determined by the + reactions of individual modules. +

    • + ignore: when used with a stack of modules, the module's return status will not + contribute to the return code the application obtains. +

    • + bad: this action indicates that the return code should be thought of as indicative + of the module failing. If this module is the first in the stack to fail, its status value will be used + for that of the whole stack. +

    • + die: equivalent to bad with the side effect of terminating the module stack and + PAM immediately returning to the application. +

    • + ok: this tells PAM that the administrator thinks this return code should + contribute directly to the return code of the full stack of modules. In other words, if the former + state of the stack would lead to a return of PAM_SUCCESS, the module's return code will override + this value. Note, if the former state of the stack holds some value that is indicative of a modules + failure, this 'ok' value will not be used to override that value. +

    • + done: equivalent to ok with the side effect of terminating the module stack and + PAM immediately returning to the application. +

    • + reset: clear all memory of the state of the module stack and start again with + the next stacked module. +

    + Each of the four keywords: required; requisite; sufficient; and optional, have an equivalent expression in + terms of the [...] syntax. They are as follows: +

    +

    • + required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad] +

    • + requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die] +

    • + sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore] +

    • + optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore] +

    +

    + Just to get a feel for the power of this new syntax, here is a taste of what you can do with it. With Linux-PAM-0.63, + the notion of client plug-in agents was introduced. This is something that makes it possible for PAM to support + machine-machine authentication using the transport protocol inherent to the client/server application. With the + [ ... value=action ... ] control syntax, it is possible for an application to be configured + to support binary prompts with compliant clients, but to gracefully fall over into an alternative authentication + mode for older, legacy, applications. +

    module-path

    -

    + The path-name of the dynamically loadable object file; the pluggable module itself. If the first character of the + module path is `/', it is assumed to be a complete path. If this is not the case, the given module path is appended + to the default module path: /lib/security (but see the notes above). +

    + The args are a list of tokens that are passed to the module when it is invoked. Much like arguments to a typical + Linux shell command. Generally, valid arguments are optional and are specific to any given module. Invalid arguments + are ignored by a module, however, when encountering an invalid argument, the module is required to write an error + to syslog(3). For a list of generic options see the next section. +

    + Note, if you wish to include spaces in an argument, you should surround that argument with square brackets. For example: + 

    +squid auth required pam_mysql.so user=passwd_query passwd=mada \
+        db=eminence [query=select user_name from internet_service where \
+                     user_name='%u' and password=PASSWORD('%p') and \
+                     service='web_proxy']
+

    + Note, when using this convention, you can include `[' characters inside the string, and if you wish to include a `]' + character inside the string that will survive the argument parsing, you should use `\['. In other words: + 

    +[..[..\]..]    -->   ..[..]..
+

    + Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the + side of caution) to make the authentication process fail. A corresponding error is written to the system log files + with a call to syslog(3). +

    Example System Configurations

    +The following is an example /etc/pam.d/login configuration file. This example had all options been uncommented is probably not usable as it stacks many conditions before allowing successful completion of the login process. Essentially all conditions can be disabled -by commenting them out except the calls to pam_pwdb.so. -

    -	#%PAM-1.0
-	# The PAM configuration file for the `login' service
-	#
-	auth 		required	pam_securetty.so
-	auth 		required	pam_nologin.so
-	# auth 		required	pam_dialup.so
-	# auth 		optional	pam_mail.so
-	auth		required	pam_pwdb.so shadow md5
-	# account    	requisite  	pam_time.so
-	account		required	pam_pwdb.so
-	session		required	pam_pwdb.so
-	# session 	optional	pam_lastlog.so
-	# password   	required   	pam_cracklib.so retry=3
-	password	required	pam_pwdb.so shadow md5
-

    -PAM allows use of replacable modules. Those available on a -sample system include: -

    $/bin/ls /lib/security -

    -	pam_access.so    pam_ftp.so          pam_limits.so     
-	pam_ncp_auth.so  pam_rhosts_auth.so  pam_stress.so     
-	pam_cracklib.so  pam_group.so        pam_listfile.so   
-	pam_nologin.so   pam_rootok.so       pam_tally.so      
-	pam_deny.so      pam_issue.so        pam_mail.so       
-	pam_permit.so    pam_securetty.so    pam_time.so       
-	pam_dialup.so    pam_lastlog.so      pam_mkhomedir.so  
-	pam_pwdb.so      pam_shells.so       pam_unix.so       
-	pam_env.so       pam_ldap.so         pam_motd.so       
-	pam_radius.so    pam_smbpass.so      pam_unix_acct.so  
-	pam_wheel.so     pam_unix_auth.so    pam_unix_passwd.so
-	pam_userdb.so    pam_warn.so         pam_unix_session.so
+by commenting them out except the calls to pam_pwdb.so.
+
    PAM: original login config
    +#%PAM-1.0
+# The PAM configuration file for the `login' service
+#
+auth         required    pam_securetty.so
+auth         required    pam_nologin.so
+# auth       required    pam_dialup.so
+# auth       optional    pam_mail.so
+auth         required    pam_pwdb.so shadow md5
+# account    requisite   pam_time.so
+account      required    pam_pwdb.so
+session      required    pam_pwdb.so
+# session    optional    pam_lastlog.so
+# password   required    pam_cracklib.so retry=3
+password     required    pam_pwdb.so shadow md5
+
    PAM: login using pam_smbpass
    
+PAM allows use of replaceable modules. Those available on a sample system include:
+
    $/bin/ls /lib/security
+
    +pam_access.so    pam_ftp.so          pam_limits.so     
+pam_ncp_auth.so  pam_rhosts_auth.so  pam_stress.so     
+pam_cracklib.so  pam_group.so        pam_listfile.so   
+pam_nologin.so   pam_rootok.so       pam_tally.so      
+pam_deny.so      pam_issue.so        pam_mail.so       
+pam_permit.so    pam_securetty.so    pam_time.so       
+pam_dialup.so    pam_lastlog.so      pam_mkhomedir.so  
+pam_pwdb.so      pam_shells.so       pam_unix.so       
+pam_env.so       pam_ldap.so         pam_motd.so       
+pam_radius.so    pam_smbpass.so      pam_unix_acct.so  
+pam_wheel.so     pam_unix_auth.so    pam_unix_passwd.so
+pam_userdb.so    pam_warn.so         pam_unix_session.so
 
    
 The following example for the login program replaces the use of 
-the pam_pwdb.so module which uses the system 
-password database (/etc/passwd,
-/etc/shadow, /etc/group) with 
-the module pam_smbpass.so which uses the Samba 
+the pam_pwdb.so module which uses the system 
+password database (/etc/passwd,
+/etc/shadow, /etc/group) with 
+the module pam_smbpass.so which uses the Samba 
 database which contains the Microsoft MD4 encrypted password 
 hashes. This database is stored in either 
-/usr/local/samba/private/smbpasswd, 
-/etc/samba/smbpasswd, or in 
-/etc/samba.d/smbpasswd, depending on the 
+/usr/local/samba/private/smbpasswd, 
+/etc/samba/smbpasswd, or in 
+/etc/samba.d/smbpasswd, depending on the 
 Samba implementation for your Unix/Linux system. The 
-pam_smbpass.so module is provided by 
+pam_smbpass.so module is provided by 
 Samba version 2.2.1 or later. It can be compiled by specifying the 
---with-pam_smbpass options when running Samba's
-configure script.  For more information
-on the pam_smbpass module, see the documentation
-in the source/pam_smbpass directory of the Samba 
+--with-pam_smbpass options when running Samba's
+configure script.  For more information
+on the pam_smbpass module, see the documentation
+in the source/pam_smbpass directory of the Samba 
 source distribution.
-
    -	#%PAM-1.0
-	# The PAM configuration file for the `login' service
-	#
-	auth		required	pam_smbpass.so nodelay
-	account		required	pam_smbpass.so nodelay
-	session		required	pam_smbpass.so nodelay
-	password	required	pam_smbpass.so nodelay
+
    +#%PAM-1.0
+# The PAM configuration file for the `login' service
+#
+auth        required    pam_smbpass.so nodelay
+account     required    pam_smbpass.so nodelay
+session     required    pam_smbpass.so nodelay
+password    required    pam_smbpass.so nodelay
 
    
 The following is the PAM configuration file for a particular 
-Linux system. The default condition uses pam_pwdb.so.
-
    -	#%PAM-1.0
-	# The PAM configuration file for the `samba' service
-	#
-	auth       required     pam_pwdb.so nullok nodelay shadow audit
-	account    required     pam_pwdb.so audit nodelay
-	session    required     pam_pwdb.so nodelay
-	password   required     pam_pwdb.so shadow md5
+Linux system. The default condition uses pam_pwdb.so.
+
    +#%PAM-1.0
+# The PAM configuration file for the `samba' service
+#
+auth       required     pam_pwdb.so nullok nodelay shadow audit
+account    required     pam_pwdb.so audit nodelay
+session    required     pam_pwdb.so nodelay
+password   required     pam_pwdb.so shadow md5
 
    
 In the following example the decision has been made to use the 
 smbpasswd database even for basic samba authentication. Such a 
 decision could also be made for the passwd program and would 
 thus allow the smbpasswd passwords to be changed using the passwd 
 program.
-
    -	#%PAM-1.0
-	# The PAM configuration file for the `samba' service
-	#
-	auth       required     pam_smbpass.so nodelay
-	account    required     pam_pwdb.so audit nodelay
-	session    required     pam_pwdb.so nodelay
-	password   required     pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf
+
    +#%PAM-1.0
+# The PAM configuration file for the `samba' service
+#
+auth       required     pam_smbpass.so nodelay
+account    required     pam_pwdb.so audit nodelay
+session    required     pam_pwdb.so nodelay
+password   required     pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf
 
    Note
    PAM allows stacking of authentication mechanisms. It is 
 also possible to pass information obtained within one PAM module through 
 to the next module in the PAM stack. Please refer to the documentation for 
 your particular system implementation for details regarding the specific 
-capabilities of PAM in this environment. Some Linux implmentations also 
-provide the pam_stack.so module that allows all 
+capabilities of PAM in this environment. Some Linux implementations also 
+provide the pam_stack.so module that allows all 
 authentication to be configured in a single central file. The 
-pam_stack.so method has some very devoted followers 
+pam_stack.so method has some very devoted followers 
 on the basis that it allows for easier administration. As with all issues in 
 life though, every decision makes trade-offs, so you may want examine the 
 PAM documentation for further helpful information.
-
    PAM Configuration in smb.conf
    
+

    smb.conf PAM Configuration

    There is an option in smb.conf called obey pam restrictions. The following is from the on-line help for this option in SWAT;

    -When Samba is configured to enable PAM support (i.e. ---with-pam), this parameter will +When Samba-3 is configured to enable PAM support (i.e. +--with-pam), this parameter will control whether or not Samba should obey PAM's account and session management directives. The default behavior is to use PAM for clear text authentication only and to @@ -140,141 +375,148 @@ ignores PAM for authentication in the case of The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. -

    Default: obey pam restrictions = no

    Password Synchronisation using pam_smbpass.so

    +

    Default: obey pam restrictions = no

    Remote CIFS Authentication using winbindd.so

    +All operating systems depend on the provision of users credentials acceptable to the platform. +Unix requires the provision of a user identifier (UID) as well as a group identifier (GID). +These are both simple integer type numbers that are obtained from a password backend such +as /etc/passwd. +

    +Users and groups on a Windows NT server are assigned a relative id (rid) which is unique for +the domain when the user or group is created. To convert the Windows NT user or group into +a unix user or group, a mapping between rids and unix user and group ids is required. This +is one of the jobs that winbind performs. +

    +As winbind users and groups are resolved from a server, user and group ids are allocated +from a specified range. This is done on a first come, first served basis, although all +existing users and groups will be mapped as soon as a client performs a user or group +enumeration command. The allocated unix ids are stored in a database file under the Samba +lock directory and will be remembered. +

    +The astute administrator will realize from this that the combination of pam_smbpass.so, +winbindd, and a distributed passdb backend, such as ldap, will allow the establishment of a +centrally managed, distributed user/password database that can also be used by all PAM (eg: Linux) aware +programs and applications. This arrangement can have particularly potent advantages compared with the use of +Microsoft Active Directory Service (ADS) in so far as reduction of wide area network authentication traffic. +

    Warning

    +The rid to unix id database is the only location where the user and group mappings are +stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd +to determine which user and group ids correspond to Windows NT user and group rids. +

    Password Synchronization using pam_smbpass.so

    pam_smbpass is a PAM module which can be used on conforming systems to keep the smbpasswd (Samba password) database in sync with the unix password file. PAM (Pluggable Authentication Modules) is an API supported under some Unices, such as Solaris, HPUX and Linux, that provides a generic interface to authentication mechanisms.

    -For more information on PAM, see http://ftp.kernel.org/pub/linux/libs/pam/ -

    This module authenticates a local smbpasswd user database. If you require support for authenticating against a remote SMB server, or if you're concerned about the presence of suid root binaries on your system, it is recommended that you use pam_winbind instead. -

    +
    
 Options recognized by this module are as follows:
-
-        debug           -       log more debugging info
-        audit           -       like debug, but also logs unknown usernames
-        use_first_pass  -       don't prompt the user for passwords;
-                                take them from PAM_ items instead
-        try_first_pass  -       try to get the password from a previous
-                                PAM module, fall back to prompting the user
-        use_authtok     -       like try_first_pass, but *fail* if the new
-                                PAM_AUTHTOK has not been previously set.
-                                (intended for stacking password modules only)
-        not_set_pass    -       don't make passwords used by this module
-                                available to other modules.
-        nodelay         -       don't insert ~1 second delays on authentication
-                                failure.
-        nullok          -       null passwords are allowed.
-        nonull          -       null passwords are not allowed. Used to
-                                override the Samba configuration.
-        migrate         -       only meaningful in an "auth" context;
-                                used to update smbpasswd file with a
-                                password used for successful authentication.
-        smbconf=< file >  -     specify an alternate path to the smb.conf
-                                file.
-
    +
    Table 25.1. Options recognized by pam_smbpass
    debuglog more debugging info
    auditlike debug, but also logs unknown usernames
    use_first_passdon't prompt the user for passwords; take them from PAM_ items instead
    try_first_passtry to get the password from a previous PAM module, fall back to prompting the user
    use_authtoklike try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only)
    not_set_passdon't make passwords used by this module available to other modules.
    nodelaydon't insert ~1 second delays on authentication failure.
    nulloknull passwords are allowed.
    nonullnull passwords are not allowed. Used to override the Samba configuration.
    migrateonly meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication.
    smbconf=filespecify an alternate path to the smb.conf file.
    
+
    
 Thanks go to the following people:
-
-	* Andrew Morgan < morgan@transmeta.com >, for providing the Linux-PAM
-	framework, without which none of this would have happened
-
-	* Christian Gafton < gafton@redhat.com > and Andrew Morgan again, for the
-	pam_pwdb module upon which pam_smbpass was originally based
-
-	* Luke Leighton < lkcl@switchboard.net > for being receptive to the idea,
+
    Andrew Morgan, for providing the Linux-PAM
+	framework, without which none of this would have happened
    Christian Gafton and Andrew Morgan again, for the
+	pam_pwdb module upon which pam_smbpass was originally based
    Luke Leighton for being receptive to the idea,
 	and for the occasional good-natured complaint about the project's status
-	that keep me working on it :)
-
-	* and of course, all the other members of the Samba team
-	<http://www.samba.org/samba/team.html>, for creating a great product
-	and for giving this project a purpose
-
-	---------------------
-	Stephen Langasek < vorlon@netexpress.net >
-
    
+	that keep me working on it :)
    .
+
    
 The following are examples of the use of pam_smbpass.so in the format of Linux
-/etc/pam.d/ files structure. Those wishing to implement this
+/etc/pam.d/ files structure. Those wishing to implement this
 tool on other platforms will need to adapt this appropriately.
-
    Password Synchonisation Configuration
    
+
    Password Synchronisation Configuration
    
 A sample PAM configuration that shows the use of pam_smbpass to make
 sure private/smbpasswd is kept in sync when /etc/passwd (/etc/shadow)
 is changed.  Useful when an expired password might be changed by an
 application (such as ssh).
-
    -	#%PAM-1.0
-	# password-sync
-	#
-	auth       requisite        pam_nologin.so
-	auth       required         pam_unix.so
-	account    required         pam_unix.so
-	password   requisite        pam_cracklib.so retry=3
-	password   requisite        pam_unix.so shadow md5 use_authtok try_first_pass
-	password   required         pam_smbpass.so nullok use_authtok try_first_pass
-	session    required         pam_unix.so
-
    Password Migration Configuration
    
+
    +#%PAM-1.0
+# password-sync
+#
+auth       requisite    pam_nologin.so
+auth       required     pam_unix.so
+account    required     pam_unix.so
+password   requisite    pam_cracklib.so retry=3
+password   requisite    pam_unix.so shadow md5 use_authtok try_first_pass
+password   required     pam_smbpass.so nullok use_authtok try_first_pass
+session    required     pam_unix.so
+
    Password Migration Configuration
    
 A sample PAM configuration that shows the use of pam_smbpass to migrate
 from plaintext to encrypted passwords for Samba.  Unlike other methods,
 this can be used for users who have never connected to Samba shares:
 password migration takes place when users ftp in, login using ssh, pop
 their mail, etc.
-
    -	#%PAM-1.0
-	# password-migration
-	#
-	auth       requisite        pam_nologin.so
-	# pam_smbpass is called IFF pam_unix succeeds.
-	auth       requisite        pam_unix.so
-	auth       optional         pam_smbpass.so migrate
-	account    required         pam_unix.so
-	password   requisite        pam_cracklib.so retry=3
-	password   requisite        pam_unix.so shadow md5 use_authtok try_first_pass
-	password   optional         pam_smbpass.so nullok use_authtok try_first_pass
-	session    required         pam_unix.so
-
    Mature Password Configuration
    
+
    +#%PAM-1.0
+# password-migration
+#
+auth       requisite   pam_nologin.so
+# pam_smbpass is called IF pam_unix succeeds.
+auth       requisite   pam_unix.so
+auth       optional    pam_smbpass.so migrate
+account    required    pam_unix.so
+password   requisite   pam_cracklib.so retry=3
+password   requisite   pam_unix.so shadow md5 use_authtok try_first_pass
+password   optional    pam_smbpass.so nullok use_authtok try_first_pass
+session    required    pam_unix.so
+
    Mature Password Configuration
    
 A sample PAM configuration for a 'mature' smbpasswd installation.
 private/smbpasswd is fully populated, and we consider it an error if
 the smbpasswd doesn't exist or doesn't match the Unix password.
-
    -	#%PAM-1.0
-	# password-mature
-	#
-	auth       requisite        pam_nologin.so
-	auth       required         pam_unix.so
-	account    required         pam_unix.so
-	password   requisite        pam_cracklib.so retry=3
-	password   requisite        pam_unix.so shadow md5 use_authtok try_first_pass
-	password   required         pam_smbpass.so use_authtok use_first_pass
-	session    required         pam_unix.so
-
    Kerberos Password Integration Configuration
    
+
    +#%PAM-1.0
+# password-mature
+#
+auth       requisite    pam_nologin.so
+auth       required     pam_unix.so
+account    required     pam_unix.so
+password   requisite    pam_cracklib.so retry=3
+password   requisite    pam_unix.so shadow md5 use_authtok try_first_pass
+password   required     pam_smbpass.so use_authtok use_first_pass
+session    required     pam_unix.so
+
    Kerberos Password Integration Configuration
    
 A sample PAM configuration that shows pam_smbpass used together with
 pam_krb5.  This could be useful on a Samba PDC that is also a member of
 a Kerberos realm.
-
    -	#%PAM-1.0
-	# kdc-pdc
-	#
-	auth       requisite        pam_nologin.so
-	auth       requisite        pam_krb5.so
-	auth       optional         pam_smbpass.so migrate
-	account    required         pam_krb5.so
-	password   requisite        pam_cracklib.so retry=3
-	password   optional         pam_smbpass.so nullok use_authtok try_first_pass
-	password   required         pam_krb5.so use_authtok try_first_pass
-	session    required         pam_krb5.so
-

    Distributed Authentication

    -The astute administrator will realize from this that the -combination of pam_smbpass.so, -winbindd, and a distributed -passdb backend, such as ldap, will allow the establishment of a -centrally managed, distributed -user/password database that can also be used by all -PAM (eg: Linux) aware programs and applications. This arrangement -can have particularly potent advantages compared with the -use of Microsoft Active Directory Service (ADS) in so far as -reduction of wide area network authentication traffic. -

    Prev Up Next
    Chapter 19. Interdomain Trust Relationships Home Chapter 21. Stackable VFS modules
    +

    +#%PAM-1.0
+# kdc-pdc
+#
+auth       requisite   pam_nologin.so
+auth       requisite   pam_krb5.so
+auth       optional    pam_smbpass.so migrate
+account    required    pam_krb5.so
+password   requisite   pam_cracklib.so retry=3
+password   optional    pam_smbpass.so nullok use_authtok try_first_pass
+password   required    pam_krb5.so use_authtok try_first_pass
+session    required    pam_krb5.so
+

    Common Errors

    +PAM can be a very fickle and sensitive to configuration glitches. Here we look at a few cases from +the Samba mailing list. +

    pam_winbind problem

    + I have the following PAM configuration: +

    +

    +auth required /lib/security/pam_securetty.so
+auth sufficient /lib/security/pam_winbind.so
+auth sufficient /lib/security/pam_unix.so use_first_pass nullok
+auth required /lib/security/pam_stack.so service=system-auth
+auth required /lib/security/pam_nologin.so
+account required /lib/security/pam_stack.so service=system-auth
+account required /lib/security/pam_winbind.so
+password required /lib/security/pam_stack.so service=system-auth
+

    +

    + When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie". + I've tried with user "scienceu+pitie" also. +

    + Answer: The problem may lie with your inclusion of pam_stack.so + service=system-auth. That file often contains a lot of stuff that may + duplicate what you're already doing. Try commenting out the pam_stack lines + for auth and account and see if things work. If they do, look at + /etc/pam.d/system-auth and copy only what you need from it into your + /etc/pam.d/login file. Alternatively, if you want all services to use + winbind, you can put the winbind-specific stuff in /etc/pam.d/system-auth. +

    Prev Up Next
    Chapter 24. Desktop Profile Management Home Chapter 26. Integrating MS Windows networks with Samba
    diff --git a/docs/htmldocs/passdb.html b/docs/htmldocs/passdb.html index 9f313ee123..2c68f50c87 100644 --- a/docs/htmldocs/passdb.html +++ b/docs/htmldocs/passdb.html @@ -1,257 +1,533 @@ - -Chapter 10. User information database
    Chapter 10. User information database
    Prev Part III. Advanced Configuration Next

    Chapter 10. User information database

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    Gerald (Jerry) Carter

    Samba Team

    <jerry@samba.org>

    Jeremy Allison

    Samba Team

    <jra@samba.org>

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    Olivier (lem) Lemaire

    IDEALX

    <olem@IDEALX.org>

    February 2003

    Table of Contents

    Introduction
    Important Notes About Security
    Advantages of SMB Encryption
    Advantages of non-encrypted passwords
    The smbpasswd Command
    Plain text
    TDB
    LDAP
    Introduction
    Encrypted Password Database
    Supported LDAP Servers
    Schema and Relationship to the RFC 2307 posixAccount
    Configuring Samba with LDAP
    Accounts and Groups management
    Security and sambaAccount
    LDAP specials attributes for sambaAccounts
    Example LDIF Entries for a sambaAccount
    MySQL
    Creating the database
    Configuring
    Using plaintext passwords or encrypted password
    Getting non-column data from the table
    XML

    Introduction

    Old windows clients send plain text passwords over the wire. - Samba can check these passwords by crypting them and comparing them - to the hash stored in the unix user database. +Chapter 11. Account Information Databases

    Chapter 11. Account Information Databases
    Prev Part III. Advanced Configuration Next

    Chapter 11. Account Information Databases

    Jelmer R. Vernooij

    The Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Jeremy Allison

    Samba Team

    John H. Terpstra

    Samba Team

    Olivier (lem) Lemaire

    IDEALX

    May 24, 2003

    Table of Contents

    Features and Benefits
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and Unix
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon - Users not in Samba SAM
    Users are being added to the wrong backend database
    auth methods does not work

    +Samba-3 implements a new capability to work concurrently with multiple account backends. +The possible new combinations of password backends allows Samba-3 a degree of flexibility +and scalability that previously could be achieved only with MS Windows Active Directory. +This chapter describes the new functionality and how to get the most out of it. +

    +In the course of development of Samba-3, a number of requests were received to provide the +ability to migrate MS Windows NT4 SAM accounts to Samba-3 without the need to provide +matching Unix/Linux accounts. We called this the Non Unix Accounts (NUA) +capability. The intent was that an administrator could decide to use the tdbsam +backend and by simply specifying "passdb backend = tdbsam_nua, guest" +this would allow Samba-3 to implement a solution that did not use Unix accounts per se. Late +in the development cycle, the team doing this work hit upon some obstacles that prevents this +solution from being used. Given the delays with Samba-3 release a decision was made to NOT +deliver this functionality until a better method of recognising NT Group SIDs from NT User +SIDs could be found. This feature may thus return during the life cycle for the Samba-3 series. +

    Note

    +Samba-3.0.0 does NOT support Non-Unix Account (NUA) operation. +

    Features and Benefits

    +Samba-3 provides for complete backwards compatibility with Samba-2.2.x functionality +as follows: +

    Backwards Compatibility Backends

    Plain Text:

    + This option uses nothing but the Unix/Linux /etc/passwd + style back end. On systems that have PAM (Pluggable Authentication Modules) + support all PAM modules are supported. The behaviour is just as it was with + Samba-2.2.x, and the protocol limitations imposed by MS Windows clients + apply likewise. +

    smbpasswd:

    + This option allows continues use of the smbpasswd + file that maintains a plain ASCII (text) layout that includes the MS Windows + LanMan and NT encrypted passwords as well as a field that stores some + account information. This form of password backend does NOT store any of + the MS Windows NT/200x SAM (Security Account Manager) information needed to + provide the extended controls that are needed for more comprehensive + interoperation with MS Windows NT4 / 200x servers. +

    + This backend should be used only for backwards compatibility with older + versions of Samba. It may be deprecated in future releases. +

    ldapsam_compat (Samba-2.2 LDAP Compatibility):

    + There is a password backend option that allows continued operation with + a existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension. + This option is provided primarily as a migration tool, although there is + no reason to force migration at this time. Note that this tool will eventually + be deprecated. +

    +Samba-3 introduces the following new password backend capabilities: +

    New Backends

    guest:

    + This is always required as the last backend specified. + It provides the ability to handle guest account requirements for access to + resources like IPC$ which is used for browsing. +

    tdbsam:

    + This backend provides a rich database backend for local servers. This + backend is NOT suitable for multiple domain controller (ie: PDC + one + or more BDC) installations. +

    + The tdbsam password backend stores the old + smbpasswd information PLUS the extended MS Windows NT / 200x + SAM information into a binary format TDB (trivial database) file. + The inclusion of the extended information makes it possible for Samba-3 + to implement the same account and system access controls that are possible + with MS Windows NT4 and MS Windows 200x based systems. +

    + The inclusion of the tdbsam capability is a direct + response to user requests to allow simple site operation without the overhead + of the complexities of running OpenLDAP. It is recommended to use this only + for sites that have fewer than 250 users. For larger sites or implementations + the use of OpenLDAP or of Active Directory integration is strongly recommended. +

    ldapsam:

    + This provides a rich directory backend for distributed account installation. +

    + Samba-3 has a new and extended LDAP implementation that requires configuration + of OpenLDAP with a new format samba schema. The new format schema file is + included in the examples/LDAP directory of the Samba distribution. +

    + The new LDAP implementation significantly expands the control abilities that + were possible with prior versions of Samba. It is now possible to specify + "per user" profile settings, home directories, account access controls, and + much more. Corporate sites will see that the Samba-Team has listened to their + requests both for capability and to allow greater scalability. +

    mysqlsam (MySQL based backend):

    + It is expected that the MySQL based SAM will be very popular in some corners. + This database backend will be on considerable interest to sites that want to + leverage existing MySQL technology. +

    xmlsam (XML based datafile):

    + Allows the account and password data to be stored in an XML format + data file. This backend can not be used for normal operation, it can only + be used in conjunction with pdbedit's pdb2pdb + functionality. The DTD that is used might be subject to changes in the future. +

    + The xmlsam option can be useful for account migration between database + backends or backups. Use of this tool will allow the data to be edited before migration + into another backend format. +

    nisplussam:

    + The NIS+ based passdb backend. Takes name NIS domain as an + optional argument. Only works with Sun NIS+ servers. +

    Technical Information

    + Old windows clients send plain text passwords over the wire. Samba can check these + passwords by crypting them and comparing them to the hash stored in the unix user database. +

    + Newer windows clients send encrypted passwords (so-called Lanman and NT hashes) over + the wire, instead of plain text passwords. The newest clients will send only encrypted + passwords and refuse to send plain text passwords, unless their registry is tweaked. +

    + These passwords can't be converted to unix style encrypted passwords. Because of that, + you can't use the standard unix user database, and you have to store the Lanman and NT + hashes somewhere else. +

    + In addition to differently encrypted passwords, windows also stores certain data for each + user that is not stored in a unix user database. e.g: workstations the user may logon from, + the location where the users' profile is stored, and so on. Samba retrieves and stores this + information using a passdb backend. Commonly available backends are LDAP, plain text + file, MySQL and nisplus. For more information, see the man page for smb.conf regarding the + passdb backend parameter. +

    Important Notes About Security

    + The unix and SMB password encryption techniques seem similar on the surface. This + similarity is, however, only skin deep. The unix scheme typically sends clear text + passwords over the network when logging in. This is bad. The SMB encryption scheme + never sends the cleartext password over the network but it does store the 16 byte + hashed values on disk. This is also bad. Why? Because the 16 byte hashed values + are a "password equivalent". You cannot derive the user's password from them, but + they could potentially be used in a modified client to gain access to a server. + This would require considerable technical knowledge on behalf of the attacker but + is perfectly possible. You should thus treat the data stored in whatever passdb + backend you use (smbpasswd file, ldap, mysql) as though it contained the cleartext + passwords of all your users. Its contents must be kept secret, and the file should + be protected accordingly. +

    + Ideally we would like a password scheme that involves neither plain text passwords + on the net nor on disk. Unfortunately this is not available as Samba is stuck with + having to be compatible with other SMB systems (WinNT, WfWg, Win95 etc). +

    + Windows NT 4.0 Service pack 3 changed the default setting so that plaintext passwords + are disabled from being sent over the wire. This mandates either the use of encrypted + password support or edit the Windows NT registry to re-enable plaintext passwords. +

    + The following versions of MS Windows do not support full domain security protocols, + although they may log onto a domain environment: +

    MS DOS Network client 3.0 with the basic network redirector installed
    Windows 95 with the network redirector update installed
    Windows 98 [se]
    Windows Me

    Note

    + MS Windows XP Home does not have facilities to become a domain member and it can + not participate in domain logons. +

    + The following versions of MS Windows fully support domain security protocols. +

    Windows NT 3.5x
    Windows NT 4.0
    Windows 2000 Professional
    Windows 200x Server/Advanced Server
    Windows XP Professional

    + All current release of Microsoft SMB/CIFS clients support authentication via the + SMB Challenge/Response mechanism described here. Enabling clear text authentication + does not disable the ability of the client to participate in encrypted authentication. + Instead, it allows the client to negotiate either plain text _or_ encrypted password + handling. +

    + MS Windows clients will cache the encrypted password alone. Where plain text passwords + are re-enabled, through the appropriate registry change, the plain text password is NEVER + cached. This means that in the event that a network connections should become disconnected + (broken) only the cached (encrypted) password will be sent to the resource server to + affect a auto-reconnect. If the resource server does not support encrypted passwords the + auto-reconnect will fail. USE OF ENCRYPTED PASSWORDS IS STRONGLY ADVISED. +

    Advantages of Encrypted Passwords

    • Plain text passwords are not passed across + the network. Someone using a network sniffer cannot just + record passwords going to the SMB server.

    • Plain text passwords are not stored anywhere in + memory or on disk.

    • WinNT doesn't like talking to a server + that does not support encrypted passwords. It will refuse + to browse the server if the server is also in user level + security mode. It will insist on prompting the user for the + password on each connection, which is very annoying. The + only things you can do to stop this is to use SMB encryption. +

    • Encrypted password support allows automatic share + (resource) reconnects.

    • Encrypted passwords are essential for PDC/BDC + operation.

    Advantages of non-encrypted passwords

    • Plain text passwords are not kept + on disk, and are NOT cached in memory.

    • Uses same password file as other unix + services such as login and ftp

    • Use of other services (such as telnet and ftp) which + send plain text passwords over the net, so sending them for SMB + isn't such a big deal.

    Mapping User Identifiers between MS Windows and Unix

    + Every operation in Unix/Linux requires a user identifier (UID), just as in + MS Windows NT4 / 200x this requires a Security Identifier (SID). Samba provides + two means for mapping an MS Windows user to a Unix/Linux UID.

    - Newer windows clients send encrypted passwords (so-called - Lanman and NT hashes) over - the wire, instead of plain text passwords. The newest clients - will only send encrypted passwords and refuse to send plain text - passwords, unless their registry is tweaked. -

    These passwords can't be converted to unix style encrypted - passwords. Because of that you can't use the standard unix - user database, and you have to store the Lanman and NT hashes - somewhere else.

    Next to a differently encrypted passwords, - windows also stores certain data for each user - that is not stored in a unix user database, e.g. - workstations the user may logon from, the location where his/her - profile is stored, etc. - Samba retrieves and stores this information using a "passdb backend". - Commonly - available backends are LDAP, plain text file, MySQL and nisplus. - For more information, see the documentation about the - passdb backend = parameter. -

    Important Notes About Security

    The unix and SMB password encryption techniques seem similar - on the surface. This similarity is, however, only skin deep. The unix - scheme typically sends clear text passwords over the network when - logging in. This is bad. The SMB encryption scheme never sends the - cleartext password over the network but it does store the 16 byte - hashed values on disk. This is also bad. Why? Because the 16 byte hashed - values are a "password equivalent". You cannot derive the user's - password from them, but they could potentially be used in a modified - client to gain access to a server. This would require considerable - technical knowledge on behalf of the attacker but is perfectly possible. - You should thus treat the data stored in whatever - passdb backend you use (smbpasswd file, ldap, mysql) as though it contained the - cleartext passwords of all your users. Its contents must be kept - secret, and the file should be protected accordingly.

    Ideally we would like a password scheme which neither requires - plain text passwords on the net or on disk. Unfortunately this - is not available as Samba is stuck with being compatible with - other SMB systems (WinNT, WfWg, Win95 etc).

    Warning

    Note that Windows NT 4.0 Service pack 3 changed the - default for permissible authentication so that plaintext - passwords are never sent over the wire. - The solution to this is either to switch to encrypted passwords - with Samba or edit the Windows NT registry to re-enable plaintext - passwords. See the document WinNT.txt for details on how to do - this.

    Other Microsoft operating systems which also exhibit - this behavior includes

    These versions of MS Windows do not support full domain - security protocols, although they may log onto a domain environment. - Of these Only MS Windows XP Home does NOT support domain logons.

    MS DOS Network client 3.0 with - the basic network redirector installed
    Windows 95 with the network redirector - update installed
    Windows 98 [se]
    Windows Me
    Windows XP Home

    The following versions of MS Windows fully support domain - security protocols.

    Windows NT 3.5x
    Windows NT 4.0
    Windows 2000 Professional
    Windows 200x Server/Advanced Server
    Windows XP Professional

    Note

    All current release of - Microsoft SMB/CIFS clients support authentication via the - SMB Challenge/Response mechanism described here. Enabling - clear text authentication does not disable the ability - of the client to participate in encrypted authentication.

    MS Windows clients will cache the encrypted password alone. - Even when plain text passwords are re-enabled, through the appropriate - registry change, the plain text password is NEVER cached. This means that - in the event that a network connections should become disconnected (broken) - only the cached (encrypted) password will be sent to the resource server - to affect a auto-reconnect. If the resource server does not support encrypted - passwords the auto-reconnect will fail. USE OF ENCRYPTED PASSWORDS - IS STRONGLY ADVISED.

    Advantages of SMB Encryption

    Plain text passwords are not passed across - the network. Someone using a network sniffer cannot just - record passwords going to the SMB server.
    WinNT doesn't like talking to a server - that does not support encrypted passwords. It will refuse - to browse the server if the server is also in user level - security mode. It will insist on prompting the user for the - password on each connection, which is very annoying. The - only things you can do to stop this is to use SMB encryption. -
    Encrypted password support allows automatic share - (resource) reconnects.

    Advantages of non-encrypted passwords

    Plain text passwords are not kept - on disk, and are NOT cached in memory.
    Uses same password file as other unix - services such as login and ftp
    Use of other services (such as telnet and ftp) which - send plain text passwords over the net, so sending them for SMB - isn't such a big deal.

    The smbpasswd Command

    The smbpasswd utility is a utility similar to the - passwd or yppasswd programs. - It maintains the two 32 byte password fields in the passdb backend.

    smbpasswd works in a client-server mode - where it contacts the local smbd to change the user's password on its - behalf. This has enormous benefits - as follows.

    smbpasswd has the capability - to change passwords on Windows NT servers (this only works when - the request is sent to the NT Primary Domain Controller if you - are changing an NT Domain user's password).

    To run smbpasswd as a normal user just type :

    $ smbpasswd

    Old SMB password: <type old value here - - or hit return if there was no old password>

    New SMB Password: <type new value> -

    Repeat New SMB Password: <re-type new value -

    If the old value does not match the current value stored for - that user, or the two new values do not match each other, then the - password will not be changed.

    If invoked by an ordinary user it will only allow the user - to change his or her own Samba password.

    If run by the root user smbpasswd may take an optional - argument, specifying the user name whose SMB password you wish to - change. Note that when run as root smbpasswd does not prompt for - or check the old password value, thus allowing root to set passwords - for users who have forgotten their passwords.

    smbpasswd is designed to work in the same way - and be familiar to UNIX users who use the passwd or - yppasswd commands.

    For more details on using smbpasswd refer - to the man page which will always be the definitive reference.

    Plain text

    -Older versions of samba retrieved user information from the unix user database -and eventually some other fields from the file /etc/samba/smbpasswd -or /etc/smbpasswd. When password encryption is disabled, no -data is stored at all. -

    TDB

    Samba can also store the user data in a "TDB" (Trivial Database). Using this backend -doesn't require any additional configuration. This backend is recommended for new installations that -don not require LDAP. -

    LDAP

    Introduction

    -This document describes how to use an LDAP directory for storing Samba user -account information traditionally stored in the smbpasswd(5) file. It is -assumed that the reader already has a basic understanding of LDAP concepts -and has a working directory server already installed. For more information -on LDAP architectures and Directories, please refer to the following sites. -

    -Note that O'Reilly Publishing is working on -a guide to LDAP for System Administrators which has a planned release date of -early summer, 2002. + Firstly, all Samba SAM (Security Account Manager database) accounts require + a Unix/Linux UID that the account will map to. As users are added to the account + information database, Samba-3 will call the add user script + interface to add the account to the Samba host OS. In essence, all accounts in + the local SAM require a local user account. +

    + The second way to affect Windows SID to Unix UID mapping is via the + idmap uid, idmap gid parameters in smb.conf. + Please refer to the man page for information about these parameters. + These parameters are essential when mapping users from a remote SAM server. +

    Account Management Tools

    +Samba-3 provides two (2) tools for management of User and machine accounts. These tools are +called smbpasswd and pdbedit. A third tool is under +development but is NOT expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK +GUI tool that looks much like the MS Windows NT4 Domain User Manager - hopefully this will +be announced in time for the Samba-3.0.1 release. +

    The smbpasswd Command

    + The smbpasswd utility is a utility similar to the passwd + or yppasswd programs. It maintains the two 32 byte password + fields in the passdb backend. +

    + smbpasswd works in a client-server mode where it contacts the + local smbd to change the user's password on its behalf. This has enormous benefits + as follows: +

    + smbpasswd has the capability to change passwords on Windows NT + servers (this only works when the request is sent to the NT Primary Domain Controller + if changing an NT Domain user's password). +

    + smbpasswd can be used to: +

    add user or machine accounts
    delete user or machine accounts
    enable user or machine accounts
    disable user or machine accounts
    set to NULL user passwords
    manage interdomain trust accounts

    + To run smbpasswd as a normal user just type: +

    + 

    +		$ smbpasswd
+		Old SMB password: secret
+

    + For secret type old value here - or hit return if + there was no old password + 

    +		New SMB Password: new secret
+		Repeat New SMB Password: new secret
+

    +

    + If the old value does not match the current value stored for that user, or the two + new values do not match each other, then the password will not be changed. +

    + When invoked by an ordinary user it will only allow change of their own + SMB password. +

    + When run by root smbpasswd may take an optional argument, specifying + the user name whose SMB password you wish to change. When run as root, smbpasswd + does not prompt for or check the old password value, thus allowing root to set passwords + for users who have forgotten their passwords. +

    + smbpasswd is designed to work in the way familiar to UNIX + users who use the passwd or yppasswd commands. + While designed for administrative use, this tool provides essential user level + password change capabilities. +

    + For more details on using smbpasswd refer to the man page (the + definitive reference). +

    The pdbedit Command

    + pdbedit is a tool that can be used only by root. It is used to + manage the passdb backend. pdbedit can be used to: +

    add, remove or modify user accounts
    listing user accounts
    migrate user accounts

    + The pdbedit tool is the only one that can manage the account + security and policy settings. It is capable of all operations that smbpasswd can + do as well as a super set of them. +

    + One particularly important purpose of the pdbedit is to allow + the migration of account information from one passdb backend to another. See the + XML password backend section of this chapter. +

    + The following is an example of the user account information that is stored in + a tdbsam password backend. This listing was produced by running: + 

    +		$ pdbedit -Lv met
+		Unix username:        met
+		NT username:
+		Account Flags:        [UX         ]
+		User SID:             S-1-5-21-1449123459-1407424037-3116680435-2004
+		Primary Group SID:    S-1-5-21-1449123459-1407424037-3116680435-1201
+		Full Name:            Melissa E Terpstra
+		Home Directory:       \\frodo\met\Win9Profile
+		HomeDir Drive:        H:
+		Logon Script:         scripts\logon.bat
+		Profile Path:         \\frodo\Profiles\met
+		Domain:               MIDEARTH
+		Account desc:
+		Workstations:         melbelle
+		Munged dial:
+		Logon time:           0
+		Logoff time:          Mon, 18 Jan 2038 20:14:07 GMT
+		Kickoff time:         Mon, 18 Jan 2038 20:14:07 GMT
+		Password last set:    Sat, 14 Dec 2002 14:37:03 GMT
+		Password can change:  Sat, 14 Dec 2002 14:37:03 GMT
+		Password must change: Mon, 18 Jan 2038 20:14:07 GMT
+

    Password Backends

    +Samba-3 offers the greatest flexibility in backend account database design of any SMB/CIFS server +technology available today. The flexibility is immediately obvious as one begins to explore this +capability.

    -Two additional Samba resources which may prove to be helpful are -

    • The Samba-PDC-LDAP-HOWTO - maintained by Ignacio Coupeau.

    • The NT migration scripts from IDEALX that are - geared to manage users and group in such a Samba-LDAP Domain Controller configuration. -

    Encrypted Password Database

    -Traditionally, when configuring "encrypt -passwords = yes" in Samba's smb.conf file, user account -information such as username, LM/NT password hashes, password change times, and account -flags have been stored in the smbpasswd(5) file. There are several -disadvantages to this approach for sites with very large numbers of users (counted -in the thousands). -

    • -The first is that all lookups must be performed sequentially. Given that -there are approximately two lookups per domain logon (one for a normal -session connection such as when mapping a network drive or printer), this -is a performance bottleneck for large sites. What is needed is an indexed approach -such as is used in databases. -

    • -The second problem is that administrators who desired to replicate a -smbpasswd file to more than one Samba server were left to use external -tools such as rsync(1) and ssh(1) -and wrote custom, in-house scripts. -

    • -And finally, the amount of information which is stored in an -smbpasswd entry leaves no room for additional attributes such as -a home directory, password expiration time, or even a Relative -Identified (RID). -

    -As a result of these defeciencies, a more robust means of storing user attributes -used by smbd was developed. The API which defines access to user accounts -is commonly referred to as the samdb interface (previously this was called the passdb -API, and is still so named in the CVS trees). +It is possible to specify not only multiple different password backends, but even multiple +backends of the same type. For example, to use two different tdbsam databases:

    -There are a few points to stress about that the ldapsam -does not provide. The LDAP support referred to in the this documentation does not -include: -

    • A means of retrieving user account information from - an Windows 2000 Active Directory server.

    • A means of replacing /etc/passwd.

    -The second item can be accomplished by using LDAP NSS and PAM modules. LGPL -versions of these libraries can be obtained from PADL Software -(http://www.padl.com/). More -information about the configuration of these packages may be found at "LDAP, -System Administration; Gerald Carter, O'Reilly; Chapter 6: Replacing NIS". -

    Supported LDAP Servers

    -The LDAP samdb code in 2.2.3 (and later) has been developed and tested -using the OpenLDAP 2.0 server and client libraries. -The same code should be able to work with Netscape's Directory Server -and client SDK. However, due to lack of testing so far, there are bound -to be compile errors and bugs. These should not be hard to fix. -If you are so inclined, please be sure to forward all patches to -samba-patches@samba.org and -jerry@samba.org. -

    Schema and Relationship to the RFC 2307 posixAccount

    -Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in -examples/LDAP/samba.schema. The sambaAccount objectclass is given here: 

    -objectclass ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top AUXILIARY
-     DESC 'Samba Account'
-     MUST ( uid $ rid )
-     MAY  ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
-            logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
-            displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
-            description $ userWorkstations $ primaryGroupID $ domain ))
+[globals]
+		passdb backend = tdbsam:/etc/samba/passdb.tdb, \
+		tdbsam:/etc/samba/old-passdb.tdb, guest
+

    +

    Plain Text

    + Older versions of Samba retrieved user information from the unix user database + and eventually some other fields from the file /etc/samba/smbpasswd + or /etc/smbpasswd. When password encryption is disabled, no + SMB specific data is stored at all. Instead all operations are conducted via the way + that the Samba host OS will access its /etc/passwd database. + eg: On Linux systems that is done via PAM. +

    smbpasswd - Encrypted Password Database

    + Traditionally, when configuring encrypt + passwords = yes in Samba's smb.conf file, user account + information such as username, LM/NT password hashes, password change times, and account + flags have been stored in the smbpasswd(5) file. There are several + disadvantages to this approach for sites with very large numbers of users (counted + in the thousands). +

    • + The first is that all lookups must be performed sequentially. Given that + there are approximately two lookups per domain logon (one for a normal + session connection such as when mapping a network drive or printer), this + is a performance bottleneck for large sites. What is needed is an indexed approach + such as is used in databases. +

    • + The second problem is that administrators who desire to replicate a smbpasswd file + to more than one Samba server were left to use external tools such as + rsync(1) and ssh(1) and wrote custom, + in-house scripts. +

    • + And finally, the amount of information which is stored in an smbpasswd entry leaves + no room for additional attributes such as a home directory, password expiration time, + or even a Relative Identifier (RID). +

    + As a result of these deficiencies, a more robust means of storing user attributes + used by smbd was developed. The API which defines access to user accounts + is commonly referred to as the samdb interface (previously this was called the passdb + API, and is still so named in the Samba CVS trees). +

    + Samba-3 provides an enhanced set of passdb backends that overcome the deficiencies + of the smbpasswd plain text database. These are tdbsam, ldapsam, and xmlsam. + Of these ldapsam will be of most interest to large corporate or enterprise sites. +

    tdbsam

    Samba can store user and machine account data in a "TDB" (Trivial Database). + Using this backend doesn't require any additional configuration. This backend is + recommended for new installations that do not require LDAP. +

    + As a general guide the Samba-Team does NOT recommend using the tdbsam backend for sites + that have 250 or more users. Additionally, tdbsam is not capable of scaling for use + in sites that require PDB/BDC implementations that requires replication of the account + database. Clearly, for reason of scalability, the use of ldapsam should be encouraged. +

    ldapsam

    + There are a few points to stress that the ldapsam does not provide. The LDAP + support referred to in the this documentation does not include: +

    • A means of retrieving user account information from + an Windows 200x Active Directory server.

    • A means of replacing /etc/passwd.

    + The second item can be accomplished by using LDAP NSS and PAM modules. LGPL + versions of these libraries can be obtained from PADL Software + (http://www.padl.com/). More + information about the configuration of these packages may be found at "LDAP, + System Administration; Gerald Carter, O'Reilly; Chapter 6: Replacing NIS". + Refer to + http://safari.oreilly.com/?XmlId=1-56592-491-6 for those who might wish to know + more about configuration and administration of an OpenLDAP server. +

    Note

    + This section is outdated for Samba-3 schema. Samba-3 introduces a new schema + that has not been documented at the time of this publication. +

    + This document describes how to use an LDAP directory for storing Samba user + account information traditionally stored in the smbpasswd(5) file. It is + assumed that the reader already has a basic understanding of LDAP concepts + and has a working directory server already installed. For more information + on LDAP architectures and Directories, please refer to the following sites. +

    + Two additional Samba resources which may prove to be helpful are +

    • The Samba-PDC-LDAP-HOWTO + maintained by Ignacio Coupeau.

    • The NT migration scripts from IDEALX that are + geared to manage users and group in such a Samba-LDAP Domain Controller configuration. +

    Supported LDAP Servers

    + The LDAP ldapsam code has been developed and tested using the OpenLDAP 2.0 and 2.1 server and + client libraries. The same code should work with Netscape's Directory Server and client SDK. + However, there are bound to be compile errors and bugs. These should not be hard to fix. + Please submit fixes via Bug reporting facility. +

    Schema and Relationship to the RFC 2307 posixAccount

    + Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in + examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: +

    +

    +objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY
+    DESC 'Samba Auxiliary Account'
+    MUST ( uid $ rid )
+    MAY  ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
+           logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
+           displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
+           description $ userWorkstations $ primaryGroupID $ domain ))

    -The samba.schema file has been formatted for OpenLDAP 2.0. The OID's are -owned by the Samba Team and as such is legal to be openly published. -If you translate the schema to be used with Netscape DS, please -submit the modified schema file as a patch to jerry@samba.org -

    -Just as the smbpasswd file is meant to store information which supplements a -user's /etc/passwd entry, so is the sambaAccount object -meant to supplement the UNIX user account information. A sambaAccount is a -STRUCTURAL objectclass so it can be stored individually -in the directory. However, there are several fields (e.g. uid) which overlap -with the posixAccount objectclass outlined in RFC2307. This is by design. -

    -In order to store all user account information (UNIX and Samba) in the directory, -it is necessary to use the sambaAccount and posixAccount objectclasses in -combination. However, smbd will still obtain the user's UNIX account -information via the standard C library calls (e.g. getpwnam(), et. al.). -This means that the Samba server must also have the LDAP NSS library installed -and functioning correctly. This division of information makes it possible to -store all Samba account information in LDAP, but still maintain UNIX account -information in NIS while the network is transitioning to a full LDAP infrastructure. -

    Configuring Samba with LDAP

    OpenLDAP configuration

    -To include support for the sambaAccount object in an OpenLDAP directory -server, first copy the samba.schema file to slapd's configuration directory.

    -root# cp samba.schema /etc/openldap/schema/ + The samba.schema file has been formatted for OpenLDAP 2.0/2.1. + The OID's are owned by the Samba Team and as such is legal to be openly published. + If you translate the schema to be used with Netscape DS, please + submit the modified schema file as a patch to + jerry@samba.org. +

    + Just as the smbpasswd file is meant to store information which supplements a + user's /etc/passwd entry, so is the sambaSamAccount object + meant to supplement the UNIX user account information. A sambaSamAccount is a + STRUCTURAL objectclass so it can be stored individually + in the directory. However, there are several fields (e.g. uid) which overlap + with the posixAccount objectclass outlined in RFC2307. This is by design. +

    + In order to store all user account information (UNIX and Samba) in the directory, + it is necessary to use the sambaSamAccount and posixAccount objectclasses in + combination. However, smbd will still obtain the user's UNIX account + information via the standard C library calls (e.g. getpwnam(), et. al.). + This means that the Samba server must also have the LDAP NSS library installed + and functioning correctly. This division of information makes it possible to + store all Samba account information in LDAP, but still maintain UNIX account + information in NIS while the network is transitioning to a full LDAP infrastructure. +

    OpenLDAP configuration

    + To include support for the sambaSamAccount object in an OpenLDAP directory + server, first copy the samba.schema file to slapd's configuration directory. + The samba.schema file can be found in the directory examples/LDAP + in the samba source distribution. +

    +

    +root# cp samba.schema /etc/openldap/schema/
+

    -Next, include the samba.schema file in slapd.conf. -The sambaAccount object contains two attributes which depend upon other schema -files. The 'uid' attribute is defined in cosine.schema and -the 'displayName' attribute is defined in the inetorgperson.schema -file. Both of these must be included before the samba.schema file. + Next, include the samba.schema file in slapd.conf. + The sambaSamAccount object contains two attributes which depend upon other schema + files. The 'uid' attribute is defined in cosine.schema and + the 'displayName' attribute is defined in the inetorgperson.schema + file. Both of these must be included before the samba.schema file. + 

     ## /etc/openldap/slapd.conf
 
 ## schema files (core.schema is required by default)
 include	           /etc/openldap/schema/core.schema
 
-## needed for sambaAccount
+## needed for sambaSamAccount
 include            /etc/openldap/schema/cosine.schema
 include            /etc/openldap/schema/inetorgperson.schema
 include            /etc/openldap/schema/samba.schema
 include            /etc/openldap/schema/nis.schema
-
 ....

    -It is recommended that you maintain some indices on some of the most usefull attributes, -like in the following example, to speed up searches made on sambaAccount objectclasses -(and possibly posixAccount and posixGroup as well). -

    +
    
+		It is recommended that you maintain some indices on some of the most useful attributes,
+		like in the following example, to speed up searches made on sambaSamAccount objectclasses
+		(and possibly posixAccount and posixGroup as well).
+		
    
+
     # Indices to maintain
-## required by OpenLDAP 2.0
-index objectclass   eq
+## required by OpenLDAP
+index objectclass             eq
 
-## support pb_getsampwnam()
-index uid           pres,eq
-## support pdb_getsambapwrid()
-index rid           eq
+index cn                      pres,sub,eq
+index sn                      pres,sub,eq
+## required to support pdb_getsampwnam
+index uid                     pres,sub,eq
+## required to support pdb_getsambapwrid()
+index displayName             pres,sub,eq
 
 ## uncomment these if you are storing posixAccount and
 ## posixGroup entries in the directory as well
-##index uidNumber     eq
-##index gidNumber     eq
-##index cn            eq
-##index memberUid     eq
+##index uidNumber               eq
+##index gidNumber               eq
+##index memberUid               eq
 
-# (both fetched via ldapsearch):
-index   primaryGroupID  eq
-index   displayName     pres,eq
+index   sambaSID              eq
+index   sambaPrimaryGroupSID  eq
+index   sambaDomainName       eq
+index   default               sub
+
    
+
    
+		Create the new index by executing:
+		
    
+
    +./sbin/slapindex -f slapd.conf
+
    
+
    
+		Remember to restart slapd after making these changes:
+		
    
+
    +root# /etc/init.d/slapd restart
+
    
+

    Initialise the LDAP database

    + Before you can add accounts to the LDAP database you must create the account containers + that they will be stored in. The following LDIF file should be modified to match your + needs (ie: Your DNS entries, etc.). +

    +

    +# Organization for Samba Base
+dn: dc=plainjoe,dc=org
+objectclass: dcObject
+objectclass: organization
+dc: plainjoe
+o: Terpstra Org Network
+description: The Samba-3 Network LDAP Example
+
+# Organizational Role for Directory Management
+dn: cn=Manager,dc=plainjoe,dc=org
+objectclass: organizationalRole
+cn: Manager
+description: Directory Manager
+
+# Setting up container for users
+dn: ou=People,dc=plainjoe,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: People
 
-

    Configuring Samba

    -The following parameters are available in smb.conf only with --with-ldapsam -was included when compiling Samba. -

    -These are described in the smb.conf(5) man -page and so will not be repeated here. However, a sample smb.conf file for -use with an LDAP directory could appear as +# Setting up admin handle for People OU +dn: cn=admin,ou=People,dc=plainjoe,dc=org +cn: admin +objectclass: top +objectclass: organizationalRole +objectclass: simpleSecurityObject +userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz +

    +

    + The userPassword shown above should be generated using slappasswd. +

    + The following command will then load the contents of the LDIF file into the LDAP + database. +

    +

    +$ slapadd -v -l initldap.dif
+

    +

    + Do not forget to secure your LDAP server with an adequate access control list, + as well as an admin password. +

    Note

    + Before Samba can access the LDAP server you need to store the LDAP admin password + into the Samba-3 secrets.tdb database by: + 

    +root#  smbpasswd -w secret
+

    +

    Configuring Samba

    + The following parameters are available in smb.conf only if your + version of samba was built with LDAP support. Samba automatically builds with LDAP support if the + LDAP libraries are found. +

    + These are described in the smb.conf man + page and so will not be repeated here. However, a sample smb.conf file for + use with an LDAP directory could appear as + 

     ## /usr/local/samba/lib/smb.conf
 [global]
@@ -265,7 +541,7 @@ use with an LDAP directory could appear as
 
      # define the DN to use when binding to the directory servers
      # The password for this DN is not stored in smb.conf.  Rather it
-     # must be set by using 'smbpasswd -w secretpw' to store the
+     # must be set by using 'smbpasswd -w secretpw' to store the
      # passphrase in the secrets.tdb file.  If the "ldap admin dn" values
      # change, this password will need to be reset.
      ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"
@@ -274,245 +550,263 @@ use with an LDAP directory could appear as
      # ('off', 'start tls', or 'on' (default))
      ldap ssl = start tls
 
-     passdb backend ldapsam:ldap://ahab.samba.org
+     # syntax: passdb backend = ldapsam:ldap://server-name[:port]
+     passdb backend = ldapsam:ldap://funball.samba.org, guest
 
      # smbpasswd -x delete the entire dn-entry
      ldap delete dn = no
 
      # the machine and user suffix added to the base suffix
-     # wrote WITHOUT quotes. NULL siffixes by default
+     # wrote WITHOUT quotes. NULL suffixes by default
      ldap user suffix = ou=People
      ldap machine suffix = ou=Systems
 
-     # define the port to use in the LDAP session (defaults to 636 when
-     # "ldap ssl = on")
-     ldap port = 389
+     # Trust unix account information in LDAP
+     #  (see the smb.conf manpage for details)
+     ldap trust ids = Yes
 
      # specify the base DN to use when searching the directory
      ldap suffix = "ou=people,dc=samba,dc=org"
 
      # generally the default ldap search filter is ok
-     # ldap filter = "(&(uid=%u)(objectclass=sambaAccount))"
-

    Accounts and Groups management

    -As users accounts are managed thru the sambaAccount objectclass, you should -modify your existing administration tools to deal with sambaAccount attributes. -

    -Machines accounts are managed with the sambaAccount objectclass, just -like users accounts. However, it's up to you to store thoses accounts -in a different tree of you LDAP namespace: you should use -"ou=Groups,dc=plainjoe,dc=org" to store groups and -"ou=People,dc=plainjoe,dc=org" to store users. Just configure your -NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration -file). -

    -In Samba release 3.0, the group management system is based on posix -groups. This means that Samba makes usage of the posixGroup objectclass. -For now, there is no NT-like group system management (global and local -groups). -

    Security and sambaAccount

    -There are two important points to remember when discussing the security -of sambaAccount entries in the directory. -

    • Never retrieve the lmPassword or - ntPassword attribute values over an unencrypted LDAP session.

    • Never allow non-admin users to - view the lmPassword or ntPassword attribute values.

    -These password hashes are clear text equivalents and can be used to impersonate -the user without deriving the original clear text strings. For more information -on the details of LM/NT password hashes, refer to the User Database of the Samba-HOWTO-Collection. -

    -To remedy the first security issue, the "ldap ssl" smb.conf parameter defaults -to require an encrypted session (ldap ssl = on) using -the default port of 636 -when contacting the directory server. When using an OpenLDAP 2.0 server, it -is possible to use the use the StartTLS LDAP extended operation in the place of -LDAPS. In either case, you are strongly discouraged to disable this security -(ldap ssl = off). -

    -Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS -extended operation. However, the OpenLDAP library still provides support for -the older method of securing communication between clients and servers. -

    -The second security precaution is to prevent non-administrative users from -harvesting password hashes from the directory. This can be done using the -following ACL in slapd.conf: + # ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))" +

    +

    Accounts and Groups management

    + As users accounts are managed through the sambaSamAccount objectclass, you should + modify your existing administration tools to deal with sambaSamAccount attributes. +

    + Machines accounts are managed with the sambaSamAccount objectclass, just + like users accounts. However, it's up to you to store those accounts + in a different tree of your LDAP namespace: you should use + "ou=Groups,dc=plainjoe,dc=org" to store groups and + "ou=People,dc=plainjoe,dc=org" to store users. Just configure your + NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration + file). +

    + In Samba release 3.0, the group management system is based on POSIX + groups. This means that Samba makes use of the posixGroup objectclass. + For now, there is no NT-like group system management (global and local + groups). +

    Security and sambaSamAccount

    + There are two important points to remember when discussing the security + of sambaSamAccount entries in the directory. +

    • Never retrieve the lmPassword or + ntPassword attribute values over an unencrypted LDAP session.

    • Never allow non-admin users to + view the lmPassword or ntPassword attribute values.

    + These password hashes are clear text equivalents and can be used to impersonate + the user without deriving the original clear text strings. For more information + on the details of LM/NT password hashes, refer to the + Account Information Database section of this chapter. +

    + To remedy the first security issue, the ldap ssl smb.conf parameter defaults + to require an encrypted session (ldap ssl = on) using + the default port of 636 + when contacting the directory server. When using an OpenLDAP server, it + is possible to use the use the StartTLS LDAP extended operation in the place of + LDAPS. In either case, you are strongly discouraged to disable this security + (ldap ssl = off). +

    + Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS + extended operation. However, the OpenLDAP library still provides support for + the older method of securing communication between clients and servers. +

    + The second security precaution is to prevent non-administrative users from + harvesting password hashes from the directory. This can be done using the + following ACL in slapd.conf: + 

     ## allow the "ldap admin dn" access, but deny everyone else
 access to attrs=lmPassword,ntPassword
      by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write
      by * none
-

    LDAP specials attributes for sambaAccounts

    -The sambaAccount objectclass is composed of the following attributes: -

    • lmPassword: the LANMAN password 16-byte hash stored as a character - representation of a hexidecimal string.

    • ntPassword: the NT password hash 16-byte stored as a character - representation of a hexidecimal string.

    • pwdLastSet: The integer time in seconds since 1970 when the - lmPassword and ntPassword attributes were last set. -

    • acctFlags: string of 11 characters surrounded by square brackets [] - representing account flags such as U (user), W(workstation), X(no password expiration), and - D(disabled).

    • logonTime: Integer value currently unused

    • logoffTime: Integer value currently unused

    • kickoffTime: Integer value currently unused

    • pwdCanChange: Integer value currently unused

    • pwdMustChange: Integer value currently unused

    • homeDrive: specifies the drive letter to which to map the - UNC path specified by homeDirectory. The drive letter must be specified in the form "X:" - where X is the letter of the drive to map. Refer to the "logon drive" parameter in the - smb.conf(5) man page for more information.

    • scriptPath: The scriptPath property specifies the path of - the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path - is relative to the netlogon share. Refer to the "logon script" parameter in the - smb.conf(5) man page for more information.

    • profilePath: specifies a path to the user's profile. - This value can be a null string, a local absolute path, or a UNC path. Refer to the - "logon path" parameter in the smb.conf(5) man page for more information.

    • smbHome: The homeDirectory property specifies the path of - the home directory for the user. The string can be null. If homeDrive is set and specifies - a drive letter, homeDirectory should be a UNC path. The path must be a network - UNC path of the form \\server\share\directory. This value can be a null string. - Refer to the "logon home" parameter in the smb.conf(5) man page for more information. -

    • userWorkstation: character string value currently unused. -

    • rid: the integer representation of the user's relative identifier - (RID).

    • primaryGroupID: the relative identifier (RID) of the primary group - of the user.

    -The majority of these parameters are only used when Samba is acting as a PDC of -a domain (refer to the Samba-PDC-HOWTO for details on -how to configure Samba as a Primary Domain Controller). The following four attributes -are only stored with the sambaAccount entry if the values are non-default values: -

    • smbHome

    • scriptPath

    • logonPath

    • homeDrive

    -These attributes are only stored with the sambaAccount entry if -the values are non-default values. For example, assume TASHTEGO has now been -configured as a PDC and that logon home = \\%L\%u was defined in -its smb.conf file. When a user named "becky" logons to the domain, -the logon home string is expanded to \\TASHTEGO\becky. -If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", -this value is used. However, if this attribute does not exist, then the value -of the logon home parameter is used in its place. Samba -will only write the attribute value to the directory entry if the value is -something other than the default (e.g. \\MOBY\becky). -

    Example LDIF Entries for a sambaAccount

    -The following is a working LDIF with the inclusion of the posixAccount objectclass: -

    -dn: uid=guest2, ou=people,dc=plainjoe,dc=org
-ntPassword: 878D8014606CDA29677A44EFA1353FC7
-pwdMustChange: 2147483647
-primaryGroupID: 1201
-lmPassword: 552902031BEDE9EFAAD3B435B51404EE
-pwdLastSet: 1010179124
-logonTime: 0
-objectClass: sambaAccount
-uid: guest2
-kickoffTime: 2147483647
-acctFlags: [UX         ]
-logoffTime: 2147483647
-rid: 19006
-pwdCanChange: 0

    -The following is an LDIF entry for using both the sambaAccount and -posixAccount objectclasses: -

    -dn: uid=gcarter, ou=people,dc=plainjoe,dc=org
-logonTime: 0
-displayName: Gerald Carter
-lmPassword: 552902031BEDE9EFAAD3B435B51404EE
-primaryGroupID: 1201
-objectClass: posixAccount
-objectClass: sambaAccount
-acctFlags: [UX         ]
-userPassword: {crypt}BpM2ej8Rkzogo
-uid: gcarter
-uidNumber: 9000
-cn: Gerald Carter
-loginShell: /bin/bash
-logoffTime: 2147483647
-gidNumber: 100
-kickoffTime: 2147483647
-pwdLastSet: 1010179230
-rid: 19000
-homeDirectory: /home/tashtego/gcarter
-pwdCanChange: 0
-pwdMustChange: 2147483647
-ntPassword: 878D8014606CDA29677A44EFA1353FC7
-

    MySQL

    Creating the database

    -You either can set up your own table and specify the field names to pdb_mysql (see below -for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump -contains the correct queries to create the required tables. Use the command : - -mysql -uusername -hhostname -ppassword databasename > /path/to/samba/examples/pdb/mysql/mysql.dump - -

    Configuring

    This plugin lacks some good documentation, but here is some short info:

    Add a the following to the passdb backend variable in your smb.conf: -

    -passdb backend = [other-plugins] mysql:identifier [other-plugins]
-

    -

    The identifier can be any string you like, as long as it doesn't collide with -the identifiers of other plugins or other instances of pdb_mysql. If you -specify multiple pdb_mysql.so entries in 'passdb backend', you also need to -use different identifiers! -

    -Additional options can be given thru the smb.conf file in the [global] section. -

    -identifier:mysql host                     - host name, defaults to 'localhost'
-identifier:mysql password
-identifier:mysql user                     - defaults to 'samba'
-identifier:mysql database                 - defaults to 'samba'
-identifier:mysql port                     - defaults to 3306
-identifier:table                          - Name of the table containing users
-

    Warning

    -Since the password for the mysql user is stored in the -smb.conf file, you should make the the smb.conf file -readable only to the user that runs samba. This is considered a security -bug and will be fixed soon. -

    Names of the columns in this table(I've added column types those columns should have first):

    -identifier:logon time column             - int(9)
-identifier:logoff time column            - int(9)
-identifier:kickoff time column           - int(9)
-identifier:pass last set time column     - int(9)
-identifier:pass can change time column   - int(9)
-identifier:pass must change time column  - int(9)
-identifier:username column               - varchar(255) - unix username
-identifier:domain column                 - varchar(255) - NT domain user is part of
-identifier:nt username column            - varchar(255) - NT username
-identifier:fullname column               - varchar(255) - Full name of user
-identifier:home dir column               - varchar(255) - Unix homedir path
-identifier:dir drive column              - varchar(2)   - Directory drive path (eg: 'H:')
-identifier:logon script column           - varchar(255)
-					 - Batch file to run on client side when logging on
-identifier:profile path column           - varchar(255) - Path of profile
-identifier:acct desc column              - varchar(255) - Some ASCII NT user data
-identifier:workstations column           - varchar(255)
-					 - Workstations user can logon to (or NULL for all)
-identifier:unknown string column         - varchar(255) - unknown string
-identifier:munged dial column            - varchar(255) - ?
-identifier:user sid column               - varchar(255) - NT user SID
-identifier:group sid column              - varchar(255) - NT group ID
-identifier:lanman pass column            - varchar(255) - encrypted lanman password
-identifier:nt pass column                - varchar(255) - encrypted nt passwd
-identifier:plain pass column             - varchar(255) - plaintext password
-identifier:acct control column           - int(9) - nt user data
-identifier:unknown 3 column              - int(9) - unknown
-identifier:logon divs column             - int(9) - ?
-identifier:hours len column              - int(9) - ?
-identifier:unknown 5 column              - int(9) - unknown
-identifier:unknown 6 column              - int(9) - unknown
+

    LDAP special attributes for sambaSamAccounts

    + The sambaSamAccount objectclass is composed of the following attributes: +

    +

    Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP)

    lmPasswordthe LANMAN password 16-byte hash stored as a character + representation of a hexadecimal string.
    ntPasswordthe NT password hash 16-byte stored as a character + representation of a hexadecimal string.
    pwdLastSetThe integer time in seconds since 1970 when the + lmPassword and ntPassword attributes were last set. +
    acctFlagsstring of 11 characters surrounded by square brackets [] + representing account flags such as U (user), W(workstation), X(no password expiration), + I(Domain trust account), H(Home dir required), S(Server trust account), + and D(disabled).
    logonTimeInteger value currently unused
    logoffTimeInteger value currently unused
    kickoffTimeInteger value currently unused
    pwdCanChangeInteger value currently unused
    pwdMustChangeInteger value currently unused
    homeDrivespecifies the drive letter to which to map the + UNC path specified by homeDirectory. The drive letter must be specified in the form "X:" + where X is the letter of the drive to map. Refer to the "logon drive" parameter in the + smb.conf(5) man page for more information.
    scriptPathThe scriptPath property specifies the path of + the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path + is relative to the netlogon share. Refer to the "logon script" parameter in the + smb.conf(5) man page for more information.
    profilePathspecifies a path to the user's profile. + This value can be a null string, a local absolute path, or a UNC path. Refer to the + "logon path" parameter in the smb.conf(5) man page for more information.
    smbHomeThe homeDirectory property specifies the path of + the home directory for the user. The string can be null. If homeDrive is set and specifies + a drive letter, homeDirectory should be a UNC path. The path must be a network + UNC path of the form \\server\share\directory. This value can be a null string. + Refer to the logon home parameter in the smb.conf man page for more information. +
    userWorkstationcharacter string value currently unused. +
    ridthe integer representation of the user's relative identifier + (RID).
    primaryGroupIDthe relative identifier (RID) of the primary group + of the user.
    domaindomain the user is part of.

    +

    + The majority of these parameters are only used when Samba is acting as a PDC of + a domain (refer to the Samba as a primary domain controller chapter for details on + how to configure Samba as a Primary Domain Controller). The following four attributes + are only stored with the sambaSamAccount entry if the values are non-default values: +

    smbHome
    scriptPath
    logonPath
    homeDrive

    + These attributes are only stored with the sambaSamAccount entry if + the values are non-default values. For example, assume TASHTEGO has now been + configured as a PDC and that logon home = \\%L\%u was defined in + its smb.conf file. When a user named "becky" logons to the domain, + the logon home string is expanded to \\TASHTEGO\becky. + If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", + this value is used. However, if this attribute does not exist, then the value + of the logon home parameter is used in its place. Samba + will only write the attribute value to the directory entry if the value is + something other than the default (e.g. \\MOBY\becky). +

    Example LDIF Entries for a sambaSamAccount

    + The following is a working LDIF with the inclusion of the posixAccount objectclass: +

    + 

    +	dn: uid=guest2, ou=people,dc=plainjoe,dc=org
+	ntPassword: 878D8014606CDA29677A44EFA1353FC7
+	pwdMustChange: 2147483647
+	primaryGroupID: 1201
+	lmPassword: 552902031BEDE9EFAAD3B435B51404EE
+	pwdLastSet: 1010179124
+	logonTime: 0
+	objectClass: sambaSamAccount
+	uid: guest2
+	kickoffTime: 2147483647
+	acctFlags: [UX         ]
+	logoffTime: 2147483647
+	rid: 19006
+	pwdCanChange: 0
+

    +

    + The following is an LDIF entry for using both the sambaSamAccount and + posixAccount objectclasses: +

    + 

    +	dn: uid=gcarter, ou=people,dc=plainjoe,dc=org
+	logonTime: 0
+	displayName: Gerald Carter
+	lmPassword: 552902031BEDE9EFAAD3B435B51404EE
+	primaryGroupID: 1201
+	objectClass: posixAccount
+	objectClass: sambaSamAccount
+	acctFlags: [UX         ]
+	userPassword: {crypt}BpM2ej8Rkzogo
+	uid: gcarter
+	uidNumber: 9000
+	cn: Gerald Carter
+	loginShell: /bin/bash
+	logoffTime: 2147483647
+	gidNumber: 100
+	kickoffTime: 2147483647
+	pwdLastSet: 1010179230
+	rid: 19000
+	homeDirectory: /home/tashtego/gcarter
+	pwdCanChange: 0
+	pwdMustChange: 2147483647
+	ntPassword: 878D8014606CDA29677A44EFA1353FC7

    -Eventually, you can put a colon (:) after the name of each column, which -should specify the column to update when updating the table. You can also -specify nothing behind the colon - then the data from the field will not be -updated. -

    Using plaintext passwords or encrypted password

    -I strongly discourage the use of plaintext passwords, however, you can use them: -

    -If you would like to use plaintext passwords, set -'identifier:lanman pass column' and 'identifier:nt pass column' to -'NULL' (without the quotes) and 'identifier:plain pass column' to the -name of the column containing the plaintext passwords. -

    -If you use encrypted passwords, set the 'identifier:plain pass -column' to 'NULL' (without the quotes). This is the default. -

    Getting non-column data from the table

    -It is possible to have not all data in the database and making some 'constant'. -

    -For example, you can set 'identifier:fullname column' to : -CONCAT(First_name,' ',Sur_name) -

    -Or, set 'identifier:workstations column' to : -NULL

    See the MySQL documentation for more language constructs.

    XML

    This module requires libxml2 to be installed.

    The usage of pdb_xml is pretty straightforward. To export data, use: -

    - pdbedit -e xml:filename -

    -(where filename is the name of the file to put the data in) -

    -To import data, use: -pdbedit -i xml:filename -e current-pdb -

    -Where filename is the name to read the data from and current-pdb to put it in. -

    Prev Up Next
    Chapter 9. Samba / MS Windows Network Browsing Guide Home Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists
    +

    Password synchronisation

    + Since version 3.0 samba can update the non-samba (LDAP) password stored with an account. When + using pam_ldap, this allows changing both unix and windows passwords at once. +

    The ldap passwd sync options can have the following values:

    yes

    When the user changes his password, update + ntPassword, lmPassword + and the password fields.

    no

    Only update ntPassword and lmPassword.

    only

    Only update the LDAP password and let the LDAP server worry + about the other fields. This option is only available when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD.

    More information can be found in the smb.conf manpage. +

    MySQL

    + Every so often someone will come along with a great new idea. Storing of user accounts in an + SQL backend is one of them. Those who want to do this are in the best position to know what the + specific benefits are to them. This may sound like a cop-out, but in truth we can not attempt + to document every nitty little detail why certain things of marginal utility to the bulk of + Samba users might make sense to the rest. In any case, the following instructions should help + the determined SQL user to implement a working system. +

    Creating the database

    + You either can set up your own table and specify the field names to pdb_mysql (see below + for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump + contains the correct queries to create the required tables. Use the command : + + 

    $ mysql -uusername -hhostname -ppassword \
+databasename < /path/to/samba/examples/pdb/mysql/mysql.dump

    +

    Configuring

    This plugin lacks some good documentation, but here is some short info:

    Add a the following to the passdb backend variable in your smb.conf: + 

    +			passdb backend = [other-plugins] mysql:identifier [other-plugins]
+

    +

    The identifier can be any string you like, as long as it doesn't collide with + the identifiers of other plugins or other instances of pdb_mysql. If you + specify multiple pdb_mysql.so entries in passdb backend, you also need to + use different identifiers! +

    + Additional options can be given through the smb.conf file in the [global] section. +

    +

    Table 11.2. Basic smb.conf options for MySQL passdb backend

    FieldContents
    identifier:mysql hosthost name, defaults to 'localhost'
    identifier:mysql password 
    identifier:mysql userdefaults to 'samba'
    identifier:mysql databasedefaults to 'samba'
    identifier:mysql portdefaults to 3306
    identifier:tableName of the table containing users

    +

    Warning

    + Since the password for the MySQL user is stored in the + smb.conf file, you should make the the smb.conf file + readable only to the user that runs Samba This is considered a security + bug and will be fixed soon. +

    Names of the columns in this table (I've added column types those columns should have first):

    +

    Table 11.3. MySQL field names for MySQL passdb backend

    FieldTypeContents
    identifier:logon time columnint(9) 
    identifier:logoff time columnint(9) 
    identifier:kickoff time columnint(9) 
    identifier:pass last set time columnint(9) 
    identifier:pass can change time columnint(9) 
    identifier:pass must change time columnint(9) 
    identifier:username columnvarchar(255)unix username
    identifier:domain columnvarchar(255)NT domain user is part of
    identifier:nt username columnvarchar(255)NT username
    identifier:fullname columnvarchar(255)Full name of user
    identifier:home dir columnvarchar(255)Unix homedir path
    identifier:dir drive columnvarchar(2)Directory drive path (eg: 'H:')
    identifier:logon script columnvarchar(255)Batch file to run on client side when logging on
    identifier:profile path columnvarchar(255)Path of profile
    identifier:acct desc columnvarchar(255)Some ASCII NT user data
    identifier:workstations columnvarchar(255)Workstations user can logon to (or NULL for all)
    identifier:unknown string columnvarchar(255)unknown string
    identifier:munged dial columnvarchar(255)?
    identifier:user sid columnvarchar(255)NT user SID
    identifier:group sid columnvarchar(255)NT group ID
    identifier:lanman pass columnvarchar(255)encrypted lanman password
    identifier:nt pass columnvarchar(255)encrypted nt passwd
    identifier:plain pass columnvarchar(255)plaintext password
    identifier:acct control columnint(9)nt user data
    identifier:unknown 3 columnint(9)unknown
    identifier:logon divs columnint(9)?
    identifier:hours len columnint(9)?
    identifier:unknown 5 columnint(9)unknown
    identifier:unknown 6 columnint(9)unknown

    +

    + Eventually, you can put a colon (:) after the name of each column, which + should specify the column to update when updating the table. You can also + specify nothing behind the colon - then the data from the field will not be + updated. +

    Using plaintext passwords or encrypted password

    + I strongly discourage the use of plaintext passwords, however, you can use them: +

    + If you would like to use plaintext passwords, set + 'identifier:lanman pass column' and 'identifier:nt pass column' to + 'NULL' (without the quotes) and 'identifier:plain pass column' to the + name of the column containing the plaintext passwords. +

    + If you use encrypted passwords, set the 'identifier:plain pass + column' to 'NULL' (without the quotes). This is the default. +

    Getting non-column data from the table

    + It is possible to have not all data in the database and making some 'constant'. +

    + For example, you can set 'identifier:fullname column' to : + CONCAT(First_name,' ',Sur_name) +

    + Or, set 'identifier:workstations column' to : + NULL

    See the MySQL documentation for more language constructs.

    XML

    This module requires libxml2 to be installed.

    The usage of pdb_xml is pretty straightforward. To export data, use: +

    + $ pdbedit -e xml:filename +

    + (where filename is the name of the file to put the data in) +

    + To import data, use: + $ pdbedit -i xml:filename +

    Common Errors

    Users can not logon - Users not in Samba SAM

    + People forget to put their users in their backend and then complain Samba won't authorize them. +

    Users are being added to the wrong backend database

    + A few complaints have been received from users that just moved to Samba-3. The following + smb.conf file entries were causing problems, new accounts were being added to the old + smbpasswd file, not to the tdbsam passdb.tdb file: +

    + 

    +	[globals]
+		...
+		passdb backend = smbpasswd, tdbsam, guest
+		...
+

    +

    + Samba will add new accounts to the first entry in the passdb backend + parameter entry. If you want to update to the tdbsam, then change the entry to: +

    + 

    +	[globals]
+		...
+		passdb backend = tdbsam, smbpasswd, guest
+		...
+

    +

    auth methods does not work

    + If you explicitly set an 'auth methods' parameter, guest must be specified as the first + entry on the line. Eg: auth methods = guest sam. +

    + This is the exact opposite of the requirement for the passdb backed + option, where it must be the LAST parameter on the line. +

    Prev Up Next
    Chapter 10. Samba / MS Windows Network Browsing Guide Home Chapter 12. Mapping MS Windows and Unix Groups
    diff --git a/docs/htmldocs/pdbedit.8.html b/docs/htmldocs/pdbedit.8.html index f239011639..368a6911b7 100644 --- a/docs/htmldocs/pdbedit.8.html +++ b/docs/htmldocs/pdbedit.8.html @@ -1,18 +1,18 @@ -pdbedit

    Name

    pdbedit — manage the SAM database

    Synopsis

    pdbedit [-l] [-v] [-w] [-u username] [-f fullname] [-h homedir] [-D drive] [-S script] [-p profile] [-a] [-m] [-x] [-i passdb-backend] [-e passdb-backend] [-g] [-b passdb-backend] [-g] [-d debuglevel] [-s configfile] [-P account-policy] [-C value]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The pdbedit program is used to manage the users accounts +pdbedit

    Name

    pdbedit — manage the SAM database

    Synopsis

    pdbedit [-L] [-v] [-w] [-u username] [-f fullname] [-h homedir] [-D drive] [-S script] [-p profile] [-a] [-m] [-x] [-i passdb-backend] [-e passdb-backend] [-b passdb-backend] [-g] [-d debuglevel] [-s configfile] [-P account-policy] [-C value]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The pdbedit program is used to manage the users accounts stored in the sam database and can only be run by root.

    The pdbedit tool uses the passdb modular interface and is independent from the kind of users database used (currently there are smbpasswd, ldap, nis+ and tdb based and more can be added without changing the tool).

    There are five main ways to use pdbedit: adding a user account, removing a user account, modifing a user account, listing user - accounts, importing users accounts.

    OPTIONS

    -l

    This option lists all the user accounts + accounts, importing users accounts.

    OPTIONS

    -L

    This option lists all the user accounts present in the users database. This option prints a list of user/uid pairs separated by - the ':' character.

    Example: pdbedit -l

    +		the ':' character.
    Example: pdbedit -L
     sorce:500:Simo Sorce
 samba:45:Test User
    -v

    This option enables the verbose listing format. It causes pdbedit to list the users in the database, printing - out the account fields in a descriptive format.

    Example: pdbedit -l -v

    +		out the account fields in a descriptive format.
    Example: pdbedit -L -v
     ---------------
 username:       sorce
 user ID/Group:  500/500
@@ -34,8 +34,8 @@ Profile Path:   \\BERSERKER\profile
    -w

    This option sets the "smbpasswd" listing format. It will make pdbedit list the users in the database, printing out the account fields in a format compatible with the - smbpasswd file format. (see the - smbpasswd(5) for details)

    Example: pdbedit -l -w

    +		smbpasswd file format. (see the
+		smbpasswd(5) for details)
    Example: pdbedit -L -w
     sorce:500:508818B733CE64BEAAD3B435B51404EE:D2A2418EFC466A8A0F6B1DBB5C3DB80C:[UX         ]:LCT-00000000:
 samba:45:0F2B255F7B67A7A9AAD3B435B51404EE:BC281CE3F53B6A5146629CD4751D3490:[UX         ]:LCT-3BFA1E8D:
    -u username

    This option specifies the username to be @@ -44,64 +44,75 @@ samba:45:0F2B255F7B67A7A9AAD3B435B51404EE:BC281CE3F53B6A5146629CD4751D3490:[UX operations and optional in list operations.

    -f fullname

    This option can be used while adding or modifing a user account. It will specify the user's full - name.

    Example: -f "Simo Sorce"

    -h homedir

    This option can be used while adding or + name.

    Example: -f "Simo Sorce"

    -h homedir

    This option can be used while adding or modifing a user account. It will specify the user's home - directory network path.

    Example: -h "\\\\BERSERKER\\sorce" + directory network path.

    Example: -h "\\\\BERSERKER\\sorce"

    -D drive

    This option can be used while adding or modifing a user account. It will specify the windows drive - letter to be used to map the home directory.

    Example: -d "H:" + letter to be used to map the home directory.

    Example: -d "H:"

    -S script

    This option can be used while adding or modifing a user account. It will specify the user's logon - script path.

    Example: -s "\\\\BERSERKER\\netlogon\\sorce.bat" + script path.

    Example: -s "\\\\BERSERKER\\netlogon\\sorce.bat"

    -p profile

    This option can be used while adding or modifing a user account. It will specify the user's profile - directory.

    Example: -p "\\\\BERSERKER\\netlogon" -

    -a

    This option is used to add a user into the + directory.

    Example: -p "\\\\BERSERKER\\netlogon" +

    -G SID|rid

    + This option can be used while adding or modifying a user account. It + will specify the users' new primary group SID (Security Identifier) or + rid.

    Example: -G S-1-5-21-2447931902-1787058256-3961074038-1201

    -U SID|rid

    + This option can be used while adding or modifying a user account. It + will specify the users' new SID (Security Identifier) or + rid.

    Example: -U S-1-5-21-2447931902-1787058256-3961074038-5004

    -c account-control

    This option can be used while adding or modifying a user + account. It will specify the users' account control property. Possible + flags that can be set are: N, D, H, L, X. +

    Example: -c "[X ]"

    -a

    This option is used to add a user into the database. This command needs a user name specified with the -u switch. When adding a new user, pdbedit will also - ask for the password to be used.

    Example: pdbedit -a -u sorce + ask for the password to be used.

    Example: pdbedit -a -u sorce 

    new password:
 retype new password

    -

    -m

    This option may only be used in conjunction - with the -a option. It will make +

    -r

    This option is used to modify an existing user + in the database. This command needs a user name specified with the -u + switch. Other options can be specified to modify the properties of + the specified user. This flag is kept for backwards compatibility, but + it is no longer necessary to specify it. +

    -m

    This option may only be used in conjunction + with the -a option. It will make pdbedit to add a machine trust account instead of a user - account (-u username will provide the machine name).

    Example: pdbedit -a -m -u w2k-wks + account (-u username will provide the machine name).

    Example: pdbedit -a -m -u w2k-wks

    -x

    This option causes pdbedit to delete an account from the database. It needs a username specified with the - -u switch.

    Example: pdbedit -x -u bob

    -i passdb-backend

    Use a different passdb backend to retrieve users + -u switch.

    Example: pdbedit -x -u bob

    -i passdb-backend

    Use a different passdb backend to retrieve users than the one specified in smb.conf. Can be used to import data into your local user database.

    This option will ease migration from one passdb backend to - another.

    Example: pdbedit -i smbpasswd:/etc/smbpasswd.old + another.

    Example: pdbedit -i smbpasswd:/etc/smbpasswd.old

    -e passdb-backend

    Exports all currently available users to the specified password database backend.

    This option will ease migration from one passdb backend to - another and will ease backing up.

    Example: pdbedit -e smbpasswd:/root/samba-users.backup

    -g

    If you specify -g, - then -i in-backend -e out-backend + another and will ease backing up.

    Example: pdbedit -e smbpasswd:/root/samba-users.backup

    -g

    If you specify -g, + then -i in-backend -e out-backend applies to the group mapping instead of the user database.

    This option will ease migration from one passdb backend to - another and will ease backing up.

    -g

    If you specify -g, - then -i in-backend -e out-backend - applies to the group mapping instead of the user database.

    This option will ease migration from one passdb backend to - another and will ease backing up.

    -b passdb-backend

    Use a different default passdb backend.

    Example: pdbedit -b xml:/root/pdb-backup.xml -l

    -P account-policy

    Display an account policy

    Valid policies are: minimum password age, reset count minutes, disconnect time, + another and will ease backing up.

    -b passdb-backend

    Use a different default passdb backend.

    Example: pdbedit -b xml:/root/pdb-backup.xml -l

    -P account-policy

    Display an account policy

    Valid policies are: minimum password age, reset count minutes, disconnect time, user must logon to change password, password history, lockout duration, min password length, - maximum password age and bad lockout attempt.

    Example: pdbedit -P "bad lockout attempt"

    +		maximum password age and bad lockout attempt.
    Example: pdbedit -P "bad lockout attempt"
     account policy value for bad lockout attempt is 0
    -C account-policy-value

    Sets an account policy to a specified value. This option may only be used in conjunction - with the -P option. -

    Example: pdbedit -P "bad lockout attempt" -C 3

    +		with the -P option.
+		
    Example: pdbedit -P "bad lockout attempt" -C 3
     account policy value for bad lockout attempt was 0
 account policy value for bad lockout attempt is now 3
    -h|--help

    Print a summary of command line options.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -115,17 +126,11 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client. -

    NOTES

    This command may be used only by root.

    VERSION

    This man page is correct for version 2.2 of - the Samba suite.

    SEE ALSO

    smbpasswd(5), samba(7)

    AUTHOR

    The original Samba software and related utilities +

    NOTES

    This command may be used only by root.

    VERSION

    This man page is correct for version 3.0 of + the Samba suite.

    SEE ALSO

    smbpasswd(5), samba(7)

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar - to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. - The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 - release by Jeremy Allison. The conversion to DocBook for - Samba 2.2 was done by Gerald Carter. The conversion to DocBook - XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    + to the way the Linux kernel is developed.

    diff --git a/docs/htmldocs/printing.html b/docs/htmldocs/printing.html index 620aa5e8ba..089bba6e0f 100644 --- a/docs/htmldocs/printing.html +++ b/docs/htmldocs/printing.html @@ -1,581 +1,2240 @@ - -Chapter 13. Printing Support
    Chapter 13. Printing Support
    Prev Part III. Advanced Configuration Next

    Chapter 13. Printing Support

    Gerald (Jerry) Carter

    Samba Team

    <jerry@samba.org>

    Patrick Powell

    <papowell@lprng.org>

    (3 May 2001)

    Table of Contents

    Introduction
    Configuration
    Creating [print$]
    Setting Drivers for Existing Printers
    Support a large number of printers
    Adding New Printers via the Windows NT APW
    Samba and Printer Ports
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints server
    The Installation Client
    Diagnosis
    Introduction
    Debugging printer problems
    What printers do I have?
    Setting up printcap and print servers
    Job sent, no output
    Job sent, strange output
    Raw PostScript printed
    Advanced Printing
    Real debugging

    Introduction

    Beginning with the 2.2.0 release, Samba supports -the native Windows NT printing mechanisms implemented via -MS-RPC (i.e. the SPOOLSS named pipe). Previous versions of -Samba only supported LanMan printing calls.

    The additional functionality provided by the new -SPOOLSS support includes:

    • Support for downloading printer driver - files to Windows 95/98/NT/2000 clients upon demand. -

    • Uploading of printer drivers via the - Windows NT Add Printer Wizard (APW) or the - Imprints tool set (refer to http://imprints.sourceforge.net). -

    • Support for the native MS-RPC printing - calls such as StartDocPrinter, EnumJobs(), etc... (See - the MSDN documentation at http://msdn.microsoft.com/ - for more information on the Win32 printing API) -

    • Support for NT Access Control Lists (ACL) - on printer objects

    • Improved support for printer queue manipulation - through the use of an internal databases for spooled job - information

    -There has been some initial confusion about what all this means -and whether or not it is a requirement for printer drivers to be -installed on a Samba host in order to support printing from Windows -clients. As a side note, Samba does not use these drivers in any way to process -spooled files. They are utilized entirely by the clients. -

    -The following MS KB article, may be of some help if you are dealing with -Windows 2000 clients: How to Add Printers with No User -Interaction in Windows 2000 -

    -http://support.microsoft.com/support/kb/articles/Q189/1/05.ASP -

    Configuration

    [print$] vs. [printer$]

    -Previous versions of Samba recommended using a share named [printer$]. -This name was taken from the printer$ service created by Windows 9x -clients when a printer was shared. Windows 9x printer servers always have -a printer$ service which provides read-only access via no -password in order to support printer driver downloads. -

    -However, the initial implementation allowed for a -parameter named printer driver location -to be used on a per share basis to specify the location of -the driver files associated with that printer. Another -parameter named printer driver provided -a means of defining the printer driver name to be sent to -the client. -

    Creating [print$]

    -In order to support the uploading of printer driver -files, you must first configure a file share named [print$]. -The name of this share is hard coded in Samba's internals so -the name is very important (print$ is the service used by -Windows NT print servers to provide support for printer driver -download). -

    You should modify the server's smb.conf file to add the global -parameters and to create the -following file share (of course, some of the parameter values, -such as 'path' are arbitrary and should be replaced with -appropriate values for your site):

    -[global]
-    ; members of the ntadmin group should be able
-    ; to add drivers and set printer properties
-    ; root is implicitly a 'printer admin'
-    printer admin = @ntadmin
-
-[print$]
-    path = /usr/local/samba/printers
-    guest ok = yes
-    browseable = yes
-    read only = yes
-    ; since this share is configured as read only, then we need
-    ; a 'write list'.  Check the file system permissions to make
-    ; sure this account can copy files to the share.  If this
-    ; is setup to a non-root account, then it should also exist
-    ; as a 'printer admin'
-    write list = @ntadmin,root
-

    The -write list is used to allow administrative -level user accounts to have write access in order to update files -on the share. See the smb.conf(5) -man page for more information on configuring file shares.

    The requirement for guest -ok = yes depends upon how your -site is configured. If users will be guaranteed to have -an account on the Samba host, then this is a non-issue.

    Author's Note

    -The non-issue is that if all your Windows NT users are guaranteed to be -authenticated by the Samba server (such as a domain member server and the NT -user has already been validated by the Domain Controller in -order to logon to the Windows NT console), then guest access -is not necessary. Of course, in a workgroup environment where -you just want to be able to print without worrying about -silly accounts and security, then configure the share for -guest access. You'll probably want to add map to guest = Bad User - in the [global] section as well. Make sure -you understand what this parameter does before using it -though. --jerry -

    In order for a Windows NT print server to support -the downloading of driver files by multiple client architectures, -it must create subdirectories within the [print$] service -which correspond to each of the supported client architectures. -Samba follows this model as well.

    Next create the directory tree below the [print$] share -for each architecture you wish to support.

    -[print$]----- - |-W32X86 ; "Windows NT x86" - |-WIN40 ; "Windows 95/98" - |-W32ALPHA ; "Windows NT Alpha_AXP" - |-W32MIPS ; "Windows NT R4000" - |-W32PPC ; "Windows NT PowerPC" -

    ATTENTION! REQUIRED PERMISSIONS

    -In order to currently add a new driver to you Samba host, -one of two conditions must hold true: -

    • The account used to connect to the Samba host - must have a uid of 0 (i.e. a root account)

    • The account used to connect to the Samba host - must be a member of the printer - admin list.

    -Of course, the connected account must still possess access -to add files to the subdirectories beneath [print$]. Remember -that all file shares are set to 'read only' by default. -

    -Once you have created the required [print$] service and -associated subdirectories, simply log onto the Samba server using -a root (or printer admin) account -from a Windows NT 4.0/2k client. Open "Network Neighbourhood" or -"My Network Places" and browse for the Samba host. Once you have located -the server, navigate to the "Printers..." folder. -You should see an initial listing of printers -that matches the printer shares defined on your Samba host. -

    Setting Drivers for Existing Printers

    The initial listing of printers in the Samba host's -Printers folder will have no real printer driver assigned -to them. This defaults to a NULL string to allow the use -of the local Add Printer Wizard on NT/2000 clients. -Attempting to view the printer properties for a printer -which has this default driver assigned will result in -the error message:

    -Device settings cannot be displayed. The driver -for the specified printer is not installed, only spooler -properties will be displayed. Do you want to install the -driver now? -

    -Click "No" in the error dialog and you will be presented with -the printer properties window. The way to assign a driver to a -printer is to either -

    • Use the "New Driver..." button to install - a new printer driver, or

    • Select a driver from the popup list of - installed drivers. Initially this list will be empty.

    If you wish to install printer drivers for client -operating systems other than "Windows NT x86", you will need -to use the "Sharing" tab of the printer properties dialog.

    Assuming you have connected with a root account, you -will also be able modify other printer properties such as -ACLs and device settings using this dialog box.

    A few closing comments for this section, it is possible -on a Windows NT print server to have printers -listed in the Printers folder which are not shared. Samba does -not make this distinction. By definition, the only printers of -which Samba is aware are those which are specified as shares in -smb.conf.

    Another interesting side note is that Windows NT clients do -not use the SMB printer share, but rather can print directly -to any printer on another Windows NT host using MS-RPC. This -of course assumes that the printing client has the necessary -privileges on the remote host serving the printer. The default -permissions assigned by Windows NT to a printer gives the "Print" -permissions to the "Everyone" well-known group. -

    Support a large number of printers

    One issue that has arisen during the development -phase of Samba 2.2 is the need to support driver downloads for -100's of printers. Using the Windows NT APW is somewhat -awkward to say the list. If more than one printer are using the -same driver, the rpcclient's -setdriver command can be used to set the driver -associated with an installed driver. The following is example -of how this could be accomplished:

    -$ rpcclient pogo -U root%secret -c "enumdrivers" -

     
-Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
- 
-[Windows NT x86]
-Printer Driver Info 1:
-     Driver Name: [HP LaserJet 4000 Series PS]
- 
-Printer Driver Info 1:
-     Driver Name: [HP LaserJet 2100 Series PS]
- 
-Printer Driver Info 1:
-     Driver Name: [HP LaserJet 4Si/4SiMX PS]
-

    -$ rpcclient pogo -U root%secret -c "enumprinters" +Chapter 18. Classical Printing Support

    Chapter 18. Classical Printing Support
    Prev Part III. Advanced Configuration Next

    Chapter 18. Classical Printing Support

    Kurt Pfeifle

    Danka Deutschland GmbH

    Gerald (Jerry) Carter

    Samba Team

    May 32, 2003

    Table of Contents

    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    Parameters for Backwards Compatibility
    Parameters no longer in use
    A simple Configuration to Print with Samba-3
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print with Samba-3
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various Unix Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba-3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with +rpcclient
    "The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure)
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a +different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba-3
    Publishing Printer Information in Active Directory or LDAP
    Common Errors and Problems
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost

    Features and Benefits

    +Printing is often a mission-critical service for the users. Samba can +provide this service reliably and seamlessly for a client network +consisting of Windows workstations. +

    +A Samba-3.0 print service may be run on a Standalone or a Domain +member server, side by side with file serving functions, or on a +dedicated print server. It can be made as tight or as loosely secured +as needs dictate. Configurations may be simple or complex. Available +authentication schemes are essentially the same as described for file +services in previous chapters. Overall, Samba's printing support is +now able to replace an NT or Windows 2000 print server full-square, +with additional benefits in many cases. Clients may download and +install drivers and printers through their familiar "Point'n'Print" +mechanism. Printer installations executed by "Logon Scripts" are no +problem. Administrators can upload and manage drivers to be used by +clients through the familiar "Add Printer Wizard". As an additional +benefit, driver and printer management may be run from the command line +or through scripts, making it more efficient in case of large numbers +of printers. If a central accounting of print jobs (tracking every +single page and supplying the raw data for all sorts of statistical +reports) is required, this is best supported by CUPS as the print +subsystem underneath the Samba hood. +

    +This chapter deals with the foundations of Samba printing, as they +implemented by the more traditional UNIX (BSD- and System V-style) +printing systems. Many things apply to CUPS, the newer Common UNIX +Printing System, too; so if you use CUPS, you might be tempted to jump +to the next chapter -- but you will certainly miss a few things if you +do so. Better read this chapter too. +

    Note

    +Most of the given examples have been verified on Windows XP +Professional clients. Where this document describes the responses to +commands given, bear in mind that Windows 2000 clients are very +similar, but may differ in details. Windows NT is somewhat different +again. +

    Technical Introduction

    +Samba's printing support always relies on the installed print +subsystem of the Unix OS it runs on. Samba is a "middleman". It takes +printfiles from Windows (or other SMB) clients and passes them to the +real printing system for further processing. Therefore it needs to +"talk" to two sides: to the Windows print clients and to the Unix +printing system. Hence we must differentiate between the various +client OS types each of which behave differently, as well as the +various UNIX print subsystems, which themselves have different +features and are accessed differently. This part of the Samba HOWTO +Collection deals with the "traditional" way of Unix printing first; +the next chapter covers in great detail the more modern +Common UNIX Printing System +(CUPS). + +

    Important

    CUPS users, be warned: don't just jump on to the next +chapter. You might miss important information contained only +here!

    +

    What happens if you send a Job from a Client

    +To successfully print a job from a Windows client via a Samba +print server to a UNIX printer, there are 6 (potentially 7) +stages: +

    1. Windows opens a connection to the printershare

    2. Samba must authenticate the user

    3. Windows sends a copy of the printfile over the network +into Samba's spooling area

    4. Windows closes the connection again

    5. Samba invokes the print command to hand the file over +to the UNIX print subsystem's spooling area

    6. The Unix print subsystem processes the print +job

    7. The printfile may need to be explicitly deleted +from the Samba spooling area.

    Printing Related Configuration Parameters

    +There are a number of configuration parameters in + controlling Samba's printing +behaviour. Please also refer to the man page for smb.conf to +acquire an overview about these. As with other parameters, there are +Global Level (tagged with a "G" in the listings) and +Service Level ("S") parameters. +

    Service Level Parameters

    These may go into the +[global] section of +. In this case they define the default +behaviour of all individual or service level shares (provided those +don't have a different setting defined for the same parameter, thus +overriding the global default).

    Global Parameters

    These may not go into individual +shares. If they go in by error, the "testparm" utility can discover +this (if you run it) and tell you so.

    Parameters Recommended for Use

    The following smb.conf parameters directly +related to printing are used in Samba-3. See also the +smb.conf man page for detailed explanations: +

    List of printing related parameters in Samba-3.  +

    Global level parameters:

    • addprinter command (G)

    • deleteprinter command (G)

    • disable spoolss (G)

    • enumports command (G)

    • load printers (G)

    • lpq cache time (G)

    • os2 driver map (G)

    • printcap name (G), printcap (G)

    • show add printer wizard (G)

    • total print jobs (G)

    • use client driver (G)

    + +

    Service level parameters:

    • hosts allow (S)

    • hosts deny (S)

    • lppause command (S)

    • lpq command (S)

    • lpresume command (S)

    • lprm command (S)

    • max print jobs (S)

    • min print space (S)

    • print command (S)

    • printable (S), print ok (S)

    • printer name (S), printer (S)

    • printer admin (S)

    • printing = [cups|bsd|lprng...] (S)

    • queuepause command (S)

    • queueresume command (S)

    • total print jobs (S)

    +

    +Samba's printing support implements the Microsoft Remote Procedure +Calls (MS-RPC) methods for printing. These are used by Windows NT (and +later) print servers. The old "LanMan" protocol is still supported as +a fallback resort, and for older clients to use. More details will +follow further beneath. +

    Parameters for Backwards Compatibility

    +Two new parameters that were added in Samba 2.2.2, are still present +in Samba-3.0. Both of these options are described in the +smb.conf man page and are disabled by +default. Use them with caution! +

    disable spoolss(G)

    This is +provided for better support of Samba 2.0.x backwards capability. It +will disable Samba's support for MS-RPC printing and yield identical +printing behaviour to Samba 2.0.x.

    use client driver (G)

    was provided +for using local printer drivers on Windows NT/2000 clients. It does +not apply to Windows 95/98/ME clients.

    Parameters "for backward compatibility only", use with caution.  +

    • disable spoolss (G)

    • use client driver (S)

    +

    Parameters no longer in use

    +Samba users upgrading from 2.2.x to 3.0 need to be aware that some +previously available settings are no longer supported (as was +announced some time ago). Here is a list of them: +

    "old" parameters, removed in Samba-3.  +The following smb.conf parameters have been +deprecated already in Samba 2.2 and are now completely removed from +Samba-3. You cannot use them in new 3.0 installations: + +

    • printer driver file (G)

    • total print jobs (G)

    • postscript (S)

    • printer driver (S)

    • printer driver location (S)

    +

    A simple Configuration to Print with Samba-3

    +Here is a very simple example configuration for print related settings +in the file. If you compare it with your +own system's , you probably find some +additional parameters included there (as pre-configured by your OS +vendor). Further below is a discussion and explanation of the +parameters. Note, that this example doesn't use many parameters. +However, in many environments these are enough to provide a valid + which enables all clients to print. 

    -Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
-     flags:[0x800000]
-     name:[\\POGO\hp-print]
-     description:[POGO\\POGO\hp-print,NO DRIVER AVAILABLE FOR THIS PRINTER,]
-     comment:[]
-				  
+ [global]
+         printing = bsd
+         load printers = yes
+
+ [printers]
+         path = /var/spool/samba
+         printable = yes
+         public = yes
+         writable = no

    -$ rpcclient pogo -U root%secret -c "setdriver hp-print \"HP LaserJet 4000 Series PS\"" -

    -Domain=[NARNIA] OS=[Unix] Server=[Samba 2.2.0-alpha3]
-Successfully set hp-print to driver HP LaserJet 4000 Series PS.
-

    Adding New Printers via the Windows NT APW

    -By default, Samba offers all printer shares defined in smb.conf -in the "Printers..." folder. Also existing in this folder is the Windows NT -Add Printer Wizard icon. The APW will be show only if -

    • The connected user is able to successfully - execute an OpenPrinterEx(\\server) with administrative - privileges (i.e. root or printer admin). -

    • show - add printer wizard = yes (the default). -

    -In order to be able to use the APW to successfully add a printer to a Samba -server, the add -printer command must have a defined value. The program -hook must successfully add the printer to the system (i.e. -/etc/printcap or appropriate files) and -smb.conf if necessary. -

    -When using the APW from a client, if the named printer share does -not exist, smbd will execute the add printer -command and reparse to the smb.conf -to attempt to locate the new printer share. If the share is still not defined, -an error of "Access Denied" is returned to the client. Note that the -add printer program is executed under the context -of the connected user, not necessarily a root account. -

    -There is a complementary delete -printer command for removing entries from the "Printers..." -folder. -

    -The following is an example add printer command script. It adds the appropriate entries to /etc/printcap.local (change that to what you need) and returns a line of 'Done' which is needed for the whole process to work. -

    -#!/bin/sh
-
-# Script to insert a new printer entry into printcap.local
-#
-# $1, printer name, used as the descriptive name
-# $2, share name, used as the printer name for Linux
-# $3, port name
-# $4, driver name
-# $5, location, used for the device file of the printer
-# $6, win9x location
-
-#
-# Make sure we use the location that RedHat uses for local printer defs
-PRINTCAP=/etc/printcap.local
-DATE=`date +%Y%m%d-%H%M%S`
-LP=lp
-RESTART="service lpd restart"
-
-# Keep a copy
-cp $PRINTCAP $PRINTCAP.$DATE
-# Add the printer to $PRINTCAP
-echo ""				 			>> $PRINTCAP
-echo "$2|$1:\\" 					>> $PRINTCAP
-echo "  :sd=/var/spool/lpd/$2:\\" 			>> $PRINTCAP
-echo "  :mx=0:ml=0:sh:\\" 				>> $PRINTCAP
-echo "  :lp=/usr/local/samba/var/print/$5.prn:" 	>> $PRINTCAP
-
-touch "/usr/local/samba/var/print/$5.prn" >> /tmp/printadd.$$ 2>&1
-chown $LP "/usr/local/samba/var/print/$5.prn" >> /tmp/printadd.$$ 2>&1
-
-mkdir /var/spool/lpd/$2
-chmod 700 /var/spool/lpd/$2
-chown $LP /var/spool/lpd/$2
-#echo $1 >> "/usr/local/samba/var/print/$5.prn"
-#echo $2 >> "/usr/local/samba/var/print/$5.prn"
-#echo $3 >> "/usr/local/samba/var/print/$5.prn"
-#echo $4 >> "/usr/local/samba/var/print/$5.prn"
-#echo $5 >> "/usr/local/samba/var/print/$5.prn"
-#echo $6 >> "/usr/local/samba/var/print/$5.prn"
-$RESTART >> "/usr/local/samba/var/print/$5.prn"
-# Not sure if this is needed
-touch /usr/local/samba/lib/smb.conf
-#
-# You need to return a value, but I am not sure what it means.
-#
-echo "Done"
-exit 0
-

    Samba and Printer Ports

    -Windows NT/2000 print servers associate a port with each printer. These normally -take the form of LPT1:, COM1:, FILE:, etc... Samba must also support the -concept of ports associated with a printer. By default, only one printer port, -named "Samba Printer Port", exists on a system. Samba does not really a port in -order to print, rather it is a requirement of Windows clients. -

    -Note that Samba does not support the concept of "Printer Pooling" internally -either. This is when a logical printer is assigned to multiple ports as -a form of load balancing or fail over. -

    -If you require that multiple ports be defined for some reason, -smb.conf possesses a enumports -command which can be used to define an external program -that generates a listing of ports on a system. -

    The Imprints Toolset

    The Imprints tool set provides a UNIX equivalent of the - Windows NT Add Printer Wizard. For complete information, please - refer to the Imprints web site at - http://imprints.sourceforge.net/ as well as the documentation - included with the imprints source distribution. This section will - only provide a brief introduction to the features of Imprints.

    What is Imprints?

    Imprints is a collection of tools for supporting the goals - of

    • Providing a central repository information - regarding Windows NT and 95/98 printer driver packages

    • Providing the tools necessary for creating - the Imprints printer driver packages.

    • Providing an installation client which - will obtain and install printer drivers on remote Samba - and Windows NT 4 print servers.

    Creating Printer Driver Packages

    The process of creating printer driver packages is beyond - the scope of this document (refer to Imprints.txt also included - with the Samba distribution for more information). In short, - an Imprints driver package is a gzipped tarball containing the - driver files, related INF files, and a control file needed by the - installation client.

    The Imprints server

    The Imprints server is really a database server that - may be queried via standard HTTP mechanisms. Each printer - entry in the database has an associated URL for the actual - downloading of the package. Each package is digitally signed - via GnuPG which can be used to verify that package downloaded - is actually the one referred in the Imprints database. It is - not recommended that this security check - be disabled.

    The Installation Client

    More information regarding the Imprints installation client - is available in the Imprints-Client-HOWTO.ps - file included with the imprints source package.

    The Imprints installation client comes in two forms.

    • a set of command line Perl scripts

    • a GTK+ based graphical interface to - the command line perl scripts

    The installation client (in both forms) provides a means - of querying the Imprints database server for a matching - list of known printer model names as well as a means to - download and install the drivers on remote Samba and Windows - NT print servers.

    The basic installation process is in four steps and - perl code is wrapped around smbclient - and rpcclient.

    	
-foreach (supported architecture for a given driver)
-{
-     1.  rpcclient: Get the appropriate upload directory 
-         on the remote server
-     2.  smbclient: Upload the driver files
-     3.  rpcclient: Issues an AddPrinterDriver() MS-RPC
-}
-	
-4.  rpcclient: Issue an AddPrinterEx() MS-RPC to actually
-    create the printer
-

    One of the problems encountered when implementing - the Imprints tool set was the name space issues between - various supported client architectures. For example, Windows - NT includes a driver named "Apple LaserWriter II NTX v51.8" - and Windows 95 calls its version of this driver "Apple - LaserWriter II NTX"

    The problem is how to know what client drivers have - been uploaded for a printer. As astute reader will remember - that the Windows NT Printer Properties dialog only includes - space for one printer driver name. A quick look in the - Windows NT 4.0 system registry at

    HKLM\System\CurrentControlSet\Control\Print\Environment -

    will reveal that Windows NT always uses the NT driver - name. This is ok as Windows NT always requires that at least - the Windows NT version of the printer driver is present. - However, Samba does not have the requirement internally. - Therefore, how can you use the NT driver name if is has not - already been installed?

    The way of sidestepping this limitation is to require - that all Imprints printer driver packages include both the Intel - Windows NT and 95/98 printer drivers and that NT driver is - installed first.

    Diagnosis

    Introduction

    -This is a short description of how to debug printing problems with -Samba. This describes how to debug problems with printing from a SMB -client to a Samba server, not the other way around. For the reverse -see the examples/printing directory. -

    -Ok, so you want to print to a Samba server from your PC. The first -thing you need to understand is that Samba does not actually do any -printing itself, it just acts as a middleman between your PC client -and your Unix printing subsystem. Samba receives the file from the PC -then passes the file to a external "print command". What print command -you use is up to you. -

    -The whole things is controlled using options in smb.conf. The most -relevant options (which you should look up in the smb.conf man page) -are: -

    -      [global]
-        print command     - send a file to a spooler
-        lpq command       - get spool queue status
-        lprm command      - remove a job
-      [printers]
-        path = /var/spool/lpd/samba
+This is only an example configuration. Many settings, if not
+explicitly set to a specific value, are used and set by Samba
+implicitly to its own default, because these have been compiled in.
+To see all settings, let root use the testparm
+utility. testparm also gives warnings if you have
+mis-configured certain things. Its complete output is easily 340 lines
+and more. You may want to pipe it through a pager program.
+
    
+The syntax for the configuration file is easy to grasp. You should
+know that  is not very picky about its
+syntax. It has been explained elsewhere in this document. A short
+reminder: It even tolerates some spelling errors (like "browsable"
+instead of "browseable"). Most spelling is case-insensitive. Also, you
+can use "Yes|No" or "True|False" for boolean settings. Lists of names
+may be separated by commas, spaces or tabs.
+
    Verification of "Settings in Use" with testparm
    
+To see all (or at least most) printing related settings in Samba,
+including the implicitly used ones, try the command outlined below
+(hit "ENTER" twice!). It greps for all occurrences of "lp", "print",
+"spool", "driver", "ports" and "[" in testparm's output and gives you
+a nice overview about the running smbd's print configuration. (Note
+that this command does not show individually created printer shares,
+or the spooling paths in each case). Here is the output of my Samba
+setup, with exactly the same settings in 
+as shown above:
+
    +root# testparm -v | egrep "(lp|print|spool|driver|ports|\[)"
+ Load smb config files from /etc/samba/smb.conf.simpleprinting
+ Processing section "[homes]"
+ Processing section "[printers]"
+ 
+ [global]
+        smb ports = 445 139
+        lpq cache time = 10
+        total print jobs = 0
+        load printers = Yes
+        printcap name = /etc/printcap
+        disable spoolss = No
+        enumports command =
+        addprinter command = 
+        deleteprinter command = 
+        show add printer wizard = Yes
+        os2 driver map =
+        printer admin =
+        min print space = 0
+        max print jobs = 1000
+        printable = No
+        printing = bsd
+        print command = lpr -r -P'%p' %s
+        lpq command = lpq -P'%p'
+        lprm command = lprm -P'%p' %j
+        lppause command =
+        lpresume command =
+        printer name =
+        use client driver = No
+
+ [homes]
+
+ [printers]
+        path = /var/spool/samba
+        printable = Yes
+
 
    
-The following are nice to know about:
-
    -        queuepause command   - stop a printer or print queue
-        queueresume command  - start a printer or print queue
+You can easily verify which settings were implicitly added by Samba's
+default behaviour. Don't forget about this point: it may
+be important in your future dealings with Samba.
+
    Note
     testparm in Samba-3.0 behaves differently from 2.2.x: used
+without the "-v" switch it only shows you the settings actually
+written into ! To see the complete
+configuration used, add the "-v" parameter to testparm.
    A little Experiment to warn you
    
+Should you need to troubleshoot at any stage, please always come back
+to this point first and verify if "testparm" shows the parameters you
+expect! To give you an example from personal experience as a warning,
+try to just "comment out" the load printers"
+parameter. If your 2.2.x system behaves like mine, you'll see this:
+
    +root# grep "load printers" /etc/samba/smb.conf
+ #      load printers = Yes
+        # This setting is commented ooouuuuut!!
+
+root# testparm -v /etc/samba/smb.conf | egrep "(load printers)"
+        load printers = Yes
+
 
    
-Example:
-
    -        print command = /usr/bin/lpr -r -P%p %s
-        lpq command   = /usr/bin/lpq    -P%p %s
-        lprm command  = /usr/bin/lprm   -P%p %j
-        queuepause command = /usr/sbin/lpc -P%p stop
-        queuepause command = /usr/sbin/lpc -P%p start
+Despite my imagination that the commenting out of this setting should
+prevent Samba from publishing my printers, it still did! Oh Boy -- it
+cost me quite some time to find out the reason. But I am not fooled
+any more... at least not by this ;-)
+
    +root# grep -A1 "load printers" /etc/samba/smb.conf
+        load printers = No
+        # This setting is what I mean!!
+ #      load printers = Yes
+        # This setting is commented ooouuuuut!!
+
+root# testparm -v smb.conf.simpleprinting | egrep "(load printers)"
+        load printers = No
+
 
    
-Samba should set reasonable defaults for these depending on your
-system type, but it isn't clairvoyant. It is not uncommon that you
-have to tweak these for local conditions.  The commands should
-always have fully specified pathnames,  as the smdb may not have
-the correct PATH values.
-
    
-When you send a job to Samba to be printed,  it will make a temporary
-copy of it in the directory specified in the [printers] section.
-and it should be periodically cleaned out.  The lpr -r option
-requests that the temporary copy be removed after printing; If
-printing fails then you might find leftover files in this directory,
-and it should be periodically cleaned out.  Samba used the lpq
-command to determine the "job number" assigned to your print job
-by the spooler.
-
    
-The %>letter< are "macros" that get dynamically replaced with appropriate
-values when they are used. The %s gets replaced with the name of the spool
-file that Samba creates and the %p gets replaced with the name of the
-printer. The %j gets replaced with the "job number" which comes from
-the lpq output.
-
    Debugging printer problems
    
-One way to debug printing problems is to start by replacing these
-command with shell scripts that record the arguments and the contents
-of the print file. A simple example of this kind of things might
-be:
-
    -	print command = /tmp/saveprint %p %s
-
-    #!/bin/saveprint
-    # we make sure that we are the right user
-    /usr/bin/id -p >/tmp/tmp.print
-    # we run the command and save the error messages
-    # replace the command with the one appropriate for your system
-    /usr/bin/lpr -r -P$1 $2 2>>&/tmp/tmp.print
+Only when setting the parameter explicitly to
+"load printers = No"
+would Samba recognize my intentions. So my strong advice is:
+
    • Never rely on "commented out" parameters!
    • Always set it up explicitly as you intend it to
+behave.
    • Use testparm to uncover hidden
+settings which might not reflect your intentions.
    
+You can have a working Samba print configuration with this
+minimal :
+
    +root# cat /etc/samba/smb.conf-minimal
+        [printers]
+
 
    
-Then you print a file and try removing it.  You may find that the
-print queue needs to be stopped in order to see the queue status
-and remove the job:
-
    +This example should show you that you can use testparm to test any
+filename for fitness as a Samba configuration. Actually, we want to
+encourage you not to change your
+ on a working system (unless you know
+exactly what you are doing)! Don't rely on an assumption that changes
+will only take effect after you re-start smbd!  This is not the
+case. Samba re-reads its  every 60
+seconds and on each new client connection. You might have to face
+changes for your production clients that you didn't intend to apply at
+this time! You will now note a few more interesting things. Let's now
+ask testparm what the Samba print configuration
+would be, if you used this minimalistic file as your real
+:
+
    +root#  testparm -v /etc/samba/smb.conf-minimal | egrep "(print|lpq|spool|driver|ports|[)"
+ Processing section "[printers]"
+ WARNING: [printers] service MUST be printable!
+ No path in service printers - using /tmp
+
+        lpq cache time = 10
+        total print jobs = 0
+        load printers = Yes
+        printcap name = /etc/printcap
+        disable spoolss = No
+        enumports command =
+        addprinter command =
+        deleteprinter command =
+        show add printer wizard = Yes
+        os2 driver map =
+        printer admin =
+        min print space = 0
+        max print jobs = 1000
+        printable = No
+        printing = bsd
+        print command = lpr -r -P%p %s
+        lpq command = lpq -P%p
+        printer name =
+        use client driver = No
+ [printers]
+        printable = Yes
 
-h4: {42} % echo hi >/tmp/hi
-h4: {43} % smbclient //localhost/lw4
-added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0
-Password: 
-Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7]
-smb: \> print /tmp/hi
-putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s)
-smb: \> queue
-1049     3            hi-17534
-smb: \> cancel 1049
-Error cancelling job 1049 : code 0
-smb: \> cancel 1049
-Job 1049 cancelled
-smb: \> queue
-smb: \> exit
 
    
-The 'code 0' indicates that the job was removed.  The comment
-by the  smbclient is a bit misleading on this.
-You can observe the command output and then and look at the
-/tmp/tmp.print file to see what the results are.  You can quickly
-find out if the problem is with your printing system.  Often people
-have problems with their /etc/printcap file or permissions on
-various print queues.
-
    What printers do I have?
    
-You can use the 'testprns' program to check to see if the printer
-name you are using is recognized by Samba.  For example,  you can
-use:
+testparm issued 2 warnings:
+
    • because we didn't specify the
+[printers] section as printable,
+and
    • because we didn't tell it which spool directory to
+use.
    
+However, this was not fatal, and Samba-3.0 will default to values that
+will work here. But, please!, don't rely on this and don't use this
+example! This was only meant to make you careful to design and specify
+your setup to be what you really want it to be. The outcome on your
+system may vary for some parameters, since you may have a Samba built
+with a different compile-time configuration.
+Warning: don't put a comment sign at
+the end of a valid  line. It
+will cause the parameter to be ignored (just as if you had put the
+comment sign at the front). At first I regarded this as a bug in my
+Samba version(s). But the man page states: “Internal whitespace
+in a parameter value is retained verbatim.” This means that a
+line consisting of, for example,
+
    +printing = lprng     #This defines LPRng as the printing system"
+
    
+will regard the whole of the string after the "="
+sign as the value you want to define. And this is an invalid value
+that will be ignored, and a default value used instead.]
+

    Extended Sample Configuration to Print with Samba-3

    +Here we show a more verbose example configuration for print related +settings in an . Below is a discussion +and explanation of the various parameters. We chose to use BSD-style +printing here, because we guess it is still the most commonly used +system on legacy Linux installations (new installs now predominantly +have CUPS, which is discussed entirely in the next chapter of this +document). Note, that this example explicitly names many parameters +which don't need to be stated because they are set by default. You +might be able to do with a leaner .

    Tip

    +if you read access it with the Samba Web Administration Tool (SWAT), +and then write it to disk again, it will be optimized in a way such +that it doesn't contain any superfluous parameters and comments. SWAT +organizes the file for best performance. Remember that each smbd +re-reads the Samba configuration once a minute, and that each +connection spawns an smbd process of its own, so it is not a bad idea +to optimize the in environments with +hundreds or thousands of clients.

    + [global]
+         printing = bsd
+         load printers = yes
+         show add printer wizard = yes
+         printcap name = /etc/printcap
+         printer admin = @ntadmin, root
+         total print jobs = 100
+         lpq cache time = 20
+         use client driver = no
+
+ [printers]
+         comment = All Printers
+         printable = yes
+         path = /var/spool/samba
+         browseable = no
+         guest ok = yes
+         public = yes
+         read only = yes
+         writable = no       
+
+ [my_printer_name]
+         comment = Printer with Restricted Access
+         path = /var/spool/samba_my_printer
+         printer admin = kurt
+         browseable = yes
+         printable = yes
+         writeable = no
+         hosts allow = 0.0.0.0
+         hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60
+         guest ok = no
+

    +This also is only an example configuration. You +may not find all the settings in your own + (as pre-configured by your OS +vendor). Many configuration parameters, if not explicitly set to a +specific value, are used and set by Samba implicitly to its own +default, because these have been compiled in. To see all settings, let +root use the testparm +utility. testparm also gives warnings if you have +mis-configured certain things.. +

    Detailed Explanation of the Example's Settings

    +Following is a discussion of the settings from above shown example. +

    The [global] Section

    +The [global] section is one of 4 special +sections (along with [[homes], +[printers] and +[print$]...) It contains all parameters which +apply to the server as a whole. It is the place for parameters which +have only a "global" meaning (G). It may also contain service level +parameters (S) which then define default settings for all other +sections and shares. This way you can simplify the configuration and +avoid setting the same value repeatedly. (Within each individual +section or share you may however override these globally set "share +level" settings and specify other values). +

    printing = bsd

    this causes Samba to use default print commands +applicable for the BSD (a.k.a. RFC 1179 style or LPR/LPD) printing +system. In general, the "printing" parameter informs Samba about the +print subsystem it should expect. Samba supports CUPS, LPD, LPRNG, +SYSV, HPUX, AIX, QNX and PLP. Each of these systems defaults to a +different print command (and other queue control +commands).

    Caution

    The printing parameter is +normally a service level parameter. Since it is included here in the +[global] section, it will take effect for all +printer shares that are not defined differently. Samba-3.0 no longer +supports the SOFTQ printing system.

    load printers = yes

    this tells Samba to create automatically all +available printer shares. "Available" printer shares are discovered by +scanning the printcap file. All created printer shares are also loaded +for browsing. If you use this parameter, you do not need to specify +separate shares for each printer. Each automatically created printer +share will clone the configuration options found in the +[printers] section. (A load printers += no setting will allow you to specify each UNIX printer +you want to share separately, leaving out some you don't want to be +publicly visible and available).

    show add printer wizard = +yes

    this setting is normally +enabled by default (even if the parameter is not written into the +). It makes the Add Printer Wizard icon +show up in the Printers folder of the Samba host's +share listing (as shown in Network Neighbourhood or +by the net view command). To disable it, you need to +explicitly set it to no (commenting it out +will not suffice!). The Add Printer Wizard lets you upload printer +drivers to the [print$] share and associate it +with a printer (if the respective queue exists there before the +action), or exchange a printer's driver against any other previously +uploaded driver.

    total print jobs = 100

    this setting sets the upper limit to 100 print jobs +being active on the Samba server at any one time. Should a client +submit a job which exceeds this number, a “no more space +available on server” type of error message will be returned by +Samba to the client. A setting of "0" (the default) means there is +no limit at all! +

    printcap name = /etc/printcap

    this tells Samba where to look for a list of +available printer names. (If you use CUPS, make sure that a printcap +file is written: this is controlled by the "Printcap" directive of +cupsd.conf). +

    printer admin = @ntadmin

    members of the ntadmin group should be able to add +drivers and set printer properties ("ntadmin" is only an example name, +it needs to be a valid UNIX group name); root is implicitly always a +printer admin. The "@" sign precedes group names in +. A printer admin can do anything to +printers via the remote administration interfaces offered by MS-RPC +(see below). Note that the printer admin +parameter is normally a share level parameter, so you may associate +different groups to different printer shares in larger installations, +if you use the printer admin parameter on the +share levels). +

    lpq cache time = 20

    this controls the cache time for the results of the +lpq command. It prevents the lpq command being called too often and +reduces load on a heavily used print server. +

    use client driver = no

    if set to yes, this setting only +takes effect for Win NT/2k/XP clients (and not for Win 95/98/ME). Its +default value is No (or False). +It must not be enabled on print shares +(with a yes or true setting) which +have valid drivers installed on the Samba server! For more detailed +explanations see the man page of smb.conf. +

    The [printers] Section

    +This is the second special section. If a section with this name +appears in the smb.conf, users are able to +connect to any printer specified in the Samba host's printcap file, +because Samba on startup then creates a printer share for every +printername it finds in the printcap file. You could regard this +section as a general convenience shortcut to share all printers with +minimal configuration. It is also a container for settings which +should apply as default to all printers. (For more details see the +smb.conf man page.) Settings inside this +container must be share level parameters (S). +

    comment = All printers

    the comment is shown next to +the share if a client queries the server, either via Network +Neighbourhood or with the net view command to list +available shares. +

    printable = yes

    please note well, that the +[printers] service must be +declared as printable. If you specify otherwise, smbd will refuse to +load at startup. This parameter allows +connected clients to open, write to and submit spool files into the +directory specified with the path parameter for +this service. It is used by Samba to differentiate printer shares from +file shares.

    path = /var/spool/samba

    this must point to a directory used by Samba to spool +incoming print files. It must not be the same as the spool +directory specified in the configuration of your UNIX print +subsystem! The path would typically point to a directory +which is world writeable, with the "sticky" bit set to it. +

    browseable = no

    this is always set to no if +printable = yes. It makes the +[printer] share itself invisible in the +list of available shares in a net view command or +in the Explorer browse list. (Note that you will of course see the +individual printers). +

    guest ok = yes

    +if set to yes, then no password is required to +connect to the printers service. Access will be granted with the +privileges of the guest account. On many systems the +guest account will map to a user named "nobody". This user is in the UNIX +passwd file with an empty password, but with no valid UNIX login. +(Note: on some systems the guest account might not have the +privilege to be able to print. Test this by logging in as your +guest user using su - guest and run a system print +command like +

    lpr -P printername /etc/motd

    public = yes

    this is a synonym for guest ok = +yes. Since we have guest ok = yes, +it really doesn't need to be here! (This leads to the interesting +question: “What, if I by accident have to contradictory settings +for the same share?” The answer is: the last one encountered by +Samba wins. The "winner" is shown by testparm. Testparm doesn't +complain about different settings of the same parameter for the same +share! You can test this by setting up multiple lines for the "guest +account" parameter with different usernames, and then run testparm to +see which one is actually used by Samba.) +

    read only = yes

    this normally (for other types of shares) prevents +users creating or modifying files in the service's directory. However, +in a "printable" service, it is always allowed to +write to the directory (if user privileges allow the connection), but +only via print spooling operations. "Normal" write operations are not +allowed.

    writeable = no

    +synonym for read only = yes +

    Any [my_printer_name] Section

    +If a section appears in the , which is +tagged as printable = yes, Samba presents it as +a printer share to its clients. Note, that Win95/98/ME clients may +have problems with connecting or loading printer drivers if the share +name has more than 8 characters! Also be very careful if you give a +printer the same name as an existing user or file share name: upon a +client's connection request to a certain sharename, Samba always tries +to find file shares with that name first; if it finds one, it will +connect to this and will never ultimately connect to a printer with +the same name! +

    comment = Printer with Restricted Access

    the comment says it all. +

    path = /var/spool/samba_my_printer

    here we set the spooling area for this printer to +another directory than the default. It is not a requirement to set it +differently, but the option is available. +

    printer admin = kurt

    the printer admin definition is different for this +explicitly defined printer share from the general +[printers] share. It is not a requirement; we +did it to show that it is possible if you want it. +

    browseable = yes

    we also made this printer browseable (so that the +clients may conveniently find it when browsing the Network +Neighbourhood). +

    printable = yes

    see explanation in last subsection. +

    writeable = no

    see explanation in last subsection. +

    hosts allow = 10.160.50.,10.160.51.

    here we exercise a certain degree of access control +by using the hosts allow and hosts deny parameters. Note, that +this is not by any means a safe bet. It is not a way to secure your +printers. This line accepts all clients from a certain subnet in a +first evaluation of access control +

    hosts deny = turbo_xp,10.160.50.23,10.160.51.60 +

    all listed hosts are not allowed here (even if they +belong to the "allowed subnets"). As you can see, you could name IP +addresses as well as NetBIOS hostnames +here. +

    guest ok = no

    this printer is not open for the guest account! +

    Print Commands

    +In each section defining a printer (or in the +[printers] section), a print +command parameter may be defined. It sets a command to +process the files which have been placed into the Samba print spool +directory for that printer. (That spool directory was, if you +remember, set up with the path +parameter). Typically, this command will submit the spool file to the +Samba host's print subsystem, using the suitable system print +command. But there is no requirement that this needs to be the +case. For debugging purposes or some other reason you may want to do +something completely different than "print" the file. An example is a +command that just copies the print file to a temporary location for +further investigation when you need to debug printing. If you craft +your own print commands (or even develop print command shell scripts), +make sure you pay attention to the need to remove the files from the +Samba spool directory. Otherwise your hard disk may soon suffer from +shortage of free space. +

    Default Print Commands for various Unix Print Subsystems

    +You learned earlier on, that Samba in most cases uses its built-in +settings for many parameters if it can not find an explicitly stated +one in its configuration file. The same is true for the +print command. The default print command varies +depending on the printing =... parameter +setting. In the commands listed below, you will notice some parameters +of the form %X where X is +p, s, J etc. These letters stand for +"printername", "spoolfile" and "job ID" respectively. They are +explained in more detail further below. Here is an overview (excluding +the special case of CUPS, which is discussed in the next chapter): +

    If this setting is active......this is used in lieu of an explicit command:
    printing = bsd|aix|lprng|plpprint command is lpr -r -P%p %s
    printing = sysv|hpuxprint command is lp -c -P%p %s; rm %s
    printing = qnxprint command is lp -r -P%p -s %s
    printing = bsd|aix|lprng|plplpq command is lpq -P%p
    printing = sysv|hpuxlpq command is lpstat -o%p
    printing = qnxlpq command is lpq -P%p
    printing = bsd|aix|lprng|plplprm command is lprm -P%p %j
    printing = sysv|hpuxlprm command is cancel %p-%j
    printing = qnxlprm command is cancel %p-%j
    printing = bsd|aix|lprng|plplppause command is lp -i %p-%j -H hold
    printing = sysv|hpuxlppause command (...is empty)
    printing = qnxlppause command (...is empty)
    printing = bsd|aix|lprng|plplpresume command is lp -i %p-%j -H resume
    printing = sysv|hpuxlpresume command (...is empty)
    printing = qnxlpresume command (...is empty)

    +We excluded the special CUPS case here, because it is discussed in the +next chapter. Just a short summary. For printing = +CUPS: If SAMBA is compiled against libcups, it uses the +CUPS API to submit jobs, etc. (It is a good idea also to set +printcap = cups in case your +cupsd.conf is set to write its autogenerated +printcap file to an unusual place). Otherwise Samba maps to the System +V printing commands with the -oraw option for printing, i.e. it uses +lp -c -d%p -oraw; rm %s With printing = +cups , and if SAMBA is compiled against libcups, any +manually set print command will be ignored! +

    +Having listed the above mappings here, you should note that there used +to be a bug in recent 2.2.x versions which +prevented the mapping from taking effect. It lead to the +"bsd|aix|lprng|plp" settings taking effect for all other systems, for +the most important commands (the print command, the +lpq command and the lprm +command). The lppause command and the +lpresume command remained empty. Of course, these +commands worked on bsd|aix|lprng|plp but they didn't work on +sysv|hpux|qnx systems. To work around this bug, you need to +explicitly set the commands. Use testparm -v to +check which command takes effect. Then check that this command is +adequate and actually works for your installed print subsystem. It is +always a good idea to explicitly set up your configuration files the +way you want them to work and not rely on any built-in defaults. +

    Setting up your own Print Commands

    +After a print job has finished spooling to a service, the +print command will be used by Samba via a +system() call to process the spool file. Usually +the command specified will submit the spool file to the host's +printing subsystem. But there is no requirement at all that this must +be the case. The print subsystem will probably not remove the spool +file on its own. So whatever command you specify on your own you +should ensure that the spool file is deleted after it has been +processed. +

    +There is no difficulty with using your own customized print commands +with the traditional printing systems. However, if you don't wish to +"roll your own", you should be well informed about the default +built-in commands that Samba uses for each printing subsystem (see the +table above). In all the commands listed in the last paragraphs you +see parameters of the form %X These are +macros, or shortcuts, used as place holders for +the names of real objects. At the time of running a command with such +a placeholder, Samba will insert the appropriate value +automatically. Print commands can handle all Samba macro +substitutions. In regard to printing, the following ones do have +special relevance: +

    • %s, %f - the path to the spool +file name

    • %p - the appropriate printer +name

    • %J - the job name as +transmitted by the client.

    • %c - the number of printed +pages of the spooled job (if known).

    • %z - the size of the spooled +print job (in bytes)

    +The print command MUST contain at least one occurrence of +%s or %f. -- The +%p is optional. If no printer name is supplied, +the %p will be silently removed from the print +command. In this case the job is sent to the default printer. +

    +If specified in the [global] section, the print +command given will be used for any printable service that does not +have its own print command specified. If there is neither a specified +print command for a printable service nor a global print command, +spool files will be created but not processed! And (most importantly): +print files will not be removed, so they will start filling your Samba +hard disk. +

    +Note that printing may fail on some UNIXes from the "nobody" +account. If this happens, create an alternative guest account and +supply it with the privilege to print. Set up this guest account in +the [global] section with the guest +account parameter. +

    +You can form quite complex print commands. You need to realize that +print commands are just passed to a UNIX shell. The shell is able to +expand the included environment variables as usual. (The syntax to +include a UNIX environment variable $variable +in or in the Samba print command is +%$variable.) To give you a working +print command example, the following will log a +print job to /tmp/print.log, print the file, then +remove it. Note that ';' is the usual separator for commands in shell +scripts: 

    -    testprns printer /etc/printcap
+
+ print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s
+

    -Samba can get its printcap information from a file or from a program. -You can try the following to see the format of the extracted -information: +You may have to vary your own command considerably from this example +depending on how you normally print files on your system. The default +for the print command parameter varies depending on the setting of +the printing parameter. Another example is: 

    -    testprns -a printer /etc/printcap
+ print command = /usr/local/samba/bin/myprintscript %p %s
+

    Innovations in Samba Printing since 2.2

    +Before version 2.2.0, Samba's print server support for Windows clients +was limited to the level of LanMan printing +calls. This is the same protocol level as Windows 9x PCs offer when +they share printers. Beginning with the 2.2.0 release, Samba started +to support the native Windows NT printing mechanisms. These are +implemented via MS-RPC (RPC = Remote +Procedure Calls ). MS-RPCs use the +SPOOLSS named pipe for all printing. +

    +The additional functionality provided by the new SPOOLSS support includes: +

    • Support for downloading printer driver files to Windows +95/98/NT/2000 clients upon demand (Point'n'Print); +

    • Uploading of printer drivers via the Windows NT +Add Printer Wizard (APW) or the +Imprints tool set (refer to http://imprints.sourceforge.net); +

    • Support for the native MS-RPC printing calls such as +StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation +at http://msdn.microsoft.com/ +for more information on the Win32 printing API);

    • Support for NT Access Control +Lists (ACL) on printer objects;

    • Improved support for printer queue manipulation +through the use of internal databases for spooled job information +(implemented by various *.tdb +files).

    +One other benefit of an update is this: Samba-3 is able to publish +all its printers in Active Directory (or LDAP)! +

    +One slight difference is here: it is possible on a Windows NT print +server to have printers listed in the Printers folder which are +not shared. Samba does not make this +distinction. By definition, the only printers of which Samba is aware +are those which are specified as shares in +. The reason is that Windows NT/200x/XP Professional +clients do not normally need to use the standard SMB printer share; +rather they can print directly to any printer on another Windows NT +host using MS-RPC. This of course assumes that the printing client has +the necessary privileges on the remote host serving the printer. The +default permissions assigned by Windows NT to a printer gives the +"Print" permissions to the well-known Everyone +group. (The older clients of type Win9x can only print to "shared" +printers). +

    Client Drivers on Samba Server for Point'n'Print

    +There is still confusion about what all this means: Is it or +is it not a requirement for printer drivers to be installed on a Samba +host in order to support printing from Windows clients? The +answer to this is: No, it is not a +requirement. Windows NT/2000 clients can, of +course, also run their APW to install drivers +locally (which then connect to a Samba served +print queue). This is the same method as used by Windows 9x +clients. (However, a bug existed in Samba 2.2.0 +which made Windows NT/2000 clients require that the Samba server +possess a valid driver for the printer. This was fixed in Samba +2.2.1). +

    +But it is a new option to install the printer +drivers into the [print$] share of the Samba +server, and a big convenience too. Then all +clients (including 95/98/ME) get the driver installed when they first +connect to this printer share. The uploading or +depositing of the driver into this +[print$] share, and the following binding of +this driver to an existing Samba printer share can be achieved by +different means: +

    • running the APW on an +NT/200x/XP Professional client (this doesn't work from 95/98/ME +clients);

    • using the Imprints +toolset;

    • using the smbclient and +rpcclient commandline tools;

    • using cupsaddsmb(only works for +the CUPS printing system, not for LPR/LPD, LPRng +etc.).

    +Please take additional note of the following fact: Samba +does not use these uploaded drivers in any way to process spooled +files. Drivers are utilized entirely by the clients, who +download and install them via the "Point'n'Print" mechanism supported +by Samba. The clients use these drivers to generate print files in the +format the printer (or the Unix print system) requires. Print files +received by Samba are handed over to the Unix printing system, which +is responsible for all further processing, if needed. +

    The [printer$] Section is removed from Samba-3

    +[print$] vs. [printer$] +.  +Versions of Samba prior to 2.2 made it possible to use a share +named [printer$]. This name was taken from the +same named service created by Windows 9x clients when a printer was +shared by them. Windows 9x printer servers always have a +[printer$] service which provides read-only +access (with no password required) in order to support printer driver +downloads. However, Samba's initial implementation allowed for a +parameter named printer driver location to be +used on a per share basis. This specified the location of the driver +files associated with that printer. Another parameter named +printer driver provided a means of defining the +printer driver name to be sent to the client. These parameters, +including the printer driver file parameter, +are now removed and can not be used in installations of Samba-3.0. +Now the share name [print$] is used for the +location of downloadable printer drivers. It is taken from the +[print$] service created by Windows NT PCs when +a printer is shared by them. Windows NT print servers always have a +[print$] service which provides read-write +access (in the context of its ACLs) in order to support printer driver +down- and uploads. Don't fear -- this does not mean Windows 9x +clients are thrown aside now. They can use Samba's +[print$] share support just fine. +

    Creating the [print$] Share

    +In order to support the up- and downloading of printer driver files, +you must first configure a file share named +[print$]. The "public" name of this share is +hard coded in Samba's internals (because it is hard coded in the MS +Windows clients too). It cannot be renamed since Windows clients are +programmed to search for a service of exactly this name if they want +to retrieve printer driver files. +

    +You should modify the server's file to +add the global parameters and create the +[print$] file share (of course, some of the +parameter values, such as 'path' are arbitrary and should be replaced +with appropriate values for your site): +

    + [global]
+      ; members of the ntadmin group should be able to add drivers and set
+      ; printer properties. root is implicitly always a 'printer admin'.
+      printer admin = @ntadmin
+      [....]
 
-    testprns -a printer '|/bin/cat printcap'
-

    Setting up printcap and print servers

    -You may need to set up some printcaps for your Samba system to use. -It is strongly recommended that you use the facilities provided by -the print spooler to set up queues and printcap information. + [printers] + [....] + + [print$] + comment = Printer Driver Download Area + path = /etc/samba/drivers + browseable = yes + guest ok = yes + read only = yes + write list = @ntadmin, root +

    +Of course, you also need to ensure that the directory named by the +path parameter exists on the Unix file system. +

    Parameters in the [print$] Section

    +[print$] is a special section in +. It contains settings relevant to +potential printer driver download and local installation by clients. +

    comment = Printer Driver +Download Area

    the comment appears next to the share name if it is +listed in a share list (usually Windows clients won't see it often but +it will also appear up in a smbclient -L sambaserver + output).

    path = /etc/samba/printers

    this is the path to the location of the Windows +driver file deposit from the UNIX point of +view.

    browseable = no

    this makes the [print$] share +"invisible" in Network Neighbourhood to clients. However, you can +still "mount" it from any client using the net use +g:\\sambaserver\print$ command in a "DOS box" or the +"Connect network drive" menu from Windows +Explorer.

    guest ok = yes

    this gives read only access to this share for all +guest users. Access may be used to download and install printer +drivers on clients. The requirement for guest ok = +yes depends upon how your site is configured. If users +will be guaranteed to have an account on the Samba host, then this is +a non-issue.

    Note

    +The non-issue is this: if all your Windows NT users are guaranteed to +be authenticated by the Samba server (for example if Samba +authenticates via an NT domain server and the NT user has already been +validated by the Domain Controller in order to logon to the Windows NT +session), then guest access is not necessary. Of course, in a +workgroup environment where you just want to be able to print without +worrying about silly accounts and security, then configure the share +for guest access. You'll probably want to add map to guest += Bad User in the [global] section +as well. Make sure you understand what this parameter does before +using it. +

    read only = yes

    as we don't want everybody to upload driver files (or +even change driver settings) we tagged this share as not +writeable.

    write list = @ntadmin,root

    since the [print$] was made +read only by the previous setting, we need to create a "write list" +also. UNIX groups (denoted with a leading "@" character) and users +listed here are allowed write access (as an exception to the general +public's "read-only" access), which they need to update files on the +share. Normally you will want to only name administrative level user +accounts in this setting. Check the file system permissions to make +sure these accounts can copy files to the share. If this is a non-root +account, then the account should also be mentioned in the global +printer admin parameter. See the + man page for more information on +configuring file shares.

    Subdirectory Structure in [print$]

    +In order for a Windows NT print server to support the downloading of +driver files by multiple client architectures, you must create several +subdirectories within the [print$] service +(i.e. the Unix directory named by the path +parameter). These correspond to each of the supported client +architectures. Samba follows this model as well. Just like the name of +the [print$] share itself, the subdirectories +*must* be exactly the names listed below (you may leave out the +subdirectories of architectures you don't want to support).

    -Samba requires either a printcap or program to deliver printcap -information. This printcap information has the format: +Therefore, create a directory tree below the +[print$] share for each architecture you wish +to support. 

    -  name|alias1|alias2...:option=value:...
+[print$]--+--
+          |--W32X86           # serves drivers to "Windows NT x86"
+          |--WIN40            # serves drivers to "Windows 95/98"
+          |--W32ALPHA         # serves drivers to "Windows NT Alpha_AXP"
+          |--W32MIPS          # serves drivers to "Windows NT R4000"
+          |--W32PPC           # serves drivers to "Windows NT PowerPC"
+

    Required permissions

    +In order to add a new driver to your Samba host, one of two conditions +must hold true: +

    • The account used to connect to the Samba host must +have a UID of 0 (i.e. a root account)

    • The account used to connect to the Samba host must be +named in the printer adminlist.

    +Of course, the connected account must still possess access to add +files to the subdirectories beneath +[print$]. Remember that all file shares are set +to 'read only' by default. +

    +Once you have created the required [print$] +service and associated subdirectories, go to a Windows NT 4.0/2k/XP +client workstation. Open Network Neighbourhood or +My Network Places and browse for the Samba host. +Once you have located the server, navigate to its Printers and +Faxes folder. You should see an initial listing of printers +that matches the printer shares defined on your Samba host. +

    Installing Drivers into [print$]

    +You have successfully created the [print$] +share in ? And Samba has re-read its +configuration? Good. But you are not yet ready to take off. The +driver files need to be present in this share, +too! So far it is still an empty share. Unfortunately, it is not enough +to just copy the driver files over. They need to be set +up too. And that is a bit tricky, to say the least. We +will now discuss two alternative ways to install the drivers into +[print$]: +

    • using the Samba commandline utility +rpcclient with its various subcommands (here: +adddriver and setdriver) from +any UNIX workstation;

    • running a GUI (Printer +Properties and Add Printer Wizard) +from any Windows NT/2k/XP client workstation.

    +The latter option is probably the easier one (even if the only +entrance to this realm seems a little bit weird at first). +

    Setting Drivers for existing Printers with a Client GUI

    +The initial listing of printers in the Samba host's +Printers folder accessed from a client's Explorer +will have no real printer driver assigned to them. By default, in +Samba-3 (as in 2.2.1 and later) this driver name is set to a NULL +string. This must be changed now. The local Add Printer +Wizard, run from NT/2000/XP clients, will help us in this +task. +

    +However, the job to set a valid driver for the printer is not a +straightforward one: You must attempt to view the printer properties +for the printer to which you want the driver assigned. Open the +Windows Explorer, open Network Neighbourhood, browse to the Samba +host, open Samba's Printers folder, right-click the printer icon and +select Properties.... You are now trying to view printer and driver +properties for a queue which has this default NULL driver +assigned. This will result in an error message (this is normal here): +

    Device settings cannot be displayed. The driver +for the specified printer is not installed, only spooler properties +will be displayed. Do you want to install the driver +now?

    +Important:Don't click Yes! Instead, +click No in the error dialog. +Only now you will be presented with the printer properties window. From here, +the way to assign a driver to a printer is open to us. You have now the choice +either: +

    • select a driver from the pop-up list of installed +drivers. Initially this list will be empty. +Or

    • use the New Driver... button to +install a new printer driver (which will in fact start up the +APW).

    +Once the APW is started, the procedure is exactly the same as the one +you are familiar with in Windows (we assume here that you are +familiar with the printer driver installations procedure on Windows +NT). Make sure your connection is in fact setup as a user with +printer admin privileges (if in doubt, use +smbstatus to check for this). If you wish to +install printer drivers for client operating systems other than +Windows NT x86, you will need to use the +Sharing tab of the printer properties dialog. +

    +Assuming you have connected with an administrative (or root) account +(as named by the printer admin parameter), +you will also be able to modify other printer properties such as ACLs +and default device settings using this dialog. For the default device +settings, please consider the advice given further below. +

    Setting Drivers for existing Printers with +rpcclient

    +The second way to install printer drivers into +[print$] and set them up in a valid way can be +done from the UNIX command line. This involves four distinct steps: +

    1. gathering the info about the required driver files +and collecting the files together;

    2. deposit the driver files into the +[print$] share's correct subdirectories +(possibly by using smbclient);

    3. running the rpcclient +commandline utility once with the adddriver +subcommand,

    4. running rpcclient a second +time with the setdriver +subcommand.

    +We will provide detailed hints for each of these steps in the next few +paragraphs. +

    Identifying the Driver Files

    +To find out about the driver files, you have two options: you could +investigate the driver CD which comes with your printer. Study the +*.inf file on the CD, if it is contained. This +may not be the possible, since the *.inf file might be +missing. Unfortunately, many vendors have now started to use their own +installation programs. These installations packages are often some +sort of Windows platform archive format, plus, the files may get +re-named during the installation process. This makes it extremely +difficult to identify the driver files you need. +

    +Then you only have the second option: install the driver first on a +Windows client *locally* and investigate which file names and paths it +uses after they are installed. (Note, that you need to repeat this +procedure for every client platform you want to support. We are going +to show it here for the W32X86 platform only, a +name used by Microsoft for all WinNT/2k/XP clients...) +

    +A good method to recognize the driver files this is to print the test +page from the driver's Properties Dialog +(General tab). Then look at the list of driver +files named on the printout. You'll need to recognize what Windows +(and Samba) are calling the Driver File , the +Data File, the Config File, +the Help File and (optionally) the +Dependent Driver Files (this may vary slightly +for Windows NT). You need to remember all names (or better take a +note) for the next steps. +

    +Another method to quickly test the driver filenames and related paths +is provided by the rpcclient utility. Run it with +enumdrivers or with the +getdriver subcommand, each in the +3 level. In the following example, +TURBO_XP is the name of the Windows PC (in this +case it was a Windows XP Professional laptop, BTW). I had installed +the driver locally to TURBO_XP while kde-bitshop is +the name of the Linux host from which I am working. We could run an +interactive rpcclient session; +then we'd get an rpcclient /> prompt and would +type the subcommands at this prompt. This is left as a good exercise +to the reader. For now we use rpcclient with the +-c parameter to execute a single subcommand +line and exit again. This is the method you would use if you want to +create scripts to automate the procedure for a large number of +printers and drivers. Note the different quotes used to overcome the +different spaces in between words: +

    +root# rpcclient -U'Danka%xxxx' -c 'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP
+  cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3
+
+  [Windows NT x86]
+  Printer Driver Info 3:
+          Version: [2]
+          Driver Name: [Heidelberg Digimaster 9110 (PS)]
+          Architecture: [Windows NT x86]
+          Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.DLL]
+          Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.ppd]
+          Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.DLL]
+          Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.HLP]
+  
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.DLL]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.INI]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1KMMin.DLL]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.dat]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.cat]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.def]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hre]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.vnd]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hlp]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de_reg.HLP]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01Aux.dll]
+          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.NTF]
+  
+          Monitorname: []
+          Defaultdatatype: []
+
+

    +You may notice, that this driver has quite a big number of +Dependentfiles (I know worse cases however). Also, +strangely, the Driver File is here tagged as +Driver Path.... oh, well. Here we don't have yet +support for the so-called WIN40 architecture +installed. This name is used by Microsoft for the Win95/98/ME platforms. +If we want to support these, we need to install the Win95/98/ME driver +files in addition to those for W32X86 +(i.e. the WinNT72000/XP clients) onto a Windows PC. This PC +can also host the Win9x drivers, even if itself runs on Windows NT, +2000 or XP. +

    +Since the [print$] share is usually accessible +through the Network Neighbourhood, you can also use the UNC notation +from Windows Explorer to poke at it. The Win9x driver files will end +up in subdirectory "0" of the "WIN40" directory. The full path to +access them will be +\\WINDOWSHOST\print$\WIN40\0\. +

    Note

    more recent drivers on Windows 2000 and Windows XP are +installed into the "3" subdirectory instead of the "2". The version 2 +of drivers, as used in Windows NT, were running in Kernel Mode. +Windows 2000 changed this. While it still can use the Kernel Mode +drivers (if this is enabled by the Admin), its native mode for printer +drivers is User Mode execution. This requires drivers designed for +this. These type of drivers install into the "3" subdirectory. +

    Collecting the Driver Files from a Windows Host's +[print$] Share

    +Now we need to collect all the driver files we identified. in our +previous step. Where do we get them from? Well, why not retrieve them +from the very PC and the same [print$] share +which we investigated in our last step to identify the files? We can +use smbclient to do this. We will use the paths and +names which were leaked to us by getdriver. The +listing is edited to include linebreaks for readability: +

    +root# smbclient //TURBO_XP/print\$ -U'Danka%xxxx'	\ 
+	-c 'cd W32X86/2;mget HD*_de.*             \
+	hd*ppd Hd*_de.* Hddm*dll HDN*Aux.DLL'
+  added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+  Got a positive name query response from 10.160.50.8 ( 10.160.50.8 )
+  Domain=[DEVELOPMENT] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager]
+  Get file Hddm91c1_de.ABD? n
+  Get file Hddm91c1_de.def? y
+  getting file \W32X86\2\Hddm91c1_de.def of size 428 as Hddm91c1_de.def (22.0 kb/s) (average 22.0 kb/s)
+  Get file Hddm91c1_de.DLL? y
+  getting file \W32X86\2\Hddm91c1_de.DLL of size 876544 as Hddm91c1_de.DLL (737.3 kb/s) (average 737.3 kb/s)
+  [...]
+
+

    +After this command is complete, the files are in our current local +directory. You probably have noticed that this time we passed several +commands to the -c parameter, separated by semi-colons. This +effects that all commands are executed in sequence on the remote +Windows server before smbclient exits again. +

    +Don't forget to repeat the procedure for the WIN40 +architecture should you need to support Win95/98/XP clients. Remember, the +files for these architectures are in the WIN40/0/ subdir. Once we are +complete, we can run smbclient ... put to store +the collected files on the Samba server's +[print$] share. +

    Depositing the Driver Files into [print$]

    +So, now we are going to put the driver files into the +[print$] share. Remember, the UNIX path to this +share has been defined previously in your +. You also have created subdirectories +for the different Windows client types you want to support. Supposing +your [print$] share maps to the UNIX path +/etc/samba/drivers/, your driver files should now +go here: +

    • for all Windows NT, 2000 and XP clients into +/etc/samba/drivers/W32X86/ but +*not*(yet) into the "2" subdir!

    • for all Windows 95, 98 and ME clients into +/etc/samba/drivers/WIN40/ -- but *not* +(yet) into the "0" subdir!

    +We again use smbclient to transfer the driver files across the +network. We specify the same files and paths as were leaked to us by +running getdriver against the original +Windows install. However, now we are going to +store the files into a Samba/UNIX print server's +[print$] share... +

    +root# smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c 'cd W32X86; put HDNIS01_de.DLL; \
+  put Hddm91c1_de.ppd; put HDNIS01U_de.DLL;        \
+  put HDNIS01U_de.HLP; put Hddm91c1_de.DLL;        \
+  put Hddm91c1_de.INI; put Hddm91c1KMMin.DLL;      \
+  put Hddm91c1_de.dat; put Hddm91c1_de.dat;        \
+  put Hddm91c1_de.def; put Hddm91c1_de.hre;        \
+  put Hddm91c1_de.vnd; put Hddm91c1_de.hlp;        \
+  put Hddm91c1_de_reg.HLP; put HDNIS01Aux.dll;     \
+  put HDNIS01_de.NTF'
+ added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+ Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
+ Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+ putting file HDNIS01_de.DLL as \W32X86\HDNIS01_de.DLL (4465.5 kb/s) (average 4465.5 kb/s)
+ putting file Hddm91c1_de.ppd as \W32X86\Hddm91c1_de.ppd (12876.8 kb/s) (average 4638.9 kb/s)
+ putting file HDNIS01U_de.DLL as \W32X86\HDNIS01U_de.DLL (20249.8 kb/s) (average 5828.3 kb/s)
+ putting file HDNIS01U_de.HLP as \W32X86\HDNIS01U_de.HLP (9652.8 kb/s) (average 5899.8 kb/s)
+ putting file Hddm91c1_de.DLL as \W32X86\Hddm91c1_de.DLL (23777.7 kb/s) (average 10400.6 kb/s)
+ putting file Hddm91c1_de.INI as \W32X86\Hddm91c1_de.INI (98.6 kb/s) (average 10329.0 kb/s)
+ putting file Hddm91c1KMMin.DLL as \W32X86\Hddm91c1KMMin.DLL (22931.5 kb/s) (average 10501.7 kb/s)
+ putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (2462.8 kb/s) (average 10393.0 kb/s)
+ putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (4925.3 kb/s) (average 10356.3 kb/s)
+ putting file Hddm91c1_de.def as \W32X86\Hddm91c1_de.def (417.9 kb/s) (average 10290.1 kb/s)
+ putting file Hddm91c1_de.hre as \W32X86\Hddm91c1_de.hre (22571.3 kb/s) (average 11338.5 kb/s)
+ putting file Hddm91c1_de.vnd as \W32X86\Hddm91c1_de.vnd (3384.6 kb/s) (average 10754.3 kb/s)
+ putting file Hddm91c1_de.hlp as \W32X86\Hddm91c1_de.hlp (18406.8 kb/s) (average 10839.8 kb/s)
+ putting file Hddm91c1_de_reg.HLP as \W32X86\Hddm91c1_de_reg.HLP (20278.3 kb/s) (average 11386.3 kb/s)
+ putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll (14994.6 kb/s) (average 11405.2 kb/s)
+ putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF (23390.2 kb/s) (average 13170.8 kb/s)
+
+

    +Phewww -- that was a lot of typing! Most drivers are a lot smaller -- +many only having 3 generic PostScript driver files plus 1 PPD. Note, +that while we did retrieve the files from the "2" subdirectory of the +"W32X86" directory from the Windows box, we don't +put them (for now) in this same subdirectory of the Samba box! This +re-location will automatically be done by the +adddriver command which we will run shortly (and +don't forget to also put the files for the Win95/98/ME architecture +into the WIN40/ subdirectory should you need +them). +

    Check if the Driver Files are there (with smbclient)

    +For now we verify that our files are there. This can be done with +smbclient too (but of course you can log in via SSH +also and do this through a standard UNIX shell access too): +

    +root# smbclient //SAMBA-CUPS/print\$ -U 'root%xxxx' -c 'cd W32X86; pwd; dir; cd 2; pwd; dir'
+ added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+ Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
+ Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+
+  Current directory is \\SAMBA-CUPS\print$\W32X86\
+  .                                   D        0  Sun May  4 03:56:35 2003
+  ..                                  D        0  Thu Apr 10 23:47:40 2003
+  2                                   D        0  Sun May  4 03:56:18 2003
+  HDNIS01Aux.dll                      A    15356  Sun May  4 03:58:59 2003
+  Hddm91c1KMMin.DLL                   A    46966  Sun May  4 03:58:59 2003
+  HDNIS01_de.DLL                      A   434400  Sun May  4 03:58:59 2003
+  HDNIS01_de.NTF                      A   790404  Sun May  4 03:56:35 2003
+  Hddm91c1_de.DLL                     A   876544  Sun May  4 03:58:59 2003
+  Hddm91c1_de.INI                     A      101  Sun May  4 03:58:59 2003
+  Hddm91c1_de.dat                     A     5044  Sun May  4 03:58:59 2003
+  Hddm91c1_de.def                     A      428  Sun May  4 03:58:59 2003
+  Hddm91c1_de.hlp                     A    37699  Sun May  4 03:58:59 2003
+  Hddm91c1_de.hre                     A   323584  Sun May  4 03:58:59 2003
+  Hddm91c1_de.ppd                     A    26373  Sun May  4 03:58:59 2003
+  Hddm91c1_de.vnd                     A    45056  Sun May  4 03:58:59 2003
+  HDNIS01U_de.DLL                     A   165888  Sun May  4 03:58:59 2003
+  HDNIS01U_de.HLP                     A    19770  Sun May  4 03:58:59 2003
+  Hddm91c1_de_reg.HLP                 A   228417  Sun May  4 03:58:59 2003
+                40976 blocks of size 262144. 709 blocks available
+
+  Current directory is \\SAMBA-CUPS\print$\W32X86\2\
+  .                                   D        0  Sun May  4 03:56:18 2003
+  ..                                  D        0  Sun May  4 03:56:35 2003
+  ADOBEPS5.DLL                        A   434400  Sat May  3 23:18:45 2003
+  laserjet4.ppd                       A     9639  Thu Apr 24 01:05:32 2003
+  ADOBEPSU.DLL                        A   109568  Sat May  3 23:18:45 2003
+  ADOBEPSU.HLP                        A    18082  Sat May  3 23:18:45 2003
+  PDFcreator2.PPD                     A    15746  Sun Apr 20 22:24:07 2003
+                40976 blocks of size 262144. 709 blocks available
+

    -For almost all printing systems, the printer 'name' must be composed -only of alphanumeric or underscore '_' characters. Some systems also -allow hyphens ('-') as well. An alias is an alternative name for the -printer, and an alias with a space in it is used as a 'comment' -about the printer. The printcap format optionally uses a \ at the end of lines -to extend the printcap to multiple lines. -

    -Here are some examples of printcap files: -

    -

    1. -pr just printer name -

    2. -pr|alias printer name and alias -

    3. -pr|My Printer printer name, alias used as comment -

    4. -pr:sh:\ Same as pr:sh:cm= testing - :cm= \ - testing -

    5. -pr:sh Same as pr:sh:cm= testing - :cm= testing +Notice that there are already driver files present in the +2 subdir (probably from a previous +installation). Once the files for the new driver are there too, you +are still a few steps away from being able to use them on the +clients. The only thing you could do *now* is to retrieve them from a +client just like you retrieve ordinary files from a file share, by +opening print$ in Windows Explorer. But that wouldn't install them per +Point'n'Print. The reason is: Samba doesn't know yet that these files +are something special, namely printer driver +files and it doesn't know yet to which print queue(s) these +driver files belong. +

    Running rpcclient with +adddriver

    +So, next you must tell Samba about the special category of the files +you just uploaded into the [print$] share. This +is done by the adddriver command. It will +prompt Samba to register the driver files into its internal TDB +database files. The following command and its output has been edited, +again, for readability: +

    +root# rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL: \
+  Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
+  NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
+  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
+  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+  HDNIS01Aux.dll,HDNIS01_de.NTF,                     \
+  Hddm91c1_de_reg.HLP' SAMBA-CUPS
+
+ cmd = adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:    \
+  HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
+  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,          \
+  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,        \
+  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
+
+ Printer Driver dm9110 successfully installed.
+
+

    +After this step the driver should be recognized by Samba on the print +server. You need to be very careful when typing the command. Don't +exchange the order of the fields. Some changes would lead to a +NT_STATUS_UNSUCCESSFUL error +message. These become obvious. Other changes might install the driver +files successfully, but render the driver unworkable. So take care! +Hints about the syntax of the adddriver command are in the man +page. The CUPS printing chapter of this HOWTO collection provides a +more detailed description, if you should need it. +

    Check how Driver Files have been moved after +adddriver finished

    +One indication for Samba's recognition of the files as driver files is +the successfully installed message. +Another one is the fact, that our files have been moved by the +adddriver command into the 2 +subdirectory. You can check this again with +smbclient: +

    +root# smbclient //SAMBA-CUPS/print\$ -Uroot%xxxx -c 'cd W32X86;dir;pwd;cd 2;dir;pwd'
+ added interface ip=10.160.51.162 bcast=10.160.51.255 nmask=255.255.252.0
+ Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+
+  Current directory is \\SAMBA-CUPS\print$\W32X86\
+  .                                   D        0  Sun May  4 04:32:48 2003
+  ..                                  D        0  Thu Apr 10 23:47:40 2003
+  2                                   D        0  Sun May  4 04:32:48 2003
+                40976 blocks of size 262144. 731 blocks available 
+
+  Current directory is \\SAMBA-CUPS\print$\W32X86\2\
+  .                                   D        0  Sun May  4 04:32:48 2003
+  ..                                  D        0  Sun May  4 04:32:48 2003
+  DigiMaster.PPD                      A   148336  Thu Apr 24 01:07:00 2003
+  ADOBEPS5.DLL                        A   434400  Sat May  3 23:18:45 2003
+  laserjet4.ppd                       A     9639  Thu Apr 24 01:05:32 2003
+  ADOBEPSU.DLL                        A   109568  Sat May  3 23:18:45 2003
+  ADOBEPSU.HLP                        A    18082  Sat May  3 23:18:45 2003
+  PDFcreator2.PPD                     A    15746  Sun Apr 20 22:24:07 2003
+  HDNIS01Aux.dll                      A    15356  Sun May  4 04:32:18 2003
+  Hddm91c1KMMin.DLL                   A    46966  Sun May  4 04:32:18 2003
+  HDNIS01_de.DLL                      A   434400  Sun May  4 04:32:18 2003
+  HDNIS01_de.NTF                      A   790404  Sun May  4 04:32:18 2003
+  Hddm91c1_de.DLL                     A   876544  Sun May  4 04:32:18 2003
+  Hddm91c1_de.INI                     A      101  Sun May  4 04:32:18 2003
+  Hddm91c1_de.dat                     A     5044  Sun May  4 04:32:18 2003
+  Hddm91c1_de.def                     A      428  Sun May  4 04:32:18 2003
+  Hddm91c1_de.hlp                     A    37699  Sun May  4 04:32:18 2003
+  Hddm91c1_de.hre                     A   323584  Sun May  4 04:32:18 2003
+  Hddm91c1_de.ppd                     A    26373  Sun May  4 04:32:18 2003
+  Hddm91c1_de.vnd                     A    45056  Sun May  4 04:32:18 2003
+  HDNIS01U_de.DLL                     A   165888  Sun May  4 04:32:18 2003
+  HDNIS01U_de.HLP                     A    19770  Sun May  4 04:32:18 2003
+  Hddm91c1_de_reg.HLP                 A   228417  Sun May  4 04:32:18 2003
+                40976 blocks of size 262144. 731 blocks available
+
+

    +Another verification is that the timestamp of the printing TDB files +is now updated (and possibly their filesize has increased). +

    Check if the Driver is recognized by Samba

    +Now the driver should be registered with Samba. We can easily verify +this, and will do so in a moment. However, this driver is +not yet associated with a particular +printer. We may check the driver status of the +files by at least three methods: +

    • from any Windows client browse Network Neighbourhood, +find the Samba host and open the Samba Printers and +Faxes folder. Select any printer icon, right-click and +select the printer Properties. Click on the +Advanced tab. Here is a field indicating the +driver for that printer. A drop down menu allows you to change that +driver (be careful to not do this unwittingly.). You can use this +list to view all drivers know to Samba. Your new one should be amongst +them. (Each type of client will only see his own architecture's +list. If you don't have every driver installed for each platform, the +list will differ if you look at it from Windows95/98/ME or +WindowsNT/2000/XP.)

    • from a Windows 2000 or XP client (not WinNT) browse +Network Neighbourhood, search for the Samba +server and open the server's Printers folder, +right-click the white background (with no printer highlighted). Select +Server Properties. On the +Drivers tab you will see the new driver listed +now. This view enables you to also inspect the list of files belonging +to that driver (this doesn't work on Windows NT, but only on +Windows 2000 and Windows XP. WinNT doesn't provide the "Drivers" +tab).. An alternative, much quicker method for Windows +2000/XP to start this dialog is by typing into a DOS box (you must of +course adapt the name to your Samba server instead of SAMBA-CUPS): +

      rundll32 printui.dll,PrintUIEntry /s /t2 /n\\SAMBA-CUPS

    • from a UNIX prompt run this command (or a variant +thereof), where SAMBA-CUPS is the name of the Samba +host and "xxxx" represents the actual Samba password assigned to root: +

      rpcclient -U'root%xxxx' -c 'enumdrivers' SAMBA-CUPS

      +You will see a listing of all drivers Samba knows about. Your new one +should be amongst them. But it is only listed under the [Windows NT +x86] heading, not under [Windows 4.0], +since we didn't install that part. Or did *you*? -- You will see a listing of +all drivers Samba knows about. Your new one should be amongst them. In our +example it is named dm9110. Note that the 3rd column +shows the other installed drivers twice, for each supported architecture one +time. Our new driver only shows up for +Windows NT 4.0 or 2000. To +have it present for Windows 95, 98 and ME you'll +have to repeat the whole procedure with the WIN40 architecture and subdirectory. +

    A side note: you are not bound to specific driver names

    +You can name the driver as you like. If you repeat the +adddriver step, with the same files as before, but +with a different driver name, it will work the same: +

    +root# rpcclient -Uroot%xxxx                                        \
+      -c 'adddriver "Windows NT x86"                     \
+      "myphantasydrivername:HDNIS01_de.DLL:              \
+      Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
+      NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
+      Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
+      Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+      HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP' SAMBA-CUPS
+  
+
+ cmd = adddriver "Windows NT x86" 
+                 "myphantasydrivername:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:\
+                  HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,           \
+                  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,                    \
+                  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,                  \
+                  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
+
+ Printer Driver myphantasydrivername successfully installed.
+
+

    +You will also be able to bind that driver to any print queue (however, +you are responsible yourself that you associate drivers to queues +which make sense to the target printer). Note, that you can't run the +rpcclient adddriver command +repeatedly. Each run "consumes" the files you had put into the +[print$] share by moving them into the +respective subdirectories. So you must precede an +smbclient ... put command before each +rpcclient ... adddriver" command. +

    La Grande Finale: Running rpcclient with +setdriver

    +Samba still needs to know which printer's driver +this is. It needs to create a mapping of the driver to a printer, and +store this info in its "memory", the TDB files. The rpcclient +setdriver command achieves exactly this: +

    +root# rpcclient -U'root%xxxx' -c 'setdriver dm9110 myphantasydrivername' SAMBA-CUPS
+ cmd = setdriver dm9110 myphantasydrivername
+ Successfully set dm9110 to driver myphantasydrivername.
+

    +Ahhhhh -- no, I didn't want to do that. Repeat, this time with the +name I intended: +

    +root# rpcclient -U'root%xxxx' -c 'setdriver dm9110 dm9110' SAMBA-CUPS
+ cmd = setdriver dm9110 dm9110
+ Successfully set dm9110 to driver dm9110.
+

    +The syntax of the command is rpcclient +-U'root%sambapassword' -c 'setdriver +"printername" +"drivername' +SAMBA-Hostname . -- +Now we have done *most* of the work. But not yet all.... +

    Note

    +the setdriver command will only succeed if the printer is +known to +Samba already. A bug in 2.2.x prevented Samba from recognizing freshly +installed printers. You had to restart Samba, or at least send a HUP +signal to all running smbd processes to work around this: +kill -HUP `pidof smbd`.

    "The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure)

    +A famous philosopher said once: “The Proof of the Pudding lies +in the Eating”. The proof for our setup lies in the printing. +So let's install the printer driver onto the client PCs. This is not +as straightforward as it may seem. Read on. +

    The first Client Driver Installation

    +Especially important is the installation onto the first client PC (for +each architectural platform separately). Once this is done correctly, +all further clients are easy to setup and shouldn't need further +attention. What follows is a description for the recommended first +procedure. You work now from a client workstation. First you should +guarantee that your connection is not unwittingly mapped to +bad user "nobody". In a DOS box type: +

    net use \\SAMBA-SERVER\print$ /user:root

    +Replace root, if needed, by another valid +printer admin user as given in the definition. +Should you already be connected as a different user, you'll get an error +message. There is no easy way to get rid of that connection, because +Windows doesn't seem to know a concept of "logging off" from a share +connection (don't confuse this with logging off from the local +workstation; that is a different matter). You can try to close +all Windows file explorer and Internet Explorer +windows. As a last resort, you may have to reboot. Make sure there is +no automatic re-connection set up. It may be easier to go to a +different workstation and try from there. After you have made sure you +are connected as a printer admin user (you can check this with the +smbstatus command on Samba) do this from the +Windows workstation: +

    • Open Network +Neighbourhood

    • Browse to Samba server

    • Open its Printers and +Faxes folder

    • Highlight and right-click the printer

    • Select Connect... (for WinNT4/2K +it is possibly Install...)

    +A new printer (named printername on +samba-server) should now have appeared in your +local Printer folder (check Start -- +Settings -- Control Panel +-- Printers and Faxes). +

    +Most likely you are now tempted to try and print a test page. After +all, you now can open the printer properties and on the "General" tab, +there is a button offering to do just that. But chances are that you +get an error message saying Unable to print Test +Page. The reason might be that there is not yet a +valid Device Mode set for the driver, or that the "Printer Driver +Data" set is still incomplete. +

    +You must now make sure that a valid "Device Mode" is set for the +driver. Don't fear -- we will explain now what that means. +

    IMPORTANT! Setting Device Modes on new Printers

    +In order for a printer to be truly usable by a Windows NT/2K/XP +client, it must possess: +

    • a valid Device Mode generated by +the driver for the printer (defining things like paper size, +orientation and duplex settings), and

    • a complete set of +Printer Driver Data generated by the +driver.

    +If either one of these is incomplete, the clients can produce less +than optimal output at best. In the worst cases, unreadable garbage or +nothing at all comes from the printer or they produce a harvest of +error messages when attempting to print. Samba stores the named values +and all printing related info in its internal TDB database files +(ntprinters.tdb, +ntdrivers.tdb, printing.tdb +and ntforms.tdb). +

    +What do these two words stand for? Basically, the Device Mode and the +set of Printer Driver Data is a collection of settings for all print +queue properties, initialized in a sensible way. Device Modes and +Printer Driver Data should initially be set on the print server (that is +here: the Samba host) to healthy values so that the clients can start +to use them immediately. How do we set these initial healthy values? +This can be achieved by accessing the drivers remotely from an NT (or +2k/XP) client, as is discussed in the next paragraphs. +

    +Be aware, that a valid Device Mode can only be initiated by a +printer admin, or root (the reason should be +obvious). Device Modes can only correctly be set by executing the +printer driver program itself. Since Samba can not execute this Win32 +platform driver code, it sets this field initially to NULL (which is +not a valid setting for clients to use). Fortunately, most drivers +generate themselves the Printer Driver Data that is needed, when they +are uploaded to the [print$] share with the +help of the APW or rpcclient. +

    +The generation and setting of a first valid Device Mode however +requires some "tickling" from a client, to set it on the Samba +server. The easiest means of doing so is to simply change the page +orientation on the server's printer. This "executes" enough of the +printer driver program on the client for the desired effect to happen, +and feeds back the new Device Mode to our Samba server. You can use the +native Windows NT/2K/XP printer properties page from a Window client +for this: +

    • Browse the Network Neighbourhood

    • Find the Samba server

    • Open the Samba server's Printers and + Faxes folder

    • Highlight the shared printer in question

    • Right-click the printer (you may already be here, if you +followed the last section's description)

    • At the bottom of the context menu select +Properties.... (if the menu still offers the +Connect... entry +further above, you need to click that one first to achieve the driver +installation as shown in the last section)

    • Go to the Advanced tab; click on +Printing Defaults...

    • Change the "Portrait" page setting to "Landscape" (and +back)

    • (Oh, and make sure to apply +changes between swapping the page orientation to cause the change to +actually take effect...).

    • While you're at it, you may optionally also want to +set the desired printing defaults here, which then apply to all future +client driver installations on the remaining from now +on.

    +This procedure has executed the printer driver program on the client +platform and fed back the correct Device Mode to Samba, which now +stored it in its TDB files. Once the driver is installed on the +client, you can follow the analogous steps by accessing the +local Printers folder too if you are +a Samba printer admin user. From now on printing should work as expected. +

    +Samba also includes a service level parameter name default +devmode for generating a default Device Mode for a +printer. Some drivers will function well with Samba's default set of +properties. Others may crash the client's spooler service. So use this +parameter with caution. It is always better to have the client +generate a valid device mode for the printer and store it on the +server for you. +

    Further Client Driver Install Procedures

    +Every further driver may be done by any user, along the lines +described above: Browse network, open printers folder on Samba server, +right-click printer and choose Connect.... Once +this completes (should be not more than a few seconds, but could also take +a minute, depending on network conditions), you should find the new printer in +your client workstation local Printers and +Faxes folder. +

    +You can also open your local Printers and Faxes folder by +using this command on Windows 2000 and Windows XP Professional workstations: +

    rundll32 shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder +

    +or this command on Windows NT 4.0 workstations: +

    +rundll32 shell32.dll,Control_RunDLL MAIN.CPL @2 +

    +You can enter the commands either inside a DOS box window +or in the Run command... field from the +Start menu. +

    Always make first Client Connection as root or "printer admin"

    +After you installed the driver on the Samba server (in its +[print$] share, you should always make sure +that your first client installation completes correctly. Make it a habit for +yourself to build that the very first connection from a client as +printer admin. This is to make sure that: +

    • a first valid Device Mode is +really initialized (see above for more explanation details), and +that

    • the default print settings of your printer for all +further client installations are as you want them

    +Do this by changing the orientation to landscape, click +Apply, and then change it back again. Then modify +the other settings (for example, you don't want the default media size +set to Letter, when you are all using +A4, right? You may want to set the printer for +duplex as the default; etc.). +

    +To connect as root to a Samba printer, try this command from a Windows +2K/XP DOS box command prompt: +

    runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n \\SAMBA-SERVER\printername" +

    +You will be prompted for root's Samba-password; type it, wait a few +seconds, click on Printing Defaults... and +proceed to set the job options as should be used as defaults by all +clients. Alternatively, instead of root you can name one other member +of the printer admins from the setting. +

    +Now all the other users downloading and installing the driver +the same way (called Point'n'Print) will +have the same defaults set for them. If you miss this step you'll +get a lot of helpdesk calls from your users. But maybe you like to +talk to people.... ;-) +

    Other Gotchas

    +Your driver is installed. It is ready for +Point'n'Print installation by the clients +now. You may have tried to download and use it +onto your first client machine now. But wait... let's make you +acquainted first with a few tips and tricks you may find useful. For +example, suppose you didn't manage to "set the defaults" on the +printer, as advised in the preceding paragraphs? And your users +complain about various issues (such as “We need to set the paper +size for each job from Letter to A4 and it won't store it!”) +

    Setting Default Print Options for the Client Drivers

    +The last sentence might be viewed with mixed feelings by some users and +admins. They have struggled for hours and hours and couldn't arrive at +a point were their settings seemed to be saved. It is not their +fault. The confusing thing is this: in the multi-tabbed dialog that pops +up when you right-click the printer name and select +Properties..., you can arrive at two identically +looking dialogs, each claiming that they help you to set printer options, +in three different ways. Here is the definite answer to the "Samba +Default Driver Setting FAQ": +

    “I can't set and save default print options +for all users on Win2K/XP! Why not?”  +How are you doing it? I bet the wrong way.... (it is not very +easy to find out, though). There are 3 different ways to bring you to +a dialog that seems to set everything. All three +dialogs look the same. Only one of them +does what you intend. +Important: you need to be Administrator or Print +Administrator to do this for all users. Here is how I reproduce it in +on XP Professional: + +

    1. The first "wrong" way: + +

      1. Open the Printers +folder.

      2. Right-click on the printer +(remoteprinter on cupshost) and +select in context menu Printing +Preferences...

      3. Look at this dialog closely and remember what it looks +like.

      +

    2. The second "wrong" way: + +

      1. Open the Printers +folder.

      2. Right-click on the printer (remoteprinter on +cupshost) and select in the context menu +Properties

      3. Click on the General +tab

      4. Click on the button Printing +Preferences...

      5. A new dialog opens. Keep this dialog open and go back +to the parent dialog.

      +

    3. The third, the "correct" way: (should you do +this from the beginning, just carry out steps 1. and 2. from second +"way" above) + +

      1. Click on the Advanced +tab. (Hmmm... if everything is "Grayed Out", then you are not logged +in as a user with enough privileges).

      2. Click on the Printing +Defaults... button.

      3. On any of the two new tabs, click on the +Advanced... button.

      4. A new dialog opens. Compare this one to the other, +identical looking one from "B.5" or A.3".

    + +Do you see any difference in the two settings dialogs? I don't +either. However, only the last one, which you arrived at with steps +C.1.-6. will permanently save any settings which will then become the +defaults for new users. If you want all clients to have the same +defaults, you need to conduct these steps as administrator +(printer admin in ) +before a client downloads the driver (the clients +can later set their own per-user defaults by +following the procedures A. +or B. above...). (This is new: Windows 2000 and +Windows XP allow per-user default settings and +the ones the administrator gives them, before they set up their own). +The "parents" of the identically looking dialogs have a slight +difference in their window names: one is called +Default Print Values for Printer Foo on Server +Bar" (which is the one you need) and the other is +called "Print Settings for Printer Foo on Server +Bar". The last one is the one you arrive at when you +right-click on the printer and select Print +Settings.... This is the one what you were +taught to use back in the days of Windows NT! So it is only natural to +try the same way with Win2k or WinXP. You wouldn't dream +that there is now a different "clicking path" to arrive at an +identically looking, but functionally different dialog to set defaults +for all users! +

    Tip

    Try (on Win2000 and WinXP) to run this command (as a user +with the right privileges): +

    +rundll32 printui.dll,PrintUIEntry /p /t3 /n\\SAMBA-SERVER\printersharename +

    +to see the tab with the Printing Defaults... +button (the one you need). Also run this command: +

    +rundll32 printui.dll,PrintUIEntry /p /t0 /n\\SAMBA-SERVER\printersharename +

    +to see the tab with the Printing Preferences... +button (the one which doesn't set system-wide defaults). You can +start the commands from inside a DOS box" or from the Start +-- Run... menu. +

    Supporting large Numbers of Printers

    +One issue that has arisen during the recent development phase of Samba +is the need to support driver downloads for 100's of printers. Using +Windows NT APW here is somewhat awkward (to say the least). If you +don't want to acquire RSS pains from such the printer installation +clicking orgy alone, you need to think about a non-interactive script.

    -Samba reads the printcap information when first started. If you make -changes in the printcap information, then you must do the following: -

    1. -make sure that the print spooler is aware of these changes. -The LPRng system uses the 'lpc reread' command to do this. -

    2. -make sure that the spool queues, etc., exist and have the -correct permissions. The LPRng system uses the 'checkpc -f' -command to do this. -

    3. -You now should send a SIGHUP signal to the smbd server to have -it reread the printcap information. -

    Job sent, no output

    -This is the most frustrating part of printing. You may have sent the -job, verified that the job was forwarded, set up a wrapper around -the command to send the file, but there was no output from the printer. -

    -First, check to make sure that the job REALLY is getting to the -right print queue. If you are using a BSD or LPRng print spooler, -you can temporarily stop the printing of jobs. Jobs can still be -submitted, but they will not be printed. Use: -

    -  lpc -Pprinter stop
+If more than one printer is using the same driver, the
+rpcclient setdriver command can be used to set the
+driver associated with an installed queue. If the driver is uploaded
+to [print$] once and registered with the
+printing TDBs, it can be used by multiple print queues. In this case
+you just need to repeat the setprinter subcommand
+of rpcclient for every queue (without the need to
+conduct the adddriver again and again). The
+following is an example of how this could be accomplished:
+
    +root# rpcclient SAMBA-CUPS -U root%secret -c 'enumdrivers'
+ cmd = enumdrivers
+ 
+ [Windows NT x86]
+ Printer Driver Info 1:
+   Driver Name: [infotec  IS 2075 PCL 6]
+ 
+ Printer Driver Info 1:
+   Driver Name: [DANKA InfoStream]
+ 
+ Printer Driver Info 1:
+   Driver Name: [Heidelberg Digimaster 9110 (PS)]
+ 
+ Printer Driver Info 1:
+   Driver Name: [dm9110]
+
+ Printer Driver Info 1:
+   Driver Name: [myphantasydrivername]
+
+ [....]
 
    
-Now submit a print job and then use 'lpq -Pprinter' to see if the
-job is in the print queue.  If it is not in the print queue then
-you will have to find out why it is not being accepted for printing.
-
    
-Next, you may want to check to see what the format of the job really
-was.  With the assistance of the system administrator you can view
-the submitted jobs files.  You may be surprised to find that these
-are not in what you would expect to call a printable format.
-You can use the UNIX 'file' utitily to determine what the job
-format actually is:
-
    -    cd /var/spool/lpd/printer   # spool directory of print jobs
-    ls                          # find job files
-    file dfA001myhost
+
+
    +root# rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters'
+ cmd = enumprinters
+   flags:[0x800000]
+   name:[\\SAMBA-CUPS\dm9110]
+   description:[\\SAMBA-CUPS\dm9110,,110ppm HiVolume DANKA Stuttgart]
+   comment:[110 ppm HiVolume DANKA Stuttgart]
+ [....]
 
    
-You should make sure that your printer supports this format OR that
-your system administrator has installed a 'print filter' that will
-convert the file to a format appropriate for your printer.
-

    Job sent, strange output

    -Once you have the job printing, you can then start worrying about -making it print nicely. -

    -The most common problem is extra pages of output: banner pages -OR blank pages at the end. -

    -If you are getting banner pages, check and make sure that the -printcap option or printer option is configured for no banners. -If you have a printcap, this is the :sh (suppress header or banner -page) option. You should have the following in your printer. -

    -   printer: ... :sh
+
+
    +root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 "Heidelberg Digimaster 9110 (PS)"'
+ cmd = setdriver dm9110 Heidelberg Digimaster 9110 (PPD)
+ Successfully set dm9110 to driver Heidelberg Digimaster 9110 (PS).
 
    
-If you have this option and are still getting banner pages,  there
-is a strong chance that your printer is generating them for you
-automatically.  You should make sure that banner printing is disabled
-for the printer.  This usually requires using the printer setup software
-or procedures supplied by the printer manufacturer.
-
    
-If you get an extra page of output,  this could be due to problems
-with your job format,  or if you are generating PostScript jobs,
-incorrect setting on your printer driver on the MicroSoft client.
-For example, under Win95 there is a option:
-
    -  Printers|Printer Name|(Right Click)Properties|Postscript|Advanced|
+
+
    +root# rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters'
+ cmd = enumprinters
+   flags:[0x800000]
+   name:[\\SAMBA-CUPS\dm9110]
+   description:[\\SAMBA-CUPS\dm9110,Heidelberg Digimaster 9110 (PS),110ppm HiVolume DANKA Stuttgart]
+   comment:[110ppm HiVolume DANKA Stuttgart]
+ [....]
 
    
-that allows you to choose if a Ctrl-D is appended to all jobs.
-This is a very bad thing to do, as most spooling systems will
-automatically add a ^D to the end of the job if it is detected as
-PostScript.  The multiple ^D may cause an additional page of output.
-

    Raw PostScript printed

    -This is a problem that is usually caused by either the print spooling -system putting information at the start of the print job that makes -the printer think the job is a text file, or your printer simply -does not support PostScript. You may need to enable 'Automatic -Format Detection' on your printer. -

    Advanced Printing

    -Note that you can do some pretty magic things by using your -imagination with the "print command" option and some shell scripts. -Doing print accounting is easy by passing the %U option to a print -command shell script. You could even make the print command detect -the type of output and its size and send it to an appropriate -printer. -

    Real debugging

    -If the above debug tips don't help, then maybe you need to bring in -the bug guns, system tracing. See Tracing.txt in this directory. -

    Prev Up Next
    Chapter 12. Configuring Group Mapping Home Chapter 14. CUPS Printing Support
    + +

    +root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 myphantasydrivername'
+ cmd = setdriver dm9110 myphantasydrivername
+ Successfully set dm9110 to myphantasydrivername.
+

    + +

    +root# rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters'
+ cmd = enumprinters
+   flags:[0x800000]
+   name:[\\SAMBA-CUPS\dm9110]
+   description:[\\SAMBA-CUPS\dm9110,myphantasydrivername,110ppm HiVolume DANKA Stuttgart]
+   comment:[110ppm HiVolume DANKA Stuttgart]
+ [....]
+

    +It may be not easy to recognize: but the first call to +enumprinters showed the "dm9110" printer with an +empty string where the driver should have been listed (between the 2 +commas in the "description" field). After the +setdriver command succeeded, all is well. (The +CUPS Printing chapter has more info about the installation of printer +drivers with the help of rpcclient). +

    Adding new Printers with the Windows NT APW

    +By default, Samba exhibits all printer shares defined in +smb.conf in the +Printers... folder. Also located in this folder +is the Windows NT Add Printer Wizard icon. The APW will be shown only +if: +

    • ...the connected user is able to successfully execute +an OpenPrinterEx(\\server) with administrative +privileges (i.e. root or printer admin). +

      Tip

      Try this from a Windows 2K/XP DOS box command prompt: +

      +runas /netonly /user:root rundll32 printui.dll,PrintUIEntry /p /t0 /n \\SAMBA-SERVER\printersharename +

      +and click on Printing Preferences... +

    • ... contains the setting +show add printer wizard = yes (the +default).

    +The APW can do various things: +

    • upload a new driver to the Samba +[print$] share;

    • associate an uploaded driver with an existing (but +still "driverless") print queue;

    • exchange the currently used driver for an existing +print queue with one that has been uploaded before;

    • add an entirely new printer to the Samba host (only in +conjunction with a working add printer command; +a corresponding delete printer command for +removing entries from the Printers... folder +may be provided too)

    +The last one (add a new printer) requires more effort than the +previous ones. In order to use the APW to successfully add a printer +to a Samba server, the add printer command must +have a defined value. The program hook must successfully add the +printer to the Unix print system (i.e. to +/etc/printcap, +/etc/cups/printers.conf or other appropriate +files) and to if necessary. +

    +When using the APW from a client, if the named printer share does not +exist, smbd will execute the add printer +command and reparse to the +to attempt to locate the new printer share. If the share is still not +defined, an error of Access Denied is +returned to the client. Note that the add printer +command is executed under the context of the connected +user, not necessarily a root account. A map to guest = bad +user may have connected you unwittingly under the wrong +privilege; you should check it by using the +smbstatus command. +

    Weird Error Message Cannot connect under a +different Name

    +Once you are connected with the wrong credentials, there is no means +to reverse the situation other than to close all Explorer windows, and +perhaps reboot. +

    • The net use \\SAMBA-SERVER\sharename +/user:root gives you an error message: Multiple +connections to a server or a shared resource by the same user +utilizing the several user names are not allowed. Disconnect all +previous connections to the server, resp. the shared resource, and try +again.

    • Every attempt to "connect a network drive" to +\\SAMBASERVER\\print$ to z: is countered by the +pertinacious message. This network folder is currently +connected under different credentials (username and password). +Disconnect first any existing connection to this network share in +order to connect again under a different username and +password.

    +So you close all connections. You try again. You get the same +message. You check from the Samba side, using +smbstatus. Yes, there are some more +connections. You kill them all. The client still gives you the same +error message. You watch the smbd.log file on a very high debug level +and try re-connect. Same error message, but not a single line in the +log. You start to wonder if there was a connection attempt at all. You +run ethereal and tcpdump while you try to connect. Result: not a +single byte goes on the wire. Windows still gives the error +message. You close all Explorer Windows and start it again. You try to +connect - and this times it works! Windows seems to cache connection +info somewhere and doesn't keep it up to date (if you are unlucky you +might need to reboot to get rid of the error message). +

    Be careful when assembling Driver Files

    +You need to be very careful when you take notes about the files and +belonging to a particular driver. Don't confuse the files for driver +version "0" (for Win95/98/ME, going into +[print$]/WIN/0/), driver version "2" (Kernel Mode +driver for WinNT, going into [print$]/W32X86/2/ +may be used on Win2K/XP too), and driver version +"3" (non-Kernel Mode driver going into +[print$]/W32X86/3/ can not +be used on WinNT). Very often these different driver versions contain +files carrying the same name; but still the files are very different! +Also, if you look at them from the Windows Explorer (they reside in +%WINDOWS%\system32\spool\drivers\W32X86\) you +will probably see names in capital letters, while an "enumdrivers" +command from Samba would show mixed or lower case letters. So it is +easy to confuse them. If you install them manually using +rpcclient and subcommands, you may even succeed +without an error message. Only later, when you try install on a +client, you will encounter error messages like This +server has no appropriate driver for the printer. +

    +Here is an example. You are invited to look very closely at the +various files, compare their names and their spelling, and discover +the differences in the composition of the version-2 and -3 sets +Note: the version-0 set contained 40 (!) +Dependentfiles, so I left it out for space +reasons: +

    +root# rpcclient -U 'Administrator%secret' -c 'enumdrivers 3' 10.160.50.8 
+
+ Printer Driver Info 3:
+         Version: [3]
+         Driver Name: [Canon iR8500 PS3]
+         Architecture: [Windows NT x86]
+         Driver Path: [\\10.160.50.8\print$\W32X86\3\cns3g.dll]
+         Datafile: [\\10.160.50.8\print$\W32X86\3\iR8500sg.xpd]
+         Configfile: [\\10.160.50.8\print$\W32X86\3\cns3gui.dll]
+         Helpfile: [\\10.160.50.8\print$\W32X86\3\cns3g.hlp]
+ 
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\aucplmNT.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\ucs32p.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\tnl32.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\aussdrv.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cnspdc.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\aussapi.dat]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cns3407.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\CnS3G.cnt]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\NBAPI.DLL]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\NBIPC.DLL]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcview.exe]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcdspl.exe]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcedit.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcqm.exe]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcspl.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cfine32.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcr407.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\Cpcqm407.hlp]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cpcqm407.cnt]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\3\cns3ggr.dll]
+ 
+         Monitorname: []
+         Defaultdatatype: []
+
+ Printer Driver Info 3:
+         Version: [2]
+         Driver Name: [Canon iR5000-6000 PS3]
+         Architecture: [Windows NT x86]
+         Driver Path: [\\10.160.50.8\print$\W32X86\2\cns3g.dll]
+         Datafile: [\\10.160.50.8\print$\W32X86\2\IR5000sg.xpd]
+         Configfile: [\\10.160.50.8\print$\W32X86\2\cns3gui.dll]
+         Helpfile: [\\10.160.50.8\print$\W32X86\2\cns3g.hlp]
+ 
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\AUCPLMNT.DLL]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\aussdrv.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\cnspdc.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\aussapi.dat]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\cns3407.dll]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\CnS3G.cnt]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\NBAPI.DLL]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\NBIPC.DLL]
+         Dependentfiles: [\\10.160.50.8\print$\W32X86\2\cns3gum.dll]
+ 
+         Monitorname: [CPCA Language Monitor2]
+         Defaultdatatype: []
+
+

    +If we write the "version 2" files and the "version 3" files +into different text files and compare the result, we see this +picture: +

    +root# sdiff 2-files 3-files
+
+
+ cns3g.dll                     cns3g.dll
+ iR8500sg.xpd                  iR8500sg.xpd
+ cns3gui.dll                   cns3gui.dll
+ cns3g.hlp                     cns3g.hlp
+ AUCPLMNT.DLL                | aucplmNT.dll
+                             > ucs32p.dll
+                             > tnl32.dll
+ aussdrv.dll                   aussdrv.dll
+ cnspdc.dll                    cnspdc.dll
+ aussapi.dat                   aussapi.dat
+ cns3407.dll                   cns3407.dll
+ CnS3G.cnt                     CnS3G.cnt
+ NBAPI.DLL                     NBAPI.DLL
+ NBIPC.DLL                     NBIPC.DLL
+ cns3gum.dll                 | cpcview.exe
+                             > cpcdspl.exe 
+                             > cpcqm.exe
+                             > cpcspl.dll
+                             > cfine32.dll
+                             > cpcr407.dll
+                             > Cpcqm407.hlp
+                             > cpcqm407.cnt
+                             > cns3ggr.dll
+
+

    +Don't be fooled though! Driver files for each version with identical +names may be different in their content, as you can see from this size +comparison: +

    +root# for i in cns3g.hlp cns3gui.dll cns3g.dll; do                  \
+           smbclient //10.160.50.8/print\$ -U 'Administrator%xxxx' \
+           -c "cd W32X86/3; dir $i; cd .. ; cd 2; dir $i";      \
+		   done
+
+  CNS3G.HLP               A   122981  Thu May 30 02:31:00 2002
+  CNS3G.HLP               A    99948  Thu May 30 02:31:00 2002
+
+  CNS3GUI.DLL             A  1805824  Thu May 30 02:31:00 2002
+  CNS3GUI.DLL             A  1785344  Thu May 30 02:31:00 2002
+
+  CNS3G.DLL               A  1145088  Thu May 30 02:31:00 2002
+  CNS3G.DLL               A    15872  Thu May 30 02:31:00 2002
+
+

    +In my example were even more differences than shown here. Conclusion: +you must be very careful to select the correct driver files for each +driver version. Don't rely on the names alone. Don't interchange files +belonging to different driver versions. +

    Samba and Printer Ports

    +Windows NT/2000 print servers associate a port with each +printer. These normally take the form of LPT1:, +COM1:, FILE:, etc. Samba +must also support the concept of ports associated with a printer. By +default, only one printer port, named "Samba Printer Port", exists on +a system. Samba does not really need such a "port" in order to print; +it rather is a requirement of Windows clients. They insist on being +told about an available port when they request this info, otherwise +they throw an error message at you. So Samba fakes the port +information to keep the Windows clients happy. +

    +Note that Samba does not support the concept of "Printer Pooling" +internally either. Printer Pooling assigns a logical printer to +multiple ports as a form of load balancing or fail over. +

    +If you require that multiple ports be defined for some reason or +another (“My users and my Boss should not know that they are +working with Samba”), possesses a +enumports command which can be used to define +an external program that generates a listing of ports on a system. +

    Avoiding the most common Misconfigurations of the Client Driver

    +So - printing works, but there are still problems. Most jobs print +well, some don't print at all. Some jobs have problems with fonts, +which don't look good at all. Some jobs print fast, and some are +dead-slow. We can't cover it all; but we want to encourage you to read +the little paragraph about "Avoiding the wrong PostScript Driver +Settings" in the CUPS Printing part of this document. +

    The Imprints Toolset

    +The Imprints tool set provides a UNIX equivalent of the +Windows NT Add Printer Wizard. For complete information, please +refer to the Imprints web site +athttp://imprints.sourceforge.net/ +as well as the documentation included with the imprints source +distribution. This section will only provide a brief introduction +to the features of Imprints. +

    Attention! Maintainer required.  +Unfortunately, the Imprints toolset is no longer maintained. As of +December, 2000, the project is in need of a new maintainer. The most +important skill to have is decent perl coding and an interest in +MS-RPC based printing using Samba. If you wish to volunteer, please +coordinate your efforts on the samba-technical mailing list. The +toolset is still in usable form; but only for a series of older +printer models, where there are prepared packages to use. Packages for +more up to date print devices are needed if Imprints should have a +future.

    What is Imprints?

    +Imprints is a collection of tools for supporting these goals: +

    • Providing a central repository information regarding +Windows NT and 95/98 printer driver packages

    • Providing the tools necessary for creating the +Imprints printer driver packages.

    • Providing an installation client which will obtain +printer drivers from a central internet (or intranet) Imprints Server +repository and install them on remote Samba and Windows NT4 print +servers.

    Creating Printer Driver Packages

    +The process of creating printer driver packages is beyond the scope of +this document (refer to Imprints.txt also included with the Samba +distribution for more information). In short, an Imprints driver +package is a gzipped tarball containing the driver files, related INF +files, and a control file needed by the installation client. +

    The Imprints Server

    +The Imprints server is really a database server that may be queried +via standard HTTP mechanisms. Each printer entry in the database has +an associated URL for the actual downloading of the package. Each +package is digitally signed via GnuPG which can be used to verify that +package downloaded is actually the one referred in the Imprints +database. It is strongly recommended that this security check +not be disabled. +

    The Installation Client

    +More information regarding the Imprints installation client is +available in the Imprints-Client-HOWTO.ps file +included with the imprints source package. +

    +The Imprints installation client comes in two forms. +

    • a set of command line Perl scripts

    • a GTK+ based graphical interface to the command line Perl +scripts

    +The installation client (in both forms) provides a means of querying +the Imprints database server for a matching list of known printer +model names as well as a means to download and install the drivers on +remote Samba and Windows NT print servers. +

    +The basic installation process is in four steps and perl code is +wrapped around smbclient and rpcclient +

    • + foreach (supported architecture for a given driver) +

      1. rpcclient: Get the appropriate upload directory on the remote server

      2. smbclient: Upload the driver files

      3. rpcclient: Issues an AddPrinterDriver() MS-RPC

      +

    • rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer

    +One of the problems encountered when implementing the Imprints tool +set was the name space issues between various supported client +architectures. For example, Windows NT includes a driver named "Apple +LaserWriter II NTX v51.8" and Windows 95 calls its version of this +driver "Apple LaserWriter II NTX" +

    +The problem is how to know what client drivers have been uploaded for +a printer. An astute reader will remember that the Windows NT Printer +Properties dialog only includes space for one printer driver name. A +quick look in the Windows NT 4.0 system registry at +

    + HKLM\System\CurrentControlSet\Control\Print\Environment +

    +will reveal that Windows NT always uses the NT driver name. This is +ok as Windows NT always requires that at least the Windows NT version +of the printer driver is present. However, Samba does not have the +requirement internally. Therefore, how can you use the NT driver name +if is has not already been installed? +

    +The way of sidestepping this limitation is to require that all +Imprints printer driver packages include both the Intel Windows NT and +95/98 printer drivers and that NT driver is installed first. +

    Add Network Printers at Logon without User Interaction

    +The following MS Knowledge Base article may be of some help if you +need to handle Windows 2000 clients: How to Add Printers +with No User Interaction in Windows 2000. ( http://support.microsoft.com/default.aspx?scid=kb;en-us;189105 +). It also applies to Windows XP Professional clients. +

    +The ideas sketched out below are inspired by this article. It +describes a commandline method which can be applied to install +network and local printers and their drivers. This is most useful +if integrated in Logon Scripts. You can see what options are +available by typing in a command prompt ("DOS box") this: +

    rundll32 printui.dll,PrintUIEntry /?

    +A window pops up which shows you all of the commandline switches +available. An extensive list of examples is also provided. This is +only for Win 2k/XP. It doesn't work on WinNT. WinNT has probably some +other tools in the respective Resource Kit. Here is a suggestion about +what a client logon script might contain, with a short explanation of +what the lines actually do (it works if 2k/XP Windows clients access +printers via Samba, but works for Windows-based print servers too): +

    +rundll32 printui.dll,PrintUIEntry /dn /n "\\sambacupsserver\infotec2105-IPDS" /q
+rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\infotec2105-PS"
+rundll32 printui.dll,PrintUIEntry /y /n "\\sambacupsserver\infotec2105-PS"
+

    +Here is a list of the used commandline parameters: +

    /dn

    deletes a network printer

    /q

    quiet modus

    /n

    names a printer

    /in

    adds a network printer connection

    /y

    sets printer as default printer

    +I have tested this with a Samba 2.2.7a and a Samba-3alpha24 +installation and Windows XP Professional clients. Note that this +specific command set works with network print queues (installing +local print queues requires different parameters, but this is of no +interest here). +

    • Line 1 deletes a possibly existing previous network +printer infotec2105-IPDS (which had used native +Windows drivers with LPRng that were removed from the server which was +converted to CUPS). The /q at the end eliminates +"Confirm" or error dialog boxes popping up. They should not be +presented to the user logging on.

    • Line 2 adds the new printer +infotec2105-PS (which actually is same physical +device but is now run by the new CUPS printing system and associated +with the CUPS/Adobe PS drivers). The printer and its driver +must have been added to Samba prior to the user +logging in (e.g. by a procedure as discussed earlier in this chapter, +or by running cupsaddsmb). The driver is now +auto-downloaded to the client PC where the user is about to log +in.

    • Line 3 sets the default printer to this new network +printer (there might be several other printers installed with this +same method and some may be local as well -- so we decide for a +default printer). The default printer selection may of course be +different for different users.

    +Note that the second line only works if the printer +infotec2105-PS has an already working print queue +on "sambacupsserver", and if the printer drivers have successfully been +uploaded (via APW , +smbclient/rpcclient or +cupsaddsmb) into the +[print$] driver repository of Samba. Also, some +Samba versions prior to version 3.0 required a re-start of smbd after +the printer install and the driver upload, otherwise the script (or +any other client driver download) would fail. +

    +Since there no easy way to test for the existence of an installed +network printer from the logon script, the suggestion is: don't bother +checking and just allow the deinstallation/reinstallation to occur +every time a user logs in; it's really quick anyway (1 to 2 seconds). +

    +The additional benefits for this are: +

    • It puts in place any printer default setup changes +automatically at every user logon.

    • It allows for "roaming" users' login into the domain from +different workstations.

    +Since network printers are installed per user this much simplifies the +process of keeping the installation up-to-date. The extra few seconds +at logon time will not really be noticeable. Printers can be centrally +added, changed, and deleted at will on the server with no user +intervention required on the clients (you just need to keep the logon +scripts up to date). +

    The addprinter command

    +The addprinter command can be configured to be a +shell script or program executed by Samba. It is triggered by running +the APW from a client against the Samba print server. The APW asks the +user to fill in several fields (such as printer name, driver to be +used, comment, port monitor, etc.). These parameters are passed on to +Samba by the APW. If the addprinter command is designed in a way that +it can create a new printer (through writing correct printcap entries +on legacy systems, or execute the lpadmin command +on more modern systems) and create the associated share in +, then the APW will in effect really +create a new printer on Samba and the UNIX print subsystem! +

    Migration of "Classical" printing to Samba-3

    +The basic "NT-style" printer driver management has not changed +considerably in 3.0 over the 2.2.x releases (apart from many small +improvements). Here migration should be quite easy, especially if you +followed previous advice to stop using deprecated parameters in your +setup. For migrations from an existing 2.0.x setup, or if you +continued "Win9x-style" printing in your Samba 2.2 installations, it +is more of an effort. Please read the appropriate release notes and +the HOWTO Collection for 2.2. You can follow several paths. Here are +possible scenarios for migration: +

    • You need to study and apply the new Windows NT printer +and driver support. Previously used parameters "printer +driver file", " printer driver" and +"printer driver location" are no longer +supported.

    • If you want to take advantage of WinNT printer driver +support you also need to migrate the Win9x/ME drivers to the new +setup.

    • An existing printers.def file +(the one specified in the now removed parameter printer +driver file = ...) will work no longer with Samba-3.0. In +3.0, smbd attempts to locate a Win9x/ME driver files for the printer +in [print$] and additional settings in the TDB +and only there; if it fails it will not (as 2.2.x +used to do) drop down to using a printers.def +(and all associated parameters). The make_printerdef tool is removed +and there is no backwards compatibility for this.

    • You need to install a Windows 9x driver into the +[print$] share for a printer on your Samba +host. The driver files will be stored in the "WIN40/0" subdirectory of +[print$], and some other settings and info go +into the printing-related TDBs.

    • If you want to migrate an existing +printers.def file into the new setup, the current +only solution is to use the Windows NT APW to install the NT drivers +and the 9x drivers. This can be scripted using smbclient and +rpcclient. See the Imprints installation client at: +

      +http://imprints.sourceforge.net/ +

      +for an example. See also the discussion of rpcclient usage in the +"CUPS Printing" section.

    Publishing Printer Information in Active Directory or LDAP

    +We will publish an update to this section shortly. +

    Common Errors and Problems

    +Here are a few typical errors and problems people have +encountered. You can avoid them. Read on. +

    I give my root password but I don't get access

    +Don't confuse the root password which is valid for the Unix system +(and in most cases stored in the form of a one-way hash in a file +named /etc/shadow) with the password used to +authenticate against Samba!. Samba doesn't know the UNIX password; for +root to access Samba resources via Samba-type access, a Samba account +for root must be created first. This is often done with the +smbpasswd command. +

    My printjobs get spooled into the spooling directory, but then get lost

    +Don't use the existing Unix print system spool directory for the Samba +spool directory. It may seem convenient and a saving of space, but it +only leads to problems. The two must be separate. +

    Prev Up Next
    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba Home Chapter 19. CUPS Printing Support in Samba 3.0
    diff --git a/docs/htmldocs/problems.html b/docs/htmldocs/problems.html index f2bc0008eb..6628a7d8fe 100644 --- a/docs/htmldocs/problems.html +++ b/docs/htmldocs/problems.html @@ -1,17 +1,16 @@ - -Chapter 28. Analysing and solving samba problems
    Chapter 28. Analysing and solving samba problems
    Prev Part IV. Troubleshooting Next

    Chapter 28. Analysing and solving samba problems

    Gerald (Jerry) Carter

    Samba Team

    <jerry@samba.org>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    David Bannon

    Samba Team

    <dbannon@samba.org>

    8 Apr 2003

    Table of Contents

    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URL's
    Getting help from the mailing lists
    How to get off the mailinglists

    +Chapter 34. Analysing and solving samba problems

    Chapter 34. Analysing and solving samba problems
    Prev Part V. Troubleshooting Next

    Chapter 34. Analysing and solving samba problems

    Gerald (Jerry) Carter

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    David Bannon

    Samba Team

    8 Apr 2003

    Table of Contents

    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists

    There are many sources of information available in the form of mailing lists, RFC's and documentation. The docs that come with the samba distribution contain very good explanations of -general SMB topics such as browsing.

    Diagnostics tools

    +general SMB topics such as browsing.

    Diagnostics tools

    One of the best diagnostic tools for debugging problems is Samba itself. -You can use the -d option for both smbd and nmbd to specify what -'debug level' at which to run. See the man pages on smbd, nmbd and +You can use the -d option for both smbd and nmbd to specify what +debug level at which to run. See the man pages on smbd, nmbd and smb.conf for more information on debugging options. The debug level can range from 1 (the default) to 10 (100 for debugging passwords).

    Another helpful method of debugging is to compile samba using the -gcc -g flag. This will include debug +gcc -g flag. This will include debug information in the binaries and allow you to attach gdb to the running smbd / nmbd process. In order to attach gdb to an smbd process for an NT workstation, first get the workstation to make the @@ -24,7 +23,10 @@ idle timeout) So, in between pressing ctrl alt delete, and actually typing in your password, you can attach gdb and continue.

    Some useful samba commands worth investigating: -

    • testparam | more

    • smbclient -L //{netbios name of server}

    +

    +	$ testparm | more
+	$ smbclient -L //{netbios name of server}
+

    An SMB enabled version of tcpdump is available from http://www.tcpdup.org/. Ethereal, another good packet sniffer for Unix and Win32 @@ -39,7 +41,7 @@ The version on the NT Server install CD will only allow monitoring of network traffic directed to the local NT box and broadcasts on the local subnet. Be aware that Ethereal can read and write netmon formatted files. -

    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box

    +

    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box

    Installing netmon on an NT workstation requires a couple of steps. The following are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 4.0, on Microsoft Windows NT @@ -47,51 +49,44 @@ Workstation 4.0. The process should be similar for other versions of Windows NT / Netmon. You will need both the Microsoft Windows NT Server 4.0 Install CD and the Workstation 4.0 Install CD.

    -Initially you will need to install 'Network Monitor Tools and Agent' +Initially you will need to install Network Monitor Tools and Agent on the NT Server. To do this -

    • Goto Start - Settings - Control Panel - - Network - Services - Add

    • Select the 'Network Monitor Tools and Agent' and - click on 'OK'.

    • Click 'OK' on the Network Control Panel. +

      • Goto Start - Settings - Control Panel - + Network - Services - Add

      • Select the Network Monitor Tools and Agent and + click on OK.

      • Click OK on the Network Control Panel.

      • Insert the Windows NT Server 4.0 install CD when prompted.

      At this point the Netmon files should exist in -%SYSTEMROOT%\System32\netmon\*.*. -Two subdirectories exist as well, parsers\ +%SYSTEMROOT%\System32\netmon\*.*. +Two subdirectories exist as well, parsers\ which contains the necessary DLL's for parsing the netmon packet -dump, and captures\. +dump, and captures\.

      In order to install the Netmon tools on an NT Workstation, you will first need to install the 'Network Monitor Agent' from the Workstation install CD. -

      • Goto Start - Settings - Control Panel - - Network - Services - Add

      • Select the 'Network Monitor Agent' and click - on 'OK'.

      • Click 'OK' on the Network Control Panel. +

        • Goto Start - Settings - Control Panel - + Network - Services - Add

        • Select the Network Monitor Agent and click + on OK.

        • Click OK on the Network Control Panel.

        • Insert the Windows NT Workstation 4.0 install CD when prompted.

        -Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* -to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set -permissions as you deem appropriate for your site. You will need +Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* +to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set +permissions as you deem appropriate for your site. You will need administrative rights on the NT box to run netmon.

        To install Netmon on a Windows 9x box install the network monitor agent -from the Windows 9x CD (\admin\nettools\netmon). There is a readme +from the Windows 9x CD (\admin\nettools\netmon). There is a readme file located with the netmon driver files on the CD if you need information on how to do this. Copy the files from a working Netmon installation. -

      Useful URL's

      • Home of Samba site - http://samba.org. We have a mirror near you !

      • The Development document -on the Samba mirrors might mention your problem. If so, -it might mean that the developers are working on it.

      • See how Scott Merrill simulates a BDC behavior at +

      Useful URLs

      Getting help from the mailing lists

      + ftp://ftp.microsoft.com/developr/drg/CIFS/

    Getting help from the mailing lists

    There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror -and then click on Support and then click on +and then click on Support and then click on Samba related mailing lists.

    For questions relating to Samba TNG go to @@ -104,7 +99,7 @@ not paid and they never guarantee to produce a particular feature at a particular time. Any time lines are 'best guess' and nothing more.

  • Always mention what version of samba you are using and what operating system its running under. You should probably list the -relevant sections of your smb.conf file, at least the options +relevant sections of your smb.conf file, at least the options in [global] that affect PDC support.

  • In addition to the version, if you obtained Samba via CVS mention the date when you last checked it out.

  • Try and make your question clear and brief, lots of long, convoluted questions get deleted before they are completely read ! @@ -123,12 +118,12 @@ error messages.

  • (Possibly) If you have a complete netmon trace ( the pipe to the error ) you can send the *.CAP file as well.

  • Please think carefully before attaching a document to an email. Consider pasting the relevant parts into the body of the message. The samba mailing lists go to a huge number of people, do they all need a copy of your -smb.conf in their attach directory?

    • How to get off the mailinglists

    To have your name removed from a samba mailing list, go to the +smb.conf in their attach directory?

    How to get off the mailing lists

    To have your name removed from a samba mailing list, go to the same place you went to to get on it. Go to http://lists.samba.org, -click on your nearest mirror and then click on Support and -then click on Samba related mailing lists. Or perhaps see +click on your nearest mirror and then click on Support and +then click on Samba related mailing lists. Or perhaps see here

    Please don't post messages to the list asking to be removed, you will just be referred to the above address (unless that process failed in some way...) -

    Prev Up Next
    Chapter 27. The samba checklist Home Chapter 29. Reporting Bugs
    +

    Prev Up Next
    Chapter 33. The Samba checklist Home Chapter 35. Reporting Bugs
    diff --git a/docs/htmldocs/profiles.1.html b/docs/htmldocs/profiles.1.html index ea9f779b57..4aa4987203 100644 --- a/docs/htmldocs/profiles.1.html +++ b/docs/htmldocs/profiles.1.html @@ -1,9 +1,9 @@ -profiles

    Name

    profiles — A utility to report and change SIDs in registry files -

    Synopsis

    profiles [-v] [-c SID] [-n SID] {file}

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    profiles is a utility that +profiles

    Name

    profiles — A utility to report and change SIDs in registry files +

    Synopsis

    profiles [-v] [-c SID] [-n SID] {file}

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    profiles is a utility that reports and changes SIDs in windows registry files. It currently only supports NT.

    OPTIONS

    file

    Registry file to view or edit.

    -v,--verbose

    Increases verbosity of messages. -

    -c SID1 -n SID2

    Change all occurences of SID1 in file by SID2. +

    -c SID1 -n SID2

    Change all occurences of SID1 in file by SID2.

    -h|--help

    Print a summary of command line options.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    AUTHOR

    The original Samba software and related utilities diff --git a/docs/htmldocs/rpcclient.1.html b/docs/htmldocs/rpcclient.1.html index ed351b0096..47c4d914a5 100644 --- a/docs/htmldocs/rpcclient.1.html +++ b/docs/htmldocs/rpcclient.1.html @@ -1,31 +1,31 @@ -rpcclient

    Name

    rpcclient — tool for executing client side - MS-RPC functions

    Synopsis

    rpcclient [-A authfile] [-c <command string>] [-d debuglevel] [-h] [-l logfile] [-N] [-s <smb config file>] [-U username[%password]] [-W workgroup] [-N] [-I destinationIP] {server}

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    rpcclient is a utility initially developed +rpcclient

    Name

    rpcclient — tool for executing client side + MS-RPC functions

    Synopsis

    rpcclient [-A authfile] [-c <command string>] [-d debuglevel] [-h] [-l logfile] [-N] [-s <smb config file>] [-U username[%password]] [-W workgroup] [-N] [-I destinationIP] {server}

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    rpcclient is a utility initially developed to test MS-RPC functionality in Samba itself. It has undergone several stages of development and stability. Many system administrators have now written scripts around it to manage Windows NT clients from their UNIX workstation.

    OPTIONS

    server

    NetBIOS name of Server to which to connect. The server can be any SMB/CIFS server. The name is resolved using the - name resolve order line from smb.conf(5).

    -c|--command='command string'

    execute semicolon separated commands (listed - below))

    -I IP-address

    IP address is the address of the server to connect to. + name resolve order line from smb.conf(5).

    -c|--command='command string'

    execute semicolon separated commands (listed + below))

    -I IP-address

    IP address is the address of the server to connect to. It should be specified in standard "a.b.c.d" notation.

    Normally the client would attempt to locate a named SMB/CIFS server by looking it up via the NetBIOS name resolution - mechanism described above in the name resolve order + mechanism described above in the name resolve order parameter above. Using this parameter will force the client to assume that the server is on the machine with the specified IP address and the NetBIOS name component of the resource being connected to will be ignored.

    There is no default for this parameter. If not supplied, it will be determined automatically by the client as described above.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -39,8 +39,8 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -N

    If specified, this parameter suppresses the normal password prompt from the client to the user. This is useful when @@ -58,26 +58,26 @@ password = <value> domain = <value>

    Make certain that the permissions on the file restrict access from unwanted users.

    -U|--user=username[%password]

    Sets the SMB username or username and password.

    If %password is not specified, the user will be prompted. The -client will first check the USER environment variable, then the -LOGNAME variable and if either exists, the +client will first check the USER environment variable, then the +LOGNAME variable and if either exists, the string is uppercased. If these environmental variables are not -found, the username GUEST is used.

    A third option is to use a credentials file which +found, the username GUEST is used.

    A third option is to use a credentials file which contains the plaintext of the username and password. This option is mainly provided for scripts where the admin does not wish to pass the credentials on the command line or via environment variables. If this method is used, make certain that the permissions on the file restrict access from unwanted users. See the --A for more details.

    Be cautious about including passwords in scripts. Also, on +-A for more details.

    Be cautious about including passwords in scripts. Also, on many systems the command line of a running process may be seen -via the ps command. To be safe always allow -rpcclient to prompt for a password and type +via the ps command. To be safe always allow +rpcclient to prompt for a password and type it in directly.

    -n <primary NetBIOS name>

    This option allows you to override the NetBIOS name that Samba uses for itself. This is identical -to setting the NetBIOS -name parameter in the smb.conf(5) file. However, a command +to setting the NetBIOS +name parameter in the smb.conf(5) file. However, a command line setting will take precedence over settings in -smb.conf(5).

    -i <scope>

    This specifies a NetBIOS scope that -nmblookup will use to communicate with when +smb.conf(5).

    -i <scope>

    This specifies a NetBIOS scope that +nmblookup will use to communicate with when generating NetBIOS names. For details on the use of NetBIOS scopes, see rfc1001.txt and rfc1002.txt. NetBIOS scopes are very rarely used, only set this parameter @@ -88,7 +88,7 @@ smb.conf. If the domain specified is the same as the servers NetBIOS name, it causes the client to log on using the servers local SAM (as opposed to the Domain SAM).

    -O socket options

    TCP socket options to set on the client socket. See the socket options parameter in -the smb.conf(5) manual page for the list of valid +the smb.conf(5) manual page for the list of valid options.

    -h|--help

    Print a summary of command line options.

    COMMANDS

    LSARPC

    lsaquery

    Query info policy

    lookupsids

    Resolve a list of SIDs to usernames. @@ -98,10 +98,10 @@ options.

    -h|--help

    Print a sum Execute an AddPrinterDriver() RPC to install the printer driver information on the server. Note that the driver files should already exist in the directory returned by - getdriverdir. Possible values for - arch are the same as those for - the getdriverdir command. - The config parameter is defined as + getdriverdir. Possible values for + arch are the same as those for + the getdriverdir command. + The config parameter is defined as follows: 

     Long Printer Name:\
 Driver File Name:\
@@ -120,9 +120,9 @@ Comma Separated list of Files
 		<sharename> <drivername> <port>
    
 		Add a printer on the remote server.  This printer 
  		will be automatically shared.  Be aware that the printer driver 
-		must already be installed on the server (see adddriver) 
-		and the portmust be a valid port name (see
-		enumports.
    deldriver
    Delete the 
+		must already be installed on the server (see adddriver) 
+		and the portmust be a valid port name (see
+		enumports.
    deldriver
    Delete the 
 		specified printer driver for all architectures.  This
 		does not delete the actual driver files from the server,
 		only the entry from the server's list of drivers.
@@ -144,8 +144,8 @@ Comma Separated list of Files
 		options. Currently supported info levels are 1, 2, and 3.
    enumprinters [level]
    Execute an EnumPrinters() call.  This lists the various installed 
 		and share printers.  Refer to the MS Platform SDK documentation for 
 		more details of the various flags and calling options. Currently
-		supported info levels are 0, 1, and 2.
    getdata <printername> <valuename;>
    Retrieve the data for a given printer setting.  See 
-		the  enumdata command for more information.  
+		supported info levels are 1, 2 and 5.
    getdata <printername> <valuename;>
    Retrieve the data for a given printer setting.  See 
+		the  enumdata command for more information.  
 		This command corresponds to the GetPrinterData() MS Platform 
 		SDK function. 
    getdataex
    Get
 		printer driver data with
@@ -158,7 +158,7 @@ Comma Separated list of Files
 		Execute a GetPrinterDriverDirectory()
 		RPC to retrieve the SMB share name and subdirectory for 
 		storing printer driver files for a given architecture.  Possible 
-		values for arch are "Windows 4.0" 
+		values for arch are "Windows 4.0" 
 		(for Windows 95/98), "Windows NT x86", "Windows NT PowerPC", "Windows
 		Alpha_AXP", and "Windows NT R4000". 
    getprinter <printername>
    Retrieve the current printer information.  This command 
 		corresponds to the GetPrinter() MS Platform SDK function. 
@@ -168,13 +168,13 @@ Comma Separated list of Files
 		against a given printer. 
    setdriver <printername>
 		<drivername>
    Execute a SetPrinter() command to update the printer driver
 		associated with an installed printer.  The printer driver must
-		already be correctly installed on the print server.  
    See also the enumprinters and 
-		enumdrivers commands for obtaining a list of
+		already be correctly installed on the print server.  
    See also the enumprinters and 
+		enumdrivers commands for obtaining a list of
 		of installed printers and drivers.
    addform
    Add form
    setform
    Set form
    getform
    Get form
    deleteform
    Delete form
    enumforms
    Enumerate form
    setprinter
    Set printer comment
    setprinterdata
    Set REG_SZ printer data
    rffpcnex
    Rffpcnex test

    NETLOGON

    logonctrl2

    Logon Control 2

    logonctrl

    Logon Control

    samsync

    Sam Synchronisation

    samdeltas

    Query Sam Deltas

    samlogon

    Sam Logon

    GENERAL COMMANDS

    debuglevel

    Set the current debug level used to log information.

    help (?)

    Print a listing of all known commands or extended help on a particular command. -

    quit (exit)

    Exit rpcclient - .

    BUGS

    rpcclient is designed as a developer testing tool +

    quit (exit)

    Exit rpcclient + .

    BUGS

    rpcclient is designed as a developer testing tool and may not be robust in certain areas (such as command line parsing). It has been known to generate a core dump upon failures when invalid parameters where passed to the interpreter.

    From Luke Leighton's original rpcclient man page:

    WARNING! The MSRPC over SMB code has @@ -184,7 +184,7 @@ Comma Separated list of Files implementation of these services has been demonstrated (and reported) to be... a bit flaky in places.

    The development of Samba's implementation is also a bit rough, and as more of the services are understood, it can even result in - versions of smbd(8) and rpcclient(1) that are incompatible for some commands or services. Additionally, + versions of smbd(8) and rpcclient(1) that are incompatible for some commands or services. Additionally, the developers are sending reports to Microsoft, and problems found or reported to Microsoft are fixed in Service Packs, which may result in incompatibilities.

    VERSION

    This man page is correct for version 3.0 of the Samba diff --git a/docs/htmldocs/samba-bdc.html b/docs/htmldocs/samba-bdc.html index 0a8a8fa2e1..4c2045642d 100644 --- a/docs/htmldocs/samba-bdc.html +++ b/docs/htmldocs/samba-bdc.html @@ -1,148 +1,259 @@ - -Chapter 6.  -Samba Backup Domain Controller to Samba Domain Control -

    Chapter 6.  -Samba Backup Domain Controller to Samba Domain Control -
    Prev Part II. Server Configuration Basics Next

    Chapter 6.  -Samba Backup Domain Controller to Samba Domain Control -

    Volker Lendecke

    Samba Team

    <Volker.Lendecke@SerNet.DE>

    (26 Apr 2001)

    Table of Contents

    Prerequisite Reading
    Background
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    When is the PDC needed?
    Can Samba be a Backup Domain Controller to an NT PDC?
    How do I set up a Samba BDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?

    Prerequisite Reading

    -Before you continue reading in this chapter, please make sure -that you are comfortable with configuring a Samba PDC -as described in the Samba-PDC-HOWTO. -

    Background

    -What is a Domain Controller? It is a machine that is able to answer -logon requests from workstations in a Windows NT Domain. Whenever a -user logs into a Windows NT Workstation, the workstation connects to a -Domain Controller and asks him whether the username and password the -user typed in is correct. The Domain Controller replies with a lot of -information about the user, for example the place where the users -profile is stored, the users full name of the user. All this -information is stored in the NT user database, the so-called SAM. +Chapter 6. Backup Domain Control

    Chapter 6. Backup Domain Control
    Prev Part II. Server Configuration Basics Next

    Chapter 6. Backup Domain Control

    John H. Terpstra

    Samba Team

    Volker Lendecke

    Samba Team

    Table of Contents

    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?

    +Before you continue reading in this section, please make sure that you are comfortable +with configuring a Samba Domain Controller as described in the +Domain Control chapter. +

    Features And Benefits

    +This is one of the most difficult chapters to summarise. It does not matter what we say here +for someone will still draw conclusions and / or approach the Samba-Team with expectations +that are either not yet capable of being delivered, or that can be achieved far more +effectively using a totally different approach. Since this HOWTO is already so large and +extensive, we have taken the decision to provide sufficient (but not comprehensive) +information regarding Backup Domain Control. In the event that you should have a persistent +concern that is not addressed in this HOWTO document then please email +John H Terpstra clearly setting out your requirements +and / or question and we will do our best to provide a solution.

    -There are two kinds of Domain Controller in a NT 4 compatible Domain: -A Primary Domain Controller (PDC) and one or more Backup Domain -Controllers (BDC). The PDC contains the master copy of the -SAM. Whenever the SAM has to change, for example when a user changes -his password, this change has to be done on the PDC. A Backup Domain -Controller is a machine that maintains a read-only copy of the -SAM. This way it is able to reply to logon requests and authenticate -users in case the PDC is not available. During this time no changes to -the SAM are possible. Whenever changes to the SAM are done on the PDC, -all BDC receive the changes from the PDC. +Samba-3 is capable of acting as a Backup Domain Controller to another Samba Primary Domain +Controller. A Samba-3 PDC can operate with an LDAP Account backend. The Samba-3 BDC can +operate with a slave LDAP server for the Account backend. This effectively gives samba a high +degree of scalability. This is a very sweet (nice) solution for large organisations.

    -Since version 2.2 Samba officially supports domain logons for all -current Windows Clients, including Windows 2000 and XP. This text -assumes the domain to be named SAMBA. To be able to act as a PDC, some -parameters in the [global]-section of the smb.conf have to be set: +While it is possible to run a Samba-3 BDC with non-LDAP backend, the administrator will +need to figure out precisely what is the best way to replicate (copy / distribute) the +user and machine Accounts backend. +

    +The use of a non-LDAP backend SAM database is particularly problematic because Domain member +servers and workstations periodically change the machine trust account password. The new +password is then stored only locally. This means that in the absence of a centrally stored +accounts database (such as that provided with an LDAP based solution) if Samba-3 is running +as a BDC, the BDC instance of the Domain member trust account password will not reach the +PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs this results in +overwriting of the SAM that contains the updated (changed) trust account password with resulting +breakage of the domain trust. +

    +Considering the number of comments and questions raised concerning how to configure a BDC +lets consider each possible option and look at the pro's and con's for each theoretical solution: +

    Backup Domain Backend Account Distribution Options

    • + Solution: Passwd Backend is LDAP based, BDCs use a slave LDAP server +

      + Arguments For: This is a neat and manageable solution. The LDAP based SAM (ldapsam) + is constantly kept up to date. +

      + Arguments Against: Complexity +

    • + Passdb Backend is tdbsam based, BDCs use cron based "net rpc vampire" to + suck down the Accounts database from the PDC +

      + Arguments For: It would be a nice solution +

      + Arguments Against: It does not work because Samba-3 does not support the required + protocols. This may become a later feature but is not available today. +

    • + Make use of rsync to replicate (pull down) copies of the essential account files +

      + Arguments For: It is a simple solution, easy to set up as a scheduled job +

      + Arguments Against: This will over-write the locally changed machine trust account + passwords. This is a broken and flawed solution. Do NOT do this. +

    • + Operate with an entirely local accounts database (not recommended) +

      + Arguments For: Simple, easy to maintain +

      + Arguments Against: All machine trust accounts and user accounts will be locally + maintained. Domain users will NOT be able to roam from office to office. This is + a broken and flawed solution. Do NOT do this. +

    Essential Background Information

    +A Domain Controller is a machine that is able to answer logon requests from network +workstations. Microsoft LanManager and IBM LanServer were two early products that +provided this capability. The technology has become known as the LanMan Netlogon service. +

    +When MS Windows NT3.10 was first released, it supported an new style of Domain Control +and with it a new form of the network logon service that has extended functionality. +This service became known as the NT NetLogon Service. The nature of this service has +changed with the evolution of MS Windows NT and today provides a very complex array of +services that are implemented over a complex spectrum of technologies. +

    MS Windows NT4 Style Domain Control

    +Whenever a user logs into a Windows NT4 / 200x / XP Professional Workstation, +the workstation connects to a Domain Controller (authentication server) to validate +the username and password that the user entered are valid. If the information entered +does not validate against the account information that has been stored in the Domain +Control database (the SAM, or Security Account Manager database) then a set of error +codes is returned to the workstation that has made the authentication request. +

    +When the username / password pair has been validated, the Domain Controller +(authentication server) will respond with full enumeration of the account information +that has been stored regarding that user in the User and Machine Accounts database +for that Domain. This information contains a complete network access profile for +the user but excludes any information that is particular to the user's desktop profile, +or for that matter it excludes all desktop profiles for groups that the user may +belong to. It does include password time limits, password uniqueness controls, +network access time limits, account validity information, machine names from which the +user may access the network, and much more. All this information was stored in the SAM +in all versions of MS Windows NT (3.10, 3.50, 3.51, 4.0). +

    +The account information (user and machine) on Domain Controllers is stored in two files, +one containing the Security information and the other the SAM. These are stored in files +by the same name in the C:\WinNT\System32\config directory. These +are the files that are involved in replication of the SAM database where Backup Domain +Controllers are present on the network. +

    +There are two situations in which it is desirable to install Backup Domain Controllers: +

    • + On the local network that the Primary Domain Controller is on, if there are many + workstations and/or where the PDC is generally very busy. In this case the BDCs + will pick up network logon requests and help to add robustness to network services. +

    • + At each remote site, to reduce wide area network traffic and to add stability to + remote network operations. The design of the network, the strategic placement of + Backup Domain Controllers, together with an implementation that localises as much + of network to client interchange as possible will help to minimise wide area network + bandwidth needs (and thus costs). +

    +The PDC contains the master copy of the SAM. In the event that an administrator makes a +change to the user account database while physically present on the local network that +has the PDC, the change will likely be made directly to the PDC instance of the master +copy of the SAM. In the event that this update may be performed in a branch office the +change will likely be stored in a delta file on the local BDC. The BDC will then send +a trigger to the PDC to commence the process of SAM synchronisation. The PDC will then +request the delta from the BDC and apply it to the master SAM. The PDC will then contact +all the BDCs in the Domain and trigger them to obtain the update and then apply that to +their own copy of the SAM. +

    +Thus the BDC is said to hold a read-only of the SAM from which +it is able to process network logon requests and to authenticate users. The BDC can +continue to provide this service, particularly while, for example, the wide area +network link to the PDC is down. Thus a BDC plays a very important role in both +maintenance of Domain security as well as in network integrity. +

    +In the event that the PDC should need to be taken out of service, or if it dies, then +one of the BDCs can be promoted to a PDC. If this happens while the original PDC is on +line then it is automatically demoted to a BDC. This is an important aspect of Domain +Controller management. The tool that is used to affect a promotion or a demotion is the +Server Manager for Domains. +

    Example PDC Configuration

    +Since version 2.2 Samba officially supports domain logons for all current Windows Clients, +including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some +parameters in the [global]-section of the smb.conf have to be set: 

     	workgroup = SAMBA
 	domain master = yes
 	domain logons = yes

    -Several other things like a [homes] and a [netlogon] share also may be -set along with settings for the profile path, the users home drive and -others. This will not be covered in this document. -

    What qualifies a Domain Controller on the network?

    -Every machine that is a Domain Controller for the domain SAMBA has to -register the NetBIOS group name SAMBA#1c with the WINS server and/or -by broadcast on the local network. The PDC also registers the unique -NetBIOS name SAMBA#1b with the WINS server. The name type #1b is -normally reserved for the domain master browser, a role that has -nothing to do with anything related to authentication, but the -Microsoft Domain implementation requires the domain master browser to -be on the same machine as the PDC. -

    How does a Workstation find its domain controller?

    -A NT workstation in the domain SAMBA that wants a local user to be -authenticated has to find the domain controller for SAMBA. It does -this by doing a NetBIOS name query for the group name SAMBA#1c. It -assumes that each of the machines it gets back from the queries is a -domain controller and can answer logon requests. To not open security -holes both the workstation and the selected (TODO: How is the DC -chosen) domain controller authenticate each other. After that the -workstation sends the user's credentials (his name and password) to -the domain controller, asking for approval. -

    When is the PDC needed?

    -Whenever a user wants to change his password, this has to be done on -the PDC. To find the PDC, the workstation does a NetBIOS name query -for SAMBA#1b, assuming this machine maintains the master copy of the -SAM. The workstation contacts the PDC, both mutually authenticate and -the password change is done. -

    Can Samba be a Backup Domain Controller to an NT PDC?

    -With version 2.2, no. The native NT SAM replication protocols have -not yet been fully implemented. The Samba Team is working on -understanding and implementing the protocols, but this work has not -been finished for version 2.2. -

    -With version 3.0, the work on both the replication protocols and a -suitable storage mechanism has progressed, and some form of NT4 BDC -support is expected soon. -

    -Can I get the benefits of a BDC with Samba? Yes. The main reason for -implementing a BDC is availability. If the PDC is a Samba machine, -a second Samba machine can be set up to -service logon requests whenever the PDC is down. -

    How do I set up a Samba BDC?

    +Several other things like a [homes] and a [netlogon] share also need to be set along with +settings for the profile path, the users home drive, etc.. This will not be covered in this +chapter, for more information please refer to the chapter on Domain Control. +

    Active Directory Domain Control

    +As of the release of MS Windows 2000 and Active Directory, this information is now stored +in a directory that can be replicated and for which partial or full administrative control +can be delegated. Samba-3 is NOT able to be a Domain Controller within an Active Directory +tree, and it can not be an Active Directory server. This means that Samba-3 also can NOT +act as a Backup Domain Controller to an Active Directory Domain Controller. +

    What qualifies a Domain Controller on the network?

    +Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS +group name SAMBA<#1c> with the WINS server and/or by broadcast on the local network. +The PDC also registers the unique NetBIOS name SAMBA<#1b> with the WINS server. +The name type <#1b> name is normally reserved for the Domain Master Browser, a role +that has nothing to do with anything related to authentication, but the Microsoft Domain +implementation requires the domain master browser to be on the same machine as the PDC. +

    How does a Workstation find its domain controller?

    +An MS Windows NT4 / 200x / XP Professional workstation in the domain SAMBA that wants a +local user to be authenticated has to find the domain controller for SAMBA. It does this +by doing a NetBIOS name query for the group name SAMBA<#1c>. It assumes that each +of the machines it gets back from the queries is a domain controller and can answer logon +requests. To not open security holes both the workstation and the selected domain controller +authenticate each other. After that the workstation sends the user's credentials (name and +password) to the local Domain Controller, for validation. +

    Backup Domain Controller Configuration

    Several things have to be done:

    • -The domain SID has to be the same on the PDC and the BDC. This used to -be stored in the file private/MACHINE.SID. This file is not created -anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is -stored in the file private/secrets.tdb. Simply copying the secrets.tdb -from the PDC to the BDC does not work, as the BDC would -generate a new SID for itself and override the domain SID with this -new BDC SID.

      -To retrieve the domain SID from the PDC or an existing BDC and store it in the -secrets.tdb, execute 'net rpc getsid' on the BDC. -

    • -The Unix user database has to be synchronized from the PDC to the -BDC. This means that both the /etc/passwd and /etc/group have to be -replicated from the PDC to the BDC. This can be done manually -whenever changes are made, or the PDC is set up as a NIS master -server and the BDC as a NIS slave server. To set up the BDC as a -mere NIS client would not be enough, as the BDC would not be able to -access its user database in case of a PDC failure. -

    • -The Samba password database in the file private/smbpasswd has to be -replicated from the PDC to the BDC. This is a bit tricky, see the -next section. -

    • -Any netlogon share has to be replicated from the PDC to the -BDC. This can be done manually whenever login scripts are changed, -or it can be done automatically together with the smbpasswd -synchronization. -

    -Finally, the BDC has to be found by the workstations. This can be done -by setting + The domain SID has to be the same on the PDC and the BDC. This used to + be stored in the file private/MACHINE.SID. This file is not created + anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is + stored in the file private/secrets.tdb. Simply copying the secrets.tdb + from the PDC to the BDC does not work, as the BDC would + generate a new SID for itself and override the domain SID with this + new BDC SID.

    + To retrieve the domain SID from the PDC or an existing BDC and store it in the + secrets.tdb, execute: + 

    +	root# net rpc getsid
+

  • + The Unix user database has to be synchronized from the PDC to the + BDC. This means that both the /etc/passwd and /etc/group have to be + replicated from the PDC to the BDC. This can be done manually + whenever changes are made, or the PDC is set up as a NIS master + server and the BDC as a NIS slave server. To set up the BDC as a + mere NIS client would not be enough, as the BDC would not be able to + access its user database in case of a PDC failure. NIS is by no means + the only method to synchronize passwords. An LDAP solution would work + as well. +

  • + The Samba password database has to be replicated from the PDC to the BDC. + As said above, though possible to synchronise the smbpasswd + file with rsync and ssh, this method is broken and flawed, and is + therefore not recommended. A better solution is to set up slave LDAP + servers for each BDC and a master LDAP server for the PDC. +

  • + Any netlogon share has to be replicated from the PDC to the + BDC. This can be done manually whenever login scripts are changed, + or it can be done automatically together with the smbpasswd + synchronization. +

    • Example Configuration

    +Finally, the BDC has to be found by the workstations. This can be done by setting: 

    -	workgroup = samba
+	workgroup = SAMBA
 	domain master = no
 	domain logons = yes

    -in the [global]-section of the smb.conf of the BDC. This makes the BDC -only register the name SAMBA#1c with the WINS server. This is no -problem as the name SAMBA#1c is a NetBIOS group name that is meant to +in the [global]-section of the smb.conf of the BDC. This makes the BDC +only register the name SAMBA<#1c> with the WINS server. This is no +problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to be registered by more than one machine. The parameter 'domain master = -no' forces the BDC not to register SAMBA#1b which as a unique NetBIOS +no' forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS name is reserved for the Primary Domain Controller. -

    How do I replicate the smbpasswd file?

    -Replication of the smbpasswd file is sensitive. It has to be done -whenever changes to the SAM are made. Every user's password change is -done in the smbpasswd file and has to be replicated to the BDC. So -replicating the smbpasswd file very often is necessary. +

    Common Errors

    +As this is a rather new area for Samba there are not many examples that we may refer to. Keep +watching for updates to this section. +

    Machine Accounts keep expiring, what can I do?

    +This problem will occur when occur when the passdb (SAM) files are copied from a central +server but the local Backup Domain Controllers. Local machine trust account password updates +are not copied back to the central server. The newer machine account password is then over +written when the SAM is copied from the PDC. The result is that the Domain member machine +on start up will find that it's passwords does not match the one now in the database and +since the startup security check will now fail, this machine will not allow logon attempts +to proceed and the account expiry error will be reported. +

    +The solution: use a more robust passdb backend, such as the ldapsam backend, setting up +an slave LDAP server for each BDC, and a master LDAP server for the PDC. +

    Can Samba be a Backup Domain Controller to an NT4 PDC?

    +With version 2.2, no. The native NT4 SAM replication protocols have not yet been fully +implemented. The Samba Team is working on understanding and implementing the protocols, +but this work has not been finished for version 2.2. +

    +With version 3.0, the work on both the replication protocols and a suitable storage +mechanism has progressed, and some form of NT4 BDC support is expected soon. +

    +Can I get the benefits of a BDC with Samba? Yes. The main reason for implementing a +BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to +service logon requests whenever the PDC is down. +

    How do I replicate the smbpasswd file?

    +Replication of the smbpasswd file is sensitive. It has to be done whenever changes +to the SAM are made. Every user's password change is done in the smbpasswd file and +has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary. +

    +As the smbpasswd file contains plain text password equivalents, it must not be +sent unencrypted over the wire. The best way to set up smbpasswd replication from +the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport. +Ssh itself can be set up to accept only rsync transfer without requiring the user +to type a password.

    -As the smbpasswd file contains plain text password equivalents, it -must not be sent unencrypted over the wire. The best way to set up -smbpasswd replication from the PDC to the BDC is to use the utility -rsync. rsync can use ssh as a transport. ssh itself can be set up to -accept *only* rsync transfer without requiring the user to type a -password. -

    Can I do this all with LDAP?

    The simple answer is YES. Samba's pdb_ldap code supports -binding to a replica LDAP server, and will also follow referrals and -rebind to the master if it ever needs to make a modification to the -database. (Normally BDCs are read only, so this will not occur -often). -

    Prev Up Next
    Chapter 5.  -Samba as an NT4 or Win2k Primary Domain Controller - Home Chapter 7. Samba as a ADS domain member
    +As said a few times before, use of this method is broken and flawed. Machine trust +accounts will go out of sync, resulting in a very broken domain. This method is +not recommended. Try using LDAP instead. +

    Can I do this all with LDAP?

    +The simple answer is YES. Samba's pdb_ldap code supports binding to a replica +LDAP server, and will also follow referrals and rebind to the master if it ever +needs to make a modification to the database. (Normally BDCs are read only, so +this will not occur often). +

    Prev Up Next
    Chapter 5. Domain Control Home Chapter 7. Domain Membership
    diff --git a/docs/htmldocs/samba-pdc.html b/docs/htmldocs/samba-pdc.html index 951dd2ea96..930315b3f5 100644 --- a/docs/htmldocs/samba-pdc.html +++ b/docs/htmldocs/samba-pdc.html @@ -1,137 +1,306 @@ - -Chapter 5.  -Samba as an NT4 or Win2k Primary Domain Controller -
    Chapter 5.  -Samba as an NT4 or Win2k Primary Domain Controller -
    Prev Part II. Server Configuration Basics Next

    Chapter 5.  -Samba as an NT4 or Win2k Primary Domain Controller -

    Gerald (Jerry) Carter

    Samba Team

    <jerry@samba.org>

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    David Bannon

    Samba Team

    <dbannon@samba.org>

    (26 Apr 2001)

    Table of Contents

    Prerequisite Reading
    -Background -
    Configuring the Samba Domain Controller
    Creating Machine Trust Accounts and Joining Clients to the Domain
    Manual Creation of Machine Trust Accounts
    "On-the-Fly" Creation of Machine Trust Accounts
    Joining the Client to the Domain
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." +Chapter 5. Domain Control
    Chapter 5. Domain Control
    Prev Part II. Server Configuration Basics Next

    Chapter 5. Domain Control

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    David Bannon

    Samba Team

    Table of Contents

    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not -exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
    Domain Control for Windows 9x/ME
    Configuration Instructions: Network Logons

    Prerequisite Reading

    -Before you continue reading in this chapter, please make sure -that you are comfortable with configuring basic files services -in smb.conf and how to enable and administer password -encryption in Samba. Theses two topics are covered in the -smb.conf manpage. -

    -Background -

    -This article outlines the steps necessary for configuring Samba as a PDC. -It is necessary to have a working Samba server prior to implementing the -PDC functionality. +existing set.." when creating a machine trust account.

    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not +exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, +I get a message about my account being disabled.
    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

    The Essence of Learning:  +There are many who approach MS Windows networking with incredible misconceptions. +That's OK, because it gives the rest of us plenty of opportunity to be of assistance. +Those who really want help would be well advised to become familiar with information +that is already available. +

    +The reader is advised NOT to tackle this section without having first understood +and mastered some basics. MS Windows networking is not particularly forgiving of +misconfiguration. Users of MS Windows networking are likely to complain bitterly +of persistent niggles that may be caused by broken network or system configuration. +To a great many people however, MS Windows networking starts with a domain controller +that in some magical way is expected to solve all ills. +

    +From the Samba mailing list one can readily identify many common networking issues. +If you are not clear on the following subjects, then it will do much good to read the +sections of this HOWTO that deal with it. These are the most common causes of MS Windows +networking problems: +

    Basic TCP/IP configuration
    NetBIOS name resolution
    Authentication configuration
    User and Group configuration
    Basic File and Directory Permission Control in Unix/Linux
    Understanding of how MS Windows clients interoperate in a network + environment

    +Do not be put off; on the surface of it MS Windows networking seems so simple that any fool +can do it. In fact, it is not a good idea to set up an MS Windows network with +inadequate training and preparation. But let's get our first indelible principle out of the +way: It is perfectly OK to make mistakes! In the right place and at +the right time, mistakes are the essence of learning. It is very much +not ok to make mistakes that cause loss of productivity and impose an avoidable financial +burden on an organisation. +

    +Where is the right place to make mistakes? Only out of harm's way! If you are going to +make mistakes, then please do this on a test network, away from users and in such a way as +to not inflict pain on others. Do your learning on a test network. +

    Features and Benefits

    +What is the key benefit of Microsoft Domain security? +

    +In a word, Single Sign On, or SSO for short. To many, this is the holy +grail of MS Windows NT and beyond networking. SSO allows users in a well designed network +to log onto any workstation that is a member of the domain that their user account is in +(or in a domain that has an appropriate trust relationship with the domain they are visiting) +and they will be able to log onto the network and access resources (shares, files, and printers) +as if they are sitting at their home (personal) workstation. This is a feature of the Domain +security protocols. +

    +The benefits of Domain security are fully available to those sites that deploy a Samba PDC. +

    Note

    +Network clients of an MS Windows Domain security environment must be Domain members to be +able to gain access to the advanced features provided. Domain membership involves more than just +setting the workgroup name to the Domain name. It requires the creation of a Domain trust account +for the workstation (called a machine account). Please refer to the chapter on +Domain Membership for more information. +

    +The following functionalities are new to the Samba-3 release:

    • - Domain logons for Windows NT 4.0 / 200x / XP Professional clients. -

    • - Placing Windows 9x / Me clients in user level security -

    • - Retrieving a list of users and groups from a Samba PDC to - Windows 9x / Me / NT / 200x / XP Professional clients + Windows NT4 domain trusts

    • - Roaming Profiles + Adding users via the User Manager for Domains. This can be done on any MS Windows + client using the Nexus toolkit that is available from Microsoft's web site. + At some later date Samba-3 may get support for the use of the Microsoft Management + Console for user management.

    • - Network/System Policies -

    Note

    -Roaming Profiles and System/Network policies are advanced network administration topics -that are covered separately in this document. -

    -The following functionalities are new to the Samba 3.0 release: -

    • - Windows NT 4 domain trusts + Introduces replaceable and multiple user account (authentication) + back ends. In the case where the back end is placed in an LDAP database, + Samba-3 confers the benefits of a back end that can be distributed, replicated, + and is highly scalable.

    • - Adding users via the User Manager for Domains + Implements full Unicode support. This simplifies cross locale internationalisation + support. It also opens up the use of protocols that Samba-2.2.x had but could not use due + to the need to fully support Unicode.

    -The following functionalities are NOT provided by Samba 3.0: +The following functionalities are NOT provided by Samba-3:

    • - SAM replication with Windows NT 4.0 Domain Controllers + SAM replication with Windows NT4 Domain Controllers (i.e. a Samba PDC and a Windows NT BDC or vice versa)

    • Acting as a Windows 2000 Domain Controller (i.e. Kerberos and - Active Directory) + Active Directory) - In point of fact, Samba-3 DOES have some + Active Directory Domain Control ability that is at this time + purely experimental AND that is certain + to change as it becomes a fully supported feature some time + during the Samba-3 (or later) life cycle.

    -Please note that Windows 9x / Me / XP Home clients are not true members of a domain -for reasons outlined in this article. Therefore the protocol for -support of Windows 9x-style domain logons is completely different -from NT4 / Win2k type domain logons and has been officially supported for some -time. -

    -MS Windows XP Home edition is NOT able to join a domain and does not permit -the use of domain logons. +Windows 9x / Me / XP Home clients are not true members of a domain for reasons outlined +in this chapter. The protocol for support of Windows 9x / Me style network (domain) logons +is completely different from NT4 / Win2k type domain logons and has been officially supported +for some time. These clients use the old LanMan Network Logon facilities that are supported +in Samba since approximately the Samba-1.9.15 series.

    -Implementing a Samba PDC can basically be divided into 3 broad -steps. -

    1. - Configuring the Samba PDC +Samba-3 has an implementation of group mapping between Windows NT groups +and Unix groups (this is really quite complicated to explain in a short space). This is +discussed more fully in the Group Mapping chapter. +

      +Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store +user and machine trust account information in a suitable backend data store. With Samba-3 +there can be multiple back-ends for this including: +

      • + smbpasswd - the plain ASCII file stored used by + earlier versions of Samba. This file configuration option requires + a Unix/Linux system account for EVERY entry (ie: both for user and for + machine accounts). This file will be located in the private + directory (default is /usr/local/samba/lib/private or on linux /etc/samba).

      • - Creating machine trust accounts and joining clients to the domain + tdbsam - a binary database backend that will be + stored in the private directory in a file called + passdb.tdb. The key benefit of this binary format + file is that it can store binary objects that can not be accommodated + in the traditional plain text smbpasswd file. These permit the extended + account controls that MS Windows NT4 and later also have.

      • - Adding and managing domain user accounts -

    -There are other minor details such as user profiles, system -policies, etc... However, these are not necessarily specific -to a Samba PDC as much as they are related to Windows NT networking -concepts. -

    Configuring the Samba Domain Controller

    -The first step in creating a working Samba PDC is to -understand the parameters necessary in smb.conf. Here we -attempt to explain the parameters that are covered in -the smb.conf man page. + ldapsam - An LDAP based back-end. Permits the + LDAP server to be specified. eg: ldap://localhost or ldap://frodo.murphy.com. + Like the tdbsam, ldapsam permits the storing of extended account attributes + for control of things like: Permitted access times, password activation and + expiry, permitted points of access (workstation names), per user profile + location, and much more. +

  • + ldapsam_compat - An LDAP back-end that maintains backwards + compatibility with the behaviour of samba-2.2.x. You should use this in the process + of migrating from samba-2.2.x to samba-3 if you do not want to rebuild your LDAP + database. +

    • +Read the chapter about Account Information Database for details +regarding the choices available and how to configure them. +

    Note

    +The new tdbsam and ldapsam account backends store substantially more information than +smbpasswd is capable of. The new backend database includes capacity to specify +per user settings for many parameters, over-riding global settings given in the +smb.conf file. eg: logon drive, logon home, logon path, etc. +Thus, with samba-3 it is possible to have a default system configuration for profiles, +and on a per user basis to over-ride this for those users who should not be subject +to the default configuration. +

    Basics of Domain Control

    +Over the years, public perceptions of what Domain Control really is has taken on an +almost mystical nature. Before we branch into a brief overview of Domain Control, +there are three basic types of domain controllers: +

    Domain Controller Types

    • Primary Domain Controller

    • Backup Domain Controller

    • ADS Domain Controller

    +The Primary Domain Controller or PDC plays an important role in the MS +Windows NT4 and Windows 200x Domain Control architecture, but not in the manner that so many +expect. There is folk lore that dictates that because of it's role in the MS Windows +network, the PDC should be the most powerful and most capable machine in the network. +As strange as it may seem to say this here, good over all network performance dictates that +the entire infrastructure needs to be balanced. It is advisable to invest more in the Backup +Domain Controllers and Stand-Alone (or Domain Member) servers than in the PDC. +

    +In the case of MS Windows NT4 style domains, it is the PDC seeds the Domain Control database, +a part of the Windows registry called the SAM (Security Account Manager). It plays a key +part in NT4 type domain user authentication and in synchronisation of the domain authentication +database with Backup Domain Controllers. +

    +With MS Windows 200x Server based Active Directory domains, one domain controller seeds a potential +hierarchy of domain controllers, each with their own area of delegated control. The master domain +controller has the ability to override any down-stream controller, but a down-line controller has +control only over it's down-line. With Samba-3 this functionality can be implemented using an +LDAP based user and machine account back end.

    -Here is an example smb.conf for acting as a PDC: +New to Samba-3 is the ability to use a back-end database that holds the same type of data as +the NT4 style SAM (Security Account Manager) database (one of the registry files). +The Samba-3 SAM can be specified via the smb.conf file parameter +passwd backend and valid options include +smbpasswd, tdbsam, ldapsam, nisplussam, xmlsam, mysqlsam, guest. +

    +The Backup Domain Controller or BDC plays a key role in servicing network +authentication requests. The BDC is biased to answer logon requests in preference to the PDC. +On a network segment that has a BDC and a PDC the BDC will be most likely to service network +logon requests. The PDC will answer network logon requests when the BDC is too busy (high load). +A BDC can be promoted to a PDC. If the PDC is on line at the time that a BDC is promoted to +PDC, the previous PDC is automatically demoted to a BDC. With Samba-3 this is NOT an automatic +operation; the PDC and BDC must be manually configured and changes need to be made likewise. +

    +With MS Windows NT4, it is an install time decision what type of machine the server will be. +It is possible to change the promote a BDC to a PDC and vice versa only, but the only way +to convert a domain controller to a domain member server or a stand-alone server is to +reinstall it. The install time choices offered are: +

    • Primary Domain Controller - The one that seeds the domain SAM

    • Backup Domain Controller - One that obtains a copy of the domain SAM

    • Domain Member Server - One that has NO copy of the domain SAM, rather it obtains authentication from a Domain Controller for all access controls.

    • Stand-Alone Server - One that plays NO part is SAM synchronisation, has it's own authentication database and plays no role in Domain security.

    +With MS Windows 2000 the configuration of domain control is done after the server has been +installed. Samba-3 is capable of acting fully as a native member of a Windows 200x server +Active Directory domain. +

    +New to Samba-3 is the ability to function fully as an MS Windows NT4 style Domain Controller, +excluding the SAM replication components. However, please be aware that Samba-3 support the +MS Windows 200x domain control protocols also. +

    +At this time any appearance that Samba-3 is capable of acting as an +ADS Domain Controller is limited and experimental in nature. +This functionality should not be used until the Samba-Team offers formal support for it. +At such a time, the documentation will be revised to duly reflect all configuration and +management requirements. +

    Preparing for Domain Control

    +There are two ways that MS Windows machines may interact with each other, with other servers, +and with Domain Controllers: Either as Stand-Alone systems, more commonly +called Workgroup members, or as full participants in a security system, +more commonly called Domain members. +

    +It should be noted that Workgroup membership involve no special configuration +other than the machine being configured so that the network configuration has a commonly used name +for it's workgroup entry. It is not uncommon for the name WORKGROUP to be used for this. With this +mode of configuration there are NO machine trust accounts and any concept of membership as such +is limited to the fact that all machines appear in the network neighbourhood to be logically +grouped together. Again, just to be clear: workgroup mode does not involve any security machine +accounts. +

    +Domain member machines have a machine account in the Domain accounts database. A special procedure +must be followed on each machine to affect Domain membership. This procedure, which can be done +only by the local machine Administrator account, will create the Domain machine account (if +if does not exist), and then initializes that account. When the client first logs onto the +Domain it triggers a machine password change. +

    Note

    +When running a Domain all MS Windows NT / 200x / XP Professional clients should be configured +as full Domain Members - IF A SECURE NETWORK IS WANTED. If the machine is NOT made a member of the +Domain, then it will operate like a workgroup (stand-alone) machine. Please refer the +Domain Membership chapter for information regarding + HOW to make your MS Windows clients Domain members. +

    +The following are necessary for configuring Samba-3 as an MS Windows NT4 style PDC for MS Windows +NT4 / 200x / XP clients. +

    Configuration of basic TCP/IP and MS Windows Networking
    Correct designation of the Server Role (security = user)
    Consistent configuration of Name Resolution (See chapter on Browsing and on + MS Windows network Integration)
    Domain logons for Windows NT4 / 200x / XP Professional clients
    Configuration of Roaming Profiles or explicit configuration to force local profile usage
    Configuration of Network/System Policies
    Adding and managing domain user accounts
    Configuring MS Windows client machines to become domain members

    +The following provisions are required to serve MS Windows 9x / Me Clients: +

    Configuration of basic TCP/IP and MS Windows Networking
    Correct designation of the Server Role (security = user)
    Network Logon Configuration (Since Windows 9x / XP Home are not technically domain + members, they do not really participate in the security aspects of Domain logons as such)
    Roaming Profile Configuration
    Configuration of System Policy handling
    Installation of the Network driver "Client for MS Windows Networks" and configuration + to log onto the domain
    Placing Windows 9x / Me clients in user level security - if it is desired to allow + all client share access to be controlled according to domain user / group identities.
    Adding and managing domain user accounts

    Note

    +Roaming Profiles and System/Network policies are advanced network administration topics +that are covered in the Profile Management and +Policy Management chapters of this document. However, these are not necessarily specific +to a Samba PDC as much as they are related to Windows NT networking concepts. +

    +A Domain Controller is an SMB/CIFS server that: +

    • + Registers and advertises itself as a Domain Controller (through NetBIOS broadcasts + as well as by way of name registrations either by Mailslot Broadcasts over UDP broadcast, + to a WINS server over UDP unicast, or via DNS and Active Directory) +

    • + Provides the NETLOGON service (actually a collection of services that runs over + a number of protocols. These include the LanMan Logon service, the Netlogon service, + the Local Security Account service, and variations of them) +

    • + Provides a share called NETLOGON +

    +For Samba to provide these is rather easy to configure. Each Samba Domain Controller must provide +the NETLOGON service which Samba calls the domain logons functionality +(after the name of the parameter in the smb.conf file). Additionally, one (1) server in a Samba-3 +Domain must advertise itself as the domain master browser. This causes the Primary Domain Controller +to claim domain specific NetBIOS name that identifies it as a domain master browser for its given +domain/workgroup. Local master browsers in the same domain/workgroup on broadcast-isolated subnets +then ask for a complete copy of the browse list for the whole wide area network. Browser clients +will then contact their local master browser, and will receive the domain-wide browse list, +instead of just the list for their broadcast-isolated subnet. +

    Domain Control - Example Configuration

    +The first step in creating a working Samba PDC is to understand the parameters necessary +in smb.conf. Here we attempt to explain the parameters that are covered in +the smb.conf man page. +

    +Here is an example smb.conf for acting as a PDC: 

    -[global]
-    ; Basic server settings
-    netbios name = POGO
-    workgroup = NARNIA
+	[global]
+	    ; Basic server settings
+	    netbios name = POGO
+	    workgroup = NARNIA
 
-    ; User and Machine Account Backends
-    ; Choices are: tdbsam, tdbsam_nua, smbpasswd, smbpasswd_nua, ldapsam, ldapsam_nua, ...
-    ;              mysqlsam, xmlsam, guest
-    passdb backend = ldapsam, guest
+	    ; User and Machine Account Backends
+	    ; Choices are: tdbsam, smbpasswd, ldapsam, mysqlsam, xmlsam, guest
+	    passdb backend = ldapsam, guest
 
-    ; we should act as the domain and local master browser
-    os level = 64
-    preferred master = yes
-    domain master = yes
-    local master = yes
-    
-    ; security settings (must user security = user)
-    security = user
-    
-    ; encrypted passwords are a requirement for a PDC
-    encrypt passwords = yes
-    
-    ; support domain logons
-    domain logons = yes
-    
-    ; where to store user profiles?
-    logon path = \\%N\profiles\%u
-    
-    ; where is a user's home directory and where should it be mounted at?
-    logon drive = H:
-    logon home = \\homeserver\%u
-    
-    ; specify a generic logon script for all users
-    ; this is a relative **DOS** path to the [netlogon] share
-    logon script = logon.cmd
+	    ; we should act as the domain and local master browser
+	    os level = 64
+	    preferred master = yes
+	    domain master = yes
+	    local master = yes
+	    
+	    ; security settings (must user security = user)
+	    security = user
+	    
+	    ; encrypted passwords are a requirement for a PDC (default = Yes)
+	    encrypt passwords = yes
+	    
+	    ; support domain logons
+	    domain logons = yes
+	    
+	    ; where to store user profiles?
+	    logon path = \\%N\profiles\%u
+	    
+	    ; where is a user's home directory and where should it be mounted at?
+	    logon drive = H:
+	    logon home = \\homeserver\%u\winprofile
+	    
+	    ; specify a generic logon script for all users
+	    ; this is a relative **DOS** path to the [netlogon] share
+	    logon script = logon.cmd
 
-; necessary share for domain controller
-[netlogon]
-    path = /usr/local/samba/lib/netlogon
-    read only = yes
-    write list = ntadmin
-    
-; share for storing user profiles
-[profiles]
-    path = /export/smb/ntprofile
-    read only = no
-    create mask = 0600
-    directory mask = 0700
+	; necessary share for domain controller
+	[netlogon]
+	    path = /usr/local/samba/lib/netlogon
+	    read only = yes
+	    write list = ntadmin
+	    
+	; share for storing user profiles
+	[profiles]
+	    path = /export/smb/ntprofile
+	    read only = no
+	    create mask = 0600
+	    directory mask = 0700

    Note

    The above parameters make for a full set of parameters that may define the server's mode of operation. The following parameters are the essentials alone: @@ -139,6 +308,7 @@ of operation. The following parameters are the essentials alone: 

     	workgroup = NARNIA
 	domain logons = Yes
+	domain master = Yes
 	security = User

    @@ -148,244 +318,53 @@ more complete environment. There are a couple of points to emphasize in the above configuration.

    • Encrypted passwords must be enabled. For more details on how - to do this, refer to the User Database chapter. + to do this, refer to Account Information Database chapter.

    • - The server must support domain logons and a - [netlogon] share + The server must support domain logons and have a + [netlogon] share

    • The server must be the domain master browser in order for Windows client to locate the server as a DC. Please refer to the various Network Browsing documentation included with this distribution for details. -

    -Samba 3.0 offers a complete implementation of group mapping -between Windows NT groups and Unix groups (this is really quite -complicated to explain in a short space). -

    Creating Machine Trust Accounts and Joining Clients to the Domain

    -A machine trust account is a Samba account that is used to -authenticate a client machine (rather than a user) to the Samba -server. In Windows terminology, this is known as a "Computer -Account."

    -The password of a machine trust account acts as the shared secret for -secure communication with the Domain Controller. This is a security -feature to prevent an unauthorized machine with the same NetBIOS name -from joining the domain and gaining access to domain user/group -accounts. Windows NT, 200x, XP Professional clients use machine trust -accounts, but Windows 9x / Me / XP Home clients do not. Hence, a -Windows 9x / Me / XP Home client is never a true member of a domain -because it does not possess a machine trust account, and thus has no -shared secret with the domain controller. -

    A Windows PDC stores each machine trust account in the Windows -Registry. A Samba-3 PDC also has to store machine trust account information -in a suitable backend data store. With Samba-3 there can be multiple back-ends -for this including: -

    • - smbpasswd - the plain ascii file stored used by - earlier versions of Samba. This file configuration option requires - a Unix/Linux system account for EVERY entry (ie: both for user and for - machine accounts). This file will be located in the private - directory (default is /usr/local/samba/lib/private or on linux /etc/samba). -

    • - smbpasswd_nua - This file is independant of the - system wide user accounts. The use of this back-end option requires - specification of the "non unix account range" option also. It is called - smbpasswd and will be located in the private directory. -

    • - tdbsam - a binary database backend that will be - stored in the private directory in a file called - passwd.tdb. The key benefit of this binary format - file is that it can store binary objects that can not be accomodated - in the traditional plain text smbpasswd file. -

    • - tdbsam_nua like the smbpasswd_nua option above, this - file allows the creation of arbitrary user and machine accounts without - requiring that account to be added to the system (/etc/passwd) file. It - too requires the specification of the "non unix account range" option - in the [globals] section of the smb.conf file. -

    • - ldapsam - An LDAP based back-end. Permits the - LDAP server to be specified. eg: ldap://localhost or ldap://frodo.murphy.com -

    • - ldapsam_nua - LDAP based back-end with no unix - account requirement, like smbpasswd_nua and tdbsam_nua above. -

    Read the chapter about the User Database -for details.

    Note

    -The new tdbsam and ldapsam account backends store vastly more information than -smbpasswd is capable of. The new backend database includes capacity to specify -per user settings for many parameters, over-riding global settings given in the -smb.conf file. eg: logon drive, logon home, logon path, etc. -

    -A Samba PDC, however, stores each machine trust account in two parts, -as follows: - -

    • A Samba account, stored in the same location as user - LanMan and NT password hashes (currently - smbpasswd). The Samba account - possesses and uses only the NT password hash.

    • A corresponding Unix account, typically stored in - /etc/passwd. (Future releases will alleviate the need to - create /etc/passwd entries.)

    -

    -There are two ways to create machine trust accounts: -

    • Manual creation. Both the Samba and corresponding - Unix account are created by hand.

    • "On-the-fly" creation. The Samba machine trust - account is automatically created by Samba at the time the client - is joined to the domain. (For security, this is the - recommended method.) The corresponding Unix account may be - created automatically or manually.

    Manual Creation of Machine Trust Accounts

    -The first step in manually creating a machine trust account is to -manually create the corresponding Unix account in -/etc/passwd. This can be done using -vipw or other 'add user' command that is normally -used to create new Unix accounts. The following is an example for a -Linux based Samba server: -

    - root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine -nickname" -s /bin/false machine_name$ -

    -root# passwd -l machine_name$ -

    On *BSD systems, this can be done using the 'chpass' utility:

    -root# chpass -a "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin" -

    -The /etc/passwd entry will list the machine name -with a "$" appended, won't have a password, will have a null shell and no -home directory. For example a machine named 'doppy' would have an -/etc/passwd entry like this: -

    -doppy$:x:505:501:machine_nickname:/dev/null:/bin/false
-

    -Above, machine_nickname can be any -descriptive name for the client, i.e., BasementComputer. -machine_name absolutely must be the NetBIOS -name of the client to be joined to the domain. The "$" must be -appended to the NetBIOS name of the client or Samba will not recognize -this as a machine trust account. -

    -Now that the corresponding Unix account has been created, the next step is to create -the Samba account for the client containing the well-known initial -machine trust account password. This can be done using the smbpasswd(8) command -as shown here: -

    -root# smbpasswd -a -m machine_name -

    -where machine_name is the machine's NetBIOS -name. The RID of the new machine account is generated from the UID of -the corresponding Unix account. -

    Join the client to the domain immediately

    - Manually creating a machine trust account using this method is the - equivalent of creating a machine trust account on a Windows NT PDC using - the "Server Manager". From the time at which the account is created - to the time which the client joins the domain and changes the password, - your domain is vulnerable to an intruder joining your domain using - a machine with the same NetBIOS name. A PDC inherently trusts - members of the domain and will serve out a large degree of user - information to such clients. You have been warned! -

    "On-the-Fly" Creation of Machine Trust Accounts

    -The second (and recommended) way of creating machine trust accounts is -simply to allow the Samba server to create them as needed when the client -is joined to the domain.

    Since each Samba machine trust account requires a corresponding -Unix account, a method for automatically creating the -Unix account is usually supplied; this requires configuration of the -add user script -option in smb.conf. This -method is not required, however; corresponding Unix accounts may also -be created manually. -

    Below is an example for a RedHat 6.2 Linux system. -

    -[global]
-   # <...remainder of parameters...>
-   add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u 
-

    Joining the Client to the Domain

    -The procedure for joining a client to the domain varies with the -version of Windows. -

    • Windows 2000

      - When the user elects to join the client to a domain, Windows prompts for - an account and password that is privileged to join the domain. A Samba administrative - account (i.e., a Samba account that has root privileges on the Samba server) must be - entered here; the operation will fail if an ordinary user account is given. - The password for this account should be set to a different password than the associated - /etc/passwd entry, for security reasons. -

      - The session key of the Samba administrative account acts as an - encryption key for setting the password of the machine trust - account. The machine trust account will be created on-the-fly, or - updated if it already exists. -

    • Windows NT

      If the machine trust account was created manually, on the - Identification Changes menu enter the domain name, but do not - check the box "Create a Computer Account in the Domain." In this case, - the existing machine trust account is used to join the machine to - the domain.

      If the machine trust account is to be created - on-the-fly, on the Identification Changes menu enter the domain - name, and check the box "Create a Computer Account in the Domain." In - this case, joining the domain proceeds as above for Windows 2000 - (i.e., you must supply a Samba administrative account when - prompted).

    • Samba

      Joining a samba client to a domain is documented in - the Domain Member chapter. -

    Common Problems and Errors

    I cannot include a '$' in a machine name

    -A 'machine name' in (typically) /etc/passwd -of the machine name with a '$' appended. FreeBSD (and other BSD -systems?) won't create a user with a '$' in their name. -

    -The problem is only in the program used to make the entry. Once made, it works perfectly. -Create a user without the '$' using vipw to edit the entry, adding -the '$'. Or create the whole entry with vipw if you like, make sure you use a unique User ID! -

    I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.

    -This happens if you try to create a machine trust account from the -machine itself and already have a connection (e.g. mapped drive) -to a share (or IPC$) on the Samba PDC. The following command -will remove all network drive connections: -

    -C:\WINNT\> net use * /d -

    -Further, if the machine is already a 'member of a workgroup' that -is the same name as the domain you are joining (bad idea) you will -get this message. Change the workgroup name to something else, it -does not matter what, reboot, and try again. -

    The system can not log you on (C000019B)....

    I joined the domain successfully but after upgrading -to a newer version of the Samba code I get the message, "The system -can not log you on (C000019B), Please try again or consult your -system administrator" when attempting to logon. -

    -This occurs when the domain SID stored in the secrets.tdb database -is changed. The most common cause of a change in domain SID is when -the domain name and/or the server name (netbios name) is changed. -The only way to correct the problem is to restore the original domain -SID or remove the domain client from the domain and rejoin. The domain -SID may be reset using either the net or rpcclient utilities. -

    -The reset or change the domain SID you can use the net command as follows: +

    Samba ADS Domain Control

    +Samba-3 is not and can not act as an Active Directory Server. It can not truly function as +an Active Directory Primary Domain Controller. The protocols for some of the functionality +the Active Directory Domain Controllers is have been partially implemented on an experimental +only basis. Please do NOT expect Samba-3 to support these protocols - nor should you depend +on any such functionality either now or in the future. The Samba-Team may well remove such +experimental features or may change their behaviour. +

    Domain and Network Logon Configuration

    +The subject of Network or Domain Logons is discussed here because it rightly forms +an integral part of the essential functionality that is provided by a Domain Controller. +

    Domain Network Logon Service

    +All Domain Controllers must run the netlogon service (domain logons +in Samba). One Domain Controller must be configured with domain master = Yes +(the Primary Domain Controller); on ALL Backup Domain Controllers domain master = No +must be set. +

    Example Configuration

    +	[global]
+		domain logons = Yes
+		domain master = (Yes on PDC, No on BDCs)
 
-
    -	net getlocalsid 'OLDNAME'
-	net setlocalsid 'SID'
-
    
-

    The machine trust account for this computer either does not -exist or is not accessible.

    -When I try to join the domain I get the message "The machine account -for this computer either does not exist or is not accessible". What's -wrong? -

    -This problem is caused by the PDC not having a suitable machine trust account. -If you are using the add user script method to create -accounts then this would indicate that it has not worked. Ensure the domain -admin user system is working. + [netlogon] + comment = Network Logon Service + path = /var/lib/samba/netlogon + guest ok = Yes + browseable = No +

    The Special Case of MS Windows XP Home Edition

    Note

    +MS Windows XP Home Edition does not have the ability to join any type of Domain +security facility. Unlike, MS Windows 9x / Me, MS Windows XP Home Edition also completely +lacks the ability to log onto a network. +

    +To be completely clear: If you want MS Windows XP Home Edition to integrate with your +MS Windows NT4 or Active Directory Domain security understand - IT CAN NOT BE DONE. +Your only choice is to buy the upgrade pack from MS Windows XP Home Edition to +MS Windows XP Professional.

    -Alternatively if you are creating account entries manually then they -have not been created correctly. Make sure that you have the entry -correct for the machine trust account in smbpasswd file on the Samba PDC. -If you added the account using an editor rather than using the smbpasswd -utility, make sure that the account name is the machine NetBIOS name -with a '$' appended to it ( i.e. computer_name$ ). There must be an entry -in both /etc/passwd and the smbpasswd file. Some people have reported -that inconsistent subnet masks between the Samba server and the NT -client have caused this problem. Make sure that these are consistent -for both client and server. -

    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.

    -At first be ensure to enable the useraccounts with smbpasswd -e -%user%, this is normally done, when you create an account. -

    Domain Control for Windows 9x/ME

    +Now that this has been said, please do NOT ask the mailing list, or email any of the +Samba-Team members with your questions asking how to make this work. It can't be done. +

    The Special Case of Windows 9x / Me

    A domain and a workgroup are exactly the same thing in terms of network browsing. The difference is that a distributable authentication database is associated with a domain, for secure login access to a @@ -404,7 +383,7 @@ section. Samba supports domain logons, network logon scripts, and user profiles for MS Windows for workgroups and MS Windows 9X/ME clients which are the focus of this section.

    -When an SMB client in a domain wishes to logon it broadcast requests for a +When an SMB client in a domain wishes to logon, it broadcasts requests for a logon server. The first one to reply gets the job, and validates its password using whatever mechanism the Samba administrator has installed. It is possible (but very stupid) to create a domain where the user @@ -416,15 +395,18 @@ involved with domains. Using these features you can make your clients verify their logon via the Samba server; make clients run a batch file when they logon to the network and download their preferences, desktop and start menu. -

    +

    +MS Windows XP Home edition is NOT able to join a domain and does not permit +the use of domain logons. +

    Before launching into the configuration instructions, it is worthwhile to look at how a Windows 9x/ME client performs a logon:

    1. The client broadcasts (to the IP broadcast address of the subnet it is in) - a NetLogon request. This is sent to the NetBIOS name DOMAIN<1c> at the + a NetLogon request. This is sent to the NetBIOS name DOMAIN<#1c> at the NetBIOS layer. The client chooses the first response it receives, which contains the NetBIOS name of the logon server to use in the format of - \\SERVER. + \\SERVER.

    2. The client then connects to that server, logs on (does an SMBsessetupX) and then connects to the IPC$ share (using an SMBtconX). @@ -432,67 +414,137 @@ worthwhile to look at how a Windows 9x/ME client performs a logon: The client then does a NetWkstaUserLogon request, which retrieves the name of the user's logon script.

    3. - The client then connects to the NetLogon share and searches for this + The client then connects to the NetLogon share and searches for said script and if it is found and can be read, is retrieved and executed by the client. After this, the client disconnects from the NetLogon share.

    4. The client then sends a NetUserGetInfo request to the server, to retrieve the user's home share, which is used to search for profiles. Since the - response to the NetUserGetInfo request does not contain much more then + response to the NetUserGetInfo request does not contain much more than the user's home share, profiles for Win9X clients MUST reside in the user home directory.

    5. The client then connects to the user's home share and searches for the user's profile. As it turns out, you can specify the user's home share as - a sharename and path. For example, \\server\fred\.profile. + a sharename and path. For example, \\server\fred\.winprofile. If the profiles are found, they are implemented.

    6. The client then disconnects from the user's home share, and reconnects to - the NetLogon share and looks for CONFIG.POL, the policies file. If this is + the NetLogon share and looks for CONFIG.POL, the policies file. If this is found, it is read and implemented. -

    Configuration Instructions: Network Logons

    -The main difference between a PDC and a Windows 9x logon -server configuration is that +

    +The main difference between a PDC and a Windows 9x logon server configuration is that

    • -Password encryption is not required for a Windows 9x logon server. -

    • -Windows 9x/ME clients do not possess machine trust accounts. -

    -Therefore, a Samba PDC will also act as a Windows 9x logon -server. -

    security mode and master browsers

    + Password encryption is not required for a Windows 9x logon server. But note + that beginning with MS Windows 98 the default setting is that plain-text + password support has been disabled. It can be re-enabled with the registry + changes that are documented in the chapter on Policies. +

  • + Windows 9x/ME clients do not require and do not use machine trust accounts. +

    • +A Samba PDC will act as a Windows 9x logon server; after all, it does provide the +network logon services that MS Windows 9x / Me expect to find. +

    Security Mode and Master Browsers

    There are a few comments to make in order to tie up some loose ends. There has been much debate over the issue of whether or not it is ok to configure Samba as a Domain Controller in security -modes other than USER. The only security mode -which will not work due to technical reasons is SHARE -mode security. DOMAIN and SERVER -mode security is really just a variation on SMB user level security. +modes other than USER. The only security mode +which will not work due to technical reasons is SHARE +mode security. DOMAIN and SERVER +mode security are really just a variation on SMB user level security.

    Actually, this issue is also closely tied to the debate on whether or not Samba must be the domain master browser for its workgroup when operating as a DC. While it may technically be possible to configure a server as such (after all, browsing and domain logons are two distinctly different functions), it is not a good idea to do -so. You should remember that the DC must register the DOMAIN#1b NetBIOS +so. You should remember that the DC must register the DOMAIN<#1b> NetBIOS name. This is the name used by Windows clients to locate the DC. Windows clients do not distinguish between the DC and the DMB. For this reason, it is very wise to configure the Samba DC as the DMB.

    Now back to the issue of configuring a Samba DC to use a mode other -than "security = user". If a Samba host is configured to use +than security = user. If a Samba host is configured to use another SMB server or DC in order to validate user connection requests, then it is a fact that some other machine on the network -(the "password server") knows more about the user than the Samba host. +(the password server) knows more about the user than the Samba host. 99% of the time, this other host is a domain controller. Now -in order to operate in domain mode security, the "workgroup" parameter +in order to operate in domain mode security, the workgroup parameter must be set to the name of the Windows NT domain (which already -has a domain controller, right?) +has a domain controller). If the domain does NOT already have a Domain Controller +then you do not yet have a Domain!

    -Therefore configuring a Samba box as a DC for a domain that -already by definition has a PDC is asking for trouble. -Therefore, you should always configure the Samba DC to be the DMB -for its domain. -

    Prev Up Next
    Chapter 4. Samba as Stand-Alone Server Home Chapter 6.  -Samba Backup Domain Controller to Samba Domain Control -
    +Configuring a Samba box as a DC for a domain that already by definition has a +PDC is asking for trouble. Therefore, you should always configure the Samba DC +to be the DMB for its domain and set security = user. +This is the only officially supported mode of operation. +

    Common Problems and Errors

    I cannot include a '$' in a machine name

    +A 'machine account', (typically) stored in /etc/passwd, +takes the form of the machine name with a '$' appended. FreeBSD (and other BSD +systems?) won't create a user with a '$' in their name. +

    +The problem is only in the program used to make the entry. Once made, it works perfectly. +Create a user without the '$'. Then use vipw to edit the entry, adding +the '$'. Or create the whole entry with vipw if you like; make sure you use a unique User ID! +

    I get told "You already have a connection to the Domain...." +or "Cannot join domain, the credentials supplied conflict with an +existing set.." when creating a machine trust account.

    +This happens if you try to create a machine trust account from the +machine itself and already have a connection (e.g. mapped drive) +to a share (or IPC$) on the Samba PDC. The following command +will remove all network drive connections: +

    +	C:\WINNT\> net use * /d
+

    +Further, if the machine is already a 'member of a workgroup' that +is the same name as the domain you are joining (bad idea) you will +get this message. Change the workgroup name to something else, it +does not matter what, reboot, and try again. +

    The system can not log you on (C000019B)....

    I joined the domain successfully but after upgrading +to a newer version of the Samba code I get the message, The system +can not log you on (C000019B), Please try again or consult your +system administrator when attempting to logon. +

    +This occurs when the domain SID stored in the secrets.tdb database +is changed. The most common cause of a change in domain SID is when +the domain name and/or the server name (NetBIOS name) is changed. +The only way to correct the problem is to restore the original domain +SID or remove the domain client from the domain and rejoin. The domain +SID may be reset using either the net or rpcclient utilities. +

    +The reset or change the domain SID you can use the net command as follows: + +

    +root# net getlocalsid 'OLDNAME'
+root# net setlocalsid 'SID'
+

    +

    The machine trust account for this computer either does not +exist or is not accessible.

    +When I try to join the domain I get the message The machine account +for this computer either does not exist or is not accessible. What's +wrong? +

    +This problem is caused by the PDC not having a suitable machine trust account. +If you are using the add machine script method to create +accounts then this would indicate that it has not worked. Ensure the domain +admin user system is working. +

    +Alternatively if you are creating account entries manually then they +have not been created correctly. Make sure that you have the entry +correct for the machine trust account in smbpasswd file on the Samba PDC. +If you added the account using an editor rather than using the smbpasswd +utility, make sure that the account name is the machine NetBIOS name +with a '$' appended to it ( i.e. computer_name$ ). There must be an entry +in both /etc/passwd and the smbpasswd file. +

    +Some people have also reported +that inconsistent subnet masks between the Samba server and the NT +client can cause this problem. Make sure that these are consistent +for both client and server. +

    When I attempt to login to a Samba Domain from a NT4/W2K workstation, +I get a message about my account being disabled.

    +Enable the user accounts with smbpasswd -e username +, this is normally done as an account is created. +

    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

    + A domain controller has to announce on the network who it is. This usually takes a while. +

    Prev Up Next
    Chapter 4. Server Types and Security Modes Home Chapter 6. Backup Domain Control
    diff --git a/docs/htmldocs/samba.7.html b/docs/htmldocs/samba.7.html index a54d3e883f..222bdee995 100644 --- a/docs/htmldocs/samba.7.html +++ b/docs/htmldocs/samba.7.html @@ -1,68 +1,68 @@ -samba

    Name

    Samba — A Windows SMB/CIFS fileserver for UNIX

    Synopsis

    Samba

    DESCRIPTION

    The Samba software suite is a collection of programs +samba

    Name

    samba — A Windows SMB/CIFS fileserver for UNIX

    Synopsis

    Samba

    DESCRIPTION

    The Samba software suite is a collection of programs that implements the Server Message Block (commonly abbreviated as SMB) protocol for UNIX systems. This protocol is sometimes also referred to as the Common Internet File System (CIFS). For a more thorough description, see http://www.ubiqx.org/cifs/. Samba also implements the NetBIOS - protocol in nmbd.

    smbd(8)

    The smbd daemon provides the file and print services to + protocol in nmbd.

    smbd(8)

    The smbd daemon provides the file and print services to SMB clients, such as Windows 95/98, Windows NT, Windows for Workgroups or LanManager. The configuration file - for this daemon is described in smb.conf(5) -

    nmbd(8)

    The nmbd + for this daemon is described in smb.conf(5) +

    nmbd(8)

    The nmbd daemon provides NetBIOS nameservice and browsing support. The configuration file for this daemon - is described in smb.conf(5)

    smbclient(1)

    The smbclient + is described in smb.conf(5)

    smbclient(1)

    The smbclient program implements a simple ftp-like client. This is useful for accessing SMB shares on other compatible servers (such as Windows NT), and can also be used to allow a UNIX box to print to a printer attached to - any SMB server (such as a PC running Windows NT).

    testparm(1)

    The testparm - utility is a simple syntax checker for Samba's smb.conf(5) configuration file.

    testprns(1)

    The testprns + any SMB server (such as a PC running Windows NT).

    testparm(1)

    The testparm + utility is a simple syntax checker for Samba's smb.conf(5) configuration file.

    testprns(1)

    The testprns utility supports testing printer names defined - in your printcap file used - by Samba.

    smbstatus(1)

    The smbstatus + in your printcap file used + by Samba.

    smbstatus(1)

    The smbstatus tool provides access to information about the - current connections to smbd.

    nmblookup(1)

    The nmblookup + current connections to smbd.

    nmblookup(1)

    The nmblookup tools allows NetBIOS name queries to be made - from a UNIX host.

    smbgroupedit(8)

    The smbgroupedit + from a UNIX host.

    smbgroupedit(8)

    The smbgroupedit tool allows for mapping unix groups to NT Builtin, Domain, or Local groups. Also it allows setting - priviledges for that group, such as saAddUser, etc.

    smbpasswd(8)

    The smbpasswd + priviledges for that group, such as saAddUser, etc.

    smbpasswd(8)

    The smbpasswd command is a tool for changing LanMan and Windows NT - password hashes on Samba and Windows NT servers.

    smbcacls(1)

    The smbcacls command is - a tool to set ACL's on remote CIFS servers.

    smbsh(1)

    The smbsh command is + password hashes on Samba and Windows NT servers.

    smbcacls(1)

    The smbcacls command is + a tool to set ACL's on remote CIFS servers.

    smbsh(1)

    The smbsh command is a program that allows you to run a unix shell with - with an overloaded VFS.

    smbtree(1)

    The smbtree command - is a text-based network neighborhood tool.

    smbtar(1)

    The smbtar can make - backups of data on CIFS/SMB servers.

    smbspool(8)

    smbspool is a + with an overloaded VFS.

    smbtree(1)

    The smbtree command + is a text-based network neighborhood tool.

    smbtar(1)

    The smbtar can make + backups of data on CIFS/SMB servers.

    smbspool(8)

    smbspool is a helper utility for printing on printers connected - to CIFS servers.

    smbcontrol(1)

    smbcontrol is a utility + to CIFS servers.

    smbcontrol(1)

    smbcontrol is a utility that can change the behaviour of running samba daemons. -

    rpcclient(1)

    rpcclient is a utility +

    rpcclient(1)

    rpcclient is a utility that can be used to execute RPC commands on remote - CIFS servers.

    pdbedit(8)

    The pdbedit command + CIFS servers.

    pdbedit(8)

    The pdbedit command can be used to maintain the local user database on - a samba server.

    findsmb(1)

    The findsmb command + a samba server.

    findsmb(1)

    The findsmb command can be used to find SMB servers on the local network. -

    net(8)

    The net command +

    net(8)

    The net command is supposed to work similar to the DOS/Windows - NET.EXE command.

    swat(8)

    swat is a web-based - interface to configuring smb.conf. -

    winbindd(8)

    winbindd is a daemon + NET.EXE command.

    swat(8)

    swat is a web-based + interface to configuring smb.conf. +

    winbindd(8)

    winbindd is a daemon that is used for integrating authentication and - the user database into unix.

    wbinfo(1)

    wbinfo is a utility + the user database into unix.

    wbinfo(1)

    wbinfo is a utility that retrieves and stores information related to winbind. -

    editreg(1)

    editreg is a command-line +

    editreg(1)

    editreg is a command-line utility that can edit windows registry files. -

    profiles(1)

    profiles is a command-line +

    profiles(1)

    profiles is a command-line utility that can be used to replace all occurences of a certain SID with another SID. -

    vfstest(1)

    vfstest is a utility - that can be used to test vfs modules.

    ntlm_auth(1)

    ntlm_auth is a helper-utility +

    vfstest(1)

    vfstest is a utility + that can be used to test vfs modules.

    ntlm_auth(1)

    ntlm_auth is a helper-utility for external programs wanting to do NTLM-authentication. -

    smbmount(8), smbumount(8), smbmount(8)

    smbmount,smbmnt and smbmnt are commands that can be used to +

    smbmount(8), smbumount(8), smbmount(8)

    smbmount,smbmnt and smbmnt are commands that can be used to mount CIFS/SMB shares on Linux. -

    smbcquotas(1)

    smbcquotas is a tool that +

    smbcquotas(1)

    smbcquotas is a tool that can set remote QUOTA's on server with NTFS 5.

    COMPONENTS

    The Samba suite is made up of several components. Each component is described in a separate manual page. It is strongly recommended that you read the documentation that comes with Samba @@ -93,18 +93,15 @@

    If you have patches to submit, visit http://devel.samba.org/ for information on how to do it properly. We prefer patches - in diff -u format.

    CONTRIBUTORS

    Contributors to the project are now too numerous + in diff -u format.

    CONTRIBUTORS

    Contributors to the project are now too numerous to mention here but all deserve the thanks of all Samba - users. To see a full list, look at - ftp://samba.org/pub/samba/alpha/change-log - for the pre-CVS changes and at - ftp://samba.org/pub/samba/alpha/cvs.log + users. To see a full list, look at the + change-log in the source package + for the pre-CVS changes and at + http://cvs.samba.org/ for the contributors to Samba post-CVS. CVS is the Open Source source code control system used by the Samba Team to develop - Samba. The project would have been unmanageable without it.

    In addition, several commercial organizations now help - fund the Samba Team with money and equipment. For details see - the Samba Web pages at - http://samba.org/samba/samba-thanks.html.

    AUTHOR

    The original Samba software and related utilities + Samba. The project would have been unmanageable without it.

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. diff --git a/docs/htmldocs/securing-samba.html b/docs/htmldocs/securing-samba.html index ae6408ea7b..a790816d02 100644 --- a/docs/htmldocs/securing-samba.html +++ b/docs/htmldocs/securing-samba.html @@ -1,116 +1,206 @@ - -Chapter 24. Securing Samba

    Chapter 24. Securing Samba
    Prev Part III. Advanced Configuration Next

    Chapter 24. Securing Samba

    Andrew Tridgell

    Samba Team

    <tridge@samba.org>

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    17 March 2003

    Table of Contents

    Introduction
    Using host based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba

    Introduction

    +Chapter 15. Securing Samba

    Chapter 15. Securing Samba
    Prev Part III. Advanced Configuration Next

    Chapter 15. Securing Samba

    Andrew Tridgell

    Samba Team

    John H. Terpstra

    Samba Team

    May 26, 2003

    Table of Contents

    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?

    Introduction

    This note was attached to the Samba 2.2.8 release notes as it contained an important security fix. The information contained here applies to Samba installations in general. -

    Using host based protection

    -In many installations of Samba the greatest threat comes for outside -your immediate network. By default Samba will accept connections from -any host, which means that if you run an insecure version of Samba on -a host that is directly connected to the Internet you can be -especially vulnerable.

    -One of the simplest fixes in this case is to use the hosts allow and -hosts deny options in the Samba smb.conf configuration file to only -allow access to your server from a specific range of hosts. An example -might be: -

    -	hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
-	hosts deny = 0.0.0.0/0
-

    -The above will only allow SMB connections from 'localhost' (your own -computer) and from the two private networks 192.168.2 and -192.168.3. All other connections will be refused as soon -as the client sends its first packet. The refusal will be marked as a -'not listening on called name' error. -

    Using interface protection

    -By default Samba will accept connections on any network interface that -it finds on your system. That means if you have a ISDN line or a PPP -connection to the Internet then Samba will accept connections on those -links. This may not be what you want. -

    -You can change this behaviour using options like the following: -

    -	interfaces = eth* lo
-	bind interfaces only = yes
-

    -This tells Samba to only listen for connections on interfaces with a -name starting with 'eth' such as eth0, eth1, plus on the loopback -interface called 'lo'. The name you will need to use depends on what -OS you are using, in the above I used the common name for Ethernet -adapters on Linux. -

    -If you use the above and someone tries to make a SMB connection to -your host over a PPP interface called 'ppp0' then they will get a TCP -connection refused reply. In that case no Samba code is run at all as -the operating system has been told not to pass connections from that -interface to any samba process. -

    Using a firewall

    -Many people use a firewall to deny access to services that they don't -want exposed outside their network. This can be a very good idea, -although I would recommend using it in conjunction with the above -methods so that you are protected even if your firewall is not active -for some reason. +A new apprentice reported for duty to the Chief Engineer of a boiler house. He said, "Here I am, +if you will show me the boiler I'll start working on it." Then engineer replied, "You're leaning +on it!"

    -If you are setting up a firewall then you need to know what TCP and -UDP ports to allow and block. Samba uses the following: -

    -	UDP/137    - used by nmbd
-	UDP/138    - used by nmbd
-	TCP/139    - used by smbd
-	TCP/445    - used by smbd
-

    -The last one is important as many older firewall setups may not be -aware of it, given that this port was only added to the protocol in -recent years. -

    Using a IPC$ share deny

    -If the above methods are not suitable, then you could also place a -more specific deny on the IPC$ share that is used in the recently -discovered security hole. This allows you to offer access to other -shares while denying access to IPC$ from potentially untrustworthy -hosts. +Security concerns are just like that: You need to know a little about the subject to appreciate +how obvious most of it really is. The challenge for most of us is to discover that first morsel +of knowledge with which we may unlock the secrets of the masters. +

    Features and Benefits

    +There are three level at which security principals must be observed in order to render a site +at least moderately secure. These are: the perimeter firewall, the configuration of the host +server that is running Samba, and Samba itself.

    -To do that you could use: -

    -	[ipc$]
-	     hosts allow = 192.168.115.0/24 127.0.0.1
-	     hosts deny = 0.0.0.0/0
-

    -this would tell Samba that IPC$ connections are not allowed from -anywhere but the two listed places (localhost and a local -subnet). Connections to other shares would still be allowed. As the -IPC$ share is the only share that is always accessible anonymously -this provides some level of protection against attackers that do not -know a username/password for your host. +Samba permits a most flexible approach to network security. As far as possible Samba implements +the latest protocols to permit more secure MS Windows file and print operations.

    -If you use this method then clients will be given a 'access denied' -reply when they try to access the IPC$ share. That means that those -clients will not be able to browse shares, and may also be unable to -access some other resources. +Samba may be secured from connections that originate from outside the local network. This may be +done using host based protection (using samba's implementation of a technology +known as "tcpwrappers", or it may be done be using interface based exclusion +so that smbd will bind only to specifically permitted interfaces. It is also +possible to set specific share or resource based exclusions, eg: on the IPC$ +auto-share. The IPC$ share is used for browsing purposes as well as to establish +TCP/IP connections.

    -This is not recommended unless you cannot use one of the other -methods listed above for some reason. -

    NTLMv2 Security

    -To configure NTLMv2 authentication the following registry keys are worth knowing about: -

    -

    -	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
-	"lmcompatibilitylevel"=dword:00000003
+Another method by which Samba may be secured is by way of setting Access Control Entries in an Access 
+Control List on the shares themselves. This is discussed in the chapter on File, Directory and Share Access
+Control.
+

    Technical Discussion of Protective Measures and Issues

    +The key challenge of security is the fact that protective measures suffice at best +only to close the door on known exploits and breach techniques. Never assume that +because you have followed these few measures that the Samba server is now an impenetrable +fortress! Given the history of information systems so far, it is only a matter of time +before someone will find yet another vulnerability. +

    Using host based protection

    + In many installations of Samba the greatest threat comes for outside + your immediate network. By default Samba will accept connections from + any host, which means that if you run an insecure version of Samba on + a host that is directly connected to the Internet you can be + especially vulnerable. +

    + One of the simplest fixes in this case is to use the hosts allow and + hosts deny options in the Samba smb.conf configuration file to only + allow access to your server from a specific range of hosts. An example + might be: + 

    +		hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
+		hosts deny = 0.0.0.0/0
+

    + The above will only allow SMB connections from 'localhost' (your own + computer) and from the two private networks 192.168.2 and + 192.168.3. All other connections will be refused as soon + as the client sends its first packet. The refusal will be marked as a + not listening on called name error. +

    User based protection

    + If you want to restrict access to your server to valid users only then the following + method may be of use. In the smb.conf [globals] section put: + 

    +		valid users = @smbusers, jacko
+

    + What this does is, it restricts all server access to either the user jacko + or to members of the system group smbusers. +

    Using interface protection

    + By default Samba will accept connections on any network interface that + it finds on your system. That means if you have a ISDN line or a PPP + connection to the Internet then Samba will accept connections on those + links. This may not be what you want. +

    + You can change this behaviour using options like the following: + 

    +		interfaces = eth* lo
+		bind interfaces only = yes
+

    + This tells Samba to only listen for connections on interfaces with a + name starting with 'eth' such as eth0, eth1, plus on the loopback + interface called 'lo'. The name you will need to use depends on what + OS you are using, in the above I used the common name for Ethernet + adapters on Linux. +

    + If you use the above and someone tries to make a SMB connection to + your host over a PPP interface called 'ppp0' then they will get a TCP + connection refused reply. In that case no Samba code is run at all as + the operating system has been told not to pass connections from that + interface to any samba process. +

    Using a firewall

    + Many people use a firewall to deny access to services that they don't + want exposed outside their network. This can be a very good idea, + although I would recommend using it in conjunction with the above + methods so that you are protected even if your firewall is not active + for some reason. +

    + If you are setting up a firewall then you need to know what TCP and + UDP ports to allow and block. Samba uses the following: +

    UDP/137 - used by nmbd
    UDP/138 - used by nmbd
    TCP/139 - used by smbd
    TCP/445 - used by smbd

    + The last one is important as many older firewall setups may not be + aware of it, given that this port was only added to the protocol in + recent years. +

    Using a IPC$ share deny

    + If the above methods are not suitable, then you could also place a + more specific deny on the IPC$ share that is used in the recently + discovered security hole. This allows you to offer access to other + shares while denying access to IPC$ from potentially untrustworthy + hosts. +

    + To do that you could use: + 

    +[ipc$]
+	hosts allow = 192.168.115.0/24 127.0.0.1
+	hosts deny = 0.0.0.0/0
+

    + this would tell Samba that IPC$ connections are not allowed from + anywhere but the two listed places (localhost and a local + subnet). Connections to other shares would still be allowed. As the + IPC$ share is the only share that is always accessible anonymously + this provides some level of protection against attackers that do not + know a username/password for your host. +

    + If you use this method then clients will be given a access denied + reply when they try to access the IPC$ share. That means that those + clients will not be able to browse shares, and may also be unable to + access some other resources. +

    + This is not recommended unless you cannot use one of the other + methods listed above for some reason. +

    NTLMv2 Security

    + To configure NTLMv2 authentication the following registry keys are worth knowing about: +

    + 

    +		[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
+		"lmcompatibilitylevel"=dword:00000003
 
-	0x3 - Send NTLMv2 response only. Clients will use NTLMv2 authentication,
-	use NTLMv2 session security if the server supports it. Domain
-	controllers accept LM, NTLM and NTLMv2 authentication.
+		0x3 - Send NTLMv2 response only. Clients will use NTLMv2 authentication,
+		use NTLMv2 session security if the server supports it. Domain
+		controllers accept LM, NTLM and NTLMv2 authentication.
 
-	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
-	"NtlmMinClientSec"=dword:00080000
+		[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
+		"NtlmMinClientSec"=dword:00080000
 
-	0x80000 - NTLMv2 session security. If either NtlmMinClientSec or
-	NtlmMinServerSec is set to 0x80000, the connection will fail if NTLMv2
-	session security is not negotiated.
-

    -

    Upgrading Samba

    + 0x80000 - NTLMv2 session security. If either NtlmMinClientSec or + NtlmMinServerSec is set to 0x80000, the connection will fail if NTLMv2 + session security is not negotiated. +

    +

    Upgrading Samba

    Please check regularly on http://www.samba.org/ for updates and important announcements. Occasionally security releases are made and it is highly recommended to upgrade Samba when a security vulnerability is discovered. -

    Prev Up Next
    Chapter 23. Integrating MS Windows networks with Samba Home Chapter 25. Unicode/Charsets
    +

    Common Errors

    +If all of samba and host platform configuration were really as intuitive as one might like then this +section would not be necessary. Security issues are often vexing for a support person to resolve, not +because of the complexity of the problem, but for reason that most administrators who post what turns +out to be a security problem request are totally convinced that the problem is with Samba. +

    Smbclient works on localhost, but the network is dead

    + This is a very common problem. Red Hat Linux (as do others) will install a default firewall. + With the default firewall in place only traffic on the loopback adapter (IP address 127.0.0.1) + will be allowed through the firewall. +

    + The solution is either to remove the firewall (stop it) or to modify the firewall script to + allow SMB networking traffic through. See section above in this chapter. +

    Why can users access home directories of other users?

    + “ + We are unable to keep individual users from mapping to any other user's + home directory once they have supplied a valid password! They only need + to enter their own password. I have not found *any* method that I can + use to configure samba to enforce that only a user may map their own + home directory. + ” +

    “ + User xyzzy can map his home directory. Once mapped user xyzzy can also map + *anyone* else's home directory! + ”

    + This is not a security flaw, it is by design. Samba allows + users to have *exactly* the same access to the UNIX filesystem + as they would if they were logged onto the UNIX box, except + that it only allows such views onto the file system as are + allowed by the defined shares. +

    + This means that if your UNIX home directories are set up + such that one user can happily cd into another users + directory and do an ls, the UNIX security solution is to + change the UNIX file permissions on the users home directories + such that the cd and ls would be denied. +

    + Samba tries very hard not to second guess the UNIX administrators + security policies, and trusts the UNIX admin to set + the policies and permissions he or she desires. +

    + Samba does allow the setup you require when you have set the + only user = yes option on the share, is that you have not set the + valid users list for the share. +

    + Note that only user works in conjunction with the users= list, + so to get the behavior you require, add the line : + 

    +	users = %S
+

    + this is equivalent to: + 

    +	valid users = %S
+

    + to the definition of the [homes] share, as recommended in + the smb.conf man page. +

    Prev Up Next
    Chapter 14. File and Record Locking Home Chapter 16. Interdomain Trust Relationships
    diff --git a/docs/htmldocs/smb.conf.5.html b/docs/htmldocs/smb.conf.5.html index 3a54a894ac..f22afa5884 100644 --- a/docs/htmldocs/smb.conf.5.html +++ b/docs/htmldocs/smb.conf.5.html @@ -1,12 +1,12 @@ -smb.conf

    Name

    smb.conf — The configuration file for the Samba suite

    SYNOPSIS

    The smb.conf file is a configuration - file for the Samba suite. smb.conf contains - runtime configuration information for the Samba programs. The smb.conf file - is designed to be configured and administered by the swat(8) program. The complete +smb.conf

    Name

    smb.conf — The configuration file for the Samba suite

    SYNOPSIS

    The smb.conf file is a configuration + file for the Samba suite. smb.conf contains + runtime configuration information for the Samba programs. The smb.conf file + is designed to be configured and administered by the swat(8) program. The complete description of the file format and possible parameters held within are here for reference purposes.

    FILE FORMAT

    The file consists of sections and parameters. A section begins with the name of the section in square brackets and continues until the next section begins. Sections contain parameters of the - form

    name = value + form

    name = value

    The file is line-based - that is, each newline-terminated line represents either a comment, a section name or a parameter.

    Section and parameter names are not case sensitive.

    Only the first equals sign in a parameter is significant. Whitespace before or after the first equals sign is discarded. @@ -44,9 +44,9 @@ masked by the access rights granted to the specified or guest UNIX user by the host system. The server does not grant more access than the host system grants.

    The following sample section defines a file space share. - The user has write access to the path /home/bar. + The user has write access to the path /home/bar. The share is accessed via the share name "foo":

    -
+
 [foo]
 	path = /home/bar
 	read only = no
@@ -57,7 +57,7 @@
 	spool file. The guest ok parameter means 
 	access will be permitted as the default guest user (specified 
 	elsewhere):
    -
+
 [aprinter]
 	path = /usr/spool/public
 	read only = yes
@@ -79,7 +79,7 @@
 		the located username.
  • If no path was given, the path is set to
 		the user's home directory.

    • If you decide to use a path = line in your [homes] section then you may find it useful - to use the %S macro. For example :

    path = /data/pchome/%S

    would be useful if you have different home directories + to use the %S macro. For example :

    path = /data/pchome/%S

    would be useful if you have different home directories for your PCs than for UNIX access.

    This is a fast and simple way to give a large number of clients access to their home directories with a minimum of fuss.

    A similar process occurs if the requested section @@ -90,7 +90,7 @@ a normal service section can specify, though some make more sense than others. The following is a typical and suitable [homes] section:

    -
+
 [homes]
 	read only = no
 
@@ -124,7 +124,7 @@
 		to load the configuration file.
    Typically the path specified would be that of a 
 		world-writeable spool directory with the sticky bit set on 
 		it. A typical [printers] entry would look like 
-		this:
    
+		this:
    
 [printers]
 	path = /usr/spool/public
 	guest ok = yes
@@ -134,7 +134,7 @@
 		If your printing subsystem doesn't work like that, you will have 
 		to set up a pseudo-printcap. This is a file consisting of one or 
 		more lines like this:
    -
+
 alias|alias|alias|alias...    
 
 
    Each alias should be an acceptable printer name for 
@@ -184,8 +184,8 @@ alias|alias|alias|alias...
 		WinNT and Win2k. Anything else will be known as 
 		"UNKNOWN". If it gets it wrong then sending a level 
 		3 log to samba@samba.org
-		 should allow it to be fixed.
    %I
    The IP address of the client machine.
    %T
    the current date and time.
    %D
    Name of the domain or workgroup of the current user.
    %$(envvar)
    The value of the environment variable
-		envar.

    The following substitutes apply only to some configuration options(only those + should allow it to be fixed.

    %I

    The IP address of the client machine.

    %T

    the current date and time.

    %D

    Name of the domain or workgroup of the current user.

    %$(envvar)

    The value of the environment variable + envar.

    The following substitutes apply only to some configuration options(only those that are used when a connection has been established):

    %S

    the name of the current service, if any.

    %P

    the root directory of the current service, if any.

    %u

    user name of the current service, if any.

    %g

    primary group name of %u.

    %H

    the home directory of the user given by %u.

    %N

    the name of your NIS home directory server. @@ -224,7 +224,7 @@ alias|alias|alias|alias... pair and that username/password pair is validated by the UNIX system's password programs then the connection is made as that username. Note that this includes the - \\server\service%username method of passing + \\server\service%username method of passing a username.

  • If the client has previously registered a username with the system and now supplies a correct password for that username then the connection is allowed.

  • The client's NetBIOS name and any previously @@ -233,7 +233,7 @@ alias|alias|alias|alias... user.

  • If the client has previously validated a username/password pair with the server and the client has passed the validation token then that username is used.

  • If a "user = " field is given in the - smb.conf file for the service and the client + smb.conf file for the service and the client has supplied a password, and that password matches (according to the UNIX system's password checking) with one of the usernames from the "user =" field then the connection is made as @@ -244,116 +244,114 @@ alias|alias|alias|alias... connection is made as the username given in the "guest account =" for the service, irrespective of the supplied password.

    • COMPLETE LIST OF GLOBAL PARAMETERS

    Here is a list of all global parameters. See the section of - each parameter for details. Note that some are synonyms.

    COMPLETE LIST OF SERVICE PARAMETERS

    Here is a list of all service parameters. See the section on - each parameter for details. Note that some are synonyms.

    EXPLANATION OF EACH PARAMETER

    abort shutdown script (G)

    This parameter only exists in the HEAD cvs branch - This a full path name to a script called by smbd(8) that + each parameter for details. Note that some are synonyms.

    COMPLETE LIST OF SERVICE PARAMETERS

    Here is a list of all service parameters. See the section on + each parameter for details. Note that some are synonyms.

    EXPLANATION OF EACH PARAMETER

    abort shutdown script (G)

    This parameter only exists in the HEAD cvs branch + This a full path name to a script called by smbd(8) that should stop a shutdown procedure issued by the - shutdown script.

    This command will be run as user.

    Default: None.

    Example: abort shutdown script = /sbin/shutdown -c

    add group script (G)

    This is the full pathname to a script that will be run - AS ROOT by smbd(8) - when a new group is requested. It will expand any %g to the group name passed. This + shutdown script.

    This command will be run as user.

    Default: None.

    Example: abort shutdown script = /sbin/shutdown -c

    add group script (G)

    This is the full pathname to a script that will be run + AS ROOT by smbd(8) + when a new group is requested. It will expand any %g to the group name passed. This script is only useful for installations using the Windows NT domain administration tools. The script is free to create a group with an arbitrary name to circumvent unix group name restrictions. In that case the script must print the numeric gid of the created group on stdout.

    add machine script (G)

    This is the full pathname to a script that will be run by - smbd(8) when a machine is added + smbd(8) when a machine is added to it's domain using the administrator username and password method.

    This option is only required when using sam back-ends tied to the Unix uid method of RID calculation such as smbpasswd. - This option is only available in Samba 3.0.

    Default: add machine script = <empty string>

    Example: add machine script = /usr/sbin/adduser -n -g + This option is only available in Samba 3.0.

    Default: add machine script = <empty string>

    Example: add machine script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %u

    addprinter command (G)

    With the introduction of MS-RPC based printing support for Windows NT/2000 clients in Samba 2.2, The MS Add Printer Wizard (APW) icon is now also available in the "Printers..." folder displayed a share listing. The APW allows for printers to be add remotely to a Samba or Windows NT/2000 print server.

    For a Samba host this means that the printer must be - physically added to the underlying printing system. The add + physically added to the underlying printing system. The add printer command defines a script to be run which will perform the necessary operations for adding the printer to the print system and to add the appropriate service definition - to the smb.conf file in order that it can be - shared by smbd(8).

    The addprinter command is + to the smb.conf file in order that it can be + shared by smbd(8).

    The addprinter command is automatically invoked with the following parameter (in - order):

    • printer name

    • share name

    • port name

    • driver name

    • location

    • Windows 9x driver location

    All parameters are filled in from the PRINTER_INFO_2 structure sent + order):

    • printer name

    • share name

    • port name

    • driver name

    • location

    • Windows 9x driver location

    All parameters are filled in from the PRINTER_INFO_2 structure sent by the Windows NT/2000 client with one exception. The "Windows 9x driver location" parameter is included for backwards compatibility only. The remaining fields in the structure are generated from answers - to the APW questions.

    Once the addprinter command has - been executed, smbd will reparse the + to the APW questions.

    Once the addprinter command has + been executed, smbd will reparse the smb.conf to determine if the share defined by the APW - exists. If the sharename is still invalid, then smbd + exists. If the sharename is still invalid, then smbd will return an ACCESS_DENIED error to the client.

    The "add printer command" program can output a single line of text, which Samba will set as the port the new printer is connected to. If this line isn't output, Samba won't reload its printer shares. -

    See also +

    See also deleteprinter command, - printing, - show add - printer wizard

    Default: none

    Example: addprinter command = /usr/bin/addprinter

    add share command (G)

    Samba 2.2.0 introduced the ability to dynamically + printing, + show add + printer wizard

    Default: none

    Example: addprinter command = /usr/bin/addprinter

    add share command (G)

    Samba 2.2.0 introduced the ability to dynamically add and delete shares via the Windows NT 4.0 Server Manager. The - add share command is used to define an + add share command is used to define an external program or script which will add a new service definition - to smb.conf. In order to successfully - execute the add share command, smbd + to smb.conf. In order to successfully + execute the add share command, smbd requires that the administrator be connected using a root account (i.e. uid == 0).

    - When executed, smbd will automatically invoke the - add share command with four parameters. -

    • configFile - the location - of the global smb.conf file. -

    • shareName - the name of the new + When executed, smbd will automatically invoke the + add share command with four parameters. +

      • configFile - the location + of the global smb.conf file. +

      • shareName - the name of the new share. -

      • pathName - path to an **existing** +

      • pathName - path to an **existing** directory on disk. -

      • comment - comment string to associate +

      • comment - comment string to associate with the new share.

      This parameter is only used for add file shares. To add printer shares, - see the addprinter + see the addprinter command.

      - See also change share - command, delete share + See also change share + command, delete share command. -

      Default: none

      Example: add share command = /usr/local/bin/addshare

    add user script (G)

    This is the full pathname to a script that will - be run AS ROOT by smbd(8) under special circumstances described below.

    Normally, a Samba server requires that UNIX users are +

    Default: none

    Example: add share command = /usr/local/bin/addshare

    add user script (G)

    This is the full pathname to a script that will + be run AS ROOT by smbd(8) under special circumstances described below.

    Normally, a Samba server requires that UNIX users are created for all users accessing files on this server. For sites that use Windows NT account databases as their primary user database creating these users and keeping the user list in sync with the Windows NT PDC is an onerous task. This option allows smbd to create the required UNIX users - ON DEMAND when a user accesses the Samba server.

    In order to use this option, smbd(8) must NOT be set to security = share - and add user script + ON DEMAND when a user accesses the Samba server.

    In order to use this option, smbd(8) must NOT be set to security = share + and add user script must be set to a full pathname for a script that will create a UNIX - user given one argument of %u, which expands into + user given one argument of %u, which expands into the UNIX user name to create.

    When the Windows user attempts to access the Samba server, - at login (session setup in the SMB protocol) time, smbd(8) contacts the password server and + at login (session setup in the SMB protocol) time, smbd(8) contacts the password server and attempts to authenticate the given user with the given password. If the - authentication succeeds then smbd + authentication succeeds then smbd attempts to find a UNIX user in the UNIX password database to map the - Windows user into. If this lookup fails, and add user script - is set then smbd will + Windows user into. If this lookup fails, and add user script + is set then smbd will call the specified script AS ROOT, expanding - any %u argument to be the user name to create.

    If this script successfully creates the user then smbd + any %u argument to be the user name to create.

    If this script successfully creates the user then smbd will continue on as though the UNIX user already existed. In this way, UNIX users are dynamically created to - match existing Windows NT accounts.

    See also + match existing Windows NT accounts.

    See also security, - password server, - delete user - script.

    Default: add user script = <empty string>

    Example: add user script = /usr/local/samba/bin/add_user %u

    add user to group script (G)

    Full path to the script that will be called when + password server, + delete user + script.

    Default: add user script = <empty string>

    Example: add user script = /usr/local/samba/bin/add_user %u

    add user to group script (G)

    Full path to the script that will be called when a user is added to a group using the Windows NT domain administration - tools. It will be run by smbd(8) AS ROOT. - Any %g will be replaced with the group name and - any %u will be replaced with the user name. -

    Default: add user to group script =

    Example: add user to group script = /usr/sbin/adduser %u %g

    admin users (S)

    This is a list of users who will be granted + tools. It will be run by smbd(8) AS ROOT. + Any %g will be replaced with the group name and + any %u will be replaced with the user name. +

    Default: add user to group script =

    Example: add user to group script = /usr/sbin/adduser %u %g

    admin users (S)

    This is a list of users who will be granted administrative privileges on the share. This means that they will do all file operations as the super-user (root).

    You should use this option very carefully, as any user in this list will be able to do anything they like on the share, - irrespective of file permissions.

    Default: no admin users

    Example: admin users = jason

    ads server (G)

    If this option is specified, samba does not try to figure out what - ads server to use itself, but uses the specified ads server. Either one - DNS name or IP address can be used.

    Default: ads server =

    Example: ads server = 192.168.1.2

    algorithmic rid base (G)

    This determines how Samba will use its + irrespective of file permissions.

    Default: no admin users

    Example: admin users = jason

    algorithmic rid base (G)

    This determines how Samba will use its algorithmic mapping from uids/gid to the RIDs needed to construct NT Security Identifiers.

    Setting this option to a larger value could be useful to sites @@ -364,10 +362,10 @@ alias|alias|alias|alias... mapping can't be 'turned off', but pushing it 'out of the way' should resolve the issues. Users and groups can then be assigned 'low' RIDs in arbitary-rid supporting backends. -

    Default: algorithmic rid base = 1000

    Example: algorithmic rid base = 100000

    allow hosts (S)

    Synonym for - hosts allow.

    allow trusted domains (G)

    This option only takes effect when the - security option is set to - server or domain. +

    Default: algorithmic rid base = 1000

    Example: algorithmic rid base = 100000

    allow hosts (S)

    Synonym for + hosts allow.

    allow trusted domains (G)

    This option only takes effect when the + security option is set to + server or domain. If it is set to no, then attempts to connect to a resource from a domain or workgroup other than the one which smbd is running in will fail, even if that domain is trusted by the remote server @@ -378,7 +376,7 @@ alias|alias|alias|alias... circumstances, a user with an account in DOMB can then access the resources of a UNIX account with the same account name on the Samba server even if they do not have an account in DOMA. This - can make implementing a security boundary difficult.

    Default: allow trusted domains = yes

    announce as (G)

    This specifies what type of server nmbd(8) will announce itself as, to a network neighborhood browse + can make implementing a security boundary difficult.

    Default: allow trusted domains = yes

    announce as (G)

    This specifies what type of server nmbd(8) will announce itself as, to a network neighborhood browse list. By default this is set to Windows NT. The valid options are : "NT Server" (which can also be written as "NT"), "NT Workstation", "Win95" or "WfW" meaning Windows NT Server, @@ -386,73 +384,81 @@ alias|alias|alias|alias... respectively. Do not change this parameter unless you have a specific need to stop Samba appearing as an NT server as this may prevent Samba servers from participating as browser servers - correctly.

    Default: announce as = NT Server

    Example: announce as = Win95

    announce version (G)

    This specifies the major and minor version numbers + correctly.

    Default: announce as = NT Server

    Example: announce as = Win95

    announce version (G)

    This specifies the major and minor version numbers that nmbd will use when announcing itself as a server. The default is 4.9. Do not change this parameter unless you have a specific - need to set a Samba server to be a downlevel server.

    Default: announce version = 4.9

    Example: announce version = 2.0

    auth methods (G)

    This option allows the administrator to chose what - authentication methods smbd will use when authenticating + need to set a Samba server to be a downlevel server.

    Default: announce version = 4.9

    Example: announce version = 2.0

    auth methods (G)

    This option allows the administrator to chose what + authentication methods smbd will use when authenticating a user. This option defaults to sensible values based on - security.

    Each entry in the list attempts to authenticate the user in turn, until + security. This should be considered + a developer option and used only in rare circumstances. In the majority (if not all) + of production servers, the default setting should be adequate.

    Each entry in the list attempts to authenticate the user in turn, until the user authenticates. In practice only one method will ever actually be able to complete the authentication. -

    Default: auth methods = <empty string>

    Example: auth methods = guest sam ntdomain

    auto services (G)

    This is a synonym for the - preload.

    available (S)

    This parameter lets you "turn off" a service. If - available = no, then ALL +

    Possible options include guest (anonymous access), + sam (lookups in local list of accounts based on netbios + name or domain name), winbind (relay authentication requests + for remote users through winbindd), ntdomain (pre-winbindd + method of authentication for remote domain users; deprecated in favour of winbind method), + trustdomain (authenticate trusted users by contacting the + remote DC directly from smbd; deprecated in favour of winbind method).

    Default: auth methods = <empty string>

    Example: auth methods = guest sam winbind

    auto services (G)

    This is a synonym for the + preload.

    available (S)

    This parameter lets you "turn off" a service. If + available = no, then ALL attempts to connect to the service will fail. Such failures are - logged.

    Default: available = yes

    bind interfaces only (G)

    This global parameter allows the Samba admin + logged.

    Default: available = yes

    bind interfaces only (G)

    This global parameter allows the Samba admin to limit what interfaces on a machine will serve SMB requests. It - affects file service smbd(8) and name service nmbd(8) in a slightly different ways.

    For name service it causes nmbd to bind + affects file service smbd(8) and name service nmbd(8) in a slightly different ways.

    For name service it causes nmbd to bind to ports 137 and 138 on the interfaces listed in - the interfaces parameter. nmbd also + the interfaces parameter. nmbd also binds to the "all addresses" interface (0.0.0.0) on ports 137 and 138 for the purposes of reading broadcast messages. - If this option is not set then nmbd will service - name requests on all of these sockets. If bind interfaces - only is set then nmbd will check the + If this option is not set then nmbd will service + name requests on all of these sockets. If bind interfaces + only is set then nmbd will check the source address of any packets coming in on the broadcast sockets and discard any that don't match the broadcast addresses of the - interfaces in the interfaces parameter list. + interfaces in the interfaces parameter list. As unicast packets are received on the other sockets it allows - nmbd to refuse to serve names to machines that + nmbd to refuse to serve names to machines that send packets that arrive through any interfaces not listed in the - interfaces list. IP Source address spoofing + interfaces list. IP Source address spoofing does defeat this simple check, however, so it must not be used - seriously as a security feature for nmbd.

    For file service it causes smbd(8) to bind only to the interface list + seriously as a security feature for nmbd.

    For file service it causes smbd(8) to bind only to the interface list given in the interfaces parameter. This - restricts the networks that smbd will serve + restricts the networks that smbd will serve to packets coming in those interfaces. Note that you should not use this parameter for machines that are serving PPP or other intermittent or non-broadcast network - interfaces as it will not cope with non-permanent interfaces.

    If bind interfaces only is set then + interfaces as it will not cope with non-permanent interfaces.

    If bind interfaces only is set then unless the network address 127.0.0.1 is added - to the interfaces parameter - list smbpasswd(8) and swat(8) may not work as expected due - to the reasons covered below.

    To change a users SMB password, the smbpasswd + to the interfaces parameter + list smbpasswd(8) and swat(8) may not work as expected due + to the reasons covered below.

    To change a users SMB password, the smbpasswd by default connects to the localhost - 127.0.0.1 address as an SMB client to issue the password change request. If - bind interfaces only is set then unless the + bind interfaces only is set then unless the network address 127.0.0.1 is added to the - interfaces parameter list then + interfaces parameter list then smbpasswd will fail to connect in it's default mode. - smbpasswd can be forced to use the primary IP interface - of the local host by using its smbpasswd(8) -r remote machine - parameter, with remote machine set - to the IP name of the primary interface of the local host.

    The swat status page tries to connect with - smbd and nmbd at the address + smbpasswd can be forced to use the primary IP interface + of the local host by using its smbpasswd(8) -r remote machine + parameter, with remote machine set + to the IP name of the primary interface of the local host.

    The swat status page tries to connect with + smbd and nmbd at the address 127.0.0.1 to determine if they are running. - Not adding 127.0.0.1 will cause - smbd and nmbd to always show - "not running" even if they really are. This can prevent - swat from starting/stopping/restarting smbd - and nmbd.

    Default: bind interfaces only = no

    blocking locks (S)

    This parameter controls the behavior - of smbd(8) when given a request by a client + Not adding 127.0.0.1 will cause + smbd and nmbd to always show + "not running" even if they really are. This can prevent + swat from starting/stopping/restarting smbd + and nmbd.

    Default: bind interfaces only = no

    blocking locks (S)

    This parameter controls the behavior + of smbd(8) when given a request by a client to obtain a byte range lock on a region of an open file, and the request has a time limit associated with it.

    If this parameter is set and the lock range requested cannot be immediately satisfied, samba will internally queue the lock request, and periodically attempt to obtain - the lock until the timeout period expires.

    If this parameter is set to no, then + the lock until the timeout period expires.

    If this parameter is set to no, then samba will behave as previous versions of Samba would and will fail the lock request immediately if the lock range - cannot be obtained.

    Default: blocking locks = yes

    block size (S)

    This parameter controls the behavior of smbd(8) when reporting disk free + cannot be obtained.

    Default: blocking locks = yes

    block size (S)

    This parameter controls the behavior of smbd(8) when reporting disk free sizes. By default, this reports a disk block size of 1024 bytes.

    Changing this parameter may have some effect on the efficiency of client writes, this is not yet confirmed. This @@ -463,62 +469,68 @@ alias|alias|alias|alias...

    Changing this option does not change the disk free reporting size, just the block size unit reported to the client.

    browsable (S)

    See the - browseable.

    browseable (S)

    This controls whether this share is seen in - the list of available shares in a net view and in the browse list.

    Default: browseable = yes

    browse list (G)

    This controls whether smbd(8) will serve a browse list to - a client doing a NetServerEnum call. Normally - set to yes. You should never need to change - this.

    Default: browse list = yes

    case sensitive (S)

    See the discussion in the section NAME MANGLING.

    Default: case sensitive = no

    casesignames (S)

    Synonym for case sensitive.

    change notify timeout (G)

    This SMB allows a client to tell a server to + browseable.

    browseable (S)

    This controls whether this share is seen in + the list of available shares in a net view and in the browse list.

    Default: browseable = yes

    browse list (G)

    This controls whether smbd(8) will serve a browse list to + a client doing a NetServerEnum call. Normally + set to yes. You should never need to change + this.

    Default: browse list = yes

    case sensitive (S)

    See the discussion in the section NAME MANGLING.

    Default: case sensitive = no

    casesignames (S)

    Synonym for case sensitive.

    change notify timeout (G)

    This SMB allows a client to tell a server to "watch" a particular directory for any changes and only reply to the SMB request when a change has occurred. Such constant scanning of - a directory is expensive under UNIX, hence an smbd(8) daemon only performs such a scan - on each requested directory once every change notify - timeout seconds.

    Default: change notify timeout = 60

    Example: change notify timeout = 300

    Would change the scan time to every 5 minutes.

    change share command (G)

    Samba 2.2.0 introduced the ability to dynamically + a directory is expensive under UNIX, hence an smbd(8) daemon only performs such a scan + on each requested directory once every change notify + timeout seconds.

    Default: change notify timeout = 60

    Example: change notify timeout = 300

    Would change the scan time to every 5 minutes.

    change share command (G)

    Samba 2.2.0 introduced the ability to dynamically add and delete shares via the Windows NT 4.0 Server Manager. The - change share command is used to define an + change share command is used to define an external program or script which will modify an existing service definition - in smb.conf. In order to successfully - execute the change share command, smbd + in smb.conf. In order to successfully + execute the change share command, smbd requires that the administrator be connected using a root account (i.e. uid == 0).

    - When executed, smbd will automatically invoke the - change share command with four parameters. -

    • configFile - the location - of the global smb.conf file. -

    • shareName - the name of the new + When executed, smbd will automatically invoke the + change share command with four parameters. +

      • configFile - the location + of the global smb.conf file. +

      • shareName - the name of the new share. -

      • pathName - path to an **existing** +

      • pathName - path to an **existing** directory on disk. -

      • comment - comment string to associate +

      • comment - comment string to associate with the new share.

      This parameter is only used modify existing file shares definitions. To modify printer shares, use the "Printers..." folder as seen when browsing the Samba host.

      - See also add share - command, delete + See also add share + command, delete share command. -

      Default: none

      Example: change share command = /usr/local/bin/addshare

    comment (S)

    This is a text field that is seen next to a share +

    Default: none

    Example: change share command = /usr/local/bin/addshare

    client use spnego (G)

    This variable controls controls whether samba clients will try + to use Simple and Protected NEGOciation (as specified by rfc2478) with + WindowsXP and Windows2000 servers to agree upon an authentication mechanism. + SPNEGO client support with Sign and Seal is currently broken, so + you might want to turn this option off when doing joins to + Windows 2003 domains. +

    Default: client use spnego = yes

    comment (S)

    This is a text field that is seen next to a share when a client does a queries the server, either via the network - neighborhood or via net view to list what shares + neighborhood or via net view to list what shares are available.

    If you want to set the string that is displayed next to the - machine name then see the - server string parameter.

    Default: No comment string

    Example: comment = Fred's Files

    config file (G)

    This allows you to override the config file - to use, instead of the default (usually smb.conf). + machine name then see the + server string parameter.

    Default: No comment string

    Example: comment = Fred's Files

    config file (G)

    This allows you to override the config file + to use, instead of the default (usually smb.conf). There is a chicken and egg problem here as this option is set in the config file!

    For this reason, if the name of the config file has changed when the parameters are loaded then it will reload them from the new config file.

    This option takes the usual substitutions, which can be very useful.

    If the config file doesn't exist then it won't be loaded (allowing you to special case the config files of just a few - clients).

    Example: config file = /usr/local/samba/lib/smb.conf.%m

    copy (S)

    This parameter allows you to "clone" service + clients).

    Example: config file = /usr/local/samba/lib/smb.conf.%m

    copy (S)

    This parameter allows you to "clone" service entries. The specified service is simply duplicated under the current service's name. Any parameters specified in the current section will override those in the section being copied.

    This feature lets you set up a 'template' service and create similar services easily. Note that the service being copied must occur earlier in the configuration file than the - service doing the copying.

    Default: no value

    Example: copy = otherservice

    create mask (S)

    A synonym for this parameter is - create mode + service doing the copying.

    Default: no value

    Example: copy = otherservice

    create mask (S)

    A synonym for this parameter is + create mode .

    When a file is created, the necessary permissions are calculated according to the mapping from DOS modes to UNIX permissions, and the resulting UNIX mode is then bit-wise 'AND'ed @@ -528,23 +540,23 @@ alias|alias|alias|alias... created.

    The default value of this parameter removes the 'group' and 'other' write and execute bits from the UNIX modes.

    Following this Samba will bit-wise 'OR' the UNIX mode created from this parameter with the value of the - force create mode + force create mode parameter which is set to 000 by default.

    This parameter does not affect directory modes. See the - parameter directory mode - for details.

    See also the force + parameter directory mode + for details.

    See also the force create mode parameter for forcing particular mode bits to be set on created files. See also the - directory mode parameter for masking + directory mode parameter for masking mode bits on created directories. See also the - inherit permissions parameter.

    Note that this parameter does not apply to permissions + inherit permissions parameter.

    Note that this parameter does not apply to permissions set by Windows NT/2000 ACL editors. If the administrator wishes to enforce a mask on access control lists also, they need to set the - security mask.

    Default: create mask = 0744

    Example: create mask = 0775

    create mode (S)

    This is a synonym for + security mask.

    Default: create mask = 0744

    Example: create mask = 0775

    create mode (S)

    This is a synonym for create mask.

    csc policy (S)

    This stands for client-side caching policy, and specifies how clients capable of offline caching will cache the files in the share. The valid values are: manual, documents, programs, disable.

    These values correspond to those used on Windows servers.

    For example, shares containing roaming profiles can have - offline caching disabled using csc policy = disable.

    Default: csc policy = manual

    Example: csc policy = programs

    dead time (G)

    The value of the parameter (a decimal integer) + offline caching disabled using csc policy = disable.

    Default: csc policy = manual

    Example: csc policy = programs

    dead time (G)

    The value of the parameter (a decimal integer) represents the number of minutes of inactivity before a connection is considered dead, and it is disconnected. The deadtime only takes effect if the number of open files is zero.

    This is useful to stop a server's resources being @@ -552,30 +564,31 @@ alias|alias|alias|alias... connection is broken so in most cases this parameter should be transparent to users.

    Using this parameter with a timeout of a few minutes is recommended for most systems.

    A deadtime of zero indicates that no auto-disconnection - should be performed.

    Default: deadtime = 0

    Example: deadtime = 15

    debug hires timestamp (G)

    Sometimes the timestamps in the log messages + should be performed.

    Default: deadtime = 0

    Example: deadtime = 15

    debug hires timestamp (G)

    Sometimes the timestamps in the log messages are needed with a resolution of higher that seconds, this boolean parameter adds microsecond resolution to the timestamp - message header when turned on.

    Note that the parameter + message header when turned on.

    Note that the parameter debug timestamp must be on for this to have an - effect.

    Default: debug hires timestamp = no

    debug level (G)

    Synonym for + effect.

    Default: debug hires timestamp = no

    debug level (G)

    Synonym for log level.

    debug pid (G)

    When using only one log file for more then one forked - smbd(8)-process there may be hard to + smbd(8)-process there may be hard to follow which process outputs which message. This boolean parameter is adds the process-id to the timestamp message headers in the - logfile when turned on.

    Note that the parameter + logfile when turned on.

    Note that the parameter debug timestamp must be on for this to have an - effect.

    Default: debug pid = no

    debug timestamp (G)

    Samba debug log messages are timestamped + effect.

    Default: debug pid = no

    debug timestamp (G)

    Samba debug log messages are timestamped by default. If you are running at a high - debug level these timestamps + debug level these timestamps can be distracting. This boolean parameter allows timestamping - to be turned off.

    Default: debug timestamp = yes

    debug uid (G)

    Samba is sometimes run as root and sometime + to be turned off.

    Default: debug timestamp = yes

    debug uid (G)

    Samba is sometimes run as root and sometime run as the connected user, this boolean parameter inserts the current euid, egid, uid and gid to the timestamp message headers - in the log file if turned on.

    Note that the parameter + in the log file if turned on.

    Note that the parameter debug timestamp must be on for this to have an - effect.

    Default: debug uid = no

    default case (S)

    See the section on + effect.

    Default: debug uid = no

    default (G)

    A synonym for + default service.

    default case (S)

    See the section on NAME MANGLING. Also note the - short preserve case parameter.

    Default: default case = lower

    default devmode (S)

    This parameter is only applicable to printable services. + short preserve case parameter.

    Default: default case = lower

    default devmode (S)

    This parameter is only applicable to printable services. When smbd is serving Printer Drivers to Windows NT/2k/XP clients, each printer on the Samba server has a Device Mode which defines things such as paper size and orientation and duplex settings. The device mode can only correctly be @@ -592,20 +605,20 @@ alias|alias|alias|alias...

    This parameter should be used with care and tested with the printer driver in question. It is better to leave the device mode to NULL and let the Windows client set the correct values. Because drivers do not - do this all the time, setting default devmode = yes + do this all the time, setting default devmode = yes will instruct smbd to generate a default one.

    For more information on Windows NT/2k printing and Device Modes, see the MSDN documentation. -

    Default: default devmode = no

    default service (G)

    This parameter specifies the name of a service +

    Default: default devmode = no

    default service (G)

    This parameter specifies the name of a service which will be connected to if the service actually requested cannot be found. Note that the square brackets are NOT given in the parameter value (see example below).

    There is no default value for this parameter. If this parameter is not given, attempting to connect to a nonexistent service results in an error.

    Typically the default service would be a - guest ok, - read-only service.

    Also note that the apparent service name will be changed + guest ok, + read-only service.

    Also note that the apparent service name will be changed to equal that of the requested service, this is very useful as it - allows you to use macros like %S to make + allows you to use macros like %S to make a wildcard service.

    Note also that any "_" characters in the name of the service used in the default service will get mapped to a "/". This allows for interesting things.

    Example:

    @@ -614,80 +627,79 @@ alias|alias|alias|alias...
         
 [pub]
 	path = /%S
-
    default (G)

    A synonym for - default service.

    delete group script (G)

    This is the full pathname to a script that will - be run AS ROOT smbd(8) when a group is requested to be deleted. - It will expand any %g to the group name passed. +

    delete group script (G)

    This is the full pathname to a script that will + be run AS ROOT smbd(8) when a group is requested to be deleted. + It will expand any %g to the group name passed. This script is only useful for installations using the Windows NT domain administration tools.

    deleteprinter command (G)

    With the introduction of MS-RPC based printer support for Windows NT/2000 clients in Samba 2.2, it is now possible to delete printer at run time by issuing the DeletePrinter() RPC call.

    For a Samba host this means that the printer must be - physically deleted from underlying printing system. The + physically deleted from underlying printing system. The deleteprinter command defines a script to be run which will perform the necessary operations for removing the printer - from the print system and from smb.conf. -

    The deleteprinter command is - automatically called with only one parameter: - "printer name".

    Once the deleteprinter command has - been executed, smbd will reparse the + from the print system and from smb.conf. +

    The deleteprinter command is + automatically called with only one parameter: + "printer name".

    Once the deleteprinter command has + been executed, smbd will reparse the smb.conf to associated printer no longer exists. - If the sharename is still valid, then smbd - will return an ACCESS_DENIED error to the client.

    See also + If the sharename is still valid, then smbd + will return an ACCESS_DENIED error to the client.

    See also addprinter command, - printing, - show add - printer wizard

    Default: none

    Example: deleteprinter command = /usr/bin/removeprinter

    delete readonly (S)

    This parameter allows readonly files to be deleted. + printing, + show add + printer wizard

    Default: none

    Example: deleteprinter command = /usr/bin/removeprinter

    delete readonly (S)

    This parameter allows readonly files to be deleted. This is not normal DOS semantics, but is allowed by UNIX.

    This option may be useful for running applications such as rcs, where UNIX file ownership prevents changing file - permissions, and DOS semantics prevent deletion of a read only file.

    Default: delete readonly = no

    delete share command (G)

    Samba 2.2.0 introduced the ability to dynamically + permissions, and DOS semantics prevent deletion of a read only file.

    Default: delete readonly = no

    delete share command (G)

    Samba 2.2.0 introduced the ability to dynamically add and delete shares via the Windows NT 4.0 Server Manager. The - delete share command is used to define an + delete share command is used to define an external program or script which will remove an existing service - definition from smb.conf. In order to successfully - execute the delete share command, smbd + definition from smb.conf. In order to successfully + execute the delete share command, smbd requires that the administrator be connected using a root account (i.e. uid == 0).

    - When executed, smbd will automatically invoke the - delete share command with two parameters. -

    delete user from group script (G)

    Full path to the script that will be called when +

    Default: none

    Example: delete share command = /usr/local/bin/delshare

    delete user from group script (G)

    Full path to the script that will be called when a user is removed from a group using the Windows NT domain administration - tools. It will be run by smbd(8) AS ROOT. - Any %g will be replaced with the group name and - any %u will be replaced with the user name. -

    Default: delete user from group script =

    Example: delete user from group script = /usr/sbin/deluser %u %g

    delete user script (G)

    This is the full pathname to a script that will - be run by smbd(8) when managing users + tools. It will be run by smbd(8) AS ROOT. + Any %g will be replaced with the group name and + any %u will be replaced with the user name. +

    Default: delete user from group script =

    Example: delete user from group script = /usr/sbin/deluser %u %g

    delete user script (G)

    This is the full pathname to a script that will + be run by smbd(8) when managing users with remote RPC (NT) tools.

    This script is called when a remote client removes a user from the server, normally using 'User Manager for Domains' or - rpcclient.

    This script should delete the given UNIX username.

    Default: delete user script = <empty string>

    Example: delete user script = /usr/local/samba/bin/del_user %u

    delete veto files (S)

    This option is used when Samba is attempting to + rpcclient.

    This script should delete the given UNIX username.

    Default: delete user script = <empty string>

    Example: delete user script = /usr/local/samba/bin/del_user %u

    delete veto files (S)

    This option is used when Samba is attempting to delete a directory that contains one or more vetoed directories - (see the veto files - option). If this option is set to no (the default) then if a vetoed + (see the veto files + option). If this option is set to no (the default) then if a vetoed directory contains any non-vetoed files or directories then the - directory delete will fail. This is usually what you want.

    If this option is set to yes, then Samba + directory delete will fail. This is usually what you want.

    If this option is set to yes, then Samba will attempt to recursively delete any files and directories within the vetoed directory. This can be useful for integration with file serving systems such as NetAtalk which create meta-files within directories you might normally veto DOS/Windows users from seeing - (e.g. .AppleDouble)

    Setting delete veto files = yes allows these + (e.g. .AppleDouble)

    Setting delete veto files = yes allows these directories to be transparently deleted when the parent directory - is deleted (so long as the user has permissions to do so).

    See also the veto - files parameter.

    Default: delete veto files = no

    deny hosts (S)

    Synonym for hosts - deny.

    dfree command (G)

    The dfree command setting + is deleted (so long as the user has permissions to do so).

    See also the veto + files parameter.

    Default: delete veto files = no

    deny hosts (S)

    Synonym for hosts + deny.

    dfree command (G)

    The dfree command setting should only be used on systems where a problem occurs with the internal disk space calculations. This has been known to happen with Ultrix, but may occur with other operating systems. The @@ -697,20 +709,20 @@ alias|alias|alias|alias... routine. The example below gives a possible script that might fulfill this function.

    The external program will be passed a single parameter indicating a directory in the filesystem being queried. This will typically consist - of the string ./. The script should return two + of the string ./. The script should return two integers in ASCII. The first should be the total disk space in blocks, and the second should be the number of available blocks. An optional third return value can give the block size in bytes. The default blocksize is 1024 bytes.

    Note: Your script should NOT be setuid or setgid and should be owned by (and writeable only by) root!

    Default: By default internal routines for determining the disk capacity and remaining space will be used. -

    Example: dfree command = /usr/local/samba/bin/dfree

    Where the script dfree (which must be made executable) could be:

     
+	
    Example: dfree command = /usr/local/samba/bin/dfree
    Where the script dfree (which must be made executable) could be:
     
 #!/bin/sh
 df $1 | tail -1 | awk '{print $2" "$4}'
 
    or perhaps (on Sys V based systems):
     
 #!/bin/sh
 /usr/bin/df -k $1 | tail -1 | awk '{print $3" "$5}'
-
    Note that you may have to replace the command names with full path names on some systems.
    directory mask (S)

    This parameter is the octal modes which are +

    Note that you may have to replace the command names with full path names on some systems.

    directory (S)

    Synonym for path.

    directory mask (S)

    This parameter is the octal modes which are used when converting DOS modes to UNIX modes when creating UNIX directories.

    When a directory is created, the necessary permissions are calculated according to the mapping from DOS modes to UNIX permissions, @@ -722,17 +734,17 @@ df $1 | tail -1 | awk '{print $2" "$4}' and 'other' write bits from the UNIX mode, allowing only the user who owns the directory to modify it.

    Following this Samba will bit-wise 'OR' the UNIX mode created from this parameter with the value of the - force directory mode parameter. + force directory mode parameter. This parameter is set to 000 by default (i.e. no extra mode bits are added).

    Note that this parameter does not apply to permissions set by Windows NT/2000 ACL editors. If the administrator wishes to enforce a mask on access control lists also, they need to set the - directory security mask.

    See the force + directory security mask.

    See the force directory mode parameter to cause particular mode - bits to always be set on created directories.

    See also the create mode + bits to always be set on created directories.

    See also the create mode parameter for masking mode bits on created files, - and the directory - security mask parameter.

    Also refer to the - inherit permissions parameter.

    Default: directory mask = 0755

    Example: directory mask = 0775

    directory mode (S)

    Synonym for + and the directory + security mask parameter.

    Also refer to the + inherit permissions parameter.

    Default: directory mask = 0755

    Example: directory mask = 0775

    directory mode (S)

    Synonym for directory mask

    directory security mask (S)

    This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a directory using the native NT security dialog @@ -746,15 +758,15 @@ df $1 | tail -1 | awk '{print $2" "$4}' Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will probably want to leave - it as the default of 0777.

    See also the + it as the default of 0777.

    See also the force directory security mode, - security mask, - force security mode - parameters.

    Default: directory security mask = 0777

    Example: directory security mask = 0700

    directory (S)

    Synonym for path.

    disable netbios (G)

    Enabling this parameter will disable netbios support + security mask, + force security mode + parameters.

    Default: directory security mask = 0777

    Example: directory security mask = 0700

    disable netbios (G)

    Enabling this parameter will disable netbios support in Samba. Netbios is the only available form of browsing in all windows versions except for 2000 and XP.

    Note

    Note that clients that only support netbios won't be able to see your samba server when netbios support is disabled. -

    Default: disable netbios = no

    Example: disable netbios = yes

    disable spoolss (G)

    Enabling this parameter will disable Samba's support +

    Default: disable netbios = no

    Example: disable netbios = yes

    disable spoolss (G)

    Enabling this parameter will disable Samba's support for the SPOOLSS set of MS-RPC's and will yield identical behavior as Samba 2.0.x. Windows NT/2000 clients will downgrade to using Lanman style printing commands. Windows 9x/ME will be uneffected by @@ -765,58 +777,58 @@ df $1 | tail -1 | awk '{print $2" "$4}' print drivers from the Samba host upon demand. Be very careful about enabling this parameter.

    See also use client driver -

    Default : disable spoolss = no

    display charset (G)

    Specifies the charset that samba will use +

    Default : disable spoolss = no

    display charset (G)

    Specifies the charset that samba will use to print messages to stdout and stderr and SWAT will use. - Should generally be the same as the unix charset. -

    Default: display charset = ASCII

    Example: display charset = UTF8

    dns proxy (G)

    Specifies that nmbd(8) when acting as a WINS server and + Should generally be the same as the unix charset. +

    Default: display charset = ASCII

    Example: display charset = UTF8

    dns proxy (G)

    Specifies that nmbd(8) when acting as a WINS server and finding that a NetBIOS name has not been registered, should treat the NetBIOS name word-for-word as a DNS name and do a lookup with the DNS server for that name on behalf of the name-querying client.

    Note that the maximum length for a NetBIOS name is 15 characters, so the DNS name (or DNS alias) can likewise only be - 15 characters, maximum.

    nmbd spawns a second copy of itself to do the + 15 characters, maximum.

    nmbd spawns a second copy of itself to do the DNS name lookup requests, as doing a name lookup is a blocking - action.

    See also the parameter - wins support.

    Default: dns proxy = yes

    domain logons (G)

    If set to yes, the Samba server will serve + action.

    See also the parameter + wins support.

    Default: dns proxy = yes

    domain logons (G)

    If set to yes, the Samba server will serve Windows 95/98 Domain logons for the - workgroup it is in. Samba 2.2 + workgroup it is in. Samba 2.2 has limited capability to act as a domain controller for Windows NT 4 Domains. For more details on setting up this feature see - the Samba-PDC-HOWTO included in the Samba documentation.

    Default: domain logons = no

    domain master (G)

    Tell smbd(8) to enable WAN-wide browse list - collation. Setting this option causes nmbd to + the Samba-PDC-HOWTO included in the Samba documentation.

    Default: domain logons = no

    domain master (G)

    Tell smbd(8) to enable WAN-wide browse list + collation. Setting this option causes nmbd to claim a special domain specific NetBIOS name that identifies it as a domain master browser for its given - workgroup. Local master browsers - in the same workgroup on broadcast-isolated - subnets will give this nmbd their local browse lists, - and then ask smbd(8) for a complete copy of the browse + workgroup. Local master browsers + in the same workgroup on broadcast-isolated + subnets will give this nmbd their local browse lists, + and then ask smbd(8) for a complete copy of the browse list for the whole wide area network. Browser clients will then contact their local master browser, and will receive the domain-wide browse list, instead of just the list for their broadcast-isolated subnet.

    Note that Windows NT Primary Domain Controllers expect to be - able to claim this workgroup specific special + able to claim this workgroup specific special NetBIOS name that identifies them as domain master browsers for - that workgroup by default (i.e. there is no + that workgroup by default (i.e. there is no way to prevent a Windows NT PDC from attempting to do this). This - means that if this parameter is set and nmbd claims - the special name for a workgroup before a Windows + means that if this parameter is set and nmbd claims + the special name for a workgroup before a Windows NT PDC is able to do so then cross subnet browsing will behave - strangely and may fail.

    If domain logons = yes - , then the default behavior is to enable the domain - master parameter. If domain logons is - not enabled (the default setting), then neither will domain - master be enabled by default.

    Default: domain master = auto

    dont descend (S)

    There are certain directories on some systems - (e.g., the /proc tree under Linux) that are either not + strangely and may fail.

    If domain logons = yes + , then the default behavior is to enable the domain + master parameter. If domain logons is + not enabled (the default setting), then neither will domain + master be enabled by default.

    Default: domain master = auto

    dont descend (S)

    There are certain directories on some systems + (e.g., the /proc tree under Linux) that are either not of interest to clients or are infinitely deep (recursive). This parameter allows you to specify a comma-delimited list of directories that the server should always show as empty.

    Note that Samba can be very fussy about the exact format - of the "dont descend" entries. For example you may need - ./proc instead of just /proc. + of the "dont descend" entries. For example you may need + ./proc instead of just /proc. Experimentation is the best policy :-)

    Default: none (i.e., all directories are OK - to descend)

    Example: dont descend = /proc,/dev

    dos charset (G)

    DOS SMB clients assume the server has + to descend)

    Example: dont descend = /proc,/dev

    dos charset (G)

    DOS SMB clients assume the server has the same charset as they do. This option specifies which charset Samba should talk to DOS clients.

    The default depends on which charsets you have installed. Samba tries to use charset 850 but falls back to ASCII in - case it is not available. Run testparm(1) to check the default on your system.

    dos filemode (S)

    The default behavior in Samba is to provide + case it is not available. Run testparm(1) to check the default on your system.

    dos filemode (S)

    The default behavior in Samba is to provide UNIX-like behavior where only the owner of a file/directory is able to change the permissions on it. However, this behavior is often confusing to DOS/Windows users. Enabling this parameter @@ -825,11 +837,11 @@ df $1 | tail -1 | awk '{print $2" "$4}' belonging to the group owning the file will not be allowed to change permissions if the group is only granted read access. Ownership of the file/directory is not changed, only the permissions - are modified.

    Default: dos filemode = no

    dos filetime resolution (S)

    Under the DOS and Windows FAT filesystem, the finest + are modified.

    Default: dos filemode = no

    dos filetime resolution (S)

    Under the DOS and Windows FAT filesystem, the finest granularity on time resolution is two seconds. Setting this parameter for a share causes Samba to round the reported time down to the nearest two second boundary when a query call that requires one second - resolution is made to smbd(8).

    This option is mainly used as a compatibility option for Visual + resolution is made to smbd(8).

    This option is mainly used as a compatibility option for Visual C++ when used against Samba shares. If oplocks are enabled on a share, Visual C++ uses two different time reading calls to check if a file has changed since it was last read. One of these calls uses a @@ -838,23 +850,23 @@ df $1 | tail -1 | awk '{print $2" "$4}' timestamp of an odd number of seconds then the two timestamps will not match and Visual C++ will keep reporting the file has changed. Setting this option causes the two timestamps to match, and Visual C++ is - happy.

    Default: dos filetime resolution = no

    dos filetimes (S)

    Under DOS and Windows, if a user can write to a + happy.

    Default: dos filetime resolution = no

    dos filetimes (S)

    Under DOS and Windows, if a user can write to a file they can change the timestamp on it. Under POSIX semantics, only the owner of the file or root may change the timestamp. By default, Samba runs with POSIX semantics and refuses to change the - timestamp on a file if the user smbd is acting - on behalf of is not the file owner. Setting this option to - yes allows DOS semantics and smbd(8) will change the file - timestamp as DOS requires.

    Default: dos filetimes = no

    encrypt passwords (G)

    This boolean controls whether encrypted passwords + timestamp on a file if the user smbd is acting + on behalf of is not the file owner. Setting this option to + yes allows DOS semantics and smbd(8) will change the file + timestamp as DOS requires.

    Default: dos filetimes = no

    encrypt passwords (G)

    This boolean controls whether encrypted passwords will be negotiated with the client. Note that Windows NT 4.0 SP3 and above and also Windows 98 will by default expect encrypted passwords unless a registry entry is changed. To use encrypted passwords in Samba see the chapter "User Database" in the Samba HOWTO Collection.

    In order for encrypted passwords to work correctly - smbd(8) must either - have access to a local smbpasswd(5) file (see the smbpasswd(8) program for information on how to set up + smbd(8) must either + have access to a local smbpasswd(5) file (see the smbpasswd(8) program for information on how to set up and maintain this file), or set the security = [server|domain|ads] parameter which - causes smbd to authenticate against another - server.

    Default: encrypt passwords = yes

    enhanced browsing (G)

    This option enables a couple of enhancements to + causes smbd to authenticate against another + server.

    Default: encrypt passwords = yes

    enhanced browsing (G)

    This option enables a couple of enhancements to cross-subnet browse propagation that have been added in Samba but which are not standard in Microsoft implementations.

    The first enhancement to browse propagation consists of a regular @@ -865,21 +877,21 @@ df $1 | tail -1 | awk '{print $2" "$4}' workgroups not disappearing from browse lists. Due to the restrictions of the browse protocols these enhancements can cause a empty workgroup to stay around forever which can be annoying.

    In general you should leave this option enabled as it makes - cross-subnet browse propagation much more reliable.

    Default: enhanced browsing = yes

    enumports command (G)

    The concept of a "port" is fairly foreign + cross-subnet browse propagation much more reliable.

    Default: enhanced browsing = yes

    enumports command (G)

    The concept of a "port" is fairly foreign to UNIX hosts. Under Windows NT/2000 print servers, a port is associated with a port monitor and generally takes the form of a local port (i.e. LPT1:, COM1:, FILE:) or a remote port (i.e. LPD Port Monitor, etc...). By default, Samba has only one - port defined--"Samba Printer Port". Under + port defined--"Samba Printer Port". Under Windows NT/2000, all printers must have a valid port name. - If you wish to have a list of ports displayed (smbd + If you wish to have a list of ports displayed (smbd does not use a port name for anything) other than - the default "Samba Printer Port", you - can define enumports command to point to + the default "Samba Printer Port", you + can define enumports command to point to a program which should generate a list of ports, one per line, to standard output. This listing will then be used in response - to the level 1 and 2 EnumPorts() RPC.

    Default: no enumports command

    Example: enumports command = /usr/bin/listports

    exec (S)

    This is a synonym for - preexec.

    fake directory create times (S)

    NTFS and Windows VFAT file systems keep a create + to the level 1 and 2 EnumPorts() RPC.

    Default: no enumports command

    Example: enumports command = /usr/bin/listports

    exec (S)

    This is a synonym for + preexec.

    fake directory create times (S)

    NTFS and Windows VFAT file systems keep a create time for all files and directories. This is not the same as the ctime - status change time - that Unix keeps, so Samba by default reports the earliest of the various times Unix does keep. Setting @@ -899,40 +911,40 @@ df $1 | tail -1 | awk '{print $2" "$4}' directory's timestamp if newer, then all object files will be rebuilt. Enabling this option ensures directories always predate their contents and an NMAKE build - will proceed as expected.

    Default: fake directory create times = no

    fake oplocks (S)

    Oplocks are the way that SMB clients get permission + will proceed as expected.

    Default: fake directory create times = no

    fake oplocks (S)

    Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an oplock (opportunistic lock) then the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. With some oplock types the client may even cache file open/close operations. This can give enormous performance benefits. -

    When you set fake oplocks = yes, smbd(8) will +

    When you set fake oplocks = yes, smbd(8) will always grant oplock requests no matter how many clients are using the file.

    It is generally much better to use the real - oplocks support rather + oplocks support rather than this parameter.

    If you enable this option on all read-only shares or shares that you know will only be accessed from one client at a time such as physically read-only media like CDROMs, you will see a big performance improvement on many operations. If you enable this option on shares where multiple clients may be accessing the files read-write at the same time you can get data corruption. Use - this option carefully!

    Default: fake oplocks = no

    follow symlinks (S)

    This parameter allows the Samba administrator - to stop smbd(8) from following symbolic + this option carefully!

    Default: fake oplocks = no

    follow symlinks (S)

    This parameter allows the Samba administrator + to stop smbd(8) from following symbolic links in a particular share. Setting this - parameter to no prevents any file or directory + parameter to no prevents any file or directory that is a symbolic link from being followed (the user will get an error). This option is very useful to stop users from adding a - symbolic link to /etc/passwd in their home + symbolic link to /etc/passwd in their home directory for instance. However it will slow filename lookups - down slightly.

    This option is enabled (i.e. smbd will - follow symbolic links) by default.

    Default: follow symlinks = yes

    force create mode (S)

    This parameter specifies a set of UNIX mode bit + down slightly.

    This option is enabled (i.e. smbd will + follow symbolic links) by default.

    Default: follow symlinks = yes

    force create mode (S)

    This parameter specifies a set of UNIX mode bit permissions that will always be set on a file created by Samba. This is done by bitwise 'OR'ing these bits onto the mode bits of a file that is being created or having its permissions changed. The default for this parameter is (in octal) 000. The modes in this parameter are bitwise 'OR'ed onto the file - mode after the mask set in the create mask - parameter is applied.

    See also the parameter create - mask for details on masking mode bits on files.

    See also the inherit - permissions parameter.

    Default: force create mode = 000

    Example: force create mode = 0755

    would force all created files to have read and execute + mode after the mask set in the create mask + parameter is applied.

    See also the parameter create + mask for details on masking mode bits on files.

    See also the inherit + permissions parameter.

    Default: force create mode = 000

    Example: force create mode = 0755

    would force all created files to have read and execute permissions set for 'group' and 'other' as well as the read/write/execute bits set for the 'user'.

    force directory mode (S)

    This parameter specifies a set of UNIX mode bit permissions that will always be set on a directory @@ -940,11 +952,11 @@ df $1 | tail -1 | awk '{print $2" "$4}' mode bits of a directory that is being created. The default for this parameter is (in octal) 0000 which will not add any extra permission bits to a created directory. This operation is done after the mode - mask in the parameter directory mask is - applied.

    See also the parameter + mask in the parameter directory mask is + applied.

    See also the parameter directory mask for details on masking mode bits - on created directories.

    See also the - inherit permissions parameter.

    Default: force directory mode = 000

    Example: force directory mode = 0755

    would force all created directories to have read and execute + on created directories.

    See also the + inherit permissions parameter.

    Default: force directory mode = 000

    Example: force directory mode = 0755

    would force all created directories to have read and execute permissions set for 'group' and 'other' as well as the read/write/execute bits set for the 'user'.

    force directory security mode (S)

    This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX @@ -958,11 +970,11 @@ df $1 | tail -1 | awk '{print $2" "$4}' Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will probably want to leave - it set as 0000.

    See also the + it set as 0000.

    See also the directory security mask, - security mask, - force security mode - parameters.

    Default: force directory security mode = 0

    Example: force directory security mode = 700

    force group (S)

    This specifies a UNIX group name that will be + security mask, + force security mode + parameters.

    Default: force directory security mode = 0

    Example: force directory security mode = 700

    force group (S)

    This specifies a UNIX group name that will be assigned as the default primary group for all users connecting to this service. This is useful for sharing files by ensuring that all access to files on service will use the named group for @@ -976,13 +988,13 @@ df $1 | tail -1 | awk '{print $2" "$4}' an administrator to decide that only users who are already in a particular group will create files with group ownership set to that group. This gives a finer granularity of ownership assignment. For - example, the setting force group = +sys means + example, the setting force group = +sys means that only users who are already in group sys will have their default primary group assigned to sys when accessing this Samba share. All - other users will retain their ordinary primary group.

    If the force user + other users will retain their ordinary primary group.

    If the force user parameter is also set the group specified in - force group will override the primary group - set in force user.

    See also force user.

    Default: no forced group

    Example: force group = agroup

    force security mode (S)

    This parameter controls what UNIX permission + force group will override the primary group + set in force user.

    See also force user.

    Default: no forced group

    Example: force group = agroup

    force security mode (S)

    This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a file using the native NT security dialog box.

    This parameter is applied as a mask (OR'ed with) to the @@ -995,11 +1007,11 @@ df $1 | tail -1 | awk '{print $2" "$4}' the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will probably want to leave - this set to 0000.

    See also the + this set to 0000.

    See also the force directory security mode, - directory security - mask, - security mask parameters.

    Default: force security mode = 0

    Example: force security mode = 700

    force user (S)

    This specifies a UNIX user name that will be + directory security + mask, + security mask parameters.

    Default: force security mode = 0

    Example: force security mode = 700

    force user (S)

    This specifies a UNIX user name that will be assigned as the default user for all users connecting to this service. This is useful for sharing files. You should also use it carefully as using it incorrectly can cause security problems.

    This user name only gets used once a connection is established. @@ -1009,19 +1021,19 @@ df $1 | tail -1 | awk '{print $2" "$4}' as. This can be very useful.

    In Samba 2.0.5 and above this parameter also causes the primary group of the forced user to be used as the primary group for all file activity. Prior to 2.0.5 the primary group was left - as the primary group of the connecting user (this was a bug).

    See also force group

    Default: no forced user

    Example: force user = auser

    fstype (S)

    This parameter allows the administrator to + as the primary group of the connecting user (this was a bug).

    See also force group

    Default: no forced user

    Example: force user = auser

    fstype (S)

    This parameter allows the administrator to configure the string that specifies the type of filesystem a share - is using that is reported by smbd(8) when a client queries the filesystem type - for a share. The default type is NTFS for + is using that is reported by smbd(8) when a client queries the filesystem type + for a share. The default type is NTFS for compatibility with Windows NT but this can be changed to other - strings such as Samba or FAT - if required.

    Default: fstype = NTFS

    Example: fstype = Samba

    getwd cache (G)

    This is a tuning option. When this is enabled a + strings such as Samba or FAT + if required.

    Default: fstype = NTFS

    Example: fstype = Samba

    getwd cache (G)

    This is a tuning option. When this is enabled a caching algorithm will be used to reduce the time taken for getwd() calls. This can have a significant impact on performance, especially - when the wide links - parameter is set to no.

    Default: getwd cache = yes

    group (S)

    Synonym for - force group.

    guest account (G,S)

    This is a username which will be used for access - to services which are specified as + when the wide links + parameter is set to no.

    Default: getwd cache = yes

    group (S)

    Synonym for + force group.

    guest account (G,S)

    This is a username which will be used for access + to services which are specified as guest ok (see below). Whatever privileges this user has will be available to any client connecting to the guest service. Typically this user will exist in the password file, but will not @@ -1031,24 +1043,24 @@ df $1 | tail -1 | awk '{print $2" "$4}'

    One some systems the default guest account "nobody" may not be able to print. Use another account in this case. You should test this by trying to log in as your guest user (perhaps by using the - su - command) and trying to print using the - system print command such as lpr(1) or + su - command) and trying to print using the + system print command such as lpr(1) or lp(1).

    This parameter does not accept % macros, because many parts of the system require this value to be - constant for correct operation.

    Default: specified at compile time, usually "nobody"

    Example: guest account = ftp

    guest ok (S)

    If this parameter is yes for + constant for correct operation.

    Default: specified at compile time, usually "nobody"

    Example: guest account = ftp

    guest ok (S)

    If this parameter is yes for a service, then no password is required to connect to the service. - Privileges will be those of the + Privileges will be those of the guest account.

    This paramater nullifies the benifits of setting - restrict - anonymous = 2

    See the section below on + restrict + anonymous = 2

    See the section below on security for more information about this option. -

    Default: guest ok = no

    guest only (S)

    If this parameter is yes for +

    Default: guest ok = no

    guest only (S)

    If this parameter is yes for a service, then only guest connections to the service are permitted. This parameter will have no effect if - guest ok is not set for the service.

    See the section below on + guest ok is not set for the service.

    See the section below on security for more information about this option. -

    Default: guest only = no

    hide dot files (S)

    This is a boolean parameter that controls whether - files starting with a dot appear as hidden files.

    Default: hide dot files = yes

    hide files (S)

    This is a list of files or directories that are not +

    Default: guest only = no

    hide dot files (S)

    This is a boolean parameter that controls whether + files starting with a dot appear as hidden files.

    Default: hide dot files = yes

    hide files (S)

    This is a list of files or directories that are not visible but are accessible. The DOS 'hidden' attribute is applied to any files or directories that match.

    Each entry in the list must be separated by a '/', which allows spaces to be included in the entry. '*' @@ -1057,111 +1069,116 @@ df $1 | tail -1 | awk '{print $2" "$4}' not include the Unix directory separator '/'.

    Note that the case sensitivity option is applicable in hiding files.

    Setting this parameter will affect the performance of Samba, as it will be forced to check all files and directories for a match - as they are scanned.

    See also hide - dot files, + as they are scanned.

    See also hide + dot files, veto files and - case sensitive.

    Default: no file are hidden

    Example: hide files = + case sensitive.

    Default: no file are hidden

    Example: hide files = /.*/DesktopFolderDB/TrashFor%m/resource.frk/

    The above example is based on files that the Macintosh SMB client (DAVE) available from Thursby creates for internal use, and also still hides all files beginning with a dot.

    hide local users (G)

    This parameter toggles the hiding of local UNIX - users (root, wheel, floppy, etc) from remote clients.

    Default: hide local users = no

    hide special files (S)

    This parameter prevents clients from seeing + users (root, wheel, floppy, etc) from remote clients.

    Default: hide local users = no

    hide special files (S)

    This parameter prevents clients from seeing special files such as sockets, devices and fifo's in directory listings. -

    Default: hide special files = no

    hide unreadable (S)

    This parameter prevents clients from seeing the - existance of files that cannot be read. Defaults to off.

    Default: hide unreadable = no

    hide unwriteable files (S)

    This parameter prevents clients from seeing +

    Default: hide special files = no

    hide unreadable (S)

    This parameter prevents clients from seeing the + existance of files that cannot be read. Defaults to off.

    Default: hide unreadable = no

    hide unwriteable files (S)

    This parameter prevents clients from seeing the existance of files that cannot be written to. Defaults to off. Note that unwriteable directories are shown as usual. -

    Default: hide unwriteable = no

    homedir map (G)

    Ifnis homedir - is yes, and smbd(8) is also acting - as a Win95/98 logon server then this parameter +

    Default: hide unwriteable = no

    homedir map (G)

    Ifnis homedir + is yes, and smbd(8) is also acting + as a Win95/98 logon server then this parameter specifies the NIS (or YP) map from which the server for the user's home directory should be extracted. At present, only the Sun - auto.home map format is understood. The form of the map is:

    username server:/some/file/system

    and the program will extract the servername from before + auto.home map format is understood. The form of the map is:

    username server:/some/file/system

    and the program will extract the servername from before the first ':'. There should probably be a better parsing system that copes with different map formats and also Amd (another automounter) maps.

    Note

    A working NIS client is required on - the system for this option to work.

    See also nis homedir - , domain logons - .

    Default: homedir map = <empty string>

    Example: homedir map = amd.homedir

    host msdfs (G)

    This boolean parameter is only available - if Samba has been configured and compiled with the - --with-msdfs option. If set to yes, + the system for this option to work.

    See also nis homedir + , domain logons + .

    Default: homedir map = <empty string>

    Example: homedir map = amd.homedir

    host msdfs (G)

    This boolean parameter is only available + if Samba has been configured and compiled with the + --with-msdfs option. If set to yes, Samba will act as a Dfs server, and allow Dfs-aware clients - to browse Dfs trees hosted on the server.

    See also the + to browse Dfs trees hosted on the server.

    See also the msdfs root share level parameter. For more information on setting up a Dfs tree on Samba, refer to msdfs_setup.html. -

    Default: host msdfs = no

    hostname lookups (G)

    Specifies whether samba should use (expensive) +

    Default: host msdfs = no

    hostname lookups (G)

    Specifies whether samba should use (expensive) hostname lookups or use the ip addresses instead. An example place where hostname lookups are currently used is when checking - the hosts deny and hosts allow. -

    Default: hostname lookups = yes

    Example: hostname lookups = no

    hosts allow (S)

    A synonym for this parameter is allow + the hosts deny and hosts allow. +

    Default: hostname lookups = yes

    Example: hostname lookups = no

    hosts allow (S)

    A synonym for this parameter is allow hosts.

    This parameter is a comma, space, or tab delimited set of hosts which are permitted to access a service.

    If specified in the [global] section then it will apply to all services, regardless of whether the individual service has a different setting.

    You can specify the hosts by name or IP number. For example, you could restrict access to only the hosts on a - Class C subnet with something like allow hosts = 150.203.5. + Class C subnet with something like allow hosts = 150.203.5. . The full syntax of the list is described in the man - page hosts_access(5). Note that this man + page hosts_access(5). Note that this man page may not be present on your system, so a brief description will be given here also.

    Note that the localhost address 127.0.0.1 will always be allowed access unless specifically denied by a - hosts deny option.

    You can also specify hosts by network/netmask pairs and + hosts deny option.

    You can also specify hosts by network/netmask pairs and by netgroup names if your system supports netgroups. The EXCEPT keyword can also be used to limit a - wildcard list. The following examples may provide some help:

    Example 1: allow all IPs in 150.203.*.*; except one

    hosts allow = 150.203. EXCEPT 150.203.6.66

    Example 2: allow hosts that match the given network/netmask

    hosts allow = 150.203.15.0/255.255.255.0

    Example 3: allow a couple of hosts

    hosts allow = lapland, arvidsjaur

    Example 4: allow only hosts in NIS netgroup "foonet", but - deny access from one particular host

    hosts allow = @foonet

    hosts deny = pirate

    Note

    Note that access still requires suitable user-level passwords.

    See testparm(1) for a way of testing your host access - to see if it does what you expect.

    Default: none (i.e., all hosts permitted access)

    Example: allow hosts = 150.203.5. myhost.mynet.edu.au

    hosts deny (S)

    The opposite of hosts allow + wildcard list. The following examples may provide some help:

    Example 1: allow all IPs in 150.203.*.*; except one

    hosts allow = 150.203. EXCEPT 150.203.6.66

    Example 2: allow hosts that match the given network/netmask

    hosts allow = 150.203.15.0/255.255.255.0

    Example 3: allow a couple of hosts

    hosts allow = lapland, arvidsjaur

    Example 4: allow only hosts in NIS netgroup "foonet", but + deny access from one particular host

    hosts allow = @foonet

    hosts deny = pirate

    Note

    Note that access still requires suitable user-level passwords.

    See testparm(1) for a way of testing your host access + to see if it does what you expect.

    Default: none (i.e., all hosts permitted access)

    Example: allow hosts = 150.203.5. myhost.mynet.edu.au

    hosts deny (S)

    The opposite of hosts allow - hosts listed here are NOT permitted access to services unless the specific services have their own lists to override - this one. Where the lists conflict, the allow - list takes precedence.

    Default: none (i.e., no hosts specifically excluded)

    Example: hosts deny = 150.203.4. badhost.mynet.edu.au

    hosts equiv (G)

    If this global parameter is a non-null string, + this one. Where the lists conflict, the allow + list takes precedence.

    Default: none (i.e., no hosts specifically excluded)

    Example: hosts deny = 150.203.4. badhost.mynet.edu.au

    hosts equiv (G)

    If this global parameter is a non-null string, it specifies the name of a file to read for the names of hosts and users who will be allowed access without specifying a password.

    This is not be confused with - hosts allow which is about hosts - access to services and is more useful for guest services. + hosts allow which is about hosts + access to services and is more useful for guest services. hosts equiv may be useful for NT clients which will - not supply passwords to Samba.

    Note

    The use of hosts equiv + not supply passwords to Samba.

    Note

    The use of hosts equiv can be a major security hole. This is because you are trusting the PC to supply the correct username. It is very easy to get a PC to supply a false username. I recommend that the - hosts equiv option be only used if you really + hosts equiv option be only used if you really know what you are doing, or perhaps on a home network where you trust your spouse and kids. And only if you really trust - them :-).

    Default: no host equivalences

    Example: hosts equiv = /etc/hosts.equiv

    include (G)

    This allows you to include one config file + them :-).

    Default: no host equivalences

    Example: hosts equiv = /etc/hosts.equiv

    idmap gid (G)

    The idmap gid parameter specifies the range of group ids that are allocated for + the purpose of mapping UNX groups to NT group SIDs. This range of group ids should have no + existing local or NIS groups within it as strange conflicts can occur otherwise.

    The availability of an idmap gid range is essential for correct operation of + all group mapping.

    Default: idmap gid = <empty string>

    Example: idmap gid = 10000-20000

    idmap uid (G)

    The idmap uid parameter specifies the range of user ids that are allocated for use + in mapping UNIX users to NT user SIDs. This range of ids should have no existing local + or NIS users within it as strange conflicts can occur otherwise.

    Default: idmap uid = <empty string>

    Example: idmap uid = 10000-20000

    include (G)

    This allows you to include one config file inside another. The file is included literally, as though typed - in place.

    It takes the standard substitutions, except %u - , %P and %S. -

    Default: no file included

    Example: include = /usr/local/samba/lib/admin_smb.conf

    inherit acls (S)

    This parameter can be used to ensure that if default acls + in place.

    It takes the standard substitutions, except %u + , %P and %S. +

    Default: no file included

    Example: include = /usr/local/samba/lib/admin_smb.conf

    inherit acls (S)

    This parameter can be used to ensure that if default acls exist on parent directories, they are always honored when creating a subdirectory. The default behavior is to use the mode specified when creating the directory. Enabling this option sets the mode to 0777, thus guaranteeing that default directory acls are propagated. -

    Default: inherit acls = no +

    Default: inherit acls = no

    inherit permissions (S)

    The permissions on new files and directories - are normally governed by + are normally governed by create mask, - directory mask, - force create mode - and force + directory mask, + force create mode + and force directory mode but the boolean inherit permissions parameter overrides this.

    New directories inherit the mode of the parent directory, including bits such as setgid.

    New files inherit their read/write bits from the parent directory. Their execute bits continue to be determined by - map archive - , map hidden - and map system + map archive + , map hidden + and map system as usual.

    Note that the setuid bit is never set via inheritance (the code explicitly prohibits this).

    This can be particularly useful on large systems with many users, perhaps several thousand, to allow a single [homes] - share to be used flexibly by each user.

    See also create mask - , + share to be used flexibly by each user.

    See also create mask + , directory mask, - force create mode and - force directory mode - .

    Default: inherit permissions = no

    interfaces (G)

    This option allows you to override the default + force create mode and + force directory mode + .

    Default: inherit permissions = no

    interfaces (G)

    This option allows you to override the default network interfaces list that Samba will use for browsing, name registration and other NBT traffic. By default Samba will query the kernel for the list of all active interfaces and use any @@ -1174,9 +1191,9 @@ df $1 | tail -1 | awk '{print $2" "$4}' as 24 for a C class network) or a full netmask in dotted decimal form.

    The "IP" parameters above can either be a full dotted decimal IP address or a hostname which will be looked up via - the OS's normal hostname resolution mechanisms.

    For example, the following line:

    interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0

    would configure three network interfaces corresponding + the OS's normal hostname resolution mechanisms.

    For example, the following line:

    interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0

    would configure three network interfaces corresponding to the eth0 device and IP addresses 192.168.2.10 and 192.168.3.10. - The netmasks of the latter two interfaces would be set to 255.255.255.0.

    See also bind + The netmasks of the latter two interfaces would be set to 255.255.255.0.

    See also bind interfaces only.

    Default: all active interfaces except 127.0.0.1 that are broadcast capable

    invalid users (S)

    This is a list of users that should not be allowed to login to this service. This is really a paranoid @@ -1188,85 +1205,95 @@ df $1 | tail -1 | awk '{print $2" "$4}' '&' is interpreted only by looking in the NIS netgroup database (this requires NIS to be working on your system). The characters '+' and '&' may be used at the start of the name in either order - so the value +&group means check the + so the value +&group means check the UNIX group database, followed by the NIS netgroup database, and - the value &+group means check the NIS + the value &+group means check the NIS netgroup database, followed by the UNIX group database (the - same as the '@' prefix).

    The current servicename is substituted for %S. - This is useful in the [homes] section.

    See also valid users - .

    Default: no invalid users

    Example: invalid users = root fred admin @wheel

    keepalive (G)

    The value of the parameter (an integer) represents - the number of seconds between keepalive + same as the '@' prefix).

    The current servicename is substituted for %S. + This is useful in the [homes] section.

    See also valid users + .

    Default: no invalid users

    Example: invalid users = root fred admin @wheel

    keepalive (G)

    The value of the parameter (an integer) represents + the number of seconds between keepalive packets. If this parameter is zero, no keepalive packets will be sent. Keepalive packets, if sent, allow the server to tell whether a client is still present and responding.

    Keepalives should, in general, not be needed if the socket being used has the SO_KEEPALIVE attribute set on it (see - socket options). - Basically you should only use this option if you strike difficulties.

    Default: keepalive = 300

    Example: keepalive = 600

    kernel oplocks (G)

    For UNIXes that support kernel based - oplocks + socket options). + Basically you should only use this option if you strike difficulties.

    Default: keepalive = 300

    Example: keepalive = 600

    kernel oplocks (G)

    For UNIXes that support kernel based + oplocks (currently only IRIX and the Linux 2.4 kernel), this parameter - allows the use of them to be turned on or off.

    Kernel oplocks support allows Samba oplocks + allows the use of them to be turned on or off.

    Kernel oplocks support allows Samba oplocks to be broken whenever a local UNIX process or NFS operation - accesses a file that smbd(8) has oplocked. This allows complete + accesses a file that smbd(8) has oplocked. This allows complete data consistency between SMB/CIFS, NFS and local file access (and is - a very cool feature :-).

    This parameter defaults to on, but is translated + a very cool feature :-).

    This parameter defaults to on, but is translated to a no-op on systems that no not have the necessary kernel support. - You should never need to touch this parameter.

    See also the oplocks - and level2 oplocks - parameters.

    Default: kernel oplocks = yes

    lanman auth (G)

    This parameter determines whether or not smbd(8) will attempt to authenticate users + You should never need to touch this parameter.

    See also the oplocks + and level2 oplocks + parameters.

    Default: kernel oplocks = yes

    lanman auth (G)

    This parameter determines whether or not smbd(8) will attempt to authenticate users using the LANMAN password hash. If disabled, only clients which support NT password hashes (e.g. Windows NT/2000 clients, smbclient, etc... but not - Windows 95/98 or the MS DOS network client) will be able to connect to the Samba host.

    Default : lanman auth = yes

    large readwrite (G)

    This parameter determines whether or not - smbd(8) supports the new 64k + Windows 95/98 or the MS DOS network client) will be able to connect to the Samba host.

    The LANMAN encrypted response is easily broken, due to it's + case-insensitive nature, and the choice of algorithm. Servers + without Windows 95/98 or MS DOS clients are advised to disable + this option.

    Unlike the encypt + passwords option, this parameter cannot alter client + behaviour, and the LANMAN response will still be sent over the + network. See the client lanman + auth to disable this for Samba's clients (such as smbclient)

    If this option, and ntlm + auth are both disabled, then only NTLMv2 logins will be + permited. Not all clients support NTLMv2, and most will require + special configuration to us it.

    Default : lanman auth = yes

    large readwrite (G)

    This parameter determines whether or not + smbd(8) supports the new 64k streaming read and write varient SMB requests introduced with Windows 2000. Note that due to Windows 2000 client redirector bugs this requires Samba to be running on a 64-bit capable operating system such as IRIX, Solaris or a Linux 2.4 kernel. Can improve performance by 10% with Windows 2000 clients. Defaults to on. Not as - tested as some other Samba code paths.

    Default: large readwrite = yes

    ldap admin dn (G)

    The ldap admin dn + tested as some other Samba code paths.

    Default: large readwrite = yes

    ldap admin dn (G)

    The ldap admin dn defines the Distinguished Name (DN) name used by Samba to contact the ldap server when retreiving user account - information. The ldap admin + information. The ldap admin dn is used in conjunction with the admin dn password - stored in the private/secrets.tdb file. - See the smbpasswd(8) man page for more + stored in the private/secrets.tdb file. + See the smbpasswd(8) man page for more information on how to accmplish this.

    ldap delete dn (G)

    This parameter specifies whether a delete operation in the ldapsam deletes the complete entry or only the attributes specific to Samba.

    Default: ldap delete dn = no

    ldap filter (G)

    This parameter specifies the RFC 2254 compliant LDAP search filter. - The default is to match the login name with the uid - attribute for all entries matching the sambaAccount + The default is to match the login name with the uid + attribute for all entries matching the sambaAccount objectclass. Note that this filter should only return one entry. -

    Default: ldap filter = (&(uid=%u)(objectclass=sambaAccount))

    ldap machine suffix (G)

    It specifies where machines should be added to the ldap tree.

    Default: none

    ldap passwd sync (G)

    This option is used to define whether +

    Default: ldap filter = (&(uid=%u)(objectclass=sambaAccount))

    ldap machine suffix (G)

    It specifies where machines should be added to the ldap tree.

    Default: none

    ldap passwd sync (G)

    This option is used to define whether or not Samba should sync the LDAP password with the NT and LM hashes for normal accounts (NOT for workstation, server or domain trusts) on a password change via SAMBA. -

    The ldap passwd - sync can be set to one of three values:

    • Yes = Try - to update the LDAP, NT and LM passwords and update the pwdLastSet time.

    • No = Update NT and - LM passwords and update the pwdLastSet time.

    • Only = Only update - the LDAP password and let the LDAP server do the rest.

    Default: ldap passwd sync = no

    ldap port (G)

    This parameter is only available if Samba has been - configure to include the --with-ldapsam option +

    The ldap passwd + sync can be set to one of three values:

    • Yes = Try + to update the LDAP, NT and LM passwords and update the pwdLastSet time.

    • No = Update NT and + LM passwords and update the pwdLastSet time.

    • Only = Only update + the LDAP password and let the LDAP server do the rest.

    Default: ldap passwd sync = no

    ldap port (G)

    This parameter is only available if Samba has been + configure to include the --with-ldapsam option at compile time.

    This option is used to control the tcp port number used to contact - the ldap server. - The default is to use the stand LDAPS port 636.

    See Also: ldap ssl

    Default : ldap port = 636 ; if ldap ssl = on

    Default : ldap port = 389 ; if ldap ssl = off

    ldap server (G)

    This parameter is only available if Samba has been - configure to include the --with-ldapsam + the ldap server. + The default is to use the stand LDAPS port 636.

    See Also: ldap ssl

    Default : ldap port = 636 ; if ldap ssl = on

    Default : ldap port = 389 ; if ldap ssl = off

    ldap server (G)

    This parameter is only available if Samba has been + configure to include the --with-ldapsam option at compile time.

    This parameter should contain the FQDN of the ldap directory server which should be queried to locate user account information. -

    Default : ldap server = localhost

    ldap ssl (G)

    This option is used to define whether or not Samba should +

    Default : ldap server = localhost

    ldap ssl (G)

    This option is used to define whether or not Samba should use SSL when connecting to the ldap server This is NOT related to Samba's previous SSL support which was enabled by specifying the - --with-ssl option to the configure - script.

    The ldap ssl can be set to one of three values:

    • Off = Never - use SSL when querying the directory.

    • Start_tls = Use + --with-ssl option to the configure + script.

      The ldap ssl can be set to one of three values:

      • Off = Never + use SSL when querying the directory.

      • Start_tls = Use the LDAPv3 StartTLS extended operation (RFC2830) for - communicating with the directory server.

      • On = Use SSL - on the ldaps port when contacting the ldap server. Only available when the - backwards-compatiblity --with-ldapsam option is specified - to configure. See passdb backend

      Default : ldap ssl = start_tls

    ldap suffix (G)

    Specifies where user and machine accounts are added to the - tree. Can be overriden by ldap user - suffix and ldap machine + communicating with the directory server.

  • On = Use SSL + on the ldaps port when contacting the ldap server. Only available when the + backwards-compatiblity --with-ldapsam option is specified + to configure. See passdb backend

    • Default : ldap ssl = start_tls

    ldap suffix (G)

    Specifies where user and machine accounts are added to the + tree. Can be overriden by ldap user + suffix and ldap machine suffix. It also used as the base dn for all ldap searches.

    Default: none

    ldap trust ids (G)

    Normally, Samba validates each entry in the LDAP server against getpwnam(). This allows LDAP to be used for Samba with @@ -1276,8 +1303,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' instead to rely on the presence of the appropriate attributes in LDAP directly, which can result in a significant performance boost in some situations. Setting this option to yes effectivly - assumes that the local machine is running nss_ldap against the same LDAP - server.

    Default: ldap trust ids = No

    ldap user suffix (G)

    It specifies where users are added to the tree.

    Default: none

    level2 oplocks (S)

    This parameter controls whether Samba supports + assumes that the local machine is running nss_ldap against the same LDAP + server.

    Default: ldap trust ids = No

    ldap user suffix (G)

    It specifies where users are added to the tree.

    Default: none

    level2 oplocks (S)

    This parameter controls whether Samba supports level2 (read-only) oplocks on a share.

    Level2, or read-only oplocks allow Windows NT clients that have an oplock on a file to downgrade from a read-write oplock to a read-only oplock once a second client opens the file (instead @@ -1290,58 +1317,58 @@ df $1 | tail -1 | awk '{print $2" "$4}' writes to the file all clients are notified (no reply is needed or waited for) and told to break their oplocks to "none" and delete any read-ahead caches.

    It is recommended that this parameter be turned on to - speed access to shared executables.

    For more discussions on level2 oplocks see the CIFS spec.

    Currently, if kernel + speed access to shared executables.

    For more discussions on level2 oplocks see the CIFS spec.

    Currently, if kernel oplocks are supported then level2 oplocks are - not granted (even if this parameter is set to yes). - Note also, the oplocks - parameter must be set to yes on this share in order for - this parameter to have any effect.

    See also the oplocks - and kernel oplocks - parameters.

    Default: level2 oplocks = yes

    lm announce (G)

    This parameter determines if nmbd(8) will produce Lanman announce + not granted (even if this parameter is set to yes). + Note also, the oplocks + parameter must be set to yes on this share in order for + this parameter to have any effect.

    See also the oplocks + and kernel oplocks + parameters.

    Default: level2 oplocks = yes

    lm announce (G)

    This parameter determines if nmbd(8) will produce Lanman announce broadcasts that are needed by OS/2 clients in order for them to see the Samba server in their browse list. This parameter can have three - values, yes, no, or - auto. The default is auto. - If set to no Samba will never produce these - broadcasts. If set to yes Samba will produce + values, yes, no, or + auto. The default is auto. + If set to no Samba will never produce these + broadcasts. If set to yes Samba will produce Lanman announce broadcasts at a frequency set by the parameter - lm interval. If set to auto + lm interval. If set to auto Samba will not send Lanman announce broadcasts by default but will listen for them. If it hears such a broadcast on the wire it will then start sending them at a frequency set by the parameter - lm interval.

    See also lm interval.

    Default: lm announce = auto

    Example: lm announce = yes

    lm interval (G)

    If Samba is set to produce Lanman announce + lm interval.

    See also lm interval.

    Default: lm announce = auto

    Example: lm announce = yes

    lm interval (G)

    If Samba is set to produce Lanman announce broadcasts needed by OS/2 clients (see the - lm announce parameter) then this + lm announce parameter) then this parameter defines the frequency in seconds with which they will be made. If this is set to zero then no Lanman announcements will be - made despite the setting of the lm announce - parameter.

    See also lm announce.

    Default: lm interval = 60

    Example: lm interval = 120

    load printers (G)

    A boolean variable that controls whether all + made despite the setting of the lm announce + parameter.

    See also lm announce.

    Default: lm interval = 60

    Example: lm interval = 120

    load printers (G)

    A boolean variable that controls whether all printers in the printcap will be loaded for browsing by default. See the printers section for - more details.

    Default: load printers = yes

    local master (G)

    This option allows nmbd(8) to try and become a local master browser - on a subnet. If set to no then + more details.

    Default: load printers = yes

    local master (G)

    This option allows nmbd(8) to try and become a local master browser + on a subnet. If set to no then nmbd will not attempt to become a local master browser on a subnet and will also lose in all browsing elections. By - default this value is set to yes. Setting this value to - yes doesn't mean that Samba will become the - local master browser on a subnet, just that nmbd - will participate in elections for local master browser.

    Setting this value to no will cause nmbd never to become a local - master browser.

    Default: local master = yes

    lock directory (G)

    This option specifies the directory where lock - files will be placed. The lock files are used to implement the - max connections - option.

    Default: lock directory = ${prefix}/var/locks

    Example: lock directory = /var/run/samba/locks

    lock dir (G)

    Synonym for + default this value is set to yes. Setting this value to + yes doesn't mean that Samba will become the + local master browser on a subnet, just that nmbd + will participate in elections for local master browser.

    Setting this value to no will cause nmbd never to become a local + master browser.

    Default: local master = yes

    lock dir (G)

    Synonym for lock directory. -

    locking (S)

    This controls whether or not locking will be +

    lock directory (G)

    This option specifies the directory where lock + files will be placed. The lock files are used to implement the + max connections + option.

    Default: lock directory = ${prefix}/var/locks

    Example: lock directory = /var/run/samba/locks

    locking (S)

    This controls whether or not locking will be performed by the server in response to lock requests from the - client.

    If locking = no, all lock and unlock + client.

    If locking = no, all lock and unlock requests will appear to succeed and all lock queries will report - that the file in question is available for locking.

    If locking = yes, real locking will be performed + that the file in question is available for locking.

    If locking = yes, real locking will be performed by the server.

    This option may be useful for read-only filesystems which may not need locking (such as - CDROM drives), although setting this parameter of no + CDROM drives), although setting this parameter of no is not really recommended even in this case.

    Be careful about disabling locking either globally or in a specific service, as lack of locking may result in data corruption. - You should never need to set this parameter.

    Default: locking = yes

    lock spin count (G)

    This parameter controls the number of times + You should never need to set this parameter.

    Default: locking = yes

    lock spin count (G)

    This parameter controls the number of times that smbd should attempt to gain a byte range lock on the behalf of a client request. Experiments have shown that Windows 2k servers do not reply with a failure if the lock @@ -1349,47 +1376,47 @@ df $1 | tail -1 | awk '{print $2" "$4}' in case the lock could later be aquired. This behavior is used to support PC database formats such as MS Access and FoxPro. -

    Default: lock spin count = 2

    lock spin time (G)

    The time in microseconds that smbd should +

    Default: lock spin count = 2

    lock spin time (G)

    The time in microseconds that smbd should pause before attempting to gain a failed lock. See - lock spin - count for more details.

    Default: lock spin time = 10

    log file (G)

    This option allows you to override the name + lock spin + count for more details.

    Default: lock spin time = 10

    log file (G)

    This option allows you to override the name of the Samba log file (also known as the debug file).

    This option takes the standard substitutions, allowing - you to have separate log files for each user or machine.

    Example: log file = /usr/local/samba/var/log.%m

    log level (G)

    The value of the parameter (a astring) allows + you to have separate log files for each user or machine.

    Example: log file = /usr/local/samba/var/log.%m

    log level (G)

    The value of the parameter (a astring) allows the debug level (logging level) to be specified in the - smb.conf file. This parameter has been + smb.conf file. This parameter has been extended since the 2.2.x series, now it allow to specify the debug level for multiple debug classes. This is to give greater flexibility in the configuration of the system.

    The default will be the log level specified on - the command line or level zero if none was specified.

    Example: log level = 3 passdb:5 auth:10 winbind:2

    logon drive (G)

    This parameter specifies the local path to + the command line or level zero if none was specified.

    Example: log level = 3 passdb:5 auth:10 winbind:2

    logon drive (G)

    This parameter specifies the local path to which the home directory will be connected (see - logon home) + logon home) and is only used by NT Workstations.

    Note that this option is only useful if Samba is set up as a - logon server.

    Default: logon drive = z:

    Example: logon drive = h:

    logon home (G)

    This parameter specifies the home directory + logon server.

    Default: logon drive = z:

    Example: logon drive = h:

    logon home (G)

    This parameter specifies the home directory location when a Win95/98 or NT Workstation logs into a Samba PDC. - It allows you to do

    C:\> - NET USE H: /HOME + It allows you to do

    C:\> + NET USE H: /HOME

    from a command prompt, for example.

    This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine.

    This parameter can be used with Win9X workstations to ensure that roaming profiles are stored in a subdirectory of the user's - home directory. This is done in the following way:

    logon home = \\%N\%U\profile

    This tells Samba to return the above string, with + home directory. This is done in the following way:

    logon home = \\%N\%U\profile

    This tells Samba to return the above string, with substitutions made when a client requests the info, generally in a NetUserGetInfo request. Win9X clients truncate the info to - \\server\share when a user does net use /home + \\server\share when a user does net use /home but use the whole string when dealing with profiles.

    Note that in prior versions of Samba, the - logon path was returned rather than - logon home. This broke net use /home but allowed profiles outside the home directory. + logon path was returned rather than + logon home. This broke net use /home but allowed profiles outside the home directory. The current implementation is correct, and can be used for profiles if you use the above trick.

    This option is only useful if Samba is set up as a logon - server.

    Default: logon home = "\\%N\%U"

    Example: logon home = "\\remote_smb_server\%U"

    logon path (G)

    This parameter specifies the home directory + server.

    Default: logon home = "\\%N\%U"

    Example: logon home = "\\remote_smb_server\%U"

    logon path (G)

    This parameter specifies the home directory where roaming profiles (NTuser.dat etc files for Windows NT) are stored. Contrary to previous versions of these manual pages, it has nothing to do with Win 9X roaming profiles. To find out how to handle roaming profiles for Win 9X system, see the - logon home parameter.

    This option takes the standard substitutions, allowing you + logon home parameter.

    This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine. It also specifies the directory from which the "Application Data", - (desktop, start menu, - network neighborhood, programs + (desktop, start menu, + network neighborhood, programs and other folders, and their contents, are loaded and displayed on your Windows NT client.

    The share and the path must be readable by the user for the preferences and directories to be loaded onto the Windows NT @@ -1405,126 +1432,126 @@ df $1 | tail -1 | awk '{print $2" "$4}' reference to the homes share (i.e. setting this parameter to \%N\%U\profile_path will cause problems).

    This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine.

    Note that this option is only useful if Samba is set up - as a logon server.

    Default: logon path = \\%N\%U\profile

    Example: logon path = \\PROFILESERVER\PROFILE\%U

    logon script (G)

    This parameter specifies the batch file (.bat) or + as a logon server.

    Default: logon path = \\%N\%U\profile

    Example: logon path = \\PROFILESERVER\PROFILE\%U

    logon script (G)

    This parameter specifies the batch file (.bat) or NT command file (.cmd) to be downloaded and run on a machine when a user successfully logs in. The file must contain the DOS style CR/LF line endings. Using a DOS-style editor to create the file is recommended.

    The script must be a relative path to the [netlogon] service. If the [netlogon] service specifies a - path of /usr/local/samba/netlogon, and logon script = STARTUP.BAT, then - the file that will be downloaded is:

    /usr/local/samba/netlogon/STARTUP.BAT

    The contents of the batch file are entirely your choice. A - suggested command would be to add NET TIME \\SERVER /SET + path of /usr/local/samba/netlogon, and logon script = STARTUP.BAT, then + the file that will be downloaded is:

    /usr/local/samba/netlogon/STARTUP.BAT

    The contents of the batch file are entirely your choice. A + suggested command would be to add NET TIME \\SERVER /SET /YES, to force every machine to synchronize clocks with - the same time server. Another use would be to add NET USE - U: \\SERVER\UTILS for commonly used utilities, or + the same time server. Another use would be to add NET USE + U: \\SERVER\UTILS for commonly used utilities, or NET USE Q: \\SERVER\ISO9001_QA for example.

    Note that it is particularly important not to allow write access to the [netlogon] share, or to grant users write permission on the batch files in a secure environment, as this would allow the batch files to be arbitrarily modified and security to be breached.

    This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine.

    This option is only useful if Samba is set up as a logon - server.

    Default: no logon script defined

    Example: logon script = scripts\%U.bat

    lppause command (S)

    This parameter specifies the command to be + server.

    Default: no logon script defined

    Example: logon script = scripts\%U.bat

    lppause command (S)

    This parameter specifies the command to be executed on the server host in order to stop printing or spooling a specific print job.

    This command should be a program or script which takes a printer name and job number to pause the print job. One way of implementing this is by using job priorities, where jobs - having a too low priority won't be sent to the printer.

    If a %p is given then the printer name - is put in its place. A %j is replaced with - the job number (an integer). On HPUX (see printing=hpux - ), if the -p%p option is added + having a too low priority won't be sent to the printer.

    If a %p is given then the printer name + is put in its place. A %j is replaced with + the job number (an integer). On HPUX (see printing=hpux + ), if the -p%p option is added to the lpq command, the job will show up with the correct status, i.e. if the job priority is lower than the set fence priority it will have the PAUSED status, whereas if the priority is equal or higher it will have the SPOOLED or PRINTING status.

    Note that it is good practice to include the absolute path - in the lppause command as the PATH may not be available to the server.

    See also the printing + in the lppause command as the PATH may not be available to the server.

    See also the printing parameter.

    Default: Currently no default value is given to - this string, unless the value of the printing - parameter is SYSV, in which case the default is :

    lp -i %p-%j -H hold

    or if the value of the printing parameter - is SOFTQ, then the default is:

    qstat -s -j%j -h

    Example for HPUX: lppause command = /usr/bin/lpalt %p-%j -p0

    lpq cache time (G)

    This controls how long lpq info will be cached - for to prevent the lpq command being called too - often. A separate cache is kept for each variation of the + this string, unless the value of the printing + parameter is SYSV, in which case the default is :

    lp -i %p-%j -H hold

    or if the value of the printing parameter + is SOFTQ, then the default is:

    qstat -s -j%j -h

    Example for HPUX: lppause command = /usr/bin/lpalt %p-%j -p0

    lpq cache time (G)

    This controls how long lpq info will be cached + for to prevent the lpq command being called too + often. A separate cache is kept for each variation of the lpq command used by the system, so if you use different - lpq commands for different users then they won't - share cache information.

    The cache files are stored in /tmp/lpq.xxxx - where xxxx is a hash of the lpq command in use.

    The default is 10 seconds, meaning that the cached results - of a previous identical lpq command will be used + lpq commands for different users then they won't + share cache information.

    The cache files are stored in /tmp/lpq.xxxx + where xxxx is a hash of the lpq command in use.

    The default is 10 seconds, meaning that the cached results + of a previous identical lpq command will be used if the cached data is less than 10 seconds old. A large value may - be advisable if your lpq command is very slow.

    A value of 0 will disable caching completely.

    See also the printing parameter.

    Default: lpq cache time = 10

    Example: lpq cache time = 30

    lpq command (S)

    This parameter specifies the command to be - executed on the server host in order to obtain lpq + be advisable if your lpq command is very slow.

    A value of 0 will disable caching completely.

    See also the printing parameter.

    Default: lpq cache time = 10

    Example: lpq cache time = 30

    lpq command (S)

    This parameter specifies the command to be + executed on the server host in order to obtain lpq -style printer status information.

    This command should be a program or script which takes a printer name as its only parameter and outputs printer status information.

    Currently nine styles of printer status information are supported; BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX, CUPS, and SOFTQ. This covers most UNIX systems. You control which type is expected - using the printing = option.

    Some clients (notably Windows for Workgroups) may not + using the printing = option.

    Some clients (notably Windows for Workgroups) may not correctly send the connection number for the printer they are requesting status information about. To get around this, the server reports on the first printer service connected to by the - client. This only happens if the connection number sent is invalid.

    If a %p is given then the printer name + client. This only happens if the connection number sent is invalid.

    If a %p is given then the printer name is put in its place. Otherwise it is placed at the end of the command.

    Note that it is good practice to include the absolute path - in the lpq command as the $PATH + in the lpq command as the $PATH may not be available to the server. When compiled with - the CUPS libraries, no lpq command is + the CUPS libraries, no lpq command is needed because smbd will make a library call to obtain the - print queue listing.

    See also the printing - parameter.

    Default: depends on the setting of - printing

    Example: lpq command = /usr/bin/lpq -P%p

    lpresume command (S)

    This parameter specifies the command to be + print queue listing.

    See also the printing + parameter.

    Default: depends on the setting of + printing

    Example: lpq command = /usr/bin/lpq -P%p

    lpresume command (S)

    This parameter specifies the command to be executed on the server host in order to restart or continue printing or spooling a specific print job.

    This command should be a program or script which takes a printer name and job number to resume the print job. See - also the lppause command - parameter.

    If a %p is given then the printer name - is put in its place. A %j is replaced with + also the lppause command + parameter.

    If a %p is given then the printer name + is put in its place. A %j is replaced with the job number (an integer).

    Note that it is good practice to include the absolute path - in the lpresume command as the PATH may not - be available to the server.

    See also the printing + in the lpresume command as the PATH may not + be available to the server.

    See also the printing parameter.

    Default: Currently no default value is given - to this string, unless the value of the printing - parameter is SYSV, in which case the default is :

    lp -i %p-%j -H resume

    or if the value of the printing parameter - is SOFTQ, then the default is:

    qstat -s -j%j -r

    Example for HPUX: lpresume command = /usr/bin/lpalt %p-%j -p2

    lprm command (S)

    This parameter specifies the command to be + to this string, unless the value of the printing + parameter is SYSV, in which case the default is :

    lp -i %p-%j -H resume

    or if the value of the printing parameter + is SOFTQ, then the default is:

    qstat -s -j%j -r

    Example for HPUX: lpresume command = /usr/bin/lpalt %p-%j -p2

    lprm command (S)

    This parameter specifies the command to be executed on the server host in order to delete a print job.

    This command should be a program or script which takes - a printer name and job number, and deletes the print job.

    If a %p is given then the printer name - is put in its place. A %j is replaced with + a printer name and job number, and deletes the print job.

    If a %p is given then the printer name + is put in its place. A %j is replaced with the job number (an integer).

    Note that it is good practice to include the absolute - path in the lprm command as the PATH may not be - available to the server.

    See also the printing - parameter.

    Default: depends on the setting of printing -

    Example 1: lprm command = /usr/bin/lprm -P%p %j

    Example 2: lprm command = /usr/bin/cancel %p-%j

    machine password timeout (G)

    If a Samba server is a member of a Windows + path in the lprm command as the PATH may not be + available to the server.

    See also the printing + parameter.

    Default: depends on the setting of printing +

    Example 1: lprm command = /usr/bin/lprm -P%p %j

    Example 2: lprm command = /usr/bin/cancel %p-%j

    machine password timeout (G)

    If a Samba server is a member of a Windows NT Domain (see the security = domain) parameter) then periodically a running smbd(8) process will try and change the MACHINE ACCOUNT - PASSWORD stored in the TDB called private/secrets.tdb + PASSWORD stored in the TDB called private/secrets.tdb . This parameter specifies how often this password will be changed, in seconds. The default is one week (expressed in - seconds), the same as a Windows NT Domain member server.

    See also smbpasswd(8), and the - security = domain) parameter.

    Default: machine password timeout = 604800

    magic output (S)

    This parameter specifies the name of a file + seconds), the same as a Windows NT Domain member server.

    See also smbpasswd(8), and the + security = domain) parameter.

    Default: machine password timeout = 604800

    magic output (S)

    This parameter specifies the name of a file which will contain output created by a magic script (see the - magic script - parameter below).

    Warning: If two clients use the same magic script + magic script + parameter below).

    Warning: If two clients use the same magic script in the same directory the output file content - is undefined.

    Default: magic output = <magic script name>.out

    Example: magic output = myfile.txt

    magic script (S)

    This parameter specifies the name of a file which, + is undefined.

    Default: magic output = <magic script name>.out

    Example: magic output = myfile.txt

    magic script (S)

    This parameter specifies the name of a file which, if opened, will be executed by the server when the file is closed. This allows a UNIX script to be sent to the Samba host and executed on behalf of the connected user.

    Scripts executed in this way will be deleted upon completion assuming that the user has the appropriate level of privilege and the file permissions allow the deletion.

    If the script generates output, output will be sent to - the file specified by the + the file specified by the magic output parameter (see above).

    Note that some shells are unable to interpret scripts containing CR/LF instead of CR as the end-of-line marker. Magic scripts must be executable as is on the host, which for some hosts and some shells will require filtering at the DOS end.

    Magic scripts are EXPERIMENTAL and - should NOT be relied upon.

    Default: None. Magic scripts disabled.

    Example: magic script = user.csh

    mangle case (S)

    See the section on NAME MANGLING

    Default: mangle case = no

    mangled map (S)

    This is for those who want to directly map UNIX + should NOT be relied upon.

    Default: None. Magic scripts disabled.

    Example: magic script = user.csh

    mangle case (S)

    See the section on NAME MANGLING

    Default: mangle case = no

    mangled map (S)

    This is for those who want to directly map UNIX file names which cannot be represented on Windows/DOS. The mangling of names is not always what is needed. In particular you may have documents with file extensions that differ between DOS and UNIX. - For example, under UNIX it is common to use .html - for HTML files, whereas under Windows/DOS .htm - is more commonly used.

    So to map html to htm - you would use:

    mangled map = (*.html *.htm)

    One very useful case is to remove the annoying ;1 + For example, under UNIX it is common to use .html + for HTML files, whereas under Windows/DOS .htm + is more commonly used.

    So to map html to htm + you would use:

    mangled map = (*.html *.htm)

    One very useful case is to remove the annoying ;1 off the ends of filenames on some CDROMs (only visible - under some UNIXes). To do this use a map of (*;1 *;).

    Default: no mangled map

    Example: mangled map = (*;1 *;)

    mangled names (S)

    This controls whether non-DOS names under UNIX + under some UNIXes). To do this use a map of (*;1 *;).

    Default: no mangled map

    Example: mangled map = (*;1 *;)

    mangled names (S)

    This controls whether non-DOS names under UNIX should be mapped to DOS-compatible names ("mangled") and made visible, or whether non-DOS names should simply be ignored.

    See the section on NAME MANGLING for details on how to control the mangling process.

    If mangling is used then the mangling algorithm is as follows:

    • The first (up to) five alphanumeric characters @@ -1536,7 +1563,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' extension). The final extension is included in the hash calculation only if it contains any upper case characters or is longer than three characters.

      Note that the character to use may be specified using - the mangling char + the mangling char option, if you don't like '~'.

    • The first three alphanumeric characters of the final extension are preserved, forced to upper case and appear as the extension of the mangled name. The final extension is defined as that @@ -1552,56 +1579,62 @@ df $1 | tail -1 | awk '{print $2" "$4}' copied between UNIX directories from Windows/DOS while retaining the long UNIX filename. UNIX files can be renamed to a new extension from Windows/DOS and will retain the same basename. Mangled names - do not change between sessions.

      Default: mangled names = yes

    mangling stack (G)

    This parameter controls the number of mangled names - that should be cached in the Samba server smbd(8).

    This stack is a list of recently mangled base names + do not change between sessions.

    Default: mangled names = yes

    mangling stack (G)

    This parameter controls the number of mangled names + that should be cached in the Samba server smbd(8).

    This stack is a list of recently mangled base names (extensions are only maintained if they are longer than 3 characters or contains upper case characters).

    The larger this value, the more likely it is that mangled names can be successfully converted to correct long UNIX names. However, large stack sizes will slow most directory accesses. Smaller stacks save memory in the server (each stack element costs 256 bytes).

    It is not possible to absolutely guarantee correct long - filenames, so be prepared for some surprises!

    Default: mangled stack = 50

    Example: mangled stack = 100

    mangling prefix (G)

    controls the number of prefix + filenames, so be prepared for some surprises!

    Default: mangled stack = 50

    Example: mangled stack = 100

    mangling prefix (G)

    controls the number of prefix characters from the original name used when generating the mangled names. A larger value will give a weaker hash and therefore more name collisions. The minimum - value is 1 and the maximum value is 6.

    Default: mangle prefix = 1

    Example: mangle prefix = 4

    mangling char (S)

    This controls what character is used as + value is 1 and the maximum value is 6.

    Default: mangle prefix = 1

    Example: mangle prefix = 4

    mangling char (S)

    This controls what character is used as the magic character in name mangling. The default is a '~' but this may interfere with some software. Use this option to set - it to whatever you prefer.

    Default: mangling char = ~

    Example: mangling char = ^

    mangling method (G)

    controls the algorithm used for the generating + it to whatever you prefer.

    Default: mangling char = ~

    Example: mangling char = ^

    mangling method (G)

    controls the algorithm used for the generating the mangled names. Can take two different values, "hash" and "hash2". "hash" is the default and is the algorithm that has been used in Samba for many years. "hash2" is a newer and considered a better algorithm (generates less collisions) in the names. However, many Win32 applications store the mangled names and so changing to the new algorithm must not be done - lightly as these applications may break unless reinstalled.

    Default: mangling method = hash2

    Example: mangling method = hash

    map archive (S)

    This controls whether the DOS archive attribute + lightly as these applications may break unless reinstalled.

    Default: mangling method = hash2

    Example: mangling method = hash

    map acl inherit (S)

    This boolean parameter controls whether smbd(8) will attempt to map the 'inherit' and 'protected' + access control entry flags stored in Windows ACLs into an extended attribute + called user.SAMBA_PAI. This parameter only takes effect if Samba is being run + on a platform that supports extended attributes (Linux and IRIX so far) and + allows the Windows 2000 ACL editor to correctly use inheritance with the Samba + POSIX ACL mapping code. +

    Default: map acl inherit = no

    map archive (S)

    This controls whether the DOS archive attribute should be mapped to the UNIX owner execute bit. The DOS archive bit is set when a file has been modified since its last backup. One motivation for this option it to keep Samba/your PC from making any file it touches from becoming executable under UNIX. This can - be quite annoying for shared source code, documents, etc...

    Note that this requires the create mask + be quite annoying for shared source code, documents, etc...

    Note that this requires the create mask parameter to be set such that owner execute bit is not masked out (i.e. it must include 100). See the parameter - create mask for details.

    Default: map archive = yes

    map hidden (S)

    This controls whether DOS style hidden files - should be mapped to the UNIX world execute bit.

    Note that this requires the create mask + create mask for details.

    Default: map archive = yes

    map hidden (S)

    This controls whether DOS style hidden files + should be mapped to the UNIX world execute bit.

    Note that this requires the create mask to be set such that the world execute bit is not masked out (i.e. it must include 001). See the parameter - create mask for details.

    Default: map hidden = no

    map system (S)

    This controls whether DOS style system files - should be mapped to the UNIX group execute bit.

    Note that this requires the create mask + create mask for details.

    Default: map hidden = no

    map system (S)

    This controls whether DOS style system files + should be mapped to the UNIX group execute bit.

    Note that this requires the create mask to be set such that the group execute bit is not masked out (i.e. it must include 010). See the parameter - create mask for details.

    Default: map system = no

    map to guest (G)

    This parameter is only useful in - security modes other than security = share - - i.e. user, server, - and domain.

    This parameter can take three different values, which tell - smbd(8) what to do with user - login requests that don't match a valid UNIX user in some way.

    The three settings are :

    • Never - Means user login + create mask for details.

      Default: map system = no

    map to guest (G)

    This parameter is only useful in + security modes other than security = share + - i.e. user, server, + and domain.

    This parameter can take three different values, which tell + smbd(8) what to do with user + login requests that don't match a valid UNIX user in some way.

    The three settings are :

    • Never - Means user login requests with an invalid password are rejected. This is the - default.

    • Bad User - Means user + default.

    • Bad User - Means user logins with an invalid password are rejected, unless the username does not exist, in which case it is treated as a guest login and - mapped into the - guest account.

    • Bad Password - Means user logins + mapped into the + guest account.

    • Bad Password - Means user logins with an invalid password are treated as a guest login and mapped into the guest account. Note that this can cause problems as it means that any user incorrectly typing @@ -1609,175 +1642,188 @@ df $1 | tail -1 | awk '{print $2" "$4}' will not know the reason they cannot access files they think they should - there will have been no message given to them that they got their password wrong. Helpdesk services will - hate you if you set the map to + hate you if you set the map to guest parameter this way :-).

    Note that this parameter is needed to set up "Guest" - share services when using security modes other than + share services when using security modes other than share. This is because in these modes the name of the resource being requested is not sent to the server until after the server has successfully authenticated the client so the server cannot make authentication decisions at the correct time (connection to the share) for "Guest" shares.

    For people familiar with the older Samba releases, this - parameter maps to the old compile-time setting of the - GUEST_SESSSETUP value in local.h.

    Default: map to guest = Never

    Example: map to guest = Bad User

    max connections (S)

    This option allows the number of simultaneous connections to a service to be limited. - If max connections is greater than 0 then connections + parameter maps to the old compile-time setting of the + GUEST_SESSSETUP value in local.h.

    Default: map to guest = Never

    Example: map to guest = Bad User

    max connections (S)

    This option allows the number of simultaneous connections to a service to be limited. + If max connections is greater than 0 then connections will be refused if this number of connections to the service are already open. A value of zero mean an unlimited number of connections may be made.

    Record lock files are used to implement this feature. The lock files will be stored in the directory specified by the - lock directory option.

    Default: max connections = 0

    Example: max connections = 10

    max disk size (G)

    This option allows you to put an upper limit + lock directory option.

    Default: max connections = 0

    Example: max connections = 10

    max disk size (G)

    This option allows you to put an upper limit on the apparent size of disks. If you set this option to 100 then all shares will appear to be not larger than 100 MB in size.

    Note that this option does not limit the amount of data you can put on the disk. In the above case you could still store much more than 100 MB on the disk, but if a client ever asks for the amount of free disk space or the total disk size then the - result will be bounded by the amount specified in max + result will be bounded by the amount specified in max disk size.

    This option is primarily useful to work around bugs in some pieces of software that can't handle very large disks, - particularly disks over 1GB in size.

    A max disk size of 0 means no limit.

    Default: max disk size = 0

    Example: max disk size = 1000

    max log size (G)

    This option (an integer in kilobytes) specifies + particularly disks over 1GB in size.

    A max disk size of 0 means no limit.

    Default: max disk size = 0

    Example: max disk size = 1000

    max log size (G)

    This option (an integer in kilobytes) specifies the max size the log file should grow to. Samba periodically checks the size and if it is exceeded it will rename the file, adding - a .old extension.

    A size of 0 means no limit.

    Default: max log size = 5000

    Example: max log size = 1000

    max mux (G)

    This option controls the maximum number of + a .old extension.

    A size of 0 means no limit.

    Default: max log size = 5000

    Example: max log size = 1000

    max mux (G)

    This option controls the maximum number of outstanding simultaneous SMB operations that Samba tells the client - it will allow. You should never need to set this parameter.

    Default: max mux = 50

    max open files (G)

    This parameter limits the maximum number of - open files that one smbd(8) file + it will allow. You should never need to set this parameter.

    Default: max mux = 50

    max open files (G)

    This parameter limits the maximum number of + open files that one smbd(8) file serving process may have open for a client at any one time. The default for this parameter is set very high (10,000) as Samba uses only one bit per unopened file.

    The limit of the number of open files is usually set by the UNIX per-process file descriptor limit rather than - this parameter so you should never need to touch this parameter.

    Default: max open files = 10000

    max print jobs (S)

    This parameter limits the maximum number of + this parameter so you should never need to touch this parameter.

    Default: max open files = 10000

    max print jobs (S)

    This parameter limits the maximum number of jobs allowable in a Samba printer queue at any given moment. - If this number is exceeded, smbd(8) will remote "Out of Space" to the client. - See all total + If this number is exceeded, smbd(8) will remote "Out of Space" to the client. + See all total print jobs. -

    Default: max print jobs = 1000

    Example: max print jobs = 5000

    max protocol (G)

    The value of the parameter (a string) is the highest - protocol level that will be supported by the server.

    Possible values are :

    • CORE: Earliest version. No - concept of user names.

    • COREPLUS: Slight improvements on - CORE for efficiency.

    • LANMAN1: First +

      Default: max print jobs = 1000

      Example: max print jobs = 5000

    max protocol (G)

    The value of the parameter (a string) is the highest + protocol level that will be supported by the server.

    Possible values are :

    • CORE: Earliest version. No + concept of user names.

    • COREPLUS: Slight improvements on + CORE for efficiency.

    • LANMAN1: First modern version of the protocol. Long filename - support.

    • LANMAN2: Updates to Lanman1 protocol.

    • NT1: Current up to date version of the protocol. + support.

    • LANMAN2: Updates to Lanman1 protocol.

    • NT1: Current up to date version of the protocol. Used by Windows NT. Known as CIFS.

    Normally this option should not be set as the automatic negotiation phase in the SMB protocol takes care of choosing - the appropriate protocol.

    See also min - protocol

    Default: max protocol = NT1

    Example: max protocol = LANMAN1

    max smbd processes (G)

    This parameter limits the maximum number of smbd(8) processes concurrently running on a system and is intended + the appropriate protocol.

    See also min + protocol

    Default: max protocol = NT1

    Example: max protocol = LANMAN1

    max reported print jobs (S)

    This parameter limits the maximum number of + jobs displayed in a port monitor for Samba printer queue at any given + moment. If this number is exceeded, the excess jobs will not be shown. + A value of zero means there is no limit on the number of print + jobs reported. + + See all total + print jobs and max print + jobs parameters. +

    Default: max reported print jobs = 0

    Example: max reported print jobs = 1000

    max smbd processes (G)

    This parameter limits the maximum number of smbd(8) processes concurrently running on a system and is intended as a stopgap to prevent degrading service to clients in the event that the server has insufficient resources to handle more than this number of connections. Remember that under normal operating - conditions, each user will have an smbd(8) associated with him or her to handle connections to all - shares from a given host.

    Default: max smbd processes = 0 ## no limit

    Example: max smbd processes = 1000

    max ttl (G)

    This option tells nmbd(8) what the default 'time to live' - of NetBIOS names should be (in seconds) when nmbd is + conditions, each user will have an smbd(8) associated with him or her to handle connections to all + shares from a given host.

    Default: max smbd processes = 0 ## no limit

    Example: max smbd processes = 1000

    max ttl (G)

    This option tells nmbd(8) what the default 'time to live' + of NetBIOS names should be (in seconds) when nmbd is requesting a name using either a broadcast packet or from a WINS server. You should - never need to change this parameter. The default is 3 days.

    Default: max ttl = 259200

    max wins ttl (G)

    This option tells smbd(8) when acting as a WINS server ( - wins support = yes) what the maximum - 'time to live' of NetBIOS names that nmbd + never need to change this parameter. The default is 3 days.

    Default: max ttl = 259200

    max wins ttl (G)

    This option tells smbd(8) when acting as a WINS server ( + wins support = yes) what the maximum + 'time to live' of NetBIOS names that nmbd will grant will be (in seconds). You should never need to change this - parameter. The default is 6 days (518400 seconds).

    See also the min - wins ttl parameter.

    Default: max wins ttl = 518400

    max xmit (G)

    This option controls the maximum packet size + parameter. The default is 6 days (518400 seconds).

    See also the min + wins ttl parameter.

    Default: max wins ttl = 518400

    max xmit (G)

    This option controls the maximum packet size that will be negotiated by Samba. The default is 65535, which is the maximum. In some cases you may find you get better performance with a smaller value. A value below 2048 is likely to cause problems. -

    Default: max xmit = 65535

    Example: max xmit = 8192

    message command (G)

    This specifies what command to run when the +

    Default: max xmit = 65535

    Example: max xmit = 8192

    message command (G)

    This specifies what command to run when the server receives a WinPopup style message.

    This would normally be a command that would deliver the message somehow. How this is to be done is - up to your imagination.

    An example is:

    message command = csh -c 'xedit %s;rm %s' & -

    This delivers the message using xedit, then + up to your imagination.

    An example is:

    message command = csh -c 'xedit %s;rm %s' & +

    This delivers the message using xedit, then removes it afterwards. NOTE THAT IT IS VERY IMPORTANT THAT THIS COMMAND RETURN IMMEDIATELY. That's why I have the '&' on the end. If it doesn't return immediately then your PCs may freeze when sending messages (they should recover after 30 seconds, hopefully).

    All messages are delivered as the global guest user. - The command takes the standard substitutions, although - %u won't work (%U may be better + The command takes the standard substitutions, although + %u won't work (%U may be better in this case).

    Apart from the standard substitutions, some additional - ones apply. In particular:

    • %s = the filename containing - the message.

    • %t = the destination that - the message was sent to (probably the server name).

    • %f = who the message + ones apply. In particular:

      • %s = the filename containing + the message.

      • %t = the destination that + the message was sent to (probably the server name).

      • %f = who the message is from.

      You could make this command send mail, or whatever else takes your fancy. Please let us know of any really interesting - ideas you have.

      Here's a way of sending the messages as mail to root:

      message command = /bin/mail -s 'message from %f on + ideas you have.

      Here's a way of sending the messages as mail to root:

      message command = /bin/mail -s 'message from %f on %m' root < %s; rm %s

      If you don't have a message command then the message won't be delivered and Samba will tell the sender there was an error. Unfortunately WfWg totally ignores the error code and carries on regardless, saying that the message was delivered. -

      If you want to silently delete it then try:

      message command = rm %s

      Default: no message command

      Example: message command = csh -c 'xedit %s; rm %s' &

    min passwd length (G)

    Synonym for - min password length. +

    If you want to silently delete it then try:

    message command = rm %s

    Default: no message command

    Example: message command = csh -c 'xedit %s; rm %s' &

    min passwd length (G)

    Synonym for + min password length.

    min password length (G)

    This option sets the minimum length in characters of a - plaintext password that smbd will - accept when performing UNIX password changing.

    See also unix + plaintext password that smbd will + accept when performing UNIX password changing.

    See also unix password sync, - passwd program and - passwd chat debug.

    Default: min password length = 5

    min print space (S)

    This sets the minimum amount of free disk + passwd program and + passwd chat debug.

    Default: min password length = 5

    min print space (S)

    This sets the minimum amount of free disk space that must be available before a user will be able to spool a print job. It is specified in kilobytes. The default is 0, which - means a user can always spool a print job.

    See also the printing - parameter.

    Default: min print space = 0

    Example: min print space = 2000

    min protocol (G)

    The value of the parameter (a string) is the + means a user can always spool a print job.

    See also the printing + parameter.

    Default: min print space = 0

    Example: min print space = 2000

    min protocol (G)

    The value of the parameter (a string) is the lowest SMB protocol dialect than Samba will support. Please refer - to the max protocol + to the max protocol parameter for a list of valid protocol names and a brief description of each. You may also wish to refer to the C source code in - source/smbd/negprot.c for a listing of known protocol + source/smbd/negprot.c for a listing of known protocol dialects supported by clients.

    If you are viewing this parameter as a security measure, you should - also refer to the lanman + also refer to the lanman auth parameter. Otherwise, you should never need - to change this parameter.

    Default : min protocol = CORE

    Example : min protocol = NT1 # disable DOS clients

    min wins ttl (G)

    This option tells nmbd(8) - when acting as a WINS server ( + to change this parameter.

    Default : min protocol = CORE

    Example : min protocol = NT1 # disable DOS clients

    min wins ttl (G)

    This option tells nmbd(8) + when acting as a WINS server ( wins support = yes) what the minimum 'time to live' - of NetBIOS names that nmbd will grant will be (in + of NetBIOS names that nmbd will grant will be (in seconds). You should never need to change this parameter. The default - is 6 hours (21600 seconds).

    Default: min wins ttl = 21600

    msdfs proxy (S)

    This parameter indicates that the share is a + is 6 hours (21600 seconds).

    Default: min wins ttl = 21600

    msdfs proxy (S)

    This parameter indicates that the share is a stand-in for another CIFS share whose location is specified by the value of the parameter. When clients attempt to connect to this share, they are redirected to the proxied share using the SMB-Dfs protocol.

    Only Dfs roots can act as proxy shares. Take a look at the - msdfs root - and host msdfs - options to find out how to set up a Dfs root share.

    Example: msdfs proxy = \\\\otherserver\\someshare

    msdfs root (S)

    This boolean parameter is only available if - Samba is configured and compiled with the - --with-msdfs option. If set to yes, + msdfs root + and host msdfs + options to find out how to set up a Dfs root share.

    Example: msdfs proxy = \\\\otherserver\\someshare

    msdfs root (S)

    This boolean parameter is only available if + Samba is configured and compiled with the + --with-msdfs option. If set to yes, Samba treats the share as a Dfs root and allows clients to browse the distributed file system tree rooted at the share directory. Dfs links are specified in the share directory by symbolic - links of the form msdfs:serverA\\shareA,serverB\\shareB + links of the form msdfs:serverA\\shareA,serverB\\shareB and so on. For more information on setting up a Dfs tree on Samba, refer to "Hosting a Microsoft - Distributed File System tree on Samba" document.

    See also host msdfs

    Default: msdfs root = no

    name cache timeout (G)

    Specifies the number of seconds it takes before + Distributed File System tree on Samba" document.

    See also host msdfs

    Default: msdfs root = no

    name cache timeout (G)

    Specifies the number of seconds it takes before entries in samba's hostname resolve cache time out. If the timeout is set to 0. the caching is disabled. -

    Default: name cache timeout = 660

    Example: name cache timeout = 0

    name resolve order (G)

    This option is used by the programs in the Samba +

    Default: name cache timeout = 660

    Example: name cache timeout = 0

    name resolve order (G)

    This option is used by the programs in the Samba suite to determine what naming services to use and in what order - to resolve host names to IP addresses. The option takes a space + to resolve host names to IP addresses. Its main purpose to is to + control how netbios name resolution is performed. The option takes a space separated string of name resolution options.

    The options are: "lmhosts", "host", "wins" and "bcast". They cause names to be - resolved as follows:

    Default: name resolve order = lmhosts host wins bcast

    Example: name resolve order = lmhosts bcast host

    This will cause the local lmhosts file to be examined first, followed by a broadcast attempt, followed by a normal - system hostname lookup.

    netbios aliases (G)

    This is a list of NetBIOS names that nmbd(8) will + system hostname lookup.

    When Samba is functioning in ADS security mode (security = ads) + it is advised to use following settings for name resolve order:

    name resolve order = wins bcast

    DC lookups will still be done via DNS, but fallbacks to netbios names will + not inundate your DNS servers with needless querys for DOMAIN<0x1c> lookups.

    netbios aliases (G)

    This is a list of NetBIOS names that nmbd(8) will advertise as additional names by which the Samba server is known. This allows one machine to appear in browse lists under multiple names. If a machine is acting as a browse server or logon server none of these names will be advertised as either browse server or logon servers, only the primary name of the machine will be advertised with these capabilities. -

    See also netbios - name.

    Default: empty string (no additional names)

    Example: netbios aliases = TEST TEST1 TEST2

    netbios name (G)

    This sets the NetBIOS name by which a Samba +

    See also netbios + name.

    Default: empty string (no additional names)

    Example: netbios aliases = TEST TEST1 TEST2

    netbios name (G)

    This sets the NetBIOS name by which a Samba server is known. By default it is the same as the first component of the host's DNS name. If a machine is a browse server or logon server this name (or the first component of the hosts DNS name) will be the name that these services are - advertised under.

    See also netbios - aliases.

    Default: machine DNS name

    Example: netbios name = MYNAME

    netbios scope (G)

    This sets the NetBIOS scope that Samba will + advertised under.

    See also netbios + aliases.

    Default: machine DNS name

    Example: netbios name = MYNAME

    netbios scope (G)

    This sets the NetBIOS scope that Samba will operate under. This should not be set unless every machine on your LAN also sets this value.

    nis homedir (G)

    Get the home share server from a NIS map. For UNIX systems that use an automounter, the user's home directory @@ -1793,10 +1839,10 @@ df $1 | tail -1 | awk '{print $2" "$4}' it will be mounted on the Samba client directly from the directory server. When Samba is returning the home share to the client, it will consult the NIS map specified in - homedir map and return the server + homedir map and return the server listed there.

    Note that for this option to work there must be a working NIS system and the Samba server with this option must also - be a logon server.

    Default: nis homedir = no

    non unix account range (G)

    The non unix account range parameter specifies + be a logon server.

    Default: nis homedir = no

    non unix account range (G)

    The non unix account range parameter specifies the range of 'user ids' that are allocated by the various 'non unix account' passdb backends. These backends allow the storage of passwords for users who don't exist in /etc/passwd. @@ -1805,105 +1851,109 @@ df $1 | tail -1 | awk '{print $2" "$4}' it as strange conflicts can occur otherwise.

    Note

    These userids never appear on the system and Samba will never 'become' these users. They are used only to ensure that the algorithmic RID mapping does not conflict with normal users. -

    Default: non unix account range = <empty string>

    Example: non unix account range = 10000-20000

    nt acl support (S)

    This boolean parameter controls whether smbd(8) will attempt to map +

    Default: non unix account range = <empty string>

    Example: non unix account range = 10000-20000

    nt acl support (S)

    This boolean parameter controls whether smbd(8) will attempt to map UNIX permissions into Windows NT access control lists. This parameter was formally a global parameter in releases - prior to 2.2.2.

    Default: nt acl support = yes

    ntlm auth (G)

    This parameter determines whether or not smbd(8) will attempt to authenticate users using the NTLM password hash. - If disabled, only the lanman password hashes will be used.

    Please note that at least this option or lanman auth should - be enabled in order to be able to log in.

    Default : ntlm auth = yes

    nt pipe support (G)

    This boolean parameter controls whether - smbd(8) will allow Windows NT - clients to connect to the NT SMB specific IPC$ + prior to 2.2.2.

    Default: nt acl support = yes

    ntlm auth (G)

    This parameter determines whether or not smbd(8) will attempt to + authenticate users using the NTLM encrypted password response. + If disabled, either the lanman password hash or an NTLMv2 response + will need to be sent by the client.

    If this option, and lanman + auth are both disabled, then only NTLMv2 logins will be + permited. Not all clients support NTLMv2, and most will require + special configuration to us it.

    Default : ntlm auth = yes

    nt pipe support (G)

    This boolean parameter controls whether + smbd(8) will allow Windows NT + clients to connect to the NT SMB specific IPC$ pipes. This is a developer debugging option and can be left - alone.

    Default: nt pipe support = yes

    nt status support (G)

    This boolean parameter controls whether smbd(8) will negotiate NT specific status + alone.

    Default: nt pipe support = yes

    nt status support (G)

    This boolean parameter controls whether smbd(8) will negotiate NT specific status support with Windows NT/2k/XP clients. This is a developer debugging option and should be left alone. - If this option is set to no then Samba offers + If this option is set to no then Samba offers exactly the same DOS error codes that versions prior to Samba 2.2.3 - reported.

    You should not need to ever disable this parameter.

    Default: nt status support = yes

    null passwords (G)

    Allow or disallow client access to accounts that have null passwords.

    See also smbpasswd(5).

    Default: null passwords = no

    obey pam restrictions (G)

    When Samba 3.0 is configured to enable PAM support + reported.

    You should not need to ever disable this parameter.

    Default: nt status support = yes

    null passwords (G)

    Allow or disallow client access to accounts that have null passwords.

    See also smbpasswd(5).

    Default: null passwords = no

    obey pam restrictions (G)

    When Samba 3.0 is configured to enable PAM support (i.e. --with-pam), this parameter will control whether or not Samba should obey PAM's account and session management directives. The default behavior is to use PAM for clear text authentication only and to ignore any account or session management. Note that Samba always ignores PAM for authentication in the case of - encrypt passwords = yes. The reason + encrypt passwords = yes. The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. -

    Default: obey pam restrictions = no

    only guest (S)

    A synonym for +

    Default: obey pam restrictions = no

    only guest (S)

    A synonym for guest only.

    only user (S)

    This is a boolean option that controls whether - connections with usernames not in the user + connections with usernames not in the user list will be allowed. By default this option is disabled so that a client can supply a username to be used by the server. Enabling this parameter will force the server to only use the login - names from the user list and is only really + names from the user list and is only really useful in share level security.

    Note that this also means Samba won't try to deduce usernames from the service name. This can be annoying for - the [homes] section. To get around this you could use user = - %S which means your user list + the [homes] section. To get around this you could use user = + %S which means your user list will be just the service name, which for home directories is the - name of the user.

    See also the user - parameter.

    Default: only user = no

    oplock break wait time (G)

    This is a tuning parameter added due to bugs in + name of the user.

    See also the user + parameter.

    Default: only user = no

    oplock break wait time (G)

    This is a tuning parameter added due to bugs in both Windows 9x and WinNT. If Samba responds to a client too quickly when that client issues an SMB that can cause an oplock break request, then the network client can fail and not respond to the break request. This tuning parameter (which is set in milliseconds) is the amount of time Samba will wait before sending an oplock break request to such (broken) clients.

    DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND - UNDERSTOOD THE SAMBA OPLOCK CODE.

    Default: oplock break wait time = 0

    oplock contention limit (S)

    This is a very advanced - smbd(8) tuning option to + UNDERSTOOD THE SAMBA OPLOCK CODE.

    Default: oplock break wait time = 0

    oplock contention limit (S)

    This is a very advanced + smbd(8) tuning option to improve the efficiency of the granting of oplocks under multiple - client contention for the same file.

    In brief it specifies a number, which causes smbd(8)not to grant an oplock even when requested + client contention for the same file.

    In brief it specifies a number, which causes smbd(8)not to grant an oplock even when requested if the approximate number of clients contending for an oplock on the same file goes over this - limit. This causes smbd to behave in a similar + limit. This causes smbd to behave in a similar way to Windows NT.

    DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ - AND UNDERSTOOD THE SAMBA OPLOCK CODE.

    Default: oplock contention limit = 2

    oplocks (S)

    This boolean option tells smbd whether to + AND UNDERSTOOD THE SAMBA OPLOCK CODE.

    Default: oplock contention limit = 2

    oplocks (S)

    This boolean option tells smbd whether to issue oplocks (opportunistic locks) to file open requests on this share. The oplock code can dramatically (approx. 30% or more) improve the speed of access to files on Samba servers. It allows the clients to aggressively cache files locally and you may want to disable this option for unreliable network environments (it is turned on by default in Windows NT Servers). For more information see the file - Speed.txt in the Samba docs/ + Speed.txt in the Samba docs/ directory.

    Oplocks may be selectively turned off on certain files with a - share. See the + share. See the veto oplock files parameter. On some systems oplocks are recognized by the underlying operating system. This allows data synchronization between all access to oplocked files, whether it be via Samba or NFS or a local UNIX process. See the - kernel oplocks parameter for details.

    See also the kernel - oplocks and - level2 oplocks parameters.

    Default: oplocks = yes

    os2 driver map (G)

    The parameter is used to define the absolute + kernel oplocks parameter for details.

    See also the kernel + oplocks and + level2 oplocks parameters.

    Default: oplocks = yes

    os2 driver map (G)

    The parameter is used to define the absolute path to a file containing a mapping of Windows NT printer driver names to OS/2 printer driver names. The format is:

    <nt driver name> = <os2 driver name>.<device name>

    For example, a valid entry using the HP LaserJet 5 - printer driver would appear as HP LaserJet 5L = LASERJET.HP + printer driver would appear as HP LaserJet 5L = LASERJET.HP LaserJet 5L.

    The need for the file is due to the printer driver namespace problem described in the Samba Printing HOWTO. For more details on OS/2 clients, please - refer to the OS2-Client-HOWTO containing in the Samba documentation.

    Default: os2 driver map = <empty string>

    os level (G)

    This integer value controls what level Samba + refer to the OS2-Client-HOWTO containing in the Samba documentation.

    Default: os2 driver map = <empty string>

    os level (G)

    This integer value controls what level Samba advertises itself as for browse elections. The value of this - parameter determines whether nmbd(8) - has a chance of becoming a local master browser for the + parameter determines whether nmbd(8) + has a chance of becoming a local master browser for the WORKGROUP in the local broadcast area.

    Note :By default, Samba will win a local master browsing election over all Microsoft operating systems except a Windows NT 4.0/2000 Domain Controller. This means that a misconfigured Samba host can effectively isolate - a subnet for browsing purposes. See BROWSING.txt - in the Samba docs/ directory - for details.

    Default: os level = 20

    Example: os level = 65

    pam password change (G)

    With the addition of better PAM support in Samba 2.2, + a subnet for browsing purposes. See BROWSING.txt + in the Samba docs/ directory + for details.

    Default: os level = 20

    Example: os level = 65

    pam password change (G)

    With the addition of better PAM support in Samba 2.2, this parameter, it is possible to use PAM's password change control flag for Samba. If enabled, then PAM will be used for password changes when requested by an SMB client instead of the program listed in - passwd program. + passwd program. It should be possible to enable this without changing your - passwd chat - parameter for most setups.

    Default: pam password change = no

    panic action (G)

    This is a Samba developer option that allows a - system command to be called when either smbd(8) or smbd(8) crashes. This is usually used to - draw attention to the fact that a problem occurred.

    Default: panic action = <empty string>

    Example: panic action = "/bin/sleep 90000"

    paranoid server security (G)

    Some version of NT 4.x allow non-guest + passwd chat + parameter for most setups.

    Default: pam password change = no

    panic action (G)

    This is a Samba developer option that allows a + system command to be called when either smbd(8) or smbd(8) crashes. This is usually used to + draw attention to the fact that a problem occurred.

    Default: panic action = <empty string>

    Example: panic action = "/bin/sleep 90000"

    paranoid server security (G)

    Some version of NT 4.x allow non-guest users with a bad passowrd. When this option is enabled, samba will not use a broken NT 4.x server as password server, but instead complain to the logs and exit.

    Disabling this option prevents Samba from making this check, which involves deliberatly attempting a - bad logon to the remote server.

    Default: paranoid server security = yes

    passdb backend (G)

    This option allows the administrator to chose which backends + bad logon to the remote server.

    Default: paranoid server security = yes

    passdb backend (G)

    This option allows the administrator to chose which backends to retrieve and store passwords with. This allows (for example) both smbpasswd and tdbsam to be used without a recompile. Multiple backends can be specified, separated by spaces. The backends will be @@ -1911,98 +1961,95 @@ df $1 | tail -1 | awk '{print $2" "$4}' to the first backend specified.

    This parameter is in two parts, the backend's name, and a 'location' string that has meaning only to that particular backed. These are separated by a : character.

    Available backends can include: -

    • smbpasswd - The default smbpasswd +

      • smbpasswd - The default smbpasswd backend. Takes a path to the smbpasswd file as an optional argument. -

      • smbpasswd_nua - The smbpasswd - backend, but with support for 'not unix accounts'. - Takes a path to the smbpasswd file as an optional argument.

        See also - non unix account range

      • tdbsam - The TDB based password storage +

      • tdbsam - The TDB based password storage backend. Takes a path to the TDB as an optional argument (defaults to passdb.tdb in the - private dir directory.

      • tdbsam_nua - The TDB based password storage - backend, with non unix account support. Takes a path to the TDB as an optional argument (defaults to passdb.tdb - in the - private dir directory.

        See also - non unix account range

      • ldapsam - The LDAP based passdb + private dir directory.

      • ldapsam - The LDAP based passdb backend. Takes an LDAP URL as an optional argument (defaults to - ldap://localhost)

      • ldapsam_nua - The LDAP based passdb - backend, with non unix account support. Takes an LDAP URL as an optional argument (defaults to - ldap://localhost)

        Note: In this module, any account without a matching POSIX account is regarded - as 'non unix'.

        See also - non unix account range

        LDAP connections should be secured where possible. This may be done using either - Start-TLS (see ldap ssl) or by - specifying ldaps:// in - the URL argument.

      • nisplussam - + ldap://localhost)

        LDAP connections should be secured where possible. This may be done using either + Start-TLS (see ldap ssl) or by + specifying ldaps:// in + the URL argument.

      • nisplussam - The NIS+ based passdb backend. Takes name NIS domain as an optional argument. Only works with sun NIS+ servers. +

      • mysql - + The MySQL based passdb backend. Takes an identifier as + argument. Read the Samba HOWTO Collection for configuration + details. +

      • guest - + Very simple backend that only provides one user: the guest user. + Only maps the NT guest user to the guest account. + Required in pretty much all situations.

      -

      Default: passdb backend = smbpasswd unixsam

      Example: passdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd guest

      Example: passdb backend = ldapsam_nua:ldaps://ldap.example.com guest

      Example: passdb backend = mysql:my_plugin_args tdbsam:/etc/samba/private/passdb.tdb

    passwd chat debug (G)

    This boolean specifies if the passwd chat script - parameter is run in debug mode. In this mode the - strings passed to and received from the passwd chat are printed - in the smbd(8) log with a - debug level - of 100. This is a dangerous option as it will allow plaintext passwords - to be seen in the smbd log. It is available to help - Samba admins debug their passwd chat scripts - when calling the passwd program and should - be turned off after this has been done. This option has no effect if the - pam password change - paramter is set. This parameter is off by default.

    See also passwd chat - , pam password change - , passwd program - .

    Default: passwd chat debug = no

    passwd chat (G)

    This string controls the "chat" - conversation that takes places between smbd(8) and the local password changing +

    Default: passdb backend = smbpasswd

    Example: passdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd guest

    Example: passdb backend = ldapsam:ldaps://ldap.example.com guest

    Example: passdb backend = mysql:my_plugin_args tdbsam:/etc/samba/private/passdb.tdb guest

    passwd chat (G)

    This string controls the "chat" + conversation that takes places between smbd(8) and the local password changing program to change the user's password. The string describes a - sequence of response-receive pairs that smbd(8) uses to determine what to send to the - passwd program + sequence of response-receive pairs that smbd(8) uses to determine what to send to the + passwd program and what to expect back. If the expected output is not received then the password is not changed.

    This chat sequence is often quite site specific, depending on what local methods are used for password control (such as NIS - etc).

    Note that this parameter only is only used if the unix password sync - parameter is set to yes. This sequence is + etc).

    Note that this parameter only is only used if the unix password sync + parameter is set to yes. This sequence is then called AS ROOT when the SMB password in the smbpasswd file is being changed, without access to the old password cleartext. This means that root must be able to reset the user's password without knowing the text of the previous password. In the presence of NIS/YP, this means that the passwd program must be executed on the NIS master. -

    The string can contain the macro %n which is substituted +

    The string can contain the macro %n which is substituted for the new password. The chat sequence can also contain the standard - macros \\n, \\r, \\t and \\s to + macros \\n, \\r, \\t and \\s to give line-feed, carriage-return, tab and space. The chat sequence string can also contain a '*' which matches any sequence of characters. Double quotes can be used to collect strings with spaces in them into a single string.

    If the send string in any part of the chat sequence is a full stop ".", then no string is sent. Similarly, if the - expect string is a full stop then no string is expected.

    If the pam - password change parameter is set to yes, the chat pairs + expect string is a full stop then no string is expected.

    If the pam + password change parameter is set to yes, the chat pairs may be matched in any order, and success is determined by the PAM result, not any particular output. The \n macro is ignored for PAM conversions. -

    See also unix password - sync, +

    See also unix password + sync, passwd program , - passwd chat debug and - pam password change.

    Default: passwd chat = *new*password* %n\\n - *new*password* %n\\n *changed*

    Example: passwd chat = "*Enter OLD password*" %o\\n + passwd chat debug and + pam password change.

    Default: passwd chat = *new*password* %n\\n + *new*password* %n\\n *changed*

    Example: passwd chat = "*Enter OLD password*" %o\\n "*Enter NEW password*" %n\\n "*Reenter NEW password*" %n\\n - "*Password changed*"

    passwd program (G)

    The name of a program that can be used to set - UNIX user passwords. Any occurrences of %u + "*Password changed*"

    passwd chat debug (G)

    This boolean specifies if the passwd chat script + parameter is run in debug mode. In this mode the + strings passed to and received from the passwd chat are printed + in the smbd(8) log with a + debug level + of 100. This is a dangerous option as it will allow plaintext passwords + to be seen in the smbd log. It is available to help + Samba admins debug their passwd chat scripts + when calling the passwd program and should + be turned off after this has been done. This option has no effect if the + pam password change + paramter is set. This parameter is off by default.

    See also passwd chat + , pam password change + , passwd program + .

    Default: passwd chat debug = no

    passwd program (G)

    The name of a program that can be used to set + UNIX user passwords. Any occurrences of %u will be replaced with the user name. The user name is checked for existence before calling the password changing program.

    Also note that many passwd programs insist in reasonable passwords, such as a minimum length, or the inclusion of mixed case chars and digits. This can pose a problem as some clients (such as Windows for Workgroups) uppercase the password before sending - it.

    Note that if the unix - password sync parameter is set to yes + it.

    Note that if the unix + password sync parameter is set to yes then this program is called AS ROOT - before the SMB password in the smbpasswd(5) + before the SMB password in the smbpasswd(5) file is changed. If this UNIX password change fails, then - smbd will fail to change the SMB password also - (this is by design).

    If the unix password sync parameter + smbd will fail to change the SMB password also + (this is by design).

    If the unix password sync parameter is set this parameter MUST USE ABSOLUTE PATHS for ALL programs called, and must be examined - for security implications. Note that by default unix - password sync is set to no.

    See also unix - password sync.

    Default: passwd program = /bin/passwd

    Example: passwd program = /sbin/npasswd %u

    password level (G)

    Some client/server combinations have difficulty + for security implications. Note that by default unix + password sync is set to no.

    See also unix + password sync.

    Default: passwd program = /bin/passwd

    Example: passwd program = /sbin/npasswd %u

    password level (G)

    Some client/server combinations have difficulty with mixed-case passwords. One offending client is Windows for Workgroups, which for some reason forces passwords to upper case when using the LANMAN1 protocol, but leaves them alone when @@ -2010,23 +2057,27 @@ df $1 | tail -1 | awk '{print $2" "$4}' family of operating systems. These clients upper case clear text passwords even when NT LM 0.12 selected by the protocol negotiation request/response.

    This parameter defines the maximum number of characters - that may be upper case in passwords.

    For example, say the password given was "FRED". If + that may be upper case in passwords.

    For example, say the password given was "FRED". If password level is set to 1, the following combinations - would be tried if "FRED" failed:

    "Fred", "fred", "fRed", "frEd","freD"

    If password level was set to 2, + would be tried if "FRED" failed:

    "Fred", "fred", "fRed", "frEd","freD"

    If password level was set to 2, the following combinations would also be tried:

    "FRed", "FrEd", "FreD", "fREd", "fReD", "frED", ..

    And so on.

    The higher value this parameter is set to the more likely it is that a mixed case password will be matched against a single case password. However, you should be aware that use of this parameter reduces security and increases the time taken to process a new connection.

    A value of zero will cause only two attempts to be - made - the password as is and the password in all-lower case.

    Default: password level = 0

    Example: password level = 4

    password server (G)

    By specifying the name of another SMB server (such - as a WinNT box) with this option, and using security = domain - or security = server you can get Samba - to do all its username/password validation via a remote server.

    This option sets the name of the password server to use. - It must be a NetBIOS name, so if the machine's NetBIOS name is - different from its Internet name then you may have to add its NetBIOS - name to the lmhosts file which is stored in the same directory - as the smb.conf file.

    The name of the password server is looked up using the - parameter name + made - the password as is and the password in all-lower case.

    Default: password level = 0

    Example: password level = 4

    password server (G)

    By specifying the name of another SMB server + or Active Directory domain controller with this option, + and using security = [ads|domain|server] + it is possible to get Samba to + to do all its username/password validation using a specific remote server.

    This option sets the name or IP address of the password server to use. + New syntax has been added to support defining the port to use when connecting + to the server the case of an ADS realm. To define a port other than the + default LDAP port of 389, add the port number using a colon after the + name or IP address (e.g. 192.168.1.100:389). If you do not specify a port, + Samba will use the standard LDAP port of tcp/389. Note that port numbers + have no effect on password servers for Windows NT 4.0 domains or netbios + connections.

    If parameter is a name, it is looked up using the + parameter name resolve order and so may resolved by any method and order described in that parameter.

    The password server must be a machine capable of using the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in @@ -2035,117 +2086,118 @@ df $1 | tail -1 | awk '{print $2" "$4}' CHOOSE A PASSWORD SERVER THAT YOU DON'T COMPLETELY TRUST.

    Never point a Samba server at itself for password serving. This will cause a loop and could lock up your Samba server!

    The name of the password server takes the standard - substitutions, but probably the only useful one is %m + substitutions, but probably the only useful one is %m , which means the Samba server will use the incoming client as the password server. If you use this then you better - trust your clients, and you had better restrict them with hosts allow!

    If the security parameter is set to - domain, then the list of machines in this + trust your clients, and you had better restrict them with hosts allow!

    If the security parameter is set to + domain or ads, then the list of machines in this option must be a list of Primary or Backup Domain controllers for the Domain or the character '*', as the Samba server is effectively in that domain, and will use cryptographically authenticated RPC calls - to authenticate the user logging on. The advantage of using + to authenticate the user logging on. The advantage of using security = domain is that if you list several hosts in the - password server option then smbd - will try each in turn till it finds one that responds. This - is useful in case your primary server goes down.

    If the password server option is set + password server option then smbd + will try each in turn till it finds one that responds. This + is useful in case your primary server goes down.

    If the password server option is set to the character '*', then Samba will attempt to auto-locate the Primary or Backup Domain controllers to authenticate against by - doing a query for the name WORKGROUP<1C> + doing a query for the name WORKGROUP<1C> and then contacting each server returned in the list of IP - addresses from the name resolution source.

    If the list of servers contains both names and the '*' + addresses from the name resolution source.

    If the list of servers contains both names/IP's and the '*' character, the list is treated as a list of preferred domain controllers, but an auto lookup of all remaining DC's will be added to the list as well. Samba will not attempt to optimize - this list by locating the closest DC.

    If the security parameter is - set to server, then there are different - restrictions that security = domain doesn't + this list by locating the closest DC.

    If the security parameter is + set to server, then there are different + restrictions that security = domain doesn't suffer from:

    • You may list several password servers in - the password server parameter, however if an - smbd makes a connection to a password server, + the password server parameter, however if an + smbd makes a connection to a password server, and then the password server fails, no more users will be able - to be authenticated from this smbd. This is a - restriction of the SMB/CIFS protocol when in security = server + to be authenticated from this smbd. This is a + restriction of the SMB/CIFS protocol when in security = server mode and cannot be fixed in Samba.

    • If you are using a Windows NT server as your password server then you will have to ensure that your users - are able to login from the Samba server, as when in + are able to login from the Samba server, as when in security = server mode the network logon will appear to - come from there rather than from the users workstation.

    See also the security - parameter.

    Default: password server = <empty string>

    Example: password server = NT-PDC, NT-BDC1, NT-BDC2, *

    Example: password server = *

    path (S)

    This parameter specifies a directory to which + come from there rather than from the users workstation.

    See also the security + parameter.

    Default: password server = <empty string>

    Example: password server = NT-PDC, NT-BDC1, NT-BDC2, *

    Example: password server = windc.mydomain.com:389 192.168.1.101 *

    Example: password server = *

    path (S)

    This parameter specifies a directory to which the user of the service is to be given access. In the case of printable services, this is where print data will spool prior to being submitted to the host for printing.

    For a printable service offering guest access, the service should be readonly and the path should be world-writeable and have the sticky bit set. This is not mandatory of course, but you probably won't get the results you expect if you do - otherwise.

    Any occurrences of %u in the path + otherwise.

    Any occurrences of %u in the path will be replaced with the UNIX username that the client is using - on this connection. Any occurrences of %m + on this connection. Any occurrences of %m will be replaced by the NetBIOS name of the machine they are connecting from. These replacements are very useful for setting up pseudo home directories for users.

    Note that this path will be based on - root dir if one was specified.

    Default: none

    Example: path = /home/fred

    pid directory (G)

    This option specifies the directory where pid - files will be placed.

    Default: pid directory = ${prefix}/var/locks

    Example: pid directory = /var/run/

    posix locking (S)

    The smbd(8) + root dir if one was specified.

    Default: none

    Example: path = /home/fred

    pid directory (G)

    This option specifies the directory where pid + files will be placed.

    Default: pid directory = ${prefix}/var/locks

    Example: pid directory = /var/run/

    posix locking (S)

    The smbd(8) daemon maintains an database of file locks obtained by SMB clients. The default behavior is to map this internal database to POSIX locks. This means that file locks obtained by SMB clients are consistent with those seen by POSIX compliant applications accessing the files via a non-SMB method (e.g. NFS or local file access). - You should never need to disable this parameter.

    Default: posix locking = yes

    postexec (S)

    This option specifies a command to be run + You should never need to disable this parameter.

    Default: posix locking = yes

    postexec (S)

    This option specifies a command to be run whenever the service is disconnected. It takes the usual substitutions. The command may be run as the root on some systems.

    An interesting example may be to unmount server - resources:

    postexec = /etc/umount /cdrom

    See also preexec.

    Default: none (no command executed)

    Example: postexec = echo \"%u disconnected from %S from %m (%I)\" >> /tmp/log

    preexec close (S)

    This boolean option controls whether a non-zero - return code from preexec - should close the service being connected to.

    Default: preexec close = no

    preexec (S)

    This option specifies a command to be run whenever + resources:

    postexec = /etc/umount /cdrom

    See also preexec.

    Default: none (no command executed)

    Example: postexec = echo \"%u disconnected from %S from %m (%I)\" >> /tmp/log

    preexec (S)

    This option specifies a command to be run whenever the service is connected to. It takes the usual substitutions.

    An interesting example is to send the users a welcome message every time they log in. Maybe a message of the day? Here - is an example:

    preexec = csh -c 'echo \"Welcome to %S!\" | /usr/local/samba/bin/smbclient -M %m -I %I' &

    Of course, this could get annoying after a while :-)

    See also preexec close and postexec - .

    Default: none (no command executed)

    Example: preexec = echo \"%u connected to %S from %m (%I)\" >> /tmp/log

    prefered master (G)

    Synonym for + is an example:

    preexec = csh -c 'echo \"Welcome to %S!\" | /usr/local/samba/bin/smbclient -M %m -I %I' &

    Of course, this could get annoying after a while :-)

    See also preexec close and postexec + .

    Default: none (no command executed)

    Example: preexec = echo \"%u connected to %S from %m (%I)\" >> /tmp/log

    preexec close (S)

    This boolean option controls whether a non-zero + return code from preexec + should close the service being connected to.

    Default: preexec close = no

    prefered master (G)

    Synonym for preferred master for people who cannot spell :-).

    preferred master (G)

    This boolean parameter controls if - nmbd(8) is a preferred master - browser for its workgroup.

    If this is set to yes, on startup, nmbd + nmbd(8) is a preferred master + browser for its workgroup.

    If this is set to yes, on startup, nmbd will force an election, and it will have a slight advantage in winning the election. It is recommended that this parameter is - used in conjunction with - domain master = yes, so - that nmbd can guarantee becoming a domain master.

    Use this option with caution, because if there are several + used in conjunction with + domain master = yes, so + that nmbd can guarantee becoming a domain master.

    Use this option with caution, because if there are several hosts (whether Samba servers, Windows 95 or NT) that are preferred master browsers on the same subnet, they will each periodically and continuously attempt to become the local master browser. This will result in unnecessary broadcast - traffic and reduced browsing capabilities.

    See also os level.

    Default: preferred master = auto

    preload modules (G)

    This is a list of paths to modules that should - be loaded into smbd before a client connects. This improves - the speed of smbd when reacting to new connections somewhat.

    It is recommended to only use this option on heavy-performance - servers.

    Default: preload modules =

    Example: preload modules = /usr/lib/samba/passdb/mysql.so+++

    preload (G)

    This is a list of services that you want to be + traffic and reduced browsing capabilities.

    See also os level.

    Default: preferred master = auto

    preload (G)

    This is a list of services that you want to be automatically added to the browse lists. This is most useful for homes and printers services that would otherwise not be visible.

    Note that if you just want all printers in your printcap file loaded then the - load printers option is easier.

    Default: no preloaded services

    Example: preload = fred lp colorlp

    preserve case (S)

    This controls if new filenames are created + load printers option is easier.

    Default: no preloaded services

    Example: preload = fred lp colorlp

    preload modules (G)

    This is a list of paths to modules that should + be loaded into smbd before a client connects. This improves + the speed of smbd when reacting to new connections somewhat.

    It is recommended to only use this option on heavy-performance + servers.

    Default: preload modules =

    Example: preload modules = /usr/lib/samba/passdb/mysql.so+++

    preserve case (S)

    This controls if new filenames are created with the case that the client passes, or if they are forced to - be the default case - .

    Default: preserve case = yes

    See the section on NAME MANGLING for a fuller discussion.

    printable (S)

    If this parameter is yes, then + be the default case + .

    Default: preserve case = yes

    See the section on NAME MANGLING for a fuller discussion.

    printable (S)

    If this parameter is yes, then clients may open, write to and submit spool files on the directory specified for the service.

    Note that a printable service will ALWAYS allow writing to the service path (user privileges permitting) via the spooling - of print data. The read only + of print data. The read only parameter controls only non-printing access to - the resource.

    Default: printable = no

    printcap name (S)

    This parameter may be used to override the - compiled-in default printcap name used by the server (usually + the resource.

    Default: printable = no

    printcap (G)

    Synonym for + printcap name.

    printcap name (S)

    This parameter may be used to override the + compiled-in default printcap name used by the server (usually /etc/printcap). See the discussion of the [printers] section above for reasons - why you might want to do this.

    To use the CUPS printing interface set printcap name = cups + why you might want to do this.

    To use the CUPS printing interface set printcap name = cups . This should be supplemented by an addtional setting printing = cups in the [global] - section. printcap name = cups will use the + section. printcap name = cups will use the "dummy" printcap created by CUPS, as specified in your CUPS configuration file. -

    On System V systems that use lpstat to - list available printers you can use printcap name = lpstat +

    On System V systems that use lpstat to + list available printers you can use printcap name = lpstat to automatically obtain lists of available printers. This is the default for systems that define SYSV at configure time in - Samba (this includes most System V based systems). If - printcap name is set to lpstat on - these systems then Samba will launch lpstat -v and + Samba (this includes most System V based systems). If + printcap name is set to lpstat on + these systems then Samba will launch lpstat -v and attempt to parse the output to obtain a printer list.

    A minimal printcap file would look something like this:

     print1|My Printer 1
 print2|My Printer 2
@@ -2155,115 +2207,114 @@ print5|My Printer 5

    where the '|' separates aliases of a printer. The fact that the second alias has a space in it gives a hint to Samba that it's a comment.

    Note

    Under AIX the default printcap - name is /etc/qconfig. Samba will assume the - file is in AIX qconfig format if the string - qconfig appears in the printcap filename.

    Default: printcap name = /etc/printcap

    Example: printcap name = /etc/myprintcap

    printcap (G)

    Synonym for - printcap name.

    print command (S)

    After a print job has finished spooling to - a service, this command will be used via a system() + name is /etc/qconfig. Samba will assume the + file is in AIX qconfig format if the string + qconfig appears in the printcap filename.

    Default: printcap name = /etc/printcap

    Example: printcap name = /etc/myprintcap

    print command (S)

    After a print job has finished spooling to + a service, this command will be used via a system() call to process the spool file. Typically the command specified will submit the spool file to the host's printing subsystem, but there is no requirement that this be the case. The server will not remove the spool file, so whatever command you specify should remove the spool file when it has been processed, otherwise you will need to manually remove old spool files.

    The print command is simply a text string. It will be used - verbatim after macro substitutions have been made:

    %s, %p - the path to the spool + verbatim after macro substitutions have been made:

    %s, %f - the path to the spool file name

    %p - the appropriate printer name

    %J - the job name as transmitted by the client.

    %c - The number of printed pages of the spooled job (if known).

    %z - the size of the spooled print job (in bytes)

    The print command MUST contain at least - one occurrence of %s or %f - - the %p is optional. At the time - a job is submitted, if no printer name is supplied the %p + one occurrence of %s or %f + - the %p is optional. At the time + a job is submitted, if no printer name is supplied the %p will be silently removed from the printer command.

    If specified in the [global] section, the print command given will be used for any printable service that does not have its own print command specified.

    If there is neither a specified print command for a printable service nor a global print command, spool files will be created but not processed and (most importantly) not removed.

    Note that printing may fail on some UNIXes from the - nobody account. If this happens then create + nobody account. If this happens then create an alternative guest account that can print and set the - guest account + guest account in the [global] section.

    You can form quite complex print commands by realizing that they are just passed to a shell. For example the following will log a print job, print the file, then remove it. Note that - ';' is the usual separator for command in shell scripts.

    print command = echo Printing %s >> + ';' is the usual separator for command in shell scripts.

    print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s

    You may have to vary this command considerably depending on how you normally print files on your system. The default for the parameter varies depending on the setting of the - printing parameter.

    Default: For printing = BSD, AIX, QNX, LPRNG - or PLP :

    print command = lpr -r -P%p %s

    For printing = SYSV or HPUX :

    print command = lp -c -d%p %s; rm %s

    For printing = SOFTQ :

    print command = lp -d%p -s %s; rm %s

    For printing = CUPS : If SAMBA is compiled against + printing parameter.

    Default: For printing = BSD, AIX, QNX, LPRNG + or PLP :

    print command = lpr -r -P%p %s

    For printing = SYSV or HPUX :

    print command = lp -c -d%p %s; rm %s

    For printing = SOFTQ :

    print command = lp -d%p -s %s; rm %s

    For printing = CUPS : If SAMBA is compiled against libcups, then printcap = cups uses the CUPS API to submit jobs, etc. Otherwise it maps to the System V commands with the -oraw option for printing, i.e. it - uses lp -c -d%p -oraw; rm %s. - With printing = cups, + uses lp -c -d%p -oraw; rm %s. + With printing = cups, and if SAMBA is compiled against libcups, any manually - set print command will be ignored.

    Example: print command = /usr/local/samba/bin/myprintscript %p %s

    printer admin (S)

    This is a list of users that can do anything to + set print command will be ignored.

    Example: print command = /usr/local/samba/bin/myprintscript %p %s

    printer (S)

    Synonym for + printer name.

    printer admin (S)

    This is a list of users that can do anything to printers via the remote administration interfaces offered by MS-RPC (usually using a NT workstation). Note that the root user always - has admin rights.

    Default: printer admin = <empty string>

    Example: printer admin = admin, @staff

    printer name (S)

    This parameter specifies the name of the printer + has admin rights.

    Default: printer admin = <empty string>

    Example: printer admin = admin, @staff

    printer name (S)

    This parameter specifies the name of the printer to which print jobs spooled through a printable service will be sent.

    If specified in the [global] section, the printer name given will be used for any printable service that does - not have its own printer name specified.

    Default: none (but may be lp - on many systems)

    Example: printer name = laserwriter

    printer (S)

    Synonym for - printer name.

    printing (S)

    This parameters controls how printer status information is + not have its own printer name specified.

    Default: none (but may be lp + on many systems)

    Example: printer name = laserwriter

    printing (S)

    This parameters controls how printer status information is interpreted on your system. It also affects the default values for - the print command, lpq command, lppause command , lpresume command, and lprm command if specified in the + the print command, lpq command, lppause command , lpresume command, and lprm command if specified in the [global] section.

    Currently nine printing styles are supported. They are - BSD, AIX, - LPRNG, PLP, - SYSV, HPUX, - QNX, SOFTQ, - and CUPS.

    To see what the defaults are for the other print - commands when using the various options use the testparm(1) program.

    This option can be set on a per printer basis

    See also the discussion in the + BSD, AIX, + LPRNG, PLP, + SYSV, HPUX, + QNX, SOFTQ, + and CUPS.

    To see what the defaults are for the other print + commands when using the various options use the testparm(1) program.

    This option can be set on a per printer basis

    See also the discussion in the [printers] section.

    print ok (S)

    Synonym for - printable.

    private dir (G)

    This parameters defines the directory - smbd will use for storing such files as smbpasswd - and secrets.tdb. -

    Default :private dir = ${prefix}/private

    protocol (G)

    Synonym for - max protocol.

    public (S)

    Synonym for guest + printable.

    private dir (G)

    This parameters defines the directory + smbd will use for storing such files as smbpasswd + and secrets.tdb. +

    Default :private dir = ${prefix}/private

    protocol (G)

    Synonym for + max protocol.

    public (S)

    Synonym for guest ok.

    queuepause command (S)

    This parameter specifies the command to be executed on the server host in order to pause the printer queue.

    This command should be a program or script which takes a printer name as its only parameter and stops the printer queue, such that no longer jobs are submitted to the printer.

    This command is not supported by Windows for Workgroups, but can be issued from the Printers window under Windows 95 - and NT.

    If a %p is given then the printer name + and NT.

    If a %p is given then the printer name is put in its place. Otherwise it is placed at the end of the command.

    Note that it is good practice to include the absolute path in the command as the PATH may not be available to the - server.

    Default: depends on the setting of printing

    Example: queuepause command = disable %p

    queueresume command (S)

    This parameter specifies the command to be + server.

    Default: depends on the setting of printing

    Example: queuepause command = disable %p

    queueresume command (S)

    This parameter specifies the command to be executed on the server host in order to resume the printer queue. It is the command to undo the behavior that is caused by the - previous parameter ( + previous parameter ( queuepause command).

    This command should be a program or script which takes a printer name as its only parameter and resumes the printer queue, such that queued jobs are resubmitted to the printer.

    This command is not supported by Windows for Workgroups, but can be issued from the Printers window under Windows 95 - and NT.

    If a %p is given then the printer name + and NT.

    If a %p is given then the printer name is put in its place. Otherwise it is placed at the end of the command.

    Note that it is good practice to include the absolute path in the command as the PATH may not be available to the server.

    Default: depends on the setting of - printing

    Example: queuepause command = enable %p

    read bmpx (G)

    This boolean parameter controls whether - smbd(8) will support the "Read + printing

    Example: queuepause command = enable %p

    read bmpx (G)

    This boolean parameter controls whether + smbd(8) will support the "Read Block Multiplex" SMB. This is now rarely used and defaults to - no. You should never need to set this - parameter.

    Default: read bmpx = no

    read list (S)

    This is a list of users that are given read-only + no. You should never need to set this + parameter.

    Default: read bmpx = no

    read list (S)

    This is a list of users that are given read-only access to a service. If the connecting user is in this list then they will not be given write access, no matter what the - read only + read only option is set to. The list can include group names using the - syntax described in the - invalid users parameter.

    See also the + syntax described in the + invalid users parameter.

    See also the write list parameter and the - invalid users - parameter.

    Default: read list = <empty string>

    Example: read list = mary, @students

    read only (S)

    An inverted synonym is - writeable.

    If this parameter is yes, then users + invalid users + parameter.

    Default: read list = <empty string>

    Example: read list = mary, @students

    read only (S)

    An inverted synonym is + writeable.

    If this parameter is yes, then users of a service may not create or modify files in the service's - directory.

    Note that a printable service (printable = yes) + directory.

    Note that a printable service (printable = yes) will ALWAYS allow writing to the directory - (user privileges permitting), but only via spooling operations.

    Default: read only = yes

    read raw (G)

    This parameter controls whether or not the server + (user privileges permitting), but only via spooling operations.

    Default: read only = yes

    read raw (G)

    This parameter controls whether or not the server will support the raw read SMB requests when transferring data to clients.

    If enabled, raw reads allow reads of 65535 bytes in one packet. This typically provides a major performance benefit. @@ -2271,7 +2322,7 @@ print5|My Printer 5 block size incorrectly or are incapable of supporting larger block sizes, and for these clients you may need to disable raw reads.

    In general this parameter should be viewed as a system tuning tool and left severely alone. See also - write raw.

    Default: read raw = yes

    read size (G)

    The option read size + write raw.

    Default: read raw = yes

    read size (G)

    The option read size affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger @@ -2284,101 +2335,101 @@ print5|My Printer 5 has been done yet to determine the optimal value, and it is likely that the best value will vary greatly between systems anyway. A value over 65536 is pointless and will cause you to allocate - memory unnecessarily.

    Default: read size = 16384

    Example: read size = 8192

    realm (G)

    This option specifies the kerberos realm to use. The realm is - used as the ADS equivalent of the NT4 domain. It + memory unnecessarily.

    Default: read size = 16384

    Example: read size = 8192

    realm (G)

    This option specifies the kerberos realm to use. The realm is + used as the ADS equivalent of the NT4 domain. It is usually set to the DNS name of the kerberos server. -

    Default: realm =

    Example: realm = mysambabox.mycompany.com

    remote announce (G)

    This option allows you to setup nmbd(8)to periodically announce itself +

    Default: realm =

    Example: realm = mysambabox.mycompany.com

    remote announce (G)

    This option allows you to setup nmbd(8)to periodically announce itself to arbitrary IP addresses with an arbitrary workgroup name.

    This is useful if you want your Samba server to appear in a remote workgroup for which the normal browse propagation rules don't work. The remote workgroup can be anywhere that you - can send IP packets to.

    For example:

    remote announce = 192.168.2.255/SERVERS - 192.168.4.255/STAFF

    the above line would cause nmbd to announce itself + can send IP packets to.

    For example:

    remote announce = 192.168.2.255/SERVERS + 192.168.4.255/STAFF

    the above line would cause nmbd to announce itself to the two given IP addresses using the given workgroup names. If you leave out the workgroup name then the one given in - the workgroup + the workgroup parameter is used instead.

    The IP addresses you choose would normally be the broadcast addresses of the remote networks, but can also be the IP addresses of known browse masters if your network config is that stable.

    See the documentation file BROWSING - in the docs/ directory.

    Default: remote announce = <empty string>

    remote browse sync (G)

    This option allows you to setup nmbd(8) to periodically request + in the docs/ directory.

    Default: remote announce = <empty string>

    remote browse sync (G)

    This option allows you to setup nmbd(8) to periodically request synchronization of browse lists with the master browser of a Samba server that is on a remote segment. This option will allow you to gain browse lists for multiple workgroups across routed networks. This is done in a manner that does not work with any non-Samba servers.

    This is useful if you want your Samba server and all local clients to appear in a remote workgroup for which the normal browse propagation rules don't work. The remote workgroup can be anywhere - that you can send IP packets to.

    For example:

    remote browse sync = 192.168.2.255 192.168.4.255

    the above line would cause nmbd to request + that you can send IP packets to.

    For example:

    remote browse sync = 192.168.2.255 192.168.4.255

    the above line would cause nmbd to request the master browser on the specified subnets or addresses to synchronize their browse lists with the local server.

    The IP addresses you choose would normally be the broadcast addresses of the remote networks, but can also be the IP addresses of known browse masters if your network config is that stable. If a machine IP address is given Samba makes NO attempt to validate that the remote machine is available, is listening, nor that it - is in fact the browse master on its segment.

    Default: remote browse sync = <empty string>

    restrict anonymous (G)

    This is a integer parameter, and mirrors as much as possible the functinality the - RestrictAnonymous registry key does on NT/Win2k. -

    Default: restrict anonymous = 0

    root directory (G)

    The server will chroot() (i.e. + is in fact the browse master on its segment.

    Default: remote browse sync = <empty string>

    restrict anonymous (G)

    The setting of this parameter determines whether user and + group list information is returned for an anonymous connection. + and mirrors the effects of the + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\RestrictAnonymous registry key in Windows + 2000 and Windows NT. When set to 0, user and group list + information is returned to anyone who asks. When set + to 1, only an authenticated user can retrive user and + group list information. For the value 2, supported by + Windows 2000/XP and Samba, no anonymous connections are allowed at + all. This can break third party and Microsoft + applications which expect to be allowed to perform + operations anonymously.

    + The security advantage of using restrict anonymous = 1 is dubious, + as user and group list information can be obtained using other + means. +

    Note

    + The security advantage of using restrict anonymous = 2 is removed + by setting guest + ok = yes on any share. +

    Default: restrict anonymous = 0

    root (G)

    Synonym for + root directory". +

    root dir (G)

    Synonym for + root directory". +

    root directory (G)

    The server will chroot() (i.e. Change its root directory) to this directory on startup. This is not strictly necessary for secure operation. Even without it the server will deny access to files not in one of the service entries. It may also check for, and deny access to, soft links to other parts of the filesystem, or attempts to use ".." in file names to access other directories (depending on the setting of the - wide links + wide links parameter). -

    Adding a root directory entry other +

    Adding a root directory entry other than "/" adds an extra level of security, but at a price. It absolutely ensures that no access is given to files not in the - sub-tree specified in the root directory + sub-tree specified in the root directory option, including some files needed for complete operation of the server. To maintain full operability of the server you will need to mirror some system files - into the root directory tree. In particular - you will need to mirror /etc/passwd (or a + into the root directory tree. In particular + you will need to mirror /etc/passwd (or a subset of it), and any binaries or configuration files needed for printing (if required). The set of files that must be mirrored is - operating system dependent.

    Default: root directory = /

    Example: root directory = /homes/smb

    root dir (G)

    Synonym for - root directory". -

    root postexec (S)

    This is the same as the postexec + operating system dependent.

    Default: root directory = /

    Example: root directory = /homes/smb

    root postexec (S)

    This is the same as the postexec parameter except that the command is run as root. This is useful for unmounting filesystems - (such as CDROMs) after a connection is closed.

    See also - postexec.

    Default: root postexec = <empty string>

    root preexec close (S)

    This is the same as the preexec close - parameter except that the command is run as root.

    See also - preexec and - preexec close.

    Default: root preexec close = no

    root preexec (S)

    This is the same as the preexec + (such as CDROMs) after a connection is closed.

    See also + postexec.

    Default: root postexec = <empty string>

    root preexec (S)

    This is the same as the preexec parameter except that the command is run as root. This is useful for mounting filesystems (such as CDROMs) when a - connection is opened.

    See also + connection is opened.

    See also preexec and - preexec close.

    Default: root preexec = <empty string>

    root (G)

    Synonym for - root directory". -

    security mask (S)

    This parameter controls what UNIX permission - bits can be modified when a Windows NT client is manipulating - the UNIX permission on a file using the native NT security - dialog box.

    This parameter is applied as a mask (AND'ed with) to - the changed permission bits, thus preventing any bits not in - this mask from being modified. Essentially, zero bits in this - mask may be treated as a set of bits the user is not allowed - to change.

    If not set explicitly this parameter is 0777, allowing - a user to modify all the user/group/world permissions on a file. -

    Note that users who can access the - Samba server through other means can easily bypass this - restriction, so it is primarily useful for standalone - "appliance" systems. Administrators of most normal systems will - probably want to leave it set to 0777.

    See also the - force directory security mode, - directory - security mask, - force security mode parameters.

    Default: security mask = 0777

    Example: security mask = 0770

    security (G)

    This option affects how clients respond to - Samba and is one of the most important settings in the + preexec close.

    Default: root preexec = <empty string>

    root preexec close (S)

    This is the same as the preexec close + parameter except that the command is run as root.

    See also + preexec and + preexec close.

    Default: root preexec close = no

    security (G)

    This option affects how clients respond to + Samba and is one of the most important settings in the smb.conf file.

    The option sets the "security mode bit" in replies to - protocol negotiations with smbd(8) to turn share level security on or off. Clients decide + protocol negotiations with smbd(8) to turn share level security on or off. Clients decide based on this bit whether (and how) to transfer user and password - information to the server.

    The default is security = user, as this is + information to the server.

    The default is security = user, as this is the most common setting needed when talking to Windows 98 and - Windows NT.

    The alternatives are security = share, - security = server or security = domain + Windows NT.

    The alternatives are security = share, + security = server or security = domain .

    In versions of Samba prior to 2.0.0, the default was - security = share mainly because that was + security = share mainly because that was the only option at one stage.

    There is a bug in WfWg that has relevance to this setting. When in user or server level security a WfWg client will totally ignore the password you type in the "connect @@ -2386,36 +2437,36 @@ print5|My Printer 5 to connect to a Samba service as anyone except the user that you are logged into WfWg as.

    If your PCs use usernames that are the same as their usernames on the UNIX machine then you will want to use - security = user. If you mostly use usernames - that don't exist on the UNIX box then use security = - share.

    You should also use security = share if you + security = user. If you mostly use usernames + that don't exist on the UNIX box then use security = + share.

    You should also use security = share if you want to mainly setup shares without a password (guest shares). This is commonly used for a shared printer server. It is more difficult - to setup guest shares with security = user, see - the map to guest - parameter for details.

    It is possible to use smbd in a + to setup guest shares with security = user, see + the map to guest + parameter for details.

    It is possible to use smbd in a hybrid mode where it is offers both user and share level security under different - NetBIOS aliases.

    The different settings will now be explained.

    SECURITY = SHARE

    When clients connect to a share level security server they + NetBIOS aliases.

    The different settings will now be explained.

    SECURITY = SHARE

    When clients connect to a share level security server they need not log onto the server with a valid username and password before attempting to connect to a shared resource (although modern clients such as Windows 95/98 and Windows NT will send a logon request with - a username but no password when talking to a security = share + a username but no password when talking to a security = share server). Instead, the clients send authentication information (passwords) on a per-share basis, at the time they attempt to connect - to that share.

    Note that smbd ALWAYS + to that share.

    Note that smbd ALWAYS uses a valid UNIX user to act on behalf of the client, even in - security = share level security.

    As clients are not required to send a username to the server - in share level security, smbd uses several + security = share level security.

    As clients are not required to send a username to the server + in share level security, smbd uses several techniques to determine the correct UNIX user to use on behalf of the client.

    A list of possible UNIX usernames to match with the given - client password is constructed using the following methods :

    • If the guest + client password is constructed using the following methods :

      • If the guest only parameter is set, then all the other stages are missed and only the - guest account username is checked. + guest account username is checked.

      • Is a username is sent with the share connection request, then this username (after mapping - see - username map), + username map), is added as a potential username.

      • If the client did a previous logon request (the SessionSetup SMB call) then the @@ -2424,69 +2475,68 @@ print5|My Printer 5 added as a potential username.

      • The NetBIOS name of the client is added to the list as a potential username. -

      • Any users on the +

      • Any users on the user list are added as potential usernames. -

      If the guest only parameter is +

    If the guest only parameter is not set, then this list is then tried with the supplied password. The first user for whom the password matches will be used as the - UNIX user.

    If the guest only parameter is + UNIX user.

    If the guest only parameter is set, or no username can be determined then if the share is marked - as available to the guest account, then this + as available to the guest account, then this guest user will be used, otherwise access is denied.

    Note that it can be very confusing in share-level security as to which UNIX username will eventually be used in granting access.

    See also the section NOTE ABOUT USERNAME/PASSWORD VALIDATION.

    SECURITY = USER

    This is the default security setting in Samba 3.0. With user-level security a client must first "log-on" with a valid username and password (which can be mapped using the - username map + username map parameter). Encrypted passwords (see the - encrypted passwords parameter) can also + encrypted passwords parameter) can also be used in this security mode. Parameters such as - user and - guest only if set are then applied and + user and + guest only if set are then applied and may change the UNIX user to use on this connection, but only after the user has been successfully authenticated.

    Note that the name of the resource being requested is not sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing the server to automatically map unknown users into the - guest account. - See the map to guest + guest account. + See the map to guest parameter for details on doing this.

    See also the section - NOTE ABOUT USERNAME/PASSWORD VALIDATION.

    SECURITY = DOMAIN

    This mode will only work correctly if net(8) has been used to add this + NOTE ABOUT USERNAME/PASSWORD VALIDATION.

    SECURITY = DOMAIN

    This mode will only work correctly if net(8) has been used to add this machine into a Windows NT Domain. It expects the - encrypted passwords - parameter to be set to yes. In this + encrypted passwords + parameter to be set to yes. In this mode Samba will try to validate the username/password by passing it to a Windows NT Primary or Backup Domain Controller, in exactly the same way that a Windows NT Server would do.

    Note that a valid UNIX user must still exist as well as the account on the Domain Controller to allow Samba to have a valid UNIX account to map file access to.

    Note that from the client's point - of view security = domain is the same - as security = user. It only + of view security = domain is the same + as security = user. It only affects how the server deals with the authentication, it does not in any way affect what the client sees.

    Note that the name of the resource being requested is not sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing the server to automatically map unknown users into the - guest account. - See the map to guest + guest account. + See the map to guest parameter for details on doing this.

    See also the section - NOTE ABOUT USERNAME/PASSWORD VALIDATION.

    See also the password + NOTE ABOUT USERNAME/PASSWORD VALIDATION.

    See also the password server parameter and the - encrypted passwords + encrypted passwords parameter.

    SECURITY = SERVER

    In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an NT box. If this - fails it will revert to security = + fails it will revert to security = user. It expects the - encrypted passwords parameter - to be set to yes, unless the remote server + encrypted passwords parameter + to be set to yes, unless the remote server does not support them. However note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, - it must have a valid smbpasswd file to check - users against. See the documentation file in the docs/ directory - ENCRYPTION.txt for details on how to set this up.

    Note this mode of operation has + it must have a valid smbpasswd file to check + users against. See the chapter about the User Database in the Samba HOWTO Collection for details on how to set this up.

    Note this mode of operation has significant pitfalls, due to the fact that is activly initiates a man-in-the-middle attack on the remote SMB server. In particular, this mode of operation can cause significant resource consuption on @@ -2495,66 +2545,83 @@ print5|My Printer 5 there is no way to reestablish it, and futher authenticaions to the Samba server may fail. (From a single client, till it disconnects).

    Note that from the client's point of - view security = server is the - same as security = user. It + view security = server is the + same as security = user. It only affects how the server deals with the authentication, it does not in any way affect what the client sees.

    Note that the name of the resource being requested is not sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing the server to automatically map unknown users into the - guest account. - See the map to guest + guest account. + See the map to guest parameter for details on doing this.

    See also the section - NOTE ABOUT USERNAME/PASSWORD VALIDATION.

    See also the password + NOTE ABOUT USERNAME/PASSWORD VALIDATION.

    See also the password server parameter and the - encrypted passwords parameter.

    Default: security = USER

    Example: security = DOMAIN

    server schannel (G)

    This controls whether the server offers or even + encrypted passwords parameter.

    Default: security = USER

    Example: security = DOMAIN

    security mask (S)

    This parameter controls what UNIX permission + bits can be modified when a Windows NT client is manipulating + the UNIX permission on a file using the native NT security + dialog box.

    This parameter is applied as a mask (AND'ed with) to + the changed permission bits, thus preventing any bits not in + this mask from being modified. Essentially, zero bits in this + mask may be treated as a set of bits the user is not allowed + to change.

    If not set explicitly this parameter is 0777, allowing + a user to modify all the user/group/world permissions on a file. +

    Note that users who can access the + Samba server through other means can easily bypass this + restriction, so it is primarily useful for standalone + "appliance" systems. Administrators of most normal systems will + probably want to leave it set to 0777.

    See also the + force directory security mode, + directory + security mask, + force security mode parameters.

    Default: security mask = 0777

    Example: security mask = 0770

    server schannel (G)

    This controls whether the server offers or even demands the use of the netlogon schannel. - server schannel = no does not - offer the schannel, server schannel = + server schannel = no does not + offer the schannel, server schannel = auto offers the schannel but does not - enforce it, and server schannel = + enforce it, and server schannel = yes denies access if the client is not able to speak netlogon schannel. This is only the case for Windows NT4 before SP4.

    Please note that with this set to - no you will have to apply the + no you will have to apply the WindowsXP requireSignOrSeal-Registry patch found in - the docs/Registry subdirectory.

    Default: server schannel = auto

    Example: server schannel = yes

    server string (G)

    This controls what string will show up in the printer comment box in print - manager and next to the IPC connection in net view. It + the docs/Registry subdirectory.

    Default: server schannel = auto

    Example: server schannel = yes

    server string (G)

    This controls what string will show up in the printer comment box in print + manager and next to the IPC connection in net view. It can be any string that you wish to show to your users.

    It also sets what will appear in browse lists next - to the machine name.

    A %v will be replaced with the Samba - version number.

    A %h will be replaced with the - hostname.

    Default: server string = Samba %v

    Example: server string = University of GNUs Samba - Server

    set directory (S)

    If set directory = no, then + to the machine name.

    A %v will be replaced with the Samba + version number.

    A %h will be replaced with the + hostname.

    Default: server string = Samba %v

    Example: server string = University of GNUs Samba + Server

    set directory (S)

    If set directory = no, then users of the service may not use the setdir command to change - directory.

    The setdir command is only implemented + directory.

    The setdir command is only implemented in the Digital Pathworks client. See the Pathworks documentation - for details.

    Default: set directory = no

    set primary group script (G)

    Thanks to the Posix subsystem in NT a Windows User has a + for details.

    Default: set directory = no

    set primary group script (G)

    Thanks to the Posix subsystem in NT a Windows User has a primary group in addition to the auxiliary groups. This script sets the primary group in the unix userdatase when an administrator sets the primary group from the windows user - manager or when fetching a SAM with net rpc - vampire. %u will be replaced + manager or when fetching a SAM with net rpc + vampire. %u will be replaced with the user whose primary group is to be set. - %g will be replaced with the group to - set.

    Default: No default value

    Example: set primary group script = /usr/sbin/usermod -g '%g' '%u'

    share modes (S)

    This enables or disables the honoring of - the share modes during a file open. These + %g will be replaced with the group to + set.

    Default: No default value

    Example: set primary group script = /usr/sbin/usermod -g '%g' '%u'

    share modes (S)

    This enables or disables the honoring of + the share modes during a file open. These modes are used by clients to gain exclusive read or write access to a file.

    These open modes are not directly supported by UNIX, so they are simulated using shared memory, or lock files if your UNIX doesn't support shared memory (almost all do).

    The share modes that are enabled by this option are - DENY_DOS, DENY_ALL, - DENY_READ, DENY_WRITE, - DENY_NONE and DENY_FCB. + DENY_DOS, DENY_ALL, + DENY_READ, DENY_WRITE, + DENY_NONE and DENY_FCB.

    This option gives full share compatibility and enabled by default.

    You should NEVER turn this parameter - off as many Windows applications will break if you do so.

    Default: share modes = yes

    short preserve case (S)

    This boolean parameter controls if new files + off as many Windows applications will break if you do so.

    Default: share modes = yes

    short preserve case (S)

    This boolean parameter controls if new files which conform to 8.3 syntax, that is all in upper case and of suitable length, are created upper case, or if they are forced - to be the default case - . This option can be use with preserve case = yes + to be the default case + . This option can be use with preserve case = yes to permit long filenames to retain their case, while short - names are lowered.

    See the section on NAME MANGLING.

    Default: short preserve case = yes

    show add printer wizard (G)

    With the introduction of MS-RPC based printing support + names are lowered.

    See the section on NAME MANGLING.

    Default: short preserve case = yes

    show add printer wizard (G)

    With the introduction of MS-RPC based printing support for Windows NT/2000 client in Samba 2.2, a "Printers..." folder will appear on Samba hosts in the share listing. Normally this folder will contain an icon for the MS Add Printer Wizard (APW). However, it is @@ -2563,25 +2630,25 @@ print5|My Printer 5 open a handle on the printer server with OpenPrinterEx() asking for Administrator privileges. If the user does not have administrative access on the print server (i.e is not root or a member of the - printer admin group), the OpenPrinterEx() + printer admin group), the OpenPrinterEx() call fails and the client makes another open call with a request for a lower privilege level. This should succeed, however the APW - icon will not be displayed.

    Disabling the show add printer wizard + icon will not be displayed.

    Disabling the show add printer wizard parameter will always cause the OpenPrinterEx() on the server to fail. Thus the APW icon will never be displayed. Note :This does not prevent the same user from having - administrative privilege on an individual printer.

    See also addprinter + administrative privilege on an individual printer.

    See also addprinter command, - deleteprinter command, - printer admin

    Default :show add printer wizard = yes

    shutdown script (G)

    This parameter only exists in the HEAD cvs branch - This a full path name to a script called by smbd(8) that should start a shutdown procedure.

    This command will be run as the user connected to the server.

    %m %t %r %f parameters are expanded:

    • %m will be substituted with the - shutdown message sent to the server.

    • %t will be substituted with the + deleteprinter command, + printer admin

      Default :show add printer wizard = yes

    shutdown script (G)

    This parameter only exists in the HEAD cvs branch + This a full path name to a script called by smbd(8) that should start a shutdown procedure.

    This command will be run as the user connected to the server.

    %m %t %r %f parameters are expanded:

    • %m will be substituted with the + shutdown message sent to the server.

    • %t will be substituted with the number of seconds to wait before effectively starting the - shutdown procedure.

    • %r will be substituted with the + shutdown procedure.

    • %r will be substituted with the switch -r. It means reboot after shutdown - for NT.

    • %f will be substituted with the + for NT.

    • %f will be substituted with the switch -f. It means force the shutdown - even if applications do not respond for NT.

    Default: None.

    Example: abort shutdown script = /usr/local/samba/sbin/shutdown %m %t %r %f

    Shutdown script example: + even if applications do not respond for NT.

    Default: None.

    Example: abort shutdown script = /usr/local/samba/sbin/shutdown %m %t %r %f

    Shutdown script example: 

     #!/bin/bash
 		
@@ -2593,12 +2660,12 @@ let "time++"

    Shutdown does not return so we need to launch it in background.

    See also - abort shutdown script.

    smb passwd file (G)

    This option sets the path to the encrypted smbpasswd file. By - default the path to the smbpasswd file is compiled into Samba.

    Default: smb passwd file = ${prefix}/private/smbpasswd

    Example: smb passwd file = /etc/samba/smbpasswd

    smb ports (G)

    Specifies which ports the server should listen on for SMB traffic.

    Default: smb ports = 445 139

    socket address (G)

    This option allows you to control what + abort shutdown script.

    smb passwd file (G)

    This option sets the path to the encrypted smbpasswd file. By + default the path to the smbpasswd file is compiled into Samba.

    Default: smb passwd file = ${prefix}/private/smbpasswd

    Example: smb passwd file = /etc/samba/smbpasswd

    smb ports (G)

    Specifies which ports the server should listen on for SMB traffic.

    Default: smb ports = 445 139

    socket address (G)

    This option allows you to control what address Samba will listen for connections on. This is used to support multiple virtual interfaces on the one server, each with a different configuration.

    By default Samba will accept connections on any - address.

    Example: socket address = 192.168.2.20

    socket options (G)

    This option allows you to set socket options + address.

    Example: socket address = 192.168.2.20

    socket options (G)

    This option allows you to set socket options to be used when talking with the client.

    Socket options are controls on the networking layer of the operating systems which allow the connection to be tuned.

    This option will typically be used to tune your Samba server @@ -2606,7 +2673,7 @@ Shutdown does not return so we need to launch it in background. that Samba can know what the optimal parameters are for your net, so you must experiment and choose them yourself. We strongly suggest you read the appropriate documentation for your operating - system first (perhaps man + system first (perhaps man setsockopt will help).

    You may find that on some systems Samba will say "Unknown socket option" when you supply an option. This means you either incorrectly typed it or you need to add an include file @@ -2618,114 +2685,114 @@ Shutdown does not return so we need to launch it in background. argument. The others can optionally take a 1 or 0 argument to enable or disable the option, by default they will be enabled if you don't specify 1 or 0.

    To specify an argument use the syntax SOME_OPTION = VALUE - for example SO_SNDBUF = 8192. Note that you must + for example SO_SNDBUF = 8192. Note that you must not have any spaces before or after the = sign.

    If you are on a local network then a sensible option - might be:

    socket options = IPTOS_LOWDELAY

    If you have a local network then you could try:

    socket options = IPTOS_LOWDELAY TCP_NODELAY

    If you are on a wide area network then perhaps try + might be:

    socket options = IPTOS_LOWDELAY

    If you have a local network then you could try:

    socket options = IPTOS_LOWDELAY TCP_NODELAY

    If you are on a wide area network then perhaps try setting IPTOS_THROUGHPUT.

    Note that several of the options may cause your Samba - server to fail completely. Use these options with caution!

    Default: socket options = TCP_NODELAY

    Example: socket options = IPTOS_LOWDELAY

    source environment (G)

    This parameter causes Samba to set environment + server to fail completely. Use these options with caution!

    Default: socket options = TCP_NODELAY

    Example: socket options = IPTOS_LOWDELAY

    source environment (G)

    This parameter causes Samba to set environment variables as per the content of the file named.

    If the value of this parameter starts with a "|" character then Samba will treat that value as a pipe command to open and will set the environment variables from the output of the pipe.

    The contents of the file or the output of the pipe should - be formatted as the output of the standard Unix env(1) command. This is of the form:

    Example environment entry:

    SAMBA_NETBIOS_NAME = myhostname

    Default: No default value

    Examples: source environment = |/etc/smb.conf.sh

    Example: source environment = - /usr/local/smb_env_vars

    stat cache size (G)

    This parameter determines the number of - entries in the stat cache. You should - never need to change this parameter.

    Default: stat cache size = 50

    stat cache (G)

    This parameter determines if smbd(8) will use a cache in order to + be formatted as the output of the standard Unix env(1) command. This is of the form:

    Example environment entry:

    SAMBA_NETBIOS_NAME = myhostname

    Default: No default value

    Examples: source environment = |/etc/smb.conf.sh

    Example: source environment = + /usr/local/smb_env_vars

    stat cache (G)

    This parameter determines if smbd(8) will use a cache in order to speed up case insensitive name mappings. You should never need - to change this parameter.

    Default: stat cache = yes

    strict allocate (S)

    This is a boolean that controls the handling of - disk space allocation in the server. When this is set to yes + to change this parameter.

    Default: stat cache = yes

    stat cache size (G)

    This parameter determines the number of + entries in the stat cache. You should + never need to change this parameter.

    Default: stat cache size = 50

    strict allocate (S)

    This is a boolean that controls the handling of + disk space allocation in the server. When this is set to yes the server will change from UNIX behaviour of not committing real disk storage blocks when a file is extended to the Windows behaviour of actually forcing the disk system to allocate real storage blocks when a file is created or extended to be a given size. In UNIX terminology this means that Samba will stop creating sparse files. - This can be slow on some systems.

    When strict allocate is no the server does sparse - disk block allocation when a file is extended.

    Setting this to yes can help Samba return + This can be slow on some systems.

    When strict allocate is no the server does sparse + disk block allocation when a file is extended.

    Setting this to yes can help Samba return out of quota messages on systems that are restricting the disk quota - of users.

    Default: strict allocate = no

    strict locking (S)

    This is a boolean that controls the handling of - file locking in the server. When this is set to yes + of users.

    Default: strict allocate = no

    strict locking (S)

    This is a boolean that controls the handling of + file locking in the server. When this is set to yes the server will check every read and write access for file locks, and - deny access if locks exist. This can be slow on some systems.

    When strict locking is no the server does file + deny access if locks exist. This can be slow on some systems.

    When strict locking is no the server does file lock checks only when the client explicitly asks for them.

    Well-behaved clients always ask for lock checks when it - is important, so in the vast majority of cases strict - locking = no is preferable.

    Default: strict locking = no

    strict sync (S)

    Many Windows applications (including the Windows 98 explorer + is important, so in the vast majority of cases strict + locking = no is preferable.

    Default: strict locking = no

    strict sync (S)

    Many Windows applications (including the Windows 98 explorer shell) seem to confuse flushing buffer contents to disk with doing a sync to disk. Under UNIX, a sync call forces the process to be suspended until the kernel has ensured that all outstanding data in kernel disk buffers has been safely stored onto stable storage. This is very slow and should only be done rarely. Setting this - parameter to no (the default) means that - smbd(8) ignores the Windows + parameter to no (the default) means that + smbd(8) ignores the Windows applications requests for a sync call. There is only a possibility of losing data if the operating system itself that Samba is running on crashes, so there is little danger in this default setting. In addition, this fixes many performance problems that people have - reported with the new Windows98 explorer shell file copies.

    See also the sync - always parameter.

    Default: strict sync = no

    strip dot (G)

    This is a boolean that controls whether to + reported with the new Windows98 explorer shell file copies.

    See also the sync + always parameter.

    Default: strict sync = no

    strip dot (G)

    This is a boolean that controls whether to strip trailing dots off UNIX filenames. This helps with some - CDROMs that have filenames ending in a single dot.

    Default: strip dot = no

    sync always (S)

    This is a boolean parameter that controls + CDROMs that have filenames ending in a single dot.

    Default: strip dot = no

    sync always (S)

    This is a boolean parameter that controls whether writes will always be written to stable storage before - the write call returns. If this is no then the server will be + the write call returns. If this is no then the server will be guided by the client's request in each write call (clients can set a bit indicating that a particular write should be synchronous). - If this is yes then every write will be followed by a fsync() + If this is yes then every write will be followed by a fsync() call to ensure the data is written to disk. Note that - the strict sync parameter must be set to - yes in order for this parameter to have - any affect.

    See also the strict - sync parameter.

    Default: sync always = no

    syslog only (G)

    If this parameter is set then Samba debug - messages are logged into the system syslog only, and not to - the debug log files.

    Default: syslog only = no

    syslog (G)

    This parameter maps how Samba debug messages + the strict sync parameter must be set to + yes in order for this parameter to have + any affect.

    See also the strict + sync parameter.

    Default: sync always = no

    syslog (G)

    This parameter maps how Samba debug messages are logged onto the system syslog logging levels. Samba debug - level zero maps onto syslog LOG_ERR, debug - level one maps onto LOG_WARNING, debug level - two maps onto LOG_NOTICE, debug level three - maps onto LOG_INFO. All higher levels are mapped to + level zero maps onto syslog LOG_ERR, debug + level one maps onto LOG_WARNING, debug level + two maps onto LOG_NOTICE, debug level three + maps onto LOG_INFO. All higher levels are mapped to LOG_DEBUG.

    This parameter sets the threshold for sending messages to syslog. Only messages with debug level less than this value - will be sent to syslog.

    Default: syslog = 1

    template homedir (G)

    When filling out the user information for a Windows NT - user, the winbindd(8) daemon uses this + will be sent to syslog.

    Default: syslog = 1

    syslog only (G)

    If this parameter is set then Samba debug + messages are logged into the system syslog only, and not to + the debug log files.

    Default: syslog only = no

    template homedir (G)

    When filling out the user information for a Windows NT + user, the winbindd(8) daemon uses this parameter to fill in the home directory for that user. If the - string %D is present it + string %D is present it is substituted with the user's Windows NT domain name. If the - string %U is present it - is substituted with the user's Windows NT user name.

    Default: template homedir = /home/%D/%U

    template shell (G)

    When filling out the user information for a Windows NT - user, the winbindd(8) daemon uses this - parameter to fill in the login shell for that user.

    Default: template shell = /bin/false

    time offset (G)

    This parameter is a setting in minutes to add + string %U is present it + is substituted with the user's Windows NT user name.

    Default: template homedir = /home/%D/%U

    template shell (G)

    When filling out the user information for a Windows NT + user, the winbindd(8) daemon uses this + parameter to fill in the login shell for that user.

    Default: template shell = /bin/false

    time offset (G)

    This parameter is a setting in minutes to add to the normal GMT to local time conversion. This is useful if you are serving a lot of PCs that have incorrect daylight - saving time handling.

    Default: time offset = 0

    Example: time offset = 60

    time server (G)

    This parameter determines if nmbd(8) advertises itself as a time server to Windows - clients.

    Default: time server = no

    timestamp logs (G)

    Synonym for + saving time handling.

    Default: time offset = 0

    Example: time offset = 60

    time server (G)

    This parameter determines if nmbd(8) advertises itself as a time server to Windows + clients.

    Default: time server = no

    timestamp logs (G)

    Synonym for debug timestamp.

    total print jobs (G)

    This parameter accepts an integer value which defines a limit on the maximum number of print jobs that will be accepted system wide at any given time. If a print job is submitted - by a client which will exceed this number, then smbd(8) will return an + by a client which will exceed this number, then smbd(8) will return an error indicating that no space is available on the server. The default value of 0 means that no such limit exists. This parameter can be used to prevent a server from exceeding its capacity and is designed as a printing throttle. See also - max print jobs. -

    Default: total print jobs = 0

    Example: total print jobs = 5000

    unicode (G)

    Specifies whether Samba should try + max print jobs. +

    Default: total print jobs = 0

    Example: total print jobs = 5000

    unicode (G)

    Specifies whether Samba should try to use unicode on the wire by default. Note: This does NOT mean that samba will assume that the unix machine uses unicode! -

    Default: unicode = yes

    unix charset (G)

    Specifies the charset the unix machine +

    Default: unicode = yes

    unix charset (G)

    Specifies the charset the unix machine Samba runs on uses. Samba needs to know this in order to be able to convert text to the charsets other SMB clients use. -

    Default: unix charset = UTF8

    Example: unix charset = ASCII

    unix extensions (G)

    This boolean parameter controls whether Samba +

    Default: unix charset = UTF8

    Example: unix charset = ASCII

    unix extensions (G)

    This boolean parameter controls whether Samba implments the CIFS UNIX extensions, as defined by HP. These extensions enable Samba to better serve UNIX CIFS clients by supporting features such as symbolic links, hard links, etc... These extensions require a similarly enabled client, and are of - no current use to Windows clients.

    Default: unix extensions = no

    unix password sync (G)

    This boolean parameter controls whether Samba + no current use to Windows clients.

    Default: unix extensions = no

    unix password sync (G)

    This boolean parameter controls whether Samba attempts to synchronize the UNIX password with the SMB password when the encrypted SMB password in the smbpasswd file is changed. - If this is set to yes the program specified in the passwd + If this is set to yes the program specified in the passwd programparameter is called AS ROOT - to allow the new UNIX password to be set without access to the old UNIX password (as the SMB password change code has no - access to the old password cleartext, only the new).

    See also passwd - program, + access to the old password cleartext, only the new).

    See also passwd + program, passwd chat. -

    Default: unix password sync = no

    update encrypted (G)

    This boolean parameter allows a user logging on with +

    Default: unix password sync = no

    update encrypted (G)

    This boolean parameter allows a user logging on with a plaintext password to have their encrypted (hashed) password in the smbpasswd file to be updated automatically as they log on. This option allows a site to migrate from plaintext @@ -2738,19 +2805,19 @@ Shutdown does not return so we need to launch it in background. over to encrypted passwords to be made over a longer period. Once all users have encrypted representations of their passwords in the smbpasswd file this parameter should be set to - no.

    In order for this parameter to work correctly the - encrypt passwords parameter must - be set to no when this parameter is set to yes.

    Note that even when this parameter is set a user - authenticating to smbd must still enter a valid + no.

    In order for this parameter to work correctly the + encrypt passwords parameter must + be set to no when this parameter is set to yes.

    Note that even when this parameter is set a user + authenticating to smbd must still enter a valid password in order to connect correctly, and to update their hashed - (smbpasswd) passwords.

    Default: update encrypted = no

    use client driver (S)

    This parameter applies only to Windows NT/2000 - clients. It has no affect on Windows 95/98/ME clients. When + (smbpasswd) passwords.

    Default: update encrypted = no

    use client driver (S)

    This parameter applies only to Windows NT/2000 + clients. It has no effect on Windows 95/98/ME clients. When serving a printer to Windows NT/2000 clients without first installing a valid printer driver on the Samba host, the client will be required to install a local printer driver. From this point on, the client will treat the print as a local printer and not a network printer connection. This is much the same behavior that will occur - when disable spoolss = yes. + when disable spoolss = yes.

    The differentiating factor is that under normal circumstances, the NT/2000 client will attempt to open the network printer using MS-RPC. The problem is that because the client @@ -2766,14 +2833,49 @@ Shutdown does not return so we need to launch it in background. to PRINTER_ACCESS_USE instead. Thus allowing the OpenPrinterEx() call to succeed. This parameter MUST not be able enabled on a print share which has valid print driver installed on the Samba - server.

    See also disable spoolss

    Default: use client driver = no

    use mmap (G)

    This global parameter determines if the tdb internals of Samba can + server.

    See also disable spoolss

    Default: use client driver = no

    use mmap (G)

    This global parameter determines if the tdb internals of Samba can depend on mmap working correctly on the running system. Samba requires a coherent mmap/read-write system memory cache. Currently only HPUX does not have such a - coherent cache, and so this parameter is set to no by + coherent cache, and so this parameter is set to no by default on HPUX. On all other systems this parameter should be left alone. This parameter is provided to help the Samba developers track down problems with the tdb internal code. -

    Default: use mmap = yes

    username level (G)

    This option helps Samba to try and 'guess' at +

    Default: use mmap = yes

    user (S)

    Synonym for username.

    username (S)

    Multiple users may be specified in a comma-delimited + list, in which case the supplied password will be tested against + each username in turn (left to right).

    The username line is needed only when + the PC is unable to supply its own username. This is the case + for the COREPLUS protocol or where your users have different WfWg + usernames to UNIX usernames. In both these cases you may also be + better using the \\server\share%user syntax instead.

    The username line is not a great + solution in many cases as it means Samba will try to validate + the supplied password against each of the usernames in the + username line in turn. This is slow and + a bad idea for lots of users in case of duplicate passwords. + You may get timeouts or security breaches using this parameter + unwisely.

    Samba relies on the underlying UNIX security. This + parameter does not restrict who can login, it just offers hints + to the Samba server as to what usernames might correspond to the + supplied password. Users can login as whoever they please and + they will be able to do no more damage than if they started a + telnet session. The daemon runs as the user that they log in as, + so they cannot do anything that user cannot do.

    To restrict a service to a particular set of users you + can use the valid users + parameter.

    If any of the usernames begin with a '@' then the name + will be looked up first in the NIS netgroups list (if Samba + is compiled with netgroup support), followed by a lookup in + the UNIX groups database and will expand to a list of all users + in the group of that name.

    If any of the usernames begin with a '+' then the name + will be looked up only in the UNIX groups database and will + expand to a list of all users in the group of that name.

    If any of the usernames begin with a '&' then the name + will be looked up only in the NIS netgroups database (if Samba + is compiled with netgroup support) and will expand to a list + of all users in the netgroup group of that name.

    Note that searching though a groups database can take + quite some time, and some clients may time out during the + search.

    See the section NOTE ABOUT + USERNAME/PASSWORD VALIDATION for more information on how + this parameter determines access to the services.

    Default: The guest account if a guest service, + else <empty string>.

    Examples:username = fred, mary, jack, jane, + @users, @pcgroup

    username level (G)

    This option helps Samba to try and 'guess' at the real UNIX username, as many DOS clients send an all-uppercase username. By default Samba tries all lowercase, followed by the username with the first letter capitalized, and fails if the @@ -2782,8 +2884,8 @@ Shutdown does not return so we need to launch it in background. combinations to try while trying to determine the UNIX user name. The higher the number the more combinations will be tried, but the slower the discovery of usernames will be. Use this parameter when you have - strange usernames on your UNIX machine, such as AstrangeUser - .

    Default: username level = 0

    Example: username level = 5

    username map (G)

    This option allows you to specify a file containing + strange usernames on your UNIX machine, such as AstrangeUser + .

    Default: username level = 0

    Example: username level = 5

    username map (G)

    This option allows you to specify a file containing a mapping of usernames from the clients to the server. This can be used for several purposes. The most common is to map usernames that users use on DOS or Windows machines to those that the UNIX @@ -2802,13 +2904,13 @@ Shutdown does not return so we need to launch it in background. will stop after that line if a mapping was done by the line. Otherwise mapping continues with every line being processed. Using '!' is most useful when you have a wildcard mapping line - later in the file.

    For example to map from the name admin - or administrator to the UNIX name - root you would use:

    root = admin administrator

    Or to map anyone in the UNIX group system - to the UNIX name sys you would use:

    sys = @system

    You can have as many mappings as you like in a username map file.

    If your system supports the NIS NETGROUP option then - the netgroup database is checked before the /etc/group + later in the file.

    For example to map from the name admin + or administrator to the UNIX name + root you would use:

    root = admin administrator

    Or to map anyone in the UNIX group system + to the UNIX name sys you would use:

    sys = @system

    You can have as many mappings as you like in a username map file.

    If your system supports the NIS NETGROUP option then + the netgroup database is checked before the /etc/group database for matching groups.

    You can map Windows usernames that have spaces in them - by using double quotes around the name. For example:

    tridge = "Andrew Tridgell"

    would map the windows username "Andrew Tridgell" to the + by using double quotes around the name. For example:

    tridge = "Andrew Tridgell"

    would map the windows username "Andrew Tridgell" to the unix username "tridge".

    The following example would map mary and fred to the unix user sys, and map the rest to guest. Note the use of the '!' to tell Samba to stop processing if it gets a match on @@ -2816,107 +2918,79 @@ Shutdown does not return so we need to launch it in background. !sys = mary fred guest = *

    Note that the remapping is applied to all occurrences - of usernames. Thus if you connect to \\server\fred and - fred is remapped to mary then you + of usernames. Thus if you connect to \\server\fred and + fred is remapped to mary then you will actually be connecting to \\server\mary and will need to - supply a password suitable for mary not - fred. The only exception to this is the - username passed to the + supply a password suitable for mary not + fred. The only exception to this is the + username passed to the password server (if you have one). The password server will receive whatever username the client supplies without modification.

    Also note that no reverse mapping is done. The main effect this has is with printing. Users who have been mapped may have trouble deleting print jobs as PrintManager under WfWg will think - they don't own the print job.

    Default: no username map

    Example: username map = /usr/local/samba/lib/users.map

    username (S)

    Multiple users may be specified in a comma-delimited - list, in which case the supplied password will be tested against - each username in turn (left to right).

    The username line is needed only when - the PC is unable to supply its own username. This is the case - for the COREPLUS protocol or where your users have different WfWg - usernames to UNIX usernames. In both these cases you may also be - better using the \\server\share%user syntax instead.

    The username line is not a great - solution in many cases as it means Samba will try to validate - the supplied password against each of the usernames in the - username line in turn. This is slow and - a bad idea for lots of users in case of duplicate passwords. - You may get timeouts or security breaches using this parameter - unwisely.

    Samba relies on the underlying UNIX security. This - parameter does not restrict who can login, it just offers hints - to the Samba server as to what usernames might correspond to the - supplied password. Users can login as whoever they please and - they will be able to do no more damage than if they started a - telnet session. The daemon runs as the user that they log in as, - so they cannot do anything that user cannot do.

    To restrict a service to a particular set of users you - can use the valid users - parameter.

    If any of the usernames begin with a '@' then the name - will be looked up first in the NIS netgroups list (if Samba - is compiled with netgroup support), followed by a lookup in - the UNIX groups database and will expand to a list of all users - in the group of that name.

    If any of the usernames begin with a '+' then the name - will be looked up only in the UNIX groups database and will - expand to a list of all users in the group of that name.

    If any of the usernames begin with a '&' then the name - will be looked up only in the NIS netgroups database (if Samba - is compiled with netgroup support) and will expand to a list - of all users in the netgroup group of that name.

    Note that searching though a groups database can take - quite some time, and some clients may time out during the - search.

    See the section NOTE ABOUT - USERNAME/PASSWORD VALIDATION for more information on how - this parameter determines access to the services.

    Default: The guest account if a guest service, - else <empty string>.

    Examples:username = fred, mary, jack, jane, - @users, @pcgroup

    users (S)

    Synonym for - username.

    user (S)

    Synonym for username.

    use sendfile (S)

    If this parameter is yes, and Samba + they don't own the print job.

    Default: no username map

    Example: username map = /usr/local/samba/lib/users.map

    users (S)

    Synonym for + username.

    use sendfile (S)

    If this parameter is yes, and Samba was built with the --with-sendfile-support option, and the underlying operating system supports sendfile system call, then some SMB read calls (mainly ReadAndX and ReadRaw) will use the more efficient sendfile system call for files that are exclusively oplocked. This may make more efficient use of the system CPU's and cause Samba to be faster. This is off by default as it's effects are unknown - as yet.

    Default: use sendfile = no

    use spnego (G)

    This variable controls controls whether samba will try + as yet.

    Default: use sendfile = no

    use spnego (G)

    This variable controls controls whether samba will try to use Simple and Protected NEGOciation (as specified by rfc2478) with - WindowsXP and Windows2000sp2 clients to agree upon an authentication mechanism. + WindowsXP and Windows2000 clients to agree upon an authentication mechanism. Unless further issues are discovered with our SPNEGO implementation, there is no reason this should ever be - disabled.

    Default: use spnego = yes

    utmp directory (G)

    This parameter is only available if Samba has - been configured and compiled with the option - --with-utmp. It specifies a directory pathname that is - used to store the utmp or utmpx files (depending on the UNIX system) that - record user connections to a Samba server. See also the - utmp parameter. By default this is - not set, meaning the system will use whatever utmp file the - native system is set to use (usually - /var/run/utmp on Linux).

    Default: no utmp directory

    Example: utmp directory = /var/run/utmp

    utmp (G)

    This boolean parameter is only available if - Samba has been configured and compiled with the option - --with-utmp. If set to yes then Samba will attempt + disabled.

    Default: use spnego = yes

    utmp (G)

    This boolean parameter is only available if + Samba has been configured and compiled with the option + --with-utmp. If set to yes then Samba will attempt to add utmp or utmpx records (depending on the UNIX system) whenever a connection is made to a Samba server. Sites may use this to record the user connecting to a Samba share.

    Due to the requirements of the utmp record, we are required to create a unique identifier for the incoming user. Enabling this option creates an n^2 algorithm to find this number. This may impede - performance on large installations.

    See also the - utmp directory parameter.

    Default: utmp = no

    valid users (S)

    This is a list of users that should be allowed + performance on large installations.

    See also the + utmp directory parameter.

    Default: utmp = no

    utmp directory (G)

    This parameter is only available if Samba has + been configured and compiled with the option + --with-utmp. It specifies a directory pathname that is + used to store the utmp or utmpx files (depending on the UNIX system) that + record user connections to a Samba server. See also the + utmp parameter. By default this is + not set, meaning the system will use whatever utmp file the + native system is set to use (usually + /var/run/utmp on Linux).

    Default: no utmp directory

    Example: utmp directory = /var/run/utmp

    -valid (S)

    This parameter indicates whether a share is + valid and thus can be used. When this parameter is set to false, + the share will be in no way visible nor accessible. +

    + This option should not be + used by regular users but might be of help to developers. + Samba uses this option internally to mark shares as deleted. +

    Default: True

    valid users (S)

    This is a list of users that should be allowed to login to this service. Names starting with '@', '+' and '&' are interpreted using the same rules as described in the - invalid users parameter.

    If this is empty (the default) then any user can login. - If a username is in both this list and the invalid - users list then access is denied for that user.

    The current servicename is substituted for %S - . This is useful in the [homes] section.

    See also invalid users + invalid users parameter.

    If this is empty (the default) then any user can login. + If a username is in both this list and the invalid + users list then access is denied for that user.

    The current servicename is substituted for %S + . This is useful in the [homes] section.

    See also invalid users

    Default: No valid users list (anyone can login) -

    Example: valid users = greg, @pcusers

    veto files (S)

    This is a list of files and directories that +

    Example: valid users = greg, @pcusers

    veto files (S)

    This is a list of files and directories that are neither visible nor accessible. Each entry in the list must be separated by a '/', which allows spaces to be included in the entry. '*' and '?' can be used to specify multiple files or directories as in DOS wildcards.

    Each entry must be a unix path, not a DOS path and must not include the unix directory - separator '/'.

    Note that the case sensitive option + separator '/'.

    Note that the case sensitive option is applicable in vetoing files.

    One feature of the veto files parameter that it is important to be aware of is Samba's behaviour when trying to delete a directory. If a directory that is to be deleted contains nothing but veto files this deletion will fail unless you also set - the delete veto files parameter to - yes.

    Setting this parameter will affect the performance + the delete veto files parameter to + yes.

    Setting this parameter will affect the performance of Samba, as it will be forced to check all files and directories - for a match as they are scanned.

    See also hide files - and + for a match as they are scanned.

    See also hide files + and case sensitive.

    Default: No files or directories are vetoed.

    Examples: 

    @@ -2929,26 +3003,25 @@ veto files = /*Security*/*.tmp/*root*/
 ; creates.
 veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/
    veto oplock files (S)

    This parameter is only valid when the - oplocks + oplocks parameter is turned on for a share. It allows the Samba administrator to selectively turn off the granting of oplocks on selected files that match a wildcarded list, similar to the wildcarded list used in the - veto files + veto files parameter.

    Default: No files are vetoed for oplock grants

    You might want to do this on files that you know will be heavily contended for by clients. A good example of this is in the NetBench SMB benchmark program, which causes heavy - client contention for files ending in .SEM. + client contention for files ending in .SEM. To cause Samba not to grant oplocks on these files you would use the line (either in the [global] section or in the section for - the particular NetBench share :

    Example: veto oplock files = /*.SEM/

    vfs object (S)

    This parameter specifies a shared object files that + the particular NetBench share :

    Example: veto oplock files = /*.SEM/

    vfs object (S)

    Synonym for + + vfs objects + . +

    vfs objects (S)

    This parameter specifies the backend names which are used for Samba VFS I/O operations. By default, normal disk I/O operations are used but these can be overloaded - with one or more VFS objects.

    Default: no value

    vfs options (S)

    This parameter allows parameters to be passed - to the vfs layer at initialization time. - See also - vfs object.

    Default: no value

    vfs path (S)

    This parameter specifies the directory - to look in for vfs modules. The name of every vfs object - will be prepended by this directory.

    Default: vfs path =

    Example: vfs path = /usr/lib/samba/vfs

    volume (S)

    This allows you to override the volume label + with one or more VFS objects.

    Default: no value

    Example: vfs objects = extd_audit recycle

    volume (S)

    This allows you to override the volume label returned for a share. Useful for CDROMs with installation programs that insist on a particular volume label.

    Default: the name of the share

    wide links (S)

    This parameter controls whether or not links in the UNIX file system may be followed by the server. Links @@ -2956,52 +3029,52 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ server are always allowed; this parameter controls access only to areas that are outside the directory tree being exported.

    Note that setting this parameter can have a negative effect on your server performance due to the extra system calls - that Samba has to do in order to perform the link checks.

    Default: wide links = yes

    winbind cache time (G)

    This parameter specifies the number of - seconds the winbindd(8) daemon will cache + that Samba has to do in order to perform the link checks.

    Default: wide links = yes

    winbind cache time (G)

    This parameter specifies the number of + seconds the winbindd(8) daemon will cache user and group information before querying a Windows NT server - again.

    Default: winbind cache type = 15

    winbind enum groups (G)

    On large installations using winbindd(8) it may be necessary to suppress - the enumeration of groups through the setgrent(), - getgrent() and - endgrent() group of system calls. If - the winbind enum groups parameter is - no, calls to the getgrent() system + again.

    Default: winbind cache type = 15

    winbind enum groups (G)

    On large installations using winbindd(8) it may be necessary to suppress + the enumeration of groups through the setgrent(), + getgrent() and + endgrent() group of system calls. If + the winbind enum groups parameter is + no, calls to the getgrent() system call will not return any data.

    Warning: Turning off group enumeration may cause some programs to behave oddly. -

    Default: winbind enum groups = yes

    winbind enum users (G)

    On large installations using winbindd(8) it may be - necessary to suppress the enumeration of users through the setpwent(), - getpwent() and - endpwent() group of system calls. If - the winbind enum users parameter is - no, calls to the getpwent system call +

    Default: winbind enum groups = yes

    winbind enum users (G)

    On large installations using winbindd(8) it may be + necessary to suppress the enumeration of users through the setpwent(), + getpwent() and + endpwent() group of system calls. If + the winbind enum users parameter is + no, calls to the getpwent system call will not return any data.

    Warning: Turning off user enumeration may cause some programs to behave oddly. For example, the finger program relies on having access to the full user list when searching for matching - usernames.

    Default: winbind enum users = yes

    winbind gid (G)

    The winbind gid parameter specifies the range of group - ids that are allocated by the winbindd(8) daemon. This range of group ids should have no + usernames.

    Default: winbind enum users = yes

    winbind gid (G)

    This parameter is now an alias for idmap gid

    The winbind gid parameter specifies the range of group + ids that are allocated by the winbindd(8) daemon. This range of group ids should have no existing local or NIS groups within it as strange conflicts can - occur otherwise.

    Default: winbind gid = <empty string>

    Example: winbind gid = 10000-20000

    winbind separator (G)

    This parameter allows an admin to define the character - used when listing a username of the form of DOMAIN - \user. This parameter - is only applicable when using the pam_winbind.so - and nss_winbind.so modules for UNIX services. + occur otherwise.

    Default: winbind gid = <empty string>

    Example: winbind gid = 10000-20000

    winbind separator (G)

    This parameter allows an admin to define the character + used when listing a username of the form of DOMAIN + \user. This parameter + is only applicable when using the pam_winbind.so + and nss_winbind.so modules for UNIX services.

    Please note that setting this parameter to + causes problems with group membership at least on glibc systems, as the character + - is used as a special character for NIS in /etc/group.

    Default: winbind separator = '\'

    Example: winbind separator = +

    winbind uid (G)

    The winbind gid parameter specifies the range of group - ids that are allocated by the winbindd(8) daemon. This range of ids should have no - existing local or NIS users within it as strange conflicts can - occur otherwise.

    Default: winbind uid = <empty string>

    Example: winbind uid = 10000-20000

    winbind used default domain (G)

    This parameter specifies whether the - winbindd(8) daemon should operate on users + is used as a special character for NIS in /etc/group.

    Default: winbind separator = '\'

    Example: winbind separator = +

    winbind uid (G)

    This parameter is now an alias for idmap uid

    The winbind gid parameter specifies the range of user ids that are allocated by the + winbindd(8) + daemon. This range of ids should have no existing local or NIS users within it as strange + conflicts can occur otherwise.

    Default: winbind uid = <empty string>

    Example: winbind uid = 10000-20000

    winbind used default domain (G)

    This parameter specifies whether the + winbindd(8) daemon should operate on users without domain component in their username. Users without a domain component are treated as is part of the winbindd server's own domain. While this does not benifit Windows users, it makes SSH, FTP and e-mail function in a way much closer to the way they - would in a native unix system.

    Default: winbind use default domain = <no>

    Example: winbind use default domain = yes

    wins hook (G)

    When Samba is running as a WINS server this + would in a native unix system.

    Default: winbind use default domain = <no>

    Example: winbind use default domain = yes

    wins hook (G)

    When Samba is running as a WINS server this allows you to call an external program for all changes to the WINS database. The primary use for this option is to allow the dynamic update of external name resolution databases such as dynamic DNS.

    The wins hook parameter specifies the name of a script - or executable that will be called as follows:

    wins_hook operation name nametype ttl IP_list

    • The first argument is the operation and is + or executable that will be called as follows:

      wins_hook operation name nametype ttl IP_list

      • The first argument is the operation and is one of "add", "delete", or "refresh". In most cases the operation can be ignored as the rest of the parameters @@ -3016,16 +3089,16 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ for the name in seconds.

      • The fifth and subsequent arguments are the IP addresses currently registered for that name. If this list is empty then the name should be deleted.

      An example script that calls the BIND dynamic DNS update - program nsupdate is provided in the examples + program nsupdate is provided in the examples directory of the Samba source code.

    wins partner (G)

    A space separated list of partners' IP addresses for WINS replication. WINS partners are always defined as push/pull partners as defining only one way WINS replication is unreliable. WINS replication is currently experimental and unreliable between samba servers. -

    Default: wins partners =

    Example: wins partners = 192.168.0.1 172.16.1.2

    wins proxy (G)

    This is a boolean that controls if nmbd(8) will respond to broadcast name +

    Default: wins partners =

    Example: wins partners = 192.168.0.1 172.16.1.2

    wins proxy (G)

    This is a boolean that controls if nmbd(8) will respond to broadcast name queries on behalf of other hosts. You may need to set this - to yes for some older clients.

    Default: wins proxy = no

    wins server (G)

    This specifies the IP address (or DNS name: IP - address for preference) of the WINS server that nmbd(8) should register with. If you have a WINS server on + to yes for some older clients.

    Default: wins proxy = no

    wins server (G)

    This specifies the IP address (or DNS name: IP + address for preference) of the WINS server that nmbd(8) should register with. If you have a WINS server on your network then you should set this to the WINS server's IP.

    You should point this at your WINS server if you have a multi-subnetted network.

    If you want to work in multiple namespaces, you can give every wins server a 'tag'. For each tag, only one @@ -3033,20 +3106,20 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ seperated from the ip address by a colon.

    Note

    You need to set up Samba to point to a WINS server if you have multiple subnets and wish cross-subnet - browsing to work correctly.

    See the documentation file Browsing in the samba howto collection.

    Default: not enabled

    Example: wins server = mary:192.9.200.1 fred:192.168.3.199 mary:192.168.2.61

    For this example when querying a certain name, 192.19.200.1 will + browsing to work correctly.

    See the documentation file Browsing in the samba howto collection.

    Default: not enabled

    Example: wins server = mary:192.9.200.1 fred:192.168.3.199 mary:192.168.2.61

    For this example when querying a certain name, 192.19.200.1 will be asked first and if that doesn't respond 192.168.2.61. If either of those doesn't know the name 192.168.3.199 will be queried. -

    Example: wins server = 192.9.200.1 192.168.2.61

    wins support (G)

    This boolean controls if the nmbd(8) process in Samba will act as a WINS server. You should - not set this to yes unless you have a multi-subnetted network and - you wish a particular nmbd to be your WINS server. - Note that you should NEVER set this to yes - on more than one machine in your network.

    Default: wins support = no

    workgroup (G)

    This controls what workgroup your server will +

    Example: wins server = 192.9.200.1 192.168.2.61

    wins support (G)

    This boolean controls if the nmbd(8) process in Samba will act as a WINS server. You should + not set this to yes unless you have a multi-subnetted network and + you wish a particular nmbd to be your WINS server. + Note that you should NEVER set this to yes + on more than one machine in your network.

    Default: wins support = no

    workgroup (G)

    This controls what workgroup your server will appear to be in when queried by clients. Note that this parameter also controls the Domain name used with - the security = domain - setting.

    Default: set at compile time to WORKGROUP

    Example: workgroup = MYGROUP

    writable (S)

    Synonym for + the security = domain + setting.

    Default: set at compile time to WORKGROUP

    Example: workgroup = MYGROUP

    writable (S)

    Synonym for writeable for people who can't spell :-).

    writeable (S)

    Inverted synonym for - read only.

    write cache size (S)

    If this integer parameter is set to non-zero value, + read only.

    write cache size (S)

    If this integer parameter is set to non-zero value, Samba will create an in-memory cache for each oplocked file (it does not do this for non-oplocked files). All writes that the client does not request @@ -3059,31 +3132,31 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ be the RAID stripe size) and can improve performance on systems where the disk subsystem is a bottleneck but there is free memory for userspace programs.

    The integer parameter specifies the size of this cache - (per oplocked file) in bytes.

    Default: write cache size = 0

    Example: write cache size = 262144

    for a 256k cache size per file.

    write list (S)

    This is a list of users that are given read-write + (per oplocked file) in bytes.

    Default: write cache size = 0

    Example: write cache size = 262144

    for a 256k cache size per file.

    write list (S)

    This is a list of users that are given read-write access to a service. If the connecting user is in this list then they will be given write access, no matter what the - read only + read only option is set to. The list can include group names using the @group syntax.

    Note that if a user is in both the read list and the - write list then they will be given write access.

    See also the read list - option.

    Default: write list = <empty string>

    Example: write list = admin, root, @staff

    write ok (S)

    Inverted synonym for - read only.

    write raw (G)

    This parameter controls whether or not the server + write list then they will be given write access.

    See also the read list + option.

    Default: write list = <empty string>

    Example: write list = admin, root, @staff

    write ok (S)

    Inverted synonym for + read only.

    write raw (G)

    This parameter controls whether or not the server will support raw write SMB's when transferring data from clients. - You should never need to change this parameter.

    Default: write raw = yes

    wtmp directory (G)

    This parameter is only available if Samba has - been configured and compiled with the option + You should never need to change this parameter.

    Default: write raw = yes

    wtmp directory (G)

    This parameter is only available if Samba has + been configured and compiled with the option --with-utmp. It specifies a directory pathname that is used to store the wtmp or wtmpx files (depending on the UNIX system) that record user connections to a Samba server. The difference with the utmp directory is the fact that user info is kept after a user has logged out.

    See also the - utmp parameter. By default this is + utmp parameter. By default this is not set, meaning the system will use whatever utmp file the native system is set to use (usually - /var/run/wtmp on Linux).

    Default: no wtmp directory

    Example: wtmp directory = /var/log/wtmp

    WARNINGS

    Although the configuration file permits service names + /var/run/wtmp on Linux).

    Default: no wtmp directory

    Example: wtmp directory = /var/log/wtmp

    WARNINGS

    Although the configuration file permits service names to contain spaces, your client software may not. Spaces will be ignored in comparisons anyway, so it shouldn't be a problem - but be aware of the possibility.

    On a similar note, many clients - especially DOS clients - - limit service names to eight characters. smbd(8) has no such limitation, but attempts to connect from such + limit service names to eight characters. smbd(8) has no such limitation, but attempts to connect from such clients will fail if they truncate the service names. For this reason you should probably keep your service names down to eight characters in length.

    Use of the [homes] and [printers] special sections make life @@ -3091,7 +3164,7 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ attributes can be tricky. Take extreme care when designing these sections. In particular, ensure that the permissions on spool directories are correct.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    - samba(7), smbpasswd(8), swat(8), smbd(8), nmbd(8), smbclient(1), nmblookup(1), testparm(1), testprns(1).

    AUTHOR

    The original Samba software and related utilities + samba(7), smbpasswd(8), swat(8), smbd(8), nmbd(8), smbclient(1), nmblookup(1), testparm(1), testprns(1).

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. diff --git a/docs/htmldocs/smbcacls.1.html b/docs/htmldocs/smbcacls.1.html index f987680f33..d7c5fed1b5 100644 --- a/docs/htmldocs/smbcacls.1.html +++ b/docs/htmldocs/smbcacls.1.html @@ -1,5 +1,5 @@ -smbcacls

    Name

    smbcacls — Set or get ACLs on an NT file or directory names

    Synopsis

    smbcacls {//server/share} {filename} [-D acls] [-M acls] [-A acls] [-S acls] [-C name] [-G name] [-n] [-t] [-U username] [-h] [-d]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The smbcacls program manipulates NT Access Control - Lists (ACLs) on SMB file shares.

    OPTIONS

    The following options are available to the smbcacls program. +smbcacls

    Name

    smbcacls — Set or get ACLs on an NT file or directory names

    Synopsis

    smbcacls {//server/share} {filename} [-D acls] [-M acls] [-A acls] [-S acls] [-C name] [-G name] [-n] [-t] [-U username] [-h] [-d]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The smbcacls program manipulates NT Access Control + Lists (ACLs) on SMB file shares.

    OPTIONS

    The following options are available to the smbcacls program. The format of ACLs is described in the section ACL FORMAT

    -A acls

    Add the ACLs specified to the ACL list. Existing access control entries are unchanged.

    -M acls

    Modify the mask value (permissions) for the ACLs specified on the command line. An error will be printed for each @@ -12,14 +12,14 @@ type, owner and group for the call to succeed.

    -U username

    Specifies a username used to connect to the specified service. The username may be of the form "username" in which case the user is prompted to enter in a password and the - workgroup specified in the smb.conf(5) file is + workgroup specified in the smb.conf(5) file is used, or "username%password" or "DOMAIN\username%password" and the password and workgroup names are used as provided.

    -C name

    The owner of a file or directory can be changed - to the name given using the -C option. + to the name given using the -C option. The name can be a sid in the form S-1-x-y-z or a name resolved against the server specified in the first argument.

    This command is a shortcut for -M OWNER:name.

    -G name

    The group owner of a file or directory can - be changed to the name given using the -G + be changed to the name given using the -G option. The name can be a sid in the form S-1-x-y-z or a name resolved against the server specified n the first argument.

    This command is a shortcut for -M GROUP:name.

    -n

    This option displays all ACL information in numeric @@ -29,15 +29,15 @@ the arguments.

    -h|--help

    Print a summary of command line options.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -51,8 +51,8 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    ACL FORMAT

    The format of an ACL is one or more ACL entries separated by either commas or newlines. An ACL entry is one of the following: 

     
@@ -73,23 +73,23 @@ ACL:<sid or name>:<type>/<flags>/<mask>
 	access granted to the SID. 
    The type can be either 0 or 1 corresponding to ALLOWED or 
 	DENIED access to the SID.  The flags values are generally
 	zero for file ACLs and either 9 or 2 for directory ACLs.  Some 
-	common flags are: 
    • #define SEC_ACE_FLAG_OBJECT_INHERIT     	0x1
    • #define SEC_ACE_FLAG_CONTAINER_INHERIT  	0x2
    • #define SEC_ACE_FLAG_NO_PROPAGATE_INHERIT     0x4
    • #define SEC_ACE_FLAG_INHERIT_ONLY       	0x8
    At present flags can only be specified as decimal or 
+	common flags are: 
    • #define SEC_ACE_FLAG_OBJECT_INHERIT     	0x1
    • #define SEC_ACE_FLAG_CONTAINER_INHERIT  	0x2
    • #define SEC_ACE_FLAG_NO_PROPAGATE_INHERIT     0x4
    • #define SEC_ACE_FLAG_INHERIT_ONLY       	0x8
    At present flags can only be specified as decimal or 
 	hexadecimal values.
    The mask is a value which expresses the access right 
 	granted to the SID. It can be given as a decimal or hexadecimal value, 
 	or by using one of the following text strings which map to the NT 
 	file permissions of the same name. 
    • R - Allow read access 
    • W - Allow write access
    • X - Execute permission on the object
    • D - Delete the object
    • P - Change permissions
    • O - Take ownership
    The following combined permissions can be specified:
    • READ -  Equivalent to 'RX'
 		permissions
    • CHANGE - Equivalent to 'RXWD' permissions
 		
    • FULL - Equivalent to 'RWXDPO' 
-		permissions

    EXIT STATUS

    The smbcacls program sets the exit status + permissions

    EXIT STATUS

    The smbcacls program sets the exit status depending on the success or otherwise of the operations performed. The exit status may be one of the following values.

    If the operation succeeded, smbcacls returns and exit - status of 0. If smbcacls couldn't connect to the specified server, + status of 0. If smbcacls couldn't connect to the specified server, or there was an error getting or setting the ACLs, an exit status of 1 is returned. If there was an error parsing any command line arguments, an exit status of 2 is returned.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar - to the way the Linux kernel is developed.

    smbcacls was written by Andrew Tridgell + to the way the Linux kernel is developed.

    smbcacls was written by Andrew Tridgell and Tim Potter.

    The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/smbclient.1.html b/docs/htmldocs/smbclient.1.html index 49f00fb2db..ecb85d6e85 100644 --- a/docs/htmldocs/smbclient.1.html +++ b/docs/htmldocs/smbclient.1.html @@ -1,34 +1,34 @@ -smbclient

    Name

    smbclient — ftp-like client to access SMB/CIFS resources - on servers

    Synopsis

    smbclient {servicename} [password] [-b <buffer size>] [-d debuglevel] [-D Directory] [-U username] [-W workgroup] [-M <netbios name>] [-m maxprotocol] [-A authfile] [-N] [-l logfile] [-L <netbios name>] [-I destinationIP] [-E] [-c <command string>] [-i scope] [-O <socket options>] [-p port] [-R <name resolve order>] [-s <smb config file>] [-T<c|x>IXFqgbNan] [-k]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbclient is a client that can +smbclient

    Name

    smbclient — ftp-like client to access SMB/CIFS resources + on servers

    Synopsis

    smbclient {servicename} [password] [-b <buffer size>] [-d debuglevel] [-D Directory] [-U username] [-W workgroup] [-M <netbios name>] [-m maxprotocol] [-A authfile] [-N] [-l logfile] [-L <netbios name>] [-I destinationIP] [-E] [-c <command string>] [-i scope] [-O <socket options>] [-p port] [-R <name resolve order>] [-s <smb config file>] [-T<c|x>IXFqgbNan] [-k]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbclient is a client that can 'talk' to an SMB/CIFS server. It offers an interface - similar to that of the ftp program (see ftp(1)). + similar to that of the ftp program (see ftp(1)). Operations include things like getting files from the server to the local machine, putting files from the local machine to the server, retrieving directory information from the server and so on.

    OPTIONS

    servicename

    servicename is the name of the service you want to use on the server. A service name takes the form - //server/service where server + //server/service where server is the NetBIOS name of the SMB/CIFS server - offering the desired service and service + offering the desired service and service is the name of the service offered. Thus to connect to the service "printer" on the SMB/CIFS server "smbserver", - you would use the servicename //smbserver/printer + you would use the servicename //smbserver/printer

    Note that the server name required is NOT necessarily the IP (DNS) host name of the server ! The name required is a NetBIOS server name, which may or may not be the same as the IP hostname of the machine running the server.

    The server name is looked up according to either - the -R parameter to smbclient or + the -R parameter to smbclient or using the name resolve order parameter in - the smb.conf(5) file, + the smb.conf(5) file, allowing an administrator to change the order and methods by which server names are looked up.

    password

    The password required to access the specified service on the specified server. If this parameter is - supplied, the -N option (suppress + supplied, the -N option (suppress password prompt) is assumed.

    There is no default password. If no password is supplied on the command line (either by using this parameter or adding - a password to the -U option (see - below)) and the -N option is not + a password to the -U option (see + below)) and the -N option is not specified, the client will prompt for a password, even if the desired service does not require one. (If no password is required, simply press ENTER to provide a null password.) @@ -40,30 +40,30 @@ suite to determine what naming services and in what order to resolve host names to IP addresses. The option takes a space-separated string of different name resolution options.

    The options are :"lmhosts", "host", "wins" and "bcast". They - cause names to be resolved as follows:

    • lmhosts: Lookup an IP + cause names to be resolved as follows:

      • lmhosts: Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has no name type attached to the NetBIOS name (see - the lmhosts(5) for details) then - any name type matches for lookup.

      • host: Do a standard host - name to IP address resolution, using the system /etc/hosts + the lmhosts(5) for details) then + any name type matches for lookup.

      • host: Do a standard host + name to IP address resolution, using the system /etc/hosts , NIS, or DNS lookups. This method of name resolution is operating system dependent, for instance on IRIX or Solaris this - may be controlled by the /etc/nsswitch.conf + may be controlled by the /etc/nsswitch.conf file). Note that this method is only used if the NetBIOS name type being queried is the 0x20 (server) name type, otherwise - it is ignored.

      • wins: Query a name with - the IP address listed in the wins server + it is ignored.

      • wins: Query a name with + the IP address listed in the wins server parameter. If no WINS server has - been specified this method will be ignored.

      • bcast: Do a broadcast on + been specified this method will be ignored.

      • bcast: Do a broadcast on each of the known local interfaces listed in the - interfaces + interfaces parameter. This is the least reliable of the name resolution methods as it depends on the target host being on a locally connected subnet.

      If this parameter is not set then the name resolve order - defined in the smb.conf(5) file parameter + defined in the smb.conf(5) file parameter (name resolve order) will be used.

      The default order is lmhosts, host, wins, bcast and without - this parameter or any entry in the name resolve order - parameter of the smb.conf(5) file the name resolution + this parameter or any entry in the name resolve order + parameter of the smb.conf(5) file the name resolution methods will be attempted in this order.

    -M NetBIOS name

    This options allows you to send messages, using the "WinPopup" protocol, to another computer. Once a connection is established you then type your message, pressing ^D (control-D) to @@ -73,27 +73,27 @@ occur.

    The message is also automatically truncated if the message is over 1600 bytes, as this is the limit of the protocol.

    One useful trick is to cat the message through - smbclient. For example: + smbclient. For example: cat mymessage.txt | smbclient -M FRED will - send the message in the file mymessage.txt - to the machine FRED.

    You may also find the -U and - -I options useful, as they allow you to - control the FROM and TO parts of the message.

    See the message command parameter in the smb.conf(5) for a description of how to handle incoming + send the message in the file mymessage.txt + to the machine FRED.

    You may also find the -U and + -I options useful, as they allow you to + control the FROM and TO parts of the message.

    See the message command parameter in the smb.conf(5) for a description of how to handle incoming WinPopup messages in Samba.

    Note: Copy WinPopup into the startup group on your WfWg PCs if you want them to always be able to receive messages.

    -p port

    This number is the TCP port number that will be used when making connections to the server. The standard (well-known) TCP port number for an SMB/CIFS server is 139, which is the - default.

    -l logfilename

    If specified, logfilename specifies a base filename + default.

    -l logfilename

    If specified, logfilename specifies a base filename into which operational data from the running client will be logged.

    The default base name is specified at compile time.

    The base name is used to generate actual log file names. For example, if the name specified was "log", the debug file - would be log.client.

    The log file generated is never removed by the client. + would be log.client.

    The log file generated is never removed by the client.

    -h|--help

    Print a summary of command line options. -

    -I IP-address

    IP address is the address of the server to connect to. +

    -I IP-address

    IP address is the address of the server to connect to. It should be specified in standard "a.b.c.d" notation.

    Normally the client would attempt to locate a named SMB/CIFS server by looking it up via the NetBIOS name resolution - mechanism described above in the name resolve order + mechanism described above in the name resolve order parameter above. Using this parameter will force the client to assume that the server is on the machine with the specified IP address and the NetBIOS name component of the resource being @@ -103,16 +103,16 @@ to the standard error stream (stderr) rather than to the standard output stream.

    By default, the client writes messages to standard output - typically the user's tty.

    -L

    This option allows you to look at what services - are available on a server. You use it as smbclient -L - host and a list should appear. The -I + are available on a server. You use it as smbclient -L + host and a list should appear. The -I option may be useful if your NetBIOS names don't match your TCP/IP DNS host names or if you are trying to reach a - host on another network.

    -t terminal code

    This option tells smbclient how to interpret + host on another network.

    -t terminal code

    This option tells smbclient how to interpret filenames coming from the remote server. Usually Asian language multibyte UNIX implementations use different character sets than SMB/CIFS servers (EUC instead of SJIS for example). Setting this parameter will let - smbclient convert between the UNIX filenames and + smbclient convert between the UNIX filenames and the SMB filenames correctly. This option has not been seriously tested and may have some problems.

    The terminal codes include CWsjis, CWeuc, CWjis7, CWjis8, CWjunet, CWhex, CWcap. This is not a complete list, check the Samba @@ -121,15 +121,15 @@ is 65520 bytes. Setting this value smaller (to 1200 bytes) has been observed to speed up file transfers to and from a Win9x server.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -143,8 +143,8 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -N

    If specified, this parameter suppresses the normal password prompt from the client to the user. This is useful when @@ -162,26 +162,26 @@ password = <value> domain = <value>

    Make certain that the permissions on the file restrict access from unwanted users.

    -U|--user=username[%password]

    Sets the SMB username or username and password.

    If %password is not specified, the user will be prompted. The -client will first check the USER environment variable, then the -LOGNAME variable and if either exists, the +client will first check the USER environment variable, then the +LOGNAME variable and if either exists, the string is uppercased. If these environmental variables are not -found, the username GUEST is used.

    A third option is to use a credentials file which +found, the username GUEST is used.

    A third option is to use a credentials file which contains the plaintext of the username and password. This option is mainly provided for scripts where the admin does not wish to pass the credentials on the command line or via environment variables. If this method is used, make certain that the permissions on the file restrict access from unwanted users. See the --A for more details.

    Be cautious about including passwords in scripts. Also, on +-A for more details.

    Be cautious about including passwords in scripts. Also, on many systems the command line of a running process may be seen -via the ps command. To be safe always allow -rpcclient to prompt for a password and type +via the ps command. To be safe always allow +rpcclient to prompt for a password and type it in directly.

    -n <primary NetBIOS name>

    This option allows you to override the NetBIOS name that Samba uses for itself. This is identical -to setting the NetBIOS -name parameter in the smb.conf(5) file. However, a command +to setting the NetBIOS +name parameter in the smb.conf(5) file. However, a command line setting will take precedence over settings in -smb.conf(5).

    -i <scope>

    This specifies a NetBIOS scope that -nmblookup will use to communicate with when +smb.conf(5).

    -i <scope>

    This specifies a NetBIOS scope that +nmblookup will use to communicate with when generating NetBIOS names. For details on the use of NetBIOS scopes, see rfc1001.txt and rfc1002.txt. NetBIOS scopes are very rarely used, only set this parameter @@ -192,71 +192,71 @@ smb.conf. If the domain specified is the same as the servers NetBIOS name, it causes the client to log on using the servers local SAM (as opposed to the Domain SAM).

    -O socket options

    TCP socket options to set on the client socket. See the socket options parameter in -the smb.conf(5) manual page for the list of valid -options.

    -T tar options

    smbclient may be used to create tar(1) +the smb.conf(5) manual page for the list of valid +options.

    -T tar options

    smbclient may be used to create tar(1) compatible backups of all the files on an SMB/CIFS share. The secondary tar flags that can be given to this option - are :

    • c - Create a tar file on UNIX. + are :

      • c - Create a tar file on UNIX. Must be followed by the name of a tar file, tape device or "-" for standard output. If using standard output you must turn the log level to its lowest value -d0 to avoid corrupting your tar file. This flag is mutually exclusive with the - x flag.

      • x - Extract (restore) a local + x flag.

      • x - Extract (restore) a local tar file back to a share. Unless the -D option is given, the tar files will be restored from the top level of the share. Must be followed by the name of the tar file, device or "-" for standard - input. Mutually exclusive with the c flag. + input. Mutually exclusive with the c flag. Restored files have their creation times (mtime) set to the date saved in the tar file. Directories currently do not get - their creation dates restored properly.

      • I - Include files and directories. + their creation dates restored properly.

      • I - Include files and directories. Is the default behavior when filenames are specified above. Causes tar files to be included in an extract or create (and therefore everything else to be excluded). See example below. Filename globbing - works in one of two ways. See r below.

      • X - Exclude files and directories. + works in one of two ways. See r below.

      • X - Exclude files and directories. Causes tar files to be excluded from an extract or create. See example below. Filename globbing works in one of two ways now. - See r below.

      • b - Blocksize. Must be followed + See r below.

      • b - Blocksize. Must be followed by a valid (greater than zero) blocksize. Causes tar file to be written out in blocksize*TBLOCK (usually 512 byte) blocks. -

      • g - Incremental. Only back up +

      • g - Incremental. Only back up files that have the archive bit set. Useful only with the - c flag.

      • q - Quiet. Keeps tar from printing + c flag.

      • q - Quiet. Keeps tar from printing diagnostics as it works. This is the same as tarmode quiet. -

      • r - Regular expression include +

      • r - Regular expression include or exclude. Uses regular expression matching for excluding or excluding files if compiled with HAVE_REGEX_H. However this mode can be very slow. If not compiled with HAVE_REGEX_H, does a limited wildcard match on '*' and '?'. -

      • N - Newer than. Must be followed +

      • N - Newer than. Must be followed by the name of a file whose date is compared against files found on the share during a create. Only files newer than the file specified are backed up to the tar file. Useful only with the - c flag.

      • a - Set archive bit. Causes the + c flag.

      • a - Set archive bit. Causes the archive bit to be reset when a file is backed up. Useful with the - g and c flags. -

      Tar Long File Names

      smbclient's tar option now supports long + g and c flags. +

    Tar Long File Names

    smbclient's tar option now supports long file names both on backup and restore. However, the full path name of the file must be less than 1024 bytes. Also, when - a tar archive is created, smbclient's tar option places all + a tar archive is created, smbclient's tar option places all files in the archive with relative names, not absolute names.

    Tar Filenames

    All file names can be given as DOS path names (with '\\' as the component separator) or as UNIX path names (with '/' as - the component separator).

    Examples

    Restore from tar file backup.tar into myshare on mypc - (no password on share).

    smbclient //mypc/yshare "" -N -Tx backup.tar -

    Restore everything except users/docs -

    smbclient //mypc/myshare "" -N -TXx backup.tar - users/docs

    Create a tar file of the files beneath - users/docs.

    smbclient //mypc/myshare "" -N -Tc + the component separator).

    Examples

    Restore from tar file backup.tar into myshare on mypc + (no password on share).

    smbclient //mypc/yshare "" -N -Tx backup.tar +

    Restore everything except users/docs +

    smbclient //mypc/myshare "" -N -TXx backup.tar + users/docs

    Create a tar file of the files beneath + users/docs.

    smbclient //mypc/myshare "" -N -Tc backup.tar users/docs

    Create the same tar file as above, but now use - a DOS path name.

    smbclient //mypc/myshare "" -N -tc backup.tar + a DOS path name.

    smbclient //mypc/myshare "" -N -tc backup.tar users\edocs

    Create a tar file of all the files and directories in - the share.

    smbclient //mypc/myshare "" -N -Tc backup.tar * + the share.

    smbclient //mypc/myshare "" -N -Tc backup.tar *

    -D initial directory

    Change to initial directory before starting. Probably only of any use with the tar -T option.

    -c command string

    command string is a semicolon-separated list of - commands to be executed instead of prompting from stdin. - -N is implied by -c.

    This is particularly useful in scripts and for printing stdin - to the server, e.g. -c 'print -'.

    OPERATIONS

    Once the client is running, the user is presented with - a prompt :

    smb:\>

    The backslash ("\\") indicates the current working directory + commands to be executed instead of prompting from stdin. + -N is implied by -c.

    This is particularly useful in scripts and for printing stdin + to the server, e.g. -c 'print -'.

    OPERATIONS

    Once the client is running, the user is presented with + a prompt :

    smb:\>

    The backslash ("\\") indicates the current working directory on the server, and will change if the current working directory is changed.

    The prompt indicates that the client is ready and waiting to carry out a user command. Each command is a single word, optionally @@ -271,10 +271,10 @@ options.

    -T tar options

    smbcli

    Note that all commands operating on the server are actually performed by issuing a request to the server. Thus the behavior may vary from server to server, depending on how the server was implemented. -

    The commands available are given here in alphabetical order.

    ? [command]

    If command is specified, the ? command will display +

    The commands available are given here in alphabetical order.

    ? [command]

    If command is specified, the ? command will display a brief informative message about the specified command. If no command is specified, a list of available commands will - be displayed.

    ! [shell command]

    If shell command is specified, the ! + be displayed.

    ! [shell command]

    If shell command is specified, the ! command will execute a shell locally and run the specified shell command. If no command is specified, a local shell will be run.

    altname file

    The client will request that the server return @@ -294,15 +294,15 @@ options.

    -T tar options

    smbcli specified. This operation will fail if for any reason the specified directory is inaccessible.

    If no directory name is specified, the current working directory on the server will be reported.

    del <mask>

    The client will request that the server attempt - to delete all files matching mask from the current working - directory on the server.

    dir <mask>

    A list of the files matching mask in the current + to delete all files matching mask from the current working + directory on the server.

    dir <mask>

    A list of the files matching mask in the current working directory on the server will be retrieved from the server and displayed.

    exit

    Terminate the connection with the server and exit - from the program.

    get <remote file name> [local file name]

    Copy the file called remote file name from + from the program.

    get <remote file name> [local file name]

    Copy the file called remote file name from the server to the machine running the client. If specified, name - the local copy local file name. Note that all transfers in - smbclient are binary. See also the - lowercase command.

    help [command]

    See the ? command above.

    lcd [directory name]

    If directory name is specified, the current + the local copy local file name. Note that all transfers in + smbclient are binary. See also the + lowercase command.

    help [command]

    See the ? command above.

    lcd [directory name]

    If directory name is specified, the current working directory on the local machine will be changed to the directory specified. This operation will fail if for any reason the specified directory is inaccessible.

    If no directory name is specified, the name of the @@ -329,16 +329,16 @@ options.

    -T tar options

    smbcli to "*") and remains so until the mask command is used to change it. It retains the most recently specified value indefinitely. To avoid unexpected results it would be wise to change the value of - mask back to "*" after using the mget or mput commands.

    md <directory name>

    See the mkdir command.

    mget <mask>

    Copy all files matching mask from the server to - the machine running the client.

    Note that mask is interpreted differently during recursive + mask back to "*" after using the mget or mput commands.

    md <directory name>

    See the mkdir command.

    mget <mask>

    Copy all files matching mask from the server to + the machine running the client.

    Note that mask is interpreted differently during recursive operation and non-recursive operation - refer to the recurse and mask commands for more information. Note that all transfers in - smbclient are binary. See also the lowercase command.

    mkdir <directory name>

    Create a new directory on the server (user access - privileges permitting) with the specified name.

    mput <mask>

    Copy all files matching mask in the current working + smbclient are binary. See also the lowercase command.

    mkdir <directory name>

    Create a new directory on the server (user access + privileges permitting) with the specified name.

    mput <mask>

    Copy all files matching mask in the current working directory on the local machine to the current working directory on - the server.

    Note that mask is interpreted differently during recursive + the server.

    Note that mask is interpreted differently during recursive operation and non-recursive operation - refer to the recurse and mask - commands for more information. Note that all transfers in smbclient + commands for more information. Note that all transfers in smbclient are binary.

    print <file name>

    Print the specified file from the local machine through a printable service on the server.

    See also the printmode command.

    printmode <graphics or text>

    Set the print mode to suit either binary data (such as graphical information) or text. Subsequent print @@ -346,10 +346,10 @@ options.

    -T tar options

    smbcli of the mget and mput commands.

    When toggled ON, the user will be prompted to confirm the transfer of each file during these commands. When toggled OFF, all specified files will be transferred without prompting. -

    put <local file name> [remote file name]

    Copy the file called local file name from the +

    put <local file name> [remote file name]

    Copy the file called local file name from the machine running the client to the server. If specified, - name the remote copy remote file name. Note that all transfers - in smbclient are binary. See also the lowercase command. + name the remote copy remote file name. Note that all transfers + in smbclient are binary. See also the lowercase command.

    queue

    Displays the print queue, showing the job id, name, size and current status.

    quit

    See the exit command.

    rd <directory name>

    See the rmdir command.

    recurse

    Toggle directory recursion for the commands mget and mput.

    When toggled ON, these commands will process all directories @@ -360,22 +360,22 @@ options.

    -T tar options

    smbcli

    When recursion is toggled OFF, only files from the current working directory on the source machine that match the mask specified to the mget or mput commands will be copied, and any mask specified - using the mask command will be ignored.

    rm <mask>

    Remove all files matching mask from the current + using the mask command will be ignored.

    rm <mask>

    Remove all files matching mask from the current working directory on the server.

    rmdir <directory name>

    Remove the specified directory (user access privileges permitting) from the server.

    setmode <filename> <perm=[+|\-]rsha>

    A version of the DOS attrib command to set - file permissions. For example:

    setmode myfile +r

    would make myfile read only.

    symlink source destination

    This command depends on the server supporting the CIFS + file permissions. For example:

    setmode myfile +r

    would make myfile read only.

    symlink source destination

    This command depends on the server supporting the CIFS UNIX extensions and will fail if the server does not. The client requests that the server create a symbolic hard link between the source and destination files. The source file must not exist. Note that the server will not create a link to any path that lies outside the currently connected share. This is enforced by the Samba server. -

    tar <c|x>[IXbgNa]

    Performs a tar operation - see the -T +

    tar <c|x>[IXbgNa]

    Performs a tar operation - see the -T command line option above. Behavior may be affected by the tarmode command (see below). Using g (incremental) and N (newer) will affect tarmode settings. Note that using the "-" option with tar x may not work - use the command line option instead.

    blocksize <blocksize>

    Blocksize. Must be followed by a valid (greater than zero) blocksize. Causes tar file to be written out in - blocksize*TBLOCK (usually 512 byte) blocks.

    tarmode <full|inc|reset|noreset>

    Changes tar's behavior with regard to archive + blocksize*TBLOCK (usually 512 byte) blocks.

    tarmode <full|inc|reset|noreset>

    Changes tar's behavior with regard to archive bits. In full mode, tar will back up everything regardless of the archive bit setting (this is the default mode). In incremental mode, tar will only back up files with the archive bit set. In reset mode, @@ -387,26 +387,26 @@ options.

    -T tar options

    smbcli to some types of servers. For example OS/2 LanManager insists on a valid NetBIOS name being used, so you need to supply a valid name that would be known to the server.

    smbclient supports long file names where the server - supports the LANMAN2 protocol or above.

    ENVIRONMENT VARIABLES

    The variable USER may contain the + supports the LANMAN2 protocol or above.

    ENVIRONMENT VARIABLES

    The variable USER may contain the username of the person using the client. This information is used only if the protocol level is high enough to support - session-level passwords.

    The variable PASSWD may contain + session-level passwords.

    The variable PASSWD may contain the password of the person using the client. This information is used only if the protocol level is high enough to support - session-level passwords.

    The variable LIBSMB_PROG may contain + session-level passwords.

    The variable LIBSMB_PROG may contain the path, executed with system(), which the client should connect to instead of connecting to a server. This functionality is primarily intended as a development aid, and works best when using a LMHOSTS file

    INSTALLATION

    The location of the client program is a matter for individual system administrators. The following are thus suggestions only.

    It is recommended that the smbclient software be installed - in the /usr/local/samba/bin/ or + in the /usr/local/samba/bin/ or /usr/samba/bin/ directory, this directory readable by all, writeable only by root. The client program itself should be executable by all. The client should NOT be setuid or setgid!

    The client log files should be put in a directory readable and writeable only by the user.

    To test the client, you will need to know the name of a - running SMB/CIFS server. It is possible to run smbd(8) as an ordinary user - running that server as a daemon + running SMB/CIFS server. It is possible to run smbd(8) as an ordinary user - running that server as a daemon on a user-accessible port (typically any port number over 1024) would provide a suitable test server.

    DIAGNOSTICS

    Most diagnostics issued by the client are logged in a specified log file. The log file name is specified at compile time, diff --git a/docs/htmldocs/smbcontrol.1.html b/docs/htmldocs/smbcontrol.1.html index 6fa017fdb0..21344b9ade 100644 --- a/docs/htmldocs/smbcontrol.1.html +++ b/docs/htmldocs/smbcontrol.1.html @@ -1,30 +1,30 @@ -smbcontrol

    Name

    smbcontrol — send messages to smbd, nmbd or winbindd processes

    Synopsis

    smbcontrol [-i] [-s]

    smbcontrol [destination] [message-type] [parameter]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbcontrol is a very small program, which - sends messages to a smbd(8), a nmbd(8), or a winbindd(8) daemon running on the system.

    OPTIONS

    -h|--help

    Print a summary of command line options. +smbcontrol

    Name

    smbcontrol — send messages to smbd, nmbd or winbindd processes

    Synopsis

    smbcontrol [-i] [-s]

    smbcontrol [destination] [message-type] [parameter]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbcontrol is a very small program, which + sends messages to a smbd(8), a nmbd(8), or a winbindd(8) daemon running on the system.

    OPTIONS

    -h|--help

    Print a summary of command line options.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at compile time.

    -i

    Run interactively. Individual commands of the form destination message-type parameters can be entered on STDIN. An empty command line or a "q" will quit the - program.

    destination

    One of nmbd, smbd or a process ID.

    The smbd destination causes the - message to "broadcast" to all smbd daemons.

    The nmbd destination causes the + program.

    destination

    One of nmbd, smbd or a process ID.

    The smbd destination causes the + message to "broadcast" to all smbd daemons.

    The nmbd destination causes the message to be sent to the nmbd daemon specified in the - nmbd.pid file.

    If a single process ID is given, the message is sent + nmbd.pid file.

    If a single process ID is given, the message is sent to only that process.

    message-type

    Type of message to send. See - the section MESSAGE-TYPES for details. + the section MESSAGE-TYPES for details.

    parameters

    any parameters required for the message-type

    MESSAGE-TYPES

    Available message types are:

    close-share

    Order smbd to close the client connections to the named share. Note that this doesn't affect client connections to any other shares. This message-type takes an argument of the share name for which client connections will be closed, or the "*" character which will close all currently open shares. This may be useful if you made changes to the access controls on the share. - This message can only be sent to smbd.

    debug

    Set debug level to the value specified by the - parameter. This can be sent to any of the destinations.

    force-election

    This message causes the nmbd daemon to + This message can only be sent to smbd.

    debug

    Set debug level to the value specified by the + parameter. This can be sent to any of the destinations.

    force-election

    This message causes the nmbd daemon to force a new browse master election.

    ping

    Send specified number of "ping" messages and wait for the same number of reply "pong" messages. This can be sent to @@ -52,14 +52,14 @@ compile time.

    -i

    Run interactiv Note that this message only sends notification that an event has occured. It doesn't actually cause the event to happen. -

    This message can only be sent to smbd.

    samsync

    Order smbd to synchronise sam database from PDC (being BDC). Can only be sent to smbd.

    Note

    Not working at the moment

    samrepl

    Send sam replication message, with specified serial. Can only be sent to smbd. Should not be used manually.

    dmalloc-mark

    Set a mark for dmalloc. Can be sent to both smbd and nmbd. Only available if samba is built with dmalloc support.

    dmalloc-log-changed

    +

    This message can only be sent to smbd.

    samsync

    Order smbd to synchronise sam database from PDC (being BDC). Can only be sent to smbd.

    Note

    Not working at the moment

    samrepl

    Send sam replication message, with specified serial. Can only be sent to smbd. Should not be used manually.

    dmalloc-mark

    Set a mark for dmalloc. Can be sent to both smbd and nmbd. Only available if samba is built with dmalloc support.

    dmalloc-log-changed

    Dump the pointers that have changed since the mark set by dmalloc-mark. Can be sent to both smbd and nmbd. Only available if samba is built with dmalloc support.

    shutdown

    Shut down specified daemon. Can be sent to both smbd and nmbd.

    pool-usage

    Print a human-readable description of all talloc(pool) memory usage by the specified daemon/process. Available for both smbd and nmbd.

    drvupgrade

    Force clients of printers using specified driver to update their local version of the driver. Can only be sent to smbd.

    VERSION

    This man page is correct for version 3.0 of - the Samba suite.

    SEE ALSO

    nmbd(8) and smbd(8).

    AUTHOR

    The original Samba software and related utilities + the Samba suite.

    SEE ALSO

    nmbd(8) and smbd(8).

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. diff --git a/docs/htmldocs/smbcquotas.1.html b/docs/htmldocs/smbcquotas.1.html index 478c03cdaa..468edd1d61 100644 --- a/docs/htmldocs/smbcquotas.1.html +++ b/docs/htmldocs/smbcquotas.1.html @@ -1,4 +1,4 @@ -smbcquotas

    Name

    smbcquotas — Set or get QUOTAs of NTFS 5 shares

    Synopsis

    smbcquotas {//server/share} [-u user] [-L] [-F] [-S QUOTA_SET_COMMAND] [-n] [-t] [-v] [-d debuglevel] [-s configfile] [-l logfilebase] [-V] [-U username] [-N] [-k] [-A]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The smbcquotas program manipulates NT Quotas on SMB file shares.

    OPTIONS

    The following options are available to the smbcquotas program.

    -u user

    Specifies the user of whom the quotas are get or set. +smbcquotas

    Name

    smbcquotas — Set or get QUOTAs of NTFS 5 shares

    Synopsis

    smbcquotas {//server/share} [-u user] [-L] [-F] [-S QUOTA_SET_COMMAND] [-n] [-t] [-v] [-d debuglevel] [-s configfile] [-l logfilebase] [-V] [-U username] [-N] [-k] [-A]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The smbcquotas program manipulates NT Quotas on SMB file shares.

    OPTIONS

    The following options are available to the smbcquotas program.

    -u user

    Specifies the user of whom the quotas are get or set. By default the current user's username will be used.

    -L

    Lists all quota records of the share.

    -F

    Show the share quota status and default limits.

    -S QUOTA_SET_COMMAND

    This command set/modify quotas for a user or on the share, depending on the QUOTA_SET_COMMAND parameter witch is described later

    -n

    This option displays all QUOTA information in numeric format. The default is to convert SIDs to names and QUOTA limits @@ -9,15 +9,15 @@ Be verbose.

    -h|--help

    Print a summary of command line options.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -31,8 +31,8 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -N

    If specified, this parameter suppresses the normal password prompt from the client to the user. This is useful when @@ -50,39 +50,39 @@ password = <value> domain = <value>

    Make certain that the permissions on the file restrict access from unwanted users.

    -U|--user=username[%password]

    Sets the SMB username or username and password.

    If %password is not specified, the user will be prompted. The -client will first check the USER environment variable, then the -LOGNAME variable and if either exists, the +client will first check the USER environment variable, then the +LOGNAME variable and if either exists, the string is uppercased. If these environmental variables are not -found, the username GUEST is used.

    A third option is to use a credentials file which +found, the username GUEST is used.

    A third option is to use a credentials file which contains the plaintext of the username and password. This option is mainly provided for scripts where the admin does not wish to pass the credentials on the command line or via environment variables. If this method is used, make certain that the permissions on the file restrict access from unwanted users. See the --A for more details.

    Be cautious about including passwords in scripts. Also, on +-A for more details.

    Be cautious about including passwords in scripts. Also, on many systems the command line of a running process may be seen -via the ps command. To be safe always allow -rpcclient to prompt for a password and type +via the ps command. To be safe always allow +rpcclient to prompt for a password and type it in directly.

    QUOTA_SET_COMAND

    The format of an ACL is one or more ACL entries separated by either commas or newlines. An ACL entry is one of the following:

    for user setting quotas for the specified by -u or the current username: -

    +

    UQLIM:<username><softlimit><hardlimit>

    for setting the share quota defaults limits: -

    +

    FSQLIM:<softlimit><hardlimit>

    for changing the share quota settings: -

    +

    FSQFLAGS:QUOTA_ENABLED/DENY_DISK/LOG_SOFTLIMIT/LOG_HARD_LIMIT -

    EXIT STATUS

    The smbcquotas program sets the exit status +

    EXIT STATUS

    The smbcquotas program sets the exit status depending on the success or otherwise of the operations performed. The exit status may be one of the following values.

    If the operation succeeded, smbcquotas returns an exit - status of 0. If smbcquotas couldn't connect to the specified server, + status of 0. If smbcquotas couldn't connect to the specified server, or when there was an error getting or setting the quota(s), an exit status of 1 is returned. If there was an error parsing any command line arguments, an exit status of 2 is returned.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar - to the way the Linux kernel is developed.

    smbcacls was written by Stefan Metzmacher.

    + to the way the Linux kernel is developed.

    smbcacls was written by Stefan Metzmacher.

    diff --git a/docs/htmldocs/smbd.8.html b/docs/htmldocs/smbd.8.html index 2ae976c3e8..5b71bd7196 100644 --- a/docs/htmldocs/smbd.8.html +++ b/docs/htmldocs/smbd.8.html @@ -1,4 +1,4 @@ -smbd

    Name

    smbd — server to provide SMB/CIFS services to clients

    Synopsis

    smbd [-D] [-F] [-S] [-i] [-h] [-V] [-b] [-d <debug level>] [-l <log directory>] [-p <port number>] [-O <socket option>] [-s <configuration file>]

    DESCRIPTION

    This program is part of the Samba(7) suite.

    smbd is the server daemon that +smbd

    Name

    smbd — server to provide SMB/CIFS services to clients

    Synopsis

    smbd [-D] [-F] [-S] [-i] [-h] [-V] [-b] [-d <debug level>] [-l <log directory>] [-p <port number>] [-O <socket option>] [-s <configuration file>]

    DESCRIPTION

    This program is part of the Samba(7) suite.

    smbd is the server daemon that provides filesharing and printing services to Windows clients. The server provides filespace and printer services to clients using the SMB (or CIFS) protocol. This is compatible @@ -8,10 +8,10 @@ OS/2, DAVE for Macintosh, and smbfs for Linux.

    An extensive description of the services that the server can provide is given in the man page for the configuration file controlling the attributes of those - services (see smb.conf(5). This man page will not describe the + services (see smb.conf(5). This man page will not describe the services, but will concentrate on the administrative aspects of running the server.

    Please note that there are significant security - implications to running this server, and the smb.conf(5) manual page should be regarded as mandatory reading before + implications to running this server, and the smb.conf(5) manual page should be regarded as mandatory reading before proceeding with installation.

    A session is created whenever a client requests one. Each client gets a copy of the server for each session. This copy then services all connections made by the client during @@ -21,43 +21,43 @@ can force a reload by sending a SIGHUP to the server. Reloading the configuration file will not affect connections to any service that is already established. Either the user will have to - disconnect from the service, or smbd killed and restarted.

    OPTIONS

    -D

    If specified, this parameter causes + disconnect from the service, or smbd killed and restarted.

    OPTIONS

    -D

    If specified, this parameter causes the server to operate as a daemon. That is, it detaches itself and runs in the background, fielding requests on the appropriate port. Operating the server as a - daemon is the recommended way of running smbd for + daemon is the recommended way of running smbd for servers that provide more than casual use file and - print services. This switch is assumed if smbd + print services. This switch is assumed if smbd is executed on the command line of a shell.

    -F

    If specified, this parameter causes - the main smbd process to not daemonize, + the main smbd process to not daemonize, i.e. double-fork and disassociate with the terminal. Child processes are still created as normal to service each connection request, but the main process does not exit. This operation mode is suitable for running - smbd under process supervisors such - as supervise and svscan - from Daniel J. Bernstein's daemontools + smbd under process supervisors such + as supervise and svscan + from Daniel J. Bernstein's daemontools package, or the AIX process monitor.

    -S

    If specified, this parameter causes - smbd to log to standard output rather + smbd to log to standard output rather than a file.

    -i

    If this parameter is specified it causes the server to run "interactively", not as a daemon, even if the server is executed on the command line of a shell. Setting this parameter negates the implicit deamon mode when run from the - command line. smbd also logs to standard - output, as if the -S parameter had been + command line. smbd also logs to standard + output, as if the -S parameter had been given.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -71,23 +71,23 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -h|--help

    Print a summary of command line options.

    -b

    Prints information about how Samba was built.

    -l <log directory>

    If specified, - log directory + log directory specifies a log directory into which the "log.smbd" log file will be created for informational and debug messages from the running server. The log file generated is never removed by the server although - its size may be controlled by the max log size - option in the smb.conf(5) file. Beware: - If the directory specified does not exist, smbd + its size may be controlled by the max log size + option in the smb.conf(5) file. Beware: + If the directory specified does not exist, smbd will log to the default debug log location defined at compile time.

    The default log directory is specified at - compile time.

    -p <port number>

    port number is a positive integer + compile time.

    -p <port number>

    port number is a positive integer value. The default value if this parameter is not specified is 139.

    This number is the port number that will be used when making connections to the server from client @@ -101,38 +101,38 @@ never removed by the client. than 139, you will require port redirection services on port 139, details of which are outlined in rfc1002.txt section 4.3.5.

    This parameter is not normally specified except - in the above situation.

    FILES

    /etc/inetd.conf

    If the server is to be run by the - inetd meta-daemon, this file + in the above situation.

    FILES

    /etc/inetd.conf

    If the server is to be run by the + inetd meta-daemon, this file must contain suitable startup information for the meta-daemon. See the "How to Install and Test SAMBA" document for details. -

    /etc/rc

    or whatever initialization script your +

    /etc/rc

    or whatever initialization script your system uses).

    If running the server as a daemon at startup, this file will need to contain an appropriate startup sequence for the server. See the "How to Install and Test SAMBA" - document for details.

    /etc/services

    If running the server via the - meta-daemon inetd, this file + document for details.

    /etc/services

    If running the server via the + meta-daemon inetd, this file must contain a mapping of service name (e.g., netbios-ssn) to service port (e.g., 139) and protocol type (e.g., tcp). See the "How to Install and Test SAMBA" - document for details.

    /usr/local/samba/lib/smb.conf

    This is the default location of the smb.conf(5) server configuration file. Other common places that systems - install this file are /usr/samba/lib/smb.conf - and /etc/samba/smb.conf.

    This file describes all the services the server - is to make available to clients. See smb.conf(5) for more information.

    LIMITATIONS

    On some systems smbd cannot change uid back + document for details.

    /usr/local/samba/lib/smb.conf

    This is the default location of the smb.conf(5) server configuration file. Other common places that systems + install this file are /usr/samba/lib/smb.conf + and /etc/samba/smb.conf.

    This file describes all the services the server + is to make available to clients. See smb.conf(5) for more information.

    LIMITATIONS

    On some systems smbd cannot change uid back to root after a setuid() call. Such systems are called trapdoor uid systems. If you have such a system, you will be unable to connect from a client (such as a PC) as two different users at once. Attempts to connect the second user will result in access denied or - similar.

    ENVIRONMENT VARIABLES

    PRINTER

    If no printer name is specified to + similar.

    ENVIRONMENT VARIABLES

    PRINTER

    If no printer name is specified to printable services, most systems will use the value of - this variable (or lp if this variable is + this variable (or lp if this variable is not defined) as the name of the printer to use. This is not specific to the server, however.

    PAM INTERACTION

    Samba uses PAM for authentication (when presented with a plaintext password), for account checking (is this account disabled?) and for session management. The degree too which samba supports PAM is restricted - by the limitations of the SMB protocol and the obey - pam restricions smb.conf(5) paramater. When this is set, the following restrictions apply: + by the limitations of the SMB protocol and the obey + pam restricions smb.conf(5) paramater. When this is set, the following restrictions apply:

    • Account Validation: All accesses to a samba server are checked against PAM to see if the account is vaild, not disabled and is permitted to @@ -152,23 +152,23 @@ never removed by the client. available in the source code to warrant describing each and every diagnostic. At this stage your best bet is still to grep the source code and inspect the conditions that gave rise to the - diagnostics you are seeing.

    SIGNALS

    Sending the smbd a SIGHUP will cause it to - reload its smb.conf configuration - file within a short period of time.

    To shut down a user's smbd process it is recommended - that SIGKILL (-9) NOT + diagnostics you are seeing.

    SIGNALS

    Sending the smbd a SIGHUP will cause it to + reload its smb.conf configuration + file within a short period of time.

    To shut down a user's smbd process it is recommended + that SIGKILL (-9) NOT be used, except as a last resort, as this may leave the shared memory area in an inconsistent state. The safe way to terminate - an smbd is to send it a SIGTERM (-15) signal and wait for - it to die on its own.

    The debug log level of smbd may be raised - or lowered using smbcontrol(1) program (SIGUSR[1|2] signals are no longer + an smbd is to send it a SIGTERM (-15) signal and wait for + it to die on its own.

    The debug log level of smbd may be raised + or lowered using smbcontrol(1) program (SIGUSR[1|2] signals are no longer used since Samba 2.2). This is to allow transient problems to be diagnosed, whilst still running at a normally low log level.

    Note that as the signal handlers send a debug write, - they are not re-entrant in smbd. This you should wait until - smbd is in a state of waiting for an incoming SMB before + they are not re-entrant in smbd. This you should wait until + smbd is in a state of waiting for an incoming SMB before issuing them. It is possible to make the signal handlers safe by un-blocking the signals before the select call and re-blocking - them after, however this would affect performance.

    SEE ALSO

    hosts_access(5), inetd(8), nmbd(8), smb.conf(5), smbclient(1), testparm(1), testprns(1), and the - Internet RFC's rfc1001.txt, rfc1002.txt. + them after, however this would affect performance.

    SEE ALSO

    hosts_access(5), inetd(8), nmbd(8), smb.conf(5), smbclient(1), testparm(1), testprns(1), and the + Internet RFC's rfc1001.txt, rfc1002.txt. In addition the CIFS (formerly SMB) specification is available as a link from the Web page http://samba.org/cifs/.

    AUTHOR

    The original Samba software and related utilities diff --git a/docs/htmldocs/smbmnt.8.html b/docs/htmldocs/smbmnt.8.html index d577a6a3a7..8caedac3f5 100644 --- a/docs/htmldocs/smbmnt.8.html +++ b/docs/htmldocs/smbmnt.8.html @@ -1,9 +1,9 @@ -smbmnt

    Name

    smbmnt — helper utility for mounting SMB filesystems

    Synopsis

    smbmnt {mount-point} [-s <share>] [-r] [-u <uid>] [-g <gid>] [-f <mask>] [-d <mask>] [-o <options>] [-h]

    DESCRIPTION

    smbmnt is a helper application used +smbmnt

    Name

    smbmnt — helper utility for mounting SMB filesystems

    Synopsis

    smbmnt {mount-point} [-s <share>] [-r] [-u <uid>] [-g <gid>] [-f <mask>] [-d <mask>] [-o <options>] [-h]

    DESCRIPTION

    smbmnt is a helper application used by the smbmount program to do the actual mounting of SMB shares. - smbmnt can be installed setuid root if you want + smbmnt can be installed setuid root if you want normal users to be able to mount their SMB shares.

    A setuid smbmnt will only allow mounts on directories owned - by the user, and that the user has write permission on.

    The smbmnt program is normally invoked - by smbmount(8). It should not be invoked directly by users.

    smbmount searches the normal PATH for smbmnt. You must ensure + by the user, and that the user has write permission on.

    The smbmnt program is normally invoked + by smbmount(8). It should not be invoked directly by users.

    smbmount searches the normal PATH for smbmnt. You must ensure that the smbmnt version in your path matches the smbmount used.

    OPTIONS

    -r

    mount the filesystem read-only

    -u uid

    specify the uid that the files will be owned by

    -g gid

    specify the gid that the files will be @@ -15,8 +15,8 @@

    -h|--help

    Print a summary of command line options.

    AUTHOR

    Volker Lendecke, Andrew Tridgell, Michael H. Warfield and others.

    The current maintainer of smbfs and the userspace - tools smbmount, smbumount, - and smbmnt is Urban Widmark. + tools smbmount, smbumount, + and smbmnt is Urban Widmark. The SAMBA Mailing list is the preferred place to ask questions regarding these programs.

    The conversion of this manpage for Samba 2.2 was performed diff --git a/docs/htmldocs/smbmount.8.html b/docs/htmldocs/smbmount.8.html index 94560fba66..233dee51d7 100644 --- a/docs/htmldocs/smbmount.8.html +++ b/docs/htmldocs/smbmount.8.html @@ -1,27 +1,27 @@ -smbmount

    Name

    smbmount — mount an smbfs filesystem

    Synopsis

    smbmount {service} {mount-point} [-o options]

    DESCRIPTION

    smbmount mounts a Linux SMB filesystem. It - is usually invoked as mount.smbfs by - the mount(8) command when using the +smbmount

    Name

    smbmount — mount an smbfs filesystem

    Synopsis

    smbmount {service} {mount-point} [-o options]

    DESCRIPTION

    smbmount mounts a Linux SMB filesystem. It + is usually invoked as mount.smbfs by + the mount(8) command when using the "-t smbfs" option. This command only works in Linux, and the kernel must - support the smbfs filesystem.

    Options to smbmount are specified as a comma-separated + support the smbfs filesystem.

    Options to smbmount are specified as a comma-separated list of key=value pairs. It is possible to send options other than those listed here, assuming that smbfs supports them. If you get mount failures, check your kernel log for errors on - unknown options.

    smbmount is a daemon. After mounting it keeps running until + unknown options.

    smbmount is a daemon. After mounting it keeps running until the mounted smbfs is umounted. It will log things that happen when in daemon mode using the "machine name" smbmount, so - typically this output will end up in log.smbmount. The - smbmount process may also be called mount.smbfs.

    NOTE: smbmount - calls smbmnt(8) to do the actual mount. You - must make sure that smbmnt is in the path so - that it can be found.

    OPTIONS

    username=<arg>

    specifies the username to connect as. If - this is not given, then the environment variable + typically this output will end up in log.smbmount. The + smbmount process may also be called mount.smbfs.

    Note

    smbmount + calls smbmnt(8) to do the actual mount. You + must make sure that smbmnt is in the path so + that it can be found.

    OPTIONS

    username=<arg>

    specifies the username to connect as. If + this is not given, then the environment variable USER is used. This option can also take the form "user%password" or "user/workgroup" or "user/workgroup%password" to allow the password and workgroup to be specified as part of the username.

    password=<arg>

    specifies the SMB password. If this option is not given then the environment variable - PASSWD is used. If it can find - no password smbmount will prompt + PASSWD is used. If it can find + no password smbmount will prompt for a passeword, unless the guest option is given.

    Note that passwords which contain the argument delimiter @@ -35,7 +35,7 @@ The format of the file is: username = <value> password = <value>

    This is preferred over having passwords in plaintext in a - shared file, such as /etc/fstab. Be sure to protect any + shared file, such as /etc/fstab. Be sure to protect any credentials file properly.

    krb

    Use kerberos (Active Directory).

    netbiosname=<arg>

    sets the source NetBIOS name. It defaults to the local hostname.

    uid=<arg>

    sets the uid that will own all files on @@ -47,13 +47,15 @@ password = <value> gid.

    port=<arg>

    sets the remote SMB port number. The default is 139.

    fmask=<arg>

    sets the file mask. This determines the permissions that remote files have in the local filesystem. + This is not a umask, but the actual permissions for the files. The default is based on the current umask.

    dmask=<arg>

    Sets the directory mask. This determines the permissions that remote directories have in the local filesystem. + This is not a umask, but the actual permissions for the directories. The default is based on the current umask.

    debug=<arg>

    Sets the debug level. This is useful for tracking down SMB connection problems. A suggested value to start with is 4. If set too high there will be a lot of output, possibly hiding the useful output.

    ip=<arg>

    Sets the destination host or IP address. -

    workgroup=<arg>

    Sets the workgroup on the destination

    sockopt=<arg>

    Sets the TCP socket options. See the smb.conf(5) socket options option. +

    workgroup=<arg>

    Sets the workgroup on the destination

    sockopt=<arg>

    Sets the TCP socket options. See the smb.conf(5) socket options option.

    scope=<arg>

    Sets the NetBIOS scope

    guest

    Don't prompt for a password

    ro

    mount read-only

    rw

    mount read-write

    iocharset=<arg>

    sets the charset used by the Linux side for codepage to charset translations (NLS). Argument should be the @@ -73,14 +75,14 @@ password = <value> like 10000ms (10 seconds) is probably more reasonable in many cases. (Note: only kernel 2.4.2 or later) -

    ENVIRONMENT VARIABLES

    The variable USER may contain the username of the +

    ENVIRONMENT VARIABLES

    The variable USER may contain the username of the person using the client. This information is used only if the protocol level is high enough to support session-level passwords. The variable can be used to set both username and - password by using the format username%password.

    The variable PASSWD may contain the password of the + password by using the format username%password.

    The variable PASSWD may contain the password of the person using the client. This information is used only if the protocol level is high enough to support session-level - passwords.

    The variable PASSWD_FILE may contain the pathname + passwords.

    The variable PASSWD_FILE may contain the pathname of a file to read the password from. A single line of input is read and used as the password.

    BUGS

    Passwords and other options containing , can not be handled. For passwords an alternative way of passing them is in a credentials @@ -94,11 +96,11 @@ password = <value> to try the latest version first. So please try doing that first, and always include which versions you use of relevant software when reporting bugs (minimum: samba, kernel, distribution)

    SEE ALSO

    Documentation/filesystems/smbfs.txt in the linux kernel - source tree may contain additional options and information.

    FreeBSD also has a smbfs, but it is not related to smbmount

    For Solaris, HP-UX and others you may want to look at smbsh(1) or at other solutions, such as + source tree may contain additional options and information.

    FreeBSD also has a smbfs, but it is not related to smbmount

    For Solaris, HP-UX and others you may want to look at smbsh(1) or at other solutions, such as Sharity or perhaps replacing the SMB server with a NFS server.

    AUTHOR

    Volker Lendecke, Andrew Tridgell, Michael H. Warfield and others.

    The current maintainer of smbfs and the userspace - tools smbmount, smbumount, - and smbmnt is Urban Widmark. + tools smbmount, smbumount, + and smbmnt is Urban Widmark. The SAMBA Mailing list is the preferred place to ask questions regarding these programs.

    The conversion of this manpage for Samba 2.2 was performed diff --git a/docs/htmldocs/smbpasswd.5.html b/docs/htmldocs/smbpasswd.5.html index 82cb3450e9..556b637f4f 100644 --- a/docs/htmldocs/smbpasswd.5.html +++ b/docs/htmldocs/smbpasswd.5.html @@ -1,9 +1,9 @@ -smbpasswd

    Name

    smbpasswd — The Samba encrypted password file

    Synopsis

    smbpasswd

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbpasswd is the Samba encrypted password file. It contains +smbpasswd

    Name

    smbpasswd — The Samba encrypted password file

    Synopsis

    smbpasswd

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbpasswd is the Samba encrypted password file. It contains the username, Unix user id and the SMB hashed passwords of the user, as well as account flag information and the time the password was last changed. This file format has been evolving with Samba and has had several different formats in the past.

    FILE FORMAT

    The format of the smbpasswd file used by Samba 2.2 - is very similar to the familiar Unix passwd(5) + is very similar to the familiar Unix passwd(5) file. It is an ASCII file containing one line for each user. Each field ithin each line is separated from the next by a colon. Any entry beginning with '#' is ignored. The smbpasswd file contains the @@ -23,7 +23,7 @@ null password this field will contain the characters "NO PASSWORD" as the start of the hex string. If the hex string is equal to 32 'X' characters then the user's account is marked as - disabled and the user will not be able to + disabled and the user will not be able to log onto the Samba server.

    WARNING !! Note that, due to the challenge-response nature of the SMB/CIFS authentication protocol, anyone with a knowledge of this password hash will @@ -64,8 +64,8 @@ in the smbpasswd file.

  • N - This means the account has no password (the passwords in the fields LANMAN Password Hash and NT Password Hash are ignored). Note that this - will only allow users to log on with no password if the - null passwords parameter is set in the smb.conf(5) config file.

  • D - This means the account + will only allow users to log on with no password if the + null passwords parameter is set in the smb.conf(5) config file.

  • D - This means the account is disabled and no SMB/CIFS logins will be allowed for this user.

  • W - This means this account is a "Workstation Trust" account. This kind of account is used in the Samba PDC code stream to allow Windows NT Workstations @@ -75,7 +75,7 @@ "Last Change Time") followed by a numeric encoding of the UNIX time in seconds since the epoch (1970) that the last change was made.

    • All other colon separated fields are ignored at this time.

    VERSION

    This man page is correct for version 3.0 of - the Samba suite.

    SEE ALSO

    smbpasswd(8), Samba(7), and + the Samba suite.

    SEE ALSO

    smbpasswd(8), Samba(7), and the Internet RFC1321 for details on the MD4 algorithm.

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed diff --git a/docs/htmldocs/smbpasswd.8.html b/docs/htmldocs/smbpasswd.8.html index 44a1089e13..7612fdd775 100644 --- a/docs/htmldocs/smbpasswd.8.html +++ b/docs/htmldocs/smbpasswd.8.html @@ -1,17 +1,17 @@ -smbpasswd

    Name

    smbpasswd — change a user's SMB password

    Synopsis

    smbpasswd [-a] [-x] [-d] [-e] [-D debuglevel] [-n] [-r <remote machine>] [-R <name resolve order>] [-m] [-U username[%password]] [-h] [-s] [-w pass] [-i] [-L] [username]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The smbpasswd program has several different +smbpasswd

    Name

    smbpasswd — change a user's SMB password

    Synopsis

    smbpasswd [-a] [-x] [-d] [-e] [-D debuglevel] [-n] [-r <remote machine>] [-R <name resolve order>] [-m] [-U username[%password]] [-h] [-s] [-w pass] [-i] [-L] [username]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The smbpasswd program has several different functions, depending on whether it is run by the root user or not. When run as a normal user it allows the user to change the password used for their SMB sessions on any machines that store SMB passwords.

    By default (when run with no arguments) it will attempt to change the current user's SMB password on the local machine. This is - similar to the way the passwd(1) program works. + similar to the way the passwd(1) program works. smbpasswd differs from how the passwd program works however in that it is not setuid root but works in a client-server mode and communicates with a - locally running smbd(8). As a consequence in order for this to + locally running smbd(8). As a consequence in order for this to succeed the smbd daemon must be running on the local machine. On a UNIX machine the encrypted SMB passwords are usually stored in - the smbpasswd(5) file.

    When run by an ordinary user with no options, smbpasswd + the smbpasswd(5) file.

    When run by an ordinary user with no options, smbpasswd will prompt them for their old SMB password and then ask them for their new password twice, to ensure that the new password was typed correctly. No passwords will be echoed on the screen @@ -19,10 +19,10 @@ the string "NO PASSWORD" in the smbpasswd file) then just press the <Enter> key when asked for your old password.

    smbpasswd can also be used by a normal user to change their SMB password on remote machines, such as Windows NT Primary Domain - Controllers. See the (-r) and -U options + Controllers. See the (-r) and -U options below.

    When run by root, smbpasswd allows new users to be added and deleted in the smbpasswd file, as well as allows changes to - the attributes of the user in this file to be made. When run by root, + the attributes of the user in this file to be made. When run by root, smbpasswd accesses the local smbpasswd file directly, thus enabling changes to be made even if smbd is not running.

    OPTIONS

    -a

    This option specifies that the username @@ -32,29 +32,29 @@ the smbpasswd file and it is treated like a regular change password command. Note that the default passdb backends require the user to already exist in the system password file (usually - /etc/passwd), else the request to add the + /etc/passwd), else the request to add the user will fail.

    This option is only available when running smbpasswd as root.

    -x

    This option specifies that the username following should be deleted from the local smbpasswd file.

    This option is only available when running smbpasswd as root.

    -d

    This option specifies that the username following - should be disabled in the local smbpasswd - file. This is done by writing a 'D' flag + should be disabled in the local smbpasswd + file. This is done by writing a 'D' flag into the account control space in the smbpasswd file. Once this is done all attempts to authenticate via SMB using this username will fail.

    If the smbpasswd file is in the 'old' format (pre-Samba 2.0 format) there is no space in the user's password entry to write - this information and the command will FAIL. See smbpasswd(5) for details on the 'old' and new password file formats. + this information and the command will FAIL. See smbpasswd(5) for details on the 'old' and new password file formats.

    This option is only available when running smbpasswd as root.

    -e

    This option specifies that the username following - should be enabled in the local smbpasswd file, + should be enabled in the local smbpasswd file, if the account was previously disabled. If the account was not disabled this option has no effect. Once the account is enabled then - the user will be able to authenticate via SMB once again.

    If the smbpasswd file is in the 'old' format, then + the user will be able to authenticate via SMB once again.

    If the smbpasswd file is in the 'old' format, then smbpasswd will FAIL to enable the account. - See smbpasswd(5) for + See smbpasswd(5) for details on the 'old' and new password file formats.

    This option is only available when running smbpasswd as root. -

    -D debuglevel

    debuglevel is an integer +

    -D debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of smbpasswd. At level 0, only @@ -69,17 +69,17 @@ smbpasswd file.

    Note that to allow users to logon to a Samba server once the password has been set to "NO PASSWORD" in the smbpasswd file the administrator must set the following parameter in the [global] - section of the smb.conf file :

    null passwords = yes

    This option is only available when running smbpasswd as + section of the smb.conf file :

    null passwords = yes

    This option is only available when running smbpasswd as root.

    -r remote machine name

    This option allows a user to specify what machine they wish to change their password on. Without this parameter - smbpasswd defaults to the local host. The remote + smbpasswd defaults to the local host. The remote machine name is the NetBIOS name of the SMB/CIFS server to contact to attempt the password change. This name is resolved into an IP address using the standard name resolution - mechanism in all programs of the Samba suite. See the -R + mechanism in all programs of the Samba suite. See the -R name resolve order parameter for details on changing this resolving mechanism.

    The username whose password is changed is that of the - current UNIX logged on user. See the -U username + current UNIX logged on user. See the -U username parameter for details on changing the password for a different username.

    Note that if changing a Windows NT Domain password the remote machine specified must be the Primary Domain Controller for @@ -90,47 +90,47 @@ specifying a Win95/98 machine as remote machine target.

    -R name resolve order

    This option allows the user of smbpasswd to determine what name resolution services to use when looking up the NetBIOS name of the host being connected to.

    The options are :"lmhosts", "host", "wins" and "bcast". They - cause names to be resolved as follows:

    • lmhosts: Lookup an IP + cause names to be resolved as follows:

      • lmhosts: Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has - no name type attached to the NetBIOS name (see the lmhosts(5) for details) then - any name type matches for lookup.

      • host: Do a standard host - name to IP address resolution, using the system /etc/hosts + no name type attached to the NetBIOS name (see the lmhosts(5) for details) then + any name type matches for lookup.

      • host: Do a standard host + name to IP address resolution, using the system /etc/hosts , NIS, or DNS lookups. This method of name resolution is operating system depended for instance on IRIX or Solaris this - may be controlled by the /etc/nsswitch.conf + may be controlled by the /etc/nsswitch.conf file). Note that this method is only used if the NetBIOS name type being queried is the 0x20 (server) name type, otherwise - it is ignored.

      • wins: Query a name with - the IP address listed in the wins server + it is ignored.

      • wins: Query a name with + the IP address listed in the wins server parameter. If no WINS server has been specified this method - will be ignored.

      • bcast: Do a broadcast on + will be ignored.

      • bcast: Do a broadcast on each of the known local interfaces listed in the - interfaces parameter. This is the least + interfaces parameter. This is the least reliable of the name resolution methods as it depends on the - target host being on a locally connected subnet.

      The default order is lmhosts, host, wins, bcast - and without this parameter or any entry in the smb.conf(5) file the name resolution methods will + target host being on a locally connected subnet.

    The default order is lmhosts, host, wins, bcast + and without this parameter or any entry in the smb.conf(5) file the name resolution methods will be attempted in this order.

    -m

    This option tells smbpasswd that the account being changed is a MACHINE account. Currently this is used when Samba is being used as an NT Primary Domain Controller.

    This option is only available when running smbpasswd as root.

    -U username

    This option may only be used in conjunction - with the -r option. When changing + with the -r option. When changing a password on a remote machine it allows the user to specify the user name on that machine whose password will be changed. It is present to allow users who have different user names on - different systems to change these passwords.

    -h

    This option prints the help string for + different systems to change these passwords.

    -h

    This option prints the help string for smbpasswd, selecting the correct one for running as root or as an ordinary user.

    -s

    This option causes smbpasswd to be silent (i.e. not issue prompts) and to read its old and new passwords from - standard input, rather than from /dev/tty - (like the passwd(1) program does). This option + standard input, rather than from /dev/tty + (like the passwd(1) program does). This option is to aid people writing scripts to drive smbpasswd

    -w password

    This parameter is only available if Samba has been configured to use the experimental - --with-ldapsam option. The -w + --with-ldapsam option. The -w switch is used to specify the password to be used with the - ldap admin + ldap admin dn. Note that the password is stored in - the secrets.tdb and is keyed off - of the admin's DN. This means that if the value of ldap + the secrets.tdb and is keyed off + of the admin's DN. This means that if the value of ldap admin dn ever changes, the password will need to be manually updated as well.

    -i

    This option tells smbpasswd that the account @@ -141,17 +141,17 @@ root only options to operate on. Only root can specify this parameter as only root has the permission needed to modify attributes directly in the local smbpasswd file. -

    NOTES

    Since smbpasswd works in client-server +

    NOTES

    Since smbpasswd works in client-server mode communicating with a local smbd for a non-root user then the smbd daemon must be running for this to work. A common problem - is to add a restriction to the hosts that may access the - smbd running on the local machine by specifying either allow - hosts or deny hosts entry in - the smb.conf(5) file and neglecting to + is to add a restriction to the hosts that may access the + smbd running on the local machine by specifying either allow + hosts or deny hosts entry in + the smb.conf(5) file and neglecting to allow "localhost" access to the smbd.

    In addition, the smbpasswd command is only useful if Samba has been set up to use encrypted passwords. See the document "LanMan and NT Password Encryption in Samba" in the docs directory for details - on how to do this.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    smbpasswd(5), Samba(7).

    AUTHOR

    The original Samba software and related utilities + on how to do this.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    smbpasswd(5), Samba(7).

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. diff --git a/docs/htmldocs/smbsh.1.html b/docs/htmldocs/smbsh.1.html index 942f617920..935576af6b 100644 --- a/docs/htmldocs/smbsh.1.html +++ b/docs/htmldocs/smbsh.1.html @@ -1,10 +1,10 @@ -smbsh

    Name

    smbsh — Allows access to Windows NT filesystem - using UNIX commands

    Synopsis

    smbsh [-W workgroup] [-U username] [-P prefix] [-R <name resolve order>] [-d <debug level>] [-l logfile] [-L libdir]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbsh allows you to access an NT filesystem - using UNIX commands such as ls, - egrep, and rcp. You must use a - shell that is dynamically linked in order for smbsh +smbsh

    Name

    smbsh — Allows access to Windows NT filesystem + using UNIX commands

    Synopsis

    smbsh [-W workgroup] [-U username] [-P prefix] [-R <name resolve order>] [-d <debug level>] [-l logfile] [-L libdir]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbsh allows you to access an NT filesystem + using UNIX commands such as ls, + egrep, and rcp. You must use a + shell that is dynamically linked in order for smbsh to work correctly.

    OPTIONS

    -W WORKGROUP

    Override the default workgroup specified in the - workgroup parameter of the smb.conf(5) file + workgroup parameter of the smb.conf(5) file for this session. This may be needed to connect to some servers.

    -U username[%pass]

    Sets the SMB username or username and password. If this option is not specified, the user will be prompted for @@ -19,10 +19,10 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -36,69 +36,69 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -R <name resolve order>

    This option is used to determine what naming +smb.conf(5) file.

    -R <name resolve order>

    This option is used to determine what naming services and in what order to resolve host names to IP addresses. The option takes a space-separated string of different name resolution options.

    The options are: "lmhosts", "host", "wins" and "bcast". -They cause names to be resolved as follows :

    • lmhosts: +They cause names to be resolved as follows :

      • lmhosts: Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has no name type attached to the NetBIOS name -(see the lmhosts(5) for details) +(see the lmhosts(5) for details) then any name type matches for lookup. -

      • host: +

      • host: Do a standard host name to IP address resolution, using -the system /etc/hosts, NIS, or DNS +the system /etc/hosts, NIS, or DNS lookups. This method of name resolution is operating system dependent, for instance on IRIX or Solaris this -may be controlled by the /etc/nsswitch.conf +may be controlled by the /etc/nsswitch.conf file). Note that this method is only used if the NetBIOS name type being queried is the 0x20 (server) name type, otherwise it is ignored. -

      • wins: +

      • wins: Query a name with the IP address listed in the -wins server parameter. If no +wins server parameter. If no WINS server has been specified this method will be ignored. -

      • bcast: +

      • bcast: Do a broadcast on each of the known local interfaces -listed in the interfaces +listed in the interfaces parameter. This is the least reliable of the name resolution methods as it depends on the target host being on a locally connected subnet.

      If this parameter is not set then the name resolve order -defined in the smb.conf(5) file parameter -(name resolve order) will be used.

      The default order is lmhosts, host, wins, bcast. Without -this parameter or any entry in the name resolve order - parameter of the smb.conf(5) file, the name resolution methods +defined in the smb.conf(5) file parameter +(name resolve order) will be used.

      The default order is lmhosts, host, wins, bcast. Without +this parameter or any entry in the name resolve order + parameter of the smb.conf(5) file, the name resolution methods will be attempted in this order.

    -L libdir

    This parameter specifies the location of the - shared libraries used by smbsh. The default + shared libraries used by smbsh. The default value is specified at compile time. -

    EXAMPLES

    To use the smbsh command, execute +

    EXAMPLES

    To use the smbsh command, execute smbsh from the prompt and enter the username and password that authenticates you to the machine running the Windows NT operating system. 

    -system% smbsh
-Username: user
-Password: XXXXXXX
+system% smbsh
+Username: user
+Password: XXXXXXX

    Any dynamically linked command you execute from - this shell will access the /smb directory - using the smb protocol. For example, the command ls /smb + this shell will access the /smb directory + using the smb protocol. For example, the command ls /smb will show a list of workgroups. The command - ls /smb/MYGROUP will show all the machines in + ls /smb/MYGROUP will show all the machines in the workgroup MYGROUP. The command - ls /smb/MYGROUP/<machine-name> will show the share - names for that machine. You could then, for example, use the - cd command to change directories, vi to - edit files, and rcp to copy files.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    BUGS

    smbsh works by intercepting the standard - libc calls with the dynamically loaded versions in + ls /smb/MYGROUP/<machine-name> will show the share + names for that machine. You could then, for example, use the + cd command to change directories, vi to + edit files, and rcp to copy files.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    BUGS

    smbsh works by intercepting the standard + libc calls with the dynamically loaded versions in smbwrapper.o. Not all calls have been "wrapped", so - some programs may not function correctly under smbsh + some programs may not function correctly under smbsh .

    Programs which are not dynamically linked cannot make - use of smbsh's functionality. Most versions - of UNIX have a file command that will - describe how a program was linked.

    SEE ALSO

    smbd(8), smb.conf(5)

    AUTHOR

    The original Samba software and related utilities + use of smbsh's functionality. Most versions + of UNIX have a file command that will + describe how a program was linked.

    SEE ALSO

    smbd(8), smb.conf(5)

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. diff --git a/docs/htmldocs/smbspool.8.html b/docs/htmldocs/smbspool.8.html index fffd779dcf..186f30ebcf 100644 --- a/docs/htmldocs/smbspool.8.html +++ b/docs/htmldocs/smbspool.8.html @@ -1,14 +1,14 @@ -smbspool

    Name

    smbspool — send a print file to an SMB printer

    Synopsis

    smbspool {job} {user} {title} {copies} {options} [filename]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbspool is a very small print spooling program that +smbspool

    Name

    smbspool — send a print file to an SMB printer

    Synopsis

    smbspool {job} {user} {title} {copies} {options} [filename]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbspool is a very small print spooling program that sends a print file to an SMB printer. The command-line arguments are position-dependent for compatibility with the Common UNIX Printing System, but you can use smbspool with any printing system or from a program or script.

    DEVICE URI

    smbspool specifies the destination using a Uniform Resource Identifier ("URI") with a method of "smb". This string can take a number of forms:

    • smb://server/printer

    • smb://workgroup/server/printer

    • smb://username:password@server/printer

    • smb://username:password@workgroup/server/printer

    smbspool tries to get the URI from argv[0]. If argv[0] - contains the name of the program then it looks in the - DEVICE_URI environment variable.

    Programs using the exec(2) functions can + contains the name of the program then it looks in the + DEVICE_URI environment variable.

    Programs using the exec(2) functions can pass the URI in argv[0], while shell scripts must set the - DEVICE_URI environment variable prior to + DEVICE_URI environment variable prior to running smbspool.

    OPTIONS

    • The job argument (argv[1]) contains the job ID number and is presently not used by smbspool.

    • The user argument (argv[2]) contains the @@ -22,7 +22,7 @@ the print options in a single string and is currently not used by smbspool.

    • The filename argument (argv[6]) contains the name of the file to print. If this argument is not specified - then the print file is read from the standard input.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    smbd(8) and Samba(7).

    AUTHOR

    smbspool was written by Michael Sweet + then the print file is read from the standard input.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    smbd(8) and Samba(7).

    AUTHOR

    smbspool was written by Michael Sweet at Easy Software Products.

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar diff --git a/docs/htmldocs/smbstatus.1.html b/docs/htmldocs/smbstatus.1.html index a8ae9132ec..c1be6234c3 100644 --- a/docs/htmldocs/smbstatus.1.html +++ b/docs/htmldocs/smbstatus.1.html @@ -1,16 +1,16 @@ -smbstatus

    Name

    smbstatus — report on current Samba connections

    Synopsis

    smbstatus [-P] [-b] [-d <debug level>] [-v] [-L] [-B] [-p] [-S] [-s <configuration file>] [-u <username>]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbstatus is a very simple program to +smbstatus

    Name

    smbstatus — report on current Samba connections

    Synopsis

    smbstatus [-P] [-b] [-d <debug level>] [-v] [-L] [-B] [-p] [-S] [-s <configuration file>] [-u <username>]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbstatus is a very simple program to list the current Samba connections.

    OPTIONS

    -P|--profile

    If samba has been compiled with the profiling option, print only the contents of the profiling shared memory area.

    -b|--brief

    gives brief output.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -24,15 +24,15 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -v|--verbose

    gives verbose output.

    -L|--locks

    causes smbstatus to only list locks.

    -B|--byterange

    causes smbstatus to include byte range locks. -

    -p|--processes

    print a list of smbd(8) processes and exit. +

    -p|--processes

    print a list of smbd(8) processes and exit. Useful for scripting.

    -S|--shares

    causes smbstatus to only list shares.

    -h|--help

    Print a summary of command line options.

    -u|--user=<username>

    selects information relevant to - username only.

    VERSION

    This man page is correct for version 3.0 of - the Samba suite.

    SEE ALSO

    smbd(8) and smb.conf(5).

    AUTHOR

    The original Samba software and related utilities + username only.

    VERSION

    This man page is correct for version 3.0 of + the Samba suite.

    SEE ALSO

    smbd(8) and smb.conf(5).

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. diff --git a/docs/htmldocs/smbtar.1.html b/docs/htmldocs/smbtar.1.html index 35802edb90..30058d1860 100644 --- a/docs/htmldocs/smbtar.1.html +++ b/docs/htmldocs/smbtar.1.html @@ -1,34 +1,34 @@ -smbtar

    Name

    smbtar — shell script for backing up SMB/CIFS shares - directly to UNIX tape drives

    Synopsis

    smbtar [-r] [-i] [-a] [-v] {-s server} [-p password] [-x services] [-X] [-N filename] [-b blocksize] [-d directory] [-l loglevel] [-u user] [-t tape] {filenames}

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbtar is a very small shell script on top - of smbclient(1) which dumps SMB shares directly to tape.

    OPTIONS

    -s server

    The SMB/CIFS server that the share resides +smbtar

    Name

    smbtar — shell script for backing up SMB/CIFS shares + directly to UNIX tape drives

    Synopsis

    smbtar [-r] [-i] [-a] [-v] {-s server} [-p password] [-x services] [-X] [-N filename] [-b blocksize] [-d directory] [-l loglevel] [-u user] [-t tape] {filenames}

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbtar is a very small shell script on top + of smbclient(1) which dumps SMB shares directly to tape.

    OPTIONS

    -s server

    The SMB/CIFS server that the share resides upon.

    -x service

    The share name on the server to connect to. The default is "backup".

    -X

    Exclude mode. Exclude filenames... from tar - create or restore.

    -d directory

    Change to initial directory + create or restore.

    -d directory

    Change to initial directory before restoring / backing up files.

    -v

    Verbose mode.

    -p password

    The password to use to access a share. Default: none

    -u user

    The user id to connect as. Default: UNIX login name.

    -a

    Reset DOS archive bit mode to indicate file has been archived.

    -t tape

    Tape device. May be regular file or tape - device. Default: $TAPE environmental - variable; if not set, a file called tar.out + device. Default: $TAPE environmental + variable; if not set, a file called tar.out .

    -b blocksize

    Blocking factor. Defaults to 20. See - tar(1) for a fuller explanation.

    -N filename

    Backup only files newer than filename. Could + tar(1) for a fuller explanation.

    -N filename

    Backup only files newer than filename. Could be used (for example) on a log file to implement incremental backups.

    -i

    Incremental mode; tar files are only backed up if they have the archive bit set. The archive bit is reset after each file is read.

    -r

    Restore. Files are restored to the share from the tar file.

    -l log level

    Log (debug) level. Corresponds to the - -d flag of smbclient(1).

    ENVIRONMENT VARIABLES

    The $TAPE variable specifies the + -d flag of smbclient(1).

    ENVIRONMENT VARIABLES

    The $TAPE variable specifies the default tape device to write to. May be overridden - with the -t option.

    BUGS

    The smbtar script has different + with the -t option.

    BUGS

    The smbtar script has different options from ordinary tar and from smbclient's tar command.

    CAVEATS

    Sites that are more careful about security may not like the way the script handles PC passwords. Backup and restore work on entire shares; should work on file lists. smbtar works best - with GNU tar and may not work well with other versions.

    DIAGNOSTICS

    See the DIAGNOSTICS section for the smbclient(1) command.

    VERSION

    This man page is correct for version 3.0 of - the Samba suite.

    SEE ALSO

    smbd(8), smbclient(1), smb.conf(5).

    AUTHOR

    The original Samba software and related utilities + with GNU tar and may not work well with other versions.

    DIAGNOSTICS

    See the DIAGNOSTICS section for the smbclient(1) command.

    VERSION

    This man page is correct for version 3.0 of + the Samba suite.

    SEE ALSO

    smbd(8), smbclient(1), smb.conf(5).

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    Ricky Poulten - wrote the tar extension and this man page. The smbtar + wrote the tar extension and this man page. The smbtar script was heavily rewritten and improved by Martin Kraemer. Many thanks to everyone who suggested extensions, improvements, bug fixes, etc. The man page sources were converted to YODL format (another diff --git a/docs/htmldocs/smbtree.1.html b/docs/htmldocs/smbtree.1.html index 0d9a845d70..6cf24ddf91 100644 --- a/docs/htmldocs/smbtree.1.html +++ b/docs/htmldocs/smbtree.1.html @@ -1,5 +1,5 @@ -smbtree

    Name

    smbtree — A text based smb network browser -

    Synopsis

    smbtree [-b] [-D] [-S]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbtree is a smb browser program +smbtree

    Name

    smbtree — A text based smb network browser +

    Synopsis

    smbtree [-b] [-D] [-S]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbtree is a smb browser program in text mode. It is similar to the "Network Neighborhood" found on Windows computers. It prints a tree with all the known domains, the servers in those domains and @@ -12,15 +12,15 @@ all the domains and servers responding on broadcast or known by the master browser.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -34,8 +34,8 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -N

    If specified, this parameter suppresses the normal password prompt from the client to the user. This is useful when @@ -53,19 +53,19 @@ password = <value> domain = <value>

    Make certain that the permissions on the file restrict access from unwanted users.

    -U|--user=username[%password]

    Sets the SMB username or username and password.

    If %password is not specified, the user will be prompted. The -client will first check the USER environment variable, then the -LOGNAME variable and if either exists, the +client will first check the USER environment variable, then the +LOGNAME variable and if either exists, the string is uppercased. If these environmental variables are not -found, the username GUEST is used.

    A third option is to use a credentials file which +found, the username GUEST is used.

    A third option is to use a credentials file which contains the plaintext of the username and password. This option is mainly provided for scripts where the admin does not wish to pass the credentials on the command line or via environment variables. If this method is used, make certain that the permissions on the file restrict access from unwanted users. See the --A for more details.

    Be cautious about including passwords in scripts. Also, on +-A for more details.

    Be cautious about including passwords in scripts. Also, on many systems the command line of a running process may be seen -via the ps command. To be safe always allow -rpcclient to prompt for a password and type +via the ps command. To be safe always allow +rpcclient to prompt for a password and type it in directly.

    -h|--help

    Print a summary of command line options.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    AUTHOR

    The original Samba software and related utilities diff --git a/docs/htmldocs/smbumount.8.html b/docs/htmldocs/smbumount.8.html index e297d448e3..f0aa0f974d 100644 --- a/docs/htmldocs/smbumount.8.html +++ b/docs/htmldocs/smbumount.8.html @@ -1,14 +1,14 @@ -smbumount

    Name

    smbumount — smbfs umount for normal users

    Synopsis

    smbumount {mount-point}

    DESCRIPTION

    With this program, normal users can unmount smb-filesystems, - provided that it is suid root. smbumount has +smbumount

    Name

    smbumount — smbfs umount for normal users

    Synopsis

    smbumount {mount-point}

    DESCRIPTION

    With this program, normal users can unmount smb-filesystems, + provided that it is suid root. smbumount has been written to give normal Linux users more control over their resources. It is safe to install this program suid root, because only the user who has mounted a filesystem is allowed to unmount it again. For root it is not necessary to use smbumount. The normal umount program works perfectly well, but it would certainly be problematic - to make umount setuid root.

    OPTIONS

    mount-point

    The directory to unmount.

    SEE ALSO

    smbmount(8)

    AUTHOR

    Volker Lendecke, Andrew Tridgell, Michael H. Warfield + to make umount setuid root.

    OPTIONS

    mount-point

    The directory to unmount.

    SEE ALSO

    smbmount(8)

    AUTHOR

    Volker Lendecke, Andrew Tridgell, Michael H. Warfield and others.

    The current maintainer of smbfs and the userspace - tools smbmount, smbumount, - and smbmnt is Urban Widmark. + tools smbmount, smbumount, + and smbmnt is Urban Widmark. The SAMBA Mailing list is the preferred place to ask questions regarding these programs.

    The conversion of this manpage for Samba 2.2 was performed diff --git a/docs/htmldocs/speed.html b/docs/htmldocs/speed.html index d2e1f2c15b..626d5e0193 100644 --- a/docs/htmldocs/speed.html +++ b/docs/htmldocs/speed.html @@ -1,5 +1,4 @@ - -Chapter 35. Samba performance issues

    Chapter 35. Samba performance issues
    Prev Part V. Appendixes 

    Chapter 35. Samba performance issues

    Paul Cochrane

    Dundee Limb Fitting Centre

    <paulc@dth.scot.nhs.uk>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    Table of Contents

    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning

    Comparisons

    +Chapter 39. Samba Performance Tuning

    Chapter 39. Samba Performance Tuning
    Prev Part VI. Appendixes Next

    Chapter 39. Samba Performance Tuning

    Paul Cochrane

    Dundee Limb Fitting Centre

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files

    Comparisons

    The Samba server uses TCP to talk to the client. Thus if you are trying to see if it performs well you should really compare it to programs that use the same protocol. The most readily available @@ -9,7 +8,7 @@ SMB server. If you want to test against something like a NT or WfWg server then you will have to disable all but TCP on either the client or server. Otherwise you may well be using a totally different protocol -(such as Netbeui) and comparisons may not be valid. +(such as NetBEUI) and comparisons may not be valid.

    Generally you should find that Samba performs similarly to ftp at raw transfer speed. It should perform quite a bit faster than NFS, @@ -21,14 +20,14 @@ suspect the biggest factor is not Samba vs some other system but the hardware and drivers used on the various systems. Given similar hardware Samba should certainly be competitive in speed with other systems. -

    Socket options

    +

    Socket options

    There are a number of socket options that can greatly affect the performance of a TCP based server like Samba.

    The socket options that Samba uses are settable both on the command -line with the -O option, or in the smb.conf file. +line with the -O option, or in the smb.conf file.

    -The socket options section of the smb.conf manual page describes how +The socket options section of the smb.conf manual page describes how to set these and gives recommendations.

    Getting the socket options right can make a big difference to your @@ -37,11 +36,11 @@ much. The correct settings are very dependent on your local network.

    The socket option TCP_NODELAY is the one that seems to make the biggest single difference for most networks. Many people report that -adding socket options = TCP_NODELAY doubles the read +adding socket options = TCP_NODELAY doubles the read performance of a Samba drive. The best explanation I have seen for this is that the Microsoft TCP/IP stack is slow in sending tcp ACKs. -

    Read size

    -The option read size affects the overlap of disk +

    Read size

    +The option read size affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger than this value then the server begins writing @@ -57,11 +56,11 @@ The default value is 16384, but very little experimentation has been done yet to determine the optimal value, and it is likely that the best value will vary greatly between systems anyway. A value over 65536 is pointless and will cause you to allocate memory unnecessarily. -

    Max xmit

    -At startup the client and server negotiate a maximum transmit size, +

    Max xmit

    +At startup the client and server negotiate a maximum transmit size, which limits the size of nearly all SMB commands. You can set the -maximum size that Samba will negotiate using the max xmit = option -in smb.conf. Note that this is the maximum size of SMB requests that +maximum size that Samba will negotiate using the max xmit = option +in smb.conf. Note that this is the maximum size of SMB requests that Samba will accept, but not the maximum size that the *client* will accept. The client maximum receive size is sent to Samba by the client and Samba honours this limit. @@ -71,38 +70,71 @@ clients may perform better with a smaller transmit unit. Trying values of less than 2048 is likely to cause severe problems.

    In most cases the default is the best option. -

    Log level

    -If you set the log level (also known as debug level) higher than 2 +

    Log level

    +If you set the log level (also known as debug level) higher than 2 then you may suffer a large drop in performance. This is because the server flushes the log file after each operation, which can be very expensive. -

    Read raw

    -The read raw operation is designed to be an optimised, low-latency +

    Read raw

    +The read raw operation is designed to be an optimised, low-latency file read operation. A server may choose to not support it, -however. and Samba makes support for read raw optional, with it +however. and Samba makes support for read raw optional, with it being enabled by default.

    -In some cases clients don't handle read raw very well and actually +In some cases clients don't handle read raw very well and actually get lower performance using it than they get using the conventional read operations.

    -So you might like to try read raw = no and see what happens on your +So you might like to try read raw = no and see what happens on your network. It might lower, raise or not affect your performance. Only testing can really tell. -

    Write raw

    -The write raw operation is designed to be an optimised, low-latency +

    Write raw

    +The write raw operation is designed to be an optimised, low-latency file write operation. A server may choose to not support it, -however. and Samba makes support for write raw optional, with it +however. and Samba makes support for write raw optional, with it being enabled by default.

    -Some machines may find write raw slower than normal write, in which +Some machines may find write raw slower than normal write, in which case you may wish to change this option. -

    Slow Logins

    +

    Slow Logins

    Slow logins are almost always due to the password checking time. Using -the lowest practical password level will improve things. -

    Client tuning

    +the lowest practical password level will improve things. +

    Client tuning

    Often a speed problem can be traced to the client. The client (for example Windows for Workgroups) can often be tuned for better TCP performance. Check the sections on the various clients in -Samba and Other Clients. -

    Prev Up 
    Chapter 34. SWAT - The Samba Web Admininistration Tool Home 
    +Samba and Other Clients. +

    Samba performance problem due changing kernel

    +Hi everyone. I am running Gentoo on my server and samba 2.2.8a. Recently +I changed kernel version from linux-2.4.19-gentoo-r10 to +linux-2.4.20-wolk4.0s. And now I have performance issue with samba. Ok +many of you will probably say that move to vanilla sources...well I tried +it too and it didn't work. I have 100mb LAN and two computers (linux + +Windows2000). Linux server shares directory with DivX files, client +(windows2000) plays them via LAN. Before when I was running 2.4.19 kernel +everything was fine, but now movies freezes and stops...I tried moving +files between server and Windows and it's terribly slow. +

    +Grab mii-tool and check the duplex settings on the NIC. +My guess is that it is a link layer issue, not an application +layer problem. Also run ifconfig and verify that the framing +error, collisions, etc... look normal for ethernet. +

    Corrupt tdb Files

    +Well today it happened, Our first major problem using samba. +Our samba PDC server has been hosting 3 TB of data to our 500+ users +[Windows NT/XP] for the last 3 years using samba, no problem. +But today all shares went SLOW; very slow. Also the main smbd kept +spawning new processes so we had 1600+ running smbd's (normally we avg. 250). +It crashed the SUN E3500 cluster twice. After a lot of searching I +decided to rm /var/locks/*.tdb. Happy again. +

    +Q1) Is there any method of keeping the *.tdb files in top condition or +how to early detect corruption? +

    +A1) Yes, run tdbbackup each time after stopping nmbd and before starting nmbd. +

    +Q2) What I also would like to mention is that the service latency seems +a lot lower then before the locks cleanup, any ideas on keeping it top notch? +

    +A2) Yes! Same answer as for Q1! +

    Prev Up Next
    Chapter 38. Samba and other CIFS clients Home Chapter 40. DNS and DHCP Configuration Guide
    diff --git a/docs/htmldocs/swat.8.html b/docs/htmldocs/swat.8.html index c5a5ab271b..e0719dce3d 100644 --- a/docs/htmldocs/swat.8.html +++ b/docs/htmldocs/swat.8.html @@ -1,28 +1,28 @@ -swat

    Name

    swat — Samba Web Administration Tool

    Synopsis

    swat [-s <smb config file>] [-a]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    swat allows a Samba administrator to - configure the complex smb.conf(5) file via a Web browser. In addition, - a swat configuration page has help links - to all the configurable options in the smb.conf file allowing an - administrator to easily look up the effects of any change.

    swat is run from inetd

    OPTIONS

    -s smb configuration file

    The default configuration file path is +swat

    Name

    swat — Samba Web Administration Tool

    Synopsis

    swat [-s <smb config file>] [-a]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    swat allows a Samba administrator to + configure the complex smb.conf(5) file via a Web browser. In addition, + a swat configuration page has help links + to all the configurable options in the smb.conf file allowing an + administrator to easily look up the effects of any change.

    swat is run from inetd

    OPTIONS

    -s smb configuration file

    The default configuration file path is determined at compile time. The file specified contains - the configuration details required by the smbd(8) server. This is the file - that swat will modify. + the configuration details required by the smbd(8) server. This is the file + that swat will modify. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide. - See smb.conf for more information. + See smb.conf for more information.

    -a

    This option disables authentication and puts - swat in demo mode. In that mode anyone will be able to modify - the smb.conf file.

    WARNING: Do NOT enable this option on a production + swat in demo mode. In that mode anyone will be able to modify + the smb.conf file.

    WARNING: Do NOT enable this option on a production server.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -36,46 +36,46 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -h|--help

    Print a summary of command line options.

    INSTALLATION

    Swat is included as binary package with most distributions. The package manager in this case takes care of the installation and configuration. This section is only for those who have compiled swat from scratch. -

    After you compile SWAT you need to run make install - to install the swat binary +

    After you compile SWAT you need to run make install + to install the swat binary and the various help files and images. A default install would put - these in:

    • /usr/local/samba/bin/swat

    • /usr/local/samba/swat/images/*

    • /usr/local/samba/swat/help/*

    Inetd Installation

    You need to edit your /etc/inetd.conf - and /etc/services - to enable SWAT to be launched via inetd.

    In /etc/services you need to - add a line like this:

    swat 901/tcp

    Note for NIS/YP and LDAP users - you may need to rebuild the - NIS service maps rather than alter your local + these in:

    • /usr/local/samba/bin/swat

    • /usr/local/samba/swat/images/*

    • /usr/local/samba/swat/help/*

    Inetd Installation

    You need to edit your /etc/inetd.conf + and /etc/services + to enable SWAT to be launched via inetd.

    In /etc/services you need to + add a line like this:

    swat 901/tcp

    Note for NIS/YP and LDAP users - you may need to rebuild the + NIS service maps rather than alter your local /etc/services file.

    the choice of port number isn't really important except that it should be less than 1024 and not currently used (using a number above 1024 presents an obscure security hole depending on the implementation details of your - inetd daemon).

    In /etc/inetd.conf you should - add a line like this:

    swat stream tcp nowait.400 root - /usr/local/samba/bin/swat swat

    One you have edited /etc/services - and /etc/inetd.conf you need to send a - HUP signal to inetd. To do this use kill -1 PID + inetd daemon).

    In /etc/inetd.conf you should + add a line like this:

    swat stream tcp nowait.400 root + /usr/local/samba/bin/swat swat

    One you have edited /etc/services + and /etc/inetd.conf you need to send a + HUP signal to inetd. To do this use kill -1 PID where PID is the process ID of the inetd daemon.

    LAUNCHING

    To launch SWAT just run your favorite web browser and point it at "http://localhost:901/".

    Note that you can attach to SWAT from any IP connected machine but connecting from a remote machine leaves your connection open to password sniffing as passwords will be sent - in the clear over the wire.

    FILES

    /etc/inetd.conf

    This file must contain suitable startup - information for the meta-daemon.

    /etc/services

    This file must contain a mapping of service name + in the clear over the wire.

    FILES

    /etc/inetd.conf

    This file must contain suitable startup + information for the meta-daemon.

    /etc/services

    This file must contain a mapping of service name (e.g., swat) to service port (e.g., 901) and protocol type - (e.g., tcp).

    /usr/local/samba/lib/smb.conf

    This is the default location of the smb.conf(5) server configuration file that swat edits. Other - common places that systems install this file are - /usr/samba/lib/smb.conf and /etc/smb.conf + (e.g., tcp).

    /usr/local/samba/lib/smb.conf

    This is the default location of the smb.conf(5) server configuration file that swat edits. Other + common places that systems install this file are + /usr/samba/lib/smb.conf and /etc/smb.conf . This file describes all the services the server - is to make available to clients.

    WARNINGS

    swat will rewrite your smb.conf(5) file. It will rearrange the entries and delete all - comments, include= and copy= - options. If you have a carefully crafted - smb.conf then back it up or don't use swat!

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    inetd(5), smbd(8), smb.conf(5)

    AUTHOR

    The original Samba software and related utilities + is to make available to clients.

    WARNINGS

    swat will rewrite your smb.conf(5) file. It will rearrange the entries and delete all + comments, include= and copy= + options. If you have a carefully crafted + smb.conf then back it up or don't use swat!

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    inetd(5), smbd(8), smb.conf(5)

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. diff --git a/docs/htmldocs/testparm.1.html b/docs/htmldocs/testparm.1.html index 55779a2ad8..3732b53f4c 100644 --- a/docs/htmldocs/testparm.1.html +++ b/docs/htmldocs/testparm.1.html @@ -1,45 +1,45 @@ -testparm

    Name

    testparm — check an smb.conf configuration file for - internal correctness

    Synopsis

    testparm [-s] [-h] [-v] [-L <servername>] [-t <encoding>] {config filename} [hostname hostIP]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    testparm is a very simple test program - to check an smbd(8) configuration file for +testparm

    Name

    testparm — check an smb.conf configuration file for + internal correctness

    Synopsis

    testparm [-s] [-h] [-v] [-L <servername>] [-t <encoding>] {config filename} [hostname hostIP]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    testparm is a very simple test program + to check an smbd(8) configuration file for internal correctness. If this program reports no problems, you - can use the configuration file with confidence that smbd + can use the configuration file with confidence that smbd will successfully load the configuration file.

    Note that this is NOT a guarantee that the services specified in the configuration file will be available or will operate as expected.

    If the optional host name and host IP address are specified on the command line, this test program will run through the service entries reporting whether the specified host - has access to each service.

    If testparm finds an error in the + has access to each service.

    If testparm finds an error in the smb.conf file it returns an exit code of 1 to the calling program, else it returns an exit code of 0. This allows shell scripts - to test the output from testparm.

    OPTIONS

    -s

    Without this option, testparm + to test the output from testparm.

    OPTIONS

    -s

    Without this option, testparm will prompt for a carriage return after printing the service names and before dumping the service definitions.

    -h|--help

    Print a summary of command line options.

    -V

    Prints the version number for -smbd.

    -L servername

    Sets the value of the %L macro to servername. +smbd.

    -L servername

    Sets the value of the %L macro to servername. This is useful for testing include files specified with the %L macro.

    -v

    If this option is specified, testparm - will also output all options that were not used in smb.conf(5) and are thus set to their defaults.

    -t encoding

    + will also output all options that were not used in smb.conf(5) and are thus set to their defaults.

    -t encoding

    Output data in specified encoding.

    configfilename

    This is the name of the configuration file to check. If this parameter is not present then the - default smb.conf(5) file will be checked. + default smb.conf(5) file will be checked.

    hostname

    If this parameter and the following are - specified, then testparm will examine the hosts - allow and hosts deny - parameters in the smb.conf(5) file to + specified, then testparm will examine the hosts + allow and hosts deny + parameters in the smb.conf(5) file to determine if the hostname with this IP address would be - allowed access to the smbd server. If + allowed access to the smbd server. If this parameter is supplied, the hostIP parameter must also be supplied.

    hostIP

    This is the IP address of the host specified in the previous parameter. This address must be supplied - if the hostname parameter is supplied.

    FILES

    smb.conf(5)

    This is usually the name of the configuration - file used by smbd(8). + if the hostname parameter is supplied.

    FILES

    smb.conf(5)

    This is usually the name of the configuration + file used by smbd(8).

    DIAGNOSTICS

    The program will issue a message saying whether the configuration file loaded OK or not. This message may be preceded by errors and warnings if the file did not load. If the file was loaded OK, the program then dumps all known service details to stdout.

    VERSION

    This man page is correct for version 3.0 of - the Samba suite.

    SEE ALSO

    smb.conf(5), smbd(8)

    AUTHOR

    The original Samba software and related utilities + the Samba suite.

    SEE ALSO

    smb.conf(5), smbd(8)

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. diff --git a/docs/htmldocs/testprns.1.html b/docs/htmldocs/testprns.1.html index 16784fcc25..ff7d4efd33 100644 --- a/docs/htmldocs/testprns.1.html +++ b/docs/htmldocs/testprns.1.html @@ -1,6 +1,6 @@ -testprns

    Name

    testprns — check printer name for validity with smbd

    Synopsis

    testprns {printername} [printcapname]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    testprns is a very simple test program +testprns

    Name

    testprns — check printer name for validity with smbd

    Synopsis

    testprns {printername} [printcapname]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    testprns is a very simple test program to determine whether a given printer name is valid for use in - a service to be provided by smbd(8).

    "Valid" in this context means "can be found in the + a service to be provided by smbd(8).

    "Valid" in this context means "can be found in the printcap specified". This program is very stupid - so stupid in fact that it would be wisest to always specify the printcap file to use.

    OPTIONS

    printername

    The printer name to validate.

    Printer names are taken from the first field in each @@ -9,24 +9,24 @@ Note that no validation or checking of the printcap syntax is done beyond that required to extract the printer name. It may be that the print spooling system is more forgiving or less - forgiving than testprns. However, if - testprns finds the printer then smbd(8) should do so as well.

    printcapname

    This is the name of the printcap file within - which to search for the given printer name.

    If no printcap name is specified testprns + forgiving than testprns. However, if + testprns finds the printer then smbd(8) should do so as well.

    printcapname

    This is the name of the printcap file within + which to search for the given printer name.

    If no printcap name is specified testprns will attempt to scan the printcap file name - specified at compile time.

    FILES

    /etc/printcap

    This is usually the default printcap - file to scan. See printcap (5). + specified at compile time.

    FILES

    /etc/printcap

    This is usually the default printcap + file to scan. See printcap (5).

    DIAGNOSTICS

    If a printer is found to be valid, the message "Printer name <printername> is valid" will be displayed.

    If a printer is found to be invalid, the message "Printer name <printername> is not valid" will be displayed.

    All messages that would normally be logged during operation of the Samba daemons are logged by this program to the - file test.log in the current directory. The + file test.log in the current directory. The program runs at debuglevel 3, so quite extensive logging information is written. The log should be checked carefully for errors and warnings.

    Other messages are self-explanatory.

    VERSION

    This man page is correct for version 3.0 of - the Samba suite.

    SEE ALSO

    printcap(5), - smbd(8), smbclient(1)

    AUTHOR

    The original Samba software and related utilities + the Samba suite.

    SEE ALSO

    printcap(5), + smbd(8), smbclient(1)

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. diff --git a/docs/htmldocs/type.html b/docs/htmldocs/type.html index 3524abc962..209c177a0b 100644 --- a/docs/htmldocs/type.html +++ b/docs/htmldocs/type.html @@ -1,16 +1,9 @@ - -Part II. Server Configuration Basics

    Part II. Server Configuration Basics
    Prev   Next

    Server Configuration Basics

    First Steps in Server Configuration

    +Part II. Server Configuration Basics

    Part II. Server Configuration Basics
    Prev   Next

    Server Configuration Basics

    First Steps in Server Configuration

    Samba can operate in various modes within SMB networks. This HOWTO section contains information on configuring samba to function as the type of server your network requires. Please read this section carefully. -

    Table of Contents

    3. Nomenclature of Server Types
    Stand Alone Server
    Domain Member Server
    Domain Controller
    Domain Controller Types
    4. Samba as Stand-Alone Server
    User and Share security level
    User Level Security
    Share Level Security
    Server Level Security
    Domain Level Security
    ADS Level Security
    5. -Samba as an NT4 or Win2k Primary Domain Controller -
    Prerequisite Reading
    -Background -
    Configuring the Samba Domain Controller
    Creating Machine Trust Accounts and Joining Clients to the Domain
    Manual Creation of Machine Trust Accounts
    "On-the-Fly" Creation of Machine Trust Accounts
    Joining the Client to the Domain
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." +

    Table of Contents

    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Seamless Windows Network Integration
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not -exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
    Domain Control for Windows 9x/ME
    Configuration Instructions: Network Logons
    6. -Samba Backup Domain Controller to Samba Domain Control -
    Prerequisite Reading
    Background
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    When is the PDC needed?
    Can Samba be a Backup Domain Controller to an NT PDC?
    How do I set up a Samba BDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Samba as a ADS domain member
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Possible errors
    Test your server setup
    Testing with smbclient
    Notes
    8. Samba as a NT4 or Win2k domain member
    Joining an NT Domain with Samba 3.0
    Why is this better than security = server?
    Prev Up Next
    Chapter 2. How to Install and Test SAMBA Home Chapter 3. Nomenclature of Server Types
    +existing set.." when creating a machine trust account.
    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not +exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, +I get a message about my account being disabled.
    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    Prev Up Next
    Chapter 3. Fast Start for the Impatient Home Chapter 4. Server Types and Security Modes
    diff --git a/docs/htmldocs/unicode.html b/docs/htmldocs/unicode.html index 0c5bb01d13..a971602e81 100644 --- a/docs/htmldocs/unicode.html +++ b/docs/htmldocs/unicode.html @@ -1,5 +1,19 @@ - -Chapter 25. Unicode/Charsets
    Chapter 25. Unicode/Charsets
    Prev Part III. Advanced Configuration Next

    Chapter 25. Unicode/Charsets

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    TAKAHASHI Motonobu

    <monyo@home.monyo.com>

    25 March 2003

    Table of Contents

    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets

    What are charsets and unicode?

    +Chapter 27. Unicode/Charsets

    Chapter 27. Unicode/Charsets
    Prev Part III. Advanced Configuration Next

    Chapter 27. Unicode/Charsets

    Jelmer R. Vernooij

    The Samba Team

    TAKAHASHI Motonobu

    25 March 2003

    Table of Contents

    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets

    Features and Benefits

    +Every industry eventually matures. One of the great areas of maturation is in +the focus that has been given over the past decade to make it possible for anyone +anywhere to use a computer. It has not always been that way, in fact, not so long +ago it was common for software to be written for exclusive use in the country of +origin. +

    +Of all the effort that has been brought to bear on providing native language support +for all computer users, the efforts of the Openi18n organisation is deserving of +special mention. For more information about Openi18n please refer to: +http://www.openi18n.org/. +

    +Samba-2.x supported a single locale through a mechanism called +codepages. Samba-3 is destined to become a truly trans-global +file and printer sharing platform. +

    What are charsets and unicode?

    Computers communicate in numbers. In texts, each number will be translated to a corresponding letter. The meaning that will be assigned to a certain number depends on the character set(charset) @@ -11,7 +25,7 @@ with German umlauts, Japanese characters, etc). Usually a charset contains exactly one byte.

    There are also charsets that support even more characters, but those need twice(or even more) as much storage space. These -charsets can contain 256 * 256 = 65536 characters, which +charsets can contain 256 * 256 = 65536 characters, which is more then all possible characters one could think of. They are called multibyte charsets (because they use more then one byte to store one character). @@ -22,39 +36,39 @@ A big advantage of using a multibyte charset is that you only need one; no need to make sure two computers use the same charset when they are communicating.

    Old windows clients used to use single-byte charsets, named -'codepages' by microsoft. However, there is no support for +'codepages' by Microsoft. However, there is no support for negotiating the charset to be used in the smb protocol. Thus, you have to make sure you are using the same charset when talking to an old client. Newer clients (Windows NT, 2K, XP) talk unicode over the wire. -

    Samba and charsets

    +

    Samba and charsets

    As of samba 3.0, samba can (and will) talk unicode over the wire. Internally, samba knows of three kinds of character sets: -

    unix charset

    +

    unix charset

    This is the charset used internally by your operating system. - The default is ASCII, which is fine for most + The default is ASCII, which is fine for most systems. -

    display charset

    This is the charset samba will use to print messages - on your screen. It should generally be the same as the unix charset. -

    dos charset

    This is the charset samba uses when communicating with +

    display charset

    This is the charset samba will use to print messages + on your screen. It should generally be the same as the unix charset. +

    dos charset

    This is the charset samba uses when communicating with DOS and Windows 9x clients. It will talk unicode to all newer clients. The default depends on the charsets you have installed on your system. - Run testparm -v | grep "dos charset" to see + Run testparm -v | grep "dos charset" to see what the default is on your system. -

    Conversion from old names

    Because previous samba versions did not do any charset conversion, +

    Conversion from old names

    Because previous samba versions did not do any charset conversion, characters in filenames are usually not correct in the unix charset but only for the local charset used by the DOS/Windows clients.

    The following script from Steve Langasek converts all filenames from CP850 to the iso8859-15 charset.

    -#find /path/to/share -type f -exec bash -c 'CP="{}"; ISO=`echo -n "$CP" | iconv -f cp850 \ +#find /path/to/share -type f -exec bash -c 'CP="{}"; ISO=`echo -n "$CP" | iconv -f cp850 \ -t iso8859-15`; if [ "$CP" != "$ISO" ]; then mv "$CP" "$ISO"; fi' \; -

    Japanese charsets

    Samba doesn't work correctly with Japanese charsets yet. Here are -points of attention when setting it up:

    • You should set mangling method = -hash

    • There are various iconv() implementations around and not +

    Japanese charsets

    Samba doesn't work correctly with Japanese charsets yet. Here are +points of attention when setting it up:

    • You should set mangling method = +hash

    • There are various iconv() implementations around and not all of them work equally well. glibc2's iconv() has a critical problem in CP932. libiconv-1.8 works with CP932 but still has some problems and -does not work with EUC-JP.

    • You should set dos charset = CP932, not -Shift_JIS, SJIS...

    • Currently only unix charset = CP932 +does not work with EUC-JP.

    • You should set dos charset = CP932, not +Shift_JIS, SJIS...

    • Currently only unix charset = CP932 will work (but still has some problems...) because of iconv() issues. -unix charset = EUC-JP doesn't work well because of -iconv() issues.

    • Currently Samba 3.0 does not support unix charset -= UTF8-MAC/CAP/HEX/JIS*

    More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

    Prev Up Next
    Chapter 24. Securing Samba Home Chapter 26. File and Record Locking
    +unix charset = EUC-JP doesn't work well because of +iconv() issues.

  • Currently Samba 3.0 does not support unix charset += UTF8-MAC/CAP/HEX/JIS*

    • More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

    Prev Up Next
    Chapter 26. Integrating MS Windows networks with Samba Home Chapter 28. Samba Backup Techniques
    diff --git a/docs/htmldocs/vfstest.1.html b/docs/htmldocs/vfstest.1.html index 8c5565f02b..7b124c070f 100644 --- a/docs/htmldocs/vfstest.1.html +++ b/docs/htmldocs/vfstest.1.html @@ -1,4 +1,4 @@ -vfstest

    Name

    vfstest — tool for testing samba VFS modules

    Synopsis

    vfstest [-d debuglevel] [-c command] [-l logfile] [-h]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    vfstest is a small command line +vfstest

    Name

    vfstest — tool for testing samba VFS modules

    Synopsis

    vfstest [-d debuglevel] [-c command] [-l logfile] [-h]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    vfstest is a small command line utility that has the ability to test dso samba VFS modules. It gives the user the ability to call the various VFS functions manually and supports cascaded VFS modules. @@ -6,18 +6,18 @@ See below for the commands that are available.

    -h|--help

    Print a summary of command line options.

    -l|--logfile=logbasename

    File name for log/debug files. The extension - '.client' will be appended. The log file is never removed + '.client' will be appended. The log file is never removed by the client.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -31,12 +31,12 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client. -

    COMMANDS

    VFS COMMANDS

    • load <module.so> - Load specified VFS module

    • populate <char> <size> - Populate a data buffer with the specified data -

    • showdata [<offset> <len>] - Show data currently in data buffer -

    • connect - VFS connect()

    • disconnect - VFS disconnect()

    • disk_free - VFS disk_free()

    • opendir - VFS opendir()

    • readdir - VFS readdir()

    • mkdir - VFS mkdir()

    • rmdir - VFS rmdir()

    • closedir - VFS closedir()

    • open - VFS open()

    • close - VFS close()

    • read - VFS read()

    • write - VFS write()

    • lseek - VFS lseek()

    • rename - VFS rename()

    • fsync - VFS fsync()

    • stat - VFS stat()

    • fstat - VFS fstat()

    • lstat - VFS lstat()

    • unlink - VFS unlink()

    • chmod - VFS chmod()

    • fchmod - VFS fchmod()

    • chown - VFS chown()

    • fchown - VFS fchown()

    • chdir - VFS chdir()

    • getwd - VFS getwd()

    • utime - VFS utime()

    • ftruncate - VFS ftruncate()

    • lock - VFS lock()

    • symlink - VFS symlink()

    • readlink - VFS readlink()

    • link - VFS link()

    • mknod - VFS mknod()

    • realpath - VFS realpath()

    GENERAL COMMANDS

    • conf <smb.conf> - Load a different configuration file

    • help [<command>] - Get list of commands or info about specified command

    • debuglevel <level> - Set debug level

    • freemem - Free memory currently in use

    • exit - Exit vfstest

    VERSION

    This man page is correct for version 3.0 of the Samba +

    COMMANDS

    VFS COMMANDS

    • load <module.so> - Load specified VFS module

    • populate <char> <size> - Populate a data buffer with the specified data +

    • showdata [<offset> <len>] - Show data currently in data buffer +

    • connect - VFS connect()

    • disconnect - VFS disconnect()

    • disk_free - VFS disk_free()

    • opendir - VFS opendir()

    • readdir - VFS readdir()

    • mkdir - VFS mkdir()

    • rmdir - VFS rmdir()

    • closedir - VFS closedir()

    • open - VFS open()

    • close - VFS close()

    • read - VFS read()

    • write - VFS write()

    • lseek - VFS lseek()

    • rename - VFS rename()

    • fsync - VFS fsync()

    • stat - VFS stat()

    • fstat - VFS fstat()

    • lstat - VFS lstat()

    • unlink - VFS unlink()

    • chmod - VFS chmod()

    • fchmod - VFS fchmod()

    • chown - VFS chown()

    • fchown - VFS fchown()

    • chdir - VFS chdir()

    • getwd - VFS getwd()

    • utime - VFS utime()

    • ftruncate - VFS ftruncate()

    • lock - VFS lock()

    • symlink - VFS symlink()

    • readlink - VFS readlink()

    • link - VFS link()

    • mknod - VFS mknod()

    • realpath - VFS realpath()

    GENERAL COMMANDS

    • conf <smb.conf> - Load a different configuration file

    • help [<command>] - Get list of commands or info about specified command

    • debuglevel <level> - Set debug level

    • freemem - Free memory currently in use

    • exit - Exit vfstest

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar diff --git a/docs/htmldocs/wbinfo.1.html b/docs/htmldocs/wbinfo.1.html index fc72b333a8..4aa9ddab12 100644 --- a/docs/htmldocs/wbinfo.1.html +++ b/docs/htmldocs/wbinfo.1.html @@ -1,31 +1,31 @@ -wbinfo

    Name

    wbinfo — Query information from winbind daemon

    Synopsis

    wbinfo [-u] [-g] [-N netbios-name] [-I ip] [-n name] [-s sid] [-U uid] [-G gid] [-S sid] [-Y sid] [-t] [-m] [--sequence] [-r user] [-a user%password] [-A user%password] [--get-auth-user] [-p]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The wbinfo program queries and returns information - created and used by the winbindd(8) daemon.

    The winbindd(8) daemon must be configured - and running for the wbinfo program to be able +wbinfo

    Name

    wbinfo — Query information from winbind daemon

    Synopsis

    wbinfo [-u] [-g] [-N netbios-name] [-I ip] [-n name] [-s sid] [-U uid] [-G gid] [-S sid] [-Y sid] [-t] [-m] [--sequence] [-r user] [-a user%password] [--set-auth-user user%password] [--get-auth-user] [-p]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The wbinfo program queries and returns information + created and used by the winbindd(8) daemon.

    The winbindd(8) daemon must be configured + and running for the wbinfo program to be able to return information.

    OPTIONS

    -u

    This option will list all users available - in the Windows NT domain for which the winbindd(8) daemon is operating in. Users in all trusted domains + in the Windows NT domain for which the winbindd(8) daemon is operating in. Users in all trusted domains will also be listed. Note that this operation does not assign - user ids to any users that have not already been seen by winbindd(8) + user ids to any users that have not already been seen by winbindd(8) .

    -g

    This option will list all groups available - in the Windows NT domain for which the Samba(7) daemon is operating in. Groups in all trusted domains + in the Windows NT domain for which the Samba(7) daemon is operating in. Groups in all trusted domains will also be listed. Note that this operation does not assign group ids to any groups that have not already been - seen by winbindd(8).

    -N name

    The -N option - queries winbindd(8) to query the WINS + seen by winbindd(8).

    -N name

    The -N option + queries winbindd(8) to query the WINS server for the IP address associated with the NetBIOS name - specified by the name parameter. -

    -I ip

    The -I option - queries winbindd(8) to send a node status + specified by the name parameter. +

    -I ip

    The -I option + queries winbindd(8) to send a node status request to get the NetBIOS name associated with the IP address - specified by the ip parameter. -

    -n name

    The -n option - queries winbindd(8) for the SID + specified by the ip parameter. +

    -n name

    The -n option + queries winbindd(8) for the SID associated with the name specified. Domain names can be specified before the user name by using the winbind separator character. For example CWDOM1/Administrator refers to the Administrator user in the domain CWDOM1. If no domain is specified then the - domain used is the one specified in the smb.conf(5) workgroup - parameter.

    -s sid

    Use -s to resolve - a SID to a name. This is the inverse of the -n + domain used is the one specified in the smb.conf(5) workgroup + parameter.

    -s sid

    Use -s to resolve + a SID to a name. This is the inverse of the -n option above. SIDs must be specified as ASCII strings in the traditional Microsoft format. For example, S-1-5-21-1455342024-3071081365-2475485837-500.

    -U uid

    Try to convert a UNIX user id to a Windows NT @@ -33,12 +33,12 @@ the winbind uid range then the operation will fail.

    -G gid

    Try to convert a UNIX group id to a Windows NT SID. If the gid specified does not refer to one within the winbind gid range then the operation will fail.

    -S sid

    Convert a SID to a UNIX user id. If the SID - does not correspond to a UNIX user mapped by winbindd(8) then the operation will fail.

    -Y sid

    Convert a SID to a UNIX group id. If the SID - does not correspond to a UNIX group mapped by winbindd(8) then + does not correspond to a UNIX user mapped by winbindd(8) then the operation will fail.

    -Y sid

    Convert a SID to a UNIX group id. If the SID + does not correspond to a UNIX group mapped by winbindd(8) then the operation will fail.

    -t

    Verify that the workstation trust account created when the Samba server is added to the Windows NT domain is working.

    -m

    Produce a list of domains trusted by the - Windows NT server winbindd(8) contacts + Windows NT server winbindd(8) contacts when resolving names. This list does not include the Windows NT domain the server is a Primary Domain Controller for.

    --sequence

    Show sequence numbers of @@ -47,7 +47,7 @@ defined on a Domain Controller.

    -a username%password

    Attempt to authenticate a user via winbindd. This checks both authenticaion methods and reports its results. -

    -A username%password

    Store username and password used by winbindd +

    --set-auth-user username%password

    Store username and password used by winbindd during session setup to a domain controller. This enables winbindd to operate in a Windows 2000 domain with Restrict Anonymous turned on (a.k.a. Permissions compatiable with @@ -58,14 +58,14 @@ root.

    -p

    Check whether winbindd is still alive. Prints out either 'succeeded' or 'failed'.

    -V

    Prints the version number for -smbd.

    -h|--help

    Print a summary of command line options. +smbd.

    -h|--help

    Print a summary of command line options.

    EXIT STATUS

    The wbinfo program returns 0 if the operation - succeeded, or 1 if the operation failed. If the winbindd(8) daemon is not working wbinfo will always return + succeeded, or 1 if the operation failed. If the winbindd(8) daemon is not working wbinfo will always return failure.

    VERSION

    This man page is correct for version 3.0 of - the Samba suite.

    SEE ALSO

    winbindd(8)

    AUTHOR

    The original Samba software and related utilities + the Samba suite.

    SEE ALSO

    winbindd(8)

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar - to the way the Linux kernel is developed.

    wbinfo and winbindd + to the way the Linux kernel is developed.

    wbinfo and winbindd were written by Tim Potter.

    The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/winbind.html b/docs/htmldocs/winbind.html index 3672fa0717..567e882367 100644 --- a/docs/htmldocs/winbind.html +++ b/docs/htmldocs/winbind.html @@ -1,5 +1,4 @@ - -Chapter 15. Unified Logons between Windows NT and UNIX using Winbind
    Chapter 15. Unified Logons between Windows NT and UNIX using Winbind
    Prev Part III. Advanced Configuration Next

    Chapter 15. Unified Logons between Windows NT and UNIX using Winbind

    Tim Potter

    Samba Team

    <tpot@linuxcare.com.au>

    Andrew Tridgell

    Samba Team

    <tridge@samba.org>

    John H. Terpstra

    Samba Team

    <jht@samba.org>

    Naag Mummaneni

    <getnag@rediffmail.com>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    27 June 2002

    Table of Contents

    Abstract
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Limitations
    Conclusion

    Abstract

    Integration of UNIX and Microsoft Windows NT through +Chapter 21. Integrated Logon Support using Winbind

    Chapter 21. Integrated Logon Support using Winbind
    Prev Part III. Advanced Configuration Next

    Chapter 21. Integrated Logon Support using Winbind

    Tim Potter

    Samba Team

    Andrew Tridgell

    Samba Team

    Naag Mummaneni

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    27 June 2002

    Table of Contents

    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors

    Features and Benefits

    Integration of UNIX and Microsoft Windows NT through a unified logon has been considered a "holy grail" in heterogeneous computing environments for a long time. We present winbind, a component of the Samba suite @@ -9,7 +8,7 @@ Service Switch to allow Windows NT domain users to appear and operate as UNIX users on a UNIX machine. This paper describes the winbind system, explaining the functionality it provides, how it is configured, - and how it works internally.

    Introduction

    It is well known that UNIX and Microsoft Windows NT have + and how it works internally.

    Introduction

    It is well known that UNIX and Microsoft Windows NT have different models for representing user and group information and use different technologies for implementing them. This fact has made it difficult to integrate the two systems in a satisfactory @@ -30,7 +29,7 @@ tasks for the system administrator when maintaining users and groups on either system. The winbind system provides a simple and elegant solution to all three components of the unified logon - problem.

    What Winbind Provides

    Winbind unifies UNIX and Windows NT account management by + problem.

    What Winbind Provides

    Winbind unifies UNIX and Windows NT account management by allowing a UNIX box to become a full member of a NT domain. Once this is done the UNIX box will see NT users and groups as if they were native UNIX users and groups, allowing the NT domain @@ -54,7 +53,7 @@ to provide authentication via a NT domain to any PAM enabled applications. This capability solves the problem of synchronizing passwords between systems since all passwords are stored in a single - location (on the domain controller).

    Target Uses

    Winbind is targeted at organizations that have an + location (on the domain controller).

    Target Uses

    Winbind is targeted at organizations that have an existing NT based domain infrastructure into which they wish to put UNIX workstations or servers. Winbind will allow these organizations to deploy UNIX workstations without having to @@ -64,12 +63,12 @@ be used is as a central part of UNIX based appliances. Appliances that provide file and print services to Microsoft based networks will be able to use Winbind to provide seamless integration of - the appliance into the domain.

    How Winbind Works

    The winbind system is designed around a client/server - architecture. A long running winbindd daemon + the appliance into the domain.

    How Winbind Works

    The winbind system is designed around a client/server + architecture. A long running winbindd daemon listens on a UNIX domain socket waiting for requests to arrive. These requests are generated by the NSS and PAM clients and processed sequentially.

    The technologies used to implement winbind are described - in detail below.

    Microsoft Remote Procedure Calls

    Over the last few years, efforts have been underway + in detail below.

    Microsoft Remote Procedure Calls

    Over the last few years, efforts have been underway by various Samba Team members to decode various aspects of the Microsoft Remote Procedure Call (MSRPC) system. This system is used for most network related operations between @@ -82,7 +81,7 @@ users or groups. Other MSRPC calls can be used to authenticate NT domain users and to change user passwords. By directly querying a Windows PDC for user and group information, winbind maps the - NT account information onto UNIX user and group names.

    Microsoft Active Directory Services

    + NT account information onto UNIX user and group names.

    Microsoft Active Directory Services

    Since late 2001, Samba has gained the ability to interact with Microsoft Windows 2000 using its 'Native Mode' protocols, rather than the NT4 RPC services. @@ -91,7 +90,7 @@ same way as a Win2k client would, and in so doing provide a much more efficient and effective winbind implementation. -

    Name Service Switch

    The Name Service Switch, or NSS, is a feature that is +

    Name Service Switch

    The Name Service Switch, or NSS, is a feature that is present in many UNIX operating systems. It allows system information such as hostnames, mail aliases and user information to be resolved from different sources. For example, a standalone @@ -108,25 +107,27 @@ a UNIX machine running winbind and see all users and groups in a NT domain plus any trusted domain as though they were local users and groups.

    The primary control file for NSS is - /etc/nsswitch.conf. + /etc/nsswitch.conf. When a UNIX application makes a request to do a lookup - the C library looks in /etc/nsswitch.conf + the C library looks in /etc/nsswitch.conf for a line which matches the service type being requested, for example the "passwd" service type is used when user or group names are looked up. This config line species which implementations of that service should be tried and in what order. If the passwd - config line is:

    passwd: files example

    then the C library will first load a module called - /lib/libnss_files.so followed by - the module /lib/libnss_example.so. The + config line is:

    +passwd: files example
+

    then the C library will first load a module called + /lib/libnss_files.so followed by + the module /lib/libnss_example.so. The C library will dynamically load each of these modules in turn and call resolver functions within the modules to try to resolve the request. Once the request is resolved the C library returns the result to the application.

    This NSS interface provides a very easy way for Winbind to hook into the operating system. All that needs to be done - is to put libnss_winbind.so in /lib/ - then add "winbind" into /etc/nsswitch.conf at + is to put libnss_winbind.so in /lib/ + then add "winbind" into /etc/nsswitch.conf at the appropriate place. The C library will then call Winbind to - resolve user and group names.

    Pluggable Authentication Modules

    Pluggable Authentication Modules, also known as PAM, + resolve user and group names.

    Pluggable Authentication Modules

    Pluggable Authentication Modules, also known as PAM, is a system for abstracting authentication and authorization technologies. With a PAM module it is possible to specify different authentication methods for different system applications without @@ -141,17 +142,17 @@ Controller. These users can also change their passwords and have this change take effect directly on the Primary Domain Controller.

    PAM is configured by providing control files in the directory - /etc/pam.d/ for each of the services that + /etc/pam.d/ for each of the services that require authentication. When an authentication request is made by an application the PAM code in the C library looks up this control file to determine what modules to load to do the authentication check and in what order. This interface makes adding a new authentication service for Winbind very easy, all that needs - to be done is that the pam_winbind.so module - is copied to /lib/security/ and the PAM + to be done is that the pam_winbind.so module + is copied to /lib/security/ and the PAM control files for relevant services are updated to allow authentication via winbind. See the PAM documentation - for more details.

    User and Group ID Allocation

    When a user or group is created under Windows NT + for more details.

    User and Group ID Allocation

    When a user or group is created under Windows NT is it allocated a numerical relative identifier (RID). This is slightly different to UNIX which has a range of numbers that are used to identify users, and the same range in which to identify @@ -164,7 +165,7 @@ time, winbind will have mapped all Windows NT users and groups to UNIX user ids and group ids.

    The results of this mapping are stored persistently in an ID mapping database held in a tdb database). This ensures that - RIDs are mapped to UNIX IDs in a consistent way.

    Result Caching

    An active system can generate a lot of user and group + RIDs are mapped to UNIX IDs in a consistent way.

    Result Caching

    An active system can generate a lot of user and group name lookups. To reduce the network cost of these lookups winbind uses a caching scheme based on the SAM sequence number supplied by NT domain controllers. User or group information returned @@ -175,16 +176,16 @@ the PDC and compared against the sequence number of the cached entry. If the sequence numbers do not match, then the cached information is discarded and up to date information is requested directly - from the PDC.

    Installation and Configuration

    + from the PDC.

    Installation and Configuration

    Many thanks to John Trostel jtrostel@snapserver.com for providing the HOWTO for this section.

    This HOWTO describes how to get winbind services up and running to control access and authenticate users on your Linux box using the winbind services which come with SAMBA 3.0. -

    Introduction

    -This HOWTO describes the procedures used to get winbind up and -running on my RedHat 7.1 system. Winbind is capable of providing access +

    Introduction

    +This section describes the procedures used to get winbind up and +running on a RedHat 7.1 system. Winbind is capable of providing access and authentication control for Windows Domain users through an NT or Win2K PDC for 'regular' services, such as telnet a nd ftp, as well for SAMBA services. @@ -207,17 +208,17 @@ somewhat to fit the way your distribution works. SAMBA server, this HOWTO is for you. That said, I am no NT or PAM expert, so you may find a better or easier way to accomplish these tasks. -

    Requirements

    -If you have a samba configuration file that you are currently +

    Requirements

    +If you have a Samba configuration file that you are currently using... BACK IT UP! If your system already uses PAM, -back up the /etc/pam.d directory +back up the /etc/pam.d directory contents! If you haven't already made a boot disk, MAKE ONE NOW!

    -Messing with the pam configuration files can make it nearly impossible -to log in to yourmachine. That's why you want to be able to boot back +Messing with the PAM configuration files can make it nearly impossible +to log in to your machine. That's why you want to be able to boot back into your machine in single user mode and restore your -/etc/pam.d back to the original state they were in if +/etc/pam.d back to the original state they were in if you get frustrated with the way things are going. ;-)

    The latest version of SAMBA (version 3.0 as of this writing), now @@ -232,54 +233,54 @@ SAMBA machine, PAM (pluggable authentication modules) must be setup properly on your machine. In order to compile the winbind modules, you should have at least the pam libraries resident on your system. For recent RedHat systems (7.1, for instance), that -means pam-0.74-22. For best results, it is helpful to also -install the development packages in pam-devel-0.74-22. -

    Testing Things Out

    +means pam-0.74-22. For best results, it is helpful to also +install the development packages in pam-devel-0.74-22. +

    Testing Things Out

    Before starting, it is probably best to kill off all the SAMBA -related daemons running on your server. Kill off all smbd, -nmbd, and winbindd processes that may +related daemons running on your server. Kill off all smbd, +nmbd, and winbindd processes that may be running. To use PAM, you will want to make sure that you have the -standard PAM package (for RedHat) which supplies the /etc/pam.d +standard PAM package (for RedHat) which supplies the /etc/pam.d directory structure, including the pam modules are used by pam-aware -services, several pam libraries, and the /usr/doc -and /usr/man entries for pam. Winbind built better +services, several pam libraries, and the /usr/doc +and /usr/man entries for pam. Winbind built better in SAMBA if the pam-devel package was also installed. This package includes -the header files needed to compile pam-aware applications. For instance, -my RedHat system has both pam-0.74-22 and -pam-devel-0.74-22 RPMs installed. -

    Configure and compile SAMBA

    +the header files needed to compile pam-aware applications. +

    Configure and compile SAMBA

    The configuration and compilation of SAMBA is pretty straightforward. The first three steps may not be necessary depending upon whether or not you have previously built the Samba binaries. -

    -root# autoconf
-root# make clean
-root# rm config.cache
-root# ./configure
-root# make
-root# make install
+
    +root# autoconf
+root# make clean
+root# rm config.cache
+root# ./configure
+root# make
+root# make install
 
    
-This will, by default, install SAMBA in /usr/local/samba.
+This will, by default, install SAMBA in /usr/local/samba.
 See the main SAMBA documentation if you want to install SAMBA somewhere else.
 It will also build the winbindd executable and libraries. 
-

    Configure nsswitch.conf and the -winbind libraries on Linux and Solaris

    -The libraries needed to run the winbindd daemon +

    Configure nsswitch.conf and the +winbind libraries on Linux and Solaris

    +The libraries needed to run the winbindd daemon through nsswitch need to be copied to their proper locations, so

    -root# cp ../samba/source/nsswitch/libnss_winbind.so /lib +

    +root# cp ../samba/source/nsswitch/libnss_winbind.so /lib
+

    I also found it necessary to make the following symbolic link:

    -root# ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2 -

    And, in the case of Sun solaris:

    -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1 -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1 -root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2 -

    -Now, as root you need to edit /etc/nsswitch.conf to -allow user and group entries to be visible from the winbindd -daemon. My /etc/nsswitch.conf file look like +root# ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2 +

    And, in the case of Sun Solaris:

    +root# ln -s /usr/lib/libnss_winbind.so /usr/lib/libnss_winbind.so.1
+root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.1
+root# ln -s /usr/lib/libnss_winbind.so /usr/lib/nss_winbind.so.2
+

    +Now, as root you need to edit /etc/nsswitch.conf to +allow user and group entries to be visible from the winbindd +daemon. My /etc/nsswitch.conf file look like this after editing: 

     	passwd:     files winbind
@@ -287,15 +288,15 @@ this after editing:
 	group:      files winbind

    The libraries needed by the winbind daemon will be automatically -entered into the ldconfig cache the next time +entered into the ldconfig cache the next time your system reboots, but it is faster (and you don't need to reboot) if you do it manually:

    -root# /sbin/ldconfig -v | grep winbind +root# /sbin/ldconfig -v | grep winbind

    -This makes libnss_winbind available to winbindd +This makes libnss_winbind available to winbindd and echos back a check to you. -

    NSS Winbind on AIX

    (This section is only for those running AIX)

    +

    NSS Winbind on AIX

    (This section is only for those running AIX)

    The winbind AIX identification module gets built as libnss_winbind.so in the nsswitch directory of the samba source. This file can be copied to /usr/lib/security, and the AIX naming convention would indicate that it @@ -305,22 +306,22 @@ WINBIND: program = /usr/lib/security/WINBIND options = authonly

    can then be added to -/usr/lib/security/methods.cfg. This module only +/usr/lib/security/methods.cfg. This module only supports identification, but there have been success reports using the standard winbind pam module for authentication. Use caution configuring loadable authentication modules as it is possible to make it impossible to logon to the system. More information about the AIX authentication module API can be found at "Kernel Extensions and Device Support -Programming Concepts for AIX": +Programming Concepts for AIX": Chapter 18. Loadable Authentication Module Programming Interface -and more information on administering the modules at +and more information on administering the modules at "System Management Guide: Operating System and Devices". -

    Configure smb.conf

    +

    Configure smb.conf

    Several parameters are needed in the smb.conf file to control -the behavior of winbindd. Configure -smb.conf These are described in more detail in -the winbindd(8) man page. My -smb.conf file was modified to +the behavior of winbindd. Configure +smb.conf These are described in more detail in +the winbindd(8) man page. My +smb.conf file was modified to include the following entries in the [global] section: 

     [global]
@@ -328,61 +329,61 @@ include the following entries in the [global] section:
      # separate domain and username with '+', like DOMAIN+username
      winbind separator = +
      # use uids from 10000 to 20000 for domain users
-     winbind uid = 10000-20000
+     idmap uid = 10000-20000
      # use gids from 10000 to 20000 for domain groups
-     winbind gid = 10000-20000
+     idmap gid = 10000-20000
      # allow enumeration of winbind users and groups
      winbind enum users = yes
      winbind enum groups = yes
      # give winbind users a real shell (only needed if they have telnet access)
      template homedir = /home/winnt/%D/%U
      template shell = /bin/bash
-

    Join the SAMBA server to the PDC domain

    +

    Join the SAMBA server to the PDC domain

    Enter the following command to make the SAMBA server join the -PDC domain, where DOMAIN is the name of -your Windows domain and Administrator is +PDC domain, where DOMAIN is the name of +your Windows domain and Administrator is a domain user who has administrative privileges in the domain.

    -root# /usr/local/samba/bin/net join -S PDC -U Administrator +root# /usr/local/samba/bin/net join -S PDC -U Administrator

    The proper response to the command should be: "Joined the domain -DOMAIN" where DOMAIN +DOMAIN" where DOMAIN is your DOMAIN name. -

    Start up the winbindd daemon and test it!

    +

    Start up the winbindd daemon and test it!

    Eventually, you will want to modify your smb startup script to automatically invoke the winbindd daemon when the other parts of SAMBA start, but it is possible to test out just the winbind portion first. To start up winbind services, enter the following command as root:

    -root# /usr/local/samba/bin/winbindd +root# /usr/local/samba/bin/winbindd

    Winbindd can now also run in 'dual daemon mode'. This will make it run as 2 processes. The first will answer all requests from the cache, thus making responses to clients faster. The other will update the cache for the query that the first has just responded. Advantage of this is that responses stay accurate and are faster. -You can enable dual daemon mode by adding '-B' to the commandline: +You can enable dual daemon mode by adding -B to the commandline:

    -root# /usr/local/samba/bin/winbindd -B +root# /usr/local/samba/bin/winbindd -B

    I'm always paranoid and like to make sure the daemon is really running...

    -root# ps -ae | grep winbindd +root# ps -ae | grep winbindd

    This command should produce output like this, if the daemon is running -

    +

     3025 ?        00:00:00 winbindd
-
    
+

    Now... for the real test, try to get some information about the users on your PDC

    -root# /usr/local/samba/bin/wbinfo -u +root# /usr/local/samba/bin/wbinfo -u

    This should echo back a list of users on your Windows users on your PDC. For example, I get the following response: -

    +
     	CEO+Administrator
 	CEO+burdell
 	CEO+Guest
@@ -390,13 +391,13 @@ your PDC.  For example, I get the following response:
 	CEO+krbtgt
 	CEO+TsInternetUser
 
    
-Obviously, I have named my domain 'CEO' and my winbind
+Obviously, I have named my domain 'CEO' and my winbind
 separator is '+'.
 
    
 You can do the same sort of thing to get group information from 
 the PDC:
-
    -root# /usr/local/samba/bin/wbinfo -g
+
    +root# /usr/local/samba/bin/wbinfo -g
 	CEO+Domain Admins
 	CEO+Domain Users
 	CEO+Domain Guests
@@ -411,25 +412,24 @@ The function 'getent' can now be used to get unified
 lists of both local and PDC users and groups.
 Try the following command:
 
    
-root# getent passwd
+root# getent passwd
 
    
-You should get a list that looks like your /etc/passwd 
+You should get a list that looks like your /etc/passwd 
 list followed by the domain users with their new uids, gids, home 
 directories and default shells.
 
    
 The same thing can be done for groups with the command
 
    
-root# getent group
-

    Fix the init.d startup scripts

    Linux

    -The winbindd daemon needs to start up after the -smbd and nmbd daemons are running. +root# getent group +

    Fix the init.d startup scripts

    Linux

    +The winbindd daemon needs to start up after the +smbd and nmbd daemons are running. To accomplish this task, you need to modify the startup scripts of your system. -They are located at /etc/init.d/smb in RedHat and -/etc/init.d/samba in Debian. +They are located at /etc/init.d/smb in RedHat and +/etc/init.d/samba in Debian. script to add commands to invoke this daemon in the proper sequence. My -startup script starts up smbd, -nmbd, and winbindd from the -/usr/local/samba/bin directory directly. The 'start' +startup script starts up smbd, nmbd, and winbindd from the +/usr/local/samba/bin directory directly. The 'start' function in the script looks like this: 

     start() {
@@ -487,10 +487,10 @@ stop() {
         echo ""
         return $RETVAL
 }
-
    Solaris

    Winbind doesn't work on solaris 9, see the Portability chapter for details.

    On solaris, you need to modify the -/etc/init.d/samba.server startup script. It usually +

    Solaris

    Winbind doesn't work on Solaris 9, see the Portability chapter for details.

    On Solaris, you need to modify the +/etc/init.d/samba.server startup script. It usually only starts smbd and nmbd but should now start winbindd too. If you -have samba installed in /usr/local/samba/bin, +have samba installed in /usr/local/samba/bin, the file could contains something like this: 

     	##
@@ -550,34 +550,33 @@ in the script above with:
 
     	/usr/local/samba/bin/winbindd -B
 
    
-
    Restarting

    -If you restart the smbd, nmbd, -and winbindd daemons at this point, you +

    Restarting

    +If you restart the smbd, nmbd, and winbindd daemons at this point, you should be able to connect to the samba server as a domain member just as if you were a local user. -

    Configure Winbind and PAM

    +

    Configure Winbind and PAM

    If you have made it this far, you know that winbindd and samba are working together. If you want to use winbind to provide authentication for other services, keep reading. The pam configuration files need to be altered in this step. (Did you remember to make backups of your original -/etc/pam.d files? If not, do it now.) +/etc/pam.d files? If not, do it now.)

    You will need a pam module to use winbindd with these other services. This -module will be compiled in the ../source/nsswitch directory +module will be compiled in the ../source/nsswitch directory by invoking the command

    -root# make nsswitch/pam_winbind.so +root# make nsswitch/pam_winbind.so

    -from the ../source directory. The -pam_winbind.so file should be copied to the location of +from the ../source directory. The +pam_winbind.so file should be copied to the location of your other pam security modules. On my RedHat system, this was the -/lib/security directory. On Solaris, the pam security -modules reside in /usr/lib/security. +/lib/security directory. On Solaris, the pam security +modules reside in /usr/lib/security.

    -root# cp ../samba/source/nsswitch/pam_winbind.so /lib/security -

    Linux/FreeBSD-specific PAM configuration

    -The /etc/pam.d/samba file does not need to be changed. I -just left this fileas it was: +root# cp ../samba/source/nsswitch/pam_winbind.so /lib/security +

    Linux/FreeBSD-specific PAM configuration

    +The /etc/pam.d/samba file does not need to be changed. I +just left this file as it was: 

     	auth    required        /lib/security/pam_stack.so service=system-auth
 	account required        /lib/security/pam_stack.so service=system-auth
@@ -586,10 +585,10 @@ The other services that I modified to allow the use of winbind
 as an authentication service were the normal login on the console (or a terminal 
 session), telnet logins, and ftp service.  In order to enable these 
 services, you may first need to change the entries in 
-/etc/xinetd.d (or /etc/inetd.conf).  
+/etc/xinetd.d (or /etc/inetd.conf).  
 RedHat 7.1 uses the new xinetd.d structure, in this case you need 
-to change the lines in /etc/xinetd.d/telnet 
-and /etc/xinetd.d/wu-ftp from 
+to change the lines in /etc/xinetd.d/telnet 
+and /etc/xinetd.d/wu-ftp from 
 
     	enable = no
 
    
@@ -601,12 +600,12 @@ For ftp services to work properly, you will also need to either
 have individual directories for the domain users already present on 
 the server, or change the home directory template to a general
 directory for all domain users.  These can be easily set using 
-the smb.conf global entry 
-template homedir.
+the smb.conf global entry 
+template homedir.
 
    
-The /etc/pam.d/ftp file can be changed 
+The /etc/pam.d/ftp file can be changed 
 to allow winbind ftp access in a manner similar to the
-samba file.  My /etc/pam.d/ftp file was 
+samba file.  My /etc/pam.d/ftp file was 
 changed to look like this:
 
     	auth       required     /lib/security/pam_listfile.so item=user sense=deny \
@@ -618,7 +617,7 @@ changed to look like this:
 	account    required     /lib/security/pam_stack.so service=system-auth
 	session    required     /lib/security/pam_stack.so service=system-auth
 
    
-The /etc/pam.d/login file can be changed nearly the 
+The /etc/pam.d/login file can be changed nearly the 
 same way.  It now looks like this:
 
     	auth       required     /lib/security/pam_securetty.so
@@ -632,13 +631,13 @@ same way.  It now looks like this:
 	session    required     /lib/security/pam_stack.so service=system-auth
 	session    optional     /lib/security/pam_console.so
 
    
-In this case, I added the auth sufficient /lib/security/pam_winbind.so 
-lines as before, but also added the required pam_securetty.so 
+In this case, I added the 
    auth sufficient /lib/security/pam_winbind.so
     
+lines as before, but also added the 
    required pam_securetty.so
    
 above it, to disallow root logins over the network.  I also added a 
-sufficient /lib/security/pam_unix.so use_first_pass
-line after the winbind.so line to get rid of annoying 
+sufficient /lib/security/pam_unix.so use_first_pass
+line after the winbind.so line to get rid of annoying 
 double prompts for passwords.
-
    Solaris-specific configuration

    +

    Solaris-specific configuration

    The /etc/pam.conf needs to be changed. I changed this file so that my Domain users can logon both locally as well as telnet.The following are the changes that I made.You can customize the pam.conf file as per your requirements,but @@ -710,7 +709,12 @@ annoying double prompts for passwords.

    Now restart your Samba and try connecting through your application that you configured in the pam.conf. -

    Limitations

    Winbind has a number of limitations in its current +

    Conclusion

    The winbind system, through the use of the Name Service + Switch, Pluggable Authentication Modules, and appropriate + Microsoft RPC calls have allowed us to provide seamless + integration of Microsoft Windows NT domain users on a + UNIX system. The result is a great reduction in the administrative + cost of running a mixed UNIX and NT network.

    Common Errors

    Winbind has a number of limitations in its current released version that we hope to overcome in future releases:

    • Winbind is currently only available for the Linux, Solaris and IRIX operating systems, although ports to other operating @@ -718,16 +722,11 @@ configured in the pam.conf. we require the C library of the target operating system to support the Name Service Switch and Pluggable Authentication Modules systems. This is becoming more common as NSS and - PAM gain support among UNIX vendors.

    • The mappings of Windows NT RIDs to UNIX ids + PAM gain support among UNIX vendors.

    • The mappings of Windows NT RIDs to UNIX ids is not made algorithmically and depends on the order in which unmapped users or groups are seen by winbind. It may be difficult to recover the mappings of rid to UNIX id mapping if the file containing this information is corrupted or destroyed.

    • Currently the winbind PAM module does not take into account possible workstation and logon time restrictions that may be been set for Windows NT users, this is - instead up to the PDC to enforce.

    Conclusion

    The winbind system, through the use of the Name Service - Switch, Pluggable Authentication Modules, and appropriate - Microsoft RPC calls have allowed us to provide seamless - integration of Microsoft Windows NT domain users on a - UNIX system. The result is a great reduction in the administrative - cost of running a mixed UNIX and NT network.

    Prev Up Next
    Chapter 14. CUPS Printing Support Home Chapter 16. Advanced Network Manangement
    + instead up to the PDC to enforce.

    Prev Up Next
    Chapter 20. Stackable VFS modules Home Chapter 22. Advanced Network Management
    diff --git a/docs/htmldocs/winbindd.8.html b/docs/htmldocs/winbindd.8.html index b1260df500..c1a64d6a00 100644 --- a/docs/htmldocs/winbindd.8.html +++ b/docs/htmldocs/winbindd.8.html @@ -1,64 +1,64 @@ -winbindd

    Name

    winbindd — Name Service Switch daemon for resolving names - from NT servers

    Synopsis

    winbindd [-F] [-S] [-i] [-B] [-d <debug level>] [-s <smb config file>] [-n]

    DESCRIPTION

    This program is part of the Samba(7) suite.

    winbindd is a daemon that provides +winbindd

    Name

    winbindd — Name Service Switch daemon for resolving names + from NT servers

    Synopsis

    winbindd [-F] [-S] [-i] [-B] [-d <debug level>] [-s <smb config file>] [-n]

    DESCRIPTION

    This program is part of the Samba(7) suite.

    winbindd is a daemon that provides a service for the Name Service Switch capability that is present in most modern C libraries. The Name Service Switch allows user and system information to be obtained from different databases services such as NIS or DNS. The exact behaviour can be configured - throught the /etc/nsswitch.conf file. + throught the /etc/nsswitch.conf file. Users and groups are allocated as they are resolved to a range of user and group ids specified by the administrator of the - Samba system.

    The service provided by winbindd is called `winbind' and + Samba system.

    The service provided by winbindd is called `winbind' and can be used to resolve user and group information from a Windows NT server. The service can also provide authentication services via an associated PAM module.

    - The pam_winbind module in the 2.2.2 release only - supports the auth and account + The pam_winbind module in the 2.2.2 release only + supports the auth and account module-types. The latter simply performs a getpwnam() to verify that the system can obtain a uid for the - user. If the libnss_winbind library has been correctly + user. If the libnss_winbind library has been correctly installed, this should always succeed.

    The following nsswitch databases are implemented by the winbindd service:

    hosts

    User information traditionally stored in - the hosts(5) file and used by - gethostbyname(3) functions. Names are + the hosts(5) file and used by + gethostbyname(3) functions. Names are resolved through the WINS server or by broadcast.

    passwd

    User information traditionally stored in - the passwd(5) file and used by - getpwent(3) functions.

    group

    Group information traditionally stored in - the group(5) file and used by - getgrent(3) functions.

    For example, the following simple configuration in the - /etc/nsswitch.conf file can be used to initially - resolve user and group information from /etc/passwd - and /etc/group and then from the + the passwd(5) file and used by + getpwent(3) functions.

    group

    Group information traditionally stored in + the group(5) file and used by + getgrent(3) functions.

    For example, the following simple configuration in the + /etc/nsswitch.conf file can be used to initially + resolve user and group information from /etc/passwd + and /etc/group and then from the Windows NT server. 

     passwd:         files winbind
 group:          files winbind

    The following simple configuration in the - /etc/nsswitch.conf file can be used to initially - resolve hostnames from /etc/hosts and then from the + /etc/nsswitch.conf file can be used to initially + resolve hostnames from /etc/hosts and then from the WINS server.

    OPTIONS

    -F

    If specified, this parameter causes - the main winbindd process to not daemonize, + the main winbindd process to not daemonize, i.e. double-fork and disassociate with the terminal. Child processes are still created as normal to service each connection request, but the main process does not exit. This operation mode is suitable for running - winbindd under process supervisors such - as supervise and svscan - from Daniel J. Bernstein's daemontools + winbindd under process supervisors such + as supervise and svscan + from Daniel J. Bernstein's daemontools package, or the AIX process monitor.

    -S

    If specified, this parameter causes - winbindd to log to standard output rather + winbindd to log to standard output rather than a file.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +smbd.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See +to provide. See smb.conf(5) for more information. The default configuration file name is determined at -compile time.

    -d|--debug=debuglevel

    debuglevel is an integer +compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the @@ -72,16 +72,16 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will override the log level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -h|--help

    Print a summary of command line options. -

    -i

    Tells winbindd to not +

    -i

    Tells winbindd to not become a daemon and detach from the current terminal. This option is used by developers when interactive debugging - of winbindd is required. - winbindd also logs to standard output, - as if the -S parameter had been given. + of winbindd is required. + winbindd also logs to standard output, + as if the -S parameter had been given.

    -n

    Disable caching. This means winbindd will always have to wait for a response from the domain controller before it can respond to a client and this thus makes things @@ -97,7 +97,7 @@ never removed by the client. a relative id (rid) which is unique for the domain when the user or group is created. To convert the Windows NT user or group into a unix user or group, a mapping between rids and unix user - and group ids is required. This is one of the jobs that + and group ids is required. This is one of the jobs that winbindd performs.

    As winbindd users and groups are resolved from a server, user and group ids are allocated from a specified range. This is done on a first come, first served basis, although all existing @@ -108,43 +108,43 @@ never removed by the client. where the user and group mappings are stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd to determine which user and group ids correspond to Windows NT user - and group rids.

    CONFIGURATION

    Configuration of the winbindd daemon - is done through configuration parameters in the smb.conf(5) file. All parameters should be specified in the + and group rids.

    CONFIGURATION

    Configuration of the winbindd daemon + is done through configuration parameters in the smb.conf(5) file. All parameters should be specified in the [global] section of smb.conf.

    EXAMPLE SETUP

    To setup winbindd for user and group lookups plus + winbind separator

  • + winbind uid

  • + winbind gid

  • + winbind cache time

  • + winbind enum users

  • + winbind enum groups

  • + template homedir

  • + template shell

  • + winbind use default domain

    • EXAMPLE SETUP

    To setup winbindd for user and group lookups plus authentication from a domain controller use something like the - following setup. This was tested on a RedHat 6.2 Linux box.

    In /etc/nsswitch.conf put the + following setup. This was tested on a RedHat 6.2 Linux box.

    In /etc/nsswitch.conf put the following: 

     passwd:     files winbind
 group:      files winbind
-

    In /etc/pam.d/* replace the +

    In /etc/pam.d/* replace the auth lines with something like this: 

     auth       required	/lib/security/pam_securetty.so
 auth       required	/lib/security/pam_nologin.so
 auth       sufficient	/lib/security/pam_winbind.so
 auth       required     /lib/security/pam_pwdb.so use_first_pass shadow nullok
-

    Note in particular the use of the sufficient - keyword and the use_first_pass keyword.

    Now replace the account lines with this:

    account required /lib/security/pam_winbind.so +

    Note in particular the use of the sufficient + keyword and the use_first_pass keyword.

    Now replace the account lines with this:

    account required /lib/security/pam_winbind.so

    The next step is to join the domain. To do that use the - net program like this:

    net join -S PDC -U Administrator

    The username after the -U can be any + net program like this:

    net join -S PDC -U Administrator

    The username after the -U can be any Domain user that has administrator privileges on the machine. - Substitute the name or IP of your PDC for "PDC".

    Next copy libnss_winbind.so to - /lib and pam_winbind.so - to /lib/security. A symbolic link needs to be - made from /lib/libnss_winbind.so to - /lib/libnss_winbind.so.2. If you are using an + Substitute the name or IP of your PDC for "PDC".

    Next copy libnss_winbind.so to + /lib and pam_winbind.so + to /lib/security. A symbolic link needs to be + made from /lib/libnss_winbind.so to + /lib/libnss_winbind.so.2. If you are using an older version of glibc then the target of the link should be - /lib/libnss_winbind.so.1.

    Finally, setup a smb.conf(5) containing directives like the + /lib/libnss_winbind.so.1.

    Finally, setup a smb.conf(5) containing directives like the following: 

     [global]
@@ -161,54 +161,54 @@ auth       required     /lib/security/pam_pwdb.so use_first_pass shadow nullok
 	group database is expanded to include your NT users and groups, 
 	and that you can login to your unix box as a domain user, using 
 	the DOMAIN+user syntax for the username. You may wish to use the 
-	commands getent passwd and getent group
+	commands getent passwd and getent group
 	 to confirm the correct operation of winbindd.

    NOTES

    The following notes are useful when configuring and - running winbindd:

    nmbd(8) must be running on the local machine - for winbindd to work. winbindd queries + running winbindd:

    nmbd(8) must be running on the local machine + for winbindd to work. winbindd queries the list of trusted domains for the Windows NT server - on startup and when a SIGHUP is received. Thus, for a running + on startup and when a SIGHUP is received. Thus, for a running winbindd to become aware of new trust relationships between servers, it must be sent a SIGHUP signal.

    PAM is really easy to misconfigure. Make sure you know what you are doing when modifying PAM configuration files. It is possible - to set up PAM such that you can no longer log into your system.

    If more than one UNIX machine is running winbindd, + to set up PAM such that you can no longer log into your system.

    If more than one UNIX machine is running winbindd, then in general the user and groups ids allocated by winbindd will not be the same. The user and group ids will only be valid for the local machine.

    If the the Windows NT RID to UNIX user and group id mapping file is damaged or destroyed then the mappings will be lost.

    SIGNALS

    The following signals can be used to manipulate the - winbindd daemon.

    SIGHUP

    Reload the smb.conf(5) file and + winbindd daemon.

    SIGHUP

    Reload the smb.conf(5) file and apply any parameter changes to the running version of winbindd. This signal also clears any cached user and group information. The list of other domains trusted - by winbindd is also reloaded.

    SIGUSR1

    The SIGUSR1 signal will cause + by winbindd is also reloaded.

    SIGUSR1

    The SIGUSR1 signal will cause winbindd to write status information to the winbind log file including information about the number of user and - group ids allocated by winbindd.

    Log files are stored in the filename specified by the - log file parameter.

    FILES

    /etc/nsswitch.conf(5)

    Name service switch configuration file.

    /tmp/.winbindd/pipe

    The UNIX pipe over which clients communicate with - the winbindd program. For security reasons, the + group ids allocated by winbindd.

    Log files are stored in the filename specified by the + log file parameter.

    FILES

    /etc/nsswitch.conf(5)

    Name service switch configuration file.

    /tmp/.winbindd/pipe

    The UNIX pipe over which clients communicate with + the winbindd program. For security reasons, the winbind client will only attempt to connect to the winbindd daemon - if both the /tmp/.winbindd directory - and /tmp/.winbindd/pipe file are owned by + if both the /tmp/.winbindd directory + and /tmp/.winbindd/pipe file are owned by root.

    $LOCKDIR/winbindd_privilaged/pipe

    The UNIX pipe over which 'privilaged' clients - communicate with the winbindd program. For security + communicate with the winbindd program. For security reasons, access to some winbindd functions - like those needed by - the ntlm_auth utility - is restricted. By default, + the ntlm_auth utility - is restricted. By default, only users in the 'root' group will get this access, however the administrator may change the group permissions on $LOCKDIR/winbindd_privilaged to allow programs like 'squid' to use ntlm_auth. Note that the winbind client will only attempt to connect to the winbindd daemon - if both the $LOCKDIR/winbindd_privilaged directory - and $LOCKDIR/winbindd_privilaged/pipe file are owned by + if both the $LOCKDIR/winbindd_privilaged directory + and $LOCKDIR/winbindd_privilaged/pipe file are owned by root.

    /lib/libnss_winbind.so.X

    Implementation of name service switch library.

    $LOCKDIR/winbindd_idmap.tdb

    Storage for the Windows NT rid to UNIX user/group id mapping. The lock directory is specified when Samba is initially - compiled using the --with-lockdir option. - This directory is by default /usr/local/samba/var/locks + compiled using the --with-lockdir option. + This directory is by default /usr/local/samba/var/locks .

    $LOCKDIR/winbindd_cache.tdb

    Storage for cached user and group information.

    VERSION

    This man page is correct for version 3.0 of - the Samba suite.

    SEE ALSO

    nsswitch.conf(5), Samba(7), wbinfo(8), smb.conf(5)

    AUTHOR

    The original Samba software and related utilities + the Samba suite.

    SEE ALSO

    nsswitch.conf(5), Samba(7), wbinfo(8), smb.conf(5)

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar - to the way the Linux kernel is developed.

    wbinfo and winbindd were + to the way the Linux kernel is developed.

    wbinfo and winbindd were written by Tim Potter.

    The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/manpages/pdbedit.8 b/docs/manpages/pdbedit.8 index 51dcf44bf0..ff0fc1244b 100644 --- a/docs/manpages/pdbedit.8 +++ b/docs/manpages/pdbedit.8 @@ -23,9 +23,9 @@ pdbedit \- manage the SAM database .SH "SYNOPSIS" .nf -\fBpdbedit\fR [-l] [-v] [-w] [-u username] [-f fullname] [-h homedir] [-D drive] [-S +\fBpdbedit\fR [-L] [-v] [-w] [-u username] [-f fullname] [-h homedir] [-D drive] [-S script] [-p profile] [-a] [-m] [-x] [-i passdb-backend] [-e passdb-backend] - [-g] [-b passdb-backend] [-g] [-d debuglevel] [-s configfile] [-P account-policy] + [-b passdb-backend] [-g] [-d debuglevel] [-s configfile] [-P account-policy] [-C value] .fi @@ -46,11 +46,11 @@ There are five main ways to use pdbedit: adding a user account, removing a user .SH "OPTIONS" .TP --l +-L This option lists all the user accounts present in the users database\&. This option prints a list of user/uid pairs separated by the ':' character\&. -Example: \fBpdbedit -l\fR +Example: \fBpdbedit -L\fR .nf @@ -65,7 +65,7 @@ samba:45:Test User This option enables the verbose listing format\&. It causes pdbedit to list the users in the database, printing out the account fields in a descriptive format\&. -Example: \fBpdbedit -l -v\fR +Example: \fBpdbedit -L -v\fR .nf @@ -96,7 +96,7 @@ Profile Path: \\\\BERSERKER\\profile This option sets the "smbpasswd" listing format\&. It will make pdbedit list the users in the database, printing out the account fields in a format compatible with the \fIsmbpasswd\fR file format\&. (see the \fBsmbpasswd\fR(5) for details) -Example: \fBpdbedit -l -w\fR +Example: \fBpdbedit -L -w\fR sorce:500:508818B733CE64BEAAD3B435B51404EE:D2A2418EFC466A8A0F6B1DBB5C3DB80C:[UX ]:LCT-00000000: @@ -147,6 +147,30 @@ This option can be used while adding or modifing a user account\&. It will speci Example: \fB-p "\\\\BERSERKER\\netlogon"\fR +.TP +-G SID|rid +This option can be used while adding or modifying a user account\&. It will specify the users' new primary group SID (Security Identifier) or rid\&. + + +Example: \fB-G S-1-5-21-2447931902-1787058256-3961074038-1201\fR + + +.TP +-U SID|rid +This option can be used while adding or modifying a user account\&. It will specify the users' new SID (Security Identifier) or rid\&. + + +Example: \fB-U S-1-5-21-2447931902-1787058256-3961074038-5004\fR + + +.TP +-c account-control +This option can be used while adding or modifying a user account\&. It will specify the users' account control property\&. Possible flags that can be set are: N, D, H, L, X\&. + + +Example: \fB-c "[X ]"\fR + + .TP -a This option is used to add a user into the database\&. This command needs a user name specified with the -u switch\&. When adding a new user, pdbedit will also ask for the password to be used\&. @@ -160,6 +184,11 @@ retype new password +.TP +-r +This option is used to modify an existing user in the database\&. This command needs a user name specified with the -u switch\&. Other options can be specified to modify the properties of the specified user\&. This flag is kept for backwards compatibility, but it is no longer necessary to specify it\&. + + .TP -m This option may only be used in conjunction with the \fI-a\fR option\&. It will make pdbedit to add a machine trust account instead of a user account (-u username will provide the machine name)\&. @@ -206,14 +235,6 @@ If you specify \fI-g\fR, then \fI-i in-backend -e out-backend\fR applies to the This option will ease migration from one passdb backend to another and will ease backing up\&. -.TP --g -If you specify \fI-g\fR, then \fI-i in-backend -e out-backend\fR applies to the group mapping instead of the user database\&. - - -This option will ease migration from one passdb backend to another and will ease backing up\&. - - .TP -b passdb-backend Use a different default passdb backend\&. @@ -296,7 +317,7 @@ This command may be used only by root\&. .SH "VERSION" .PP -This man page is correct for version 2\&.2 of the Samba suite\&. +This man page is correct for version 3\&.0 of the Samba suite\&. .SH "SEE ALSO" @@ -308,6 +329,3 @@ This man page is correct for version 2\&.2 of the Samba suite\&. .PP The original Samba software and related utilities were created by Andrew Tridgell\&. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed\&. -.PP -The original Samba man pages were written by Karl Auer\&. The man page sources were converted to YODL format (another excellent piece of Open Source software, available at ftp://ftp\&.icce\&.rug\&.nl/pub/unix/) and updated for the Samba 2\&.0 release by Jeremy Allison\&. The conversion to DocBook for Samba 2\&.2 was done by Gerald Carter\&. The conversion to DocBook XML 4\&.2 for Samba 3\&.0 was done by Alexander Bokovoy\&. - diff --git a/docs/manpages/rpcclient.1 b/docs/manpages/rpcclient.1 index 7655d6c312..34cb6a1fa5 100644 --- a/docs/manpages/rpcclient.1 +++ b/docs/manpages/rpcclient.1 @@ -457,7 +457,7 @@ Execute an EnumPrinterDrivers() call\&. This lists the various installed printer .TP enumprinters [level] -Execute an EnumPrinters() call\&. This lists the various installed and share printers\&. Refer to the MS Platform SDK documentation for more details of the various flags and calling options\&. Currently supported info levels are 0, 1, and 2\&. +Execute an EnumPrinters() call\&. This lists the various installed and share printers\&. Refer to the MS Platform SDK documentation for more details of the various flags and calling options\&. Currently supported info levels are 1, 2 and 5\&. .TP diff --git a/docs/manpages/samba.7 b/docs/manpages/samba.7 index 9f01169a5a..50665c700b 100644 --- a/docs/manpages/samba.7 +++ b/docs/manpages/samba.7 @@ -1,230 +1,221 @@ -.\" This manpage has been automatically generated by docbook2man -.\" from a DocBook document. This tool can be found at: -.\" -.\" Please send any bug reports, improvements, comments, patches, -.\" etc. to Steve Cheng . -.TH "SAMBA" "7" "19 april 2003" "" "" - +.\"Generated by db2man.xsl. Don't modify this, modify the source. +.de Sh \" Subsection +.br +.if t .Sp +.ne 5 +.PP +\fB\\$1\fR +.PP +.. +.de Sp \" Vertical space (when we can't use .PP) +.if t .sp .5v +.if n .sp +.. +.de Ip \" List item +.br +.ie \\n(.$>=3 .ne \\$3 +.el .ne 3 +.IP "\\$1" \\$2 +.. +.TH "SAMBA" 7 "" "" "" .SH NAME -Samba \- A Windows SMB/CIFS fileserver for UNIX -.SH SYNOPSIS +samba \- A Windows SMB/CIFS fileserver for UNIX +.SH "SYNOPSIS" -\fBSamba\fR +.nf +\fBSamba\fR +.fi .SH "DESCRIPTION" + .PP -The Samba software suite is a collection of programs -that implements the Server Message Block (commonly abbreviated -as SMB) protocol for UNIX systems. This protocol is sometimes -also referred to as the Common Internet File System (CIFS). For a -more thorough description, see http://www.ubiqx.org/cifs/ . Samba also implements the NetBIOS -protocol in nmbd. -.TP -\fBsmbd(8)\fR -The \fBsmbd\fR daemon provides the file and print services to -SMB clients, such as Windows 95/98, Windows NT, Windows -for Workgroups or LanManager. The configuration file -for this daemon is described in \fBsmb.conf\fR(5) -.TP -\fBnmbd(8)\fR -The \fBnmbd\fR -daemon provides NetBIOS nameservice and browsing -support. The configuration file for this daemon -is described in \fBsmb.conf\fR(5) -.TP -\fBsmbclient(1)\fR -The \fBsmbclient\fR -program implements a simple ftp-like client. This -is useful for accessing SMB shares on other compatible -servers (such as Windows NT), and can also be used -to allow a UNIX box to print to a printer attached to -any SMB server (such as a PC running Windows NT). -.TP -\fBtestparm(1)\fR -The \fBtestparm\fR -utility is a simple syntax checker for Samba's \fBsmb.conf\fR(5) configuration file. -.TP -\fBtestprns(1)\fR -The \fBtestprns\fR -utility supports testing printer names defined -in your \fIprintcap\fR file used -by Samba. -.TP -\fBsmbstatus(1)\fR -The \fBsmbstatus\fR -tool provides access to information about the -current connections to \fBsmbd\fR. -.TP -\fBnmblookup(1)\fR -The \fBnmblookup\fR -tools allows NetBIOS name queries to be made -from a UNIX host. -.TP -\fBsmbgroupedit(8)\fR -The \fBsmbgroupedit\fR -tool allows for mapping unix groups to NT Builtin, -Domain, or Local groups. Also it allows setting -priviledges for that group, such as saAddUser, etc. -.TP -\fBsmbpasswd(8)\fR -The \fBsmbpasswd\fR -command is a tool for changing LanMan and Windows NT -password hashes on Samba and Windows NT servers. -.TP -\fBsmbcacls(1)\fR -The \fBsmbcacls\fR command is -a tool to set ACL's on remote CIFS servers. -.TP -\fBsmbsh(1)\fR -The \fBsmbsh\fR command is -a program that allows you to run a unix shell with -with an overloaded VFS. -.TP -\fBsmbtree(1)\fR -The \fBsmbtree\fR command -is a text-based network neighborhood tool. -.TP -\fBsmbtar(1)\fR -The \fBsmbtar\fR can make -backups of data on CIFS/SMB servers. -.TP -\fBsmbspool(8)\fR -\fBsmbspool\fR is a -helper utility for printing on printers connected -to CIFS servers. -.TP -\fBsmbcontrol(1)\fR -\fBsmbcontrol\fR is a utility -that can change the behaviour of running samba daemons. -.TP -\fBrpcclient(1)\fR -\fBrpcclient\fR is a utility -that can be used to execute RPC commands on remote -CIFS servers. -.TP -\fBpdbedit(8)\fR -The \fBpdbedit\fR command -can be used to maintain the local user database on -a samba server. -.TP -\fBfindsmb(1)\fR -The \fBfindsmb\fR command -can be used to find SMB servers on the local network. -.TP -\fBnet(8)\fR -The \fBnet\fR command -is supposed to work similar to the DOS/Windows -NET.EXE command. -.TP -\fBswat(8)\fR -\fBswat\fR is a web-based -interface to configuring \fIsmb.conf\fR. -.TP -\fBwinbindd(8)\fR -\fBwinbindd\fR is a daemon -that is used for integrating authentication and -the user database into unix. -.TP -\fBwbinfo(1)\fR -\fBwbinfo\fR is a utility -that retrieves and stores information related to winbind. -.TP -\fBeditreg(1)\fR -\fBeditreg\fR is a command-line -utility that can edit windows registry files. -.TP -\fBprofiles(1)\fR -\fBprofiles\fR is a command-line -utility that can be used to replace all occurences of -a certain SID with another SID. -.TP -\fBvfstest(1)\fR -\fBvfstest\fR is a utility -that can be used to test vfs modules. -.TP -\fBntlm_auth(1)\fR -\fBntlm_auth\fR is a helper-utility -for external programs wanting to do NTLM-authentication. -.TP -\fBsmbmount(8), smbumount(8), smbmount(8)\fR -\fBsmbmount\fR,\fBsmbmnt\fR and \fBsmbmnt\fR are commands that can be used to -mount CIFS/SMB shares on Linux. -.TP -\fBsmbcquotas(1)\fR -\fBsmbcquotas\fR is a tool that -can set remote QUOTA's on server with NTFS 5. +The Samba software suite is a collection of programs that implements the Server Message Block (commonly abbreviated as SMB) protocol for UNIX systems\&. This protocol is sometimes also referred to as the Common Internet File System (CIFS)\&. For a more thorough description, see http://www\&.ubiqx\&.org/cifs/\&. Samba also implements the NetBIOS protocol in nmbd\&. + +.TP +\fBsmbd\fR(8) +The \fBsmbd\fR daemon provides the file and print services to SMB clients, such as Windows 95/98, Windows NT, Windows for Workgroups or LanManager\&. The configuration file for this daemon is described in \fBsmb.conf\fR(5) + + +.TP +\fBnmbd\fR(8) +The \fBnmbd\fR daemon provides NetBIOS nameservice and browsing support\&. The configuration file for this daemon is described in \fBsmb.conf\fR(5) + + +.TP +\fBsmbclient\fR(1) +The \fBsmbclient\fR program implements a simple ftp-like client\&. This is useful for accessing SMB shares on other compatible servers (such as Windows NT), and can also be used to allow a UNIX box to print to a printer attached to any SMB server (such as a PC running Windows NT)\&. + + +.TP +\fBtestparm\fR(1) +The \fBtestparm\fR utility is a simple syntax checker for Samba's \fBsmb.conf\fR(5) configuration file\&. + + +.TP +\fBtestprns\fR(1) +The \fBtestprns\fR utility supports testing printer names defined in your \fIprintcap\fR file used by Samba\&. + + +.TP +\fBsmbstatus\fR(1) +The \fBsmbstatus\fR tool provides access to information about the current connections to \fBsmbd\fR\&. + + +.TP +\fBnmblookup\fR(1) +The \fBnmblookup\fR tools allows NetBIOS name queries to be made from a UNIX host\&. + + +.TP +\fBsmbgroupedit\fR(8) +The \fBsmbgroupedit\fR tool allows for mapping unix groups to NT Builtin, Domain, or Local groups\&. Also it allows setting priviledges for that group, such as saAddUser, etc\&. + + +.TP +\fBsmbpasswd\fR(8) +The \fBsmbpasswd\fR command is a tool for changing LanMan and Windows NT password hashes on Samba and Windows NT servers\&. + + +.TP +\fBsmbcacls\fR(1) +The \fBsmbcacls\fR command is a tool to set ACL's on remote CIFS servers\&. + + +.TP +\fBsmbsh\fR(1) +The \fBsmbsh\fR command is a program that allows you to run a unix shell with with an overloaded VFS\&. + + +.TP +\fBsmbtree\fR(1) +The \fBsmbtree\fR command is a text-based network neighborhood tool\&. + + +.TP +\fBsmbtar\fR(1) +The \fBsmbtar\fR can make backups of data on CIFS/SMB servers\&. + + +.TP +\fBsmbspool\fR(8) +\fBsmbspool\fR is a helper utility for printing on printers connected to CIFS servers\&. + + +.TP +\fBsmbcontrol\fR(1) +\fBsmbcontrol\fR is a utility that can change the behaviour of running samba daemons\&. + + +.TP +\fBrpcclient\fR(1) +\fBrpcclient\fR is a utility that can be used to execute RPC commands on remote CIFS servers\&. + + +.TP +\fBpdbedit\fR(8) +The \fBpdbedit\fR command can be used to maintain the local user database on a samba server\&. + + +.TP +\fBfindsmb\fR(1) +The \fBfindsmb\fR command can be used to find SMB servers on the local network\&. + + +.TP +\fBnet\fR(8) +The \fBnet\fR command is supposed to work similar to the DOS/Windows NET\&.EXE command\&. + + +.TP +\fBswat\fR(8) +\fBswat\fR is a web-based interface to configuring \fIsmb\&.conf\fR\&. + + +.TP +\fBwinbindd\fR(8) +\fBwinbindd\fR is a daemon that is used for integrating authentication and the user database into unix\&. + + +.TP +\fBwbinfo\fR(1) +\fBwbinfo\fR is a utility that retrieves and stores information related to winbind\&. + + +.TP +\fBeditreg\fR(1) +\fBeditreg\fR is a command-line utility that can edit windows registry files\&. + + +.TP +\fBprofiles\fR(1) +\fBprofiles\fR is a command-line utility that can be used to replace all occurences of a certain SID with another SID\&. + + +.TP +\fBvfstest\fR(1) +\fBvfstest\fR is a utility that can be used to test vfs modules\&. + + +.TP +\fBntlm_auth\fR(1) +\fBntlm_auth\fR is a helper-utility for external programs wanting to do NTLM-authentication\&. + + +.TP +\fBsmbmount\fR(8), \fBsmbumount\fR(8), \fBsmbmount\fR(8) +\fBsmbmount\fR,\fBsmbmnt\fR and \fBsmbmnt\fR are commands that can be used to mount CIFS/SMB shares on Linux\&. + + +.TP +\fBsmbcquotas\fR(1) +\fBsmbcquotas\fR is a tool that can set remote QUOTA's on server with NTFS 5\&. + + .SH "COMPONENTS" + .PP -The Samba suite is made up of several components. Each -component is described in a separate manual page. It is strongly -recommended that you read the documentation that comes with Samba -and the manual pages of those components that you use. If the -manual pages and documents aren't clear enough then please visit -http://devel.samba.org -for information on how to file a bug report or submit a patch. +The Samba suite is made up of several components\&. Each component is described in a separate manual page\&. It is strongly recommended that you read the documentation that comes with Samba and the manual pages of those components that you use\&. If the manual pages and documents aren't clear enough then please visithttp://devel\&.samba\&.org for information on how to file a bug report or submit a patch\&. + .PP -If you require help, visit the Samba webpage at -http://www.samba.org/ and -explore the many option available to you. +If you require help, visit the Samba webpage athttp://www\&.samba\&.org/ and explore the many option available to you\&. + .SH "AVAILABILITY" + .PP -The Samba software suite is licensed under the -GNU Public License(GPL). A copy of that license should -have come with the package in the file COPYING. You are -encouraged to distribute copies of the Samba suite, but -please obey the terms of this license. +The Samba software suite is licensed under the GNU Public License(GPL)\&. A copy of that license should have come with the package in the file COPYING\&. You are encouraged to distribute copies of the Samba suite, but please obey the terms of this license\&. + .PP -The latest version of the Samba suite can be -obtained via anonymous ftp from samba.org in the -directory pub/samba/. It is also available on several -mirror sites worldwide. +The latest version of the Samba suite can be obtained via anonymous ftp from samba\&.org in the directory pub/samba/\&. It is also available on several mirror sites worldwide\&. + .PP -You may also find useful information about Samba -on the newsgroup comp.protocol.smb and the Samba mailing -list. Details on how to join the mailing list are given in -the README file that comes with Samba. +You may also find useful information about Samba on the newsgroup comp\&.protocol\&.smb and the Samba mailing list\&. Details on how to join the mailing list are given in the README file that comes with Samba\&. + .PP -If you have access to a WWW viewer (such as Mozilla -or Konqueror) then you will also find lots of useful information, -including back issues of the Samba mailing list, at -http://lists.samba.org . +If you have access to a WWW viewer (such as Mozilla or Konqueror) then you will also find lots of useful information, including back issues of the Samba mailing list, athttp://lists\&.samba\&.org\&. + .SH "VERSION" + .PP -This man page is correct for version 3.0 of the -Samba suite. +This man page is correct for version 3\&.0 of the Samba suite\&. + .SH "CONTRIBUTIONS" + .PP -If you wish to contribute to the Samba project, -then I suggest you join the Samba mailing list at -http://lists.samba.org . +If you wish to contribute to the Samba project, then I suggest you join the Samba mailing list athttp://lists\&.samba\&.org\&. + .PP -If you have patches to submit, visit -http://devel.samba.org/ -for information on how to do it properly. We prefer patches -in \fBdiff -u\fR format. +If you have patches to submit, visithttp://devel\&.samba\&.org/ for information on how to do it properly\&. We prefer patches in \fBdiff -u\fR format\&. + .SH "CONTRIBUTORS" + .PP -Contributors to the project are now too numerous -to mention here but all deserve the thanks of all Samba -users. To see a full list, look at ftp://samba.org/pub/samba/alpha/change-log -for the pre-CVS changes and at ftp://samba.org/pub/samba/alpha/cvs.log -for the contributors to Samba post-CVS. CVS is the Open Source -source code control system used by the Samba Team to develop -Samba. The project would have been unmanageable without it. -.PP -In addition, several commercial organizations now help -fund the Samba Team with money and equipment. For details see -the Samba Web pages at http://samba.org/samba/samba-thanks.html +Contributors to the project are now too numerous to mention here but all deserve the thanks of all Samba users\&. To see a full list, look at the\fIchange-log\fR in the source package for the pre-CVS changes and at http://cvs\&.samba\&.org/ for the contributors to Samba post-CVS\&. CVS is the Open Source source code control system used by the Samba Team to develop Samba\&. The project would have been unmanageable without it\&. + .SH "AUTHOR" + .PP -The original Samba software and related utilities -were created by Andrew Tridgell. Samba is now developed -by the Samba Team as an Open Source project similar -to the way the Linux kernel is developed. +The original Samba software and related utilities were created by Andrew Tridgell\&. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed\&. + .PP -The original Samba man pages were written by Karl Auer. -The man page sources were converted to YODL format (another -excellent piece of Open Source software, available at ftp://ftp.icce.rug.nl/pub/unix/ ) and updated for the Samba 2.0 -release by Jeremy Allison. The conversion to DocBook for -Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML -4.2 for Samba 3.0 was done by Alexander Bokovoy. +The original Samba man pages were written by Karl Auer\&. The man page sources were converted to YODL format (another excellent piece of Open Source software, available at ftp://ftp\&.icce\&.rug\&.nl/pub/unix/) and updated for the Samba 2\&.0 release by Jeremy Allison\&. The conversion to DocBook for Samba 2\&.2 was done by Gerald Carter\&. The conversion to DocBook XML 4\&.2 for Samba 3\&.0 was done by Alexander Bokovoy\&. + diff --git a/docs/manpages/smb.conf.5 b/docs/manpages/smb.conf.5 index 74716bf1bd..3e0bc555ea 100644 --- a/docs/manpages/smb.conf.5 +++ b/docs/manpages/smb.conf.5 @@ -458,10 +458,6 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIadd user to group script\fR -.TP -\(bu -\fIads server\fR - .TP \(bu \fIalgorithmic rid base\fR @@ -502,6 +498,10 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIchange share command\fR +.TP +\(bu +\fIclient use spnego\fR + .TP \(bu \fIconfig file\fR @@ -532,11 +532,11 @@ Here is a list of all global parameters\&. See the section of each parameter for .TP \(bu -\fIdefault service\fR +\fIdefault\fR .TP \(bu -\fIdefault\fR +\fIdefault service\fR .TP \(bu @@ -630,6 +630,14 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIhosts equiv\fR +.TP +\(bu +\fIidmap gid\fR + +.TP +\(bu +\fIidmap uid\fR + .TP \(bu \fIinclude\fR @@ -716,11 +724,11 @@ Here is a list of all global parameters\&. See the section of each parameter for .TP \(bu -\fIlock directory\fR +\fIlock dir\fR .TP \(bu -\fIlock dir\fR +\fIlock directory\fR .TP \(bu @@ -912,11 +920,11 @@ Here is a list of all global parameters\&. See the section of each parameter for .TP \(bu -\fIpasswd chat debug\fR +\fIpasswd chat\fR .TP \(bu -\fIpasswd chat\fR +\fIpasswd chat debug\fR .TP \(bu @@ -944,11 +952,11 @@ Here is a list of all global parameters\&. See the section of each parameter for .TP \(bu -\fIpreload modules\fR +\fIpreload\fR .TP \(bu -\fIpreload\fR +\fIpreload modules\fR .TP \(bu @@ -992,7 +1000,7 @@ Here is a list of all global parameters\&. See the section of each parameter for .TP \(bu -\fIroot directory\fR +\fIroot\fR .TP \(bu @@ -1000,7 +1008,7 @@ Here is a list of all global parameters\&. See the section of each parameter for .TP \(bu -\fIroot\fR +\fIroot directory\fR .TP \(bu @@ -1048,11 +1056,11 @@ Here is a list of all global parameters\&. See the section of each parameter for .TP \(bu -\fIstat cache size\fR +\fIstat cache\fR .TP \(bu -\fIstat cache\fR +\fIstat cache size\fR .TP \(bu @@ -1060,11 +1068,11 @@ Here is a list of all global parameters\&. See the section of each parameter for .TP \(bu -\fIsyslog only\fR +\fIsyslog\fR .TP \(bu -\fIsyslog\fR +\fIsyslog only\fR .TP \(bu @@ -1128,11 +1136,11 @@ Here is a list of all global parameters\&. See the section of each parameter for .TP \(bu -\fIutmp directory\fR +\fIutmp\fR .TP \(bu -\fIutmp\fR +\fIutmp directory\fR .TP \(bu @@ -1279,19 +1287,19 @@ Here is a list of all service parameters\&. See the section on each parameter fo .TP \(bu -\fIdirectory mask\fR +\fIdirectory\fR .TP \(bu -\fIdirectory mode\fR +\fIdirectory mask\fR .TP \(bu -\fIdirectory security mask\fR +\fIdirectory mode\fR .TP \(bu -\fIdirectory\fR +\fIdirectory security mask\fR .TP \(bu @@ -1457,6 +1465,10 @@ Here is a list of all service parameters\&. See the section on each parameter fo \(bu \fImangling char\fR +.TP +\(bu +\fImap acl inherit\fR + .TP \(bu \fImap archive\fR @@ -1477,6 +1489,10 @@ Here is a list of all service parameters\&. See the section on each parameter fo \(bu \fImax print jobs\fR +.TP +\(bu +\fImax reported print jobs\fR + .TP \(bu \fImin print space\fR @@ -1523,11 +1539,11 @@ Here is a list of all service parameters\&. See the section on each parameter fo .TP \(bu -\fIpreexec close\fR +\fIpreexec\fR .TP \(bu -\fIpreexec\fR +\fIpreexec close\fR .TP \(bu @@ -1547,15 +1563,15 @@ Here is a list of all service parameters\&. See the section on each parameter fo .TP \(bu -\fIprinter admin\fR +\fIprinter\fR .TP \(bu -\fIprinter name\fR +\fIprinter admin\fR .TP \(bu -\fIprinter\fR +\fIprinter name\fR .TP \(bu @@ -1591,11 +1607,11 @@ Here is a list of all service parameters\&. See the section on each parameter fo .TP \(bu -\fIroot preexec close\fR +\fIroot preexec\fR .TP \(bu -\fIroot preexec\fR +\fIroot preexec close\fR .TP \(bu @@ -1633,6 +1649,10 @@ Here is a list of all service parameters\&. See the section on each parameter fo \(bu \fIuse client driver\fR +.TP +\(bu +\fIuser\fR + .TP \(bu \fIusername\fR @@ -1643,11 +1663,11 @@ Here is a list of all service parameters\&. See the section on each parameter fo .TP \(bu -\fIuser\fR +\fIuse sendfile\fR .TP \(bu -\fIuse sendfile\fR +\fI-valid\fR .TP \(bu @@ -1667,11 +1687,7 @@ Here is a list of all service parameters\&. See the section on each parameter fo .TP \(bu -\fIvfs options\fR - -.TP -\(bu -\fIvfs path\fR +\fIvfs objects\fR .TP \(bu @@ -1858,17 +1874,6 @@ Default: \fBno admin users\fR Example: \fBadmin users = jason\fR -.TP -ads server (G) -If this option is specified, samba does not try to figure out what ads server to use itself, but uses the specified ads server\&. Either one DNS name or IP address can be used\&. - - -Default: \fBads server = \fR - - -Example: \fBads server = 192.168.1.2\fR - - .TP algorithmic rid base (G) This determines how Samba will use its algorithmic mapping from uids/gid to the RIDs needed to construct NT Security Identifiers\&. @@ -1926,16 +1931,19 @@ Example: \fBannounce version = 2.0\fR .TP auth methods (G) -This option allows the administrator to chose what authentication methods \fBsmbd\fR will use when authenticating a user\&. This option defaults to sensible values based on \fIsecurity\fR\&. +This option allows the administrator to chose what authentication methods \fBsmbd\fR will use when authenticating a user\&. This option defaults to sensible values based on \fIsecurity\fR\&. This should be considered a developer option and used only in rare circumstances\&. In the majority (if not all) of production servers, the default setting should be adequate\&. Each entry in the list attempts to authenticate the user in turn, until the user authenticates\&. In practice only one method will ever actually be able to complete the authentication\&. +Possible options include \fBguest\fR (anonymous access), \fBsam\fR (lookups in local list of accounts based on netbios name or domain name), \fBwinbind\fR (relay authentication requests for remote users through winbindd), \fBntdomain\fR (pre-winbindd method of authentication for remote domain users; deprecated in favour of winbind method), \fBtrustdomain\fR (authenticate trusted users by contacting the remote DC directly from smbd; deprecated in favour of winbind method)\&. + + Default: \fBauth methods = \fR -Example: \fBauth methods = guest sam ntdomain\fR +Example: \fBauth methods = guest sam winbind\fR .TP @@ -2075,6 +2083,14 @@ Default: \fBnone\fR Example: \fBchange share command = /usr/local/bin/addshare\fR +.TP +client use spnego (G) +This variable controls controls whether samba clients will try to use Simple and Protected NEGOciation (as specified by rfc2478) with WindowsXP and Windows2000 servers to agree upon an authentication mechanism\&. SPNEGO client support with Sign and Seal is currently broken, so you might want to turn this option off when doing joins to Windows 2003 domains\&. + + +Default: \fBclient use spnego = yes\fR + + .TP comment (S) This is a text field that is seen next to a share when a client does a queries the server, either via the network neighborhood or via \fBnet view\fR to list what shares are available\&. @@ -2240,6 +2256,11 @@ Note that the parameter \fI debug timestamp\fR must be on for this to have an ef Default: \fBdebug uid = no\fR +.TP +default (G) +A synonym for \fI default service\fR\&. + + .TP default case (S) See the section on NAME MANGLING\&. Also note the \fIshort preserve case\fR parameter\&. @@ -2295,11 +2316,6 @@ Example: .fi -.TP -default (G) -A synonym for \fI default service\fR\&. - - .TP delete group script (G) This is the full pathname to a script that will be run \fBAS ROOT\fR \fBsmbd\fR(8) when a group is requested to be deleted\&. It will expand any \fI%g\fR to the group name passed\&. This script is only useful for installations using the Windows NT domain administration tools\&. @@ -2456,6 +2472,11 @@ or perhaps (on Sys V based systems): Note that you may have to replace the command names with full path names on some systems\&. +.TP +directory (S) +Synonym for \fIpath\fR\&. + + .TP directory mask (S) This parameter is the octal modes which are used when converting DOS modes to UNIX modes when creating UNIX directories\&. @@ -2516,11 +2537,6 @@ Default: \fBdirectory security mask = 0777\fR Example: \fBdirectory security mask = 0700\fR -.TP -directory (S) -Synonym for \fIpath\fR\&. - - .TP disable netbios (G) Enabling this parameter will disable netbios support in Samba\&. Netbios is the only available form of browsing in all windows versions except for 2000 and XP\&. @@ -3120,6 +3136,31 @@ Default: \fBno host equivalences\fR Example: \fBhosts equiv = /etc/hosts.equiv\fR +.TP +idmap gid (G) +The idmap gid parameter specifies the range of group ids that are allocated for the purpose of mapping UNX groups to NT group SIDs\&. This range of group ids should have no existing local or NIS groups within it as strange conflicts can occur otherwise\&. + + +The availability of an idmap gid range is essential for correct operation of all group mapping\&. + + +Default: \fBidmap gid = \fR + + +Example: \fBidmap gid = 10000-20000\fR + + +.TP +idmap uid (G) +The idmap uid parameter specifies the range of user ids that are allocated for use in mapping UNIX users to NT user SIDs\&. This range of ids should have no existing local or NIS users within it as strange conflicts can occur otherwise\&. + + +Default: \fBidmap uid = \fR + + +Example: \fBidmap uid = 10000-20000\fR + + .TP include (G) This allows you to include one config file inside another\&. The file is included literally, as though typed in place\&. @@ -3261,6 +3302,15 @@ lanman auth (G) This parameter determines whether or not \fBsmbd\fR(8) will attempt to authenticate users using the LANMAN password hash\&. If disabled, only clients which support NT password hashes (e\&.g\&. Windows NT/2000 clients, smbclient, etc\&.\&.\&. but not Windows 95/98 or the MS DOS network client) will be able to connect to the Samba host\&. +The LANMAN encrypted response is easily broken, due to it's case-insensitive nature, and the choice of algorithm\&. Servers without Windows 95/98 or MS DOS clients are advised to disable this option\&. + + +Unlike the \fBencypt passwords\fR option, this parameter cannot alter client behaviour, and the LANMAN response will still be sent over the network\&. See the \fBclient lanman auth\fR to disable this for Samba's clients (such as smbclient) + + +If this option, and \fBntlm auth\fR are both disabled, then only NTLMv2 logins will be permited\&. Not all clients support NTLMv2, and most will require special configuration to us it\&. + + Default : \fBlanman auth = yes\fR @@ -3463,6 +3513,11 @@ Setting this value to \fBno\fR will cause \fBnmbd\fR \fBnever\fR to become a loc Default: \fBlocal master = yes\fR +.TP +lock dir (G) +Synonym for \fI lock directory\fR\&. + + .TP lock directory (G) This option specifies the directory where lock files will be placed\&. The lock files are used to implement the \fImax connections\fR option\&. @@ -3474,11 +3529,6 @@ Default: \fBlock directory = ${prefix}/var/locks\fR Example: \fBlock directory = /var/run/samba/locks\fR -.TP -lock dir (G) -Synonym for \fI lock directory\fR\&. - - .TP locking (S) This controls whether or not locking will be performed by the server in response to lock requests from the client\&. @@ -3949,6 +3999,14 @@ Default: \fBmangling method = hash2\fR Example: \fBmangling method = hash\fR +.TP +map acl inherit (S) +This boolean parameter controls whether \fBsmbd\fR(8) will attempt to map the 'inherit' and 'protected' access control entry flags stored in Windows ACLs into an extended attribute called user\&.SAMBA_PAI\&. This parameter only takes effect if Samba is being run on a platform that supports extended attributes (Linux and IRIX so far) and allows the Windows 2000 ACL editor to correctly use inheritance with the Samba POSIX ACL mapping code\&. + + +Default: \fBmap acl inherit = no\fR + + .TP map archive (S) This controls whether the DOS archive attribute should be mapped to the UNIX owner execute bit\&. The DOS archive bit is set when a file has been modified since its last backup\&. One motivation for this option it to keep Samba/your PC from making any file it touches from becoming executable under UNIX\&. This can be quite annoying for shared source code, documents, etc\&.\&.\&. @@ -4119,6 +4177,17 @@ Default: \fBmax protocol = NT1\fR Example: \fBmax protocol = LANMAN1\fR +.TP +max reported print jobs (S) +This parameter limits the maximum number of jobs displayed in a port monitor for Samba printer queue at any given moment\&. If this number is exceeded, the excess jobs will not be shown\&. A value of zero means there is no limit on the number of print jobs reported\&. See all \fItotal print jobs\fR and \fImax print jobs\fR parameters\&. + + +Default: \fBmax reported print jobs = 0\fR + + +Example: \fBmax reported print jobs = 1000\fR + + .TP max smbd processes (G) This parameter limits the maximum number of \fBsmbd\fR(8) processes concurrently running on a system and is intended as a stopgap to prevent degrading service to clients in the event that the server has insufficient resources to handle more than this number of connections\&. Remember that under normal operating conditions, each user will have an \fBsmbd\fR(8) associated with him or her to handle connections to all shares from a given host\&. @@ -4300,7 +4369,7 @@ Example: \fBname cache timeout = 0\fR .TP name resolve order (G) -This option is used by the programs in the Samba suite to determine what naming services to use and in what order to resolve host names to IP addresses\&. The option takes a space separated string of name resolution options\&. +This option is used by the programs in the Samba suite to determine what naming services to use and in what order to resolve host names to IP addresses\&. Its main purpose to is to control how netbios name resolution is performed\&. The option takes a space separated string of name resolution options\&. The options are: "lmhosts", "host", "wins" and "bcast"\&. They cause names to be resolved as follows: @@ -4308,7 +4377,7 @@ The options are: "lmhosts", "host", "wins" and "bcast"\&. They cause names to be \fBlmhosts\fR : Lookup an IP address in the Samba lmhosts file\&. If the line in lmhosts has no name type attached to the NetBIOS name (see the lmhosts(5) for details) then any name type matches for lookup\&. -\fBhost\fR : Do a standard host name to IP address resolution, using the system \fI/etc/hosts \fR, NIS, or DNS lookups\&. This method of name resolution is operating system depended for instance on IRIX or Solaris this may be controlled by the \fI/etc/nsswitch\&.conf\fR file\&. Note that this method is only used if the NetBIOS name type being queried is the 0x20 (server) name type, otherwise it is ignored\&. +\fBhost\fR : Do a standard host name to IP address resolution, using the system \fI/etc/hosts \fR, NIS, or DNS lookups\&. This method of name resolution is operating system depended for instance on IRIX or Solaris this may be controlled by the \fI/etc/nsswitch\&.conf\fR file\&. Note that this method is used only if the NetBIOS name type being queried is the 0x20 (server) name type or 0x1c (domain controllers)\&. The latter case is only useful for active directory domains and results in a DNS query for the SRV RR entry matching _ldap\&._tcp\&.domain\&. \fBwins\fR : Query a name with the IP address listed in the \fI wins server\fR parameter\&. If no WINS server has been specified this method will be ignored\&. @@ -4323,6 +4392,15 @@ Example: \fBname resolve order = lmhosts bcast host\fR This will cause the local lmhosts file to be examined first, followed by a broadcast attempt, followed by a normal system hostname lookup\&. +When Samba is functioning in ADS security mode (\fBsecurity = ads\fR) it is advised to use following settings for \fIname resolve order\fR: + + +\fBname resolve order = wins bcast\fR + + +DC lookups will still be done via DNS, but fallbacks to netbios names will not inundate your DNS servers with needless querys for DOMAIN<0x1c> lookups\&. + + .TP netbios aliases (G) This is a list of NetBIOS names that nmbd(8) will advertise as additional names by which the Samba server is known\&. This allows one machine to appear in browse lists under multiple names\&. If a machine is acting as a browse server or logon server none of these names will be advertised as either browse server or logon servers, only the primary name of the machine will be advertised with these capabilities\&. @@ -4396,10 +4474,10 @@ Default: \fBnt acl support = yes\fR .TP ntlm auth (G) -This parameter determines whether or not \fBsmbd\fR(8) will attempt to authenticate users using the NTLM password hash\&. If disabled, only the lanman password hashes will be used\&. +This parameter determines whether or not \fBsmbd\fR(8) will attempt to authenticate users using the NTLM encrypted password response\&. If disabled, either the lanman password hash or an NTLMv2 response will need to be sent by the client\&. -Please note that at least this option or \fBlanman auth\fR should be enabled in order to be able to log in\&. +If this option, and \fBlanman auth\fR are both disabled, then only NTLMv2 logins will be permited\&. Not all clients support NTLMv2, and most will require special configuration to us it\&. Default : \fBntlm auth = yes\fR @@ -4570,30 +4648,19 @@ This option allows the administrator to chose which backends to retrieve and sto This parameter is in two parts, the backend's name, and a 'location' string that has meaning only to that particular backed\&. These are separated by a : character\&. -Available backends can include: .TP 3 \(bu \fBsmbpasswd\fR - The default smbpasswd backend\&. Takes a path to the smbpasswd file as an optional argument\&. .TP \(bu \fBsmbpasswd_nua\fR - The smbpasswd backend, but with support for 'not unix accounts'\&. Takes a path to the smbpasswd file as an optional argument\&. See also \fInon unix account range\fR .TP \(bu \fBtdbsam\fR - The TDB based password storage backend\&. Takes a path to the TDB as an optional argument (defaults to passdb\&.tdb in the \fIprivate dir\fR directory\&. .TP \(bu \fBtdbsam_nua\fR - The TDB based password storage backend, with non unix account support\&. Takes a path to the TDB as an optional argument (defaults to passdb\&.tdb in the \fIprivate dir\fR directory\&. See also \fInon unix account range\fR .TP \(bu \fBldapsam\fR - The LDAP based passdb backend\&. Takes an LDAP URL as an optional argument (defaults to \fBldap://localhost\fR) .TP \(bu \fBldapsam_nua\fR - The LDAP based passdb backend, with non unix account support\&. Takes an LDAP URL as an optional argument (defaults to \fBldap://localhost\fR) Note: In this module, any account without a matching POSIX account is regarded as 'non unix'\&. See also \fInon unix account range\fR LDAP connections should be secured where possible\&. This may be done using either Start-TLS (see \fIldap ssl\fR) or by specifying \fIldaps://\fR in the URL argument\&. .TP \(bu \fBnisplussam\fR - The NIS+ based passdb backend\&. Takes name NIS domain as an optional argument\&. Only works with sun NIS+ servers\&. .LP +Available backends can include: .TP 3 \(bu \fBsmbpasswd\fR - The default smbpasswd backend\&. Takes a path to the smbpasswd file as an optional argument\&. .TP \(bu \fBtdbsam\fR - The TDB based password storage backend\&. Takes a path to the TDB as an optional argument (defaults to passdb\&.tdb in the \fIprivate dir\fR directory\&. .TP \(bu \fBldapsam\fR - The LDAP based passdb backend\&. Takes an LDAP URL as an optional argument (defaults to \fBldap://localhost\fR) LDAP connections should be secured where possible\&. This may be done using either Start-TLS (see \fIldap ssl\fR) or by specifying \fIldaps://\fR in the URL argument\&. .TP \(bu \fBnisplussam\fR - The NIS+ based passdb backend\&. Takes name NIS domain as an optional argument\&. Only works with sun NIS+ servers\&. .TP \(bu \fBmysql\fR - The MySQL based passdb backend\&. Takes an identifier as argument\&. Read the Samba HOWTO Collection for configuration details\&. .TP \(bu \fBguest\fR - Very simple backend that only provides one user: the guest user\&. Only maps the NT guest user to the \fIguest account\fR\&. Required in pretty much all situations\&. .LP -Default: \fBpassdb backend = smbpasswd unixsam\fR +Default: \fBpassdb backend = smbpasswd\fR Example: \fBpassdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd guest\fR -Example: \fBpassdb backend = ldapsam_nua:ldaps://ldap.example.com guest\fR +Example: \fBpassdb backend = ldapsam:ldaps://ldap.example.com guest\fR -Example: \fBpassdb backend = mysql:my_plugin_args tdbsam:/etc/samba/private/passdb.tdb\fR - - -.TP -passwd chat debug (G) -This boolean specifies if the passwd chat script parameter is run in \fBdebug\fR mode\&. In this mode the strings passed to and received from the passwd chat are printed in the \fBsmbd\fR(8) log with a \fIdebug level\fR of 100\&. This is a dangerous option as it will allow plaintext passwords to be seen in the \fBsmbd\fR log\&. It is available to help Samba admins debug their \fIpasswd chat\fR scripts when calling the \fIpasswd program\fR and should be turned off after this has been done\&. This option has no effect if the \fIpam password change\fR paramter is set\&. This parameter is off by default\&. - - -See also \fIpasswd chat\fR , \fIpam password change\fR , \fIpasswd program\fR \&. - - -Default: \fBpasswd chat debug = no\fR +Example: \fBpassdb backend = mysql:my_plugin_args tdbsam:/etc/samba/private/passdb.tdb guest\fR .TP @@ -4625,6 +4692,17 @@ Default: \fBpasswd chat = *new*password* %n\\n *new*password* %n\\n *changed*\fR Example: \fBpasswd chat = "*Enter OLD password*" %o\\n "*Enter NEW password*" %n\\n "*Reenter NEW password*" %n\\n "*Password changed*"\fR +.TP +passwd chat debug (G) +This boolean specifies if the passwd chat script parameter is run in \fBdebug\fR mode\&. In this mode the strings passed to and received from the passwd chat are printed in the \fBsmbd\fR(8) log with a \fIdebug level\fR of 100\&. This is a dangerous option as it will allow plaintext passwords to be seen in the \fBsmbd\fR log\&. It is available to help Samba admins debug their \fIpasswd chat\fR scripts when calling the \fIpasswd program\fR and should be turned off after this has been done\&. This option has no effect if the \fIpam password change\fR paramter is set\&. This parameter is off by default\&. + + +See also \fIpasswd chat\fR , \fIpam password change\fR , \fIpasswd program\fR \&. + + +Default: \fBpasswd chat debug = no\fR + + .TP passwd program (G) The name of a program that can be used to set UNIX user passwords\&. Any occurrences of \fI%u\fR will be replaced with the user name\&. The user name is checked for existence before calling the password changing program\&. @@ -4685,13 +4763,13 @@ Example: \fBpassword level = 4\fR .TP password server (G) -By specifying the name of another SMB server (such as a WinNT box) with this option, and using \fBsecurity = domain \fR or \fBsecurity = server\fR you can get Samba to do all its username/password validation via a remote server\&. +By specifying the name of another SMB server or Active Directory domain controller with this option, and using \fBsecurity = [ads|domain|server]\fR it is possible to get Samba to to do all its username/password validation using a specific remote server\&. -This option sets the name of the password server to use\&. It must be a NetBIOS name, so if the machine's NetBIOS name is different from its Internet name then you may have to add its NetBIOS name to the lmhosts file which is stored in the same directory as the \fIsmb\&.conf\fR file\&. +This option sets the name or IP address of the password server to use\&. New syntax has been added to support defining the port to use when connecting to the server the case of an ADS realm\&. To define a port other than the default LDAP port of 389, add the port number using a colon after the name or IP address (e\&.g\&. 192\&.168\&.1\&.100:389)\&. If you do not specify a port, Samba will use the standard LDAP port of tcp/389\&. Note that port numbers have no effect on password servers for Windows NT 4\&.0 domains or netbios connections\&. -The name of the password server is looked up using the parameter \fIname resolve order\fR and so may resolved by any method and order described in that parameter\&. +If parameter is a name, it is looked up using the parameter \fIname resolve order\fR and so may resolved by any method and order described in that parameter\&. The password server must be a machine capable of using the "LM1\&.2X002" or the "NT LM 0\&.12" protocol, and it must be in user level security mode\&. @@ -4705,13 +4783,13 @@ Never point a Samba server at itself for password serving\&. This will cause a l The name of the password server takes the standard substitutions, but probably the only useful one is \fI%m \fR, which means the Samba server will use the incoming client as the password server\&. If you use this then you better trust your clients, and you had better restrict them with hosts allow! -If the \fIsecurity\fR parameter is set to \fBdomain\fR, then the list of machines in this option must be a list of Primary or Backup Domain controllers for the Domain or the character '*', as the Samba server is effectively in that domain, and will use cryptographically authenticated RPC calls to authenticate the user logging on\&. The advantage of using \fB security = domain\fR is that if you list several hosts in the \fIpassword server\fR option then \fBsmbd \fR will try each in turn till it finds one that responds\&. This is useful in case your primary server goes down\&. +If the \fIsecurity\fR parameter is set to \fBdomain\fR or \fBads\fR, then the list of machines in this option must be a list of Primary or Backup Domain controllers for the Domain or the character '*', as the Samba server is effectively in that domain, and will use cryptographically authenticated RPC calls to authenticate the user logging on\&. The advantage of using \fB security = domain\fR is that if you list several hosts in the \fIpassword server\fR option then \fBsmbd \fR will try each in turn till it finds one that responds\&. This is useful in case your primary server goes down\&. If the \fIpassword server\fR option is set to the character '*', then Samba will attempt to auto-locate the Primary or Backup Domain controllers to authenticate against by doing a query for the name \fBWORKGROUP<1C>\fR and then contacting each server returned in the list of IP addresses from the name resolution source\&. -If the list of servers contains both names and the '*' character, the list is treated as a list of preferred domain controllers, but an auto lookup of all remaining DC's will be added to the list as well\&. Samba will not attempt to optimize this list by locating the closest DC\&. +If the list of servers contains both names/IP's and the '*' character, the list is treated as a list of preferred domain controllers, but an auto lookup of all remaining DC's will be added to the list as well\&. Samba will not attempt to optimize this list by locating the closest DC\&. If the \fIsecurity\fR parameter is set to \fBserver\fR, then there are different restrictions that \fBsecurity = domain\fR doesn't suffer from: @@ -4730,6 +4808,9 @@ Default: \fBpassword server = \fR Example: \fBpassword server = NT-PDC, NT-BDC1, NT-BDC2, *\fR +Example: \fBpassword server = windc.mydomain.com:389 192.168.1.101 *\fR + + Example: \fBpassword server = *\fR @@ -4792,14 +4873,6 @@ Default: \fBnone (no command executed)\fR Example: \fBpostexec = echo \"%u disconnected from %S from %m (%I)\" >> /tmp/log\fR -.TP -preexec close (S) -This boolean option controls whether a non-zero return code from \fIpreexec \fR should close the service being connected to\&. - - -Default: \fBpreexec close = no\fR - - .TP preexec (S) This option specifies a command to be run whenever the service is connected to\&. It takes the usual substitutions\&. @@ -4823,6 +4896,14 @@ Default: \fBnone (no command executed)\fR Example: \fBpreexec = echo \"%u connected to %S from %m (%I)\" >> /tmp/log\fR +.TP +preexec close (S) +This boolean option controls whether a non-zero return code from \fIpreexec \fR should close the service being connected to\&. + + +Default: \fBpreexec close = no\fR + + .TP prefered master (G) Synonym for \fI preferred master\fR for people who cannot spell :-)\&. @@ -4846,31 +4927,31 @@ Default: \fBpreferred master = auto\fR .TP -preload modules (G) -This is a list of paths to modules that should be loaded into smbd before a client connects\&. This improves the speed of smbd when reacting to new connections somewhat\&. +preload (G) +This is a list of services that you want to be automatically added to the browse lists\&. This is most useful for homes and printers services that would otherwise not be visible\&. -It is recommended to only use this option on heavy-performance servers\&. +Note that if you just want all printers in your printcap file loaded then the \fIload printers\fR option is easier\&. -Default: \fBpreload modules = \fR +Default: \fBno preloaded services\fR -Example: \fBpreload modules = /usr/lib/samba/passdb/mysql.so+++ \fR +Example: \fBpreload = fred lp colorlp\fR .TP -preload (G) -This is a list of services that you want to be automatically added to the browse lists\&. This is most useful for homes and printers services that would otherwise not be visible\&. +preload modules (G) +This is a list of paths to modules that should be loaded into smbd before a client connects\&. This improves the speed of smbd when reacting to new connections somewhat\&. -Note that if you just want all printers in your printcap file loaded then the \fIload printers\fR option is easier\&. +It is recommended to only use this option on heavy-performance servers\&. -Default: \fBno preloaded services\fR +Default: \fBpreload modules = \fR -Example: \fBpreload = fred lp colorlp\fR +Example: \fBpreload modules = /usr/lib/samba/passdb/mysql.so+++ \fR .TP @@ -4895,6 +4976,11 @@ Note that a printable service will ALWAYS allow writing to the service path (use Default: \fBprintable = no\fR +.TP +printcap (G) +Synonym for \fI printcap name\fR\&. + + .TP printcap name (S) This parameter may be used to override the compiled-in default printcap name used by the server (usually \fI /etc/printcap\fR)\&. See the discussion of the [printers] section above for reasons why you might want to do this\&. @@ -4930,11 +5016,6 @@ Default: \fBprintcap name = /etc/printcap\fR Example: \fBprintcap name = /etc/myprintcap\fR -.TP -printcap (G) -Synonym for \fI printcap name\fR\&. - - .TP print command (S) After a print job has finished spooling to a service, this command will be used via a \fBsystem()\fR call to process the spool file\&. Typically the command specified will submit the spool file to the host's printing subsystem, but there is no requirement that this be the case\&. The server will not remove the spool file, so whatever command you specify should remove the spool file when it has been processed, otherwise you will need to manually remove old spool files\&. @@ -4943,7 +5024,7 @@ After a print job has finished spooling to a service, this command will be used The print command is simply a text string\&. It will be used verbatim after macro substitutions have been made: -%s, %p - the path to the spool file name +%s, %f - the path to the spool file name %p - the appropriate printer name @@ -5003,6 +5084,11 @@ For printing = CUPS : If SAMBA is compiled against libcups, then printcap = cups Example: \fBprint command = /usr/local/samba/bin/myprintscript %p %s\fR +.TP +printer (S) +Synonym for \fI printer name\fR\&. + + .TP printer admin (S) This is a list of users that can do anything to printers via the remote administration interfaces offered by MS-RPC (usually using a NT workstation)\&. Note that the root user always has admin rights\&. @@ -5028,11 +5114,6 @@ Default: \fBnone (but may be \fBlp\fR on many systems)\fR Example: \fBprinter name = laserwriter\fR -.TP -printer (S) -Synonym for \fI printer name\fR\&. - - .TP printing (S) This parameters controls how printer status information is interpreted on your system\&. It also affects the default values for the \fIprint command\fR, \fIlpq command\fR, \fIlppause command \fR, \fIlpresume command\fR, and \fIlprm command\fR if specified in the [global] section\&. @@ -5251,12 +5332,27 @@ Default: \fBremote browse sync = \fR .TP restrict anonymous (G) -This is a integer parameter, and mirrors as much as possible the functinality the \fBRestrictAnonymous\fR registry key does on NT/Win2k\&. +The setting of this parameter determines whether user and group list information is returned for an anonymous connection\&. and mirrors the effects of the \fBHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\LSA\\RestrictAnonymous\fR registry key in Windows 2000 and Windows NT\&. When set to 0, user and group list information is returned to anyone who asks\&. When set to 1, only an authenticated user can retrive user and group list information\&. For the value 2, supported by Windows 2000/XP and Samba, no anonymous connections are allowed at all\&. This can break third party and Microsoft applications which expect to be allowed to perform operations anonymously\&. + + +The security advantage of using restrict anonymous = 1 is dubious, as user and group list information can be obtained using other means\&. + +The security advantage of using restrict anonymous = 2 is removed by setting \fIguest ok\fR = yes on any share\&. Default: \fBrestrict anonymous = 0\fR +.TP +root (G) +Synonym for \fIroot directory"\fR\&. + + +.TP +root dir (G) +Synonym for \fIroot directory"\fR\&. + + .TP root directory (G) The server will \fBchroot()\fR (i\&.e\&. Change its root directory) to this directory on startup\&. This is not strictly necessary for secure operation\&. Even without it the server will deny access to files not in one of the service entries\&. It may also check for, and deny access to, soft links to other parts of the filesystem, or attempts to use "\&.\&." in file names to access other directories (depending on the setting of the \fIwide links\fR parameter)\&. @@ -5271,11 +5367,6 @@ Default: \fBroot directory = /\fR Example: \fBroot directory = /homes/smb\fR -.TP -root dir (G) -Synonym for \fIroot directory"\fR\&. - - .TP root postexec (S) This is the same as the \fIpostexec\fR parameter except that the command is run as root\&. This is useful for unmounting filesystems (such as CDROMs) after a connection is closed\&. @@ -5287,17 +5378,6 @@ See also \fI postexec\fR\&. Default: \fBroot postexec = \fR -.TP -root preexec close (S) -This is the same as the \fIpreexec close \fR parameter except that the command is run as root\&. - - -See also \fI preexec\fR and \fIpreexec close\fR\&. - - -Default: \fBroot preexec close = no\fR - - .TP root preexec (S) This is the same as the \fIpreexec\fR parameter except that the command is run as root\&. This is useful for mounting filesystems (such as CDROMs) when a connection is opened\&. @@ -5310,31 +5390,14 @@ Default: \fBroot preexec = \fR .TP -root (G) -Synonym for \fIroot directory"\fR\&. - - -.TP -security mask (S) -This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a file using the native NT security dialog box\&. - - -This parameter is applied as a mask (AND'ed with) to the changed permission bits, thus preventing any bits not in this mask from being modified\&. Essentially, zero bits in this mask may be treated as a set of bits the user is not allowed to change\&. - - -If not set explicitly this parameter is 0777, allowing a user to modify all the user/group/world permissions on a file\&. - - -\fBNote\fR that users who can access the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems\&. Administrators of most normal systems will probably want to leave it set to \fB0777\fR\&. - - -See also the \fIforce directory security mode\fR, \fIdirectory security mask\fR, \fIforce security mode\fR parameters\&. +root preexec close (S) +This is the same as the \fIpreexec close \fR parameter except that the command is run as root\&. -Default: \fBsecurity mask = 0777\fR +See also \fI preexec\fR and \fIpreexec close\fR\&. -Example: \fBsecurity mask = 0770\fR +Default: \fBroot preexec close = no\fR .TP @@ -5444,7 +5507,7 @@ See also the \fIpassword server\fR parameter and the \fIencrypted passwords\fR p \fBSECURITY = SERVER\fR -In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an NT box\&. If this fails it will revert to \fBsecurity = user\fR\&. It expects the \fIencrypted passwords\fR parameter to be set to \fByes\fR, unless the remote server does not support them\&. However note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, it must have a valid \fIsmbpasswd\fR file to check users against\&. See the documentation file in the \fIdocs/\fR directory \fIENCRYPTION\&.txt\fR for details on how to set this up\&. +In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an NT box\&. If this fails it will revert to \fBsecurity = user\fR\&. It expects the \fIencrypted passwords\fR parameter to be set to \fByes\fR, unless the remote server does not support them\&. However note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, it must have a valid \fIsmbpasswd\fR file to check users against\&. See the chapter about the User Database in the Samba HOWTO Collection for details on how to set this up\&. \fBNote\fR this mode of operation has significant pitfalls, due to the fact that is activly initiates a man-in-the-middle attack on the remote SMB server\&. In particular, this mode of operation can cause significant resource consuption on the PDC, as it must maintain an active connection for the duration of the user's session\&. Furthermore, if this connection is lost, there is no way to reestablish it, and futher authenticaions to the Samba server may fail\&. (From a single client, till it disconnects)\&. @@ -5468,6 +5531,29 @@ Default: \fBsecurity = USER\fR Example: \fBsecurity = DOMAIN\fR +.TP +security mask (S) +This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a file using the native NT security dialog box\&. + + +This parameter is applied as a mask (AND'ed with) to the changed permission bits, thus preventing any bits not in this mask from being modified\&. Essentially, zero bits in this mask may be treated as a set of bits the user is not allowed to change\&. + + +If not set explicitly this parameter is 0777, allowing a user to modify all the user/group/world permissions on a file\&. + + +\fBNote\fR that users who can access the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems\&. Administrators of most normal systems will probably want to leave it set to \fB0777\fR\&. + + +See also the \fIforce directory security mode\fR, \fIdirectory security mask\fR, \fIforce security mode\fR parameters\&. + + +Default: \fBsecurity mask = 0777\fR + + +Example: \fBsecurity mask = 0770\fR + + .TP server schannel (G) This controls whether the server offers or even demands the use of the netlogon schannel\&. \fIserver schannel = no\fR does not offer the schannel, \fIserver schannel = auto\fR offers the schannel but does not enforce it, and \fIserver schannel = yes\fR denies access if the client is not able to speak netlogon schannel\&. This is only the case for Windows NT4 before SP4\&. @@ -5742,19 +5828,19 @@ Example: \fBsource environment = /usr/local/smb_env_vars\fR .TP -stat cache size (G) -This parameter determines the number of entries in the \fIstat cache\fR\&. You should never need to change this parameter\&. +stat cache (G) +This parameter determines if \fBsmbd\fR(8) will use a cache in order to speed up case insensitive name mappings\&. You should never need to change this parameter\&. -Default: \fBstat cache size = 50\fR +Default: \fBstat cache = yes\fR .TP -stat cache (G) -This parameter determines if \fBsmbd\fR(8) will use a cache in order to speed up case insensitive name mappings\&. You should never need to change this parameter\&. +stat cache size (G) +This parameter determines the number of entries in the \fIstat cache\fR\&. You should never need to change this parameter\&. -Default: \fBstat cache = yes\fR +Default: \fBstat cache size = 50\fR .TP @@ -5815,14 +5901,6 @@ See also the \fIstrict sync\fR parameter\&. Default: \fBsync always = no\fR -.TP -syslog only (G) -If this parameter is set then Samba debug messages are logged into the system syslog only, and not to the debug log files\&. - - -Default: \fBsyslog only = no\fR - - .TP syslog (G) This parameter maps how Samba debug messages are logged onto the system syslog logging levels\&. Samba debug level zero maps onto syslog \fBLOG_ERR\fR, debug level one maps onto \fBLOG_WARNING\fR, debug level two maps onto \fBLOG_NOTICE\fR, debug level three maps onto LOG_INFO\&. All higher levels are mapped to \fB LOG_DEBUG\fR\&. @@ -5834,6 +5912,14 @@ This parameter sets the threshold for sending messages to syslog\&. Only message Default: \fBsyslog = 1\fR +.TP +syslog only (G) +If this parameter is set then Samba debug messages are logged into the system syslog only, and not to the debug log files\&. + + +Default: \fBsyslog only = no\fR + + .TP template homedir (G) When filling out the user information for a Windows NT user, the \fBwinbindd\fR(8) daemon uses this parameter to fill in the home directory for that user\&. If the string \fI%D\fR is present it is substituted with the user's Windows NT domain name\&. If the string \fI%U\fR is present it is substituted with the user's Windows NT user name\&. @@ -5939,7 +6025,7 @@ Default: \fBupdate encrypted = no\fR .TP use client driver (S) -This parameter applies only to Windows NT/2000 clients\&. It has no affect on Windows 95/98/ME clients\&. When serving a printer to Windows NT/2000 clients without first installing a valid printer driver on the Samba host, the client will be required to install a local printer driver\&. From this point on, the client will treat the print as a local printer and not a network printer connection\&. This is much the same behavior that will occur when \fBdisable spoolss = yes\fR\&. +This parameter applies only to Windows NT/2000 clients\&. It has no effect on Windows 95/98/ME clients\&. When serving a printer to Windows NT/2000 clients without first installing a valid printer driver on the Samba host, the client will be required to install a local printer driver\&. From this point on, the client will treat the print as a local printer and not a network printer connection\&. This is much the same behavior that will occur when \fBdisable spoolss = yes\fR\&. The differentiating factor is that under normal circumstances, the NT/2000 client will attempt to open the network printer using MS-RPC\&. The problem is that because the client considers the printer to be local, it will attempt to issue the OpenPrinterEx() call requesting access rights associated with the logged on user\&. If the user possesses local administator rights but not root privilegde on the Samba host (often the case), the OpenPrinterEx() call will fail\&. The result is that the client will now display an "Access Denied; Unable to connect" message in the printer queue window (even though jobs may successfully be printed)\&. @@ -5962,6 +6048,49 @@ This global parameter determines if the tdb internals of Samba can depend on mma Default: \fBuse mmap = yes\fR +.TP +user (S) +Synonym for \fIusername\fR\&. + + +.TP +username (S) +Multiple users may be specified in a comma-delimited list, in which case the supplied password will be tested against each username in turn (left to right)\&. + + +The \fIusername\fR line is needed only when the PC is unable to supply its own username\&. This is the case for the COREPLUS protocol or where your users have different WfWg usernames to UNIX usernames\&. In both these cases you may also be better using the \\\\server\\share%user syntax instead\&. + + +The \fIusername\fR line is not a great solution in many cases as it means Samba will try to validate the supplied password against each of the usernames in the \fIusername\fR line in turn\&. This is slow and a bad idea for lots of users in case of duplicate passwords\&. You may get timeouts or security breaches using this parameter unwisely\&. + + +Samba relies on the underlying UNIX security\&. This parameter does not restrict who can login, it just offers hints to the Samba server as to what usernames might correspond to the supplied password\&. Users can login as whoever they please and they will be able to do no more damage than if they started a telnet session\&. The daemon runs as the user that they log in as, so they cannot do anything that user cannot do\&. + + +To restrict a service to a particular set of users you can use the \fIvalid users \fR parameter\&. + + +If any of the usernames begin with a '@' then the name will be looked up first in the NIS netgroups list (if Samba is compiled with netgroup support), followed by a lookup in the UNIX groups database and will expand to a list of all users in the group of that name\&. + + +If any of the usernames begin with a '+' then the name will be looked up only in the UNIX groups database and will expand to a list of all users in the group of that name\&. + + +If any of the usernames begin with a '&' then the name will be looked up only in the NIS netgroups database (if Samba is compiled with netgroup support) and will expand to a list of all users in the netgroup group of that name\&. + + +Note that searching though a groups database can take quite some time, and some clients may time out during the search\&. + + +See the section NOTE ABOUT USERNAME/PASSWORD VALIDATION for more information on how this parameter determines access to the services\&. + + +Default: \fBThe guest account if a guest service, else .\fR + + +Examples:\fBusername = fred, mary, jack, jane, @users, @pcgroup\fR + + .TP username level (G) This option helps Samba to try and 'guess' at the real UNIX username, as many DOS clients send an all-uppercase username\&. By default Samba tries all lowercase, followed by the username with the first letter capitalized, and fails if the username is not found on the UNIX machine\&. @@ -6043,67 +6172,38 @@ Example: \fBusername map = /usr/local/samba/lib/users.map\fR .TP -username (S) -Multiple users may be specified in a comma-delimited list, in which case the supplied password will be tested against each username in turn (left to right)\&. - - -The \fIusername\fR line is needed only when the PC is unable to supply its own username\&. This is the case for the COREPLUS protocol or where your users have different WfWg usernames to UNIX usernames\&. In both these cases you may also be better using the \\\\server\\share%user syntax instead\&. - - -The \fIusername\fR line is not a great solution in many cases as it means Samba will try to validate the supplied password against each of the usernames in the \fIusername\fR line in turn\&. This is slow and a bad idea for lots of users in case of duplicate passwords\&. You may get timeouts or security breaches using this parameter unwisely\&. - - -Samba relies on the underlying UNIX security\&. This parameter does not restrict who can login, it just offers hints to the Samba server as to what usernames might correspond to the supplied password\&. Users can login as whoever they please and they will be able to do no more damage than if they started a telnet session\&. The daemon runs as the user that they log in as, so they cannot do anything that user cannot do\&. - - -To restrict a service to a particular set of users you can use the \fIvalid users \fR parameter\&. - - -If any of the usernames begin with a '@' then the name will be looked up first in the NIS netgroups list (if Samba is compiled with netgroup support), followed by a lookup in the UNIX groups database and will expand to a list of all users in the group of that name\&. - - -If any of the usernames begin with a '+' then the name will be looked up only in the UNIX groups database and will expand to a list of all users in the group of that name\&. - - -If any of the usernames begin with a '&' then the name will be looked up only in the NIS netgroups database (if Samba is compiled with netgroup support) and will expand to a list of all users in the netgroup group of that name\&. - - -Note that searching though a groups database can take quite some time, and some clients may time out during the search\&. - - -See the section NOTE ABOUT USERNAME/PASSWORD VALIDATION for more information on how this parameter determines access to the services\&. +users (S) +Synonym for \fI username\fR\&. -Default: \fBThe guest account if a guest service, else .\fR +.TP +use sendfile (S) +If this parameter is \fByes\fR, and Samba was built with the --with-sendfile-support option, and the underlying operating system supports sendfile system call, then some SMB read calls (mainly ReadAndX and ReadRaw) will use the more efficient sendfile system call for files that are exclusively oplocked\&. This may make more efficient use of the system CPU's and cause Samba to be faster\&. This is off by default as it's effects are unknown as yet\&. -Examples:\fBusername = fred, mary, jack, jane, @users, @pcgroup\fR +Default: \fBuse sendfile = no\fR .TP -users (S) -Synonym for \fI username\fR\&. +use spnego (G) +This variable controls controls whether samba will try to use Simple and Protected NEGOciation (as specified by rfc2478) with WindowsXP and Windows2000 clients to agree upon an authentication mechanism\&. Unless further issues are discovered with our SPNEGO implementation, there is no reason this should ever be disabled\&. -.TP -user (S) -Synonym for \fIusername\fR\&. +Default: \fBuse spnego = yes\fR .TP -use sendfile (S) -If this parameter is \fByes\fR, and Samba was built with the --with-sendfile-support option, and the underlying operating system supports sendfile system call, then some SMB read calls (mainly ReadAndX and ReadRaw) will use the more efficient sendfile system call for files that are exclusively oplocked\&. This may make more efficient use of the system CPU's and cause Samba to be faster\&. This is off by default as it's effects are unknown as yet\&. +utmp (G) +This boolean parameter is only available if Samba has been configured and compiled with the option \fB --with-utmp\fR\&. If set to \fByes\fR then Samba will attempt to add utmp or utmpx records (depending on the UNIX system) whenever a connection is made to a Samba server\&. Sites may use this to record the user connecting to a Samba share\&. -Default: \fBuse sendfile = no\fR +Due to the requirements of the utmp record, we are required to create a unique identifier for the incoming user\&. Enabling this option creates an n^2 algorithm to find this number\&. This may impede performance on large installations\&. -.TP -use spnego (G) -This variable controls controls whether samba will try to use Simple and Protected NEGOciation (as specified by rfc2478) with WindowsXP and Windows2000sp2 clients to agree upon an authentication mechanism\&. Unless further issues are discovered with our SPNEGO implementation, there is no reason this should ever be disabled\&. +See also the \fI utmp directory\fR parameter\&. -Default: \fBuse spnego = yes\fR +Default: \fButmp = no\fR .TP @@ -6118,17 +6218,14 @@ Example: \fButmp directory = /var/run/utmp\fR .TP -utmp (G) -This boolean parameter is only available if Samba has been configured and compiled with the option \fB --with-utmp\fR\&. If set to \fByes\fR then Samba will attempt to add utmp or utmpx records (depending on the UNIX system) whenever a connection is made to a Samba server\&. Sites may use this to record the user connecting to a Samba share\&. +-valid (S) +This parameter indicates whether a share is valid and thus can be used\&. When this parameter is set to false, the share will be in no way visible nor accessible\&. -Due to the requirements of the utmp record, we are required to create a unique identifier for the incoming user\&. Enabling this option creates an n^2 algorithm to find this number\&. This may impede performance on large installations\&. +This option should not be used by regular users but might be of help to developers\&. Samba uses this option internally to mark shares as deleted\&. -See also the \fI utmp directory\fR parameter\&. - - -Default: \fButmp = no\fR +Default: \fBTrue\fR .TP @@ -6204,29 +6301,18 @@ Example: \fBveto oplock files = /*.SEM/\fR .TP vfs object (S) -This parameter specifies a shared object files that are used for Samba VFS I/O operations\&. By default, normal disk I/O operations are used but these can be overloaded with one or more VFS objects\&. - - -Default: \fBno value\fR +Synonym for \fIvfs objects\fR \&. .TP -vfs options (S) -This parameter allows parameters to be passed to the vfs layer at initialization time\&. See also \fI vfs object\fR\&. +vfs objects (S) +This parameter specifies the backend names which are used for Samba VFS I/O operations\&. By default, normal disk I/O operations are used but these can be overloaded with one or more VFS objects\&. Default: \fBno value\fR -.TP -vfs path (S) -This parameter specifies the directory to look in for vfs modules\&. The name of every \fBvfs object \fR will be prepended by this directory\&. - - -Default: \fBvfs path = \fR - - -Example: \fBvfs path = /usr/lib/samba/vfs\fR +Example: \fBvfs objects = extd_audit recycle\fR .TP @@ -6280,6 +6366,9 @@ Default: \fBwinbind enum users = yes \fR .TP winbind gid (G) +This parameter is now an alias for \fBidmap gid\fR + + The winbind gid parameter specifies the range of group ids that are allocated by the \fBwinbindd\fR(8) daemon\&. This range of group ids should have no existing local or NIS groups within it as strange conflicts can occur otherwise\&. @@ -6305,7 +6394,10 @@ Example: \fBwinbind separator = +\fR .TP winbind uid (G) -The winbind gid parameter specifies the range of group ids that are allocated by the \fBwinbindd\fR(8) daemon\&. This range of ids should have no existing local or NIS users within it as strange conflicts can occur otherwise\&. +This parameter is now an alias for \fBidmap uid\fR + + +The winbind gid parameter specifies the range of user ids that are allocated by the \fBwinbindd\fR(8) daemon\&. This range of ids should have no existing local or NIS users within it as strange conflicts can occur otherwise\&. Default: \fBwinbind uid = \fR diff --git a/docs/manpages/smbmount.8 b/docs/manpages/smbmount.8 index ccb776e7f1..fdf49c0e97 100644 --- a/docs/manpages/smbmount.8 +++ b/docs/manpages/smbmount.8 @@ -37,8 +37,13 @@ Options to \fBsmbmount\fR are specified as a comma-separated list of key=value p .PP \fBsmbmount\fR is a daemon\&. After mounting it keeps running until the mounted smbfs is umounted\&. It will log things that happen when in daemon mode using the "machine name" smbmount, so typically this output will end up in \fIlog\&.smbmount\fR\&. The \fB smbmount\fR process may also be called mount\&.smbfs\&. +.RS +.Sh "Note" + .PP -\fBNOTE:\fR \fBsmbmount\fR calls \fBsmbmnt\fR(8) to do the actual mount\&. You must make sure that \fBsmbmnt\fR is in the path so that it can be found\&. + \fBsmbmount\fR calls \fBsmbmnt\fR(8) to do the actual mount\&. You must make sure that \fBsmbmnt\fR is in the path so that it can be found\&. + +.RE .SH "OPTIONS" @@ -96,12 +101,12 @@ sets the remote SMB port number\&. The default is 139\&. .TP fmask= -sets the file mask\&. This determines the permissions that remote files have in the local filesystem\&. The default is based on the current umask\&. +sets the file mask\&. This determines the permissions that remote files have in the local filesystem\&. This is not a umask, but the actual permissions for the files\&. The default is based on the current umask\&. .TP dmask= -Sets the directory mask\&. This determines the permissions that remote directories have in the local filesystem\&. The default is based on the current umask\&. +Sets the directory mask\&. This determines the permissions that remote directories have in the local filesystem\&. This is not a umask, but the actual permissions for the directories\&. The default is based on the current umask\&. .TP diff --git a/docs/manpages/wbinfo.1 b/docs/manpages/wbinfo.1 index 0481489078..9bbecb29a4 100644 --- a/docs/manpages/wbinfo.1 +++ b/docs/manpages/wbinfo.1 @@ -25,7 +25,7 @@ wbinfo \- Query information from winbind daemon .nf \fBwbinfo\fR [-u] [-g] [-N netbios-name] [-I ip] [-n name] [-s sid] [-U uid] [-G gid] [-S sid] [-Y sid] [-t] [-m] [--sequence] [-r user] [-a user%password] - [-A user%password] [--get-auth-user] [-p] + [--set-auth-user user%password] [--get-auth-user] [-p] .fi .SH "DESCRIPTION" @@ -117,7 +117,7 @@ Attempt to authenticate a user via winbindd\&. This checks both authenticaion me .TP --A username%password +--set-auth-user username%password Store username and password used by winbindd during session setup to a domain controller\&. This enables winbindd to operate in a Windows 2000 domain with Restrict Anonymous turned on (a\&.k\&.a\&. Permissions compatiable with Windows 2000 servers only)\&. diff --git a/examples/LDAP/README b/examples/LDAP/README index 98d88c091b..c7ff16ad08 100644 --- a/examples/LDAP/README +++ b/examples/LDAP/README @@ -4,28 +4,11 @@ !== written by Gerald Carter !== -This is a quick and dirty means of storing smbpasswd entries -in LDAP. Samba 2.2.x (x >=4) and 3.0 can both store this information -directly in LDAP, and the schema has *changed*. As such these scripts will -need modification prior to use. - -Be aware of search limits on your client or server which prevent -all entries from being returned in the search result. +This is a quick and dirty means of converting smbpasswd entries +to sambaAccount entriues in an LDAP directory. Pre-requisites for import_smbpasswd.pl & export_smbpasswd.pl ------------------------------------------------------------- -You must install Mozilla PerLDAP which is available at: - - http://www.mozilla.org/directory - -PerLDAP depends on the Netscape (aka iPlanet) C-SDK which is -available for download at: - - http:// www.iplanet.com/downloads/developer/ - - -Pre-requisites for import2_smbpasswd.pl & export2_smbpasswd.pl -------------------------------------------------------------- These two scripts are modified versions of [import|export]_smbpasswd.pl rewritten to use the Net::LDAP @@ -35,6 +18,7 @@ perl module available from + OpenLDAP 2.0.x -------------- @@ -67,7 +51,7 @@ You must restart the LDAP server for these new included schema files to become active. -import[2]_smbpasswd.pl +import_smbpasswd.pl ---------------------- Make sure you customize the local site variable in the perl script @@ -79,17 +63,17 @@ refer to RFC2307 and http://www.padl.com/software.html). The following will import an smbpasswd file into an LDAP directory - $ cat smbpasswd | import[2]_smbpasswd.pl + $ cat smbpasswd | import_smbpasswd.pl -export[2]_smbpasswd.pl +export_smbpasswd.pl ---------------------- Make sure you customize the local site variable in the perl script (i.e. ldapserver, rootdn, rootpw, etc...). You can then generate an smbpasswd file by executing - $ export[2]_smbpasswd.pl > smbpasswd + $ export_smbpasswd.pl > smbpasswd NOTE: Server side (or client side) search limites may prevent all users from being listed. Check you directory server documentation diff --git a/examples/LDAP/convertSambaAccount b/examples/LDAP/convertSambaAccount index f5b49ff095..223c43eada 100755 --- a/examples/LDAP/convertSambaAccount +++ b/examples/LDAP/convertSambaAccount @@ -15,8 +15,8 @@ use Net::LDAP::LDIF; my ( $domain, $domsid ); my ( $ldif, $ldif2 ); my ( $entry, @objclasses, $obj ); -my ( $is_samba_account ); -my ( %attr_map, $key ); +my ( $is_samba_account, $is_samba_group ); +my ( %attr_map, %group_attr_map, $key ); if ( $#ARGV != 2 ) { print "Usage: convertSambaAccount domain_sid input_ldif output_ldif\n"; @@ -41,6 +41,11 @@ if ( $#ARGV != 2 ) { acctFlags => 'sambaAcctFlags', ); +%group_attr_map = ( + ntSid => 'sambaSID', + ntGroupType => 'sambaGroupType', +); + $domsid = $ARGV[0]; $ldif = Net::LDAP::LDIF->new ($ARGV[1], "r") @@ -65,37 +70,44 @@ while ( !$ldif->eof ) { ## @objclasses = $entry->get_value( "objectClass" ); undef ( $is_samba_account ); + undef ( $is_samba_group ); foreach $obj ( @objclasses ) { if ( "$obj" eq "sambaAccount" ) { $is_samba_account = 1; + } elsif ( "$obj" eq "sambaGroupMapping" ) { + $is_samba_group = 1; } } - if ( !defined ( $is_samba_account ) ) { - $ldif2->write_entry( $entry ); - next; - } - - ## - ## start editing the sambaAccount - ## + if ( defined ( $is_samba_account ) ) { + ## + ## start editing the sambaAccount + ## - $entry->delete( 'objectclass' => [ 'sambaAccount' ] ); - $entry->add( 'objectclass' => 'sambaSamAccount' ); + $entry->delete( 'objectclass' => [ 'sambaAccount' ] ); + $entry->add( 'objectclass' => 'sambaSamAccount' ); - $entry->add( 'sambaSID' => $domsid."-".$entry->get_value( "rid" ) ); - $entry->delete( 'rid' ); + $entry->add( 'sambaSID' => $domsid."-".$entry->get_value( "rid" ) ); + $entry->delete( 'rid' ); - if ( $entry->get_value( "primaryGroupID" ) ) { - $entry->add( 'sambaPrimaryGroupSID' => $domsid."-".$entry->get_value( "primaryGroupID" ) ); - $entry->delete( 'primaryGroupID' ); - } + if ( $entry->get_value( "primaryGroupID" ) ) { + $entry->add( 'sambaPrimaryGroupSID' => $domsid."-".$entry->get_value( "primaryGroupID" ) ); + $entry->delete( 'primaryGroupID' ); + } - foreach $key ( keys %attr_map ) { - if ( $entry->get_value($key) ) { - $entry->add( $attr_map{$key} => $entry->get_value($key) ); - $entry->delete( $key ); + foreach $key ( keys %attr_map ) { + if ( defined($entry->get_value($key)) ) { + $entry->add( $attr_map{$key} => $entry->get_value($key) ); + $entry->delete( $key ); + } + } + } elsif ( defined ( $is_samba_group ) ) { + foreach $key ( keys %group_attr_map ) { + if ( defined($entry->get_value($key)) ) { + $entry->add( $group_attr_map{$key} => $entry->get_value($key) ); + $entry->delete( $key ); + } } } diff --git a/examples/LDAP/export2_smbpasswd.pl b/examples/LDAP/export2_smbpasswd.pl deleted file mode 100644 index 90f5805e55..0000000000 --- a/examples/LDAP/export2_smbpasswd.pl +++ /dev/null @@ -1,64 +0,0 @@ -#!/usr/bin/perl -## -## Example script to export ldap entries into an smbpasswd file format -## using the Mozilla PerLDAP module. -## -## writen by jerry@samba.org -## -## ported to Net::LDAP by dkrovich@slackworks.com - -use Net::LDAP; - -###################################################### -## Set these values to whatever you need for your site -## - -$DN="dc=samba,dc=my-domain,dc=com"; -$ROOTDN="cn=Manager,dc=my-domain,dc=com"; -$rootpw = "secret"; -$LDAPSERVER="localhost"; - -## -## end local site variables -###################################################### - -$ldap = Net::LDAP->new($LDAPSERVER) or die "Unable to connect to LDAP server $LDAPSERVER"; - -print "##\n"; -print "## Autogenerated smbpasswd file via ldapsearch\n"; -print "## from $LDAPSERVER ($DN)\n"; -print "##\n"; - -## scheck for the existence of the posixAccount first -$result = $ldap->search ( base => "$DN", - scope => "sub", - filter => "(objectclass=smbpasswordentry)" - ); - - - -## loop over the entries we found -while ( $entry = $result->shift_entry() ) { - - @uid = $entry->get_value("uid"); - @uidNumber = $entry->get_value("uidNumber"); - @lm_pw = $entry->get_value("lmpassword"); - @nt_pw = $entry->get_value("ntpassword"); - @acct = $entry->get_value("acctFlags"); - @pwdLastSet = $entry->get_value("pwdLastSet"); - - if (($#uid+1) && ($#uidNumber+1)) { - - $lm_pw[0] = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" if (! ($#lm_pw+1)); - $nt_pw[0] = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" if (! ($#nt_pw+1)); - $acct[0] = "[DU ]" if (! ($#acct+1)); - $pwdLastSet[0] = "FFFFFFFF" if (! ($#pwdLastSet+1)); - - print "$uid[0]:$uidNumber[0]:$lm_pw[0]:$nt_pw[0]:$acct[0]:LCT-$pwdLastSet[0]\n"; - } - -} - -$ldap->unbind(); -exit 0; - diff --git a/examples/LDAP/import2_smbpasswd.pl b/examples/LDAP/import2_smbpasswd.pl deleted file mode 100644 index bf643391a7..0000000000 --- a/examples/LDAP/import2_smbpasswd.pl +++ /dev/null @@ -1,108 +0,0 @@ -#!/usr/bin/perl -## -## Example script of how you could import a smbpasswd file into an LDAP -## directory using the Mozilla PerLDAP module. -## -## writen by jerry@samba.org -## -## ported to Net::LDAP by dkrovich@slackworks.com - -use Net::LDAP; - -################################################# -## set these to a value appropriate for your site -## - -$DN="dc=samba,dc=my-domain,dc=com"; -$ROOTDN="cn=Manager,dc=my-domain,dc=com"; -$rootpw = "secret"; -$LDAPSERVER="localhost"; - -## -## end local site variables -################################################# - -$ldap = Net::LDAP->new($LDAPSERVER) or die "Unable to connect to LDAP server $LDAPSERVER"; - -## Bind as $ROOTDN so you can do updates -$mesg = $ldap->bind($ROOTDN, password => $rootpw); - -while ( $string = ) { - chop ($string); - - ## Get the account info from the smbpasswd file - @smbentry = split (/:/, $string); - - ## Check for the existence of a system account - @getpwinfo = getpwnam($smbentry[0]); - if (! @getpwinfo ) { - print STDERR "$smbentry[0] does not have a system account... skipping\n"; - next; - } - - ## check and see if account info already exists in LDAP. - $result = $ldap->search ( base => "$DN", - scope => "sub", - filter => "(&(|(objectclass=posixAccount)(objectclass=smbPasswordEntry))(uid=$smbentry[0]))" - ); - - ## If no LDAP entry exists, create one. - if ( $result->count == 0 ) { - $entry = $ldap->add ( dn => "uid=$smbentry[0]\,$DN", - attrs => [ - uid => $smbentry[0], - uidNumber => @getpwinfo[2], - lmPassword => $smbentry[2], - ntPassword => $smbentry[3], - acctFlags => $smbentry[4], - pwdLastSet => substr($smbentry[5],4), - objectclass => [ 'top', 'smbPasswordEntry' ] - ] - ); - print "Adding [uid=" . $smbentry[0] . "," . $DN . "]\n"; - - ## Otherwise, supplement/update the existing entry. - } elsif ($result->count == 1) { - # Put the search results into an entry object - $entry = $result->shift_entry; - - print "Updating [" . $entry->dn . "]\n"; - - ## Add the objectclass: smbPasswordEntry attribute if it's not there - @values = $entry->get_value( "objectclass" ); - $flag = 1; - foreach $item (@values) { - if ( lc($item) eq "smbpasswordentry" ) { - print $item . "\n"; - $flag = 0; - } - } - if ( $flag ) { - $entry->add(objectclass => "smbPasswordEntry"); - } - - ## Set the other attribute values - $entry->replace(lmPassword => $smbentry[2], - ntPassword => $smbentry[3], - acctFlags => $smbentry[4], - pwdLastSet => substr($smbentry[5],4) - ); - - ## Apply changes to the LDAP server - $updatemesg = $entry->update($ldap); - if ( $updatemesg->code ) { - print "Error updating $smbentry[0]!\n"; - } - - ## If we get here, the LDAP search returned more than one value - ## which shouldn't happen under normal circumstances. - } else { - print STDERR "LDAP search returned more than one entry for $smbentry[0]... skipping!\n"; - next; - } -} - -$ldap->unbind(); -exit 0; - - diff --git a/examples/LDAP/samba.schema b/examples/LDAP/samba.schema index 3db7094bf2..6e8387f16e 100644 --- a/examples/LDAP/samba.schema +++ b/examples/LDAP/samba.schema @@ -132,7 +132,7 @@ # description $ userWorkstations $ primaryGroupID $ domain )) #objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILIARY -# DESC 'Samba Auxilary Account' +# DESC 'Samba Auxiliary Account' # MUST ( uid $ rid ) # MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $ # logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $ @@ -276,6 +276,16 @@ attributetype ( 1.3.6.1.4.1.7165.2.1.22 NAME 'sambaNextGroupRid' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) +attributetype ( 1.3.6.1.4.1.7165.2.1.39 NAME 'sambaNextRid' + DESC 'Next NT rid to give out for anything' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +attributetype ( 1.3.6.1.4.1.7165.2.1.40 NAME 'sambaAlgorithmicRidBase' + DESC 'Base at which the samba RID generation algorithm should operate' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + ####################################################################### ## objectClasses used by Samba 3.0 schema ## @@ -312,6 +322,23 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' SUP top AUXILIARY ## objectclass ( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' SUP top STRUCTURAL DESC 'Samba Domain Information' - MUST ( sambaDomainName $ sambaNextGroupRid $ sambaNextUserRid $ - sambaSID ) ) + MUST ( sambaDomainName $ + sambaSID ) + MAY ( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ + sambaAlgorithmicRidBase ) ) + +## used for idmap_ldap module +objectclass ( 1.3.6.1.4.1.7165.1.2.2.7 NAME 'sambaUnixIdPool' SUP top AUXILIARY + DESC 'Pool for allocating UNIX uids/gids' + MUST ( uidNumber $ gidNumber ) ) + + +objectclass ( 1.3.6.1.4.1.7165.1.2.2.8 NAME 'sambaIdmapEntry' SUP top AUXILIARY + DESC 'Mapping from a SID to an ID' + MUST ( sambaSID ) + MAY ( uidNumber $ gidNumber ) ) + +objectclass ( 1.3.6.1.4.1.7165.1.2.2.9 NAME 'sambaSidEntry' SUP top STRUCTURAL + DESC 'Structural Class for a SID' + MUST ( sambaSID ) ) diff --git a/examples/VFS/.cvsignore b/examples/VFS/.cvsignore index 92b494f978..f269c98273 100644 --- a/examples/VFS/.cvsignore +++ b/examples/VFS/.cvsignore @@ -1,4 +1,9 @@ .libs *.so *.o +*.bak +autom4te.cache +autom4te-2.53.cache Makefile +configure +config.* diff --git a/examples/VFS/README b/examples/VFS/README index 25254c1ffc..2f6196d117 100644 --- a/examples/VFS/README +++ b/examples/VFS/README @@ -1,12 +1,18 @@ README for Samba Virtual File System (VFS) Example =================================================== -This directory contains a skeleton VFS module. When used, +This directory contains skeleton VFS modules. When used, this module simply passes all requests back to the disk functions (i.e it operates as a passthrough filter). It should be useful as a starting point for developing new VFS modules. +Please look at skel_opaque.c when you want your module to provide +final functions, like a database filesystem. + +Please look at skel_transport.c when you want your module to provide +passthrough functions, like audit modules. + Please read the VFS chapter in the HOWTO collection for general help on the usage of VFS modules. diff --git a/examples/libsmbclient/testsmbc.c b/examples/libsmbclient/testsmbc.c index 9af845a5ea..888a9c0d4f 100644 --- a/examples/libsmbclient/testsmbc.c +++ b/examples/libsmbclient/testsmbc.c @@ -103,7 +103,7 @@ int main(int argc, char *argv[]) } - fprintf(stdout, "Directory handles: %u\n", dh1); + fprintf(stdout, "Directory handles: %u, %u, %u\n", dh1, dh2, dh3); /* Now, list those directories, but in funny ways ... */ diff --git a/examples/smb.conf.default b/examples/smb.conf.default index 89847c58f9..0603623c28 100644 --- a/examples/smb.conf.default +++ b/examples/smb.conf.default @@ -12,7 +12,7 @@ # may wish to enable # # NOTE: Whenever you modify this file you should run the command "testparm" -# to check that you have not many any basic syntactic errors. +# to check that you have not made any basic syntactic errors. # #======================= Global Settings ===================================== [global] diff --git a/packaging/Debian/README b/packaging/Debian/README index 7de9ba625c..0a1d68ba37 100644 --- a/packaging/Debian/README +++ b/packaging/Debian/README @@ -4,7 +4,7 @@ Building Samba Packages for Debian GNU/Linux Building Debian packages is not as hard as some people might think. The following instructions will allow you to build your own Samba Debian packages. These instructions, and the files in packaging/Debian/, should -be current as of Samba 3.0beta1, and should allow you to build Debian +be current as of Samba 3.0beta3, and should allow you to build Debian packages for Debian unstable. We try to maintain as much compatibility with previous releases @@ -27,19 +27,29 @@ these instructions: to the normal Debian development packages -- dpkg-dev, libc6-dev, devscripts, etc.): + autoconf debhelper libpam0g-dev libreadline4-dev libcupsys2-dev - autoconf + libacl1-dev | acl-dev (>= 2.0.0) + libkrb5-dev + libldap2-dev + po-debconf + python-dev (>= 2.2) - Notes about the packages required to build Samba Debian packages: + Notes regarding the packages required to build Samba Debian packages: * The libcupsys2-dev is not available in Debian Potato (Debian 2.2). - That's fine; the configure script won't detect CUPS support and the - resulting binaries won't support CUPS. + That's fine; the configure script won't detect CUPS support and the + resulting binaries won't support CUPS. -1) cd samba[-]. For example, "cd samba-2.2.5". + * The list above is current as of samba-3.0.0beta3, but it can get + out of date. The best way to check what packages are required to + build the samba packages on Debian is to look for the Build-Depends: + field in the file debian/control. + +1) cd samba[-]. For example, "cd samba-3.0.0beta3". 2) cp -a packaging/Debian/debian/ debian It's important that you copy instead of symlink because the build tools in Potato have a problem that prevents the build to work with @@ -48,9 +58,8 @@ devscripts, etc.): Debian version numbers! Don't complain later if you can't upgrade to official versions of the Samba packages for Debian.) - Edit the changelog and make sure the version is right. For example, - for Samba 2.2.4, the version number should something like 2.2.4-0.1 - (use a number less than 1 like 0.1, 0.2, etc. so there is no conflict - with future upgrades to the official Debian packages.) + for Samba 3.0.0beta3, the version number should something like + 3.0.0beta3-0.1. 4) Run 'debian/rules binary'. - It is better that you prefix the above command with 'fakeroot'. If you have problems you might try building as root. @@ -63,5 +72,3 @@ better things to do and know nothing about the Debian packaging system. Eloy A. Paris Steve Langasek -$Id: README,v 1.3 2003/06/01 07:12:51 peloy Exp $ - diff --git a/packaging/Debian/debian/README.build-upstream b/packaging/Debian/debian/README.build-upstream index 8b6cc68178..0a1d68ba37 100644 --- a/packaging/Debian/debian/README.build-upstream +++ b/packaging/Debian/debian/README.build-upstream @@ -3,10 +3,15 @@ Building Samba Packages for Debian GNU/Linux Building Debian packages is not as hard as some people might think. The following instructions will allow you to build your own Samba Debian -packages. These instructions, and the files in packaging/Debian/, are -current as of Samba 2.2.5, and should allow you to build Debian packages -for Debian Potato (2.2), Debian Woody (3.0), and Debian unstable as of -the date Samba 2.2.5 was released. +packages. These instructions, and the files in packaging/Debian/, should +be current as of Samba 3.0beta3, and should allow you to build Debian +packages for Debian unstable. + +We try to maintain as much compatibility with previous releases +of Debian as possible, so it is possible that the files in +packaging/Debian/ can also be used to build Samba Debian packages for +other Debian releases. However, sometimes this is just not possible +because we need to use stuff that is only available on Debian unstable. Instructions ------------ @@ -22,19 +27,29 @@ these instructions: to the normal Debian development packages -- dpkg-dev, libc6-dev, devscripts, etc.): + autoconf debhelper libpam0g-dev libreadline4-dev libcupsys2-dev - autoconf + libacl1-dev | acl-dev (>= 2.0.0) + libkrb5-dev + libldap2-dev + po-debconf + python-dev (>= 2.2) - Notes about the packages required to build Samba Debian packages: + Notes regarding the packages required to build Samba Debian packages: * The libcupsys2-dev is not available in Debian Potato (Debian 2.2). - That's fine; the configure script won't detect CUPS support and the - resulting binaries won't support CUPS. + That's fine; the configure script won't detect CUPS support and the + resulting binaries won't support CUPS. -1) cd samba[-]. For example, "cd samba-2.2.5". + * The list above is current as of samba-3.0.0beta3, but it can get + out of date. The best way to check what packages are required to + build the samba packages on Debian is to look for the Build-Depends: + field in the file debian/control. + +1) cd samba[-]. For example, "cd samba-3.0.0beta3". 2) cp -a packaging/Debian/debian/ debian It's important that you copy instead of symlink because the build tools in Potato have a problem that prevents the build to work with @@ -43,9 +58,8 @@ devscripts, etc.): Debian version numbers! Don't complain later if you can't upgrade to official versions of the Samba packages for Debian.) - Edit the changelog and make sure the version is right. For example, - for Samba 2.2.4, the version number should something like 2.2.4-0.1 - (use a number less than 1 like 0.1, 0.2, etc. so there is no conflict - with future upgrades to the official Debian packages.) + for Samba 3.0.0beta3, the version number should something like + 3.0.0beta3-0.1. 4) Run 'debian/rules binary'. - It is better that you prefix the above command with 'fakeroot'. If you have problems you might try building as root. @@ -58,5 +72,3 @@ better things to do and know nothing about the Debian packaging system. Eloy A. Paris Steve Langasek -$Id: README.build-upstream,v 1.2 2003/06/01 07:12:51 peloy Exp $ - diff --git a/packaging/Debian/debian/README.debian b/packaging/Debian/debian/README.debian index d73f91a154..3802e329e5 100644 --- a/packaging/Debian/debian/README.debian +++ b/packaging/Debian/debian/README.debian @@ -11,9 +11,9 @@ samba and sambades (merged together for longer than we can remember.) Contents of this README file: 1. Notes -2. Packages Generated from the Samba Sources -3. Support for NT Domains -4. Samba and LDAP +2. Upgrading from Samba 2.2 +3. Packages Generated from the Samba Sources +4. Support for NT Domains 5. Reporting bugs @@ -36,7 +36,45 @@ Contents of this README file: (/var/log/{nmb,smb} were moved to the new location. -2. Packages Generated from the Samba Sources +2. Upgrading from Samba 2.2 +--------------------------- + +Samba 3.0 provides greatly improved support for modern Windows systems, +including support for Unicode and LDAP. In the process, Samba 3.0 +necessarily also breaks backward compatiblity with past releases. These +issues are documented herein; if you are aware of other problems related +to upgrading from Samba 2.2, please let us know at +. + +Samba and LDAP +-------------- +Starting with Samba 2.999+3.0cvs20020723-1 we are building Samba with +LDAP support. However, the LDAP schema for Samba 3.0 differs +substantially from the schema used by many sites with Samba 2.2 (not +enabled in the Debian packages). If upgrading from an LDAP-enabled 2.2, +you will need to run the convertSambaAccount script found in +/usr/share/doc/samba-doc/examples/LDAP. A copy of the schema itself can +also be found at /usr/share/doc/samba-doc/examples/LDAP/samba.schema. + +Character Sets +-------------- +Samba 3.0 introduces support for negotiating Unicode (UCS-2LE) with +Windows clients. Owing to the close similarity between Windows and Unix +NLS charsets, in the past, many users were able to pass filenames +containing non-ASCII characters between clients and servers without +configuring Samba to know what character set was in use. Now, Samba +must be able to convert Unix filenames to Unicode before sending to the +client, so Samba must know what character set the filenames are being +converted from. If you will be sharing files with non-ASCII names, and +the filenames are not encoded with UTF-8, you will need to tell Samba +which character set to use with the 'unix charset' option. + +If you had previously specified 'character set' and 'client code page' +options under 2.2, these settings should be automatically converted for +you. + + +3. Packages Generated from the Samba Sources -------------------------------------------- Currently, the Samba sources produce the following binary packages: @@ -66,7 +104,7 @@ with glibc2.1 get cleared out (the problem is with glibc, not with Samba itself). -3. Support for NT Domains +4. Support for NT Domains ------------------------- Samba 2.2 includes preliminary support for NT domains. A Samba server @@ -86,13 +124,6 @@ Please note that NT domain PDC support is far from complete and is still experimental. -4. Samba and LDAP ------------------ - -Starting with Samba 2.999+3.0cvs20020723-1 we are building Samba with -ldapsam support. - - 5. Reporting Bugs ----------------- @@ -130,4 +161,3 @@ doesn't mean that it doesn't work for others. So again: think _twice_. Eloy A. Paris Steve Langasek -$Id: README.debian,v 1.3 2003/06/01 07:12:51 peloy Exp $ diff --git a/packaging/Debian/debian/changelog b/packaging/Debian/debian/changelog index 28d71269bf..a3d27b56d4 100644 --- a/packaging/Debian/debian/changelog +++ b/packaging/Debian/debian/changelog @@ -1,15 +1,100 @@ -samba (3.0beta1-1) unstable; urgency=low +samba (3.0.0beta3-0.1) unstable; urgency=low * Local build. - -- Debian User Sat, 31 May 2003 22:49:18 -0400 - -samba (2.999+3.0.alpha24-4) unstable; urgency=low + -- Debian User Tue, 15 Jul 2003 11:05:39 -0400 + +samba (3.0.0beta2-2) unstable; urgency=low + + * Drag new unpackaged tools into the packages: smbcquotas (smbclient), + vfs modules (samba), smbtree(1) manpage (smbclient), tdbbackup(8) + manpage (samba). (closes: #151158) + * Switch to DH_COMPAT level 4: + - no explicit conffile listings needed + - the postinst for libsmbclient is now completely autogenerated + - use the default init script handling (with support for + invoke-rc.d) in debhelper, instead of the currently buggy upgrade + path (closes: #185439) + - add support for ${misc:Depends} in control for those packages with + init scripts + + -- Steve Langasek Sat, 12 Jul 2003 19:27:31 -0500 + +samba (3.0.0beta2-1) unstable; urgency=low + + * New upstream release + - The smb.conf(5) manpage documents config options again + (closes: #197963). + - Handling of winbind/idmap has been restructured; domain members + should be able to map domain accounts to local accounts again + (closes: #196815). + - Use the locale charset for 'display charset' by default + (closes: #194406). + - Fix for segfault in smbclient when using the -b option + (closes: #196833). + - Handle an empty 'passdb backend' list gracefully (closes: #193946). + * Don't set 'display charset' anymore on upgrade, since this is now + grabbed from the locale by default -- a much better option. + * Removed time.c.patch which is now in the upstream sources. + * Update FHS patch for two new tdb files (netsamlogon_cache.tdb, + privilege.tdb). + * Remove python-linker.patch, since the Kerberos package has been + fixed to no longer use rpath + * Remove configure.patch: the hppa glibc bug this was added for is + long since fixed, and upstream isn't interested in supporting this + kludge. + * Update references to missing documentation in sample smb.conf file + (closes: #187632). + * Fix handling of krb5 link line, building on a patch from Stefan + Metzmacher . + * Add patch so smbclient's tar support works with popt + (closes: #194921). + + -- Steve Langasek Wed, 2 Jul 2003 20:59:09 -0500 + +samba (3.0.0beta1-2) unstable; urgency=low + + * Update build-deps to libacl1-dev (>= 2.2.11-1), libacl1 (>= 2.2.11-1) + to make sure we get the right shlib dependencies (closes: #193149). + * Update the dhcp config hooks so they're suitable for sourcing (i.e., + don't call "exit") (closes: #196477). + * Bring package into line with current policy by adding support for + the DEB_BUILD_OPTIONS flag, and enabling debugging symbols (-gstabs) + by default + * Make sure libpam-smbpass is a self-contained DSO. + * Fix a typo in samba-common.dhcp that caused us to spuriously rewrite + the server list. + * Fix python install script to ignore -Wl linker flags, as seen in the + output from the latest krb5-config. + * Add LDAP and Unicode information about upgrading from 2.2 to + README.debian. + * Remove dangerous and confusing browse options from the default + smb.conf (closes: #198804). + * Reorder smb.conf options for clearer grouping, and clarify the + comments. + * Add a default [print$] share to the sample smb.conf, and create the + necessary tree under /var/lib/samba/printers. (closes: #168173) + * s/winbind/idmap/ in smb.conf, since the option names have changed. + * Fix the patch for postexec handling, so that we chdir("/") at the + right time. + + -- Steve Langasek Thu, 12 Jun 2003 15:02:00 -0500 + +samba (3.0.0beta1-1) unstable; urgency=low + * New upstream version. + - fix for empty browselist bug (closes: #194553) + - fix for tab completion segfault in smbclient (closes: #194776) + - Samba now works as a domain member again without segfaulting + (closes: #194134, #194394, #194775) + - WinXP machines can join a Samba-controlled domain again + (closes: #195362) * Build-depend on python-dev >= 2.2 instead of on just python-dev (without version). + * Added Vorlon'n patch to source/lib/time.c to fix #194075. + (closes: #194075) - -- Eloy A. Paris Sat, 31 May 2003 18:46:05 -0400 + -- Eloy A. Paris Sun, 8 Jun 2003 22:26:43 -0400 samba (2.999+3.0.alpha24-3) unstable; urgency=low diff --git a/packaging/Debian/debian/control b/packaging/Debian/debian/control index 74f60c3213..ddbf9e8e3a 100644 --- a/packaging/Debian/debian/control +++ b/packaging/Debian/debian/control @@ -3,12 +3,12 @@ Section: net Priority: optional Maintainer: Eloy A. Paris Uploaders: Steve Langasek -Build-Depends: debhelper (>= 4.1.13), libpam0g-dev, libreadline4-dev, libcupsys2-dev, autoconf, libacl1-dev | acl-dev (>= 2.0.0), libkrb5-dev, libldap2-dev, po-debconf, python-dev (>= 2.2) -Standards-Version: 3.1.1 +Build-Depends: debhelper (>= 4.1.13), libpam0g-dev, libreadline4-dev, libcupsys2-dev, autoconf, libacl1-dev (>= 2.2.11-1), libacl1 (>= 2.2.11-1), libkrb5-dev, libldap2-dev, po-debconf, python-dev (>= 2.2) +Standards-Version: 3.5.10 Package: samba Architecture: any -Depends: debconf, samba-common (= ${Source-Version}), netbase, logrotate, ${shlibs:Depends} +Depends: samba-common (= ${Source-Version}), netbase, logrotate, ${shlibs:Depends}, ${misc:Depends} Replaces: samba-common (<= 2.0.5a-2) Suggests: samba-doc Description: a LanManager-like file and printer server for Unix @@ -163,7 +163,7 @@ Package: winbind Section: net Priority: optional Architecture: any -Depends: ${shlibs:Depends} +Depends: ${shlibs:Depends}, ${misc:Depends} Replaces: samba (<= 2.2.3-2) Description: service to resolve user and group information from Windows NT servers This package provides the winbindd daemon, which provides a diff --git a/packaging/Debian/debian/patches/documentation.patch b/packaging/Debian/debian/patches/documentation.patch index 5ced2f0e4b..65f7421ab4 100644 --- a/packaging/Debian/debian/patches/documentation.patch +++ b/packaging/Debian/debian/patches/documentation.patch @@ -17,90 +17,85 @@ diff -uNr samba-2.999+3.0.alpha21.orig/docs/htmldocs/using_samba/ch06_05.html sa domain logons = yes security = user
    -diff -uNr samba-2.999+3.0.alpha21.orig/docs/manpages/swat.8 samba-2.999+3.0.alpha21/docs/manpages/swat.8 ---- samba-2.999+3.0.alpha21.orig/docs/manpages/swat.8 2002-11-26 20:54:13.000000000 -0600 -+++ samba-2.999+3.0.alpha21/docs/manpages/swat.8 2002-12-16 23:15:46.000000000 -0600 -@@ -42,19 +42,26 @@ - server. \fR +--- samba-2.2.2.cvs20020120.orig/swat/README ++++ samba-2.2.2.cvs20020120/swat/README +@@ -1,3 +1,11 @@ ++[Debian-specific Note: you can safely skip the installation notes in ++this document. swat was configured for you when the package was ++installed. For security reasons, swat is not enabled. To enable it, you ++need to edit /etc/inetd.conf, uncomment the swat entry, and reload ++inetd. Please note that the file locations given in this file are not ++correct for the Debian version of swat. The correct file locations are ++given in swat's man page.] ++ + This is a brief description of how to install and use the Samba Web + Administration Tool on your machine. + +--- samba_3_0/docs/manpages/swat.8.orig 2003-06-06 16:16:24.000000000 -0400 ++++ samba_3_0/docs/manpages/swat.8 2003-06-06 16:25:13.000000000 -0400 +@@ -89,6 +89,13 @@ .SH "INSTALLATION" + .PP +\fBDebian-specific Note\fR: all these steps have already been done for +you. However, by default, swat is not enabled. This has been done for +security reasons. To enable swat you need to edit /etc/inetd.conf, +uncomment the swat entry (usually at the end of the file), and then +restart inetd. ++ +.PP - After you compile SWAT you need to run \fBmake install - \fR to install the \fBswat\fR binary --and the various help files and images. A default install would put --these in: -+and the various help files and images. Under \fBDebian\fR, these -+files are in (please note that these locations are different than the -+default location): - .TP 0.2i + Swat is included as binary package with most distributions\&. The package manager in this case takes care of the installation and configuration\&. This section is only for those who have compiled swat from scratch\&. + + .PP +@@ -96,15 +103,15 @@ + + .TP 3 \(bu -/usr/local/samba/bin/swat -+/usr/sbin/* - .TP 0.2i ++/usr/sbin/swat + + .TP \(bu -/usr/local/samba/swat/images/* +/usr/share/samba/swat/images/* - .TP 0.2i + + .TP \(bu -/usr/local/samba/swat/help/* +/usr/share/samba/swat/help/* - .SS "INETD INSTALLATION" - .PP - You need to edit your \fI/etc/inetd.conf -@@ -62,7 +69,7 @@ - to enable SWAT to be launched via \fBinetd\fR. - .PP - In \fI/etc/services\fR you need to --add a line like this: -+add a line like this (not needed for Debian): + + .LP + +@@ -114,7 +121,7 @@ + You need to edit your \fI/etc/inetd\&.conf \fR and \fI/etc/services\fR to enable SWAT to be launched via \fBinetd\fR\&. + .PP - \fBswat 901/tcp\fR +-In \fI/etc/services\fR you need to add a line like this: ++In \fI/etc/services\fR you need to add a line like this (not needed for Debian): + .PP -@@ -76,10 +83,11 @@ - \fBinetd\fR daemon). + \fBswat 901/tcp\fR +@@ -126,10 +133,10 @@ + the choice of port number isn't really important except that it should be less than 1024 and not currently used (using a number above 1024 presents an obscure security hole depending on the implementation details of your\fBinetd\fR daemon)\&. + .PP - In \fI/etc/inetd.conf\fR you should --add a line like this: -+add a line like this (not needed for Debian, the postinst script takes -+care of this): +-In \fI/etc/inetd\&.conf\fR you should add a line like this: ++In \fI/etc/inetd\&.conf\fR you should add a line like this (not needed for Debian since the maintainer scripts do it. You need to uncomment the line, though, because it is added commented out for security reasons): + .PP - \fBswat stream tcp nowait.400 root --/usr/local/samba/bin/swat swat\fR -+/usr/sbin/swat swat\fR +-\fBswat stream tcp nowait.400 root /usr/local/samba/bin/swat swat\fR ++\fBswat stream tcp nowait.400 root /usr/sbin/swat swat\fR + .PP - One you have edited \fI/etc/services\fR - and \fI/etc/inetd.conf\fR you need to send a -@@ -105,11 +113,10 @@ - (e.g., swat) to service port (e.g., 901) and protocol type - (e.g., tcp). + One you have edited \fI/etc/services\fR and \fI/etc/inetd\&.conf\fR you need to send a HUP signal to inetd\&. To do this use \fBkill -1 PID \fR where PID is the process ID of the inetd daemon\&. +@@ -155,8 +162,8 @@ + + .TP --\fB\fI/usr/local/samba/lib/smb.conf\fB\fR -+\fB\fI/etc/samba/smb.conf\fB\fR - This is the default location of the \fIsmb.conf(5) --\fR server configuration file that swat edits. Other --common places that systems install this file are \fI /usr/samba/lib/smb.conf\fR and \fI/etc/smb.conf --\fR. This file describes all the services the server -+\fRserver configuration file that swat edits. -+This file describes all the services the server - is to make available to clients. - .SH "WARNINGS" - .PP ---- samba-2.2.2.cvs20020120.orig/swat/README -+++ samba-2.2.2.cvs20020120/swat/README -@@ -1,3 +1,11 @@ -+[Debian-specific Note: you can safely skip the installation notes in -+this document. swat was configured for you when the package was -+installed. For security reasons, swat is not enabled. To enable it, you -+need to edit /etc/inetd.conf, uncomment the swat entry, and reload -+inetd. Please note that the file locations given in this file are not -+correct for the Debian version of swat. The correct file locations are -+given in swat's man page.] -+ - This is a brief description of how to install and use the Samba Web - Administration Tool on your machine. +-\fI/usr/local/samba/lib/smb\&.conf\fR +-This is the default location of the \fBsmb.conf\fR(5) server configuration file that swat edits\&. Other common places that systems install this file are \fI /usr/samba/lib/smb\&.conf\fR and \fI/etc/smb\&.conf \fR\&. This file describes all the services the server is to make available to clients\&. ++\fI/etc/samba/smb\&.conf\fR ++This is the default location of the \fBsmb.conf\fR(5) server configuration file that swat edits\&. This file describes all the services the server is to make available to clients\&. + + .SH "WARNINGS" diff --git a/packaging/Debian/debian/patches/fhs.patch b/packaging/Debian/debian/patches/fhs.patch index 5972b52434..b5c7c6c676 100644 --- a/packaging/Debian/debian/patches/fhs.patch +++ b/packaging/Debian/debian/patches/fhs.patch @@ -1,7 +1,7 @@ -diff -uNr samba-3.0alpha23.orig/source/Makefile.in samba-3.0alpha23/source/Makefile.in ---- samba-3.0alpha23.orig/source/Makefile.in 2003-03-30 20:28:28.000000000 -0600 -+++ samba-3.0alpha23/source/Makefile.in 2003-04-04 21:04:05.000000000 -0600 -@@ -65,6 +65,7 @@ +diff -uNr samba-3.0.0beta2.orig/source/Makefile.in samba-3.0.0beta2/source/Makefile.in +--- samba-3.0.0beta2.orig/source/Makefile.in 2003-07-02 23:26:46.000000000 -0500 ++++ samba-3.0.0beta2/source/Makefile.in 2003-07-02 23:19:46.000000000 -0500 +@@ -68,6 +68,7 @@ CONFIGDIR = @configdir@ VARDIR = @localstatedir@ MANDIR = @mandir@ @@ -9,7 +9,7 @@ diff -uNr samba-3.0alpha23.orig/source/Makefile.in samba-3.0alpha23/source/Makef # The permissions to give the executables INSTALLPERMS = 0755 -@@ -88,6 +89,13 @@ +@@ -91,6 +92,13 @@ # the directory where lock files go LOCKDIR = @lockdir@ @@ -23,7 +23,7 @@ diff -uNr samba-3.0alpha23.orig/source/Makefile.in samba-3.0alpha23/source/Makef # the directory where pid files go PIDDIR = @piddir@ # man pages language(s) -@@ -113,7 +121,7 @@ +@@ -115,7 +123,7 @@ PATH_FLAGS4 = $(PATH_FLAGS3) -DSWATDIR=\"$(SWATDIR)\" -DLOCKDIR=\"$(LOCKDIR)\" -DPIDDIR=\"$(PIDDIR)\" PATH_FLAGS5 = $(PATH_FLAGS4) -DLIBDIR=\"$(LIBDIR)\" \ -DLOGFILEBASE=\"$(LOGFILEBASE)\" -DSHLIBEXT=\"@SHLIBEXT@\" @@ -32,7 +32,7 @@ diff -uNr samba-3.0alpha23.orig/source/Makefile.in samba-3.0alpha23/source/Makef PATH_FLAGS = $(PATH_FLAGS6) $(PASSWD_FLAGS) # Note that all executable programs now provide for an optional executable suffix. -@@ -1146,7 +1154,7 @@ +@@ -1123,7 +1131,7 @@ @$(SHELL) $(srcdir)/script/installscripts.sh $(INSTALLPERMS) $(DESTDIR)$(BINDIR) $(SCRIPTS) installdat: installdirs @@ -41,9 +41,9 @@ diff -uNr samba-3.0alpha23.orig/source/Makefile.in samba-3.0alpha23/source/Makef installswat: installdirs @$(SHELL) $(srcdir)/script/installswat.sh $(DESTDIR)$(SWATDIR) $(srcdir) -diff -uNr samba-3.0alpha23.orig/source/configure.in samba-3.0alpha23/source/configure.in ---- samba-3.0alpha23.orig/source/configure.in 2003-04-04 21:03:52.000000000 -0600 -+++ samba-3.0alpha23/source/configure.in 2003-04-04 21:04:05.000000000 -0600 +diff -uNr samba-3.0.0beta2.orig/source/configure.in samba-3.0.0beta2/source/configure.in +--- samba-3.0.0beta2.orig/source/configure.in 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/configure.in 2003-07-02 23:19:02.000000000 -0500 @@ -17,18 +17,25 @@ AC_ARG_WITH(fhs, [ --with-fhs Use FHS-compliant paths (default=no)], @@ -83,9 +83,9 @@ diff -uNr samba-3.0alpha23.orig/source/configure.in samba-3.0alpha23/source/conf dnl Unique-to-Samba variables we'll be playing with. AC_SUBST(SHELL) -diff -uNr samba-3.0alpha23.orig/source/dynconfig.c samba-3.0alpha23/source/dynconfig.c ---- samba-3.0alpha23.orig/source/dynconfig.c 2003-02-14 16:34:36.000000000 -0600 -+++ samba-3.0alpha23/source/dynconfig.c 2003-04-04 21:04:05.000000000 -0600 +diff -uNr samba-3.0.0beta2.orig/source/dynconfig.c samba-3.0.0beta2/source/dynconfig.c +--- samba-3.0.0beta2.orig/source/dynconfig.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/dynconfig.c 2003-07-02 23:19:02.000000000 -0500 @@ -53,6 +53,13 @@ pstring dyn_LMHOSTSFILE = LMHOSTSFILE; @@ -128,10 +128,10 @@ diff -uNr samba-3.0alpha23.orig/source/dynconfig.c samba-3.0alpha23/source/dynco + return lp_lockdir(); +#endif +} -diff -uNr samba-3.0alpha23.orig/source/groupdb/mapping.c samba-3.0alpha23/source/groupdb/mapping.c ---- samba-3.0alpha23.orig/source/groupdb/mapping.c 2003-03-30 20:28:28.000000000 -0600 -+++ samba-3.0alpha23/source/groupdb/mapping.c 2003-04-04 21:04:05.000000000 -0600 -@@ -214,7 +214,7 @@ +diff -uNr samba-3.0.0beta2.orig/source/groupdb/mapping.c samba-3.0.0beta2/source/groupdb/mapping.c +--- samba-3.0.0beta2.orig/source/groupdb/mapping.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/groupdb/mapping.c 2003-07-02 23:19:02.000000000 -0500 +@@ -134,7 +134,7 @@ if (tdb && local_pid == sys_getpid()) return True; @@ -140,9 +140,9 @@ diff -uNr samba-3.0alpha23.orig/source/groupdb/mapping.c samba-3.0alpha23/source if (!tdb) { DEBUG(0,("Failed to open group mapping database\n")); return False; -diff -uNr samba-3.0alpha23.orig/source/include/dynconfig.h samba-3.0alpha23/source/include/dynconfig.h ---- samba-3.0alpha23.orig/source/include/dynconfig.h 2003-02-14 16:34:36.000000000 -0600 -+++ samba-3.0alpha23/source/include/dynconfig.h 2003-04-04 21:04:05.000000000 -0600 +diff -uNr samba-3.0.0beta2.orig/source/include/dynconfig.h samba-3.0.0beta2/source/include/dynconfig.h +--- samba-3.0.0beta2.orig/source/include/dynconfig.h 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/include/dynconfig.h 2003-07-02 23:19:02.000000000 -0500 @@ -31,8 +31,12 @@ extern pstring dyn_CONFIGFILE; extern pstring dyn_LOGFILEBASE, dyn_LMHOSTSFILE; @@ -154,11 +154,11 @@ diff -uNr samba-3.0alpha23.orig/source/include/dynconfig.h samba-3.0alpha23/sour extern const pstring dyn_SMB_PASSWD_FILE; extern const pstring dyn_PRIVATE_DIR; + -+char *dyn_STATEDIR(); -+char *dyn_CACHEDIR(); -diff -uNr samba-3.0alpha23.orig/source/intl/lang_tdb.c samba-3.0alpha23/source/intl/lang_tdb.c ---- samba-3.0alpha23.orig/source/intl/lang_tdb.c 2003-01-03 08:41:24.000000000 -0600 -+++ samba-3.0alpha23/source/intl/lang_tdb.c 2003-04-04 21:04:05.000000000 -0600 ++char *dyn_STATEDIR(void); ++char *dyn_CACHEDIR(void); +diff -uNr samba-3.0.0beta2.orig/source/intl/lang_tdb.c samba-3.0.0beta2/source/intl/lang_tdb.c +--- samba-3.0.0beta2.orig/source/intl/lang_tdb.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/intl/lang_tdb.c 2003-07-02 23:19:02.000000000 -0500 @@ -123,7 +123,7 @@ /* if no lang then we don't translate */ if (!lang) return True; @@ -177,9 +177,9 @@ diff -uNr samba-3.0alpha23.orig/source/intl/lang_tdb.c samba-3.0alpha23/source/i tdb = tdb_open_log(path, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0644); if (!tdb) { -diff -uNr samba-3.0alpha23.orig/source/lib/account_pol.c samba-3.0alpha23/source/lib/account_pol.c ---- samba-3.0alpha23.orig/source/lib/account_pol.c 2003-01-03 08:41:24.000000000 -0600 -+++ samba-3.0alpha23/source/lib/account_pol.c 2003-04-04 21:04:06.000000000 -0600 +diff -uNr samba-3.0.0beta2.orig/source/lib/account_pol.c samba-3.0.0beta2/source/lib/account_pol.c +--- samba-3.0.0beta2.orig/source/lib/account_pol.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/lib/account_pol.c 2003-07-02 23:19:02.000000000 -0500 @@ -36,7 +36,7 @@ if (tdb && local_pid == sys_getpid()) @@ -189,10 +189,10 @@ diff -uNr samba-3.0alpha23.orig/source/lib/account_pol.c samba-3.0alpha23/source if (!tdb) { DEBUG(0,("Failed to open account policy database\n")); return False; -diff -uNr samba-3.0alpha23.orig/source/lib/util.c samba-3.0alpha23/source/lib/util.c ---- samba-3.0alpha23.orig/source/lib/util.c 2003-03-30 20:28:28.000000000 -0600 -+++ samba-3.0alpha23/source/lib/util.c 2003-04-04 21:04:06.000000000 -0600 -@@ -2228,6 +2228,61 @@ +diff -uNr samba-3.0.0beta2.orig/source/lib/util.c samba-3.0.0beta2/source/lib/util.c +--- samba-3.0.0beta2.orig/source/lib/util.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/lib/util.c 2003-07-02 23:19:02.000000000 -0500 +@@ -2252,6 +2252,61 @@ } /** @@ -254,9 +254,9 @@ diff -uNr samba-3.0alpha23.orig/source/lib/util.c samba-3.0alpha23/source/lib/ut * @brief Returns the platform specific shared library extension. * * @retval Pointer to a static #fstring containing the extension. -diff -uNr samba-3.0alpha23.orig/source/lib/util_unistr.c samba-3.0alpha23/source/lib/util_unistr.c ---- samba-3.0alpha23.orig/source/lib/util_unistr.c 2003-02-27 09:22:58.000000000 -0600 -+++ samba-3.0alpha23/source/lib/util_unistr.c 2003-04-04 21:04:06.000000000 -0600 +diff -uNr samba-3.0.0beta2.orig/source/lib/util_unistr.c samba-3.0.0beta2/source/lib/util_unistr.c +--- samba-3.0.0beta2.orig/source/lib/util_unistr.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/lib/util_unistr.c 2003-07-02 23:19:02.000000000 -0500 @@ -54,8 +54,8 @@ if (initialised) return; initialised = 1; @@ -277,30 +277,30 @@ diff -uNr samba-3.0alpha23.orig/source/lib/util_unistr.c samba-3.0alpha23/source if (valid_file) { valid_table = valid_file; mapped_file = 1; -diff -uNr samba-3.0alpha23.orig/source/libsmb/netlogon_unigrp.c samba-3.0alpha23/source/libsmb/netlogon_unigrp.c ---- samba-3.0alpha23.orig/source/libsmb/netlogon_unigrp.c 2003-01-02 10:22:58.000000000 -0600 -+++ samba-3.0alpha23/source/libsmb/netlogon_unigrp.c 2003-04-04 21:04:06.000000000 -0600 -@@ -41,7 +41,7 @@ - BOOL uni_group_cache_init(void) +diff -uNr samba-3.0.0beta2.orig/source/libsmb/samlogon_cache.c samba-3.0.0beta2/source/libsmb/samlogon_cache.c +--- samba-3.0.0beta2.orig/source/libsmb/samlogon_cache.c 2003-07-01 09:40:37.000000000 -0500 ++++ samba-3.0.0beta2/source/libsmb/samlogon_cache.c 2003-07-02 23:19:02.000000000 -0500 +@@ -34,7 +34,7 @@ + BOOL netsamlogon_cache_init(void) { - if (!netlogon_unigrp_tdb) { -- netlogon_unigrp_tdb = tdb_open_log(lock_path("netlogon_unigrp.tdb"), 0, -+ netlogon_unigrp_tdb = tdb_open_log(state_path("netlogon_unigrp.tdb"), 0, - TDB_DEFAULT, O_RDWR | O_CREAT, 0644); + if (!netsamlogon_tdb) { +- netsamlogon_tdb = tdb_open_log(lock_path(NETSAMLOGON_TDB), 0, ++ netsamlogon_tdb = tdb_open_log(cache_path(NETSAMLOGON_TDB), 0, + TDB_DEFAULT, O_RDWR | O_CREAT, 0600); } -@@ -119,7 +119,7 @@ - return NULL; - } - if (!netlogon_unigrp_tdb) { -- netlogon_unigrp_tdb = tdb_open_log(lock_path("netlogon_unigrp.tdb"), 0, -+ netlogon_unigrp_tdb = tdb_open_log(state_path("netlogon_unigrp.tdb"), 0, - TDB_DEFAULT, O_RDWR, 0644); - } - if (!netlogon_unigrp_tdb) { -diff -uNr samba-3.0alpha23.orig/source/nmbd/nmbd_serverlistdb.c samba-3.0alpha23/source/nmbd/nmbd_serverlistdb.c ---- samba-3.0alpha23.orig/source/nmbd/nmbd_serverlistdb.c 2002-12-12 09:07:32.000000000 -0600 -+++ samba-3.0alpha23/source/nmbd/nmbd_serverlistdb.c 2003-04-04 21:04:06.000000000 -0600 +@@ -67,7 +67,7 @@ + winbindd_cache.tdb open. Open the tdb if a NULL is passed. */ + + if (!tdb) { +- tdb = tdb_open_log(lock_path("winbindd_cache.tdb"), 5000, ++ tdb = tdb_open_log(cache_path("winbindd_cache.tdb"), 5000, + TDB_DEFAULT, O_RDWR, 0600); + if (!tdb) { + DEBUG(5, ("netsamlogon_clear_cached_user: failed to open cache\n")); +diff -uNr samba-3.0.0beta2.orig/source/nmbd/nmbd_serverlistdb.c samba-3.0.0beta2/source/nmbd/nmbd_serverlistdb.c +--- samba-3.0.0beta2.orig/source/nmbd/nmbd_serverlistdb.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/nmbd/nmbd_serverlistdb.c 2003-07-02 23:19:02.000000000 -0500 @@ -343,7 +343,7 @@ updatecount++; @@ -310,21 +310,54 @@ diff -uNr samba-3.0alpha23.orig/source/nmbd/nmbd_serverlistdb.c samba-3.0alpha23 trim_string(fname,NULL,"/"); pstrcat(fname,"/"); pstrcat(fname,SERVER_LIST); -diff -uNr samba-3.0alpha23.orig/source/nsswitch/winbindd_cache.c samba-3.0alpha23/source/nsswitch/winbindd_cache.c ---- samba-3.0alpha23.orig/source/nsswitch/winbindd_cache.c 2002-10-16 12:52:31.000000000 -0500 -+++ samba-3.0alpha23/source/nsswitch/winbindd_cache.c 2003-04-04 21:04:06.000000000 -0600 -@@ -53,7 +53,7 @@ - } - if (opt_nocache) return; +diff -uNr samba-3.0.0beta2.orig/source/nmbd/nmbd_winsserver.c samba-3.0.0beta2/source/nmbd/nmbd_winsserver.c +--- samba-3.0.0beta2.orig/source/nmbd/nmbd_winsserver.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/nmbd/nmbd_winsserver.c 2003-07-02 23:19:02.000000000 -0500 +@@ -230,7 +230,7 @@ + + add_samba_names_to_subnet(wins_server_subnet); + +- if((fp = x_fopen(lock_path(WINS_LIST),O_RDONLY,0)) == NULL) ++ if((fp = x_fopen(state_path(WINS_LIST),O_RDONLY,0)) == NULL) + { + DEBUG(2,("initialise_wins: Can't open wins database file %s. Error was %s\n", + WINS_LIST, strerror(errno) )); +@@ -1836,7 +1836,7 @@ + } + } + +- slprintf(fname,sizeof(fname)-1,"%s/%s", lp_lockdir(), WINS_LIST); ++ slprintf(fname,sizeof(fname)-1,"%s/%s", dyn_STATEDIR(), WINS_LIST); + all_string_sub(fname,"//", "/", 0); + slprintf(fnamenew,sizeof(fnamenew)-1,"%s.%u", fname, (unsigned int)sys_getpid()); + +diff -uNr samba-3.0.0beta2.orig/source/nsswitch/winbindd_cache.c samba-3.0.0beta2/source/nsswitch/winbindd_cache.c +--- samba-3.0.0beta2.orig/source/nsswitch/winbindd_cache.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/nsswitch/winbindd_cache.c 2003-07-02 23:19:02.000000000 -0500 +@@ -56,7 +56,7 @@ + if (opt_nocache) + return; - wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"), 5000, + wcache->tdb = tdb_open_log(cache_path("winbindd_cache.tdb"), 5000, TDB_CLEAR_IF_FIRST, O_RDWR|O_CREAT, 0600); if (!wcache->tdb) { -diff -uNr samba-3.0alpha23.orig/source/param/loadparm.c samba-3.0alpha23/source/param/loadparm.c ---- samba-3.0alpha23.orig/source/param/loadparm.c 2003-03-30 20:28:29.000000000 -0600 -+++ samba-3.0alpha23/source/param/loadparm.c 2003-04-04 21:04:06.000000000 -0600 +diff -uNr samba-3.0.0beta2.orig/source/nsswitch/winbindd_util.c samba-3.0.0beta2/source/nsswitch/winbindd_util.c +--- samba-3.0.0beta2.orig/source/nsswitch/winbindd_util.c 2003-07-01 15:44:25.000000000 -0500 ++++ samba-3.0.0beta2/source/nsswitch/winbindd_util.c 2003-07-02 23:19:02.000000000 -0500 +@@ -747,7 +747,7 @@ + SMB_STRUCT_STAT stbuf; + TDB_CONTEXT *idmap_tdb; + +- pstrcpy(idmap_name, lock_path("winbindd_idmap.tdb")); ++ pstrcpy(idmap_name, state_path("winbindd_idmap.tdb")); + + if (!file_exist(idmap_name, &stbuf)) { + /* nothing to convert return */ +diff -uNr samba-3.0.0beta2.orig/source/param/loadparm.c samba-3.0.0beta2/source/param/loadparm.c +--- samba-3.0.0beta2.orig/source/param/loadparm.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/param/loadparm.c 2003-07-02 23:19:02.000000000 -0500 @@ -104,6 +104,9 @@ char *szAddPrinterCommand; char *szDeletePrinterCommand; @@ -335,7 +368,7 @@ diff -uNr samba-3.0alpha23.orig/source/param/loadparm.c samba-3.0alpha23/source/ char *szLockDir; char *szPidDir; char *szRootdir; -@@ -1053,8 +1056,13 @@ +@@ -1055,8 +1058,13 @@ {"config file", P_STRING, P_GLOBAL, &Globals.szConfigFile, NULL, NULL, FLAG_HIDE}, {"preload", P_STRING, P_GLOBAL, &Globals.szAutoServices, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"auto services", P_STRING, P_GLOBAL, &Globals.szAutoServices, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, @@ -349,9 +382,36 @@ diff -uNr samba-3.0alpha23.orig/source/param/loadparm.c samba-3.0alpha23/source/ {"pid directory", P_STRING, P_GLOBAL, &Globals.szPidDir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, #ifdef WITH_UTMP {"utmp directory", P_STRING, P_GLOBAL, &Globals.szUtmpDir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, -diff -uNr samba-3.0alpha23.orig/source/passdb/secrets.c samba-3.0alpha23/source/passdb/secrets.c ---- samba-3.0alpha23.orig/source/passdb/secrets.c 2003-03-30 20:28:29.000000000 -0600 -+++ samba-3.0alpha23/source/passdb/secrets.c 2003-04-04 21:04:06.000000000 -0600 +diff -uNr samba-3.0.0beta2.orig/source/passdb/pdb_tdb.c samba-3.0.0beta2/source/passdb/pdb_tdb.c +--- samba-3.0.0beta2.orig/source/passdb/pdb_tdb.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/passdb/pdb_tdb.c 2003-07-02 23:19:02.000000000 -0500 +@@ -526,10 +526,7 @@ + if (location) { + tdb_state->tdbsam_location = talloc_strdup(pdb_context->mem_ctx, location); + } else { +- pstring tdbfile; +- get_private_directory(tdbfile); +- pstrcat(tdbfile, "/"); +- pstrcat(tdbfile, PASSDB_FILE_NAME); ++ char *tdbfile = state_path(PASSDB_FILE_NAME); + tdb_state->tdbsam_location = talloc_strdup(pdb_context->mem_ctx, tdbfile); + } + +diff -uNr samba-3.0.0beta2.orig/source/passdb/privileges.c samba-3.0.0beta2/source/passdb/privileges.c +--- samba-3.0.0beta2.orig/source/passdb/privileges.c 2003-06-07 12:57:35.000000000 -0500 ++++ samba-3.0.0beta2/source/passdb/privileges.c 2003-07-02 23:19:02.000000000 -0500 +@@ -62,7 +62,7 @@ + /* initialise the privilege database */ + BOOL privilege_init(void) + { +- tdb = tdb_open_log(lock_path("privilege.tdb"), 0, TDB_DEFAULT, ++ tdb = tdb_open_log(state_path("privilege.tdb"), 0, TDB_DEFAULT, + O_RDWR|O_CREAT, 0600); + if (!tdb) { + DEBUG(0,("Failed to open privilege database\n")); +diff -uNr samba-3.0.0beta2.orig/source/passdb/secrets.c samba-3.0.0beta2/source/passdb/secrets.c +--- samba-3.0.0beta2.orig/source/passdb/secrets.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/passdb/secrets.c 2003-07-02 23:19:02.000000000 -0500 @@ -37,8 +37,7 @@ if (tdb) return True; @@ -362,10 +422,10 @@ diff -uNr samba-3.0alpha23.orig/source/passdb/secrets.c samba-3.0alpha23/source/ tdb = tdb_open_log(fname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600); -diff -uNr samba-3.0alpha23.orig/source/printing/nt_printing.c samba-3.0alpha23/source/printing/nt_printing.c ---- samba-3.0alpha23.orig/source/printing/nt_printing.c 2003-03-30 20:28:29.000000000 -0600 -+++ samba-3.0alpha23/source/printing/nt_printing.c 2003-04-04 21:04:07.000000000 -0600 -@@ -271,28 +271,28 @@ +diff -uNr samba-3.0.0beta2.orig/source/printing/nt_printing.c samba-3.0.0beta2/source/printing/nt_printing.c +--- samba-3.0.0beta2.orig/source/printing/nt_printing.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/printing/nt_printing.c 2003-07-02 23:19:02.000000000 -0500 +@@ -287,28 +287,28 @@ if (tdb_drivers) tdb_close(tdb_drivers); @@ -400,9 +460,9 @@ diff -uNr samba-3.0alpha23.orig/source/printing/nt_printing.c samba-3.0alpha23/s return False; } -diff -uNr samba-3.0alpha23.orig/source/printing/printing.c samba-3.0alpha23/source/printing/printing.c ---- samba-3.0alpha23.orig/source/printing/printing.c 2003-03-30 20:28:29.000000000 -0600 -+++ samba-3.0alpha23/source/printing/printing.c 2003-04-04 21:04:08.000000000 -0600 +diff -uNr samba-3.0.0beta2.orig/source/printing/printing.c samba-3.0.0beta2/source/printing/printing.c +--- samba-3.0.0beta2.orig/source/printing/printing.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/printing/printing.c 2003-07-02 23:19:02.000000000 -0500 @@ -174,8 +174,8 @@ if (local_pid == sys_getpid()) return True; @@ -414,9 +474,9 @@ diff -uNr samba-3.0alpha23.orig/source/printing/printing.c samba-3.0alpha23/sour mkdir(printing_path,0755); local_pid = sys_getpid(); -diff -uNr samba-3.0alpha23.orig/source/printing/printing_db.c samba-3.0alpha23/source/printing/printing_db.c ---- samba-3.0alpha23.orig/source/printing/printing_db.c 2003-02-14 16:34:37.000000000 -0600 -+++ samba-3.0alpha23/source/printing/printing_db.c 2003-04-04 21:04:08.000000000 -0600 +diff -uNr samba-3.0.0beta2.orig/source/printing/printing_db.c samba-3.0.0beta2/source/printing/printing_db.c +--- samba-3.0.0beta2.orig/source/printing/printing_db.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/printing/printing_db.c 2003-07-02 23:19:02.000000000 -0500 @@ -86,7 +86,7 @@ DLIST_ADD(print_db_head, p); } @@ -426,9 +486,9 @@ diff -uNr samba-3.0alpha23.orig/source/printing/printing_db.c samba-3.0alpha23/s pstrcat(printdb_path, printername); pstrcat(printdb_path, ".tdb"); -diff -uNr samba-3.0alpha23.orig/source/registry/reg_db.c samba-3.0alpha23/source/registry/reg_db.c ---- samba-3.0alpha23.orig/source/registry/reg_db.c 2002-08-26 09:46:07.000000000 -0500 -+++ samba-3.0alpha23/source/registry/reg_db.c 2003-04-04 21:04:08.000000000 -0600 +diff -uNr samba-3.0.0beta2.orig/source/registry/reg_db.c samba-3.0.0beta2/source/registry/reg_db.c +--- samba-3.0.0beta2.orig/source/registry/reg_db.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/registry/reg_db.c 2003-07-02 23:19:02.000000000 -0500 @@ -131,13 +131,13 @@ * if we need to init the data in the registry */ @@ -446,9 +506,9 @@ diff -uNr samba-3.0alpha23.orig/source/registry/reg_db.c samba-3.0alpha23/source return False; } -diff -uNr samba-3.0alpha23.orig/source/rpc_server/srv_srvsvc_nt.c samba-3.0alpha23/source/rpc_server/srv_srvsvc_nt.c ---- samba-3.0alpha23.orig/source/rpc_server/srv_srvsvc_nt.c 2003-03-30 20:28:31.000000000 -0600 -+++ samba-3.0alpha23/source/rpc_server/srv_srvsvc_nt.c 2003-04-04 21:04:08.000000000 -0600 +diff -uNr samba-3.0.0beta2.orig/source/rpc_server/srv_srvsvc_nt.c samba-3.0.0beta2/source/rpc_server/srv_srvsvc_nt.c +--- samba-3.0.0beta2.orig/source/rpc_server/srv_srvsvc_nt.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/rpc_server/srv_srvsvc_nt.c 2003-07-02 23:19:02.000000000 -0500 @@ -133,10 +133,10 @@ if (share_tdb && local_pid == sys_getpid()) @@ -462,9 +522,21 @@ diff -uNr samba-3.0alpha23.orig/source/rpc_server/srv_srvsvc_nt.c samba-3.0alpha return False; } -diff -uNr samba-3.0alpha23.orig/source/smbd/lanman.c samba-3.0alpha23/source/smbd/lanman.c ---- samba-3.0alpha23.orig/source/smbd/lanman.c 2003-02-25 14:51:35.000000000 -0600 -+++ samba-3.0alpha23/source/smbd/lanman.c 2003-04-04 21:04:08.000000000 -0600 +diff -uNr samba-3.0.0beta2.orig/source/sam/idmap_tdb.c samba-3.0.0beta2/source/sam/idmap_tdb.c +--- samba-3.0.0beta2.orig/source/sam/idmap_tdb.c 2003-07-01 15:44:26.000000000 -0500 ++++ samba-3.0.0beta2/source/sam/idmap_tdb.c 2003-07-02 23:19:02.000000000 -0500 +@@ -495,7 +495,7 @@ + BOOL tdb_is_new = False; + + /* use the old database if present */ +- tdbfile = strdup(lock_path("winbindd_idmap.tdb")); ++ tdbfile = strdup(state_path("winbindd_idmap.tdb")); + if (!tdbfile) { + DEBUG(0, ("idmap_init: out of memory!\n")); + return NT_STATUS_NO_MEMORY; +diff -uNr samba-3.0.0beta2.orig/source/smbd/lanman.c samba-3.0.0beta2/source/smbd/lanman.c +--- samba-3.0.0beta2.orig/source/smbd/lanman.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/smbd/lanman.c 2003-07-02 23:19:02.000000000 -0500 @@ -966,9 +966,9 @@ BOOL local_list_only; int i; @@ -477,9 +549,9 @@ diff -uNr samba-3.0alpha23.orig/source/smbd/lanman.c samba-3.0alpha23/source/smb return(0); } -diff -uNr samba-3.0alpha23.orig/source/wrepld/process.c samba-3.0alpha23/source/wrepld/process.c ---- samba-3.0alpha23.orig/source/wrepld/process.c 2003-01-14 10:01:01.000000000 -0600 -+++ samba-3.0alpha23/source/wrepld/process.c 2003-04-04 21:04:09.000000000 -0600 +diff -uNr samba-3.0.0beta2.orig/source/wrepld/process.c samba-3.0.0beta2/source/wrepld/process.c +--- samba-3.0.0beta2.orig/source/wrepld/process.c 2003-07-02 23:26:47.000000000 -0500 ++++ samba-3.0.0beta2/source/wrepld/process.c 2003-07-02 23:19:02.000000000 -0500 @@ -197,7 +197,7 @@ { TDB_CONTEXT *tdb; @@ -498,70 +570,14 @@ diff -uNr samba-3.0alpha23.orig/source/wrepld/process.c samba-3.0alpha23/source/ if (!tdb) { DEBUG(2,("send_entry_request: Can't open wins database file %s. Error was %s\n", WINS_LIST, strerror(errno) )); return; -diff -uNr samba-3.0alpha23.orig/source/passdb/pdb_tdb.c samba-3.0alpha23/source/passdb/pdb_tdb.c ---- samba-3.0alpha23.orig/source/passdb/pdb_tdb.c 2003-03-30 20:28:29.000000000 -0600 -+++ samba-3.0alpha23/source/passdb/pdb_tdb.c 2003-04-30 13:51:43.000000000 -0500 -@@ -943,10 +943,7 @@ - if (location) { - tdb_state->tdbsam_location = talloc_strdup(pdb_context->mem_ctx, location); - } else { -- pstring tdbfile; -- get_private_directory(tdbfile); -- pstrcat(tdbfile, "/"); -- pstrcat(tdbfile, PASSDB_FILE_NAME); -+ char *tdbfile = state_path(PASSDB_FILE_NAME); - tdb_state->tdbsam_location = talloc_strdup(pdb_context->mem_ctx, tdbfile); - } - ---- samba-3.0alpha24/source/nmbd/nmbd_winsserver.c.orig 2003-05-18 19:12:27.000000000 -0400 -+++ samba-3.0alpha24/source/nmbd/nmbd_winsserver.c 2003-05-18 19:18:04.000000000 -0400 -@@ -230,7 +230,7 @@ - - add_samba_names_to_subnet(wins_server_subnet); - -- if((fp = x_fopen(lock_path(WINS_LIST),O_RDONLY,0)) == NULL) -+ if((fp = x_fopen(state_path(WINS_LIST),O_RDONLY,0)) == NULL) - { - DEBUG(2,("initialise_wins: Can't open wins database file %s. Error was %s\n", - WINS_LIST, strerror(errno) )); -@@ -1836,7 +1836,7 @@ - } - } - -- slprintf(fname,sizeof(fname)-1,"%s/%s", lp_lockdir(), WINS_LIST); -+ slprintf(fname,sizeof(fname)-1,"%s/%s", dyn_STATEDIR(), WINS_LIST); - all_string_sub(fname,"//", "/", 0); - slprintf(fnamenew,sizeof(fnamenew)-1,"%s.%u", fname, (unsigned int)sys_getpid()); - ---- samba-3.0alpha24/source/nsswitch/winbindd_idmap_tdb.c.orig 2003-05-18 19:22:14.000000000 -0400 -+++ samba-3.0alpha24/source/nsswitch/winbindd_idmap_tdb.c 2003-05-18 19:27:14.000000000 -0400 -@@ -283,16 +283,16 @@ - SMB_STRUCT_STAT stbuf; - - /* move to the new database on first startup */ -- if (!file_exist(lock_path("idmap.tdb"), &stbuf)) { -- if (file_exist(lock_path("winbindd_idmap.tdb"), &stbuf)) { -+ if (!file_exist(state_path("idmap.tdb"), &stbuf)) { -+ if (file_exist(state_path("winbindd_idmap.tdb"), &stbuf)) { - char *cmd = NULL; - - /* lazy file copy */ -- if (asprintf(&cmd, "cp -p %s/winbindd_idmap.tdb %s/idmap.tdb", lp_lockdir(), lp_lockdir()) != -1) { -+ if (asprintf(&cmd, "cp -p %s/winbindd_idmap.tdb %s/idmap.tdb", dyn_STATEDIR(), dyn_STATEDIR()) != -1) { - system(cmd); - free(cmd); - } -- if (!file_exist(lock_path("idmap.tdb"), &stbuf)) { -+ if (!file_exist(state_path("idmap.tdb"), &stbuf)) { - DEBUG(0, ("idmap_init: Unable to make a new database copy\n")); - return False; - } -@@ -300,7 +300,7 @@ - } +--- samba_3_0/source/nsswitch/winbindd_acct.c.orig 2003-07-15 13:03:59.000000000 -0400 ++++ samba_3_0/source/nsswitch/winbindd_acct.c 2003-07-15 13:04:42.000000000 -0400 +@@ -73,7 +73,7 @@ + + /* Nope. Try to open it */ - /* Open tdb cache */ -- if (!(idmap_tdb = tdb_open_log(lock_path("idmap.tdb"), 0, -+ if (!(idmap_tdb = tdb_open_log(state_path("idmap.tdb"), 0, - TDB_DEFAULT, O_RDWR | O_CREAT, - 0600))) { - DEBUG(0, +- if (!(account_tdb = tdb_open_log(lock_path("winbindd_idmap.tdb"), 0, ++ if (!(account_tdb = tdb_open_log(state_path("winbindd_idmap.tdb"), 0, + TDB_DEFAULT, O_RDWR | O_CREAT, 0600))) + { + /* last chance -- maybe idmap has already opened it */ diff --git a/packaging/Debian/debian/patches/samba.patch b/packaging/Debian/debian/patches/samba.patch index 60968aae36..bface14166 100644 --- a/packaging/Debian/debian/patches/samba.patch +++ b/packaging/Debian/debian/patches/samba.patch @@ -1,6 +1,6 @@ -diff -uNr samba-3.0alpha23.orig/source/client/smbmount.c samba-3.0alpha23/source/client/smbmount.c ---- samba-3.0alpha23.orig/source/client/smbmount.c 2003-03-30 20:28:28.000000000 -0600 -+++ samba-3.0alpha23/source/client/smbmount.c 2003-04-04 21:05:58.000000000 -0600 +diff -uNr samba-3.0.0beta1.orig/source/client/smbmount.c samba-3.0.0beta1/source/client/smbmount.c +--- samba-3.0.0beta1.orig/source/client/smbmount.c 2003-06-07 12:57:32.000000000 -0500 ++++ samba-3.0.0beta1/source/client/smbmount.c 2003-06-30 20:12:22.000000000 -0500 @@ -765,7 +765,7 @@ *lp = 0; pstrcpy(password,lp+1); @@ -19,18 +19,18 @@ diff -uNr samba-3.0alpha23.orig/source/client/smbmount.c samba-3.0alpha23/source } else if(!strcmp(opts, "credentials")) { pstrcpy(credentials,opteq+1); } else if(!strcmp(opts, "netbiosname")) { -@@ -889,7 +889,7 @@ +@@ -889,7 +901,7 @@ *p = 0; pstrcpy(password,p+1); got_pass = True; - memset(strchr_m(getenv("USER"),'%')+1,'X',strlen(password)); + memset(strchr_m(getenv("USER"),'%')+1,'\0',strlen(password)); } - strupper(username); + strupper_m(username); } -diff -uNr samba-3.0alpha23.orig/source/script/installbin.sh samba-3.0alpha23/source/script/installbin.sh ---- samba-3.0alpha23.orig/source/script/installbin.sh 2002-04-22 13:16:20.000000000 -0500 -+++ samba-3.0alpha23/source/script/installbin.sh 2003-04-04 21:05:58.000000000 -0600 +diff -uNr samba-3.0.0beta1.orig/source/script/installbin.sh samba-3.0.0beta1/source/script/installbin.sh +--- samba-3.0.0beta1.orig/source/script/installbin.sh 2002-04-22 13:16:20.000000000 -0500 ++++ samba-3.0.0beta1/source/script/installbin.sh 2003-06-30 20:12:22.000000000 -0500 @@ -22,9 +22,11 @@ chmod $INSTALLPERMS $BINDIR/$p2 @@ -46,27 +46,31 @@ diff -uNr samba-3.0alpha23.orig/source/script/installbin.sh samba-3.0alpha23/sou done -diff -uNr samba-3.0alpha23.orig/source/smbd/service.c samba-3.0alpha23/source/smbd/service.c ---- samba-3.0alpha23.orig/source/smbd/service.c 2003-03-30 20:28:31.000000000 -0600 -+++ samba-3.0alpha23/source/smbd/service.c 2003-04-04 21:05:58.000000000 -0600 -@@ -895,6 +895,14 @@ - change_to_root_user(); - } +diff -uNr samba-3.0.0beta1.orig/source/smbd/service.c samba-3.0.0beta1/source/smbd/service.c +--- samba-3.0.0beta1.orig/source/smbd/service.c 2003-06-07 12:57:39.000000000 -0500 ++++ samba-3.0.0beta1/source/smbd/service.c 2003-06-30 20:12:57.000000000 -0500 +@@ -880,6 +880,9 @@ + file_close_conn(conn); + dptr_closecnum(conn); -+ /* If our root postexec command includes a call to 'unmount', we want -+ to make sure we aren't blocking the mount point. */ -+ /* I think this patch should go here, but I am not sure since -+ the code looks very different than in Samba 2.2.2. Will come -+ back later; should check what change_to_root_user() does. Eloy.- -+ vfs_ChDir(conn,"/"); -+ /* ++ /* make sure we leave the directory available for unmount */ ++ vfs_ChDir(conn, "/"); + - change_to_root_user(); - /* execute any "root postexec = " line */ - if (*lp_rootpostexec(SNUM(conn))) { -diff -uNr samba-3.0alpha23.orig/source/smbwrapper/smbsh.c samba-3.0alpha23/source/smbwrapper/smbsh.c ---- samba-3.0alpha23.orig/source/smbwrapper/smbsh.c 2003-03-30 20:28:31.000000000 -0600 -+++ samba-3.0alpha23/source/smbwrapper/smbsh.c 2003-04-04 21:05:58.000000000 -0600 + /* execute any "postexec = " line */ + if (*lp_postexec(SNUM(conn)) && + change_to_user(conn, vuid)) { +@@ -899,8 +902,5 @@ + smbrun(cmd,NULL); + } + +- /* make sure we leave the directory available for unmount */ +- vfs_ChDir(conn, "/"); +- + conn_free(conn); + } +diff -uNr samba-3.0.0beta1.orig/source/smbwrapper/smbsh.c samba-3.0.0beta1/source/smbwrapper/smbsh.c +--- samba-3.0.0beta1.orig/source/smbwrapper/smbsh.c 2003-06-07 12:57:40.000000000 -0500 ++++ samba-3.0.0beta1/source/smbwrapper/smbsh.c 2003-06-30 20:12:22.000000000 -0500 @@ -36,7 +36,7 @@ int main(int argc, char *argv[]) { @@ -76,9 +80,9 @@ diff -uNr samba-3.0alpha23.orig/source/smbwrapper/smbsh.c samba-3.0alpha23/sourc pstring line, wd; int opt; extern char *optarg; -diff -uNr samba-3.0alpha23.orig/source/web/diagnose.c samba-3.0alpha23/source/web/diagnose.c ---- samba-3.0alpha23.orig/source/web/diagnose.c 2003-01-18 13:03:58.000000000 -0600 -+++ samba-3.0alpha23/source/web/diagnose.c 2003-04-04 21:05:58.000000000 -0600 +diff -uNr samba-3.0.0beta1.orig/source/web/diagnose.c samba-3.0.0beta1/source/web/diagnose.c +--- samba-3.0.0beta1.orig/source/web/diagnose.c 2003-06-07 12:57:41.000000000 -0500 ++++ samba-3.0.0beta1/source/web/diagnose.c 2003-06-30 20:12:22.000000000 -0500 @@ -70,6 +70,7 @@ static struct cli_state cli; extern struct in_addr loopback_ip; diff --git a/packaging/Debian/debian/po/es.po b/packaging/Debian/debian/po/es.po index 22f4fe58b0..1c5854b480 100644 --- a/packaging/Debian/debian/po/es.po +++ b/packaging/Debian/debian/po/es.po @@ -13,14 +13,15 @@ # msgid "" msgstr "" -"Project-Id-Version: Samba for Debian 2.999+3.0.alpha21-4\n" -"POT-Creation-Date: 2003-04-30 13:11-0500\n" -"PO-Revision-Date: 2003-03-09 20:27-0600\n" +"Project-Id-Version: Samba for Debian 3.0.0beta2-1\n" +"POT-Creation-Date: 2003-07-02 21:50-0500\n" +"PO-Revision-Date: 2003-07-02 21:51-0500\n" "Last-Translator: Steve Langasek \n" "Language-Team: Spanish \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"Report-Msgid-Bugs-To: \n" #. Description #: ../samba-common.templates:3 @@ -32,18 +33,15 @@ msgstr "Juego de caracteres para el sistema de ficheros Unix" #: ../samba-common.templates:3 msgid "" "You currently have a \"character set\" configured in your smb.conf. In " -"Samba 3.0, this option is replaced by two new options, \"unix charset\" and " -"\"display charset\". Please specify the character set you wish to use for " -"these new options, which control how Samba interprets filenames on the file " -"system and how smbclient will interpret these names when you connect to a " -"file server." +"Samba 3.0, this option is replaced by a new option, \"unix charset\". Please " +"specify the character set you wish to use for theis new option, which " +"controls how Samba interprets filenames on the file system." msgstr "" "Actualmente hay una opción de \"character set\" en smb.conf. En Samba 3.0 " -"esta opción ha sido reemplazado por dos opciones nuevas: \"unix charset\" y " -"\"display charset\". Por favor, indique el juego de caracteres que desea " -"usar para estas opciones nuevas, que controlan cómo Samba interpretará los " -"nombres en el sistema de ficheros y también cómo smbclient los interpretará " -"al conectarse a un servidor de ficheros." +"esta opción ha sido reemplazado por una opción nueva: \"unix charset\". Por " +"favor, indique el juego de caracteres que desea usar para esta opción " +"nueva, que controla cómo Samba interpretará los nombres en el sistema de " +"ficheros." #. Description #: ../samba-common.templates:3 @@ -51,12 +49,12 @@ msgid "If you leave this option blank, your smb.conf will not be changed." msgstr "Si deja en blanco este campo, no se cambiará smb.conf." #. Description -#: ../samba-common.templates:15 +#: ../samba-common.templates:13 msgid "Character Set for DOS clients" msgstr "Juego de caracteres para los clientes DOS" #. Description -#: ../samba-common.templates:15 +#: ../samba-common.templates:13 msgid "" "You currently have a \"client code page\" set in your smb.conf. In Samba " "3.0, this option is replaced by the option \"dos charset\". Please specify " @@ -73,13 +71,13 @@ msgstr "" "cambiará smb.conf." #. Description -#: ../samba-common.templates:26 +#: ../samba-common.templates:24 msgid "Modify smb.conf to use WINS settings from DHCP?" msgstr "" "¿Modificar smb.conf para usar la configuración WINS que proviene de DHCP?" #. Description -#: ../samba-common.templates:26 +#: ../samba-common.templates:24 msgid "" "If your computer gets IP address information from a DHCP server on the " "network, the DHCP server may also provide information about WINS servers " @@ -94,7 +92,7 @@ msgstr "" "de /etc/samba/dhcp.conf." #. Description -#: ../samba-common.templates:26 +#: ../samba-common.templates:24 msgid "" "You must have the dhcp3-client package installed to take advantage of this " "feature." @@ -102,12 +100,12 @@ msgstr "" "Hay que instalar el paquete dhcp3-client para aprovechar esta funcionalidad." #. Description -#: ../samba-common.templates:39 +#: ../samba-common.templates:37 msgid "Configure smb.conf through debconf?" msgstr "¿Configurar smb.conf mediante debconf?" #. Description -#: ../samba-common.templates:39 +#: ../samba-common.templates:37 msgid "" "The rest of the configuration of Samba deals with questions that affect " "parameters in /etc/samba/smb.conf, which is the file used to configure the " @@ -123,7 +121,7 @@ msgstr "" "arregle a mano." #. Description -#: ../samba-common.templates:39 +#: ../samba-common.templates:37 msgid "" "If you don't use debconf to configure smb.conf, you will have to handle any " "configuration changes yourself, and will not be able to take advantage of " @@ -136,12 +134,12 @@ msgstr "" "sea posible." #. Description -#: ../samba-common.templates:54 +#: ../samba-common.templates:52 msgid "Workgroup/Domain Name?" msgstr "Nombre del dominio o del grupo de trabajo" #. Description -#: ../samba-common.templates:54 +#: ../samba-common.templates:52 msgid "" "This controls what workgroup your server will appear to be in when queried " "by clients. Note that this parameter also controls the Domain name used with " @@ -152,12 +150,12 @@ msgstr "" "de dominio que se usa con la configuración security=domain." #. Description -#: ../samba-common.templates:62 +#: ../samba-common.templates:60 msgid "Use password encryption?" msgstr "¿Utilizar contraseñas cifradas?" #. Description -#: ../samba-common.templates:62 +#: ../samba-common.templates:60 msgid "" "Recent Windows clients communicate with SMB servers using encrypted " "passwords. If you want to use clear text passwords you will need to change a " diff --git a/packaging/Debian/debian/po/fr.po b/packaging/Debian/debian/po/fr.po index bb8cf41e35..130a92ee11 100644 --- a/packaging/Debian/debian/po/fr.po +++ b/packaging/Debian/debian/po/fr.po @@ -13,14 +13,15 @@ # msgid "" msgstr "" -"Project-Id-Version: Samba for Debian 2.999+3.0.alpha23-1\n" -"POT-Creation-Date: 2003-04-30 13:11-0500\n" -"PO-Revision-Date: 2003-04-19 08:28-0100\n" -"Last-Translator: Christian Perrier \n" +"Project-Id-Version: Samba for Debian 3.0.0beta2-1\n" +"POT-Creation-Date: 2003-07-02 21:50-0500\n" +"PO-Revision-Date: 2003-07-02 21:52-0500\n" +"Last-Translator: Steve Langasek \n" "Language-Team: French \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=ISO-8859-15\n" "Content-Transfer-Encoding: 8bit\n" +"Report-Msgid-Bugs-To: \n" #. Description #: ../samba-common.templates:3 @@ -31,20 +32,15 @@ msgstr "Jeu de caract #: ../samba-common.templates:3 msgid "" "You currently have a \"character set\" configured in your smb.conf. In " -"Samba 3.0, this option is replaced by two new options, \"unix charset\" and " -"\"display charset\". Please specify the character set you wish to use for " -"these new options, which control how Samba interprets filenames on the file " -"system and how smbclient will interpret these names when you connect to a " -"file server." +"Samba 3.0, this option is replaced by a new option, \"unix charset\". Please " +"specify the character set you wish to use for theis new option, which " +"controls how Samba interprets filenames on the file system." msgstr "" "Une instruction « character set » (jeu de caractères) est utilisée dans " -"votre fichier smb.conf. Avec Samba 3.0, cette option est remplacée par deux " -"nouvelles options, « unix charset » (jeu de caractères Unix) et « display " -"charset » (jeu de caractères à l'affichage). Veuillez indiquer le jeu de " -"caractères que vous voulez utiliser avec chacune de ces deux options. La " -"première permet d'interpréter les noms de fichiers sur le système et la " -"seconde permet à smbclient d'interpréter ces noms lors d'une connexion à un " -"serveur de fichiers." +"votre fichier smb.conf. Avec Samba 3.0, cette option est remplacée par une " +"nouvelle option, « unix charset » (jeu de caractères Unix). Veuillez " +"indiquer le jeu de caractères que vous voulez utiliser avec cette option, " +"qui permet d'interpréter les noms de fichiers sur le système." #. Description #: ../samba-common.templates:3 @@ -54,12 +50,12 @@ msgstr "" "réponse." #. Description -#: ../samba-common.templates:15 +#: ../samba-common.templates:13 msgid "Character Set for DOS clients" msgstr "Jeu de caractères pour les clients DOS" #. Description -#: ../samba-common.templates:15 +#: ../samba-common.templates:13 msgid "" "You currently have a \"client code page\" set in your smb.conf. In Samba " "3.0, this option is replaced by the option \"dos charset\". Please specify " @@ -78,12 +74,12 @@ msgstr "" "sans réponse. " #. Description -#: ../samba-common.templates:26 +#: ../samba-common.templates:24 msgid "Modify smb.conf to use WINS settings from DHCP?" msgstr "Modifier smb.conf pour utiliser les paramètres WINS fournis par DHCP ?" #. Description -#: ../samba-common.templates:26 +#: ../samba-common.templates:24 msgid "" "If your computer gets IP address information from a DHCP server on the " "network, the DHCP server may also provide information about WINS servers " @@ -98,19 +94,19 @@ msgstr "" "serveur DHCP soient lus dans /etc/samba/dhcp.conf." #. Description -#: ../samba-common.templates:26 +#: ../samba-common.templates:24 msgid "" "You must have the dhcp3-client package installed to take advantage of this " "feature." msgstr "Pour cela, le paquet dhcp3-client doit être installé." #. Description -#: ../samba-common.templates:39 +#: ../samba-common.templates:37 msgid "Configure smb.conf through debconf?" msgstr "Voulez-vous configurer smb.conf avec debconf ?" #. Description -#: ../samba-common.templates:39 +#: ../samba-common.templates:37 msgid "" "The rest of the configuration of Samba deals with questions that affect " "parameters in /etc/samba/smb.conf, which is the file used to configure the " @@ -125,7 +121,7 @@ msgstr "" "il vaut mieux gérer manuellement le contenu de ce fichier." #. Description -#: ../samba-common.templates:39 +#: ../samba-common.templates:37 msgid "" "If you don't use debconf to configure smb.conf, you will have to handle any " "configuration changes yourself, and will not be able to take advantage of " @@ -138,12 +134,12 @@ msgstr "" "est conseillé d'utiliser debconf." #. Description -#: ../samba-common.templates:54 +#: ../samba-common.templates:52 msgid "Workgroup/Domain Name?" msgstr "Groupe de travail et nom de domaine ?" #. Description -#: ../samba-common.templates:54 +#: ../samba-common.templates:52 msgid "" "This controls what workgroup your server will appear to be in when queried " "by clients. Note that this parameter also controls the Domain name used with " @@ -154,12 +150,12 @@ msgstr "" "« security=domain »." #. Description -#: ../samba-common.templates:62 +#: ../samba-common.templates:60 msgid "Use password encryption?" msgstr "Voulez-vous chiffrer les mots de passe ?" #. Description -#: ../samba-common.templates:62 +#: ../samba-common.templates:60 msgid "" "Recent Windows clients communicate with SMB servers using encrypted " "passwords. If you want to use clear text passwords you will need to change a " diff --git a/packaging/Debian/debian/po/pt_BR.po b/packaging/Debian/debian/po/pt_BR.po index a6f02f7706..63ffd9a983 100644 --- a/packaging/Debian/debian/po/pt_BR.po +++ b/packaging/Debian/debian/po/pt_BR.po @@ -13,14 +13,15 @@ # msgid "" msgstr "" -"Project-Id-Version: samba_2.999+3.0.alpha20-4\n" -"POT-Creation-Date: 2003-04-30 13:11-0500\n" -"PO-Revision-Date: 2003-04-05 13:30-0300\n" -"Last-Translator: André Luís Lopes \n" +"Project-Id-Version: samba_3.0.0beta2-1\n" +"POT-Creation-Date: 2003-07-02 21:50-0500\n" +"PO-Revision-Date: 2003-07-02 21:56-0500\n" +"Last-Translator: Steve Langasek \n" "Language-Team: Debian-BR Project \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=ISO-8859-1\n" "Content-Transfer-Encoding: 8bit\n" +"Report-Msgid-Bugs-To: \n" #. Description #: ../samba-common.templates:3 @@ -29,21 +30,19 @@ msgstr "Conjunto de caracteres para sistema de arquivos Unix" #. Description #: ../samba-common.templates:3 +#, fuzzy msgid "" "You currently have a \"character set\" configured in your smb.conf. In " -"Samba 3.0, this option is replaced by two new options, \"unix charset\" and " -"\"display charset\". Please specify the character set you wish to use for " -"these new options, which control how Samba interprets filenames on the file " -"system and how smbclient will interpret these names when you connect to a " -"file server." +"Samba 3.0, this option is replaced by a new option, \"unix charset\". Please " +"specify the character set you wish to use for theis new option, which " +"controls how Samba interprets filenames on the file system." msgstr "" "Atualmente existe um \"conjunto de caracteres\" (\"character set\") " "configurado em seu arquivo smb.conf. No Samba 3.0, esta opção foi " -"substituída por duas novas opções, \"unix charset\" e \"display charset\". " -"Por favor especifique o conjunto de caracteres a ser usado para essas novas " -"opções, as quais controlam como o Samba interpreta nomes de arquivos no " -"sistema de arquivos e como o smbclient irá interpretar esses nomes quando " -"você se conectar a um servidor de arquivos, respectivamente." +"substituída por uma nova opção, \"unix charset\". Por favor especifique " +"o conjunto de caracteres a ser usado para essa nova opção, a qual " +"controla como o Samba interpreta nomes de arquivos no sistema de " +"arquivos." #. Description #: ../samba-common.templates:3 @@ -53,12 +52,12 @@ msgstr "" "modificado." #. Description -#: ../samba-common.templates:15 +#: ../samba-common.templates:13 msgid "Character Set for DOS clients" msgstr "Conjunto de caracteres para clientes DOS" #. Description -#: ../samba-common.templates:15 +#: ../samba-common.templates:13 msgid "" "You currently have a \"client code page\" set in your smb.conf. In Samba " "3.0, this option is replaced by the option \"dos charset\". Please specify " @@ -76,12 +75,12 @@ msgstr "" "será modificado." #. Description -#: ../samba-common.templates:26 +#: ../samba-common.templates:24 msgid "Modify smb.conf to use WINS settings from DHCP?" msgstr "Modificar smb.conf para usar configurações WINS fornecidas via DHCP ?" #. Description -#: ../samba-common.templates:26 +#: ../samba-common.templates:24 msgid "" "If your computer gets IP address information from a DHCP server on the " "network, the DHCP server may also provide information about WINS servers " @@ -97,7 +96,7 @@ msgstr "" "arquivo smb.conf." #. Description -#: ../samba-common.templates:26 +#: ../samba-common.templates:24 msgid "" "You must have the dhcp3-client package installed to take advantage of this " "feature." @@ -106,12 +105,12 @@ msgstr "" "recurso." #. Description -#: ../samba-common.templates:39 +#: ../samba-common.templates:37 msgid "Configure smb.conf through debconf?" msgstr "Configurar smb.conf através do debconf ?" #. Description -#: ../samba-common.templates:39 +#: ../samba-common.templates:37 msgid "" "The rest of the configuration of Samba deals with questions that affect " "parameters in /etc/samba/smb.conf, which is the file used to configure the " @@ -127,7 +126,7 @@ msgstr "" "lo funcional novamente." #. Description -#: ../samba-common.templates:39 +#: ../samba-common.templates:37 msgid "" "If you don't use debconf to configure smb.conf, you will have to handle any " "configuration changes yourself, and will not be able to take advantage of " @@ -140,12 +139,12 @@ msgstr "" "Por esse motivo, é recomendado usar o debconf, caso seja possível." #. Description -#: ../samba-common.templates:54 +#: ../samba-common.templates:52 msgid "Workgroup/Domain Name?" msgstr "Nome de Domínio/Grupo de Trabalho ?" #. Description -#: ../samba-common.templates:54 +#: ../samba-common.templates:52 msgid "" "This controls what workgroup your server will appear to be in when queried " "by clients. Note that this parameter also controls the Domain name used with " @@ -157,12 +156,12 @@ msgstr "" "security=domain." #. Description -#: ../samba-common.templates:62 +#: ../samba-common.templates:60 msgid "Use password encryption?" msgstr "Usar encriptação de senhas ?" #. Description -#: ../samba-common.templates:62 +#: ../samba-common.templates:60 msgid "" "Recent Windows clients communicate with SMB servers using encrypted " "passwords. If you want to use clear text passwords you will need to change a " diff --git a/packaging/Debian/debian/po/templates.pot b/packaging/Debian/debian/po/templates.pot index 4798ca9cfa..b636ba2e48 100644 --- a/packaging/Debian/debian/po/templates.pot +++ b/packaging/Debian/debian/po/templates.pot @@ -15,7 +15,7 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" -"POT-Creation-Date: 2003-04-30 13:11-0500\n" +"POT-Creation-Date: 2003-07-02 21:50-0500\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" @@ -32,11 +32,9 @@ msgstr "" #: ../samba-common.templates:3 msgid "" "You currently have a \"character set\" configured in your smb.conf. In " -"Samba 3.0, this option is replaced by two new options, \"unix charset\" and " -"\"display charset\". Please specify the character set you wish to use for " -"these new options, which control how Samba interprets filenames on the file " -"system and how smbclient will interpret these names when you connect to a " -"file server." +"Samba 3.0, this option is replaced by a new option, \"unix charset\". Please " +"specify the character set you wish to use for theis new option, which " +"controls how Samba interprets filenames on the file system." msgstr "" #. Description @@ -45,12 +43,12 @@ msgid "If you leave this option blank, your smb.conf will not be changed." msgstr "" #. Description -#: ../samba-common.templates:15 +#: ../samba-common.templates:13 msgid "Character Set for DOS clients" msgstr "" #. Description -#: ../samba-common.templates:15 +#: ../samba-common.templates:13 msgid "" "You currently have a \"client code page\" set in your smb.conf. In Samba " "3.0, this option is replaced by the option \"dos charset\". Please specify " @@ -61,12 +59,12 @@ msgid "" msgstr "" #. Description -#: ../samba-common.templates:26 +#: ../samba-common.templates:24 msgid "Modify smb.conf to use WINS settings from DHCP?" msgstr "" #. Description -#: ../samba-common.templates:26 +#: ../samba-common.templates:24 msgid "" "If your computer gets IP address information from a DHCP server on the " "network, the DHCP server may also provide information about WINS servers " @@ -76,19 +74,19 @@ msgid "" msgstr "" #. Description -#: ../samba-common.templates:26 +#: ../samba-common.templates:24 msgid "" "You must have the dhcp3-client package installed to take advantage of this " "feature." msgstr "" #. Description -#: ../samba-common.templates:39 +#: ../samba-common.templates:37 msgid "Configure smb.conf through debconf?" msgstr "" #. Description -#: ../samba-common.templates:39 +#: ../samba-common.templates:37 msgid "" "The rest of the configuration of Samba deals with questions that affect " "parameters in /etc/samba/smb.conf, which is the file used to configure the " @@ -98,7 +96,7 @@ msgid "" msgstr "" #. Description -#: ../samba-common.templates:39 +#: ../samba-common.templates:37 msgid "" "If you don't use debconf to configure smb.conf, you will have to handle any " "configuration changes yourself, and will not be able to take advantage of " @@ -107,12 +105,12 @@ msgid "" msgstr "" #. Description -#: ../samba-common.templates:54 +#: ../samba-common.templates:52 msgid "Workgroup/Domain Name?" msgstr "" #. Description -#: ../samba-common.templates:54 +#: ../samba-common.templates:52 msgid "" "This controls what workgroup your server will appear to be in when queried " "by clients. Note that this parameter also controls the Domain name used with " @@ -120,12 +118,12 @@ msgid "" msgstr "" #. Description -#: ../samba-common.templates:62 +#: ../samba-common.templates:60 msgid "Use password encryption?" msgstr "" #. Description -#: ../samba-common.templates:62 +#: ../samba-common.templates:60 msgid "" "Recent Windows clients communicate with SMB servers using encrypted " "passwords. If you want to use clear text passwords you will need to change a " diff --git a/packaging/Debian/debian/rules b/packaging/Debian/debian/rules index 79be52a044..0539484089 100755 --- a/packaging/Debian/debian/rules +++ b/packaging/Debian/debian/rules @@ -4,14 +4,13 @@ # solve build problems) introduced in Samba 2.2.1a-5. These # modification were made by Steve Langasek . # -# $Id: rules,v 1.3 2003/06/01 07:12:51 peloy Exp $ # # Uncomment this to turn on verbose mode. #export DH_VERBOSE=1 # This is the debhelper compatability version to use. -export DH_COMPAT=2 +export DH_COMPAT=4 # This has to be exported to make some magic below work. export DH_OPTIONS @@ -24,6 +23,22 @@ DEB_BUILD_GNU_TYPE := $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE) export DEB_HOST_GNU_TYPE export DEB_BUILD_GNU_TYPE + +# Support the DEB_BUILD_OPTIONS variable +CFLAGS = -gstabs -Wall +INSTALL = install + +ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS))) + CFLAGS += -O0 +else + CFLAGS += -O2 +endif + +ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS))) + INSTALL += -s +endif + + DESTDIR=`pwd`/debian/tmp SWATDIR=`pwd`/debian/swat SAMBABOOK=`pwd`/debian/swat @@ -33,7 +48,7 @@ IVARS = BASEDIR=$(DESTDIR)/usr \ BINDIR=$(DESTDIR)/usr/bin \ SBINDIR=$(DESTDIR)/usr/sbin \ MANDIR=$(DESTDIR)/usr/share/man \ - LIBDIR=$(DESTDIR)/etc/samba \ + LIBDIR=$(DESTDIR)/usr/lib/samba \ VARDIR=$(DESTDIR)/var \ INCLUDEDIR=$(DESTDIR)/usr/include \ SWATDIR=$(SWATDIR)/usr/share/samba/swat \ @@ -61,7 +76,7 @@ configure-stamp: cp -f debian/config.cache source/config.cache; \ fi - [ -f source/Makefile ] || (cd source && ./configure \ + [ -f source/Makefile ] || (cd source && CFLAGS="$(CFLAGS)" ./configure \ --host=$(DEB_HOST_GNU_TYPE) \ --build=$(DEB_BUILD_GNU_TYPE) \ --cache-file=./config.cache \ @@ -260,7 +275,7 @@ binary-arch: build install fi # dh_installemacsen # dh_installpam - DH_OPTIONS= dh_installinit -psamba -n + DH_OPTIONS= dh_installinit -psamba -- "defaults 20 19" DH_OPTIONS= dh_installinit -pwinbind dh_installcron # dh_installmanpages diff --git a/packaging/Debian/debian/samba-common.config b/packaging/Debian/debian/samba-common.config index b5ab6e81d5..ed76b95cb8 100644 --- a/packaging/Debian/debian/samba-common.config +++ b/packaging/Debian/debian/samba-common.config @@ -78,7 +78,6 @@ if [ -f $FILE ]; then CHARSET=`smbconf_retr "character set"` CODEPAGE=`smbconf_retr "client code page"` - DISPLAYCHARSET=`smbconf_retr "display charset"` UNIXCHARSET=`smbconf_retr "unix charset"` DOSCHARSET=`smbconf_retr "dos charset"` @@ -110,10 +109,10 @@ db_input medium samba-common/encrypt_passwords || true db_go # Handle migrating character sets -if [ -n "$CHARSET" -a -z "$DISPLAYCHARSET" -a -z "$UNIXCHARSET" ] +if [ -n "$CHARSET" -a -z "$UNIXCHARSET" ] then - DISPLAYCHARSET=`echo $CHARSET | sed -e's/iso-/ISO/i'` - db_set samba-common/character_set "$DISPLAYCHARSET" + UNIXCHARSET=`echo $CHARSET | sed -e's/iso-/ISO/i'` + db_set samba-common/character_set "$UNIXCHARSET" # FIXME: should eventually be low. db_input medium samba-common/character_set || true db_go diff --git a/packaging/Debian/debian/samba-common.dhcp b/packaging/Debian/debian/samba-common.dhcp index 0ec8a0ff80..3b2fa4ba19 100644 --- a/packaging/Debian/debian/samba-common.dhcp +++ b/packaging/Debian/debian/samba-common.dhcp @@ -1,29 +1,34 @@ #!/bin/sh -# No need to continue if we're called with an unsupported option +netbios_setup() { + # No need to continue if we're called with an unsupported option -if [ "$reason" != BOUND ] && [ "$reason" != RENEW ] \ - && [ "$reason" != REBIND ] && [ "$reason" != REBOOT ] \ - && [ "$reason" != EXPIRE ] && [ "$reason" != FAIL ] -then - exit 0 -fi + if [ "$reason" != BOUND ] && [ "$reason" != RENEW ] \ + && [ "$reason" != REBIND ] && [ "$reason" != REBOOT ] \ + && [ "$reason" != EXPIRE ] && [ "$reason" != FAIL ] + then + return + fi -umask 022 + umask 022 -if [ -z "$new_netbios_name_servers" ] || [ "$reason" = FAIL ] \ - || [ "$reason" = EXPIRE ] -then - # FIXME: add sed magic to only remove wins servers - # associated with this interface - echo -n > /etc/samba/dhcp.conf -elif [ "$new_netbios_name_servers" != "old_netbios_name_servers" ] -then - for server in $new_netbios_name_servers - do - serverlist="$serverlist $interface:$server" - done - # FIXME: add sed magic to only update wins servers - # associated with this interface - echo " wins server =$serverlist" > /etc/samba/dhcp.conf -fi + if [ -z "$new_netbios_name_servers" ] || [ "$reason" = FAIL ] \ + || [ "$reason" = EXPIRE ] + then + # FIXME: add sed magic to only remove wins servers + # associated with this interface + echo -n > /etc/samba/dhcp.conf + elif [ "$new_netbios_name_servers" != "$old_netbios_name_servers" ] + then + local serverlist="" + for server in $new_netbios_name_servers + do + serverlist="$serverlist $interface:$server" + done + # FIXME: add sed magic to only update wins servers + # associated with this interface + echo " wins server =$serverlist" > /etc/samba/dhcp.conf + fi +} + +netbios_setup diff --git a/packaging/Debian/debian/samba-common.postinst b/packaging/Debian/debian/samba-common.postinst index b3f3c5e9fd..6c6eb9bf53 100644 --- a/packaging/Debian/debian/samba-common.postinst +++ b/packaging/Debian/debian/samba-common.postinst @@ -1,6 +1,5 @@ #!/bin/sh # -# $Id: samba-common.postinst,v 1.2 2003/06/01 07:12:51 peloy Exp $ # set -e @@ -80,15 +79,14 @@ if [ "${RET}" = "true" ]; then if ! grep -q "^[[:space:]]*unix charset[[:space:]]*=" /etc/samba/smb.conf then db_get samba-common/character_set || true - DISPLAYCHARSET="${RET}" - if [ -n "$DISPLAYCHARSET" ] + UNIXCHARSET="${RET}" + if [ -n "$UNIXCHARSET" ] then sed -e "s/^\([[:space:]]*\)\[global\]/\1\[global\]/i s/^\([[:space:]]*\)character set/\1character set/i /^[[:space:]]*\[global\]/,/^[[:space:]]*\[/ { /^[[:space:]]*character set[[:space:]]*=/c \\ - display charset = $DISPLAYCHARSET\\ - unix charset = $DISPLAYCHARSET + unix charset = $UNIXCHARSET }" < /etc/samba/smb.conf > ${TMPFILE} mv -f ${TMPFILE} /etc/samba/smb.conf fi diff --git a/packaging/Debian/debian/samba-common.postrm b/packaging/Debian/debian/samba-common.postrm index 0f005e1055..8a4b6d3d55 100644 --- a/packaging/Debian/debian/samba-common.postrm +++ b/packaging/Debian/debian/samba-common.postrm @@ -1,6 +1,5 @@ #!/bin/sh # -# $Id: samba-common.postrm,v 1.3 2003/06/01 07:12:51 peloy Exp $ # if [ "$1" = purge ]; then diff --git a/packaging/Debian/debian/samba-common.templates b/packaging/Debian/debian/samba-common.templates index 83621408df..e5f7b1ae0c 100644 --- a/packaging/Debian/debian/samba-common.templates +++ b/packaging/Debian/debian/samba-common.templates @@ -2,11 +2,9 @@ Template: samba-common/character_set Type: string _Description: Character Set for Unix filesystem You currently have a "character set" configured in your smb.conf. In - Samba 3.0, this option is replaced by two new options, "unix charset" and - "display charset". Please specify the character set you wish to use for - these new options, which control how Samba interprets filenames on the - file system and how smbclient will interpret these names when you connect - to a file server. + Samba 3.0, this option is replaced by a new option, "unix charset". + Please specify the character set you wish to use for theis new option, + which controls how Samba interprets filenames on the file system. . If you leave this option blank, your smb.conf will not be changed. diff --git a/packaging/Debian/debian/samba.config b/packaging/Debian/debian/samba.config index 022d5fe6dc..89792d436e 100644 --- a/packaging/Debian/debian/samba.config +++ b/packaging/Debian/debian/samba.config @@ -1,6 +1,5 @@ #/bin/sh -e # -# $Id: samba.config,v 1.2 2003/06/01 07:12:51 peloy Exp $ # # Source debconf library. diff --git a/packaging/Debian/debian/samba.dirs b/packaging/Debian/debian/samba.dirs index 06a2fb2484..a58e4e9892 100644 --- a/packaging/Debian/debian/samba.dirs +++ b/packaging/Debian/debian/samba.dirs @@ -1,6 +1,7 @@ usr/bin usr/sbin var/log/samba -var/lib/samba +var/lib/samba/printers/W32X86 +var/lib/samba/printers/WIN40 var/run/samba var/cache/samba diff --git a/packaging/Debian/debian/samba.files b/packaging/Debian/debian/samba.files index 7de0a15f2f..f52e6c5e4f 100644 --- a/packaging/Debian/debian/samba.files +++ b/packaging/Debian/debian/samba.files @@ -6,6 +6,7 @@ usr/bin/pdbedit usr/sbin/smbd usr/sbin/nmbd usr/sbin/mksmbpasswd +usr/lib/samba/vfs usr/share/man/man1/smbcontrol.1 usr/share/man/man1/smbstatus.1 usr/share/man/man1/testprns.1 @@ -14,3 +15,5 @@ usr/share/man/man8/nmbd.8 usr/share/man/man8/pdbedit.8 usr/share/man/man8/smbd.8 usr/share/man/man8/mksmbpasswd.8 +usr/share/man/man8/tdbbackup.8 + diff --git a/packaging/Debian/debian/samba.init b/packaging/Debian/debian/samba.init index 3894fe1e64..5d0f4671a0 100644 --- a/packaging/Debian/debian/samba.init +++ b/packaging/Debian/debian/samba.init @@ -2,7 +2,6 @@ # # Start/stops the Samba daemons (nmbd and smbd). # -# $Id: samba.init,v 1.3 2003/06/01 07:12:51 peloy Exp $ # # Defaults diff --git a/packaging/Debian/debian/samba.postinst b/packaging/Debian/debian/samba.postinst index 00f9fde3b2..1a25290ed2 100644 --- a/packaging/Debian/debian/samba.postinst +++ b/packaging/Debian/debian/samba.postinst @@ -2,7 +2,6 @@ # # Post-installation script for the Samba package for Debian GNU/Linux # -# $Id: samba.postinst,v 1.3 2003/06/01 07:12:51 peloy Exp $ # case "$1" in @@ -192,11 +191,6 @@ if dpkg --compare-versions "$2" lt 2.999+3.0.alpha20-4; then update-inetd --remove netbios-ns fi -# We always run /etc/init.d/samba, even if we run Samba from inetd. -# The init.d script takes care of handling the conflict of running -# from inetd or as daemons. -update-rc.d samba defaults 20 19 > /dev/null - # We want to add these entries to inetd.conf commented out. Otherwise # UDP traffic could make inetd to start nmbd or smbd right during # the configuration stage. @@ -210,16 +204,6 @@ else update-inetd --enable netbios-ssn fi -# Start Samba: we don't want to call /etc/init.d/samba if we are -# running from inetd because a nasty help message would be printed out. - -# Run the init script if this is a first-time install, or if it's an -# upgrade and Samba was running before, _and_ we're not running from inetd. -if [ -z "$2" -o ! -f /tmp/samba-was-not-running ]; then - # Check the script is executable before running it. - [ -x /etc/init.d/samba ] && /etc/init.d/samba start -fi - # This check is a safety net: the /etc/samba/smbpasswd file must have # permissions 600. if [ -f /etc/samba/smbpasswd ]; then @@ -239,10 +223,6 @@ rm -f /etc/samba/debian_config mv -f /var/log/nmb* /var/log/samba/ 2> /dev/null || true mv -f /var/log/smb* /var/log/samba/ 2> /dev/null || true -# Do this last, so we don't accidentally start the daemons if something -# else in the script fails above. -rm -f /tmp/samba-was-not-running - #DEBHELPER# exit 0 diff --git a/packaging/Debian/debian/samba.postrm b/packaging/Debian/debian/samba.postrm index b929061f37..b79fe1d009 100644 --- a/packaging/Debian/debian/samba.postrm +++ b/packaging/Debian/debian/samba.postrm @@ -1,6 +1,5 @@ #!/bin/sh -e # -# $Id: samba.postrm,v 1.3 2003/06/01 07:12:51 peloy Exp $ # if [ "$1" = purge ]; then @@ -18,7 +17,6 @@ if [ "$1" = purge ]; then # Remove NetBIOS entries from /etc/inetd.conf update-inetd --remove netbios-ssn - update-rc.d samba remove >/dev/null else # Not purging, do not remove NetBIOS entries from /etc/inetd.conf update-inetd --disable netbios-ssn diff --git a/packaging/Debian/debian/samba.prerm b/packaging/Debian/debian/samba.prerm index 6a4a8a4b4b..ab62c706d8 100644 --- a/packaging/Debian/debian/samba.prerm +++ b/packaging/Debian/debian/samba.prerm @@ -1,24 +1,5 @@ #!/bin/sh -e -# Clean up any such stale file. -rm -f /tmp/samba-was-not-running - -# The smbd pid file is missing, or points to a dead process -if [ ! -f /var/run/samba/smbd.pid ] || \ - ! ps h `cat /var/run/samba/smbd.pid` > /dev/null -then - # The nmbd pid file is missing, or points to a dead process - if [ -f /var/run/samba/nmbd.pid ] || \ - ! ps h `cat /var/run/samba/nmbd.pid` > /dev/null - then - # let the postinst know not to start samba. - [ "$1" = "upgrade" ] && touch /tmp/samba-was-not-running - fi -fi - -# We call the init script to stop Samba, even if it only affects nmbd. -[ -x /etc/init.d/samba ] && /etc/init.d/samba stop - if [ "$1" = upgrade -a -n "$2" ] && dpkg --compare-versions "$2" lt 2.99 \ && [ -e /var/lib/samba/passdb.tdb -a ! -e /etc/samba/smbpasswd ] then diff --git a/packaging/Debian/debian/scripts/patch-source b/packaging/Debian/debian/scripts/patch-source index ac2140f993..aabcbf709c 100755 --- a/packaging/Debian/debian/scripts/patch-source +++ b/packaging/Debian/debian/scripts/patch-source @@ -1,6 +1,5 @@ #!/bin/sh -e # -# $Id: patch-source,v 1.3 2003/06/01 07:12:51 peloy Exp $ # for patch in debian/patches/*.patch; do diff --git a/packaging/Debian/debian/scripts/unpatch-source b/packaging/Debian/debian/scripts/unpatch-source index ae58b2851c..0f577d362f 100755 --- a/packaging/Debian/debian/scripts/unpatch-source +++ b/packaging/Debian/debian/scripts/unpatch-source @@ -1,6 +1,5 @@ #!/bin/sh -e # -# $Id: unpatch-source,v 1.3 2003/06/01 07:12:51 peloy Exp $ # # We want to reverse the patches in the opposite order we applied diff --git a/packaging/Debian/debian/smb.conf b/packaging/Debian/debian/smb.conf index f5d04889d1..8a75979945 100644 --- a/packaging/Debian/debian/smb.conf +++ b/packaging/Debian/debian/smb.conf @@ -1,7 +1,6 @@ # # Sample configuration file for the Samba suite for Debian GNU/Linux. # -# $Id: smb.conf,v 1.3 2003/06/01 07:12:51 peloy Exp $ # # This is the main Samba configuration file. You should read the # smb.conf(5) manual page in order to understand the options listed @@ -22,27 +21,31 @@ [global] -# Change this for the workgroup/NT-domain name your Samba server will part of +## Browsing/Identification ### + +# Change this to the workgroup/NT-domain name your Samba server will part of workgroup = DEBIAN_FANS # server string is the equivalent of the NT Description field server string = %h server (Samba %v) -# If you want to automatically load your printer list rather -# than setting them up individually then you'll need this -; load printers = yes +# Windows Internet Name Serving Support Section: +# WINS Support - Tells the NMBD component of Samba to enable its WINS Server +; wins support = no -# lpr(ng) printing. You may wish to override the location of the -# printcap file -; printing = bsd -; printcap name = /etc/printcap +# WINS Server - Tells the NMBD components of Samba to be a WINS Client +# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both +; wins server = w.x.y.z -# cups printing. See also the cupsaddsmb(8) manpage -; printing = cups -; printcap name = cups +# This will prevent nmbd to search for NetBIOS names through DNS. + dns proxy = no -; guest account = nobody - invalid users = root +# What naming service and in what order should we use to resolve host names +# to IP addresses +; name resolve order = lmhosts host wins bcast + + +#### Debugging/Accounting #### # This tells Samba to use a separate log file for each machine # that connects @@ -51,118 +54,116 @@ # Put a capping on the size of the log files (in Kb). max log size = 1000 -# If you want Samba to log though syslog only then set the following -# parameter to 'yes'. Please note that logging through syslog in -# Samba is still experimental. +# If you want Samba to only log through syslog then set the following +# parameter to 'yes'. ; syslog only = no # We want Samba to log a minimum amount of information to syslog. Everything -# should go to /var/log/samba/log.{smb,nmb} instead. If you want to log +# should go to /var/log/samba/log.{smbd,nmbd} instead. If you want to log # through syslog you should set the following parameter to something higher. syslog = 0 +# Do something sensible when Samba crashes: mail the admin a backtrace + panic action = /usr/share/samba/panic-action %d + + +####### Authentication ####### + # "security = user" is always a good idea. This will require a Unix account # in this server for every user accessing the server. See -# security_level.txt for details. +# /usr/share/doc/samba-doc/htmldocs/ServerType.html in the samba-doc +# package for details. ; security = user -# You may wish to use password encryption. Please read ENCRYPTION.html, -# Win95.txt and WinNT.txt in the Samba documentation. Do not enable this -# option unless you have read those documents +# You may wish to use password encryption. See the section on +# 'encrypt passwords' in the smb.conf(5) manpage before enabling. encrypt passwords = no # If you are using encrypted passwords, Samba will need to know what # password database type you are using. passdb backend = tdbsam guest -# Using the following line enables you to customise your configuration -# on a per machine basis. The %m gets replaced with the netbios name -# of the machine that is connecting -; include = /home/samba/etc/smb.conf.%m + obey pam restrictions = yes -# Most people will find that this option gives better performance. -# See speed.txt and the manual pages for details -# You may want to add the following on a Linux system: -# SO_RCVBUF=8192 SO_SNDBUF=8192 - socket options = TCP_NODELAY +; guest account = nobody + invalid users = root -# --- Browser Control Options --- +# This boolean parameter controls whether Samba attempts to sync the Unix +# password with the SMB password when the encrypted SMB password in the +# passdb is changed. +; unix password sync = no -# Please _read_ BROWSING.txt and set the next four parameters according -# to your network setup. The defaults are specified below (commented -# out.) It's important that you read BROWSING.txt so you don't break -# browsing in your network! +# For Unix password sync to work on a Debian GNU/Linux system, the following +# parameters must be set (thanks to Augustin Luton for +# sending the correct chat script for the passwd program in Debian Potato). + passwd program = /usr/bin/passwd %u + passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n . -# set local master to no if you don't want Samba to become a master -# browser on your network. Otherwise the normal election rules apply -; local master = yes +# This boolean controls whether PAM will be used for password changes +# when requested by an SMB client instead of the program listed in +# 'passwd program'. The default is 'no'. +; pam password change = no -# OS Level determines the precedence of this server in master browser -# elections. The default value should be reasonable -; os level = 20 -# Domain Master specifies Samba to be the Domain Master Browser. This -# allows Samba to collate browse lists between subnets. Don't use this -# if you already have a Windows NT domain controller doing this job -; domain master = auto +########## Printing ########## -# Preferred Master causes Samba to force a local browser election on startup -# and gives it a slightly higher chance of winning the election -; preferred master = auto +# If you want to automatically load your printer list rather +# than setting them up individually then you'll need this +; load printers = yes -# --- End of Browser Control Options --- +# lpr(ng) printing. You may wish to override the location of the +# printcap file +; printing = bsd +; printcap name = /etc/printcap -# Windows Internet Name Serving Support Section: -# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server -; wins support = no +# CUPS printing. See also the cupsaddsmb(8) manpage in the +# cupsys-client package. +; printing = cups +; printcap name = cups -# WINS Server - Tells the NMBD components of Samba to be a WINS Client -# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both -; wins server = w.x.y.z +# When using [print$], root is implicitly a 'printer admin', but you can +# also give this right to other users to add drivers and set printer +# properties +; printer admin = @ntadmin -# This will prevent nmbd to search for NetBIOS names through DNS. - dns proxy = no -# What naming service and in what order should we use to resolve host names -# to IP addresses -; name resolve order = lmhosts host wins bcast +######## File sharing ######## # Name mangling options ; preserve case = yes ; short preserve case = yes -# This boolean parameter controlls whether Samba attempts to sync. the Unix -# password with the SMB password when the encrypted SMB password in the -# /etc/samba/smbpasswd file is changed. -; unix password sync = false -# For Unix password sync. to work on a Debian GNU/Linux system, the following -# parameters must be set (thanks to Augustin Luton for -# sending the correct chat script for the passwd program in Debian Potato). - passwd program = /usr/bin/passwd %u - passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n . +############ Misc ############ -# This boolean controls whether PAM will be used for password changes -# when requested by an SMB client instead of the program listed in -# 'passwd program'. The default is 'no'. -; pam password change = no +# Using the following line enables you to customise your configuration +# on a per machine basis. The %m gets replaced with the netbios name +# of the machine that is connecting +; include = /home/samba/etc/smb.conf.%m + +# Most people will find that this option gives better performance. +# See smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/speed.html +# for details +# You may want to add the following on a Linux system: +# SO_RCVBUF=8192 SO_SNDBUF=8192 + socket options = TCP_NODELAY # The following parameter is useful only if you have the linpopup package # installed. The samba maintainer and the linpopup maintainer are # working to ease installation and configuration of linpopup and samba. ; message command = /bin/sh -c '/usr/bin/linpopup "%f" "%m" %s; rm %s' & - obey pam restrictions = yes +# Domain Master specifies Samba to be the Domain Master Browser. If this +# machine will be configured as a BDC (a secondary logon server), you +# must set this to 'no'; otherwise, the default behavior is recommended. +; domain master = auto # Some defaults for winbind (make sure you're not using the ranges # for something else.) -; winbind uid = 10000-20000 -; winbind gid = 10000-20000 +; idmap uid = 10000-20000 +; idmap gid = 10000-20000 ; template shell = /bin/bash -# Do something sensible when Samba crashes: mail the admin a backtrace - panic action = /usr/share/samba/panic-action %d - #======================= Share Definitions ======================= [homes] @@ -199,6 +200,19 @@ writable = no create mode = 0700 +# Windows clients look for this share name as a source of downloadable +# printer drivers +[print$] + comment = Printer Drivers + path = /var/lib/samba/printers + browseable = yes + read only = yes + guest ok = no +# Uncomment to allow remote administration of Windows print drivers. +# Replace 'ntadmin' with the name of the group your admin users are +# members of. +; write list = root, @ntadmin + # A sample share for sharing your CD-ROM with others. ;[cdrom] ; comment = Samba server's CD-ROM diff --git a/packaging/Debian/debian/smbclient.files b/packaging/Debian/debian/smbclient.files index efabb0ddd0..96e8945bf3 100644 --- a/packaging/Debian/debian/smbclient.files +++ b/packaging/Debian/debian/smbclient.files @@ -4,9 +4,12 @@ usr/bin/rpcclient usr/bin/smbspool usr/bin/smbtree usr/bin/smbcacls +usr/bin/smbcquotas usr/share/man/man1/smbclient.1 usr/share/man/man1/smbtar.1 usr/share/man/man1/rpcclient.1 usr/share/man/man8/smbspool.8 usr/share/man/man1/smbcacls.1 +usr/share/man/man1/smbcquotas.1 +usr/share/man/man1/smbtree.1 usr/lib/cups/backend/smb diff --git a/packaging/Debian/debian/swat.config b/packaging/Debian/debian/swat.config index ae539d2ae5..e210fae55e 100644 --- a/packaging/Debian/debian/swat.config +++ b/packaging/Debian/debian/swat.config @@ -1,6 +1,5 @@ #/bin/sh -e # -# $Id: swat.config,v 1.2 2003/06/01 07:12:51 peloy Exp $ # # Source debconf library. diff --git a/packaging/Debian/debian/swat.postinst b/packaging/Debian/debian/swat.postinst index c06f3a72fb..338f8a07c2 100644 --- a/packaging/Debian/debian/swat.postinst +++ b/packaging/Debian/debian/swat.postinst @@ -1,6 +1,5 @@ #!/bin/sh # -# $Id: swat.postinst,v 1.3 2003/06/01 07:12:51 peloy Exp $ # PATH=/sbin:/bin:/usr/sbin:/usr/bin diff --git a/packaging/Debian/debian/swat.postrm b/packaging/Debian/debian/swat.postrm index 30fa0d63c8..6bc5873096 100644 --- a/packaging/Debian/debian/swat.postrm +++ b/packaging/Debian/debian/swat.postrm @@ -1,6 +1,5 @@ #!/bin/sh # -# $Id: swat.postrm,v 1.3 2003/06/01 07:12:51 peloy Exp $ # case "$1" in diff --git a/packaging/Debian/debian/winbind.init b/packaging/Debian/debian/winbind.init index b7c2389dab..2dfdf3b835 100644 --- a/packaging/Debian/debian/winbind.init +++ b/packaging/Debian/debian/winbind.init @@ -2,7 +2,6 @@ # # Start/stops the winbindd daemon. # -# $Id: winbind.init,v 1.2 2003/06/01 07:12:51 peloy Exp $ # PATH=/sbin:/bin:/usr/sbin:/usr/bin diff --git a/packaging/Mandrake/makerpms-cvs.sh b/packaging/Mandrake/makerpms-cvs.sh index 72c75b772b..08c4370b31 100644 --- a/packaging/Mandrake/makerpms-cvs.sh +++ b/packaging/Mandrake/makerpms-cvs.sh @@ -22,13 +22,16 @@ done #Change up three directories, rename directory to samba-$VERSION, change back #then run makerpms.sh -( + CURRENT=$(pwd) -cd $(dirname $(dirname $(dirname $CURRENT))) +pushd $(dirname $(dirname $(dirname $CURRENT))) SAMBA_DIR=$(basename $(dirname $(dirname $CURRENT))) mv $SAMBA_DIR samba-$VERSION -cd samba-$VERSION/packaging/Mandrake +pushd samba-$VERSION/source +./autogen.sh +popd +pushd samba-$VERSION/packaging/Mandrake sh makerpms.sh $@ -cd $(dirname $(dirname $(dirname $CURRENT))) +popd mv samba-$VERSION $SAMBA_DIR -) +popd diff --git a/packaging/Mandrake/makerpms.sh.tmpl b/packaging/Mandrake/makerpms.sh.tmpl index ba4eff0e2b..5d06e2bbcc 100644 --- a/packaging/Mandrake/makerpms.sh.tmpl +++ b/packaging/Mandrake/makerpms.sh.tmpl @@ -13,8 +13,8 @@ # # rpm --eval should always give a correct answer for this -SPECDIR=`rpm --eval "%{_specdir}"` -SRCDIR=`rpm --eval "%{_sourcedir}"` +SPECDIR=`rpm "$@" --eval "%{_specdir}"` +SRCDIR=`rpm "$@" --eval "%{_sourcedir}"` # At this point the (SPECDIR and) SRCDIR vaiables must have a value! diff --git a/packaging/Mandrake/samba-print-pdf.sh b/packaging/Mandrake/samba-print-pdf.sh index 07c92b484b..973bb4f90e 100644 --- a/packaging/Mandrake/samba-print-pdf.sh +++ b/packaging/Mandrake/samba-print-pdf.sh @@ -5,7 +5,20 @@ # and turn it into a PDF, informing the user of where it is when it # is done # -# Buchan Milne 20020723 +# (c) Buchan Milne 2002 +# License: GPLv2 +# Changelog +# v0.0.6 20030428 +# - Allow options passed as env. variables from print command +# - Inline and simplify sed (use tr) clean script +# - Ensure file arrives in PREFIX even if TEMP is used without provided name +# - Changes from Joshua M. Schmidlkofer 20030425 +# - Debugging, adjustments, and corrections. +# - Stupid sed sanitizing script. [probably horribly inefficient also]. +# - Temp file usage cleanup. +# v0.0.5 20020723 +# - Add support for preset settings +# - Allow passing of filename provided by client as final filename # # Arguments: # $1 = file (usually passed with %s from samba) @@ -18,61 +31,80 @@ # # If you want to customise any of the following configuration defaults, # you can place them in the file /etc/samba/print-pdf.conf. +# If you need to modify anything in this script, please provide me with your +# changes, preferably in such a way that the changes are configurable. PS2PDF=ps2pdf13 OPTIONS="-dAutoFilterColorImages=false -sColorImageFilter=FlateEncode" +#Values taken from arguments: INPUT=$1 -KEEP_PS=1 -PERMS=640 -INFILE=$(basename $INPUT) -BASEFILE=pdf-service PREFIX="$2" -NAME="$6" WINBASE=$(echo "$3"|sed -e 's,/,\\\\,g') +#NAME=`echo "$6"|sed -e 's/[&/:{}\\\[<>$#@*^!?=|]/-/g;s/\]/-/g'` +NAME=`echo "$6"|tr '[:punct:]' '[-*]'` # Source config file if it exists: CONFFILE=/etc/samba/print-pdf.conf [ -e $CONFFILE ] && . $CONFFILE +#Values not taken as arguments, could be set via env. vars (?) or config file +KEEP_PS=${KEEP_PS=0} +PERMS=${PERMS=640} +BASEFILE=${BASEFILE=pdf-service} +TEMP="${TEMP=$2}" +UMASK=${UMASK=006} + +#Make sure that destination directory exists +mkdir -p "$PREFIX" + +INFILE=$(basename $INPUT) + +umask $UMASK + +[ -n "$NAME" ] && TEMP="$PREFIX" + #make a temp file to use for the output of the PDF -OUTPUT=`mktemp -q $2/$BASEFILE-XXXXXX` +OUTPUT=`mktemp -q $TEMP/$BASEFILE-XXXXXX` if [ $? -ne 0 ]; then - echo "$0: Can't create temp file $2/$BASEFILE-XXXXXX, exiting..." + echo "$0: Can't create temp file $TEMP/$OUTPUT, exiting..." exit 1 fi -if [ "$NAME" != "" ]; then +if [ -n "$NAME" ]; then FINALOUTPUT="$PREFIX/$NAME" else FINALOUTPUT="$OUTPUT" fi -if [ "$7" != "" ]; then +if [ -n "$7" ]; then OPTIONS="$OPTIONS -dPDFSETTINGS=/${7#pdf-}" else OPTIONS="$OPTIONS -dPDFSETTINGS=/default" fi - + WIN_OUTPUT="$WINBASE\\"`basename "$FINALOUTPUT"` +#mv "$INPUT" "$INPUT.ps";INPUT="$INPUT.ps" -# create the PDF: -$PS2PDF $OPTIONS $INPUT "$OUTPUT".pdf >/dev/null 2>&1 -mv -f "$OUTPUT".pdf "$FINALOUTPUT".pdf +# create the pdf +$PS2PDF $OPTIONS "$INPUT" "$OUTPUT.pdf" >/dev/null 2>&1 +mv -f "${OUTPUT}.pdf" "${FINALOUTPUT}".pdf # Generate a message to send to the user, and deal with the original file: MESSAGE=$(echo "Your PDF file has been created as $WIN_OUTPUT.pdf\n") -if [ $KEEP_PS ];then + +# Cleanup +if [ $KEEP_PS != 0 ];then mv -f $INPUT "${FINALOUTPUT}".ps MESSAGE=$(echo "$MESSAGE and your postscript file as $WIN_OUTPUT.ps") # Fix permissions on the generated files - chmod $PERMS "${FINALOUTPUT}".ps + chmod $PERMS "${FINALOUTPUT}".ps "${FINALOUTPUT}".pdf else rm -f $INPUT - chmod $PERMS "${FINALOUTPUT}".ps "${FINALOUTPUT}".pdf # Fix permissions on the generated files + chmod $PERMS "${FINALOUTPUT}".pdf fi - + #Remove empty file from mktemp: -[ "x$NAME" -eq "x" ] && rm -f $OUTPUT +rm -f $OUTPUT # Send notification to user echo -e $MESSAGE|smbclient -M $4 -I $5 -U "PDF Generator" >/dev/null 2>&1 diff --git a/packaging/Mandrake/samba2.spec.tmpl b/packaging/Mandrake/samba2.spec.tmpl index 47f61eea64..5d8e03438e 100644 --- a/packaging/Mandrake/samba2.spec.tmpl +++ b/packaging/Mandrake/samba2.spec.tmpl @@ -13,19 +13,11 @@ # cvs should be submitted for inclusion in samba cvs. %define pkg_name samba -%define ver 3.0alpha22 -%define rel 2mdk -%define vscanver 0.3.1 +%define ver 3.0.0beta2 +%define rel 3mdk +%define vscanver 0.3.3beta1 %define libsmbmajor 0 -# Determine whether this is the system samba or not. -%define build_system 0 -%if %build_system -%define samba_major %{null} -%else -%define samba_major 3 -%endif - # Version and release replaced by samba-team at release from samba cvs %define pversion PVERSION %define prelease PRELEASE @@ -36,6 +28,8 @@ %if %have_pversion %define source_ver %{pversion} +%global _unpackaged_files_terminate_build 0 +%global _missing_doc_files_terminate_build 0 %else %define source_ver %{ver} %endif @@ -59,6 +53,7 @@ # We now do detection of the Mandrake release we are building on: #%define build_cooker %(if [ `awk '{print $3}' /etc/mandrake-release` = "Cooker" ];then echo 1; else echo 0; fi) #%define build_cooker %(if [[ `cat /etc/mandrake-release|grep Cooker` ]];then echo 1; else echo 0; fi) +%define build_mdk92 %(if [ `awk '{print $4}' /etc/mandrake-release` = 9.2 ];then echo 1; else echo 0; fi) %define build_mdk91 %(if [ `awk '{print $4}' /etc/mandrake-release` = 9.1 ];then echo 1; else echo 0; fi) %define build_mdk90 %(if [ `awk '{print $4}' /etc/mandrake-release` = 9.0 ];then echo 1; else echo 0; fi) %define build_mdk82 %(if [ `awk '{print $4}' /etc/mandrake-release` = 8.2 ];then echo 1; else echo 0; fi) @@ -68,6 +63,7 @@ %define build_non_default 0 # Default options +%define build_system 0 %define build_acl 1 %define build_winbind 1 %define build_wins 1 @@ -78,6 +74,10 @@ %define build_cupspc 0 # Set defaults for each version +%if %build_mdk92 +%define build_cupspc 1 +%endif + %if %build_mdk91 %define build_cupspc 1 %endif @@ -97,40 +97,45 @@ %define build_acl 0 %define build_winbind 0 %define build_wins 0 +%define build_ads 0 %endif %if %build_mdk72 %define build_acl 0 %define build_winbind 0 %define build_wins 0 +%define build_ads 0 %endif + # Allow commandline option overrides (borrowed from Vince's qmail srpm): # To use it, do rpm [-ba|--rebuild] --with 'xxx' # Check if the rpm was built with the defaults, otherwise we inform the user %define build_non_default 0 -%{?_with_acl: %{expand: %%define build_acl 1}} -%{?_with_acl: %{expand: %%define build_non_default 1}} -%{?_without_acl: %{expand: %%define build_acl 0}} -%{?_without_acl: %{expand: %%define build_non_default 1}} +%{?_with_system: %{expand: %%global build_system 1}} +%{?_without_system: %{expand: %%global build_system 0}} +%{?_with_acl: %{expand: %%global build_acl 1}} +%{?_with_acl: %{expand: %%global build_non_default 1}} +%{?_without_acl: %{expand: %%global build_acl 0}} +%{?_without_acl: %{expand: %%global build_non_default 1}} %{?_with_winbind: %{expand: %%global build_winbind 1}} -%{?_with_winbind: %{expand: %%define build_non_default 1}} -%{?_without_winbind: %{expand: %%define build_winbind 0}} -%{?_without_winbind: %{expand: %%define build_non_default 1}} +%{?_with_winbind: %{expand: %%global build_non_default 1}} +%{?_without_winbind: %{expand: %%global build_winbind 0}} +%{?_without_winbind: %{expand: %%global build_non_default 1}} %{?_with_wins: %{expand: %%global build_wins 1}} -%{?_with_wins: %{expand: %%define build_non_default 1}} +%{?_with_wins: %{expand: %%global build_non_default 1}} %{?_without_wins: %{expand: %%global build_wins 0}} -%{?_without_wins: %{expand: %%define build_non_default 1}} +%{?_without_wins: %{expand: %%global build_non_default 1}} %{?_with_ldap: %{expand: %%global build_ldap 1}} -%{?_with_ldap: %{expand: %%define build_non_default 1}} +%{?_with_ldap: %{expand: %%global build_non_default 1}} %{?_without_ldap: %{expand: %%global build_ldap 0}} -%{?_without_ldap: %{expand: %%define build_non_default 1}} -%{?_with_ads: %{expand: %%define build_ads 1}} -%{?_with_ads: %{expand: %%define build_non_default 1}} -%{?_without_ads: %{expand: %%define build_ads 0}} -%{?_without_ads: %{expand: %%define build_non_default 1}} -%{?_with_scanners: %{expand: %%define build_scanners 1}} -%{?_with_scanners: %{expand: %%define build_non_default 1}} +%{?_without_ldap: %{expand: %%global build_non_default 1}} +%{?_with_ads: %{expand: %%global build_ads 1}} +%{?_with_ads: %{expand: %%global build_non_default 1}} +%{?_without_ads: %{expand: %%global build_ads 0}} +%{?_without_ads: %{expand: %%global build_non_default 1}} +%{?_with_scanners: %{expand: %%global build_scanners 1}} +%{?_with_scanners: %{expand: %%global build_non_default 1}} # As if that weren't enough, we're going to try building with antivirus # support as an option also @@ -162,9 +167,26 @@ %endif %global vfsdir examples.bin/VFS +#Standard texts for descriptions: +%define message_bugzilla() %(echo -e -n "Please file bug reports for this package at Mandrake bugzilla \\n(http://qa.mandrakesoft.com) under the product name %{1}") +%define message_system %(echo -e -n "NOTE: This is a prerelease of samba-%{samba_major}, not intended for production\\n use. Rather these packages are provided, parallel installable\\nwith samba-2.2.x, for testing purposes") + +%ifarch alpha +%define build_expsam xml +%else +%define build_expsam mysql,xml +%endif + #Workaround missing macros in 8.x: %{!?perl_vendorlib: %{expand: %%global perl_vendorlib %{perl_sitearch}/../}} +# Determine whether this is the system samba or not. +%if %build_system +%define samba_major %{nil} +%else +%define samba_major 3 +%endif + Summary: Samba SMB server. Name: %{pkg_name}%{samba_major} @@ -193,9 +215,9 @@ Source: ftp://samba.org/pub/samba/samba-%{source_ver}.tar.bz2 URL: http://www.samba.org Source1: samba.log Source3: samba.xinetd -Source4: swat_48.xpm.bz2 -Source5: swat_32.xpm.bz2 -Source6: swat_16.xpm.bz2 +Source4: swat_48.png.bz2 +Source5: swat_32.png.bz2 +Source6: swat_16.png.bz2 Source7: README.%{name}-mandrake-rpm %if %build_vscan Source8: samba-vscan-%{vscanver}.tar.bz2 @@ -207,9 +229,7 @@ Patch3: samba-2.2.0-buildroot.patch.bz2 Patch4: samba-3.0-smbmount-sbin.patch.bz2 %if !%have_pversion # Version specific patches: current version -Patch101: samba-Makefile-3.0alpha21.patch.bz2 -Patch102: samba-3.0alpha22-mandrake-packaging.patch.bz2 -Patch110: samba-2.2.7a-fix-build.patch.bz2 +Patch100: samba-3.0.0beta2-mandrake-packaging.patch.bz2 %else # Version specific patches: upcoming version %endif @@ -218,9 +238,11 @@ Patch110: samba-2.2.7a-fix-build.patch.bz2 %if %have_pversion && %have_pre %endif Requires: pam >= 0.64, samba-common = %{version} -BuildRequires: pam-devel autoconf readline-devel +BuildRequires: pam-devel readline-devel libncurses-devel popt-devel BuildRequires: libxml2-devel +%ifnarch alpha BuildRequires: mysql-devel +%endif %if %build_acl BuildRequires: libacl-devel %endif @@ -260,12 +282,12 @@ This binary release includes encrypted password support. Please read the smb.conf file and ENCRYPTION.txt in the docs directory for implementation details. - +%if %have_pversion +%message_bugzilla samba3 +%endif %if !%build_system -NOTE: This is a prerelease of samba-%{samba_major}, not intended -for production use. If something breaks, file a bug report. +%message_system %endif - %if %build_non_default WARNING: This RPM was built with command-line options. Please see README.%{name}-mandrake-rpm in the documentation for @@ -281,7 +303,9 @@ Group: Networking/Other %if %build_system Provides: samba Obsoletes: samba +Provides: samba-server-ldap Obsoletes: samba-server-ldap +Provides: samba3-server Obsoletes: samba3-server %else #Provides: samba-server @@ -306,21 +330,11 @@ This binary release includes encrypted password support. Please read the smb.conf file and ENCRYPTION.txt in the docs directory for implementation details. - -%if %build_ldap -This package was compiled with LDAP support, which means that -passwords can be stored in LDAP or in smbpasswd files. -To migrate your passwords from smbpasswd into LDAP, try -examples/LDAP/import_smbpasswd.pl using: -%{_datadir}/%{name}/scripts/import_smbpasswd.pl %{SOURCE7} echo "an identical rpm, you need to supply the following options">>%{SOURCE7} echo "at build time: $RPM_EXTRA_OPTIONS">>%{SOURCE7} echo -e "\n%{name}-%{version}-%{release}\n">>%{SOURCE7} -%else +%else echo "This rpm was built with default options">%{SOURCE7} echo -e "\n%{name}-%{version}-%{release}\n">>%{SOURCE7} %endif @@ -664,11 +754,7 @@ echo -e "\n%{name}-%{version}-%{release}\n">>%{SOURCE7} # Version specific patches: current version %if !%have_pversion echo "Applying patches for current version: %{ver}" -(cd source -%patch101 -) -%patch102 -p1 -b .mdk -%patch110 -p1 +%patch100 -p1 -b .mdk %else # Version specific patches: upcoming version echo "Applying patches for new versions: %{pversion}" @@ -680,7 +766,7 @@ echo "Appling patches which should only be applied to prereleases" %endif # Fix quota compilation in glibc>2.3 -%if %build_mdk91 +%if %build_mdk91 || %build_mdk92 #grep "" source/smbd/quotas.c >/dev/null && \ perl -pi -e 's@@@' source/smbd/quotas.c %endif @@ -712,8 +798,6 @@ perl -pi -e 's/%{pkg_name}/%{name}/g' source/auth/pampass.c %build #%serverbuild (cd source -autoconf -CPPFLAGS="-I/usr/include/openssl"; export CPPFLAGS CFLAGS="$RPM_OPT_FLAGS" # Don't use --with-fhs now, since it overrides libdir, it sets configdir, # lockdir,piddir logfilebase,privatedir and swatdir @@ -746,24 +830,25 @@ CFLAGS="$RPM_OPT_FLAGS" --with-acl-support \ %endif --disable-mysqltest \ + --with-expsam=%build_expsam \ --program-suffix=%{samba_major} -# --with-pam_smbpass \ +# --with-shared-modules=pdb_ldap,idmap_ldap \ # --with-manpages-langs=en,ja,pl \ -# --with-ldap=no \ -#%if !%build_system +#_if !%build_system # --with-smbwrapper \ -#%endif +#_endif # --with-nisplussam \ # --with-fhs \ -# For some reason passdb/pdb_xml.c doesn't like the flags below ... -# and the samba team doesn't always make proto before release ... +#Fix the make file so we don't create debug information on 9.2 +%if %build_mdk92 +perl -pi -e 's/-g //g' Makefile +%endif + make proto_exists -make passdb/pdb_xml.o torture -# torture target broken in alpha22 (only on 9.0?) -make CFLAGS="$RPM_OPT_FLAGS -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE" \ - all libsmbclient debug2html smbfilter wins modules -# all libsmbclient debug2html smbfilter wins torture modules +%make all libsmbclient smbfilter wins modules %{!?_without_test: torture debug2html} bin/editreg + + # Build VFS modules (experimental) #cd ../%vfsdir #_configure --prefix=%{prefix} \ @@ -787,7 +872,10 @@ echo "Building fprot" %endif %if %build_kaspersky echo "Building Kaspersky" -(cd %{vfsdir}/%{vscandir}/kaspersky;make) +(cd %{vfsdir}/%{vscandir}/kavp + perl -p -i -e "s|/usr/local/|/usr/|g" Makefile.KAV4 + make -f Makefile.KAV4 +) %endif %if %build_mks echo "Building mks" @@ -825,6 +913,8 @@ mkdir -p $RPM_BUILD_ROOT%{_libdir}/%{name}/vfs (cd source make DESTDIR=$RPM_BUILD_ROOT LIBDIR=%{_libdir}/%{name} install installclientlib installmodules) +install -m755 source/bin/editreg %{buildroot}/%{_bindir} + #need to stay mkdir -p $RPM_BUILD_ROOT/sbin mkdir -p $RPM_BUILD_ROOT/etc/{logrotate.d,pam.d,xinetd.d} @@ -846,6 +936,8 @@ mkdir -p $RPM_BUILD_ROOT%{_datadir}/%{name}/scripts install -m 755 source/bin/pam_smbpass.so $RPM_BUILD_ROOT/%{_lib}/security/pam_smbpass%{samba_major}.so install -m 755 source/nsswitch/pam_winbind.so $RPM_BUILD_ROOT/%{_lib}/security/pam_winbind%{samba_major}.so +install -m755 source/bin/libsmbclient.a $RPM_BUILD_ROOT%{_libdir}/libsmbclient.a + # smbsh forgotten #install -m 755 source/bin/smbsh $RPM_BUILD_ROOT%{_bindir}/ @@ -867,13 +959,6 @@ install -m 755 source/nsswitch/pam_winbind.so $RPM_BUILD_ROOT/%{_lib}/security/p fi done -#These scripts are not handled by make: -#for i in addtosmbpass mksmbpasswd.sh smbtar convert_smbpasswd -for i in addtosmbpass mksmbpasswd.sh convert_smbpasswd -do - install -m755 source/script/$i $RPM_BUILD_ROOT/%{_bindir} -done - #libnss_* not handled by make: # Install the nsswitch library extension file for i in wins winbind; do @@ -882,8 +967,7 @@ done # Make link for wins and winbind resolvers ( cd $RPM_BUILD_ROOT/%{_lib}; ln -s libnss_wins%{samba_major}.so libnss_wins%{samba_major}.so.2; ln -s libnss_winbind%{samba_major}.so libnss_winbind%{samba_major}.so.2) -%if 1 -# Debugging stuff (broken in alpha22) +%if %{?_without_test:0}%{!?_without_test:1} for i in smbtorture msgtest masktest locktest locktest2 nsstest vfstest debug2html;do install -m755 source/bin/$i $RPM_BUILD_ROOT/%{_bindir} done @@ -899,7 +983,7 @@ done install -m755 packaging/Mandrake/smb.init $RPM_BUILD_ROOT/etc/rc.d/init.d/smb%{samba_major} install -m755 packaging/Mandrake/smb.init $RPM_BUILD_ROOT/%{_sbindir}/%{name} install -m755 packaging/Mandrake/winbind.init $RPM_BUILD_ROOT/etc/rc.d/init.d/winbind%{samba_major} - install -m755 packaging/Mandrake/wrepld.init $RPM_BUILD_ROOT/etc/rc.d/init.d/wrepld%{samba_major} +# install -m755 packaging/Mandrake/wrepld.init $RPM_BUILD_ROOT/etc/rc.d/init.d/wrepld%{samba_major} install -m755 packaging/Mandrake/winbind.init $RPM_BUILD_ROOT/%{_sbindir}/winbind%{samba_major} install -m644 packaging/Mandrake/samba.pamd $RPM_BUILD_ROOT/etc/pam.d/%{name} install -m644 packaging/Mandrake/system-auth-winbind.pamd $RPM_BUILD_ROOT/etc/pam.d/system-auth-winbind%{samba_major} @@ -928,6 +1012,7 @@ done # Samba smbpasswd migration script: install -m700 examples/LDAP/export_smbpasswd.pl $RPM_BUILD_ROOT/%{_datadir}/%{name}/scripts/ install -m700 examples/LDAP/import_smbpasswd.pl $RPM_BUILD_ROOT/%{_datadir}/%{name}/scripts/ +install -m755 examples/LDAP/convertSambaAccount $RPM_BUILD_ROOT/%{_datadir}/%{name}/scripts/ @@ -966,19 +1051,27 @@ perl -pi -e 's/printcap name = lpstat/printcap name = cups/g' $RPM_BUILD_ROOT/et mkdir -p $RPM_BUILD_ROOT%{_menudir} cat > $RPM_BUILD_ROOT%{_menudir}/%{name}-swat << EOF -?package(%{name}-swat):command="gnome-moz-remote http://localhost:901/" needs="gnome" \ -icon="swat%{samba_major}.xpm" section="Configuration/Networking" title="Samba Configuration" \ +?package(%{name}-swat):\ +command="gnome-moz-remote http://localhost:901/" \ +needs="gnome" \ +icon="swat%{samba_major}.png" \ +section="Configuration/Networking" \ +title="Samba Configuration (SWAT)" \ longtitle="The Swat Samba Administration Tool" -?package(%{name}-swat):command="sh -c '\$BROWSER http://localhost:901/'" needs="x11" \ -icon="swat%{samba_major}.xpm" section="Configuration/Networking" title="Samba Configuration" \ +?package(%{name}-swat):\ +command="sh -c '\$BROWSER http://localhost:901/'" \ +needs="x11" \ +icon="swat%{samba_major}.png" \ +section="Configuration/Networking" \ +title="Samba Configuration (SWAT)" \ longtitle="The Swat Samba Administration Tool" EOF mkdir -p $RPM_BUILD_ROOT%{_liconsdir} $RPM_BUILD_ROOT%{_iconsdir} $RPM_BUILD_ROOT%{_miconsdir} -bzcat %{SOURCE4} > $RPM_BUILD_ROOT%{_liconsdir}/swat%{samba_major}.xpm -bzcat %{SOURCE5} > $RPM_BUILD_ROOT%{_iconsdir}/swat%{samba_major}.xpm -bzcat %{SOURCE6} > $RPM_BUILD_ROOT%{_miconsdir}/swat%{samba_major}.xpm +bzcat %{SOURCE4} > $RPM_BUILD_ROOT%{_liconsdir}/swat%{samba_major}.png +bzcat %{SOURCE5} > $RPM_BUILD_ROOT%{_iconsdir}/swat%{samba_major}.png +bzcat %{SOURCE6} > $RPM_BUILD_ROOT%{_miconsdir}/swat%{samba_major}.png bzcat %{SOURCE10}> $RPM_BUILD_ROOT%{_datadir}/%{name}/scripts/print-pdf @@ -1024,7 +1117,7 @@ rm -rf $RPM_BUILD_ROOT %post server %_post_service smb%{samba_major} -%_post_service wrepld%{samba_major} +#%_post_service wrepld%{samba_major} # Add a unix group for samba machine accounts groupadd -frg 421 machines @@ -1138,7 +1231,7 @@ fi %preun server %_preun_service smb%{samba_major} -%_preun_service wrepld%{samba_major} +#%_preun_service wrepld%{samba_major} if [ $1 = 0 ] ; then # /sbin/chkconfig --level 35 smb reset @@ -1196,26 +1289,23 @@ fi %{_sbindir}/%{name} %{_sbindir}/smbd%{samba_major} %{_sbindir}/nmbd%{samba_major} -%{_sbindir}/wrepld%{samba_major} +#%{_sbindir}/wrepld%{samba_major} %{_bindir}/smbcontrol%{samba_major} #%{_sbindir}/mkntpwd -%{_bindir}/addtosmbpass%{samba_major} -%{_bindir}/mksmbpasswd.sh %{_bindir}/smbstatus%{samba_major} -%{_bindir}/convert_smbpasswd%{samba_major} %{_bindir}/pdbedit%{samba_major} -%{_bindir}/smbgroupedit%{samba_major} %{_bindir}/tdbbackup%{samba_major} %{_bindir}/profiles%{samba_major} +%{_bindir}/editreg%{samba_major} %attr(755,root,root) /%{_lib}/security/pam_smbpass* -%{_libdir}/%{name}/vfs/vfs_audit.so -%{_libdir}/%{name}/vfs/vfs_netatalk.so -%{_libdir}/%{name}/vfs/vfs_recycle.so -%{_libdir}/%{name}/vfs/vfs_extd_audit.so +%dir %{_libdir}/%{name}/vfs +%{_libdir}/%{name}/vfs/*.so +%dir %{_libdir}/%{name}/pdb + #/usr/share/swat %attr(-,root,root) %config(noreplace) /etc/%{name}/smbusers %attr(-,root,root) %config %{_initrddir}/smb%{samba_major} -%attr(-,root,root) %config %{_initrddir}/wrepld%{samba_major} +#%attr(-,root,root) %config %{_initrddir}/wrepld%{samba_major} %attr(-,root,root) %config(noreplace) /etc/logrotate.d/%{name} %attr(-,root,root) %config(noreplace) /etc/pam.d/%{name} #%attr(-,root,root) %config(noreplace) /etc/%{name}/samba-slapd.include @@ -1225,12 +1315,15 @@ fi %{_mandir}/man8/smbd*.8* %{_mandir}/man8/nmbd*.8* %{_mandir}/man8/pdbedit*.8* -%{_mandir}/man8/smbgroupedit*.8* %{_mandir}/man1/smbcontrol*.1* +%{_mandir}/man8/tdbbackup*.8* +%{_mandir}/man1/profiles*.1* +%{_mandir}/man1/editreg*.1* %attr(775,root,root) %dir %{_localstatedir}/%{name}/netlogon %attr(775,root,root) %dir %{_localstatedir}/%{name}/profiles -%attr(775,root,root) %dir %{_localstatedir}/%{name}/printers/* +%attr(775,root,root) %dir %{_localstatedir}/%{name}/printers %attr(1777,root,root) %dir /var/spool/%{name} +%dir %{_datadir}/%{name} %dir %{_datadir}/%{name}/scripts %attr(0755,root,root) %{_datadir}/%{name}/scripts/print-pdf #%attr(0750,root,root) %{_datadir}/%{name}/scripts/smbldap*.pl @@ -1238,6 +1331,7 @@ fi #%attr(0644,root,root) %{_datadir}/%{name}/scripts/smbldap_tools.pm #%{perl_vendorlib}/*.pm %attr(0700,root,root) %{_datadir}/%{name}/scripts/*port_smbpasswd.pl +%attr(0755,root,root) %{_datadir}/%{name}/scripts/convertSambaAccount %files doc @@ -1256,9 +1350,9 @@ fi #%attr(-,root,root) /sbin/* %{_sbindir}/swat%{samba_major} %{_menudir}/%{name}-swat -%{_miconsdir}/*.xpm -%{_liconsdir}/*.xpm -%{_iconsdir}/*.xpm +%{_miconsdir}/*.png +%{_liconsdir}/*.png +%{_iconsdir}/*.png %attr(-,root,root) %{_datadir}/swat%{samba_major}/help/* %attr(-,root,root) %{_datadir}/swat%{samba_major}/images/* %attr(-,root,root) %{_datadir}/swat%{samba_major}/include/* @@ -1277,6 +1371,9 @@ fi %{_mandir}/man8/smbmnt*.8* %{_mandir}/man8/smbmount*.8* %{_mandir}/man8/smbumount*.8* +%else +%exclude %{_bindir}/smb*m*nt%{samba_major} +%exclude %{_mandir}/man8/smb*m*nt*.8* %endif %{_bindir}/nmblookup%{samba_major} %{_bindir}/findsmb%{samba_major} @@ -1306,28 +1403,35 @@ fi #%{_bindir}/smbsh%{samba_major} %{_bindir}/smbpasswd%{samba_major} %{_bindir}/smbcacls%{samba_major} +%{_bindir}/smbcquotas%{samba_major} %{_bindir}/net%{samba_major} %{_bindir}/smbtree%{samba_major} %{_bindir}/ntlm_auth%{samba_major} #%{_libdir}/smbwrapper%{samba_major}.so +%dir %{_libdir}/%{name} %{_libdir}/%{name}/*.dat #%{_libdir}/%{name}/lowcase.dat #%{_libdir}/%{name}/valid.dat -%attr(-,root,root) %config(noreplace) /etc/%{name}/smb.conf -%attr(-,root,root) %config(noreplace) /etc/%{name}/smb-winbind.conf -%attr(-,root,root) %config(noreplace) /etc/%{name}/lmhosts +%dir %{_sysconfdir}/%{name} +%attr(-,root,root) %config(noreplace) %{_sysconfdir}/%{name}/smb.conf +%attr(-,root,root) %config(noreplace) %{_sysconfdir}/%{name}/smb-winbind.conf +%attr(-,root,root) %config(noreplace) %{_sysconfdir}/%{name}/lmhosts +%dir %{_localstatedir}/%{name} %attr(-,root,root) %{_localstatedir}/%{name}/codepages #%{_mandir}/man1/make_smbcodepage*.1* #%{_mandir}/man1/make_unicodemap*.1* %{_mandir}/man1/testparm*.1* %{_mandir}/man1/rpcclient*.1* -%exclude %{_mandir}/man1/smbsh*.1* %{_mandir}/man1/testprns*.1* %{_mandir}/man5/smb.conf*.5* %{_mandir}/man5/lmhosts*.5* %{_mandir}/man8/smbpasswd*.8* %{_mandir}/man1/smbcacls*.1* +%{_mandir}/man1/smbcquotas*.1* %{_mandir}/man8/net*.8* +%{_mandir}/man1/smbtree*.1* +%{_mandir}/man1/ntlm_auth*.1* +%{_mandir}/man7/Samba*.7* %if %build_winbind %files winbind @@ -1349,8 +1453,8 @@ fi %attr(755,root,root) /%{_lib}/libnss_wins%{samba_major}.so* %endif -%if 1 -%files debug +%if %{?_without_test:0}%{!?_without_test:1} +%files test %defattr(-,root,root) %{_bindir}/debug2html%{samba_major} %{_bindir}/smbtorture%{samba_major} @@ -1381,13 +1485,27 @@ fi %exclude %{_includedir}/* %endif +%if %build_system +%files -n libsmbclient%{libsmbmajor}-static-devel +%defattr(-,root,root) +%{_libdir}/libsmbclient.a +%else +%exclude %{_libdir}/libsmbclient.a +%endif + +#%files passdb-ldap +#%defattr(-,root,root) +#%{_libdir}/%{name}/*/*ldap.so + +%ifnarch alpha %files passdb-mysql %defattr(-,root,root) -%{_libdir}/%{name}/*/pdb_mysql.so +%{_libdir}/%{name}/pdb/*mysql.so +%endif %files passdb-xml %defattr(-,root,root) -%{_libdir}/%{name}/*/pdb_xml.so +%{_libdir}/%{name}/pdb/*xml.so #Files for antivirus support: %if %build_fprot @@ -1446,7 +1564,72 @@ fi %doc %{vfsdir}/%{vscandir}/INSTALL %endif +%exclude %{_mandir}/man1/smbsh*.1* + %changelog +* Mon Jul 14 2003 Buchan Milne 3.0.0-0.beta2.3mdk +- place non-conditional excludes at the end of files list, to prevent causing + rpm in Mandrake <=8.2 from segfaulting when processing files. +- Update default config + +* Wed Jul 02 2003 Buchan Milne 3.0.0-0.beta2.2mdk +- 3.0.0beta2 +- manually build editreg +- Add some new man pages + +* Tue Jun 10 2003 Buchan Milne 3.0.0-0.beta1.3mdk +- add provision for passdb-ldap subpackage (it doesn't build like that yet) +- avoid debugging info on cooker/9.2 for the moment +- We probably don't need to autoconf (and can thus build on 8.1) +- We can probably build without kerberos support (and thus on 8.0) +- Don't require mysql-devel on alpha's (maybe we want to be able to disable + mysql support for other arches?) +- We shouldn't need to specifically add openssl to include path, since ssl + support is deprecated. +- png icons, change menu title to not conflict with ksambaplugin +- update to samba-vscan-0.3.3beta1, but it still does not build the vscan + modules. +- add -static-devel package +- Add buildrequires for lib packages that are picked up if installed + (ncurses, popt) in an attempt to get slbd to build samba3 +- Fix default config (P100) + +* Sun Jun 08 2003 Buchan Milne 3.0.0-0.beta1.2mdk +- Get packages into cooker (klama doesn't want to build this package ..) +- samba-vscan-0.3.2b + +* Fri Jun 06 2003 Buchan Milne 3.0-0.alpha24.2mdk +- Rename debug package to test and other fixes for rpm-4.2 +- prepare for beta1 + +* Wed Apr 30 2003 Buchan Milne 3.0-0.alpha24.1mdk +- Remove some files removed upstream +- In builds from source, don't terminate on missing docs or unpackaged files + (if only we could do it for other missing files ...) + +* Mon Apr 28 2003 Buchan Milne 3.0-0.alpha24.0mdk +- Reenable debug package by (--without debug to not build it), fixed post-a23 +- Add bugzilla note for builds from source (also intended for packages made + available on samba FTP site) at samba team request +- Fix build from CVS (run autogen.sh, pass options to all rpm commands) +- Appease distriblint, but not much to be done about /usr/share/swat3/ since + samba-doc owns some subdirs, and samba-swat others, and they can be installed + independantly. +- Apply kaspersky vscan build fix from samba2 +- Final for alpha24 + +* Wed Apr 23 2003 Buchan Milne 3.0-0.alpha23.3mdk +- Small fixes in preparation for testing as system samba +- Make debug package optional (--with debug) since it's often broken +- Add support for 9.2 (including in-line smbd quota patch for glibc2.3) +- Add --with options option, which will just show you the available options and exit + +* Sun Apr 06 2003 Buchan Milne 3.0-0.alpha23.2mdk +- Alpha23 +- buildrequire autconf2.5 +- samba-vscan 0.3.2a +- Remove patch 102 (upstreamed) + * Thu Mar 06 2003 Buchan Milne 3.0-0.alpha22.2mdk - Alpha22 - Add profiles binary to server and ntlm_auth to common @@ -1517,7 +1700,7 @@ fi warning in description if built with these options. * Wed Jan 23 2002 Buchan Milne 3.0-alpha13-0.2mdk -- Added %%if's for build_ads, which hopefully will add Active Directory +- Added if's for build_ads, which hopefully will add Active Directory Support (by request). * Thu Jan 17 2002 Buchan Milne 3.0-alpha13-0.1mdk @@ -1536,7 +1719,7 @@ fi - 3.0-alpha12 - Sync up with changes made in 2.2.2 to support Mandrake 8.0, 7.2 - Added new subpackage for swat -- More %if's for ldap. +- More if's for ldap. * Thu Dec 20 2001 Buchan Milne 3.0-alpha11-0.0mdk - 3.0-alpha11 @@ -1561,7 +1744,7 @@ fi - addtosmbpass seems to have returned for now, but make_* have disappeared! * Fri Dec 14 2001 Buchan Milne 3.0alpha6-0.0mdk -- DESTDIR patch for Makefile.in (p23), remove a lot of %install scripts +- DESTDIR patch for Makefile.in (p23), remove a lot of %%install scripts this forces move of smbcontrol and smbmnt to %{prefix}/bin removed --with-pam_smbpass as it doesn't compile. @@ -1670,7 +1853,7 @@ fi - cleanup /var/lib/samba/codepage/src * Tue Aug 21 2001 Sylvestre Taburet 2.2.1a-7mdk -- moved codepage generation to %install and codepage dir to /var/lib/samba +- moved codepage generation to %%install and codepage dir to /var/lib/samba * Tue Aug 21 2001 Sylvestre Taburet 2.2.1a-6mdk - /lib/* was in both samba and samba-common diff --git a/packaging/Mandrake/smb.conf b/packaging/Mandrake/smb.conf index f2643b774a..6024442ecd 100644 --- a/packaging/Mandrake/smb.conf +++ b/packaging/Mandrake/smb.conf @@ -48,7 +48,6 @@ # server. The printer admins (or root) may install drivers onto samba. # Note that this feature uses the print$ share, so you will need to # enable it below. -# This parameter works like domain admin group: # printer admin = @ ; printer admin = @adm # This should work well for winbind: @@ -113,7 +112,7 @@ # enable pam password change ; pam password change = yes ; passwd program = /usr/bin/passwd %u -; passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* %n\n +; passwd chat = *New*UNIX*password* %n\n *Re*ype*new*UNIX*password* %n\n \ ;*passwd:*all*authentication*tokens*updated*successfully* # Unix users can map to different SMB User names @@ -229,23 +228,26 @@ ; add machine script = /usr/share/samba/scripts/smbldap-useradd.pl -w -d /dev/null -g machines -c 'Machine Account' -s /bin/false %u # Domain groups: -# Domain groups are now configured by using the smbgroupedit tool +# Domain groups are now configured by using the 'net groupmap' tool # Samba Password Database configuration: # Samba now has runtime-configurable password database backends. Multiple # passdb backends may be used, but users will only be added to the first one # Default: -; passdb backend = smbpasswd unixsam -# TDB backen with fallback to smbpasswd and unixsam -; passdb backend = tdbsam_nua smbpasswd unixsam -# LDAP with fallback to smbpasswd unixsam +; passdb backend = smbpasswd guest +# TDB backen with fallback to smbpasswd and guest +; passdb backend = tdbsam smbpasswd guest +# LDAP with fallback to smbpasswd guest # Enable SSL by using an ldaps url, or enable tls with 'ldap ssl' below. -; passdb backend = ldapsam_nua:ldaps://ldap.mydomain.com smbpasswd unixsam +; passdb backend = ldapsam:ldaps://ldap.mydomain.com smbpasswd guest +# Use the samba2 LDAP schema: +; passdb backend = ldapsam_compat:ldaps://ldap.mydomain.com smbpasswd guest -# Non-unix account range: +# idmap uid account range: # This is a range of unix user-id's that samba will map non-unix RIDs to, -# such as machine accounts, when using a _nua passdb backend - non unix account range = 10000-20000 +# such as when using Winbind +; idmap uid = 10000-20000 +; idmap gid = 10000-20000 # LDAP configuration for Domain Controlling: # The account (dn) that samba uses to access the LDAP server @@ -258,6 +260,18 @@ ; ldap port = 389 ; ldap suffix = dc=mydomain,dc=com ; ldap server = ldap.mydomain.com +# Seperate suffixes are available for machines, users, groups, and idmap, if +# ldap suffix appears first, it is appended to the specific suffix. +# Example for a unix-ish directory layout: +; ldap machine suffix = ou=Hosts +; ldap user suffix = ou=People +; ldap group suffix = ou=Group +; ldap idmap suffix = ou=Idmap +# Example for AD-ish layout: +; ldap machine suffix = cn=Computers +; ldap user suffix = cn=Users +; ldap group suffix = cn=Groups +; ldap idmap suffix = cn=Idmap # 7. Name Resolution Options: @@ -326,7 +340,6 @@ # all users will have write access to it. See # examples/VFS/recycle/REAME in samba-doc for details ; vfs object = /usr/lib/samba/vfs/recycle.so -; vfs options= /etc/samba/recycle.conf # Un-comment the following and create the netlogon directory for Domain Logons ; [netlogon] diff --git a/packaging/README b/packaging/README index ce65137790..1cf147f3f9 100644 --- a/packaging/README +++ b/packaging/README @@ -1,7 +1,8 @@ -Copyright (C) 1997-1998 Samba-Team +Copyright (C) 1997-2003 Samba-Team Date: November 16, 1998 Updates: First Release - 19970819 19981116 + 20030329 =============================================================================== Note: @@ -36,3 +37,10 @@ ability to keep the binary distribution itself current with the released source. The future of cooperatively developed software such as Samba depends on the willingness of all partners to share the fruit of their labours. + +If you have a compelling need for binary packages for your platform and it is +not available from this packaging repository please notify jht@samba.org. We +can not guarrantee our ability to satisfy your need, but your feedback may help +us to find a solution. + +- John T. diff --git a/packaging/RedHat/makerpms.sh.tmpl b/packaging/RedHat/makerpms.sh.tmpl index 9d71452db8..dc82033b06 100644 --- a/packaging/RedHat/makerpms.sh.tmpl +++ b/packaging/RedHat/makerpms.sh.tmpl @@ -28,6 +28,7 @@ SRCDIR=${SRCDIR:-/usr/src/redhat/SOURCES} USERID=`id -u` GRPID=`id -g` VERSION='PVERSION' +SPECFILE="samba3.spec" RPMVER=`rpm --version | awk '{print $3}'` RPM="rpm" @@ -36,24 +37,21 @@ echo The RPM Version on this machine is: $RPMVER case $RPMVER in 2*) echo Building for RPM v2.x - sed -e "s/MANDIR_MACRO/\%\{prefix\}\/man/g" < samba2.spec > samba.spec - sed -e "s/MANDIR_MACRO/\%\{prefix\}\/man/g" < samba2-devel.spec > samba-devel.spec + sed -e "s/MANDIR_MACRO/\%\{prefix\}\/man/g" < samba.spec > $SPECFILE ;; 3*) echo Building for RPM v3.x - sed -e "s/MANDIR_MACRO/\%\{prefix\}\/man/g" < samba2.spec > samba.spec - sed -e "s/MANDIR_MACRO/\%\{prefix\}\/man/g" < samba2-devel.spec > samba-devel.spec + sed -e "s/MANDIR_MACRO/\%\{prefix\}\/man/g" < samba.spec > $SPECFILE ;; - 4.1*) - echo Building for RPM v4.1 - RPM="rpmbuild" - sed -e "s/MANDIR_MACRO/\%\{_mandir\}/g" < samba2.spec > samba.spec - sed -e "s/MANDIR_MACRO/\%\{_mandir\}/g" < samba2-devel.spec > samba-devel.spec + 4.0*) + ## catch rpm v4.0.x first + echo Building for RPM v4.0 + sed -e "s/MANDIR_MACRO/\%\{_mandir\}/g" < samba.spec > $SPECFILE ;; - 4*) - echo Building for RPM v4.x - sed -e "s/MANDIR_MACRO/\%\{_mandir\}/g" < samba2.spec > samba.spec - sed -e "s/MANDIR_MACRO/\%\{_mandir\}/g" < samba2-devel.spec > samba-devel.spec + 4.*) + echo Building for RPM v4.1 or later + RPM="rpmbuild" + sed -e "s/MANDIR_MACRO/\%\{_mandir\}/g" < samba.spec > $SPECFILE ;; *) echo "Unknown RPM version: `rpm --version`" @@ -64,27 +62,13 @@ esac ( cd ../../source; if [ -f Makefile ]; then make distclean; fi ) ( cd ../../.. ; chown -R ${USERID}.${GRPID} samba-${VERSION} ) -# We do this to make sure that the package always has the current version in it''s name -if [ z$1 = z"devel" ]; then - (cd ../../.. ; mv samba samba-${VERSION} ) -fi - ( cd ../../.. ; tar --exclude=CVS -cf - samba-${VERSION}/. | bzip2 > ${SRCDIR}/samba-${VERSION}.tar.bz2 ) -cp -av samba.spec ${SPECDIR} -cp -av samba-devel.spec ${SPECDIR} +cp -av $SPECFILE ${SPECDIR} -if [ z$1 = "zdevel" ]; then - echo Restoring source samba directory name - ( cd ../../.. ; mv samba-${VERSION} samba ) - echo Getting Ready to build Developmental Build - cd ${SPECDIR} - ${RPM} -ba -v samba-devel.spec -else - echo Getting Ready to build release package - cd ${SPECDIR} - ${RPM} -ba -v --clean --rmsource samba.spec -fi +echo Getting Ready to build release package +cd ${SPECDIR} +${RPM} -ba -v --clean --rmsource $SPECFILE echo Done. diff --git a/packaging/RedHat/winbind.init b/packaging/RedHat/winbind.init index 291c351df3..17ddbd502b 100644 --- a/packaging/RedHat/winbind.init +++ b/packaging/RedHat/winbind.init @@ -20,16 +20,20 @@ fi [ ${NETWORKING} = "no" ] && exit 0 # Check that smb.conf exists. -[ -f /etc/samba/smb.conf ] || exit 0 +[ -f $CONFIG ] || exit 0 RETVAL=0 +CONFIG=/usr/local/samba/lib/smb.conf +PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/samba/sbin:/usr/local/samba/bin +export PATH + start() { echo -n "Starting Winbind services: " RETVAL=1 - if [ "`grep -i 'winbind uid' /etc/samba/smb.conf | egrep -v [\#\;]`" ]; then - daemon winbindd + if [ "`egrep -i '(idmap.*uid|winbind.*uid)' $CONFIG | egrep -v [\#\;]`" ]; then + daemon winbindd RETVAL=$? fi echo @@ -40,7 +44,7 @@ start() { stop() { echo -n "Shutting down Winbind services: " RETVAL=1 - if [ "`grep -i 'winbind uid' /etc/samba/smb.conf | egrep -v [\#\;]`" ]; then + if [ "`egrep -i '(idmap.*uid|winbind.*uid)' $CONFIG | egrep -v [\#\;]`" ]; then killproc winbindd RETVAL=$? fi diff --git a/packaging/SGI/idb.pl b/packaging/SGI/idb.pl index 72f573b8ee..529695b14b 100755 --- a/packaging/SGI/idb.pl +++ b/packaging/SGI/idb.pl @@ -132,9 +132,6 @@ while(@bins) { if ($filename eq "smbpasswd") { print IDB "f 0755 root sys usr/samba/bin/$filename $SRCPFX/source/$nextfile $PKG.sw.base \n"; } - elsif ($filename eq "findsmb") { - print IDB "f 0755 root sys usr/samba/bin/$filename $SRCPFX/packaging/SGI/$filename $PKG.sw.base\n"; - } elsif ($filename eq "swat") { print IDB "f 4755 root sys usr/samba/bin/$filename $SRCPFX/source/$nextfile $PKG.sw.base preop(\"chroot \$rbase /etc/init.d/samba stop\") exitop(\"chroot \$rbase /usr/samba/scripts/startswat.sh\") removeop(\"chroot \$rbase /sbin/cp /etc/inetd.conf /etc/inetd.conf.O ; chroot \$rbase /sbin/sed -e '/^swat/D' -e '/^#SWAT/D' /etc/inetd.conf.O >/etc/inetd.conf; /etc/killall -HUP inetd || true\")\n"; } @@ -368,11 +365,11 @@ sub get_line { $_ = ; chomp; s/^\s*/ /; - substr($line,$cont,1,$_); + substr($line,$cont,1) = $_; } $line =~ s/\$\(EXEEXT\)/$EXEEXT/g; - $line =~ s/\$\(srcdir\)/$srcdir/g; - $line =~ s/\$\(builddir\)/$builddir/g; + $line =~ s/\$\(srcdir\)//g; + $line =~ s/\$\(builddir\)//g; $line =~ s/\$\(\S*\)\s*//g; $line =~ s/\s\s*/ /g; @line = split(' ',$line); diff --git a/packaging/Solaris/makepkg.sh b/packaging/Solaris/makepkg.sh index b57e182e4a..bd370e9a62 100755 --- a/packaging/Solaris/makepkg.sh +++ b/packaging/Solaris/makepkg.sh @@ -11,37 +11,6 @@ INSTALL_BASE=/usr/local add_dynamic_entries() { - # First build the codepages and append codepage entries to prototype - echo "#\n# Codepages \n#" - echo d none samba/lib/codepages 0755 root other - - CODEPAGELIST="437 737 850 852 861 932 866 949 950 936" - # Check if make_smbcodepage exists - if [ ! -f $DISTR_BASE/source/bin/make_smbcodepage ]; then - echo "Could not find $DISTR_BASE/source/bin/make_smbcodepage to generate codepages.\n\ - Please create the binaries before packaging." >&2 - exit 1 - fi - - for p in $CODEPAGELIST; do - $DISTR_BASE/source/bin/make_smbcodepage c $p $DISTR_BASE/source/codepages/codepage_def.$p $DISTR_BASE/source/codepages/codepage.$p - echo f none samba/lib/codepages/codepage.$p=source/codepages/codepage.$p 0644 root other - done - - # Create unicode maps - if [ ! -f $DISTR_BASE/source/bin/make_unicodemap ]; then - echo "Missing $DISTR_BASE/source/bin/make_unicodemap. Aborting." >&2 - exit 1 - fi - - # Pull in all the unicode map files from source/codepages/CP*.TXT - list=`find $DISTR_BASE/source/codepages -name "CP*.TXT" | sed 's|^.*CP\(.*\)\.TXT|\1|'` - for umap in $list - do - $DISTR_BASE/source/bin/make_unicodemap $umap $DISTR_BASE/source/codepages/CP$umap.TXT $DISTR_BASE/source/codepages/unicode_map.$umap - echo f none samba/lib/codepages/unicode_map.$umap=source/codepages/unicode_map.$umap 0644 root other - done - # Add the binaries, docs and SWAT files echo "#\n# Binaries \n#" diff --git a/packaging/Solaris/pkg-specs/pkginfo b/packaging/Solaris/pkg-specs/pkginfo index d195f177e9..d24ecaefe8 100644 --- a/packaging/Solaris/pkg-specs/pkginfo +++ b/packaging/Solaris/pkg-specs/pkginfo @@ -1,7 +1,7 @@ PKG=samba NAME=SMB based file/printer sharing ARCH=sparc -VERSION=2.0.6 +VERSION=3.0.0beta3 CATEGORY=system VENDOR=Samba Group DESC=File and printer sharing for NT workstations diff --git a/packaging/Solaris/prototype.master b/packaging/Solaris/prototype.master index bfcb3e0049..ff5ba895b3 100644 --- a/packaging/Solaris/prototype.master +++ b/packaging/Solaris/prototype.master @@ -8,7 +8,6 @@ i pkginfo=./pkginfo i copyright=./copyright i request=./request -i checkinstall i preremove=./preremove i postinstall=./postinstall i i.swat=./i.swat @@ -40,10 +39,12 @@ d none samba/docs 0755 root other # f none samba/lib/smb.conf.example=examples/smb.conf.default 0644 root other d none samba/lib/regeditscripts 0755 root other -f none samba/lib/regeditscripts/NT4_PlainPassword.reg=docs/NT4_PlainPassword.reg 0444 root other -f none samba/lib/regeditscripts/Win95_PlainPassword.reg=docs/Win95_PlainPassword.reg 0444 root other -f none samba/lib/regeditscripts/Win98_PlainPassword.reg=docs/Win98_PlainPassword.reg 0444 root other -f none samba/lib/regeditscripts/Win2000_PlainPassword.reg=docs/Win2000_PlainPassword.reg 0444 root other +f none samba/lib/regeditscripts/NT4_PlainPassword.reg=docs/Registry/NT4_PlainPassword.reg 0444 root other +f none samba/lib/regeditscripts/Win95_PlainPassword.reg=docs/Registry/Win95_PlainPassword.reg 0444 root other +f none samba/lib/regeditscripts/Win98_PlainPassword.reg=docs/Registry/Win98_PlainPassword.reg 0444 root other +f none samba/lib/regeditscripts/WinME_PlainPassword.reg=docs/Registry/WinME_PlainPassword.reg 0444 root other +f none samba/lib/regeditscripts/Win2000_PlainPassword.reg=docs/Registry/Win2000_PlainPassword.reg 0444 root other +f none samba/lib/regeditscripts/WinXP_PlainPassword.reg=docs/Registry/WinXP_PlainPassword.reg 0444 root other # # Random files f none samba/docs/Samba-HOWTO-Collection.pdf=docs/Samba-HOWTO-Collection.pdf 0644 root other diff --git a/source3/Makefile.in b/source3/Makefile.in index c81fdd4a83..73ff436c6f 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -31,8 +31,10 @@ PRINTLIBS=@PRINTLIBS@ AUTHLIBS=@AUTHLIBS@ ACLLIBS=@ACLLIBS@ PASSDBLIBS=@PASSDBLIBS@ +IDMAP_LIBS=@IDMAP_LIBS@ ADSLIBS=@ADSLIBS@ KRB5LIBS=@KRB5_LIBS@ +LDAPLIBS=@LDAP_LIBS@ LINK=$(CC) $(FLAGS) $(LDFLAGS) @@ -41,8 +43,8 @@ INSTALLCLIENTCMD_SH=@INSTALLCLIENTCMD_SH@ INSTALLCLIENTCMD_A=@INSTALLCLIENTCMD_A@ VPATH=@srcdir@ -srcdir=@srcdir@ -builddir=@builddir@ +srcdir=@abs_srcdir@ +builddir=@abs_builddir@ SHELL=/bin/sh # XXX: Perhaps this should be @SHELL@ instead -- apparently autoconf @@ -60,6 +62,7 @@ LIBDIR = @libdir@ VFSLIBDIR = $(LIBDIR)/vfs PDBLIBDIR = $(LIBDIR)/pdb RPCLIBDIR = $(LIBDIR)/rpc +IDMAPLIBDIR = $(LIBDIR)/idmap CHARSETLIBDIR = $(LIBDIR)/charset AUTHLIBDIR = $(LIBDIR)/auth CONFIGDIR = @configdir@ @@ -104,7 +107,6 @@ FLAGS3 = FLAGS4 = FLAGS5 = $(FLAGS1) $(FLAGS2) $(FLAGS3) $(FLAGS4) FLAGS = $(ISA) $(FLAGS5) -FLAGS32 = $(ISA32) $(FLAGS5) PASSWD_FLAGS = -DSMB_PASSWD_FILE=\"$(SMB_PASSWD_FILE)\" -DPRIVATE_DIR=\"$(PRIVATE_DIR)\" PATH_FLAGS1 = -DCONFIGFILE=\"$(CONFIGFILE)\" -DSBINDIR=\"$(SBINDIR)\" @@ -118,8 +120,7 @@ PATH_FLAGS = $(PATH_FLAGS6) $(PASSWD_FLAGS) # Note that all executable programs now provide for an optional executable suffix. -SBIN_PROGS = bin/smbd@EXEEXT@ bin/nmbd@EXEEXT@ bin/swat@EXEEXT@ \ - bin/wrepld@EXEEXT@ @EXTRA_SBIN_PROGS@ +SBIN_PROGS = bin/smbd@EXEEXT@ bin/nmbd@EXEEXT@ bin/swat@EXEEXT@ @EXTRA_SBIN_PROGS@ BIN_PROGS1 = bin/smbclient@EXEEXT@ bin/net@EXEEXT@ bin/smbspool@EXEEXT@ \ bin/testparm@EXEEXT@ bin/testprns@EXEEXT@ bin/smbstatus@EXEEXT@ @@ -127,7 +128,11 @@ BIN_PROGS2 = bin/smbcontrol@EXEEXT@ bin/smbtree@EXEEXT@ bin/tdbbackup@EXEEXT@ \ bin/nmblookup@EXEEXT@ bin/pdbedit@EXEEXT@ BIN_PROGS3 = bin/smbpasswd@EXEEXT@ bin/rpcclient@EXEEXT@ bin/smbcacls@EXEEXT@ \ bin/profiles@EXEEXT@ bin/ntlm_auth@EXEEXT@ \ - bin/editreg@EXEEXT@ bin/smbcquotas@EXEEXT@ + bin/smbcquotas@EXEEXT@ + +# editreg removed from standard build until it is portable. It needs a major rewrite to +# achieve this (tridge) +# bin/editreg@EXEEXT@ TORTURE_PROGS = bin/smbtorture@EXEEXT@ bin/msgtest@EXEEXT@ \ bin/masktest@EXEEXT@ bin/locktest@EXEEXT@ \ @@ -141,21 +146,22 @@ SHLIBS = @SHLIB_PROGS@ @LIBSMBCLIENT@ SCRIPTS = $(srcdir)/script/smbtar $(builddir)/script/findsmb -QUOTAOBJS=@QUOTAOBJS@ - VFS_MODULES = @VFS_MODULES@ PDB_MODULES = @PDB_MODULES@ RPC_MODULES = @RPC_MODULES@ +IDMAP_MODULES = @IDMAP_MODULES@ CHARSET_MODULES = @CHARSET_MODULES@ AUTH_MODULES = @AUTH_MODULES@ -MODULES = $(VFS_MODULES) $(PDB_MODULES) $(RPC_MODULES) $(CHARSET_MODULES) $(AUTH_MODULES) +MODULES = $(VFS_MODULES) $(PDB_MODULES) $(RPC_MODULES) $(IDMAP_MODULES) $(CHARSET_MODULES) $(AUTH_MODULES) ###################################################################### # object file lists ###################################################################### TDBBASE_OBJ = tdb/tdb.o tdb/spinlock.o -TDB_OBJ = $(TDBBASE_OBJ) tdb/tdbutil.o +TDB_OBJ = $(TDBBASE_OBJ) tdb/tdbutil.o tdb/tdbback.o + +SMBLDAP_OBJ = @SMBLDAP@ LIB_OBJ = lib/charcnv.o lib/debug.o lib/fault.o \ lib/getsmbpass.o lib/interface.o lib/md4.o \ @@ -175,10 +181,9 @@ LIB_OBJ = lib/charcnv.o lib/debug.o lib/fault.o \ nsswitch/wb_client.o nsswitch/wb_common.o \ lib/pam_errors.o intl/lang_tdb.o lib/account_pol.o \ lib/adt_tree.o lib/gencache.o $(TDB_OBJ) \ - lib/module.o lib/genparser.o lib/genparser_samba.o \ - lib/ldap_escape.o @CHARSET_STATIC@ + lib/module.o lib/ldap_escape.o @CHARSET_STATIC@ -LIB_SMBD_OBJ = lib/system_smbd.o lib/util_smbd.o +LIB_SMBD_OBJ = lib/system_smbd.o lib/util_smbd.o READLINE_OBJ = lib/readline.o @@ -202,11 +207,9 @@ LIBADS_SERVER_OBJ = libads/util.o libads/kerberos_verify.o SECRETS_OBJ = passdb/secrets.o LIBNMB_OBJ = libsmb/unexpected.o libsmb/namecache.o libsmb/nmblib.o \ - libsmb/namequery.o + libsmb/namequery.o libsmb/conncache.o -LIBNTLMSSP_OBJ = libsmb/ntlmssp.o libsmb/ntlmssp_parse.o libsmb/ntlmssp_sign.o - -LIBSAMBA_OBJ = libsmb/nterr.o libsmb/smbdes.o libsmb/smbencrypt.o +LIBSAMBA_OBJ = libsmb/nterr.o libsmb/smbdes.o libsmb/smbencrypt.o libsmb/ntlmssp.o libsmb/ntlmssp_parse.o libsmb/ntlmssp_sign.o LIBSMB_OBJ = libsmb/clientgen.o libsmb/cliconnect.o libsmb/clifile.o \ libsmb/clikrb5.o libsmb/clispnego.o libsmb/asn1.o \ @@ -218,17 +221,14 @@ LIBSMB_OBJ = libsmb/clientgen.o libsmb/cliconnect.o libsmb/clifile.o \ libsmb/smberr.o libsmb/credentials.o libsmb/pwd_cache.o \ libsmb/clioplock.o libsmb/errormap.o libsmb/clirap2.o \ libsmb/passchange.o libsmb/doserr.o \ - libsmb/trustdom_cache.o \ - $(RPC_PARSE_OBJ1) $(LIBNTLMSSP_OBJ) $(LIBSAMBA_OBJ) $(LIBNMB_OBJ) + $(RPC_PARSE_OBJ1) $(LIBSAMBA_OBJ) $(LIBNMB_OBJ) LIBMSRPC_OBJ = rpc_client/cli_lsarpc.o rpc_client/cli_samr.o \ rpc_client/cli_netlogon.o rpc_client/cli_srvsvc.o \ rpc_client/cli_wkssvc.o rpc_client/cli_dfs.o \ rpc_client/cli_reg.o rpc_client/cli_pipe.o \ rpc_client/cli_spoolss.o rpc_client/cli_spoolss_notify.o \ - rpc_client/cli_ds.o rpc_client/cli_echo.o libsmb/namequery_dc.o - -LIBMSRPC_SERVER_OBJ = libsmb/trusts_util.o + rpc_client/cli_ds.o rpc_client/cli_echo.o REGOBJS_OBJ = registry/reg_objects.o REGISTRY_OBJ = registry/reg_frontend.o registry/reg_cachehook.o registry/reg_printing.o \ @@ -279,26 +279,17 @@ PASSDB_GET_SET_OBJ = passdb/pdb_get_set.o PASSDB_OBJ = $(PASSDB_GET_SET_OBJ) passdb/passdb.o passdb/pdb_interface.o \ passdb/machine_sid.o passdb/util_sam_sid.o passdb/pdb_compat.o \ - passdb/privileges.o @LDAP_OBJ@ @PDB_STATIC@ + passdb/privileges.o @PDB_STATIC@ XML_OBJ = passdb/pdb_xml.o MYSQL_OBJ = passdb/pdb_mysql.o -DEVEL_HELP_OBJ = modules/developer.o - -SAM_STATIC_MODULES = sam/sam_plugin.o sam/sam_skel.o sam/sam_ads.o - -IDMAP_OBJ = sam/idmap.o sam/idmap_util.o sam/idmap_tdb.o - -SAM_OBJ = sam/account.o sam/get_set_account.o sam/get_set_group.o \ - sam/get_set_domain.o sam/interface.o $(SAM_STATIC_MODULES) - -SAMTEST_OBJ = torture/samtest.o torture/cmd_sam.o $(PARAM_OBJ) $(SAM_OBJ) $(LIB_OBJ) $(LIBSMB_OBJ) $(UBIQX_OBJ) $(READLINE_OBJ) lib/util_seaccess.o $(LIBADS_OBJ) $(KRBCLIENT_OBJ) $(PASSDB_OBJ) $(SECRETS_OBJ) $(GROUPDB_OBJ) +DEVEL_HELP_OBJ = modules/weird.o GROUPDB_OBJ = groupdb/mapping.o PROFILE_OBJ = profile/profile.o PROFILES_OBJ = utils/profiles.o -EDITREG_OBJ = utils/editreg.o lib/snprintf.o +EDITREG_OBJ = utils/editreg.o OPLOCK_OBJ = smbd/oplock.o smbd/oplock_irix.o smbd/oplock_linux.o @@ -306,13 +297,15 @@ NOTIFY_OBJ = smbd/notify.o smbd/notify_hash.o smbd/notify_kernel.o VFS_AUDIT_OBJ = modules/vfs_audit.o VFS_EXTD_AUDIT_OBJ = modules/vfs_extd_audit.o +VFS_FAKE_PERMS_OBJ = modules/vfs_fake_perms.o VFS_RECYCLE_OBJ = modules/vfs_recycle.o VFS_NETATALK_OBJ = modules/vfs_netatalk.o -VFS_FAKE_PERMS_OBJ = modules/vfs_fake_perms.o PLAINTEXT_AUTH_OBJ = auth/pampass.o auth/pass_check.o -UNIGRP_OBJ = libsmb/netlogon_unigrp.o +SLCACHE_OBJ = libsmb/samlogon_cache.o + +DCUTIL_OBJ = libsmb/namequery_dc.o libsmb/trustdom_cache.o libsmb/trusts_util.o AUTH_BUILTIN_OBJ = auth/auth_builtin.o AUTH_DOMAIN_OBJ = auth/auth_domain.o @@ -323,13 +316,15 @@ AUTH_UNIX_OBJ = auth/auth_unix.o AUTH_WINBIND_OBJ = auth/auth_winbind.o AUTH_OBJ = auth/auth.o @AUTH_STATIC@ auth/auth_util.o auth/auth_compat.o \ - auth/auth_ntlmssp.o \ - $(PLAINTEXT_AUTH_OBJ) $(UNIGRP_OBJ) + auth/auth_ntlmssp.o \ + $(PLAINTEXT_AUTH_OBJ) $(SLCACHE_OBJ) $(DCUTIL_OBJ) MANGLE_OBJ = smbd/mangle.o smbd/mangle_hash.o smbd/mangle_map.o smbd/mangle_hash2.o SMBD_OBJ_MAIN = smbd/server.o +BUILDOPT_OBJ = smbd/build_options.o + SMBD_OBJ_SRV = smbd/files.o smbd/chgpasswd.o smbd/connection.o \ smbd/utmp.o smbd/session.o \ smbd/dfree.o smbd/dir.o smbd/password.o smbd/conn.o smbd/fileio.o \ @@ -342,20 +337,19 @@ SMBD_OBJ_SRV = smbd/files.o smbd/chgpasswd.o smbd/connection.o \ smbd/posix_acls.o lib/sysacls.o lib/server_mutex.o \ smbd/process.o smbd/service.o smbd/error.o \ printing/printfsp.o lib/util_seaccess.o \ - smbd/build_options.o \ - smbd/change_trust_pw.o \ + lib/sysquotas.o smbd/change_trust_pw.o smbd/fake_file.o \ + smbd/quotas.o smbd/ntquotas.o \ $(MANGLE_OBJ) @VFS_STATIC@ SMBD_OBJ_BASE = $(PARAM_OBJ) $(SMBD_OBJ_SRV) $(MSDFS_OBJ) $(LIBSMB_OBJ) \ - $(RPC_SERVER_OBJ) $(RPC_PARSE_OBJ) $(SECRETS_OBJ) $(UBIQX_OBJ) \ + $(RPC_SERVER_OBJ) $(RPC_PARSE_OBJ) $(SECRETS_OBJ) \ $(LOCKING_OBJ) $(PASSDB_OBJ) $(PRINTING_OBJ) $(PROFILE_OBJ) \ - $(LIB_OBJ) $(PRINTBACKEND_OBJ) $(QUOTAOBJS) $(OPLOCK_OBJ) \ + $(LIB_OBJ) $(PRINTBACKEND_OBJ) $(OPLOCK_OBJ) \ $(NOTIFY_OBJ) $(GROUPDB_OBJ) $(AUTH_OBJ) \ - $(LIBMSRPC_OBJ) $(LIBMSRPC_SERVER_OBJ) \ + $(LIBMSRPC_OBJ) \ $(LIBADS_OBJ) $(KRBCLIENT_OBJ) $(LIBADS_SERVER_OBJ) \ $(LIB_SMBD_OBJ) $(REGISTRY_OBJ) $(POPT_LIB_OBJ) \ - $(IDMAP_OBJ) - + $(UBIQX_OBJ) $(BUILDOPT_OBJ) $(SMBLDAP_OBJ) PRINTING_OBJ = printing/pcap.o printing/print_svid.o \ printing/print_cups.o printing/print_generic.o \ @@ -395,7 +389,7 @@ SWAT_OBJ1 = web/cgi.o web/diagnose.o web/startstop.o web/statuspage.o \ SWAT_OBJ = $(SWAT_OBJ1) $(PARAM_OBJ) $(PRINTING_OBJ) $(LIBSMB_OBJ) \ $(LOCKING_OBJ) $(PASSDB_OBJ) $(SECRETS_OBJ) $(KRBCLIENT_OBJ) \ $(UBIQX_OBJ) $(LIB_OBJ) $(GROUPDB_OBJ) $(PLAINTEXT_AUTH_OBJ) \ - $(POPT_LIB_OBJ) $(IDMAP_OBJ) + $(POPT_LIB_OBJ) $(SMBLDAP_OBJ) SMBSH_OBJ = smbwrapper/smbsh.o smbwrapper/shared.o \ $(PARAM_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) @@ -420,14 +414,11 @@ TESTPRNS_OBJ = utils/testprns.o $(PARAM_OBJ) $(PRINTING_OBJ) $(UBIQX_OBJ) \ SMBPASSWD_OBJ = utils/smbpasswd.o $(PARAM_OBJ) $(SECRETS_OBJ) \ $(LIBSMB_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ)\ $(UBIQX_OBJ) $(LIB_OBJ) $(KRBCLIENT_OBJ) \ - $(IDMAP_OBJ) + $(SMBLDAP_OBJ) PDBEDIT_OBJ = utils/pdbedit.o $(PARAM_OBJ) $(PASSDB_OBJ) $(LIBSAMBA_OBJ) \ $(UBIQX_OBJ) $(LIB_OBJ) $(GROUPDB_OBJ) $(SECRETS_OBJ) \ - $(POPT_LIB_OBJ) $(IDMAP_OBJ) - -SMBGROUPEDIT_OBJ = utils/smbgroupedit.o $(GROUPDB_OBJ) $(PARAM_OBJ) \ - $(LIBSAMBA_OBJ) $(PASSDB_OBJ) $(SECRETS_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) $(IDMAP_OBJ) + $(POPT_LIB_OBJ) $(SMBLDAP_OBJ) RPCCLIENT_OBJ1 = rpcclient/rpcclient.o rpcclient/cmd_lsarpc.o \ rpcclient/cmd_samr.o rpcclient/cmd_spoolss.o \ @@ -441,7 +432,7 @@ RPCCLIENT_OBJ = $(RPCCLIENT_OBJ1) \ $(RPC_PARSE_OBJ) $(PASSDB_OBJ) $(LIBMSRPC_OBJ) \ $(READLINE_OBJ) $(GROUPDB_OBJ) $(KRBCLIENT_OBJ) \ $(LIBADS_OBJ) $(SECRETS_OBJ) $(POPT_LIB_OBJ) \ - $(IDMAP_OBJ) + $(SMBLDAP_OBJ) $(DCUTIL_OBJ) PAM_WINBIND_OBJ = nsswitch/pam_winbind.po nsswitch/wb_common.po lib/snprintf.po @@ -469,7 +460,7 @@ LIBBIGBALLOFMUD_MAJOR = 0 LIBBIGBALLOFMUD_OBJ = $(PARAM_OBJ) $(LIB_OBJ) $(UBIQX_OBJ) $(SECRETS_OBJ) \ $(LIBSMB_OBJ) $(LIBMSRPC_OBJ) $(RPC_PARSE_OBJ) $(PASSDB_OBJ) \ - $(GROUPDB_OBJ) $(KRBCLIENT_OBJ) + $(GROUPDB_OBJ) $(KRBCLIENT_OBJ) $(SMBLDAP_OBJ) LIBBIGBALLOFMUD_PICOBJS = $(LIBBIGBALLOFMUD_OBJ:.o=.po) @@ -482,14 +473,14 @@ CLIENT_OBJ = $(CLIENT_OBJ1) $(PARAM_OBJ) $(LIBSMB_OBJ) $(UBIQX_OBJ) \ NET_OBJ1 = utils/net.o utils/net_ads.o utils/net_ads_cldap.o utils/net_help.o \ utils/net_rap.o utils/net_rpc.o utils/net_rpc_samsync.o \ utils/net_rpc_join.o utils/net_time.o utils/net_lookup.o \ - utils/net_cache.o utils/net_groupmap.o + utils/net_cache.o utils/net_groupmap.o utils/net_idmap.o NET_OBJ = $(NET_OBJ1) $(PARAM_OBJ) $(SECRETS_OBJ) $(LIBSMB_OBJ) \ $(RPC_PARSE_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ) \ $(KRBCLIENT_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) \ - $(LIBMSRPC_OBJ) $(LIBMSRPC_SERVER_OBJ) \ + $(LIBMSRPC_OBJ) $(IDMAP_OBJ) \ $(LIBADS_OBJ) $(LIBADS_SERVER_OBJ) $(POPT_LIB_OBJ) \ - $(IDMAP_OBJ) + $(SMBLDAP_OBJ) $(DCUTIL_OBJ) CUPS_OBJ = client/smbspool.o $(PARAM_OBJ) $(LIBSMB_OBJ) $(UBIQX_OBJ) \ $(LIB_OBJ) $(KRBCLIENT_OBJ) @@ -532,7 +523,7 @@ LOCKTEST2_OBJ = torture/locktest2.o $(PARAM_OBJ) $(LOCKING_OBJ) $(LIBSMB_OBJ) \ SMBCACLS_OBJ = utils/smbcacls.o $(PARAM_OBJ) $(LOCKING_OBJ) $(LIBSMB_OBJ) \ $(KRBCLIENT_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) $(RPC_PARSE_OBJ) \ $(PASSDB_GET_SET_OBJ) $(LIBMSRPC_OBJ) $(SECRETS_OBJ) \ - $(POPT_LIB_OBJ) + $(POPT_LIB_OBJ) $(DCUTIL_OBJ) $(LIBADS_OBJ) SMBCQUOTAS_OBJ = utils/smbcquotas.o $(LOCKING_OBJ) $(LIBSMB_OBJ) $(KRBCLIENT_OBJ) \ $(PARAM_OBJ) \ @@ -559,34 +550,35 @@ SMBFILTER_OBJ = utils/smbfilter.o $(PARAM_OBJ) $(LIBSMB_OBJ) \ PROTO_OBJ = $(SMBD_OBJ_MAIN) \ $(SMBD_OBJ_SRV) $(NMBD_OBJ1) $(SWAT_OBJ1) $(LIB_OBJ) $(LIBSMB_OBJ) \ $(SMBW_OBJ1) $(SMBWRAPPER_OBJ1) $(SMBTORTURE_OBJ1) $(RPCCLIENT_OBJ1) \ - $(LIBMSRPC_OBJ) $(LIBMSRPC_SERVER_OBJ) $(RPC_CLIENT_OBJ) \ + $(LIBMSRPC_OBJ) $(RPC_CLIENT_OBJ) \ $(RPC_PIPE_OBJ) $(RPC_PARSE_OBJ) $(KRBCLIENT_OBJ) \ $(AUTH_OBJ) $(PARAM_OBJ) $(LOCKING_OBJ) $(SECRETS_OBJ) \ $(PRINTING_OBJ) $(PRINTBACKEND_OBJ) $(OPLOCK_OBJ) $(NOTIFY_OBJ) \ - $(QUOTAOBJS) $(PASSDB_OBJ) $(GROUPDB_OBJ) $(MSDFS_OBJ) \ + $(PASSDB_OBJ) $(GROUPDB_OBJ) $(MSDFS_OBJ) \ $(READLINE_OBJ) $(PROFILE_OBJ) $(LIBADS_OBJ) $(LIBADS_SERVER_OBJ) \ $(LIB_SMBD_OBJ) $(SAM_OBJ) $(REGISTRY_OBJ) $(POPT_LIB_OBJ) \ $(RPC_LSA_OBJ) $(RPC_NETLOG_OBJ) $(RPC_SAMR_OBJ) $(RPC_REG_OBJ) \ $(RPC_SVC_OBJ) $(RPC_WKS_OBJ) $(RPC_DFS_OBJ) $(RPC_SPOOLSS_OBJ) \ - $(IDMAP_OBJ) $(RPC_ECHO_OBJ) + $(RPC_ECHO_OBJ) $(SMBLDAP_OBJ) $(IDMAP_OBJ) -NSS_OBJ_0 = nsswitch/wins.o $(PARAM_OBJ) $(UBIQX_OBJ) $(LIBSMB_OBJ) \ - $(LIB_OBJ) $(NSSWINS_OBJ) +WINBIND_WINS_NSS_OBJ = nsswitch/wins.o $(PARAM_OBJ) $(UBIQX_OBJ) \ + $(LIBSMB_OBJ) $(LIB_OBJ) $(NSSWINS_OBJ) -NSS_OBJ = $(NSS_OBJ_0:.o=.po) +WINBIND_WINS_NSS_PICOBJS = $(WINBIND_WINS_NSS_OBJ:.o=.po) PICOBJS = $(SMBWRAPPER_OBJ:.o=.po) -PICOBJS32 = $(SMBWRAPPER_OBJ:.o=.po32) LIBSMBCLIENT_PICOBJS = $(LIBSMBCLIENT_OBJ:.o=.po) PAM_SMBPASS_OBJ_0 = pam_smbpass/pam_smb_auth.o pam_smbpass/pam_smb_passwd.o \ pam_smbpass/pam_smb_acct.o pam_smbpass/support.o \ libsmb/smbencrypt.o libsmb/smbdes.o libsmb/nterr.o \ $(PARAM_OBJ) $(LIB_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ) \ - $(SECRETS_OBJ) $(UBIQX_OBJ) $(IDMAP_OBJ) + $(SECRETS_OBJ) $(UBIQX_OBJ) PAM_SMBPASS_PICOOBJ = $(PAM_SMBPASS_OBJ_0:.o=.po) +IDMAP_OBJ = sam/idmap.o sam/idmap_util.o @IDMAP_STATIC@ + WINBINDD_OBJ1 = \ nsswitch/winbindd.o \ nsswitch/winbindd_user.o \ @@ -601,16 +593,18 @@ WINBINDD_OBJ1 = \ nsswitch/winbindd_rpc.o \ nsswitch/winbindd_ads.o \ nsswitch/winbindd_dual.o \ - nsswitch/winbindd_passdb.o + nsswitch/winbindd_acct.o WINBINDD_OBJ = \ $(WINBINDD_OBJ1) $(PASSDB_OBJ) $(GROUPDB_OBJ) \ $(PARAM_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) \ $(LIBSMB_OBJ) $(LIBMSRPC_OBJ) $(RPC_PARSE_OBJ) \ - $(PROFILE_OBJ) $(UNIGRP_OBJ) $(IDMAP_OBJ) \ - $(SECRETS_OBJ) $(LIBADS_OBJ) $(KRBCLIENT_OBJ) $(POPT_LIB_OBJ) + $(PROFILE_OBJ) $(SLCACHE_OBJ) $(SMBLDAP_OBJ) \ + $(SECRETS_OBJ) $(LIBADS_OBJ) $(KRBCLIENT_OBJ) $(POPT_LIB_OBJ) \ + $(DCUTIL_OBJ) $(IDMAP_OBJ) -WBINFO_OBJ = nsswitch/wbinfo.o libsmb/smbencrypt.o libsmb/smbdes.o $(POPT_LIB_OBJ) +WBINFO_OBJ = nsswitch/wbinfo.o $(LIBSAMBA_OBJ) $(PARAM_OBJ) $(LIB_OBJ) \ + $(UBIQX_OBJ) $(SECRETS_OBJ) $(POPT_LIB_OBJ) WINBIND_NSS_OBJ = nsswitch/wb_common.o @WINBIND_NSS_EXTRA_OBJS@ @@ -619,19 +613,14 @@ WINBIND_NSS_PICOBJS = $(WINBIND_NSS_OBJ:.o=.po) POPT_OBJS=popt/findme.o popt/popt.o popt/poptconfig.o \ popt/popthelp.o popt/poptparse.o -TDBBACKUP_OBJ = tdb/tdbbackup.o $(TDBBASE_OBJ) +TDBBACKUP_OBJ = tdb/tdbbackup.o tdb/tdbback.o $(TDBBASE_OBJ) -NTLM_AUTH_OBJ = utils/ntlm_auth.o $(LIBNTLMSSP_OBJ) $(LIBSAMBA_OBJ) $(POPT_LIB_OBJ) +NTLM_AUTH_OBJ = utils/ntlm_auth.o $(LIBSAMBA_OBJ) $(POPT_LIB_OBJ) ###################################################################### # now the rules... ###################################################################### -all: - @echo The Samba HEAD branch is deprecated pending the release of Samba 3.0 - @echo Please use the SAMBA_3_0 branch - @exit 1 - -all_real : SHOWFLAGS proto_exists $(SBIN_PROGS) $(BIN_PROGS) $(SHLIBS) \ +all : SHOWFLAGS proto_exists $(SBIN_PROGS) $(BIN_PROGS) $(SHLIBS) \ $(MODULES) @EXTRA_ALL_TARGETS@ pam_smbpass : SHOWFLAGS bin/pam_smbpass.@SHLIBEXT@ @@ -662,20 +651,20 @@ smbfilter : SHOWFLAGS bin/smbfilter@EXEEXT@ talloctort : SHOWFLAGS bin/talloctort@EXEEXT@ -nsswitch : SHOWFLAGS bin/winbindd@EXEEXT@ bin/wbinfo@EXEEXT@ nsswitch/@WINBIND_NSS@ nsswitch/pam_winbind.@SHLIBEXT@ +nsswitch : SHOWFLAGS bin/winbindd@EXEEXT@ bin/wbinfo@EXEEXT@ @WINBIND_NSS@ \ + @WINBIND_WINS_NSS@ nsswitch/pam_winbind.@SHLIBEXT@ -wins : SHOWFLAGS nsswitch/libnss_wins.@SHLIBEXT@ +wins : SHOWFLAGS @WINBIND_WINS_NSS@ modules: SHOWFLAGS proto_exists $(MODULES) -everything: all libsmbclient debug2html smbfilter talloctort torture +everything: all libsmbclient debug2html smbfilter talloctort modules torture .SUFFIXES: -.SUFFIXES: .c .o .po .po32 .lo +.SUFFIXES: .c .o .po .lo SHOWFLAGS: @echo "Using FLAGS = $(FLAGS)" - @echo " FLAGS32 = $(FLAGS32)" @echo " LIBS = $(LIBS)" @echo " LDSHFLAGS = $(LDSHFLAGS)" @echo " LDFLAGS = $(LDFLAGS)" @@ -715,6 +704,14 @@ dynconfig.po: dynconfig.c Makefile @BROKEN_CC@ -mv `echo $@ | sed -e 's%^.*/%%g' -e 's%\.po$$%.o%'` $@ @POBAD_CC@ @mv $*.po.o $@ +smbd/build_options.o: smbd/build_options.c Makefile include/config.h include/build_env.h include/proto.h + @echo Compiling $*.c + @$(CC) $(FLAGS) $(PATH_FLAGS) -c $< -o $@ + +smbd/build_options.c: include/config.h.in script/mkbuildoptions.awk + @echo Generating $@ + @dir=smbd $(MAKEDIR) && $(AWK) -f $(srcdir)/script/mkbuildoptions.awk > $(builddir)/smbd/build_options.c < $(srcdir)/include/config.h.in + .c.po: @if (: >> $@ || : > $@) >/dev/null 2>&1; then rm -f $@; else \ dir=`echo $@ | sed 's,/[^/]*$$,,;s,^$$,.,'` $(MAKEDIR); fi @@ -723,16 +720,6 @@ dynconfig.po: dynconfig.c Makefile @BROKEN_CC@ -mv `echo $@ | sed -e 's%^.*/%%g' -e 's%\.po$$%.o%'` $@ @POBAD_CC@ @mv $*.po.o $@ -# this is for IRIX -.c.po32: - @if (: >> $@ || : > $@) >/dev/null 2>&1; then rm -f $@; else \ - dir=`echo $@ | sed 's,/[^/]*$$,,;s,^$$,.,'` $(MAKEDIR); fi - @echo Compiling $*.c with @PICFLAG@ and -32 - @$(CC) -32 -I. -I$(srcdir) $(FLAGS32) $(PATH_FLAGS) @PICFLAG@ -c $< \ - -o $*.po32.o -@BROKEN_CC@ -mv `echo $@ | sed -e 's%^.*/%%g' -e 's%\.po32$$%.o%'` $@.o - @mv $*.po32.o $@ - bin/.dummy: @if (: >> $@ || : > $@) >/dev/null 2>&1; then :; else \ dir=bin $(MAKEDIR); fi @@ -745,7 +732,7 @@ bin/smbd@EXEEXT@: $(SMBD_OBJ) @BUILD_POPT@ bin/.dummy bin/nmbd@EXEEXT@: $(NMBD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(ADSLIBS) bin/wrepld@EXEEXT@: $(WREPL_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @@ -754,7 +741,7 @@ bin/wrepld@EXEEXT@: $(WREPL_OBJ) @BUILD_POPT@ bin/.dummy bin/swat@EXEEXT@: $(SWAT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @$(CC) $(FLAGS) -o $@ $(SWAT_OBJ) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ - $(AUTHLIBS) $(LIBS) $(PASSDBLIBS) @POPTLIBS@ $(KRB5LIBS) + $(AUTHLIBS) $(LIBS) $(PASSDBLIBS) @POPTLIBS@ $(KRB5LIBS) bin/rpcclient@EXEEXT@: $(RPCCLIENT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @@ -762,11 +749,11 @@ bin/rpcclient@EXEEXT@: $(RPCCLIENT_OBJ) @BUILD_POPT@ bin/.dummy bin/smbclient@EXEEXT@: $(CLIENT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(ADSLIBS) bin/net@EXEEXT@: $(NET_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(ADSLIBS) + @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(ADSLIBS) $(PASSDBLIBS) bin/profiles@EXEEXT@: $(PROFILES_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @@ -778,11 +765,11 @@ bin/editreg@EXEEXT@: $(EDITREG_OBJ) @BUILD_POPT@ bin/.dummy bin/smbspool@EXEEXT@: $(CUPS_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(CUPS_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(CUPS_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) bin/smbmount@EXEEXT@: $(MOUNT_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(MOUNT_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(MOUNT_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) bin/smbmnt@EXEEXT@: $(MNT_OBJ) bin/.dummy @echo Linking $@ @@ -810,7 +797,7 @@ bin/smbcontrol@EXEEXT@: $(SMBCONTROL_OBJ) @BUILD_POPT@ bin/.dummy bin/smbtree@EXEEXT@: $(SMBTREE_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBTREE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBTREE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) bin/smbpasswd@EXEEXT@: $(SMBPASSWD_OBJ) bin/.dummy @echo Linking $@ @@ -818,23 +805,19 @@ bin/smbpasswd@EXEEXT@: $(SMBPASSWD_OBJ) bin/.dummy bin/pdbedit@EXEEXT@: $(PDBEDIT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(PDBEDIT_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ + @$(CC) $(FLAGS) -o $@ $(PDBEDIT_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(PASSDBLIBS) bin/samtest@EXEEXT@: $(SAMTEST_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SAMTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(PASSDBLIBS) $(ADSLIBS) - -bin/smbgroupedit@EXEEXT@: $(SMBGROUPEDIT_OBJ) bin/.dummy - @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBGROUPEDIT_OBJ) $(PASSDBLIBS) $(LDFLAGS) $(DYNEXP) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(SAMTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(PASSDBLIBS) $(KRB5LIBS) $(LDAPLIBS) bin/nmblookup@EXEEXT@: $(NMBLOOKUP_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NMBLOOKUP_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ + @$(CC) $(FLAGS) -o $@ $(NMBLOOKUP_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(LDAPLIBS) bin/smbtorture@EXEEXT@: $(SMBTORTURE_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBTORTURE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBTORTURE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) bin/talloctort@EXEEXT@: $(TALLOCTORT_OBJ) bin/.dummy @echo Linking $@ @@ -842,31 +825,31 @@ bin/talloctort@EXEEXT@: $(TALLOCTORT_OBJ) bin/.dummy bin/masktest@EXEEXT@: $(MASKTEST_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(MASKTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(MASKTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) bin/msgtest@EXEEXT@: $(MSGTEST_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(MSGTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(MSGTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) bin/smbcacls@EXEEXT@: $(SMBCACLS_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBCACLS_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBCACLS_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) bin/smbcquotas@EXEEXT@: $(SMBCQUOTAS_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBCQUOTAS_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBCQUOTAS_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) bin/locktest@EXEEXT@: $(LOCKTEST_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(LOCKTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(LOCKTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) bin/nsstest@EXEEXT@: $(NSSTEST_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NSSTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(NSSTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) bin/vfstest@EXEEXT@: $(VFSTEST_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(VFSTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(PRINTLIBS) $(AUTHLIBS) $(ACLLIBS) $(LIBS) @POPTLIBS@ $(ADSLIBS) + @$(CC) $(FLAGS) -o $@ $(VFSTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(PRINTLIBS) $(AUTHLIBS) $(ACLLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) bin/smbiconv@EXEEXT@: $(SMBICONV_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @@ -874,11 +857,11 @@ bin/smbiconv@EXEEXT@: $(SMBICONV_OBJ) @BUILD_POPT@ bin/.dummy bin/locktest2@EXEEXT@: $(LOCKTEST2_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(LOCKTEST2_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(LOCKTEST2_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) bin/rpctorture@EXEEXT@: $(RPCTORTURE_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(RPCTORTURE_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(RPCTORTURE_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) bin/debug2html@EXEEXT@: $(DEBUG2HTML_OBJ) bin/.dummy @echo Linking $@ @@ -886,7 +869,7 @@ bin/debug2html@EXEEXT@: $(DEBUG2HTML_OBJ) bin/.dummy bin/smbfilter@EXEEXT@: $(SMBFILTER_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBFILTER_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBFILTER_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) bin/smbw_sample@EXEEXT@: $(SMBW_OBJ) utils/smbw_sample.o bin/.dummy @echo Linking $@ @@ -901,11 +884,6 @@ bin/smbwrapper.@SHLIBEXT@: $(PICOBJS) bin/.dummy @$(SHLD) $(LDSHFLAGS) -o $@ $(PICOBJS) $(LIBS) \ @SONAMEFLAG@`basename $@` $(KRB5LIBS) -bin/smbwrapper.32.@SHLIBEXT@: $(PICOBJS32) - @echo Linking shared library $@ - @$(SHLD) -32 $(LDSHFLAGS) -o $@ $(PICOBJS32) $(LIBS) \ - @SONAMEFLAG@`basename $@` $(KRB5LIBS) - bin/libsmbclient.@SHLIBEXT@: $(LIBSMBCLIENT_PICOBJS) @echo Linking libsmbclient shared library $@ @$(SHLD) $(LDSHFLAGS) -o $@ $(LIBSMBCLIENT_PICOBJS) $(LDFLAGS) $(LIBS) \ @@ -919,12 +897,12 @@ bin/libsmbclient.a: $(LIBSMBCLIENT_PICOBJS) bin/libbigballofmud.@SHLIBEXT@: $(LIBBIGBALLOFMUD_PICOBJS) @echo Linking bigballofmud shared library $@ @$(SHLD) $(LDSHFLAGS) -o $@ $(LIBBIGBALLOFMUD_PICOBJS) $(LIBS) \ - @SONAMEFLAG@`basename $@`.$(LIBBIGBALLOFMUD_MAJOR) $(PASSDBLIBS) $(ADSLIBS) + @SONAMEFLAG@`basename $@`.$(LIBBIGBALLOFMUD_MAJOR) $(PASSDBLIBS) $(IDMAP_LIBS) $(ADSLIBS) ln -snf libbigballofmud.so bin/libbigballofmud.so.0 # It would be nice to build a static bigballofmud too, but when I try -# I get linker errors about dl_open and similar things. I'm not sure -# if it can be fixed or if they just can't be called from a static +# I get linker errors about dl_open and similar things. I'm not sure if +# it can be fixed or if they just can't be called from a static # library. libsmbclient: $(LIBSMBCLIENT) @@ -974,22 +952,22 @@ bin/librpc_echo.@SHLIBEXT@: $(RPC_ECHO_OBJ) @$(SHLD) $(LDSHFLAGS) -o $@ $(RPC_ECHO_OBJ) -lc \ @SONAMEFLAG@`basename $@` -nsswitch/libnss_wins.@SHLIBEXT@: $(NSS_OBJ) - @echo "Linking $@" - @$(SHLD) $(LDSHFLAGS) -o $@ $(NSS_OBJ) -lc \ - @SONAMEFLAG@`basename $@` - bin/winbindd@EXEEXT@: $(WINBINDD_OBJ) @BUILD_POPT@ bin/.dummy - @echo Linking $@ - @$(LINK) -o $@ $(WINBINDD_OBJ) $(DYNEXP) $(LIBS) @POPTLIBS@ $(ADSLIBS) @LDAP_LIBS@ + @echo "Linking $@" + @$(LINK) -o $@ $(WINBINDD_OBJ) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) -nsswitch/@WINBIND_NSS@: $(WINBIND_NSS_PICOBJS) +@WINBIND_NSS@: $(WINBIND_NSS_PICOBJS) @echo "Linking $@" @$(SHLD) $(WINBIND_NSS_LDSHFLAGS) -o $@ $(WINBIND_NSS_PICOBJS) \ @WINBIND_NSS_EXTRA_LIBS@ @SONAMEFLAG@`basename $@` +@WINBIND_WINS_NSS@: $(WINBIND_WINS_NSS_PICOBJS) + @echo "Linking $@" + @$(SHLD) $(LDSHFLAGS) -o $@ $(WINBIND_WINS_NSS_PICOBJS) -lc \ + @SONAMEFLAG@`basename $@` + nsswitch/pam_winbind.@SHLIBEXT@: $(PAM_WINBIND_OBJ) bin/.dummy - @echo Linking $@ + @echo "Linking $@" @$(SHLD) $(LDSHFLAGS) -o $@ $(PAM_WINBIND_OBJ) \ @SONAMEFLAG@`basename $@` -lpam @@ -1028,7 +1006,7 @@ bin/mysql.@SHLIBEXT@: $(MYSQL_OBJ:.o=.po) bin/ldapsam.@SHLIBEXT@: passdb/pdb_ldap.po @echo "Building plugin $@" - @$(SHLD) $(LDSHFLAGS) @LDAP_LIBS@ -o $@ passdb/pdb_ldap.po \ + @$(SHLD) $(LDSHFLAGS) $(LDAPLIBS) -o $@ passdb/pdb_ldap.po \ @SONAMEFLAG@`basename $@` bin/tdbsam.@SHLIBEXT@: passdb/pdb_tdb.po @@ -1041,11 +1019,6 @@ bin/smbpasswd.@SHLIBEXT@: passdb/pdb_smbpasswd.po @$(SHLD) $(LDSHFLAGS) -o $@ passdb/pdb_smbpasswd.po \ @SONAMEFLAG@`basename $@` -bin/nisplussam.@SHLIBEXT@: passdb/pdb_nisplus.po - @echo "Building plugin $@" - @$(SHLD) $(LDSHFLAGS) -o $@ passdb/pdb_nisplus.po \ - @SONAMEFLAG@`basename $@` - bin/weird.@SHLIBEXT@: $(DEVEL_HELP_OBJ:.o=.po) @echo "Building plugin $@" @$(SHLD) $(LDSHFLAGS) -o $@ $(DEVEL_HELP_OBJ:.o=.po) \ @@ -1081,11 +1054,9 @@ bin/fake_perms.@SHLIBEXT@: $(VFS_FAKE_PERMS_OBJ:.o=.po) @$(SHLD) $(LDSHFLAGS) -o $@ $(VFS_FAKE_PERMS_OBJ:.o=.po) \ @SONAMEFLAG@`basename $@` -bin/wbinfo@EXEEXT@: $(WBINFO_OBJ) $(PARAM_OBJ) $(LIB_OBJ) \ - $(UBIQX_OBJ) $(SECRETS_OBJ) @BUILD_POPT@ bin/.dummy +bin/wbinfo@EXEEXT@: $(WBINFO_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(LINK) -o $@ $(WBINFO_OBJ) $(PARAM_OBJ) $(LIB_OBJ) \ - $(UBIQX_OBJ) $(SECRETS_OBJ) $(LIBS) @POPTLIBS@ + @$(LINK) -o $@ $(WBINFO_OBJ) $(LIBS) @POPTLIBS@ bin/ntlm_auth@EXEEXT@: $(NTLM_AUTH_OBJ) $(PARAM_OBJ) $(LIB_OBJ) \ $(UBIQX_OBJ) @BUILD_POPT@ bin/.dummy @@ -1112,14 +1083,14 @@ bin/t_stringoverflow@EXEEXT@: bin/libbigballofmud.@SHLIBEXT@ torture/t_stringove bin/t_doschar@EXEEXT@: bin/libbigballofmud.@SHLIBEXT@ torture/t_doschar.o $(CC) $(FLAGS) -o $@ $(LIBS) torture/t_doschar.o -L ./bin -lbigballofmud - bin/t_push_ucs2@EXEEXT@: bin/libbigballofmud.@SHLIBEXT@ torture/t_push_ucs2.o $(CC) $(FLAGS) -o $@ $(LIBS) torture/t_push_ucs2.o -L ./bin -lbigballofmud bin/t_snprintf@EXEEXT@: lib/snprintf.c $(CC) $(FLAGS) -o $@ -DTEST_SNPRINTF lib/snprintf.c -lm +install: installbin installman installscripts installdat installswat installmodules -install: installbin installman installscripts installdat installswat installmodules installclientlib +install-everything: install installmodules # DESTDIR is used here to prevent packagers wasting their time # duplicating the Makefile. Remove it and you will have the privelege @@ -1130,7 +1101,7 @@ install: installbin installman installscripts installdat installswat installmodu # is not used installdirs: - @$(SHELL) $(srcdir)/script/installdirs.sh $(DESTDIR)$(BASEDIR) $(DESTDIR)$(BINDIR) $(DESTDIR)$(SBINDIR) $(DESTDIR)$(LIBDIR) $(DESTDIR)$(VARDIR) $(DESTDIR)$(PRIVATEDIR) $(DESTDIR)$(VFSLIBDIR) $(DESTDIR)$(PDBLIBDIR) $(DESTDIR)$(PIDDIR) $(DESTDIR)$(LOCKDIR) + @$(SHELL) $(srcdir)/script/installdirs.sh $(DESTDIR)$(BASEDIR) $(DESTDIR)$(BINDIR) $(DESTDIR)$(SBINDIR) $(DESTDIR)$(LIBDIR) $(DESTDIR)$(VARDIR) $(DESTDIR)$(PRIVATEDIR) $(DESTDIR)$(PIDDIR) $(DESTDIR)$(LOCKDIR) $(DESTDIR)$(MANDIR) installservers: all installdirs @$(SHELL) $(srcdir)/script/installbin.sh $(INSTALLPERMS) $(DESTDIR)$(BASEDIR) $(DESTDIR)$(SBINDIR) $(DESTDIR)$(LIBDIR) $(DESTDIR)$(VARDIR) $(SBIN_PROGS) @@ -1144,6 +1115,7 @@ installmodules: modules installdirs @$(SHELL) $(srcdir)/script/installmodules.sh $(INSTALLPERMS) $(DESTDIR)$(BASEDIR) $(DESTDIR)$(VFSLIBDIR) $(VFS_MODULES) @$(SHELL) $(srcdir)/script/installmodules.sh $(INSTALLPERMS) $(DESTDIR)$(BASEDIR) $(DESTDIR)$(PDBLIBDIR) $(PDB_MODULES) @$(SHELL) $(srcdir)/script/installmodules.sh $(INSTALLPERMS) $(DESTDIR)$(BASEDIR) $(DESTDIR)$(RPCLIBDIR) $(RPC_MODULES) + @$(SHELL) $(srcdir)/script/installmodules.sh $(INSTALLPERMS) $(DESTDIR)$(BASEDIR) $(DESTDIR)$(IDMAPLIBDIR) $(IDMAP_MODULES) @$(SHELL) $(srcdir)/script/installmodules.sh $(INSTALLPERMS) $(DESTDIR)$(BASEDIR) $(DESTDIR)$(CHARSETLIBDIR) $(CHARSET_MODULES) @$(SHELL) $(srcdir)/script/installmodules.sh $(INSTALLPERMS) $(DESTDIR)$(BASEDIR) $(DESTDIR)$(AUTHLIBDIR) $(AUTH_MODULES) @@ -1177,7 +1149,7 @@ python_ext: $(PYTHON_PICOBJS) fi PYTHON_OBJS="$(PYTHON_PICOBJS)" \ PYTHON_CFLAGS="$(CFLAGS) $(CPPFLAGS) $(FLAGS)" \ - LIBS="$(LIBS) $(PASSDBLIBS) $(KRB5LIBS)" \ + LIBS="$(LIBS) $(PASSDBLIBS) $(IDMAP_LIBS) $(KRB5LIBS)" \ $(PYTHON) python/setup.py build python_install: $(PYTHON_PICOBJS) @@ -1236,14 +1208,14 @@ uninstallscripts: TOPFILES=dynconfig.o dynconfig.po clean: delheaders python_clean - -rm -f core */*~ *~ */*.o */*.po */*.po32 */*.@SHLIBEXT@ \ + -rm -f core */*~ *~ */*.o */*.po */*.@SHLIBEXT@ \ $(TOPFILES) $(BIN_PROGS) $(SBIN_PROGS) $(MODULES) $(TORTURE_PROGS) \ $(LIBSMBCLIENT) $(EVERYTHING_PROGS) .headers.stamp # This is quite ugly actually.. But we need to make # sure the changes to include/config.h are used. modules_clean: - @-rm -f @MODULES_CLEAN@ auth/auth.o passdb/pdb_interface.o rpc_server/srv_pipe_hnd.o lib/iconv.o smbd/vfs.o + @-rm -f auth/auth.o passdb/pdb_interface.o smbd/server.o lib/iconv.o smbd/vfs.o sam/idmap.o # Making this target will just make sure that the prototype files # exist, not necessarily that they are up to date. Since they're @@ -1251,81 +1223,67 @@ modules_clean: # afterwards. proto_exists: include/proto.h include/wrepld_proto.h include/build_env.h \ nsswitch/winbindd_proto.h web/swat_proto.h \ - client/client_proto.h utils/net_proto.h -# include/tdbsam2_parse_info.h + client/client_proto.h utils/net_proto.h smbd/build_options.c delheaders: @echo Removing prototype headers - @/bin/rm -f $(srcdir)/include/proto.h $(srcdir)/include/build_env.h - @/bin/rm -f $(srcdir)/include/wrepld_proto.h $(srcdir)/nsswitch/winbindd_proto.h - @/bin/rm -f $(srcdir)/web/swat_proto.h - @/bin/rm -f $(srcdir)/client/client_proto.h $(srcdir)/utils/net_proto.h - @/bin/rm -f $(srcdir)/include/tdbsam2_parse_info.h - - @/bin/rm -f include/proto.h include/build_env.h include/wrepld_proto.h \ - nsswitch/winbindd_proto.h web/swat_proto.h \ - client/client_proto.h utils/net_proto.h -# include/tdbsam2_parse_info.h - -include/proto.h: + @rm -f include/proto.h include/build_env.h include/wrepld_proto.h \ + nsswitch/winbindd_proto.h web/swat_proto.h \ + client/client_proto.h utils/net_proto.h \ + smbd/build_options.c + +MKPROTO_SH = $(srcdir)/script/mkproto.sh + +include/proto.h: smbd/build_options.c @echo Building include/proto.h - @cd $(srcdir) && $(SHELL) script/mkproto.sh $(AWK) \ + @cd $(srcdir) && $(SHELL) $(MKPROTO_SH) $(AWK) \ -h _PROTO_H_ $(builddir)/include/proto.h \ $(PROTO_OBJ) -include/build_env.h: +include/build_env.h: script/build_env.sh @echo Building include/build_env.h - @cd $(srcdir) && $(SHELL) script/build_env.sh $(srcdir) $(builddir) $(CC) > $(builddir)/include/build_env.h + @$(SHELL) $(srcdir)/script/build_env.sh $(srcdir) $(builddir) $(CC) \ + > $(builddir)/include/build_env.h include/wrepld_proto.h: @echo Building include/wrepld_proto.h - @cd $(srcdir) && $(SHELL) script/mkproto.sh $(AWK) \ + @cd $(srcdir) && $(SHELL) $(MKPROTO_SH) $(AWK) \ -h _WREPLD_PROTO_H_ $(builddir)/include/wrepld_proto.h \ $(WREPL_OBJ1) nsswitch/winbindd_proto.h: - @cd $(srcdir) && $(SHELL) script/mkproto.sh $(AWK) \ - -h _WINBINDD_PROTO_H_ nsswitch/winbindd_proto.h \ + @cd $(srcdir) && $(SHELL) $(MKPROTO_SH) $(AWK) \ + -h _WINBINDD_PROTO_H_ $(builddir)/nsswitch/winbindd_proto.h \ $(WINBINDD_OBJ1) web/swat_proto.h: - @cd $(srcdir) && $(SHELL) script/mkproto.sh $(AWK) \ - -h _SWAT_PROTO_H_ web/swat_proto.h \ + @cd $(srcdir) && $(SHELL) $(MKPROTO_SH) $(AWK) \ + -h _SWAT_PROTO_H_ $(builddir)/web/swat_proto.h \ $(SWAT_OBJ1) client/client_proto.h: - @cd $(srcdir) && $(SHELL) script/mkproto.sh $(AWK) \ - -h _CLIENT_PROTO_H_ client/client_proto.h \ + @cd $(srcdir) && $(SHELL) $(MKPROTO_SH) $(AWK) \ + -h _CLIENT_PROTO_H_ $(builddir)/client/client_proto.h \ $(CLIENT_OBJ1) utils/net_proto.h: - @cd $(srcdir) && $(SHELL) script/mkproto.sh $(AWK) \ - -h _CLIENT_PROTO_H_ utils/net_proto.h \ + @cd $(srcdir) && $(SHELL) $(MKPROTO_SH) $(AWK) \ + -h _CLIENT_PROTO_H_ $(builddir)/utils/net_proto.h \ $(NET_OBJ1) -# not used yet an perl dependent -#include/tdbsam2_parse_info.h: -# @if test -n "$(PERL)"; then \ -# cd $(srcdir) && @PERL@ -w script/genstruct.pl \ -# -o include/tdbsam2_parse_info.h $(CC) -E -O2 -g \ -# include/tdbsam2.h; \ -# else \ -# echo Unable to build $@, continuing; \ -# fi - # "make headers" or "make proto" calls a subshell because we need to # make sure these commands are executed in sequence even for a # parallel make. headers: $(MAKE) delheaders; \ + $(MAKE) smbd/build_options.c; \ $(MAKE) include/proto.h; \ $(MAKE) include/build_env.h; \ $(MAKE) include/wrepld_proto.h; \ $(MAKE) nsswitch/winbindd_proto.h; \ $(MAKE) web/swat_proto.h; \ $(MAKE) client/client_proto.h; \ - $(MAKE) utils/net_proto.h; -# $(MAKE) include/tdbsam2_parse_info.h + $(MAKE) utils/net_proto.h proto: headers diff --git a/source3/aclocal.m4 b/source3/aclocal.m4 index f470e2e8b0..21358e2a71 100644 --- a/source3/aclocal.m4 +++ b/source3/aclocal.m4 @@ -64,7 +64,6 @@ AC_DEFUN(SMB_MODULE, else AC_MSG_RESULT([not]) fi - MODULES_CLEAN="$MODULES_CLEAN $2 $3" ]) AC_DEFUN(SMB_SUBSYSTEM, @@ -533,59 +532,83 @@ AC_DEFUN(jm_ICONV, jm_cv_func_iconv="no" jm_cv_lib_iconv=no jm_cv_giconv=no + jm_save_LIBS="$LIBS" + LIBS="$LIBS -lbiconv" AC_TRY_LINK([#include -#include ], - [iconv_t cd = iconv_open("",""); - iconv(cd,NULL,NULL,NULL,NULL); - iconv_close(cd);], +#include ], + [iconv_t cd = iconv_open("",""); + iconv(cd,NULL,NULL,NULL,NULL); + iconv_close(cd);], jm_cv_func_iconv=yes - jm_cv_giconv=yes) + jm_cv_biconv=yes + jm_cv_include="biconv.h" + jm_cv_lib_iconv="yes") + LIBS="$jm_save_LIBS" - if test "$jm_cv_func_iconv" != yes; then + if test "$jm_cv_func_iconv" != yes; then AC_TRY_LINK([#include -#include ], +#include ], [iconv_t cd = iconv_open("",""); iconv(cd,NULL,NULL,NULL,NULL); iconv_close(cd);], - jm_cv_func_iconv=yes) + jm_cv_func_iconv=yes + jm_cv_include="giconv.h" + jm_cv_giconv="yes") - if test "$jm_cv_lib_iconv" != yes; then + if test "$jm_cv_func_iconv" != yes; then + AC_TRY_LINK([#include +#include ], + [iconv_t cd = iconv_open("",""); + iconv(cd,NULL,NULL,NULL,NULL); + iconv_close(cd);], + jm_cv_include="iconv.h" + jm_cv_func_iconv=yes) + + if test "$jm_cv_lib_iconv" != yes; then + jm_save_LIBS="$LIBS" + LIBS="$LIBS -lgiconv" + AC_TRY_LINK([#include +#include ], + [iconv_t cd = iconv_open("",""); + iconv(cd,NULL,NULL,NULL,NULL); + iconv_close(cd);], + jm_cv_lib_iconv=yes + jm_cv_func_iconv=yes + jm_cv_include="giconv.h" + jm_cv_giconv=yes) + LIBS="$jm_save_LIBS" + + if test "$jm_cv_func_iconv" != yes; then jm_save_LIBS="$LIBS" - LIBS="$LIBS -lgiconv" + LIBS="$LIBS -liconv" AC_TRY_LINK([#include -#include ], +#include ], [iconv_t cd = iconv_open("",""); iconv(cd,NULL,NULL,NULL,NULL); iconv_close(cd);], jm_cv_lib_iconv=yes - jm_cv_func_iconv=yes - jm_cv_giconv=yes) + jm_cv_include="iconv.h" + jm_cv_func_iconv=yes) LIBS="$jm_save_LIBS" - - if test "$jm_cv_func_iconv" != yes; then - jm_save_LIBS="$LIBS" - LIBS="$LIBS -liconv" - AC_TRY_LINK([#include -#include ], - [iconv_t cd = iconv_open("",""); - iconv(cd,NULL,NULL,NULL,NULL); - iconv_close(cd);], - jm_cv_lib_iconv=yes - jm_cv_func_iconv=yes) - LIBS="$jm_save_LIBS" fi fi fi - + fi if test "$jm_cv_func_iconv" = yes; then if test "$jm_cv_giconv" = yes; then AC_DEFINE(HAVE_GICONV, 1, [What header to include for iconv() function: giconv.h]) AC_MSG_RESULT(yes) ICONV_FOUND=yes else - AC_DEFINE(HAVE_ICONV, 1, [What header to include for iconv() function: iconv.h]) - AC_MSG_RESULT(yes) - ICONV_FOUND=yes + if test "$jm_cv_biconv" = yes; then + AC_DEFINE(HAVE_BICONV, 1, [What header to include for iconv() function: biconv.h]) + AC_MSG_RESULT(yes) + ICONV_FOUND=yes + else + AC_DEFINE(HAVE_ICONV, 1, [What header to include for iconv() function: iconv.h]) + AC_MSG_RESULT(yes) + ICONV_FOUND=yes + fi fi else AC_MSG_RESULT(no) @@ -594,7 +617,11 @@ AC_DEFUN(jm_ICONV, if test "$jm_cv_giconv" = yes; then LIBS="$LIBS -lgiconv" else - LIBS="$LIBS -liconv" + if test "$jm_cv_biconv" = yes; then + LIBS="$LIBS -lbiconv" + else + LIBS="$LIBS -liconv" + fi fi fi ]) @@ -678,3 +705,29 @@ dnl AC_DISABLE_STATIC - set the default static flag to --disable-static AC_DEFUN([AC_DISABLE_STATIC], [AC_BEFORE([$0],[AC_LIBTOOL_SETUP])dnl AC_ENABLE_STATIC(no)]) + +dnl AC_TRY_RUN_STRICT(PROGRAM,CFLAGS,CPPFLAGS,LDFLAGS, +dnl [ACTION-IF-TRUE],[ACTION-IF-FALSE], +dnl [ACTION-IF-CROSS-COMPILING = RUNTIME-ERROR]) +AC_DEFUN( [AC_TRY_RUN_STRICT], +[ + old_CFLAGS="$CFLAGS"; + CFLAGS="$2"; + export CFLAGS; + old_CPPFLAGS="$CPPFLAGS"; + CPPFLAGS="$3"; + export CPPFLAGS; + old_LDFLAGS="$LDFLAGS"; + LDFLAGS="$4"; + export LDFLAGS; + AC_TRY_RUN([$1],[$5],[$6],[$7]); + CFLAGS="$old_CFLAGS"; + old_CFLAGS=""; + export CFLAGS; + CPPFLAGS="$old_CPPFLAGS"; + old_CPPFLAGS=""; + export CPPFLAGS; + LDFLAGS="$old_LDFLAGS"; + old_LDFLAGS=""; + export LDFLAGS; +]) diff --git a/source3/auth/auth.c b/source3/auth/auth.c index 0c4fe76830..a2486acbd1 100644 --- a/source3/auth/auth.c +++ b/source3/auth/auth.c @@ -63,7 +63,7 @@ static struct auth_init_function_entry *auth_find_backend_entry(const char *name struct auth_init_function_entry *entry = backends; while(entry) { - if (strequal(entry->name, name)) return entry; + if (strcmp(entry->name, name)==0) return entry; entry = entry->next; } @@ -203,9 +203,9 @@ static NTSTATUS check_ntlm_password(const struct auth_context *auth_context, const struct auth_usersupplied_info *user_info, struct auth_serversupplied_info **server_info) { - - NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE; - const char *pdb_username; + /* if all the modules say 'not for me' this is reasonable */ + NTSTATUS nt_status = NT_STATUS_NO_SUCH_USER; + const char *unix_username; auth_methods *auth_method; TALLOC_CTX *mem_ctx; @@ -244,12 +244,24 @@ static NTSTATUS check_ntlm_password(const struct auth_context *auth_context, return NT_STATUS_LOGON_FAILURE; for (auth_method = auth_context->auth_method_list;auth_method; auth_method = auth_method->next) { + NTSTATUS result; + mem_ctx = talloc_init("%s authentication for user %s\\%s", auth_method->name, user_info->domain.str, user_info->smb_name.str); - nt_status = auth_method->auth(auth_context, auth_method->private_data, mem_ctx, user_info, server_info); + result = auth_method->auth(auth_context, auth_method->private_data, mem_ctx, user_info, server_info); + + /* check if the module did anything */ + if ( NT_STATUS_V(result) == NT_STATUS_V(NT_STATUS_NOT_IMPLEMENTED) ) { + DEBUG(10,("check_ntlm_password: %s had nothing to say\n", auth_method->name)); + talloc_destroy(mem_ctx); + continue; + } + + nt_status = result; + if (NT_STATUS_IS_OK(nt_status)) { - DEBUG(3, ("check_ntlm_password: %s authentication for user [%s] suceeded\n", + DEBUG(3, ("check_ntlm_password: %s authentication for user [%s] succeeded\n", auth_method->name, user_info->smb_name.str)); } else { DEBUG(5, ("check_ntlm_password: %s authentication for user [%s] FAILED with error %s\n", @@ -258,40 +270,36 @@ static NTSTATUS check_ntlm_password(const struct auth_context *auth_context, talloc_destroy(mem_ctx); - if (NT_STATUS_IS_OK(nt_status)) - break; + if ( NT_STATUS_IS_OK(nt_status)) + { + break; + } } - /* This is one of the few places the *relies* (rather than just sets defaults - on the value of lp_security(). This needs to change. A new paramater - perhaps? */ - if (lp_security() >= SEC_SERVER) - smb_user_control(user_info, *server_info, nt_status); - if (NT_STATUS_IS_OK(nt_status)) { - pdb_username = pdb_get_username((*server_info)->sam_account); + unix_username = (*server_info)->unix_name; if (!(*server_info)->guest) { /* We might not be root if we are an RPC call */ become_root(); - nt_status = smb_pam_accountcheck(pdb_username); + nt_status = smb_pam_accountcheck(unix_username); unbecome_root(); if (NT_STATUS_IS_OK(nt_status)) { - DEBUG(5, ("check_ntlm_password: PAM Account for user [%s] suceeded\n", - pdb_username)); + DEBUG(5, ("check_ntlm_password: PAM Account for user [%s] succeeded\n", + unix_username)); } else { DEBUG(3, ("check_ntlm_password: PAM Account for user [%s] FAILED with error %s\n", - pdb_username, nt_errstr(nt_status))); + unix_username, nt_errstr(nt_status))); } } if (NT_STATUS_IS_OK(nt_status)) { DEBUG((*server_info)->guest ? 5 : 2, - ("check_ntlm_password: %sauthentication for user [%s] -> [%s] -> [%s] suceeded\n", + ("check_ntlm_password: %sauthentication for user [%s] -> [%s] -> [%s] succeeded\n", (*server_info)->guest ? "guest " : "", user_info->smb_name.str, user_info->internal_username.str, - pdb_username)); + unix_username)); } } @@ -451,8 +459,13 @@ NTSTATUS make_auth_context_subsystem(struct auth_context **auth_context) break; case SEC_USER: if (lp_encrypted_passwords()) { - DEBUG(5,("Making default auth method list for security=user, encrypt passwords = yes\n")); - auth_method_list = str_list_make("guest sam", NULL); + if ((lp_server_role() == ROLE_DOMAIN_PDC) || (lp_server_role() == ROLE_DOMAIN_BDC)) { + DEBUG(5,("Making default auth method list for DC, security=user, encrypt passwords = yes\n")); + auth_method_list = str_list_make("guest sam winbind:trustdomain", NULL); + } else { + DEBUG(5,("Making default auth method list for standalone security=user, encrypt passwords = yes\n")); + auth_method_list = str_list_make("guest sam", NULL); + } } else { DEBUG(5,("Making default auth method list for security=user, encrypt passwords = no\n")); auth_method_list = str_list_make("guest unix", NULL); diff --git a/source3/auth/auth_builtin.c b/source3/auth/auth_builtin.c index 5a9b5534ab..f7cdfe3fd2 100644 --- a/source3/auth/auth_builtin.c +++ b/source3/auth/auth_builtin.c @@ -38,7 +38,8 @@ static NTSTATUS check_guest_security(const struct auth_context *auth_context, const auth_usersupplied_info *user_info, auth_serversupplied_info **server_info) { - NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE; + /* mark this as 'not for me' */ + NTSTATUS nt_status = NT_STATUS_NOT_IMPLEMENTED; if (!(user_info->internal_username.str && *user_info->internal_username.str)) { @@ -86,11 +87,11 @@ static NTSTATUS check_name_to_ntstatus_security(const struct auth_context *auth_ fstrcpy(user, user_info->smb_name.str); if (strncasecmp("NT_STATUS", user, strlen("NT_STATUS")) == 0) { - strupper(user); + strupper_m(user); return nt_status_string_to_code(user); } - strlower(user); + strlower_m(user); error_num = strtoul(user, NULL, 16); DEBUG(5,("check_name_to_ntstatus_security: Error for user %s was %lx\n", user, error_num)); @@ -133,7 +134,7 @@ static NTSTATUS check_fixed_challenge_security(const struct auth_context *auth_c const auth_usersupplied_info *user_info, auth_serversupplied_info **server_info) { - return NT_STATUS_UNSUCCESSFUL; + return NT_STATUS_NOT_IMPLEMENTED; } /**************************************************************************** diff --git a/source3/auth/auth_domain.c b/source3/auth/auth_domain.c index bc03fecf74..56bd6b9aca 100644 --- a/source3/auth/auth_domain.c +++ b/source3/auth/auth_domain.c @@ -29,86 +29,6 @@ extern BOOL global_machine_password_needs_changing; extern userdom_struct current_user_info; -/* - resolve the name of a DC in ways appropriate for an ADS domain mode - an ADS domain may not have Netbios enabled at all, so this is - quite different from the RPC case - Note that we ignore the 'server' parameter here. That has the effect of using - the 'ADS server' smb.conf parameter, which is what we really want anyway - */ -static NTSTATUS ads_resolve_dc(fstring remote_machine, - struct in_addr *dest_ip) -{ - ADS_STRUCT *ads; - ads = ads_init_simple(); - if (!ads) { - return NT_STATUS_NO_LOGON_SERVERS; - } - - DEBUG(4,("ads_resolve_dc: realm=%s\n", ads->config.realm)); - - ads->auth.flags |= ADS_AUTH_NO_BIND; - -#ifdef HAVE_ADS - /* a full ads_connect() is actually overkill, as we don't srictly need - to do the SASL auth in order to get the info we need, but libads - doesn't offer a better way right now */ - ads_connect(ads); -#endif - - fstrcpy(remote_machine, ads->config.ldap_server_name); - strupper(remote_machine); - *dest_ip = ads->ldap_ip; - ads_destroy(&ads); - - if (!*remote_machine || is_zero_ip(*dest_ip)) { - return NT_STATUS_NO_LOGON_SERVERS; - } - - DEBUG(4,("ads_resolve_dc: using server='%s' IP=%s\n", - remote_machine, inet_ntoa(*dest_ip))); - - return NT_STATUS_OK; -} - -/* - resolve the name of a DC in ways appropriate for RPC domain mode - this relies on the server supporting netbios and port 137 not being - firewalled - */ -static NTSTATUS rpc_resolve_dc(const char *server, - fstring remote_machine, - struct in_addr *dest_ip) -{ - if (is_ipaddress(server)) { - struct in_addr to_ip = *interpret_addr2(server); - - /* we need to know the machines netbios name - this is a lousy - way to find it, but until we have a RPC call that does this - it will have to do */ - if (!name_status_find("*", 0x20, 0x20, to_ip, remote_machine)) { - DEBUG(2, ("rpc_resolve_dc: Can't resolve name for IP %s\n", server)); - return NT_STATUS_NO_LOGON_SERVERS; - } - - *dest_ip = to_ip; - return NT_STATUS_OK; - } - - fstrcpy(remote_machine, server); - strupper(remote_machine); - if (!resolve_name(remote_machine, dest_ip, 0x20)) { - DEBUG(1,("rpc_resolve_dc: Can't resolve address for %s\n", - remote_machine)); - return NT_STATUS_NO_LOGON_SERVERS; - } - - DEBUG(4,("rpc_resolve_dc: using server='%s' IP=%s\n", - remote_machine, inet_ntoa(*dest_ip))); - - return NT_STATUS_OK; -} - /** * Connect to a remote server for domain security authenticaion. * @@ -121,36 +41,14 @@ static NTSTATUS rpc_resolve_dc(const char *server, **/ static NTSTATUS connect_to_domain_password_server(struct cli_state **cli, - const char *server, + const char *dc_name, struct in_addr dc_ip, const char *setup_creds_as, uint16 sec_chan, const unsigned char *trust_passwd, BOOL *retry) { - struct in_addr dest_ip; - fstring remote_machine; NTSTATUS result; - uint32 neg_flags = 0x000001ff; - - *retry = False; - - if (lp_security() == SEC_ADS) - result = ads_resolve_dc(remote_machine, &dest_ip); - else - result = rpc_resolve_dc(server, remote_machine, &dest_ip); - - if (!NT_STATUS_IS_OK(result)) { - DEBUG(2,("connect_to_domain_password_server: unable to resolve DC: %s\n", - nt_errstr(result))); - return result; - } - if (ismyip(dest_ip)) { - DEBUG(1,("connect_to_domain_password_server: Password server loop - not using password server %s\n", - remote_machine)); - return NT_STATUS_NO_LOGON_SERVERS; - } - /* TODO: Send a SAMLOGON request to determine whether this is a valid logonserver. We can avoid a 30-second timeout if the DC is down if the SAMLOGON request fails as it is only over UDP. */ @@ -165,14 +63,13 @@ static NTSTATUS connect_to_domain_password_server(struct cli_state **cli, * ACCESS_DENIED errors if 2 auths are done from the same machine. JRA. */ - *retry = True; - - if (!grab_server_mutex(server)) + if (!grab_server_mutex(dc_name)) return NT_STATUS_NO_LOGON_SERVERS; /* Attempt connection */ - result = cli_full_connection(cli, global_myname(), remote_machine, - &dest_ip, 0, "IPC$", "IPC", "", "", "",0, retry); + *retry = True; + result = cli_full_connection(cli, global_myname(), dc_name, &dc_ip, 0, + "IPC$", "IPC", "", "", "", 0, retry); if (!NT_STATUS_IS_OK(result)) { /* map to something more useful */ @@ -199,7 +96,7 @@ static NTSTATUS connect_to_domain_password_server(struct cli_state **cli, if(cli_nt_session_open(*cli, PI_NETLOGON) == False) { DEBUG(0,("connect_to_domain_password_server: unable to open the domain client session to \ -machine %s. Error was : %s.\n", remote_machine, cli_errstr(*cli))); +machine %s. Error was : %s.\n", dc_name, cli_errstr(*cli))); cli_nt_session_close(*cli); cli_ulogoff(*cli); cli_shutdown(*cli); @@ -214,11 +111,11 @@ machine %s. Error was : %s.\n", remote_machine, cli_errstr(*cli))); return NT_STATUS_NO_MEMORY; } - result = cli_nt_setup_creds(*cli, sec_chan, trust_passwd, &neg_flags, 2); + result = cli_nt_establish_netlogon(*cli, sec_chan, trust_passwd); if (!NT_STATUS_IS_OK(result)) { DEBUG(0,("connect_to_domain_password_server: unable to setup the NETLOGON credentials to machine \ -%s. Error was : %s.\n", remote_machine, nt_errstr(result))); +%s. Error was : %s.\n", dc_name, nt_errstr(result))); cli_nt_session_close(*cli); cli_ulogoff(*cli); cli_shutdown(*cli); @@ -231,61 +128,6 @@ machine %s. Error was : %s.\n", remote_machine, cli_errstr(*cli))); return NT_STATUS_OK; } -/*********************************************************************** - Utility function to attempt a connection to an IP address of a DC. -************************************************************************/ - -static NTSTATUS attempt_connect_to_dc(struct cli_state **cli, - const char *domain, - struct in_addr *ip, - const char *setup_creds_as, - uint16 sec_chan, - const unsigned char *trust_passwd) -{ - NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - BOOL retry = True; - fstring dc_name; - int i; - - /* - * Ignore addresses we have already tried. - */ - - if (is_zero_ip(*ip)) - return NT_STATUS_NO_LOGON_SERVERS; - - if (!lookup_dc_name(global_myname(), domain, ip, dc_name)) - return NT_STATUS_NO_LOGON_SERVERS; - - for (i = 0; (!NT_STATUS_IS_OK(ret)) && retry && (i < 3); i++) - ret = connect_to_domain_password_server(cli, dc_name, setup_creds_as, - sec_chan, trust_passwd, &retry); - return ret; -} - -/*********************************************************************** - We have been asked to dynamically determine the IP addresses of - the PDC and BDC's for DOMAIN, and query them in turn. -************************************************************************/ -static NTSTATUS find_connect_dc(struct cli_state **cli, - const char *domain, - const char *setup_creds_as, - uint16 sec_chan, - unsigned char *trust_passwd, - time_t last_change_time) -{ - struct in_addr dc_ip; - fstring srv_name; - - if (!rpc_find_dc(domain, srv_name, &dc_ip)) { - DEBUG(0,("find_connect_dc: Failed to find an DCs for %s\n", lp_workgroup())); - return NT_STATUS_NO_LOGON_SERVERS; - } - - return attempt_connect_to_dc( cli, domain, &dc_ip, setup_creds_as, - sec_chan, trust_passwd ); -} - /*********************************************************************** Do the same as security=server, but using NT Domain calls and a session key from the machine password. If the server parameter is specified @@ -297,15 +139,17 @@ static NTSTATUS domain_client_validate(TALLOC_CTX *mem_ctx, const char *domain, uchar chal[8], auth_serversupplied_info **server_info, - const char *server, const char *setup_creds_as, + const char *dc_name, struct in_addr dc_ip, + const char *setup_creds_as, uint16 sec_chan, unsigned char trust_passwd[16], time_t last_change_time) { - fstring remote_machine; NET_USER_INFO_3 info3; struct cli_state *cli = NULL; NTSTATUS nt_status = NT_STATUS_NO_LOGON_SERVERS; + int i; + BOOL retry = True; /* * At this point, smb_apasswd points to the lanman response to @@ -315,20 +159,14 @@ static NTSTATUS domain_client_validate(TALLOC_CTX *mem_ctx, * see if they were valid. */ - while (!NT_STATUS_IS_OK(nt_status) && - next_token(&server,remote_machine,LIST_SEP,sizeof(remote_machine))) { - if(lp_security() != SEC_ADS && strequal(remote_machine, "*")) { - nt_status = find_connect_dc(&cli, domain, setup_creds_as, sec_chan, trust_passwd, last_change_time); - } else { - int i; - BOOL retry = True; - for (i = 0; !NT_STATUS_IS_OK(nt_status) && retry && (i < 3); i++) - nt_status = connect_to_domain_password_server(&cli, remote_machine, setup_creds_as, - sec_chan, trust_passwd, &retry); - } + /* rety loop for robustness */ + + for (i = 0; !NT_STATUS_IS_OK(nt_status) && retry && (i < 3); i++) { + nt_status = connect_to_domain_password_server(&cli, dc_name, dc_ip, setup_creds_as, + sec_chan, trust_passwd, &retry); } - if (!NT_STATUS_IS_OK(nt_status)) { + if ( !NT_STATUS_IS_OK(nt_status) ) { DEBUG(0,("domain_client_validate: Domain password server not available.\n")); return nt_status; } @@ -341,11 +179,15 @@ static NTSTATUS domain_client_validate(TALLOC_CTX *mem_ctx, */ nt_status = cli_netlogon_sam_network_logon(cli, mem_ctx, - user_info->smb_name.str, user_info->domain.str, - user_info->wksta_name.str, chal, - user_info->lm_resp, user_info->nt_resp, - &info3); + NULL, user_info->smb_name.str, user_info->domain.str, + user_info->wksta_name.str, chal, user_info->lm_resp, + user_info->nt_resp, &info3); + /* let go as soon as possible so we avoid any potential deadlocks + with winbind lookup up users or groups */ + + release_server_mutex(); + if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0,("domain_client_validate: unable to validate password " "for user %s in domain %s to Domain controller %s. " @@ -360,7 +202,7 @@ static NTSTATUS domain_client_validate(TALLOC_CTX *mem_ctx, } else { nt_status = make_server_info_info3(mem_ctx, user_info->internal_username.str, user_info->smb_name.str, domain, server_info, &info3); - uni_group_cache_store_netlogon(mem_ctx, &info3); + netsamlogon_cache_store( mem_ctx, &info3 ); } #if 0 @@ -373,7 +215,7 @@ static NTSTATUS domain_client_validate(TALLOC_CTX *mem_ctx, if (NT_STATUS_IS_OK(status)) { if(cli_nt_logoff(&cli, &ctr) == False) { DEBUG(0,("domain_client_validate: unable to log off user %s in domain \ -%s to Domain controller %s. Error was %s.\n", user, domain, remote_machine, cli_errstr(&cli))); +%s to Domain controller %s. Error was %s.\n", user, domain, dc_name, cli_errstr(&cli))); nt_status = NT_STATUS_LOGON_FAILURE; } } @@ -386,7 +228,6 @@ static NTSTATUS domain_client_validate(TALLOC_CTX *mem_ctx, cli_nt_session_close(cli); cli_ulogoff(cli); cli_shutdown(cli); - release_server_mutex(); return nt_status; } @@ -401,11 +242,18 @@ static NTSTATUS check_ntdomain_security(const struct auth_context *auth_context, auth_serversupplied_info **server_info) { NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE; - char *password_server; unsigned char trust_passwd[16]; time_t last_change_time; const char *domain = lp_workgroup(); uint32 sec_channel_type = 0; + fstring dc_name; + struct in_addr dc_ip; + + if ( lp_server_role() != ROLE_DOMAIN_MEMBER ) { + DEBUG(0,("check_ntdomain_security: Configuration error! Cannot use " + "ntdomain auth method when not a member of a domain.\n")); + return NT_STATUS_NOT_IMPLEMENTED; + } if (!user_info || !server_info || !auth_context) { DEBUG(1,("check_ntdomain_security: Critical variables not present. Failing.\n")); @@ -418,9 +266,9 @@ static NTSTATUS check_ntdomain_security(const struct auth_context *auth_context, * password file. */ - if(is_myname(user_info->domain.str)) { + if(strequal(get_global_sam_name(), user_info->domain.str)) { DEBUG(3,("check_ntdomain_security: Requested domain was for this machine.\n")); - return NT_STATUS_LOGON_FAILURE; + return NT_STATUS_NOT_IMPLEMENTED; } /* @@ -443,22 +291,23 @@ static NTSTATUS check_ntdomain_security(const struct auth_context *auth_context, } } - /* - * Treat each name in the 'password server =' line as a potential - * PDC/BDC. Contact each in turn and try and authenticate. - */ - - password_server = lp_passwordserver(); + /* we need our DC to send the net_sam_logon() request to */ + if ( !get_dc_name(domain, dc_name, &dc_ip) ) { + DEBUG(5,("check_trustdomain_security: unable to locate a DC for domain %s\n", + user_info->domain.str)); + return NT_STATUS_NO_LOGON_SERVERS; + } + nt_status = domain_client_validate(mem_ctx, user_info, domain, - (uchar *)auth_context->challenge.data, - server_info, - password_server, global_myname(), sec_channel_type,trust_passwd, last_change_time); + (uchar *)auth_context->challenge.data, server_info, dc_name, dc_ip, + global_myname(), sec_channel_type,trust_passwd, last_change_time); + return nt_status; } /* module initialisation */ -NTSTATUS auth_init_ntdomain(struct auth_context *auth_context, const char* param, auth_methods **auth_method) +static NTSTATUS auth_init_ntdomain(struct auth_context *auth_context, const char* param, auth_methods **auth_method) { if (!make_auth_methods(auth_context, auth_method)) { return NT_STATUS_NO_MEMORY; @@ -485,6 +334,8 @@ static NTSTATUS check_trustdomain_security(const struct auth_context *auth_conte char *trust_password; time_t last_change_time; DOM_SID sid; + fstring dc_name; + struct in_addr dc_ip; if (!user_info || !server_info || !auth_context) { DEBUG(1,("check_trustdomain_security: Critical variables not present. Failing.\n")); @@ -492,25 +343,22 @@ static NTSTATUS check_trustdomain_security(const struct auth_context *auth_conte } /* - * Check that the requested domain is not our own machine name. - * If it is, we should never check the PDC here, we use our own local - * password file. + * Check that the requested domain is not our own machine name or domain name. */ - if(is_myname(user_info->domain.str)) { - DEBUG(3,("check_trustdomain_security: Requested domain was for this machine.\n")); - return NT_STATUS_LOGON_FAILURE; + if( strequal(get_global_sam_name(), user_info->domain.str)) { + DEBUG(3,("check_trustdomain_security: Requested domain [%s] was for this machine.\n", + user_info->domain.str)); + return NT_STATUS_NOT_IMPLEMENTED; } - /* - * Check that the requested domain is not our own domain, - * If it is, we should use our own local password file. - */ - - if(strequal(lp_workgroup(), (user_info->domain.str))) { - DEBUG(3,("check_trustdomain_security: Requested domain was for this domain.\n")); - return NT_STATUS_LOGON_FAILURE; - } + /* No point is bothering if this is not a trusted domain. + This return makes "map to guest = bad user" work again. + The logic is that if we know nothing about the domain, that + user is known to us and does not exist */ + + if ( !is_trusted_domain( user_info->domain.str ) ) + return NT_STATUS_NOT_IMPLEMENTED; /* * Get the trusted account password for the trusted domain @@ -537,16 +385,24 @@ static NTSTATUS check_trustdomain_security(const struct auth_context *auth_conte } #endif - nt_status = domain_client_validate(mem_ctx, user_info, user_info->domain.str, - (uchar *)auth_context->challenge.data, - server_info, "*" /* Do a lookup */, - lp_workgroup(), SEC_CHAN_DOMAIN, trust_md4_password, last_change_time); + /* use get_dc_name() for consistency even through we know that it will be + a netbios name */ + + if ( !get_dc_name(user_info->domain.str, dc_name, &dc_ip) ) { + DEBUG(5,("check_trustdomain_security: unable to locate a DC for domain %s\n", + user_info->domain.str)); + return NT_STATUS_NO_LOGON_SERVERS; + } + nt_status = domain_client_validate(mem_ctx, user_info, user_info->domain.str, + (uchar *)auth_context->challenge.data, server_info, dc_name, dc_ip, + lp_workgroup(), SEC_CHAN_DOMAIN, trust_md4_password, last_change_time); + return nt_status; } /* module initialisation */ -NTSTATUS auth_init_trustdomain(struct auth_context *auth_context, const char* param, auth_methods **auth_method) +static NTSTATUS auth_init_trustdomain(struct auth_context *auth_context, const char* param, auth_methods **auth_method) { if (!make_auth_methods(auth_context, auth_method)) { return NT_STATUS_NO_MEMORY; diff --git a/source3/auth/auth_rhosts.c b/source3/auth/auth_rhosts.c index 3411083116..fab2d551f2 100644 --- a/source3/auth/auth_rhosts.c +++ b/source3/auth/auth_rhosts.c @@ -139,7 +139,7 @@ static BOOL check_hosts_equiv(SAM_ACCOUNT *account) char *fname = NULL; fname = lp_hosts_equiv(); - if (NT_STATUS_IS_ERR(sid_to_uid(pdb_get_user_sid(account), &uid))) + if (!NT_STATUS_IS_OK(sid_to_uid(pdb_get_user_sid(account), &uid))) return False; /* note: don't allow hosts.equiv on root */ @@ -162,11 +162,13 @@ static NTSTATUS check_hostsequiv_security(const struct auth_context *auth_contex const auth_usersupplied_info *user_info, auth_serversupplied_info **server_info) { - NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE; + NTSTATUS nt_status; SAM_ACCOUNT *account = NULL; if (!NT_STATUS_IS_OK(nt_status = auth_get_sam_account(user_info->internal_username.str, &account))) { + if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) + nt_status = NT_STATUS_NOT_IMPLEMENTED; return nt_status; } @@ -174,14 +176,14 @@ static NTSTATUS check_hostsequiv_security(const struct auth_context *auth_contex nt_status = make_server_info_sam(server_info, account); } else { pdb_free_sam(&account); - nt_status = NT_STATUS_LOGON_FAILURE; + nt_status = NT_STATUS_NOT_IMPLEMENTED; } return nt_status; } /* module initialisation */ -NTSTATUS auth_init_hostsequiv(struct auth_context *auth_context, const char* param, auth_methods **auth_method) +static NTSTATUS auth_init_hostsequiv(struct auth_context *auth_context, const char* param, auth_methods **auth_method) { if (!make_auth_methods(auth_context, auth_method)) { return NT_STATUS_NO_MEMORY; @@ -203,7 +205,7 @@ static NTSTATUS check_rhosts_security(const struct auth_context *auth_context, const auth_usersupplied_info *user_info, auth_serversupplied_info **server_info) { - NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE; + NTSTATUS nt_status; SAM_ACCOUNT *account = NULL; pstring rhostsfile; const char *home; @@ -211,6 +213,8 @@ static NTSTATUS check_rhosts_security(const struct auth_context *auth_context, if (!NT_STATUS_IS_OK(nt_status = auth_get_sam_account(user_info->internal_username.str, &account))) { + if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) + nt_status = NT_STATUS_NOT_IMPLEMENTED; return nt_status; } @@ -223,19 +227,18 @@ static NTSTATUS check_rhosts_security(const struct auth_context *auth_context, nt_status = make_server_info_sam(server_info, account); } else { pdb_free_sam(&account); - nt_status = NT_STATUS_LOGON_FAILURE; } unbecome_root(); } else { pdb_free_sam(&account); - nt_status = NT_STATUS_LOGON_FAILURE; + nt_status = NT_STATUS_NOT_IMPLEMENTED; } return nt_status; } /* module initialisation */ -NTSTATUS auth_init_rhosts(struct auth_context *auth_context, const char *param, auth_methods **auth_method) +static NTSTATUS auth_init_rhosts(struct auth_context *auth_context, const char *param, auth_methods **auth_method) { if (!make_auth_methods(auth_context, auth_method)) { return NT_STATUS_NO_MEMORY; diff --git a/source3/auth/auth_sam.c b/source3/auth/auth_sam.c index a7e49a270f..012696f46a 100644 --- a/source3/auth/auth_sam.c +++ b/source3/auth/auth_sam.c @@ -4,6 +4,7 @@ Copyright (C) Andrew Tridgell 1992-2000 Copyright (C) Luke Kenneth Casson Leighton 1996-2000 Copyright (C) Andrew Bartlett 2001 + Copyright (C) Gerald Carter 2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -28,9 +29,9 @@ /**************************************************************************** core of smb password checking routine. ****************************************************************************/ -static BOOL smb_pwd_check_ntlmv1(DATA_BLOB nt_response, +static BOOL smb_pwd_check_ntlmv1(const DATA_BLOB *nt_response, const uchar *part_passwd, - DATA_BLOB sec_blob, + const DATA_BLOB *sec_blob, uint8 user_sess_key[16]) { /* Finish the encryption of part_passwd. */ @@ -42,17 +43,17 @@ static BOOL smb_pwd_check_ntlmv1(DATA_BLOB nt_response, return False; } - if (sec_blob.length != 8) { - DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect challenge size (%d)\n", sec_blob.length)); + if (sec_blob->length != 8) { + DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect challenge size (%d)\n", sec_blob->length)); return False; } - if (nt_response.length != 24) { - DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect password length (%d)\n", nt_response.length)); + if (nt_response->length != 24) { + DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect password length (%d)\n", nt_response->length)); return False; } - SMBOWFencrypt(part_passwd, sec_blob.data, p24); + SMBOWFencrypt(part_passwd, sec_blob->data, p24); if (user_sess_key != NULL) { SMBsesskeygen_ntv1(part_passwd, NULL, user_sess_key); @@ -61,16 +62,16 @@ static BOOL smb_pwd_check_ntlmv1(DATA_BLOB nt_response, #if DEBUG_PASSWORD - DEBUG(100,("Part password (P16) was |")); + DEBUG(100,("Part password (P16) was |\n")); dump_data(100, part_passwd, 16); - DEBUG(100,("Password from client was |")); - dump_data(100, nt_response.data, nt_response.length); - DEBUG(100,("Given challenge was |")); - dump_data(100, sec_blob.data, sec_blob.length); - DEBUG(100,("Value from encryption was |")); + DEBUGADD(100,("Password from client was |\n")); + dump_data(100, nt_response->data, nt_response->length); + DEBUGADD(100,("Given challenge was |\n")); + dump_data(100, sec_blob->data, sec_blob->length); + DEBUGADD(100,("Value from encryption was |\n")); dump_data(100, p24, 24); #endif - return (memcmp(p24, nt_response.data, 24) == 0); + return (memcmp(p24, nt_response->data, 24) == 0); } @@ -79,9 +80,9 @@ core of smb password checking routine. (NTLMv2, LMv2) Note: The same code works with both NTLMv2 and LMv2. ****************************************************************************/ -static BOOL smb_pwd_check_ntlmv2(const DATA_BLOB ntv2_response, +static BOOL smb_pwd_check_ntlmv2(const DATA_BLOB *ntv2_response, const uchar *part_passwd, - const DATA_BLOB sec_blob, + const DATA_BLOB *sec_blob, const char *user, const char *domain, uint8 user_sess_key[16]) { @@ -98,42 +99,43 @@ static BOOL smb_pwd_check_ntlmv2(const DATA_BLOB ntv2_response, return False; } - if (ntv2_response.length < 16) { + if (ntv2_response->length < 24) { /* We MUST have more than 16 bytes, or the stuff below will go - crazy... */ + crazy. No known implementation sends less than the 24 bytes + for LMv2, let alone NTLMv2. */ DEBUG(0, ("smb_pwd_check_ntlmv2: incorrect password length (%d)\n", - ntv2_response.length)); + ntv2_response->length)); return False; } - client_key_data = data_blob(ntv2_response.data+16, ntv2_response.length-16); + client_key_data = data_blob(ntv2_response->data+16, ntv2_response->length-16); /* todo: should we be checking this for anything? We can't for LMv2, but for NTLMv2 it is meant to contain the current time etc. */ - memcpy(client_response, ntv2_response.data, sizeof(client_response)); + memcpy(client_response, ntv2_response->data, sizeof(client_response)); if (!ntv2_owf_gen(part_passwd, user, domain, kr)) { return False; } - SMBOWFencrypt_ntv2(kr, sec_blob, client_key_data, value_from_encryption); + SMBOWFencrypt_ntv2(kr, sec_blob, &client_key_data, value_from_encryption); if (user_sess_key != NULL) { SMBsesskeygen_ntv2(kr, value_from_encryption, user_sess_key); } #if DEBUG_PASSWORD - DEBUG(100,("Part password (P16) was |")); + DEBUG(100,("Part password (P16) was |\n")); dump_data(100, part_passwd, 16); - DEBUG(100,("Password from client was |")); - dump_data(100, ntv2_response.data, ntv2_response.length); - DEBUG(100,("Variable data from client was |")); + DEBUGADD(100,("Password from client was |\n")); + dump_data(100, ntv2_response->data, ntv2_response->length); + DEBUGADD(100,("Variable data from client was |\n")); dump_data(100, client_key_data.data, client_key_data.length); - DEBUG(100,("Given challenge was |")); - dump_data(100, sec_blob.data, sec_blob.length); - DEBUG(100,("Value from encryption was |")); + DEBUGADD(100,("Given challenge was |\n")); + dump_data(100, sec_blob->data, sec_blob->length); + DEBUGADD(100,("Value from encryption was |\n")); dump_data(100, value_from_encryption, 16); #endif data_blob_clear_free(&client_key_data); @@ -185,8 +187,8 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, use it (ie. does it exist in the smbpasswd file). */ DEBUG(4,("sam_password_ok: Checking NTLMv2 password with domain [%s]\n", user_info->client_domain.str)); - if (smb_pwd_check_ntlmv2( user_info->nt_resp, - nt_pw, auth_context->challenge, + if (smb_pwd_check_ntlmv2( &user_info->nt_resp, + nt_pw, &auth_context->challenge, user_info->smb_name.str, user_info->client_domain.str, user_sess_key)) @@ -195,11 +197,12 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, } DEBUG(4,("sam_password_ok: Checking NTLMv2 password without a domain\n")); - if (smb_pwd_check_ntlmv2( user_info->nt_resp, - nt_pw, auth_context->challenge, + if (smb_pwd_check_ntlmv2( &user_info->nt_resp, + nt_pw, &auth_context->challenge, user_info->smb_name.str, "", user_sess_key)) + { return NT_STATUS_OK; } else { @@ -213,8 +216,8 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, use it (ie. does it exist in the smbpasswd file). */ DEBUG(4,("sam_password_ok: Checking NT MD4 password\n")); - if (smb_pwd_check_ntlmv1(user_info->nt_resp, - nt_pw, auth_context->challenge, + if (smb_pwd_check_ntlmv1(&user_info->nt_resp, + nt_pw, &auth_context->challenge, user_sess_key)) { return NT_STATUS_OK; @@ -224,7 +227,7 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, } } else { DEBUG(2,("sam_password_ok: NTLMv1 passwords NOT PERMITTED for user %s\n",pdb_get_username(sampass))); - /* no return, because we might pick up LMv2 in the LM field */ + /* no return, becouse we might pick up LMv2 in the LM field */ } } @@ -242,8 +245,8 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, lm_pw = pdb_get_lanman_passwd(sampass); DEBUG(4,("sam_password_ok: Checking LM password\n")); - if (smb_pwd_check_ntlmv1(user_info->lm_resp, - lm_pw, auth_context->challenge, + if (smb_pwd_check_ntlmv1(&user_info->lm_resp, + lm_pw, &auth_context->challenge, user_sess_key)) { return NT_STATUS_OK; @@ -261,8 +264,8 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, - related to Win9X, legacy NAS pass-though authentication */ DEBUG(4,("sam_password_ok: Checking LMv2 password with domain %s\n", user_info->client_domain.str)); - if (smb_pwd_check_ntlmv2( user_info->lm_resp, - nt_pw, auth_context->challenge, + if (smb_pwd_check_ntlmv2( &user_info->lm_resp, + nt_pw, &auth_context->challenge, user_info->smb_name.str, user_info->client_domain.str, user_sess_key)) @@ -271,8 +274,8 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, } DEBUG(4,("sam_password_ok: Checking LMv2 password without a domain\n")); - if (smb_pwd_check_ntlmv2( user_info->lm_resp, - nt_pw, auth_context->challenge, + if (smb_pwd_check_ntlmv2( &user_info->lm_resp, + nt_pw, &auth_context->challenge, user_info->smb_name.str, "", user_sess_key)) @@ -286,8 +289,8 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, DEBUG(4,("sam_password_ok: Checking NT MD4 password in LM field\n")); if (lp_ntlm_auth()) { - if (smb_pwd_check_ntlmv1(user_info->lm_resp, - nt_pw, auth_context->challenge, + if (smb_pwd_check_ntlmv1(&user_info->lm_resp, + nt_pw, &auth_context->challenge, user_sess_key)) { return NT_STATUS_OK; @@ -330,7 +333,7 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx, kickoff_time = pdb_get_kickoff_time(sampass); if (kickoff_time != 0 && time(NULL) > kickoff_time) { - DEBUG(1,("Account for user '%s' has expried.\n", pdb_get_username(sampass))); + DEBUG(1,("Account for user '%s' has expired.\n", pdb_get_username(sampass))); DEBUG(3,("Account expired at '%ld' unix time.\n", (long)kickoff_time)); return NT_STATUS_ACCOUNT_EXPIRED; } @@ -438,14 +441,14 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context, return NT_STATUS_NO_SUCH_USER; } - nt_status = sam_account_ok(mem_ctx, sampass, user_info); + nt_status = sam_password_ok(auth_context, mem_ctx, sampass, user_info, user_sess_key); if (!NT_STATUS_IS_OK(nt_status)) { pdb_free_sam(&sampass); return nt_status; } - nt_status = sam_password_ok(auth_context, mem_ctx, sampass, user_info, user_sess_key); + nt_status = sam_account_ok(mem_ctx, sampass, user_info); if (!NT_STATUS_IS_OK(nt_status)) { pdb_free_sam(&sampass); @@ -468,14 +471,14 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context, } /* module initialisation */ -NTSTATUS auth_init_sam(struct auth_context *auth_context, const char *param, auth_methods **auth_method) +static NTSTATUS auth_init_sam_ignoredomain(struct auth_context *auth_context, const char *param, auth_methods **auth_method) { if (!make_auth_methods(auth_context, auth_method)) { return NT_STATUS_NO_MEMORY; } (*auth_method)->auth = check_sam_security; - (*auth_method)->name = "sam"; + (*auth_method)->name = "sam_ignoredomain"; return NT_STATUS_OK; } @@ -490,83 +493,55 @@ static NTSTATUS check_samstrict_security(const struct auth_context *auth_context const auth_usersupplied_info *user_info, auth_serversupplied_info **server_info) { + BOOL is_local_name, is_my_domain; if (!user_info || !auth_context) { return NT_STATUS_LOGON_FAILURE; } - /* If we are a domain member, we must not - attempt to check the password locally, - unless it is one of our aliases. */ + is_local_name = is_myname(user_info->domain.str); + is_my_domain = strequal(user_info->domain.str, lp_workgroup()); + + /* check whether or not we service this domain/workgroup name */ - if (!is_myname(user_info->domain.str)) { - DEBUG(7,("The requested user domain is not the local server name. [%s]\\[%s]\n", - user_info->domain.str,user_info->internal_username.str)); - return NT_STATUS_NO_SUCH_USER; + switch ( lp_server_role() ) { + case ROLE_STANDALONE: + case ROLE_DOMAIN_MEMBER: + if ( !is_local_name ) { + DEBUG(6,("check_samstrict_security: %s is not one of my local names (%s)\n", + user_info->domain.str, (lp_server_role() == ROLE_DOMAIN_MEMBER + ? "ROLE_DOMAIN_MEMBER" : "ROLE_STANDALONE") )); + return NT_STATUS_NOT_IMPLEMENTED; + } + case ROLE_DOMAIN_PDC: + case ROLE_DOMAIN_BDC: + if ( !is_local_name && !is_my_domain ) { + DEBUG(6,("check_samstrict_security: %s is not one of my local names or domain name (DC)\n", + user_info->domain.str)); + return NT_STATUS_NOT_IMPLEMENTED; + } + default: /* name is ok */ + break; } return check_sam_security(auth_context, my_private_data, mem_ctx, user_info, server_info); } /* module initialisation */ -NTSTATUS auth_init_samstrict(struct auth_context *auth_context, const char *param, auth_methods **auth_method) +static NTSTATUS auth_init_sam(struct auth_context *auth_context, const char *param, auth_methods **auth_method) { if (!make_auth_methods(auth_context, auth_method)) { return NT_STATUS_NO_MEMORY; } (*auth_method)->auth = check_samstrict_security; - (*auth_method)->name = "samstrict"; - return NT_STATUS_OK; -} - -/**************************************************************************** -Check SAM security (above) but with a few extra checks if we're a DC. -****************************************************************************/ - -static NTSTATUS check_samstrict_dc_security(const struct auth_context *auth_context, - void *my_private_data, - TALLOC_CTX *mem_ctx, - const auth_usersupplied_info *user_info, - auth_serversupplied_info **server_info) -{ - - if (!user_info || !auth_context) { - return NT_STATUS_LOGON_FAILURE; - } - - /* If we are a domain member, we must not - attempt to check the password locally, - unless it is one of our aliases, empty - or our domain if we are a logon server.*/ - - - if ((!is_myworkgroup(user_info->domain.str))&& - (!is_myname(user_info->domain.str))) { - DEBUG(7,("The requested user domain is not the local server name or our domain. [%s]\\[%s]\n", - user_info->domain.str,user_info->internal_username.str)); - return NT_STATUS_NO_SUCH_USER; - } - - return check_sam_security(auth_context, my_private_data, mem_ctx, user_info, server_info); -} - -/* module initialisation */ -NTSTATUS auth_init_samstrict_dc(struct auth_context *auth_context, const char *param, auth_methods **auth_method) -{ - if (!make_auth_methods(auth_context, auth_method)) { - return NT_STATUS_NO_MEMORY; - } - - (*auth_method)->auth = check_samstrict_dc_security; - (*auth_method)->name = "samstrict_dc"; + (*auth_method)->name = "sam"; return NT_STATUS_OK; } NTSTATUS auth_sam_init(void) { - smb_register_auth(AUTH_INTERFACE_VERSION, "samstrict_dc", auth_init_samstrict_dc); - smb_register_auth(AUTH_INTERFACE_VERSION, "samstrict", auth_init_samstrict); smb_register_auth(AUTH_INTERFACE_VERSION, "sam", auth_init_sam); + smb_register_auth(AUTH_INTERFACE_VERSION, "sam_ignoredomain", auth_init_sam_ignoredomain); return NT_STATUS_OK; } diff --git a/source3/auth/auth_server.c b/source3/auth/auth_server.c index 73af290af2..30e0e13a56 100644 --- a/source3/auth/auth_server.c +++ b/source3/auth/auth_server.c @@ -50,7 +50,7 @@ static struct cli_state *server_cryptkey(TALLOC_CTX *mem_ctx) while(next_token( &p, desthost, LIST_SEP, sizeof(desthost))) { standard_sub_basic(current_user_info.smb_name, desthost, sizeof(desthost)); - strupper(desthost); + strupper_m(desthost); if(!resolve_name( desthost, &dest_ip, 0x20)) { DEBUG(1,("server_cryptkey: Can't resolve address for %s\n",desthost)); @@ -222,7 +222,7 @@ static NTSTATUS check_smbserver_security(const struct auth_context *auth_context static fstring baduser; static BOOL tested_password_server = False; static BOOL bad_password_server = False; - NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE; + NTSTATUS nt_status = NT_STATUS_NOT_IMPLEMENTED; BOOL locally_made_cli = False; /* @@ -233,7 +233,7 @@ static NTSTATUS check_smbserver_security(const struct auth_context *auth_context if(is_myname(user_info->domain.str)) { DEBUG(3,("check_smbserver_security: Requested domain was for this machine.\n")); - return NT_STATUS_LOGON_FAILURE; + return nt_status; } cli = my_private_data; @@ -372,12 +372,19 @@ use this machine as the password server.\n")); cli_ulogoff(cli); - if NT_STATUS_IS_OK(nt_status) { + if (NT_STATUS_IS_OK(nt_status)) { struct passwd *pass = Get_Pwnam(user_info->internal_username.str); if (pass) { nt_status = make_server_info_pw(server_info, pass); } else { - nt_status = NT_STATUS_NO_SUCH_USER; + auth_add_user_script(user_info->domain.str, user_info->internal_username.str); + pass = Get_Pwnam(user_info->internal_username.str); + + if (pass) { + nt_status = make_server_info_pw(server_info, pass); + } else { + nt_status = NT_STATUS_NO_SUCH_USER; + } } } @@ -388,7 +395,7 @@ use this machine as the password server.\n")); return(nt_status); } -NTSTATUS auth_init_smbserver(struct auth_context *auth_context, const char* param, auth_methods **auth_method) +static NTSTATUS auth_init_smbserver(struct auth_context *auth_context, const char* param, auth_methods **auth_method) { if (!make_auth_methods(auth_context, auth_method)) { return NT_STATUS_NO_MEMORY; diff --git a/source3/auth/auth_unix.c b/source3/auth/auth_unix.c index 392178f77c..b9de6f7acb 100644 --- a/source3/auth/auth_unix.c +++ b/source3/auth/auth_unix.c @@ -119,7 +119,7 @@ static NTSTATUS check_unix_security(const struct auth_context *auth_context, } /* module initialisation */ -NTSTATUS auth_init_unix(struct auth_context *auth_context, const char* param, auth_methods **auth_method) +static NTSTATUS auth_init_unix(struct auth_context *auth_context, const char* param, auth_methods **auth_method) { if (!make_auth_methods(auth_context, auth_method)) { return NT_STATUS_NO_MEMORY; diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c index e8f2af41f3..8e1b420b47 100644 --- a/source3/auth/auth_util.c +++ b/source3/auth/auth_util.c @@ -1,4 +1,4 @@ -/* +/* Unix SMB/CIFS implementation. Authentication utility functions Copyright (C) Andrew Tridgell 1992-1998 @@ -36,7 +36,7 @@ extern DOM_SID global_sid_Authenticated_Users; Create a UNIX user on demand. ****************************************************************************/ -static int smb_create_user(const char *unix_user, const char *homedir) +static int smb_create_user(const char *domain, const char *unix_username, const char *homedir) { pstring add_script; int ret; @@ -44,7 +44,9 @@ static int smb_create_user(const char *unix_user, const char *homedir) pstrcpy(add_script, lp_adduser_script()); if (! *add_script) return -1; - all_string_sub(add_script, "%u", unix_user, sizeof(pstring)); + all_string_sub(add_script, "%u", unix_username, sizeof(pstring)); + if (domain) + all_string_sub(add_script, "%D", domain, sizeof(pstring)); if (homedir) all_string_sub(add_script, "%H", homedir, sizeof(pstring)); ret = smbrun(add_script,NULL); @@ -54,25 +56,30 @@ static int smb_create_user(const char *unix_user, const char *homedir) /**************************************************************************** Add and Delete UNIX users on demand, based on NTSTATUS codes. + We don't care about RID's here so ignore. ****************************************************************************/ -void smb_user_control(const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info, NTSTATUS nt_status) +void auth_add_user_script(const char *domain, const char *username) { - struct passwd *pwd=NULL; - - if (NT_STATUS_IS_OK(nt_status)) { - - if (!(server_info->sam_fill_level & SAM_FILL_UNIX)) { - - /* - * User validated ok against Domain controller. - * If the admin wants us to try and create a UNIX - * user on the fly, do so. - */ - - if(lp_adduser_script() && !(pwd = Get_Pwnam(user_info->internal_username.str))) { - smb_create_user(user_info->internal_username.str, NULL); - } + uint32 rid; + /* + * User validated ok against Domain controller. + * If the admin wants us to try and create a UNIX + * user on the fly, do so. + */ + + if ( lp_adduser_script() ) + smb_create_user(domain, username, NULL); + else { + DEBUG(10,("auth_add_user_script: no 'add user script'. Asking winbindd\n")); + + /* should never get here is we a re a domain member running winbindd + However, a host set for 'security = server' might run winbindd for + account allocation */ + + if ( !winbind_create_user(username, NULL) ) { + DEBUG(5,("auth_add_user_script: winbindd_create_user() failed\n")); + rid = 0; } } } @@ -208,41 +215,26 @@ NTSTATUS make_user_info_map(auth_usersupplied_info **user_info, DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n", client_domain, smb_name, wksta_name)); - if (lp_allow_trusted_domains() && *client_domain) { - - /* the client could have given us a workstation name - or other crap for the workgroup - we really need a - way of telling if this domain name is one of our - trusted domain names - - Also don't allow "" as a domain, fixes a Win9X bug + /* don't allow "" as a domain, fixes a Win9X bug where it doens't supply a domain for logon script - 'net use' commands. - - Finally, we do this by looking up a cache of trusted domains! - */ + 'net use' commands.*/ + if ( *client_domain ) domain = client_domain; + else + domain = lp_workgroup(); - if (is_trusted_domain(domain)) { - return make_user_info(user_info, smb_name, internal_username, - client_domain, domain, wksta_name, - lm_pwd, nt_pwd, plaintext, ntlmssp_flags, - encrypted); - } + /* do what win2k does. Always map unknown domains to our own + and let the "passdb backend" handle unknown users. */ - } else { - domain = lp_workgroup(); - } + if ( !is_trusted_domain(domain) ) + domain = get_default_sam_name(); - return make_user_info(user_info, - smb_name, internal_username, - client_domain, domain, - wksta_name, - lm_pwd, nt_pwd, - plaintext, - ntlmssp_flags, encrypted); + /* we know that it is a trusted domain (and we are allowing them) or it is our domain */ + return make_user_info(user_info, smb_name, internal_username, + client_domain, domain, wksta_name, lm_pwd, nt_pwd, + plaintext, ntlmssp_flags, encrypted); } /**************************************************************************** @@ -611,10 +603,10 @@ NT_USER_TOKEN *create_nt_token(uid_t uid, gid_t gid, int ngroups, gid_t *groups, NT_USER_TOKEN *token; int i; - if (NT_STATUS_IS_ERR(uid_to_sid(&user_sid, uid))) { + if (!NT_STATUS_IS_OK(uid_to_sid(&user_sid, uid))) { return NULL; } - if (NT_STATUS_IS_ERR(gid_to_sid(&group_sid, gid))) { + if (!NT_STATUS_IS_OK(gid_to_sid(&group_sid, gid))) { return NULL; } @@ -625,7 +617,7 @@ NT_USER_TOKEN *create_nt_token(uid_t uid, gid_t gid, int ngroups, gid_t *groups, } for (i = 0; i < ngroups; i++) { - if (NT_STATUS_IS_ERR(gid_to_sid(&(group_sids)[i], (groups)[i]))) { + if (!NT_STATUS_IS_OK(gid_to_sid(&(group_sids)[i], (groups)[i]))) { DEBUG(1, ("create_nt_token: failed to convert gid %ld to a sid!\n", (long int)groups[i])); SAFE_FREE(group_sids); return NULL; @@ -654,29 +646,22 @@ NT_USER_TOKEN *create_nt_token(uid_t uid, gid_t gid, int ngroups, gid_t *groups, * of groups. ******************************************************************************/ -static NTSTATUS get_user_groups_from_local_sam(SAM_ACCOUNT *sampass, +static NTSTATUS get_user_groups_from_local_sam(const char *username, uid_t uid, gid_t gid, int *n_groups, DOM_SID **groups, gid_t **unix_groups) { - uid_t uid; - gid_t gid; int n_unix_groups; int i; *n_groups = 0; *groups = NULL; - if (NT_STATUS_IS_ERR(sid_to_uid(pdb_get_user_sid(sampass), &uid)) || NT_STATUS_IS_ERR(sid_to_gid(pdb_get_group_sid(sampass), &gid))) { - DEBUG(0, ("get_user_groups_from_local_sam: error fetching uid or gid for user!\n")); - return NT_STATUS_UNSUCCESSFUL; - } - n_unix_groups = groups_max(); if ((*unix_groups = malloc( sizeof(gid_t) * n_unix_groups ) ) == NULL) { DEBUG(0, ("get_user_groups_from_local_sam: Out of memory allocating unix group list\n")); return NT_STATUS_NO_MEMORY; } - if (sys_getgrouplist(pdb_get_username(sampass), gid, *unix_groups, &n_unix_groups) == -1) { + if (sys_getgrouplist(username, gid, *unix_groups, &n_unix_groups) == -1) { gid_t *groups_tmp; groups_tmp = Realloc(*unix_groups, sizeof(gid_t) * n_unix_groups); if (!groups_tmp) { @@ -685,7 +670,7 @@ static NTSTATUS get_user_groups_from_local_sam(SAM_ACCOUNT *sampass, } *unix_groups = groups_tmp; - if (sys_getgrouplist(pdb_get_username(sampass), gid, *unix_groups, &n_unix_groups) == -1) { + if (sys_getgrouplist(username, gid, *unix_groups, &n_unix_groups) == -1) { DEBUG(0, ("get_user_groups_from_local_sam: failed to get the unix group list\n")); SAFE_FREE(*unix_groups); return NT_STATUS_NO_SUCH_USER; /* what should this return value be? */ @@ -706,7 +691,7 @@ static NTSTATUS get_user_groups_from_local_sam(SAM_ACCOUNT *sampass, *n_groups = n_unix_groups; for (i = 0; i < *n_groups; i++) { - if (NT_STATUS_IS_ERR(gid_to_sid(&(*groups)[i], (*unix_groups)[i]))) { + if (!NT_STATUS_IS_OK(gid_to_sid(&(*groups)[i], (*unix_groups)[i]))) { DEBUG(1, ("get_user_groups_from_local_sam: failed to convert gid %ld to a sid!\n", (long int)(*unix_groups)[i+1])); SAFE_FREE(*groups); SAFE_FREE(*unix_groups); @@ -721,10 +706,8 @@ static NTSTATUS get_user_groups_from_local_sam(SAM_ACCOUNT *sampass, Make a user_info struct ***************************************************************************/ -static NTSTATUS make_server_info(auth_serversupplied_info **server_info, SAM_ACCOUNT *sampass) +static NTSTATUS make_server_info(auth_serversupplied_info **server_info) { - NTSTATUS ret; - *server_info = malloc(sizeof(**server_info)); if (!*server_info) { DEBUG(0,("make_server_info: malloc failed!\n")); @@ -732,24 +715,25 @@ static NTSTATUS make_server_info(auth_serversupplied_info **server_info, SAM_ACC } ZERO_STRUCTP(*server_info); - (*server_info)->sam_fill_level = SAM_FILL_ALL; - (*server_info)->sam_account = sampass; - if (NT_STATUS_IS_ERR(ret = sid_to_uid(pdb_get_user_sid(sampass), &((*server_info)->uid)))) - return ret; - if (NT_STATUS_IS_ERR(ret = sid_to_gid(pdb_get_group_sid(sampass), &((*server_info)->gid)))) - return ret; + /* Initialise the uid and gid values to something non-zero + which may save us from giving away root access if there + is a bug in allocating these fields. */ + + (*server_info)->uid = -1; + (*server_info)->gid = -1; return NT_STATUS_OK; } /*************************************************************************** - Make (and fill) a user_info struct from a SAM_ACCOUNT +Fill a server_info struct from a SAM_ACCOUNT with their groups ***************************************************************************/ -NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info, - SAM_ACCOUNT *sampass) +static NTSTATUS add_user_groups(auth_serversupplied_info **server_info, + SAM_ACCOUNT *sampass, + uid_t uid, gid_t gid) { - NTSTATUS nt_status = NT_STATUS_OK; + NTSTATUS nt_status; const DOM_SID *user_sid = pdb_get_user_sid(sampass); const DOM_SID *group_sid = pdb_get_group_sid(sampass); int n_groupSIDs = 0; @@ -759,14 +743,11 @@ NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info, BOOL is_guest; uint32 rid; - if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info, sampass))) { - return nt_status; - } - - if (!NT_STATUS_IS_OK(nt_status - = get_user_groups_from_local_sam(sampass, - &n_groupSIDs, &groupSIDs, &unix_groups))) - { + nt_status = get_user_groups_from_local_sam(pdb_get_username(sampass), + uid, gid, + &n_groupSIDs, &groupSIDs, + &unix_groups); + if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(4,("get_user_groups_from_local_sam failed\n")); free_server_info(server_info); return nt_status; @@ -789,11 +770,49 @@ NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info, (*server_info)->n_groups = n_groupSIDs; (*server_info)->groups = unix_groups; - (*server_info)->ptok = token; + + return nt_status; +} + +/*************************************************************************** + Make (and fill) a user_info struct from a SAM_ACCOUNT +***************************************************************************/ + +NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info, + SAM_ACCOUNT *sampass) +{ + NTSTATUS nt_status; + struct passwd *pwd; + + if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info))) + return nt_status; + + (*server_info)->sam_account = sampass; + + if ( !(pwd = getpwnam_alloc(pdb_get_username(sampass))) ) { + DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n", + pdb_get_username(sampass))); + free_server_info(server_info); + return NT_STATUS_NO_SUCH_USER; + } + (*server_info)->unix_name = smb_xstrdup(pwd->pw_name); + (*server_info)->gid = pwd->pw_gid; + (*server_info)->uid = pwd->pw_uid; - DEBUG(5,("make_server_info_sam: made server info for user %s\n", - pdb_get_username((*server_info)->sam_account))); + passwd_free(&pwd); + + if (!NT_STATUS_IS_OK(nt_status = add_user_groups(server_info, sampass, + (*server_info)->uid, + (*server_info)->gid))) { + free_server_info(server_info); + return nt_status; + } + + (*server_info)->sam_fill_level = SAM_FILL_ALL; + DEBUG(5,("make_server_info_sam: made server info for user %s -> %s\n", + pdb_get_username(sampass), + (*server_info)->unix_name)); return nt_status; } @@ -810,7 +829,22 @@ NTSTATUS make_server_info_pw(auth_serversupplied_info **server_info, const struc if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam_pw(&sampass, pwd))) { return nt_status; } - return make_server_info_sam(server_info, sampass); + if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info))) { + return nt_status; + } + + (*server_info)->sam_account = sampass; + + if (!NT_STATUS_IS_OK(nt_status = add_user_groups(server_info, sampass, pwd->pw_uid, pwd->pw_gid))) { + return nt_status; + } + + (*server_info)->unix_name = smb_xstrdup(pwd->pw_name); + + (*server_info)->sam_fill_level = SAM_FILL_ALL; + (*server_info)->uid = pwd->pw_uid; + (*server_info)->gid = pwd->pw_gid; + return nt_status; } /*************************************************************************** @@ -846,6 +880,43 @@ NTSTATUS make_server_info_guest(auth_serversupplied_info **server_info) return nt_status; } +/*************************************************************************** + Purely internal function for make_server_info_info3 + Fill the sam account from getpwnam +***************************************************************************/ +static NTSTATUS fill_sam_account(TALLOC_CTX *mem_ctx, + const char *domain, + const char *username, + char **found_username, + uid_t *uid, gid_t *gid, + SAM_ACCOUNT **sam_account) +{ + fstring dom_user; + struct passwd *passwd; + + fstr_sprintf(dom_user, "%s%s%s", + domain, lp_winbind_separator(), username); + + passwd = Get_Pwnam(dom_user); + + /* if the lookup for DOMAIN\username failed, try again + with just 'username'. This is need for accessing the server + as a trust user that actually maps to a local account */ + + if ( !passwd ) + passwd = Get_Pwnam(username); + + if (passwd == NULL) + return NT_STATUS_NO_SUCH_USER; + + *uid = passwd->pw_uid; + *gid = passwd->pw_gid; + + *found_username = talloc_strdup(mem_ctx, passwd->pw_name); + + return pdb_init_sam_pw(sam_account, passwd); +} + /*************************************************************************** Make a server_info struct from the info3 returned by a domain logon ***************************************************************************/ @@ -858,7 +929,7 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, NET_USER_INFO_3 *info3) { NTSTATUS nt_status = NT_STATUS_OK; - + char *found_username; const char *nt_domain; const char *nt_username; @@ -866,10 +937,8 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, DOM_SID user_sid; DOM_SID group_sid; - struct passwd *passwd; - - unid_t u_id, g_id; - int u_type, g_type; + uid_t uid; + gid_t gid; int n_lgroupSIDs; DOM_SID *lgroupSIDs = NULL; @@ -905,40 +974,20 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, /* If the server didn't give us one, just use the one we sent them */ domain = domain; } - - u_type = ID_USERID; - g_type = ID_GROUPID; - if (NT_STATUS_IS_OK(idmap_get_id_from_sid(&u_id, &u_type, &user_sid)) - && NT_STATUS_IS_OK(idmap_get_id_from_sid(&g_id, &g_type, &group_sid)) - && ((passwd = getpwuid_alloc(u_id.uid)))) { - nt_status = pdb_init_sam_pw(&sam_account, passwd); - passwd_free(&passwd); - } else { - char *dom_user; - dom_user = talloc_asprintf(mem_ctx, "%s%s%s", - nt_domain, - lp_winbind_separator(), - internal_username); - - if (!dom_user) { - DEBUG(0, ("talloc_asprintf failed!\n")); - return NT_STATUS_NO_MEMORY; - } else { - - if (!(passwd = Get_Pwnam(dom_user)) - /* Only lookup local for the local - domain, we don't want this for - trusted domains */ - && strequal(nt_domain, lp_workgroup())) { - passwd = Get_Pwnam(internal_username); - } - - if (!passwd) { - return NT_STATUS_NO_SUCH_USER; - } else { - nt_status = pdb_init_sam_pw(&sam_account, passwd); - } - } + + /* try to fill the SAM account.. If getpwnam() fails, then try the + add user script (2.2.x behavior) */ + + nt_status = fill_sam_account(mem_ctx, nt_domain, internal_username, + &found_username, &uid, &gid, &sam_account); + + if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) { + DEBUG(3,("User %s does not exist, trying to add it\n", + internal_username)); + auth_add_user_script(nt_domain, internal_username); + nt_status = fill_sam_account(mem_ctx, nt_domain, + internal_username, &found_username, + &uid, &gid, &sam_account); } if (!NT_STATUS_IS_OK(nt_status)) { @@ -946,17 +995,12 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, return nt_status; } - if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) { + if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) { pdb_free_sam(&sam_account); - return NT_STATUS_UNSUCCESSFUL; + return NT_STATUS_NO_MEMORY; } - if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) { - pdb_free_sam(&sam_account); - return NT_STATUS_UNSUCCESSFUL; - } - - if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) { + if (!pdb_set_username(sam_account, nt_username, PDB_CHANGED)) { pdb_free_sam(&sam_account); return NT_STATUS_NO_MEMORY; } @@ -966,7 +1010,18 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, return NT_STATUS_NO_MEMORY; } - if (!pdb_set_fullname(sam_account, unistr2_static(&(info3->uni_full_name)), PDB_CHANGED)) { + if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) { + pdb_free_sam(&sam_account); + return NT_STATUS_UNSUCCESSFUL; + } + + if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) { + pdb_free_sam(&sam_account); + return NT_STATUS_UNSUCCESSFUL; + } + + if (!pdb_set_fullname(sam_account, unistr2_static(&(info3->uni_full_name)), + PDB_CHANGED)) { pdb_free_sam(&sam_account); return NT_STATUS_NO_MEMORY; } @@ -991,20 +1046,31 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, return NT_STATUS_NO_MEMORY; } - if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info, sam_account))) { + if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info))) { DEBUG(4, ("make_server_info failed!\n")); pdb_free_sam(&sam_account); return nt_status; } + /* save this here to _net_sam_logon() doesn't fail (it assumes a + valid SAM_ACCOUNT) */ + + (*server_info)->sam_account = sam_account; + + (*server_info)->unix_name = smb_xstrdup(found_username); + + /* Fill in the unix info we found on the way */ + + (*server_info)->sam_fill_level = SAM_FILL_ALL; + (*server_info)->uid = uid; + (*server_info)->gid = gid; + /* Store the user group information in the server_info returned to the caller. */ - if (!NT_STATUS_IS_OK(nt_status - = get_user_groups_from_local_sam(sam_account, - &n_lgroupSIDs, - &lgroupSIDs, - &unix_groups))) + nt_status = get_user_groups_from_local_sam((*server_info)->unix_name, + uid, gid, &n_lgroupSIDs, &lgroupSIDs, &unix_groups); + if ( !NT_STATUS_IS_OK(nt_status) ) { DEBUG(4,("get_user_groups_from_local_sam failed\n")); return nt_status; @@ -1018,8 +1084,9 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, (n_lgroupSIDs + info3->num_groups2 + info3->num_other_sids)); if (!all_group_SIDs) { - DEBUG(0, ("create_nt_token_info3: malloc() failed for DOM_SID list!\n")); + DEBUG(0, ("malloc() failed for DOM_SID list!\n")); SAFE_FREE(lgroupSIDs); + free_server_info(server_info); return NT_STATUS_NO_MEMORY; } @@ -1032,9 +1099,10 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, sid_copy(&all_group_SIDs[i+n_lgroupSIDs], &(info3->dom_sid.sid)); if (!sid_append_rid(&all_group_SIDs[i+n_lgroupSIDs], info3->gids[i].g_rid)) { nt_status = NT_STATUS_INVALID_PARAMETER; - DEBUG(3,("create_nt_token_info3: could not append additional group rid 0x%x\n", + DEBUG(3,("could not append additional group rid 0x%x\n", info3->gids[i].g_rid)); SAFE_FREE(lgroupSIDs); + free_server_info(server_info); return nt_status; } } @@ -1060,6 +1128,7 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, all_group_SIDs, False, &token))) { DEBUG(4,("create_nt_user_token failed\n")); SAFE_FREE(all_group_SIDs); + free_server_info(server_info); return nt_status; } @@ -1111,6 +1180,7 @@ void free_server_info(auth_serversupplied_info **server_info) /* call pam_end here, unless we know we are keeping it */ delete_nt_token( &(*server_info)->ptok ); SAFE_FREE((*server_info)->groups); + SAFE_FREE((*server_info)->unix_name); ZERO_STRUCT(**server_info); } SAFE_FREE(*server_info); @@ -1208,4 +1278,52 @@ NTSTATUS nt_status_squash(NTSTATUS nt_status) } +/** + * Verify whether or not given domain is trusted. + * + * @param domain_name name of the domain to be verified + * @return true if domain is one of the trusted once or + * false if otherwise + **/ + +BOOL is_trusted_domain(const char* dom_name) +{ + DOM_SID trustdom_sid; + char *pass = NULL; + time_t lct; + BOOL ret; + + /* no trusted domains for a standalone server */ + + if ( lp_server_role() == ROLE_STANDALONE ) + return False; + + /* if we are a DC, then check for a direct trust relationships */ + + if (lp_server_role() == ROLE_DOMAIN_BDC || lp_server_role() == ROLE_DOMAIN_PDC) { + become_root(); + ret = secrets_fetch_trusted_domain_password(dom_name, &pass, &trustdom_sid, &lct); + unbecome_root(); + SAFE_FREE(pass); + if (ret) + return True; + } + else { + /* if winbindd is not up and we are a domain member) then we need to update the + trustdom_cache ourselves */ + + if ( !winbind_ping() ) + update_trustdom_cache(); + } + + /* now the trustdom cache should be available a DC could still + * have a transitive trust so fall back to the cache of trusted + * domains (like a domain member would use */ + + if ( trustdom_cache_fetch(dom_name, &trustdom_sid) ) { + return True; + } + + return False; +} diff --git a/source3/auth/auth_winbind.c b/source3/auth/auth_winbind.c index b8276b0866..aa8f345a5b 100644 --- a/source3/auth/auth_winbind.c +++ b/source3/auth/auth_winbind.c @@ -29,7 +29,7 @@ static NTSTATUS get_info3_from_ndr(TALLOC_CTX *mem_ctx, struct winbindd_response *response, NET_USER_INFO_3 *info3) { uint8 *info3_ndr; - size_t len = response->length - sizeof(response); + size_t len = response->length - sizeof(struct winbindd_response); prs_struct ps; if (len > 0) { info3_ndr = response->extra_data; @@ -72,15 +72,20 @@ static NTSTATUS check_winbind_security(const struct auth_context *auth_context, if (!auth_context) { DEBUG(3,("Password for user %s cannot be checked because we have no auth_info to get the challenge from.\n", user_info->internal_username.str)); - return NT_STATUS_UNSUCCESSFUL; + return NT_STATUS_INVALID_PARAMETER; } + if (strequal(user_info->domain.str, get_global_sam_name())) { + DEBUG(3,("check_winbind_security: Not using winbind, requested domain was for this SAM.\n")); + return NT_STATUS_NOT_IMPLEMENTED; + } + /* Send off request */ ZERO_STRUCT(request); ZERO_STRUCT(response); - request.data.auth_crap.flags = WINBIND_PAM_INFO3_NDR; + request.flags = WBFLAG_PAM_INFO3_NDR; push_utf8_fstring(request.data.auth_crap.user, user_info->smb_name.str); @@ -100,8 +105,11 @@ static NTSTATUS check_winbind_security(const struct auth_context *auth_context, request.data.auth_crap.lm_resp_len); memcpy(request.data.auth_crap.nt_resp, user_info->nt_resp.data, request.data.auth_crap.nt_resp_len); - + + /* we are contacting the privileged pipe */ + become_root(); result = winbindd_request(WINBINDD_PAM_AUTH_CRAP, &request, &response); + unbecome_root(); if ( result == NSS_STATUS_UNAVAIL ) { struct auth_methods *auth_method = my_private_data; @@ -129,14 +137,14 @@ static NTSTATUS check_winbind_security(const struct auth_context *auth_context, } } } else if (NT_STATUS_IS_OK(nt_status)) { - nt_status = NT_STATUS_UNSUCCESSFUL; + nt_status = NT_STATUS_NO_LOGON_SERVERS; } return nt_status; } /* module initialisation */ -NTSTATUS auth_init_winbind(struct auth_context *auth_context, const char *param, auth_methods **auth_method) +static NTSTATUS auth_init_winbind(struct auth_context *auth_context, const char *param, auth_methods **auth_method) { if (!make_auth_methods(auth_context, auth_method)) { return NT_STATUS_NO_MEMORY; diff --git a/source3/auth/pampass.c b/source3/auth/pampass.c index 045ceb7c72..d666e439b0 100644 --- a/source3/auth/pampass.c +++ b/source3/auth/pampass.c @@ -229,7 +229,7 @@ static struct chat_struct *make_pw_chat(char *p) special_char_sub(prompt); fstrcpy(t->prompt, prompt); - strlower(t->prompt); + strlower_m(t->prompt); trim_string(t->prompt, " ", " "); if (!next_token(&p, reply, NULL, sizeof(fstring))) @@ -240,7 +240,7 @@ static struct chat_struct *make_pw_chat(char *p) special_char_sub(reply); fstrcpy(t->reply, reply); - strlower(t->reply); + strlower_m(t->reply); trim_string(t->reply, " ", " "); } diff --git a/source3/auth/pass_check.c b/source3/auth/pass_check.c index 88b82e3474..1ac8c1815a 100644 --- a/source3/auth/pass_check.c +++ b/source3/auth/pass_check.c @@ -757,7 +757,7 @@ NTSTATUS pass_check(const struct passwd *pass, const char *user, const char *pas /* try all lowercase if it's currently all uppercase */ if (strhasupper(pass2)) { - strlower(pass2); + strlower_m(pass2); if NT_STATUS_IS_OK(nt_status = password_check(pass2)) { if (fn) fn(user, pass2); @@ -771,8 +771,7 @@ NTSTATUS pass_check(const struct passwd *pass, const char *user, const char *pas } /* last chance - all combinations of up to level chars upper! */ - strlower(pass2); - + strlower_m(pass2); if (NT_STATUS_IS_OK(nt_status = string_combinations(pass2, password_check, level))) { if (fn) diff --git a/source3/autogen.sh b/source3/autogen.sh index 056c0e6133..2d91173f4a 100755 --- a/source3/autogen.sh +++ b/source3/autogen.sh @@ -1,11 +1,5 @@ #!/bin/sh -echo The Samba HEAD branch is deprecated pending the release of Samba 3.0 -echo Please use the SAMBA_3_0 branch -echo to update to SAMBA_3_0 use this command: -echo " cvs -z3 update -r SAMBA_3_0 -dP" -exit 1 - # Run this script to build samba from CVS. ## insert all possible names (only works with diff --git a/source3/change-log b/source3/change-log index 71f5012484..1f7798b541 100644 --- a/source3/change-log +++ b/source3/change-log @@ -2,7 +2,7 @@ SUPERCEDED Change Log for Samba ^^^^^^^^^^ Unless otherwise attributed, all changes were made by -Andrew.Tridgell@anu.edu.au. +Andrew.Tridgell@anu.edu.au. All bugs to samba-bugs@samba.org. NOTE: THIS LOG IS IN CHRONOLOGICAL ORDER diff --git a/source3/client/client.c b/source3/client/client.c index 918b435b2d..d9c3a7aa1b 100644 --- a/source3/client/client.c +++ b/source3/client/client.c @@ -659,7 +659,7 @@ static int do_get(char *rname, char *lname, BOOL reget) GetTimeOfDay(&tp_start); if (lowercase) { - strlower(lname); + strlower_m(lname); } fnum = cli_open(cli, rname, O_RDONLY, DENY_NONE); @@ -834,7 +834,7 @@ static void do_mget(file_info *finfo) unix_format(finfo->name); if (lowercase) - strlower(finfo->name); + strlower_m(finfo->name); if (!directory_exist(finfo->name,NULL) && mkdir(finfo->name,0777) != 0) { @@ -2108,7 +2108,7 @@ static struct /* Yes, this must be here, see crh's comment above. */ {"!",NULL,"run a shell command on the local system",{COMPL_NONE,COMPL_NONE}}, - {"",NULL,NULL,{COMPL_NONE,COMPL_NONE}} + {NULL,NULL,NULL,{COMPL_NONE,COMPL_NONE}} }; @@ -2328,11 +2328,9 @@ static char **completion_fn(const char *text, int start, int end) if (sp == NULL) return NULL; - for (i = 0; commands[i].description; i++) { + for (i = 0; commands[i].name; i++) if ((strncmp(commands[i].name, text, sp - buf) == 0) && (commands[i].name[sp - buf] == 0)) break; - } - if (commands[i].name == NULL) return NULL; @@ -2565,6 +2563,9 @@ static struct cli_state *do_connect(const char *server, const char *share) if (password[0] || !username[0] || use_kerberos || !cli_session_setup(c, "", "", 0, "", 0, lp_workgroup())) { d_printf("session setup failed: %s\n", cli_errstr(c)); + if (NT_STATUS_V(cli_nt_error(c)) == + NT_STATUS_V(NT_STATUS_MORE_PROCESSING_REQUIRED)) + d_printf("did you forget to run kinit?\n"); cli_shutdown(c); return NULL; } @@ -2749,7 +2750,7 @@ static void remember_query_host(const char *arg, { "tar", 'T', POPT_ARG_STRING, NULL, 'T', "Command line tar", "IXFqgbNan" }, { "directory", 'D', POPT_ARG_STRING, NULL, 'D', "Start from directory", "DIR" }, { "command", 'c', POPT_ARG_STRING, &cmdstr, 'c', "Execute semicolon separated commands" }, - { "send-buffer", 'b', POPT_ARG_INT, NULL, 'b', "Changes the transmit/send buffer", "BYTES" }, + { "send-buffer", 'b', POPT_ARG_INT, &io_bufsize, 'b', "Changes the transmit/send buffer", "BYTES" }, { "port", 'p', POPT_ARG_INT, &port, 'p', "Port to connect to", "PORT" }, POPT_COMMON_SAMBA POPT_COMMON_CONNECTION @@ -2823,9 +2824,6 @@ static void remember_query_host(const char *arg, case 'D': fstrcpy(base_directory,poptGetOptArg(pc)); break; - case 'b': - io_bufsize = MAX(1, atoi(poptGetOptArg(pc))); - break; } } @@ -2864,6 +2862,7 @@ static void remember_query_host(const char *arg, pstrcpy(username, cmdline_auth_info.username); pstrcpy(password, cmdline_auth_info.password); + use_kerberos = cmdline_auth_info.use_kerberos; got_pass = cmdline_auth_info.got_pass; diff --git a/source3/client/clitar.c b/source3/client/clitar.c index dfda997ca2..765bc2a659 100644 --- a/source3/client/clitar.c +++ b/source3/client/clitar.c @@ -197,7 +197,7 @@ static void writetarheader(int f, const char *aname, SMB_BIG_UINT size, time_t m fixtarname(hb.dbuf.name, aname, (l >= NAMSIZ) ? NAMSIZ : l + 1); if (lowercase) - strlower(hb.dbuf.name); + strlower_m(hb.dbuf.name); /* write out a "standard" tar format header */ @@ -206,6 +206,16 @@ static void writetarheader(int f, const char *aname, SMB_BIG_UINT size, time_t m oct_it((SMB_BIG_UINT)0, 8, hb.dbuf.uid); oct_it((SMB_BIG_UINT)0, 8, hb.dbuf.gid); oct_it((SMB_BIG_UINT) size, 13, hb.dbuf.size); + if (size > (SMB_BIG_UINT)077777777777LL) { + + /* This is a non-POSIX compatible extention to store files + greater than 8GB. */ + + memset(hb.dbuf.size, 0, 4); + hb.dbuf.size[0]=128; + for (i = 8, jp=(char*)&size; i; i--) + hb.dbuf.size[i+3] = *(jp++); + } oct_it((SMB_BIG_UINT) mtime, 13, hb.dbuf.mtime); memcpy(hb.dbuf.chksum, " ", sizeof(hb.dbuf.chksum)); memset(hb.dbuf.linkname, 0, NAMSIZ); diff --git a/source3/client/mount.cifs.c b/source3/client/mount.cifs.c index 8ba1eff02e..9592dbdf96 100755 --- a/source3/client/mount.cifs.c +++ b/source3/client/mount.cifs.c @@ -222,6 +222,7 @@ char * parse_server(char * unc_name) printf(" %s does not begin with \\\\ or //\n",unc_name); return 0; } else { + unc_name[0] = '\\'; unc_name[0] = '/'; unc_name[1] = '/'; unc_name += 2; @@ -376,7 +377,7 @@ int main(int argc, char ** argv) test_opts = xstrdup(optarg); break;*/ case 'r': /* mount readonly */ - flags |= MS_RDONLY;; + flags |= MS_RDONLY; break; case 'U': uuid = optarg; @@ -388,7 +389,7 @@ int main(int argc, char ** argv) printf ("mount: %s\n", version); exit (0);*/ case 'w': - flags &= ~MS_RDONLY;; + flags &= ~MS_RDONLY; break; /* case 0: break; diff --git a/source3/client/smbmount.c b/source3/client/smbmount.c index 1ee7dbc8cb..343d4f2675 100644 --- a/source3/client/smbmount.c +++ b/source3/client/smbmount.c @@ -891,7 +891,7 @@ static void parse_mount_smb(int argc, char **argv) got_pass = True; memset(strchr_m(getenv("USER"),'%')+1,'X',strlen(password)); } - strupper(username); + strupper_m(username); } if (getenv("PASSWD")) { @@ -933,7 +933,7 @@ static void parse_mount_smb(int argc, char **argv) if (!*my_netbios_name) { pstrcpy(my_netbios_name, myhostname()); } - strupper(my_netbios_name); + strupper_m(my_netbios_name); init_mount(); return 0; diff --git a/source3/client/tree.c b/source3/client/tree.c index 94fd93c210..3b90d15f65 100644 --- a/source3/client/tree.c +++ b/source3/client/tree.c @@ -36,7 +36,7 @@ struct tree_data { }; -void error_message(gchar *message) { +static void tree_error_message(gchar *message) { GtkWidget *dialog, *label, *okay_button; @@ -344,7 +344,7 @@ static void cb_itemsignal( GtkWidget *item, slprintf(errmsg, sizeof(errmsg), "cb_itemsignal: Could not open dir %s, %s\n", get_path(item), strerror(errno)); - error_message(errmsg); + tree_error_message(errmsg); /* gtk_main_quit();*/ @@ -363,7 +363,7 @@ static void cb_itemsignal( GtkWidget *item, slprintf(errmsg, sizeof(errmsg), "cb_itemsignal: Could not read dir smbc://, %s\n", strerror(errno)); - error_message(errmsg); + tree_error_message(errmsg); /* gtk_main_quit();*/ diff --git a/source3/config.sub b/source3/config.sub index 04baf3d80d..2476310dff 100755 --- a/source3/config.sub +++ b/source3/config.sub @@ -1,9 +1,9 @@ #! /bin/sh # Configuration validation subroutine script. -# Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, -# 2000, 2001, 2002, 2003 Free Software Foundation, Inc. +# Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001 +# Free Software Foundation, Inc. -timestamp='2003-01-03' +timestamp='2001-12-03' # This file is (in principle) common to ALL GNU software. # The presence of a machine in this file suggests that SOME GNU software @@ -118,7 +118,7 @@ esac # Here we must recognize all the valid KERNEL-OS combinations. maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'` case $maybe_os in - nto-qnx* | linux-gnu* | freebsd*-gnu* | netbsd*-gnu* | storm-chaos* | os2-emx* | rtmk-nova*) + nto-qnx* | linux-gnu* | storm-chaos* | os2-emx* | windows32-*) os=-$maybe_os basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'` ;; @@ -227,39 +227,26 @@ case $basic_machine in 1750a | 580 \ | a29k \ | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \ - | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \ | arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr \ - | clipper \ - | d10v | d30v | dlx | dsp16xx \ - | fr30 | frv \ + | c4x | clipper \ + | d10v | d30v | dsp16xx \ + | fr30 \ | h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \ | i370 | i860 | i960 | ia64 \ - | ip2k \ | m32r | m68000 | m68k | m88k | mcore \ - | mips | mipsbe | mipseb | mipsel | mipsle \ - | mips16 \ - | mips64 | mips64el \ - | mips64vr | mips64vrel \ - | mips64orion | mips64orionel \ - | mips64vr4100 | mips64vr4100el \ - | mips64vr4300 | mips64vr4300el \ - | mips64vr5000 | mips64vr5000el \ - | mipsisa32 | mipsisa32el \ - | mipsisa32r2 | mipsisa32r2el \ - | mipsisa64 | mipsisa64el \ - | mipsisa64sb1 | mipsisa64sb1el \ - | mipsisa64sr71k | mipsisa64sr71kel \ - | mipstx39 | mipstx39el \ + | mips16 | mips64 | mips64el | mips64orion | mips64orionel \ + | mips64vr4100 | mips64vr4100el | mips64vr4300 \ + | mips64vr4300el | mips64vr5000 | mips64vr5000el \ + | mipsbe | mipseb | mipsel | mipsle | mipstx39 | mipstx39el \ + | mipsisa32 \ | mn10200 | mn10300 \ - | msp430 \ | ns16k | ns32k \ - | openrisc | or32 \ + | openrisc \ | pdp10 | pdp11 | pj | pjl \ | powerpc | powerpc64 | powerpc64le | powerpcle | ppcbe \ | pyramid \ - | sh | sh[1234] | sh3e | sh[34]eb | shbe | shle | sh[1234]le | sh3ele \ - | sh64 | sh64le \ - | sparc | sparc64 | sparc86x | sparclet | sparclite | sparcv9 | sparcv9b \ + | sh | sh[34] | sh[34]eb | shbe | shle \ + | sparc | sparc64 | sparclet | sparclite | sparcv9 | sparcv9b \ | strongarm \ | tahoe | thumb | tic80 | tron \ | v850 | v850e \ @@ -291,52 +278,38 @@ case $basic_machine in 580-* \ | a29k-* \ | alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \ - | alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \ - | alphapca5[67]-* | alpha64pca5[67]-* | arc-* \ - | arm-* | armbe-* | armle-* | armeb-* | armv*-* \ + | alphapca5[67]-* | arc-* \ + | arm-* | armbe-* | armle-* | armv*-* \ | avr-* \ | bs2000-* \ - | c[123]* | c30-* | [cjt]90-* | c4x-* | c54x-* \ - | clipper-* | cydra-* \ - | d10v-* | d30v-* | dlx-* \ + | c[123]* | c30-* | [cjt]90-* | c54x-* \ + | clipper-* | cray2-* | cydra-* \ + | d10v-* | d30v-* \ | elxsi-* \ - | f30[01]-* | f700-* | fr30-* | frv-* | fx80-* \ + | f30[01]-* | f700-* | fr30-* | fx80-* \ | h8300-* | h8500-* \ | hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \ | i*86-* | i860-* | i960-* | ia64-* \ - | ip2k-* \ | m32r-* \ - | m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \ + | m68000-* | m680[01234]0-* | m68360-* | m683?2-* | m68k-* \ | m88110-* | m88k-* | mcore-* \ - | mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \ - | mips16-* \ - | mips64-* | mips64el-* \ - | mips64vr-* | mips64vrel-* \ - | mips64orion-* | mips64orionel-* \ - | mips64vr4100-* | mips64vr4100el-* \ - | mips64vr4300-* | mips64vr4300el-* \ - | mips64vr5000-* | mips64vr5000el-* \ - | mipsisa32-* | mipsisa32el-* \ - | mipsisa32r2-* | mipsisa32r2el-* \ - | mipsisa64-* | mipsisa64el-* \ - | mipsisa64sb1-* | mipsisa64sb1el-* \ - | mipsisa64sr71k-* | mipsisa64sr71kel-* \ - | mipstx39-* | mipstx39el-* \ - | msp430-* \ - | none-* | np1-* | nv1-* | ns16k-* | ns32k-* \ + | mips-* | mips16-* | mips64-* | mips64el-* | mips64orion-* \ + | mips64orionel-* | mips64vr4100-* | mips64vr4100el-* \ + | mips64vr4300-* | mips64vr4300el-* | mipsbe-* | mipseb-* \ + | mipsle-* | mipsel-* | mipstx39-* | mipstx39el-* \ + | none-* | np1-* | ns16k-* | ns32k-* \ | orion-* \ | pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \ | powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \ | pyramid-* \ | romp-* | rs6000-* \ - | sh-* | sh[1234]-* | sh3e-* | sh[34]eb-* | shbe-* \ - | shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \ - | sparc-* | sparc64-* | sparc86x-* | sparclet-* | sparclite-* \ - | sparcv9-* | sparcv9b-* | strongarm-* | sv1-* | sx?-* \ - | tahoe-* | thumb-* | tic30-* | tic4x-* | tic54x-* | tic80-* | tron-* \ + | sh-* | sh[34]-* | sh[34]eb-* | shbe-* | shle-* \ + | sparc-* | sparc64-* | sparc86x-* | sparclite-* \ + | sparcv9-* | sparcv9b-* | strongarm-* | sv1-* \ + | t3e-* | tahoe-* | thumb-* | tic30-* | tic54x-* | tic80-* | tron-* \ | v850-* | v850e-* | vax-* \ | we32k-* \ - | x86-* | x86_64-* | xps100-* | xscale-* | xstormy16-* \ + | x86-* | x86_64-* | xmp-* | xps100-* | xscale-* | xstormy16-* \ | xtensa-* \ | ymp-* \ | z8k-*) @@ -402,10 +375,6 @@ case $basic_machine in basic_machine=ns32k-sequent os=-dynix ;; - c90) - basic_machine=c90-cray - os=-unicos - ;; convex-c1) basic_machine=c1-convex os=-bsd @@ -426,8 +395,16 @@ case $basic_machine in basic_machine=c38-convex os=-bsd ;; - cray | j90) - basic_machine=j90-cray + cray | ymp) + basic_machine=ymp-cray + os=-unicos + ;; + cray2) + basic_machine=cray2-cray + os=-unicos + ;; + [cjt]90) + basic_machine=${basic_machine}-cray os=-unicos ;; crds | unos) @@ -442,14 +419,6 @@ case $basic_machine in decstation | decstation-3100 | pmax | pmax-* | pmin | dec3100 | decstatn) basic_machine=mips-dec ;; - decsystem10* | dec10*) - basic_machine=pdp10-dec - os=-tops10 - ;; - decsystem20* | dec20*) - basic_machine=pdp10-dec - os=-tops20 - ;; delta | 3300 | motorola-3300 | motorola-delta \ | 3300-motorola | delta-motorola) basic_machine=m68k-motorola @@ -630,6 +599,14 @@ case $basic_machine in basic_machine=m68k-atari os=-mint ;; + mipsel*-linux*) + basic_machine=mipsel-unknown + os=-linux-gnu + ;; + mips*-linux*) + basic_machine=mips-unknown + os=-linux-gnu + ;; mips3*-*) basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'` ;; @@ -644,10 +621,6 @@ case $basic_machine in basic_machine=m68k-rom68k os=-coff ;; - morphos) - basic_machine=powerpc-unknown - os=-morphos - ;; msdos) basic_machine=i386-pc os=-msdos @@ -720,10 +693,6 @@ case $basic_machine in np1) basic_machine=np1-gould ;; - nv1) - basic_machine=nv1-cray - os=-unicosmp - ;; nsr-tandem) basic_machine=nsr-tandem ;; @@ -731,10 +700,6 @@ case $basic_machine in basic_machine=hppa1.1-oki os=-proelf ;; - or32 | or32-*) - basic_machine=or32-unknown - os=-coff - ;; OSE68000 | ose68000) basic_machine=m68000-ericsson os=-ose @@ -757,13 +722,13 @@ case $basic_machine in pbb) basic_machine=m68k-tti ;; - pc532 | pc532-*) + pc532 | pc532-*) basic_machine=ns32k-pc532 ;; pentium | p5 | k5 | k6 | nexgen | viac3) basic_machine=i586-pc ;; - pentiumpro | p6 | 6x86 | athlon | athlon_*) + pentiumpro | p6 | 6x86 | athlon) basic_machine=i686-pc ;; pentiumii | pentium2) @@ -784,22 +749,22 @@ case $basic_machine in power) basic_machine=power-ibm ;; ppc) basic_machine=powerpc-unknown - ;; + ;; ppc-*) basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ppcle | powerpclittle | ppc-le | powerpc-little) basic_machine=powerpcle-unknown - ;; + ;; ppcle-* | powerpclittle-*) basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ppc64) basic_machine=powerpc64-unknown - ;; + ;; ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ppc64le | powerpc64little | ppc64-le | powerpc64-little) basic_machine=powerpc64le-unknown - ;; + ;; ppc64le-* | powerpc64little-*) basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'` ;; @@ -830,12 +795,6 @@ case $basic_machine in basic_machine=a29k-amd os=-udi ;; - sb1) - basic_machine=mipsisa64sb1-unknown - ;; - sb1el) - basic_machine=mipsisa64sb1el-unknown - ;; sequent) basic_machine=i386-sequent ;; @@ -910,17 +869,9 @@ case $basic_machine in os=-dynix ;; t3e) - basic_machine=alphaev5-cray + basic_machine=t3e-cray os=-unicos ;; - t90) - basic_machine=t90-cray - os=-unicos - ;; - tic4x | c4x*) - basic_machine=tic4x-unknown - os=-coff - ;; tic54x | c54x*) basic_machine=tic54x-unknown os=-coff @@ -931,10 +882,6 @@ case $basic_machine in tx39el) basic_machine=mipstx39el-unknown ;; - toad1) - basic_machine=pdp10-xkl - os=-tops20 - ;; tower | tower-32) basic_machine=m68k-ncr ;; @@ -959,8 +906,8 @@ case $basic_machine in os=-vms ;; vpp*|vx|vx-*) - basic_machine=f301-fujitsu - ;; + basic_machine=f301-fujitsu + ;; vxworks960) basic_machine=i960-wrs os=-vxworks @@ -981,13 +928,17 @@ case $basic_machine in basic_machine=hppa1.1-winbond os=-proelf ;; - xps | xps100) - basic_machine=xps100-honeywell + windows32) + basic_machine=i386-pc + os=-windows32-msvcrt ;; - ymp) - basic_machine=ymp-cray + xmp) + basic_machine=xmp-cray os=-unicos ;; + xps | xps100) + basic_machine=xps100-honeywell + ;; z8k-*-coff) basic_machine=z8k-unknown os=-sim @@ -1008,6 +959,13 @@ case $basic_machine in op60c) basic_machine=hppa1.1-oki ;; + mips) + if [ x$os = x-linux-gnu ]; then + basic_machine=mips-unknown + else + basic_machine=mips-mips + fi + ;; romp) basic_machine=romp-ibm ;; @@ -1027,16 +985,13 @@ case $basic_machine in we32k) basic_machine=we32k-att ;; - sh3 | sh4 | sh3eb | sh4eb | sh[1234]le | sh3ele) + sh3 | sh4 | sh3eb | sh4eb) basic_machine=sh-unknown ;; - sh64) - basic_machine=sh64-unknown - ;; sparc | sparcv9 | sparcv9b) basic_machine=sparc-sun ;; - cydra) + cydra) basic_machine=cydra-cydrome ;; orion) @@ -1051,6 +1006,10 @@ case $basic_machine in pmac | pmac-mpw) basic_machine=powerpc-apple ;; + c4x*) + basic_machine=c4x-none + os=-coff + ;; *-unknown) # Make sure to match an already-canonicalized machine name. ;; @@ -1113,12 +1072,10 @@ case $os in | -chorusos* | -chorusrdb* \ | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \ | -mingw32* | -linux-gnu* | -uxpv* | -beos* | -mpeix* | -udk* \ - | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \ + | -interix* | -uwin* | -rhapsody* | -darwin* | -opened* \ | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \ | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \ - | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \ - | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \ - | -powermax* | -dnix* | -microbsd*) + | -os2* | -vos* | -palmos* | -uclinux* | -nucleus*) # Remember, each alternative MUST END IN *, to match a version number. ;; -qnx*) @@ -1130,10 +1087,8 @@ case $os in ;; esac ;; - -nto-qnx*) - ;; -nto*) - os=`echo $os | sed -e 's|nto|nto-qnx|'` + os=-nto-qnx ;; -sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \ | -windows* | -osx | -abug | -netware* | -os9* | -beos* \ @@ -1181,11 +1136,8 @@ case $os in -ctix* | -uts*) os=-sysv ;; - -nova*) - os=-rtmk-nova - ;; -ns2 ) - os=-nextstep2 + os=-nextstep2 ;; -nsk*) os=-nsk @@ -1224,8 +1176,8 @@ case $os in -xenix) os=-xenix ;; - -*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*) - os=-mint + -*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*) + os=-mint ;; -none) ;; @@ -1258,11 +1210,10 @@ case $basic_machine in arm*-semi) os=-aout ;; - # This must come before the *-dec entry. pdp10-*) os=-tops20 ;; - pdp11-*) + pdp11-*) os=-none ;; *-dec | vax-*) @@ -1289,9 +1240,6 @@ case $basic_machine in mips*-*) os=-elf ;; - or32-*) - os=-coff - ;; *-tti) # must be before sparc entry or we get the wrong os. os=-sysv3 ;; @@ -1355,19 +1303,19 @@ case $basic_machine in *-next) os=-nextstep3 ;; - *-gould) + *-gould) os=-sysv ;; - *-highlevel) + *-highlevel) os=-bsd ;; *-encore) os=-bsd ;; - *-sgi) + *-sgi) os=-irix ;; - *-siemens) + *-siemens) os=-sysv4 ;; *-masscomp) @@ -1439,7 +1387,7 @@ case $basic_machine in -ptx*) vendor=sequent ;; - -vxsim* | -vxworks* | -windiss*) + -vxsim* | -vxworks*) vendor=wrs ;; -aux*) diff --git a/source3/configure.in b/source3/configure.in index 533757aab8..fd7ee9fc30 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -154,6 +154,7 @@ AC_SUBST(AUTHLIBS) AC_SUBST(ACLLIBS) AC_SUBST(ADSLIBS) AC_SUBST(PASSDBLIBS) +AC_SUBST(IDMAP_LIBS) AC_SUBST(KRB5_LIBS) AC_SUBST(LDAP_LIBS) AC_SUBST(LDAP_OBJ) @@ -171,12 +172,14 @@ AC_ARG_ENABLE(debug, AC_ARG_ENABLE(developer, [ --enable-developer Turn on developer warnings and debugging (default=no)], [if eval "test x$enable_developer = xyes"; then - CFLAGS="${CFLAGS} -g -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -DDEBUG_PASSWORD -DDEVELOPER" + developer=yes + CFLAGS="${CFLAGS} -gstabs -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -DDEBUG_PASSWORD -DDEVELOPER" fi]) AC_ARG_ENABLE(krb5developer, [ --enable-krb5developer Turn on developer warnings and debugging, except -Wstrict-prototypes (default=no)], [if eval "test x$enable_krb5developer = xyes"; then - CFLAGS="${CFLAGS} -g -Wall -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -DDEBUG_PASSWORD -DDEVELOPER" + developer=yes + CFLAGS="${CFLAGS} -gstabs -Wall -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -DDEBUG_PASSWORD -DDEVELOPER" fi]) AC_ARG_ENABLE(dmalloc, [ --enable-dmalloc Enable heap debugging [default=no]]) @@ -221,6 +224,30 @@ else fi AC_SUBST(BROKEN_CC) +dnl Check if the C compiler understands -Werror +AC_CACHE_CHECK([that the C compiler understands -Werror],samba_cv_HAVE_Werror, [ + AC_TRY_RUN_STRICT([ + int main(void) + { + return 0; + }],[-Werror],[$CPPFLAGS],[$LDFLAGS], + samba_cv_HAVE_Werror=yes,samba_cv_HAVE_Werror=no,samba_cv_HAVE_Werror=cross)]) +if test x"$samba_cv_HAVE_Werror" = x"yes"; then + Werror_FLAGS="-Werror" +else +dnl Check if the C compiler understands -w2 +AC_CACHE_CHECK([that the C compiler understands -w2],samba_cv_HAVE_w2, [ + AC_TRY_RUN_STRICT([ + int main(void) + { + return 0; + }],[-w2],[$CPPFLAGS],[$LDFLAGS], + samba_cv_HAVE_w2=yes,samba_cv_HAVE_w2=no,samba_cv_HAVE_w2=cross)]) +if test x"$samba_cv_HAVE_w2" = x"yes"; then + Werror_FLAGS="-w2" +fi +fi + dnl Check if the C compiler understands volatile (it should, being ANSI). AC_CACHE_CHECK([that the C compiler understands volatile],samba_cv_volatile, [ AC_TRY_COMPILE([#include ],[volatile int i = 0], @@ -229,6 +256,21 @@ if test x"$samba_cv_volatile" = x"yes"; then AC_DEFINE(HAVE_VOLATILE, 1, [Whether the C compiler understands volatile]) fi +UNAME_S=`uname -s` +AC_MSG_CHECKING(uname -s) +AC_MSG_RESULT(${UNAME_S}) + +UNAME_R=`uname -r` +AC_MSG_CHECKING(uname -r) +AC_MSG_RESULT(${UNAME_R}) + +UNAME_M=`uname -m` +AC_MSG_CHECKING(uname -m) +AC_MSG_RESULT(${UNAME_M}) + +UNAME_P=`uname -p` +AC_MSG_CHECKING(uname -p) +AC_MSG_RESULT(${UNAME_P}) AC_CANONICAL_SYSTEM @@ -244,12 +286,12 @@ DYNEXP= dnl Add modules that have to be built by default here dnl These have to be built static: -default_static_modules="pdb_smbpasswd pdb_tdbsam rpc_lsa rpc_samr rpc_reg rpc_wks rpc_net rpc_dfs rpc_srv rpc_spoolss auth_rhosts auth_sam auth_unix auth_winbind auth_server auth_domain auth_builtin idmap_winbind" +default_static_modules="pdb_smbpasswd pdb_tdbsam rpc_lsa rpc_samr rpc_reg rpc_wks rpc_net rpc_dfs rpc_srv rpc_spoolss auth_rhosts auth_sam auth_unix auth_winbind auth_server auth_domain auth_builtin" dnl These are preferably build shared, and static if dlopen() is not available -default_shared_modules="vfs_recycle vfs_audit vfs_extd_audit vfs_fake_perms vfs_netatalk" +default_shared_modules="vfs_recycle vfs_audit vfs_extd_audit vfs_netatalk vfs_fake_perms" -if test "x$enable_developer" = xyes; then +if test "x$developer" = xyes; then default_static_modules="$default_static_modules rpc_echo" default_shared_modules="$default_shared_modules charset_weird" fi @@ -487,6 +529,7 @@ AC_CHECK_HEADERS(sys/mount.h sys/vfs.h sys/fs/s5param.h sys/filsys.h termios.h t AC_CHECK_HEADERS(sys/termio.h sys/statfs.h sys/dustat.h sys/statvfs.h stdarg.h sys/sockio.h) AC_CHECK_HEADERS(security/pam_modules.h security/_pam_macros.h dlfcn.h) AC_CHECK_HEADERS(sys/syslog.h syslog.h execinfo.h) +AC_CHECK_HEADERS(langinfo.h locale.h) # In valgrind 1.0.x, it's just valgrind.h. In 1.9.x+ there's a # subdirectory of headers. @@ -509,18 +552,11 @@ AC_CHECK_HEADERS(shadow.h netinet/ip.h netinet/tcp.h netinet/in_systm.h netinet/ AC_CHECK_HEADERS(nss.h nss_common.h ns_api.h sys/security.h security/pam_appl.h security/pam_modules.h) AC_CHECK_HEADERS(stropts.h poll.h) AC_CHECK_HEADERS(sys/capability.h syscall.h sys/syscall.h) -AC_CHECK_HEADERS(sys/acl.h sys/cdefs.h glob.h) +AC_CHECK_HEADERS(sys/acl.h attr/xattr.h sys/cdefs.h glob.h) # For experimental utmp support (lastlog on some BSD-like systems) AC_CHECK_HEADERS(utmp.h utmpx.h lastlog.h) -# For quotas on Veritas VxFS filesystems -AC_CHECK_HEADERS(sys/fs/vx_quota.h) - -# For quotas on Linux XFS filesystems -AC_CHECK_HEADERS(linux/xqm.h) -AC_CHECK_HEADERS(xfs/xqm.h) - AC_CHECK_SIZEOF(int,cross) AC_CHECK_SIZEOF(long,cross) AC_CHECK_SIZEOF(short,cross) @@ -808,6 +844,7 @@ AC_CHECK_FUNCS(lstat64 fopen64 atexit grantpt dup2 lseek64 ftruncate64 readdir64 AC_CHECK_FUNCS(fseek64 fseeko64 ftell64 ftello64 setluid getpwanam setlinebuf) AC_CHECK_FUNCS(srandom random srand rand setenv usleep strcasecmp fcvt fcvtl symlink readlink) AC_CHECK_FUNCS(syslog vsyslog getgrouplist timegm) +AC_CHECK_FUNCS(setlocale nl_langinfo) # setbuffer, shmget, shm_open are needed for smbtorture AC_CHECK_FUNCS(setbuffer shmget shm_open backtrace_symbols) @@ -903,6 +940,13 @@ AC_LIBTESTFUNC(sec, bigcrypt) AC_LIBTESTFUNC(security, getprpwnam) AC_LIBTESTFUNC(sec, getprpwnam) +############################################ +# Check if we have libattr +AC_SEARCH_LIBS(getxattr, [attr]) +AC_CHECK_FUNCS(getxattr lgetxattr fgetxattr listxattr llistxattr) +AC_CHECK_FUNCS(flistxattr removexattr lremovexattr fremovexattr) +AC_CHECK_FUNCS(setxattr lsetxattr fsetxattr) + # Assume non-shared by default and override below BLDSHARED="false" @@ -982,7 +1026,6 @@ if test "$enable_shared" = "yes"; then *irix6*) AC_DEFINE(IRIX6,1,[Whether the host os is irix6]) ;; esac - ATTEMPT_WRAP32_BUILD=yes BLDSHARED="true" LDSHFLAGS="-set_version sgi1.0 -shared" SONAMEFLAG="-soname " @@ -1325,6 +1368,9 @@ if test x"$samba_cv_HAVE_UTIMBUF" = x"yes"; then AC_DEFINE(HAVE_UTIMBUF,1,[Whether struct utimbuf is available]) fi +############## +# Check utmp details, but only if our OS offers utmp.h +if test x"$ac_cv_header_utmp_h" = x"yes"; then dnl utmp and utmpx come in many flavours dnl We need to check for many of them dnl But we don't need to do each and every one, because our code uses @@ -1442,6 +1488,9 @@ if test x"$samba_cv_HAVE_UX_UT_SYSLEN" = x"yes"; then AC_DEFINE(HAVE_UX_UT_SYSLEN,1,[Whether the utmpx struct has a property ut_syslen]) fi +fi +# end utmp details + ICONV_LOCATION=standard LOOK_DIRS="/usr /usr/local /sw" @@ -1470,7 +1519,7 @@ dnl Try to find iconv(3) jm_ICONV($i) CPPFLAGS=$save_CPPFLAGS - if test -n "$ICONV_FOUND" ; then + if test "$ICONV_FOUND" = yes; then LDFLAGS=$save_LDFLAGS LIB_ADD_DIR(LDFLAGS, "$i/lib") CFLAGS_ADD_DIR(CPPFLAGS, "$i/include") @@ -1487,9 +1536,11 @@ done ############ # check for iconv in libc +ic_save_LIBS="$LIBS" +LIBS="$LIBS -L$ICONV_LOCATION/lib" AC_CACHE_CHECK([for working iconv],samba_cv_HAVE_NATIVE_ICONV,[ AC_TRY_RUN([ -#include +#include <$jm_cv_include> main() { iconv_t cd = iconv_open("ASCII", "UCS-2LE"); if (cd == 0 || cd == (iconv_t)-1) return -1; @@ -1500,6 +1551,7 @@ samba_cv_HAVE_NATIVE_ICONV=yes,samba_cv_HAVE_NATIVE_ICONV=no,samba_cv_HAVE_NATIV if test x"$samba_cv_HAVE_NATIVE_ICONV" = x"yes"; then AC_DEFINE(HAVE_NATIVE_ICONV,1,[Whether to use native iconv]) fi +LIBS="$ic_save_LIBS" if test x"$ICONV_FOUND" = x"no" -o x"$samba_cv_HAVE_NATIVE_ICONV" != x"yes" ; then AC_MSG_WARN([Sufficient support for iconv function was not found. @@ -1987,27 +2039,19 @@ AC_ARG_WITH(smbwrapper, WRAPPROG="bin/smbsh\$(EXEEXT)" WRAP="bin/smbwrapper.$SHLIBEXT" - if test x$ATTEMPT_WRAP32_BUILD = x; then - WRAP32="" - else - WRAP32=bin/smbwrapper.32.$SHLIBEXT - fi - # Conditions under which smbwrapper should not be built. if test x$PICFLAG = x; then echo No support for PIC code - disabling smbwrapper and smbsh WRAPPROG="" WRAP="" - WRAP32="" elif test x$ac_cv_func_syscall = xno; then AC_MSG_RESULT([No syscall() -- disabling smbwrapper and smbsh]) WRAPPROG="" WRAP="" - WRAP32="" fi - EXTRA_ALL_TARGETS="$EXTRA_ALL_TARGETS $WRAPPROG $WRAP $WRAP32" - SMBWRAPPER="$WRAPPROG $WRAP $WRAP32" + EXTRA_ALL_TARGETS="$EXTRA_ALL_TARGETS $WRAPPROG $WRAP" + SMBWRAPPER="$WRAPPROG $WRAP" ;; *) AC_MSG_RESULT(no) @@ -2054,31 +2098,29 @@ AC_ARG_WITH(dfs, ################################################# # active directory support -with_ads_support=yes +with_ads_support=auto AC_MSG_CHECKING([whether to use Active Directory]) AC_ARG_WITH(ads, [ --with-ads Active Directory support (default yes)], [ case "$withval" in - no) - with_ads_support=no + yes|no) + with_ads_support="$withval" ;; esac ]) -if test x"$with_ads_support" = x"yes"; then - AC_DEFINE(WITH_ADS,1,[Whether to include Active Directory support]) -fi - AC_MSG_RESULT($with_ads_support) FOUND_KRB5=no KRB5_LIBS="" -if test x"$with_ads_support" = x"yes"; then -ac_save_CFLAGS="$CFLAGS" -ac_save_LIBS="$LIBS" -CFLAGS="" -LIBS="" +if test x"$with_ads_support" != x"no"; then + + # Do no harm to the values of CFLAGS and LIBS while testing for + # Kerberos support. + + ac_save_CFLAGS="$CFLAGS" + ac_save_LIBS="$LIBS" ################################################# # check for krb5-config from recent MIT and Heimdal kerberos 5 @@ -2095,157 +2137,239 @@ LIBS="" fi if test x$FOUND_KRB5 = x"no"; then - ################################################# - # check for location of Kerberos 5 install - AC_MSG_CHECKING(for kerberos 5 install path) - AC_ARG_WITH(krb5, - [ --with-krb5=base-dir Locate Kerberos 5 support (default=/usr)], - [ case "$withval" in - no) + ################################################# + # check for location of Kerberos 5 install + AC_MSG_CHECKING(for kerberos 5 install path) + AC_ARG_WITH(krb5, + [ --with-krb5=base-dir Locate Kerberos 5 support (default=/usr)], + [ case "$withval" in + no) + AC_MSG_RESULT(no) + ;; + *) + AC_MSG_RESULT(yes) + LIBS="$LIBS -lkrb5" + CFLAGS="$CFLAGS -I$withval/include" + CPPFLAGS="$CPPFLAGS -I$withval/include" + LDFLAGS="$LDFLAGS -L$withval/lib" + FOUND_KRB5=yes + ;; + esac ], AC_MSG_RESULT(no) - ;; - *) - AC_MSG_RESULT(yes) - LIBS="$LIBS -lkrb5" - CFLAGS="$CFLAGS -I$withval/include" - CPPFLAGS="$CPPFLAGS -I$withval/include" - LDFLAGS="$LDFLAGS -L$withval/lib" - FOUND_KRB5=yes - ;; - esac ], - AC_MSG_RESULT(no) - ) + ) fi -if test x$FOUND_KRB5 = x"no"; then -################################################# -# see if this box has the SuSE location for the heimdal kerberos implementation -AC_MSG_CHECKING(for /usr/include/heimdal) -if test -d /usr/include/heimdal; then - if test -f /usr/lib/heimdal/lib/libkrb5.a; then - LIBS="$LIBS -lkrb5" - CFLAGS="$CFLAGS -I/usr/include/heimdal" - CPPFLAGS="$CPPFLAGS -I/usr/include/heimdal" - LDFLAGS="$LDFLAGS -L/usr/lib/heimdal/lib" - AC_MSG_RESULT(yes) + if test x$FOUND_KRB5 = x"no"; then + ################################################# + # see if this box has the SuSE location for the heimdal krb implementation + AC_MSG_CHECKING(for /usr/include/heimdal) + if test -d /usr/include/heimdal; then + if test -f /usr/lib/heimdal/lib/libkrb5.a; then + LIBS="$LIBS -lkrb5" + CFLAGS="$CFLAGS -I/usr/include/heimdal" + CPPFLAGS="$CPPFLAGS -I/usr/include/heimdal" + LDFLAGS="$LDFLAGS -L/usr/lib/heimdal/lib" + AC_MSG_RESULT(yes) + else + LIBS="$LIBS -lkrb5" + CFLAGS="$CFLAGS -I/usr/include/heimdal" + CPPFLAGS="$CPPFLAGS -I/usr/include/heimdal" + AC_MSG_RESULT(yes) + fi else - LIBS="$LIBS -lkrb5" - CFLAGS="$CFLAGS -I/usr/include/heimdal" - CPPFLAGS="$CPPFLAGS -I/usr/include/heimdal" - AC_MSG_RESULT(yes) - + AC_MSG_RESULT(no) fi -else - AC_MSG_RESULT(no) -fi -fi - + fi -if test x$FOUND_KRB5 = x"no"; then -################################################# -# see if this box has the RedHat location for kerberos -AC_MSG_CHECKING(for /usr/kerberos) -if test -d /usr/kerberos -a -f /usr/kerberos/lib/libkrb5.a; then - LIBS="$LIBS -lkrb5" - LDFLAGS="$LDFLAGS -L/usr/kerberos/lib" - CFLAGS="$CFLAGS -I/usr/kerberos/include" - CPPFLAGS="$CPPFLAGS -I/usr/kerberos/include" - AC_MSG_RESULT(yes) -else - AC_MSG_RESULT(no) -fi -fi + if test x$FOUND_KRB5 = x"no"; then + ################################################# + # see if this box has the RedHat location for kerberos + AC_MSG_CHECKING(for /usr/kerberos) + if test -d /usr/kerberos -a -f /usr/kerberos/lib/libkrb5.a; then + LIBS="$LIBS -lkrb5" + LDFLAGS="$LDFLAGS -L/usr/kerberos/lib" + CFLAGS="$CFLAGS -I/usr/kerberos/include" + CPPFLAGS="$CPPFLAGS -I/usr/kerberos/include" + AC_MSG_RESULT(yes) + else + AC_MSG_RESULT(no) + fi + fi # now check for krb5.h. Some systems have the libraries without the headers! # note that this check is done here to allow for different kerberos # include paths AC_CHECK_HEADERS(krb5.h) + if test x"$ac_cv_header_krb5_h" = x"no"; then + + # Give a warning if AD support was not explicitly requested, + # i.e with_ads_support = auto, otherwise die with an error. + + if test x"$with_ads_support" = x"yes"; then + AC_MSG_ERROR([Active Directory cannot be supported without krb5.h]) + else + AC_MSG_WARN([Active Directory cannot be supported without krb5.h]) + fi + + # Turn off AD support and restore CFLAGS and LIBS variables + + with_ads_support="no" + + CFLAGS="$ac_save_CFLAGS" + LIBS="$ac_save_LIBS" + + else + + # Get rid of case where $with_ads_support=auto + + with_ads_support="yes" + + fi +fi + +# Now we have determined whether we really want ADS support + +if test x"$with_ads_support" = x"yes"; then + + AC_DEFINE(WITH_ADS,1,[Whether to include Active Directory support]) + # now check for gssapi headers. This is also done here to allow for # different kerberos include paths AC_CHECK_HEADERS(gssapi.h gssapi/gssapi_generic.h gssapi/gssapi.h com_err.h) ################################################################## # we might need the k5crypto and com_err libraries on some systems - AC_CHECK_LIB(com_err, _et_list, [LIBS="$LIBS -lcom_err"]) - AC_CHECK_LIB(k5crypto, krb5_encrypt_data, [LIBS="$LIBS -lk5crypto"]) + AC_CHECK_LIB(com_err, _et_list) + AC_CHECK_LIB(k5crypto, krb5_encrypt_data) + # Heimdal checks. - AC_CHECK_LIB(crypto, des_set_key, [LIBS="$LIBS -lcrypto"]) - AC_CHECK_LIB(asn1, copy_Authenticator, [LIBS="$LIBS -lasn1"]) - AC_CHECK_LIB(roken, roken_getaddrinfo_hostspec, [LIBS="$LIBS -lroken"]) + AC_CHECK_LIB(crypto, des_set_key) + AC_CHECK_LIB(asn1, copy_Authenticator) + AC_CHECK_LIB(roken, roken_getaddrinfo_hostspec) + # Heimdal checks. On static Heimdal gssapi must be linked before krb5. AC_CHECK_LIB(gssapi, gss_display_status, [LIBS="$LIBS -lgssapi -lkrb5"; - AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) - - AC_CHECK_LIB(krb5, krb5_set_real_time, [AC_DEFINE(HAVE_KRB5_SET_REAL_TIME,1,[Whether krb5_set_real_time is available])]) - AC_CHECK_LIB(krb5, krb5_set_default_in_tkt_etypes, [AC_DEFINE(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES,1,[Whether krb5_set_default_in_tkt_etypes, is available])]) - AC_CHECK_LIB(krb5, krb5_set_default_tgs_ktypes, [AC_DEFINE(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES,1,[Whether krb5_set_default_tgs_ktypes is available])]) - - AC_CHECK_LIB(krb5, krb5_principal2salt, [AC_DEFINE(HAVE_KRB5_PRINCIPAL2SALT,1,[Whether krb5_principal2salt is available])]) - AC_CHECK_LIB(krb5, krb5_use_enctype, [AC_DEFINE(HAVE_KRB5_USE_ENCTYPE,1,[Whether krb5_use_enctype is available])]) - AC_CHECK_LIB(krb5, krb5_string_to_key, [AC_DEFINE(HAVE_KRB5_STRING_TO_KEY,1,[Whether krb5_string_to_key is available])]) - AC_CHECK_LIB(krb5, krb5_get_pw_salt, [AC_DEFINE(HAVE_KRB5_GET_PW_SALT,1,[Whether krb5_get_pw_salt is available])]) - AC_CHECK_LIB(krb5, krb5_string_to_key_salt, [AC_DEFINE(HAVE_KRB5_STRING_TO_KEY_SALT,1,[Whether krb5_string_to_key_salt is available])]) - AC_CHECK_LIB(krb5, krb5_auth_con_setkey, [AC_DEFINE(HAVE_KRB5_AUTH_CON_SETKEY,1,[Whether krb5_auth_con_setkey is available])]) - AC_CHECK_LIB(krb5, krb5_auth_con_setuseruserkey, [AC_DEFINE(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY,1,[Whether krb5_auth_con_setuseruserkey is available])]) - AC_CHECK_LIB(krb5, krb5_locate_kdc, [AC_DEFINE(HAVE_KRB5_LOCATE_KDC,1,[Whether krb5_locate_kdc is available])]) - AC_CHECK_LIB(krb5, krb5_get_permitted_enctypes, [AC_DEFINE(HAVE_KRB5_GET_PERMITTED_ENCTYPES,1,[Whether krb5_get_permitted_enctypes is available])]) - AC_CHECK_LIB(krb5, krb5_get_default_in_tkt_etypes, [AC_DEFINE(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES,1,[Whether krb5_get_default_in_tkt_etypes is available])]) - AC_CHECK_LIB(krb5, krb5_free_ktypes, [AC_DEFINE(HAVE_KRB5_FREE_KTYPES,1,[Whether krb5_free_ktypes is available])]) - -AC_CACHE_CHECK([for addrtype in krb5_address],samba_cv_HAVE_ADDRTYPE_IN_KRB5_ADDRESS,[ -AC_TRY_COMPILE([#include ], -[krb5_address kaddr; kaddr.addrtype = ADDRTYPE_INET;], -samba_cv_HAVE_ADDRTYPE_IN_KRB5_ADDRESS=yes,samba_cv_HAVE_ADDRTYPE_IN_KRB5_ADDRESS=no)]) -if test x"$samba_cv_HAVE_ADDRTYPE_IN_KRB5_ADDRESS" = x"yes"; then - AC_DEFINE(HAVE_ADDRTYPE_IN_KRB5_ADDRESS,1,[Whether the krb5_address struct has a addrtype property]) -fi - -AC_CACHE_CHECK([for addr_type in krb5_address],samba_cv_HAVE_ADDR_TYPE_IN_KRB5_ADDRESS,[ -AC_TRY_COMPILE([#include ], -[krb5_address kaddr; kaddr.addr_type = KRB5_ADDRESS_INET;], -samba_cv_HAVE_ADDR_TYPE_IN_KRB5_ADDRESS=yes,samba_cv_HAVE_ADDR_TYPE_IN_KRB5_ADDRESS=no)]) -if test x"$samba_cv_HAVE_ADDR_TYPE_IN_KRB5_ADDRESS" = x"yes"; then - AC_DEFINE(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS,1,[Whether the krb5_address struct has a addr_type property]) -fi - -AC_CACHE_CHECK([for enc_part2 in krb5_ticket],samba_cv_HAVE_KRB5_TKT_ENC_PART2,[ -AC_TRY_COMPILE([#include ], -[krb5_ticket tkt; tkt.enc_part2->authorization_data[0]->contents = NULL;], -samba_cv_HAVE_KRB5_TKT_ENC_PART2=yes,samba_cv_HAVE_KRB5_TKT_ENC_PART2=no)]) -if test x"$samba_cv_HAVE_KRB5_TKT_ENC_PART2" = x"yes"; then - AC_DEFINE(HAVE_KRB5_TKT_ENC_PART2,1,[Whether the krb5_ticket struct has a enc_part2 property]) -fi - -AC_CACHE_CHECK([for keyvalue in krb5_keyblock],samba_cv_HAVE_KRB5_KEYBLOCK_KEYVALUE,[ -AC_TRY_COMPILE([#include ], -[krb5_keyblock key; key.keyvalue.data = NULL;], -samba_cv_HAVE_KRB5_KEYBLOCK_KEYVALUE=yes,samba_cv_HAVE_KRB5_KEYBLOCK_KEYVALUE=no)]) -if test x"$samba_cv_HAVE_KRB5_KEYBLOCK_KEYVALUE" = x"yes"; then - AC_DEFINE(HAVE_KRB5_KEYBLOCK_KEYVALUE,1,[Whether the krb5_keyblock struct has a keyvalue property]) -fi - -AC_CACHE_CHECK([for ENCTYPE_ARCFOUR_HMAC_MD5],samba_cv_HAVE_ENCTYPE_ARCFOUR_HMAC_MD5,[ -AC_TRY_COMPILE([#include ], -[krb5_enctype enctype; enctype = ENCTYPE_ARCFOUR_HMAC_MD5;], -samba_cv_HAVE_ENCTYPE_ARCFOUR_HMAC_MD5=yes,samba_cv_HAVE_ENCTYPE_ARCFOUR_HMAC_MD5=no)]) -if test x"$samba_cv_HAVE_ENCTYPE_ARCFOUR_HMAC_MD5" = x"yes"; then - AC_DEFINE(HAVE_ENCTYPE_ARCFOUR_HMAC_MD5,1,[Whether the ENCTYPE_ARCFOUR_HMAC_MD5 key type is available]) -fi + AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) + + AC_CHECK_LIB(krb5, krb5_set_real_time, + [AC_DEFINE(HAVE_KRB5_SET_REAL_TIME,1, + [Whether krb5_set_real_time is available])]) + AC_CHECK_LIB(krb5, krb5_set_default_in_tkt_etypes, + [AC_DEFINE(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES,1, + [Whether krb5_set_default_in_tkt_etypes, is available])]) + AC_CHECK_LIB(krb5, krb5_set_default_tgs_ktypes, + [AC_DEFINE(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES,1, + [Whether krb5_set_default_tgs_ktypes is available])]) + + AC_CHECK_LIB(krb5, krb5_principal2salt, + [AC_DEFINE(HAVE_KRB5_PRINCIPAL2SALT,1, + [Whether krb5_principal2salt is available])]) + AC_CHECK_LIB(krb5, krb5_use_enctype, + [AC_DEFINE(HAVE_KRB5_USE_ENCTYPE,1, + [Whether krb5_use_enctype is available])]) + AC_CHECK_LIB(krb5, krb5_string_to_key, + [AC_DEFINE(HAVE_KRB5_STRING_TO_KEY,1, + [Whether krb5_string_to_key is available])]) + AC_CHECK_LIB(krb5, krb5_get_pw_salt, + [AC_DEFINE(HAVE_KRB5_GET_PW_SALT,1, + [Whether krb5_get_pw_salt is available])]) + AC_CHECK_LIB(krb5, krb5_string_to_key_salt, + [AC_DEFINE(HAVE_KRB5_STRING_TO_KEY_SALT,1, + [Whether krb5_string_to_key_salt is available])]) + AC_CHECK_LIB(krb5, krb5_auth_con_setkey, + [AC_DEFINE(HAVE_KRB5_AUTH_CON_SETKEY,1, + [Whether krb5_auth_con_setkey is available])]) + AC_CHECK_LIB(krb5, krb5_auth_con_setuseruserkey, + [AC_DEFINE(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY,1, + [Whether krb5_auth_con_setuseruserkey is available])]) + AC_CHECK_LIB(krb5, krb5_locate_kdc, + [AC_DEFINE(HAVE_KRB5_LOCATE_KDC,1, + [Whether krb5_locate_kdc is available])]) + AC_CHECK_LIB(krb5, krb5_get_permitted_enctypes, + [AC_DEFINE(HAVE_KRB5_GET_PERMITTED_ENCTYPES,1, + [Whether krb5_get_permitted_enctypes is available])]) + AC_CHECK_LIB(krb5, krb5_get_default_in_tkt_etypes, + [AC_DEFINE(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES,1, + [Whether krb5_get_default_in_tkt_etypes is available])]) + AC_CHECK_LIB(krb5, krb5_free_ktypes, + [AC_DEFINE(HAVE_KRB5_FREE_KTYPES,1, + [Whether krb5_free_ktypes is available])]) + + AC_CACHE_CHECK([for addrtype in krb5_address], + samba_cv_HAVE_ADDRTYPE_IN_KRB5_ADDRESS,[ + AC_TRY_COMPILE([#include ], + [krb5_address kaddr; kaddr.addrtype = ADDRTYPE_INET;], + samba_cv_HAVE_ADDRTYPE_IN_KRB5_ADDRESS=yes, + samba_cv_HAVE_ADDRTYPE_IN_KRB5_ADDRESS=no)]) + + if test x"$samba_cv_HAVE_ADDRTYPE_IN_KRB5_ADDRESS" = x"yes"; then + AC_DEFINE(HAVE_ADDRTYPE_IN_KRB5_ADDRESS,1, + [Whether the krb5_address struct has a addrtype property]) + fi + + AC_CACHE_CHECK([for addr_type in krb5_address], + samba_cv_HAVE_ADDR_TYPE_IN_KRB5_ADDRESS,[ + AC_TRY_COMPILE([#include ], + [krb5_address kaddr; kaddr.addr_type = KRB5_ADDRESS_INET;], + samba_cv_HAVE_ADDR_TYPE_IN_KRB5_ADDRESS=yes, + samba_cv_HAVE_ADDR_TYPE_IN_KRB5_ADDRESS=no)]) + + if test x"$samba_cv_HAVE_ADDR_TYPE_IN_KRB5_ADDRESS" = x"yes"; then + AC_DEFINE(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS,1, + [Whether the krb5_address struct has a addr_type property]) + fi + + AC_CACHE_CHECK([for enc_part2 in krb5_ticket], + samba_cv_HAVE_KRB5_TKT_ENC_PART2, + [AC_TRY_COMPILE([#include ], + [krb5_ticket tkt; tkt.enc_part2->authorization_data[0]->contents = NULL;], + samba_cv_HAVE_KRB5_TKT_ENC_PART2=yes,samba_cv_HAVE_KRB5_TKT_ENC_PART2=no)]) + + if test x"$samba_cv_HAVE_KRB5_TKT_ENC_PART2" = x"yes"; then + AC_DEFINE(HAVE_KRB5_TKT_ENC_PART2,1, + [Whether the krb5_ticket struct has a enc_part2 property]) + fi + + AC_CACHE_CHECK([for keyvalue in krb5_keyblock], + samba_cv_HAVE_KRB5_KEYBLOCK_KEYVALUE,[ + AC_TRY_COMPILE([#include ], + [krb5_keyblock key; key.keyvalue.data = NULL;], + samba_cv_HAVE_KRB5_KEYBLOCK_KEYVALUE=yes, + samba_cv_HAVE_KRB5_KEYBLOCK_KEYVALUE=no)]) + + if test x"$samba_cv_HAVE_KRB5_KEYBLOCK_KEYVALUE" = x"yes"; then + AC_DEFINE(HAVE_KRB5_KEYBLOCK_KEYVALUE,1, + [Whether the krb5_keyblock struct has a keyvalue property]) + fi + + AC_CACHE_CHECK([for ENCTYPE_ARCFOUR_HMAC_MD5], + samba_cv_HAVE_ENCTYPE_ARCFOUR_HMAC_MD5,[ + AC_TRY_COMPILE([#include ], + [krb5_enctype enctype; enctype = ENCTYPE_ARCFOUR_HMAC_MD5;], + samba_cv_HAVE_ENCTYPE_ARCFOUR_HMAC_MD5=yes, + samba_cv_HAVE_ENCTYPE_ARCFOUR_HMAC_MD5=no)]) + + if test x"$samba_cv_HAVE_ENCTYPE_ARCFOUR_HMAC_MD5" = x"yes"; then + AC_DEFINE(HAVE_ENCTYPE_ARCFOUR_HMAC_MD5,1, + [Whether the ENCTYPE_ARCFOUR_HMAC_MD5 key type is available]) + fi ######################################################## # now see if we can find the krb5 libs in standard paths # or as specified above AC_CHECK_LIB(krb5, krb5_mk_req_extended, [KRB5_LIBS="$LIBS -lkrb5"; - KRB5_CFLAGS="$CFLAGS"; - AC_DEFINE(HAVE_KRB5,1,[Whether KRB5 is available])]) + KRB5_CFLAGS="$CFLAGS"; + AC_DEFINE(HAVE_KRB5,1,[Whether KRB5 is available])]) ######################################################## # now see if we can find the gssapi libs in standard paths - AC_CHECK_LIB(gssapi_krb5, gss_display_status, [KRB5_LIBS="$KRB5_LIBS -lgssapi_krb5"; - AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) + AC_CHECK_LIB(gssapi_krb5, gss_display_status, + [KRB5_LIBS="$KRB5_LIBS -lgssapi_krb5"; + AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) -LIBS="$ac_save_LIBS"; CFLAGS="$ac_save_CFLAGS" + CFLAGS="$ac_save_CFLAGS" + LIBS="$ac_save_LIBS" fi ######################################################## @@ -2265,22 +2389,28 @@ AC_ARG_WITH(ldap, AC_MSG_RESULT($with_ldap_support) +SMBLDAP="" if test x"$with_ldap_support" = x"yes"; then -ac_save_LIBS="$LIBS" -LIBS="" + ac_save_LIBS="$LIBS" + LIBS="" ################################################################## # we might need the lber lib on some systems. To avoid link errors # this test must be before the libldap test - AC_CHECK_LIB(lber, ber_scanf, [LIBS="$LIBS -llber"]) + AC_CHECK_LIB(lber, ber_scanf) ######################################################## # now see if we can find the ldap libs in standard paths if test x$have_ldap != xyes; then - AC_CHECK_LIB(ldap, ldap_domain2hostlist, [LIBS="$LIBS -lldap"; - LDAP_OBJ=lib/ldap.o; - AC_DEFINE(HAVE_LDAP,1,[Whether ldap is available])]) - AC_CHECK_HEADERS([ldap.h lber.h], [default_static_modules="$default_static_modules pdb_ldap"]) + AC_CHECK_LIB(ldap, ldap_init, [ + LIBS="$LIBS -lldap"; + AC_CHECK_LIB(ldap, ldap_domain2hostlist, [ + AC_DEFINE(HAVE_LDAP,1,[Whether ldap is available]) + AC_CHECK_HEADERS([ldap.h lber.h], + [default_static_modules="$default_static_modules pdb_ldap idmap_ldap"; + SMBLDAP="lib/smbldap.o"]) + ]) + ]) ######################################################## # If we have LDAP, does it's rebind procedure take 2 or 3 arguments? @@ -2291,10 +2421,12 @@ LIBS="" #include #include ], [ldap_set_rebind_proc(0, 0, 0);], [pam_ldap_cv_ldap_set_rebind_proc=3], [pam_ldap_cv_ldap_set_rebind_proc=2]) ]) AC_DEFINE_UNQUOTED(LDAP_SET_REBIND_PROC_ARGS, $pam_ldap_cv_ldap_set_rebind_proc, [Number of arguments to ldap_set_rebind_proc]) + AC_CHECK_FUNCS(ldap_initialize) fi -LDAP_LIBS="$LIBS"; -LIBS="$ac_save_LIBS"; + AC_SUBST(SMBLDAP) + LDAP_LIBS="$LIBS"; + LIBS="$ac_save_LIBS"; else # Can't have ADS support without LDAP if test x"$with_ads_support" = x"yes"; then @@ -2313,10 +2445,10 @@ AC_MSG_CHECKING(whether to build experimental passdb libraries) AC_ARG_WITH(expsam, [ --with-expsam= Include experimental passdb libraries (default=no)] [ Valid choices include (comma separated list): ] -[ xml, mysql, & nisplussam ], +[ xml & mysql], [ expsam_pdb_modules=`echo "$withval" | sed 's/,/ /g'` if test "z$expsam_pdb_modules" = "zyes"; then - expsam_pdb_modules="xml mysql nisplussam" + expsam_pdb_modules="xml mysql" fi AC_MSG_RESULT($expsam_pdb_modules) for i in $expsam_pdb_modules @@ -2332,9 +2464,7 @@ AC_ARG_WITH(expsam, AM_PATH_MYSQL([0.11.0],[default_shared_modules="$default_shared_modules pdb_mysql"],[]) CFLAGS="$CFLAGS $MYSQL_CFLAGS" ;; - nisplussam) - ## pdb_nisplussam - MODULE_pdb_nisplussam=SHARED + no) ;; *) echo "Unknown module name \"$i\"! Exiting..." @@ -2485,27 +2615,6 @@ AC_ARG_WITH(ldapsam, AC_MSG_RESULT(no) ) -################################################# -# check for IDMAP - -AC_DEFINE(WITH_IDMAP,1, [Include IDMAP support]) - -AC_MSG_CHECKING(whether to use IDMAP only for [ug]id mapping) -AC_ARG_WITH(idmap, -[ --with-idmap Include experimental IDMAP support (default=yes)], -[ case "$withval" in - yes) - AC_MSG_RESULT(yes) - AC_DEFINE(WITH_IDMAP,1,[Whether to include experimental IDMAP support]) - ;; - no) - AC_MSG_RESULT(no) - AC_DEFINE(WITH_IDMAP,0,[Whether to include experimental IDMAP support]) - ;; - esac ], - AC_MSG_RESULT(yes) -) - ######################################################################################## ## ## END OF TESTS FOR SAM BACKENDS. @@ -2566,63 +2675,318 @@ AC_ARG_WITH(profiling-data, ################################################# # check for experimental disk-quotas support -QUOTAOBJS=smbd/noquotas.o -AC_MSG_CHECKING(whether to support disk-quotas) +samba_cv_WITH_QUOTAS=auto +samba_cv_TRY_QUOTAS=no +samba_cv_RUN_QUOTA_TESTS=auto +samba_cv_WITH_SYS_QUOTAS=auto +samba_cv_TRY_SYS_QUOTAS=no + +AC_MSG_CHECKING(whether to try disk-quotas support) AC_ARG_WITH(quotas, -[ --with-quotas Include experimental disk-quota support (default=no)], +[ --with-quotas Include disk-quota support (default=no)], [ case "$withval" in yes) AC_MSG_RESULT(yes) - case "$host_os" in - *linux*) - # Check for kernel 2.4.x quota braindamage... - AC_CACHE_CHECK([for linux 2.4.x quota braindamage..],samba_cv_linux_2_4_quota_braindamage, [ - AC_TRY_COMPILE([#include -#include -#include -#include -#include -#include ],[struct mem_dqblk D;], - samba_cv_linux_2_4_quota_braindamage=yes,samba_cv_linux_2_4_quota_braindamage=no)]) -if test x"$samba_cv_linux_2_4_quota_braindamage" = x"yes"; then - AC_DEFINE(LINUX_QUOTAS_2,1,[linux 2.4.x quota braindamage]) -else - AC_DEFINE(LINUX_QUOTAS_1,1,[linux quotas]) -fi - ;; - *) - ;; - esac - QUOTAOBJS=smbd/quotas.o - AC_DEFINE(WITH_QUOTAS,1,[Whether to include experimental quota support]) + samba_cv_WITH_QUOTAS=yes + samba_cv_TRY_QUOTAS=yes + samba_cv_RUN_QUOTA_TESTS=yes + #set sys quotas to auto in this case + samba_cv_TRY_SYS_QUOTAS=auto + ;; + auto) + AC_MSG_RESULT(auto) + samba_cv_WITH_QUOTAS=auto + samba_cv_TRY_QUOTAS=auto + samba_cv_RUN_QUOTA_TESTS=auto + #set sys quotas to auto in this case + samba_cv_TRY_SYS_QUOTAS=auto + ;; + no) + AC_MSG_RESULT(no) + samba_cv_WITH_QUOTAS=no + samba_cv_TRY_QUOTAS=no + samba_cv_RUN_QUOTA_TESTS=no ;; *) + AC_MSG_RESULT(${samba_cv_TRY_QUOTAS}) + ;; + esac ], + AC_MSG_RESULT(${samba_cv_TRY_QUOTAS}) +) + +AC_MSG_CHECKING(whether to try the new lib/sysquotas.c interface) +AC_ARG_WITH(sys-quotas, +[ --with-sys-quotas Include lib/sysquotas.c support (default=auto)], +[ case "$withval" in + yes) + AC_MSG_RESULT(yes) + samba_cv_WITH_SYS_QUOTAS=yes + samba_cv_TRY_SYS_QUOTAS=yes + samba_cv_RUN_QUOTA_TESTS=yes + ;; + auto) + AC_MSG_RESULT(auto) + samba_cv_WITH_SYS_QUOTAS=auto + samba_cv_TRY_SYS_QUOTAS=auto + samba_cv_RUN_QUOTA_TESTS=auto + ;; + no) AC_MSG_RESULT(no) + samba_cv_WITH_SYS_QUOTAS=no + samba_cv_TRY_SYS_QUOTAS=no + ;; + *) + AC_MSG_RESULT(${samba_cv_TRY_SYS_QUOTAS}) ;; esac ], - AC_MSG_RESULT(no) + AC_MSG_RESULT(${samba_cv_TRY_SYS_QUOTAS}) ) -AC_SUBST(QUOTAOBJS) + +if test x"$samba_cv_TRY_SYS_QUOTAS" = x"auto"; then +AC_MSG_CHECKING(whether to try the lib/sysquotas.c interface on ${host_os}) + case "$host_os" in + *linux*) + AC_MSG_RESULT(yes) + samba_cv_TRY_SYS_QUOTAS=yes + samba_cv_RUN_QUOTA_TESTS=yes + ;; + *) + AC_MSG_RESULT(no) + samba_cv_TRY_SYS_QUOTAS=no + ;; + esac +fi + +############################################# +# only check for quota stuff if --with-quotas +if test x"$samba_cv_RUN_QUOTA_TESTS" != x"no"; then + +# For quotas on Veritas VxFS filesystems +AC_CHECK_HEADERS(sys/fs/vx_quota.h) + +# For sys/quota.h and linux/quota.h +AC_CHECK_HEADERS(sys/quota.h) +AC_CHECK_HEADERS(asm/types.h linux/quota.h) + +# For quotas on Linux XFS filesystems +AC_CHECK_HEADERS(linux/xqm.h linux/xfs_fs.h) +AC_CHECK_HEADERS(xfs/libxfs.h xfs/xqm.h xfs/xfs_fs.h) +# For linux > 2.5.56 +AC_CHECK_HEADERS(linux/dqblk_xfs.h) + +# if we have struct if_dqblk in we should use it +AC_CACHE_CHECK([for struct if_dqblk in ],samba_cv_HAVE_STRUCT_IF_DQBLK, [ +AC_TRY_COMPILE([ +#include "confdefs.h" +#ifdef HAVE_SYS_TYPES_H +#include +#endif +#ifdef HAVE_ASM_TYPES_H +#include +#endif +#include +],[struct if_dqblk D;], +samba_cv_HAVE_STRUCT_IF_DQBLK=yes,samba_cv_HAVE_STRUCT_IF_DQBLK=no)]) +if test "$samba_cv_HAVE_STRUCT_IF_DQBLK"x = "yes"x; then + AC_DEFINE(HAVE_STRUCT_IF_DQBLK,1,[struct if_dqblk]) +fi + +# if we have struct mem_dqblk in we should use it +AC_CACHE_CHECK([for struct mem_dqblk in ],samba_cv_HAVE_STRUCT_MEM_DQBLK, [ +AC_TRY_COMPILE([ +#include "confdefs.h" +#ifdef HAVE_SYS_TYPES_H +#include +#endif +#ifdef HAVE_ASM_TYPES_H +#include +#endif +#include +],[struct mem_dqblk D;], +samba_cv_HAVE_STRUCT_MEM_DQBLK=yes,samba_cv_HAVE_STRUCT_MEM_DQBLK=no)]) +if test "$samba_cv_HAVE_STRUCT_MEM_DQBLK"x = "yes"x; then + AC_DEFINE(HAVE_STRUCT_MEM_DQBLK,1,[struct mem_dqblk]) +fi + +# if we have struct dqblk .dqb_fsoftlimit instead of .dqb_isoftlimit on IRIX +AC_CACHE_CHECK([if struct dqblk has .dqb_fsoftlimit],samba_cv_HAVE_DQB_FSOFTLIMIT, [ +AC_TRY_COMPILE([ +#include "confdefs.h" +#ifdef HAVE_SYS_QUOTA_H +#include +#endif +],[ +struct dqblk D; +D.dqb_fsoftlimit = 0;], +samba_cv_HAVE_DQB_FSOFTLIMIT=yes,samba_cv_HAVE_DQB_FSOFTLIMIT=no)]) +if test "$samba_cv_HAVE_DQB_FSOFTLIMIT"x = "yes"x; then + AC_DEFINE(HAVE_DQB_FSOFTLIMIT,1,[struct dqblk .dqb_fsoftlimit]) +fi + +################## +# look for a working quota system +samba_cv_SYSQUOTA_FOUND=no; + +if test x"$samba_cv_SYSQUOTA_FOUND" != x"yes"; then +AC_CACHE_CHECK([for long quotactl(int cmd, char *special, qid_t id, caddr_t addr)],samba_cv_HAVE_QUOTACTL_4A,[ +AC_TRY_RUN_STRICT([ +#define HAVE_QUOTACTL_4A 1 +#define AUTOCONF_TEST 1 +#include "confdefs.h" +#include "${srcdir-.}/lib/sysquotas.c"],[$Werror_FLAGS],[$CPPFLAGS],[$LDFLAGS], + samba_cv_HAVE_QUOTACTL_4A=yes,samba_cv_HAVE_QUOTACTL_4A=no,samba_cv_HAVE_QUOTACTL_4A=cross)]) +if test x"$samba_cv_HAVE_QUOTACTL_4A" = x"yes"; then + samba_cv_SYSQUOTA_FOUND=yes;AC_DEFINE(HAVE_QUOTACTL_4A,1,[Whether long quotactl(int cmd, char *special, qid_t id, caddr_t addr) is available]) +fi +fi + +if test x"$samba_cv_SYSQUOTA_FOUND" != x"yes"; then +AC_CACHE_CHECK([for int quotactl(const char *path, int cmd, int id, char *addr)],samba_cv_HAVE_QUOTACTL_4B,[ +AC_TRY_RUN_STRICT([ +#define HAVE_QUOTACTL_4B 1 +#define AUTOCONF_TEST 1 +#include "confdefs.h" +#include "${srcdir-.}/lib/sysquotas.c"],[$Werror_FLAGS],[$CPPFLAGS],[$LDFLAGS], + samba_cv_HAVE_QUOTACTL_4B=yes,samba_cv_HAVE_QUOTACTL_4B=no,samba_cv_HAVE_QUOTACTL_4B=cross)]) +if test x"$samba_cv_HAVE_QUOTACTL_4B" = x"yes"; then + echo "int quotactl(const char *path, int cmd, int id, char *addr) is not reworked for the new sys_quota api" +# samba_cv_SYSQUOTA_FOUND=yes;AC_DEFINE(HAVE_QUOTACTL_4B,1,[Whether int quotactl(const char *path, int cmd, int id, char *addr) is available]) +fi +fi + +if test x"$samba_cv_SYSQUOTA_FOUND" != x"yes"; then +AC_CACHE_CHECK([for CRAY int quotactl (char *spec, int request, char *arg)],samba_cv_HAVE_QUOTACTL_3,[ +AC_TRY_RUN_STRICT([ +#define HAVE_QUOTACTL_3 1 +#define AUTOCONF_TEST 1 +#include "confdefs.h" +#include "${srcdir-.}/lib/sysquotas.c"],[$Werror_FLAGS],[$CPPFLAGS],[$LDFLAGS], + samba_cv_HAVE_QUOTACTL_3=yes,samba_cv_HAVE_QUOTACTL_3=no,samba_cv_HAVE_QUOTACTL_3=cross)]) +if test x"$samba_cv_HAVE_QUOTACTL_3" = x"yes"; then + echo "CRAY int quotactl (char *spec, int request, char *arg) is NOT reworked for the sys_quota api" +# samba_cv_SYSQUOTA_FOUND=yes;AC_DEFINE(HAVE_QUOTACTL_3,1,[Whether CRAY int quotactl (char *spec, int request, char *arg); is available]) +fi +fi + +################################################# +# check for mntent.h and struct mntent +AC_CHECK_HEADERS(mntent.h) +################################################# +# check for setmntent,getmntent,endmntent +AC_CHECK_FUNCS(setmntent getmntent endmntent) + +################################################# +# check for devnm.h and struct mntent +AC_CHECK_HEADERS(devnm.h) +################################################# +# check for devnm +AC_CHECK_FUNCS(devnm) + +if test x"$samba_cv_WITH_SYS_QUOTAS" = x"yes"; then + if test x"$samba_cv_SYSQUOTA_FOUND" != x"yes"; then + # if --with-sys-quotas=yes then build it + # you have can use the get/set quota command smb.conf + # options then + samba_cv_SYSQUOTA_FOUND=auto + fi + if test x"$samba_cv_TRY_SYS_QUOTAS" != x"yes"; then + # if --with-sys-quotas=yes then build it + # you have can use the get/set quota command smb.conf + # options then + samba_cv_TRY_SYS_QUOTAS=auto + fi +fi + +if test x"$samba_cv_SYSQUOTA_FOUND" != x"no"; then +AC_CACHE_CHECK([whether the sys_quota interface works],samba_cv_SYSQUOTA_WORKS,[ +SAVE_CPPFLAGS="$CPPFLAGS" +CPPFLAGS="$CPPFLAGS -I${srcdir-.}/ -I. -I${srcdir-.}/include -I${srcdir-.}/ubiqx -I${srcdir-.}/popt -I${srcdir-.}/smbwrapper -I${srcdir-.}/nsswitch" +AC_TRY_COMPILE([ +#include "confdefs.h" +#define NO_PROTO_H 1 +#define NO_CONFIG_H 1 +#define HAVE_SYS_QUOTAS 1 +#include "${srcdir-.}/lib/sysquotas.c" +],[],samba_cv_SYSQUOTA_WORKS=yes,samba_cv_SYSQUOTA_WORKS=no) +CPPFLAGS="$SAVE_CPPFLAGS" +]) +if test x"$samba_cv_SYSQUOTA_WORKS" = x"yes"; then +AC_MSG_CHECKING(whether to use the new lib/sysquotas.c interface) + if test x"$samba_cv_TRY_SYS_QUOTAS" != x"no"; then + AC_DEFINE(WITH_QUOTAS,1,[Whether to use disk quota support]) + AC_DEFINE(HAVE_SYS_QUOTAS,1,[Whether the new lib/sysquotas.c interface can be used]) + samba_cv_WE_USE_SYS_QUOTAS=yes + AC_MSG_RESULT(yes) + else + AC_MSG_RESULT(no) + fi +fi +fi + +AC_CACHE_CHECK([whether the old quota support works],samba_cv_QUOTA_WORKS,[ +SAVE_CPPFLAGS="$CPPFLAGS" +CPPFLAGS="$CPPFLAGS -I${srcdir-.}/ -I. -I${srcdir-.}/include -I${srcdir-.}/ubiqx -I${srcdir-.}/popt -I${srcdir-.}/smbwrapper -I${srcdir-.}/nsswitch" +AC_TRY_COMPILE([ +#include "confdefs.h" +#define NO_PROTO_H 1 +#define NO_CONFIG_H 1 +#include "${srcdir-.}/smbd/quotas.c" +],[],samba_cv_QUOTA_WORKS=yes,samba_cv_QUOTA_WORKS=no) +CPPFLAGS="$SAVE_CPPFLAGS" +]) +if test x"$samba_cv_QUOTA_WORKS" = x"yes"; then +AC_MSG_CHECKING(whether to use the old quota support) + if test x"$samba_cv_WE_USE_SYS_QUOTAS" != x"yes"; then + if test x"$samba_cv_TRY_QUOTAS" != x"no"; then + AC_DEFINE(WITH_QUOTAS,1,[Whether to use disk quota support]) + AC_MSG_RESULT(yes) + else + AC_MSG_RESULT(no) + fi + else + AC_MSG_RESULT(no) + fi +fi + +#################### +# End of quota check samba_cv_RUN_QUOTA_TESTS +fi ################################################# # check for experimental utmp accounting AC_MSG_CHECKING(whether to support utmp accounting) +WITH_UTMP=yes AC_ARG_WITH(utmp, -[ --with-utmp Include experimental utmp accounting (default=no)], +[ --with-utmp Include utmp accounting (default, if supported by OS)], [ case "$withval" in - yes) - AC_MSG_RESULT(yes) - AC_DEFINE(WITH_UTMP,1,[Whether to include experimental utmp accounting]) - ;; + no) + WITH_UTMP=no + ;; *) - AC_MSG_RESULT(no) - ;; + WITH_UTMP=yes + ;; esac ], - AC_MSG_RESULT(no) ) +# utmp requires utmp.h +# Note similar check earlier, when checking utmp details. + +if test x"$WITH_UTMP" = x"yes" -a x"$ac_cv_header_utmp_h" = x"no"; then + utmp_no_reason=", no utmp.h on $host_os" + WITH_UTMP=no +fi + +# Display test results + +if test x"$WITH_UTMP" = x"yes"; then + AC_MSG_RESULT(yes) + AC_DEFINE(WITH_UTMP,1,[Whether to include experimental utmp accounting]) +else + AC_MSG_RESULT(no$utmp_no_reason) +fi + ################################################# # choose native language(s) of man pages AC_MSG_CHECKING(chosen man pages' language(s)) @@ -2966,7 +3330,34 @@ AC_ARG_WITH(acl-support, AC_DEFINE(HAVE_POSIX_ACLS,1,[Whether FreeBSD POSIX ACLs are available]) AC_DEFINE(HAVE_ACL_GET_PERM_NP,1,[Whether acl_get_perm_np() is available]) ;; - *) + *linux*) + AC_CHECK_LIB(attr,getxattr,[ACLLIBS="$ACLLIBS -lattr"]) + AC_CHECK_LIB(acl,acl_get_file,[ACLLIBS="$ACLLIBS -lacl"]) + AC_CACHE_CHECK([for ACL support],samba_cv_HAVE_POSIX_ACLS,[ + acl_LIBS=$LIBS + LIBS="$LIBS -lacl" + AC_TRY_LINK([#include +#include ], +[ acl_t acl; int entry_id; acl_entry_t *entry_p; return acl_get_entry( acl, entry_id, entry_p);], +samba_cv_HAVE_POSIX_ACLS=yes,samba_cv_HAVE_POSIX_ACLS=no) + LIBS=$acl_LIBS]) + if test x"$samba_cv_HAVE_POSIX_ACLS" = x"yes"; then + AC_MSG_RESULT(Using posix ACLs) + AC_DEFINE(HAVE_POSIX_ACLS,1,[Whether POSIX ACLs are available]) + AC_CACHE_CHECK([for acl_get_perm_np],samba_cv_HAVE_ACL_GET_PERM_NP,[ + acl_LIBS=$LIBS + LIBS="$LIBS -lacl" + AC_TRY_LINK([#include +#include ], +[ acl_permset_t permset_d; acl_perm_t perm; return acl_get_perm_np( permset_d, perm);], +samba_cv_HAVE_ACL_GET_PERM_NP=yes,samba_cv_HAVE_ACL_GET_PERM_NP=no) + LIBS=$acl_LIBS]) + if test x"$samba_cv_HAVE_ACL_GET_PERM_NP" = x"yes"; then + AC_DEFINE(HAVE_ACL_GET_PERM_NP,1,[Whether acl_get_perm_np() is available]) + fi + fi + ;; + *) AC_CHECK_LIB(acl,acl_get_file,[ACLLIBS="$ACLLIBS -lacl"]) AC_CACHE_CHECK([for ACL support],samba_cv_HAVE_POSIX_ACLS,[ acl_LIBS=$LIBS @@ -3245,7 +3636,8 @@ HAVE_WINBIND=yes # Define the winbind shared library name and any specific linker flags # it needs to be built with. -WINBIND_NSS=libnss_winbind.$SHLIBEXT +WINBIND_NSS="nsswitch/libnss_winbind.$SHLIBEXT" +WINBIND_WINS_NSS="nsswitch/libnss_wins.$SHLIBEXT" WINBIND_NSS_LDSHFLAGS=$LDSHFLAGS case "$host_os" in @@ -3253,8 +3645,10 @@ case "$host_os" in WINBIND_NSS_EXTRA_OBJS="nsswitch/winbind_nss_linux.o" ;; *irix*) + # IRIX has differently named shared libraries WINBIND_NSS_EXTRA_OBJS="nsswitch/winbind_nss_irix.o" - WINBIND_NSS="libns_winbind.$SHLIBEXT" + WINBIND_NSS="nsswitch/libns_winbind.$SHLIBEXT" + WINBIND_WINS_NSS="nsswitch/libns_wins.$SHLIBEXT" ;; *solaris*) # Solaris winbind client is implemented as a wrapper around @@ -3267,9 +3661,12 @@ case "$host_os" in WINBIND_NSS_EXTRA_OBJS="nsswitch/winbind_nss_solaris.o" ;; *aix*) + # AIX has even differently named shared libraries. No + # WINS support has been implemented yet. WINBIND_NSS_EXTRA_OBJS="nsswitch/winbind_nss_aix.o" WINBIND_NSS_LDSHFLAGS="-Wl,-bexpall,-bM:SRE,-ewb_aix_init" - WINBIND_NSS="WINBIND" + WINBIND_NSS="nsswitch/WINBIND" + WINBIND_WINS_NSS="" ;; *) HAVE_WINBIND=no @@ -3278,6 +3675,7 @@ case "$host_os" in esac AC_SUBST(WINBIND_NSS) +AC_SUBST(WINBIND_WINS_NSS) AC_SUBST(WINBIND_NSS_LDSHFLAGS) AC_SUBST(WINBIND_NSS_EXTRA_OBJS) AC_SUBST(WINBIND_NSS_EXTRA_LIBS) @@ -3316,7 +3714,7 @@ if test x"$HAVE_WINBIND" = x"yes"; then EXTRA_BIN_PROGS="$EXTRA_BIN_PROGS bin/wbinfo\$(EXEEXT)" EXTRA_SBIN_PROGS="$EXTRA_SBIN_PROGS bin/winbindd\$(EXEEXT)" if test x"$BLDSHARED" = x"true"; then - SHLIB_PROGS="$SHLIB_PROGS nsswitch/$WINBIND_NSS" + SHLIB_PROGS="$SHLIB_PROGS $WINBIND_NSS $WINBIND_WINS_NSS" if test x"$with_pam" = x"yes"; then SHLIB_PROGS="$SHLIB_PROGS nsswitch/pam_winbind.$SHLIBEXT" @@ -3327,31 +3725,15 @@ else fi # Solaris has some extra fields in struct passwd that need to be -# initialised otherwise nscd crashes. Unfortunately autoconf < 2.50 -# doesn't have the AC_CHECK_MEMBER macro which would be handy for checking -# this. - -#AC_CHECK_MEMBER(struct passwd.pw_comment, -# AC_DEFINE(HAVE_PASSWD_PW_COMMENT, 1, [Defined if struct passwd has pw_comment field]), -# [#include ]) - -AC_CACHE_CHECK([whether struct passwd has pw_comment],samba_cv_passwd_pw_comment, [ - AC_TRY_COMPILE([#include ],[struct passwd p; p.pw_comment;], - samba_cv_passwd_pw_comment=yes,samba_cv_passwd_pw_comment=no)]) -if test x"$samba_cv_passwd_pw_comment" = x"yes"; then - AC_DEFINE(HAVE_PASSWD_PW_COMMENT,1,[Whether struct passwd has pw_comment]) -fi - -#AC_CHECK_MEMBER(struct passwd.pw_age, -# AC_DEFINE(HAVE_PASSWD_PW_AGE, 1, [Defined if struct passwd has pw_age field]), -# [#include ]) +# initialised otherwise nscd crashes. + +AC_CHECK_MEMBER(struct passwd.pw_comment, + AC_DEFINE(HAVE_PASSWD_PW_COMMENT, 1, [Defined if struct passwd has pw_comment field]),, + [#include ]) -AC_CACHE_CHECK([whether struct passwd has pw_age],samba_cv_passwd_pw_age, [ - AC_TRY_COMPILE([#include ],[struct passwd p; p.pw_age;], - samba_cv_passwd_pw_age=yes,samba_cv_passwd_pw_age=no)]) -if test x"$samba_cv_passwd_pw_age" = x"yes"; then - AC_DEFINE(HAVE_PASSWD_PW_AGE,1,[Whether struct passwd has pw_age]) -fi +AC_CHECK_MEMBER(struct passwd.pw_age, + AC_DEFINE(HAVE_PASSWD_PW_AGE, 1, [Defined if struct passwd has pw_age field]),, + [#include ]) ################################################# # Check to see if we should use the included popt @@ -3435,6 +3817,7 @@ dnl Always built these modules static MODULE_pdb_guest=STATIC MODULE_rpc_spoolss=STATIC MODULE_rpc_srv=STATIC +MODULE_idmap_tdb=STATIC AC_ARG_WITH(static-modules, [ --with-static-modules=MODULES Comma-seperated list of names of modules to statically link in], @@ -3461,7 +3844,6 @@ SMB_MODULE(pdb_xml, passdb/pdb_xml.o, "bin/xml.$SHLIBEXT", PDB, [ PASSDBLIBS="$PASSDBLIBS $XML_LIBS" ] ) SMB_MODULE(pdb_mysql, passdb/pdb_mysql.o, "bin/mysql.$SHLIBEXT", PDB, [ PASSDBLIBS="$PASSDBLIBS $MYSQL_LIBS" ] ) -SMB_MODULE(pdb_nisplussam, passdb/pdb_nisplus.o, "bin/nisplussam.$SHLIBEXT", PDB) ## end of contributed pdb_modules ########################################################################### @@ -3484,7 +3866,11 @@ SMB_MODULE(rpc_samr, \$(RPC_SAMR_OBJ), "bin/librpc_samr.$SHLIBEXT", RPC) SMB_MODULE(rpc_echo, \$(RPC_ECHO_OBJ), "bin/librpc_echo.$SHLIBEXT", RPC) SMB_SUBSYSTEM(RPC) -SMB_MODULE(charset_weird, modules/developer.o, "bin/weird.$SHLIBEXT", CHARSET) +SMB_MODULE(idmap_ldap, sam/idmap_ldap.o, "bin/idmap_ldap.$SHLIBEXT", IDMAP) +SMB_MODULE(idmap_tdb, sam/idmap_tdb.o, "bin/idmap_tdb.$SHLIBEXT", IDMAP) +SMB_SUBSYSTEM(IDMAP) + +SMB_MODULE(charset_weird, modules/weird.o, "bin/weird.$SHLIBEXT", CHARSET) SMB_SUBSYSTEM(CHARSET) SMB_MODULE(auth_rhosts, \$(AUTH_RHOSTS_OBJ), "bin/rhosts.$SHLIBEXT", AUTH) @@ -3499,14 +3885,12 @@ SMB_SUBSYSTEM(AUTH) SMB_MODULE(vfs_recycle, \$(VFS_RECYCLE_OBJ), "bin/recycle.$SHLIBEXT", VFS) SMB_MODULE(vfs_audit, \$(VFS_AUDIT_OBJ), "bin/audit.$SHLIBEXT", VFS) SMB_MODULE(vfs_extd_audit, \$(VFS_EXTD_AUDIT_OBJ), "bin/extd_audit.$SHLIBEXT", VFS) -SMB_MODULE(vfs_fake_perms, \$(VFS_FAKE_PERMS_OBJ), "bin/fake_perms.$SHLIBEXT", VFS) SMB_MODULE(vfs_netatalk, \$(VFS_NETATALK_OBJ), "bin/netatalk.$SHLIBEXT", VFS) +SMB_MODULE(vfs_fake_perms, \$(VFS_FAKE_PERMS_OBJ), "bin/fake_perms.$SHLIBEXT", VFS) SMB_SUBSYSTEM(VFS) AC_DEFINE_UNQUOTED(STRING_STATIC_MODULES, "$string_static_modules", [String list of builtin modules]) -AC_SUBST(MODULES_CLEAN) - ################################################# # do extra things if we are running insure @@ -3514,6 +3898,18 @@ if test "${ac_cv_prog_CC}" = "insure"; then CPPFLAGS="$CPPFLAGS -D__INSURE__" fi +################################################# +# Display summary of libraries detected + +AC_MSG_RESULT([Using libraries:]) +AC_MSG_RESULT([ LIBS = $LIBS]) +if test x"$with_ads_support" = x"yes"; then + AC_MSG_RESULT([ KRB5_LIBS = $KRB5_LIBS]) +fi +if test x"$with_ldap_support" = x"yes"; then + AC_MSG_RESULT([ LDAP_LIBS = $LDAP_LIBS]) +fi + ################################################# # final configure stuff diff --git a/source3/groupdb/mapping.c b/source3/groupdb/mapping.c index 2b7a852688..3d2af5d0ba 100644 --- a/source3/groupdb/mapping.c +++ b/source3/groupdb/mapping.c @@ -37,69 +37,7 @@ PRIVS privs[] = { {SE_PRIV_PRINT_OPERATOR, "SaPrintOp", "Add or remove printers - Samba" }, {SE_PRIV_ALL, "SaAllPrivs", "all privileges" } }; -/* -PRIVS privs[] = { - { 2, "SeCreateTokenPrivilege" }, - { 3, "SeAssignPrimaryTokenPrivilege" }, - { 4, "SeLockMemoryPrivilege" }, - { 5, "SeIncreaseQuotaPrivilege" }, - { 6, "SeMachineAccountPrivilege" }, - { 7, "SeTcbPrivilege" }, - { 8, "SeSecurityPrivilege" }, - { 9, "SeTakeOwnershipPrivilege" }, - { 10, "SeLoadDriverPrivilege" }, - { 11, "SeSystemProfilePrivilege" }, - { 12, "SeSystemtimePrivilege" }, - { 13, "SeProfileSingleProcessPrivilege" }, - { 14, "SeIncreaseBasePriorityPrivilege" }, - { 15, "SeCreatePagefilePrivilege" }, - { 16, "SeCreatePermanentPrivilege" }, - { 17, "SeBackupPrivilege" }, - { 18, "SeRestorePrivilege" }, - { 19, "SeShutdownPrivilege" }, - { 20, "SeDebugPrivilege" }, - { 21, "SeAuditPrivilege" }, - { 22, "SeSystemEnvironmentPrivilege" }, - { 23, "SeChangeNotifyPrivilege" }, - { 24, "SeRemoteShutdownPrivilege" }, - { 25, "SeUndockPrivilege" }, - { 26, "SeSyncAgentPrivilege" }, - { 27, "SeEnableDelegationPrivilege" }, -}; -*/ - /* - * Those are not really privileges like the other ones. - * They are handled in a special case and called - * system privileges. - * - * SeNetworkLogonRight - * SeUnsolicitedInputPrivilege - * SeBatchLogonRight - * SeServiceLogonRight - * SeInteractiveLogonRight - * SeDenyInteractiveLogonRight - * SeDenyNetworkLogonRight - * SeDenyBatchLogonRight - * SeDenyBatchLogonRight - */ - -#if 0 -/**************************************************************************** -check if the user has the required privilege. -****************************************************************************/ -static BOOL se_priv_access_check(NT_USER_TOKEN *token, uint32 privilege) -{ - /* no token, no privilege */ - if (token==NULL) - return False; - - if ((token->privilege & privilege)==privilege) - return True; - - return False; -} -#endif /**************************************************************************** dump the mapping group mapping to a text file @@ -151,53 +89,35 @@ static BOOL default_group_mapping(void) fstring str_admins; fstring str_users; fstring str_guests; - LUID_ATTR set; - - PRIVILEGE_SET privilege_none; - PRIVILEGE_SET privilege_all; - PRIVILEGE_SET privilege_print_op; - - init_privilege(&privilege_none); - init_privilege(&privilege_all); - init_privilege(&privilege_print_op); - - set.attr=0; - set.luid.high=0; - set.luid.low=SE_PRIV_PRINT_OPERATOR; - add_privilege(&privilege_print_op, set); - - add_all_privilege(&privilege_all); /* Add the Wellknown groups */ - add_initial_entry(-1, "S-1-5-32-544", SID_NAME_WKN_GRP, "Administrators", "", privilege_all, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY); - add_initial_entry(-1, "S-1-5-32-545", SID_NAME_WKN_GRP, "Users", "", privilege_none, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY); - add_initial_entry(-1, "S-1-5-32-546", SID_NAME_WKN_GRP, "Guests", "", privilege_none, PR_ACCESS_FROM_NETWORK); - add_initial_entry(-1, "S-1-5-32-547", SID_NAME_WKN_GRP, "Power Users", "", privilege_none, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY); - - add_initial_entry(-1, "S-1-5-32-548", SID_NAME_WKN_GRP, "Account Operators", "", privilege_none, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY); - add_initial_entry(-1, "S-1-5-32-549", SID_NAME_WKN_GRP, "System Operators", "", privilege_none, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY); - add_initial_entry(-1, "S-1-5-32-550", SID_NAME_WKN_GRP, "Print Operators", "", privilege_print_op, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY); - add_initial_entry(-1, "S-1-5-32-551", SID_NAME_WKN_GRP, "Backup Operators", "", privilege_none, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY); - - add_initial_entry(-1, "S-1-5-32-552", SID_NAME_WKN_GRP, "Replicators", "", privilege_none, PR_ACCESS_FROM_NETWORK); + add_initial_entry(-1, "S-1-5-32-544", SID_NAME_WKN_GRP, "Administrators", ""); + add_initial_entry(-1, "S-1-5-32-545", SID_NAME_WKN_GRP, "Users", ""); + add_initial_entry(-1, "S-1-5-32-546", SID_NAME_WKN_GRP, "Guests", ""); + add_initial_entry(-1, "S-1-5-32-547", SID_NAME_WKN_GRP, "Power Users", ""); + add_initial_entry(-1, "S-1-5-32-548", SID_NAME_WKN_GRP, "Account Operators", ""); + add_initial_entry(-1, "S-1-5-32-549", SID_NAME_WKN_GRP, "System Operators", ""); + add_initial_entry(-1, "S-1-5-32-550", SID_NAME_WKN_GRP, "Print Operators", ""); + add_initial_entry(-1, "S-1-5-32-551", SID_NAME_WKN_GRP, "Backup Operators", ""); + add_initial_entry(-1, "S-1-5-32-552", SID_NAME_WKN_GRP, "Replicators", ""); /* Add the defaults domain groups */ sid_copy(&sid_admins, get_global_sam_sid()); sid_append_rid(&sid_admins, DOMAIN_GROUP_RID_ADMINS); sid_to_string(str_admins, &sid_admins); - add_initial_entry(-1, str_admins, SID_NAME_DOM_GRP, "Domain Admins", "", privilege_all, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY); + add_initial_entry(-1, str_admins, SID_NAME_DOM_GRP, "Domain Admins", ""); sid_copy(&sid_users, get_global_sam_sid()); sid_append_rid(&sid_users, DOMAIN_GROUP_RID_USERS); sid_to_string(str_users, &sid_users); - add_initial_entry(-1, str_users, SID_NAME_DOM_GRP, "Domain Users", "", privilege_none, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY); + add_initial_entry(-1, str_users, SID_NAME_DOM_GRP, "Domain Users", ""); sid_copy(&sid_guests, get_global_sam_sid()); sid_append_rid(&sid_guests, DOMAIN_GROUP_RID_GUESTS); sid_to_string(str_guests, &sid_guests); - add_initial_entry(-1, str_guests, SID_NAME_DOM_GRP, "Domain Guests", "", privilege_none, PR_ACCESS_FROM_NETWORK); + add_initial_entry(-1, str_guests, SID_NAME_DOM_GRP, "Domain Guests", ""); return True; } @@ -255,8 +175,6 @@ static BOOL add_mapping_entry(GROUP_MAP *map, int flag) pstring key, buf; fstring string_sid=""; int len; - int i; - PRIVILEGE_SET *set; if(!init_group_mapping()) { DEBUG(0,("failed to initialize group mapping")); @@ -265,16 +183,8 @@ static BOOL add_mapping_entry(GROUP_MAP *map, int flag) sid_to_string(string_sid, &map->sid); - len = tdb_pack(buf, sizeof(buf), "ddffd", - map->gid, map->sid_name_use, map->nt_name, map->comment, map->systemaccount); - - /* write the privilege list in the TDB database */ - - set=&map->priv_set; - len += tdb_pack(buf+len, sizeof(buf)-len, "d", set->count); - for (i=0; icount; i++) - len += tdb_pack(buf+len, sizeof(buf)-len, "ddd", - set->set[i].luid.low, set->set[i].luid.high, set->set[i].attr); + len = tdb_pack(buf, sizeof(buf), "ddff", + map->gid, map->sid_name_use, map->nt_name, map->comment); if (len > sizeof(buf)) return False; @@ -293,8 +203,7 @@ static BOOL add_mapping_entry(GROUP_MAP *map, int flag) /**************************************************************************** initialise first time the mapping list ****************************************************************************/ -BOOL add_initial_entry(gid_t gid, const char *sid, enum SID_NAME_USE sid_name_use, - const char *nt_name, const char *comment, PRIVILEGE_SET priv_set, uint32 systemaccount) +BOOL add_initial_entry(gid_t gid, const char *sid, enum SID_NAME_USE sid_name_use, const char *nt_name, const char *comment) { GROUP_MAP map; @@ -312,207 +221,20 @@ BOOL add_initial_entry(gid_t gid, const char *sid, enum SID_NAME_USE sid_name_us map.sid_name_use=sid_name_use; fstrcpy(map.nt_name, nt_name); fstrcpy(map.comment, comment); - map.systemaccount=systemaccount; - - map.priv_set.count=priv_set.count; - map.priv_set.set=priv_set.set; - - pdb_add_group_mapping_entry(&map); - - return True; -} - -/**************************************************************************** -initialise a privilege list -****************************************************************************/ -void init_privilege(PRIVILEGE_SET *priv_set) -{ - priv_set->count=0; - priv_set->control=0; - priv_set->set=NULL; -} - -/**************************************************************************** -free a privilege list -****************************************************************************/ -BOOL free_privilege(PRIVILEGE_SET *priv_set) -{ - if (priv_set->count==0) { - DEBUG(100,("free_privilege: count=0, nothing to clear ?\n")); - return False; - } - - if (priv_set->set==NULL) { - DEBUG(0,("free_privilege: list ptr is NULL, very strange !\n")); - return False; - } - - safe_free(priv_set->set); - priv_set->count=0; - priv_set->control=0; - priv_set->set=NULL; - - return True; -} - -/**************************************************************************** -add a privilege to a privilege array -****************************************************************************/ -BOOL add_privilege(PRIVILEGE_SET *priv_set, LUID_ATTR set) -{ - LUID_ATTR *new_set; - - /* check if the privilege is not already in the list */ - if (check_priv_in_privilege(priv_set, set)) - return False; - - /* we can allocate memory to add the new privilege */ - - new_set=(LUID_ATTR *)Realloc(priv_set->set, (priv_set->count+1)*(sizeof(LUID_ATTR))); - if (new_set==NULL) { - DEBUG(0,("add_privilege: could not Realloc memory to add a new privilege\n")); - return False; - } - - new_set[priv_set->count].luid.high=set.luid.high; - new_set[priv_set->count].luid.low=set.luid.low; - new_set[priv_set->count].attr=set.attr; - - priv_set->count++; - priv_set->set=new_set; - - return True; -} - -/**************************************************************************** -add all the privileges to a privilege array -****************************************************************************/ -BOOL add_all_privilege(PRIVILEGE_SET *priv_set) -{ - LUID_ATTR set; - - set.attr=0; - set.luid.high=0; - - set.luid.low=SE_PRIV_ADD_USERS; - add_privilege(priv_set, set); - - set.luid.low=SE_PRIV_ADD_MACHINES; - add_privilege(priv_set, set); - - set.luid.low=SE_PRIV_PRINT_OPERATOR; - add_privilege(priv_set, set); - - return True; -} - -/**************************************************************************** -check if the privilege list is empty -****************************************************************************/ -BOOL check_empty_privilege(PRIVILEGE_SET *priv_set) -{ - return (priv_set->count == 0); -} - -/**************************************************************************** -check if the privilege is in the privilege list -****************************************************************************/ -BOOL check_priv_in_privilege(PRIVILEGE_SET *priv_set, LUID_ATTR set) -{ - int i; - - /* if the list is empty, obviously we can't have it */ - if (check_empty_privilege(priv_set)) - return False; - - for (i=0; icount; i++) { - LUID_ATTR *cur_set; - - cur_set=&priv_set->set[i]; - /* check only the low and high part. Checking the attr field has no meaning */ - if( (cur_set->luid.low==set.luid.low) && (cur_set->luid.high==set.luid.high) ) - return True; - } - - return False; -} - -/**************************************************************************** -remove a privilege from a privilege array -****************************************************************************/ -BOOL remove_privilege(PRIVILEGE_SET *priv_set, LUID_ATTR set) -{ - LUID_ATTR *new_set; - LUID_ATTR *old_set; - int i,j; - - /* check if the privilege is in the list */ - if (!check_priv_in_privilege(priv_set, set)) - return False; - - /* special case if it's the only privilege in the list */ - if (priv_set->count==1) { - free_privilege(priv_set); - init_privilege(priv_set); - - return True; - } - - /* - * the privilege is there, create a new list, - * and copy the other privileges - */ - - old_set=priv_set->set; - - new_set=(LUID_ATTR *)malloc((priv_set->count-1)*(sizeof(LUID_ATTR))); - if (new_set==NULL) { - DEBUG(0,("remove_privilege: could not malloc memory for new privilege list\n")); - return False; - } - - for (i=0, j=0; icount; i++) { - if ((old_set[i].luid.low==set.luid.low) && - (old_set[i].luid.high==set.luid.high)) { - continue; - } - - new_set[j].luid.low=old_set[i].luid.low; - new_set[j].luid.high=old_set[i].luid.high; - new_set[j].attr=old_set[i].attr; - j++; - } - - if (j!=priv_set->count-1) { - DEBUG(0,("remove_privilege: mismatch ! difference is not -1\n")); - DEBUGADD(0,("old count:%d, new count:%d\n", priv_set->count, j)); - safe_free(new_set); - return False; - } - - /* ok everything is fine */ - - priv_set->count--; - priv_set->set=new_set; - - safe_free(old_set); - - return True; + return pdb_add_group_mapping_entry(&map); } /**************************************************************************** Return the sid and the type of the unix group. ****************************************************************************/ -static BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) +static BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map) { TDB_DATA kbuf, dbuf; pstring key; fstring string_sid; int ret; - int i; - PRIVILEGE_SET *set; if(!init_group_mapping()) { DEBUG(0,("failed to initialize group mapping")); @@ -531,34 +253,10 @@ static BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) if (!dbuf.dptr) return False; - ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddffd", - &map->gid, &map->sid_name_use, &map->nt_name, &map->comment, &map->systemaccount); - - set=&map->priv_set; - init_privilege(set); - ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "d", &set->count); - - DEBUG(10,("get_group_map_from_sid: %d privileges\n", map->priv_set.count)); - - set->set = NULL; - if (set->count) { - set->set=(LUID_ATTR *)smb_xmalloc(set->count*sizeof(LUID_ATTR)); - } - - for (i=0; icount; i++) - ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "ddd", - &(set->set[i].luid.low), &(set->set[i].luid.high), &(set->set[i].attr)); + ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff", + &map->gid, &map->sid_name_use, &map->nt_name, &map->comment); SAFE_FREE(dbuf.dptr); - if (ret != dbuf.dsize) { - DEBUG(0,("get_group_map_from_sid: group mapping TDB corrupted ?\n")); - free_privilege(set); - return False; - } - - /* we don't want the privileges */ - if (with_priv==MAPPING_WITHOUT_PRIV) - free_privilege(set); sid_copy(&map->sid, &sid); @@ -569,13 +267,11 @@ static BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) Return the sid and the type of the unix group. ****************************************************************************/ -static BOOL get_group_map_from_gid(gid_t gid, GROUP_MAP *map, BOOL with_priv) +static BOOL get_group_map_from_gid(gid_t gid, GROUP_MAP *map) { TDB_DATA kbuf, dbuf, newkey; fstring string_sid; int ret; - int i; - PRIVILEGE_SET *set; if(!init_group_mapping()) { DEBUG(0,("failed to initialize group mapping")); @@ -598,33 +294,15 @@ static BOOL get_group_map_from_gid(gid_t gid, GROUP_MAP *map, BOOL with_priv) string_to_sid(&map->sid, string_sid); - ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddffd", - &map->gid, &map->sid_name_use, &map->nt_name, &map->comment, &map->systemaccount); - - set=&map->priv_set; - ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "d", &set->count); - set->set = NULL; - if (set->count) { - set->set=(LUID_ATTR *)smb_xmalloc(set->count*sizeof(LUID_ATTR)); - } - - for (i=0; icount; i++) - ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "ddd", - &(set->set[i].luid.low), &(set->set[i].luid.high), &(set->set[i].attr)); + ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff", + &map->gid, &map->sid_name_use, &map->nt_name, &map->comment); SAFE_FREE(dbuf.dptr); - if (ret != dbuf.dsize){ - free_privilege(set); - continue; - } if (gid==map->gid) { - if (!with_priv) - free_privilege(&map->priv_set); + SAFE_FREE(kbuf.dptr); return True; } - - free_privilege(set); } return False; @@ -634,13 +312,11 @@ static BOOL get_group_map_from_gid(gid_t gid, GROUP_MAP *map, BOOL with_priv) Return the sid and the type of the unix group. ****************************************************************************/ -static BOOL get_group_map_from_ntname(char *name, GROUP_MAP *map, BOOL with_priv) +static BOOL get_group_map_from_ntname(const char *name, GROUP_MAP *map) { TDB_DATA kbuf, dbuf, newkey; fstring string_sid; int ret; - int i; - PRIVILEGE_SET *set; if(!init_group_mapping()) { DEBUG(0,("get_group_map_from_ntname:failed to initialize group mapping")); @@ -663,35 +339,15 @@ static BOOL get_group_map_from_ntname(char *name, GROUP_MAP *map, BOOL with_priv string_to_sid(&map->sid, string_sid); - ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddffd", - &map->gid, &map->sid_name_use, &map->nt_name, &map->comment, &map->systemaccount); - - set=&map->priv_set; - ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "d", &set->count); - - set->set=(LUID_ATTR *)malloc(set->count*sizeof(LUID_ATTR)); - if (set->set==NULL) { - DEBUG(0,("get_group_map_from_ntname: could not allocate memory for privileges\n")); - return False; - } - - for (i=0; icount; i++) - ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "ddd", - &(set->set[i].luid.low), &(set->set[i].luid.high), &(set->set[i].attr)); + ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff", + &map->gid, &map->sid_name_use, &map->nt_name, &map->comment); SAFE_FREE(dbuf.dptr); - if (ret != dbuf.dsize) { - free_privilege(set); - continue; - } if (StrCaseCmp(name, map->nt_name)==0) { - if (!with_priv) - free_privilege(&map->priv_set); + SAFE_FREE(kbuf.dptr); return True; } - - free_privilege(set); } return False; @@ -737,7 +393,7 @@ static BOOL group_map_remove(DOM_SID sid) ****************************************************************************/ static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, - int *num_entries, BOOL unix_only, BOOL with_priv) + int *num_entries, BOOL unix_only) { TDB_DATA kbuf, dbuf, newkey; fstring string_sid; @@ -746,8 +402,6 @@ static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, GROUP_MAP *mapt; int ret; int entries=0; - int i; - PRIVILEGE_SET *set; if(!init_group_mapping()) { DEBUG(0,("failed to initialize group mapping")); @@ -770,43 +424,19 @@ static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, fstrcpy(string_sid, kbuf.dptr+strlen(GROUP_PREFIX)); - ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddffd", - &map.gid, &map.sid_name_use, &map.nt_name, &map.comment, &map.systemaccount); - - set=&map.priv_set; - init_privilege(set); - - ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "d", &set->count); - - if (set->count!=0) { - set->set=(LUID_ATTR *)malloc(set->count*sizeof(LUID_ATTR)); - if (set->set==NULL) { - DEBUG(0,("enum_group_mapping: could not allocate memory for privileges\n")); - return False; - } - } - - for (i=0; icount; i++) - ret += tdb_unpack(dbuf.dptr+ret, dbuf.dsize-ret, "ddd", - &(set->set[i].luid.low), &(set->set[i].luid.high), &(set->set[i].attr)); + ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff", + &map.gid, &map.sid_name_use, &map.nt_name, &map.comment); SAFE_FREE(dbuf.dptr); - if (ret != dbuf.dsize) { - DEBUG(11,("enum_group_mapping: error in memory size\n")); - free_privilege(set); - continue; - } /* list only the type or everything if UNKNOWN */ if (sid_name_use!=SID_NAME_UNKNOWN && sid_name_use!=map.sid_name_use) { DEBUG(11,("enum_group_mapping: group %s is not of the requested type\n", map.nt_name)); - free_privilege(set); continue; } if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) { DEBUG(11,("enum_group_mapping: group %s is non mapped\n", map.nt_name)); - free_privilege(set); continue; } @@ -819,7 +449,6 @@ static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, if (!mapt) { DEBUG(0,("enum_group_mapping: Unable to enlarge group map!\n")); SAFE_FREE(*rmap); - free_privilege(set); return False; } else @@ -830,12 +459,6 @@ static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, mapt[entries].sid_name_use = map.sid_name_use; fstrcpy(mapt[entries].nt_name, map.nt_name); fstrcpy(mapt[entries].comment, map.comment); - mapt[entries].systemaccount=map.systemaccount; - mapt[entries].priv_set.count=set->count; - mapt[entries].priv_set.control=set->control; - mapt[entries].priv_set.set=set->set; - if (!with_priv) - free_privilege(&(mapt[entries].priv_set)); entries++; @@ -846,64 +469,6 @@ static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, return True; } - -/**************************************************************************** -convert a privilege string to a privilege array -****************************************************************************/ -void convert_priv_from_text(PRIVILEGE_SET *se_priv, char *privilege) -{ - pstring tok; - const char *p = privilege; - int i; - LUID_ATTR set; - - /* By default no privilege */ - init_privilege(se_priv); - - if (privilege==NULL) - return; - - while(next_token(&p, tok, " ", sizeof(tok)) ) { - for (i=0; i<=PRIV_ALL_INDEX; i++) { - if (StrCaseCmp(privs[i].priv, tok)==0) { - set.attr=0; - set.luid.high=0; - set.luid.low=privs[i].se_priv; - add_privilege(se_priv, set); - } - } - } -} - -/**************************************************************************** -convert a privilege array to a privilege string -****************************************************************************/ -void convert_priv_to_text(PRIVILEGE_SET *se_priv, char *privilege) -{ - int i,j; - - if (privilege==NULL) - return; - - ZERO_STRUCTP(privilege); - - if (check_empty_privilege(se_priv)) { - fstrcat(privilege, "No privilege"); - return; - } - - for(i=0; icount; i++) { - j=1; - while (privs[j].se_priv!=se_priv->set[i].luid.low && j<=PRIV_ALL_INDEX) { - j++; - } - - fstrcat(privilege, privs[j].priv); - fstrcat(privilege, " "); - } -} - - /* * * High level functions @@ -916,7 +481,7 @@ void convert_priv_to_text(PRIVILEGE_SET *se_priv, char *privilege) /* get a domain group from it's SID */ -BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) +BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map) { struct group *grp; @@ -928,23 +493,19 @@ BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) DEBUG(10, ("get_domain_group_from_sid\n")); /* if the group is NOT in the database, it CAN NOT be a domain group */ - if(!pdb_getgrsid(map, sid, with_priv)) + if(!pdb_getgrsid(map, sid)) return False; DEBUG(10, ("get_domain_group_from_sid: SID found in the TDB\n")); /* if it's not a domain group, continue */ if (map->sid_name_use!=SID_NAME_DOM_GRP) { - if (with_priv) - free_privilege(&map->priv_set); return False; } DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n")); if (map->gid==-1) { - if (with_priv) - free_privilege(&map->priv_set); return False; } @@ -952,8 +513,6 @@ BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) if ( (grp=getgrgid(map->gid)) == NULL) { DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n")); - if (with_priv) - free_privilege(&map->priv_set); return False; } @@ -965,7 +524,7 @@ BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) /* get a local (alias) group from it's SID */ -BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) +BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map) { struct group *grp; @@ -975,22 +534,16 @@ BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) } /* The group is in the mapping table */ - if(pdb_getgrsid(map, sid, with_priv)) { + if(pdb_getgrsid(map, sid)) { if (map->sid_name_use!=SID_NAME_ALIAS) { - if (with_priv) - free_privilege(&map->priv_set); return False; } if (map->gid==-1) { - if (with_priv) - free_privilege(&map->priv_set); return False; } if ( (grp=getgrgid(map->gid)) == NULL) { - if (with_priv) - free_privilege(&map->priv_set); return False; } } else { @@ -1005,13 +558,10 @@ BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) return False; map->sid_name_use=SID_NAME_ALIAS; - map->systemaccount=PR_ACCESS_FROM_NETWORK; fstrcpy(map->nt_name, grp->gr_name); fstrcpy(map->comment, "Local Unix Group"); - init_privilege(&map->priv_set); - sid_copy(&map->sid, &sid); } @@ -1020,7 +570,7 @@ BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) /* get a builtin group from it's SID */ -BOOL get_builtin_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) +BOOL get_builtin_group_from_sid(DOM_SID sid, GROUP_MAP *map) { struct group *grp; @@ -1029,24 +579,18 @@ BOOL get_builtin_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) return(False); } - if(!pdb_getgrsid(map, sid, with_priv)) + if(!pdb_getgrsid(map, sid)) return False; if (map->sid_name_use!=SID_NAME_WKN_GRP) { - if (with_priv) - free_privilege(&map->priv_set); return False; } if (map->gid==-1) { - if (with_priv) - free_privilege(&map->priv_set); return False; } if ( (grp=getgrgid(map->gid)) == NULL) { - if (with_priv) - free_privilege(&map->priv_set); return False; } @@ -1058,7 +602,7 @@ BOOL get_builtin_group_from_sid(DOM_SID sid, GROUP_MAP *map, BOOL with_priv) /**************************************************************************** Returns a GROUP_MAP struct based on the gid. ****************************************************************************/ -BOOL get_group_from_gid(gid_t gid, GROUP_MAP *map, BOOL with_priv) +BOOL get_group_from_gid(gid_t gid, GROUP_MAP *map) { struct group *grp; @@ -1073,11 +617,9 @@ BOOL get_group_from_gid(gid_t gid, GROUP_MAP *map, BOOL with_priv) /* * make a group map from scratch if doesn't exist. */ - if (!pdb_getgrgid(map, gid, with_priv)) { + if (!pdb_getgrgid(map, gid)) { map->gid=gid; map->sid_name_use=SID_NAME_ALIAS; - map->systemaccount=PR_ACCESS_FROM_NETWORK; - init_privilege(&map->priv_set); /* interim solution until we have a last RID allocated */ @@ -1139,8 +681,8 @@ BOOL get_uid_list_of_group(gid_t gid, uid_t **uid, int *num_uids) if( (pwd=getpwnam_alloc(gr)) !=NULL) { (*uid)[*num_uids]=pwd->pw_uid; (*num_uids)++; + passwd_free(&pwd); } - passwd_free(&pwd); gr = grp->gr_mem[++i]; } DEBUG(10, ("got [%d] members\n", *num_uids)); @@ -1172,40 +714,49 @@ BOOL get_uid_list_of_group(gid_t gid, uid_t **uid, int *num_uids) int smb_create_group(char *unix_group, gid_t *new_gid) { pstring add_script; - int ret; - int fd = 0; - - pstrcpy(add_script, lp_addgroup_script()); - if (! *add_script) return -1; - pstring_sub(add_script, "%g", unix_group); - ret = smbrun(add_script, (new_gid!=NULL) ? &fd : NULL); - DEBUG(3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret)); - if (ret != 0) - return ret; - - if (fd != 0) { - fstring output; + int ret = -1; + int fd = 0; + + *new_gid = 0; - *new_gid = 0; - if (read(fd, output, sizeof(output)) > 0) { - *new_gid = (gid_t)strtoul(output, NULL, 10); - } - close(fd); - - if (*new_gid == 0) { - /* The output was garbage. We assume nobody - will create group 0 via smbd. Now we try to - get the group via getgrnam. */ - - struct group *grp = getgrnam(unix_group); - if (grp != NULL) - *new_gid = grp->gr_gid; - else - return 1; + /* defer to scripts */ + + if ( *lp_addgroup_script() ) { + pstrcpy(add_script, lp_addgroup_script()); + pstring_sub(add_script, "%g", unix_group); + ret = smbrun(add_script, (new_gid!=NULL) ? &fd : NULL); + DEBUG(3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret)); + if (ret != 0) + return ret; + + if (fd != 0) { + fstring output; + + *new_gid = 0; + if (read(fd, output, sizeof(output)) > 0) { + *new_gid = (gid_t)strtoul(output, NULL, 10); + } + + close(fd); } } - return ret; + /* Try winbindd */ + + if ( winbind_create_group( unix_group, NULL ) ) { + DEBUG(3,("smb_create_group: winbindd created the group (%s)\n", + unix_group)); + ret = 0; + } + + if (*new_gid == 0) { + struct group *grp = getgrnam(unix_group); + + if (grp != NULL) + *new_gid = grp->gr_gid; + } + + return ret; } /**************************************************************************** @@ -1217,12 +768,23 @@ int smb_delete_group(char *unix_group) pstring del_script; int ret; - pstrcpy(del_script, lp_delgroup_script()); - if (! *del_script) return -1; - pstring_sub(del_script, "%g", unix_group); - ret = smbrun(del_script,NULL); - DEBUG(3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret)); - return ret; + /* defer to scripts */ + + if ( *lp_delgroup_script() ) { + pstrcpy(del_script, lp_delgroup_script()); + pstring_sub(del_script, "%g", unix_group); + ret = smbrun(del_script,NULL); + DEBUG(3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret)); + return ret; + } + + if ( winbind_delete_group( unix_group ) ) { + DEBUG(3,("smb_delete_group: winbindd deleted the group (%s)\n", + unix_group)); + return 0; + } + + return -1; } /**************************************************************************** @@ -1233,14 +795,27 @@ int smb_set_primary_group(const char *unix_group, const char* unix_user) pstring add_script; int ret; - pstrcpy(add_script, lp_setprimarygroup_script()); - if (! *add_script) return -1; - all_string_sub(add_script, "%g", unix_group, sizeof(add_script)); - all_string_sub(add_script, "%u", unix_user, sizeof(add_script)); - ret = smbrun(add_script,NULL); - DEBUG(3,("smb_set_primary_group: " - "Running the command `%s' gave %d\n",add_script,ret)); - return ret; + /* defer to scripts */ + + if ( *lp_setprimarygroup_script() ) { + pstrcpy(add_script, lp_setprimarygroup_script()); + all_string_sub(add_script, "%g", unix_group, sizeof(add_script)); + all_string_sub(add_script, "%u", unix_user, sizeof(add_script)); + ret = smbrun(add_script,NULL); + DEBUG(3,("smb_set_primary_group: " + "Running the command `%s' gave %d\n",add_script,ret)); + return ret; + } + + /* Try winbindd */ + + if ( winbind_set_user_primary_group( unix_user, unix_group ) ) { + DEBUG(3,("smb_delete_group: winbindd set the group (%s) as the primary group for user (%s)\n", + unix_group, unix_user)); + return 0; + } + + return -1; } /**************************************************************************** @@ -1252,13 +827,26 @@ int smb_add_user_group(char *unix_group, char *unix_user) pstring add_script; int ret; - pstrcpy(add_script, lp_addusertogroup_script()); - if (! *add_script) return -1; - pstring_sub(add_script, "%g", unix_group); - pstring_sub(add_script, "%u", unix_user); - ret = smbrun(add_script,NULL); - DEBUG(3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret)); - return ret; + /* defer to scripts */ + + if ( *lp_addusertogroup_script() ) { + pstrcpy(add_script, lp_addusertogroup_script()); + pstring_sub(add_script, "%g", unix_group); + pstring_sub(add_script, "%u", unix_user); + ret = smbrun(add_script,NULL); + DEBUG(3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret)); + return ret; + } + + /* Try winbindd */ + + if ( winbind_add_user_to_group( unix_user, unix_group ) ) { + DEBUG(3,("smb_delete_group: winbindd added user (%s) to the group (%s)\n", + unix_user, unix_group)); + return -1; + } + + return -1; } /**************************************************************************** @@ -1270,34 +858,47 @@ int smb_delete_user_group(const char *unix_group, const char *unix_user) pstring del_script; int ret; - pstrcpy(del_script, lp_deluserfromgroup_script()); - if (! *del_script) return -1; - pstring_sub(del_script, "%g", unix_group); - pstring_sub(del_script, "%u", unix_user); - ret = smbrun(del_script,NULL); - DEBUG(3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret)); - return ret; + /* defer to scripts */ + + if ( *lp_deluserfromgroup_script() ) { + pstrcpy(del_script, lp_deluserfromgroup_script()); + pstring_sub(del_script, "%g", unix_group); + pstring_sub(del_script, "%u", unix_user); + ret = smbrun(del_script,NULL); + DEBUG(3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret)); + return ret; + } + + /* Try winbindd */ + + if ( winbind_remove_user_from_group( unix_user, unix_group ) ) { + DEBUG(3,("smb_delete_group: winbindd removed user (%s) from the group (%s)\n", + unix_user, unix_group)); + return 0; + } + + return -1; } NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map, - DOM_SID sid, BOOL with_priv) + DOM_SID sid) { - return get_group_map_from_sid(sid, map, with_priv) ? + return get_group_map_from_sid(sid, map) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL; } NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map, - gid_t gid, BOOL with_priv) + gid_t gid) { - return get_group_map_from_gid(gid, map, with_priv) ? + return get_group_map_from_gid(gid, map) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL; } NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map, - char *name, BOOL with_priv) + const char *name) { - return get_group_map_from_ntname(name, map, with_priv) ? + return get_group_map_from_ntname(name, map) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL; } @@ -1325,10 +926,9 @@ NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods, NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods, enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, int *num_entries, - BOOL unix_only, BOOL with_priv) + BOOL unix_only) { - return enum_group_mapping(sid_name_use, rmap, num_entries, unix_only, - with_priv) ? + return enum_group_mapping(sid_name_use, rmap, num_entries, unix_only) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL; } @@ -1337,19 +937,19 @@ NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods, *********************************************************************/ NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map, - DOM_SID sid, BOOL with_priv) + DOM_SID sid) { return NT_STATUS_UNSUCCESSFUL; } NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map, - gid_t gid, BOOL with_priv) + gid_t gid) { return NT_STATUS_UNSUCCESSFUL; } NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map, - char *name, BOOL with_priv) + const char *name) { return NT_STATUS_UNSUCCESSFUL; } @@ -1375,7 +975,7 @@ NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods, NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods, enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, int *num_entries, - BOOL unix_only, BOOL with_priv) + BOOL unix_only) { return NT_STATUS_UNSUCCESSFUL; } diff --git a/source3/include/.cvsignore b/source3/include/.cvsignore index 4bff170b3b..bff248727f 100644 --- a/source3/include/.cvsignore +++ b/source3/include/.cvsignore @@ -3,5 +3,4 @@ config.h stamp-h proto.h wrepld_proto.h -tdbsam2_parse_info.h config.h.in diff --git a/source3/include/ads.h b/source3/include/ads.h index 7f7568d8b0..0961c9581c 100644 --- a/source3/include/ads.h +++ b/source3/include/ads.h @@ -205,6 +205,7 @@ typedef void **ADS_MODLIST; #define ADS_AUTH_NO_BIND 0x02 #define ADS_AUTH_ANON_BIND 0x04 #define ADS_AUTH_SIMPLE_BIND 0x08 +#define ADS_AUTH_ALLOW_NTLMSSP 0x10 /* Kerberos environment variable names */ #define KRB5_ENV_CCNAME "KRB5CCNAME" diff --git a/source3/include/auth.h b/source3/include/auth.h index eb80e3c5b4..6b42418be8 100644 --- a/source3/include/auth.h +++ b/source3/include/auth.h @@ -96,6 +96,8 @@ typedef struct auth_serversupplied_info SAM_ACCOUNT *sam_account; void *pam_handle; + + char *unix_name; } auth_serversupplied_info; diff --git a/source3/include/client.h b/source3/include/client.h index d75effd7d0..fad2c099b9 100644 --- a/source3/include/client.h +++ b/source3/include/client.h @@ -66,7 +66,7 @@ typedef struct smb_sign_info { BOOL negotiated_smb_signing; BOOL allow_smb_signing; BOOL doing_signing; - BOOL mandetory_signing; + BOOL mandatory_signing; } smb_sign_info; struct cli_state { @@ -131,25 +131,30 @@ struct cli_state { * Only used in NT domain calls. */ + int pipe_idx; /* Index (into list of known pipes) + of the pipe we're talking to, + if any */ + uint16 nt_pipe_fnum; /* Pipe handle. */ + /* Secure pipe parameters */ + int pipe_auth_flags; + uint16 saved_netlogon_pipe_fnum; /* The "first" pipe to get the session key for the schannel. */ struct netsec_auth_struct auth_info; + NTLMSSP_CLIENT_STATE *ntlmssp_pipe_state; + unsigned char sess_key[16]; /* Current session key. */ - unsigned char ntlmssp_hash[258]; /* ntlmssp data. */ - uint32 ntlmssp_cli_flgs; /* ntlmssp client flags */ - uint32 ntlmssp_srv_flgs; /* ntlmssp server flags */ - uint32 ntlmssp_seq_num; /* ntlmssp sequence number */ DOM_CRED clnt_cred; /* Client credential. */ fstring mach_acct; /* MYNAME$. */ fstring srv_name_slash; /* \\remote server. */ fstring clnt_name_slash; /* \\local client. */ uint16 max_xmit_frag; uint16 max_recv_frag; - uint32 ntlmssp_flags; + BOOL use_kerberos; BOOL use_spnego; diff --git a/source3/include/idmap.h b/source3/include/idmap.h index 1e56519453..ae7e4e5101 100644 --- a/source3/include/idmap.h +++ b/source3/include/idmap.h @@ -1,3 +1,5 @@ +#ifndef _IDMAP_H_ +#define _IDMAP_H_ /* Unix SMB/CIFS implementation. @@ -22,6 +24,9 @@ Boston, MA 02111-1307, USA. */ +#define SMB_IDMAP_INTERFACE_VERSION 2 + + #define ID_EMPTY 0x00 #define ID_USERID 0x01 #define ID_GROUPID 0x02 @@ -29,20 +34,16 @@ #define ID_TYPEMASK 0x0f -#define ID_NOMAP 0x10 -#define ID_CACHE 0x20 - -typedef union unid_t { - uid_t uid; - gid_t gid; -} unid_t; +#define ID_QUERY_ONLY 0x10 /* Filled out by IDMAP backends */ struct idmap_methods { /* Called when backend is first loaded */ - NTSTATUS (*init)(void); + NTSTATUS (*init)( char *params ); + NTSTATUS (*allocate_rid)(uint32 *rid, int rid_type); + NTSTATUS (*allocate_id)(unid_t *id, int id_type); NTSTATUS (*get_sid_from_id)(DOM_SID *sid, unid_t id, int id_type); NTSTATUS (*get_id_from_sid)(unid_t *id, int *id_type, const DOM_SID *sid); NTSTATUS (*set_mapping)(const DOM_SID *sid, unid_t id, int id_type); @@ -53,4 +54,4 @@ struct idmap_methods { /* Called to dump backend status */ void (*status)(void); }; - +#endif /* _IDMAP_H_ */ diff --git a/source3/include/includes.h b/source3/include/includes.h index 534bbfbf26..edaeda3abe 100644 --- a/source3/include/includes.h +++ b/source3/include/includes.h @@ -437,6 +437,18 @@ #include #endif +#if HAVE_ATTR_XATTR_H +#include +#endif + +#if HAVE_LOCALE_H +#include +#endif + +#if HAVE_LANGINFO_H +#include +#endif + /* Special macros that are no-ops except when run under Valgrind on * x86. They've moved a little bit from valgrind 1.0.4 to 1.9.4 */ #if HAVE_VALGRIND_MEMCHECK_H @@ -769,9 +781,6 @@ extern int errno; #include "version.h" #include "smb.h" -/* -#include "smbw.h" -*/ #include "nameserv.h" @@ -808,14 +817,12 @@ extern int errno; #include "auth.h" -#include "sam.h" - -#include "gums.h" - #include "idmap.h" #include "client.h" + #include "smbw.h" + #include "session.h" #include "asn_1.h" @@ -828,8 +835,6 @@ extern int errno; #include "nsswitch/winbind_client.h" -#include "genparser.h" - /* * Type for wide character dirent structure. * Only d_name is defined by POSIX. @@ -876,6 +881,10 @@ struct printjob; struct smb_ldap_privates; +/* forward declarations from smbldap.c */ + +#include "smbldap.h" + /***** automatically generated prototypes *****/ #ifndef NO_PROTO_H #include "proto.h" @@ -1034,10 +1043,6 @@ int setresgid(gid_t rgid, gid_t egid, gid_t sgid); int vasprintf(char **ptr, const char *format, va_list ap); #endif -#if !defined(HAVE_BZERO) && defined(HAVE_MEMSET) -#define bzero(a,b) memset((a),'\0',(b)) -#endif - #ifdef REPLACE_GETPASS #define getpass(prompt) getsmbpass((prompt)) #endif @@ -1283,7 +1288,7 @@ krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt); krb5_error_code krb5_locate_kdc(krb5_context ctx, const krb5_data *realm, struct sockaddr **addr_pp, int *naddrs, int get_masters); krb5_error_code get_kerberos_allowed_etypes(krb5_context context, krb5_enctype **enctypes); void free_kerberos_etypes(krb5_context context, krb5_enctype *enctypes); -BOOL krb5_get_smb_session_key(krb5_context context, krb5_auth_context auth_context, uint8 session_key[16]); +BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, uint8 session_key[16]); #endif /* HAVE_KRB5 */ /* TRUE and FALSE are part of the C99 standard and gcc, but diff --git a/source3/include/mapping.h b/source3/include/mapping.h index d4f2d28e6a..fdaa2b0453 100644 --- a/source3/include/mapping.h +++ b/source3/include/mapping.h @@ -19,29 +19,9 @@ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ -#define PRIV_ALL_INDEX 5 - -#define SE_PRIV_NONE 0x0000 -#define SE_PRIV_ADD_MACHINES 0x0006 -#define SE_PRIV_SEC_PRIV 0x0008 -#define SE_PRIV_TAKE_OWNER 0x0009 -#define SE_PRIV_ADD_USERS 0xff01 -#define SE_PRIV_PRINT_OPERATOR 0xff03 -#define SE_PRIV_ALL 0xffff - #define ENUM_ONLY_MAPPED True #define ENUM_ALL_MAPPED False -#define MAPPING_WITH_PRIV True -#define MAPPING_WITHOUT_PRIV False - -#define PR_NONE 0x0000 -#define PR_LOG_ON_LOCALLY 0x0001 -#define PR_ACCESS_FROM_NETWORK 0x0002 -#define PR_LOG_ON_BATCH_JOB 0x0004 -#define PR_LOG_ON_SERVICE 0x0010 - - typedef struct _GROUP_MAP { struct pdb_methods *methods; gid_t gid; @@ -49,13 +29,5 @@ typedef struct _GROUP_MAP { enum SID_NAME_USE sid_name_use; fstring nt_name; fstring comment; - uint32 systemaccount; - PRIVILEGE_SET priv_set; } GROUP_MAP; -typedef struct _PRIVS { - uint32 se_priv; - const char *priv; - const char *description; -} PRIVS; - diff --git a/source3/include/ntioctl.h b/source3/include/ntioctl.h index 4749842ddc..17791fde18 100644 --- a/source3/include/ntioctl.h +++ b/source3/include/ntioctl.h @@ -23,4 +23,46 @@ we only need the sparse flag */ -#define NTIOCTL_SET_SPARSE 0x900c4 + +/* IOCTL information */ +/* List of ioctl function codes that look to be of interest to remote clients like this. */ +/* Need to do some experimentation to make sure they all work remotely. */ +/* Some of the following such as the encryption/compression ones would be */ +/* invoked from tools via a specialized hook into the VFS rather than via the */ +/* standard vfs entry points */ +#define FSCTL_REQUEST_OPLOCK_LEVEL_1 0x00090000 +#define FSCTL_REQUEST_OPLOCK_LEVEL_2 0x00090004 +#define FSCTL_REQUEST_BATCH_OPLOCK 0x00090008 +#define FSCTL_LOCK_VOLUME 0x00090018 +#define FSCTL_UNLOCK_VOLUME 0x0009001C +#define FSCTL_GET_COMPRESSION 0x0009003C +#define FSCTL_SET_COMPRESSION 0x0009C040 +#define FSCTL_REQUEST_FILTER_OPLOCK 0x0009008C +#define FSCTL_FIND_FILES_BY_SID 0x0009008F +#define FSCTL_FILESYS_GET_STATISTICS 0x00090090 +#define FSCTL_SET_REPARSE_POINT 0x000900A4 +#define FSCTL_GET_REPARSE_POINT 0x000900A8 +#define FSCTL_DELETE_REPARSE_POINT 0x000900AC +#define FSCTL_0x000900C0 0x000900C0 +#define FSCTL_SET_SPARSE 0x000900C4 +#define FSCTL_SET_ZERO_DATA 0x000900C8 +#define FSCTL_SET_ENCRYPTION 0x000900D7 +#define FSCTL_ENCRYPTION_FSCTL_IO 0x000900DB +#define FSCTL_WRITE_RAW_ENCRYPTED 0x000900DF +#define FSCTL_READ_RAW_ENCRYPTED 0x000900E3 +#define FSCTL_SIS_COPYFILE 0x00090100 +#define FSCTL_SIS_LINK_FILES 0x0009C104 + +#if 0 +#define FSCTL_SECURITY_ID_CHECK +#define FSCTL_DISMOUNT_VOLUME +#define FSCTL_GET_NTFS_FILE_RECORD +#define FSCTL_ALLOW_EXTENDED_DASD_IO +#define FSCTL_RECALL_FILE +#define FSCTL_QUERY_ALLOCATED_RANGES + +#endif + +#define IO_REPARSE_TAG_MOUNT_POINT 0xA0000003 +#define IO_REPARSE_TAG_HSM 0xC0000004 +#define IO_REPARSE_TAG_SIS 0x80000007 diff --git a/source3/include/ntlmssp.h b/source3/include/ntlmssp.h index cfbbb00381..562e4853cc 100644 --- a/source3/include/ntlmssp.h +++ b/source3/include/ntlmssp.h @@ -64,8 +64,8 @@ enum NTLM_MESSAGE_TYPE #define NTLMSSP_NAME_TYPE_SERVER 0x01 #define NTLMSSP_NAME_TYPE_DOMAIN 0x02 -#define NTLMSSP_NAME_TYPE_DOMAIN_DNS 0x03 -#define NTLMSSP_NAME_TYPE_SERVER_DNS 0x04 +#define NTLMSSP_NAME_TYPE_SERVER_DNS 0x03 +#define NTLMSSP_NAME_TYPE_DOMAIN_DNS 0x04 typedef struct ntlmssp_state { @@ -129,5 +129,10 @@ typedef struct ntlmssp_client_state /* ntlmv1 */ unsigned char ntlmssp_hash[258]; + /* it turns out that we don't always get the + response in at the time we want to process it. + Store it here, until we need it */ + DATA_BLOB stored_response; + } NTLMSSP_CLIENT_STATE; diff --git a/source3/include/passdb.h b/source3/include/passdb.h index e14e250d34..e3077eee70 100644 --- a/source3/include/passdb.h +++ b/source3/include/passdb.h @@ -61,6 +61,7 @@ enum pdb_elements { PDB_UNKNOWN6, PDB_LMPASSWD, PDB_NTPASSWD, + PDB_BACKEND_PRIVATE_DATA, /* this must be the last element */ PDB_COUNT @@ -137,6 +138,10 @@ typedef struct sam_passwd uint32 unknown_5; /* 0x0002 0000 */ uint32 unknown_6; /* 0x0000 04ec */ + /* a tag for who added the private methods */ + const struct pdb_methods *backend_private_methods; + void *backend_private_data; + void (*backend_private_data_free_fn)(void **); } private; /* Lets see if the remaining code can get the hint that you @@ -203,14 +208,11 @@ typedef struct pdb_context NTSTATUS (*pdb_delete_sam_account)(struct pdb_context *, SAM_ACCOUNT *username); - NTSTATUS (*pdb_getgrsid)(struct pdb_context *context, GROUP_MAP *map, - DOM_SID sid, BOOL with_priv); + NTSTATUS (*pdb_getgrsid)(struct pdb_context *context, GROUP_MAP *map, DOM_SID sid); - NTSTATUS (*pdb_getgrgid)(struct pdb_context *context, GROUP_MAP *map, - gid_t gid, BOOL with_priv); + NTSTATUS (*pdb_getgrgid)(struct pdb_context *context, GROUP_MAP *map, gid_t gid); - NTSTATUS (*pdb_getgrnam)(struct pdb_context *context, GROUP_MAP *map, - char *name, BOOL with_priv); + NTSTATUS (*pdb_getgrnam)(struct pdb_context *context, GROUP_MAP *map, const char *name); NTSTATUS (*pdb_add_group_mapping_entry)(struct pdb_context *context, GROUP_MAP *map); @@ -224,7 +226,7 @@ typedef struct pdb_context NTSTATUS (*pdb_enum_group_mapping)(struct pdb_context *context, enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, int *num_entries, - BOOL unix_only, BOOL with_priv); + BOOL unix_only); void (*free_fn)(struct pdb_context **); @@ -257,14 +259,11 @@ typedef struct pdb_methods NTSTATUS (*delete_sam_account)(struct pdb_methods *, SAM_ACCOUNT *username); - NTSTATUS (*getgrsid)(struct pdb_methods *methods, GROUP_MAP *map, - DOM_SID sid, BOOL with_priv); + NTSTATUS (*getgrsid)(struct pdb_methods *methods, GROUP_MAP *map, DOM_SID sid); - NTSTATUS (*getgrgid)(struct pdb_methods *methods, GROUP_MAP *map, - gid_t gid, BOOL with_priv); + NTSTATUS (*getgrgid)(struct pdb_methods *methods, GROUP_MAP *map, gid_t gid); - NTSTATUS (*getgrnam)(struct pdb_methods *methods, GROUP_MAP *map, - char *name, BOOL with_priv); + NTSTATUS (*getgrnam)(struct pdb_methods *methods, GROUP_MAP *map, const char *name); NTSTATUS (*add_group_mapping_entry)(struct pdb_methods *methods, GROUP_MAP *map); @@ -278,7 +277,7 @@ typedef struct pdb_methods NTSTATUS (*enum_group_mapping)(struct pdb_methods *methods, enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, int *num_entries, - BOOL unix_only, BOOL with_priv); + BOOL unix_only); void *private_data; /* Private data of some kind */ diff --git a/source3/include/privileges.h b/source3/include/privileges.h index 404c5d246b..67d8a2cbcc 100644 --- a/source3/include/privileges.h +++ b/source3/include/privileges.h @@ -23,6 +23,22 @@ #ifndef PRIVILEGES_H #define PRIVILEGES_H +#define PRIV_ALL_INDEX 5 + +#define SE_PRIV_NONE 0x0000 +#define SE_PRIV_ADD_MACHINES 0x0006 +#define SE_PRIV_SEC_PRIV 0x0008 +#define SE_PRIV_TAKE_OWNER 0x0009 +#define SE_PRIV_ADD_USERS 0xff01 +#define SE_PRIV_PRINT_OPERATOR 0xff03 +#define SE_PRIV_ALL 0xffff + +#define PR_NONE 0x0000 +#define PR_LOG_ON_LOCALLY 0x0001 +#define PR_ACCESS_FROM_NETWORK 0x0002 +#define PR_LOG_ON_BATCH_JOB 0x0004 +#define PR_LOG_ON_SERVICE 0x0010 + typedef struct LUID { uint32 low; @@ -42,4 +58,11 @@ typedef struct privilege_set LUID_ATTR *set; } PRIVILEGE_SET; -#endif /* _RPC_LSA_H */ +typedef struct _PRIVS { + uint32 se_priv; + const char *priv; + const char *description; +} PRIVS; + + +#endif /* PRIVILEGES_H */ diff --git a/source3/include/rpc_dce.h b/source3/include/rpc_dce.h index b99639d68d..dc82f45368 100644 --- a/source3/include/rpc_dce.h +++ b/source3/include/rpc_dce.h @@ -51,17 +51,32 @@ enum RPC_PKT_TYPE /* NTLMSSP signature version */ #define NTLMSSP_SIGN_VERSION 0x01 -/* NTLMSSP auth type and level. */ +/* NTLMSSP auth type */ #define NTLMSSP_AUTH_TYPE 0xa -#define NTLMSSP_AUTH_LEVEL 0x6 + +/* DCE-RPC standard identifiers to indicate + signing or sealing of an RPC pipe */ +#define RPC_PIPE_AUTH_SIGN_LEVEL 0x5 +#define RPC_PIPE_AUTH_SEAL_LEVEL 0x6 /* Netlogon schannel auth type and level */ #define NETSEC_AUTH_TYPE 0x44 -#define NETSEC_AUTH_LEVEL 0x6 #define NETSEC_SIGNATURE { 0x77, 0x00, 0x7a, 0x00, 0xff, 0xff, 0x00, 0x00 } #define RPC_AUTH_NETSEC_CHK_LEN 0x20 #define NETLOGON_NEG_SCHANNEL 0x40000000 +enum netsec_direction +{ + SENDER_IS_INITIATOR, + SENDER_IS_ACCEPTOR +}; + +/* Internal Flags to indicate what type of authentication on the pipe */ +#define AUTH_PIPE_SIGN 0x0001 +#define AUTH_PIPE_SEAL 0x0002 +#define AUTH_PIPE_NTLMSSP 0x0004 +#define AUTH_PIPE_NETSEC 0x0008 + /* Maximum PDU fragment size. */ #define MAX_PDU_FRAG_LEN 0x1630 /* #define MAX_PDU_FRAG_LEN 0x10b8 this is what w2k sets */ @@ -222,8 +237,8 @@ typedef struct rpc_auth_netsec_neg_info typedef struct rpc_auth_netsec_chk_info { uint8 sig [8]; /* 77 00 7a 00 ff ff 00 00 */ - uint8 data1[8]; - uint8 data3[8]; /* verifier, seq num */ + uint8 packet_digest[8]; /* checksum over the packet, MD5'ed with session key */ + uint8 seq_num[8]; /* verifier, seq num */ uint8 data8[8]; /* random 8-byte nonce */ } RPC_AUTH_NETSEC_CHK; @@ -350,5 +365,4 @@ typedef struct rpc_auth_ntlmssp_chk_info #define RPC_AUTH_NTLMSSP_CHK_LEN 16 - #endif /* _DCE_RPC_H */ diff --git a/source3/include/rpc_lsa.h b/source3/include/rpc_lsa.h index d4136a9fde..135fd76d6c 100644 --- a/source3/include/rpc_lsa.h +++ b/source3/include/rpc_lsa.h @@ -237,7 +237,7 @@ typedef struct r_lsa_query_sec_obj_info typedef struct lsa_query_info { POLICY_HND pol; /* policy handle */ - uint16 info_class; /* info class */ + uint16 info_class; /* info class */ } LSA_Q_QUERY_INFO; @@ -537,6 +537,7 @@ typedef struct POLICY_HND pol; /* policy handle */ DOM_SID2 sid; UNISTR2_ARRAY rights; + uint32 count; } LSA_Q_ADD_ACCT_RIGHTS; /* LSA_R_ADD_ACCT_RIGHTS - LSA add account rights */ @@ -553,6 +554,7 @@ typedef struct DOM_SID2 sid; uint32 removeall; UNISTR2_ARRAY rights; + uint32 count; } LSA_Q_REMOVE_ACCT_RIGHTS; /* LSA_R_REMOVE_ACCT_RIGHTS - LSA remove account rights */ @@ -561,22 +563,6 @@ typedef struct NTSTATUS status; } LSA_R_REMOVE_ACCT_RIGHTS; -/* LSA_Q_ENUM_ACCT_WITH_RIGHT - LSA enum accounts with right */ -typedef struct -{ - POLICY_HND pol; - STRHDR right_hdr; - UNISTR2 right; -} LSA_Q_ENUM_ACCT_WITH_RIGHT; - -/* LSA_R_ENUM_ACCT_WITH_RIGHT - LSA enum accounts with right */ -typedef struct -{ - uint32 count; - SID_ARRAY sids; - NTSTATUS status; -} LSA_R_ENUM_ACCT_WITH_RIGHT; - /* LSA_Q_PRIV_GET_DISPNAME - LSA get privilege display name */ typedef struct lsa_q_priv_get_dispname diff --git a/source3/include/rpc_samr.h b/source3/include/rpc_samr.h index e1fa9c06bc..7d28a0f3a7 100644 --- a/source3/include/rpc_samr.h +++ b/source3/include/rpc_samr.h @@ -147,16 +147,6 @@ SamrTestPrivateFunctionsUser #define SAMR_SET_USERINFO 0x3A #define SAMR_CONNECT4 0x3E - -typedef struct _DISP_USER_INFO { - SAM_ACCOUNT *sam; -} DISP_USER_INFO; - -typedef struct _DISP_GROUP_INFO { - DOMAIN_GRP *grp; -} DISP_GROUP_INFO; - - typedef struct logon_hours_info { uint32 len; /* normally 21 bytes */ diff --git a/source3/include/rpc_secdes.h b/source3/include/rpc_secdes.h index 1bb25e8651..fb7060cde3 100644 --- a/source3/include/rpc_secdes.h +++ b/source3/include/rpc_secdes.h @@ -78,7 +78,8 @@ #define SEC_DESC_DACL_DEFAULTED 0x0008 #define SEC_DESC_SACL_PRESENT 0x0010 #define SEC_DESC_SACL_DEFAULTED 0x0020 -#define SEC_DESC_SELF_RELATIVE 0x8000 +#define SEC_DESC_DACL_TRUSTED 0x0040 +#define SEC_DESC_SERVER_SECURITY 0x0080 /* * New Windows 2000 bits. */ @@ -89,14 +90,28 @@ #define SE_DESC_DACL_PROTECTED 0x1000 #define SE_DESC_SACL_PROTECTED 0x2000 +/* Don't know what this means. */ +#define SEC_DESC_RM_CONTROL_VALID 0x4000 + +#define SEC_DESC_SELF_RELATIVE 0x8000 + /* security information */ #define OWNER_SECURITY_INFORMATION 0x00000001 #define GROUP_SECURITY_INFORMATION 0x00000002 #define DACL_SECURITY_INFORMATION 0x00000004 #define SACL_SECURITY_INFORMATION 0x00000008 +/* Extra W2K flags. */ +#define UNPROTECTED_SACL_SECURITY_INFORMATION 0x10000000 +#define UNPROTECTED_DACL_SECURITY_INFORMATION 0x20000000 +#define PROTECTED_SACL_SECURITY_INFORMATION 0x40000000 +#define PROTECTED_DACL_SECURITY_INFORMATION 0x80000000 #define ALL_SECURITY_INFORMATION (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|\ - DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION) + DACL_SECURITY_INFORMATION|SACL_SECURITY_INFORMATION|\ + UNPROTECTED_SACL_SECURITY_INFORMATION|\ + UNPROTECTED_DACL_SECURITY_INFORMATION|\ + PROTECTED_SACL_SECURITY_INFORMATION|\ + PROTECTED_DACL_SECURITY_INFORMATION) /* Globally Unique ID */ #define GUID_SIZE 16 diff --git a/source3/include/rpc_srvsvc.h b/source3/include/rpc_srvsvc.h index 94d23bb4bc..5ebb77a8c2 100644 --- a/source3/include/rpc_srvsvc.h +++ b/source3/include/rpc_srvsvc.h @@ -463,9 +463,15 @@ typedef struct ptr_info_1004_info SH_INFO_1004_STR info_1004_str; } SRV_SHARE_INFO_1004; +#define SHARE_1005_IN_DFS 0x00000001 +#define SHARE_1005_DFS_ROOT 0x00000002 +/* use the CSC policy mask and shift to match up with the smb.conf parm */ +#define SHARE_1005_CSC_POLICY_MASK 0x00000030 +#define SHARE_1005_CSC_POLICY_SHIFT 4 + typedef struct share_info_1005_info { - uint32 dfs_root_flag; + uint32 share_info_flags; } SRV_SHARE_INFO_1005; typedef struct share_info_1006_info diff --git a/source3/include/safe_string.h b/source3/include/safe_string.h index a6b352b02e..6656f4f6bb 100644 --- a/source3/include/safe_string.h +++ b/source3/include/safe_string.h @@ -113,24 +113,24 @@ size_t __unsafe_string_function_usage_here_char__(void); #endif /* HAVE_COMPILER_WILL_OPTIMIZE_OUT_FNS */ -/* the addition of the DEVELOPER checks in safe_strcpy means we must - * update a lot of code. To make this a little easier here are some - * functions that provide the lengths with less pain */ -#define pstrcpy_base(dest, src, pstring_base) \ - safe_strcpy(dest, src, sizeof(pstring)-PTR_DIFF(dest,pstring_base)-1) - #define safe_strcpy_base(dest, src, base, size) \ safe_strcpy(dest, src, size-PTR_DIFF(dest,base)-1) -/* String copy functions - macro hell below adds 'type checking' - (limited, but the best we can do in C) and may tag with function - name/number to record the last 'clobber region' on that string */ +/* String copy functions - macro hell below adds 'type checking' (limited, + but the best we can do in C) and may tag with function name/number to + record the last 'clobber region' on that string */ #define pstrcpy(d,s) safe_strcpy((d), (s),sizeof(pstring)-1) #define pstrcat(d,s) safe_strcat((d), (s),sizeof(pstring)-1) #define fstrcpy(d,s) safe_strcpy((d),(s),sizeof(fstring)-1) #define fstrcat(d,s) safe_strcat((d),(s),sizeof(fstring)-1) +/* the addition of the DEVELOPER checks in safe_strcpy means we must + * update a lot of code. To make this a little easier here are some + * functions that provide the lengths with less pain */ +#define pstrcpy_base(dest, src, pstring_base) \ + safe_strcpy(dest, src, sizeof(pstring)-PTR_DIFF(dest,pstring_base)-1) + /* Inside the _fn variants of these is a call to clobber_region(), - * which might destroy the stack on a buggy function. We help the @@ -209,9 +209,4 @@ size_t __unsafe_string_function_usage_here_char__(void); #endif -/* replace some string functions with multi-byte - versions */ -#define strlower(s) strlower_m(s) -#define strupper(s) strupper_m(s) - #endif diff --git a/source3/include/smb.h b/source3/include/smb.h index 0889abf038..d2714e78bc 100644 --- a/source3/include/smb.h +++ b/source3/include/smb.h @@ -45,6 +45,7 @@ #define False (0) #define True (1) #define Auto (2) +#define Required (3) #ifndef _BOOL typedef int BOOL; @@ -66,6 +67,7 @@ typedef int BOOL; #define STR_ASCII 4 #define STR_UNICODE 8 #define STR_NOALIGN 16 +#define STR_TERMINATE_ASCII 128 /* how long to wait for secondary SMB packets (milli-seconds) */ #define SMB_SECONDARY_WAIT (60*1000) @@ -155,6 +157,11 @@ typedef int BOOL; #include "doserr.h" +typedef union unid_t { + uid_t uid; + gid_t gid; +} unid_t; + /* * SMB UCS2 (16-bit unicode) internal type. */ @@ -404,9 +411,11 @@ typedef struct files_struct BOOL is_stat; BOOL directory_delete_on_close; char *fsp_name; + FAKE_FILE_HANDLE *fake_file_handle; } files_struct; #include "ntquotas.h" +#include "sysquotas.h" /* used to hold an arbitrary blob of data */ typedef struct data_blob { @@ -442,18 +451,10 @@ typedef struct #include "smb_acls.h" #include "vfs.h" -typedef struct smb_vfs_handle_struct -{ - void *data; - /* Handle on dlopen() call */ - void *handle; - struct smb_vfs_handle_struct *next, *prev; - -} smb_vfs_handle_struct; - typedef struct connection_struct { struct connection_struct *next, *prev; + TALLOC_CTX *mem_ctx; unsigned cnum; /* an index passed over the wire */ int service; BOOL force_user; @@ -468,8 +469,9 @@ typedef struct connection_struct char *connectpath; char *origpath; - struct vfs_ops vfs_ops; /* Filesystem operations */ - struct smb_vfs_handle_struct *vfs_private; + struct vfs_ops vfs; /* Filesystem operations */ + struct vfs_ops vfs_opaque; /* OPAQUE Filesystem operations */ + struct vfs_handle_struct *vfs_handles; /* for the new plugins */ char *user; /* name of user who *opened* this connection */ uid_t uid; /* uid of user who *opened* this connection */ @@ -1617,4 +1619,15 @@ typedef struct { #include "popt_common.h" +#define PORT_NONE 0 +#ifndef LDAP_PORT +#define LDAP_PORT 389 +#endif + +/* used by the IP comparison function */ +struct ip_service { + struct in_addr ip; + unsigned port; +}; + #endif /* _SMB_H */ diff --git a/source3/include/smb_macros.h b/source3/include/smb_macros.h index 8e2cb1c818..21ccdf295c 100644 --- a/source3/include/smb_macros.h +++ b/source3/include/smb_macros.h @@ -77,12 +77,15 @@ #define OPEN_CONN(conn) ((conn) && (conn)->open) #define IS_IPC(conn) ((conn) && (conn)->ipc) #define IS_PRINT(conn) ((conn) && (conn)->printer) -#define FNUM_OK(fsp,c) (OPEN_FSP(fsp) && (c)==(fsp)->conn) +#define FNUM_OK(fsp,c) (OPEN_FSP(fsp) && (c)==(fsp)->conn && current_user.vuid==(fsp)->vuid) -#define CHECK_FSP(fsp,conn) if (!FNUM_OK(fsp,conn)) \ +#define CHECK_FSP(fsp,conn) do {\ + extern struct current_user current_user;\ + if (!FNUM_OK(fsp,conn)) \ return(ERROR_DOS(ERRDOS,ERRbadfid)); \ else if((fsp)->fd == -1) \ - return(ERROR_DOS(ERRDOS,ERRbadaccess)) + return(ERROR_DOS(ERRDOS,ERRbadaccess));\ + } while(0) #define CHECK_READ(fsp) if (!(fsp)->can_read) \ return(ERROR_DOS(ERRDOS,ERRbadaccess)) @@ -199,6 +202,7 @@ true if two IP addresses are equal ****************************************************************************/ #define ip_equal(ip1,ip2) ((ip1).s_addr == (ip2).s_addr) +#define ip_service_equal(ip1,ip2) ( ((ip1).ip.s_addr == (ip2).ip.s_addr) && ((ip1).port == (ip2).port) ) /***************************************************************** splits out the last subkey of a key @@ -244,52 +248,10 @@ copy an IP address from one buffer to another #define dos_format(fname) string_replace(fname,'/','\\') -/******************************************************************* - vfs stat wrapper that calls internal2unix. -********************************************************************/ - -#define vfs_stat(conn, fname, st) ((conn)->vfs_ops.stat((conn), fname,(st))) - -/******************************************************************* - vfs lstat wrapper that calls internal2unix. -********************************************************************/ - -#define vfs_lstat(conn, fname, st) ((conn)->vfs_ops.lstat((conn), fname,(st))) - -/******************************************************************* - vfs fstat wrapper -********************************************************************/ - -#define vfs_fstat(fsp, fd, st) ((fsp)->conn->vfs_ops.fstat((fsp),(fd),(st))) - -/******************************************************************* - vfs rmdir wrapper that calls internal2unix. -********************************************************************/ - -#define vfs_rmdir(conn,fname) ((conn)->vfs_ops.rmdir((conn),fname)) - -/******************************************************************* - vfs Unlink wrapper that calls internal2unix. -********************************************************************/ - -#define vfs_unlink(conn, fname) ((conn)->vfs_ops.unlink((conn),fname)) - -/******************************************************************* - vfs chmod wrapper that calls internal2unix. -********************************************************************/ - -#define vfs_chmod(conn,fname,mode) ((conn)->vfs_ops.chmod((conn),fname,(mode))) - -/******************************************************************* - vfs chown wrapper that calls internal2unix. -********************************************************************/ - -#define vfs_chown(conn,fname,uid,gid) ((conn)->vfs_ops.chown((conn),fname,(uid),(gid))) - -/******************************************************************* - A wrapper for vfs_chdir(). -********************************************************************/ +/***************************************************************************** + Check to see if we are a DO for this domain +*****************************************************************************/ -#define vfs_chdir(conn,fname) ((conn)->vfs_ops.chdir((conn),fname)) +#define IS_DC (lp_server_role()==ROLE_DOMAIN_PDC || lp_server_role()==ROLE_DOMAIN_BDC) #endif /* _SMB_MACROS_H */ diff --git a/source3/include/smbprofile.h b/source3/include/smbprofile.h index e501de8c0e..a64c2ce69e 100644 --- a/source3/include/smbprofile.h +++ b/source3/include/smbprofile.h @@ -108,6 +108,10 @@ struct profile_stats { unsigned syscall_mknod_time; unsigned syscall_realpath_count; unsigned syscall_realpath_time; + unsigned syscall_get_quota_count; + unsigned syscall_get_quota_time; + unsigned syscall_set_quota_count; + unsigned syscall_set_quota_time; /* stat cache counters */ unsigned statcache_lookups; unsigned statcache_misses; @@ -326,6 +330,10 @@ struct profile_stats { unsigned NT_transact_rename_time; unsigned NT_transact_query_security_desc_count; unsigned NT_transact_query_security_desc_time; + unsigned NT_transact_get_user_quota_count; + unsigned NT_transact_get_user_quota_time; + unsigned NT_transact_set_user_quota_count; + unsigned NT_transact_set_user_quota_time; /* These are ACL manipulation calls */ unsigned get_nt_acl_count; unsigned get_nt_acl_time; diff --git a/source3/include/trans2.h b/source3/include/trans2.h index 2ccf83478b..eb5b1bc79f 100644 --- a/source3/include/trans2.h +++ b/source3/include/trans2.h @@ -224,6 +224,7 @@ Byte offset Type name description #define SMB_QUERY_FILE_ALL_INFO 0x107 #define SMB_QUERY_FILE_ALT_NAME_INFO 0x108 #define SMB_QUERY_FILE_STREAM_INFO 0x109 +#define SMB_QUERY_COMPRESSION_INFO 0x10b #define SMB_FIND_FILE_DIRECTORY_INFO 0x101 #define SMB_FIND_FILE_FULL_DIRECTORY_INFO 0x102 diff --git a/source3/include/version.h b/source3/include/version.h index c0a1c702f2..5e2d47e1de 100644 --- a/source3/include/version.h +++ b/source3/include/version.h @@ -1 +1 @@ -#define VERSION "post3.0-HEAD" +#define VERSION "3.0.0beta3" diff --git a/source3/include/vfs.h b/source3/include/vfs.h index 756e417814..924d706321 100644 --- a/source3/include/vfs.h +++ b/source3/include/vfs.h @@ -1,8 +1,10 @@ /* Unix SMB/CIFS implementation. VFS structures and parameters + Copyright (C) Jeremy Allison 1999-2003 Copyright (C) Tim Potter 1999 Copyright (C) Alexander Bokovoy 2002 + Copyright (C) Stefan (metze) Metzmacher 2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -45,150 +47,41 @@ /* Changed to version 3 for POSIX acl extensions. JRA. */ /* Changed to version 4 for cascaded VFS interface. Alexander Bokovoy. */ /* Changed to version 5 for sendfile addition. JRA. */ -#define SMB_VFS_INTERFACE_VERSION 5 +/* Changed to version 6 for the new module system, fixed cascading and quota functions. --metze */ +/* Changed to version 7 to include the get_nt_acl info parameter. JRA. */ +/* Changed to version 8 includes EA calls. JRA. */ +#define SMB_VFS_INTERFACE_VERSION 8 -/* Version of supported cascaded interface backward compatibility. - (version 5 corresponds to SMB_VFS_INTERFACE_VERSION 5) - It is used in vfs_init_custom() to detect VFS modules which conform to cascaded - VFS interface but implement elder version than current version of Samba uses. - This allows to use old modules with new VFS interface as far as combined VFS operation - set is coherent (will be in most cases). -*/ -#define SMB_VFS_INTERFACE_CASCADED 5 + +/* to bug old modules witch are trying to compile with the old functions */ +#define vfs_init __ERROR_please_port_this_module_to_SMB_VFS_INTERFACE_VERSION_8_donot_use_vfs_init_anymore(void) { __ERROR_please_port_this_module_to_SMB_VFS_INTERFACE_VERSION_8_donot_use_vfs_init_anymore }; +#define lp_parm_string __ERROR_please_port_lp_parm_string_to_lp_parm_const_string_or_lp_parm_talloc_string { \ + __ERROR_please_port_lp_parm_string_to_lp_parm_const_string_or_lp_parm_talloc_string }; +#define lp_vfs_options __ERROR_please_donot_use_lp_vfs_options_anymore_use_lp_parm_xxxx_functions_instead { \ + __ERROR_please_donot_use_lp_vfs_options_anymore_use_lp_parm_xxxx_functions_instead }; /* - Each VFS module must provide following global functions: - vfs_init -- initialization function - vfs_done -- finalization function - - vfs_init must return proper initialized vfs_op_tuple[] array - which describes all operations this module claims to intercept. This function - is called whenever module is loaded into smbd process using sys_dlopen(). - - vfs_init must store somewhere vfs_handle reference if module wants to store per-instance - private information for further usage. vfs_handle->data should be used to - store such information. Do not try to change other fields in this structure - or results likely to be unpredictable. - - vfs_done must perform finalization of the module. In particular, - this function must free vfs_ops structure returned to module from smb_vfs_get_opaque_ops() - function if it is used (see below). This function is called whenever module - is unloaded from smbd process using sys_dlclose(). - - Prototypes: - vfs_op_tuple *vfs_init(const struct vfs_ops *def_vfs_ops, - struct smb_vfs_handle_struct *vfs_handle); - void vfs_done(connection_struct *conn); - All intercepted VFS operations must be declared as static functions inside module source - in order to keep smbd namespace unpolluted. See source of skel, audit, and recycle bin + in order to keep smbd namespace unpolluted. See source of audit, extd_audit, fake_perms and recycle example VFS modules for more details. - */ /* VFS operations structure */ +struct vfs_handle_struct; struct connection_struct; struct files_struct; struct security_descriptor_info; -struct vfs_ops { - - /* Disk operations */ - - int (*connect)(struct connection_struct *conn, const char *service, const char *user); - void (*disconnect)(struct connection_struct *conn); - SMB_BIG_UINT (*disk_free)(struct connection_struct *conn, const char *path, BOOL small_query, SMB_BIG_UINT *bsize, - SMB_BIG_UINT *dfree, SMB_BIG_UINT *dsize); - - /* Directory operations */ - - DIR *(*opendir)(struct connection_struct *conn, const char *fname); - struct dirent *(*readdir)(struct connection_struct *conn, DIR *dirp); - int (*mkdir)(struct connection_struct *conn, const char *path, mode_t mode); - int (*rmdir)(struct connection_struct *conn, const char *path); - int (*closedir)(struct connection_struct *conn, DIR *dir); - - /* File operations */ - - int (*open)(struct connection_struct *conn, const char *fname, int flags, mode_t mode); - int (*close)(struct files_struct *fsp, int fd); - ssize_t (*read)(struct files_struct *fsp, int fd, void *data, size_t n); - ssize_t (*write)(struct files_struct *fsp, int fd, const void *data, size_t n); - SMB_OFF_T (*lseek)(struct files_struct *fsp, int filedes, SMB_OFF_T offset, int whence); - ssize_t (*sendfile)(int tofd, files_struct *fsp, int fromfd, const DATA_BLOB *header, SMB_OFF_T offset, size_t count); - int (*rename)(struct connection_struct *conn, const char *old, const char *new); - int (*fsync)(struct files_struct *fsp, int fd); - int (*stat)(struct connection_struct *conn, const char *fname, SMB_STRUCT_STAT *sbuf); - int (*fstat)(struct files_struct *fsp, int fd, SMB_STRUCT_STAT *sbuf); - int (*lstat)(struct connection_struct *conn, const char *path, SMB_STRUCT_STAT *sbuf); - int (*unlink)(struct connection_struct *conn, const char *path); - int (*chmod)(struct connection_struct *conn, const char *path, mode_t mode); - int (*fchmod)(struct files_struct *fsp, int fd, mode_t mode); - int (*chown)(struct connection_struct *conn, const char *path, uid_t uid, gid_t gid); - int (*fchown)(struct files_struct *fsp, int fd, uid_t uid, gid_t gid); - int (*chdir)(struct connection_struct *conn, const char *path); - char *(*getwd)(struct connection_struct *conn, char *buf); - int (*utime)(struct connection_struct *conn, const char *path, struct utimbuf *times); - int (*ftruncate)(struct files_struct *fsp, int fd, SMB_OFF_T offset); - BOOL (*lock)(struct files_struct *fsp, int fd, int op, SMB_OFF_T offset, SMB_OFF_T count, int type); - int (*symlink)(struct connection_struct *conn, const char *oldpath, const char *newpath); - int (*readlink)(struct connection_struct *conn, const char *path, char *buf, size_t bufsiz); - int (*link)(struct connection_struct *conn, const char *oldpath, const char *newpath); - int (*mknod)(struct connection_struct *conn, const char *path, mode_t mode, SMB_DEV_T dev); - char *(*realpath)(struct connection_struct *conn, const char *path, char *resolved_path); - - /* NT ACL operations. */ - - size_t (*fget_nt_acl)(struct files_struct *fsp, int fd, struct security_descriptor_info **ppdesc); - size_t (*get_nt_acl)(struct files_struct *fsp, const char *name, struct security_descriptor_info **ppdesc); - BOOL (*fset_nt_acl)(struct files_struct *fsp, int fd, uint32 security_info_sent, struct security_descriptor_info *psd); - BOOL (*set_nt_acl)(struct files_struct *fsp, const char *name, uint32 security_info_sent, struct security_descriptor_info *psd); - - /* POSIX ACL operations. */ - - int (*chmod_acl)(struct connection_struct *conn, const char *name, mode_t mode); - int (*fchmod_acl)(struct files_struct *fsp, int fd, mode_t mode); - - int (*sys_acl_get_entry)(struct connection_struct *conn, SMB_ACL_T theacl, int entry_id, SMB_ACL_ENTRY_T *entry_p); - int (*sys_acl_get_tag_type)(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_TAG_T *tag_type_p); - int (*sys_acl_get_permset)(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_PERMSET_T *permset_p); - void * (*sys_acl_get_qualifier)(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d); - SMB_ACL_T (*sys_acl_get_file)(struct connection_struct *conn, const char *path_p, SMB_ACL_TYPE_T type); - SMB_ACL_T (*sys_acl_get_fd)(struct files_struct *fsp, int fd); - int (*sys_acl_clear_perms)(struct connection_struct *conn, SMB_ACL_PERMSET_T permset); - int (*sys_acl_add_perm)(struct connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm); - char * (*sys_acl_to_text)(struct connection_struct *conn, SMB_ACL_T theacl, ssize_t *plen); - SMB_ACL_T (*sys_acl_init)(struct connection_struct *conn, int count); - int (*sys_acl_create_entry)(struct connection_struct *conn, SMB_ACL_T *pacl, SMB_ACL_ENTRY_T *pentry); - int (*sys_acl_set_tag_type)(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_TAG_T tagtype); - int (*sys_acl_set_qualifier)(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, void *qual); - int (*sys_acl_set_permset)(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_PERMSET_T permset); - int (*sys_acl_valid)(struct connection_struct *conn, SMB_ACL_T theacl ); - int (*sys_acl_set_file)(struct connection_struct *conn, const char *name, SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl); - int (*sys_acl_set_fd)(struct files_struct *fsp, int fd, SMB_ACL_T theacl); - int (*sys_acl_delete_def_file)(struct connection_struct *conn, const char *path); - int (*sys_acl_get_perm)(struct connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm); - int (*sys_acl_free_text)(struct connection_struct *conn, char *text); - int (*sys_acl_free_acl)(struct connection_struct *conn, SMB_ACL_T posix_acl); - int (*sys_acl_free_qualifier)(struct connection_struct *conn, void *qualifier, SMB_ACL_TAG_T tagtype); -}; - -struct vfs_options { - struct vfs_options *prev, *next; - char *name; - char *value; -}; - /* - Available VFS operations. These values must be in sync with vfs_ops struct. + Available VFS operations. These values must be in sync with vfs_ops struct + (struct vfs_fn_pointers and struct vfs_handle_pointers inside of struct vfs_ops). In particular, if new operations are added to vfs_ops, appropriate constants should be added to vfs_op_type so that order of them kept same as in vfs_ops. */ typedef enum _vfs_op_type { - SMB_VFS_OP_NOOP = -1, /* Disk operations */ @@ -196,6 +89,8 @@ typedef enum _vfs_op_type { SMB_VFS_OP_CONNECT = 0, SMB_VFS_OP_DISCONNECT, SMB_VFS_OP_DISK_FREE, + SMB_VFS_OP_GET_QUOTA, + SMB_VFS_OP_SET_QUOTA, /* Directory operations */ @@ -269,11 +164,224 @@ typedef enum _vfs_op_type { SMB_VFS_OP_SYS_ACL_FREE_ACL, SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER, + /* EA operations. */ + SMB_VFS_OP_GETXATTR, + SMB_VFS_OP_LGETXATTR, + SMB_VFS_OP_FGETXATTR, + SMB_VFS_OP_LISTXATTR, + SMB_VFS_OP_LLISTXATTR, + SMB_VFS_OP_FLISTXATTR, + SMB_VFS_OP_REMOVEXATTR, + SMB_VFS_OP_LREMOVEXATTR, + SMB_VFS_OP_FREMOVEXATTR, + SMB_VFS_OP_SETXATTR, + SMB_VFS_OP_LSETXATTR, + SMB_VFS_OP_FSETXATTR, + /* This should always be last enum value */ SMB_VFS_OP_LAST } vfs_op_type; +/* + Please keep vfs_op_type, struct vfs_fn_pointers and struct vfs_handles_pointers in sync. +*/ +struct vfs_ops { + struct vfs_fn_pointers { + /* Disk operations */ + + int (*connect)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *service, const char *user); + void (*disconnect)(struct vfs_handle_struct *handle, struct connection_struct *conn); + SMB_BIG_UINT (*disk_free)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path, BOOL small_query, SMB_BIG_UINT *bsize, + SMB_BIG_UINT *dfree, SMB_BIG_UINT *dsize); + int (*get_quota)(struct vfs_handle_struct *handle, struct connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *qt); + int (*set_quota)(struct vfs_handle_struct *handle, struct connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *qt); + + /* Directory operations */ + + DIR *(*opendir)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *fname); + struct dirent *(*readdir)(struct vfs_handle_struct *handle, struct connection_struct *conn, DIR *dirp); + int (*mkdir)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path, mode_t mode); + int (*rmdir)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path); + int (*closedir)(struct vfs_handle_struct *handle, struct connection_struct *conn, DIR *dir); + + /* File operations */ + + int (*open)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *fname, int flags, mode_t mode); + int (*close)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd); + ssize_t (*read)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd, void *data, size_t n); + ssize_t (*write)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd, const void *data, size_t n); + SMB_OFF_T (*lseek)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd, SMB_OFF_T offset, int whence); + ssize_t (*sendfile)(struct vfs_handle_struct *handle, int tofd, files_struct *fsp, int fromfd, const DATA_BLOB *header, SMB_OFF_T offset, size_t count); + int (*rename)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *old, const char *new); + int (*fsync)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd); + int (*stat)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *fname, SMB_STRUCT_STAT *sbuf); + int (*fstat)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd, SMB_STRUCT_STAT *sbuf); + int (*lstat)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path, SMB_STRUCT_STAT *sbuf); + int (*unlink)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path); + int (*chmod)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path, mode_t mode); + int (*fchmod)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd, mode_t mode); + int (*chown)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path, uid_t uid, gid_t gid); + int (*fchown)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd, uid_t uid, gid_t gid); + int (*chdir)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path); + char *(*getwd)(struct vfs_handle_struct *handle, struct connection_struct *conn, char *buf); + int (*utime)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path, struct utimbuf *times); + int (*ftruncate)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd, SMB_OFF_T offset); + BOOL (*lock)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd, int op, SMB_OFF_T offset, SMB_OFF_T count, int type); + int (*symlink)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *oldpath, const char *newpath); + int (*readlink)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path, char *buf, size_t bufsiz); + int (*link)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *oldpath, const char *newpath); + int (*mknod)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path, mode_t mode, SMB_DEV_T dev); + char *(*realpath)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path, char *resolved_path); + + /* NT ACL operations. */ + + size_t (*fget_nt_acl)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd, uint32 security_info, struct security_descriptor_info **ppdesc); + size_t (*get_nt_acl)(struct vfs_handle_struct *handle, struct files_struct *fsp, const char *name, uint32 security_info, struct security_descriptor_info **ppdesc); + BOOL (*fset_nt_acl)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd, uint32 security_info_sent, struct security_descriptor_info *psd); + BOOL (*set_nt_acl)(struct vfs_handle_struct *handle, struct files_struct *fsp, const char *name, uint32 security_info_sent, struct security_descriptor_info *psd); + + /* POSIX ACL operations. */ + + int (*chmod_acl)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *name, mode_t mode); + int (*fchmod_acl)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd, mode_t mode); + + int (*sys_acl_get_entry)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_T theacl, int entry_id, SMB_ACL_ENTRY_T *entry_p); + int (*sys_acl_get_tag_type)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_TAG_T *tag_type_p); + int (*sys_acl_get_permset)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_PERMSET_T *permset_p); + void * (*sys_acl_get_qualifier)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d); + SMB_ACL_T (*sys_acl_get_file)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path_p, SMB_ACL_TYPE_T type); + SMB_ACL_T (*sys_acl_get_fd)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd); + int (*sys_acl_clear_perms)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_PERMSET_T permset); + int (*sys_acl_add_perm)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm); + char * (*sys_acl_to_text)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_T theacl, ssize_t *plen); + SMB_ACL_T (*sys_acl_init)(struct vfs_handle_struct *handle, struct connection_struct *conn, int count); + int (*sys_acl_create_entry)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_T *pacl, SMB_ACL_ENTRY_T *pentry); + int (*sys_acl_set_tag_type)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_TAG_T tagtype); + int (*sys_acl_set_qualifier)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_ENTRY_T entry, void *qual); + int (*sys_acl_set_permset)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_PERMSET_T permset); + int (*sys_acl_valid)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_T theacl ); + int (*sys_acl_set_file)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *name, SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl); + int (*sys_acl_set_fd)(struct vfs_handle_struct *handle, struct files_struct *fsp, int fd, SMB_ACL_T theacl); + int (*sys_acl_delete_def_file)(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path); + int (*sys_acl_get_perm)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm); + int (*sys_acl_free_text)(struct vfs_handle_struct *handle, struct connection_struct *conn, char *text); + int (*sys_acl_free_acl)(struct vfs_handle_struct *handle, struct connection_struct *conn, SMB_ACL_T posix_acl); + int (*sys_acl_free_qualifier)(struct vfs_handle_struct *handle, struct connection_struct *conn, void *qualifier, SMB_ACL_TAG_T tagtype); + + /* EA operations. */ + ssize_t (*getxattr)(struct vfs_handle_struct *handle,struct connection_struct *conn,const char *path, const char *name, void *value, size_t size); + ssize_t (*lgetxattr)(struct vfs_handle_struct *handle,struct connection_struct *conn,const char *path, const char *name, void *value, size_t size); + ssize_t (*fgetxattr)(struct vfs_handle_struct *handle, struct files_struct *fsp,int fd, const char *name, void *value, size_t size); + ssize_t (*listxattr)(struct vfs_handle_struct *handle, struct connection_struct *conn,const char *path, char *list, size_t size); + ssize_t (*llistxattr)(struct vfs_handle_struct *handle, struct connection_struct *conn,const char *path, char *list, size_t size); + ssize_t (*flistxattr)(struct vfs_handle_struct *handle, struct files_struct *fsp,int fd, char *list, size_t size); + int (*removexattr)(struct vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name); + int (*lremovexattr)(struct vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name); + int (*fremovexattr)(struct vfs_handle_struct *handle, struct files_struct *fsp,int filedes, const char *name); + int (*setxattr)(struct vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, const void *value, size_t size, int flags); + int (*lsetxattr)(struct vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, const void *value, size_t size, int flags); + int (*fsetxattr)(struct vfs_handle_struct *handle, struct files_struct *fsp,int filedes, const char *name, const void *value, size_t size, int flags); + + } ops; + + struct vfs_handles_pointers { + /* Disk operations */ + + struct vfs_handle_struct *connect; + struct vfs_handle_struct *disconnect; + struct vfs_handle_struct *disk_free; + struct vfs_handle_struct *get_quota; + struct vfs_handle_struct *set_quota; + + /* Directory operations */ + + struct vfs_handle_struct *opendir; + struct vfs_handle_struct *readdir; + struct vfs_handle_struct *mkdir; + struct vfs_handle_struct *rmdir; + struct vfs_handle_struct *closedir; + + /* File operations */ + + struct vfs_handle_struct *open; + struct vfs_handle_struct *close; + struct vfs_handle_struct *read; + struct vfs_handle_struct *write; + struct vfs_handle_struct *lseek; + struct vfs_handle_struct *sendfile; + struct vfs_handle_struct *rename; + struct vfs_handle_struct *fsync; + struct vfs_handle_struct *stat; + struct vfs_handle_struct *fstat; + struct vfs_handle_struct *lstat; + struct vfs_handle_struct *unlink; + struct vfs_handle_struct *chmod; + struct vfs_handle_struct *fchmod; + struct vfs_handle_struct *chown; + struct vfs_handle_struct *fchown; + struct vfs_handle_struct *chdir; + struct vfs_handle_struct *getwd; + struct vfs_handle_struct *utime; + struct vfs_handle_struct *ftruncate; + struct vfs_handle_struct *lock; + struct vfs_handle_struct *symlink; + struct vfs_handle_struct *readlink; + struct vfs_handle_struct *link; + struct vfs_handle_struct *mknod; + struct vfs_handle_struct *realpath; + + /* NT ACL operations. */ + + struct vfs_handle_struct *fget_nt_acl; + struct vfs_handle_struct *get_nt_acl; + struct vfs_handle_struct *fset_nt_acl; + struct vfs_handle_struct *set_nt_acl; + + /* POSIX ACL operations. */ + + struct vfs_handle_struct *chmod_acl; + struct vfs_handle_struct *fchmod_acl; + + struct vfs_handle_struct *sys_acl_get_entry; + struct vfs_handle_struct *sys_acl_get_tag_type; + struct vfs_handle_struct *sys_acl_get_permset; + struct vfs_handle_struct *sys_acl_get_qualifier; + struct vfs_handle_struct *sys_acl_get_file; + struct vfs_handle_struct *sys_acl_get_fd; + struct vfs_handle_struct *sys_acl_clear_perms; + struct vfs_handle_struct *sys_acl_add_perm; + struct vfs_handle_struct *sys_acl_to_text; + struct vfs_handle_struct *sys_acl_init; + struct vfs_handle_struct *sys_acl_create_entry; + struct vfs_handle_struct *sys_acl_set_tag_type; + struct vfs_handle_struct *sys_acl_set_qualifier; + struct vfs_handle_struct *sys_acl_set_permset; + struct vfs_handle_struct *sys_acl_valid; + struct vfs_handle_struct *sys_acl_set_file; + struct vfs_handle_struct *sys_acl_set_fd; + struct vfs_handle_struct *sys_acl_delete_def_file; + struct vfs_handle_struct *sys_acl_get_perm; + struct vfs_handle_struct *sys_acl_free_text; + struct vfs_handle_struct *sys_acl_free_acl; + struct vfs_handle_struct *sys_acl_free_qualifier; + + /* EA operations. */ + struct vfs_handle_struct *getxattr; + struct vfs_handle_struct *lgetxattr; + struct vfs_handle_struct *fgetxattr; + struct vfs_handle_struct *listxattr; + struct vfs_handle_struct *llistxattr; + struct vfs_handle_struct *flistxattr; + struct vfs_handle_struct *removexattr; + struct vfs_handle_struct *lremovexattr; + struct vfs_handle_struct *fremovexattr; + struct vfs_handle_struct *setxattr; + struct vfs_handle_struct *lsetxattr; + struct vfs_handle_struct *fsetxattr; + } handles; +}; + /* Possible VFS operation layers (per-operation) @@ -300,7 +408,7 @@ typedef enum _vfs_op_layer { SMB_VFS_LAYER_OPAQUE = 0, /* - Final level, does not call anything beyond itself */ SMB_VFS_LAYER_TRANSPARENT, /* - Normal operation, calls underlying layer after */ /* possibly changing passed data */ - SMB_VFS_LAYER_LOGGER, /* - Logs data, calls underlying layer, logging does not */ + SMB_VFS_LAYER_LOGGER, /* - Logs data, calls underlying layer, logging may not */ /* use Samba VFS */ SMB_VFS_LAYER_SPLITTER, /* - Splits operation, calls underlying layer _and_ own facility, */ /* then combines result */ @@ -309,10 +417,10 @@ typedef enum _vfs_op_layer { } vfs_op_layer; /* - VFS operation description. Each VFS module initialization function returns to VFS subsystem - an array of vfs_op_tuple which describes all operations this module is willing to intercept. - VFS subsystem initializes then vfs_ops using this information and passes it - to next VFS module as underlying vfs_ops and to connection after all VFS modules are initialized. + VFS operation description. Each VFS module registers an array of vfs_op_tuple to VFS subsystem, + which describes all operations this module is willing to intercept. + VFS subsystem initializes then the conn->vfs_ops and conn->vfs_opaque_ops structs + using this information. */ typedef struct _vfs_op_tuple { @@ -321,18 +429,46 @@ typedef struct _vfs_op_tuple { vfs_op_layer layer; } vfs_op_tuple; -/* - Return vfs_ops filled with current opaque VFS operations. This function is designed to - be called from VFS module initialization function for those modules which needs 'direct' VFS - access (loggers or initiators of file operations other than connection asks for). - - Returned vfs_ops must be cleaned up in VFS module's finalizer function (vfs_done_) - using safe_free(). - - Prototype: - struct vfs_ops *smb_vfs_get_opaque_ops(); - - This prototype will be available via include/proto.h -*/ + +typedef struct vfs_handle_struct { + struct vfs_handle_struct *next, *prev; + const char *param; + struct vfs_ops vfs_next; + struct connection_struct *conn; + void *data; + void (*free_data)(void **data); +} vfs_handle_struct; + + +#define SMB_VFS_HANDLE_GET_DATA(handle, datap, type, ret) { \ + if (!(handle)||((datap=(type *)(handle)->data)==NULL)) { \ + DEBUG(0,("%s() failed to get vfs_handle->data!\n",FUNCTION_MACRO)); \ + ret; \ + } \ +} + +#define SMB_VFS_HANDLE_SET_DATA(handle, datap, free_fn, type, ret) { \ + if (!(handle)) { \ + DEBUG(0,("%s() failed to set handle->data!\n",FUNCTION_MACRO)); \ + ret; \ + } else { \ + if ((handle)->free_data) { \ + (handle)->free_data(&(handle)->data); \ + } \ + (handle)->data = (void *)datap; \ + (handle)->free_data = free_fn; \ + } \ +} + +#define SMB_VFS_HANDLE_FREE_DATA(handle) { \ + if ((handle) && (handle)->free_data) { \ + (handle)->free_data(&(handle)->data); \ + } \ +} + +#define SMB_VFS_OP(x) ((void *) x) + + +#include "vfs_macros.h" #endif /* _VFS_H */ diff --git a/source3/lib/charcnv.c b/source3/lib/charcnv.c index eb427cc0fc..4e9c2c1592 100644 --- a/source3/lib/charcnv.c +++ b/source3/lib/charcnv.c @@ -55,6 +55,30 @@ static const char *charset_name(charset_t ch) else if (ch == CH_DISPLAY) ret = lp_display_charset(); else if (ch == CH_UTF8) ret = "UTF8"; +#if defined(HAVE_NL_LANGINFO) && defined(CODESET) + if (ret && strcasecmp(ret, "LOCALE") == 0) { + const char *ln = NULL; + +#ifdef HAVE_SETLOCALE + setlocale(LC_ALL, ""); +#endif + ln = nl_langinfo(CODESET); + if (ln) { + /* Check whether the charset name is supported + by iconv */ + smb_iconv_t handle = smb_iconv_open(ln,"UCS-2LE"); + if (handle == (smb_iconv_t) -1) { + DEBUG(5,("Locale charset '%s' unsupported, using ASCII instead\n", ln)); + ln = NULL; + } else { + DEBUG(5,("Substituting charset '%s' for LOCALE\n", ln)); + smb_iconv_close(handle); + } + } + ret = ln; + } +#endif + if (!ret || !*ret) ret = "ASCII"; return ret; } @@ -363,11 +387,11 @@ size_t push_ascii(void *dest, const char *src, size_t dest_len, int flags) if (flags & STR_UPPER) { pstrcpy(tmpbuf, src); - strupper(tmpbuf); + strupper_m(tmpbuf); src = tmpbuf; } - if (flags & STR_TERMINATE) + if (flags & (STR_TERMINATE | STR_TERMINATE_ASCII)) src_len++; return convert_string(CH_UNIX, CH_DOS, src, src_len, dest, dest_len); @@ -464,7 +488,7 @@ size_t push_ucs2(const void *base_ptr, void *dest, const char *src, size_t dest_ if (flags & STR_UPPER) { pstrcpy(tmpbuf, src); - strupper(tmpbuf); + strupper_m(tmpbuf); src = tmpbuf; } @@ -542,7 +566,7 @@ static size_t push_utf8(void *dest, const char *src, size_t dest_len, int flags) if (flags & STR_UPPER) { pstrcpy(tmpbuf, src); - strupper(tmpbuf); + strupper_m(tmpbuf); src = tmpbuf; } @@ -723,8 +747,21 @@ size_t pull_utf8_allocate(void **dest, const char *src) size_t push_string_fn(const char *function, unsigned int line, const void *base_ptr, void *dest, const char *src, size_t dest_len, int flags) { +#ifdef DEVELOPER + /* We really need to zero fill here, not clobber + * region, as we want to ensure that valgrind thinks + * all of the outgoing buffer has been written to + * so a send() or write() won't trap an error. + * JRA. + */ +#if 0 if (dest_len != (size_t)-1) clobber_region(function, line, dest, dest_len); +#else + if (dest_len != (size_t)-1) + memset(dest, '\0', dest_len); +#endif +#endif if (!(flags & STR_ASCII) && \ ((flags & STR_UNICODE || \ diff --git a/source3/lib/gencache.c b/source3/lib/gencache.c index 40b4d1390d..f3740e3e12 100644 --- a/source3/lib/gencache.c +++ b/source3/lib/gencache.c @@ -319,9 +319,8 @@ void gencache_iterate(void (*fn)(const char* key, const char *value, time_t time while (node) { /* ensure null termination of the key string */ - node->node_key.dptr[node->node_key.dsize] = '\0'; - keystr = node->node_key.dptr; - + keystr = strndup(node->node_key.dptr, node->node_key.dsize); + /* * We don't use gencache_get function, because we need to iterate through * all of the entries. Validity verification is up to fn routine. @@ -329,6 +328,8 @@ void gencache_iterate(void (*fn)(const char* key, const char *value, time_t time databuf = tdb_fetch(cache, node->node_key); if (!databuf.dptr || databuf.dsize <= TIMEOUT_LEN) { SAFE_FREE(databuf.dptr); + SAFE_FREE(keystr); + node = node->next; continue; } entry = strndup(databuf.dptr, databuf.dsize); @@ -342,8 +343,30 @@ void gencache_iterate(void (*fn)(const char* key, const char *value, time_t time SAFE_FREE(valstr); SAFE_FREE(entry); + SAFE_FREE(keystr); node = node->next; } tdb_search_list_free(first_node); } + +/******************************************************************** + lock a key +********************************************************************/ + +int gencache_lock_entry( const char *key ) +{ + return tdb_lock_bystring(cache, key, 0); +} + +/******************************************************************** + unlock a key +********************************************************************/ + +void gencache_unlock_entry( const char *key ) +{ + tdb_unlock_bystring(cache, key); + return; +} + + diff --git a/source3/lib/module.c b/source3/lib/module.c index 4437d085f9..ac4fe57a2c 100644 --- a/source3/lib/module.c +++ b/source3/lib/module.c @@ -130,29 +130,6 @@ void init_modules(void) } -/************************************************************************* - * This functions /path/to/foobar.so -> foobar - ************************************************************************/ -void module_path_get_name(const char *path, pstring name) -{ - char *s; - - /* First, make the path relative */ - s = strrchr(path, '/'); - if(s) pstrcpy(name, s+1); - else pstrcpy(name, path); - - if (dyn_SHLIBEXT && *dyn_SHLIBEXT && strlen(dyn_SHLIBEXT) < strlen(name)) { - int n = strlen(name) - strlen(dyn_SHLIBEXT); - - /* Remove extension if necessary */ - if (name[n-1] == '.' && !strcmp(name+n, dyn_SHLIBEXT)) { - name[n-1] = '\0'; - } - } -} - - /*************************************************************************** * This Function registers a idle event * diff --git a/source3/lib/popt_common.c b/source3/lib/popt_common.c index 6920ef4d5f..b8e77b2d9e 100644 --- a/source3/lib/popt_common.c +++ b/source3/lib/popt_common.c @@ -335,8 +335,8 @@ static void popt_common_credentials_callback(poptContext con, struct poptOption popt_common_credentials[] = { { NULL, 0, POPT_ARG_CALLBACK|POPT_CBFLAG_PRE, popt_common_credentials_callback }, { "user", 'U', POPT_ARG_STRING, NULL, 'U', "Set the network username", "USERNAME" }, - { "no-pass", 'N', POPT_ARG_NONE, &cmdline_auth_info.got_pass, True, "Don't ask for a password" }, - { "kerberos", 'k', POPT_ARG_NONE, &cmdline_auth_info.use_kerberos, True, "Use kerberos (active directory) authentication" }, + { "no-pass", 'N', POPT_ARG_NONE, &cmdline_auth_info.got_pass, 0, "Don't ask for a password" }, + { "kerberos", 'k', POPT_ARG_NONE, &cmdline_auth_info.use_kerberos, 'k', "Use kerberos (active directory) authentication" }, { "authentication-file", 'A', POPT_ARG_STRING, NULL, 'A', "Get the credentials from a file", "FILE" }, POPT_TABLEEND }; diff --git a/source3/lib/substitute.c b/source3/lib/substitute.c index 7ba8648156..ac2cf687c4 100644 --- a/source3/lib/substitute.c +++ b/source3/lib/substitute.c @@ -58,7 +58,7 @@ void set_local_machine_name(const char* local_name, BOOL perm) fstrcpy(tmp_local_machine,local_name); trim_string(tmp_local_machine," "," "); - strlower(tmp_local_machine); + strlower_m(tmp_local_machine); alpha_strcpy(local_machine,tmp_local_machine,SAFE_NETBIOS_CHARS,sizeof(local_machine)-1); } @@ -80,7 +80,7 @@ void set_remote_machine_name(const char* remote_name, BOOL perm) fstrcpy(tmp_remote_machine,remote_name); trim_string(tmp_remote_machine," "," "); - strlower(tmp_remote_machine); + strlower_m(tmp_remote_machine); alpha_strcpy(remote_machine,tmp_remote_machine,SAFE_NETBIOS_CHARS,sizeof(remote_machine)-1); } @@ -111,7 +111,7 @@ void sub_set_smb_name(const char *name) fstrcpy(tmp,name); trim_string(tmp," "," "); - strlower(tmp); + strlower_m(tmp); alpha_strcpy(smb_user_name,tmp,SAFE_NETBIOS_CHARS,sizeof(smb_user_name)-1); } @@ -331,7 +331,7 @@ void standard_sub_basic(const char *smb_name, char *str,size_t len) switch (*(p+1)) { case 'U' : fstrcpy(tmp_str, smb_name); - strlower(tmp_str); + strlower_m(tmp_str); string_sub(p,"%U",tmp_str,l); break; case 'G' : @@ -344,7 +344,7 @@ void standard_sub_basic(const char *smb_name, char *str,size_t len) break; case 'D' : fstrcpy(tmp_str, current_user_info.domain); - strupper(tmp_str); + strupper_m(tmp_str); string_sub(p,"%D", tmp_str,l); break; case 'I' : @@ -357,7 +357,7 @@ void standard_sub_basic(const char *smb_name, char *str,size_t len) pstring temp_name; pstrcpy(temp_name, global_myname()); - strlower(temp_name); + strlower_m(temp_name); string_sub(p,"%L", temp_name,l); } break; @@ -650,7 +650,7 @@ char *talloc_sub_advanced(TALLOC_CTX *mem_ctx, const char *connectpath, gid_t gid, const char *smb_name, - char *str) + const char *str) { char *a, *t; a = alloc_sub_advanced(snum, user, connectpath, gid, smb_name, str); @@ -662,7 +662,7 @@ char *talloc_sub_advanced(TALLOC_CTX *mem_ctx, char *alloc_sub_advanced(int snum, const char *user, const char *connectpath, gid_t gid, - const char *smb_name, char *str) + const char *smb_name, const char *str) { char *a_string, *ret_string; char *b, *p, *s, *t, *h; @@ -736,14 +736,14 @@ void standard_sub_conn(connection_struct *conn, char *str, size_t len) conn->gid, smb_user_name, str, len); } -char *talloc_sub_conn(TALLOC_CTX *mem_ctx, connection_struct *conn, char *str) +char *talloc_sub_conn(TALLOC_CTX *mem_ctx, connection_struct *conn, const char *str) { return talloc_sub_advanced(mem_ctx, SNUM(conn), conn->user, conn->connectpath, conn->gid, smb_user_name, str); } -char *alloc_sub_conn(connection_struct *conn, char *str) +char *alloc_sub_conn(connection_struct *conn, const char *str) { return alloc_sub_advanced(SNUM(conn), conn->user, conn->connectpath, conn->gid, smb_user_name, str); diff --git a/source3/lib/system.c b/source3/lib/system.c index 6ff97b88da..a7024c852d 100644 --- a/source3/lib/system.c +++ b/source3/lib/system.c @@ -1253,3 +1253,128 @@ int sys_dup2(int oldfd, int newfd) #endif SAFE_FREE(msgbuf); } + +/************************************************************************** + Wrappers for extented attribute calls. Based on the Linux package with + support for IRIX also. Expand as other systems have them. +****************************************************************************/ + +ssize_t sys_getxattr (const char *path, const char *name, void *value, size_t size) +{ +#if defined(HAVE_GETXATTR) + return getxattr(path, name, value, size); +#else + errno = ENOSYS; + return -1; +#endif +} + +ssize_t sys_lgetxattr (const char *path, const char *name, void *value, size_t size) +{ +#if defined(HAVE_LGETXATTR) + return lgetxattr(path, name, value, size); +#else + errno = ENOSYS; + return -1; +#endif +} + +ssize_t sys_fgetxattr (int filedes, const char *name, void *value, size_t size) +{ +#if defined(HAVE_FGETXATTR) + return fgetxattr(filedes, name, value, size); +#else + errno = ENOSYS; + return -1; +#endif +} + +ssize_t sys_listxattr (const char *path, char *list, size_t size) +{ +#if defined(HAVE_LISTXATTR) + return listxattr(path, list, size); +#else + errno = ENOSYS; + return -1; +#endif +} + +ssize_t sys_llistxattr (const char *path, char *list, size_t size) +{ +#if defined(HAVE_GETXATTR) + return llistxattr(path, list, size); +#else + errno = ENOSYS; + return -1; +#endif +} + +ssize_t sys_flistxattr (int filedes, char *list, size_t size) +{ +#if defined(HAVE_FLISTXATTR) + return flistxattr(filedes, list, size); +#else + errno = ENOSYS; + return -1; +#endif +} + +int sys_removexattr (const char *path, const char *name) +{ +#if defined(HAVE_REMOVEXATTR) + return removexattr(path, name); +#else + errno = ENOSYS; + return -1; +#endif +} + +int sys_lremovexattr (const char *path, const char *name) +{ +#if defined(HAVE_LREMOVEXATTR) + return lremovexattr(path, name); +#else + errno = ENOSYS; + return -1; +#endif +} + +int sys_fremovexattr (int filedes, const char *name) +{ +#if defined(HAVE_FREMOVEXATTR) + return fremovexattr(filedes, name); +#else + errno = ENOSYS; + return -1; +#endif +} + +int sys_setxattr (const char *path, const char *name, const void *value, size_t size, int flags) +{ +#if defined(HAVE_SETXATTR) + return setxattr(path, name, value, size, flags); +#else + errno = ENOSYS; + return -1; +#endif +} + +int sys_lsetxattr (const char *path, const char *name, const void *value, size_t size, int flags) +{ +#if defined(HAVE_LSETXATTR) + return lsetxattr(path, name, value, size, flags); +#else + errno = ENOSYS; + return -1; +#endif +} + +int sys_fsetxattr (int filedes, const char *name, const void *value, size_t size, int flags) +{ +#if defined(HAVE_FSETXATTR) + return fsetxattr(filedes, name, value, size, flags); +#else + errno = ENOSYS; + return -1; +#endif +} diff --git a/source3/lib/system_smbd.c b/source3/lib/system_smbd.c index 3ae0a6395e..bcbc8c61e6 100644 --- a/source3/lib/system_smbd.c +++ b/source3/lib/system_smbd.c @@ -107,13 +107,31 @@ static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups, in int sys_getgrouplist(const char *user, gid_t gid, gid_t *groups, int *grpcnt) { + char *p; + int retval; + + DEBUG(10,("sys_getgrouplist: user [%s]\n", user)); + + /* see if we should disable winbindd lookups for local users */ + if ( (p = strchr(user, *lp_winbind_separator())) == NULL ) { + if ( !winbind_off() ) + DEBUG(0,("sys_getgroup_list: Insufficient environment space for %s\n", + WINBINDD_DONT_ENV)); + else + DEBUG(10,("sys_getgrouplist(): disabled winbindd for group lookup [user == %s]\n", + user)); + } + #ifdef HAVE_GETGROUPLIST - return getgrouplist(user, gid, groups, grpcnt); + retval = getgrouplist(user, gid, groups, grpcnt); #else - int retval; become_root(); retval = getgrouplist_internals(user, gid, groups, grpcnt); unbecome_root(); - return retval; #endif + + /* allow winbindd lookups */ + winbind_on(); + + return retval; } diff --git a/source3/lib/time.c b/source3/lib/time.c index f76a1bdc0d..5309711a05 100644 --- a/source3/lib/time.c +++ b/source3/lib/time.c @@ -308,7 +308,8 @@ time_t nt_time_to_unix(NTTIME *nt) time_t l_time_min = TIME_T_MIN; time_t l_time_max = TIME_T_MAX; - if (nt->high == 0) return(0); + if (nt->high == 0 || (nt->high == 0xffffffff && nt->low == 0xffffffff)) + return(0); d = ((double)nt->high)*4.0*(double)(1<<30); d += (nt->low&0xFFF00000); diff --git a/source3/lib/username.c b/source3/lib/username.c index d8f4ff80ed..98b8f33aae 100644 --- a/source3/lib/username.c +++ b/source3/lib/username.c @@ -219,7 +219,7 @@ static struct passwd *Get_Pwnam_internals(const char *user, char *user2) /* Try in all lower case first as this is the most common case on UNIX systems */ - strlower(user2); + strlower_m(user2); DEBUG(5,("Trying _Get_Pwnam(), username as lowercase is %s\n",user2)); ret = getpwnam_alloc(user2); if(ret) @@ -234,7 +234,7 @@ static struct passwd *Get_Pwnam_internals(const char *user, char *user2) } /* Try as uppercase, if username wasn't originally uppercase */ - strupper(user2); + strupper_m(user2); if(strcmp(user, user2) != 0) { DEBUG(5,("Trying _Get_Pwnam(), username as uppercase is %s\n", user2)); ret = getpwnam_alloc(user2); @@ -243,7 +243,7 @@ static struct passwd *Get_Pwnam_internals(const char *user, char *user2) } /* Try all combinations up to usernamelevel */ - strlower(user2); + strlower_m(user2); DEBUG(5,("Checking combinations of %d uppercase letters in %s\n", lp_usernamelevel(), user2)); ret = uname_string_combinations(user2, getpwnam_alloc, lp_usernamelevel()); @@ -325,11 +325,12 @@ static BOOL user_in_netgroup_list(const char *user, const char *ngname) static BOOL user_in_winbind_group_list(const char *user, const char *gname, BOOL *winbind_answered) { - int num_groups; int i; - gid_t *groups = NULL; gid_t gid, gid_low, gid_high; BOOL ret = False; + static gid_t *groups = NULL; + static int num_groups = 0; + static fstring last_user = ""; *winbind_answered = False; @@ -349,27 +350,44 @@ static BOOL user_in_winbind_group_list(const char *user, const char *gname, BOOL goto err; } - /* - * Get the gid's that this user belongs to. - */ - - if ((num_groups = winbind_getgroups(user, 0, NULL)) == -1) - return False; + /* try to user the last user we looked up */ + /* otherwise fall back to lookups */ + + if ( !strequal( last_user, user ) || !groups ) + { + /* clear any cached information */ + + SAFE_FREE(groups); + fstrcpy( last_user, "" ); + + /* + * Get the gid's that this user belongs to. + */ - if (num_groups == 0) { - *winbind_answered = True; - return False; - } + if ((num_groups = winbind_getgroups(user, &groups)) == -1) + return False; + + if ( num_groups == -1 ) + return False; - if ((groups = (gid_t *)malloc(sizeof(gid_t) * num_groups )) == NULL) { - DEBUG(0,("user_in_winbind_group_list: malloc fail.\n")); - goto err; - } + if ( num_groups == 0 ) { + *winbind_answered = True; + return False; + } + + /* save the last username */ + + fstrcpy( last_user, user ); + + } + else + DEBUG(10,("user_in_winbind_group_list: using cached user groups for [%s]\n", user)); - if ((num_groups = winbind_getgroups(user, num_groups, groups)) == -1) { - DEBUG(0,("user_in_winbind_group_list: second winbind_getgroups call \ -failed with error %s\n", strerror(errno) )); - goto err; + if ( DEBUGLEVEL >= 10 ) { + DEBUG(10,("user_in_winbind_group_list: using groups -- ")); + for ( i=0; i 0) + { + dump_data(11, data, len); + } +#endif +} + char *tab_depth(int depth) { static pstring spaces; @@ -2323,8 +2347,8 @@ BOOL mask_match(const char *string, char *pattern, BOOL is_case_sensitive) fstrcpy(p2, pattern); fstrcpy(s2, string); - strlower(p2); - strlower(s2); + strlower_m(p2); + strlower_m(s2); return ms_fnmatch(p2, s2, Protocol) == 0; } @@ -2332,9 +2356,9 @@ BOOL mask_match(const char *string, char *pattern, BOOL is_case_sensitive) Recursive routine that is called by unix_wild_match. *********************************************************/ -static BOOL unix_do_match(char *regexp, char *str) +static BOOL unix_do_match(const char *regexp, const char *str) { - char *p; + const char *p; for( p = regexp; *p && *str; ) { @@ -2440,8 +2464,8 @@ BOOL unix_wild_match(const char *pattern, const char *string) pstrcpy(p2, pattern); pstrcpy(s2, string); - strlower(p2); - strlower(s2); + strlower_m(p2); + strlower_m(s2); /* Remove any *? and ** from the pattern as they are meaningless */ for(p = p2; *p; p++) @@ -2454,6 +2478,7 @@ BOOL unix_wild_match(const char *pattern, const char *string) return unix_do_match(p2, s2) == 0; } + #ifdef __INSURE__ /******************************************************************* diff --git a/source3/lib/util_sid.c b/source3/lib/util_sid.c index 9dc0c8ca18..00f14d7d26 100644 --- a/source3/lib/util_sid.c +++ b/source3/lib/util_sid.c @@ -391,6 +391,9 @@ BOOL sid_peek_check_rid(const DOM_SID *exp_dom_sid, const DOM_SID *sid, uint32 * if (!exp_dom_sid || !sid || !rid) return False; + if (sid->num_auths != (exp_dom_sid->num_auths+1)) { + return False; + } if (sid_compare_domain(exp_dom_sid, sid)!=0){ *rid=(-1); @@ -642,8 +645,9 @@ DOM_SID *sid_dup_talloc(TALLOC_CTX *ctx, DOM_SID *src) if(!src) return NULL; - if((dst = talloc_zero(ctx, sizeof(DOM_SID))) != NULL) + if((dst = talloc_zero(ctx, sizeof(DOM_SID))) != NULL) { sid_copy( dst, src); + } return dst; } diff --git a/source3/lib/util_sock.c b/source3/lib/util_sock.c index c974050b43..1bd4c3a96b 100644 --- a/source3/lib/util_sock.c +++ b/source3/lib/util_sock.c @@ -654,8 +654,8 @@ int open_socket_out(int type, struct in_addr *addr, int port ,int timeout) { struct sockaddr_in sock_out; int res,ret; - int connect_loop = 250; /* 250 milliseconds */ - int loops = (timeout) / connect_loop; + int connect_loop = 10; + int increment = 10; /* create a socket to write to */ res = socket(PF_INET, type, 0); @@ -681,8 +681,13 @@ connect_again: /* Some systems return EAGAIN when they mean EINPROGRESS */ if (ret < 0 && (errno == EINPROGRESS || errno == EALREADY || - errno == EAGAIN) && loops--) { + errno == EAGAIN) && (connect_loop < timeout) ) { msleep(connect_loop); + connect_loop += increment; + if (increment < 250) { + /* After 8 rounds we end up at a max of 255 msec */ + increment *= 1.5; + } goto connect_again; } @@ -764,6 +769,19 @@ char *client_addr(void) return get_socket_addr(client_fd); } +struct in_addr *client_inaddr(struct sockaddr *sa) +{ + struct sockaddr_in *sockin = (struct sockaddr_in *) (sa); + int length = sizeof(*sa); + + if (getpeername(client_fd, sa, &length) < 0) { + DEBUG(0,("getpeername failed. Error was %s\n", strerror(errno) )); + return NULL; + } + + return &sockin->sin_addr; +} + /******************************************************************* matchname - determine if host name matches IP address. Used to confirm a hostname lookup to prevent spoof attacks diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c index e561d15f61..96fbc3f124 100644 --- a/source3/lib/util_str.c +++ b/source3/lib/util_str.c @@ -38,6 +38,7 @@ BOOL next_token(const char **ptr,char *buff, const char *sep, size_t bufsize) { const char *s; + char *pbuf; BOOL quoted; size_t len=1; @@ -59,17 +60,18 @@ BOOL next_token(const char **ptr,char *buff, const char *sep, size_t bufsize) return(False); /* copy over the token */ + pbuf = buff; for (quoted = False; len < bufsize && *s && (quoted || !strchr_m(sep,*s)); s++) { if (*s == '\"') { quoted = !quoted; } else { len++; - *buff++ = *s; + *pbuf++ = *s; } } *ptr = (*s) ? s+1 : s; - *buff = 0; + *pbuf = 0; return(True); } @@ -312,7 +314,7 @@ char *strupper_static(const char *s) static pstring str; pstrcpy(str, s); - strupper(str); + strupper_m(str); return str; } @@ -325,9 +327,9 @@ void strnorm(char *s) { extern int case_default; if (case_default == CASE_UPPER) - strupper(s); + strupper_m(s); else - strlower(s); + strlower_m(s); } /** @@ -1109,6 +1111,26 @@ char *strrchr_m(const char *s, char c) return (char *)(s+strlen(s2)); } +/*********************************************************************** + Return the equivalent of doing strrchr 'n' times - always going + backwards. +***********************************************************************/ + +char *strnrchr_m(const char *s, char c, unsigned int n) +{ + wpstring ws; + pstring s2; + smb_ucs2_t *p; + + push_ucs2(NULL, ws, s, sizeof(ws), STR_TERMINATE); + p = strnrchr_w(ws, UCS2_CHAR(c), n); + if (!p) + return NULL; + *p = 0; + pull_ucs2_pstring(s2, ws); + return (char *)(s+strlen(s2)); +} + /** Convert a string to lower case. **/ @@ -1469,6 +1491,7 @@ BOOL str_list_substitute(char **list, const char *pattern, const char *insert) #define IPSTR_LIST_SEP "," +#define IPSTR_LIST_CHAR ',' /** * Add ip string representation to ipstr list. Used also @@ -1483,19 +1506,20 @@ BOOL str_list_substitute(char **list, const char *pattern, const char *insert) * reallocated to new length **/ -char* ipstr_list_add(char** ipstr_list, const struct in_addr *ip) +char* ipstr_list_add(char** ipstr_list, const struct ip_service *service) { char* new_ipstr = NULL; /* arguments checking */ - if (!ipstr_list || !ip) return NULL; + if (!ipstr_list || !service) return NULL; /* attempt to convert ip to a string and append colon separator to it */ if (*ipstr_list) { - asprintf(&new_ipstr, "%s%s%s", *ipstr_list, IPSTR_LIST_SEP,inet_ntoa(*ip)); + asprintf(&new_ipstr, "%s%s%s:%d", *ipstr_list, IPSTR_LIST_SEP, + inet_ntoa(service->ip), service->port); SAFE_FREE(*ipstr_list); } else { - asprintf(&new_ipstr, "%s", inet_ntoa(*ip)); + asprintf(&new_ipstr, "%s:%d", inet_ntoa(service->ip), service->port); } *ipstr_list = new_ipstr; return *ipstr_list; @@ -1512,7 +1536,7 @@ char* ipstr_list_add(char** ipstr_list, const struct in_addr *ip) * @return pointer to allocated ip string **/ -char* ipstr_list_make(char** ipstr_list, const struct in_addr* ip_list, int ip_count) +char* ipstr_list_make(char** ipstr_list, const struct ip_service* ip_list, int ip_count) { int i; @@ -1531,7 +1555,8 @@ char* ipstr_list_make(char** ipstr_list, const struct in_addr* ip_list, int ip_c /** * Parse given ip string list into array of ip addresses - * (as in_addr structures) + * (as ip_service structures) + * e.g. 192.168.1.100:389,192.168.1.78, ... * * @param ipstr ip string list to be parsed * @param ip_list pointer to array of ip addresses which is @@ -1539,28 +1564,40 @@ char* ipstr_list_make(char** ipstr_list, const struct in_addr* ip_list, int ip_c * @return number of succesfully parsed addresses **/ -int ipstr_list_parse(const char* ipstr_list, struct in_addr** ip_list) +int ipstr_list_parse(const char* ipstr_list, struct ip_service **ip_list) { fstring token_str; - int count; + size_t count; + int i; - if (!ipstr_list || !ip_list) return 0; + if (!ipstr_list || !ip_list) + return 0; + + count = count_chars(ipstr_list, IPSTR_LIST_CHAR) + 1; + if ( (*ip_list = (struct ip_service*)malloc(count * sizeof(struct ip_service))) == NULL ) { + DEBUG(0,("ipstr_list_parse: malloc failed for %d entries\n", count)); + return 0; + } - for (*ip_list = NULL, count = 0; - next_token(&ipstr_list, token_str, IPSTR_LIST_SEP, FSTRING_LEN); - count++) { - + for ( i=0; + next_token(&ipstr_list, token_str, IPSTR_LIST_SEP, FSTRING_LEN) && inode, ptr+10, 6); } -void uuid_generate_random(GUID *out) +void smb_uuid_generate_random(GUID *out) { GUID tmp; struct uuid uu; @@ -71,7 +71,7 @@ void uuid_generate_random(GUID *out) uuid_pack(&uu, out); } -char *guid_to_string(const GUID in) +char *smb_uuid_to_string(const GUID in) { struct uuid uu; char *out; @@ -87,7 +87,7 @@ char *guid_to_string(const GUID in) return out; } -const char *uuid_string_static(const GUID in) +const char *smb_uuid_string_static(const GUID in) { struct uuid uu; static char out[37]; diff --git a/source3/lib/wins_srv.c b/source3/lib/wins_srv.c index 3372f74dcb..4a54762fde 100644 --- a/source3/lib/wins_srv.c +++ b/source3/lib/wins_srv.c @@ -70,14 +70,24 @@ static char *wins_srv_keystr(struct in_addr wins_ip, struct in_addr src_ip) { - char *keystr; + char *keystr = NULL, *wins_ip_addr = NULL, *src_ip_addr = NULL; - if (asprintf(&keystr, WINS_SRV_FMT, inet_ntoa(wins_ip), - inet_ntoa(src_ip)) == -1) { - DEBUG(0, ("wins_srv_is_dead: malloc error\n")); - return NULL; + wins_ip_addr = strdup(inet_ntoa(wins_ip)); + src_ip_addr = strdup(inet_ntoa(src_ip)); + + if ( !wins_ip_addr || !src_ip_addr ) { + DEBUG(0,("wins_srv_keystr: malloc error\n")); + goto done; } + if (asprintf(&keystr, WINS_SRV_FMT, wins_ip_addr, src_ip_addr) == -1) { + DEBUG(0, (": ns_srv_keystr: malloc error for key string\n")); + } + +done: + SAFE_FREE(wins_ip_addr); + SAFE_FREE(src_ip_addr); + return keystr; } diff --git a/source3/libads/ads_ldap.c b/source3/libads/ads_ldap.c index 97f12de0f7..dcceaaeb83 100644 --- a/source3/libads/ads_ldap.c +++ b/source3/libads/ads_ldap.c @@ -34,7 +34,7 @@ NTSTATUS ads_name_to_sid(ADS_STRUCT *ads, int count; ADS_STATUS rc; void *res = NULL; - char *exp; + char *ldap_exp; uint32 t; NTSTATUS status = NT_STATUS_UNSUCCESSFUL; char *escaped_name = escape_ldap_string_alloc(name); @@ -45,15 +45,15 @@ NTSTATUS ads_name_to_sid(ADS_STRUCT *ads, goto done; } - if (asprintf(&exp, "(|(sAMAccountName=%s)(userPrincipalName=%s@%s))", + if (asprintf(&ldap_exp, "(|(sAMAccountName=%s)(userPrincipalName=%s@%s))", escaped_name, escaped_name, escaped_realm) == -1) { DEBUG(1,("ads_name_to_sid: asprintf failed!\n")); status = NT_STATUS_NO_MEMORY; goto done; } - rc = ads_search_retry(ads, &res, exp, attrs); - free(exp); + rc = ads_search_retry(ads, &res, ldap_exp, attrs); + free(ldap_exp); if (!ADS_ERR_OK(rc)) { DEBUG(1,("name_to_sid ads_search: %s\n", ads_errstr(rc))); goto done; @@ -102,7 +102,7 @@ NTSTATUS ads_sid_to_name(ADS_STRUCT *ads, "sAMAccountType", NULL}; ADS_STATUS rc; void *msg = NULL; - char *exp = NULL; + char *ldap_exp = NULL; char *sidstr = NULL; uint32 atype; NTSTATUS status = NT_STATUS_UNSUCCESSFUL; @@ -113,13 +113,13 @@ NTSTATUS ads_sid_to_name(ADS_STRUCT *ads, goto done; } - if (asprintf(&exp, "(objectSid=%s)", sidstr) == -1) { + if (asprintf(&ldap_exp, "(objectSid=%s)", sidstr) == -1) { DEBUG(1,("ads_sid_to_name: asprintf failed!\n")); status = NT_STATUS_NO_MEMORY; goto done; } - rc = ads_search_retry(ads, &msg, exp, attrs); + rc = ads_search_retry(ads, &msg, ldap_exp, attrs); if (!ADS_ERR_OK(rc)) { status = ads_ntstatus(rc); DEBUG(1,("ads_sid_to_name ads_search: %s\n", ads_errstr(rc))); @@ -146,7 +146,7 @@ NTSTATUS ads_sid_to_name(ADS_STRUCT *ads, done: if (msg) ads_msgfree(ads, msg); - SAFE_FREE(exp); + SAFE_FREE(ldap_exp); SAFE_FREE(sidstr); return status; diff --git a/source3/libads/ads_struct.c b/source3/libads/ads_struct.c index 652bfe31be..dd31439d83 100644 --- a/source3/libads/ads_struct.c +++ b/source3/libads/ads_struct.c @@ -94,8 +94,7 @@ ADS_STRUCT *ads_init(const char *realm, ads->server.workgroup = workgroup ? strdup(workgroup) : NULL; ads->server.ldap_server = ldap_server? strdup(ldap_server) : NULL; - /* we need to know if this is a foreign realm to know if we can - use lp_ads_server() */ + /* we need to know if this is a foreign realm */ if (realm && *realm && strcasecmp(lp_realm(), realm) != 0) { ads->server.foreign = 1; } diff --git a/source3/libads/ads_utils.c b/source3/libads/ads_utils.c index c56e7385a4..1aad0bed54 100644 --- a/source3/libads/ads_utils.c +++ b/source3/libads/ads_utils.c @@ -88,52 +88,6 @@ uint32 ads_uf2atype(uint32 uf) return atype; } -/* -translated the GROUP_CTRL Flags to GroupType (groupType) -*/ -uint32 ads_gcb2gtype(uint16 gcb) -{ - uint32 gtype = 0x00000000; - - if (gcb & GCB_ALIAS_GROUP) gtype |= GTYPE_SECURITY_BUILTIN_LOCAL_GROUP; - else if(gcb & GCB_LOCAL_GROUP) gtype |= GTYPE_SECURITY_DOMAIN_LOCAL_GROUP; - if (gcb & GCB_GLOBAL_GROUP) gtype |= GTYPE_SECURITY_GLOBAL_GROUP; - - return gtype; -} - -/* -translated the GroupType (groupType) to GROUP_CTRL Flags -*/ -uint16 ads_gtype2gcb(uint32 gtype) -{ - uint16 gcb = 0x0000; - - switch(gtype) { - case GTYPE_SECURITY_BUILTIN_LOCAL_GROUP: - gcb = GCB_ALIAS_GROUP; - break; - case GTYPE_SECURITY_DOMAIN_LOCAL_GROUP: - gcb = GCB_LOCAL_GROUP; - break; - case GTYPE_SECURITY_GLOBAL_GROUP: - gcb = GCB_GLOBAL_GROUP; - break; - - case GTYPE_DISTRIBUTION_GLOBAL_GROUP: - gcb = GCB_GLOBAL_GROUP; - break; - case GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP: - gcb = GCB_LOCAL_GROUP; - break; - case GTYPE_DISTRIBUTION_UNIVERSAL_GROUP: - gcb = GCB_GLOBAL_GROUP; - break; - } - - return gcb; -} - /* get the accountType from the groupType */ diff --git a/source3/libads/kerberos_verify.c b/source3/libads/kerberos_verify.c index 35d429ca2a..25b7f9d948 100644 --- a/source3/libads/kerberos_verify.c +++ b/source3/libads/kerberos_verify.c @@ -33,21 +33,32 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, DATA_BLOB *ap_rep, uint8 session_key[16]) { - krb5_context context; + NTSTATUS sret = NT_STATUS_LOGON_FAILURE; + krb5_context context = NULL; krb5_auth_context auth_context = NULL; krb5_keytab keytab = NULL; krb5_data packet; krb5_ticket *tkt = NULL; + krb5_rcache rcache = NULL; int ret, i; - krb5_keyblock * key; + krb5_keyblock *key = NULL; krb5_principal host_princ; - char *host_princ_s; + char *host_princ_s = NULL; fstring myname; - char *password_s; + char *password_s = NULL; krb5_data password; krb5_enctype *enctypes = NULL; +#if 0 + krb5_address local_addr; + krb5_address remote_addr; +#endif BOOL auth_ok = False; + ZERO_STRUCT(packet); + ZERO_STRUCT(password); + ZERO_STRUCTP(auth_data); + ZERO_STRUCTP(ap_rep); + if (!secrets_init()) { DEBUG(1,("secrets_init failed\n")); return NT_STATUS_LOGON_FAILURE; @@ -71,35 +82,63 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, ret = krb5_set_default_realm(context, ads->auth.realm); if (ret) { DEBUG(1,("krb5_set_default_realm failed (%s)\n", error_message(ret))); - return NT_STATUS_LOGON_FAILURE; + sret = NT_STATUS_LOGON_FAILURE; + goto out; } - /* this whole process is far more complex than I would + /* This whole process is far more complex than I would like. We have to go through all this to allow us to store the secret internally, instead of using /etc/krb5.keytab */ + ret = krb5_auth_con_init(context, &auth_context); if (ret) { DEBUG(1,("krb5_auth_con_init failed (%s)\n", error_message(ret))); - return NT_STATUS_LOGON_FAILURE; + sret = NT_STATUS_LOGON_FAILURE; + goto out; } fstrcpy(myname, global_myname()); - strlower(myname); + strlower_m(myname); asprintf(&host_princ_s, "HOST/%s@%s", myname, lp_realm()); ret = krb5_parse_name(context, host_princ_s, &host_princ); if (ret) { DEBUG(1,("krb5_parse_name(%s) failed (%s)\n", host_princ_s, error_message(ret))); - return NT_STATUS_LOGON_FAILURE; + sret = NT_STATUS_LOGON_FAILURE; + goto out; } + /* + * JRA. We must set the rcache and the allowed addresses in the auth_context + * here. This will prevent replay attacks and ensure the client has got a key from + * the correct IP address. + */ + + ret = krb5_get_server_rcache(context, krb5_princ_component(context, host_princ, 0), &rcache); + if (ret) { + DEBUG(1,("krb5_get_server_rcache failed (%s)\n", error_message(ret))); + sret = NT_STATUS_LOGON_FAILURE; + goto out; + } + + ret = krb5_auth_con_setrcache(context, auth_context, rcache); + if (ret) { + DEBUG(1,("krb5_auth_con_setrcache failed (%s)\n", error_message(ret))); + sret = NT_STATUS_LOGON_FAILURE; + goto out; + } + + /* Now we need to add the addresses.... JRA. */ + if (!(key = (krb5_keyblock *)malloc(sizeof(*key)))) { - return NT_STATUS_NO_MEMORY; + sret = NT_STATUS_NO_MEMORY; + goto out; } if ((ret = get_kerberos_allowed_etypes(context, &enctypes))) { DEBUG(1,("krb5_get_permitted_enctypes failed (%s)\n", error_message(ret))); - return NT_STATUS_LOGON_FAILURE; + sret = NT_STATUS_LOGON_FAILURE; + goto out; } /* we need to setup a auth context with each possible encoding type in turn */ @@ -124,23 +163,26 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, if (!auth_ok) { DEBUG(3,("krb5_rd_req with auth failed (%s)\n", error_message(ret))); - return NT_STATUS_LOGON_FAILURE; + sret = NT_STATUS_LOGON_FAILURE; + goto out; } ret = krb5_mk_rep(context, auth_context, &packet); if (ret) { DEBUG(3,("Failed to generate mutual authentication reply (%s)\n", error_message(ret))); - krb5_auth_con_free(context, auth_context); - return NT_STATUS_LOGON_FAILURE; + sret = NT_STATUS_LOGON_FAILURE; + goto out; } *ap_rep = data_blob(packet.data, packet.length); free(packet.data); - krb5_get_smb_session_key(context, auth_context, session_key); - DEBUG(0,("SMB session key (from ticket) follows:\n")); - dump_data(0, session_key, 16); + get_krb5_smb_session_key(context, auth_context, session_key); +#ifdef DEBUG_PASSWORD + DEBUG(10,("SMB session key (from ticket) follows:\n")); + dump_data(10, session_key, 16); +#endif #if 0 file_save("/tmp/ticket.dat", ticket->data, ticket->length); @@ -165,15 +207,30 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, principal))) { DEBUG(3,("krb5_unparse_name failed (%s)\n", error_message(ret))); + sret = NT_STATUS_LOGON_FAILURE; + goto out; + } + + sret = NT_STATUS_OK; + + out: + + if (!NT_STATUS_IS_OK(sret)) data_blob_free(auth_data); + + if (!NT_STATUS_IS_OK(sret)) data_blob_free(ap_rep); + + SAFE_FREE(host_princ_s); + SAFE_FREE(password_s); + + if (auth_context) krb5_auth_con_free(context, auth_context); - return NT_STATUS_LOGON_FAILURE; - } - krb5_auth_con_free(context, auth_context); + if (context) + krb5_free_context(context); - return NT_STATUS_OK; + return sret; } #endif /* HAVE_KRB5 */ diff --git a/source3/libads/krb5_setpw.c b/source3/libads/krb5_setpw.c index 214871b3fb..80ef6cdf01 100644 --- a/source3/libads/krb5_setpw.c +++ b/source3/libads/krb5_setpw.c @@ -195,9 +195,9 @@ static const struct kpasswd_errors { {0, NULL} }; -static krb5_error_code krb5_setpw_result_code_string(krb5_context context, - int result_code, - const char **code_string) +static krb5_error_code setpw_result_code_string(krb5_context context, + int result_code, + const char **code_string) { unsigned int idx = 0; @@ -311,7 +311,7 @@ static krb5_error_code parse_setpw_reply(krb5_context context, return 0; else { const char *errstr; - krb5_setpw_result_code_string(context, res_code, &errstr); + setpw_result_code_string(context, res_code, &errstr); DEBUG(1, ("Error changing password: %s\n", errstr)); switch(res_code) { @@ -457,8 +457,8 @@ static ADS_STATUS do_krb5_kpasswd_request(krb5_context context, return ADS_SUCCESS; } -ADS_STATUS krb5_set_password(const char *kdc_host, const char *princ, const char *newpw, - int time_offset) +ADS_STATUS ads_krb5_set_password(const char *kdc_host, const char *princ, + const char *newpw, int time_offset) { ADS_STATUS aret; @@ -570,11 +570,11 @@ kerb_prompter(krb5_context ctx, void *data, return 0; } -static ADS_STATUS krb5_chg_password(const char *kdc_host, - const char *principal, - const char *oldpw, - const char *newpw, - int time_offset) +static ADS_STATUS ads_krb5_chg_password(const char *kdc_host, + const char *principal, + const char *oldpw, + const char *newpw, + int time_offset) { ADS_STATUS aret; krb5_error_code ret; @@ -648,11 +648,11 @@ ADS_STATUS kerberos_set_password(const char *kpasswd_server, } if (!strcmp(auth_principal, target_principal)) - return krb5_chg_password(kpasswd_server, target_principal, - auth_password, new_password, time_offset); + return ads_krb5_chg_password(kpasswd_server, target_principal, + auth_password, new_password, time_offset); else - return krb5_set_password(kpasswd_server, target_principal, - new_password, time_offset); + return ads_krb5_set_password(kpasswd_server, target_principal, + new_password, time_offset); } @@ -671,15 +671,16 @@ ADS_STATUS ads_set_machine_password(ADS_STRUCT *ads, char *host = strdup(hostname); char *principal; - strlower(host); + strlower_m(host); /* we need to use the '$' form of the name here, as otherwise the server might end up setting the password for a user instead */ - asprintf(&principal, "%s$@%s", host, ads->auth.realm); + asprintf(&principal, "%s$@%s", host, ads->config.realm); - status = krb5_set_password(ads->auth.kdc_server, principal, password, ads->auth.time_offset); + status = ads_krb5_set_password(ads->auth.kdc_server, principal, + password, ads->auth.time_offset); free(host); free(principal); diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c index 3ce80975da..92f7f7645a 100644 --- a/source3/libads/ldap.c +++ b/source3/libads/ldap.c @@ -41,6 +41,9 @@ /* try a connection to a given ldap server, returning True and setting the servers IP in the ads struct if successful + + TODO : add a negative connection cache in here leveraged off of the one + found in the rpc code. --jerry */ static BOOL ads_try_connect(ADS_STRUCT *ads, const char *server, unsigned port) { @@ -90,133 +93,81 @@ static BOOL ads_try_connect_uri(ADS_STRUCT *ads) return False; } -/* used by the IP comparison function */ -struct ldap_ip { - struct in_addr ip; - unsigned port; -}; - -/* compare 2 ldap IPs by nearness to our interfaces - used in qsort */ -static int ldap_ip_compare(struct ldap_ip *ip1, struct ldap_ip *ip2) -{ - return ip_compare(&ip1->ip, &ip2->ip); -} +/********************************************************************** + Try to find an AD dc using our internal name resolution routines + Try the realm first and then then workgroup name if netbios is not + disabled +**********************************************************************/ -/* try connecting to a ldap server via DNS */ -static BOOL ads_try_dns(ADS_STRUCT *ads) +static BOOL ads_find_dc(ADS_STRUCT *ads) { const char *c_realm; - const char *ptr; - char *realm; - char *list = NULL; - pstring tok; - struct ldap_ip *ip_list; int count, i=0; + struct ip_service *ip_list; + pstring realm; + BOOL got_realm = False; + /* realm */ c_realm = ads->server.realm; if (!c_realm || !*c_realm) { c_realm = lp_realm(); } - if (!c_realm || !*c_realm) { - c_realm = ads->server.workgroup; - } - if (!c_realm || !*c_realm) { - c_realm = lp_workgroup(); - } - if (!c_realm) { - return False; - } - realm = smb_xstrdup(c_realm); + if ( c_realm ) + got_realm = True; - DEBUG(6,("ads_try_dns: looking for realm '%s'\n", realm)); - if (ldap_domain2hostlist(realm, &list) != LDAP_SUCCESS) { - SAFE_FREE(realm); - return False; + +again: + /* we need to try once with the realm name and fallback to the + netbios domain name if we fail (if netbios has not been disabled */ + + if ( !got_realm && !lp_disable_netbios() ) { + c_realm = ads->server.workgroup; + if (!c_realm || !*c_realm) + c_realm = lp_workgroup(); + if (!c_realm) + return False; } + + pstrcpy( realm, c_realm ); - DEBUG(6,("ads_try_dns: ldap realm '%s' host list '%s'\n", realm, list)); - SAFE_FREE(realm); + DEBUG(6,("ads_find_dc: looking for %s '%s'\n", + (got_realm ? "realm" : "domain"), realm)); - count = count_chars(list, ' ') + 1; - ip_list = malloc(count * sizeof(struct ldap_ip)); - if (!ip_list) { - return False; - } - - ptr = list; - while (next_token(&ptr, tok, " ", sizeof(tok))) { - unsigned port = LDAP_PORT; - char *p = strchr(tok, ':'); - if (p) { - *p = 0; - port = atoi(p+1); - } - ip_list[i].ip = *interpret_addr2(tok); - ip_list[i].port = port; - if (!is_zero_ip(ip_list[i].ip)) { - i++; + if ( !get_sorted_dc_list(realm, &ip_list, &count, got_realm) ) { + /* fall back to netbios if we can */ + if ( got_realm && !lp_disable_netbios() ) { + got_realm = False; + goto again; } + + return False; } - free(list); - - count = i; - - /* we sort the list of addresses by closeness to our interfaces. This - tries to prevent us using a DC on the other side of the country */ - if (count > 1) { - qsort(ip_list, count, sizeof(struct ldap_ip), - QSORT_CAST ldap_ip_compare); - } - - for (i=0;iserver.workgroup; - BOOL list_ordered; - - if (!workgroup) { - workgroup = lp_workgroup(); - } - - DEBUG(6,("ads_try_netbios: looking for workgroup '%s'\n", workgroup)); - - /* try the PDC first */ - if (get_pdc_ip(workgroup, &pdc_ip)) { - DEBUG(6,("ads_try_netbios: trying server '%s'\n", - inet_ntoa(pdc_ip))); - if (ads_try_connect(ads, inet_ntoa(pdc_ip), LDAP_PORT)) - return True; - } - - /* now any DC, including backups */ - if (get_dc_list(workgroup, &ip_list, &count, &list_ordered)) { - for (i=0;iserver.foreign && - ads_try_connect(ads, lp_ads_server(), LDAP_PORT)) { - goto got_connection; - } - - /* try via DNS */ - if (ads_try_dns(ads)) { - goto got_connection; - } - - /* try via netbios lookups */ - if (!lp_disable_netbios() && ads_try_netbios(ads)) { + if (ads_find_dc(ads)) { goto got_connection; } @@ -278,7 +216,7 @@ got_connection: /* by default use the machine account */ fstring myname; fstrcpy(myname, global_myname()); - strlower(myname); + strlower_m(myname); asprintf(&ads->auth.user_name, "HOST/%s", myname); } @@ -400,7 +338,7 @@ static char **ads_pull_strvals(TALLOC_CTX *ctx, const char **in_vals) * again when the entire search is complete * @param ads connection to ads server * @param bind_path Base dn for the search - * @param scope Scope of search (LDAP_BASE | LDAP_ONE | LDAP_SUBTREE) + * @param scope Scope of search (LDAP_SCOPE_BASE | LDAP_SCOPE_ONE | LDAP_SCOPE_SUBTREE) * @param expr Search expression - specified in local charset * @param attrs Attributes to retrieve - specified in utf8 or ascii * @param res ** which will contain results - free res* with ads_msgfree() @@ -540,7 +478,7 @@ done: * all entries in a large search. * @param ads connection to ads server * @param bind_path Base dn for the search - * @param scope Scope of search (LDAP_BASE | LDAP_ONE | LDAP_SUBTREE) + * @param scope Scope of search (LDAP_SCOPE_BASE | LDAP_SCOPE_ONE | LDAP_SCOPE_SUBTREE) * @param expr Search expression * @param attrs Attributes to retrieve * @param res ** which will contain results - free res* with ads_msgfree() @@ -587,7 +525,7 @@ ADS_STATUS ads_do_search_all(ADS_STRUCT *ads, const char *bind_path, * runs the function as each page is returned, using ads_process_results() * @param ads connection to ads server * @param bind_path Base dn for the search - * @param scope Scope of search (LDAP_BASE | LDAP_ONE | LDAP_SUBTREE) + * @param scope Scope of search (LDAP_SCOPE_BASE | LDAP_SCOPE_ONE | LDAP_SCOPE_SUBTREE) * @param expr Search expression - specified in local charset * @param attrs Attributes to retrieve - specified in UTF-8 or ascii * @param fn Function which takes attr name, values list, and data_area @@ -629,7 +567,7 @@ ADS_STATUS ads_do_search_all_fn(ADS_STRUCT *ads, const char *bind_path, * Do a search with a timeout. * @param ads connection to ads server * @param bind_path Base dn for the search - * @param scope Scope of search (LDAP_BASE | LDAP_ONE | LDAP_SUBTREE) + * @param scope Scope of search (LDAP_SCOPE_BASE | LDAP_SCOPE_ONE | LDAP_SCOPE_SUBTREE) * @param expr Search expression * @param attrs Attributes to retrieve * @param res ** which will contain results - free res* with ads_msgfree() @@ -749,14 +687,15 @@ void ads_memfree(ADS_STRUCT *ads, void *mem) /** * Get a dn from search results * @param ads connection to ads server - * @param res Search results + * @param msg Search result * @return dn string **/ -char *ads_get_dn(ADS_STRUCT *ads, void *res) +char *ads_get_dn(ADS_STRUCT *ads, void *msg) { char *utf8_dn, *unix_dn; - utf8_dn = ldap_get_dn(ads->ld, res); + utf8_dn = ldap_get_dn(ads->ld, msg); + pull_utf8_allocate((void **) &unix_dn, utf8_dn); ldap_memfree(utf8_dn); return unix_dn; @@ -998,7 +937,7 @@ ADS_STATUS ads_del_dn(ADS_STRUCT *ads, char *del_dn) return ADS_ERROR_NT(NT_STATUS_NO_MEMORY); } - ret = ldap_delete(ads->ld, utf8_dn); + ret = ldap_delete_s(ads->ld, utf8_dn); return ADS_ERROR(ret); } @@ -1058,13 +997,13 @@ static ADS_STATUS ads_add_machine_acct(ADS_STRUCT *ads, const char *hostname, psp = talloc_asprintf(ctx, "HOST/%s.%s", hostname, ads->config.realm); - strlower(&psp[5]); + strlower_m(&psp[5]); servicePrincipalName[1] = psp; servicePrincipalName[2] = talloc_asprintf(ctx, "CIFS/%s", hostname); psp2 = talloc_asprintf(ctx, "CIFS/%s.%s", hostname, ads->config.realm); - strlower(&psp2[5]); + strlower_m(&psp2[5]); servicePrincipalName[3] = psp2; free(ou_str); @@ -1078,6 +1017,7 @@ static ADS_STATUS ads_add_machine_acct(ADS_STRUCT *ads, const char *hostname, #ifndef ENCTYPE_ARCFOUR_HMAC acct_control |= UF_USE_DES_KEY_ONLY; #endif + if (!(controlstr = talloc_asprintf(ctx, "%u", acct_control))) goto done; @@ -1142,7 +1082,7 @@ static void dump_guid(const char *field, struct berval **values) GUID guid; for (i=0; values[i]; i++) { memcpy(guid.info, values[i]->bv_val, sizeof(guid.info)); - printf("%s: %s\n", field, uuid_string_static(guid)); + printf("%s: %s\n", field, smb_uuid_string_static(guid)); } } @@ -1345,7 +1285,7 @@ ADS_STATUS ads_join_realm(ADS_STRUCT *ads, const char *hostname, /* hostname must be lowercase */ host = strdup(hostname); - strlower(host); + strlower_m(host); status = ads_find_machine_acct(ads, (void **)&res, host); if (ADS_ERR_OK(status) && ads_count_replies(ads, res) == 1) { @@ -1384,13 +1324,13 @@ ADS_STATUS ads_join_realm(ADS_STRUCT *ads, const char *hostname, ADS_STATUS ads_leave_realm(ADS_STRUCT *ads, const char *hostname) { ADS_STATUS status; - void *res; + void *res, *msg; char *hostnameDN, *host; int rc; /* hostname must be lowercase */ host = strdup(hostname); - strlower(host); + strlower_m(host); status = ads_find_machine_acct(ads, &res, host); if (!ADS_ERR_OK(status)) { @@ -1398,7 +1338,12 @@ ADS_STATUS ads_leave_realm(ADS_STRUCT *ads, const char *hostname) return status; } - hostnameDN = ads_get_dn(ads, (LDAPMessage *)res); + msg = ads_first_entry(ads, res); + if (!msg) { + return ADS_ERROR_SYSTEM(ENOENT); + } + + hostnameDN = ads_get_dn(ads, (LDAPMessage *)msg); rc = ldap_delete_s(ads->ld, hostnameDN); ads_memfree(ads, hostnameDN); if (rc != LDAP_SUCCESS) { diff --git a/source3/libads/ldap_printer.c b/source3/libads/ldap_printer.c index f5cd4f2885..b650a5eb38 100644 --- a/source3/libads/ldap_printer.c +++ b/source3/libads/ldap_printer.c @@ -31,7 +31,7 @@ ADS_STATUS ads_find_printer_on_server(ADS_STRUCT *ads, void **res, const char *printer, const char *servername) { ADS_STATUS status; - char *srv_dn, **srv_cn, *exp; + char *srv_dn, **srv_cn, *s; const char *attrs[] = {"*", "nTSecurityDescriptor", NULL}; status = ads_find_machine_acct(ads, res, servername); @@ -44,15 +44,29 @@ ADS_STATUS ads_find_printer_on_server(ADS_STRUCT *ads, void **res, srv_cn = ldap_explode_dn(srv_dn, 1); ads_msgfree(ads, *res); - asprintf(&exp, "(cn=%s-%s)", srv_cn[0], printer); - status = ads_search(ads, res, exp, attrs); + asprintf(&s, "(cn=%s-%s)", srv_cn[0], printer); + status = ads_search(ads, res, s, attrs); ldap_memfree(srv_dn); ldap_value_free(srv_cn); - free(exp); + free(s); return status; } +ADS_STATUS ads_find_printers(ADS_STRUCT *ads, void **res) +{ + char *ldap_expr; + const char *attrs[] = { "objectClass", "printerName", "location", "driverName", + "serverName", "description", NULL }; + + /* For the moment only display all printers */ + + ldap_expr = "(&(!(showInAdvancedViewOnly=TRUE))(uncName=*)" + "(objectCategory=printQueue))"; + + return ads_search(ads, res, ldap_expr, attrs); +} + /* modify a printer entry in the directory */ @@ -338,4 +352,3 @@ BOOL get_local_printer_publishing_data(TALLOC_CTX *mem_ctx, } #endif - diff --git a/source3/libads/ldap_user.c b/source3/libads/ldap_user.c index 7efe5338f3..e70249dd78 100644 --- a/source3/libads/ldap_user.c +++ b/source3/libads/ldap_user.c @@ -28,16 +28,16 @@ ADS_STATUS ads_find_user_acct(ADS_STRUCT *ads, void **res, const char *user) { ADS_STATUS status; - char *exp; + char *ldap_exp; const char *attrs[] = {"*", NULL}; char *escaped_user = escape_ldap_string_alloc(user); if (!escaped_user) { return ADS_ERROR(LDAP_NO_MEMORY); } - asprintf(&exp, "(samAccountName=%s)", escaped_user); - status = ads_search(ads, res, exp, attrs); - SAFE_FREE(exp); + asprintf(&ldap_exp, "(samAccountName=%s)", escaped_user); + status = ads_search(ads, res, ldap_exp, attrs); + SAFE_FREE(ldap_exp); SAFE_FREE(escaped_user); return status; } diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c index 29d4533a54..598208b17f 100644 --- a/source3/libads/sasl.c +++ b/source3/libads/sasl.c @@ -198,8 +198,11 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) if (ads_kinit_password(ads) == 0) { status = ads_sasl_spnego_krb5_bind(ads, principal); } - if (ADS_ERR_OK(status)) + /* only fallback to NTLMSSP if allowed */ + if (ADS_ERR_OK(status) || + !(ads->auth.flags & ADS_AUTH_ALLOW_NTLMSSP)) { return status; + } } #endif diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c index 32397173da..fa9af19bf5 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c @@ -270,28 +270,41 @@ static BOOL cli_session_setup_nt1(struct cli_state *cli, const char *user, if (passlen != 24) { if (lp_client_ntlmv2_auth()) { DATA_BLOB server_chal; - + DATA_BLOB names_blob; server_chal = data_blob(cli->secblob.data, MIN(cli->secblob.length, 8)); - if (!SMBNTLMv2encrypt(user, workgroup, pass, server_chal, + /* note that the 'workgroup' here is a best guess - we don't know + the server's domain at this point. The 'server name' is also + dodgy... + */ + names_blob = NTLMv2_generate_names_blob(cli->called.name, workgroup); + + if (!SMBNTLMv2encrypt(user, workgroup, pass, &server_chal, + &names_blob, &lm_response, &nt_response, &session_key)) { + data_blob_free(&names_blob); data_blob_free(&server_chal); return False; } + data_blob_free(&names_blob); data_blob_free(&server_chal); } else { uchar nt_hash[16]; E_md4hash(pass, nt_hash); + nt_response = data_blob(NULL, 24); + SMBNTencrypt(pass,cli->secblob.data,nt_response.data); + /* non encrypted password supplied. Ignore ntpass. */ if (lp_client_lanman_auth()) { lm_response = data_blob(NULL, 24); - SMBencrypt(pass,cli->secblob.data,lm_response.data); + SMBencrypt(pass,cli->secblob.data, lm_response.data); + } else { + /* LM disabled, place NT# in LM feild instead */ + lm_response = data_blob(nt_response.data, nt_response.length); } - nt_response = data_blob(NULL, 24); - SMBNTencrypt(pass,cli->secblob.data,nt_response.data); session_key = data_blob(NULL, 16); SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data); } @@ -440,6 +453,8 @@ static DATA_BLOB cli_session_setup_blob_receive(struct cli_state *cli) return blob2; } +#ifdef HAVE_KRB5 + /**************************************************************************** Send a extended security session setup blob, returning a reply blob. ****************************************************************************/ @@ -454,7 +469,6 @@ static DATA_BLOB cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob) return cli_session_setup_blob_receive(cli); } -#ifdef HAVE_KRB5 /**************************************************************************** Use in-memory credentials cache ****************************************************************************/ @@ -490,7 +504,8 @@ static BOOL cli_session_setup_kerberos(struct cli_state *cli, const char *princi return !cli_is_error(cli); } -#endif +#endif /* HAVE_KRB5 */ + /**************************************************************************** Do a spnego/NTLMSSP encrypted session setup. @@ -525,11 +540,18 @@ static BOOL cli_session_setup_ntlmssp(struct cli_state *cli, const char *user, ntlmssp_state->use_ntlmv2 = lp_client_ntlmv2_auth(); + if (cli->sign_info.negotiated_smb_signing + || cli->sign_info.mandatory_signing) { + ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN; + ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN; + } + do { nt_status = ntlmssp_client_update(ntlmssp_state, blob_in, &blob_out); data_blob_free(&blob_in); if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { + DATA_BLOB null = data_blob(NULL, 0); if (turn == 1) { /* and wrap it in a SPNEGO wrapper */ msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out); @@ -538,14 +560,16 @@ static BOOL cli_session_setup_ntlmssp(struct cli_state *cli, const char *user, msg1 = spnego_gen_auth(blob_out); } + cli_simple_set_signing(cli, + ntlmssp_state->session_key.data, + null); + /* now send that blob on its way */ if (!cli_session_setup_blob_send(cli, msg1)) { return False; } data_blob_free(&msg1); - cli_ntlmssp_set_signing(cli, ntlmssp_state); - blob = cli_session_setup_blob_receive(cli); nt_status = cli_nt_error(cli); @@ -566,7 +590,6 @@ static BOOL cli_session_setup_ntlmssp(struct cli_state *cli, const char *user, } data_blob_free(&tmp_blob); } else { - /* the server might give us back two challenges */ if (!spnego_parse_auth_response(blob, nt_status, &blob_in)) { DEBUG(3,("Failed to parse auth response\n")); @@ -704,8 +727,22 @@ BOOL cli_session_setup(struct cli_state *cli, /* if its an older server then we have to use the older request format */ - if (cli->protocol < PROTOCOL_NT1) + if (cli->protocol < PROTOCOL_NT1) { + if (!lp_client_lanman_auth() && passlen != 24 && (*pass)) { + DEBUG(1, ("Server requested LM password but 'client lanman auth'" + " is disabled\n")); + return False; + } + + if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0 && + !lp_client_plaintext_auth() && (*pass)) { + DEBUG(1, ("Server requested plaintext password but 'client use plaintext auth'" + " is disabled\n")); + return False; + } + return cli_session_setup_lanman2(cli, user, pass, passlen, workgroup); + } /* if no user is supplied then we have to do an anonymous connection. passwords are ignored */ @@ -717,17 +754,21 @@ BOOL cli_session_setup(struct cli_state *cli, password at this point. The password is sent in the tree connect */ - if ((cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0) + if ((cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL) == 0) return cli_session_setup_plaintext(cli, user, "", workgroup); /* if the server doesn't support encryption then we have to use plaintext. The second password is ignored */ - if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) + if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) { + if (!lp_client_plaintext_auth() && (*pass)) { + DEBUG(1, ("Server requested plaintext password but 'client use plaintext auth'" + " is disabled\n")); + return False; + } return cli_session_setup_plaintext(cli, user, pass, workgroup); + } - /* Indidicate signing */ - /* if the server supports extended security then use SPNEGO */ if (cli->capabilities & CAP_EXTENDED_SECURITY) @@ -780,6 +821,12 @@ BOOL cli_send_tconX(struct cli_state *cli, } if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) && *pass && passlen != 24) { + if (!lp_client_lanman_auth()) { + DEBUG(1, ("Server requested LANMAN password but 'client use lanman auth'" + " is disabled\n")); + return False; + } + /* * Non-encrypted passwords - convert to DOS codepage before encryption. */ @@ -787,10 +834,17 @@ BOOL cli_send_tconX(struct cli_state *cli, SMBencrypt(pass,cli->secblob.data,(uchar *)pword); } else { if((cli->sec_mode & (NEGOTIATE_SECURITY_USER_LEVEL|NEGOTIATE_SECURITY_CHALLENGE_RESPONSE)) == 0) { + if (!lp_client_plaintext_auth() && (*pass)) { + DEBUG(1, ("Server requested plaintext password but 'client use plaintext auth'" + " is disabled\n")); + return False; + } + /* * Non-encrypted passwords - convert to DOS codepage before using. */ passlen = clistr_push(cli, pword, pass, sizeof(pword), STR_TERMINATE); + } else { memcpy(pword, pass, passlen); } @@ -823,9 +877,6 @@ BOOL cli_send_tconX(struct cli_state *cli, clistr_pull(cli, cli->dev, smb_buf(cli->inbuf), sizeof(fstring), -1, STR_TERMINATE|STR_ASCII); - if (strcasecmp(share,"IPC$")==0) - fstrcpy(cli->dev, "IPC"); - if (cli->protocol >= PROTOCOL_NT1 && smb_buflen(cli->inbuf) == 3) { /* almost certainly win95 - enable bug fixes */ @@ -962,12 +1013,24 @@ BOOL cli_negprot(struct cli_state *cli) smb_buflen(cli->inbuf)-8, STR_UNICODE|STR_NOALIGN); } - if ((cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED)) + if ((cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED)) { + /* Fail if signing is mandatory and we don't want to support it. */ + if (!lp_client_signing()) { + DEBUG(1,("cli_negprot: SMB signing is mandatory and we have disabled it.\n")); + return False; + } cli->sign_info.negotiated_smb_signing = True; + } if ((cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) && cli->sign_info.allow_smb_signing) cli->sign_info.negotiated_smb_signing = True; + /* Fail if signing is mandatory and the server doesn't support it. */ + if (cli->sign_info.mandatory_signing && !(cli->sign_info.negotiated_smb_signing)) { + DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n")); + return False; + } + } else if (cli->protocol >= PROTOCOL_LANMAN1) { cli->use_spnego = False; cli->sec_mode = SVAL(cli->inbuf,smb_vwv1); @@ -1369,6 +1432,12 @@ NTSTATUS cli_raw_tcon(struct cli_state *cli, { char *p; + if (!lp_client_plaintext_auth() && (*pass)) { + DEBUG(1, ("Server requested plaintext password but 'client use plaintext auth'" + " is disabled\n")); + return NT_STATUS_ACCESS_DENIED; + } + memset(cli->outbuf,'\0',smb_size); memset(cli->inbuf,'\0',smb_size); @@ -1433,7 +1502,7 @@ struct cli_state *get_ipc_connect(char *server, struct in_addr *server_ip, struct cli_state *get_ipc_connect_master_ip_bcast(pstring workgroup, struct user_auth_info *user_info) { - struct in_addr *ip_list; + struct ip_service *ip_list; struct cli_state *cli; int i, count; struct in_addr server_ip; @@ -1447,7 +1516,7 @@ struct cli_state *get_ipc_connect_master_ip_bcast(pstring workgroup, struct user for (i = 0; i < count; i++) { static fstring name; - if (!name_status_find("*", 0, 0x1d, ip_list[i], name)) + if (!name_status_find("*", 0, 0x1d, ip_list[i].ip, name)) continue; if (!find_master_ip(name, &server_ip)) @@ -1456,7 +1525,7 @@ struct cli_state *get_ipc_connect_master_ip_bcast(pstring workgroup, struct user pstrcpy(workgroup, name); DEBUG(4, ("found master browser %s, %s\n", - name, inet_ntoa(ip_list[i]))); + name, inet_ntoa(ip_list[i].ip))); cli = get_ipc_connect(inet_ntoa(server_ip), &server_ip, user_info); diff --git a/source3/libsmb/clientgen.c b/source3/libsmb/clientgen.c index 8d4e8a266c..58c5ad8cd3 100644 --- a/source3/libsmb/clientgen.c +++ b/source3/libsmb/clientgen.c @@ -203,12 +203,9 @@ void cli_init_creds(struct cli_state *cli, const struct ntuser_creds *usr) fstrcpy(cli->domain , usr->domain); fstrcpy(cli->user_name, usr->user_name); memcpy(&cli->pwd, &usr->pwd, sizeof(usr->pwd)); - cli->ntlmssp_flags = usr->ntlmssp_flags; - cli->ntlmssp_cli_flgs = usr != NULL ? usr->ntlmssp_flags : 0; - DEBUG(10,("cli_init_creds: user %s domain %s flgs: %x\nntlmssp_cli_flgs:%x\n", - cli->user_name, cli->domain, - cli->ntlmssp_flags,cli->ntlmssp_cli_flgs)); + DEBUG(10,("cli_init_creds: user %s domain %s\n", + cli->user_name, cli->domain)); } /**************************************************************************** @@ -264,6 +261,9 @@ struct cli_state *cli_initialise(struct cli_state *cli) if (lp_client_signing()) cli->sign_info.allow_smb_signing = True; + + if (lp_client_signing() == Required) + cli->sign_info.mandatory_signing = True; if (!cli->outbuf || !cli->inbuf) goto error; @@ -287,6 +287,8 @@ struct cli_state *cli_initialise(struct cli_state *cli) cli->initialised = 1; cli->allocated = alloced_cli; + cli->pipe_idx = -1; + return cli; /* Clean up after malloc() error */ @@ -302,18 +304,51 @@ struct cli_state *cli_initialise(struct cli_state *cli) return NULL; } +/**************************************************************************** +close the session +****************************************************************************/ + +void cli_nt_session_close(struct cli_state *cli) +{ + if (cli->ntlmssp_pipe_state) { + ntlmssp_client_end(&cli->ntlmssp_pipe_state); + } + + cli_close(cli, cli->nt_pipe_fnum); + cli->nt_pipe_fnum = 0; + cli->pipe_idx = -1; +} + +/**************************************************************************** +close the NETLOGON session holding the session key for NETSEC +****************************************************************************/ + +void cli_nt_netlogon_netsec_session_close(struct cli_state *cli) +{ + if (cli->saved_netlogon_pipe_fnum != 0) { + cli_close(cli, cli->saved_netlogon_pipe_fnum); + cli->saved_netlogon_pipe_fnum = 0; + } +} + /**************************************************************************** Close a client connection and free the memory without destroying cli itself. ****************************************************************************/ void cli_close_connection(struct cli_state *cli) { + cli_nt_session_close(cli); + cli_nt_netlogon_netsec_session_close(cli); + SAFE_FREE(cli->outbuf); SAFE_FREE(cli->inbuf); cli_free_signing_context(cli); data_blob_free(&cli->secblob); + if (cli->ntlmssp_pipe_state) + ntlmssp_client_end(&cli->ntlmssp_pipe_state); + if (cli->mem_ctx) { talloc_destroy(cli->mem_ctx); cli->mem_ctx = NULL; diff --git a/source3/libsmb/clifile.c b/source3/libsmb/clifile.c index b771e135f4..f021076a46 100644 --- a/source3/libsmb/clifile.c +++ b/source3/libsmb/clifile.c @@ -600,8 +600,8 @@ NTSTATUS cli_locktype(struct cli_state *cli, int fnum, /**************************************************************************** Lock a file. + note that timeout is in units of 2 milliseconds ****************************************************************************/ - BOOL cli_lock(struct cli_state *cli, int fnum, uint32 offset, uint32 len, int timeout, enum brl_type lock_type) { @@ -636,7 +636,7 @@ BOOL cli_lock(struct cli_state *cli, int fnum, cli_send_smb(cli); if (timeout != 0) { - cli->timeout = (timeout == -1) ? 0x7FFFFFFF : (timeout + 10*1000); + cli->timeout = (timeout == -1) ? 0x7FFFFFFF : (timeout*2 + 5*1000); } if (!cli_receive_smb(cli)) { diff --git a/source3/libsmb/clikrb5.c b/source3/libsmb/clikrb5.c index 5edc56daa9..fd5dd91325 100644 --- a/source3/libsmb/clikrb5.c +++ b/source3/libsmb/clikrb5.c @@ -235,12 +235,12 @@ krb5_error_code get_kerberos_allowed_etypes(krb5_context context, /* we can't use krb5_mk_req because w2k wants the service to be in a particular format */ -static krb5_error_code krb5_mk_req2(krb5_context context, - krb5_auth_context *auth_context, - const krb5_flags ap_req_options, - const char *principal, - krb5_ccache ccache, - krb5_data *outbuf) +static krb5_error_code ads_krb5_mk_req(krb5_context context, + krb5_auth_context *auth_context, + const krb5_flags ap_req_options, + const char *principal, + krb5_ccache ccache, + krb5_data *outbuf) { krb5_error_code retval; krb5_principal server; @@ -255,7 +255,7 @@ static krb5_error_code krb5_mk_req2(krb5_context context, } /* obtain ticket & session key */ - memset((char *)&creds, 0, sizeof(creds)); + ZERO_STRUCT(creds); if ((retval = krb5_copy_principal(context, server, &creds.server))) { DEBUG(1,("krb5_copy_principal failed (%s)\n", error_message(retval))); @@ -305,7 +305,7 @@ cleanup_princ: /* get a kerberos5 ticket for the given service */ -DATA_BLOB krb5_get_ticket(const char *principal, time_t time_offset) +DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset) { krb5_error_code retval; krb5_data packet; @@ -344,11 +344,11 @@ DATA_BLOB krb5_get_ticket(const char *principal, time_t time_offset) goto failed; } - if ((retval = krb5_mk_req2(context, - &auth_context, - 0, - principal, - ccdef, &packet))) { + if ((retval = ads_krb5_mk_req(context, + &auth_context, + 0, + principal, + ccdef, &packet))) { goto failed; } @@ -365,7 +365,7 @@ failed: return data_blob(NULL, 0); } - BOOL krb5_get_smb_session_key(krb5_context context, krb5_auth_context auth_context, uint8 session_key[16]) + BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, uint8 session_key[16]) { #ifdef ENCTYPE_ARCFOUR_HMAC krb5_keyblock *skey; @@ -390,7 +390,7 @@ failed: } #else /* HAVE_KRB5 */ /* this saves a few linking headaches */ -DATA_BLOB krb5_get_ticket(const char *principal, time_t time_offset) +DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset) { DEBUG(0,("NO KERBEROS SUPPORT\n")); return data_blob(NULL, 0); diff --git a/source3/libsmb/climessage.c b/source3/libsmb/climessage.c index 2b1be75089..8ce8416487 100644 --- a/source3/libsmb/climessage.c +++ b/source3/libsmb/climessage.c @@ -26,12 +26,11 @@ /**************************************************************************** start a message sequence ****************************************************************************/ -BOOL cli_message_start(struct cli_state *cli, char *host, char *username, - int *grp) +int cli_message_start_build(struct cli_state *cli, char *host, char *username) { char *p; - /* send a SMBsendstrt command */ + /* construct a SMBsendstrt command */ memset(cli->outbuf,'\0',smb_size); set_message(cli->outbuf,0,0,True); SCVAL(cli->outbuf,smb_com,SMBsendstrt); @@ -45,6 +44,14 @@ BOOL cli_message_start(struct cli_state *cli, char *host, char *username, p += clistr_push(cli, p, host, -1, STR_ASCII|STR_TERMINATE); cli_setup_bcc(cli, p); + + return(PTR_DIFF(p, cli->outbuf)); +} + +BOOL cli_message_start(struct cli_state *cli, char *host, char *username, + int *grp) +{ + cli_message_start_build(cli, host, username); cli_send_smb(cli); @@ -63,7 +70,7 @@ BOOL cli_message_start(struct cli_state *cli, char *host, char *username, /**************************************************************************** send a message ****************************************************************************/ -BOOL cli_message_text(struct cli_state *cli, char *msg, int len, int grp) +int cli_message_text_build(struct cli_state *cli, char *msg, int len, int grp) { char *msgdos; int lendos; @@ -93,6 +100,14 @@ BOOL cli_message_text(struct cli_state *cli, char *msg, int len, int grp) } cli_setup_bcc(cli, p); + + return(PTR_DIFF(p, cli->outbuf)); +} + +BOOL cli_message_text(struct cli_state *cli, char *msg, int len, int grp) +{ + cli_message_text_build(cli, msg, len, grp); + cli_send_smb(cli); if (!cli_receive_smb(cli)) { @@ -107,8 +122,10 @@ BOOL cli_message_text(struct cli_state *cli, char *msg, int len, int grp) /**************************************************************************** end a message ****************************************************************************/ -BOOL cli_message_end(struct cli_state *cli, int grp) +int cli_message_end_build(struct cli_state *cli, int grp) { + char *p; + memset(cli->outbuf,'\0',smb_size); set_message(cli->outbuf,1,0,True); SCVAL(cli->outbuf,smb_com,SMBsendend); @@ -117,7 +134,16 @@ BOOL cli_message_end(struct cli_state *cli, int grp) SSVAL(cli->outbuf,smb_vwv0,grp); cli_setup_packet(cli); - + + p = smb_buf(cli->outbuf); + + return(PTR_DIFF(p, cli->outbuf)); +} + +BOOL cli_message_end(struct cli_state *cli, int grp) +{ + cli_message_end_build(cli, grp); + cli_send_smb(cli); if (!cli_receive_smb(cli)) { diff --git a/source3/libsmb/clirap.c b/source3/libsmb/clirap.c index 9d4411797d..a307ac6ccf 100644 --- a/source3/libsmb/clirap.c +++ b/source3/libsmb/clirap.c @@ -92,13 +92,13 @@ BOOL cli_NetWkstaUserLogon(struct cli_state *cli,char *user, char *workstation) SSVAL(p,0,1); p += 2; pstrcpy_base(p,user,param); - strupper(p); + strupper_m(p); p += 21; p++; p += 15; p++; pstrcpy_base(p, workstation, param); - strupper(p); + strupper_m(p); p += 16; SSVAL(p, 0, CLI_BUFFER_SIZE); p += 2; diff --git a/source3/libsmb/clirap2.c b/source3/libsmb/clirap2.c index 948e88061a..669b33860d 100644 --- a/source3/libsmb/clirap2.c +++ b/source3/libsmb/clirap2.c @@ -1396,11 +1396,11 @@ BOOL cli_NetWkstaUserLogoff(struct cli_state *cli,char *user, char *workstation) PUTDWORD(p, 0); /* Null pointer */ PUTDWORD(p, 0); /* Null pointer */ fstrcpy(upperbuf, user); - strupper(upperbuf); + strupper_m(upperbuf); PUTSTRINGF(p, upperbuf, RAP_USERNAME_LEN); p++; /* strange format, but ok */ fstrcpy(upperbuf, workstation); - strupper(upperbuf); + strupper_m(upperbuf); PUTSTRINGF(p, upperbuf, RAP_MACHNAME_LEN); PUTWORD(p, CLI_BUFFER_SIZE); PUTWORD(p, CLI_BUFFER_SIZE); diff --git a/source3/libsmb/clispnego.c b/source3/libsmb/clispnego.c index 53f7eb6e7d..bb48f57915 100644 --- a/source3/libsmb/clispnego.c +++ b/source3/libsmb/clispnego.c @@ -329,7 +329,7 @@ DATA_BLOB spnego_gen_negTokenTarg(const char *principal, int time_offset) const char *krb_mechs[] = {OID_KERBEROS5_OLD, OID_NTLMSSP, NULL}; /* get a kerberos ticket for the service */ - tkt = krb5_get_ticket(principal, time_offset); + tkt = cli_krb5_get_ticket(principal, time_offset); /* wrap that up in a nice GSS-API wrapping */ tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ); diff --git a/source3/libsmb/namecache.c b/source3/libsmb/namecache.c index d3541b7719..e3e7ac4e3c 100644 --- a/source3/libsmb/namecache.c +++ b/source3/libsmb/namecache.c @@ -113,7 +113,7 @@ static char* namecache_key(const char *name, int name_type) **/ BOOL namecache_store(const char *name, int name_type, - int num_names, struct in_addr *ip_list) + int num_names, struct ip_service *ip_list) { time_t expiry; char *key, *value_string; @@ -126,27 +126,19 @@ BOOL namecache_store(const char *name, int name_type, */ if (!gencache_init()) return False; - DEBUG(5, ("namecache_store: storing %d address%s for %s#%02x: ", - num_names, num_names == 1 ? "": "es", name, name_type)); - - for (i = 0; i < num_names; i++) - DEBUGADD(5, ("%s%s", inet_ntoa(ip_list[i]), - i == (num_names - 1) ? "" : ", ")); - - DEBUGADD(5, ("\n")); + if ( DEBUGLEVEL >= 5 ) { + DEBUG(5, ("namecache_store: storing %d address%s for %s#%02x: ", + num_names, num_names == 1 ? "": "es", name, name_type)); + for (i = 0; i < num_names; i++) + DEBUGADD(5, ("%s:%d%s", inet_ntoa(ip_list[i].ip), + ip_list[i].port, (i == (num_names - 1) ? "" : ","))); + + DEBUGADD(5, ("\n")); + } + key = namecache_key(name, name_type); - - /* - * Cache pdc location or dc lists for only a little while - * otherwise if we lock on to a bad DC we can potentially be - * out of action for the entire cache timeout time! - */ - - if (name_type == 0x1b || name_type == 0x1c) - expiry = time(NULL) + 10; - else - expiry = time(NULL) + lp_name_cache_timeout(); + expiry = time(NULL) + lp_name_cache_timeout(); /* * Generate string representation of ip addresses list @@ -180,7 +172,7 @@ BOOL namecache_store(const char *name, int name_type, * false if name isn't found in the cache or has expired **/ -BOOL namecache_fetch(const char *name, int name_type, struct in_addr **ip_list, +BOOL namecache_fetch(const char *name, int name_type, struct ip_service **ip_list, int *num_names) { char *key, *value; @@ -201,7 +193,9 @@ BOOL namecache_fetch(const char *name, int name_type, struct in_addr **ip_list, if (!gencache_get(key, &value, &timeout)) { DEBUG(5, ("no entry for %s#%02X found.\n", name, name_type)); + gencache_del(key); SAFE_FREE(key); + SAFE_FREE(value); return False; } else { DEBUG(5, ("name %s#%02X found.\n", name, name_type)); @@ -213,7 +207,8 @@ BOOL namecache_fetch(const char *name, int name_type, struct in_addr **ip_list, *num_names = ipstr_list_parse(value, ip_list); SAFE_FREE(key); - SAFE_FREE(value); + SAFE_FREE(value); + return *num_names > 0; /* true only if some ip has been fetched */ } @@ -252,3 +247,75 @@ void namecache_flush(void) DEBUG(5, ("Namecache flushed\n")); } +/* Construct a name status record key. */ + +static char *namecache_status_record_key(const char *name, int name_type1, + int name_type2, struct in_addr keyip) +{ + char *keystr; + + asprintf(&keystr, "NBT/%s#%02X.%02X.%s", + strupper_static(name), name_type1, name_type2, inet_ntoa(keyip)); + return keystr; +} + +/* Store a name status record. */ + +BOOL namecache_status_store(const char *keyname, int keyname_type, + int name_type, struct in_addr keyip, + const char *srvname) +{ + char *key; + time_t expiry; + BOOL ret; + + if (!gencache_init()) + return False; + + key = namecache_status_record_key(keyname, keyname_type, name_type, keyip); + if (!key) + return False; + + expiry = time(NULL) + lp_name_cache_timeout(); + ret = gencache_set(key, srvname, expiry); + + if (ret) + DEBUG(5, ("namecache_status_store: entry %s -> %s\n", key, srvname )); + else + DEBUG(5, ("namecache_status_store: entry %s store failed.\n", key )); + + SAFE_FREE(key); + return ret; +} + +/* Fetch a name status record. */ + +BOOL namecache_status_fetch(const char *keyname, int keyname_type, + int name_type, struct in_addr keyip, char *srvname_out) +{ + char *key = NULL; + char *value = NULL; + time_t timeout; + + if (!gencache_init()) + return False; + + key = namecache_status_record_key(keyname, keyname_type, name_type, keyip); + if (!key) + return False; + + if (!gencache_get(key, &value, &timeout)) { + DEBUG(5, ("namecache_status_fetch: no entry for %s found.\n", key)); + gencache_del(key); + SAFE_FREE(key); + SAFE_FREE(value); + return False; + } else { + DEBUG(5, ("namecache_status_fetch: key %s -> %s\n", key, value )); + } + + strlcpy(srvname_out, value, 16); + SAFE_FREE(key); + SAFE_FREE(value); + return True; +} diff --git a/source3/libsmb/namequery.c b/source3/libsmb/namequery.c index 18ce5e4bd9..9875f77c72 100644 --- a/source3/libsmb/namequery.c +++ b/source3/libsmb/namequery.c @@ -25,8 +25,9 @@ BOOL global_in_nmbd = False; /**************************************************************************** -generate a random trn_id + Generate a random trn_id. ****************************************************************************/ + static int generate_trn_id(void) { static int trn_id; @@ -40,10 +41,10 @@ static int generate_trn_id(void) return trn_id % (unsigned)0x7FFF; } - /**************************************************************************** - parse a node status response into an array of structures + Parse a node status response into an array of structures. ****************************************************************************/ + static struct node_status *parse_node_status(char *p, int *num_names) { struct node_status *ret; @@ -51,7 +52,8 @@ static struct node_status *parse_node_status(char *p, int *num_names) *num_names = CVAL(p,0); - if (*num_names == 0) return NULL; + if (*num_names == 0) + return NULL; ret = (struct node_status *)malloc(sizeof(struct node_status)* (*num_names)); if (!ret) return NULL; @@ -71,9 +73,10 @@ static struct node_status *parse_node_status(char *p, int *num_names) /**************************************************************************** -do a NBT node status query on an open socket and return an array of -structures holding the returned names or NULL if the query failed + Do a NBT node status query on an open socket and return an array of + structures holding the returned names or NULL if the query failed. **************************************************************************/ + struct node_status *node_status_query(int fd,struct nmb_name *name, struct in_addr to_ip, int *num_names) { @@ -155,11 +158,9 @@ struct node_status *node_status_query(int fd,struct nmb_name *name, return NULL; } - /**************************************************************************** -find the first type XX name in a node status reply - used for finding -a servers name given its IP -return the matched name in *name + Find the first type XX name in a node status reply - used for finding + a servers name given its IP. Return the matched name in *name. **************************************************************************/ BOOL name_status_find(const char *q_name, int q_type, int type, struct in_addr to_ip, char *name) @@ -178,6 +179,11 @@ BOOL name_status_find(const char *q_name, int q_type, int type, struct in_addr t DEBUG(10, ("name_status_find: looking up %s#%02x at %s\n", q_name, q_type, inet_ntoa(to_ip))); + /* Check the cache first. */ + + if (namecache_status_fetch(q_name, q_type, type, to_ip, name)) + return True; + sock = open_socket_in(SOCK_DGRAM, 0, 3, interpret_addr(lp_socket_address()), True); if (sock == -1) goto done; @@ -197,6 +203,14 @@ BOOL name_status_find(const char *q_name, int q_type, int type, struct in_addr t goto done; pull_ascii(name, status[i].name, 16, 15, STR_TERMINATE); + + /* Store the result in the cache. */ + /* but don't store an entry for 0x1c names here. Here we have + a single host and DOMAIN<0x1c> names should be a list of hosts */ + + if ( q_type != 0x1c ) + namecache_status_store(q_name, q_type, type, to_ip, name); + result = True; done: @@ -205,17 +219,17 @@ BOOL name_status_find(const char *q_name, int q_type, int type, struct in_addr t DEBUG(10, ("name_status_find: name %sfound", result ? "" : "not ")); if (result) - DEBUGADD(10, (", ip address is %s", inet_ntoa(to_ip))); + DEBUGADD(10, (", name %s ip address is %s", name, inet_ntoa(to_ip))); DEBUG(10, ("\n")); return result; } - /* comparison function used by sort_ip_list */ + int ip_compare(struct in_addr *ip1, struct in_addr *ip2) { int max_bits1=0, max_bits2=0; @@ -243,11 +257,32 @@ int ip_compare(struct in_addr *ip1, struct in_addr *ip2) return max_bits2 - max_bits1; } +/******************************************************************* + compare 2 ldap IPs by nearness to our interfaces - used in qsort +*******************************************************************/ + +static int ip_service_compare(struct ip_service *ip1, struct ip_service *ip2) +{ + int result; + + if ( (result = ip_compare(&ip1->ip, &ip2->ip)) != 0 ) + return result; + + if ( ip1->port > ip2->port ) + return 1; + + if ( ip1->port < ip2->port ) + return -1; + + return 0; +} + /* sort an IP list so that names that are close to one of our interfaces are at the top. This prevents the problem where a WINS server returns an IP that is not reachable from our subnet as the first match */ + static void sort_ip_list(struct in_addr *iplist, int count) { if (count <= 1) { @@ -257,6 +292,50 @@ static void sort_ip_list(struct in_addr *iplist, int count) qsort(iplist, count, sizeof(struct in_addr), QSORT_CAST ip_compare); } +void sort_ip_list2(struct ip_service *iplist, int count) +{ + if (count <= 1) { + return; + } + + qsort(iplist, count, sizeof(struct ip_service), QSORT_CAST ip_service_compare); +} + +/********************************************************************** + Remove any duplicate address/port pairs in the list + *********************************************************************/ + +static int remove_duplicate_addrs2( struct ip_service *iplist, int count ) +{ + int i, j; + + DEBUG(10,("remove_duplicate_addrs2: looking for duplicate address/port pairs\n")); + + /* one loop to remove duplicates */ + for ( i=0; i if we are using ADS */ + if ( lp_security() != SEC_ADS ) + return False; + + DEBUG(5,("resolve_hosts: Attempting to resolve DC's for %s using DNS\n", + name)); + + if (ldap_domain2hostlist(name, &list) != LDAP_SUCCESS) + return False; + + count = count_chars(list, ' ') + 1; + if ( (*return_iplist = malloc(count * sizeof(struct ip_service))) == NULL ) { + DEBUG(0,("resolve_hosts: malloc failed for %d entries\n", count )); + return False; + } + + ptr = list; + while (next_token(&ptr, tok, " ", sizeof(tok))) { + unsigned port = LDAP_PORT; + char *p = strchr(tok, ':'); + if (p) { + *p = 0; + port = atoi(p+1); + } + (*return_iplist)[i].ip = *interpret_addr2(tok); + (*return_iplist)[i].port = port; + + /* make sure it is a valid IP. I considered checking the negative + connection cache, but this is the wrong place for it. Maybe only + as a hac. After think about it, if all of the IP addresses retuend + from DNS are dead, what hope does a netbios name lookup have? + The standard reason for falling back to netbios lookups is that + our DNS server doesn't know anything about the DC's -- jerry */ + + if ( is_zero_ip((*return_iplist)[i].ip) ) + continue; + + i++; + } + SAFE_FREE(list); + + *return_count = i; + + return True; + } +#endif /* HAVE_ADS */ *return_iplist = NULL; *return_count = 0; @@ -764,27 +946,33 @@ static BOOL resolve_hosts(const char *name, if (((hp = sys_gethostbyname(name)) != NULL) && (hp->h_addr != NULL)) { struct in_addr return_ip; putip((char *)&return_ip,(char *)hp->h_addr); - *return_iplist = (struct in_addr *)malloc(sizeof(struct in_addr)); + *return_iplist = (struct ip_service *)malloc(sizeof(struct ip_service)); if(*return_iplist == NULL) { DEBUG(3,("resolve_hosts: malloc fail !\n")); return False; } - **return_iplist = return_ip; + (*return_iplist)->ip = return_ip; + (*return_iplist)->port = PORT_NONE; *return_count = 1; return True; } return False; } -/******************************************************** +/******************************************************************* Internal interface to resolve a name into an IP address. Use this function if the string is either an IP address, DNS or host name or NetBIOS name. This uses the name switch in the smb.conf to determine the order of name resolution. -*********************************************************/ + + Added support for ip addr/port to support ADS ldap servers. + the only place we currently care about the port is in the + resolve_hosts() when looking up DC's via SRV RR entries in DNS +**********************************************************************/ static BOOL internal_resolve_name(const char *name, int name_type, - struct in_addr **return_iplist, int *return_count) + struct ip_service **return_iplist, + int *return_count, const char *resolve_order) { pstring name_resolve_list; fstring tok; @@ -793,7 +981,6 @@ static BOOL internal_resolve_name(const char *name, int name_type, BOOL allzeros = (strcmp(name,"0.0.0.0") == 0); BOOL is_address = is_ipaddress(name); BOOL result = False; - struct in_addr *nodupes_iplist; int i; *return_iplist = NULL; @@ -802,42 +989,56 @@ static BOOL internal_resolve_name(const char *name, int name_type, DEBUG(10, ("internal_resolve_name: looking up %s#%x\n", name, name_type)); if (allzeros || allones || is_address) { - *return_iplist = (struct in_addr *)malloc(sizeof(struct in_addr)); - if(*return_iplist == NULL) { - DEBUG(3,("internal_resolve_name: malloc fail !\n")); + + if ( (*return_iplist = (struct ip_service *)malloc(sizeof(struct ip_service))) == NULL ) { + DEBUG(0,("internal_resolve_name: malloc fail !\n")); return False; } + if(is_address) { + /* ignore the port here */ + (*return_iplist)->port = PORT_NONE; + /* if it's in the form of an IP address then get the lib to interpret it */ - if (((*return_iplist)->s_addr = inet_addr(name)) == 0xFFFFFFFF ){ + if (((*return_iplist)->ip.s_addr = inet_addr(name)) == 0xFFFFFFFF ){ DEBUG(1,("internal_resolve_name: inet_addr failed on %s\n", name)); return False; } } else { - (*return_iplist)->s_addr = allones ? 0xFFFFFFFF : 0; + (*return_iplist)->ip.s_addr = allones ? 0xFFFFFFFF : 0; *return_count = 1; } return True; } - /* Check netbios name cache */ + /* Check name cache */ if (namecache_fetch(name, name_type, return_iplist, return_count)) { - - /* This could be a negative response */ - - return (*return_count > 0); + /* This could be a negative response */ + return (*return_count > 0); } - pstrcpy(name_resolve_list, lp_name_resolve_order()); - ptr = name_resolve_list; - if (!ptr || !*ptr) + /* set the name resolution order */ + + if ( !resolve_order ) + pstrcpy(name_resolve_list, lp_name_resolve_order()); + else + pstrcpy(name_resolve_list, resolve_order); + + if ( !name_resolve_list[0] ) ptr = "host"; + else + ptr = name_resolve_list; + /* iterate through the name resolution backends */ + while (next_token(&ptr, tok, LIST_SEP, sizeof(tok))) { if((strequal(tok, "host") || strequal(tok, "hosts"))) { - if (name_type == 0x20) { - if (resolve_hosts(name, return_iplist, return_count)) { + /* deal with 0x20 & 0x1c names here. The latter will result + in a SRV record lookup for _ldap._tcp. if we are using + 'security = ads' */ + if ( name_type==0x20 || name_type == 0x1c ) { + if (resolve_hosts(name, name_type, return_iplist, return_count)) { result = True; goto done; } @@ -878,58 +1079,31 @@ static BOOL internal_resolve_name(const char *name, int name_type, controllers including the PDC in iplist[1..n]. Iterating over the iplist when the PDC is down will cause two sets of timeouts. */ - if (*return_count && (nodupes_iplist = (struct in_addr *) - malloc(sizeof(struct in_addr) * (*return_count)))) { - int nodupes_count = 0; - - /* Iterate over return_iplist looking for duplicates */ - - for (i = 0; i < *return_count; i++) { - BOOL is_dupe = False; - int j; - - for (j = i + 1; j < *return_count; j++) { - if (ip_equal((*return_iplist)[i], - (*return_iplist)[j])) { - is_dupe = True; - break; - } - } - - if (!is_dupe) { - - /* This one not a duplicate */ - - nodupes_iplist[nodupes_count] = (*return_iplist)[i]; - nodupes_count++; - } - } - - /* Switcheroo with original list */ - - free(*return_iplist); - - *return_iplist = nodupes_iplist; - *return_count = nodupes_count; + if ( *return_count ) { + *return_count = remove_duplicate_addrs2( *return_iplist, *return_count ); } /* Save in name cache */ - for (i = 0; i < *return_count && DEBUGLEVEL == 100; i++) - DEBUG(100, ("Storing name %s of type %d (ip: %s)\n", name, - name_type, inet_ntoa((*return_iplist)[i]))); - + if ( DEBUGLEVEL >= 100 ) { + for (i = 0; i < *return_count && DEBUGLEVEL == 100; i++) + DEBUG(100, ("Storing name %s of type %d (%s:%d)\n", name, + name_type, inet_ntoa((*return_iplist)[i].ip), (*return_iplist)[i].port)); + } + namecache_store(name, name_type, *return_count, *return_iplist); /* Display some debugging info */ - DEBUG(10, ("internal_resolve_name: returning %d addresses: ", - *return_count)); - - for (i = 0; i < *return_count; i++) - DEBUGADD(10, ("%s ", inet_ntoa((*return_iplist)[i]))); + if ( DEBUGLEVEL >= 10 ) { + DEBUG(10, ("internal_resolve_name: returning %d addresses: ", + *return_count)); - DEBUG(10, ("\n")); + for (i = 0; i < *return_count; i++) + DEBUGADD(10, ("%s:%d ", inet_ntoa((*return_iplist)[i].ip), (*return_iplist)[i].port)); + DEBUG(10, ("\n")); + } + return result; } @@ -942,7 +1116,7 @@ static BOOL internal_resolve_name(const char *name, int name_type, BOOL resolve_name(const char *name, struct in_addr *return_ip, int name_type) { - struct in_addr *ip_list = NULL; + struct ip_service *ip_list = NULL; int count = 0; if (is_ipaddress(name)) { @@ -950,20 +1124,23 @@ BOOL resolve_name(const char *name, struct in_addr *return_ip, int name_type) return True; } - if (internal_resolve_name(name, name_type, &ip_list, &count)) { + if (internal_resolve_name(name, name_type, &ip_list, &count, lp_name_resolve_order())) { int i; + /* only return valid addresses for TCP connections */ for (i=0; iheader.msg_type = 0x10; - dgram->header.flags.node_type = M_NODE; - dgram->header.flags.first = True; - dgram->header.flags.more = False; - dgram->header.dgm_id = dgm_id; - dgram->header.source_ip = *iface_ip(*pdc_ip); - dgram->header.source_port = ntohs(sock_name.sin_port); - dgram->header.dgm_length = 0; /* Let build_dgram() handle this. */ - dgram->header.packet_offset = 0; - - make_nmb_name(&dgram->source_name,srcname,0); - make_nmb_name(&dgram->dest_name,domain,0x1C); - - ptr = &dgram->data[0]; - - /* Setup the smb part. */ - ptr -= 4; /* XXX Ugliness because of handling of tcp SMB length. */ - memcpy(tmp,ptr,4); - set_message(ptr,17,17 + len,True); - memcpy(ptr,tmp,4); - - CVAL(ptr,smb_com) = SMBtrans; - SSVAL(ptr,smb_vwv1,len); - SSVAL(ptr,smb_vwv11,len); - SSVAL(ptr,smb_vwv12,70 + strlen(mailslot)); - SSVAL(ptr,smb_vwv13,3); - SSVAL(ptr,smb_vwv14,1); - SSVAL(ptr,smb_vwv15,1); - SSVAL(ptr,smb_vwv16,2); - p2 = smb_buf(ptr); - pstrcpy(p2,mailslot); - p2 = skip_string(p2,1); - - memcpy(p2,buffer,len); - p2 += len; - - dgram->datasize = PTR_DIFF(p2,ptr+4); /* +4 for tcp length. */ - - p.ip = *pdc_ip; - p.port = DGRAM_PORT; - p.fd = sock; - p.timestamp = time(NULL); - p.packet_type = DGRAM_PACKET; - - GetTimeOfDay(&tval); - - if (!send_packet(&p)) { - DEBUG(0,("lookup_pdc_name: send_packet failed.\n")); - close(sock); - return False; - } - - retries--; - - while (1) { - struct timeval tval2; - struct packet_struct *p_ret; - - GetTimeOfDay(&tval2); - if (TvalDiff(&tval,&tval2) > retry_time) { - if (!retries) - break; - if (!send_packet(&p)) { - DEBUG(0,("lookup_pdc_name: send_packet failed.\n")); - close(sock); - return False; - } - GetTimeOfDay(&tval); - retries--; - } - - if ((p_ret = receive_dgram_packet(sock,90,mailslot_name))) { - struct dgram_packet *dgram2 = &p_ret->packet.dgram; - char *buf; - char *buf2; - - buf = &dgram2->data[0]; - buf -= 4; - - if (CVAL(buf,smb_com) != SMBtrans) { - DEBUG(0,("lookup_pdc_name: datagram type %u != SMBtrans(%u)\n", (unsigned int) - CVAL(buf,smb_com), (unsigned int)SMBtrans )); - free_packet(p_ret); - continue; - } - - len = SVAL(buf,smb_vwv11); - buf2 = smb_base(buf) + SVAL(buf,smb_vwv12); - - if (len <= 0) { - DEBUG(0,("lookup_pdc_name: datagram len < 0 (%d)\n", len )); - free_packet(p_ret); - continue; - } - - DEBUG(4,("lookup_pdc_name: datagram reply from %s to %s IP %s for %s of type %d len=%d\n", - nmb_namestr(&dgram2->source_name),nmb_namestr(&dgram2->dest_name), - inet_ntoa(p_ret->ip), smb_buf(buf),SVAL(buf2,0),len)); - - if(SVAL(buf2,0) != QUERYFORPDC_R) { - DEBUG(0,("lookup_pdc_name: datagram type (%u) != QUERYFORPDC_R(%u)\n", - (unsigned int)SVAL(buf,0), (unsigned int)QUERYFORPDC_R )); - free_packet(p_ret); - continue; - } - - buf2 += 2; - /* Note this is safe as it is a bounded strcpy. */ - fstrcpy(ret_name, buf2); - ret_name[sizeof(fstring)-1] = '\0'; - close(sock); - free_packet(p_ret); - return True; - } - } - - close(sock); - return False; -#endif /* defined(I_HATE_WINDOWS_REPLY_CODE) */ -} - /******************************************************** Get the IP address list of the primary domain controller for a domain. @@ -1215,68 +1181,81 @@ NT GETDC call, UNICODE, NT domain SID and uncle tom cobbley and all... BOOL get_pdc_ip(const char *domain, struct in_addr *ip) { - struct in_addr *ip_list; + struct ip_service *ip_list; int count; - int i = 0; /* Look up #1B name */ - if (!internal_resolve_name(domain, 0x1b, &ip_list, &count)) + if (!internal_resolve_name(domain, 0x1b, &ip_list, &count, lp_name_resolve_order())) return False; /* if we get more than 1 IP back we have to assume it is a multi-homed PDC and not a mess up */ - + if ( count > 1 ) { - DEBUG(6,("get_pdc_ip: PDC has %d IP addresses!\n", count)); - - /* look for a local net */ - for ( i=0; i= 4 ) { + DEBUG(4,("get_dc_list: returning %d ip addresses in an %sordered list\n", local_count, + *ordered ? "":"un")); + DEBUG(4,("get_dc_list: ")); + for ( i=0; iauth.flags |= ADS_AUTH_NO_BIND; + + DEBUG(4,("ads_dc_name: domain=%s\n", domain)); + +#ifdef HAVE_ADS + /* a full ads_connect() is actually overkill, as we don't srictly need + to do the SASL auth in order to get the info we need, but libads + doesn't offer a better way right now */ + ads_connect(ads); +#endif + + if (!ads->config.realm) + return False; + + fstrcpy(srv_name, ads->config.ldap_server_name); + strupper_m(srv_name); + *dc_ip = ads->ldap_ip; + ads_destroy(&ads); + + DEBUG(4,("ads_dc_name: using server='%s' IP=%s\n", + srv_name, inet_ntoa(*dc_ip))); + + return True; +} + +/**************************************************************************** + Utility function to return the name of a DC. The name is guaranteed to be + valid since we have already done a name_status_find on it + ***************************************************************************/ + +static BOOL rpc_dc_name(const char *domain, fstring srv_name, struct in_addr *ip_out) { - struct in_addr *ip_list = NULL, dc_ip, exclude_ip; + struct ip_service *ip_list = NULL; + struct in_addr dc_ip, exclude_ip; int count, i; - BOOL list_ordered; BOOL use_pdc_only; + NTSTATUS result; zero_ip(&exclude_ip); @@ -41,11 +86,17 @@ BOOL rpc_find_dc(const char *domain, fstring srv_name, struct in_addr *ip_out) /* Lookup domain controller name */ - if ( use_pdc_only && get_pdc_ip(domain, &dc_ip) ) { - DEBUG(10,("rpc_find_dc: Atempting to lookup PDC to avoid sam sync delays\n")); + if ( use_pdc_only && get_pdc_ip(domain, &dc_ip) ) + { + DEBUG(10,("rpc_dc_name: Atempting to lookup PDC to avoid sam sync delays\n")); - if (name_status_find(domain, 0x1c, 0x20, dc_ip, srv_name)) { - goto done; + /* check the connection cache and perform the node status + lookup only if the IP is not found to be bad */ + + if (name_status_find(domain, 0x1b, 0x20, dc_ip, srv_name) ) { + result = check_negative_conn_cache( domain, srv_name ); + if ( NT_STATUS_IS_OK(result) ) + goto done; } /* Didn't get name, remember not to talk to this DC. */ exclude_ip = dc_ip; @@ -53,7 +104,7 @@ BOOL rpc_find_dc(const char *domain, fstring srv_name, struct in_addr *ip_out) /* get a list of all domain controllers */ - if (!get_dc_list( domain, &ip_list, &count, &list_ordered) ) { + if ( !get_sorted_dc_list(domain, &ip_list, &count, False) ) { DEBUG(3, ("Could not look up dc's for domain %s\n", domain)); return False; } @@ -62,37 +113,37 @@ BOOL rpc_find_dc(const char *domain, fstring srv_name, struct in_addr *ip_out) if ( use_pdc_only ) { for (i = 0; i < count; i++) { - if (ip_equal( exclude_ip, ip_list[i])) - zero_ip(&ip_list[i]); + if (ip_equal( exclude_ip, ip_list[i].ip)) + zero_ip(&ip_list[i].ip); } } - /* Pick a nice close server, but only if the list was not ordered */ - if (!list_ordered && (count > 1) ) { - qsort(ip_list, count, sizeof(struct in_addr), QSORT_CAST ip_compare); - } - for (i = 0; i < count; i++) { - if (is_zero_ip(ip_list[i])) + if (is_zero_ip(ip_list[i].ip)) continue; - if (name_status_find(domain, 0x1c, 0x20, ip_list[i], srv_name)) { - dc_ip = ip_list[i]; - goto done; + if (name_status_find(domain, 0x1c, 0x20, ip_list[i].ip, srv_name)) { + result = check_negative_conn_cache( domain, srv_name ); + if ( NT_STATUS_IS_OK(result) ) { + dc_ip = ip_list[i].ip; + goto done; + } } } - + SAFE_FREE(ip_list); - return False; -done: + /* No-one to talk to )-: */ + return False; /* Boo-hoo */ + + done: /* We have the netbios name and IP address of a domain controller. Ideally we should sent a SAMLOGON request to determine whether the DC is alive and kicking. If we can catch a dead DC before performing a cli_connect() we can avoid a 30-second timeout. */ - DEBUG(3, ("rpc_find_dc: Returning DC %s (%s) for domain %s\n", srv_name, + DEBUG(3, ("rpc_dc_name: Returning DC %s (%s) for domain %s\n", srv_name, inet_ntoa(dc_ip), domain)); *ip_out = dc_ip; @@ -102,3 +153,28 @@ done: return True; } +/********************************************************************** + wrapper around ads and rpc methods of finds DC's +**********************************************************************/ + +BOOL get_dc_name(const char *domain, fstring srv_name, struct in_addr *ip_out) +{ + struct in_addr dc_ip; + BOOL ret; + + zero_ip(&dc_ip); + + ret = False; + if (lp_security() == SEC_ADS) + ret = ads_dc_name(domain, &dc_ip, srv_name); + + if (!ret) { + /* fall back on rpc methods if the ADS methods fail */ + ret = rpc_dc_name(domain, srv_name, &dc_ip); + } + + *ip_out = dc_ip; + + return ret; +} + diff --git a/source3/libsmb/nmblib.c b/source3/libsmb/nmblib.c index 30ce5b6b10..157a2bb43c 100644 --- a/source3/libsmb/nmblib.c +++ b/source3/libsmb/nmblib.c @@ -295,7 +295,7 @@ static int put_nmb_name(char *buf,int offset,struct nmb_name *name) if (name->scope[0]) { /* XXXX this scope handling needs testing */ ret += strlen(name->scope) + 1; - pstrcpy(&buf[offset+1],name->scope); + safe_strcpy(&buf[offset+1],name->scope,sizeof(name->scope)); p = &buf[offset+1]; while ((p = strchr_m(p,'.'))) { @@ -823,7 +823,7 @@ void make_nmb_name( struct nmb_name *n, const char *name, int type) push_ascii(n->name, name, 16, STR_TERMINATE|STR_UPPER); n->name_type = (unsigned int)type & 0xFF; StrnCpy( n->scope, global_scope(), 63 ); - strupper( n->scope ); + strupper_m( n->scope ); } /******************************************************************* diff --git a/source3/libsmb/ntlmssp.c b/source3/libsmb/ntlmssp.c index d54655d17f..66dc6e08eb 100644 --- a/source3/libsmb/ntlmssp.c +++ b/source3/libsmb/ntlmssp.c @@ -175,11 +175,11 @@ static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state, /* This should be a 'netbios domain -> DNS domain' mapping */ dnsdomname[0] = '\0'; get_mydomname(dnsdomname); - strlower(dnsdomname); + strlower_m(dnsdomname); dnsname[0] = '\0'; get_myfullname(dnsname); - strlower(dnsname); + strlower_m(dnsname); if (chal_flags & NTLMSSP_CHAL_TARGET_INFO) { @@ -190,7 +190,6 @@ static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state, target_name_dns = dnsname; } - /* the numbers here are the string type flags */ msrpc_gen(&struct_blob, "aaaaa", ntlmssp_state->unicode, NTLMSSP_NAME_TYPE_DOMAIN, target_name, ntlmssp_state->unicode, NTLMSSP_NAME_TYPE_SERVER, ntlmssp_state->get_global_myname(), @@ -410,6 +409,10 @@ static NTSTATUS ntlmssp_client_initial(struct ntlmssp_client_state *ntlmssp_stat ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE; } + if (ntlmssp_state->use_ntlmv2) { + ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2; + } + /* generate the ntlmssp negotiate packet */ msrpc_gen(next_request, "CddAA", "NTLMSSP", @@ -436,7 +439,7 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st uint32 chal_flags, ntlmssp_command, unkn1, unkn2; DATA_BLOB server_domain_blob; DATA_BLOB challenge_blob; - DATA_BLOB struct_blob; + DATA_BLOB struct_blob = data_blob(NULL, 0); char *server_domain; const char *chal_parse_string; const char *auth_gen_string; @@ -444,28 +447,48 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st DATA_BLOB nt_response = data_blob(NULL, 0); DATA_BLOB session_key = data_blob(NULL, 0); uint8 datagram_sess_key[16]; + size_t datagram_sess_key_len; +#if 0 /* until we know what flag to tigger it on */ generate_random_buffer(datagram_sess_key, sizeof(datagram_sess_key), False); + datagram_sess_key_len = sizeof(datagram_sess_key); +#else + ZERO_STRUCT(datagram_sess_key); + datagram_sess_key_len = 0; +#endif if (!msrpc_parse(&reply, "CdBd", "NTLMSSP", &ntlmssp_command, &server_domain_blob, &chal_flags)) { - DEBUG(0, ("Failed to parse the NTLMSSP Challenge\n")); + DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n")); + dump_data(2, reply.data, reply.length); + return NT_STATUS_INVALID_PARAMETER; } data_blob_free(&server_domain_blob); + DEBUG(3, ("Got challenge flags:\n")); + debug_ntlmssp_flags(chal_flags); + if (chal_flags & NTLMSSP_NEGOTIATE_UNICODE) { - chal_parse_string = "CdUdbddB"; + if (chal_flags & NTLMSSP_CHAL_TARGET_INFO) { + chal_parse_string = "CdUdbddB"; + } else { + chal_parse_string = "CdUdbdd"; + } auth_gen_string = "CdBBUUUBd"; ntlmssp_state->unicode = True; ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE; ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_OEM; } else if (chal_flags & NTLMSSP_NEGOTIATE_OEM) { - chal_parse_string = "CdAdbddB"; + if (chal_flags & NTLMSSP_CHAL_TARGET_INFO) { + chal_parse_string = "CdAdbddB"; + } else { + chal_parse_string = "CdAdbdd"; + } auth_gen_string = "CdBBAAABd"; ntlmssp_state->unicode = False; ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_UNICODE; @@ -474,6 +497,25 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st return NT_STATUS_INVALID_PARAMETER; } + if (chal_flags & NTLMSSP_NEGOTIATE_LM_KEY && lp_client_lanman_auth()) { + /* server forcing us to use LM */ + ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_LM_KEY; + ntlmssp_state->use_ntlmv2 = False; + } else { + ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY; + } + + if (!(chal_flags & NTLMSSP_NEGOTIATE_NTLM2)) { + ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2; + } + + if (!(chal_flags & NTLMSSP_NEGOTIATE_128)) { + ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_128; + } + + DEBUG(3, ("NTLMSSP: Set final flags:\n")); + debug_ntlmssp_flags(ntlmssp_state->neg_flags); + if (!msrpc_parse(&reply, chal_parse_string, "NTLMSSP", &ntlmssp_command, @@ -482,34 +524,43 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st &challenge_blob, 8, &unkn1, &unkn2, &struct_blob)) { - DEBUG(0, ("Failed to parse the NTLMSSP Challenge\n")); + DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n")); + dump_data(2, reply.data, reply.length); return NT_STATUS_INVALID_PARAMETER; } SAFE_FREE(server_domain); - data_blob_free(&struct_blob); - if (challenge_blob.length != 8) { + data_blob_free(&struct_blob); return NT_STATUS_INVALID_PARAMETER; } if (ntlmssp_state->use_ntlmv2) { + if (!struct_blob.length) { + /* be lazy, match win2k - we can't do NTLMv2 without it */ + return NT_STATUS_INVALID_PARAMETER; + } + /* TODO: if the remote server is standalone, then we should replace 'domain' with the server name as supplied above */ if (!SMBNTLMv2encrypt(ntlmssp_state->user, ntlmssp_state->domain, - ntlmssp_state->password, challenge_blob, + ntlmssp_state->password, &challenge_blob, + &struct_blob, &lm_response, &nt_response, &session_key)) { data_blob_free(&challenge_blob); + data_blob_free(&struct_blob); return NT_STATUS_NO_MEMORY; } } else { + uchar lm_hash[16]; uchar nt_hash[16]; + E_deshash(ntlmssp_state->password, lm_hash); E_md4hash(ntlmssp_state->password, nt_hash); - /* non encrypted password supplied. Ignore ntpass. */ + /* lanman auth is insecure, it may be disabled */ if (lp_client_lanman_auth()) { lm_response = data_blob(NULL, 24); SMBencrypt(ntlmssp_state->password,challenge_blob.data, @@ -519,9 +570,17 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st nt_response = data_blob(NULL, 24); SMBNTencrypt(ntlmssp_state->password,challenge_blob.data, nt_response.data); + session_key = data_blob(NULL, 16); - SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data); + if ((ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) + && lp_client_lanman_auth()) { + SMBsesskeygen_lmv1(lm_hash, lm_response.data, + session_key.data); + } else { + SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data); + } } + data_blob_free(&struct_blob); /* this generates the actual auth packet */ if (!msrpc_gen(next_request, auth_gen_string, @@ -532,7 +591,7 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st ntlmssp_state->domain, ntlmssp_state->user, ntlmssp_state->get_global_myname(), - datagram_sess_key, 16, + datagram_sess_key, datagram_sess_key_len, ntlmssp_state->neg_flags)) { data_blob_free(&lm_response); @@ -574,6 +633,8 @@ NTSTATUS ntlmssp_client_start(NTLMSSP_CLIENT_STATE **ntlmssp_state) (*ntlmssp_state)->unicode = True; + (*ntlmssp_state)->use_ntlmv2 = lp_client_ntlmv2_auth(); + (*ntlmssp_state)->neg_flags = NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_NTLM | @@ -595,6 +656,7 @@ NTSTATUS ntlmssp_client_end(NTLMSSP_CLIENT_STATE **ntlmssp_state) data_blob_free(&(*ntlmssp_state)->lm_resp); data_blob_free(&(*ntlmssp_state)->nt_resp); data_blob_free(&(*ntlmssp_state)->session_key); + data_blob_free(&(*ntlmssp_state)->stored_response); talloc_destroy(mem_ctx); } @@ -605,12 +667,18 @@ NTSTATUS ntlmssp_client_end(NTLMSSP_CLIENT_STATE **ntlmssp_state) NTSTATUS ntlmssp_client_update(NTLMSSP_CLIENT_STATE *ntlmssp_state, DATA_BLOB reply, DATA_BLOB *next_request) { + NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER; uint32 ntlmssp_command; *next_request = data_blob(NULL, 0); if (!reply.length) { - return ntlmssp_client_initial(ntlmssp_state, reply, next_request); - } + /* If there is a cached reply, use it - otherwise this is the first packet */ + if (!ntlmssp_state->stored_response.length) { + return ntlmssp_client_initial(ntlmssp_state, reply, next_request); + } + + reply = ntlmssp_state->stored_response; + } if (!msrpc_parse(&reply, "Cd", "NTLMSSP", @@ -619,9 +687,12 @@ NTSTATUS ntlmssp_client_update(NTLMSSP_CLIENT_STATE *ntlmssp_state, } if (ntlmssp_command == NTLMSSP_CHALLENGE) { - return ntlmssp_client_challenge(ntlmssp_state, reply, next_request); + nt_status = ntlmssp_client_challenge(ntlmssp_state, reply, next_request); + } + if (ntlmssp_state->stored_response.length) { + data_blob_free(&ntlmssp_state->stored_response); } - return NT_STATUS_INVALID_PARAMETER; + return nt_status; } NTSTATUS ntlmssp_set_username(NTLMSSP_CLIENT_STATE *ntlmssp_state, const char *user) @@ -650,3 +721,16 @@ NTSTATUS ntlmssp_set_domain(NTLMSSP_CLIENT_STATE *ntlmssp_state, const char *dom } return NT_STATUS_OK; } + +/** + * Store a DATA_BLOB containing an NTLMSSP response, for use later. + * This 'keeps' the data blob - the caller must *not* free it. + */ + +NTSTATUS ntlmssp_client_store_response(NTLMSSP_CLIENT_STATE *ntlmssp_state, + DATA_BLOB response) +{ + data_blob_free(&ntlmssp_state->stored_response); + ntlmssp_state->stored_response = response; + return NT_STATUS_OK; +} diff --git a/source3/libsmb/ntlmssp_parse.c b/source3/libsmb/ntlmssp_parse.c index ac779a3906..f53afcdcd0 100644 --- a/source3/libsmb/ntlmssp_parse.c +++ b/source3/libsmb/ntlmssp_parse.c @@ -220,23 +220,27 @@ BOOL msrpc_parse(const DATA_BLOB *blob, len2 = SVAL(blob->data, head_ofs); head_ofs += 2; ptr = IVAL(blob->data, head_ofs); head_ofs += 4; - /* make sure its in the right format - be strict */ - if (len1 != len2 || ptr + len1 > blob->length) { - return False; - } - if (len1 & 1) { - /* if odd length and unicode */ - return False; - } - ps = va_arg(ap, char **); - if (0 < len1) { - pull_string(NULL, p, blob->data + ptr, sizeof(p), - len1, - STR_UNICODE|STR_NOALIGN); - (*ps) = smb_xstrdup(p); + if (len1 == 0 && len2 == 0) { + *ps = smb_xstrdup(""); } else { - (*ps) = smb_xstrdup(""); + /* make sure its in the right format - be strict */ + if (len1 != len2 || ptr + len1 > blob->length) { + return False; + } + if (len1 & 1) { + /* if odd length and unicode */ + return False; + } + + if (0 < len1) { + pull_string(NULL, p, blob->data + ptr, sizeof(p), + len1, + STR_UNICODE|STR_NOALIGN); + (*ps) = smb_xstrdup(p); + } else { + (*ps) = smb_xstrdup(""); + } } break; case 'A': @@ -245,19 +249,23 @@ BOOL msrpc_parse(const DATA_BLOB *blob, len2 = SVAL(blob->data, head_ofs); head_ofs += 2; ptr = IVAL(blob->data, head_ofs); head_ofs += 4; - /* make sure its in the right format - be strict */ - if (len1 != len2 || ptr + len1 > blob->length) { - return False; - } - ps = va_arg(ap, char **); - if (0 < len1) { - pull_string(NULL, p, blob->data + ptr, sizeof(p), - len1, - STR_ASCII|STR_NOALIGN); - (*ps) = smb_xstrdup(p); + /* make sure its in the right format - be strict */ + if (len1 == 0 && len2 == 0) { + *ps = smb_xstrdup(""); } else { - (*ps) = smb_xstrdup(""); + if (len1 != len2 || ptr + len1 > blob->length) { + return False; + } + + if (0 < len1) { + pull_string(NULL, p, blob->data + ptr, sizeof(p), + len1, + STR_ASCII|STR_NOALIGN); + (*ps) = smb_xstrdup(p); + } else { + (*ps) = smb_xstrdup(""); + } } break; case 'B': @@ -265,12 +273,17 @@ BOOL msrpc_parse(const DATA_BLOB *blob, len1 = SVAL(blob->data, head_ofs); head_ofs += 2; len2 = SVAL(blob->data, head_ofs); head_ofs += 2; ptr = IVAL(blob->data, head_ofs); head_ofs += 4; - /* make sure its in the right format - be strict */ - if (len1 != len2 || ptr + len1 > blob->length) { - return False; - } + b = (DATA_BLOB *)va_arg(ap, void *); - *b = data_blob(blob->data + ptr, len1); + if (len1 == 0 && len2 == 0) { + *b = data_blob(NULL, 0); + } else { + /* make sure its in the right format - be strict */ + if (len1 != len2 || ptr + len1 > blob->length) { + return False; + } + *b = data_blob(blob->data + ptr, len1); + } break; case 'b': b = (DATA_BLOB *)va_arg(ap, void *); diff --git a/source3/libsmb/ntlmssp_sign.c b/source3/libsmb/ntlmssp_sign.c index 86faf1f5e6..748c008963 100644 --- a/source3/libsmb/ntlmssp_sign.c +++ b/source3/libsmb/ntlmssp_sign.c @@ -79,13 +79,18 @@ static void calc_hash(unsigned char *hash, const char *k2, int k2l) } static void calc_ntlmv2_hash(unsigned char hash[16], char digest[16], - const char encrypted_response[16], + DATA_BLOB session_key, const char *constant) { struct MD5Context ctx3; + /* NOTE: This code is currently complate fantasy - it's + got more in common with reality than the previous code + (the LM session key is not the right thing to use) but + it still needs work */ + MD5Init(&ctx3); - MD5Update(&ctx3, encrypted_response, 5); + MD5Update(&ctx3, session_key.data, session_key.length); MD5Update(&ctx3, constant, strlen(constant)); MD5Final(digest, &ctx3); @@ -113,25 +118,28 @@ static NTSTATUS ntlmssp_make_packet_signiture(NTLMSSP_CLIENT_STATE *ntlmssp_stat hmac_md5_update(data, length, &ctx); hmac_md5_final(digest, &ctx); - if (!msrpc_gen(sig, "Bd", digest, sizeof(digest), ntlmssp_state->ntlmssp_seq_num)) { + if (!msrpc_gen(sig, "dBd", NTLMSSP_SIGN_VERSION, digest, 8 /* only copy first 8 bytes */ + , ntlmssp_state->ntlmssp_seq_num)) { return NT_STATUS_NO_MEMORY; } switch (direction) { case NTLMSSP_SEND: - NTLMSSPcalc_ap(ntlmssp_state->cli_sign_hash, sig->data, sig->length); + NTLMSSPcalc_ap(ntlmssp_state->cli_sign_hash, sig->data+4, sig->length-4); break; case NTLMSSP_RECEIVE: - NTLMSSPcalc_ap(ntlmssp_state->srv_sign_hash, sig->data, sig->length); + NTLMSSPcalc_ap(ntlmssp_state->srv_sign_hash, sig->data+4, sig->length-4); break; } } else { uint32 crc; crc = crc32_calc_buffer(data, length); - if (!msrpc_gen(sig, "ddd", 0, crc, ntlmssp_state->ntlmssp_seq_num)) { + if (!msrpc_gen(sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmssp_seq_num)) { return NT_STATUS_NO_MEMORY; } - NTLMSSPcalc_ap(ntlmssp_state->ntlmssp_hash, sig->data, sig->length); + dump_data_pw("ntlmssp hash:\n", ntlmssp_state->ntlmssp_hash, + sizeof(ntlmssp_state->ntlmssp_hash)); + NTLMSSPcalc_ap(ntlmssp_state->ntlmssp_hash, sig->data+4, sig->length-4); } return NT_STATUS_OK; } @@ -140,8 +148,11 @@ NTSTATUS ntlmssp_client_sign_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, const uchar *data, size_t length, DATA_BLOB *sig) { + NTSTATUS nt_status = ntlmssp_make_packet_signiture(ntlmssp_state, data, length, NTLMSSP_SEND, sig); + + /* increment counter on send */ ntlmssp_state->ntlmssp_seq_num++; - return ntlmssp_make_packet_signiture(ntlmssp_state, data, length, NTLMSSP_SEND, sig); + return nt_status; } /** @@ -151,8 +162,8 @@ NTSTATUS ntlmssp_client_sign_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, */ NTSTATUS ntlmssp_client_check_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, - const uchar *data, size_t length, - const DATA_BLOB *sig) + const uchar *data, size_t length, + const DATA_BLOB *sig) { DATA_BLOB local_sig; NTSTATUS nt_status; @@ -170,9 +181,7 @@ NTSTATUS ntlmssp_client_check_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, return nt_status; } - if (memcmp(sig->data, local_sig.data, MIN(sig->length, local_sig.length)) == 0) { - return NT_STATUS_OK; - } else { + if (memcmp(sig->data+sig->length - 8, local_sig.data+local_sig.length - 8, 8) != 0) { DEBUG(5, ("BAD SIG: wanted signature of\n")); dump_data(5, local_sig.data, local_sig.length); @@ -182,6 +191,97 @@ NTSTATUS ntlmssp_client_check_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, DEBUG(0, ("NTLMSSP packet check failed due to invalid signiture!\n")); return NT_STATUS_ACCESS_DENIED; } + + /* increment counter on recieive */ + ntlmssp_state->ntlmssp_seq_num++; + + return NT_STATUS_OK; +} + + +/** + * Seal data with the NTLMSSP algorithm + * + */ + +NTSTATUS ntlmssp_client_seal_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, + uchar *data, size_t length, + DATA_BLOB *sig) +{ + DEBUG(10,("ntlmssp_client_seal_data: seal\n")); + dump_data_pw("ntlmssp clear data\n", data, length); + if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) { + HMACMD5Context ctx; + char seq_num[4]; + uchar digest[16]; + SIVAL(seq_num, 0, ntlmssp_state->ntlmssp_seq_num); + + hmac_md5_init_limK_to_64(ntlmssp_state->cli_sign_const, 16, &ctx); + hmac_md5_update(seq_num, 4, &ctx); + hmac_md5_update(data, length, &ctx); + hmac_md5_final(digest, &ctx); + + if (!msrpc_gen(sig, "dBd", NTLMSSP_SIGN_VERSION, digest, 8 /* only copy first 8 bytes */ + , ntlmssp_state->ntlmssp_seq_num)) { + return NT_STATUS_NO_MEMORY; + } + + dump_data_pw("ntlmssp client sealing hash:\n", + ntlmssp_state->cli_seal_hash, + sizeof(ntlmssp_state->cli_seal_hash)); + NTLMSSPcalc_ap(ntlmssp_state->cli_seal_hash, data, length); + dump_data_pw("ntlmssp client signing hash:\n", + ntlmssp_state->cli_sign_hash, + sizeof(ntlmssp_state->cli_sign_hash)); + NTLMSSPcalc_ap(ntlmssp_state->cli_sign_hash, sig->data+4, sig->length-4); + } else { + uint32 crc; + crc = crc32_calc_buffer(data, length); + if (!msrpc_gen(sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmssp_seq_num)) { + return NT_STATUS_NO_MEMORY; + } + + /* The order of these two operations matters - we must first seal the packet, + then seal the sequence number - this is becouse the ntlmssp_hash is not + constant, but is is rather updated with each iteration */ + + dump_data_pw("ntlmssp hash:\n", ntlmssp_state->ntlmssp_hash, + sizeof(ntlmssp_state->ntlmssp_hash)); + NTLMSSPcalc_ap(ntlmssp_state->ntlmssp_hash, data, length); + + dump_data_pw("ntlmssp hash:\n", ntlmssp_state->ntlmssp_hash, + sizeof(ntlmssp_state->ntlmssp_hash)); + NTLMSSPcalc_ap(ntlmssp_state->ntlmssp_hash, sig->data+4, sig->length-4); + } + dump_data_pw("ntlmssp sealed data\n", data, length); + + /* increment counter on send */ + ntlmssp_state->ntlmssp_seq_num++; + + return NT_STATUS_OK; +} + +/** + * Unseal data with the NTLMSSP algorithm + * + */ + +NTSTATUS ntlmssp_client_unseal_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, + uchar *data, size_t length, + DATA_BLOB *sig) +{ + DEBUG(10,("ntlmssp_client_unseal_data: seal\n")); + dump_data_pw("ntlmssp sealed data\n", data, length); + if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) { + NTLMSSPcalc_ap(ntlmssp_state->srv_seal_hash, data, length); + } else { + dump_data_pw("ntlmssp hash:\n", ntlmssp_state->ntlmssp_hash, + sizeof(ntlmssp_state->ntlmssp_hash)); + NTLMSSPcalc_ap(ntlmssp_state->ntlmssp_hash, data, length); + } + dump_data_pw("ntlmssp clear data\n", data, length); + + return ntlmssp_client_check_packet(ntlmssp_state, data, length, sig); } /** @@ -190,37 +290,69 @@ NTSTATUS ntlmssp_client_check_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, NTSTATUS ntlmssp_client_sign_init(NTLMSSP_CLIENT_STATE *ntlmssp_state) { unsigned char p24[24]; - unsigned char lm_hash[16]; + ZERO_STRUCT(p24); + + DEBUG(3, ("NTLMSSP Sign/Seal - Initialising with flags:\n")); + debug_ntlmssp_flags(ntlmssp_state->neg_flags); - if (!ntlmssp_state->lm_resp.data) { - /* can't sign or check signitures yet */ - return NT_STATUS_UNSUCCESSFUL; - } - - E_deshash(ntlmssp_state->password, lm_hash); - - NTLMSSPOWFencrypt(lm_hash, ntlmssp_state->lm_resp.data, p24); - if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) { - calc_ntlmv2_hash(ntlmssp_state->cli_sign_hash, ntlmssp_state->cli_sign_const, p24, CLI_SIGN); - calc_ntlmv2_hash(ntlmssp_state->cli_seal_hash, ntlmssp_state->cli_seal_const, p24, CLI_SEAL); - calc_ntlmv2_hash(ntlmssp_state->srv_sign_hash, ntlmssp_state->srv_sign_const, p24, SRV_SIGN); - calc_ntlmv2_hash(ntlmssp_state->srv_seal_hash, ntlmssp_state->srv_seal_const, p24, SRV_SEAL); - } - else - { - char k2[8]; - memcpy(k2, p24, 5); - k2[5] = 0xe5; - k2[6] = 0x38; - k2[7] = 0xb0; + + calc_ntlmv2_hash(ntlmssp_state->cli_sign_hash, + ntlmssp_state->cli_sign_const, + ntlmssp_state->session_key, CLI_SIGN); + dump_data_pw("NTLMSSP client sign hash:\n", + ntlmssp_state->cli_sign_hash, + sizeof(ntlmssp_state->cli_sign_hash)); + + calc_ntlmv2_hash(ntlmssp_state->cli_seal_hash, + ntlmssp_state->cli_seal_const, + ntlmssp_state->session_key, CLI_SEAL); + dump_data_pw("NTLMSSP client sesl hash:\n", + ntlmssp_state->cli_seal_hash, + sizeof(ntlmssp_state->cli_seal_hash)); + + calc_ntlmv2_hash(ntlmssp_state->srv_sign_hash, + ntlmssp_state->srv_sign_const, + ntlmssp_state->session_key, SRV_SIGN); + dump_data_pw("NTLMSSP server sign hash:\n", + ntlmssp_state->srv_sign_hash, + sizeof(ntlmssp_state->srv_sign_hash)); + + calc_ntlmv2_hash(ntlmssp_state->srv_seal_hash, + ntlmssp_state->srv_seal_const, + ntlmssp_state->session_key, SRV_SEAL); + dump_data_pw("NTLMSSP server seal hash:\n", + ntlmssp_state->cli_sign_hash, + sizeof(ntlmssp_state->cli_sign_hash)); + } + else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) { + if (!ntlmssp_state->session_key.data || ntlmssp_state->session_key.length < 8) { + /* can't sign or check signitures yet */ + DEBUG(5, ("NTLMSSP Sign/Seal - cannot use LM KEY yet\n")); + return NT_STATUS_UNSUCCESSFUL; + } + + DEBUG(5, ("NTLMSSP Sign/Seal - using LM KEY\n")); + + calc_hash(ntlmssp_state->ntlmssp_hash, ntlmssp_state->session_key.data, 8); + dump_data_pw("NTLMSSP hash:\n", ntlmssp_state->ntlmssp_hash, + sizeof(ntlmssp_state->ntlmssp_hash)); + } else { + if (!ntlmssp_state->session_key.data || ntlmssp_state->session_key.length < 16) { + /* can't sign or check signitures yet */ + DEBUG(5, ("NTLMSSP Sign/Seal - cannot use NT KEY yet\n")); + return NT_STATUS_UNSUCCESSFUL; + } - calc_hash(ntlmssp_state->ntlmssp_hash, k2, 8); + DEBUG(5, ("NTLMSSP Sign/Seal - using NT KEY\n")); + + calc_hash(ntlmssp_state->ntlmssp_hash, ntlmssp_state->session_key.data, 16); + dump_data_pw("NTLMSSP hash:\n", ntlmssp_state->ntlmssp_hash, + sizeof(ntlmssp_state->ntlmssp_hash)); } ntlmssp_state->ntlmssp_seq_num = 0; - ZERO_STRUCT(lm_hash); return NT_STATUS_OK; } diff --git a/source3/libsmb/pwd_cache.c b/source3/libsmb/pwd_cache.c index 7ddcf853c4..f45832d7d7 100644 --- a/source3/libsmb/pwd_cache.c +++ b/source3/libsmb/pwd_cache.c @@ -43,15 +43,10 @@ static void pwd_init(struct pwd_info *pwd) static void pwd_make_lm_nt_16(struct pwd_info *pwd, const char *clr) { - pstring dos_passwd; - pwd_init(pwd); - push_ascii_pstring(dos_passwd, clr); - - nt_lm_owf_gen(dos_passwd, pwd->smb_nt_pwd, pwd->smb_lm_pwd); + nt_lm_owf_gen(clr, pwd->smb_nt_pwd, pwd->smb_lm_pwd); pwd->null_pwd = False; - pwd->cleartext = False; pwd->crypted = False; } @@ -61,12 +56,9 @@ static void pwd_make_lm_nt_16(struct pwd_info *pwd, const char *clr) void pwd_set_cleartext(struct pwd_info *pwd, const char *clr) { - pwd_init(pwd); - push_ascii_fstring(pwd->password, clr); - pwd->cleartext = True; - pwd->null_pwd = False; - pwd->crypted = False; pwd_make_lm_nt_16(pwd, clr); + fstrcpy(pwd->password, clr); + pwd->cleartext = True; } /**************************************************************************** diff --git a/source3/libsmb/smb_signing.c b/source3/libsmb/smb_signing.c index 4e9b895a1b..d4f77bf07c 100644 --- a/source3/libsmb/smb_signing.c +++ b/source3/libsmb/smb_signing.c @@ -21,20 +21,58 @@ #include "includes.h" +/* Lookup a packet's MID (multiplex id) and figure out it's sequence number */ +struct outstanding_packet_lookup { + uint16 mid; + uint32 reply_seq_num; + struct outstanding_packet_lookup *prev, *next; +}; + struct smb_basic_signing_context { DATA_BLOB mac_key; uint32 send_seq_num; - uint32 reply_seq_num; + struct outstanding_packet_lookup *outstanding_packet_list; }; +static void store_sequence_for_reply(struct outstanding_packet_lookup **list, + uint16 mid, uint32 reply_seq_num) +{ + struct outstanding_packet_lookup *t; + struct outstanding_packet_lookup *tmp; + + t = smb_xmalloc(sizeof(*t)); + ZERO_STRUCTP(t); + + DLIST_ADD_END(*list, t, tmp); + t->mid = mid; + t->reply_seq_num = reply_seq_num; +} + +static BOOL get_sequence_for_reply(struct outstanding_packet_lookup **list, + uint16 mid, uint32 *reply_seq_num) +{ + struct outstanding_packet_lookup *t; + + for (t = *list; t; t = t->next) { + if (t->mid == mid) { + *reply_seq_num = t->reply_seq_num; + DLIST_REMOVE(*list, t); + return True; + } + } + DEBUG(0, ("Unexpected incoming packet, it's MID (%u) does not match" + " a MID in our outstanding list!\n", mid)); + return False; +} + /*********************************************************** SMB signing - Common code before we set a new signing implementation ************************************************************/ -static BOOL set_smb_signing_common(struct cli_state *cli) +static BOOL cli_set_smb_signing_common(struct cli_state *cli) { if (!cli->sign_info.negotiated_smb_signing - && !cli->sign_info.mandetory_signing) { + && !cli->sign_info.mandatory_signing) { return False; } @@ -56,9 +94,9 @@ static BOOL set_smb_signing_common(struct cli_state *cli) SMB signing - Common code for 'real' implementations ************************************************************/ -static BOOL set_smb_signing_real_common(struct cli_state *cli) +static BOOL cli_set_smb_signing_real_common(struct cli_state *cli) { - if (cli->sign_info.mandetory_signing) { + if (cli->sign_info.mandatory_signing) { DEBUG(5, ("Mandatory SMB signing enabled!\n")); cli->sign_info.doing_signing = True; } @@ -68,7 +106,7 @@ static BOOL set_smb_signing_real_common(struct cli_state *cli) return True; } -static void mark_packet_signed(struct cli_state *cli) +static void cli_mark_packet_signed(struct cli_state *cli) { uint16 flags2; flags2 = SVAL(cli->outbuf,smb_flg2); @@ -76,7 +114,7 @@ static void mark_packet_signed(struct cli_state *cli) SSVAL(cli->outbuf,smb_flg2, flags2); } -static BOOL signing_good(struct cli_state *cli, BOOL good) +static BOOL cli_signing_good(struct cli_state *cli, BOOL good) { DEBUG(10, ("got SMB signature of\n")); dump_data(10,&cli->inbuf[smb_ss_field] , 8); @@ -99,32 +137,67 @@ static BOOL signing_good(struct cli_state *cli, BOOL good) } /*********************************************************** - SMB signing - Simple implementation - calculate a MAC to send. + SMB signing - Simple implementation - calculate a MAC on the packet ************************************************************/ -static void cli_simple_sign_outgoing_message(struct cli_state *cli) +static void simple_packet_signature(struct smb_basic_signing_context *data, + const uchar *buf, uint32 seq_number, + unsigned char calc_md5_mac[16]) { - unsigned char calc_md5_mac[16]; + const size_t offset_end_of_sig = (smb_ss_field + 8); + unsigned char sequence_buf[8]; struct MD5Context md5_ctx; - struct smb_basic_signing_context *data = cli->sign_info.signing_context; /* * Firstly put the sequence number into the first 4 bytes. * and zero out the next 4 bytes. + * + * We do this here, to avoid modifying the packet. */ - SIVAL(cli->outbuf, smb_ss_field, - data->send_seq_num); - SIVAL(cli->outbuf, smb_ss_field + 4, 0); - /* mark the packet as signed - BEFORE we sign it...*/ - mark_packet_signed(cli); + SIVAL(sequence_buf, 0, seq_number); + SIVAL(sequence_buf, 4, 0); - /* Calculate the 16 byte MAC and place first 8 bytes into the field. */ + /* Calculate the 16 byte MAC - but don't alter the data in the + incoming packet. + + This makes for a bit for fussing about, but it's not too bad. + */ MD5Init(&md5_ctx); + + /* intialise with the key */ MD5Update(&md5_ctx, data->mac_key.data, data->mac_key.length); - MD5Update(&md5_ctx, cli->outbuf + 4, smb_len(cli->outbuf)); + + /* copy in the first bit of the SMB header */ + MD5Update(&md5_ctx, buf + 4, smb_ss_field - 4); + + /* copy in the sequence number, instead of the signature */ + MD5Update(&md5_ctx, sequence_buf, sizeof(sequence_buf)); + + /* copy in the rest of the packet in, skipping the signature */ + MD5Update(&md5_ctx, buf + offset_end_of_sig, + smb_len(buf) - (offset_end_of_sig - 4)); + + /* caclulate the MD5 sig */ MD5Final(calc_md5_mac, &md5_ctx); +} + + +/*********************************************************** + SMB signing - Simple implementation - send the MAC. +************************************************************/ + +static void cli_simple_sign_outgoing_message(struct cli_state *cli) +{ + unsigned char calc_md5_mac[16]; + struct smb_basic_signing_context *data = cli->sign_info.signing_context; + + /* mark the packet as signed - BEFORE we sign it...*/ + cli_mark_packet_signed(cli); + + simple_packet_signature(data, cli->outbuf, data->send_seq_num, + calc_md5_mac); DEBUG(10, ("sent SMB signature of\n")); dump_data(10, calc_md5_mac, 8); @@ -132,9 +205,12 @@ static void cli_simple_sign_outgoing_message(struct cli_state *cli) memcpy(&cli->outbuf[smb_ss_field], calc_md5_mac, 8); /* cli->outbuf[smb_ss_field+2]=0; - Uncomment this to test if the remote server actually verifies signitures...*/ + Uncomment this to test if the remote server actually verifies signatures...*/ + data->send_seq_num++; - data->reply_seq_num = data->send_seq_num; + store_sequence_for_reply(&data->outstanding_packet_list, + cli->mid, + data->send_seq_num); data->send_seq_num++; } @@ -145,35 +221,21 @@ static void cli_simple_sign_outgoing_message(struct cli_state *cli) static BOOL cli_simple_check_incoming_message(struct cli_state *cli) { BOOL good; + uint32 reply_seq_number; unsigned char calc_md5_mac[16]; - unsigned char server_sent_mac[8]; - unsigned char sequence_buf[8]; - struct MD5Context md5_ctx; + unsigned char *server_sent_mac; + struct smb_basic_signing_context *data = cli->sign_info.signing_context; - const size_t offset_end_of_sig = (smb_ss_field + 8); - /* - * Firstly put the sequence number into the first 4 bytes. - * and zero out the next 4 bytes. - */ + if (!get_sequence_for_reply(&data->outstanding_packet_list, + SVAL(cli->inbuf, smb_mid), + &reply_seq_number)) { + return False; + } - SIVAL(sequence_buf, 0, data->reply_seq_num); - SIVAL(sequence_buf, 4, 0); - - /* get a copy of the server-sent mac */ - memcpy(server_sent_mac, &cli->inbuf[smb_ss_field], sizeof(server_sent_mac)); - - /* Calculate the 16 byte MAC and place first 8 bytes into the field. */ - MD5Init(&md5_ctx); - MD5Update(&md5_ctx, data->mac_key.data, - data->mac_key.length); - MD5Update(&md5_ctx, cli->inbuf + 4, smb_ss_field - 4); - MD5Update(&md5_ctx, sequence_buf, sizeof(sequence_buf)); - - MD5Update(&md5_ctx, cli->inbuf + offset_end_of_sig, - smb_len(cli->inbuf) - (offset_end_of_sig - 4)); - MD5Final(calc_md5_mac, &md5_ctx); + simple_packet_signature(data, cli->inbuf, reply_seq_number, calc_md5_mac); + server_sent_mac = &cli->inbuf[smb_ss_field]; good = (memcmp(server_sent_mac, calc_md5_mac, 8) == 0); if (!good) { @@ -183,7 +245,7 @@ static BOOL cli_simple_check_incoming_message(struct cli_state *cli) DEBUG(5, ("BAD SIG: got SMB signature of\n")); dump_data(5, server_sent_mac, 8); } - return signing_good(cli, good); + return cli_signing_good(cli, good); } /*********************************************************** @@ -193,6 +255,13 @@ static BOOL cli_simple_check_incoming_message(struct cli_state *cli) static void cli_simple_free_signing_context(struct cli_state *cli) { struct smb_basic_signing_context *data = cli->sign_info.signing_context; + struct outstanding_packet_lookup *list = data->outstanding_packet_list; + + while (list) { + struct outstanding_packet_lookup *old_head = list; + DLIST_REMOVE(list, list); + SAFE_FREE(old_head); + } data_blob_free(&data->mac_key); SAFE_FREE(cli->sign_info.signing_context); @@ -208,25 +277,32 @@ BOOL cli_simple_set_signing(struct cli_state *cli, const uchar user_session_key[ { struct smb_basic_signing_context *data; - if (!set_smb_signing_common(cli)) { + if (!user_session_key) + return False; + + if (!cli_set_smb_signing_common(cli)) { return False; } - if (!set_smb_signing_real_common(cli)) { + if (!cli_set_smb_signing_real_common(cli)) { return False; } data = smb_xmalloc(sizeof(*data)); + cli->sign_info.signing_context = data; - data->mac_key = data_blob(NULL, MIN(response.length + 16, 40)); + data->mac_key = data_blob(NULL, response.length + 16); memcpy(&data->mac_key.data[0], user_session_key, 16); - memcpy(&data->mac_key.data[16],response.data, MIN(response.length, 40 - 16)); + memcpy(&data->mac_key.data[16],response.data, response.length); /* Initialise the sequence number */ data->send_seq_num = 0; + /* Initialise the list of outstanding packets */ + data->outstanding_packet_list = NULL; + cli->sign_info.sign_outgoing_message = cli_simple_sign_outgoing_message; cli->sign_info.check_incoming_message = cli_simple_check_incoming_message; cli->sign_info.free_signing_context = cli_simple_free_signing_context; @@ -234,97 +310,6 @@ BOOL cli_simple_set_signing(struct cli_state *cli, const uchar user_session_key[ return True; } -/*********************************************************** - SMB signing - NTLMSSP implementation - calculate a MAC to send. -************************************************************/ - -static void cli_ntlmssp_sign_outgoing_message(struct cli_state *cli) -{ - NTSTATUS nt_status; - DATA_BLOB sig; - NTLMSSP_CLIENT_STATE *ntlmssp_state = cli->sign_info.signing_context; - - /* mark the packet as signed - BEFORE we sign it...*/ - mark_packet_signed(cli); - - nt_status = ntlmssp_client_sign_packet(ntlmssp_state, cli->outbuf + 4, - smb_len(cli->outbuf), &sig); - - if (!NT_STATUS_IS_OK(nt_status)) { - DEBUG(0, ("NTLMSSP signing failed with %s\n", nt_errstr(nt_status))); - return; - } - - DEBUG(10, ("sent SMB signature of\n")); - dump_data(10, sig.data, MIN(sig.length, 8)); - memcpy(&cli->outbuf[smb_ss_field], sig.data, MIN(sig.length, 8)); - - data_blob_free(&sig); -} - -/*********************************************************** - SMB signing - NTLMSSP implementation - check a MAC sent by server. -************************************************************/ - -static BOOL cli_ntlmssp_check_incoming_message(struct cli_state *cli) -{ - BOOL good; - NTSTATUS nt_status; - DATA_BLOB sig = data_blob(&cli->inbuf[smb_ss_field], 8); - - NTLMSSP_CLIENT_STATE *ntlmssp_state = cli->sign_info.signing_context; - - nt_status = ntlmssp_client_check_packet(ntlmssp_state, cli->outbuf + 4, - smb_len(cli->outbuf), &sig); - - data_blob_free(&sig); - - good = NT_STATUS_IS_OK(nt_status); - if (!NT_STATUS_IS_OK(nt_status)) { - DEBUG(5, ("NTLMSSP signing failed with %s\n", nt_errstr(nt_status))); - } - - return signing_good(cli, good); -} - -/*********************************************************** - SMB signing - NTLMSSP implementation - free signing context -************************************************************/ - -static void cli_ntlmssp_free_signing_context(struct cli_state *cli) -{ - ntlmssp_client_end((NTLMSSP_CLIENT_STATE **)&cli->sign_info.signing_context); -} - -/*********************************************************** - SMB signing - NTLMSSP implementation - setup the MAC key. -************************************************************/ - -BOOL cli_ntlmssp_set_signing(struct cli_state *cli, - NTLMSSP_CLIENT_STATE *ntlmssp_state) -{ - if (!set_smb_signing_common(cli)) { - return False; - } - - if (!NT_STATUS_IS_OK(ntlmssp_client_sign_init(ntlmssp_state))) { - return False; - } - - if (!set_smb_signing_real_common(cli)) { - return False; - } - - cli->sign_info.signing_context = ntlmssp_state; - ntlmssp_state->ref_count++; - - cli->sign_info.sign_outgoing_message = cli_ntlmssp_sign_outgoing_message; - cli->sign_info.check_incoming_message = cli_ntlmssp_check_incoming_message; - cli->sign_info.free_signing_context = cli_ntlmssp_free_signing_context; - - return True; -} - /*********************************************************** SMB signing - NULL implementation - calculate a MAC to send. ************************************************************/ @@ -380,7 +365,7 @@ BOOL cli_null_set_signing(struct cli_state *cli) static void cli_temp_sign_outgoing_message(struct cli_state *cli) { /* mark the packet as signed - BEFORE we sign it...*/ - mark_packet_signed(cli); + cli_mark_packet_signed(cli); /* I wonder what BSRSPYL stands for - but this is what MS actually sends! */ @@ -412,7 +397,7 @@ static void cli_temp_free_signing_context(struct cli_state *cli) BOOL cli_temp_set_signing(struct cli_state *cli) { - if (!set_smb_signing_common(cli)) { + if (!cli_set_smb_signing_common(cli)) { return False; } @@ -473,4 +458,3 @@ BOOL cli_check_sign_mac(struct cli_state *cli) return True; } - diff --git a/source3/libsmb/smbencrypt.c b/source3/libsmb/smbencrypt.c index 28160d9609..7a1a2d7d18 100644 --- a/source3/libsmb/smbencrypt.c +++ b/source3/libsmb/smbencrypt.c @@ -76,10 +76,9 @@ void E_deshash(const char *passwd, uchar p16[16]) { fstring dospwd; ZERO_STRUCT(dospwd); - ZERO_STRUCTP(p16); /* Password must be converted to DOS charset - null terminated, uppercase. */ - push_ascii(dospwd, (const char *)passwd, sizeof(dospwd), STR_UPPER|STR_TERMINATE); + push_ascii(dospwd, passwd, sizeof(dospwd), STR_UPPER|STR_TERMINATE); /* Only the fisrt 14 chars are considered, password need not be null terminated. */ E_P16(dospwd, p16); @@ -250,21 +249,21 @@ BOOL make_oem_passwd_hash(char data[516], const char *passwd, uchar old_pw_hash[ /* Does the md5 encryption from the NT hash for NTLMv2. */ void SMBOWFencrypt_ntv2(const uchar kr[16], - const DATA_BLOB srv_chal, - const DATA_BLOB cli_chal, + const DATA_BLOB *srv_chal, + const DATA_BLOB *cli_chal, uchar resp_buf[16]) { HMACMD5Context ctx; hmac_md5_init_limK_to_64(kr, 16, &ctx); - hmac_md5_update(srv_chal.data, srv_chal.length, &ctx); - hmac_md5_update(cli_chal.data, cli_chal.length, &ctx); + hmac_md5_update(srv_chal->data, srv_chal->length, &ctx); + hmac_md5_update(cli_chal->data, cli_chal->length, &ctx); hmac_md5_final(resp_buf, &ctx); #ifdef DEBUG_PASSWORD DEBUG(100, ("SMBOWFencrypt_ntv2: srv_chal, cli_chal, resp_buf\n")); - dump_data(100, srv_chal.data, srv_chal.length); - dump_data(100, cli_chal.data, cli_chal.length); + dump_data(100, srv_chal->data, srv_chal->length); + dump_data(100, cli_chal->data, cli_chal->length); dump_data(100, resp_buf, 16); #endif } @@ -272,6 +271,8 @@ void SMBOWFencrypt_ntv2(const uchar kr[16], void SMBsesskeygen_ntv2(const uchar kr[16], const uchar * nt_resp, uint8 sess_key[16]) { + /* a very nice, 128 bit, variable session key */ + HMACMD5Context ctx; hmac_md5_init_limK_to_64(kr, 16, &ctx); @@ -287,6 +288,9 @@ void SMBsesskeygen_ntv2(const uchar kr[16], void SMBsesskeygen_ntv1(const uchar kr[16], const uchar * nt_resp, uint8 sess_key[16]) { + /* yes, this session key does not change - yes, this + is a problem - but it is 128 bits */ + mdfour((unsigned char *)sess_key, kr, 16); #ifdef DEBUG_PASSWORD @@ -295,36 +299,125 @@ void SMBsesskeygen_ntv1(const uchar kr[16], #endif } -static DATA_BLOB NTLMv2_generate_response(uchar ntlm_v2_hash[16], - DATA_BLOB server_chal, size_t client_chal_length) +void SMBsesskeygen_lmv1(const uchar lm_hash[16], + const uchar lm_resp[24], /* only uses 8 */ + uint8 sess_key[16]) +{ + /* Calculate the LM session key (effective length 40 bits, + but changes with each session) */ + + uchar p24[24]; + uchar partial_lm_hash[16]; + + memcpy(partial_lm_hash, lm_hash, 8); + memset(partial_lm_hash + 8, 0xbd, 8); + + SMBOWFencrypt(lm_hash, lm_resp, p24); + + memcpy(sess_key, p24, 16); + sess_key[5] = 0xe5; + sess_key[6] = 0x38; + sess_key[7] = 0xb0; + +#ifdef DEBUG_PASSWORD + DEBUG(100, ("SMBsesskeygen_lmv1:\n")); + dump_data(100, sess_key, 16); +#endif +} + +DATA_BLOB NTLMv2_generate_names_blob(const char *hostname, + const char *domain) +{ + DATA_BLOB names_blob = data_blob(NULL, 0); + + msrpc_gen(&names_blob, "aaa", + True, NTLMSSP_NAME_TYPE_DOMAIN, domain, + True, NTLMSSP_NAME_TYPE_SERVER, hostname, + True, 0, ""); + return names_blob; +} + +static DATA_BLOB NTLMv2_generate_client_data(const DATA_BLOB *names_blob) +{ + uchar client_chal[8]; + DATA_BLOB response = data_blob(NULL, 0); + char long_date[8]; + + generate_random_buffer(client_chal, sizeof(client_chal), False); + + put_long_date(long_date, time(NULL)); + + /* See http://www.ubiqx.org/cifs/SMB.html#SMB.8.5 */ + + msrpc_gen(&response, "ddbbdb", + 0x00000101, /* Header */ + 0, /* 'Reserved' */ + long_date, 8, /* Timestamp */ + client_chal, 8, /* client challenge */ + 0, /* Unknown */ + names_blob->data, names_blob->length); /* End of name list */ + + return response; +} + +static DATA_BLOB NTLMv2_generate_response(const uchar ntlm_v2_hash[16], + const DATA_BLOB *server_chal, + const DATA_BLOB *names_blob) { uchar ntlmv2_response[16]; DATA_BLOB ntlmv2_client_data; DATA_BLOB final_response; /* NTLMv2 */ + /* generate some data to pass into the response function - including + the hostname and domain name of the server */ + ntlmv2_client_data = NTLMv2_generate_client_data(names_blob); - /* We also get to specify some random data */ - ntlmv2_client_data = data_blob(NULL, client_chal_length); - generate_random_buffer(ntlmv2_client_data.data, ntlmv2_client_data.length, False); - /* Given that data, and the challenge from the server, generate a response */ - SMBOWFencrypt_ntv2(ntlm_v2_hash, server_chal, ntlmv2_client_data, ntlmv2_response); + SMBOWFencrypt_ntv2(ntlm_v2_hash, server_chal, &ntlmv2_client_data, ntlmv2_response); - /* put it into nt_response, for the code below to put into the packet */ - final_response = data_blob(NULL, ntlmv2_client_data.length + sizeof(ntlmv2_response)); + final_response = data_blob(NULL, sizeof(ntlmv2_response) + ntlmv2_client_data.length); + memcpy(final_response.data, ntlmv2_response, sizeof(ntlmv2_response)); - /* after the first 16 bytes is the random data we generated above, so the server can verify us with it */ - memcpy(final_response.data + sizeof(ntlmv2_response), ntlmv2_client_data.data, ntlmv2_client_data.length); + + memcpy(final_response.data+sizeof(ntlmv2_response), + ntlmv2_client_data.data, ntlmv2_client_data.length); + data_blob_free(&ntlmv2_client_data); return final_response; } +static DATA_BLOB LMv2_generate_response(const uchar ntlm_v2_hash[16], + const DATA_BLOB *server_chal) +{ + uchar lmv2_response[16]; + DATA_BLOB lmv2_client_data = data_blob(NULL, 8); + DATA_BLOB final_response = data_blob(NULL, 24); + + /* LMv2 */ + /* client-supplied random data */ + generate_random_buffer(lmv2_client_data.data, lmv2_client_data.length, False); + + /* Given that data, and the challenge from the server, generate a response */ + SMBOWFencrypt_ntv2(ntlm_v2_hash, server_chal, &lmv2_client_data, lmv2_response); + memcpy(final_response.data, lmv2_response, sizeof(lmv2_response)); + + /* after the first 16 bytes is the random data we generated above, + so the server can verify us with it */ + memcpy(final_response.data+sizeof(lmv2_response), + lmv2_client_data.data, lmv2_client_data.length); + + data_blob_free(&lmv2_client_data); + + return final_response; +} + BOOL SMBNTLMv2encrypt(const char *user, const char *domain, const char *password, - const DATA_BLOB server_chal, + const DATA_BLOB *server_chal, + const DATA_BLOB *names_blob, DATA_BLOB *lm_response, DATA_BLOB *nt_response, - DATA_BLOB *session_key) + DATA_BLOB *nt_session_key) { uchar nt_hash[16]; uchar ntlm_v2_hash[16]; @@ -338,18 +431,24 @@ BOOL SMBNTLMv2encrypt(const char *user, const char *domain, const char *password return False; } - *nt_response = NTLMv2_generate_response(ntlm_v2_hash, server_chal, 64 /* pick a number, > 8 */); + if (nt_response) { + *nt_response = NTLMv2_generate_response(ntlm_v2_hash, server_chal, + names_blob); + if (nt_session_key) { + *nt_session_key = data_blob(NULL, 16); + + /* The NTLMv2 calculations also provide a session key, for signing etc later */ + /* use only the first 16 bytes of nt_response for session key */ + SMBsesskeygen_ntv2(ntlm_v2_hash, nt_response->data, nt_session_key->data); + } + } /* LMv2 */ - *lm_response = NTLMv2_generate_response(ntlm_v2_hash, server_chal, 8); - - *session_key = data_blob(NULL, 16); + if (lm_response) { + *lm_response = LMv2_generate_response(ntlm_v2_hash, server_chal); + } - /* The NTLMv2 calculations also provide a session key, for signing etc later */ - /* use only the first 16 bytes of nt_response for session key */ - SMBsesskeygen_ntv2(ntlm_v2_hash, nt_response->data, session_key->data); - return True; } diff --git a/source3/libsmb/trustdom_cache.c b/source3/libsmb/trustdom_cache.c index cddbb2daa6..8378125088 100644 --- a/source3/libsmb/trustdom_cache.c +++ b/source3/libsmb/trustdom_cache.c @@ -26,6 +26,7 @@ #define DBGC_CLASS DBGC_ALL /* there's no proper class yet */ #define TDOMKEY_FMT "TDOM/%s" +#define TDOMTSKEY "TDOMCACHE/TIMESTAMP" /** @@ -89,7 +90,7 @@ BOOL trustdom_cache_shutdown(void) static char* trustdom_cache_key(const char* name) { - char* keystr; + char* keystr = NULL; asprintf(&keystr, TDOMKEY_FMT, strupper_static(name)); return keystr; @@ -165,11 +166,14 @@ BOOL trustdom_cache_fetch(const char* name, DOM_SID* sid) /* prepare a key and get the value */ key = trustdom_cache_key(name); + if (!key) return False; if (!gencache_get(key, &value, &timeout)) { DEBUG(5, ("no entry for trusted domain %s found.\n", name)); + SAFE_FREE(key); return False; } else { + SAFE_FREE(key); DEBUG(5, ("trusted domain %s found (%s)\n", name, value)); } @@ -183,6 +187,71 @@ BOOL trustdom_cache_fetch(const char* name, DOM_SID* sid) } +/******************************************************************* + fetch the timestamp from the last update +*******************************************************************/ + +uint32 trustdom_cache_fetch_timestamp( void ) +{ + char *value; + time_t timeout; + uint32 timestamp; + + /* init the cache */ + if (!gencache_init()) + return False; + + if (!gencache_get(TDOMTSKEY, &value, &timeout)) { + DEBUG(5, ("no timestamp for trusted domain cache located.\n")); + return 0; + } + + timestamp = atoi(value); + + return timestamp; +} + +/******************************************************************* + store the timestamp from the last update +*******************************************************************/ + +BOOL trustdom_cache_store_timestamp( uint32 t, time_t timeout ) +{ + fstring value; + + /* init the cache */ + if (!gencache_init()) + return False; + + snprintf(value, sizeof(value), "%d", t ); + + if (!gencache_set(TDOMTSKEY, value, timeout)) { + DEBUG(5, ("failed to set timestamp for trustdom_cache\n")); + return False; + } + + return True; +} + + +/******************************************************************* + lock the timestamp entry in the trustdom_cache +*******************************************************************/ + +BOOL trustdom_cache_lock_timestamp( void ) +{ + return gencache_lock_entry( TDOMTSKEY ) != -1; +} + +/******************************************************************* + unlock the timestamp entry in the trustdom_cache +*******************************************************************/ + +void trustdom_cache_unlock_timestamp( void ) +{ + gencache_unlock_entry( TDOMTSKEY ); +} + /** * Delete single trustdom entry. Look at the * gencache_iterate definition. @@ -213,3 +282,61 @@ void trustdom_cache_flush(void) DEBUG(5, ("Trusted domains cache flushed\n")); } +/******************************************************************** + update the trustdom_cache if needed +********************************************************************/ +#define TRUSTDOM_UPDATE_INTERVAL 600 + +void update_trustdom_cache( void ) +{ + char **domain_names; + DOM_SID *dom_sids; + uint32 num_domains; + uint32 last_check; + int time_diff; + TALLOC_CTX *mem_ctx = NULL; + time_t now = time(NULL); + int i; + + /* get the timestamp. We have to initialise it if the last timestamp == 0 */ + + if ( (last_check = trustdom_cache_fetch_timestamp()) == 0 ) + trustdom_cache_store_timestamp(0, now+TRUSTDOM_UPDATE_INTERVAL); + + time_diff = now - last_check; + + if ( (time_diff > 0) && (time_diff < TRUSTDOM_UPDATE_INTERVAL) ) { + DEBUG(10,("update_trustdom_cache: not time to update trustdom_cache yet\n")); + return; + } + + /* lock the timestamp */ + if ( !trustdom_cache_lock_timestamp() ) + return; + + if ( !(mem_ctx = talloc_init("update_trustdom_cache")) ) { + DEBUG(0,("update_trustdom_cache: talloc_init() failed!\n")); + goto done; + } + + /* get the domains and store them */ + + if ( enumerate_domain_trusts(mem_ctx, lp_workgroup(), &domain_names, + &num_domains, &dom_sids) ) + { + for ( i=0; ivfs_ops.close(fsp,fsp->fd); + ret = SMB_VFS_CLOSE(fsp,fsp->fd); fsp->fd = -1; return ret; } @@ -259,7 +259,7 @@ int fd_close_posix(struct connection_struct *conn, files_struct *fsp) DEBUG(10,("fd_close_posix: doing close on %u fd's.\n", (unsigned int)count )); for(i = 0; i < count; i++) { - if (conn->vfs_ops.close(fsp,fd_array[i]) == -1) { + if (SMB_VFS_CLOSE(fsp,fd_array[i]) == -1) { saved_errno = errno; } } @@ -278,7 +278,7 @@ int fd_close_posix(struct connection_struct *conn, files_struct *fsp) * Finally close the fd associated with this fsp. */ - ret = conn->vfs_ops.close(fsp,fsp->fd); + ret = SMB_VFS_CLOSE(fsp,fsp->fd); if (saved_errno != 0) { errno = saved_errno; @@ -646,11 +646,10 @@ static BOOL posix_lock_in_range(SMB_OFF_T *offset_out, SMB_OFF_T *count_out, static BOOL posix_fcntl_lock(files_struct *fsp, int op, SMB_OFF_T offset, SMB_OFF_T count, int type) { int ret; - struct connection_struct *conn = fsp->conn; DEBUG(8,("posix_fcntl_lock %d %d %.0f %.0f %d\n",fsp->fd,op,(double)offset,(double)count,type)); - ret = conn->vfs_ops.lock(fsp,fsp->fd,op,offset,count,type); + ret = SMB_VFS_LOCK(fsp,fsp->fd,op,offset,count,type); if (!ret && ((errno == EFBIG) || (errno == ENOLCK) || (errno == EINVAL))) { @@ -674,7 +673,7 @@ static BOOL posix_fcntl_lock(files_struct *fsp, int op, SMB_OFF_T offset, SMB_OF DEBUG(0,("Count greater than 31 bits - retrying with 31 bit truncated length.\n")); errno = 0; count &= 0x7fffffff; - ret = conn->vfs_ops.lock(fsp,fsp->fd,op,offset,count,type); + ret = SMB_VFS_LOCK(fsp,fsp->fd,op,offset,count,type); } } diff --git a/source3/modules/vfs_audit.c b/source3/modules/vfs_audit.c index 4f9dc1b1e4..550d918b43 100644 --- a/source3/modules/vfs_audit.c +++ b/source3/modules/vfs_audit.c @@ -2,8 +2,9 @@ * Auditing VFS module for samba. Log selected file operations to syslog * facility. * - * Copyright (C) Tim Potter, 1999-2000 - * Copyright (C) Alexander Bokovoy, 2002 + * Copyright (C) Tim Potter 1999-2000 + * Copyright (C) Alexander Bokovoy 2002 + * Copyright (C) Stefan (metze) Metzmacher 2002 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -20,118 +21,111 @@ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ -#include "config.h" -#include -#include -#ifdef HAVE_UTIME_H -#include -#endif -#ifdef HAVE_DIRENT_H -#include -#endif -#include -#ifdef HAVE_FCNTL_H -#include -#endif -#include -#include -#include -#include - -#ifndef SYSLOG_FACILITY -#define SYSLOG_FACILITY LOG_USER -#endif - -#ifndef SYSLOG_PRIORITY -#define SYSLOG_PRIORITY LOG_NOTICE -#endif + +#include "includes.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_VFS /* Function prototypes */ -static int audit_connect(struct connection_struct *conn, const char *svc, const char *user); -static void audit_disconnect(struct connection_struct *conn); -static DIR *audit_opendir(struct connection_struct *conn, const char *fname); -static int audit_mkdir(struct connection_struct *conn, const char *path, mode_t mode); -static int audit_rmdir(struct connection_struct *conn, const char *path); -static int audit_open(struct connection_struct *conn, const char *fname, int flags, mode_t mode); -static int audit_close(struct files_struct *fsp, int fd); -static int audit_rename(struct connection_struct *conn, const char *old, const char *new); -static int audit_unlink(struct connection_struct *conn, const char *path); -static int audit_chmod(struct connection_struct *conn, const char *path, mode_t mode); -static int audit_chmod_acl(struct connection_struct *conn, const char *name, mode_t mode); -static int audit_fchmod(struct files_struct *fsp, int fd, mode_t mode); -static int audit_fchmod_acl(struct files_struct *fsp, int fd, mode_t mode); +static int audit_connect(vfs_handle_struct *handle, connection_struct *conn, const char *svc, const char *user); +static void audit_disconnect(vfs_handle_struct *handle, connection_struct *conn); +static DIR *audit_opendir(vfs_handle_struct *handle, connection_struct *conn, const char *fname); +static int audit_mkdir(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode); +static int audit_rmdir(vfs_handle_struct *handle, connection_struct *conn, const char *path); +static int audit_open(vfs_handle_struct *handle, connection_struct *conn, const char *fname, int flags, mode_t mode); +static int audit_close(vfs_handle_struct *handle, files_struct *fsp, int fd); +static int audit_rename(vfs_handle_struct *handle, connection_struct *conn, const char *old, const char *new); +static int audit_unlink(vfs_handle_struct *handle, connection_struct *conn, const char *path); +static int audit_chmod(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode); +static int audit_chmod_acl(vfs_handle_struct *handle, connection_struct *conn, const char *name, mode_t mode); +static int audit_fchmod(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode); +static int audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode); /* VFS operations */ -static struct vfs_ops default_vfs_ops; /* For passthrough operation */ -static struct smb_vfs_handle_struct *audit_handle; - -static vfs_op_tuple audit_ops[] = { +static vfs_op_tuple audit_op_tuples[] = { /* Disk operations */ - {audit_connect, SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_LOGGER}, - {audit_disconnect, SMB_VFS_OP_DISCONNECT, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_connect), SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_disconnect), SMB_VFS_OP_DISCONNECT, SMB_VFS_LAYER_LOGGER}, /* Directory operations */ - {audit_opendir, SMB_VFS_OP_OPENDIR, SMB_VFS_LAYER_LOGGER}, - {audit_mkdir, SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_LOGGER}, - {audit_rmdir, SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_opendir), SMB_VFS_OP_OPENDIR, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_mkdir), SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_rmdir), SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_LOGGER}, /* File operations */ - {audit_open, SMB_VFS_OP_OPEN, SMB_VFS_LAYER_LOGGER}, - {audit_close, SMB_VFS_OP_CLOSE, SMB_VFS_LAYER_LOGGER}, - {audit_rename, SMB_VFS_OP_RENAME, SMB_VFS_LAYER_LOGGER}, - {audit_unlink, SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_LOGGER}, - {audit_chmod, SMB_VFS_OP_CHMOD, SMB_VFS_LAYER_LOGGER}, - {audit_fchmod, SMB_VFS_OP_FCHMOD, SMB_VFS_LAYER_LOGGER}, - {audit_chmod_acl, SMB_VFS_OP_CHMOD_ACL, SMB_VFS_LAYER_LOGGER}, - {audit_fchmod_acl, SMB_VFS_OP_FCHMOD_ACL, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_open), SMB_VFS_OP_OPEN, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_close), SMB_VFS_OP_CLOSE, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_rename), SMB_VFS_OP_RENAME, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_unlink), SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_chmod), SMB_VFS_OP_CHMOD, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_fchmod), SMB_VFS_OP_FCHMOD, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_chmod_acl), SMB_VFS_OP_CHMOD_ACL, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_fchmod_acl), SMB_VFS_OP_FCHMOD_ACL, SMB_VFS_LAYER_LOGGER}, /* Finish VFS operations definition */ - {NULL, SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} + {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} }; -/* VFS initialisation function. Return vfs_op_tuple array back to SAMBA. */ -static vfs_op_tuple *audit_init(const struct vfs_ops *def_vfs_ops, - struct smb_vfs_handle_struct *vfs_handle) +static int audit_syslog_facility(vfs_handle_struct *handle) { - memcpy(&default_vfs_ops, def_vfs_ops, sizeof(struct vfs_ops)); - - audit_handle = vfs_handle; + /* fix me: let this be configurable by: + * lp_param_enum(SNUM(handle->conn),(handle->param?handle->param:"audit"),"syslog facility", + * audit_enum_facility,LOG_USER); + */ + return LOG_USER; +} - openlog("smbd_audit", LOG_PID, SYSLOG_FACILITY); - syslog(SYSLOG_PRIORITY, "VFS_INIT: vfs_ops loaded\n"); - return audit_ops; + +static int audit_syslog_priority(vfs_handle_struct *handle) +{ + /* fix me: let this be configurable by: + * lp_param_enum(SNUM(handle->conn),(handle->param?handle->param:"audit"),"syslog priority", + * audit_enum_priority,LOG_NOTICE); + */ + return LOG_NOTICE; } /* Implementation of vfs_ops. Pass everything on to the default operation but log event first. */ -static int audit_connect(struct connection_struct *conn, const char *svc, const char *user) +static int audit_connect(vfs_handle_struct *handle, connection_struct *conn, const char *svc, const char *user) { - syslog(SYSLOG_PRIORITY, "connect to service %s by user %s\n", + int result; + + openlog("smbd_audit", LOG_PID, audit_syslog_facility(handle)); + + syslog(audit_syslog_priority(handle), "connect to service %s by user %s\n", svc, user); - return default_vfs_ops.connect(conn, svc, user); + result = SMB_VFS_NEXT_CONNECT(handle, conn, svc, user); + + return result; } -static void audit_disconnect(struct connection_struct *conn) +static void audit_disconnect(vfs_handle_struct *handle, connection_struct *conn) { - syslog(SYSLOG_PRIORITY, "disconnected\n"); - default_vfs_ops.disconnect(conn); + syslog(audit_syslog_priority(handle), "disconnected\n"); + SMB_VFS_NEXT_DISCONNECT(handle, conn); + + return; } -static DIR *audit_opendir(struct connection_struct *conn, const char *fname) +static DIR *audit_opendir(vfs_handle_struct *handle, connection_struct *conn, const char *fname) { - DIR *result = default_vfs_ops.opendir(conn, fname); + DIR *result; + + result = SMB_VFS_NEXT_OPENDIR(handle, conn, fname); - syslog(SYSLOG_PRIORITY, "opendir %s %s%s\n", + syslog(audit_syslog_priority(handle), "opendir %s %s%s\n", fname, (result == NULL) ? "failed: " : "", (result == NULL) ? strerror(errno) : ""); @@ -139,11 +133,13 @@ static DIR *audit_opendir(struct connection_struct *conn, const char *fname) return result; } -static int audit_mkdir(struct connection_struct *conn, const char *path, mode_t mode) +static int audit_mkdir(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) { - int result = default_vfs_ops.mkdir(conn, path, mode); - - syslog(SYSLOG_PRIORITY, "mkdir %s %s%s\n", + int result; + + result = SMB_VFS_NEXT_MKDIR(handle, conn, path, mode); + + syslog(audit_syslog_priority(handle), "mkdir %s %s%s\n", path, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -151,11 +147,13 @@ static int audit_mkdir(struct connection_struct *conn, const char *path, mode_t return result; } -static int audit_rmdir(struct connection_struct *conn, const char *path) +static int audit_rmdir(vfs_handle_struct *handle, connection_struct *conn, const char *path) { - int result = default_vfs_ops.rmdir(conn, path); + int result; + + result = SMB_VFS_NEXT_RMDIR(handle, conn, path); - syslog(SYSLOG_PRIORITY, "rmdir %s %s%s\n", + syslog(audit_syslog_priority(handle), "rmdir %s %s%s\n", path, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -163,11 +161,13 @@ static int audit_rmdir(struct connection_struct *conn, const char *path) return result; } -static int audit_open(struct connection_struct *conn, const char *fname, int flags, mode_t mode) +static int audit_open(vfs_handle_struct *handle, connection_struct *conn, const char *fname, int flags, mode_t mode) { - int result = default_vfs_ops.open(conn, fname, flags, mode); + int result; + + result = SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode); - syslog(SYSLOG_PRIORITY, "open %s (fd %d) %s%s%s\n", + syslog(audit_syslog_priority(handle), "open %s (fd %d) %s%s%s\n", fname, result, ((flags & O_WRONLY) || (flags & O_RDWR)) ? "for writing " : "", (result < 0) ? "failed: " : "", @@ -176,11 +176,13 @@ static int audit_open(struct connection_struct *conn, const char *fname, int fla return result; } -static int audit_close(struct files_struct *fsp, int fd) +static int audit_close(vfs_handle_struct *handle, files_struct *fsp, int fd) { - int result = default_vfs_ops.close(fsp, fd); + int result; + + result = SMB_VFS_NEXT_CLOSE(handle, fsp, fd); - syslog(SYSLOG_PRIORITY, "close fd %d %s%s\n", + syslog(audit_syslog_priority(handle), "close fd %d %s%s\n", fd, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -188,11 +190,13 @@ static int audit_close(struct files_struct *fsp, int fd) return result; } -static int audit_rename(struct connection_struct *conn, const char *old, const char *new) +static int audit_rename(vfs_handle_struct *handle, connection_struct *conn, const char *old, const char *new) { - int result = default_vfs_ops.rename(conn, old, new); + int result; + + result = SMB_VFS_NEXT_RENAME(handle, conn, old, new); - syslog(SYSLOG_PRIORITY, "rename %s -> %s %s%s\n", + syslog(audit_syslog_priority(handle), "rename %s -> %s %s%s\n", old, new, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -200,11 +204,13 @@ static int audit_rename(struct connection_struct *conn, const char *old, const c return result; } -static int audit_unlink(struct connection_struct *conn, const char *path) +static int audit_unlink(vfs_handle_struct *handle, connection_struct *conn, const char *path) { - int result = default_vfs_ops.unlink(conn, path); + int result; + + result = SMB_VFS_NEXT_UNLINK(handle, conn, path); - syslog(SYSLOG_PRIORITY, "unlink %s %s%s\n", + syslog(audit_syslog_priority(handle), "unlink %s %s%s\n", path, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -212,11 +218,13 @@ static int audit_unlink(struct connection_struct *conn, const char *path) return result; } -static int audit_chmod(struct connection_struct *conn, const char *path, mode_t mode) +static int audit_chmod(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) { - int result = default_vfs_ops.chmod(conn, path, mode); + int result; + + result = SMB_VFS_NEXT_CHMOD(handle, conn, path, mode); - syslog(SYSLOG_PRIORITY, "chmod %s mode 0x%x %s%s\n", + syslog(audit_syslog_priority(handle), "chmod %s mode 0x%x %s%s\n", path, mode, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -224,16 +232,13 @@ static int audit_chmod(struct connection_struct *conn, const char *path, mode_t return result; } -static int audit_chmod_acl(struct connection_struct *conn, const char *path, mode_t mode) +static int audit_chmod_acl(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) { int result; - if ( !default_vfs_ops.chmod_acl ) - return 0; + result = SMB_VFS_NEXT_CHMOD_ACL(handle, conn, path, mode); - result = default_vfs_ops.chmod_acl(conn, path, mode); - - syslog(SYSLOG_PRIORITY, "chmod_acl %s mode 0x%x %s%s\n", + syslog(audit_syslog_priority(handle), "chmod_acl %s mode 0x%x %s%s\n", path, mode, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -241,11 +246,13 @@ static int audit_chmod_acl(struct connection_struct *conn, const char *path, mod return result; } -static int audit_fchmod(struct files_struct *fsp, int fd, mode_t mode) +static int audit_fchmod(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode) { - int result = default_vfs_ops.fchmod(fsp, fd, mode); + int result; - syslog(SYSLOG_PRIORITY, "fchmod %s mode 0x%x %s%s\n", + result = SMB_VFS_NEXT_FCHMOD(handle, fsp, fd, mode); + + syslog(audit_syslog_priority(handle), "fchmod %s mode 0x%x %s%s\n", fsp->fsp_name, mode, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -253,16 +260,13 @@ static int audit_fchmod(struct files_struct *fsp, int fd, mode_t mode) return result; } -static int audit_fchmod_acl(struct files_struct *fsp, int fd, mode_t mode) +static int audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode) { int result; - if ( !default_vfs_ops.fchmod_acl ) - return 0; - - result = default_vfs_ops.fchmod_acl(fsp, fd, mode); + result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, fd, mode); - syslog(SYSLOG_PRIORITY, "fchmod_acl %s mode 0x%x %s%s\n", + syslog(audit_syslog_priority(handle), "fchmod_acl %s mode 0x%x %s%s\n", fsp->fsp_name, mode, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -272,5 +276,5 @@ static int audit_fchmod_acl(struct files_struct *fsp, int fd, mode_t mode) NTSTATUS vfs_audit_init(void) { - return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "audit", audit_init); + return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "audit", audit_op_tuples); } diff --git a/source3/modules/vfs_extd_audit.c b/source3/modules/vfs_extd_audit.c index ef30ca7027..06cddc78e4 100644 --- a/source3/modules/vfs_extd_audit.c +++ b/source3/modules/vfs_extd_audit.c @@ -5,6 +5,7 @@ * Copyright (C) Tim Potter, 1999-2000 * Copyright (C) Alexander Bokovoy, 2002 * Copyright (C) John H Terpstra, 2003 + * Copyright (C) Stefan (metze) Metzmacher, 2003 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -21,127 +22,120 @@ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ -#include "config.h" -#include -#include -#ifdef HAVE_UTIME_H -#include -#endif -#ifdef HAVE_DIRENT_H -#include -#endif -#include -#ifdef HAVE_FCNTL_H -#include -#endif -#include -#include -#include -#include - -#ifndef SYSLOG_FACILITY -#define SYSLOG_FACILITY LOG_USER -#endif - -#ifndef SYSLOG_PRIORITY -#define SYSLOG_PRIORITY LOG_NOTICE -#endif + +#include "includes.h" + +static int vfs_extd_audit_debug_level = DBGC_VFS; + +#undef DBGC_CLASS +#define DBGC_CLASS vfs_extd_audit_debug_level /* Function prototypes */ -static int audit_connect(struct connection_struct *conn, const char *svc, const char *user); -static void audit_disconnect(struct connection_struct *conn); -static DIR *audit_opendir(struct connection_struct *conn, const char *fname); -static int audit_mkdir(struct connection_struct *conn, const char *path, mode_t mode); -static int audit_rmdir(struct connection_struct *conn, const char *path); -static int audit_open(struct connection_struct *conn, const char *fname, int flags, mode_t mode); -static int audit_close(struct files_struct *fsp, int fd); -static int audit_rename(struct connection_struct *conn, const char *old, const char *new); -static int audit_unlink(struct connection_struct *conn, const char *path); -static int audit_chmod(struct connection_struct *conn, const char *path, mode_t mode); -static int audit_chmod_acl(struct connection_struct *conn, const char *name, mode_t mode); -static int audit_fchmod(struct files_struct *fsp, int fd, mode_t mode); -static int audit_fchmod_acl(struct files_struct *fsp, int fd, mode_t mode); +static int audit_connect(vfs_handle_struct *handle, connection_struct *conn, const char *svc, const char *user); +static void audit_disconnect(vfs_handle_struct *handle, connection_struct *conn); +static DIR *audit_opendir(vfs_handle_struct *handle, connection_struct *conn, const char *fname); +static int audit_mkdir(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode); +static int audit_rmdir(vfs_handle_struct *handle, connection_struct *conn, const char *path); +static int audit_open(vfs_handle_struct *handle, connection_struct *conn, const char *fname, int flags, mode_t mode); +static int audit_close(vfs_handle_struct *handle, files_struct *fsp, int fd); +static int audit_rename(vfs_handle_struct *handle, connection_struct *conn, const char *old, const char *new); +static int audit_unlink(vfs_handle_struct *handle, connection_struct *conn, const char *path); +static int audit_chmod(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode); +static int audit_chmod_acl(vfs_handle_struct *handle, connection_struct *conn, const char *name, mode_t mode); +static int audit_fchmod(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode); +static int audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode); /* VFS operations */ -static struct vfs_ops default_vfs_ops; /* For passthrough operation */ -static struct smb_vfs_handle_struct *audit_handle; - -static vfs_op_tuple audit_ops[] = { +static vfs_op_tuple audit_op_tuples[] = { /* Disk operations */ - {audit_connect, SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_LOGGER}, - {audit_disconnect, SMB_VFS_OP_DISCONNECT, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_connect), SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_disconnect), SMB_VFS_OP_DISCONNECT, SMB_VFS_LAYER_LOGGER}, /* Directory operations */ - {audit_opendir, SMB_VFS_OP_OPENDIR, SMB_VFS_LAYER_LOGGER}, - {audit_mkdir, SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_LOGGER}, - {audit_rmdir, SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_opendir), SMB_VFS_OP_OPENDIR, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_mkdir), SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_rmdir), SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_LOGGER}, /* File operations */ - {audit_open, SMB_VFS_OP_OPEN, SMB_VFS_LAYER_LOGGER}, - {audit_close, SMB_VFS_OP_CLOSE, SMB_VFS_LAYER_LOGGER}, - {audit_rename, SMB_VFS_OP_RENAME, SMB_VFS_LAYER_LOGGER}, - {audit_unlink, SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_LOGGER}, - {audit_chmod, SMB_VFS_OP_CHMOD, SMB_VFS_LAYER_LOGGER}, - {audit_fchmod, SMB_VFS_OP_FCHMOD, SMB_VFS_LAYER_LOGGER}, - {audit_chmod_acl, SMB_VFS_OP_CHMOD_ACL, SMB_VFS_LAYER_LOGGER}, - {audit_fchmod_acl, SMB_VFS_OP_FCHMOD_ACL, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_open), SMB_VFS_OP_OPEN, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_close), SMB_VFS_OP_CLOSE, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_rename), SMB_VFS_OP_RENAME, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_unlink), SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_chmod), SMB_VFS_OP_CHMOD, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_fchmod), SMB_VFS_OP_FCHMOD, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_chmod_acl), SMB_VFS_OP_CHMOD_ACL, SMB_VFS_LAYER_LOGGER}, + {SMB_VFS_OP(audit_fchmod_acl), SMB_VFS_OP_FCHMOD_ACL, SMB_VFS_LAYER_LOGGER}, /* Finish VFS operations definition */ - {NULL, SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} + {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} }; -/* VFS initialisation function. Return vfs_op_tuple array back to SAMBA. */ -static vfs_op_tuple *audit_init(const struct vfs_ops *def_vfs_ops, - struct smb_vfs_handle_struct *vfs_handle) +static int audit_syslog_facility(vfs_handle_struct *handle) { - memcpy(&default_vfs_ops, def_vfs_ops, sizeof(struct vfs_ops)); - - audit_handle = vfs_handle; + /* fix me: let this be configurable by: + * lp_param_enum(SNUM(handle->conn),(handle->param?handle->param:"extd_audit"),"syslog facility", + * audit_enum_facility,LOG_USER); + */ + return LOG_USER; +} - openlog("smbd_audit", LOG_PID, SYSLOG_FACILITY); - syslog(SYSLOG_PRIORITY, "VFS_INIT: vfs_ops loaded\n"); - return audit_ops; +static int audit_syslog_priority(vfs_handle_struct *handle) +{ + /* fix me: let this be configurable by: + * lp_param_enum(SNUM(handle->conn),(handle->param?handle->param:"extd_audit"),"syslog priority", + * audit_enum_priority,LOG_NOTICE); + */ + return LOG_NOTICE; } /* Implementation of vfs_ops. Pass everything on to the default operation but log event first. */ -static int audit_connect(struct connection_struct *conn, const char *svc, const char *user) +static int audit_connect(vfs_handle_struct *handle, connection_struct *conn, const char *svc, const char *user) { - syslog(SYSLOG_PRIORITY, "connect to service %s by user %s\n", + int result; + + openlog("smbd_audit", LOG_PID, audit_syslog_facility(handle)); + + syslog(audit_syslog_priority(handle), "connect to service %s by user %s\n", svc, user); DEBUG(10, ("Connected to service %s as user %s\n", svc, user)); - return default_vfs_ops.connect(conn, svc, user); + result = SMB_VFS_NEXT_CONNECT(handle, conn, svc, user); + + return result; } -static void audit_disconnect(struct connection_struct *conn) +static void audit_disconnect(vfs_handle_struct *handle, connection_struct *conn) { - syslog(SYSLOG_PRIORITY, "disconnected\n"); + syslog(audit_syslog_priority(handle), "disconnected\n"); DEBUG(10, ("Disconnected from VFS module extd_audit\n")); + SMB_VFS_NEXT_DISCONNECT(handle, conn); - default_vfs_ops.disconnect(conn); + return; } -static DIR *audit_opendir(struct connection_struct *conn, const char *fname) +static DIR *audit_opendir(vfs_handle_struct *handle, connection_struct *conn, const char *fname) { - DIR *result = default_vfs_ops.opendir(conn, fname); + DIR *result; + + result = SMB_VFS_NEXT_OPENDIR(handle, conn, fname); - syslog(SYSLOG_PRIORITY, "opendir %s %s%s\n", + syslog(audit_syslog_priority(handle), "opendir %s %s%s\n", fname, (result == NULL) ? "failed: " : "", (result == NULL) ? strerror(errno) : ""); - DEBUG(1, ("vfs_extd_audit: opendir %s %s %s", + DEBUG(1, ("vfs_extd_audit: opendir %s %s %s\n", fname, (result == NULL) ? "failed: " : "", (result == NULL) ? strerror(errno) : "")); @@ -149,11 +143,13 @@ static DIR *audit_opendir(struct connection_struct *conn, const char *fname) return result; } -static int audit_mkdir(struct connection_struct *conn, const char *path, mode_t mode) +static int audit_mkdir(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) { - int result = default_vfs_ops.mkdir(conn, path, mode); - - syslog(SYSLOG_PRIORITY, "mkdir %s %s%s\n", + int result; + + result = SMB_VFS_NEXT_MKDIR(handle, conn, path, mode); + + syslog(audit_syslog_priority(handle), "mkdir %s %s%s\n", path, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -165,11 +161,13 @@ static int audit_mkdir(struct connection_struct *conn, const char *path, mode_t return result; } -static int audit_rmdir(struct connection_struct *conn, const char *path) +static int audit_rmdir(vfs_handle_struct *handle, connection_struct *conn, const char *path) { - int result = default_vfs_ops.rmdir(conn, path); + int result; + + result = SMB_VFS_NEXT_RMDIR(handle, conn, path); - syslog(SYSLOG_PRIORITY, "rmdir %s %s%s\n", + syslog(audit_syslog_priority(handle), "rmdir %s %s%s\n", path, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -181,11 +179,13 @@ static int audit_rmdir(struct connection_struct *conn, const char *path) return result; } -static int audit_open(struct connection_struct *conn, const char *fname, int flags, mode_t mode) +static int audit_open(vfs_handle_struct *handle, connection_struct *conn, const char *fname, int flags, mode_t mode) { - int result = default_vfs_ops.open(conn, fname, flags, mode); + int result; + + result = SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode); - syslog(SYSLOG_PRIORITY, "open %s (fd %d) %s%s%s\n", + syslog(audit_syslog_priority(handle), "open %s (fd %d) %s%s%s\n", fname, result, ((flags & O_WRONLY) || (flags & O_RDWR)) ? "for writing " : "", (result < 0) ? "failed: " : "", @@ -198,11 +198,13 @@ static int audit_open(struct connection_struct *conn, const char *fname, int fla return result; } -static int audit_close(struct files_struct *fsp, int fd) +static int audit_close(vfs_handle_struct *handle, files_struct *fsp, int fd) { - int result = default_vfs_ops.close(fsp, fd); + int result; + + result = SMB_VFS_NEXT_CLOSE(handle, fsp, fd); - syslog(SYSLOG_PRIORITY, "close fd %d %s%s\n", + syslog(audit_syslog_priority(handle), "close fd %d %s%s\n", fd, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -214,11 +216,13 @@ static int audit_close(struct files_struct *fsp, int fd) return result; } -static int audit_rename(struct connection_struct *conn, const char *old, const char *new) +static int audit_rename(vfs_handle_struct *handle, connection_struct *conn, const char *old, const char *new) { - int result = default_vfs_ops.rename(conn, old, new); + int result; + + result = SMB_VFS_NEXT_RENAME(handle, conn, old, new); - syslog(SYSLOG_PRIORITY, "rename %s -> %s %s%s\n", + syslog(audit_syslog_priority(handle), "rename %s -> %s %s%s\n", old, new, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -230,11 +234,13 @@ static int audit_rename(struct connection_struct *conn, const char *old, const c return result; } -static int audit_unlink(struct connection_struct *conn, const char *path) +static int audit_unlink(vfs_handle_struct *handle, connection_struct *conn, const char *path) { - int result = default_vfs_ops.unlink(conn, path); + int result; + + result = SMB_VFS_NEXT_UNLINK(handle, conn, path); - syslog(SYSLOG_PRIORITY, "unlink %s %s%s\n", + syslog(audit_syslog_priority(handle), "unlink %s %s%s\n", path, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -246,11 +252,13 @@ static int audit_unlink(struct connection_struct *conn, const char *path) return result; } -static int audit_chmod(struct connection_struct *conn, const char *path, mode_t mode) +static int audit_chmod(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) { - int result = default_vfs_ops.chmod(conn, path, mode); + int result; - syslog(SYSLOG_PRIORITY, "chmod %s mode 0x%x %s%s\n", + result = SMB_VFS_NEXT_CHMOD(handle, conn, path, mode); + + syslog(audit_syslog_priority(handle), "chmod %s mode 0x%x %s%s\n", path, mode, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -262,11 +270,13 @@ static int audit_chmod(struct connection_struct *conn, const char *path, mode_t return result; } -static int audit_chmod_acl(struct connection_struct *conn, const char *path, mode_t mode) +static int audit_chmod_acl(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) { - int result = default_vfs_ops.chmod_acl(conn, path, mode); + int result; + + result = SMB_VFS_NEXT_CHMOD_ACL(handle, conn, path, mode); - syslog(SYSLOG_PRIORITY, "chmod_acl %s mode 0x%x %s%s\n", + syslog(audit_syslog_priority(handle), "chmod_acl %s mode 0x%x %s%s\n", path, mode, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -278,11 +288,13 @@ static int audit_chmod_acl(struct connection_struct *conn, const char *path, mod return result; } -static int audit_fchmod(struct files_struct *fsp, int fd, mode_t mode) +static int audit_fchmod(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode) { - int result = default_vfs_ops.fchmod(fsp, fd, mode); + int result; + + result = SMB_VFS_NEXT_FCHMOD(handle, fsp, fd, mode); - syslog(SYSLOG_PRIORITY, "fchmod %s mode 0x%x %s%s\n", + syslog(audit_syslog_priority(handle), "fchmod %s mode 0x%x %s%s\n", fsp->fsp_name, mode, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -294,11 +306,13 @@ static int audit_fchmod(struct files_struct *fsp, int fd, mode_t mode) return result; } -static int audit_fchmod_acl(struct files_struct *fsp, int fd, mode_t mode) +static int audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode) { - int result = default_vfs_ops.fchmod_acl(fsp, fd, mode); + int result; + + result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, fd, mode); - syslog(SYSLOG_PRIORITY, "fchmod_acl %s mode 0x%x %s%s\n", + syslog(audit_syslog_priority(handle), "fchmod_acl %s mode 0x%x %s%s\n", fsp->fsp_name, mode, (result < 0) ? "failed: " : "", (result < 0) ? strerror(errno) : ""); @@ -312,5 +326,18 @@ static int audit_fchmod_acl(struct files_struct *fsp, int fd, mode_t mode) NTSTATUS vfs_extd_audit_init(void) { - return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "extd_audit", audit_init); + NTSTATUS ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "extd_audit", audit_op_tuples); + + if (!NT_STATUS_IS_OK(ret)) + return ret; + + vfs_extd_audit_debug_level = debug_add_class("extd_audit"); + if (vfs_extd_audit_debug_level == -1) { + vfs_extd_audit_debug_level = DBGC_VFS; + DEBUG(0, ("vfs_extd_audit: Couldn't register custom debugging class!\n")); + } else { + DEBUG(10, ("vfs_extd_audit: Debug class number of 'extd_audit': %d\n", vfs_extd_audit_debug_level)); + } + + return ret; } diff --git a/source3/modules/vfs_fake_perms.c b/source3/modules/vfs_fake_perms.c index 3a18fbb730..740218dcd4 100644 --- a/source3/modules/vfs_fake_perms.c +++ b/source3/modules/vfs_fake_perms.c @@ -22,31 +22,16 @@ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ -#include "config.h" +#include "includes.h" -#include -#include -#ifdef HAVE_UTIME_H -#include -#endif -#ifdef HAVE_DIRENT_H -#include -#endif -#ifdef HAVE_FCNTL_H -#include -#endif -#include -#include +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_VFS -#include -#include - -static struct vfs_ops default_vfs_ops; /* For passthrough operation */ -static struct smb_vfs_handle_struct *fake_perms_handle; /* use fake_perms_handle->data for storing per-instance private data */ - -static int fake_perms_stat(struct connection_struct *conn, const char *fname, SMB_STRUCT_STAT *sbuf) +static int fake_perms_stat(vfs_handle_struct *handle, connection_struct *conn, const char *fname, SMB_STRUCT_STAT *sbuf) { - int ret = default_vfs_ops.stat(conn, fname, sbuf); + int ret = -1; + + ret = SMB_VFS_NEXT_STAT(handle, conn, fname, sbuf); if (ret == 0) { extern struct current_user current_user; @@ -58,12 +43,15 @@ static int fake_perms_stat(struct connection_struct *conn, const char *fname, SM sbuf->st_uid = current_user.uid; sbuf->st_gid = current_user.gid; } + return ret; } -static int fake_perms_fstat(struct files_struct *fsp, int fd, SMB_STRUCT_STAT *sbuf) +static int fake_perms_fstat(vfs_handle_struct *handle, files_struct *fsp, int fd, SMB_STRUCT_STAT *sbuf) { - int ret = default_vfs_ops.fstat(fsp, fd, sbuf); + int ret = -1; + + ret = SMB_VFS_NEXT_FSTAT(handle, fsp, fd, sbuf); if (ret == 0) { extern struct current_user current_user; @@ -78,210 +66,16 @@ static int fake_perms_fstat(struct files_struct *fsp, int fd, SMB_STRUCT_STAT *s return ret; } -#if 0 -static size_t fake_perms_fget_nt_acl(struct files_struct *fsp, int fd, struct security_descriptor_info **ppdesc) -{ - return default_vfs_ops.fget_nt_acl(fsp, fd, ppdesc); -} - -static size_t fake_perms_get_nt_acl(struct files_struct *fsp, const char *name, struct security_descriptor_info **ppdesc) -{ - return default_vfs_ops.get_nt_acl(fsp, name, ppdesc); -} - -static BOOL fake_perms_fset_nt_acl(struct files_struct *fsp, int fd, uint32 security_info_sent, struct security_descriptor_info *psd) -{ - return default_vfs_ops.fset_nt_acl(fsp, fd, security_info_sent, psd); -} - -static BOOL fake_perms_set_nt_acl(struct files_struct *fsp, const char *name, uint32 security_info_sent, struct security_descriptor_info *psd) -{ - return default_vfs_ops.set_nt_acl(fsp, name, security_info_sent, psd); -} - -static BOOL fake_perms_chmod_acl(struct connection_struct *conn, const char *name, mode_t mode) -{ - return default_vfs_ops.chmod_acl(conn, name, mode); -} - -static BOOL fake_perms_fchmod_acl(struct files_struct *fsp, int fd, mode_t mode) -{ - return default_vfs_ops.fchmod_acl(fsp, fd, mode); -} - -static int fake_perms_sys_acl_get_entry(struct connection_struct *conn, SMB_ACL_T theacl, int entry_id, SMB_ACL_ENTRY_T *entry_p) -{ - return default_vfs_ops.sys_acl_get_entry(conn, theacl, entry_id, entry_p); -} - -static int fake_perms_sys_acl_get_tag_type(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_TAG_T *tag_type_p) -{ - return default_vfs_ops.sys_acl_get_tag_type(conn, entry_d, tag_type_p); -} - -static int fake_perms_sys_acl_get_permset(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_PERMSET_T *permset_p) -{ - return default_vfs_ops.sys_acl_get_permset(conn, entry_d, permset_p); -} - -static void *fake_perms_sys_acl_get_qualifier(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d) -{ - return default_vfs_ops.sys_acl_get_qualifier(conn, entry_d); -} - -static SMB_ACL_T fake_perms_sys_acl_get_file(struct connection_struct *conn, const char *path_p, SMB_ACL_TYPE_T type) -{ - return default_vfs_ops.sys_acl_get_file(conn, path_p, type); -} - -static SMB_ACL_T fake_perms_sys_acl_get_fd(struct files_struct *fsp, int fd) -{ - return default_vfs_ops.sys_acl_get_fd(fsp, fd); -} - -static int fake_perms_sys_acl_clear_perms(struct connection_struct *conn, SMB_ACL_PERMSET_T permset) -{ - return default_vfs_ops.sys_acl_clear_perms(conn, permset); -} - -static int fake_perms_sys_acl_add_perm(struct connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm) -{ - return default_vfs_ops.sys_acl_add_perm(conn, permset, perm); -} - -static char *fake_perms_sys_acl_to_text(struct connection_struct *conn, SMB_ACL_T theacl, ssize_t *plen) -{ - return default_vfs_ops.sys_acl_to_text(conn, theacl, plen); -} - -static SMB_ACL_T fake_perms_sys_acl_init(struct connection_struct *conn, int count) -{ - return default_vfs_ops.sys_acl_init(conn, count); -} - -static int fake_perms_sys_acl_create_entry(struct connection_struct *conn, SMB_ACL_T *pacl, SMB_ACL_ENTRY_T *pentry) -{ - return default_vfs_ops.sys_acl_create_entry(conn, pacl, pentry); -} - -static int fake_perms_sys_acl_set_tag_type(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_TAG_T tagtype) -{ - return default_vfs_ops.sys_acl_set_tag_type(conn, entry, tagtype); -} - -static int fake_perms_sys_acl_set_qualifier(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, void *qual) -{ - return default_vfs_ops.sys_acl_set_qualifier(conn, entry, qual); -} - -static int fake_perms_sys_acl_set_permset(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_PERMSET_T permset) -{ - return default_vfs_ops.sys_acl_set_permset(conn, entry, permset); -} - -static int fake_perms_sys_acl_valid(struct connection_struct *conn, SMB_ACL_T theacl ) -{ - return default_vfs_ops.sys_acl_valid(conn, theacl ); -} - -static int fake_perms_sys_acl_set_file(struct connection_struct *conn, const char *name, SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl) -{ - return default_vfs_ops.sys_acl_set_file(conn, name, acltype, theacl); -} - -static int fake_perms_sys_acl_set_fd(struct files_struct *fsp, int fd, SMB_ACL_T theacl) -{ - return default_vfs_ops.sys_acl_set_fd(fsp, fd, theacl); -} - -static int fake_perms_sys_acl_delete_def_file(struct connection_struct *conn, const char *path) -{ - return default_vfs_ops.sys_acl_delete_def_file(conn, path); -} - -static int fake_perms_sys_acl_get_perm(struct connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm) -{ - return default_vfs_ops.sys_acl_get_perm(conn, permset, perm); -} - -static int fake_perms_sys_acl_free_text(struct connection_struct *conn, char *text) -{ - return default_vfs_ops.sys_acl_free_text(conn, text); -} - -static int fake_perms_sys_acl_free_acl(struct connection_struct *conn, SMB_ACL_T posix_acl) -{ - return default_vfs_ops.sys_acl_free_acl(conn, posix_acl); -} - -static int fake_perms_sys_acl_free_qualifier(struct connection_struct *conn, void *qualifier, SMB_ACL_TAG_T tagtype) -{ - return default_vfs_ops.sys_acl_free_qualifier(conn, qualifier, tagtype); -} -#endif - /* VFS operations structure */ -static vfs_op_tuple fake_perms_ops[] = { - - /* NT File ACL operations */ -#if 0 - {fake_perms_fget_nt_acl, SMB_VFS_OP_FGET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_get_nt_acl, SMB_VFS_OP_GET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_fset_nt_acl, SMB_VFS_OP_FSET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_set_nt_acl, SMB_VFS_OP_SET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT}, - - /* POSIX ACL operations */ +static vfs_op_tuple fake_perms_ops[] = { + {SMB_VFS_OP(fake_perms_stat), SMB_VFS_OP_STAT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(fake_perms_fstat), SMB_VFS_OP_FSTAT, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_chmod_acl, SMB_VFS_OP_CHMOD_ACL, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_fchmod_acl, SMB_VFS_OP_FCHMOD_ACL, SMB_VFS_LAYER_TRANSPARENT}, - - {fake_perms_sys_acl_get_entry, SMB_VFS_OP_SYS_ACL_GET_ENTRY, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_get_tag_type, SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_get_permset, SMB_VFS_OP_SYS_ACL_GET_PERMSET, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_get_qualifier, SMB_VFS_OP_SYS_ACL_GET_QUALIFIER, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_get_file, SMB_VFS_OP_SYS_ACL_GET_FILE, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_get_fd, SMB_VFS_OP_SYS_ACL_GET_FD, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_clear_perms, SMB_VFS_OP_SYS_ACL_CLEAR_PERMS, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_add_perm, SMB_VFS_OP_SYS_ACL_ADD_PERM, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_to_text, SMB_VFS_OP_SYS_ACL_TO_TEXT, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_init, SMB_VFS_OP_SYS_ACL_INIT, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_create_entry, SMB_VFS_OP_SYS_ACL_CREATE_ENTRY, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_set_tag_type, SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_set_qualifier, SMB_VFS_OP_SYS_ACL_SET_QUALIFIER, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_set_permset, SMB_VFS_OP_SYS_ACL_SET_PERMSET, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_valid, SMB_VFS_OP_SYS_ACL_VALID, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_set_file, SMB_VFS_OP_SYS_ACL_SET_FILE, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_set_fd, SMB_VFS_OP_SYS_ACL_SET_FD, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_delete_def_file, SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_get_perm, SMB_VFS_OP_SYS_ACL_GET_PERM, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_free_text, SMB_VFS_OP_SYS_ACL_FREE_TEXT, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_free_acl, SMB_VFS_OP_SYS_ACL_FREE_ACL, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_sys_acl_free_qualifier, SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER, SMB_VFS_LAYER_TRANSPARENT}, -#endif - - {fake_perms_stat, SMB_VFS_OP_STAT, SMB_VFS_LAYER_TRANSPARENT}, - {fake_perms_fstat, SMB_VFS_OP_FSTAT, SMB_VFS_LAYER_TRANSPARENT}, - {NULL, SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} + {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} }; -/* VFS initialisation - return initialized vfs_op_tuple array back to Samba */ - -static vfs_op_tuple *fake_perms_init(const struct vfs_ops *def_vfs_ops, - struct smb_vfs_handle_struct *vfs_handle) -{ - DEBUG(3, ("Initialising default vfs hooks\n")); - - memcpy(&default_vfs_ops, def_vfs_ops, sizeof(struct vfs_ops)); - - /* Remember vfs_handle for further allocation and referencing of private - information in vfs_handle->data - */ - fake_perms_handle = vfs_handle; - return fake_perms_ops; -} - NTSTATUS vfs_fake_perms_init(void) { - return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "fake_perms", fake_perms_init); + return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "fake_perms", fake_perms_ops); } diff --git a/source3/modules/vfs_netatalk.c b/source3/modules/vfs_netatalk.c index 718bc2a35c..ae6286e292 100644 --- a/source3/modules/vfs_netatalk.c +++ b/source3/modules/vfs_netatalk.c @@ -2,6 +2,7 @@ * AppleTalk VFS module for Samba-3.x * * Copyright (C) Alexei Kotovich, 2002 + * Copyright (C) Stefan (metze) Metzmacher, 2003 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -18,22 +19,10 @@ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ -#include "config.h" -#include -#include -#ifdef HAVE_UTIME_H -#include -#endif -#ifdef HAVE_DIRENT_H -#include -#endif -#ifdef HAVE_FCNTL_H -#include -#endif -#include -#include -#include -#include +#include "includes.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_VFS #define APPLEDOUBLE ".AppleDouble" #define ADOUBLEMODE 0777 @@ -46,9 +35,6 @@ static int atalk_build_paths(TALLOC_CTX *ctx, const char *path, static int atalk_unlink_file(const char *path); -static struct vfs_ops default_vfs_ops; /* For passthrough operation */ -static struct smb_vfs_handle_struct *atalk_handle; - static int atalk_get_path_ptr(char *path) { int i = 0; @@ -187,11 +173,11 @@ static void atalk_rrmdir(TALLOC_CTX *ctx, char *path) /* Directory operations */ -DIR *atalk_opendir(struct connection_struct *conn, const char *fname) +DIR *atalk_opendir(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *fname) { DIR *ret = 0; - - ret = default_vfs_ops.opendir(conn, fname); + + ret = SMB_VFS_NEXT_OPENDIR(handle, conn, fname); /* * when we try to perform delete operation upon file which has fork @@ -208,7 +194,7 @@ DIR *atalk_opendir(struct connection_struct *conn, const char *fname) return ret; } -static int atalk_rmdir(struct connection_struct *conn, const char *path) +static int atalk_rmdir(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path) { BOOL add = False; TALLOC_CTX *ctx = 0; @@ -233,12 +219,12 @@ static int atalk_rmdir(struct connection_struct *conn, const char *path) exit_rmdir: talloc_destroy(ctx); - return default_vfs_ops.rmdir(conn, path); + return SMB_VFS_NEXT_RMDIR(handle, conn, path); } /* File operations */ -static int atalk_rename(struct connection_struct *conn, const char *old, const char *new) +static int atalk_rename(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *old, const char *new) { int ret = 0; char *adbl_path = 0; @@ -247,7 +233,7 @@ static int atalk_rename(struct connection_struct *conn, const char *old, const c SMB_STRUCT_STAT orig_info; TALLOC_CTX *ctx; - ret = default_vfs_ops.rename(conn, old, new); + ret = SMB_VFS_NEXT_RENAME(handle, conn, old, new); if (!conn || !old) return ret; @@ -270,7 +256,7 @@ exit_rename: return ret; } -static int atalk_unlink(struct connection_struct *conn, const char *path) +static int atalk_unlink(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path) { int ret = 0, i; char *adbl_path = 0; @@ -279,7 +265,7 @@ static int atalk_unlink(struct connection_struct *conn, const char *path) SMB_STRUCT_STAT orig_info; TALLOC_CTX *ctx; - ret = default_vfs_ops.unlink(conn, path); + ret = SMB_VFS_NEXT_UNLINK(handle, conn, path); if (!conn || !path) return ret; @@ -326,7 +312,7 @@ exit_unlink: return ret; } -static int atalk_chmod(struct connection_struct *conn, const char *path, mode_t mode) +static int atalk_chmod(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path, mode_t mode) { int ret = 0; char *adbl_path = 0; @@ -335,7 +321,7 @@ static int atalk_chmod(struct connection_struct *conn, const char *path, mode_t SMB_STRUCT_STAT orig_info; TALLOC_CTX *ctx; - ret = default_vfs_ops.chmod(conn, path, mode); + ret = SMB_VFS_NEXT_CHMOD(handle, conn, path, mode); if (!conn || !path) return ret; @@ -358,7 +344,7 @@ exit_chmod: return ret; } -static int atalk_chown(struct connection_struct *conn, const char *path, uid_t uid, gid_t gid) +static int atalk_chown(struct vfs_handle_struct *handle, struct connection_struct *conn, const char *path, uid_t uid, gid_t gid) { int ret = 0; char *adbl_path = 0; @@ -367,7 +353,7 @@ static int atalk_chown(struct connection_struct *conn, const char *path, uid_t u SMB_STRUCT_STAT orig_info; TALLOC_CTX *ctx; - ret = default_vfs_ops.chown(conn, path, uid, gid); + ret = SMB_VFS_NEXT_CHOWN(handle, conn, path, uid, gid); if (!conn || !path) return ret; @@ -394,34 +380,22 @@ static vfs_op_tuple atalk_ops[] = { /* Directory operations */ - {atalk_opendir, SMB_VFS_OP_OPENDIR, SMB_VFS_LAYER_TRANSPARENT}, - {atalk_rmdir, SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(atalk_opendir), SMB_VFS_OP_OPENDIR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(atalk_rmdir), SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_TRANSPARENT}, /* File operations */ - {atalk_rename, SMB_VFS_OP_RENAME, SMB_VFS_LAYER_TRANSPARENT}, - {atalk_unlink, SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_TRANSPARENT}, - {atalk_chmod, SMB_VFS_OP_CHMOD, SMB_VFS_LAYER_TRANSPARENT}, - {atalk_chown, SMB_VFS_OP_CHOWN, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(atalk_rename), SMB_VFS_OP_RENAME, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(atalk_unlink), SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(atalk_chmod), SMB_VFS_OP_CHMOD, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(atalk_chown), SMB_VFS_OP_CHOWN, SMB_VFS_LAYER_TRANSPARENT}, /* Finish VFS operations definition */ - {NULL, SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} + {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} }; -/* VFS initialisation function. Return vfs_op_tuple array back to SAMBA. */ -static vfs_op_tuple *netatalk_init(const struct vfs_ops *def_vfs_ops, - struct smb_vfs_handle_struct *vfs_handle) -{ - memcpy(&default_vfs_ops, def_vfs_ops, sizeof(struct vfs_ops)); - - atalk_handle = vfs_handle; - - DEBUG(3, ("ATALK: vfs module loaded\n")); - return atalk_ops; -} - NTSTATUS vfs_netatalk_init(void) { - return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "netatalk", netatalk_init); + return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "netatalk", atalk_ops); } diff --git a/source3/modules/vfs_recycle.c b/source3/modules/vfs_recycle.c index 87dea944ac..e725daedba 100644 --- a/source3/modules/vfs_recycle.c +++ b/source3/modules/vfs_recycle.c @@ -6,6 +6,7 @@ * Copyright (C) 2002, Alexander Bokovoy - cascaded VFS adoption, * Copyright (C) 2002, Juergen Hasch - added some options. * Copyright (C) 2002, Simo Sorce + * Copyright (C) 2002, Stefan (metze) Metzmacher * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -30,231 +31,133 @@ static int vfs_recycle_debug_level = DBGC_VFS; #undef DBGC_CLASS #define DBGC_CLASS vfs_recycle_debug_level - -static const char *delimiter = "|"; /* delimiter for options */ - -/* One per connection */ - -typedef struct recycle_bin_struct -{ - TALLOC_CTX *mem_ctx; - char *repository; /* name of the recycle bin directory */ - BOOL keep_dir_tree; /* keep directory structure of deleted file in recycle bin */ - BOOL versions; /* create versions of deleted files with identical name */ - BOOL touch; /* touch access date of deleted file */ - char *exclude; /* which files to exclude */ - char *exclude_dir; /* which directories to exclude */ - char *noversions; /* which files to exclude from versioning */ - SMB_OFF_T maxsize; /* maximum file size to be saved */ -} recycle_bin_struct; - -typedef struct recycle_bin_connections { - int conn; - recycle_bin_struct *data; - struct recycle_bin_connections *next; -} recycle_bin_connections; - -typedef struct recycle_bin_private_data { - TALLOC_CTX *mem_ctx; - recycle_bin_connections *conns; -} recycle_bin_private_data; - -struct smb_vfs_handle_struct *recycle_bin_private_handle; - -/* VFS operations */ -static struct vfs_ops default_vfs_ops; /* For passthrough operation */ - -static int recycle_connect(struct connection_struct *conn, const char *service, const char *user); -static void recycle_disconnect(struct connection_struct *conn); -static int recycle_unlink(connection_struct *, const char *); - -#define VFS_OP(x) ((void *) x) + +static int recycle_connect(vfs_handle_struct *handle, connection_struct *conn, const char *service, const char *user); +static void recycle_disconnect(vfs_handle_struct *handle, connection_struct *conn); +static int recycle_unlink(vfs_handle_struct *handle, connection_struct *conn, const char *name); static vfs_op_tuple recycle_ops[] = { /* Disk operations */ - {VFS_OP(recycle_connect), SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_TRANSPARENT}, - {VFS_OP(recycle_disconnect), SMB_VFS_OP_DISCONNECT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(recycle_connect), SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(recycle_disconnect), SMB_VFS_OP_DISCONNECT, SMB_VFS_LAYER_TRANSPARENT}, /* File operations */ - {VFS_OP(recycle_unlink), SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(recycle_unlink), SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_TRANSPARENT}, - {NULL, SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} + {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} }; -/** - * VFS initialisation function. - * - * @retval initialised vfs_op_tuple array - **/ -static vfs_op_tuple *recycle_init(const struct vfs_ops *def_vfs_ops, - struct smb_vfs_handle_struct *vfs_handle) +static int recycle_connect(vfs_handle_struct *handle, connection_struct *conn, const char *service, const char *user) { - TALLOC_CTX *mem_ctx = NULL; + DEBUG(10,("recycle_connect() connect to service[%s] as user[%s].\n", + service,user)); - DEBUG(10, ("Initializing VFS module recycle\n")); - memcpy(&default_vfs_ops, def_vfs_ops, sizeof(struct vfs_ops)); - vfs_recycle_debug_level = debug_add_class("vfs_recycle_bin"); - if (vfs_recycle_debug_level == -1) { - vfs_recycle_debug_level = DBGC_VFS; - DEBUG(0, ("vfs_recycle: Couldn't register custom debugging class!\n")); - } else { - DEBUG(0, ("vfs_recycle: Debug class number of 'vfs_recycle': %d\n", vfs_recycle_debug_level)); - } - - recycle_bin_private_handle = vfs_handle; - if (!(mem_ctx = talloc_init("recycle bin data"))) { - DEBUG(0, ("Failed to allocate memory in VFS module recycle_bin\n")); - return NULL; - } + return SMB_VFS_NEXT_CONNECT(handle, conn, service, user); +} - recycle_bin_private_handle->data = talloc(mem_ctx, sizeof(recycle_bin_private_data)); - if (recycle_bin_private_handle->data == NULL) { - DEBUG(0, ("Failed to allocate memory in VFS module recycle_bin\n")); - return NULL; - } - ((recycle_bin_private_data *)(recycle_bin_private_handle->data))->mem_ctx = mem_ctx; - ((recycle_bin_private_data *)(recycle_bin_private_handle->data))->conns = NULL; +static void recycle_disconnect(vfs_handle_struct *handle, connection_struct *conn) +{ + DEBUG(10,("recycle_disconnect() connect to service[%s].\n", + lp_servicename(SNUM(conn)))); - return recycle_ops; + SMB_VFS_NEXT_DISCONNECT(handle, conn); } -static int recycle_connect(struct connection_struct *conn, const char *service, const char *user) +static const char *recycle_repository(vfs_handle_struct *handle) { - TALLOC_CTX *ctx = NULL; - recycle_bin_struct *recbin; - recycle_bin_connections *recconn; - recycle_bin_connections *recconnbase; - recycle_bin_private_data *recdata; - const char *tmp_str; + const char *tmp_str = NULL; + - DEBUG(10, ("Called for service %s (%d) as user %s\n", service, SNUM(conn), user)); + tmp_str = lp_parm_const_string(SNUM(handle->conn), "recycle", "repository",".recycle"); - if (recycle_bin_private_handle) - recdata = (recycle_bin_private_data *)(recycle_bin_private_handle->data); - else { - DEBUG(0, ("Recycle bin not initialized!\n")); - return -1; - } + DEBUG(10, ("recycle: repository = %s\n", tmp_str)); + + return tmp_str; +} - if (!(ctx = talloc_init("recycle bin connection"))) { - DEBUG(0, ("Failed to allocate memory in VFS module recycle_bin\n")); - return -1; - } +static BOOL recycle_keep_dir_tree(vfs_handle_struct *handle) +{ + BOOL ret; + + ret = lp_parm_bool(SNUM(handle->conn), "recycle", "keeptree", False); - recbin = talloc_zero(ctx, sizeof(recycle_bin_struct)); - if (recbin == NULL) { - DEBUG(0, ("Failed to allocate memory in VFS module recycle_bin\n")); - return -1; - } - recbin->mem_ctx = ctx; - - /* parse configuration options */ - if ((tmp_str = lp_parm_const_string(SNUM(conn), "vfs_recycle_bin", "repository", ".recycle")) != NULL) { - recbin->repository = talloc_sub_conn(recbin->mem_ctx, conn, tmp_str); - ALLOC_CHECK(recbin->repository, error); - trim_string(recbin->repository, "/", "/"); - DEBUG(5, ("recycle.bin: repository = %s\n", recbin->repository)); - } else { - DEBUG(0,("recycle.bin: no repository found (fail) !\n")); - goto error; - } + DEBUG(10, ("recycle_bin: keeptree = %s\n", ret?"True":"False")); - recbin->keep_dir_tree = lp_parm_bool(SNUM(conn), "vfs_recycle_bin", "keeptree", False); - DEBUG(5, ("recycle.bin: keeptree = %d\n", recbin->keep_dir_tree)); + return ret; +} + +static BOOL recycle_versions(vfs_handle_struct *handle) +{ + BOOL ret; + + ret = lp_parm_bool(SNUM(handle->conn), "recycle", "versions", False); + + DEBUG(10, ("recycle: versions = %s\n", ret?"True":"False")); - recbin->versions = lp_parm_bool(SNUM(conn), "vfs_recycle_bin", "versions", False); - DEBUG(5, ("recycle.bin: versions = %d\n", recbin->versions)); + return ret; +} + +static BOOL recycle_touch(vfs_handle_struct *handle) +{ + BOOL ret; + + ret = lp_parm_bool(SNUM(handle->conn), "recycle", "touch", False); + + DEBUG(10, ("recycle: touch = %s\n", ret?"True":"False")); - recbin->touch = lp_parm_bool(SNUM(conn), "vfs_recycle_bin", "touch", False); - DEBUG(5, ("recycle.bin: touch = %d\n", recbin->touch)); + return ret; +} - recbin->maxsize = lp_parm_ulong(SNUM(conn), "vfs_recycle_bin", "maxsize" , 0); - if (recbin->maxsize == 0) { - recbin->maxsize = -1; - DEBUG(5, ("recycle.bin: maxsize = -infinite-\n")); - } else { - DEBUG(5, ("recycle.bin: maxsize = %ld\n", (long int)recbin->maxsize)); - } +static const char **recycle_exclude(vfs_handle_struct *handle) +{ + const char **tmp_lp; + + tmp_lp = lp_parm_string_list(SNUM(handle->conn), "recycle", "exclude", NULL); - if ((tmp_str = lp_parm_const_string(SNUM(conn), "vfs_recycle_bin", "exclude", "")) != NULL) { - recbin->exclude = talloc_strdup(recbin->mem_ctx, tmp_str); - ALLOC_CHECK(recbin->exclude, error); - DEBUG(5, ("recycle.bin: exclude = %s\n", recbin->exclude)); - } - if ((tmp_str = lp_parm_const_string(SNUM(conn), "vfs_recycle_bin", "exclude_dir", "")) != NULL) { - recbin->exclude_dir = talloc_strdup(recbin->mem_ctx, tmp_str); - ALLOC_CHECK(recbin->exclude_dir, error); - DEBUG(5, ("recycle.bin: exclude_dir = %s\n", recbin->exclude_dir)); - } - if ((tmp_str = lp_parm_const_string(SNUM(conn), "vfs_recycle_bin", "noversions", "")) != NULL) { - recbin->noversions = talloc_strdup(recbin->mem_ctx, tmp_str); - ALLOC_CHECK(recbin->noversions, error); - DEBUG(5, ("recycle.bin: noversions = %s\n", recbin->noversions)); - } + DEBUG(10, ("recycle: exclude = %s ...\n", tmp_lp?*tmp_lp:"")); + + return tmp_lp; +} - recconn = talloc(recdata->mem_ctx, sizeof(recycle_bin_connections)); - if (recconn == NULL) { - DEBUG(0, ("Failed to allocate memory in VFS module recycle_bin\n")); - goto error; - } - recconn->conn = SNUM(conn); - recconn->data = recbin; - recconn->next = NULL; - if (recdata->conns) { - recconnbase = recdata->conns; - while (recconnbase->next != NULL) recconnbase = recconnbase->next; - recconnbase->next = recconn; - } else { - recdata->conns = recconn; - } - return default_vfs_ops.connect(conn, service, user); +static const char **recycle_exclude_dir(vfs_handle_struct *handle) +{ + const char **tmp_lp; + + tmp_lp = lp_parm_string_list(SNUM(handle->conn), "recycle", "exclude_dir", NULL); -error: - talloc_destroy(ctx); - return -1; + DEBUG(10, ("recycle: exclude_dir = %s ...\n", tmp_lp?*tmp_lp:"")); + + return tmp_lp; } -static void recycle_disconnect(struct connection_struct *conn) +static const char **recycle_noversions(vfs_handle_struct *handle) { - recycle_bin_private_data *recdata; - recycle_bin_connections *recconn; + const char **tmp_lp; + + tmp_lp = lp_parm_string_list(SNUM(handle->conn), "recycle", "noversions", NULL); - DEBUG(10, ("Disconnecting VFS module recycle bin\n")); + DEBUG(10, ("recycle: noversions = %s\n", tmp_lp?*tmp_lp:"")); + + return tmp_lp; +} - if (recycle_bin_private_handle) - recdata = (recycle_bin_private_data *)(recycle_bin_private_handle->data); - else { - DEBUG(0, ("Recycle bin not initialized!\n")); - return; - } +static int recycle_maxsize(vfs_handle_struct *handle) +{ + int maxsize; + + maxsize = lp_parm_int(SNUM(handle->conn), "recycle", "maxsize", -1); - if (recdata) { - if (recdata->conns) { - if (recdata->conns->conn == SNUM(conn)) { - talloc_destroy(recdata->conns->data->mem_ctx); - recdata->conns = recdata->conns->next; - } else { - recconn = recdata->conns; - while (recconn->next) { - if (recconn->next->conn == SNUM(conn)) { - talloc_destroy(recconn->next->data->mem_ctx); - recconn->next = recconn->next->next; - break; - } - recconn = recconn->next; - } - } - } - } - default_vfs_ops.disconnect(conn); + DEBUG(10, ("recycle: maxsize = %d\n", maxsize)); + + return maxsize; } -static BOOL recycle_directory_exist(connection_struct *conn, const char *dname) +static BOOL recycle_directory_exist(vfs_handle_struct *handle, const char *dname) { SMB_STRUCT_STAT st; - if (default_vfs_ops.stat(conn, dname, &st) == 0) { + if (SMB_VFS_NEXT_STAT(handle, handle->conn, dname, &st) == 0) { if (S_ISDIR(st.st_mode)) { return True; } @@ -263,11 +166,11 @@ static BOOL recycle_directory_exist(connection_struct *conn, const char *dname) return False; } -static BOOL recycle_file_exist(connection_struct *conn, const char *fname) +static BOOL recycle_file_exist(vfs_handle_struct *handle, const char *fname) { SMB_STRUCT_STAT st; - if (default_vfs_ops.stat(conn, fname, &st) == 0) { + if (SMB_VFS_NEXT_STAT(handle, handle->conn, fname, &st) == 0) { if (S_ISREG(st.st_mode)) { return True; } @@ -282,13 +185,15 @@ static BOOL recycle_file_exist(connection_struct *conn, const char *fname) * @param fname file name * @return size in bytes **/ -static SMB_OFF_T recycle_get_file_size(connection_struct *conn, const char *fname) +static SMB_OFF_T recycle_get_file_size(vfs_handle_struct *handle, const char *fname) { SMB_STRUCT_STAT st; - if (default_vfs_ops.stat(conn, fname, &st) != 0) { - DEBUG(0,("recycle.bin: stat for %s returned %s\n", fname, strerror(errno))); + + if (SMB_VFS_NEXT_STAT(handle, handle->conn, fname, &st) != 0) { + DEBUG(0,("recycle: stat for %s returned %s\n", fname, strerror(errno))); return (SMB_OFF_T)0; } + return(st.st_size); } @@ -298,7 +203,7 @@ static SMB_OFF_T recycle_get_file_size(connection_struct *conn, const char *fnam * @param dname Directory tree to be created * @return Returns True for success **/ -static BOOL recycle_create_dir(connection_struct *conn, const char *dname) +static BOOL recycle_create_dir(vfs_handle_struct *handle, const char *dname) { int len; mode_t mode; @@ -322,18 +227,18 @@ static BOOL recycle_create_dir(connection_struct *conn, const char *dname) /* Create directory tree if neccessary */ for(token = strtok(tok_str, "/"); token; token = strtok(NULL, "/")) { safe_strcat(new_dir, token, len); - if (recycle_directory_exist(conn, new_dir)) - DEBUG(10, ("recycle.bin: dir %s already exists\n", new_dir)); + if (recycle_directory_exist(handle, new_dir)) + DEBUG(10, ("recycle: dir %s already exists\n", new_dir)); else { - DEBUG(5, ("recycle.bin: creating new dir %s\n", new_dir)); - if (default_vfs_ops.mkdir(conn, new_dir, mode) != 0) { - DEBUG(1,("recycle.bin: mkdir failed for %s with error: %s\n", new_dir, strerror(errno))); + DEBUG(5, ("recycle: creating new dir %s\n", new_dir)); + if (SMB_VFS_NEXT_MKDIR(handle, handle->conn, new_dir, mode) != 0) { + DEBUG(1,("recycle: mkdir failed for %s with error: %s\n", new_dir, strerror(errno))); ret = False; goto done; } } safe_strcat(new_dir, "/", len); - } + } ret = True; done: @@ -348,30 +253,22 @@ done: * @param needle string to be matched exactly to haystack * @return True if found **/ -static BOOL checkparam(const char *haystack, const char *needle) +static BOOL checkparam(const char **haystack_list, const char *needle) { - char *token; - char *tok_str; - char *tmp_str; - BOOL ret = False; + int i; - if (haystack == NULL || strlen(haystack) == 0 || needle == NULL || strlen(needle) == 0) { + if (haystack_list == NULL || haystack_list[0] == NULL || + *haystack_list[0] == '\0' || needle == NULL || *needle == '\0') { return False; } - tmp_str = strdup(haystack); - ALLOC_CHECK(tmp_str, done); - token = tok_str = tmp_str; - - for(token = strtok(tok_str, delimiter); token; token = strtok(NULL, delimiter)) { - if(strcmp(token, needle) == 0) { - ret = True; - goto done; + for(i=0; haystack_list[i] ; i++) { + if(strequal(haystack_list[i], needle)) { + return True; } } -done: - SAFE_FREE(tmp_str); - return ret; + + return False; } /** @@ -380,110 +277,87 @@ done: * @param needle string to be matched exectly to haystack including pattern matching * @return True if found **/ -static BOOL matchparam(const char *haystack, const char *needle) +static BOOL matchparam(const char **haystack_list, const char *needle) { - char *token; - char *tok_str; - char *tmp_str; - BOOL ret = False; + int i; - if (haystack == NULL || strlen(haystack) == 0 || needle == NULL || strlen(needle) == 0) { + if (haystack_list == NULL || haystack_list[0] == NULL || + *haystack_list[0] == '\0' || needle == NULL || *needle == '\0') { return False; } - tmp_str = strdup(haystack); - ALLOC_CHECK(tmp_str, done); - token = tok_str = tmp_str; - - for(token = strtok(tok_str, delimiter); token; token = strtok(NULL, delimiter)) { - if (!unix_wild_match(token, needle)) { - ret = True; - goto done; + for(i=0; haystack_list[i] ; i++) { + if(!unix_wild_match(haystack_list[i], needle)) { + return True; } } -done: - SAFE_FREE(tmp_str); - return ret; + + return False; } /** * Touch access date **/ -static void recycle_touch(connection_struct *conn, const char *fname) +static void recycle_do_touch(vfs_handle_struct *handle, const char *fname) { SMB_STRUCT_STAT st; struct utimbuf tb; time_t currtime; - - if (default_vfs_ops.stat(conn, fname, &st) != 0) { - DEBUG(0,("recycle.bin: stat for %s returned %s\n", fname, strerror(errno))); + + if (SMB_VFS_NEXT_STAT(handle, handle->conn, fname, &st) != 0) { + DEBUG(0,("recycle: stat for %s returned %s\n", fname, strerror(errno))); return; } currtime = time(&currtime); tb.actime = currtime; tb.modtime = st.st_mtime; - if (default_vfs_ops.utime(conn, fname, &tb) == -1 ) - DEBUG(0, ("recycle.bin: touching %s failed, reason = %s\n", fname, strerror(errno))); + if (SMB_VFS_NEXT_UTIME(handle, handle->conn, fname, &tb) == -1 ) { + DEBUG(0, ("recycle: touching %s failed, reason = %s\n", fname, strerror(errno))); } +} /** * Check if file should be recycled **/ -static int recycle_unlink(connection_struct *conn, const char *file_name) +static int recycle_unlink(vfs_handle_struct *handle, connection_struct *conn, const char *file_name) { - recycle_bin_private_data *recdata; - recycle_bin_connections *recconn; - recycle_bin_struct *recbin; char *path_name = NULL; char *temp_name = NULL; char *final_name = NULL; const char *base; - int i; -/* SMB_BIG_UINT dfree, dsize, bsize; */ + char *repository = NULL; + int i = 1; + int maxsize; SMB_OFF_T file_size; /* space_avail; */ BOOL exist; int rc = -1; - recbin = NULL; - if (recycle_bin_private_handle) { - recdata = (recycle_bin_private_data *)(recycle_bin_private_handle->data); - if (recdata) { - if (recdata->conns) { - recconn = recdata->conns; - while (recconn && recconn->conn != SNUM(conn)) recconn = recconn->next; - if (recconn != NULL) { - recbin = recconn->data; - } - } - } - } - if (recbin == NULL) { - DEBUG(0, ("Recycle bin not initialized!\n")); - rc = default_vfs_ops.unlink(conn, file_name); - goto done; - } - - if(!recbin->repository || *(recbin->repository) == '\0') { - DEBUG(3, ("Recycle path not set, purging %s...\n", file_name)); - rc = default_vfs_ops.unlink(conn, file_name); + repository = alloc_sub_conn(conn, recycle_repository(handle)); + ALLOC_CHECK(repository, done); + /* shouldn't we allow absolute path names here? --metze */ + trim_string(repository, "/", "/"); + + if(!repository || *(repository) == '\0') { + DEBUG(3, ("recycle: repository path not set, purging %s...\n", file_name)); + rc = SMB_VFS_NEXT_UNLINK(handle, conn, file_name); goto done; } /* we don't recycle the recycle bin... */ - if (strncmp(file_name, recbin->repository, strlen(recbin->repository)) == 0) { - DEBUG(3, ("File is within recycling bin, unlinking ...\n")); - rc = default_vfs_ops.unlink(conn, file_name); + if (strncmp(file_name, repository, strlen(repository)) == 0) { + DEBUG(3, ("recycle: File is within recycling bin, unlinking ...\n")); + rc = SMB_VFS_NEXT_UNLINK(handle, conn, file_name); goto done; } - file_size = recycle_get_file_size(conn, file_name); + file_size = recycle_get_file_size(handle, file_name); /* it is wrong to purge filenames only because they are empty imho * --- simo * if(fsize == 0) { - DEBUG(3, ("File %s is empty, purging...\n", file_name)); - rc = default_vfs_ops.unlink(conn,file_name); + DEBUG(3, ("recycle: File %s is empty, purging...\n", file_name)); + rc = SMB_VFS_NEXT_UNLINK(handle,conn,file_name); goto done; } */ @@ -492,20 +366,21 @@ static int recycle_unlink(connection_struct *conn, const char *file_name) * not greater then maxsize, not the size of the single file, also it is better * to remove older files */ - if(recbin->maxsize > 0 && file_size > recbin->maxsize) { - DEBUG(3, ("File %s exceeds maximum recycle size, purging... \n", file_name)); - rc = default_vfs_ops.unlink(conn, file_name); + maxsize = recycle_maxsize(handle); + if(maxsize > 0 && file_size > maxsize) { + DEBUG(3, ("recycle: File %s exceeds maximum recycle size, purging... \n", file_name)); + rc = SMB_VFS_NEXT_UNLINK(handle, conn, file_name); goto done; } /* FIXME: this is wrong: moving files with rename does not change the disk space * allocation * - space_avail = default_vfs_ops.disk_free(conn, ".", True, &bsize, &dfree, &dsize) * 1024L; + space_avail = SMB_VFS_NEXT_DISK_FREE(handle, conn, ".", True, &bsize, &dfree, &dsize) * 1024L; DEBUG(5, ("space_avail = %Lu, file_size = %Lu\n", space_avail, file_size)); if(space_avail < file_size) { - DEBUG(3, ("Not enough diskspace, purging file %s\n", file_name)); - rc = default_vfs_ops.unlink(conn, file_name); + DEBUG(3, ("recycle: Not enough diskspace, purging file %s\n", file_name)); + rc = SMB_VFS_NEXT_UNLINK(handle, conn, file_name); goto done; } */ @@ -524,13 +399,13 @@ static int recycle_unlink(connection_struct *conn, const char *file_name) base++; } - DEBUG(10, ("recycle.bin: fname = %s\n", file_name)); /* original filename with path */ - DEBUG(10, ("recycle.bin: fpath = %s\n", path_name)); /* original path */ - DEBUG(10, ("recycle.bin: base = %s\n", base)); /* filename without path */ + DEBUG(10, ("recycle: fname = %s\n", file_name)); /* original filename with path */ + DEBUG(10, ("recycle: fpath = %s\n", path_name)); /* original path */ + DEBUG(10, ("recycle: base = %s\n", base)); /* filename without path */ - if (matchparam(recbin->exclude, base)) { - DEBUG(3, ("recycle.bin: file %s is excluded \n", base)); - rc = default_vfs_ops.unlink(conn, file_name); + if (matchparam(recycle_exclude(handle), base)) { + DEBUG(3, ("recycle: file %s is excluded \n", base)); + rc = SMB_VFS_NEXT_UNLINK(handle, conn, file_name); goto done; } @@ -538,72 +413,85 @@ static int recycle_unlink(connection_struct *conn, const char *file_name) * we shoud check for every level 1, 1/2, 1/2/3, 1/2/3/4 .... * ---simo */ - if (checkparam(recbin->exclude_dir, path_name)) { - DEBUG(3, ("recycle.bin: directory %s is excluded \n", path_name)); - rc = default_vfs_ops.unlink(conn, file_name); + if (checkparam(recycle_exclude_dir(handle), path_name)) { + DEBUG(3, ("recycle: directory %s is excluded \n", path_name)); + rc = SMB_VFS_NEXT_UNLINK(handle, conn, file_name); goto done; } - /* see if we need to recreate the original directory structure in the recycle bin */ - if (recbin->keep_dir_tree == True) { - asprintf(&temp_name, "%s/%s", recbin->repository, path_name); + if (recycle_keep_dir_tree(handle) == True) { + asprintf(&temp_name, "%s/%s", repository, path_name); } else { - temp_name = strdup(recbin->repository); + temp_name = strdup(repository); } ALLOC_CHECK(temp_name, done); - exist = recycle_directory_exist(conn, temp_name); + exist = recycle_directory_exist(handle, temp_name); if (exist) { - DEBUG(10, ("recycle.bin: Directory already exists\n")); + DEBUG(10, ("recycle: Directory already exists\n")); } else { - DEBUG(10, ("recycle.bin: Creating directory %s\n", temp_name)); - if (recycle_create_dir(conn, temp_name) == False) { - DEBUG(3, ("Could not create directory, purging %s...\n", file_name)); - rc = default_vfs_ops.unlink(conn, file_name); + DEBUG(10, ("recycle: Creating directory %s\n", temp_name)); + if (recycle_create_dir(handle, temp_name) == False) { + DEBUG(3, ("recycle: Could not create directory, purging %s...\n", file_name)); + rc = SMB_VFS_NEXT_UNLINK(handle, conn, file_name); goto done; } } asprintf(&final_name, "%s/%s", temp_name, base); ALLOC_CHECK(final_name, done); - DEBUG(10, ("recycle.bin: recycled file name: %s\n", temp_name)); /* new filename with path */ + DEBUG(10, ("recycle: recycled file name: %s\n", final_name)); /* new filename with path */ /* check if we should delete file from recycle bin */ - if (recycle_file_exist(conn, final_name)) { - if (recbin->versions == False || matchparam(recbin->noversions, base) == True) { - DEBUG(3, ("recycle.bin: Removing old file %s from recycle bin\n", final_name)); - if (default_vfs_ops.unlink(conn, final_name) != 0) { - DEBUG(1, ("recycle.bin: Error deleting old file: %s\n", strerror(errno))); + if (recycle_file_exist(handle, final_name)) { + if (recycle_versions(handle) == False || matchparam(recycle_noversions(handle), base) == True) { + DEBUG(3, ("recycle: Removing old file %s from recycle bin\n", final_name)); + if (SMB_VFS_NEXT_UNLINK(handle, conn, final_name) != 0) { + DEBUG(1, ("recycle: Error deleting old file: %s\n", strerror(errno))); } } } /* rename file we move to recycle bin */ i = 1; - while (recycle_file_exist(conn, final_name)) { - snprintf(final_name, PATH_MAX, "%s/Copy #%d of %s", temp_name, i++, base); + while (recycle_file_exist(handle, final_name)) { + snprintf(final_name, PATH_MAX -1, "%s/Copy #%d of %s", temp_name, i++, base); } - DEBUG(10, ("recycle.bin: Moving %s to %s\n", file_name, final_name)); - rc = default_vfs_ops.rename(conn, file_name, final_name); + DEBUG(10, ("recycle: Moving %s to %s\n", file_name, final_name)); + rc = SMB_VFS_NEXT_RENAME(handle, conn, file_name, final_name); if (rc != 0) { - DEBUG(3, ("recycle.bin: Move error %d (%s), purging file %s (%s)\n", errno, strerror(errno), file_name, final_name)); - rc = default_vfs_ops.unlink(conn, file_name); + DEBUG(3, ("recycle: Move error %d (%s), purging file %s (%s)\n", errno, strerror(errno), file_name, final_name)); + rc = SMB_VFS_NEXT_UNLINK(handle, conn, file_name); goto done; } /* touch access date of moved file */ - if (recbin->touch == True ) - recycle_touch(conn, final_name); + if (recycle_touch(handle) == True ) + recycle_do_touch(handle, final_name); done: SAFE_FREE(path_name); SAFE_FREE(temp_name); SAFE_FREE(final_name); + SAFE_FREE(repository); return rc; } NTSTATUS vfs_recycle_init(void) -{ - return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "recycle", recycle_init); +{ + NTSTATUS ret = smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "recycle", recycle_ops); + + if (!NT_STATUS_IS_OK(ret)) + return ret; + + vfs_recycle_debug_level = debug_add_class("recycle"); + if (vfs_recycle_debug_level == -1) { + vfs_recycle_debug_level = DBGC_VFS; + DEBUG(0, ("vfs_recycle: Couldn't register custom debugging class!\n")); + } else { + DEBUG(10, ("vfs_recycle: Debug class number of 'recycle': %d\n", vfs_recycle_debug_level)); + } + + return ret; } diff --git a/source3/msdfs/msdfs.c b/source3/msdfs/msdfs.c index 69a315d4e4..ce6e64d915 100644 --- a/source3/msdfs/msdfs.c +++ b/source3/msdfs/msdfs.c @@ -164,19 +164,19 @@ BOOL is_msdfs_link(connection_struct* conn, char* path, if (!path || !conn) return False; - strlower(path); + strlower_m(path); if (sbufp == NULL) sbufp = &st; - if (conn->vfs_ops.lstat(conn, path, sbufp) != 0) { + if (SMB_VFS_LSTAT(conn, path, sbufp) != 0) { DEBUG(5,("is_msdfs_link: %s does not exist.\n",path)); return False; } if (S_ISLNK(sbufp->st_mode)) { /* open the link and read it */ - referral_len = conn->vfs_ops.readlink(conn, path, referral, + referral_len = SMB_VFS_READLINK(conn, path, referral, sizeof(pstring)); if (referral_len == -1) { DEBUG(0,("is_msdfs_link: Error reading msdfs link %s: %s\n", path, strerror(errno))); @@ -740,7 +740,7 @@ static BOOL junction_to_local_path(struct junction_map* jn, char* path, safe_strcpy(path, lp_pathname(snum), max_pathlen-1); safe_strcat(path, "/", max_pathlen-1); - strlower(jn->volume_name); + strlower_m(jn->volume_name); safe_strcat(path, jn->volume_name, max_pathlen-1); pstrcpy(conn_path, lp_pathname(snum)); @@ -785,10 +785,10 @@ BOOL create_msdfs_link(struct junction_map* jn, BOOL exists) DEBUG(5,("create_msdfs_link: Creating new msdfs link: %s -> %s\n", path, msdfs_link)); if(exists) - if(conn->vfs_ops.unlink(conn,path)!=0) + if(SMB_VFS_UNLINK(conn,path)!=0) return False; - if(conn->vfs_ops.symlink(conn, msdfs_link, path) < 0) { + if(SMB_VFS_SYMLINK(conn, msdfs_link, path) < 0) { DEBUG(1,("create_msdfs_link: symlink failed %s -> %s\nError: %s\n", path, msdfs_link, strerror(errno))); return False; @@ -805,7 +805,7 @@ BOOL remove_msdfs_link(struct junction_map* jn) if(!junction_to_local_path(jn, path, sizeof(path), conn)) return False; - if(conn->vfs_ops.unlink(conn, path)!=0) + if(SMB_VFS_UNLINK(conn, path)!=0) return False; return True; @@ -862,7 +862,7 @@ static BOOL form_junctions(int snum, struct junction_map* jn, int* jn_count) cnt++; /* Now enumerate all dfs links */ - dirp = conn->vfs_ops.opendir(conn, connect_path); + dirp = SMB_VFS_OPENDIR(conn, connect_path); if(!dirp) return False; @@ -881,7 +881,7 @@ static BOOL form_junctions(int snum, struct junction_map* jn, int* jn_count) } } - conn->vfs_ops.closedir(conn,dirp); + SMB_VFS_CLOSEDIR(conn,dirp); *jn_count = cnt; return True; } diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c index ad5ab4d734..2801e54551 100644 --- a/source3/nmbd/nmbd.c +++ b/source3/nmbd/nmbd.c @@ -298,6 +298,28 @@ static BOOL reload_nmbd_services(BOOL test) return(ret); } +/**************************************************************************** ** + * React on 'smbcontrol nmbd reload-config' in the same way as to SIGHUP + * We use buf here to return BOOL result to process() when reload_interfaces() + * detects that there are no subnets. + **************************************************************************** */ +static void msg_reload_nmbd_services(int msg_type, pid_t src, void *buf, size_t len) +{ + write_browse_list( 0, True ); + dump_all_namelists(); + reload_nmbd_services( True ); + reopen_logs(); + + if(buf) { + /* We were called from process() */ + /* If reload_interfaces() returned True */ + /* we need to shutdown if there are no subnets... */ + /* pass this info back to process() */ + *((BOOL*)buf) = reload_interfaces(0); + } +} + + /**************************************************************************** ** The main select loop. **************************************************************************** */ @@ -305,6 +327,7 @@ static BOOL reload_nmbd_services(BOOL test) static void process(void) { BOOL run_election; + BOOL no_subnets; while( True ) { time_t t = time(NULL); @@ -513,11 +536,8 @@ static void process(void) if(reload_after_sighup) { DEBUG( 0, ( "Got SIGHUP dumping debug info.\n" ) ); - write_browse_list( 0, True ); - dump_all_namelists(); - reload_nmbd_services( True ); - reopen_logs(); - if(reload_interfaces(0)) + msg_reload_nmbd_services(MSG_SMB_CONF_UPDATED, (pid_t) 0, (void*) &no_subnets, 0); + if(no_subnets) return; reload_after_sighup = 0; } @@ -573,8 +593,10 @@ static BOOL open_sockets(BOOL isdaemon, int port) **************************************************************************** */ int main(int argc, const char *argv[]) { - static BOOL opt_interactive = False; + pstring logfile; + static BOOL opt_interactive; poptContext pc; + int opt; struct poptOption long_options[] = { POPT_AUTOHELP {"daemon", 'D', POPT_ARG_VAL, &is_daemon, True, "Become a daemon(default)" }, @@ -586,46 +608,47 @@ static BOOL open_sockets(BOOL isdaemon, int port) POPT_COMMON_SAMBA { NULL } }; - pstring logfile; - - global_nmb_port = NMB_PORT; - global_in_nmbd = True; - - StartupTime = time(NULL); - - sys_srandom(time(NULL) ^ sys_getpid()); - slprintf(logfile, sizeof(logfile)-1, "%s/log.nmbd", dyn_LOGFILEBASE); - lp_set_logfile(logfile); + global_nmb_port = NMB_PORT; - fault_setup((void (*)(void *))fault_continue ); - - /* POSIX demands that signals are inherited. If the invoking process has - * these signals masked, we will have problems, as we won't receive them. */ - BlockSignals(False, SIGHUP); - BlockSignals(False, SIGUSR1); - BlockSignals(False, SIGTERM); - - CatchSignal( SIGHUP, SIGNAL_CAST sig_hup ); - CatchSignal( SIGTERM, SIGNAL_CAST sig_term ); + pc = poptGetContext("nmbd", argc, argv, long_options, 0); + while ((opt = poptGetNextOpt(pc)) != -1) ; + poptFreeContext(pc); + global_in_nmbd = True; + + StartupTime = time(NULL); + + sys_srandom(time(NULL) ^ sys_getpid()); + + slprintf(logfile, sizeof(logfile)-1, "%s/log.nmbd", dyn_LOGFILEBASE); + lp_set_logfile(logfile); + + fault_setup((void (*)(void *))fault_continue ); + + /* POSIX demands that signals are inherited. If the invoking process has + * these signals masked, we will have problems, as we won't receive them. */ + BlockSignals(False, SIGHUP); + BlockSignals(False, SIGUSR1); + BlockSignals(False, SIGTERM); + + CatchSignal( SIGHUP, SIGNAL_CAST sig_hup ); + CatchSignal( SIGTERM, SIGNAL_CAST sig_term ); + #if defined(SIGFPE) - /* we are never interested in SIGFPE */ - BlockSignals(True,SIGFPE); + /* we are never interested in SIGFPE */ + BlockSignals(True,SIGFPE); #endif - /* We no longer use USR2... */ + /* We no longer use USR2... */ #if defined(SIGUSR2) - BlockSignals(True, SIGUSR2); + BlockSignals(True, SIGUSR2); #endif - pc = poptGetContext("nmbd", argc, argv, long_options, 0); - - poptFreeContext(pc); - if ( opt_interactive ) { - Fork = False; - log_stdout = True; - } + if ( opt_interactive ) { + Fork = False; + log_stdout = True; + } if ( log_stdout && Fork ) { DEBUG(0,("ERROR: Can't log to stdout (-S) unless daemon is in foreground (-F) or interactive (-i)\n")); @@ -693,6 +716,7 @@ static BOOL open_sockets(BOOL isdaemon, int port) message_register(MSG_FORCE_ELECTION, nmbd_message_election); message_register(MSG_WINS_NEW_ENTRY, nmbd_wins_new_entry); message_register(MSG_SHUTDOWN, nmbd_terminate); + message_register(MSG_SMB_CONF_UPDATED, msg_reload_nmbd_services); DEBUG( 3, ( "Opening sockets %d\n", global_nmb_port ) ); diff --git a/source3/nmbd/nmbd_become_lmb.c b/source3/nmbd/nmbd_become_lmb.c index 6f8e7efb1a..d390bf72e9 100644 --- a/source3/nmbd/nmbd_become_lmb.c +++ b/source3/nmbd/nmbd_become_lmb.c @@ -600,6 +600,5 @@ local_master_browser_name for workgroup %s to workgroup name.\n", } #endif - StrnCpy(work->local_master_browser_name, newname, - sizeof(work->local_master_browser_name)-1); + fstrcpy(work->local_master_browser_name, newname); } diff --git a/source3/nmbd/nmbd_browserdb.c b/source3/nmbd/nmbd_browserdb.c index a4ef98e265..4a302ddfd4 100644 --- a/source3/nmbd/nmbd_browserdb.c +++ b/source3/nmbd/nmbd_browserdb.c @@ -37,7 +37,6 @@ ubi_dlNewList( lmb_browserlist ); - /* -------------------------------------------------------------------------- ** * Functions... */ @@ -52,9 +51,9 @@ ubi_dlNewList( lmb_browserlist ); * ************************************************************************** ** */ static void remove_lmb_browser_entry( struct browse_cache_record *browc ) - { - safe_free( ubi_dlRemThis( lmb_browserlist, browc ) ); - } /* remove_lmb_browser_entry */ +{ + safe_free( ubi_dlRemThis( lmb_browserlist, browc ) ); +} /* ************************************************************************** ** * Update a browser death time. @@ -65,10 +64,10 @@ static void remove_lmb_browser_entry( struct browse_cache_record *browc ) * ************************************************************************** ** */ void update_browser_death_time( struct browse_cache_record *browc ) - { - /* Allow the new lmb to miss an announce period before we remove it. */ - browc->death_time = time(NULL) + ( (CHECK_TIME_MST_ANNOUNCE + 2) * 60 ); - } /* update_browser_death_time */ +{ + /* Allow the new lmb to miss an announce period before we remove it. */ + browc->death_time = time(NULL) + ( (CHECK_TIME_MST_ANNOUNCE + 2) * 60 ); +} /* ************************************************************************** ** * Create a browser entry and add it to the local master browser list. @@ -84,48 +83,47 @@ void update_browser_death_time( struct browse_cache_record *browc ) struct browse_cache_record *create_browser_in_lmb_cache( char *work_name, char *browser_name, struct in_addr ip ) - { - struct browse_cache_record *browc; - time_t now = time( NULL ); +{ + struct browse_cache_record *browc; + time_t now = time( NULL ); - browc = (struct browse_cache_record *)malloc( sizeof( *browc ) ); + browc = (struct browse_cache_record *)malloc( sizeof( *browc ) ); - if( NULL == browc ) - { - DEBUG( 0, ("create_browser_in_lmb_cache: malloc fail !\n") ); - return( NULL ); - } + if( NULL == browc ) { + DEBUG( 0, ("create_browser_in_lmb_cache: malloc fail !\n") ); + return( NULL ); + } - memset( (char *)browc, '\0', sizeof( *browc ) ); + memset( (char *)browc, '\0', sizeof( *browc ) ); - /* For a new lmb entry we want to sync with it after one minute. This - will allow it time to send out a local announce and build its - browse list. - */ - browc->sync_time = now + 60; - - /* Allow the new lmb to miss an announce period before we remove it. */ - browc->death_time = now + ( (CHECK_TIME_MST_ANNOUNCE + 2) * 60 ); - - StrnCpy( browc->lmb_name, browser_name, sizeof(browc->lmb_name)-1 ); - StrnCpy( browc->work_group, work_name, sizeof(browc->work_group)-1 ); - strupper( browc->lmb_name ); - strupper( browc->work_group ); + /* For a new lmb entry we want to sync with it after one minute. This + will allow it time to send out a local announce and build its + browse list. + */ + + browc->sync_time = now + 60; + + /* Allow the new lmb to miss an announce period before we remove it. */ + browc->death_time = now + ( (CHECK_TIME_MST_ANNOUNCE + 2) * 60 ); + + pstrcpy( browc->lmb_name, browser_name); + pstrcpy( browc->work_group, work_name); + strupper_m( browc->lmb_name ); + strupper_m( browc->work_group ); - browc->ip = ip; + browc->ip = ip; - (void)ubi_dlAddTail( lmb_browserlist, browc ); - - if( DEBUGLVL( 3 ) ) - { - Debug1( "nmbd_browserdb:create_browser_in_lmb_cache()\n" ); - Debug1( " Added lmb cache entry for workgroup %s ", browc->work_group ); - Debug1( "name %s IP %s ", browc->lmb_name, inet_ntoa(ip) ); - Debug1( "ttl %d\n", (int)browc->death_time ); - } + (void)ubi_dlAddTail( lmb_browserlist, browc ); + + if( DEBUGLVL( 3 ) ) { + Debug1( "nmbd_browserdb:create_browser_in_lmb_cache()\n" ); + Debug1( " Added lmb cache entry for workgroup %s ", browc->work_group ); + Debug1( "name %s IP %s ", browc->lmb_name, inet_ntoa(ip) ); + Debug1( "ttl %d\n", (int)browc->death_time ); + } - return( browc ); - } /* create_browser_in_lmb_cache */ + return( browc ); +} /* ************************************************************************** ** * Find a browser entry in the local master browser list. @@ -137,17 +135,16 @@ struct browse_cache_record *create_browser_in_lmb_cache( char *work_name, * ************************************************************************** ** */ struct browse_cache_record *find_browser_in_lmb_cache( char *browser_name ) - { - struct browse_cache_record *browc; +{ + struct browse_cache_record *browc; - for( browc = (struct browse_cache_record *)ubi_dlFirst( lmb_browserlist ); - browc; - browc = (struct browse_cache_record *)ubi_dlNext( browc ) ) - if( strequal( browser_name, browc->lmb_name ) ) - break; + for( browc = (struct browse_cache_record *)ubi_dlFirst( lmb_browserlist ); + browc; browc = (struct browse_cache_record *)ubi_dlNext( browc ) ) + if( strequal( browser_name, browc->lmb_name ) ) + break; - return( browc ); - } /* find_browser_in_lmb_cache */ + return( browc ); +} /* ************************************************************************** ** * Expire timed out browsers in the browserlist. @@ -159,24 +156,20 @@ struct browse_cache_record *find_browser_in_lmb_cache( char *browser_name ) * ************************************************************************** ** */ void expire_lmb_browsers( time_t t ) - { - struct browse_cache_record *browc; - struct browse_cache_record *nextbrowc; - - for( browc = (struct browse_cache_record *)ubi_dlFirst( lmb_browserlist ); - browc; - browc = nextbrowc ) - { - nextbrowc = (struct browse_cache_record *)ubi_dlNext( browc ); - - if( browc->death_time < t ) - { - if( DEBUGLVL( 3 ) ) - { - Debug1( "nmbd_browserdb:expire_lmb_browsers()\n" ); - Debug1( " Removing timed out lmb entry %s\n", browc->lmb_name ); - } - remove_lmb_browser_entry( browc ); - } - } - } /* expire_lmb_browsers */ +{ + struct browse_cache_record *browc; + struct browse_cache_record *nextbrowc; + + for( browc = (struct browse_cache_record *)ubi_dlFirst( lmb_browserlist ); + browc; browc = nextbrowc ) { + nextbrowc = (struct browse_cache_record *)ubi_dlNext( browc ); + + if( browc->death_time < t ) { + if( DEBUGLVL( 3 ) ) { + Debug1( "nmbd_browserdb:expire_lmb_browsers()\n" ); + Debug1( " Removing timed out lmb entry %s\n", browc->lmb_name ); + } + remove_lmb_browser_entry( browc ); + } + } +} diff --git a/source3/nmbd/nmbd_browsesync.c b/source3/nmbd/nmbd_browsesync.c index adfefc9f27..26d4735744 100644 --- a/source3/nmbd/nmbd_browsesync.c +++ b/source3/nmbd/nmbd_browsesync.c @@ -106,6 +106,7 @@ As a local master browser, send an announce packet to the domain master browser. static void announce_local_master_browser_to_domain_master_browser( struct work_record *work) { pstring outbuf; + fstring myname; char *p; if(ismyip(work->dmb_addr)) @@ -125,8 +126,11 @@ static void announce_local_master_browser_to_domain_master_browser( struct work_ SCVAL(p,0,ANN_MasterAnnouncement); p++; - StrnCpy(p,global_myname(),15); - strupper(p); + fstrcpy(myname, global_myname()); + strupper_m(myname); + myname[15]='\0'; + push_pstring_base(p, myname, outbuf); + p = skip_string(p,1); if( DEBUGLVL( 4 ) ) diff --git a/source3/nmbd/nmbd_elections.c b/source3/nmbd/nmbd_elections.c index 339a27d207..b948eb9d04 100644 --- a/source3/nmbd/nmbd_elections.c +++ b/source3/nmbd/nmbd_elections.c @@ -48,7 +48,7 @@ static void send_election_dgram(struct subnet_record *subrec, const char *workgr SIVAL(p,5,timeup*1000); /* ms - Despite what the spec says. */ p += 13; pstrcpy_base(p, server_name, outbuf); - strupper(p); + strupper_m(p); p = skip_string(p,1); send_mailslot(False, BROWSE_MAILSLOT, outbuf, PTR_DIFF(p,outbuf), diff --git a/source3/nmbd/nmbd_incomingdgrams.c b/source3/nmbd/nmbd_incomingdgrams.c index cd6954fc62..80465ada0d 100644 --- a/source3/nmbd/nmbd_incomingdgrams.c +++ b/source3/nmbd/nmbd_incomingdgrams.c @@ -172,7 +172,7 @@ void process_host_announce(struct subnet_record *subrec, struct packet_struct *p /* Update the record. */ servrec->serv.type = servertype|SV_TYPE_LOCAL_LIST_ONLY; update_server_ttl( servrec, ttl); - StrnCpy(servrec->serv.comment,comment,sizeof(servrec->serv.comment)-1); + fstrcpy(servrec->serv.comment,comment); } } else @@ -343,7 +343,7 @@ a local master browser for workgroup %s and we think we are master. Forcing elec /* Update the record. */ servrec->serv.type = servertype|SV_TYPE_LOCAL_LIST_ONLY; update_server_ttl(servrec, ttl); - StrnCpy(servrec->serv.comment,comment,sizeof(servrec->serv.comment)-1); + fstrcpy(servrec->serv.comment,comment); } set_workgroup_local_master_browser_name( work, server_name ); @@ -520,7 +520,7 @@ originate from OS/2 Warp client. Ignoring packet.\n")); /* Update the record. */ servrec->serv.type = servertype|SV_TYPE_LOCAL_LIST_ONLY; update_server_ttl( servrec, ttl); - StrnCpy(servrec->serv.comment,comment,sizeof(servrec->serv.comment)-1); + fstrcpy(servrec->serv.comment,comment); } } else @@ -559,6 +559,7 @@ static void send_backup_list_response(struct subnet_record *subrec, #if 0 struct server_record *servrec; #endif + fstring myname; memset(outbuf,'\0',sizeof(outbuf)); @@ -578,8 +579,11 @@ static void send_backup_list_response(struct subnet_record *subrec, /* We always return at least one name - our own. */ count = 1; - StrnCpy(p,global_myname(),15); - strupper(p); + fstrcpy(myname, global_myname()); + strupper_m(myname); + myname[15]='\0'; + push_pstring_base(p, myname, outbuf); + p = skip_string(p,1); /* Look for backup browsers in this workgroup. */ @@ -610,7 +614,7 @@ static void send_backup_list_response(struct subnet_record *subrec, continue; StrnCpy(p, servrec->serv.name, 15); - strupper(p); + strupper_m(p); count++; DEBUG(5,("send_backup_list_response: Adding server %s number %d\n", diff --git a/source3/nmbd/nmbd_incomingrequests.c b/source3/nmbd/nmbd_incomingrequests.c index a8168566f1..a3faf5e104 100644 --- a/source3/nmbd/nmbd_incomingrequests.c +++ b/source3/nmbd/nmbd_incomingrequests.c @@ -364,7 +364,7 @@ subnet %s - name not found.\n", nmb_namestr(&nmb->question.question_name), /* Start with the name. */ memset(buf,'\0',18); slprintf(buf, 17, "%-15.15s",namerec->name.name); - strupper(buf); + strupper_m(buf); /* Put the name type and netbios flags in the buffer. */ buf[15] = name_type; diff --git a/source3/nmbd/nmbd_namelistdb.c b/source3/nmbd/nmbd_namelistdb.c index 932d926a91..3f6d2f3b64 100644 --- a/source3/nmbd/nmbd_namelistdb.c +++ b/source3/nmbd/nmbd_namelistdb.c @@ -49,8 +49,8 @@ static void upcase_name( struct nmb_name *target, struct nmb_name *source ) if( NULL != source ) (void)memcpy( target, source, sizeof( struct nmb_name ) ); - strupper( target->name ); - strupper( target->scope ); + strupper_m( target->name ); + strupper_m( target->scope ); /* fudge... We're using a byte-by-byte compare, so we must be sure that * unused space doesn't have garbage in it. diff --git a/source3/nmbd/nmbd_processlogon.c b/source3/nmbd/nmbd_processlogon.c index a702fc3015..42edcc871f 100644 --- a/source3/nmbd/nmbd_processlogon.c +++ b/source3/nmbd/nmbd_processlogon.c @@ -304,19 +304,19 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n", pstring hostname; char *component, *dc, *q1; uint8 size; + char *q_orig = q; + int str_offset; get_mydomname(domain); get_myname(hostname); if (SVAL(uniuser, 0) == 0) { - SSVAL(q, 0, SAMLOGON_AD_UNK_R); /* user unknown */ + SIVAL(q, 0, SAMLOGON_AD_UNK_R); /* user unknown */ } else { - SSVAL(q, 0, SAMLOGON_AD_R); + SIVAL(q, 0, SAMLOGON_AD_R); } - q += 2; + q += 4; - SSVAL(q, 0, 0); - q += 2; SIVAL(q, 0, ADS_PDC|ADS_GC|ADS_LDAP|ADS_DS| ADS_KDC|ADS_TIMESERV|ADS_CLOSEST|ADS_WRITABLE); q += 4; @@ -329,7 +329,8 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n", memcpy(q, &domain_guid, sizeof(domain_guid)); q += sizeof(domain_guid); - /* Push domain components */ + /* Forest */ + str_offset = q - q_orig; dc = domain; q1 = q; while ((component = strtok(dc, "."))) { @@ -338,44 +339,60 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n", SCVAL(q, 0, size); q += (size + 1); } + + /* Unk0 */ SCVAL(q, 0, 0); q++; - SSVAL(q, 0, 0x18c0); /* not sure what this is for, but */ - q += 2; /* it must follow the domain name. */ - /* Push dns host name */ + /* Domain */ + SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F)); + SCVAL(q, 1, str_offset & 0xFF); + q += 2; + + /* Hostname */ size = push_ascii(&q[1], hostname, -1, 0); SCVAL(q, 0, size); q += (size + 1); - SSVAL(q, 0, 0x18c0); /* not sure what this is for, but */ - q += 2; /* it must follow the domain name. */ + SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F)); + SCVAL(q, 1, str_offset & 0xFF); + q += 2; - /* Push NETBIOS of domain */ + /* NETBIOS of domain */ size = push_ascii(&q[1], lp_workgroup(), -1, STR_UPPER); SCVAL(q, 0, size); q += (size + 1); - SCVAL(q, 0, 0); q++; /* is this a null terminator or empty field */ - /* null terminator would not be needed because size is included */ - /* Push NETBIOS of hostname */ + /* Unk1 */ + SCVAL(q, 0, 0); q++; + + /* NETBIOS of hostname */ size = push_ascii(&q[1], my_name, -1, 0); SCVAL(q, 0, size); q += (size + 1); - SCVAL(q, 0, 0); q++; /* null terminator or empty field? */ - /* Push user account */ - size = push_ascii(&q[1], ascuser, -1, 0); - SCVAL(q, 0, size); - q += (size + 1); + /* Unk2 */ + SCVAL(q, 0, 0); q++; + + /* User name */ + if (SVAL(uniuser, 0) != 0) { + size = push_ascii(&q[1], ascuser, -1, 0); + SCVAL(q, 0, size); + q += (size + 1); + } - /* Push 'Default-First-Site-Name' */ + q_orig = q; + /* Site name */ size = push_ascii(&q[1], "Default-First-Site-Name", -1, 0); SCVAL(q, 0, size); q += (size + 1); - SSVAL(q, 0, 0xc000); /* unknown */ - SCVAL(q, 2, PTR_DIFF(q,q1)); - SCVAL(q, 3, 0x10); /* unknown */ - q += 4; + /* Site name (2) */ + str_offset = q - q_orig; + SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F)); + SCVAL(q, 1, str_offset & 0xFF); + q += 2; + + SCVAL(q, 0, PTR_DIFF(q,q1)); + SCVAL(q, 1, 0x10); /* unknown */ SIVAL(q, 0, 0x00000002); q += 4; /* unknown */ SIVAL(q, 0, (iface_ip(p->ip))->s_addr); q += 4; diff --git a/source3/nmbd/nmbd_sendannounce.c b/source3/nmbd/nmbd_sendannounce.c index 40d07aae16..353717ee62 100644 --- a/source3/nmbd/nmbd_sendannounce.c +++ b/source3/nmbd/nmbd_sendannounce.c @@ -142,7 +142,7 @@ static void send_lm_announcement(struct subnet_record *subrec, int announce_type p += 10; /*StrnCpy(p,server_name,15); - strupper(p); + strupper_m(p); p = skip_string(p,1); pstrcpy(p,server_comment); p = skip_string(p,1);*/ @@ -555,6 +555,7 @@ void browse_sync_remote(time_t t) struct work_record *work; pstring outbuf; char *p; + fstring myname; if (last_time && (t < (last_time + REMOTE_ANNOUNCE_INTERVAL))) return; @@ -589,8 +590,11 @@ for workgroup %s on subnet %s.\n", lp_workgroup(), FIRST_SUBNET->subnet_name )); SCVAL(p,0,ANN_MasterAnnouncement); p++; - StrnCpy(p,global_myname(),15); - strupper(p); + fstrcpy(myname, global_myname()); + strupper_m(myname); + myname[15]='\0'; + push_pstring_base(p, myname, outbuf); + p = skip_string(p,1); for (ptr=s; next_token(&ptr,s2,NULL,sizeof(s2)); ) diff --git a/source3/nmbd/nmbd_serverlistdb.c b/source3/nmbd/nmbd_serverlistdb.c index ee0c021d5d..2484a7f830 100644 --- a/source3/nmbd/nmbd_serverlistdb.c +++ b/source3/nmbd/nmbd_serverlistdb.c @@ -153,9 +153,9 @@ workgroup %s. This is a bug.\n", name, work->work_group)); servrec->subnet = work->subnet; - StrnCpy(servrec->serv.name,name,sizeof(servrec->serv.name)-1); - StrnCpy(servrec->serv.comment,comment,sizeof(servrec->serv.comment)-1); - strupper(servrec->serv.name); + fstrcpy(servrec->serv.name,name); + fstrcpy(servrec->serv.comment,comment); + strupper_m(servrec->serv.name); servrec->serv.type = servertype; update_server_ttl(servrec, ttl); diff --git a/source3/nmbd/nmbd_winsserver.c b/source3/nmbd/nmbd_winsserver.c index 47ce8119f3..eafff03b76 100644 --- a/source3/nmbd/nmbd_winsserver.c +++ b/source3/nmbd/nmbd_winsserver.c @@ -22,7 +22,7 @@ #include "includes.h" -#define WINS_LIST "wins.tdb" +#define WINS_LIST "wins.dat" #define WINS_VERSION 1 /**************************************************************************** @@ -221,123 +221,177 @@ Load or create the WINS database. BOOL initialise_wins(void) { - time_t time_now = time(NULL); - TDB_CONTEXT *tdb; - TDB_DATA kbuf, dbuf, newkey; - struct name_record *namerec = NULL; - struct in_addr our_fake_ip = *interpret_addr2("0.0.0.0"); + time_t time_now = time(NULL); + XFILE *fp; + pstring line; - DEBUG(2,("initialise_wins: started\n")); + if(!lp_we_are_a_wins_server()) + return True; - if(!lp_we_are_a_wins_server()) - return True; + add_samba_names_to_subnet(wins_server_subnet); - add_samba_names_to_subnet(wins_server_subnet); + if((fp = x_fopen(lock_path(WINS_LIST),O_RDONLY,0)) == NULL) + { + DEBUG(2,("initialise_wins: Can't open wins database file %s. Error was %s\n", + WINS_LIST, strerror(errno) )); + return True; + } - tdb = tdb_open_log(lock_path(WINS_LIST), 0, TDB_DEFAULT, O_RDONLY, 0600); - if (!tdb) { - DEBUG(2,("initialise_wins: Can't open wins database file %s. Error was %s\n", WINS_LIST, strerror(errno) )); - return True; - } + while (!x_feof(fp)) + { + pstring name_str, ip_str, ttl_str, nb_flags_str; + unsigned int num_ips; + pstring name; + struct in_addr *ip_list; + int type = 0; + int nb_flags; + int ttl; + const char *ptr; + char *p; + BOOL got_token; + BOOL was_ip; + int i; + unsigned hash; + int version; + + /* Read a line from the wins.dat file. Strips whitespace + from the beginning and end of the line. + */ + if (!fgets_slash(line,sizeof(pstring),fp)) + continue; + + if (*line == '#') + continue; + + if (strncmp(line,"VERSION ", 8) == 0) { + if (sscanf(line,"VERSION %d %u", &version, &hash) != 2 || + version != WINS_VERSION) { + DEBUG(0,("Discarding invalid wins.dat file [%s]\n",line)); + x_fclose(fp); + return True; + } + continue; + } - if (tdb_fetch_int32(tdb, INFO_VERSION) != WINS_VERSION) { - DEBUG(0,("Discarding invalid wins.tdb file\n")); - tdb_close(tdb); - return True; - } + ptr = line; - for (kbuf = tdb_firstkey(tdb); - kbuf.dptr; - newkey = tdb_nextkey(tdb, kbuf), safe_free(kbuf.dptr), kbuf=newkey) { - - fstring name_type; - pstring name, ip_str; - char *p; - int type = 0; - int nb_flags; - int ttl; - unsigned int num_ips; - int high, low; - struct in_addr wins_ip; - struct in_addr *ip_list; - int wins_flags; - int len,i; - - if (strncmp(kbuf.dptr, ENTRY_PREFIX, strlen(ENTRY_PREFIX)) != 0) - continue; - - dbuf = tdb_fetch(tdb, kbuf); - if (!dbuf.dptr) - continue; + /* + * Now we handle multiple IP addresses per name we need + * to iterate over the line twice. The first time to + * determine how many IP addresses there are, the second + * time to actually parse them into the ip_list array. + */ - fstrcpy(name_type, kbuf.dptr+strlen(ENTRY_PREFIX)); + if (!next_token(&ptr,name_str,NULL,sizeof(name_str))) + { + DEBUG(0,("initialise_wins: Failed to parse name when parsing line %s\n", line )); + continue; + } - pstrcpy(name, name_type); + if (!next_token(&ptr,ttl_str,NULL,sizeof(ttl_str))) + { + DEBUG(0,("initialise_wins: Failed to parse time to live when parsing line %s\n", line )); + continue; + } - if((p = strchr(name,'#')) != NULL) { - *p = 0; - sscanf(p+1,"%x",&type); - } + /* + * Determine the number of IP addresses per line. + */ + num_ips = 0; + do + { + got_token = next_token(&ptr,ip_str,NULL,sizeof(ip_str)); + was_ip = False; - len = tdb_unpack(dbuf.dptr, dbuf.dsize, "dddfddd", - &nb_flags, &high, &low, - ip_str, &ttl, &num_ips, &wins_flags); + if(got_token && strchr(ip_str, '.')) + { + num_ips++; + was_ip = True; + } + } while( got_token && was_ip); - wins_ip=*interpret_addr2(ip_str); + if(num_ips == 0) + { + DEBUG(0,("initialise_wins: Missing IP address when parsing line %s\n", line )); + continue; + } - /* Don't reload replica records */ - if (!ip_equal(wins_ip, our_fake_ip)) { - SAFE_FREE(dbuf.dptr); - continue; - } + if(!got_token) + { + DEBUG(0,("initialise_wins: Missing nb_flags when parsing line %s\n", line )); + continue; + } - /* Don't reload released or tombstoned records */ - if ((wins_flags&WINS_STATE_MASK) != WINS_ACTIVE) { - SAFE_FREE(dbuf.dptr); - continue; - } + /* Allocate the space for the ip_list. */ + if((ip_list = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr))) == NULL) + { + DEBUG(0,("initialise_wins: Malloc fail !\n")); + return False; + } + + /* Reset and re-parse the line. */ + ptr = line; + next_token(&ptr,name_str,NULL,sizeof(name_str)); + next_token(&ptr,ttl_str,NULL,sizeof(ttl_str)); + for(i = 0; i < num_ips; i++) + { + next_token(&ptr, ip_str, NULL, sizeof(ip_str)); + ip_list[i] = *interpret_addr2(ip_str); + } + next_token(&ptr,nb_flags_str,NULL, sizeof(nb_flags_str)); - /* Allocate the space for the ip_list. */ - if((ip_list = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr))) == NULL) { - SAFE_FREE(dbuf.dptr); - DEBUG(0,("initialise_wins: Malloc fail !\n")); - return False; - } + /* + * Deal with SELF or REGISTER name encoding. Default is REGISTER + * for compatibility with old nmbds. + */ - for (i = 0; i < num_ips; i++) { - len += tdb_unpack(dbuf.dptr+len, dbuf.dsize-len, "f", ip_str); - ip_list[i] = *interpret_addr2(ip_str); - } + if(nb_flags_str[strlen(nb_flags_str)-1] == 'S') + { + DEBUG(5,("initialise_wins: Ignoring SELF name %s\n", line)); + SAFE_FREE(ip_list); + continue; + } + + if(nb_flags_str[strlen(nb_flags_str)-1] == 'R') + nb_flags_str[strlen(nb_flags_str)-1] = '\0'; + + /* Netbios name. # divides the name from the type (hex): netbios#xx */ + pstrcpy(name,name_str); + + if((p = strchr(name,'#')) != NULL) + { + *p = 0; + sscanf(p+1,"%x",&type); + } + + /* Decode the netbios flags (hex) and the time-to-live (in seconds). */ + sscanf(nb_flags_str,"%x",&nb_flags); + sscanf(ttl_str,"%d",&ttl); - /* add all entries that have 60 seconds or more to live */ - if ((ttl - 60) > time_now || ttl == PERMANENT_TTL) { - if(ttl != PERMANENT_TTL) - ttl -= time_now; + /* add all entries that have 60 seconds or more to live */ + if ((ttl - 60) > time_now || ttl == PERMANENT_TTL) + { + if(ttl != PERMANENT_TTL) + ttl -= time_now; - DEBUG( 4, ("initialise_wins: add name: %s#%02x ttl = %d first IP %s flags = %2x\n", - name, type, ttl, inet_ntoa(ip_list[0]), nb_flags)); - - namerec=add_name_to_subnet( wins_server_subnet, name, type, nb_flags, - ttl, REGISTER_NAME, num_ips, ip_list); - if (namerec!=NULL) { - update_wins_owner(namerec, wins_ip); - update_wins_flag(namerec, wins_flags); - /* we don't reload the ID, on startup we restart at 1 */ - get_global_id_and_update(&namerec->data.id, True); - } + DEBUG( 4, ("initialise_wins: add name: %s#%02x ttl = %d first IP %s flags = %2x\n", + name, type, ttl, inet_ntoa(ip_list[0]), nb_flags)); - } else { - DEBUG(4, ("initialise_wins: not adding name (ttl problem) %s#%02x ttl = %d first IP %s flags = %2x\n", - name, type, ttl, inet_ntoa(ip_list[0]), nb_flags)); - } + (void)add_name_to_subnet( wins_server_subnet, name, type, nb_flags, + ttl, REGISTER_NAME, num_ips, ip_list ); - SAFE_FREE(dbuf.dptr); - SAFE_FREE(ip_list); - } + } + else + { + DEBUG(4, ("initialise_wins: not adding name (ttl problem) %s#%02x ttl = %d first IP %s flags = %2x\n", + name, type, ttl, inet_ntoa(ip_list[0]), nb_flags)); + } + + SAFE_FREE(ip_list); + } - tdb_close(tdb); - DEBUG(2,("initialise_wins: done\n")); - return True; + x_fclose(fp); + return True; } /**************************************************************************** @@ -1765,113 +1819,87 @@ we are not the wins owner !\n", nmb_namestr(&namerec->name))); ******************************************************************/ void wins_write_database(BOOL background) { - struct name_record *namerec; - pstring fname, fnamenew; - TDB_CONTEXT *tdb; - TDB_DATA kbuf, dbuf; - pstring key, buf; - int len; - int num_record=0; - SMB_BIG_UINT id; - - if(!lp_we_are_a_wins_server()) - return; - - /* we will do the writing in a child process to ensure that the parent - doesn't block while this is done */ - if (background) { - CatchChild(); - if (sys_fork()) { - return; - } - } - - slprintf(fname,sizeof(fname)-1,"%s/%s", lp_lockdir(), WINS_LIST); - all_string_sub(fname,"//", "/", 0); - slprintf(fnamenew,sizeof(fnamenew)-1,"%s.%u", fname, (unsigned int)sys_getpid()); - - tdb = tdb_open_log(fnamenew, 0, TDB_DEFAULT, O_RDWR|O_CREAT|O_TRUNC, 0644); - if (!tdb) { - DEBUG(0,("wins_write_database: Can't open %s. Error was %s\n", fnamenew, strerror(errno))); - if (background) - _exit(0); - return; - } - - DEBUG(3,("wins_write_database: Dump of WINS name list.\n")); - - tdb_store_int32(tdb, INFO_VERSION, WINS_VERSION); - - for (namerec = (struct name_record *)ubi_trFirst( wins_server_subnet->namelist ); - namerec; - namerec = (struct name_record *)ubi_trNext( namerec ) ) { - - int i; - struct tm *tm; - - DEBUGADD(3,("%-19s ", nmb_namestr(&namerec->name) )); + struct name_record *namerec; + pstring fname, fnamenew; - if( namerec->data.death_time != PERMANENT_TTL ) { - char *ts, *nl; - - tm = LocalTime(&namerec->data.death_time); - ts = asctime(tm); - nl = strrchr_m( ts, '\n' ); - if( NULL != nl ) - *nl = '\0'; + XFILE *fp; + + if(!lp_we_are_a_wins_server()) + return; - DEBUGADD(3,("TTL = %s ", ts )); - } else - DEBUGADD(3,("TTL = PERMANENT ")); + /* we will do the writing in a child process to ensure that the parent + doesn't block while this is done */ + if (background) { + CatchChild(); + if (sys_fork()) { + return; + } + } - for (i = 0; i < namerec->data.num_ips; i++) - DEBUGADD(0,("%15s ", inet_ntoa(namerec->data.ip[i]) )); + slprintf(fname,sizeof(fname)-1,"%s/%s", lp_lockdir(), WINS_LIST); + all_string_sub(fname,"//", "/", 0); + slprintf(fnamenew,sizeof(fnamenew)-1,"%s.%u", fname, (unsigned int)sys_getpid()); - DEBUGADD(3,("0x%2x 0x%2x %15s\n", namerec->data.nb_flags, namerec->data.wins_flags, inet_ntoa(namerec->data.wins_ip))); + if((fp = x_fopen(fnamenew,O_WRONLY|O_CREAT,0644)) == NULL) + { + DEBUG(0,("wins_write_database: Can't open %s. Error was %s\n", fnamenew, strerror(errno))); + if (background) { + _exit(0); + } + return; + } - if( namerec->data.source == REGISTER_NAME ) { - - /* store the type in the key to make the name unique */ - slprintf(key, sizeof(key), "%s%s#%02x", ENTRY_PREFIX, namerec->name.name, namerec->name.name_type); - - len = tdb_pack(buf, sizeof(buf), "dddfddd", - (int)namerec->data.nb_flags, - (int)(namerec->data.id>>32), - (int)(namerec->data.id&0xffffffff), - inet_ntoa(namerec->data.wins_ip), - (int)namerec->data.death_time, - namerec->data.num_ips, - namerec->data.wins_flags); - - for (i = 0; i < namerec->data.num_ips; i++) - len += tdb_pack(buf+len, sizeof(buf)-len, "f", inet_ntoa(namerec->data.ip[i])); - - kbuf.dsize = strlen(key)+1; - kbuf.dptr = key; - dbuf.dsize = len; - dbuf.dptr = buf; - if (tdb_store(tdb, kbuf, dbuf, TDB_INSERT) != 0) return; + DEBUG(4,("wins_write_database: Dump of WINS name list.\n")); - num_record++; - } - } + x_fprintf(fp,"VERSION %d %u\n", WINS_VERSION, 0); + + for( namerec + = (struct name_record *)ubi_trFirst( wins_server_subnet->namelist ); + namerec; + namerec = (struct name_record *)ubi_trNext( namerec ) ) + { + int i; + struct tm *tm; - /* store the number of records */ - tdb_store_int32(tdb, INFO_COUNT, num_record); + DEBUGADD(4,("%-19s ", nmb_namestr(&namerec->name) )); - /* get and store the last used ID */ - get_global_id_and_update(&id, False); - tdb_store_int32(tdb, INFO_ID_HIGH, id>>32); - tdb_store_int32(tdb, INFO_ID_LOW, id&0xffffffff); + if( namerec->data.death_time != PERMANENT_TTL ) + { + char *ts, *nl; + + tm = LocalTime(&namerec->data.death_time); + ts = asctime(tm); + nl = strrchr( ts, '\n' ); + if( NULL != nl ) + *nl = '\0'; + DEBUGADD(4,("TTL = %s ", ts )); + } + else + DEBUGADD(4,("TTL = PERMANENT ")); - tdb_close(tdb); + for (i = 0; i < namerec->data.num_ips; i++) + DEBUGADD(4,("%15s ", inet_ntoa(namerec->data.ip[i]) )); + DEBUGADD(4,("%2x\n", namerec->data.nb_flags )); - chmod(fnamenew,0644); - unlink(fname); - rename(fnamenew,fname); + if( namerec->data.source == REGISTER_NAME ) + { + x_fprintf(fp, "\"%s#%02x\" %d ", + namerec->name.name,namerec->name.name_type, /* Ignore scope. */ + (int)namerec->data.death_time); - if (background) - _exit(0); + for (i = 0; i < namerec->data.num_ips; i++) + x_fprintf( fp, "%s ", inet_ntoa( namerec->data.ip[i] ) ); + x_fprintf( fp, "%2xR\n", namerec->data.nb_flags ); + } + } + + x_fclose(fp); + chmod(fnamenew,0644); + unlink(fname); + rename(fnamenew,fname); + if (background) { + _exit(0); + } } /**************************************************************************** diff --git a/source3/nmbd/nmbd_workgroupdb.c b/source3/nmbd/nmbd_workgroupdb.c index b8ea60dec0..2357fd637b 100644 --- a/source3/nmbd/nmbd_workgroupdb.c +++ b/source3/nmbd/nmbd_workgroupdb.c @@ -57,7 +57,7 @@ static struct work_record *create_workgroup(const char *name, int ttl) } memset((char *)work, '\0', sizeof(*work)); - StrnCpy(work->work_group,name,sizeof(work->work_group)-1); + fstrcpy(work->work_group,name); work->serverlist = NULL; work->RunningElection = False; diff --git a/source3/nsswitch/wb_client.c b/source3/nsswitch/wb_client.c index 996d15180d..7c5a8dd054 100644 --- a/source3/nsswitch/wb_client.c +++ b/source3/nsswitch/wb_client.c @@ -269,11 +269,8 @@ static int wb_getgroups(const char *user, gid_t **groups) time consuming. If size is zero, list is not modified and the total number of groups for the user is returned. */ -int winbind_getgroups(const char *user, int size, gid_t *list) +int winbind_getgroups(const char *user, gid_t **list) { - gid_t *groups = NULL; - int result, i; - /* * Don't do the lookup if the name has no separator _and_ we are not in * 'winbind use default domain' mode. @@ -284,24 +281,316 @@ int winbind_getgroups(const char *user, int size, gid_t *list) /* Fetch list of groups */ - result = wb_getgroups(user, &groups); + return wb_getgroups(user, list); +} + +/********************************************************************** + simple wrapper function to see if winbindd is alive +**********************************************************************/ + +BOOL winbind_ping( void ) +{ + NSS_STATUS result; + + result = winbindd_request(WINBINDD_PING, NULL, NULL); + + return result == NSS_STATUS_SUCCESS; +} + +/********************************************************************** + Ask winbindd to create a local user +**********************************************************************/ + +BOOL winbind_create_user( const char *name, uint32 *rid ) +{ + struct winbindd_request request; + struct winbindd_response response; + NSS_STATUS result; + + if ( !lp_winbind_enable_local_accounts() ) + return False; + + if ( !name ) + return False; + + DEBUG(10,("winbind_create_user: %s\n", name)); + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + /* see if the caller wants a new RID returned */ + + if ( rid ) + request.flags = WBFLAG_ALLOCATE_RID; + + fstrcpy( request.data.acct_mgt.username, name ); + fstrcpy( request.data.acct_mgt.groupname, "" ); + + result = winbindd_request( WINBINDD_CREATE_USER, &request, &response); + + if ( rid ) + *rid = response.data.rid; + + return result == NSS_STATUS_SUCCESS; +} + +/********************************************************************** + Ask winbindd to create a local group +**********************************************************************/ + +BOOL winbind_create_group( const char *name, uint32 *rid ) +{ + struct winbindd_request request; + struct winbindd_response response; + NSS_STATUS result; + + if ( !lp_winbind_enable_local_accounts() ) + return False; + + if ( !name ) + return False; + + DEBUG(10,("winbind_create_group: %s\n", name)); + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + /* see if the caller wants a new RID returned */ + + if ( rid ) + request.flags = WBFLAG_ALLOCATE_RID; + + fstrcpy( request.data.acct_mgt.groupname, name ); + + + result = winbindd_request( WINBINDD_CREATE_GROUP, &request, &response); + + if ( rid ) + *rid = response.data.rid; + + return result == NSS_STATUS_SUCCESS; +} + +/********************************************************************** + Ask winbindd to add a user to a local group +**********************************************************************/ + +BOOL winbind_add_user_to_group( const char *user, const char *group ) +{ + struct winbindd_request request; + struct winbindd_response response; + NSS_STATUS result; + + if ( !lp_winbind_enable_local_accounts() ) + return False; + + if ( !user || !group ) + return False; + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + DEBUG(10,("winbind_add_user_to_group: user(%s), group(%s) \n", + user, group)); + + fstrcpy( request.data.acct_mgt.username, user ); + fstrcpy( request.data.acct_mgt.groupname, group ); + + result = winbindd_request( WINBINDD_ADD_USER_TO_GROUP, &request, &response); + + return result == NSS_STATUS_SUCCESS; +} + +/********************************************************************** + Ask winbindd to remove a user to a local group +**********************************************************************/ + +BOOL winbind_remove_user_from_group( const char *user, const char *group ) +{ + struct winbindd_request request; + struct winbindd_response response; + NSS_STATUS result; + + if ( !lp_winbind_enable_local_accounts() ) + return False; + + if ( !user || !group ) + return False; + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + DEBUG(10,("winbind_remove_user_from_group: user(%s), group(%s) \n", + user, group)); + + ZERO_STRUCT(response); + + result = winbindd_request( WINBINDD_REMOVE_USER_FROM_GROUP, &request, &response); + + return result == NSS_STATUS_SUCCESS; +} + +/********************************************************************** + Ask winbindd to set the primary group for a user local user +**********************************************************************/ + +BOOL winbind_set_user_primary_group( const char *user, const char *group ) +{ + struct winbindd_request request; + struct winbindd_response response; + NSS_STATUS result; + + if ( !lp_winbind_enable_local_accounts() ) + return False; + + if ( !user || !group ) + return False; + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + DEBUG(10,("winbind_set_user_primary_group: user(%s), group(%s) \n", + user, group)); + + fstrcpy( request.data.acct_mgt.username, user ); + fstrcpy( request.data.acct_mgt.groupname, group ); + + result = winbindd_request( WINBINDD_SET_USER_PRIMARY_GROUP, &request, &response); + + return result == NSS_STATUS_SUCCESS; +} + + +/********************************************************************** + Ask winbindd to remove a user from its lists of accounts +**********************************************************************/ + +BOOL winbind_delete_user( const char *user ) +{ + struct winbindd_request request; + struct winbindd_response response; + NSS_STATUS result; + + if ( !lp_winbind_enable_local_accounts() ) + return False; + + if ( !user ) + return False; + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + DEBUG(10,("winbind_delete_user: user (%s)\n", user)); + + fstrcpy( request.data.acct_mgt.username, user ); + + result = winbindd_request( WINBINDD_DELETE_USER, &request, &response); + + return result == NSS_STATUS_SUCCESS; +} + +/********************************************************************** + Ask winbindd to remove a group from its lists of accounts +**********************************************************************/ + +BOOL winbind_delete_group( const char *group ) +{ + struct winbindd_request request; + struct winbindd_response response; + NSS_STATUS result; + + if ( !lp_winbind_enable_local_accounts() ) + return False; + + if ( !group ) + return False; + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + DEBUG(10,("winbind_delete_group: group (%s)\n", group)); + + fstrcpy( request.data.acct_mgt.groupname, group ); + + result = winbindd_request( WINBINDD_DELETE_GROUP, &request, &response); + + return result == NSS_STATUS_SUCCESS; +} + +/***********************************************************************/ +#if 0 /* not needed currently since winbindd_acct was added -- jerry */ + +/* Call winbindd to convert SID to uid. Do not allocate */ + +BOOL winbind_sid_to_uid_query(uid_t *puid, const DOM_SID *sid) +{ + struct winbindd_request request; + struct winbindd_response response; + int result; + fstring sid_str; + + if (!puid) + return False; + + /* Initialise request */ + + ZERO_STRUCT(request); + ZERO_STRUCT(response); - if (size == 0) - goto done; + sid_to_string(sid_str, sid); + fstrcpy(request.data.sid, sid_str); + + request.flags = WBFLAG_QUERY_ONLY; + + /* Make request */ - if (result > size) { - result = -1; - errno = EINVAL; /* This is what getgroups() does */ - goto done; + result = winbindd_request(WINBINDD_SID_TO_UID, &request, &response); + + /* Copy out result */ + + if (result == NSS_STATUS_SUCCESS) { + *puid = response.data.uid; } - /* Copy list of groups across */ + return (result == NSS_STATUS_SUCCESS); +} + +/* Call winbindd to convert SID to gid. Do not allocate */ - for (i = 0; i < result; i++) { - list[i] = groups[i]; +BOOL winbind_sid_to_gid_query(gid_t *pgid, const DOM_SID *sid) +{ + struct winbindd_request request; + struct winbindd_response response; + int result; + fstring sid_str; + + if (!pgid) + return False; + + /* Initialise request */ + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + sid_to_string(sid_str, sid); + fstrcpy(request.data.sid, sid_str); + + request.flags = WBFLAG_QUERY_ONLY; + + /* Make request */ + + result = winbindd_request(WINBINDD_SID_TO_GID, &request, &response); + + /* Copy out result */ + + if (result == NSS_STATUS_SUCCESS) { + *pgid = response.data.gid; } - done: - SAFE_FREE(groups); - return result; + return (result == NSS_STATUS_SUCCESS); } + +#endif /* JERRY */ + +/***********************************************************************/ + diff --git a/source3/nsswitch/wb_common.c b/source3/nsswitch/wb_common.c index ac1ccb217e..acaf0ed17c 100644 --- a/source3/nsswitch/wb_common.c +++ b/source3/nsswitch/wb_common.c @@ -395,11 +395,15 @@ int read_reply(struct winbindd_response *response) NSS_STATUS winbindd_send_request(int req_type, struct winbindd_request *request) { struct winbindd_request lrequest; - + char *env; + int value; + /* Check for our tricky environment variable */ - if (getenv(WINBINDD_DONT_ENV)) { - return NSS_STATUS_NOTFOUND; + if ( (env = getenv(WINBINDD_DONT_ENV)) != NULL ) { + value = atoi(env); + if ( value == 1 ) + return NSS_STATUS_NOTFOUND; } if (!request) { @@ -464,3 +468,19 @@ NSS_STATUS winbindd_request(int req_type, return(status); return winbindd_get_response(response); } + +/************************************************************************* + A couple of simple jfunctions to disable winbindd lookups and re- + enable them + ************************************************************************/ + +BOOL winbind_off( void ) +{ + return (setenv( WINBINDD_DONT_ENV, "1", 1 ) != -1); +} + +BOOL winbind_on( void ) +{ + return (setenv( WINBINDD_DONT_ENV, "0", 1 ) != -1); +} + diff --git a/source3/nsswitch/wbinfo.c b/source3/nsswitch/wbinfo.c index 61c54b3738..f533799370 100644 --- a/source3/nsswitch/wbinfo.c +++ b/source3/nsswitch/wbinfo.c @@ -103,7 +103,7 @@ static BOOL parse_wbinfo_domain_user(const char *domuser, fstring domain, fstrcpy(user, p+1); fstrcpy(domain, domuser); domain[PTR_DIFF(p, domuser)] = 0; - strupper(domain); + strupper_m(domain); return True; } @@ -511,6 +511,175 @@ static BOOL wbinfo_auth_crap(char *username) return result == NSS_STATUS_SUCCESS; } +/****************************************************************** + create a winbindd user +******************************************************************/ + +static BOOL wbinfo_create_user(char *username) +{ + struct winbindd_request request; + struct winbindd_response response; + NSS_STATUS result; + + /* Send off request */ + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + request.flags = WBFLAG_ALLOCATE_RID; + fstrcpy(request.data.acct_mgt.username, username); + + result = winbindd_request(WINBINDD_CREATE_USER, &request, &response); + + if ( result == NSS_STATUS_SUCCESS ) + d_printf("New RID is %d\n", response.data.rid); + + return result == NSS_STATUS_SUCCESS; +} + +/****************************************************************** + remove a winbindd user +******************************************************************/ + +static BOOL wbinfo_delete_user(char *username) +{ + struct winbindd_request request; + struct winbindd_response response; + NSS_STATUS result; + + /* Send off request */ + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + fstrcpy(request.data.acct_mgt.username, username); + + result = winbindd_request(WINBINDD_DELETE_USER, &request, &response); + + return result == NSS_STATUS_SUCCESS; +} + +/****************************************************************** + create a winbindd group +******************************************************************/ + +static BOOL wbinfo_create_group(char *groupname) +{ + struct winbindd_request request; + struct winbindd_response response; + NSS_STATUS result; + + /* Send off request */ + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + fstrcpy(request.data.acct_mgt.groupname, groupname); + + result = winbindd_request(WINBINDD_CREATE_GROUP, &request, &response); + + return result == NSS_STATUS_SUCCESS; +} + +/****************************************************************** + remove a winbindd group +******************************************************************/ + +static BOOL wbinfo_delete_group(char *groupname) +{ + struct winbindd_request request; + struct winbindd_response response; + NSS_STATUS result; + + /* Send off request */ + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + fstrcpy(request.data.acct_mgt.groupname, groupname); + + result = winbindd_request(WINBINDD_DELETE_GROUP, &request, &response); + + return result == NSS_STATUS_SUCCESS; +} + +/****************************************************************** + parse a string in the form user:group +******************************************************************/ + +static BOOL parse_user_group( const char *string, fstring user, fstring group ) +{ + char *p; + + if ( !string ) + return False; + + if ( !(p = strchr( string, ':' )) ) + return False; + + *p = '\0'; + p++; + + fstrcpy( user, string ); + fstrcpy( group, p ); + + return True; +} + +/****************************************************************** + add a user to a winbindd group +******************************************************************/ + +static BOOL wbinfo_add_user_to_group(char *string) +{ + struct winbindd_request request; + struct winbindd_response response; + NSS_STATUS result; + + /* Send off request */ + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + if ( !parse_user_group( string, request.data.acct_mgt.username, + request.data.acct_mgt.groupname)) + { + d_printf("Can't parse user:group from %s\n", string); + return False; + } + + result = winbindd_request(WINBINDD_ADD_USER_TO_GROUP, &request, &response); + + return result == NSS_STATUS_SUCCESS; +} + +/****************************************************************** + remove a user from a winbindd group +******************************************************************/ + +static BOOL wbinfo_remove_user_from_group(char *string) +{ + struct winbindd_request request; + struct winbindd_response response; + NSS_STATUS result; + + /* Send off request */ + + ZERO_STRUCT(request); + ZERO_STRUCT(response); + + if ( !parse_user_group( string, request.data.acct_mgt.username, + request.data.acct_mgt.groupname)) + { + d_printf("Can't parse user:group from %s\n", string); + return False; + } + + result = winbindd_request(WINBINDD_REMOVE_USER_FROM_GROUP, &request, &response); + + return result == NSS_STATUS_SUCCESS; +} + /* Print domain users */ static BOOL print_domain_users(void) @@ -705,12 +874,18 @@ int main(int argc, char **argv) { "gid-to-sid", 'G', POPT_ARG_INT, &int_arg, 'G', "Converts gid to sid", "GID" }, { "sid-to-uid", 'S', POPT_ARG_STRING, &string_arg, 'S', "Converts sid to uid", "SID" }, { "sid-to-gid", 'Y', POPT_ARG_STRING, &string_arg, 'Y', "Converts sid to gid", "SID" }, + { "create-user", 'c', POPT_ARG_STRING, &string_arg, 'c', "Create a local user account", "name" }, + { "delete-user", 'x', POPT_ARG_STRING, &string_arg, 'x', "Delete a local user account", "name" }, + { "create-group", 'C', POPT_ARG_STRING, &string_arg, 'C', "Create a local group", "name" }, + { "delete-group", 'X', POPT_ARG_STRING, &string_arg, 'X', "Delete a local group", "name" }, + { "add-to-group", 'o', POPT_ARG_STRING, &string_arg, 'o', "Add user to group", "user:group" }, + { "del-from-group", 'O', POPT_ARG_STRING, &string_arg, 'O', "Remove user from group", "user:group" }, { "check-secret", 't', POPT_ARG_NONE, 0, 't', "Check shared secret" }, { "trusted-domains", 'm', POPT_ARG_NONE, 0, 'm', "List trusted domains" }, { "sequence", 0, POPT_ARG_NONE, 0, OPT_SEQUENCE, "Show sequence numbers of all domains" }, { "user-groups", 'r', POPT_ARG_STRING, &string_arg, 'r', "Get user groups", "USER" }, { "authenticate", 'a', POPT_ARG_STRING, &string_arg, 'a', "authenticate user", "user%password" }, - { "set-auth-user", 'A', POPT_ARG_STRING, &string_arg, OPT_SET_AUTH_USER, "Store user and password used by winbindd (root only)", "user%password" }, + { "set-auth-user", 0, POPT_ARG_STRING, &string_arg, OPT_SET_AUTH_USER, "Store user and password used by winbindd (root only)", "user%password" }, { "get-auth-user", 0, POPT_ARG_NONE, NULL, OPT_GET_AUTH_USER, "Retrieve user and password used by winbindd (root only)", NULL }, { "ping", 'p', POPT_ARG_NONE, 0, 'p', "Ping winbindd to see if it is alive" }, POPT_COMMON_VERSION @@ -845,31 +1020,66 @@ int main(int argc, char **argv) } break; case 'a': { - BOOL got_error = False; - - if (!wbinfo_auth(string_arg)) { - d_printf("Could not authenticate user %s with " - "plaintext password\n", string_arg); - got_error = True; - } - - if (!wbinfo_auth_crap(string_arg)) { - d_printf("Could not authenticate user %s with " - "challenge/response\n", string_arg); - got_error = True; - } - - if (got_error) - goto done; - break; - } - case 'p': { - if (!wbinfo_ping()) { - d_printf("could not ping winbindd!\n"); - goto done; - } - break; - } + BOOL got_error = False; + + if (!wbinfo_auth(string_arg)) { + d_printf("Could not authenticate user %s with " + "plaintext password\n", string_arg); + got_error = True; + } + + if (!wbinfo_auth_crap(string_arg)) { + d_printf("Could not authenticate user %s with " + "challenge/response\n", string_arg); + got_error = True; + } + + if (got_error) + goto done; + break; + } + case 'c': + if ( !wbinfo_create_user(string_arg) ) { + d_printf("Could not create user account\n"); + goto done; + } + break; + case 'C': + if ( !wbinfo_create_group(string_arg) ) { + d_printf("Could not create group\n"); + goto done; + } + break; + case 'o': + if ( !wbinfo_add_user_to_group(string_arg) ) { + d_printf("Could not add user to group\n"); + goto done; + } + break; + case 'O': + if ( !wbinfo_remove_user_from_group(string_arg) ) { + d_printf("Could not remove user kfrom group\n"); + goto done; + } + break; + case 'x': + if ( !wbinfo_delete_user(string_arg) ) { + d_printf("Could not delete user account\n"); + goto done; + } + break; + case 'X': + if ( !wbinfo_delete_group(string_arg) ) { + d_printf("Could not delete group\n"); + goto done; + } + break; + case 'P': + if (!wbinfo_ping()) { + d_printf("could not ping winbindd!\n"); + goto done; + } + break; case OPT_SET_AUTH_USER: wbinfo_set_auth_user(string_arg); break; diff --git a/source3/nsswitch/winbindd.c b/source3/nsswitch/winbindd.c index c7e45e5429..0860d701d8 100644 --- a/source3/nsswitch/winbindd.c +++ b/source3/nsswitch/winbindd.c @@ -25,7 +25,21 @@ #include "winbindd.h" BOOL opt_nocache = False; -BOOL opt_dual_daemon = False; +BOOL opt_dual_daemon = True; + +/***************************************************************************** + stubb functions +****************************************************************************/ + +void become_root( void ) +{ + return; +} + +void unbecome_root( void ) +{ + return; +} /* Reload configuration */ @@ -52,6 +66,7 @@ static BOOL reload_services_file(BOOL test) return(ret); } + #if DUMP_CORE /**************************************************************************** ** @@ -135,8 +150,17 @@ static void print_winbindd_status(void) static void flush_caches(void) { +#if 0 /* Clear cached user and group enumation info */ - wcache_flush_cache(); + if (!opt_dual_daemon) /* Until we have coherent cache flush. */ + wcache_flush_cache(); +#endif + + /* We need to invalidate cached user list entries on a SIGHUP + otherwise cached access denied errors due to restrict anonymous + hang around until the sequence number changes. */ + + wcache_invalidate_cache(); } /* Handle the signal by unlinking socket and exiting */ @@ -178,6 +202,20 @@ static void sighup_handler(int signum) sys_select_signal(); } +/* React on 'smbcontrol winbindd reload-config' in the same way as on SIGHUP*/ +static void msg_reload_services(int msg_type, pid_t src, void *buf, size_t len) +{ + /* Flush various caches */ + flush_caches(); + reload_services_file(True); +} + +/* React on 'smbcontrol winbindd shutdown' in the same way as on SIGTERM*/ +static void msg_shutdown(int msg_type, pid_t src, void *buf, size_t len) +{ + terminate(); +} + struct dispatch_table { enum winbindd_cmd cmd; enum winbindd_result (*fn)(struct winbindd_cli_state *state); @@ -245,7 +283,16 @@ static struct dispatch_table dispatch_table[] = { { WINBINDD_WINS_BYNAME, winbindd_wins_byname, "WINS_BYNAME" }, { WINBINDD_WINS_BYIP, winbindd_wins_byip, "WINS_BYIP" }, - + + /* UNIX account management functions */ + { WINBINDD_CREATE_USER, winbindd_create_user, "CREATE_USER" }, + { WINBINDD_CREATE_GROUP, winbindd_create_group, "CREATE_GROUP" }, + { WINBINDD_ADD_USER_TO_GROUP, winbindd_add_user_to_group, "ADD_USER_TO_GROUP" }, + { WINBINDD_REMOVE_USER_FROM_GROUP, winbindd_remove_user_from_group,"REMOVE_USER_FROM_GROUP"}, + { WINBINDD_SET_USER_PRIMARY_GROUP, winbindd_set_user_primary_group,"SET_USER_PRIMARY_GROUP"}, + { WINBINDD_DELETE_USER, winbindd_delete_user, "DELETE_USER" }, + { WINBINDD_DELETE_GROUP, winbindd_delete_group, "DELETE_GROUP" }, + /* End of list */ { WINBINDD_NUM_CMDS, NULL, "NONE" } @@ -714,11 +761,8 @@ static void process_loop(void) if (do_sighup) { DEBUG(3, ("got SIGHUP\n")); - - /* Flush various caches */ - flush_caches(); - reload_services_file(True); + msg_reload_services(MSG_SMB_CONF_UPDATED, (pid_t) 0, NULL, 0); do_sighup = False; } @@ -744,7 +788,7 @@ int main(int argc, char **argv) { "stdout", 'S', POPT_ARG_VAL, &log_stdout, True, "Log to stdout" }, { "foreground", 'F', POPT_ARG_VAL, &Fork, False, "Daemon in foreground mode" }, { "interactive", 'i', POPT_ARG_NONE, NULL, 'i', "Interactive mode" }, - { "dual-daemon", 'B', POPT_ARG_VAL, &opt_dual_daemon, True, "Dual daemon mode" }, + { "single-daemon", 'Y', POPT_ARG_VAL, &opt_dual_daemon, False, "Single daemon mode" }, { "no-caching", 'n', POPT_ARG_VAL, &opt_nocache, False, "Disable caching" }, POPT_COMMON_SAMBA POPT_TABLEEND @@ -833,11 +877,11 @@ int main(int argc, char **argv) /* Winbind daemon initialisation */ - if (!idmap_init()) + if (!winbindd_upgrade_idmap()) return 1; - if (!idmap_init_wellknown_sids()) - exit(1); + if (!idmap_init(lp_idmap_backend())) + return 1; /* Unblock all signals we are interested in as they may have been blocked by the parent process. */ @@ -884,14 +928,21 @@ int main(int argc, char **argv) DEBUG(0, ("unable to initialise messaging system\n")); exit(1); } + + /* React on 'smbcontrol winbindd reload-config' in the same way + as to SIGHUP signal */ + message_register(MSG_SMB_CONF_UPDATED, msg_reload_services); + message_register(MSG_SHUTDOWN, msg_shutdown); + poptFreeContext(pc); + netsamlogon_cache_init(); /* Non-critical */ + /* Loop waiting for requests */ process_loop(); trustdom_cache_shutdown(); - uni_group_cache_shutdown(); return 0; } diff --git a/source3/nsswitch/winbindd.h b/source3/nsswitch/winbindd.h index 2d9a0b5949..2acb89b24b 100644 --- a/source3/nsswitch/winbindd.h +++ b/source3/nsswitch/winbindd.h @@ -98,9 +98,12 @@ struct winbindd_domain { BOOL native_mode; /* is this a win2k domain in native mode ? */ /* Lookup methods for this domain (LDAP or RPC) */ - struct winbindd_methods *methods; + /* the backend methods are used by the cache layer to find the right + backend */ + struct winbindd_methods *backend; + /* Private data for the backends (used for connection cache) */ void *private; @@ -109,6 +112,7 @@ struct winbindd_domain { time_t last_seq_check; uint32 sequence_number; + NTSTATUS last_status; /* Linked list info */ @@ -219,7 +223,7 @@ struct winbindd_idmap_methods { void (*status)(void); }; -#include "winbindd_proto.h" +#include "../nsswitch/winbindd_proto.h" #include "rpc_parse.h" #include "rpc_client.h" diff --git a/source3/nsswitch/winbindd_ads.c b/source3/nsswitch/winbindd_ads.c index beb40af79d..462dd21531 100644 --- a/source3/nsswitch/winbindd_ads.c +++ b/source3/nsswitch/winbindd_ads.c @@ -65,7 +65,7 @@ static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain) status = ads_connect(ads); if (!ADS_ERR_OK(status) || !ads->config.realm) { - extern struct winbindd_methods msrpc_methods; + extern struct winbindd_methods msrpc_methods, cache_methods; DEBUG(1,("ads_connect for domain %s failed: %s\n", domain->name, ads_errstr(status))); ads_destroy(&ads); @@ -75,7 +75,11 @@ static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain) if (status.error_type == ADS_ERROR_SYSTEM && status.err.rc == ECONNREFUSED) { DEBUG(1,("Trying MSRPC methods\n")); - domain->methods = &msrpc_methods; + if (domain->methods == &cache_methods) { + domain->backend = &msrpc_methods; + } else { + domain->methods = &msrpc_methods; + } } return NULL; } @@ -112,7 +116,11 @@ static NTSTATUS query_user_list(struct winbindd_domain *domain, DEBUG(3,("ads: query_user_list\n")); ads = ads_cached_connection(domain); - if (!ads) goto done; + + if (!ads) { + domain->last_status = NT_STATUS_SERVER_DISABLED; + goto done; + } rc = ads_search_retry(ads, &res, "(objectCategory=user)", attrs); if (!ADS_ERR_OK(rc)) { @@ -209,7 +217,11 @@ static NTSTATUS enum_dom_groups(struct winbindd_domain *domain, DEBUG(3,("ads: enum_dom_groups\n")); ads = ads_cached_connection(domain); - if (!ads) goto done; + + if (!ads) { + domain->last_status = NT_STATUS_SERVER_DISABLED; + goto done; + } rc = ads_search_retry(ads, &res, "(objectCategory=group)", attrs); if (!ADS_ERR_OK(rc)) { @@ -232,7 +244,9 @@ static NTSTATUS enum_dom_groups(struct winbindd_domain *domain, i = 0; group_flags = ATYPE_GLOBAL_GROUP; - if ( domain->native_mode ) + + /* only grab domain local groups for our domain */ + if ( domain->native_mode && strequal(lp_realm(), domain->alt_name) ) group_flags |= ATYPE_LOCAL_GROUP; for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) { @@ -282,7 +296,7 @@ static NTSTATUS enum_local_groups(struct winbindd_domain *domain, { /* * This is a stub function only as we returned the domain - * ocal groups in enum_dom_groups() if the domain->native field + * local groups in enum_dom_groups() if the domain->native field * was true. This is a simple performance optimization when * using LDAP. * @@ -307,8 +321,11 @@ static NTSTATUS name_to_sid(struct winbindd_domain *domain, DEBUG(3,("ads: name_to_sid\n")); ads = ads_cached_connection(domain); - if (!ads) + + if (!ads) { + domain->last_status = NT_STATUS_SERVER_DISABLED; return NT_STATUS_UNSUCCESSFUL; + } return ads_name_to_sid(ads, name, sid, type); } @@ -322,9 +339,13 @@ static NTSTATUS sid_to_name(struct winbindd_domain *domain, { ADS_STRUCT *ads = NULL; DEBUG(3,("ads: sid_to_name\n")); + ads = ads_cached_connection(domain); - if (!ads) + + if (!ads) { + domain->last_status = NT_STATUS_SERVER_DISABLED; return NT_STATUS_UNSUCCESSFUL; + } return ads_sid_to_name(ads, mem_ctx, sid, name, type); } @@ -338,7 +359,7 @@ static BOOL dn_lookup(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, const char *dn, char **name, uint32 *name_type, DOM_SID *sid) { - char *exp; + char *ldap_exp; void *res = NULL; const char *attrs[] = {"userPrincipalName", "sAMAccountName", "objectSid", "sAMAccountType", NULL}; @@ -346,13 +367,15 @@ static BOOL dn_lookup(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, uint32 atype; char *escaped_dn = escape_ldap_string_alloc(dn); + DEBUG(3,("ads: dn_lookup\n")); + if (!escaped_dn) { return False; } - asprintf(&exp, "(distinguishedName=%s)", dn); - rc = ads_search_retry(ads, &res, exp, attrs); - SAFE_FREE(exp); + asprintf(&ldap_exp, "(distinguishedName=%s)", dn); + rc = ads_search_retry(ads, &res, ldap_exp, attrs); + SAFE_FREE(ldap_exp); SAFE_FREE(escaped_dn); if (!ADS_ERR_OK(rc)) { @@ -392,7 +415,7 @@ static NTSTATUS query_user(struct winbindd_domain *domain, ADS_STATUS rc; int count; void *msg = NULL; - char *exp; + char *ldap_exp; char *sidstr; uint32 group_rid; NTSTATUS status = NT_STATUS_UNSUCCESSFUL; @@ -402,12 +425,16 @@ static NTSTATUS query_user(struct winbindd_domain *domain, DEBUG(3,("ads: query_user\n")); ads = ads_cached_connection(domain); - if (!ads) goto done; + + if (!ads) { + domain->last_status = NT_STATUS_SERVER_DISABLED; + goto done; + } sidstr = sid_binstring(sid); - asprintf(&exp, "(objectSid=%s)", sidstr); - rc = ads_search_retry(ads, &msg, exp, attrs); - free(exp); + asprintf(&ldap_exp, "(objectSid=%s)", sidstr); + rc = ads_search_retry(ads, &msg, ldap_exp, attrs); + free(ldap_exp); free(sidstr); if (!ADS_ERR_OK(rc)) { DEBUG(1,("query_user(sid=%s) ads_search: %s\n", sid_to_string(sid_string, sid), ads_errstr(rc))); @@ -461,22 +488,28 @@ static NTSTATUS lookup_usergroups_alt(struct winbindd_domain *domain, int count; void *res = NULL; void *msg = NULL; - char *exp; + char *ldap_exp; ADS_STRUCT *ads; const char *group_attrs[] = {"objectSid", NULL}; + DEBUG(3,("ads: lookup_usergroups_alt\n")); + ads = ads_cached_connection(domain); - if (!ads) goto done; + + if (!ads) { + domain->last_status = NT_STATUS_SERVER_DISABLED; + goto done; + } /* buggy server, no tokenGroups. Instead lookup what groups this user is a member of by DN search on member*/ - if (asprintf(&exp, "(&(member=%s)(objectClass=group))", user_dn) == -1) { + if (asprintf(&ldap_exp, "(&(member=%s)(objectClass=group))", user_dn) == -1) { DEBUG(1,("lookup_usergroups(dn=%s) asprintf failed!\n", user_dn)); return NT_STATUS_NO_MEMORY; } - rc = ads_search_retry(ads, &res, exp, group_attrs); - free(exp); + rc = ads_search_retry(ads, &res, ldap_exp, group_attrs); + free(ldap_exp); if (!ADS_ERR_OK(rc)) { DEBUG(1,("lookup_usergroups ads_search member=%s: %s\n", user_dn, ads_errstr(rc))); @@ -540,7 +573,7 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain, ADS_STATUS rc; int count; void *msg = NULL; - char *exp; + char *ldap_exp; char *user_dn; DOM_SID *sids; int i; @@ -554,22 +587,26 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain, *num_groups = 0; ads = ads_cached_connection(domain); - if (!ads) goto done; + + if (!ads) { + domain->last_status = NT_STATUS_SERVER_DISABLED; + goto done; + } if (!(sidstr = sid_binstring(sid))) { DEBUG(1,("lookup_usergroups(sid=%s) sid_binstring returned NULL\n", sid_to_string(sid_string, sid))); status = NT_STATUS_NO_MEMORY; goto done; } - if (asprintf(&exp, "(objectSid=%s)", sidstr) == -1) { + if (asprintf(&ldap_exp, "(objectSid=%s)", sidstr) == -1) { free(sidstr); DEBUG(1,("lookup_usergroups(sid=%s) asprintf failed!\n", sid_to_string(sid_string, sid))); status = NT_STATUS_NO_MEMORY; goto done; } - rc = ads_search_retry(ads, &msg, exp, attrs); - free(exp); + rc = ads_search_retry(ads, &msg, ldap_exp, attrs); + free(ldap_exp); free(sidstr); if (!ADS_ERR_OK(rc)) { @@ -648,7 +685,7 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain, int count; void *res=NULL; ADS_STRUCT *ads = NULL; - char *exp; + char *ldap_exp; NTSTATUS status = NT_STATUS_UNSUCCESSFUL; char *sidstr; const char *attrs[] = {"member", NULL}; @@ -656,17 +693,23 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain, int i, num_members; fstring sid_string; + DEBUG(10,("ads: lookup_groupmem %s sid=%s\n", domain->name, sid_string_static(group_sid))); + *num_names = 0; ads = ads_cached_connection(domain); - if (!ads) goto done; + + if (!ads) { + domain->last_status = NT_STATUS_SERVER_DISABLED; + goto done; + } sidstr = sid_binstring(group_sid); /* search for all members of the group */ - asprintf(&exp, "(objectSid=%s)",sidstr); - rc = ads_search_retry(ads, &res, exp, attrs); - free(exp); + asprintf(&ldap_exp, "(objectSid=%s)",sidstr); + rc = ads_search_retry(ads, &res, ldap_exp, attrs); + free(ldap_exp); free(sidstr); if (!ADS_ERR_OK(rc)) { @@ -730,10 +773,16 @@ static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq) ADS_STRUCT *ads = NULL; ADS_STATUS rc; + DEBUG(3,("ads: fetch sequence_number for %s\n", domain->name)); + *seq = DOM_SEQUENCE_NONE; ads = ads_cached_connection(domain); - if (!ads) return NT_STATUS_UNSUCCESSFUL; + + if (!ads) { + domain->last_status = NT_STATUS_SERVER_DISABLED; + return NT_STATUS_UNSUCCESSFUL; + } rc = ads_USN(ads, seq); if (!ADS_ERR_OK(rc)) { @@ -755,11 +804,17 @@ static NTSTATUS trusted_domains(struct winbindd_domain *domain, ADS_STRUCT *ads; ADS_STATUS rc; + DEBUG(3,("ads: trusted_domains\n")); + *num_domains = 0; *names = NULL; ads = ads_cached_connection(domain); - if (!ads) return NT_STATUS_UNSUCCESSFUL; + + if (!ads) { + domain->last_status = NT_STATUS_SERVER_DISABLED; + return NT_STATUS_UNSUCCESSFUL; + } rc = ads_trusted_domains(ads, mem_ctx, num_domains, names, alt_names, dom_sids); @@ -772,8 +827,14 @@ static NTSTATUS domain_sid(struct winbindd_domain *domain, DOM_SID *sid) ADS_STRUCT *ads; ADS_STATUS rc; + DEBUG(3,("ads: domain_sid\n")); + ads = ads_cached_connection(domain); - if (!ads) return NT_STATUS_UNSUCCESSFUL; + + if (!ads) { + domain->last_status = NT_STATUS_SERVER_DISABLED; + return NT_STATUS_UNSUCCESSFUL; + } rc = ads_domain_sid(ads, sid); @@ -796,8 +857,14 @@ static NTSTATUS alternate_name(struct winbindd_domain *domain) TALLOC_CTX *ctx; char *workgroup; + DEBUG(3,("ads: alternate_name\n")); + ads = ads_cached_connection(domain); - if (!ads) return NT_STATUS_UNSUCCESSFUL; + + if (!ads) { + domain->last_status = NT_STATUS_SERVER_DISABLED; + return NT_STATUS_UNSUCCESSFUL; + } if (!(ctx = talloc_init("alternate_name"))) { return NT_STATUS_NO_MEMORY; @@ -808,8 +875,8 @@ static NTSTATUS alternate_name(struct winbindd_domain *domain) if (ADS_ERR_OK(rc)) { fstrcpy(domain->name, workgroup); fstrcpy(domain->alt_name, ads->config.realm); - strupper(domain->alt_name); - strupper(domain->name); + strupper_m(domain->alt_name); + strupper_m(domain->name); } talloc_destroy(ctx); diff --git a/source3/nsswitch/winbindd_cache.c b/source3/nsswitch/winbindd_cache.c index f3dc1263b9..2da2a9e641 100644 --- a/source3/nsswitch/winbindd_cache.c +++ b/source3/nsswitch/winbindd_cache.c @@ -4,6 +4,8 @@ Winbind cache backend functions Copyright (C) Andrew Tridgell 2001 + Copyright (C) Gerald Carter 2003 + This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -26,7 +28,6 @@ #define DBGC_CLASS DBGC_WINBIND struct winbind_cache { - struct winbindd_methods *backend; TDB_CONTEXT *tdb; }; @@ -46,12 +47,14 @@ void wcache_flush_cache(void) { extern BOOL opt_nocache; - if (!wcache) return; + if (!wcache) + return; if (wcache->tdb) { tdb_close(wcache->tdb); wcache->tdb = NULL; } - if (opt_nocache) return; + if (opt_nocache) + return; wcache->tdb = tdb_open_log(lock_path("winbindd_cache.tdb"), 5000, TDB_CLEAR_IF_FIRST, O_RDWR|O_CREAT, 0600); @@ -59,6 +62,7 @@ void wcache_flush_cache(void) if (!wcache->tdb) { DEBUG(0,("Failed to open winbindd_cache.tdb!\n")); } + DEBUG(10,("wcache_flush_cache success\n")); } void winbindd_check_cache_size(time_t t) @@ -93,30 +97,39 @@ void winbindd_check_cache_size(time_t t) /* get the winbind_cache structure */ static struct winbind_cache *get_cache(struct winbindd_domain *domain) { - extern struct winbindd_methods msrpc_methods; struct winbind_cache *ret = wcache; - if (ret) return ret; - - ret = smb_xmalloc(sizeof(*ret)); - ZERO_STRUCTP(ret); - - if (!strcmp(domain->name, lp_workgroup()) && (lp_security() == SEC_USER)) { - extern struct winbindd_methods passdb_methods; - ret->backend = &passdb_methods; - - } else switch (lp_security()) { + if (!domain->backend) { + extern struct winbindd_methods msrpc_methods; + switch (lp_security()) { #ifdef HAVE_ADS - case SEC_ADS: { - extern struct winbindd_methods ads_methods; - ret->backend = &ads_methods; - break; - } + case SEC_ADS: { + extern struct winbindd_methods ads_methods; + /* always obey the lp_security parameter for our domain */ + if ( strequal(lp_realm(), domain->alt_name) ) { + domain->backend = &ads_methods; + break; + } + + if ( domain->native_mode ) { + domain->backend = &ads_methods; + break; + } + + /* fall through */ + } #endif - default: - ret->backend = &msrpc_methods; + default: + domain->backend = &msrpc_methods; + } } + if (ret) + return ret; + + ret = smb_xmalloc(sizeof(*ret)); + ZERO_STRUCTP(ret); + wcache = ret; wcache_flush_cache(); @@ -128,12 +141,12 @@ static struct winbind_cache *get_cache(struct winbindd_domain *domain) */ static void centry_free(struct cache_entry *centry) { - if (!centry) return; + if (!centry) + return; SAFE_FREE(centry->data); free(centry); } - /* pull a uint32 from a cache entry */ @@ -204,8 +217,10 @@ static DOM_SID *centry_sid(struct cache_entry *centry, TALLOC_CTX *mem_ctx) { DOM_SID *sid; char *sid_string; + sid = talloc(mem_ctx, sizeof(*sid)); - if (!sid) return NULL; + if (!sid) + return NULL; sid_string = centry_string(centry, mem_ctx); if (!string_to_sid(sid, sid_string)) { @@ -217,8 +232,17 @@ static DOM_SID *centry_sid(struct cache_entry *centry, TALLOC_CTX *mem_ctx) /* the server is considered down if it can't give us a sequence number */ static BOOL wcache_server_down(struct winbindd_domain *domain) { - if (!wcache->tdb) return False; - return (domain->sequence_number == DOM_SEQUENCE_NONE); + BOOL ret; + + if (!wcache->tdb) + return False; + + ret = (domain->sequence_number == DOM_SEQUENCE_NONE); + + if (ret) + DEBUG(10,("wcache_server_down: server for Domain %s down\n", + domain->name )); + return ret; } static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now ) @@ -227,14 +251,18 @@ static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now ) fstring key; uint32 time_diff; - if (!wcache->tdb) + if (!wcache->tdb) { + DEBUG(10,("fetch_cache_seqnum: tdb == NULL\n")); return NT_STATUS_UNSUCCESSFUL; + } snprintf( key, sizeof(key), "SEQNUM/%s", domain->name ); - data = tdb_fetch_by_string( wcache->tdb, key ); - if ( !data.dptr || data.dsize!=8 ) + data = tdb_fetch_bystring( wcache->tdb, key ); + if ( !data.dptr || data.dsize!=8 ) { + DEBUG(10,("fetch_cache_seqnum: invalid data size key [%s]\n", key )); return NT_STATUS_UNSUCCESSFUL; + } domain->sequence_number = IVAL(data.dptr, 0); domain->last_seq_check = IVAL(data.dptr, 4); @@ -242,8 +270,12 @@ static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now ) /* have we expired? */ time_diff = now - domain->last_seq_check; - if ( time_diff > lp_winbind_cache_time() ) + if ( time_diff > lp_winbind_cache_time() ) { + DEBUG(10,("fetch_cache_seqnum: timeout [%s][%u @ %u]\n", + domain->name, domain->sequence_number, + (uint32)domain->last_seq_check)); return NT_STATUS_UNSUCCESSFUL; + } DEBUG(10,("fetch_cache_seqnum: success [%s][%u @ %u]\n", domain->name, domain->sequence_number, @@ -258,8 +290,10 @@ static NTSTATUS store_cache_seqnum( struct winbindd_domain *domain ) fstring key_str; char buf[8]; - if (!wcache->tdb) + if (!wcache->tdb) { + DEBUG(10,("store_cache_seqnum: tdb == NULL\n")); return NT_STATUS_UNSUCCESSFUL; + } snprintf( key_str, sizeof(key_str), "SEQNUM/%s", domain->name ); key.dptr = key_str; @@ -270,8 +304,10 @@ static NTSTATUS store_cache_seqnum( struct winbindd_domain *domain ) data.dptr = buf; data.dsize = 8; - if ( tdb_store( wcache->tdb, key, data, TDB_REPLACE) == -1 ) + if ( tdb_store( wcache->tdb, key, data, TDB_REPLACE) == -1 ) { + DEBUG(10,("store_cache_seqnum: tdb_store fail key [%s]\n", key_str )); return NT_STATUS_UNSUCCESSFUL; + } DEBUG(10,("store_cache_seqnum: success [%s][%u @ %u]\n", domain->name, domain->sequence_number, @@ -280,8 +316,6 @@ static NTSTATUS store_cache_seqnum( struct winbindd_domain *domain ) return NT_STATUS_OK; } - - /* refresh the domain sequence number. If force is True then always refresh it, no matter how recently we fetched it @@ -303,7 +337,8 @@ static void refresh_sequence_number(struct winbindd_domain *domain, BOOL force) /* see if we have to refetch the domain sequence number */ if (!force && (time_diff < cache_time)) { - return; + DEBUG(10, ("refresh_sequence_number: %s time ok\n", domain->name)); + goto done; } /* try to get the sequence number from the tdb cache first */ @@ -313,20 +348,21 @@ static void refresh_sequence_number(struct winbindd_domain *domain, BOOL force) if ( NT_STATUS_IS_OK(status) ) goto done; - status = wcache->backend->sequence_number(domain, &domain->sequence_number); + status = domain->backend->sequence_number(domain, &domain->sequence_number); if (!NT_STATUS_IS_OK(status)) { domain->sequence_number = DOM_SEQUENCE_NONE; } + domain->last_status = status; domain->last_seq_check = time(NULL); /* save the new sequence number ni the cache */ store_cache_seqnum( domain ); done: - DEBUG(10, ("refresh_sequence_number: seq number is now %d\n", - domain->sequence_number)); + DEBUG(10, ("refresh_sequence_number: %s seq number is now %d\n", + domain->name, domain->sequence_number)); return; } @@ -334,12 +370,14 @@ done: /* decide if a cache entry has expired */ -static BOOL centry_expired(struct winbindd_domain *domain, struct cache_entry *centry) +static BOOL centry_expired(struct winbindd_domain *domain, const char *keystr, struct cache_entry *centry) { /* if the server is OK and our cache entry came from when it was down then the entry is invalid */ if (domain->sequence_number != DOM_SEQUENCE_NONE && centry->sequence_number == DOM_SEQUENCE_NONE) { + DEBUG(10,("centry_expired: Key %s for domain %s invalid sequence.\n", + keystr, domain->name )); return True; } @@ -347,9 +385,14 @@ static BOOL centry_expired(struct winbindd_domain *domain, struct cache_entry *c current sequence number then it is OK */ if (wcache_server_down(domain) || centry->sequence_number == domain->sequence_number) { + DEBUG(10,("centry_expired: Key %s for domain %s is good.\n", + keystr, domain->name )); return False; } + DEBUG(10,("centry_expired: Key %s for domain %s expired\n", + keystr, domain->name )); + /* it's expired */ return True; } @@ -380,9 +423,9 @@ static struct cache_entry *wcache_fetch(struct winbind_cache *cache, key.dptr = kstr; key.dsize = strlen(kstr); data = tdb_fetch(wcache->tdb, key); - free(kstr); if (!data.dptr) { /* a cache miss */ + free(kstr); return NULL; } @@ -393,25 +436,38 @@ static struct cache_entry *wcache_fetch(struct winbind_cache *cache, if (centry->len < 8) { /* huh? corrupt cache? */ + DEBUG(10,("wcache_fetch: Corrupt cache for key %s domain %s (len < 8) ?\n", + kstr, domain->name )); centry_free(centry); + free(kstr); return NULL; } centry->status = NT_STATUS(centry_uint32(centry)); centry->sequence_number = centry_uint32(centry); - if (centry_expired(domain, centry)) { + if (centry_expired(domain, kstr, centry)) { extern BOOL opt_dual_daemon; + DEBUG(10,("wcache_fetch: entry %s expired for domain %s\n", + kstr, domain->name )); + if (opt_dual_daemon) { extern BOOL background_process; background_process = True; + DEBUG(10,("wcache_fetch: background processing expired entry %s for domain %s\n", + kstr, domain->name )); } else { centry_free(centry); + free(kstr); return NULL; } } + DEBUG(10,("wcache_fetch: returning entry %s for domain %s\n", + kstr, domain->name )); + + free(kstr); return centry; } @@ -421,7 +477,8 @@ static struct cache_entry *wcache_fetch(struct winbind_cache *cache, static void centry_expand(struct cache_entry *centry, uint32 len) { uint8 *p; - if (centry->len - centry->ofs >= len) return; + if (centry->len - centry->ofs >= len) + return; centry->len *= 2; p = realloc(centry->data, centry->len); if (!p) { @@ -466,7 +523,8 @@ static void centry_put_string(struct cache_entry *centry, const char *s) len = strlen(s); /* can't handle more than 254 char strings. Truncating is probably best */ - if (len > 254) len = 254; + if (len > 254) + len = 254; centry_put_uint8(centry, len); centry_expand(centry, len); memcpy(centry->data + centry->ofs, s, len); @@ -486,7 +544,8 @@ struct cache_entry *centry_start(struct winbindd_domain *domain, NTSTATUS status { struct cache_entry *centry; - if (!wcache->tdb) return NULL; + if (!wcache->tdb) + return NULL; centry = smb_xmalloc(sizeof(*centry)); @@ -532,11 +591,13 @@ static void wcache_save_name_to_sid(struct winbindd_domain *domain, fstring sid_string; centry = centry_start(domain, status); - if (!centry) return; + if (!centry) + return; centry_put_sid(centry, sid); fstrcpy(uname, name); - strupper(uname); + strupper_m(uname); centry_end(centry, "NS/%s", sid_to_string(sid_string, sid)); + DEBUG(10,("wcache_save_name_to_sid: %s -> %s\n", uname, sid_string)); centry_free(centry); } @@ -547,12 +608,14 @@ static void wcache_save_sid_to_name(struct winbindd_domain *domain, NTSTATUS sta fstring sid_string; centry = centry_start(domain, status); - if (!centry) return; + if (!centry) + return; if (NT_STATUS_IS_OK(status)) { centry_put_uint32(centry, type); centry_put_string(centry, name); } centry_end(centry, "SN/%s", sid_to_string(sid_string, sid)); + DEBUG(10,("wcache_save_sid_to_name: %s -> %s\n", sid_string, name)); centry_free(centry); } @@ -563,12 +626,14 @@ static void wcache_save_user(struct winbindd_domain *domain, NTSTATUS status, WI fstring sid_string; centry = centry_start(domain, status); - if (!centry) return; + if (!centry) + return; centry_put_string(centry, info->acct_name); centry_put_string(centry, info->full_name); centry_put_sid(centry, info->user_sid); centry_put_sid(centry, info->group_sid); centry_end(centry, "U/%s", sid_to_string(sid_string, info->user_sid)); + DEBUG(10,("wcache_save_user: %s (acct_name %s)\n", sid_string, info->acct_name)); centry_free(centry); } @@ -582,19 +647,23 @@ static NTSTATUS query_user_list(struct winbindd_domain *domain, struct winbind_cache *cache = get_cache(domain); struct cache_entry *centry = NULL; NTSTATUS status; - unsigned int i; + unsigned int i, retry; - if (!cache->tdb) goto do_query; + if (!cache->tdb) + goto do_query; centry = wcache_fetch(cache, domain, "UL/%s", domain->name); - if (!centry) goto do_query; + if (!centry) + goto do_query; *num_entries = centry_uint32(centry); - if (*num_entries == 0) goto do_cached; + if (*num_entries == 0) + goto do_cached; (*info) = talloc(mem_ctx, sizeof(**info) * (*num_entries)); - if (! (*info)) smb_panic("query_user_list out of memory"); + if (! (*info)) + smb_panic("query_user_list out of memory"); for (i=0; i<(*num_entries); i++) { (*info)[i].acct_name = centry_string(centry, mem_ctx); (*info)[i].full_name = centry_string(centry, mem_ctx); @@ -604,6 +673,10 @@ static NTSTATUS query_user_list(struct winbindd_domain *domain, do_cached: status = centry->status; + + DEBUG(10,("query_user_list: [Cached] - cached list for domain %s status %s\n", + domain->name, get_friendly_nt_error_msg(status) )); + centry_free(centry); return status; @@ -611,23 +684,48 @@ do_query: *num_entries = 0; *info = NULL; - if (wcache_server_down(domain)) { - return NT_STATUS_SERVER_DISABLED; - } + /* Return status value returned by seq number check */ + + if (!NT_STATUS_IS_OK(domain->last_status)) + return domain->last_status; - status = cache->backend->query_user_list(domain, mem_ctx, num_entries, info); + /* Put the query_user_list() in a retry loop. There appears to be + * some bug either with Windows 2000 or Samba's handling of large + * rpc replies. This manifests itself as sudden disconnection + * at a random point in the enumeration of a large (60k) user list. + * The retry loop simply tries the operation again. )-: It's not + * pretty but an acceptable workaround until we work out what the + * real problem is. */ + + retry = 0; + do { + + DEBUG(10,("query_user_list: [Cached] - doing backend query for list for domain %s\n", + domain->name )); + + status = domain->backend->query_user_list(domain, mem_ctx, num_entries, info); + if (!NT_STATUS_IS_OK(status)) + DEBUG(3, ("query_user_list: returned 0x%08x, retrying\n", NT_STATUS_V(status))); + if (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL)) { + DEBUG(3, ("query_user_list: flushing connection cache\n")); + winbindd_cm_flush(); + } + + } while (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) && + (retry++ < 5)); /* and save it */ refresh_sequence_number(domain, False); centry = centry_start(domain, status); - if (!centry) goto skip_save; + if (!centry) + goto skip_save; centry_put_uint32(centry, *num_entries); for (i=0; i<(*num_entries); i++) { centry_put_string(centry, (*info)[i].acct_name); centry_put_string(centry, (*info)[i].full_name); centry_put_sid(centry, (*info)[i].user_sid); centry_put_sid(centry, (*info)[i].group_sid); - if (cache->backend->consistent) { + if (domain->backend->consistent) { /* when the backend is consistent we can pre-prime some mappings */ wcache_save_name_to_sid(domain, NT_STATUS_OK, (*info)[i].acct_name, @@ -658,17 +756,21 @@ static NTSTATUS enum_dom_groups(struct winbindd_domain *domain, NTSTATUS status; unsigned int i; - if (!cache->tdb) goto do_query; + if (!cache->tdb) + goto do_query; centry = wcache_fetch(cache, domain, "GL/%s/domain", domain->name); - if (!centry) goto do_query; + if (!centry) + goto do_query; *num_entries = centry_uint32(centry); - if (*num_entries == 0) goto do_cached; + if (*num_entries == 0) + goto do_cached; (*info) = talloc(mem_ctx, sizeof(**info) * (*num_entries)); - if (! (*info)) smb_panic("enum_dom_groups out of memory"); + if (! (*info)) + smb_panic("enum_dom_groups out of memory"); for (i=0; i<(*num_entries); i++) { fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx)); fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx)); @@ -677,6 +779,10 @@ static NTSTATUS enum_dom_groups(struct winbindd_domain *domain, do_cached: status = centry->status; + + DEBUG(10,("enum_dom_groups: [Cached] - cached list for domain %s status %s\n", + domain->name, get_friendly_nt_error_msg(status) )); + centry_free(centry); return status; @@ -684,16 +790,21 @@ do_query: *num_entries = 0; *info = NULL; - if (wcache_server_down(domain)) { - return NT_STATUS_SERVER_DISABLED; - } + /* Return status value returned by seq number check */ - status = cache->backend->enum_dom_groups(domain, mem_ctx, num_entries, info); + if (!NT_STATUS_IS_OK(domain->last_status)) + return domain->last_status; + + DEBUG(10,("enum_dom_groups: [Cached] - doing backend query for list for domain %s\n", + domain->name )); + + status = domain->backend->enum_dom_groups(domain, mem_ctx, num_entries, info); /* and save it */ refresh_sequence_number(domain, False); centry = centry_start(domain, status); - if (!centry) goto skip_save; + if (!centry) + goto skip_save; centry_put_uint32(centry, *num_entries); for (i=0; i<(*num_entries); i++) { centry_put_string(centry, (*info)[i].acct_name); @@ -718,17 +829,21 @@ static NTSTATUS enum_local_groups(struct winbindd_domain *domain, NTSTATUS status; unsigned int i; - if (!cache->tdb) goto do_query; + if (!cache->tdb) + goto do_query; centry = wcache_fetch(cache, domain, "GL/%s/local", domain->name); - if (!centry) goto do_query; + if (!centry) + goto do_query; *num_entries = centry_uint32(centry); - if (*num_entries == 0) goto do_cached; + if (*num_entries == 0) + goto do_cached; (*info) = talloc(mem_ctx, sizeof(**info) * (*num_entries)); - if (! (*info)) smb_panic("enum_dom_groups out of memory"); + if (! (*info)) + smb_panic("enum_dom_groups out of memory"); for (i=0; i<(*num_entries); i++) { fstrcpy((*info)[i].acct_name, centry_string(centry, mem_ctx)); fstrcpy((*info)[i].acct_desc, centry_string(centry, mem_ctx)); @@ -743,11 +858,14 @@ do_cached: indicate this. */ if (wcache_server_down(domain)) { - DEBUG(10, ("query_user_list: returning cached user list and server was down\n")); + DEBUG(10, ("enum_local_groups: returning cached user list and server was down\n")); status = NT_STATUS_MORE_PROCESSING_REQUIRED; } else status = centry->status; + DEBUG(10,("enum_local_groups: [Cached] - cached list for domain %s status %s\n", + domain->name, get_friendly_nt_error_msg(status) )); + centry_free(centry); return status; @@ -755,16 +873,21 @@ do_query: *num_entries = 0; *info = NULL; - if (wcache_server_down(domain)) { - return NT_STATUS_SERVER_DISABLED; - } + /* Return status value returned by seq number check */ + + if (!NT_STATUS_IS_OK(domain->last_status)) + return domain->last_status; - status = cache->backend->enum_local_groups(domain, mem_ctx, num_entries, info); + DEBUG(10,("enum_local_groups: [Cached] - doing backend query for list for domain %s\n", + domain->name )); + + status = domain->backend->enum_local_groups(domain, mem_ctx, num_entries, info); /* and save it */ refresh_sequence_number(domain, False); centry = centry_start(domain, status); - if (!centry) goto skip_save; + if (!centry) + goto skip_save; centry_put_uint32(centry, *num_entries); for (i=0; i<(*num_entries); i++) { centry_put_string(centry, (*info)[i].acct_name); @@ -791,12 +914,14 @@ static NTSTATUS name_to_sid(struct winbindd_domain *domain, fstring uname; DOM_SID *sid2; - if (!cache->tdb) goto do_query; + if (!cache->tdb) + goto do_query; fstrcpy(uname, name); - strupper(uname); + strupper_m(uname); centry = wcache_fetch(cache, domain, "NS/%s/%s", domain->name, uname); - if (!centry) goto do_query; + if (!centry) + goto do_query; *type = centry_uint32(centry); sid2 = centry_sid(centry, mem_ctx); if (!sid2) { @@ -806,16 +931,31 @@ static NTSTATUS name_to_sid(struct winbindd_domain *domain, } status = centry->status; + + DEBUG(10,("name_to_sid: [Cached] - cached name for domain %s status %s\n", + domain->name, get_friendly_nt_error_msg(status) )); + centry_free(centry); return status; do_query: ZERO_STRUCTP(sid); - if (wcache_server_down(domain)) { - return NT_STATUS_SERVER_DISABLED; - } - status = cache->backend->name_to_sid(domain, mem_ctx, name, sid, type); + /* If the seq number check indicated that there is a problem + * with this DC, then return that status... except for + * access_denied. This is special because the dc may be in + * "restrict anonymous = 1" mode, in which case it will deny + * most unauthenticated operations, but *will* allow the LSA + * name-to-sid that we try as a fallback. */ + + if (!(NT_STATUS_IS_OK(domain->last_status) + || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED))) + return domain->last_status; + + DEBUG(10,("name_to_sid: [Cached] - doing backend query for name for domain %s\n", + domain->name )); + + status = domain->backend->name_to_sid(domain, mem_ctx, name, sid, type); /* and save it */ wcache_save_name_to_sid(domain, status, name, sid, *type); @@ -839,25 +979,42 @@ static NTSTATUS sid_to_name(struct winbindd_domain *domain, NTSTATUS status; fstring sid_string; - if (!cache->tdb) goto do_query; + if (!cache->tdb) + goto do_query; centry = wcache_fetch(cache, domain, "SN/%s", sid_to_string(sid_string, sid)); - if (!centry) goto do_query; + if (!centry) + goto do_query; if (NT_STATUS_IS_OK(centry->status)) { *type = centry_uint32(centry); *name = centry_string(centry, mem_ctx); } status = centry->status; + + DEBUG(10,("sid_to_name: [Cached] - cached name for domain %s status %s\n", + domain->name, get_friendly_nt_error_msg(status) )); + centry_free(centry); return status; do_query: *name = NULL; - if (wcache_server_down(domain)) { - return NT_STATUS_SERVER_DISABLED; - } - status = cache->backend->sid_to_name(domain, mem_ctx, sid, name, type); + /* If the seq number check indicated that there is a problem + * with this DC, then return that status... except for + * access_denied. This is special because the dc may be in + * "restrict anonymous = 1" mode, in which case it will deny + * most unauthenticated operations, but *will* allow the LSA + * sid-to-name that we try as a fallback. */ + + if (!(NT_STATUS_IS_OK(domain->last_status) + || NT_STATUS_EQUAL(domain->last_status, NT_STATUS_ACCESS_DENIED))) + return domain->last_status; + + DEBUG(10,("sid_to_name: [Cached] - doing backend query for name for domain %s\n", + domain->name )); + + status = domain->backend->sid_to_name(domain, mem_ctx, sid, name, type); /* and save it */ refresh_sequence_number(domain, False); @@ -877,29 +1034,51 @@ static NTSTATUS query_user(struct winbindd_domain *domain, struct winbind_cache *cache = get_cache(domain); struct cache_entry *centry = NULL; NTSTATUS status; - fstring sid_string; - if (!cache->tdb) goto do_query; + if (!cache->tdb) + goto do_query; - centry = wcache_fetch(cache, domain, "U/%s", sid_to_string(sid_string, user_sid)); - if (!centry) goto do_query; + centry = wcache_fetch(cache, domain, "U/%s", sid_string_static(user_sid)); + + /* If we have an access denied cache entry and a cached info3 in the + samlogon cache then do a query. This will force the rpc back end + to return the info3 data. */ + + if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) && + netsamlogon_cache_have(user_sid)) { + DEBUG(10, ("query_user: cached access denied and have cached info3\n")); + domain->last_status = NT_STATUS_OK; + centry_free(centry); + goto do_query; + } + + if (!centry) + goto do_query; info->acct_name = centry_string(centry, mem_ctx); info->full_name = centry_string(centry, mem_ctx); info->user_sid = centry_sid(centry, mem_ctx); info->group_sid = centry_sid(centry, mem_ctx); status = centry->status; + + DEBUG(10,("query_user: [Cached] - cached info for domain %s status %s\n", + domain->name, get_friendly_nt_error_msg(status) )); + centry_free(centry); return status; do_query: ZERO_STRUCTP(info); - if (wcache_server_down(domain)) { - return NT_STATUS_SERVER_DISABLED; - } + /* Return status value returned by seq number check */ + + if (!NT_STATUS_IS_OK(domain->last_status)) + return domain->last_status; - status = cache->backend->query_user(domain, mem_ctx, user_sid, info); + DEBUG(10,("sid_to_name: [Cached] - doing backend query for info for domain %s\n", + domain->name )); + + status = domain->backend->query_user(domain, mem_ctx, user_sid, info); /* and save it */ refresh_sequence_number(domain, False); @@ -921,23 +1100,44 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain, unsigned int i; fstring sid_string; - if (!cache->tdb) goto do_query; + if (!cache->tdb) + goto do_query; centry = wcache_fetch(cache, domain, "UG/%s", sid_to_string(sid_string, user_sid)); - if (!centry) goto do_query; + + /* If we have an access denied cache entry and a cached info3 in the + samlogon cache then do a query. This will force the rpc back end + to return the info3 data. */ + + if (NT_STATUS_V(domain->last_status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) && + netsamlogon_cache_have(user_sid)) { + DEBUG(10, ("query_user: cached access denied and have cached info3\n")); + domain->last_status = NT_STATUS_OK; + centry_free(centry); + goto do_query; + } + + if (!centry) + goto do_query; *num_groups = centry_uint32(centry); - if (*num_groups == 0) goto do_cached; + if (*num_groups == 0) + goto do_cached; (*user_gids) = talloc(mem_ctx, sizeof(**user_gids) * (*num_groups)); - if (! (*user_gids)) smb_panic("lookup_usergroups out of memory"); + if (! (*user_gids)) + smb_panic("lookup_usergroups out of memory"); for (i=0; i<(*num_groups); i++) { (*user_gids)[i] = centry_sid(centry, mem_ctx); } do_cached: status = centry->status; + + DEBUG(10,("lookup_usergroups: [Cached] - cached info for domain %s status %s\n", + domain->name, get_friendly_nt_error_msg(status) )); + centry_free(centry); return status; @@ -945,15 +1145,21 @@ do_query: (*num_groups) = 0; (*user_gids) = NULL; - if (wcache_server_down(domain)) { - return NT_STATUS_SERVER_DISABLED; - } - status = cache->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids); + /* Return status value returned by seq number check */ + + if (!NT_STATUS_IS_OK(domain->last_status)) + return domain->last_status; + + DEBUG(10,("lookup_usergroups: [Cached] - doing backend query for info for domain %s\n", + domain->name )); + + status = domain->backend->lookup_usergroups(domain, mem_ctx, user_sid, num_groups, user_gids); /* and save it */ refresh_sequence_number(domain, False); centry = centry_start(domain, status); - if (!centry) goto skip_save; + if (!centry) + goto skip_save; centry_put_uint32(centry, *num_groups); for (i=0; i<(*num_groups); i++) { centry_put_sid(centry, (*user_gids)[i]); @@ -978,14 +1184,17 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain, unsigned int i; fstring sid_string; - if (!cache->tdb) goto do_query; + if (!cache->tdb) + goto do_query; centry = wcache_fetch(cache, domain, "GM/%s", sid_to_string(sid_string, group_sid)); - if (!centry) goto do_query; + if (!centry) + goto do_query; *num_names = centry_uint32(centry); - if (*num_names == 0) goto do_cached; + if (*num_names == 0) + goto do_cached; (*sid_mem) = talloc(mem_ctx, sizeof(**sid_mem) * (*num_names)); (*names) = talloc(mem_ctx, sizeof(**names) * (*num_names)); @@ -1003,6 +1212,10 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain, do_cached: status = centry->status; + + DEBUG(10,("lookup_groupmem: [Cached] - cached info for domain %s status %s\n", + domain->name, get_friendly_nt_error_msg(status) )); + centry_free(centry); return status; @@ -1012,17 +1225,22 @@ do_query: (*names) = NULL; (*name_types) = NULL; + /* Return status value returned by seq number check */ - if (wcache_server_down(domain)) { - return NT_STATUS_SERVER_DISABLED; - } - status = cache->backend->lookup_groupmem(domain, mem_ctx, group_sid, num_names, - sid_mem, names, name_types); + if (!NT_STATUS_IS_OK(domain->last_status)) + return domain->last_status; + + DEBUG(10,("lookup_groupmem: [Cached] - doing backend query for info for domain %s\n", + domain->name )); + + status = domain->backend->lookup_groupmem(domain, mem_ctx, group_sid, num_names, + sid_mem, names, name_types); /* and save it */ refresh_sequence_number(domain, False); centry = centry_start(domain, status); - if (!centry) goto skip_save; + if (!centry) + goto skip_save; centry_put_uint32(centry, *num_names); for (i=0; i<(*num_names); i++) { centry_put_sid(centry, (*sid_mem)[i]); @@ -1054,29 +1272,78 @@ static NTSTATUS trusted_domains(struct winbindd_domain *domain, char ***alt_names, DOM_SID **dom_sids) { - struct winbind_cache *cache = get_cache(domain); + get_cache(domain); + + DEBUG(10,("trusted_domains: [Cached] - doing backend query for info for domain %s\n", + domain->name )); /* we don't cache this call */ - return cache->backend->trusted_domains(domain, mem_ctx, num_domains, + return domain->backend->trusted_domains(domain, mem_ctx, num_domains, names, alt_names, dom_sids); } /* find the domain sid */ static NTSTATUS domain_sid(struct winbindd_domain *domain, DOM_SID *sid) { - struct winbind_cache *cache = get_cache(domain); + get_cache(domain); + + DEBUG(10,("domain_sid: [Cached] - doing backend query for info for domain %s\n", + domain->name )); /* we don't cache this call */ - return cache->backend->domain_sid(domain, sid); + return domain->backend->domain_sid(domain, sid); } /* find the alternate names for the domain, if any */ static NTSTATUS alternate_name(struct winbindd_domain *domain) { - struct winbind_cache *cache = get_cache(domain); + get_cache(domain); + + DEBUG(10,("alternate_name: [Cached] - doing backend query for info for domain %s\n", + domain->name )); /* we don't cache this call */ - return cache->backend->alternate_name(domain); + return domain->backend->alternate_name(domain); +} + +/* Invalidate cached user and group lists coherently */ + +static int traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, + void *state) +{ + if (strncmp(kbuf.dptr, "UL/", 3) == 0 || + strncmp(kbuf.dptr, "GL/", 3) == 0) + tdb_delete(the_tdb, kbuf); + + return 0; +} + +/* Invalidate the getpwnam and getgroups entries for a winbindd domain */ + +void wcache_invalidate_samlogon(struct winbindd_domain *domain, + NET_USER_INFO_3 *info3) +{ + struct winbind_cache *cache; + + if (!domain) + return; + + cache = get_cache(domain); + netsamlogon_clear_cached_user(cache->tdb, info3); +} + +void wcache_invalidate_cache(void) +{ + struct winbindd_domain *domain; + + for (domain = domain_list(); domain; domain = domain->next) { + struct winbind_cache *cache = get_cache(domain); + + DEBUG(10, ("wcache_invalidate_cache: invalidating cache " + "entries for %s\n", domain->name)); + if (cache) + tdb_traverse(cache->tdb, traverse_fn, NULL); + } } /* the ADS backend methods are exposed via this structure */ diff --git a/source3/nsswitch/winbindd_cm.c b/source3/nsswitch/winbindd_cm.c index 02fd15e069..7f35167778 100644 --- a/source3/nsswitch/winbindd_cm.c +++ b/source3/nsswitch/winbindd_cm.c @@ -51,9 +51,6 @@ - I'm pretty annoyed by all the make_nmb_name() stuff. It should be moved down into another function. - - There needs to be a utility function in libsmb/namequery.c that does - cm_get_dc_name() - - Take care when destroying cli_structs as they can be shared between various sam handles. @@ -79,139 +76,6 @@ struct winbindd_cm_conn { static struct winbindd_cm_conn *cm_conns = NULL; -/* Get a domain controller name. Cache positive and negative lookups so we - don't go to the network too often when something is badly broken. */ - -#define GET_DC_NAME_CACHE_TIMEOUT 30 /* Seconds between dc lookups */ - -struct get_dc_name_cache { - fstring domain_name; - fstring srv_name; - time_t lookup_time; - struct get_dc_name_cache *prev, *next; -}; - -/* - find the DC for a domain using methods appropriate for a ADS domain -*/ -static BOOL cm_ads_find_dc(const char *domain, struct in_addr *dc_ip, fstring srv_name) -{ - ADS_STRUCT *ads; - const char *realm = domain; - - if (strcasecmp(realm, lp_workgroup()) == 0) - realm = lp_realm(); - - ads = ads_init(realm, domain, NULL); - if (!ads) - return False; - - /* we don't need to bind, just connect */ - ads->auth.flags |= ADS_AUTH_NO_BIND; - - DEBUG(4,("cm_ads_find_dc: domain=%s\n", domain)); - -#ifdef HAVE_ADS - /* a full ads_connect() is actually overkill, as we don't srictly need - to do the SASL auth in order to get the info we need, but libads - doesn't offer a better way right now */ - ads_connect(ads); -#endif - - if (!ads->config.realm) - return False; - - fstrcpy(srv_name, ads->config.ldap_server_name); - strupper(srv_name); - *dc_ip = ads->ldap_ip; - ads_destroy(&ads); - - DEBUG(4,("cm_ads_find_dc: using server='%s' IP=%s\n", - srv_name, inet_ntoa(*dc_ip))); - - return True; -} - - - -static BOOL cm_get_dc_name(const char *domain, fstring srv_name, struct in_addr *ip_out) -{ - static struct get_dc_name_cache *get_dc_name_cache; - struct get_dc_name_cache *dcc; - struct in_addr dc_ip; - BOOL ret; - - /* Check the cache for previous lookups */ - - for (dcc = get_dc_name_cache; dcc; dcc = dcc->next) { - - if (!strequal(domain, dcc->domain_name)) - continue; /* Not our domain */ - - if ((time(NULL) - dcc->lookup_time) > - GET_DC_NAME_CACHE_TIMEOUT) { - - /* Cache entry has expired, delete it */ - - DEBUG(10, ("get_dc_name_cache entry expired for %s\n", domain)); - - DLIST_REMOVE(get_dc_name_cache, dcc); - SAFE_FREE(dcc); - - break; - } - - /* Return a positive or negative lookup for this domain */ - - if (dcc->srv_name[0]) { - DEBUG(10, ("returning positive get_dc_name_cache entry for %s\n", domain)); - fstrcpy(srv_name, dcc->srv_name); - return True; - } else { - DEBUG(10, ("returning negative get_dc_name_cache entry for %s\n", domain)); - return False; - } - } - - /* Add cache entry for this lookup. */ - - DEBUG(10, ("Creating get_dc_name_cache entry for %s\n", domain)); - - if (!(dcc = (struct get_dc_name_cache *) - malloc(sizeof(struct get_dc_name_cache)))) - return False; - - ZERO_STRUCTP(dcc); - - fstrcpy(dcc->domain_name, domain); - dcc->lookup_time = time(NULL); - - DLIST_ADD(get_dc_name_cache, dcc); - - zero_ip(&dc_ip); - - ret = False; - if (lp_security() == SEC_ADS) - ret = cm_ads_find_dc(domain, &dc_ip, srv_name); - - if (!ret) { - /* fall back on rpc methods if the ADS methods fail */ - ret = rpc_find_dc(domain, srv_name, &dc_ip); - } - - if (!ret) - return False; - - /* We have a name so make the cache entry positive now */ - fstrcpy(dcc->srv_name, srv_name); - - DEBUG(3, ("cm_get_dc_name: Returning DC %s (%s) for domain %s\n", srv_name, - inet_ntoa(dc_ip), domain)); - - *ip_out = dc_ip; - - return True; -} /* Choose between anonymous or authenticated connections. We need to use an authenticated connection if DCs have the RestrictAnonymous registry @@ -246,65 +110,11 @@ static void cm_get_ipc_userpass(char **username, char **domain, char **password) } } -/* Open a new smb pipe connection to a DC on a given domain. Cache - negative creation attempts so we don't try and connect to broken - machines too often. */ - -#define FAILED_CONNECTION_CACHE_TIMEOUT 30 /* Seconds between attempts */ - -struct failed_connection_cache { - fstring domain_name; - fstring controller; - time_t lookup_time; - NTSTATUS nt_status; - struct failed_connection_cache *prev, *next; -}; - -static struct failed_connection_cache *failed_connection_cache; - -/* Add an entry to the failed conneciton cache */ - -static void add_failed_connection_entry(struct winbindd_cm_conn *new_conn, - NTSTATUS result) -{ - struct failed_connection_cache *fcc; - - SMB_ASSERT(!NT_STATUS_IS_OK(result)); - - /* Check we already aren't in the cache */ - - for (fcc = failed_connection_cache; fcc; fcc = fcc->next) { - if (strequal(fcc->domain_name, new_conn->domain)) { - DEBUG(10, ("domain %s already tried and failed\n", - fcc->domain_name)); - return; - } - } - - /* Create negative lookup cache entry for this domain and controller */ - - if (!(fcc = (struct failed_connection_cache *) - malloc(sizeof(struct failed_connection_cache)))) { - DEBUG(0, ("malloc failed in add_failed_connection_entry!\n")); - return; - } - - ZERO_STRUCTP(fcc); - - fstrcpy(fcc->domain_name, new_conn->domain); - fstrcpy(fcc->controller, new_conn->controller); - fcc->lookup_time = time(NULL); - fcc->nt_status = result; - - DLIST_ADD(failed_connection_cache, fcc); -} - /* Open a connction to the remote server, cache failures for 30 seconds */ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index, struct winbindd_cm_conn *new_conn) { - struct failed_connection_cache *fcc; NTSTATUS result; char *ipc_username, *ipc_domain, *ipc_password; struct in_addr dc_ip; @@ -316,47 +126,15 @@ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index, fstrcpy(new_conn->domain, domain); fstrcpy(new_conn->pipe_name, get_pipe_name_from_index(pipe_index)); - /* Look for a domain controller for this domain. Negative results - are cached so don't bother applying the caching for this - function just yet. */ + /* connection failure cache has been moved inside of get_dc_name + so we can deal with half dead DC's --jerry */ - if (!cm_get_dc_name(domain, new_conn->controller, &dc_ip)) { + if (!get_dc_name(domain, new_conn->controller, &dc_ip)) { result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND; - add_failed_connection_entry(new_conn, result); + add_failed_connection_entry(domain, "", result); return result; } - /* Return false if we have tried to look up this domain and netbios - name before and failed. */ - - for (fcc = failed_connection_cache; fcc; fcc = fcc->next) { - - if (!(strequal(domain, fcc->domain_name) && - strequal(new_conn->controller, fcc->controller))) - continue; /* Not our domain */ - - if ((time(NULL) - fcc->lookup_time) > - FAILED_CONNECTION_CACHE_TIMEOUT) { - - /* Cache entry has expired, delete it */ - - DEBUG(10, ("cm_open_connection cache entry expired for %s, %s\n", domain, new_conn->controller)); - - DLIST_REMOVE(failed_connection_cache, fcc); - free(fcc); - - break; - } - - /* The timeout hasn't expired yet so return false */ - - DEBUG(10, ("returning negative open_connection_cache entry for %s, %s\n", domain, new_conn->controller)); - - result = fcc->nt_status; - SMB_ASSERT(!NT_STATUS_IS_OK(result)); - return result; - } - /* Initialise SMB connection */ cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password); @@ -387,7 +165,7 @@ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index, SAFE_FREE(ipc_password); if (!NT_STATUS_IS_OK(result)) { - add_failed_connection_entry(new_conn, result); + add_failed_connection_entry(domain, new_conn->controller, result); return result; } @@ -402,7 +180,7 @@ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index, * specific UUID right now, i'm not going to bother. --jerry */ if ( !is_win2k_pipe(pipe_index) ) - add_failed_connection_entry(new_conn, result); + add_failed_connection_entry(domain, new_conn->controller, result); cli_shutdown(new_conn->cli); return result; } @@ -415,21 +193,19 @@ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index, static BOOL connection_ok(struct winbindd_cm_conn *conn) { if (!conn) { - smb_panic("Invalid paramater passed to conneciton_ok(): conn was NULL!\n"); + smb_panic("Invalid parameter passed to connection_ok(): conn was NULL!\n"); return False; } if (!conn->cli) { - DEBUG(0, ("Connection to %s for domain %s (pipe %s) has NULL conn->cli!\n", + DEBUG(3, ("Connection to %s for domain %s (pipe %s) has NULL conn->cli!\n", conn->controller, conn->domain, conn->pipe_name)); - smb_panic("connection_ok: conn->cli was null!"); return False; } if (!conn->cli->initialised) { - DEBUG(0, ("Connection to %s for domain %s (pipe %s) was never initialised!\n", + DEBUG(3, ("Connection to %s for domain %s (pipe %s) was never initialised!\n", conn->controller, conn->domain, conn->pipe_name)); - smb_panic("connection_ok: conn->cli->initialised is False!"); return False; } @@ -442,52 +218,73 @@ static BOOL connection_ok(struct winbindd_cm_conn *conn) return True; } -/* Get a connection to the remote DC and open the pipe. If there is already a connection, use that */ +/* Search the cache for a connection. If there is a broken one, + shut it down properly and return NULL. */ -static NTSTATUS get_connection_from_cache(const char *domain, const char *pipe_name, - struct winbindd_cm_conn **conn_out) +static void find_cm_connection(const char *domain, const char *pipe_name, + struct winbindd_cm_conn **conn_out) { - struct winbindd_cm_conn *conn, conn_temp; - NTSTATUS result; - - *conn_out = NULL; + struct winbindd_cm_conn *conn; - for (conn = cm_conns; conn; conn = conn->next) { + for (conn = cm_conns; conn; ) { if (strequal(conn->domain, domain) && strequal(conn->pipe_name, pipe_name)) { if (!connection_ok(conn)) { + /* Dead connection - remove it. */ + struct winbindd_cm_conn *conn_temp = conn->next; if (conn->cli) cli_shutdown(conn->cli); - ZERO_STRUCT(conn_temp); - conn_temp.next = conn->next; DLIST_REMOVE(cm_conns, conn); SAFE_FREE(conn); - conn = &conn_temp; /* Just to keep the loop moving */ + conn = conn_temp; /* Keep the loop moving */ + continue; } else { break; } } + conn = conn->next; } - - if (!conn) { - if (!(conn = malloc(sizeof(*conn)))) - return NT_STATUS_NO_MEMORY; + + *conn_out = conn; +} + +/* Initialize a new connection up to the RPC BIND. */ + +static NTSTATUS new_cm_connection(const char *domain, const char *pipe_name, + struct winbindd_cm_conn **conn_out) +{ + struct winbindd_cm_conn *conn; + NTSTATUS result; + + if (!(conn = malloc(sizeof(*conn)))) + return NT_STATUS_NO_MEMORY; - ZERO_STRUCTP(conn); + ZERO_STRUCTP(conn); - if (!NT_STATUS_IS_OK(result = cm_open_connection(domain, get_pipe_index(pipe_name), conn))) { - DEBUG(3, ("Could not open a connection to %s for %s (%s)\n", - domain, pipe_name, nt_errstr(result))); - SAFE_FREE(conn); - return result; - } - DLIST_ADD(cm_conns, conn); + if (!NT_STATUS_IS_OK(result = cm_open_connection(domain, get_pipe_index(pipe_name), conn))) { + DEBUG(3, ("Could not open a connection to %s for %s (%s)\n", + domain, pipe_name, nt_errstr(result))); + SAFE_FREE(conn); + return result; } - + DLIST_ADD(cm_conns, conn); + *conn_out = conn; return NT_STATUS_OK; } +/* Get a connection to the remote DC and open the pipe. If there is already a connection, use that */ + +static NTSTATUS get_connection_from_cache(const char *domain, const char *pipe_name, + struct winbindd_cm_conn **conn_out) +{ + find_cm_connection(domain, pipe_name, conn_out); + + if (*conn_out != NULL) + return NT_STATUS_OK; + + return new_cm_connection(domain, pipe_name, conn_out); +} /********************************************************************************** **********************************************************************************/ @@ -522,8 +319,14 @@ BOOL cm_check_for_native_mode_win2k( const char *domain ) ret = True; done: + +#if 0 + /* + * I don't think we need to shutdown here ? JRA. + */ if ( conn.cli ) cli_shutdown( conn.cli ); +#endif return ret; } @@ -532,7 +335,7 @@ done: /* Return a LSA policy handle on a domain */ -CLI_POLICY_HND *cm_get_lsa_handle(const char *domain) +NTSTATUS cm_get_lsa_handle(const char *domain, CLI_POLICY_HND **return_hnd) { struct winbindd_cm_conn *conn; uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED; @@ -542,13 +345,16 @@ CLI_POLICY_HND *cm_get_lsa_handle(const char *domain) /* Look for existing connections */ if (!NT_STATUS_IS_OK(result = get_connection_from_cache(domain, PIPE_LSARPC, &conn))) - return NULL; + return result; /* This *shitty* code needs scrapping ! JRA */ + if (policy_handle_is_valid(&conn->pol)) { hnd.pol = conn->pol; hnd.cli = conn->cli; - return &hnd; + *return_hnd = &hnd; + + return NT_STATUS_OK; } result = cli_lsa_open_policy(conn->cli, conn->cli->mem_ctx, False, @@ -558,7 +364,7 @@ CLI_POLICY_HND *cm_get_lsa_handle(const char *domain) /* Hit the cache code again. This cleans out the old connection and gets a new one */ if (conn->cli->fd == -1) { /* Try again, if the remote host disapeared */ if (!NT_STATUS_IS_OK(result = get_connection_from_cache(domain, PIPE_LSARPC, &conn))) - return NULL; + return result; result = cli_lsa_open_policy(conn->cli, conn->cli->mem_ctx, False, des_access, &conn->pol); @@ -568,19 +374,21 @@ CLI_POLICY_HND *cm_get_lsa_handle(const char *domain) cli_shutdown(conn->cli); DLIST_REMOVE(cm_conns, conn); SAFE_FREE(conn); - return NULL; + return result; } } hnd.pol = conn->pol; hnd.cli = conn->cli; - return &hnd; + *return_hnd = &hnd; + + return NT_STATUS_OK; } /* Return a SAM policy handle on a domain */ -CLI_POLICY_HND *cm_get_sam_handle(char *domain) +NTSTATUS cm_get_sam_handle(char *domain, CLI_POLICY_HND **return_hnd) { struct winbindd_cm_conn *conn; uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED; @@ -590,279 +398,62 @@ CLI_POLICY_HND *cm_get_sam_handle(char *domain) /* Look for existing connections */ if (!NT_STATUS_IS_OK(result = get_connection_from_cache(domain, PIPE_SAMR, &conn))) - return NULL; + return result; /* This *shitty* code needs scrapping ! JRA */ + if (policy_handle_is_valid(&conn->pol)) { hnd.pol = conn->pol; hnd.cli = conn->cli; - return &hnd; + + *return_hnd = &hnd; + + return NT_STATUS_OK; } + result = cli_samr_connect(conn->cli, conn->cli->mem_ctx, des_access, &conn->pol); if (!NT_STATUS_IS_OK(result)) { /* Hit the cache code again. This cleans out the old connection and gets a new one */ if (conn->cli->fd == -1) { /* Try again, if the remote host disapeared */ + if (!NT_STATUS_IS_OK(result = get_connection_from_cache(domain, PIPE_SAMR, &conn))) - return NULL; + return result; result = cli_samr_connect(conn->cli, conn->cli->mem_ctx, des_access, &conn->pol); } if (!NT_STATUS_IS_OK(result)) { + cli_shutdown(conn->cli); DLIST_REMOVE(cm_conns, conn); SAFE_FREE(conn); - return NULL; + + return result; } } hnd.pol = conn->pol; hnd.cli = conn->cli; - return &hnd; -} - -#if 0 /* This code now *well* out of date */ + *return_hnd = &hnd; -/* Return a SAM domain policy handle on a domain */ - -CLI_POLICY_HND *cm_get_sam_dom_handle(char *domain, DOM_SID *domain_sid) -{ - struct winbindd_cm_conn *conn, *basic_conn = NULL; - static CLI_POLICY_HND hnd; - NTSTATUS result; - uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED; - - /* Look for existing connections */ - - for (conn = cm_conns; conn; conn = conn->next) { - if (strequal(conn->domain, domain) && - strequal(conn->pipe_name, PIPE_SAMR) && - conn->pipe_data.samr.pipe_type == SAM_PIPE_DOM) { - - if (!connection_ok(conn)) { - /* Shutdown cli? Free conn? Allow retry of DC? */ - DLIST_REMOVE(cm_conns, conn); - return NULL; - } - - goto ok; - } - } - - /* Create a basic handle to open a domain handle from */ - - if (!cm_get_sam_handle(domain)) - return False; - - for (conn = cm_conns; conn; conn = conn->next) { - if (strequal(conn->domain, domain) && - strequal(conn->pipe_name, PIPE_SAMR) && - conn->pipe_data.samr.pipe_type == SAM_PIPE_BASIC) - basic_conn = conn; - } - - if (!(conn = (struct winbindd_cm_conn *) - malloc(sizeof(struct winbindd_cm_conn)))) - return NULL; - - ZERO_STRUCTP(conn); - - fstrcpy(conn->domain, basic_conn->domain); - fstrcpy(conn->controller, basic_conn->controller); - fstrcpy(conn->pipe_name, basic_conn->pipe_name); - - conn->pipe_data.samr.pipe_type = SAM_PIPE_DOM; - conn->cli = basic_conn->cli; - - result = cli_samr_open_domain(conn->cli, conn->cli->mem_ctx, - &basic_conn->pol, des_access, - domain_sid, &conn->pol); - - if (!NT_STATUS_IS_OK(result)) - return NULL; - - /* Add to list */ - - DLIST_ADD(cm_conns, conn); - - ok: - hnd.pol = conn->pol; - hnd.cli = conn->cli; - - return &hnd; -} - -/* Return a SAM policy handle on a domain user */ - -CLI_POLICY_HND *cm_get_sam_user_handle(char *domain, DOM_SID *domain_sid, - uint32 user_rid) -{ - struct winbindd_cm_conn *conn, *basic_conn = NULL; - static CLI_POLICY_HND hnd; - NTSTATUS result; - uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED; - - /* Look for existing connections */ - - for (conn = cm_conns; conn; conn = conn->next) { - if (strequal(conn->domain, domain) && - strequal(conn->pipe_name, PIPE_SAMR) && - conn->pipe_data.samr.pipe_type == SAM_PIPE_USER && - conn->pipe_data.samr.rid == user_rid) { - - if (!connection_ok(conn)) { - /* Shutdown cli? Free conn? Allow retry of DC? */ - DLIST_REMOVE(cm_conns, conn); - return NULL; - } - - goto ok; - } - } - - /* Create a domain handle to open a user handle from */ - - if (!cm_get_sam_dom_handle(domain, domain_sid)) - return NULL; - - for (conn = cm_conns; conn; conn = conn->next) { - if (strequal(conn->domain, domain) && - strequal(conn->pipe_name, PIPE_SAMR) && - conn->pipe_data.samr.pipe_type == SAM_PIPE_DOM) - basic_conn = conn; - } - - if (!basic_conn) { - DEBUG(0, ("No domain sam handle was created!\n")); - return NULL; - } - - if (!(conn = (struct winbindd_cm_conn *) - malloc(sizeof(struct winbindd_cm_conn)))) - return NULL; - - ZERO_STRUCTP(conn); - - fstrcpy(conn->domain, basic_conn->domain); - fstrcpy(conn->controller, basic_conn->controller); - fstrcpy(conn->pipe_name, basic_conn->pipe_name); - - conn->pipe_data.samr.pipe_type = SAM_PIPE_USER; - conn->cli = basic_conn->cli; - conn->pipe_data.samr.rid = user_rid; - - result = cli_samr_open_user(conn->cli, conn->cli->mem_ctx, - &basic_conn->pol, des_access, user_rid, - &conn->pol); - - if (!NT_STATUS_IS_OK(result)) - return NULL; - - /* Add to list */ - - DLIST_ADD(cm_conns, conn); - - ok: - hnd.pol = conn->pol; - hnd.cli = conn->cli; - - return &hnd; -} - -/* Return a SAM policy handle on a domain group */ - -CLI_POLICY_HND *cm_get_sam_group_handle(char *domain, DOM_SID *domain_sid, - uint32 group_rid) -{ - struct winbindd_cm_conn *conn, *basic_conn = NULL; - static CLI_POLICY_HND hnd; - NTSTATUS result; - uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED; - - /* Look for existing connections */ - - for (conn = cm_conns; conn; conn = conn->next) { - if (strequal(conn->domain, domain) && - strequal(conn->pipe_name, PIPE_SAMR) && - conn->pipe_data.samr.pipe_type == SAM_PIPE_GROUP && - conn->pipe_data.samr.rid == group_rid) { - - if (!connection_ok(conn)) { - /* Shutdown cli? Free conn? Allow retry of DC? */ - DLIST_REMOVE(cm_conns, conn); - return NULL; - } - - goto ok; - } - } - - /* Create a domain handle to open a user handle from */ - - if (!cm_get_sam_dom_handle(domain, domain_sid)) - return NULL; - - for (conn = cm_conns; conn; conn = conn->next) { - if (strequal(conn->domain, domain) && - strequal(conn->pipe_name, PIPE_SAMR) && - conn->pipe_data.samr.pipe_type == SAM_PIPE_DOM) - basic_conn = conn; - } - - if (!basic_conn) { - DEBUG(0, ("No domain sam handle was created!\n")); - return NULL; - } - - if (!(conn = (struct winbindd_cm_conn *) - malloc(sizeof(struct winbindd_cm_conn)))) - return NULL; - - ZERO_STRUCTP(conn); - - fstrcpy(conn->domain, basic_conn->domain); - fstrcpy(conn->controller, basic_conn->controller); - fstrcpy(conn->pipe_name, basic_conn->pipe_name); - - conn->pipe_data.samr.pipe_type = SAM_PIPE_GROUP; - conn->cli = basic_conn->cli; - conn->pipe_data.samr.rid = group_rid; - - result = cli_samr_open_group(conn->cli, conn->cli->mem_ctx, - &basic_conn->pol, des_access, group_rid, - &conn->pol); - - if (!NT_STATUS_IS_OK(result)) - return NULL; - - /* Add to list */ - - DLIST_ADD(cm_conns, conn); - - ok: - hnd.pol = conn->pol; - hnd.cli = conn->cli; - - return &hnd; + return NT_STATUS_OK; } -#endif - /* Get a handle on a netlogon pipe. This is a bit of a hack to re-use the netlogon pipe as no handle is returned. */ NTSTATUS cm_get_netlogon_cli(const char *domain, const unsigned char *trust_passwd, uint32 sec_channel_type, + BOOL fresh, struct cli_state **cli) { NTSTATUS result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND; struct winbindd_cm_conn *conn; - uint32 neg_flags = 0x000001ff; fstring lock_name; BOOL got_mutex; @@ -871,7 +462,30 @@ NTSTATUS cm_get_netlogon_cli(const char *domain, /* Open an initial conection - keep the mutex. */ - if (!NT_STATUS_IS_OK(result = get_connection_from_cache(domain, PIPE_NETLOGON, &conn))) + find_cm_connection(domain, PIPE_NETLOGON, &conn); + + if ( fresh && (conn != NULL) ) { + cli_shutdown(conn->cli); + conn->cli = NULL; + + conn = NULL; + + /* purge connection from cache */ + find_cm_connection(domain, PIPE_NETLOGON, &conn); + if (conn != NULL) { + DEBUG(0,("Could not purge connection\n")); + return NT_STATUS_UNSUCCESSFUL; + } + } + + if (conn != NULL) { + *cli = conn->cli; + return NT_STATUS_OK; + } + + result = new_cm_connection(domain, PIPE_NETLOGON, &conn); + + if (!NT_STATUS_IS_OK(result)) return result; snprintf(lock_name, sizeof(lock_name), "NETLOGON\\%s", conn->controller); @@ -879,39 +493,20 @@ NTSTATUS cm_get_netlogon_cli(const char *domain, if (!(got_mutex = secrets_named_mutex(lock_name, WINBIND_SERVER_MUTEX_WAIT_TIME))) { DEBUG(0,("cm_get_netlogon_cli: mutex grab failed for %s\n", conn->controller)); } + + if ( sec_channel_type == SEC_CHAN_DOMAIN ) + snprintf(conn->cli->mach_acct, sizeof(conn->cli->mach_acct) - 1, "%s$", lp_workgroup()); - result = cli_nt_setup_creds(conn->cli, sec_channel_type, trust_passwd, &neg_flags, 2); + result = cli_nt_establish_netlogon(conn->cli, sec_channel_type, trust_passwd); if (got_mutex) secrets_named_mutex_release(lock_name); - + if (!NT_STATUS_IS_OK(result)) { - DEBUG(0, ("error connecting to domain password server: %s\n", - nt_errstr(result))); - - /* Hit the cache code again. This cleans out the old connection and gets a new one */ - if (conn->cli->fd == -1) { - if (!NT_STATUS_IS_OK(result = get_connection_from_cache(domain, PIPE_NETLOGON, &conn))) - return result; - - snprintf(lock_name, sizeof(lock_name), "NETLOGON\\%s", conn->controller); - if (!(got_mutex = secrets_named_mutex(lock_name, WINBIND_SERVER_MUTEX_WAIT_TIME))) { - DEBUG(0,("cm_get_netlogon_cli: mutex grab failed for %s\n", conn->controller)); - } - - /* Try again */ - result = cli_nt_setup_creds( conn->cli, sec_channel_type,trust_passwd, &neg_flags, 2); - - if (got_mutex) - secrets_named_mutex_release(lock_name); - } - - if (!NT_STATUS_IS_OK(result)) { - cli_shutdown(conn->cli); - DLIST_REMOVE(cm_conns, conn); - SAFE_FREE(conn); - return result; - } + cli_shutdown(conn->cli); + DLIST_REMOVE(cm_conns, conn); + SAFE_FREE(conn); + return result; } *cli = conn->cli; @@ -952,3 +547,34 @@ void winbindd_cm_status(void) else DEBUG(0, ("\tNo active connections\n")); } + +/* Close all cached connections */ + +void winbindd_cm_flush(void) +{ + struct winbindd_cm_conn *conn, tmp; + + /* Flush connection cache */ + + for (conn = cm_conns; conn; conn = conn->next) { + + if (!connection_ok(conn)) + continue; + + DEBUG(10, ("Closing connection to %s on %s\n", + conn->pipe_name, conn->controller)); + + if (conn->cli) + cli_shutdown(conn->cli); + + tmp.next = conn->next; + + DLIST_REMOVE(cm_conns, conn); + SAFE_FREE(conn); + conn = &tmp; + } + + /* Flush failed connection cache */ + + flush_negative_conn_cache(); +} diff --git a/source3/nsswitch/winbindd_group.c b/source3/nsswitch/winbindd_group.c index 94b6326b90..d67d48d506 100644 --- a/source3/nsswitch/winbindd_group.c +++ b/source3/nsswitch/winbindd_group.c @@ -5,6 +5,7 @@ Copyright (C) Tim Potter 2000 Copyright (C) Jeremy Allison 2001. + Copyright (C) Gerald (Jerry) Carter 2003. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -26,6 +27,34 @@ #undef DBGC_CLASS #define DBGC_CLASS DBGC_WINBIND +/********************************************************************* +*********************************************************************/ + +static int gr_mem_buffer( char **buffer, char **members, int num_members ) +{ + int i; + int len = 0; + int idx = 0; + + if ( num_members == 0 ) { + *buffer = NULL; + return 0; + } + + for ( i=0; iname)); + if ( !((group_name_type==SID_NAME_DOM_GRP) || + ((group_name_type==SID_NAME_ALIAS) && strequal(lp_workgroup(), domain->name))) ) + { + DEBUG(1, ("SID %s in domain %s isn't a domain group (%d)\n", + sid_to_string(sid_string, group_sid), domain->name, + group_name_type)); goto done; } @@ -189,6 +221,7 @@ done: enum winbindd_result winbindd_getgrnam(struct winbindd_cli_state *state) { DOM_SID group_sid; + WINBINDD_GR *grp; struct winbindd_domain *domain; enum SID_NAME_USE name_type; fstring name_domain, name_group; @@ -207,9 +240,39 @@ enum winbindd_result winbindd_getgrnam(struct winbindd_cli_state *state) memset(name_group, 0, sizeof(fstring)); tmp = state->request.data.groupname; - if (!parse_domain_user(tmp, name_domain, name_group)) + + parse_domain_user(tmp, name_domain, name_group); + + /* if no domain or our local domain, then do a local tdb search */ + + if ( !*name_domain || strequal(name_domain, get_global_sam_name()) ) { + char *buffer = NULL; + + if ( !(grp=wb_getgrnam(name_group)) ) { + DEBUG(5,("winbindd_getgrnam: lookup for %s\\%s failed\n", + name_domain, name_group)); + return WINBINDD_ERROR; + } + memcpy( &state->response.data.gr, grp, sizeof(WINBINDD_GR) ); + + gr_mem_len = gr_mem_buffer( &buffer, grp->gr_mem, grp->num_gr_mem ); + + state->response.data.gr.gr_mem_ofs = 0; + state->response.length += gr_mem_len; + state->response.extra_data = buffer; /* give the memory away */ + + return WINBINDD_OK; + } + + /* should we deal with users for our domain? */ + + if ( lp_winbind_trusted_domains_only() && strequal(name_domain, lp_workgroup())) { + DEBUG(7,("winbindd_getgrnam: My domain -- rejecting getgrnam() for %s\\%s.\n", + name_domain, name_group)); return WINBINDD_ERROR; + } + /* Get info for the domain */ if ((domain = find_domain_from_name(name_domain)) == NULL) { @@ -227,13 +290,15 @@ enum winbindd_result winbindd_getgrnam(struct winbindd_cli_state *state) return WINBINDD_ERROR; } - if ((name_type != SID_NAME_ALIAS) && (name_type != SID_NAME_DOM_GRP)) { + if ( !((name_type==SID_NAME_DOM_GRP) || + ((name_type==SID_NAME_ALIAS) && strequal(lp_workgroup(), domain->name))) ) + { DEBUG(1, ("name '%s' is not a local or domain group: %d\n", name_group, name_type)); return WINBINDD_ERROR; } - if (NT_STATUS_IS_ERR(sid_to_gid(&group_sid, &gid))) { + if (!NT_STATUS_IS_OK(idmap_sid_to_gid(&group_sid, &gid, 0))) { DEBUG(1, ("error converting unix gid to sid\n")); return WINBINDD_ERROR; } @@ -261,6 +326,7 @@ enum winbindd_result winbindd_getgrnam(struct winbindd_cli_state *state) enum winbindd_result winbindd_getgrgid(struct winbindd_cli_state *state) { struct winbindd_domain *domain; + WINBINDD_GR *grp; DOM_SID group_sid; enum SID_NAME_USE name_type; fstring dom_name; @@ -277,8 +343,23 @@ enum winbindd_result winbindd_getgrgid(struct winbindd_cli_state *state) (state->request.data.gid > server_state.gid_high)) return WINBINDD_ERROR; + /* alway try local tdb lookup first */ + if ( ( grp=wb_getgrgid(state->request.data.gid)) != NULL ) { + char *buffer = NULL; + + memcpy( &state->response.data.gr, grp, sizeof(WINBINDD_GR) ); + + gr_mem_len = gr_mem_buffer( &buffer, grp->gr_mem, grp->num_gr_mem ); + + state->response.data.gr.gr_mem_ofs = 0; + state->response.length += gr_mem_len; + state->response.extra_data = buffer; /* give away the memory */ + + return WINBINDD_OK; + } + /* Get rid from gid */ - if (NT_STATUS_IS_ERR(uid_to_sid(&group_sid, state->request.data.gid))) { + if (!NT_STATUS_IS_OK(idmap_gid_to_sid(&group_sid, state->request.data.gid))) { DEBUG(1, ("could not convert gid %d to rid\n", state->request.data.gid)); return WINBINDD_ERROR; @@ -291,13 +372,6 @@ enum winbindd_result winbindd_getgrgid(struct winbindd_cli_state *state) return WINBINDD_ERROR; } - if (!((name_type == SID_NAME_ALIAS) || - (name_type == SID_NAME_DOM_GRP))) { - DEBUG(1, ("name '%s' is not a local or domain group: %d\n", - group_name, name_type)); - return WINBINDD_ERROR; - } - /* Fill in group structure */ domain = find_domain_from_sid(&group_sid); @@ -307,6 +381,14 @@ enum winbindd_result winbindd_getgrgid(struct winbindd_cli_state *state) return WINBINDD_ERROR; } + if ( !((name_type==SID_NAME_DOM_GRP) || + ((name_type==SID_NAME_ALIAS) && strequal(lp_workgroup(), domain->name))) ) + { + DEBUG(1, ("name '%s' is not a local or domain group: %d\n", + group_name, name_type)); + return WINBINDD_ERROR; + } + if (!fill_grent(&state->response.data.gr, dom_name, group_name, state->request.data.gid) || !fill_grent_mem(domain, &group_sid, name_type, @@ -353,6 +435,16 @@ enum winbindd_result winbindd_setgrent(struct winbindd_cli_state *state) for (domain = domain_list(); domain != NULL; domain = domain->next) { struct getent_state *domain_state; + + /* don't add our domaina if we are a PDC or if we + are a member of a Samba domain */ + + if ( (IS_DC || lp_winbind_trusted_domains_only()) + && strequal(domain->name, lp_workgroup()) ) + { + continue; + } + /* Create a state record for this domain */ if ((domain_state = (struct getent_state *) @@ -450,10 +542,10 @@ static BOOL get_sam_group_entries(struct getent_state *ent) ent->num_sam_entries = num_entries; - /* get the domain local groups if we are a member of a native win2k domain */ + /* get the domain local groups if we are a member of a native win2k domain + and are not using LDAP to get the groups */ - if ( domain->native_mode - && domain->methods->enum_local_groups + if ( lp_security() != SEC_ADS && domain->native_mode && strequal(lp_workgroup(), domain->name) ) { DEBUG(4,("get_sam_group_entries: Native Mode 2k domain; enumerating local groups as well\n")); @@ -590,7 +682,7 @@ enum winbindd_result winbindd_getgrent(struct winbindd_cli_state *state) sid_copy(&group_sid, &domain->sid); sid_append_rid(&group_sid, name_list[ent->sam_entry_index].rid); - if (NT_STATUS_IS_ERR(sid_to_gid(&group_sid, &group_gid))) { + if (!NT_STATUS_IS_OK(idmap_sid_to_gid(&group_sid, &group_gid, 0))) { DEBUG(1, ("could not look up gid for group %s\n", name_list[ent->sam_entry_index].acct_name)); @@ -743,7 +835,7 @@ enum winbindd_result winbindd_list_groups(struct winbindd_cli_state *state) ZERO_STRUCT(groups); /* Get list of sam groups */ - ZERO_STRUCT(groups); + fstrcpy(groups.domain_name, domain->name); get_sam_group_entries(&groups); @@ -799,21 +891,26 @@ enum winbindd_result winbindd_list_groups(struct winbindd_cli_state *state) } /* Get user supplementary groups. This is much quicker than trying to - invert the groups database. */ + invert the groups database. We merge the groups from the gids and + other_sids info3 fields as trusted domain, universal group + memberships, and nested groups (win2k native mode only) are not + returned by the getgroups RPC call but are present in the info3. */ enum winbindd_result winbindd_getgroups(struct winbindd_cli_state *state) { fstring name_domain, name_user; - DOM_SID user_sid; + DOM_SID user_sid, group_sid; enum SID_NAME_USE name_type; - uint32 num_groups, num_gids; + uint32 num_groups = 0; + uint32 num_gids = 0; NTSTATUS status; - DOM_SID **user_gids; + DOM_SID **user_grpsids; struct winbindd_domain *domain; enum winbindd_result result = WINBINDD_ERROR; gid_t *gid_list; unsigned int i; TALLOC_CTX *mem_ctx; + NET_USER_INFO_3 *info3 = NULL; /* Ensure null termination */ state->request.data.username[sizeof(state->request.data.username)-1]='\0'; @@ -827,8 +924,12 @@ enum winbindd_result winbindd_getgroups(struct winbindd_cli_state *state) /* Parse domain and username */ - if (!parse_domain_user(state->request.data.username, name_domain, - name_user)) + parse_domain_user(state->request.data.username, + name_domain, name_user); + + /* bail if there is no domain */ + + if ( !*name_domain ) goto done; /* Get info for the domain */ @@ -853,33 +954,109 @@ enum winbindd_result winbindd_getgroups(struct winbindd_cli_state *state) goto done; } - status = domain->methods->lookup_usergroups(domain, mem_ctx, - &user_sid, &num_groups, - &user_gids); - if (!NT_STATUS_IS_OK(status)) goto done; + /* Treat the info3 cache as authoritative as the + lookup_usergroups() function may return cached data. */ - /* Copy data back to client */ + if ((info3 = netsamlogon_cache_get(mem_ctx, &user_sid))) { - num_gids = 0; - gid_list = malloc(sizeof(gid_t) * num_groups); + DEBUG(10, ("winbindd_getgroups: info3 has %d groups, %d other sids\n", + info3->num_groups2, info3->num_other_sids)); - if (state->response.extra_data) - goto done; + num_groups = info3->num_other_sids + info3->num_groups2; + gid_list = calloc(sizeof(gid_t), num_groups); - for (i = 0; i < num_groups; i++) { - gid_t gid; + /* Go through each other sid and convert it to a gid */ + + for (i = 0; i < info3->num_other_sids; i++) { + fstring name; + fstring dom_name; + enum SID_NAME_USE sid_type; + + /* Is this sid known to us? It can either be + a trusted domain sid or a foreign sid. */ + + if (!winbindd_lookup_name_by_sid( &info3->other_sids[i].sid, + dom_name, name, &sid_type)) + { + DEBUG(10, ("winbindd_getgroups: could not lookup name for %s\n", + sid_string_static(&info3->other_sids[i].sid))); + continue; + } + + /* Check it is a domain group or an alias (domain local group) + in a win2k native mode domain. */ + + if ( !((sid_type==SID_NAME_DOM_GRP) || + ((sid_type==SID_NAME_ALIAS) && strequal(lp_workgroup(), domain->name))) ) + { + DEBUG(10, ("winbindd_getgroups: sid type %d " + "for %s is not a domain group\n", + sid_type, + sid_string_static( + &info3->other_sids[i].sid))); + continue; + } + + /* Map to a gid */ + + if (!NT_STATUS_IS_OK(idmap_sid_to_gid(&info3->other_sids[i].sid, &gid_list[num_gids], 0)) ) + { + DEBUG(10, ("winbindd_getgroups: could not map sid %s to gid\n", + sid_string_static(&info3->other_sids[i].sid))); + continue; + } + + /* We've jumped through a lot of hoops to get here */ + + DEBUG(10, ("winbindd_getgroups: mapped other sid %s to " + "gid %d\n", sid_string_static( + &info3->other_sids[i].sid), + gid_list[num_gids])); + + num_gids++; + } + + for (i = 0; i < info3->num_groups2; i++) { - if (NT_STATUS_IS_ERR(sid_to_gid(user_gids[i], &gid))) { - fstring sid_string; + /* create the group SID */ + + sid_copy( &group_sid, &domain->sid ); + sid_append_rid( &group_sid, info3->gids[i].g_rid ); - DEBUG(1, ("unable to convert group sid %s to gid\n", - sid_to_string(sid_string, user_gids[i]))); - continue; + if (!NT_STATUS_IS_OK(idmap_sid_to_gid(&group_sid, &gid_list[num_gids], 0)) ) { + DEBUG(10, ("winbindd_getgroups: could not map sid %s to gid\n", + sid_string_static(&group_sid))); + } + + num_gids++; + } + + SAFE_FREE(info3); + + } else { + status = domain->methods->lookup_usergroups(domain, mem_ctx, + &user_sid, &num_groups, + &user_grpsids); + if (!NT_STATUS_IS_OK(status)) + goto done; + + gid_list = malloc(sizeof(gid_t) * num_groups); + + if (state->response.extra_data) + goto done; + + for (i = 0; i < num_groups; i++) { + if (!NT_STATUS_IS_OK(idmap_sid_to_gid(user_grpsids[i], &gid_list[num_gids], 0))) { + DEBUG(1, ("unable to convert group sid %s to gid\n", + sid_string_static(user_grpsids[i]))); + continue; + } + num_gids++; } - gid_list[num_gids] = gid; - num_gids++; } + /* Send data back to client */ + state->response.data.num_entries = num_gids; state->response.extra_data = gid_list; state->response.length += num_gids * sizeof(gid_t); diff --git a/source3/nsswitch/winbindd_misc.c b/source3/nsswitch/winbindd_misc.c index fb56d0e657..8d7cdc4731 100644 --- a/source3/nsswitch/winbindd_misc.c +++ b/source3/nsswitch/winbindd_misc.c @@ -50,7 +50,7 @@ enum winbindd_result winbindd_check_machine_acct(struct winbindd_cli_state *stat the trust account password. */ /* Don't shut this down - it belongs to the connection cache code */ - result = cm_get_netlogon_cli(lp_workgroup(), trust_passwd, sec_channel_type, &cli); + result = cm_get_netlogon_cli(lp_workgroup(), trust_passwd, sec_channel_type, True, &cli); if (!NT_STATUS_IS_OK(result)) { DEBUG(3, ("could not open handle to NETLOGON pipe\n")); diff --git a/source3/nsswitch/winbindd_nss.h b/source3/nsswitch/winbindd_nss.h index cc1b144063..c4407bbe31 100644 --- a/source3/nsswitch/winbindd_nss.h +++ b/source3/nsswitch/winbindd_nss.h @@ -36,7 +36,7 @@ /* Update this when you change the interface. */ -#define WINBIND_INTERFACE_VERSION 7 +#define WINBIND_INTERFACE_VERSION 8 /* Socket commands */ @@ -99,6 +99,16 @@ enum winbindd_cmd { WINBINDD_WINS_BYIP, WINBINDD_WINS_BYNAME, + /* account management commands */ + + WINBINDD_CREATE_USER, + WINBINDD_CREATE_GROUP, + WINBINDD_ADD_USER_TO_GROUP, + WINBINDD_REMOVE_USER_FROM_GROUP, + WINBINDD_SET_USER_PRIMARY_GROUP, + WINBINDD_DELETE_USER, + WINBINDD_DELETE_GROUP, + /* this is like GETGRENT but gives an empty group list */ WINBINDD_GETGRLST, @@ -111,11 +121,34 @@ enum winbindd_cmd { WINBINDD_NUM_CMDS }; -#define WINBIND_PAM_INFO3_NDR 0x0001 -#define WINBIND_PAM_INFO3_TEXT 0x0002 -#define WINBIND_PAM_NTKEY 0x0004 -#define WINBIND_PAM_LMKEY 0x0008 -#define WINBIND_PAM_CONTACT_TRUSTDOM 0x0010 +typedef struct winbindd_pw { + fstring pw_name; + fstring pw_passwd; + uid_t pw_uid; + gid_t pw_gid; + fstring pw_gecos; + fstring pw_dir; + fstring pw_shell; +} WINBINDD_PW; + + +typedef struct winbindd_gr { + fstring gr_name; + fstring gr_passwd; + gid_t gr_gid; + int num_gr_mem; + int gr_mem_ofs; /* offset to group membership */ + char **gr_mem; +} WINBINDD_GR; + + +#define WBFLAG_PAM_INFO3_NDR 0x0001 +#define WBFLAG_PAM_INFO3_TEXT 0x0002 +#define WBFLAG_PAM_NTKEY 0x0004 +#define WBFLAG_PAM_LMKEY 0x0008 +#define WBFLAG_PAM_CONTACT_TRUSTDOM 0x0010 +#define WBFLAG_QUERY_ONLY 0x0020 +#define WBFLAG_ALLOCATE_RID 0x0040 /* Winbind request structure */ @@ -123,6 +156,7 @@ struct winbindd_request { uint32 length; enum winbindd_cmd cmd; /* Winbindd command to execute */ pid_t pid; /* pid of calling process */ + uint32 flags; /* flags relavant to a given request */ union { fstring winsreq; /* WINS request */ @@ -146,7 +180,6 @@ struct winbindd_request { fstring nt_resp; uint16 nt_resp_len; fstring workstation; - uint32 flags; } auth_crap; struct { fstring user; @@ -159,6 +192,10 @@ struct winbindd_request { fstring name; } name; uint32 num_entries; /* getpwent, getgrent */ + struct { + fstring username; + fstring groupname; + } acct_mgt; } data; char null_term; }; @@ -188,25 +225,11 @@ struct winbindd_response { /* getpwnam, getpwuid */ - struct winbindd_pw { - fstring pw_name; - fstring pw_passwd; - uid_t pw_uid; - gid_t pw_gid; - fstring pw_gecos; - fstring pw_dir; - fstring pw_shell; - } pw; + struct winbindd_pw pw; /* getgrnam, getgrgid */ - struct winbindd_gr { - fstring gr_name; - fstring gr_passwd; - gid_t gr_gid; - int num_gr_mem; - int gr_mem_ofs; /* offset to group membership */ - } gr; + struct winbindd_gr gr; uint32 num_entries; /* getpwent, getgrent */ struct winbindd_sid { @@ -235,6 +258,7 @@ struct winbindd_response { char nt_session_key[16]; char first_8_lm_hash[8]; } auth; + uint32 rid; /* create user or group */ } data; /* Variable length return data */ diff --git a/source3/nsswitch/winbindd_pam.c b/source3/nsswitch/winbindd_pam.c index 2998372bd2..8df0f621c0 100644 --- a/source3/nsswitch/winbindd_pam.c +++ b/source3/nsswitch/winbindd_pam.c @@ -1,4 +1,4 @@ -/* +/* Unix SMB/CIFS implementation. Winbind daemon - pam auth funcions @@ -53,7 +53,58 @@ static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx, return NT_STATUS_OK; } -/* Return a password structure from a username. */ +/******************************************************************* + wrapper around retreiving the trsut account password +*******************************************************************/ + +static BOOL get_trust_pw(const char *domain, uint8 ret_pwd[16], + time_t *pass_last_set_time, uint32 *channel) +{ + DOM_SID sid; + char *pwd; + + /* if we are a DC and this is not our domain, then lookup an account + for the domain trust */ + + if ( IS_DC && !strequal(domain, lp_workgroup()) && lp_allow_trusted_domains() ) + { + if ( !secrets_fetch_trusted_domain_password(domain, &pwd, &sid, + pass_last_set_time) ) + { + DEBUG(0, ("get_trust_pw: could not fetch trust account " + "password for trusted domain %s\n", domain)); + return False; + } + + *channel = SEC_CHAN_DOMAIN; + E_md4hash(pwd, ret_pwd); + SAFE_FREE(pwd); + + return True; + } + else /* just get the account for our domain (covers + ROLE_DOMAIN_MEMBER as well */ + { + /* get the machine trust account for our domain */ + + if ( !secrets_fetch_trust_account_password (lp_workgroup(), ret_pwd, + pass_last_set_time, channel) ) + { + DEBUG(0, ("get_trust_pw: could not fetch trust account " + "password for my domain %s\n", domain)); + return False; + } + + return True; + } + + /* Failure */ + return False; +} + +/********************************************************************** + Authenticate a user with a clear test password +**********************************************************************/ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) { @@ -68,6 +119,11 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) TALLOC_CTX *mem_ctx = NULL; DATA_BLOB lm_resp; DATA_BLOB nt_resp; + DOM_CRED ret_creds; + int attempts = 0; + unsigned char local_lm_response[24]; + unsigned char local_nt_response[24]; + const char *contact_domain; /* Ensure null termination */ state->request.data.auth.user[sizeof(state->request.data.auth.user)-1]='\0'; @@ -86,58 +142,85 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) /* Parse domain and username */ - if (!parse_domain_user(state->request.data.auth.user, name_domain, - name_user)) { + parse_domain_user(state->request.data.auth.user, name_domain, name_user); + if ( !name_domain ) { DEBUG(5,("no domain separator (%s) in username (%s) - failing auth\n", lp_winbind_separator(), state->request.data.auth.user)); result = NT_STATUS_INVALID_PARAMETER; goto done; } - { - unsigned char local_lm_response[24]; - unsigned char local_nt_response[24]; - - generate_random_buffer(chal, 8, False); - SMBencrypt(state->request.data.auth.pass, chal, local_lm_response); + /* do password magic */ + + generate_random_buffer(chal, 8, False); + SMBencrypt(state->request.data.auth.pass, chal, local_lm_response); - SMBNTencrypt(state->request.data.auth.pass, chal, local_nt_response); + SMBNTencrypt(state->request.data.auth.pass, chal, local_nt_response); - lm_resp = data_blob_talloc(mem_ctx, local_lm_response, sizeof(local_lm_response)); - nt_resp = data_blob_talloc(mem_ctx, local_nt_response, sizeof(local_nt_response)); - } + lm_resp = data_blob_talloc(mem_ctx, local_lm_response, sizeof(local_lm_response)); + nt_resp = data_blob_talloc(mem_ctx, local_nt_response, sizeof(local_nt_response)); - /* - * Get the machine account password for our primary domain - */ - - if (!secrets_fetch_trust_account_password( - lp_workgroup(), trust_passwd, &last_change_time, - &sec_channel_type)) { - DEBUG(0, ("winbindd_pam_auth: could not fetch trust account " - "password for domain %s\n", lp_workgroup())); + if ( !get_trust_pw(name_domain, trust_passwd, &last_change_time, &sec_channel_type) ) { result = NT_STATUS_CANT_ACCESS_DOMAIN_INFO; goto done; } - ZERO_STRUCT(info3); + /* what domain should we contact? */ + + if ( IS_DC ) + contact_domain = name_domain; + else + contact_domain = lp_workgroup(); + + /* check authentication loop */ + + do { + ZERO_STRUCT(info3); + ZERO_STRUCT(ret_creds); + + /* Don't shut this down - it belongs to the connection cache code */ + result = cm_get_netlogon_cli(contact_domain, trust_passwd, + sec_channel_type, False, &cli); + + if (!NT_STATUS_IS_OK(result)) { + DEBUG(3, ("could not open handle to NETLOGON pipe\n")); + goto done; + } + + result = cli_netlogon_sam_network_logon(cli, mem_ctx, + &ret_creds, + name_user, name_domain, + global_myname(), chal, + lm_resp, nt_resp, + &info3); + attempts += 1; + + /* if we get access denied, a possible cuase was that we had and open + connection to the DC, but someone changed our machine accoutn password + out from underneath us using 'net rpc changetrustpw' */ + + if ( NT_STATUS_V(result) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) ) { + DEBUG(3,("winbindd_pam_auth: sam_logon returned ACCESS_DENIED. Maybe the trust account " + "password was changed and we didn't know it. Killing connections to domain %s\n", + name_domain)); + winbindd_cm_flush(); + cli->fd = -1; + } + + /* We have to try a second time as cm_get_netlogon_cli + might not yet have noticed that the DC has killed + our connection. */ + + } while ( (attempts < 2) && (cli->fd == -1) ); + + + clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds); + + if (NT_STATUS_IS_OK(result)) { + netsamlogon_cache_store( cli->mem_ctx, &info3 ); + wcache_invalidate_samlogon(find_domain_from_name(name_domain), &info3); + } - /* Don't shut this down - it belongs to the connection cache code */ - result = cm_get_netlogon_cli(lp_workgroup(), trust_passwd, - sec_channel_type, - &cli); - - if (!NT_STATUS_IS_OK(result)) { - DEBUG(3, ("could not open handle to NETLOGON pipe\n")); - goto done; - } - - result = cli_netlogon_sam_network_logon(cli, mem_ctx, - name_user, name_domain, - global_myname(), chal, - lm_resp, nt_resp, - &info3); - uni_group_cache_store_netlogon(mem_ctx, &info3); done: /* give us a more useful (more correct?) error code */ @@ -160,8 +243,10 @@ done: return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR; } - -/* Challenge Response Authentication Protocol */ + +/********************************************************************** + Challenge Response Authentication Protocol +**********************************************************************/ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) { @@ -174,8 +259,10 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) TALLOC_CTX *mem_ctx = NULL; char *user = NULL; const char *domain = NULL; - const char *contact_domain; const char *workstation; + const char *contact_domain; + DOM_CRED ret_creds; + int attempts = 0; DATA_BLOB lm_resp, nt_resp; @@ -220,11 +307,10 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) DEBUG(3, ("[%5d]: pam auth crap domain: %s user: %s\n", state->pid, domain, user)); - - if (lp_allow_trusted_domains() && (state->request.data.auth_crap.flags & WINBIND_PAM_CONTACT_TRUSTDOM)) { - contact_domain = domain; - } else { - contact_domain = lp_workgroup(); + + if ( !get_trust_pw(domain, trust_passwd, &last_change_time, &sec_channel_type) ) { + result = NT_STATUS_CANT_ACCESS_DOMAIN_INFO; + goto done; } if (*state->request.data.auth_crap.workstation) { @@ -249,47 +335,68 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) lm_resp = data_blob_talloc(mem_ctx, state->request.data.auth_crap.lm_resp, state->request.data.auth_crap.lm_resp_len); nt_resp = data_blob_talloc(mem_ctx, state->request.data.auth_crap.nt_resp, state->request.data.auth_crap.nt_resp_len); - /* - * Get the machine account password for the domain to contact. - * This is either our own domain for a workstation, or possibly - * any domain for a PDC with trusted domains. - */ - - if (!secrets_fetch_trust_account_password ( - contact_domain, trust_passwd, &last_change_time, - &sec_channel_type)) { - DEBUG(0, ("winbindd_pam_auth: could not fetch trust account " - "password for domain %s\n", contact_domain)); - result = NT_STATUS_CANT_ACCESS_DOMAIN_INFO; - goto done; - } + /* what domain should we contact? */ + + if ( IS_DC ) + contact_domain = domain; + else + contact_domain = lp_workgroup(); + + do { + ZERO_STRUCT(info3); + ZERO_STRUCT(ret_creds); + + /* Don't shut this down - it belongs to the connection cache code */ + result = cm_get_netlogon_cli(contact_domain, trust_passwd, sec_channel_type, False, &cli); - ZERO_STRUCT(info3); + if (!NT_STATUS_IS_OK(result)) { + DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n", + nt_errstr(result))); + goto done; + } - /* Don't shut this down - it belongs to the connection cache code */ - result = cm_get_netlogon_cli(contact_domain, trust_passwd, sec_channel_type, &cli); + result = cli_netlogon_sam_network_logon(cli, mem_ctx, + &ret_creds, + user, domain, + workstation, + state->request.data.auth_crap.chal, + lm_resp, nt_resp, + &info3); + + attempts += 1; + + /* if we get access denied, a possible cuase was that we had and open + connection to the DC, but someone changed our machine accoutn password + out from underneath us using 'net rpc changetrustpw' */ + + if ( NT_STATUS_V(result) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) ) { + DEBUG(3,("winbindd_pam_auth_crap: sam_logon returned ACCESS_DENIED. Maybe the trust account " + "password was changed and we didn't know it. Killing connections to domain %s\n", + domain)); + winbindd_cm_flush(); + cli->fd = -1; + } + + /* We have to try a second time as cm_get_netlogon_cli + might not yet have noticed that the DC has killed + our connection. */ - if (!NT_STATUS_IS_OK(result)) { - DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n", nt_errstr(result))); - goto done; - } + } while ( (attempts < 2) && (cli->fd == -1) ); - result = cli_netlogon_sam_network_logon(cli, mem_ctx, - user, domain, - workstation, state->request.data.auth_crap.chal, - lm_resp, nt_resp, - &info3); + clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds); if (NT_STATUS_IS_OK(result)) { - uni_group_cache_store_netlogon(mem_ctx, &info3); - if (state->request.data.auth_crap.flags & WINBIND_PAM_INFO3_NDR) { + netsamlogon_cache_store( cli->mem_ctx, &info3 ); + wcache_invalidate_samlogon(find_domain_from_name(domain), &info3); + + if (state->request.flags & WBFLAG_PAM_INFO3_NDR) { result = append_info3_as_ndr(mem_ctx, state, &info3); } - - if (state->request.data.auth_crap.flags & WINBIND_PAM_NTKEY) { + + if (state->request.flags & WBFLAG_PAM_NTKEY) { memcpy(state->response.data.auth.nt_session_key, info3.user_sess_key, sizeof(state->response.data.auth.nt_session_key) /* 16 */); } - if (state->request.data.auth_crap.flags & WINBIND_PAM_LMKEY) { + if (state->request.flags & WBFLAG_PAM_LMKEY) { memcpy(state->response.data.auth.first_8_lm_hash, info3.padding, sizeof(state->response.data.auth.first_8_lm_hash) /* 8 */); } } @@ -337,8 +444,8 @@ enum winbindd_result winbindd_pam_chauthtok(struct winbindd_cli_state *state) if (state == NULL) return WINBINDD_ERROR; - if (!parse_domain_user(state->request.data.chauthtok.user, domain, - user)) { + parse_domain_user(state->request.data.chauthtok.user, domain, user); + if ( !*domain ) { result = NT_STATUS_INVALID_PARAMETER; goto done; } @@ -350,9 +457,8 @@ enum winbindd_result winbindd_pam_chauthtok(struct winbindd_cli_state *state) /* Get sam handle */ - if (!(hnd = cm_get_sam_handle(domain))) { + if ( NT_STATUS_IS_ERR(result = cm_get_sam_handle(domain, &hnd)) ) { DEBUG(1, ("could not get SAM handle on DC for %s\n", domain)); - result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND; goto done; } diff --git a/source3/nsswitch/winbindd_rpc.c b/source3/nsswitch/winbindd_rpc.c index 9ec35617f1..33339d7ca0 100644 --- a/source3/nsswitch/winbindd_rpc.c +++ b/source3/nsswitch/winbindd_rpc.c @@ -51,8 +51,8 @@ static NTSTATUS query_user_list(struct winbindd_domain *domain, do { /* Get sam handle */ - if (!(hnd = cm_get_sam_handle(domain->name))) - goto done; + if ( !NT_STATUS_IS_OK(result = cm_get_sam_handle(domain->name, &hnd)) ) + return result; /* Get domain handle */ @@ -136,6 +136,7 @@ static NTSTATUS enum_dom_groups(struct winbindd_domain *domain, NTSTATUS status; uint32 start = 0; int retry; + NTSTATUS result; *num_entries = 0; *info = NULL; @@ -144,8 +145,8 @@ static NTSTATUS enum_dom_groups(struct winbindd_domain *domain, retry = 0; do { - if (!(hnd = cm_get_sam_handle(domain->name))) - return NT_STATUS_UNSUCCESSFUL; + if (!NT_STATUS_IS_OK(result = cm_get_sam_handle(domain->name, &hnd))) + return result; status = cli_samr_open_domain(hnd->cli, mem_ctx, &hnd->pol, des_access, &domain->sid, &dom_pol); @@ -209,8 +210,8 @@ static NTSTATUS enum_local_groups(struct winbindd_domain *domain, retry = 0; do { - if ( !(hnd = cm_get_sam_handle(domain->name)) ) - return NT_STATUS_UNSUCCESSFUL; + if ( !NT_STATUS_IS_OK(result = cm_get_sam_handle(domain->name, &hnd)) ) + return result; result = cli_samr_open_domain( hnd->cli, mem_ctx, &hnd->pol, des_access, &domain->sid, &dom_pol); @@ -262,7 +263,7 @@ static NTSTATUS name_to_sid(struct winbindd_domain *domain, enum SID_NAME_USE *type) { CLI_POLICY_HND *hnd; - NTSTATUS status; + NTSTATUS result; DOM_SID *sids = NULL; uint32 *types = NULL; const char *full_name; @@ -277,24 +278,27 @@ static NTSTATUS name_to_sid(struct winbindd_domain *domain, return NT_STATUS_NO_MEMORY; } + DEBUG(3,("name_to_sid [rpc] %s for domain %s\n", name, domain->name )); + retry = 0; do { - if (!(hnd = cm_get_lsa_handle(domain->name))) { - return NT_STATUS_UNSUCCESSFUL; + if (!NT_STATUS_IS_OK(result = cm_get_lsa_handle(domain->name, &hnd))) { + return result; } - status = cli_lsa_lookup_names(hnd->cli, mem_ctx, &hnd->pol, 1, + result = cli_lsa_lookup_names(hnd->cli, mem_ctx, &hnd->pol, 1, &full_name, &sids, &types); - } while (!NT_STATUS_IS_OK(status) && (retry++ < 1) && hnd && hnd->cli && hnd->cli->fd == -1); + } while (!NT_STATUS_IS_OK(result) && (retry++ < 1) && + hnd && hnd->cli && hnd->cli->fd == -1); /* Return rid and type if lookup successful */ - if (NT_STATUS_IS_OK(status)) { + if (NT_STATUS_IS_OK(result)) { sid_copy(sid, &sids[0]); *type = types[0]; } - return status; + return result; } /* @@ -310,21 +314,23 @@ static NTSTATUS sid_to_name(struct winbindd_domain *domain, char **domains; char **names; uint32 *types; - NTSTATUS status; + NTSTATUS result; int retry; - DEBUG(3,("rpc: sid_to_name\n")); + DEBUG(3,("sid_to_name [rpc] %s for domain %s\n", sid_string_static(sid), + domain->name )); retry = 0; do { - if (!(hnd = cm_get_lsa_handle(domain->name))) - return NT_STATUS_UNSUCCESSFUL; + if (!NT_STATUS_IS_OK(result = cm_get_lsa_handle(domain->name, &hnd))) + return result; - status = cli_lsa_lookup_sids(hnd->cli, mem_ctx, &hnd->pol, + result = cli_lsa_lookup_sids(hnd->cli, mem_ctx, &hnd->pol, 1, sid, &domains, &names, &types); - } while (!NT_STATUS_IS_OK(status) && (retry++ < 1) && hnd && hnd->cli && hnd->cli->fd == -1); + } while (!NT_STATUS_IS_OK(result) && (retry++ < 1) && + hnd && hnd->cli && hnd->cli->fd == -1); - if (NT_STATUS_IS_OK(status)) { + if (NT_STATUS_IS_OK(result)) { *type = types[0]; *name = names[0]; DEBUG(5,("Mapped sid to [%s]\\[%s]\n", domains[0], *name)); @@ -335,7 +341,8 @@ static NTSTATUS sid_to_name(struct winbindd_domain *domain, return NT_STATUS_UNSUCCESSFUL; } } - return status; + + return result; } /* Lookup user information from a rid or username. */ @@ -352,24 +359,48 @@ static NTSTATUS query_user(struct winbindd_domain *domain, int retry; fstring sid_string; uint32 user_rid; + NET_USER_INFO_3 *user; DEBUG(3,("rpc: query_user rid=%s\n", sid_to_string(sid_string, user_sid))); if (!sid_peek_check_rid(&domain->sid, user_sid, &user_rid)) { goto done; } - + + /* try netsamlogon cache first */ + + if ( (user = netsamlogon_cache_get( mem_ctx, user_sid )) != NULL ) + { + + DEBUG(5,("query_user: Cache lookup succeeded for %s\n", + sid_string_static(user_sid))); + + user_info->user_sid = rid_to_talloced_sid( domain, mem_ctx, user_rid ); + user_info->group_sid = rid_to_talloced_sid( domain, mem_ctx, user->group_rid ); + + user_info->acct_name = unistr2_tdup(mem_ctx, &user->uni_user_name); + user_info->full_name = unistr2_tdup(mem_ctx, &user->uni_full_name); + + SAFE_FREE(user); + + return NT_STATUS_OK; + } + + /* no cache; hit the wire */ + retry = 0; do { - /* Get sam handle */ - if (!(hnd = cm_get_sam_handle(domain->name))) + /* Get sam handle; if we fail here there is no hope */ + + if (!NT_STATUS_IS_OK(result = cm_get_sam_handle(domain->name, &hnd))) goto done; - + /* Get domain handle */ result = cli_samr_open_domain(hnd->cli, mem_ctx, &hnd->pol, SEC_RIGHTS_MAXIMUM_ALLOWED, &domain->sid, &dom_pol); - } while (!NT_STATUS_IS_OK(result) && (retry++ < 1) && hnd && hnd->cli && hnd->cli->fd == -1); + } while (!NT_STATUS_IS_OK(result) && (retry++ < 1) && + hnd && hnd->cli && hnd->cli->fd == -1); if (!NT_STATUS_IS_OK(result)) goto done; @@ -417,7 +448,7 @@ static NTSTATUS query_user(struct winbindd_domain *domain, static NTSTATUS lookup_usergroups(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, DOM_SID *user_sid, - uint32 *num_groups, DOM_SID ***user_gids) + uint32 *num_groups, DOM_SID ***user_grpsids) { CLI_POLICY_HND *hnd; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; @@ -429,30 +460,47 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain, unsigned int retry; fstring sid_string; uint32 user_rid; + NET_USER_INFO_3 *user; DEBUG(3,("rpc: lookup_usergroups sid=%s\n", sid_to_string(sid_string, user_sid))); *num_groups = 0; + *user_grpsids = NULL; - /* First try cached universal groups from logon */ - *user_gids = uni_group_cache_fetch(&domain->sid, user_sid, mem_ctx, num_groups); - if((*num_groups > 0) && *user_gids) { + /* so lets see if we have a cached user_info_3 */ + + if ( (user = netsamlogon_cache_get( mem_ctx, user_sid )) != NULL ) + { + DEBUG(5,("query_user: Cache lookup succeeded for %s\n", + sid_string_static(user_sid))); + + *num_groups = user->num_groups; + + (*user_grpsids) = talloc(mem_ctx, sizeof(DOM_SID*) * (*num_groups)); + for (i=0;i<(*num_groups);i++) { + (*user_grpsids)[i] = rid_to_talloced_sid(domain, mem_ctx, user->gids[i].g_rid); + } + + SAFE_FREE(user); + return NT_STATUS_OK; - } else { - *user_gids = NULL; - *num_groups = 0; } + /* no cache; hit the wire */ + retry = 0; do { - /* Get sam handle */ - if (!(hnd = cm_get_sam_handle(domain->name))) + /* Get sam handle; if we fail here there is no hope */ + + if (!NT_STATUS_IS_OK(result = cm_get_sam_handle(domain->name, &hnd))) goto done; /* Get domain handle */ + result = cli_samr_open_domain(hnd->cli, mem_ctx, &hnd->pol, des_access, &domain->sid, &dom_pol); - } while (!NT_STATUS_IS_OK(result) && (retry++ < 1) && hnd && hnd->cli && hnd->cli->fd == -1); + } while (!NT_STATUS_IS_OK(result) && (retry++ < 1) && + hnd && hnd->cli && hnd->cli->fd == -1); if (!NT_STATUS_IS_OK(result)) goto done; @@ -480,14 +528,14 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain, if (!NT_STATUS_IS_OK(result) || (*num_groups) == 0) goto done; - (*user_gids) = talloc(mem_ctx, sizeof(uint32) * (*num_groups)); - if (!(*user_gids)) { + (*user_grpsids) = talloc(mem_ctx, sizeof(DOM_SID*) * (*num_groups)); + if (!(*user_grpsids)) { result = NT_STATUS_NO_MEMORY; goto done; } for (i=0;i<(*num_groups);i++) { - (*user_gids)[i] = rid_to_talloced_sid(domain, mem_ctx, user_groups[i].g_rid); + (*user_grpsids)[i] = rid_to_talloced_sid(domain, mem_ctx, user_groups[i].g_rid); } done: @@ -532,7 +580,7 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain, retry = 0; do { /* Get sam handle */ - if (!(hnd = cm_get_sam_handle(domain->name))) + if (!NT_STATUS_IS_OK(result = cm_get_sam_handle(domain->name, &hnd))) goto done; /* Get domain handle */ @@ -581,7 +629,7 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain, (*sid_mem)[j] = rid_to_talloced_sid(domain, mem_ctx, (rid_mem)[j]); } - if (!*names || !*name_types) { + if (*num_names>0 && (!*names || !*name_types)) { result = NT_STATUS_NO_MEMORY; goto done; } @@ -601,9 +649,12 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain, &tmp_num_names, &tmp_names, &tmp_types); - if (!NT_STATUS_IS_OK(result)) + /* see if we have a real error (and yes the STATUS_SOME_UNMAPPED is + the one returned from 2k) */ + + if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) != NT_STATUS_V(STATUS_SOME_UNMAPPED)) goto done; - + /* Copy result into array. The talloc system will take care of freeing the temporary arrays later on. */ @@ -618,7 +669,9 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain, *num_names = total_names; - done: + result = NT_STATUS_OK; + +done: if (got_group_pol) cli_samr_close(hnd->cli, mem_ctx, &group_pol); @@ -628,6 +681,137 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain, return result; } +#ifdef HAVE_LDAP + +#include + +static SIG_ATOMIC_T gotalarm; + +/*************************************************************** + Signal function to tell us we timed out. +****************************************************************/ + +static void gotalarm_sig(void) +{ + gotalarm = 1; +} + +static LDAP *ldap_open_with_timeout(const char *server, int port, unsigned int to) +{ + LDAP *ldp = NULL; + + /* Setup timeout */ + gotalarm = 0; + CatchSignal(SIGALRM, SIGNAL_CAST gotalarm_sig); + alarm(to); + /* End setup timeout. */ + + ldp = ldap_open(server, port); + + /* Teardown timeout. */ + CatchSignal(SIGALRM, SIGNAL_CAST SIG_IGN); + alarm(0); + + return ldp; +} + +static int get_ldap_seq(const char *server, int port, uint32 *seq) +{ + int ret = -1; + struct timeval to; + char *attrs[] = {"highestCommittedUSN", NULL}; + LDAPMessage *res = NULL; + char **values = NULL; + LDAP *ldp = NULL; + + *seq = DOM_SEQUENCE_NONE; + + /* + * 10 second timeout on open. This is needed as the search timeout + * doesn't seem to apply to doing an open as well. JRA. + */ + + if ((ldp = ldap_open_with_timeout(server, port, 10)) == NULL) + return -1; + + /* Timeout if no response within 20 seconds. */ + to.tv_sec = 10; + to.tv_usec = 0; + + if (ldap_search_st(ldp, "", LDAP_SCOPE_BASE, "(objectclass=*)", &attrs[0], 0, &to, &res)) + goto done; + + if (ldap_count_entries(ldp, res) != 1) + goto done; + + values = ldap_get_values(ldp, res, "highestCommittedUSN"); + if (!values || !values[0]) + goto done; + + *seq = atoi(values[0]); + ret = 0; + + done: + + if (values) + ldap_value_free(values); + if (res) + ldap_msgfree(res); + if (ldp) + ldap_unbind(ldp); + return ret; +} + +/********************************************************************** + Get the sequence number for a Windows AD native mode domain using + LDAP queries +**********************************************************************/ + +int get_ldap_sequence_number( const char* domain, uint32 *seq) +{ + int ret = -1; + int i, port = LDAP_PORT; + struct ip_service *ip_list = NULL; + int count; + + if ( !get_sorted_dc_list(domain, &ip_list, &count, False) ) { + DEBUG(3, ("Could not look up dc's for domain %s\n", domain)); + return False; + } + + /* Finally return first DC that we can contact */ + + for (i = 0; i < count; i++) { + fstring ipstr; + + /* since the is an LDAP lookup, default to the LDAP_PORT is not set */ + port = (ip_list[i].port!= PORT_NONE) ? ip_list[i].port : LDAP_PORT; + + fstrcpy( ipstr, inet_ntoa(ip_list[i].ip) ); + + if (is_zero_ip(ip_list[i].ip)) + continue; + + if ( (ret = get_ldap_seq( ipstr, port, seq)) == 0 ) + goto done; + + /* add to failed connection cache */ + add_failed_connection_entry( domain, ipstr, NT_STATUS_UNSUCCESSFUL ); + } + +done: + if ( ret == 0 ) { + DEBUG(3, ("get_ldap_sequence_number: Retrieved sequence number for Domain (%s) from DC (%s:%d)\n", + domain, inet_ntoa(ip_list[i].ip), port)); + } + + SAFE_FREE(ip_list); + + return ret; +} + +#endif /* HAVE_LDAP */ + /* find the sequence number for a domain */ static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq) { @@ -636,7 +820,6 @@ static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq) SAM_UNK_CTR ctr; uint16 switch_value = 2; NTSTATUS result; - uint32 seqnum = DOM_SEQUENCE_NONE; POLICY_HND dom_pol; BOOL got_dom_pol = False; uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED; @@ -651,8 +834,24 @@ static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq) retry = 0; do { - /* Get sam handle */ - if (!(hnd = cm_get_sam_handle(domain->name))) +#ifdef HAVE_LDAP + if ( domain->native_mode ) + { + DEBUG(8,("using get_ldap_seq() to retrieve the sequence number\n")); + + if ( get_ldap_sequence_number( domain->name, seq ) == 0 ) { + result = NT_STATUS_OK; + DEBUG(10,("domain_sequence_number: LDAP for domain %s is %u\n", + domain->name, *seq)); + goto done; + } + + DEBUG(10,("domain_sequence_number: failed to get LDAP sequence number for domain %s\n", + domain->name )); + } +#endif /* HAVE_LDAP */ + /* Get sam handle */ + if (!NT_STATUS_IS_OK(result = cm_get_sam_handle(domain->name, &hnd))) goto done; /* Get domain handle */ @@ -671,11 +870,11 @@ static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq) switch_value, &ctr); if (NT_STATUS_IS_OK(result)) { - seqnum = ctr.info.inf2.seq_num; - DEBUG(10,("domain_sequence_number: for domain %s is %u\n", domain->name, (unsigned)seqnum )); + *seq = ctr.info.inf2.seq_num; + DEBUG(10,("domain_sequence_number: for domain %s is %u\n", domain->name, (unsigned)*seq)); } else { DEBUG(10,("domain_sequence_number: failed to get sequence number (%u) for domain %s\n", - (unsigned)seqnum, domain->name )); + (unsigned)*seq, domain->name )); } done: @@ -685,8 +884,6 @@ static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq) talloc_destroy(mem_ctx); - *seq = seqnum; - return result; } @@ -710,7 +907,7 @@ static NTSTATUS trusted_domains(struct winbindd_domain *domain, retry = 0; do { - if (!(hnd = cm_get_lsa_handle(lp_workgroup()))) + if (!NT_STATUS_IS_OK(result = cm_get_lsa_handle(lp_workgroup(), &hnd))) goto done; result = cli_lsa_enum_trust_dom(hnd->cli, mem_ctx, @@ -725,7 +922,7 @@ done: /* find the domain sid for a domain */ static NTSTATUS domain_sid(struct winbindd_domain *domain, DOM_SID *sid) { - NTSTATUS status = NT_STATUS_UNSUCCESSFUL; + NTSTATUS result = NT_STATUS_UNSUCCESSFUL; TALLOC_CTX *mem_ctx; CLI_POLICY_HND *hnd; fstring level5_dom; @@ -738,17 +935,17 @@ static NTSTATUS domain_sid(struct winbindd_domain *domain, DOM_SID *sid) retry = 0; do { - /* Get sam handle */ - if (!(hnd = cm_get_lsa_handle(domain->name))) + /* Get lsa handle */ + if (!NT_STATUS_IS_OK(result = cm_get_lsa_handle(domain->name, &hnd))) goto done; - status = cli_lsa_query_info_policy(hnd->cli, mem_ctx, + result = cli_lsa_query_info_policy(hnd->cli, mem_ctx, &hnd->pol, 0x05, level5_dom, sid); - } while (!NT_STATUS_IS_OK(status) && (retry++ < 1) && hnd && hnd->cli && hnd->cli->fd == -1); + } while (!NT_STATUS_IS_OK(result) && (retry++ < 1) && hnd && hnd->cli && hnd->cli->fd == -1); done: talloc_destroy(mem_ctx); - return status; + return result; } /* find alternate names list for the domain - none for rpc */ diff --git a/source3/nsswitch/winbindd_sid.c b/source3/nsswitch/winbindd_sid.c index f5dd904dc1..676beae3aa 100644 --- a/source3/nsswitch/winbindd_sid.c +++ b/source3/nsswitch/winbindd_sid.c @@ -122,6 +122,7 @@ enum winbindd_result winbindd_lookupname(struct winbindd_cli_state *state) enum winbindd_result winbindd_sid_to_uid(struct winbindd_cli_state *state) { DOM_SID sid; + uint32 flags = 0x0; /* Ensure null termination */ state->request.data.sid[sizeof(state->request.data.sid)-1]='\0'; @@ -131,15 +132,16 @@ enum winbindd_result winbindd_sid_to_uid(struct winbindd_cli_state *state) /* Split sid into domain sid and user rid */ if (!string_to_sid(&sid, state->request.data.sid)) { - DEBUG(1, ("Could not get convert sid %s from string\n", - state->request.data.sid)); + DEBUG(1, ("Could not get convert sid %s from string\n", state->request.data.sid)); return WINBINDD_ERROR; } - + + if ( state->request.flags & WBFLAG_QUERY_ONLY ) + flags = ID_QUERY_ONLY; + /* Find uid for this sid and return it */ - if (NT_STATUS_IS_ERR(sid_to_uid(&sid, &(state->response.data.uid)))) { - DEBUG(1, ("Could not get uid for sid %s\n", - state->request.data.sid)); + if ( !NT_STATUS_IS_OK(idmap_sid_to_uid(&sid, &(state->response.data.uid), flags)) ) { + DEBUG(1, ("Could not get uid for sid %s\n", state->request.data.sid)); return WINBINDD_ERROR; } @@ -152,6 +154,7 @@ enum winbindd_result winbindd_sid_to_uid(struct winbindd_cli_state *state) enum winbindd_result winbindd_sid_to_gid(struct winbindd_cli_state *state) { DOM_SID sid; + uint32 flags = 0x0; /* Ensure null termination */ state->request.data.sid[sizeof(state->request.data.sid)-1]='\0'; @@ -160,15 +163,16 @@ enum winbindd_result winbindd_sid_to_gid(struct winbindd_cli_state *state) state->request.data.sid)); if (!string_to_sid(&sid, state->request.data.sid)) { - DEBUG(1, ("Could not cvt string to sid %s\n", - state->request.data.sid)); + DEBUG(1, ("Could not cvt string to sid %s\n", state->request.data.sid)); return WINBINDD_ERROR; } + if ( state->request.flags & WBFLAG_QUERY_ONLY ) + flags = ID_QUERY_ONLY; + /* Find gid for this sid and return it */ - if (NT_STATUS_IS_ERR(sid_to_gid(&sid, &(state->response.data.gid)))) { - DEBUG(1, ("Could not get gid for sid %s\n", - state->request.data.sid)); + if ( !NT_STATUS_IS_OK(idmap_sid_to_gid(&sid, &(state->response.data.gid), flags)) ) { + DEBUG(1, ("Could not get gid for sid %s\n", state->request.data.sid)); return WINBINDD_ERROR; } @@ -192,7 +196,7 @@ enum winbindd_result winbindd_uid_to_sid(struct winbindd_cli_state *state) state->request.data.uid)); /* Lookup rid for this uid */ - if (NT_STATUS_IS_ERR(uid_to_sid(&sid, state->request.data.uid))) { + if (!NT_STATUS_IS_OK(idmap_uid_to_sid(&sid, state->request.data.uid))) { DEBUG(1, ("Could not convert uid %d to rid\n", state->request.data.uid)); return WINBINDD_ERROR; @@ -221,7 +225,7 @@ enum winbindd_result winbindd_gid_to_sid(struct winbindd_cli_state *state) state->request.data.gid)); /* Lookup sid for this uid */ - if (NT_STATUS_IS_ERR(gid_to_sid(&sid, state->request.data.gid))) { + if (!NT_STATUS_IS_OK(idmap_gid_to_sid(&sid, state->request.data.gid))) { DEBUG(1, ("Could not convert gid %d to sid\n", state->request.data.gid)); return WINBINDD_ERROR; diff --git a/source3/nsswitch/winbindd_user.c b/source3/nsswitch/winbindd_user.c index dc07bc42e7..c49c41687b 100644 --- a/source3/nsswitch/winbindd_user.c +++ b/source3/nsswitch/winbindd_user.c @@ -5,6 +5,7 @@ Copyright (C) Tim Potter 2000 Copyright (C) Jeremy Allison 2001. + Copyright (C) Gerald (Jerry) Carter 2003. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -26,13 +27,14 @@ #undef DBGC_CLASS #define DBGC_CLASS DBGC_WINBIND +extern userdom_struct current_user_info; + /* Fill a pwent structure with information we have obtained */ static BOOL winbindd_fill_pwent(char *dom_name, char *user_name, DOM_SID *user_sid, DOM_SID *group_sid, char *full_name, struct winbindd_pw *pw) { - extern userdom_struct current_user_info; fstring output_username; pstring homedir; fstring sid_string; @@ -42,14 +44,14 @@ static BOOL winbindd_fill_pwent(char *dom_name, char *user_name, /* Resolve the uid number */ - if (NT_STATUS_IS_ERR(sid_to_uid(user_sid, &(pw->pw_uid)))) { + if (!NT_STATUS_IS_OK(idmap_sid_to_uid(user_sid, &(pw->pw_uid), 0))) { DEBUG(1, ("error getting user id for sid %s\n", sid_to_string(sid_string, user_sid))); return False; } /* Resolve the gid number */ - if (NT_STATUS_IS_ERR(sid_to_gid(group_sid, &(pw->pw_gid)))) { + if (!NT_STATUS_IS_OK(idmap_sid_to_gid(group_sid, &(pw->pw_gid), 0))) { DEBUG(1, ("error getting group id for sid %s\n", sid_to_string(sid_string, group_sid))); return False; } @@ -95,6 +97,7 @@ static BOOL winbindd_fill_pwent(char *dom_name, char *user_name, enum winbindd_result winbindd_getpwnam(struct winbindd_cli_state *state) { WINBIND_USERINFO user_info; + WINBINDD_PW *pw; DOM_SID user_sid; NTSTATUS status; fstring name_domain, name_user; @@ -110,9 +113,28 @@ enum winbindd_result winbindd_getpwnam(struct winbindd_cli_state *state) /* Parse domain and username */ - if (!parse_domain_user(state->request.data.username, name_domain, - name_user)) + parse_domain_user(state->request.data.username, + name_domain, name_user); + + /* if this is our local domain (or no domain), the do a local tdb search */ + + if ( !*name_domain || strequal(name_domain, get_global_sam_name()) ) { + if ( !(pw = wb_getpwnam(name_user)) ) { + DEBUG(5,("winbindd_getpwnam: lookup for %s\\%s failed\n", + name_domain, name_user)); + return WINBINDD_ERROR; + } + memcpy( &state->response.data.pw, pw, sizeof(WINBINDD_PW) ); + return WINBINDD_OK; + } + + /* should we deal with users for our domain? */ + + if ( lp_winbind_trusted_domains_only() && strequal(name_domain, lp_workgroup())) { + DEBUG(7,("winbindd_getpenam: My domain -- rejecting getpwnam() for %s\\%s.\n", + name_domain, name_user)); return WINBINDD_ERROR; + } if ((domain = find_domain_from_name(name_domain)) == NULL) { DEBUG(5, ("no such domain: %s\n", name_domain)); @@ -172,6 +194,7 @@ enum winbindd_result winbindd_getpwuid(struct winbindd_cli_state *state) { DOM_SID user_sid; struct winbindd_domain *domain; + WINBINDD_PW *pw; fstring dom_name; fstring user_name; enum SID_NAME_USE name_type; @@ -188,10 +211,17 @@ enum winbindd_result winbindd_getpwuid(struct winbindd_cli_state *state) DEBUG(3, ("[%5d]: getpwuid %d\n", state->pid, state->request.data.uid)); + + /* always try local tdb first */ + + if ( (pw = wb_getpwuid(state->request.data.uid)) != NULL ) { + memcpy( &state->response.data.pw, pw, sizeof(WINBINDD_PW) ); + return WINBINDD_OK; + } /* Get rid from uid */ - if (NT_STATUS_IS_ERR(uid_to_sid(&user_sid, state->request.data.uid))) { + if (!NT_STATUS_IS_OK(idmap_uid_to_sid(&user_sid, state->request.data.uid))) { DEBUG(1, ("could not convert uid %d to SID\n", state->request.data.uid)); return WINBINDD_ERROR; @@ -235,7 +265,7 @@ enum winbindd_result winbindd_getpwuid(struct winbindd_cli_state *state) /* Check group has a gid number */ - if (NT_STATUS_IS_ERR(sid_to_gid(user_info.group_sid, &gid))) { + if (!NT_STATUS_IS_OK(idmap_sid_to_gid(user_info.group_sid, &gid, 0))) { DEBUG(1, ("error getting group id for user %s\n", user_name)); talloc_destroy(mem_ctx); return WINBINDD_ERROR; @@ -278,12 +308,35 @@ enum winbindd_result winbindd_setpwent(struct winbindd_cli_state *state) free_getent_state(state->getpwent_state); state->getpwent_state = NULL; } + +#if 0 /* JERRY */ + /* add any local users we have */ + + if ( (domain_state = (struct getent_state *)malloc(sizeof(struct getent_state))) == NULL ) + return WINBINDD_ERROR; + + ZERO_STRUCTP(domain_state); + + /* Add to list of open domains */ + + DLIST_ADD(state->getpwent_state, domain_state); +#endif /* Create sam pipes for each domain we know about */ for(domain = domain_list(); domain != NULL; domain = domain->next) { struct getent_state *domain_state; + + /* don't add our domaina if we are a PDC or if we + are a member of a Samba domain */ + + if ( (IS_DC || lp_winbind_trusted_domains_only()) + && strequal(domain->name, lp_workgroup()) ) + { + continue; + } + /* Create a state record for this domain */ if ((domain_state = (struct getent_state *) diff --git a/source3/nsswitch/winbindd_util.c b/source3/nsswitch/winbindd_util.c index 84f5d19568..6177c46aef 100644 --- a/source3/nsswitch/winbindd_util.c +++ b/source3/nsswitch/winbindd_util.c @@ -118,6 +118,7 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const } domain->methods = methods; + domain->backend = NULL; domain->sequence_number = DOM_SEQUENCE_NONE; domain->last_seq_check = 0; if (sid) { @@ -296,14 +297,10 @@ BOOL winbindd_lookup_sid_by_name(struct winbindd_domain *domain, * @brief Lookup a name in a domain from a sid. * * @param sid Security ID you want to look up. - * * @param name On success, set to the name corresponding to @p sid. - * * @param dom_name On success, set to the 'domain name' corresponding to @p sid. - * * @param type On success, contains the type of name: alias, group or * user. - * * @retval True if the name exists, in which case @p name and @p type * are set, otherwise False. **/ @@ -379,12 +376,14 @@ BOOL winbindd_param_init(void) /* Parse winbind uid and winbind_gid parameters */ if (!lp_idmap_uid(&server_state.uid_low, &server_state.uid_high)) { - DEBUG(0, ("winbind uid range missing or invalid\n")); + DEBUG(0, ("winbindd: idmap uid range missing or invalid\n")); + DEBUG(0, ("winbindd: cannot continue, exiting.\n")); return False; } if (!lp_idmap_gid(&server_state.gid_low, &server_state.gid_high)) { - DEBUG(0, ("winbind gid range missing or invalid\n")); + DEBUG(0, ("winbindd: idmap gid range missing or invalid\n")); + DEBUG(0, ("winbindd: cannot continue, exiting.\n")); return False; } @@ -412,18 +411,22 @@ BOOL parse_domain_user(const char *domuser, fstring domain, fstring user) { char *p = strchr(domuser,*lp_winbind_separator()); - if (!(p || lp_winbind_use_default_domain())) - return False; - - if(!p && lp_winbind_use_default_domain()) { + if ( !p ) { fstrcpy(user, domuser); - fstrcpy(domain, lp_workgroup()); - } else { + + if ( lp_winbind_use_default_domain() ) + fstrcpy(domain, lp_workgroup()); + else + fstrcpy( domain, "" ); + } + else { fstrcpy(user, p+1); fstrcpy(domain, domuser); domain[PTR_DIFF(p, domuser)] = 0; } - strupper(domain); + + strupper_m(domain); + return True; } @@ -573,3 +576,209 @@ DOM_SID *rid_to_talloced_sid(struct winbindd_domain *domain, return sid; } +/***************************************************************************** + For idmap conversion: convert one record to new format + Ancient versions (eg 2.2.3a) of winbindd_idmap.tdb mapped DOMAINNAME/rid + instead of the SID. +*****************************************************************************/ +static int convert_fn(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA data, void *state) +{ + struct winbindd_domain *domain; + char *p; + DOM_SID sid; + uint32 rid; + fstring keystr; + fstring dom_name; + TDB_DATA key2; + BOOL *failed = (BOOL *)state; + + DEBUG(10,("Converting %s\n", key.dptr)); + + p = strchr(key.dptr, '/'); + if (!p) + return 0; + + *p = 0; + fstrcpy(dom_name, key.dptr); + *p++ = '/'; + + domain = find_domain_from_name(dom_name); + if (domain == NULL) { + /* We must delete the old record. */ + DEBUG(0,("Unable to find domain %s\n", dom_name )); + DEBUG(0,("deleting record %s\n", key.dptr )); + + if (tdb_delete(tdb, key) != 0) { + DEBUG(0, ("Unable to delete record %s\n", key.dptr)); + *failed = True; + return -1; + } + + return 0; + } + + rid = atoi(p); + + sid_copy(&sid, &domain->sid); + sid_append_rid(&sid, rid); + + sid_to_string(keystr, &sid); + key2.dptr = keystr; + key2.dsize = strlen(keystr) + 1; + + if (tdb_store(tdb, key2, data, TDB_INSERT) != 0) { + DEBUG(0,("Unable to add record %s\n", key2.dptr )); + *failed = True; + return -1; + } + + if (tdb_store(tdb, data, key2, TDB_REPLACE) != 0) { + DEBUG(0,("Unable to update record %s\n", data.dptr )); + *failed = True; + return -1; + } + + if (tdb_delete(tdb, key) != 0) { + DEBUG(0,("Unable to delete record %s\n", key.dptr )); + *failed = True; + return -1; + } + + return 0; +} + +/* These definitions are from sam/idmap_tdb.c. Replicated here just + out of laziness.... :-( */ + +/* High water mark keys */ +#define HWM_GROUP "GROUP HWM" +#define HWM_USER "USER HWM" + +/* idmap version determines auto-conversion */ +#define IDMAP_VERSION 2 + + +/***************************************************************************** + Convert the idmap database from an older version. +*****************************************************************************/ + +static BOOL idmap_convert(const char *idmap_name) +{ + int32 vers; + BOOL bigendianheader; + BOOL failed = False; + TDB_CONTEXT *idmap_tdb; + + if (!(idmap_tdb = tdb_open_log(idmap_name, 0, + TDB_DEFAULT, O_RDWR, + 0600))) { + DEBUG(0, ("idmap_convert: Unable to open idmap database\n")); + return False; + } + + bigendianheader = (idmap_tdb->flags & TDB_BIGENDIAN) ? True : False; + + vers = tdb_fetch_int32(idmap_tdb, "IDMAP_VERSION"); + + if (((vers == -1) && bigendianheader) || (IREV(vers) == IDMAP_VERSION)) { + /* Arrggghh ! Bytereversed or old big-endian - make order independent ! */ + /* + * high and low records were created on a + * big endian machine and will need byte-reversing. + */ + + int32 wm; + + wm = tdb_fetch_int32(idmap_tdb, HWM_USER); + + if (wm != -1) { + wm = IREV(wm); + } else { + wm = server_state.uid_low; + } + + if (tdb_store_int32(idmap_tdb, HWM_USER, wm) == -1) { + DEBUG(0, ("idmap_convert: Unable to byteswap user hwm in idmap database\n")); + tdb_close(idmap_tdb); + return False; + } + + wm = tdb_fetch_int32(idmap_tdb, HWM_GROUP); + if (wm != -1) { + wm = IREV(wm); + } else { + wm = server_state.gid_low; + } + + if (tdb_store_int32(idmap_tdb, HWM_GROUP, wm) == -1) { + DEBUG(0, ("idmap_convert: Unable to byteswap group hwm in idmap database\n")); + tdb_close(idmap_tdb); + return False; + } + } + + /* the old format stored as DOMAIN/rid - now we store the SID direct */ + tdb_traverse(idmap_tdb, convert_fn, &failed); + + if (failed) { + DEBUG(0, ("Problem during conversion\n")); + tdb_close(idmap_tdb); + return False; + } + + if (tdb_store_int32(idmap_tdb, "IDMAP_VERSION", IDMAP_VERSION) == -1) { + DEBUG(0, ("idmap_convert: Unable to dtore idmap version in databse\n")); + tdb_close(idmap_tdb); + return False; + } + + tdb_close(idmap_tdb); + return True; +} + +/***************************************************************************** + Convert the idmap database from an older version if necessary +*****************************************************************************/ + +BOOL winbindd_upgrade_idmap(void) +{ + pstring idmap_name; + pstring backup_name; + SMB_STRUCT_STAT stbuf; + TDB_CONTEXT *idmap_tdb; + + pstrcpy(idmap_name, lock_path("winbindd_idmap.tdb")); + + if (!file_exist(idmap_name, &stbuf)) { + /* nothing to convert return */ + return True; + } + + if (!(idmap_tdb = tdb_open_log(idmap_name, 0, + TDB_DEFAULT, O_RDWR, + 0600))) { + DEBUG(0, ("idmap_convert: Unable to open idmap database\n")); + return False; + } + + if (tdb_fetch_int32(idmap_tdb, "IDMAP_VERSION") == IDMAP_VERSION) { + /* nothing to convert return */ + tdb_close(idmap_tdb); + return True; + } + + /* backup_tdb expects the tdb not to be open */ + tdb_close(idmap_tdb); + + DEBUG(0, ("Upgrading winbindd_idmap.tdb from an old version\n")); + + pstrcpy(backup_name, idmap_name); + pstrcat(backup_name, ".bak"); + + if (backup_tdb(idmap_name, backup_name) != 0) { + DEBUG(0, ("Could not backup idmap database\n")); + return False; + } + + return idmap_convert(idmap_name); +} diff --git a/source3/nsswitch/winbindd_wins.c b/source3/nsswitch/winbindd_wins.c index a1d38ed69a..66903e250d 100644 --- a/source3/nsswitch/winbindd_wins.c +++ b/source3/nsswitch/winbindd_wins.c @@ -86,14 +86,26 @@ static struct node_status *lookup_byaddr_backend(char *addr, int *count) static struct in_addr *lookup_byname_backend(const char *name, int *count) { int fd; - struct in_addr *ret = NULL; - int j, flags = 0; + struct ip_service *ret = NULL; + struct in_addr *return_ip; + int j, i, flags = 0; *count = 0; /* always try with wins first */ if (resolve_wins(name,0x20,&ret,count)) { - return ret; + if ( count == 0 ) + return NULL; + if ( (return_ip = (struct in_addr *)malloc((*count)*sizeof(struct in_addr))) == NULL ) { + free( ret ); + return NULL; + } + + /* copy the IP addresses */ + for ( i=0; i<(*count); i++ ) + return_ip[i] = ret[i].ip; + + return return_ip; } fd = wins_lookup_open_socket_in(); @@ -106,12 +118,12 @@ static struct in_addr *lookup_byname_backend(const char *name, int *count) j >= 0; j--) { struct in_addr *bcast = iface_n_bcast(j); - ret = name_query(fd,name,0x20,True,True,*bcast,count, &flags, NULL); - if (ret) break; + return_ip = name_query(fd,name,0x20,True,True,*bcast,count, &flags, NULL); + if (return_ip) break; } close(fd); - return ret; + return return_ip; } /* Get hostname from IP */ diff --git a/source3/nsswitch/wins.c b/source3/nsswitch/wins.c index 9bb2d6755c..62493ef0a9 100644 --- a/source3/nsswitch/wins.c +++ b/source3/nsswitch/wins.c @@ -112,8 +112,8 @@ static struct node_status *lookup_byaddr_backend(char *addr, int *count) static struct in_addr *lookup_byname_backend(const char *name, int *count) { int fd = -1; - struct in_addr *ret = NULL; - struct in_addr p; + struct ip_service *address = NULL; + struct in_addr *ret; int j, flags = 0; if (!initialised) { @@ -123,7 +123,13 @@ static struct in_addr *lookup_byname_backend(const char *name, int *count) *count = 0; /* always try with wins first */ - if (resolve_wins(name,0x20,&ret,count)) { + if (resolve_wins(name,0x20,&address,count)) { + if ( (ret = (struct in_addr *)malloc(sizeof(struct in_addr))) == NULL ) { + free( address ); + return NULL; + } + *ret = address[0].ip; + free( address ); return ret; } @@ -139,7 +145,6 @@ static struct in_addr *lookup_byname_backend(const char *name, int *count) if (ret) break; } -out: close(fd); return ret; } diff --git a/source3/pam_smbpass/pam_smb_passwd.c b/source3/pam_smbpass/pam_smb_passwd.c index 78b89c60b7..bef587a916 100644 --- a/source3/pam_smbpass/pam_smb_passwd.c +++ b/source3/pam_smbpass/pam_smb_passwd.c @@ -298,7 +298,7 @@ int pam_sm_chauthtok(pam_handle_t *pamh, int flags, uid_t uid; /* password updated */ - if (NT_STATUS_IS_ERR(sid_to_uid(pdb_get_user_sid(sampass), &uid))) { + if (!NT_STATUS_IS_OK(sid_to_uid(pdb_get_user_sid(sampass), &uid))) { _log_err( LOG_NOTICE, "Unable to get uid for user %s", pdb_get_username(sampass)); _log_err( LOG_NOTICE, "password for (%s) changed by (%s/%d)", diff --git a/source3/pam_smbpass/support.c b/source3/pam_smbpass/support.c index 62cc866fae..8a0432c855 100644 --- a/source3/pam_smbpass/support.c +++ b/source3/pam_smbpass/support.c @@ -399,7 +399,7 @@ int _smb_verify_password( pam_handle_t * pamh, SAM_ACCOUNT *sampass, service ? service : "**unknown**", name); new->count = 1; } - if (NT_STATUS_IS_ERR(sid_to_uid(pdb_get_user_sid(sampass), &(new->id)))) { + if (!NT_STATUS_IS_OK(sid_to_uid(pdb_get_user_sid(sampass), &(new->id)))) { _log_err(LOG_NOTICE, "failed auth request by %s for service %s as %s", uidtoname(getuid()), diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index 3925a569ca..dd429fa688 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -109,6 +109,8 @@ typedef struct char *szRootdir; char *szDefaultService; char *szDfree; + char *szGetQuota; + char *szSetQuota; char *szMsgCommand; char *szHostsEquiv; char *szServerString; @@ -124,7 +126,6 @@ typedef struct char *szPasswordServer; char *szSocketOptions; char *szRealm; - char *szADSserver; char *szUsernameMap; char *szLogonScript; char *szLogonPath; @@ -156,23 +157,23 @@ typedef struct char *szAbortShutdownScript; char *szWINSHook; char *szWINSPartners; -#ifdef WITH_UTMP char *szUtmpDir; char *szWtmpDir; BOOL bUtmp; -#endif char *szSourceEnv; char *szIdmapUID; char *szIdmapGID; - BOOL *bIdmapOnly; - char *szNonUnixAccountRange; + BOOL bEnableRidAlgorithm; int AlgorithmicRidBase; + char *szTemplatePrimaryGroup; char *szTemplateHomedir; char *szTemplateShell; char *szWinbindSeparator; + BOOL bWinbindEnableLocalAccounts; BOOL bWinbindEnumUsers; BOOL bWinbindEnumGroups; BOOL bWinbindUseDefaultDomain; + BOOL bWinbindTrustedDomainsOnly; char *szWinbindBackend; char *szIdmapBackend; char *szAddShareCommand; @@ -212,7 +213,6 @@ typedef struct int announce_as; /* This is initialised in init_globals */ int machine_password_timeout; int change_notify_timeout; - int stat_cache_size; int map_to_guest; int min_passwd_length; int oplock_break_wait_time; @@ -221,6 +221,8 @@ typedef struct int iLockSpinTime; char *szLdapMachineSuffix; char *szLdapUserSuffix; + char *szLdapIdmapSuffix; + char *szLdapGroupSuffix; #ifdef WITH_LDAP_SAMCONFIG int ldap_port; char *szLdapServer; @@ -274,6 +276,7 @@ typedef struct BOOL bUseSpnego; BOOL bClientLanManAuth; BOOL bClientNTLMv2Auth; + BOOL bClientPlaintextAuth; BOOL bClientUseSpnego; BOOL bDebugHiresTimestamp; BOOL bDebugPid; @@ -288,7 +291,7 @@ typedef struct BOOL bKernelChangeNotify; int restrict_anonymous; int name_cache_timeout; - BOOL client_signing; + int client_signing; param_opt_struct *param_opt; } global; @@ -339,9 +342,7 @@ typedef struct char **printer_admin; char *volume; char *fstype; - char *szVfsObjectFile; - char *szVfsOptions; - char *szVfsPath; + char **szVfsObjects; char *szMSDfsProxy; int iMinPrintSpace; int iMaxPrintJobs; @@ -412,6 +413,7 @@ typedef struct BOOL bNTAclSupport; BOOL bUseSendfile; BOOL bProfileAcls; + BOOL bMap_acl_inherit; param_opt_struct *param_opt; char dummy[3]; /* for alignment */ @@ -460,9 +462,7 @@ static service sDefault = { NULL, /* printer admin */ NULL, /* volume */ NULL, /* fstype */ - NULL, /* vfs object */ - NULL, /* vfs options */ - NULL, /* vfs path */ + NULL, /* vfs objects */ NULL, /* szMSDfsProxy */ 0, /* iMinPrintSpace */ 1000, /* iMaxPrintJobs */ @@ -533,6 +533,7 @@ static service sDefault = { True, /* bNTAclSupport */ False, /* bUseSendfile */ False, /* bProfileAcls */ + False, /* bMap_acl_inherit */ NULL, /* Parametric options */ @@ -562,14 +563,14 @@ static BOOL handle_workgroup( const char *pszParmValue, char **ptr ); static BOOL handle_netbios_aliases( const char *pszParmValue, char **ptr ); static BOOL handle_netbios_scope( const char *pszParmValue, char **ptr ); -static BOOL handle_ldap_machine_suffix ( const char *pszParmValue, char **ptr ); -static BOOL handle_ldap_user_suffix ( const char *pszParmValue, char **ptr ); static BOOL handle_ldap_suffix ( const char *pszParmValue, char **ptr ); +static BOOL handle_ldap_sub_suffix ( const char *pszParmValue, char **ptr ); static BOOL handle_acl_compatibility(const char *pszParmValue, char **ptr); static void set_server_role(void); static void set_default_server_announce_type(void); +static void set_allowed_client_auth(void); static const struct enum_list enum_protocol[] = { {PROTOCOL_NT1, "NT1"}, @@ -627,18 +628,16 @@ static const struct enum_list enum_ldap_ssl[] = { }; static const struct enum_list enum_ldap_passwd_sync[] = { - {LDAP_PASSWD_SYNC_ON, "Yes"}, - {LDAP_PASSWD_SYNC_ON, "yes"}, - {LDAP_PASSWD_SYNC_ON, "on"}, - {LDAP_PASSWD_SYNC_ON, "On"}, {LDAP_PASSWD_SYNC_OFF, "no"}, {LDAP_PASSWD_SYNC_OFF, "No"}, {LDAP_PASSWD_SYNC_OFF, "off"}, {LDAP_PASSWD_SYNC_OFF, "Off"}, -#ifdef LDAP_EXOP_X_MODIFY_PASSWD + {LDAP_PASSWD_SYNC_ON, "Yes"}, + {LDAP_PASSWD_SYNC_ON, "yes"}, + {LDAP_PASSWD_SYNC_ON, "on"}, + {LDAP_PASSWD_SYNC_ON, "On"}, {LDAP_PASSWD_SYNC_ONLY, "Only"}, {LDAP_PASSWD_SYNC_ONLY, "only"}, -#endif /* LDAP_EXOP_X_MODIFY_PASSWD */ {-1, NULL} }; @@ -688,6 +687,25 @@ static const struct enum_list enum_csc_policy[] = { {-1, NULL} }; +/* SMB signing types. */ +static const struct enum_list enum_smb_signing_vals[] = { + {False, "No"}, + {False, "False"}, + {False, "0"}, + {False, "Off"}, + {True, "Yes"}, + {True, "True"}, + {True, "1"}, + {True, "On"}, + {Required, "Required"}, + {Required, "Mandatory"}, + {Required, "Force"}, + {Required, "Forced"}, + {Required, "Enforced"}, + {-1, NULL} +}; + + /* Do you want session setups at user level security with a invalid password to be rejected or allowed in as guest? WinNT rejects them @@ -737,7 +755,6 @@ static struct parm_struct parm_table[] = { {"directory", P_STRING, P_LOCAL, &sDefault.szPath, NULL, NULL, FLAG_HIDE}, {"workgroup", P_USTRING, P_GLOBAL, &Globals.szWorkgroup, handle_workgroup, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, {"realm", P_USTRING, P_GLOBAL, &Globals.szRealm, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"ADS server", P_STRING, P_GLOBAL, &Globals.szADSserver, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, {"netbios name", P_USTRING, P_GLOBAL, &Globals.szNetbiosName, handle_netbios_name, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, {"netbios aliases", P_LIST, P_GLOBAL, &Globals.szNetbiosAliases, handle_netbios_aliases, NULL, FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, {"netbios scope", P_USTRING, P_GLOBAL, &Globals.szNetbiosScope, handle_netbios_scope, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, @@ -751,8 +768,8 @@ static struct parm_struct parm_table[] = { {"auth methods", P_LIST, P_GLOBAL, &Globals.AuthMethods, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, {"encrypt passwords", P_BOOL, P_GLOBAL, &Globals.bEncryptPasswords, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, {"update encrypted", P_BOOL, P_GLOBAL, &Globals.bUpdateEncrypt, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_DEVELOPER}, - {"client schannel", P_ENUM, P_GLOBAL, &Globals.clientSchannel, NULL, enum_bool_auto, FLAG_BASIC}, - {"server schannel", P_ENUM, P_GLOBAL, &Globals.serverSchannel, NULL, enum_bool_auto, FLAG_BASIC}, + {"client schannel", P_ENUM, P_GLOBAL, &Globals.clientSchannel, NULL, enum_bool_auto, FLAG_BASIC | FLAG_ADVANCED | FLAG_DEVELOPER}, + {"server schannel", P_ENUM, P_GLOBAL, &Globals.serverSchannel, NULL, enum_bool_auto, FLAG_BASIC | FLAG_ADVANCED | FLAG_DEVELOPER}, {"allow trusted domains", P_BOOL, P_GLOBAL, &Globals.bAllowTrustedDomains, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"hosts equiv", P_STRING, P_GLOBAL, &Globals.szHostsEquiv, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"min passwd length", P_INTEGER, P_GLOBAL, &Globals.min_passwd_length, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, @@ -763,7 +780,7 @@ static struct parm_struct parm_table[] = { {"password server", P_STRING, P_GLOBAL, &Globals.szPasswordServer, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, {"smb passwd file", P_STRING, P_GLOBAL, &Globals.szSMBPasswdFile, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"private dir", P_STRING, P_GLOBAL, &Globals.szPrivateDir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"passdb backend", P_LIST, P_GLOBAL, &Globals.szPassdbBackend, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"passdb backend", P_LIST, P_GLOBAL, &Globals.szPassdbBackend, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, {"algorithmic rid base", P_INTEGER, P_GLOBAL, &Globals.AlgorithmicRidBase, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"root directory", P_STRING, P_GLOBAL, &Globals.szRootdir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"root dir", P_STRING, P_GLOBAL, &Globals.szRootdir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, @@ -783,6 +800,7 @@ static struct parm_struct parm_table[] = { {"ntlm auth", P_BOOL, P_GLOBAL, &Globals.bNTLMAuth, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"client NTLMv2 auth", P_BOOL, P_GLOBAL, &Globals.bClientNTLMv2Auth, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"client lanman auth", P_BOOL, P_GLOBAL, &Globals.bClientLanManAuth, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"client plaintext auth", P_BOOL, P_GLOBAL, &Globals.bClientPlaintextAuth, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"username", P_STRING, P_LOCAL, &sDefault.szUsername, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, {"user", P_STRING, P_LOCAL, &sDefault.szUsername, NULL, NULL, FLAG_HIDE}, @@ -804,12 +822,12 @@ static struct parm_struct parm_table[] = { {"writable", P_BOOLREV, P_LOCAL, &sDefault.bRead_only, NULL, NULL, FLAG_HIDE}, {"create mask", P_OCTAL, P_LOCAL, &sDefault.iCreate_mask, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"create mode", P_OCTAL, P_LOCAL, &sDefault.iCreate_mask, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, + {"create mode", P_OCTAL, P_LOCAL, &sDefault.iCreate_mask, NULL, NULL, FLAG_GLOBAL}, {"force create mode", P_OCTAL, P_LOCAL, &sDefault.iCreate_force_mode, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, {"security mask", P_OCTAL, P_LOCAL, &sDefault.iSecurity_mask, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, {"force security mode", P_OCTAL, P_LOCAL, &sDefault.iSecurity_force_mode, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, {"directory mask", P_OCTAL, P_LOCAL, &sDefault.iDir_mask, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"directory mode", P_OCTAL, P_LOCAL, &sDefault.iDir_mask, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, + {"directory mode", P_OCTAL, P_LOCAL, &sDefault.iDir_mask, NULL, NULL, FLAG_GLOBAL}, {"force directory mode", P_OCTAL, P_LOCAL, &sDefault.iDir_force_mode, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, {"directory security mask", P_OCTAL, P_LOCAL, &sDefault.iDir_Security_mask, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, {"force directory security mode", P_OCTAL, P_LOCAL, &sDefault.iDir_Security_force_mode, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, @@ -856,14 +874,15 @@ static struct parm_struct parm_table[] = { {"write raw", P_BOOL, P_GLOBAL, &Globals.bWriteRaw, NULL, NULL, FLAG_DEVELOPER}, {"disable netbios", P_BOOL, P_GLOBAL, &Globals.bDisableNetbios, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"acl compatibility", P_STRING, P_GLOBAL, &Globals.szAclCompat, handle_acl_compatibility, NULL, FLAG_SHARE | FLAG_GLOBAL | FLAG_ADVANCED}, - {"nt acl support", P_BOOL, P_LOCAL, &sDefault.bNTAclSupport, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE | FLAG_ADVANCED | FLAG_WIZARD}, + {"acl compatibility", P_STRING, P_GLOBAL, &Globals.szAclCompat, handle_acl_compatibility, NULL, FLAG_SHARE | FLAG_GLOBAL | FLAG_ADVANCED | FLAG_DEVELOPER}, + {"nt acl support", P_BOOL, P_LOCAL, &sDefault.bNTAclSupport, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE | FLAG_ADVANCED | FLAG_DEVELOPER}, {"nt pipe support", P_BOOL, P_GLOBAL, &Globals.bNTPipeSupport, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"nt status support", P_BOOL, P_GLOBAL, &Globals.bNTStatusSupport, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"profile acls", P_BOOL, P_LOCAL, &sDefault.bProfileAcls, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE | FLAG_ADVANCED | FLAG_WIZARD}, + {"profile acls", P_BOOL, P_LOCAL, &sDefault.bProfileAcls, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE | FLAG_ADVANCED}, {"announce version", P_STRING, P_GLOBAL, &Globals.szAnnounceVersion, NULL, NULL, FLAG_DEVELOPER}, {"announce as", P_ENUM, P_GLOBAL, &Globals.announce_as, NULL, enum_announce_as, FLAG_DEVELOPER}, + {"map acl inherit", P_BOOL, P_LOCAL, &sDefault.bMap_acl_inherit, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, {"max mux", P_INTEGER, P_GLOBAL, &Globals.max_mux, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"max xmit", P_INTEGER, P_GLOBAL, &Globals.max_xmit, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, @@ -874,7 +893,7 @@ static struct parm_struct parm_table[] = { {"time server", P_BOOL, P_GLOBAL, &Globals.bTimeServer, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"unix extensions", P_BOOL, P_GLOBAL, &Globals.bUnixExtensions, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"use spnego", P_BOOL, P_GLOBAL, &Globals.bUseSpnego, NULL, NULL, FLAG_DEVELOPER}, - {"client signing", P_BOOL, P_GLOBAL, &Globals.client_signing, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"client signing", P_ENUM, P_GLOBAL, &Globals.client_signing, NULL, enum_smb_signing_vals, FLAG_ADVANCED | FLAG_DEVELOPER}, {"client use spnego", P_BOOL, P_GLOBAL, &Globals.bClientUseSpnego, NULL, NULL, FLAG_DEVELOPER}, {"Tuning Options", P_SEP, P_SEPARATOR}, @@ -896,7 +915,6 @@ static struct parm_struct parm_table[] = { {"read size", P_INTEGER, P_GLOBAL, &Globals.ReadSize, NULL, NULL, FLAG_DEVELOPER}, {"socket options", P_GSTRING, P_GLOBAL, user_socket_options, NULL, NULL, FLAG_DEVELOPER}, - {"stat cache size", P_INTEGER, P_GLOBAL, &Globals.stat_cache_size, NULL, NULL, FLAG_DEVELOPER}, {"strict allocate", P_BOOL, P_LOCAL, &sDefault.bStrictAllocate, NULL, NULL, FLAG_SHARE}, {"strict sync", P_BOOL, P_LOCAL, &sDefault.bStrictSync, NULL, NULL, FLAG_SHARE}, {"sync always", P_BOOL, P_LOCAL, &sDefault.bSyncAlways, NULL, NULL, FLAG_SHARE}, @@ -1003,6 +1021,7 @@ static struct parm_struct parm_table[] = { {"enhanced browsing", P_BOOL, P_GLOBAL, &Globals.enhanced_browsing, NULL, NULL, FLAG_DEVELOPER | FLAG_ADVANCED}, {"WINS Options", P_SEP, P_SEPARATOR}, + {"dns proxy", P_BOOL, P_GLOBAL, &Globals.bDNSproxy, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"wins proxy", P_BOOL, P_GLOBAL, &Globals.bWINSproxy, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, @@ -1027,7 +1046,7 @@ static struct parm_struct parm_table[] = { {"oplock contention limit", P_INTEGER, P_LOCAL, &sDefault.iOplockContentionLimit, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, {"posix locking", P_BOOL, P_LOCAL, &sDefault.bPosixLocking, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, {"strict locking", P_BOOL, P_LOCAL, &sDefault.bStrictLocking, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"share modes", P_BOOL, P_LOCAL, &sDefault.bShareModes, NULL, NULL, FLAG_SHARE|FLAG_GLOBAL}, + {"share modes", P_BOOL, P_LOCAL, &sDefault.bShareModes, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, {"Ldap Options", P_SEP, P_SEPARATOR}, @@ -1036,8 +1055,10 @@ static struct parm_struct parm_table[] = { {"ldap port", P_INTEGER, P_GLOBAL, &Globals.ldap_port, NULL, NULL, 0}, #endif {"ldap suffix", P_STRING, P_GLOBAL, &Globals.szLdapSuffix, handle_ldap_suffix, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"ldap machine suffix", P_STRING, P_GLOBAL, &Globals.szLdapMachineSuffix, handle_ldap_machine_suffix, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"ldap user suffix", P_STRING, P_GLOBAL, &Globals.szLdapUserSuffix, handle_ldap_user_suffix, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"ldap machine suffix", P_STRING, P_GLOBAL, &Globals.szLdapMachineSuffix, handle_ldap_sub_suffix, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"ldap user suffix", P_STRING, P_GLOBAL, &Globals.szLdapUserSuffix, handle_ldap_sub_suffix, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"ldap group suffix", P_STRING, P_GLOBAL, &Globals.szLdapGroupSuffix, handle_ldap_sub_suffix, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"ldap idmap suffix", P_STRING, P_GLOBAL, &Globals.szLdapIdmapSuffix, handle_ldap_sub_suffix, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"ldap filter", P_STRING, P_GLOBAL, &Globals.szLdapFilter, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"ldap admin dn", P_STRING, P_GLOBAL, &Globals.szLdapAdminDn, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"ldap ssl", P_ENUM, P_GLOBAL, &Globals.ldap_ssl, NULL, enum_ldap_ssl, FLAG_ADVANCED | FLAG_DEVELOPER}, @@ -1066,6 +1087,8 @@ static struct parm_struct parm_table[] = { {"default", P_STRING, P_GLOBAL, &Globals.szDefaultService, NULL, NULL, FLAG_DEVELOPER}, {"message command", P_STRING, P_GLOBAL, &Globals.szMsgCommand, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"dfree command", P_STRING, P_GLOBAL, &Globals.szDfree, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"get quota command", P_STRING, P_GLOBAL, &Globals.szGetQuota, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"set quota command", P_STRING, P_GLOBAL, &Globals.szSetQuota, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"remote announce", P_STRING, P_GLOBAL, &Globals.szRemoteAnnounce, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"remote browse sync", P_STRING, P_GLOBAL, &Globals.szRemoteBrowseSync, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"socket address", P_STRING, P_GLOBAL, &Globals.szSocketAddress, NULL, NULL, FLAG_DEVELOPER}, @@ -1104,10 +1127,9 @@ static struct parm_struct parm_table[] = { {"hide local users", P_BOOL, P_GLOBAL, &Globals.bHideLocalUsers, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"VFS module options", P_SEP, P_SEPARATOR}, - - {"vfs object", P_LIST, P_LOCAL, &sDefault.szVfsObjectFile, NULL, NULL, FLAG_SHARE}, - {"vfs options", P_STRING, P_LOCAL, &sDefault.szVfsOptions, NULL, NULL, FLAG_SHARE}, - {"vfs path", P_STRING, P_LOCAL, &sDefault.szVfsPath, NULL, NULL, FLAG_SHARE}, + + {"vfs objects", P_LIST, P_LOCAL, &sDefault.szVfsObjects, NULL, NULL, FLAG_SHARE}, + {"vfs object", P_LIST, P_LOCAL, &sDefault.szVfsObjects, NULL, NULL, FLAG_SHARE | FLAG_HIDE}, {"msdfs root", P_BOOL, P_LOCAL, &sDefault.bMSDfsRoot, NULL, NULL, FLAG_SHARE}, @@ -1116,19 +1138,22 @@ static struct parm_struct parm_table[] = { {"Winbind options", P_SEP, P_SEPARATOR}, - {"idmap only", P_BOOL, P_GLOBAL, &Globals.bIdmapOnly, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"enable rid algorithm", P_BOOL, P_GLOBAL, &Globals.bEnableRidAlgorithm, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER | FLAG_DEPRECATED}, {"idmap backend", P_STRING, P_GLOBAL, &Globals.szIdmapBackend, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"idmap uid", P_STRING, P_GLOBAL, &Globals.szIdmapUID, handle_idmap_uid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"winbind uid", P_STRING, P_GLOBAL, &Globals.szIdmapUID, handle_idmap_uid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER | FLAG_HIDE}, + {"winbind uid", P_STRING, P_GLOBAL, &Globals.szIdmapUID, handle_idmap_uid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER }, {"idmap gid", P_STRING, P_GLOBAL, &Globals.szIdmapGID, handle_idmap_gid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"winbind gid", P_STRING, P_GLOBAL, &Globals.szIdmapGID, handle_idmap_gid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER | FLAG_HIDE}, + {"winbind gid", P_STRING, P_GLOBAL, &Globals.szIdmapGID, handle_idmap_gid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER }, + {"template primary group", P_STRING, P_GLOBAL, &Globals.szTemplatePrimaryGroup, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"template homedir", P_STRING, P_GLOBAL, &Globals.szTemplateHomedir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"template shell", P_STRING, P_GLOBAL, &Globals.szTemplateShell, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"winbind separator", P_STRING, P_GLOBAL, &Globals.szWinbindSeparator, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"winbind cache time", P_INTEGER, P_GLOBAL, &Globals.winbind_cache_time, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"winbind enable local accounts", P_BOOL, P_GLOBAL, &Globals.bWinbindEnableLocalAccounts, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"winbind enum users", P_BOOL, P_GLOBAL, &Globals.bWinbindEnumUsers, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"winbind enum groups", P_BOOL, P_GLOBAL, &Globals.bWinbindEnumGroups, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {"winbind use default domain", P_BOOL, P_GLOBAL, &Globals.bWinbindUseDefaultDomain, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"winbind trusted domains only", P_BOOL, P_GLOBAL, &Globals.bWinbindTrustedDomainsOnly, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, {NULL, P_BOOL, P_NONE, NULL, NULL, NULL, 0} }; @@ -1278,8 +1303,13 @@ static void init_globals(void) /* using UTF8 by default allows us to support all chars */ string_set(&Globals.unix_charset, "UTF8"); - /* using UTF8 by default allows us to support all chars */ +#if defined(HAVE_NL_LANGINFO) && defined(CODESET) + /* If the system supports nl_langinfo(), try to grab the value + from the user's locale */ + string_set(&Globals.display_charset, "LOCALE"); +#else string_set(&Globals.display_charset, "ASCII"); +#endif /* Use codepage 850 as a default for the dos character set */ string_set(&Globals.dos_charset, "CP850"); @@ -1341,8 +1371,8 @@ static void init_globals(void) Globals.paranoid_server_security = True; Globals.bEncryptPasswords = True; Globals.bUpdateEncrypt = False; - Globals.clientSchannel = False; - Globals.serverSchannel = False; + Globals.clientSchannel = Auto; + Globals.serverSchannel = Auto; Globals.bReadRaw = True; Globals.bWriteRaw = True; Globals.bReadPrediction = False; @@ -1366,7 +1396,6 @@ static void init_globals(void) Globals.ReadSize = 16 * 1024; Globals.lm_announce = 2; /* = Auto: send only if LM clients found */ Globals.lm_interval = 60; - Globals.stat_cache_size = 50; /* Number of stat translations we'll keep */ Globals.announce_as = ANNOUNCE_AS_NT_SERVER; #if (defined(HAVE_NETGROUP) && defined(WITH_AUTOMOUNT)) Globals.bNISHomeMap = False; @@ -1387,6 +1416,7 @@ static void init_globals(void) Globals.bStatCache = True; /* use stat cache by default */ Globals.restrict_anonymous = 0; Globals.bClientLanManAuth = True; /* Do use the LanMan hash if it is available */ + Globals.bClientPlaintextAuth = True; /* Do use a plaintext password if is requested by the server */ Globals.bLanmanAuth = True; /* Do use the LanMan hash if it is available */ Globals.bNTLMAuth = True; /* Do use NTLMv1 if it is available (otherwise NTLMv2) */ @@ -1410,15 +1440,17 @@ static void init_globals(void) #ifdef WITH_LDAP_SAMCONFIG string_set(&Globals.szLdapServer, "localhost"); Globals.ldap_port = 636; - Globals.szPassdbBackend = str_list_make("ldapsam guest", NULL); + Globals.szPassdbBackend = str_list_make("ldapsam_compat", NULL); #else - Globals.szPassdbBackend = str_list_make("smbpasswd guest", NULL); + Globals.szPassdbBackend = str_list_make("smbpasswd", NULL); #endif /* WITH_LDAP_SAMCONFIG */ string_set(&Globals.szLdapSuffix, ""); string_set(&Globals.szLdapFilter, "(uid=%u)"); string_set(&Globals.szLdapMachineSuffix, ""); string_set(&Globals.szLdapUserSuffix, ""); + string_set(&Globals.szLdapGroupSuffix, ""); + string_set(&Globals.szLdapIdmapSuffix, ""); string_set(&Globals.szLdapAdminDn, ""); Globals.ldap_ssl = LDAP_SSL_ON; @@ -1456,15 +1488,18 @@ static void init_globals(void) string_set(&Globals.szTemplateShell, "/bin/false"); string_set(&Globals.szTemplateHomedir, "/home/%D/%U"); + string_set(&Globals.szTemplatePrimaryGroup, "nobody"); string_set(&Globals.szWinbindSeparator, "\\"); string_set(&Globals.szAclCompat, ""); - Globals.winbind_cache_time = 600; /* 5 minutes */ + Globals.winbind_cache_time = 300; /* 5 minutes */ + Globals.bWinbindEnableLocalAccounts = True; Globals.bWinbindEnumUsers = True; Globals.bWinbindEnumGroups = True; Globals.bWinbindUseDefaultDomain = False; + Globals.bWinbindTrustedDomainsOnly = False; - Globals.bIdmapOnly = False; + Globals.bEnableRidAlgorithm = True; Globals.name_cache_timeout = 660; /* In seconds */ @@ -1496,8 +1531,7 @@ void lp_talloc_free(void) static char *lp_string(const char *s) { - size_t len = s ? strlen(s) : 0; - char *ret; + char *ret, *tmpstr; /* The follow debug is useful for tracking down memory problems especially if you have an inner loop that is calling a lp_*() @@ -1511,25 +1545,16 @@ static char *lp_string(const char *s) if (!lp_talloc) lp_talloc = talloc_init("lp_talloc"); - ret = (char *)talloc(lp_talloc, len + 100); /* leave room for substitution */ - - if (!ret) - return NULL; - - /* Note: StrnCpy touches len+1 bytes, but we allocate 100 - * extra bytes so we're OK. */ - - if (!s) - *ret = 0; - else - StrnCpy(ret, s, len); - - if (trim_string(ret, "\"", "\"")) { - if (strchr(ret,'"') != NULL) - StrnCpy(ret, s, len); + tmpstr = alloc_sub_basic(current_user_info.smb_name, s); + if (trim_string(tmpstr, "\"", "\"")) { + if (strchr(tmpstr,'"') != NULL) { + SAFE_FREE(tmpstr); + tmpstr = alloc_sub_basic(current_user_info.smb_name,s); + } } - - standard_sub_basic(current_user_info.smb_name,ret,len+100); + ret = talloc_strdup(lp_talloc, tmpstr); + SAFE_FREE(tmpstr); + return (ret); } @@ -1582,16 +1607,16 @@ FN_GLOBAL_STRING(lp_lockdir, &Globals.szLockDir) FN_GLOBAL_STRING(lp_piddir, &Globals.szPidDir) FN_GLOBAL_STRING(lp_mangling_method, &Globals.szManglingMethod) FN_GLOBAL_INTEGER(lp_mangle_prefix, &Globals.mangle_prefix) -#ifdef WITH_UTMP FN_GLOBAL_STRING(lp_utmpdir, &Globals.szUtmpDir) FN_GLOBAL_STRING(lp_wtmpdir, &Globals.szWtmpDir) FN_GLOBAL_BOOL(lp_utmp, &Globals.bUtmp) -#endif FN_GLOBAL_STRING(lp_rootdir, &Globals.szRootdir) FN_GLOBAL_STRING(lp_source_environment, &Globals.szSourceEnv) FN_GLOBAL_STRING(lp_defaultservice, &Globals.szDefaultService) FN_GLOBAL_STRING(lp_msg_command, &Globals.szMsgCommand) FN_GLOBAL_STRING(lp_dfree_command, &Globals.szDfree) +FN_GLOBAL_STRING(lp_get_quota_command, &Globals.szGetQuota) +FN_GLOBAL_STRING(lp_set_quota_command, &Globals.szSetQuota) FN_GLOBAL_STRING(lp_hosts_equiv, &Globals.szHostsEquiv) FN_GLOBAL_STRING(lp_auto_services, &Globals.szAutoServices) FN_GLOBAL_STRING(lp_passwd_program, &Globals.szPasswdProgram) @@ -1599,7 +1624,6 @@ FN_GLOBAL_STRING(lp_passwd_chat, &Globals.szPasswdChat) FN_GLOBAL_STRING(lp_passwordserver, &Globals.szPasswordServer) FN_GLOBAL_STRING(lp_name_resolve_order, &Globals.szNameResolveOrder) FN_GLOBAL_STRING(lp_realm, &Globals.szRealm) -FN_GLOBAL_STRING(lp_ads_server, &Globals.szADSserver) FN_GLOBAL_STRING(lp_username_map, &Globals.szUsernameMap) FN_GLOBAL_CONST_STRING(lp_logon_script, &Globals.szLogonScript) FN_GLOBAL_CONST_STRING(lp_logon_path, &Globals.szLogonPath) @@ -1633,16 +1657,19 @@ FN_GLOBAL_STRING(lp_abort_shutdown_script, &Globals.szAbortShutdownScript) FN_GLOBAL_STRING(lp_wins_hook, &Globals.szWINSHook) FN_GLOBAL_STRING(lp_wins_partners, &Globals.szWINSPartners) +FN_GLOBAL_STRING(lp_template_primary_group, &Globals.szTemplatePrimaryGroup) FN_GLOBAL_STRING(lp_template_homedir, &Globals.szTemplateHomedir) FN_GLOBAL_STRING(lp_template_shell, &Globals.szTemplateShell) FN_GLOBAL_CONST_STRING(lp_winbind_separator, &Globals.szWinbindSeparator) FN_GLOBAL_STRING(lp_acl_compatibility, &Globals.szAclCompat) +FN_GLOBAL_BOOL(lp_winbind_enable_local_accounts, &Globals.bWinbindEnableLocalAccounts) FN_GLOBAL_BOOL(lp_winbind_enum_users, &Globals.bWinbindEnumUsers) FN_GLOBAL_BOOL(lp_winbind_enum_groups, &Globals.bWinbindEnumGroups) FN_GLOBAL_BOOL(lp_winbind_use_default_domain, &Globals.bWinbindUseDefaultDomain) +FN_GLOBAL_BOOL(lp_winbind_trusted_domains_only, &Globals.bWinbindTrustedDomainsOnly) FN_GLOBAL_STRING(lp_idmap_backend, &Globals.szIdmapBackend) -FN_GLOBAL_BOOL(lp_idmap_only, &Globals.bIdmapOnly) +FN_GLOBAL_BOOL(lp_enable_rid_algorithm, &Globals.bEnableRidAlgorithm) #ifdef WITH_LDAP_SAMCONFIG FN_GLOBAL_STRING(lp_ldap_server, &Globals.szLdapServer) @@ -1651,6 +1678,8 @@ FN_GLOBAL_INTEGER(lp_ldap_port, &Globals.ldap_port) FN_GLOBAL_STRING(lp_ldap_suffix, &Globals.szLdapSuffix) FN_GLOBAL_STRING(lp_ldap_machine_suffix, &Globals.szLdapMachineSuffix) FN_GLOBAL_STRING(lp_ldap_user_suffix, &Globals.szLdapUserSuffix) +FN_GLOBAL_STRING(lp_ldap_idmap_suffix, &Globals.szLdapIdmapSuffix) +FN_GLOBAL_STRING(lp_ldap_group_suffix, &Globals.szLdapGroupSuffix) FN_GLOBAL_STRING(lp_ldap_filter, &Globals.szLdapFilter) FN_GLOBAL_STRING(lp_ldap_admin_dn, &Globals.szLdapAdminDn) FN_GLOBAL_INTEGER(lp_ldap_ssl, &Globals.ldap_ssl) @@ -1702,6 +1731,7 @@ FN_GLOBAL_BOOL(lp_allow_trusted_domains, &Globals.bAllowTrustedDomains) FN_GLOBAL_INTEGER(lp_restrict_anonymous, &Globals.restrict_anonymous) FN_GLOBAL_BOOL(lp_lanman_auth, &Globals.bLanmanAuth) FN_GLOBAL_BOOL(lp_ntlm_auth, &Globals.bNTLMAuth) +FN_GLOBAL_BOOL(lp_client_plaintext_auth, &Globals.bClientPlaintextAuth) FN_GLOBAL_BOOL(lp_client_lanman_auth, &Globals.bClientLanManAuth) FN_GLOBAL_BOOL(lp_client_ntlmv2_auth, &Globals.bClientNTLMv2Auth) FN_GLOBAL_BOOL(lp_host_msdfs, &Globals.bHostMSDfs) @@ -1740,7 +1770,6 @@ FN_GLOBAL_INTEGER(lp_lm_announce, &Globals.lm_announce) FN_GLOBAL_INTEGER(lp_lm_interval, &Globals.lm_interval) FN_GLOBAL_INTEGER(lp_machine_password_timeout, &Globals.machine_password_timeout) FN_GLOBAL_INTEGER(lp_change_notify_timeout, &Globals.change_notify_timeout) -FN_GLOBAL_INTEGER(lp_stat_cache_size, &Globals.stat_cache_size) FN_GLOBAL_INTEGER(lp_map_to_guest, &Globals.map_to_guest) FN_GLOBAL_INTEGER(lp_min_passwd_length, &Globals.min_passwd_length) FN_GLOBAL_INTEGER(lp_oplock_break_wait_time, &Globals.oplock_break_wait_time) @@ -1777,9 +1806,7 @@ FN_LOCAL_LIST(lp_readlist, readlist) FN_LOCAL_LIST(lp_writelist, writelist) FN_LOCAL_LIST(lp_printer_admin, printer_admin) FN_LOCAL_STRING(lp_fstype, fstype) -FN_LOCAL_LIST(lp_vfsobj, szVfsObjectFile) -FN_LOCAL_STRING(lp_vfs_options, szVfsOptions) -FN_LOCAL_STRING(lp_vfs_path, szVfsPath) +FN_LOCAL_LIST(lp_vfs_objects, szVfsObjects) FN_LOCAL_STRING(lp_msdfs_proxy, szMSDfsProxy) static FN_LOCAL_STRING(lp_volume, volume) FN_LOCAL_STRING(lp_mangled_map, szMangledMap) @@ -1835,6 +1862,7 @@ FN_LOCAL_BOOL(lp_default_devmode, bDefaultDevmode) FN_LOCAL_BOOL(lp_nt_acl_support, bNTAclSupport) FN_LOCAL_BOOL(lp_use_sendfile, bUseSendfile) FN_LOCAL_BOOL(lp_profile_acls, bProfileAcls) +FN_LOCAL_BOOL(lp_map_acl_inherit, bMap_acl_inherit) FN_LOCAL_INTEGER(lp_create_mask, iCreate_mask) FN_LOCAL_INTEGER(lp_force_create_mode, iCreate_force_mode) FN_LOCAL_INTEGER(lp_security_mask, iSecurity_mask) @@ -2259,6 +2287,7 @@ BOOL lp_add_home(const char *pszHomename, int iDefaultService, } else { pstrcpy(newHomedir, lp_pathname(iDefaultService)); string_sub(newHomedir,"%H", pszHomedir, sizeof(newHomedir)); + string_sub(newHomedir,"%S", pszHomename, sizeof(newHomedir)); } string_set(&ServicePtrs[i]->szPath, newHomedir); @@ -2475,7 +2504,7 @@ static void copy_service(service * pserviceDest, service * pserviceSource, BOOL case P_USTRING: string_set(dest_ptr, *(char **)src_ptr); - strupper(*(char **)dest_ptr); + strupper_m(*(char **)dest_ptr); break; case P_LIST: str_list_copy((char ***)dest_ptr, *(const char ***)src_ptr); @@ -2942,91 +2971,61 @@ static BOOL handle_debug_list( const char *pszParmValueIn, char **ptr ) } /*************************************************************************** - Handle the ldap machine suffix option. + Handle setting ldap suffix and determines whether ldap machine suffix needs + to be set as well. + + Set all of the sub suffix strings to be the 'ldap suffix' by default ***************************************************************************/ -static BOOL handle_ldap_machine_suffix( const char *pszParmValue, char **ptr) +static BOOL handle_ldap_suffix( const char *pszParmValue, char **ptr ) { - pstring suffix; - - pstrcpy(suffix, pszParmValue); - - if (! *Globals.szLdapSuffix ) { - string_set( ptr, suffix ); - return True; - } - - if (! strstr(suffix, Globals.szLdapSuffix) ) { - if ( *pszParmValue ) - pstrcat(suffix, ","); - pstrcat(suffix, Globals.szLdapSuffix); - } - string_set( ptr, suffix ); - return True; + pstring suffix; + + pstrcpy(suffix, pszParmValue); + + /* set defaults for the the sub-suffixes */ + + if (! *Globals.szLdapMachineSuffix ) + string_set(&Globals.szLdapMachineSuffix, suffix); + if (! *Globals.szLdapUserSuffix ) + string_set(&Globals.szLdapUserSuffix, suffix); + if (! *Globals.szLdapGroupSuffix ) + string_set(&Globals.szLdapGroupSuffix, suffix); + if (! *Globals.szLdapIdmapSuffix ) + string_set(&Globals.szLdapIdmapSuffix, suffix); + + string_set(ptr, suffix); + return True; } /*************************************************************************** - Handle the ldap user suffix option. + Handle the ldap sub suffix option. + Always append the 'ldap suffix' if it is set ***************************************************************************/ -static BOOL handle_ldap_user_suffix( const char *pszParmValue, char **ptr) +static BOOL handle_ldap_sub_suffix( const char *pszParmValue, char **ptr) { - pstring suffix; + pstring suffix; - pstrcpy(suffix, pszParmValue); + pstrcpy(suffix, pszParmValue); - if (! *Globals.szLdapSuffix ) { - string_set( ptr, suffix ); - return True; - } - - if (! strstr(suffix, Globals.szLdapSuffix) ) { - if ( *pszParmValue ) - pstrcat(suffix, ","); - pstrcat(suffix, Globals.szLdapSuffix); - } - string_set( ptr, suffix ); - return True; + if (! *Globals.szLdapSuffix ) { + string_set( ptr, suffix ); + return True; + } + else { + if ( *pszParmValue ) + pstrcat(suffix, ","); + pstrcat(suffix, Globals.szLdapSuffix); + } + + string_set( ptr, suffix ); + return True; } /*************************************************************************** - Handle setting ldap suffix and determines whether ldap machine suffix needs - to be set as well. ***************************************************************************/ -static BOOL handle_ldap_suffix( const char *pszParmValue, char **ptr) -{ - pstring suffix; - pstring user_suffix; - pstring machine_suffix; - - pstrcpy(suffix, pszParmValue); - - if (! *Globals.szLdapMachineSuffix ) - string_set(&Globals.szLdapMachineSuffix, suffix); - if (! *Globals.szLdapUserSuffix ) - string_set(&Globals.szLdapUserSuffix, suffix); - - if (! strstr(Globals.szLdapMachineSuffix, suffix)) { - pstrcpy(machine_suffix, Globals.szLdapMachineSuffix); - if ( *Globals.szLdapMachineSuffix ) - pstrcat(machine_suffix, ","); - pstrcat(machine_suffix, suffix); - string_set(&Globals.szLdapMachineSuffix, machine_suffix); - } - - if (! strstr(Globals.szLdapUserSuffix, suffix)) { - pstrcpy(user_suffix, Globals.szLdapUserSuffix); - if ( *Globals.szLdapUserSuffix ) - pstrcat(user_suffix, ","); - pstrcat(user_suffix, suffix); - string_set(&Globals.szLdapUserSuffix, user_suffix); - } - - string_set(ptr, suffix); - return True; -} - static BOOL handle_acl_compatibility(const char *pszParmValue, char **ptr) { if (strequal(pszParmValue, "auto")) @@ -3040,6 +3039,7 @@ static BOOL handle_acl_compatibility(const char *pszParmValue, char **ptr) return True; } + /*************************************************************************** Initialise a copymap. ***************************************************************************/ @@ -3201,7 +3201,7 @@ BOOL lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue case P_USTRING: string_set(parm_ptr, pszParmValue); - strupper(*(char **)parm_ptr); + strupper_m(*(char **)parm_ptr); break; case P_GSTRING: @@ -3210,7 +3210,7 @@ BOOL lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue case P_UGSTRING: pstrcpy((char *)parm_ptr, pszParmValue); - strupper((char *)parm_ptr); + strupper_m((char *)parm_ptr); break; case P_ENUM: @@ -3858,6 +3858,19 @@ static void set_server_role(void) } } +/*********************************************************** + If we should send plaintext/LANMAN passwords in the clinet +************************************************************/ +static void set_allowed_client_auth(void) +{ + if (Globals.bClientNTLMv2Auth) { + Globals.bClientLanManAuth = False; + } + if (!Globals.bClientLanManAuth) { + Globals.bClientPlaintextAuth = False; + } +} + /*************************************************************************** Load the services array from the services file. Return True on success, False on failure. @@ -3925,6 +3938,7 @@ BOOL lp_load(const char *pszFname, BOOL global_only, BOOL save_defaults, set_server_role(); set_default_server_announce_type(); + set_allowed_client_auth(); bLoaded = True; @@ -4242,7 +4256,7 @@ void lp_set_logfile(const char *name) } /******************************************************************* - Return the NetBIOS called name. + Return the NetBIOS called name, or my IP - but never global_myname(). ********************************************************************/ const char *get_called_name(void) @@ -4250,22 +4264,11 @@ const char *get_called_name(void) extern fstring local_machine; static fstring called_name; - if (! *local_machine) - return global_myname(); - - /* - * Windows NT/2k uses "*SMBSERVER" and XP uses "*SMBSERV" - * arrggg!!! but we've already rewritten the client's - * netbios name at this point... - */ - - if (*local_machine) { - if (!StrCaseCmp(local_machine, "_SMBSERVER") || !StrCaseCmp(local_machine, "_SMBSERV")) { - fstrcpy(called_name, get_my_primary_ip()); - DEBUG(8,("get_called_name: assuming that client used IP address [%s] as called name.\n", - called_name)); - return called_name; - } + if (!*local_machine) { + fstrcpy(called_name, get_my_primary_ip()); + DEBUG(8,("get_called_name: assuming that client used IP address [%s] as called name.\n", + called_name)); + return called_name; } return local_machine; diff --git a/source3/passdb/machine_sid.c b/source3/passdb/machine_sid.c index a578ecc711..4e7476781c 100644 --- a/source3/passdb/machine_sid.c +++ b/source3/passdb/machine_sid.c @@ -191,8 +191,9 @@ DOM_SID *get_global_sam_sid(void) /* memory for global_sam_sid is allocated in pdb_generate_sam_sid() as needed */ - if (!pdb_generate_sam_sid()) - global_sam_sid=NULL; + if (!pdb_generate_sam_sid()) { + smb_panic("Could not generate a machine SID\n"); + } return global_sam_sid; } diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c index f34513b225..9a99e07d82 100644 --- a/source3/passdb/passdb.c +++ b/source3/passdb/passdb.c @@ -27,6 +27,30 @@ #undef DBGC_CLASS #define DBGC_CLASS DBGC_PASSDB +/****************************************************************** + get the default domain/netbios name to be used when + testing authentication. For example, if you connect + to a Windows member server using a bogus domain name, the + Windows box will map the BOGUS\user to DOMAIN\user. A + standalone box will map to WKS\user. +******************************************************************/ + +const char *get_default_sam_name(void) +{ + /* standalone servers can only use the local netbios name */ + if ( lp_server_role() == ROLE_STANDALONE ) + return global_myname(); + + /* Windows domain members default to the DOMAIN + name when not specified */ + return lp_workgroup(); +} + +/****************************************************************** + get the default domain/netbios name to be used when dealing + with our passdb list of accounts +******************************************************************/ + const char *get_global_sam_name(void) { if ((lp_server_role() == ROLE_DOMAIN_PDC) || (lp_server_role() == ROLE_DOMAIN_BDC)) { @@ -190,7 +214,7 @@ NTSTATUS pdb_fill_sam_pw(SAM_ACCOUNT *sam_account, const struct passwd *pwd) */ ret = pdb_set_sam_sids(sam_account, pwd); - if (NT_STATUS_IS_ERR(ret)) return ret; + if (!NT_STATUS_IS_OK(ret)) return ret; /* check if this is a user account or a machine account */ if (pwd->pw_name[strlen(pwd->pw_name)-1] != '$') @@ -266,41 +290,37 @@ NTSTATUS pdb_init_sam_pw(SAM_ACCOUNT **new_sam_acct, const struct passwd *pwd) /************************************************************* Initialises a SAM_ACCOUNT ready to add a new account, based - on the unix user if possible. + on the UNIX user. Pass in a RID if you have one ************************************************************/ -NTSTATUS pdb_init_sam_new(SAM_ACCOUNT **new_sam_acct, const char *username) +NTSTATUS pdb_init_sam_new(SAM_ACCOUNT **new_sam_acct, const char *username, + uint32 rid) { - NTSTATUS nt_status = NT_STATUS_NO_MEMORY; - - struct passwd *pwd; + NTSTATUS nt_status = NT_STATUS_NO_MEMORY; + struct passwd *pwd; + BOOL ret; pwd = Get_Pwnam(username); - if (pwd) { - if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam_pw(new_sam_acct, pwd))) { - *new_sam_acct = NULL; - return nt_status; - } - } else { - DOM_SID g_sid; - if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(new_sam_acct))) { - *new_sam_acct = NULL; - return nt_status; - } - if (!pdb_set_username(*new_sam_acct, username, PDB_SET)) { - pdb_free_sam(new_sam_acct); - return nt_status; - } - - pdb_set_domain (*new_sam_acct, get_global_sam_name(), PDB_DEFAULT); - - /* set Domain Users by default ! */ - sid_copy(&g_sid, get_global_sam_sid()); - sid_append_rid(&g_sid, DOMAIN_GROUP_RID_USERS); - pdb_set_group_sid(*new_sam_acct, &g_sid, PDB_SET); + if (!pwd) + return NT_STATUS_NO_SUCH_USER; + + if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam_pw(new_sam_acct, pwd))) { + *new_sam_acct = NULL; + return nt_status; } - return NT_STATUS_OK; + + /* see if we need to generate a new rid using the 2.2 algorithm */ + if ( rid == 0 && lp_enable_rid_algorithm() ) { + DEBUG(10,("pdb_init_sam_new: no RID specified. Generating one via old algorithm\n")); + rid = fallback_pdb_uid_to_user_rid(pwd->pw_uid); + } + + /* set the new SID */ + + ret = pdb_set_user_sid_from_rid( *new_sam_acct, rid, PDB_SET ); + + return (ret ? NT_STATUS_OK : NT_STATUS_NO_SUCH_USER); } @@ -323,6 +343,10 @@ static void pdb_free_sam_contents(SAM_ACCOUNT *user) data_blob_clear_free(&(user->private.nt_pw)); if (user->private.plaintext_pw!=NULL) memset(user->private.plaintext_pw,'\0',strlen(user->private.plaintext_pw)); + + if (user->private.backend_private_data && user->private.backend_private_data_free_fn) { + user->private.backend_private_data_free_fn(&user->private.backend_private_data); + } } @@ -413,7 +437,7 @@ NTSTATUS pdb_set_sam_sids(SAM_ACCOUNT *account_data, const struct passwd *pwd) } /* call the mapping code here */ - if(pdb_getgrgid(&map, pwd->pw_gid, MAPPING_WITHOUT_PRIV)) { + if(pdb_getgrgid(&map, pwd->pw_gid)) { if (!pdb_set_group_sid(account_data, &map.sid, PDB_SET)){ DEBUG(0,("Can't set Group SID!\n")); return NT_STATUS_INVALID_PARAMETER; @@ -557,7 +581,7 @@ BOOL pdb_gethexpwd(const char *p, unsigned char *pwd) return (True); } -static int algorithmic_rid_base(void) +int algorithmic_rid_base(void) { static int rid_offset = 0; @@ -706,7 +730,10 @@ BOOL local_lookup_sid(DOM_SID *sid, char *name, enum SID_NAME_USE *psid_name_use } /* see if the passdb can help us with the name of the user */ + + become_root(); if (pdb_getsampwsid(sam_account, sid)) { + unbecome_root(); fstrcpy(name, pdb_get_username(sam_account)); *psid_name_use = SID_NAME_USER; @@ -714,10 +741,10 @@ BOOL local_lookup_sid(DOM_SID *sid, char *name, enum SID_NAME_USE *psid_name_use return True; } - + unbecome_root(); pdb_free_sam(&sam_account); - if (pdb_getgrsid(&map, *sid, MAPPING_WITHOUT_PRIV)) { + if (pdb_getgrsid(&map, *sid)) { if (map.gid!=(gid_t)-1) { DEBUG(5,("local_lookup_sid: mapped group %s to gid %u\n", map.nt_name, (unsigned int)map.gid)); } else { @@ -812,13 +839,16 @@ BOOL local_lookup_name(const char *c_user, DOM_SID *psid, enum SID_NAME_USE *psi return False; } + become_root(); if (pdb_getsampwnam(sam_account, user)) { + unbecome_root(); sid_copy(psid, pdb_get_user_sid(sam_account)); *psid_name_use = SID_NAME_USER; pdb_free_sam(&sam_account); return True; } + unbecome_root(); pdb_free_sam(&sam_account); @@ -827,7 +857,7 @@ BOOL local_lookup_name(const char *c_user, DOM_SID *psid, enum SID_NAME_USE *psi */ /* check if it's a mapped group */ - if (pdb_getgrnam(&map, user, MAPPING_WITHOUT_PRIV)) { + if (pdb_getgrnam(&map, user)) { /* yes it's a mapped group */ sid_copy(&local_sid, &map.sid); *psid_name_use = map.sid_name_use; @@ -849,7 +879,7 @@ BOOL local_lookup_name(const char *c_user, DOM_SID *psid, enum SID_NAME_USE *psi * JFM, 30/11/2001 */ - if (pdb_getgrgid(&map, grp->gr_gid, MAPPING_WITHOUT_PRIV)){ + if (pdb_getgrgid(&map, grp->gr_gid)){ return False; } @@ -864,10 +894,6 @@ BOOL local_lookup_name(const char *c_user, DOM_SID *psid, enum SID_NAME_USE *psi /************************************************************* Change a password entry in the local smbpasswd file. - -It is currently being called by SWAT and by smbpasswd. - - --jerry *************************************************************/ BOOL local_password_change(const char *user_name, int local_flags, @@ -883,12 +909,15 @@ BOOL local_password_change(const char *user_name, int local_flags, /* Get the smb passwd entry for this user */ pdb_init_sam(&sam_pass); + + become_root(); if(!pdb_getsampwnam(sam_pass, user_name)) { + unbecome_root(); pdb_free_sam(&sam_pass); if ((local_flags & LOCAL_ADD_USER) || (local_flags & LOCAL_DELETE_USER)) { - /* Might not exist in /etc/passwd */ - if (!NT_STATUS_IS_OK(pdb_init_sam_new(&sam_pass, user_name))) { + /* Might not exist in /etc/passwd. Use rid algorithm here */ + if (!NT_STATUS_IS_OK(pdb_init_sam_new(&sam_pass, user_name, 0))) { slprintf(err_str, err_str_len-1, "Failed initialise SAM_ACCOUNT for user %s.\n", user_name); return False; } @@ -897,6 +926,7 @@ BOOL local_password_change(const char *user_name, int local_flags, return False; } } else { + unbecome_root(); /* the entry already existed */ local_flags &= ~LOCAL_ADD_USER; } @@ -1012,3 +1042,637 @@ BOOL local_password_change(const char *user_name, int local_flags, pdb_free_sam(&sam_pass); return True; } + +/**************************************************************************** + Convert a uid to SID - locally. +****************************************************************************/ + +DOM_SID *local_uid_to_sid(DOM_SID *psid, uid_t uid) +{ + SAM_ACCOUNT *sampw = NULL; + struct passwd *unix_pw; + BOOL ret; + + unix_pw = sys_getpwuid( uid ); + + if ( !unix_pw ) { + DEBUG(4,("local_uid_to_sid: host has know idea of uid %d\n", uid)); + return NULL; + } + + if ( !NT_STATUS_IS_OK(pdb_init_sam(&sampw)) ) { + DEBUG(0,("local_uid_to_sid: failed to allocate SAM_ACCOUNT object\n")); + return NULL; + } + + become_root(); + ret = pdb_getsampwnam( sampw, unix_pw->pw_name ); + unbecome_root(); + + if ( ret ) + sid_copy( psid, pdb_get_user_sid(sampw) ); + else { + DEBUG(4,("local_uid_to_sid: User %s [uid == %d] has no samba account\n", + unix_pw->pw_name, uid)); + + if ( !lp_enable_rid_algorithm() ) + return NULL; + + DEBUG(8,("local_uid_to_sid: falling back to RID algorithm\n")); + + sid_copy( psid, get_global_sam_sid() ); + sid_append_rid( psid, fallback_pdb_uid_to_user_rid(uid) ); + } + + + DEBUG(10,("local_uid_to_sid: uid (%d) -> SID %s (%s).\n", + (unsigned int)uid, sid_string_static(psid), unix_pw->pw_name)); + + return psid; +} + +/**************************************************************************** + Convert a SID to uid - locally. +****************************************************************************/ + +BOOL local_sid_to_uid(uid_t *puid, const DOM_SID *psid, enum SID_NAME_USE *name_type) +{ + SAM_ACCOUNT *sampw = NULL; + struct passwd *unix_pw; + const char *user_name; + + *name_type = SID_NAME_UNKNOWN; + + /* + * We can only convert to a uid if this is our local + * Domain SID (ie. we are the controling authority). + */ + if (!sid_check_is_in_our_domain(psid) ) { + DEBUG(5,("local_sid_to_uid: this SID (%s) is not from our domain\n", sid_string_static(psid))); + return False; + } + + /* lookup the user account */ + + if ( !NT_STATUS_IS_OK(pdb_init_sam(&sampw)) ) { + DEBUG(0,("local_sid_to_uid: Failed to allocate memory for SAM_ACCOUNT object\n")); + return False; + } + + become_root(); + if ( !pdb_getsampwsid(sampw, psid) ) { + unbecome_root(); + DEBUG(8,("local_sid_to_uid: Could not find SID %s in passdb\n", + sid_string_static(psid))); + return False; + } + unbecome_root(); + + user_name = pdb_get_username(sampw); + + unix_pw = sys_getpwnam( user_name ); + + if ( !unix_pw ) { + DEBUG(0,("local_sid_to_uid: %s found in passdb but getpwnam() return NULL!\n", + user_name)); + pdb_free_sam( &sampw ); + return False; + } + + *puid = unix_pw->pw_uid; + + DEBUG(10,("local_sid_to_uid: SID %s -> uid (%u) (%s).\n", sid_string_static(psid), + (unsigned int)*puid, user_name )); + + *name_type = SID_NAME_USER; + + return True; +} + +/**************************************************************************** + Convert a gid to SID - locally. +****************************************************************************/ + +DOM_SID *local_gid_to_sid(DOM_SID *psid, gid_t gid) +{ + GROUP_MAP group; + + /* we don't need to disable winbindd since the gid is stored in + the GROUP_MAP object */ + + if ( !pdb_getgrgid( &group, gid ) ) { + + /* fallback to rid mapping if enabled */ + + if ( lp_enable_rid_algorithm() ) { + sid_copy(psid, get_global_sam_sid()); + sid_append_rid(psid, pdb_gid_to_group_rid(gid)); + + DEBUG(10,("local_gid_to_sid: Fall back to algorithmic mapping: %u -> %s\n", + (unsigned int)gid, sid_string_static(psid))); + + return psid; + } + else + return NULL; + } + + sid_copy( psid, &group.sid ); + + DEBUG(10,("local_gid_to_sid: gid (%d) -> SID %s.\n", + (unsigned int)gid, sid_string_static(psid))); + + return psid; +} + +/**************************************************************************** + Convert a SID to gid - locally. +****************************************************************************/ + +BOOL local_sid_to_gid(gid_t *pgid, const DOM_SID *psid, enum SID_NAME_USE *name_type) +{ + uint32 rid; + GROUP_MAP group; + + *name_type = SID_NAME_UNKNOWN; + + /* This call can enumerate group mappings for foreign sids as well. + So don't check for a match against our domain SID */ + + /* we don't need to disable winbindd since the gid is stored in + the GROUP_MAP object */ + + if ( !pdb_getgrsid(&group, *psid) ) { + + /* fallback to rid mapping if enabled */ + + if ( lp_enable_rid_algorithm() ) { + + if (!sid_check_is_in_our_domain(psid) ) { + DEBUG(5,("local_sid_to_gid: RID algorithm only supported for our domain (%s is not)\n", sid_string_static(psid))); + return False; + } + + if (!sid_peek_rid(psid, &rid)) { + DEBUG(10,("local_sid_to_uid: invalid SID!\n")); + return False; + } + + DEBUG(10,("local_sid_to_gid: Fall back to algorithmic mapping\n")); + + if (fallback_pdb_rid_is_user(rid)) { + DEBUG(3, ("local_sid_to_gid: SID %s is *NOT* a group\n", sid_string_static(psid))); + return False; + } else { + *pgid = pdb_group_rid_to_gid(rid); + DEBUG(10,("local_sid_to_gid: mapping: %s -> %u\n", sid_string_static(psid), (unsigned int)(*pgid))); + return True; + } + } + + return False; + } + + *pgid = group.gid; + + DEBUG(10,("local_sid_to_gid: SID %s -> gid (%u)\n", sid_string_static(psid), + (unsigned int)*pgid)); + + return True; +} + +/********************************************************************** + Marshall/unmarshall SAM_ACCOUNT structs. + *********************************************************************/ + +#define TDB_FORMAT_STRING "ddddddBBBBBBBBBBBBddBBwdwdBdd" + +/********************************************************************** + Intialize a SAM_ACCOUNT struct from a BYTE buffer of size len + *********************************************************************/ + +BOOL init_sam_from_buffer(SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen) +{ + + /* times are stored as 32bit integer + take care on system with 64bit wide time_t + --SSS */ + uint32 logon_time, + logoff_time, + kickoff_time, + pass_last_set_time, + pass_can_change_time, + pass_must_change_time; + char *username; + char *domain; + char *nt_username; + char *dir_drive; + char *unknown_str; + char *munged_dial; + char *fullname; + char *homedir; + char *logon_script; + char *profile_path; + char *acct_desc; + char *workstations; + uint32 username_len, domain_len, nt_username_len, + dir_drive_len, unknown_str_len, munged_dial_len, + fullname_len, homedir_len, logon_script_len, + profile_path_len, acct_desc_len, workstations_len; + + uint32 user_rid, group_rid, unknown_3, hours_len, unknown_5, unknown_6; + uint16 acct_ctrl, logon_divs; + uint8 *hours; + static uint8 *lm_pw_ptr, *nt_pw_ptr; + uint32 len = 0; + uint32 lm_pw_len, nt_pw_len, hourslen; + BOOL ret = True; + uid_t uid = -1; + gid_t gid = -1; + + if(sampass == NULL || buf == NULL) { + DEBUG(0, ("init_sam_from_buffer: NULL parameters found!\n")); + return False; + } + + /* unpack the buffer into variables */ + len = tdb_unpack (buf, buflen, TDB_FORMAT_STRING, + &logon_time, + &logoff_time, + &kickoff_time, + &pass_last_set_time, + &pass_can_change_time, + &pass_must_change_time, + &username_len, &username, + &domain_len, &domain, + &nt_username_len, &nt_username, + &fullname_len, &fullname, + &homedir_len, &homedir, + &dir_drive_len, &dir_drive, + &logon_script_len, &logon_script, + &profile_path_len, &profile_path, + &acct_desc_len, &acct_desc, + &workstations_len, &workstations, + &unknown_str_len, &unknown_str, + &munged_dial_len, &munged_dial, + &user_rid, + &group_rid, + &lm_pw_len, &lm_pw_ptr, + &nt_pw_len, &nt_pw_ptr, + &acct_ctrl, + &unknown_3, + &logon_divs, + &hours_len, + &hourslen, &hours, + &unknown_5, + &unknown_6); + + if (len == -1) { + ret = False; + goto done; + } + + pdb_set_logon_time(sampass, logon_time, PDB_SET); + pdb_set_logoff_time(sampass, logoff_time, PDB_SET); + pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET); + pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET); + pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET); + pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET); + + pdb_set_username(sampass, username, PDB_SET); + pdb_set_domain(sampass, domain, PDB_SET); + pdb_set_nt_username(sampass, nt_username, PDB_SET); + pdb_set_fullname(sampass, fullname, PDB_SET); + + if (homedir) { + pdb_set_homedir(sampass, homedir, PDB_SET); + } + else { + pdb_set_homedir(sampass, + talloc_sub_specified(sampass->mem_ctx, + lp_logon_home(), + username, domain, + uid, gid), + PDB_DEFAULT); + } + + if (dir_drive) + pdb_set_dir_drive(sampass, dir_drive, PDB_SET); + else { + pdb_set_dir_drive(sampass, + talloc_sub_specified(sampass->mem_ctx, + lp_logon_drive(), + username, domain, + uid, gid), + PDB_DEFAULT); + } + + if (logon_script) + pdb_set_logon_script(sampass, logon_script, PDB_SET); + else { + pdb_set_logon_script(sampass, + talloc_sub_specified(sampass->mem_ctx, + lp_logon_script(), + username, domain, + uid, gid), + PDB_DEFAULT); + } + + if (profile_path) { + pdb_set_profile_path(sampass, profile_path, PDB_SET); + } else { + pdb_set_profile_path(sampass, + talloc_sub_specified(sampass->mem_ctx, + lp_logon_path(), + username, domain, + uid, gid), + PDB_DEFAULT); + } + + pdb_set_acct_desc(sampass, acct_desc, PDB_SET); + pdb_set_workstations(sampass, workstations, PDB_SET); + pdb_set_munged_dial(sampass, munged_dial, PDB_SET); + + if (lm_pw_ptr && lm_pw_len == LM_HASH_LEN) { + if (!pdb_set_lanman_passwd(sampass, lm_pw_ptr, PDB_SET)) { + ret = False; + goto done; + } + } + + if (nt_pw_ptr && nt_pw_len == NT_HASH_LEN) { + if (!pdb_set_nt_passwd(sampass, nt_pw_ptr, PDB_SET)) { + ret = False; + goto done; + } + } + + pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET); + pdb_set_group_sid_from_rid(sampass, group_rid, PDB_SET); + pdb_set_unknown_3(sampass, unknown_3, PDB_SET); + pdb_set_hours_len(sampass, hours_len, PDB_SET); + pdb_set_unknown_5(sampass, unknown_5, PDB_SET); + pdb_set_unknown_6(sampass, unknown_6, PDB_SET); + pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET); + pdb_set_logon_divs(sampass, logon_divs, PDB_SET); + pdb_set_hours(sampass, hours, PDB_SET); + +done: + + SAFE_FREE(username); + SAFE_FREE(domain); + SAFE_FREE(nt_username); + SAFE_FREE(fullname); + SAFE_FREE(homedir); + SAFE_FREE(dir_drive); + SAFE_FREE(logon_script); + SAFE_FREE(profile_path); + SAFE_FREE(acct_desc); + SAFE_FREE(workstations); + SAFE_FREE(munged_dial); + SAFE_FREE(unknown_str); + SAFE_FREE(hours); + + return ret; +} + +/********************************************************************** + Intialize a BYTE buffer from a SAM_ACCOUNT struct + *********************************************************************/ + +uint32 init_buffer_from_sam (uint8 **buf, const SAM_ACCOUNT *sampass, BOOL size_only) +{ + size_t len, buflen; + + /* times are stored as 32bit integer + take care on system with 64bit wide time_t + --SSS */ + uint32 logon_time, + logoff_time, + kickoff_time, + pass_last_set_time, + pass_can_change_time, + pass_must_change_time; + + uint32 user_rid, group_rid; + + const char *username; + const char *domain; + const char *nt_username; + const char *dir_drive; + const char *unknown_str; + const char *munged_dial; + const char *fullname; + const char *homedir; + const char *logon_script; + const char *profile_path; + const char *acct_desc; + const char *workstations; + uint32 username_len, domain_len, nt_username_len, + dir_drive_len, unknown_str_len, munged_dial_len, + fullname_len, homedir_len, logon_script_len, + profile_path_len, acct_desc_len, workstations_len; + + const uint8 *lm_pw; + const uint8 *nt_pw; + uint32 lm_pw_len = 16; + uint32 nt_pw_len = 16; + + /* do we have a valid SAM_ACCOUNT pointer? */ + if (sampass == NULL) { + DEBUG(0, ("init_buffer_from_sam: SAM_ACCOUNT is NULL!\n")); + return -1; + } + + *buf = NULL; + buflen = 0; + + logon_time = (uint32)pdb_get_logon_time(sampass); + logoff_time = (uint32)pdb_get_logoff_time(sampass); + kickoff_time = (uint32)pdb_get_kickoff_time(sampass); + pass_can_change_time = (uint32)pdb_get_pass_can_change_time(sampass); + pass_must_change_time = (uint32)pdb_get_pass_must_change_time(sampass); + pass_last_set_time = (uint32)pdb_get_pass_last_set_time(sampass); + + user_rid = pdb_get_user_rid(sampass); + group_rid = pdb_get_group_rid(sampass); + + username = pdb_get_username(sampass); + if (username) + username_len = strlen(username) +1; + else + username_len = 0; + + domain = pdb_get_domain(sampass); + if (domain) + domain_len = strlen(domain) +1; + else + domain_len = 0; + + nt_username = pdb_get_nt_username(sampass); + if (nt_username) + nt_username_len = strlen(nt_username) +1; + else + nt_username_len = 0; + + fullname = pdb_get_fullname(sampass); + if (fullname) + fullname_len = strlen(fullname) +1; + else + fullname_len = 0; + + /* + * Only updates fields which have been set (not defaults from smb.conf) + */ + + if (!IS_SAM_DEFAULT(sampass, PDB_DRIVE)) + dir_drive = pdb_get_dir_drive(sampass); + else + dir_drive = NULL; + if (dir_drive) + dir_drive_len = strlen(dir_drive) +1; + else + dir_drive_len = 0; + + if (!IS_SAM_DEFAULT(sampass, PDB_SMBHOME)) + homedir = pdb_get_homedir(sampass); + else + homedir = NULL; + if (homedir) + homedir_len = strlen(homedir) +1; + else + homedir_len = 0; + + if (!IS_SAM_DEFAULT(sampass, PDB_LOGONSCRIPT)) + logon_script = pdb_get_logon_script(sampass); + else + logon_script = NULL; + if (logon_script) + logon_script_len = strlen(logon_script) +1; + else + logon_script_len = 0; + + if (!IS_SAM_DEFAULT(sampass, PDB_PROFILE)) + profile_path = pdb_get_profile_path(sampass); + else + profile_path = NULL; + if (profile_path) + profile_path_len = strlen(profile_path) +1; + else + profile_path_len = 0; + + lm_pw = pdb_get_lanman_passwd(sampass); + if (!lm_pw) + lm_pw_len = 0; + + nt_pw = pdb_get_nt_passwd(sampass); + if (!nt_pw) + nt_pw_len = 0; + + acct_desc = pdb_get_acct_desc(sampass); + if (acct_desc) + acct_desc_len = strlen(acct_desc) +1; + else + acct_desc_len = 0; + + workstations = pdb_get_workstations(sampass); + if (workstations) + workstations_len = strlen(workstations) +1; + else + workstations_len = 0; + + unknown_str = NULL; + unknown_str_len = 0; + + munged_dial = pdb_get_munged_dial(sampass); + if (munged_dial) + munged_dial_len = strlen(munged_dial) +1; + else + munged_dial_len = 0; + + /* one time to get the size needed */ + len = tdb_pack(NULL, 0, TDB_FORMAT_STRING, + logon_time, + logoff_time, + kickoff_time, + pass_last_set_time, + pass_can_change_time, + pass_must_change_time, + username_len, username, + domain_len, domain, + nt_username_len, nt_username, + fullname_len, fullname, + homedir_len, homedir, + dir_drive_len, dir_drive, + logon_script_len, logon_script, + profile_path_len, profile_path, + acct_desc_len, acct_desc, + workstations_len, workstations, + unknown_str_len, unknown_str, + munged_dial_len, munged_dial, + user_rid, + group_rid, + lm_pw_len, lm_pw, + nt_pw_len, nt_pw, + pdb_get_acct_ctrl(sampass), + pdb_get_unknown_3(sampass), + pdb_get_logon_divs(sampass), + pdb_get_hours_len(sampass), + MAX_HOURS_LEN, pdb_get_hours(sampass), + pdb_get_unknown_5(sampass), + pdb_get_unknown_6(sampass)); + + + if (size_only) + return buflen; + + /* malloc the space needed */ + if ( (*buf=(uint8*)malloc(len)) == NULL) { + DEBUG(0,("init_buffer_from_sam: Unable to malloc() memory for buffer!\n")); + return (-1); + } + + /* now for the real call to tdb_pack() */ + buflen = tdb_pack(*buf, len, TDB_FORMAT_STRING, + logon_time, + logoff_time, + kickoff_time, + pass_last_set_time, + pass_can_change_time, + pass_must_change_time, + username_len, username, + domain_len, domain, + nt_username_len, nt_username, + fullname_len, fullname, + homedir_len, homedir, + dir_drive_len, dir_drive, + logon_script_len, logon_script, + profile_path_len, profile_path, + acct_desc_len, acct_desc, + workstations_len, workstations, + unknown_str_len, unknown_str, + munged_dial_len, munged_dial, + user_rid, + group_rid, + lm_pw_len, lm_pw, + nt_pw_len, nt_pw, + pdb_get_acct_ctrl(sampass), + pdb_get_unknown_3(sampass), + pdb_get_logon_divs(sampass), + pdb_get_hours_len(sampass), + MAX_HOURS_LEN, pdb_get_hours(sampass), + pdb_get_unknown_5(sampass), + pdb_get_unknown_6(sampass)); + + + /* check to make sure we got it correct */ + if (buflen != len) { + DEBUG(0, ("init_buffer_from_sam: somthing odd is going on here: bufflen (%d) != len (%d) in tdb_pack operations!\n", + buflen, len)); + /* error */ + SAFE_FREE (*buf); + return (-1); + } + + return (buflen); +} diff --git a/source3/passdb/pdb_get_set.c b/source3/passdb/pdb_get_set.c index c95719451a..ba07a4e01c 100644 --- a/source3/passdb/pdb_get_set.c +++ b/source3/passdb/pdb_get_set.c @@ -330,6 +330,14 @@ uint32 pdb_get_unknown_6 (const SAM_ACCOUNT *sampass) return (-1); } +void *pdb_get_backend_private_data (const SAM_ACCOUNT *sampass, const struct pdb_methods *my_methods) +{ + if (sampass && my_methods == sampass->private.backend_private_methods) + return sampass->private.backend_private_data; + else + return NULL; +} + /********************************************************************* Collection of set...() functions for SAM_ACCOUNT. ********************************************************************/ @@ -1011,6 +1019,29 @@ BOOL pdb_set_hours (SAM_ACCOUNT *sampass, const uint8 *hours, enum pdb_value_sta return pdb_set_init_flags(sampass, PDB_HOURS, flag); } +BOOL pdb_set_backend_private_data (SAM_ACCOUNT *sampass, void *private_data, + void (*free_fn)(void **), + const struct pdb_methods *my_methods, + enum pdb_value_state flag) +{ + if (!sampass) + return False; + + /* does this backend 'own' this SAM_ACCOUNT? */ + if (my_methods != sampass->private.backend_private_methods) + return False; + + if (sampass->private.backend_private_data && sampass->private.backend_private_data_free_fn) { + sampass->private.backend_private_data_free_fn(&sampass->private.backend_private_data); + } + + sampass->private.backend_private_data = private_data; + sampass->private.backend_private_data_free_fn = free_fn; + sampass->private.backend_private_methods = my_methods; + + return pdb_set_init_flags(sampass, PDB_BACKEND_PRIVATE_DATA, flag); +} + /* Helpful interfaces to the above */ diff --git a/source3/passdb/pdb_guest.c b/source3/passdb/pdb_guest.c index 359e2285a3..fa29657edc 100644 --- a/source3/passdb/pdb_guest.c +++ b/source3/passdb/pdb_guest.c @@ -98,6 +98,21 @@ static NTSTATUS guestsam_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUNT } +/*************************************************************************** + Updates a SAM_ACCOUNT + + This isn't a particulary practical option for pdb_guest. We certainly don't + want to twidde the filesystem, so what should we do? + + Current plan is to transparently add the account. It should appear + as if the pdb_guest version was modified, but its actually stored somehwere. + ****************************************************************************/ + +static NTSTATUS guestsam_update_sam_account (struct pdb_methods *methods, SAM_ACCOUNT *newpwd) +{ + return methods->parent->pdb_add_sam_account(methods->parent, newpwd); +} + NTSTATUS pdb_init_guestsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location) { NTSTATUS nt_status; @@ -115,6 +130,7 @@ NTSTATUS pdb_init_guestsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, c (*pdb_method)->getsampwnam = guestsam_getsampwnam; (*pdb_method)->getsampwsid = guestsam_getsampwsid; + (*pdb_method)->update_sam_account = guestsam_update_sam_account; /* we should do no group mapping here */ (*pdb_method)->getgrsid = pdb_nop_getgrsid; diff --git a/source3/passdb/pdb_interface.c b/source3/passdb/pdb_interface.c index 7b44df193f..5ebc14030f 100644 --- a/source3/passdb/pdb_interface.c +++ b/source3/passdb/pdb_interface.c @@ -74,7 +74,7 @@ static struct pdb_init_function_entry *pdb_find_backend_entry(const char *name) struct pdb_init_function_entry *entry = backends; while(entry) { - if (strcasecmp(entry->name, name) == 0) return entry; + if (strcmp(entry->name, name)==0) return entry; entry = entry->next; } @@ -258,7 +258,7 @@ static NTSTATUS context_delete_sam_account(struct pdb_context *context, SAM_ACCO } static NTSTATUS context_getgrsid(struct pdb_context *context, - GROUP_MAP *map, DOM_SID sid, BOOL with_priv) + GROUP_MAP *map, DOM_SID sid) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; @@ -269,7 +269,7 @@ static NTSTATUS context_getgrsid(struct pdb_context *context, } curmethods = context->pdb_methods; while (curmethods){ - ret = curmethods->getgrsid(curmethods, map, sid, with_priv); + ret = curmethods->getgrsid(curmethods, map, sid); if (NT_STATUS_IS_OK(ret)) { map->methods = curmethods; return ret; @@ -281,7 +281,7 @@ static NTSTATUS context_getgrsid(struct pdb_context *context, } static NTSTATUS context_getgrgid(struct pdb_context *context, - GROUP_MAP *map, gid_t gid, BOOL with_priv) + GROUP_MAP *map, gid_t gid) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; @@ -292,7 +292,7 @@ static NTSTATUS context_getgrgid(struct pdb_context *context, } curmethods = context->pdb_methods; while (curmethods){ - ret = curmethods->getgrgid(curmethods, map, gid, with_priv); + ret = curmethods->getgrgid(curmethods, map, gid); if (NT_STATUS_IS_OK(ret)) { map->methods = curmethods; return ret; @@ -304,7 +304,7 @@ static NTSTATUS context_getgrgid(struct pdb_context *context, } static NTSTATUS context_getgrnam(struct pdb_context *context, - GROUP_MAP *map, char *name, BOOL with_priv) + GROUP_MAP *map, const char *name) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; @@ -315,7 +315,7 @@ static NTSTATUS context_getgrnam(struct pdb_context *context, } curmethods = context->pdb_methods; while (curmethods){ - ret = curmethods->getgrnam(curmethods, map, name, with_priv); + ret = curmethods->getgrnam(curmethods, map, name); if (NT_STATUS_IS_OK(ret)) { map->methods = curmethods; return ret; @@ -371,7 +371,7 @@ static NTSTATUS context_delete_group_mapping_entry(struct pdb_context *context, static NTSTATUS context_enum_group_mapping(struct pdb_context *context, enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, int *num_entries, - BOOL unix_only, BOOL with_priv) + BOOL unix_only) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; @@ -382,8 +382,7 @@ static NTSTATUS context_enum_group_mapping(struct pdb_context *context, return context->pdb_methods->enum_group_mapping(context->pdb_methods, sid_name_use, rmap, - num_entries, unix_only, - with_priv); + num_entries, unix_only); } /****************************************************************** @@ -517,12 +516,21 @@ NTSTATUS make_pdb_context_list(struct pdb_context **context, const char **select int i = 0; struct pdb_methods *curmethods, *tmpmethods; NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL; + BOOL have_guest = False; if (!NT_STATUS_IS_OK(nt_status = make_pdb_context(context))) { return nt_status; } + if (!selected) { + DEBUG(0, ("ERROR: empty passdb backend list!\n")); + return nt_status; + } + while (selected[i]){ + if (strcmp(selected[i], "guest") == 0) { + have_guest = True; + } /* Try to initialise pdb */ DEBUG(5,("Trying to load: %s\n", selected[i])); if (!NT_STATUS_IS_OK(nt_status = make_pdb_methods_name(&curmethods, *context, selected[i]))) { @@ -535,6 +543,27 @@ NTSTATUS make_pdb_context_list(struct pdb_context **context, const char **select i++; } + if (have_guest) + return NT_STATUS_OK; + + if ( (lp_guestaccount() == NULL) || + (*lp_guestaccount() == '\0') ) { + /* We explicitly don't want guest access. No idea what + else that breaks, but be it that way. */ + return NT_STATUS_OK; + } + + if (!NT_STATUS_IS_OK(nt_status = make_pdb_methods_name(&curmethods, + *context, + "guest"))) { + DEBUG(1, ("Loading guest module failed!\n")); + free_pdb_context(context); + return nt_status; + } + + curmethods->parent = *context; + DLIST_ADD_END((*context)->pdb_methods, curmethods, tmpmethods); + return NT_STATUS_OK; } @@ -562,13 +591,13 @@ static struct pdb_context *pdb_get_static_context(BOOL reload) if ((pdb_context) && (reload)) { pdb_context->free_fn(&pdb_context); - if (NT_STATUS_IS_ERR(make_pdb_context_list(&pdb_context, lp_passdb_backend()))) { + if (!NT_STATUS_IS_OK(make_pdb_context_list(&pdb_context, lp_passdb_backend()))) { return NULL; } } if (!pdb_context) { - if (NT_STATUS_IS_ERR(make_pdb_context_list(&pdb_context, lp_passdb_backend()))) { + if (!NT_STATUS_IS_OK(make_pdb_context_list(&pdb_context, lp_passdb_backend()))) { return NULL; } } @@ -668,7 +697,7 @@ BOOL pdb_delete_sam_account(SAM_ACCOUNT *sam_acct) return NT_STATUS_IS_OK(pdb_context->pdb_delete_sam_account(pdb_context, sam_acct)); } -BOOL pdb_getgrsid(GROUP_MAP *map, DOM_SID sid, BOOL with_priv) +BOOL pdb_getgrsid(GROUP_MAP *map, DOM_SID sid) { struct pdb_context *pdb_context = pdb_get_static_context(False); @@ -677,10 +706,10 @@ BOOL pdb_getgrsid(GROUP_MAP *map, DOM_SID sid, BOOL with_priv) } return NT_STATUS_IS_OK(pdb_context-> - pdb_getgrsid(pdb_context, map, sid, with_priv)); + pdb_getgrsid(pdb_context, map, sid)); } -BOOL pdb_getgrgid(GROUP_MAP *map, gid_t gid, BOOL with_priv) +BOOL pdb_getgrgid(GROUP_MAP *map, gid_t gid) { struct pdb_context *pdb_context = pdb_get_static_context(False); @@ -689,10 +718,10 @@ BOOL pdb_getgrgid(GROUP_MAP *map, gid_t gid, BOOL with_priv) } return NT_STATUS_IS_OK(pdb_context-> - pdb_getgrgid(pdb_context, map, gid, with_priv)); + pdb_getgrgid(pdb_context, map, gid)); } -BOOL pdb_getgrnam(GROUP_MAP *map, char *name, BOOL with_priv) +BOOL pdb_getgrnam(GROUP_MAP *map, char *name) { struct pdb_context *pdb_context = pdb_get_static_context(False); @@ -701,7 +730,7 @@ BOOL pdb_getgrnam(GROUP_MAP *map, char *name, BOOL with_priv) } return NT_STATUS_IS_OK(pdb_context-> - pdb_getgrnam(pdb_context, map, name, with_priv)); + pdb_getgrnam(pdb_context, map, name)); } BOOL pdb_add_group_mapping_entry(GROUP_MAP *map) @@ -741,7 +770,7 @@ BOOL pdb_delete_group_mapping_entry(DOM_SID sid) } BOOL pdb_enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, - int *num_entries, BOOL unix_only, BOOL with_priv) + int *num_entries, BOOL unix_only) { struct pdb_context *pdb_context = pdb_get_static_context(False); @@ -751,8 +780,7 @@ BOOL pdb_enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, return NT_STATUS_IS_OK(pdb_context-> pdb_enum_group_mapping(pdb_context, sid_name_use, - rmap, num_entries, unix_only, - with_priv)); + rmap, num_entries, unix_only)); } /*************************************************************** diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c index fb63e81d28..a4ee4dbd4b 100644 --- a/source3/passdb/pdb_ldap.c +++ b/source3/passdb/pdb_ldap.c @@ -4,7 +4,7 @@ Copyright (C) Jean François Micouleau 1998 Copyright (C) Gerald Carter 2001-2003 Copyright (C) Shahms King 2001 - Copyright (C) Andrew Bartlett 2002 + Copyright (C) Andrew Bartlett 2002-2003 Copyright (C) Stefan (metze) Metzmacher 2002 This program is free software; you can redistribute it and/or modify @@ -51,218 +51,61 @@ #include #include -#ifndef LDAP_OPT_SUCCESS -#define LDAP_OPT_SUCCESS 0 +/* + * Work around versions of the LDAP client libs that don't have the OIDs + * defined, or have them defined under the old name. + * This functionality is really a factor of the server, not the client + * + */ + +#if defined(LDAP_EXOP_X_MODIFY_PASSWD) && !defined(LDAP_EXOP_MODIFY_PASSWD) +#define LDAP_EXOP_MODIFY_PASSWD LDAP_EXOP_X_MODIFY_PASSWD +#elif !defined(LDAP_EXOP_MODIFY_PASSWD) +#define "1.3.6.1.4.1.4203.1.11.1" #endif +#if defined(LDAP_EXOP_X_MODIFY_PASSWD_ID) && !defined(LDAP_EXOP_MODIFY_PASSWD_ID) +#define LDAP_TAG_EXOP_MODIFY_PASSWD_ID LDAP_EXOP_X_MODIFY_PASSWD_ID +#elif !defined(LDAP_EXOP_MODIFY_PASSWD_ID) +#define LDAP_TAG_EXOP_MODIFY_PASSWD_ID ((ber_tag_t) 0x80U) +#endif + +#if defined(LDAP_EXOP_X_MODIFY_PASSWD_NEW) && !defined(LDAP_EXOP_MODIFY_PASSWD_NEW) +#define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW LDAP_EXOP_X_MODIFY_PASSWD_NEW +#elif !defined(LDAP_EXOP_MODIFY_PASSWD_NEW) +#define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ((ber_tag_t) 0x82U) +#endif + + #ifndef SAM_ACCOUNT #define SAM_ACCOUNT struct sam_passwd #endif +#include "smbldap.h" + struct ldapsam_privates { + struct smbldap_state *smbldap_state; + /* Former statics */ - LDAP *ldap_struct; LDAPMessage *result; LDAPMessage *entry; int index; - time_t last_ping; - /* retrive-once info */ - const char *uri; const char *domain_name; DOM_SID domain_sid; /* configuration items */ int schema_ver; - - BOOL permit_non_unix_accounts; - - uint32 low_allocated_user_rid; - uint32 high_allocated_user_rid; - - uint32 low_allocated_group_rid; - uint32 high_allocated_group_rid; - - char *bind_dn; - char *bind_secret; - - unsigned int num_failures; -}; - -#define LDAPSAM_DONT_PING_TIME 10 /* ping only all 10 seconds */ - -static struct ldapsam_privates *static_ldap_state; - -/* specify schema versions between 2.2. and 3.0 */ - -#define SCHEMAVER_SAMBAACCOUNT 1 -#define SCHEMAVER_SAMBASAMACCOUNT 2 - -/* objectclass names */ - -#define LDAP_OBJ_SAMBASAMACCOUNT "sambaSamAccount" -#define LDAP_OBJ_SAMBAACCOUNT "sambaAccount" -#define LDAP_OBJ_GROUPMAP "sambaGroupMapping" -#define LDAP_OBJ_DOMINFO "sambaDomain" - -#define LDAP_OBJ_ACCOUNT "account" -#define LDAP_OBJ_POSIXACCOUNT "posixAccount" -#define LDAP_OBJ_POSIXGROUP "posixGroup" - -/* some generic attributes that get reused a lot */ - -#define LDAP_ATTRIBUTE_SID "sambaSID" - -/* attribute map table indexes */ - -#define LDAP_ATTR_LIST_END 0 -#define LDAP_ATTR_UID 1 -#define LDAP_ATTR_UIDNUMBER 2 -#define LDAP_ATTR_GIDNUMBER 3 -#define LDAP_ATTR_UNIX_HOME 4 -#define LDAP_ATTR_PWD_LAST_SET 5 -#define LDAP_ATTR_PWD_CAN_CHANGE 6 -#define LDAP_ATTR_PWD_MUST_CHANGE 7 -#define LDAP_ATTR_LOGON_TIME 8 -#define LDAP_ATTR_LOGOFF_TIME 9 -#define LDAP_ATTR_KICKOFF_TIME 10 -#define LDAP_ATTR_CN 11 -#define LDAP_ATTR_DISPLAY_NAME 12 -#define LDAP_ATTR_HOME_PATH 13 -#define LDAP_ATTR_LOGON_SCRIPT 14 -#define LDAP_ATTR_PROFILE_PATH 15 -#define LDAP_ATTR_DESC 16 -#define LDAP_ATTR_USER_WKS 17 -#define LDAP_ATTR_USER_SID 18 -#define LDAP_ATTR_USER_RID 18 -#define LDAP_ATTR_PRIMARY_GROUP_SID 19 -#define LDAP_ATTR_PRIMARY_GROUP_RID 20 -#define LDAP_ATTR_LMPW 21 -#define LDAP_ATTR_NTPW 22 -#define LDAP_ATTR_DOMAIN 23 -#define LDAP_ATTR_OBJCLASS 24 -#define LDAP_ATTR_ACB_INFO 25 -#define LDAP_ATTR_NEXT_USERRID 26 -#define LDAP_ATTR_NEXT_GROUPRID 27 -#define LDAP_ATTR_DOM_SID 28 -#define LDAP_ATTR_HOME_DRIVE 29 -#define LDAP_ATTR_GROUP_SID 30 -#define LDAP_ATTR_GROUP_TYPE 31 - - -typedef struct _attrib_map_entry { - int attrib; - const char *name; -} ATTRIB_MAP_ENTRY; - - -/* attributes used by Samba 2.2 */ - -static ATTRIB_MAP_ENTRY attrib_map_v22[] = { - { LDAP_ATTR_UID, "uid" }, - { LDAP_ATTR_UIDNUMBER, "uidNumber" }, - { LDAP_ATTR_GIDNUMBER, "gidNumber" }, - { LDAP_ATTR_UNIX_HOME, "homeDirectory" }, - { LDAP_ATTR_PWD_LAST_SET, "pwdLastSet" }, - { LDAP_ATTR_PWD_CAN_CHANGE, "pwdCanChange" }, - { LDAP_ATTR_PWD_MUST_CHANGE, "pwdMustChange" }, - { LDAP_ATTR_LOGON_TIME, "logonTime" }, - { LDAP_ATTR_LOGOFF_TIME, "logoffTime" }, - { LDAP_ATTR_KICKOFF_TIME, "kickoffTime" }, - { LDAP_ATTR_CN, "cn" }, - { LDAP_ATTR_DISPLAY_NAME, "displayName" }, - { LDAP_ATTR_HOME_PATH, "smbHome" }, - { LDAP_ATTR_HOME_DRIVE, "homeDrives" }, - { LDAP_ATTR_LOGON_SCRIPT, "scriptPath" }, - { LDAP_ATTR_PROFILE_PATH, "profilePath" }, - { LDAP_ATTR_DESC, "description" }, - { LDAP_ATTR_USER_WKS, "userWorkstations"}, - { LDAP_ATTR_USER_RID, "rid" }, - { LDAP_ATTR_PRIMARY_GROUP_RID, "primaryGroupID"}, - { LDAP_ATTR_LMPW, "lmPassword" }, - { LDAP_ATTR_NTPW, "ntPassword" }, - { LDAP_ATTR_DOMAIN, "domain" }, - { LDAP_ATTR_OBJCLASS, "objectClass" }, - { LDAP_ATTR_ACB_INFO, "acctFlags" }, - { LDAP_ATTR_LIST_END, NULL } -}; - -/* attributes used by Samba 3.0's sambaSamAccount */ - -static ATTRIB_MAP_ENTRY attrib_map_v30[] = { - { LDAP_ATTR_UID, "uid" }, - { LDAP_ATTR_UIDNUMBER, "uidNumber" }, - { LDAP_ATTR_GIDNUMBER, "gidNumber" }, - { LDAP_ATTR_UNIX_HOME, "homeDirectory" }, - { LDAP_ATTR_PWD_LAST_SET, "sambaPwdLastSet" }, - { LDAP_ATTR_PWD_CAN_CHANGE, "sambaPwdCanChange" }, - { LDAP_ATTR_PWD_MUST_CHANGE, "sambaPwdMustChange" }, - { LDAP_ATTR_LOGON_TIME, "sambaLogonTime" }, - { LDAP_ATTR_LOGOFF_TIME, "sambaLogoffTime" }, - { LDAP_ATTR_KICKOFF_TIME, "sambaKickoffTime" }, - { LDAP_ATTR_CN, "cn" }, - { LDAP_ATTR_DISPLAY_NAME, "displayName" }, - { LDAP_ATTR_HOME_DRIVE, "sambaHomeDrive" }, - { LDAP_ATTR_HOME_PATH, "sambaHomePath" }, - { LDAP_ATTR_LOGON_SCRIPT, "sambaLogonScript" }, - { LDAP_ATTR_PROFILE_PATH, "sambaProfilePath" }, - { LDAP_ATTR_DESC, "description" }, - { LDAP_ATTR_USER_WKS, "sambaUserWorkstations" }, - { LDAP_ATTR_USER_SID, "sambaSID" }, - { LDAP_ATTR_PRIMARY_GROUP_SID, "sambaPrimaryGroupSID" }, - { LDAP_ATTR_LMPW, "sambaLMPassword" }, - { LDAP_ATTR_NTPW, "sambaNTPassword" }, - { LDAP_ATTR_DOMAIN, "sambaDomainName" }, - { LDAP_ATTR_OBJCLASS, "objectClass" }, - { LDAP_ATTR_ACB_INFO, "sambaAcctFlags" }, - { LDAP_ATTR_LIST_END, NULL } -}; - -/* attributes used for alalocating RIDs */ - -static ATTRIB_MAP_ENTRY dominfo_attr_list[] = { - { LDAP_ATTR_DOMAIN, "sambaDomainName" }, - { LDAP_ATTR_NEXT_USERRID, "sambaNextUserRid" }, - { LDAP_ATTR_NEXT_GROUPRID, "sambaNextGroupRid" }, - { LDAP_ATTR_DOM_SID, "sambaSID" }, - { LDAP_ATTR_LIST_END, NULL }, -}; - -/* Samba 3.0 group mapping attributes */ - -static ATTRIB_MAP_ENTRY groupmap_attr_list[] = { - { LDAP_ATTR_GIDNUMBER, "gidNumber" }, - { LDAP_ATTR_GROUP_SID, "sambaSID" }, - { LDAP_ATTR_GROUP_TYPE, "sambaGroupType" }, - { LDAP_ATTR_DESC, "description" }, - { LDAP_ATTR_DISPLAY_NAME, "displayName" }, - { LDAP_ATTR_CN, "cn" }, - { LDAP_ATTR_LIST_END, NULL } -}; - -static ATTRIB_MAP_ENTRY groupmap_attr_list_to_delete[] = { - { LDAP_ATTR_GROUP_SID, "sambaSID" }, - { LDAP_ATTR_GROUP_TYPE, "sambaGroupType" }, - { LDAP_ATTR_DESC, "description" }, - { LDAP_ATTR_DISPLAY_NAME, "displayName" }, - { LDAP_ATTR_LIST_END, NULL } }; /********************************************************************** - perform a simple table lookup and return the attribute name + Free a LDAPMessage (one is stored on the SAM_ACCOUNT) **********************************************************************/ -static const char* get_attr_key2string( ATTRIB_MAP_ENTRY table[], int key ) +static void private_data_free_fn(void **result) { - int i = 0; - - while ( table[i].attrib != LDAP_ATTR_LIST_END ) { - if ( table[i].attrib == key ) - return table[i].name; - i++; - } - - return NULL; + ldap_memfree(*result); + *result = NULL; } /********************************************************************** @@ -286,52 +129,6 @@ static const char* get_userattr_key2string( int schema_ver, int key ) return NULL; } -/********************************************************************** - Return the list of attribute names from a mapping table - **********************************************************************/ - -static char** get_attr_list( ATTRIB_MAP_ENTRY table[] ) -{ - char **names; - int i = 0; - - while ( table[i].attrib != LDAP_ATTR_LIST_END ) - i++; - i++; - - names = (char**)malloc( sizeof(char*)*i ); - if ( !names ) { - DEBUG(0,("get_attr_list: out of memory\n")); - return NULL; - } - - i = 0; - while ( table[i].attrib != LDAP_ATTR_LIST_END ) { - names[i] = strdup( table[i].name ); - i++; - } - names[i] = NULL; - - return names; -} - -/********************************************************************* - Cleanup - ********************************************************************/ - -static void free_attr_list( char **list ) -{ - int i = 0; - - if ( !list ) - return; - - while ( list[i] ) - SAFE_FREE( list[i] ); - - SAFE_FREE( list ); -} - /********************************************************************** return the list of attribute names given a user schema version **********************************************************************/ @@ -352,1478 +149,187 @@ static char** get_userattr_list( int schema_ver ) return NULL; } - /******************************************************************* - find the ldap password -******************************************************************/ -static BOOL fetch_ldapsam_pw(char **dn, char** pw) -{ - char *key = NULL; - size_t size; - - *dn = smb_xstrdup(lp_ldap_admin_dn()); - - if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, *dn) < 0) { - SAFE_FREE(*dn); - DEBUG(0, ("fetch_ldapsam_pw: asprintf failed!\n")); - } - - *pw=secrets_fetch(key, &size); - SAFE_FREE(key); - - if (!size) { - /* Upgrade 2.2 style entry */ - char *p; - char* old_style_key = strdup(*dn); - char *data; - fstring old_style_pw; - - if (!old_style_key) { - DEBUG(0, ("fetch_ldapsam_pw: strdup failed!\n")); - return False; - } - - for (p=old_style_key; *p; p++) - if (*p == ',') *p = '/'; - - data=secrets_fetch(old_style_key, &size); - if (!size && size < sizeof(old_style_pw)) { - DEBUG(0,("fetch_ldap_pw: neither ldap secret retrieved!\n")); - SAFE_FREE(old_style_key); - SAFE_FREE(*dn); - return False; - } - - strncpy(old_style_pw, data, size); - old_style_pw[size] = 0; - - SAFE_FREE(data); - - if (!secrets_store_ldap_pw(*dn, old_style_pw)) { - DEBUG(0,("fetch_ldap_pw: ldap secret could not be upgraded!\n")); - SAFE_FREE(old_style_key); - SAFE_FREE(*dn); - return False; - } - if (!secrets_delete(old_style_key)) { - DEBUG(0,("fetch_ldap_pw: old ldap secret could not be deleted!\n")); - } - - SAFE_FREE(old_style_key); + generate the LDAP search filter for the objectclass based on the + version of the schema we are using + ******************************************************************/ - *pw = smb_xstrdup(old_style_pw); - } - - return True; -} - -/******************************************************************* - open a connection to the ldap server. -******************************************************************/ -static int ldapsam_open_connection (struct ldapsam_privates *ldap_state, LDAP ** ldap_struct) +static const char* get_objclass_filter( int schema_ver ) { - int rc = LDAP_SUCCESS; - int version; - BOOL ldap_v3 = False; - -#ifdef HAVE_LDAP_INITIALIZE - DEBUG(10, ("ldapsam_open_connection: %s\n", ldap_state->uri)); - - if ((rc = ldap_initialize(ldap_struct, ldap_state->uri)) != LDAP_SUCCESS) { - DEBUG(0, ("ldap_initialize: %s\n", ldap_err2string(rc))); - return rc; - } + static fstring objclass_filter; -#else - - /* Parse the string manually */ - - { - int port = 0; - fstring protocol; - fstring host; - const char *p = ldap_state->uri; - SMB_ASSERT(sizeof(protocol)>10 && sizeof(host)>254); - - /* skip leading "URL:" (if any) */ - if ( strncasecmp( p, "URL:", 4 ) == 0 ) { - p += 4; - } - - sscanf(p, "%10[^:]://%254s[^:]:%d", protocol, host, &port); - - if (port == 0) { - if (strequal(protocol, "ldap")) { - port = LDAP_PORT; - } else if (strequal(protocol, "ldaps")) { - port = LDAPS_PORT; - } else { - DEBUG(0, ("unrecognised protocol (%s)!\n", protocol)); - } - } - - if ((*ldap_struct = ldap_init(host, port)) == NULL) { - DEBUG(0, ("ldap_init failed !\n")); - return LDAP_OPERATIONS_ERROR; - } - - if (strequal(protocol, "ldaps")) { -#ifdef LDAP_OPT_X_TLS - int tls = LDAP_OPT_X_TLS_HARD; - if (ldap_set_option (*ldap_struct, LDAP_OPT_X_TLS, &tls) != LDAP_SUCCESS) - { - DEBUG(0, ("Failed to setup a TLS session\n")); - } - - DEBUG(3,("LDAPS option set...!\n")); -#else - DEBUG(0,("ldapsam_open_connection: Secure connection not supported by LDAP client libraries!\n")); - return LDAP_OPERATIONS_ERROR; -#endif - } - } -#endif - - if (ldap_get_option(*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS) + switch( schema_ver ) { - if (version != LDAP_VERSION3) - { - version = LDAP_VERSION3; - if (ldap_set_option (*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS) { - ldap_v3 = True; - } - } else { - ldap_v3 = True; - } - } - - if (lp_ldap_ssl() == LDAP_SSL_START_TLS) { -#ifdef LDAP_OPT_X_TLS - if (ldap_v3) { - if ((rc = ldap_start_tls_s (*ldap_struct, NULL, NULL)) != LDAP_SUCCESS) - { - DEBUG(0,("Failed to issue the StartTLS instruction: %s\n", - ldap_err2string(rc))); - return rc; - } - DEBUG (3, ("StartTLS issued: using a TLS connection\n")); - } else { - - DEBUG(0, ("Need LDAPv3 for Start TLS\n")); - return LDAP_OPERATIONS_ERROR; - } -#else - DEBUG(0,("ldapsam_open_connection: StartTLS not supported by LDAP client libraries!\n")); - return LDAP_OPERATIONS_ERROR; -#endif + case SCHEMAVER_SAMBAACCOUNT: + snprintf( objclass_filter, sizeof(objclass_filter)-1, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT ); + break; + case SCHEMAVER_SAMBASAMACCOUNT: + snprintf( objclass_filter, sizeof(objclass_filter)-1, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT ); + break; + default: + DEBUG(0,("pdb_ldapsam: get_objclass_filter(): Invalid schema version specified!\n")); + break; } - - DEBUG(2, ("ldapsam_open_connection: connection opened\n")); - return rc; + + return objclass_filter; } - /******************************************************************* - a rebind function for authenticated referrals - This version takes a void* that we can shove useful stuff in :-) + run the search by name. ******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -#else -static int rebindproc_with_state (LDAP * ld, char **whop, char **credp, - int *methodp, int freeit, void *arg) +static int ldapsam_search_suffix_by_name (struct ldapsam_privates *ldap_state, + const char *user, + LDAPMessage ** result, char **attr) { - struct ldapsam_privates *ldap_state = arg; - - /** @TODO Should we be doing something to check what servers we rebind to? - Could we get a referral to a machine that we don't want to give our - username and password to? */ - - if (freeit) { - SAFE_FREE(*whop); - memset(*credp, '\0', strlen(*credp)); - SAFE_FREE(*credp); - } else { - DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n", - ldap_state->bind_dn)); + pstring filter; + char *escape_user = escape_ldap_string_alloc(user); - *whop = strdup(ldap_state->bind_dn); - if (!*whop) { - return LDAP_NO_MEMORY; - } - *credp = strdup(ldap_state->bind_secret); - if (!*credp) { - SAFE_FREE(*whop); - return LDAP_NO_MEMORY; - } - *methodp = LDAP_AUTH_SIMPLE; + if (!escape_user) { + return LDAP_NO_MEMORY; } - return 0; -} -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ -/******************************************************************* - a rebind function for authenticated referrals - This version takes a void* that we can shove useful stuff in :-) - and actually does the connection. -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -static int rebindproc_connect_with_state (LDAP *ldap_struct, - LDAP_CONST char *url, - ber_tag_t request, - ber_int_t msgid, void *arg) -{ - struct ldapsam_privates *ldap_state = arg; - int rc; - DEBUG(5,("rebindproc_connect_with_state: Rebinding as \"%s\"\n", - ldap_state->bind_dn)); - - /** @TODO Should we be doing something to check what servers we rebind to? - Could we get a referral to a machine that we don't want to give our - username and password to? */ + /* + * in the filter expression, replace %u with the real name + * so in ldap filter, %u MUST exist :-) + */ + snprintf(filter, sizeof(filter)-1, "(&%s%s)", lp_ldap_filter(), + get_objclass_filter(ldap_state->schema_ver)); - rc = ldap_simple_bind_s(ldap_struct, ldap_state->bind_dn, ldap_state->bind_secret); + /* + * have to use this here because $ is filtered out + * in pstring_sub + */ - return rc; -} -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ -/******************************************************************* - Add a rebind function for authenticated referrals -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -#else -# if LDAP_SET_REBIND_PROC_ARGS == 2 -static int rebindproc (LDAP *ldap_struct, char **whop, char **credp, - int *method, int freeit ) -{ - return rebindproc_with_state(ldap_struct, whop, credp, - method, freeit, static_ldap_state); - -} -# endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/ -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ + all_string_sub(filter, "%u", escape_user, sizeof(pstring)); + SAFE_FREE(escape_user); -/******************************************************************* - a rebind function for authenticated referrals - this also does the connection, but no void*. -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -# if LDAP_SET_REBIND_PROC_ARGS == 2 -static int rebindproc_connect (LDAP * ld, LDAP_CONST char *url, int request, - ber_int_t msgid) -{ - return rebindproc_connect_with_state(ld, url, (ber_tag_t)request, msgid, - static_ldap_state); + return smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result); } -# endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/ -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ /******************************************************************* - connect to the ldap server under system privilege. + run the search by rid. ******************************************************************/ -static int ldapsam_connect_system(struct ldapsam_privates *ldap_state, LDAP * ldap_struct) -{ - int rc; - char *ldap_dn; - char *ldap_secret; - - /* The rebind proc needs this *HACK*. We are not multithreaded, so - this will work, but it's not nice. */ - static_ldap_state = ldap_state; - - /* get the password */ - if (!fetch_ldapsam_pw(&ldap_dn, &ldap_secret)) - { - DEBUG(0, ("ldap_connect_system: Failed to retrieve password from secrets.tdb\n")); - return LDAP_INVALID_CREDENTIALS; - } - - ldap_state->bind_dn = ldap_dn; - ldap_state->bind_secret = ldap_secret; - - /* removed the sasl_bind_s "EXTERNAL" stuff, as my testsuite - (OpenLDAP) doesnt' seem to support it */ - - DEBUG(10,("ldap_connect_system: Binding to ldap server %s as \"%s\"\n", - ldap_state->uri, ldap_dn)); - -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -# if LDAP_SET_REBIND_PROC_ARGS == 2 - ldap_set_rebind_proc(ldap_struct, &rebindproc_connect); -# endif -# if LDAP_SET_REBIND_PROC_ARGS == 3 - ldap_set_rebind_proc(ldap_struct, &rebindproc_connect_with_state, (void *)ldap_state); -# endif -#else /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ -# if LDAP_SET_REBIND_PROC_ARGS == 2 - ldap_set_rebind_proc(ldap_struct, &rebindproc); -# endif -# if LDAP_SET_REBIND_PROC_ARGS == 3 - ldap_set_rebind_proc(ldap_struct, &rebindproc_with_state, (void *)ldap_state); -# endif -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - - rc = ldap_simple_bind_s(ldap_struct, ldap_dn, ldap_secret); - - if (rc != LDAP_SUCCESS) { - char *ld_error = NULL; - ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, - &ld_error); - DEBUG(ldap_state->num_failures ? 2 : 0, - ("failed to bind to server with dn= %s Error: %s\n\t%s\n", - ldap_dn ? ld_error : "(unknown)", ldap_err2string(rc), - ld_error)); - SAFE_FREE(ld_error); - ldap_state->num_failures++; - return rc; - } - - ldap_state->num_failures = 0; - - DEBUG(3, ("ldap_connect_system: succesful connection to the LDAP server\n")); - return rc; -} - -/********************************************************************** -Connect to LDAP server -*********************************************************************/ -static int ldapsam_open(struct ldapsam_privates *ldap_state) +static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state, + uint32 rid, LDAPMessage ** result, + char **attr) { + pstring filter; int rc; - SMB_ASSERT(ldap_state); - -#ifndef NO_LDAP_SECURITY - if (geteuid() != 0) { - DEBUG(0, ("ldapsam_open: cannot access LDAP when not root..\n")); - return LDAP_INSUFFICIENT_ACCESS; - } -#endif - if ((ldap_state->ldap_struct != NULL) && ((ldap_state->last_ping + LDAPSAM_DONT_PING_TIME) < time(NULL))) { - struct sockaddr_un addr; - socklen_t len = sizeof(addr); - int sd; - if (ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_DESC, &sd) == 0 && - getpeername(sd, (struct sockaddr *) &addr, &len) < 0) { - /* the other end has died. reopen. */ - ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); - ldap_state->ldap_struct = NULL; - ldap_state->last_ping = (time_t)0; - } else { - ldap_state->last_ping = time(NULL); - } - } - - if (ldap_state->ldap_struct != NULL) { - DEBUG(5,("ldapsam_open: already connected to the LDAP server\n")); - return LDAP_SUCCESS; - } - - if ((rc = ldapsam_open_connection(ldap_state, &ldap_state->ldap_struct))) { - return rc; - } - - if ((rc = ldapsam_connect_system(ldap_state, ldap_state->ldap_struct))) { - ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); - ldap_state->ldap_struct = NULL; - return rc; - } - - - ldap_state->last_ping = time(NULL); - DEBUG(4,("The LDAP server is succesful connected\n")); - - return LDAP_SUCCESS; -} - -/********************************************************************** -Disconnect from LDAP server -*********************************************************************/ -static NTSTATUS ldapsam_close(struct ldapsam_privates *ldap_state) -{ - if (!ldap_state) - return NT_STATUS_INVALID_PARAMETER; - - if (ldap_state->ldap_struct != NULL) { - ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); - ldap_state->ldap_struct = NULL; - } + snprintf(filter, sizeof(filter)-1, "(&(rid=%i)%s)", rid, + get_objclass_filter(ldap_state->schema_ver)); - DEBUG(5,("The connection to the LDAP server was closed\n")); - /* maybe free the results here --metze */ + rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result); - return NT_STATUS_OK; + return rc; } -static int ldapsam_retry_open(struct ldapsam_privates *ldap_state, int *attempts) +/******************************************************************* + run the search by SID. +******************************************************************/ +static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state, + const DOM_SID *sid, LDAPMessage ** result, + char **attr) { + pstring filter; int rc; + fstring sid_string; - SMB_ASSERT(ldap_state && attempts); - - if (*attempts != 0) { - unsigned int sleep_time; - uint8 rand_byte; - - /* Sleep for a random timeout */ - rand_byte = (char)(sys_random()); - - sleep_time = (((*attempts)*(*attempts))/2)*rand_byte*2; - /* we retry after (0.5, 1, 2, 3, 4.5, 6) seconds - on average. - */ - DEBUG(3, ("Sleeping for %u milliseconds before reconnecting\n", - sleep_time)); - msleep(sleep_time); - } - (*attempts)++; - - if ((rc = ldapsam_open(ldap_state))) { - DEBUG(1,("Connection to LDAP Server failed for the %d try!\n",*attempts)); - return rc; - } - - return LDAP_SUCCESS; -} - - -/********************************************************************* - ********************************************************************/ - -static int ldapsam_search(struct ldapsam_privates *ldap_state, - const char *base, int scope, const char *filter, - char *attrs[], int attrsonly, - LDAPMessage **res) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - char *utf8_filter; - - SMB_ASSERT(ldap_state); - - if (push_utf8_allocate(&utf8_filter, filter) == (size_t)-1) { - return LDAP_NO_MEMORY; - } - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; + snprintf(filter, sizeof(filter)-1, "(&(%s=%s)%s)", + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), + sid_to_string(sid_string, sid), + get_objclass_filter(ldap_state->schema_ver)); - rc = ldap_search_s(ldap_state->ldap_struct, base, scope, - utf8_filter, attrs, attrsonly, res); - } + rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result); - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - ldapsam_close(ldap_state); - } - - SAFE_FREE(utf8_filter); return rc; } -static int ldapsam_modify(struct ldapsam_privates *ldap_state, const char *dn, LDAPMod *attrs[]) +/******************************************************************* + Delete complete object or objectclass and attrs from + object found in search_result depending on lp_ldap_delete_dn +******************************************************************/ +static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state, + LDAPMessage *result, + const char *objectclass, + char **attrs) { - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - char *utf8_dn; + int rc; + LDAPMessage *entry; + LDAPMod **mods = NULL; + char *name, *dn; + BerElement *ptr = NULL; - SMB_ASSERT(ldap_state); - - if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) { - return LDAP_NO_MEMORY; - } - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_modify_s(ldap_state->ldap_struct, utf8_dn, attrs); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - ldapsam_close(ldap_state); - } - - SAFE_FREE(utf8_dn); - return rc; -} - -static int ldapsam_add(struct ldapsam_privates *ldap_state, const char *dn, LDAPMod *attrs[]) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - char *utf8_dn; - - SMB_ASSERT(ldap_state); - - if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) { - return LDAP_NO_MEMORY; - } - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_add_s(ldap_state->ldap_struct, utf8_dn, attrs); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - ldapsam_close(ldap_state); - } - - SAFE_FREE(utf8_dn); - return rc; -} - -static int ldapsam_delete(struct ldapsam_privates *ldap_state, char *dn) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - char *utf8_dn; - - SMB_ASSERT(ldap_state); - - if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) { - return LDAP_NO_MEMORY; - } - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_delete_s(ldap_state->ldap_struct, utf8_dn); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - ldapsam_close(ldap_state); - } - - SAFE_FREE(utf8_dn); - return rc; -} - -#ifdef LDAP_EXOP_X_MODIFY_PASSWD -static int ldapsam_extended_operation(struct ldapsam_privates *ldap_state, LDAP_CONST char *reqoid, struct berval *reqdata, LDAPControl **serverctrls, LDAPControl **clientctrls, char **retoidp, struct berval **retdatap) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - - if (!ldap_state) - return (-1); - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_extended_operation_s(ldap_state->ldap_struct, reqoid, reqdata, serverctrls, clientctrls, retoidp, retdatap); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - ldapsam_close(ldap_state); - } - - return rc; -} -#endif - -/******************************************************************* - run the search by name. -******************************************************************/ -static int ldapsam_search_suffix (struct ldapsam_privates *ldap_state, const char *filter, - char **search_attr, LDAPMessage ** result) -{ - int scope = LDAP_SCOPE_SUBTREE; - int rc; - - DEBUG(2, ("ldapsam_search_suffix: searching for:[%s]\n", filter)); - - rc = ldapsam_search(ldap_state, lp_ldap_suffix(), scope, filter, search_attr, 0, result); - - if (rc != LDAP_SUCCESS) { - char *ld_error = NULL; - ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, - &ld_error); - DEBUG(0,("ldapsam_search_suffix: Problem during the LDAP search: %s (%s)\n", - ld_error?ld_error:"(unknown)", ldap_err2string (rc))); - DEBUG(3,("ldapsam_search_suffix: Query was: %s, %s\n", lp_ldap_suffix(), - filter)); - SAFE_FREE(ld_error); - } - - return rc; -} - -/******************************************************************* - generate the LDAP search filter for the objectclass based on the - version of the schema we are using - ******************************************************************/ - -static const char* get_objclass_filter( int schema_ver ) -{ - static fstring objclass_filter; - - switch( schema_ver ) - { - case SCHEMAVER_SAMBAACCOUNT: - snprintf( objclass_filter, sizeof(objclass_filter)-1, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT ); - break; - case SCHEMAVER_SAMBASAMACCOUNT: - snprintf( objclass_filter, sizeof(objclass_filter)-1, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT ); - break; - default: - DEBUG(0,("ldapsam_search_suffix_by_name(): Invalid schema version specified!\n")); - break; - } - - return objclass_filter; -} - -/******************************************************************* - run the search by name. -******************************************************************/ -static int ldapsam_search_suffix_by_name (struct ldapsam_privates *ldap_state, const char *user, - LDAPMessage ** result, char **attr) -{ - pstring filter; - char *escape_user = escape_ldap_string_alloc(user); - - if (!escape_user) { - return LDAP_NO_MEMORY; - } - - /* - * in the filter expression, replace %u with the real name - * so in ldap filter, %u MUST exist :-) - */ - snprintf(filter, sizeof(filter)-1, "(&%s%s)", lp_ldap_filter(), - get_objclass_filter(ldap_state->schema_ver)); - - /* - * have to use this here because $ is filtered out - * in pstring_sub - */ - - - all_string_sub(filter, "%u", escape_user, sizeof(pstring)); - SAFE_FREE(escape_user); - - return ldapsam_search_suffix(ldap_state, filter, attr, result); -} - -/******************************************************************* - run the search by rid. -******************************************************************/ -static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state, - uint32 rid, LDAPMessage ** result, - char **attr) -{ - pstring filter; - int rc; - - /* check if the user rid exists, if not, try searching on the uid */ - - snprintf(filter, sizeof(filter)-1, "(&(rid=%i)%s)", rid, - get_objclass_filter(ldap_state->schema_ver)); - - rc = ldapsam_search_suffix(ldap_state, filter, attr, result); - - return rc; -} - -/******************************************************************* - run the search by SID. -******************************************************************/ -static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state, - const DOM_SID *sid, LDAPMessage ** result, - char **attr) -{ - pstring filter; - int rc; - fstring sid_string; - - /* check if the user rid exsists, if not, try searching on the uid */ - - snprintf(filter, sizeof(filter)-1, "(&(%s=%s)%s)", - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), - sid_to_string(sid_string, sid), - get_objclass_filter(ldap_state->schema_ver)); - - rc = ldapsam_search_suffix(ldap_state, filter, attr, result); - - return rc; -} - -/******************************************************************* -search an attribute and return the first value found. -******************************************************************/ -static BOOL get_single_attribute (LDAP * ldap_struct, LDAPMessage * entry, - const char *attribute, pstring value) -{ - char **values; - - if ( !attribute ) - return False; - - value[0] = '\0'; - - if ((values = ldap_get_values (ldap_struct, entry, attribute)) == NULL) { - DEBUG (10, ("get_single_attribute: [%s] = []\n", attribute)); - - return False; - } - - if (convert_string(CH_UTF8, CH_UNIX,values[0], -1, value, sizeof(pstring)) == (size_t)-1) - { - DEBUG(1, ("get_single_attribute: string conversion of [%s] = [%s] failed!\n", - attribute, values[0])); - ldap_value_free(values); - return False; - } - - ldap_value_free(values); -#ifdef DEBUG_PASSWORDS - DEBUG (100, ("get_single_attribute: [%s] = [%s]\n", attribute, value)); -#endif - return True; -} - -/************************************************************************ -Routine to manage the LDAPMod structure array -manage memory used by the array, by each struct, and values - -************************************************************************/ -static void make_a_mod (LDAPMod *** modlist, int modop, const char *attribute, const char *value) -{ - LDAPMod **mods; - int i; - int j; - - mods = *modlist; - - /* sanity checks on the mod values */ - - if (attribute == NULL || *attribute == '\0') - return; -#if 0 /* commented out after discussion with abartlet. Do not reenable. - left here so other so re-add similar code --jerry */ - if (value == NULL || *value == '\0') - return; -#endif - - if (mods == NULL) - { - mods = (LDAPMod **) malloc(sizeof(LDAPMod *)); - if (mods == NULL) - { - DEBUG(0, ("make_a_mod: out of memory!\n")); - return; - } - mods[0] = NULL; - } - - for (i = 0; mods[i] != NULL; ++i) { - if (mods[i]->mod_op == modop && !strcasecmp(mods[i]->mod_type, attribute)) - break; - } - - if (mods[i] == NULL) - { - mods = (LDAPMod **) Realloc (mods, (i + 2) * sizeof (LDAPMod *)); - if (mods == NULL) - { - DEBUG(0, ("make_a_mod: out of memory!\n")); - return; - } - mods[i] = (LDAPMod *) malloc(sizeof(LDAPMod)); - if (mods[i] == NULL) - { - DEBUG(0, ("make_a_mod: out of memory!\n")); - return; - } - mods[i]->mod_op = modop; - mods[i]->mod_values = NULL; - mods[i]->mod_type = strdup(attribute); - mods[i + 1] = NULL; - } - - if (value != NULL) - { - char *utf8_value = NULL; - - j = 0; - if (mods[i]->mod_values != NULL) { - for (; mods[i]->mod_values[j] != NULL; j++); - } - mods[i]->mod_values = (char **)Realloc(mods[i]->mod_values, - (j + 2) * sizeof (char *)); - - if (mods[i]->mod_values == NULL) { - DEBUG (0, ("make_a_mod: Memory allocation failure!\n")); - return; - } - - if (push_utf8_allocate(&utf8_value, value) == (size_t)-1) { - DEBUG (0, ("make_a_mod: String conversion failure!\n")); - return; - } - - mods[i]->mod_values[j] = utf8_value; - - mods[i]->mod_values[j + 1] = NULL; - } - *modlist = mods; -} - -/********************************************************************** - Set attribute to newval in LDAP, regardless of what value the - attribute had in LDAP before. -*********************************************************************/ -static void make_ldap_mod(LDAP *ldap_struct, LDAPMessage *existing, - LDAPMod ***mods, - const char *attribute, const char *newval) -{ - char **values = NULL; - - if (existing != NULL) { - values = ldap_get_values(ldap_struct, existing, attribute); - } - - /* all of our string attributes are case insensitive */ - - if ((values != NULL) && (values[0] != NULL) && - StrCaseCmp(values[0], newval) == 0) - { - - /* Believe it or not, but LDAP will deny a delete and - an add at the same time if the values are the - same... */ - - ldap_value_free(values); - return; - } - - /* Regardless of the real operation (add or modify) - we add the new value here. We rely on deleting - the old value, should it exist. */ - - if ((newval != NULL) && (strlen(newval) > 0)) { - make_a_mod(mods, LDAP_MOD_ADD, attribute, newval); - } - - if (values == NULL) { - /* There has been no value before, so don't delete it. - Here's a possible race: We might end up with - duplicate attributes */ - return; - } - - /* By deleting exactly the value we found in the entry this - should be race-free in the sense that the LDAP-Server will - deny the complete operation if somebody changed the - attribute behind our back. */ - - make_a_mod(mods, LDAP_MOD_DELETE, attribute, values[0]); - ldap_value_free(values); -} - -/******************************************************************* - Delete complete object or objectclass and attrs from - object found in search_result depending on lp_ldap_delete_dn -******************************************************************/ -static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state, - LDAPMessage *result, - const char *objectclass, - char **attrs) -{ - int rc; - LDAPMessage *entry; - LDAPMod **mods = NULL; - char *name, *dn; - BerElement *ptr = NULL; - - rc = ldap_count_entries(ldap_state->ldap_struct, result); + rc = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); if (rc != 1) { DEBUG(0, ("Entry must exist exactly once!\n")); return NT_STATUS_UNSUCCESSFUL; } - entry = ldap_first_entry(ldap_state->ldap_struct, result); - dn = ldap_get_dn(ldap_state->ldap_struct, entry); - - if (lp_ldap_delete_dn()) { - NTSTATUS ret = NT_STATUS_OK; - rc = ldapsam_delete(ldap_state, dn); - - if (rc != LDAP_SUCCESS) { - DEBUG(0, ("Could not delete object %s\n", dn)); - ret = NT_STATUS_UNSUCCESSFUL; - } - ldap_memfree(dn); - return ret; - } - - /* Ok, delete only the SAM attributes */ - - for (name = ldap_first_attribute(ldap_state->ldap_struct, entry, &ptr); - name != NULL; - name = ldap_next_attribute(ldap_state->ldap_struct, entry, ptr)) - { - char **attrib; - - /* We are only allowed to delete the attributes that - really exist. */ - - for (attrib = attrs; *attrib != NULL; attrib++) - { - if (StrCaseCmp(*attrib, name) == 0) { - DEBUG(10, ("deleting attribute %s\n", name)); - make_a_mod(&mods, LDAP_MOD_DELETE, name, NULL); - } - } - - ldap_memfree(name); - } - - if (ptr != NULL) { - ber_free(ptr, 0); - } - - make_a_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass); - - rc = ldapsam_modify(ldap_state, dn, mods); - ldap_mods_free(mods, 1); - - if (rc != LDAP_SUCCESS) { - char *ld_error = NULL; - ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, - &ld_error); - - DEBUG(0, ("could not delete attributes for %s, error: %s (%s)\n", - dn, ldap_err2string(rc), ld_error?ld_error:"unknown")); - SAFE_FREE(ld_error); - ldap_memfree(dn); - return NT_STATUS_UNSUCCESSFUL; - } - - ldap_memfree(dn); - return NT_STATUS_OK; -} - -/********************************************************************** -Search for the domain info entry -*********************************************************************/ -static int ldapsam_search_domain_info(struct ldapsam_privates *ldap_state, - LDAPMessage ** result) -{ - pstring filter; - int rc; - char **attr_list; - - snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(%s=%s))", - LDAP_OBJ_DOMINFO, - get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN), - ldap_state->domain_name); - - DEBUG(2, ("Searching for:[%s]\n", filter)); - - - attr_list = get_attr_list( dominfo_attr_list ); - rc = ldapsam_search_suffix(ldap_state, filter, attr_list , result); - free_attr_list( attr_list ); - - if (rc != LDAP_SUCCESS) { - DEBUG(2,("Problem during LDAPsearch: %s\n", ldap_err2string (rc))); - DEBUG(2,("Query was: %s, %s\n", lp_ldap_suffix(), filter)); - } - - return rc; -} - -/********************************************************************** - If this entry is is the 'allocated' range, extract the RID and return - it, so we can find the 'next' rid to allocate. - - Do this, no matter what type of object holds the RID - be it a user, - group or somthing else. -*********************************************************************/ -static uint32 entry_to_rid(struct ldapsam_privates *ldap_state, LDAPMessage *entry, int rid_type) -{ - pstring sid_string; - DOM_SID dom_sid; - uint32 rid; - - if (!get_single_attribute(ldap_state->ldap_struct, entry, - LDAP_ATTRIBUTE_SID, sid_string)) - { - return 0; - } - - if (!string_to_sid(&dom_sid, sid_string)) { - return 0; - } - - if (!sid_peek_check_rid(&dom_sid, get_global_sam_sid(), &rid)) { - /* not our domain, so we don't care */ - return 0; - } - - switch (rid_type) { - case USER_RID_TYPE: - if (rid >= ldap_state->low_allocated_user_rid && - rid <= ldap_state->high_allocated_user_rid) { - return rid; - } - break; - case GROUP_RID_TYPE: - if (rid >= ldap_state->low_allocated_group_rid && - rid <= ldap_state->high_allocated_group_rid) { - return rid; - } - break; - } - return 0; -} - - -/********************************************************************** -Connect to LDAP server and find the next available 'allocated' RID. - -The search is done 'per type' as we allocate seperate pools for the -EVEN and ODD (user and group) RIDs. - -This is only done once, so that we can fill out the sambaDomain. -*********************************************************************/ -static uint32 search_next_allocated_rid(struct ldapsam_privates *ldap_state, int rid_type) -{ - int rc; - LDAPMessage *result; - LDAPMessage *entry; - uint32 top_rid = 0; - uint32 next_rid; - uint32 count; - uint32 rid; - char *sid_attr[] = {LDAP_ATTRIBUTE_SID, NULL}; - fstring filter; - - snprintf( filter, sizeof(filter)-1, "(%s=*)", LDAP_ATTRIBUTE_SID ); - - DEBUG(2, ("search_top_allocated_rid: searching for:[%s]\n", filter)); - - rc = ldapsam_search_suffix(ldap_state, filter, sid_attr, &result); - - if (rc != LDAP_SUCCESS) { - DEBUG(3, ("LDAP search failed! cannot find base for NUA RIDs: %s\n", ldap_err2string(rc))); - DEBUGADD(3, ("Query was: %s, %s\n", lp_ldap_suffix(), filter)); - - result = NULL; - return 0; - } - - count = ldap_count_entries(ldap_state->ldap_struct, result); - DEBUG(2, ("search_top_allocated_rid: %d entries in the base!\n", count)); - - if (count == 0) { - DEBUG(3, ("LDAP search returned no records, assuming no allocated RIDs present!: %s\n", ldap_err2string(rc))); - DEBUGADD(3, ("Query was: %s, %s\n", lp_ldap_suffix(), filter)); - } else { - entry = ldap_first_entry(ldap_state->ldap_struct,result); - - top_rid = entry_to_rid(ldap_state, entry, rid_type); - - while ((entry = ldap_next_entry(ldap_state->ldap_struct, entry))) { - - rid = entry_to_rid(ldap_state, entry, rid_type); - if (((rid & ~RID_TYPE_MASK) == rid_type) && (rid > top_rid)) { - top_rid = rid; - } - } - } - - switch (rid_type) { - case USER_RID_TYPE: - if (top_rid < ldap_state->low_allocated_user_rid) { - return ldap_state->low_allocated_user_rid; - } - break; - case GROUP_RID_TYPE: - if (top_rid < ldap_state->low_allocated_group_rid) - return ldap_state->low_allocated_group_rid; - break; - } - - next_rid = (top_rid & ~RID_TYPE_MASK) + rid_type + RID_MULTIPLIER; - - switch (rid_type) { - case USER_RID_TYPE: - if (next_rid > ldap_state->high_allocated_user_rid) { - return 0; - } - break; - case GROUP_RID_TYPE: - if (next_rid > ldap_state->high_allocated_group_rid) { - return 0; - } - break; - } - return next_rid; -} - -/********************************************************************** - Add the sambaDomain to LDAP, so we don't have to search for this stuff - again. This is a once-add operation for now. - - TODO: Add other attributes, and allow modification. -*********************************************************************/ -static NTSTATUS add_new_domain_info(struct ldapsam_privates *ldap_state) -{ - pstring tmp; - pstring filter; - LDAPMod **mods = NULL; - int rc; - int ldap_op; - LDAPMessage *result = NULL; - char *dn = NULL; - int num_result; - char **attr_list; - - uint32 next_allocated_user_rid; - uint32 next_allocated_group_rid; - - next_allocated_user_rid = search_next_allocated_rid(ldap_state, USER_RID_TYPE); - if (!next_allocated_user_rid) { - return NT_STATUS_UNSUCCESSFUL; - } - - next_allocated_group_rid = search_next_allocated_rid(ldap_state, GROUP_RID_TYPE); - if (!next_allocated_group_rid) { - return NT_STATUS_UNSUCCESSFUL; - } - - slprintf (filter, sizeof (filter) - 1, "(&(%s=%s)(objectclass=%s))", - get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN), - ldap_state->domain_name, LDAP_OBJ_DOMINFO); - - attr_list = get_attr_list( dominfo_attr_list ); - rc = ldapsam_search_suffix(ldap_state, filter, attr_list, &result); - free_attr_list( attr_list ); - - if (rc != LDAP_SUCCESS) { - return NT_STATUS_UNSUCCESSFUL; - } - - num_result = ldap_count_entries(ldap_state->ldap_struct, result); - - if (num_result > 1) { - DEBUG (0, ("More than domain with that name exists: bailing out!\n")); - ldap_msgfree(result); - return NT_STATUS_UNSUCCESSFUL; - } - - /* Check if we need to add an entry */ - DEBUG(3,("Adding new domain\n")); - ldap_op = LDAP_MOD_ADD; - asprintf (&dn, "%s=%s,%s", get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN), - ldap_state->domain_name, lp_ldap_suffix()); - - /* Free original search */ - ldap_msgfree(result); - - if (!dn) - return NT_STATUS_NO_MEMORY; - - /* make the changes - the entry *must* not already have samba attributes */ - make_a_mod(&mods, LDAP_MOD_ADD, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN), - ldap_state->domain_name); - - sid_to_string(tmp, &ldap_state->domain_sid); - make_a_mod(&mods, LDAP_MOD_ADD, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOM_SID), tmp); - - snprintf(tmp, sizeof(tmp)-1, "%i", next_allocated_user_rid); - make_a_mod(&mods, LDAP_MOD_ADD, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_USERRID), tmp); - - snprintf(tmp, sizeof(tmp)-1, "%i", next_allocated_group_rid); - make_a_mod(&mods, LDAP_MOD_ADD, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_GROUPRID), tmp); - - make_a_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_DOMINFO); - - switch(ldap_op) - { - case LDAP_MOD_ADD: - rc = ldapsam_add(ldap_state, dn, mods); - break; - case LDAP_MOD_REPLACE: - rc = ldapsam_modify(ldap_state, dn, mods); - break; - default: - DEBUG(0,("Wrong LDAP operation type: %d!\n", ldap_op)); - return NT_STATUS_INVALID_PARAMETER; - } - - if (rc!=LDAP_SUCCESS) { - char *ld_error = NULL; - ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, - &ld_error); - DEBUG(1, - ("failed to %s domain dn= %s with: %s\n\t%s\n", - ldap_op == LDAP_MOD_ADD ? "add" : "modify", - dn, ldap_err2string(rc), - ld_error?ld_error:"unknown")); - SAFE_FREE(ld_error); - - ldap_mods_free(mods,1); - return NT_STATUS_UNSUCCESSFUL; - } - - DEBUG(2,("added: domain = %s in the LDAP database\n", ldap_state->domain_name)); - ldap_mods_free(mods, 1); - return NT_STATUS_OK; -} - -/********************************************************************** - Even if the sambaAccount attribute in LDAP tells us that this RID is - safe to use, always check before use. -*********************************************************************/ -static BOOL sid_in_use(struct ldapsam_privates *ldap_state, - const DOM_SID *sid, int *error) -{ - fstring filter; - fstring sid_string; - LDAPMessage *result = NULL; - int count; - int rc; - char *sid_attr[] = {LDAP_ATTRIBUTE_SID, NULL}; - - slprintf(filter, sizeof(filter)-1, "(%s=%s)", LDAP_ATTRIBUTE_SID, sid_to_string(sid_string, sid)); - - rc = ldapsam_search_suffix(ldap_state, filter, sid_attr, &result); - - if (rc != LDAP_SUCCESS) { - char *ld_error = NULL; - ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); - DEBUG(2, ("Failed to check if sid %s is alredy in use: %s\n", - sid_string, ld_error)); - SAFE_FREE(ld_error); - - *error = rc; - return True; - } - - if ((count = ldap_count_entries(ldap_state->ldap_struct, result)) > 0) { - DEBUG(3, ("Sid %s already in use - trying next RID\n", - sid_string)); - ldap_msgfree(result); - return True; - } - - ldap_msgfree(result); - - /* good, sid is not in use */ - return False; -} - -/********************************************************************** - Set the new nextRid attribute, and return one we can use. - - This also checks that this RID is actually free - in case the admin - manually stole it :-). -*********************************************************************/ -static NTSTATUS ldapsam_next_rid(struct ldapsam_privates *ldap_state, uint32 *rid, int rid_type) -{ - NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - int rc; - LDAPMessage *result = NULL; - LDAPMessage *entry = NULL; - char *dn; - LDAPMod **mods = NULL; - int count; - fstring old_rid_string; - fstring next_rid_string; - uint32 next_rid; - int attempts = 0; - - if ( ldap_state->schema_ver != SCHEMAVER_SAMBASAMACCOUNT ) { - DEBUG(0, ("Allocated RIDs require the %s objectclass used by 'ldapsam'\n", - LDAP_OBJ_SAMBASAMACCOUNT)); - return NT_STATUS_UNSUCCESSFUL; - } - - while (attempts < 10) - { - char *ld_error; - if (ldapsam_search_domain_info(ldap_state, &result)) { - return ret; - } - - if (ldap_count_entries(ldap_state->ldap_struct, result) < 1) { - DEBUG(3, ("Got no domain info entries for domain %s\n", - ldap_state->domain_name)); - ldap_msgfree(result); - if (NT_STATUS_IS_OK(ret = add_new_domain_info(ldap_state))) { - continue; - } else { - DEBUG(0, ("Adding domain info failed with %s\n", nt_errstr(ret))); - return ret; - } - } - - if ((count = ldap_count_entries(ldap_state->ldap_struct, result)) > 1) { - DEBUG(0, ("Got too many (%d) domain info entries for domain %s\n", - count, ldap_state->domain_name)); - ldap_msgfree(result); - return ret; - } - - entry = ldap_first_entry(ldap_state->ldap_struct, result); - if (!entry) { - ldap_msgfree(result); - return ret; - } - - if ((dn = ldap_get_dn(ldap_state->ldap_struct, entry)) == NULL) { - DEBUG(0, ("Could not get domain info DN\n")); - ldap_msgfree(result); - return ret; - } - - /* yes, we keep 2 seperate counters, to avoid stomping on the two - different sets of algorithmic RIDs */ - - switch (rid_type) { - case USER_RID_TYPE: - if (!get_single_attribute(ldap_state->ldap_struct, entry, - get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_USERRID), - old_rid_string)) - { - ldap_memfree(dn); - ldap_msgfree(result); - return ret; - } - break; - case GROUP_RID_TYPE: - if (!get_single_attribute(ldap_state->ldap_struct, entry, - get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_GROUPRID), - old_rid_string)) - { - ldap_memfree(dn); - ldap_msgfree(result); - return ret; - } - break; - } - - /* This is the core of the whole routine. If we had - scheme-style closures, there would be a *lot* less code - duplication... */ - *rid = (uint32)atol(old_rid_string); - next_rid = *rid+RID_MULTIPLIER; - - slprintf(next_rid_string, sizeof(next_rid_string)-1, "%d", next_rid); - - switch (rid_type) { - case USER_RID_TYPE: - if (next_rid > ldap_state->high_allocated_user_rid) { - return NT_STATUS_UNSUCCESSFUL; - } - - /* Try to make the modification atomically by enforcing the - old value in the delete mod. */ - make_ldap_mod(ldap_state->ldap_struct, entry, &mods, - get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_USERRID), - next_rid_string); - break; - - case GROUP_RID_TYPE: - if (next_rid > ldap_state->high_allocated_group_rid) { - return NT_STATUS_UNSUCCESSFUL; - } - - /* Try to make the modification atomically by enforcing the - old value in the delete mod. */ - make_ldap_mod(ldap_state->ldap_struct, entry, &mods, - get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_GROUPRID), - next_rid_string); - break; - } - - if ((rc = ldap_modify_s(ldap_state->ldap_struct, dn, mods)) == LDAP_SUCCESS) { - DOM_SID dom_sid; - DOM_SID sid; - pstring domain_sid_string; - int error = 0; - - if (!get_single_attribute(ldap_state->ldap_struct, result, - get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOM_SID), - domain_sid_string)) - { - ldap_mods_free(mods, 1); - ldap_memfree(dn); - ldap_msgfree(result); - return ret; - } + entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); + dn = ldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry); - if (!string_to_sid(&dom_sid, domain_sid_string)) { - ldap_mods_free(mods, 1); - ldap_memfree(dn); - ldap_msgfree(result); - return ret; - } + if (lp_ldap_delete_dn()) { + NTSTATUS ret = NT_STATUS_OK; + rc = smbldap_delete(ldap_state->smbldap_state, dn); - ldap_mods_free(mods, 1); - mods = NULL; - ldap_memfree(dn); - ldap_msgfree(result); + if (rc != LDAP_SUCCESS) { + DEBUG(0, ("Could not delete object %s\n", dn)); + ret = NT_STATUS_UNSUCCESSFUL; + } + ldap_memfree(dn); + return ret; + } + + /* Ok, delete only the SAM attributes */ + + for (name = ldap_first_attribute(ldap_state->smbldap_state->ldap_struct, entry, &ptr); + name != NULL; + name = ldap_next_attribute(ldap_state->smbldap_state->ldap_struct, entry, ptr)) + { + char **attrib; - sid_copy(&sid, &dom_sid); - sid_append_rid(&sid, *rid); + /* We are only allowed to delete the attributes that + really exist. */ - /* check RID is not in use */ - if (sid_in_use(ldap_state, &sid, &error)) { - if (error) { - return ret; - } - continue; + for (attrib = attrs; *attrib != NULL; attrib++) + { + if (StrCaseCmp(*attrib, name) == 0) { + DEBUG(10, ("deleting attribute %s\n", name)); + smbldap_set_mod(&mods, LDAP_MOD_DELETE, name, NULL); } - - return NT_STATUS_OK; } - ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); - DEBUG(2, ("Failed to modify rid: %s\n", ld_error)); - SAFE_FREE(ld_error); + ldap_memfree(name); + } + + if (ptr != NULL) { + ber_free(ptr, 0); + } + + smbldap_set_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass); - ldap_mods_free(mods, 1); - mods = NULL; + rc = smbldap_modify(ldap_state->smbldap_state, dn, mods); + ldap_mods_free(mods, True); + if (rc != LDAP_SUCCESS) { + char *ld_error = NULL; + ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, + &ld_error); + + DEBUG(0, ("could not delete attributes for %s, error: %s (%s)\n", + dn, ldap_err2string(rc), ld_error?ld_error:"unknown")); + SAFE_FREE(ld_error); ldap_memfree(dn); - dn = NULL; - - ldap_msgfree(result); - result = NULL; - - { - /* Sleep for a random timeout */ - unsigned sleeptime = (sys_random()*sys_getpid()*attempts); - attempts += 1; - - sleeptime %= 100; - msleep(sleeptime); - } + return NT_STATUS_UNSUCCESSFUL; } - DEBUG(0, ("Failed to set new RID\n")); - return ret; + ldap_memfree(dn); + return NT_STATUS_OK; } + /* New Interface is being implemented here */ @@ -1840,7 +346,7 @@ static BOOL get_unix_attributes (struct ldapsam_privates *ldap_state, char **ldap_values; char **values; - if ((ldap_values = ldap_get_values (ldap_state->ldap_struct, entry, "objectClass")) == NULL) { + if ((ldap_values = ldap_get_values (ldap_state->smbldap_state->ldap_struct, entry, "objectClass")) == NULL) { DEBUG (1, ("get_unix_attributes: no objectClass! \n")); return False; } @@ -1858,13 +364,13 @@ static BOOL get_unix_attributes (struct ldapsam_privates *ldap_state, } ldap_value_free(ldap_values); - if ( !get_single_attribute(ldap_state->ldap_struct, entry, + if ( !smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_UNIX_HOME), homedir) ) { return False; } - if ( !get_single_attribute(ldap_state->ldap_struct, entry, + if ( !smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_GIDNUMBER), temp) ) { return False; @@ -1937,12 +443,12 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, return False; } - if (ldap_state->ldap_struct == NULL) { - DEBUG(0, ("init_sam_from_ldap: ldap_state->ldap_struct is NULL!\n")); + if (ldap_state->smbldap_state->ldap_struct == NULL) { + DEBUG(0, ("init_sam_from_ldap: ldap_state->smbldap_state->ldap_struct is NULL!\n")); return False; } - if (!get_single_attribute(ldap_state->ldap_struct, entry, "uid", username)) { + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, "uid", username)) { DEBUG(1, ("No uid attribute found for this user!\n")); return False; } @@ -1962,13 +468,13 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) { - if (get_single_attribute(ldap_state->ldap_struct, entry, + if (smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), temp)) { pdb_set_user_sid_from_string(sampass, temp, PDB_SET); } - if (get_single_attribute(ldap_state->ldap_struct, entry, + if (smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_SID), temp)) { pdb_set_group_sid_from_string(sampass, temp, PDB_SET); @@ -1982,14 +488,14 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } else { - if (get_single_attribute(ldap_state->ldap_struct, entry, + if (smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), temp)) { user_rid = (uint32)atol(temp); pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_RID), temp)) { pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT); @@ -2027,7 +533,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, { GROUP_MAP map; /* call the mapping code here */ - if(pdb_getgrgid(&map, gid, MAPPING_WITHOUT_PRIV)) { + if(pdb_getgrgid(&map, gid)) { pdb_set_group_sid(sampass, &map.sid, PDB_SET); } else { @@ -2036,7 +542,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), temp)) { /* leave as default */ @@ -2045,7 +551,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp)) { /* leave as default */ @@ -2054,7 +560,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_logon_time(sampass, logon_time, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp)) { /* leave as default */ @@ -2063,7 +569,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_logoff_time(sampass, logoff_time, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp)) { /* leave as default */ @@ -2072,7 +578,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp)) { /* leave as default */ @@ -2081,7 +587,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp)) { /* leave as default */ @@ -2096,10 +602,10 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, * that fits your needs; using cn then displayName rather than 'userFullName' */ - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME), fullname)) { - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_CN), fullname)) { /* leave as default */ @@ -2110,7 +616,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_fullname(sampass, fullname, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE), dir_drive)) { pdb_set_dir_drive(sampass, talloc_sub_specified(sampass->mem_ctx, @@ -2122,7 +628,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_dir_drive(sampass, dir_drive, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH), homedir)) { pdb_set_homedir(sampass, talloc_sub_specified(sampass->mem_ctx, @@ -2134,7 +640,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_homedir(sampass, homedir, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT), logon_script)) { pdb_set_logon_script(sampass, talloc_sub_specified(sampass->mem_ctx, @@ -2146,7 +652,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_logon_script(sampass, logon_script, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH), profile_path)) { pdb_set_profile_path(sampass, talloc_sub_specified(sampass->mem_ctx, @@ -2158,7 +664,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_profile_path(sampass, profile_path, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC), acct_desc)) { /* leave as default */ @@ -2166,7 +672,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_acct_desc(sampass, acct_desc, PDB_SET); } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS), workstations)) { /* leave as default */; @@ -2180,7 +686,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, hours_len = 21; memset(hours, 0xff, hours_len); - if (!get_single_attribute (ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute (ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), temp)) { /* leave as default */ @@ -2192,7 +698,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, ZERO_STRUCT(smblmpwd); } - if (!get_single_attribute (ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute (ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), temp)) { /* leave as default */ @@ -2204,7 +710,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, ZERO_STRUCT(smbntpwd); } - if (!get_single_attribute (ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute (ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO), temp)) { acct_ctrl |= ACB_NORMAL; @@ -2256,39 +762,11 @@ static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, * do this on a per-mod basis */ if (need_update(sampass, PDB_USERNAME)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, "uid", pdb_get_username(sampass)); DEBUG(2, ("Setting entry for user: %s\n", pdb_get_username(sampass))); - if (pdb_get_init_flags(sampass, PDB_USERSID) == PDB_DEFAULT) { - if (ldap_state->permit_non_unix_accounts) { - if (!NT_STATUS_IS_OK(ldapsam_next_rid(ldap_state, &rid, USER_RID_TYPE))) { - DEBUG(0, ("NO user RID specified on account %s, and " - "finding next available NUA RID failed, " - "cannot store!\n", - pdb_get_username(sampass))); - ldap_mods_free(*mods, 1); - return False; - } - } else { - DEBUG(0, ("NO user RID specified on account %s, " - "cannot store!\n", pdb_get_username(sampass))); - ldap_mods_free(*mods, 1); - return False; - } - - /* now that we have figured out the RID, always store it, as - the schema requires it (either as a SID or a RID) */ - - if (!pdb_set_user_sid_from_rid(sampass, rid, PDB_CHANGED)) { - DEBUG(0, ("Could not store RID back onto SAM_ACCOUNT for user %s!\n", - pdb_get_username(sampass))); - ldap_mods_free(*mods, 1); - return False; - } - } - /* only update the RID if we actually need to */ if (need_update(sampass, PDB_USERSID)) { @@ -2299,20 +777,20 @@ static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, switch ( ldap_state->schema_ver ) { case SCHEMAVER_SAMBAACCOUNT: - if (!sid_peek_check_rid(get_global_sam_sid(), user_sid, &rid)) { + if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) { DEBUG(1, ("User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n", sid_to_string(sid_string, user_sid), - sid_to_string(dom_sid_string, get_global_sam_sid()))); + sid_to_string(dom_sid_string, &ldap_state->domain_sid))); return False; } slprintf(temp, sizeof(temp) - 1, "%i", rid); - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), temp); break; case SCHEMAVER_SAMBASAMACCOUNT: - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), sid_to_string(sid_string, user_sid)); break; @@ -2335,21 +813,21 @@ static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, switch ( ldap_state->schema_ver ) { case SCHEMAVER_SAMBAACCOUNT: - if (!sid_peek_check_rid(get_global_sam_sid(), group_sid, &rid)) { + if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) { DEBUG(1, ("User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n", sid_to_string(sid_string, group_sid), - sid_to_string(dom_sid_string, get_global_sam_sid()))); + sid_to_string(dom_sid_string, &ldap_state->domain_sid))); return False; } slprintf(temp, sizeof(temp) - 1, "%i", rid); - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_RID), temp); break; case SCHEMAVER_SAMBASAMACCOUNT: - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_SID), sid_to_string(sid_string, group_sid)); break; @@ -2370,63 +848,63 @@ static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, */ if (need_update(sampass, PDB_FULLNAME)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME), pdb_get_fullname(sampass)); if (need_update(sampass, PDB_ACCTDESC)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC), pdb_get_acct_desc(sampass)); if (need_update(sampass, PDB_WORKSTATIONS)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS), pdb_get_workstations(sampass)); if (need_update(sampass, PDB_SMBHOME)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH), pdb_get_homedir(sampass)); if (need_update(sampass, PDB_DRIVE)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE), pdb_get_dir_drive(sampass)); if (need_update(sampass, PDB_LOGONSCRIPT)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT), pdb_get_logon_script(sampass)); if (need_update(sampass, PDB_PROFILE)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH), pdb_get_profile_path(sampass)); slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logon_time(sampass)); if (need_update(sampass, PDB_LOGONTIME)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp); slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logoff_time(sampass)); if (need_update(sampass, PDB_LOGOFFTIME)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp); slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_kickoff_time(sampass)); if (need_update(sampass, PDB_KICKOFFTIME)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp); slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_can_change_time(sampass)); if (need_update(sampass, PDB_CANCHANGETIME)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp); slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_must_change_time(sampass)); if (need_update(sampass, PDB_MUSTCHANGETIME)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp); if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) @@ -2437,7 +915,7 @@ static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, pdb_get_acct_ctrl(sampass)); if (need_update(sampass, PDB_LMPASSWD)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), temp); @@ -2445,13 +923,13 @@ static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, pdb_get_acct_ctrl(sampass)); if (need_update(sampass, PDB_NTPASSWD)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), temp); slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_last_set_time(sampass)); if (need_update(sampass, PDB_PASSLASTSET)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), temp); } @@ -2459,7 +937,7 @@ static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, /* FIXME: Hours stuff goes in LDAP */ if (need_update(sampass, PDB_ACCTCTRL)) - make_ldap_mod(ldap_state->ldap_struct, existing, mods, + smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO), pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass), NEW_PW_FORMAT_SPACE_PADDED_LEN)); @@ -2483,7 +961,8 @@ static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, BOOL update) all_string_sub(filter, "%u", "*", sizeof(pstring)); attr_list = get_userattr_list(ldap_state->schema_ver); - rc = ldapsam_search_suffix(ldap_state, filter, attr_list, &ldap_state->result); + rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, + attr_list, &ldap_state->result); free_attr_list( attr_list ); if (rc != LDAP_SUCCESS) { @@ -2495,10 +974,10 @@ static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, BOOL update) } DEBUG(2, ("ldapsam_setsampwent: %d entries in the base!\n", - ldap_count_entries(ldap_state->ldap_struct, + ldap_count_entries(ldap_state->smbldap_state->ldap_struct, ldap_state->result))); - ldap_state->entry = ldap_first_entry(ldap_state->ldap_struct, + ldap_state->entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, ldap_state->result); ldap_state->index = 0; @@ -2526,10 +1005,6 @@ static NTSTATUS ldapsam_getsampwent(struct pdb_methods *my_methods, SAM_ACCOUNT struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; BOOL bret = False; - /* The rebind proc needs this *HACK*. We are not multithreaded, so - this will work, but it's not nice. */ - static_ldap_state = ldap_state; - while (!bret) { if (!ldap_state->entry) return ret; @@ -2537,7 +1012,7 @@ static NTSTATUS ldapsam_getsampwent(struct pdb_methods *my_methods, SAM_ACCOUNT ldap_state->index++; bret = init_sam_from_ldap(ldap_state, user, ldap_state->entry); - ldap_state->entry = ldap_next_entry(ldap_state->ldap_struct, + ldap_state->entry = ldap_next_entry(ldap_state->smbldap_state->ldap_struct, ldap_state->entry); } @@ -2564,28 +1039,32 @@ static NTSTATUS ldapsam_getsampwnam(struct pdb_methods *my_methods, SAM_ACCOUNT if ( rc != LDAP_SUCCESS ) return NT_STATUS_NO_SUCH_USER; - count = ldap_count_entries(ldap_state->ldap_struct, result); + count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); if (count < 1) { DEBUG(4, ("Unable to locate user [%s] count=%d\n", sname, count)); + ldap_msgfree(result); return NT_STATUS_NO_SUCH_USER; } else if (count > 1) { DEBUG(1, ("Duplicate entries for this user [%s] Failing. count=%d\n", sname, count)); + ldap_msgfree(result); return NT_STATUS_NO_SUCH_USER; } - entry = ldap_first_entry(ldap_state->ldap_struct, result); + entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); if (entry) { if (!init_sam_from_ldap(ldap_state, user, entry)) { DEBUG(1,("ldapsam_getsampwnam: init_sam_from_ldap failed for user '%s'!\n", sname)); ldap_msgfree(result); return NT_STATUS_NO_SUCH_USER; } - ldap_msgfree(result); + pdb_set_backend_private_data(user, result, + private_data_free_fn, + my_methods, PDB_CHANGED); ret = NT_STATUS_OK; } else { ldap_msgfree(result); @@ -2593,55 +1072,65 @@ static NTSTATUS ldapsam_getsampwnam(struct pdb_methods *my_methods, SAM_ACCOUNT return ret; } -/********************************************************************** -Get SAM_ACCOUNT entry from LDAP by SID -*********************************************************************/ -static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUNT * user, const DOM_SID *sid) +static int ldapsam_get_ldap_user_by_sid(struct ldapsam_privates *ldap_state, + const DOM_SID *sid, LDAPMessage **result) { - NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; - LDAPMessage *result; - LDAPMessage *entry; - fstring sid_string; - int count; - int rc; + int rc = -1; char ** attr_list; - + uint32 rid; + switch ( ldap_state->schema_ver ) { case SCHEMAVER_SAMBASAMACCOUNT: attr_list = get_userattr_list(ldap_state->schema_ver); - rc = ldapsam_search_suffix_by_sid(ldap_state, sid, &result, attr_list); + rc = ldapsam_search_suffix_by_sid(ldap_state, sid, result, attr_list); free_attr_list( attr_list ); if ( rc != LDAP_SUCCESS ) - return NT_STATUS_NO_SUCH_USER; + return rc; break; case SCHEMAVER_SAMBAACCOUNT: - { - uint32 rid; - if (!sid_peek_check_rid(get_global_sam_sid(), sid, &rid)) { - return NT_STATUS_NO_SUCH_USER; + if (!sid_peek_check_rid(&ldap_state->domain_sid, sid, &rid)) { + return rc; } attr_list = get_userattr_list(ldap_state->schema_ver); - rc = ldapsam_search_suffix_by_rid(ldap_state, rid, &result, attr_list ); + rc = ldapsam_search_suffix_by_rid(ldap_state, rid, result, attr_list ); free_attr_list( attr_list ); if ( rc != LDAP_SUCCESS ) - return NT_STATUS_NO_SUCH_USER; - } - break; + return rc; + break; } - - count = ldap_count_entries(ldap_state->ldap_struct, result); + return rc; +} + +/********************************************************************** +Get SAM_ACCOUNT entry from LDAP by SID +*********************************************************************/ +static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUNT * user, const DOM_SID *sid) +{ + struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; + LDAPMessage *result; + LDAPMessage *entry; + int count; + int rc; + fstring sid_string; + + rc = ldapsam_get_ldap_user_by_sid(ldap_state, + sid, &result); + if (rc != LDAP_SUCCESS) + return NT_STATUS_NO_SUCH_USER; + + count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); if (count < 1) { DEBUG(4, ("Unable to locate SID [%s] count=%d\n", sid_to_string(sid_string, sid), count)); + ldap_msgfree(result); return NT_STATUS_NO_SUCH_USER; } else if (count > 1) @@ -2649,23 +1138,27 @@ static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUNT DEBUG(1, ("More than one user with SID [%s]. Failing. count=%d\n", sid_to_string(sid_string, sid), count)); + ldap_msgfree(result); return NT_STATUS_NO_SUCH_USER; } - entry = ldap_first_entry(ldap_state->ldap_struct, result); - if (entry) + entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); + if (!entry) { - if (!init_sam_from_ldap(ldap_state, user, entry)) { - DEBUG(1,("ldapsam_getsampwrid: init_sam_from_ldap failed!\n")); - ldap_msgfree(result); - return NT_STATUS_NO_SUCH_USER; - } ldap_msgfree(result); - ret = NT_STATUS_OK; - } else { + return NT_STATUS_NO_SUCH_USER; + } + + if (!init_sam_from_ldap(ldap_state, user, entry)) { + DEBUG(1,("ldapsam_getsampwrid: init_sam_from_ldap failed!\n")); ldap_msgfree(result); + return NT_STATUS_NO_SUCH_USER; } - return ret; + + pdb_set_backend_private_data(user, result, + private_data_free_fn, + my_methods, PDB_CHANGED); + return NT_STATUS_OK; } /******************************************************************** @@ -2693,20 +1186,25 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, switch(ldap_op) { case LDAP_MOD_ADD: - make_a_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_ACCOUNT); - rc = ldapsam_add(ldap_state, dn, mods); + smbldap_set_mod(&mods, LDAP_MOD_ADD, + "objectclass", + LDAP_OBJ_ACCOUNT); + rc = smbldap_add(ldap_state->smbldap_state, + dn, mods); break; case LDAP_MOD_REPLACE: - rc = ldapsam_modify(ldap_state, dn ,mods); + rc = smbldap_modify(ldap_state->smbldap_state, + dn ,mods); break; default: - DEBUG(0,("Wrong LDAP operation type: %d!\n", ldap_op)); + DEBUG(0,("Wrong LDAP operation type: %d!\n", + ldap_op)); return NT_STATUS_INVALID_PARAMETER; } if (rc!=LDAP_SUCCESS) { char *ld_error = NULL; - ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, + ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); DEBUG(1, ("failed to %s user dn= %s with: %s\n\t%s\n", @@ -2718,7 +1216,6 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, } } -#ifdef LDAP_EXOP_X_MODIFY_PASSWD if (!(pdb_get_acct_ctrl(newpwd)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) && (lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_OFF) && need_update(newpwd, PDB_PLAINTEXT_PW) && @@ -2745,8 +1242,8 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, } ber_printf (ber, "{"); - ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID, utf8_dn); - ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_NEW, utf8_password); + ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_ID, utf8_dn); + ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_NEW, utf8_password); ber_printf (ber, "N}"); if ((rc = ber_flatten (ber, &bv))<0) { @@ -2761,8 +1258,10 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, SAFE_FREE(utf8_password); ber_free(ber, 1); - if ((rc = ldapsam_extended_operation(ldap_state, LDAP_EXOP_X_MODIFY_PASSWD, - bv, NULL, NULL, &retoid, &retdata))!=LDAP_SUCCESS) { + if ((rc = smbldap_extended_operation(ldap_state->smbldap_state, + LDAP_EXOP_MODIFY_PASSWD, + bv, NULL, NULL, &retoid, + &retdata)) != LDAP_SUCCESS) { DEBUG(0,("LDAP Password could not be changed for user %s: %s\n", pdb_get_username(newpwd),ldap_err2string(rc))); } else { @@ -2775,9 +1274,6 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, } ber_bvfree(bv); } -#else - DEBUG(10,("LDAP PASSWORD SYNC is not supported!\n")); -#endif /* LDAP_EXOP_X_MODIFY_PASSWD */ return NT_STATUS_OK; } @@ -2857,43 +1353,46 @@ static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, SAM_A LDAPMod **mods; char **attr_list; - attr_list = get_userattr_list(ldap_state->schema_ver); - rc = ldapsam_search_suffix_by_name(ldap_state, pdb_get_username(newpwd), &result, attr_list ); - free_attr_list( attr_list ); - if (rc != LDAP_SUCCESS) - return NT_STATUS_UNSUCCESSFUL; + result = pdb_get_backend_private_data(newpwd, my_methods); + if (!result) { + attr_list = get_userattr_list(ldap_state->schema_ver); + rc = ldapsam_search_suffix_by_name(ldap_state, pdb_get_username(newpwd), &result, attr_list ); + free_attr_list( attr_list ); + if (rc != LDAP_SUCCESS) { + return NT_STATUS_UNSUCCESSFUL; + } + pdb_set_backend_private_data(newpwd, result, private_data_free_fn, my_methods, PDB_CHANGED); + } - if (ldap_count_entries(ldap_state->ldap_struct, result) == 0) { + if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) { DEBUG(0, ("No user to modify!\n")); - ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; } - entry = ldap_first_entry(ldap_state->ldap_struct, result); - dn = ldap_get_dn(ldap_state->ldap_struct, entry); + entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); + dn = ldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry); + + DEBUG(4, ("user %s to be modified has dn: %s\n", pdb_get_username(newpwd), dn)); if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd, element_is_changed)) { DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n")); - ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; } - ldap_msgfree(result); - if (mods == NULL) { DEBUG(4,("mods is empty: nothing to update for user: %s\n", pdb_get_username(newpwd))); - ldap_mods_free(mods, 1); + ldap_mods_free(mods, True); return NT_STATUS_OK; } ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, element_is_changed); - ldap_mods_free(mods,1); + ldap_mods_free(mods,True); if (!NT_STATUS_IS_OK(ret)) { char *ld_error = NULL; - ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, + ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); DEBUG(0,("failed to modify user with uid = %s, error: %s (%s)\n", pdb_get_username(newpwd), ld_error?ld_error:"(unknwon)", ldap_err2string(rc))); @@ -2935,7 +1434,9 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO char **attr_list; char *escape_user; const char *username = pdb_get_username(newpwd); + const DOM_SID *sid = pdb_get_user_sid(newpwd); pstring filter; + fstring sid_string; if (!username || !*username) { DEBUG(0, ("Cannot add user without a username!\n")); @@ -2943,8 +1444,8 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO } /* free this list after the second search or in case we exit on failure */ - attr_list = get_userattr_list(ldap_state->schema_ver); + rc = ldapsam_search_suffix_by_name (ldap_state, username, &result, attr_list); if (rc != LDAP_SUCCESS) { @@ -2952,7 +1453,7 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO return NT_STATUS_UNSUCCESSFUL; } - if (ldap_count_entries(ldap_state->ldap_struct, result) != 0) { + if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) { DEBUG(0,("User '%s' already in the base, with samba attributes\n", username)); ldap_msgfree(result); @@ -2960,25 +1461,42 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO return NT_STATUS_UNSUCCESSFUL; } ldap_msgfree(result); + result = NULL; + + if (element_is_set_or_changed(newpwd, PDB_USERSID)) { + rc = ldapsam_get_ldap_user_by_sid(ldap_state, + sid, &result); + if (rc == LDAP_SUCCESS) { + if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) { + DEBUG(0,("SID '%s' already in the base, with samba attributes\n", + sid_to_string(sid_string, sid))); + free_attr_list( attr_list ); + return NT_STATUS_UNSUCCESSFUL; + } + ldap_msgfree(result); + } + } - /* does the entry already exist but without a samba rttibutes? - we don't really care what attributes are returned here */ + /* does the entry already exist but without a samba attributes? + we need to return the samba attributes here */ escape_user = escape_ldap_string_alloc( username ); pstrcpy( filter, lp_ldap_filter() ); all_string_sub( filter, "%u", escape_user, sizeof(filter) ); SAFE_FREE( escape_user ); - rc = ldapsam_search_suffix(ldap_state, filter, attr_list, &result); - free_attr_list( attr_list ); - - if ( rc != LDAP_SUCCESS ) + rc = smbldap_search_suffix(ldap_state->smbldap_state, + filter, attr_list, &result); + if ( rc != LDAP_SUCCESS ) { + free_attr_list( attr_list ); return NT_STATUS_UNSUCCESSFUL; + } - num_result = ldap_count_entries(ldap_state->ldap_struct, result); + num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); if (num_result > 1) { DEBUG (0, ("More than one user with that uid exists: bailing out!\n")); + free_attr_list( attr_list ); ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; } @@ -2989,19 +1507,62 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO DEBUG(3,("User exists without samba attributes: adding them\n")); ldap_op = LDAP_MOD_REPLACE; - entry = ldap_first_entry (ldap_state->ldap_struct, result); - tmp = ldap_get_dn (ldap_state->ldap_struct, entry); + entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result); + tmp = ldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry); slprintf (dn, sizeof (dn) - 1, "%s", tmp); ldap_memfree (tmp); - } else { + + } else if (ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT) { + + /* There might be a SID for this account already - say an idmap entry */ + + snprintf(filter, sizeof(filter)-1, "(&(%s=%s)(|(objectClass=%s)(objectClass=%s)))", + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), + sid_to_string(sid_string, sid), + LDAP_OBJ_IDMAP_ENTRY, + LDAP_OBJ_SID_ENTRY); + + rc = smbldap_search_suffix(ldap_state->smbldap_state, + filter, attr_list, &result); + + if ( rc != LDAP_SUCCESS ) { + free_attr_list( attr_list ); + return NT_STATUS_UNSUCCESSFUL; + } + + num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); + + if (num_result > 1) { + DEBUG (0, ("More than one user with that uid exists: bailing out!\n")); + free_attr_list( attr_list ); + ldap_msgfree(result); + return NT_STATUS_UNSUCCESSFUL; + } + + /* Check if we need to update an existing entry */ + if (num_result == 1) { + char *tmp; + + DEBUG(3,("User exists without samba attributes: adding them\n")); + ldap_op = LDAP_MOD_REPLACE; + entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result); + tmp = ldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry); + slprintf (dn, sizeof (dn) - 1, "%s", tmp); + ldap_memfree (tmp); + } + } + + free_attr_list( attr_list ); + + if (num_result == 0) { /* Check if we need to add an entry */ DEBUG(3,("Adding new user\n")); ldap_op = LDAP_MOD_ADD; if (username[strlen(username)-1] == '$') { - slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_machine_suffix ()); - } else { - slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_user_suffix ()); - } + slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_machine_suffix ()); + } else { + slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_user_suffix ()); + } } if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd, @@ -3020,10 +1581,10 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO switch ( ldap_state->schema_ver ) { case SCHEMAVER_SAMBAACCOUNT: - make_a_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBAACCOUNT); + smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBAACCOUNT); break; case SCHEMAVER_SAMBASAMACCOUNT: - make_a_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBASAMACCOUNT); + smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBASAMACCOUNT); break; default: DEBUG(0,("ldapsam_add_sam_account: invalid schema version specified\n")); @@ -3031,43 +1592,19 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO } ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, element_is_set_or_changed); - if (NT_STATUS_IS_ERR(ret)) { + if (!NT_STATUS_IS_OK(ret)) { DEBUG(0,("failed to modify/add user with uid = %s (dn = %s)\n", pdb_get_username(newpwd),dn)); - ldap_mods_free(mods,1); + ldap_mods_free(mods, True); return ret; } DEBUG(2,("added: uid == %s in the LDAP database\n", pdb_get_username(newpwd))); - ldap_mods_free(mods, 1); + ldap_mods_free(mods, True); return NT_STATUS_OK; } -/********************************************************************** - Housekeeping - *********************************************************************/ - -static void free_private_data(void **vp) -{ - struct ldapsam_privates **ldap_state = (struct ldapsam_privates **)vp; - - ldapsam_close(*ldap_state); - - if ((*ldap_state)->bind_secret) { - memset((*ldap_state)->bind_secret, '\0', strlen((*ldap_state)->bind_secret)); - } - - ldapsam_close(*ldap_state); - - SAFE_FREE((*ldap_state)->bind_dn); - SAFE_FREE((*ldap_state)->bind_secret); - - *ldap_state = NULL; - - /* No need to free any further, as it is talloc()ed */ -} - /********************************************************************** *********************************************************************/ @@ -3083,19 +1620,20 @@ static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state, attr_list = get_attr_list(groupmap_attr_list); - rc = ldapsam_search(ldap_state, lp_ldap_suffix (), scope, + rc = smbldap_search(ldap_state->smbldap_state, + lp_ldap_group_suffix (), scope, filter, attr_list, 0, result); free_attr_list( attr_list ); if (rc != LDAP_SUCCESS) { char *ld_error = NULL; - ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, + ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); DEBUG(0, ("ldapsam_search_one_group: " "Problem during the LDAP search: LDAP error: %s (%s)", ld_error?ld_error:"(unknown)", ldap_err2string(rc))); DEBUG(3, ("ldapsam_search_one_group: Query was: %s, %s\n", - lp_ldap_suffix(), filter)); + lp_ldap_group_suffix(), filter)); SAFE_FREE(ld_error); } @@ -3111,13 +1649,13 @@ static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, pstring temp; if (ldap_state == NULL || map == NULL || entry == NULL || - ldap_state->ldap_struct == NULL) + ldap_state->smbldap_state->ldap_struct == NULL) { DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n")); return False; } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER), temp)) { DEBUG(0, ("Mandatory attribute %s not found\n", @@ -3128,7 +1666,7 @@ static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, map->gid = (gid_t)atol(temp); - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID), temp)) { DEBUG(0, ("Mandatory attribute %s not found\n", @@ -3137,7 +1675,7 @@ static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, } string_to_sid(&map->sid, temp); - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), temp)) { DEBUG(0, ("Mandatory attribute %s not found\n", @@ -3152,11 +1690,11 @@ static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, return False; } - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), temp)) { temp[0] = '\0'; - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_attr_key2string( groupmap_attr_list, LDAP_ATTR_CN), temp)) { DEBUG(0, ("Attributes cn not found either " @@ -3166,16 +1704,13 @@ static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, } fstrcpy(map->nt_name, temp); - if (!get_single_attribute(ldap_state->ldap_struct, entry, + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), temp)) { temp[0] = '\0'; } fstrcpy(map->comment, temp); - map->systemaccount = 0; - init_privilege(&map->priv_set); - return True; } @@ -3197,15 +1732,15 @@ static BOOL init_ldap_from_group(LDAP *ldap_struct, *mods = NULL; sid_to_string(tmp, &map->sid); - make_ldap_mod(ldap_struct, existing, mods, + smbldap_make_mod(ldap_struct, existing, mods, get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID), tmp); snprintf(tmp, sizeof(tmp)-1, "%i", map->sid_name_use); - make_ldap_mod(ldap_struct, existing, mods, + smbldap_make_mod(ldap_struct, existing, mods, get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), tmp); - make_ldap_mod(ldap_struct, existing, mods, + smbldap_make_mod(ldap_struct, existing, mods, get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), map->nt_name); - make_ldap_mod(ldap_struct, existing, mods, + smbldap_make_mod(ldap_struct, existing, mods, get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), map->comment); return True; @@ -3229,20 +1764,22 @@ static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods, return NT_STATUS_NO_SUCH_GROUP; } - count = ldap_count_entries(ldap_state->ldap_struct, result); + count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); if (count < 1) { - DEBUG(4, ("Did not find group for filter %s\n", filter)); + DEBUG(4, ("Did not find group\n")); + ldap_msgfree(result); return NT_STATUS_NO_SUCH_GROUP; } if (count > 1) { DEBUG(1, ("Duplicate entries for filter %s: count=%d\n", filter, count)); + ldap_msgfree(result); return NT_STATUS_NO_SUCH_GROUP; } - entry = ldap_first_entry(ldap_state->ldap_struct, result); + entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); if (!entry) { ldap_msgfree(result); @@ -3264,7 +1801,7 @@ static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods, *********************************************************************/ static NTSTATUS ldapsam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map, - DOM_SID sid, BOOL with_priv) + DOM_SID sid) { pstring filter; @@ -3280,7 +1817,7 @@ static NTSTATUS ldapsam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map, *********************************************************************/ static NTSTATUS ldapsam_getgrgid(struct pdb_methods *methods, GROUP_MAP *map, - gid_t gid, BOOL with_priv) + gid_t gid) { pstring filter; @@ -3296,16 +1833,21 @@ static NTSTATUS ldapsam_getgrgid(struct pdb_methods *methods, GROUP_MAP *map, *********************************************************************/ static NTSTATUS ldapsam_getgrnam(struct pdb_methods *methods, GROUP_MAP *map, - char *name, BOOL with_priv) + const char *name) { pstring filter; + char *escape_name = escape_ldap_string_alloc(name); - /* TODO: Escaping of name? */ + if (!escape_name) { + return NT_STATUS_NO_MEMORY; + } snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(|(%s=%s)(%s=%s)))", LDAP_OBJ_GROUPMAP, - get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), name, - get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN), name); + get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), escape_name, + get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN), escape_name); + + SAFE_FREE(escape_name); return ldapsam_getgroup(methods, filter, map); } @@ -3337,6 +1879,7 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, (struct ldapsam_privates *)methods->private_data; LDAPMessage *result = NULL; LDAPMod **mods = NULL; + int count; char *tmp; pstring dn; @@ -3347,7 +1890,7 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, int rc; if (NT_STATUS_IS_OK(ldapsam_getgrgid(methods, &dummy, - map->gid, False))) { + map->gid))) { DEBUG(0, ("Group %i already exists in LDAP\n", map->gid)); return NT_STATUS_UNSUCCESSFUL; } @@ -3357,22 +1900,27 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, return NT_STATUS_UNSUCCESSFUL; } - if (ldap_count_entries(ldap_state->ldap_struct, result) != 1) { + count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); + + if ( count == 0 ) + return NT_STATUS_UNSUCCESSFUL; + + if (count > 1) { DEBUG(2, ("Group %i must exist exactly once in LDAP\n", map->gid)); ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; } - entry = ldap_first_entry(ldap_state->ldap_struct, result); - tmp = ldap_get_dn(ldap_state->ldap_struct, entry); + entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); + tmp = ldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry); pstrcpy(dn, tmp); ldap_memfree(tmp); - if (!init_ldap_from_group(ldap_state->ldap_struct, + if (!init_ldap_from_group(ldap_state->smbldap_state->ldap_struct, result, &mods, map)) { DEBUG(0, ("init_ldap_from_group failed!\n")); - ldap_mods_free(mods, 1); + ldap_mods_free(mods, True); ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; } @@ -3384,15 +1932,14 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, return NT_STATUS_UNSUCCESSFUL; } - make_a_mod(&mods, LDAP_MOD_ADD, "objectClass", - "sambaGroupMapping"); + smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP ); - rc = ldapsam_modify(ldap_state, dn, mods); - ldap_mods_free(mods, 1); + rc = smbldap_modify(ldap_state->smbldap_state, dn, mods); + ldap_mods_free(mods, True); if (rc != LDAP_SUCCESS) { char *ld_error = NULL; - ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, + ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); DEBUG(0, ("failed to add group %i error: %s (%s)\n", map->gid, ld_error ? ld_error : "(unknown)", ldap_err2string(rc))); @@ -3424,16 +1971,16 @@ static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods, return NT_STATUS_UNSUCCESSFUL; } - if (ldap_count_entries(ldap_state->ldap_struct, result) == 0) { + if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) { DEBUG(0, ("No group to modify!\n")); ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; } - entry = ldap_first_entry(ldap_state->ldap_struct, result); - dn = ldap_get_dn(ldap_state->ldap_struct, entry); + entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); + dn = ldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry); - if (!init_ldap_from_group(ldap_state->ldap_struct, + if (!init_ldap_from_group(ldap_state->smbldap_state->ldap_struct, result, &mods, map)) { DEBUG(0, ("init_ldap_from_group failed\n")); ldap_msgfree(result); @@ -3447,13 +1994,13 @@ static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods, return NT_STATUS_UNSUCCESSFUL; } - rc = ldapsam_modify(ldap_state, dn, mods); + rc = smbldap_modify(ldap_state->smbldap_state, dn, mods); - ldap_mods_free(mods, 1); + ldap_mods_free(mods, True); if (rc != LDAP_SUCCESS) { char *ld_error = NULL; - ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, + ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); DEBUG(0, ("failed to modify group %i error: %s (%s)\n", map->gid, ld_error ? ld_error : "(unknown)", ldap_err2string(rc))); @@ -3509,24 +2056,24 @@ static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods, BOOL update) snprintf( filter, sizeof(filter)-1, "(objectclass=%s)", LDAP_OBJ_GROUPMAP); attr_list = get_attr_list( groupmap_attr_list ); - rc = ldapsam_search(ldap_state, lp_ldap_suffix(), + rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(), LDAP_SCOPE_SUBTREE, filter, attr_list, 0, &ldap_state->result); free_attr_list( attr_list ); if (rc != LDAP_SUCCESS) { DEBUG(0, ("LDAP search failed: %s\n", ldap_err2string(rc))); - DEBUG(3, ("Query was: %s, %s\n", lp_ldap_suffix(), filter)); + DEBUG(3, ("Query was: %s, %s\n", lp_ldap_group_suffix(), filter)); ldap_msgfree(ldap_state->result); ldap_state->result = NULL; return NT_STATUS_UNSUCCESSFUL; } DEBUG(2, ("ldapsam_setsampwent: %d entries in the base!\n", - ldap_count_entries(ldap_state->ldap_struct, + ldap_count_entries(ldap_state->smbldap_state->ldap_struct, ldap_state->result))); - ldap_state->entry = ldap_first_entry(ldap_state->ldap_struct, ldap_state->result); + ldap_state->entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, ldap_state->result); ldap_state->index = 0; return NT_STATUS_OK; @@ -3550,10 +2097,6 @@ static NTSTATUS ldapsam_getsamgrent(struct pdb_methods *my_methods, struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; BOOL bret = False; - /* The rebind proc needs this *HACK*. We are not multithreaded, so - this will work, but it's not nice. */ - static_ldap_state = ldap_state; - while (!bret) { if (!ldap_state->entry) return ret; @@ -3561,7 +2104,7 @@ static NTSTATUS ldapsam_getsamgrent(struct pdb_methods *my_methods, ldap_state->index++; bret = init_group_from_ldap(ldap_state, map, ldap_state->entry); - ldap_state->entry = ldap_next_entry(ldap_state->ldap_struct, + ldap_state->entry = ldap_next_entry(ldap_state->smbldap_state->ldap_struct, ldap_state->entry); } @@ -3574,7 +2117,7 @@ static NTSTATUS ldapsam_getsamgrent(struct pdb_methods *my_methods, static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods, enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, int *num_entries, - BOOL unix_only, BOOL with_priv) + BOOL unix_only) { GROUP_MAP map; GROUP_MAP *mapt; @@ -3622,6 +2165,22 @@ static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods, } /********************************************************************** + Housekeeping + *********************************************************************/ + +static void free_private_data(void **vp) +{ + struct ldapsam_privates **ldap_state = (struct ldapsam_privates **)vp; + + smbldap_free_struct(&(*ldap_state)->smbldap_state); + + *ldap_state = NULL; + + /* No need to free any further, as it is talloc()ed */ +} + +/********************************************************************** + Intitalise the parts of the pdb_context that are common to all pdb_ldap modes *********************************************************************/ static NTSTATUS pdb_init_ldapsam_common(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, @@ -3655,26 +2214,21 @@ static NTSTATUS pdb_init_ldapsam_common(PDB_CONTEXT *pdb_context, PDB_METHODS ** /* TODO: Setup private data and free */ - ldap_state = talloc_zero(pdb_context->mem_ctx, sizeof(struct ldapsam_privates)); - + ldap_state = talloc_zero(pdb_context->mem_ctx, sizeof(*ldap_state)); if (!ldap_state) { DEBUG(0, ("talloc() failed for ldapsam private_data!\n")); return NT_STATUS_NO_MEMORY; } - if (location) { - ldap_state->uri = talloc_strdup(pdb_context->mem_ctx, location); - } else { - ldap_state->uri = "ldap://localhost"; - } + if (!NT_STATUS_IS_OK(nt_status = + smbldap_init(pdb_context->mem_ctx, location, + &ldap_state->smbldap_state))); ldap_state->domain_name = talloc_strdup(pdb_context->mem_ctx, get_global_sam_name()); if (!ldap_state->domain_name) { return NT_STATUS_NO_MEMORY; } - sid_copy(&ldap_state->domain_sid, get_global_sam_sid()); - (*pdb_method)->private_data = ldap_state; (*pdb_method)->free_private_data = free_private_data; @@ -3683,6 +2237,7 @@ static NTSTATUS pdb_init_ldapsam_common(PDB_CONTEXT *pdb_context, PDB_METHODS ** } /********************************************************************** + Initialise the 'compat' mode for pdb_ldap *********************************************************************/ static NTSTATUS pdb_init_ldapsam_compat(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location) @@ -3690,21 +2245,8 @@ static NTSTATUS pdb_init_ldapsam_compat(PDB_CONTEXT *pdb_context, PDB_METHODS ** NTSTATUS nt_status; struct ldapsam_privates *ldap_state; - if (!NT_STATUS_IS_OK(nt_status = pdb_init_ldapsam_common(pdb_context, pdb_method, location))) { - return nt_status; - } - - (*pdb_method)->name = "ldapsam_compat"; - - ldap_state = (*pdb_method)->private_data; - ldap_state->schema_ver = SCHEMAVER_SAMBAACCOUNT; - - if (location) { - ldap_state->uri = talloc_strdup(pdb_context->mem_ctx, location); - } else { -#ifndef WITH_LDAP_SAMCONFIG - ldap_state->uri = "ldap://localhost"; -#else +#ifdef WITH_LDAP_SAMCONFIG + if (!location) { int ldap_port = lp_ldap_port(); /* remap default port if not using SSL (ie clear or TLS) */ @@ -3712,25 +2254,42 @@ static NTSTATUS pdb_init_ldapsam_compat(PDB_CONTEXT *pdb_context, PDB_METHODS ** ldap_port = 389; } - ldap_state->uri = talloc_asprintf(pdb_context->mem_ctx, "%s://%s:%d", lp_ldap_ssl() == LDAP_SSL_ON ? "ldaps" : "ldap", lp_ldap_server(), ldap_port); - if (!ldap_state->uri) { + location = talloc_asprintf(pdb_context->mem_ctx, "%s://%s:%d", lp_ldap_ssl() == LDAP_SSL_ON ? "ldaps" : "ldap", lp_ldap_server(), ldap_port); + if (!location) { return NT_STATUS_NO_MEMORY; } + } #endif + + if (!NT_STATUS_IS_OK(nt_status = pdb_init_ldapsam_common(pdb_context, pdb_method, location))) { + return nt_status; } + (*pdb_method)->name = "ldapsam_compat"; + + ldap_state = (*pdb_method)->private_data; + ldap_state->schema_ver = SCHEMAVER_SAMBAACCOUNT; + + sid_copy(&ldap_state->domain_sid, get_global_sam_sid()); + return NT_STATUS_OK; } /********************************************************************** + Initialise the normal mode for pdb_ldap *********************************************************************/ static NTSTATUS pdb_init_ldapsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location) { NTSTATUS nt_status; struct ldapsam_privates *ldap_state; - uint32 low_idmap_uid, high_idmap_uid; - uint32 low_idmap_gid, high_idmap_gid; + uint32 alg_rid_base; + pstring alg_rid_base_string; + LDAPMessage *result = NULL; + LDAPMessage *entry = NULL; + DOM_SID ldap_domain_sid; + DOM_SID secrets_domain_sid; + pstring domain_sid_string; if (!NT_STATUS_IS_OK(nt_status = pdb_init_ldapsam_common(pdb_context, pdb_method, location))) { return nt_status; @@ -3739,23 +2298,57 @@ static NTSTATUS pdb_init_ldapsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_met (*pdb_method)->name = "ldapsam"; ldap_state = (*pdb_method)->private_data; - ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT; - ldap_state->permit_non_unix_accounts = False; + ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT; + + /* Try to setup the Domain Name, Domain SID, algorithmic rid base */ + + nt_status = smbldap_search_domain_info(ldap_state->smbldap_state, &result, + ldap_state->domain_name, True); + + if ( !NT_STATUS_IS_OK(nt_status) ) { + DEBUG(2, ("WARNING: Could not get domain info, nor add one to the domain\n")); + DEBUGADD(2, ("Continuing on regardless, will be unable to allocate new users/groups, " + "and will risk BDCs having inconsistant SIDs\n")); + sid_copy(&ldap_state->domain_sid, get_global_sam_sid()); + return NT_STATUS_OK; + } - /* check for non-unix account ranges */ + /* Given that the above might fail, everything below this must be optional */ + + entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); + if (!entry) { + DEBUG(0, ("Could not get domain info entry\n")); + ldap_msgfree(result); + return NT_STATUS_UNSUCCESSFUL; + } - if (lp_idmap_uid(&low_idmap_uid, &high_idmap_uid) - && lp_idmap_gid(&low_idmap_gid, &high_idmap_gid)) + if (smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), + domain_sid_string)) { - DEBUG(2, ("Enabling non-unix account ranges\n")); - - ldap_state->permit_non_unix_accounts = True; + BOOL found_sid; + string_to_sid(&ldap_domain_sid, domain_sid_string); + found_sid = secrets_fetch_domain_sid(ldap_state->domain_name, &secrets_domain_sid); + if (!found_sid || !sid_equal(&secrets_domain_sid, &ldap_domain_sid)) { + /* reset secrets.tdb sid */ + secrets_store_domain_sid(ldap_state->domain_name, &ldap_domain_sid); + } + sid_copy(&ldap_state->domain_sid, &ldap_domain_sid); + } - ldap_state->low_allocated_user_rid = fallback_pdb_uid_to_user_rid(low_idmap_uid); - ldap_state->high_allocated_user_rid = fallback_pdb_uid_to_user_rid(high_idmap_uid); - ldap_state->low_allocated_group_rid = pdb_gid_to_group_rid(low_idmap_gid); - ldap_state->high_allocated_group_rid = pdb_gid_to_group_rid(high_idmap_gid); + if (smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ALGORITHMIC_RID_BASE), + alg_rid_base_string)) + { + alg_rid_base = (uint32)atol(alg_rid_base_string); + if (alg_rid_base != algorithmic_rid_base()) { + DEBUG(0, ("The value of 'algorithmic RID base' has changed since the LDAP\n" + "database was initialised. Aborting. \n")); + ldap_msgfree(result); + return NT_STATUS_UNSUCCESSFUL; + } } + ldap_msgfree(result); return NT_STATUS_OK; } diff --git a/source3/passdb/pdb_smbpasswd.c b/source3/passdb/pdb_smbpasswd.c index c392846d93..055e8e71ba 100644 --- a/source3/passdb/pdb_smbpasswd.c +++ b/source3/passdb/pdb_smbpasswd.c @@ -1,10 +1,10 @@ /* * Unix SMB/CIFS implementation. * SMB parameters and setup - * Copyright (C) Andrew Tridgell 1992-1998 - * Modified by Jeremy Allison 1995. - * Modified by Gerald (Jerry) Carter 2000-2001 - * Modified by Andrew Bartlett 2002. + * Copyright (C) Andrew Tridgell 1992-1998 + * Modified by Jeremy Allison 1995. + * Modified by Gerald (Jerry) Carter 2000-2001,2003 + * Modified by Andrew Bartlett 2002. * * This program is free software; you can redistribute it and/or modify it under * the terms of the GNU General Public License as published by the Free @@ -34,14 +34,13 @@ struct smb_passwd { - BOOL smb_userid_set; /* this is actually the unix uid_t */ - uint32 smb_userid; /* this is actually the unix uid_t */ + uint32 smb_userid; /* this is actually the unix uid_t */ const char *smb_name; /* username string */ - const unsigned char *smb_passwd; /* Null if no password */ + const unsigned char *smb_passwd; /* Null if no password */ const unsigned char *smb_nt_passwd; /* Null if no password */ - uint16 acct_ctrl; /* account info (ACB_xxxx bit-mask) */ + uint16 acct_ctrl; /* account info (ACB_xxxx bit-mask) */ time_t pass_last_set_time; /* password last set time */ }; @@ -61,12 +60,6 @@ struct smbpasswd_privates /* retrive-once info */ const char *smbpasswd_file; - - BOOL permit_non_unix_accounts; - - uid_t low_nua_userid; - uid_t high_nua_userid; - }; enum pwf_access_type { PWF_READ, PWF_UPDATE, PWF_CREATE }; @@ -591,28 +584,6 @@ static BOOL add_smbfilepwd_entry(struct smbpasswd_privates *smbpasswd_state, str /* Ok - entry doesn't exist. We can add it */ - /* Account not in /etc/passwd hack!!! */ - if (!newpwd->smb_userid_set) { - if (!smbpasswd_state->permit_non_unix_accounts) { - DEBUG(0, ("add_smbfilepwd_entry: cannot add account %s without unix identity\n", newpwd->smb_name)); - endsmbfilepwent(fp, &(smbpasswd_state->pw_file_lock_depth)); - return False; - } - - if (max_found_uid < smbpasswd_state->low_nua_userid) { - newpwd->smb_userid = smbpasswd_state->low_nua_userid; - newpwd->smb_userid_set = True; - } else if (max_found_uid >= smbpasswd_state->high_nua_userid) { - DEBUG(0, ("add_smbfilepwd_entry: cannot add machine %s, no uids are free! \n", newpwd->smb_name)); - endsmbfilepwent(fp, &(smbpasswd_state->pw_file_lock_depth)); - return False; - } else { - newpwd->smb_userid = max_found_uid + 1; - newpwd->smb_userid_set = True; - } - } - - /* Create a new smb passwd entry and set it to the given password. */ /* * The add user write needs to be atomic - so get the fd from @@ -1133,24 +1104,32 @@ Error was %s\n", pwd->smb_name, pfile2, strerror(errno))); ********************************************************************/ static BOOL build_smb_pass (struct smb_passwd *smb_pw, const SAM_ACCOUNT *sampass) { - uid_t uid; uint32 rid; if (sampass == NULL) return False; - - rid = pdb_get_user_rid(sampass); - - /* If the user specified a RID, make sure its able to be both stored and retreived */ - if (rid && rid != DOMAIN_USER_RID_GUEST && uid != fallback_pdb_user_rid_to_uid(rid)) { - DEBUG(0,("build_sam_pass: Failing attempt to store user with non-uid based user RID. \n")); - return False; - } - ZERO_STRUCTP(smb_pw); - smb_pw->smb_userid_set = True; - smb_pw->smb_userid=uid; + if (!IS_SAM_DEFAULT(sampass, PDB_USERSID)) { + rid = pdb_get_user_rid(sampass); + + /* If the user specified a RID, make sure its able to be both stored and retreived */ + if (rid == DOMAIN_USER_RID_GUEST) { + struct passwd *passwd = getpwnam_alloc(lp_guestaccount()); + if (!passwd) { + DEBUG(0, ("Could not find gest account via getpwnam()! (%s)\n", lp_guestaccount())); + return False; + } + smb_pw->smb_userid=passwd->pw_uid; + passwd_free(&passwd); + + } else if (fallback_pdb_rid_is_user(rid)) { + smb_pw->smb_userid=fallback_pdb_user_rid_to_uid(rid); + } else { + DEBUG(0,("build_sam_pass: Failing attempt to store user with non-uid based user RID. \n")); + return False; + } + } smb_pw->smb_name=(const char*)pdb_get_username(sampass); @@ -1160,25 +1139,6 @@ static BOOL build_smb_pass (struct smb_passwd *smb_pw, const SAM_ACCOUNT *sampas smb_pw->acct_ctrl=pdb_get_acct_ctrl(sampass); smb_pw->pass_last_set_time=pdb_get_pass_last_set_time(sampass); -#if 0 - /* - * ifdef'out by JFM on 11/29/2001. - * this assertion is no longer valid - * and I don't understand the goal - * and doing the same thing with the group mapping code - * is hairy ! - * - * We just have the RID, in which SID is it valid ? - * our domain SID ? well known SID ? local SID ? - */ - - if (gid != pdb_group_rid_to_gid(pdb_get_group_rid(sampass))) { - DEBUG(0,("build_sam_pass: Failing attempt to store user with non-gid based primary group RID. \n")); - DEBUG(0,("build_sam_pass: %d %d %d. \n", *gid, pdb_group_rid_to_gid(pdb_get_group_rid(sampass)), pdb_get_group_rid(sampass))); - return False; - } -#endif - return True; } @@ -1194,49 +1154,28 @@ static BOOL build_sam_account(struct smbpasswd_privates *smbpasswd_state, DEBUG(5,("build_sam_account: SAM_ACCOUNT is NULL\n")); return False; } - - pwfile = getpwnam_alloc(pw_buf->smb_name); - if (pwfile == NULL) { - if ((smbpasswd_state->permit_non_unix_accounts) - && (pw_buf->smb_userid >= smbpasswd_state->low_nua_userid) - && (pw_buf->smb_userid <= smbpasswd_state->high_nua_userid)) { - pdb_set_user_sid_from_rid(sam_pass, fallback_pdb_uid_to_user_rid (pw_buf->smb_userid), PDB_SET); + /* verify the user account exists */ - /* lkclXXXX this is OBSERVED behaviour by NT PDCs, enforced here. - - This was down the bottom for machines, but it looks pretty good as - a general default for non-unix users. --abartlet 2002-01-08 - */ - pdb_set_group_sid_from_rid (sam_pass, DOMAIN_GROUP_RID_USERS, PDB_SET); - pdb_set_username (sam_pass, pw_buf->smb_name, PDB_SET); - pdb_set_domain (sam_pass, get_global_sam_name(), PDB_DEFAULT); - - } else { - DEBUG(0,("build_sam_account: smbpasswd database is corrupt! username %s with uid %u is not in unix passwd database!\n", pw_buf->smb_name, pw_buf->smb_userid)); + if ( !(pwfile = getpwnam_alloc(pw_buf->smb_name)) ) { + DEBUG(0,("build_sam_account: smbpasswd database is corrupt! username %s with uid " + "%u is not in unix passwd database!\n", pw_buf->smb_name, pw_buf->smb_userid)); return False; - } - } else { - if (!NT_STATUS_IS_OK(pdb_fill_sam_pw(sam_pass, pwfile))) { - return False; - } - - passwd_free(&pwfile); } + if (!NT_STATUS_IS_OK(pdb_fill_sam_pw(sam_pass, pwfile))) + return False; + + passwd_free(&pwfile); + + /* set remaining fields */ + pdb_set_nt_passwd (sam_pass, pw_buf->smb_nt_passwd, PDB_SET); pdb_set_lanman_passwd (sam_pass, pw_buf->smb_passwd, PDB_SET); pdb_set_acct_ctrl (sam_pass, pw_buf->acct_ctrl, PDB_SET); pdb_set_pass_last_set_time (sam_pass, pw_buf->pass_last_set_time, PDB_SET); pdb_set_pass_can_change_time (sam_pass, pw_buf->pass_last_set_time, PDB_SET); -#if 0 /* JERRY */ - /* the smbpasswd format doesn't have a must change time field, so - we can't get this right. The best we can do is to set this to - some time in the future. 21 days seems as reasonable as any other value :) - */ - pdb_set_pass_must_change_time (sam_pass, pw_buf->pass_last_set_time + MAX_PASSWORD_AGE, PDB_DEFAULT); -#endif return True; } @@ -1342,7 +1281,7 @@ static NTSTATUS smbpasswd_getsampwnam(struct pdb_methods *my_methods, fp = startsmbfilepwent(smbpasswd_state->smbpasswd_file, PWF_READ, &(smbpasswd_state->pw_file_lock_depth)); if (fp == NULL) { - DEBUG(0, ("unable to open passdb database.\n")); + DEBUG(0, ("Unable to open passdb database.\n")); return nt_status; } @@ -1402,7 +1341,7 @@ static NTSTATUS smbpasswd_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUN fp = startsmbfilepwent(smbpasswd_state->smbpasswd_file, PWF_READ, &(smbpasswd_state->pw_file_lock_depth)); if (fp == NULL) { - DEBUG(0, ("unable to open passdb database.\n")); + DEBUG(0, ("Unable to open passdb database.\n")); return nt_status; } @@ -1502,7 +1441,7 @@ static void free_private_data(void **vp) /* No need to free any further, as it is talloc()ed */ } -NTSTATUS pdb_init_smbpasswd(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location) +static NTSTATUS pdb_init_smbpasswd(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location) { NTSTATUS nt_status; struct smbpasswd_privates *privates; @@ -1548,16 +1487,10 @@ NTSTATUS pdb_init_smbpasswd(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, (*pdb_method)->free_private_data = free_private_data; - if (lp_idmap_uid(&privates->low_nua_userid, &privates->high_nua_userid)) { - DEBUG(0, ("idmap uid range defined, non unix accounts enabled\n")); - privates->permit_non_unix_accounts = True; - } - return NT_STATUS_OK; } -int pdb_smbpasswd_init(void) +NTSTATUS pdb_smbpasswd_init(void) { - smb_register_passdb(PASSDB_INTERFACE_VERSION, "smbpasswd", pdb_init_smbpasswd); - return True; + return smb_register_passdb(PASSDB_INTERFACE_VERSION, "smbpasswd", pdb_init_smbpasswd); } diff --git a/source3/passdb/pdb_tdb.c b/source3/passdb/pdb_tdb.c index 7f8c2a26f7..1078a5bd26 100644 --- a/source3/passdb/pdb_tdb.c +++ b/source3/passdb/pdb_tdb.c @@ -1,11 +1,11 @@ /* * Unix SMB/CIFS implementation. * SMB parameters and setup - * Copyright (C) Andrew Tridgell 1992-1998 - * Copyright (C) Simo Sorce 2000-2002 - * Copyright (C) Gerald Carter 2000 - * Copyright (C) Jeremy Allison 2001 - * Copyright (C) Andrew Bartlett 2002 + * Copyright (C) Andrew Tridgell 1992-1998 + * Copyright (C) Simo Sorce 2000-2002 + * Copyright (C) Gerald Carter 2000 + * Copyright (C) Jeremy Allison 2001 + * Copyright (C) Andrew Bartlett 2002 * * This program is free software; you can redistribute it and/or modify it under * the terms of the GNU General Public License as published by the Free @@ -39,7 +39,6 @@ static int tdbsam_debug_level = DBGC_ALL; #define PDB_VERSION "20010830" #define PASSDB_FILE_NAME "passdb.tdb" -#define TDB_FORMAT_STRING "ddddddBBBBBBBBBBBBddBBwdwdBdd" #define USERPREFIX "USER_" #define RIDPREFIX "RID_" @@ -49,410 +48,8 @@ struct tdbsam_privates { /* retrive-once info */ const char *tdbsam_location; - - BOOL permit_non_unix_accounts; - - BOOL algorithmic_rids; - - uint32 low_nua_rid; - uint32 high_nua_rid; }; -/********************************************************************** - Intialize a SAM_ACCOUNT struct from a BYTE buffer of size len - *********************************************************************/ - -static BOOL init_sam_from_buffer (struct tdbsam_privates *tdb_state, - SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen) -{ - - /* times are stored as 32bit integer - take care on system with 64bit wide time_t - --SSS */ - uint32 logon_time, - logoff_time, - kickoff_time, - pass_last_set_time, - pass_can_change_time, - pass_must_change_time; - char *username; - char *domain; - char *nt_username; - char *dir_drive; - char *unknown_str; - char *munged_dial; - char *fullname; - char *homedir; - char *logon_script; - char *profile_path; - char *acct_desc; - char *workstations; - uint32 username_len, domain_len, nt_username_len, - dir_drive_len, unknown_str_len, munged_dial_len, - fullname_len, homedir_len, logon_script_len, - profile_path_len, acct_desc_len, workstations_len; - - uint32 user_rid, group_rid, unknown_3, hours_len, unknown_5, unknown_6; - uint16 acct_ctrl, logon_divs; - uint8 *hours; - static uint8 *lm_pw_ptr, *nt_pw_ptr; - uint32 len = 0; - uint32 lm_pw_len, nt_pw_len, hourslen; - BOOL ret = True; - uid_t uid = -1; - gid_t gid = -1; - - if(sampass == NULL || buf == NULL) { - DEBUG(0, ("init_sam_from_buffer: NULL parameters found!\n")); - return False; - } - - /* unpack the buffer into variables */ - len = tdb_unpack (buf, buflen, TDB_FORMAT_STRING, - &logon_time, - &logoff_time, - &kickoff_time, - &pass_last_set_time, - &pass_can_change_time, - &pass_must_change_time, - &username_len, &username, - &domain_len, &domain, - &nt_username_len, &nt_username, - &fullname_len, &fullname, - &homedir_len, &homedir, - &dir_drive_len, &dir_drive, - &logon_script_len, &logon_script, - &profile_path_len, &profile_path, - &acct_desc_len, &acct_desc, - &workstations_len, &workstations, - &unknown_str_len, &unknown_str, - &munged_dial_len, &munged_dial, - &user_rid, - &group_rid, - &lm_pw_len, &lm_pw_ptr, - &nt_pw_len, &nt_pw_ptr, - &acct_ctrl, - &unknown_3, - &logon_divs, - &hours_len, - &hourslen, &hours, - &unknown_5, - &unknown_6); - - if (len == -1) { - ret = False; - goto done; - } - - pdb_set_logon_time(sampass, logon_time, PDB_SET); - pdb_set_logoff_time(sampass, logoff_time, PDB_SET); - pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET); - pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET); - pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET); - pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET); - - pdb_set_username (sampass, username, PDB_SET); - pdb_set_domain (sampass, domain, PDB_SET); - pdb_set_nt_username (sampass, nt_username, PDB_SET); - pdb_set_fullname (sampass, fullname, PDB_SET); - - if (homedir) { - pdb_set_homedir(sampass, homedir, PDB_SET); - } - else { - pdb_set_homedir(sampass, - talloc_sub_specified(sampass->mem_ctx, - lp_logon_home(), - username, domain, - uid, gid), - PDB_DEFAULT); - } - - if (dir_drive) - pdb_set_dir_drive(sampass, dir_drive, PDB_SET); - else { - pdb_set_dir_drive(sampass, - talloc_sub_specified(sampass->mem_ctx, - lp_logon_drive(), - username, domain, - uid, gid), - PDB_DEFAULT); - } - - if (logon_script) - pdb_set_logon_script(sampass, logon_script, PDB_SET); - else { - pdb_set_logon_script(sampass, - talloc_sub_specified(sampass->mem_ctx, - lp_logon_script(), - username, domain, - uid, gid), - PDB_DEFAULT); - } - - if (profile_path) { - pdb_set_profile_path(sampass, profile_path, PDB_SET); - } else { - pdb_set_profile_path(sampass, - talloc_sub_specified(sampass->mem_ctx, - lp_logon_path(), - username, domain, - uid, gid), - PDB_DEFAULT); - } - - pdb_set_acct_desc (sampass, acct_desc, PDB_SET); - pdb_set_workstations (sampass, workstations, PDB_SET); - pdb_set_munged_dial (sampass, munged_dial, PDB_SET); - - if (lm_pw_ptr && lm_pw_len == LM_HASH_LEN) { - if (!pdb_set_lanman_passwd(sampass, lm_pw_ptr, PDB_SET)) { - ret = False; - goto done; - } - } - - if (nt_pw_ptr && nt_pw_len == NT_HASH_LEN) { - if (!pdb_set_nt_passwd(sampass, nt_pw_ptr, PDB_SET)) { - ret = False; - goto done; - } - } - - pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET); - pdb_set_group_sid_from_rid(sampass, group_rid, PDB_SET); - pdb_set_unknown_3(sampass, unknown_3, PDB_SET); - pdb_set_hours_len(sampass, hours_len, PDB_SET); - pdb_set_unknown_5(sampass, unknown_5, PDB_SET); - pdb_set_unknown_6(sampass, unknown_6, PDB_SET); - pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET); - pdb_set_logon_divs(sampass, logon_divs, PDB_SET); - pdb_set_hours(sampass, hours, PDB_SET); - -done: - - SAFE_FREE(username); - SAFE_FREE(domain); - SAFE_FREE(nt_username); - SAFE_FREE(fullname); - SAFE_FREE(homedir); - SAFE_FREE(dir_drive); - SAFE_FREE(logon_script); - SAFE_FREE(profile_path); - SAFE_FREE(acct_desc); - SAFE_FREE(workstations); - SAFE_FREE(munged_dial); - - return ret; -} - -/********************************************************************** - Intialize a BYTE buffer from a SAM_ACCOUNT struct - *********************************************************************/ -static uint32 init_buffer_from_sam (struct tdbsam_privates *tdb_state, - uint8 **buf, const SAM_ACCOUNT *sampass) -{ - size_t len, buflen; - - /* times are stored as 32bit integer - take care on system with 64bit wide time_t - --SSS */ - uint32 logon_time, - logoff_time, - kickoff_time, - pass_last_set_time, - pass_can_change_time, - pass_must_change_time; - - uint32 user_rid, group_rid; - - const char *username; - const char *domain; - const char *nt_username; - const char *dir_drive; - const char *unknown_str; - const char *munged_dial; - const char *fullname; - const char *homedir; - const char *logon_script; - const char *profile_path; - const char *acct_desc; - const char *workstations; - uint32 username_len, domain_len, nt_username_len, - dir_drive_len, unknown_str_len, munged_dial_len, - fullname_len, homedir_len, logon_script_len, - profile_path_len, acct_desc_len, workstations_len; - - const uint8 *lm_pw; - const uint8 *nt_pw; - uint32 lm_pw_len = 16; - uint32 nt_pw_len = 16; - - /* do we have a valid SAM_ACCOUNT pointer? */ - if (sampass == NULL) { - DEBUG(0, ("init_buffer_from_sam: SAM_ACCOUNT is NULL!\n")); - return -1; - } - - *buf = NULL; - buflen = 0; - - logon_time = (uint32)pdb_get_logon_time(sampass); - logoff_time = (uint32)pdb_get_logoff_time(sampass); - kickoff_time = (uint32)pdb_get_kickoff_time(sampass); - pass_can_change_time = (uint32)pdb_get_pass_can_change_time(sampass); - pass_must_change_time = (uint32)pdb_get_pass_must_change_time(sampass); - pass_last_set_time = (uint32)pdb_get_pass_last_set_time(sampass); - - user_rid = pdb_get_user_rid(sampass); - group_rid = pdb_get_group_rid(sampass); - - username = pdb_get_username(sampass); - if (username) username_len = strlen(username) +1; - else username_len = 0; - - domain = pdb_get_domain(sampass); - if (domain) domain_len = strlen(domain) +1; - else domain_len = 0; - - nt_username = pdb_get_nt_username(sampass); - if (nt_username) nt_username_len = strlen(nt_username) +1; - else nt_username_len = 0; - - fullname = pdb_get_fullname(sampass); - if (fullname) fullname_len = strlen(fullname) +1; - else fullname_len = 0; - - /* - * Only updates fields which have been set (not defaults from smb.conf) - */ - - if (!IS_SAM_DEFAULT(sampass, PDB_DRIVE)) - dir_drive = pdb_get_dir_drive(sampass); - else dir_drive = NULL; - if (dir_drive) dir_drive_len = strlen(dir_drive) +1; - else dir_drive_len = 0; - - if (!IS_SAM_DEFAULT(sampass, PDB_SMBHOME)) homedir = pdb_get_homedir(sampass); - else homedir = NULL; - if (homedir) homedir_len = strlen(homedir) +1; - else homedir_len = 0; - - if (!IS_SAM_DEFAULT(sampass, PDB_LOGONSCRIPT)) logon_script = pdb_get_logon_script(sampass); - else logon_script = NULL; - if (logon_script) logon_script_len = strlen(logon_script) +1; - else logon_script_len = 0; - - if (!IS_SAM_DEFAULT(sampass, PDB_PROFILE)) profile_path = pdb_get_profile_path(sampass); - else profile_path = NULL; - if (profile_path) profile_path_len = strlen(profile_path) +1; - else profile_path_len = 0; - - lm_pw = pdb_get_lanman_passwd(sampass); - if (!lm_pw) lm_pw_len = 0; - - nt_pw = pdb_get_nt_passwd(sampass); - if (!nt_pw) nt_pw_len = 0; - - acct_desc = pdb_get_acct_desc(sampass); - if (acct_desc) acct_desc_len = strlen(acct_desc) +1; - else acct_desc_len = 0; - - workstations = pdb_get_workstations(sampass); - if (workstations) workstations_len = strlen(workstations) +1; - else workstations_len = 0; - - unknown_str = NULL; - unknown_str_len = 0; - - munged_dial = pdb_get_munged_dial(sampass); - if (munged_dial) munged_dial_len = strlen(munged_dial) +1; - else munged_dial_len = 0; - - /* one time to get the size needed */ - len = tdb_pack(NULL, 0, TDB_FORMAT_STRING, - logon_time, - logoff_time, - kickoff_time, - pass_last_set_time, - pass_can_change_time, - pass_must_change_time, - username_len, username, - domain_len, domain, - nt_username_len, nt_username, - fullname_len, fullname, - homedir_len, homedir, - dir_drive_len, dir_drive, - logon_script_len, logon_script, - profile_path_len, profile_path, - acct_desc_len, acct_desc, - workstations_len, workstations, - unknown_str_len, unknown_str, - munged_dial_len, munged_dial, - user_rid, - group_rid, - lm_pw_len, lm_pw, - nt_pw_len, nt_pw, - pdb_get_acct_ctrl(sampass), - pdb_get_unknown_3(sampass), - pdb_get_logon_divs(sampass), - pdb_get_hours_len(sampass), - MAX_HOURS_LEN, pdb_get_hours(sampass), - pdb_get_unknown_5(sampass), - pdb_get_unknown_6(sampass)); - - - /* malloc the space needed */ - if ( (*buf=(uint8*)malloc(len)) == NULL) { - DEBUG(0,("init_buffer_from_sam: Unable to malloc() memory for buffer!\n")); - return (-1); - } - - /* now for the real call to tdb_pack() */ - buflen = tdb_pack(*buf, len, TDB_FORMAT_STRING, - logon_time, - logoff_time, - kickoff_time, - pass_last_set_time, - pass_can_change_time, - pass_must_change_time, - username_len, username, - domain_len, domain, - nt_username_len, nt_username, - fullname_len, fullname, - homedir_len, homedir, - dir_drive_len, dir_drive, - logon_script_len, logon_script, - profile_path_len, profile_path, - acct_desc_len, acct_desc, - workstations_len, workstations, - unknown_str_len, unknown_str, - munged_dial_len, munged_dial, - user_rid, - group_rid, - lm_pw_len, lm_pw, - nt_pw_len, nt_pw, - pdb_get_acct_ctrl(sampass), - pdb_get_unknown_3(sampass), - pdb_get_logon_divs(sampass), - pdb_get_hours_len(sampass), - MAX_HOURS_LEN, pdb_get_hours(sampass), - pdb_get_unknown_5(sampass), - pdb_get_unknown_6(sampass)); - - - /* check to make sure we got it correct */ - if (buflen != len) { - DEBUG(0, ("init_buffer_from_sam: somthing odd is going on here: bufflen (%d) != len (%d) in tdb_pack operations!\n", - buflen, len)); - /* error */ - SAFE_FREE (*buf); - return (-1); - } - - return (buflen); -} - /*************************************************************** Open the TDB passwd database for SAM account enumeration. ****************************************************************/ @@ -488,6 +85,7 @@ static void close_tdb(struct tdbsam_privates *tdb_state) static void tdbsam_endsampwent(struct pdb_methods *my_methods) { struct tdbsam_privates *tdb_state = (struct tdbsam_privates *)my_methods->private_data; + SAFE_FREE(tdb_state->key.dptr); close_tdb(tdb_state); DEBUG(7, ("endtdbpwent: closed sam database.\n")); @@ -501,7 +99,7 @@ static NTSTATUS tdbsam_getsampwent(struct pdb_methods *my_methods, SAM_ACCOUNT * { NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL; struct tdbsam_privates *tdb_state = (struct tdbsam_privates *)my_methods->private_data; - TDB_DATA data; + TDB_DATA data, old_key; const char *prefix = USERPREFIX; int prefixlen = strlen (prefix); @@ -512,10 +110,16 @@ static NTSTATUS tdbsam_getsampwent(struct pdb_methods *my_methods, SAM_ACCOUNT * } /* skip all non-USER entries (eg. RIDs) */ - while ((tdb_state->key.dsize != 0) && (strncmp(tdb_state->key.dptr, prefix, prefixlen))) + while ((tdb_state->key.dsize != 0) && (strncmp(tdb_state->key.dptr, prefix, prefixlen))) { + + old_key = tdb_state->key; + /* increment to next in line */ tdb_state->key = tdb_nextkey(tdb_state->passwd_tdb, tdb_state->key); + SAFE_FREE(old_key.dptr); + } + /* do we have an valid iteration pointer? */ if(tdb_state->passwd_tdb == NULL) { DEBUG(0,("pdb_get_sampwent: Bad TDB Context pointer.\n")); @@ -529,16 +133,20 @@ static NTSTATUS tdbsam_getsampwent(struct pdb_methods *my_methods, SAM_ACCOUNT * } /* unpack the buffer */ - if (!init_sam_from_buffer(tdb_state, user, data.dptr, data.dsize)) { + if (!init_sam_from_buffer(user, data.dptr, data.dsize)) { DEBUG(0,("pdb_getsampwent: Bad SAM_ACCOUNT entry returned from TDB!\n")); SAFE_FREE(data.dptr); return nt_status; } SAFE_FREE(data.dptr); + old_key = tdb_state->key; + /* increment to next in line */ tdb_state->key = tdb_nextkey(tdb_state->passwd_tdb, tdb_state->key); + SAFE_FREE(old_key.dptr); + return NT_STATUS_OK; } @@ -563,7 +171,7 @@ static NTSTATUS tdbsam_getsampwnam (struct pdb_methods *my_methods, SAM_ACCOUNT /* Data is stored in all lower-case */ fstrcpy(name, sname); - strlower(name); + strlower_m(name); /* set search key */ slprintf(keystr, sizeof(keystr)-1, "%s%s", USERPREFIX, name); @@ -587,7 +195,7 @@ static NTSTATUS tdbsam_getsampwnam (struct pdb_methods *my_methods, SAM_ACCOUNT } /* unpack the buffer */ - if (!init_sam_from_buffer(tdb_state, user, data.dptr, data.dsize)) { + if (!init_sam_from_buffer(user, data.dptr, data.dsize)) { DEBUG(0,("pdb_getsampwent: Bad SAM_ACCOUNT entry returned from TDB!\n")); SAFE_FREE(data.dptr); tdb_close(pwd_tdb); @@ -670,7 +278,7 @@ static NTSTATUS tdbsam_delete_sam_account(struct pdb_methods *my_methods, SAM_AC fstring name; fstrcpy(name, pdb_get_username(sam_pass)); - strlower(name); + strlower_m(name); /* open the TDB */ if (!(pwd_tdb = tdb_open_log(tdb_state->tdbsam_location, 0, TDB_DEFAULT, O_RDWR, 0600))) { @@ -727,63 +335,39 @@ static BOOL tdb_update_sam(struct pdb_methods *my_methods, SAM_ACCOUNT* newpwd, fstring name; BOOL ret = True; uint32 user_rid; - BOOL tdb_ret; /* invalidate the existing TDB iterator if it is open */ + if (tdb_state->passwd_tdb) { tdb_close(tdb_state->passwd_tdb); tdb_state->passwd_tdb = NULL; } /* open the account TDB passwd*/ + pwd_tdb = tdb_open_log(tdb_state->tdbsam_location, 0, TDB_DEFAULT, O_RDWR | O_CREAT, 0600); - if (!pwd_tdb) - { - DEBUG(0, ("tdb_update_sam: Unable to open TDB passwd (%s)!\n", tdb_state->tdbsam_location)); + + if (!pwd_tdb) { + DEBUG(0, ("tdb_update_sam: Unable to open TDB passwd (%s)!\n", + tdb_state->tdbsam_location)); return False; } if (!pdb_get_group_rid(newpwd)) { - DEBUG (0,("tdb_update_sam: Failing to store a SAM_ACCOUNT for [%s] without a primary group RID\n",pdb_get_username(newpwd))); + DEBUG (0,("tdb_update_sam: Failing to store a SAM_ACCOUNT for [%s] without a primary group RID\n", + pdb_get_username(newpwd))); ret = False; goto done; } - /* if flag == TDB_INSERT then make up a new RID else throw an error. */ - if (!(user_rid = pdb_get_user_rid(newpwd))) { - if ((flag & TDB_INSERT) && tdb_state->permit_non_unix_accounts) { - uint32 lowrid, highrid; - if (!idmap_get_free_rid_range(&lowrid, &highrid)) { - /* should never happen */ - DEBUG(0, ("tdbsam: something messed up, no high/low rids but nua enabled ?!\n")); - ret = False; - goto done; - } - user_rid = lowrid; - tdb_ret = tdb_change_uint32_atomic(pwd_tdb, "RID_COUNTER", &user_rid, RID_MULTIPLIER); - if (!tdb_ret) { - ret = False; - goto done; - } - if (user_rid > highrid) { - DEBUG(0, ("tdbsam: no NUA rids available, cannot add user %s!\n", pdb_get_username(newpwd))); - ret = False; - goto done; - } - if (!pdb_set_user_sid_from_rid(newpwd, user_rid, PDB_CHANGED)) { - DEBUG(0, ("tdbsam: not able to set new allocated user RID into sam account!\n")); - ret = False; - goto done; - } - } else { - DEBUG (0,("tdb_update_sam: Failing to store a SAM_ACCOUNT for [%s] without a RID\n",pdb_get_username(newpwd))); - ret = False; - goto done; - } + if ( !(user_rid = pdb_get_user_rid(newpwd)) ) { + DEBUG(0,("tdb_update_sam: SAM_ACCOUNT (%s) with no RID!\n", pdb_get_username(newpwd))); + ret = False; + goto done; } /* copy the SAM_ACCOUNT struct into a BYTE buffer for storage */ - if ((data.dsize=init_buffer_from_sam (tdb_state, &buf, newpwd)) == -1) { + if ((data.dsize=init_buffer_from_sam (&buf, newpwd, False)) == -1) { DEBUG(0,("tdb_update_sam: ERROR - Unable to copy SAM_ACCOUNT info BYTE buffer!\n")); ret = False; goto done; @@ -791,7 +375,7 @@ static BOOL tdb_update_sam(struct pdb_methods *my_methods, SAM_ACCOUNT* newpwd, data.dptr = buf; fstrcpy(name, pdb_get_username(newpwd)); - strlower(name); + strlower_m(name); DEBUG(5, ("Storing %saccount %s with RID %d\n", flag == TDB_INSERT ? "(new) " : "", name, user_rid)); @@ -912,11 +496,10 @@ static void free_private_data(void **vp) } -NTSTATUS pdb_init_tdbsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location) +static NTSTATUS pdb_init_tdbsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location) { NTSTATUS nt_status; struct tdbsam_privates *tdb_state; - uid_t low_nua_uid, high_nua_uid; if (!NT_STATUS_IS_OK(nt_status = make_pdb_methods(pdb_context->mem_ctx, pdb_method))) { return nt_status; @@ -954,25 +537,11 @@ NTSTATUS pdb_init_tdbsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, con (*pdb_method)->free_private_data = free_private_data; - if (lp_idmap_uid(&low_nua_uid, &high_nua_uid)) { - DEBUG(0, ("idmap uid range defined, non unix accounts enabled\n")); - - tdb_state->permit_non_unix_accounts = True; - - tdb_state->low_nua_rid=fallback_pdb_uid_to_user_rid(low_nua_uid); - - tdb_state->high_nua_rid=fallback_pdb_uid_to_user_rid(high_nua_uid); - - } else { - tdb_state->algorithmic_rids = True; - } - return NT_STATUS_OK; } -int pdb_tdbsam_init(void) +NTSTATUS pdb_tdbsam_init(void) { - smb_register_passdb(PASSDB_INTERFACE_VERSION, "tdbsam", pdb_init_tdbsam); - return True; + return smb_register_passdb(PASSDB_INTERFACE_VERSION, "tdbsam", pdb_init_tdbsam); } diff --git a/source3/passdb/pdb_xml.c b/source3/passdb/pdb_xml.c index 7a5c0e2b53..154d8c927f 100644 --- a/source3/passdb/pdb_xml.c +++ b/source3/passdb/pdb_xml.c @@ -28,7 +28,7 @@ */ -#define XML_URL "http://www.samba.org/ns" +#define XML_URL "http://samba.org/~jelmer/sambapdb.dtd" #include "includes.h" diff --git a/source3/passdb/privileges.c b/source3/passdb/privileges.c index 688053674b..624817e32e 100644 --- a/source3/passdb/privileges.c +++ b/source3/passdb/privileges.c @@ -107,7 +107,7 @@ NTSTATUS privilege_enum_account_with_right(const char *right, return NT_STATUS_INTERNAL_ERROR; } - data = tdb_fetch_by_string(tdb, right); + data = tdb_fetch_bystring(tdb, right); if (!data.dptr) { *count = 0; *sids = NULL; @@ -168,7 +168,7 @@ static NTSTATUS privilege_set_accounts_with_right(const char *right, data.dsize = PTR_DIFF(p, data.dptr); - if (tdb_store_by_string(tdb, right, data, TDB_REPLACE) != 0) { + if (tdb_store_bystring(tdb, right, data, TDB_REPLACE) != 0) { free(data.dptr); return NT_STATUS_INTERNAL_ERROR; } diff --git a/source3/passdb/secrets.c b/source3/passdb/secrets.c index 5df0edc29a..bad8e96865 100644 --- a/source3/passdb/secrets.c +++ b/source3/passdb/secrets.c @@ -100,7 +100,7 @@ BOOL secrets_store_domain_sid(const char *domain, const DOM_SID *sid) fstring key; slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_SID, domain); - strupper(key); + strupper_m(key); return secrets_store(key, sid, sizeof(DOM_SID)); } @@ -111,7 +111,7 @@ BOOL secrets_fetch_domain_sid(const char *domain, DOM_SID *sid) size_t size; slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_SID, domain); - strupper(key); + strupper_m(key); dyn_sid = (DOM_SID *)secrets_fetch(key, &size); if (dyn_sid == NULL) @@ -133,7 +133,7 @@ BOOL secrets_store_domain_guid(const char *domain, GUID *guid) fstring key; slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_GUID, domain); - strupper(key); + strupper_m(key); return secrets_store(key, guid, sizeof(GUID)); } @@ -145,13 +145,13 @@ BOOL secrets_fetch_domain_guid(const char *domain, GUID *guid) GUID new_guid; slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_DOMAIN_GUID, domain); - strupper(key); + strupper_m(key); dyn_guid = (GUID *)secrets_fetch(key, &size); DEBUG(6,("key is %s, size is %d\n", key, (int)size)); if ((NULL == dyn_guid) && (ROLE_DOMAIN_PDC == lp_server_role())) { - uuid_generate_random(&new_guid); + smb_uuid_generate_random(&new_guid); if (!secrets_store_domain_guid(domain, &new_guid)) return False; dyn_guid = (GUID *)secrets_fetch(key, &size); @@ -183,7 +183,7 @@ const char *trust_keystr(const char *domain) slprintf(keystr,sizeof(keystr)-1,"%s/%s", SECRETS_MACHINE_ACCT_PASS, domain); - strupper(keystr); + strupper_m(keystr); return keystr; } @@ -200,7 +200,7 @@ char *trustdom_keystr(const char *domain) static char* keystr; asprintf(&keystr, "%s/%s", SECRETS_DOMTRUST_ACCT_PASS, domain); - strupper(keystr); + strupper_m(keystr); return keystr; } @@ -252,8 +252,7 @@ BOOL secrets_fetch_trust_account_password(const char *domain, uint8 ret_pwd[16], plaintext = secrets_fetch_machine_password(domain, pass_last_set_time, channel); if (plaintext) { - /* we have an ADS password - use that */ - DEBUG(4,("Using ADS machine password\n")); + DEBUG(4,("Using cleartext machine password\n")); E_md4hash(plaintext, ret_pwd); SAFE_FREE(plaintext); return True; @@ -400,7 +399,7 @@ BOOL secrets_store_machine_password(const char *pass, const char *domain, uint32 asprintf(&key, "%s/%s", SECRETS_MACHINE_PASSWORD, domain); if (!key) return False; - strupper(key); + strupper_m(key); ret = secrets_store(key, pass, strlen(pass)+1); SAFE_FREE(key); @@ -411,7 +410,7 @@ BOOL secrets_store_machine_password(const char *pass, const char *domain, uint32 asprintf(&key, "%s/%s", SECRETS_MACHINE_LAST_CHANGE_TIME, domain); if (!key) return False; - strupper(key); + strupper_m(key); SIVAL(&last_change_time, 0, time(NULL)); ret = secrets_store(key, &last_change_time, sizeof(last_change_time)); @@ -420,7 +419,7 @@ BOOL secrets_store_machine_password(const char *pass, const char *domain, uint32 asprintf(&key, "%s/%s", SECRETS_MACHINE_SEC_CHANNEL_TYPE, domain); if (!key) return False; - strupper(key); + strupper_m(key); SIVAL(&sec_channel_type, 0, sec_channel); ret = secrets_store(key, &sec_channel_type, sizeof(sec_channel_type)); @@ -441,7 +440,7 @@ char *secrets_fetch_machine_password(const char *domain, char *key = NULL; char *ret; asprintf(&key, "%s/%s", SECRETS_MACHINE_PASSWORD, domain); - strupper(key); + strupper_m(key); ret = (char *)secrets_fetch(key, NULL); SAFE_FREE(key); @@ -449,10 +448,11 @@ char *secrets_fetch_machine_password(const char *domain, size_t size; uint32 *last_set_time; asprintf(&key, "%s/%s", SECRETS_MACHINE_LAST_CHANGE_TIME, domain); - strupper(key); + strupper_m(key); last_set_time = secrets_fetch(key, &size); if (last_set_time) { *pass_last_set_time = IVAL(last_set_time,0); + SAFE_FREE(last_set_time); } else { *pass_last_set_time = 0; } @@ -463,10 +463,11 @@ char *secrets_fetch_machine_password(const char *domain, size_t size; uint32 *channel_type; asprintf(&key, "%s/%s", SECRETS_MACHINE_SEC_CHANNEL_TYPE, domain); - strupper(key); + strupper_m(key); channel_type = secrets_fetch(key, &size); if (channel_type) { *channel = IVAL(channel_type,0); + SAFE_FREE(channel_type); } else { *channel = get_default_sec_channel(); } @@ -614,7 +615,7 @@ NTSTATUS secrets_get_trusted_domains(TALLOC_CTX* ctx, int* enum_ctx, unsigned in DEBUG(0, ("strndup failed!\n")); return NT_STATUS_NO_MEMORY; } - + packed_pass = secrets_fetch(secrets_key, &size); packed_size = tdb_trusted_dom_pass_unpack(packed_pass, size, pass); /* packed representation isn't needed anymore */ diff --git a/source3/printing/lpq_parse.c b/source3/printing/lpq_parse.c index c845170749..0acca67b70 100644 --- a/source3/printing/lpq_parse.c +++ b/source3/printing/lpq_parse.c @@ -145,8 +145,8 @@ static BOOL parse_lpq_bsd(char *line,print_queue_struct *buf,BOOL first) buf->size = atoi(tok[TOTALTOK]); buf->status = strequal(tok[RANKTOK],"active")?LPQ_PRINTING:LPQ_QUEUED; buf->time = time(NULL); - StrnCpy(buf->fs_user,tok[USERTOK],sizeof(buf->fs_user)-1); - StrnCpy(buf->fs_file,tok[FILETOK],sizeof(buf->fs_file)-1); + fstrcpy(buf->fs_user,tok[USERTOK]); + fstrcpy(buf->fs_file,tok[FILETOK]); if ((FILETOK + 1) != TOTALTOK) { int i; @@ -266,7 +266,7 @@ static BOOL parse_lpq_lprng(char *line,print_queue_struct *buf,BOOL first) buf->time = LPRng_time(tokarr[LPRNG_TIMETOK]); - StrnCpy(buf->fs_user,tokarr[LPRNG_USERTOK],sizeof(buf->fs_user)-1); + fstrcpy(buf->fs_user,tokarr[LPRNG_USERTOK]); /* The '@hostname' prevents windows from displaying the printing icon * for the current user on the taskbar. Plop in a null. @@ -276,7 +276,7 @@ static BOOL parse_lpq_lprng(char *line,print_queue_struct *buf,BOOL first) *ptr = '\0'; } - StrnCpy(buf->fs_file,tokarr[LPRNG_FILETOK],sizeof(buf->fs_file)-1); + fstrcpy(buf->fs_file,tokarr[LPRNG_FILETOK]); if ((LPRNG_FILETOK + 1) != LPRNG_TOTALTOK) { int i; @@ -353,8 +353,8 @@ static BOOL parse_lpq_aix(char *line,print_queue_struct *buf,BOOL first) buf->status = strequal(tok[0],"HELD")?LPQ_PAUSED:LPQ_QUEUED; buf->priority = 0; buf->time = time(NULL); - StrnCpy(buf->fs_user,tok[3],sizeof(buf->fs_user)-1); - StrnCpy(buf->fs_file,tok[2],sizeof(buf->fs_file)-1); + fstrcpy(buf->fs_user,tok[3]); + fstrcpy(buf->fs_file,tok[2]); } else { @@ -387,8 +387,8 @@ static BOOL parse_lpq_aix(char *line,print_queue_struct *buf,BOOL first) buf->status = strequal(tok[2],"RUNNING")?LPQ_PRINTING:LPQ_QUEUED; buf->priority = 0; buf->time = time(NULL); - StrnCpy(buf->fs_user,tok[5],sizeof(buf->fs_user)-1); - StrnCpy(buf->fs_file,tok[4],sizeof(buf->fs_file)-1); + fstrcpy(buf->fs_user,tok[5]); + fstrcpy(buf->fs_file,tok[4]); } @@ -449,14 +449,14 @@ static BOOL parse_lpq_hpux(char *line, print_queue_struct *buf, BOOL first) fstrcpy(tok[0],"STDIN"); buf->size = atoi(tok[1]); - StrnCpy(buf->fs_file,tok[0],sizeof(buf->fs_file)-1); + fstrcpy(buf->fs_file,tok[0]); /* fill things from header line */ buf->time = jobtime; buf->job = jobid; buf->status = jobstat; buf->priority = jobprio; - StrnCpy(buf->fs_user,jobuser,sizeof(buf->fs_user)-1); + fstrcpy(buf->fs_user,jobuser); return(True); } @@ -482,7 +482,7 @@ static BOOL parse_lpq_hpux(char *line, print_queue_struct *buf, BOOL first) /* the 2nd, 5th & 7th column must be integer */ if (!isdigit((int)*tok[1]) || !isdigit((int)*tok[4]) || !isdigit((int)*tok[6])) return(False); jobid = atoi(tok[1]); - StrnCpy(jobuser,tok[2],sizeof(buf->fs_user)-1); + fstrcpy(jobuser,tok[2]); jobprio = atoi(tok[4]); /* process time */ @@ -573,8 +573,8 @@ static BOOL parse_lpq_sysv(char *line,print_queue_struct *buf,BOOL first) buf->status = LPQ_QUEUED; buf->priority = 0; buf->time = EntryTime(tok, 4, count, 7); - StrnCpy(buf->fs_user,tok[2],sizeof(buf->fs_user)-1); - StrnCpy(buf->fs_file,tok[2],sizeof(buf->fs_file)-1); + fstrcpy(buf->fs_user,tok[2]); + fstrcpy(buf->fs_file,tok[2]); return(True); } @@ -633,8 +633,8 @@ static BOOL parse_lpq_qnx(char *line,print_queue_struct *buf,BOOL first) buf->status = strequal(tok[3],"active")?LPQ_PRINTING:LPQ_QUEUED; buf->priority = 0; buf->time = time(NULL); - StrnCpy(buf->fs_user,tok[1],sizeof(buf->fs_user)-1); - StrnCpy(buf->fs_file,tok[6],sizeof(buf->fs_file)-1); + fstrcpy(buf->fs_user,tok[1]); + fstrcpy(buf->fs_file,tok[6]); return(True); } @@ -704,8 +704,8 @@ static BOOL parse_lpq_plp(char *line,print_queue_struct *buf,BOOL first) buf->status = strequal(tok[0],"active")?LPQ_PRINTING:LPQ_QUEUED; buf->priority = 0; buf->time = time(NULL); - StrnCpy(buf->fs_user,tok[1],sizeof(buf->fs_user)-1); - StrnCpy(buf->fs_file,tok[6],sizeof(buf->fs_file)-1); + fstrcpy(buf->fs_user,tok[1]); + fstrcpy(buf->fs_file,tok[6]); return(True); } @@ -779,8 +779,8 @@ static BOOL parse_lpq_nt(char *line,print_queue_struct *buf,BOOL first) buf->priority = 0; buf->size = atoi(parse_line.size); buf->time = time(NULL); - StrnCpy(buf->fs_user, parse_line.owner, sizeof(buf->fs_user)-1); - StrnCpy(buf->fs_file, parse_line.jobname, sizeof(buf->fs_file)-1); + fstrcpy(buf->fs_user, parse_line.owner); + fstrcpy(buf->fs_file, parse_line.jobname); if (strequal(parse_line.status, LPRNT_PRINTING)) buf->status = LPQ_PRINTING; else if (strequal(parse_line.status, LPRNT_PAUSED)) @@ -838,7 +838,7 @@ static BOOL parse_lpq_os2(char *line,print_queue_struct *buf,BOOL first) /* Get the job name */ parse_line.space2[0] = '\0'; trim_string(parse_line.jobname, NULL, " "); - StrnCpy(buf->fs_file, parse_line.jobname, sizeof(buf->fs_file)-1); + fstrcpy(buf->fs_file, parse_line.jobname); buf->priority = 0; buf->size = atoi(parse_line.size); @@ -856,7 +856,7 @@ static BOOL parse_lpq_os2(char *line,print_queue_struct *buf,BOOL first) !strequal(parse_line.status, LPROS2_WAITING)) return(False); - StrnCpy(buf->fs_user, parse_line.owner, sizeof(buf->fs_user)-1); + fstrcpy(buf->fs_user, parse_line.owner); if (strequal(parse_line.status, LPROS2_PRINTING)) buf->status = LPQ_PRINTING; else if (strequal(parse_line.status, LPROS2_PAUSED)) @@ -984,29 +984,29 @@ BOOL parse_lpq_entry(int snum,char *line, printer status line: handle them so that most severe condition is shown */ int i; - strlower(line); + strlower_m(line); switch (status->status) { case LPSTAT_OK: for (i=0; stat0_strings[i]; i++) if (strstr(line,stat0_strings[i])) { - StrnCpy(status->message,line,sizeof(status->message)-1); - status->status=LPSTAT_OK; - return ret; + fstrcpy(status->message,line); + status->status=LPSTAT_OK; + return ret; } case LPSTAT_STOPPED: for (i=0; stat1_strings[i]; i++) if (strstr(line,stat1_strings[i])) { - StrnCpy(status->message,line,sizeof(status->message)-1); - status->status=LPSTAT_STOPPED; - return ret; + fstrcpy(status->message,line); + status->status=LPSTAT_STOPPED; + return ret; } case LPSTAT_ERROR: for (i=0; stat2_strings[i]; i++) if (strstr(line,stat2_strings[i])) { - StrnCpy(status->message,line,sizeof(status->message)-1); - status->status=LPSTAT_ERROR; - return ret; + fstrcpy(status->message,line); + status->status=LPSTAT_ERROR; + return ret; } break; } diff --git a/source3/printing/notify.c b/source3/printing/notify.c index ee973da211..479d883134 100644 --- a/source3/printing/notify.c +++ b/source3/printing/notify.c @@ -480,7 +480,7 @@ void notify_printer_location(int snum, char *location) snum, strlen(location) + 1, location); } -void notify_printer_byname( char *printername, uint32 change, char *value ) +void notify_printer_byname( const char *printername, uint32 change, char *value ) { int snum = print_queue_snum(printername); int type = PRINTER_NOTIFY_TYPE; diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c index 2b4b7dab6b..5e6e95ff7e 100644 --- a/source3/printing/nt_printing.c +++ b/source3/printing/nt_printing.c @@ -198,6 +198,22 @@ static const nt_forms_struct default_forms[] = { {"PRC Envelope #10 Rotated",0x1,0x6fd10,0x4f1a0,0x0,0x0,0x6fd10,0x4f1a0} }; +struct table_node { + const char *long_archi; + const char *short_archi; + int version; +}; + +static const struct table_node archi_table[]= { + + {"Windows 4.0", "WIN40", 0 }, + {"Windows NT x86", "W32X86", 2 }, + {"Windows NT R4000", "W32MIPS", 2 }, + {"Windows NT Alpha_AXP", "W32ALPHA", 2 }, + {"Windows NT PowerPC", "W32PPC", 2 }, + {NULL, "", -1 } +}; + static BOOL upgrade_to_version_3(void) { TDB_DATA kbuf, newkey, dbuf; @@ -638,12 +654,12 @@ void update_a_form(nt_forms_struct **list, const FORM *form, int count) int get_ntdrivers(fstring **list, const char *architecture, uint32 version) { int total=0; - fstring short_archi; + const char *short_archi; fstring *fl; pstring key; TDB_DATA kbuf, newkey; - get_short_archi(short_archi, architecture); + short_archi = get_short_archi(architecture); slprintf(key, sizeof(key)-1, "%s%s/%d/", DRIVERS_PREFIX, short_archi, version); for (kbuf = tdb_firstkey(tdb_drivers); @@ -667,52 +683,32 @@ int get_ntdrivers(fstring **list, const char *architecture, uint32 version) } /**************************************************************************** - Function to do the mapping between the long architecture name and - the short one. +function to do the mapping between the long architecture name and +the short one. ****************************************************************************/ -BOOL get_short_archi(char *short_archi, const char *long_archi) +const char *get_short_archi(const char *long_archi) { - struct table { - const char *long_archi; - const char *short_archi; - }; - - struct table archi_table[]= - { - {"Windows 4.0", "WIN40" }, - {"Windows NT x86", "W32X86" }, - {"Windows NT R4000", "W32MIPS" }, - {"Windows NT Alpha_AXP", "W32ALPHA" }, - {"Windows NT PowerPC", "W32PPC" }, - {NULL, "" } - }; - - int i=-1; + int i=-1; - DEBUG(107,("Getting architecture dependant directory\n")); + DEBUG(107,("Getting architecture dependant directory\n")); + do { + i++; + } while ( (archi_table[i].long_archi!=NULL ) && + StrCaseCmp(long_archi, archi_table[i].long_archi) ); - if (long_archi == NULL) { - DEBUGADD(107,("Bad long_archi param.!\n")); - return False; - } + if (archi_table[i].long_archi==NULL) { + DEBUGADD(10,("Unknown architecture [%s] !\n", long_archi)); + return NULL; + } - do { - i++; - } while ( (archi_table[i].long_archi!=NULL ) && - StrCaseCmp(long_archi, archi_table[i].long_archi) ); + /* this might be client code - but shouldn't this be an fstrcpy etc? */ - if (archi_table[i].long_archi==NULL) { - DEBUGADD(107,("Unknown architecture [%s] !\n", long_archi)); - return False; - } - StrnCpy (short_archi, archi_table[i].short_archi, strlen(archi_table[i].short_archi)); + DEBUGADD(108,("index: [%d]\n", i)); + DEBUGADD(108,("long architecture: [%s]\n", archi_table[i].long_archi)); + DEBUGADD(108,("short architecture: [%s]\n", archi_table[i].short_archi)); - DEBUGADD(108,("index: [%d]\n", i)); - DEBUGADD(108,("long architecture: [%s]\n", long_archi)); - DEBUGADD(108,("short architecture: [%s]\n", short_archi)); - - return True; + return archi_table[i].short_archi; } /**************************************************************************** @@ -750,7 +746,7 @@ static int get_file_version(files_struct *fsp, char *fname,uint32 *major, uint32 } /* Skip OEM header (if any) and the DOS stub to start of Windows header */ - if (fsp->conn->vfs_ops.lseek(fsp, fsp->fd, SVAL(buf,DOS_HEADER_LFANEW_OFFSET), SEEK_SET) == (SMB_OFF_T)-1) { + if (SMB_VFS_LSEEK(fsp, fsp->fd, SVAL(buf,DOS_HEADER_LFANEW_OFFSET), SEEK_SET) == (SMB_OFF_T)-1) { DEBUG(3,("get_file_version: File [%s] too short, errno = %d\n", fname, errno)); /* Assume this isn't an error... the file just looks sort of like a PE/NE file */ @@ -810,7 +806,7 @@ static int get_file_version(files_struct *fsp, char *fname,uint32 *major, uint32 } /* Seek to the start of the .rsrc section info */ - if (fsp->conn->vfs_ops.lseek(fsp, fsp->fd, section_pos, SEEK_SET) == (SMB_OFF_T)-1) { + if (SMB_VFS_LSEEK(fsp, fsp->fd, section_pos, SEEK_SET) == (SMB_OFF_T)-1) { DEBUG(3,("get_file_version: PE file [%s] too short for section info, errno = %d\n", fname, errno)); goto error_exit; @@ -903,7 +899,7 @@ static int get_file_version(files_struct *fsp, char *fname,uint32 *major, uint32 * twice, as it is simpler to read the code. */ if (strcmp(&buf[i], VS_SIGNATURE) == 0) { /* Compute skip alignment to next long address */ - int skip = -(fsp->conn->vfs_ops.lseek(fsp, fsp->fd, 0, SEEK_CUR) - (byte_count - i) + + int skip = -(SMB_VFS_LSEEK(fsp, fsp->fd, 0, SEEK_CUR) - (byte_count - i) + sizeof(VS_SIGNATURE)) & 3; if (IVAL(buf,i+sizeof(VS_SIGNATURE)+skip) != 0xfeef04bd) continue; @@ -996,7 +992,7 @@ static int file_version_is_newer(connection_struct *conn, fstring new_file, fstr DEBUG(6,("file_version_is_newer: Version info not found [%s], use mod time\n", old_file)); use_version = False; - if (fsp->conn->vfs_ops.fstat(fsp, fsp->fd, &st) == -1) goto error_exit; + if (SMB_VFS_FSTAT(fsp, fsp->fd, &st) == -1) goto error_exit; old_create_time = st.st_mtime; DEBUGADD(6,("file_version_is_newer: mod time = %ld sec\n", old_create_time)); } @@ -1025,7 +1021,7 @@ static int file_version_is_newer(connection_struct *conn, fstring new_file, fstr DEBUG(6,("file_version_is_newer: Version info not found [%s], use mod time\n", new_file)); use_version = False; - if (fsp->conn->vfs_ops.fstat(fsp, fsp->fd, &st) == -1) goto error_exit; + if (SMB_VFS_FSTAT(fsp, fsp->fd, &st) == -1) goto error_exit; new_create_time = st.st_mtime; DEBUGADD(6,("file_version_is_newer: mod time = %ld sec\n", new_create_time)); } @@ -1066,7 +1062,7 @@ static int file_version_is_newer(connection_struct *conn, fstring new_file, fstr /**************************************************************************** Determine the correct cVersion associated with an architecture and driver ****************************************************************************/ -static uint32 get_correct_cversion(fstring architecture, fstring driverpath_in, +static uint32 get_correct_cversion(const char *architecture, fstring driverpath_in, struct current_user *user, WERROR *perr) { int cversion; @@ -1111,7 +1107,7 @@ static uint32 get_correct_cversion(fstring architecture, fstring driverpath_in, } /* We are temporarily becoming the connection user. */ - if (!become_user(conn, conn->vuid)) { + if (!become_user(conn, user->vuid)) { DEBUG(0,("get_correct_cversion: Can't become user!\n")); *perr = WERR_ACCESS_DENIED; return -1; @@ -1192,7 +1188,7 @@ static uint32 get_correct_cversion(fstring architecture, fstring driverpath_in, static WERROR clean_up_driver_struct_level_3(NT_PRINTER_DRIVER_INFO_LEVEL_3 *driver, struct current_user *user) { - fstring architecture; + const char *architecture; fstring new_name; char *p; int i; @@ -1232,7 +1228,7 @@ static WERROR clean_up_driver_struct_level_3(NT_PRINTER_DRIVER_INFO_LEVEL_3 *dri } } - get_short_archi(architecture, driver->environment); + architecture = get_short_archi(driver->environment); /* jfm:7/16/2000 the client always sends the cversion=0. * The server should check which version the driver is by reading @@ -1256,7 +1252,7 @@ static WERROR clean_up_driver_struct_level_3(NT_PRINTER_DRIVER_INFO_LEVEL_3 *dri ****************************************************************************/ static WERROR clean_up_driver_struct_level_6(NT_PRINTER_DRIVER_INFO_LEVEL_6 *driver, struct current_user *user) { - fstring architecture; + const char *architecture; fstring new_name; char *p; int i; @@ -1296,7 +1292,7 @@ static WERROR clean_up_driver_struct_level_6(NT_PRINTER_DRIVER_INFO_LEVEL_6 *dri } } - get_short_archi(architecture, driver->environment); + architecture = get_short_archi(driver->environment); /* jfm:7/16/2000 the client always sends the cversion=0. * The server should check which version the driver is by reading @@ -1382,7 +1378,7 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract, { NT_PRINTER_DRIVER_INFO_LEVEL_3 *driver; NT_PRINTER_DRIVER_INFO_LEVEL_3 converted_driver; - fstring architecture; + const char *architecture; pstring new_dir; pstring old_name; pstring new_name; @@ -1409,7 +1405,7 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract, return False; } - get_short_archi(architecture, driver->environment); + architecture = get_short_archi(driver->environment); /* * Connect to the print$ share under the same account as the user connected to the rpc pipe. @@ -1589,7 +1585,7 @@ BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract, static uint32 add_a_printer_driver_3(NT_PRINTER_DRIVER_INFO_LEVEL_3 *driver) { int len, buflen; - fstring architecture; + const char *architecture; pstring directory; fstring temp_name; pstring key; @@ -1597,7 +1593,7 @@ static uint32 add_a_printer_driver_3(NT_PRINTER_DRIVER_INFO_LEVEL_3 *driver) int i, ret; TDB_DATA kbuf, dbuf; - get_short_archi(architecture, driver->environment); + architecture = get_short_archi(driver->environment); /* The names are relative. We store them in the form: \print$\arch\version\driver.xxx * \\server is added in the rpc server layer. @@ -1751,14 +1747,14 @@ static WERROR get_a_printer_driver_3(NT_PRINTER_DRIVER_INFO_LEVEL_3 **info_ptr, { NT_PRINTER_DRIVER_INFO_LEVEL_3 driver; TDB_DATA kbuf, dbuf; - fstring architecture; + const char *architecture; int len = 0; int i; pstring key; ZERO_STRUCT(driver); - get_short_archi(architecture, arch); + architecture = get_short_archi(arch); DEBUG(8,("get_a_printer_driver_3: [%s%s/%d/%s]\n", DRIVERS_PREFIX, architecture, version, drivername)); @@ -2447,6 +2443,7 @@ uint32 get_printer_subkeys( NT_PRINTER_DATA *data, const char* key, fstring **su return num_subkeys; } +#ifdef HAVE_ADS static void map_sz_into_ctr(REGVAL_CTR *ctr, const char *val_name, const char *sz) { @@ -2559,7 +2556,6 @@ static BOOL map_nt_printer_info2_to_dsspooler(NT_PRINTER_INFO_LEVEL_2 *info2) return True; } -#ifdef HAVE_ADS static void store_printer_guid(NT_PRINTER_INFO_LEVEL_2 *info2, GUID guid) { int i; @@ -2605,12 +2601,19 @@ static WERROR publish_it(NT_PRINTER_INFO_LEVEL *printer) ads_mod_str(ctx, &mods, SPOOL_REG_PRINTERNAME, printer->info_2->sharename); - /* connect to the ADS server */ - ads = ads_init(NULL, NULL, lp_ads_server()); + /* initial ads structure */ + + ads = ads_init(NULL, NULL, NULL); if (!ads) { DEBUG(3, ("ads_init() failed\n")); return WERR_SERVER_UNAVAILABLE; } + setenv(KRB5_ENV_CCNAME, "MEMORY:prtpub_cache", 1); + SAFE_FREE(ads->auth.password); + ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), + NULL, NULL); + + /* ads_connect() will find the DC for us */ ads_rc = ads_connect(ads); if (!ADS_ERR_OK(ads_rc)) { DEBUG(3, ("ads_connect failed: %s\n", ads_errstr(ads_rc))); @@ -2663,11 +2666,17 @@ WERROR unpublish_it(NT_PRINTER_INFO_LEVEL *printer) return win_rc; } - ads = ads_init(NULL, NULL, lp_ads_server()); + ads = ads_init(NULL, NULL, NULL); if (!ads) { DEBUG(3, ("ads_init() failed\n")); return WERR_SERVER_UNAVAILABLE; } + setenv(KRB5_ENV_CCNAME, "MEMORY:prtpub_cache", 1); + SAFE_FREE(ads->auth.password); + ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), + NULL, NULL); + + /* ads_connect() will find the DC for us */ ads_rc = ads_connect(ads); if (!ADS_ERR_OK(ads_rc)) { DEBUG(3, ("ads_connect failed: %s\n", ads_errstr(ads_rc))); @@ -3813,7 +3822,7 @@ static NTSTATUS copy_printer_data( NT_PRINTER_DATA *dst, NT_PRINTER_DATA *src ) Caller must free. ****************************************************************************/ -static NT_PRINTER_INFO_LEVEL_2* dup_printer_2( TALLOC_CTX *ctx, NT_PRINTER_INFO_LEVEL_2 *printer ) +NT_PRINTER_INFO_LEVEL_2* dup_printer_2( TALLOC_CTX *ctx, NT_PRINTER_INFO_LEVEL_2 *printer ) { NT_PRINTER_INFO_LEVEL_2 *copy; @@ -3845,8 +3854,6 @@ static NT_PRINTER_INFO_LEVEL_2* dup_printer_2( TALLOC_CTX *ctx, NT_PRINTER_INFO_ Get a NT_PRINTER_INFO_LEVEL struct. It returns malloced memory. ****************************************************************************/ -#define ENABLE_PRINT_HND_CACHE 1 - WERROR get_a_printer( Printer_entry *print_hnd, NT_PRINTER_INFO_LEVEL **pp_printer, uint32 level, const char *sharename) { @@ -3871,7 +3878,6 @@ WERROR get_a_printer( Printer_entry *print_hnd, NT_PRINTER_INFO_LEVEL **pp_print * is actually for a printer and that the printer_info pointer * is valid */ -#ifdef ENABLE_PRINT_HND_CACHE /* JERRY */ if ( print_hnd && (print_hnd->printer_type==PRINTER_HANDLE_IS_PRINTER) && print_hnd->printer_info ) @@ -3890,20 +3896,27 @@ WERROR get_a_printer( Printer_entry *print_hnd, NT_PRINTER_INFO_LEVEL **pp_print break; } -#endif - /* no cache; look it up on disk */ + /* no cache for this handle; see if we can match one from another handle */ - result=get_a_printer_2(&printer->info_2, sharename); - if (W_ERROR_IS_OK(result)) { - dump_a_printer(*printer, level); + if ( print_hnd ) + result = find_printer_in_print_hnd_cache(print_hnd->ctx, &printer->info_2, sharename); + + /* fail to disk if we don't have it with any open handle */ -#if ENABLE_PRINT_HND_CACHE /* JERRY */ + if ( !print_hnd || !W_ERROR_IS_OK(result) ) + result = get_a_printer_2(&printer->info_2, sharename); + + /* we have a new printer now. Save it with this handle */ + + if ( W_ERROR_IS_OK(result) ) { + dump_a_printer(*printer, level); + /* save a copy in cache */ if ( print_hnd && (print_hnd->printer_type==PRINTER_HANDLE_IS_PRINTER)) { if ( !print_hnd->printer_info ) print_hnd->printer_info = (NT_PRINTER_INFO_LEVEL *)malloc(sizeof(NT_PRINTER_INFO_LEVEL)); - + if ( print_hnd->printer_info ) { print_hnd->printer_info->info_2 = dup_printer_2(print_hnd->ctx, printer->info_2); @@ -3911,16 +3924,14 @@ WERROR get_a_printer( Printer_entry *print_hnd, NT_PRINTER_INFO_LEVEL **pp_print if ( !print_hnd->printer_info->info_2 ) DEBUG(0,("get_a_printer: unable to copy new printer info!\n")); } - } -#endif - *pp_printer = printer; + *pp_printer = printer; } - else + else SAFE_FREE(printer); - - + break; + default: result=WERR_UNKNOWN_LEVEL; break; @@ -4405,13 +4416,13 @@ WERROR delete_printer_driver( NT_PRINTER_DRIVER_INFO_LEVEL_3 *info_3, struct cur uint32 version, BOOL delete_files ) { pstring key; - fstring arch; + const char *arch; TDB_DATA kbuf, dbuf; NT_PRINTER_DRIVER_INFO_LEVEL ctr; /* delete the tdb data first */ - get_short_archi(arch, info_3->environment); + arch = get_short_archi(info_3->environment); slprintf(key, sizeof(key)-1, "%s%s/%d/%s", DRIVERS_PREFIX, arch, version, info_3->name); diff --git a/source3/printing/pcap.c b/source3/printing/pcap.c index c399c3c6cc..1bdbf4a789 100644 --- a/source3/printing/pcap.c +++ b/source3/printing/pcap.c @@ -384,7 +384,7 @@ void pcap_printer_fn(void (*fn)(char *, char *)) if (strlen(p)>strlen(comment) && has_punctuation) { - StrnCpy(comment,p,sizeof(comment)-1); + pstrcpy(comment,p); continue; } @@ -398,8 +398,8 @@ void pcap_printer_fn(void (*fn)(char *, char *)) if (!strchr_m(comment,' ') && strlen(p) > strlen(comment)) { - StrnCpy(comment,p,sizeof(comment)-1); - continue; + pstrcpy(comment,p); + continue; } } diff --git a/source3/printing/printfsp.c b/source3/printing/printfsp.c index 45d937f29c..0b6d4fdbe1 100644 --- a/source3/printing/printfsp.c +++ b/source3/printing/printfsp.c @@ -80,7 +80,7 @@ files_struct *print_fsp_open(connection_struct *conn, char *fname) string_set(&fsp->fsp_name,print_job_fname(SNUM(conn),jobid)); fsp->wbmpx_ptr = NULL; fsp->wcp = NULL; - conn->vfs_ops.fstat(fsp,fsp->fd, &sbuf); + SMB_VFS_FSTAT(fsp,fsp->fd, &sbuf); fsp->mode = sbuf.st_mode; fsp->inode = sbuf.st_ino; fsp->dev = sbuf.st_dev; diff --git a/source3/printing/printing.c b/source3/printing/printing.c index add690fb8b..1a7066f906 100644 --- a/source3/printing/printing.c +++ b/source3/printing/printing.c @@ -1180,7 +1180,7 @@ BOOL print_notify_register_pid(int snum) } /* Store back the record. */ - if (tdb_store_by_string(tdb, NOTIFY_PID_LIST_KEY, data, TDB_REPLACE) == -1) { + if (tdb_store_bystring(tdb, NOTIFY_PID_LIST_KEY, data, TDB_REPLACE) == -1) { DEBUG(0,("print_notify_register_pid: Failed to update pid \ list for printer %s\n", printername)); goto done; @@ -1270,7 +1270,7 @@ printer %s database\n", printername)); SAFE_FREE(data.dptr); /* Store back the record. */ - if (tdb_store_by_string(tdb, NOTIFY_PID_LIST_KEY, data, TDB_REPLACE) == -1) { + if (tdb_store_bystring(tdb, NOTIFY_PID_LIST_KEY, data, TDB_REPLACE) == -1) { DEBUG(0,("print_notify_register_pid: Failed to update pid \ list for printer %s\n", printername)); goto done; @@ -1465,7 +1465,7 @@ static BOOL print_job_delete1(int snum, uint32 jobid) else remove_from_jobs_changed(snum, jobid); - /* Delete the tdb entry if the delete suceeded or the job hasn't + /* Delete the tdb entry if the delete succeeded or the job hasn't been spooled. */ if (result == 0) { diff --git a/source3/printing/printing_db.c b/source3/printing/printing_db.c index 0aa8dfafa5..1c7ac71353 100644 --- a/source3/printing/printing_db.c +++ b/source3/printing/printing_db.c @@ -154,7 +154,7 @@ TDB_DATA get_printer_notify_pid_list(TDB_CONTEXT *tdb, const char *printer_name, ZERO_STRUCT(data); - data = tdb_fetch_by_string( tdb, NOTIFY_PID_LIST_KEY ); + data = tdb_fetch_bystring( tdb, NOTIFY_PID_LIST_KEY ); if (!data.dptr) { ZERO_STRUCT(data); @@ -163,7 +163,7 @@ TDB_DATA get_printer_notify_pid_list(TDB_CONTEXT *tdb, const char *printer_name, if (data.dsize % 8) { DEBUG(0,("get_printer_notify_pid_list: Size of record for printer %s not a multiple of 8 !\n", printer_name )); - tdb_delete_by_string(tdb, NOTIFY_PID_LIST_KEY ); + tdb_delete_bystring(tdb, NOTIFY_PID_LIST_KEY ); SAFE_FREE(data.dptr); ZERO_STRUCT(data); return data; diff --git a/source3/python/py_winbind.c b/source3/python/py_winbind.c index 0c40861c70..db66be2321 100644 --- a/source3/python/py_winbind.c +++ b/source3/python/py_winbind.c @@ -261,12 +261,12 @@ static PyObject *py_config_dict(void) /* Winbind uid/gid range */ - if (lp_idmap_uid(&ulow, &uhi)) { + if (lp_winbind_uid(&ulow, &uhi)) { PyDict_SetItemString(result, "uid_low", PyInt_FromLong(ulow)); PyDict_SetItemString(result, "uid_high", PyInt_FromLong(uhi)); } - if (lp_idmap_gid(&glow, &ghi)) { + if (lp_winbind_gid(&glow, &ghi)) { PyDict_SetItemString(result, "gid_low", PyInt_FromLong(glow)); PyDict_SetItemString(result, "gid_high", PyInt_FromLong(ghi)); } diff --git a/source3/registry/reg_db.c b/source3/registry/reg_db.c index b0917c8f60..cd5ec18f02 100644 --- a/source3/registry/reg_db.c +++ b/source3/registry/reg_db.c @@ -250,7 +250,7 @@ int regdb_fetch_reg_keys( char* key, REGSUBKEY_CTR *ctr ) pstring_sub( path, "\\", "/" ); strupper_m( path ); - dbuf = tdb_fetch_by_string( tdb_reg, path ); + dbuf = tdb_fetch_bystring( tdb_reg, path ); buf = dbuf.dptr; buflen = dbuf.dsize; diff --git a/source3/rpc_client/cli_lsarpc.c b/source3/rpc_client/cli_lsarpc.c index 9002ad3d1b..db873236e4 100644 --- a/source3/rpc_client/cli_lsarpc.c +++ b/source3/rpc_client/cli_lsarpc.c @@ -1164,7 +1164,7 @@ NTSTATUS cli_lsa_enum_account_rights(struct cli_state *cli, TALLOC_CTX *mem_ctx, LSA_Q_ENUM_ACCT_RIGHTS q; LSA_R_ENUM_ACCT_RIGHTS r; NTSTATUS result; - unsigned int i; + int i; ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -1199,7 +1199,7 @@ NTSTATUS cli_lsa_enum_account_rights(struct cli_state *cli, TALLOC_CTX *mem_ctx, *privs_name = (char **)talloc(mem_ctx, (*count) * sizeof(char **)); for (i=0;i<*count;i++) { - (*privs_name)[i] = unistr2_tdup(mem_ctx, &r.rights.strings[i].string); + pull_ucs2_talloc(mem_ctx, &(*privs_name)[i], r.rights.strings[i].string.buffer); } done: @@ -1293,58 +1293,6 @@ done: } -/* list account SIDs that have the specified right */ - -NTSTATUS cli_lsa_enum_account_with_right(struct cli_state *cli, TALLOC_CTX *mem_ctx, - POLICY_HND *pol, const char *right, - uint32 *count, DOM_SID **sids) -{ - prs_struct qbuf, rbuf; - LSA_Q_ENUM_ACCT_WITH_RIGHT q; - LSA_R_ENUM_ACCT_WITH_RIGHT r; - NTSTATUS result; - - ZERO_STRUCT(q); - - /* Initialise parse structures */ - prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL); - prs_init(&rbuf, 0, mem_ctx, UNMARSHALL); - - /* Marshall data and send request */ - init_q_enum_acct_with_right(&q, pol, right); - - if (!lsa_io_q_enum_acct_with_right("", &q, &qbuf, 0) || - !rpc_api_pipe_req(cli, LSA_ENUMACCTWITHRIGHT, &qbuf, &rbuf)) { - result = NT_STATUS_UNSUCCESSFUL; - goto done; - } - - /* Unmarshall response */ - - if (!lsa_io_r_enum_acct_with_right("", &r, &rbuf, 0)) { - result = NT_STATUS_UNSUCCESSFUL; - goto done; - } - - *count = r.count; - - if (!NT_STATUS_IS_OK(result = r.status)) { - goto done; - } - - if (*count) { - int i; - (*sids) = (DOM_SID *)talloc(mem_ctx, sizeof(DOM_SID) * (*count)); - for (i=0; i<*count; i++) { - sid_copy(&(*sids)[i], &r.sids.sids[i].sid.sid); - } - } -done: - - return result; -} - - #if 0 /** An example of how to use the routines in this file. Fetch a DOMAIN diff --git a/source3/rpc_client/cli_netlogon.c b/source3/rpc_client/cli_netlogon.c index ce0dd95e94..831101ed81 100644 --- a/source3/rpc_client/cli_netlogon.c +++ b/source3/rpc_client/cli_netlogon.c @@ -280,7 +280,7 @@ NTSTATUS cli_nt_setup_creds(struct cli_state *cli, } if (!NT_STATUS_IS_OK(result)) - DEBUG(1,("cli_nt_setup_creds: auth%d challenge failed %s\n", level, nt_errstr(result))); + DEBUG(3,("cli_nt_setup_creds: auth%d challenge failed %s\n", level, nt_errstr(result))); return result; } @@ -472,6 +472,7 @@ NTSTATUS cli_netlogon_sam_deltas(struct cli_state *cli, TALLOC_CTX *mem_ctx, /* Logon domain user */ NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx, + DOM_CRED *ret_creds, const char *username, const char *password, int logon_type) { @@ -486,6 +487,7 @@ NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx, ZERO_STRUCT(q); ZERO_STRUCT(r); + ZERO_STRUCT(dummy_rtn_creds); /* Initialise parse structures */ @@ -498,8 +500,8 @@ NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx, q.validation_level = validation_level; - memset(&dummy_rtn_creds, '\0', sizeof(dummy_rtn_creds)); - dummy_rtn_creds.timestamp.time = time(NULL); + if (ret_creds == NULL) + ret_creds = &dummy_rtn_creds; ctr.switch_value = logon_type; @@ -542,7 +544,7 @@ NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx, } init_sam_info(&q.sam_id, cli->srv_name_slash, global_myname(), - &clnt_creds, &dummy_rtn_creds, logon_type, + &clnt_creds, ret_creds, logon_type, &ctr); /* Marshall data and send request */ @@ -563,6 +565,7 @@ NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx, /* Return results */ result = r.status; + memcpy(ret_creds, &r.srv_creds, sizeof(*ret_creds)); done: prs_mem_free(&qbuf); @@ -579,6 +582,7 @@ NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx, **/ NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx, + DOM_CRED *ret_creds, const char *username, const char *domain, const char *workstation, const uint8 chal[8], DATA_BLOB lm_response, DATA_BLOB nt_response, @@ -598,6 +602,7 @@ NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_c ZERO_STRUCT(q); ZERO_STRUCT(r); + ZERO_STRUCT(dummy_rtn_creds); workstation_name_slash = talloc_asprintf(mem_ctx, "\\\\%s", workstation); @@ -617,8 +622,8 @@ NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_c q.validation_level = validation_level; - memset(&dummy_rtn_creds, '\0', sizeof(dummy_rtn_creds)); - dummy_rtn_creds.timestamp.time = time(NULL); + if (ret_creds == NULL) + ret_creds = &dummy_rtn_creds; ctr.switch_value = NET_LOGON_TYPE; @@ -629,7 +634,7 @@ NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_c lm_response.data, lm_response.length, nt_response.data, nt_response.length); init_sam_info(&q.sam_id, cli->srv_name_slash, global_myname(), - &clnt_creds, &dummy_rtn_creds, NET_LOGON_TYPE, + &clnt_creds, ret_creds, NET_LOGON_TYPE, &ctr); /* Marshall data and send request */ @@ -659,6 +664,7 @@ NTSTATUS cli_netlogon_sam_network_logon(struct cli_state *cli, TALLOC_CTX *mem_c /* Return results */ result = r.status; + memcpy(ret_creds, &r.srv_creds, sizeof(*ret_creds)); done: prs_mem_free(&qbuf); diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c index a5cb6d425e..d6307ddb46 100644 --- a/source3/rpc_client/cli_pipe.c +++ b/source3/rpc_client/cli_pipe.c @@ -28,6 +28,23 @@ extern struct pipe_id_info pipe_names[]; +static void get_auth_type_level(int pipe_auth_flags, int *auth_type, int *auth_level) +{ + *auth_type = 0; + *auth_level = 0; + if (pipe_auth_flags & AUTH_PIPE_SEAL) { + *auth_level = RPC_PIPE_AUTH_SEAL_LEVEL; + } else if (pipe_auth_flags & AUTH_PIPE_SIGN) { + *auth_level = RPC_PIPE_AUTH_SIGN_LEVEL; + } + + if (pipe_auth_flags & AUTH_PIPE_NETSEC) { + *auth_type = NETSEC_AUTH_TYPE; + } else if (pipe_auth_flags & AUTH_PIPE_NTLMSSP) { + *auth_type = NTLMSSP_AUTH_TYPE; + } +} + /******************************************************************** Rpc pipe call id. ********************************************************************/ @@ -132,32 +149,6 @@ static BOOL rpc_check_hdr(prs_struct *rdata, RPC_HDR *rhdr, return (rhdr->pkt_type != RPC_FAULT); } -static void NTLMSSPcalc_ap( struct cli_state *cli, unsigned char *data, uint32 len) -{ - unsigned char *hash = cli->ntlmssp_hash; - unsigned char index_i = hash[256]; - unsigned char index_j = hash[257]; - int ind; - - for( ind = 0; ind < len; ind++) { - unsigned char tc; - unsigned char t; - - index_i++; - index_j += hash[index_i]; - - tc = hash[index_i]; - hash[index_i] = hash[index_j]; - hash[index_j] = tc; - - t = hash[index_i] + hash[index_j]; - data[ind] = data[ind] ^ hash[t]; - } - - hash[256] = index_i; - hash[257] = index_j; -} - /**************************************************************************** Verify data on an rpc pipe. The VERIFY & SEAL code is only executed on packets that look like this : @@ -174,8 +165,11 @@ static void NTLMSSPcalc_ap( struct cli_state *cli, unsigned char *data, uint32 l Never on bind requests/responses. ****************************************************************************/ -static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, int len, int auth_len) +static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, + uint32 fragment_start, int len, int auth_len, uint8 pkt_type, + int *pauth_padding_len) { + /* * The following is that length of the data we must sign or seal. * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN @@ -187,155 +181,173 @@ static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, int len, int /* * The start of the data to sign/seal is just after the RPC headers. */ - char *reply_data = prs_data_p(rdata) + RPC_HEADER_LEN + RPC_HDR_REQ_LEN; + char *reply_data = prs_data_p(rdata) + fragment_start + RPC_HEADER_LEN + RPC_HDR_REQ_LEN; - BOOL auth_verify = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SIGN) != 0); - BOOL auth_seal = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SEAL) != 0); - BOOL auth_schannel = (cli->saved_netlogon_pipe_fnum != 0); + RPC_HDR_AUTH rhdr_auth; - DEBUG(5,("rpc_auth_pipe: len: %d auth_len: %d verify %s seal %s schannel %s\n", - len, auth_len, BOOLSTR(auth_verify), BOOLSTR(auth_seal), BOOLSTR(auth_schannel))); + char *dp = prs_data_p(rdata) + fragment_start + len - + RPC_HDR_AUTH_LEN - auth_len; + prs_struct auth_verf; - /* - * Unseal any sealed data in the PDU, not including the - * 8 byte auth_header or the auth_data. - */ - - if (auth_seal) { - DEBUG(10,("rpc_auth_pipe: unseal\n")); - dump_data(100, reply_data, data_len); - NTLMSSPcalc_ap(cli, (uchar*)reply_data, data_len); - dump_data(100, reply_data, data_len); - } - - if (auth_verify || auth_seal) { - RPC_HDR_AUTH rhdr_auth; - prs_struct auth_req; - char data[RPC_HDR_AUTH_LEN]; - /* - * We set dp to be the end of the packet, minus the auth_len - * and the length of the header that preceeds the auth_data. - */ - char *dp = prs_data_p(rdata) + len - auth_len - RPC_HDR_AUTH_LEN; + *pauth_padding_len = 0; - if(dp - prs_data_p(rdata) > prs_data_size(rdata)) { - DEBUG(0,("rpc_auth_pipe: auth data > data size !\n")); - return False; + if (auth_len == 0) { + if (cli->pipe_auth_flags == 0) { + /* move along, nothing to see here */ + return True; } - memcpy(data, dp, sizeof(data)); - - prs_init(&auth_req , 0, cli->mem_ctx, UNMARSHALL); + DEBUG(2, ("No authenticaton header recienved on reply, but this pipe is authenticated\n")); + return False; + } - /* The endianness must be preserved... JRA. */ + DEBUG(5,("rpc_auth_pipe: pkt_type: %d len: %d auth_len: %d NTLMSSP %s schannel %s sign %s seal %s \n", + pkt_type, len, auth_len, + BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP), + BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_NETSEC), + BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_SIGN), + BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_SEAL))); - prs_set_endian_data(&auth_req, rdata->bigendian_data); + if (dp - prs_data_p(rdata) > prs_data_size(rdata)) { + DEBUG(0,("rpc_auth_pipe: schannel auth data > data size !\n")); + return False; + } - prs_give_memory(&auth_req, data, RPC_HDR_AUTH_LEN, False); + DEBUG(10,("rpc_auth_pipe: packet:\n")); + dump_data(100, dp, auth_len); - /* - * Unmarshall the 8 byte auth_header that comes before the - * auth data. - */ + prs_init(&auth_verf, 0, cli->mem_ctx, UNMARSHALL); + + /* The endinness must be preserved. JRA. */ + prs_set_endian_data( &auth_verf, rdata->bigendian_data); + + /* Point this new parse struct at the auth section of the main + parse struct - rather than copying it. Avoids needing to + free it on every error + */ + prs_give_memory(&auth_verf, dp, RPC_HDR_AUTH_LEN + auth_len, False /* not dynamic */); + prs_set_offset(&auth_verf, 0); - if(!smb_io_rpc_hdr_auth("hdr_auth", &rhdr_auth, &auth_req, 0)) { - DEBUG(0,("rpc_auth_pipe: unmarshalling RPC_HDR_AUTH failed.\n")); + { + int auth_type; + int auth_level; + if (!smb_io_rpc_hdr_auth("auth_hdr", &rhdr_auth, &auth_verf, 0)) { + DEBUG(0, ("rpc_auth_pipe: Could not parse auth header\n")); return False; } - if (!rpc_hdr_auth_chk(&rhdr_auth)) { - DEBUG(0,("rpc_auth_pipe: rpc_hdr_auth_chk failed.\n")); + /* Let the caller know how much padding at the end of the data */ + *pauth_padding_len = rhdr_auth.padding; + + /* Check it's the type of reply we were expecting to decode */ + + get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level); + if (rhdr_auth.auth_type != auth_type) { + DEBUG(0, ("BAD auth type %d (should be %d)\n", + rhdr_auth.auth_type, auth_type)); return False; } - } - - /* - * Now unseal and check the auth verifier in the auth_data at - * then end of the packet. The 4 bytes skipped in the unseal - * seem to be a buffer pointer preceeding the sealed data. - */ - - if (auth_verify) { - RPC_AUTH_NTLMSSP_CHK chk; - uint32 crc32; - prs_struct auth_verf; - char data[RPC_AUTH_NTLMSSP_CHK_LEN]; - char *dp = prs_data_p(rdata) + len - auth_len; - - if(dp - prs_data_p(rdata) > prs_data_size(rdata)) { - DEBUG(0,("rpc_auth_pipe: auth data > data size !\n")); + + if (rhdr_auth.auth_level != auth_level) { + DEBUG(0, ("BAD auth level %d (should be %d)\n", + rhdr_auth.auth_level, auth_level)); return False; } + } - DEBUG(10,("rpc_auth_pipe: verify\n")); - dump_data(100, dp, auth_len); - NTLMSSPcalc_ap(cli, (uchar*)(dp+4), auth_len - 4); + if (pkt_type == RPC_BINDACK) { + if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) { + /* copy the next auth_len bytes into a buffer for + later use */ - memcpy(data, dp, RPC_AUTH_NTLMSSP_CHK_LEN); - dump_data(100, data, auth_len); + DATA_BLOB ntlmssp_verf = data_blob(NULL, auth_len); + + /* save the reply away, for use a little later */ + prs_copy_data_out(ntlmssp_verf.data, &auth_verf, auth_len); - prs_init(&auth_verf, 0, cli->mem_ctx, UNMARSHALL); - /* The endinness must be preserved. JRA. */ - prs_set_endian_data( &auth_verf, rdata->bigendian_data); + return (NT_STATUS_IS_OK(ntlmssp_client_store_response(cli->ntlmssp_pipe_state, + ntlmssp_verf))); + } + else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) { + /* nothing to do here - we don't seem to be able to + validate the bindack based on VL's comments */ + return True; + } + } + + if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) { + NTSTATUS nt_status; + DATA_BLOB sig; + if ((cli->pipe_auth_flags & AUTH_PIPE_SIGN) || + (cli->pipe_auth_flags & AUTH_PIPE_SEAL)) { + if (auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) { + DEBUG(0,("rpc_auth_pipe: wrong ntlmssp auth len %d\n", auth_len)); + return False; + } + sig = data_blob(NULL, auth_len); + prs_copy_data_out(sig.data, &auth_verf, auth_len); + } + + /* + * Unseal any sealed data in the PDU, not including the + * 8 byte auth_header or the auth_data. + */ - prs_give_memory(&auth_verf, data, RPC_AUTH_NTLMSSP_CHK_LEN, False); + /* + * Now unseal and check the auth verifier in the auth_data at + * the end of the packet. + */ - if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &chk, &auth_verf, 0)) { - DEBUG(0,("rpc_auth_pipe: unmarshalling RPC_AUTH_NTLMSSP_CHK failed.\n")); - return False; + if (cli->pipe_auth_flags & AUTH_PIPE_SEAL) { + if (data_len < 0) { + DEBUG(1, ("Can't unseal - data_len < 0!!\n")); + return False; + } + nt_status = ntlmssp_client_unseal_packet(cli->ntlmssp_pipe_state, + reply_data, data_len, + &sig); + } + else if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) { + nt_status = ntlmssp_client_check_packet(cli->ntlmssp_pipe_state, + reply_data, data_len, + &sig); } - crc32 = crc32_calc_buffer(reply_data, data_len); + data_blob_free(&sig); - if (!rpc_auth_ntlmssp_chk(&chk, crc32 , cli->ntlmssp_seq_num)) { - DEBUG(0,("rpc_auth_pipe: rpc_auth_ntlmssp_chk failed.\n")); + if (!NT_STATUS_IS_OK(nt_status)) { + DEBUG(0, ("rpc_auth_pipe: could not validate " + "incoming NTLMSSP packet!\n")); return False; } - cli->ntlmssp_seq_num++; } - if (auth_schannel) { + if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) { RPC_AUTH_NETSEC_CHK chk; - char data[RPC_AUTH_NETSEC_CHK_LEN]; - char *dp = prs_data_p(rdata) + len - auth_len; - prs_struct auth_verf; if (auth_len != RPC_AUTH_NETSEC_CHK_LEN) { DEBUG(0,("rpc_auth_pipe: wrong schannel auth len %d\n", auth_len)); return False; } - if (dp - prs_data_p(rdata) > prs_data_size(rdata)) { - DEBUG(0,("rpc_auth_pipe: schannel auth data > data size !\n")); - return False; - } - - DEBUG(10,("rpc_auth_pipe: schannel verify netsec\n")); - dump_data(100, dp, auth_len); - - memcpy(data, dp, sizeof(data)); - dump_data(100, data, sizeof(data)); - - prs_init(&auth_verf, 0, cli->mem_ctx, UNMARSHALL); - - /* The endinness must be preserved. JRA. */ - prs_set_endian_data( &auth_verf, rdata->bigendian_data); - - prs_give_memory(&auth_verf, data, RPC_AUTH_NETSEC_CHK_LEN, False); - - if (!smb_io_rpc_auth_netsec_chk("schannel_auth_sign", &chk, &auth_verf, 0)) { + if (!smb_io_rpc_auth_netsec_chk("schannel_auth_sign", + &chk, &auth_verf, 0)) { DEBUG(0, ("rpc_auth_pipe: schannel unmarshalling " "RPC_AUTH_NETSECK_CHK failed\n")); return False; } - cli->auth_info.seq_num++; - - if (!netsec_decode(&cli->auth_info, &chk, reply_data, data_len)) { + if (!netsec_decode(&cli->auth_info, + cli->pipe_auth_flags, + SENDER_IS_ACCEPTOR, + &chk, reply_data, data_len)) { DEBUG(0, ("rpc_auth_pipe: Could not decode schannel\n")); return False; } + + cli->auth_info.seq_num++; + } return True; } @@ -365,7 +377,8 @@ static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, int len, int ****************************************************************************/ -static BOOL rpc_api_pipe(struct cli_state *cli, prs_struct *data, prs_struct *rdata) +static BOOL rpc_api_pipe(struct cli_state *cli, prs_struct *data, prs_struct *rdata, + uint8 expected_pkt_type) { uint32 len; char *rparam = NULL; @@ -379,7 +392,9 @@ static BOOL rpc_api_pipe(struct cli_state *cli, prs_struct *data, prs_struct *rd char *prdata = NULL; uint32 rdata_len = 0; uint32 current_offset = 0; + uint32 fragment_start = 0; uint32 max_data = cli->max_xmit_frag ? cli->max_xmit_frag : 1024; + int auth_padding_len = 0; /* Create setup parameters - must be in native byte order. */ @@ -437,6 +452,12 @@ static BOOL rpc_api_pipe(struct cli_state *cli, prs_struct *data, prs_struct *rd } } + if (rhdr.pkt_type == RPC_BINDNACK) { + DEBUG(3, ("Bind NACK received on pipe %x!\n", (int)cli->nt_pipe_fnum)); + prs_mem_free(rdata); + return False; + } + if (rhdr.pkt_type == RPC_RESPONSE) { RPC_HDR_RESP rhdr_resp; if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, rdata, 0)) { @@ -446,6 +467,12 @@ static BOOL rpc_api_pipe(struct cli_state *cli, prs_struct *data, prs_struct *rd } } + if (rhdr.pkt_type != expected_pkt_type) { + DEBUG(3, ("Connection to pipe %x got an unexpected RPC packet type - %d, not %d\n", (int)cli->nt_pipe_fnum, rhdr.pkt_type, expected_pkt_type)); + prs_mem_free(rdata); + return False; + } + DEBUG(5,("rpc_api_pipe: len left: %u smbtrans read: %u\n", (unsigned int)len, (unsigned int)rdata_len )); @@ -468,16 +495,20 @@ static BOOL rpc_api_pipe(struct cli_state *cli, prs_struct *data, prs_struct *rd * Now we have a complete PDU, check the auth struct if any was sent. */ + if(!rpc_auth_pipe(cli, rdata, fragment_start, rhdr.frag_len, + rhdr.auth_len, rhdr.pkt_type, &auth_padding_len)) { + prs_mem_free(rdata); + return False; + } + if (rhdr.auth_len != 0) { - if(!rpc_auth_pipe(cli, rdata, rhdr.frag_len, rhdr.auth_len)) - return False; /* * Drop the auth footers from the current offset. * We need this if there are more fragments. * The auth footers consist of the auth_data and the * preceeding 8 byte auth_header. */ - current_offset -= (rhdr.auth_len + RPC_HDR_AUTH_LEN); + current_offset -= (auth_padding_len + RPC_HDR_AUTH_LEN + rhdr.auth_len); } /* @@ -501,7 +532,7 @@ static BOOL rpc_api_pipe(struct cli_state *cli, prs_struct *data, prs_struct *rd prs_struct hps; uint8 eclass; uint32 ecode; - + /* * First read the header of the next PDU. */ @@ -554,23 +585,33 @@ static BOOL rpc_api_pipe(struct cli_state *cli, prs_struct *data, prs_struct *rd * Now read the rest of the PDU. */ - if (!rpc_read(cli, rdata, len, ¤t_offset)) + if (!rpc_read(cli, rdata, len, ¤t_offset)) { + prs_mem_free(rdata); return False; + } + + fragment_start = current_offset - len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN; /* * Verify any authentication footer. */ + + if(!rpc_auth_pipe(cli, rdata, fragment_start, rhdr.frag_len, + rhdr.auth_len, rhdr.pkt_type, &auth_padding_len)) { + prs_mem_free(rdata); + return False; + } + if (rhdr.auth_len != 0 ) { - if(!rpc_auth_pipe(cli, rdata, rhdr.frag_len, rhdr.auth_len)) - return False; + /* * Drop the auth footers from the current offset. * The auth footers consist of the auth_data and the * preceeding 8 byte auth_header. * We need this if there are more fragments. */ - current_offset -= (rhdr.auth_len + RPC_HDR_AUTH_LEN); + current_offset -= (auth_padding_len + RPC_HDR_AUTH_LEN + rhdr.auth_len); } } @@ -586,97 +627,94 @@ static BOOL rpc_api_pipe(struct cli_state *cli, prs_struct *data, prs_struct *rd ********************************************************************/ -static BOOL create_rpc_bind_req(prs_struct *rpc_out, BOOL do_auth, BOOL do_netsec, uint32 rpc_call_id, - RPC_IFACE *abstract, RPC_IFACE *transfer, - const char *my_name, const char *domain, uint32 neg_flags) +static NTSTATUS create_rpc_bind_req(struct cli_state *cli, prs_struct *rpc_out, + uint32 rpc_call_id, + RPC_IFACE *abstract, RPC_IFACE *transfer, + const char *my_name, const char *domain) { RPC_HDR hdr; RPC_HDR_RB hdr_rb; - char buffer[4096]; - prs_struct auth_info; + RPC_HDR_AUTH hdr_auth; int auth_len = 0; + int auth_type, auth_level; + size_t saved_hdr_offset; - prs_init(&auth_info, 0, prs_get_mem_context(rpc_out), MARSHALL); - - if (do_auth) { - RPC_HDR_AUTH hdr_auth; - RPC_AUTH_VERIFIER auth_verifier; - RPC_AUTH_NTLMSSP_NEG ntlmssp_neg; + prs_struct auth_info; + prs_init(&auth_info, RPC_HDR_AUTH_LEN, /* we will need at least this much */ + prs_get_mem_context(rpc_out), MARSHALL); + if (cli->pipe_auth_flags) { + get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level); + /* * Create the auth structs we will marshall. */ - - init_rpc_hdr_auth(&hdr_auth, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, 0x00, 1); - init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_NEGOTIATE); - init_rpc_auth_ntlmssp_neg(&ntlmssp_neg, neg_flags, my_name, domain); - - /* - * Use the 4k buffer to store the auth info. - */ - - prs_give_memory( &auth_info, buffer, sizeof(buffer), False); - + + init_rpc_hdr_auth(&hdr_auth, auth_type, auth_level, 0x00, 1); + /* * Now marshall the data into the temporary parse_struct. */ - + if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &auth_info, 0)) { DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_AUTH.\n")); - return False; + prs_mem_free(&auth_info); + return NT_STATUS_NO_MEMORY; } + saved_hdr_offset = prs_offset(&auth_info); + } + + if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) { - if(!smb_io_rpc_auth_verifier("auth_verifier", &auth_verifier, &auth_info, 0)) { - DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_AUTH_VERIFIER.\n")); - return False; - } + NTSTATUS nt_status; + DATA_BLOB null_blob = data_blob(NULL, 0); + DATA_BLOB request; - if(!smb_io_rpc_auth_ntlmssp_neg("ntlmssp_neg", &ntlmssp_neg, &auth_info, 0)) { - DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_AUTH_NTLMSSP_NEG.\n")); - return False; + DEBUG(5, ("Processing NTLMSSP Negotiate\n")); + nt_status = ntlmssp_client_update(cli->ntlmssp_pipe_state, + null_blob, + &request); + + if (!NT_STATUS_EQUAL(nt_status, + NT_STATUS_MORE_PROCESSING_REQUIRED)) { + prs_mem_free(&auth_info); + return nt_status; } /* Auth len in the rpc header doesn't include auth_header. */ - auth_len = prs_offset(&auth_info) - RPC_HDR_AUTH_LEN; - } + auth_len = request.length; + prs_copy_data_in(&auth_info, request.data, request.length); - if (do_netsec) { - RPC_HDR_AUTH hdr_auth; - RPC_AUTH_NETSEC_NEG netsec_neg; + DEBUG(5, ("NTLMSSP Negotiate:\n")); + dump_data(5, request.data, request.length); - /* - * Create the auth structs we will marshall. - */ + data_blob_free(&request); - init_rpc_hdr_auth(&hdr_auth, NETSEC_AUTH_TYPE, NETSEC_AUTH_LEVEL, - 0x00, 1); - init_rpc_auth_netsec_neg(&netsec_neg, domain, my_name); + } + else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) { + RPC_AUTH_NETSEC_NEG netsec_neg; - /* - * Use the 4k buffer to store the auth info. - */ + /* Use lp_workgroup() if domain not specified */ - prs_give_memory( &auth_info, buffer, sizeof(buffer), False); + if (!domain || !domain[0]) + domain = lp_workgroup(); + + init_rpc_auth_netsec_neg(&netsec_neg, domain, my_name); /* * Now marshall the data into the temporary parse_struct. */ - if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &auth_info, 0)) { - DEBUG(0,("Failed to marshall RPC_HDR_AUTH.\n")); - return False; - } - if(!smb_io_rpc_auth_netsec_neg("netsec_neg", &netsec_neg, &auth_info, 0)) { DEBUG(0,("Failed to marshall RPC_AUTH_NETSEC_NEG.\n")); - return False; + prs_mem_free(&auth_info); + return NT_STATUS_NO_MEMORY; } /* Auth len in the rpc header doesn't include auth_header. */ - auth_len = prs_offset(&auth_info) - RPC_HDR_AUTH_LEN; + auth_len = prs_offset(&auth_info) - saved_hdr_offset; } - /* create the request RPC_HDR */ init_rpc_hdr(&hdr, RPC_BIND, 0x3, rpc_call_id, RPC_HEADER_LEN + RPC_HDR_RB_LEN + prs_offset(&auth_info), @@ -684,7 +722,8 @@ static BOOL create_rpc_bind_req(prs_struct *rpc_out, BOOL do_auth, BOOL do_netse if(!smb_io_rpc_hdr("hdr" , &hdr, rpc_out, 0)) { DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR.\n")); - return False; + prs_mem_free(&auth_info); + return NT_STATUS_NO_MEMORY; } /* create the bind request RPC_HDR_RB */ @@ -694,21 +733,22 @@ static BOOL create_rpc_bind_req(prs_struct *rpc_out, BOOL do_auth, BOOL do_netse /* Marshall the bind request data */ if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) { DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_RB.\n")); - return False; + prs_mem_free(&auth_info); + return NT_STATUS_NO_MEMORY; } /* * Grow the outgoing buffer to store any auth info. */ - if(hdr.auth_len != 0) { + if(auth_len != 0) { if(!prs_append_prs_data( rpc_out, &auth_info)) { DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n")); - return False; + prs_mem_free(&auth_info); + return NT_STATUS_NO_MEMORY; } } - - return True; + return NT_STATUS_OK; } /******************************************************************* @@ -718,90 +758,71 @@ static BOOL create_rpc_bind_req(prs_struct *rpc_out, BOOL do_auth, BOOL do_netse the authentication handshake. ********************************************************************/ -static BOOL create_rpc_bind_resp(struct pwd_info *pwd, - const char *domain, const char *user_name, const char *my_name, - uint32 ntlmssp_cli_flgs, - uint32 rpc_call_id, - prs_struct *rpc_out) +static NTSTATUS create_rpc_bind_resp(struct cli_state *cli, + uint32 rpc_call_id, + prs_struct *rpc_out) { - unsigned char lm_owf[24]; - unsigned char nt_owf[24]; + NTSTATUS nt_status; RPC_HDR hdr; RPC_HDR_AUTHA hdr_autha; - RPC_AUTH_VERIFIER auth_verifier; - RPC_AUTH_NTLMSSP_RESP ntlmssp_resp; - char buffer[4096]; - prs_struct auth_info; - - /* - * Marshall the variable length data into a temporary parse - * struct, pointing into a 4k local buffer. - */ - prs_init(&auth_info, 0, prs_get_mem_context(rpc_out), MARSHALL); - - /* - * Use the 4k buffer to store the auth info. - */ - - prs_give_memory( &auth_info, buffer, sizeof(buffer), False); - - /* - * Create the variable length auth_data. - */ - - init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH); - - pwd_get_lm_nt_owf(pwd, lm_owf, nt_owf); - - init_rpc_auth_ntlmssp_resp(&ntlmssp_resp, - lm_owf, nt_owf, - domain, user_name, my_name, - ntlmssp_cli_flgs); - - /* - * Marshall the variable length auth_data into a temp parse_struct. - */ - - if(!smb_io_rpc_auth_verifier("auth_verifier", &auth_verifier, &auth_info, 0)) { - DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_AUTH_VERIFIER.\n")); - return False; - } - - if(!smb_io_rpc_auth_ntlmssp_resp("ntlmssp_resp", &ntlmssp_resp, &auth_info, 0)) { - DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_AUTH_NTLMSSP_RESP.\n")); - return False; + DATA_BLOB ntlmssp_null_response = data_blob(NULL, 0); + DATA_BLOB ntlmssp_reply; + int auth_type, auth_level; + + /* The response is picked up from the internal cache, + where it was placed by the rpc_auth_pipe() code */ + nt_status = ntlmssp_client_update(cli->ntlmssp_pipe_state, + ntlmssp_null_response, + &ntlmssp_reply); + + if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { + return nt_status; } /* Create the request RPC_HDR */ init_rpc_hdr(&hdr, RPC_BINDRESP, 0x0, rpc_call_id, - RPC_HEADER_LEN + RPC_HDR_AUTHA_LEN + prs_offset(&auth_info), - prs_offset(&auth_info) ); - + RPC_HEADER_LEN + RPC_HDR_AUTHA_LEN + ntlmssp_reply.length, + ntlmssp_reply.length ); + /* Marshall it. */ if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) { DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR.\n")); - return False; + data_blob_free(&ntlmssp_reply); + return NT_STATUS_NO_MEMORY; } + get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level); + /* Create the request RPC_HDR_AUTHA */ init_rpc_hdr_autha(&hdr_autha, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN, - NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, 0x00); + auth_type, auth_level, 0x00); if(!smb_io_rpc_hdr_autha("hdr_autha", &hdr_autha, rpc_out, 0)) { DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR_AUTHA.\n")); - return False; + data_blob_free(&ntlmssp_reply); + return NT_STATUS_NO_MEMORY; } /* * Append the auth data to the outgoing buffer. */ - if(!prs_append_prs_data(rpc_out, &auth_info)) { + if(!prs_copy_data_in(rpc_out, ntlmssp_reply.data, ntlmssp_reply.length)) { DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n")); - return False; + data_blob_free(&ntlmssp_reply); + return NT_STATUS_NO_MEMORY; } - return True; + if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) { + nt_status = ntlmssp_client_sign_init(cli->ntlmssp_pipe_state); + + if (!NT_STATUS_IS_OK(nt_status)) { + return nt_status; + } + } + + data_blob_free(&ntlmssp_reply); + return NT_STATUS_OK; } @@ -852,34 +873,17 @@ static uint32 create_rpc_request(prs_struct *rpc_out, uint8 op_num, int data_len } /******************************************************************* - Puts an NTLMSSP auth header into an rpc request. - ********************************************************************/ - -static BOOL create_ntlmssp_auth_hdr(prs_struct *outgoing_packet, BOOL auth_verify) -{ - RPC_HDR_AUTH hdr_auth; - - init_rpc_hdr_auth(&hdr_auth, NTLMSSP_AUTH_TYPE, - NTLMSSP_AUTH_LEVEL, 0x08, - (auth_verify ? 1 : 0)); - if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, - outgoing_packet, 0)) { - DEBUG(0,("create_auth_hdr:Failed to marshal RPC_HDR_AUTH.\n")); - return False; - } - return True; -} - -/******************************************************************* - Puts a NETLOGON schannel auth header into an rpc request. + Puts an auth header into an rpc request. ********************************************************************/ -static BOOL create_netsec_auth_hdr(prs_struct *outgoing_packet, int padding) +static BOOL create_auth_hdr(prs_struct *outgoing_packet, + int auth_type, + int auth_level, int padding) { RPC_HDR_AUTH hdr_auth; - init_rpc_hdr_auth(&hdr_auth, NETSEC_AUTH_TYPE, - NETSEC_AUTH_LEVEL, padding, 1); + init_rpc_hdr_auth(&hdr_auth, auth_type, auth_level, + padding, 1); if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, outgoing_packet, 0)) { DEBUG(0,("create_auth_hdr:Failed to marshal RPC_HDR_AUTH.\n")); @@ -888,30 +892,6 @@ static BOOL create_netsec_auth_hdr(prs_struct *outgoing_packet, int padding) return True; } -/******************************************************************* - Puts auth data into an rpc request. - ********************************************************************/ - -static BOOL create_auth_data(struct cli_state *cli, uint32 crc32, - prs_struct *outgoing_packet) -{ - char *pdata_out = prs_data_p(outgoing_packet); - RPC_AUTH_NTLMSSP_CHK chk; - uint32 current_offset = prs_offset(outgoing_packet); - - init_rpc_auth_ntlmssp_chk(&chk, NTLMSSP_SIGN_VERSION, - crc32, cli->ntlmssp_seq_num++); - if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &chk, - outgoing_packet, 0)) { - DEBUG(0,("create_auth_data: Failed to marshal RPC_AUTH_NTLMSSP_CHK.\n")); - return False; - } - NTLMSSPcalc_ap(cli, (unsigned char*) - &pdata_out[current_offset+4], - RPC_AUTH_NTLMSSP_CHK_LEN - 4); - return True; -} - /** * Send a request on an RPC pipe and get a response. * @@ -922,43 +902,60 @@ static BOOL create_auth_data(struct cli_state *cli, uint32 crc32, BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num, prs_struct *data, prs_struct *rdata) { - uint32 auth_len, max_data, data_left, data_sent; + uint32 auth_len, real_auth_len, auth_hdr_len, max_data, data_left, data_sent; + NTSTATUS nt_status; BOOL ret = False; - BOOL auth_verify, auth_seal, auth_schannel; uint32 callid = 0; fstring dump_name; - auth_verify = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SIGN) != 0); - auth_seal = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SEAL) != 0); - auth_schannel = (cli->saved_netlogon_pipe_fnum != 0); - auth_len = 0; + real_auth_len = 0; + auth_hdr_len = 0; - if (auth_verify) - auth_len = RPC_AUTH_NTLMSSP_CHK_LEN; - - if (auth_schannel) - auth_len = RPC_AUTH_NETSEC_CHK_LEN; + if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) { + if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) { + auth_len = RPC_AUTH_NTLMSSP_CHK_LEN; + } + if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) { + auth_len = RPC_AUTH_NETSEC_CHK_LEN; + } + auth_hdr_len = RPC_HDR_AUTH_LEN; + } /* * calc how much actual data we can send in a PDU fragment */ max_data = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - - (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len - 8; - + auth_hdr_len - auth_len - 8; + for (data_left = prs_offset(data), data_sent = 0; data_left > 0;) { prs_struct outgoing_packet; + prs_struct sec_blob; uint32 data_len, send_size; uint8 flags = 0; - uint32 crc32 = 0; uint32 auth_padding = 0; RPC_AUTH_NETSEC_CHK verf; + DATA_BLOB sign_blob; /* * how much will we send this time */ send_size = MIN(data_left, max_data); + if (!prs_init(&sec_blob, send_size, /* will need at least this much */ + cli->mem_ctx, MARSHALL)) { + DEBUG(0,("Could not malloc %u bytes", + send_size+auth_padding)); + return False; + } + + if(!prs_append_some_prs_data(&sec_blob, data, + data_sent, send_size)) { + DEBUG(0,("Failed to append data to netsec blob\n")); + prs_mem_free(&sec_blob); + return False; + } + /* * NT expects the data that is sealed to be 8-byte * aligned. The padding must be encrypted as well and @@ -967,12 +964,95 @@ BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num, * be stored in the auth header. */ - if (auth_schannel) - auth_padding = 8 - (send_size & 7); + if (cli->pipe_auth_flags) { + size_t data_and_padding_size; + int auth_type; + int auth_level; + prs_align_uint64(&sec_blob); - data_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + send_size + - ((auth_verify|auth_schannel) ? RPC_HDR_AUTH_LEN : 0) + - auth_len + auth_padding; + get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level); + + data_and_padding_size = prs_offset(&sec_blob); + auth_padding = data_and_padding_size - send_size; + + /* insert the auth header */ + + if(!create_auth_hdr(&sec_blob, auth_type, auth_level, auth_padding)) { + prs_mem_free(&sec_blob); + return False; + } + + /* create an NTLMSSP signature */ + if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) { + /* + * Seal the outgoing data if requested. + */ + if (cli->pipe_auth_flags & AUTH_PIPE_SEAL) { + + nt_status = ntlmssp_client_seal_packet(cli->ntlmssp_pipe_state, + (unsigned char*)prs_data_p(&sec_blob), + data_and_padding_size, + &sign_blob); + if (!NT_STATUS_IS_OK(nt_status)) { + prs_mem_free(&sec_blob); + return False; + } + } + else if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) { + + nt_status = ntlmssp_client_sign_packet(cli->ntlmssp_pipe_state, + (unsigned char*)prs_data_p(&sec_blob), + data_and_padding_size, &sign_blob); + if (!NT_STATUS_IS_OK(nt_status)) { + prs_mem_free(&sec_blob); + return False; + } + } + + + /* write auth footer onto the packet */ + real_auth_len = sign_blob.length; + + prs_copy_data_in(&sec_blob, sign_blob.data, sign_blob.length); + data_blob_free(&sign_blob); + + } + else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) { + static const uchar netsec_sig[8] = NETSEC_SIGNATURE; + static const uchar nullbytes[8] = { 0,0,0,0,0,0,0,0 }; + size_t parse_offset_marker; + if ((cli->auth_info.seq_num & 1) != 0) { + DEBUG(0,("SCHANNEL ERROR: seq_num must be even in client (seq_num=%d)\n", + cli->auth_info.seq_num)); + } + + DEBUG(10,("SCHANNEL seq_num=%d\n", cli->auth_info.seq_num)); + + init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes, + nullbytes, nullbytes); + + netsec_encode(&cli->auth_info, + cli->pipe_auth_flags, + SENDER_IS_INITIATOR, + &verf, + prs_data_p(&sec_blob), + data_and_padding_size); + + cli->auth_info.seq_num++; + + /* write auth footer onto the packet */ + + parse_offset_marker = prs_offset(&sec_blob); + if (!smb_io_rpc_auth_netsec_chk("", &verf, + &sec_blob, 0)) { + prs_mem_free(&sec_blob); + return False; + } + real_auth_len = prs_offset(&sec_blob) - parse_offset_marker; + } + } + + data_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + prs_offset(&sec_blob); /* * Malloc parse struct to hold it (and enough for alignments). @@ -992,128 +1072,23 @@ BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num, * Write out the RPC header and the request header. */ if(!(callid = create_rpc_request(&outgoing_packet, op_num, - data_len, auth_len, flags, + data_len, real_auth_len, flags, callid, data_left))) { DEBUG(0,("rpc_api_pipe_req: Failed to create RPC request.\n")); prs_mem_free(&outgoing_packet); + prs_mem_free(&sec_blob); return False; } - /* - * Seal the outgoing data if requested. - */ - if (auth_seal) { - crc32 = crc32_calc_buffer(prs_data_p(data) + data_sent, - send_size); - NTLMSSPcalc_ap(cli, (unsigned char*)prs_data_p(data) + - data_sent, send_size); - } - - /* - * Now copy the data into the outgoing packet. - */ - - if (auth_schannel) { - static const uchar netsec_sig[8] = NETSEC_SIGNATURE; - static const uchar nullbytes[8] = { 0,0,0,0,0,0,0,0 }; - uchar sign[8]; - prs_struct netsec_blob; - - if ((cli->auth_info.seq_num & 1) != 0) { - DEBUG(0,("SCHANNEL ERROR: seq_num must be even in client (seq_num=%d)\n", - cli->auth_info.seq_num)); - } - - DEBUG(10,("SCHANNEL seq_num=%d\n", cli->auth_info.seq_num)); - - RSIVAL(sign, 0, cli->auth_info.seq_num); - SIVAL(sign, 4, 0x80); - - if (!prs_init(&netsec_blob, send_size+auth_padding, - cli->mem_ctx, MARSHALL)) { - DEBUG(0,("Could not malloc %u bytes", - send_size+auth_padding)); - prs_mem_free(&outgoing_packet); - return False; - } - - if(!prs_append_some_prs_data(&netsec_blob, data, - data_sent, send_size)) { - DEBUG(0,("Failed to append data to netsec blob\n")); - prs_mem_free(&outgoing_packet); - return False; - } - - netsec_blob.align = 8; - - if (!prs_align(&netsec_blob)) { - DEBUG(0,("Could not align netsec blob\n")); - prs_mem_free(&outgoing_packet); - return False; - } - - init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes, - sign, nullbytes); - - netsec_encode(&cli->auth_info, &verf, - prs_data_p(&netsec_blob), - prs_data_size(&netsec_blob)); - - prs_append_prs_data(&outgoing_packet, &netsec_blob); - prs_mem_free(&netsec_blob); - - cli->auth_info.seq_num++; - - } else { - if(!prs_append_some_prs_data(&outgoing_packet, data, - data_sent, send_size)) { - DEBUG(0,("rpc_api_pipe_req: Failed to append " - "data to outgoing packet.\n")); - prs_mem_free(&outgoing_packet); - return False; - } - } - - /* - * Add a trailing auth_verifier if needed. - */ - if (auth_seal || auth_verify) { - if(!create_ntlmssp_auth_hdr(&outgoing_packet, auth_verify)) { - prs_mem_free(&outgoing_packet); - return False; - } - } - - /* - * Finally the auth data itself. - */ - if (auth_verify) { - if (!create_auth_data(cli, crc32, &outgoing_packet)) { - prs_mem_free(&outgoing_packet); - return False; - } - } - - if (auth_schannel) { - - if (!create_netsec_auth_hdr(&outgoing_packet, - auth_padding)) { - prs_mem_free(&outgoing_packet); - return False; - } - - if (!smb_io_rpc_auth_netsec_chk("", &verf, - &outgoing_packet, 0)) { - prs_mem_free(&outgoing_packet); - return False; - } - } + prs_append_prs_data(&outgoing_packet, &sec_blob); + prs_mem_free(&sec_blob); DEBUG(100,("data_len: %x data_calc_len: %x\n", data_len, prs_offset(&outgoing_packet))); if (flags & RPC_FLG_LAST) - ret = rpc_api_pipe(cli, &outgoing_packet, rdata); + ret = rpc_api_pipe(cli, &outgoing_packet, + rdata, RPC_RESPONSE); else { cli_write(cli, cli->nt_pipe_fnum, 0x0008, prs_data_p(&outgoing_packet), @@ -1297,84 +1272,23 @@ static BOOL check_bind_response(RPC_HDR_BA *hdr_ba, const int pipe_idx, RPC_IFAC static BOOL rpc_send_auth_reply(struct cli_state *cli, prs_struct *rdata, uint32 rpc_call_id) { - RPC_HDR_AUTH rhdr_auth; - RPC_AUTH_VERIFIER rhdr_verf; - RPC_AUTH_NTLMSSP_CHAL rhdr_chal; - char buffer[MAX_PDU_FRAG_LEN]; prs_struct rpc_out; ssize_t ret; - unsigned char p24[24]; - unsigned char lm_owf[24]; - unsigned char lm_hash[16]; - - if(!smb_io_rpc_hdr_auth("", &rhdr_auth, rdata, 0)) { - DEBUG(0,("rpc_send_auth_reply: Failed to unmarshall RPC_HDR_AUTH.\n")); - return False; - } - if(!smb_io_rpc_auth_verifier("", &rhdr_verf, rdata, 0)) { - DEBUG(0,("rpc_send_auth_reply: Failed to unmarshall RPC_AUTH_VERIFIER.\n")); - return False; - } - if(!smb_io_rpc_auth_ntlmssp_chal("", &rhdr_chal, rdata, 0)) { - DEBUG(0,("rpc_send_auth_reply: Failed to unmarshall RPC_AUTH_NTLMSSP_CHAL.\n")); - return False; - } - - cli->ntlmssp_cli_flgs = rhdr_chal.neg_flags; - - pwd_make_lm_nt_owf(&cli->pwd, rhdr_chal.challenge); + prs_init(&rpc_out, RPC_HEADER_LEN + RPC_HDR_AUTHA_LEN, /* need at least this much */ + cli->mem_ctx, MARSHALL); - prs_init(&rpc_out, 0, cli->mem_ctx, MARSHALL); - - prs_give_memory( &rpc_out, buffer, sizeof(buffer), False); - - create_rpc_bind_resp(&cli->pwd, cli->domain, - cli->user_name, global_myname(), - cli->ntlmssp_cli_flgs, rpc_call_id, + create_rpc_bind_resp(cli, rpc_call_id, &rpc_out); - - pwd_get_lm_nt_owf(&cli->pwd, lm_owf, NULL); - pwd_get_lm_nt_16(&cli->pwd, lm_hash, NULL); - - NTLMSSPOWFencrypt(lm_hash, lm_owf, p24); - - { - unsigned char j = 0; - int ind; - unsigned char k2[8]; - - memcpy(k2, p24, 5); - k2[5] = 0xe5; - k2[6] = 0x38; - k2[7] = 0xb0; - - for (ind = 0; ind < 256; ind++) - cli->ntlmssp_hash[ind] = (unsigned char)ind; - - for( ind = 0; ind < 256; ind++) { - unsigned char tc; - - j += (cli->ntlmssp_hash[ind] + k2[ind%8]); - - tc = cli->ntlmssp_hash[ind]; - cli->ntlmssp_hash[ind] = cli->ntlmssp_hash[j]; - cli->ntlmssp_hash[j] = tc; - } - - cli->ntlmssp_hash[256] = 0; - cli->ntlmssp_hash[257] = 0; - } - - memset((char *)lm_hash, '\0', sizeof(lm_hash)); if ((ret = cli_write(cli, cli->nt_pipe_fnum, 0x8, prs_data_p(&rpc_out), 0, (size_t)prs_offset(&rpc_out))) != (ssize_t)prs_offset(&rpc_out)) { DEBUG(0,("rpc_send_auth_reply: cli_write failed. Return was %d\n", (int)ret)); + prs_mem_free(&rpc_out); return False; } - cli->ntlmssp_srv_flgs = rhdr_chal.neg_flags; + prs_mem_free(&rpc_out); return True; } @@ -1382,14 +1296,12 @@ static BOOL rpc_send_auth_reply(struct cli_state *cli, prs_struct *rdata, uint32 Do an rpc bind. ****************************************************************************/ -static BOOL rpc_pipe_bind(struct cli_state *cli, int pipe_idx, const char *my_name, - BOOL do_netsec) +static BOOL rpc_pipe_bind(struct cli_state *cli, int pipe_idx, const char *my_name) { RPC_IFACE abstract; RPC_IFACE transfer; prs_struct rpc_out; prs_struct rdata; - BOOL do_auth = (cli->ntlmssp_cli_flgs != 0); uint32 rpc_call_id; char buffer[MAX_PDU_FRAG_LEN]; @@ -1411,16 +1323,54 @@ static BOOL rpc_pipe_bind(struct cli_state *cli, int pipe_idx, const char *my_na rpc_call_id = get_rpc_call_id(); + if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) { + NTSTATUS nt_status; + fstring password; + + DEBUG(5, ("NTLMSSP authenticated pipe selected\n")); + + nt_status = ntlmssp_client_start(&cli->ntlmssp_pipe_state); + + if (!NT_STATUS_IS_OK(nt_status)) + return False; + + nt_status = ntlmssp_set_username(cli->ntlmssp_pipe_state, + cli->user_name); + if (!NT_STATUS_IS_OK(nt_status)) + return False; + + nt_status = ntlmssp_set_domain(cli->ntlmssp_pipe_state, + cli->domain); + if (!NT_STATUS_IS_OK(nt_status)) + return False; + + pwd_get_cleartext(&cli->pwd, password); + nt_status = ntlmssp_set_password(cli->ntlmssp_pipe_state, + password); + if (!NT_STATUS_IS_OK(nt_status)) + return False; + + if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) { + cli->ntlmssp_pipe_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN; + } + + if (cli->pipe_auth_flags & AUTH_PIPE_SEAL) { + cli->ntlmssp_pipe_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL; + } + } else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) { + cli->auth_info.seq_num = 0; + } + /* Marshall the outgoing data. */ - create_rpc_bind_req(&rpc_out, do_auth, do_netsec, rpc_call_id, + create_rpc_bind_req(cli, &rpc_out, rpc_call_id, &abstract, &transfer, - global_myname(), cli->domain, cli->ntlmssp_cli_flgs); + global_myname(), cli->domain); /* Initialize the incoming data struct. */ prs_init(&rdata, 0, cli->mem_ctx, UNMARSHALL); /* send data on \PIPE\. receive a response */ - if (rpc_api_pipe(cli, &rpc_out, &rdata)) { + if (rpc_api_pipe(cli, &rpc_out, &rdata, RPC_BINDACK)) { RPC_HDR_BA hdr_ba; DEBUG(5, ("rpc_pipe_bind: rpc_api_pipe returned OK.\n")); @@ -1446,15 +1396,17 @@ static BOOL rpc_pipe_bind(struct cli_state *cli, int pipe_idx, const char *my_na * handshake. */ - if (do_auth && !rpc_send_auth_reply(cli, &rdata, rpc_call_id)) { + if ((cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) + && !rpc_send_auth_reply(cli, &rdata, rpc_call_id)) { DEBUG(0,("rpc_pipe_bind: rpc_send_auth_reply failed.\n")); prs_mem_free(&rdata); return False; } + prs_mem_free(&rdata); + return True; } - prs_mem_free(&rdata); - return True; + return False; } /**************************************************************************** @@ -1502,7 +1454,7 @@ BOOL cli_nt_session_open(struct cli_state *cli, const int pipe_idx) /******************* bind request on pipe *****************/ - if (!rpc_pipe_bind(cli, pipe_idx, global_myname(), False)) { + if (!rpc_pipe_bind(cli, pipe_idx, global_myname())) { DEBUG(2,("cli_nt_session_open: rpc bind to %s failed\n", get_pipe_name_from_index(pipe_idx))); cli_close(cli, cli->nt_pipe_fnum); @@ -1515,15 +1467,15 @@ BOOL cli_nt_session_open(struct cli_state *cli, const int pipe_idx) fstrcpy(cli->srv_name_slash, "\\\\"); fstrcat(cli->srv_name_slash, cli->desthost); - strupper(cli->srv_name_slash); + strupper_m(cli->srv_name_slash); fstrcpy(cli->clnt_name_slash, "\\\\"); fstrcat(cli->clnt_name_slash, global_myname()); - strupper(cli->clnt_name_slash); + strupper_m(cli->clnt_name_slash); fstrcpy(cli->mach_acct, global_myname()); fstrcat(cli->mach_acct, "$"); - strupper(cli->mach_acct); + strupper_m(cli->mach_acct); /* Remember which pipe we're talking to */ fstrcpy(cli->pipe_name, pipe_names[pipe_idx].client_pipe); @@ -1534,34 +1486,28 @@ BOOL cli_nt_session_open(struct cli_state *cli, const int pipe_idx) /**************************************************************************** Open a session to the NETLOGON pipe using schannel. + + (Assumes that the netlogon pipe is already open) ****************************************************************************/ -BOOL cli_nt_open_netlogon(struct cli_state *cli, const char *trust_password, - int sec_chan) +NTSTATUS cli_nt_establish_netlogon(struct cli_state *cli, int sec_chan, + const uchar trust_password[16]) { - NTSTATUS result; + NTSTATUS result; uint32 neg_flags = 0x000001ff; int fnum; + cli_nt_netlogon_netsec_session_close(cli); + if (lp_client_schannel() != False) neg_flags |= NETLOGON_NEG_SCHANNEL; - - if (!cli_nt_session_open(cli, PI_NETLOGON)) { - return False; - } - - if (!secrets_init()) { - DEBUG(3,("Failed to init secrets.tdb\n")); - return False; - } - result = cli_nt_setup_creds(cli, sec_chan, trust_password, &neg_flags, 2); if (!NT_STATUS_IS_OK(result)) { cli_nt_session_close(cli); - return False; + return result; } if ((lp_client_schannel() == True) && @@ -1569,35 +1515,40 @@ BOOL cli_nt_open_netlogon(struct cli_state *cli, const char *trust_password, DEBUG(3, ("Server did not offer schannel\n")); cli_nt_session_close(cli); - return False; + return NT_STATUS_UNSUCCESSFUL; } if ((lp_client_schannel() == False) || ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) { - return True; + return NT_STATUS_OK; + + /* keep the existing connection to NETLOGON open */ + } /* Server offered schannel, so try it. */ - cli->auth_info.seq_num = 0; memcpy(cli->auth_info.sess_key, cli->sess_key, sizeof(cli->auth_info.sess_key)); cli->saved_netlogon_pipe_fnum = cli->nt_pipe_fnum; + cli->pipe_auth_flags = AUTH_PIPE_NETSEC; + cli->pipe_auth_flags |= AUTH_PIPE_SIGN; + cli->pipe_auth_flags |= AUTH_PIPE_SEAL; + if (cli->capabilities & CAP_NT_SMBS) { /* The secure channel connection must be opened on the same session (TCP connection) as the one the challenge was requested from. */ - if ((fnum = cli_nt_create(cli, PIPE_NETLOGON_PLAIN, DESIRED_ACCESS_PIPE)) == -1) { DEBUG(0,("cli_nt_create failed to %s machine %s. " "Error was %s\n", PIPE_NETLOGON, cli->desthost, cli_errstr(cli))); - return False; + return NT_STATUS_UNSUCCESSFUL; } cli->nt_pipe_fnum = (uint16)fnum; @@ -1608,7 +1559,7 @@ BOOL cli_nt_open_netlogon(struct cli_state *cli, const char *trust_password, "Error was %s\n", PIPE_NETLOGON, cli->desthost, cli_errstr(cli))); - return False; + return NT_STATUS_UNSUCCESSFUL; } cli->nt_pipe_fnum = (uint16)fnum; @@ -1618,17 +1569,20 @@ BOOL cli_nt_open_netlogon(struct cli_state *cli, const char *trust_password, DEBUG(0,("Pipe hnd state failed. Error was %s\n", cli_errstr(cli))); cli_close(cli, cli->nt_pipe_fnum); - return False; + return NT_STATUS_UNSUCCESSFUL; } } - - if (!rpc_pipe_bind(cli, PI_NETLOGON, global_myname(), True)) { + + /* doing schannel, not per-user auth */ + cli->pipe_auth_flags = AUTH_PIPE_NETSEC | AUTH_PIPE_SIGN | AUTH_PIPE_SEAL; + + if (!rpc_pipe_bind(cli, PI_NETLOGON, global_myname())) { DEBUG(2,("rpc bind to %s failed\n", PIPE_NETLOGON)); cli_close(cli, cli->nt_pipe_fnum); - return False; + return NT_STATUS_UNSUCCESSFUL; } - return True; + return NT_STATUS_OK; } @@ -1638,16 +1592,3 @@ const char *cli_pipe_get_name(struct cli_state *cli) } -/**************************************************************************** -close the session -****************************************************************************/ - -void cli_nt_session_close(struct cli_state *cli) -{ - if (cli->saved_netlogon_pipe_fnum != 0) { - cli_close(cli, cli->saved_netlogon_pipe_fnum); - cli->saved_netlogon_pipe_fnum = 0; - } - cli_close(cli, cli->nt_pipe_fnum); - cli->nt_pipe_fnum = 0; -} diff --git a/source3/rpc_client/cli_samr.c b/source3/rpc_client/cli_samr.c index 767c6a12b2..635b7e7135 100644 --- a/source3/rpc_client/cli_samr.c +++ b/source3/rpc_client/cli_samr.c @@ -35,6 +35,8 @@ NTSTATUS cli_samr_connect(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_CONNECT r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_connect to %s\n", cli->desthost)); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -82,6 +84,8 @@ NTSTATUS cli_samr_connect4(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_CONNECT4 r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_connect4 to %s\n", cli->desthost)); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -129,6 +133,8 @@ NTSTATUS cli_samr_close(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_CLOSE_HND r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_close\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -177,6 +183,8 @@ NTSTATUS cli_samr_open_domain(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_OPEN_DOMAIN r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_open_domain with sid %s\n", sid_string_static(domain_sid) )); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -225,6 +233,8 @@ NTSTATUS cli_samr_open_user(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_OPEN_USER r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_open_user with rid 0x%x\n", user_rid )); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -273,6 +283,8 @@ NTSTATUS cli_samr_open_group(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_OPEN_GROUP r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_open_group with rid 0x%x\n", group_rid )); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -321,6 +333,8 @@ NTSTATUS cli_samr_query_userinfo(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_QUERY_USERINFO r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_query_userinfo\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -365,6 +379,8 @@ NTSTATUS cli_samr_query_groupinfo(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_QUERY_GROUPINFO r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_query_groupinfo\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -410,6 +426,8 @@ NTSTATUS cli_samr_query_usergroups(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_QUERY_USERGROUPS r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_query_usergroups\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -457,6 +475,8 @@ NTSTATUS cli_samr_query_useraliases(struct cli_state *cli, TALLOC_CTX *mem_ctx, NTSTATUS result = NT_STATUS_UNSUCCESSFUL; unsigned int ptr=1; + DEBUG(10,("cli_samr_query_useraliases\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -503,6 +523,8 @@ NTSTATUS cli_samr_query_groupmem(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_QUERY_GROUPMEM r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_query_groupmem\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -568,6 +590,8 @@ NTSTATUS cli_samr_enum_dom_users(struct cli_state *cli, TALLOC_CTX *mem_ctx, NTSTATUS result = NT_STATUS_UNSUCCESSFUL; int i; + DEBUG(10,("cli_samr_enum_dom_users starting at index %u\n", (unsigned int)*start_idx)); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -646,6 +670,8 @@ NTSTATUS cli_samr_enum_dom_groups(struct cli_state *cli, TALLOC_CTX *mem_ctx, NTSTATUS result = NT_STATUS_UNSUCCESSFUL; uint32 name_idx, i; + DEBUG(10,("cli_samr_enum_dom_groups starting at index %u\n", (unsigned int)*start_idx)); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -724,6 +750,8 @@ NTSTATUS cli_samr_enum_als_groups(struct cli_state *cli, TALLOC_CTX *mem_ctx, NTSTATUS result = NT_STATUS_UNSUCCESSFUL; uint32 name_idx, i; + DEBUG(10,("cli_samr_enum_als_groups starting at index %u\n", (unsigned int)*start_idx)); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -804,6 +832,8 @@ NTSTATUS cli_samr_query_aliasmem(struct cli_state *cli, TALLOC_CTX *mem_ctx, NTSTATUS result = NT_STATUS_UNSUCCESSFUL; uint32 i; + DEBUG(10,("cli_samr_query_aliasmem\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -862,6 +892,8 @@ NTSTATUS cli_samr_open_alias(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_OPEN_ALIAS r; NTSTATUS result; + DEBUG(10,("cli_samr_open_alias with rid 0x%x\n", alias_rid)); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -903,6 +935,57 @@ NTSTATUS cli_samr_open_alias(struct cli_state *cli, TALLOC_CTX *mem_ctx, return result; } +/* Query alias info */ + +NTSTATUS cli_samr_query_alias_info(struct cli_state *cli, TALLOC_CTX *mem_ctx, + POLICY_HND *alias_pol, uint16 switch_value, + ALIAS_INFO_CTR *ctr) +{ + prs_struct qbuf, rbuf; + SAMR_Q_QUERY_ALIASINFO q; + SAMR_R_QUERY_ALIASINFO r; + NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + + DEBUG(10,("cli_samr_query_dom_info\n")); + + ZERO_STRUCT(q); + ZERO_STRUCT(r); + + /* Initialise parse structures */ + + prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL); + prs_init(&rbuf, 0, mem_ctx, UNMARSHALL); + + /* Marshall data and send request */ + + init_samr_q_query_aliasinfo(&q, alias_pol, switch_value); + + if (!samr_io_q_query_aliasinfo("", &q, &qbuf, 0) || + !rpc_api_pipe_req(cli, SAMR_QUERY_ALIASINFO, &qbuf, &rbuf)) { + goto done; + } + + /* Unmarshall response */ + + if (!samr_io_r_query_aliasinfo("", &r, &rbuf, 0)) { + goto done; + } + + /* Return output parameters */ + + if (!NT_STATUS_IS_OK(result = r.status)) { + goto done; + } + + *ctr = r.ctr; + + done: + prs_mem_free(&qbuf); + prs_mem_free(&rbuf); + + return result; +} + /* Query domain info */ NTSTATUS cli_samr_query_dom_info(struct cli_state *cli, TALLOC_CTX *mem_ctx, @@ -914,6 +997,8 @@ NTSTATUS cli_samr_query_dom_info(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_QUERY_DOMAIN_INFO r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_query_dom_info\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -997,9 +1082,13 @@ NTSTATUS cli_samr_query_dispinfo(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_QUERY_DISPINFO r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_query_dispinfo for start_idx = %u\n", *start_idx)); + ZERO_STRUCT(q); ZERO_STRUCT(r); + *num_entries = 0; + /* Initialise parse structures */ prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL); @@ -1057,6 +1146,8 @@ NTSTATUS cli_samr_lookup_rids(struct cli_state *cli, TALLOC_CTX *mem_ctx, NTSTATUS result = NT_STATUS_UNSUCCESSFUL; uint32 i; + DEBUG(10,("cli_samr_lookup_rids\n")); + if (num_rids > 1000) { DEBUG(2, ("cli_samr_lookup_rids: warning: NT4 can crash if " "more than ~1000 rids are looked up at once.\n")); @@ -1131,6 +1222,8 @@ NTSTATUS cli_samr_lookup_names(struct cli_state *cli, TALLOC_CTX *mem_ctx, NTSTATUS result = NT_STATUS_UNSUCCESSFUL; uint32 i; + DEBUG(10,("cli_samr_lookup_names\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -1194,6 +1287,8 @@ NTSTATUS cli_samr_create_dom_user(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_CREATE_USER r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_create_dom_user %s\n", acct_name)); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -1247,6 +1342,8 @@ NTSTATUS cli_samr_set_userinfo(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_SET_USERINFO r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_set_userinfo\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -1297,6 +1394,8 @@ NTSTATUS cli_samr_set_userinfo2(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_SET_USERINFO2 r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_set_userinfo2\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -1343,6 +1442,8 @@ NTSTATUS cli_samr_delete_dom_user(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_DELETE_DOM_USER r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_delete_dom_user\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -1388,6 +1489,8 @@ NTSTATUS cli_samr_query_sec_obj(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_QUERY_SEC_OBJ r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_query_sec_obj\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -1433,6 +1536,8 @@ NTSTATUS cli_samr_get_dom_pwinfo(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_GET_DOM_PWINFO r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_get_dom_pwinfo\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); @@ -1485,6 +1590,8 @@ NTSTATUS cli_samr_lookup_domain(struct cli_state *cli, TALLOC_CTX *mem_ctx, SAMR_R_LOOKUP_DOMAIN r; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DEBUG(10,("cli_samr_lookup_domain\n")); + ZERO_STRUCT(q); ZERO_STRUCT(r); diff --git a/source3/rpc_client/cli_spoolss.c b/source3/rpc_client/cli_spoolss.c index bb6ce1b998..6392620497 100644 --- a/source3/rpc_client/cli_spoolss.c +++ b/source3/rpc_client/cli_spoolss.c @@ -511,8 +511,8 @@ WERROR cli_spoolss_enum_ports(struct cli_state *cli, TALLOC_CTX *mem_ctx, ZERO_STRUCT(q); ZERO_STRUCT(r); - slprintf (server, sizeof(fstring)-1, "\\\\%s", cli->desthost); - strupper (server); + slprintf(server, sizeof(fstring)-1, "\\\\%s", cli->desthost); + strupper_m(server); /* Initialise input parameters */ @@ -732,8 +732,8 @@ WERROR cli_spoolss_getprinterdriver(struct cli_state *cli, ZERO_STRUCT(q); ZERO_STRUCT(r); - fstrcpy (server, cli->desthost); - strupper (server); + fstrcpy(server, cli->desthost); + strupper_m(server); /* Initialise input parameters */ @@ -813,8 +813,8 @@ WERROR cli_spoolss_enumprinterdrivers (struct cli_state *cli, ZERO_STRUCT(q); ZERO_STRUCT(r); - slprintf (server, sizeof(fstring)-1, "\\\\%s", cli->desthost); - strupper (server); + slprintf(server, sizeof(fstring)-1, "\\\\%s", cli->desthost); + strupper_m(server); /* Initialise input parameters */ @@ -899,8 +899,8 @@ WERROR cli_spoolss_getprinterdriverdir (struct cli_state *cli, ZERO_STRUCT(q); ZERO_STRUCT(r); - slprintf (server, sizeof(fstring)-1, "\\\\%s", cli->desthost); - strupper (server); + slprintf(server, sizeof(fstring)-1, "\\\\%s", cli->desthost); + strupper_m(server); /* Initialise input parameters */ @@ -967,8 +967,8 @@ WERROR cli_spoolss_addprinterdriver (struct cli_state *cli, ZERO_STRUCT(q); ZERO_STRUCT(r); - slprintf (server, sizeof(fstring)-1, "\\\\%s", cli->desthost); - strupper (server); + slprintf(server, sizeof(fstring)-1, "\\\\%s", cli->desthost); + strupper_m(server); /* Initialise input parameters */ @@ -1021,10 +1021,10 @@ WERROR cli_spoolss_addprinterex (struct cli_state *cli, TALLOC_CTX *mem_ctx, ZERO_STRUCT(q); ZERO_STRUCT(r); - slprintf (client, sizeof(fstring)-1, "\\\\%s", cli->desthost); - strupper (client); - slprintf (server, sizeof(fstring)-1, "\\\\%s", cli->desthost); - strupper (server); + slprintf(client, sizeof(fstring)-1, "\\\\%s", cli->desthost); + strupper_m(client); + slprintf(server, sizeof(fstring)-1, "\\\\%s", cli->desthost); + strupper_m(server); fstrcpy (user, cli->user_name); /* Initialise input parameters */ @@ -1084,8 +1084,8 @@ WERROR cli_spoolss_deleteprinterdriver (struct cli_state *cli, prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL); prs_init(&rbuf, 0, mem_ctx, UNMARSHALL); - slprintf (server, sizeof(fstring)-1, "\\\\%s", cli->desthost); - strupper (server); + slprintf(server, sizeof(fstring)-1, "\\\\%s", cli->desthost); + strupper_m(server); /* Write the request */ diff --git a/source3/rpc_parse/parse_misc.c b/source3/rpc_parse/parse_misc.c index a39e3391bb..17a96fff80 100644 --- a/source3/rpc_parse/parse_misc.c +++ b/source3/rpc_parse/parse_misc.c @@ -1122,78 +1122,6 @@ BOOL smb_io_unistr2_array(const char *desc, UNISTR2_ARRAY *array, prs_struct *ps } -/* - initialise a SID_ARRAY from a list of sids -*/ -BOOL init_sid_array(SID_ARRAY *array, - uint32 count, DOM_SID *sids) -{ - unsigned int i; - - array->count = count; - array->ref_id = count?1:0; - if (array->count == 0) { - return True; - } - - array->sids = (SID_ARRAY_EL *)talloc_zero(get_talloc_ctx(), count * sizeof(SID_ARRAY_EL)); - if (!array->sids) { - return False; - } - - for (i=0;isids[i].ref_id = 1; - init_dom_sid2(&array->sids[i].sid, &sids[i]); - } - - return True; -} - - -/******************************************************************* - Reads or writes a SID_ARRAY structure. -********************************************************************/ -BOOL smb_io_sid_array(const char *desc, SID_ARRAY *array, prs_struct *ps, int depth) -{ - unsigned int i; - - prs_debug(ps, depth, desc, "smb_io_sid_array"); - depth++; - - if(!prs_uint32("ref_id", ps, depth, &array->ref_id)) - return False; - - if (! array->ref_id) { - return True; - } - - if(!prs_uint32("count", ps, depth, &array->count)) - return False; - - if (array->count == 0) { - return True; - } - - if (UNMARSHALLING(ps)) { - array->sids = talloc_zero(get_talloc_ctx(), array->count * sizeof(array->sids[0])); - } - if (! array->sids) { - return False; - } - - for (i=0;icount;i++) { - if(!prs_uint32("ref_id", ps, depth, &array->sids[i].ref_id)) - return False; - } - - for (i=0;icount;i++) { - if (!smb_io_dom_sid2("sid", &array->sids[i].sid, ps, depth)) - return False; - } - - return True; -} - /******************************************************************* Inits a DOM_RID2 structure. ********************************************************************/ @@ -1289,22 +1217,22 @@ void init_dom_rid4(DOM_RID4 *rid4, uint16 unknown, uint16 attr, uint32 rid) Inits a DOM_CLNT_SRV structure. ********************************************************************/ -static void init_clnt_srv(DOM_CLNT_SRV *dlog, const char *logon_srv, const char *comp_name) +static void init_clnt_srv(DOM_CLNT_SRV *logcln, const char *logon_srv, const char *comp_name) { DEBUG(5,("init_clnt_srv: %d\n", __LINE__)); if (logon_srv != NULL) { - dlog->undoc_buffer = 1; - init_unistr2(&dlog->uni_logon_srv, logon_srv, strlen(logon_srv)+1); + logcln->undoc_buffer = 1; + init_unistr2(&logcln->uni_logon_srv, logon_srv, strlen(logon_srv)+1); } else { - dlog->undoc_buffer = 0; + logcln->undoc_buffer = 0; } if (comp_name != NULL) { - dlog->undoc_buffer2 = 1; - init_unistr2(&dlog->uni_comp_name, comp_name, strlen(comp_name)+1); + logcln->undoc_buffer2 = 1; + init_unistr2(&logcln->uni_comp_name, comp_name, strlen(comp_name)+1); } else { - dlog->undoc_buffer2 = 0; + logcln->undoc_buffer2 = 0; } } @@ -1312,9 +1240,9 @@ static void init_clnt_srv(DOM_CLNT_SRV *dlog, const char *logon_srv, const char Inits or writes a DOM_CLNT_SRV structure. ********************************************************************/ -static BOOL smb_io_clnt_srv(const char *desc, DOM_CLNT_SRV *dlog, prs_struct *ps, int depth) +static BOOL smb_io_clnt_srv(const char *desc, DOM_CLNT_SRV *logcln, prs_struct *ps, int depth) { - if (dlog == NULL) + if (logcln == NULL) return False; prs_debug(ps, depth, desc, "smb_io_clnt_srv"); @@ -1323,22 +1251,22 @@ static BOOL smb_io_clnt_srv(const char *desc, DOM_CLNT_SRV *dlog, prs_struct *ps if(!prs_align(ps)) return False; - if(!prs_uint32("undoc_buffer ", ps, depth, &dlog->undoc_buffer)) + if(!prs_uint32("undoc_buffer ", ps, depth, &logcln->undoc_buffer)) return False; - if (dlog->undoc_buffer != 0) { - if(!smb_io_unistr2("unistr2", &dlog->uni_logon_srv, dlog->undoc_buffer, ps, depth)) + if (logcln->undoc_buffer != 0) { + if(!smb_io_unistr2("unistr2", &logcln->uni_logon_srv, logcln->undoc_buffer, ps, depth)) return False; } if(!prs_align(ps)) return False; - if(!prs_uint32("undoc_buffer2", ps, depth, &dlog->undoc_buffer2)) + if(!prs_uint32("undoc_buffer2", ps, depth, &logcln->undoc_buffer2)) return False; - if (dlog->undoc_buffer2 != 0) { - if(!smb_io_unistr2("unistr2", &dlog->uni_comp_name, dlog->undoc_buffer2, ps, depth)) + if (logcln->undoc_buffer2 != 0) { + if(!smb_io_unistr2("unistr2", &logcln->uni_comp_name, logcln->undoc_buffer2, ps, depth)) return False; } @@ -1349,28 +1277,28 @@ static BOOL smb_io_clnt_srv(const char *desc, DOM_CLNT_SRV *dlog, prs_struct *ps Inits a DOM_LOG_INFO structure. ********************************************************************/ -void init_log_info(DOM_LOG_INFO *dlog, const char *logon_srv, const char *acct_name, +void init_log_info(DOM_LOG_INFO *loginfo, const char *logon_srv, const char *acct_name, uint16 sec_chan, const char *comp_name) { DEBUG(5,("make_log_info %d\n", __LINE__)); - dlog->undoc_buffer = 1; + loginfo->undoc_buffer = 1; - init_unistr2(&dlog->uni_logon_srv, logon_srv, strlen(logon_srv)+1); - init_unistr2(&dlog->uni_acct_name, acct_name, strlen(acct_name)+1); + init_unistr2(&loginfo->uni_logon_srv, logon_srv, strlen(logon_srv)+1); + init_unistr2(&loginfo->uni_acct_name, acct_name, strlen(acct_name)+1); - dlog->sec_chan = sec_chan; + loginfo->sec_chan = sec_chan; - init_unistr2(&dlog->uni_comp_name, comp_name, strlen(comp_name)+1); + init_unistr2(&loginfo->uni_comp_name, comp_name, strlen(comp_name)+1); } /******************************************************************* Reads or writes a DOM_LOG_INFO structure. ********************************************************************/ -BOOL smb_io_log_info(const char *desc, DOM_LOG_INFO *dlog, prs_struct *ps, int depth) +BOOL smb_io_log_info(const char *desc, DOM_LOG_INFO *loginfo, prs_struct *ps, int depth) { - if (dlog == NULL) + if (loginfo == NULL) return False; prs_debug(ps, depth, desc, "smb_io_log_info"); @@ -1379,18 +1307,18 @@ BOOL smb_io_log_info(const char *desc, DOM_LOG_INFO *dlog, prs_struct *ps, int d if(!prs_align(ps)) return False; - if(!prs_uint32("undoc_buffer", ps, depth, &dlog->undoc_buffer)) + if(!prs_uint32("undoc_buffer", ps, depth, &loginfo->undoc_buffer)) return False; - if(!smb_io_unistr2("unistr2", &dlog->uni_logon_srv, True, ps, depth)) + if(!smb_io_unistr2("unistr2", &loginfo->uni_logon_srv, True, ps, depth)) return False; - if(!smb_io_unistr2("unistr2", &dlog->uni_acct_name, True, ps, depth)) + if(!smb_io_unistr2("unistr2", &loginfo->uni_acct_name, True, ps, depth)) return False; - if(!prs_uint16("sec_chan", ps, depth, &dlog->sec_chan)) + if(!prs_uint16("sec_chan", ps, depth, &loginfo->sec_chan)) return False; - if(!smb_io_unistr2("unistr2", &dlog->uni_comp_name, True, ps, depth)) + if(!smb_io_unistr2("unistr2", &loginfo->uni_comp_name, True, ps, depth)) return False; return True; @@ -1529,21 +1457,21 @@ BOOL smb_io_clnt_info(const char *desc, DOM_CLNT_INFO *clnt, prs_struct *ps, in Inits a DOM_LOGON_ID structure. ********************************************************************/ -void init_logon_id(DOM_LOGON_ID *dlog, uint32 log_id_low, uint32 log_id_high) +void init_logon_id(DOM_LOGON_ID *logonid, uint32 log_id_low, uint32 log_id_high) { DEBUG(5,("make_logon_id: %d\n", __LINE__)); - dlog->low = log_id_low; - dlog->high = log_id_high; + logonid->low = log_id_low; + logonid->high = log_id_high; } /******************************************************************* Reads or writes a DOM_LOGON_ID structure. ********************************************************************/ -BOOL smb_io_logon_id(const char *desc, DOM_LOGON_ID *dlog, prs_struct *ps, int depth) +BOOL smb_io_logon_id(const char *desc, DOM_LOGON_ID *logonid, prs_struct *ps, int depth) { - if (dlog == NULL) + if (logonid == NULL) return False; prs_debug(ps, depth, desc, "smb_io_logon_id"); @@ -1552,9 +1480,9 @@ BOOL smb_io_logon_id(const char *desc, DOM_LOGON_ID *dlog, prs_struct *ps, int d if(!prs_align(ps)) return False; - if(!prs_uint32("low ", ps, depth, &dlog->low )) + if(!prs_uint32("low ", ps, depth, &logonid->low )) return False; - if(!prs_uint32("high", ps, depth, &dlog->high)) + if(!prs_uint32("high", ps, depth, &logonid->high)) return False; return True; diff --git a/source3/rpc_parse/parse_net.c b/source3/rpc_parse/parse_net.c index 1a14915c9f..804da707de 100644 --- a/source3/rpc_parse/parse_net.c +++ b/source3/rpc_parse/parse_net.c @@ -446,7 +446,7 @@ void init_r_trust_dom(NET_R_TRUST_DOM_LIST *r_t, for (i = 0; i < num_doms; i++) { fstring domain_name; fstrcpy(domain_name, dom_name); - strupper(domain_name); + strupper_m(domain_name); init_unistr2(&r_t->uni_trust_dom_name[i], domain_name, strlen(domain_name)+1); /* the use of UNISTR2 here is non-standard. */ r_t->uni_trust_dom_name[i].undoc = 0x1; @@ -1294,7 +1294,7 @@ void init_net_user_info3(TALLOC_CTX *ctx, NET_USER_INFO_3 *usr, int len_logon_srv = strlen(logon_srv); int len_logon_dom = strlen(logon_dom); - len_user_name = strlen(user_name ); + len_user_name = strlen(user_name ); len_full_name = strlen(full_name ); len_home_dir = strlen(home_dir ); len_dir_drive = strlen(dir_drive ); @@ -1306,6 +1306,7 @@ void init_net_user_info3(TALLOC_CTX *ctx, NET_USER_INFO_3 *usr, usr->ptr_user_info = 1; /* yes, we're bothering to put USER_INFO data here */ + /* Create NTTIME structs */ unix_to_nt_time (&logon_time, unix_logon_time); @@ -1808,9 +1809,9 @@ static BOOL net_io_sam_domain_info(const char *desc, SAM_DOMAIN_INFO * info, if (!smb_io_unihdr("hdr_unknown", &info->hdr_unknown, ps, depth)) return False; - if (prs_offset(ps) + 40 > prs_data_size(ps)) + if (ps->data_offset + 40 > ps->buffer_size) return False; - prs_set_offset(ps, prs_offset(ps) + 40); + ps->data_offset += 40; if (!smb_io_unistr2("uni_dom_name", &info->uni_dom_name, info->hdr_dom_name.buffer, ps, depth)) @@ -1847,9 +1848,9 @@ static BOOL net_io_sam_group_info(const char *desc, SAM_GROUP_INFO * info, if (!smb_io_bufhdr2("hdr_sec_desc", &info->hdr_sec_desc, ps, depth)) return False; - if (prs_offset(ps) + 48 > prs_data_size(ps)) + if (ps->data_offset + 48 > ps->buffer_size) return False; - prs_set_offset(ps, prs_offset(ps) + 48); + ps->data_offset += 48; if (!smb_io_unistr2("uni_grp_name", &info->uni_grp_name, info->hdr_grp_name.buffer, ps, depth)) @@ -2128,13 +2129,13 @@ static BOOL net_io_sam_account_info(const char *desc, uint8 sess_key[16], uint32 len = 0x44; if (!prs_uint32("pwd_len", ps, depth, &len)) return False; - old_offset = prs_offset(ps); + old_offset = ps->data_offset; if (len > 0) { if (ps->io) { /* reading */ - if (!prs_hash1(ps, prs_offset(ps), sess_key)) + if (!prs_hash1(ps, ps->data_offset, sess_key, len)) return False; } if (!net_io_sam_passwd_info("pass", &info->pass, @@ -2144,13 +2145,13 @@ static BOOL net_io_sam_account_info(const char *desc, uint8 sess_key[16], if (!ps->io) { /* writing */ - if (!prs_hash1(ps, old_offset, sess_key)) + if (!prs_hash1(ps, old_offset, sess_key, len)) return False; } } - if (old_offset + len > prs_data_size(ps)) + if (old_offset + len > ps->buffer_size) return False; - prs_set_offset(ps, old_offset + len); + ps->data_offset = old_offset + len; } if (!smb_io_buffer4("buf_sec_desc", &info->buf_sec_desc, info->hdr_sec_desc.buffer, ps, depth)) @@ -2185,9 +2186,9 @@ static BOOL net_io_sam_group_mem_info(const char *desc, SAM_GROUP_MEM_INFO * inf if (!prs_uint32("num_members", ps, depth, &info->num_members)) return False; - if (prs_offset(ps) + 16 > prs_data_size(ps)) + if (ps->data_offset + 16 > ps->buffer_size) return False; - prs_set_offset(ps, prs_offset(ps) + 16); + ps->data_offset += 16; if (info->ptr_rids != 0) { @@ -2267,9 +2268,9 @@ static BOOL net_io_sam_alias_info(const char *desc, SAM_ALIAS_INFO * info, if (!smb_io_unihdr("hdr_als_desc", &info->hdr_als_desc, ps, depth)) return False; - if (prs_offset(ps) + 40 > prs_data_size(ps)) + if (ps->data_offset + 40 > ps->buffer_size) return False; - prs_set_offset(ps, prs_offset(ps) + 40); + ps->data_offset += 40; if (!smb_io_unistr2("uni_als_name", &info->uni_als_name, info->hdr_als_name.buffer, ps, depth)) @@ -2307,9 +2308,9 @@ static BOOL net_io_sam_alias_mem_info(const char *desc, SAM_ALIAS_MEM_INFO * inf if (info->ptr_members != 0) { - if (prs_offset(ps) + 16 > prs_data_size(ps)) + if (ps->data_offset + 16 > ps->buffer_size) return False; - prs_set_offset(ps, prs_offset(ps) + 16); + ps->data_offset += 16; if (!prs_uint32("num_sids", ps, depth, &info->num_sids)) return False; diff --git a/source3/rpc_parse/parse_prs.c b/source3/rpc_parse/parse_prs.c index e0a75d7382..efd4914c66 100644 --- a/source3/rpc_parse/parse_prs.c +++ b/source3/rpc_parse/parse_prs.c @@ -1316,7 +1316,7 @@ int tdb_prs_fetch(TDB_CONTEXT *tdb, char *keystr, prs_struct *ps, TALLOC_CTX *me /******************************************************************* hash a stream. ********************************************************************/ -BOOL prs_hash1(prs_struct *ps, uint32 offset, uint8 sess_key[16]) +BOOL prs_hash1(prs_struct *ps, uint32 offset, uint8 sess_key[16], int len) { char *q; @@ -1326,12 +1326,12 @@ BOOL prs_hash1(prs_struct *ps, uint32 offset, uint8 sess_key[16]) #ifdef DEBUG_PASSWORD DEBUG(100, ("prs_hash1\n")); dump_data(100, sess_key, 16); - dump_data(100, q, 68); + dump_data(100, q, len); #endif - SamOEMhash((uchar *) q, sess_key, 68); + SamOEMhash((uchar *) q, sess_key, len); #ifdef DEBUG_PASSWORD - dump_data(100, q, 68); + dump_data(100, q, len); #endif return True; @@ -1378,141 +1378,221 @@ static void netsechash(uchar * key, uchar * data, int data_len) } } -void dump_data_pw(const char *msg, const uchar * data, size_t len) + +/******************************************************************* + Create a digest over the entire packet (including the data), and + MD5 it with the session key. + ********************************************************************/ +static void netsec_digest(struct netsec_auth_struct *a, + int auth_flags, + RPC_AUTH_NETSEC_CHK * verf, + char *data, size_t data_len, + uchar digest_final[16]) { -#ifdef DEBUG_PASSWORD - DEBUG(11, ("%s", msg)); - if (data != NULL && len > 0) - { - dump_data(11, data, len); + uchar whole_packet_digest[16]; + static uchar zeros[4]; + struct MD5Context ctx3; + + /* verfiy the signature on the packet by MD5 over various bits */ + MD5Init(&ctx3); + /* use our sequence number, which ensures the packet is not + out of order */ + MD5Update(&ctx3, zeros, sizeof(zeros)); + MD5Update(&ctx3, verf->sig, sizeof(verf->sig)); + if (auth_flags & AUTH_PIPE_SEAL) { + MD5Update(&ctx3, verf->data8, sizeof(verf->data8)); } -#endif + MD5Update(&ctx3, data, data_len); + MD5Final(whole_packet_digest, &ctx3); + dump_data_pw("whole_packet_digest:\n", whole_packet_digest, sizeof(whole_packet_digest)); + + /* MD5 this result and the session key, to prove that + only a valid client could had produced this */ + hmac_md5(a->sess_key, whole_packet_digest, sizeof(whole_packet_digest), digest_final); } -void netsec_encode(struct netsec_auth_struct *a, - RPC_AUTH_NETSEC_CHK * verf, char *data, size_t data_len) +/******************************************************************* + Calculate the key with which to encode the data payload + ********************************************************************/ +static void netsec_get_sealing_key(struct netsec_auth_struct *a, + RPC_AUTH_NETSEC_CHK *verf, + uchar sealing_key[16]) { - uchar dataN[4]; - uchar digest1[16]; - struct MD5Context ctx3; + static uchar zeros[4]; + uchar digest2[16]; uchar sess_kf0[16]; int i; - SIVAL(dataN, 0, 0); - for (i = 0; i < sizeof(sess_kf0); i++) { sess_kf0[i] = a->sess_key[i] ^ 0xf0; } + + dump_data_pw("sess_kf0:\n", sess_kf0, sizeof(sess_kf0)); + + /* MD5 of sess_kf0 and the high bytes of the sequence number */ + hmac_md5(sess_kf0, zeros, 0x4, digest2); + dump_data_pw("digest2:\n", digest2, sizeof(digest2)); + + /* MD5 of the above result, plus 8 bytes of sequence number */ + hmac_md5(digest2, verf->seq_num, sizeof(verf->seq_num), sealing_key); + dump_data_pw("sealing_key:\n", sealing_key, 16); +} - DEBUG(10,("SCHANNEL: netsec_encode seq_num=%d data_len=%d\n", a->seq_num, data_len)); - dump_data_pw("a->sess_key:\n", a->sess_key, sizeof(a->sess_key)); - dump_data_pw("a->seq_num :\n", dataN, sizeof(dataN)); +/******************************************************************* + Encode or Decode the sequence number (which is symmetric) + ********************************************************************/ +static void netsec_deal_with_seq_num(struct netsec_auth_struct *a, + RPC_AUTH_NETSEC_CHK *verf) +{ + static uchar zeros[4]; + uchar sequence_key[16]; + uchar digest1[16]; - MD5Init(&ctx3); - MD5Update(&ctx3, dataN, 0x4); - MD5Update(&ctx3, verf->sig, 8); + hmac_md5(a->sess_key, zeros, sizeof(zeros), digest1); + dump_data_pw("(sequence key) digest1:\n", digest1, sizeof(digest1)); - MD5Update(&ctx3, verf->data8, 8); + hmac_md5(digest1, verf->packet_digest, 8, sequence_key); - dump_data_pw("verf->data8:\n", verf->data8, sizeof(verf->data8)); - dump_data_pw("sess_kf0:\n", sess_kf0, sizeof(sess_kf0)); + dump_data_pw("sequence_key:\n", sequence_key, sizeof(sequence_key)); - hmac_md5(sess_kf0, dataN, 0x4, digest1); - dump_data_pw("digest1 (ebp-8):\n", digest1, sizeof(digest1)); - hmac_md5(digest1, verf->data3, 8, digest1); - dump_data_pw("netsechashkey:\n", digest1, sizeof(digest1)); - netsechash(digest1, verf->data8, 8); + dump_data_pw("seq_num (before):\n", verf->seq_num, sizeof(verf->seq_num)); + netsechash(sequence_key, verf->seq_num, 8); + dump_data_pw("seq_num (after):\n", verf->seq_num, sizeof(verf->seq_num)); +} - dump_data_pw("verf->data8:\n", verf->data8, sizeof(verf->data8)); - dump_data_pw("data :\n", data, data_len); - MD5Update(&ctx3, data, data_len); +/******************************************************************* + Encode a blob of data using the netsec (schannel) alogrithm, also produceing + a checksum over the original data. We currently only support + signing and sealing togeather - the signing-only code is close, but not + quite compatible with what MS does. + ********************************************************************/ +void netsec_encode(struct netsec_auth_struct *a, int auth_flags, + enum netsec_direction direction, + RPC_AUTH_NETSEC_CHK * verf, char *data, size_t data_len) +{ + uchar digest_final[16]; - { - char digest_tmp[16]; - char digest2[16]; - MD5Final(digest_tmp, &ctx3); - hmac_md5(a->sess_key, digest_tmp, 16, digest2); - dump_data_pw("digest_tmp:\n", digest_tmp, sizeof(digest_tmp)); - dump_data_pw("digest:\n", digest2, sizeof(digest2)); - memcpy(verf->data1, digest2, sizeof(verf->data1)); + DEBUG(10,("SCHANNEL: netsec_encode seq_num=%d data_len=%d\n", a->seq_num, data_len)); + dump_data_pw("a->sess_key:\n", a->sess_key, sizeof(a->sess_key)); + + RSIVAL(verf->seq_num, 0, a->seq_num); + + switch (direction) { + case SENDER_IS_INITIATOR: + SIVAL(verf->seq_num, 4, 0x80); + break; + case SENDER_IS_ACCEPTOR: + SIVAL(verf->seq_num, 4, 0x0); + break; } - netsechash(digest1, data, data_len); - dump_data_pw("data:\n", data, data_len); + dump_data_pw("verf->seq_num:\n", verf->seq_num, sizeof(verf->seq_num)); - hmac_md5(a->sess_key, dataN, 0x4, digest1); - dump_data_pw("ctx:\n", digest1, sizeof(digest1)); + /* produce a digest of the packet to prove it's legit (before we seal it) */ + netsec_digest(a, auth_flags, verf, data, data_len, digest_final); + memcpy(verf->packet_digest, digest_final, sizeof(verf->packet_digest)); - hmac_md5(digest1, verf->data1, 8, digest1); + if (auth_flags & AUTH_PIPE_SEAL) { + uchar sealing_key[16]; - dump_data_pw("netsechashkey:\n", digest1, sizeof(digest1)); + /* get the key to encode the data with */ + netsec_get_sealing_key(a, verf, sealing_key); - dump_data_pw("verf->data3:\n", verf->data3, sizeof(verf->data3)); - netsechash(digest1, verf->data3, 8); - dump_data_pw("verf->data3:\n", verf->data3, sizeof(verf->data3)); + /* encode the verification data */ + dump_data_pw("verf->data8:\n", verf->data8, sizeof(verf->data8)); + netsechash(sealing_key, verf->data8, 8); + + dump_data_pw("verf->data8_enc:\n", verf->data8, sizeof(verf->data8)); + + /* encode the packet payload */ + dump_data_pw("data:\n", data, data_len); + netsechash(sealing_key, data, data_len); + dump_data_pw("data_enc:\n", data, data_len); + } + + /* encode the sequence number (key based on packet digest) */ + /* needs to be done after the sealing, as the original version + is used in the sealing stuff... */ + netsec_deal_with_seq_num(a, verf); return; } -BOOL netsec_decode(struct netsec_auth_struct *a, +/******************************************************************* + Decode a blob of data using the netsec (schannel) alogrithm, also verifiying + a checksum over the original data. We currently can verify signed messages, + as well as decode sealed messages + ********************************************************************/ + +BOOL netsec_decode(struct netsec_auth_struct *a, int auth_flags, + enum netsec_direction direction, RPC_AUTH_NETSEC_CHK * verf, char *data, size_t data_len) { - uchar dataN[4]; - uchar digest1[16]; - struct MD5Context ctx3; - uchar sess_kf0[16]; - int i; - - SIVAL(dataN, 0, 0); - - for (i = 0; i < sizeof(sess_kf0); i++) { - sess_kf0[i] = a->sess_key[i] ^ 0xf0; + uchar digest_final[16]; + + /* Create the expected sequence number for comparison */ + uchar seq_num[8]; + RSIVAL(seq_num, 0, a->seq_num); + + switch (direction) { + case SENDER_IS_INITIATOR: + SIVAL(seq_num, 4, 0x80); + break; + case SENDER_IS_ACCEPTOR: + SIVAL(seq_num, 4, 0x0); + break; } DEBUG(10,("SCHANNEL: netsec_decode seq_num=%d data_len=%d\n", a->seq_num, data_len)); dump_data_pw("a->sess_key:\n", a->sess_key, sizeof(a->sess_key)); - dump_data_pw("a->seq_num :\n", dataN, sizeof(dataN)); - hmac_md5(a->sess_key, dataN, 0x4, digest1); - dump_data_pw("ctx:\n", digest1, sizeof(digest1)); - - hmac_md5(digest1, verf->data1, 8, digest1); - - dump_data_pw("netsechashkey:\n", digest1, sizeof(digest1)); - dump_data_pw("verf->data3:\n", verf->data3, sizeof(verf->data3)); - netsechash(digest1, verf->data3, 8); - dump_data_pw("verf->data3_dec:\n", verf->data3, sizeof(verf->data3)); - - MD5Init(&ctx3); - MD5Update(&ctx3, dataN, 0x4); - MD5Update(&ctx3, verf->sig, 8); - - dump_data_pw("sess_kf0:\n", sess_kf0, sizeof(sess_kf0)); - hmac_md5(sess_kf0, dataN, 0x4, digest1); - dump_data_pw("digest1 (ebp-8):\n", digest1, sizeof(digest1)); - hmac_md5(digest1, verf->data3, 8, digest1); - dump_data_pw("netsechashkey:\n", digest1, sizeof(digest1)); + dump_data_pw("seq_num:\n", seq_num, sizeof(seq_num)); - dump_data_pw("verf->data8:\n", verf->data8, sizeof(verf->data8)); - netsechash(digest1, verf->data8, 8); - dump_data_pw("verf->data8_dec:\n", verf->data8, sizeof(verf->data8)); - MD5Update(&ctx3, verf->data8, 8); + /* extract the sequence number (key based on supplied packet digest) */ + /* needs to be done before the sealing, as the original version + is used in the sealing stuff... */ + netsec_deal_with_seq_num(a, verf); - dump_data_pw("data :\n", data, data_len); - netsechash(digest1, data, data_len); - dump_data_pw("datadec:\n", data, data_len); + if (memcmp(verf->seq_num, seq_num, sizeof(seq_num))) { + /* don't even bother with the below if the sequence number is out */ + /* The sequence number is MD5'ed with a key based on the whole-packet + digest, as supplied by the client. We check that it's a valid + checksum after the decode, below + */ + return False; + } - MD5Update(&ctx3, data, data_len); - { - uchar digest_tmp[16]; - MD5Final(digest_tmp, &ctx3); - hmac_md5(a->sess_key, digest_tmp, 16, digest1); - dump_data_pw("digest_tmp:\n", digest_tmp, sizeof(digest_tmp)); + if (auth_flags & AUTH_PIPE_SEAL) { + uchar sealing_key[16]; + + /* get the key to extract the data with */ + netsec_get_sealing_key(a, verf, sealing_key); + + /* extract the verification data */ + dump_data_pw("verf->data8:\n", verf->data8, + sizeof(verf->data8)); + netsechash(sealing_key, verf->data8, 8); + + dump_data_pw("verf->data8_dec:\n", verf->data8, + sizeof(verf->data8)); + + /* extract the packet payload */ + dump_data_pw("data :\n", data, data_len); + netsechash(sealing_key, data, data_len); + dump_data_pw("datadec:\n", data, data_len); } - dump_data_pw("digest:\n", digest1, sizeof(digest1)); - dump_data_pw("verf->data1:\n", verf->data1, sizeof(verf->data1)); + /* digest includes 'data' after unsealing */ + netsec_digest(a, auth_flags, verf, data, data_len, digest_final); - return memcmp(digest1, verf->data1, sizeof(verf->data1)) == 0; + dump_data_pw("Calculated digest:\n", digest_final, + sizeof(digest_final)); + dump_data_pw("verf->packet_digest:\n", verf->packet_digest, + sizeof(verf->packet_digest)); + + /* compare - if the client got the same result as us, then + it must know the session key */ + return (memcmp(digest_final, verf->packet_digest, + sizeof(verf->packet_digest)) == 0); } diff --git a/source3/rpc_parse/parse_rpc.c b/source3/rpc_parse/parse_rpc.c index be3a04e31c..34ba62caa9 100644 --- a/source3/rpc_parse/parse_rpc.c +++ b/source3/rpc_parse/parse_rpc.c @@ -602,15 +602,6 @@ BOOL smb_io_rpc_hdr_autha(const char *desc, RPC_HDR_AUTHA *rai, prs_struct *ps, return True; } -/******************************************************************* - Checks an RPC_HDR_AUTH structure. -********************************************************************/ - -BOOL rpc_hdr_auth_chk(RPC_HDR_AUTH *rai) -{ - return (rai->auth_type == NTLMSSP_AUTH_TYPE && rai->auth_level == NTLMSSP_AUTH_LEVEL); -} - /******************************************************************* Inits an RPC_HDR_AUTH structure. ********************************************************************/ @@ -1088,9 +1079,10 @@ BOOL rpc_auth_ntlmssp_chk(RPC_AUTH_NTLMSSP_CHK *chk, uint32 crc32, uint32 seq_nu chk->seq_num != seq_num) { DEBUG(5,("verify failed - crc %x ver %x seq %d\n", - crc32, NTLMSSP_SIGN_VERSION, seq_num)); + chk->crc32, chk->ver, chk->seq_num)); + DEBUG(5,("verify expect - crc %x ver %x seq %d\n", - chk->crc32, chk->ver, chk->seq_num)); + crc32, NTLMSSP_SIGN_VERSION, seq_num)); return False; } return True; @@ -1182,15 +1174,15 @@ creates an RPC_AUTH_NETSEC_CHK structure. ********************************************************************/ BOOL init_rpc_auth_netsec_chk(RPC_AUTH_NETSEC_CHK * chk, const uchar sig[8], - const uchar data1[8], - const uchar data3[8], const uchar data8[8]) + const uchar packet_digest[8], + const uchar seq_num[8], const uchar data8[8]) { if (chk == NULL) return False; memcpy(chk->sig, sig, sizeof(chk->sig)); - memcpy(chk->data1, data1, sizeof(chk->data1)); - memcpy(chk->data3, data3, sizeof(chk->data3)); + memcpy(chk->packet_digest, packet_digest, sizeof(chk->packet_digest)); + memcpy(chk->seq_num, seq_num, sizeof(chk->seq_num)); memcpy(chk->data8, data8, sizeof(chk->data8)); return True; @@ -1209,8 +1201,8 @@ BOOL smb_io_rpc_auth_netsec_chk(const char *desc, RPC_AUTH_NETSEC_CHK * chk, depth++; prs_uint8s(False, "sig ", ps, depth, chk->sig, sizeof(chk->sig)); - prs_uint8s(False, "data3", ps, depth, chk->data3, sizeof(chk->data3)); - prs_uint8s(False, "data1", ps, depth, chk->data1, sizeof(chk->data1)); + prs_uint8s(False, "seq_num", ps, depth, chk->seq_num, sizeof(chk->seq_num)); + prs_uint8s(False, "packet_digest", ps, depth, chk->packet_digest, sizeof(chk->packet_digest)); prs_uint8s(False, "data8", ps, depth, chk->data8, sizeof(chk->data8)); return True; diff --git a/source3/rpc_parse/parse_samr.c b/source3/rpc_parse/parse_samr.c index ac1e9da61b..45c81deb89 100644 --- a/source3/rpc_parse/parse_samr.c +++ b/source3/rpc_parse/parse_samr.c @@ -1500,7 +1500,7 @@ inits a SAM_DISPINFO_1 structure. ********************************************************************/ NTSTATUS init_sam_dispinfo_1(TALLOC_CTX *ctx, SAM_DISPINFO_1 *sam, uint32 num_entries, - uint32 start_idx, DISP_USER_INFO *disp_user_info, + uint32 start_idx, SAM_ACCOUNT *disp_user_info, DOM_SID *domain_sid) { uint32 len_sam_name, len_sam_full, len_sam_desc; @@ -1535,7 +1535,7 @@ NTSTATUS init_sam_dispinfo_1(TALLOC_CTX *ctx, SAM_DISPINFO_1 *sam, uint32 num_en DEBUG(11, ("init_sam_dispinfo_1: entry: %d\n",i)); - pwd=disp_user_info[i+start_idx].sam; + pwd=&disp_user_info[i+start_idx]; username = pdb_get_username(pwd); fullname = pdb_get_fullname(pwd); @@ -1635,7 +1635,7 @@ inits a SAM_DISPINFO_2 structure. ********************************************************************/ NTSTATUS init_sam_dispinfo_2(TALLOC_CTX *ctx, SAM_DISPINFO_2 *sam, uint32 num_entries, - uint32 start_idx, DISP_USER_INFO *disp_user_info, + uint32 start_idx, SAM_ACCOUNT *disp_user_info, DOM_SID *domain_sid ) { uint32 len_sam_name, len_sam_desc; @@ -1666,7 +1666,7 @@ NTSTATUS init_sam_dispinfo_2(TALLOC_CTX *ctx, SAM_DISPINFO_2 *sam, uint32 num_en fstring user_sid_string, domain_sid_string; DEBUG(11, ("init_sam_dispinfo_2: entry: %d\n",i)); - pwd=disp_user_info[i+start_idx].sam; + pwd=&disp_user_info[i+start_idx]; username = pdb_get_username(pwd); acct_desc = pdb_get_acct_desc(pwd); @@ -1754,7 +1754,7 @@ inits a SAM_DISPINFO_3 structure. ********************************************************************/ NTSTATUS init_sam_dispinfo_3(TALLOC_CTX *ctx, SAM_DISPINFO_3 *sam, uint32 num_entries, - uint32 start_idx, DISP_GROUP_INFO *disp_group_info) + uint32 start_idx, DOMAIN_GRP *disp_group_info) { uint32 len_sam_name, len_sam_desc; uint32 i; @@ -1776,7 +1776,7 @@ NTSTATUS init_sam_dispinfo_3(TALLOC_CTX *ctx, SAM_DISPINFO_3 *sam, uint32 num_en ZERO_STRUCTP(sam->str); for (i = 0; i < num_entries; i++) { - DOMAIN_GRP *grp = disp_group_info[i+start_idx].grp; + DOMAIN_GRP *grp = &disp_group_info[i+start_idx]; DEBUG(11, ("init_sam_dispinfo_3: entry: %d\n",i)); @@ -1848,7 +1848,7 @@ inits a SAM_DISPINFO_4 structure. ********************************************************************/ NTSTATUS init_sam_dispinfo_4(TALLOC_CTX *ctx, SAM_DISPINFO_4 *sam, uint32 num_entries, - uint32 start_idx, DISP_USER_INFO *disp_user_info) + uint32 start_idx, SAM_ACCOUNT *disp_user_info) { uint32 len_sam_name; uint32 i; @@ -1872,7 +1872,7 @@ NTSTATUS init_sam_dispinfo_4(TALLOC_CTX *ctx, SAM_DISPINFO_4 *sam, uint32 num_en for (i = 0; i < num_entries; i++) { DEBUG(11, ("init_sam_dispinfo_2: entry: %d\n",i)); - pwd=disp_user_info[i+start_idx].sam; + pwd=&disp_user_info[i+start_idx]; len_sam_name = strlen(pdb_get_username(pwd)); @@ -1939,7 +1939,7 @@ inits a SAM_DISPINFO_5 structure. ********************************************************************/ NTSTATUS init_sam_dispinfo_5(TALLOC_CTX *ctx, SAM_DISPINFO_5 *sam, uint32 num_entries, - uint32 start_idx, DISP_GROUP_INFO *disp_group_info) + uint32 start_idx, DOMAIN_GRP *disp_group_info) { uint32 len_sam_name; uint32 i; @@ -1961,7 +1961,7 @@ NTSTATUS init_sam_dispinfo_5(TALLOC_CTX *ctx, SAM_DISPINFO_5 *sam, uint32 num_en ZERO_STRUCTP(sam->str); for (i = 0; i < num_entries; i++) { - DOMAIN_GRP *grp = disp_group_info[i+start_idx].grp; + DOMAIN_GRP *grp = &disp_group_info[i+start_idx]; DEBUG(11, ("init_sam_dispinfo_5: entry: %d\n",i)); @@ -4598,7 +4598,6 @@ BOOL samr_io_r_query_aliasmem(const char *desc, SAMR_R_QUERY_ALIASMEM * r_u, prs_struct *ps, int depth) { uint32 i; - uint32 ptr_sid[MAX_LOOKUP_SIDS]; if (r_u == NULL) return False; @@ -4614,28 +4613,31 @@ BOOL samr_io_r_query_aliasmem(const char *desc, SAMR_R_QUERY_ALIASMEM * r_u, if(!prs_uint32("ptr", ps, depth, &r_u->ptr)) return False; - if (r_u->ptr != 0) { - SMB_ASSERT_ARRAY(ptr_sid, r_u->num_sids); - - if (r_u->num_sids != 0) { - if(!prs_uint32("num_sids1", ps, depth, &r_u->num_sids1)) - return False; - - for (i = 0; i < r_u->num_sids1; i++) { - ptr_sid[i] = 1; - if(!prs_uint32("ptr_sid", ps, depth, &ptr_sid[i])) - return False; - } + if (r_u->ptr != 0 && r_u->num_sids != 0) { + uint32 *ptr_sid = NULL; - if (UNMARSHALLING(ps)) { - r_u->sid = talloc(ps->mem_ctx, r_u->num_sids1 * sizeof(DOM_SID2)); - } + if(!prs_uint32("num_sids1", ps, depth, &r_u->num_sids1)) + return False; - for (i = 0; i < r_u->num_sids1; i++) { - if (ptr_sid[i] != 0) { - if(!smb_io_dom_sid2("sid", &r_u->sid[i], ps, depth)) - return False; - } + ptr_sid = talloc(ps->mem_ctx, sizeof(uint32) * r_u->num_sids1); + if (!ptr_sid) { + return False; + } + + for (i = 0; i < r_u->num_sids1; i++) { + ptr_sid[i] = 1; + if(!prs_uint32("ptr_sid", ps, depth, &ptr_sid[i])) + return False; + } + + if (UNMARSHALLING(ps)) { + r_u->sid = talloc(ps->mem_ctx, r_u->num_sids1 * sizeof(DOM_SID2)); + } + + for (i = 0; i < r_u->num_sids1; i++) { + if (ptr_sid[i] != 0) { + if(!smb_io_dom_sid2("sid", &r_u->sid[i], ps, depth)) + return False; } } } diff --git a/source3/rpc_parse/parse_sec.c b/source3/rpc_parse/parse_sec.c index 081173cf8d..3848bd7051 100644 --- a/source3/rpc_parse/parse_sec.c +++ b/source3/rpc_parse/parse_sec.c @@ -3,7 +3,7 @@ * Version 1.9. * RPC Pipe client / server routines * Copyright (C) Andrew Tridgell 1992-1998, - * Copyright (C) Jeremy R. Allison 1995-1998 + * Copyright (C) Jeremy R. Allison 1995-2003. * Copyright (C) Luke Kenneth Casson Leighton 1996-1998, * Copyright (C) Paul Ashton 1997-1998. * @@ -48,7 +48,7 @@ BOOL sec_io_access(const char *desc, SEC_ACCESS *t, prs_struct *ps, int depth) prs_debug(ps, depth, desc, "sec_io_access"); depth++; - if(!prs_uint32("mask", ps, depth, &(t->mask))) + if(!prs_uint32("mask", ps, depth, &t->mask)) return False; return True; @@ -579,8 +579,6 @@ SEC_DESC *make_sec_desc(TALLOC_CTX *ctx, uint16 revision, { SEC_DESC *dst; uint32 offset = 0; - uint32 offset_sid = SEC_DESC_HEADER_SIZE; - uint32 offset_acl = 0; *sd_size = 0; @@ -610,58 +608,33 @@ SEC_DESC *make_sec_desc(TALLOC_CTX *ctx, uint16 revision, if(dacl && ((dst->dacl = dup_sec_acl(ctx, dacl)) == NULL)) goto error_exit; - offset = 0; + offset = SEC_DESC_HEADER_SIZE; /* * Work out the linearization sizes. */ - if (dst->owner_sid != NULL) { - - if (offset == 0) - offset = SEC_DESC_HEADER_SIZE; - - offset += sid_size(dst->owner_sid); - } - - if (dst->grp_sid != NULL) { - - if (offset == 0) - offset = SEC_DESC_HEADER_SIZE; - - offset += sid_size(dst->grp_sid); - } if (dst->sacl != NULL) { - - offset_acl = SEC_DESC_HEADER_SIZE; - - dst->off_sacl = offset_acl; - offset_acl += dst->sacl->size; - offset += dst->sacl->size; - offset_sid += dst->sacl->size; + dst->off_sacl = offset; + offset += dst->sacl->size; } if (dst->dacl != NULL) { - - if (offset_acl == 0) - offset_acl = SEC_DESC_HEADER_SIZE; - - dst->off_dacl = offset_acl; - offset_acl += dst->dacl->size; - offset += dst->dacl->size; - offset_sid += dst->dacl->size; + dst->off_dacl = offset; + offset += dst->dacl->size; } - *sd_size = (size_t)((offset == 0) ? SEC_DESC_HEADER_SIZE : offset); + if (dst->owner_sid != NULL) { + dst->off_owner_sid = offset; + offset += sid_size(dst->owner_sid); + } - if (dst->owner_sid != NULL) - dst->off_owner_sid = offset_sid; - - /* sid_size() returns 0 if the sid is NULL so this is ok */ - - if (dst->grp_sid != NULL) - dst->off_grp_sid = offset_sid + sid_size(dst->owner_sid); + if (dst->grp_sid != NULL) { + dst->off_grp_sid = offset; + offset += sid_size(dst->grp_sid); + } + *sd_size = (size_t)offset; return dst; error_exit: @@ -928,7 +901,7 @@ BOOL sec_io_desc_buf(const char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int } /******************************************************************* - adds new SID with its permissions to SEC_DESC + Add a new SID with its permissions to SEC_DESC. ********************************************************************/ NTSTATUS sec_desc_add_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, uint32 mask, size_t *sd_size) @@ -940,7 +913,8 @@ NTSTATUS sec_desc_add_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, uint32 *sd_size = 0; - if (!ctx || !psd || !sid || !sd_size) return NT_STATUS_INVALID_PARAMETER; + if (!ctx || !psd || !sid || !sd_size) + return NT_STATUS_INVALID_PARAMETER; status = sec_ace_add_sid(ctx, &ace, psd[0]->dacl->ace, &psd[0]->dacl->num_aces, sid, mask); @@ -960,14 +934,15 @@ NTSTATUS sec_desc_add_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, uint32 } /******************************************************************* - modify SID's permissions at SEC_DESC + Modify a SID's permissions in a SEC_DESC. ********************************************************************/ NTSTATUS sec_desc_mod_sid(SEC_DESC *sd, DOM_SID *sid, uint32 mask) { NTSTATUS status; - if (!sd || !sid) return NT_STATUS_INVALID_PARAMETER; + if (!sd || !sid) + return NT_STATUS_INVALID_PARAMETER; status = sec_ace_mod_sid(sd->dacl->ace, sd->dacl->num_aces, sid, mask); @@ -978,7 +953,7 @@ NTSTATUS sec_desc_mod_sid(SEC_DESC *sd, DOM_SID *sid, uint32 mask) } /******************************************************************* - delete SID from SEC_DESC + Delete a SID from a SEC_DESC. ********************************************************************/ NTSTATUS sec_desc_del_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, size_t *sd_size) @@ -990,7 +965,8 @@ NTSTATUS sec_desc_del_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, size_t *sd_size = 0; - if (!ctx || !psd[0] || !sid || !sd_size) return NT_STATUS_INVALID_PARAMETER; + if (!ctx || !psd[0] || !sid || !sd_size) + return NT_STATUS_INVALID_PARAMETER; status = sec_ace_del_sid(ctx, &ace, psd[0]->dacl->ace, &psd[0]->dacl->num_aces, sid); @@ -1008,3 +984,108 @@ NTSTATUS sec_desc_del_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, size_t sd = 0; return NT_STATUS_OK; } + +/******************************************************************* + Comparison function to sort non-inherited first. +*******************************************************************/ + +static int nt_ace_inherit_comp( SEC_ACE *a1, SEC_ACE *a2) +{ + int a1_inh = a1->flags & SEC_ACE_FLAG_INHERITED_ACE; + int a2_inh = a2->flags & SEC_ACE_FLAG_INHERITED_ACE; + + if (a1_inh == a2_inh) + return 0; + + if (!a1_inh && a2_inh) + return -1; + return 1; +} + +/******************************************************************* + Comparison function to apply the order explained below in a group. +*******************************************************************/ + +static int nt_ace_canon_comp( SEC_ACE *a1, SEC_ACE *a2) +{ + if ((a1->type == SEC_ACE_TYPE_ACCESS_DENIED) && + (a2->type != SEC_ACE_TYPE_ACCESS_DENIED)) + return -1; + + if ((a2->type == SEC_ACE_TYPE_ACCESS_DENIED) && + (a1->type != SEC_ACE_TYPE_ACCESS_DENIED)) + return 1; + + /* Both access denied or access allowed. */ + + /* 1. ACEs that apply to the object itself */ + + if (!(a1->flags & SEC_ACE_FLAG_INHERIT_ONLY) && + (a2->flags & SEC_ACE_FLAG_INHERIT_ONLY)) + return -1; + else if (!(a2->flags & SEC_ACE_FLAG_INHERIT_ONLY) && + (a1->flags & SEC_ACE_FLAG_INHERIT_ONLY)) + return 1; + + /* 2. ACEs that apply to a subobject of the object, such as + * a property set or property. */ + + if (a1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT) && + !(a2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT))) + return -1; + else if (a2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT) && + !(a1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT))) + return 1; + + return 0; +} + +/******************************************************************* + Functions to convert a SEC_DESC ACE DACL list into canonical order. + JRA. + +--- from http://msdn.microsoft.com/library/default.asp?url=/library/en-us/security/security/order_of_aces_in_a_dacl.asp + +The following describes the preferred order: + + To ensure that noninherited ACEs have precedence over inherited ACEs, + place all noninherited ACEs in a group before any inherited ACEs. + This ordering ensures, for example, that a noninherited access-denied ACE + is enforced regardless of any inherited ACE that allows access. + + Within the groups of noninherited ACEs and inherited ACEs, order ACEs according to ACE type, as the following shows: + 1. Access-denied ACEs that apply to the object itself + 2. Access-denied ACEs that apply to a subobject of the object, such as a property set or property + 3. Access-allowed ACEs that apply to the object itself + 4. Access-allowed ACEs that apply to a subobject of the object" + +********************************************************************/ + +void dacl_sort_into_canonical_order(SEC_ACE *srclist, unsigned int num_aces) +{ + unsigned int i; + + if (!srclist || num_aces == 0) + return; + + /* Sort so that non-inherited ACE's come first. */ + qsort( srclist, num_aces, sizeof(srclist[0]), QSORT_CAST nt_ace_inherit_comp); + + /* Find the boundary between non-inherited ACEs. */ + for (i = 0; i < num_aces; i++ ) { + SEC_ACE *curr_ace = &srclist[i]; + + if (curr_ace->flags & SEC_ACE_FLAG_INHERITED_ACE) + break; + } + + /* i now points at entry number of the first inherited ACE. */ + + /* Sort the non-inherited ACEs. */ + if (i) + qsort( srclist, i, sizeof(srclist[0]), QSORT_CAST nt_ace_canon_comp); + + /* Now sort the inherited ACEs. */ + if (num_aces - i) + qsort( &srclist[i], num_aces - i, sizeof(srclist[0]), QSORT_CAST nt_ace_canon_comp); +} diff --git a/source3/rpc_parse/parse_spoolss.c b/source3/rpc_parse/parse_spoolss.c index a5d2087a3a..1a380c64d5 100644 --- a/source3/rpc_parse/parse_spoolss.c +++ b/source3/rpc_parse/parse_spoolss.c @@ -645,7 +645,7 @@ static BOOL spool_io_user_level(const char *desc, SPOOL_USER_CTR *q_u, prs_struc BOOL spoolss_io_devmode(const char *desc, prs_struct *ps, int depth, DEVICEMODE *devmode) { - uint32 available_space; /* size of the device mode left to parse */ + int available_space; /* size of the device mode left to parse */ /* only important on unmarshalling */ int i = 0; @@ -7296,15 +7296,14 @@ static BOOL spoolss_io_printer_enum_values_ctr(const char *desc, prs_struct *ps, if (!prs_unistr("valuename", ps, depth, &ctr->values[i].valuename)) return False; - if (UNMARSHALLING(ps)) { + if (UNMARSHALLING(ps) && ctr->values[i].data_len) { ctr->values[i].data = (uint8 *)prs_alloc_mem( ps, ctr->values[i].data_len); if (!ctr->values[i].data) return False; + if (!prs_uint8s(False, "data", ps, depth, ctr->values[i].data, ctr->values[i].data_len)) + return False; } - - if (!prs_uint8s(False, "data", ps, depth, ctr->values[i].data, ctr->values[i].data_len)) - return False; if ( !prs_align_uint16(ps) ) return False; diff --git a/source3/rpc_parse/parse_srv.c b/source3/rpc_parse/parse_srv.c index 27763aa224..bbb5193ddc 100644 --- a/source3/rpc_parse/parse_srv.c +++ b/source3/rpc_parse/parse_srv.c @@ -623,7 +623,8 @@ static BOOL srv_io_share_info1005(const char* desc, SRV_SHARE_INFO_1005* sh1005, if(!prs_align(ps)) return False; - if(!prs_uint32("dfs_root_flag", ps, depth, &sh1005->dfs_root_flag)) + if(!prs_uint32("share_info_flags", ps, depth, + &sh1005->share_info_flags)) return False; return True; diff --git a/source3/rpc_server/srv_dfs_nt.c b/source3/rpc_server/srv_dfs_nt.c index da92e5c06b..eba4eaec75 100644 --- a/source3/rpc_server/srv_dfs_nt.c +++ b/source3/rpc_server/srv_dfs_nt.c @@ -135,7 +135,7 @@ WERROR _dfs_remove(pipes_struct *p, DFS_Q_DFS_REMOVE *q_u, pstrcpy(altpath, servername); pstrcat(altpath, "\\"); pstrcat(altpath, sharename); - strlower(altpath); + strlower_m(altpath); } DEBUG(5,("init_reply_dfs_remove: Request to remove %s -> %s\\%s.\n", diff --git a/source3/rpc_server/srv_lsa.c b/source3/rpc_server/srv_lsa.c index 1c4ef6c8e6..679cfb73bb 100644 --- a/source3/rpc_server/srv_lsa.c +++ b/source3/rpc_server/srv_lsa.c @@ -642,176 +642,45 @@ static BOOL api_lsa_query_info2(pipes_struct *p) } - -/*************************************************************************** - api_lsa_enum_acctrights - ***************************************************************************/ -static BOOL api_lsa_enum_acct_rights(pipes_struct *p) -{ - LSA_Q_ENUM_ACCT_RIGHTS q_u; - LSA_R_ENUM_ACCT_RIGHTS r_u; - - prs_struct *data = &p->in_data.data; - prs_struct *rdata = &p->out_data.rdata; - - ZERO_STRUCT(q_u); - ZERO_STRUCT(r_u); - - if(!lsa_io_q_enum_acct_rights("", &q_u, data, 0)) { - DEBUG(0,("api_lsa_enum_acct_rights: failed to unmarshall LSA_Q_ENUM_ACCT_RIGHTS.\n")); - return False; - } - - r_u.status = _lsa_enum_acct_rights(p, &q_u, &r_u); - - /* store the response in the SMB stream */ - if(!lsa_io_r_enum_acct_rights("", &r_u, rdata, 0)) { - DEBUG(0,("api_lsa_enum_acct_rights: Failed to marshall LSA_R_ENUM_ACCT_RIGHTS.\n")); - return False; - } - - return True; -} - - -/*************************************************************************** - api_lsa_enum_acct_with_right - ***************************************************************************/ -static BOOL api_lsa_enum_acct_with_right(pipes_struct *p) -{ - LSA_Q_ENUM_ACCT_WITH_RIGHT q_u; - LSA_R_ENUM_ACCT_WITH_RIGHT r_u; - - prs_struct *data = &p->in_data.data; - prs_struct *rdata = &p->out_data.rdata; - - ZERO_STRUCT(q_u); - ZERO_STRUCT(r_u); - - if(!lsa_io_q_enum_acct_with_right("", &q_u, data, 0)) { - DEBUG(0,("api_lsa_enum_acct_with_right: failed to unmarshall LSA_Q_ENUM_ACCT_WITH_RIGHT.\n")); - return False; - } - - r_u.status = _lsa_enum_acct_with_right(p, &q_u, &r_u); - - /* store the response in the SMB stream */ - if(!lsa_io_r_enum_acct_with_right("", &r_u, rdata, 0)) { - DEBUG(0,("api_lsa_enum_acct_with_right: Failed to marshall LSA_R_ENUM_ACCT_WITH_RIGHT.\n")); - return False; - } - - return True; -} - - -/*************************************************************************** - api_lsa_add_acctrights - ***************************************************************************/ -static BOOL api_lsa_add_acct_rights(pipes_struct *p) -{ - LSA_Q_ADD_ACCT_RIGHTS q_u; - LSA_R_ADD_ACCT_RIGHTS r_u; - - prs_struct *data = &p->in_data.data; - prs_struct *rdata = &p->out_data.rdata; - - ZERO_STRUCT(q_u); - ZERO_STRUCT(r_u); - - if(!lsa_io_q_add_acct_rights("", &q_u, data, 0)) { - DEBUG(0,("api_lsa_add_acct_rights: failed to unmarshall LSA_Q_ADD_ACCT_RIGHTS.\n")); - return False; - } - - r_u.status = _lsa_add_acct_rights(p, &q_u, &r_u); - - /* store the response in the SMB stream */ - if(!lsa_io_r_add_acct_rights("", &r_u, rdata, 0)) { - DEBUG(0,("api_lsa_add_acct_rights: Failed to marshall LSA_R_ADD_ACCT_RIGHTS.\n")); - return False; - } - - return True; -} - - -/*************************************************************************** - api_lsa_remove_acctrights - ***************************************************************************/ -static BOOL api_lsa_remove_acct_rights(pipes_struct *p) -{ - LSA_Q_REMOVE_ACCT_RIGHTS q_u; - LSA_R_REMOVE_ACCT_RIGHTS r_u; - - prs_struct *data = &p->in_data.data; - prs_struct *rdata = &p->out_data.rdata; - - ZERO_STRUCT(q_u); - ZERO_STRUCT(r_u); - - if(!lsa_io_q_remove_acct_rights("", &q_u, data, 0)) { - DEBUG(0,("api_lsa_remove_acct_rights: failed to unmarshall LSA_Q_REMOVE_ACCT_RIGHTS.\n")); - return False; - } - - r_u.status = _lsa_remove_acct_rights(p, &q_u, &r_u); - - /* store the response in the SMB stream */ - if(!lsa_io_r_remove_acct_rights("", &r_u, rdata, 0)) { - DEBUG(0,("api_lsa_remove_acct_rights: Failed to marshall LSA_R_REMOVE_ACCT_RIGHTS.\n")); - return False; - } - - return True; -} - - /*************************************************************************** \PIPE\ntlsa commands ***************************************************************************/ - NTSTATUS rpc_lsa_init(void) { - static const struct api_struct api_lsa_cmds[] = - { - { "LSA_OPENPOLICY2" , LSA_OPENPOLICY2 , api_lsa_open_policy2 }, - { "LSA_OPENPOLICY" , LSA_OPENPOLICY , api_lsa_open_policy }, - { "LSA_QUERYINFOPOLICY" , LSA_QUERYINFOPOLICY , api_lsa_query_info }, - { "LSA_ENUMTRUSTDOM" , LSA_ENUMTRUSTDOM , api_lsa_enum_trust_dom }, - { "LSA_CLOSE" , LSA_CLOSE , api_lsa_close }, - { "LSA_OPENSECRET" , LSA_OPENSECRET , api_lsa_open_secret }, - { "LSA_LOOKUPSIDS" , LSA_LOOKUPSIDS , api_lsa_lookup_sids }, - { "LSA_LOOKUPNAMES" , LSA_LOOKUPNAMES , api_lsa_lookup_names }, - { "LSA_ENUM_PRIVS" , LSA_ENUM_PRIVS , api_lsa_enum_privs }, - { "LSA_PRIV_GET_DISPNAME",LSA_PRIV_GET_DISPNAME,api_lsa_priv_get_dispname}, - { "LSA_ENUM_ACCOUNTS" , LSA_ENUM_ACCOUNTS , api_lsa_enum_accounts }, - { "LSA_UNK_GET_CONNUSER", LSA_UNK_GET_CONNUSER, api_lsa_unk_get_connuser }, - { "LSA_OPENACCOUNT" , LSA_OPENACCOUNT , api_lsa_open_account }, - { "LSA_ENUMPRIVSACCOUNT", LSA_ENUMPRIVSACCOUNT, api_lsa_enum_privsaccount}, - { "LSA_GETSYSTEMACCOUNT", LSA_GETSYSTEMACCOUNT, api_lsa_getsystemaccount }, - { "LSA_SETSYSTEMACCOUNT", LSA_SETSYSTEMACCOUNT, api_lsa_setsystemaccount }, - { "LSA_ADDPRIVS" , LSA_ADDPRIVS , api_lsa_addprivs }, - { "LSA_REMOVEPRIVS" , LSA_REMOVEPRIVS , api_lsa_removeprivs }, - { "LSA_QUERYSECOBJ" , LSA_QUERYSECOBJ , api_lsa_query_secobj }, - { "LSA_ENUMACCTRIGHTS" , LSA_ENUMACCTRIGHTS , api_lsa_enum_acct_rights }, - { "LSA_ENUMACCTWITHRIGHT", LSA_ENUMACCTWITHRIGHT, api_lsa_enum_acct_with_right }, - { "LSA_ADDACCTRIGHTS" , LSA_ADDACCTRIGHTS , api_lsa_add_acct_rights }, - { "LSA_REMOVEACCTRIGHTS", LSA_REMOVEACCTRIGHTS, api_lsa_remove_acct_rights}, - /* be careful of the adding of new RPC's. See commentrs below about - * ADS DC capabilities */ - { "LSA_QUERYINFO2" , LSA_QUERYINFO2 , api_lsa_query_info2 }, - }; - +static const struct api_struct api_lsa_cmds[] = +{ + { "LSA_OPENPOLICY2" , LSA_OPENPOLICY2 , api_lsa_open_policy2 }, + { "LSA_OPENPOLICY" , LSA_OPENPOLICY , api_lsa_open_policy }, + { "LSA_QUERYINFOPOLICY" , LSA_QUERYINFOPOLICY , api_lsa_query_info }, + { "LSA_ENUMTRUSTDOM" , LSA_ENUMTRUSTDOM , api_lsa_enum_trust_dom }, + { "LSA_CLOSE" , LSA_CLOSE , api_lsa_close }, + { "LSA_OPENSECRET" , LSA_OPENSECRET , api_lsa_open_secret }, + { "LSA_LOOKUPSIDS" , LSA_LOOKUPSIDS , api_lsa_lookup_sids }, + { "LSA_LOOKUPNAMES" , LSA_LOOKUPNAMES , api_lsa_lookup_names }, + { "LSA_ENUM_PRIVS" , LSA_ENUM_PRIVS , api_lsa_enum_privs }, + { "LSA_PRIV_GET_DISPNAME",LSA_PRIV_GET_DISPNAME,api_lsa_priv_get_dispname}, + { "LSA_ENUM_ACCOUNTS" , LSA_ENUM_ACCOUNTS , api_lsa_enum_accounts }, + { "LSA_UNK_GET_CONNUSER", LSA_UNK_GET_CONNUSER, api_lsa_unk_get_connuser }, + { "LSA_OPENACCOUNT" , LSA_OPENACCOUNT , api_lsa_open_account }, + { "LSA_ENUMPRIVSACCOUNT", LSA_ENUMPRIVSACCOUNT, api_lsa_enum_privsaccount}, + { "LSA_GETSYSTEMACCOUNT", LSA_GETSYSTEMACCOUNT, api_lsa_getsystemaccount }, + { "LSA_SETSYSTEMACCOUNT", LSA_SETSYSTEMACCOUNT, api_lsa_setsystemaccount }, + { "LSA_ADDPRIVS" , LSA_ADDPRIVS , api_lsa_addprivs }, + { "LSA_REMOVEPRIVS" , LSA_REMOVEPRIVS , api_lsa_removeprivs }, + { "LSA_QUERYSECOBJ" , LSA_QUERYSECOBJ , api_lsa_query_secobj }, + /* be careful of the adding of new RPC's. See commentrs below about + ADS DC capabilities */ + { "LSA_QUERYINFO2" , LSA_QUERYINFO2 , api_lsa_query_info2 } +}; /* * NOTE: Certain calls can not be enabled if we aren't an ADS DC. Make sure * these calls are always last and that you decrement by the amount of calls * to disable. - */ + */ int funcs = sizeof(api_lsa_cmds) / sizeof(struct api_struct); if (!(SEC_ADS == lp_security() && ROLE_DOMAIN_PDC == lp_server_role())) { - funcs -= 1; + funcs -= 1; } return rpc_pipe_register_commands(SMB_RPC_INTERFACE_VERSION, "lsarpc", "lsass", api_lsa_cmds, diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c index 3581be0181..ca3021a876 100644 --- a/source3/rpc_server/srv_lsa_nt.c +++ b/source3/rpc_server/srv_lsa_nt.c @@ -403,8 +403,16 @@ NTSTATUS _lsa_open_policy2(pipes_struct *p, LSA_Q_OPEN_POL2 *q_u, LSA_R_OPEN_POL /* get the generic lsa policy SD until we store it */ lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size); - if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) - return status; + if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) { + if (geteuid() != 0) { + return status; + } + DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n", + acc_granted, des_access)); + DEBUGADD(4,("but overwritten by euid == 0\n")); + acc_granted = des_access; + } + /* associate the domain SID with the (unique) handle. */ if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL) @@ -441,8 +449,15 @@ NTSTATUS _lsa_open_policy(pipes_struct *p, LSA_Q_OPEN_POL *q_u, LSA_R_OPEN_POL * /* get the generic lsa policy SD until we store it */ lsa_get_generic_sd(p->mem_ctx, &psd, &sd_size); - if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) - return status; + if(!se_access_check(psd, p->pipe_user.nt_user_token, des_access, &acc_granted, &status)) { + if (geteuid() != 0) { + return status; + } + DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n", + acc_granted, des_access)); + DEBUGADD(4,("but overwritten by euid == 0\n")); + acc_granted = des_access; + } /* associate the domain SID with the (unique) handle. */ if ((info = (struct lsa_info *)malloc(sizeof(struct lsa_info))) == NULL) @@ -547,7 +562,7 @@ NTSTATUS _lsa_query_info(pipes_struct *p, LSA_Q_QUERY_INFO *q_u, LSA_R_QUERY_INF switch (lp_server_role()) { case ROLE_DOMAIN_PDC: case ROLE_DOMAIN_BDC: - name = lp_workgroup(); + name = get_global_sam_name(); sid = get_global_sam_sid(); break; case ROLE_DOMAIN_MEMBER: @@ -573,23 +588,8 @@ NTSTATUS _lsa_query_info(pipes_struct *p, LSA_Q_QUERY_INFO *q_u, LSA_R_QUERY_INF return NT_STATUS_ACCESS_DENIED; /* Request PolicyAccountDomainInformation. */ - switch (lp_server_role()) { - case ROLE_DOMAIN_PDC: - case ROLE_DOMAIN_BDC: - name = lp_workgroup(); - sid = get_global_sam_sid(); - break; - case ROLE_DOMAIN_MEMBER: - name = global_myname(); - sid = get_global_sam_sid(); - break; - case ROLE_STANDALONE: - name = global_myname(); - sid = get_global_sam_sid(); - break; - default: - return NT_STATUS_CANT_ACCESS_DOMAIN_INFO; - } + name = get_global_sam_name(); + sid = get_global_sam_sid(); init_dom_query(&r_u->dom.id5, name, sid); break; case 0x06: @@ -645,7 +645,7 @@ NTSTATUS _lsa_lookup_sids(pipes_struct *p, LSA_Q_LOOKUP_SIDS *q_u, LSA_R_LOOKUP_ num_entries = MAX_LOOKUP_SIDS; DEBUG(5,("_lsa_lookup_sids: truncating SID lookup list to %d\n", num_entries)); } - + ref = (DOM_R_REF *)talloc_zero(p->mem_ctx, sizeof(DOM_R_REF)); names = (LSA_TRANS_NAME_ENUM *)talloc_zero(p->mem_ctx, sizeof(LSA_TRANS_NAME_ENUM)); @@ -859,7 +859,7 @@ NTSTATUS _lsa_enum_accounts(pipes_struct *p, LSA_Q_ENUM_ACCOUNTS *q_u, LSA_R_ENU return NT_STATUS_ACCESS_DENIED; /* get the list of mapped groups (domain, local, builtin) */ - if(!pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &num_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV)) + if(!pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &num_entries, ENUM_ONLY_MAPPED)) return NT_STATUS_OK; if (q_u->enum_context >= num_entries) @@ -964,8 +964,6 @@ NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, LSA_Q_ENUMPRIVSACCOUNT *q_u, LS { struct lsa_info *info=NULL; GROUP_MAP map; - int i=0; - LUID_ATTR *set=NULL; r_u->status = NT_STATUS_OK; @@ -974,9 +972,10 @@ NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, LSA_Q_ENUMPRIVSACCOUNT *q_u, LS if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info)) return NT_STATUS_INVALID_HANDLE; - if (!pdb_getgrsid(&map, info->sid, MAPPING_WITH_PRIV)) + if (!pdb_getgrsid(&map, info->sid)) return NT_STATUS_NO_SUCH_GROUP; +#if 0 /* privileges currently not implemented! */ DEBUG(10,("_lsa_enum_privsaccount: %d privileges\n", map.priv_set.count)); if (map.priv_set.count!=0) { @@ -997,6 +996,9 @@ NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, LSA_Q_ENUMPRIVSACCOUNT *q_u, LS init_lsa_r_enum_privsaccount(r_u, set, map.priv_set.count, 0); free_privilege(&map.priv_set); +#endif + + init_lsa_r_enum_privsaccount(r_u, set, 0, 0); return r_u->status; } @@ -1015,7 +1017,7 @@ NTSTATUS _lsa_getsystemaccount(pipes_struct *p, LSA_Q_GETSYSTEMACCOUNT *q_u, LSA if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info)) return NT_STATUS_INVALID_HANDLE; - if (!pdb_getgrsid(&map, info->sid, MAPPING_WITHOUT_PRIV)) + if (!pdb_getgrsid(&map, info->sid)) return NT_STATUS_NO_SUCH_GROUP; /* @@ -1027,7 +1029,7 @@ NTSTATUS _lsa_getsystemaccount(pipes_struct *p, LSA_Q_GETSYSTEMACCOUNT *q_u, LSA they can be ORed together */ - r_u->access=map.systemaccount; + r_u->access = PR_LOG_ON_LOCALLY | PR_ACCESS_FROM_NETWORK; return r_u->status; } @@ -1046,16 +1048,12 @@ NTSTATUS _lsa_setsystemaccount(pipes_struct *p, LSA_Q_SETSYSTEMACCOUNT *q_u, LSA if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info)) return NT_STATUS_INVALID_HANDLE; - if (!pdb_getgrsid(&map, info->sid, MAPPING_WITH_PRIV)) + if (!pdb_getgrsid(&map, info->sid)) return NT_STATUS_NO_SUCH_GROUP; - map.systemaccount=q_u->access; - if(!pdb_update_group_mapping_entry(&map)) return NT_STATUS_NO_SUCH_GROUP; - free_privilege(&map.priv_set); - return r_u->status; } @@ -1065,20 +1063,22 @@ NTSTATUS _lsa_setsystemaccount(pipes_struct *p, LSA_Q_SETSYSTEMACCOUNT *q_u, LSA NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u) { +#if 0 struct lsa_info *info=NULL; GROUP_MAP map; int i=0; - LUID_ATTR *luid_attr=NULL; PRIVILEGE_SET *set=NULL; +#endif r_u->status = NT_STATUS_OK; +#if 0 /* privileges are not implemented */ /* find the connection policy handle. */ if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info)) return NT_STATUS_INVALID_HANDLE; - if (!pdb_getgrsid(&map, info->sid, MAPPING_WITH_PRIV)) + if (!pdb_getgrsid(&map, info->sid)) return NT_STATUS_NO_SUCH_GROUP; set=&q_u->set; @@ -1100,6 +1100,7 @@ NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u free_privilege(&map.priv_set); +#endif return r_u->status; } @@ -1109,20 +1110,22 @@ NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEPRIVS *r_u) { +#if 0 struct lsa_info *info=NULL; GROUP_MAP map; int i=0; - LUID_ATTR *luid_attr=NULL; PRIVILEGE_SET *set=NULL; +#endif r_u->status = NT_STATUS_OK; +#if 0 /* privileges are not implemented */ /* find the connection policy handle. */ if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info)) return NT_STATUS_INVALID_HANDLE; - if (!pdb_getgrsid(&map, info->sid, MAPPING_WITH_PRIV)) + if (!pdb_getgrsid(&map, info->sid)) return NT_STATUS_NO_SUCH_GROUP; if (q_u->allrights!=0) { @@ -1156,7 +1159,7 @@ NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEP return NT_STATUS_NO_SUCH_GROUP; free_privilege(&map.priv_set); - +#endif return r_u->status; } @@ -1240,13 +1243,13 @@ NTSTATUS _lsa_query_info2(pipes_struct *p, LSA_Q_QUERY_INFO2 *q_u, LSA_R_QUERY_I switch (lp_server_role()) { case ROLE_DOMAIN_PDC: case ROLE_DOMAIN_BDC: - nb_name = lp_workgroup(); + nb_name = get_global_sam_name(); /* ugly temp hack for these next two */ /* This should be a 'netbios domain -> DNS domain' mapping */ dnsdomname[0] = '\0'; get_mydomname(dnsdomname); - strlower(dnsdomname); + strlower_m(dnsdomname); dns_name = dnsdomname; forest_name = dnsdomname; @@ -1273,140 +1276,3 @@ NTSTATUS _lsa_query_info2(pipes_struct *p, LSA_Q_QUERY_INFO2 *q_u, LSA_R_QUERY_I return r_u->status; } - - -/*************************************************************************** - For a given SID, enumerate all the privilege this account has. - ***************************************************************************/ -NTSTATUS _lsa_enum_acct_rights(pipes_struct *p, LSA_Q_ENUM_ACCT_RIGHTS *q_u, LSA_R_ENUM_ACCT_RIGHTS *r_u) -{ - struct lsa_info *info=NULL; - char **rights = NULL; - int num_rights = 0; - int i; - - r_u->status = NT_STATUS_OK; - - /* find the connection policy handle. */ - if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info)) - return NT_STATUS_INVALID_HANDLE; - - r_u->status = privilege_enum_account_rights(&q_u->sid.sid, &num_rights, &rights); - - init_r_enum_acct_rights(r_u, num_rights, (const char **)rights); - - for (i=0;istatus; -} - -/*************************************************************************** -return a list of SIDs for a particular privilege - ***************************************************************************/ -NTSTATUS _lsa_enum_acct_with_right(pipes_struct *p, - LSA_Q_ENUM_ACCT_WITH_RIGHT *q_u, - LSA_R_ENUM_ACCT_WITH_RIGHT *r_u) -{ - struct lsa_info *info=NULL; - char *right; - DOM_SID *sids = NULL; - uint32 count = 0; - - r_u->status = NT_STATUS_OK; - - /* find the connection policy handle. */ - if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info)) - return NT_STATUS_INVALID_HANDLE; - - right = unistr2_tdup(p->mem_ctx, &q_u->right); - - DEBUG(5,("lsa_enum_acct_with_right on right %s\n", right)); - - r_u->status = privilege_enum_account_with_right(right, &count, &sids); - - init_r_enum_acct_with_right(r_u, count, sids); - - safe_free(sids); - - return r_u->status; -} - -/*************************************************************************** - add privileges to a acct by SID - ***************************************************************************/ -NTSTATUS _lsa_add_acct_rights(pipes_struct *p, LSA_Q_ADD_ACCT_RIGHTS *q_u, LSA_R_ADD_ACCT_RIGHTS *r_u) -{ - struct lsa_info *info=NULL; - int i; - - r_u->status = NT_STATUS_OK; - - /* find the connection policy handle. */ - if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info)) - return NT_STATUS_INVALID_HANDLE; - - DEBUG(5,("_lsa_add_acct_rights to %s (%d rights)\n", - sid_string_static(&q_u->sid.sid), q_u->rights.count)); - - for (i=0;irights.count;i++) { - DEBUG(5,("\t%s\n", unistr2_static(&q_u->rights.strings[i].string))); - } - - - for (i=0;irights.count;i++) { - r_u->status = privilege_add_account_right(unistr2_static(&q_u->rights.strings[i].string), - &q_u->sid.sid); - if (!NT_STATUS_IS_OK(r_u->status)) { - DEBUG(2,("Failed to add right '%s'\n", - unistr2_static(&q_u->rights.strings[i].string))); - break; - } - } - - init_r_add_acct_rights(r_u); - - return r_u->status; -} - - -/*************************************************************************** - remove privileges from a acct by SID - ***************************************************************************/ -NTSTATUS _lsa_remove_acct_rights(pipes_struct *p, LSA_Q_REMOVE_ACCT_RIGHTS *q_u, LSA_R_REMOVE_ACCT_RIGHTS *r_u) -{ - struct lsa_info *info=NULL; - int i; - - r_u->status = NT_STATUS_OK; - - /* find the connection policy handle. */ - if (!find_policy_by_hnd(p, &q_u->pol, (void **)&info)) - return NT_STATUS_INVALID_HANDLE; - - - DEBUG(5,("_lsa_remove_acct_rights from %s all=%d (%d rights)\n", - sid_string_static(&q_u->sid.sid), - q_u->removeall, - q_u->rights.count)); - - for (i=0;irights.count;i++) { - DEBUG(5,("\t%s\n", unistr2_static(&q_u->rights.strings[i].string))); - } - - for (i=0;irights.count;i++) { - r_u->status = privilege_remove_account_right(unistr2_static(&q_u->rights.strings[i].string), - &q_u->sid.sid); - if (!NT_STATUS_IS_OK(r_u->status)) { - DEBUG(2,("Failed to remove right '%s'\n", - unistr2_static(&q_u->rights.strings[i].string))); - break; - } - } - - init_r_remove_acct_rights(r_u); - - return r_u->status; -} diff --git a/source3/rpc_server/srv_netlog_nt.c b/source3/rpc_server/srv_netlog_nt.c index aa573b8154..c4a87d2e26 100644 --- a/source3/rpc_server/srv_netlog_nt.c +++ b/source3/rpc_server/srv_netlog_nt.c @@ -524,6 +524,7 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON * auth_serversupplied_info *server_info = NULL; extern userdom_struct current_user_info; SAM_ACCOUNT *sampw; + struct auth_context *auth_context = NULL; usr_info = (NET_USER_INFO_3 *)talloc(p->mem_ctx, sizeof(NET_USER_INFO_3)); if (!usr_info) @@ -598,10 +599,11 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON * DEBUG(5,("Attempting validation level %d for unmapped username %s.\n", q_u->sam_id.ctr->switch_value, nt_username)); + status = NT_STATUS_OK; + switch (ctr->switch_value) { case NET_LOGON_TYPE: { - struct auth_context *auth_context = NULL; if (!NT_STATUS_IS_OK(status = make_auth_context_fixed(&auth_context, ctr->auth.id2.lm_chal))) { return status; } @@ -615,11 +617,7 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON * ctr->auth.id2.nt_chal_resp.buffer, ctr->auth.id2.nt_chal_resp.str_str_len)) { status = NT_STATUS_NO_MEMORY; - } else { - status = auth_context->check_ntlm_password(auth_context, user_info, &server_info); - } - (auth_context->free)(&auth_context); - + } break; } case INTERACTIVE_LOGON_TYPE: @@ -628,8 +626,8 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON * convert this to chellange/responce for the auth subsystem to chew on */ { - struct auth_context *auth_context = NULL; const uint8 *chal; + if (!NT_STATUS_IS_OK(status = make_auth_context_subsystem(&auth_context))) { return status; } @@ -643,12 +641,7 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON * ctr->auth.id1.nt_owf.data, p->dc.sess_key)) { status = NT_STATUS_NO_MEMORY; - } else { - status = auth_context->check_ntlm_password(auth_context, user_info, &server_info); } - - (auth_context->free)(&auth_context); - break; } default: @@ -656,6 +649,12 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON * return NT_STATUS_INVALID_INFO_CLASS; } /* end switch */ + if ( NT_STATUS_IS_OK(status) ) { + status = auth_context->check_ntlm_password(auth_context, + user_info, &server_info); + } + + (auth_context->free)(&auth_context); free_user_info(&user_info); DEBUG(5, ("_net_sam_logon: check_password returned status %s\n", @@ -731,8 +730,7 @@ NTSTATUS _net_sam_logon(pipes_struct *p, NET_Q_SAM_LOGON *q_u, NET_R_SAM_LOGON * init_net_user_info3(p->mem_ctx, usr_info, user_rid, - group_rid, - + group_rid, pdb_get_username(sampw), pdb_get_fullname(sampw), pdb_get_homedir(sampw), diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c index 6a9e591f64..9a63ebc7a3 100644 --- a/source3/rpc_server/srv_pipe.c +++ b/source3/rpc_server/srv_pipe.c @@ -227,7 +227,7 @@ BOOL create_next_pdu(pipes_struct *p) if (auth_seal || auth_verify) { RPC_HDR_AUTH auth_info; - init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, + init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, RPC_PIPE_AUTH_SEAL_LEVEL, (auth_verify ? RPC_HDR_AUTH_LEN : 0), (auth_verify ? 1 : 0)); if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) { DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n")); @@ -263,11 +263,9 @@ BOOL create_next_pdu(pipes_struct *p) prs_struct rverf; prs_struct rauth; - uchar sign[8]; - data = prs_data_p(&outgoing_pdu) + data_pos; - init_rpc_hdr_auth(&auth_info, NETSEC_AUTH_TYPE, NETSEC_AUTH_LEVEL, + init_rpc_hdr_auth(&auth_info, NETSEC_AUTH_TYPE, RPC_PIPE_AUTH_SEAL_LEVEL, RPC_HDR_AUTH_LEN, 1); if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) { @@ -284,12 +282,12 @@ BOOL create_next_pdu(pipes_struct *p) p->netsec_auth.seq_num)); } - RSIVAL(sign, 0, p->netsec_auth.seq_num); - SIVAL(sign, 4, 0); - - init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes, sign, nullbytes); + init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes, nullbytes, nullbytes); - netsec_encode(&p->netsec_auth, &verf, data, data_len); + netsec_encode(&p->netsec_auth, + AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN|AUTH_PIPE_SEAL, + SENDER_IS_ACCEPTOR, + &verf, data, data_len); smb_io_rpc_auth_netsec_chk("", &verf, &outgoing_pdu, 0); @@ -458,13 +456,17 @@ failed authentication on named pipe %s.\n", domain, user_name, wks, p->name )); p->ntlmssp_hash[256] = 0; p->ntlmssp_hash[257] = 0; } + + dump_data_pw("NTLMSSP hash (v1)\n", p->ntlmssp_hash, + sizeof(p->ntlmssp_hash)); + /* NTLMSSPhash(p->ntlmssp_hash, p24); */ p->ntlmssp_seq_num = 0; } fstrcpy(p->user_name, user_name); - fstrcpy(p->pipe_user_name, pdb_get_username(server_info->sam_account)); + fstrcpy(p->pipe_user_name, server_info->unix_name); fstrcpy(p->domain, domain); fstrcpy(p->wks, wks); @@ -546,7 +548,7 @@ BOOL api_pipe_bind_auth_resp(pipes_struct *p, prs_struct *rpc_in_p) return False; } - if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != NTLMSSP_AUTH_LEVEL) { + if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != RPC_PIPE_AUTH_SEAL_LEVEL) { DEBUG(0,("api_pipe_bind_auth_resp: incorrect auth type (%d) or level (%d).\n", (int)autha_info.auth_type, (int)autha_info.auth_level )); return False; @@ -1070,7 +1072,7 @@ BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p) /*** Authentication info ***/ - init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, RPC_HDR_AUTH_LEN, 1); + init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, RPC_PIPE_AUTH_SEAL_LEVEL, RPC_HDR_AUTH_LEN, 1); if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) { DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n")); goto err_exit; @@ -1105,7 +1107,7 @@ BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p) re-used from the auth2 the client did before. */ p->dc = last_dcinfo; - init_rpc_hdr_auth(&auth_info, NETSEC_AUTH_TYPE, NETSEC_AUTH_LEVEL, RPC_HDR_AUTH_LEN, 1); + init_rpc_hdr_auth(&auth_info, NETSEC_AUTH_TYPE, RPC_PIPE_AUTH_SEAL_LEVEL, RPC_HDR_AUTH_LEN, 1); if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) { DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n")); goto err_exit; @@ -1226,7 +1228,14 @@ BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in) * has already been consumed. */ char *data = prs_data_p(rpc_in) + RPC_HDR_REQ_LEN; + dump_data_pw("NTLMSSP hash (v1)\n", p->ntlmssp_hash, + sizeof(p->ntlmssp_hash)); + + dump_data_pw("Incoming RPC PDU (NTLMSSP sealed)\n", + data, data_len); NTLMSSPcalc_p(p, (uchar*)data, data_len); + dump_data_pw("Incoming RPC PDU (NTLMSSP unsealed)\n", + data, data_len); crc32 = crc32_calc_buffer(data, data_len); } @@ -1335,7 +1344,7 @@ BOOL api_pipe_netsec_process(pipes_struct *p, prs_struct *rpc_in) } if ((auth_info.auth_type != NETSEC_AUTH_TYPE) || - (auth_info.auth_level != NETSEC_AUTH_LEVEL)) { + (auth_info.auth_level != RPC_PIPE_AUTH_SEAL_LEVEL)) { DEBUG(0,("Invalid auth info %d or level %d on schannel\n", auth_info.auth_type, auth_info.auth_level)); return False; @@ -1346,7 +1355,10 @@ BOOL api_pipe_netsec_process(pipes_struct *p, prs_struct *rpc_in) return False; } - if (!netsec_decode(&p->netsec_auth, &netsec_chk, + if (!netsec_decode(&p->netsec_auth, + AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN|AUTH_PIPE_SEAL, + SENDER_IS_INITIATOR, + &netsec_chk, prs_data_p(rpc_in)+old_offset, data_len)) { DEBUG(0,("failed to decode PDU\n")); return False; diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c index fc29df3976..9324fd4765 100644 --- a/source3/rpc_server/srv_samr_nt.c +++ b/source3/rpc_server/srv_samr_nt.c @@ -44,10 +44,10 @@ extern rid_name builtin_alias_rids[]; typedef struct _disp_info { BOOL user_dbloaded; uint32 num_user_account; - DISP_USER_INFO *disp_user_info; + SAM_ACCOUNT *disp_user_info; BOOL group_dbloaded; uint32 num_group_account; - DISP_GROUP_INFO *disp_group_info; + DOMAIN_GRP *disp_group_info; } DISP_INFO; struct samr_info { @@ -151,28 +151,29 @@ static struct samr_info *get_samr_info_by_sid(DOM_SID *psid) return info; } - /******************************************************************* Function to free the per handle data. ********************************************************************/ + static void free_samr_users(struct samr_info *info) { int i; if (info->disp_info.user_dbloaded){ for (i=0; idisp_info.num_user_account; i++) { + SAM_ACCOUNT *sam = &info->disp_info.disp_user_info[i]; /* Not really a free, actually a 'clear' */ - pdb_free_sam(&info->disp_info.disp_user_info[i].sam); + pdb_free_sam(&sam); } } info->disp_info.user_dbloaded=False; info->disp_info.num_user_account=0; } - /******************************************************************* Function to free the per handle data. ********************************************************************/ + static void free_samr_db(struct samr_info *info) { /* Groups are talloced */ @@ -183,7 +184,6 @@ static void free_samr_db(struct samr_info *info) info->disp_info.num_group_account=0; } - static void free_samr_info(void *ptr) { struct samr_info *info=(struct samr_info *) ptr; @@ -212,7 +212,7 @@ static void samr_clear_sam_passwd(SAM_ACCOUNT *sam_pass) static NTSTATUS load_sampwd_entries(struct samr_info *info, uint16 acb_mask, BOOL all_machines) { SAM_ACCOUNT *pwd = NULL; - DISP_USER_INFO *pwd_array = NULL; + SAM_ACCOUNT *pwd_array = NULL; NTSTATUS nt_status = NT_STATUS_OK; TALLOC_CTX *mem_ctx = info->mem_ctx; @@ -255,8 +255,8 @@ static NTSTATUS load_sampwd_entries(struct samr_info *info, uint16 acb_mask, BOO if (info->disp_info.num_user_account % MAX_SAM_ENTRIES == 0) { DEBUG(10,("load_sampwd_entries: allocating more memory\n")); - pwd_array=(DISP_USER_INFO *)talloc_realloc(mem_ctx, info->disp_info.disp_user_info, - (info->disp_info.num_user_account+MAX_SAM_ENTRIES)*sizeof(DISP_USER_INFO)); + pwd_array=(SAM_ACCOUNT *)talloc_realloc(mem_ctx, info->disp_info.disp_user_info, + (info->disp_info.num_user_account+MAX_SAM_ENTRIES)*sizeof(SAM_ACCOUNT)); if (pwd_array==NULL) return NT_STATUS_NO_MEMORY; @@ -264,8 +264,8 @@ static NTSTATUS load_sampwd_entries(struct samr_info *info, uint16 acb_mask, BOO info->disp_info.disp_user_info=pwd_array; } - /* link the SAM_ACCOUNT to the array */ - info->disp_info.disp_user_info[info->disp_info.num_user_account].sam=pwd; + /* Copy the SAM_ACCOUNT into the array */ + info->disp_info.disp_user_info[info->disp_info.num_user_account]=*pwd; DEBUG(10,("load_sampwd_entries: entry: %d\n", info->disp_info.num_user_account)); @@ -288,7 +288,7 @@ static NTSTATUS load_sampwd_entries(struct samr_info *info, uint16 acb_mask, BOO static NTSTATUS load_group_domain_entries(struct samr_info *info, DOM_SID *sid) { GROUP_MAP *map=NULL; - DISP_GROUP_INFO *grp_array = NULL; + DOMAIN_GRP *grp_array = NULL; uint32 group_entries = 0; uint32 i; TALLOC_CTX *mem_ctx = info->mem_ctx; @@ -304,7 +304,7 @@ static NTSTATUS load_group_domain_entries(struct samr_info *info, DOM_SID *sid) become_root(); - if (!pdb_enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV)) { + if (!pdb_enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED)) { DEBUG(1, ("load_group_domain_entries: pdb_enum_group_mapping() failed!\n")); return NT_STATUS_NO_MEMORY; } @@ -313,8 +313,7 @@ static NTSTATUS load_group_domain_entries(struct samr_info *info, DOM_SID *sid) info->disp_info.num_group_account=group_entries; - grp_array=(DISP_GROUP_INFO *)talloc(mem_ctx, info->disp_info.num_group_account*sizeof(DISP_GROUP_INFO)); - + grp_array=(DOMAIN_GRP *)talloc(mem_ctx, info->disp_info.num_group_account*sizeof(DOMAIN_GRP)); if (group_entries!=0 && grp_array==NULL) { DEBUG(1, ("load_group_domain_entries: talloc() failed for grp_array!\n")); SAFE_FREE(map); @@ -324,13 +323,10 @@ static NTSTATUS load_group_domain_entries(struct samr_info *info, DOM_SID *sid) info->disp_info.disp_group_info=grp_array; for (i=0; iname, map[i].nt_name); - fstrcpy(grp_array[i].grp->comment, map[i].comment); - sid_split_rid(&map[i].sid, &grp_array[i].grp->rid); - grp_array[i].grp->attr=SID_NAME_DOM_GRP; + fstrcpy(grp_array[i].name, map[i].nt_name); + fstrcpy(grp_array[i].comment, map[i].comment); + sid_split_rid(&map[i].sid, &grp_array[i].rid); + grp_array[i].attr=SID_NAME_DOM_GRP; } SAFE_FREE(map); @@ -691,7 +687,7 @@ makes a SAM_ENTRY / UNISTR2* structure from a user list. ********************************************************************/ static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp, UNISTR2 **uni_name_pp, - uint32 num_entries, uint32 start_idx, DISP_USER_INFO *disp_user_info, + uint32 num_entries, uint32 start_idx, SAM_ACCOUNT *disp_user_info, DOM_SID *domain_sid) { uint32 i; @@ -721,7 +717,7 @@ static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp, UN } for (i = 0; i < num_entries; i++) { - pwd = disp_user_info[i+start_idx].sam; + pwd = &disp_user_info[i+start_idx]; temp_name = pdb_get_username(pwd); init_unistr2(&uni_temp_name, temp_name, strlen(temp_name)+1); user_sid = pdb_get_user_sid(pwd); @@ -900,7 +896,7 @@ static NTSTATUS get_group_alias_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM /* well-known aliases */ if (sid_equal(sid, &global_sid_Builtin) && !lp_hide_local_users()) { - pdb_enum_group_mapping(SID_NAME_WKN_GRP, &map, (int *)&num_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV); + pdb_enum_group_mapping(SID_NAME_WKN_GRP, &map, (int *)&num_entries, ENUM_ONLY_MAPPED); if (num_entries != 0) { *d_grp=(DOMAIN_GRP *)talloc_zero(ctx, num_entries*sizeof(DOMAIN_GRP)); @@ -937,7 +933,7 @@ static NTSTATUS get_group_alias_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM for (; (num_entries < max_entries) && (grp != NULL); grp = grp->next) { uint32 trid; - if(!pdb_getgrgid(&smap, grp->gr_gid, MAPPING_WITHOUT_PRIV)) + if(!pdb_getgrgid(&smap, grp->gr_gid)) continue; if (smap.sid_name_use!=SID_NAME_ALIAS) { @@ -1018,7 +1014,7 @@ static NTSTATUS get_group_domain_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DO *p_num_entries = 0; - pdb_enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV); + pdb_enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED); num_entries=group_entries-start_idx; @@ -1128,6 +1124,7 @@ NTSTATUS _samr_enum_dom_aliases(pipes_struct *p, SAMR_Q_ENUM_DOM_ALIASES *q_u, S /******************************************************************* samr_reply_query_dispinfo ********************************************************************/ + NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u, SAMR_R_QUERY_DISPINFO *r_u) { @@ -1346,7 +1343,7 @@ NTSTATUS _samr_query_aliasinfo(pipes_struct *p, SAMR_Q_QUERY_ALIASINFO *q_u, SAM !sid_check_is_in_builtin(&sid)) return NT_STATUS_OBJECT_TYPE_MISMATCH; - if (!pdb_getgrsid(&map, sid, MAPPING_WITHOUT_PRIV)) + if (!pdb_getgrsid(&map, sid)) return NT_STATUS_NO_SUCH_ALIAS; switch (q_u->switch_level) { @@ -2207,6 +2204,7 @@ NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_ uint32 acc_granted; SEC_DESC *psd; size_t sd_size; + uint32 new_rid = 0; /* check this, when giving away 'add computer to domain' privs */ uint32 des_access = GENERIC_RIGHTS_USER_ALL_ACCESS; @@ -2225,7 +2223,7 @@ NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_ */ rpcstr_pull(account, user_account.buffer, sizeof(account), user_account.uni_str_len*2, 0); - strlower(account); + strlower_m(account); pdb_init_sam(&sam_pass); @@ -2262,23 +2260,30 @@ NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_ */ DEBUG(10,("checking account %s at pos %d for $ termination\n",account, strlen(account)-1)); -#if 0 - if ((acb_info & ACB_WSTRUST) && (account[strlen(account)-1] == '$')) { - pstrcpy(add_script, lp_addmachine_script()); - } else if ((!(acb_info & ACB_WSTRUST)) && (account[strlen(account)-1] != '$')) { - pstrcpy(add_script, lp_adduser_script()); - } else { - DEBUG(0, ("_api_samr_create_user: mismatch between trust flags and $ termination\n")); - pdb_free_sam(&sam_pass); - return NT_STATUS_UNSUCCESSFUL; - } -#endif + + /* + * we used to have code here that made sure the acb_info flags + * matched with the users named (e.g. an account flags as a machine + * trust account ended in '$'). It has been ifdef'd out for a long + * time, so I replaced it with this comment. --jerry + */ /* the passdb lookup has failed; check to see if we need to run the add user/machine script */ pw = Get_Pwnam(account); + /********************************************************************* + * HEADS UP! If we have to create a new user account, we have to get + * a new RID from somewhere. This used to be done by the passdb + * backend. It has been moved into idmap now. Since idmap is now + * wrapped up behind winbind, this means you have to run winbindd if you + * want new accounts to get a new RID when "enable rid algorithm = no". + * Tough. We now have a uniform way of allocating RIDs regardless + * of what ever passdb backend people may use. + * --jerry (2003-07-10) + *********************************************************************/ + if ( !pw ) { /* * we can't check both the ending $ and the acb_info. @@ -2298,11 +2303,19 @@ NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_ add_ret = smbrun(add_script,NULL); DEBUG(3,("_api_samr_create_user: Running the command `%s' gave %d\n", add_script, add_ret)); } + else /* no add user script -- ask winbindd to do it */ + { + if ( !winbind_create_user( account, &new_rid ) ) { + DEBUG(3,("_api_samr_create_user: winbind_create_user(%s) failed\n", + account)); + } + } } - nt_status = pdb_init_sam_new(&sam_pass, account); - if (!NT_STATUS_IS_OK(nt_status)) + /* implicit call to getpwnam() next. we have a valid SID coming out of this call */ + + if ( !NT_STATUS_IS_OK(nt_status = pdb_init_sam_new(&sam_pass, account, new_rid)) ) return nt_status; pdb_set_acct_ctrl(sam_pass, acb_info, PDB_CHANGED); @@ -2575,17 +2588,10 @@ NTSTATUS _samr_enum_domains(pipes_struct *p, SAMR_Q_ENUM_DOMAINS *q_u, SAMR_R_EN return r_u->status; } - switch (lp_server_role()) { - case ROLE_DOMAIN_PDC: - case ROLE_DOMAIN_BDC: - name = lp_workgroup(); - break; - default: - name = global_myname(); - } + name = get_global_sam_name(); fstrcpy(dom[0],name); - strupper(dom[0]); + strupper_m(dom[0]); fstrcpy(dom[1],"Builtin"); if (!make_enum_domains(p->mem_ctx, &r_u->sam, &r_u->uni_dom_name, num_entries, dom)) @@ -2737,6 +2743,41 @@ static BOOL set_user_info_12(SAM_USER_INFO_12 *id12, DOM_SID *sid) return True; } +/******************************************************************* + The GROUPSID field in the SAM_ACCOUNT changed. Try to tell unix. + ********************************************************************/ +static BOOL set_unix_primary_group(SAM_ACCOUNT *sampass) +{ + struct group *grp; + gid_t gid; + + if (!NT_STATUS_IS_OK(sid_to_gid(pdb_get_group_sid(sampass), + &gid))) { + DEBUG(2,("Could not get gid for primary group of " + "user %s\n", pdb_get_username(sampass))); + return False; + } + + grp = getgrgid(gid); + + if (grp == NULL) { + DEBUG(2,("Could not find primary group %d for " + "user %s\n", gid, pdb_get_username(sampass))); + return False; + } + + if (smb_set_primary_group(grp->gr_name, + pdb_get_username(sampass)) != 0) { + DEBUG(2,("Could not set primary group for user %s to " + "%s\n", + pdb_get_username(sampass), grp->gr_name)); + return False; + } + + return True; +} + + /******************************************************************* set_user_info_21 ********************************************************************/ @@ -2766,6 +2807,9 @@ static BOOL set_user_info_21(SAM_USER_INFO_21 *id21, DOM_SID *sid) * id21. I don't know if they need to be set. --jerry */ + if (IS_SAM_CHANGED(pwd, PDB_GROUPSID)) + set_unix_primary_group(pwd); + /* write the change out */ if(!pdb_update_sam_account(pwd)) { pdb_free_sam(&pwd); @@ -2833,6 +2877,9 @@ static BOOL set_user_info_23(SAM_USER_INFO_23 *id23, DOM_SID *sid) ZERO_STRUCT(plaintext_buf); + if (IS_SAM_CHANGED(pwd, PDB_GROUPSID)) + set_unix_primary_group(pwd); + if(!pdb_update_sam_account(pwd)) { pdb_free_sam(&pwd); return False; @@ -3181,12 +3228,12 @@ NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_ if (sid_equal(&alias_sid, &global_sid_Builtin)) { DEBUG(10, ("lookup on Builtin SID (S-1-5-32)\n")); - if(!get_builtin_group_from_sid(als_sid, &map, MAPPING_WITHOUT_PRIV)) + if(!get_builtin_group_from_sid(als_sid, &map)) return NT_STATUS_NO_SUCH_ALIAS; } else { if (sid_equal(&alias_sid, get_global_sam_sid())) { DEBUG(10, ("lookup on Server SID\n")); - if(!get_local_group_from_sid(als_sid, &map, MAPPING_WITHOUT_PRIV)) + if(!get_local_group_from_sid(als_sid, &map)) return NT_STATUS_NO_SUCH_ALIAS; } } @@ -3287,7 +3334,7 @@ NTSTATUS _samr_query_groupmem(pipes_struct *p, SAMR_Q_QUERY_GROUPMEM *q_u, SAMR_ sid_append_rid(&group_sid, group_rid); DEBUG(10, ("lookup on Domain SID\n")); - if(!get_domain_group_from_sid(group_sid, &map, MAPPING_WITHOUT_PRIV)) + if(!get_domain_group_from_sid(group_sid, &map)) return NT_STATUS_NO_SUCH_GROUP; if(!get_uid_list_of_group(map.gid, &uid, &num_uids)) @@ -3371,13 +3418,13 @@ NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_AD if (sid_compare(&alias_sid, get_global_sam_sid())>0) { DEBUG(10, ("adding member on Server SID\n")); - if(!get_local_group_from_sid(alias_sid, &map, MAPPING_WITHOUT_PRIV)) + if(!get_local_group_from_sid(alias_sid, &map)) return NT_STATUS_NO_SUCH_ALIAS; } else { if (sid_compare(&alias_sid, &global_sid_Builtin)>0) { DEBUG(10, ("adding member on BUILTIN SID\n")); - if( !get_local_group_from_sid(alias_sid, &map, MAPPING_WITHOUT_PRIV)) + if( !get_local_group_from_sid(alias_sid, &map)) return NT_STATUS_NO_SUCH_ALIAS; } else @@ -3396,7 +3443,7 @@ NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_AD } /* check a real user exist before we run the script to add a user to a group */ - if (NT_STATUS_IS_ERR(sid_to_uid(pdb_get_user_sid(sam_user), &uid))) { + if (!NT_STATUS_IS_OK(sid_to_uid(pdb_get_user_sid(sam_user), &uid))) { pdb_free_sam(&sam_user); return NT_STATUS_NO_SUCH_USER; } @@ -3468,7 +3515,7 @@ NTSTATUS _samr_del_aliasmem(pipes_struct *p, SAMR_Q_DEL_ALIASMEM *q_u, SAMR_R_DE return NT_STATUS_NO_SUCH_ALIAS; } - if( !get_local_group_from_sid(alias_sid, &map, MAPPING_WITHOUT_PRIV)) + if( !get_local_group_from_sid(alias_sid, &map)) return NT_STATUS_NO_SUCH_ALIAS; if ((grp=getgrgid(map.gid)) == NULL) @@ -3538,7 +3585,7 @@ NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_AD DEBUG(10, ("lookup on Domain SID\n")); - if(!get_domain_group_from_sid(group_sid, &map, MAPPING_WITHOUT_PRIV)) + if(!get_domain_group_from_sid(group_sid, &map)) return NT_STATUS_NO_SUCH_GROUP; sid_copy(&user_sid, get_global_sam_sid()); @@ -3556,7 +3603,7 @@ NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_AD } /* check a real user exist before we run the script to add a user to a group */ - if (NT_STATUS_IS_ERR(sid_to_uid(pdb_get_user_sid(sam_user), &uid))) { + if (!NT_STATUS_IS_OK(sid_to_uid(pdb_get_user_sid(sam_user), &uid))) { pdb_free_sam(&sam_user); return NT_STATUS_NO_SUCH_USER; } @@ -3633,7 +3680,7 @@ NTSTATUS _samr_del_groupmem(pipes_struct *p, SAMR_Q_DEL_GROUPMEM *q_u, SAMR_R_DE sid_copy(&user_sid, get_global_sam_sid()); sid_append_rid(&user_sid, q_u->rid); - if (!get_domain_group_from_sid(group_sid, &map, MAPPING_WITHOUT_PRIV)) + if (!get_domain_group_from_sid(group_sid, &map)) return NT_STATUS_NO_SUCH_GROUP; if ((grp=getgrgid(map.gid)) == NULL) @@ -3678,12 +3725,25 @@ static int smb_delete_user(const char *unix_user) pstring del_script; int ret; + /* try winbindd first since it is impossible to determine where + a user came from via NSS. Try the delete user script if this fails + meaning the user did not exist in winbindd's list of accounts */ + + if ( winbind_delete_user( unix_user ) ) { + DEBUG(3,("winbind_delete_user: removed user (%s)\n", unix_user)); + return 0; + } + + + /* fall back to 'delete user script' */ + pstrcpy(del_script, lp_deluser_script()); if (! *del_script) return -1; all_string_sub(del_script, "%u", unix_user, sizeof(pstring)); ret = smbrun(del_script,NULL); DEBUG(3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret)); + return ret; } @@ -3778,7 +3838,7 @@ NTSTATUS _samr_delete_dom_group(pipes_struct *p, SAMR_Q_DELETE_DOM_GROUP *q_u, S DEBUG(10, ("lookup on Domain SID\n")); - if(!get_domain_group_from_sid(group_sid, &map, MAPPING_WITHOUT_PRIV)) + if(!get_domain_group_from_sid(group_sid, &map)) return NT_STATUS_NO_SUCH_GROUP; gid=map.gid; @@ -3840,7 +3900,7 @@ NTSTATUS _samr_delete_dom_alias(pipes_struct *p, SAMR_Q_DELETE_DOM_ALIAS *q_u, S DEBUG(10, ("lookup on Local SID\n")); - if(!get_local_group_from_sid(alias_sid, &map, MAPPING_WITHOUT_PRIV)) + if(!get_local_group_from_sid(alias_sid, &map)) return NT_STATUS_NO_SUCH_ALIAS; gid=map.gid; @@ -3877,12 +3937,9 @@ NTSTATUS _samr_create_dom_group(pipes_struct *p, SAMR_Q_CREATE_DOM_GROUP *q_u, S fstring sid_string; struct group *grp; struct samr_info *info; - PRIVILEGE_SET priv_set; uint32 acc_granted; gid_t gid; - init_privilege(&priv_set); - /* Find the policy handle. Open a policy on it. */ if (!get_lsa_policy_samr_sid(p, &q_u->pol, &dom_sid, &acc_granted)) return NT_STATUS_INVALID_HANDLE; @@ -3917,7 +3974,7 @@ NTSTATUS _samr_create_dom_group(pipes_struct *p, SAMR_Q_CREATE_DOM_GROUP *q_u, S sid_append_rid(&info_sid, r_u->rid); sid_to_string(sid_string, &info_sid); - if(!add_initial_entry(grp->gr_gid, sid_string, SID_NAME_DOM_GRP, name, NULL, priv_set, PR_ACCESS_FROM_NETWORK)) + if(!add_initial_entry(grp->gr_gid, sid_string, SID_NAME_DOM_GRP, name, NULL)) return NT_STATUS_ACCESS_DENIED; if ((info = get_samr_info_by_sid(&info_sid)) == NULL) @@ -3942,12 +3999,9 @@ NTSTATUS _samr_create_dom_alias(pipes_struct *p, SAMR_Q_CREATE_DOM_ALIAS *q_u, S fstring sid_string; struct group *grp; struct samr_info *info; - PRIVILEGE_SET priv_set; uint32 acc_granted; gid_t gid; - init_privilege(&priv_set); - /* Find the policy handle. Open a policy on it. */ if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &dom_sid, &acc_granted)) return NT_STATUS_INVALID_HANDLE; @@ -3982,7 +4036,7 @@ NTSTATUS _samr_create_dom_alias(pipes_struct *p, SAMR_Q_CREATE_DOM_ALIAS *q_u, S sid_to_string(sid_string, &info_sid); /* add the group to the mapping table */ - if(!add_initial_entry(grp->gr_gid, sid_string, SID_NAME_ALIAS, name, NULL, priv_set, PR_ACCESS_FROM_NETWORK)) + if(!add_initial_entry(grp->gr_gid, sid_string, SID_NAME_ALIAS, name, NULL)) return NT_STATUS_ACCESS_DENIED; if ((info = get_samr_info_by_sid(&info_sid)) == NULL) @@ -4018,7 +4072,7 @@ NTSTATUS _samr_query_groupinfo(pipes_struct *p, SAMR_Q_QUERY_GROUPINFO *q_u, SAM return r_u->status; } - if (!get_domain_group_from_sid(group_sid, &map, MAPPING_WITHOUT_PRIV)) + if (!get_domain_group_from_sid(group_sid, &map)) return NT_STATUS_INVALID_HANDLE; ctr=(GROUP_INFO_CTR *)talloc_zero(p->mem_ctx, sizeof(GROUP_INFO_CTR)); @@ -4070,7 +4124,7 @@ NTSTATUS _samr_set_groupinfo(pipes_struct *p, SAMR_Q_SET_GROUPINFO *q_u, SAMR_R_ return r_u->status; } - if (!get_domain_group_from_sid(group_sid, &map, MAPPING_WITH_PRIV)) + if (!get_domain_group_from_sid(group_sid, &map)) return NT_STATUS_NO_SUCH_GROUP; ctr=q_u->ctr; @@ -4083,17 +4137,13 @@ NTSTATUS _samr_set_groupinfo(pipes_struct *p, SAMR_Q_SET_GROUPINFO *q_u, SAMR_R_ unistr2_to_ascii(map.comment, &(ctr->group.info4.uni_acct_desc), sizeof(map.comment)-1); break; default: - free_privilege(&map.priv_set); return NT_STATUS_INVALID_INFO_CLASS; } if(!pdb_update_group_mapping_entry(&map)) { - free_privilege(&map.priv_set); return NT_STATUS_NO_SUCH_GROUP; } - free_privilege(&map.priv_set); - return NT_STATUS_OK; } @@ -4117,7 +4167,7 @@ NTSTATUS _samr_set_aliasinfo(pipes_struct *p, SAMR_Q_SET_ALIASINFO *q_u, SAMR_R_ return r_u->status; } - if (!get_local_group_from_sid(group_sid, &map, MAPPING_WITH_PRIV)) + if (!get_local_group_from_sid(group_sid, &map)) return NT_STATUS_NO_SUCH_GROUP; ctr=&q_u->ctr; @@ -4127,17 +4177,13 @@ NTSTATUS _samr_set_aliasinfo(pipes_struct *p, SAMR_Q_SET_ALIASINFO *q_u, SAMR_R_ unistr2_to_ascii(map.comment, &(ctr->alias.info3.uni_acct_desc), sizeof(map.comment)-1); break; default: - free_privilege(&map.priv_set); return NT_STATUS_INVALID_INFO_CLASS; } if(!pdb_update_group_mapping_entry(&map)) { - free_privilege(&map.priv_set); return NT_STATUS_NO_SUCH_GROUP; } - free_privilege(&map.priv_set); - return NT_STATUS_OK; } @@ -4212,7 +4258,7 @@ NTSTATUS _samr_open_group(pipes_struct *p, SAMR_Q_OPEN_GROUP *q_u, SAMR_R_OPEN_G DEBUG(10, ("_samr_open_group:Opening SID: %s\n", sid_string)); /* check if that group really exists */ - if (!get_domain_group_from_sid(info->sid, &map, MAPPING_WITHOUT_PRIV)) + if (!get_domain_group_from_sid(info->sid, &map)) return NT_STATUS_NO_SUCH_GROUP; /* get a (unique) handle. open a policy on it. */ diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c index 24459a26f0..2d316051af 100644 --- a/source3/rpc_server/srv_spoolss_nt.c +++ b/source3/rpc_server/srv_spoolss_nt.c @@ -273,7 +273,34 @@ static Printer_entry *find_printer_index_by_hnd(pipes_struct *p, POLICY_HND *hnd } /**************************************************************************** - find printer index by handle + look for a printer object cached on an open printer handle +****************************************************************************/ + +WERROR find_printer_in_print_hnd_cache( TALLOC_CTX *ctx, NT_PRINTER_INFO_LEVEL_2 **info2, + const char *printername ) +{ + Printer_entry *p; + + DEBUG(10,("find_printer_in_print_hnd_cache: printer [%s]\n", printername)); + + for ( p=printers_list; p; p=p->next ) + { + if ( p->printer_type==PRINTER_HANDLE_IS_PRINTER + && p->printer_info + && StrCaseCmp(p->dev.handlename, printername) == 0 ) + { + DEBUG(10,("Found printer\n")); + *info2 = dup_printer_2( ctx, p->printer_info->info_2 ); + if ( *info2 ) + return WERR_OK; + } + } + + return WERR_INVALID_PRINTER_NAME; +} + +/**************************************************************************** + destroy any cached printer_info_2 structures on open handles ****************************************************************************/ void invalidate_printer_hnd_cache( char *printername ) @@ -1025,9 +1052,9 @@ static void send_notify2_changes( SPOOLSS_NOTIFY_MSG_CTR *ctr, uint32 idx ) } if ( sending_msg_count ) { - cli_spoolss_rrpcn( ¬ify_cli, mem_ctx, &p->notify.client_hnd, - data_len, data, p->notify.change, 0 ); - } + cli_spoolss_rrpcn( ¬ify_cli, mem_ctx, &p->notify.client_hnd, + data_len, data, p->notify.change, 0 ); + } } done: @@ -2339,7 +2366,6 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint return WERR_OK; } -#if 0 /* JERRY */ /* REG_BINARY * uint32 size = 0x114 * uint32 major = 5 @@ -2348,14 +2374,23 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint * extra unicode string = e.g. "Service Pack 3" */ if (!StrCaseCmp(value, "OSVersion")) { - *type = 0x4; - if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL) + *type = 0x3; + *needed = 0x114; + + if((*data = (uint8 *)talloc(ctx, (*needed)*sizeof(uint8) )) == NULL) return WERR_NOMEM; - SIVAL(*data, 0, 2); - *needed = 0x4; + ZERO_STRUCTP( *data ); + + SIVAL(*data, 0, *needed); /* size */ + SIVAL(*data, 4, 5); /* Windows 2000 == 5.0 */ + SIVAL(*data, 8, 0); + SIVAL(*data, 12, 2195); /* build */ + + /* leave extra string empty */ + return WERR_OK; } -#endif + if (!StrCaseCmp(value, "DefaultSpoolDirectory")) { fstring string; @@ -4330,8 +4365,8 @@ static BOOL construct_printer_info_7(Printer_entry *print_hnd, PRINTER_INFO_7 *p GUID guid; if (is_printer_published(print_hnd, snum, &guid)) { - asprintf(&guid_str, "{%s}", uuid_string_static(guid)); - strupper(guid_str); + asprintf(&guid_str, "{%s}", smb_uuid_string_static(guid)); + strupper_m(guid_str); init_unistr(&printer->guid, guid_str); printer->action = SPOOL_DS_PUBLISH; } else { @@ -4681,7 +4716,7 @@ WERROR _spoolss_enumprinters( pipes_struct *p, SPOOL_Q_ENUMPRINTERS *q_u, SPOOL_ */ unistr2_to_ascii(name, servername, sizeof(name)-1); - strupper(name); + strupper_m(name); switch (level) { case 1: @@ -7609,12 +7644,12 @@ static WERROR getprinterdriverdir_level_1(UNISTR2 *name, UNISTR2 *uni_environmen { pstring path; pstring long_archi; - pstring short_archi; + const char *short_archi; DRIVER_DIRECTORY_1 *info=NULL; unistr2_to_ascii(long_archi, uni_environment, sizeof(long_archi)-1); - if (get_short_archi(short_archi, long_archi)==False) + if (!(short_archi = get_short_archi(long_archi))) return WERR_INVALID_ENVIRONMENT; if((info=(DRIVER_DIRECTORY_1 *)malloc(sizeof(DRIVER_DIRECTORY_1))) == NULL) @@ -8440,7 +8475,7 @@ WERROR _spoolss_enumprintmonitors(pipes_struct *p, SPOOL_Q_ENUMPRINTMONITORS *q_ /**************************************************************************** ****************************************************************************/ -static WERROR getjob_level_1(print_queue_struct *queue, int count, int snum, uint32 jobid, NEW_BUFFER *buffer, uint32 offered, uint32 *needed) +static WERROR getjob_level_1(print_queue_struct **queue, int count, int snum, uint32 jobid, NEW_BUFFER *buffer, uint32 offered, uint32 *needed) { int i=0; BOOL found=False; @@ -8453,7 +8488,7 @@ static WERROR getjob_level_1(print_queue_struct *queue, int count, int snum, uin } for (i=0; idfs_root_flag = 0; + sh1005->share_info_flags = 0; if(lp_host_msdfs() && lp_msdfs_root(snum)) - sh1005->dfs_root_flag = 3; + sh1005->share_info_flags |= + SHARE_1005_IN_DFS | SHARE_1005_DFS_ROOT; + sh1005->share_info_flags |= + lp_csc_policy(snum) << SHARE_1005_CSC_POLICY_SHIFT; } /*************************************************************************** Fill in a share info level 1006 structure. @@ -1513,6 +1516,19 @@ WERROR _srv_net_share_set_info(pipes_struct *p, SRV_Q_NET_SHARE_SET_INFO *q_u, S type = STYPE_DISKTREE; break; case 1005: + /* XP re-sets the csc policy even if it wasn't changed by the + user, so we must compare it to see if it's what is set in + smb.conf, so that we can contine other ops like setting + ACLs on a share */ + if (((q_u->info.share.info1005.share_info_flags & + SHARE_1005_CSC_POLICY_MASK) >> + SHARE_1005_CSC_POLICY_SHIFT) == lp_csc_policy(snum)) + return WERR_OK; + else { + DEBUG(3, ("_srv_net_share_set_info: client is trying to change csc policy from the network; must be done with smb.conf\n")); + return WERR_ACCESS_DENIED; + } + break; case 1006: case 1007: return WERR_ACCESS_DENIED; @@ -1840,8 +1856,6 @@ WERROR _srv_net_file_query_secdesc(pipes_struct *p, SRV_Q_NET_FILE_QUERY_SECDESC struct current_user user; connection_struct *conn = NULL; BOOL became_user = False; - fstring dev; - fstrcpy(dev, "A:"); ZERO_STRUCT(st); @@ -1855,7 +1869,7 @@ WERROR _srv_net_file_query_secdesc(pipes_struct *p, SRV_Q_NET_FILE_QUERY_SECDESC get_current_user(&user, p); become_root(); - conn = make_connection(qualname, null_pw, dev, user.vuid, &nt_status); + conn = make_connection(qualname, null_pw, "A:", user.vuid, &nt_status); unbecome_root(); if (conn == NULL) { @@ -1889,7 +1903,7 @@ WERROR _srv_net_file_query_secdesc(pipes_struct *p, SRV_Q_NET_FILE_QUERY_SECDESC } } - sd_size = conn->vfs_ops.get_nt_acl(fsp, fsp->fsp_name, &psd); + sd_size = SMB_VFS_GET_NT_ACL(fsp, fsp->fsp_name, (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION), &psd); if (sd_size == 0) { DEBUG(3,("_srv_net_file_query_secdesc: Unable to get NT ACL for file %s\n", filename)); @@ -1945,12 +1959,9 @@ WERROR _srv_net_file_set_secdesc(pipes_struct *p, SRV_Q_NET_FILE_SET_SECDESC *q_ struct current_user user; connection_struct *conn = NULL; BOOL became_user = False; - fstring dev; - fstrcpy(dev, "A:"); ZERO_STRUCT(st); - r_u->status = WERR_OK; unistr2_to_ascii(qualname, &q_u->uni_qual_name, sizeof(qualname)); @@ -1961,7 +1972,7 @@ WERROR _srv_net_file_set_secdesc(pipes_struct *p, SRV_Q_NET_FILE_SET_SECDESC *q_ get_current_user(&user, p); become_root(); - conn = make_connection(qualname, null_pw, dev, user.vuid, &nt_status); + conn = make_connection(qualname, null_pw, "A:", user.vuid, &nt_status); unbecome_root(); if (conn == NULL) { @@ -1996,7 +2007,7 @@ WERROR _srv_net_file_set_secdesc(pipes_struct *p, SRV_Q_NET_FILE_SET_SECDESC *q_ } } - ret = conn->vfs_ops.set_nt_acl(fsp, fsp->fsp_name, q_u->sec_info, q_u->sec_desc); + ret = SMB_VFS_SET_NT_ACL(fsp, fsp->fsp_name, q_u->sec_info, q_u->sec_desc); if (ret == False) { DEBUG(3,("_srv_net_file_set_secdesc: Unable to set NT ACL on file %s\n", filename)); diff --git a/source3/rpc_server/srv_util.c b/source3/rpc_server/srv_util.c index f96ccaef67..03e53118a8 100644 --- a/source3/rpc_server/srv_util.c +++ b/source3/rpc_server/srv_util.c @@ -129,7 +129,7 @@ NTSTATUS get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups, ui fstrcpy(user_name, pdb_get_username(sam_pass)); grid=pdb_get_group_rid(sam_pass); - if (NT_STATUS_IS_ERR(sid_to_gid(pdb_get_group_sid(sam_pass), &gid))) { + if (!NT_STATUS_IS_OK(sid_to_gid(pdb_get_group_sid(sam_pass), &gid))) { /* this should never happen */ DEBUG(2,("get_alias_user_groups: sid_to_gid failed!\n")); pdb_free_sam(&sam_pass); @@ -147,14 +147,17 @@ NTSTATUS get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups, ui return NT_STATUS_UNSUCCESSFUL; } + become_root(); + for (i=0;i\n", argv[0]); - return NT_STATUS_OK; - } - - right = argv[1]; - - result = cli_lsa_open_policy2(cli, mem_ctx, True, - SEC_RIGHTS_MAXIMUM_ALLOWED, - &dom_pol); - - if (!NT_STATUS_IS_OK(result)) - goto done; - - result = cli_lsa_enum_account_with_right(cli, mem_ctx, &dom_pol, right, &count, &sids); - - if (!NT_STATUS_IS_OK(result)) - goto done; - - printf("found %d SIDs for '%s'\n", count, right); - - for (i = 0; i < count; i++) { - printf("\t%s\n", sid_string_static(&sids[i])); - } - - done: - return result; -} - - /* add some privileges to a SID via LsaAddAccountRights */ static NTSTATUS cmd_lsa_add_acct_rights(struct cli_state *cli, @@ -750,7 +706,6 @@ struct cmd_set lsarpc_commands[] = { { "lsaenumsid", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_sids, NULL, PI_LSARPC, "Enumerate the LSA SIDS", "" }, { "lsaenumprivsaccount", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privsaccounts, NULL, PI_LSARPC, "Enumerate the privileges of an SID", "" }, { "lsaenumacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_acct_rights, NULL, PI_LSARPC, "Enumerate the rights of an SID", "" }, - { "lsaenumacctwithright",RPC_RTYPE_NTSTATUS, cmd_lsa_enum_acct_with_right,NULL, PI_LSARPC,"Enumerate accounts with a right", "" }, { "lsaaddacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_add_acct_rights, NULL, PI_LSARPC, "Add rights to an account", "" }, { "lsaremoveacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_remove_acct_rights, NULL, PI_LSARPC, "Remove rights from an account", "" }, { "lsalookupprivvalue", RPC_RTYPE_NTSTATUS, cmd_lsa_lookupprivvalue, NULL, PI_LSARPC, "Get a privilege value given its name", "" }, diff --git a/source3/rpcclient/cmd_netlogon.c b/source3/rpcclient/cmd_netlogon.c index 32fa9c3699..0ec78a0673 100644 --- a/source3/rpcclient/cmd_netlogon.c +++ b/source3/rpcclient/cmd_netlogon.c @@ -275,6 +275,7 @@ static NTSTATUS cmd_netlogon_sam_logon(struct cli_state *cli, const char *username, *password; uint32 neg_flags = 0x000001ff; int auth_level = 2; + DOM_CRED ret_creds; /* Check arguments */ @@ -299,7 +300,13 @@ static NTSTATUS cmd_netlogon_sam_logon(struct cli_state *cli, /* Perform the sam logon */ - result = cli_netlogon_sam_logon(cli, mem_ctx, username, password, logon_type); + ZERO_STRUCT(ret_creds); + + result = cli_netlogon_sam_logon(cli, mem_ctx, &ret_creds, username, password, logon_type); + + clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds); + + result = cli_netlogon_sam_logon(cli, mem_ctx, &ret_creds, username, password, logon_type); if (!NT_STATUS_IS_OK(result)) goto done; diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c index e2232f0da7..40d01d0f5a 100644 --- a/source3/rpcclient/cmd_samr.c +++ b/source3/rpcclient/cmd_samr.c @@ -288,8 +288,8 @@ static NTSTATUS cmd_samr_query_user(struct cli_state *cli, sscanf(argv[3], "%x", &access_mask); - slprintf (server, sizeof(fstring)-1, "\\\\%s", cli->desthost); - strupper (server); + slprintf(server, sizeof(fstring)-1, "\\\\%s", cli->desthost); + strupper_m(server); result = try_samr_connects(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS, &connect_pol); @@ -396,8 +396,8 @@ static NTSTATUS cmd_samr_query_group(struct cli_state *cli, if (argc > 3) sscanf(argv[3], "%x", &access_mask); - slprintf (server, sizeof(fstring)-1, "\\\\%s", cli->desthost); - strupper (server); + slprintf(server, sizeof(fstring)-1, "\\\\%s", cli->desthost); + strupper_m(server); result = try_samr_connects(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS, &connect_pol); @@ -458,8 +458,8 @@ static NTSTATUS cmd_samr_query_usergroups(struct cli_state *cli, if (argc > 2) sscanf(argv[2], "%x", &access_mask); - slprintf (server, sizeof(fstring)-1, "\\\\%s", cli->desthost); - strupper (server); + slprintf(server, sizeof(fstring)-1, "\\\\%s", cli->desthost); + strupper_m(server); result = try_samr_connects(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS, &connect_pol); @@ -524,8 +524,8 @@ static NTSTATUS cmd_samr_query_useraliases(struct cli_state *cli, if (argc > 3) sscanf(argv[3], "%x", &access_mask); - slprintf (server, sizeof(fstring)-1, "\\\\%s", cli->desthost); - strupper (server); + slprintf(server, sizeof(fstring)-1, "\\\\%s", cli->desthost); + strupper_m(server); result = try_samr_connects(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS, &connect_pol); @@ -587,8 +587,8 @@ static NTSTATUS cmd_samr_query_groupmem(struct cli_state *cli, if (argc > 2) sscanf(argv[2], "%x", &access_mask); - slprintf (server, sizeof(fstring)-1, "\\\\%s", cli->desthost); - strupper (server); + slprintf(server, sizeof(fstring)-1, "\\\\%s", cli->desthost); + strupper_m(server); result = try_samr_connects(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS, &connect_pol); @@ -1415,8 +1415,8 @@ static NTSTATUS cmd_samr_query_sec_obj(struct cli_state *cli, sscanf(argv[1], "%i", &user_rid); } - slprintf (server, sizeof(fstring)-1, "\\\\%s", cli->desthost); - strupper (server); + slprintf(server, sizeof(fstring)-1, "\\\\%s", cli->desthost); + strupper_m(server); result = try_samr_connects(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS, &connect_pol); diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c index 3ce7f9e6ac..b2fa802e9a 100644 --- a/source3/rpcclient/cmd_spoolss.c +++ b/source3/rpcclient/cmd_spoolss.c @@ -54,7 +54,7 @@ static const struct table_node archi_table[]= { function to do the mapping between the long architecture name and the short one. ****************************************************************************/ -BOOL get_short_archi(char *short_archi, const char *long_archi) +static const char *cmd_spoolss_get_short_archi(const char *long_archi) { int i=-1; @@ -66,18 +66,17 @@ BOOL get_short_archi(char *short_archi, const char *long_archi) if (archi_table[i].long_archi==NULL) { DEBUGADD(10,("Unknown architecture [%s] !\n", long_archi)); - return False; + return NULL; } /* this might be client code - but shouldn't this be an fstrcpy etc? */ - StrnCpy (short_archi, archi_table[i].short_archi, strlen(archi_table[i].short_archi)); DEBUGADD(108,("index: [%d]\n", i)); - DEBUGADD(108,("long architecture: [%s]\n", long_archi)); - DEBUGADD(108,("short architecture: [%s]\n", short_archi)); + DEBUGADD(108,("long architecture: [%s]\n", archi_table[i].long_archi)); + DEBUGADD(108,("short architecture: [%s]\n", archi_table[i].short_archi)); - return True; + return archi_table[i].short_archi; } #if 0 @@ -113,10 +112,10 @@ static WERROR cmd_spoolss_open_printer_ex(struct cli_state *cli, if (!cli) return WERR_GENERAL_FAILURE; - slprintf (servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper (servername); - fstrcpy (user, cli->user_name); - fstrcpy (printername, argv[1]); + slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); + strupper_m(servername); + fstrcpy(user, cli->user_name); + fstrcpy(printername, argv[1]); /* Open the printer handle */ @@ -321,7 +320,7 @@ static WERROR cmd_spoolss_enum_printers(struct cli_state *cli, fstrcpy(name, argv[2]); else { slprintf(name, sizeof(name)-1, "\\\\%s", cli->desthost); - strupper(name); + strupper_m(name); } /* Enumerate printers -- Should we enumerate types other @@ -481,14 +480,14 @@ static WERROR cmd_spoolss_setprinter(struct cli_state *cli, fstrcpy(comment, argv[2]); } - slprintf (servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper (servername); - fstrcpy (printername, argv[1]); - fstrcpy (user, cli->user_name); + slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); + strupper_m(servername); + fstrcpy(printername, argv[1]); + fstrcpy(user, cli->user_name); /* get a printer handle */ result = cli_spoolss_open_printer_ex(cli, mem_ctx, printername, "", - MAXIMUM_ALLOWED_ACCESS, servername, + PRINTER_ALL_ACCESS, servername, user, &pol); if (!W_ERROR_IS_OK(result)) @@ -549,10 +548,10 @@ static WERROR cmd_spoolss_getprinter(struct cli_state *cli, info_level = atoi(argv[2]); } - slprintf (servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper (servername); - slprintf (printername, sizeof(printername)-1, "%s\\%s", servername, argv[1]); - fstrcpy (user, cli->user_name); + slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); + strupper_m(servername); + slprintf(printername, sizeof(printername)-1, "%s\\%s", servername, argv[1]); + fstrcpy(user, cli->user_name); /* get a printer handle */ @@ -667,14 +666,14 @@ static WERROR cmd_spoolss_getprinterdata(struct cli_state *cli, /* Open a printer handle */ - slprintf (servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper (servername); + slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); + strupper_m(servername); if (strncmp(argv[1], ".", sizeof(".")) == 0) fstrcpy(printername, servername); else - slprintf (printername, sizeof(servername)-1, "%s\\%s", + slprintf(printername, sizeof(servername)-1, "%s\\%s", servername, argv[1]); - fstrcpy (user, cli->user_name); + fstrcpy(user, cli->user_name); /* get a printer handle */ @@ -740,14 +739,14 @@ static WERROR cmd_spoolss_getprinterdataex(struct cli_state *cli, /* Open a printer handle */ - slprintf (servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper (servername); + slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); + strupper_m(servername); if (strncmp(argv[1], ".", sizeof(".")) == 0) fstrcpy(printername, servername); else - slprintf (printername, sizeof(printername)-1, "%s\\%s", + slprintf(printername, sizeof(printername)-1, "%s\\%s", servername, argv[1]); - fstrcpy (user, cli->user_name); + fstrcpy(user, cli->user_name); /* get a printer handle */ @@ -921,10 +920,10 @@ static WERROR cmd_spoolss_getdriver(struct cli_state *cli, } /* get the arguments need to open the printer handle */ - slprintf (servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper (servername); - fstrcpy (user, cli->user_name); - fstrcpy (printername, argv[1]); + slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); + strupper_m(servername); + fstrcpy(user, cli->user_name); + fstrcpy(printername, argv[1]); if (argc == 3) info_level = atoi(argv[2]); @@ -1153,7 +1152,7 @@ static char* get_driver_3_param (const char* str, const char* delim, UNISTR* des parameter because two consecutive delimiters will not return an empty string. See man strtok(3) for details */ - if (StrCaseCmp(ptr, "NULL") == 0) + if (ptr && (StrCaseCmp(ptr, "NULL") == 0)) ptr = NULL; if (dest != NULL) @@ -1227,7 +1226,7 @@ static WERROR cmd_spoolss_addprinterdriver(struct cli_state *cli, uint32 level = 3; PRINTER_DRIVER_CTR ctr; DRIVER_INFO_3 info3; - fstring arch; + const char *arch; fstring driver_name; /* parse the command arguements */ @@ -1243,7 +1242,7 @@ static WERROR cmd_spoolss_addprinterdriver(struct cli_state *cli, /* Fill in the DRIVER_INFO_3 struct */ ZERO_STRUCT(info3); - if (!get_short_archi(arch, argv[1])) + if (!(arch = cmd_spoolss_get_short_archi(argv[1]))) { printf ("Error Unknown architechture [%s]\n", argv[1]); return WERR_INVALID_PARAM; @@ -1289,8 +1288,8 @@ static WERROR cmd_spoolss_addprinterex(struct cli_state *cli, return WERR_OK; } - slprintf (servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper (servername); + slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); + strupper_m(servername); /* Fill in the DRIVER_INFO_3 struct */ ZERO_STRUCT(info2); @@ -1351,10 +1350,10 @@ static WERROR cmd_spoolss_setdriver(struct cli_state *cli, return WERR_OK; } - slprintf (servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper (servername); - slprintf (printername, sizeof(printername)-1, "%s\\%s", servername, argv[1]); - fstrcpy (user, cli->user_name); + slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); + strupper_m(servername); + slprintf(printername, sizeof(printername)-1, "%s\\%s", servername, argv[1]); + fstrcpy(user, cli->user_name); /* Get a printer handle */ @@ -1422,8 +1421,8 @@ static WERROR cmd_spoolss_deletedriver(struct cli_state *cli, return WERR_OK; } - slprintf (servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper (servername); + slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); + strupper_m(servername); /* delete the driver for all architectures */ for (i=0; archi_table[i].long_archi; i++) @@ -1466,7 +1465,7 @@ static WERROR cmd_spoolss_getprintprocdir(struct cli_state *cli, if (asprintf(&servername, "\\\\%s", cli->desthost) < 0) return WERR_NOMEM; - strupper(servername); + strupper_m(servername); if (asprintf(&environment, "%s", (argc == 2) ? argv[1] : PRINTER_DRIVER_ARCHITECTURE) < 0) { @@ -1512,7 +1511,7 @@ static WERROR cmd_spoolss_addform(struct cli_state *cli, TALLOC_CTX *mem_ctx, /* Get a printer handle */ asprintf(&servername, "\\\\%s", cli->desthost); - strupper(servername); + strupper_m(servername); asprintf(&printername, "%s\\%s", servername, argv[1]); werror = cli_spoolss_open_printer_ex(cli, mem_ctx, printername, "", @@ -1571,7 +1570,7 @@ static WERROR cmd_spoolss_setform(struct cli_state *cli, TALLOC_CTX *mem_ctx, /* Get a printer handle */ asprintf(&servername, "\\\\%s", cli->desthost); - strupper(servername); + strupper_m(servername); asprintf(&printername, "%s\\%s", servername, argv[1]); werror = cli_spoolss_open_printer_ex( @@ -1630,7 +1629,7 @@ static WERROR cmd_spoolss_getform(struct cli_state *cli, TALLOC_CTX *mem_ctx, /* Get a printer handle */ asprintf(&servername, "\\\\%s", cli->desthost); - strupper(servername); + strupper_m(servername); asprintf(&printername, "%s\\%s", servername, argv[1]); werror = cli_spoolss_open_printer_ex( @@ -1692,7 +1691,7 @@ static WERROR cmd_spoolss_deleteform(struct cli_state *cli, /* Get a printer handle */ asprintf(&servername, "\\\\%s", cli->desthost); - strupper(servername); + strupper_m(servername); asprintf(&printername, "%s\\%s", servername, argv[1]); werror = cli_spoolss_open_printer_ex( @@ -1741,7 +1740,7 @@ static WERROR cmd_spoolss_enum_forms(struct cli_state *cli, /* Get a printer handle */ asprintf(&servername, "\\\\%s", cli->desthost); - strupper(servername); + strupper_m(servername); asprintf(&printername, "%s\\%s", servername, argv[1]); werror = cli_spoolss_open_printer_ex( @@ -1807,10 +1806,10 @@ static WERROR cmd_spoolss_setprinterdata(struct cli_state *cli, return WERR_OK; } - slprintf (servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper (servername); - slprintf (printername, sizeof(servername)-1, "%s\\%s", servername, argv[1]); - fstrcpy (user, cli->user_name); + slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); + strupper_m(servername); + slprintf(printername, sizeof(servername)-1, "%s\\%s", servername, argv[1]); + fstrcpy(user, cli->user_name); /* get a printer handle */ result = cli_spoolss_open_printer_ex(cli, mem_ctx, printername, "", @@ -1930,10 +1929,10 @@ static WERROR cmd_spoolss_enum_jobs(struct cli_state *cli, /* Open printer handle */ slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper(servername); + strupper_m(servername); fstrcpy(user, cli->user_name); slprintf(printername, sizeof(servername)-1, "\\\\%s\\", cli->desthost); - strupper(printername); + strupper_m(printername); pstrcat(printername, argv[1]); result = cli_spoolss_open_printer_ex(cli, mem_ctx, printername, @@ -2001,10 +2000,10 @@ static WERROR cmd_spoolss_enum_data( struct cli_state *cli, /* Open printer handle */ slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper(servername); + strupper_m(servername); fstrcpy(user, cli->user_name); slprintf(printername, sizeof(printername)-1, "\\\\%s\\", cli->desthost); - strupper(printername); + strupper_m(printername); pstrcat(printername, argv[1]); result = cli_spoolss_open_printer_ex(cli, mem_ctx, printername, @@ -2064,10 +2063,10 @@ static WERROR cmd_spoolss_enum_data_ex( struct cli_state *cli, /* Open printer handle */ slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper(servername); + strupper_m(servername); fstrcpy(user, cli->user_name); slprintf(printername, sizeof(printername)-1, "\\\\%s\\", cli->desthost); - strupper(printername); + strupper_m(printername); pstrcat(printername, argv[1]); result = cli_spoolss_open_printer_ex(cli, mem_ctx, printername, @@ -2132,10 +2131,10 @@ static WERROR cmd_spoolss_enum_printerkey( struct cli_state *cli, /* Open printer handle */ slprintf(servername, sizeof(servername)-1, "\\\\%s", cli->desthost); - strupper(servername); + strupper_m(servername); fstrcpy(user, cli->user_name); slprintf(printername, sizeof(printername)-1, "\\\\%s\\", cli->desthost); - strupper(printername); + strupper_m(printername); pstrcat(printername, argv[1]); result = cli_spoolss_open_printer_ex(cli, mem_ctx, printername, @@ -2197,11 +2196,11 @@ static WERROR cmd_spoolss_rffpcnex(struct cli_state *cli, /* Open printer */ slprintf(servername, sizeof(servername) - 1, "\\\\%s", cli->desthost); - strupper(servername); + strupper_m(servername); slprintf(printername, sizeof(printername) - 1, "\\\\%s\\%s", cli->desthost, argv[1]); - strupper(printername); + strupper_m(printername); result = cli_spoolss_open_printer_ex( cli, mem_ctx, printername, "", MAXIMUM_ALLOWED_ACCESS, @@ -2240,7 +2239,7 @@ static WERROR cmd_spoolss_rffpcnex(struct cli_state *cli, /* Send rffpcnex */ slprintf(servername, sizeof(servername) - 1, "\\\\%s", myhostname()); - strupper(servername); + strupper_m(servername); result = cli_spoolss_rffpcnex( cli, mem_ctx, &hnd, 0, 0, servername, 123, &option); diff --git a/source3/rpcclient/cmd_wkssvc.c b/source3/rpcclient/cmd_wkssvc.c index bb118234c0..137ff3bdae 100644 --- a/source3/rpcclient/cmd_wkssvc.c +++ b/source3/rpcclient/cmd_wkssvc.c @@ -44,7 +44,7 @@ void cmd_wks_query_info(struct client_info *info) fstrcpy(dest_wks, "\\\\"); fstrcat(dest_wks, info->dest_host); - strupper(dest_wks); + strupper_m(dest_wks); if (next_token_nr(NULL, tmp, NULL, sizeof(tmp))) { diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c index b01e2d694c..af021962f5 100644 --- a/source3/rpcclient/rpcclient.c +++ b/source3/rpcclient/rpcclient.c @@ -37,6 +37,21 @@ static struct cmd_list { struct cmd_set *cmd_set; } *cmd_list; +/***************************************************************************** + stubb functions +****************************************************************************/ + +void become_root( void ) +{ + return; +} + +void unbecome_root( void ) +{ + return; +} + + /**************************************************************************** handle completion of commands for readline ****************************************************************************/ @@ -304,6 +319,119 @@ static NTSTATUS cmd_quit(struct cli_state *cli, TALLOC_CTX *mem_ctx, return NT_STATUS_OK; /* NOTREACHED */ } +static NTSTATUS cmd_sign(struct cli_state *cli, TALLOC_CTX *mem_ctx, + int argc, const char **argv) +{ + if (cli->pipe_auth_flags == (AUTH_PIPE_NTLMSSP|AUTH_PIPE_SIGN)) { + return NT_STATUS_OK; + } else { + /* still have session, just need to use it again */ + cli->pipe_auth_flags = AUTH_PIPE_NTLMSSP; + cli->pipe_auth_flags |= AUTH_PIPE_SIGN; + if (cli->nt_pipe_fnum != 0) + cli_nt_session_close(cli); + } + + return NT_STATUS_OK; +} + +static NTSTATUS cmd_seal(struct cli_state *cli, TALLOC_CTX *mem_ctx, + int argc, const char **argv) +{ + if (cli->pipe_auth_flags == (AUTH_PIPE_NTLMSSP|AUTH_PIPE_SIGN|AUTH_PIPE_SEAL)) { + return NT_STATUS_OK; + } else { + /* still have session, just need to use it again */ + cli->pipe_auth_flags = AUTH_PIPE_NTLMSSP; + cli->pipe_auth_flags |= AUTH_PIPE_SIGN; + cli->pipe_auth_flags |= AUTH_PIPE_SEAL; + if (cli->nt_pipe_fnum != 0) + cli_nt_session_close(cli); + } + return NT_STATUS_OK; +} + +static NTSTATUS cmd_none(struct cli_state *cli, TALLOC_CTX *mem_ctx, + int argc, const char **argv) +{ + if (cli->pipe_auth_flags == 0) { + return NT_STATUS_OK; + } else { + /* still have session, just need to use it again */ + cli->pipe_auth_flags = 0; + if (cli->nt_pipe_fnum != 0) + cli_nt_session_close(cli); + } + cli->pipe_auth_flags = 0; + + return NT_STATUS_OK; +} + +static NTSTATUS cmd_schannel(struct cli_state *cli, TALLOC_CTX *mem_ctx, + int argc, const char **argv) +{ + uchar trust_password[16]; + uint32 sec_channel_type; + uint32 neg_flags = 0x000001ff; + NTSTATUS result; + static uchar zeros[16]; + + /* Cleanup */ + + if ((memcmp(cli->auth_info.sess_key, zeros, sizeof(cli->auth_info.sess_key)) != 0) + && (cli->saved_netlogon_pipe_fnum != 0)) { + if (cli->pipe_auth_flags == (AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN|AUTH_PIPE_SEAL)) { + return NT_STATUS_OK; + } else { + /* still have session, just need to use it again */ + cli->pipe_auth_flags = AUTH_PIPE_NETSEC; + cli->pipe_auth_flags |= AUTH_PIPE_SIGN; + cli->pipe_auth_flags |= AUTH_PIPE_SEAL; + if (cli->nt_pipe_fnum != 0) + cli_nt_session_close(cli); + } + } + + if (cli->nt_pipe_fnum != 0) + cli_nt_session_close(cli); + + cli->pipe_auth_flags = 0; + + if (!secrets_fetch_trust_account_password(lp_workgroup(), + trust_password, + NULL, &sec_channel_type)) { + return NT_STATUS_UNSUCCESSFUL; + } + + if (!cli_nt_session_open(cli, PI_NETLOGON)) { + DEBUG(0, ("Could not initialise %s\n", + get_pipe_name_from_index(PI_NETLOGON))); + return NT_STATUS_UNSUCCESSFUL; + } + + neg_flags |= NETLOGON_NEG_SCHANNEL; + + result = cli_nt_setup_creds(cli, sec_channel_type, trust_password, + &neg_flags, 2); + + if (!NT_STATUS_IS_OK(result)) { + ZERO_STRUCT(cli->auth_info.sess_key); + cli->pipe_auth_flags = 0; + return result; + } + + memcpy(cli->auth_info.sess_key, cli->sess_key, + sizeof(cli->auth_info.sess_key)); + + cli->saved_netlogon_pipe_fnum = cli->nt_pipe_fnum; + + cli->pipe_auth_flags = AUTH_PIPE_NETSEC; + cli->pipe_auth_flags |= AUTH_PIPE_SIGN; + cli->pipe_auth_flags |= AUTH_PIPE_SEAL; + + return NT_STATUS_OK; +} + /* Built in rpcclient commands */ static struct cmd_set rpcclient_commands[] = { @@ -316,6 +444,10 @@ static struct cmd_set rpcclient_commands[] = { { "list", RPC_RTYPE_NTSTATUS, cmd_listcommands, NULL, -1, "List available commands on ", "pipe" }, { "exit", RPC_RTYPE_NTSTATUS, cmd_quit, NULL, -1, "Exit program", "" }, { "quit", RPC_RTYPE_NTSTATUS, cmd_quit, NULL, -1, "Exit program", "" }, + { "sign", RPC_RTYPE_NTSTATUS, cmd_sign, NULL, -1, "Force RPC pipe connections to be signed", "" }, + { "seal", RPC_RTYPE_NTSTATUS, cmd_seal, NULL, -1, "Force RPC pipe connections to be sealed", "" }, + { "schannel", RPC_RTYPE_NTSTATUS, cmd_schannel, NULL, -1, "Force RPC pipe connections to be sealed with 'schannel' (NETSEC). Assumes valid machine account to this domain controller.", "" }, + { "none", RPC_RTYPE_NTSTATUS, cmd_none, NULL, -1, "Force RPC pipe connections to have no special properties", "" }, { NULL } }; @@ -377,8 +509,9 @@ static NTSTATUS do_cmd(struct cli_state *cli, struct cmd_set *cmd_entry, int argc, char **argv) { - NTSTATUS ntresult; - WERROR wresult; + NTSTATUS ntresult; + WERROR wresult; + uchar trust_password[16]; TALLOC_CTX *mem_ctx; @@ -386,34 +519,42 @@ static NTSTATUS do_cmd(struct cli_state *cli, if (!(mem_ctx = talloc_init("do_cmd"))) { DEBUG(0, ("talloc_init() failed\n")); - return NT_STATUS_UNSUCCESSFUL; + return NT_STATUS_NO_MEMORY; } /* Open pipe */ - if (cmd_entry->pipe_idx == PI_NETLOGON) { - uchar trust_password[16]; - uint32 sec_channel_type; + if (cmd_entry->pipe_idx != -1 + && cmd_entry->pipe_idx != cli->pipe_idx) { + if (cli->nt_pipe_fnum != 0) + cli_nt_session_close(cli); + + if (!cli_nt_session_open(cli, cmd_entry->pipe_idx)) { + DEBUG(0, ("Could not initialise %s\n", + get_pipe_name_from_index(cmd_entry->pipe_idx))); + return NT_STATUS_UNSUCCESSFUL; + } + } + if ((cmd_entry->pipe_idx == PI_NETLOGON) && !(cli->pipe_auth_flags & AUTH_PIPE_NETSEC)) { + uint32 neg_flags = 0x000001ff; + uint32 sec_channel_type; + if (!secrets_fetch_trust_account_password(lp_workgroup(), trust_password, NULL, &sec_channel_type)) { return NT_STATUS_UNSUCCESSFUL; } - - if (!cli_nt_open_netlogon(cli, trust_password, - sec_channel_type)) { - DEBUG(0, ("Could not initialise NETLOGON pipe\n")); - return NT_STATUS_UNSUCCESSFUL; - } - } else { - if (cmd_entry->pipe_idx != -1) { - if (!cli_nt_session_open(cli, cmd_entry->pipe_idx)) { - DEBUG(0, ("Could not initialise %s\n", - get_pipe_name_from_index(cmd_entry->pipe_idx))); - return NT_STATUS_UNSUCCESSFUL; - } + + ntresult = cli_nt_setup_creds(cli, sec_channel_type, + trust_password, + &neg_flags, 2); + if (!NT_STATUS_IS_OK(ntresult)) { + ZERO_STRUCT(cli->auth_info.sess_key); + printf("nt_setup_creds failed with %s\n", nt_errstr(ntresult)); + return ntresult; } + } /* Run command */ @@ -435,9 +576,6 @@ static NTSTATUS do_cmd(struct cli_state *cli, /* Cleanup */ - if (cmd_entry->pipe_idx != -1) - cli_nt_session_close(cli); - talloc_destroy(mem_ctx); return ntresult; diff --git a/source3/sam/idmap.c b/source3/sam/idmap.c index 9695e7b764..7a8f270e15 100644 --- a/source3/sam/idmap.c +++ b/source3/sam/idmap.c @@ -4,6 +4,7 @@ Copyright (C) Tim Potter 2000 Copyright (C) Anthony Liguori 2003 Copyright (C) Simo Sorce 2003 + Copyright (C) Jeremy Allison 2003. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -24,189 +25,292 @@ #undef DBGC_CLASS #define DBGC_CLASS DBGC_IDMAP -static struct { - +struct idmap_function_entry { const char *name; - /* Function to create a member of the idmap_methods list */ - NTSTATUS (*reg_meth)(struct idmap_methods **methods); struct idmap_methods *methods; - -} remote_idmap_functions[] = { - { NULL, NULL, NULL } + struct idmap_function_entry *prev,*next; }; -static struct idmap_methods *local_map; -static struct idmap_methods *remote_map; - -static void lazy_initialize_idmap(void) -{ - static BOOL initialized = False; - if (initialized) return; - idmap_init(); - initialized = True; -} +static struct idmap_function_entry *backends = NULL; +static struct idmap_methods *cache_map; +static struct idmap_methods *remote_map; +/********************************************************************** + Get idmap methods. Don't allow tdb to be a remote method. +**********************************************************************/ -static struct idmap_methods *get_methods(const char *name) +static struct idmap_methods *get_methods(const char *name, BOOL cache_method) { - int i = 0; - struct idmap_methods *ret = NULL; + struct idmap_function_entry *entry = backends; - while (remote_idmap_functions[i].name && strcmp(remote_idmap_functions[i].name, name)) { - i++; + for(entry = backends; entry; entry = entry->next) { + if (!cache_method && strequal(entry->name, "tdb")) + continue; /* tdb is only cache method. */ + if (strequal(entry->name, name)) + return entry->methods; } - if (remote_idmap_functions[i].name) { + return NULL; +} - if (!remote_idmap_functions[i].methods) { - remote_idmap_functions[i].reg_meth(&remote_idmap_functions[i].methods); - } +/********************************************************************** + Allow a module to register itself as a method. +**********************************************************************/ - ret = remote_idmap_functions[i].methods; +NTSTATUS smb_register_idmap(int version, const char *name, struct idmap_methods *methods) +{ + struct idmap_function_entry *entry; + + if ((version != SMB_IDMAP_INTERFACE_VERSION)) { + DEBUG(0, ("smb_register_idmap: Failed to register idmap module.\n" + "The module was compiled against SMB_IDMAP_INTERFACE_VERSION %d,\n" + "current SMB_IDMAP_INTERFACE_VERSION is %d.\n" + "Please recompile against the current version of samba!\n", + version, SMB_IDMAP_INTERFACE_VERSION)); + return NT_STATUS_OBJECT_TYPE_MISMATCH; + } + + if (!name || !name[0] || !methods) { + DEBUG(0,("smb_register_idmap: called with NULL pointer or empty name!\n")); + return NT_STATUS_INVALID_PARAMETER; } - return ret; + if (get_methods(name, False)) { + DEBUG(0,("smb_register_idmap: idmap module %s already registered!\n", name)); + return NT_STATUS_OBJECT_NAME_COLLISION; + } + + entry = smb_xmalloc(sizeof(struct idmap_function_entry)); + entry->name = smb_xstrdup(name); + entry->methods = methods; + + DLIST_ADD(backends, entry); + DEBUG(5, ("smb_register_idmap: Successfully added idmap backend '%s'\n", name)); + return NT_STATUS_OK; } -/* Initialize backend */ -BOOL idmap_init(void) +/********************************************************************** + Initialise idmap cache and a remote backend (if configured). +**********************************************************************/ + +BOOL idmap_init(const char *remote_backend) { - const char *remote_backend = lp_idmap_backend(); + if (!backends) + static_init_idmap; + + if (!cache_map) { + cache_map = get_methods("tdb", True); - if (!local_map) { - idmap_reg_tdb(&local_map); - if (NT_STATUS_IS_ERR(local_map->init())) { - DEBUG(0, ("idmap_init: could not load or create local backend!\n")); + if (!cache_map) { + DEBUG(0, ("idmap_init: could not find tdb cache backend!\n")); + return False; + } + + if (!NT_STATUS_IS_OK(cache_map->init( NULL ))) { + DEBUG(0, ("idmap_init: could not initialise tdb cache backend!\n")); return False; } } if (!remote_map && remote_backend && *remote_backend != 0) { - DEBUG(3, ("idmap_init: using '%s' as remote backend\n", remote_backend)); + char *rem_backend = smb_xstrdup(remote_backend); + fstring params = ""; + char *pparams; + + /* get any mode parameters passed in */ + + if ( (pparams = strchr( rem_backend, ':' )) != NULL ) { + *pparams = '\0'; + pparams++; + fstrcpy( params, pparams ); + } + + DEBUG(3, ("idmap_init: using '%s' as remote backend\n", rem_backend)); - remote_map = get_methods(remote_backend); - if (!remote_map) { - DEBUG(0, ("idmap_init: could not load remote backend '%s'\n", remote_backend)); + if((remote_map = get_methods(rem_backend, False)) || + (NT_STATUS_IS_OK(smb_probe_module("idmap", rem_backend)) && + (remote_map = get_methods(rem_backend, False)))) { + remote_map->init(params); + } else { + DEBUG(0, ("idmap_init: could not load remote backend '%s'\n", rem_backend)); + SAFE_FREE(rem_backend); return False; } - remote_map->init(); + SAFE_FREE(rem_backend); } return True; } +/************************************************************************** + This is a rare operation, designed to allow an explicit mapping to be + set up for a sid to a POSIX id. +**************************************************************************/ + NTSTATUS idmap_set_mapping(const DOM_SID *sid, unid_t id, int id_type) { - NTSTATUS ret; - - lazy_initialize_idmap(); - - ret = local_map->set_mapping(sid, id, id_type); - if (NT_STATUS_IS_ERR(ret)) { - DEBUG (0, ("idmap_set_mapping: Error, unable to modify local cache!\n")); - DEBUGADD(0, ("Error: %s", nt_errstr(ret))); - return ret; + struct idmap_methods *map = remote_map; + DOM_SID tmp_sid; + + DEBUG(10, ("idmap_set_mapping: Set %s to %s %d\n", + sid_string_static(sid), + ((id_type & ID_TYPEMASK) == ID_USERID) ? "UID" : "GID", + ((id_type & ID_TYPEMASK) == ID_USERID) ? id.uid : id.gid)); + + if ( (NT_STATUS_IS_OK(cache_map-> + get_sid_from_id(&tmp_sid, id, + id_type | ID_QUERY_ONLY))) && + sid_equal(sid, &tmp_sid) ) { + /* Nothing to do, we already have that mapping */ + DEBUG(10, ("idmap_set_mapping: Mapping already there\n")); + return NT_STATUS_OK; } - /* Being able to update the remote cache is seldomly right. - Generally this is a forbidden operation. */ - if (!(id_type & ID_CACHE) && (remote_map != NULL)) { - remote_map->set_mapping(sid, id, id_type); - if (NT_STATUS_IS_ERR(ret)) { - DEBUG (0, ("idmap_set_mapping: Error, unable to modify remote cache!\n")); - DEBUGADD(0, ("Error: %s", nt_errstr(ret))); - } + if (map == NULL) { + /* Ok, we don't have a authoritative remote + mapping. So update our local cache only. */ + map = cache_map; } - return ret; + return map->set_mapping(sid, id, id_type); } -/* Get ID from SID */ +/************************************************************************** + Get ID from SID. This can create a mapping for a SID to a POSIX id. +**************************************************************************/ + NTSTATUS idmap_get_id_from_sid(unid_t *id, int *id_type, const DOM_SID *sid) { NTSTATUS ret; int loc_type; - lazy_initialize_idmap(); - loc_type = *id_type; - if (remote_map) { /* We have a central remote idmap */ - loc_type |= ID_NOMAP; + + if (remote_map) { + /* We have a central remote idmap so only look in + cache, don't allocate */ + loc_type |= ID_QUERY_ONLY; } - ret = local_map->get_id_from_sid(id, &loc_type, sid); - if (NT_STATUS_IS_ERR(ret)) { - if (remote_map) { - ret = remote_map->get_id_from_sid(id, id_type, sid); - if (NT_STATUS_IS_ERR(ret)) { - DEBUG(3, ("idmap_get_id_from_sid: error fetching id!\n")); - return ret; - } else { - loc_type |= ID_CACHE; - idmap_set_mapping(sid, *id, loc_type); - } - } - } else { + + ret = cache_map->get_id_from_sid(id, &loc_type, sid); + + if (NT_STATUS_IS_OK(ret)) { *id_type = loc_type & ID_TYPEMASK; + return NT_STATUS_OK; + } + + if (remote_map == NULL) { + return ret; + } + + /* Ok, the mapping was not in the cache, give the remote map a + second try. */ + + ret = remote_map->get_id_from_sid(id, id_type, sid); + + if (NT_STATUS_IS_OK(ret)) { + /* The remote backend gave us a valid mapping, cache it. */ + ret = cache_map->set_mapping(sid, *id, *id_type); } return ret; } -/* Get SID from ID */ +/************************************************************************** + Get SID from ID. This must have been created before. +**************************************************************************/ + NTSTATUS idmap_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) { NTSTATUS ret; int loc_type; - lazy_initialize_idmap(); - loc_type = id_type; if (remote_map) { - loc_type = id_type | ID_NOMAP; + loc_type = id_type | ID_QUERY_ONLY; } - ret = local_map->get_sid_from_id(sid, id, loc_type); - if (NT_STATUS_IS_ERR(ret)) { - if (remote_map) { - ret = remote_map->get_sid_from_id(sid, id, id_type); - if (NT_STATUS_IS_ERR(ret)) { - DEBUG(3, ("idmap_get_sid_from_id: unable to fetch sid!\n")); - return ret; - } else { - loc_type |= ID_CACHE; - idmap_set_mapping(sid, id, loc_type); - } - } + + ret = cache_map->get_sid_from_id(sid, id, loc_type); + + if (NT_STATUS_IS_OK(ret)) + return ret; + + if (remote_map == NULL) + return ret; + + /* We have a second chance, ask our authoritative backend */ + + ret = remote_map->get_sid_from_id(sid, id, id_type); + + if (NT_STATUS_IS_OK(ret)) { + /* The remote backend gave us a valid mapping, cache it. */ + ret = cache_map->set_mapping(sid, id, id_type); } return ret; } -/* Close backend */ +/************************************************************************** + Alloocate a new UNIX uid/gid +**************************************************************************/ + +NTSTATUS idmap_allocate_id(unid_t *id, int id_type) +{ + /* we have to allocate from the authoritative backend */ + + if ( remote_map ) + return remote_map->allocate_id( id, id_type ); + + return cache_map->allocate_id( id, id_type ); +} + +/************************************************************************** + Alloocate a new RID +**************************************************************************/ + +NTSTATUS idmap_allocate_rid(uint32 *rid, int type) +{ + /* we have to allocate from the authoritative backend */ + + if ( remote_map ) + return remote_map->allocate_rid( rid, type ); + + return cache_map->allocate_rid( rid, type ); +} + +/************************************************************************** + Shutdown maps. +**************************************************************************/ + NTSTATUS idmap_close(void) { NTSTATUS ret; - ret = local_map->close(); - if (NT_STATUS_IS_ERR(ret)) { - DEBUG(3, ("idmap_close: failed to close local cache!\n")); + ret = cache_map->close(); + if (!NT_STATUS_IS_OK(ret)) { + DEBUG(3, ("idmap_close: failed to close local tdb cache!\n")); } + cache_map = NULL; if (remote_map) { ret = remote_map->close(); - if (NT_STATUS_IS_ERR(ret)) { + if (!NT_STATUS_IS_OK(ret)) { DEBUG(3, ("idmap_close: failed to close remote idmap repository!\n")); } + remote_map = NULL; } return ret; } -/* Dump backend status */ +/************************************************************************** + Dump backend status. +**************************************************************************/ + void idmap_status(void) { - lazy_initialize_idmap(); - - local_map->status(); - if (remote_map) remote_map->status(); + cache_map->status(); + if (remote_map) + remote_map->status(); } diff --git a/source3/sam/idmap_ldap.c b/source3/sam/idmap_ldap.c index 33cf5fb030..9a1ee039d0 100644 --- a/source3/sam/idmap_ldap.c +++ b/source3/sam/idmap_ldap.c @@ -3,9 +3,10 @@ idmap LDAP backend - Copyright (C) Tim Potter 2000 - Copyright (C) Anthony Liguori 2003 - Copyright (C) Simo Sorce 2003 + Copyright (C) Tim Potter 2000 + Copyright (C) Anthony Liguori 2003 + Copyright (C) Simo Sorce 2003 + Copyright (C) Gerald Carter 2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -31,781 +32,912 @@ #include #include +#include "smbldap.h" + +#define IDMAP_GROUP_SUFFIX "ou=idmap group" +#define IDMAP_USER_SUFFIX "ou=idmap people" + + struct ldap_idmap_state { - LDAP *ldap_struct; - time_t last_ping; - const char *uri; - char *bind_dn; - char *bind_secret; - unsigned int num_failures; - struct ldap_idmap_state *prev, *next; + struct smbldap_state *smbldap_state; + TALLOC_CTX *mem_ctx; + + uint32 low_allocated_user_rid; + uint32 high_allocated_user_rid; + uint32 low_allocated_group_rid; + uint32 high_allocated_group_rid; + }; -#define LDAP_IDMAP_DONT_PING_TIME 10 /* ping only all 10 seconds */ #define LDAP_MAX_ALLOC_ID 128 /* number tries while allocating new id */ static struct ldap_idmap_state ldap_state; -static int ldap_idmap_connect_system(struct ldap_idmap_state *state); static NTSTATUS ldap_set_mapping(const DOM_SID *sid, unid_t id, int id_type); +static NTSTATUS ldap_set_mapping_internals(const DOM_SID *sid, unid_t id, int id_type, + const char *ldap_dn, LDAPMessage *entry); static NTSTATUS ldap_idmap_close(void); -/******************************************************************* - find the ldap password -******************************************************************/ -static BOOL fetch_ldapsam_pw(char **dn, char** pw) -{ - char *key = NULL; - size_t size; - - *dn = smb_xstrdup(lp_ldap_admin_dn()); - - if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, *dn) < 0) { - SAFE_FREE(*dn); - DEBUG(0, ("fetch_ldapsam_pw: asprintf failed!\n")); - } - - *pw=secrets_fetch(key, &size); - SAFE_FREE(key); - - if (!size) { - /* Upgrade 2.2 style entry */ - char *p; - char* old_style_key = strdup(*dn); - char *data; - fstring old_style_pw; - - if (!old_style_key) { - DEBUG(0, ("fetch_ldapsam_pw: strdup failed!\n")); - return False; - } - - for (p=old_style_key; *p; p++) - if (*p == ',') *p = '/'; - - data=secrets_fetch(old_style_key, &size); - if (!size && size < sizeof(old_style_pw)) { - DEBUG(0,("fetch_ldap_pw: neither ldap secret retrieved!\n")); - SAFE_FREE(old_style_key); - SAFE_FREE(*dn); - return False; - } +/********************************************************************** + Even if the sambaDomain attribute in LDAP tells us that this RID is + safe to use, always check before use. +*********************************************************************/ - strncpy(old_style_pw, data, size); - old_style_pw[size] = 0; +static BOOL sid_in_use(struct ldap_idmap_state *state, + const DOM_SID *sid, int *error) +{ + fstring filter; + fstring sid_string; + LDAPMessage *result = NULL; + int count; + int rc; + char *sid_attr[] = {LDAP_ATTRIBUTE_SID, NULL}; - SAFE_FREE(data); + slprintf(filter, sizeof(filter)-1, "(%s=%s)", LDAP_ATTRIBUTE_SID, sid_to_string(sid_string, sid)); - if (!secrets_store_ldap_pw(*dn, old_style_pw)) { - DEBUG(0,("fetch_ldap_pw: ldap secret could not be upgraded!\n")); - SAFE_FREE(old_style_key); - SAFE_FREE(*dn); - return False; - } - if (!secrets_delete(old_style_key)) { - DEBUG(0,("fetch_ldap_pw: old ldap secret could not be deleted!\n")); - } + rc = smbldap_search_suffix(state->smbldap_state, + filter, sid_attr, &result); - SAFE_FREE(old_style_key); + if (rc != LDAP_SUCCESS) { + char *ld_error = NULL; + ldap_get_option(state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); + DEBUG(2, ("Failed to check if sid %s is alredy in use: %s\n", + sid_string, ld_error)); + SAFE_FREE(ld_error); - *pw = smb_xstrdup(old_style_pw); + *error = rc; + return True; } - return True; + if ((count = ldap_count_entries(state->smbldap_state->ldap_struct, result)) > 0) { + DEBUG(3, ("Sid %s already in use - trying next RID\n", + sid_string)); + ldap_msgfree(result); + return True; + } + + ldap_msgfree(result); + + /* good, sid is not in use */ + return False; } -/******************************************************************* - open a connection to the ldap server. -******************************************************************/ -static int ldap_idmap_open_connection(struct ldap_idmap_state *state) +/********************************************************************** + Set the new nextRid attribute, and return one we can use. + + This also checks that this RID is actually free - in case the admin + manually stole it :-). +*********************************************************************/ +static NTSTATUS ldap_next_rid(struct ldap_idmap_state *state, uint32 *rid, + int rid_type) { - int rc = LDAP_SUCCESS; - int version; - BOOL ldap_v3 = False; + NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; + int rc; + LDAPMessage *domain_result = NULL; + LDAPMessage *entry = NULL; + char *dn; + LDAPMod **mods = NULL; + fstring old_rid_string; + fstring next_rid_string; + fstring algorithmic_rid_base_string; + uint32 next_rid; + uint32 alg_rid_base; + int attempts = 0; + char *ld_error = NULL; -#ifdef HAVE_LDAP_INITIALIZE - DEBUG(10, ("ldap_idmap_open_connection: %s\n", state->uri)); - - if ((rc = ldap_initialize(&state->ldap_struct, state->uri)) - != LDAP_SUCCESS) { - DEBUG(0, ("ldap_initialize: %s\n", ldap_err2string(rc))); - return rc; - } -#else - /* Parse the string manually */ + while (attempts < 10) { - int port = 0; - fstring protocol; - fstring host; - const char *p = state->uri; - SMB_ASSERT(sizeof(protocol)>10 && sizeof(host)>254); - - /* skip leading "URL:" (if any) */ - if ( strncasecmp( p, "URL:", 4 ) == 0 ) { - p += 4; + if (!NT_STATUS_IS_OK(ret = smbldap_search_domain_info(state->smbldap_state, + &domain_result, get_global_sam_name(), True))) + { + return ret; } - - sscanf(p, "%10[^:]://%254s[^:]:%d", protocol, host, &port); - - if (port == 0) { - if (strequal(protocol, "ldap")) { - port = LDAP_PORT; - } else if (strequal(protocol, "ldaps")) { - port = LDAPS_PORT; - } else { - DEBUG(0, ("unrecognised protocol (%s)!\n", - protocol)); - } + + entry = ldap_first_entry(state->smbldap_state->ldap_struct, domain_result); + if (!entry) { + DEBUG(0, ("Could not get domain info entry\n")); + ldap_msgfree(domain_result); + return ret; } - - if ((state->ldap_struct = ldap_init(host, port)) == NULL) { - DEBUG(0, ("ldap_init failed !\n")); - return LDAP_OPERATIONS_ERROR; + + if ((dn = ldap_get_dn(state->smbldap_state->ldap_struct, entry)) == NULL) { + DEBUG(0, ("Could not get domain info DN\n")); + ldap_msgfree(domain_result); + return ret; } + + /* yes, we keep 3 seperate counters, one for rids between 1000 (BASE_RID) and + algorithmic_rid_base. The other two are to avoid stomping on the + different sets of algorithmic RIDs */ - if (strequal(protocol, "ldaps")) { -#ifdef LDAP_OPT_X_TLS - int tls = LDAP_OPT_X_TLS_HARD; - if (ldap_set_option (state->ldap_struct, - LDAP_OPT_X_TLS, &tls) != - LDAP_SUCCESS) - { - DEBUG(0, ("Failed to setup a TLS session\n")); - } + if (smbldap_get_single_attribute(state->smbldap_state->ldap_struct, entry, + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_ALGORITHMIC_RID_BASE), + algorithmic_rid_base_string)) + { - DEBUG(3,("LDAPS option set...!\n")); -#else - DEBUG(0,("ldap_idmap_open_connection: Secure " - "connection not supported by LDAP client " - "libraries!\n")); - return LDAP_OPERATIONS_ERROR; -#endif - } - } -#endif - - if (ldap_get_option(state->ldap_struct, LDAP_OPT_PROTOCOL_VERSION, - &version) == LDAP_OPT_SUCCESS) { - if (version != LDAP_VERSION3) { - version = LDAP_VERSION3; - if (ldap_set_option(state->ldap_struct, - LDAP_OPT_PROTOCOL_VERSION, - &version) == LDAP_OPT_SUCCESS) { - ldap_v3 = True; - } + alg_rid_base = (uint32)atol(algorithmic_rid_base_string); } else { - ldap_v3 = True; + alg_rid_base = algorithmic_rid_base(); + /* Try to make the modification atomically by enforcing the + old value in the delete mod. */ + slprintf(algorithmic_rid_base_string, sizeof(algorithmic_rid_base_string)-1, "%d", alg_rid_base); + smbldap_make_mod(state->smbldap_state->ldap_struct, entry, &mods, + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_ALGORITHMIC_RID_BASE), + algorithmic_rid_base_string); } - } - if (lp_ldap_ssl() == LDAP_SSL_START_TLS) { -#ifdef LDAP_OPT_X_TLS - if (ldap_v3) { - if ((rc = ldap_start_tls_s(state->ldap_struct, NULL, - NULL)) != LDAP_SUCCESS) { - DEBUG(0,("Failed to issue the StartTLS " - "instruction: %s\n", - ldap_err2string(rc))); - return rc; + next_rid = 0; + + if (alg_rid_base > BASE_RID) { + /* we have a non-default 'algorithmic rid base', so we have 'low' rids that we + can allocate to new users */ + if (smbldap_get_single_attribute(state->smbldap_state->ldap_struct, entry, + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_RID), + old_rid_string)) + { + *rid = (uint32)atol(old_rid_string); + } else { + *rid = BASE_RID; + } + + next_rid = *rid+1; + if (next_rid >= alg_rid_base) { + return NT_STATUS_UNSUCCESSFUL; } - DEBUG (3, ("StartTLS issued: using a TLS " - "connection\n")); - } else { - DEBUG(0, ("Need LDAPv3 for Start TLS\n")); - return LDAP_OPERATIONS_ERROR; + slprintf(next_rid_string, sizeof(next_rid_string)-1, "%d", next_rid); + + /* Try to make the modification atomically by enforcing the + old value in the delete mod. */ + smbldap_make_mod(state->smbldap_state->ldap_struct, entry, &mods, + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_RID), + next_rid_string); } -#else - DEBUG(0,("ldap_idmap_open_connection: StartTLS not supported by " - "LDAP client libraries!\n")); - return LDAP_OPERATIONS_ERROR; -#endif - } - - DEBUG(2, ("ldap_idmap_open_connection: connection opened\n")); - return rc; -} -/********************************************************************** -Connect to LDAP server -*********************************************************************/ -static int ldap_idmap_open(struct ldap_idmap_state *state) -{ - int rc; - SMB_ASSERT(state); - -#ifndef NO_LDAP_SECURITY - if (geteuid() != 0) { - DEBUG(0, - ("ldap_idmap_open: cannot access LDAP when not root\n")); - return LDAP_INSUFFICIENT_ACCESS; - } -#endif - - if ((state->ldap_struct != NULL) && - ((state->last_ping + LDAP_IDMAP_DONT_PING_TIME)ldap_struct, LDAP_OPT_DESC, &sd)&& - getpeername(sd, (struct sockaddr *) &addr, &len) < 0) { - /* the other end has died. reopen. */ - ldap_unbind_ext(state->ldap_struct, NULL, NULL); - state->ldap_struct = NULL; - state->last_ping = (time_t)0; - } else { - state->last_ping = time(NULL); - } - } - - if (state->ldap_struct != NULL) { - DEBUG(5,("ldap_idmap_open: already connected to the LDAP " - "server\n")); - return LDAP_SUCCESS; - } - - if ((rc = ldap_idmap_open_connection(state))) { - return rc; - } - - if ((rc = ldap_idmap_connect_system(state))) { - ldap_unbind_ext(state->ldap_struct, NULL, NULL); - state->ldap_struct = NULL; - return rc; - } - - - state->last_ping = time(NULL); - DEBUG(4,("The LDAP server is succesful connected\n")); - - return LDAP_SUCCESS; -} + if (!next_rid) { /* not got one already */ + switch (rid_type) { + case USER_RID_TYPE: + if (smbldap_get_single_attribute(state->smbldap_state->ldap_struct, entry, + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_USERRID), + old_rid_string)) + { + + *rid = (uint32)atol(old_rid_string); + + } else { + *rid = state->low_allocated_user_rid; + } + break; + case GROUP_RID_TYPE: + if (smbldap_get_single_attribute(state->smbldap_state->ldap_struct, entry, + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_GROUPRID), + old_rid_string)) + { + *rid = (uint32)atol(old_rid_string); + } else { + *rid = state->low_allocated_group_rid; + } + break; + } + + /* This is the core of the whole routine. If we had + scheme-style closures, there would be a *lot* less code + duplication... */ -static int ldap_idmap_retry_open(struct ldap_idmap_state *state, int *attempts) -{ - int rc; + next_rid = *rid+RID_MULTIPLIER; + slprintf(next_rid_string, sizeof(next_rid_string)-1, "%d", next_rid); + + switch (rid_type) { + case USER_RID_TYPE: + if (next_rid > state->high_allocated_user_rid) { + return NT_STATUS_UNSUCCESSFUL; + } + + /* Try to make the modification atomically by enforcing the + old value in the delete mod. */ + smbldap_make_mod(state->smbldap_state->ldap_struct, entry, &mods, + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_USERRID), + next_rid_string); + break; + + case GROUP_RID_TYPE: + if (next_rid > state->high_allocated_group_rid) { + return NT_STATUS_UNSUCCESSFUL; + } + + /* Try to make the modification atomically by enforcing the + old value in the delete mod. */ + smbldap_make_mod(state->smbldap_state->ldap_struct, entry, &mods, + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_GROUPRID), + next_rid_string); + break; + } + } - SMB_ASSERT(state && attempts); + if ((rc = ldap_modify_s(state->smbldap_state->ldap_struct, dn, mods)) == LDAP_SUCCESS) { + DOM_SID dom_sid; + DOM_SID sid; + pstring domain_sid_string; + int error = 0; - if (*attempts != 0) { - unsigned int sleep_time; - uint8 rand_byte = 128; /* a reasonable place to start */ + if (!smbldap_get_single_attribute(state->smbldap_state->ldap_struct, domain_result, + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOM_SID), + domain_sid_string)) + { + ldap_mods_free(mods, True); + ldap_memfree(dn); + ldap_msgfree(domain_result); + return ret; + } - generate_random_buffer(&rand_byte, 1, False); + if (!string_to_sid(&dom_sid, domain_sid_string)) { + ldap_mods_free(mods, True); + ldap_memfree(dn); + ldap_msgfree(domain_result); + return ret; + } - sleep_time = (((*attempts)*(*attempts))/2)*rand_byte*2; - /* we retry after (0.5, 1, 2, 3, 4.5, 6) seconds - on average. - */ - DEBUG(3, ("Sleeping for %u milliseconds before reconnecting\n", - sleep_time)); - msleep(sleep_time); - } - (*attempts)++; + ldap_mods_free(mods, True); + mods = NULL; + ldap_memfree(dn); + ldap_msgfree(domain_result); - if ((rc = ldap_idmap_open(state))) { - DEBUG(1,("Connection to LDAP Server failed for the %d try!\n", - *attempts)); - return rc; - } - - return LDAP_SUCCESS; -} + sid_copy(&sid, &dom_sid); + sid_append_rid(&sid, *rid); -/******************************************************************* - a rebind function for authenticated referrals - This version takes a void* that we can shove useful stuff in :-) -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -#else -static int rebindproc_with_state (LDAP * ld, char **whop, char **credp, - int *methodp, int freeit, void *arg) -{ - struct ldap_idmap_state *state = arg; - - /** @TODO Should we be doing something to check what servers we rebind - to? Could we get a referral to a machine that we don't want to - give our username and password to? */ - - if (freeit) { - SAFE_FREE(*whop); - memset(*credp, '\0', strlen(*credp)); - SAFE_FREE(*credp); - } else { - DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n", - state->bind_dn)); + /* check RID is not in use */ + if (sid_in_use(state, &sid, &error)) { + if (error) { + return ret; + } + continue; + } - *whop = strdup(state->bind_dn); - if (!*whop) { - return LDAP_NO_MEMORY; + return NT_STATUS_OK; } - *credp = strdup(state->bind_secret); - if (!*credp) { - SAFE_FREE(*whop); - return LDAP_NO_MEMORY; - } - *methodp = LDAP_AUTH_SIMPLE; - } - return 0; -} -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - -/******************************************************************* - a rebind function for authenticated referrals - This version takes a void* that we can shove useful stuff in :-) - and actually does the connection. -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -static int rebindproc_connect_with_state (LDAP *ldap_struct, - LDAP_CONST char *url, - ber_tag_t request, - ber_int_t msgid, void *arg) -{ - struct ldap_idmap_state *state = arg; - int rc; - DEBUG(5,("rebindproc_connect_with_state: Rebinding as \"%s\"\n", - state->bind_dn)); - - /** @TODO Should we be doing something to check what servers we rebind - to? Could we get a referral to a machine that we don't want to - give our username and password to? */ - rc = ldap_simple_bind_s(ldap_struct, state->bind_dn, - state->bind_secret); - - return rc; -} -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - -/******************************************************************* - Add a rebind function for authenticated referrals -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -#else -# if LDAP_SET_REBIND_PROC_ARGS == 2 -static int rebindproc (LDAP *ldap_struct, char **whop, char **credp, - int *method, int freeit ) -{ - return rebindproc_with_state(ldap_struct, whop, credp, - method, freeit, &ldap_state); - -} -# endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/ -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - -/******************************************************************* - a rebind function for authenticated referrals - this also does the connection, but no void*. -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -# if LDAP_SET_REBIND_PROC_ARGS == 2 -static int rebindproc_connect (LDAP * ld, LDAP_CONST char *url, int request, - ber_int_t msgid) -{ - return rebindproc_connect_with_state(ld, url, (ber_tag_t)request, - msgid, &ldap_state); -} -# endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/ -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - -/******************************************************************* - connect to the ldap server under system privilege. -******************************************************************/ -static int ldap_idmap_connect_system(struct ldap_idmap_state *state) -{ - int rc; - char *ldap_dn; - char *ldap_secret; + ld_error = NULL; + ldap_get_option(state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); + DEBUG(2, ("Failed to modify rid: %s\n", ld_error ? ld_error : "(NULL")); + SAFE_FREE(ld_error); - /* get the password */ - if (!fetch_ldapsam_pw(&ldap_dn, &ldap_secret)) - { - DEBUG(0, ("ldap_idmap_connect_system: Failed to retrieve " - "password from secrets.tdb\n")); - return LDAP_INVALID_CREDENTIALS; - } + ldap_mods_free(mods, True); + mods = NULL; - state->bind_dn = ldap_dn; - state->bind_secret = ldap_secret; + ldap_memfree(dn); + dn = NULL; - /* removed the sasl_bind_s "EXTERNAL" stuff, as my testsuite - (OpenLDAP) doesnt' seem to support it */ - - DEBUG(10,("ldap_idmap_connect_system: Binding to ldap server %s as " - "\"%s\"\n", state->uri, ldap_dn)); - -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -# if LDAP_SET_REBIND_PROC_ARGS == 2 - ldap_set_rebind_proc(state->ldap_struct, &rebindproc_connect); -# endif -# if LDAP_SET_REBIND_PROC_ARGS == 3 - ldap_set_rebind_proc(state->ldap_struct, - &rebindproc_connect_with_state, (void *)state); -# endif -#else /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ -# if LDAP_SET_REBIND_PROC_ARGS == 2 - ldap_set_rebind_proc(state->ldap_struct, &rebindproc); -# endif -# if LDAP_SET_REBIND_PROC_ARGS == 3 - ldap_set_rebind_proc(state->ldap_struct, &rebindproc_with_state, - (void *)state); -# endif -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - - rc = ldap_simple_bind_s(state->ldap_struct, ldap_dn, ldap_secret); + ldap_msgfree(domain_result); + domain_result = NULL; - if (rc != LDAP_SUCCESS) { - char *ld_error = NULL; - ldap_get_option(state->ldap_struct, LDAP_OPT_ERROR_STRING, - &ld_error); - DEBUG(state->num_failures ? 2 : 0, - ("failed to bind to server with dn= %s Error: " - "%s\n\t%s\n", - ldap_dn ? ld_error : "(unknown)", - ldap_err2string(rc), ld_error)); - SAFE_FREE(ld_error); - state->num_failures++; - return rc; + { + /* Sleep for a random timeout */ + unsigned sleeptime = (sys_random()*sys_getpid()*attempts); + attempts += 1; + + sleeptime %= 100; + msleep(sleeptime); + } } - state->num_failures = 0; - - DEBUG(3, ("ldap_idmap_connect_system: succesful connection to the " - "LDAP server\n")); - return rc; + DEBUG(0, ("Failed to set new RID\n")); + return ret; } -static int ldap_idmap_search(struct ldap_idmap_state *state, - const char *base, int scope, const char *filter, - const char *attrs[], int attrsonly, - LDAPMessage **res) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - char *utf8_filter; - - SMB_ASSERT(state); - - if (push_utf8_allocate(&utf8_filter, filter) == (size_t)-1) { - return LDAP_NO_MEMORY; - } - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - if ((rc = ldap_idmap_retry_open(state, &attempts)) != - LDAP_SUCCESS) continue; - - rc = ldap_search_s(state->ldap_struct, base, scope, - utf8_filter, (char**)attrs, attrsonly, res); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("ldap_idmap_search: LDAP server is down!\n")); - ldap_idmap_close(); - } - SAFE_FREE(utf8_filter); - return rc; -} +/***************************************************************************** + Allocate a new RID +*****************************************************************************/ -/******************************************************************* -search an attribute and return the first value found. -******************************************************************/ -static BOOL ldap_idmap_attribute (struct ldap_idmap_state *state, - LDAPMessage * entry, - const char *attribute, pstring value) +static NTSTATUS ldap_allocate_rid(uint32 *rid, int rid_type) { - char **values; - value[0] = '\0'; - - if ((values = ldap_get_values (state->ldap_struct, entry, attribute)) - == NULL) { - DEBUG(10,("get_single_attribute: [%s] = []\n", - attribute)); - return False; - } - if (convert_string(CH_UTF8, CH_UNIX, - values[0], -1, - value, sizeof(pstring)) == (size_t)-1) - { - DEBUG(1, ("ldap_idmap_attribute: string conversion of [%s] = " - "[%s] failed!\n", attribute, values[0])); - ldap_value_free(values); - return False; - } - ldap_value_free(values); - - return True; + return ldap_next_rid( &ldap_state, rid, rid_type ); } -static const char *attrs[] = {"objectClass", "uidNumber", "gidNumber", - "ntSid", NULL}; -static const char *pool_attr[] = {"uidNumber", "gidNumber", NULL}; +/***************************************************************************** + Allocate a new uid or gid +*****************************************************************************/ static NTSTATUS ldap_allocate_id(unid_t *id, int id_type) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; int rc = LDAP_SERVER_DOWN; int count = 0; - LDAPMessage *result = 0; - LDAPMessage *entry = 0; + LDAPMessage *result = NULL; + LDAPMessage *entry = NULL; pstring id_str, new_id_str; - LDAPMod mod[2]; - LDAPMod *mods[3]; - const char *type = (id_type & ID_USERID) ? "uidNumber" : "gidNumber"; - char *val[4]; + LDAPMod **mods = NULL; + const char *type; char *dn; + char **attr_list; + pstring filter; + uid_t luid, huid; + gid_t lgid, hgid; + - rc = ldap_idmap_search(&ldap_state, lp_ldap_suffix(), - LDAP_SCOPE_SUBTREE, "(objectClass=unixIdPool)", - pool_attr, 0, &result); + type = (id_type & ID_USERID) ? + get_attr_key2string( idpool_attr_list, LDAP_ATTR_UIDNUMBER ) : + get_attr_key2string( idpool_attr_list, LDAP_ATTR_GIDNUMBER ); + + snprintf(filter, sizeof(filter)-1, "(objectClass=%s)", LDAP_OBJ_IDPOOL); + + attr_list = get_attr_list( idpool_attr_list ); + + rc = smbldap_search(ldap_state.smbldap_state, lp_ldap_idmap_suffix(), + LDAP_SCOPE_SUBTREE, filter, + attr_list, 0, &result); + free_attr_list( attr_list ); + if (rc != LDAP_SUCCESS) { - DEBUG(0,("ldap_allocate_id: unixIdPool object not found\n")); + DEBUG(0,("ldap_allocate_id: %s object not found\n", LDAP_OBJ_IDPOOL)); goto out; } - count = ldap_count_entries(ldap_state.ldap_struct, result); + count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result); if (count != 1) { - DEBUG(0,("ldap_allocate_id: single unixIdPool not found\n")); + DEBUG(0,("ldap_allocate_id: single %s object not found\n", LDAP_OBJ_IDPOOL)); goto out; } - dn = ldap_get_dn(ldap_state.ldap_struct, result); - entry = ldap_first_entry(ldap_state.ldap_struct, result); + dn = ldap_get_dn(ldap_state.smbldap_state->ldap_struct, result); + entry = ldap_first_entry(ldap_state.smbldap_state->ldap_struct, result); - if (!ldap_idmap_attribute(&ldap_state, entry, type, id_str)) { + if (!smbldap_get_single_attribute(ldap_state.smbldap_state->ldap_struct, entry, type, id_str)) { DEBUG(0,("ldap_allocate_id: %s attribute not found\n", type)); goto out; } + + /* this must succeed or else we wouldn't have initialized */ + + lp_idmap_uid( &luid, &huid); + lp_idmap_gid( &lgid, &hgid); + + /* make sure we still have room to grow */ + if (id_type & ID_USERID) { id->uid = strtoul(id_str, NULL, 10); - } else { + if (id->uid > huid ) { + DEBUG(0,("ldap_allocate_id: Cannot allocate uid above %d!\n", huid)); + goto out; + } + } + else { id->gid = strtoul(id_str, NULL, 10); + if (id->gid > hgid ) { + DEBUG(0,("ldap_allocate_id: Cannot allocate gid above %d!\n", hgid)); + goto out; + } } - - mod[0].mod_op = LDAP_MOD_DELETE; - mod[0].mod_type = strdup(type); - val[0] = id_str; val[1] = NULL; - mod[0].mod_values = val; - - pstr_sprintf(new_id_str, "%ud", + + snprintf(new_id_str, sizeof(new_id_str), "%u", ((id_type & ID_USERID) ? id->uid : id->gid) + 1); - mod[1].mod_op = LDAP_MOD_ADD; - mod[1].mod_type = strdup(type); - val[3] = new_id_str; val[4] = NULL; - mod[1].mod_values = val + 2; + + smbldap_set_mod( &mods, LDAP_MOD_DELETE, type, id_str ); + smbldap_set_mod( &mods, LDAP_MOD_ADD, type, new_id_str ); + + rc = ldap_modify_s(ldap_state.smbldap_state->ldap_struct, dn, mods); - mods[0] = mod; mods[1] = mod + 1; mods[2] = NULL; - rc = ldap_modify_s(ldap_state.ldap_struct, dn, mods); ldap_memfree(dn); - - if (rc == LDAP_SUCCESS) ret = NT_STATUS_OK; + ldap_mods_free( mods, True ); + + if (rc != LDAP_SUCCESS) { + DEBUG(0,("ldap_allocate_id: Failed to allocate new %s. ldap_modify() failed.\n", + type)); + goto out; + } + + ret = NT_STATUS_OK; out: return ret; } -/* Get a sid from an id */ +/***************************************************************************** + get a sid from an id +*****************************************************************************/ + static NTSTATUS ldap_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) { - LDAPMessage *result = 0; - LDAPMessage *entry = 0; + LDAPMessage *result = NULL; + LDAPMessage *entry = NULL; + fstring id_str; pstring sid_str; pstring filter; - char type = (id_type & ID_USERID) ? 'u' : 'g'; + pstring suffix; + const char *type; + const char *obj_class; int rc; int count; NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - - pstr_sprintf(filter, "(&(%cidNumber=%ud)(objectClass=sambaAccount))", - type, ((id_type & ID_USERID) ? id.uid : id.gid)); - rc = ldap_idmap_search(&ldap_state, lp_ldap_suffix(), - LDAP_SCOPE_SUBTREE, filter, attrs, 0, - &result); - if (rc != LDAP_SUCCESS) { + char **attr_list; + + /* first we try for a samba user or group mapping */ + + if ( id_type & ID_USERID ) { + type = get_attr_key2string( idpool_attr_list, LDAP_ATTR_UIDNUMBER ); + obj_class = LDAP_OBJ_SAMBASAMACCOUNT; + snprintf(id_str, sizeof(id_str), "%u", id.uid ); + pstrcpy( suffix, lp_ldap_suffix()); + } + else { + type = get_attr_key2string( idpool_attr_list, LDAP_ATTR_GIDNUMBER ); + obj_class = LDAP_OBJ_GROUPMAP; + snprintf(id_str, sizeof(id_str), "%u", id.gid ); + pstrcpy( suffix, lp_ldap_group_suffix() ); + } + + attr_list = get_attr_list( sidmap_attr_list ); + snprintf(filter, sizeof(filter), "(&(|(objectClass=%s)(objectClass=%s))(%s=%s))", + LDAP_OBJ_IDMAP_ENTRY, obj_class, type, id_str); + + rc = smbldap_search(ldap_state.smbldap_state, suffix, LDAP_SCOPE_SUBTREE, + filter, attr_list, 0, &result); + + if (rc != LDAP_SUCCESS) goto out; - } + + count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result); + + /* fall back to looking up an idmap entry if we didn't find and + actual user or group */ - count = ldap_count_entries(ldap_state.ldap_struct, result); if (count == 0) { - pstr_sprintf(filter, - "(&(objectClass=idmapEntry)(%cidNumber=%ud))", - type, ((id_type & ID_USERID) ? id.uid : id.gid)); - rc = ldap_idmap_search(&ldap_state, lp_ldap_suffix(), - LDAP_SCOPE_SUBTREE, filter, - attrs, 0, &result); - if (rc != LDAP_SUCCESS) { + ldap_msgfree(result); + result = NULL; + + snprintf(filter, sizeof(filter), "(&(objectClass=%s)(%s=%u))", + LDAP_OBJ_IDMAP_ENTRY, type, ((id_type & ID_USERID) ? id.uid : id.gid)); + + pstrcpy( suffix, lp_ldap_idmap_suffix() ); + + rc = smbldap_search(ldap_state.smbldap_state, suffix, LDAP_SCOPE_SUBTREE, + filter, attr_list, 0, &result); + + if (rc != LDAP_SUCCESS) goto out; - } - count = ldap_count_entries(ldap_state.ldap_struct, result); + + count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result); } if (count != 1) { - DEBUG(0,("ldap_get_sid_from_id: mapping not found for " - "%cid: %ud\n", (id_type&ID_USERID)?'u':'g', - ((id_type & ID_USERID) ? id.uid : id.gid))); + DEBUG(0,("ldap_get_sid_from_id: mapping not found for %s: %u\n", + type, ((id_type & ID_USERID) ? id.uid : id.gid))); goto out; } - entry = ldap_first_entry(ldap_state.ldap_struct, result); + entry = ldap_first_entry(ldap_state.smbldap_state->ldap_struct, result); - if (!ldap_idmap_attribute(&ldap_state, entry, "ntSid", sid_str)) { + if ( !smbldap_get_single_attribute(ldap_state.smbldap_state->ldap_struct, entry, LDAP_ATTRIBUTE_SID, sid_str) ) goto out; - } - if (!string_to_sid(sid, sid_str)) { + if (!string_to_sid(sid, sid_str)) goto out; - } ret = NT_STATUS_OK; out: + free_attr_list( attr_list ); + + if (result) + ldap_msgfree(result); + return ret; } -/* Get an id from a sid */ -static NTSTATUS ldap_get_id_from_sid(unid_t *id, int *id_type, - const DOM_SID *sid) +/*********************************************************************** + Get an id from a sid +***********************************************************************/ + +static NTSTATUS ldap_get_id_from_sid(unid_t *id, int *id_type, const DOM_SID *sid) { - LDAPMessage *result = 0; - LDAPMessage *entry = 0; + LDAPMessage *result = NULL; + LDAPMessage *entry = NULL; pstring sid_str; pstring filter; pstring id_str; - const char *type = (*id_type & ID_USERID) ? "uidNumber" : "gidNumber"; - const char *class = - (*id_type & ID_USERID) ? "sambaAccount" : "sambaGroupMapping"; + const char *suffix; + const char *type; + const char *obj_class; + const char *posix_obj_class; int rc; int count; + char **attr_list; + char *dn = NULL; NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - + + /* first try getting the mapping from a samba user or group */ + sid_to_string(sid_str, sid); - pstr_sprintf(filter, "(&(objectClass=%s)(ntSid=%s)", class, sid_str); - rc = ldap_idmap_search(&ldap_state, lp_ldap_suffix(), - LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result); - if (rc != LDAP_SUCCESS) { - goto out; + if ( *id_type & ID_USERID ) { + type = get_attr_key2string( sidmap_attr_list, LDAP_ATTR_UIDNUMBER ); + obj_class = LDAP_OBJ_SAMBASAMACCOUNT; + posix_obj_class = LDAP_OBJ_POSIXACCOUNT; + suffix = lp_ldap_suffix(); + snprintf(filter, sizeof(filter), + "(&(|(&(objectClass=%s)(objectClass=%s))(objectClass=%s))(%s=%s))", + obj_class, posix_obj_class, LDAP_OBJ_IDMAP_ENTRY, + get_attr_key2string( sidmap_attr_list, LDAP_ATTR_SID ), + sid_str); + } + else { + type = get_attr_key2string( sidmap_attr_list, LDAP_ATTR_GIDNUMBER ); + obj_class = LDAP_OBJ_GROUPMAP; + posix_obj_class = LDAP_OBJ_POSIXGROUP; + suffix = lp_ldap_group_suffix(); + snprintf(filter, sizeof(filter), + "(&(|(objectClass=%s)(objectClass=%s))(%s=%s))", + obj_class, LDAP_OBJ_IDMAP_ENTRY, + get_attr_key2string( sidmap_attr_list, LDAP_ATTR_SID ), + sid_str); } - count = ldap_count_entries(ldap_state.ldap_struct, result); + + attr_list = get_attr_list( sidmap_attr_list ); + rc = smbldap_search(ldap_state.smbldap_state, suffix, LDAP_SCOPE_SUBTREE, + filter, attr_list, 0, &result); + + if (rc != LDAP_SUCCESS) + goto out; + + count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result); + + /* fall back to looking up an idmap entry if we didn't find anything under the idmap + user or group suffix */ + if (count == 0) { - pstr_sprintf(filter, - "(&(objectClass=idmapEntry)(ntSid=%s))", sid_str); + ldap_msgfree(result); + + snprintf(filter, sizeof(filter), "(&(objectClass=%s)(%s=%s))", + LDAP_OBJ_IDMAP_ENTRY, LDAP_ATTRIBUTE_SID, sid_str); - rc = ldap_idmap_search(&ldap_state, lp_ldap_suffix(), - LDAP_SCOPE_SUBTREE, filter, - attrs, 0, &result); - if (rc != LDAP_SUCCESS) { - goto out; - } - count = ldap_count_entries(ldap_state.ldap_struct, result); - } + suffix = lp_ldap_idmap_suffix(); - /* our search filters may 2 objects in the case that a user and group - rid are the same */ - if (count != 1 && count != 2) { - DEBUG(0, - ("ldap_get_id_from_sid: incorrect number of objects\n")); + rc = smbldap_search(ldap_state.smbldap_state, suffix, LDAP_SCOPE_SUBTREE, + filter, attr_list, 0, &result); + + if (rc != LDAP_SUCCESS) + goto out; + + count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result); + } + + if ( count > 1 ) { + DEBUG(0, ("ldap_get_id_from_sid: search %s returned more than on entry!\n", + filter)); goto out; } - entry = ldap_first_entry(ldap_state.ldap_struct, result); - if (!ldap_idmap_attribute(&ldap_state, entry, type, id_str)) { - entry = ldap_next_entry(ldap_state.ldap_struct, entry); - - if (!ldap_idmap_attribute(&ldap_state, entry, type, id_str)) { - int i; - - for (i = 0; i < LDAP_MAX_ALLOC_ID; i++) { - ret = ldap_allocate_id(id, *id_type); - if (NT_STATUS_IS_OK(ret)) { - break; - } - } - if (NT_STATUS_IS_OK(ret)) { - ret = ldap_set_mapping(sid, *id, *id_type); - } else { - DEBUG(0,("ldap_allocate_id: cannot acquire id" - " lock\n")); - } - } else { - if ((*id_type & ID_USERID)) { + /* we might have an existing entry to work with so pull out the requested information */ + + if ( count ) { + entry = ldap_first_entry(ldap_state.smbldap_state->ldap_struct, result); + + dn = ldap_get_dn(ldap_state.smbldap_state->ldap_struct, result); + DEBUG(10, ("Found mapping entry at dn=%s, looking for %s\n", dn, type)); + + if ( smbldap_get_single_attribute(ldap_state.smbldap_state->ldap_struct, entry, type, id_str) ) + { + if ( (*id_type & ID_USERID) ) id->uid = strtoul(id_str, NULL, 10); - } else { + else id->gid = strtoul(id_str, NULL, 10); - } + ret = NT_STATUS_OK; + goto out; } - } else { - if ((*id_type & ID_USERID)) { - id->uid = strtoul(id_str, NULL, 10); - } else { - id->gid = strtoul(id_str, NULL, 10); + } + + if (!(*id_type & ID_QUERY_ONLY)) { + /* if entry == NULL, and we are asked to - allocate a new id */ + int i; + + for (i = 0; i < LDAP_MAX_ALLOC_ID; i++) + { + ret = ldap_allocate_id(id, *id_type); + if ( NT_STATUS_IS_OK(ret) ) + break; + } + + if ( !NT_STATUS_IS_OK(ret) ) { + DEBUG(0,("ldap_allocate_id: cannot acquire id lock!\n")); + goto out; } - ret = NT_STATUS_OK; + + ret = ldap_set_mapping(sid, *id, *id_type); + } else { + /* no match, and not adding one */ + ret = NT_STATUS_UNSUCCESSFUL; } + out: + free_attr_list( attr_list ); + if (result) + ldap_msgfree(result); + if (dn) + ldap_memfree(dn); + return ret; } -/* This function cannot be called to modify a mapping, only set a new one */ -static NTSTATUS ldap_set_mapping(const DOM_SID *sid, unid_t id, int id_type) +/*********************************************************************** + This function cannot be called to modify a mapping, only set a new one + + This takes a possible pointer to the existing entry for the UID or SID + involved. +***********************************************************************/ + +static NTSTATUS ldap_set_mapping_internals(const DOM_SID *sid, unid_t id, + int id_type, const char *ldap_dn, + LDAPMessage *entry) { - pstring dn, sid_str, id_str; - const char *type = (id_type & ID_USERID) ? "uidNumber" : "gidNumber"; - LDAPMod *mods[3]; - LDAPMod mod[2]; - char *val[4]; - int rc; - int attempts = 0; + char *dn = NULL; + pstring id_str; + fstring type; + LDAPMod **mods = NULL; + int rc = -1; + int ldap_op; + fstring sid_string; + char **values = NULL; + int i; + + sid_to_string( sid_string, sid ); + + if (ldap_dn) { + DEBUG(10, ("Adding new IDMAP mapping on DN: %s", ldap_dn)); + ldap_op = LDAP_MOD_REPLACE; + dn = strdup(ldap_dn); + } else { + ldap_op = LDAP_MOD_ADD; + asprintf(&dn, "%s=%s,%s", get_attr_key2string( sidmap_attr_list, LDAP_ATTR_SID), + sid_string, lp_ldap_idmap_suffix()); + } + + if (!dn) { + DEBUG(0, ("ldap_set_mapping_internals: out of memory allocating DN!\n")); + return NT_STATUS_NO_MEMORY; + } - pstr_sprintf(id_str, "%ud", ((id_type & ID_USERID) ? id.uid : id.gid)); - sid_to_string(sid_str, sid); - pstr_sprintf(dn, "%s=%ud,%s", type, ((id_type & ID_USERID) ? id.uid : id.gid), lp_ldap_suffix()); - mod[0].mod_op = LDAP_MOD_REPLACE; - mod[0].mod_type = strdup(type); - val[0] = id_str; val[1] = NULL; - mod[0].mod_values = val; - - mod[1].mod_op = LDAP_MOD_REPLACE; - mod[1].mod_type = strdup("ntSid"); - val[2] = sid_str; val[3] = NULL; - mod[1].mod_values = val + 2; - - mods[0] = mod; mods[1] = mod + 1; mods[2] = NULL; - - do { - if ((rc = ldap_idmap_retry_open(&ldap_state, &attempts)) != - LDAP_SUCCESS) continue; + if ( id_type & ID_USERID ) + fstrcpy( type, get_attr_key2string( sidmap_attr_list, LDAP_ATTR_UIDNUMBER ) ); + else + fstrcpy( type, get_attr_key2string( sidmap_attr_list, LDAP_ATTR_GIDNUMBER ) ); + + snprintf(id_str, sizeof(id_str), "%u", ((id_type & ID_USERID) ? id.uid : id.gid)); + + if (entry) + values = ldap_get_values(ldap_state.smbldap_state->ldap_struct, entry, "objectClass"); + + if (values) { + BOOL found_idmap = False; + for (i=0; values[i]; i++) { + if (StrCaseCmp(values[i], LDAP_OBJ_IDMAP_ENTRY) == 0) { + found_idmap = True; + break; + } + } + if (!found_idmap) + smbldap_set_mod( &mods, LDAP_MOD_ADD, + "objectClass", LDAP_OBJ_IDMAP_ENTRY ); + } else { + smbldap_set_mod( &mods, LDAP_MOD_ADD, + "objectClass", LDAP_OBJ_IDMAP_ENTRY ); + } + + smbldap_make_mod( ldap_state.smbldap_state->ldap_struct, + entry, &mods, type, id_str ); + + smbldap_make_mod( ldap_state.smbldap_state->ldap_struct, + entry, &mods, + get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID), + sid_string ); + + /* There may well be nothing at all to do */ + if (mods) { + switch(ldap_op) + { + case LDAP_MOD_ADD: + smbldap_set_mod( &mods, LDAP_MOD_ADD, + "objectClass", LDAP_OBJ_SID_ENTRY ); + rc = smbldap_add(ldap_state.smbldap_state, dn, mods); + break; + case LDAP_MOD_REPLACE: + rc = smbldap_modify(ldap_state.smbldap_state, dn, mods); + break; + } - rc = ldap_modify_s(ldap_state.ldap_struct, dn, mods); - } while ((rc == LDAP_SERVER_DOWN) && (attempts <= 8)); + ldap_mods_free( mods, True ); + } else { + rc = LDAP_SUCCESS; + } if (rc != LDAP_SUCCESS) { + char *ld_error = NULL; + ldap_get_option(ldap_state.smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, + &ld_error); + DEBUG(0,("ldap_set_mapping_internals: Failed to %s mapping from %s to %u [%s]\n", + (ldap_op == LDAP_MOD_ADD) ? "add" : "replace", + sid_string, (unsigned int)((id_type & ID_USERID) ? id.uid : id.gid), type)); + DEBUG(0, ("ldap_set_mapping_internals: Error was: %s (%s)\n", ld_error ? ld_error : "(NULL)", ldap_err2string (rc))); return NT_STATUS_UNSUCCESSFUL; } + + DEBUG(10,("ldap_set_mapping: Successfully created mapping from %s to %d [%s]\n", + sid_string, ((id_type & ID_USERID) ? id.uid : id.gid), type)); return NT_STATUS_OK; } +/*********************************************************************** + This function cannot be called to modify a mapping, only set a new one +***********************************************************************/ + +static NTSTATUS ldap_set_mapping(const DOM_SID *sid, unid_t id, int id_type) +{ + NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; + char *dn = NULL; + LDAPMessage *result = NULL; + LDAPMessage *entry = NULL; + const char *type; + const char *obj_class; + const char *posix_obj_class; + const char *suffix; + fstring sid_str; + fstring id_str; + pstring filter; + char **attr_list; + int rc; + int count; + + /* try for a samba user or group mapping (looking for an entry with a SID) */ + if ( id_type & ID_USERID ) { + obj_class = LDAP_OBJ_SAMBASAMACCOUNT; + suffix = lp_ldap_suffix(); + type = get_attr_key2string( idpool_attr_list, LDAP_ATTR_UIDNUMBER ); + posix_obj_class = LDAP_OBJ_POSIXACCOUNT; + snprintf(id_str, sizeof(id_str), "%u", id.uid ); + } + else { + obj_class = LDAP_OBJ_GROUPMAP; + suffix = lp_ldap_group_suffix(); + type = get_attr_key2string( idpool_attr_list, LDAP_ATTR_GIDNUMBER ); + posix_obj_class = LDAP_OBJ_POSIXGROUP; + snprintf(id_str, sizeof(id_str), "%u", id.gid ); + } + + sid_to_string(sid_str, sid); + snprintf(filter, sizeof(filter), + "(|" + "(&(|(objectClass=%s)(|(objectClass=%s)(objectClass=%s)))(%s=%s))" + "(&(objectClass=%s)(%s=%s))" + ")", + /* objectClasses that might contain a SID */ + LDAP_OBJ_SID_ENTRY, LDAP_OBJ_IDMAP_ENTRY, obj_class, + get_attr_key2string( sidmap_attr_list, LDAP_ATTR_SID ), + sid_str, + + /* objectClasses that might contain a Unix UID/GID */ + posix_obj_class, + /* Unix UID/GID specifier*/ + type, + /* actual ID */ + id_str); + + attr_list = get_attr_list( sidmap_attr_list ); + rc = smbldap_search(ldap_state.smbldap_state, suffix, LDAP_SCOPE_SUBTREE, + filter, attr_list, 0, &result); + free_attr_list( attr_list ); + + if (rc != LDAP_SUCCESS) + goto out; + + count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result); + + /* fall back to looking up an idmap entry if we didn't find anything under the idmap + user or group suffix */ + + if (count == 1) { + entry = ldap_first_entry(ldap_state.smbldap_state->ldap_struct, result); + + dn = ldap_get_dn(ldap_state.smbldap_state->ldap_struct, result); + DEBUG(10, ("Found partial mapping entry at dn=%s, looking for %s\n", dn, type)); + + ret = ldap_set_mapping_internals(sid, id, id_type, dn, entry); + + goto out; + } else if (count > 1) { + DEBUG(0, ("Too many entries trying to find DN to attach ldap \n")); + goto out; + } + + ret = ldap_set_mapping_internals(sid, id, id_type, NULL, NULL); + +out: + if (result) + ldap_msgfree(result); + if (dn) + ldap_memfree(dn); + + return ret; +} /***************************************************************************** Initialise idmap database. *****************************************************************************/ -static NTSTATUS ldap_idmap_init(void) +static NTSTATUS ldap_idmap_init( char *params ) { - /* We wait for the first search request before we try to connect to - the LDAP server. We may want to connect upon initialization though - -- aliguori */ + fstring filter; + int rc; + char **attr_list; + LDAPMessage *result = NULL; + LDAPMod **mods = NULL; + int count; + NTSTATUS nt_status; + + ldap_state.mem_ctx = talloc_init("idmap_ldap"); + if (!ldap_state.mem_ctx) { + return NT_STATUS_NO_MEMORY; + } + + /* assume location is the only parameter */ + if (!NT_STATUS_IS_OK(nt_status = + smbldap_init(ldap_state.mem_ctx, params, + &ldap_state.smbldap_state))) { + talloc_destroy(ldap_state.mem_ctx); + return nt_status; + } + + /* see if the idmap suffix and sub entries exists */ + + snprintf( filter, sizeof(filter), "(objectclass=%s)", LDAP_OBJ_IDPOOL ); + + attr_list = get_attr_list( idpool_attr_list ); + rc = smbldap_search(ldap_state.smbldap_state, lp_ldap_idmap_suffix(), + LDAP_SCOPE_SUBTREE, filter, attr_list, 0, &result); + free_attr_list ( attr_list ); + + if (rc != LDAP_SUCCESS) + return NT_STATUS_UNSUCCESSFUL; + + count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result); + + if ( count > 1 ) { + DEBUG(0,("ldap_idmap_init: multiple entries returned from %s (base == %s)\n", + filter, lp_ldap_idmap_suffix() )); + return NT_STATUS_UNSUCCESSFUL; + } + else if (count == 0) { + uid_t luid, huid; + gid_t lgid, hgid; + fstring uid_str, gid_str; + + if ( !lp_idmap_uid(&luid, &huid) || !lp_idmap_gid( &lgid, &hgid ) ) { + DEBUG(0,("ldap_idmap_init: idmap uid/gid parameters not specified\n")); + return NT_STATUS_UNSUCCESSFUL; + } + + snprintf( uid_str, sizeof(uid_str), "%d", luid ); + snprintf( gid_str, sizeof(gid_str), "%d", lgid ); + + smbldap_set_mod( &mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_IDPOOL ); + smbldap_set_mod( &mods, LDAP_MOD_ADD, + get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER), uid_str ); + smbldap_set_mod( &mods, LDAP_MOD_ADD, + get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER), gid_str ); + + rc = smbldap_modify(ldap_state.smbldap_state, lp_ldap_idmap_suffix(), mods); + } + return NT_STATUS_OK; } -/* End the LDAP session */ +/***************************************************************************** + End the LDAP session +*****************************************************************************/ + static NTSTATUS ldap_idmap_close(void) { - if (ldap_state.ldap_struct != NULL) { - ldap_unbind_ext(ldap_state.ldap_struct, NULL, NULL); - ldap_state.ldap_struct = NULL; - } + + smbldap_free_struct(&(ldap_state).smbldap_state); + talloc_destroy(ldap_state.mem_ctx); DEBUG(5,("The connection to the LDAP server was closed\n")); /* maybe free the results here --metze */ @@ -823,6 +955,8 @@ static void ldap_idmap_status(void) static struct idmap_methods ldap_methods = { ldap_idmap_init, + ldap_allocate_rid, + ldap_allocate_id, ldap_get_sid_from_id, ldap_get_id_from_sid, ldap_set_mapping, @@ -833,6 +967,5 @@ static struct idmap_methods ldap_methods = { NTSTATUS idmap_ldap_init(void) { - DEBUG(0,("idmap_reg_ldap: no LDAP support\n")); return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "ldap", &ldap_methods); } diff --git a/source3/sam/idmap_tdb.c b/source3/sam/idmap_tdb.c index 31c12241bf..7f8dce1f1a 100644 --- a/source3/sam/idmap_tdb.c +++ b/source3/sam/idmap_tdb.c @@ -45,44 +45,126 @@ static struct idmap_state { gid_t gid_low, gid_high; /* Range of gids to allocate */ } idmap_state; -/* Allocate either a user or group id from the pool */ +/********************************************************************** + Return the TDB_CONTEXT* for winbindd_idmap. I **really** feel + dirty doing this, but not so dirty that I want to create another + tdb +***********************************************************************/ + +TDB_CONTEXT *idmap_tdb_handle( void ) +{ + if ( idmap_tdb ) + return idmap_tdb; + + return NULL; +} + +/********************************************************************** + allocate a new RID; We don't care if is a user or group +**********************************************************************/ + +static NTSTATUS db_allocate_rid(uint32 *rid, int rid_type) +{ + uint32 lowrid, highrid; + uint32 tmp_rid; + + /* can't handle group rids right now. This is such a mess.... */ + + if ( rid_type == GROUP_RID_TYPE ) + return NT_STATUS_UNSUCCESSFUL; + + /* cannot fail since idmap is only called winbindd */ + + idmap_get_free_rid_range( &lowrid, &highrid ); + + tmp_rid = lowrid; + + if ( !tdb_change_uint32_atomic(idmap_tdb, "RID_COUNTER", &tmp_rid, RID_MULTIPLIER) ) { + DEBUG(3,("db_allocate_rid: Failed to locate next rid record in idmap db\n")); + return NT_STATUS_UNSUCCESSFUL; + } + + if ( tmp_rid > highrid ) { + DEBUG(0, ("db_allocate_rid: no RIDs available!\n")); + return NT_STATUS_UNSUCCESSFUL; + } + + *rid = tmp_rid; + + return NT_STATUS_OK; +} + +/********************************************************************** + Allocate either a user or group id from the pool +**********************************************************************/ + static NTSTATUS db_allocate_id(unid_t *id, int id_type) { + BOOL ret; int hwm; - if (!id) return NT_STATUS_INVALID_PARAMETER; + if (!id) + return NT_STATUS_INVALID_PARAMETER; /* Get current high water mark */ switch (id_type & ID_TYPEMASK) { case ID_USERID: + if ((hwm = tdb_fetch_int32(idmap_tdb, HWM_USER)) == -1) { return NT_STATUS_INTERNAL_DB_ERROR; } + /* check it is in the range */ if (hwm > idmap_state.uid_high) { DEBUG(0, ("idmap Fatal Error: UID range full!! (max: %u)\n", idmap_state.uid_high)); return NT_STATUS_UNSUCCESSFUL; } - (*id).uid = hwm++; + /* fetch a new id and increment it */ + ret = tdb_change_uint32_atomic(idmap_tdb, HWM_USER, &hwm, 1); + if (!ret) { + DEBUG(0, ("idmap_tdb: Fatal error while fetching a new id\n!")); + return NT_STATUS_UNSUCCESSFUL; + } + + /* recheck it is in the range */ + if (hwm > idmap_state.uid_high) { + DEBUG(0, ("idmap Fatal Error: UID range full!! (max: %u)\n", idmap_state.uid_high)); + return NT_STATUS_UNSUCCESSFUL; + } + + (*id).uid = hwm; + DEBUG(10,("db_allocate_id: ID_USERID (*id).uid = %d\n", (unsigned int)hwm)); - /* Store new high water mark */ - tdb_store_int32(idmap_tdb, HWM_USER, hwm); break; case ID_GROUPID: if ((hwm = tdb_fetch_int32(idmap_tdb, HWM_GROUP)) == -1) { return NT_STATUS_INTERNAL_DB_ERROR; } + /* check it is in the range */ if (hwm > idmap_state.gid_high) { DEBUG(0, ("idmap Fatal Error: GID range full!! (max: %u)\n", idmap_state.gid_high)); return NT_STATUS_UNSUCCESSFUL; } - (*id).gid = hwm++; + /* fetch a new id and increment it */ + ret = tdb_change_uint32_atomic(idmap_tdb, HWM_GROUP, &hwm, 1); + + if (!ret) { + DEBUG(0, ("idmap_tdb: Fatal error while fetching a new id\n!")); + return NT_STATUS_UNSUCCESSFUL; + } + + /* recheck it is in the range */ + if (hwm > idmap_state.gid_high) { + DEBUG(0, ("idmap Fatal Error: GID range full!! (max: %u)\n", idmap_state.gid_high)); + return NT_STATUS_UNSUCCESSFUL; + } + + (*id).gid = hwm; + DEBUG(10,("db_allocate_id: ID_GROUPID (*id).gid = %d\n", (unsigned int)hwm)); - /* Store new high water mark */ - tdb_store_int32(idmap_tdb, HWM_GROUP, hwm); break; default: return NT_STATUS_INVALID_PARAMETER; @@ -92,13 +174,14 @@ static NTSTATUS db_allocate_id(unid_t *id, int id_type) } /* Get a sid from an id */ -static NTSTATUS db_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) +static NTSTATUS internal_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) { TDB_DATA key, data; fstring keystr; NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - if (!sid) return NT_STATUS_INVALID_PARAMETER; + if (!sid) + return NT_STATUS_INVALID_PARAMETER; switch (id_type & ID_TYPEMASK) { case ID_USERID: @@ -114,10 +197,13 @@ static NTSTATUS db_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) key.dptr = keystr; key.dsize = strlen(keystr) + 1; + DEBUG(10,("internal_get_sid_from_id: fetching record %s\n", keystr )); + data = tdb_fetch(idmap_tdb, key); if (data.dptr) { if (string_to_sid(sid, data.dptr)) { + DEBUG(10,("internal_get_sid_from_id: fetching record %s -> %s\n", keystr, data.dptr )); ret = NT_STATUS_OK; } SAFE_FREE(data.dptr); @@ -126,14 +212,15 @@ static NTSTATUS db_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) return ret; } -/* Get an id from a sid */ -static NTSTATUS db_get_id_from_sid(unid_t *id, int *id_type, const DOM_SID *sid) +/* Error codes for get_id_from_sid */ +enum getidfromsiderr { GET_ID_FROM_SID_OK = 0, GET_ID_FROM_SID_NOTFOUND, GET_ID_FROM_SID_WRONG_TYPE, GET_ID_FROM_SID_ERR }; + +static enum getidfromsiderr internal_get_id_from_sid(unid_t *id, int *id_type, const DOM_SID *sid) { - TDB_DATA data, key; + enum getidfromsiderr ret = GET_ID_FROM_SID_ERR; fstring keystr; - NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - - if (!sid || !id || !id_type) return NT_STATUS_INVALID_PARAMETER; + TDB_DATA key, data; + int type = *id_type & ID_TYPEMASK; /* Check if sid is present in database */ sid_to_string(keystr, sid); @@ -141,71 +228,186 @@ static NTSTATUS db_get_id_from_sid(unid_t *id, int *id_type, const DOM_SID *sid) key.dptr = keystr; key.dsize = strlen(keystr) + 1; + DEBUG(10,("internal_get_id_from_sid: fetching record %s of type 0x%x\n", keystr, type )); + data = tdb_fetch(idmap_tdb, key); + if (!data.dptr) { + DEBUG(10,("internal_get_id_from_sid: record %s not found\n", keystr )); + return GET_ID_FROM_SID_NOTFOUND; + } else { + DEBUG(10,("internal_get_id_from_sid: record %s -> %s\n", keystr, data.dptr )); + } - if (data.dptr) { - int type = *id_type & ID_TYPEMASK; + if (type == ID_EMPTY || type == ID_USERID) { fstring scanstr; + /* Parse and return existing uid */ + fstrcpy(scanstr, "UID %d"); + + if (sscanf(data.dptr, scanstr, &((*id).uid)) == 1) { + /* uid ok? */ + if (type == ID_EMPTY) { + *id_type = ID_USERID; + } + DEBUG(10,("internal_get_id_from_sid: %s fetching record %s -> %s \n", + (type == ID_EMPTY) ? "ID_EMPTY" : "ID_USERID", + keystr, data.dptr )); + ret = GET_ID_FROM_SID_OK; + } else { + ret = GET_ID_FROM_SID_WRONG_TYPE; + } + } + + if ((ret != GET_ID_FROM_SID_OK) && (type == ID_EMPTY || type == ID_GROUPID)) { + fstring scanstr; + /* Parse and return existing gid */ + fstrcpy(scanstr, "GID %d"); + + if (sscanf(data.dptr, scanstr, &((*id).gid)) == 1) { + /* gid ok? */ + if (type == ID_EMPTY) { + *id_type = ID_GROUPID; + } + DEBUG(10,("internal_get_id_from_sid: %s fetching record %s -> %s \n", + (type == ID_EMPTY) ? "ID_EMPTY" : "ID_GROUPID", + keystr, data.dptr )); + ret = GET_ID_FROM_SID_OK; + } else { + ret = GET_ID_FROM_SID_WRONG_TYPE; + } + } + + SAFE_FREE(data.dptr); - if (type == ID_EMPTY || type == ID_USERID) { - /* Parse and return existing uid */ - fstrcpy(scanstr, "UID %d"); + return ret; +} - if (sscanf(data.dptr, scanstr, &((*id).uid)) == 1) { - /* uid ok? */ - if (type == ID_EMPTY) { - *id_type = ID_USERID; - } - ret = NT_STATUS_OK; - goto idok; - } +/* Get a sid from an id */ +static NTSTATUS db_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type_in) +{ + NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; + enum getidfromsiderr iderr; + int id_type = id_type_in & ID_TYPEMASK; + unid_t id_tmp = id; + int id_type_tmp = id_type; + + DEBUG(10,("db_get_sid_from_id: id_type_in = 0x%x\n", id_type_in)); + + ret = internal_get_sid_from_id(sid, id, id_type); + if (!NT_STATUS_IS_OK(ret)) { + return ret; + } + + iderr = internal_get_id_from_sid(&id_tmp, &id_type_tmp, sid); + if (iderr != GET_ID_FROM_SID_OK) { + return NT_STATUS_UNSUCCESSFUL; + } + if (id_type_tmp != id_type) { + return NT_STATUS_UNSUCCESSFUL; + } else if (id_type == ID_USERID) { + if (id_tmp.uid != id.uid) { + return NT_STATUS_UNSUCCESSFUL; + } + } else if (id_type == ID_GROUPID) { + if (id_tmp.gid != id.gid) { + return NT_STATUS_UNSUCCESSFUL; } + } else { + return NT_STATUS_UNSUCCESSFUL; + } + return ret; +} +/* Get an id from a sid */ +static NTSTATUS db_get_id_from_sid(unid_t *id, int *id_type, const DOM_SID *sid) +{ + NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; + enum getidfromsiderr iderr; - if (type == ID_EMPTY || type == ID_GROUPID) { - /* Parse and return existing gid */ - fstrcpy(scanstr, "GID %d"); + DEBUG(10,("db_get_id_from_sid\n")); - if (sscanf(data.dptr, scanstr, &((*id).gid)) == 1) { - /* gid ok? */ - if (type == ID_EMPTY) { - *id_type = ID_GROUPID; - } - ret = NT_STATUS_OK; + if (!sid || !id || !id_type) + return NT_STATUS_INVALID_PARAMETER; + + iderr = internal_get_id_from_sid(id, id_type, sid); + if (iderr == GET_ID_FROM_SID_OK) { + DOM_SID sid_tmp; + ret = internal_get_sid_from_id(&sid_tmp, *id, *id_type); + if (NT_STATUS_IS_OK(ret)) { + if (!sid_equal(&sid_tmp, sid)) { + return NT_STATUS_UNSUCCESSFUL; } } -idok: - SAFE_FREE(data.dptr); + } else if (iderr == GET_ID_FROM_SID_WRONG_TYPE) { + /* We found a record but not the type we wanted. + * This is an error, not an opportunity to overwrite... + * JRA. + */ + return NT_STATUS_UNSUCCESSFUL; + } - } else if (!(*id_type & ID_NOMAP) && + if (!(*id_type & ID_QUERY_ONLY) && (iderr != GET_ID_FROM_SID_OK) && (((*id_type & ID_TYPEMASK) == ID_USERID) || (*id_type & ID_TYPEMASK) == ID_GROUPID)) { + TDB_DATA sid_data; + TDB_DATA ugid_data; + fstring sid_string; + + sid_to_string(sid_string, sid); + + sid_data.dptr = sid_string; + sid_data.dsize = strlen(sid_string)+1; + + /* Lock the record for this SID. */ + if (tdb_chainlock(idmap_tdb, sid_data) != 0) { + DEBUG(10,("db_get_id_from_sid: failed to lock record %s. Error %s\n", + sid_string, tdb_errorstr(idmap_tdb) )); + return NT_STATUS_UNSUCCESSFUL; + } - /* Allocate a new id for this sid */ - ret = db_allocate_id(id, *id_type); - if (NT_STATUS_IS_OK(ret)) { - fstring keystr2; + do { + fstring ugid_str; + /* Allocate a new id for this sid */ + ret = db_allocate_id(id, *id_type); + if (!NT_STATUS_IS_OK(ret)) + break; + + /* Store the UID side */ /* Store new id */ if (*id_type & ID_USERID) { - slprintf(keystr2, sizeof(keystr2), "UID %d", (*id).uid); + slprintf(ugid_str, sizeof(ugid_str), "UID %d", (*id).uid); } else { - slprintf(keystr2, sizeof(keystr2), "GID %d", (*id).gid); + slprintf(ugid_str, sizeof(ugid_str), "GID %d", (*id).gid); } + + ugid_data.dptr = ugid_str; + ugid_data.dsize = strlen(ugid_str) + 1; - data.dptr = keystr2; - data.dsize = strlen(keystr2) + 1; + DEBUG(10,("db_get_id_from_sid: storing %s -> %s\n", + ugid_data.dptr, sid_data.dptr )); - if (tdb_store(idmap_tdb, key, data, TDB_REPLACE) == -1) { - /* TODO: print tdb error !! */ - return NT_STATUS_UNSUCCESSFUL; + if (tdb_store(idmap_tdb, ugid_data, sid_data, TDB_INSERT) != -1) { + ret = NT_STATUS_OK; + break; } - if (tdb_store(idmap_tdb, data, key, TDB_REPLACE) == -1) { + if (tdb_error(idmap_tdb) != TDB_ERR_EXISTS) + DEBUG(10,("db_get_id_from_sid: error %s\n", tdb_errorstr(idmap_tdb) )); + ret = NT_STATUS_UNSUCCESSFUL; + } while (tdb_error(idmap_tdb) == TDB_ERR_EXISTS); + + if (NT_STATUS_IS_OK(ret)) { + + DEBUG(10,("db_get_id_from_sid: storing %s -> %s\n", + sid_data.dptr, ugid_data.dptr )); + + if (tdb_store(idmap_tdb, sid_data, ugid_data, TDB_REPLACE) == -1) { + DEBUG(10,("db_get_id_from_sid: error %s\n", tdb_errorstr(idmap_tdb) )); /* TODO: print tdb error !! */ + tdb_chainunlock(idmap_tdb, sid_data); return NT_STATUS_UNSUCCESSFUL; } - - ret = NT_STATUS_OK; } + + tdb_chainunlock(idmap_tdb, sid_data); } return ret; @@ -217,7 +419,10 @@ static NTSTATUS db_set_mapping(const DOM_SID *sid, unid_t id, int id_type) fstring ksidstr; fstring kidstr; - if (!sid) return NT_STATUS_INVALID_PARAMETER; + DEBUG(10,("db_set_mapping: id_type = 0x%x\n", id_type)); + + if (!sid) + return NT_STATUS_INVALID_PARAMETER; sid_to_string(ksidstr, sid); @@ -238,32 +443,51 @@ static NTSTATUS db_set_mapping(const DOM_SID *sid, unid_t id, int id_type) /* *DELETE* prevoius mappings if any. * This is done both SID and [U|G]ID passed in */ + /* Lock the record for this SID. */ + if (tdb_chainlock(idmap_tdb, ksid) != 0) { + DEBUG(10,("db_set_mapping: failed to lock record %s. Error %s\n", + ksidstr, tdb_errorstr(idmap_tdb) )); + return NT_STATUS_UNSUCCESSFUL; + } + + DEBUG(10,("db_set_mapping: fetching %s\n", ksid.dptr)); + data = tdb_fetch(idmap_tdb, ksid); if (data.dptr) { + DEBUG(10,("db_set_mapping: deleting %s and %s\n", data.dptr, ksid.dptr )); tdb_delete(idmap_tdb, data); tdb_delete(idmap_tdb, ksid); + SAFE_FREE(data.dptr); } data = tdb_fetch(idmap_tdb, kid); if (data.dptr) { + DEBUG(10,("db_set_mapping: deleting %s and %s\n", data.dptr, kid.dptr )); tdb_delete(idmap_tdb, data); tdb_delete(idmap_tdb, kid); + SAFE_FREE(data.dptr); } if (tdb_store(idmap_tdb, ksid, kid, TDB_INSERT) == -1) { DEBUG(0, ("idb_set_mapping: tdb_store 1 error: %s\n", tdb_errorstr(idmap_tdb))); + tdb_chainunlock(idmap_tdb, ksid); return NT_STATUS_UNSUCCESSFUL; } if (tdb_store(idmap_tdb, kid, ksid, TDB_INSERT) == -1) { DEBUG(0, ("idb_set_mapping: tdb_store 2 error: %s\n", tdb_errorstr(idmap_tdb))); + tdb_chainunlock(idmap_tdb, ksid); return NT_STATUS_UNSUCCESSFUL; } + + tdb_chainunlock(idmap_tdb, ksid); + DEBUG(10,("db_set_mapping: stored %s -> %s and %s -> %s\n", ksid.dptr, kid.dptr, kid.dptr, ksid.dptr )); return NT_STATUS_OK; } /***************************************************************************** Initialise idmap database. *****************************************************************************/ -static NTSTATUS db_idmap_init(void) + +static NTSTATUS db_idmap_init( char *params ) { SMB_STRUCT_STAT stbuf; char *tdbfile = NULL; @@ -271,30 +495,22 @@ static NTSTATUS db_idmap_init(void) BOOL tdb_is_new = False; /* use the old database if present */ - if (!file_exist(lock_path("idmap.tdb"), &stbuf)) { - if (file_exist(lock_path("winbindd_idmap.tdb"), &stbuf)) { - DEBUG(0, ("idmap_init: using winbindd_idmap.tdb file!\n")); - tdbfile = strdup(lock_path("winbindd_idmap.tdb")); - if (!tdbfile) { - DEBUG(0, ("idmap_init: out of memory!\n")); - return NT_STATUS_NO_MEMORY; - } - } else { - tdb_is_new = True; - } - } + tdbfile = strdup(lock_path("winbindd_idmap.tdb")); if (!tdbfile) { - tdbfile = strdup(lock_path("idmap.tdb")); - if (!tdbfile) { - DEBUG(0, ("idmap_init: out of memory!\n")); - return NT_STATUS_NO_MEMORY; - } + DEBUG(0, ("idmap_init: out of memory!\n")); + return NT_STATUS_NO_MEMORY; + } + + if (!file_exist(tdbfile, &stbuf)) { + tdb_is_new = True; } - /* Open tdb cache */ + DEBUG(10,("db_idmap_init: Opening tdbfile %s\n", tdbfile )); + + /* Open idmap repository */ if (!(idmap_tdb = tdb_open_log(tdbfile, 0, TDB_DEFAULT, O_RDWR | O_CREAT, - 0600))) { + 0644))) { DEBUG(0, ("idmap_init: Unable to open idmap database\n")); SAFE_FREE(tdbfile); return NT_STATUS_UNSUCCESSFUL; @@ -302,16 +518,20 @@ static NTSTATUS db_idmap_init(void) SAFE_FREE(tdbfile); - /* check against earlier versions */ if (tdb_is_new) { - /* TODO: delete the file if this fail */ + /* the file didn't existed before opening it, let's + * store idmap version as nobody else yet opened and + * stored it. I do not like this method but didn't + * found a way to understand if an opened tdb have + * been just created or not --- SSS */ tdb_store_int32(idmap_tdb, "IDMAP_VERSION", IDMAP_VERSION); - } else { - version = tdb_fetch_int32(idmap_tdb, "IDMAP_VERSION"); - if (version != IDMAP_VERSION) { - DEBUG(0, ("idmap_init: Unable to open idmap database, it's in an old format!\n")); - return NT_STATUS_INTERNAL_DB_ERROR; - } + } + + /* check against earlier versions */ + version = tdb_fetch_int32(idmap_tdb, "IDMAP_VERSION"); + if (version != IDMAP_VERSION) { + DEBUG(0, ("idmap_init: Unable to open idmap database, it's in an old format!\n")); + return NT_STATUS_INTERNAL_DB_ERROR; } /* Create high water marks for group and user id */ @@ -424,9 +644,11 @@ static void db_idmap_status(void) /* Display complete mapping of users and groups to rids */ } -struct idmap_methods db_methods = { +static struct idmap_methods db_methods = { db_idmap_init, + db_allocate_rid, + db_allocate_id, db_get_sid_from_id, db_get_id_from_sid, db_set_mapping, @@ -435,9 +657,7 @@ struct idmap_methods db_methods = { }; -NTSTATUS idmap_reg_tdb(struct idmap_methods **meth) +NTSTATUS idmap_tdb_init(void) { - *meth = &db_methods; - - return NT_STATUS_OK; + return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "tdb", &db_methods); } diff --git a/source3/sam/idmap_util.c b/source3/sam/idmap_util.c index 8c3a378832..f767cc898c 100644 --- a/source3/sam/idmap_util.c +++ b/source3/sam/idmap_util.c @@ -22,10 +22,54 @@ #undef DBGC_CLASS #define DBGC_CLASS DBGC_IDMAP +/********************************************************************** +**********************************************************************/ + +BOOL idmap_get_free_ugid_range(uint32 *low, uint32 *high) +{ + uid_t u_low, u_high; + gid_t g_low, g_high; + + if (!lp_idmap_uid(&u_low, &u_high) || !lp_idmap_gid(&g_low, &g_high)) { + return False; + } + + *low = (u_low < g_low) ? u_low : g_low; + *high = (u_high < g_high) ? u_high : g_high; + + return True; +} /****************************************************************** - * Get the free RID base if idmap is configured, otherwise return 0 - ******************************************************************/ + Get the the non-algorithmic RID range if idmap range are defined +******************************************************************/ + +BOOL idmap_get_free_rid_range(uint32 *low, uint32 *high) +{ + uint32 id_low, id_high; + + if (!lp_enable_rid_algorithm()) { + *low = BASE_RID; + *high = (uint32)-1; + } + + if (!idmap_get_free_ugid_range(&id_low, &id_high)) { + return False; + } + + *low = fallback_pdb_uid_to_user_rid(id_low); + if (fallback_pdb_user_rid_to_uid((uint32)-1) < id_high) { + *high = (uint32)-1; + } else { + *high = fallback_pdb_uid_to_user_rid(id_high); + } + + return True; +} + +/********************************************************************** + Get the free RID base if idmap is configured, otherwise return 0 +**********************************************************************/ uint32 idmap_get_free_rid_base(void) { @@ -36,6 +80,9 @@ uint32 idmap_get_free_rid_base(void) return 0; } +/********************************************************************** +**********************************************************************/ + BOOL idmap_check_ugid_is_in_free_range(uint32 id) { uint32 low, high; @@ -49,6 +96,9 @@ BOOL idmap_check_ugid_is_in_free_range(uint32 id) return True; } +/********************************************************************** +**********************************************************************/ + BOOL idmap_check_rid_is_in_free_range(uint32 rid) { uint32 low, high; @@ -56,13 +106,20 @@ BOOL idmap_check_rid_is_in_free_range(uint32 rid) if (!idmap_get_free_rid_range(&low, &high)) { return False; } + if (rid < algorithmic_rid_base()) { + return True; + } + if (rid < low || rid > high) { return False; } + return True; } -/* if it is a foreign SID or if the SID is in the free range, return true */ +/********************************************************************** + if it is a foreign SID or if the SID is in the free range, return true +**********************************************************************/ BOOL idmap_check_sid_is_in_free_range(const DOM_SID *sid) { @@ -80,182 +137,70 @@ BOOL idmap_check_sid_is_in_free_range(const DOM_SID *sid) return True; } -/****************************************************************** - * Get the the non-algorithmic RID range if idmap range are defined - ******************************************************************/ - -BOOL idmap_get_free_rid_range(uint32 *low, uint32 *high) -{ - uint32 id_low, id_high; - - if (lp_idmap_only()) { - *low = BASE_RID; - *high = (uint32)-1; - } - - if (!idmap_get_free_ugid_range(&id_low, &id_high)) { - return False; - } - - *low = fallback_pdb_uid_to_user_rid(id_low); - if (fallback_pdb_user_rid_to_uid((uint32)-1) < id_high) { - *high = (uint32)-1; - } else { - *high = fallback_pdb_uid_to_user_rid(id_high); - } - - return True; -} - -BOOL idmap_get_free_ugid_range(uint32 *low, uint32 *high) -{ - uid_t u_low, u_high; - gid_t g_low, g_high; - - if (!lp_idmap_uid(&u_low, &u_high) || !lp_idmap_gid(&g_low, &g_high)) { - return False; - } - if (u_low < g_low) { - *low = u_low; - } else { - *low = g_low; - } - if (u_high < g_high) { - *high = g_high; - } else { - *high = u_high; - } - return True; -} - /***************************************************************** - *THE CANONICAL* convert uid_t to SID function. - check idmap if uid is in idmap range, otherwise falls back to - the legacy algorithmic mapping. - A special cache is used for uids that maps to Wellknown SIDs Returns SID pointer. *****************************************************************/ -NTSTATUS uid_to_sid(DOM_SID *sid, uid_t uid) +NTSTATUS idmap_uid_to_sid(DOM_SID *sid, uid_t uid) { - NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; unid_t id; int flags; - DEBUG(10,("uid_to_sid: uid = [%d]\n", uid)); + DEBUG(10,("idmap_uid_to_sid: uid = [%d]\n", uid)); flags = ID_USERID; - if (!lp_idmap_only() && !idmap_check_ugid_is_in_free_range(uid)) { - flags |= ID_NOMAP; - } - id.uid = uid; - if (NT_STATUS_IS_ERR(ret = idmap_get_sid_from_id(sid, id, flags))) { - DEBUG(10, ("uid_to_sid: Failed to map uid = [%u]\n", (unsigned int)uid)); - if (flags & ID_NOMAP) { - sid_copy(sid, get_global_sam_sid()); - sid_append_rid(sid, fallback_pdb_uid_to_user_rid(uid)); - - DEBUG(10,("uid_to_sid: Fall back to algorithmic mapping: %u -> %s\n", (unsigned int)uid, sid_string_static(sid))); - ret = NT_STATUS_OK; - } - } - - return ret; + + return idmap_get_sid_from_id(sid, id, flags); } /***************************************************************** - *THE CANONICAL* convert gid_t to SID function. - check idmap if gid is in idmap range, otherwise falls back to - the legacy algorithmic mapping. Group mapping is used for gids that maps to Wellknown SIDs Returns SID pointer. *****************************************************************/ -NTSTATUS gid_to_sid(DOM_SID *sid, gid_t gid) +NTSTATUS idmap_gid_to_sid(DOM_SID *sid, gid_t gid) { - NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; unid_t id; int flags; - DEBUG(10,("gid_to_sid: gid = [%d]\n", gid)); + DEBUG(10,("idmap_gid_to_sid: gid = [%d]\n", gid)); flags = ID_GROUPID; - if (!lp_idmap_only() && !idmap_check_ugid_is_in_free_range(gid)) { - flags |= ID_NOMAP; +#if 0 /* JERRY */ + if (!idmap_check_ugid_is_in_free_range(gid)) { + flags |= ID_QUERY_ONLY; } - +#endif id.gid = gid; - if (NT_STATUS_IS_ERR(ret = idmap_get_sid_from_id(sid, id, flags))) { - DEBUG(10, ("gid_to_sid: Failed to map gid = [%u]\n", (unsigned int)gid)); - if (flags & ID_NOMAP) { - sid_copy(sid, get_global_sam_sid()); - sid_append_rid(sid, pdb_gid_to_group_rid(gid)); - - DEBUG(10,("gid_to_sid: Fall back to algorithmic mapping: %u -> %s\n", (unsigned int)gid, sid_string_static(sid))); - ret = NT_STATUS_OK; - } - } - - return ret; + return idmap_get_sid_from_id(sid, id, flags); } /***************************************************************** - *THE CANONICAL* convert SID to uid function. if it is a foreign sid or it is in idmap rid range check idmap, otherwise falls back to the legacy algorithmic mapping. - A special cache is used for uids that maps to Wellknown SIDs Returns True if this name is a user sid and the conversion was done correctly, False if not. *****************************************************************/ -NTSTATUS sid_to_uid(const DOM_SID *sid, uid_t *uid) +NTSTATUS idmap_sid_to_uid(const DOM_SID *sid, uid_t *uid, uint32 flags) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - BOOL fallback = False; unid_t id; - int flags; - - DEBUG(10,("sid_to_uid: sid = [%s]\n", sid_string_static(sid))); - - flags = ID_USERID; - if (!lp_idmap_only()) { - if (!idmap_check_sid_is_in_free_range(sid)) { - flags |= ID_NOMAP; - fallback = True; - } - } - if (NT_STATUS_IS_OK(idmap_get_id_from_sid(&id, &flags, sid))) { + DEBUG(10,("idmap_sid_to_uid: sid = [%s]\n", sid_string_static(sid))); - DEBUG(10,("sid_to_uid: uid = [%d]\n", id.uid)); + flags |= ID_USERID; + ret = idmap_get_id_from_sid(&id, &flags, sid); + + if ( NT_STATUS_IS_OK(ret) ) { + DEBUG(10,("idmap_sid_to_uid: uid = [%d]\n", id.uid)); *uid = id.uid; - ret = NT_STATUS_OK; - - } else if (fallback) { - uint32 rid; - - if (!sid_peek_rid(sid, &rid)) { - DEBUG(10,("sid_to_uid: invalid SID!\n")); - ret = NT_STATUS_INVALID_PARAMETER; - goto done; - } - - DEBUG(10,("sid_to_uid: Fall back to algorithmic mapping\n")); - - if (!fallback_pdb_rid_is_user(rid)) { - DEBUG(3, ("sid_to_uid: SID %s is *NOT* a user\n", sid_string_static(sid))); - ret = NT_STATUS_UNSUCCESSFUL; - } else { - *uid = fallback_pdb_user_rid_to_uid(rid); - DEBUG(10,("sid_to_uid: mapping: %s -> %u\n", sid_string_static(sid), (unsigned int)(*uid))); - ret = NT_STATUS_OK; - } - } + } -done: return ret; + } /***************************************************************** @@ -267,56 +212,59 @@ done: was done correctly, False if not. *****************************************************************/ -NTSTATUS sid_to_gid(const DOM_SID *sid, gid_t *gid) +NTSTATUS idmap_sid_to_gid(const DOM_SID *sid, gid_t *gid, uint32 flags) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - BOOL fallback = False; unid_t id; - int flags; DEBUG(10,("sid_to_gid: sid = [%s]\n", sid_string_static(sid))); - flags = ID_GROUPID; - if (!lp_idmap_only()) { - if (!idmap_check_sid_is_in_free_range(sid)) { - flags |= ID_NOMAP; - fallback = True; - } - } + flags |= ID_GROUPID; - if (NT_STATUS_IS_OK(idmap_get_id_from_sid(&id, &flags, sid))) { - - DEBUG(10,("sid_to_gid: gid = [%d]\n", id.gid)); + ret = idmap_get_id_from_sid(&id, &flags, sid); + + if ( NT_STATUS_IS_OK(ret) ) + { + DEBUG(10,("idmap_sid_to_gid: gid = [%d]\n", id.gid)); *gid = id.gid; - ret = NT_STATUS_OK; + } - } else if (fallback) { - uint32 rid; + return ret; +} - if (!sid_peek_rid(sid, &rid)) { - DEBUG(10,("sid_to_uid: invalid SID!\n")); - ret = NT_STATUS_INVALID_PARAMETER; - goto done; - } - DEBUG(10,("sid_to_gid: Fall back to algorithmic mapping\n")); +/*************************************************************************** + Check first, call set_mapping if it doesn't already exist. +***************************************************************************/ - if (fallback_pdb_rid_is_user(rid)) { - DEBUG(3, ("sid_to_gid: SID %s is *NOT* a group\n", sid_string_static(sid))); - ret = NT_STATUS_UNSUCCESSFUL; - } else { - *gid = pdb_group_rid_to_gid(rid); - DEBUG(10,("sid_to_gid: mapping: %s -> %u\n", sid_string_static(sid), (unsigned int)(*gid))); - ret = NT_STATUS_OK; +static NTSTATUS wellknown_id_init(DOM_SID *sid, unid_t id, int flags) +{ + unid_t storedid; + int qflags = flags | ID_QUERY_ONLY; + + if (!NT_STATUS_IS_OK(idmap_get_id_from_sid(&storedid, &qflags, sid))) { + return idmap_set_mapping(sid, id, flags); + } else { + if (flags == ID_USERID && id.uid != storedid.uid) { + DEBUG(0,("wellknown_id_init: WARNING ! Stored uid %u for SID %s is not the same as the requested uid %u\n", + (unsigned int)storedid.uid, sid_string_static(sid), (unsigned int)id.uid )); + DEBUG(0,("wellknown_id_init: Attempting to overwrite old mapping with new.\n")); + return idmap_set_mapping(sid, id, flags); + } else if (flags == ID_GROUPID && id.gid != storedid.gid) { + DEBUG(0,("wellknown_id_init: WARNING ! Stored gid %u for SID %s is not the same as the requested gid %u\n", + (unsigned int)storedid.gid, sid_string_static(sid), (unsigned int)id.gid )); + DEBUG(0,("wellknown_id_init: Attempting to overwrite old mapping with new.\n")); + return idmap_set_mapping(sid, id, flags); } } - -done: - return ret; + return NT_STATUS_OK; } -/* Initialize idmap withWellknown SIDs like Guest, that are necessary - * to make samba run properly */ +/*************************************************************************** + Initialize idmap withWellknown SIDs like Guest, that are necessary + to make samba run properly. +***************************************************************************/ + BOOL idmap_init_wellknown_sids(void) { const char *guest_account = lp_guestaccount(); @@ -325,7 +273,7 @@ BOOL idmap_init_wellknown_sids(void) int num_entries=0; DOM_SID sid; unid_t id; - int flags; + fstring sid_string; if (!(guest_account && *guest_account)) { DEBUG(1, ("NULL guest account!?!?\n")); @@ -337,39 +285,52 @@ BOOL idmap_init_wellknown_sids(void) return False; } - flags = ID_USERID; + /* Fill in the SID for the guest account. */ id.uid = pass->pw_uid; sid_copy(&sid, get_global_sam_sid()); sid_append_rid(&sid, DOMAIN_USER_RID_GUEST); - if (NT_STATUS_IS_ERR(idmap_set_mapping(&sid, id, flags))) { + + if (!NT_STATUS_IS_OK(wellknown_id_init(&sid, id, ID_USERID))) { + DEBUG(0, ("Failed to setup UID mapping for GUEST (%s) to (%u)\n", + sid_to_string(sid_string, &sid), (unsigned int)id.uid)); + passwd_free(&pass); + return False; + } + + /* check if DOMAIN_GROUP_RID_GUESTS SID is set, if not store the + * guest account gid as mapping */ + id.gid = pass->pw_gid; + sid_copy(&sid, get_global_sam_sid()); + sid_append_rid(&sid, DOMAIN_GROUP_RID_GUESTS); + if (!NT_STATUS_IS_OK(wellknown_id_init(&sid, id, ID_GROUPID))) { + DEBUG(0, ("Failed to setup GID mapping for Group DOMAIN GUESTS (%s) to (%u)\n", + sid_to_string(sid_string, &sid), (unsigned int)id.gid)); passwd_free(&pass); return False; } + passwd_free(&pass); /* now fill in group mappings */ - if(pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &num_entries, ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV)) { + if(pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &num_entries, ENUM_ONLY_MAPPED)) { int i; for (i = 0; i < num_entries; i++) { id.gid = map[i].gid; - idmap_set_mapping(&(map[i].sid), id, ID_GROUPID); + wellknown_id_init(&map[i].sid, id, ID_GROUPID); } + SAFE_FREE(map); } - /* check if DOMAIN_GROUP_RID_GUESTS SID is set, if not store the - * guest account gid as mapping */ - flags = ID_GROUPID | ID_NOMAP; + /* Fill in the SID for the administrator account. */ + id.uid = 0; sid_copy(&sid, get_global_sam_sid()); - sid_append_rid(&sid, DOMAIN_GROUP_RID_GUESTS); - if (NT_STATUS_IS_ERR(idmap_get_id_from_sid(&id, &flags, &sid))) { - flags = ID_GROUPID; - id.gid = pass->pw_gid; - if (NT_STATUS_IS_ERR(idmap_set_mapping(&sid, id, flags))) { - passwd_free(&pass); - return False; - } + sid_append_rid(&sid, DOMAIN_USER_RID_ADMIN); + + if (!NT_STATUS_IS_OK(wellknown_id_init(&sid, id, ID_USERID))) { + DEBUG(0, ("Failed to setup UID mapping for ADMINISTRATOR (%s) to (%u)\n", + sid_to_string(sid_string, &sid), (unsigned int)id.uid)); + return False; } - passwd_free(&pass); return True; } diff --git a/source3/script/.cvsignore b/source3/script/.cvsignore index 5efd0d33db..7a8114ecd7 100644 --- a/source3/script/.cvsignore +++ b/source3/script/.cvsignore @@ -1,2 +1 @@ findsmb -mkproto.sh diff --git a/source3/script/build_env.sh b/source3/script/build_env.sh index 0000759f16..eb54f37aed 100755 --- a/source3/script/build_env.sh +++ b/source3/script/build_env.sh @@ -1,25 +1,31 @@ #!/bin/sh +if [ $# -lt 3 ] +then + echo "Usage: $0 srcdir builddir compiler" + exit 1 +fi + uname=`uname -a` date=`date` srcdir=$1 builddir=$2 compiler=$3 - if [ ! "x$USER" = "x" ]; then - whoami=$USER - else - if [ ! "x$LOGNAME" = "x" ]; then - whoami=$LOGNAME - else - whoami=`whoami || id -un` - fi - fi +if [ ! "x$USER" = "x" ]; then + whoami=$USER +else + if [ ! "x$LOGNAME" = "x" ]; then + whoami=$LOGNAME + else + whoami=`whoami || id -un` + fi +fi host=`hostname` cat <fsp_name)); - if(fsp->conn->vfs_ops.unlink(conn,fsp->fsp_name) != 0) { + if(SMB_VFS_UNLINK(conn,fsp->fsp_name) != 0) { /* * This call can potentially fail as another smbd may have * had the file open with delete on close set and deleted diff --git a/source3/smbd/conn.c b/source3/smbd/conn.c index b6c7aa1076..eb2d2bbcbf 100644 --- a/source3/smbd/conn.c +++ b/source3/smbd/conn.c @@ -93,6 +93,7 @@ thinking the server is still available. ****************************************************************************/ connection_struct *conn_new(void) { + TALLOC_CTX *mem_ctx; connection_struct *conn; int i; @@ -103,10 +104,16 @@ connection_struct *conn_new(void) return NULL; } - conn = (connection_struct *)malloc(sizeof(*conn)); - if (!conn) return NULL; + if ((mem_ctx=talloc_init("connection_struct"))==NULL) { + DEBUG(0,("talloc_init(connection_struct) failed!\n")); + return NULL; + } - ZERO_STRUCTP(conn); + if ((conn=(connection_struct *)talloc_zero(mem_ctx, sizeof(*conn)))==NULL) { + DEBUG(0,("talloc_zero() failed!\n")); + return NULL; + } + conn->mem_ctx = mem_ctx; conn->cnum = i; bitmap_set(bmap, i); @@ -195,27 +202,16 @@ void conn_clear_vuid_cache(uint16 vuid) void conn_free(connection_struct *conn) { - smb_vfs_handle_struct *handle, *thandle; - void (*done_fptr)(connection_struct *the_conn); + vfs_handle_struct *handle = NULL, *thandle = NULL; + TALLOC_CTX *mem_ctx = NULL; /* Free vfs_connection_struct */ - handle = conn->vfs_private; + handle = conn->vfs_handles; while(handle) { - /* Only call dlclose for the old modules */ - if (handle->handle) { - /* Close dlopen() handle */ - done_fptr = (void (*)(connection_struct *))sys_dlsym(handle->handle, "vfs_done"); - - if (done_fptr == NULL) { - DEBUG(3, ("No vfs_done() symbol found in module with handle %p, ignoring\n", handle->handle)); - } else { - done_fptr(conn); - } - sys_dlclose(handle->handle); - } - DLIST_REMOVE(conn->vfs_private, handle); + DLIST_REMOVE(conn->vfs_handles, handle); thandle = handle->next; - SAFE_FREE(handle); + if (handle->free_data) + handle->free_data(&handle->data); handle = thandle; } @@ -238,8 +234,9 @@ void conn_free(connection_struct *conn) bitmap_clear(bmap, conn->cnum); num_open--; + mem_ctx = conn->mem_ctx; ZERO_STRUCTP(conn); - SAFE_FREE(conn); + talloc_destroy(mem_ctx); } diff --git a/source3/smbd/connection.c b/source3/smbd/connection.c index c2718d4d70..5bb76eb3bd 100644 --- a/source3/smbd/connection.c +++ b/source3/smbd/connection.c @@ -38,10 +38,17 @@ TDB_CONTEXT *conn_tdb_ctx(void) static void make_conn_key(connection_struct *conn, const char *name, TDB_DATA *pkbuf, struct connections_key *pkey) { ZERO_STRUCTP(pkey); - ZERO_STRUCTP(pkbuf); pkey->pid = sys_getpid(); pkey->cnum = conn?conn->cnum:-1; fstrcpy(pkey->name, name); +#ifdef DEVELOPER + /* valgrind fixer... */ + { + size_t sl = strlen(pkey->name); + if (sizeof(fstring)-sl) + memset(&pkey->name[sl], '\0', sizeof(fstring)-sl); + } +#endif pkbuf->dptr = (char *)pkey; pkbuf->dsize = sizeof(*pkey); diff --git a/source3/smbd/dfree.c b/source3/smbd/dfree.c index 71b3f2bf77..f93cdf3791 100644 --- a/source3/smbd/dfree.c +++ b/source3/smbd/dfree.c @@ -80,7 +80,7 @@ static SMB_BIG_UINT disk_free(const char *path, BOOL small_query, dfree_command = lp_dfree_command(); if (dfree_command && *dfree_command) { - char *p; + const char *p; char **lines; pstring syscmd; @@ -93,15 +93,15 @@ static SMB_BIG_UINT disk_free(const char *path, BOOL small_query, DEBUG (3, ("Read input from dfree, \"%s\"\n", line)); - *dsize = (SMB_BIG_UINT)strtoul(line, &p, 10); - while (p && *p & isspace(*p)) + *dsize = STR_TO_SMB_BIG_UINT(line, &p); + while (p && *p && isspace(*p)) p++; if (p && *p) - *dfree = (SMB_BIG_UINT)strtoul(p, &p, 10); - while (p && *p & isspace(*p)) + *dfree = STR_TO_SMB_BIG_UINT(p, &p); + while (p && *p && isspace(*p)) p++; if (p && *p) - *bsize = (SMB_BIG_UINT)strtoul(p, NULL, 10); + *bsize = STR_TO_SMB_BIG_UINT(p, NULL); else *bsize = 1024; file_lines_free(lines); diff --git a/source3/smbd/dir.c b/source3/smbd/dir.c index 6cf56fd373..94b605ee8f 100644 --- a/source3/smbd/dir.c +++ b/source3/smbd/dir.c @@ -643,7 +643,7 @@ BOOL get_dir_entry(connection_struct *conn,char *mask,int dirtype, pstring fname pstrcpy(pathreal,path); pstrcat(path,fname); pstrcat(pathreal,dname); - if (conn->vfs_ops.stat(conn, pathreal, &sbuf) != 0) { + if (SMB_VFS_STAT(conn, pathreal, &sbuf) != 0) { DEBUG(5,("Couldn't stat 1 [%s]. Error = %s\n",path, strerror(errno) )); continue; } @@ -700,7 +700,7 @@ static BOOL user_can_read_file(connection_struct *conn, char *name, SMB_STRUCT_S return True; /* If we can't stat it does not show it */ - if (!VALID_STAT(*pst) && (vfs_stat(conn, name, pst) != 0)) + if (!VALID_STAT(*pst) && (SMB_VFS_STAT(conn, name, pst) != 0)) return False; /* Pseudo-open the file (note - no fd's created). */ @@ -715,7 +715,8 @@ static BOOL user_can_read_file(connection_struct *conn, char *name, SMB_STRUCT_S return False; /* Get NT ACL -allocated in main loop talloc context. No free needed here. */ - sd_size = conn->vfs_ops.fget_nt_acl(fsp, fsp->fd, &psd); + sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fd, + (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION), &psd); close_file(fsp, True); /* No access if SD get failed. */ @@ -753,7 +754,7 @@ static BOOL user_can_write_file(connection_struct *conn, char *name, SMB_STRUCT_ return True; /* If we can't stat it does not show it */ - if (!VALID_STAT(*pst) && (vfs_stat(conn, name, pst) != 0)) + if (!VALID_STAT(*pst) && (SMB_VFS_STAT(conn, name, pst) != 0)) return False; /* Pseudo-open the file (note - no fd's created). */ @@ -768,7 +769,8 @@ static BOOL user_can_write_file(connection_struct *conn, char *name, SMB_STRUCT_ return False; /* Get NT ACL -allocated in main loop talloc context. No free needed here. */ - sd_size = conn->vfs_ops.fget_nt_acl(fsp, fsp->fd, &psd); + sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fd, + (OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION), &psd); close_file(fsp, False); /* No access if SD get failed. */ @@ -794,7 +796,7 @@ static BOOL file_is_special(connection_struct *conn, char *name, SMB_STRUCT_STAT return True; /* If we can't stat it does not show it */ - if (!VALID_STAT(*pst) && (vfs_stat(conn, name, pst) != 0)) + if (!VALID_STAT(*pst) && (SMB_VFS_STAT(conn, name, pst) != 0)) return True; if (S_ISREG(pst->st_mode) || S_ISDIR(pst->st_mode) || S_ISLNK(pst->st_mode)) @@ -811,7 +813,7 @@ void *OpenDir(connection_struct *conn, const char *name, BOOL use_veto) { Dir *dirp; const char *n; - DIR *p = conn->vfs_ops.opendir(conn,name); + DIR *p = SMB_VFS_OPENDIR(conn,name); int used=0; if (!p) @@ -819,7 +821,7 @@ void *OpenDir(connection_struct *conn, const char *name, BOOL use_veto) dirp = (Dir *)malloc(sizeof(Dir)); if (!dirp) { DEBUG(0,("Out of memory in OpenDir\n")); - conn->vfs_ops.closedir(conn,p); + SMB_VFS_CLOSEDIR(conn,p); return(NULL); } dirp->pos = dirp->numentries = dirp->mallocsize = 0; @@ -912,7 +914,7 @@ void *OpenDir(connection_struct *conn, const char *name, BOOL use_veto) dirp->numentries++; } - conn->vfs_ops.closedir(conn,p); + SMB_VFS_CLOSEDIR(conn,p); return((void *)dirp); } diff --git a/source3/smbd/dosmode.c b/source3/smbd/dosmode.c index 6c21dc04d0..aaee41b546 100644 --- a/source3/smbd/dosmode.c +++ b/source3/smbd/dosmode.c @@ -56,7 +56,7 @@ mode_t unix_mode(connection_struct *conn,int dosmode,const char *fname) dname = parent_dirname(fname); DEBUG(2,("unix_mode(%s) inheriting from %s\n",fname,dname)); - if (vfs_stat(conn,dname,&sbuf) != 0) { + if (SMB_VFS_STAT(conn,dname,&sbuf) != 0) { DEBUG(4,("unix_mode(%s) failed, [dir %s]: %s\n",fname,dname,strerror(errno))); return(0); /* *** shouldn't happen! *** */ } @@ -191,7 +191,7 @@ int file_chmod(connection_struct *conn,char *fname, uint32 dosmode,SMB_STRUCT_ST if (!st) { st = &st1; - if (vfs_stat(conn,fname,st)) + if (SMB_VFS_STAT(conn,fname,st)) return(-1); } @@ -235,7 +235,7 @@ int file_chmod(connection_struct *conn,char *fname, uint32 dosmode,SMB_STRUCT_ST unixmode |= (st->st_mode & (S_IWUSR|S_IWGRP|S_IWOTH)); } - if ((ret = vfs_chmod(conn,fname,unixmode)) == 0) + if ((ret = SMB_VFS_CHMOD(conn,fname,unixmode)) == 0) return 0; if((errno != EPERM) && (errno != EACCES)) @@ -262,7 +262,7 @@ int file_chmod(connection_struct *conn,char *fname, uint32 dosmode,SMB_STRUCT_ST if (!fsp) return -1; become_root(); - ret = conn->vfs_ops.fchmod(fsp, fsp->fd, unixmode); + ret = SMB_VFS_FCHMOD(fsp, fsp->fd, unixmode); unbecome_root(); close_file_fchmod(fsp); } @@ -283,7 +283,7 @@ int file_utime(connection_struct *conn, char *fname, struct utimbuf *times) errno = 0; - if(conn->vfs_ops.utime(conn,fname, times) == 0) + if(SMB_VFS_UTIME(conn,fname, times) == 0) return 0; if((errno != EPERM) && (errno != EACCES)) @@ -298,7 +298,7 @@ int file_utime(connection_struct *conn, char *fname, struct utimbuf *times) (as DOS does). */ - if(vfs_stat(conn,fname,&sb) != 0) + if(SMB_VFS_STAT(conn,fname,&sb) != 0) return -1; /* Check if we have write access. */ @@ -311,7 +311,7 @@ int file_utime(connection_struct *conn, char *fname, struct utimbuf *times) current_user.ngroups,current_user.groups)))) { /* We are allowed to become root and change the filetime. */ become_root(); - ret = conn->vfs_ops.utime(conn,fname, times); + ret = SMB_VFS_UTIME(conn,fname, times); unbecome_root(); } } diff --git a/source3/smbd/fileio.c b/source3/smbd/fileio.c index b612b1a451..6be5f6af7d 100644 --- a/source3/smbd/fileio.c +++ b/source3/smbd/fileio.c @@ -32,7 +32,7 @@ static SMB_OFF_T seek_file(files_struct *fsp,SMB_OFF_T pos) { SMB_OFF_T seek_ret; - seek_ret = fsp->conn->vfs_ops.lseek(fsp,fsp->fd,pos,SEEK_SET); + seek_ret = SMB_VFS_LSEEK(fsp,fsp->fd,pos,SEEK_SET); if(seek_ret == -1) { DEBUG(0,("seek_file: (%s) sys_lseek failed. Error was %s\n", @@ -101,7 +101,7 @@ ssize_t read_file(files_struct *fsp,char *data,SMB_OFF_T pos,size_t n) #ifdef DMF_FIX int numretries = 3; tryagain: - readret = fsp->conn->vfs_ops.read(fsp,fsp->fd,data,n); + readret = SMB_VFS_READ(fsp,fsp->fd,data,n); if (readret == -1) { if ((errno == EAGAIN) && numretries) { DEBUG(3,("read_file EAGAIN retry in 10 seconds\n")); @@ -112,7 +112,7 @@ tryagain: return -1; } #else /* NO DMF fix. */ - readret = fsp->conn->vfs_ops.read(fsp,fsp->fd,data,n); + readret = SMB_VFS_READ(fsp,fsp->fd,data,n); if (readret == -1) return -1; #endif @@ -181,7 +181,7 @@ ssize_t write_file(files_struct *fsp, char *data, SMB_OFF_T pos, size_t n) SMB_STRUCT_STAT st; fsp->modified = True; - if (fsp->conn->vfs_ops.fstat(fsp,fsp->fd,&st) == 0) { + if (SMB_VFS_FSTAT(fsp,fsp->fd,&st) == 0) { int dosmode = dos_mode(fsp->conn,fsp->fsp_name,&st); fsp->size = (SMB_BIG_UINT)st.st_size; if (MAP_ARCHIVE(fsp->conn) && !IS_DOS_ARCHIVE(dosmode)) @@ -760,7 +760,7 @@ void sync_file(connection_struct *conn, files_struct *fsp) { if(lp_strict_sync(SNUM(conn)) && fsp->fd != -1) { flush_write_cache(fsp, SYNC_FLUSH); - conn->vfs_ops.fsync(fsp,fsp->fd); + SMB_VFS_FSYNC(fsp,fsp->fd); } } @@ -772,7 +772,7 @@ void sync_file(connection_struct *conn, files_struct *fsp) int fsp_stat(files_struct *fsp, SMB_STRUCT_STAT *pst) { if (fsp->fd == -1) - return vfs_stat(fsp->conn, fsp->fsp_name, pst); + return SMB_VFS_STAT(fsp->conn, fsp->fsp_name, pst); else - return vfs_fstat(fsp,fsp->fd, pst); + return SMB_VFS_FSTAT(fsp,fsp->fd, pst); } diff --git a/source3/smbd/filename.c b/source3/smbd/filename.c index b9e33e8f93..ad107f9c3e 100644 --- a/source3/smbd/filename.c +++ b/source3/smbd/filename.c @@ -178,7 +178,7 @@ BOOL unix_convert(pstring name,connection_struct *conn,char *saved_last_componen * stat the name - if it exists then we are all done! */ - if (vfs_stat(conn,name,&st) == 0) { + if (SMB_VFS_STAT(conn,name,&st) == 0) { stat_cache_add(orig_path, name); DEBUG(5,("conversion finished %s -> %s\n",orig_path, name)); *pst = st; @@ -234,7 +234,7 @@ BOOL unix_convert(pstring name,connection_struct *conn,char *saved_last_componen * Check if the name exists up to this point. */ - if (vfs_stat(conn,name, &st) == 0) { + if (SMB_VFS_STAT(conn,name, &st) == 0) { /* * It exists. it must either be a directory or this must be * the last part of the path for it to be OK. @@ -342,7 +342,7 @@ BOOL unix_convert(pstring name,connection_struct *conn,char *saved_last_componen * JRA. */ - if (vfs_stat(conn,name, &st) == 0) { + if (SMB_VFS_STAT(conn,name, &st) == 0) { *pst = st; } else { ZERO_STRUCT(st); @@ -418,7 +418,7 @@ BOOL check_name(pstring name,connection_struct *conn) #ifdef S_ISLNK if (!lp_symlinks(SNUM(conn))) { SMB_STRUCT_STAT statbuf; - if ( (conn->vfs_ops.lstat(conn,name,&statbuf) != -1) && + if ( (SMB_VFS_LSTAT(conn,name,&statbuf) != -1) && (S_ISLNK(statbuf.st_mode)) ) { DEBUG(3,("check_name: denied: file path name %s is a symlink\n",name)); ret=0; diff --git a/source3/smbd/files.c b/source3/smbd/files.c index b9b27ad5ff..f0fd6b7a73 100644 --- a/source3/smbd/files.c +++ b/source3/smbd/files.c @@ -346,6 +346,10 @@ void file_free(files_struct *fsp) string_free(&fsp->fsp_name); + if (fsp->fake_file_handle) { + destroy_fake_file_handle(&fsp->fake_file_handle); + } + bitmap_clear(file_bmap, fsp->fnum - FILE_HANDLE_OFFSET); files_used--; diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c index 98857c6d32..04d6a9a8a8 100644 --- a/source3/smbd/lanman.c +++ b/source3/smbd/lanman.c @@ -1649,7 +1649,7 @@ static BOOL api_RNetGroupEnum(connection_struct *conn,uint16 vuid, char *param,c return False; /* get list of domain groups SID_DOMAIN_GRP=2 */ - if(!pdb_enum_group_mapping(SID_NAME_DOM_GRP , &group_list, &num_entries, False, False)) { + if(!pdb_enum_group_mapping(SID_NAME_DOM_GRP , &group_list, &num_entries, False)) { DEBUG(3,("api_RNetGroupEnum:failed to get group list")); return False; } @@ -2367,7 +2367,7 @@ static BOOL api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid, char *param SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* host name */ pstrcpy(p2,local_machine); - strupper(p2); + strupper_m(p2); p2 = skip_string(p2,1); p += 4; @@ -2378,7 +2378,7 @@ static BOOL api_NetWkstaGetInfo(connection_struct *conn,uint16 vuid, char *param SIVAL(p,0,PTR_DIFF(p2,*rdata)); /* login domain */ pstrcpy(p2,lp_workgroup()); - strupper(p2); + strupper_m(p2); p2 = skip_string(p2,1); p += 4; @@ -2788,7 +2788,7 @@ static BOOL api_WWkstaUserLogon(connection_struct *conn,uint16 vuid, char *param fstring mypath; fstrcpy(mypath,"\\\\"); fstrcat(mypath,local_machine); - strupper(mypath); + strupper_m(mypath); PACKS(&desc,"z",mypath); /* computer */ } PACKS(&desc,"z",lp_workgroup());/* domain */ @@ -3007,7 +3007,7 @@ static void fill_printdest_info(connection_struct *conn, int snum, int uLevel, char buf[100]; strncpy(buf,SERVICE(snum),sizeof(buf)-1); buf[sizeof(buf)-1] = 0; - strupper(buf); + strupper_m(buf); if (uLevel <= 1) { PACKS(desc,"B9",buf); /* szName */ if (uLevel == 1) { diff --git a/source3/smbd/mangle_hash.c b/source3/smbd/mangle_hash.c index e220d2f6d2..ac8e425fd3 100644 --- a/source3/smbd/mangle_hash.c +++ b/source3/smbd/mangle_hash.c @@ -217,7 +217,7 @@ static NTSTATUS is_valid_name(const smb_ucs2_t *fname, BOOL allow_wildcards) return NT_STATUS_UNSUCCESSFUL; ret = has_valid_chars(fname, allow_wildcards); - if (NT_STATUS_IS_ERR(ret)) + if (!NT_STATUS_IS_OK(ret)) return ret; str = strdup_w(fname); @@ -227,7 +227,8 @@ static NTSTATUS is_valid_name(const smb_ucs2_t *fname, BOOL allow_wildcards) SAFE_FREE(str); return NT_STATUS_UNSUCCESSFUL; } - if (p) *p = 0; + if (p) + *p = 0; strupper_w(str); p = &(str[1]); @@ -285,10 +286,10 @@ static NTSTATUS is_8_3_w(const smb_ucs2_t *fname, BOOL allow_wildcards) if (strcmp_wa(fname, ".") == 0 || strcmp_wa(fname, "..") == 0) return NT_STATUS_OK; - if (NT_STATUS_IS_ERR(is_valid_name(fname, allow_wildcards))) + if (!NT_STATUS_IS_OK(is_valid_name(fname, allow_wildcards))) goto done; - if (NT_STATUS_IS_ERR(mangle_get_prefix(fname, &pref, &ext, allow_wildcards))) + if (!NT_STATUS_IS_OK(mangle_get_prefix(fname, &pref, &ext, allow_wildcards))) goto done; plen = strlen_w(pref); @@ -556,8 +557,8 @@ static void cache_mangled_name( char *mangled_name, char *raw_name ) /* Fill the new cache entry, and add it to the cache. */ s1 = (char *)(new_entry + 1); s2 = (char *)&(s1[mangled_len + 1]); - (void)StrnCpy( s1, mangled_name, mangled_len ); - (void)StrnCpy( s2, raw_name, raw_len ); + safe_strcpy( s1, mangled_name, mangled_len ); + safe_strcpy( s2, raw_name, raw_len ); ubi_cachePut( mangled_cache, i, new_entry, s1 ); } @@ -660,7 +661,7 @@ static void to_8_3(char *s) } else csum = str_checksum(s); - strupper( s ); + strupper_m( s ); if( p ) { if( p == s ) @@ -735,7 +736,7 @@ static void name_map(char *OutName, BOOL need83, BOOL cache83) return; } - if( !need83 && NT_STATUS_IS_ERR(is_valid_name(OutName_ucs2, False))) + if( !need83 && !NT_STATUS_IS_OK(is_valid_name(OutName_ucs2, False))) need83 = True; /* check if it's already in 8.3 format */ diff --git a/source3/smbd/negprot.c b/source3/smbd/negprot.c index 66cd835240..f452dd845b 100644 --- a/source3/smbd/negprot.c +++ b/source3/smbd/negprot.c @@ -100,8 +100,8 @@ static int reply_lanman1(char *inbuf, char *outbuf) SSVAL(outbuf,smb_vwv1,secword); /* Create a token value and add it to the outgoing packet. */ if (global_encrypted_passwords_negotiated) { - SSVAL(outbuf,smb_vwv11, 8); get_challenge(smb_buf(outbuf)); + SSVAL(outbuf,smb_vwv11, 8); } Protocol = PROTOCOL_LANMAN1; @@ -144,8 +144,8 @@ static int reply_lanman2(char *inbuf, char *outbuf) /* Create a token value and add it to the outgoing packet. */ if (global_encrypted_passwords_negotiated) { - SSVAL(outbuf,smb_vwv11, 8); get_challenge(smb_buf(outbuf)); + SSVAL(outbuf,smb_vwv11, 8); } Protocol = PROTOCOL_LANMAN2; @@ -182,7 +182,17 @@ static int negprot_spnego(char *p) ZERO_STRUCT(guid); safe_strcpy((char *)guid, global_myname(), sizeof(guid)-1); - strlower((char *)guid); + +#ifdef DEVELOPER + /* valgrind fixer... */ + { + size_t sl = strlen(guid); + if (sizeof(guid)-sl) + memset(&guid[sl], '\0', sizeof(guid)-sl); + } +#endif + + strlower_m((char *)guid); #if 0 /* strangely enough, NT does not sent the single OID NTLMSSP when diff --git a/source3/smbd/notify_hash.c b/source3/smbd/notify_hash.c index d8b35462ac..810e5079ba 100644 --- a/source3/smbd/notify_hash.c +++ b/source3/smbd/notify_hash.c @@ -48,7 +48,7 @@ static BOOL notify_hash(connection_struct *conn, char *path, uint32 flags, ZERO_STRUCTP(data); - if(vfs_stat(conn,path, &st) == -1) + if(SMB_VFS_STAT(conn,path, &st) == -1) return False; data->modify_time = st.st_mtime; @@ -100,7 +100,7 @@ static BOOL notify_hash(connection_struct *conn, char *path, uint32 flags, /* * Do the stat - but ignore errors. */ - vfs_stat(conn,full_name, &st); + SMB_VFS_STAT(conn,full_name, &st); /* * Always sum the times. diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c index 9f7fabb75e..c574d9d563 100644 --- a/source3/smbd/nttrans.c +++ b/source3/smbd/nttrans.c @@ -1,7 +1,8 @@ /* Unix SMB/CIFS implementation. SMB NT transaction handling - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Stefan (metze) Metzmacher 2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -26,6 +27,7 @@ extern int global_oplock_break; extern BOOL case_sensitive; extern BOOL case_preserve; extern BOOL short_case_preserve; +extern struct current_user current_user; static const char *known_nt_pipes[] = { "\\LANMAN", @@ -53,6 +55,24 @@ struct generic_mapping file_generic_mapping = { FILE_GENERIC_ALL }; +char *nttrans_realloc(char **ptr, size_t size) +{ + char *tptr = NULL; + if (ptr==NULL) + smb_panic("nttrans_realloc() called with NULL ptr\n"); + + tptr = Realloc_zero(*ptr, size); + if(tptr == NULL) { + *ptr = NULL; + return NULL; + } + + *ptr = tptr; + + return tptr; +} + + /**************************************************************************** Send the required number of replies back. We assume all fields other than the data fields are @@ -542,6 +562,7 @@ int reply_ntcreate_and_X(connection_struct *conn, { int result; pstring fname; + enum FAKE_FILE_TYPE fake_file_type = FAKE_FILE_TYPE_NONE; uint32 flags = IVAL(inbuf,smb_ntcreate_Flags); uint32 desired_access = IVAL(inbuf,smb_ntcreate_DesiredAccess); uint32 file_attributes = IVAL(inbuf,smb_ntcreate_FileAttributes); @@ -669,8 +690,25 @@ create_options = 0x%x root_dir_fid = 0x%x\n", flags, desired_access, file_attrib */ if( strchr_m(fname, ':')) { - END_PROFILE(SMBntcreateX); - return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND); + +#ifdef HAVE_SYS_QUOTAS + if ((fake_file_type=is_fake_file(fname))!=FAKE_FILE_TYPE_NONE) { + /* + * here we go! support for changing the disk quotas --metze + * + * we need to fake up to open this MAGIC QUOTA file + * and return a valid FID + * + * w2k close this file directly after openening + * xp also tries a QUERY_FILE_INFO on the file and then close it + */ + } else { +#endif + END_PROFILE(SMBntcreateX); + return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND); +#ifdef HAVE_SYS_QUOTAS + } +#endif } } @@ -746,12 +784,21 @@ create_options = 0x%x root_dir_fid = 0x%x\n", flags, desired_access, file_attrib * before issuing an oplock break request to * our client. JRA. */ - fsp = open_file_shared1(conn,fname,&sbuf, + if (fake_file_type==FAKE_FILE_TYPE_NONE) { + fsp = open_file_shared1(conn,fname,&sbuf, desired_access, smb_open_mode, smb_ofun,unixmode, oplock_request, &rmode,&smb_action); - + } else { + /* to open a fake_file --metze */ + fsp = open_fake_file_shared1(fake_file_type,conn,fname,&sbuf, + desired_access, + smb_open_mode, + smb_ofun,unixmode, oplock_request, + &rmode,&smb_action); + } + if (!fsp) { /* We cheat here. There are two cases we * care about. One is a directory rename, @@ -917,13 +964,12 @@ create_options = 0x%x root_dir_fid = 0x%x\n", flags, desired_access, file_attrib Reply to a NT_TRANSACT_CREATE call to open a pipe. ****************************************************************************/ -static int do_nt_transact_create_pipe( connection_struct *conn, - char *inbuf, char *outbuf, int length, - int bufsize, char **ppsetup, char **ppparams, - char **ppdata) +static int do_nt_transact_create_pipe( connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, + char **ppsetup, uint32 setup_count, + char **ppparams, uint32 parameter_count, + char **ppdata, uint32 data_count) { pstring fname; - int total_parameter_count = (int)IVAL(inbuf, smb_nt_TotalParameterCount); char *params = *ppparams; int ret; int pnum = -1; @@ -933,25 +979,21 @@ static int do_nt_transact_create_pipe( connection_struct *conn, * Ensure minimum number of parameters sent. */ - if(total_parameter_count < 54) { - DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)total_parameter_count)); + if(parameter_count < 54) { + DEBUG(0,("do_nt_transact_create_pipe - insufficient parameters (%u)\n", (unsigned int)parameter_count)); return ERROR_DOS(ERRDOS,ERRnoaccess); } - srvstr_pull(inbuf, fname, params+53, sizeof(fname), total_parameter_count-53, STR_TERMINATE); + srvstr_pull(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE); if ((ret = nt_open_pipe(fname, conn, inbuf, outbuf, &pnum)) != 0) return ret; /* Realloc the size of parameters and data we will return */ - params = Realloc(*ppparams, 69); + params = nttrans_realloc(ppparams, 69); if(params == NULL) return ERROR_DOS(ERRDOS,ERRnomem); - *ppparams = params; - - memset((char *)params,'\0',69); - p = params; SCVAL(p,0,NO_OPLOCK_RETURN); @@ -1032,7 +1074,7 @@ static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 secu if (psd->off_dacl==0) security_info_sent &= ~DACL_SECURITY_INFORMATION; - ret = fsp->conn->vfs_ops.fset_nt_acl( fsp, fsp->fd, security_info_sent, psd); + ret = SMB_VFS_FSET_NT_ACL( fsp, fsp->fd, security_info_sent, psd); if (!ret) { talloc_destroy(mem_ctx); @@ -1048,15 +1090,14 @@ static NTSTATUS set_sd(files_struct *fsp, char *data, uint32 sd_len, uint32 secu Reply to a NT_TRANSACT_CREATE call (needs to process SD's). ****************************************************************************/ -static int call_nt_transact_create(connection_struct *conn, - char *inbuf, char *outbuf, int length, - int bufsize, char **ppsetup, char **ppparams, - char **ppdata) +static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, + char **ppsetup, uint32 setup_count, + char **ppparams, uint32 parameter_count, + char **ppdata, uint32 data_count) { pstring fname; char *params = *ppparams; char *data = *ppdata; - int total_parameter_count = (int)IVAL(inbuf, smb_nt_TotalParameterCount); /* Breakout the oplock request bits so we can set the reply bits separately. */ int oplock_request = 0; mode_t unixmode; @@ -1092,7 +1133,10 @@ static int call_nt_transact_create(connection_struct *conn, if (IS_IPC(conn)) { if (lp_nt_pipe_support()) return do_nt_transact_create_pipe(conn, inbuf, outbuf, length, - bufsize, ppsetup, ppparams, ppdata); + bufsize, + ppsetup, setup_count, + ppparams, parameter_count, + ppdata, data_count); else return ERROR_DOS(ERRDOS,ERRnoaccess); } @@ -1101,8 +1145,8 @@ static int call_nt_transact_create(connection_struct *conn, * Ensure minimum number of parameters sent. */ - if(total_parameter_count < 54) { - DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)total_parameter_count)); + if(parameter_count < 54) { + DEBUG(0,("call_nt_transact_create - insufficient parameters (%u)\n", (unsigned int)parameter_count)); return ERROR_DOS(ERRDOS,ERRnoaccess); } @@ -1146,7 +1190,7 @@ static int call_nt_transact_create(connection_struct *conn, if(!dir_fsp->is_directory) { - srvstr_pull(inbuf, fname, params+53, sizeof(fname), total_parameter_count-53, STR_TERMINATE); + srvstr_pull(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE); /* * Check to see if this is a mac fork of some kind. @@ -1175,9 +1219,9 @@ static int call_nt_transact_create(connection_struct *conn, } srvstr_pull(inbuf, &fname[dir_name_len], params+53, sizeof(fname)-dir_name_len, - total_parameter_count-53, STR_TERMINATE); + parameter_count-53, STR_TERMINATE); } else { - srvstr_pull(inbuf, fname, params+53, sizeof(fname), total_parameter_count-53, STR_TERMINATE); + srvstr_pull(inbuf, fname, params+53, sizeof(fname), parameter_count-53, STR_TERMINATE); /* * Check to see if this is a mac fork of some kind. @@ -1331,14 +1375,10 @@ static int call_nt_transact_create(connection_struct *conn, } /* Realloc the size of parameters and data we will return */ - params = Realloc(*ppparams, 69); + params = nttrans_realloc(ppparams, 69); if(params == NULL) return ERROR_DOS(ERRDOS,ERRnomem); - *ppparams = params; - - memset((char *)params,'\0',69); - p = params; if (extended_oplock_granted) SCVAL(p,0, BATCH_OPLOCK_RETURN); @@ -1428,11 +1468,10 @@ int reply_nttranss(connection_struct *conn, don't allow a directory to be opened. ****************************************************************************/ -static int call_nt_transact_notify_change(connection_struct *conn, - char *inbuf, char *outbuf, int length, - int bufsize, - char **ppsetup, - char **ppparams, char **ppdata) +static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, + char **ppsetup, uint32 setup_count, + char **ppparams, uint32 parameter_count, + char **ppdata, uint32 data_count) { char *setup = *ppsetup; files_struct *fsp; @@ -1462,17 +1501,22 @@ name = %s\n", fsp->fsp_name )); Reply to an NT transact rename command. ****************************************************************************/ -static int call_nt_transact_rename(connection_struct *conn, - char *inbuf, char *outbuf, int length, - int bufsize, - char **ppsetup, char **ppparams, char **ppdata) +static int call_nt_transact_rename(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, + char **ppsetup, uint32 setup_count, + char **ppparams, uint32 parameter_count, + char **ppdata, uint32 data_count) { char *params = *ppparams; pstring new_name; - files_struct *fsp = file_fsp(params, 0); - BOOL replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False; + files_struct *fsp = NULL; + BOOL replace_if_exists = False; NTSTATUS status; + if(parameter_count < 4) + return ERROR_DOS(ERRDOS,ERRbadfunc); + + fsp = file_fsp(params, 0); + replace_if_exists = (SVAL(params,2) & RENAME_REPLACE_IF_EXISTS) ? True : False; CHECK_FSP(fsp, conn); srvstr_pull(inbuf, new_name, params+4, sizeof(new_name), -1, STR_TERMINATE); @@ -1518,15 +1562,13 @@ static size_t get_null_nt_acl(TALLOC_CTX *mem_ctx, SEC_DESC **ppsd) } /**************************************************************************** - Reply to query a security descriptor - currently this is not implemented (it - is planned to be though). Right now it just returns the same thing NT would - when queried on a FAT filesystem. JRA. + Reply to query a security descriptor. ****************************************************************************/ -static int call_nt_transact_query_security_desc(connection_struct *conn, - char *inbuf, char *outbuf, - int length, int bufsize, - char **ppsetup, char **ppparams, char **ppdata) +static int call_nt_transact_query_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, + char **ppsetup, uint32 setup_count, + char **ppparams, uint32 parameter_count, + char **ppdata, uint32 data_count) { uint32 max_data_count = IVAL(inbuf,smb_nt_MaxDataCount); char *params = *ppparams; @@ -1534,21 +1576,25 @@ static int call_nt_transact_query_security_desc(connection_struct *conn, prs_struct pd; SEC_DESC *psd = NULL; size_t sd_size; + uint32 security_info_wanted; TALLOC_CTX *mem_ctx; + files_struct *fsp = NULL; - files_struct *fsp = file_fsp(params,0); + if(parameter_count < 8) + return ERROR_DOS(ERRDOS,ERRbadfunc); + fsp = file_fsp(params,0); if(!fsp) return ERROR_DOS(ERRDOS,ERRbadfid); + security_info_wanted = IVAL(params,4); + DEBUG(3,("call_nt_transact_query_security_desc: file = %s\n", fsp->fsp_name )); - params = Realloc(*ppparams, 4); + params = nttrans_realloc(ppparams, 4); if(params == NULL) return ERROR_DOS(ERRDOS,ERRnomem); - *ppparams = params; - if ((mem_ctx = talloc_init("call_nt_transact_query_security_desc")) == NULL) { DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n")); return ERROR_DOS(ERRDOS,ERRnomem); @@ -1561,7 +1607,7 @@ static int call_nt_transact_query_security_desc(connection_struct *conn, if (!lp_nt_acl_support(SNUM(conn))) sd_size = get_null_nt_acl(mem_ctx, &psd); else - sd_size = conn->vfs_ops.fget_nt_acl(fsp, fsp->fd, &psd); + sd_size = SMB_VFS_FGET_NT_ACL(fsp, fsp->fd, security_info_wanted, &psd); if (sd_size == 0) { talloc_destroy(mem_ctx); @@ -1584,16 +1630,12 @@ static int call_nt_transact_query_security_desc(connection_struct *conn, * Allocate the data we will point this at. */ - data = Realloc(*ppdata, sd_size); + data = nttrans_realloc(ppdata, sd_size); if(data == NULL) { talloc_destroy(mem_ctx); return ERROR_DOS(ERRDOS,ERRnomem); } - *ppdata = data; - - memset(data, '\0', sd_size); - /* * Init the parse struct we will marshall into. */ @@ -1632,23 +1674,21 @@ security descriptor.\n")); } /**************************************************************************** - Reply to set a security descriptor. Map to UNIX perms. + Reply to set a security descriptor. Map to UNIX perms or POSIX ACLs. ****************************************************************************/ -static int call_nt_transact_set_security_desc(connection_struct *conn, - char *inbuf, char *outbuf, int length, - int bufsize, char **ppsetup, - char **ppparams, char **ppdata) +static int call_nt_transact_set_security_desc(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, + char **ppsetup, uint32 setup_count, + char **ppparams, uint32 parameter_count, + char **ppdata, uint32 data_count) { - uint32 total_parameter_count = IVAL(inbuf, smb_nts_TotalParameterCount); char *params= *ppparams; char *data = *ppdata; - uint32 total_data_count = (uint32)IVAL(inbuf, smb_nts_TotalDataCount); files_struct *fsp = NULL; uint32 security_info_sent = 0; NTSTATUS nt_status; - if(total_parameter_count < 8) + if(parameter_count < 8) return ERROR_DOS(ERRDOS,ERRbadfunc); if((fsp = file_fsp(params,0)) == NULL) @@ -1662,10 +1702,10 @@ static int call_nt_transact_set_security_desc(connection_struct *conn, DEBUG(3,("call_nt_transact_set_security_desc: file = %s, sent 0x%x\n", fsp->fsp_name, (unsigned int)security_info_sent )); - if (total_data_count == 0) + if (data_count == 0) return ERROR_DOS(ERRDOS, ERRnoaccess); - if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, total_data_count, security_info_sent))) + if (!NT_STATUS_IS_OK(nt_status = set_sd( fsp, data, data_count, security_info_sent))) return ERROR_NT(nt_status); done: @@ -1677,15 +1717,15 @@ static int call_nt_transact_set_security_desc(connection_struct *conn, /**************************************************************************** Reply to NT IOCTL ****************************************************************************/ -static int call_nt_transact_ioctl(connection_struct *conn, - char *inbuf, char *outbuf, int length, - int bufsize, - char **ppsetup, int setup_count, - char **ppparams, int parameter_count, - char **ppdata, int data_count) + +static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, + char **ppsetup, uint32 setup_count, + char **ppparams, uint32 parameter_count, + char **ppdata, uint32 data_count) { unsigned fnum, control; static BOOL logged_message; + char *pdata = *ppdata; if (setup_count != 8) { DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count)); @@ -1695,28 +1735,475 @@ static int call_nt_transact_ioctl(connection_struct *conn, fnum = SVAL(*ppsetup, 4); control = IVAL(*ppsetup, 0); - DEBUG(6,("call_nt_transact_ioctl: fnum=%d control=0x%x\n", + DEBUG(10,("call_nt_transact_ioctl: fnum=%d control=0x%08x\n", fnum, control)); switch (control) { - case NTIOCTL_SET_SPARSE: + case FSCTL_SET_SPARSE: /* pretend this succeeded - tho strictly we should mark the file sparse (if the local fs supports it) so we can know if we need to pre-allocate or not */ + + DEBUG(10,("FSCTL_SET_SPARSE: fnum=%d control=0x%08x\n",fnum,control)); send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0); return -1; + + case FSCTL_0x000900C0: + /* pretend this succeeded - don't know what this really is + but works ok like this --metze + */ + + DEBUG(10,("FSCTL_GET_REPARSE_POINT: fnum=%d control=0x%08x\n",fnum,control)); + send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0); + return -1; + + case FSCTL_GET_REPARSE_POINT: + /* pretend this fail - my winXP does it like this + * --metze + */ + DEBUG(10,("FSCTL_GET_REPARSE_POINT: fnum=%d control=0x%08x\n",fnum,control)); + send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0); + return -1; + + case FSCTL_SET_REPARSE_POINT: + /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case. + * --metze + */ + + DEBUG(10,("FSCTL_SET_REPARSE_POINT: fnum=%d control=0x%08x\n",fnum,control)); + send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0); + return -1; + + case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */ + { + /* pretend this succeeded - + * + * we have to send back a list with all files owned by this SID + * + * but I have to check that --metze + */ + + DOM_SID sid; + uid_t uid; + size_t sid_len=SID_MAX_SIZE; + + DEBUG(10,("FSCTL_FIND_FILES_BY_SID: fnum=%d control=0x%08x\n",fnum,control)); + + /* this is not the length of the sid :-( so unknown 4 bytes */ + /*sid_len = IVAL(pdata,0); + DEBUGADD(0,("sid_len: (%u)\n",sid_len));*/ + + sid_parse(pdata+4,sid_len,&sid); + DEBUGADD(10,("SID: %s\n",sid_string_static(&sid))); + + if (!NT_STATUS_IS_OK(sid_to_uid(&sid, &uid))) { + DEBUG(0,("sid_to_uid: failed, sid[%s]\n", + sid_string_static(&sid))); + uid = (-1); + } + + /* we can take a look at the find source :-) + * + * find ./ -uid $uid -name '*' is what we need here + * + * + * and send 4bytes len and then NULL terminated unicode strings + * for each file + * + * but I don't know how to deal with the paged results + * + * we don't send all files at once + * and at the next we should *not* start from the beginning, + * so we have to cache the result + * + * --metze + */ + + /* this works for now... */ + send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0); + return -1; + } default: if (!logged_message) { logged_message = True; /* Only print this once... */ - DEBUG(3,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n", + DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n", control)); } } return ERROR_NT(NT_STATUS_NOT_SUPPORTED); } - + + +#ifdef HAVE_SYS_QUOTAS +/**************************************************************************** + Reply to get user quota +****************************************************************************/ + +static int call_nt_transact_get_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, + char **ppsetup, uint32 setup_count, + char **ppparams, uint32 parameter_count, + char **ppdata, uint32 data_count) +{ + NTSTATUS nt_status = NT_STATUS_OK; + uint32 max_data_count = IVAL(inbuf,smb_nt_MaxDataCount); + char *params = *ppparams; + char *pdata = *ppdata; + char *entry; + int data_len=0,param_len=0; + int qt_len=0; + int entry_len = 0; + files_struct *fsp = NULL; + uint16 level = 0; + size_t sid_len; + DOM_SID sid; + BOOL start_enum = True; + SMB_NTQUOTA_STRUCT qt; + SMB_NTQUOTA_LIST *tmp_list; + SMB_NTQUOTA_HANDLE *qt_handle = NULL; + + ZERO_STRUCT(qt); + + /* access check */ + if (conn->admin_user != True) { + DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n", + lp_servicename(SNUM(conn)),conn->user)); + return ERROR_DOS(ERRDOS,ERRnoaccess); + } + + /* + * Ensure minimum number of parameters sent. + */ + + if (parameter_count < 4) { + DEBUG(0,("TRANSACT_GET_USER_QUOTA: requires %d >= 4 bytes parameters\n",parameter_count)); + return ERROR_DOS(ERRDOS,ERRinvalidparam); + } + + /* maybe we can check the quota_fnum */ + fsp = file_fsp(params,0); + if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) { + DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n")); + return ERROR_NT(NT_STATUS_INVALID_HANDLE); + } + + /* the NULL pointer cheking for fsp->fake_file_handle->pd + * is done by CHECK_NTQUOTA_HANDLE_OK() + */ + qt_handle = (SMB_NTQUOTA_HANDLE *)fsp->fake_file_handle->pd; + + level = SVAL(params,2); + + /* unknown 12 bytes leading in params */ + + switch (level) { + case TRANSACT_GET_USER_QUOTA_LIST_CONTINUE: + /* seems that we should continue with the enum here --metze */ + + if (qt_handle->quota_list!=NULL && + qt_handle->tmp_list==NULL) { + + /* free the list */ + free_ntquota_list(&(qt_handle->quota_list)); + + /* Realloc the size of parameters and data we will return */ + param_len = 4; + params = nttrans_realloc(ppparams, param_len); + if(params == NULL) + return ERROR_DOS(ERRDOS,ERRnomem); + + data_len = 0; + SIVAL(params,0,data_len); + + break; + } + + start_enum = False; + + case TRANSACT_GET_USER_QUOTA_LIST_START: + + if (qt_handle->quota_list==NULL && + qt_handle->tmp_list==NULL) { + start_enum = True; + } + + if (start_enum && vfs_get_user_ntquota_list(fsp,&(qt_handle->quota_list))!=0) + return ERROR_DOS(ERRSRV,ERRerror); + + /* Realloc the size of parameters and data we will return */ + param_len = 4; + params = nttrans_realloc(ppparams, param_len); + if(params == NULL) + return ERROR_DOS(ERRDOS,ERRnomem); + + /* we should not trust the value in max_data_count*/ + max_data_count = MIN(max_data_count,2048); + + pdata = nttrans_realloc(ppdata, max_data_count);/* should be max data count from client*/ + if(pdata == NULL) + return ERROR_DOS(ERRDOS,ERRnomem); + + entry = pdata; + + + /* set params Size of returned Quota Data 4 bytes*/ + /* but set it later when we know it */ + + /* for each entry push the data */ + + if (start_enum) { + qt_handle->tmp_list = qt_handle->quota_list; + } + + tmp_list = qt_handle->tmp_list; + + for (;((tmp_list!=NULL)&&((qt_len +40+SID_MAX_SIZE)next,entry+=entry_len,qt_len+=entry_len) { + + sid_len = sid_size(&tmp_list->quotas->sid); + entry_len = 40 + sid_len; + + /* nextoffset entry 4 bytes */ + SIVAL(entry,0,entry_len); + + /* then the len of the SID 4 bytes */ + SIVAL(entry,4,sid_len); + + /* unknown data 8 bytes SMB_BIG_UINT */ + SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-metze*/ + + /* the used disk space 8 bytes SMB_BIG_UINT */ + SBIG_UINT(entry,16,tmp_list->quotas->usedspace); + + /* the soft quotas 8 bytes SMB_BIG_UINT */ + SBIG_UINT(entry,24,tmp_list->quotas->softlim); + + /* the hard quotas 8 bytes SMB_BIG_UINT */ + SBIG_UINT(entry,32,tmp_list->quotas->hardlim); + + /* and now the SID */ + sid_linearize(entry+40, sid_len, &tmp_list->quotas->sid); + } + + qt_handle->tmp_list = tmp_list; + + /* overwrite the offset of the last entry */ + SIVAL(entry-entry_len,0,0); + + data_len = 4+qt_len; + /* overwrite the params quota_data_len */ + SIVAL(params,0,data_len); + + break; + + case TRANSACT_GET_USER_QUOTA_FOR_SID: + + /* unknown 4 bytes IVAL(pdata,0) */ + + if (data_count < 8) { + DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8)); + return ERROR_DOS(ERRDOS,ERRunknownlevel); + } + + sid_len = IVAL(pdata,4); + + if (data_count < 8+sid_len) { + DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: requires %d >= %d bytes data\n",data_count,8+sid_len)); + return ERROR_DOS(ERRDOS,ERRunknownlevel); + } + + data_len = 4+40+sid_len; + + if (max_data_count < data_len) { + DEBUG(0,("TRANSACT_GET_USER_QUOTA_FOR_SID: max_data_count(%d) < data_len(%d)\n", + max_data_count, data_len)); + param_len = 4; + SIVAL(params,0,data_len); + data_len = 0; + nt_status = NT_STATUS_BUFFER_TOO_SMALL; + break; + } + + sid_parse(pdata+8,sid_len,&sid); + + + if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) { + ZERO_STRUCT(qt); + /* + * we have to return zero's in all fields + * instead of returning an error here + * --metze + */ + } + + /* Realloc the size of parameters and data we will return */ + param_len = 4; + params = nttrans_realloc(ppparams, param_len); + if(params == NULL) + return ERROR_DOS(ERRDOS,ERRnomem); + + pdata = nttrans_realloc(ppdata, data_len); + if(pdata == NULL) + return ERROR_DOS(ERRDOS,ERRnomem); + + entry = pdata; + + /* set params Size of returned Quota Data 4 bytes*/ + SIVAL(params,0,data_len); + + /* nextoffset entry 4 bytes */ + SIVAL(entry,0,0); + + /* then the len of the SID 4 bytes */ + SIVAL(entry,4,sid_len); + + /* unknown data 8 bytes SMB_BIG_UINT */ + SBIG_UINT(entry,8,(SMB_BIG_UINT)0); /* this is not 0 in windows...-mezte*/ + + /* the used disk space 8 bytes SMB_BIG_UINT */ + SBIG_UINT(entry,16,qt.usedspace); + + /* the soft quotas 8 bytes SMB_BIG_UINT */ + SBIG_UINT(entry,24,qt.softlim); + + /* the hard quotas 8 bytes SMB_BIG_UINT */ + SBIG_UINT(entry,32,qt.hardlim); + + /* and now the SID */ + sid_linearize(entry+40, sid_len, &sid); + + break; + + default: + DEBUG(0,("do_nt_transact_get_user_quota: fnum %d unknown level 0x%04hX\n",fsp->fnum,level)); + return ERROR_DOS(ERRSRV,ERRerror); + break; + } + + send_nt_replies(inbuf, outbuf, bufsize, nt_status, params, param_len, pdata, data_len); + + return -1; +} + +/**************************************************************************** + Reply to set user quota +****************************************************************************/ + +static int call_nt_transact_set_user_quota(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, + char **ppsetup, uint32 setup_count, + char **ppparams, uint32 parameter_count, + char **ppdata, uint32 data_count) +{ + char *params = *ppparams; + char *pdata = *ppdata; + int data_len=0,param_len=0; + SMB_NTQUOTA_STRUCT qt; + size_t sid_len; + DOM_SID sid; + files_struct *fsp = NULL; + + ZERO_STRUCT(qt); + + /* access check */ + if (conn->admin_user != True) { + DEBUG(1,("set_user_quota: access_denied service [%s] user [%s]\n", + lp_servicename(SNUM(conn)),conn->user)); + return ERROR_DOS(ERRDOS,ERRnoaccess); + } + + /* + * Ensure minimum number of parameters sent. + */ + + if (parameter_count < 2) { + DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= 2 bytes parameters\n",parameter_count)); + return ERROR_DOS(ERRDOS,ERRinvalidparam); + } + + /* maybe we can check the quota_fnum */ + fsp = file_fsp(params,0); + if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) { + DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n")); + return ERROR_NT(NT_STATUS_INVALID_HANDLE); + } + + if (data_count < 40) { + DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40)); + return ERROR_DOS(ERRDOS,ERRunknownlevel); + } + + /* offset to next quota record. + * 4 bytes IVAL(pdata,0) + * unused here... + */ + + /* sid len */ + sid_len = IVAL(pdata,4); + + if (data_count < 40+sid_len) { + DEBUG(0,("TRANSACT_SET_USER_QUOTA: requires %d >= %d bytes data\n",data_count,40+sid_len)); + return ERROR_DOS(ERRDOS,ERRunknownlevel); + } + + /* unknown 8 bytes in pdata + * maybe its the change time in NTTIME + */ + + /* the used space 8 bytes (SMB_BIG_UINT)*/ + qt.usedspace = (SMB_BIG_UINT)IVAL(pdata,16); +#ifdef LARGE_SMB_OFF_T + qt.usedspace |= (((SMB_BIG_UINT)IVAL(pdata,20)) << 32); +#else /* LARGE_SMB_OFF_T */ + if ((IVAL(pdata,20) != 0)&& + ((qt.usedspace != 0xFFFFFFFF)|| + (IVAL(pdata,20)!=0xFFFFFFFF))) { + /* more than 32 bits? */ + return ERROR_DOS(ERRDOS,ERRunknownlevel); + } +#endif /* LARGE_SMB_OFF_T */ + + /* the soft quotas 8 bytes (SMB_BIG_UINT)*/ + qt.softlim = (SMB_BIG_UINT)IVAL(pdata,24); +#ifdef LARGE_SMB_OFF_T + qt.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32); +#else /* LARGE_SMB_OFF_T */ + if ((IVAL(pdata,28) != 0)&& + ((qt.softlim != 0xFFFFFFFF)|| + (IVAL(pdata,28)!=0xFFFFFFFF))) { + /* more than 32 bits? */ + return ERROR_DOS(ERRDOS,ERRunknownlevel); + } +#endif /* LARGE_SMB_OFF_T */ + + /* the hard quotas 8 bytes (SMB_BIG_UINT)*/ + qt.hardlim = (SMB_BIG_UINT)IVAL(pdata,32); +#ifdef LARGE_SMB_OFF_T + qt.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32); +#else /* LARGE_SMB_OFF_T */ + if ((IVAL(pdata,36) != 0)&& + ((qt.hardlim != 0xFFFFFFFF)|| + (IVAL(pdata,36)!=0xFFFFFFFF))) { + /* more than 32 bits? */ + return ERROR_DOS(ERRDOS,ERRunknownlevel); + } +#endif /* LARGE_SMB_OFF_T */ + + sid_parse(pdata+40,sid_len,&sid); + DEBUGADD(8,("SID: %s\n",sid_string_static(&sid))); + + /* 44 unknown bytes left... */ + + if (vfs_set_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) { + return ERROR_DOS(ERRSRV,ERRerror); + } + + send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, params, param_len, pdata, data_len); + + return -1; +} +#endif /* HAVE_SYS_QUOTAS */ + /**************************************************************************** Reply to a SMBNTtrans. ****************************************************************************/ @@ -1918,8 +2405,10 @@ due to being in oplock break state.\n", (unsigned int)function_code )); case NT_TRANSACT_CREATE: START_PROFILE_NESTED(NT_transact_create); outsize = call_nt_transact_create(conn, inbuf, outbuf, - length, bufsize, - &setup, ¶ms, &data); + length, bufsize, + &setup, setup_count, + ¶ms, total_parameter_count, + &data, total_data_count); END_PROFILE_NESTED(NT_transact_create); break; case NT_TRANSACT_IOCTL: @@ -1927,39 +2416,67 @@ due to being in oplock break state.\n", (unsigned int)function_code )); outsize = call_nt_transact_ioctl(conn, inbuf, outbuf, length, bufsize, &setup, setup_count, - ¶ms, parameter_count, - &data, data_count); + ¶ms, total_parameter_count, + &data, total_data_count); END_PROFILE_NESTED(NT_transact_ioctl); break; case NT_TRANSACT_SET_SECURITY_DESC: START_PROFILE_NESTED(NT_transact_set_security_desc); outsize = call_nt_transact_set_security_desc(conn, inbuf, outbuf, - length, bufsize, - &setup, ¶ms, &data); + length, bufsize, + &setup, setup_count, + ¶ms, total_parameter_count, + &data, total_data_count); END_PROFILE_NESTED(NT_transact_set_security_desc); break; case NT_TRANSACT_NOTIFY_CHANGE: START_PROFILE_NESTED(NT_transact_notify_change); outsize = call_nt_transact_notify_change(conn, inbuf, outbuf, - length, bufsize, - &setup, ¶ms, &data); + length, bufsize, + &setup, setup_count, + ¶ms, total_parameter_count, + &data, total_data_count); END_PROFILE_NESTED(NT_transact_notify_change); break; case NT_TRANSACT_RENAME: START_PROFILE_NESTED(NT_transact_rename); outsize = call_nt_transact_rename(conn, inbuf, outbuf, - length, bufsize, - &setup, ¶ms, &data); + length, bufsize, + &setup, setup_count, + ¶ms, total_parameter_count, + &data, total_data_count); END_PROFILE_NESTED(NT_transact_rename); break; case NT_TRANSACT_QUERY_SECURITY_DESC: START_PROFILE_NESTED(NT_transact_query_security_desc); outsize = call_nt_transact_query_security_desc(conn, inbuf, outbuf, - length, bufsize, - &setup, ¶ms, &data); + length, bufsize, + &setup, setup_count, + ¶ms, total_parameter_count, + &data, total_data_count); END_PROFILE_NESTED(NT_transact_query_security_desc); break; +#ifdef HAVE_SYS_QUOTAS + case NT_TRANSACT_GET_USER_QUOTA: + START_PROFILE_NESTED(NT_transact_get_user_quota); + outsize = call_nt_transact_get_user_quota(conn, inbuf, outbuf, + length, bufsize, + &setup, setup_count, + ¶ms, total_parameter_count, + &data, total_data_count); + END_PROFILE_NESTED(NT_transact_get_user_quota); + break; + case NT_TRANSACT_SET_USER_QUOTA: + START_PROFILE_NESTED(NT_transact_set_user_quota); + outsize = call_nt_transact_set_user_quota(conn, inbuf, outbuf, + length, bufsize, + &setup, setup_count, + ¶ms, total_parameter_count, + &data, total_data_count); + END_PROFILE_NESTED(NT_transact_set_user_quota); + break; +#endif /* HAVE_SYS_QUOTAS */ default: /* Error in request */ DEBUG(0,("reply_nttrans: Unknown request %d in nttrans call\n", function_code)); diff --git a/source3/smbd/open.c b/source3/smbd/open.c index 510b28172d..6d03eaa29a 100644 --- a/source3/smbd/open.c +++ b/source3/smbd/open.c @@ -38,13 +38,13 @@ static int fd_open(struct connection_struct *conn, char *fname, flags |= O_NOFOLLOW; #endif - fd = conn->vfs_ops.open(conn,fname,flags,mode); + fd = SMB_VFS_OPEN(conn,fname,flags,mode); /* Fix for files ending in '.' */ if((fd == -1) && (errno == ENOENT) && (strchr_m(fname,'.')==NULL)) { pstrcat(fname,"."); - fd = conn->vfs_ops.open(conn,fname,flags,mode); + fd = SMB_VFS_OPEN(conn,fname,flags,mode); } DEBUG(10,("fd_open: name %s, flags = 0%o mode = 0%o, fd = %d. %s\n", fname, @@ -74,7 +74,7 @@ static void check_for_pipe(char *fname) /* special case of pipe opens */ char s[10]; StrnCpy(s,fname,sizeof(s)-1); - strlower(s); + strlower_m(s); if (strstr(s,"pipe/")) { DEBUG(3,("Rejecting named pipe open for %s\n",fname)); unix_ERR_class = ERRSRV; @@ -186,9 +186,9 @@ static BOOL open_file(files_struct *fsp,connection_struct *conn, int ret; if (fsp->fd == -1) - ret = vfs_stat(conn, fname, psbuf); + ret = SMB_VFS_STAT(conn, fname, psbuf); else { - ret = vfs_fstat(fsp,fsp->fd,psbuf); + ret = SMB_VFS_FSTAT(fsp,fsp->fd,psbuf); /* If we have an fd, this stat should succeed. */ if (ret == -1) DEBUG(0,("Error doing fstat on open file %s (%s)\n", fname,strerror(errno) )); @@ -259,7 +259,7 @@ static int truncate_unless_locked(struct connection_struct *conn, files_struct * unix_ERR_ntstatus = dos_to_ntstatus(ERRDOS, ERRlock); return -1; } else { - return conn->vfs_ops.ftruncate(fsp,fsp->fd,0); + return SMB_VFS_FTRUNCATE(fsp,fsp->fd,0); } } @@ -1024,6 +1024,16 @@ flags=0x%X flags2=0x%X mode=0%o returned %d\n", if (!file_existed) { + /* + * Now the file exists and fsp is successfully opened, + * fsp->dev and fsp->inode are valid and should replace the + * dev=0,inode=0 from a non existent file. Spotted by + * Nadav Danieli . JRA. + */ + + dev = fsp->dev; + inode = fsp->inode; + lock_share_entry_fsp(fsp); num_share_modes = open_mode_check(conn, fname, dev, inode, @@ -1073,7 +1083,7 @@ flags=0x%X flags2=0x%X mode=0%o returned %d\n", /* * We are modifing the file after open - update the stat struct.. */ - if ((truncate_unless_locked(conn,fsp) == -1) || (vfs_fstat(fsp,fsp->fd,psbuf)==-1)) { + if ((truncate_unless_locked(conn,fsp) == -1) || (SMB_VFS_FSTAT(fsp,fsp->fd,psbuf)==-1)) { unlock_share_entry_fsp(fsp); fd_close(conn,fsp); file_free(fsp); @@ -1148,11 +1158,11 @@ flags=0x%X flags2=0x%X mode=0%o returned %d\n", * selected. */ - if (!file_existed && !def_acl && (conn->vfs_ops.fchmod_acl != NULL)) { + if (!file_existed && !def_acl) { int saved_errno = errno; /* We might get ENOSYS in the next call.. */ - if (conn->vfs_ops.fchmod_acl(fsp, fsp->fd, mode) == -1 && errno == ENOSYS) + if (SMB_VFS_FCHMOD_ACL(fsp, fsp->fd, mode) == -1 && errno == ENOSYS) errno = saved_errno; /* Ignore ENOSYS */ } else if (new_mode) { @@ -1161,9 +1171,9 @@ flags=0x%X flags2=0x%X mode=0%o returned %d\n", /* Attributes need changing. File already existed. */ - if (conn->vfs_ops.fchmod_acl != NULL) { + { int saved_errno = errno; /* We might get ENOSYS in the next call.. */ - ret = conn->vfs_ops.fchmod_acl(fsp, fsp->fd, new_mode); + ret = SMB_VFS_FCHMOD_ACL(fsp, fsp->fd, new_mode); if (ret == -1 && errno == ENOSYS) { errno = saved_errno; /* Ignore ENOSYS */ @@ -1174,7 +1184,7 @@ flags=0x%X flags2=0x%X mode=0%o returned %d\n", } } - if ((ret == -1) && (conn->vfs_ops.fchmod(fsp, fsp->fd, new_mode) == -1)) + if ((ret == -1) && (SMB_VFS_FCHMOD(fsp, fsp->fd, new_mode) == -1)) DEBUG(5, ("open_file_shared: failed to reset attributes of file %s to 0%o\n", fname, (int)new_mode)); } @@ -1280,14 +1290,14 @@ files_struct *open_directory(connection_struct *conn, char *fname, SMB_STRUCT_ST return NULL; } - if(vfs_mkdir(conn,fname, unix_mode(conn,aDIR, fname)) < 0) { + if(vfs_MkDir(conn,fname, unix_mode(conn,aDIR, fname)) < 0) { DEBUG(2,("open_directory: unable to create %s. Error was %s\n", fname, strerror(errno) )); file_free(fsp); return NULL; } - if(vfs_stat(conn,fname, psbuf) != 0) { + if(SMB_VFS_STAT(conn,fname, psbuf) != 0) { file_free(fsp); return NULL; } diff --git a/source3/smbd/oplock.c b/source3/smbd/oplock.c index 632dfe9e29..8525687793 100644 --- a/source3/smbd/oplock.c +++ b/source3/smbd/oplock.c @@ -391,7 +391,7 @@ pid %d, port %d, dev = %x, inode = %.0f, file_id = %lu\n", /* * Keep this as a debug case - eventually we can remove it. */ - case (CMD_REPLY | KERNEL_OPLOCK_BREAK_CMD): + case 0x8001: DEBUG(0,("process_local_message: Received unsolicited break \ reply - dumping info.\n")); diff --git a/source3/smbd/password.c b/source3/smbd/password.c index 283eed73ef..e2c143f1e2 100644 --- a/source3/smbd/password.c +++ b/source3/smbd/password.c @@ -157,7 +157,7 @@ int register_vuid(auth_serversupplied_info *server_info, const char *smb_name) } vuser->guest = server_info->guest; - fstrcpy(vuser->user.unix_name, pdb_get_username(server_info->sam_account)); + fstrcpy(vuser->user.unix_name, server_info->unix_name); /* This is a potentially untrusted username */ alpha_strcpy(vuser->user.smb_name, smb_name, ". _-$", sizeof(vuser->user.smb_name)); @@ -168,16 +168,24 @@ int register_vuid(auth_serversupplied_info *server_info, const char *smb_name) { /* Keep the homedir handy */ const char *homedir = pdb_get_homedir(server_info->sam_account); - const char *unix_homedir = pdb_get_unix_homedir(server_info->sam_account); const char *logon_script = pdb_get_logon_script(server_info->sam_account); + + if (!IS_SAM_DEFAULT(server_info->sam_account, PDB_UNIXHOMEDIR)) { + const char *unix_homedir = pdb_get_unix_homedir(server_info->sam_account); + if (unix_homedir) { + vuser->unix_homedir = smb_xstrdup(unix_homedir); + } + } else { + struct passwd *passwd = getpwnam_alloc(vuser->user.unix_name); + if (passwd) { + vuser->unix_homedir = smb_xstrdup(passwd->pw_dir); + passwd_free(&passwd); + } + } + if (homedir) { vuser->homedir = smb_xstrdup(homedir); } - - if (unix_homedir) { - vuser->unix_homedir = smb_xstrdup(unix_homedir); - } - if (logon_script) { vuser->logon_script = smb_xstrdup(logon_script); } diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c index a362db7d56..95b45fcc99 100644 --- a/source3/smbd/posix_acls.c +++ b/source3/smbd/posix_acls.c @@ -42,10 +42,448 @@ typedef struct canon_ace { enum ace_owner owner_type; enum ace_attribute attr; posix_id unix_ug; + BOOL inherited; } canon_ace; #define ALL_ACE_PERMS (S_IRUSR|S_IWUSR|S_IXUSR) +/* + * EA format of user.SAMBA_PAI (Samba_Posix_Acl_Interitance) + * attribute on disk. + * + * | 1 | 1 | 2 | 2 | .... + * +------+------+-------------+---------------------+-------------+--------------------+ + * | vers | flag | num_entries | num_default_entries | ..entries.. | default_entries... | + * +------+------+-------------+---------------------+-------------+--------------------+ + */ + +#define SAMBA_POSIX_INHERITANCE_EA_NAME "user.SAMBA_PAI" + +#define PAI_VERSION_OFFSET 0 +#define PAI_FLAG_OFFSET 1 +#define PAI_NUM_ENTRIES_OFFSET 2 +#define PAI_NUM_DEFAULT_ENTRIES_OFFSET 4 +#define PAI_ENTRIES_BASE 6 + +#define PAI_VERSION 1 +#define PAI_ACL_FLAG_PROTECTED 0x1 +#define PAI_ENTRY_LENGTH 5 + +/* + * In memory format of user.SAMBA_PAI attribute. + */ + +struct pai_entry { + struct pai_entry *next, *prev; + enum ace_owner owner_type; + posix_id unix_ug; +}; + +struct pai_val { + BOOL protected; + unsigned int num_entries; + struct pai_entry *entry_list; + unsigned int num_def_entries; + struct pai_entry *def_entry_list; +}; + +/************************************************************************ + Return a uint32 of the pai_entry principal. +************************************************************************/ + +static uint32 get_pai_entry_val(struct pai_entry *paie) +{ + switch (paie->owner_type) { + case UID_ACE: + DEBUG(10,("get_pai_entry_val: uid = %u\n", (unsigned int)paie->unix_ug.uid )); + return (uint32)paie->unix_ug.uid; + case GID_ACE: + DEBUG(10,("get_pai_entry_val: gid = %u\n", (unsigned int)paie->unix_ug.gid )); + return (uint32)paie->unix_ug.gid; + case WORLD_ACE: + default: + DEBUG(10,("get_pai_entry_val: world ace\n")); + return (uint32)-1; + } +} + +/************************************************************************ + Return a uint32 of the entry principal. +************************************************************************/ + +static uint32 get_entry_val(canon_ace *ace_entry) +{ + switch (ace_entry->owner_type) { + case UID_ACE: + DEBUG(10,("get_entry_val: uid = %u\n", (unsigned int)ace_entry->unix_ug.uid )); + return (uint32)ace_entry->unix_ug.uid; + case GID_ACE: + DEBUG(10,("get_entry_val: gid = %u\n", (unsigned int)ace_entry->unix_ug.gid )); + return (uint32)ace_entry->unix_ug.gid; + case WORLD_ACE: + default: + DEBUG(10,("get_entry_val: world ace\n")); + return (uint32)-1; + } +} + +/************************************************************************ + Count the inherited entries. +************************************************************************/ + +static unsigned int num_inherited_entries(canon_ace *ace_list) +{ + unsigned int num_entries = 0; + + for (; ace_list; ace_list = ace_list->next) + if (ace_list->inherited) + num_entries++; + return num_entries; +} + +/************************************************************************ + Create the on-disk format. Caller must free. +************************************************************************/ + +static char *create_pai_buf(canon_ace *file_ace_list, canon_ace *dir_ace_list, BOOL protected, size_t *store_size) +{ + char *pai_buf = NULL; + canon_ace *ace_list = NULL; + char *entry_offset = NULL; + unsigned int num_entries = 0; + unsigned int num_def_entries = 0; + + for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) + if (ace_list->inherited) + num_entries++; + + for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) + if (ace_list->inherited) + num_def_entries++; + + DEBUG(10,("create_pai_buf: num_entries = %u, num_def_entries = %u\n", num_entries, num_def_entries )); + + *store_size = PAI_ENTRIES_BASE + ((num_entries + num_def_entries)*PAI_ENTRY_LENGTH); + + pai_buf = malloc(*store_size); + if (!pai_buf) { + return NULL; + } + + /* Set up the header. */ + memset(pai_buf, '\0', PAI_ENTRIES_BASE); + SCVAL(pai_buf,PAI_VERSION_OFFSET,PAI_VERSION); + SCVAL(pai_buf,PAI_FLAG_OFFSET,(protected ? PAI_ACL_FLAG_PROTECTED : 0)); + SSVAL(pai_buf,PAI_NUM_ENTRIES_OFFSET,num_entries); + SSVAL(pai_buf,PAI_NUM_DEFAULT_ENTRIES_OFFSET,num_def_entries); + + entry_offset = pai_buf + PAI_ENTRIES_BASE; + + for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) { + if (ace_list->inherited) { + uint8 type_val = (unsigned char)ace_list->owner_type; + uint32 entry_val = get_entry_val(ace_list); + + SCVAL(entry_offset,0,type_val); + SIVAL(entry_offset,1,entry_val); + entry_offset += PAI_ENTRY_LENGTH; + } + } + + for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) { + if (ace_list->inherited) { + uint8 type_val = (unsigned char)ace_list->owner_type; + uint32 entry_val = get_entry_val(ace_list); + + SCVAL(entry_offset,0,type_val); + SIVAL(entry_offset,1,entry_val); + entry_offset += PAI_ENTRY_LENGTH; + } + } + + return pai_buf; +} + +/************************************************************************ + Store the user.SAMBA_PAI attribute on disk. +************************************************************************/ + +static void store_inheritance_attributes(files_struct *fsp, canon_ace *file_ace_list, + canon_ace *dir_ace_list, BOOL protected) +{ + int ret; + size_t store_size; + char *pai_buf; + + if (!lp_map_acl_inherit(SNUM(fsp->conn))) + return; + + /* + * Don't store if this ACL isn't protected and + * none of the entries in it are marked as inherited. + */ + + if (!protected && num_inherited_entries(file_ace_list) == 0 && num_inherited_entries(dir_ace_list) == 0) { + /* Instead just remove the attribute if it exists. */ + if (fsp->fd != -1) + SMB_VFS_FREMOVEXATTR(fsp, fsp->fd, SAMBA_POSIX_INHERITANCE_EA_NAME); + else + SMB_VFS_REMOVEXATTR(fsp->conn, fsp->fsp_name, SAMBA_POSIX_INHERITANCE_EA_NAME); + return; + } + + pai_buf = create_pai_buf(file_ace_list, dir_ace_list, protected, &store_size); + + if (fsp->fd != -1) + ret = SMB_VFS_FSETXATTR(fsp, fsp->fd, SAMBA_POSIX_INHERITANCE_EA_NAME, + pai_buf, store_size, 0); + else + ret = SMB_VFS_SETXATTR(fsp->conn,fsp->fsp_name, SAMBA_POSIX_INHERITANCE_EA_NAME, + pai_buf, store_size, 0); + + SAFE_FREE(pai_buf); + + DEBUG(10,("store_inheritance_attribute:%s for file %s\n", protected ? " (protected)" : "", fsp->fsp_name)); + if (ret == -1 && errno != ENOSYS) + DEBUG(1,("store_inheritance_attribute: Error %s\n", strerror(errno) )); +} + +/************************************************************************ + Delete the in memory inheritance info. +************************************************************************/ + +static void free_inherited_info(struct pai_val *pal) +{ + if (pal) { + struct pai_entry *paie, *paie_next; + for (paie = pal->entry_list; paie; paie = paie_next) { + paie_next = paie->next; + SAFE_FREE(paie); + } + for (paie = pal->def_entry_list; paie; paie = paie_next) { + paie_next = paie->next; + SAFE_FREE(paie); + } + SAFE_FREE(pal); + } +} + +/************************************************************************ + Was this ACL protected ? +************************************************************************/ + +static BOOL get_protected_flag(struct pai_val *pal) +{ + if (!pal) + return False; + return pal->protected; +} + +/************************************************************************ + Was this ACE inherited ? +************************************************************************/ + +static BOOL get_inherited_flag(struct pai_val *pal, canon_ace *ace_entry, BOOL default_ace) +{ + struct pai_entry *paie; + + if (!pal) + return False; + + /* If the entry exists it is inherited. */ + for (paie = (default_ace ? pal->def_entry_list : pal->entry_list); paie; paie = paie->next) { + if (ace_entry->owner_type == paie->owner_type && + get_entry_val(ace_entry) == get_pai_entry_val(paie)) + return True; + } + return False; +} + +/************************************************************************ + Ensure an attribute just read is valid. +************************************************************************/ + +static BOOL check_pai_ok(char *pai_buf, size_t pai_buf_data_size) +{ + uint16 num_entries; + uint16 num_def_entries; + + if (pai_buf_data_size < PAI_ENTRIES_BASE) { + /* Corrupted - too small. */ + return False; + } + + if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_VERSION) + return False; + + num_entries = SVAL(pai_buf,PAI_NUM_ENTRIES_OFFSET); + num_def_entries = SVAL(pai_buf,PAI_NUM_DEFAULT_ENTRIES_OFFSET); + + /* Check the entry lists match. */ + /* Each entry is 5 bytes (type plus 4 bytes of uid or gid). */ + + if (((num_entries + num_def_entries)*PAI_ENTRY_LENGTH) + PAI_ENTRIES_BASE != pai_buf_data_size) + return False; + + return True; +} + + +/************************************************************************ + Convert to in-memory format. +************************************************************************/ + +static struct pai_val *create_pai_val(char *buf, size_t size) +{ + char *entry_offset; + struct pai_val *paiv = NULL; + int i; + + if (!check_pai_ok(buf, size)) + return NULL; + + paiv = malloc(sizeof(struct pai_val)); + if (!paiv) + return NULL; + + memset(paiv, '\0', sizeof(struct pai_val)); + + paiv->protected = (CVAL(buf,PAI_FLAG_OFFSET) == PAI_ACL_FLAG_PROTECTED); + + paiv->num_entries = SVAL(buf,PAI_NUM_ENTRIES_OFFSET); + paiv->num_def_entries = SVAL(buf,PAI_NUM_DEFAULT_ENTRIES_OFFSET); + + entry_offset = buf + PAI_ENTRIES_BASE; + + DEBUG(10,("create_pai_val:%s num_entries = %u, num_def_entries = %u\n", + paiv->protected ? " (protected)" : "", paiv->num_entries, paiv->num_def_entries )); + + for (i = 0; i < paiv->num_entries; i++) { + struct pai_entry *paie; + + paie = malloc(sizeof(struct pai_entry)); + if (!paie) { + free_inherited_info(paiv); + return NULL; + } + + paie->owner_type = (enum ace_owner)CVAL(entry_offset,0); + switch( paie->owner_type) { + case UID_ACE: + paie->unix_ug.uid = (uid_t)IVAL(entry_offset,1); + DEBUG(10,("create_pai_val: uid = %u\n", (unsigned int)paie->unix_ug.uid )); + break; + case GID_ACE: + paie->unix_ug.gid = (gid_t)IVAL(entry_offset,1); + DEBUG(10,("create_pai_val: gid = %u\n", (unsigned int)paie->unix_ug.gid )); + break; + case WORLD_ACE: + paie->unix_ug.world = -1; + DEBUG(10,("create_pai_val: world ace\n")); + break; + default: + free_inherited_info(paiv); + return NULL; + } + entry_offset += PAI_ENTRY_LENGTH; + DLIST_ADD(paiv->entry_list, paie); + } + + for (i = 0; i < paiv->num_def_entries; i++) { + struct pai_entry *paie; + + paie = malloc(sizeof(struct pai_entry)); + if (!paie) { + free_inherited_info(paiv); + return NULL; + } + + paie->owner_type = (enum ace_owner)CVAL(entry_offset,0); + switch( paie->owner_type) { + case UID_ACE: + paie->unix_ug.uid = (uid_t)IVAL(entry_offset,1); + DEBUG(10,("create_pai_val: (def) uid = %u\n", (unsigned int)paie->unix_ug.uid )); + break; + case GID_ACE: + paie->unix_ug.gid = (gid_t)IVAL(entry_offset,1); + DEBUG(10,("create_pai_val: (def) gid = %u\n", (unsigned int)paie->unix_ug.gid )); + break; + case WORLD_ACE: + paie->unix_ug.world = -1; + DEBUG(10,("create_pai_val: (def) world ace\n")); + break; + default: + free_inherited_info(paiv); + return NULL; + } + entry_offset += PAI_ENTRY_LENGTH; + DLIST_ADD(paiv->def_entry_list, paie); + } + + return paiv; +} + +/************************************************************************ + Load the user.SAMBA_PAI attribute. +************************************************************************/ + +static struct pai_val *load_inherited_info(files_struct *fsp) +{ + char *pai_buf; + size_t pai_buf_size = 1024; + struct pai_val *paiv = NULL; + ssize_t ret; + + if (!lp_map_acl_inherit(SNUM(fsp->conn))) + return NULL; + + if ((pai_buf = malloc(pai_buf_size)) == NULL) + return NULL; + + do { + if (fsp->fd != -1) + ret = SMB_VFS_FGETXATTR(fsp, fsp->fd, SAMBA_POSIX_INHERITANCE_EA_NAME, + pai_buf, pai_buf_size); + else + ret = SMB_VFS_GETXATTR(fsp->conn,fsp->fsp_name,SAMBA_POSIX_INHERITANCE_EA_NAME, + pai_buf, pai_buf_size); + + if (ret == -1) { + if (errno != ERANGE) { + break; + } + /* Buffer too small - enlarge it. */ + pai_buf_size *= 2; + SAFE_FREE(pai_buf); + if ((pai_buf = malloc(pai_buf_size)) == NULL) + return NULL; + } + } while (ret == -1); + + DEBUG(10,("load_inherited_info: ret = %d for file %s\n", ret, fsp->fsp_name)); + + if (ret == -1) { + /* No attribute or not supported. */ +#if defined(ENOATTR) + if (errno != ENOATTR) + DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) )); +#else + if (errno != ENOSYS) + DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) )); +#endif + SAFE_FREE(pai_buf); + return NULL; + } + + paiv = create_pai_val(pai_buf, ret); + + if (paiv && paiv->protected) + DEBUG(10,("load_inherited_info: ACL is protected for file %s\n", fsp->fsp_name)); + + SAFE_FREE(pai_buf); + return paiv; +} + /**************************************************************************** Functions to manipulate the internal ACE format. ****************************************************************************/ @@ -106,10 +544,10 @@ static void print_canon_ace(canon_ace *pace, int num) dbgtext( "SID = %s ", sid_to_string( str, &pace->trustee)); if (pace->owner_type == UID_ACE) { const char *u_name = uidtoname(pace->unix_ug.uid); - dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name); + dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name ); } else if (pace->owner_type == GID_ACE) { char *g_name = gidtoname(pace->unix_ug.gid); - dbgtext( "gid %u (%s) ", (unsigned int)pace->unix_ug.gid, g_name); + dbgtext( "gid %u (%s) ", (unsigned int)pace->unix_ug.gid, g_name ); } else dbgtext( "other "); switch (pace->type) { @@ -129,6 +567,8 @@ static void print_canon_ace(canon_ace *pace, int num) dbgtext( "SMB_ACL_OTHER "); break; } + if (pace->inherited) + dbgtext( "(inherited) "); dbgtext( "perms "); dbgtext( "%c", pace->perms & S_IRUSR ? 'r' : '-'); dbgtext( "%c", pace->perms & S_IWUSR ? 'w' : '-'); @@ -158,9 +598,9 @@ static mode_t convert_permset_to_mode_t(connection_struct *conn, SMB_ACL_PERMSET { mode_t ret = 0; - ret |= (conn->vfs_ops.sys_acl_get_perm(conn, permset, SMB_ACL_READ) ? S_IRUSR : 0); - ret |= (conn->vfs_ops.sys_acl_get_perm(conn, permset, SMB_ACL_WRITE) ? S_IWUSR : 0); - ret |= (conn->vfs_ops.sys_acl_get_perm(conn, permset, SMB_ACL_EXECUTE) ? S_IXUSR : 0); + ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_READ) ? S_IRUSR : 0); + ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_WRITE) ? S_IWUSR : 0); + ret |= (SMB_VFS_SYS_ACL_GET_PERM(conn, permset, SMB_ACL_EXECUTE) ? S_IXUSR : 0); return ret; } @@ -190,18 +630,18 @@ static mode_t unix_perms_to_acl_perms(mode_t mode, int r_mask, int w_mask, int x static int map_acl_perms_to_permset(connection_struct *conn, mode_t mode, SMB_ACL_PERMSET_T *p_permset) { - if (conn->vfs_ops.sys_acl_clear_perms(conn, *p_permset) == -1) + if (SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, *p_permset) == -1) return -1; if (mode & S_IRUSR) { - if (conn->vfs_ops.sys_acl_add_perm(conn, *p_permset, SMB_ACL_READ) == -1) + if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_READ) == -1) return -1; } if (mode & S_IWUSR) { - if (conn->vfs_ops.sys_acl_add_perm(conn, *p_permset, SMB_ACL_WRITE) == -1) + if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_WRITE) == -1) return -1; } if (mode & S_IXUSR) { - if (conn->vfs_ops.sys_acl_add_perm(conn, *p_permset, SMB_ACL_EXECUTE) == -1) + if (SMB_VFS_SYS_ACL_ADD_PERM(conn, *p_permset, SMB_ACL_EXECUTE) == -1) return -1; } return 0; @@ -468,7 +908,7 @@ static BOOL unpack_nt_owners(SMB_STRUCT_STAT *psbuf, uid_t *puser, gid_t *pgrp, if (security_info_sent & OWNER_SECURITY_INFORMATION) { sid_copy(&owner_sid, psd->owner_sid); - if (NT_STATUS_IS_ERR(sid_to_uid(&owner_sid, puser))) { + if (!NT_STATUS_IS_OK(sid_to_uid(&owner_sid, puser))) { #if ACL_FORCE_UNMAPPABLE /* this allows take ownership to work reasonably */ extern struct current_user current_user; @@ -488,7 +928,7 @@ static BOOL unpack_nt_owners(SMB_STRUCT_STAT *psbuf, uid_t *puser, gid_t *pgrp, if (security_info_sent & GROUP_SECURITY_INFORMATION) { sid_copy(&grp_sid, psd->grp_sid); - if (NT_STATUS_IS_ERR(sid_to_gid( &grp_sid, pgrp))) { + if (!NT_STATUS_IS_OK(sid_to_gid( &grp_sid, pgrp))) { #if ACL_FORCE_UNMAPPABLE /* this allows take group ownership to work reasonably */ extern struct current_user current_user; @@ -637,62 +1077,6 @@ static BOOL ensure_canon_entry_valid(canon_ace **pp_ace, } } - /* - * When setting ACLs and missing one out of SMB_ACL_USER_OBJ, - * SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER, try to retrieve current - * values. For user and other a simple vfs_stat would do, but - * we would get mask instead of group. Let's do it via ACL. - */ - - if (setting_acl && (!got_user || !got_grp || !got_other)) { - - SMB_ACL_ENTRY_T entry; - int entry_id = SMB_ACL_FIRST_ENTRY; - - if(fsp->is_directory || fsp->fd == -1) { - current_posix_acl = conn->vfs_ops.sys_acl_get_file(conn, fsp->fsp_name, SMB_ACL_TYPE_ACCESS); - } else { - current_posix_acl = conn->vfs_ops.sys_acl_get_fd(fsp, fsp->fd); - } - - if (current_posix_acl) { - while (conn->vfs_ops.sys_acl_get_entry(conn, current_posix_acl, entry_id, &entry) == 1) { - SMB_ACL_TAG_T tagtype; - SMB_ACL_PERMSET_T permset; - - /* get_next... */ - if (entry_id == SMB_ACL_FIRST_ENTRY) - entry_id = SMB_ACL_NEXT_ENTRY; - - /* Is this a MASK entry ? */ - if (conn->vfs_ops.sys_acl_get_tag_type(conn, entry, &tagtype) == -1) - continue; - - if (conn->vfs_ops.sys_acl_get_permset(conn, entry, &permset) == -1) - continue; - - switch(tagtype) { - case SMB_ACL_USER_OBJ: - current_user_perms = convert_permset_to_mode_t(conn, permset); - got_current_user = True; - break; - case SMB_ACL_GROUP_OBJ: - current_grp_perms = convert_permset_to_mode_t(conn, permset); - got_current_grp = True; - break; - case SMB_ACL_OTHER: - current_other_perms = convert_permset_to_mode_t(conn, permset); - got_current_other = True; - break; - } - } - conn->vfs_ops.sys_acl_free_acl(conn, current_posix_acl); - } else { - DEBUG(10,("ensure_canon_entry_valid: failed to retrieve current ACL of %s\n", - fsp->fsp_name)); - } - } - if (!got_user) { if ((pace = (canon_ace *)malloc(sizeof(canon_ace))) == NULL) { DEBUG(0,("ensure_canon_entry_valid: malloc fail.\n")); @@ -822,7 +1206,7 @@ static void check_owning_objs(canon_ace *ace, DOM_SID *pfile_owner_sid, DOM_SID Unpack a SEC_DESC into two canonical ace lists. ****************************************************************************/ -static BOOL create_canon_ace_lists(files_struct *fsp, +static BOOL create_canon_ace_lists(files_struct *fsp, SMB_STRUCT_STAT *pst, DOM_SID *pfile_owner_sid, DOM_SID *pfile_grp_sid, canon_ace **ppfile_ace, canon_ace **ppdir_ace, @@ -957,7 +1341,7 @@ static BOOL create_canon_ace_lists(files_struct *fsp, current_ace->type = SMB_ACL_OTHER; } else if (sid_equal(¤t_ace->trustee, &global_sid_Creator_Owner)) { current_ace->owner_type = UID_ACE; - current_ace->unix_ug.world = -1; + current_ace->unix_ug.uid = pst->st_uid; current_ace->type = SMB_ACL_USER_OBJ; /* @@ -970,7 +1354,7 @@ static BOOL create_canon_ace_lists(files_struct *fsp, psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY; } else if (sid_equal(¤t_ace->trustee, &global_sid_Creator_Group)) { current_ace->owner_type = GID_ACE; - current_ace->unix_ug.world = -1; + current_ace->unix_ug.gid = pst->st_gid; current_ace->type = SMB_ACL_GROUP_OBJ; /* @@ -1005,6 +1389,7 @@ static BOOL create_canon_ace_lists(files_struct *fsp, current_ace->perms |= map_nt_perms( psa->info, S_IRUSR); current_ace->attr = (psa->type == SEC_ACE_TYPE_ACCESS_ALLOWED) ? ALLOW_ACE : DENY_ACE; + current_ace->inherited = ((psa->flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False); /* * Now add the created ace to either the file list, the directory @@ -1529,7 +1914,7 @@ static BOOL unpack_canon_ace(files_struct *fsp, * Now go through the DACL and create the canon_ace lists. */ - if (!create_canon_ace_lists( fsp, pfile_owner_sid, pfile_grp_sid, + if (!create_canon_ace_lists( fsp, pst, pfile_owner_sid, pfile_grp_sid, &file_ace, &dir_ace, psd->dacl)) return False; @@ -1672,7 +2057,7 @@ static void arrange_posix_perms( char *filename, canon_ace **pp_list_head) ****************************************************************************/ static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_STRUCT_STAT *psbuf, - DOM_SID *powner, DOM_SID *pgroup, SMB_ACL_TYPE_T the_acl_type) + DOM_SID *powner, DOM_SID *pgroup, struct pai_val *pal, SMB_ACL_TYPE_T the_acl_type) { extern DOM_SID global_sid_World; connection_struct *conn = fsp->conn; @@ -1684,7 +2069,7 @@ static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_ SMB_ACL_ENTRY_T entry; size_t ace_count; - while ( posix_acl && (conn->vfs_ops.sys_acl_get_entry(conn, posix_acl, entry_id, &entry) == 1)) { + while ( posix_acl && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1)) { SMB_ACL_TAG_T tagtype; SMB_ACL_PERMSET_T permset; DOM_SID sid; @@ -1696,10 +2081,10 @@ static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_ entry_id = SMB_ACL_NEXT_ENTRY; /* Is this a MASK entry ? */ - if (conn->vfs_ops.sys_acl_get_tag_type(conn, entry, &tagtype) == -1) + if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1) continue; - if (conn->vfs_ops.sys_acl_get_permset(conn, entry, &permset) == -1) + if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) continue; /* Decide which SID to use based on the ACL type. */ @@ -1712,7 +2097,7 @@ static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_ break; case SMB_ACL_USER: { - uid_t *puid = (uid_t *)conn->vfs_ops.sys_acl_get_qualifier(conn, entry); + uid_t *puid = (uid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry); if (puid == NULL) { DEBUG(0,("canonicalise_acl: Failed to get uid.\n")); continue; @@ -1729,7 +2114,7 @@ static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_ uid_to_sid( &sid, *puid); unix_ug.uid = *puid; owner_type = UID_ACE; - conn->vfs_ops.sys_acl_free_qualifier(conn, (void *)puid,tagtype); + SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)puid,tagtype); break; } case SMB_ACL_GROUP_OBJ: @@ -1740,7 +2125,7 @@ static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_ break; case SMB_ACL_GROUP: { - gid_t *pgid = (gid_t *)conn->vfs_ops.sys_acl_get_qualifier(conn, entry); + gid_t *pgid = (gid_t *)SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry); if (pgid == NULL) { DEBUG(0,("canonicalise_acl: Failed to get gid.\n")); continue; @@ -1748,7 +2133,7 @@ static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_ gid_to_sid( &sid, *pgid); unix_ug.gid = *pgid; owner_type = GID_ACE; - conn->vfs_ops.sys_acl_free_qualifier(conn, (void *)pgid,tagtype); + SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, (void *)pgid,tagtype); break; } case SMB_ACL_MASK: @@ -1779,6 +2164,7 @@ static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_ ace->trustee = sid; ace->unix_ug = unix_ug; ace->owner_type = owner_type; + ace->inherited = get_inherited_flag(pal, ace, (the_acl_type == SMB_ACL_TYPE_DEFAULT)); DLIST_ADD(list_head, ace); } @@ -1790,14 +2176,12 @@ static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_ if (!ensure_canon_entry_valid(&list_head, fsp, powner, pgroup, psbuf, False)) goto fail; - arrange_posix_perms(fsp->fsp_name,&list_head ); - /* * Now go through the list, masking the permissions with the * acl_mask. Ensure all DENY Entries are at the start of the list. */ - DEBUG(10,("canonicalise_acl: ace entries before arrange :\n")); + DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", the_acl_type == SMB_ACL_TYPE_ACCESS ? "Access" : "Default" )); for ( ace_count = 0, ace = list_head; ace; ace = next_ace, ace_count++) { next_ace = ace->next; @@ -1815,6 +2199,8 @@ static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_ } } + arrange_posix_perms(fsp->fsp_name,&list_head ); + print_canon_ace_list( "canonicalise_acl: ace entries after arrange", list_head ); return list_head; @@ -1833,7 +2219,7 @@ static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL defau { connection_struct *conn = fsp->conn; BOOL ret = False; - SMB_ACL_T the_acl = conn->vfs_ops.sys_acl_init(conn, (int)count_canon_ace_list(the_ace) + 1); + SMB_ACL_T the_acl = SMB_VFS_SYS_ACL_INIT(conn, (int)count_canon_ace_list(the_ace) + 1); canon_ace *p_ace; int i; SMB_ACL_ENTRY_T mask_entry; @@ -1891,7 +2277,7 @@ static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL defau * Get the entry for this ACE. */ - if (conn->vfs_ops.sys_acl_create_entry(conn, &the_acl, &the_entry) == -1) { + if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &the_entry) == -1) { DEBUG(0,("set_canon_ace_list: Failed to create entry %d. (%s)\n", i, strerror(errno) )); goto done; @@ -1917,7 +2303,7 @@ static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL defau * First tell the entry what type of ACE this is. */ - if (conn->vfs_ops.sys_acl_set_tag_type(conn, the_entry, p_ace->type) == -1) { + if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, the_entry, p_ace->type) == -1) { DEBUG(0,("set_canon_ace_list: Failed to set tag type on entry %d. (%s)\n", i, strerror(errno) )); goto done; @@ -1929,7 +2315,7 @@ static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL defau */ if ((p_ace->type == SMB_ACL_USER) || (p_ace->type == SMB_ACL_GROUP)) { - if (conn->vfs_ops.sys_acl_set_qualifier(conn, the_entry,(void *)&p_ace->unix_ug.uid) == -1) { + if (SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, the_entry,(void *)&p_ace->unix_ug.uid) == -1) { DEBUG(0,("set_canon_ace_list: Failed to set qualifier on entry %d. (%s)\n", i, strerror(errno) )); goto done; @@ -1940,7 +2326,7 @@ static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL defau * Convert the mode_t perms in the canon_ace to a POSIX permset. */ - if (conn->vfs_ops.sys_acl_get_permset(conn, the_entry, &the_permset) == -1) { + if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, the_entry, &the_permset) == -1) { DEBUG(0,("set_canon_ace_list: Failed to get permset on entry %d. (%s)\n", i, strerror(errno) )); goto done; @@ -1956,7 +2342,7 @@ static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL defau * ..and apply them to the entry. */ - if (conn->vfs_ops.sys_acl_set_permset(conn, the_entry, the_permset) == -1) { + if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, the_entry, the_permset) == -1) { DEBUG(0,("set_canon_ace_list: Failed to add permset on entry %d. (%s)\n", i, strerror(errno) )); goto done; @@ -1964,20 +2350,21 @@ static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL defau if( DEBUGLVL( 10 )) print_canon_ace( p_ace, i); + } if (needs_mask && !got_mask_entry) { - if (conn->vfs_ops.sys_acl_create_entry(conn, &the_acl, &mask_entry) == -1) { + if (SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, &the_acl, &mask_entry) == -1) { DEBUG(0,("set_canon_ace_list: Failed to create mask entry. (%s)\n", strerror(errno) )); goto done; } - if (conn->vfs_ops.sys_acl_set_tag_type(conn, mask_entry, SMB_ACL_MASK) == -1) { + if (SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, mask_entry, SMB_ACL_MASK) == -1) { DEBUG(0,("set_canon_ace_list: Failed to set tag type on mask entry. (%s)\n",strerror(errno) )); goto done; } - if (conn->vfs_ops.sys_acl_get_permset(conn, mask_entry, &mask_permset) == -1) { + if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, mask_entry, &mask_permset) == -1) { DEBUG(0,("set_canon_ace_list: Failed to get mask permset. (%s)\n", strerror(errno) )); goto done; } @@ -1987,7 +2374,7 @@ static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL defau goto done; } - if (conn->vfs_ops.sys_acl_set_permset(conn, mask_entry, mask_permset) == -1) { + if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, mask_entry, mask_permset) == -1) { DEBUG(0,("set_canon_ace_list: Failed to add mask permset. (%s)\n", strerror(errno) )); goto done; } @@ -1997,7 +2384,7 @@ static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL defau * Check if the ACL is valid. */ - if (conn->vfs_ops.sys_acl_valid(conn, the_acl) == -1) { + if (SMB_VFS_SYS_ACL_VALID(conn, the_acl) == -1) { DEBUG(0,("set_canon_ace_list: ACL type (%s) is invalid for set (%s).\n", the_acl_type == SMB_ACL_TYPE_DEFAULT ? "directory default" : "file", strerror(errno) )); @@ -2009,7 +2396,7 @@ static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL defau */ if(default_ace || fsp->is_directory || fsp->fd == -1) { - if (conn->vfs_ops.sys_acl_set_file(conn, fsp->fsp_name, the_acl_type, the_acl) == -1) { + if (SMB_VFS_SYS_ACL_SET_FILE(conn, fsp->fsp_name, the_acl_type, the_acl) == -1) { /* * Some systems allow all the above calls and only fail with no ACL support * when attempting to apply the acl. HPUX with HFS is an example of this. JRA. @@ -2028,7 +2415,7 @@ static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL defau goto done; } } else { - if (conn->vfs_ops.sys_acl_set_fd(fsp, fsp->fd, the_acl) == -1) { + if (SMB_VFS_SYS_ACL_SET_FD(fsp, fsp->fd, the_acl) == -1) { /* * Some systems allow all the above calls and only fail with no ACL support * when attempting to apply the acl. HPUX with HFS is an example of this. JRA. @@ -2052,7 +2439,7 @@ static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL defau done: if (the_acl != NULL) - conn->vfs_ops.sys_acl_free_acl(conn, the_acl); + SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl); return ret; } @@ -2083,8 +2470,8 @@ SMB_ACL_T free_empty_sys_acl(connection_struct *conn, SMB_ACL_T the_acl) if (!the_acl) return NULL; - if (conn->vfs_ops.sys_acl_get_entry(conn, the_acl, SMB_ACL_FIRST_ENTRY, &entry) != 1) { - conn->vfs_ops.sys_acl_free_acl(conn, the_acl); + if (SMB_VFS_SYS_ACL_GET_ENTRY(conn, the_acl, SMB_ACL_FIRST_ENTRY, &entry) != 1) { + SMB_VFS_SYS_ACL_FREE_ACL(conn, the_acl); return NULL; } return the_acl; @@ -2165,16 +2552,6 @@ posix perms.\n", fsp->fsp_name )); return True; } -static int nt_ace_comp( SEC_ACE *a1, SEC_ACE *a2) -{ - if (a1->type == a2->type) - return 0; - - if (a1->type == SEC_ACE_TYPE_ACCESS_DENIED && a2->type == SEC_ACE_TYPE_ACCESS_ALLOWED) - return -1; - return 1; -} - /**************************************************************************** Incoming NT ACLs on a directory can be split into a default POSIX acl (CI|OI|IO) and a normal POSIX acl. Win2k needs these split acls re-merging into one ACL @@ -2188,24 +2565,51 @@ static size_t merge_default_aces( SEC_ACE *nt_ace_list, size_t num_aces) for (i = 0; i < num_aces; i++) { for (j = i+1; j < num_aces; j++) { + uint32 i_flags_ni = (nt_ace_list[i].flags & ~SEC_ACE_FLAG_INHERITED_ACE); + uint32 j_flags_ni = (nt_ace_list[j].flags & ~SEC_ACE_FLAG_INHERITED_ACE); + BOOL i_inh = (nt_ace_list[i].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False; + BOOL j_inh = (nt_ace_list[j].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False; + /* We know the lower number ACE's are file entries. */ if ((nt_ace_list[i].type == nt_ace_list[j].type) && (nt_ace_list[i].size == nt_ace_list[j].size) && (nt_ace_list[i].info.mask == nt_ace_list[j].info.mask) && sid_equal(&nt_ace_list[i].trustee, &nt_ace_list[j].trustee) && - (nt_ace_list[i].flags == 0) && - (nt_ace_list[j].flags == (SEC_ACE_FLAG_OBJECT_INHERIT| - SEC_ACE_FLAG_CONTAINER_INHERIT| - SEC_ACE_FLAG_INHERIT_ONLY))) { + (i_inh == j_inh) && + (i_flags_ni == 0) && + (j_flags_ni == (SEC_ACE_FLAG_OBJECT_INHERIT| + SEC_ACE_FLAG_CONTAINER_INHERIT| + SEC_ACE_FLAG_INHERIT_ONLY))) { /* - * These are identical except for the flags. - * Merge the inherited ACE onto the non-inherited ACE. + * W2K wants to have access allowed zero access ACE's + * at the end of the list. If the mask is zero, merge + * the non-inherited ACE onto the inherited ACE. */ - nt_ace_list[i].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT; - if (num_aces - j - 1 > 0) - memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) * - sizeof(SEC_ACE)); + if (nt_ace_list[i].info.mask == 0) { + nt_ace_list[j].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT| + (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0); + if (num_aces - i - 1 > 0) + memmove(&nt_ace_list[i], &nt_ace_list[i+1], (num_aces-i-1) * + sizeof(SEC_ACE)); + + DEBUG(10,("merge_default_aces: Merging zero access ACE %u onto ACE %u.\n", + (unsigned int)i, (unsigned int)j )); + } else { + /* + * These are identical except for the flags. + * Merge the inherited ACE onto the non-inherited ACE. + */ + + nt_ace_list[i].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT| + (i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0); + if (num_aces - j - 1 > 0) + memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) * + sizeof(SEC_ACE)); + + DEBUG(10,("merge_default_aces: Merging ACE %u onto ACE %u.\n", + (unsigned int)j, (unsigned int)i )); + } num_aces--; break; } @@ -2221,7 +2625,7 @@ static size_t merge_default_aces( SEC_ACE *nt_ace_list, size_t num_aces) the UNIX style get ACL. ****************************************************************************/ -size_t get_nt_acl(files_struct *fsp, SEC_DESC **ppdesc) +size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc) { extern DOM_SID global_sid_Builtin_Administrators; extern DOM_SID global_sid_Builtin_Users; @@ -2242,7 +2646,9 @@ size_t get_nt_acl(files_struct *fsp, SEC_DESC **ppdesc) canon_ace *file_ace = NULL; canon_ace *dir_ace = NULL; size_t num_profile_acls = 0; - + struct pai_val *pal = NULL; + SEC_DESC *psd = NULL; + *ppdesc = NULL; DEBUG(10,("get_nt_acl: called for file %s\n", fsp->fsp_name )); @@ -2250,40 +2656,42 @@ size_t get_nt_acl(files_struct *fsp, SEC_DESC **ppdesc) if(fsp->is_directory || fsp->fd == -1) { /* Get the stat struct for the owner info. */ - if(vfs_stat(fsp->conn,fsp->fsp_name, &sbuf) != 0) { + if(SMB_VFS_STAT(fsp->conn,fsp->fsp_name, &sbuf) != 0) { return 0; } /* * Get the ACL from the path. */ - posix_acl = conn->vfs_ops.sys_acl_get_file(conn, fsp->fsp_name, SMB_ACL_TYPE_ACCESS); + posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fsp->fsp_name, SMB_ACL_TYPE_ACCESS); /* * If it's a directory get the default POSIX ACL. */ if(fsp->is_directory) { - dir_acl = conn->vfs_ops.sys_acl_get_file(conn, fsp->fsp_name, SMB_ACL_TYPE_DEFAULT); + dir_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fsp->fsp_name, SMB_ACL_TYPE_DEFAULT); dir_acl = free_empty_sys_acl(conn, dir_acl); } } else { /* Get the stat struct for the owner info. */ - if(vfs_fstat(fsp,fsp->fd,&sbuf) != 0) { + if(SMB_VFS_FSTAT(fsp,fsp->fd,&sbuf) != 0) { return 0; } /* * Get the ACL from the fd. */ - posix_acl = conn->vfs_ops.sys_acl_get_fd(fsp, fsp->fd); + posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, fsp->fd); } DEBUG(5,("get_nt_acl : file ACL %s, directory ACL %s\n", posix_acl ? "present" : "absent", dir_acl ? "present" : "absent" )); + pal = load_inherited_info(fsp); + /* * Get the owner, group and world SIDs. */ @@ -2297,179 +2705,171 @@ size_t get_nt_acl(files_struct *fsp, SEC_DESC **ppdesc) create_file_sids(&sbuf, &owner_sid, &group_sid); } - /* - * In the optimum case Creator Owner and Creator Group would be used for - * the ACL_USER_OBJ and ACL_GROUP_OBJ entries, respectively, but this - * would lead to usability problems under Windows: The Creator entries - * are only available in browse lists of directories and not for files; - * additionally the identity of the owning group couldn't be determined. - * We therefore use those identities only for Default ACLs. - */ - - /* Create the canon_ace lists. */ - file_ace = canonicalise_acl( fsp, posix_acl, &sbuf, &owner_sid, &group_sid, SMB_ACL_TYPE_ACCESS ); + if ((security_info & DACL_SECURITY_INFORMATION) && !(security_info & PROTECTED_DACL_SECURITY_INFORMATION)) { - /* We must have *some* ACLS. */ + /* + * In the optimum case Creator Owner and Creator Group would be used for + * the ACL_USER_OBJ and ACL_GROUP_OBJ entries, respectively, but this + * would lead to usability problems under Windows: The Creator entries + * are only available in browse lists of directories and not for files; + * additionally the identity of the owning group couldn't be determined. + * We therefore use those identities only for Default ACLs. + */ - if (count_canon_ace_list(file_ace) == 0) { - DEBUG(0,("get_nt_acl : No ACLs on file (%s) !\n", fsp->fsp_name )); - return 0; - } + /* Create the canon_ace lists. */ + file_ace = canonicalise_acl( fsp, posix_acl, &sbuf, &owner_sid, &group_sid, pal, SMB_ACL_TYPE_ACCESS ); - if (fsp->is_directory && dir_acl) { - dir_ace = canonicalise_acl(fsp, dir_acl, &sbuf, - &global_sid_Creator_Owner, - &global_sid_Creator_Group, SMB_ACL_TYPE_DEFAULT ); - } + /* We must have *some* ACLS. */ + + if (count_canon_ace_list(file_ace) == 0) { + DEBUG(0,("get_nt_acl : No ACLs on file (%s) !\n", fsp->fsp_name )); + return 0; + } - /* - * Create the NT ACE list from the canonical ace lists. - */ + if (fsp->is_directory && dir_acl) { + dir_ace = canonicalise_acl(fsp, dir_acl, &sbuf, + &global_sid_Creator_Owner, + &global_sid_Creator_Group, pal, SMB_ACL_TYPE_DEFAULT ); + } - { - canon_ace *ace; - int nt_acl_type; - int i; + /* + * Create the NT ACE list from the canonical ace lists. + */ - if (nt4_compatible_acls() && dir_ace) { - /* - * NT 4 chokes if an ACL contains an INHERIT_ONLY entry - * but no non-INHERIT_ONLY entry for one SID. So we only - * remove entries from the Access ACL if the - * corresponding Default ACL entries have also been - * removed. ACEs for CREATOR-OWNER and CREATOR-GROUP - * are exceptions. We can do nothing - * intelligent if the Default ACL contains entries that - * are not also contained in the Access ACL, so this - * case will still fail under NT 4. - */ + { + canon_ace *ace; + int nt_acl_type; + int i; - ace = canon_ace_entry_for(dir_ace, SMB_ACL_OTHER, NULL); - if (ace && !ace->perms) { - DLIST_REMOVE(dir_ace, ace); - SAFE_FREE(ace); + if (nt4_compatible_acls() && dir_ace) { + /* + * NT 4 chokes if an ACL contains an INHERIT_ONLY entry + * but no non-INHERIT_ONLY entry for one SID. So we only + * remove entries from the Access ACL if the + * corresponding Default ACL entries have also been + * removed. ACEs for CREATOR-OWNER and CREATOR-GROUP + * are exceptions. We can do nothing + * intelligent if the Default ACL contains entries that + * are not also contained in the Access ACL, so this + * case will still fail under NT 4. + */ - ace = canon_ace_entry_for(file_ace, SMB_ACL_OTHER, NULL); + ace = canon_ace_entry_for(dir_ace, SMB_ACL_OTHER, NULL); if (ace && !ace->perms) { - DLIST_REMOVE(file_ace, ace); + DLIST_REMOVE(dir_ace, ace); SAFE_FREE(ace); + + ace = canon_ace_entry_for(file_ace, SMB_ACL_OTHER, NULL); + if (ace && !ace->perms) { + DLIST_REMOVE(file_ace, ace); + SAFE_FREE(ace); + } } - } - /* - * WinNT doesn't usually have Creator Group - * in browse lists, so we send this entry to - * WinNT even if it contains no relevant - * permissions. Once we can add - * Creator Group to browse lists we can - * re-enable this. - */ + /* + * WinNT doesn't usually have Creator Group + * in browse lists, so we send this entry to + * WinNT even if it contains no relevant + * permissions. Once we can add + * Creator Group to browse lists we can + * re-enable this. + */ #if 0 - ace = canon_ace_entry_for(dir_ace, SMB_ACL_GROUP_OBJ, NULL); - if (ace && !ace->perms) { - DLIST_REMOVE(dir_ace, ace); - SAFE_FREE(ace); - } + ace = canon_ace_entry_for(dir_ace, SMB_ACL_GROUP_OBJ, NULL); + if (ace && !ace->perms) { + DLIST_REMOVE(dir_ace, ace); + SAFE_FREE(ace); + } #endif - ace = canon_ace_entry_for(file_ace, SMB_ACL_GROUP_OBJ, NULL); - if (ace && !ace->perms) { - DLIST_REMOVE(file_ace, ace); - SAFE_FREE(ace); - } - } else { - - ace = canon_ace_entry_for(dir_ace, SMB_ACL_OTHER, NULL); - if (ace && !ace->perms) { - DLIST_REMOVE(dir_ace, ace); - SAFE_FREE(ace); - } - ace = canon_ace_entry_for(dir_ace, SMB_ACL_GROUP_OBJ, NULL); - if (ace && !ace->perms) { - DLIST_REMOVE(dir_ace, ace); - SAFE_FREE(ace); + ace = canon_ace_entry_for(file_ace, SMB_ACL_GROUP_OBJ, NULL); + if (ace && !ace->perms) { + DLIST_REMOVE(file_ace, ace); + SAFE_FREE(ace); + } } - } - - num_acls = count_canon_ace_list(file_ace); - num_dir_acls = count_canon_ace_list(dir_ace); - - /* Allocate the ace list. */ - if ((nt_ace_list = (SEC_ACE *)malloc((num_acls + num_profile_acls + num_dir_acls)* sizeof(SEC_ACE))) == NULL) { - DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n")); - goto done; - } - memset(nt_ace_list, '\0', (num_acls + num_dir_acls) * sizeof(SEC_ACE) ); - - /* - * Create the NT ACE list from the canonical ace lists. - */ + num_acls = count_canon_ace_list(file_ace); + num_dir_acls = count_canon_ace_list(dir_ace); - ace = file_ace; + /* Allocate the ace list. */ + if ((nt_ace_list = (SEC_ACE *)malloc((num_acls + num_profile_acls + num_dir_acls)* sizeof(SEC_ACE))) == NULL) { + DEBUG(0,("get_nt_acl: Unable to malloc space for nt_ace_list.\n")); + goto done; + } - for (i = 0; i < num_acls; i++, ace = ace->next) { - SEC_ACCESS acc; + memset(nt_ace_list, '\0', (num_acls + num_dir_acls) * sizeof(SEC_ACE) ); + + /* + * Create the NT ACE list from the canonical ace lists. + */ + + ace = file_ace; - acc = map_canon_ace_perms(&nt_acl_type, &owner_sid, ace ); - init_sec_ace(&nt_ace_list[num_aces++], &ace->trustee, nt_acl_type, acc, 0); - } + for (i = 0; i < num_acls; i++, ace = ace->next) { + SEC_ACCESS acc; - /* The User must have access to a profile share - even if we can't map the SID. */ - if (lp_profile_acls(SNUM(fsp->conn))) { - SEC_ACCESS acc; + acc = map_canon_ace_perms(&nt_acl_type, &owner_sid, ace ); + init_sec_ace(&nt_ace_list[num_aces++], &ace->trustee, nt_acl_type, acc, ace->inherited ? SEC_ACE_FLAG_INHERITED_ACE : 0); + } - init_sec_access(&acc,FILE_GENERIC_ALL); - init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, acc, 0); - } + /* The User must have access to a profile share - even if we can't map the SID. */ + if (lp_profile_acls(SNUM(fsp->conn))) { + SEC_ACCESS acc; - ace = dir_ace; + init_sec_access(&acc,FILE_GENERIC_ALL); + init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, + acc, 0); + } - for (i = 0; i < num_dir_acls; i++, ace = ace->next) { - SEC_ACCESS acc; + ace = dir_ace; - acc = map_canon_ace_perms(&nt_acl_type, &owner_sid, ace ); - init_sec_ace(&nt_ace_list[num_aces++], &ace->trustee, nt_acl_type, acc, - SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_INHERIT_ONLY); - } + for (i = 0; i < num_dir_acls; i++, ace = ace->next) { + SEC_ACCESS acc; + + acc = map_canon_ace_perms(&nt_acl_type, &owner_sid, ace ); + init_sec_ace(&nt_ace_list[num_aces++], &ace->trustee, nt_acl_type, acc, + SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT| + SEC_ACE_FLAG_INHERIT_ONLY| + (ace->inherited ? SEC_ACE_FLAG_INHERITED_ACE : 0)); + } - /* The User must have access to a profile share - even if we can't map the SID. */ - if (lp_profile_acls(SNUM(fsp->conn))) { - SEC_ACCESS acc; + /* The User must have access to a profile share - even if we can't map the SID. */ + if (lp_profile_acls(SNUM(fsp->conn))) { + SEC_ACCESS acc; - init_sec_access(&acc,FILE_GENERIC_ALL); - init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, acc, - SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT| - SEC_ACE_FLAG_INHERIT_ONLY); - } - - /* - * Merge POSIX default ACLs and normal ACLs into one NT ACE. - * Win2K needs this to get the inheritance correct when replacing ACLs - * on a directory tree. Based on work by Jim @ IBM. - */ + init_sec_access(&acc,FILE_GENERIC_ALL); + init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, acc, + SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT| + SEC_ACE_FLAG_INHERIT_ONLY|0); + } - num_aces = merge_default_aces(nt_ace_list, num_aces); + /* + * Merge POSIX default ACLs and normal ACLs into one NT ACE. + * Win2K needs this to get the inheritance correct when replacing ACLs + * on a directory tree. Based on work by Jim @ IBM. + */ - /* - * Sort to force deny entries to the front. - */ + num_aces = merge_default_aces(nt_ace_list, num_aces); - if (num_aces) - qsort( nt_ace_list, num_aces, sizeof(nt_ace_list[0]), QSORT_CAST nt_ace_comp); - } + } - if (num_aces) { - if((psa = make_sec_acl( main_loop_talloc_get(), ACL_REVISION, num_aces, nt_ace_list)) == NULL) { - DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n")); - goto done; + if (num_aces) { + if((psa = make_sec_acl( main_loop_talloc_get(), ACL_REVISION, num_aces, nt_ace_list)) == NULL) { + DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n")); + goto done; + } } - } + } /* security_info & DACL_SECURITY_INFORMATION */ - *ppdesc = make_standard_sec_desc( main_loop_talloc_get(), &owner_sid, &group_sid, psa, &sd_size); + psd = make_standard_sec_desc( main_loop_talloc_get(), + (security_info & OWNER_SECURITY_INFORMATION) ? &owner_sid : NULL, + (security_info & GROUP_SECURITY_INFORMATION) ? &group_sid : NULL, + psa, + &sd_size); - if(!*ppdesc) { + if(!psd) { DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n")); sd_size = 0; } else { @@ -2482,17 +2882,24 @@ size_t get_nt_acl(files_struct *fsp, SEC_DESC **ppdesc) * any ACEs that are inherited dynamically. The DACL_PROTECTED * flag doesn't seem to bother Windows NT. */ - (*ppdesc)->type |= SE_DESC_DACL_PROTECTED; + if (get_protected_flag(pal)) + psd->type |= SE_DESC_DACL_PROTECTED; } + if (psd->dacl) + dacl_sort_into_canonical_order(psd->dacl->ace, (unsigned int)psd->dacl->num_aces); + + *ppdesc = psd; + done: if (posix_acl) - conn->vfs_ops.sys_acl_free_acl(conn, posix_acl); + SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl); if (dir_acl) - conn->vfs_ops.sys_acl_free_acl(conn, dir_acl); + SMB_VFS_SYS_ACL_FREE_ACL(conn, dir_acl); free_canon_ace_list(file_ace); free_canon_ace_list(dir_ace); + free_inherited_info(pal); SAFE_FREE(nt_ace_list); return sd_size; @@ -2514,14 +2921,14 @@ static int try_chown(connection_struct *conn, const char *fname, uid_t uid, gid_ SMB_STRUCT_STAT st; /* try the direct way first */ - ret = vfs_chown(conn, fname, uid, gid); + ret = SMB_VFS_CHOWN(conn, fname, uid, gid); if (ret == 0) return 0; if(!CAN_WRITE(conn) || !lp_dos_filemode(SNUM(conn))) return -1; - if (vfs_stat(conn,fname,&st)) + if (SMB_VFS_STAT(conn,fname,&st)) return -1; fsp = open_file_fchmod(conn,fname,&st); @@ -2536,7 +2943,7 @@ static int try_chown(connection_struct *conn, const char *fname, uid_t uid, gid_ become_root(); /* Keep the current file gid the same. */ - ret = vfswrap_fchown(fsp, fsp->fd, uid, (gid_t)-1); + ret = SMB_VFS_FCHOWN(fsp, fsp->fd, uid, (gid_t)-1); unbecome_root(); close_file_fchmod(fsp); @@ -2579,10 +2986,10 @@ BOOL set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd) */ if(fsp->is_directory || fsp->fd == -1) { - if(vfs_stat(fsp->conn,fsp->fsp_name, &sbuf) != 0) + if(SMB_VFS_STAT(fsp->conn,fsp->fsp_name, &sbuf) != 0) return False; } else { - if(vfs_fstat(fsp,fsp->fd,&sbuf) != 0) + if(SMB_VFS_FSTAT(fsp,fsp->fd,&sbuf) != 0) return False; } @@ -2628,7 +3035,7 @@ BOOL set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd) */ if(fsp->is_directory) { - if(vfs_stat(fsp->conn, fsp->fsp_name, &sbuf) != 0) { + if(SMB_VFS_STAT(fsp->conn, fsp->fsp_name, &sbuf) != 0) { return False; } } else { @@ -2636,9 +3043,9 @@ BOOL set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd) int ret; if(fsp->fd == -1) - ret = vfs_stat(fsp->conn, fsp->fsp_name, &sbuf); + ret = SMB_VFS_STAT(fsp->conn, fsp->fsp_name, &sbuf); else - ret = vfs_fstat(fsp,fsp->fd,&sbuf); + ret = SMB_VFS_FSTAT(fsp,fsp->fd,&sbuf); if(ret != 0) return False; @@ -2706,7 +3113,7 @@ BOOL set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd) * No default ACL - delete one if it exists. */ - if (conn->vfs_ops.sys_acl_delete_def_file(conn, fsp->fsp_name) == -1) { + if (SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, fsp->fsp_name) == -1) { DEBUG(3,("set_nt_acl: sys_acl_delete_def_file failed (%s)\n", strerror(errno))); free_canon_ace_list(file_ace_list); free_canon_ace_list(dir_ace_list); @@ -2715,6 +3122,10 @@ BOOL set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd) } } + if (acl_set_support) + store_inheritance_attributes(fsp, file_ace_list, dir_ace_list, + (psd->type & SE_DESC_DACL_PROTECTED) ? True : False); + /* * If we cannot set using POSIX ACLs we fall back to checking if we need to chmod. */ @@ -2735,7 +3146,7 @@ BOOL set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd) DEBUG(3,("set_nt_acl: chmod %s. perms = 0%o.\n", fsp->fsp_name, (unsigned int)posix_perms )); - if(conn->vfs_ops.chmod(conn,fsp->fsp_name, posix_perms) == -1) { + if(SMB_VFS_CHMOD(conn,fsp->fsp_name, posix_perms) == -1) { DEBUG(3,("set_nt_acl: chmod %s, 0%o failed. Error = %s.\n", fsp->fsp_name, (unsigned int)posix_perms, strerror(errno) )); free_canon_ace_list(file_ace_list); @@ -2777,7 +3188,7 @@ static int chmod_acl_internals( connection_struct *conn, SMB_ACL_T posix_acl, mo SMB_ACL_ENTRY_T entry; int num_entries = 0; - while ( conn->vfs_ops.sys_acl_get_entry(conn, posix_acl, entry_id, &entry) == 1) { + while ( SMB_VFS_SYS_ACL_GET_ENTRY(conn, posix_acl, entry_id, &entry) == 1) { SMB_ACL_TAG_T tagtype; SMB_ACL_PERMSET_T permset; mode_t perms; @@ -2786,10 +3197,10 @@ static int chmod_acl_internals( connection_struct *conn, SMB_ACL_T posix_acl, mo if (entry_id == SMB_ACL_FIRST_ENTRY) entry_id = SMB_ACL_NEXT_ENTRY; - if (conn->vfs_ops.sys_acl_get_tag_type(conn, entry, &tagtype) == -1) + if (SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry, &tagtype) == -1) return -1; - if (conn->vfs_ops.sys_acl_get_permset(conn, entry, &permset) == -1) + if (SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry, &permset) == -1) return -1; num_entries++; @@ -2820,7 +3231,7 @@ static int chmod_acl_internals( connection_struct *conn, SMB_ACL_T posix_acl, mo if (map_acl_perms_to_permset(conn, perms, &permset) == -1) return -1; - if (conn->vfs_ops.sys_acl_set_permset(conn, entry, permset) == -1) + if (SMB_VFS_SYS_ACL_SET_PERMSET(conn, entry, permset) == -1) return -1; } @@ -2846,17 +3257,17 @@ static int copy_access_acl(connection_struct *conn, const char *from, const char SMB_ACL_T posix_acl = NULL; int ret = -1; - if ((posix_acl = conn->vfs_ops.sys_acl_get_file(conn, from, SMB_ACL_TYPE_ACCESS)) == NULL) + if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, from, SMB_ACL_TYPE_ACCESS)) == NULL) return -1; if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1) goto done; - ret = conn->vfs_ops.sys_acl_set_file(conn, to, SMB_ACL_TYPE_ACCESS, posix_acl); + ret = SMB_VFS_SYS_ACL_SET_FILE(conn, to, SMB_ACL_TYPE_ACCESS, posix_acl); done: - conn->vfs_ops.sys_acl_free_acl(conn, posix_acl); + SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl); return ret; } @@ -2898,17 +3309,17 @@ int fchmod_acl(files_struct *fsp, int fd, mode_t mode) SMB_ACL_T posix_acl = NULL; int ret = -1; - if ((posix_acl = conn->vfs_ops.sys_acl_get_fd(fsp, fd)) == NULL) + if ((posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, fd)) == NULL) return -1; if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1) goto done; - ret = conn->vfs_ops.sys_acl_set_fd(fsp, fd, posix_acl); + ret = SMB_VFS_SYS_ACL_SET_FD(fsp, fd, posix_acl); done: - conn->vfs_ops.sys_acl_free_acl(conn, posix_acl); + SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl); return ret; } @@ -2918,14 +3329,14 @@ int fchmod_acl(files_struct *fsp, int fd, mode_t mode) BOOL directory_has_default_acl(connection_struct *conn, const char *fname) { - SMB_ACL_T dir_acl = conn->vfs_ops.sys_acl_get_file( conn, fname, SMB_ACL_TYPE_DEFAULT); + SMB_ACL_T dir_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_DEFAULT); BOOL has_acl = False; SMB_ACL_ENTRY_T entry; - if (dir_acl != NULL && (conn->vfs_ops.sys_acl_get_entry(conn, dir_acl, SMB_ACL_FIRST_ENTRY, &entry) == 1)) + if (dir_acl != NULL && (SMB_VFS_SYS_ACL_GET_ENTRY(conn, dir_acl, SMB_ACL_FIRST_ENTRY, &entry) == 1)) has_acl = True; if (dir_acl) - conn->vfs_ops.sys_acl_free_acl(conn, dir_acl); + SMB_VFS_SYS_ACL_FREE_ACL(conn, dir_acl); return has_acl; } diff --git a/source3/smbd/quotas.c b/source3/smbd/quotas.c index 5b843bd09a..91c952aa90 100644 --- a/source3/smbd/quotas.c +++ b/source3/smbd/quotas.c @@ -27,6 +27,15 @@ #include "includes.h" +#ifndef HAVE_SYS_QUOTAS + +/* just a quick hack because sysquotas.h is included before linux/quota.h */ +#ifdef QUOTABLOCK_SIZE +#undef QUOTABLOCK_SIZE +#endif + +#ifdef WITH_QUOTAS + #if defined(VXFS_QUOTA) /* @@ -1112,3 +1121,108 @@ BOOL disk_quotas_vxfs(const pstring name, char *path, SMB_BIG_UINT *bsize, SMB_B #endif /* SUNOS5 || ... */ #endif /* VXFS_QUOTA */ + +#else /* WITH_QUOTAS */ + +BOOL disk_quotas(const char *path,SMB_BIG_UINT *bsize,SMB_BIG_UINT *dfree,SMB_BIG_UINT *dsize) +{ + (*bsize) = 512; /* This value should be ignored */ + + /* And just to be sure we set some values that hopefully */ + /* will be larger that any possible real-world value */ + (*dfree) = (SMB_BIG_UINT)-1; + (*dsize) = (SMB_BIG_UINT)-1; + + /* As we have select not to use quotas, allways fail */ + return False; +} +#endif /* WITH_QUOTAS */ + +#else /* HAVE_SYS_QUOTAS */ +/* wrapper to the new sys_quota interface + this file should be removed later + */ +BOOL disk_quotas(const char *path,SMB_BIG_UINT *bsize,SMB_BIG_UINT *dfree,SMB_BIG_UINT *dsize) +{ + int r; + SMB_DISK_QUOTA D; + unid_t id; + + id.uid = geteuid(); + + r=sys_get_quota(path, SMB_USER_QUOTA_TYPE, id, &D); + + /* Use softlimit to determine disk space, except when it has been exceeded */ + *bsize = D.bsize; + if (r == -1) { + if (errno == EDQUOT) { + *dfree =0; + *dsize =D.curblocks; + return (True); + } else { + goto try_group_quota; + } + } + + /* Use softlimit to determine disk space, except when it has been exceeded */ + if ( + (D.softlimit && D.curblocks >= D.softlimit) || + (D.hardlimit && D.curblocks >= D.hardlimit) || + (D.isoftlimit && D.curinodes >= D.isoftlimit) || + (D.ihardlimit && D.curinodes>=D.ihardlimit) + ) { + *dfree = 0; + *dsize = D.curblocks; + } else if (D.softlimit==0 && D.hardlimit==0) { + goto try_group_quota; + } else { + if (D.softlimit == 0) + D.softlimit = D.hardlimit; + *dfree = D.softlimit - D.curblocks; + *dsize = D.softlimit; + } + + return True; + +try_group_quota: +#ifdef HAVE_GROUP_QUOTA + id.gid = getegid(); + + r=sys_get_quota(path, SMB_GROUP_QUOTA_TYPE, id, &D); + + /* Use softlimit to determine disk space, except when it has been exceeded */ + *bsize = D.bsize; + if (r == -1) { + if (errno == EDQUOT) { + *dfree =0; + *dsize =D.curblocks; + return (True); + } else { + return False; + } + } + + /* Use softlimit to determine disk space, except when it has been exceeded */ + if ( + (D.softlimit && D.curblocks >= D.softlimit) || + (D.hardlimit && D.curblocks >= D.hardlimit) || + (D.isoftlimit && D.curinodes >= D.isoftlimit) || + (D.ihardlimit && D.curinodes>=D.ihardlimit) + ) { + *dfree = 0; + *dsize = D.curblocks; + } else if (D.softlimit==0 && D.hardlimit==0) { + return False; + } else { + if (D.softlimit == 0) + D.softlimit = D.hardlimit; + *dfree = D.softlimit - D.curblocks; + *dsize = D.softlimit; + } + + return (True); +#else /* HAVE_GROUP_QUOTA */ + return False; +#endif /* HAVE_GROUP_QUOTA */ +} +#endif /* HAVE_SYS_QUOTAS */ diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c index b2dab2fea2..e7f01ad02f 100644 --- a/source3/smbd/reply.c +++ b/source3/smbd/reply.c @@ -39,7 +39,7 @@ unsigned int smb_echo_count = 0; extern BOOL global_encrypted_passwords_negotiated; /**************************************************************************** - Reply to an special message. + Reply to a special message. ****************************************************************************/ int reply_special(char *inbuf,char *outbuf) @@ -148,7 +148,7 @@ int reply_tcon(connection_struct *conn, const char *service; pstring service_buf; pstring password; - fstring dev; + pstring dev; int outsize = 0; uint16 vuid = SVAL(inbuf,smb_uid); int pwlen=0; @@ -204,7 +204,7 @@ int reply_tcon_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt { fstring service; DATA_BLOB password; - + /* what the cleint thinks the device is */ fstring client_devicetype; /* what the server tells the client the share represents */ @@ -283,15 +283,16 @@ int reply_tcon_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt set_message_end(outbuf,p); } else { /* NT sets the fstype of IPC$ to the null string */ - const char *fsname = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn)); + const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn)); set_message(outbuf,3,0,True); - - p = smb_buf(outbuf); + + p = smb_buf(outbuf); p += srvstr_push(outbuf, p, server_devicetype, -1, - STR_TERMINATE|STR_ASCII); - p += srvstr_push(outbuf, p, fsname, -1, - STR_TERMINATE); + STR_TERMINATE|STR_ASCII); + p += srvstr_push(outbuf, p, fstype, -1, + STR_TERMINATE); + set_message_end(outbuf,p); /* what does setting this bit do? It is set by NT4 and @@ -398,7 +399,7 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size mode = SVAL(inbuf,smb_vwv0); if (check_name(name,conn)) { - if (VALID_STAT(sbuf) || vfs_stat(conn,name,&sbuf) == 0) + if (VALID_STAT(sbuf) || SMB_VFS_STAT(conn,name,&sbuf) == 0) if (!(ok = S_ISDIR(sbuf.st_mode))) errno = ENOTDIR; } @@ -457,7 +458,7 @@ int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size } else { unix_convert(fname,conn,0,&bad_path,&sbuf); if (check_name(fname,conn)) { - if (VALID_STAT(sbuf) || vfs_stat(conn,fname,&sbuf) == 0) { + if (VALID_STAT(sbuf) || SMB_VFS_STAT(conn,fname,&sbuf) == 0) { mode = dos_mode(conn,fname,&sbuf); size = sbuf.st_size; mtime = sbuf.st_mtime; @@ -552,7 +553,7 @@ int reply_dskattr(connection_struct *conn, char *inbuf,char *outbuf, int dum_siz SMB_BIG_UINT dfree,dsize,bsize; START_PROFILE(SMBdskattr); - conn->vfs_ops.disk_free(conn,".",True,&bsize,&dfree,&dsize); + SMB_VFS_DISK_FREE(conn,".",True,&bsize,&dfree,&dsize); outsize = set_message(outbuf,5,0,True); @@ -1127,7 +1128,7 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, return(UNIXERROR(ERRDOS,ERRnoaccess)); } - vfs_stat(conn,fname,&sbuf); + SMB_VFS_STAT(conn,fname,&sbuf); /* Open file in dos compatibility share mode. */ /* We should fail if file does not exist. */ @@ -1226,7 +1227,7 @@ static NTSTATUS can_delete(char *fname,connection_struct *conn, int dirtype) if (!CAN_WRITE(conn)) return NT_STATUS_MEDIA_WRITE_PROTECTED; - if (conn->vfs_ops.lstat(conn,fname,&sbuf) != 0) + if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) return NT_STATUS_OBJECT_NAME_NOT_FOUND; fmode = dos_mode(conn,fname,&sbuf); @@ -1312,7 +1313,7 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name) error = can_delete(directory,conn,dirtype); if (!NT_STATUS_IS_OK(error)) return error; - if (vfs_unlink(conn,directory) == 0) { + if (SMB_VFS_UNLINK(conn,directory) == 0) { count++; } } else { @@ -1342,7 +1343,7 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name) slprintf(fname,sizeof(fname)-1, "%s/%s",directory,dname); error = can_delete(fname,conn,dirtype); if (!NT_STATUS_IS_OK(error)) continue; - if (vfs_unlink(conn,fname) == 0) count++; + if (SMB_VFS_UNLINK(conn,fname) == 0) count++; DEBUG(3,("unlink_internals: succesful unlink [%s]\n",fname)); } CloseDir(dirptr); @@ -1428,7 +1429,7 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st header.length = 4; header.free = NULL; - if ( conn->vfs_ops.sendfile( smbd_server_fd(), fsp, fsp->fd, &header, startpos, nread) == -1) { + if ( SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fd, &header, startpos, nread) == -1) { /* * Special hack for broken Linux with no 64 bit clean sendfile. If we * return ENOSYS then pretend we just got a normal read. @@ -1463,6 +1464,7 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_size, int dum_buffsize) { + extern struct current_user current_user; ssize_t maxcount,mincount; size_t nread = 0; SMB_OFF_T startpos; @@ -1552,7 +1554,7 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s if (size < sizeneeded) { SMB_STRUCT_STAT st; - if (vfs_fstat(fsp,fsp->fd,&st) == 0) + if (SMB_VFS_FSTAT(fsp,fsp->fd,&st) == 0) size = st.st_size; if (!fsp->can_write) fsp->size = size; @@ -1721,7 +1723,7 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length SMB_STRUCT_STAT sbuf; DATA_BLOB header; - if(vfs_fstat(fsp,fsp->fd, &sbuf) == -1) + if(SMB_VFS_FSTAT(fsp,fsp->fd, &sbuf) == -1) return(UNIXERROR(ERRDOS,ERRnoaccess)); if (startpos > sbuf.st_size) @@ -1748,7 +1750,7 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length header.length = data - outbuf; header.free = NULL; - if ( conn->vfs_ops.sendfile( smbd_server_fd(), fsp, fsp->fd, &header, startpos, smb_maxcnt) == -1) { + if ( SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fd, &header, startpos, smb_maxcnt) == -1) { /* * Special hack for broken Linux with no 64 bit clean sendfile. If we * return ENOSYS then pretend we just got a normal read. @@ -2260,7 +2262,7 @@ int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int break; } - if((res = conn->vfs_ops.lseek(fsp,fsp->fd,startpos,umode)) == -1) { + if((res = SMB_VFS_LSEEK(fsp,fsp->fd,startpos,umode)) == -1) { /* * Check for the special case where a seek before the start * of the file sets the offset to zero. Added in the CIFS spec, @@ -2272,7 +2274,7 @@ int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int if(umode == SEEK_CUR) { - if((current_pos = conn->vfs_ops.lseek(fsp,fsp->fd,0,SEEK_CUR)) == -1) { + if((current_pos = SMB_VFS_LSEEK(fsp,fsp->fd,0,SEEK_CUR)) == -1) { END_PROFILE(SMBlseek); return(UNIXERROR(ERRDOS,ERRnoaccess)); } @@ -2283,7 +2285,7 @@ int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int SMB_STRUCT_STAT sbuf; - if(vfs_fstat(fsp,fsp->fd, &sbuf) == -1) { + if(SMB_VFS_FSTAT(fsp,fsp->fd, &sbuf) == -1) { END_PROFILE(SMBlseek); return(UNIXERROR(ERRDOS,ERRnoaccess)); } @@ -2292,7 +2294,7 @@ int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int } if(current_pos < 0) - res = conn->vfs_ops.lseek(fsp,fsp->fd,0,SEEK_SET); + res = SMB_VFS_LSEEK(fsp,fsp->fd,0,SEEK_SET); } if(res == -1) { @@ -2360,6 +2362,7 @@ int reply_exit(connection_struct *conn, int reply_close(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize) { + extern struct current_user current_user; int outsize = 0; time_t mtime; int32 eclass = 0, err = 0; @@ -2380,7 +2383,7 @@ int reply_close(connection_struct *conn, char *inbuf,char *outbuf, int size, * We can only use CHECK_FSP if we know it's not a directory. */ - if(!fsp || (fsp->conn != conn)) { + if(!fsp || (fsp->conn != conn) || (fsp->vuid != current_user.vuid)) { END_PROFILE(SMBclose); return ERROR_DOS(ERRDOS,ERRbadfid); } @@ -2827,7 +2830,7 @@ NTSTATUS mkdir_internal(connection_struct *conn, pstring directory) unix_convert(directory,conn,0,&bad_path,&sbuf); if (check_name(directory, conn)) - ret = vfs_mkdir(conn,directory,unix_mode(conn,aDIR,directory)); + ret = vfs_MkDir(conn,directory,unix_mode(conn,aDIR,directory)); if (ret == -1) { NTSTATUS nterr = set_bad_path_error(errno, bad_path); @@ -2898,7 +2901,7 @@ static BOOL recursive_rmdir(connection_struct *conn, char *directory) pstrcat(fullname, "/"); pstrcat(fullname, dname); - if(conn->vfs_ops.lstat(conn,fullname, &st) != 0) { + if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) { ret = True; break; } @@ -2908,11 +2911,11 @@ static BOOL recursive_rmdir(connection_struct *conn, char *directory) ret = True; break; } - if(vfs_rmdir(conn,fullname) != 0) { + if(SMB_VFS_RMDIR(conn,fullname) != 0) { ret = True; break; } - } else if(vfs_unlink(conn,fullname) != 0) { + } else if(SMB_VFS_UNLINK(conn,fullname) != 0) { ret = True; break; } @@ -2929,7 +2932,7 @@ BOOL rmdir_internals(connection_struct *conn, char *directory) { BOOL ok; - ok = (vfs_rmdir(conn,directory) == 0); + ok = (SMB_VFS_RMDIR(conn,directory) == 0); if(!ok && ((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) { /* * Check to see if the only thing in this directory are @@ -2971,21 +2974,21 @@ BOOL rmdir_internals(connection_struct *conn, char *directory) pstrcat(fullname, "/"); pstrcat(fullname, dname); - if(conn->vfs_ops.lstat(conn,fullname, &st) != 0) + if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) break; if(st.st_mode & S_IFDIR) { if(lp_recursive_veto_delete(SNUM(conn))) { if(recursive_rmdir(conn, fullname) != 0) break; } - if(vfs_rmdir(conn,fullname) != 0) + if(SMB_VFS_RMDIR(conn,fullname) != 0) break; - } else if(vfs_unlink(conn,fullname) != 0) + } else if(SMB_VFS_UNLINK(conn,fullname) != 0) break; } CloseDir(dirptr); /* Retry the rmdir */ - ok = (vfs_rmdir(conn,directory) == 0); + ok = (SMB_VFS_RMDIR(conn,directory) == 0); } else { CloseDir(dirptr); } @@ -3104,7 +3107,7 @@ static BOOL resolve_wildcards(const char *name1, char *name2) if (ext2[0]) { snprintf(pname2, available_space - 1, "%s.%s", root2, ext2); } else { - StrnCpy(pname2, root2, available_space - 1); + pstrcpy_base(pname2, root2, name2); } return(True); @@ -3281,7 +3284,7 @@ directory = %s, newname = %s, newname_last_component = %s, is_8_3 = %d\n", return NT_STATUS_OBJECT_NAME_COLLISION; } - if(conn->vfs_ops.rename(conn,directory, newname) == 0) { + if(SMB_VFS_RENAME(conn,directory, newname) == 0) { DEBUG(3,("rename_internals: succeeded doing rename on %s -> %s\n", directory,newname)); return NT_STATUS_OK; @@ -3348,7 +3351,7 @@ directory = %s, newname = %s, newname_last_component = %s, is_8_3 = %d\n", continue; } - if (!conn->vfs_ops.rename(conn,fname,destname)) + if (!SMB_VFS_RENAME(conn,fname,destname)) count++; DEBUG(3,("rename_internals: doing rename on %s -> %s\n",fname,destname)); } @@ -3442,7 +3445,7 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun, if (!target_is_directory && count) ofun = FILE_EXISTS_OPEN; - if (vfs_stat(conn,dest,&sbuf2) == -1) + if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) ZERO_STRUCTP(&sbuf2); fsp2 = open_file_shared(conn,dest,&sbuf2,SET_DENY_MODE(DENY_NONE)|SET_OPEN_MODE(DOS_OPEN_WRONLY), @@ -3454,7 +3457,7 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun, } if ((ofun&3) == 1) { - if(conn->vfs_ops.lseek(fsp2,fsp2->fd,0,SEEK_END) == -1) { + if(SMB_VFS_LSEEK(fsp2,fsp2->fd,0,SEEK_END) == -1) { DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) )); /* * Stop the copy from occurring. @@ -3938,7 +3941,7 @@ no oplock granted on this file (%s).\n", fsp->fnum, fsp->fsp_name)); /* Setup the timeout in seconds. */ - lock_timeout = ((lock_timeout == -1) ? -1 : (lock_timeout+999)/1000); + lock_timeout = ((lock_timeout == -1) ? -1 : (lock_timeout+499)/500); /* Now do any requested locks */ data += ((large_file_format ? 20 : 10)*num_ulocks); @@ -4382,8 +4385,9 @@ int reply_getattrE(connection_struct *conn, char *inbuf,char *outbuf, int size, SIVAL(outbuf,smb_vwv6,0); SIVAL(outbuf,smb_vwv8,0); } else { + uint32 allocation_size = get_allocation_size(fsp, &sbuf); SIVAL(outbuf,smb_vwv6,(uint32)sbuf.st_size); - SIVAL(outbuf,smb_vwv8,SMB_ROUNDUP(sbuf.st_size,1024)); + SIVAL(outbuf,smb_vwv8,allocation_size); } SSVAL(outbuf,smb_vwv10, mode); diff --git a/source3/smbd/server.c b/source3/smbd/server.c index c24fc5134d..453ff54e4b 100644 --- a/source3/smbd/server.c +++ b/source3/smbd/server.c @@ -634,6 +634,12 @@ static BOOL init_structs(void ) main program. ****************************************************************************/ +/* Declare prototype for build_options() to avoid having to run it through + mkproto.h. Mixing $(builddir) and $(srcdir) source files in the current + prototype generation system is too complicated. */ + +void build_options(BOOL screen); + int main(int argc,const char *argv[]) { /* shall I run as a daemon */ @@ -836,29 +842,24 @@ static BOOL init_structs(void ) if (!init_registry()) exit(1); - if(!initialize_password_db(False)) - exit(1); + /* Initialise the password backed before the global_sam_sid + to ensure that we fetch from ldap before we make a domain sid up */ - if (!idmap_init()) + if(!initialize_password_db(False)) exit(1); - if (!idmap_init_wellknown_sids()) + if(!get_global_sam_sid()) { + DEBUG(0,("ERROR: Samba cannot create a SAM SID.\n")); exit(1); + } static_init_rpc; init_modules(); - uni_group_cache_init(); /* Non-critical */ - /* possibly reload the services file. */ reload_services(True); - if(!get_global_sam_sid()) { - DEBUG(0,("ERROR: Samba cannot create a SAM SID.\n")); - exit(1); - } - if (!init_account_policy()) { DEBUG(0,("Could not open account policy tdb.\n")); exit(1); @@ -877,10 +878,6 @@ static BOOL init_structs(void ) if (!init_change_notify()) exit(1); - /* Setup privileges database */ - if (!privilege_init()) - exit(1); - /* re-initialise the timezone */ TimeInit(); @@ -889,7 +886,6 @@ static BOOL init_structs(void ) smbd_process(); - uni_group_cache_shutdown(); namecache_shutdown(); exit_server("normal exit"); return(0); diff --git a/source3/smbd/service.c b/source3/smbd/service.c index c9f5330551..18e0887071 100644 --- a/source3/smbd/service.c +++ b/source3/smbd/service.c @@ -237,7 +237,7 @@ static NTSTATUS share_sanity_checks(int snum, fstring dev) } } - strupper(dev); + strupper_m(dev); if (lp_print_ok(snum)) { if (!strequal(dev, "LPT1:")) { @@ -359,13 +359,15 @@ static connection_struct *make_connection_snum(int snum, user_struct *vuser, guest = True; pass = getpwnam_alloc(guestname); if (!pass) { - DEBUG(0,("authorise_login: Invalid guest account %s??\n",guestname)); + DEBUG(0,("make_connection_snum: Invalid guest account %s??\n",guestname)); conn_free(conn); *status = NT_STATUS_NO_SUCH_USER; return NULL; } fstrcpy(user,pass->pw_name); conn->force_user = True; + conn->uid = pass->pw_uid; + conn->gid = pass->pw_gid; string_set(&conn->user,pass->pw_name); passwd_free(&pass); DEBUG(3,("Guest only user %s\n",user)); @@ -704,14 +706,12 @@ static connection_struct *make_connection_snum(int snum, user_struct *vuser, /* Invoke VFS make connection hook */ - if (conn->vfs_ops.connect) { - if (conn->vfs_ops.connect(conn, lp_servicename(snum), user) < 0) { - DEBUG(0,("make_connection: VFS make connection failed!\n")); - change_to_root_user(); - conn_free(conn); - *status = NT_STATUS_UNSUCCESSFUL; - return NULL; - } + if (SMB_VFS_CONNECT(conn, lp_servicename(snum), user) < 0) { + DEBUG(0,("make_connection: VFS make connection failed!\n")); + change_to_root_user(); + conn_free(conn); + *status = NT_STATUS_UNSUCCESSFUL; + return NULL; } /* we've finished with the user stuff - go back to root */ @@ -828,7 +828,7 @@ connection_struct *make_connection(const char *service_in, DATA_BLOB password, fstrcpy(service, service_in); - strlower(service); + strlower_m(service); snum = find_service(service); @@ -872,13 +872,8 @@ void close_cnum(connection_struct *conn, uint16 vuid) get_remote_machine_name(),conn->client_address, lp_servicename(SNUM(conn)))); - if (conn->vfs_ops.disconnect != NULL) { - - /* Call VFS disconnect hook */ - - conn->vfs_ops.disconnect(conn); - - } + /* Call VFS disconnect hook */ + SMB_VFS_DISCONNECT(conn); yield_connection(conn, lp_servicename(SNUM(conn))); diff --git a/source3/smbd/session.c b/source3/smbd/session.c index 07a9504234..4d8826d332 100644 --- a/source3/smbd/session.c +++ b/source3/smbd/session.c @@ -33,6 +33,8 @@ BOOL session_claim(user_struct *vuser) { int i = 0; TDB_DATA data; + struct sockaddr sa; + struct in_addr *client_ip; struct sessionid sessionid; uint32 pid = (uint32)sys_getpid(); TDB_DATA key; @@ -64,7 +66,6 @@ BOOL session_claim(user_struct *vuser) data.dptr = NULL; data.dsize = 0; -#if WITH_UTMP if (lp_utmp()) { for (i=1;isession_keystr = strdup(keystr); if (!vuser->session_keystr) { @@ -153,7 +154,8 @@ void session_yield(user_struct *vuser) { TDB_DATA dbuf; struct sessionid sessionid; - TDB_DATA key; + struct in_addr *client_ip; + TDB_DATA key; if (!tdb) return; @@ -171,14 +173,15 @@ void session_yield(user_struct *vuser) memcpy(&sessionid, dbuf.dptr, sizeof(sessionid)); + client_ip = interpret_addr2(sessionid.ip_addr); + SAFE_FREE(dbuf.dptr); -#if WITH_UTMP if (lp_utmp()) { sys_utmp_yield(sessionid.username, sessionid.hostname, + client_ip, sessionid.id_str, sessionid.id_num); } -#endif smb_pam_close_session(sessionid.username, sessionid.id_str, sessionid.hostname); diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c index 2631961739..7d77ed3071 100644 --- a/source3/smbd/sesssetup.c +++ b/source3/smbd/sesssetup.c @@ -53,10 +53,10 @@ static NTSTATUS do_map_to_guest(NTSTATUS status, auth_serversupplied_info **serv return status; } - /**************************************************************************** Add the standard 'Samba' signature to the end of the session setup. ****************************************************************************/ + static int add_signature(char *outbuf, char *p) { char *start = p; @@ -72,8 +72,9 @@ static int add_signature(char *outbuf, char *p) } /**************************************************************************** -send a security blob via a session setup reply + Send a security blob via a session setup reply. ****************************************************************************/ + static BOOL reply_sesssetup_blob(connection_struct *conn, char *outbuf, DATA_BLOB blob, NTSTATUS nt_status) { @@ -101,6 +102,7 @@ static BOOL reply_sesssetup_blob(connection_struct *conn, char *outbuf, /**************************************************************************** Do a 'guest' logon, getting back the ****************************************************************************/ + static NTSTATUS check_guest_password(auth_serversupplied_info **server_info) { struct auth_context *auth_context; @@ -267,12 +269,12 @@ static int reply_spnego_kerberos(connection_struct *conn, } #endif - /**************************************************************************** - send a session setup reply, wrapped in SPNEGO. - get vuid and check first. - end the NTLMSSP exchange context if we are OK/complete fail + Send a session setup reply, wrapped in SPNEGO. + Get vuid and check first. + End the NTLMSSP exchange context if we are OK/complete fail ***************************************************************************/ + static BOOL reply_spnego_ntlmssp(connection_struct *conn, char *outbuf, AUTH_NTLMSSP_STATE **auth_ntlmssp_state, DATA_BLOB *ntlmssp_blob, NTSTATUS nt_status) @@ -326,8 +328,9 @@ static BOOL reply_spnego_ntlmssp(connection_struct *conn, char *outbuf, } /**************************************************************************** -reply to a session setup spnego negotiate packet + Reply to a session setup spnego negotiate packet. ****************************************************************************/ + static int reply_spnego_negotiate(connection_struct *conn, char *inbuf, char *outbuf, @@ -387,11 +390,11 @@ static int reply_spnego_negotiate(connection_struct *conn, /* already replied */ return -1; } - /**************************************************************************** -reply to a session setup spnego auth packet + Reply to a session setup spnego auth packet. ****************************************************************************/ + static int reply_spnego_auth(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, DATA_BLOB blob1) @@ -425,10 +428,10 @@ static int reply_spnego_auth(connection_struct *conn, char *inbuf, char *outbuf, return -1; } - /**************************************************************************** -reply to a session setup command + Reply to a session setup command. ****************************************************************************/ + static int reply_sesssetup_and_X_spnego(connection_struct *conn, char *inbuf, char *outbuf, int length,int bufsize) @@ -509,8 +512,9 @@ static void setup_new_vc_session(void) } /**************************************************************************** -reply to a session setup command + Reply to a session setup command. ****************************************************************************/ + int reply_sesssetup_and_X(connection_struct *conn, char *inbuf,char *outbuf, int length,int bufsize) { diff --git a/source3/smbd/statcache.c b/source3/smbd/statcache.c index 44bae48990..22b8a33a1e 100644 --- a/source3/smbd/statcache.c +++ b/source3/smbd/statcache.c @@ -24,7 +24,6 @@ extern BOOL case_sensitive; - /**************************************************************************** Stat cache code used in unix_convert. *****************************************************************************/ @@ -53,123 +52,126 @@ static hash_table stat_cache; void stat_cache_add( const char *full_orig_name, const char *orig_translated_path) { - stat_cache_entry *scp; - stat_cache_entry *found_scp; - char *translated_path; - size_t translated_path_length; - - char *original_path; - size_t original_path_length; - - hash_element *hash_elem; - - if (!lp_stat_cache()) return; - - /* - * Don't cache trivial valid directory entries. - */ - if((*full_orig_name == '\0') || (strcmp(full_orig_name, ".") == 0) || - (strcmp(full_orig_name, "..") == 0)) - return; - - /* - * If we are in case insentive mode, we don't need to - * store names that need no translation - else, it - * would be a waste. - */ - - if(case_sensitive && (strcmp(full_orig_name, orig_translated_path) == 0)) - return; - - /* - * Remove any trailing '/' characters from the - * translated path. - */ - - translated_path = strdup(orig_translated_path); - if (!translated_path) - return; - - translated_path_length = strlen(translated_path); - - if(translated_path[translated_path_length-1] == '/') { - translated_path[translated_path_length-1] = '\0'; - translated_path_length--; - } - - original_path = strdup(full_orig_name); - if (!original_path) { - SAFE_FREE(translated_path); - return; - } - - original_path_length = strlen(original_path); - - if(original_path[original_path_length-1] == '/') { - original_path[original_path_length-1] = '\0'; - original_path_length--; - } - - if(!case_sensitive) - strupper(original_path); - - if (original_path_length != translated_path_length) { - if (original_path_length < translated_path_length) { - DEBUG(0, ("OOPS - tried to store stat cache entry for werid length paths [%s] %u and [%s] %u)!\n", original_path, original_path_length, translated_path, translated_path_length)); - SAFE_FREE(original_path); - SAFE_FREE(translated_path); - return; - } - - /* we only want to store the first part of original_path, - up to the length of translated_path */ - - original_path[translated_path_length] = '\0'; - original_path_length = translated_path_length; - } - - /* - * Check this name doesn't exist in the cache before we - * add it. - */ - - if ((hash_elem = hash_lookup(&stat_cache, original_path))) { - found_scp = (stat_cache_entry *)(hash_elem->value); - if (strcmp((found_scp->translated_path), orig_translated_path) == 0) { - /* already in hash table */ - SAFE_FREE(original_path); - SAFE_FREE(translated_path); - return; - } - /* hash collision - remove before we re-add */ - hash_remove(&stat_cache, hash_elem); - } + stat_cache_entry *scp; + stat_cache_entry *found_scp; + char *translated_path; + size_t translated_path_length; + + char *original_path; + size_t original_path_length; + + hash_element *hash_elem; + + if (!lp_stat_cache()) + return; + + /* + * Don't cache trivial valid directory entries. + */ + + if((*full_orig_name == '\0') || (strcmp(full_orig_name, ".") == 0) || + (strcmp(full_orig_name, "..") == 0)) + return; + + /* + * If we are in case insentive mode, we don't need to + * store names that need no translation - else, it + * would be a waste. + */ + + if(case_sensitive && (strcmp(full_orig_name, orig_translated_path) == 0)) + return; + + /* + * Remove any trailing '/' characters from the + * translated path. + */ + + translated_path = strdup(orig_translated_path); + if (!translated_path) + return; + + translated_path_length = strlen(translated_path); + + if(translated_path[translated_path_length-1] == '/') { + translated_path[translated_path_length-1] = '\0'; + translated_path_length--; + } + + original_path = strdup(full_orig_name); + if (!original_path) { + SAFE_FREE(translated_path); + return; + } + + original_path_length = strlen(original_path); + + if(original_path[original_path_length-1] == '/') { + original_path[original_path_length-1] = '\0'; + original_path_length--; + } + + if(!case_sensitive) + strupper_m(original_path); + + if (original_path_length != translated_path_length) { + if (original_path_length < translated_path_length) { + DEBUG(0, ("OOPS - tried to store stat cache entry for werid length paths [%s] %u and [%s] %u)!\n", + original_path, original_path_length, translated_path, translated_path_length)); + SAFE_FREE(original_path); + SAFE_FREE(translated_path); + return; + } + + /* we only want to store the first part of original_path, + up to the length of translated_path */ + + original_path[translated_path_length] = '\0'; + original_path_length = translated_path_length; + } + + /* + * Check this name doesn't exist in the cache before we + * add it. + */ + + if ((hash_elem = hash_lookup(&stat_cache, original_path))) { + found_scp = (stat_cache_entry *)(hash_elem->value); + if (strcmp((found_scp->translated_path), orig_translated_path) == 0) { + /* already in hash table */ + SAFE_FREE(original_path); + SAFE_FREE(translated_path); + return; + } + /* hash collision - remove before we re-add */ + hash_remove(&stat_cache, hash_elem); + } - /* - * New entry. - */ + /* + * New entry. + */ - if((scp = (stat_cache_entry *)malloc(sizeof(stat_cache_entry) - +original_path_length - +translated_path_length)) == NULL) { - DEBUG(0,("stat_cache_add: Out of memory !\n")); - SAFE_FREE(original_path); - SAFE_FREE(translated_path); - return; - } - - scp->original_path = scp->names; - scp->translated_path = scp->names + original_path_length + 1; - safe_strcpy(scp->original_path, original_path, original_path_length); - safe_strcpy(scp->translated_path, translated_path, translated_path_length); - scp->translated_path_length = translated_path_length; - - hash_insert(&stat_cache, (char *)scp, original_path); - - SAFE_FREE(original_path); - SAFE_FREE(translated_path); - - DEBUG(5,("stat_cache_add: Added entry %s -> %s\n", scp->original_path, scp->translated_path)); + if((scp = (stat_cache_entry *)malloc(sizeof(stat_cache_entry) + +original_path_length + +translated_path_length)) == NULL) { + DEBUG(0,("stat_cache_add: Out of memory !\n")); + SAFE_FREE(original_path); + SAFE_FREE(translated_path); + return; + } + + scp->original_path = scp->names; + scp->translated_path = scp->names + original_path_length + 1; + safe_strcpy(scp->original_path, original_path, original_path_length); + safe_strcpy(scp->translated_path, translated_path, translated_path_length); + scp->translated_path_length = translated_path_length; + + hash_insert(&stat_cache, (char *)scp, original_path); + + SAFE_FREE(original_path); + SAFE_FREE(translated_path); + + DEBUG(5,("stat_cache_add: Added entry %s -> %s\n", scp->original_path, scp->translated_path)); } /** @@ -191,73 +193,106 @@ void stat_cache_add( const char *full_orig_name, const char *orig_translated_pat BOOL stat_cache_lookup(connection_struct *conn, pstring name, pstring dirpath, char **start, SMB_STRUCT_STAT *pst) { - stat_cache_entry *scp; - pstring chk_name; - size_t namelen; - hash_element *hash_elem; - char *sp; - - if (!lp_stat_cache()) - return False; + stat_cache_entry *scp; + pstring chk_name; + size_t namelen; + hash_element *hash_elem; + char *sp; + BOOL sizechanged = False; + unsigned int num_components = 0; + + if (!lp_stat_cache()) + return False; - namelen = strlen(name); - - *start = name; - - DO_PROFILE_INC(statcache_lookups); - - /* - * Don't lookup trivial valid directory entries. - */ - if((*name == '\0') || (strcmp(name, ".") == 0) || (strcmp(name, "..") == 0)) { - DO_PROFILE_INC(statcache_misses); - return False; - } - - pstrcpy(chk_name, name); - if(!case_sensitive) - strupper( chk_name ); - - while (1) { - hash_elem = hash_lookup(&stat_cache, chk_name); - if(hash_elem == NULL) { - /* - * Didn't find it - remove last component for next try. - */ - sp = strrchr_m(chk_name, '/'); - if (sp) { - *sp = '\0'; - } else { - /* - * We reached the end of the name - no match. - */ - DO_PROFILE_INC(statcache_misses); - return False; - } - if((*chk_name == '\0') || (strcmp(chk_name, ".") == 0) - || (strcmp(chk_name, "..") == 0)) { - DO_PROFILE_INC(statcache_misses); - return False; - } - } else { - scp = (stat_cache_entry *)(hash_elem->value); - DO_PROFILE_INC(statcache_hits); - if(vfs_stat(conn,scp->translated_path, pst) != 0) { - /* Discard this entry - it doesn't exist in the filesystem. */ - hash_remove(&stat_cache, hash_elem); - return False; - } - memcpy(name, scp->translated_path, MIN(sizeof(pstring)-1, scp->translated_path_length)); - - /* set pointer for 'where to start' on fixing the rest of the name */ - *start = &name[scp->translated_path_length]; - if(**start == '/') - ++*start; - - pstrcpy(dirpath, scp->translated_path); - return (namelen == scp->translated_path_length); - } - } + namelen = strlen(name); + + *start = name; + + DO_PROFILE_INC(statcache_lookups); + + /* + * Don't lookup trivial valid directory entries. + */ + if((*name == '\0') || (strcmp(name, ".") == 0) || (strcmp(name, "..") == 0)) { + DO_PROFILE_INC(statcache_misses); + return False; + } + + pstrcpy(chk_name, name); + + if(!case_sensitive) { + strupper_m( chk_name ); + /* + * In some language encodings the length changes + * if we uppercase. We need to treat this differently + * below. + */ + if (strlen(chk_name) != namelen) + sizechanged = True; + } + + while (1) { + hash_elem = hash_lookup(&stat_cache, chk_name); + if(hash_elem == NULL) { + /* + * Didn't find it - remove last component for next try. + */ + sp = strrchr_m(chk_name, '/'); + if (sp) { + *sp = '\0'; + /* + * Count the number of times we have done this, + * we'll need it when reconstructing the string. + */ + if (sizechanged) + num_components++; + + } else { + /* + * We reached the end of the name - no match. + */ + DO_PROFILE_INC(statcache_misses); + return False; + } + if((*chk_name == '\0') || (strcmp(chk_name, ".") == 0) + || (strcmp(chk_name, "..") == 0)) { + DO_PROFILE_INC(statcache_misses); + return False; + } + } else { + scp = (stat_cache_entry *)(hash_elem->value); + DO_PROFILE_INC(statcache_hits); + if(SMB_VFS_STAT(conn,scp->translated_path, pst) != 0) { + /* Discard this entry - it doesn't exist in the filesystem. */ + hash_remove(&stat_cache, hash_elem); + return False; + } + + if (!sizechanged) { + memcpy(name, scp->translated_path, MIN(sizeof(pstring)-1, scp->translated_path_length)); + } else if (num_components == 0) { + pstrcpy(name, scp->translated_path); + } else { + sp = strnrchr_m(name, '/', num_components); + if (sp) { + pstring last_component; + pstrcpy(last_component, sp); + pstrcpy(name, scp->translated_path); + pstrcat(name, last_component); + } else { + pstrcpy(name, scp->translated_path); + } + } + + /* set pointer for 'where to start' on fixing the rest of the name */ + *start = &name[scp->translated_path_length]; + if(**start == '/') + ++*start; + + pstrcpy(dirpath, scp->translated_path); + return (namelen == scp->translated_path_length); + } + } } /*************************************************************************** ** @@ -271,7 +306,8 @@ BOOL stat_cache_lookup(connection_struct *conn, pstring name, pstring dirpath, BOOL reset_stat_cache( void ) { static BOOL initialised; - if (!lp_stat_cache()) return True; + if (!lp_stat_cache()) + return True; if (initialised) { hash_clear(&stat_cache); @@ -280,4 +316,4 @@ BOOL reset_stat_cache( void ) initialised = hash_table_init( &stat_cache, INIT_STAT_CACHE_SIZE, (compare_function)(strcmp)); return initialised; -} /* reset_stat_cache */ +} diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c index de598d6713..bdcd04443e 100644 --- a/source3/smbd/trans2.c +++ b/source3/smbd/trans2.c @@ -1,7 +1,8 @@ /* Unix SMB/CIFS implementation. SMB transaction2 handling - Copyright (C) Jeremy Allison 1994-2001 + Copyright (C) Jeremy Allison 1994-2001 + Copyright (C) Stefan (metze) Metzmacher 2003 Extensively modified by Andrew Tridgell, 1995 @@ -28,6 +29,7 @@ extern int smb_read_error; extern fstring local_machine; extern int global_oplock_break; extern uint32 global_client_caps; +extern struct current_user current_user; #define get_file_size(sbuf) ((sbuf).st_size) @@ -324,7 +326,7 @@ static BOOL exact_match(char *str,char *mask, BOOL case_sig) return False; if (case_sig) return strcmp(str,mask)==0; - return strcasecmp(str,mask) == 0; + return StrCaseCmp(str,mask) == 0; } /**************************************************************************** @@ -549,12 +551,12 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn, pstrcat(pathreal,dname); if (INFO_LEVEL_IS_UNIX(info_level)) { - if (vfs_lstat(conn,pathreal,&sbuf) != 0) { + if (SMB_VFS_LSTAT(conn,pathreal,&sbuf) != 0) { DEBUG(5,("get_lanman2_dir_entry:Couldn't lstat [%s] (%s)\n", pathreal,strerror(errno))); continue; } - } else if (vfs_stat(conn,pathreal,&sbuf) != 0) { + } else if (SMB_VFS_STAT(conn,pathreal,&sbuf) != 0) { /* Needed to show the msdfs symlinks as * directories */ @@ -647,8 +649,7 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn, SIVAL(p,l2_cbList,0); /* No extended attributes */ p += l2_achName; nameptr = p; - p += align_string(outbuf, p, 0); - len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE); + len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE | STR_NOALIGN); if (SVAL(outbuf, smb_flg2) & FLAGS2_UNICODE_STRINGS) SCVAL(nameptr, -1, len-2); else @@ -680,14 +681,14 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn, pstrcpy(mangled_name, fname); mangle_map(mangled_name,True,True,SNUM(conn)); mangled_name[12] = 0; - len = srvstr_push(outbuf, p+2, mangled_name, 24, STR_UPPER); + len = srvstr_push(outbuf, p+2, mangled_name, 24, STR_UPPER|STR_UNICODE); SSVAL(p, 0, len); } else { SSVAL(p,0,0); *(p+2) = 0; } p += 2 + 24; - len = srvstr_push(outbuf, p, fname, -1, 0); + len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII); SIVAL(q,0,len); p += len; len = PTR_DIFF(p, pdata); @@ -708,7 +709,7 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn, p += 16; SIVAL(p,0,nt_extmode); p += 4; p += 4; - len = srvstr_push(outbuf, p, fname, -1, 0); + len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII); SIVAL(p, -4, len); p += len; len = PTR_DIFF(p, pdata); @@ -727,13 +728,13 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn, SOFF_T(p,0,file_size); SOFF_T(p,8,allocation_size); p += 16; - SIVAL(p,0,nt_extmode); p += 4; + SIVAL(p,0,nt_extmode); p += 4; - SIVAL(p,0,0); p += 4; - len = srvstr_push(outbuf, p, fname, -1, 0); - SIVAL(p, -4, len); - p += len; + SIVAL(p,4,0); /* ea size */ + len = srvstr_push(outbuf, p+8, fname, -1, STR_TERMINATE_ASCII); + SIVAL(p, 0, len); + p += 8 + len; len = PTR_DIFF(p, pdata); len = (len + 3) & ~3; @@ -747,7 +748,7 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn, p += 4; /* this must *not* be null terminated or w2k gets in a loop trying to set an acl on a dir (tridge) */ - len = srvstr_push(outbuf, p, fname, -1, 0); + len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII); SIVAL(p, -4, len); p += len; len = PTR_DIFF(p, pdata); @@ -1318,10 +1319,11 @@ static int call_trans2qfsinfo(connection_struct *conn, char *inbuf, char *outbuf char *vname = volume_label(SNUM(conn)); int snum = SNUM(conn); char *fstype = lp_fstype(SNUM(conn)); + int quota_flag = 0; DEBUG(3,("call_trans2qfsinfo: level = %d\n", info_level)); - if(vfs_stat(conn,".",&st)!=0) { + if(SMB_VFS_STAT(conn,".",&st)!=0) { DEBUG(2,("call_trans2qfsinfo: stat of . failed (%s)\n", strerror(errno))); return ERROR_DOS(ERRSRV,ERRinvdevice); } @@ -1338,7 +1340,7 @@ static int call_trans2qfsinfo(connection_struct *conn, char *inbuf, char *outbuf { SMB_BIG_UINT dfree,dsize,bsize; data_len = 18; - conn->vfs_ops.disk_free(conn,".",False,&bsize,&dfree,&dsize); + SMB_VFS_DISK_FREE(conn,".",False,&bsize,&dfree,&dsize); SIVAL(pdata,l1_idFileSystem,st.st_dev); SIVAL(pdata,l1_cSectorUnit,bsize/512); SIVAL(pdata,l1_cUnit,dsize); @@ -1357,7 +1359,7 @@ static int call_trans2qfsinfo(connection_struct *conn, char *inbuf, char *outbuf * the called hostname and the service name. */ SIVAL(pdata,0,str_checksum(lp_servicename(snum)) ^ (str_checksum(local_machine)<<16) ); - len = srvstr_push(outbuf, pdata+l2_vol_szVolLabel, vname, -1, STR_TERMINATE); + len = srvstr_push(outbuf, pdata+l2_vol_szVolLabel, vname, -1, 0); SCVAL(pdata,l2_vol_cch,len); data_len = l2_vol_szVolLabel + len; DEBUG(5,("call_trans2qfsinfo : time = %x, namelen = %d, name = %s\n", @@ -1367,19 +1369,26 @@ static int call_trans2qfsinfo(connection_struct *conn, char *inbuf, char *outbuf case SMB_QUERY_FS_ATTRIBUTE_INFO: case SMB_FS_ATTRIBUTE_INFORMATION: + +#if defined(HAVE_SYS_QUOTAS) + quota_flag = FILE_VOLUME_QUOTAS; +#endif + SIVAL(pdata,0,FILE_CASE_PRESERVED_NAMES|FILE_CASE_SENSITIVE_SEARCH| - (lp_nt_acl_support(SNUM(conn)) ? FILE_PERSISTENT_ACLS : 0)); /* FS ATTRIBUTES */ + (lp_nt_acl_support(SNUM(conn)) ? FILE_PERSISTENT_ACLS : 0)| + quota_flag); /* FS ATTRIBUTES */ + SIVAL(pdata,4,255); /* Max filename component length */ /* NOTE! the fstype must *not* be null terminated or win98 won't recognise it and will think we can't do long filenames */ - len = srvstr_push(outbuf, pdata+12, fstype, -1, 0); + len = srvstr_push(outbuf, pdata+12, fstype, -1, STR_UNICODE); SIVAL(pdata,8,len); data_len = 12 + len; break; case SMB_QUERY_FS_LABEL_INFO: case SMB_FS_LABEL_INFORMATION: - len = srvstr_push(outbuf, pdata+4, vname, -1, STR_TERMINATE); + len = srvstr_push(outbuf, pdata+4, vname, -1, 0); data_len = 4 + len; SIVAL(pdata,0,len); break; @@ -1394,7 +1403,7 @@ static int call_trans2qfsinfo(connection_struct *conn, char *inbuf, char *outbuf SIVAL(pdata,8,str_checksum(lp_servicename(snum)) ^ (str_checksum(local_machine)<<16)); - len = srvstr_push(outbuf, pdata+18, vname, -1, STR_TERMINATE); + len = srvstr_push(outbuf, pdata+18, vname, -1, STR_UNICODE); SIVAL(pdata,12,len); data_len = 18+len; DEBUG(5,("call_trans2qfsinfo : SMB_QUERY_FS_VOLUME_INFO namelen = %d, vol=%s serv=%s\n", @@ -1406,7 +1415,7 @@ static int call_trans2qfsinfo(connection_struct *conn, char *inbuf, char *outbuf { SMB_BIG_UINT dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector; data_len = 24; - conn->vfs_ops.disk_free(conn,".",False,&bsize,&dfree,&dsize); + SMB_VFS_DISK_FREE(conn,".",False,&bsize,&dfree,&dsize); block_size = lp_block_size(snum); if (bsize < block_size) { SMB_BIG_UINT factor = block_size/bsize; @@ -1436,7 +1445,7 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned { SMB_BIG_UINT dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector; data_len = 32; - conn->vfs_ops.disk_free(conn,".",False,&bsize,&dfree,&dsize); + SMB_VFS_DISK_FREE(conn,".",False,&bsize,&dfree,&dsize); block_size = lp_block_size(snum); if (bsize < block_size) { SMB_BIG_UINT factor = block_size/bsize; @@ -1470,6 +1479,78 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned SIVAL(pdata,4,0); /* characteristics */ break; +#ifdef HAVE_SYS_QUOTAS + case SMB_FS_QUOTA_INFORMATION: + /* + * what we have to send --metze: + * + * Unknown1: 24 NULL bytes + * Soft Quota Treshold: 8 bytes seems like SMB_BIG_UINT or so + * Hard Quota Limit: 8 bytes seems like SMB_BIG_UINT or so + * Quota Flags: 2 byte : + * Unknown3: 6 NULL bytes + * + * 48 bytes total + * + * details for Quota Flags: + * + * 0x0020 Log Limit: log if the user exceeds his Hard Quota + * 0x0010 Log Warn: log if the user exceeds his Soft Quota + * 0x0002 Deny Disk: deny disk access when the user exceeds his Hard Quota + * 0x0001 Enable Quotas: enable quota for this fs + * + */ + { + /* we need to fake up a fsp here, + * because its not send in this call + */ + files_struct fsp; + SMB_NTQUOTA_STRUCT quotas; + + ZERO_STRUCT(fsp); + ZERO_STRUCT(quotas); + + fsp.conn = conn; + fsp.fnum = -1; + fsp.fd = -1; + + /* access check */ + if (conn->admin_user != True) { + DEBUG(0,("set_user_quota: access_denied service [%s] user [%s]\n", + lp_servicename(SNUM(conn)),conn->user)); + return ERROR_DOS(ERRDOS,ERRnoaccess); + } + + if (vfs_get_ntquota(&fsp, SMB_USER_FS_QUOTA_TYPE, NULL, "as)!=0) { + DEBUG(0,("vfs_get_ntquota() failed for service [%s]\n",lp_servicename(SNUM(conn)))); + return ERROR_DOS(ERRSRV,ERRerror); + } + + data_len = 48; + + DEBUG(10,("SMB_FS_QUOTA_INFORMATION: for service [%s]\n",lp_servicename(SNUM(conn)))); + + /* Unknown1 24 NULL bytes*/ + SBIG_UINT(pdata,0,(SMB_BIG_UINT)0); + SBIG_UINT(pdata,8,(SMB_BIG_UINT)0); + SBIG_UINT(pdata,16,(SMB_BIG_UINT)0); + + /* Default Soft Quota 8 bytes */ + SBIG_UINT(pdata,24,quotas.softlim); + + /* Default Hard Quota 8 bytes */ + SBIG_UINT(pdata,32,quotas.hardlim); + + /* Quota flag 2 bytes */ + SSVAL(pdata,40,quotas.qflags); + + /* Unknown3 6 NULL bytes */ + SSVAL(pdata,42,0); + SIVAL(pdata,44,0); + + break; + } +#endif /* HAVE_SYS_QUOTAS */ case SMB_FS_OBJECTID_INFORMATION: data_len = 64; break; @@ -1511,6 +1592,7 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned return -1; } +#ifdef HAVE_SYS_QUOTAS /**************************************************************************** Reply to a TRANS2_SETFSINFO (set filesystem info). ****************************************************************************/ @@ -1519,18 +1601,110 @@ static int call_trans2setfsinfo(connection_struct *conn, char *inbuf, char *outbuf, int length, int bufsize, char **pparams, int total_params, char **ppdata, int total_data) { - /* Just say yes we did it - there is nothing that - can be set here so it doesn't matter. */ + char *pdata = *ppdata; + char *params = *pparams; + files_struct *fsp = NULL; + uint16 info_level; int outsize; - DEBUG(3,("call_trans2setfsinfo\n")); + SMB_NTQUOTA_STRUCT quotas; + + ZERO_STRUCT(quotas); - if (!CAN_WRITE(conn)) + DEBUG(10,("call_trans2setfsinfo: SET_FS_QUOTA: for service [%s]\n",lp_servicename(SNUM(conn)))); + + /* access check */ + if ((conn->admin_user != True)||!CAN_WRITE(conn)) { + DEBUG(0,("set_user_quota: access_denied service [%s] user [%s]\n", + lp_servicename(SNUM(conn)),conn->user)); return ERROR_DOS(ERRSRV,ERRaccess); + } + + /* */ + if (total_params < 4) { + DEBUG(0,("call_trans2setfsinfo: requires total_params(%d) >= 4 bytes!\n", + total_params)); + return ERROR_DOS(ERRDOS,ERRinvalidparam); + } + + fsp = file_fsp(params,0); + + if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) { + DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n")); + return ERROR_NT(NT_STATUS_INVALID_HANDLE); + } + info_level = SVAL(params,2); + + switch(info_level) { + case SMB_FS_QUOTA_INFORMATION: + /* note: normaly there're 48 bytes, + * but we didn't use the last 6 bytes for now + * --metze + */ + if (total_data < 42) { + DEBUG(0,("call_trans2setfsinfo: SET_FS_QUOTA: requires total_data(%d) >= 42 bytes!\n", + total_data)); + return ERROR_DOS(ERRDOS,ERRunknownlevel); + } + + /* unknown_1 24 NULL bytes in pdata*/ + + /* the soft quotas 8 bytes (SMB_BIG_UINT)*/ + quotas.softlim = (SMB_BIG_UINT)IVAL(pdata,24); +#ifdef LARGE_SMB_OFF_T + quotas.softlim |= (((SMB_BIG_UINT)IVAL(pdata,28)) << 32); +#else /* LARGE_SMB_OFF_T */ + if ((IVAL(pdata,28) != 0)&& + ((quotas.softlim != 0xFFFFFFFF)|| + (IVAL(pdata,28)!=0xFFFFFFFF))) { + /* more than 32 bits? */ + return ERROR_DOS(ERRDOS,ERRunknownlevel); + } +#endif /* LARGE_SMB_OFF_T */ + + /* the hard quotas 8 bytes (SMB_BIG_UINT)*/ + quotas.hardlim = (SMB_BIG_UINT)IVAL(pdata,32); +#ifdef LARGE_SMB_OFF_T + quotas.hardlim |= (((SMB_BIG_UINT)IVAL(pdata,36)) << 32); +#else /* LARGE_SMB_OFF_T */ + if ((IVAL(pdata,36) != 0)&& + ((quotas.hardlim != 0xFFFFFFFF)|| + (IVAL(pdata,36)!=0xFFFFFFFF))) { + /* more than 32 bits? */ + return ERROR_DOS(ERRDOS,ERRunknownlevel); + } +#endif /* LARGE_SMB_OFF_T */ + + /* quota_flags 2 bytes **/ + quotas.qflags = SVAL(pdata,40); + + /* unknown_2 6 NULL bytes follow*/ + + /* now set the quotas */ + if (vfs_set_ntquota(fsp, SMB_USER_FS_QUOTA_TYPE, NULL, "as)!=0) { + DEBUG(0,("vfs_set_ntquota() failed for service [%s]\n",lp_servicename(SNUM(conn)))); + return ERROR_DOS(ERRSRV,ERRerror); + } + + break; + default: + DEBUG(3,("call_trans2setfsinfo: unknown level (0x%X) not implemented yet.\n", + info_level)); + return ERROR_DOS(ERRDOS,ERRunknownlevel); + break; + } + + /* + * sending this reply works fine, + * but I'm not sure it's the same + * like windows do... + * --metze + */ outsize = set_message(outbuf,10,0,True); return outsize; } +#endif /* HAVE_SYS_QUOTAS */ /**************************************************************************** * Utility function to set bad path error. @@ -1589,7 +1763,20 @@ static int call_trans2qfilepathinfo(connection_struct *conn, DEBUG(3,("call_trans2qfilepathinfo: TRANSACT2_QFILEINFO: level = %d\n", info_level)); - if(fsp && (fsp->is_directory || fsp->fd == -1)) { + if(fsp && (fsp->fake_file_handle)) { + /* + * This is actually for the QUOTA_FAKE_FILE --metze + */ + + pstrcpy(fname, fsp->fsp_name); + unix_convert(fname,conn,0,&bad_path,&sbuf); + if (!check_name(fname,conn)) { + DEBUG(3,("call_trans2qfilepathinfo: fileinfo of %s failed for fake_file(%s)\n",fname,strerror(errno))); + set_bad_path_error(errno, bad_path); + return(UNIXERROR(ERRDOS,ERRbadpath)); + } + + } else if(fsp && (fsp->is_directory || fsp->fd == -1)) { /* * This is actually a QFILEINFO on a directory * handle (returned from an NT SMB). NT5.0 seems @@ -1605,13 +1792,13 @@ static int call_trans2qfilepathinfo(connection_struct *conn, if (INFO_LEVEL_IS_UNIX(info_level)) { /* Always do lstat for UNIX calls. */ - if (vfs_lstat(conn,fname,&sbuf)) { - DEBUG(3,("call_trans2qfilepathinfo: vfs_lstat of %s failed (%s)\n",fname,strerror(errno))); + if (SMB_VFS_LSTAT(conn,fname,&sbuf)) { + DEBUG(3,("call_trans2qfilepathinfo: SMB_VFS_LSTAT of %s failed (%s)\n",fname,strerror(errno))); set_bad_path_error(errno, bad_path); return(UNIXERROR(ERRDOS,ERRbadpath)); } - } else if (!VALID_STAT(sbuf) && vfs_stat(conn,fname,&sbuf)) { - DEBUG(3,("call_trans2qfilepathinfo: vfs_stat of %s failed (%s)\n",fname,strerror(errno))); + } else if (!VALID_STAT(sbuf) && SMB_VFS_STAT(conn,fname,&sbuf)) { + DEBUG(3,("call_trans2qfilepathinfo: SMB_VFS_STAT of %s failed (%s)\n",fname,strerror(errno))); set_bad_path_error(errno, bad_path); return(UNIXERROR(ERRDOS,ERRbadpath)); } @@ -1624,11 +1811,11 @@ static int call_trans2qfilepathinfo(connection_struct *conn, CHECK_FSP(fsp,conn); pstrcpy(fname, fsp->fsp_name); - if (vfs_fstat(fsp,fsp->fd,&sbuf) != 0) { + if (SMB_VFS_FSTAT(fsp,fsp->fd,&sbuf) != 0) { DEBUG(3,("fstat of fnum %d failed (%s)\n", fsp->fnum, strerror(errno))); return(UNIXERROR(ERRDOS,ERRbadfid)); } - if((pos = fsp->conn->vfs_ops.lseek(fsp,fsp->fd,0,SEEK_CUR)) == -1) + if((pos = SMB_VFS_LSEEK(fsp,fsp->fd,0,SEEK_CUR)) == -1) return(UNIXERROR(ERRDOS,ERRnoaccess)); delete_pending = fsp->delete_on_close; @@ -1655,13 +1842,13 @@ static int call_trans2qfilepathinfo(connection_struct *conn, if (INFO_LEVEL_IS_UNIX(info_level)) { /* Always do lstat for UNIX calls. */ - if (vfs_lstat(conn,fname,&sbuf)) { - DEBUG(3,("call_trans2qfilepathinfo: vfs_lstat of %s failed (%s)\n",fname,strerror(errno))); + if (SMB_VFS_LSTAT(conn,fname,&sbuf)) { + DEBUG(3,("call_trans2qfilepathinfo: SMB_VFS_LSTAT of %s failed (%s)\n",fname,strerror(errno))); set_bad_path_error(errno, bad_path); return(UNIXERROR(ERRDOS,ERRbadpath)); } - } else if (!VALID_STAT(sbuf) && vfs_stat(conn,fname,&sbuf)) { - DEBUG(3,("call_trans2qfilepathinfo: vfs_stat of %s failed (%s)\n",fname,strerror(errno))); + } else if (!VALID_STAT(sbuf) && SMB_VFS_STAT(conn,fname,&sbuf)) { + DEBUG(3,("call_trans2qfilepathinfo: SMB_VFS_STAT of %s failed (%s)\n",fname,strerror(errno))); set_bad_path_error(errno, bad_path); return(UNIXERROR(ERRDOS,ERRbadpath)); } @@ -1733,9 +1920,17 @@ static int call_trans2qfilepathinfo(connection_struct *conn, SIVAL(pdata,l1_cbFile,(uint32)file_size); SIVAL(pdata,l1_cbFileAlloc,(uint32)allocation_size); SSVAL(pdata,l1_attrFile,mode); - SIVAL(pdata,l1_attrFile+2,4); /* this is what OS2 does */ + SIVAL(pdata,l1_attrFile+2,0); /* this is what win2003 does */ break; + case SMB_INFO_IS_NAME_VALID: + if (tran_call == TRANSACT2_QFILEINFO) { + /* os/2 needs this ? really ?*/ + return ERROR_DOS(ERRDOS,ERRbadfunc); + } + data_size = 0; + break; + case SMB_INFO_QUERY_EAS_FROM_LIST: data_size = 24; put_dos_date2(pdata,0,c_time); @@ -1748,12 +1943,9 @@ static int call_trans2qfilepathinfo(connection_struct *conn, case SMB_INFO_QUERY_ALL_EAS: data_size = 4; - SIVAL(pdata,0,data_size); + SIVAL(pdata,0,0); /* ea size */ break; - case 6: - return ERROR_DOS(ERRDOS,ERRbadfunc); /* os/2 needs this */ - case SMB_FILE_BASIC_INFORMATION: case SMB_QUERY_FILE_BASIC_INFO: @@ -1836,6 +2028,7 @@ static int call_trans2qfilepathinfo(connection_struct *conn, break; case SMB_QUERY_FILE_ALL_INFO: + case SMB_FILE_ALL_INFORMATION: put_long_date(pdata,c_time); put_long_date(pdata+8,sbuf.st_atime); put_long_date(pdata+16,sbuf.st_mtime); /* write time */ @@ -1848,20 +2041,8 @@ static int call_trans2qfilepathinfo(connection_struct *conn, SCVAL(pdata,20,delete_pending); SCVAL(pdata,21,(mode&aDIR)?1:0); pdata += 24; - SINO_T(pdata,0,(SMB_INO_T)sbuf.st_ino); - pdata += 8; /* index number */ pdata += 4; /* EA info */ - if (mode & aRONLY) - SIVAL(pdata,0,0xA9); - else - SIVAL(pdata,0,0xd01BF); - pdata += 4; - SOFF_T(pdata,0,pos); /* current offset */ - pdata += 8; - SIVAL(pdata,0,mode); /* is this the right sort of mode info? */ - pdata += 4; - pdata += 4; /* alignment */ - len = srvstr_push(outbuf, pdata+4, dos_fname, -1, STR_TERMINATE); + len = srvstr_push(outbuf, pdata+4, dos_fname, -1, STR_UNICODE); SIVAL(pdata,0,len); pdata += 4 + len; data_size = PTR_DIFF(pdata,(*ppdata)); @@ -1914,28 +2095,6 @@ static int call_trans2qfilepathinfo(connection_struct *conn, data_size = 4; break; -#if 0 - /* Not yet finished... JRA */ - case 1018: - { - put_long_date(pdata,c_time); - put_long_date(pdata+8,sbuf.st_atime); - put_long_date(pdata+16,sbuf.st_mtime); /* write time */ - put_long_date(pdata+24,sbuf.st_mtime); /* change time */ - SIVAL(pdata,32,mode); - SIVAL(pdata,36,0); /* ??? */ - SIVAL(pdata,40,0x20); /* ??? */ - SIVAL(pdata,44,0); /* ??? */ - SOFF_T(pdata,48,size); - SIVAL(pdata,56,0x1); /* ??? */ - SIVAL(pdata,60,0); /* ??? */ - SIVAL(pdata,64,0); /* ??? */ - SIVAL(pdata,68,length); /* Following string length in bytes. */ - dos_PutUniCode(pdata+72,,False); - break; - } -#endif - #if 0 /* * NT4 server just returns "invalid query" to this - if we try to answer @@ -1958,8 +2117,9 @@ static int call_trans2qfilepathinfo(connection_struct *conn, } break; + case SMB_QUERY_COMPRESSION_INFO: case SMB_FILE_COMPRESSION_INFORMATION: - SOFF_T(pdata,0,allocation_size); + SOFF_T(pdata,0,file_size); SIVAL(pdata,8,0); /* ??? */ SIVAL(pdata,12,0); /* ??? */ data_size = 16; @@ -2054,7 +2214,7 @@ static int call_trans2qfilepathinfo(connection_struct *conn, #else return(UNIXERROR(ERRDOS,ERRbadlink)); #endif - len = conn->vfs_ops.readlink(conn,fullpathname, buffer, sizeof(pstring)-1); /* read link */ + len = SMB_VFS_READLINK(conn,fullpathname, buffer, sizeof(pstring)-1); /* read link */ if (len == -1) return(UNIXERROR(ERRDOS,ERRnoaccess)); buffer[len] = 0; @@ -2178,7 +2338,7 @@ static int ensure_link_is_safe(connection_struct *conn, const char *link_dest_in pstrcpy(link_dest, "./"); } - if (conn->vfs_ops.realpath(conn,link_dest,resolved_name) == NULL) + if (SMB_VFS_REALPATH(conn,link_dest,resolved_name) == NULL) return -1; pstrcpy(link_dest, resolved_name); @@ -2229,7 +2389,13 @@ static int call_trans2setfilepathinfo(connection_struct *conn, gid_t set_grp = (uid_t)SMB_GID_NO_CHANGE; mode_t unixmode = 0; + if (!params) + return ERROR_NT(NT_STATUS_INVALID_PARAMETER); + if (tran_call == TRANSACT2_SETFILEINFO) { + if (total_params < 4) + return(ERROR_DOS(ERRDOS,ERRinvalidparam)); + fsp = file_fsp(params,0); info_level = SVAL(params,2); @@ -2269,7 +2435,7 @@ static int call_trans2setfilepathinfo(connection_struct *conn, pstrcpy(fname, fsp->fsp_name); fd = fsp->fd; - if (vfs_fstat(fsp,fd,&sbuf) != 0) { + if (SMB_VFS_FSTAT(fsp,fd,&sbuf) != 0) { DEBUG(3,("call_trans2setfilepathinfo: fstat of fnum %d failed (%s)\n",fsp->fnum, strerror(errno))); return(UNIXERROR(ERRDOS,ERRbadfid)); } @@ -2461,7 +2627,7 @@ static int call_trans2setfilepathinfo(connection_struct *conn, if (new_fsp == NULL) return(UNIXERROR(ERRDOS,ERRbadpath)); ret = vfs_allocate_file_space(new_fsp, allocation_size); - if (vfs_fstat(new_fsp,new_fsp->fd,&new_sbuf) != 0) { + if (SMB_VFS_FSTAT(new_fsp,new_fsp->fd,&new_sbuf) != 0) { DEBUG(3,("call_trans2setfilepathinfo: fstat of fnum %d failed (%s)\n", new_fsp->fnum, strerror(errno))); ret = -1; @@ -2469,7 +2635,7 @@ static int call_trans2setfilepathinfo(connection_struct *conn, close_file(new_fsp,True); } else { ret = vfs_allocate_file_space(fsp, allocation_size); - if (vfs_fstat(fsp,fd,&new_sbuf) != 0) { + if (SMB_VFS_FSTAT(fsp,fd,&new_sbuf) != 0) { DEBUG(3,("call_trans2setfilepathinfo: fstat of fnum %d failed (%s)\n", fsp->fnum, strerror(errno))); ret = -1; @@ -2609,7 +2775,7 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n", 0%o for file %s\n", (double)dev, unixmode, fname )); /* Ok - do the mknod. */ - if (conn->vfs_ops.mknod(conn,dos_to_unix_static(fname), unixmode, dev) != 0) + if (SMB_VFS_MKNOD(conn,dos_to_unix_static(fname), unixmode, dev) != 0) return(UNIXERROR(ERRDOS,ERRnoaccess)); inherit_access_acl(conn, fname, unixmode); @@ -2628,7 +2794,7 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n", if (raw_unixmode != SMB_MODE_NO_CHANGE) { DEBUG(10,("call_trans2setfilepathinfo: SMB_SET_FILE_UNIX_BASIC setting mode 0%o for file %s\n", (unsigned int)unixmode, fname )); - if (vfs_chmod(conn,fname,unixmode) != 0) + if (SMB_VFS_CHMOD(conn,fname,unixmode) != 0) return(UNIXERROR(ERRDOS,ERRnoaccess)); } @@ -2639,7 +2805,7 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n", if ((set_owner != (uid_t)SMB_UID_NO_CHANGE) && (sbuf.st_uid != set_owner)) { DEBUG(10,("call_trans2setfilepathinfo: SMB_SET_FILE_UNIX_BASIC changing owner %u for file %s\n", (unsigned int)set_owner, fname )); - if (vfs_chown(conn,fname,set_owner, (gid_t)-1) != 0) + if (SMB_VFS_CHOWN(conn,fname,set_owner, (gid_t)-1) != 0) return(UNIXERROR(ERRDOS,ERRnoaccess)); } @@ -2650,7 +2816,7 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n", if ((set_grp != (uid_t)SMB_GID_NO_CHANGE) && (sbuf.st_gid != set_grp)) { DEBUG(10,("call_trans2setfilepathinfo: SMB_SET_FILE_UNIX_BASIC changing group %u for file %s\n", (unsigned int)set_owner, fname )); - if (vfs_chown(conn,fname,(uid_t)-1, set_grp) != 0) + if (SMB_VFS_CHOWN(conn,fname,(uid_t)-1, set_grp) != 0) return(UNIXERROR(ERRDOS,ERRnoaccess)); } break; @@ -2677,7 +2843,7 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n", DEBUG(10,("call_trans2setfilepathinfo: SMB_SET_FILE_UNIX_LINK doing symlink %s -> %s\n", fname, link_dest )); - if (conn->vfs_ops.symlink(conn,link_dest,fname) != 0) + if (SMB_VFS_SYMLINK(conn,link_dest,fname) != 0) return(UNIXERROR(ERRDOS,ERRnoaccess)); SSVAL(params,0,0); send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0); @@ -2702,7 +2868,7 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n", DEBUG(10,("call_trans2setfilepathinfo: SMB_SET_FILE_UNIX_LINK doing hard link %s -> %s\n", fname, link_dest )); - if (conn->vfs_ops.link(conn,link_dest,fname) != 0) + if (SMB_VFS_LINK(conn,link_dest,fname) != 0) return(UNIXERROR(ERRDOS,ERRnoaccess)); SSVAL(params,0,0); send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0); @@ -2854,7 +3020,7 @@ static int call_trans2mkdir(connection_struct *conn, unix_convert(directory,conn,0,&bad_path,&sbuf); if (check_name(directory,conn)) - ret = vfs_mkdir(conn,directory,unix_mode(conn,aDIR,directory)); + ret = vfs_MkDir(conn,directory,unix_mode(conn,aDIR,directory)); if(ret < 0) { DEBUG(5,("call_trans2mkdir error (%s)\n", strerror(errno))); @@ -3298,13 +3464,14 @@ int reply_trans2(connection_struct *conn, END_PROFILE_NESTED(Trans2_qfsinfo); break; +#ifdef HAVE_SYS_QUOTAS case TRANSACT2_SETFSINFO: START_PROFILE_NESTED(Trans2_setfsinfo); outsize = call_trans2setfsinfo(conn, inbuf, outbuf, length, bufsize, ¶ms, total_params, &data, total_data); END_PROFILE_NESTED(Trans2_setfsinfo); break; - +#endif case TRANSACT2_QPATHINFO: case TRANSACT2_QFILEINFO: START_PROFILE_NESTED(Trans2_qpathinfo); diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c index c68d00025c..8d3e7cd9be 100644 --- a/source3/smbd/uid.c +++ b/source3/smbd/uid.c @@ -529,3 +529,375 @@ BOOL lookup_sid(DOM_SID *sid, fstring dom_name, fstring name, enum SID_NAME_USE } return True; } + + +/***************************************************************** + Id mapping cache. This is to avoid Winbind mappings already + seen by smbd to be queried too frequently, keeping winbindd + busy, and blocking smbd while winbindd is busy with other + stuff. Written by Michael Steffens , + modified to use linked lists by jra. +*****************************************************************/ + +#define MAX_UID_SID_CACHE_SIZE 100 +#define TURNOVER_UID_SID_CACHE_SIZE 10 +#define MAX_GID_SID_CACHE_SIZE 100 +#define TURNOVER_GID_SID_CACHE_SIZE 10 + +static size_t n_uid_sid_cache = 0; +static size_t n_gid_sid_cache = 0; + +static struct uid_sid_cache { + struct uid_sid_cache *next, *prev; + uid_t uid; + DOM_SID sid; + enum SID_NAME_USE sidtype; +} *uid_sid_cache_head; + +static struct gid_sid_cache { + struct gid_sid_cache *next, *prev; + gid_t gid; + DOM_SID sid; + enum SID_NAME_USE sidtype; +} *gid_sid_cache_head; + +/***************************************************************** + Find a SID given a uid. +*****************************************************************/ + +static BOOL fetch_sid_from_uid_cache(DOM_SID *psid, uid_t uid) +{ + struct uid_sid_cache *pc; + + for (pc = uid_sid_cache_head; pc; pc = pc->next) { + if (pc->uid == uid) { + fstring sid; + *psid = pc->sid; + DEBUG(3,("fetch sid from uid cache %u -> %s\n", + (unsigned int)uid, sid_to_string(sid, psid))); + DLIST_PROMOTE(uid_sid_cache_head, pc); + return True; + } + } + return False; +} + +/***************************************************************** + Find a uid given a SID. +*****************************************************************/ + +static BOOL fetch_uid_from_cache( uid_t *puid, const DOM_SID *psid ) +{ + struct uid_sid_cache *pc; + + for (pc = uid_sid_cache_head; pc; pc = pc->next) { + if (sid_compare(&pc->sid, psid) == 0) { + fstring sid; + *puid = pc->uid; + DEBUG(3,("fetch uid from cache %u -> %s\n", + (unsigned int)*puid, sid_to_string(sid, psid))); + DLIST_PROMOTE(uid_sid_cache_head, pc); + return True; + } + } + return False; +} + +/***************************************************************** + Store uid to SID mapping in cache. +*****************************************************************/ + +static void store_uid_sid_cache(const DOM_SID *psid, uid_t uid) +{ + struct uid_sid_cache *pc; + + if (n_uid_sid_cache >= MAX_UID_SID_CACHE_SIZE && n_uid_sid_cache > TURNOVER_UID_SID_CACHE_SIZE) { + /* Delete the last TURNOVER_UID_SID_CACHE_SIZE entries. */ + struct uid_sid_cache *pc_next; + size_t i; + + for (i = 0, pc = uid_sid_cache_head; i < (n_uid_sid_cache - TURNOVER_UID_SID_CACHE_SIZE); i++, pc = pc->next) + ; + for(; pc; pc = pc_next) { + pc_next = pc->next; + DLIST_REMOVE(uid_sid_cache_head,pc); + SAFE_FREE(pc); + n_uid_sid_cache--; + } + } + + pc = (struct uid_sid_cache *)malloc(sizeof(struct uid_sid_cache)); + if (!pc) + return; + pc->uid = uid; + sid_copy(&pc->sid, psid); + DLIST_ADD(uid_sid_cache_head, pc); + n_uid_sid_cache++; +} + +/***************************************************************** + Find a SID given a gid. +*****************************************************************/ + +static BOOL fetch_sid_from_gid_cache(DOM_SID *psid, gid_t gid) +{ + struct gid_sid_cache *pc; + + for (pc = gid_sid_cache_head; pc; pc = pc->next) { + if (pc->gid == gid) { + fstring sid; + *psid = pc->sid; + DEBUG(3,("fetch sid from gid cache %u -> %s\n", + (unsigned int)gid, sid_to_string(sid, psid))); + DLIST_PROMOTE(gid_sid_cache_head, pc); + return True; + } + } + return False; +} + +/***************************************************************** + Find a gid given a SID. +*****************************************************************/ + +static BOOL fetch_gid_from_cache(gid_t *pgid, const DOM_SID *psid) +{ + struct gid_sid_cache *pc; + + for (pc = gid_sid_cache_head; pc; pc = pc->next) { + if (sid_compare(&pc->sid, psid) == 0) { + fstring sid; + *pgid = pc->gid; + DEBUG(3,("fetch uid from cache %u -> %s\n", + (unsigned int)*pgid, sid_to_string(sid, psid))); + DLIST_PROMOTE(gid_sid_cache_head, pc); + return True; + } + } + return False; +} + +/***************************************************************** + Store gid to SID mapping in cache. +*****************************************************************/ + +static void store_gid_sid_cache(const DOM_SID *psid, gid_t gid) +{ + struct gid_sid_cache *pc; + + if (n_gid_sid_cache >= MAX_GID_SID_CACHE_SIZE && n_gid_sid_cache > TURNOVER_GID_SID_CACHE_SIZE) { + /* Delete the last TURNOVER_GID_SID_CACHE_SIZE entries. */ + struct gid_sid_cache *pc_next; + size_t i; + + for (i = 0, pc = gid_sid_cache_head; i < (n_gid_sid_cache - TURNOVER_GID_SID_CACHE_SIZE); i++, pc = pc->next) + ; + for(; pc; pc = pc_next) { + pc_next = pc->next; + DLIST_REMOVE(gid_sid_cache_head,pc); + SAFE_FREE(pc); + n_gid_sid_cache--; + } + } + + pc = (struct gid_sid_cache *)malloc(sizeof(struct gid_sid_cache)); + if (!pc) + return; + pc->gid = gid; + sid_copy(&pc->sid, psid); + DLIST_ADD(gid_sid_cache_head, pc); + n_gid_sid_cache++; +} + +/***************************************************************** + *THE CANONICAL* convert uid_t to SID function. +*****************************************************************/ + +NTSTATUS uid_to_sid(DOM_SID *psid, uid_t uid) +{ + uid_t low, high; + fstring sid; + + ZERO_STRUCTP(psid); + + if (fetch_sid_from_uid_cache(psid, uid)) + return ( psid ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ); + + if (lp_idmap_uid(&low, &high) && uid >= low && uid <= high) { + if (winbind_uid_to_sid(psid, uid)) { + + DEBUG(10,("uid_to_sid: winbindd %u -> %s\n", + (unsigned int)uid, sid_to_string(sid, psid))); + + if (psid) + store_uid_sid_cache(psid, uid); + return ( psid ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ); + } + } + + if (!local_uid_to_sid(psid, uid)) { + DEBUG(10,("uid_to_sid: local %u failed to map to sid\n", (unsigned int)uid )); + return NT_STATUS_UNSUCCESSFUL; + } + + DEBUG(10,("uid_to_sid: local %u -> %s\n", (unsigned int)uid, sid_to_string(sid, psid))); + + store_uid_sid_cache(psid, uid); + return NT_STATUS_OK; +} + +/***************************************************************** + *THE CANONICAL* convert gid_t to SID function. +*****************************************************************/ + +NTSTATUS gid_to_sid(DOM_SID *psid, gid_t gid) +{ + gid_t low, high; + fstring sid; + + ZERO_STRUCTP(psid); + + if (fetch_sid_from_gid_cache(psid, gid)) + return ( psid ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ); + + if (lp_idmap_gid(&low, &high) && gid >= low && gid <= high) { + if (winbind_gid_to_sid(psid, gid)) { + + DEBUG(10,("gid_to_sid: winbindd %u -> %s\n", + (unsigned int)gid, sid_to_string(sid, psid))); + + if (psid) + store_gid_sid_cache(psid, gid); + return ( psid ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ); + } + } + + if (!local_gid_to_sid(psid, gid)) { + DEBUG(10,("gid_to_sid: local %u failed to map to sid\n", (unsigned int)gid )); + return NT_STATUS_UNSUCCESSFUL; + } + + DEBUG(10,("gid_to_sid: local %u -> %s\n", (unsigned int)gid, sid_to_string(sid, psid))); + + store_gid_sid_cache(psid, gid); + return NT_STATUS_OK; +} + +/***************************************************************** + *THE CANONICAL* convert SID to uid function. +*****************************************************************/ + +NTSTATUS sid_to_uid(const DOM_SID *psid, uid_t *puid) +{ + fstring dom_name, name, sid_str; + enum SID_NAME_USE name_type; + + if (fetch_uid_from_cache(puid, psid)) + return NT_STATUS_OK; + + /* if this is our SID then go straight to a local lookup */ + + if ( sid_compare_domain(get_global_sam_sid(), psid) == 0 ) { + DEBUG(10,("sid_to_uid: my domain (%s) - trying local.\n", + sid_string_static(psid) )); + + if ( local_sid_to_uid(puid, psid, &name_type) ) + goto success; + + DEBUG(10,("sid_to_uid: local lookup failed\n")); + + return NT_STATUS_UNSUCCESSFUL; + } + + /* If it is not our local domain, only hope is winbindd */ + + if ( !winbind_lookup_sid(psid, dom_name, name, &name_type) ) { + DEBUG(10,("sid_to_uid: winbind lookup for non-local sid %s failed\n", + sid_string_static(psid) )); + + return NT_STATUS_UNSUCCESSFUL; + } + + /* If winbindd does know the SID, ensure this is a user */ + + if (name_type != SID_NAME_USER) { + DEBUG(10,("sid_to_uid: winbind lookup succeeded but SID is not a user (%u)\n", + (unsigned int)name_type )); + return NT_STATUS_INVALID_PARAMETER; + } + + /* get the uid. Has to work or else we are dead in the water */ + + if ( !winbind_sid_to_uid(puid, psid) ) { + DEBUG(10,("sid_to_uid: winbind failed to allocate a new uid for sid %s\n", + sid_to_string(sid_str, psid) )); + return NT_STATUS_UNSUCCESSFUL; + } + +success: + DEBUG(10,("sid_to_uid: %s -> %u\n", sid_to_string(sid_str, psid), + (unsigned int)*puid )); + + store_uid_sid_cache(psid, *puid); + + return NT_STATUS_OK; +} +/***************************************************************** + *THE CANONICAL* convert SID to gid function. + Group mapping is used for gids that maps to Wellknown SIDs +*****************************************************************/ + +NTSTATUS sid_to_gid(const DOM_SID *psid, gid_t *pgid) +{ + fstring dom_name, name, sid_str; + enum SID_NAME_USE name_type; + + if (fetch_gid_from_cache(pgid, psid)) + return NT_STATUS_OK; + + /* + * First we must look up the name and decide if this is a group sid. + * Group mapping can deal with foreign SIDs + */ + + if (!winbind_lookup_sid(psid, dom_name, name, &name_type)) { + DEBUG(10,("sid_to_gid: winbind lookup for sid %s failed - trying local.\n", + sid_to_string(sid_str, psid) )); + + if ( local_sid_to_gid(pgid, psid, &name_type) ) + goto success; + + DEBUG(10,("sid_to_gid: no one knows this SID\n")); + + return NT_STATUS_UNSUCCESSFUL; + } + + /* winbindd knows it; Ensure this is a group sid */ + + if ((name_type != SID_NAME_DOM_GRP) && (name_type != SID_NAME_ALIAS) && (name_type != SID_NAME_WKN_GRP)) { + DEBUG(10,("sid_to_gid: winbind lookup succeeded but SID is not a known group (%u)\n", + (unsigned int)name_type )); + + /* winbindd is running and knows about this SID. Just the wrong type. + Don't fallback to a local lookup here */ + + return NT_STATUS_INVALID_PARAMETER; + } + + /* winbindd knows it and it is a type of group; sid_to_gid must succeed + or we are dead in the water */ + + if ( !winbind_sid_to_gid(pgid, psid) ) { + DEBUG(10,("sid_to_uid: winbind failed to allocate a new gid for sid %s\n", + sid_to_string(sid_str, psid) )); + return NT_STATUS_UNSUCCESSFUL; + } + +success: + DEBUG(10,("sid_to_gid: %s -> %u\n", sid_to_string(sid_str, psid), + (unsigned int)*pgid )); + + store_gid_sid_cache(psid, *pgid); + + return NT_STATUS_OK; +} diff --git a/source3/smbd/utmp.c b/source3/smbd/utmp.c index 6c12cfac62..9833a11f2d 100644 --- a/source3/smbd/utmp.c +++ b/source3/smbd/utmp.c @@ -21,8 +21,6 @@ #include "includes.h" -#ifdef WITH_UTMP - /**************************************************************************** Reflect connection status in utmp/wtmp files. T.D.Lee@durham.ac.uk September 1999 @@ -81,11 +79,11 @@ lastlog: Notes: Each connection requires a small number (starting at 0, working up) - to represent the line (unum). This must be unique within and across - all smbd processes. + to represent the line. This must be unique within and across all + smbd processes. It is the 'id_num' from Samba's session.c code. The 4 byte 'ut_id' component is vital to distinguish connections, - of which there could be several hundered or even thousand. + of which there could be several hundred or even thousand. Entries seem to be printable characters, with optional NULL pads. We need to be distinct from other entries in utmp/wtmp. @@ -105,14 +103,28 @@ Notes: Arbitrarily I have chosen to use a distinctive 'SM' for the first two bytes. - The remaining two encode the "unum" (see above). - - For "utmp consolidate" the suggestion was made to encode the pid into - those remaining two bytes (16 bits). But recent UNIX (e.g Solaris 8) - is migrating to pids > 16 bits, so we ought not to do this. + The remaining two bytes encode the session 'id_num' (see above). + Our caller (session.c) should note our 16-bit limitation. ****************************************************************************/ +#ifndef WITH_UTMP +/* + * Not WITH_UTMP? Simply supply dummy routines. + */ + +void sys_utmp_claim(const char *username, const char *hostname, + struct in_addr *ipaddr, + const char *id_str, int id_num) +{} + +void sys_utmp_yield(const char *username, const char *hostname, + struct in_addr *ipaddr, + const char *id_str, int id_num) +{} + +#else /* WITH_UTMP */ + #include #ifdef HAVE_UTMPX_H @@ -125,33 +137,6 @@ Notes: #include #endif -/**************************************************************************** - Obtain/release a small number (0 upwards) unique within and across smbds. -****************************************************************************/ -/* - * Need a "small" number to represent this connection, unique within this - * smbd and across all smbds. - * - * claim: - * Start at 0, hunt up for free, unique number "unum" by attempting to - * store it as a key in a tdb database: - * key: unum data: pid+conn - * Also store its inverse, ready for yield function: - * key: pid+conn data: unum - * - * yield: - * Find key: pid+conn; data is unum; delete record - * Find key: unum ; delete record. - * - * Comment: - * The claim algorithm (a "for" loop attempting to store numbers in a tdb - * database) will be increasingly inefficient with larger numbers of - * connections. Is it possible to write a suitable primitive within tdb? - * - * However, by also storing the inverse key/data pair, we at least make - * the yield algorithm efficient. - */ - /**************************************************************************** Default paths to various {u,w}tmp{,x} files. ****************************************************************************/ @@ -484,6 +469,7 @@ static int ut_id_encode(int i, char *fourbyte) */ static BOOL sys_utmp_fill(struct utmp *u, const char *username, const char *hostname, + struct in_addr *ipaddr, const char *id_str, int id_num) { struct timeval timeval; @@ -503,10 +489,6 @@ static BOOL sys_utmp_fill(struct utmp *u, /* * ut_line: * If size limit proves troublesome, then perhaps use "ut_id_encode()". - * - * Temporary variable "line_tmp" avoids trouble: - * o with unwanted trailing NULL if ut_line full; - * o with overflow if ut_line would be more than full. */ if (strlen(id_str) > sizeof(u->ut_line)) { DEBUG(1,("id_str [%s] is too long for %d char utmp field\n", @@ -538,8 +520,9 @@ static BOOL sys_utmp_fill(struct utmp *u, #if defined(HAVE_UT_UT_HOST) utmp_strcpy(u->ut_host, hostname, sizeof(u->ut_host)); #endif - #if defined(HAVE_UT_UT_ADDR) + if (ipaddr) + u->ut_addr = ipaddr->s_addr; /* * "(unsigned long) ut_addr" apparently exists on at least HP-UX 10.20. * Volunteer to implement, please ... @@ -561,6 +544,7 @@ static BOOL sys_utmp_fill(struct utmp *u, ****************************************************************************/ void sys_utmp_yield(const char *username, const char *hostname, + struct in_addr *ipaddr, const char *id_str, int id_num) { struct utmp u; @@ -576,7 +560,7 @@ void sys_utmp_yield(const char *username, const char *hostname, u.ut_type = DEAD_PROCESS; #endif - if (!sys_utmp_fill(&u, username, hostname, id_str, id_num)) return; + if (!sys_utmp_fill(&u, username, hostname, ipaddr, id_str, id_num)) return; sys_utmp_update(&u, NULL, False); } @@ -586,6 +570,7 @@ void sys_utmp_yield(const char *username, const char *hostname, ****************************************************************************/ void sys_utmp_claim(const char *username, const char *hostname, + struct in_addr *ipaddr, const char *id_str, int id_num) { struct utmp u; @@ -596,11 +581,9 @@ void sys_utmp_claim(const char *username, const char *hostname, u.ut_type = USER_PROCESS; #endif - if (!sys_utmp_fill(&u, username, hostname, id_str, id_num)) return; + if (!sys_utmp_fill(&u, username, hostname, ipaddr, id_str, id_num)) return; sys_utmp_update(&u, hostname, True); } -#else /* WITH_UTMP */ - void dummy_utmp(void) {} -#endif +#endif /* WITH_UTMP */ diff --git a/source3/smbd/vfs-wrap.c b/source3/smbd/vfs-wrap.c index 491fa70e68..8d44a1a0fa 100644 --- a/source3/smbd/vfs-wrap.c +++ b/source3/smbd/vfs-wrap.c @@ -30,18 +30,18 @@ is sure to try and execute them. These stubs are used to prevent this possibility. */ -int vfswrap_dummy_connect(connection_struct *conn, const char *service, const char *user) +int vfswrap_dummy_connect(vfs_handle_struct *handle, connection_struct *conn, const char *service, const char *user) { return 0; /* Return >= 0 for success */ } -void vfswrap_dummy_disconnect(connection_struct *conn) +void vfswrap_dummy_disconnect(vfs_handle_struct *handle, connection_struct *conn) { } /* Disk operations */ -SMB_BIG_UINT vfswrap_disk_free(connection_struct *conn, const char *path, BOOL small_query, SMB_BIG_UINT *bsize, +SMB_BIG_UINT vfswrap_disk_free(vfs_handle_struct *handle, connection_struct *conn, const char *path, BOOL small_query, SMB_BIG_UINT *bsize, SMB_BIG_UINT *dfree, SMB_BIG_UINT *dsize) { SMB_BIG_UINT result; @@ -52,7 +52,7 @@ SMB_BIG_UINT vfswrap_disk_free(connection_struct *conn, const char *path, BOOL s /* Directory operations */ -DIR *vfswrap_opendir(connection_struct *conn, const char *fname) +DIR *vfswrap_opendir(vfs_handle_struct *handle, connection_struct *conn, const char *fname) { DIR *result; @@ -62,7 +62,7 @@ DIR *vfswrap_opendir(connection_struct *conn, const char *fname) return result; } -struct dirent *vfswrap_readdir(connection_struct *conn, DIR *dirp) +struct dirent *vfswrap_readdir(vfs_handle_struct *handle, connection_struct *conn, DIR *dirp) { struct dirent *result; @@ -72,7 +72,7 @@ struct dirent *vfswrap_readdir(connection_struct *conn, DIR *dirp) return result; } -int vfswrap_mkdir(connection_struct *conn, const char *path, mode_t mode) +int vfswrap_mkdir(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) { int result; BOOL has_dacl = False; @@ -93,17 +93,15 @@ int vfswrap_mkdir(connection_struct *conn, const char *path, mode_t mode) * mess up any inherited ACL bits that were set. JRA. */ int saved_errno = errno; /* We may get ENOSYS */ - if (conn->vfs_ops.chmod_acl != NULL) { - if ((conn->vfs_ops.chmod_acl(conn, path, mode) == -1) && (errno == ENOSYS)) - errno = saved_errno; - } + if ((SMB_VFS_CHMOD_ACL(conn, path, mode) == -1) && (errno == ENOSYS)) + errno = saved_errno; } END_PROFILE(syscall_mkdir); return result; } -int vfswrap_rmdir(connection_struct *conn, const char *path) +int vfswrap_rmdir(vfs_handle_struct *handle, connection_struct *conn, const char *path) { int result; @@ -113,7 +111,7 @@ int vfswrap_rmdir(connection_struct *conn, const char *path) return result; } -int vfswrap_closedir(connection_struct *conn, DIR *dirp) +int vfswrap_closedir(vfs_handle_struct *handle, connection_struct *conn, DIR *dirp) { int result; @@ -125,7 +123,7 @@ int vfswrap_closedir(connection_struct *conn, DIR *dirp) /* File operations */ -int vfswrap_open(connection_struct *conn, const char *fname, int flags, mode_t mode) +int vfswrap_open(vfs_handle_struct *handle, connection_struct *conn, const char *fname, int flags, mode_t mode) { int result; @@ -135,7 +133,7 @@ int vfswrap_open(connection_struct *conn, const char *fname, int flags, mode_t m return result; } -int vfswrap_close(files_struct *fsp, int fd) +int vfswrap_close(vfs_handle_struct *handle, files_struct *fsp, int fd) { int result; @@ -146,7 +144,7 @@ int vfswrap_close(files_struct *fsp, int fd) return result; } -ssize_t vfswrap_read(files_struct *fsp, int fd, void *data, size_t n) +ssize_t vfswrap_read(vfs_handle_struct *handle, files_struct *fsp, int fd, void *data, size_t n) { ssize_t result; @@ -156,7 +154,7 @@ ssize_t vfswrap_read(files_struct *fsp, int fd, void *data, size_t n) return result; } -ssize_t vfswrap_write(files_struct *fsp, int fd, const void *data, size_t n) +ssize_t vfswrap_write(vfs_handle_struct *handle, files_struct *fsp, int fd, const void *data, size_t n) { ssize_t result; @@ -166,7 +164,7 @@ ssize_t vfswrap_write(files_struct *fsp, int fd, const void *data, size_t n) return result; } -SMB_OFF_T vfswrap_lseek(files_struct *fsp, int filedes, SMB_OFF_T offset, int whence) +SMB_OFF_T vfswrap_lseek(vfs_handle_struct *handle, files_struct *fsp, int filedes, SMB_OFF_T offset, int whence) { SMB_OFF_T result = 0; @@ -192,7 +190,7 @@ SMB_OFF_T vfswrap_lseek(files_struct *fsp, int filedes, SMB_OFF_T offset, int wh return result; } -ssize_t vfswrap_sendfile(int tofd, struct files_struct *fsp, int fromfd, const DATA_BLOB *hdr, +ssize_t vfswrap_sendfile(vfs_handle_struct *handle, int tofd, files_struct *fsp, int fromfd, const DATA_BLOB *hdr, SMB_OFF_T offset, size_t n) { ssize_t result; @@ -203,7 +201,7 @@ ssize_t vfswrap_sendfile(int tofd, struct files_struct *fsp, int fromfd, const D return result; } -int vfswrap_rename(connection_struct *conn, const char *old, const char *new) +int vfswrap_rename(vfs_handle_struct *handle, connection_struct *conn, const char *old, const char *new) { int result; @@ -213,7 +211,7 @@ int vfswrap_rename(connection_struct *conn, const char *old, const char *new) return result; } -int vfswrap_fsync(files_struct *fsp, int fd) +int vfswrap_fsync(vfs_handle_struct *handle, files_struct *fsp, int fd) { #ifdef HAVE_FSYNC int result; @@ -228,7 +226,7 @@ int vfswrap_fsync(files_struct *fsp, int fd) #endif } -int vfswrap_stat(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *sbuf) +int vfswrap_stat(vfs_handle_struct *handle, connection_struct *conn, const char *fname, SMB_STRUCT_STAT *sbuf) { int result; @@ -238,7 +236,7 @@ int vfswrap_stat(connection_struct *conn, const char *fname, SMB_STRUCT_STAT *sb return result; } -int vfswrap_fstat(files_struct *fsp, int fd, SMB_STRUCT_STAT *sbuf) +int vfswrap_fstat(vfs_handle_struct *handle, files_struct *fsp, int fd, SMB_STRUCT_STAT *sbuf) { int result; @@ -248,7 +246,7 @@ int vfswrap_fstat(files_struct *fsp, int fd, SMB_STRUCT_STAT *sbuf) return result; } -int vfswrap_lstat(connection_struct *conn, const char *path, SMB_STRUCT_STAT *sbuf) +int vfswrap_lstat(vfs_handle_struct *handle, connection_struct *conn, const char *path, SMB_STRUCT_STAT *sbuf) { int result; @@ -258,7 +256,7 @@ int vfswrap_lstat(connection_struct *conn, const char *path, SMB_STRUCT_STAT *sb return result; } -int vfswrap_unlink(connection_struct *conn, const char *path) +int vfswrap_unlink(vfs_handle_struct *handle, connection_struct *conn, const char *path) { int result; @@ -268,7 +266,7 @@ int vfswrap_unlink(connection_struct *conn, const char *path) return result; } -int vfswrap_chmod(connection_struct *conn, const char *path, mode_t mode) +int vfswrap_chmod(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) { int result; @@ -281,9 +279,9 @@ int vfswrap_chmod(connection_struct *conn, const char *path, mode_t mode) */ - if (conn->vfs_ops.chmod_acl != NULL) { + { int saved_errno = errno; /* We might get ENOSYS */ - if ((result = conn->vfs_ops.chmod_acl(conn, path, mode)) == 0) { + if ((result = SMB_VFS_CHMOD_ACL(conn, path, mode)) == 0) { END_PROFILE(syscall_chmod); return result; } @@ -296,10 +294,9 @@ int vfswrap_chmod(connection_struct *conn, const char *path, mode_t mode) return result; } -int vfswrap_fchmod(files_struct *fsp, int fd, mode_t mode) +int vfswrap_fchmod(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode) { int result; - struct vfs_ops *vfs_ops = &fsp->conn->vfs_ops; START_PROFILE(syscall_fchmod); @@ -309,9 +306,9 @@ int vfswrap_fchmod(files_struct *fsp, int fd, mode_t mode) * group owner bits directly. JRA. */ - if (vfs_ops->fchmod_acl != NULL) { + { int saved_errno = errno; /* We might get ENOSYS */ - if ((result = vfs_ops->fchmod_acl(fsp, fd, mode)) == 0) { + if ((result = SMB_VFS_FCHMOD_ACL(fsp, fd, mode)) == 0) { END_PROFILE(syscall_chmod); return result; } @@ -330,7 +327,7 @@ int vfswrap_fchmod(files_struct *fsp, int fd, mode_t mode) return result; } -int vfswrap_chown(connection_struct *conn, const char *path, uid_t uid, gid_t gid) +int vfswrap_chown(vfs_handle_struct *handle, connection_struct *conn, const char *path, uid_t uid, gid_t gid) { int result; @@ -340,7 +337,7 @@ int vfswrap_chown(connection_struct *conn, const char *path, uid_t uid, gid_t gi return result; } -int vfswrap_fchown(files_struct *fsp, int fd, uid_t uid, gid_t gid) +int vfswrap_fchown(vfs_handle_struct *handle, files_struct *fsp, int fd, uid_t uid, gid_t gid) { #ifdef HAVE_FCHOWN int result; @@ -356,7 +353,7 @@ int vfswrap_fchown(files_struct *fsp, int fd, uid_t uid, gid_t gid) #endif } -int vfswrap_chdir(connection_struct *conn, const char *path) +int vfswrap_chdir(vfs_handle_struct *handle, connection_struct *conn, const char *path) { int result; @@ -366,7 +363,7 @@ int vfswrap_chdir(connection_struct *conn, const char *path) return result; } -char *vfswrap_getwd(connection_struct *conn, char *path) +char *vfswrap_getwd(vfs_handle_struct *handle, connection_struct *conn, char *path) { char *result; @@ -376,7 +373,7 @@ char *vfswrap_getwd(connection_struct *conn, char *path) return result; } -int vfswrap_utime(connection_struct *conn, const char *path, struct utimbuf *times) +int vfswrap_utime(vfs_handle_struct *handle, connection_struct *conn, const char *path, struct utimbuf *times) { int result; @@ -391,18 +388,17 @@ int vfswrap_utime(connection_struct *conn, const char *path, struct utimbuf *tim allocate is set. **********************************************************************/ -static int strict_allocate_ftruncate(files_struct *fsp, int fd, SMB_OFF_T len) +static int strict_allocate_ftruncate(vfs_handle_struct *handle, files_struct *fsp, int fd, SMB_OFF_T len) { - struct vfs_ops *vfs_ops = &fsp->conn->vfs_ops; SMB_STRUCT_STAT st; - SMB_OFF_T currpos = vfs_ops->lseek(fsp, fd, 0, SEEK_CUR); + SMB_OFF_T currpos = SMB_VFS_LSEEK(fsp, fd, 0, SEEK_CUR); unsigned char zero_space[4096]; SMB_OFF_T space_to_write; if (currpos == -1) return -1; - if (vfs_ops->fstat(fsp, fd, &st) == -1) + if (SMB_VFS_FSTAT(fsp, fd, &st) == -1) return -1; space_to_write = len - st.st_size; @@ -420,7 +416,7 @@ static int strict_allocate_ftruncate(files_struct *fsp, int fd, SMB_OFF_T len) return sys_ftruncate(fd, len); /* Write out the real space on disk. */ - if (vfs_ops->lseek(fsp, fd, st.st_size, SEEK_SET) != st.st_size) + if (SMB_VFS_LSEEK(fsp, fd, st.st_size, SEEK_SET) != st.st_size) return -1; space_to_write = len - st.st_size; @@ -430,7 +426,7 @@ static int strict_allocate_ftruncate(files_struct *fsp, int fd, SMB_OFF_T len) SMB_OFF_T retlen; SMB_OFF_T current_len_to_write = MIN(sizeof(zero_space),space_to_write); - retlen = vfs_ops->write(fsp,fsp->fd,(char *)zero_space,current_len_to_write); + retlen = SMB_VFS_WRITE(fsp,fsp->fd,(char *)zero_space,current_len_to_write); if (retlen <= 0) return -1; @@ -438,16 +434,15 @@ static int strict_allocate_ftruncate(files_struct *fsp, int fd, SMB_OFF_T len) } /* Seek to where we were */ - if (vfs_ops->lseek(fsp, fd, currpos, SEEK_SET) != currpos) + if (SMB_VFS_LSEEK(fsp, fd, currpos, SEEK_SET) != currpos) return -1; return 0; } -int vfswrap_ftruncate(files_struct *fsp, int fd, SMB_OFF_T len) +int vfswrap_ftruncate(vfs_handle_struct *handle, files_struct *fsp, int fd, SMB_OFF_T len) { int result = -1; - struct vfs_ops *vfs_ops = &fsp->conn->vfs_ops; SMB_STRUCT_STAT st; char c = 0; SMB_OFF_T currpos; @@ -455,7 +450,7 @@ int vfswrap_ftruncate(files_struct *fsp, int fd, SMB_OFF_T len) START_PROFILE(syscall_ftruncate); if (lp_strict_allocate(SNUM(fsp->conn))) { - result = strict_allocate_ftruncate(fsp, fd, len); + result = strict_allocate_ftruncate(handle, fsp, fd, len); END_PROFILE(syscall_ftruncate); return result; } @@ -473,7 +468,7 @@ int vfswrap_ftruncate(files_struct *fsp, int fd, SMB_OFF_T len) /* According to W. R. Stevens advanced UNIX prog. Pure 4.3 BSD cannot extend a file with ftruncate. Provide alternate implementation for this */ - currpos = vfs_ops->lseek(fsp, fd, 0, SEEK_CUR); + currpos = SMB_VFS_LSEEK(fsp, fd, 0, SEEK_CUR); if (currpos == -1) { goto done; } @@ -482,7 +477,7 @@ int vfswrap_ftruncate(files_struct *fsp, int fd, SMB_OFF_T len) size in which case the ftruncate above should have succeeded or shorter, in which case seek to len - 1 and write 1 byte of zero */ - if (vfs_ops->fstat(fsp, fd, &st) == -1) { + if (SMB_VFS_FSTAT(fsp, fd, &st) == -1) { goto done; } @@ -503,14 +498,14 @@ int vfswrap_ftruncate(files_struct *fsp, int fd, SMB_OFF_T len) goto done; } - if (vfs_ops->lseek(fsp, fd, len-1, SEEK_SET) != len -1) + if (SMB_VFS_LSEEK(fsp, fd, len-1, SEEK_SET) != len -1) goto done; - if (vfs_ops->write(fsp, fd, &c, 1)!=1) + if (SMB_VFS_WRITE(fsp, fd, &c, 1)!=1) goto done; /* Seek to where we were */ - if (vfs_ops->lseek(fsp, fd, currpos, SEEK_SET) != currpos) + if (SMB_VFS_LSEEK(fsp, fd, currpos, SEEK_SET) != currpos) goto done; result = 0; @@ -520,7 +515,7 @@ int vfswrap_ftruncate(files_struct *fsp, int fd, SMB_OFF_T len) return result; } -BOOL vfswrap_lock(files_struct *fsp, int fd, int op, SMB_OFF_T offset, SMB_OFF_T count, int type) +BOOL vfswrap_lock(vfs_handle_struct *handle, files_struct *fsp, int fd, int op, SMB_OFF_T offset, SMB_OFF_T count, int type) { BOOL result; @@ -531,7 +526,7 @@ BOOL vfswrap_lock(files_struct *fsp, int fd, int op, SMB_OFF_T offset, SMB_OFF_T return result; } -int vfswrap_symlink(connection_struct *conn, const char *oldpath, const char *newpath) +int vfswrap_symlink(vfs_handle_struct *handle, connection_struct *conn, const char *oldpath, const char *newpath) { int result; @@ -541,7 +536,7 @@ int vfswrap_symlink(connection_struct *conn, const char *oldpath, const char *ne return result; } -int vfswrap_readlink(connection_struct *conn, const char *path, char *buf, size_t bufsiz) +int vfswrap_readlink(vfs_handle_struct *handle, connection_struct *conn, const char *path, char *buf, size_t bufsiz) { int result; @@ -551,7 +546,7 @@ int vfswrap_readlink(connection_struct *conn, const char *path, char *buf, size_ return result; } -int vfswrap_link(connection_struct *conn, const char *oldpath, const char *newpath) +int vfswrap_link(vfs_handle_struct *handle, connection_struct *conn, const char *oldpath, const char *newpath) { int result; @@ -561,7 +556,7 @@ int vfswrap_link(connection_struct *conn, const char *oldpath, const char *newpa return result; } -int vfswrap_mknod(connection_struct *conn, const char *pathname, mode_t mode, SMB_DEV_T dev) +int vfswrap_mknod(vfs_handle_struct *handle, connection_struct *conn, const char *pathname, mode_t mode, SMB_DEV_T dev) { int result; @@ -571,7 +566,7 @@ int vfswrap_mknod(connection_struct *conn, const char *pathname, mode_t mode, SM return result; } -char *vfswrap_realpath(connection_struct *conn, const char *path, char *resolved_path) +char *vfswrap_realpath(vfs_handle_struct *handle, connection_struct *conn, const char *path, char *resolved_path) { char *result; @@ -581,27 +576,27 @@ char *vfswrap_realpath(connection_struct *conn, const char *path, char *resolved return result; } -size_t vfswrap_fget_nt_acl(files_struct *fsp, int fd, SEC_DESC **ppdesc) +size_t vfswrap_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, uint32 security_info, SEC_DESC **ppdesc) { size_t result; START_PROFILE(fget_nt_acl); - result = get_nt_acl(fsp, ppdesc); + result = get_nt_acl(fsp, security_info, ppdesc); END_PROFILE(fget_nt_acl); return result; } -size_t vfswrap_get_nt_acl(files_struct *fsp, const char *name, SEC_DESC **ppdesc) +size_t vfswrap_get_nt_acl(vfs_handle_struct *handle, files_struct *fsp, const char *name, uint32 security_info, SEC_DESC **ppdesc) { size_t result; START_PROFILE(get_nt_acl); - result = get_nt_acl(fsp, ppdesc); + result = get_nt_acl(fsp, security_info, ppdesc); END_PROFILE(get_nt_acl); return result; } -BOOL vfswrap_fset_nt_acl(files_struct *fsp, int fd, uint32 security_info_sent, SEC_DESC *psd) +BOOL vfswrap_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, uint32 security_info_sent, SEC_DESC *psd) { BOOL result; @@ -611,7 +606,7 @@ BOOL vfswrap_fset_nt_acl(files_struct *fsp, int fd, uint32 security_info_sent, S return result; } -BOOL vfswrap_set_nt_acl(files_struct *fsp, const char *name, uint32 security_info_sent, SEC_DESC *psd) +BOOL vfswrap_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp, const char *name, uint32 security_info_sent, SEC_DESC *psd) { BOOL result; @@ -621,132 +616,236 @@ BOOL vfswrap_set_nt_acl(files_struct *fsp, const char *name, uint32 security_inf return result; } -int vfswrap_chmod_acl(connection_struct *conn, const char *name, mode_t mode) +int vfswrap_chmod_acl(vfs_handle_struct *handle, connection_struct *conn, const char *name, mode_t mode) { +#ifdef HAVE_NO_ACL + errno = ENOSYS; + return -1; +#else int result; START_PROFILE(chmod_acl); result = chmod_acl(conn, name, mode); END_PROFILE(chmod_acl); return result; +#endif } -int vfswrap_fchmod_acl(files_struct *fsp, int fd, mode_t mode) +int vfswrap_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode) { +#ifdef HAVE_NO_ACL + errno = ENOSYS; + return -1; +#else int result; START_PROFILE(fchmod_acl); result = fchmod_acl(fsp, fd, mode); END_PROFILE(fchmod_acl); return result; +#endif } -int vfswrap_sys_acl_get_entry(struct connection_struct *conn, SMB_ACL_T theacl, int entry_id, SMB_ACL_ENTRY_T *entry_p) +int vfswrap_sys_acl_get_entry(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T theacl, int entry_id, SMB_ACL_ENTRY_T *entry_p) { return sys_acl_get_entry(theacl, entry_id, entry_p); } -int vfswrap_sys_acl_get_tag_type(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_TAG_T *tag_type_p) +int vfswrap_sys_acl_get_tag_type(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_TAG_T *tag_type_p) { return sys_acl_get_tag_type(entry_d, tag_type_p); } -int vfswrap_sys_acl_get_permset(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_PERMSET_T *permset_p) +int vfswrap_sys_acl_get_permset(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_PERMSET_T *permset_p) { return sys_acl_get_permset(entry_d, permset_p); } -void * vfswrap_sys_acl_get_qualifier(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d) +void * vfswrap_sys_acl_get_qualifier(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry_d) { return sys_acl_get_qualifier(entry_d); } -SMB_ACL_T vfswrap_sys_acl_get_file(struct connection_struct *conn, const char *path_p, SMB_ACL_TYPE_T type) +SMB_ACL_T vfswrap_sys_acl_get_file(vfs_handle_struct *handle, connection_struct *conn, const char *path_p, SMB_ACL_TYPE_T type) { return sys_acl_get_file(path_p, type); } -SMB_ACL_T vfswrap_sys_acl_get_fd(struct files_struct *fsp, int fd) +SMB_ACL_T vfswrap_sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp, int fd) { return sys_acl_get_fd(fd); } -int vfswrap_sys_acl_clear_perms(struct connection_struct *conn, SMB_ACL_PERMSET_T permset) +int vfswrap_sys_acl_clear_perms(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_PERMSET_T permset) { return sys_acl_clear_perms(permset); } -int vfswrap_sys_acl_add_perm(struct connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm) +int vfswrap_sys_acl_add_perm(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm) { return sys_acl_add_perm(permset, perm); } -char * vfswrap_sys_acl_to_text(struct connection_struct *conn, SMB_ACL_T theacl, ssize_t *plen) +char * vfswrap_sys_acl_to_text(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T theacl, ssize_t *plen) { return sys_acl_to_text(theacl, plen); } -SMB_ACL_T vfswrap_sys_acl_init(struct connection_struct *conn, int count) +SMB_ACL_T vfswrap_sys_acl_init(vfs_handle_struct *handle, connection_struct *conn, int count) { return sys_acl_init(count); } -int vfswrap_sys_acl_create_entry(struct connection_struct *conn, SMB_ACL_T *pacl, SMB_ACL_ENTRY_T *pentry) +int vfswrap_sys_acl_create_entry(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T *pacl, SMB_ACL_ENTRY_T *pentry) { return sys_acl_create_entry(pacl, pentry); } -int vfswrap_sys_acl_set_tag_type(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_TAG_T tagtype) +int vfswrap_sys_acl_set_tag_type(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_TAG_T tagtype) { return sys_acl_set_tag_type(entry, tagtype); } -int vfswrap_sys_acl_set_qualifier(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, void *qual) +int vfswrap_sys_acl_set_qualifier(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry, void *qual) { return sys_acl_set_qualifier(entry, qual); } -int vfswrap_sys_acl_set_permset(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_PERMSET_T permset) +int vfswrap_sys_acl_set_permset(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_PERMSET_T permset) { return sys_acl_set_permset(entry, permset); } -int vfswrap_sys_acl_valid(struct connection_struct *conn, SMB_ACL_T theacl ) +int vfswrap_sys_acl_valid(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T theacl ) { return sys_acl_valid(theacl ); } -int vfswrap_sys_acl_set_file(struct connection_struct *conn, const char *name, SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl) +int vfswrap_sys_acl_set_file(vfs_handle_struct *handle, connection_struct *conn, const char *name, SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl) { return sys_acl_set_file(name, acltype, theacl); } -int vfswrap_sys_acl_set_fd(struct files_struct *fsp, int fd, SMB_ACL_T theacl) +int vfswrap_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp, int fd, SMB_ACL_T theacl) { return sys_acl_set_fd(fd, theacl); } -int vfswrap_sys_acl_delete_def_file(struct connection_struct *conn, const char *path) +int vfswrap_sys_acl_delete_def_file(vfs_handle_struct *handle, connection_struct *conn, const char *path) { return sys_acl_delete_def_file(path); } -int vfswrap_sys_acl_get_perm(struct connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm) +int vfswrap_sys_acl_get_perm(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm) { return sys_acl_get_perm(permset, perm); } -int vfswrap_sys_acl_free_text(struct connection_struct *conn, char *text) +int vfswrap_sys_acl_free_text(vfs_handle_struct *handle, connection_struct *conn, char *text) { return sys_acl_free_text(text); } -int vfswrap_sys_acl_free_acl(struct connection_struct *conn, SMB_ACL_T posix_acl) +int vfswrap_sys_acl_free_acl(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T posix_acl) { return sys_acl_free_acl(posix_acl); } -int vfswrap_sys_acl_free_qualifier(struct connection_struct *conn, void *qualifier, SMB_ACL_TAG_T tagtype) +int vfswrap_sys_acl_free_qualifier(vfs_handle_struct *handle, connection_struct *conn, void *qualifier, SMB_ACL_TAG_T tagtype) { return sys_acl_free_qualifier(qualifier, tagtype); } + +int vfswrap_get_quota(struct vfs_handle_struct *handle, struct connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *qt) +{ +#ifdef HAVE_SYS_QUOTAS + int result; + + START_PROFILE(syscall_get_quota); + result = sys_get_quota(conn->connectpath, qtype, id, qt); + END_PROFILE(syscall_get_quota); + return result; +#else + errno = ENOSYS; + return -1; +#endif +} + +int vfswrap_set_quota(struct vfs_handle_struct *handle, struct connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *qt) +{ +#ifdef HAVE_SYS_QUOTAS + int result; + + START_PROFILE(syscall_set_quota); + result = sys_set_quota(conn->connectpath, qtype, id, qt); + END_PROFILE(syscall_set_quota); + return result; +#else + errno = ENOSYS; + return -1; +#endif +} + +/**************************************************************** + Extended attribute operations. +*****************************************************************/ + +ssize_t vfswrap_getxattr(struct vfs_handle_struct *handle,struct connection_struct *conn,const char *path, const char *name, void *value, size_t size) +{ + return sys_getxattr(path, name, value, size); +} + +ssize_t vfswrap_lgetxattr(struct vfs_handle_struct *handle,struct connection_struct *conn,const char *path, const char *name, void *value, size_t size) +{ + return sys_lgetxattr(path, name, value, size); +} + +ssize_t vfswrap_fgetxattr(struct vfs_handle_struct *handle, struct files_struct *fsp,int fd, const char *name, void *value, size_t size) +{ + return sys_fgetxattr(fd, name, value, size); +} + +ssize_t vfswrap_listxattr(struct vfs_handle_struct *handle, struct connection_struct *conn,const char *path, char *list, size_t size) +{ + return sys_listxattr(path, list, size); +} + +ssize_t vfswrap_llistxattr(struct vfs_handle_struct *handle, struct connection_struct *conn,const char *path, char *list, size_t size) +{ + return sys_llistxattr(path, list, size); +} + +ssize_t vfswrap_flistxattr(struct vfs_handle_struct *handle, struct files_struct *fsp,int fd, char *list, size_t size) +{ + return sys_flistxattr(fd, list, size); +} + +int vfswrap_removexattr(struct vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name) +{ + return sys_removexattr(path, name); +} + +int vfswrap_lremovexattr(struct vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name) +{ + return sys_lremovexattr(path, name); +} + +int vfswrap_fremovexattr(struct vfs_handle_struct *handle, struct files_struct *fsp,int fd, const char *name) +{ + return sys_fremovexattr(fd, name); +} + +int vfswrap_setxattr(struct vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, const void *value, size_t size, int flags) +{ + return sys_setxattr(path, name, value, size, flags); +} + +int vfswrap_lsetxattr(struct vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, const void *value, size_t size, int flags) +{ + return sys_lsetxattr(path, name, value, size, flags); +} + +int vfswrap_fsetxattr(struct vfs_handle_struct *handle, struct files_struct *fsp,int fd, const char *name, const void *value, size_t size, int flags) +{ + return sys_fsetxattr(fd, name, value, size, flags); +} diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c index 5fcf9a575e..5f3abe7efe 100644 --- a/source3/smbd/vfs.c +++ b/source3/smbd/vfs.c @@ -28,9 +28,9 @@ #define DBGC_CLASS DBGC_VFS struct vfs_init_function_entry { - char *name; - vfs_op_tuple *ops, *(*init)(const struct vfs_ops *, struct smb_vfs_handle_struct *); - struct vfs_init_function_entry *prev, *next; + char *name; + vfs_op_tuple *vfs_op_tuples; + struct vfs_init_function_entry *prev, *next; }; static struct vfs_init_function_entry *backends = NULL; @@ -42,96 +42,106 @@ struct vfs_syminfo { void *fptr; }; -/* - Opaque (final) vfs operations. This is a combination of first-met opaque vfs operations - across all currently processed modules. */ - -static vfs_op_tuple vfs_opaque_ops[SMB_VFS_OP_LAST]; - /* Default vfs hooks. WARNING: The order of these initialisers is very important. They must be in the same order as defined in vfs.h. Change at your own peril. */ -static struct vfs_ops default_vfs_ops = { - - /* Disk operations */ - - vfswrap_dummy_connect, - vfswrap_dummy_disconnect, - vfswrap_disk_free, - - /* Directory operations */ - - vfswrap_opendir, - vfswrap_readdir, - vfswrap_mkdir, - vfswrap_rmdir, - vfswrap_closedir, - - /* File operations */ - - vfswrap_open, - vfswrap_close, - vfswrap_read, - vfswrap_write, - vfswrap_lseek, - vfswrap_sendfile, - vfswrap_rename, - vfswrap_fsync, - vfswrap_stat, - vfswrap_fstat, - vfswrap_lstat, - vfswrap_unlink, - vfswrap_chmod, - vfswrap_fchmod, - vfswrap_chown, - vfswrap_fchown, - vfswrap_chdir, - vfswrap_getwd, - vfswrap_utime, - vfswrap_ftruncate, - vfswrap_lock, - vfswrap_symlink, - vfswrap_readlink, - vfswrap_link, - vfswrap_mknod, - vfswrap_realpath, - - vfswrap_fget_nt_acl, - vfswrap_get_nt_acl, - vfswrap_fset_nt_acl, - vfswrap_set_nt_acl, - - /* POSIX ACL operations. */ -#if defined(HAVE_NO_ACLS) - NULL, - NULL, -#else - vfswrap_chmod_acl, - vfswrap_fchmod_acl, -#endif - vfswrap_sys_acl_get_entry, - vfswrap_sys_acl_get_tag_type, - vfswrap_sys_acl_get_permset, - vfswrap_sys_acl_get_qualifier, - vfswrap_sys_acl_get_file, - vfswrap_sys_acl_get_fd, - vfswrap_sys_acl_clear_perms, - vfswrap_sys_acl_add_perm, - vfswrap_sys_acl_to_text, - vfswrap_sys_acl_init, - vfswrap_sys_acl_create_entry, - vfswrap_sys_acl_set_tag_type, - vfswrap_sys_acl_set_qualifier, - vfswrap_sys_acl_set_permset, - vfswrap_sys_acl_valid, - vfswrap_sys_acl_set_file, - vfswrap_sys_acl_set_fd, - vfswrap_sys_acl_delete_def_file, - vfswrap_sys_acl_get_perm, - vfswrap_sys_acl_free_text, - vfswrap_sys_acl_free_acl, - vfswrap_sys_acl_free_qualifier +static struct vfs_ops default_vfs = { + + { + /* Disk operations */ + + vfswrap_dummy_connect, + vfswrap_dummy_disconnect, + vfswrap_disk_free, + vfswrap_get_quota, + vfswrap_set_quota, + + /* Directory operations */ + + vfswrap_opendir, + vfswrap_readdir, + vfswrap_mkdir, + vfswrap_rmdir, + vfswrap_closedir, + + /* File operations */ + + vfswrap_open, + vfswrap_close, + vfswrap_read, + vfswrap_write, + vfswrap_lseek, + vfswrap_sendfile, + vfswrap_rename, + vfswrap_fsync, + vfswrap_stat, + vfswrap_fstat, + vfswrap_lstat, + vfswrap_unlink, + vfswrap_chmod, + vfswrap_fchmod, + vfswrap_chown, + vfswrap_fchown, + vfswrap_chdir, + vfswrap_getwd, + vfswrap_utime, + vfswrap_ftruncate, + vfswrap_lock, + vfswrap_symlink, + vfswrap_readlink, + vfswrap_link, + vfswrap_mknod, + vfswrap_realpath, + + /* Windows ACL operations. */ + vfswrap_fget_nt_acl, + vfswrap_get_nt_acl, + vfswrap_fset_nt_acl, + vfswrap_set_nt_acl, + + /* POSIX ACL operations. */ + vfswrap_chmod_acl, + vfswrap_fchmod_acl, + + vfswrap_sys_acl_get_entry, + vfswrap_sys_acl_get_tag_type, + vfswrap_sys_acl_get_permset, + vfswrap_sys_acl_get_qualifier, + vfswrap_sys_acl_get_file, + vfswrap_sys_acl_get_fd, + vfswrap_sys_acl_clear_perms, + vfswrap_sys_acl_add_perm, + vfswrap_sys_acl_to_text, + vfswrap_sys_acl_init, + vfswrap_sys_acl_create_entry, + vfswrap_sys_acl_set_tag_type, + vfswrap_sys_acl_set_qualifier, + vfswrap_sys_acl_set_permset, + vfswrap_sys_acl_valid, + vfswrap_sys_acl_set_file, + vfswrap_sys_acl_set_fd, + vfswrap_sys_acl_delete_def_file, + vfswrap_sys_acl_get_perm, + vfswrap_sys_acl_free_text, + vfswrap_sys_acl_free_acl, + vfswrap_sys_acl_free_qualifier, + + /* EA operations. */ + vfswrap_getxattr, + vfswrap_lgetxattr, + vfswrap_fgetxattr, + vfswrap_listxattr, + vfswrap_llistxattr, + vfswrap_flistxattr, + vfswrap_removexattr, + vfswrap_lremovexattr, + vfswrap_fremovexattr, + vfswrap_setxattr, + vfswrap_lsetxattr, + vfswrap_fsetxattr + + } }; /**************************************************************************** @@ -140,52 +150,46 @@ static struct vfs_ops default_vfs_ops = { static struct vfs_init_function_entry *vfs_find_backend_entry(const char *name) { - struct vfs_init_function_entry *entry = backends; - pstring stripped; - - module_path_get_name(name, stripped); - - while(entry) { - if (strequal(entry->name, stripped)) return entry; - entry = entry->next; - } + struct vfs_init_function_entry *entry = backends; + + while(entry) { + if (strcmp(entry->name, name)==0) return entry; + entry = entry->next; + } - return NULL; + return NULL; } -NTSTATUS smb_register_vfs(int version, const char *name, vfs_op_tuple *(*init)(const struct vfs_ops *, struct smb_vfs_handle_struct *)) +NTSTATUS smb_register_vfs(int version, const char *name, vfs_op_tuple *vfs_op_tuples) { - struct vfs_init_function_entry *entry = backends; - - if ((version < SMB_VFS_INTERFACE_CASCADED)) { - DEBUG(0, ("vfs_init() returned wrong interface version info (was %d, should be no less than %d)\n", - version, SMB_VFS_INTERFACE_VERSION )); - return NT_STATUS_OBJECT_TYPE_MISMATCH; - } - - if ((version < SMB_VFS_INTERFACE_VERSION)) { - DEBUG(0, ("Warning: vfs_init() states that module confirms interface version #%d, current interface version is #%d.\n\ - Proceeding in compatibility mode, new operations (since version #%d) will fallback to default ones.\n", - version, SMB_VFS_INTERFACE_VERSION, version )); - return NT_STATUS_OBJECT_TYPE_MISMATCH; - } - - if (!name || !init) { - return NT_STATUS_INVALID_PARAMETER; - } - - if (vfs_find_backend_entry(name)) { - DEBUG(0,("VFS module %s already loaded!\n", name)); - return NT_STATUS_OBJECT_NAME_COLLISION; - } - - entry = smb_xmalloc(sizeof(struct vfs_init_function_entry)); - entry->name = smb_xstrdup(name); - entry->init = init; - - DLIST_ADD(backends, entry); - DEBUG(5, ("Successfully added vfs backend '%s'\n", name)); - return NT_STATUS_OK; + struct vfs_init_function_entry *entry = backends; + + if ((version != SMB_VFS_INTERFACE_VERSION)) { + DEBUG(0, ("Failed to register vfs module.\n" + "The module was compiled against SMB_VFS_INTERFACE_VERSION %d,\n" + "current SMB_VFS_INTERFACE_VERSION is %d.\n" + "Please recompile against the current Samba Version!\n", + version, SMB_VFS_INTERFACE_VERSION)); + return NT_STATUS_OBJECT_TYPE_MISMATCH; + } + + if (!name || !name[0] || !vfs_op_tuples) { + DEBUG(0,("smb_register_vfs() called with NULL pointer or empty name!\n")); + return NT_STATUS_INVALID_PARAMETER; + } + + if (vfs_find_backend_entry(name)) { + DEBUG(0,("VFS module %s already loaded!\n", name)); + return NT_STATUS_OBJECT_NAME_COLLISION; + } + + entry = smb_xmalloc(sizeof(struct vfs_init_function_entry)); + entry->name = smb_xstrdup(name); + entry->vfs_op_tuples = vfs_op_tuples; + + DLIST_ADD(backends, entry); + DEBUG(5, ("Successfully added vfs backend '%s'\n", name)); + return NT_STATUS_OK; } /**************************************************************************** @@ -196,62 +200,10 @@ static void vfs_init_default(connection_struct *conn) { DEBUG(3, ("Initialising default vfs hooks\n")); - memcpy(&conn->vfs_ops, &default_vfs_ops, sizeof(struct vfs_ops)); - conn->vfs_private = NULL; -} - -/*************************************************************************** - Function to load old VFS modules. Should go away after a while. - **************************************************************************/ - -static vfs_op_tuple *vfs_load_old_plugin(connection_struct *conn, const char *vfs_object) -{ - int vfs_version = -1; - vfs_op_tuple *ops, *(*init_fptr)(int *, const struct vfs_ops *, struct smb_vfs_handle_struct *); - /* Open object file */ - - if ((conn->vfs_private->handle = sys_dlopen(vfs_object, RTLD_NOW)) == NULL) { - DEBUG(0, ("Error opening %s: %s\n", vfs_object, sys_dlerror())); - return NULL; - } - - /* Get handle on vfs_init() symbol */ - - init_fptr = (vfs_op_tuple *(*)(int *, const struct vfs_ops *, struct smb_vfs_handle_struct *))sys_dlsym(conn->vfs_private->handle, "vfs_init"); - - if (init_fptr == NULL) { - DEBUG(0, ("No vfs_init() symbol found in %s\n", vfs_object)); - sys_dlclose(conn->vfs_private->handle); - return NULL; - } - - /* Initialise vfs_ops structure */ - if ((ops = init_fptr(&vfs_version, &conn->vfs_ops, conn->vfs_private)) == NULL) { - DEBUG(0, ("vfs_init() function from %s failed\n", vfs_object)); - sys_dlclose(conn->vfs_private->handle); - return NULL; - } - - if ((vfs_version < SMB_VFS_INTERFACE_CASCADED)) { - DEBUG(0, ("vfs_init() returned wrong interface version info (was %d, should be no less than %d)\n", - vfs_version, SMB_VFS_INTERFACE_VERSION )); - sys_dlclose(conn->vfs_private->handle); - return NULL; - } - - if ((vfs_version < SMB_VFS_INTERFACE_VERSION)) { - DEBUG(0, ("Warning: vfs_init() states that module confirms interface version #%d, current interface version is #%d.\n\ - Proceeding in compatibility mode, new operations (since version #%d) will fallback to default ones.\n", - vfs_version, SMB_VFS_INTERFACE_VERSION, vfs_version )); - sys_dlclose(conn->vfs_private->handle); - return NULL; - } - - return ops; + memcpy(&conn->vfs.ops, &default_vfs.ops, sizeof(default_vfs.ops)); + memcpy(&conn->vfs_opaque.ops, &default_vfs.ops, sizeof(default_vfs.ops)); } - - /**************************************************************************** initialise custom vfs hooks ****************************************************************************/ @@ -259,51 +211,82 @@ static vfs_op_tuple *vfs_load_old_plugin(connection_struct *conn, const char *vf BOOL vfs_init_custom(connection_struct *conn, const char *vfs_object) { vfs_op_tuple *ops; + char *module_name = NULL; + char *module_param = NULL, *p; int i; + vfs_handle_struct *handle; struct vfs_init_function_entry *entry; - - DEBUG(3, ("Initialising custom vfs hooks from %s\n", vfs_object)); + + if (!conn||!vfs_object||!vfs_object[0]) { + DEBUG(0,("vfs_init_custon() called with NULL pointer or emtpy vfs_object!\n")); + return False; + } if(!backends) static_init_vfs; + DEBUG(3, ("Initialising custom vfs hooks from [%s]\n", vfs_object)); + + module_name = smb_xstrdup(vfs_object); + + p = strchr(module_name, ':'); + + if (p) { + *p = 0; + module_param = p+1; + trim_string(module_param, " ", " "); + } + + trim_string(module_name, " ", " "); + /* First, try to load the module with the new module system */ - if((entry = vfs_find_backend_entry(vfs_object)) || - (NT_STATUS_IS_OK(smb_probe_module("vfs", vfs_object)) && - (entry = vfs_find_backend_entry(vfs_object)))) { + if((entry = vfs_find_backend_entry(module_name)) || + (NT_STATUS_IS_OK(smb_probe_module("vfs", module_name)) && + (entry = vfs_find_backend_entry(module_name)))) { - DEBUG(3,("Successfully loaded %s with the new modules system\n", vfs_object)); + DEBUGADD(5,("Successfully loaded vfs module [%s] with the new modules system\n", vfs_object)); - if ((ops = entry->init(&conn->vfs_ops, conn->vfs_private)) == NULL) { - DEBUG(0, ("vfs init function from %s failed\n", vfs_object)); - return False; - } + if ((ops = entry->vfs_op_tuples) == NULL) { + DEBUG(0, ("entry->vfs_op_tuples==NULL for [%s] failed\n", vfs_object)); + SAFE_FREE(module_name); + return False; + } } else { - /* If that doesn't work, fall back to the old system - * (This part should go away after a while, it's only here - * for backwards compatibility) */ - DEBUG(2, ("Can't load module %s with new modules system, falling back to compatibility\n", - vfs_object)); - if ((ops = vfs_load_old_plugin(conn, vfs_object)) == NULL) { - DEBUG(0, ("vfs init function from %s failed\n", vfs_object)); - return False; - } + DEBUG(0,("Can't find a vfs module [%s]\n",vfs_object)); + SAFE_FREE(module_name); + return False; + } + + handle = (vfs_handle_struct *)talloc_zero(conn->mem_ctx,sizeof(vfs_handle_struct)); + if (!handle) { + DEBUG(0,("talloc_zero() failed!\n")); + SAFE_FREE(module_name); + return False; } + memcpy(&handle->vfs_next, &conn->vfs, sizeof(struct vfs_ops)); + handle->conn = conn; + if (module_param) { + handle->param = talloc_strdup(conn->mem_ctx, module_param); + } + DLIST_ADD(conn->vfs_handles, handle); for(i=0; ops[i].op != NULL; i++) { - DEBUG(3, ("Checking operation #%d (type %d, layer %d)\n", i, ops[i].type, ops[i].layer)); + DEBUG(5, ("Checking operation #%d (type %d, layer %d)\n", i, ops[i].type, ops[i].layer)); if(ops[i].layer == SMB_VFS_LAYER_OPAQUE) { /* Check whether this operation was already made opaque by different module */ - if(vfs_opaque_ops[ops[i].type].op == ((void**)&default_vfs_ops)[ops[i].type]) { + if(((void**)&conn->vfs_opaque.ops)[ops[i].type] == ((void**)&default_vfs.ops)[ops[i].type]) { /* No, it isn't overloaded yet. Overload. */ - DEBUG(3, ("Making operation type %d opaque [module %s]\n", ops[i].type, vfs_object)); - vfs_opaque_ops[ops[i].type] = ops[i]; + DEBUGADD(5, ("Making operation type %d opaque [module %s]\n", ops[i].type, vfs_object)); + ((void**)&conn->vfs_opaque.ops)[ops[i].type] = ops[i].op; + ((vfs_handle_struct **)&conn->vfs_opaque.handles)[ops[i].type] = handle; } } /* Change current VFS disposition*/ - DEBUG(3, ("Accepting operation type %d from module %s\n", ops[i].type, vfs_object)); - ((void**)&conn->vfs_ops)[ops[i].type] = ops[i].op; + DEBUGADD(5, ("Accepting operation type %d from module %s\n", ops[i].type, vfs_object)); + ((void**)&conn->vfs.ops)[ops[i].type] = ops[i].op; + ((vfs_handle_struct **)&conn->vfs.handles)[ops[i].type] = handle; } + SAFE_FREE(module_name); return True; } @@ -314,70 +297,30 @@ BOOL vfs_init_custom(connection_struct *conn, const char *vfs_object) BOOL smbd_vfs_init(connection_struct *conn) { const char **vfs_objects; - char *vfs_module, *vfs_path; unsigned int i = 0; int j = 0; - struct smb_vfs_handle_struct *handle; /* Normal share - initialise with disk access functions */ vfs_init_default(conn); - vfs_objects = lp_vfsobj(SNUM(conn)); + vfs_objects = lp_vfs_objects(SNUM(conn)); /* Override VFS functions if 'vfs object' was not specified*/ if (!vfs_objects || !vfs_objects[0]) return True; - - for(i=0; i= 0; j--) { - conn->vfs_private = NULL; - handle = (struct smb_vfs_handle_struct *) smb_xmalloc(sizeof(smb_vfs_handle_struct)); - /* Loadable object file */ - handle->handle = NULL; - DLIST_ADD(conn->vfs_private, handle); - vfs_module = NULL; - if (vfs_path && *vfs_path) { - asprintf(&vfs_module, "%s/%s", vfs_path, vfs_objects[j]); - } else { - asprintf(&vfs_module, "%s", vfs_objects[j]); - } - if (!vfs_init_custom(conn, vfs_module)) { - DEBUG(0, ("smbd_vfs_init: vfs_init_custom failed for %s\n", vfs_module)); - SAFE_FREE(vfs_module); - DLIST_REMOVE(conn->vfs_private, handle); - SAFE_FREE(handle); + if (!vfs_init_custom(conn, vfs_objects[j])) { + DEBUG(0, ("smbd_vfs_init: vfs_init_custom failed for %s\n", vfs_objects[j])); return False; } - SAFE_FREE(vfs_module); } return True; } -/******************************************************************* - Create vfs_ops reflecting current vfs_opaque_ops -*******************************************************************/ - -struct vfs_ops *smb_vfs_get_opaque_ops(void) -{ - int i; - struct vfs_ops *ops; - - ops = smb_xmalloc(sizeof(struct vfs_ops)); - - for(i=0; ist_mode); @@ -400,25 +343,16 @@ BOOL vfs_directory_exist(connection_struct *conn, const char *dname, SMB_STRUCT_ return ret; } -/******************************************************************* - vfs getwd wrapper -********************************************************************/ - -static char *vfs_getwd(connection_struct *conn, char *path) -{ - return conn->vfs_ops.getwd(conn,path); -} - /******************************************************************* vfs mkdir wrapper ********************************************************************/ -int vfs_mkdir(connection_struct *conn, const char *name, mode_t mode) +int vfs_MkDir(connection_struct *conn, const char *name, mode_t mode) { int ret; SMB_STRUCT_STAT sbuf; - if(!(ret=conn->vfs_ops.mkdir(conn,name,mode))) { + if(!(ret=SMB_VFS_MKDIR(conn, name, mode))) { inherit_access_acl(conn, name, mode); @@ -428,8 +362,8 @@ int vfs_mkdir(connection_struct *conn, const char *name, mode_t mode) * Consider bits automagically set by UNIX, i.e. SGID bit from parent dir. */ if(mode & ~(S_IRWXU|S_IRWXG|S_IRWXO) && - !vfs_stat(conn,name,&sbuf) && (mode & ~sbuf.st_mode)) - vfs_chmod(conn,name,sbuf.st_mode | (mode & ~sbuf.st_mode)); + !SMB_VFS_STAT(conn,name,&sbuf) && (mode & ~sbuf.st_mode)) + SMB_VFS_CHMOD(conn,name,sbuf.st_mode | (mode & ~sbuf.st_mode)); } return ret; } @@ -447,7 +381,7 @@ BOOL vfs_object_exist(connection_struct *conn,const char *fname,SMB_STRUCT_STAT ZERO_STRUCTP(sbuf); - if (vfs_stat(conn,fname,sbuf) == -1) + if (SMB_VFS_STAT(conn,fname,sbuf) == -1) return(False); return True; } @@ -465,7 +399,7 @@ BOOL vfs_file_exist(connection_struct *conn, const char *fname,SMB_STRUCT_STAT * ZERO_STRUCTP(sbuf); - if (vfs_stat(conn,fname,sbuf) == -1) + if (SMB_VFS_STAT(conn,fname,sbuf) == -1) return False; return(S_ISREG(sbuf->st_mode)); } @@ -480,7 +414,7 @@ ssize_t vfs_read_data(files_struct *fsp, char *buf, size_t byte_count) while (total < byte_count) { - ssize_t ret = fsp->conn->vfs_ops.read(fsp, fsp->fd, buf + total, + ssize_t ret = SMB_VFS_READ(fsp, fsp->fd, buf + total, byte_count - total); if (ret == 0) return total; @@ -505,7 +439,7 @@ ssize_t vfs_write_data(files_struct *fsp,const char *buffer,size_t N) ssize_t ret; while (total < N) { - ret = fsp->conn->vfs_ops.write(fsp,fsp->fd,buffer + total,N - total); + ret = SMB_VFS_WRITE(fsp,fsp->fd,buffer + total,N - total); if (ret == -1) return -1; @@ -528,7 +462,6 @@ int vfs_allocate_file_space(files_struct *fsp, SMB_BIG_UINT len) int ret; SMB_STRUCT_STAT st; connection_struct *conn = fsp->conn; - struct vfs_ops *vfs_ops = &conn->vfs_ops; SMB_BIG_UINT space_avail; SMB_BIG_UINT bsize,dfree,dsize; @@ -545,7 +478,7 @@ int vfs_allocate_file_space(files_struct *fsp, SMB_BIG_UINT len) return -1; } - ret = vfs_fstat(fsp,fsp->fd,&st); + ret = SMB_VFS_FSTAT(fsp,fsp->fd,&st); if (ret == -1) return ret; @@ -559,7 +492,7 @@ int vfs_allocate_file_space(files_struct *fsp, SMB_BIG_UINT len) fsp->fsp_name, (double)st.st_size )); flush_write_cache(fsp, SIZECHANGE_FLUSH); - if ((ret = vfs_ops->ftruncate(fsp, fsp->fd, (SMB_OFF_T)len)) != -1) { + if ((ret = SMB_VFS_FTRUNCATE(fsp, fsp->fd, (SMB_OFF_T)len)) != -1) { set_filelen_write_cache(fsp, len); } return ret; @@ -572,7 +505,7 @@ int vfs_allocate_file_space(files_struct *fsp, SMB_BIG_UINT len) len -= st.st_size; len /= 1024; /* Len is now number of 1k blocks needed. */ - space_avail = conn->vfs_ops.disk_free(conn,fsp->fsp_name,False,&bsize,&dfree,&dsize); + space_avail = SMB_VFS_DISK_FREE(conn,fsp->fsp_name,False,&bsize,&dfree,&dsize); DEBUG(10,("vfs_allocate_file_space: file %s, grow. Current size %.0f, needed blocks = %.0f, space avail = %.0f\n", fsp->fsp_name, (double)st.st_size, (double)len, (double)space_avail )); @@ -598,7 +531,7 @@ int vfs_set_filelen(files_struct *fsp, SMB_OFF_T len) release_level_2_oplocks_on_change(fsp); DEBUG(10,("vfs_set_filelen: ftruncate %s to len %.0f\n", fsp->fsp_name, (double)len)); flush_write_cache(fsp, SIZECHANGE_FLUSH); - if ((ret = fsp->conn->vfs_ops.ftruncate(fsp, fsp->fd, len)) != -1) + if ((ret = SMB_VFS_FTRUNCATE(fsp, fsp->fd, len)) != -1) set_filelen_write_cache(fsp, len); return ret; @@ -613,12 +546,12 @@ static files_struct *out_fsp; static ssize_t read_fn(int fd, void *buf, size_t len) { - return in_fsp->conn->vfs_ops.read(in_fsp, fd, buf, len); + return SMB_VFS_READ(in_fsp, fd, buf, len); } static ssize_t write_fn(int fd, const void *buf, size_t len) { - return out_fsp->conn->vfs_ops.write(out_fsp, fd, buf, len); + return SMB_VFS_WRITE(out_fsp, fd, buf, len); } SMB_OFF_T vfs_transfer_file(files_struct *in, files_struct *out, SMB_OFF_T n) @@ -635,13 +568,13 @@ SMB_OFF_T vfs_transfer_file(files_struct *in, files_struct *out, SMB_OFF_T n) char *vfs_readdirname(connection_struct *conn, void *p) { - struct dirent *ptr; + struct dirent *ptr= NULL; char *dname; if (!p) return(NULL); - ptr = (struct dirent *)conn->vfs_ops.readdir(conn,p); + ptr = (struct dirent *)SMB_VFS_READDIR(conn,p); if (!ptr) return(NULL); @@ -660,72 +593,6 @@ char *vfs_readdirname(connection_struct *conn, void *p) return(dname); } -/* VFS options not quite working yet */ - -#if 0 - -/*************************************************************************** - handle the interpretation of the vfs option parameter - *************************************************************************/ -static BOOL handle_vfs_option(char *pszParmValue, char **ptr) -{ - struct vfs_options *new_option, **options = (struct vfs_options **)ptr; - int i; - - /* Create new vfs option */ - - new_option = (struct vfs_options *)malloc(sizeof(*new_option)); - if (new_option == NULL) { - return False; - } - - ZERO_STRUCTP(new_option); - - /* Get name and value */ - - new_option->name = strtok(pszParmValue, "="); - - if (new_option->name == NULL) { - return False; - } - - while(isspace(*new_option->name)) { - new_option->name++; - } - - for (i = strlen(new_option->name); i > 0; i--) { - if (!isspace(new_option->name[i - 1])) break; - } - - new_option->name[i] = '\0'; - new_option->name = strdup(new_option->name); - - new_option->value = strtok(NULL, "="); - - if (new_option->value != NULL) { - - while(isspace(*new_option->value)) { - new_option->value++; - } - - for (i = strlen(new_option->value); i > 0; i--) { - if (!isspace(new_option->value[i - 1])) break; - } - - new_option->value[i] = '\0'; - new_option->value = strdup(new_option->value); - } - - /* Add to list */ - - DLIST_ADD(*options, new_option); - - return True; -} - -#endif - - /******************************************************************* A wrapper for vfs_chdir(). ********************************************************************/ @@ -741,9 +608,9 @@ int vfs_ChDir(connection_struct *conn, const char *path) if (*path == '/' && strcsequal(LastDir,path)) return(0); - DEBUG(3,("vfs_ChDir to %s\n",path)); + DEBUG(4,("vfs_ChDir to %s\n",path)); - res = vfs_chdir(conn,path); + res = SMB_VFS_CHDIR(conn,path); if (!res) pstrcpy(LastDir,path); return(res); @@ -800,7 +667,7 @@ char *vfs_GetWd(connection_struct *conn, char *path) *s = 0; if (!use_getwd_cache) - return(vfs_getwd(conn,path)); + return(SMB_VFS_GETWD(conn,path)); /* init the cache */ if (!getwd_cache_init) { @@ -814,9 +681,9 @@ char *vfs_GetWd(connection_struct *conn, char *path) /* Get the inode of the current directory, if this doesn't work we're in trouble :-) */ - if (vfs_stat(conn, ".",&st) == -1) { + if (SMB_VFS_STAT(conn, ".",&st) == -1) { DEBUG(0,("Very strange, couldn't stat \".\" path=%s\n", path)); - return(vfs_getwd(conn,path)); + return(SMB_VFS_GETWD(conn,path)); } @@ -830,7 +697,7 @@ char *vfs_GetWd(connection_struct *conn, char *path) the same...) */ if (st.st_ino == ino_list[i].inode && st.st_dev == ino_list[i].dev) { - if (vfs_stat(conn,ino_list[i].dos_path,&st2) == 0) { + if (SMB_VFS_STAT(conn,ino_list[i].dos_path,&st2) == 0) { if (st.st_ino == st2.st_ino && st.st_dev == st2.st_dev && (st2.st_mode & S_IFMT) == S_IFDIR) { pstrcpy (path, ino_list[i].dos_path); @@ -852,8 +719,8 @@ char *vfs_GetWd(connection_struct *conn, char *path) The very slow getcwd, which spawns a process on some systems, or the not quite so bad getwd. */ - if (!vfs_getwd(conn,s)) { - DEBUG(0,("vfs_GetWd: vfs_getwd call failed, errno %s\n",strerror(errno))); + if (!SMB_VFS_GETWD(conn,s)) { + DEBUG(0,("vfs_GetWd: SMB_VFS_GETWD call failed, errno %s\n",strerror(errno))); return (NULL); } @@ -909,7 +776,7 @@ static BOOL readlink_check(connection_struct *conn, const char *dir, char *name) realdir[reallen] = 0; } - if (conn->vfs_ops.readlink(conn, name, flink, sizeof(pstring) -1) != -1) { + if (SMB_VFS_READLINK(conn, name, flink, sizeof(pstring) -1) != -1) { DEBUG(3,("reduce_name: file path name %s is a symlink\nChecking it's path\n", name)); if (*flink == '/') { pstrcpy(cleanlink, flink); diff --git a/source3/smbwrapper/shared.c b/source3/smbwrapper/shared.c index b4cfcf7148..ca8df5841d 100644 --- a/source3/smbwrapper/shared.c +++ b/source3/smbwrapper/shared.c @@ -179,8 +179,8 @@ void smbw_setshared(const char *name, const char *val) SSVAL(&variables[shared_size], 0, l1); SSVAL(&variables[shared_size], 2, l2); - pstrcpy(&variables[shared_size] + 4, name); - pstrcpy(&variables[shared_size] + 4 + l1, val); + safe_strcpy(&variables[shared_size] + 4, name, l1-1); + safe_strcpy(&variables[shared_size] + 4 + l1, val, l2-1); shared_size += l1+l2+4; diff --git a/source3/smbwrapper/smbw_dir.c b/source3/smbwrapper/smbw_dir.c index 31d81a1e7e..6d55c1d9da 100644 --- a/source3/smbwrapper/smbw_dir.c +++ b/source3/smbwrapper/smbw_dir.c @@ -216,7 +216,7 @@ int smbw_dir_open(const char *fname) smbw_NetServerEnum(&srv->cli, srv->server_name, SV_TYPE_ALL, smbw_server_add, NULL); *p = '#'; - } else if (strcmp(srv->cli.dev,"IPC") == 0) { + } else if ((strcmp(srv->cli.dev,"IPC") == 0) || (strcasecmp(share,"IPC$") == 0)) { DEBUG(4,("doing NetShareEnum\n")); smbw_share_add(".",0,"", NULL); smbw_share_add("..",0,"", NULL); @@ -412,7 +412,8 @@ int smbw_chdir(const char *name) goto failed; } - if (strncmp(srv->cli.dev,"IPC",3) && + if (strncmp(srv->cli.dev,"IPC",3) && + strcasecmp(share, "IPC$") && strncmp(srv->cli.dev,"LPT",3) && !smbw_getatr(srv, path, &mode, NULL, NULL, NULL, NULL, NULL)) { diff --git a/source3/tdb/tdb.c b/source3/tdb/tdb.c index c414ae0d31..34681ea78f 100644 --- a/source3/tdb/tdb.c +++ b/source3/tdb/tdb.c @@ -1257,7 +1257,8 @@ static int tdb_next_lock(TDB_CONTEXT *tdb, struct tdb_traverse_lock *tlock, /* Try to clean dead ones from old traverses */ current = tlock->off; tlock->off = rec->next; - if (do_delete(tdb, current, rec) != 0) + if (!tdb->read_only && + do_delete(tdb, current, rec) != 0) goto fail; } tdb_unlock(tdb, tlock->hash, F_WRLCK); diff --git a/source3/tdb/tdbbackup.c b/source3/tdb/tdbbackup.c index 36ba7db918..0eaf6b6c0b 100644 --- a/source3/tdb/tdbbackup.c +++ b/source3/tdb/tdbbackup.c @@ -55,175 +55,7 @@ #include #include #include "tdb.h" - -static int failed; - -static char *add_suffix(const char *name, const char *suffix) -{ - char *ret; - int len = strlen(name) + strlen(suffix) + 1; - ret = malloc(len); - if (!ret) { - fprintf(stderr,"Out of memory!\n"); - exit(1); - } - strncpy(ret, name, len); - strncat(ret, suffix, len); - return ret; -} - -static int copy_fn(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA dbuf, void *state) -{ - TDB_CONTEXT *tdb_new = (TDB_CONTEXT *)state; - - if (tdb_store(tdb_new, key, dbuf, TDB_INSERT) != 0) { - fprintf(stderr,"Failed to insert into %s\n", tdb_new->name); - failed = 1; - return 1; - } - return 0; -} - - -static int test_fn(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA dbuf, void *state) -{ - return 0; -} - -/* - carefully backup a tdb, validating the contents and - only doing the backup if its OK - this function is also used for restore -*/ -static int backup_tdb(const char *old_name, const char *new_name) -{ - TDB_CONTEXT *tdb; - TDB_CONTEXT *tdb_new; - char *tmp_name; - struct stat st; - int count1, count2; - - tmp_name = add_suffix(new_name, ".tmp"); - - /* stat the old tdb to find its permissions */ - if (stat(old_name, &st) != 0) { - perror(old_name); - return 1; - } - - /* open the old tdb */ - tdb = tdb_open(old_name, 0, 0, O_RDWR, 0); - if (!tdb) { - printf("Failed to open %s\n", old_name); - return 1; - } - - /* create the new tdb */ - unlink(tmp_name); - tdb_new = tdb_open(tmp_name, tdb->header.hash_size, - TDB_DEFAULT, O_RDWR|O_CREAT|O_EXCL, - st.st_mode & 0777); - if (!tdb_new) { - perror(tmp_name); - free(tmp_name); - return 1; - } - - /* lock the old tdb */ - if (tdb_lockall(tdb) != 0) { - fprintf(stderr,"Failed to lock %s\n", old_name); - tdb_close(tdb); - tdb_close(tdb_new); - unlink(tmp_name); - free(tmp_name); - return 1; - } - - failed = 0; - - /* traverse and copy */ - count1 = tdb_traverse(tdb, copy_fn, (void *)tdb_new); - if (count1 < 0 || failed) { - fprintf(stderr,"failed to copy %s\n", old_name); - tdb_close(tdb); - tdb_close(tdb_new); - unlink(tmp_name); - free(tmp_name); - return 1; - } - - /* close the old tdb */ - tdb_close(tdb); - - /* close the new tdb and re-open read-only */ - tdb_close(tdb_new); - tdb_new = tdb_open(tmp_name, 0, TDB_DEFAULT, O_RDONLY, 0); - if (!tdb_new) { - fprintf(stderr,"failed to reopen %s\n", tmp_name); - unlink(tmp_name); - perror(tmp_name); - free(tmp_name); - return 1; - } - - /* traverse the new tdb to confirm */ - count2 = tdb_traverse(tdb_new, test_fn, 0); - if (count2 != count1) { - fprintf(stderr,"failed to copy %s\n", old_name); - tdb_close(tdb_new); - unlink(tmp_name); - free(tmp_name); - return 1; - } - - /* make sure the new tdb has reached stable storage */ - fsync(tdb_new->fd); - - /* close the new tdb and rename it to .bak */ - tdb_close(tdb_new); - unlink(new_name); - if (rename(tmp_name, new_name) != 0) { - perror(new_name); - free(tmp_name); - return 1; - } - - printf("%s : %d records\n", old_name, count1); - free(tmp_name); - - return 0; -} - - - -/* - verify a tdb and if it is corrupt then restore from *.bak -*/ -static int verify_tdb(const char *fname, const char *bak_name) -{ - TDB_CONTEXT *tdb; - int count = -1; - - /* open the tdb */ - tdb = tdb_open(fname, 0, 0, O_RDONLY, 0); - - /* traverse the tdb, then close it */ - if (tdb) { - count = tdb_traverse(tdb, test_fn, NULL); - tdb_close(tdb); - } - - /* count is < 0 means an error */ - if (count < 0) { - printf("restoring %s\n", fname); - return backup_tdb(bak_name, fname); - } - - printf("%s : %d records\n", fname, count); - - return 0; -} - +#include "tdbback.h" /* see if one file is newer than another @@ -245,7 +77,7 @@ static void usage(void) printf("Usage: tdbbackup [options] \n\n"); printf(" -h this help message\n"); printf(" -s suffix set the backup suffix\n"); - printf(" -v veryify mode (restore if corrupt)\n"); + printf(" -v verify mode (restore if corrupt)\n"); } @@ -255,7 +87,7 @@ static void usage(void) int ret = 0; int c; int verify = 0; - char *suffix = ".bak"; + const char *suffix = ".bak"; extern int optind; extern char *optarg; diff --git a/source3/tdb/tdbutil.c b/source3/tdb/tdbutil.c index 19dfe642df..b01dacd0f5 100644 --- a/source3/tdb/tdbutil.c +++ b/source3/tdb/tdbutil.c @@ -266,7 +266,7 @@ BOOL tdb_store_uint32(TDB_CONTEXT *tdb, const char *keystr, uint32 value) on failure. ****************************************************************************/ -int tdb_store_by_string(TDB_CONTEXT *tdb, const char *keystr, TDB_DATA data, int flags) +int tdb_store_bystring(TDB_CONTEXT *tdb, const char *keystr, TDB_DATA data, int flags) { TDB_DATA key = make_tdb_data(keystr, strlen(keystr)+1); @@ -278,7 +278,7 @@ int tdb_store_by_string(TDB_CONTEXT *tdb, const char *keystr, TDB_DATA data, int free() on the result dptr. ****************************************************************************/ -TDB_DATA tdb_fetch_by_string(TDB_CONTEXT *tdb, const char *keystr) +TDB_DATA tdb_fetch_bystring(TDB_CONTEXT *tdb, const char *keystr) { TDB_DATA key = make_tdb_data(keystr, strlen(keystr)+1); @@ -289,7 +289,7 @@ TDB_DATA tdb_fetch_by_string(TDB_CONTEXT *tdb, const char *keystr) Delete an entry using a null terminated string key. ****************************************************************************/ -int tdb_delete_by_string(TDB_CONTEXT *tdb, const char *keystr) +int tdb_delete_bystring(TDB_CONTEXT *tdb, const char *keystr) { TDB_DATA key = make_tdb_data(keystr, strlen(keystr)+1); @@ -821,6 +821,7 @@ void tdb_search_list_free(TDB_LIST_NODE* node) while (node) { next_node = node->next; + SAFE_FREE(node->node_key.dptr); SAFE_FREE(node); node = next_node; }; diff --git a/source3/torture/cmd_vfs.c b/source3/torture/cmd_vfs.c index b90c53e9fe..f74fcedcf4 100644 --- a/source3/torture/cmd_vfs.c +++ b/source3/torture/cmd_vfs.c @@ -23,37 +23,28 @@ #include "includes.h" #include "vfstest.h" -static char *null_string = ""; +static const char *null_string = ""; -static NTSTATUS cmd_load_module(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_load_module(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { - struct smb_vfs_handle_struct *handle; - char *path = lp_vfs_path(0); - char name[PATH_MAX]; + int i; - if (argc != 2) { - printf("Usage: load \n"); + if (argc < 2) { + printf("Usage: load \n"); return NT_STATUS_OK; } - if (path != NULL && *path != '\0') { - snprintf(name, PATH_MAX, "%s/%s", path, argv[1]); - } else { - snprintf(name, PATH_MAX, "%s", argv[1]); - } - vfs->conn->vfs_private = NULL; - handle = (struct smb_vfs_handle_struct *) smb_xmalloc(sizeof(smb_vfs_handle_struct)); - handle->handle = NULL; - DLIST_ADD(vfs->conn->vfs_private, handle) - if (!vfs_init_custom(vfs->conn, name)) { - DEBUG(0, ("load: error=-1 (vfs_init_custom failed for %s)\n", argv[1])); - return NT_STATUS_UNSUCCESSFUL; + for (i=argc-1;i>0;i--) { + if (!vfs_init_custom(vfs->conn, argv[i])) { + DEBUG(0, ("load: (vfs_init_custom failed for %s)\n", argv[i])); + return NT_STATUS_UNSUCCESSFUL; + } } printf("load: ok\n"); return NT_STATUS_OK; } -static NTSTATUS cmd_populate(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_populate(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { char c; size_t size; @@ -73,7 +64,7 @@ static NTSTATUS cmd_populate(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int arg return NT_STATUS_OK; } -static NTSTATUS cmd_show_data(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_show_data(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { size_t offset; size_t len; @@ -101,19 +92,19 @@ static NTSTATUS cmd_show_data(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int ar return NT_STATUS_OK; } -static NTSTATUS cmd_connect(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_connect(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { - vfs->conn->vfs_ops.connect(vfs->conn, lp_servicename(vfs->conn->service), "vfstest"); + SMB_VFS_CONNECT(vfs->conn, lp_servicename(vfs->conn->service), "vfstest"); return NT_STATUS_OK; } -static NTSTATUS cmd_disconnect(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_disconnect(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { - vfs->conn->vfs_ops.disconnect(vfs->conn); + SMB_VFS_DISCONNECT(vfs->conn); return NT_STATUS_OK; } -static NTSTATUS cmd_disk_free(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_disk_free(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { SMB_BIG_UINT diskfree, bsize, dfree, dsize; if (argc != 2) { @@ -121,7 +112,7 @@ static NTSTATUS cmd_disk_free(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int ar return NT_STATUS_OK; } - diskfree = vfs->conn->vfs_ops.disk_free(vfs->conn, argv[1], False, &bsize, &dfree, &dsize); + diskfree = SMB_VFS_DISK_FREE(vfs->conn, argv[1], False, &bsize, &dfree, &dsize); printf("disk_free: %lu, bsize = %lu, dfree = %lu, dsize = %lu\n", (unsigned long)diskfree, (unsigned long)bsize, @@ -131,14 +122,14 @@ static NTSTATUS cmd_disk_free(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int ar } -static NTSTATUS cmd_opendir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_opendir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { if (argc != 2) { printf("Usage: opendir \n"); return NT_STATUS_OK; } - vfs->currentdir = vfs->conn->vfs_ops.opendir(vfs->conn, argv[1]); + vfs->currentdir = SMB_VFS_OPENDIR(vfs->conn, argv[1]); if (vfs->currentdir == NULL) { printf("opendir error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; @@ -149,7 +140,7 @@ static NTSTATUS cmd_opendir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc } -static NTSTATUS cmd_readdir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_readdir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { struct dirent *dent; @@ -158,7 +149,7 @@ static NTSTATUS cmd_readdir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc return NT_STATUS_UNSUCCESSFUL; } - dent = vfs->conn->vfs_ops.readdir(vfs->conn, vfs->currentdir); + dent = SMB_VFS_READDIR(vfs->conn, vfs->currentdir); if (dent == NULL) { printf("readdir: NULL\n"); return NT_STATUS_OK; @@ -169,14 +160,14 @@ static NTSTATUS cmd_readdir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc } -static NTSTATUS cmd_mkdir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_mkdir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { if (argc != 2) { printf("Usage: mkdir \n"); return NT_STATUS_OK; } - if (vfs->conn->vfs_ops.mkdir(vfs->conn, argv[1], 00755) == -1) { + if (SMB_VFS_MKDIR(vfs->conn, argv[1], 00755) == -1) { printf("mkdir error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } @@ -186,7 +177,7 @@ static NTSTATUS cmd_mkdir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } -static NTSTATUS cmd_closedir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_closedir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { int ret; @@ -195,7 +186,7 @@ static NTSTATUS cmd_closedir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int arg return NT_STATUS_UNSUCCESSFUL; } - ret = vfs->conn->vfs_ops.closedir(vfs->conn, vfs->currentdir); + ret = SMB_VFS_CLOSEDIR(vfs->conn, vfs->currentdir); if (ret == -1) { printf("closedir failure: %s\n", strerror(errno)); return NT_STATUS_UNSUCCESSFUL; @@ -207,11 +198,11 @@ static NTSTATUS cmd_closedir(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int arg } -static NTSTATUS cmd_open(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_open(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { int flags, fd; mode_t mode; - char *flagstr; + const char *flagstr; mode = 00400; @@ -287,7 +278,7 @@ static NTSTATUS cmd_open(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, c } } - fd = vfs->conn->vfs_ops.open(vfs->conn, argv[1], flags, mode); + fd = SMB_VFS_OPEN(vfs->conn, argv[1], flags, mode); if (fd == -1) { printf("open: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; @@ -302,7 +293,7 @@ static NTSTATUS cmd_open(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, c } -static NTSTATUS cmd_pathfunc(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_pathfunc(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { int ret = -1; @@ -312,11 +303,11 @@ static NTSTATUS cmd_pathfunc(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int arg } if (strcmp("rmdir", argv[0]) == 0 ) { - ret = vfs->conn->vfs_ops.rmdir(vfs->conn, argv[1]); + ret = SMB_VFS_RMDIR(vfs->conn, argv[1]); } else if (strcmp("unlink", argv[0]) == 0 ) { - ret = vfs->conn->vfs_ops.unlink(vfs->conn, argv[1]); + ret = SMB_VFS_UNLINK(vfs->conn, argv[1]); } else if (strcmp("chdir", argv[0]) == 0 ) { - ret = vfs->conn->vfs_ops.chdir(vfs->conn, argv[1]); + ret = SMB_VFS_CHDIR(vfs->conn, argv[1]); } else { printf("%s: error=%d (invalid function name!)\n", argv[0], errno); return NT_STATUS_UNSUCCESSFUL; @@ -332,7 +323,7 @@ static NTSTATUS cmd_pathfunc(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int arg } -static NTSTATUS cmd_close(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_close(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { int fd, ret; @@ -347,7 +338,7 @@ static NTSTATUS cmd_close(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, return NT_STATUS_OK; } - ret = vfs->conn->vfs_ops.close(vfs->files[fd], fd); + ret = SMB_VFS_CLOSE(vfs->files[fd], fd); if (ret == -1 ) printf("close: error=%d (%s)\n", errno, strerror(errno)); else @@ -360,7 +351,7 @@ static NTSTATUS cmd_close(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } -static NTSTATUS cmd_read(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_read(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { int fd; size_t size, rsize; @@ -380,7 +371,7 @@ static NTSTATUS cmd_read(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, c } vfs->data_size = size; - rsize = vfs->conn->vfs_ops.read(vfs->files[fd], fd, vfs->data, size); + rsize = SMB_VFS_READ(vfs->files[fd], fd, vfs->data, size); if (rsize == -1) { printf("read: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; @@ -391,7 +382,7 @@ static NTSTATUS cmd_read(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, c } -static NTSTATUS cmd_write(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_write(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { int fd, size, wsize; @@ -413,7 +404,7 @@ static NTSTATUS cmd_write(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, return NT_STATUS_UNSUCCESSFUL; } - wsize = vfs->conn->vfs_ops.write(vfs->files[fd], fd, vfs->data, size); + wsize = SMB_VFS_WRITE(vfs->files[fd], fd, vfs->data, size); if (wsize == -1) { printf("write: error=%d (%s)\n", errno, strerror(errno)); @@ -425,7 +416,7 @@ static NTSTATUS cmd_write(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } -static NTSTATUS cmd_lseek(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_lseek(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { int fd, offset, whence; SMB_OFF_T pos; @@ -444,7 +435,7 @@ static NTSTATUS cmd_lseek(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, default: whence = SEEK_END; } - pos = vfs->conn->vfs_ops.lseek(vfs->files[fd], fd, offset, whence); + pos = SMB_VFS_LSEEK(vfs->files[fd], fd, offset, whence); if (pos == (SMB_OFF_T)-1) { printf("lseek: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; @@ -455,7 +446,7 @@ static NTSTATUS cmd_lseek(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } -static NTSTATUS cmd_rename(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_rename(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { int ret; if (argc != 3) { @@ -463,7 +454,7 @@ static NTSTATUS cmd_rename(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, return NT_STATUS_OK; } - ret = vfs->conn->vfs_ops.rename(vfs->conn, argv[1], argv[2]); + ret = SMB_VFS_RENAME(vfs->conn, argv[1], argv[2]); if (ret == -1) { printf("rename: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; @@ -474,7 +465,7 @@ static NTSTATUS cmd_rename(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } -static NTSTATUS cmd_fsync(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_fsync(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { int ret, fd; if (argc != 2) { @@ -483,7 +474,7 @@ static NTSTATUS cmd_fsync(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } fd = atoi(argv[1]); - ret = vfs->conn->vfs_ops.fsync(vfs->files[fd], fd); + ret = SMB_VFS_FSYNC(vfs->files[fd], fd); if (ret == -1) { printf("fsync: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; @@ -494,11 +485,11 @@ static NTSTATUS cmd_fsync(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } -static NTSTATUS cmd_stat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_stat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { int ret; - char *user; - char *group; + const char *user; + const char *group; struct passwd *pwd; struct group *grp; SMB_STRUCT_STAT st; @@ -508,17 +499,17 @@ static NTSTATUS cmd_stat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, c return NT_STATUS_OK; } - ret = vfs->conn->vfs_ops.stat(vfs->conn, argv[1], &st); + ret = SMB_VFS_STAT(vfs->conn, argv[1], &st); if (ret == -1) { printf("stat: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } pwd = sys_getpwuid(st.st_uid); - if (pwd != NULL) user = strdup(pwd->pw_name); + if (pwd != NULL) user = pwd->pw_name; else user = null_string; grp = sys_getgrgid(st.st_gid); - if (grp != NULL) group = strdup(grp->gr_name); + if (grp != NULL) group = grp->gr_name; else group = null_string; printf("stat: ok\n"); @@ -541,17 +532,17 @@ static NTSTATUS cmd_stat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, c printf(" Access: %s", ctime(&(st.st_atime))); printf(" Modify: %s", ctime(&(st.st_mtime))); printf(" Change: %s", ctime(&(st.st_ctime))); - if (user != null_string) SAFE_FREE(user); - if (group!= null_string) SAFE_FREE(group); + SAFE_FREE(pwd); + SAFE_FREE(grp); return NT_STATUS_OK; } -static NTSTATUS cmd_fstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_fstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { int fd; - char *user; - char *group; + const char *user; + const char *group; struct passwd *pwd; struct group *grp; SMB_STRUCT_STAT st; @@ -572,16 +563,16 @@ static NTSTATUS cmd_fstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, return NT_STATUS_OK; } - if (vfs->conn->vfs_ops.fstat(vfs->files[fd], fd, &st) == -1) { + if (SMB_VFS_FSTAT(vfs->files[fd], fd, &st) == -1) { printf("fstat: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } pwd = sys_getpwuid(st.st_uid); - if (pwd != NULL) user = strdup(pwd->pw_name); + if (pwd != NULL) user = pwd->pw_name; else user = null_string; grp = sys_getgrgid(st.st_gid); - if (grp != NULL) group = strdup(grp->gr_name); + if (grp != NULL) group = grp->gr_name; else group = null_string; printf("fstat: ok\n"); @@ -603,16 +594,16 @@ static NTSTATUS cmd_fstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, printf(" Access: %s", ctime(&(st.st_atime))); printf(" Modify: %s", ctime(&(st.st_mtime))); printf(" Change: %s", ctime(&(st.st_ctime))); - if (user != null_string) SAFE_FREE(user); - if (group!= null_string) SAFE_FREE(group); + SAFE_FREE(pwd); + SAFE_FREE(grp); return NT_STATUS_OK; } -static NTSTATUS cmd_lstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_lstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { - char *user; - char *group; + const char *user; + const char *group; struct passwd *pwd; struct group *grp; SMB_STRUCT_STAT st; @@ -622,16 +613,16 @@ static NTSTATUS cmd_lstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, return NT_STATUS_OK; } - if (vfs->conn->vfs_ops.lstat(vfs->conn, argv[1], &st) == -1) { + if (SMB_VFS_LSTAT(vfs->conn, argv[1], &st) == -1) { printf("lstat: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } pwd = sys_getpwuid(st.st_uid); - if (pwd != NULL) user = strdup(pwd->pw_name); + if (pwd != NULL) user = pwd->pw_name; else user = null_string; grp = sys_getgrgid(st.st_gid); - if (grp != NULL) group = strdup(grp->gr_name); + if (grp != NULL) group = grp->gr_name; else group = null_string; printf("lstat: ok\n"); @@ -653,13 +644,13 @@ static NTSTATUS cmd_lstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, printf(" Access: %s", ctime(&(st.st_atime))); printf(" Modify: %s", ctime(&(st.st_mtime))); printf(" Change: %s", ctime(&(st.st_ctime))); - if (user != null_string) SAFE_FREE(user); - if (group!= null_string) SAFE_FREE(group); + SAFE_FREE(pwd); + SAFE_FREE(grp); return NT_STATUS_OK; } -static NTSTATUS cmd_chmod(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_chmod(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { mode_t mode; if (argc != 3) { @@ -668,7 +659,7 @@ static NTSTATUS cmd_chmod(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } mode = atoi(argv[2]); - if (vfs->conn->vfs_ops.chmod(vfs->conn, argv[1], mode) == -1) { + if (SMB_VFS_CHMOD(vfs->conn, argv[1], mode) == -1) { printf("chmod: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } @@ -678,7 +669,7 @@ static NTSTATUS cmd_chmod(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } -static NTSTATUS cmd_fchmod(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_fchmod(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { int fd; mode_t mode; @@ -698,7 +689,7 @@ static NTSTATUS cmd_fchmod(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, return NT_STATUS_OK; } - if (vfs->conn->vfs_ops.fchmod(vfs->files[fd], fd, mode) == -1) { + if (SMB_VFS_FCHMOD(vfs->files[fd], fd, mode) == -1) { printf("fchmod: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } @@ -708,7 +699,7 @@ static NTSTATUS cmd_fchmod(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } -static NTSTATUS cmd_chown(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_chown(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { uid_t uid; gid_t gid; @@ -719,7 +710,7 @@ static NTSTATUS cmd_chown(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, uid = atoi(argv[2]); gid = atoi(argv[3]); - if (vfs->conn->vfs_ops.chown(vfs->conn, argv[1], uid, gid) == -1) { + if (SMB_VFS_CHOWN(vfs->conn, argv[1], uid, gid) == -1) { printf("chown: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } @@ -729,7 +720,7 @@ static NTSTATUS cmd_chown(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } -static NTSTATUS cmd_fchown(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_fchown(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { uid_t uid; gid_t gid; @@ -750,7 +741,7 @@ static NTSTATUS cmd_fchown(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, printf("fchown: error=%d (invalid file descriptor)\n", EBADF); return NT_STATUS_OK; } - if (vfs->conn->vfs_ops.fchown(vfs->files[fd], fd, uid, gid) == -1) { + if (SMB_VFS_FCHOWN(vfs->files[fd], fd, uid, gid) == -1) { printf("fchown error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } @@ -760,10 +751,10 @@ static NTSTATUS cmd_fchown(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } -static NTSTATUS cmd_getwd(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_getwd(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { char buf[PATH_MAX]; - if (vfs->conn->vfs_ops.getwd(vfs->conn, buf) == NULL) { + if (SMB_VFS_GETWD(vfs->conn, buf) == NULL) { printf("getwd: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } @@ -772,7 +763,7 @@ static NTSTATUS cmd_getwd(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, return NT_STATUS_OK; } -static NTSTATUS cmd_utime(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_utime(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { struct utimbuf times; if (argc != 4) { @@ -781,7 +772,7 @@ static NTSTATUS cmd_utime(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } times.actime = atoi(argv[2]); times.modtime = atoi(argv[3]); - if (vfs->conn->vfs_ops.utime(vfs->conn, argv[1], ×) != 0) { + if (SMB_VFS_UTIME(vfs->conn, argv[1], ×) != 0) { printf("utime: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } @@ -790,7 +781,7 @@ static NTSTATUS cmd_utime(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, return NT_STATUS_OK; } -static NTSTATUS cmd_ftruncate(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_ftruncate(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { int fd; SMB_OFF_T off; @@ -810,7 +801,7 @@ static NTSTATUS cmd_ftruncate(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int ar return NT_STATUS_OK; } - if (vfs->conn->vfs_ops.ftruncate(vfs->files[fd], fd, off) == -1) { + if (SMB_VFS_FTRUNCATE(vfs->files[fd], fd, off) == -1) { printf("ftruncate: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } @@ -819,7 +810,7 @@ static NTSTATUS cmd_ftruncate(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int ar return NT_STATUS_OK; } -static NTSTATUS cmd_lock(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_lock(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { BOOL ret; int fd; @@ -827,7 +818,7 @@ static NTSTATUS cmd_lock(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, c long offset; long count; int type; - char *typestr; + const char *typestr; if (argc != 6) { printf("Usage: lock \n"); @@ -893,7 +884,7 @@ static NTSTATUS cmd_lock(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, c printf("lock: debug lock(fd=%d, op=%d, offset=%ld, count=%ld, type=%d))\n", fd, op, offset, count, type); - if ((ret = vfs->conn->vfs_ops.lock(vfs->files[fd], fd, op, offset, count, type)) == False) { + if ((ret = SMB_VFS_LOCK(vfs->files[fd], fd, op, offset, count, type)) == False) { printf("lock: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } @@ -902,14 +893,14 @@ static NTSTATUS cmd_lock(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, c return NT_STATUS_OK; } -static NTSTATUS cmd_symlink(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_symlink(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { if (argc != 3) { printf("Usage: symlink \n"); return NT_STATUS_OK; } - if (vfs->conn->vfs_ops.symlink(vfs->conn, argv[1], argv[2]) == -1) { + if (SMB_VFS_SYMLINK(vfs->conn, argv[1], argv[2]) == -1) { printf("symlink: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } @@ -919,7 +910,7 @@ static NTSTATUS cmd_symlink(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc } -static NTSTATUS cmd_readlink(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_readlink(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { char buffer[PATH_MAX]; int size; @@ -929,7 +920,7 @@ static NTSTATUS cmd_readlink(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int arg return NT_STATUS_OK; } - if ((size = vfs->conn->vfs_ops.readlink(vfs->conn, argv[1], buffer, PATH_MAX)) == -1) { + if ((size = SMB_VFS_READLINK(vfs->conn, argv[1], buffer, PATH_MAX)) == -1) { printf("readlink: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } @@ -940,14 +931,14 @@ static NTSTATUS cmd_readlink(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int arg } -static NTSTATUS cmd_link(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_link(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { if (argc != 3) { printf("Usage: link \n"); return NT_STATUS_OK; } - if (vfs->conn->vfs_ops.link(vfs->conn, argv[1], argv[2]) == -1) { + if (SMB_VFS_LINK(vfs->conn, argv[1], argv[2]) == -1) { printf("link: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } @@ -956,7 +947,7 @@ static NTSTATUS cmd_link(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, c return NT_STATUS_OK; } -static NTSTATUS cmd_mknod(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_mknod(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { mode_t mode; unsigned int dev_val; @@ -980,7 +971,7 @@ static NTSTATUS cmd_mknod(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, } dev = (SMB_DEV_T)dev_val; - if (vfs->conn->vfs_ops.mknod(vfs->conn, argv[1], mode, dev) == -1) { + if (SMB_VFS_MKNOD(vfs->conn, argv[1], mode, dev) == -1) { printf("mknod: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } @@ -989,7 +980,7 @@ static NTSTATUS cmd_mknod(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, return NT_STATUS_OK; } -static NTSTATUS cmd_realpath(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_realpath(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { char respath[PATH_MAX]; @@ -998,7 +989,7 @@ static NTSTATUS cmd_realpath(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int arg return NT_STATUS_OK; } - if (vfs->conn->vfs_ops.realpath(vfs->conn, argv[1], respath) == NULL) { + if (SMB_VFS_REALPATH(vfs->conn, argv[1], respath) == NULL) { printf("realpath: error=%d (%s)\n", errno, strerror(errno)); return NT_STATUS_UNSUCCESSFUL; } diff --git a/source3/torture/mangle_test.c b/source3/torture/mangle_test.c index e4ccfc1b83..660d4d17af 100644 --- a/source3/torture/mangle_test.c +++ b/source3/torture/mangle_test.c @@ -82,7 +82,7 @@ static BOOL test_one(struct cli_state *cli, const char *name) } /* see if the short name is already in the tdb */ - data = tdb_fetch_by_string(tdb, shortname); + data = tdb_fetch_bystring(tdb, shortname); if (data.dptr) { /* maybe its a duplicate long name? */ if (strcasecmp(name, data.dptr) != 0) { @@ -98,7 +98,7 @@ static BOOL test_one(struct cli_state *cli, const char *name) /* store it for later */ namedata.dptr = name; namedata.dsize = strlen(name)+1; - tdb_store_by_string(tdb, shortname, namedata, TDB_REPLACE); + tdb_store_bystring(tdb, shortname, namedata, TDB_REPLACE); } return True; diff --git a/source3/torture/masktest.c b/source3/torture/masktest.c index 06dead3f16..fa901e3d63 100644 --- a/source3/torture/masktest.c +++ b/source3/torture/masktest.c @@ -279,9 +279,9 @@ static void get_real_name(struct cli_state *cli, } if (f_info) { fstrcpy(short_name, f_info->short_name); - strlower(short_name); + strlower_m(short_name); pstrcpy(long_name, f_info->name); - strlower(long_name); + strlower_m(long_name); } if (*short_name == 0) { diff --git a/source3/torture/nsstest.c b/source3/torture/nsstest.c index a82fa05203..0a08cb6e8f 100644 --- a/source3/torture/nsstest.c +++ b/source3/torture/nsstest.c @@ -2,6 +2,7 @@ Unix SMB/CIFS implementation. nss tester for winbindd Copyright (C) Andrew Tridgell 2001 + Copyright (C) Tim Potter 2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -44,6 +45,7 @@ static void *find_fn(const char *name) res = sys_dlsym(h, s); if (!res) { printf("Can't find function %s\n", s); + total_errors++; return NULL; } return res; @@ -65,6 +67,9 @@ static struct passwd *nss_getpwent(void) static char buf[1000]; NSS_STATUS status; + if (!_nss_getpwent_r) + return NULL; + status = _nss_getpwent_r(&pwd, buf, sizeof(buf), &nss_errno); if (status == NSS_STATUS_NOTFOUND) { return NULL; @@ -83,6 +88,9 @@ static struct passwd *nss_getpwnam(const char *name) static struct passwd pwd; static char buf[1000]; NSS_STATUS status; + + if (!_nss_getpwnam_r) + return NULL; status = _nss_getpwnam_r(name, &pwd, buf, sizeof(buf), &nss_errno); if (status == NSS_STATUS_NOTFOUND) { @@ -102,6 +110,9 @@ static struct passwd *nss_getpwuid(uid_t uid) static struct passwd pwd; static char buf[1000]; NSS_STATUS status; + + if (!_nss_getpwuid_r) + return NULL; status = _nss_getpwuid_r(uid, &pwd, buf, sizeof(buf), &nss_errno); if (status == NSS_STATUS_NOTFOUND) { @@ -118,6 +129,10 @@ static void nss_setpwent(void) { NSS_STATUS (*_nss_setpwent)(void) = find_fn("setpwent"); NSS_STATUS status; + + if (!_nss_setpwent) + return; + status = _nss_setpwent(); if (status != NSS_STATUS_SUCCESS) { report_nss_error("setpwent", status); @@ -128,6 +143,10 @@ static void nss_endpwent(void) { NSS_STATUS (*_nss_endpwent)(void) = find_fn("endpwent"); NSS_STATUS status; + + if (!_nss_endpwent) + return; + status = _nss_endpwent(); if (status != NSS_STATUS_SUCCESS) { report_nss_error("endpwent", status); @@ -144,7 +163,11 @@ static struct group *nss_getgrent(void) static int buflen = 1024; NSS_STATUS status; - if (!buf) buf = malloc(buflen); + if (!_nss_getgrent_r) + return NULL; + + if (!buf) + buf = malloc(buflen); again: status = _nss_getgrent_r(&grp, buf, buflen, &nss_errno); @@ -172,7 +195,11 @@ static struct group *nss_getgrnam(const char *name) static int buflen = 1000; NSS_STATUS status; - if (!buf) buf = malloc(buflen); + if (!_nss_getgrnam_r) + return NULL; + + if (!buf) + buf = malloc(buflen); again: status = _nss_getgrnam_r(name, &grp, buf, buflen, &nss_errno); if (status == NSS_STATUS_TRYAGAIN) { @@ -199,7 +226,12 @@ static struct group *nss_getgrgid(gid_t gid) static int buflen = 1000; NSS_STATUS status; - if (!buf) buf = malloc(buflen); + if (!_nss_getgrgid_r) + return NULL; + + if (!buf) + buf = malloc(buflen); + again: status = _nss_getgrgid_r(gid, &grp, buf, buflen, &nss_errno); if (status == NSS_STATUS_TRYAGAIN) { @@ -221,6 +253,10 @@ static void nss_setgrent(void) { NSS_STATUS (*_nss_setgrent)(void) = find_fn("setgrent"); NSS_STATUS status; + + if (!_nss_setgrent) + return; + status = _nss_setgrent(); if (status != NSS_STATUS_SUCCESS) { report_nss_error("setgrent", status); @@ -231,6 +267,10 @@ static void nss_endgrent(void) { NSS_STATUS (*_nss_endgrent)(void) = find_fn("endgrent"); NSS_STATUS status; + + if (!_nss_endgrent) + return; + status = _nss_endgrent(); if (status != NSS_STATUS_SUCCESS) { report_nss_error("endgrent", status); @@ -244,7 +284,8 @@ static int nss_initgroups(char *user, gid_t group, gid_t **groups, long int *sta find_fn("initgroups_dyn"); NSS_STATUS status; - if (!_nss_initgroups) return NSS_STATUS_UNAVAIL; + if (!_nss_initgroups) + return NSS_STATUS_UNAVAIL; status = _nss_initgroups(user, group, start, size, groups, 0, &nss_errno); if (status != NSS_STATUS_SUCCESS) { diff --git a/source3/torture/rpctorture.c b/source3/torture/rpctorture.c index 086f8d5d33..8dfaebd64f 100644 --- a/source3/torture/rpctorture.c +++ b/source3/torture/rpctorture.c @@ -363,7 +363,7 @@ enum client_action case 'S': { pstrcpy(cli_info.dest_host,optarg); - strupper(cli_info.dest_host); + strupper_m(cli_info.dest_host); cli_action = CLIENT_IPC; break; } @@ -486,7 +486,7 @@ enum client_action exit(1); } - strupper(global_myname); + strupper_m(global_myname); fstrcpy(cli_info.myhostname, global_myname); DEBUG(3,("%s client started (version %s)\n",timestring(False),VERSION)); @@ -495,7 +495,7 @@ enum client_action { pstrcpy(smb_cli->domain,lp_workgroup()); } - strupper(smb_cli->domain); + strupper_m(smb_cli->domain); load_interfaces(); @@ -506,7 +506,7 @@ enum client_action } fstrcpy(cli_info.mach_acct, cli_info.myhostname); - strupper(cli_info.mach_acct); + strupper_m(cli_info.mach_acct); fstrcat(cli_info.mach_acct, "$"); /* set the password cache info */ diff --git a/source3/torture/smbiconv.c b/source3/torture/smbiconv.c index ce21a09025..3524136fb1 100644 --- a/source3/torture/smbiconv.c +++ b/source3/torture/smbiconv.c @@ -198,6 +198,10 @@ int main(int argc, char *argv[]) while(poptGetNextOpt(pc) != -1); + /* the following functions are part of the Samba debugging + facilities. See lib/debug.c */ + setup_logging("smbiconv", True); + if(preload)smb_load_modules(str_list_make(preload, NULL)); if(output) { @@ -209,10 +213,6 @@ int main(int argc, char *argv[]) } } - /* the following functions are part of the Samba debugging - facilities. See lib/debug.c */ - setup_logging("smbiconv", True); - cd = smb_iconv_open(to, from); if((int)cd == -1) { DEBUG(0,("unable to find from or to encoding, exiting...\n")); diff --git a/source3/torture/torture.c b/source3/torture/torture.c index 07d7f1547e..f26ebb49b3 100644 --- a/source3/torture/torture.c +++ b/source3/torture/torture.c @@ -866,7 +866,7 @@ static BOOL run_locktest1(int dummy) lock_timeout = (1 + (random() % 20)); printf("Testing lock timeout with timeout=%u\n", lock_timeout); t1 = time(NULL); - if (cli_lock(cli2, fnum3, 0, 4, lock_timeout * 1000, WRITE_LOCK)) { + if (cli_lock(cli2, fnum3, 0, 4, lock_timeout * 500, WRITE_LOCK)) { printf("lock3 succeeded! This is a locking bug\n"); return False; } else { @@ -875,9 +875,10 @@ static BOOL run_locktest1(int dummy) } t2 = time(NULL); - if (t2 - t1 < 5) { + if (ABS(t2 - t1) < lock_timeout-1) { printf("error: This server appears not to support timed lock requests\n"); } + printf("server slept for %u seconds for a %u second timeout\n", (unsigned int)(t2-t1), lock_timeout); diff --git a/source3/torture/vfstest.c b/source3/torture/vfstest.c index 3b28a3c496..88fe348649 100644 --- a/source3/torture/vfstest.c +++ b/source3/torture/vfstest.c @@ -106,7 +106,7 @@ static char* next_command(char** cmdstr) /* Load specified configuration file */ static NTSTATUS cmd_conf(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, - int argc, char **argv) + int argc, const char **argv) { if (argc != 2) { printf("Usage: %s \n", argv[0]); @@ -181,7 +181,7 @@ static NTSTATUS cmd_help(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, } /* Change the debug level */ -static NTSTATUS cmd_debuglevel(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_debuglevel(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { if (argc > 2) { printf("Usage: %s [debuglevel]\n", argv[0]); @@ -197,7 +197,7 @@ static NTSTATUS cmd_debuglevel(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int a return NT_STATUS_OK; } -static NTSTATUS cmd_freemem(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_freemem(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { /* Cleanup */ talloc_destroy(mem_ctx); @@ -207,7 +207,7 @@ static NTSTATUS cmd_freemem(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc return NT_STATUS_OK; } -static NTSTATUS cmd_quit(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, char **argv) +static NTSTATUS cmd_quit(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, const char **argv) { /* Cleanup */ talloc_destroy(mem_ctx); @@ -261,7 +261,8 @@ static void add_command_set(struct cmd_set *cmd_set) static NTSTATUS do_cmd(struct vfs_state *vfs, struct cmd_set *cmd_entry, char *cmd) { - char *p = cmd, **argv = NULL; + const char *p = cmd; + char **argv = NULL; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; pstring buf; TALLOC_CTX *mem_ctx = NULL; @@ -311,7 +312,7 @@ static NTSTATUS do_cmd(struct vfs_state *vfs, struct cmd_set *cmd_entry, char *c } /* Run command */ - result = cmd_entry->fn(vfs, mem_ctx, argc, argv); + result = cmd_entry->fn(vfs, mem_ctx, argc, (const char **)argv); } else { fprintf (stderr, "Invalid command\n"); @@ -338,7 +339,7 @@ static NTSTATUS process_cmd(struct vfs_state *vfs, char *cmd) struct cmd_list *temp_list; BOOL found = False; pstring buf; - char *p = cmd; + const char *p = cmd; NTSTATUS result = NT_STATUS_OK; int len = 0; @@ -478,7 +479,7 @@ int main(int argc, char *argv[]) struct cmd_set **cmd_set; static struct vfs_state vfs; int i; - static const char *filename = NULL; + static char *filename = NULL; /* make sure the vars that get altered (4th field) are in a fixed location or certain compilers complain */ @@ -520,9 +521,10 @@ int main(int argc, char *argv[]) } /* some basic initialization stuff */ + sec_init(); conn_init(); vfs.conn = conn_new(); - vfs.conn->user = "vfstest"; + string_set(&vfs.conn->user,"vfstest"); for (i=0; i < 1024; i++) vfs.files[i] = NULL; diff --git a/source3/torture/vfstest.h b/source3/torture/vfstest.h index 5910c5ce37..1e030fad04 100644 --- a/source3/torture/vfstest.h +++ b/source3/torture/vfstest.h @@ -39,7 +39,7 @@ struct vfs_state { struct cmd_set { const char *name; NTSTATUS (*fn)(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, - char **argv); + const char **argv); const char *description; const char *usage; }; diff --git a/source3/utils/editreg.c b/source3/utils/editreg.c index 54148fdcf8..a0cfa2bb07 100644 --- a/source3/utils/editreg.c +++ b/source3/utils/editreg.c @@ -1099,7 +1099,7 @@ VAL_KEY *nt_add_reg_value(REG_KEY *key, char *name, int type, char *value) tmp = (VAL_KEY *)malloc(sizeof(VAL_KEY)); if (!tmp) goto error; - bzero(tmp, sizeof(VAL_KEY)); + memset(tmp, 0, sizeof(VAL_KEY)); tmp->name = strdup(name); tmp->has_name = True; if (!tmp->name) goto error; @@ -1181,7 +1181,7 @@ int sid_string_to_sid(sid_t **sid, const char *sid_str) *sid = (sid_t *)malloc(sizeof(sid_t)); if (!*sid) return 0; - bzero(*sid, sizeof(sid_t)); + memset(*sid, 0, sizeof(sid_t)); if (strncmp(sid_str, "S-1-5", 5)) { fprintf(stderr, "Does not conform to S-1-5...: %s\n", sid_str); @@ -1402,7 +1402,7 @@ REG_KEY *nt_add_reg_key_list(REGF *regf, REG_KEY *key, char * name, int create) tmp = (REG_KEY *)malloc(sizeof(REG_KEY)); - bzero(tmp, sizeof(REG_KEY)); + memset(tmp, 0, sizeof(REG_KEY)); tmp->name = strdup(c1); if (!tmp->name) goto error; @@ -1466,7 +1466,7 @@ REG_KEY *nt_add_reg_key(REGF *regf, char *name, int create) tmp = (REG_KEY *)malloc(sizeof(REG_KEY)); if (!tmp) goto error; - bzero(tmp, sizeof(REG_KEY)); + memset(tmp, 0, sizeof(REG_KEY)); tmp->name = strdup(c1); if (!tmp->name) goto error; tmp->security = nt_create_init_sec(regf); @@ -1654,7 +1654,7 @@ REGF *nt_create_regf(void) { REGF *tmp = (REGF *)malloc(sizeof(REGF)); if (!tmp) return tmp; - bzero(tmp, sizeof(REGF)); + memset(tmp, 0, sizeof(REGF)); tmp->owner_sid_str = def_owner_sid_str; return tmp; } @@ -1815,7 +1815,7 @@ KEY_SEC_DESC *lookup_create_sec_key(REGF *regf, SK_MAP *sk_map, int sk_off) if (!tmp) { return NULL; } - bzero(tmp, sizeof(KEY_SEC_DESC)); /* Neatly sets offset to 0 */ + memset(tmp, 0, sizeof(KEY_SEC_DESC)); /* Neatly sets offset to 0 */ tmp->state = SEC_DESC_RES; if (!alloc_sk_map_entry(regf, tmp, sk_off)) { return NULL; @@ -1991,7 +1991,7 @@ KEY_SEC_DESC *process_sk(REGF *regf, SK_HDR *sk_hdr, int sk_off, int size) if (!tmp) { tmp = (KEY_SEC_DESC *)malloc(sizeof(KEY_SEC_DESC)); if (!tmp) return NULL; - bzero(tmp, sizeof(KEY_SEC_DESC)); + memset(tmp, 0, sizeof(KEY_SEC_DESC)); /* * Allocate an entry in the SK_MAP ... @@ -2059,7 +2059,7 @@ VAL_KEY *process_vk(REGF *regf, VK_HDR *vk_hdr, int size) if (!tmp) { goto error; } - bzero(tmp, sizeof(VAL_KEY)); + memset(tmp, 0, sizeof(VAL_KEY)); tmp->has_name = flag; tmp->data_type = dat_type; @@ -2268,7 +2268,7 @@ REG_KEY *nt_get_key_tree(REGF *regf, NK_HDR *nk_hdr, int size, REG_KEY *parent) /* Allocate the key struct now */ tmp = (REG_KEY *)malloc(sizeof(REG_KEY)); if (!tmp) return tmp; - bzero(tmp, sizeof(REG_KEY)); + memset(tmp, 0, sizeof(REG_KEY)); tmp->type = (SVAL(&nk_hdr->type)==0x2C?REG_ROOT_KEY:REG_SUB_KEY); @@ -2295,7 +2295,7 @@ REG_KEY *nt_get_key_tree(REGF *regf, NK_HDR *nk_hdr, int size, REG_KEY *parent) clsnamep = LOCN(regf->base, clsnam_off); if (verbose) fprintf(stdout, "Class Name Offset: %0X\n", clsnam_off); - bzero(cls_name, clsname_len); + memset(cls_name, 0, clsname_len); uni_to_ascii(clsnamep, cls_name, sizeof(cls_name), clsname_len); /* @@ -2494,12 +2494,12 @@ HBIN_BLK *nt_create_hbin_blk(REGF *regf, int size) size = (size + (REGF_HDR_BLKSIZ - 1)) & ~(REGF_HDR_BLKSIZ - 1); tmp = (HBIN_BLK *)malloc(sizeof(HBIN_BLK)); - bzero(tmp, sizeof(HBIN_BLK)); + memset(tmp, 0, sizeof(HBIN_BLK)); tmp->data = malloc(size); if (!tmp->data) goto error; - bzero(tmp->data, size); /* Make it pristine */ + memset(tmp->data, 0, size); /* Make it pristine */ tmp->size = size; tmp->file_offset = regf->blk_tail->file_offset + regf->blk_tail->size; @@ -2986,13 +2986,13 @@ REGF_HDR *nt_get_reg_header(REGF *regf) tmp = (HBIN_BLK *)malloc(sizeof(HBIN_BLK)); if (!tmp) return 0; - bzero(tmp, sizeof(HBIN_BLK)); + memset(tmp, 0, sizeof(HBIN_BLK)); tmp->type = REG_OUTBLK_HDR; tmp->size = REGF_HDR_BLKSIZ; tmp->data = malloc(REGF_HDR_BLKSIZ); if (!tmp->data) goto error; - bzero(tmp->data, REGF_HDR_BLKSIZ); /* Make it pristine, unlike Windows */ + memset(tmp->data, 0, REGF_HDR_BLKSIZ); /* Make it pristine, unlike Windows */ regf->blk_head = regf->blk_tail = tmp; return (REGF_HDR *)tmp->data; @@ -3921,7 +3921,7 @@ int print_val(const char *path, char *val_name, int val_type, int data_len, { char data_asc[1024]; - bzero(data_asc, sizeof(data_asc)); + memset(data_asc, 0, sizeof(data_asc)); if (!terminal && first) fprintf(stdout, "%s\n", path); data_to_ascii((unsigned char *)data_blk, data_len, val_type, data_asc, diff --git a/source3/utils/net.c b/source3/utils/net.c index aa245a920a..e643a3d10d 100644 --- a/source3/utils/net.c +++ b/source3/utils/net.c @@ -77,6 +77,21 @@ static int opt_machine_pass = 0; BOOL opt_have_ip = False; struct in_addr opt_dest_ip; +/***************************************************************************** + stubb functions +****************************************************************************/ + +void become_root( void ) +{ + return; +} + +void unbecome_root( void ) +{ + return; +} + + uint32 get_sec_channel_type(const char *param) { if (!(param && *param)) { @@ -206,7 +221,7 @@ BOOL net_find_server(unsigned flags, struct in_addr *server_ip, char **server_na if (is_zero_ip(pdc_ip)) return False; - if (!lookup_dc_name(global_myname(), opt_target_workgroup, &pdc_ip, dc_name)) + if ( !name_status_find(opt_target_workgroup, 0x1b, 0x20, pdc_ip, dc_name) ) return False; *server_name = strdup(dc_name); @@ -248,20 +263,18 @@ BOOL net_find_server(unsigned flags, struct in_addr *server_ip, char **server_na } -BOOL net_find_dc(struct in_addr *server_ip, fstring server_name, const char *domain_name) +BOOL net_find_pdc(struct in_addr *server_ip, fstring server_name, const char *domain_name) { if (get_pdc_ip(domain_name, server_ip)) { - fstring dc_name; - if (is_zero_ip(*server_ip)) return False; - if (!lookup_dc_name(global_myname(), domain_name, server_ip, dc_name)) + if (!name_status_find(domain_name, 0x1b, 0x20, *server_ip, server_name)) return False; - fstrcpy(server_name, dc_name); - return True; - } else + return True; + } + else return False; } @@ -348,26 +361,6 @@ static int net_file(int argc, const char **argv) return net_rap_file(argc, argv); } -/*********************************************************** - migrated functionality from smbgroupedit - **********************************************************/ -static int net_groupmap(int argc, const char **argv) -{ - if ( 0 == argc ) - return net_help_groupmap( argc, argv ); - - if ( !StrCaseCmp( argv[0], "add" ) ) - return net_groupmap_add(argc-1, argv+1); - else if ( !StrCaseCmp( argv[0], "modify" ) ) - return net_groupmap_modify(argc-1, argv+1); - else if ( !StrCaseCmp( argv[0], "delete" ) ) - return net_groupmap_delete(argc-1, argv+1); - else if ( !StrCaseCmp( argv[0], "list" ) ) - return net_groupmap_list(argc-1, argv+1); - - return net_help_groupmap( argc, argv ); -} - /* Retrieve our local SID or the SID for the specified name */ @@ -471,7 +464,7 @@ static uint32 get_maxrid(void) pdb_free_sam(&pwd); if (!pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &num_entries, - ENUM_ONLY_MAPPED, MAPPING_WITHOUT_PRIV)) + ENUM_ONLY_MAPPED)) return max_rid; for (i = 0; i < num_entries; i++) { @@ -544,6 +537,7 @@ static struct functable net_func[] = { {"SETLOCALSID", net_setlocalsid}, {"GETDOMAINSID", net_getdomainsid}, {"MAXRID", net_maxrid}, + {"IDMAP", net_idmap}, {"HELP", net_help}, {NULL, NULL} @@ -655,6 +649,10 @@ static struct functable net_func[] = { exit(1); load_interfaces(); + + /* this makes sure that when we do things like call scripts, + that it won't assert becouse we are not root */ + sec_init(); if (opt_machine_pass) { char *user = NULL; diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c index 203d849786..69d282420d 100644 --- a/source3/utils/net_ads.c +++ b/source3/utils/net_ads.c @@ -109,6 +109,9 @@ static int net_ads_info(int argc, const char **argv) d_printf("LDAP port: %d\n", ads->ldap_port); d_printf("Server time: %s\n", http_timestring(ads->config.current_time)); + d_printf("KDC server: %s\n", ads->auth.kdc_server ); + d_printf("Server time offset: %d\n", ads->auth.time_offset ); + return 0; } @@ -124,7 +127,7 @@ static ADS_STRUCT *ads_startup(void) ADS_STATUS status; BOOL need_password = False; BOOL second_time = False; - char *realm; + char *cp; ads = ads_init(NULL, NULL, opt_host); @@ -146,22 +149,24 @@ retry: if (opt_password) { use_in_memory_ccache(); - ads->auth.password = strdup(opt_password); + ads->auth.password = smb_xstrdup(opt_password); } - ads->auth.user_name = strdup(opt_user_name); + ads->auth.user_name = smb_xstrdup(opt_user_name); - /* - * If the username is of the form "name@realm", - * extract the realm and convert to upper case. - */ - if ((realm = strchr(ads->auth.user_name, '@'))) { - *realm++ = '\0'; - ads->auth.realm = strdup(realm); - strupper(ads->auth.realm); - } + /* + * If the username is of the form "name@realm", + * extract the realm and convert to upper case. + * This is only used to establish the connection. + */ + if ((cp = strchr(ads->auth.user_name, '@'))!=0) { + *cp++ = '\0'; + ads->auth.realm = smb_xstrdup(cp); + strupper_m(ads->auth.realm); + } status = ads_connect(ads); + if (!ADS_ERR_OK(status)) { if (!need_password && !second_time) { need_password = True; @@ -230,7 +235,7 @@ static BOOL usergrp_display(char *field, void **values, void *data_area) if (!field) { /* must be end of record */ if (!strchr_m(disp_fields[0], '$')) { if (disp_fields[1]) - d_printf("%-21.21s %-50.50s\n", + d_printf("%-21.21s %s\n", disp_fields[0], disp_fields[1]); else d_printf("%s\n", disp_fields[0]); @@ -295,7 +300,8 @@ static int ads_user_add(int argc, const char **argv) /* try setting the password */ asprintf(&upn, "%s@%s", argv[0], ads->config.realm); - status = krb5_set_password(ads->auth.kdc_server, upn, argv[1], ads->auth.time_offset); + status = ads_krb5_set_password(ads->auth.kdc_server, upn, argv[1], + ads->auth.time_offset); safe_free(upn); if (ADS_ERR_OK(status)) { d_printf("User %s added\n", argv[0]); @@ -720,6 +726,8 @@ int net_ads_join(int argc, const char **argv) int net_ads_printer_usage(int argc, const char **argv) { d_printf( +"\nnet ads printer search " +"\n\tsearch for a printer in the directory" "\nnet ads printer info " "\n\tlookup info in directory for printer on server" "\n\t(note: printer defaults to \"*\", server defaults to local)\n" @@ -732,6 +740,35 @@ int net_ads_printer_usage(int argc, const char **argv) return -1; } +static int net_ads_printer_search(int argc, const char **argv) +{ + ADS_STRUCT *ads; + ADS_STATUS rc; + void *res = NULL; + + if (!(ads = ads_startup())) + return -1; + + rc = ads_find_printers(ads, &res); + + if (!ADS_ERR_OK(rc)) { + d_printf("ads_find_printer: %s\n", ads_errstr(rc)); + ads_msgfree(ads, res); + return -1; + } + + if (ads_count_replies(ads, res) == 0) { + d_printf("No results found\n"); + ads_msgfree(ads, res); + return -1; + } + + ads_dump(ads, res); + ads_msgfree(ads, res); + + return 0; +} + static int net_ads_printer_info(int argc, const char **argv) { ADS_STRUCT *ads; @@ -780,7 +817,7 @@ static int net_ads_printer_publish(int argc, const char **argv) { ADS_STRUCT *ads; ADS_STATUS rc; - const char *servername; + const char *servername, *printername; struct cli_state *cli; struct in_addr server_ip; NTSTATUS nt_status; @@ -794,15 +831,14 @@ static int net_ads_printer_publish(int argc, const char **argv) if (argc < 1) return net_ads_printer_usage(argc, argv); + printername = argv[0]; + if (argc == 2) servername = argv[1]; else servername = global_myname(); - ads_find_machine_acct(ads, &res, servername); - srv_dn = ldap_get_dn(ads->ld, res); - srv_cn = ldap_explode_dn(srv_dn, 1); - asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn[0], argv[0], srv_dn); + /* Get printer data from SPOOLSS */ resolve_name(servername, &server_ip, 0x20); @@ -814,8 +850,29 @@ static int net_ads_printer_publish(int argc, const char **argv) CLI_FULL_CONNECTION_USE_KERBEROS, NULL); + if (NT_STATUS_IS_ERR(nt_status)) { + d_printf("Unable to open a connnection to %s to obtain data " + "for %s\n", servername, printername); + return -1; + } + + /* Publish on AD server */ + + ads_find_machine_acct(ads, &res, servername); + + if (ads_count_replies(ads, res) == 0) { + d_printf("Could not find machine account for server %s\n", + servername); + return -1; + } + + srv_dn = ldap_get_dn(ads->ld, res); + srv_cn = ldap_explode_dn(srv_dn, 1); + + asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn[0], printername, srv_dn); + cli_nt_session_open(cli, PI_SPOOLSS); - get_remote_printer_publishing_data(cli, mem_ctx, &mods, argv[0]); + get_remote_printer_publishing_data(cli, mem_ctx, &mods, printername); rc = ads_add_printer_entry(ads, prt_dn, mem_ctx, &mods); if (!ADS_ERR_OK(rc)) { @@ -876,6 +933,7 @@ static int net_ads_printer_remove(int argc, const char **argv) static int net_ads_printer(int argc, const char **argv) { struct functable func[] = { + {"SEARCH", net_ads_printer_search}, {"INFO", net_ads_printer_info}, {"PUBLISH", net_ads_printer_publish}, {"REMOVE", net_ads_printer_remove}, @@ -893,20 +951,34 @@ static int net_ads_password(int argc, const char **argv) const char *auth_password = opt_password; char *realm = NULL; char *new_password = NULL; - char *c; - char *prompt; + char *c, *prompt; + const char *user; ADS_STATUS ret; + if (opt_user_name == NULL || opt_password == NULL) { + d_printf("You must supply an administrator username/password\n"); + return -1; + } + - if ((argc != 1) || (opt_user_name == NULL) || - (opt_password == NULL) || (strchr(opt_user_name, '@') == NULL) || - (strchr(argv[0], '@') == NULL)) { - return net_ads_usage(argc, argv); + if (argc != 1) { + d_printf("ERROR: You must say which username to change password for\n"); + return -1; + } + + user = argv[0]; + if (!strchr(user, '@')) { + asprintf(&c, "%s@%s", argv[0], lp_realm()); + user = c; } use_in_memory_ccache(); c = strchr(auth_principal, '@'); - realm = ++c; + if (c) { + realm = ++c; + } else { + realm = lp_realm(); + } /* use the realm so we can eventually change passwords for users in realms other than default */ @@ -921,12 +993,12 @@ static int net_ads_password(int argc, const char **argv) return -1; } - asprintf(&prompt, "Enter new password for %s:", argv[0]); + asprintf(&prompt, "Enter new password for %s:", user); new_password = getpass(prompt); ret = kerberos_set_password(ads->auth.kdc_server, auth_principal, - auth_password, argv[0], new_password, ads->auth.time_offset); + auth_password, user, new_password, ads->auth.time_offset); if (!ADS_ERR_OK(ret)) { d_printf("Password change failed :-( ...\n"); ads_destroy(&ads); @@ -934,7 +1006,7 @@ static int net_ads_password(int argc, const char **argv) return -1; } - d_printf("Password change for %s completed.\n", argv[0]); + d_printf("Password change for %s completed.\n", user); ads_destroy(&ads); free(prompt); @@ -967,7 +1039,7 @@ int net_ads_changetrustpw(int argc, const char **argv) } hostname = strdup(global_myname()); - strlower(hostname); + strlower_m(hostname); asprintf(&host_principal, "%s@%s", hostname, ads->config.realm); SAFE_FREE(hostname); d_printf("Changing password for principal: HOST/%s\n", host_principal); @@ -1012,7 +1084,7 @@ static int net_ads_search(int argc, const char **argv) { ADS_STRUCT *ads; ADS_STATUS rc; - const char *exp; + const char *ldap_exp; const char **attrs; void *res = NULL; @@ -1024,12 +1096,12 @@ static int net_ads_search(int argc, const char **argv) return -1; } - exp = argv[0]; + ldap_exp = argv[0]; attrs = (argv + 1); rc = ads_do_search_all(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE, - exp, attrs, &res); + ldap_exp, attrs, &res); if (!ADS_ERR_OK(rc)) { d_printf("search failed: %s\n", ads_errstr(rc)); return -1; diff --git a/source3/utils/net_ads_cldap.c b/source3/utils/net_ads_cldap.c index 86d5abea4b..e74e4b5a4c 100644 --- a/source3/utils/net_ads_cldap.c +++ b/source3/utils/net_ads_cldap.c @@ -24,28 +24,28 @@ #ifdef HAVE_ADS -struct netlogon_string { - uint32 comp_len; - char **component; - uint8 extra_flag; -}; +#define MAX_DNS_LABEL 255 + 1 struct cldap_netlogon_reply { uint32 type; uint32 flags; GUID guid; - struct netlogon_string forest; - struct netlogon_string domain; - struct netlogon_string hostname; - - struct netlogon_string netbios_domain; - struct netlogon_string netbios_hostname; + char forest[MAX_DNS_LABEL]; + char unk0[MAX_DNS_LABEL]; + char domain[MAX_DNS_LABEL]; + char hostname[MAX_DNS_LABEL]; - struct netlogon_string user_name; - struct netlogon_string site_name; + char netbios_domain[MAX_DNS_LABEL]; + char unk1[MAX_DNS_LABEL]; + char netbios_hostname[MAX_DNS_LABEL]; - struct netlogon_string unk0; + char unk2[MAX_DNS_LABEL]; + char user_name[MAX_DNS_LABEL]; + char unk3[MAX_DNS_LABEL]; + char site_name[MAX_DNS_LABEL]; + char unk4[MAX_DNS_LABEL]; + char site_name_2[MAX_DNS_LABEL]; uint32 version; uint16 lmnt_token; @@ -53,38 +53,69 @@ struct cldap_netlogon_reply { }; /* - These strings are rather interesting... They are composed of a series of - length encoded strings, terminated by either 1) a zero length string or 2) - a 0xc0 byte with what appears to be a one byte flags immediately following. + These seem to be strings as described in RFC1035 4.1.4 and can be: + + - a sequence of labels ending in a zero octet + - a pointer + - a sequence of labels ending with a pointer + + A label is a byte where the first two bits must be zero and the remaining + bits represent the length of the label followed by the label itself. + Therefore, the length of a label is at max 64 bytes. Under RFC1035, a + sequence of labels cannot exceed 255 bytes. + + A pointer consists of a 14 bit offset from the beginning of the data. + + struct ptr { + unsigned ident:2; // must be 11 + unsigned offset:14; // from the beginning of data + }; + + This is used as a method to compress the packet by eliminated duplicate + domain components. Since a UDP packet should probably be < 512 bytes and a + DNS name can be up to 255 bytes, this actually makes a lot of sense. */ -static unsigned pull_netlogon_string(struct netlogon_string *ret,const char *d) +static unsigned pull_netlogon_string(char *ret, const char *ptr, + const char *data) { - const char *p = (const char *)d; - - ZERO_STRUCTP(ret); + char *pret = ret; + int followed_ptr = 0; + unsigned ret_len = 0; + memset(pret, 0, MAX_DNS_LABEL); do { - unsigned len = (unsigned char)*p; - p++; - - if (len > 0 && len != 0xc0) { - ret->component = realloc(ret->component, - ++ret->comp_len * - sizeof(char *)); - - ret->component[ret->comp_len - 1] = - smb_xstrndup(p, len); - p += len; - } else { - if (len == 0xc0) { - ret->extra_flag = *p; - p++; - }; - break; + if ((*ptr & 0xc0) == 0xc0) { + uint16 len; + + if (!followed_ptr) { + ret_len += 2; + followed_ptr = 1; + } + len = ((ptr[0] & 0x3f) << 8) | ptr[1]; + ptr = data + len; + } else if (*ptr) { + uint8 len = (uint8)*(ptr++); + + if ((pret - ret + len + 1) >= MAX_DNS_LABEL) { + d_printf("DC returning too long DNS name\n"); + return 0; + } + + if (pret != ret) { + *pret = '.'; + pret++; + } + memcpy(pret, ptr, len); + pret += len; + ptr += len; + + if (!followed_ptr) { + ret_len += (len + 1); + } } - } while (1); + } while (*ptr); - return (p - d); + return ret_len ? ret_len : 1; } /* @@ -95,7 +126,11 @@ static int send_cldap_netlogon(int sock, const char *domain, { ASN1_DATA data; char ntver[4]; +#ifdef CLDAP_USER_QUERY + char aac[4]; + SIVAL(aac, 0, 0x00000180); +#endif SIVAL(ntver, 0, ntversion); memset(&data, 0, sizeof(data)); @@ -121,6 +156,18 @@ static int send_cldap_netlogon(int sock, const char *domain, asn1_write_OctetString(&data, hostname, strlen(hostname)); asn1_pop_tag(&data); +#ifdef CLDAP_USER_QUERY + asn1_push_tag(&data, ASN1_CONTEXT(3)); + asn1_write_OctetString(&data, "User", 4); + asn1_write_OctetString(&data, "SAMBA$", 6); + asn1_pop_tag(&data); + + asn1_push_tag(&data, ASN1_CONTEXT(3)); + asn1_write_OctetString(&data, "AAC", 4); + asn1_write_OctetString(&data, aac, 4); + asn1_pop_tag(&data); +#endif + asn1_push_tag(&data, ASN1_CONTEXT(3)); asn1_write_OctetString(&data, "NtVer", 5); asn1_write_OctetString(&data, ntver, 4); @@ -144,7 +191,6 @@ static int send_cldap_netlogon(int sock, const char *domain, d_printf("failed to send cldap query (%s)\n", strerror(errno)); } - file_save("cldap_query.dat", data.data, data.length); asn1_free(&data); return 0; @@ -173,8 +219,6 @@ static int recv_cldap_netlogon(int sock, struct cldap_netlogon_reply *reply) } blob.length = ret; - file_save("cldap_reply.dat", blob.data, blob.length); - asn1_load(&data, blob); asn1_start_tag(&data, ASN1_SEQUENCE(0)); asn1_read_Integer(&data, &i1); @@ -196,8 +240,6 @@ static int recv_cldap_netlogon(int sock, struct cldap_netlogon_reply *reply) return -1; } - file_save("cldap_reply_core.dat", os3.data, os3.length); - p = os3.data; reply->type = IVAL(p, 0); p += 4; @@ -206,15 +248,25 @@ static int recv_cldap_netlogon(int sock, struct cldap_netlogon_reply *reply) memcpy(&reply->guid.info, p, GUID_SIZE); p += GUID_SIZE; - p += pull_netlogon_string(&reply->forest, p); - p += pull_netlogon_string(&reply->domain, p); - p += pull_netlogon_string(&reply->hostname, p); - p += pull_netlogon_string(&reply->netbios_domain, p); - p += pull_netlogon_string(&reply->netbios_hostname, p); - p += pull_netlogon_string(&reply->user_name, p); - p += pull_netlogon_string(&reply->site_name, p); + p += pull_netlogon_string(reply->forest, p, os3.data); + p += pull_netlogon_string(reply->unk0, p, os3.data); + p += pull_netlogon_string(reply->domain, p, os3.data); + p += pull_netlogon_string(reply->hostname, p, os3.data); + p += pull_netlogon_string(reply->netbios_domain, p, os3.data); + p += pull_netlogon_string(reply->unk1, p, os3.data); + p += pull_netlogon_string(reply->netbios_hostname, p, os3.data); + p += pull_netlogon_string(reply->unk2, p, os3.data); + + if (reply->type == SAMLOGON_AD_R) { + p += pull_netlogon_string(reply->user_name, p, os3.data); + } else { + *reply->user_name = 0; + } - p += pull_netlogon_string(&reply->unk0, p); + p += pull_netlogon_string(reply->unk3, p, os3.data); + p += pull_netlogon_string(reply->site_name, p, os3.data); + p += pull_netlogon_string(reply->unk4, p, os3.data); + p += pull_netlogon_string(reply->site_name_2, p, os3.data); reply->version = IVAL(p, 0); reply->lmnt_token = SVAL(p, 4); @@ -228,52 +280,6 @@ static int recv_cldap_netlogon(int sock, struct cldap_netlogon_reply *reply) return 0; } -/* - free a netlogon string -*/ -static void netlogon_string_free(struct netlogon_string *str) -{ - unsigned int i; - - for (i = 0; i < str->comp_len; ++i) { - SAFE_FREE(str->component[i]); - } - SAFE_FREE(str->component); -} - -/* - free a cldap reply packet -*/ -static void cldap_reply_free(struct cldap_netlogon_reply *reply) -{ - netlogon_string_free(&reply->forest); - netlogon_string_free(&reply->domain); - netlogon_string_free(&reply->hostname); - netlogon_string_free(&reply->netbios_domain); - netlogon_string_free(&reply->netbios_hostname); - netlogon_string_free(&reply->user_name); - netlogon_string_free(&reply->site_name); - netlogon_string_free(&reply->unk0); -} - -static void d_print_netlogon_string(const char *label, - struct netlogon_string *str) -{ - unsigned int i; - - if (str->comp_len) { - d_printf("%s", label); - if (str->extra_flag) { - d_printf("[%d]", str->extra_flag); - } - d_printf(": "); - for (i = 0; i < str->comp_len; ++i) { - d_printf("%s%s", (i ? "." : ""), str->component[i]); - } - d_printf("\n"); - } -} - /* do a cldap netlogon query */ @@ -289,6 +295,7 @@ int ads_cldap_netlogon(ADS_STRUCT *ads) inet_ntoa(ads->ldap_ip), ads->ldap_port); return -1; + } ret = send_cldap_netlogon(sock, ads->config.realm, global_myname(), 6); @@ -305,7 +312,18 @@ int ads_cldap_netlogon(ADS_STRUCT *ads) d_printf("Information for Domain Controller: %s\n\n", ads->config.ldap_server_name); - d_printf("Response Type: 0x%x\n", reply.type); + d_printf("Response Type: "); + switch (reply.type) { + case SAMLOGON_AD_UNK_R: + d_printf("SAMLOGON\n"); + break; + case SAMLOGON_AD_R: + d_printf("SAMLOGON_USER\n"); + break; + default: + d_printf("0x%x\n", reply.type); + break; + } d_printf("GUID: "); print_guid(&reply.guid); d_printf("Flags:\n" @@ -330,23 +348,27 @@ int ads_cldap_netlogon(ADS_STRUCT *ads) (reply.flags & ADS_GOOD_TIMESERV) ? "yes" : "no", (reply.flags & ADS_NDNC) ? "yes" : "no"); - d_print_netlogon_string("Forest", &reply.forest); - d_print_netlogon_string("Domain", &reply.domain); - d_print_netlogon_string("Hostname", &reply.hostname); + printf("Forest:\t\t\t%s\n", reply.forest); + if (*reply.unk0) printf("Unk0:\t\t\t%s\n", reply.unk0); + printf("Domain:\t\t\t%s\n", reply.domain); + printf("Domain Controller:\t%s\n", reply.hostname); - d_print_netlogon_string("Pre-Win2k Domain", &reply.netbios_domain); - d_print_netlogon_string("Pre-Win2k Hostname", &reply.netbios_hostname); + printf("Pre-Win2k Domain:\t%s\n", reply.netbios_domain); + if (*reply.unk1) printf("Unk1:\t\t\t%s\n", reply.unk1); + printf("Pre-Win2k Hostname:\t%s\n", reply.netbios_hostname); - d_print_netlogon_string("User name", &reply.user_name); - d_print_netlogon_string("Site Name", &reply.site_name); - d_print_netlogon_string("Unknown Field", &reply.unk0); + if (*reply.unk2) printf("Unk2:\t\t\t%s\n", reply.unk2); + if (*reply.user_name) printf("User name:\t%s\n", reply.user_name); + + if (*reply.unk3) printf("Unk3:\t\t\t%s\n", reply.unk3); + printf("Site Name:\t\t%s\n", reply.site_name); + if (*reply.unk4) printf("Unk4:\t\t\t%s\n", reply.unk4); + printf("Site Name (2):\t\t%s\n", reply.site_name_2); d_printf("NT Version: %d\n", reply.version); d_printf("LMNT Token: %.2x\n", reply.lmnt_token); d_printf("LM20 Token: %.2x\n", reply.lm20_token); - cldap_reply_free(&reply); - return ret; } diff --git a/source3/utils/net_cache.c b/source3/utils/net_cache.c index 93c4f1aa1d..8dd9db599d 100644 --- a/source3/utils/net_cache.c +++ b/source3/utils/net_cache.c @@ -64,7 +64,7 @@ static void delete_cache_entry(const char* keystr, const char* datastr, const time_t timeout, void* dptr) { if (!gencache_del(keystr)) - d_printf("Couldn't delete entry! key = %s", keystr); + d_printf("Couldn't delete entry! key = %s\n", keystr); } diff --git a/source3/utils/net_groupmap.c b/source3/utils/net_groupmap.c index 905fdf6287..8831839e4e 100644 --- a/source3/utils/net_groupmap.c +++ b/source3/utils/net_groupmap.c @@ -65,7 +65,7 @@ static BOOL get_sid_from_input(DOM_SID *sid, char *input) if (StrnCaseCmp( input, "S-", 2)) { /* Perhaps its the NT group name? */ - if (!pdb_getgrnam(&map, input, MAPPING_WITHOUT_PRIV)) { + if (!pdb_getgrnam(&map, input)) { printf("NT Group %s doesn't exist in mapping DB\n", input); return False; } else { @@ -88,11 +88,9 @@ static void print_map_entry ( GROUP_MAP map, BOOL long_list ) { fstring string_sid; fstring group_type; - fstring priv_text; decode_sid_name_use(group_type, map.sid_name_use); sid_to_string(string_sid, &map.sid); - convert_priv_to_text(&(map.priv_set), priv_text); if (!long_list) d_printf("%s (%s) -> %s\n", map.nt_name, string_sid, gidtoname(map.gid)); @@ -102,14 +100,13 @@ static void print_map_entry ( GROUP_MAP map, BOOL long_list ) d_printf("\tUnix group: %s\n", gidtoname(map.gid)); d_printf("\tGroup type: %s\n", group_type); d_printf("\tComment : %s\n", map.comment); - d_printf("\tPrivilege : %s\n\n", priv_text); } } /********************************************************* List the groups. **********************************************************/ -int net_groupmap_list(int argc, const char **argv) +static int net_groupmap_list(int argc, const char **argv) { int entries; BOOL long_list = False; @@ -155,24 +152,24 @@ int net_groupmap_list(int argc, const char **argv) } /* Get the current mapping from the database */ - if(!pdb_getgrsid(&map, sid, MAPPING_WITH_PRIV)) { + if(!pdb_getgrsid(&map, sid)) { d_printf("Failure to local group SID in the database\n"); return -1; } print_map_entry( map, long_list ); - free_privilege(&(map.priv_set)); } else { GROUP_MAP *map=NULL; /* enumerate all group mappings */ - if ( !pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &entries, ENUM_ALL_MAPPED, MAPPING_WITH_PRIV) ) + if (!pdb_enum_group_mapping(SID_NAME_UNKNOWN, &map, &entries, ENUM_ALL_MAPPED)) return -1; for (i=0; i] join [misc. options]\n" diff --git a/source3/utils/net_lookup.c b/source3/utils/net_lookup.c index 271094480c..8456da4e0c 100644 --- a/source3/utils/net_lookup.c +++ b/source3/utils/net_lookup.c @@ -124,11 +124,11 @@ static int net_lookup_ldap(int argc, const char **argv) static int net_lookup_dc(int argc, const char **argv) { - struct in_addr *ip_list, addr; + struct ip_service *ip_list; + struct in_addr addr; char *pdc_str = NULL; const char *domain=opt_target_workgroup; int count, i; - BOOL list_ordered; if (argc > 0) domain=argv[0]; @@ -140,12 +140,12 @@ static int net_lookup_dc(int argc, const char **argv) asprintf(&pdc_str, "%s", inet_ntoa(addr)); d_printf("%s\n", pdc_str); - if (!get_dc_list(domain, &ip_list, &count, &list_ordered)) { + if (!get_sorted_dc_list(domain, &ip_list, &count, False)) { SAFE_FREE(pdc_str); return 0; } for (i=0;i= 0) { + sec_channel_type = get_sec_channel_type(argv[0]); + } else { + sec_channel_type = get_sec_channel_type(NULL); + } + fstrcpy(trust_passwd, global_myname()); - strlower(trust_passwd); + strlower_m(trust_passwd); /* * Machine names can be 15 characters, but the max length on @@ -257,11 +268,7 @@ static NTSTATUS rpc_join_oldstyle_internals(const DOM_SID *domain_sid, struct cl result = trust_pw_change_and_store_it(cli, mem_ctx, opt_target_workgroup, orig_trust_passwd_hash, - SEC_CHAN_WKSTA); - - /* SEC_CHAN_WKSTA specified specifically, as you cannot use this - to join a BDC to the domain (MS won't allow it, and is *really* - insecure) */ + sec_channel_type); if (NT_STATUS_IS_OK(result)) printf("Joined domain %s.\n",opt_target_workgroup); @@ -275,35 +282,6 @@ static NTSTATUS rpc_join_oldstyle_internals(const DOM_SID *domain_sid, struct cl return result; } -/** - * Join a domain, the old way. - * - * @param argc Standard main() style argc - * @param argc Standard main() style argv. Initial components are already - * stripped - * - * @return A shell status integer (0 for success) - **/ - -static int net_rpc_join_oldstyle(int argc, const char **argv) -{ - uint32 sec_channel_type; - /* check what type of join */ - if (argc >= 0) { - sec_channel_type = get_sec_channel_type(argv[0]); - } else { - sec_channel_type = get_sec_channel_type(NULL); - } - - if (sec_channel_type != SEC_CHAN_WKSTA) - return 1; - - return run_rpc_command(NULL, PI_NETLOGON, - NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC, - rpc_join_oldstyle_internals, - argc, argv); -} - /** * Join a domain, the old way. * @@ -318,7 +296,7 @@ static int net_rpc_oldjoin(int argc, const char **argv) { return run_rpc_command(NULL, PI_NETLOGON, NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC, - rpc_join_oldstyle_internals, + rpc_oldjoin_internals, argc, argv); } @@ -351,13 +329,13 @@ static int rpc_join_usage(int argc, const char **argv) * * Main 'net_rpc_join()' (where the admain username/password is used) is * in net_rpc_join.c - * Assume if a -U is specified, it's the new style, otherwise it's the - * old style. If 'oldstyle' is specfied explicity, do it and don't prompt. + * Try to just change the password, but if that doesn't work, use/prompt + * for a username/password. **/ int net_rpc_join(int argc, const char **argv) { - if ((net_rpc_join_oldstyle(argc, argv) == 0)) + if ((net_rpc_oldjoin(argc, argv) == 0)) return 0; return net_rpc_join_newstyle(argc, argv); @@ -862,11 +840,11 @@ rpc_user_list_internals(const DOM_SID *domain_sid, struct cli_state *cli, unistr2_to_ascii(desc, &(&ctr.sam.info1->str[i])->uni_acct_desc, sizeof(desc)-1); if (opt_long_list_entries) - printf("%-21.21s %-50.50s\n", user, desc); + printf("%-21.21s %s\n", user, desc); else printf("%s\n", user); } - } while (!NT_STATUS_IS_OK(result)); + } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)); done: return result; @@ -937,7 +915,7 @@ rpc_group_list_internals(const DOM_SID *domain_sid, struct cli_state *cli, { POLICY_HND connect_pol, domain_pol; NTSTATUS result = NT_STATUS_UNSUCCESSFUL; - uint32 start_idx=0, max_entries=250, num_entries, i; + uint32 start_idx=0, max_entries=250, num_entries, i, loop_count = 0; struct acct_info *groups; DOM_SID global_sid_Builtin; @@ -965,34 +943,75 @@ rpc_group_list_internals(const DOM_SID *domain_sid, struct cli_state *cli, d_printf("\nGroup name Comment"\ "\n-----------------------------\n"); do { - result = cli_samr_enum_dom_groups(cli, mem_ctx, &domain_pol, - &start_idx, max_entries, - &groups, &num_entries); + SAM_DISPINFO_CTR ctr; + SAM_DISPINFO_3 info3; + uint32 max_size; + + ZERO_STRUCT(ctr); + ZERO_STRUCT(info3); + ctr.sam.info3 = &info3; + + get_query_dispinfo_params( + loop_count, &max_entries, &max_size); + + result = cli_samr_query_dispinfo(cli, mem_ctx, &domain_pol, + &start_idx, 3, &num_entries, + max_entries, max_size, &ctr); for (i = 0; i < num_entries; i++) { + + fstring group, desc; + + unistr2_to_ascii(group, &(&ctr.sam.info3->str[i])->uni_grp_name, sizeof(group)-1); + unistr2_to_ascii(desc, &(&ctr.sam.info3->str[i])->uni_grp_desc, sizeof(desc)-1); + if (opt_long_list_entries) - printf("%-21.21s %-50.50s\n", - groups[i].acct_name, - groups[i].acct_desc); + printf("%-21.21s %-50.50s\n", + group, desc); else - printf("%-21.21s\n", groups[i].acct_name); + printf("%-21.21s\n", group); } - } while (NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES)); + } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)); /* query domain aliases */ + start_idx = 0; do { result = cli_samr_enum_als_groups(cli, mem_ctx, &domain_pol, &start_idx, max_entries, &groups, &num_entries); - + for (i = 0; i < num_entries; i++) { - if (opt_long_list_entries) + + char *description = NULL; + + if (opt_long_list_entries) { + + POLICY_HND alias_pol; + ALIAS_INFO_CTR ctr; + + if ((NT_STATUS_IS_OK(cli_samr_open_alias(cli, mem_ctx, + &domain_pol, + 0x8, + groups[i].rid, + &alias_pol))) && + (NT_STATUS_IS_OK(cli_samr_query_alias_info(cli, mem_ctx, + &alias_pol, 3, + &ctr))) && + (NT_STATUS_IS_OK(cli_samr_close(cli, mem_ctx, + &alias_pol)))) { + description = unistr2_tdup(mem_ctx, + &ctr.alias.info3.uni_acct_desc); + } + } + + if (description != NULL) { printf("%-21.21s %-50.50s\n", groups[i].acct_name, - groups[i].acct_desc); - else + description); + } else { printf("%-21.21s\n", groups[i].acct_name); + } } - } while (NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES)); + } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)); cli_samr_close(cli, mem_ctx, &domain_pol); /* Get builtin policy handle */ @@ -1003,20 +1022,45 @@ rpc_group_list_internals(const DOM_SID *domain_sid, struct cli_state *cli, goto done; } /* query builtin aliases */ + start_idx = 0; do { result = cli_samr_enum_als_groups(cli, mem_ctx, &domain_pol, &start_idx, max_entries, &groups, &num_entries); for (i = 0; i < num_entries; i++) { - if (opt_long_list_entries) + + char *description = NULL; + + if (opt_long_list_entries) { + + POLICY_HND alias_pol; + ALIAS_INFO_CTR ctr; + + if ((NT_STATUS_IS_OK(cli_samr_open_alias(cli, mem_ctx, + &domain_pol, + 0x8, + groups[i].rid, + &alias_pol))) && + (NT_STATUS_IS_OK(cli_samr_query_alias_info(cli, mem_ctx, + &alias_pol, 3, + &ctr))) && + (NT_STATUS_IS_OK(cli_samr_close(cli, mem_ctx, + &alias_pol)))) { + description = unistr2_tdup(mem_ctx, + &ctr.alias.info3.uni_acct_desc); + } + } + + if (description != NULL) { printf("%-21.21s %-50.50s\n", groups[i].acct_name, - groups[i].acct_desc); - else - printf("%s\n", groups[i].acct_name); + description); + } else { + printf("%-21.21s\n", groups[i].acct_name); + } } - } while (NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES)); + } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)); done: return result; @@ -1576,8 +1620,8 @@ static NTSTATUS rpc_trustdom_add_internals(const DOM_SID *domain_sid, struct cli uint16 acb_info; uint32 unknown, user_rid; - if (argc != 1) { - d_printf("Usage: net rpc trustdom add \n"); + if (argc != 2) { + d_printf("Usage: net rpc trustdom add \n"); return NT_STATUS_INVALID_PARAMETER; } @@ -1589,7 +1633,7 @@ static NTSTATUS rpc_trustdom_add_internals(const DOM_SID *domain_sid, struct cli return NT_STATUS_NO_MEMORY; } - strupper(acct_name); + strupper_m(acct_name); /* Get samr policy handle */ result = cli_samr_connect(cli, mem_ctx, MAXIMUM_ALLOWED_ACCESS, @@ -1608,7 +1652,7 @@ static NTSTATUS rpc_trustdom_add_internals(const DOM_SID *domain_sid, struct cli /* Create trusting domain's account */ acb_info = ACB_DOMTRUST; - unknown = 0xe005000b; /* No idea what this is - a permission mask? + unknown = 0xe00500b0; /* No idea what this is - a permission mask? mimir: yes, most probably it is */ result = cli_samr_create_dom_user(cli, mem_ctx, &domain_pol, @@ -1618,6 +1662,37 @@ static NTSTATUS rpc_trustdom_add_internals(const DOM_SID *domain_sid, struct cli goto done; } + { + SAM_USERINFO_CTR ctr; + SAM_USER_INFO_24 p24; + fstring ucs2_trust_password; + int ucs2_pw_len; + uchar pwbuf[516]; + + ucs2_pw_len = push_ucs2(NULL, ucs2_trust_password, argv[1], + sizeof(ucs2_trust_password), 0); + + encode_pw_buffer((char *)pwbuf, ucs2_trust_password, + ucs2_pw_len); + + ZERO_STRUCT(ctr); + ZERO_STRUCT(p24); + + init_sam_user_info24(&p24, (char *)pwbuf, 24); + + ctr.switch_value = 24; + ctr.info.id24 = &p24; + + result = cli_samr_set_userinfo(cli, mem_ctx, &user_pol, 24, + cli->user_session_key, &ctr); + + if (!NT_STATUS_IS_OK(result)) { + DEBUG(0,("Could not set trust account password: %s\n", + nt_errstr(result))); + goto done; + } + } + done: SAFE_FREE(acct_name); return result; @@ -1689,11 +1764,11 @@ static int rpc_trustdom_establish(int argc, const char **argv) } domain_name = smb_xstrdup(argv[0]); - strupper(domain_name); + strupper_m(domain_name); /* account name used at first is our domain's name with '$' */ asprintf(&acct_name, "%s$", lp_workgroup()); - strupper(acct_name); + strupper_m(acct_name); /* * opt_workgroup will be used by connection functions further, @@ -1706,7 +1781,7 @@ static int rpc_trustdom_establish(int argc, const char **argv) opt_user_name = acct_name; /* find the domain controller */ - if (!net_find_dc(&server_ip, pdc_name, domain_name)) { + if (!net_find_pdc(&server_ip, pdc_name, domain_name)) { DEBUG(0, ("Coulnd find domain controller for domain %s\n", domain_name)); return -1; } @@ -1785,7 +1860,7 @@ static int rpc_trustdom_establish(int argc, const char **argv) return -1; } - nt_status = cli_lsa_open_policy2(cli, mem_ctx, False, SEC_RIGHTS_QUERY_VALUE, + nt_status = cli_lsa_open_policy2(cli, mem_ctx, True, SEC_RIGHTS_QUERY_VALUE, &connect_hnd); if (NT_STATUS_IS_ERR(nt_status)) { DEBUG(0, ("Couldn't open policy handle. Error was %s\n", @@ -1804,6 +1879,9 @@ static int rpc_trustdom_establish(int argc, const char **argv) return -1; } + + + /* There should be actually query info level 3 (following nt serv behaviour), but I still don't know if it's _really_ necessary */ @@ -1855,7 +1933,7 @@ static int rpc_trustdom_revoke(int argc, const char **argv) /* generate upper cased domain name */ domain_name = smb_xstrdup(argv[0]); - strupper(domain_name); + strupper_m(domain_name); /* delete password of the trust */ if (!trusted_domain_password_delete(domain_name)) { @@ -2089,7 +2167,7 @@ static int rpc_trustdom_list(int argc, const char **argv) do padding[--pad_len] = ' '; while (pad_len); /* set opt_* variables to remote domain */ - strupper(trusting_dom_names[i]); + strupper_m(trusting_dom_names[i]); opt_workgroup = talloc_strdup(mem_ctx, trusting_dom_names[i]); opt_target_workgroup = opt_workgroup; diff --git a/source3/utils/net_rpc_join.c b/source3/utils/net_rpc_join.c index e389cf8ef8..22ed49c74f 100644 --- a/source3/utils/net_rpc_join.c +++ b/source3/utils/net_rpc_join.c @@ -49,7 +49,6 @@ int net_rpc_join_ok(const char *domain) int retval = 1; uint32 channel; NTSTATUS result; - uint32 neg_flags = 0x000001ff; /* Connect to remote machine */ if (!(cli = net_make_ipc_connection(NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC))) { @@ -68,10 +67,12 @@ int net_rpc_join_ok(const char *domain) goto done; } - CHECK_RPC_ERR(cli_nt_setup_creds(cli, - channel, - stored_md4_trust_password, &neg_flags, 2), - "error in domain join verification"); + /* ensure that schannel uses the right domain */ + fstrcpy(cli->domain, domain); + if (! NT_STATUS_IS_OK(result = cli_nt_establish_netlogon(cli, channel, stored_md4_trust_password))) { + DEBUG(0,("Error in domain join verfication\n")); + goto done; + } retval = 0; /* Success! */ @@ -131,7 +132,6 @@ int net_rpc_join_newstyle(int argc, const char **argv) uint32 flags = 0x3e8; char *acct_name; const char *const_acct_name; - uint32 neg_flags = 0x000001ff; /* check what type of join */ if (argc >= 0) { @@ -167,7 +167,7 @@ int net_rpc_join_newstyle(int argc, const char **argv) /* Fetch domain sid */ if (!cli_nt_session_open(cli, PI_LSARPC)) { - DEBUG(0, ("Error connecting to SAM pipe\n")); + DEBUG(0, ("Error connecting to LSA pipe\n")); goto done; } @@ -204,7 +204,7 @@ int net_rpc_join_newstyle(int argc, const char **argv) /* Create domain user */ acct_name = talloc_asprintf(mem_ctx, "%s$", global_myname()); - strlower(acct_name); + strlower_m(acct_name); const_acct_name = acct_name; result = cli_samr_create_dom_user(cli, mem_ctx, &domain_pol, @@ -240,7 +240,7 @@ int net_rpc_join_newstyle(int argc, const char **argv) acct_name, nt_errstr(result))); if (name_types[0] != SID_NAME_USER) { - DEBUG(0, ("%s is not a user account\n", acct_name)); + DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name, name_types[0])); goto done; } @@ -315,14 +315,29 @@ int net_rpc_join_newstyle(int argc, const char **argv) goto done; } - CHECK_RPC_ERR(cli_nt_setup_creds(cli, - sec_channel_type, - md4_trust_password, &neg_flags, 2), - "error in domain join verification"); - + /* ensure that schannel uses the right domain */ + fstrcpy(cli->domain, domain); + + result = cli_nt_establish_netlogon(cli, sec_channel_type, + md4_trust_password); + + if (!NT_STATUS_IS_OK(result)) { + DEBUG(0, ("Error domain join verification: %s\n\n", + nt_errstr(result))); + + if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) && + (sec_channel_type == SEC_CHAN_BDC) ) { + d_printf("Please make sure that no computer account\n" + "named like this machine (%s) exists in the domain\n", + global_myname()); + } + + goto done; + } + /* Now store the secret in the secrets database */ - strupper(domain); + strupper_m(domain); if (!secrets_store_domain_sid(domain, &domain_sid)) { DEBUG(0, ("error storing domain sid for %s\n", domain)); @@ -366,7 +381,7 @@ done: **/ int net_rpc_testjoin(int argc, const char **argv) { - char *domain = smb_xstrdup(lp_workgroup()); + char *domain = smb_xstrdup(opt_target_workgroup); /* Display success or failure */ if (net_rpc_join_ok(domain) != 0) { diff --git a/source3/utils/net_rpc_samsync.c b/source3/utils/net_rpc_samsync.c index 42bb480844..e5e9a68b2e 100644 --- a/source3/utils/net_rpc_samsync.c +++ b/source3/utils/net_rpc_samsync.c @@ -209,6 +209,11 @@ int rpc_samdump(int argc, const char **argv) fstrcpy(cli->domain, lp_workgroup()); + if (!cli_nt_session_open(cli, PI_NETLOGON)) { + DEBUG(0,("Could not open connection to NETLOGON pipe\n")); + goto fail; + } + if (!secrets_fetch_trust_account_password(lp_workgroup(), trust_password, NULL, &sec_channel)) { @@ -216,7 +221,8 @@ int rpc_samdump(int argc, const char **argv) goto fail; } - if (!cli_nt_open_netlogon(cli, trust_password, sec_channel)) { + if (!NT_STATUS_IS_OK(cli_nt_establish_netlogon(cli, sec_channel, + trust_password))) { DEBUG(0,("Error connecting to NETLOGON pipe\n")); goto fail; } @@ -403,8 +409,10 @@ fetch_account_info(uint32 rid, SAM_ACCOUNT_INFO *delta) SAM_ACCOUNT *sam_account=NULL; GROUP_MAP map; struct group *grp; - DOM_SID sid; - BOOL try_add = False; + DOM_SID user_sid; + DOM_SID group_sid; + struct passwd *passwd; + fstring sid_string; fstrcpy(account, unistr2_static(&delta->uni_acct_name)); d_printf("Creating account: %s\n", account); @@ -412,7 +420,7 @@ fetch_account_info(uint32 rid, SAM_ACCOUNT_INFO *delta) if (!NT_STATUS_IS_OK(nt_ret = pdb_init_sam(&sam_account))) return nt_ret; - if (!pdb_getsampwnam(sam_account, account)) { + if (!(passwd = Get_Pwnam(account))) { /* Create appropriate user */ if (delta->acb_info & ACB_NORMAL) { pstrcpy(add_script, lp_adduser_script()); @@ -423,8 +431,6 @@ fetch_account_info(uint32 rid, SAM_ACCOUNT_INFO *delta) } else { DEBUG(1, ("Unknown user type: %s\n", smbpasswd_encode_acb_info(delta->acb_info))); - pdb_free_sam(&sam_account); - return NT_STATUS_NO_SUCH_USER; } if (*add_script) { int add_ret; @@ -434,44 +440,68 @@ fetch_account_info(uint32 rid, SAM_ACCOUNT_INFO *delta) DEBUG(1,("fetch_account: Running the command `%s' " "gave %d\n", add_script, add_ret)); } - - try_add = True; + else { + DEBUG(8,("fetch_account_info: no add user/machine script. Asking winbindd\n")); + + /* don't need a RID allocated since the user already has a SID */ + if ( !winbind_create_user( account, NULL ) ) + DEBUG(4,("fetch_account_info: winbind_create_user() failed\n")); + } + + /* try and find the possible unix account again */ + if ( !(passwd = Get_Pwnam(account)) ) + return NT_STATUS_NO_SUCH_USER; + } - - sam_account_from_delta(sam_account, delta); - - if (try_add) { + + sid_copy(&user_sid, get_global_sam_sid()); + sid_append_rid(&user_sid, delta->user_rid); + + DEBUG(3, ("Attempting to find SID %s for user %s in the passdb\n", sid_to_string(sid_string, &user_sid), account)); + if (!pdb_getsampwsid(sam_account, &user_sid)) { + sam_account_from_delta(sam_account, delta); + DEBUG(3, ("Attempting to add user SID %s for user %s in the passdb\n", + sid_to_string(sid_string, &user_sid), pdb_get_username(sam_account))); if (!pdb_add_sam_account(sam_account)) { DEBUG(1, ("SAM Account for %s failed to be added to the passdb!\n", account)); + return NT_STATUS_ACCESS_DENIED; } } else { + sam_account_from_delta(sam_account, delta); + DEBUG(3, ("Attempting to update user SID %s for user %s in the passdb\n", + sid_to_string(sid_string, &user_sid), pdb_get_username(sam_account))); if (!pdb_update_sam_account(sam_account)) { DEBUG(1, ("SAM Account for %s failed to be updated in the passdb!\n", account)); + pdb_free_sam(&sam_account); + return NT_STATUS_ACCESS_DENIED; } } - sid = *pdb_get_group_sid(sam_account); + group_sid = *pdb_get_group_sid(sam_account); - if (!pdb_getgrsid(&map, sid, False)) { + if (!pdb_getgrsid(&map, group_sid)) { DEBUG(0, ("Primary group of %s has no mapping!\n", pdb_get_username(sam_account))); - pdb_free_sam(&sam_account); - return NT_STATUS_NO_SUCH_GROUP; - } + } else { + if (map.gid != passwd->pw_gid) { + if (!(grp = getgrgid(map.gid))) { + DEBUG(0, ("Could not find unix group %d for user %s (group SID=%s)\n", + map.gid, pdb_get_username(sam_account), sid_string_static(&group_sid))); + } else { + smb_set_primary_group(grp->gr_name, pdb_get_username(sam_account)); + } + } + } - if (!(grp = getgrgid(map.gid))) { - DEBUG(0, ("Could not find unix group %d for user %s (group SID=%s)\n", - map.gid, pdb_get_username(sam_account), sid_string_static(&sid))); - pdb_free_sam(&sam_account); - return NT_STATUS_NO_SUCH_GROUP; + if ( !passwd ) { + DEBUG(1, ("No unix user for this account (%s), cannot adjust mappings\n", + pdb_get_username(sam_account))); } - smb_set_primary_group(grp->gr_name, pdb_get_username(sam_account)); - pdb_free_sam(&sam_account); - return NT_STATUS_OK; + return nt_ret; } static NTSTATUS @@ -493,22 +523,26 @@ fetch_group_info(uint32 rid, SAM_GROUP_INFO *delta) sid_append_rid(&group_sid, rid); sid_to_string(sid_string, &group_sid); - if (pdb_getgrsid(&map, group_sid, False)) { - grp = getgrgid(map.gid); + if (pdb_getgrsid(&map, group_sid)) { + if ( map.gid != -1 ) + grp = getgrgid(map.gid); insert = False; } - if (grp == NULL) - { + if (grp == NULL) { gid_t gid; /* No group found from mapping, find it from its name. */ if ((grp = getgrnam(name)) == NULL) { + /* No appropriate group found, create one */ + d_printf("Creating unix group: '%s'\n", name); + if (smb_create_group(name, &gid) != 0) return NT_STATUS_ACCESS_DENIED; - if ((grp = getgrgid(gid)) == NULL) + + if ((grp = getgrnam(name)) == NULL) return NT_STATUS_ACCESS_DENIED; } } @@ -519,9 +553,6 @@ fetch_group_info(uint32 rid, SAM_GROUP_INFO *delta) fstrcpy(map.nt_name, name); fstrcpy(map.comment, comment); - map.priv_set.count = 0; - map.priv_set.set = NULL; - if (insert) pdb_add_group_mapping_entry(&map); else @@ -548,7 +579,7 @@ fetch_group_mem_info(uint32 rid, SAM_GROUP_MEM_INFO *delta) sid_copy(&group_sid, get_global_sam_sid()); sid_append_rid(&group_sid, rid); - if (!get_domain_group_from_sid(group_sid, &map, False)) { + if (!get_domain_group_from_sid(group_sid, &map)) { DEBUG(0, ("Could not find global group %d\n", rid)); return NT_STATUS_NO_SUCH_GROUP; } @@ -673,7 +704,7 @@ static NTSTATUS fetch_alias_info(uint32 rid, SAM_ALIAS_INFO *delta, sid_append_rid(&alias_sid, rid); sid_to_string(sid_string, &alias_sid); - if (pdb_getgrsid(&map, alias_sid, False)) { + if (pdb_getgrsid(&map, alias_sid)) { grp = getgrgid(map.gid); insert = False; } @@ -703,9 +734,6 @@ static NTSTATUS fetch_alias_info(uint32 rid, SAM_ALIAS_INFO *delta, fstrcpy(map.nt_name, name); fstrcpy(map.comment, comment); - map.priv_set.count = 0; - map.priv_set.set = NULL; - if (insert) pdb_add_group_mapping_entry(&map); else @@ -885,7 +913,7 @@ fetch_sam_entry(SAM_DELTA_HDR *hdr_delta, SAM_DELTA_CTR *delta, &delta->als_mem_info, dom_sid); break; case SAM_DELTA_DOMAIN_INFO: - d_printf("SAMBA_DELTA_DOMAIN_INFO not handled\n"); + d_printf("SAM_DELTA_DOMAIN_INFO not handled\n"); break; default: d_printf("Unknown delta record type %d\n", hdr_delta->type); @@ -893,7 +921,7 @@ fetch_sam_entry(SAM_DELTA_HDR *hdr_delta, SAM_DELTA_CTR *delta, } } -static void +static NTSTATUS fetch_database(struct cli_state *cli, unsigned db_type, DOM_CRED *ret_creds, DOM_SID dom_sid) { @@ -905,9 +933,8 @@ fetch_database(struct cli_state *cli, unsigned db_type, DOM_CRED *ret_creds, SAM_DELTA_CTR *deltas; uint32 num_deltas; - if (!(mem_ctx = talloc_init("fetch_database"))) { - return; - } + if (!(mem_ctx = talloc_init("fetch_database"))) + return NT_STATUS_NO_MEMORY; switch( db_type ) { case SAM_DATABASE_DOMAIN: @@ -929,15 +956,25 @@ fetch_database(struct cli_state *cli, unsigned db_type, DOM_CRED *ret_creds, db_type, sync_context, &num_deltas, &hdr_deltas, &deltas); - clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), - ret_creds); - for (i = 0; i < num_deltas; i++) { - fetch_sam_entry(&hdr_deltas[i], &deltas[i], dom_sid); - } + + if (NT_STATUS_IS_OK(result) || + NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) { + + clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), + ret_creds); + + for (i = 0; i < num_deltas; i++) { + fetch_sam_entry(&hdr_deltas[i], &deltas[i], dom_sid); + } + } else + return result; + sync_context += 1; } while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)); talloc_destroy(mem_ctx); + + return result; } /* dump sam database via samsync rpc calls */ @@ -947,7 +984,6 @@ int rpc_vampire(int argc, const char **argv) struct cli_state *cli = NULL; uchar trust_password[16]; DOM_CRED ret_creds; - uint32 neg_flags = 0x000001ff; DOM_SID dom_sid; uint32 sec_channel; @@ -971,18 +1007,35 @@ int rpc_vampire(int argc, const char **argv) goto fail; } - result = cli_nt_setup_creds(cli, sec_channel, trust_password, - &neg_flags, 2); + result = cli_nt_establish_netlogon(cli, sec_channel, trust_password); + if (!NT_STATUS_IS_OK(result)) { d_printf("Failed to setup BDC creds\n"); goto fail; } - dom_sid = *get_global_sam_sid(); - fetch_database(cli, SAM_DATABASE_DOMAIN, &ret_creds, dom_sid); + sid_copy( &dom_sid, get_global_sam_sid() ); + result = fetch_database(cli, SAM_DATABASE_DOMAIN, &ret_creds, dom_sid); + + if (!NT_STATUS_IS_OK(result)) { + d_printf("Failed to fetch domain database: %s\n", + nt_errstr(result)); + if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) + d_printf("Perhaps %s is a Windows 2000 native mode " + "domain?\n", lp_workgroup()); + goto fail; + } sid_copy(&dom_sid, &global_sid_Builtin); - fetch_database(cli, SAM_DATABASE_BUILTIN, &ret_creds, dom_sid); + + result = fetch_database(cli, SAM_DATABASE_BUILTIN, &ret_creds, + dom_sid); + + if (!NT_STATUS_IS_OK(result)) { + d_printf("Failed to fetch builtin database: %s\n", + nt_errstr(result)); + goto fail; + } /* Currently we crash on PRIVS somewhere in unmarshalling */ /* Dump_database(cli, SAM_DATABASE_PRIVS, &ret_creds); */ @@ -992,8 +1045,8 @@ int rpc_vampire(int argc, const char **argv) return 0; fail: - if (cli) { + if (cli) cli_nt_session_close(cli); - } + return -1; } diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c index 42490190f3..3dfa157bda 100644 --- a/source3/utils/ntlm_auth.c +++ b/source3/utils/ntlm_auth.c @@ -38,7 +38,6 @@ enum squid_mode { extern int winbindd_fd; -static const char *helper_protocol; static const char *opt_username; static const char *opt_domain; static const char *opt_workstation; @@ -48,7 +47,6 @@ static DATA_BLOB opt_lm_response; static DATA_BLOB opt_nt_response; static int request_lm_key; static int request_nt_key; -static int diagnostics; static char winbind_separator(void) @@ -184,7 +182,7 @@ static NTSTATUS contact_winbind_auth_crap(const char *username, const DATA_BLOB *lm_response, const DATA_BLOB *nt_response, uint32 flags, - uint8 lm_key[16], + uint8 lm_key[8], uint8 nt_key[16], char **error_string) { @@ -198,7 +196,7 @@ static NTSTATUS contact_winbind_auth_crap(const char *username, ZERO_STRUCT(request); ZERO_STRUCT(response); - request.data.auth_crap.flags = flags; + request.flags = flags; fstrcpy(request.data.auth_crap.user, username); @@ -235,13 +233,13 @@ static NTSTATUS contact_winbind_auth_crap(const char *username, return nt_status; } - if ((flags & WINBIND_PAM_LMKEY) && lm_key + if ((flags & WBFLAG_PAM_LMKEY) && lm_key && (memcmp(zeros, response.data.auth.first_8_lm_hash, sizeof(response.data.auth.first_8_lm_hash)) != 0)) { memcpy(lm_key, response.data.auth.first_8_lm_hash, sizeof(response.data.auth.first_8_lm_hash)); } - if ((flags & WINBIND_PAM_NTKEY) && nt_key + if ((flags & WBFLAG_PAM_NTKEY) && nt_key && (memcmp(zeros, response.data.auth.nt_session_key, sizeof(response.data.auth.nt_session_key)) != 0)) { memcpy(nt_key, response.data.auth.nt_session_key, @@ -410,14 +408,15 @@ static BOOL check_auth_crap(void) char *hex_lm_key; char *hex_nt_key; char *error_string; - static uint8 zeros[16]; + x_setbuf(x_stdout, NULL); + if (request_lm_key) - flags |= WINBIND_PAM_LMKEY; + flags |= WBFLAG_PAM_LMKEY; if (request_nt_key) - flags |= WINBIND_PAM_NTKEY; + flags |= WBFLAG_PAM_NTKEY; nt_status = contact_winbind_auth_crap(opt_username, opt_domain, opt_workstation, @@ -430,9 +429,9 @@ static BOOL check_auth_crap(void) &error_string); if (!NT_STATUS_IS_OK(nt_status)) { - d_printf("%s (0x%x)\n", - error_string, - NT_STATUS_V(nt_status)); + x_fprintf(x_stdout, "%s (0x%x)\n", + error_string, + NT_STATUS_V(nt_status)); SAFE_FREE(error_string); return False; } @@ -443,7 +442,7 @@ static BOOL check_auth_crap(void) hex_encode(lm_key, sizeof(lm_key), &hex_lm_key); - d_printf("LM_KEY: %s\n", hex_lm_key); + x_fprintf(x_stdout, "LM_KEY: %s\n", hex_lm_key); SAFE_FREE(hex_lm_key); } if (request_nt_key @@ -452,7 +451,7 @@ static BOOL check_auth_crap(void) hex_encode(nt_key, sizeof(nt_key), &hex_nt_key); - d_printf("NT_KEY: %s\n", hex_nt_key); + x_fprintf(x_stdout, "NT_KEY: %s\n", hex_nt_key); SAFE_FREE(hex_nt_key); } @@ -476,6 +475,10 @@ static DATA_BLOB get_challenge(void) return chal; } +/* + * Test LM authentication, no NT response supplied + */ + static BOOL test_lm(void) { NTSTATUS nt_status; @@ -483,13 +486,18 @@ static BOOL test_lm(void) DATA_BLOB lm_response = data_blob(NULL, 24); uchar lm_key[8]; + uchar nt_key[16]; uchar lm_hash[16]; DATA_BLOB chall = get_challenge(); char *error_string; - flags |= WINBIND_PAM_LMKEY; + ZERO_STRUCT(lm_key); + ZERO_STRUCT(nt_key); - SMBencrypt(opt_password,chall.data,lm_response.data); + flags |= WBFLAG_PAM_LMKEY; + flags |= WBFLAG_PAM_NTKEY; + + SMBencrypt(opt_password, chall.data, lm_response.data); E_deshash(opt_password, lm_hash); nt_status = contact_winbind_auth_crap(opt_username, opt_domain, opt_workstation, @@ -498,7 +506,7 @@ static BOOL test_lm(void) NULL, flags, lm_key, - NULL, + nt_key, &error_string); data_blob_free(&lm_response); @@ -518,9 +526,20 @@ static BOOL test_lm(void) DEBUG(1, ("expected:\n")); dump_data(1, lm_hash, 8); } + if (memcmp(lm_hash, nt_key, 8) != 0) { + DEBUG(1, ("Session Key (first 8, lm hash) does not match expectations!\n")); + DEBUG(1, ("nt_key:\n")); + dump_data(1, nt_key, 8); + DEBUG(1, ("expected:\n")); + dump_data(1, lm_hash, 8); + } return True; } +/* + * Test the normal 'LM and NTLM' combination + */ + static BOOL test_lm_ntlm(void) { BOOL pass = True; @@ -537,8 +556,11 @@ static BOOL test_lm_ntlm(void) DATA_BLOB chall = get_challenge(); char *error_string; - flags |= WINBIND_PAM_LMKEY; - flags |= WINBIND_PAM_NTKEY; + ZERO_STRUCT(lm_key); + ZERO_STRUCT(nt_key); + + flags |= WBFLAG_PAM_LMKEY; + flags |= WBFLAG_PAM_NTKEY; SMBencrypt(opt_password,chall.data,lm_response.data); E_deshash(opt_password, lm_hash); @@ -589,6 +611,10 @@ static BOOL test_lm_ntlm(void) return pass; } +/* + * Test the NTLM response only, no LM. + */ + static BOOL test_ntlm(void) { BOOL pass = True; @@ -597,24 +623,99 @@ static BOOL test_ntlm(void) DATA_BLOB nt_response = data_blob(NULL, 24); DATA_BLOB session_key = data_blob(NULL, 16); + char lm_key[8]; char nt_key[16]; + char lm_hash[16]; char nt_hash[16]; DATA_BLOB chall = get_challenge(); char *error_string; - flags |= WINBIND_PAM_NTKEY; + ZERO_STRUCT(lm_key); + ZERO_STRUCT(nt_key); + + flags |= WBFLAG_PAM_LMKEY; + flags |= WBFLAG_PAM_NTKEY; SMBNTencrypt(opt_password,chall.data,nt_response.data); E_md4hash(opt_password, nt_hash); SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data); + E_deshash(opt_password, lm_hash); + nt_status = contact_winbind_auth_crap(opt_username, opt_domain, opt_workstation, &chall, NULL, &nt_response, flags, + lm_key, + nt_key, + &error_string); + + data_blob_free(&nt_response); + + if (!NT_STATUS_IS_OK(nt_status)) { + d_printf("%s (0x%x)\n", + error_string, + NT_STATUS_V(nt_status)); + SAFE_FREE(error_string); + return False; + } + + if (memcmp(lm_hash, lm_key, + sizeof(lm_key)) != 0) { + DEBUG(1, ("LM Key does not match expectations!\n")); + DEBUG(1, ("lm_key:\n")); + dump_data(1, lm_key, 8); + DEBUG(1, ("expected:\n")); + dump_data(1, lm_hash, 8); + pass = False; + } + if (memcmp(session_key.data, nt_key, + sizeof(nt_key)) != 0) { + DEBUG(1, ("NT Session Key does not match expectations!\n")); + DEBUG(1, ("nt_key:\n")); + dump_data(1, nt_key, 16); + DEBUG(1, ("expected:\n")); + dump_data(1, session_key.data, session_key.length); + pass = False; + } + return pass; +} + +/* + * Test the NTLM response only, but in the LM field. + */ + +static BOOL test_ntlm_in_lm(void) +{ + BOOL pass = True; + NTSTATUS nt_status; + uint32 flags = 0; + DATA_BLOB nt_response = data_blob(NULL, 24); + + uchar lm_key[8]; + uchar lm_hash[16]; + uchar nt_key[16]; + DATA_BLOB chall = get_challenge(); + char *error_string; + + ZERO_STRUCT(nt_key); + + flags |= WBFLAG_PAM_LMKEY; + flags |= WBFLAG_PAM_NTKEY; + + SMBNTencrypt(opt_password,chall.data,nt_response.data); + + E_deshash(opt_password, lm_hash); + + nt_status = contact_winbind_auth_crap(opt_username, opt_domain, + opt_workstation, + &chall, + &nt_response, NULL, + flags, + lm_key, nt_key, &error_string); @@ -628,6 +729,86 @@ static BOOL test_ntlm(void) return False; } + if (memcmp(lm_hash, lm_key, + sizeof(lm_key)) != 0) { + DEBUG(1, ("LM Key does not match expectations!\n")); + DEBUG(1, ("lm_key:\n")); + dump_data(1, lm_key, 8); + DEBUG(1, ("expected:\n")); + dump_data(1, lm_hash, 8); + pass = False; + } + if (memcmp(lm_hash, nt_key, 8) != 0) { + DEBUG(1, ("Session Key (first 8 lm hash) does not match expectations!\n")); + DEBUG(1, ("nt_key:\n")); + dump_data(1, nt_key, 16); + DEBUG(1, ("expected:\n")); + dump_data(1, lm_hash, 8); + pass = False; + } + return pass; +} + +/* + * Test the NTLM response only, but in the both the NT and LM fields. + */ + +static BOOL test_ntlm_in_both(void) +{ + BOOL pass = True; + NTSTATUS nt_status; + uint32 flags = 0; + DATA_BLOB nt_response = data_blob(NULL, 24); + DATA_BLOB session_key = data_blob(NULL, 16); + + char lm_key[8]; + char lm_hash[16]; + char nt_key[16]; + char nt_hash[16]; + DATA_BLOB chall = get_challenge(); + char *error_string; + + ZERO_STRUCT(lm_key); + ZERO_STRUCT(nt_key); + + flags |= WBFLAG_PAM_LMKEY; + flags |= WBFLAG_PAM_NTKEY; + + SMBNTencrypt(opt_password,chall.data,nt_response.data); + E_md4hash(opt_password, nt_hash); + SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data); + + E_deshash(opt_password, lm_hash); + + nt_status = contact_winbind_auth_crap(opt_username, opt_domain, + opt_workstation, + &chall, + &nt_response, + &nt_response, + flags, + lm_key, + nt_key, + &error_string); + + data_blob_free(&nt_response); + + if (!NT_STATUS_IS_OK(nt_status)) { + d_printf("%s (0x%x)\n", + error_string, + NT_STATUS_V(nt_status)); + SAFE_FREE(error_string); + return False; + } + + if (memcmp(lm_hash, lm_key, + sizeof(lm_key)) != 0) { + DEBUG(1, ("LM Key does not match expectations!\n")); + DEBUG(1, ("lm_key:\n")); + dump_data(1, lm_key, 8); + DEBUG(1, ("expected:\n")); + dump_data(1, lm_hash, 8); + pass = False; + } if (memcmp(session_key.data, nt_key, sizeof(nt_key)) != 0) { DEBUG(1, ("NT Session Key does not match expectations!\n")); @@ -637,15 +818,347 @@ static BOOL test_ntlm(void) dump_data(1, session_key.data, session_key.length); pass = False; } + + return pass; } +/* + * Test the NTLMv2 response only + */ + +static BOOL test_ntlmv2(void) +{ + BOOL pass = True; + NTSTATUS nt_status; + uint32 flags = 0; + DATA_BLOB ntlmv2_response = data_blob(NULL, 0); + DATA_BLOB nt_session_key = data_blob(NULL, 0); + DATA_BLOB names_blob = NTLMv2_generate_names_blob(get_winbind_netbios_name(), get_winbind_domain()); + + uchar nt_key[16]; + DATA_BLOB chall = get_challenge(); + char *error_string; + + ZERO_STRUCT(nt_key); + + flags |= WBFLAG_PAM_NTKEY; + + if (!SMBNTLMv2encrypt(opt_username, opt_domain, opt_password, &chall, + &names_blob, + NULL, &ntlmv2_response, + &nt_session_key)) { + data_blob_free(&names_blob); + return False; + } + data_blob_free(&names_blob); + + nt_status = contact_winbind_auth_crap(opt_username, opt_domain, + opt_workstation, + &chall, + NULL, + &ntlmv2_response, + flags, + NULL, + nt_key, + &error_string); + + data_blob_free(&ntlmv2_response); + + if (!NT_STATUS_IS_OK(nt_status)) { + d_printf("%s (0x%x)\n", + error_string, + NT_STATUS_V(nt_status)); + SAFE_FREE(error_string); + return False; + } + + if (memcmp(nt_session_key.data, nt_key, + sizeof(nt_key)) != 0) { + DEBUG(1, ("NT Session Key does not match expectations!\n")); + DEBUG(1, ("nt_key:\n")); + dump_data(1, nt_key, 16); + DEBUG(1, ("expected:\n")); + dump_data(1, nt_session_key.data, nt_session_key.length); + pass = False; + } + return pass; +} + +/* + * Test the NTLMv2 and LMv2 responses + */ + +static BOOL test_lmv2_ntlmv2(void) +{ + BOOL pass = True; + NTSTATUS nt_status; + uint32 flags = 0; + DATA_BLOB ntlmv2_response = data_blob(NULL, 0); + DATA_BLOB lmv2_response = data_blob(NULL, 0); + DATA_BLOB nt_session_key = data_blob(NULL, 0); + DATA_BLOB names_blob = NTLMv2_generate_names_blob(get_winbind_netbios_name(), get_winbind_domain()); + + uchar nt_key[16]; + DATA_BLOB chall = get_challenge(); + char *error_string; + + ZERO_STRUCT(nt_key); + + flags |= WBFLAG_PAM_NTKEY; + + if (!SMBNTLMv2encrypt(opt_username, opt_domain, opt_password, &chall, + &names_blob, + &lmv2_response, &ntlmv2_response, + &nt_session_key)) { + data_blob_free(&names_blob); + return False; + } + data_blob_free(&names_blob); + + nt_status = contact_winbind_auth_crap(opt_username, opt_domain, + opt_workstation, + &chall, + &lmv2_response, + &ntlmv2_response, + flags, + NULL, + nt_key, + &error_string); + + data_blob_free(&lmv2_response); + data_blob_free(&ntlmv2_response); + + if (!NT_STATUS_IS_OK(nt_status)) { + d_printf("%s (0x%x)\n", + error_string, + NT_STATUS_V(nt_status)); + SAFE_FREE(error_string); + return False; + } + + if (memcmp(nt_session_key.data, nt_key, + sizeof(nt_key)) != 0) { + DEBUG(1, ("NT Session Key does not match expectations!\n")); + DEBUG(1, ("nt_key:\n")); + dump_data(1, nt_key, 16); + DEBUG(1, ("expected:\n")); + dump_data(1, nt_session_key.data, nt_session_key.length); + pass = False; + } + return pass; +} + +/* + * Test the LMv2 response only + */ + +static BOOL test_lmv2(void) +{ + BOOL pass = True; + NTSTATUS nt_status; + uint32 flags = 0; + DATA_BLOB lmv2_response = data_blob(NULL, 0); + + DATA_BLOB chall = get_challenge(); + char *error_string; + + if (!SMBNTLMv2encrypt(opt_username, opt_domain, opt_password, &chall, + NULL, + &lmv2_response, NULL, + NULL)) { + return False; + } + + nt_status = contact_winbind_auth_crap(opt_username, opt_domain, + opt_workstation, + &chall, + &lmv2_response, + NULL, + flags, + NULL, + NULL, + &error_string); + + data_blob_free(&lmv2_response); + + if (!NT_STATUS_IS_OK(nt_status)) { + d_printf("%s (0x%x)\n", + error_string, + NT_STATUS_V(nt_status)); + SAFE_FREE(error_string); + return False; + } + + return pass; +} + +/* + * Test the normal 'LM and NTLM' combination but deliberately break one + */ + +static BOOL test_ntlm_broken(BOOL break_lm) +{ + BOOL pass = True; + NTSTATUS nt_status; + uint32 flags = 0; + DATA_BLOB lm_response = data_blob(NULL, 24); + DATA_BLOB nt_response = data_blob(NULL, 24); + DATA_BLOB session_key = data_blob(NULL, 16); + + uchar lm_key[8]; + uchar nt_key[16]; + uchar lm_hash[16]; + uchar nt_hash[16]; + DATA_BLOB chall = get_challenge(); + char *error_string; + + ZERO_STRUCT(lm_key); + ZERO_STRUCT(nt_key); + + flags |= WBFLAG_PAM_LMKEY; + flags |= WBFLAG_PAM_NTKEY; + + SMBencrypt(opt_password,chall.data,lm_response.data); + E_deshash(opt_password, lm_hash); + + SMBNTencrypt(opt_password,chall.data,nt_response.data); + + E_md4hash(opt_password, nt_hash); + SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data); + + if (break_lm) + lm_response.data[0]++; + else + nt_response.data[0]++; + + nt_status = contact_winbind_auth_crap(opt_username, opt_domain, + opt_workstation, + &chall, + &lm_response, + &nt_response, + flags, + lm_key, + nt_key, + &error_string); + + data_blob_free(&lm_response); + + if (!NT_STATUS_IS_OK(nt_status)) { + d_printf("%s (0x%x)\n", + error_string, + NT_STATUS_V(nt_status)); + SAFE_FREE(error_string); + return False; + } + + if (memcmp(lm_hash, lm_key, + sizeof(lm_key)) != 0) { + DEBUG(1, ("LM Key does not match expectations!\n")); + DEBUG(1, ("lm_key:\n")); + dump_data(1, lm_key, 8); + DEBUG(1, ("expected:\n")); + dump_data(1, lm_hash, 8); + pass = False; + } + if (memcmp(session_key.data, nt_key, + sizeof(nt_key)) != 0) { + DEBUG(1, ("NT Session Key does not match expectations!\n")); + DEBUG(1, ("nt_key:\n")); + dump_data(1, nt_key, 16); + DEBUG(1, ("expected:\n")); + dump_data(1, session_key.data, session_key.length); + pass = False; + } + return pass; +} + +static BOOL test_ntlm_lm_broken(void) +{ + return test_ntlm_broken(True); +} + +static BOOL test_ntlm_ntlm_broken(void) +{ + return test_ntlm_broken(False); +} + +static BOOL test_ntlmv2_broken(BOOL break_lmv2) +{ + BOOL pass = True; + NTSTATUS nt_status; + uint32 flags = 0; + DATA_BLOB ntlmv2_response = data_blob(NULL, 0); + DATA_BLOB lmv2_response = data_blob(NULL, 0); + DATA_BLOB nt_session_key = data_blob(NULL, 0); + DATA_BLOB names_blob = NTLMv2_generate_names_blob(get_winbind_netbios_name(), get_winbind_domain()); + + uchar nt_key[16]; + DATA_BLOB chall = get_challenge(); + char *error_string; + + ZERO_STRUCT(nt_key); + + flags |= WBFLAG_PAM_NTKEY; + + if (!SMBNTLMv2encrypt(opt_username, opt_domain, opt_password, &chall, + &names_blob, + &lmv2_response, &ntlmv2_response, + &nt_session_key)) { + data_blob_free(&names_blob); + return False; + } + data_blob_free(&names_blob); + + /* Heh - this should break the appropriate password hash nicely! */ + + if (break_lmv2) + lmv2_response.data[0]++; + else + ntlmv2_response.data[0]++; + + nt_status = contact_winbind_auth_crap(opt_username, opt_domain, + opt_workstation, + &chall, + &lmv2_response, + &ntlmv2_response, + flags, + NULL, + nt_key, + &error_string); + + data_blob_free(&lmv2_response); + data_blob_free(&ntlmv2_response); + + if (!NT_STATUS_IS_OK(nt_status)) { + d_printf("%s (0x%x)\n", + error_string, + NT_STATUS_V(nt_status)); + SAFE_FREE(error_string); + return False; + } + + return pass; +} + +static BOOL test_ntlmv2_lmv2_broken(void) +{ + return test_ntlmv2_broken(True); +} + +static BOOL test_ntlmv2_ntlmv2_broken(void) +{ + return test_ntlmv2_broken(False); +} + /* Tests: - LM only - NT and LM - NT + - NT in LM field + - NT in both fields - NTLMv2 - NTLMv2 and LMv2 - LMv2 @@ -659,12 +1172,18 @@ struct ntlm_tests { BOOL (*fn)(void); const char *name; } test_table[] = { - {test_lm, "test LM"}, - {test_lm_ntlm, "test LM and NTLM"}, - {test_ntlm, "test NTLM"} -/* {test_lm_ntlmv2, "test NTLMv2"}, */ -/* {test_lm_ntlmv2, "test NTLMv2 and LMv2"}, */ -/* {test_lm_ntlmv2, "test LMv2"} */ + {test_lm, "LM"}, + {test_lm_ntlm, "LM and NTLM"}, + {test_ntlm, "NTLM"}, + {test_ntlm_in_lm, "NTLM in LM"}, + {test_ntlm_in_both, "NTLM in both"}, + {test_ntlmv2, "NTLMv2"}, + {test_lmv2_ntlmv2, "NTLMv2 and LMv2"}, + {test_lmv2, "LMv2"}, + {test_ntlmv2_lmv2_broken, "NTLMv2 and LMv2, LMv2 broken"}, + {test_ntlmv2_ntlmv2_broken, "NTLMv2 and LMv2, NTLMv2 broken"}, + {test_ntlm_lm_broken, "NTLM and LM, LM broken"}, + {test_ntlm_ntlm_broken, "NTLM and LM, NTLM broken"} }; static BOOL diagnose_ntlm_auth(void) @@ -701,6 +1220,8 @@ enum { int main(int argc, const char **argv) { int opt; + static const char *helper_protocol; + static int diagnostics; static const char *hex_challenge; static const char *hex_lm_response; @@ -743,6 +1264,14 @@ enum { dbf = x_stderr; + /* Samba client initialisation */ + + if (!lp_load(dyn_CONFIGFILE, True, False, False)) { + d_fprintf(stderr, "wbinfo: error opening config file %s. Error was %s\n", + dyn_CONFIGFILE, strerror(errno)); + exit(1); + } + /* Parse options */ pc = poptGetContext("ntlm_auth", argc, argv, long_options, 0); @@ -760,7 +1289,7 @@ enum { while((opt = poptGetNextOpt(pc)) != -1) { switch (opt) { case OPT_CHALLENGE: - challenge = smb_xmalloc((strlen(hex_challenge)+1)/2); + challenge = smb_xmalloc((strlen(hex_challenge))/2+1); if ((challenge_len = strhex_to_str(challenge, strlen(hex_challenge), hex_challenge)) != 8) { @@ -772,7 +1301,7 @@ enum { SAFE_FREE(challenge); break; case OPT_LM: - lm_response = smb_xmalloc((strlen(hex_lm_response)+1)/2); + lm_response = smb_xmalloc((strlen(hex_lm_response))/2+1); lm_response_len = strhex_to_str(lm_response, strlen(hex_lm_response), hex_lm_response); @@ -784,7 +1313,7 @@ enum { SAFE_FREE(lm_response); break; case OPT_NT: - nt_response = smb_xmalloc((strlen(hex_nt_response)+1)/2); + nt_response = smb_xmalloc((strlen(hex_nt_response)+2)/2+1); nt_response_len = strhex_to_str(nt_response, strlen(hex_nt_response), hex_nt_response); diff --git a/source3/utils/pdbedit.c b/source3/utils/pdbedit.c index d540bf42de..96d0d3c057 100644 --- a/source3/utils/pdbedit.c +++ b/source3/utils/pdbedit.c @@ -51,6 +51,21 @@ #define MASK_ALWAYS_GOOD 0x0000001F #define MASK_USER_GOOD 0x00401F00 +/***************************************************************************** + stubb functions +****************************************************************************/ + +void become_root( void ) +{ + return; +} + +void unbecome_root( void ) +{ + return; +} + + /********************************************************* Add all currently available users to another db ********************************************************/ @@ -91,7 +106,7 @@ static int export_groups (struct pdb_context *in, struct pdb_context *out) { if (NT_STATUS_IS_ERR(in->pdb_enum_group_mapping(in, SID_NAME_UNKNOWN, &maps, &entries, - False, False))) { + False))) { fprintf(stderr, "Can't get group mappings!\n"); return 1; } @@ -157,8 +172,7 @@ static int print_sam_info (SAM_ACCOUNT *sam_pwent, BOOL verbosity, BOOL smbpwdst char lm_passwd[33]; char nt_passwd[33]; - uid = -1; - sid_to_uid(pdb_get_user_sid(sam_pwent), &uid); + uid = nametouid(pdb_get_username(sam_pwent)); pdb_sethexpwd(lm_passwd, pdb_get_lanman_passwd(sam_pwent), pdb_get_acct_ctrl(sam_pwent)); pdb_sethexpwd(nt_passwd, pdb_get_nt_passwd(sam_pwent), pdb_get_acct_ctrl(sam_pwent)); @@ -170,8 +184,7 @@ static int print_sam_info (SAM_ACCOUNT *sam_pwent, BOOL verbosity, BOOL smbpwdst pdb_encode_acct_ctrl(pdb_get_acct_ctrl(sam_pwent),NEW_PW_FORMAT_SPACE_PADDED_LEN), (uint32)pdb_get_pass_last_set_time(sam_pwent)); } else { - uid = -1; - sid_to_uid(pdb_get_user_sid(sam_pwent), &uid); + uid = nametouid(pdb_get_username(sam_pwent)); printf ("%s:%d:%s\n", pdb_get_username(sam_pwent), uid, pdb_get_fullname(sam_pwent)); } @@ -337,7 +350,7 @@ static int new_user (struct pdb_context *in, const char *username, NTSTATUS nt_status; char *password1, *password2, *staticpass; - if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam_new(&sam_pwent, username))) { + if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam_new(&sam_pwent, username, 0))) { DEBUG(0, ("could not create account to add new user %s\n", username)); return -1; } @@ -485,7 +498,7 @@ static int delete_user_entry (struct pdb_context *in, const char *username) return -1; } - if (NT_STATUS_IS_ERR(in->pdb_getsampwnam(in, samaccount, username))) { + if (!NT_STATUS_IS_OK(in->pdb_getsampwnam(in, samaccount, username))) { fprintf (stderr, "user %s does not exist in the passdb\n", username); return -1; } @@ -511,7 +524,7 @@ static int delete_machine_entry (struct pdb_context *in, const char *machinename return -1; } - if (NT_STATUS_IS_ERR(in->pdb_getsampwnam(in, samaccount, name))) { + if (!NT_STATUS_IS_OK(in->pdb_getsampwnam(in, samaccount, name))) { fprintf (stderr, "machine %s does not exist in the passdb\n", name); return -1; } @@ -606,13 +619,10 @@ int main (int argc, char **argv) exit(1); } - if (!init_names()) - exit(1); - - if (!idmap_init()) + if(!initialize_password_db(False)) exit(1); - if (!idmap_init_wellknown_sids()) + if (!init_names()) exit(1); setparms = (backend ? BIT_BACKEND : 0) + diff --git a/source3/utils/profiles.c b/source3/utils/profiles.c index afaa83f638..23df26d150 100644 --- a/source3/utils/profiles.c +++ b/source3/utils/profiles.c @@ -454,6 +454,8 @@ static int get_sid(DOM_SID *sid, const unsigned char *sid_str) return 1; } +#if 0 + /* * Replace SID1, component by component with SID2 * Assumes will never be called with unequal length SIDS @@ -470,6 +472,8 @@ static void change_sid(DOM_SID *s1, DOM_SID *s2) } } +#endif + static void print_sid(DOM_SID *sid) { int i, comps = sid->num_auths; diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c index 9d8a657726..69dc2dd47a 100644 --- a/source3/utils/smbcacls.c +++ b/source3/utils/smbcacls.c @@ -30,7 +30,6 @@ static int test_args = False; static TALLOC_CTX *ctx; #define CREATE_ACCESS_READ READ_CONTROL_ACCESS -#define CREATE_ACCESS_WRITE (WRITE_DAC_ACCESS | WRITE_OWNER_ACCESS) /* numeric is set when the user wants numeric SIDs and ACEs rather than going via LSA calls to resolve them */ @@ -506,11 +505,11 @@ static int owner_set(struct cli_state *cli, enum chown_mode change_mode, } sd = make_sec_desc(ctx,old->revision, - (change_mode == REQUEST_CHOWN) ? &sid : old->owner_sid, - (change_mode == REQUEST_CHGRP) ? &sid : old->grp_sid, - NULL, old->dacl, &sd_size); + (change_mode == REQUEST_CHOWN) ? &sid : NULL, + (change_mode == REQUEST_CHGRP) ? &sid : NULL, + NULL, NULL, &sd_size); - fnum = cli_nt_create(cli, filename, CREATE_ACCESS_WRITE); + fnum = cli_nt_create(cli, filename, WRITE_OWNER_ACCESS); if (fnum == -1) { printf("Failed to open %s: %s\n", filename, cli_errstr(cli)); @@ -680,10 +679,10 @@ static int cacl_set(struct cli_state *cli, char *filename, sort_acl(old->dacl); /* Create new security descriptor and set it */ - sd = make_sec_desc(ctx,old->revision, old->owner_sid, old->grp_sid, + sd = make_sec_desc(ctx,old->revision, NULL, NULL, NULL, old->dacl, &sd_size); - fnum = cli_nt_create(cli, filename, CREATE_ACCESS_WRITE); + fnum = cli_nt_create(cli, filename, WRITE_DAC_ACCESS); if (fnum == -1) { printf("cacl_set failed to open %s: %s\n", filename, cli_errstr(cli)); diff --git a/source3/utils/smbcontrol.c b/source3/utils/smbcontrol.c index 06add6af22..b7333f2317 100644 --- a/source3/utils/smbcontrol.c +++ b/source3/utils/smbcontrol.c @@ -34,7 +34,7 @@ static int num_replies; /* Used by message callback fns */ /* Send a message to a destination pid. Zero means broadcast smbd. */ -static BOOL send_message(pid_t pid, int msg_type, void *buf, int len, +static BOOL send_message(pid_t pid, int msg_type, const void *buf, int len, BOOL duplicates) { TDB_CONTEXT *tdb; @@ -92,7 +92,7 @@ static void print_string_cb(int msg_type, pid_t pid, void *buf, size_t len) /* Send no message. Useful for testing. */ -static BOOL do_noop(const pid_t pid, const int argc, char **argv) +static BOOL do_noop(const pid_t pid, const int argc, const char **argv) { if (argc != 1) { fprintf(stderr, "Usage: smbcontrol noop\n"); @@ -106,7 +106,7 @@ static BOOL do_noop(const pid_t pid, const int argc, char **argv) /* Send a debug string */ -static BOOL do_debug(const pid_t pid, const int argc, char **argv) +static BOOL do_debug(const pid_t pid, const int argc, const char **argv) { if (argc != 2) { fprintf(stderr, "Usage: smbcontrol debug " @@ -120,7 +120,7 @@ static BOOL do_debug(const pid_t pid, const int argc, char **argv) /* Force a browser election */ -static BOOL do_election(const pid_t pid, const int argc, char **argv) +static BOOL do_election(const pid_t pid, const int argc, const char **argv) { if (argc != 1) { fprintf(stderr, "Usage: smbcontrol force-election\n"); @@ -139,7 +139,7 @@ static void pong_cb(int msg_type, pid_t pid, void *buf, size_t len) num_replies++; } -static BOOL do_ping(const pid_t pid, const int argc, char **argv) +static BOOL do_ping(const pid_t pid, const int argc, const char **argv) { if (argc != 1) { fprintf(stderr, "Usage: smbcontrol ping\n"); @@ -167,7 +167,7 @@ static BOOL do_ping(const pid_t pid, const int argc, char **argv) /* Set profiling options */ -static BOOL do_profile(const pid_t pid, const int argc, char **argv) +static BOOL do_profile(const pid_t pid, const int argc, const char **argv) { int v; @@ -239,7 +239,7 @@ static void profilelevel_rqst(int msg_type, pid_t pid, void *buf, size_t len) send_message(pid, MSG_PROFILELEVEL, &v, sizeof(int), False); } -static BOOL do_profilelevel(const pid_t pid, const int argc, char **argv) +static BOOL do_profilelevel(const pid_t pid, const int argc, const char **argv) { if (argc != 1) { fprintf(stderr, "Usage: smbcontrol profilelevel\n"); @@ -268,7 +268,7 @@ static BOOL do_profilelevel(const pid_t pid, const int argc, char **argv) /* Display debug level settings */ -static BOOL do_debuglevel(const pid_t pid, const int argc, char **argv) +static BOOL do_debuglevel(const pid_t pid, const int argc, const char **argv) { if (argc != 1) { fprintf(stderr, "Usage: smbcontrol debuglevel\n"); @@ -296,9 +296,9 @@ static BOOL do_debuglevel(const pid_t pid, const int argc, char **argv) /* Send a print notify message */ -static BOOL do_printnotify(const pid_t pid, const int argc, char **argv) +static BOOL do_printnotify(const pid_t pid, const int argc, const char **argv) { - char *cmd; + const char *cmd; /* Check for subcommand */ @@ -434,7 +434,7 @@ send: /* Close a share */ -static BOOL do_closeshare(const pid_t pid, const int argc, char **argv) +static BOOL do_closeshare(const pid_t pid, const int argc, const char **argv) { if (argc != 2) { fprintf(stderr, "Usage: smbcontrol close-share " @@ -448,7 +448,7 @@ static BOOL do_closeshare(const pid_t pid, const int argc, char **argv) /* Force a SAM synchronisation */ -static BOOL do_samsync(const pid_t pid, const int argc, char **argv) +static BOOL do_samsync(const pid_t pid, const int argc, const char **argv) { if (argc != 1) { fprintf(stderr, "Usage: smbcontrol samsync\n"); @@ -461,7 +461,7 @@ static BOOL do_samsync(const pid_t pid, const int argc, char **argv) /* Force a SAM replication */ -static BOOL do_samrepl(const pid_t pid, const int argc, char **argv) +static BOOL do_samrepl(const pid_t pid, const int argc, const char **argv) { if (argc != 1) { fprintf(stderr, "Usage: smbcontrol samrepl\n"); @@ -474,7 +474,7 @@ static BOOL do_samrepl(const pid_t pid, const int argc, char **argv) /* Display talloc pool usage */ -static BOOL do_poolusage(const pid_t pid, const int argc, char **argv) +static BOOL do_poolusage(const pid_t pid, const int argc, const char **argv) { if (argc != 1) { fprintf(stderr, "Usage: smbcontrol pool-usage\n"); @@ -502,7 +502,7 @@ static BOOL do_poolusage(const pid_t pid, const int argc, char **argv) /* Perform a dmalloc mark */ -static BOOL do_dmalloc_mark(const pid_t pid, const int argc, char **argv) +static BOOL do_dmalloc_mark(const pid_t pid, const int argc, const char **argv) { if (argc != 1) { fprintf(stderr, "Usage: smbcontrol dmalloc-mark\n"); @@ -515,8 +515,7 @@ static BOOL do_dmalloc_mark(const pid_t pid, const int argc, char **argv) /* Perform a dmalloc changed */ -static BOOL do_dmalloc_changed(const pid_t pid, const int argc, - char **argv) +static BOOL do_dmalloc_changed(const pid_t pid, const int argc, const char **argv) { if (argc != 1) { fprintf(stderr, "Usage: smbcontrol " @@ -530,7 +529,7 @@ static BOOL do_dmalloc_changed(const pid_t pid, const int argc, /* Shutdown a server process */ -static BOOL do_shutdown(const pid_t pid, const int argc, char **argv) +static BOOL do_shutdown(const pid_t pid, const int argc, const char **argv) { if (argc != 1) { fprintf(stderr, "Usage: smbcontrol shutdown\n"); @@ -542,7 +541,7 @@ static BOOL do_shutdown(const pid_t pid, const int argc, char **argv) /* Notify a driver upgrade */ -static BOOL do_drvupgrade(const pid_t pid, const int argc, char **argv) +static BOOL do_drvupgrade(const pid_t pid, const int argc, const char **argv) { if (argc != 2) { fprintf(stderr, "Usage: smbcontrol drvupgrade " @@ -554,11 +553,21 @@ static BOOL do_drvupgrade(const pid_t pid, const int argc, char **argv) pid, MSG_DEBUG, argv[1], strlen(argv[1]) + 1, False); } +static BOOL do_reload_config(const pid_t pid, const int argc, const char **argv) +{ + if (argc != 1) { + fprintf(stderr, "Usage: smbcontrol reload-config\n"); + return False; + } + + return send_message(pid, MSG_SMB_CONF_UPDATED, NULL, 0, False); +} + /* A list of message type supported */ static const struct { const char *name; /* Option name */ - BOOL (*fn)(const pid_t pid, const int argc, char **argv); + BOOL (*fn)(const pid_t pid, const int argc, const char **argv); const char *help; /* Short help text */ } msg_types[] = { { "debug", do_debug, "Set debuglevel" }, @@ -577,6 +586,7 @@ static const struct { { "dmalloc-log-changed", do_dmalloc_changed, "" }, { "shutdown", do_shutdown, "Shut down daemon" }, { "drvupgrade", do_drvupgrade, "Notify a printer driver has changed" }, + { "reload-config", do_reload_config, "Force smbd or winbindd to reload config file"}, { "noop", do_noop, "Do nothing" }, { NULL } }; @@ -613,7 +623,7 @@ static void usage(poptContext *pc) /* Return the pid number for a string destination */ -static pid_t parse_dest(char *dest) +static pid_t parse_dest(const char *dest) { pid_t pid; @@ -644,9 +654,9 @@ static pid_t parse_dest(char *dest) /* Execute smbcontrol command */ -static BOOL do_command(int argc, char **argv) +static BOOL do_command(int argc, const char **argv) { - char *dest = argv[0], *command = argv[1]; + const char *dest = argv[0], *command = argv[1]; pid_t pid; int i; @@ -669,7 +679,7 @@ static BOOL do_command(int argc, char **argv) /* Main program */ -int main(int argc, char **argv) +int main(int argc, const char **argv) { poptContext pc; int opt; @@ -726,7 +736,7 @@ int main(int argc, char **argv) argv. The argc parameter should have been decremented to the correct value in the above switch statement. */ - argv = (char **)poptGetArgs(pc); + argv = (const char **)poptGetArgs(pc); argc--; /* Don't forget about argv[0] */ if (argc == 1) diff --git a/source3/utils/smbpasswd.c b/source3/utils/smbpasswd.c index 577e467fbd..eade5331af 100644 --- a/source3/utils/smbpasswd.c +++ b/source3/utils/smbpasswd.c @@ -37,6 +37,21 @@ static const char *remote_machine = NULL; static fstring ldap_secret; +/***************************************************************************** + stubb functions +****************************************************************************/ + +void become_root( void ) +{ + return; +} + +void unbecome_root( void ) +{ + return; +} + + /********************************************************* Print command usage on stderr and die. **********************************************************/ @@ -392,7 +407,7 @@ static int process_root(int local_flags) if (local_flags & LOCAL_ADD_USER) { SAFE_FREE(new_passwd); new_passwd = smb_xstrdup(user_name); - strlower(new_passwd); + strlower_m(new_passwd); } /* @@ -405,7 +420,7 @@ static int process_root(int local_flags) } else if (local_flags & LOCAL_INTERDOM_ACCOUNT) { static fstring buf; - if (local_flags & LOCAL_ADD_USER) { + if ((local_flags & LOCAL_ADD_USER) && (new_passwd == NULL)) { /* * Prompt for trusting domain's account password */ @@ -450,7 +465,7 @@ static int process_root(int local_flags) } } - if(local_flags & LOCAL_SET_PASSWORD) { + if((local_flags & LOCAL_SET_PASSWORD) && (new_passwd == NULL)) { new_passwd = prompt_for_new_password(stdin_passwd_get); if(!new_passwd) { diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c index e3d6ce0274..16918ecd4a 100644 --- a/source3/utils/testparm.c +++ b/source3/utils/testparm.c @@ -183,6 +183,10 @@ via the %%o substitution. With encrypted passwords this is not possible.\n", lp_ } #endif + if (!lp_passdb_backend()) { + printf("ERROR: passdb backend must have a value or be left out\n"); + } + return ret; } diff --git a/source3/web/swat.c b/source3/web/swat.c index 7f9492933a..d97278c485 100644 --- a/source3/web/swat.c +++ b/source3/web/swat.c @@ -31,8 +31,6 @@ #include "includes.h" #include "../web/swat_proto.h" -#define GLOBALS_SNUM -1 - static BOOL demo_mode = False; static BOOL have_write_access = False; static BOOL have_read_access = False; @@ -579,7 +577,7 @@ static void wizard_params_page(void) d_printf("

    Wizard Parameter Edit Page

    \n"); if (cgi_variable("Commit")) { - commit_parameters(GLOBALS_SNUM); + commit_parameters(GLOBAL_SECTION_SNUM); save_reload(0); } @@ -593,7 +591,7 @@ static void wizard_params_page(void) d_printf("

    \n"); d_printf("\n"); - show_parameters(GLOBALS_SNUM, 1, parm_filter, 0); + show_parameters(GLOBAL_SECTION_SNUM, 1, parm_filter, 0); d_printf("
    \n"); d_printf("\n"); } @@ -603,7 +601,7 @@ static void wizard_params_page(void) ****************************************************************************/ static void rewritecfg_file(void) { - commit_parameters(GLOBALS_SNUM); + commit_parameters(GLOBAL_SECTION_SNUM); save_reload(0); d_printf("

    Note: smb.conf %s

    \n", _("file has been read and rewritten")); } @@ -637,37 +635,37 @@ static void wizard_page(void) HomeExpo = atoi(cgi_variable("HomeExpo")); /* Plain text passwords are too badly broken - use encrypted passwords only */ - lp_do_parameter( GLOBALS_SNUM, "encrypt passwords", "Yes"); + lp_do_parameter( GLOBAL_SECTION_SNUM, "encrypt passwords", "Yes"); switch ( SerType ){ case 0: /* Stand-alone Server */ - lp_do_parameter( GLOBALS_SNUM, "security", "USER" ); - lp_do_parameter( GLOBALS_SNUM, "domain logons", "No" ); + lp_do_parameter( GLOBAL_SECTION_SNUM, "security", "USER" ); + lp_do_parameter( GLOBAL_SECTION_SNUM, "domain logons", "No" ); break; case 1: /* Domain Member */ - lp_do_parameter( GLOBALS_SNUM, "security", "DOMAIN" ); - lp_do_parameter( GLOBALS_SNUM, "domain logons", "No" ); + lp_do_parameter( GLOBAL_SECTION_SNUM, "security", "DOMAIN" ); + lp_do_parameter( GLOBAL_SECTION_SNUM, "domain logons", "No" ); break; case 2: /* Domain Controller */ - lp_do_parameter( GLOBALS_SNUM, "security", "USER" ); - lp_do_parameter( GLOBALS_SNUM, "domain logons", "Yes" ); + lp_do_parameter( GLOBAL_SECTION_SNUM, "security", "USER" ); + lp_do_parameter( GLOBAL_SECTION_SNUM, "domain logons", "Yes" ); break; } switch ( winstype ) { case 0: - lp_do_parameter( GLOBALS_SNUM, "wins support", "No" ); - lp_do_parameter( GLOBALS_SNUM, "wins server", "" ); + lp_do_parameter( GLOBAL_SECTION_SNUM, "wins support", "No" ); + lp_do_parameter( GLOBAL_SECTION_SNUM, "wins server", "" ); break; case 1: - lp_do_parameter( GLOBALS_SNUM, "wins support", "Yes" ); - lp_do_parameter( GLOBALS_SNUM, "wins server", "" ); + lp_do_parameter( GLOBAL_SECTION_SNUM, "wins support", "Yes" ); + lp_do_parameter( GLOBAL_SECTION_SNUM, "wins server", "" ); break; case 2: - lp_do_parameter( GLOBALS_SNUM, "wins support", "No" ); - lp_do_parameter( GLOBALS_SNUM, "wins server", cgi_variable("WINSAddr")); + lp_do_parameter( GLOBAL_SECTION_SNUM, "wins support", "No" ); + lp_do_parameter( GLOBAL_SECTION_SNUM, "wins server", cgi_variable("WINSAddr")); break; } @@ -677,7 +675,7 @@ static void wizard_page(void) pstrcpy(unix_share,HOMES_NAME); load_config(False); - lp_copy_service(GLOBALS_SNUM, unix_share); + lp_copy_service(GLOBAL_SECTION_SNUM, unix_share); iNumNonAutoPrintServices = lp_numservices(); have_home = lp_servicenumber(HOMES_NAME); lp_do_parameter( have_home, "read only", "No"); @@ -692,7 +690,7 @@ static void wizard_page(void) have_home = -1; } - commit_parameters(GLOBALS_SNUM); + commit_parameters(GLOBAL_SECTION_SNUM); save_reload(0); } else @@ -778,7 +776,7 @@ static void globals_page(void) d_printf("

    %s

    \n", _("Global Variables")); if (cgi_variable("Commit")) { - commit_parameters(GLOBALS_SNUM); + commit_parameters(GLOBAL_SECTION_SNUM); save_reload(0); } @@ -810,7 +808,7 @@ static void globals_page(void) d_printf("

    \n"); d_printf("\n"); - show_parameters(GLOBALS_SNUM, 1, parm_filter, 0); + show_parameters(GLOBAL_SECTION_SNUM, 1, parm_filter, 0); d_printf("
    \n"); d_printf("\n"); } @@ -847,7 +845,7 @@ static void shares_page(void) if (cgi_variable("createshare") && (share=cgi_variable("newshare"))) { load_config(False); - lp_copy_service(GLOBALS_SNUM, share); + lp_copy_service(GLOBAL_SECTION_SNUM, share); iNumNonAutoPrintServices = lp_numservices(); save_reload(0); snum = lp_servicenumber(share); @@ -1186,7 +1184,7 @@ static void printers_page(void) if (cgi_variable("createshare") && (share=cgi_variable("newshare"))) { load_config(False); - lp_copy_service(GLOBALS_SNUM, share); + lp_copy_service(GLOBAL_SECTION_SNUM, share); iNumNonAutoPrintServices = lp_numservices(); snum = lp_servicenumber(share); lp_do_parameter(snum, "print ok", "Yes"); diff --git a/testsuite/build_farm/basicsmb-domainsec.test b/testsuite/build_farm/basicsmb-domainsec.test index 848cf69a75..eb0a5c81aa 100644 --- a/testsuite/build_farm/basicsmb-domainsec.test +++ b/testsuite/build_farm/basicsmb-domainsec.test @@ -4,8 +4,8 @@ test_joindomain() { test_join_domain_password="$1" - echo "$prefix/bin/net rpc join -S localhost -U $whoami%$test_join_domain_password -d$loglevel" - $prefix/bin/net rpc join -S localhost -U $whoami%$test_join_domain_password -d$loglevel + echo "$prefix/bin/net rpc join -S localhost -U $whoami%$test_join_domain_password" + $prefix/bin/net rpc join -S localhost -U $whoami%$test_join_domain_password status=$? if [ $status = 0 ]; then echo "'net rpc join' correctly joined the domain" diff --git a/testsuite/build_farm/basicsmb.fns b/testsuite/build_farm/basicsmb.fns index f5143cc4d8..3a9080f473 100644 --- a/testsuite/build_farm/basicsmb.fns +++ b/testsuite/build_farm/basicsmb.fns @@ -63,8 +63,16 @@ test_smb_conf_setup() { template_smb_conf_setup .preexec_close template_smb_conf_setup .preexec_cl_fl + template_smb_conf_setup .share + template_smb_conf_setup .user + template_smb_conf_setup .server + template_smb_conf_setup .domain + template_setup preexec lib/preexec + touch $prefix/lib/smb.conf. + touch $prefix/lib/smb.conf.localhost + echo "127.0.0.1 localhost">$prefix/lib/lmhosts echo "127.0.0.2 BUILDFARM">>$prefix/lib/lmhosts echo "127.0.0.3 SHARE">>$prefix/lib/lmhosts @@ -81,20 +89,13 @@ test_smb_conf_setup() { echo "127.0.0.1" > $prefix/lib/hosts.equiv - cp basicsmb.smb.conf.share $prefix/lib/smb.conf.share - cp basicsmb.smb.conf.user $prefix/lib/smb.conf.user - cp basicsmb.smb.conf.server $prefix/lib/smb.conf.server - cp basicsmb.smb.conf.domain $prefix/lib/smb.conf.domain - - touch $prefix/lib/smb.conf. - touch $prefix/lib/smb.conf.localhost } test_smbpasswd() { test_smbpasswd_password="$1" rm -f $prefix/private/smbpasswd - echo "( echo $test_smbpasswd_password ; echo $test_smbpasswd_password; ) | $prefix/bin/smbpasswd -L -s -a $whoami" - ( echo $test_smbpasswd_password; echo $test_smbpasswd_password; ) | $prefix/bin/smbpasswd -L -s -a $whoami + echo "( echo $test_smbpasswd_password ; echo $test_smbpasswd_password; ) | $prefix/bin/smbpasswd -L -D $loglevel -s -a $whoami" + ( echo $test_smbpasswd_password; echo $test_smbpasswd_password; ) | $prefix/bin/smbpasswd -L -D $loglevel -s -a $whoami status=$? if [ $status = 0 ]; then echo "smbpasswd correctly set initial password ($test_smbpasswd_password)" diff --git a/testsuite/build_farm/runlist b/testsuite/build_farm/runlist index b847e13fbc..5996f24ba8 100644 --- a/testsuite/build_farm/runlist +++ b/testsuite/build_farm/runlist @@ -6,11 +6,13 @@ basicsmb-hostsdeny basicsmb-remote-pass-change \ basicsmb-preexec \ torture-FDPASS torture-LOCK1 torture-LOCK2 \ torture-LOCK3 torture-LOCK4 torture-LOCK5 \ +torture-LOCK6 torture-LOCK7 \ torture-UNLINK torture-BROWSE torture-ATTR \ torture-TRANS2 torture-TORTURE torture-OPLOCK1 \ -torture-OPLOCK3 torture-DIR torture-DENY1 \ -torture-DENY2 torture-TCON torture-RW1 \ -torture-RW2 torture-OPEN torture-RENAME \ -torture-DELETE" +torture-OPLOCK3 torture-DIR torture-DIR1 torture-DENY1 \ +torture-DENY2 torture-TCON torture-TCON2 torture-TCONDEV \ +torture-RW1 torture-RW2 torture-OPEN torture-XCOPY \ +torture-RENAME torture-DELETE torture-PROPERTIES \ +torture-MANGLE torture-FDSESS" #basicsmb-serversec diff --git a/testsuite/build_farm/template/preexec b/testsuite/build_farm/template/preexec index e417d6a017..23809aaf89 100644 --- a/testsuite/build_farm/template/preexec +++ b/testsuite/build_farm/template/preexec @@ -1,2 +1,3 @@ #!/bin/sh + echo "Test worked" > PREFIX/testdir/preexec_touch diff --git a/testsuite/build_farm/torture-FDPASS.test b/testsuite/build_farm/torture-FDPASS.test index e8af277d43..40ffdb666d 100644 --- a/testsuite/build_farm/torture-FDPASS.test +++ b/testsuite/build_farm/torture-FDPASS.test @@ -1,2 +1,2 @@ . torture_setup.fns -test_torture "FDPASS" +test_torture "FDSESS" diff --git a/testsuite/build_farm/torture_setup.fns b/testsuite/build_farm/torture_setup.fns index bf5146148e..a42be94129 100644 --- a/testsuite/build_farm/torture_setup.fns +++ b/testsuite/build_farm/torture_setup.fns @@ -12,7 +12,7 @@ test_torture() { if [ $status = 0 ]; then echo "smbtorture test $torture_test worked" else - echo "smbtorture test $torture_test FAILED!" + echo "smbtorture test $torture_test FAILED (status $status)!" return 1 fi return 0 -- cgit From 1caa6b23e417f77e7b38ecdfa47d9abe8c7b7d0e Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 16 Jul 2003 05:42:34 +0000 Subject: ading new files from 3.0 (This used to be commit 99feae7b5b1c229a925367b87c0c0f636d9a2d75) --- docs/docbook/devdoc/.cvsignore | 1 + docs/docbook/devdoc/vfs.xml | 797 +++++ docs/docbook/devdoc/windows-debug.xml | 19 + docs/docbook/manpages/profiles.1.sgml | 86 + docs/docbook/projdoc/.cvsignore | 1 + docs/docbook/projdoc/Backup.xml | 36 + docs/docbook/projdoc/DNS-DHCP-Configuration.xml | 17 + docs/docbook/projdoc/FastStart.xml | 17 + docs/docbook/projdoc/HighAvailability.xml | 17 + docs/docbook/projdoc/WindowsClientConfig.xml | 17 + docs/docbook/smbdotconf/misc/valid.xml | 18 + .../docbook/smbdotconf/printing/totalprintjobs.xml | 22 + .../smbdotconf/protocol/clientusespnego.xml | 13 + docs/docbook/smbdotconf/protocol/mapaclinherit.xml | 17 + docs/docbook/smbdotconf/protocol/profileacls.xml | 33 + .../smbdotconf/security/clientlanmanauth.xml | 28 + .../smbdotconf/security/clientntlmv2auth.xml | 26 + docs/docbook/smbdotconf/vfs/vfsobjects.xml | 14 + .../smbdotconf/winbind/enableridalgorithm.xml | 17 + docs/docbook/smbdotconf/winbind/idmapgid.xml | 18 + docs/docbook/smbdotconf/winbind/idmapuid.xml | 14 + .../smbdotconf/winbind/templateprimarygroup.xml | 14 + .../winbind/winbindenablelocalaccounts.xml | 16 + .../winbind/winbindtrusteddomainsonly.xml | 16 + docs/docbook/xslt/generate-attributions.xsl | 67 + docs/htmldocs/AccessControls.html | 660 ++++ docs/htmldocs/AdvancedNetworkManagement.html | 224 ++ docs/htmldocs/Appendixes.html | 4 + docs/htmldocs/Backup.html | 13 + docs/htmldocs/CUPS-printing.html | 3733 ++++++++++++++++++++ docs/htmldocs/ClientConfig.html | 4 + docs/htmldocs/DNSDHCP.html | 4 + docs/htmldocs/FastStart.html | 4 + docs/htmldocs/Further-Resources.html | 100 + docs/htmldocs/InterdomainTrusts.html | 175 + docs/htmldocs/IntroSMB.html | 174 + docs/htmldocs/NT4Migration.html | 202 ++ docs/htmldocs/NetworkBrowsing.html | 957 +++++ docs/htmldocs/Other-Clients.html | 186 + docs/htmldocs/PolicyMgmt.html | 260 ++ docs/htmldocs/Portability.html | 128 + docs/htmldocs/ProfileMgmt.html | 680 ++++ docs/htmldocs/SWAT.html | 200 ++ docs/htmldocs/SambaHA.html | 4 + docs/htmldocs/ServerType.html | 343 ++ docs/htmldocs/StandAloneServer.html | 143 + docs/htmldocs/VFS.html | 105 + docs/htmldocs/index.html | 76 + docs/htmldocs/ix01.html | 1 + docs/htmldocs/locking.html | 656 ++++ docs/htmldocs/migration.html | 1 + docs/htmldocs/tdbbackup.8.html | 35 + docs/htmldocs/troubleshooting.html | 1 + docs/htmldocs/upgrading-to-3.0.html | 19 + docs/manpages/Samba.7 | 221 ++ docs/manpages/tdbbackup.8 | 100 + docs/textdocs/README.jis | 149 + examples/LDAP/export_smbpasswd.pl | 64 + examples/LDAP/import_smbpasswd.pl | 119 + examples/VFS/Makefile.in | 43 + examples/VFS/autogen.sh | 60 + examples/VFS/configure.in | 353 ++ examples/VFS/install-sh | 238 ++ examples/VFS/skel_opaque.c | 563 +++ examples/VFS/skel_transparent.c | 532 +++ examples/pdb/sambapdb.dtd | 46 + packaging/Debian/debian/patches/krb5-vars.patch | 685 ++++ .../debian/patches/pam_smbpass_linkage.patch | 24 + .../Debian/debian/patches/smbclient-tar.patch | 43 + packaging/Mandrake/swat_16.png.bz2 | Bin 0 -> 1142 bytes packaging/Mandrake/swat_32.png.bz2 | Bin 0 -> 2870 bytes packaging/Mandrake/swat_48.png.bz2 | Bin 0 -> 5072 bytes packaging/RedHat/samba.spec.tmpl | 440 +++ packaging/Solaris/.cvsignore | 4 + packaging/SuSE/README | 18 + packaging/SuSE/samba-3.0.0-msdfs.diff | 97 + packaging/SuSE/samba-3.0.0-net_ads.diff | 140 + packaging/SuSE/samba-3.0.0-pdb.diff | 11 + packaging/SuSE/samba-3.0.0-python.diff | 44 + packaging/SuSE/samba-3.0.0-vscan.diff | 80 + packaging/SuSE/samba-3.0.0.files.tar.bz2 | Bin 0 -> 7266 bytes packaging/SuSE/samba-vscan-0.3.1.tar.bz2 | Bin 0 -> 51383 bytes packaging/SuSE/samba3.spec | 764 ++++ source3/build-me | 36 + source3/include/smbldap.h | 142 + source3/include/sysquotas.h | 204 ++ source3/include/vfs_macros.h | 309 ++ source3/intl/libgettext.h | 0 source3/lib/smbldap.c | 1262 +++++++ source3/lib/sysquotas.c | 963 +++++ source3/libsmb/conncache.c | 158 + source3/libsmb/samlogon_cache.c | 238 ++ source3/mainpage.dox | 7 + source3/modules/weird.c | 131 + source3/nsswitch/winbindd_acct.c | 1209 +++++++ source3/pam_smbpass/.cvsignore | 1 + source3/passdb/pdb_plugin.c | 78 + source3/script/mkbuildoptions.awk | 262 ++ source3/smbd/fake_file.c | 166 + source3/smbd/ntquotas.c | 259 ++ source3/tdb/tdbback.c | 201 ++ source3/tdb/tdbback.h | 23 + source3/utils/net_idmap.c | 156 + testsuite/build_farm/torture-DIR1.test | 2 + testsuite/build_farm/torture-FDSESS.test | 2 + testsuite/build_farm/torture-LOCK6.test | 2 + testsuite/build_farm/torture-LOCK7.test | 2 + testsuite/build_farm/torture-MANGLE.test | 2 + testsuite/build_farm/torture-PROPERTIES.test | 2 + testsuite/build_farm/torture-TCON1.test | 2 + testsuite/build_farm/torture-TCON2.test | 2 + testsuite/build_farm/torture-TCONDEV.test | 2 + 112 files changed, 21094 insertions(+) create mode 100644 docs/docbook/devdoc/.cvsignore create mode 100644 docs/docbook/devdoc/vfs.xml create mode 100644 docs/docbook/devdoc/windows-debug.xml create mode 100644 docs/docbook/manpages/profiles.1.sgml create mode 100644 docs/docbook/projdoc/.cvsignore create mode 100644 docs/docbook/projdoc/Backup.xml create mode 100644 docs/docbook/projdoc/DNS-DHCP-Configuration.xml create mode 100644 docs/docbook/projdoc/FastStart.xml create mode 100644 docs/docbook/projdoc/HighAvailability.xml create mode 100644 docs/docbook/projdoc/WindowsClientConfig.xml create mode 100644 docs/docbook/smbdotconf/misc/valid.xml create mode 100644 docs/docbook/smbdotconf/printing/totalprintjobs.xml create mode 100644 docs/docbook/smbdotconf/protocol/clientusespnego.xml create mode 100644 docs/docbook/smbdotconf/protocol/mapaclinherit.xml create mode 100644 docs/docbook/smbdotconf/protocol/profileacls.xml create mode 100644 docs/docbook/smbdotconf/security/clientlanmanauth.xml create mode 100644 docs/docbook/smbdotconf/security/clientntlmv2auth.xml create mode 100644 docs/docbook/smbdotconf/vfs/vfsobjects.xml create mode 100644 docs/docbook/smbdotconf/winbind/enableridalgorithm.xml create mode 100644 docs/docbook/smbdotconf/winbind/idmapgid.xml create mode 100644 docs/docbook/smbdotconf/winbind/idmapuid.xml create mode 100644 docs/docbook/smbdotconf/winbind/templateprimarygroup.xml create mode 100644 docs/docbook/smbdotconf/winbind/winbindenablelocalaccounts.xml create mode 100644 docs/docbook/smbdotconf/winbind/winbindtrusteddomainsonly.xml create mode 100644 docs/docbook/xslt/generate-attributions.xsl create mode 100644 docs/htmldocs/AccessControls.html create mode 100644 docs/htmldocs/AdvancedNetworkManagement.html create mode 100644 docs/htmldocs/Appendixes.html create mode 100644 docs/htmldocs/Backup.html create mode 100644 docs/htmldocs/CUPS-printing.html create mode 100644 docs/htmldocs/ClientConfig.html create mode 100644 docs/htmldocs/DNSDHCP.html create mode 100644 docs/htmldocs/FastStart.html create mode 100644 docs/htmldocs/Further-Resources.html create mode 100644 docs/htmldocs/InterdomainTrusts.html create mode 100644 docs/htmldocs/IntroSMB.html create mode 100644 docs/htmldocs/NT4Migration.html create mode 100644 docs/htmldocs/NetworkBrowsing.html create mode 100644 docs/htmldocs/Other-Clients.html create mode 100644 docs/htmldocs/PolicyMgmt.html create mode 100644 docs/htmldocs/Portability.html create mode 100644 docs/htmldocs/ProfileMgmt.html create mode 100644 docs/htmldocs/SWAT.html create mode 100644 docs/htmldocs/SambaHA.html create mode 100644 docs/htmldocs/ServerType.html create mode 100644 docs/htmldocs/StandAloneServer.html create mode 100644 docs/htmldocs/VFS.html create mode 100755 docs/htmldocs/index.html create mode 100644 docs/htmldocs/ix01.html create mode 100644 docs/htmldocs/locking.html create mode 100644 docs/htmldocs/migration.html create mode 100644 docs/htmldocs/tdbbackup.8.html create mode 100644 docs/htmldocs/troubleshooting.html create mode 100644 docs/htmldocs/upgrading-to-3.0.html create mode 100644 docs/manpages/Samba.7 create mode 100644 docs/manpages/tdbbackup.8 create mode 100644 docs/textdocs/README.jis create mode 100644 examples/LDAP/export_smbpasswd.pl create mode 100644 examples/LDAP/import_smbpasswd.pl create mode 100644 examples/VFS/Makefile.in create mode 100755 examples/VFS/autogen.sh create mode 100644 examples/VFS/configure.in create mode 100644 examples/VFS/install-sh create mode 100644 examples/VFS/skel_opaque.c create mode 100644 examples/VFS/skel_transparent.c create mode 100644 examples/pdb/sambapdb.dtd create mode 100644 packaging/Debian/debian/patches/krb5-vars.patch create mode 100644 packaging/Debian/debian/patches/pam_smbpass_linkage.patch create mode 100644 packaging/Debian/debian/patches/smbclient-tar.patch create mode 100644 packaging/Mandrake/swat_16.png.bz2 create mode 100644 packaging/Mandrake/swat_32.png.bz2 create mode 100644 packaging/Mandrake/swat_48.png.bz2 create mode 100644 packaging/RedHat/samba.spec.tmpl create mode 100644 packaging/Solaris/.cvsignore create mode 100644 packaging/SuSE/README create mode 100644 packaging/SuSE/samba-3.0.0-msdfs.diff create mode 100644 packaging/SuSE/samba-3.0.0-net_ads.diff create mode 100644 packaging/SuSE/samba-3.0.0-pdb.diff create mode 100644 packaging/SuSE/samba-3.0.0-python.diff create mode 100644 packaging/SuSE/samba-3.0.0-vscan.diff create mode 100644 packaging/SuSE/samba-3.0.0.files.tar.bz2 create mode 100644 packaging/SuSE/samba-vscan-0.3.1.tar.bz2 create mode 100644 packaging/SuSE/samba3.spec create mode 100755 source3/build-me create mode 100644 source3/include/smbldap.h create mode 100644 source3/include/sysquotas.h create mode 100644 source3/include/vfs_macros.h create mode 100644 source3/intl/libgettext.h create mode 100644 source3/lib/smbldap.c create mode 100644 source3/lib/sysquotas.c create mode 100644 source3/libsmb/conncache.c create mode 100644 source3/libsmb/samlogon_cache.c create mode 100644 source3/mainpage.dox create mode 100644 source3/modules/weird.c create mode 100644 source3/nsswitch/winbindd_acct.c create mode 100644 source3/pam_smbpass/.cvsignore create mode 100644 source3/passdb/pdb_plugin.c create mode 100644 source3/script/mkbuildoptions.awk create mode 100644 source3/smbd/fake_file.c create mode 100644 source3/smbd/ntquotas.c create mode 100644 source3/tdb/tdbback.c create mode 100644 source3/tdb/tdbback.h create mode 100644 source3/utils/net_idmap.c create mode 100644 testsuite/build_farm/torture-DIR1.test create mode 100644 testsuite/build_farm/torture-FDSESS.test create mode 100644 testsuite/build_farm/torture-LOCK6.test create mode 100644 testsuite/build_farm/torture-LOCK7.test create mode 100644 testsuite/build_farm/torture-MANGLE.test create mode 100644 testsuite/build_farm/torture-PROPERTIES.test create mode 100644 testsuite/build_farm/torture-TCON1.test create mode 100644 testsuite/build_farm/torture-TCON2.test create mode 100644 testsuite/build_farm/torture-TCONDEV.test diff --git a/docs/docbook/devdoc/.cvsignore b/docs/docbook/devdoc/.cvsignore new file mode 100644 index 0000000000..3bbac303f5 --- /dev/null +++ b/docs/docbook/devdoc/.cvsignore @@ -0,0 +1 @@ +attributions.xml diff --git a/docs/docbook/devdoc/vfs.xml b/docs/docbook/devdoc/vfs.xml new file mode 100644 index 0000000000..ed2afef53e --- /dev/null +++ b/docs/docbook/devdoc/vfs.xml @@ -0,0 +1,797 @@ + + + + AlexanderBokovoy + +

    ab@samba.org
    + + + + StefanMetzmacher + +
    metze@metzemix.de
    +     +     + 27 May 2003 + + +VFS Modules + + +The Samba (Posix) VFS layer + + +The general interface + + +Each VFS operation has a vfs_op_type, a function pointer and a handle pointer in the +struct vfs_ops and tree macros to make it easier to call the operations. +(Take a look at include/vfs.h and include/vfs_macros.h.) + + + +typedef enum _vfs_op_type { + SMB_VFS_OP_NOOP = -1, + + ... + + /* File operations */ + + SMB_VFS_OP_OPEN, + SMB_VFS_OP_CLOSE, + SMB_VFS_OP_READ, + SMB_VFS_OP_WRITE, + SMB_VFS_OP_LSEEK, + SMB_VFS_OP_SENDFILE, + + ... + + SMB_VFS_OP_LAST +} vfs_op_type; + + +This struct contains the function and handle pointers for all operations. +struct vfs_ops { + struct vfs_fn_pointers { + ... + + /* File operations */ + + int (*open)(struct vfs_handle_struct *handle, + struct connection_struct *conn, + const char *fname, int flags, mode_t mode); + int (*close)(struct vfs_handle_struct *handle, + struct files_struct *fsp, int fd); + ssize_t (*read)(struct vfs_handle_struct *handle, + struct files_struct *fsp, int fd, void *data, size_t n); + ssize_t (*write)(struct vfs_handle_struct *handle, + struct files_struct *fsp, int fd, + const void *data, size_t n); + SMB_OFF_T (*lseek)(struct vfs_handle_struct *handle, + struct files_struct *fsp, int fd, + SMB_OFF_T offset, int whence); + ssize_t (*sendfile)(struct vfs_handle_struct *handle, + int tofd, files_struct *fsp, int fromfd, + const DATA_BLOB *header, SMB_OFF_T offset, size_t count); + + ... + } ops; + + struct vfs_handles_pointers { + ... + + /* File operations */ + + struct vfs_handle_struct *open; + struct vfs_handle_struct *close; + struct vfs_handle_struct *read; + struct vfs_handle_struct *write; + struct vfs_handle_struct *lseek; + struct vfs_handle_struct *sendfile; + + ... + } handles; +}; + + + +This macros SHOULD be used to call any vfs operation. +DO NOT ACCESS conn->vfs.ops.* directly !!! + +... + +/* File operations */ +#define SMB_VFS_OPEN(conn, fname, flags, mode) \ + ((conn)->vfs.ops.open((conn)->vfs.handles.open,\ + (conn), (fname), (flags), (mode))) +#define SMB_VFS_CLOSE(fsp, fd) \ + ((fsp)->conn->vfs.ops.close(\ + (fsp)->conn->vfs.handles.close, (fsp), (fd))) +#define SMB_VFS_READ(fsp, fd, data, n) \ + ((fsp)->conn->vfs.ops.read(\ + (fsp)->conn->vfs.handles.read,\ + (fsp), (fd), (data), (n))) +#define SMB_VFS_WRITE(fsp, fd, data, n) \ + ((fsp)->conn->vfs.ops.write(\ + (fsp)->conn->vfs.handles.write,\ + (fsp), (fd), (data), (n))) +#define SMB_VFS_LSEEK(fsp, fd, offset, whence) \ + ((fsp)->conn->vfs.ops.lseek(\ + (fsp)->conn->vfs.handles.lseek,\ + (fsp), (fd), (offset), (whence))) +#define SMB_VFS_SENDFILE(tofd, fsp, fromfd, header, offset, count) \ + ((fsp)->conn->vfs.ops.sendfile(\ + (fsp)->conn->vfs.handles.sendfile,\ + (tofd), (fsp), (fromfd), (header), (offset), (count))) + +... + + + + + +Possible VFS operation layers + + +These values are used by the VFS subsystem when building the conn->vfs +and conn->vfs_opaque structs for a connection with multiple VFS modules. +Internally, Samba differentiates only opaque and transparent layers at this process. +Other types are used for providing better diagnosing facilities. + + + +Most modules will provide transparent layers. Opaque layer is for modules +which implement actual file system calls (like DB-based VFS). For example, +default POSIX VFS which is built in into Samba is an opaque VFS module. + + + +Other layer types (logger, splitter, scanner) were designed to provide different +degree of transparency and for diagnosing VFS module behaviour. + + + +Each module can implement several layers at the same time provided that only +one layer is used per each operation. + + + +typedef enum _vfs_op_layer { + SMB_VFS_LAYER_NOOP = -1, /* - For using in VFS module to indicate end of array */ + /* of operations description */ + SMB_VFS_LAYER_OPAQUE = 0, /* - Final level, does not call anything beyond itself */ + SMB_VFS_LAYER_TRANSPARENT, /* - Normal operation, calls underlying layer after */ + /* possibly changing passed data */ + SMB_VFS_LAYER_LOGGER, /* - Logs data, calls underlying layer, logging may not */ + /* use Samba VFS */ + SMB_VFS_LAYER_SPLITTER, /* - Splits operation, calls underlying layer _and_ own facility, */ + /* then combines result */ + SMB_VFS_LAYER_SCANNER /* - Checks data and possibly initiates additional */ + /* file activity like logging to files _inside_ samba VFS */ +} vfs_op_layer; + + + + + + + +The Interaction between the Samba VFS subsystem and the modules + + +Initialization and registration + + +As each Samba module a VFS module should have a +NTSTATUS vfs_example_init(void); function if it's staticly linked to samba or +NTSTATUS init_module(void); function if it's a shared module. + + + +This should be the only non static function inside the module. +Global variables should also be static! + + + +The module should register its functions via the + +NTSTATUS smb_register_vfs(int version, const char *name, vfs_op_tuple *vfs_op_tuples); + function. + + + + +version +should be filled with SMB_VFS_INTERFACE_VERSION + + +name +this is the name witch can be listed in the +vfs objects parameter to use this module. + + +vfs_op_tuples + +this is an array of vfs_op_tuple's. +(vfs_op_tuples is descripted in details below.) + + + + + + +For each operation the module wants to provide it has a entry in the +vfs_op_tuple array. + + + +typedef struct _vfs_op_tuple { + void* op; + vfs_op_type type; + vfs_op_layer layer; +} vfs_op_tuple; + + + + +op +the function pointer to the specified function. + + +type +the vfs_op_type of the function to specified witch operation the function provides. + + +layer +the vfs_op_layer in whitch the function operates. + + + + +A simple example: + + +static vfs_op_tuple example_op_tuples[] = { + {SMB_VFS_OP(example_connect), SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(example_disconnect), SMB_VFS_OP_DISCONNECT, SMB_VFS_LAYER_TRANSPARENT}, + + {SMB_VFS_OP(example_rename), SMB_VFS_OP_RENAME, SMB_VFS_LAYER_OPAQUE}, + + /* This indicates the end of the array */ + {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} +}; + +NTSTATUS init_module(void) +{ + return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "example", example_op_tuples); +} + + + + + +How the Modules handle per connection data + +Each VFS function has as first parameter a pointer to the modules vfs_handle_struct. + + + +typedef struct vfs_handle_struct { + struct vfs_handle_struct *next, *prev; + const char *param; + struct vfs_ops vfs_next; + struct connection_struct *conn; + void *data; + void (*free_data)(void **data); +} vfs_handle_struct; + + + + +param +this is the module parameter specified in the vfs objects parameter. +e.g. for 'vfs objects = example:test' param would be "test". + + +vfs_next +This vfs_ops struct contains the information for calling the next module operations. +Use the SMB_VFS_NEXT_* macros to call a next module operations and +don't access handle->vfs_next.ops.* directly! + + +conn +This is a pointer back to the connection_struct to witch the handle belongs. + + +data +This is a pointer for holding module private data. +You can alloc data with connection life time on the handle->conn->mem_ctx TALLOC_CTX. +But you can also manage the memory allocation yourself. + + +free_data +This is a function pointer to a function that free's the module private data. +If you talloc your private data on the TALLOC_CTX handle->conn->mem_ctx, +you can set this function pointer to NULL. + + + + +Some useful MACROS for handle private data. + + + +#define SMB_VFS_HANDLE_GET_DATA(handle, datap, type, ret) { \ + if (!(handle)||((datap=(type *)(handle)->data)==NULL)) { \ + DEBUG(0,("%s() failed to get vfs_handle->data!\n",FUNCTION_MACRO)); \ + ret; \ + } \ +} + +#define SMB_VFS_HANDLE_SET_DATA(handle, datap, free_fn, type, ret) { \ + if (!(handle)) { \ + DEBUG(0,("%s() failed to set handle->data!\n",FUNCTION_MACRO)); \ + ret; \ + } else { \ + if ((handle)->free_data) { \ + (handle)->free_data(&(handle)->data); \ + } \ + (handle)->data = (void *)datap; \ + (handle)->free_data = free_fn; \ + } \ +} + +#define SMB_VFS_HANDLE_FREE_DATA(handle) { \ + if ((handle) && (handle)->free_data) { \ + (handle)->free_data(&(handle)->data); \ + } \ +} + + +How SMB_VFS_LAYER_TRANSPARENT functions can call the SMB_VFS_LAYER_OPAQUE functions. + +The easiest way to do this is to use the SMB_VFS_OPAQUE_* macros. + + + +... +/* File operations */ +#define SMB_VFS_OPAQUE_OPEN(conn, fname, flags, mode) \ + ((conn)->vfs_opaque.ops.open(\ + (conn)->vfs_opaque.handles.open,\ + (conn), (fname), (flags), (mode))) +#define SMB_VFS_OPAQUE_CLOSE(fsp, fd) \ + ((fsp)->conn->vfs_opaque.ops.close(\ + (fsp)->conn->vfs_opaque.handles.close,\ + (fsp), (fd))) +#define SMB_VFS_OPAQUE_READ(fsp, fd, data, n) \ + ((fsp)->conn->vfs_opaque.ops.read(\ + (fsp)->conn->vfs_opaque.handles.read,\ + (fsp), (fd), (data), (n))) +#define SMB_VFS_OPAQUE_WRITE(fsp, fd, data, n) \ + ((fsp)->conn->vfs_opaque.ops.write(\ + (fsp)->conn->vfs_opaque.handles.write,\ + (fsp), (fd), (data), (n))) +#define SMB_VFS_OPAQUE_LSEEK(fsp, fd, offset, whence) \ + ((fsp)->conn->vfs_opaque.ops.lseek(\ + (fsp)->conn->vfs_opaque.handles.lseek,\ + (fsp), (fd), (offset), (whence))) +#define SMB_VFS_OPAQUE_SENDFILE(tofd, fsp, fromfd, header, offset, count) \ + ((fsp)->conn->vfs_opaque.ops.sendfile(\ + (fsp)->conn->vfs_opaque.handles.sendfile,\ + (tofd), (fsp), (fromfd), (header), (offset), (count))) +... + + +How SMB_VFS_LAYER_TRANSPARENT functions can call the next modules functions. + +The easiest way to do this is to use the SMB_VFS_NEXT_* macros. + + + +... +/* File operations */ +#define SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode) \ + ((handle)->vfs_next.ops.open(\ + (handle)->vfs_next.handles.open,\ + (conn), (fname), (flags), (mode))) +#define SMB_VFS_NEXT_CLOSE(handle, fsp, fd) \ + ((handle)->vfs_next.ops.close(\ + (handle)->vfs_next.handles.close,\ + (fsp), (fd))) +#define SMB_VFS_NEXT_READ(handle, fsp, fd, data, n) \ + ((handle)->vfs_next.ops.read(\ + (handle)->vfs_next.handles.read,\ + (fsp), (fd), (data), (n))) +#define SMB_VFS_NEXT_WRITE(handle, fsp, fd, data, n) \ + ((handle)->vfs_next.ops.write(\ + (handle)->vfs_next.handles.write,\ + (fsp), (fd), (data), (n))) +#define SMB_VFS_NEXT_LSEEK(handle, fsp, fd, offset, whence) \ + ((handle)->vfs_next.ops.lseek(\ + (handle)->vfs_next.handles.lseek,\ + (fsp), (fd), (offset), (whence))) +#define SMB_VFS_NEXT_SENDFILE(handle, tofd, fsp, fromfd, header, offset, count) \ + ((handle)->vfs_next.ops.sendfile(\ + (handle)->vfs_next.handles.sendfile,\ + (tofd), (fsp), (fromfd), (header), (offset), (count))) +... + + + + + + + +Upgrading to the New VFS Interface + + +Upgrading from 2.2.* and 3.0aplha modules + + + +Add "vfs_handle_struct *handle, " as first parameter to all vfs operation functions. +e.g. example_connect(connection_struct *conn, const char *service, const char *user); +-> example_connect(vfs_handle_struct *handle, connection_struct *conn, const char *service, const char *user); + + + +Replace "default_vfs_ops." with "smb_vfs_next_". +e.g. default_vfs_ops.connect(conn, service, user); +-> smb_vfs_next_connect(conn, service, user); + + + +Uppercase all "smb_vfs_next_*" functions. +e.g. smb_vfs_next_connect(conn, service, user); +-> SMB_VFS_NEXT_CONNECT(conn, service, user); + + + +Add "handle, " as first parameter to all SMB_VFS_NEXT_*() calls. +e.g. SMB_VFS_NEXT_CONNECT(conn, service, user); +-> SMB_VFS_NEXT_CONNECT(handle, conn, service, user); + + + +(Only for 2.2.* modules) +Convert the old struct vfs_ops example_ops to +a vfs_op_tuple example_op_tuples[] array. +e.g. + +struct vfs_ops example_ops = { + /* Disk operations */ + example_connect, /* connect */ + example_disconnect, /* disconnect */ + NULL, /* disk free * + /* Directory operations */ + NULL, /* opendir */ + NULL, /* readdir */ + NULL, /* mkdir */ + NULL, /* rmdir */ + NULL, /* closedir */ + /* File operations */ + NULL, /* open */ + NULL, /* close */ + NULL, /* read */ + NULL, /* write */ + NULL, /* lseek */ + NULL, /* sendfile */ + NULL, /* rename */ + NULL, /* fsync */ + example_stat, /* stat */ + example_fstat, /* fstat */ + example_lstat, /* lstat */ + NULL, /* unlink */ + NULL, /* chmod */ + NULL, /* fchmod */ + NULL, /* chown */ + NULL, /* fchown */ + NULL, /* chdir */ + NULL, /* getwd */ + NULL, /* utime */ + NULL, /* ftruncate */ + NULL, /* lock */ + NULL, /* symlink */ + NULL, /* readlink */ + NULL, /* link */ + NULL, /* mknod */ + NULL, /* realpath */ + NULL, /* fget_nt_acl */ + NULL, /* get_nt_acl */ + NULL, /* fset_nt_acl */ + NULL, /* set_nt_acl */ + + NULL, /* chmod_acl */ + NULL, /* fchmod_acl */ + + NULL, /* sys_acl_get_entry */ + NULL, /* sys_acl_get_tag_type */ + NULL, /* sys_acl_get_permset */ + NULL, /* sys_acl_get_qualifier */ + NULL, /* sys_acl_get_file */ + NULL, /* sys_acl_get_fd */ + NULL, /* sys_acl_clear_perms */ + NULL, /* sys_acl_add_perm */ + NULL, /* sys_acl_to_text */ + NULL, /* sys_acl_init */ + NULL, /* sys_acl_create_entry */ + NULL, /* sys_acl_set_tag_type */ + NULL, /* sys_acl_set_qualifier */ + NULL, /* sys_acl_set_permset */ + NULL, /* sys_acl_valid */ + NULL, /* sys_acl_set_file */ + NULL, /* sys_acl_set_fd */ + NULL, /* sys_acl_delete_def_file */ + NULL, /* sys_acl_get_perm */ + NULL, /* sys_acl_free_text */ + NULL, /* sys_acl_free_acl */ + NULL /* sys_acl_free_qualifier */ +}; + +-> + +static vfs_op_tuple example_op_tuples[] = { + {SMB_VFS_OP(example_connect), SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(example_disconnect), SMB_VFS_OP_DISCONNECT, SMB_VFS_LAYER_TRANSPARENT}, + + {SMB_VFS_OP(example_fstat), SMB_VFS_OP_FSTAT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(example_stat), SMB_VFS_OP_STAT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(example_lstat), SMB_VFS_OP_LSTAT, SMB_VFS_LAYER_TRANSPARENT}, + + {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} +}; + + + + +Move the example_op_tuples[] array to the end of the file. + + + +Add the init_module() function at the end of the file. +e.g. + +NTSTATUS init_module(void) +{ + return smb_register_vfs(SMB_VFS_INTERFACE_VERSION,"example",example_op_tuples); +} + + + + +Check if your vfs_init() function does more then just prepare the vfs_ops structs or +remember the struct smb_vfs_handle_struct. + +If NOT you can remove the vfs_init() function. +If YES decide if you want to move the code to the example_connect() operation or to the init_module(). And then remove vfs_init(). + e.g. a debug class registration should go into init_module() and the allocation of private data should go to example_connect(). + + + + +(Only for 3.0alpha* modules) +Check if your vfs_done() function contains needed code. + +If NOT you can remove the vfs_done() function. +If YES decide if you can move the code to the example_disconnect() operation. Otherwise register a SMB_EXIT_EVENT with smb_register_exit_event(); (Described in the modules section) And then remove vfs_done(). e.g. the freeing of private data should go to example_disconnect(). + + + + + +Check if you have any global variables left. +Decide if it wouldn't be better to have this data on a connection basis. + + If NOT leave them as they are. (e.g. this could be the variable for the private debug class.) + If YES pack all this data into a struct. You can use handle->data to point to such a struct on a per connection basis. + + + e.g. if you have such a struct: + +struct example_privates { + char *some_string; + int db_connection; +}; + +first way of doing it: + +static int example_connect(vfs_handle_struct *handle, + connection_struct *conn, const char *service, + const char* user) +{ + struct example_privates *data = NULL; + + /* alloc our private data */ + data = (struct example_privates *)talloc_zero(conn->mem_ctx, sizeof(struct example_privates)); + if (!data) { + DEBUG(0,("talloc_zero() failed\n")); + return -1; + } + + /* init out private data */ + data->some_string = talloc_strdup(conn->mem_ctx,"test"); + if (!data->some_string) { + DEBUG(0,("talloc_strdup() failed\n")); + return -1; + } + + data->db_connection = open_db_conn(); + + /* and now store the private data pointer in handle->data + * we don't need to specify a free_function here because + * we use the connection TALLOC context. + * (return -1 if something failed.) + */ + VFS_HANDLE_SET_DATA(handle, data, NULL, struct example_privates, return -1); + + return SMB_VFS_NEXT_CONNECT(handle,conn,service,user); +} + +static int example_close(vfs_handle_struct *handle, files_struct *fsp, int fd) +{ + struct example_privates *data = NULL; + + /* get the pointer to our private data + * return -1 if something failed + */ + SMB_VFS_HANDLE_GET_DATA(handle, data, struct example_privates, return -1); + + /* do something here...*/ + DEBUG(0,("some_string: %s\n",data->some_string)); + + return SMB_VFS_NEXT_CLOSE(handle, fsp, fd); +} + +second way of doing it: + +static void free_example_privates(void **datap) +{ + struct example_privates *data = (struct example_privates *)*datap; + + SAFE_FREE(data->some_string); + SAFE_FREE(data); + + *datap = NULL; + + return; +} + +static int example_connect(vfs_handle_struct *handle, + connection_struct *conn, const char *service, + const char* user) +{ + struct example_privates *data = NULL; + + /* alloc our private data */ + data = (struct example_privates *)malloc(sizeof(struct example_privates)); + if (!data) { + DEBUG(0,("malloc() failed\n")); + return -1; + } + + /* init out private data */ + data->some_string = strdup("test"); + if (!data->some_string) { + DEBUG(0,("strdup() failed\n")); + return -1; + } + + data->db_connection = open_db_conn(); + + /* and now store the private data pointer in handle->data + * we need to specify a free_function because we used malloc() and strdup(). + * (return -1 if something failed.) + */ + SMB_VFS_HANDLE_SET_DATA(handle, data, free_example_privates, struct example_privates, return -1); + + return SMB_VFS_NEXT_CONNECT(handle,conn,service,user); +} + +static int example_close(vfs_handle_struct *handle, files_struct *fsp, int fd) +{ + struct example_privates *data = NULL; + + /* get the pointer to our private data + * return -1 if something failed + */ + SMB_VFS_HANDLE_GET_DATA(handle, data, struct example_privates, return -1); + + /* do something here...*/ + DEBUG(0,("some_string: %s\n",data->some_string)); + + return SMB_VFS_NEXT_CLOSE(handle, fsp, fd); +} + + + + +To make it easy to build 3rd party modules it would be usefull to provide +configure.in, (configure), install.sh and Makefile.in with the module. +(Take a look at the example in examples/VFS.) + + + +The configure script accepts to specify +the path to the samba source tree. +It also accept which lets the compiler +give you more warnings. + + + +The idea is that you can extend this +configure.in and Makefile.in scripts +for your module. + + + +Compiling & Testing... + +./configure ... +make +Try to fix all compiler warnings +make +Testing, Testing, Testing ... + + + + + + + + +Some Notes + + +Implement TRANSPARENT functions + + +Avoid writing functions like this: + + +static int example_close(vfs_handle_struct *handle, files_struct *fsp, int fd) +{ + return SMB_VFS_NEXT_CLOSE(handle, fsp, fd); +} + + +Overload only the functions you really need to! + + + + + +Implement OPAQUE functions + + +If you want to just implement a better version of a +default samba opaque function +(e.g. like a disk_free() function for a special filesystem) +it's ok to just overload that specific function. + + + +If you want to implement a database filesystem or +something different from a posix filesystem. +Make sure that you overload every vfs operation!!! + + +Functions your FS does not support should be overloaded by something like this: +e.g. for a readonly filesystem. + + + +static int example_rename(vfs_handle_struct *handle, connection_struct *conn, + char *oldname, char *newname) +{ + DEBUG(10,("function rename() not allowed on vfs 'example'\n")); + errno = ENOSYS; + return -1; +} + + + + + + + diff --git a/docs/docbook/devdoc/windows-debug.xml b/docs/docbook/devdoc/windows-debug.xml new file mode 100644 index 0000000000..3535c38dbd --- /dev/null +++ b/docs/docbook/devdoc/windows-debug.xml @@ -0,0 +1,19 @@ + + + &author.jelmer; + &author.tridge; + + + Finding useful information on windows + + Netlogon debugging output + + + stop netlogon service on PDC + rename original netlogon.dll to netlogon.dll.original + copy checked version of netlogon.dll to system32 directory + set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DBFlag to 0x20000004 + start netlogon service on PDC + + + diff --git a/docs/docbook/manpages/profiles.1.sgml b/docs/docbook/manpages/profiles.1.sgml new file mode 100644 index 0000000000..6fd2b6fd86 --- /dev/null +++ b/docs/docbook/manpages/profiles.1.sgml @@ -0,0 +1,86 @@ + %globalentities; +]> + + + + profiles + 1 + + + + + profiles + A utility to report and change SIDs in registry files + + + + + + profiles + -v + -c SID + -n SID + file + + + + + DESCRIPTION + + This tool is part of the Samba + 7 suite. + + profiles is a utility that + reports and changes SIDs in windows registry files. It currently only + supports NT. + + + + + + OPTIONS + + + + file + Registry file to view or edit. + + + + + -v,--verbose + Increases verbosity of messages. + + + + + -c SID1 -n SID2 + Change all occurences of SID1 in file by SID2. + + + + &stdarg.help; + + + + + + VERSION + + This man page is correct for version 3.0 of the Samba + suite. + + + + AUTHOR + + The original Samba software and related utilities + were created by Andrew Tridgell. Samba is now developed + by the Samba Team as an Open Source project similar + to the way the Linux kernel is developed. + + The profiles man page was written by Jelmer Vernooij. + + + diff --git a/docs/docbook/projdoc/.cvsignore b/docs/docbook/projdoc/.cvsignore new file mode 100644 index 0000000000..3bbac303f5 --- /dev/null +++ b/docs/docbook/projdoc/.cvsignore @@ -0,0 +1 @@ +attributions.xml diff --git a/docs/docbook/projdoc/Backup.xml b/docs/docbook/projdoc/Backup.xml new file mode 100644 index 0000000000..b3c37aba53 --- /dev/null +++ b/docs/docbook/projdoc/Backup.xml @@ -0,0 +1,36 @@ + + + &author.jht; + + +Samba Backup Techniques + + +Note + + +This chapter did not make it into this release. +It is planned for the published release of this document. +If you have something to contribute for this section please email it to +jht@samba.org/ + + + + + +Features and Benefits + + +We need feedback from people who are backing up samba servers. +We would like to know what software tools you are using to backup +your samba server/s. + + + +In particular, if you have any success and / or failure stories you could +share with other users this would be appreciated. + + + + + diff --git a/docs/docbook/projdoc/DNS-DHCP-Configuration.xml b/docs/docbook/projdoc/DNS-DHCP-Configuration.xml new file mode 100644 index 0000000000..21bda63276 --- /dev/null +++ b/docs/docbook/projdoc/DNS-DHCP-Configuration.xml @@ -0,0 +1,17 @@ + + + &author.jht; + + +DNS and DHCP Configuration Guide + + +Note + + +This chapter did not make it into this release. +It is planned for the published release of this document. + + + + diff --git a/docs/docbook/projdoc/FastStart.xml b/docs/docbook/projdoc/FastStart.xml new file mode 100644 index 0000000000..a1aee9b7df --- /dev/null +++ b/docs/docbook/projdoc/FastStart.xml @@ -0,0 +1,17 @@ + + + &author.jht; + + +Fast Start for the Impatient + + +Note + + +This chapter did not make it into this release. +It is planned for the published release of this document. + + + + diff --git a/docs/docbook/projdoc/HighAvailability.xml b/docs/docbook/projdoc/HighAvailability.xml new file mode 100644 index 0000000000..3cd7fac807 --- /dev/null +++ b/docs/docbook/projdoc/HighAvailability.xml @@ -0,0 +1,17 @@ + + + &author.jht; + + +High Availability Options + + +Note + + +This chapter did not make it into this release. +It is planned for the published release of this document. + + + + diff --git a/docs/docbook/projdoc/WindowsClientConfig.xml b/docs/docbook/projdoc/WindowsClientConfig.xml new file mode 100644 index 0000000000..ea1d4d5aa3 --- /dev/null +++ b/docs/docbook/projdoc/WindowsClientConfig.xml @@ -0,0 +1,17 @@ + + + &author.jht; + + +MS Windows Network Configuration Guide + + +Note + + +This chapter did not make it into this release. +It is planned for the published release of this document. + + + + diff --git a/docs/docbook/smbdotconf/misc/valid.xml b/docs/docbook/smbdotconf/misc/valid.xml new file mode 100644 index 0000000000..b5756f0afe --- /dev/null +++ b/docs/docbook/smbdotconf/misc/valid.xml @@ -0,0 +1,18 @@ + + + This parameter indicates whether a share is + valid and thus can be used. When this parameter is set to false, + the share will be in no way visible nor accessible. + + + + This option should not be + used by regular users but might be of help to developers. + Samba uses this option internally to mark shares as deleted. + + + Default: True + + diff --git a/docs/docbook/smbdotconf/printing/totalprintjobs.xml b/docs/docbook/smbdotconf/printing/totalprintjobs.xml new file mode 100644 index 0000000000..ccdb137a69 --- /dev/null +++ b/docs/docbook/smbdotconf/printing/totalprintjobs.xml @@ -0,0 +1,22 @@ + + + This parameter accepts an integer value which defines + a limit on the maximum number of print jobs that will be accepted + system wide at any given time. If a print job is submitted + by a client which will exceed this number, then smbd + 8 will return an + error indicating that no space is available on the server. The + default value of 0 means that no such limit exists. This parameter + can be used to prevent a server from exceeding its capacity and is + designed as a printing throttle. See also + max print jobs. + + + Default: total print jobs = 0 + + Example: total print jobs = 5000 + + diff --git a/docs/docbook/smbdotconf/protocol/clientusespnego.xml b/docs/docbook/smbdotconf/protocol/clientusespnego.xml new file mode 100644 index 0000000000..df25fbfb20 --- /dev/null +++ b/docs/docbook/smbdotconf/protocol/clientusespnego.xml @@ -0,0 +1,13 @@ + + + This variable controls controls whether samba clients will try + to use Simple and Protected NEGOciation (as specified by rfc2478) with + WindowsXP and Windows2000 servers to agree upon an authentication mechanism. + + + Default: client use spnego = yes + + diff --git a/docs/docbook/smbdotconf/protocol/mapaclinherit.xml b/docs/docbook/smbdotconf/protocol/mapaclinherit.xml new file mode 100644 index 0000000000..5b8ed7f656 --- /dev/null +++ b/docs/docbook/smbdotconf/protocol/mapaclinherit.xml @@ -0,0 +1,17 @@ + + + This boolean parameter controls whether smbd + 8 will attempt to map the 'inherit' and 'protected' + access control entry flags stored in Windows ACLs into an extended attribute + called user.SAMBA_PAI. This parameter only takes effect if Samba is being run + on a platform that supports extended attributes (Linux and IRIX so far) and + allows the Windows 2000 ACL editor to correctly use inheritance with the Samba + POSIX ACL mapping code. + + + Default: map acl inherit = no + + diff --git a/docs/docbook/smbdotconf/protocol/profileacls.xml b/docs/docbook/smbdotconf/protocol/profileacls.xml new file mode 100644 index 0000000000..6f2b3ec510 --- /dev/null +++ b/docs/docbook/smbdotconf/protocol/profileacls.xml @@ -0,0 +1,33 @@ + + + This boolean parameter controls whether smbd + 8 + This boolean parameter was added to fix the problems that people have been + having with storing user profiles on Samba shares from Windows 2000 or + Windows XP clients. New versions of Windows 2000 or Windows XP service + packs do security ACL checking on the owner and ability to write of the + profile directory stored on a local workstation when copied from a Samba + share. When not in domain mode with winbindd then the security info copied + onto the local workstation has no meaning to the logged in user (SID) on + that workstation so the profile storing fails. Adding this parameter + onto a share used for profile storage changes two things about the + returned Windows ACL. Firstly it changes the owner and group owner + of all reported files and directories to be BUILTIN\\Administrators, + BUILTIN\\Users respectively (SIDs S-1-5-32-544, S-1-5-32-545). Secondly + it adds an ACE entry of "Full Control" to the SID BUILTIN\\Users to + every returned ACL. This will allow any Windows 2000 or XP workstation + user to access the profile. Note that if you have multiple users logging + on to a workstation then in order to prevent them from being able to access + each others profiles you must remove the "Bypass traverse checking" advanced + user right. This will prevent access to other users profile directories as + the top level profile directory (named after the user) is created by the + workstation profile code and has an ACL restricting entry to the directory + tree to the owning user. + + + Default: profile acls = no + + diff --git a/docs/docbook/smbdotconf/security/clientlanmanauth.xml b/docs/docbook/smbdotconf/security/clientlanmanauth.xml new file mode 100644 index 0000000000..a427198ea3 --- /dev/null +++ b/docs/docbook/smbdotconf/security/clientlanmanauth.xml @@ -0,0 +1,28 @@ + + + This parameter determines whether or not smbclient + 8 and other samba client + tools will attempt to authenticate itself to servers using the + weaker LANMAN password hash. If disabled, only server which support NT + password hashes (e.g. Windows NT/2000, Samba, etc... but not + Windows 95/98) will be able to be connected from the Samba client. + + The LANMAN encrypted response is easily broken, due to it's + case-insensitive nature, and the choice of algorithm. Clients + without Windows 95/98 servers are advised to disable + this option. + + Disabling this option will also disable the client plaintext auth option + + Likewise, if the client ntlmv2 + auth parameter is enabled, then only NTLMv2 logins will be + attempted. Not all servers support NTLMv2, and most will require + special configuration to us it. + + Default : client lanman auth = yes + + diff --git a/docs/docbook/smbdotconf/security/clientntlmv2auth.xml b/docs/docbook/smbdotconf/security/clientntlmv2auth.xml new file mode 100644 index 0000000000..0bf196488b --- /dev/null +++ b/docs/docbook/smbdotconf/security/clientntlmv2auth.xml @@ -0,0 +1,26 @@ + + + This parameter determines whether or not smbclient + 8 will attempt to + authenticate itself to servers using the NTLMv2 encrypted password + response. + + If enabled, only an NTLMv2 and LMv2 response (both much more + secure than earlier versions) will be sent. Many servers + (including NT4 < SP4, Win9x and Samba 2.2) are not compatible with + NTLMv2. + + If disabled, an NTLM response (and possibly a LANMAN response) + will be sent by the client, depending on the value of client lanman auth. + + Note that some sites (particularly + those following 'best practice' security polices) only allow NTLMv2 + responses, and not the weaker LM or NTLM. + + Default : client ntlmv2 auth = no + + diff --git a/docs/docbook/smbdotconf/vfs/vfsobjects.xml b/docs/docbook/smbdotconf/vfs/vfsobjects.xml new file mode 100644 index 0000000000..32a10b5bd6 --- /dev/null +++ b/docs/docbook/smbdotconf/vfs/vfsobjects.xml @@ -0,0 +1,14 @@ + + + This parameter specifies the backend names which + are used for Samba VFS I/O operations. By default, normal + disk I/O operations are used but these can be overloaded + with one or more VFS objects. + + Default: no value + + Example: vfs objects = extd_audit recycle + + diff --git a/docs/docbook/smbdotconf/winbind/enableridalgorithm.xml b/docs/docbook/smbdotconf/winbind/enableridalgorithm.xml new file mode 100644 index 0000000000..86786f0734 --- /dev/null +++ b/docs/docbook/smbdotconf/winbind/enableridalgorithm.xml @@ -0,0 +1,17 @@ + + + This option is used to control whether or not smbd in Samba 3.0 should fallback + to the algorithm used by Samba 2.2 to generate user and group RIDs. The longterm + development goal is to remove the algorithmic mappings of RIDs altogether, but + this has proved to be difficult. This parameter is mainly provided so that + developers can turn the algorithm on and off and see what breaks. This parameter + should not be disabled by non-developers because certain features in Samba will fail + to work without it. + + + Default: enable rid algorithm = <yes> + + diff --git a/docs/docbook/smbdotconf/winbind/idmapgid.xml b/docs/docbook/smbdotconf/winbind/idmapgid.xml new file mode 100644 index 0000000000..8bd46a80c6 --- /dev/null +++ b/docs/docbook/smbdotconf/winbind/idmapgid.xml @@ -0,0 +1,18 @@ + + + + The idmap gid parameter specifies the range of group ids that are allocated for + the purpose of mapping UNX groups to NT group SIDs. This range of group ids should have no + existing local or NIS groups within it as strange conflicts can occur otherwise. + + The availability of an idmap gid range is essential for correct operation of + all group mapping. + + Default: idmap gid = <empty string> + + Example: idmap gid = 10000-20000 + + diff --git a/docs/docbook/smbdotconf/winbind/idmapuid.xml b/docs/docbook/smbdotconf/winbind/idmapuid.xml new file mode 100644 index 0000000000..5e6a245bfe --- /dev/null +++ b/docs/docbook/smbdotconf/winbind/idmapuid.xml @@ -0,0 +1,14 @@ + + + The idmap uid parameter specifies the range of user ids that are allocated for use + in mapping UNIX users to NT user SIDs. This range of ids should have no existing local + or NIS users within it as strange conflicts can occur otherwise. + + Default: idmap uid = <empty string> + + Example: idmap uid = 10000-20000 + + diff --git a/docs/docbook/smbdotconf/winbind/templateprimarygroup.xml b/docs/docbook/smbdotconf/winbind/templateprimarygroup.xml new file mode 100644 index 0000000000..bd59ea7ee0 --- /dev/null +++ b/docs/docbook/smbdotconf/winbind/templateprimarygroup.xml @@ -0,0 +1,14 @@ + + + This option defines the default primary group for + each user created by winbindd + 8's local account management + functions (similar to the 'add user script'). + + + Default: template primary group = nobody + + diff --git a/docs/docbook/smbdotconf/winbind/winbindenablelocalaccounts.xml b/docs/docbook/smbdotconf/winbind/winbindenablelocalaccounts.xml new file mode 100644 index 0000000000..f6e7cfb359 --- /dev/null +++ b/docs/docbook/smbdotconf/winbind/winbindenablelocalaccounts.xml @@ -0,0 +1,16 @@ + + + This parameter controls whether or not winbindd + will act as a stand in replacement for the various account + management hooks in smb.conf (e.g. 'add user script'). + If enabled, winbindd will support the creation of local + users and groups as another source of UNIX account information + available via getpwnam() or getgrgid(), etc... + + + Default: winbind enable local accounts = yes + + diff --git a/docs/docbook/smbdotconf/winbind/winbindtrusteddomainsonly.xml b/docs/docbook/smbdotconf/winbind/winbindtrusteddomainsonly.xml new file mode 100644 index 0000000000..bf383131d4 --- /dev/null +++ b/docs/docbook/smbdotconf/winbind/winbindtrusteddomainsonly.xml @@ -0,0 +1,16 @@ + + + This parameter is designed to allow Samba servers that + are members of a Samba controlled domain to use UNIX accounts + distributed vi NIS, rsync, or LDAP as the uid's for winbindd users + in the hosts primary domain. Therefore, the user 'SAMBA\user1' would + be mapped to the account 'user1' in /etc/passwd instead of allocating + a new uid for him or her. + + + Default: winbind trusted domains only = <no> + + diff --git a/docs/docbook/xslt/generate-attributions.xsl b/docs/docbook/xslt/generate-attributions.xsl new file mode 100644 index 0000000000..c781a77cc4 --- /dev/null +++ b/docs/docbook/xslt/generate-attributions.xsl @@ -0,0 +1,67 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + < + + + mailto: + + + + + > + + + + + ( + + ) + + + + + + + diff --git a/docs/htmldocs/AccessControls.html b/docs/htmldocs/AccessControls.html new file mode 100644 index 0000000000..044d347107 --- /dev/null +++ b/docs/htmldocs/AccessControls.html @@ -0,0 +1,660 @@ +Chapter 13. File, Directory and Share Access Controls
    Chapter 13. File, Directory and Share Access Controls
    Prev Part III. Advanced Configuration Next

    Chapter 13. File, Directory and Share Access Controls

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    May 10, 2003

    Table of Contents

    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with Unix File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and Unix Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask + parameters
    Interaction with the standard Samba file attribute + mapping
    Common Errors
    Users can not write to a public share
    I have set force user and Samba still makes root the owner of all the files + I touch!

    +Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of +resources shared via Samba do not behave in the manner they might expect. MS Windows network +administrators are often confused regarding network access controls and what is the best way to +provide users with the type of access they need while protecting resources from the consequences +of untoward access capabilities. +

    +Unix administrators frequently are not familiar with the MS Windows environment and in particular +have difficulty in visualizing what the MS Windows user wishes to achieve in attempts to set file +and directory access permissions. +

    +The problem lies in the differences in how file and directory permissions and controls work +between the two environments. This difference is one that Samba can not completely hide, even +though it does try to make the chasm transparent. +

    +POSIX Access Control List technology has been available (along with Extended Attributes) +for Unix for many years, yet there is little evidence today of any significant use. This +explains to some extent the slow adoption of ACLs into commercial Linux products. MS Windows +administrators are astounded at this given that ACLs were a foundational capability of the now +decade old MS Windows NT operating system. +

    +The purpose of this chapter is to present each of the points of control that are possible with +Samba-3 in the hope that this will help the network administrator to find the optimum method +for delivering the best environment for MS Windows desktop users. +

    +This is an opportune point to mention that it should be borne in mind that Samba was created to +provide a means of interoperability and interchange of data between two operating environments +that are quite different. It was never the intent to make Unix/Linux like MS Windows NT. Instead +the purpose was an is to provide a sufficient level of exchange of data between the two environments. +What is available today extends well beyond early plans and expectations, yet the gap continues to +shrink. +

    Features and Benefits

    + Samba offers a lot of flexibility in file system access management. These are the key access control + facilities present in Samba today: +

    Samba Access Control Facilities

    • + Unix File and Directory Permissions +

      + Samba honours and implements Unix file system access controls. Users + who access a Samba server will do so as a particular MS Windows user. + This information is passed to the Samba server as part of the logon or + connection setup process. Samba uses this user identity to validate + whether or not the user should be given access to file system resources + (files and directories). This chapter provides an overview for those + to whom the Unix permissions and controls are a little strange or unknown. +

    • + Samba Share Definitions +

      + In configuring share settings and controls in the smb.conf file + the network administrator can exercise over-rides to native file + system permissions and behaviours. This can be handy and convenient + to affect behaviour that is more like what MS Windows NT users expect + but it is seldom the best way to achieve this. + The basic options and techniques are described herein. +

    • + Samba Share ACLs +

      + Just like it is possible in MS Windows NT to set ACLs on shares + themselves, so it is possible to do this in Samba. + Very few people make use of this facility, yet it remains on of the + easiest ways to affect access controls (restrictions) and can often + do so with minimum invasiveness compared with other methods. +

    • + MS Windows ACLs through Unix POSIX ACLs +

      + The use of POSIX ACLs on Unix/Linux is possible ONLY if the underlying + operating system supports them. If not, then this option will not be + available to you. Current Unix technology platforms have native support + for POSIX ACLs. There are patches for the Linux kernel that provide + this also. Sadly, few Linux platforms ship today with native ACLs and + Extended Attributes enabled. This chapter has pertinent information + for users of platforms that support them. +

    File System Access Controls

    +Perhaps the most important recognition to be made is the simple fact that MS Windows NT4 / 200x / XP +implement a totally divergent file system technology from what is provided in the Unix operating system +environment. Firstly we should consider what the most significant differences are, then we shall look +at how Samba helps to bridge the differences. +

    MS Windows NTFS Comparison with Unix File Systems

    + Samba operates on top of the Unix file system. This means it is subject to Unix file system conventions + and permissions. It also means that if the MS Windows networking environment requires file system + behaviour that differs from unix file system behaviour then somehow Samba is responsible for emulating + that in a transparent and consistent manner. +

    + It is good news that Samba does this to a very large extent and on top of that provides a high degree + of optional configuration to over-ride the default behaviour. We will look at some of these over-rides, + but for the greater part we will stay within the bounds of default behaviour. Those wishing to explore + to depths of control ability should review the smb.conf man page. +

    File System Feature Comparison

    Name Space

    + MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, Unix file names + may be 1023 characters long. In MS Windows file extensions indicate particular file types, + in Unix this is not so rigorously observed as all names are considered arbitrary. +

    + What MS Windows calls a Folder, Unix calls a directory, +

    Case Sensitivity

    + MS Windows file names are generally Upper Case if made up of 8.3 (ie: 8 character file name + and 3 character extension. If longer than 8.3 file names are Case Preserving, and Case + Insensitive. +

    + Unix file and directory names are Case Sensitive and Case Preserving. Samba implements the + MS Windows file name behaviour, but it does so as a user application. The Unix file system + provides no mechanism to perform case insensitive file name lookups. MS Windows does this + by default. This means that Samba has to carry the processing overhead to provide features + that are NOT native to the Unix operating system environment. +

    + Consider the following, all are unique Unix names but one single MS Windows file name: + + MYFILE.TXT + MyFile.txt + myfile.txt + + So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in Unix + they can. So what should Samba do if all three are present? Answer, the one that is lexically + first will be accessible to MS Windows users, the others are invisible and unaccessible - any + other solution would be suicidal. +

    Directory Separators

    + MS Windows and DOS uses the back-slash '\' as a directory delimiter, Unix uses the forward-slash '/' + as it's directory delimiter. This is transparently handled by Samba. +

    Drive Identification

    + MS Windows products support a notion of drive letters, like C: to represent + disk partitions. Unix has NO concept if separate identifiers for file partitions since each + such file system is mounted to become part of the over-all directory tree. + The Unix directory tree begins at '/', just like the root of a DOS drive is specified like + C:\. +

    File Naming Conventions

    + MS Windows generally never experiences file names that begin with a '.', while in Unix these + are commonly found in a user's home directory. Files that begin with a '.' are typically + either start up files for various Unix applications, or they may be files that contain + start-up configuration data. +

    Links and Short-Cuts

    + MS Windows make use of "links and Short-Cuts" that are actually special types of files that will + redirect an attempt to execute the file to the real location of the file. Unix knows of file and directory + links, but they are entirely different from what MS Windows users are used to. +

    + Symbolic links are files in Unix that contain the actual location of the data (file OR directory). An + operation (like read or write) will operate directly on the file referenced. Symbolic links are also + referred to as 'soft links'. A hard link is something that MS Windows is NOT familiar with. It allows + one physical file to be known simultaneously by more than one file name. +

    + There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort + in the process of becoming familiar with Unix/Linux. These are best left for a text that is dedicated to the + purpose of Unix/Linux training/education. +

    Managing Directories

    + There are three basic operations for managing directories, create, delete, rename. +

    Table 13.1. Managing directories with unix and windows

    ActionMS Windows CommandUnix Command
    createmd foldermkdir folder
    deleterd folderrmdir folder
    renamerename oldname newnamemv oldname newname

    +

    File and Directory Access Control

    + The network administrator is strongly advised to read foundational training manuals and reference materials + regarding file and directory permissions maintenance. Much can be achieved with the basic Unix permissions + without having to resort to more complex facilities like POSIX Access Control Lists (ACLs) or Extended + Attributes (EAs). +

    + Unix/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. + A Unix file listing looks as follows:- + + 

    +	jht@frodo:~/stuff> ls -la
+	total 632
+	drwxr-xr-x   13 jht   users      816 2003-05-12 22:56 .
+	drwxr-xr-x   37 jht   users     3800 2003-05-12 22:29 ..
+	d---------    2 jht   users       48 2003-05-12 22:29 muchado00
+	d--x--x--x    2 jht   users       48 2003-05-12 22:29 muchado01
+	dr-xr-xr-x    2 jht   users       48 2003-05-12 22:29 muchado02
+	drwxrwxrwx    2 jht   users       48 2003-05-12 22:29 muchado03
+	drw-rw-rw-    2 jht   users       48 2003-05-12 22:29 muchado04
+	d-w--w--w-    2 jht   users       48 2003-05-12 22:29 muchado05
+	dr--r--r--    2 jht   users       48 2003-05-12 22:29 muchado06
+	drwxrwxrwt    2 jht   users       48 2003-05-12 22:29 muchado07
+	drwsrwsrwx    2 jht   users       48 2003-05-12 22:29 muchado08
+	----------    1 jht   users     1242 2003-05-12 22:31 mydata00.lst
+	---x--x--x    1 jht   users     1674 2003-05-12 22:33 mydata01.lst
+	--w--w--w-    1 jht   users     7754 2003-05-12 22:33 mydata02.lst
+	--wx-wx-wx    1 jht   users   260179 2003-05-12 22:33 mydata03.lst
+	-r--r--r--    1 jht   users    21017 2003-05-12 22:32 mydata04.lst
+	-r-xr-xr-x    1 jht   users   206339 2003-05-12 22:32 mydata05.lst
+	-rw-rw-rw-    1 jht   users    41105 2003-05-12 22:32 mydata06.lst
+	-rwxrwxrwx    1 jht   users    19312 2003-05-12 22:32 mydata07.lst
+	jht@frodo:~/stuff>
+

    +

    + The columns above represent (from left to right): permissions, no blocks used, owner, group, size (bytes), access date, access time, file name. +

    + The permissions field is made up of: + + 

    +	 JRV: Put this into a diagram of some sort
+	[ type  ] [ users ] [ group ] [ others ]   [File, Directory Permissions]
+	[ d | l ] [ r w x ] [ r w x ] [ r w x  ]
+	  |   |     | | |     | | |     | | |
+	  |   |     | | |     | | |     | | |-----> Can Execute, List files
+	  |   |     | | |     | | |     | |-------> Can Write,   Create files
+	  |   |     | | |     | | |     |---------> Can Read,    Read files
+	  |   |     | | |     | | |---------------> Can Execute, List files
+	  |   |     | | |     | |-----------------> Can Write,   Create files
+	  |   |     | | |     |-------------------> Can Read,    Read files
+	  |   |     | | |-------------------------> Can Execute, List files
+	  |   |     | |---------------------------> Can Write,   Create files
+	  |   |     |-----------------------------> Can Read,    Read files
+	  |   |-----------------------------------> Is a symbolic Link
+	  |---------------------------------------> Is a directory
+

    +

    + Any bit flag may be unset. An unset bit flag is the equivalent of 'Can NOT' and is represented as a '-' character. + +

    Example 13.1. Example File

    +		-rwxr-x---   Means: The owner (user) can read, write, execute
+		                    the group can read and execute
+		                    everyone else can NOT do anything with it
+

    + +

    + Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = Unix Domain Socket. +

    + The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x), + execute only if the file is a directory or already has execute permission for some user (X), set user or group ID on execution (s), + sticky (t). +

    + When the sticky bit is set on a directory, files in that directory may be unlinked (deleted) or renamed only by root or their owner. + Without the sticky bit, anyone able to write to the directory can delete or rename files. The sticky bit is commonly found on + directories, such as /tmp, that are world-writable. +

    + When the set user or group ID bit (s) is set on a directory, then all files created within it will be owned by the user and/or + group whose 'set user or group' bit is set. This can be very helpful in setting up directories that for which it is desired that + all users who are in a group should be able to write to and read from a file, particularly when it is undesirable for that file + to be exclusively owned by a user who's primary group is not the group that all such users belong to. +

    + When a directory is set drw-r----- this means that the owner can read and create (write) files in it, but because + the (x) execute flags are not set files can not be listed (seen) in the directory by anyone. The group can read files in the + directory but can NOT create new files. NOTE: If files in the directory are set to be readable and writable for the group, then + group members will be able to write to (or delete) them. +

    Share Definition Access Controls

    +The following parameters in the smb.conf file sections that define a share control or affect access controls. +Before using any of the following options please refer to the man page for smb.conf. +

    User and Group Based Controls

    + User and group based controls can prove very useful. In some situations it is distinctly desirable to affect all + file system operations as if a single user is doing this, the use of the force user and + force group behaviour will achieve this. In other situations it may be necessary to affect a + paranoia level of control to ensure that only particular authorised persons will be able to access a share or + it's contents, here the use of the valid users or the invalid users may + be most useful. +

    + As always, it is highly advisable to use the least difficult to maintain and the least ambiguous method for + controlling access. Remember, that when you leave the scene someone else will need to provide assistance and + if that person finds too great a mess, or if they do not understand what you have done then there is risk of + Samba being removed and an alternative solution being adopted. +

    Table 13.2. User and Group Based Controls

    Control ParameterDescription - Action - Notes
    admin users

    + List of users who will be granted administrative privileges on the share. + They will do all file operations as the super-user (root). + Any user in this list will be able to do anything they like on the share, + irrespective of file permissions. +

    force group

    + Specifies a UNIX group name that will be assigned as the default primary group + for all users connecting to this service. +

    force user

    + Specifies a UNIX user name that will be assigned as the default user for all users connecting to this service. + This is useful for sharing files. Incorrect use can cause security problems. +

    guest ok

    + If this parameter is set for a service, then no password is required to connect to the service. Privileges will be + those of the guest account. +

    invalid users

    + List of users that should not be allowed to login to this service. +

    only user

    + Controls whether connections with usernames not in the user list will be allowed. +

    read list

    + List of users that are given read-only access to a service. Users in this list + will not be given write access, no matter what the read only option is set to. +

    username

    + Refer to the smb.conf man page for more information - this is a complex and potentially misused parameter. +

    valid users

    + List of users that should be allowed to login to this service. +

    write list

    + List of users that are given read-write access to a service. +

    File and Directory Permissions Based Controls

    + The following file and directory permission based controls, if misused, can result in considerable difficulty to + diagnose the cause of mis-configuration. Use them sparingly and carefully. By gradually introducing each one by one + undesirable side-effects may be detected. In the event of a problem, always comment all of them out and then gradually + re-introduce them in a controlled fashion. +

    Table 13.3. File and Directory Permission Based Controls

    Control ParameterDescription - Action - Notes
    create mask

    + Refer to the smb.conf man page. +

    directory mask

    + The octal modes used when converting DOS modes to UNIX modes when creating UNIX directories. + See also: directory security mask. +

    dos filemode

    + Enabling this parameter allows a user who has write access to the file to modify the permissions on it. +

    force create mode

    + This parameter specifies a set of UNIX mode bit permissions that will always be set on a file created by Samba. +

    force directory mode

    + This parameter specifies a set of UNIX mode bit permissions that will always be set on a directory created by Samba. +

    force directory security mode

    + Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory +

    force security mode

    + Controls UNIX permission bits modified when a Windows NT client manipulates UNIX permissions. +

    hide unreadable

    + Prevents clients from seeing the existence of files that cannot be read. +

    hide unwriteable files

    + Prevents clients from seeing the existence of files that cannot be written to. Unwriteable directories are shown as usual. +

    nt acl support

    + This parameter controls whether smbd will attempt to map UNIX permissions into Windows NT access control lists. +

    security mask

    + Controls UNIX permission bits modified when a Windows NT client is manipulating the UNIX permissions on a file. +

    Miscellaneous Controls

    + The following are documented because of the prevalence of administrators creating inadvertant barriers to file + access by not understanding the full implications of smb.conf file settings. +

    Table 13.4. Other Controls

    Control ParameterDescription - Action - Notes
    case sensitive, default case, short preserve case

    + This means that all file name lookup will be done in a case sensitive manner. + Files will be created with the precise filename Samba received from the MS Windows client. +

    csc policy

    + Client Side Caching Policy - parallels MS Windows client side file caching capabilities. +

    dont descend

    + Allows to specify a comma-delimited list of directories that the server should always show as empty. +

    dos filetime resolution

    + This option is mainly used as a compatibility option for Visual C++ when used against Samba shares. +

    dos filetimes

    + DOS and Windows allows users to change file time stamps if they can write to the file. POSIX semantics prevent this. + This options allows DOS and Windows behaviour. +

    fake oplocks

    + Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an + oplock then the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. +

    hide dot files, hide files, veto files

    + Note: MS Windows Explorer allows over-ride of files marked as hidden so they will still be visible. +

    read only

    + If this parameter is yes, then users of a service may not create or modify files in the service's directory. +

    veto files

    + List of files and directories that are neither visible nor accessible. +

    Access Controls on Shares

    + This section deals with how to configure Samba per share access control restrictions. + By default, Samba sets no restrictions on the share itself. Restrictions on the share itself + can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can + connect to a share. In the absence of specific restrictions the default setting is to allow + the global user Everyone Full Control (ie: Full control, Change and Read). +

    + At this time Samba does NOT provide a tool for configuring access control setting on the Share + itself. Samba does have the capacity to store and act on access control settings, but the only + way to create those settings is to use either the NT4 Server Manager or the Windows 200x MMC for + Computer Management. +

    + Samba stores the per share access control settings in a file called share_info.tdb. + The location of this file on your system will depend on how samba was compiled. The default location + for Samba's tdb files is under /usr/local/samba/var. If the tdbdump + utility has been compiled and installed on your system, then you can examine the contents of this file + by: tdbdump share_info.tdb. +

    Share Permissions Management

    + The best tool for the task is platform dependant. Choose the best tool for your environment. +

    Windows NT4 Workstation/Server

    + The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. + Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. + You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below. +

    Procedure 13.1. Instructions

    1. + Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu + select Computer, then click on the Shared Directories entry. +

    2. + Now click on the share that you wish to manage, then click on the Properties tab, next click on + the Permissions tab. Now you can add or change access control settings as you wish. +

    Windows 200x/XP

    + On MS Windows NT4/200x/XP system access control lists on the share itself are set using native + tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder, + then select Sharing, then click on Permissions. The default + Windows NT4/200x permission allows Everyone Full Control on the Share. +

    + MS Windows 200x and later all comes with a tool called the Computer Management snap-in for the + Microsoft Management Console (MMC). This tool is located by clicking on Control Panel -> + Administrative Tools -> Computer Management. +

    Procedure 13.2. Instructions

    1. + After launching the MMC with the Computer Management snap-in, click on the menu item Action, + select Connect to another computer. If you are not logged onto a domain you will be prompted + to enter a domain login user identifier and a password. This will authenticate you to the domain. + If you where already logged in with administrative privilege this step is not offered. +

    2. + If the Samba server is not shown in the Select Computer box, then type in the name of the target + Samba server in the field Name:. Now click on the [+] next to + System Tools, then on the [+] next to Shared Folders in the + left panel. +

    3. + Now in the right panel, double-click on the share you wish to set access control permissions on. + Then click on the tab Share Permissions. It is now possible to add access control entities + to the shared folder. Do NOT forget to set what type of access (full control, change, read) you + wish to assign for each entry. +

    Warning

    + Be careful. If you take away all permissions from the Everyone user without removing this user + then effectively no user will be able to access the share. This is a result of what is known as + ACL precedence. ie: Everyone with no access means that MaryK who is part of the group + Everyone will have no access even if this user is given explicit full control access. +

    MS Windows Access Control Lists and Unix Interoperability

    Managing UNIX permissions Using NT Security Dialogs

    Windows NT clients can use their native security settings + dialog box to view and modify the underlying UNIX permissions.

    Note that this ability is careful not to compromise + the security of the UNIX host Samba is running on, and + still obeys all the file permission rules that a Samba + administrator can set.

    Note

    + All access to Unix/Linux system file via Samba is controlled at + the operating system file access control level. When trying to + figure out file access problems it is vitally important to identify + the identity of the Windows user as it is presented by Samba at + the point of file access. This can best be determined from the + Samba log files. +

    Viewing File Security on a Samba Share

    From an NT4/2000/XP client, single-click with the right + mouse button on any file or directory in a Samba mounted + drive letter or UNC path. When the menu pops-up, click + on the Properties entry at the bottom of + the menu. This brings up the file properties dialog + box. Click on the tab Security and you + will see three buttons, Permissions, + Auditing, and Ownership. + The Auditing button will cause either + an error message A requested privilege is not held + by the client to appear if the user is not the + NT Administrator, or a dialog which is intended to allow an + Administrator to add auditing requirements to a file if the + user is logged on as the NT Administrator. This dialog is + non-functional with a Samba share at this time, as the only + useful button, the Add button will not currently + allow a list of users to be seen.

    Viewing file ownership

    Clicking on the Ownership button + brings up a dialog box telling you who owns the given file. The + owner name will be of the form :

    "SERVER\user (Long name)"

    Where SERVER is the NetBIOS name of + the Samba server, user is the user name of + the UNIX user who owns the file, and (Long name) + is the descriptive string identifying the user (normally found in the + GECOS field of the UNIX password database). Click on the + Close button to remove this dialog.

    If the parameter nt acl support + is set to false then the file owner will + be shown as the NT user "Everyone".

    The Take Ownership button will not allow + you to change the ownership of this file to yourself (clicking on + it will display a dialog box complaining that the user you are + currently logged onto the NT client cannot be found). The reason + for this is that changing the ownership of a file is a privileged + operation in UNIX, available only to the root + user. As clicking on this button causes NT to attempt to change + the ownership of a file to the current user logged into the NT + client this will not work with Samba at this time.

    There is an NT chown command that will work with Samba + and allow a user with Administrator privilege connected + to a Samba server as root to change the ownership of + files on both a local NTFS filesystem or remote mounted NTFS + or Samba drive. This is available as part of the Seclib + NT security library written by Jeremy Allison of + the Samba Team, available from the main Samba ftp site.

    Viewing File or Directory Permissions

    The third button is the Permissions + button. Clicking on this brings up a dialog box that shows both + the permissions and the UNIX owner of the file or directory. + The owner is displayed in the form :

    "SERVER\ + user + (Long name)"

    Where SERVER is the NetBIOS name of + the Samba server, user is the user name of + the UNIX user who owns the file, and (Long name) + is the descriptive string identifying the user (normally found in the + GECOS field of the UNIX password database).

    If the parameter nt acl support + is set to false then the file owner will + be shown as the NT user "Everyone" and the + permissions will be shown as NT "Full Control".

    The permissions field is displayed differently for files + and directories, so I'll describe the way file permissions + are displayed first.

    File Permissions

    The standard UNIX user/group/world triplet and + the corresponding "read", "write", "execute" permissions + triplets are mapped by Samba into a three element NT ACL + with the 'r', 'w', and 'x' bits mapped into the corresponding + NT permissions. The UNIX world permissions are mapped into + the global NT group Everyone, followed + by the list of permissions allowed for UNIX world. The UNIX + owner and group permissions are displayed as an NT + user icon and an NT local + group icon respectively followed by the list + of permissions allowed for the UNIX user and group.

    As many UNIX permission sets don't map into common + NT names such as read, + "change" or full control then + usually the permissions will be prefixed by the words + "Special Access" in the NT display list.

    But what happens if the file has no permissions allowed + for a particular UNIX user group or world component ? In order + to allow "no permissions" to be seen and modified then Samba + overloads the NT "Take Ownership" ACL attribute + (which has no meaning in UNIX) and reports a component with + no permissions as having the NT "O" bit set. + This was chosen of course to make it look like a zero, meaning + zero permissions. More details on the decision behind this will + be given below.

    Directory Permissions

    Directories on an NT NTFS file system have two + different sets of permissions. The first set of permissions + is the ACL set on the directory itself, this is usually displayed + in the first set of parentheses in the normal "RW" + NT style. This first set of permissions is created by Samba in + exactly the same way as normal file permissions are, described + above, and is displayed in the same way.

    The second set of directory permissions has no real meaning + in the UNIX permissions world and represents the + inherited permissions that any file created within + this directory would inherit.

    Samba synthesises these inherited permissions for NT by + returning as an NT ACL the UNIX permission mode that a new file + created by Samba on this share would receive.

    Modifying file or directory permissions

    Modifying file and directory permissions is as simple + as changing the displayed permissions in the dialog box, and + clicking the OK button. However, there are + limitations that a user needs to be aware of, and also interactions + with the standard Samba permission masks and mapping of DOS + attributes that need to also be taken into account.

    If the parameter nt acl support + is set to false then any attempt to set + security permissions will fail with an "Access Denied" + message.

    The first thing to note is that the "Add" + button will not return a list of users in Samba (it will give + an error message of The remote procedure call failed + and did not execute). This means that you can only + manipulate the current user/group/world permissions listed in + the dialog box. This actually works quite well as these are the + only permissions that UNIX actually has.

    If a permission triplet (either user, group, or world) + is removed from the list of permissions in the NT dialog box, + then when the OK button is pressed it will + be applied as "no permissions" on the UNIX side. If you then + view the permissions again the "no permissions" entry will appear + as the NT "O" flag, as described above. This + allows you to add permissions back to a file or directory once + you have removed them from a triplet component.

    As UNIX supports only the "r", "w" and "x" bits of + an NT ACL then if other NT security attributes such as "Delete + access" are selected then they will be ignored when applied on + the Samba server.

    When setting permissions on a directory the second + set of permissions (in the second set of parentheses) is + by default applied to all files within that directory. If this + is not what you want you must uncheck the Replace + permissions on existing files checkbox in the NT + dialog before clicking OK.

    If you wish to remove all permissions from a + user/group/world component then you may either highlight the + component and click the Remove button, + or set the component to only have the special Take + Ownership permission (displayed as "O" + ) highlighted.

    Interaction with the standard Samba create mask + parameters

    There are four parameters + to control interaction with the standard Samba create mask parameters. + These are : + +

    security mask
    force security mode
    directory security mask
    force directory security mode

    + +

    Once a user clicks OK to apply the + permissions Samba maps the given permissions into a user/group/world + r/w/x triplet set, and then will check the changed permissions for a + file against the bits set in the + security mask parameter. Any bits that + were changed that are not set to '1' in this parameter are left alone + in the file permissions.

    Essentially, zero bits in the security mask + mask may be treated as a set of bits the user is not + allowed to change, and one bits are those the user is allowed to change. +

    If not set explicitly this parameter is set to the same value as + the create mask + parameter. To allow a user to modify all the + user/group/world permissions on a file, set this parameter + to 0777.

    Next Samba checks the changed permissions for a file against + the bits set in the + force security mode parameter. Any bits + that were changed that correspond to bits set to '1' in this parameter + are forced to be set.

    Essentially, bits set in the force security mode + parameter may be treated as a set of bits that, when + modifying security on a file, the user has always set to be 'on'.

    If not set explicitly this parameter is set to the same value + as the force + create mode parameter. + To allow a user to modify all the user/group/world permissions on a file + with no restrictions set this parameter to 000.

    The security mask and force + security mode parameters are applied to the change + request in that order.

    For a directory Samba will perform the same operations as + described above for a file except using the parameter + directory security mask instead of security + mask, and force directory security mode + parameter instead of force security mode + .

    The directory security mask parameter + by default is set to the same value as the directory mask + parameter and the force directory security + mode parameter by default is set to the same value as + the force directory mode parameter.

    In this way Samba enforces the permission restrictions that + an administrator can set on a Samba share, whilst still allowing users + to modify the permission bits within that restriction.

    If you want to set up a share that allows users full control + in modifying the permission bits on their files and directories and + doesn't force any particular bits to be set 'on', then set the following + parameters in the smb.conf file in that share specific section : +

    security mask = 0777
    force security mode = 0
    directory security mask = 0777
    force directory security mode = 0

    Interaction with the standard Samba file attribute + mapping

    Samba maps some of the DOS attribute bits (such as "read + only") into the UNIX permissions of a file. This means there can + be a conflict between the permission bits set via the security + dialog and the permission bits set by the file attribute mapping. +

    One way this can show up is if a file has no UNIX read access + for the owner it will show up as "read only" in the standard + file attributes tabbed dialog. Unfortunately this dialog is + the same one that contains the security info in another tab.

    What this can mean is that if the owner changes the permissions + to allow themselves read access using the security dialog, clicks + OK to get back to the standard attributes tab + dialog, and then clicks OK on that dialog, then + NT will set the file permissions back to read-only (as that is what + the attributes still say in the dialog). This means that after setting + permissions and clicking OK to get back to the + attributes dialog you should always hit Cancel + rather than OK to ensure that your changes + are not overridden.

    Common Errors

    +File, Directory and Share access problems are very common on the mailing list. The following +are examples taken from the mailing list in recent times. +

    Users can not write to a public share

    + “ + We are facing some troubles with file / directory permissions. I can log on the domain as admin user(root), + and there's a public share, on which everyone needs to have permission to create / modify files, but only + root can change the file, no one else can. We need to constantly go to server to + chgrp -R users * and chown -R nobody * to allow others users to change the file. + ” +

    + There are many ways to solve this problem, here are a few hints: +

    Procedure 13.3. Example Solution:

    1. + Go to the top of the directory that is shared +

    2. + Set the ownership to what ever public owner and group you want + 

      +			find 'directory_name' -type d -exec chown user.group {}\;
+			find 'directory_name' -type d -exec chmod 6775 'directory_name'
+			find 'directory_name' -type f -exec chmod 0775 {} \;
+			find 'directory_name' -type f -exec chown user.group {}\;
+

      +

      Note

      + The above will set the 'sticky bit' on all directories. Read your + Unix/Linux man page on what that does. It causes the OS to assign + to all files created in the directories the ownership of the + directory. +

    3. + + Directory is: /foodbar + 

      +				$ chown jack.engr /foodbar
+

      +

      Note

      +

      This is the same as doing:

      + 

      +					$ chown jack /foodbar
+					$ chgrp engr /foodbar
+

      +

    4. Now do: + + 

      +				$ chmod 6775 /foodbar
+				$ ls -al /foodbar/..
+

      + +

      You should see: + 

      +				drwsrwsr-x  2 jack  engr    48 2003-02-04 09:55 foodbar
+

      +

    5. Now do: + 

      +				$ su - jill
+				$ cd /foodbar
+				$ touch Afile
+				$ ls -al
+

      +

      + You should see that the file Afile created by Jill will have ownership + and permissions of Jack, as follows: + 

      +		-rw-r--r--  1 jack  engr     0 2003-02-04 09:57 Afile
+

      +

    6. + Now in your smb.conf for the share add: + 

      +		force create mode = 0775
+		force directory mode = 6775
+

      +

      Note

      + The above are only needed if your users are not members of the group + you have used. ie: Within the OS do not have write permission on the directory. +

      + An alternative is to set in the smb.conf entry for the share: + 

      +		force user = jack
+		force group = engr
+

      +

    I have set force user and Samba still makes root the owner of all the files + I touch!

    + When you have a user in 'admin users', Samba will always do file operations for + this user as root, even if force user has been set. +

    Prev Up Next
    Chapter 12. Mapping MS Windows and Unix Groups Home Chapter 14. File and Record Locking
    diff --git a/docs/htmldocs/AdvancedNetworkManagement.html b/docs/htmldocs/AdvancedNetworkManagement.html new file mode 100644 index 0000000000..296c684e24 --- /dev/null +++ b/docs/htmldocs/AdvancedNetworkManagement.html @@ -0,0 +1,224 @@ +Chapter 22. Advanced Network Management
    Chapter 22. Advanced Network Management
    Prev Part III. Advanced Configuration Next

    Chapter 22. Advanced Network Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors

    +This section documents peripheral issues that are of great importance to network +administrators who want to improve network resource access control, to automate the user +environment, and to make their lives a little easier. +

    Features and Benefits

    +Often the difference between a working network environment and a well appreciated one can +best be measured by the little things that makes everything work more +harmoniously. A key part of every network environment solution is the ability to remotely +manage MS Windows workstations, to remotely access the Samba server, to provide customised +logon scripts, as well as other house keeping activities that help to sustain more reliable +network operations. +

    +This chapter presents information on each of these area. They are placed here, and not in +other chapters, for ease of reference. +

    Remote Server Administration

    +How do I get 'User Manager' and 'Server Manager'? +

    + Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains', +the 'Server Manager'? +

    +Microsoft distributes a version of these tools called nexus for installation +on Windows 9x / Me systems. The tools set includes: +

    Server Manager
    User Manager for Domains
    Event Viewer

    +Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE +

    +The Windows NT 4.0 version of the 'User Manager for +Domains' and 'Server Manager' are available from Microsoft via ftp +from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE +

    Remote Desktop Management

    +There are a number of possible remote desktop management solutions that range from free +through costly. Do not let that put you off. Sometimes the most costly solutions is the +most cost effective. In any case, you will need to draw your own conclusions as to which +is the best tool in your network environment. +

    Remote Management from NoMachines.Com

    + The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003. + It is presented in slightly edited form (with author details omitted for privacy reasons). + The entire answer is reproduced below with some comments removed. +

    +

    +> I have a wonderful linux/samba server running as PDC for a network.
+> Now I would like to add remote desktop capabilities so that
+> users outside could login to the system and get their desktop up from
+> home or another country..
+>
+> Is there a way to accomplish this? Do I need a windows terminal server?
+> Do I need to configure it so that it is a member of the domain or a
+> BDC,PDC? Are there any hacks for MS Windows XP to enable remote login
+> even if the computer is in a domain?
+>
+> Any ideas/experience would be appreciated :)
+

    +

    + Answer provided: Check out the new offer from NoMachine, "NX" software: + http://www.nomachine.com/. +

    + It implements a very easy-to-use interface to the remote X protocol as + well as incorporating VNC/RFB and rdesktop/RDP into it, but at a speed + performance much better than anything you may have ever seen... +

    + Remote X is not new at all -- but what they did achieve successfully is + a new way of compression and caching technologies which makes the thing + fast enough to run even over slow modem/ISDN connections. +

    + I could test drive their (public) RedHat machine in Italy, over a loaded + internet connection, with enabled thumbnail previews in KDE konqueror + which popped up immediately on "mouse-over". From inside that (remote X) + session I started a rdesktop session on another, a Windows XP machine. + To test the performance, I played Pinball. I am proud to announce here + that my score was 631750 points at first try... +

    + NX performs better on my local LAN than any of the other "pure" + connection methods I am using from time to time: TightVNC, rdesktop or + remote X. It is even faster than a direct crosslink connection between + two nodes. +

    + I even got sound playing from the remote X app to my local boxes, and + had a working "copy'n'paste" from an NX window (running a KDE session + in Italy) to my Mozilla mailing agent... These guys are certainly doing + something right! +

    + I recommend to test drive NX to anybody with a only a remote interest + in remote computing + http://www.nomachine.com/testdrive.php. +

    + Just download the free of charge client software (available for RedHat, + SuSE, Debian and Windows) and be up and running within 5 minutes (they + need to send you your account data, though, because you are assigned + a real Unix account on their testdrive.nomachine.com box... +

    + They plan to get to the point were you can have NX application servers + running as a cluster of nodes, and users simply start an NX session locally, + and can select applications to run transparently (apps may even run on + another NX node, but pretend to be on the same as used for initial login, + because it displays in the same window.... well, you also can run it + fullscreen, and after a short time you forget that it is a remote session + at all). +

    + Now the best thing at the end: all the core compression and caching + technologies are released under the GPL and available as source code + to anybody who wants to build on it! These technologies are working, + albeit started from the command line only (and very inconvenient to + use in order to get a fully running remote X session up and running....) +

    + To answer your questions: +

    • + You don't need to install a terminal server; XP has RDP support built in. +

    • + NX is much cheaper than Citrix -- and comparable in performance, probably faster +

    • + You don't need to hack XP -- it just works +

    • + You log into the XP box from remote transparently (and I think there is no + need to change anything to get a connection, even if authentication is against a domain) +

    • + The NX core technologies are all Open Source and released under the GPL -- + you can today use a (very inconvenient) commandline to use it at no cost, + but you can buy a comfortable (proprietary) NX GUI frontend for money +

    • + NoMachine are encouraging and offering help to OSS/Free Software implementations + for such a frontend too, even if it means competition to them (they have written + to this effect even to the LTSP, KDE and GNOME developer mailing lists) +

    Network Logon Script Magic

    +This section needs work. Volunteer contributions most welcome. Please send your patches or updates +to John Terpstra. +

    +There are several opportunities for creating a custom network startup configuration environment. +

    No Logon Script
    Simple universal Logon Script that applies to all users
    Use of a conditional Logon Script that applies per user or per group attributes
    Use of Samba's Preexec and Postexec functions on access to the NETLOGON share to create + a custom Logon Script and then execute it.
    User of a tool such as KixStart

    +The Samba source code tree includes two logon script generation/execution tools. +See examples directory genlogon and +ntlogon subdirectories. +

    +The following listings are from the genlogon directory. +

    +This is the genlogon.pl file: + +

    +	#!/usr/bin/perl
+	#
+	# genlogon.pl
+	#
+	# Perl script to generate user logon scripts on the fly, when users
+	# connect from a Windows client.  This script should be called from smb.conf
+	# with the %U, %G and %L parameters. I.e:
+	#
+	#       root preexec = genlogon.pl %U %G %L
+	#
+	# The script generated will perform
+	# the following:
+	#
+	# 1. Log the user connection to /var/log/samba/netlogon.log
+	# 2. Set the PC's time to the Linux server time (which is maintained
+	#    daily to the National Institute of Standard's Atomic clock on the
+	#    internet.
+	# 3. Connect the user's home drive to H: (H for Home).
+	# 4. Connect common drives that everyone uses.
+	# 5. Connect group-specific drives for certain user groups.
+	# 6. Connect user-specific drives for certain users.
+	# 7. Connect network printers.
+
+	# Log client connection
+	#($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
+	($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
+	open LOG, ">>/var/log/samba/netlogon.log";
+	print LOG "$mon/$mday/$year $hour:$min:$sec - User $ARGV[0] logged into $ARGV[1]\n";
+	close LOG;
+
+	# Start generating logon script
+	open LOGON, ">/shared/netlogon/$ARGV[0].bat";
+	print LOGON "\@ECHO OFF\r\n";
+
+	# Connect shares just use by Software Development group
+	if ($ARGV[1] eq "SOFTDEV" || $ARGV[0] eq "softdev")
+	{
+		print LOGON "NET USE M: \\\\$ARGV[2]\\SOURCE\r\n";
+	}
+
+	# Connect shares just use by Technical Support staff
+	if ($ARGV[1] eq "SUPPORT" || $ARGV[0] eq "support")
+	{
+		print LOGON "NET USE S: \\\\$ARGV[2]\\SUPPORT\r\n";
+	}
+
+	# Connect shares just used by Administration staff
+	If ($ARGV[1] eq "ADMIN" || $ARGV[0] eq "admin")
+	{
+		print LOGON "NET USE L: \\\\$ARGV[2]\\ADMIN\r\n";
+		print LOGON "NET USE K: \\\\$ARGV[2]\\MKTING\r\n";
+	}
+
+	# Now connect Printers.  We handle just two or three users a little
+	# differently, because they are the exceptions that have desktop
+	# printers on LPT1: - all other user's go to the LaserJet on the
+	# server.
+	if ($ARGV[0] eq 'jim'
+	    || $ARGV[0] eq 'yvonne')
+	{
+		print LOGON "NET USE LPT2: \\\\$ARGV[2]\\LJET3\r\n";
+		print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
+	}
+	else
+	{
+		print LOGON "NET USE LPT1: \\\\$ARGV[2]\\LJET3\r\n";
+		print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
+	}
+
+	# All done! Close the output file.
+	close LOGON;
+

    +

    +Those wishing to use more elaborate or capable logon processing system should check out the following sites: +

    http://www.craigelachie.org/rhacer/ntlogon
    http://www.kixtart.org
    http://support.microsoft.com/default.asp?scid=kb;en-us;189105

    Adding printers without user intervention

    +Printers may be added automatically during logon script processing through the use of: + +

    +	rundll32 printui.dll,PrintUIEntry /?
+

    + +See the documentation in the Microsoft knowledgebase article no: 189105. +

    Common Errors

    +The information provided in this chapter has been reproduced from postings on the samba@samba.org +mailing list. No implied endorsement or recommendation is offered. Administrators should conduct +their own evaluation of alternatives and are encouraged to draw their own conclusions. +

    Prev Up Next
    Chapter 21. Integrated Logon Support using Winbind Home Chapter 23. System and Account Policies
    diff --git a/docs/htmldocs/Appendixes.html b/docs/htmldocs/Appendixes.html new file mode 100644 index 0000000000..854437acde --- /dev/null +++ b/docs/htmldocs/Appendixes.html @@ -0,0 +1,4 @@ +Part VI. Appendixes
    Part VI. Appendixes
    Prev   Next

    Appendixes

    Table of Contents

    36. How to compile SAMBA
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    Common Errors
    37. Portability
    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba?
    How do I get printer driver download working + for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Books
    Prev Up Next
    Chapter 35. Reporting Bugs Home Chapter 36. How to compile SAMBA
    diff --git a/docs/htmldocs/Backup.html b/docs/htmldocs/Backup.html new file mode 100644 index 0000000000..9fac452023 --- /dev/null +++ b/docs/htmldocs/Backup.html @@ -0,0 +1,13 @@ +Chapter 28. Samba Backup Techniques
    Chapter 28. Samba Backup Techniques
    Prev Part III. Advanced Configuration Next

    Chapter 28. Samba Backup Techniques

    John H. Terpstra

    Samba Team

    Table of Contents

    Note
    Features and Benefits

    Note

    +This chapter did not make it into this release. +It is planned for the published release of this document. +If you have something to contribute for this section please email it to +jht@samba.org/ +

    Features and Benefits

    +We need feedback from people who are backing up samba servers. +We would like to know what software tools you are using to backup +your samba server/s. +

    +In particular, if you have any success and / or failure stories you could +share with other users this would be appreciated. +

    Prev Up Next
    Chapter 27. Unicode/Charsets Home Chapter 29. High Availability Options
    diff --git a/docs/htmldocs/CUPS-printing.html b/docs/htmldocs/CUPS-printing.html new file mode 100644 index 0000000000..46ca8e15f7 --- /dev/null +++ b/docs/htmldocs/CUPS-printing.html @@ -0,0 +1,3733 @@ +Chapter 19. CUPS Printing Support in Samba 3.0
    Chapter 19. CUPS Printing Support in Samba 3.0
    Prev Part III. Advanced Configuration Next

    Chapter 19. CUPS Printing Support in Samba 3.0

    Kurt Pfeifle

    Danka Deutschland GmbH

    Ciprian Vizitiu

    drawings

    (3 June 2003)

    Table of Contents

    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for +CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for +application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download
    GDI on Windows -- PostScript on Unix
    Windows Drivers, GDI and EMF
    Unix Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and +native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many +Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel +Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for +cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Caveats to be considered
    What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver?
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsm completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the +Client
    Installing PostScript Driver Files manually (using +rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Commandline Driver Installation in 15 little Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    When not to use Samba to print to +CUPS
    In Case of Trouble.....
    Where to find Documentation
    How to ask for Help
    Where to find Help
    Appendix
    Printing from CUPS to Windows attached +Printers
    More CUPS filtering Chains
    Trouble Shooting Guidelines to fix typical Samba printing +Problems
    An Overview of the CUPS Printing Processes

    Introduction

    Features and Benefits

    + The Common Unix Print System (CUPS) has become very popular. All + big Linux distributions now ship it as their default printing + system. But to many it is still a very mystical tool. Normally it + "just works" (TM). People tend to regard it as a sort of "black box", + which they don't want to look into, as long as it works OK. But once + there is a little problem, they are in trouble to find out where to + start debugging it. Also, even the most recent and otherwise excellent + printed Samba documentation has only limited attention paid to CUPS + printing, leaving out important pieces or even writing plain wrong + things about it. This demands rectification. But before you dive into + this chapter, make sure that you don't forget to refer to the + "Classical Printing" chapter also. It contains a lot of information + that is relevant for CUPS too. +

    + CUPS sports quite a few unique and powerful features. While their + basic functions may be grasped quite easily, they are also + new. Because they are different from other, more traditional printing + systems, it is best to try and not apply any prior knowledge about + printing upon this new system. Rather try to start understand CUPS + from the beginning. This documentation will lead you here to a + complete understanding of CUPS, if you study all of the material + contained. But lets start with the most basic things first. Maybe this + is all you need for now. Then you can skip most of the other + paragraphs. +

    Overview

    + CUPS is more than just a print spooling system. It is a complete + printer management system that complies with the new IPP + (Internet Printing Protocol). IPP is an industry + and IETF (Internet Engineering Task Force) + standard for network printing. Many of its functions can be managed + remotely (or locally) via a web browser (giving you a + platform-independent access to the CUPS print server). In addition it + has the traditional commandline and several more modern GUI interfaces + (GUI interfaces developed by 3rd parties, like KDE's + overwhelming KDEPrint). +

    + CUPS allows creation of "raw" printers (ie: NO print file + format translation) as well as "smart" printers (i.e. CUPS does + file format conversion as required for the printer). In many ways + this gives CUPS similar capabilities to the MS Windows print + monitoring system. Of course, if you are a CUPS advocate, you would + argue that CUPS is better! In any case, let us now move on to + explore how one may configure CUPS for interfacing with MS Windows + print clients via Samba. +

    Basic Configuration of CUPS support

    + Printing with CUPS in the most basic smb.conf + setup in Samba 3.0 (as was true for 2.2.x) only needs two + settings: printing = cups and printcap + = cups. CUPS itself doesn't need a printcap file + anymore. However, the cupsd.conf configuration + file knows two related directives: they control if such a file should + be automatically created and maintained by CUPS for the convenience of + third party applications (example: Printcap + /etc/printcap and PrintcapFormat + BSD). These legacy programs often require the existence of + printcap file containing printernames or they will refuse to + print. Make sure CUPS is set to generate and maintain a printcap! For + details see man cupsd.conf and other CUPS-related + documentation, like the wealth of documents on your CUPS server + itself: http://localhost:631/documentation.html. +

    Linking of smbd with libcups.so

    + Samba has a very special relationship to CUPS. The reason is: Samba + can be compiled with CUPS library support. Most recent installations + have this support enabled, and per default CUPS linking is compiled + into smbd and other Samba binaries. Of course, you can use CUPS even + if Samba is not linked against libcups.so -- but + there are some differences in required or supported configuration + then. +

    + If SAMBA is compiled against libcups, then printcap = + cups uses the CUPS API to list printers, submit jobs, + query queues, etc. Otherwise it maps to the System V commands with an + additional -oraw option for printing. On a Linux + system, you can use the ldd utility to find out + details (ldd may not be present on other OS platforms, or its function + may be embodied by a different command): + 

    +				transmeta:/home/kurt # ldd `which smbd`
+				libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000)
+				libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000)
+				libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000)
+				[....]
+

    + The line libcups.so.2 => /usr/lib/libcups.so.2 + (0x40123000) shows there is CUPS support compiled + into this version of Samba. If this is the case, and printing = cups + is set, then any otherwise manually set print command in + smb.conf is ignored. This is an + important point to remember! +

    Tip

    Should you require -- for any reason -- to set your own + print commands, you can still do this by setting printing = + sysv. However, you'll loose all the benefits from the + close CUPS/Samba integration. You are on your own then to manually + configure the rest of the printing system commands (most important: + print command; other commands are + lppause command, lpresume command, lpq command, lprm + command, queuepause command and queue resume + command).

    Simple smb.conf Settings for CUPS

    + To summarize, here is the simplest printing-related setup + for smb.conf to enable basic CUPS support: + 

    +
+				[global]
+				load printers = yes
+				printing = cups
+				printcap name = cups
+
+				[printers]
+				comment = All Printers
+				path = /var/spool/samba
+				browseable = no
+				public = yes
+				guest ok = yes
+				writable = no
+				printable = yes
+				printer admin = root, @ntadmins
+
+

    + This is all you need for basic printing setup for CUPS. It will print + all Graphic, Text, PDF and PostScript file submitted from Windows + clients. However, most of your Windows users would not know how to + send these kind of files to print without opening a GUI + application. Windows clients tend to have local printer drivers + installed. And the GUI application's print buttons start a printer + driver. Your users also very rarely send files from the command + line. Unlike UNIX clients, they hardly submit graphic, text or PDF + formatted files directly to the spooler. They nearly exclusively print + from GUI applications, with a "printer driver" hooked in between the + applications native format and the print data stream. If the backend + printer is not a PostScript device, the print data stream is "binary", + sensible only for the target printer. Read on to learn which problem + this may cause and how to avoid it. +

    More complex smb.conf Settings for +CUPS

    +Here is a slightly more complex printing-related setup +for smb.conf. It enables general CUPS printing +support for all printers, but defines one printer share which is set +up differently. +

    +
+ [global]
+         printing = cups
+         printcap name = cups
+         load printers = yes
+
+ [printers]
+         comment = All Printers
+         path = /var/spool/samba
+         public = yes
+         guest ok = yes
+         writable = no
+         printable = yes
+         printer admin = root, @ntadmins
+ 
+ [special_printer]
+         comment = A special printer with his own settings
+         path = /var/spool/samba-special
+         printing = sysv
+         printcap = lpstat
+         print command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ;\
+                         echo "     `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ;\
+                         echo "     `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log :\
+                         rm %f
+         public = no
+         guest ok = no
+         writeable = no
+         printable = yes
+         printer admin = kurt
+         hosts deny = 0.0.0.0
+         hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60
+
+

    +This special share is only there for my testing purposes. It doesn't +even write the print job to a file. It just logs the job parameters +known to Samba into the /tmp/smbprn.log file and +deletes the jobfile. Moreover, the printer +admin of this share is "kurt" (not the "@ntadmins" group); +guest access is not allowed; the share isn't announced in Network +Neighbourhood (so you need to know it is there), and it is only +allowing access from three hosts. To prevent CUPS kicking in and +taking over the print jobs for that share, we need to set +printing = sysv and printcap = +lpstat. +

    Advanced Configuration

    +Before we dive into all the configuration options, let's clarify a few +points. Network printing needs to be organized and setup +correctly. Often this is not done correctly. Legacy systems +or small LANs in business environments often lack a clear design and +good housekeeping. +

    Central spooling vs. "Peer-to-Peer" printing

    +Many small office or home networks, as well as badly organized larger +environments, allow each client a direct access to available network +printers. Generally, this is a bad idea. It often blocks one client's +access to the printer when another client's job is printing. It also +might freeze the first client's application while it is waiting to get +rid of the job. Also, there are frequent complaints about various jobs +being printed with their pages mixed with each other. A better concept +is the usage of a "print server": it routes all jobs through one +central system, which responds immediately, takes jobs from multiple +concurrent clients at the same time and in turn transfers them to the +printer(s) in the correct order. +

    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients

    +Most traditionally configured Unix print servers acting on behalf of +Samba's Windows clients represented a really simple setup. Their only +task was to manage the "raw" spooling of all jobs handed to them by +Samba. This approach meant that the Windows clients were expected to +prepare the print job file in such a way that it became fit to be fed to +the printing device. Here a native (vendor-supplied) Windows printer +driver for the target device needed to be installed on each and every +client. +

    +Of course you can setup CUPS, Samba and your Windows clients in the +same, traditional and simple way. When CUPS printers are configured +for RAW print-through mode operation it is the responsibility of the +Samba client to fully render the print job (file). The file must be +sent in a format that is suitable for direct delivery to the +printer. Clients need to run the vendor-provided drivers to do +this. In this case CUPS will NOT do any print file format conversion +work. +

    Driver Installation Methods on Windows Clients

    +The printer drivers on the Windows clients may be installed +in two functionally different ways: +

    • manually install the drivers locally on each client, +one by one; this yields the old LanMan style +printing; it uses a \\sambaserver\printershare +type of connection.

    • deposit and prepare the drivers (for later download) on +the print server (Samba); this enables the clients to use +"Point'n'Print" to get drivers semi-automatically installed the +first time they access the printer; with this method NT/2K/XP +clients use the SPOOLSS/MS-RPC +type printing calls.

    +The second method is recommended for use over the first. +

    Explicitly enable "raw" printing for +application/octet-stream!

    +If you use the first option (drivers are installed on the client +side), there is one setting to take care of: CUPS needs to be told +that it should allow "raw" printing of deliberate (binary) file +formats. The CUPS files that need to be correctly set for RAW mode +printers to work are: +

    • /etc/cups/mime.types +

    • /etc/cups/mime.convs

    +Both contain entries (at the end of the respective files) which must +be uncommented to allow RAW mode operation. +In/etc/cups/mime.types make sure this line is +present: +

    +
+ application/octet-stream
+
+

    +In /etc/cups/mime.convs, +have this line: +

    +
+ application/octet-stream   application/vnd.cups-raw   0   - 
+
+

    +If these two files are not set up correctly for raw Windows client +printing, you may encounter the dreaded Unable to +convert file 0 in your CUPS error_log file. +

    Note

    editing the mime.convs and the +mime.types file does not +enforce "raw" printing, it only +allows it. +

    Background.  +CUPS being a more security-aware printing system than traditional ones +does not by default allow a user to send deliberate (possibly binary) +data to printing devices. This could be easily abused to launch a +"Denial of Service" attack on your printer(s), causing at the least +the loss of a lot of paper and ink. "Unknown" data are tagged by CUPS +as MIME type: application/octet-stream and not +allowed to go to the printer. By default, you can only send other +(known) MIME types "raw". Sending data "raw" means that CUPS does not +try to convert them and passes them to the printer untouched (see next +chapter for even more background explanations). +

    +This is all you need to know to get the CUPS/Samba combo printing +"raw" files prepared by Windows clients, which have vendor drivers +locally installed. If you are not interested in background information about +more advanced CUPS/Samba printing, simply skip the remaining sections +of this chapter. +

    Three familiar Methods for driver upload plus a new one

    +If you want to use the MS-RPC type printing, you must upload the +drivers onto the Samba server first ([print$] +share). For a discussion on how to deposit printer drivers on the +Samba host (so that the Windows clients can download and use them via +"Point'n'Print") please also refer to the previous chapter of this +HOWTO Collection. There you will find a description or reference to +three methods of preparing the client drivers on the Samba server: +

    • the GUI, "Add Printer Wizard" +upload-from-a-Windows-client +method;

    • the commandline, "smbclient/rpcclient" +upload-from-a-UNIX-workstation +method;

    • the Imprints Toolset +method.

    +These 3 methods apply to CUPS all the same. A new and more +convenient way to load the Windows drivers into Samba is provided +provided if you use CUPS: +

    • the cupsaddsmb +utility.

    +cupsaddsmb is discussed in much detail further below. But we will +first explore the CUPS filtering system and compare the Windows and +UNIX printing architectures. +

    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download

    +Still reading on? Good. Let's go into more detail then. We now know +how to set up a "dump" printserver, that is, a server which is spooling +printjobs "raw", leaving the print data untouched. +

    +Possibly you need to setup CUPS in a more smart way. The reasons could +be manifold: +

    • Maybe your boss wants to get monthly statistics: Which +printer did how many pages? What was the average data size of a job? +What was the average print run per day? What are the typical hourly +peaks in printing? Which departments prints how +much?

    • Maybe you are asked to setup a print quota system: +users should not be able to print more jobs, once they have surpassed +a given limit per period?

    • Maybe your previous network printing setup is a mess +and shall be re-organized from a clean beginning?

    • Maybe you have experiencing too many "Blue Screens", +originating from poorly debugged printer drivers running in NT "kernel +mode"?

    +These goals cannot be achieved by a raw print server. To build a +server meeting these requirements, you'll first need to learn about +how CUPS works and how you can enable its features. +

    +What follows is the comparison of some fundamental concepts for +Windows and Unix printing; then is the time for a description of the +CUPS filtering system, how it works and how you can tweak it. +

    GDI on Windows -- PostScript on Unix

    +Network printing is one of the most complicated and error-prone +day-to-day tasks any user or an administrator may encounter. This is +true for all OS platforms. And there are reasons for this. +

    +You can't expect for most file formats to just throw them towards +printers and they get printed. There needs to be a file format +conversion in between. The problem is: there is no common standard for +print file formats across all manufacturers and printer types. While +PostScript (trademark held by Adobe), and, to an +extent, PCL (trademark held by HP), have developed +into semi-official "standards", by being the most widely used PDLs +(Page Description Languages), there are still +many manufacturers who "roll their own" (their reasons may be +unacceptable license fees for using printer-embedded PostScript +interpreters, etc.). +

    Windows Drivers, GDI and EMF

    +In Windows OS, the format conversion job is done by the printer +drivers. On MS Windows OS platforms all application programmers have +at their disposal a built-in API, the GDI (Graphical Device +Interface), as part and parcel of the OS itself, to base +themselves on. This GDI core is used as one common unified ground, for +all Windows programs, to draw pictures, fonts and documents +on screen as well as on +paper (=print). Therefore printer driver developers can +standardize on a well-defined GDI output for their own driver +input. Achieving WYSIWYG ("What You See Is What You Get") is +relatively easy, because the on-screen graphic primitives, as well as +the on-paper drawn objects, come from one common source. This source, +the GDI, produces often a file format called EMF (Enhanced +MetaFile). The EMF is processed by the printer driver and +converted to the printer-specific file format. +

    Note

    +To the GDI foundation in MS Windows, Apple has chosen to +put paper and screen output on a common foundation for their +(BSD-Unix-based, did you know??) Mac OS X and Darwin Operating +Systems.Their Core Graphic Engine uses a +PDF derivate for all display work. +

    + +

    Figure 19.1. Windows Printing to a local Printer

    Windows Printing to a local Printer

    +

    Unix Printfile Conversion and GUI Basics

    +In Unix and Linux, there is no comparable layer built into the OS +kernel(s) or the X (screen display) server. Every application is +responsible for itself to create its print output. Fortunately, most +use PostScript. That gives at least some common ground. Unfortunately, +there are many different levels of quality for this PostScript. And +worse: there is a huge difference (and no common root) in the way how +the same document is displayed on screen and how it is presented on +paper. WYSIWYG is more difficult to achieve. This goes back to the +time decades ago, when the predecessors of X.org, +designing the UNIX foundations and protocols for Graphical User +Interfaces refused to take over responsibility for "paper output" +also, as some had demanded at the time, and restricted itself to +"on-screen only". (For some years now, the "Xprint" project has been +under development, attempting to build printing support into the X +framework, including a PostScript and a PCL driver, but it is not yet +ready for prime time.) You can see this unfavorable inheritance up to +the present day by looking into the various "font" directories on your +system; there are separate ones for fonts used for X display and fonts +to be used on paper. +

    Background.  +The PostScript programming language is an "invention" by Adobe Inc., +but its specifications have been published to the full. Its strength +lies in its powerful abilities to describe graphical objects (fonts, +shapes, patterns, lines, curves, dots...), their attributes (color, +linewidth...) and the way to manipulate (scale, distort, rotate, +shift...) them. Because of its open specification, anybody with the +skill can start writing his own implementation of a PostScript +interpreter and use it to display PostScript files on screen or on +paper. Most graphical output devices are based on the concept of +"raster images" or "pixels" (one notable exception are pen +plotters). Of course, you can look at a PostScript file in its textual +form and you will be reading its PostScript code, the language +instructions which need to be interpreted by a rasterizer. Rasterizers +produce pixel images, which may be displayed on screen by a viewer +program or on paper by a printer. +

    PostScript and Ghostscript

    +So, Unix is lacking a common ground for printing on paper and +displaying on screen. Despite this unfavorable legacy for Unix, basic +printing is fairly easy: if you have PostScript printers at your +disposal! The reason is: these devices have a built-in PostScript +language "interpreter", also called a Raster Image +Processor (RIP), (which makes them more expensive than +other types of printers); throw PostScript towards them, and they will +spit out your printed pages. Their RIP is doing all the hard work of +converting the PostScript drawing commands into a bitmap picture as +you see it on paper, in a resolution as done by your printer. This is +no different to PostScript printing of a file from a Windows origin. +

    Note

    Traditional Unix programs and printing systems -- while +using PostScript -- are largely not PPD-aware. PPDs are "PostScript +Printer Description" files. They enable you to specify and control all +options a printer supports: duplexing, stapling, punching... Therefore +Unix users for a long time couldn't choose many of the supported +device and job options, unlike Windows or Apple users. But now there +is CUPS.... ;-) +

    +

    Figure 19.2. Printing to a Postscript Printer

    Printing to a Postscript Printer

    +

    +However, there are other types of printers out there. These don't know +how to print PostScript. They use their own Page Description +Language (PDL, often proprietary). To print to them is much +more demanding. Since your Unix applications mostly produce +PostScript, and since these devices don't understand PostScript, you +need to convert the printfiles to a format suitable for your printer +on the host, before you can send it away. +

    Ghostscript -- the Software RIP for non-PostScript Printers

    +Here is where Ghostscript kicks in. Ghostscript is +the traditional (and quite powerful) PostScript interpreter used on +Unix platforms. It is a RIP in software, capable to do a +lot of file format conversions, for a very broad +spectrum of hardware devices as well as software file formats. +Ghostscript technology and drivers is what enables PostScript printing +to non-PostScript hardware. +

    +

    Figure 19.3. Ghostscript as a RIP for non-postscript printers

    Ghostscript as a RIP for non-postscript printers

    +

    Tip

    +Use the "gs -h" command to check for all built-in "devices" of your +Ghostscript version. If you specify e.g. a parameter of +-sDEVICE=png256 on your Ghostscript command +line, you are asking Ghostscript to convert the input into a PNG +file. Naming a "device" on the commandline is the most important +single parameter to tell Ghostscript how exactly it should render the +input. New Ghostscript versions are released at fairly regular +intervals, now by artofcode LLC. They are initially put under the +"AFPL" license, but re-released under the GNU GPL as soon as the next +AFPL version appears. GNU Ghostscript is probably the version +installed on most Samba systems. But it has got some +deficiencies. Therefore ESP Ghostscript was developed as an +enhancement over GNU Ghostscript, with lots of bug-fixes, additional +devices and improvements. It is jointly maintained by developers from +CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat and Debian. It includes +the "cups" device (essential to print to non-PS printers from CUPS). +

    PostScript Printer Description (PPD) Specification

    +While PostScript in essence is a Page Description +Language (PDL) to represent the page layout in a +device independent way, real world print jobs are +always ending up to be output on a hardware with device-specific +features. To take care of all the differences in hardware, and to +allow for innovations, Adobe has specified a syntax and file format +for PostScript Printer Description (PPD) +files. Every PostScript printer ships with one of these files. +

    +PPDs contain all information about general and special features of the +given printer model: Which different resolutions can it handle? Does +it have a Duplexing Unit? How many paper trays are there? What media +types and sizes does it take? For each item it also names the special +command string to be sent to the printer (mostly inside the PostScript +file) in order to enable it. +

    +Information from these PPDs is meant to be taken into account by the +printer drivers. Therefore, installed as part of the Windows +PostScript driver for a given printer is the printer's PPD. Where it +makes sense, the PPD features are presented in the drivers' UI dialogs +to display to the user as choice of print options. In the end, the +user selections are somehow written (in the form of special +PostScript, PJL, JCL or vendor-dependent commands) into the PostScript +file created by the driver. +

    Warning

    +A PostScript file that was created to contain device-specific commands +for achieving a certain print job output (e.g. duplexed, stapled and +punched) on a specific target machine, may not print as expected, or +may not be printable at all on other models; it also may not be fit +for further processing by software (e.g. by a PDF distilling program). +

    CUPS can use all Windows-formatted Vendor PPDs

    +CUPS can handle all spec-compliant PPDs as supplied by the +manufacturers for their PostScript models. Even if a +Unix/Linux-illiterate vendor might not have mentioned our favorite +OS in his manuals and brochures -- you can safely trust this: +if you get hold of the Windows NT version of the PPD, you +can use it unchanged in CUPS and thus access the full +power of your printer just like a Windows NT user could! +

    Tip

    +To check the spec compliance of any PPD online, go to http://www.cups.org/testppd.php +and upload your PPD. You will see the results displayed +immediately. CUPS in all versions after 1.1.19 has a much more strict +internal PPD parsing and checking code enabled; in case of printing +trouble this online resource should be one of your first pitstops. +

    Warning

    +For real PostScript printers don't use the +Foomatic or cupsomatic +PPDs from Linuxprinting.org. With these devices the original +vendor-provided PPDs are always the first choice! +

    Tip

    +If you are looking for an original vendor-provided PPD of a specific +device, and you know that an NT4 box (or any other Windows box) on +your LAN has the PostScript driver installed, just use +smbclient //NT4-box/print\$ -U username to +access the Windows directory where all printer driver files are +stored. First look in the W32X86/2 subdir for +the PPD you are seeking. +

    CUPS also uses PPDs for non-PostScript Printers

    +CUPS also uses specially crafted PPDs to handle non-PostScript +printers. These PPDs are usually not available from the vendors (and +no, you can't just take the PPD of a Postscript printer with the same +model name and hope it works for the non-PostScript version too). To +understand how these PPDs work for non-PS printers we first need to +dive deeply into the CUPS filtering and file format conversion +architecture. Stay tuned. +

    The CUPS Filtering Architecture

    +The core of the CUPS filtering system is based on +Ghostscript. In addition to Ghostscript, CUPS +uses some other filters of its own. You (or your OS vendor) may have +plugged in even more filters. CUPS handles all data file formats under +the label of various MIME types. Every incoming +printfile is subjected to an initial +auto-typing. The auto-typing determines its given +MIME type. A given MIME type implies zero or more possible filtering +chains relevant to the selected target printer. This section discusses +how MIME types recognition and conversion rules interact. They are +used by CUPS to automatically setup a working filtering chain for any +given input data format. +

    +If CUPS rasterizes a PostScript file natively to +a bitmap, this is done in 2 stages: +

    • the first stage uses a Ghostscript device named "cups" +(this is since version 1.1.15) and produces a generic raster format +called "CUPS raster". +

    • the second stage uses a "raster driver" which converts +the generic CUPS raster to a device specific raster.

    +Make sure your Ghostscript version has the "cups" device compiled in +(check with gs -h | grep cups). Otherwise you +may encounter the dreaded Unable to convert file +0 in your CUPS error_log file. To have "cups" as a +device in your Ghostscript, you either need to patch GNU +Ghostscript and re-compile or use ESP Ghostscript. The +superior alternative is ESP Ghostscript: it supports not just CUPS, +but 300 other devices too (while GNU Ghostscript supports only about +180). Because of this broad output device support, ESP Ghostscript is +the first choice for non-CUPS spoolers too. It is now recommended by +Linuxprinting.org for all spoolers. +

    +CUPS printers may be setup to use external +rendering paths. One of the most common ones is provided by the +Foomatic/cupsomatic concept, from Linuxprinting.org. This +uses the classical Ghostscript approach, doing everything in one +step. It doesn't use the "cups" device, but one of the many +others. However, even for Foomatic/cupsomatic usage, best results and +broadest printer model support is provided by ESP Ghostscript (more +about cupsomatic/Foomatic, particularly the new version called now +foomatic-rip, follows below). +

    MIME types and CUPS Filters

    +CUPS reads the file /etc/cups/mime.types +(and all other files carrying a *.types suffix +in the same directory) upon startup. These files contain the MIME +type recognition rules which are applied when CUPS runs its +auto-typing routines. The rule syntax is explained in the man page +for mime.types and in the comments section of the +mime.types file itself. A simple rule reads +like this: +

    +
+ application/pdf         pdf string(0,%PDF)
+
+

    +This means: if a filename has either a +.pdf suffix, or if the magic +string %PDF is right at the +beginning of the file itself (offset 0 from the start), then it is +a PDF file (application/pdf). +Another rule is this: +

    +
+ application/postscript  ai eps ps string(0,%!) string(0,<04>%!)
+
+

    +Its meaning: if the filename has one of the suffixes +.ai, .eps, +.ps or if the file itself starts with one of the +strings %! or <04>%!, it +is a generic PostScript file +(application/postscript). +

    Note

    +There is a very important difference between two similar MIME type in +CUPS: one is application/postscript, the other is +application/vnd.cups-postscript. While +application/postscript is meant to be device +independent (job options for the file are still outside the PS file +content, embedded in commandline or environment variables by CUPS), +application/vnd.cups-postscript may have the job +options inserted into the PostScript data itself (were +applicable). The transformation of the generic PostScript +(application/postscript) to the device-specific version +(application/vnd.cups-postscript) is the responsibility of the +CUPS pstops filter. pstops uses information +contained in the PPD to do the transformation. +

    Warning

    +Don't confuse the other mime.types file your system might be using +with the one in the /etc/cups/ directory. +

    +CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI and a +lot of image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster, +PNM, PBM, SGI-RGB and some more) and their associated MIME types +with its filters. +

    MIME type Conversion Rules

    +CUPS reads the file /etc/cups/mime.convs +(and all other files named with a *.convs +suffix in the same directory) upon startup. These files contain +lines naming an input MIME type, an output MIME type, a format +conversion filter which can produce the output from the input type +and virtual costs associated with this conversion. One example line +reads like this: +

    +
+ application/pdf         application/postscript   33   pdftops
+
+

    +This means that the pdftops filter will take +application/pdf as input and produce +application/postscript as output, the virtual +cost of this operation is 33 CUPS-$. The next filter is more +expensive, costing 66 CUPS-$: +

    +
+ application/vnd.hp-HPGL application/postscript   66   hpgltops
+
+

    +This is the hpgltops, which processes HP-GL +plotter files to PostScript. +

    +
+ application/octet-stream
+
+

    +Here are two more examples: +

    +
+ application/x-shell     application/postscript   33    texttops
+ text/plain              application/postscript   33    texttops
+
+

    +The last two examples name the texttops filter +to work on "text/plain" as well as on "application/x-shell". (Hint: +this differentiation is needed for the syntax highlighting feature of +"texttops"). +

    Filter Requirements

    +There are many more combinations named in mime.convs. However, you +are not limited to use the ones pre-defined there. You can plug in any +filter you like into the CUPS framework. It must meet, or must be made +to meet some minimal requirements. If you find (or write) a cool +conversion filter of some kind, make sure it complies to what CUPS +needs, and put in the right lines in mime.types +and mime.convs, then it will work seamlessly +inside CUPS! +

    Tip

    +The mentioned "CUPS requirements" for filters are simple. Take +filenames or stdin as input and write to +stdout. They should take these 5 or 6 arguments: +printer job user title copies options [filename] +

    Printer

    The name of the printer queue (normally this is the +name of the filter being run)

    job

    The numeric job ID for the job being +printed

    Printer

    The string from the originating-user-name +attribute

    Printer

    The string from the job-name attribute

    Printer

    The numeric value from the number-copies +attribute

    Printer

    The job options

    Printer

    (Optionally) The print request file (if missing, +filters expected data fed through stdin). In most +cases it is very easy to write a simple wrapper script around existing +filters to make them work with CUPS.

    Prefilters

    +As was said, PostScript is the central file format to any Unix based +printing system. From PostScript, CUPS generates raster data to feed +non-PostScript printers. +

    +But what is happening if you send one of the supported non-PS formats +to print? Then CUPS runs "pre-filters" on these input formats to +generate PostScript first. There are pre-filters to create PS from +ASCII text, PDF, DVI or HP-GL. The outcome of these filters is always +of MIME type application/postscript (meaning that +any device-specific print options are not yet embedded into the +PostScript by CUPS, and that the next filter to be called is +pstops). Another pre-filter is running on all supported image formats, +the imagetops filter. Its outcome is always of +MIME type application/vnd.cups-postscript +(not application/postscript), meaning it has the +print options already embedded into the file. +

    +

    Figure 19.4. Prefiltering in CUPS to form Postscript

    Prefiltering in CUPS to form Postscript

    +

    pstops

    +pstopsis the filter to convert +application/postscript to +application/vnd.cups-postscript. It was said +above that this filter inserts all device-specific print options +(commands to the printer to ask for the duplexing of output, or +stapling an punching it, etc.) into the PostScript file. +

    +

    Figure 19.5. Adding Device-specific Print Options

    Adding Device-specific Print Options

    +

    +This is not all: other tasks performed by it are: +

    • +selecting the range of pages to be printed (if you choose to +print only pages "3, 6, 8-11, 16, 19-21", or only the odd numbered +ones) +

    • +putting 2 or more logical pages on one sheet of paper (the +so-called "number-up" function) +

    • counting the pages of the job to insert the accounting +information into the /var/log/cups/page_log +

    pstoraster

    +pstoraster is at the core of the CUPS filtering +system. It is responsible for the first stage of the rasterization +process. Its input is of MIME type application/vnd.cups-postscript; +its output is application/vnd.cups-raster. This output format is not +yet meant to be printable. Its aim is to serve as a general purpose +input format for more specialized raster drivers, +that are able to generate device-specific printer data. +

    +

    Figure 19.6. Postscript to intermediate Raster format

    Postscript to intermediate Raster format

    +

    +CUPS raster is a generic raster format with powerful features. It is +able to include per-page information, color profiles and more to be +used by the following downstream raster drivers. Its MIME type is +registered with IANA and its specification is of course completely +open. It is designed to make it very easy and inexpensive for +manufacturers to develop Linux and Unix raster drivers for their +printer models, should they choose to do so. CUPS always takes care +for the first stage of rasterization so these vendors don't need to care +about Ghostscript complications (in fact, there is currently more +than one vendor financing the development of CUPS raster drivers). +

    +

    Figure 19.7. CUPS-raster production using Ghostscript

    CUPS-raster production using Ghostscript

    +

    +CUPS versions before version 1.1.15 were shipping a binary (or source +code) standalone filter, named "pstoraster". pstoraster was derived +from GNU Ghostscript 5.50, and could be installed besides and in +addition to any GNU or AFPL Ghostscript package without conflicting. +

    +From version 1.1.15, this has changed. The functions for this has been +integrated back into Ghostscript (now based on GNU Ghostscript version +7.05). The "pstoraster" filter is now a simple shell script calling +gs with the -sDEVICE=cups +parameter. If your Ghostscript doesn't show a success on asking for +gs -h |grep cups, you might not be able to +print. Update your Ghostscript then! +

    imagetops and imagetoraster

    +Above in the section about prefilters, we mentioned the prefilter +that generates PostScript from image formats. The imagetoraster +filter is used to convert directly from image to raster, without the +intermediate PostScript stage. It is used more often than the above +mentioned prefilters. Here is a summarizing flowchart of image file +filtering: +

    +

    Figure 19.8. Image format to CUPS-raster format conversion

    Image format to CUPS-raster format conversion

    +

    rasterto [printers specific]

    +CUPS ships with quite some different raster drivers processing CUPS +raster. On my system I find in /usr/lib/cups/filter/ these: +rastertoalps, rastertobj, rastertoepson, rastertoescp, +rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo, +rastertoescp, rastertohp and +rastertoprinter. Don't worry if you have less +than this; some of these are installed by commercial add-ons to CUPS +(like rastertoturboprint), others (like +rastertoprinter) by 3rd party driver +development projects (such as Gimp-Print) wanting to cooperate as +closely as possible with CUPS. +

    +

    Figure 19.9. Raster to Printer Specific formats

    Raster to Printer Specific formats

    +

    CUPS Backends

    +The last part of any CUPS filtering chain is a "backend". Backends +are special programs that send the print-ready file to the final +device. There is a separate backend program for any transfer +"protocol" of sending printjobs over the network, or for every local +interface. Every CUPS printqueue needs to have a CUPS "device-URI" +associated with it. The device URI is the way to encode the backend +used to send the job to its destination. Network device-URIs are using +two slashes in their syntax, local device URIs only one, as you can +see from the following list. Keep in mind that local interface names +may vary much from my examples, if your OS is not Linux: +

    usb

    +This backend sends printfiles to USB-connected printers. An +example for the CUPS device-URI to use is: +usb:/dev/usb/lp0 +

    serial

    +This backend sends printfiles to serially connected printers. +An example for the CUPS device-URI to use is: +serial:/dev/ttyS0?baud=11500 +

    parallel

    +This backend sends printfiles to printers connected to the +parallel port. An example for the CUPS device-URI to use is: +parallel:/dev/lp0 +

    scsi

    +This backend sends printfiles to printers attached to the +SCSI interface. An example for the CUPS device-URI to use is: +scsi:/dev/sr1 +

    lpd

    +This backend sends printfiles to LPR/LPD connected network +printers. An example for the CUPS device-URI to use is: +lpd://remote_host_name/remote_queue_name +

    AppSocket/HP JetDirect

    +This backend sends printfiles to AppSocket (a.k.a. "HP +JetDirect") connected network printers. An example for the CUPS +device-URI to use is: +socket://10.11.12.13:9100 +

    ipp

    +This backend sends printfiles to IPP connected network +printers (or to other CUPS servers). Examples for CUPS device-URIs +to use are: +ipp:://192.193.194.195/ipp +(for many HP printers) or +ipp://remote_cups_server/printers/remote_printer_name +

    http

    +This backend sends printfiles to HTTP connected printers. +(The http:// CUPS backend is only a symlink to the ipp:// backend.) +Examples for the CUPS device-URIs to use are: +http:://192.193.194.195:631/ipp +(for many HP printers) or +http://remote_cups_server:631/printers/remote_printer_name +

    smb

    +This backend sends printfiles to printers shared by a Windows +host. An example for CUPS device-URIs to use are: +smb://workgroup/server/printersharename +Or +Smb://server/printersharename +or +smb://username:password@workgroup/server/printersharename +or +smb://username:password@server/printersharename. +The smb:// backend is a symlink to the Samba utility +smbspool (doesn't ship with CUPS). If the +symlink is not present in your CUPS backend directory, have your +root user create it: ln -s `which smbspool` +/usr/lib/cups/backend/smb. +

    +It is easy to write your own backends as Shell or Perl scripts, if you +need any modification or extension to the CUPS print system. One +reason could be that you want to create "special" printers which send +the printjobs as email (through a "mailto:/" backend), convert them to +PDF (through a "pdfgen:/" backend) or dump them to "/dev/null" (In +fact I have the system-wide default printer set up to be connected to +a "devnull:/" backend: there are just too many people sending jobs +without specifying a printer, or scripts and programs which don't name +a printer. The system-wide default deletes the job and sends a polite +mail back to the $USER asking him to always specify a correct +printername). +

    +Not all of the mentioned backends may be present on your system or +usable (depending on your hardware configuration). One test for all +available CUPS backends is provided by the lpinfo +utility. Used with the -v parameter, it lists +all available backends: +

    +
+ lpinfo -v
+
+

    cupsomatic/Foomatic -- how do they fit into the Picture?

    +"cupsomatic" filters may be the most widely used on CUPS +installations. You must be clear about the fact that these were not +developed by the CUPS people. They are a "Third Party" add-on to +CUPS. They utilize the traditional Ghostscript devices to render jobs +for CUPS. When troubleshooting, you should know about the +difference. Here the whole rendering process is done in one stage, +inside Ghostscript, using an appropriate "device" for the target +printer. cupsomatic uses PPDs which are generated from the "Foomatic" +Printer & Driver Database at Linuxprinting.org. +

    +You can recognize these PPDs from the line calling the +cupsomatic filter: +

    +
+ *cupsFilter: "application/vnd.cups-postscript  0  cupsomatic"
+
+

    +This line you may find amongst the first 40 or so lines of the PPD +file. If you have such a PPD installed, the printer shows up in the +CUPS web interface with a foomatic namepart for +the driver description. cupsomatic is a Perl script that runs +Ghostscript, with all the complicated commandline options +auto-constructed from the selected PPD and commandline options give to +the printjob. +

    +However, cupsomatic is now deprecated. Its PPDs (especially the first +generation of them, still in heavy use out there) are not meeting the +Adobe specifications. You might also suffer difficulties when you try +to download them with "Point'n'Print" to Windows clients. A better, +and more powerful successor is now in a very stable Beta-version +available: it is called foomatic-rip. To use +foomatic-rip as a filter with CUPS, you need the new-type PPDs. These +have a similar, but different line: +

    +
+ *cupsFilter: "application/vnd.cups-postscript  0  foomatic-rip"
+
+

    +The PPD generating engine at Linuxprinting.org has been revamped. +The new PPDs comply to the Adobe spec. On top, they also provide a +new way to specify different quality levels (hi-res photo, normal +color, grayscale, draft...) with a single click (whereas before you +could have required 5 or more different selections (media type, +resolution, inktype, dithering algorithm...). There is support for +custom-size media built in. There is support to switch +print-options from page to page, in the middle of a job. And the +best thing is: the new foomatic-rip now works seamlessly with all +legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR etc.), providing +for them access to use PPDs for their printing! +

    The Complete Picture

    +If you want to see an overview over all the filters and how they +relate to each other, the complete picture of the puzzle is at the end +of this document. +

    mime.convs

    +CUPS auto-constructs all possible filtering chain paths for any given +MIME type, and every printer installed. But how does it decide in +favor or against a specific alternative? (There may often be cases, +where there is a choice of two or more possible filtering chains for +the same target printer). Simple: you may have noticed the figures in +the 3rd column of the mime.convs file. They represent virtual costs +assigned to this filter. Every possible filtering chain will sum up to +a total "filter cost". CUPS decides for the most "inexpensive" route. +

    Tip

    +The setting of FilterLimit 1000 in +cupsd.conf will not allow more filters to +run concurrently than will consume a total of 1000 virtual filter +cost. This is a very efficient way to limit the load of any CUPS +server by setting an appropriate "FilterLimit" value. A FilterLimit of +200 allows roughly 1 job at a time, while a FilterLimit of 1000 allows +approximately 5 jobs maximum at a time. +

    "Raw" printing

    +You can tell CUPS to print (nearly) any file "raw". "Raw" means it +will not be filtered. CUPS will send the file to the printer "as is" +without bothering if the printer is able to digest it. Users need to +take care themselves that they send sensible data formats only. Raw +printing can happen on any queue if the "-o raw" option is specified +on the command line. You can also set up raw-only queues by simply not +associating any PPD with it. This command: +

    +
+ lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E
+
+

    +sets up a queue named "rawprinter", connected via the "socket" +protocol (a.k.a. "HP JetDirect") to the device at IP address +11.12.1.3.14, using port 9100. (If you had added a PPD with +-P /path/to/PPD to this command line, you would +have installed a "normal" printqueue. +

    +CUPS will automatically treat each job sent to a queue as a "raw" one, +if it can't find a PPD associated with the queue. However, CUPS will +only send known MIME types (as defined in its own mime.types file) and +refuse others. +

    "application/octet-stream" printing

    +Any MIME type with no rule in the +/etc/cups/mime.types file is regarded as unknown +or application/octet-stream and will not be +sent. Because CUPS refuses to print unknown MIME types per default, +you will probably have experienced the fact that printjobs originating +from Windows clients were not printed. You may have found an error +message in your CUPS logs like: +

    +
+ Unable to convert file 0 to printable format for job
+
+

    +To enable the printing of "application/octet-stream" files, edit +these two files: +

    • /etc/cups/mime.convs

    • /etc/cups/mime.types

    +Both contain entries (at the end of the respective files) which must +be uncommented to allow RAW mode operation for +application/octet-stream. In /etc/cups/mime.types +make sure this line is present: +

    +
+ application/octet-stream
+
+

    +This line (with no specific auto-typing rule set) makes all files +not otherwise auto-typed a member of application/octet-stream. In +/etc/cups/mime.convs, have this +line: +

    +
+ application/octet-stream   application/vnd.cups-raw   0   -
+
+

    +This line tells CUPS to use the Null Filter +(denoted as "-", doing... nothing at all) on +application/octet-stream, and tag the result as +application/vnd.cups-raw. This last one is +always a green light to the CUPS scheduler to now hand the file over +to the "backend" connecting to the printer and sending it over. +

    Note

    Editing the mime.convs and the +mime.types file does not +enforce "raw" printing, it only +allows it. +

    Background.  +CUPS being a more security-aware printing system than traditional ones +does not by default allow one to send deliberate (possibly binary) +data to printing devices. (This could be easily abused to launch a +Denial of Service attack on your printer(s), causing at least the loss +of a lot of paper and ink...) "Unknown" data are regarded by CUPS +as MIME type +application/octet-stream. While you +can send data "raw", the MIME type for these must +be one that is known to CUPS and an allowed one. The file +/etc/cups/mime.types defines the "rules" how CUPS +recognizes MIME types. The file +/etc/cups/mime.convs decides which file +conversion filter(s) may be applied to which MIME types. +

    PostScript Printer Descriptions (PPDs) for non-PS Printers

    +Originally PPDs were meant to be used for PostScript printers +only. Here, they help to send device-specific commands and settings +to the RIP which processes the jobfile. CUPS has extended this +scope for PPDs to cover non-PostScript printers too. This was not +very difficult, because it is a standardized file format. In a way +it was logical too: CUPS handles PostScript and uses a PostScript +RIP (=Ghostscript) to process the jobfiles. The only difference is: +a PostScript printer has the RIP built-in, for other types of +printers the Ghostscript RIP runs on the host computer. +

    +PPDs for a non-PS printer have a few lines that are unique to +CUPS. The most important one looks similar to this: +

    +
+ *cupsFilter: application/vnd.cups-raster  66   rastertoprinter
+
+

    +It is the last piece in the CUPS filtering puzzle. This line tells the +CUPS daemon to use as a last filter "rastertoprinter". This filter +should be served as input an "application/vnd.cups-raster" MIME type +file. Therefore CUPS should auto-construct a filtering chain, which +delivers as its last output the specified MIME type. This is then +taken as input to the specified "rastertoprinter" filter. After this +the last filter has done its work ("rastertoprinter" is a Gimp-Print +filter), the file should go to the backend, which sends it to the +output device. +

    +CUPS by default ships only a few generic PPDs, but they are good for +several hundred printer models. You may not be able to control +different paper trays, or you may get larger margins than your +specific model supports): +

    deskjet.ppd

    older HP inkjet printers and compatible +

    deskjet2.ppd

    newer HP inkjet printers and compatible +

    dymo.ppd

    label printers +

    epson9.ppd

    Epson 24pin impact printers and compatible +

    epson24.ppd

    Epson 24pin impact printers and compatible +

    okidata9.ppd

    Okidata 9pin impact printers and compatible +

    okidat24.ppd

    Okidata 24pin impact printers and compatible +

    stcolor.ppd

    older Epson Stylus Color printers +

    stcolor2.ppd

    newer Epson Stylus Color printers +

    stphoto.ppd

    older Epson Stylus Photo printers +

    stphoto2.ppd

    newer Epson Stylus Photo printers +

    laserjet.ppd

    all PCL printers. Further below is a discussion +of several other driver/PPD-packages suitable fur use with CUPS. +

    Difference between cupsomatic/foomatic-rip and +native CUPS printing

    +Native CUPS rasterization works in two steps. +

    • +First is the "pstoraster" step. It uses the special "cups" +device from ESP Ghostscript 7.05.x as its tool +

    • +Second comes the "rasterdriver" step. It uses various +device-specific filters; there are several vendors who provide good +quality filters for this step, some are Free Software, some are +Shareware/Non-Free, some are proprietary.

    +Often this produces better quality (and has several more +advantages) than other methods. +

    +

    Figure 19.10. cupsomatic/foomatic processing versus Native CUPS

    cupsomatic/foomatic processing versus Native CUPS

    +

    +One other method is the cupsomatic/foomatic-rip +way. Note that cupsomatic is not made by the CUPS +developers. It is an independent contribution to printing development, +made by people from Linuxprinting.org (see also http://www.cups.org/cups-help.html). +cupsomatic is no longer developed and maintained and is no longer +supported. It has now been replaced by +foomatic-rip. foomatic-rip is a complete re-write +of the old cupsomatic idea, but very much improved and generalized to +other (non-CUPS) spoolers. An upgrade to foomatic-rip is strongly +advised, especially if you are upgrading to a recent version of CUPS +too. +

    +Both the cupsomatic (old) and the foomatic-rip (new) methods from +Linuxprinting.org use the traditional Ghostscript print file +processing, doing everything in a single step. It therefore relies on +all the other devices built-in into Ghostscript. The quality is as +good (or bad) as Ghostscript rendering is in other spoolers. The +advantage is that this method supports many printer models not +supported (yet) by the more modern CUPS method. +

    +Of course, you can use both methods side by side on one system (and +even for one printer, if you set up different queues), and find out +which works best for you. +

    +cupsomatic "kidnaps" the printfile after the +application/vnd.cups-postscript stage and +deviates it through the CUPS-external, system wide Ghostscript +installation: Therefore the printfile bypasses the "pstoraster" filter +(and thus also bypasses the CUPS-raster-drivers +"rastertosomething"). After Ghostscript finished its rasterization, +cupsomatic hands the rendered file directly to the CUPS backend. The +flowchart above illustrates the difference between native CUPS +rendering and the Foomatic/cupsomatic method. +

    Examples for filtering Chains

    +Here are a few examples of commonly occurring filtering chains to +illustrate the workings of CUPS. +

    +Assume you want to print a PDF file to a HP JetDirect-connected +PostScript printer, but you want to print the pages 3-5, 7, 11-13 +only, and you want to print them "2-up" and "duplex": +

    • your print options (page selection as required, 2-up, +duplex) are passed to CUPS on the commandline;

    • the (complete) PDF file is sent to CUPS and autotyped as +application/pdf;

    • the file therefore first must pass the +pdftops pre-filter, which produces PostScript +MIME type application/postscript (a preview here +would still show all pages of the original PDF);

    • the file then passes the pstops +filter which applies the commandline options: it selects the pages +2-5, 7 and 11-13, creates and imposed layout "2 pages on 1 sheet" and +inserts the correct "duplex" command (as is defined in the printer's +PPD) into the new PostScript file; the file now is of PostScript MIME +type +application/vnd.cups-postscript;

    • the file goes to the socket +backend, which transfers the job to the printers.

    +The resulting filter chain therefore is: +

    +pdftops --> pstops --> socket
+

    +Assume your want to print the same filter to an USB-connected +Epson Stylus Photo printer, installed with the CUPS +stphoto2.ppd. The first few filtering stages +are nearly the same: +

    • your print options (page selection as required, 2-up, +duplex) are passed to CUPS on the commandline;

    • the (complete) PDF file is sent to CUPS and autotyped as +application/pdf;

    • the file therefore first must pass the +pdftops pre-filter, which produces PostScript +MIME type application/postscript (a preview here +would still show all pages of the original PDF);

    • the file then passes the "pstops" filter which applies +the commandline options: it selects the pages 2-5, 7 and 11-13, +creates and imposed layout "2 pages on 1 sheet" and inserts the +correct "duplex" command... (OOoops -- this printer and his PPD +don't support duplex printing at all -- this option will be ignored +then) into the new PostScript file; the file now is of PostScript +MIME type +application/vnd.cups-postscript;

    • the file then passes the +pstoraster stage and becomes MIME type +application/cups-raster;

    • finally, the rastertoepson filter +does its work (as is indicated in the printer's PPD), creating the +printer-specific raster data and embedding any user-selected +print-options into the print data stream;

    • the file goes to the usb backend, +which transfers the job to the printers.

    +The resulting filter chain therefore is: +

    +pdftops --> pstops --> pstoraster --> rastertoepson --> usb
+

    Sources of CUPS drivers / PPDs

    +On the internet you can find now many thousand CUPS-PPD files +(with their companion filters), in many national languages, +supporting more than 1000 non-PostScript models. +

    Note

    +The cupsomatic/Foomatic trick from Linuxprinting.org works +differently from the other drivers. This is explained elsewhere in this +document. +

    Printing with Interface Scripts

    +CUPS also supports the usage of "interface scripts" as known from +System V AT&T printing systems. These are often used for PCL +printers, from applications that generate PCL print jobs. Interface +scripts are specific to printer models. They have a similar role as +PPDs for PostScript printers. Interface scripts may inject the Escape +sequences as required into the print data stream, if the user has +chosen to select a certain paper tray, or print landscape, or use A3 +paper, etc. Interfaces scripts are practically unknown in the Linux +realm. On HP-UX platforms they are more often used. You can use any +working interface script on CUPS too. Just install the printer with +the -i option: +

    +
+ lpadmin -p pclprinter -v socket://11.12.13.14:9100 -i /path/to/interface-script
+
+

    +Interface scripts might be the "unknown animal" to many. However, +with CUPS they provide the most easy way to plug in your own +custom-written filtering script or program into one specific print +queue (some information about the traditional usage of interface scripts is +to be found at http://playground.sun.com/printing/documentation/interface.html). +

    Network printing (purely Windows)

    +Network printing covers a lot of ground. To understand what exactly +goes on with Samba when it is printing on behalf of its Windows +clients, let's first look at a "purely Windows" setup: Windows clients +with a Windows NT print server. +

    From Windows Clients to an NT Print Server

    +Windows clients printing to an NT-based print server have two +options. They may +

    • execute the driver locally and render the GDI output +(EMF) into the printer specific format on their own, +or

    • send the GDI output (EMF) to the server, where the +driver is executed to render the printer specific +output.

    +Both print paths are shown in the flowcharts below. +

    Driver Execution on the Client

    +In the first case the print server must spool the file as "raw", +meaning it shouldn't touch the jobfile and try to convert it in any +way. This is what traditional Unix-based print server can do too; and +at a better performance and more reliably than NT print server. This +is what most Samba administrators probably are familiar with. One +advantage of this setup is that this "spooling-only" print server may +be used even if no driver(s) for Unix are available it is sufficient +to have the Windows client drivers available and installed on the +clients. +

    +

    Figure 19.11. Print Driver execution on the Client

    Print Driver execution on the Client

    +

    Driver Execution on the Server

    +The other path executes the printer driver on the server. The clients +transfers print files in EMF format to the server. The server uses the +PostScript, PCL, ESC/P or other driver to convert the EMF file into +the printer-specific language. It is not possible for Unix to do the +same. Currently there is no program or method to convert a Windows +client's GDI output on a Unix server into something a printer could +understand. +

    +

    Figure 19.12. Print Driver execution on the Server

    Print Driver execution on the Server

    +

    +However, there is something similar possible with CUPS. Read on... +

    Network Printing (Windows clients -- UNIX/Samba Print +Servers)

    +Since UNIX print servers cannot execute the Win32 +program code on their platform, the picture is somewhat +different. However, this doesn't limit your options all that +much. In the contrary, you may have a way here to implement printing +features which are not possible otherwise. +

    From Windows Clients to a CUPS/Samba Print Server

    +Here is a simple recipe showing how you can take advantage of CUPS +powerful features for the benefit of your Windows network printing +clients: +

    • Let the Windows clients send PostScript to the CUPS +server.

    • Let the CUPS server render the PostScript into device +specific raster format.

    +This requires the clients to use a PostScript driver (even if the +printer is a non-PostScript model. It also requires that you have a +"driver" on the CUPS server. +

    +Firstly, to enable CUPS based printing through Samba the +following options should be set in your smb.conf file [globals] +section: +

    • printing = CUPS

    • printcap = CUPS

    +When these parameters are specified, all manually set print directives +(like print command =..., or lppause +command =...) in smb.conf (as well as +in samba itself) will be ignored. Instead, Samba will directly +interface with CUPS through it's application program interface (API) - +as long as Samba has been compiled with CUPS library (libcups) +support. If Samba has NOT been compiled with CUPS support, and if no +other print commands are set up, then printing will use the +System V AT&T command set, with the -oraw +option automatically passing through (if you want your own defined +print commands to work with a Samba that has CUPS support compiled in, +simply use printing = sysv). +

    +

    Figure 19.13. Printing via CUPS/samba server

    Printing via CUPS/samba server

    +

    Samba receiving Jobfiles and passing them to CUPS

    +Samba must use its own spool directory (it is set +by a line similar to path = /var/spool/samba, +in the [printers] or +[printername] section of +smb.conf). Samba receives the job in its own +spool space and passes it into the spool directory of CUPS (the CUPS +spooling directory is set by the RequestRoot +directive, in a line that defaults to RequestRoot +/var/spool/cups). CUPS checks the access rights of its +spool dir and resets it to healthy values with every re-start. We have +seen quite some people who had used a common spooling space for Samba +and CUPS, and were struggling for weeks with this "problem". +

    +A Windows user authenticates only to Samba (by whatever means is +configured). If Samba runs on the same host as CUPS, you only need to +allow "localhost" to print. If they run on different machines, you +need to make sure the Samba host gets access to printing on CUPS. +

    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs

    +PPDs can control all print device options. They are usually provided +by the manufacturer; if you own a PostScript printer, that is. PPD +files (PostScript Printer Descriptions) are always a component of +PostScript printer drivers on MS Windows or Apple Mac OS systems. They +are ASCII files containing user-selectable print options, mapped to +appropriate PostScript, PCL or PJL commands for the target +printer. Printer driver GUI dialogs translate these options +"on-the-fly" into buttons and drop-down lists for the user to select. +

    +CUPS can load, without any conversions, the PPD file from any Windows +(NT is recommended) PostScript driver and handle the options. There is +a web browser interface to the print options (select http://localhost:631/printers/ +and click on one Configure Printer button to see +it), or a commandline interface (see man lpoptions +or see if you have lphelp on your system). There are also some +different GUI frontends on Linux/UNIX, which can present PPD options +to users. PPD options are normally meant to be evaluated by the +PostScript RIP on the real PostScript printer. +

    PPDs for non-PS Printers on UNIX

    +CUPS doesn't limit itself to "real" PostScript printers in its usage +of PPDs. The CUPS developers have extended the scope of the PPD +concept, to also describe available device and driver options for +non-PostScript printers through CUPS-PPDs. +

    +This is logical, as CUPS includes a fully featured PostScript +interpreter (RIP). This RIP is based on Ghostscript. It can process +all received PostScript (and additionally many other file formats) +from clients. All CUPS-PPDs geared to non-PostScript printers contain +an additional line, starting with the keyword +*cupsFilter . This line tells the CUPS print +system which printer-specific filter to use for the interpretation of +the supplied PostScript. Thus CUPS lets all its printers appear as +PostScript devices to its clients, because it can act as a PostScript +RIP for those printers, processing the received PostScript code into a +proper raster print format. +

    PPDs for non-PS Printers on Windows

    +CUPS-PPDs can also be used on Windows-Clients, on top of a +"core" PostScript driver (now recommended is the "CUPS PostScript +Driver for WindowsNT/2K/XP"; you can also use the Adobe one, with +limitations). This feature enables CUPS to do a few tricks no other +spooler can do: +

    • act as a networked PostScript RIP (Raster Image +Processor), handling printfiles from all client platforms in a uniform +way;

    • act as a central accounting and billing server, since +all files are passed through the pstops filter and are therefore +logged in the CUPS page_log file. +NOTE: this can not happen with "raw" print jobs, +which always remain unfiltered per definition;

    • enable clients to consolidate on a single PostScript +driver, even for many different target printers.

    +Using CUPS PPDs on Windows clients enables these to control +all print job settings just as a UNIX client can do too. +

    Windows Terminal Servers (WTS) as CUPS Clients

    +This setup may be of special interest to people experiencing major +problems in WTS environments. WTS need often a multitude of +non-PostScript drivers installed to run their clients' variety of +different printer models. This often imposes the price of much +increased instability. +

    Printer Drivers running in "Kernel Mode" cause many +Problems

    +The reason is that in Win NT printer drivers run in "Kernel +Mode", this introduces a high risk for the stability of the system +if the driver is not really stable and well-tested. And there are a +lot of bad drivers out there! Especially notorious is the example +of the PCL printer driver that had an additional sound module +running, to notify users via soundcard of their finished jobs. Do I +need to say that this one was also reliably causing "Blue Screens +of Death" on a regular basis? +

    +PostScript drivers generally are very well tested. They are not known +to cause any problems, even though they run in Kernel Mode too. This +might be because there have so far only been 2 different PostScript +drivers the ones from Adobe and the one from Microsoft. Both are +very well tested and are as stable as you ever can imagine on +Windows. The CUPS driver is derived from the Microsoft one. +

    Workarounds impose Heavy Limitations

    +In many cases, in an attempt to work around this problem, site +administrators have resorted to restrict the allowed drivers installed +on their WTS to one generic PCL- and one PostScript driver. This +however restricts the clients in the amount of printer options +available for them; often they can't get out more than simplex +prints from one standard paper tray, while their devices could do much +better, if driven by a different driver! ) +

    CUPS: a "Magical Stone"?

    +Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very +elegant way to overcome all these shortcomings. There are, depending +on the version of Windows OS you use, up to 3 different PostScript +drivers available: Adobe, Microsoft and CUPS PostScript drivers. None +of them is known to cause major stability problems on WTS (even if +used with many different PPDs). The clients will be able to (again) +chose paper trays, duplex printing and other settings. However, there +is a certain price for this too: a CUPS server acting as a PostScript +RIP for its clients requires more CPU and RAM than when just acting as +a "raw spooling" device. Plus, this setup is not yet widely tested, +although the first feedbacks look very promising. +

    PostScript Drivers with no major problems -- even in Kernel +Mode

    +More recent printer drivers on W2K and XP don't run in Kernel mode +(unlike Win NT) any more. However, both operating systems can still +use the NT drivers, running in Kernel mode (you can roughly tell which +is which as the drivers in subdirectory "2" of "W32X86" are "old" +ones). As was said before, the Adobe as well as the Microsoft +PostScript drivers are not known to cause any stability problems. The +CUPS driver is derived from the Microsoft one. There is a simple +reason for this: The MS DDK (Device Development Kit) for Win NT (which +used to be available at no cost to licensees of Visual Studio) +includes the source code of the Microsoft driver, and licensees of +Visual Studio are allowed to use and modify it for their own driver +development efforts. This is what the CUPS people have done. The +license doesn't allow them to publish the whole of the source code. +However, they have released the "diff" under the GPL, and if you are +owner of an "MS DDK for Win NT", you can check the driver yourself. +

    Setting up CUPS for driver Download

    +As we have said before: all previously known methods to prepare client +printer drivers on the Samba server for download and "Point'n'Print" +convenience of Windows workstations are working with CUPS too. These +methods were described in the previous chapter. In reality, this is a +pure Samba business, and only relates to the Samba/Win client +relationship. +

    cupsaddsmb: the unknown Utility

    +The cupsaddsmb utility (shipped with all current CUPS versions) is an +alternative method to transfer printer drivers into the Samba +[print$] share. Remember, this share is where +clients expect drivers deposited and setup for download and +installation. It makes the sharing of any (or all) installed CUPS +printers very easy. cupsaddsmb can use the Adobe PostScript driver as +well as the newly developed CUPS PostScript Driver for +WinNT/2K/XP. Note, that cupsaddsmb does +not work with arbitrary vendor printer drivers, +but only with the exact driver files that are +named in its man page. +

    +The CUPS printer driver is available from the CUPS download site. Its +package name is cups-samba-[version].tar.gz . It +is preferred over the Adobe drivers since it has a number of +advantages: +

    • it supports a much more accurate page +accounting;

    • it supports banner pages, and page labels on all +printers;

    • it supports the setting of a number of job IPP +attributes (such as job-priority, page-label and +job-billing)

    +However, currently only Windows NT, 2000, and XP are supported by the +CUPS drivers. You will need to get the respective part of Adobe driver +too if you need to support Windows 95, 98, and ME clients. +

    Prepare your smb.conf for +cupsaddsmb

    +Prior to running cupsaddsmb, you need the following settings in +smb.conf: +

    +
+ [global]
+         load printers = yes
+         printing = cups
+         printcap name = cups
+
+ [printers]
+         comment = All Printers
+         path = /var/spool/samba
+         browseable = no
+         public = yes
+         guest ok = yes           # setting depends on your requirements
+         writable = no
+         printable = yes
+         printer admin = root
+
+ [print$]
+         comment = Printer Drivers
+         path = /etc/samba/drivers
+         browseable = yes
+         guest ok = no
+         read only = yes
+         write list = root  
+
+

    CUPS Package of "PostScript Driver for WinNT/2k/XP"

    +CUPS users may get the exactly same packages fromhttp://www.cups.org/software.html. +It is a separate package from the CUPS base software files, tagged as +CUPS 1.1.x Windows NT/2k/XP Printer Driver for SAMBA +(tar.gz, 192k). The filename to download is +cups-samba-1.1.x.tar.gz. Upon untar-/unzip-ing, +it will reveal these files: +

    +
+# tar xvzf cups-samba-1.1.19.tar.gz 
+
+   cups-samba.install
+   cups-samba.license
+   cups-samba.readme
+   cups-samba.remove
+   cups-samba.ss
+
+

    +These have been packaged with the ESP meta packager software +"EPM". The *.install and +*.remove files are simple shell scripts, which +untars the *.ss (the *.ss is +nothing else but a tar-archive, which can be untar-ed by "tar" +too). Then it puts the content into +/usr/share/cups/drivers/. This content includes 3 +files: +

    +
+# tar tv cups-samba.ss
+
+    cupsdrvr.dll
+    cupsui.dll
+    cups.hlp  
+
+

    +The cups-samba.install shell scripts is easy to +handle: +

    +
+# ./cups-samba.install
+
+   [....]
+   Installing software...
+   Updating file permissions...
+   Running post-install commands...
+   Installation is complete.        
+
+

    +The script should automatically put the driver files into the +/usr/share/cups/drivers/ directory. +

    Warning

    +Due to a bug, one recent CUPS release puts the +cups.hlp driver file +into/usr/share/drivers/ instead of +/usr/share/cups/drivers/. To work around this, +copy/move the file (after running the +./cups-samba.install script) manually to the +right place. +

    +
+   cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/
+
+

    +This new CUPS PostScript driver is currently binary-only, but free of +charge. No complete source code is provided (yet). The reason is this: +it has been developed with the help of the Microsoft Driver +Developer Kit (DDK) and compiled with Microsoft Visual +Studio 6. Driver developers are not allowed to distribute the whole of +the source code as Free Software. However, CUPS developers released +the "diff" in source code under the GPL, so anybody with a license of +Visual Studio and a DDK will be able to compile for him/herself. +

    Recognize the different Driver Files

    +The CUPS drivers don't support the "older" Windows 95/98/ME, but only +the Windows NT/2000/XP client: +

    +
+ [Windows NT, 2000, and XP are supported by:]
+         cups.hlp
+         cupsdrvr.dll
+         cupsui.dll
+
+

    +Adobe drivers are available for the older Windows 95/98/ME as well as +the Windows NT/2000/XP clients. The set of files is different for the +different platforms. +

    +
+ [Windows 95, 98, and Me are supported by:]
+         ADFONTS.MFM
+         ADOBEPS4.DRV
+         ADOBEPS4.HLP
+         DEFPRTR2.PPD
+         ICONLIB.DLL
+         PSMON.DLL
+
+ [Windows NT, 2000, and XP are supported by:]
+         ADOBEPS5.DLL
+         ADOBEPSU.DLL
+         ADOBEPSU.HLP
+
+

    Note

    +If both, the Adobe driver files and the CUPS driver files for the +support of WinNT/2k/XP are present in , the Adobe ones will be ignored +and the CUPS ones will be used. If you prefer -- for whatever reason +-- to use Adobe-only drivers, move away the 3 CUPS driver files. The +Win95/98/ME clients use the Adobe drivers in any case. +

    Acquiring the Adobe Driver Files

    +Acquiring the Adobe driver files seems to be unexpectedly difficult +for many users. They are not available on the Adobe website as single +files and the self-extracting and/or self-installing Windows-exe is +not easy to locate either. Probably you need to use the included +native installer and run the installation process on one client +once. This will install the drivers (and one Generic PostScript +printer) locally on the client. When they are installed, share the +Generic PostScript printer. After this, the client's +[print$] share holds the Adobe files, from +where you can get them with smbclient from the CUPS host. A more +detailed description about this is in the next (the CUPS printing) +chapter. +

    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"

    +Users of the ESP Print Pro software are able to install their "Samba +Drivers" package for this purpose with no problem. Retrieve the driver +files from the normal download area of the ESP Print Pro software +athttp://www.easysw.com/software.html. +You need to locate the link labelled "SAMBA" amongst the +Download Printer Drivers for ESP Print Pro 4.x +area and download the package. Once installed, you can prepare any +driver by simply highlighting the printer in the Printer Manager GUI +and select Export Driver... from the menu. Of +course you need to have prepared Samba beforehand too to handle the +driver files; i.e. mainly setup the [print$] +share, etc. The ESP Print Pro package includes the CUPS driver files +as well as a (licensed) set of Adobe drivers for the Windows 95/98/ME +client family. +

    Caveats to be considered

    +Once you have run the install script (and possibly manually +moved the cups.hlp file to +/usr/share/cups/drivers/), the driver is +ready to be put into Samba's [print$] share (which often maps to +/etc/samba/drivers/ and contains a subdir +tree with WIN40 and +W32X86 branches): You do this by running +"cupsaddsmb" (see also man cupsaddsmb for +CUPS since release 1.1.16). +

    Tip

    +You may need to put root into the smbpasswd file by running +smbpasswd; this is especially important if you +should run this whole procedure for the first time, and are not +working in an environment where everything is configured for +Single Sign On to a Windows Domain Controller. +

    +Once the driver files are in the [print$] share +and are initialized, they are ready to be downloaded and installed by +the Win NT/2k/XP clients. +

    Note

    +

    1. +Win 9x/ME clients won't work with the CUPS PostScript driver. For +these you'd still need to use the ADOBE*.* +drivers as previously. +

    2. +It is not harmful if you still have the +ADOBE*.* driver files from previous +installations in the /usr/share/cups/drivers/ +directory. The new cupsaddsmb (from 1.1.16) will +automatically prefer "its own" drivers if it finds both. +

    3. +Should your Win clients have had the old ADOBE*.* +files for the Adobe PostScript driver installed, the download and +installation of the new CUPS PostScript driver for Windows NT/2k/XP +will fail at first. You need to wipe the old driver from the clients +first. It is not enough to "delete" the printer, as the driver files +will still be kept by the clients and re-used if you try to re-install +the printer. To really get rid of the Adobe driver files on the +clients, open the "Printers" folder (possibly via Start +--> Settings --> Control Panel --> Printers), +right-click onto the folder background and select Server +Properties. When the new dialog opens, select the +Drivers tab. On the list select the driver you +want to delete and click on the Delete +button. This will only work if there is not one single printer left +which uses that particular driver. You need to "delete" all printers +using this driver in the "Printers" folder first. You will need +Administrator privileges to do this. +

    4. +Once you have successfully downloaded the CUPS PostScript driver to a +client, you can easily switch all printers to this one by proceeding +as described elsewhere in the "Samba HOWTO Collection": either change +a driver for an existing printer by running the "Printer Properties" +dialog, or use rpcclient with the +setdriver sub-command. +

    +

    What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver?

    +You are interested in a comparison between the CUPS and the Adobe +PostScript drivers? For our purposes these are the most important +items which weigh in favor of the CUPS ones: +

    • no hassle with the Adobe EULA

    • no hassle with the question “Where do I +get the ADOBE*.* driver files from?”

    • the Adobe drivers (on request of the printer PPD +associated with them) often put a PJL header in front of the main +PostScript part of the print file. Thus the printfile starts with +<1B >%-12345X or +<escape>%-12345X instead +of %!PS). This leads to the +CUPS daemon auto-typing the incoming file as a print-ready file, +not initiating a pass through the "pstops" filter (to speak more +technically, it is not regarded as the generic MIME type +application/postscript, but as +the more special MIME type +application/cups.vnd-postscript), +which therefore also leads to the page accounting in +/var/log/cups/page_log not +receiving the exact number of pages; instead the dummy page number +of "1" is logged in a standard setup)

    • the Adobe driver has more options to "mis-configure" the +PostScript generated by it (like setting it inadvertently to +Optimize for Speed, instead of +Optimize for Portability, which +could lead to CUPS being unable to process it)

    • the CUPS PostScript driver output sent by Windows +clients to the CUPS server will be guaranteed to be auto-typed always +as generic MIME type application/postscript, +thusly passing through the CUPS "pstops" filter and logging the +correct number of pages in the page_log for +accounting and quota purposes

    • the CUPS PostScript driver supports the sending of +additional standard (IPP) print options by Win NT/2k/XP clients. Such +additional print options are: naming the CUPS standard +banner pages (or the custom ones, should they be +installed at the time of driver download), using the CUPS +page-label option, setting a +job-priority and setting the scheduled +time of printing (with the option to support additional +useful IPP job attributes in the future).

    • the CUPS PostScript driver supports the inclusion of +the new *cupsJobTicket comments at the +beginning of the PostScript file (which could be used in the future +for all sort of beneficial extensions on the CUPS side, but which will +not disturb any other applications as they will regard it as a comment +and simply ignore it).

    • the CUPS PostScript driver will be the heart of the +fully fledged CUPS IPP client for Windows NT/2K/XP to be released soon +(probably alongside the first Beta release for CUPS +1.2).

    Run "cupsaddsmb" (quiet Mode)

    +The cupsaddsmb command copies the needed files into your +[print$] share. Additionally, the PPD +associated with this printer is copied from +/etc/cups/ppd/ to +[print$]. There the files wait for convenient +Windows client installations via Point'n'Print. Before we can run the +command successfully, we need to be sure that we can authenticate +towards Samba. If you have a small network you are probably using user +level security (security = user). Probably your +root has already a Samba account. Otherwise, create it now, using +smbpasswd: +

    +
+ #  smbpasswd -a root 
+ New SMB password: [type in password 'secret']
+ Retype new SMB password: [type in password 'secret']
+
+

    +Here is an example of a successfully run cupsaddsmb command. +

    +
+ #  cupsaddsmb -U root infotec_IS2027
+ Password for root required to access localhost via SAMBA: [type in password 'secret']
+
+

    +To share all printers and drivers, use the +-a parameter instead of a printer name. Since +cupsaddsmb "exports" the printer drivers to Samba, it should be +obvious that it only works for queues with a CUPS driver associated. +

    Run "cupsaddsmb" with verbose Output

    +Probably you want to see what's going on. Use the +-v parameter to get a more verbose output. The +output below was edited for better readability: all "\" at the end of +a line indicate that I inserted an artificial line break plus some +indentation here: +

    Warning

    +You will see the root password for the Samba account printed on +screen. If you use remote access, the password will go over the wire +unencrypted! +

    +
+  # cupsaddsmb -U root -v infotec_2105
+  Password for root required to access localhost via SAMBA:
+  Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir W32X86;put   \
+                   /var/spool/cups/tmp/3e98bf2d333b5 W32X86/infotec_2105.ppd;put           \
+                   /usr/share/cups/drivers/cupsdrvr.dll W32X86/cupsdrvr.dll;put            \
+                   /usr/share/cups/drivers/cupsui.dll W32X86/cupsui.dll;put                \
+                   /usr/share/cups/drivers/cups.hlp W32X86/cups.hlp'
+  added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+  Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+  NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86
+  putting file /var/spool/cups/tmp/3e98bf2d333b5 as \W32X86/infotec_2105.ppd (2328.8 kb/s) \
+               (average 2328.8 kb/s)
+  putting file /usr/share/cups/drivers/cupsdrvr.dll as \W32X86/cupsdrvr.dll (9374.3 kb/s)  \
+               (average 5206.6 kb/s)
+  putting file /usr/share/cups/drivers/cupsui.dll as \W32X86/cupsui.dll (8107.2 kb/s)      \
+               (average 5984.1 kb/s)
+  putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp (3475.0 kb/s)          \
+               (average 5884.7 kb/s)
+  
+  Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows NT x86"   \
+                   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:   \
+                   RAW:NULL"'
+  cmd = adddriver "Windows NT x86" "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll: \
+                   cups.hlp:NULL:RAW:NULL"
+  Printer Driver infotec_2105 successfully installed.
+  
+  Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir WIN40;put    \
+                   /var/spool/cups/tmp/3e98bf2d333b5 WIN40/infotec_2105.PPD; put           \
+                   /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;put               \
+                   /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV;put             \
+                   /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP;put             \
+                   /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD;put             \
+                   /usr/share/cups/drivers/ICONLIB.DLL
+  WIN40/ICONLIB.DLL;put /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;'
+  added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+  Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+  NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40
+  putting file /var/spool/cups/tmp/3e98bf2d333b5 as \WIN40/infotec_2105.PPD (2328.8 kb/s)  \
+               (average 2328.8 kb/s)
+  putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM (9368.0 kb/s)     \
+               (average 6469.6 kb/s)
+  putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV (9958.2 kb/s)   \
+               (average 8404.3 kb/s)
+  putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP (8341.5 kb/s)   \
+               (average 8398.6 kb/s)
+  putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD (2195.9 kb/s)   \
+               (average 8254.3 kb/s)
+  putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL (8239.9 kb/s)     \
+               (average 8253.6 kb/s)
+  putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL (6222.2 kb/s)         \
+               (average 8188.5 kb/s)
+  
+  Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows 4.0"      \
+                   "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP:          \
+                   PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL,     \
+                   ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
+  cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:          \
+                   ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,  \
+                   PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"
+  Printer Driver infotec_2105 successfully installed.
+  
+  Running command: rpcclient localhost -N -U'root%secret'                                  \
+                             -c 'setdriver infotec_2105 infotec_2105'
+  cmd = setdriver infotec_2105 infotec_2105
+  Successfully set infotec_2105 to driver infotec_2105.
+
+

    +If you look closely, you'll discover your root password was transfered +unencrypted over the wire, so beware! Also, if you look further her, +you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in +between. They occur, because the directories WIN40 and W32X86 already +existed in the [print$] driver download share +(from a previous driver installation). They are harmless here. +

    Understanding cupsaddsmb

    +What has happened? What did cupsaddsmb do? There are five stages of +the procedure +

    1. call the CUPS server via IPP and request the +driver files and the PPD file for the named printer;

    2. store the files temporarily in the local +TEMPDIR (as defined in +cupsd.conf);

    3. connect via smbclient to the Samba server's + [print$] share and put the files into the + share's WIN40 (for Win95/98/ME) and W32X86/ (for WinNT/2k/XP) sub + directories;

    4. connect via rpcclient to the Samba server and +execute the "adddriver" command with the correct +parameters;

    5. connect via rpcclient to the Samba server a second +time and execute the "setdriver" command.

    +Note, that you can run the cupsaddsmb utility with parameters to +specify one remote host as Samba host and a second remote host as CUPS +host. Especially if you want to get a deeper understanding, it is a +good idea try it and see more clearly what is going on (though in real +life most people will have their CUPS and Samba servers run on the +same host): +

    +
+ # cupsaddsmb -H sambaserver -h cupsserver -v printername
+
+

    How to recognize if cupsaddsm completed successfully

    +You must always check if the utility completed +successfully in all fields. You need as a minimum these 3 messages +amongst the output: +

    1. Printer Driver infotec_2105 successfully +installed. # (for the W32X86 == WinNT/2K/XP +architecture...)

    2. Printer Driver infotec_2105 successfully +installed. # (for the WIN40 == Win9x/ME +architecture...)

    3. Successfully set [printerXPZ] to driver +[printerXYZ].

    +These messages probably not easily recognized in the general +output. If you run cupsaddsmb with the -a +parameter (which tries to prepare all active CUPS +printer drivers for download), you might miss if individual printers +drivers had problems to install properly. Here a redirection of the +output will help you analyze the results in retrospective. +

    Note

    +It is impossible to see any diagnostic output if you don't run +cupsaddsmb in verbose mode. Therefore we strongly recommend to not +use the default quiet mode. It will hide any problems from you which +might occur. +

    cupsaddsmb with a Samba PDC

    +You can't get the standard cupsaddsmb command to run on a Samba PDC? +You are asked for the password credential all over again and again and +the command just will not take off at all? Try one of these +variations: +

    +
+ # cupsaddsmb -U DOMAINNAME\\root -v printername
+ # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -v printername
+ # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -h cups-server -v printername
+
+

    +(Note the two backslashes: the first one is required to +"escape" the second one). +

    cupsaddsmb Flowchart

    +Here is a chart about the procedures, commandflows and +dataflows of the "cupaddsmb" command. Note again: cupsaddsmb is +not intended to, and does not work with, "raw" queues! +

    +

    Figure 19.14. cupsaddsmb flowchart

    cupsaddsmb flowchart

    +

    Installing the PostScript Driver on a Client

    +After cupsaddsmb completed, your driver is prepared for the clients to +use. Here are the steps you must perform to download and install it +via "Point'n'Print". From a Windows client, browse to the CUPS/Samba +server; +

    • open the Printers +share of Samba in Network Neighbourhood;

    • right-click on the printer in +question;

    • from the opening context-menu select +Install... or +Connect... (depending on the Windows version you +use).

    +After a few seconds, there should be a new printer in your +client's local "Printers" folder: On Windows +XP it will follow a naming convention of PrinterName on +SambaServer. (In my current case it is "infotec_2105 on +kde-bitshop"). If you want to test it and send your first job from +an application like Winword, the new printer will appears in a +\\SambaServer\PrinterName entry in the +dropdown list of available printers. +

    Note

    +cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher +and Samba from 2.2.4. If it doesn't work, or if the automatic printer +driver download to the clients doesn't succeed, you can still manually +install the CUPS printer PPD on top of the Adobe PostScript driver on +clients. Then point the client's printer queue to the Samba printer +share for a UNC type of connection: +

    +
+  net use lpt1: \\sambaserver\printershare /user:ntadmin
+
+

    +should you desire to use the CUPS networked PostScript RIP +functions. (Note that user "ntadmin" needs to be a valid Samba user +with the required privileges to access the printershare) This would +set up the printer connection in the traditional +LanMan way (not using MS-RPC). +

    Avoiding critical PostScript Driver Settings on the +Client

    +Soooo: printing works, but there are still problems. Most jobs print +well, some don't print at all. Some jobs have problems with fonts, +which don't look very good. Some jobs print fast, and some are +dead-slow. Many of these problems can be greatly reduced or even +completely eliminated if you follow a few guidelines. Remember, if +your print device is not PostScript-enabled, you are treating your +Ghostscript installation on your CUPS host with the output your client +driver settings produce. Treat it well: +

    • Avoid the PostScript Output Option: Optimize +for Speed setting. Rather use the Optimize for +Portability instead (Adobe PostScript +driver).

    • Don't use the Page Independence: +NO setting. Instead use Page Independence +YES (CUPS PostScript Driver)

    • Recommended is the True Type Font +Downloading Option: Native True Type over +Automatic and Outline; you +should by all means avoid Bitmap (Adobe +PostScript Driver)

    • Choose True Type Font: Download as Softfont +into Printer over the default Replace by Device +Font (for exotic fonts you may need to change it back to +get a printout at all) (Adobe)

    • Sometimes you can choose PostScript Language +Level: in case of problems try 2 +instead of 3 (the latest ESP Ghostscript package +handles Level 3 PostScript very well) (Adobe).

    • Say Yes to PostScript +Error Handler (Adobe)

    Installing PostScript Driver Files manually (using +rpcclient)

    +Of course you can run all the commands which are embedded into the +cupsaddsmb convenience utility yourself, one by one, and hereby upload +and prepare the driver files for future client downloads. +

    1. prepare Samba (a CUPS printqueue with the name of the +printer should be there. We are providing the driver +now);

    2. copy all files to +[print$]:

    3. run rpcclient adddriver +(for each client architecture you want to support):

    4. run rpcclient +setdriver.

    +We are going to do this now. First, read the man page on "rpcclient" +to get a first idea. Look at all the printing related +sub-commands. enumprinters, +enumdrivers, enumports, +adddriver, setdriver are amongst +the most interesting ones. rpcclient implements an important part of +the MS-RPC protocol. You can use it to query (and command) a Win NT +(or 2K/XP) PC too. MS-RPC is used by Windows clients, amongst other +things, to benefit from the "Point'n'Print" features. Samba can now +mimic this too. +

    A Check of the rpcclient man Page

    +First let's have a little check of the rpcclient man page. Here are +two relevant passages: +

    +adddriver <arch> <config> Execute an +AddPrinterDriver() RPC to install the printer driver information on +the server. Note that the driver files should already exist in the +directory returned by getdriverdir. Possible +values for arch are the same as those for the +getdriverdir command. The +config parameter is defined as follows: +

    +Long Printer Name:\
+Driver File Name:\
+Data File Name:\
+Config File Name:\
+Help File Name:\
+Language Monitor Name:\
+Default Data Type:\
+Comma Separated list of Files
+

    Any empty fields should be enter as the string "NULL".

    Samba does not need to support the concept of Print Monitors +since these only apply to local printers whose driver can make use of +a bi-directional link for communication. This field should be "NULL". +On a remote NT print server, the Print Monitor for a driver must +already be installed prior to adding the driver or else the RPC will +fail +

    +setdriver <printername> <drivername> +Execute a SetPrinter() command to update the +printer driver associated with an installed printer. The printer +driver must already be correctly installed on the print server. +

    See also the enumprinters and enumdrivers commands for +obtaining a list of installed printers and drivers. +

    Understanding the rpcclient man Page

    +The exact format isn't made too clear by the man +page, since you have to deal with some parameters containing +spaces. Here is a better description for it. We have line-broken the +command and indicated the breaks with "\". Usually you would type the +command in one line without the linebreaks: +

    +
+ adddriver "Architecture" \
+           "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\
+           LanguageMonitorFile:DataType:ListOfFiles,Comma-separated"
+
+

    +What the man pages denotes as a simple <config> +keyword, does in reality consist of 8 colon-separated fields. The +last field may take multiple (in some, very insane, cases, even +20 different additional files. This might sound confusing at first. +Note, that what the man pages names the "LongPrinterName" in +reality should rather be called the "Driver Name". You can name it +anything you want, as long as you use this name later in the +rpcclient ... setdriver command. For +practical reasons, many name the driver the same as the +printer. +

    +True: it isn't simple at all. I hear you asking: +How do I know which files are "Driver +File", "Data File", "Config File", "Help File" and "Language +Monitor File" in each case? -- For an answer you may +want to have a look at how a Windows NT box with a shared printer +presents the files to us. Remember, that this whole procedure has +to be developed by the Samba Team by overhearing the traffic caused +by Windows computers on the wire. We may as well turn to a Windows +box now, and access it from a UNIX workstation. We will query it +with rpcclient to see what it tells us and +try to understand the man page more clearly which we've read just +now. +

    Producing an Example by querying a Windows Box

    +We could run rpcclient with a +getdriver or a getprinter +subcommand (in level 3 verbosity) against it. Just sit down at UNIX or +Linux workstation with the Samba utilities installed. Then type the +following command: +

    +
+ rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3'
+
+

    +From the result it should become clear which is which. Here is an +example from my installation: +

    +
+# rpcclient -U'Danka%xxxx' W2KSERVER -c'getdriver "DANKA InfoStream Virtual Printer" 3'
+ cmd = getdriver "DANKA InfoStream Virtual Printer" 3
+
+ [Windows NT x86]
+ Printer Driver Info 3:
+         Version: [2]
+         Driver Name: [DANKA InfoStream]
+         Architecture: [Windows NT x86]
+         Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRIPT.DLL]
+         Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\INFOSTRM.PPD]
+         Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRPTUI.DLL]
+         Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\PSCRIPT.HLP]
+ 
+         Dependentfiles: []
+         Dependentfiles: []
+         Dependentfiles: []
+         Dependentfiles: []
+         Dependentfiles: []
+         Dependentfiles: []
+         Dependentfiles: []
+ 
+         Monitorname: []
+         Defaultdatatype: []
+
+

    +Some printer drivers list additional files under the label +"Dependentfiles": these would go into the last field +ListOfFiles,Comma-separated. For the CUPS +PostScript drivers we don't need any (nor would we for the Adobe +PostScript driver): therefore the field will get a "NULL" entry. +

    What is required for adddriver and setdriver to succeed

    +From the manpage (and from the quoted output +of cupsaddsmb, above) it becomes clear that you +need to have certain conditions in order to make the manual uploading +and initializing of the driver files succeed. The two rpcclient +subcommands (adddriver and +setdriver) need to encounter the following +pre-conditions to complete successfully: +

    • you are connected as "printer admin", or root (note, +that this is not the "Printer Operators" group in +NT, but the printer admin group, as defined in +the [global] section of +smb.conf);

    • copy all required driver files to +\\sambaserver\print$\w32x86 and +\\sambaserver\print$\win40 as appropriate. They +will end up in the "0" respective "2" subdirectories later -- for now +don't put them there, they'll be automatically +used by the adddriver subcommand.! (if you use +"smbclient" to put the driver files into the share, note that you need +to escape the "$": smbclient //sambaserver/print\$ -U +root);

    • the user you're connecting as must be able to write to +the [print$] share and create +subdirectories;

    • the printer you are going to setup for the Windows +clients, needs to be installed in CUPS already;

    • the CUPS printer must be known to Samba, otherwise the +setdriver subcommand fails with an +NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by +Samba you may use the enumprinters subcommand to +rpcclient. A long-standing bug prevented a proper update of the +printer list until every smbd process had received a SIGHUP or was +restarted. Remember this in case you've created the CUPS printer just +shortly ago and encounter problems: try restarting +Samba.

    Manual Commandline Driver Installation in 15 little Steps

    +We are going to install a printer driver now by manually executing all +required commands. As this may seem a rather complicated process at +first, we go through the procedure step by step, explaining every +single action item as it comes up. +

    First Step: Install the Printer on CUPS

    +
+# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P /home/kurt/canonIR85.ppd
+
+

    +This installs printer with the name mysmbtstprn +to the CUPS system. The printer is accessed via a socket +(a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root +for this step +

    Second Step (optional): Check if the Printer is recognized by +Samba

    +
+ # rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn
+
+        flags:[0x800000]
+        name:[\\kde-bitshop\mysmbtstprn]
+        description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn]
+        comment:[mysmbtstprn]
+
+

    +This should show the printer in the list. If not, stop and re-start +the Samba daemon (smbd), or send a HUP signal: kill -HUP +`pidof smbd`. Check again. Troubleshoot and repeat until +success. Note the "empty" field between the two commas in the +"description" line. Here would the driver name appear if there was one +already. You need to know root's Samba password (as set by the +smbpasswd command) for this step and most of the +following steps. Alternatively you can authenticate as one of the +users from the "write list" as defined in smb.conf for +[print$]. +

    Third Step (optional): Check if Samba knows a Driver for the +Printer

    +
+#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
+         drivername:[]
+ 
+#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv
+        servername:[\\kde-bitshop]
+        printername:[\\kde-bitshop\mysmbtstprn]
+        sharename:[mysmbtstprn]
+        portname:[Samba Printer Port]
+        drivername:[]
+        comment:[mysmbtstprn]
+        location:[]
+        sepfile:[]
+        printprocessor:[winprint]
+ 
+#  rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
+ result was WERR_UNKNOWN_PRINTER_DRIVER
+
+

    +Neither method of the three commands shown above should show a driver. +This step was done for the purpose of demonstrating this condition. An +attempt to connect to the printer at this stage will prompt the +message along the lines: "The server has not the required printer +driver installed". +

    Fourth Step: Put all required Driver Files into Samba's +[print$]

    +
+#  smbclient //localhost/print\$ -U 'root%xxxx'                        \ 
+                              -c 'cd W32X86;                                             \
+                                  put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD;     \
+                                  put /usr/share/cups/drivers/cupsui.dll cupsui.dll;     \
+                                  put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \
+                                  put /usr/share/cups/drivers/cups.hlp cups.hlp'
+
+

    +(Note that this command should be entered in one long single +line. Line-breaks and the line-end indicating "\" has been inserted +for readability reasons.) This step is required +for the next one to succeed. It makes the driver files physically +present in the [print$] share. However, clients +would still not be able to install them, because Samba does not yet +treat them as driver files. A client asking for the driver would still +be presented with a "not installed here" message. +

    Fifth Step: Verify where the Driver Files are now

    +
+#  ls -l /etc/samba/drivers/W32X86/
+ total 669
+ drwxr-sr-x    2 root     ntadmin       532 May 25 23:08 2
+ drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
+ -rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
+ -rwxr--r--    1 root     ntadmin    278380 May 25 23:21 cupsdrvr.dll
+ -rwxr--r--    1 root     ntadmin    215848 May 25 23:21 cupsui.dll
+ -rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
+
+

    +The driver files now are in the W32X86 architecture "root" of +[print$]. +

    Sixth Step: Tell Samba that these are +Driver Files +(adddriver)

    +
+#  rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \
+                                          cupsdrvr.dll:mysmbtstprn.PPD:                  \
+                                          cupsui.dll:cups.hlp:NULL:RAW[:]NULL"             \
+                                          localhost
+
+ Printer Driver mydrivername successfully installed.
+
+

    +Note that your cannot repeat this step if it fails. It could fail even +as a result of a simple typo. It will most likely have moved a part of +the driver files into the "2" subdirectory. If this step fails, you +need to go back to the fourth step and repeat it, before you can try +this one again. In this step you need to choose a name for your +driver. It is normally a good idea to use the same name as is used for +the printername; however, in big installations you may use this driver +for a number of printers which have obviously different names. So the +name of the driver is not fixed. +

    Seventh Step: Verify where the Driver Files are now

    +
+#  ls -l /etc/samba/drivers/W32X86/
+ total 1
+ drwxr-sr-x    2 root     ntadmin       532 May 25 23:22 2
+ drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
+
+ 
+#  ls -l /etc/samba/drivers/W32X86/2
+ total 5039
+ [....]
+ -rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
+ -rwxr--r--    1 root     ntadmin    278380 May 13 13:53 cupsdrvr.dll
+ -rwxr--r--    1 root     ntadmin    215848 May 13 13:53 cupsui.dll
+ -rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
+
+

    +Notice how step 6 did also move the driver files to the appropriate +subdirectory. Compare with the situation after step 5. +

    Eighth Step (optional): Verify if Samba now recognizes the +Driver

    +
+#  rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost | grep -B2 -A5 mydrivername
+
+ Printer Driver Info 3:
+        Version: [2]
+        Driver Name: [mydrivername]
+        Architecture: [Windows NT x86]
+        Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
+        Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
+        Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
+        Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
+
+

    +Remember, this command greps for the name you did choose for the +driver in step Six. This command must succeed before you can proceed. +

    Ninth Step: Tell Samba which Printer should use these Driver +Files (setdriver)

    +
+#  rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost
+ 
+ Successfully set mysmbtstprn to driver mydrivername
+
+

    +Since you can bind any printername (=printqueue) to any driver, this +is a very convenient way to setup many queues which use the same +driver. You don't need to repeat all the previous steps for the +setdriver command to succeed. The only pre-conditions are: +enumdrivers must find the driver and +enumprinters must find the printer. +

    Tenth Step (optional): Verify if Samba has this Association +recognized

    +
+#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
+       drivername:[mydrivername]
+ 
+#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv
+       servername:[\\kde-bitshop]
+       printername:[\\kde-bitshop\mysmbtstprn]
+       sharename:[mysmbtstprn]
+       portname:[Done]
+       drivername:[mydrivername]
+       comment:[mysmbtstprn]
+       location:[]
+       sepfile:[]
+       printprocessor:[winprint]
+ 
+#  rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
+ [Windows NT x86]
+ Printer Driver Info 3:
+       Version: [2]
+       Driver Name: [mydrivername]
+       Architecture: [Windows NT x86]
+       Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
+       Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
+       Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
+       Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
+       Monitorname: []
+       Defaultdatatype: [RAW]
+       Monitorname: []
+       Defaultdatatype: [RAW]
+ 
+#  rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn
+       name:[\\kde-bitshop\mysmbtstprn]
+       description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn]
+       comment:[mysmbtstprn]
+
+

    +Compare these results with the ones from steps 2 and 3. Note that +every single of these commands show the driver is installed. Even +the enumprinters command now lists the driver +on the "description" line. +

    Eleventh Step (optional): Tickle the Driver into a correct +Device Mode

    +You certainly know how to install the driver on the client. In case +you are not particularly familiar with Windows, here is a short +recipe: browse the Network Neighbourhood, go to the Samba server, look +for the shares. You should see all shared Samba printers. +Double-click on the one in question. The driver should get +installed, and the network connection set up. An alternative way is to +open the "Printers (and Faxes)" folder, right-click on the printer in +question and select "Connect" or "Install". As a result, a new printer +should have appeared in your client's local "Printers (and Faxes)" +folder, named something like "printersharename on Sambahostname". +

    +It is important that you execute this step as a Samba printer admin +(as defined in smb.conf). Here is another method +to do this on Windows XP. It uses a commandline, which you may type +into the "DOS box" (type root's smbpassword when prompted): +

    +
+ C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n \\sambacupsserver\mysmbtstprn"
+
+

    +Change any printer setting once (like "portrait" +--> "landscape"), click "Apply"; change the setting +back. +

    Twelfth Step: Install the Printer on a Client +("Point'n'Print")

    +
+ C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn"
+
+

    +If it doesn't work it could be a permission problem with the +[print$] share. +

    Thirteenth Step (optional): Print a Test Page

    +
+ C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn"
+
+

    +Then hit [TAB] 5 times, [ENTER] twice, [TAB] once and [ENTER] again +and march to the printer. +

    Fourteenth Step (recommended): Study the Test Page

    +Hmmm.... just kidding! By now you know everything about printer +installations and you don't need to read a word. Just put it in a +frame and bolt it to the wall with the heading "MY FIRST +RPCCLIENT-INSTALLED PRINTER" - why not just throw it away! +

    Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your +Success

    +
+# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd     
+
+

    Troubleshooting revisited

    +The setdriver command will fail, if in Samba's mind the queue is not +already there. You had promising messages about the: +

    +
+ Printer Driver ABC successfully installed.
+
+

    +after the "adddriver" parts of the procedure? But you are also seeing +a disappointing message like this one beneath? +

    +
+ result was NT_STATUS_UNSUCCESSFUL
+
+

    +It is not good enough that you +can see the queue in CUPS, using +the lpstat -p ir85wm command. A +bug in most recent versions of Samba prevents the proper update of +the queuelist. The recognition of newly installed CUPS printers +fails unless you re-start Samba or send a HUP to all smbd +processes. To verify if this is the reason why Samba doesn't +execute the setdriver command successfully, check if Samba "sees" +the printer: +

    +
+# rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep  ir85wm
+        printername:[ir85wm]
+
+

    +An alternative command could be this: +

    +
+# rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' 
+        cmd = getprinter ir85wm
+        flags:[0x800000]
+        name:[\\transmeta\ir85wm]
+        description:[\\transmeta\ir85wm,ir85wm,DPD]
+        comment:[CUPS PostScript-Treiber for WinNT/2K/XP]
+
+

    +BTW, you can use these commands, plus a few more, of course, +to install drivers on remote Windows NT print servers too! +

    The printing *.tdb Files

    +Some mystery is associated with the series of files with a +tdb-suffix appearing in every Samba installation. They are +connections.tdb, +printing.tdb, +share_info.tdb , +ntdrivers.tdb, +unexpected.tdb, +brlock.tdb , +locking.tdb, +ntforms.tdb, +messages.tdb , +ntprinters.tdb, +sessionid.tdb and +secrets.tdb. What is their purpose? +

    Trivial DataBase Files

    +A Windows NT (Print) Server keeps track of all information needed to serve +its duty toward its clients by storing entries in the Windows +"Registry". Client queries are answered by reading from the registry, +Administrator or user configuration settings are saved by writing into +the Registry. Samba and Unix obviously don't have such a kind of +Registry. Samba instead keeps track of all client related information in a +series of *.tdb files. (TDB = Trivial Data +Base). These are often located in /var/lib/samba/ +or /var/lock/samba/ . The printing related files +are ntprinters.tdb, +printing.tdb,ntforms.tdb and +ntdrivers.tdb. +

    Binary Format

    +*.tdb files are not human readable. They are +written in a binary format. "Why not ASCII?", you may ask. "After all, +ASCII configuration files are a good and proofed tradition on UNIX." +-- The reason for this design decision by the Samba Team is mainly +performance. Samba needs to be fast; it runs a separate +smbd process for each client connection, in some +environments many thousand of them. Some of these smbds might need to +write-access the same *.tdb file at the +same time. The file format of Samba's +*.tdb files allows for this provision. Many smbd +processes may write to the same *.tdb file at the +same time. This wouldn't be possible with pure ASCII files. +

    Losing *.tdb Files

    +It is very important that all *.tdb files remain +consistent over all write and read accesses. However, it may happen +that these files do get corrupted. (A +kill -9 `pidof smbd` while a write access is in +progress could do the damage as well as a power interruption, +etc.). In cases of trouble, a deletion of the old printing-related +*.tdb files may be the only option. You need to +re-create all print related setup after that. Or you have made a +backup of the *.tdb files in time. +

    Using tdbbackup

    +Samba ships with a little utility which helps the root user of your +system to back up your *.tdb files. If you run it +with no argument, it prints a little usage message: +

    +
+# tdbbackup
+ Usage: tdbbackup [options] <fname...>
+ 
+ Version:3.0a
+   -h            this help message
+   -s suffix     set the backup suffix
+   -v            verify mode (restore if corrupt)
+
+

    +Here is how I backed up my printing.tdb file: +

    +
+# ls 
+ .           browse.dat       locking.tdb     ntdrivers.tdb   printing.tdb    share_info.tdb
+ ..          connections.tdb  messages.tdb    ntforms.tdb     printing.tdbkp  unexpected.tdb
+ brlock.tdb  gmon.out         namelist.debug  ntprinters.tdb  sessionid.tdb
+ 
+ kde-bitshop:/var/lock/samba # tdbbackup -s .bak printing.tdb
+ printing.tdb : 135 records
+ 
+ kde-bitshop:/var/lock/samba # ls -l printing.tdb*
+ -rw-------    1 root     root        40960 May  2 03:44 printing.tdb
+ -rw-------    1 root     root        40960 May  2 03:44 printing.tdb.bak
+
+

    CUPS Print Drivers from Linuxprinting.org

    +CUPS ships with good support for HP LaserJet type printers. You can +install the generic driver as follows: +

    +
+lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
+
+

    +The -m switch will retrieve the +laserjet.ppd from the standard repository for +not-yet-installed-PPDs, which CUPS typically stores in +/usr/share/cups/model. Alternatively, you may use +-P /path/to/your.ppd. +

    +The generic laserjet.ppd however does not support every special option +for every LaserJet-compatible model. It constitutes a sort of "least +denominator" of all the models. If for some reason it is ruled out to +you to pay for the commercially available ESP Print Pro drivers, your +first move should be to consult the database on http://www.linuxprinting.org/printer_list.cgi. +Linuxprinting.org has excellent recommendations about which driver is +best used for each printer. Its database is kept current by the +tireless work of Till Kamppeter from MandrakeSoft, who is also the +principal author of the foomatic-rip utility. +

    Note

    +The former "cupsomatic" concept is now be replaced by the new, much +more powerful "foomatic-rip". foomatic-rip is the successor of +cupsomatic. cupsomatic is no longer maintained. Here is the new URL +to the Foomatic-3.0 database:http://www.linuxprinting.org/driver_list.cgi. +If you upgrade to foomatic-rip, don't forget to also upgrade to the +new-style PPDs for your foomatic-driven printers. foomatic-rip will +not work with PPDs generated for the old cupsomatic. The new-style +PPDs are 100% compliant to the Adobe PPD specification. They are +intended to be used by Samba and the cupsaddsmb utility also, to +provide the driver files for the Windows clients also! +

    foomatic-rip and Foomatic explained

    +Nowadays most Linux distros rely on the utilities of Linuxprinting.org +to create their printing related software (which, BTW, works on all +UNIXes and on Mac OS X or Darwin too). It is not known as well as it +should be, that it also has a very end-user friendly interface which +allows for an easy update of drivers and PPDs, for all supported +models, all spoolers, all operating systems and all package formats +(because there is none). Its history goes back a few years. +

    +Recently Foomatic has achieved the astonishing milestone of 1000 +listed printer models. Linuxprinting.org keeps all the +important facts about printer drivers, supported models and which +options are available for the various driver/printer combinations in +its Foomatic +database. Currently there are 245 drivers +in the database: many drivers support various models, and many models +may be driven by different drivers; it's your choice! +

    690 "perfect" Printers

    +At present there are 690 devices dubbed as working "perfectly", 181 +"mostly", 96 "partially" and 46 are "Paperweights". Keeping in mind +that most of these are non-PostScript models (PostScript printers are +automatically supported supported by CUPS to perfection, by using +their own manufacturer-provided Windows-PPD...), and that a +multifunctional device never qualifies as working "perfectly" if it +doesn't also scan and copy and fax under GNU/Linux: then this is a +truly astonishing achievement. Three years ago the number was not +more than 500, and Linux or UNIX "printing" at the time wasn't +anywhere near the quality it is today! +

    How the "Printing HOWTO" started it all

    +A few years ago Grant Taylor +started it all. The roots of today's Linuxprinting.org are in the +first Linux Printing +HOWTO which he authored. As a side-project to this document, +which served many Linux users and admins to guide their first steps in +this complicated and delicate setup (to a scientist, printing is +"applying a structured deposition of distinct patterns of ink or toner +particles on paper substrates" ;-), he started to +build in a little Postgres database with information about the +hardware and driver zoo that made up Linux printing of the time. This +database became the core component of today's Foomatic collection of +tools and data. In the meantime it has moved to an XML representation +of the data. +

    Foomatic's strange Name

    +"Why the funny name?", you ask. When it really took off, around spring +2000, CUPS was far less popular than today, and most systems used LPD, +LPRng or even PDQ to print. CUPS shipped with a few generic "drivers" +(good for a few hundred different printer models). These didn't +support many device-specific options. CUPS also shipped with its own +built-in rasterization filter ("pstoraster", derived from +Ghostscript). On the other hand, CUPS provided brilliant support for +controlling all printer options through +standardized and well-defined "PPD files" (PostScript Printers +Description files). Plus, CUPS was designed to be easily extensible. +

    +Grant already had in his database a respectable compilation +of facts about a many more printers, and the Ghostscript "drivers" +they run with. His idea, to generate PPDs from the database info +and use them to make standard Ghostscript filters work within CUPS, +proved to work very well. It also "killed several birds with one +stone": +

    • It made all current and future Ghostscript filter +developments available for CUPS;

    • It made available a lot of additional printer models +to CUPS users (because often the "traditional" Ghostscript way of +printing was the only one available);

    • It gave all the advanced CUPS options (web interface, +GUI driver configurations) to users wanting (or needing) to use +Ghostscript filters.

    cupsomatic, pdqomatic, lpdomatic, directomatic

    +CUPS worked through a quickly-hacked up filter script named cupsomatic. +cupsomatic ran the printfile through Ghostscript, constructing +automatically the rather complicated command line needed. It just +required to be copied into the CUPS system to make it work. To +"configure" the way cupsomatic controls the Ghostscript rendering +process, it needs a CUPS-PPD. This PPD is generated directly from the +contents of the database. For CUPS and the respective printer/filter +combo another Perl script named "CUPS-O-Matic" did the PPD +generation. After that was working, Grant implemented within a few +days a similar thing for two other spoolers. Names chosen for the +config-generator scripts were PDQ-O-Matic +(for PDQ) and LPD-O-Matic +(for - you guessed it - LPD); the configuration here didn't use PPDs +but other spooler-specific files. +

    +From late summer of that year, Till Kamppeter +started to put work into the database. Till had been newly employed by +MandrakeSoft to +convert their printing system over to CUPS, after they had seen his +FLTK-based XPP (a GUI frontend to +the CUPS lp-command). He added a huge amount of new information and new +printers. He also developed the support for other spoolers, like +PPR (via ppromatic), +GNUlpr and +LPRng (both via an extended +lpdomatic) and "spoolerless" printing (directomatic).... +

    +So, to answer your question: "Foomatic" is the general name for all +the overlapping code and data behind the "*omatic" scripts.... -- +Foomatic up to versions 2.0.x required (ugly) Perl data structures +attached the Linuxprinting.org PPDs for CUPS. It had a different +"*omatic" script for every spooler, as well as different printer +configuration files.. +

    7.13.1.5.The Grand Unification +achieved...

    +This all has changed in Foomatic versions 2.9 (Beta) and released as +"stable" 3.0. This has now achieved the convergence of all *omatic +scripts: it is called the foomatic-rip. +This single script is the unification of the previously different +spooler-specific *omatic scripts. foomatic-rip is used by all the +different spoolers alike. Because foomatic-rip can read PPDs (both the +original PostScript printer PPDs and the Linuxprinting.org-generated +ones), all of a sudden all supported spoolers can have the power of +PPDs at their disposal; users only need to plug "foomatic-rip" into +their system.... For users there is improved media type and source +support; paper sizes and trays are easier to configure. +

    +Also, the New Generation of Linuxprinting.org PPDs doesn't contain +Perl data structures any more. If you are a distro maintainer and have +used the previous version of Foomatic, you may want to give the new +one a spin: but don't forget to generate a new-version set of PPDs, +via the new foomatic-db-engine! +Individual users just need to generate a single new PPD specific to +their model by following +the steps outlined in the Foomatic tutorial or further +below. This new development is truly amazing. +

    +foomatic-rip is a very clever wrapper around the need to run +Ghostscript with a different syntax, different options, different +device selections and/or different filters for each different printer +or different spooler. At the same time it can read the PPD associated +with a print queue and modify the print job according to the user +selections. Together with this comes the 100% compliance of the new +Foomatic PPDs with the Adobe spec. Some really innovative features of +the Foomatic concept will surprise users: it will support custom paper +sizes for many printers; and it will support printing on media drawn +from different paper trays within the same job (in both cases: even +where there is no support for this from Windows-based vendor printer +drivers). +

    Driver Development outside

    +Most driver development itself does not happen within +Linuxprinting.org. Drivers are written by independent maintainers. +Linuxprinting.org just pools all the information, and stores it in its +database. In addition, it also provides the Foomatic glue to integrate +the many drivers into any modern (or legacy) printing system known to +the world. +

    +Speaking of the different driver development groups: most of +the work is currently done in three projects. These are: +

    • Omni +-- a Free Software project by IBM which tries to convert their printer +driver knowledge from good-ol' OS/2 times into a modern, modular, +universal driver architecture for Linux/Unix (still Beta). This +currently supports 437 models.

    • HPIJS -- +a Free Software project by HP to provide the support for their own +range of models (very mature, printing in most cases is perfect and +provides true photo quality). This currently supports 369 +models.

    • Gimp-Print -- a Free software +effort, started by Michael Sweet (also lead developer for CUPS), now +directed by Robert Krawitz, which has achieved an amazing level of +photo print quality (many Epson users swear that its quality is +better than the vendor drivers provided by Epson for the Microsoft +platforms). This currently supports 522 models.

    Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and +commercial Unix

    +Linuxprinting.org today is the one-stop "shop" to download printer +drivers. Look for printer information and tutorials +or solve printing problems in its popular forums. But +it's not just for GNU/Linux: users and admins of commercial UNIX +systems are also going there, and the relatively new Mac +OS X forum has turned out to be one of the most frequented +fora after only a few weeks. +

    +Linuxprinting.org and the Foomatic driver wrappers around Ghostscript +are now a standard toolchain for printing on all the important +distros. Most of them also have CUPS underneath. While in recent years +most printer data had been added by Till (who works at Mandrake), many +additional contributions came from engineers with SuSE, RedHat, +Connectiva, Debian and others. Vendor-neutrality is an important goal +of the Foomatic project. +

    Note

    +Till Kamppeter from MandrakeSoft is doing an excellent job in his +spare time to maintain Linuxprinting.org and Foomatic. So if you use +it often, please send him a note showing your appreciation. +

    Foomatic Database generated PPDs

    +The Foomatic database is an amazing piece of ingenuity in itself. Not +only does it keep the printer and driver information, but it is +organized in a way that it can generate "PPD" files "on the fly" from +its internal XML-based datasets. While these PPDs are modelled to the +Adobe specification of "PostScript Printer Descriptions" (PPDs), the +Linuxprinting.org/Foomatic-PPDs don't normally drive PostScript +printers: they are used to describe all the bells and whistles you +could ring or blow on an Epson Stylus inkjet, or a HP Photosmart or +what-have-you. The main "trick" is one little additional line, not +envisaged by the PPD specification, starting with the "*cupsFilter" +keyword: it tells the CUPS daemon how to proceed with the PostScript +print file (old-style Foomatic-PPDs named the +cupsomatic filter script, while the new-style +PPDs now call foomatic-rip). This filter +script calls Ghostscript on the host system (the recommended variant +is ESP Ghostscript) to do the rendering work. foomatic-rip knows which +filter or internal device setting it should ask from Ghostscript to +convert the PostScript printjob into a raster format ready for the +target device. This usage of PPDs to describe the options of non-PS +printers was the invention of the CUPS developers. The rest is easy: +GUI tools (like KDE's marvellous "kprinter", +or the GNOME "gtklp", "xpp" and the CUPS +web interface) read the PPD too and use this information to present +the available settings to the user as an intuitive menu selection. +

    foomatic-rip and Foomatic-PPD Download and Installation

    +Here are the steps to install a foomatic-rip driven "LaserJet 4 Plus" +compatible printer in CUPS (note that recent distributions of SuSE, +UnitedLinux and Mandrake may ship with a complete package of +Foomatic-PPDs plus the foomatic-rip utility. going directly to +Linuxprinting.org ensures you to get the latest driver/PPD files): +

    • Surf to http://www.linuxprinting.org/printer_list.cgi +

    • Check the complete list of printers in the database: +http://www.linuxprinting.org/printer_list.cgi?make=Anyone +

    • There select your model and click on the +link.

    • You'll arrive at a page listing all drivers working +with this model (for all printers, there will always be +one recommended driver. Try this one +first).

    • In our case ("HP LaserJet 4 Plus"), we'll arrive here: +http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus +

    • The recommended driver is "ljet4".

    • There are several links provided here. You should +visit them all, if you are not familiar with the Linuxprinting.org +database.

    • There is a link to the database page for the "ljet4": +http://www.linuxprinting.org/show_driver.cgi?driver=ljet4 +On the driver's page, you'll find important and detailed information +about how to use that driver within the various available +spoolers.

    • Another link may lead you to the homepage of the +driver author or the driver.

    • Important links are the ones which provide hints with +setup instructions for CUPS (http://www.linuxprinting.org/cups-doc.html), +PDQ (http://www.linuxprinting.org/pdq-doc.html), +LPD, LPRng and GNUlpr (http://www.linuxprinting.org/lpd-doc.html) +as well as PPR (http://www.linuxprinting.org/ppr-doc.html) +or "spooler-less" printing (http://www.linuxprinting.org/direct-doc.html +).

    • You can view the PPD in your browser through this +link: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1 +

    • You can also (most importantly) +generate and download the PPD: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=0 +

    • The PPD contains all the information needed to use our +model and the driver; this is, once installed, working transparently +for the user. Later you'll only need to choose resolution, paper size +etc. from the web-based menu, or from the print dialog GUI, or from +the commandline.

    • Should you have ended up on the driver's page (http://www.linuxprinting.org/show_driver.cgi?driver=ljet4), +you can choose to use the "PPD-O-Matic" online PPD generator +program.

    • Select the exact model and check either "download" or +"display PPD file" and click on "Generate PPD file".

    • If you save the PPD file from the browser view, please +don't use "cut'n'past" (since it could possibly damage line endings +and tabs, which makes the PPD likely to fail its duty), but use "Save +as..." in your browser's menu. (Best is to use the "download" option +from the web page directly).

    • Another very interesting part on each driver page is +the Show execution details button. If you +select your printer model and click that button, you will get +displayed a complete Ghostscript command line, enumerating all options +available for that driver/printermodel combo. This is a great way to +"Learn Ghostscript By Doing". It is also an excellent "cheat sheet" +for all experienced users who need to re-construct a good command line +for that damn printing script, but can't remember the exact +syntax. ;-)

    • Some time during your visit to Linuxprinting.org, save +the PPD to a suitable place on your harddisk, say +/path/to/my-printer.ppd (if you prefer to install +your printers with the help of the CUPS web interface, save the PPD to +the /usr/share/cups/model/ path and re-start +cupsd).

    • Then install the printer with a suitable commandline, +e.g.: +

      +
+lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd
+
+

    • Note again this: for all the new-style "Foomatic-PPDs" +from Linuxprinting.org, you also need a special "CUPS filter" named +"foomatic-rip".Get the latest version of "foomatic-rip" from: http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0 +

    • The foomatic-rip Perlscript itself also makes some +interesting reading (http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=1), +because it is very well documented by Till's inline comments (even +non-Perl hackers will learn quite a bit about printing by reading +it... ;-)

    • Save foomatic-rip either directly in +/usr/lib/cups/filter/foomatic-rip or somewhere in +your $PATH (and don't forget to make it world-executable). Again, +don't save by "copy'n'paste" but use the appropriate link, or the +"Save as..." menu item in your browser.

    • If you save foomatic-rip in your $PATH, create a symlink: +cd /usr/lib/cups/filter/ ; ln -s `which +foomatic-rip`. For CUPS to discover this new +available filter at startup, you need to re-start +cupsd.

    +Once you print to a printqueue set up with the Foomatic-PPD, CUPS will +insert the appropriate commands and comments into the resulting +PostScript jobfile. foomatic-rip is able to read and act upon +these. foomatic-rip uses some specially encoded Foomatic comments, +embedded in the jobfile. These in turn are used to construct +(transparently for you, the user) the complicated ghostscript command +line telling for the printer driver how exactly the resulting raster +data should look like and which printer commands to embed into the +data stream. +

    +You need: +

    • A "foomatic+something" PPD -- but it this not enough +to print with CUPS (it is only one important +component)

    • The "foomatic-rip" filter script (Perl) in +/usr/lib/cups/filters/

    • Perl to make foomatic-rip run

    • Ghostscript (because it is doing the main work, +controlled by the PPD/foomatic-rip combo) to produce the raster data +fit for your printermodel's consumption

    • Ghostscript must (depending on +the driver/model) contain support for a certain "device", representing +the selected "driver" for your model (as shown by "gs +-h")

    • foomatic-rip needs a new version of PPDs (PPD versions +produced for cupsomatic don't work with +foomatic-rip).

    Page Accounting with CUPS

    +Often there are questions regarding "print quotas" wherein Samba users +(that is, Windows clients) should not be able to print beyond a +certain amount of pages or data volume per day, week or month. This +feature is dependent on the real print subsystem you're using. +Samba's part is always to receive the job files from the clients +(filtered or unfiltered) and hand it over to this +printing subsystem. +

    +Of course one could "hack" things with one's own scripts. But then +there is CUPS. CUPS supports "quotas" which can be based on sizes of +jobs or on the number of pages or both, and are spanning any time +period you want. +

    Setting up Quotas

    +This is an example command how root would set a print quota in CUPS, +assuming an existing printer named "quotaprinter": +

    +
+  lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 -o job-page-limit=100
+
+

    +This would limit every single user to print 100 pages or 1024 KB of +data (whichever comes first) within the last 604,800 seconds ( = 1 +week). +

    Correct and incorrect Accounting

    +For CUPS to count correctly, the printfile needs to pass the CUPS +"pstops" filter, otherwise it uses a "dummy" count of "1". Some +printfiles don't pass it (eg: image files) but then those are mostly 1 +page jobs anyway. This also means that proprietary drivers for the +target printer running on the client computers and CUPS/Samba, which +then spool these files as "raw" (i.e. leaving them untouched, not +filtering them), will be counted as "1-pagers" too! +

    +You need to send PostScript from the clients (i.e. run a PostScript +driver there) to have the chance to get accounting done. If the +printer is a non-PostScript model, you need to let CUPS do the job to +convert the file to a print-ready format for the target printer. This +will be working for currently about 1,000 different printer models, +see http://www.linuxprinting.org/printer_list.cgi). +

    Adobe and CUPS PostScript Drivers for Windows Clients

    +Before CUPS-1.1.16 your only option was to use the Adobe PostScript +Driver on the Windows clients. The output of this driver was not +always passed through the "pstops" filter on the CUPS/Samba side, and +therefore was not counted correctly (the reason is that it often, +depending on the "PPD" being used, wrote a "PJL"-header in front of +the real PostScript which caused CUPS to skip pstops and go directly +to the "pstoraster" stage). +

    +From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver for +Windows NT/2K/XP clients" (which is tagged in the download area of +http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). It does +not work for Win9x/ME clients. But it guarantees: +

    • to not write an PJL-header

    • to still read and support all PJL-options named in the +driver PPD with its own means

    • that the file will pass through the "pstops" filter +on the CUPS/Samba server

    • to page-count correctly the +printfile

    +You can read more about the setup of this combination in the manpage +for "cupsaddsmb" (which is only present with CUPS installed, and only +current from CUPS 1.1.16). +

    The page_log File Syntax

    +These are the items CUPS logs in the "page_log" for every +single page of a job: +

    • Printer name

    • User name

    • Job ID

    • Time of printing

    • the page number

    • the number of copies

    • a billing information string +(optional)

    • the host which sent the job (included since version +1.1.19)

    +Here is an extract of my CUPS server's page_log file to illustrate the +format and included items: +

    +
+        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13
+        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13
+        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13
+        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13
+        DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33
+
+

    +This was job ID "401", printed on "infotec_IS2027" by user "kurt", a +64-page job printed in 3 copies and billed to "#marketing", sent +from IP address 10.160.50.13. The next job had ID "402", was sent by +user "boss" from IP address 10.160.51.33,printed from one page 440 +copies and is set to be billed to "finance-dep". +

    Possible Shortcomings

    +What flaws or shortcomings are there with this quota system? +

    • the ones named above (wrongly logged job in case of +printer hardware failure, etc.)

    • in reality, CUPS counts the job pages that are being +processed in software (that is, going through the +"RIP") rather than the physical sheets successfully leaving the +printing device. Thus if there is a jam while printing the 5th sheet out +of 1000 and the job is aborted by the printer, the "page count" will +still show the figure of 1000 for that job

    • all quotas are the same for all users (no flexibility +to give the boss a higher quota than the clerk) no support for +groups

    • no means to read out the current balance or the +"used-up" number of current quota

    • a user having used up 99 sheets of 100 quota will +still be able to send and print a 1,000 sheet job

    • a user being denied a job because of a filled-up quota +doesn't get a meaningful error message from CUPS other than +"client-error-not-possible".

    Future Developments

    +This is the best system currently available, and there are huge +improvements under development for CUPS 1.2: +

    • page counting will go into the "backends" (these talk +directly to the printer and will increase the count in sync with the +actual printing process: thus a jam at the 5th sheet will lead to a +stop in the counting)

    • quotas will be handled more flexibly

    • probably there will be support for users to inquire +their "accounts" in advance

    • probably there will be support for some other tools +around this topic

    Other Accounting Tools

    +PrintAnalyzer, pyKota, printbill, LogReport. +

    Additional Material

    +A printer queue with no PPD associated to it is a +"raw" printer and all files will go directly there as received by the +spooler. The exceptions are file types "application/octet-stream" +which need "passthrough feature" enabled. "Raw" queues don't do any +filtering at all, they hand the file directly to the CUPS backend. +This backend is responsible for the sending of the data to the device +(as in the "device URI" notation: lpd://, socket://, +smb://, ipp://, http://, parallel:/, serial:/, usb:/ etc.) +

    +"cupsomatic"/Foomatic are not native CUPS drivers +and they don't ship with CUPS. They are a Third Party add-on, +developed at Linuxprinting.org. As such, they are a brilliant hack to +make all models (driven by Ghostscript drivers/filters in traditional +spoolers) also work via CUPS, with the same (good or bad!) quality as +in these other spoolers. "cupsomatic" is only a vehicle to execute a +ghostscript commandline at that stage in the CUPS filtering chain, +where "normally" the native CUPS "pstoraster" filter would kick +in. cupsomatic by-passes pstoraster, "kidnaps" the printfile from CUPS +away and re-directs it to go through Ghostscript. CUPS accepts this, +because the associated CUPS-O-Matic-/Foomatic-PPD specifies: +

    +
+   *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"
+
+

    +This line persuades CUPS to hand the file to cupsomatic, once it has +successfully converted it to the MIME type +"application/vnd.cups-postscript". This conversion will not happen for +Jobs arriving from Windows which are auto-typed +"application/octet-stream", with the according changes in +/etc/cups/mime.types in place. +

    +CUPS is widely configurable and flexible, even regarding its filtering +mechanism. Another workaround in some situations would be to have in +/etc/cups/mime.types entries as follows: +

    +
+   application/postscript           application/vnd.cups-raw  0  -
+   application/vnd.cups-postscript  application/vnd.cups-raw  0  -
+
+

    +This would prevent all Postscript files from being filtered (rather, +they will through the virtual nullfilter +denoted with "-"). This could only be useful for PS printers. If you +want to print PS code on non-PS printers (provided they support ASCII +text printing) an entry as follows could be useful: +

    +
+   */*           application/vnd.cups-raw  0  -
+
+

    +and would effectively send all files to the +backend without further processing. +

    +Lastly, you could have the following entry: +

    +
+   application/vnd.cups-postscript  application/vnd.cups-raw  0  my_PJL_stripping_filter
+
+

    +You will need to write a my_PJL_stripping_filter +(could be a shellscript) that parses the PostScript and removes the +unwanted PJL. This would need to conform to CUPS filter design +(mainly, receive and pass the parameters printername, job-id, +username, jobtitle, copies, print options and possibly the +filename). It would be installed as world executable into +/usr/lib/cups/filters/ and will be called by CUPS +if it encounters a MIME type "application/vnd.cups-postscript". +

    +CUPS can handle -o job-hold-until=indefinite. +This keeps the job in the queue "on hold". It will only be printed +upon manual release by the printer operator. This is a requirement in +many "central reproduction departments", where a few operators manage +the jobs of hundreds of users on some big machine, where no user is +allowed to have direct access (such as when the operators often need +to load the proper paper type before running the 10,000 page job +requested by marketing for the mailing, etc.). +

    Auto-Deletion or Preservation of CUPS Spool Files

    +Samba print files pass through two "spool" directories. One is the +incoming directory managed by Samba, (set in the path = +/var/spool/samba directive in the +[printers] section of +smb.conf). The other is the spool directory of +your UNIX print subsystem. For CUPS it is normally +/var/spool/cups/, as set by the cupsd.conf +directive RequestRoot /var/spool/cups. +

    CUPS Configuration Settings explained

    +Some important parameter settings in the CUPS configuration file +cupsd.conf are: +

    PreserveJobHistory Yes

    +This keeps some details of jobs in cupsd's mind (well it keeps the +"c12345", "c12346" etc. files in the CUPS spool directory, which do a +similar job as the old-fashioned BSD-LPD control files). This is set +to "Yes" as a default. +

    PreserveJobFiles Yes

    +This keeps the job files themselves in cupsd's mind +(well it keeps the "d12345", "d12346" etc. files in the CUPS spool +directory...). This is set to "No" as the CUPS +default. +

    "MaxJobs 500"

    +This directive controls the maximum number of jobs +that are kept in memory. Once the number of jobs reaches the limit, +the oldest completed job is automatically purged from the system to +make room for the new one. If all of the known jobs are still +pending or active then the new job will be rejected. Setting the +maximum to 0 disables this functionality. The default setting is +0. +

    +(There are also additional settings for "MaxJobsPerUser" and +"MaxJobsPerPrinter"...) +

    Pre-conditions

    +For everything to work as announced, you need to have three +things: +

    • a Samba-smbd which is compiled against "libcups" (Check +on Linux by running "ldd `which smbd`")

    • a Samba-smb.conf setting of +"printing = cups"

    • another Samba-smb.conf setting of +"printcap = cups"

    Note

    +In this case all other manually set printing-related commands (like +"print command", "lpq command", "lprm command", "lppause command" or +"lpresume command") are ignored and they should normally have no +influence what-so-ever on your printing. +

    Manual Configuration

    +If you want to do things manually, replace the "printing = +cups" by "printing = bsd". Then your manually set commands may work +(haven't tested this), and a "print command = lp -d %P %s; rm %s" +may do what you need. +

    When not to use Samba to print to +CUPS

    +[TO BE DONE] +

    In Case of Trouble.....

    +If you have more problems, post the output of these commands +to the CUPS or Samba mailing lists (choose the one which seems more +relevant to your problem): +

    +
+   grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
+   grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"
+
+

    +(adapt paths as needed). These commands leave out the empty +lines and lines with comments, providing the "naked settings" in a +compact way. Don't forget to name the CUPS and Samba versions you +are using! This saves bandwidth and makes for easier readability +for experts (and you are expecting experts to read them, right? +;-) +

    Where to find Documentation

    +[TO BE DONE] +

    How to ask for Help

    +[TO BE DONE] +

    Where to find Help

    +[TO BE DONE] +

    Appendix

    Printing from CUPS to Windows attached +Printers

    +From time to time the question arises, how you can print +to a Windows attached printer +from Samba. Normally the local connection +"Windows host <--> printer" would be done by USB or parallel +cable, but this doesn't matter to Samba. From here only an SMB +connection needs to be opened to the Windows host. Of course, this +printer must be "shared" first. As you have learned by now, CUPS uses +backends to talk to printers and other +servers. To talk to Windows shared printers you need to use the +smb (surprise, surprise!) backend. Check if this +is in the CUPS backend directory. This resides usually in +/usr/lib/cups/backend/. You need to find a "smb" +file there. It should be a symlink to smbspool +which file must exist and be executable: +

    +
+ # ls -l /usr/lib/cups/backend/   
+ total 253
+ drwxr-xr-x    3 root     root          720 Apr 30 19:04 .
+ drwxr-xr-x    6 root     root          125 Dec 19 17:13 ..
+ -rwxr-xr-x    1 root     root        10692 Feb 16 21:29 canon
+ -rwxr-xr-x    1 root     root        10692 Feb 16 21:29 epson
+ lrwxrwxrwx    1 root     root            3 Apr 17 22:50 http -> ipp
+ -rwxr-xr-x    1 root     root        17316 Apr 17 22:50 ipp
+ -rwxr-xr-x    1 root     root        15420 Apr 20 17:01 lpd
+ -rwxr-xr-x    1 root     root         8656 Apr 20 17:01 parallel
+ -rwxr-xr-x    1 root     root         2162 Mar 31 23:15 pdfdistiller
+ lrwxrwxrwx    1 root     root           25 Apr 30 19:04 ptal -> /usr/local/sbin/ptal-cups
+ -rwxr-xr-x    1 root     root         6284 Apr 20 17:01 scsi
+ lrwxrwxrwx    1 root     root           17 Apr  2 03:11 smb -> /usr/bin/smbspool
+ -rwxr-xr-x    1 root     root         7912 Apr 20 17:01 socket
+ -rwxr-xr-x    1 root     root         9012 Apr 20 17:01 usb
+
+# ls -l `which smbspool`
+ -rwxr-xr-x    1 root     root       563245 Dec 28 14:49 /usr/bin/smbspool
+
+

    +If this symlink doesn't exist, create it: +

    +
+# ln -s `which smbspool` /usr/lib/cups/backend/smb
+
+

    +smbspool has been written by Mike Sweet from the CUPS folks. It is +included and ships with Samba. It may also be used with print +subsystems other than CUPS, to spool jobs to Windows printer shares. To +set up printer "winprinter" on CUPS, you need to have a "driver" for +it. Essentially this means to convert the print data on the CUPS/Samba +host to a format that the printer can digest (the Windows host is +unable to convert any files you may send). This also means you should +be able to print to the printer if it were hooked directly at your +Samba/CUPS host. For troubleshooting purposes, this is what you +should do, to determine if that part of the process chain is in +order. Then proceed to fix the network connection/authentication to +the Windows host, etc. +

    +To install a printer with the smb backend on CUPS, use this command: +

    +
+# lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename -P /path/to/PPD
+
+

    +The PPD must be able to direct CUPS to generate +the print data for the target model. For PostScript printers just use +the PPD that would be used with the Windows NT PostScript driver. But +what can you do if the printer is only accessible with a password? Or +if the printer's host is part of another workgroup? This is provided +for: you can include the required parameters as part of the +smb:// device-URI. Like this: +

    +
+ smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename 
+ smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename
+ smb://username:password@WINDOWSNETBIOSNAME/printersharename
+
+

    +Note that the device-URI will be visible in the process list of the +Samba server (e.g. when someone uses the ps -aux +command on Linux), even if the username and passwords are sanitized +before they get written into the log files. So this is an inherently +insecure option. However it is the only one. Don't use it if you want +to protect your passwords. Better share the printer in a way that +doesn't require a password! Printing will only work if you have a +working netbios name resolution up and running. Note that this is a +feature of CUPS and you don't necessarily need to have smbd running +(but who wants that? :-). +

    More CUPS filtering Chains

    +The following diagrams reveal how CUPS handles print jobs. +

    +#########################################################################
+#
+# CUPS in and of itself has this (general) filter chain (CAPITAL
+# letters are FILE-FORMATS or MIME types, other are filters (this is
+# true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro):
+#
+# SOMETHNG-FILEFORMAT
+#      |
+#      V
+#     somethingtops
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      V
+#     pstops
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT
+#      |
+#      V
+#     pstoraster   # as shipped with CUPS, independent from any Ghostscipt
+#      |           # installation on the system
+#      |  (= "postscipt interpreter")
+#      V
+# APPLICATION/VND.CUPS-RASTER
+#      |
+#      V
+#     rastertosomething  (e.g. Gimp-Print filters may be plugged in here)
+#      |   (= "raster driver")
+#      V
+# SOMETHING-DEVICE-SPECIFIC
+#      |
+#      V
+#     backend
+#
+#
+# ESP PrintPro has some enhanced "rastertosomething" filters as compared to
+# CUPS, and also a somewhat improved "pstoraster" filter.
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+
    +#########################################################################
+#
+# This is how "cupsomatic" comes into play:
+# =========================================
+#
+# SOMETHNG-FILEFORMAT
+#      |
+#      V
+#    somethingtops
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      V
+#    pstops
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
+#      |                                          V
+#      V                                         cupsomatic
+#    pstoraster                                  (constructs complicated
+#      |  (= "postscipt interpreter")            Ghostscript commandline
+#      |                                         to let the file be
+#      V                                         processed by a
+# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
+#      |                                         call...)
+#      V                                          |
+#    rastertosomething                            V
+#      |    (= "raster driver")     +-------------------------+
+#      |                            | Ghostscript at work.... |
+#      V                            |                         |
+# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
+#      |                                          |
+#      V                                          |
+#    backend <------------------------------------+
+#      |
+#      V
+#    THE PRINTER
+#
+#
+# Note, that cupsomatic "kidnaps" the printfile after the
+# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it gh
+# the CUPS-external, systemwide Ghostscript installation, bypassing the
+# "pstoraster" filter (therefore also bypassing the CUPS-raster-drivers
+# "rastertosomething", and hands the rasterized file directly to the CUPS
+# backend...
+#
+# cupsomatic is not made by the CUPS developers. It is an independent
+# contribution to printing development, made by people from
+# Linuxprinting.org. (see also http://www.cups.org/cups-help.html)
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+
    +#########################################################################
+#
+# And this is how it works for ESP PrintPro from 4.3:
+# ===================================================
+#
+# SOMETHNG-FILEFORMAT
+#      |
+#      V
+#     somethingtops
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      V
+#     pstops
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT
+#      |
+#      V
+#     gsrip
+#      |  (= "postscipt interpreter")
+#      V
+# APPLICATION/VND.CUPS-RASTER
+#      |
+#      V
+#     rastertosomething  (e.g. Gimp-Print filters may be plugged in here)
+#      |   (= "raster driver")
+#      V
+# SOMETHING-DEVICE-SPECIFIC
+#      |
+#      V
+#     backend
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+
    +#########################################################################
+#
+# This is how "cupsomatic" would come into play with ESP PrintPro:
+# ================================================================
+#
+#
+# SOMETHNG-FILEFORMAT
+#      |
+#      V
+#    somethingtops
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      V
+#    pstops
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
+#      |                                          V
+#      V                                         cupsomatic
+#    gsrip                                       (constructs complicated
+#      |  (= "postscipt interpreter")            Ghostscript commandline
+#      |                                         to let the file be
+#      V                                         processed by a
+# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
+#      |                                         call...)
+#      V                                          |
+#    rastertosomething                            V
+#      |   (= "raster driver")      +-------------------------+
+#      |                            | Ghostscript at work.... |
+#      V                            |                         |
+# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
+#      |                                          |
+#      V                                          |
+#    backend <------------------------------------+
+#      |
+#      V
+#    THE PRINTER
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+
    +#########################################################################
+#
+# And this is how it works for CUPS from 1.1.15:
+# ==============================================
+#
+# SOMETHNG-FILEFORMAT
+#      |
+#      V
+#     somethingtops
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      V
+#     pstops
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT-----+
+#                  +------------------v------------------------------+
+#                  | Ghostscript                                     |
+#                  | at work...                                      |
+#                  | (with                                           |
+#                  | "-sDEVICE=cups")                                |
+#                  |                                                 |
+#                  |         (= "postscipt interpreter")             |
+#                  |                                                 |
+#                  +------------------v------------------------------+
+#                                     |
+# APPLICATION/VND.CUPS-RASTER >-------+
+#      |
+#      V
+#     rastertosomething
+#      |   (= "raster driver")
+#      V
+# SOMETHING-DEVICE-SPECIFIC
+#      |
+#      V
+#     backend
+#
+#
+# NOTE: since version 1.1.15 CUPS "outsourced" the pstoraster process to
+#       Ghostscript. GNU Ghostscript needs to be patched to handle the
+#       CUPS requirement; ESP Ghostscript has this builtin. In any case,
+#       "gs -h" needs to show up a "cups" device. pstoraster is now a
+#       calling an appropriate "gs -sDEVICE=cups..." commandline to do
+#       the job. It will output "application/vnd.cup-raster", which will
+#       be finally processed by a CUPS raster driver "rastertosomething"
+#       Note the difference to "cupsomatic", which will not output
+#       CUPS-raster, but a final version of the printfile, ready to be
+#       sent to the printer. cupsomatic also doesn't use the "cups"
+#       devicemode in Ghostscript, but one of the classical devicemodes....
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+#########################################################################
+
    +#########################################################################
+#
+# And this is how it works for CUPS from 1.1.15, with cupsomatic included:
+# ========================================================================
+#
+# SOMETHNG-FILEFORMAT
+#      |
+#      V
+#     somethingtops
+#      |
+#      V
+# APPLICATION/POSTSCRIPT
+#      |
+#      V
+#     pstops
+#      |
+#      V
+# APPLICATION/VND.CUPS-POSTSCRIPT-----+
+#                  +------------------v------------------------------+
+#                  | Ghostscript        . Ghostscript at work....    |
+#                  | at work...         . (with "-sDEVICE=           |
+#                  | (with              .            s.th."          |
+#                  | "-sDEVICE=cups")   .                            |
+#                  |                    .                            |
+#                  | (CUPS standard)    .      (cupsomatic)          |
+#                  |                    .                            |
+#                  |          (= "postscript interpreter")           |
+#                  |                    .                            |
+#                  +------------------v--------------v---------------+
+#                                     |              |
+# APPLICATION/VND.CUPS-RASTER >-------+              |
+#      |                                             |
+#      V                                             |
+#     rastertosomething                              |
+#      |   (= "raster driver")                       |
+#      V                                             |
+# SOMETHING-DEVICE-SPECIFIC >------------------------+
+#      |
+#      V
+#     backend
+#
+#
+# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
+#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
+#
+##########################################################################
+

    Trouble Shooting Guidelines to fix typical Samba printing +Problems

    +This is a short description of how to debug printing problems +with Samba. This describes how to debug problems with printing from +a SMB client to a Samba server, not the other way around. +

    Win9x client can't install driver

    For Win9x clients require the printer names to be 8 +chars (or "8 plus 3 chars suffix") max; otherwise the driver files +won't get transferred when you want to download them from +Samba.

    testparm

    Run testparm: It will tell you if +smb.conf parameters are in the wrong +section. Many people have had the "printer admin" parameter in the +[printers] section and experienced +problems. "testparm" will tell you if it sees +this.

    "cupsaddsmb" keeps asking for a root password in a +neverending loop

    Have you security = user? Have +you used smbpasswd to give root a Samba account? +You can do 2 things: open another terminal and execute +smbpasswd -a root to create the account, and +continue with entering the password into the first terminal. Or break +out of the loop by hitting ENTER twice (without trying to type a +password).

    "cupsaddsmb" gives "No PPD file for printer..." +message (but I swear there is one!)

    • Have you enabled printer sharing on CUPS? This means: +do you have a <Location +/printers>....</Location> section in CUPS +server's cupsd.conf which doesn't deny access to +the host you run "cupsaddsmb" from? It could be +an issue if you use cupsaddsmb remotely, or if you use it with a +-h parameter: cupsaddsmb -H +sambaserver -h cupsserver -v printername. +

    • Is your +"TempDir" directive in +cupsd.conf +set to a valid value and is it writeable? +

    I can't connect client to Samba printer.

    Use smbstatus to check which user +you are from Samba's point of view. Do you have the privileges to +write into the [print$] +share?

    I can't reconnect to Samba under a new account +from Win2K/XP

    Once you are connected as the "wrong" user (for +example as "nobody", which often occurs if you have map to +guest = bad user), Windows Explorer will not accept an +attempt to connect again as a different user. There won't be any byte +transfered on the wire to Samba, but still you'll see a stupid error +message which makes you think that Samba has denied access. Use +smbstatus to check for active connections. Kill the +PIDs. You still can't re-connect and get the dreaded +You can't connect with a second account from the same +machine message, as soon as you are trying? And you +don't see any single byte arriving at Samba (see logs; use "ethereal") +indicating a renewed connection attempt? Shut all Explorer Windows. +This makes Windows forget what it has cached in its memory as +established connections. Then re-connect as the right user. Best +method is to use a DOS terminal window and first +do net use z: \\SAMBAHOST\print$ /user:root. Check +with smbstatus that you are connected under a +different account. Now open the "Printers" folder (on the Samba server +in the Network Neighbourhood), right-click the +printer in question and select +Connect...

    Avoid being connected to the Samba server as the +"wrong" user

    You see per smbstatus that you are +connected as user "nobody"; while you wanted to be "root" or +"printeradmin"? This is probably due to map to guest = bad +user, which silently connects you under the guest account, +when you gave (maybe by accident) an incorrect username. Remove +map to guest, if you want to prevent +this.

    Upgrading to CUPS drivers from Adobe drivers on +NT/2K/XP clients gives problems

    First delete all "old" Adobe-using printers. Then +delete all "old" Adobe drivers. (On Win2K/XP, right-click in +background of "Printers" folder, select "Server Properties...", select +tab "Drivers" and delete here).

    I can't use "cupsaddsmb"on a Samba server which is +a PDC

    Do you use the "naked" root user name? Try to do it +this way: cupsaddsmb -U DOMAINNAME\\root -v +printername (note the two backslashes: the first one is +required to "escape" the second one).

    I deleted a printer on Win2K; but I still see +its driver

    Deleting a printer on the client won't delete the +driver too (to verify, right-click on the white background of the +"Printers" folder, select "Server Properties" and click on the +"Drivers" tab). These same old drivers will be re-used when you try to +install a printer with the same name. If you want to update to a new +driver, delete the old ones first. Deletion is only possible if no +other printer uses the same driver.

    Win2K/XP "Local Security +Policies"

    Local Security Policies may not +allow the installation of unsigned drivers. "Local Security Policies" +may not allow the installation of printer drivers at +all.

    WinXP clients: "Administrator can not install +printers for all local users"

    Windows XP handles SMB printers on a "per-user" basis. +This means every user needs to install the printer himself. To have a +printer available for everybody, you might want to use the built-in +IPP client capabilities of WinXP. Add a printer with the print path of +http://cupsserver:631/printers/printername. +Still looking into this one: maybe a "logon script" could +automatically install printers for all +users.

    "Print Change Notify" functions on +NT-clients

    For "print change notify" functions on NT++ clients, +these need to run the "Server" service first (re-named to +File & Print Sharing for MS Networks in +XP).

    WinXP-SP1

    WinXP-SP1 introduced a Point and Print +Restriction Policy (this restriction doesn't apply to +"Administrator" or "Power User" groups of users). In Group Policy +Object Editor: go to User Configuration --> +Administrative Templates --> Control Panel --> +Printers. The policy is automatically set to +Enabled and the Users can only Point +and Print to machines in their Forest . You probably need +to change it to Disabled or Users can +only Point and Print to these servers in order to make +driver downloads from Samba possible.

    I can't set and save default print options for all +users on Win2K/XP

    How are you doing it? I bet the wrong way (it is not +very easy to find out, though). There are 3 different ways to bring +you to a dialog that seems to set everything. All +three dialogs look the same. Only one of them +does what you intend. You need to be +Administrator or Print Administrator to do this for all users. Here +is how I do in on XP: +

    1. The first "wrong" way: + +

      1. Open the Printers +folder.

      2. Right-click on the printer +(remoteprinter on cupshost) and +select in context menu Printing +Preferences...

      3. Look at this dialog closely and remember what it looks +like.

      +

    2. The second "wrong" way: + +

      1. Open the Printers +folder.

      2. Right-click on the printer (remoteprinter on +cupshost) and select in the context menu +Properties

      3. Click on the General +tab

      4. Click on the button Printing +Preferences...

      5. A new dialog opens. Keep this dialog open and go back +to the parent dialog.

      +

    3. The third, the "correct" way: (should you do +this from the beginning, just carry out steps 1. and 2. from second +"way" above) + +

      1. Click on the Advanced +tab. (Hmmm... if everything is "Grayed Out", then you are not logged +in as a user with enough privileges).

      2. Click on the Printing +Defaults... button.

      3. On any of the two new tabs, click on the +Advanced... +button.

      4. A new dialog opens. Compare this one to the other, +identical looking one from "B.5" or A.3".

      +

    +Do you see any difference? I don't either... However, only the last +one, which you arrived at with steps "C.1.-6." will save any settings +permanently and be the defaults for new users. If you want all clients +to get the same defaults, you need to conduct these steps as +Administrator (printer admin in +smb.conf) before a client +downloads the driver (the clients can later set their own +per-user defaults by following the +procedures A. or B. +above).

    What are the most common blunders in driver +settings on Windows clients?

    Don't use Optimize for +Speed: use Optimize for +Portability instead (Adobe PS Driver) Don't use +Page Independence: No: always +settle with Page Independence: +Yes (Microsoft PS Driver and CUPS PS Driver for +WinNT/2K/XP) If there are problems with fonts: use +Download as Softfont into +printer (Adobe PS Driver). For +TrueType Download Options +choose Outline. Use PostScript +Level 2, if you are having trouble with a non-PS printer, and if +there is a choice.

    I can't make cupsaddsmb work +with newly installed printer

    Symptom: the last command of +cupsaddsmb doesn't complete successfully: +cmd = setdriver printername printername result was +NT_STATUS_UNSUCCESSFUL then possibly the printer was not yet +"recognized" by Samba. Did it show up in Network +Neighbourhood? Did it show up in rpcclient +hostname -c 'enumprinters'? Restart smbd (or send a +kill -HUP to all processes listed by +smbstatus and try +again.

    My permissions on +/var/spool/samba/ get reset after each +reboot

    Have you by accident set the CUPS spool directory to +the same location? (RequestRoot +/var/spool/samba/ in cupsd.conf or +the other way round: /var/spool/cups/ is set as +path in the [printers] +section). These must be different. Set +RequestRoot /var/spool/cups/ in +cupsd.conf and path = +/var/spool/samba in the [printers] +section of smb.conf. Otherwise cupsd will +sanitize permissions to its spool directory with each restart, and +printing will not work reliably.

    My printers work fine: just the printer named "lp" +intermittently swallows jobs and spits out completely different +ones

    It is a very bad idea to name any printer "lp". This +is the traditional Unix name for the default printer. CUPS may be set +up to do an automatic creation of "Implicit Classes". This means, to +group all printers with the same name to a pool of devices, and +loadbalancing the jobs across them in a round-robin fashion. Chances +are high that someone else has an "lp" named printer too. You may +receive his jobs and send your own to his device unwittingly. To have +tight control over the printer names, set BrowseShortNames +No. It will present any printer as "printername@cupshost" +then, giving you a better control over what may happen in a large +networked environment.

    How do I "watch" my Samba server?

    You can use tail -f +/var/log/samba/log.smbd (you may need a different path) to +see a live scrolling of all log messages. smbcontrol smbd +debuglevel tells you which verbosity goes into the +logs. smbcontrol smbd debug 3 sets the verbosity to +a quite high level (you can choose from 0 to 10 or 100). This works +"on the fly", without the need to restart the smbd daemon. Don't use +more than 3 initially; or you'll drown in an ocean of +messages.

    I can't use Samba from my WinXP Home box, while +access from WinXP Prof works flawlessly

    You have our condolences! WinXP home has been +completely neutered by Microsoft as compared to WinXP Prof: you can +not log into a WinNT domain. It cannot join a Win NT domain as a +member server. While it is possible to access domain resources, users +don't have "single sign-on". They need to supply username and password +each time they connect to a resource. Logon scripts and roaming +profiles are not supported. It can serve file and print shares; but +only in "share-mode security" level. It can not use "user-mode +security" (what Windows 95/98/ME still can +do).

    Where do I find the Adobe PostScript driver files +I need for "cupsaddsmb"?

    Use smbclient to connect to any +Windows box with a shared PostScript printer: smbclient +//windowsbox/print\$ -U guest. You can navigate to the +W32X86/2 subdir to mget ADOBE* +and other files or to WIN40/0 to do the same. -- +Another option is to download the *.exe packaged +files from the Adobe website.

    An Overview of the CUPS Printing Processes

    +

    Figure 19.15. CUPS Printing Overview

    CUPS Printing Overview

    +

    Prev Up Next
    Chapter 18. Classical Printing Support Home Chapter 20. Stackable VFS modules
    diff --git a/docs/htmldocs/ClientConfig.html b/docs/htmldocs/ClientConfig.html new file mode 100644 index 0000000000..395be92345 --- /dev/null +++ b/docs/htmldocs/ClientConfig.html @@ -0,0 +1,4 @@ +Chapter 9. MS Windows Network Configuration Guide
    Chapter 9. MS Windows Network Configuration Guide
    Prev Part II. Server Configuration Basics Next

    Chapter 9. MS Windows Network Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +This chapter did not make it into this release. +It is planned for the published release of this document. +

    Prev Up Next
    Chapter 8. Stand-Alone Servers Home Part III. Advanced Configuration
    diff --git a/docs/htmldocs/DNSDHCP.html b/docs/htmldocs/DNSDHCP.html new file mode 100644 index 0000000000..dadf6b989a --- /dev/null +++ b/docs/htmldocs/DNSDHCP.html @@ -0,0 +1,4 @@ +Chapter 40. DNS and DHCP Configuration Guide
    Chapter 40. DNS and DHCP Configuration Guide
    Prev Part VI. Appendixes Next

    Chapter 40. DNS and DHCP Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +This chapter did not make it into this release. +It is planned for the published release of this document. +

    Prev Up Next
    Chapter 39. Samba Performance Tuning Home Chapter 41. Further Resources
    diff --git a/docs/htmldocs/FastStart.html b/docs/htmldocs/FastStart.html new file mode 100644 index 0000000000..dbb85dea6e --- /dev/null +++ b/docs/htmldocs/FastStart.html @@ -0,0 +1,4 @@ +Chapter 3. Fast Start for the Impatient
    Chapter 3. Fast Start for the Impatient
    Prev Part I. General Installation Next

    Chapter 3. Fast Start for the Impatient

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +This chapter did not make it into this release. +It is planned for the published release of this document. +

    Prev Up Next
    Chapter 2. How to Install and Test SAMBA Home Part II. Server Configuration Basics
    diff --git a/docs/htmldocs/Further-Resources.html b/docs/htmldocs/Further-Resources.html new file mode 100644 index 0000000000..8030190ed4 --- /dev/null +++ b/docs/htmldocs/Further-Resources.html @@ -0,0 +1,100 @@ +Chapter 41. Further Resources
    Chapter 41. Further Resources
    Prev Part VI. Appendixes Next

    Chapter 41. Further Resources

    Jelmer R. Vernooij

    The Samba Team

    David Lechnyr

    Unofficial HOWTO

    May 1, 2003

    Table of Contents

    Websites
    Related updates from Microsoft
    Books

    Websites

    Related updates from Microsoft

    Books

    Prev Up Next
    Chapter 40. DNS and DHCP Configuration Guide Home Index
    diff --git a/docs/htmldocs/InterdomainTrusts.html b/docs/htmldocs/InterdomainTrusts.html new file mode 100644 index 0000000000..8938b84c42 --- /dev/null +++ b/docs/htmldocs/InterdomainTrusts.html @@ -0,0 +1,175 @@ +Chapter 16. Interdomain Trust Relationships
    Chapter 16. Interdomain Trust Relationships
    Prev Part III. Advanced Configuration Next

    Chapter 16. Interdomain Trust Relationships

    John H. Terpstra

    Samba Team

    Rafal Szczesniak

    Samba Team

    April 3, 2003

    Table of Contents

    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    Common Errors
    Tell me about Trust Relationships using Samba

    +Samba-3 supports NT4 style domain trust relationships. This is feature that many sites +will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to +adopt Active Directory or an LDAP based authentication back end. This section explains +some background information regarding trust relationships and how to create them. It is now +possible for Samba-3 to NT4 trust (and vice versa), as well as Samba3 to Samba3 trusts. +

    Features and Benefits

    +Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4 style +trust relationships. This imparts to Samba similar scalability as is possible with +MS Windows NT4. +

    +Given that Samba-3 has the capability to function with a scalable backend authentication +database such as LDAP, and given it's ability to run in Primary as well as Backup Domain control +modes, the administrator would be well advised to consider alternatives to the use of +Interdomain trusts simply because by the very nature of how this works it is fragile. +That was, after all, a key reason for the development and adoption of Microsoft Active Directory. +

    Trust Relationship Background

    +MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure. +The limitations of this architecture as it affects the scalability of MS Windows networking +in large organisations is well known. Additionally, the flat-name space that results from +this design significantly impacts the delegation of administrative responsibilities in +large and diverse organisations. +

    +Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means +of circumventing the limitations of the older technologies. Not every organisation is ready +or willing to embrace ADS. For small companies the older NT4 style domain security paradigm +is quite adequate, there thus remains an entrenched user base for whom there is no direct +desire to go through a disruptive change to adopt ADS. +

    +Microsoft introduced with MS Windows NT the ability to allow differing security domains +to affect a mechanism so that users from one domain may be given access rights and privileges +in another domain. The language that describes this capability is couched in terms of +Trusts. Specifically, one domain will trust the users +from another domain. The domain from which users are available to another security domain is +said to be a trusted domain. The domain in which those users have assigned rights and privileges +is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only, +thus if users in both domains are to have privileges and rights in each others' domain, then it is +necessary to establish two (2) relationships, one in each direction. +

    +In an NT4 style MS security domain, all trusts are non-transitive. This means that if there +are three (3) domains (let's call them RED, WHITE, and BLUE) where RED and WHITE have a trust +relationship, and WHITE and BLUE have a trust relationship, then it holds that there is no +implied trust between the RED and BLUE domains. ie: Relationships are explicit and not +transitive. +

    +New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way +by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE +domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is +an inherent feature of ADS domains. Samba-3 implements MS Windows NT4 +style Interdomain trusts and interoperates with MS Windows 200x ADS +security domains in similar manner to MS Windows NT4 style domains. +

    Native MS Windows NT4 Trusts Configuration

    +There are two steps to creating an interdomain trust relationship. +

    NT4 as the Trusting Domain (ie. creating the trusted account)

    +For MS Windows NT4, all domain trust relationships are configured using the +Domain User Manager. To affect a two way trust relationship it is +necessary for each domain administrator to make available (for use by an external domain) it's +security resources. This is done from the Domain User Manager Policies entry on the menu bar. +From the Policy menu, select Trust Relationships, then +next to the lower box that is labelled Permitted to Trust this Domain are two +buttons, Add and Remove. The Add +button will open a panel in which needs to be entered the remote domain that will be able to assign +user rights to your domain. In addition it is necessary to enter a password +that is specific to this trust relationship. The password needs to be +typed twice (for standard confirmation). +

    NT4 as the Trusted Domain (ie. creating trusted account's password)

    +A trust relationship will work only when the other (trusting) domain makes the appropriate connections +with the trusted domain. To consummate the trust relationship the administrator will launch the +Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the +Add button that is next to the box that is labelled +Trusted Domains. A panel will open in which must be entered the name of the remote +domain as well as the password assigned to that trust. +

    Configuring Samba NT-style Domain Trusts

    +This description is meant to be a fairly short introduction about how to set up a Samba server so +that it could participate in interdomain trust relationships. Trust relationship support in Samba +is in its early stage, so lot of things don't work yet. +

    +Each of the procedures described below is treated as they were performed with Windows NT4 Server on +one end. The remote end could just as well be another Samba-3 domain. It can be clearly seen, after +reading this document, that combining Samba-specific parts of what's written below leads to trust +between domains in purely Samba environment. +

    Samba-3 as the Trusting Domain

    +In order to set the Samba PDC to be the trusted party of the relationship first you need +to create special account for the domain that will be the trusting party. To do that, +you can use the 'smbpasswd' utility. Creating the trusted domain account is very +similar to creating a trusted machine account. Suppose, your domain is +called SAMBA, and the remote domain is called RUMBA. The first step +will be to issue this command from your favourite shell: +

    +

    +root#  smbpasswd -a -i rumba
+	New SMB password: XXXXXXXX
+	Retype SMB password: XXXXXXXX
+	Added user rumba$
+

    + +where -a means to add a new account into the +passdb database and -i means: ''create this +account with the InterDomain trust flag'' +

    +The account name will be 'rumba$' (the name of the remote domain) +

    +After issuing this command you'll be asked to enter the password for +the account. You can use any password you want, but be aware that Windows NT will +not change this password until 7 days following account creation. +After the command returns successfully, you can look at the entry for the new account +(in the standard way depending on your configuration) and see that account's name is +really RUMBA$ and it has 'I' flag in the flags field. Now you're ready to confirm +the trust by establishing it from Windows NT Server. +

    +Open User Manager for Domains and from menu +Policies select Trust Relationships.... +Right beside Trusted domains list box press the +Add... button. You will be prompted for +the trusted domain name and the relationship password. Type in SAMBA, as this is +your domain name, and the password used at the time of account creation. +Press OK and, if everything went without incident, you will see +Trusted domain relationship successfully +established message. +

    Samba-3 as the Trusted Domain

    +This time activities are somewhat reversed. Again, we'll assume that your domain +controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA. +

    +The very first thing requirement is to add an account for the SAMBA domain on RUMBA's PDC. +

    +Launch the Domain User Manager, then from the menu select +Policies, Trust Relationships. +Now, next to Trusted Domains box press the Add +button, and type in the name of the trusted domain (SAMBA) and password securing +the relationship. +

    +The password can be arbitrarily chosen. It is easy to change the password +from the Samba server whenever you want. After confirming the password your account is +ready for use. Now it's Samba's turn. +

    +Using your favourite shell while being logged in as root, issue this command: +

    +root# net rpc trustdom establish rumba +

    +You will be prompted for the password you just typed on your Windows NT4 Server box. +Do not worry if you see an error message that mentions a returned code of +NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the +password you gave is correct and the NT4 Server says the account is +ready for interdomain connection and not for ordinary +connection. After that, be patient it can take a while (especially +in large networks), you should see the Success message. +Congratulations! Your trust relationship has just been established. +

    Note

    +Note that you have to run this command as root because you must have write access to +the secrets.tdb file. +

    Common Errors

    +Interdomain trust relationships should NOT be attempted on networks that are unstable +or that suffer regular outages. Network stability and integrity are key concerns with +distributed trusted domains. +

    Tell me about Trust Relationships using Samba

    + Like many, I administer multiple LANs connected together using NT trust + relationships. This was implemented about 4 years ago. I now have the + occasion to consider performing this same task again, but this time, I + would like to implement it solely through samba - no Microsoft PDCs + anywhere. +

    + I have read documentation on samba.org regarding NT-style trust + relationships and am now wondering, can I do what I want to? I already + have successfully implemented 2 samba servers, but they are not PDCs. + They merely act as file servers. I seem to remember, and it appears to + be true (according to samba.org) that trust relationships are a + challenge. +

    + Please provide any helpful feedback that you may have. +

    + These are almost complete in Samba 3.0 snapshots. The main catch + is getting winbindd to be able to allocate UID/GIDs for trusted + users/groups. See the updated Samba HOWTO collection for more + details. +

    Prev Up Next
    Chapter 15. Securing Samba Home Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    diff --git a/docs/htmldocs/IntroSMB.html b/docs/htmldocs/IntroSMB.html new file mode 100644 index 0000000000..f9c2539112 --- /dev/null +++ b/docs/htmldocs/IntroSMB.html @@ -0,0 +1,174 @@ +Chapter 1. Introduction to Samba
    Chapter 1. Introduction to Samba
    Prev Part I. General Installation Next

    Chapter 1. Introduction to Samba

    David Lechnyr

    Unofficial HOWTO

    April 14, 2003

    Table of Contents

    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous

    “ +"If you understand what you're doing, you're not learning anything." +-- Anonymous +”

    +Samba is a file and print server for Windows-based clients using TCP/IP as the underlying +transport protocol. In fact, it can support any SMB/CIFS-enabled client. One of Samba's big +strengths is that you can use it to blend your mix of Windows and Linux machines together +without requiring a separate Windows NT/2000/2003 Server. Samba is actively being developed +by a global team of about 30 active programmers and was originally developed by Andrew Tridgell. +

    Background

    +Once long ago, there was a buzzword referred to as DCE/RPC. This stood for Distributed +Computing Environment/Remote Procedure Calls and conceptually was a good idea. It was +originally developed by Apollo/HP as NCA 1.0 (Network Computing Architecture) and only +ran over UDP. When there was a need to run it over TCP so that it would be compatible +with DECnet 3.0, it was redesigned, submitted to The Open Group, and officially became +known as DCE/RPC. Microsoft came along and decided, rather than pay $20 per seat to +license this technology, to reimplement DCE/RPC themselves as MSRPC. From this, the +concept continued in the form of SMB (Server Message Block, or the "what") using the +NetBIOS (Network Basic Input/Output System, or the "how") compatibility layer. You can +run SMB (i.e., transport) over several different protocols; many different implementations +arose as a result, including NBIPX (NetBIOS over IPX, NwLnkNb, or NWNBLink) and NBT +(NetBIOS over TCP/IP, or NetBT). As the years passed, NBT became the most common form +of implementation until the advance of "Direct-Hosted TCP" -- the Microsoft marketing +term for eliminating NetBIOS entirely and running SMB by itself across TCP port 445 +only. As of yet, direct-hosted TCP has yet to catch on. +

    +Perhaps the best summary of the origins of SMB are voiced in the 1997 article titled, CIFS: +Common Insecurities Fail Scrutiny: +

    +Several megabytes of NT-security archives, random whitepapers, RFCs, the CIFS spec, the Samba +stuff, a few MS knowledge-base articles, strings extracted from binaries, and packet dumps have +been dutifully waded through during the information-gathering stages of this project, and there +are *still* many missing pieces... While often tedious, at least the way has been generously +littered with occurrences of clapping hand to forehead and muttering 'crikey, what are they +thinking? +

    Terminology

    • + SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol. +

    • + CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently + decided that SMB needed the word "Internet" in it, so they changed it to CIFS. +

    • + Direct-Hosted: A method of providing file/printer sharing services over port 445/tcp + only using DNS for name resolution instead of WINS. +

    • + IPC: Acronym for "Inter-Process Communication". A method to communicate specific + information between programs. +

    • + Marshalling: - A method of serializing (i.e., sequential ordering of) variable data + suitable for transmission via a network connection or storing in a file. The source + data can be re-created using a similar process called unmarshalling. +

    • + NetBIOS: Acronym for "Network Basic Input/Output System". This is not a protocol; + it is a method of communication across an existing protocol. This is a standard which + was originally developed for IBM by Sytek in 1983. To exaggerate the analogy a bit, + it can help to think of this in comparison your computer's BIOS -- it controls the + essential functions of your input/output hardware -- whereas NetBIOS controls the + essential functions of your input/output traffic via the network. Again, this is a bit + of an exaggeration but it should help that paradigm shift. What is important to realize + is that NetBIOS is a transport standard, not a protocol. Unfortunately, even technically + brilliant people tend to interchange NetBIOS with terms like NetBEUI without a second + thought; this will cause no end (and no doubt) of confusion. +

    • + NetBEUI: Acronym for the "NetBIOS Extended User Interface". Unlike NetBIOS, NetBEUI + is a protocol, not a standard. It is also not routable, so traffic on one side of a + router will be unable to communicate with the other side. Understanding NetBEUI is + not essential to deciphering SMB; however it helps to point out that it is not the + same as NetBIOS and to improve your score in trivia at parties. NetBEUI was originally + referred to by Microsoft as "NBF", or "The Windows NT NetBEUI Frame protocol driver". + It is not often heard from these days. +

    • + NBT: Acronym for "NetBIOS over TCP"; also known as "NetBT". Allows the continued use + of NetBIOS traffic proxied over TCP/IP. As a result, NetBIOS names are made + to IP addresses and NetBIOS name types are conceptually equivalent to TCP/IP ports. + This is how file and printer sharing are accomplished in Windows 95/98/ME. They + traditionally rely on three ports: NetBIOS Name Service (nbname) via UDP port 137, + NetBIOS Datagram Service (nbdatagram) via UDP port 138, and NetBIOS Session Service + (nbsession) via TCP port 139. All name resolution is done via WINS, NetBIOS broadcasts, + and DNS. NetBIOS over TCP is documented in RFC 1001 (Concepts and methods) and RFC 1002 + (Detailed specifications). +

    • + W2K: Acronym for Windows 2000 Professional or Server +

    • + W3K: Acronym for Windows 2003 Server +

    If you plan on getting help, make sure to subscribe to the Samba Mailing List (available at +http://www.samba.org). +

    Related Projects

    +There are currently two network filesystem client projects for Linux that are directly +related to Samba: SMBFS and CIFS VFS. These are both available in the Linux kernel itself. +

    • + SMBFS (Server Message Block File System) allows you to mount SMB shares (the protocol + that Microsoft Windows and OS/2 Lan Manager use to share files and printers + over local networks) and access them just like any other Unix directory. This is useful + if you just want to mount such filesystems without being a SMBFS server. +

    • + CIFS VFS (Common Internet File System Virtual File System) is the successor to SMBFS, and + is being actively developed for the upcoming version of the Linux kernel. The intent of this module + is to provide advanced network file system functionality including support for dfs (hierarchical + name space), secure per-user session establishment, safe distributed caching (oplock), + optional packet signing, Unicode and other internationalization improvements, and optional + Winbind (nsswitch) integration. +

    +Again, it's important to note that these are implementations for client filesystems, and have +nothing to do with acting as a file and print server for SMB/CIFS clients. +

    +There are other Open Source CIFS client implementations, such as the +jCIFS project +which provides an SMB client toolkit written in Java. +

    SMB Methodology

    +Traditionally, SMB uses UDP port 137 (NetBIOS name service, or netbios-ns), +UDP port 138 (NetBIOS datagram service, or netbios-dgm), and TCP port 139 (NetBIOS +session service, or netbios-ssn). Anyone looking at their network with a good +packet sniffer will be amazed at the amount of traffic generated by just opening +up a single file. In general, SMB sessions are established in the following order: +

    • + "TCP Connection" - establish 3-way handshake (connection) to port 139/tcp + or 445/tcp. +

    • + "NetBIOS Session Request" - using the following "Calling Names": The local + machine's NetBIOS name plus the 16th character 0x00; The server's NetBIOS + name plus the 16th character 0x20 +

    • + "SMB Negotiate Protocol" - determine the protocol dialect to use, which will + be one of the following: PC Network Program 1.0 (Core) - share level security + mode only; Microsoft Networks 1.03 (Core Plus) - share level security + mode only; Lanman1.0 (LAN Manager 1.0) - uses Challenge/Response + Authentication; Lanman2.1 (LAN Manager 2.1) - uses Challenge/Response + Authentication; NT LM 0.12 (NT LM 0.12) - uses Challenge/Response + Authentication +

    • + SMB Session Startup. Passwords are encrypted (or not) according to one of + the following methods: Null (no encryption); Cleartext (no encryption); LM + and NTLM; NTLM; NTLMv2 +

    • + SMB Tree Connect: Connect to a share name (e.g., \\servername\share); Connect + to a service type (e.g., IPC$ named pipe) +

    +A good way to examine this process in depth is to try out +SecurityFriday's SWB program. +It allows you to walk through the establishment of a SMB/CIFS session step by step. +

    Epilogue

    “ +What's fundamentally wrong is that nobody ever had any taste when they +did it. Microsoft has been very much into making the user interface look good, +but internally it's just a complete mess. And even people who program for Microsoft +and who have had years of experience, just don't know how it works internally. +Worse, nobody dares change it. Nobody dares to fix bugs because it's such a +mess that fixing one bug might just break a hundred programs that depend on +that bug. And Microsoft isn't interested in anyone fixing bugs -- they're interested +in making money. They don't have anybody who takes pride in Windows 95 as an +operating system. +”

    “ +People inside Microsoft know it's a bad operating system and they still +continue obviously working on it because they want to get the next version out +because they want to have all these new features to sell more copies of the +system. +”

    “ +The problem with that is that over time, when you have this kind of approach, +and because nobody understands it, because nobody REALLY fixes bugs (other than +when they're really obvious), the end result is really messy. You can't trust +it because under certain circumstances it just spontaneously reboots or just +halts in the middle of something that shouldn't be strange. Normally it works +fine and then once in a blue moon for some completely unknown reason, it's dead, +and nobody knows why. Not Microsoft, not the experienced user and certainly +not the completely clueless user who probably sits there shivering thinking +"What did I do wrong?" when they didn't do anything wrong at all. +”

    “ +That's what's really irritating to me." +”

    -- +Linus Torvalds, from an interview with BOOT Magazine, Sept 1998 +

    Miscellaneous

    +This chapter is Copyright 2003 David Lechnyr (david at lechnyr dot com). +Permission is granted to copy, distribute and/or modify this document under the terms +of the GNU Free Documentation License, Version 1.2 or any later version published by the Free +Software Foundation. A copy of the license is available at http://www.gnu.org/licenses/fdl.txt. +

    Prev Up Next
    Part I. General Installation Home Chapter 2. How to Install and Test SAMBA
    diff --git a/docs/htmldocs/NT4Migration.html b/docs/htmldocs/NT4Migration.html new file mode 100644 index 0000000000..72c6269f0e --- /dev/null +++ b/docs/htmldocs/NT4Migration.html @@ -0,0 +1,202 @@ +Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    Prev Part IV. Migration and Updating Next

    Chapter 31. Migration from NT4 PDC to Samba-3 PDC

    John H. Terpstra

    Samba Team

    April 3, 2003

    Table of Contents

    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices

    +This is a rough guide to assist those wishing to migrate from NT4 domain control to +Samba-3 based domain control. +

    Planning and Getting Started

    +In the IT world there is often a saying that all problems are encountered because of +poor planning. The corollary to this saying is that not all problems can be anticipated +and planned for. Then again, good planning will anticipate most show stopper type situations. +

    +Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control +environment would do well to develop a detailed migration plan. So here are a few pointers to +help migration get under way. +

    Objectives

    +The key objective for most organisations will be to make the migration from MS Windows NT4 +to Samba-3 domain control as painless as possible. One of the challenges you may experience +in your migration process may well be one of convincing management that the new environment +should remain in place. Many who have introduced open source technologies have experienced +pressure to return to a Microsoft based platform solution at the first sign of trouble. +

    +It is strongly advised that before attempting a migration to a Samba-3 controlled network +that every possible effort be made to gain all-round commitment to the change. Firstly, you +should know precisely why the change is important for the organisation. +Possible motivations to make a change include: +

    Improve network manageability
    Obtain better user level functionality
    Reduce network operating costs
    Reduce exposure caused by Microsoft withdrawal of NT4 support
    Avoid MS License 6 implications
    Reduce organisation's dependency on Microsoft

    +It is vital that it be well recognised that Samba-3 is NOT MS Windows NT4. Samba-3 offers +an alternative solution that is both different from MS Windows NT4 and that offers some +advantages compared with it. It should also be recognised that Samba-3 lacks many of the +features that Microsoft has promoted as core values in migration from MS Windows NT4 to +MS Windows 2000 and beyond (with or without Active Directory services). +

    +What are the features that Samba-3 can NOT provide? +

    Active Directory Server
    Group Policy Objects (in Active Directory)
    Machine Policy objects
    Logon Scripts in Active Directory
    Software Application and Access Controls in Active Directory

    +The features that Samba-3 DOES provide and that may be of compelling interest to your site +includes: +

    Lower Cost of Ownership
    Global availability of support with no strings attached
    Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system)
    Creation of on-the-fly logon scripts
    Creation of on-the-fly Policy Files
    Greater Stability, Reliability, Performance and Availability
    Manageability via an ssh connection
    Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam)
    Ability to implement a full single-sign-on architecture
    Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand

    +Before migrating a network from MS Windows NT4 to Samba-3 it is vital that all necessary factors are +considered. Users should be educated about changes they may experience so that the change will be a +welcome one and not become an obstacle to the work they need to do. The following are some of the +factors that will go into a successful migration: +

    Domain Layout

    +Samba-3 can be configured as a domain controller, a back-up domain controller (probably best called +a secondary controller), a domain member, or as a stand-alone server. The Windows network security +domain context should be sized and scoped before implementation. Particular attention needs to be +paid to the location of the primary domain controller (PDC) as well as backup controllers (BDCs). +It should be noted that one way in which Samba-3 differs from Microsoft technology is that if one +chooses to use an LDAP authentication backend then the same database can be used by several different +domains. This means that in a complex organisation there can be a single LDAP database, that itself +can be distributed, that can simultaneously serve multiple domains (that can also be widely distributed). +

    +It is recommended that from a design perspective, the number of users per server, as well as the number +of servers, per domain should be scaled according to needs and should also consider server capacity +and network bandwidth. +

    +A physical network segment may house several domains, each of which may span multiple network segments. +Where domains span routed network segments it is most advisable to consider and test the performance +implications of the design and layout of a network. A Centrally located domain controller that is being +designed to serve multiple routed network segments may result in severe performance problems if the +response time (eg: ping timing) between the remote segment and the PDC is more than 100 ms. In situations +where the delay is too long it is highly recommended to locate a backup controller (BDC) to serve as +the local authentication and access control server. +

    Server Share and Directory Layout

    +There are few cardinal rules to effective network design that can be broken with impunity. +The most important rule of effective network management is that simplicity is king in every +well controlled network. Every part of the infrastructure must be managed, the more complex +it is, the greater will be the demand of keeping systems secure and functional. +

    +The nature of the data that must be stored needs to be born in mind when deciding how many +shares must be created. The physical disk space layout should also be taken into account +when designing where share points will be created. Keep in mind that all data needs to be +backed up, thus the simpler the disk layout the easier it will be to keep track of what must +be backed up to tape or other off-line storage medium. Always plan and implement for minimum +maintenance. Leave nothing to chance in your design, above all, do not leave backups to chance: +Backup and test, validate every backup, create a disaster recovery plan and prove that it works. +

    +Users should be grouped according to data access control needs. File and directory access +is best controlled via group permissions and the use of the "sticky bit" on group controlled +directories may substantially avoid file access complaints from samba share users. +

    +Many network administrators who are new to the game will attempt to use elaborate techniques +to set access controls, on files, directories, shares, as well as in share definitions. +There is the ever present danger that that administrator's successor will not understand the +complex mess that has been inherited. Remember, apparent job security through complex design +and implementation may ultimately cause loss of operations and downtime to users as the new +administrator learns to untangle your web. Keep access controls simple and effective and +make sure that users will never be interrupted by the stupidity of complexity. +

    Logon Scripts

    +Please refer to the section of this document on Advanced Network Administration for information +regarding the network logon script options for Samba-3. Logon scripts can help to ensure that +all users gain share and printer connections they need. +

    +Logon scripts can be created on-the-fly so that all commands executed are specific to the +rights and privileges granted to the user. The preferred controls should be affected through +group membership so that group information can be used to custom create a logon script using +the root preexec parameters to the NETLOGON share. +

    +Some sites prefer to use a tool such as kixstart to establish a controlled +user environment. In any case you may wish to do a google search for logon script process controls. +In particular, you may wish to explore the use of the Microsoft knowledgebase article KB189105 that +deals with how to add printers without user intervention via the logon script process. +

    Profile Migration/Creation

    +User and Group Profiles may be migrated using the tools described in the section titled Desktop Profile +Management. +

    +Profiles may also be managed using the Samba-3 tool profiles. This tool allows +the MS Windows NT style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file +to be changed to the SID of the Samba-3 domain. +

    User and Group Accounts

    +It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before +attempting to migrate user and group accounts it is STRONGLY advised to create in Samba-3 the +groups that are present on the MS Windows NT4 domain AND to connect these to +suitable Unix/Linux groups. Following this simple advice will mean that all user and group attributes +should migrate painlessly. +

    Steps In Migration Process

    +The approximate migration process is described below. +

    • +You will have an NT4 PDC that has the users, groups, policies and profiles to be migrated +

    • +Samba-3 set up as a DC with netlogon share, profile share, etc. +

    Procedure 31.1. The Account Migration Process

    1. Create a BDC account for the samba server using NT Server Manager

      1. Samba must NOT be running

    2. rpcclient NT4PDC -U Administrator%passwd

      1. lsaquery

      2. Note the SID returned

    3. net getsid -S NT4PDC -w DOMNAME -U Administrator%passwd

      1. Note the SID

    4. net getlocalsid

      1. Note the SID, now check that all three SIDS reported are the same!

    5. net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd

    6. net rpc vampire -S NT4PDC -U administrator%passwd

    7. pdbedit -L

      1. Note - did the users migrate?

    8. initGrps.sh DOMNAME

    9. net groupmap list

      1. Now check that all groups are recognised

    10. net rpc vampire -S NT4PDC -U administrator%passwd

    11. pdbedit -Lv

      1. Note - check that all group membership has been migrated

    +Now it is time to migrate all the profiles, then migrate all policy files. +More later. +

    Migration Options

    +Based on feedback from many sites as well as from actual installation and maintenance +experience sites that wish to migrate from MS Windows NT4 Domain Control to a Samba +based solution fit into three basic categories. +

    Table 31.1. The 3 Major Site Types

    Number of UsersDescription
    < 50

    Want simple conversion with NO pain

    50 - 250

    Want new features, can manage some in-house complexity

    > 250

    Solution/Implementation MUST scale well, complex needs. Cross departmental decision process. Local expertise in most areas

    Planning for Success

    +There are three basic choices for sites that intend to migrate from MS Windows NT4 +to Samba-3. +

    • + Simple Conversion (total replacement) +

    • + Upgraded Conversion (could be one of integration) +

    • + Complete Redesign (completely new solution) +

    +No matter what choice you make, the following rules will minimise down-stream problems: +

    • + Take sufficient time +

    • + Avoid Panic +

    • + Test ALL assumptions +

    • + Test full roll-out program, including workstation deployment +

    Table 31.2. Nature of the Conversion Choices

    SimpleUpgradedRedesign

    Make use of minimal OS specific features

    Translate NT4 features to new host OS features

    Decide:

    Suck all accounts from NT4 into Samba-3

    Copy and improve:

    Authentication Regime (database location and access)

    Make least number of operational changes

    Make progressive improvements

    Desktop Management Methods

    Take least amount of time to migrate

    Minimise user impact

    Better Control of Desktops / Users

    Live versus Isolated Conversion

    Maximise functionality

    Identify Needs for: Manageability, Scalability, Security, Availability

    Integrate Samba-3 then migrate while users are active, then Change of control (ie: swap out)

    Take advantage of lower maintenance opportunity

    Samba Implementation Choices

    +Authentication database back end
+	Winbind (external Samba or NT4/200x server)
+	Can use pam_mkhomedir.so to auto-create home dirs
+	External server could use Active Directory or NT4 Domain
+
+Database type
+	smbpasswd, tdbsam, ldapsam, mysqlsam
+
+Access Control Points
+	On the Share itself (Use NT4 Server Manager)
+	On the file system
+	Unix permissions on files and directories
+	Enable Posix ACLs in file system?
+	Through Samba share parameters
+		Not recommended - except as only resort
+
+Policies (migrate or create new ones)
+	Group Policy Editor (NT4)
+	Watch out for Tattoo effect
+
+User and Group Profiles
+	Platform specific so use platform tool to change from a Local
+	to a Roaming profile Can use new profiles tool to change SIDs
+	(NTUser.DAT)
+
+Logon Scripts (Know how they work)
+
+User and Group mapping to Unix/Linux
+	username map facility may be needed
+	Use 'net groupmap' to connect NT4 groups to Unix groups
+	Use pdbedit to set/change user configuration
+NOTE:
+If migrating to LDAP back end it may be easier to dump initial LDAP database
+to LDIF, then edit, then reload into LDAP
+
+	OS specific scripts / programs may be needed
+		Add / delete Users
+			Note OS limits on size of name (Linux 8 chars)
+				NT4 up to 254 chars
+		Add / delete machines
+			Applied only to domain members (note up to 16 chars)
+		Add / delete Groups
+			Note OS limits on size and nature
+				Linux limit is 16 char,
+				no spaces and no upper case chars (groupadd)
+
+Migration Tools
+	Domain Control (NT4 Style)
+	Profiles, Policies, Access Controls, Security
+
+Migration Tools
+	Samba: net, rpcclient, smbpasswd, pdbedit, profiles
+	Windows: NT4 Domain User Manager, Server Manager (NEXUS)
+
+Authentication
+	New SAM back end (smbpasswd, tdbsam, ldapsam, mysqlsam)
+

    +

    Prev Up Next
    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0 Home Chapter 32. SWAT - The Samba Web Administration Tool
    diff --git a/docs/htmldocs/NetworkBrowsing.html b/docs/htmldocs/NetworkBrowsing.html new file mode 100644 index 0000000000..eb4d9858ca --- /dev/null +++ b/docs/htmldocs/NetworkBrowsing.html @@ -0,0 +1,957 @@ +Chapter 10. Samba / MS Windows Network Browsing Guide
    Chapter 10. Samba / MS Windows Network Browsing Guide
    Prev Part III. Advanced Configuration Next

    Chapter 10. Samba / MS Windows Network Browsing Guide

    John H. Terpstra

    Samba Team

    July 5, 1998

    Updated: April 21, 2003

    Table of Contents

    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"

    +This document contains detailed information as well as a fast track guide to +implementing browsing across subnets and / or across workgroups (or domains). +WINS is the best tool for resolution of NetBIOS names to IP addresses. WINS is +NOT involved in browse list handling except by way of name to address resolution. +

    Note

    +MS Windows 2000 and later can be configured to operate with NO NetBIOS +over TCP/IP. Samba-3 and later also supports this mode of operation. +When the use of NetBIOS over TCP/IP has been disabled then the primary +means for resolution of MS Windows machine names is via DNS and Active Directory. +The following information assumes that your site is running NetBIOS over TCP/IP. +

    Features and Benefits

    +Someone once referred to the past in terms of: They were the worst of times, +they were the best of times. The more we look back, them more we long for what was and +hope it never returns!. +

    +For many MS Windows network administrators, that statement sums up their feelings about +NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle +nature was just par for the course. For those who never quite managed to tame its +lusty features, NetBIOS is like Paterson's Curse. +

    +For those not familiar with botanical problems in Australia: Paterson's curse, +Echium plantagineum, was introduced to Australia from Europe during the mid-nineteenth +century. Since then it has spread rapidly. The high seed production, with densities of +thousands of seeds per square metre, a seed longevity of more than seven years, and an +ability to germinate at any time of year, given the right conditions, are some of the +features which make it such a persistent weed. +

    +In this chapter we explore vital aspects of SMB (Server Message Block) networking with +a particular focus on SMB as implemented through running NetBIOS (Network Basic +Input / Output System) over TCP/IP. Since Samba does NOT implement SMB or NetBIOS over +any other protocols we need to know how to configure our network environment and simply +remember to use nothing but TCP/IP on all our MS Windows network clients. +

    +Samba provides the ability to implement a WINS (Windows Internetworking Name Server) +and implements extensions to Microsoft's implementation of WINS. These extensions +help Samba to affect stable WINS operations beyond the normal scope of MS WINS. +

    +Please note that WINS is exclusively a service that applies only to those systems +that run NetBIOS over TCP/IP. MS Windows 200x / XP have the capacity to turn off +support for NetBIOS, in which case WINS is of no relevance. Samba-3 supports this also. +

    +For those networks on which NetBIOS has been disabled (ie: WINS is NOT required) +the use of DNS is necessary for host name resolution. +

    What is Browsing?

    +To most people browsing means that they can see the MS Windows and Samba servers +in the Network Neighborhood, and when the computer icon for a particular server is +clicked, it opens up and shows the shares and printers available on the target server. +

    +What seems so simple is in fact a very complex interaction of different technologies. +The technologies (or methods) employed in making all of this work includes: +

    MS Windows machines register their presence to the network
    Machines announce themselves to other machines on the network
    One or more machine on the network collates the local announcements
    The client machine finds the machine that has the collated list of machines
    The client machine is able to resolve the machine names to IP addresses
    The client machine is able to connect to a target machine

    +The Samba application that controls browse list management and name resolution is +called nmbd. The configuration parameters involved in nmbd's operation are: +

    +		
+	Browsing options:
+	-----------------
+		* os level
+		  lm announce
+		  lm interval
+		* preferred master
+		* local master
+		* domain master
+		  browse list
+		  enhanced browsing
+
+	Name Resolution Method:
+	-----------------------
+		* name resolve order
+
+	WINS options:
+	-------------
+		  dns proxy
+		  wins proxy
+		* wins server
+		* wins support
+		  wins hook
+

    +For Samba, the WINS Server and WINS Support are mutually exclusive options. Those marked with +an '*' are the only options that commonly MAY need to be modified. Even if not one of these +parameters is set nmbd will still do it's job. +

    Discussion

    +Firstly, all MS Windows networking uses SMB (Server Message Block) based messaging. +SMB messaging may be implemented with or without NetBIOS. MS Windows 200x supports +NetBIOS over TCP/IP for backwards compatibility. Microsoft is intent on phasing out NetBIOS +support. +

    NetBIOS over TCP/IP

    +Samba implements NetBIOS, as does MS Windows NT / 200x / XP, by encapsulating it over TCP/IP. +MS Windows products can do likewise. NetBIOS based networking uses broadcast messaging to +affect browse list management. When running NetBIOS over TCP/IP, this uses UDP based messaging. +UDP messages can be broadcast or unicast. +

    +Normally, only unicast UDP messaging can be forwarded by routers. The +remote announce parameter to smb.conf helps to project browse announcements +to remote network segments via unicast UDP. Similarly, the +remote browse sync parameter of smb.conf +implements browse list collation using unicast UDP. +

    +Secondly, in those networks where Samba is the only SMB server technology, +wherever possible nmbd should be configured on one (1) machine as the WINS +server. This makes it easy to manage the browsing environment. If each network +segment is configured with it's own Samba WINS server, then the only way to +get cross segment browsing to work is by using the +remote announce and the remote browse sync +parameters to your smb.conf file. +

    +If only one WINS server is used for an entire multi-segment network then +the use of the remote announce and the +remote browse sync parameters should NOT be necessary. +

    +As of Samba 3 WINS replication is being worked on. The bulk of the code has +been committed, but it still needs maturation. This is NOT a supported feature +of the Samba-3.0.0 release. Hopefully, this will become a supported feature +of one of the Samba-3 release series. +

    +Right now Samba WINS does not support MS-WINS replication. This means that +when setting up Samba as a WINS server there must only be one nmbd +configured as a WINS server on the network. Some sites have used multiple Samba WINS +servers for redundancy (one server per subnet) and then used +remote browse sync and remote announce +to affect browse list collation across all segments. Note that this means clients +will only resolve local names, and must be configured to use DNS to resolve names +on other subnets in order to resolve the IP addresses of the servers they can see +on other subnets. This setup is not recommended, but is mentioned as a practical +consideration (ie: an 'if all else fails' scenario). +

    +Lastly, take note that browse lists are a collection of unreliable broadcast +messages that are repeated at intervals of not more than 15 minutes. This means +that it will take time to establish a browse list and it can take up to 45 +minutes to stabilise, particularly across network segments. +

    TCP/IP - without NetBIOS

    +All TCP/IP using systems use various forms of host name resolution. The primary +methods for TCP/IP hostname resolutions involves either a static file (/etc/hosts +) or DNS (the Domain Name System). DNS is the technology that makes +the Internet usable. DNS based host name resolution is supported by nearly all TCP/IP +enabled systems. Only a few embedded TCP/IP systems do not support DNS. +

    +When an MS Windows 200x / XP system attempts to resolve a host name to an IP address +it follows a defined path: +

    1. + Checks the hosts file. It is located in + C:\WinNT\System32\Drivers\etc. +

    2. + Does a DNS lookup +

    3. + Checks the NetBIOS name cache +

    4. + Queries the WINS server +

    5. + Does a broadcast name lookup over UDP +

    6. + Looks up entries in LMHOSTS. It is located in + C:\WinNT\System32\Drivers\etc. +

    +Windows 200x / XP can register it's host name with a Dynamic DNS server. You can +force register with a Dynamic DNS server in Windows 200x / XP using: +ipconfig /registerdns +

    +With Active Directory (ADS), a correctly functioning DNS server is absolutely +essential. In the absence of a working DNS server that has been correctly configured, +MS Windows clients and servers will be totally unable to locate each other, +consequently network services will be severely impaired. +

    +The use of Dynamic DNS is highly recommended with Active Directory, in which case +the use of BIND9 is preferred for it's ability to adequately support the SRV (service) +records that are needed for Active Directory. +

    DNS and Active Directory

    +Occasionally we hear from Unix network administrators who want to use a Unix based Dynamic +DNS server in place of the Microsoft DNS server. While this might be desirable to some, the +MS Windows 200x DNS server is auto-configured to work with Active Directory. It is possible +to use BIND version 8 or 9, but it will almost certainly be necessary to create service records +so that MS Active Directory clients can resolve host names to locate essential network services. +The following are some of the default service records that Active Directory requires: +

    • _ldap._tcp.pdc.ms-dcs.Domain

      + This provides the address of the Windows NT PDC for the Domain. +

    • _ldap._tcp.pdc.ms-dcs.DomainTree

      + Resolves the addresses of Global Catalog servers in the domain. +

    • _ldap._tcp.site.sites.writable.ms-dcs.Domain

      + Provides list of domain controllers based on sites. +

    • _ldap._tcp.writable.ms-dcs.Domain

      + Enumerates list of domain controllers that have the writable + copies of the Active Directory data store. +

    • _ldap._tcp.GUID.domains.ms-dcs.DomainTree

      + Entry used by MS Windows clients to locate machines using the + Global Unique Identifier. +

    • _ldap._tcp.Site.gc.ms-dcs.DomainTree

      + Used by MS Windows clients to locate site configuration dependent + Global Catalog server. +

    How Browsing Functions

    +MS Windows machines register their NetBIOS names +(ie: the machine name for each service type in operation) on start +up. The exact method by which this name registration +takes place is determined by whether or not the MS Windows client/server +has been given a WINS server address, whether or not LMHOSTS lookup +is enabled, or if DNS for NetBIOS name resolution is enabled, etc. +

    +In the case where there is no WINS server, all name registrations as +well as name lookups are done by UDP broadcast. This isolates name +resolution to the local subnet, unless LMHOSTS is used to list all +names and IP addresses. In such situations Samba provides a means by +which the Samba server name may be forcibly injected into the browse +list of a remote MS Windows network (using the +remote announce parameter). +

    +Where a WINS server is used, the MS Windows client will use UDP +unicast to register with the WINS server. Such packets can be routed +and thus WINS allows name resolution to function across routed networks. +

    +During the startup process an election will take place to create a +local master browser if one does not already exist. On each NetBIOS network +one machine will be elected to function as the domain master browser. This +domain browsing has nothing to do with MS security domain control. +Instead, the domain master browser serves the role of contacting each local +master browser (found by asking WINS or from LMHOSTS) and exchanging browse +list contents. This way every master browser will eventually obtain a complete +list of all machines that are on the network. Every 11-15 minutes an election +is held to determine which machine will be the master browser. By the nature of +the election criteria used, the machine with the highest uptime, or the +most senior protocol version, or other criteria, will win the election +as domain master browser. +

    +Clients wishing to browse the network make use of this list, but also depend +on the availability of correct name resolution to the respective IP +address/addresses. +

    +Any configuration that breaks name resolution and/or browsing intrinsics +will annoy users because they will have to put up with protracted +inability to use the network services. +

    +Samba supports a feature that allows forced synchronisation +of browse lists across routed networks using the remote +browse sync parameter in the smb.conf file. +This causes Samba to contact the local master browser on a remote network and +to request browse list synchronisation. This effectively bridges +two networks that are separated by routers. The two remote +networks may use either broadcast based name resolution or WINS +based name resolution, but it should be noted that the remote +browse sync parameter provides browse list synchronisation - and +that is distinct from name to address resolution, in other +words, for cross subnet browsing to function correctly it is +essential that a name to address resolution mechanism be provided. +This mechanism could be via DNS, /etc/hosts, +and so on. +

    Setting up WORKGROUP Browsing

    +To set up cross subnet browsing on a network containing machines +in up to be in a WORKGROUP, not an NT Domain you need to set up one +Samba server to be the Domain Master Browser (note that this is *NOT* +the same as a Primary Domain Controller, although in an NT Domain the +same machine plays both roles). The role of a Domain master browser is +to collate the browse lists from local master browsers on all the +subnets that have a machine participating in the workgroup. Without +one machine configured as a domain master browser each subnet would +be an isolated workgroup, unable to see any machines on any other +subnet. It is the presence of a domain master browser that makes +cross subnet browsing possible for a workgroup. +

    +In an WORKGROUP environment the domain master browser must be a +Samba server, and there must only be one domain master browser per +workgroup name. To set up a Samba server as a domain master browser, +set the following option in the [global] section +of the smb.conf file : +

    +

    +	domain master = yes
+

    +

    +The domain master browser should also preferrably be the local master +browser for its own subnet. In order to achieve this set the following +options in the [global] section of the smb.conf file : +

    +

    +	domain master = yes
+	local master = yes
+	preferred master = yes
+	os level = 65
+

    +

    +The domain master browser may be the same machine as the WINS +server, if you require. +

    +Next, you should ensure that each of the subnets contains a +machine that can act as a local master browser for the +workgroup. Any MS Windows NT/2K/XP/2003 machine should be +able to do this, as will Windows 9x machines (although these +tend to get rebooted more often, so it's not such a good idea +to use these). To make a Samba server a local master browser +set the following options in the [global] section of the +smb.conf file : +

    +

    +	domain master = no
+	local master = yes
+	preferred master = yes
+	os level = 65
+

    +

    +Do not do this for more than one Samba server on each subnet, +or they will war with each other over which is to be the local +master browser. +

    +The local master parameter allows Samba to act as a +local master browser. The preferred master causes nmbd +to force a browser election on startup and the os level +parameter sets Samba high enough so that it should win any browser elections. +

    +If you have an NT machine on the subnet that you wish to +be the local master browser then you can disable Samba from +becoming a local master browser by setting the following +options in the [global] section of the +smb.conf file : +

    +

    +	domain master = no
+	local master = no
+	preferred master = no
+	os level = 0
+

    +

    Setting up DOMAIN Browsing

    +If you are adding Samba servers to a Windows NT Domain then +you must not set up a Samba server as a domain master browser. +By default, a Windows NT Primary Domain Controller for a domain +is also the Domain master browser for that domain, and many +things will break if a Samba server registers the Domain master +browser NetBIOS name (DOMAIN<1B>) +with WINS instead of the PDC. +

    +For subnets other than the one containing the Windows NT PDC +you may set up Samba servers as local master browsers as +described. To make a Samba server a local master browser set +the following options in the [global] section +of the smb.conf file : +

    +

    +	domain master = no
+	local master = yes
+	preferred master = yes
+	os level = 65
+

    +

    +If you wish to have a Samba server fight the election with machines +on the same subnet you may set the os level parameter +to lower levels. By doing this you can tune the order of machines that +will become local master browsers if they are running. For +more details on this see the section +Forcing Samba to be the master browser +below. +

    +If you have Windows NT machines that are members of the domain +on all subnets, and you are sure they will always be running then +you can disable Samba from taking part in browser elections and +ever becoming a local master browser by setting following options +in the [global] section of the smb.conf +file : +

    +

    +        domain master = no
+        local master = no
+        preferred master = no
+        os level = 0
+

    +

    Forcing Samba to be the master

    +Who becomes the master browser is determined by an election +process using broadcasts. Each election packet contains a number of parameters +which determine what precedence (bias) a host should have in the +election. By default Samba uses a very low precedence and thus loses +elections to just about anyone else. +

    +If you want Samba to win elections then just set the os level global +option in smb.conf to a higher number. It defaults to 0. Using 34 +would make it win all elections over every other system (except other +samba systems!) +

    +A os level of 2 would make it beat WfWg and Win95, but not MS Windows +NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32. +

    The maximum os level is 255

    +If you want Samba to force an election on startup, then set the +preferred master global option in smb.conf to yes. Samba will +then have a slight advantage over other potential master browsers +that are not preferred master browsers. Use this parameter with +care, as if you have two hosts (whether they are Windows 95 or NT or +Samba) on the same local subnet both set with preferred master to +yes, then periodically and continually they will force an election +in order to become the local master browser. +

    +If you want Samba to be a domain master browser, then it is +recommended that you also set preferred master to yes, because +Samba will not become a domain master browser for the whole of your +LAN or WAN if it is not also a local master browser on its own +broadcast isolated subnet. +

    +It is possible to configure two Samba servers to attempt to become +the domain master browser for a domain. The first server that comes +up will be the domain master browser. All other Samba servers will +attempt to become the domain master browser every 5 minutes. They +will find that another Samba server is already the domain master +browser and will fail. This provides automatic redundancy, should +the current domain master browser fail. +

    Making Samba the domain master

    +The domain master is responsible for collating the browse lists of +multiple subnets so that browsing can occur between subnets. You can +make Samba act as the domain master by setting domain master = yes +in smb.conf. By default it will not be a domain master. +

    +Note that you should not set Samba to be the domain master for a +workgroup that has the same name as an NT Domain. +

    +When Samba is the domain master and the master browser, it will listen +for master announcements (made roughly every twelve minutes) from local +master browsers on other subnets and then contact them to synchronise +browse lists. +

    +If you want Samba to be the domain master then I suggest you also set +the os level high enough to make sure it wins elections, and set +preferred master to yes, to get Samba to force an election on +startup. +

    +Note that all your servers (including Samba) and clients should be +using a WINS server to resolve NetBIOS names. If your clients are only +using broadcasting to resolve NetBIOS names, then two things will occur: +

    1. + your local master browsers will be unable to find a domain master + browser, as it will only be looking on the local subnet. +

    2. + if a client happens to get hold of a domain-wide browse list, and + a user attempts to access a host in that list, it will be unable to + resolve the NetBIOS name of that host. +

    +If, however, both Samba and your clients are using a WINS server, then: +

    1. + your local master browsers will contact the WINS server and, as long as + Samba has registered that it is a domain master browser with the WINS + server, your local master browser will receive Samba's IP address + as its domain master browser. +

    2. + when a client receives a domain-wide browse list, and a user attempts + to access a host in that list, it will contact the WINS server to + resolve the NetBIOS name of that host. as long as that host has + registered its NetBIOS name with the same WINS server, the user will + be able to see that host. +

    Note about broadcast addresses

    +If your network uses a "0" based broadcast address (for example if it +ends in a 0) then you will strike problems. Windows for Workgroups +does not seem to support a 0's broadcast and you will probably find +that browsing and name lookups won't work. +

    Multiple interfaces

    +Samba now supports machines with multiple network interfaces. If you +have multiple interfaces then you will need to use the interfaces +option in smb.conf to configure them. +

    Use of the Remote Announce parameter

    +The remote announce parameter of +smb.conf can be used to forcibly ensure +that all the NetBIOS names on a network get announced to a remote network. +The syntax of the remote announce parameter is: +

    +	remote announce = a.b.c.d [e.f.g.h] ...
+

    +or +

    +	remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...
+

    + +where: +

    a.b.c.d and +e.f.g.h

    is either the LMB (Local Master Browser) IP address +or the broadcast address of the remote network. +ie: the LMB is at 192.168.1.10, or the address +could be given as 192.168.1.255 where the netmask +is assumed to be 24 bits (255.255.255.0). +When the remote announcement is made to the broadcast +address of the remote network, every host will receive +our announcements. This is noisy and therefore +undesirable but may be necessary if we do NOT know +the IP address of the remote LMB.

    WORKGROUP

    is optional and can be either our own workgroup +or that of the remote network. If you use the +workgroup name of the remote network then our +NetBIOS machine names will end up looking like +they belong to that workgroup, this may cause +name resolution problems and should be avoided. +

    +

    Use of the Remote Browse Sync parameter

    +The remote browse sync parameter of +smb.conf is used to announce to +another LMB that it must synchronise its NetBIOS name list with our +Samba LMB. It works ONLY if the Samba server that has this option is +simultaneously the LMB on its network segment. +

    +The syntax of the remote browse sync parameter is: + +

    +remote browse sync = a.b.c.d
+

    + +where a.b.c.d is either the IP address of the +remote LMB or else is the network broadcast address of the remote segment. +

    WINS - The Windows Internetworking Name Server

    +Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly +recommended. Every NetBIOS machine registers its name together with a +name_type value for each of several types of service it has available. +eg: It registers its name directly as a unique (the type 0x03) name. +It also registers its name if it is running the LanManager compatible +server service (used to make shares and printers available to other users) +by registering the server (the type 0x20) name. +

    +All NetBIOS names are up to 15 characters in length. The name_type variable +is added to the end of the name - thus creating a 16 character name. Any +name that is shorter than 15 characters is padded with spaces to the 15th +character. ie: All NetBIOS names are 16 characters long (including the +name_type information). +

    +WINS can store these 16 character names as they get registered. A client +that wants to log onto the network can ask the WINS server for a list +of all names that have registered the NetLogon service name_type. This saves +broadcast traffic and greatly expedites logon processing. Since broadcast +name resolution can not be used across network segments this type of +information can only be provided via WINS or via statically configured +lmhosts files that must reside on all clients in the +absence of WINS. +

    +WINS also serves the purpose of forcing browse list synchronisation by all +LMB's. LMB's must synchronise their browse list with the DMB (domain master +browser) and WINS helps the LMB to identify it's DMB. By definition this +will work only within a single workgroup. Note that the domain master browser +has NOTHING to do with what is referred to as an MS Windows NT Domain. The +later is a reference to a security environment while the DMB refers to the +master controller for browse list information only. +

    +Use of WINS will work correctly only if EVERY client TCP/IP protocol stack +has been configured to use the WINS server/s. Any client that has not been +configured to use the WINS server will continue to use only broadcast based +name registration so that WINS may NEVER get to know about it. In any case, +machines that have not registered with a WINS server will fail name to address +lookup attempts by other clients and will therefore cause workstation access +errors. +

    +To configure Samba as a WINS server just add +wins support = yes to the smb.conf +file [globals] section. +

    +To configure Samba to register with a WINS server just add +wins server = a.b.c.d to your smb.conf file [globals] section. +

    Important

    +Never use both wins support = yes together +with wins server = a.b.c.d +particularly not using it's own IP address. +Specifying both will cause nmbd to refuse to start! +

    Setting up a WINS server

    +Either a Samba machine or a Windows NT Server machine may be set up +as a WINS server. To set a Samba machine to be a WINS server you must +add the following option to the smb.conf file on the selected machine : +in the [globals] section add the line +

    +

    +	wins support = yes
+

    +

    +Versions of Samba prior to 1.9.17 had this parameter default to +yes. If you have any older versions of Samba on your network it is +strongly suggested you upgrade to a recent version, or at the very +least set the parameter to 'no' on all these machines. +

    +Machines with wins support = yes will keep a list of +all NetBIOS names registered with them, acting as a DNS for NetBIOS names. +

    +You should set up only ONE WINS server. Do NOT set the +wins support = yes option on more than one Samba +server. +

    +To set up a Windows NT Server as a WINS server you need to set up +the WINS service - see your NT documentation for details. Note that +Windows NT WINS Servers can replicate to each other, allowing more +than one to be set up in a complex subnet environment. As Microsoft +refuses to document these replication protocols, Samba cannot currently +participate in these replications. It is possible in the future that +a Samba->Samba WINS replication protocol may be defined, in which +case more than one Samba machine could be set up as a WINS server +but currently only one Samba server should have the +wins support = yes parameter set. +

    +After the WINS server has been configured you must ensure that all +machines participating on the network are configured with the address +of this WINS server. If your WINS server is a Samba machine, fill in +the Samba machine IP address in the Primary WINS Server field of +the Control Panel->Network->Protocols->TCP->WINS Server dialogs +in Windows 95 or Windows NT. To tell a Samba server the IP address +of the WINS server add the following line to the [global] section of +all smb.conf files : +

    +

    +	wins server = <name or IP address>
+

    +

    +where <name or IP address> is either the DNS name of the WINS server +machine or its IP address. +

    +Note that this line MUST NOT BE SET in the smb.conf file of the Samba +server acting as the WINS server itself. If you set both the +wins support = yes option and the +wins server = <name> option then +nmbd will fail to start. +

    +There are two possible scenarios for setting up cross subnet browsing. +The first details setting up cross subnet browsing on a network containing +Windows 95, Samba and Windows NT machines that are not configured as +part of a Windows NT Domain. The second details setting up cross subnet +browsing on networks that contain NT Domains. +

    WINS Replication

    +Samba-3 permits WINS replication through the use of the wrepld utility. +This tool is not currently capable of being used as it is still in active development. +As soon as this tool becomes moderately functional we will prepare man pages and enhance this +section of the documentation to provide usage and technical details. +

    Static WINS Entries

    +Adding static entries to your Samba-3 WINS server is actually fairly easy. +All you have to do is add a line to wins.dat, typically +located in /usr/local/samba/var/locks. +

    +Entries in wins.dat take the form of + +

    +"NAME#TYPE" TTL ADDRESS+ FLAGS
+

    + +where NAME is the NetBIOS name, TYPE is the NetBIOS type, TTL is the +time-to-live as an absolute time in seconds, ADDRESS+ is one or more +addresses corresponding to the registration and FLAGS are the NetBIOS +flags for the registration. +

    +A typical dynamic entry looks like: +

    +"MADMAN#03" 1055298378 192.168.1.2 66R
+

    + +To make it static, all that has to be done is set the TTL to 0: + +

    +"MADMAN#03" 0 192.168.1.2 66R
+

    +

    +Though this method works with early Samba-3 versions, there's a +possibility that it may change in future versions if WINS replication +is added. +

    Helpful Hints

    +The following hints should be carefully considered as they are stumbling points +for many new network administrators. +

    Windows Networking Protocols

    Warning

    +Do NOT use more than one (1) protocol on MS Windows machines +

    +A very common cause of browsing problems results from installing more than +one protocol on an MS Windows machine. +

    +Every NetBIOS machine takes part in a process of electing the LMB (and DMB) +every 15 minutes. A set of election criteria is used to determine the order +of precedence for winning this election process. A machine running Samba or +Windows NT will be biased so that the most suitable machine will predictably +win and thus retain it's role. +

    +The election process is "fought out" so to speak over every NetBIOS network +interface. In the case of a Windows 9x machine that has both TCP/IP and IPX +installed and has NetBIOS enabled over both protocols the election will be +decided over both protocols. As often happens, if the Windows 9x machine is +the only one with both protocols then the LMB may be won on the NetBIOS +interface over the IPX protocol. Samba will then lose the LMB role as Windows +9x will insist it knows who the LMB is. Samba will then cease to function +as an LMB and thus browse list operation on all TCP/IP only machines will +fail. +

    +Windows 95, 98, 98se, Me are referred to generically as Windows 9x. +The Windows NT4, 2000, XP and 2003 use common protocols. These are roughly +referred to as the WinNT family, but it should be recognised that 2000 and +XP/2003 introduce new protocol extensions that cause them to behave +differently from MS Windows NT4. Generally, where a server does NOT support +the newer or extended protocol, these will fall back to the NT4 protocols. +

    +The safest rule of all to follow it this - USE ONLY ONE PROTOCOL! +

    Name Resolution Order

    +Resolution of NetBIOS names to IP addresses can take place using a number +of methods. The only ones that can provide NetBIOS name_type information +are: +

    WINS: the best tool!
    LMHOSTS: is static and hard to maintain.
    Broadcast: uses UDP and can not resolve names across remote segments.

    +Alternative means of name resolution includes: +

    /etc/hosts: is static, hard to maintain, and lacks name_type info
    DNS: is a good choice but lacks essential name_type info.

    +Many sites want to restrict DNS lookups and want to avoid broadcast name +resolution traffic. The name resolve order parameter is +of great help here. The syntax of the name resolve order +parameter is: +

    +name resolve order = wins lmhosts bcast host
+

    +or +

    +name resolve order = wins lmhosts  	(eliminates bcast and host)
+

    +The default is: +

    +name resolve order = host lmhost wins bcast
+

    +where "host" refers the the native methods used by the Unix system +to implement the gethostbyname() function call. This is normally +controlled by /etc/host.conf, /etc/nsswitch.conf and /etc/resolv.conf. +

    Technical Overview of browsing

    +SMB networking provides a mechanism by which clients can access a list +of machines in a network, a so-called browse list. This list +contains machines that are ready to offer file and/or print services +to other machines within the network. Thus it does not include +machines which aren't currently able to do server tasks. The browse +list is heavily used by all SMB clients. Configuration of SMB +browsing has been problematic for some Samba users, hence this +document. +

    +MS Windows 2000 and later, as with Samba 3 and later, can be +configured to not use NetBIOS over TCP/IP. When configured this way, +it is imperative that name resolution (using DNS/LDAP/ADS) be correctly +configured and operative. Browsing will NOT work if name resolution +from SMB machine names to IP addresses does not function correctly. +

    +Where NetBIOS over TCP/IP is enabled use of a WINS server is highly +recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. +WINS allows remote segment clients to obtain NetBIOS name_type information +that can NOT be provided by any other means of name resolution. +

    Browsing support in Samba

    +Samba facilitates browsing. The browsing is supported by nmbd +and is also controlled by options in the smb.conf file. +Samba can act as a local browse master for a workgroup and the ability +to support domain logons and scripts is now available. +

    +Samba can also act as a domain master browser for a workgroup. This +means that it will collate lists from local browse masters into a +wide area network server list. In order for browse clients to +resolve the names they may find in this list, it is recommended that +both Samba and your clients use a WINS server. +

    +Note that you should NOT set Samba to be the domain master for a +workgroup that has the same name as an NT Domain: on each wide area +network, you must only ever have one domain master browser per workgroup, +regardless of whether it is NT, Samba or any other type of domain master +that is providing this service. +

    Note

    +Nmbd can be configured as a WINS server, but it is not +necessary to specifically use Samba as your WINS server. MS Windows +NT4, Server or Advanced Server 2000 or 2003 can be configured as +your WINS server. In a mixed NT/2000/2003 server and Samba environment on +a Wide Area Network, it is recommended that you use the Microsoft +WINS server capabilities. In a Samba-only environment, it is +recommended that you use one and only one Samba server as your WINS server. +

    +To get browsing to work you need to run nmbd as usual, but will need +to use the workgroup option in smb.conf +to control what workgroup Samba becomes a part of. +

    +Samba also has a useful option for a Samba server to offer itself for +browsing on another subnet. It is recommended that this option is only +used for 'unusual' purposes: announcements over the internet, for +example. See remote announce in the +smb.conf man page. +

    Problem resolution

    +If something doesn't work then hopefully the log.nmbd file will help +you track down the problem. Try a debug level of 2 or 3 for finding +problems. Also note that the current browse list usually gets stored +in text form in a file called browse.dat. +

    +Note that if it doesn't work for you, then you should still be able to +type the server name as \\SERVER in filemanager then +hit enter and filemanager should display the list of available shares. +

    +Some people find browsing fails because they don't have the global +guest account set to a valid account. Remember that the +IPC$ connection that lists the shares is done as guest, and thus you must +have a valid guest account. +

    +MS Windows 2000 and upwards (as with Samba) can be configured to disallow +anonymous (ie: Guest account) access to the IPC$ share. In that case, the +MS Windows 2000/XP/2003 machine acting as an SMB/CIFS client will use the +name of the currently logged in user to query the IPC$ share. MS Windows +9X clients are not able to do this and thus will NOT be able to browse +server resources. +

    +The other big problem people have is that their broadcast address, +netmask or IP address is wrong (specified with the "interfaces" option +in smb.conf) +

    Browsing across subnets

    +Since the release of Samba 1.9.17(alpha1), Samba has supported the +replication of browse lists across subnet boundaries. This section +describes how to set this feature up in different settings. +

    +To see browse lists that span TCP/IP subnets (ie. networks separated +by routers that don't pass broadcast traffic), you must set up at least +one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing +NetBIOS name to IP address translation to be done by doing a direct +query of the WINS server. This is done via a directed UDP packet on +port 137 to the WINS server machine. The reason for a WINS server is +that by default, all NetBIOS name to IP address translation is done +by broadcasts from the querying machine. This means that machines +on one subnet will not be able to resolve the names of machines on +another subnet without using a WINS server. +

    +Remember, for browsing across subnets to work correctly, all machines, +be they Windows 95, Windows NT, or Samba servers must have the IP address +of a WINS server given to them by a DHCP server, or by manual configuration +(for Win95 and WinNT, this is in the TCP/IP Properties, under Network +settings) for Samba this is in the smb.conf file. +

    How does cross subnet browsing work ?

    +Cross subnet browsing is a complicated dance, containing multiple +moving parts. It has taken Microsoft several years to get the code +that achieves this correct, and Samba lags behind in some areas. +Samba is capable of cross subnet browsing when configured correctly. +

    +Consider a network set up as follows : +

    + +

    +                                   (DMB)
+             N1_A      N1_B        N1_C       N1_D        N1_E
+              |          |           |          |           |
+          -------------------------------------------------------
+            |          subnet 1                       |
+          +---+                                      +---+
+          |R1 | Router 1                  Router 2   |R2 |
+          +---+                                      +---+
+            |                                          |
+            |  subnet 2              subnet 3          |
+  --------------------------       ------------------------------------
+  |     |     |      |               |        |         |           |
+ N2_A  N2_B  N2_C   N2_D           N3_A     N3_B      N3_C        N3_D 
+                    (WINS)
+

    +

    +Consisting of 3 subnets (1, 2, 3) connected by two routers +(R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines +on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume +for the moment that all these machines are configured to be in the +same workgroup (for simplicity's sake). Machine N1_C on subnet 1 +is configured as Domain Master Browser (ie. it will collate the +browse lists for the workgroup). Machine N2_D is configured as +WINS server and all the other machines are configured to register +their NetBIOS names with it. +

    +As all these machines are booted up, elections for master browsers +will take place on each of the three subnets. Assume that machine +N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on +subnet 3 - these machines are known as local master browsers for +their particular subnet. N1_C has an advantage in winning as the +local master browser on subnet 1 as it is set up as Domain Master +Browser. +

    +On each of the three networks, machines that are configured to +offer sharing services will broadcast that they are offering +these services. The local master browser on each subnet will +receive these broadcasts and keep a record of the fact that +the machine is offering a service. This list of records is +the basis of the browse list. For this case, assume that +all the machines are configured to offer services so all machines +will be on the browse list. +

    +For each network, the local master browser on that network is +considered 'authoritative' for all the names it receives via +local broadcast. This is because a machine seen by the local +master browser via a local broadcast must be on the same +network as the local master browser and thus is a 'trusted' +and 'verifiable' resource. Machines on other networks that +the local master browsers learn about when collating their +browse lists have not been directly seen - these records are +called 'non-authoritative'. +

    +At this point the browse lists look as follows (these are +the machines you would see in your network neighborhood if +you looked in it on a particular network right now). +

    +

    Table 10.1. Browse subnet example 1

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    +

    +Note that at this point all the subnets are separate, no +machine is seen across any of the subnets. +

    +Now examine subnet 2. As soon as N2_B has become the local +master browser it looks for a Domain master browser to synchronize +its browse list with. It does this by querying the WINS server +(N2_D) for the IP address associated with the NetBIOS name +WORKGROUP<1B>. This name was registered by the Domain master +browser (N1_C) with the WINS server as soon as it was booted. +

    +Once N2_B knows the address of the Domain master browser it +tells it that is the local master browser for subnet 2 by +sending a MasterAnnouncement packet as a UDP port 138 packet. +It then synchronizes with it by doing a NetServerEnum2 call. This +tells the Domain Master Browser to send it all the server +names it knows about. Once the domain master browser receives +the MasterAnnouncement packet it schedules a synchronization +request to the sender of that packet. After both synchronizations +are done the browse lists look like : +

    +

    Table 10.2. Browse subnet example 2

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    + +Servers with a (*) after them are non-authoritative names. +

    +At this point users looking in their network neighborhood on +subnets 1 or 2 will see all the servers on both, users on +subnet 3 will still only see the servers on their own subnet. +

    +The same sequence of events that occured for N2_B now occurs +for the local master browser on subnet 3 (N3_D). When it +synchronizes browse lists with the domain master browser (N1_A) +it gets both the server entries on subnet 1, and those on +subnet 2. After N3_D has synchronized with N1_C and vica-versa +the browse lists look like. +

    +

    Table 10.3. Browse subnet example 3

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)

    + +Servers with a (*) after them are non-authoritative names. +

    +At this point users looking in their network neighborhood on +subnets 1 or 3 will see all the servers on all subnets, users on +subnet 2 will still only see the servers on subnets 1 and 2, but not 3. +

    +Finally, the local master browser for subnet 2 (N2_B) will sync again +with the domain master browser (N1_C) and will receive the missing +server entries. Finally - and as a steady state (if no machines +are removed or shut off) the browse lists will look like : +

    +

    Table 10.4. Browse subnet example 4

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)

    + +Servers with a (*) after them are non-authoritative names. +

    +Synchronizations between the domain master browser and local +master browsers will continue to occur, but this should be a +steady state situation. +

    +If either router R1 or R2 fails the following will occur: +

    1. + Names of computers on each side of the inaccessible network fragments + will be maintained for as long as 36 minutes, in the network neighbourhood + lists. +

    2. + Attempts to connect to these inaccessible computers will fail, but the + names will not be removed from the network neighbourhood lists. +

    3. + If one of the fragments is cut off from the WINS server, it will only + be able to access servers on its local subnet, by using subnet-isolated + broadcast NetBIOS name resolution. The effects are similar to that of + losing access to a DNS server. +

    Common Errors

    +Many questions are asked on the mailing lists regarding browsing. The majority of browsing +problems originate out of incorrect configuration of NetBIOS name resolution. Some are of +particular note. +

    How can one flush the Samba NetBIOS name cache without restarting Samba?

    +Samba's nmbd process controls all browse list handling. Under normal circumstances it is +safe to restart nmbd. This will effectively flush the Samba NetBIOS name cache and cause it +to be rebuilt. Note that this does NOT make certain that a rogue machine name will not re-appear +in the browse list. When nmbd is taken out of service another machine on the network will +become the browse master. This new list may still have the rogue entry in it. If you really +want to clear a rogue machine from the list then every machine on the network will need to be +shut down and restarted at after all machines are down. Failing a complete restart, the only +other thing you can do is wait until the entry times out and is then flushed from the list. +This may take a long time on some networks (months). +

    My client reports "This server is not configured to list shared resources"

    +Your guest account is probably invalid for some reason. Samba uses the +guest account for browsing in smbd. Check that your guest account is +valid. +

    See also guest account in the smb.conf man page.

    Prev Up Next
    Part III. Advanced Configuration Home Chapter 11. Account Information Databases
    diff --git a/docs/htmldocs/Other-Clients.html b/docs/htmldocs/Other-Clients.html new file mode 100644 index 0000000000..a5e7740cf0 --- /dev/null +++ b/docs/htmldocs/Other-Clients.html @@ -0,0 +1,186 @@ +Chapter 38. Samba and other CIFS clients
    Chapter 38. Samba and other CIFS clients
    Prev Part VI. Appendixes Next

    Chapter 38. Samba and other CIFS clients

    Jim McDonough

    IBM

    Jelmer R. Vernooij

    The Samba Team

    5 Mar 2001

    Table of Contents

    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba?
    How do I get printer driver download working + for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1

    This chapter contains client-specific information.

    Macintosh clients?

    +Yes. Thursby now has a CIFS Client / Server called DAVE +

    +They test it against Windows 95, Windows NT and samba for +compatibility issues. At the time of writing, DAVE was at version +1.0.1. The 1.0.0 to 1.0.1 update is available as a free download from +the Thursby web site (the speed of finder copies has been greatly +enhanced, and there are bug-fixes included). +

    +Alternatives - There are two free implementations of AppleTalk for +several kinds of UNIX machines, and several more commercial ones. +These products allow you to run file services and print services +natively to Macintosh users, with no additional support required on +the Macintosh. The two free implementations are +Netatalk, and +CAP. +What Samba offers MS +Windows users, these packages offer to Macs. For more info on these +packages, Samba, and Linux (and other UNIX-based systems) see +http://www.eats.com/linux_mac_win.html +

    OS2 Client

    How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba?

    A more complete answer to this question can be + found on + http://carol.wins.uva.nl/~leeuw/samba/warp.html.

    Basically, you need three components:

    The File and Print Client ('IBM Peer')
    TCP/IP ('Internet support')
    The "NetBIOS over TCP/IP" driver ('TCPBEUI')

    Installing the first two together with the base operating + system on a blank system is explained in the Warp manual. If Warp + has already been installed, but you now want to install the + networking support, use the "Selective Install for Networking" + object in the "System Setup" folder.

    Adding the "NetBIOS over TCP/IP" driver is not described + in the manual and just barely in the online documentation. Start + MPTS.EXE, click on OK, click on "Configure LAPS" and click + on "IBM OS/2 NETBIOS OVER TCP/IP" in 'Protocols'. This line + is then moved to 'Current Configuration'. Select that line, + click on "Change number" and increase it from 0 to 1. Save this + configuration.

    If the Samba server(s) is not on your local subnet, you + can optionally add IP names and addresses of these servers + to the "Names List", or specify a WINS server ('NetBIOS + Nameserver' in IBM and RFC terminology). For Warp Connect you + may need to download an update for 'IBM Peer' to bring it on + the same level as Warp 4. See the webpage mentioned above.

    How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba?

    You can use the free Microsoft LAN Manager 2.2c Client + for OS/2 from + + ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/. + See + http://carol.wins.uva.nl/~leeuw/lanman.html for + more information on how to install and use this client. In + a nutshell, edit the file \OS2VER in the root directory of + the OS/2 boot partition and add the lines:

    +		20=setup.exe
+		20=netwksta.sys
+		20=netvdd.sys
+

    before you install the client. Also, don't use the + included NE2000 driver because it is buggy. Try the NE2000 + or NS2000 driver from + + ftp://ftp.cdrom.com/pub/os2/network/ndis/ instead. +

    How do I get printer driver download working + for OS/2 clients?

    First, create a share called [PRINTDRV] that is + world-readable. Copy your OS/2 driver files there. Note + that the .EA_ files must still be separate, so you will need + to use the original install files, and not copy an installed + driver from an OS/2 system.

    Install the NT driver first for that printer. Then, + add to your smb.conf a parameter, os2 driver map = + filename. Then, in the file + specified by filename, map the + name of the NT driver name to the OS/2 driver name as + follows:

    nt driver name = os2 driver name.device name, e.g.:

    + HP LaserJet 5L = LASERJET.HP LaserJet 5L

    You can have multiple drivers mapped in this file.

    If you only specify the OS/2 driver name, and not the + device name, the first attempt to download the driver will + actually download the files, but the OS/2 client will tell + you the driver is not available. On the second attempt, it + will work. This is fixed simply by adding the device name + to the mapping, after which it will work on the first attempt. +

    Windows for Workgroups

    Use latest TCP/IP stack from Microsoft

    Use the latest TCP/IP stack from Microsoft if you use Windows +for Workgroups. +

    The early TCP/IP stacks had lots of bugs.

    +Microsoft has released an incremental upgrade to their TCP/IP 32-Bit +VxD drivers. The latest release can be found on their ftp site at +ftp.microsoft.com, located in /peropsys/windows/public/tcpip/wfwt32.exe. +There is an update.txt file there that describes the problems that were +fixed. New files include WINSOCK.DLL, +TELNET.EXE, +WSOCK.386, +VNBT.386, +WSTCP.386, +TRACERT.EXE, +NETSTAT.EXE, and +NBTSTAT.EXE. +

    Delete .pwl files after password change

    +WfWg does a lousy job with passwords. I find that if I change my +password on either the unix box or the PC the safest thing to do is to +delete the .pwl files in the windows directory. The PC will complain about not finding the files, but will soon get over it, allowing you to enter the new password. +

    +If you don't do this you may find that WfWg remembers and uses the old +password, even if you told it a new one. +

    +Often WfWg will totally ignore a password you give it in a dialog box. +

    Configure WfW password handling

    +There is a program call admincfg.exe +on the last disk (disk 8) of the WFW 3.11 disk set. To install it +type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE. +Then add an icon +for it via the Program Manager New Menu. +This program allows you to control how WFW handles passwords. ie disable Password Caching etc +for use with security = user +

    Case handling of passwords

    Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf(5) information on password level to specify what characters samba should try to uppercase when checking.

    Use TCP/IP as default protocol

    To support print queue reporting you may find +that you have to use TCP/IP as the default protocol under +WfWg. For some reason if you leave NetBEUI as the default +it may break the print queue reporting on some systems. +It is presumably a WfWg bug.

    Speed improvement

    +Note that some people have found that setting DefaultRcvWindow in +the [MSTCP] section of the +SYSTEM.INI file under WfWg to 3072 gives a +big improvement. I don't know why. +

    +My own experience with DefaultRcvWindow is that I get much better +performance with a large value (16384 or larger). Other people have +reported that anything over 3072 slows things down enormously. One +person even reported a speed drop of a factor of 30 when he went from +3072 to 8192. I don't know why. +

    Windows '95/'98

    +When using Windows 95 OEM SR2 the following updates are recommended where Samba +is being used. Please NOTE that the above change will affect you once these +updates have been installed. +

    +There are more updates than the ones mentioned here. You are referred to the +Microsoft Web site for all currently available updates to your specific version +of Windows 95. +

    Kernel Update: KRNLUPD.EXE
    Ping Fix: PINGUPD.EXE
    RPC Update: RPCRTUPD.EXE
    TCP/IP Update: VIPUPD.EXE
    Redirector Update: VRDRUPD.EXE

    +Also, if using MS Outlook it is desirable to +install the OLEUPD.EXE fix. This +fix may stop your machine from hanging for an extended period when exiting +Outlook and you may also notice a significant speedup when accessing network +neighborhood services. +

    Speed improvement

    +Configure the win95 TCPIP registry settings to give better +performance. I use a program called MTUSPEED.exe which I got off the +net. There are various other utilities of this type freely available. +

    Windows 2000 Service Pack 2

    +There are several annoyances with Windows 2000 SP2. One of which +only appears when using a Samba server to host user profiles +to Windows 2000 SP2 clients in a Windows domain. This assumes +that Samba is a member of the domain, but the problem will +likely occur if it is not. +

    +In order to serve profiles successfully to Windows 2000 SP2 +clients (when not operating as a PDC), Samba must have +nt acl support = no +added to the file share which houses the roaming profiles. +If this is not done, then the Windows 2000 SP2 client will +complain about not being able to access the profile (Access +Denied) and create multiple copies of it on disk (DOMAIN.user.001, +DOMAIN.user.002, etc...). See the +smb.conf(5) man page +for more details on this option. Also note that the +nt acl support parameter was formally a global parameter in +releases prior to Samba 2.2.2. +

    +The following is a minimal profile share: +

    +	[profile]
+		path = /export/profile
+		create mask = 0600
+		directory mask = 0700
+		nt acl support = no
+		read only = no
+

    +The reason for this bug is that the Win2k SP2 client copies +the security descriptor for the profile which contains +the Samba server's SID, and not the domain SID. The client +compares the SID for SAMBA\user and realizes it is +different that the one assigned to DOMAIN\user. Hence the reason +for the access denied message. +

    +By disabling the nt acl support parameter, Samba will send +the Win2k client a response to the QuerySecurityDescriptor +trans2 call which causes the client to set a default ACL +for the profile. This default ACL includes +

    DOMAIN\user "Full Control">

    Note

    This bug does not occur when using winbind to +create accounts on the Samba host for Domain users.

    Windows NT 3.1

    If you have problems communicating across routers with Windows +NT 3.1 workstations, read this Microsoft Knowledge Base article. + +

    Prev Up Next
    Chapter 37. Portability Home Chapter 39. Samba Performance Tuning
    diff --git a/docs/htmldocs/PolicyMgmt.html b/docs/htmldocs/PolicyMgmt.html new file mode 100644 index 0000000000..775cd6cc16 --- /dev/null +++ b/docs/htmldocs/PolicyMgmt.html @@ -0,0 +1,260 @@ +Chapter 23. System and Account Policies
    Chapter 23. System and Account Policies
    Prev Part III. Advanced Configuration Next

    Chapter 23. System and Account Policies

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work

    +This chapter summarises the current state of knowledge derived from personal +practice and knowledge from samba mailing list subscribers. Before reproduction +of posted information effort has been made to validate the information provided. +Where additional information was uncovered through this validation it is provided +also. +

    Features and Benefits

    +When MS Windows NT3.5 was introduced the hot new topic was the ability to implement +Group Policies for users and group. Then along came MS Windows NT4 and a few sites +started to adopt this capability. How do we know that? By way of the number of "booboos" +(or mistakes) administrators made and then requested help to resolve. +

    +By the time that MS Windows 2000 and Active Directory was released, administrators +got the message: Group Policies are a good thing! They can help reduce administrative +costs and actually can help to create happier users. But adoption of the true +potential of MS Windows 200x Active Directory and Group Policy Objects (GPOs) for users +and machines were picked up on rather slowly. This was very obvious from the samba +mailing list as in 2000 and 2001 there were very few postings regarding GPOs and +how to replicate them in a Samba environment. +

    +Judging by the traffic volume since mid 2002, GPOs have become a standard part of +the deployment in many sites. This chapter reviews techniques and methods that can +be used to exploit opportunities for automation of control over user desktops and +network client workstations. +

    +A tool new to Samba-3 may become an important part of the future Samba Administrators' +arsenal. The editreg tool is described in this document. +

    Creating and Managing System Policies

    +Under MS Windows platforms, particularly those following the release of MS Windows +NT4 and MS Windows 95) it is possible to create a type of file that would be placed +in the NETLOGON share of a domain controller. As the client logs onto the network +this file is read and the contents initiate changes to the registry of the client +machine. This file allows changes to be made to those parts of the registry that +affect users, groups of users, or machines. +

    +For MS Windows 9x/Me this file must be called Config.POL and may +be generated using a tool called poledit.exe, better known as the +Policy Editor. The policy editor was provided on the Windows 98 installation CD, but +disappeared again with the introduction of MS Windows Me (Millennium Edition). From +comments from MS Windows network administrators it would appear that this tool became +a part of the MS Windows Me Resource Kit. +

    +MS Windows NT4 Server products include the System Policy Editor +under the Start -> Programs -> Administrative Tools menu item. +For MS Windows NT4 and later clients this file must be called NTConfig.POL. +

    +New with the introduction of MS Windows 2000 was the Microsoft Management Console +or MMC. This tool is the new wave in the ever changing landscape of Microsoft +methods for management of network access and security. Every new Microsoft product +or technology seems to obsolete the old rules and to introduce newer and more +complex tools and methods. To Microsoft's credit though, the MMC does appear to +be a step forward, but improved functionality comes at a great price. +

    +Before embarking on the configuration of network and system policies it is highly +advisable to read the documentation available from Microsoft's web site regarding + +Implementing Profiles and Policies in Windows NT 4.0 from http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp available from Microsoft. +There are a large number of documents in addition to this old one that should also +be read and understood. Try searching on the Microsoft web site for "Group Policies". +

    +What follows is a very brief discussion with some helpful notes. The information provided +here is incomplete - you are warned. +

    Windows 9x/Me Policies

    + You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. + It can be found on the Original full product Win98 installation CD under + tools/reskit/netadmin/poledit. Install this using the + Add/Remove Programs facility and then click on the 'Have Disk' tab. +

    + Use the Group Policy Editor to create a policy file that specifies the location of + user profiles and/or the My Documents etc. Then save these + settings in a file called Config.POL that needs to be placed in the + root of the [NETLOGON] share. If Win98 is configured to log onto + the Samba Domain, it will automatically read this file and update the Win9x/Me registry + of the machine as it logs on. +

    + Further details are covered in the Win98 Resource Kit documentation. +

    + If you do not take the right steps, then every so often Win9x/Me will check the + integrity of the registry and will restore it's settings from the back-up + copy of the registry it stores on each Win9x/Me machine. Hence, you will + occasionally notice things changing back to the original settings. +

    + Install the group policy handler for Win9x to pick up group policies. Look on the + Win98 CD in \tools\reskit\netadmin\poledit. + Install group policies on a Win9x client by double-clicking + grouppol.inf. Log off and on again a couple of times and see + if Win98 picks up group policies. Unfortunately this needs to be done on every + Win9x/Me machine that uses group policies. +

    Windows NT4 Style Policy Files

    + To create or edit ntconfig.pol you must use the NT Server + Policy Editor, poledit.exe which is included with NT4 Server + but not NT Workstation. There is a Policy Editor on a NT4 + Workstation but it is not suitable for creating Domain Policies. + Further, although the Windows 95 Policy Editor can be installed on an NT4 + Workstation/Server, it will not work with NT clients. However, the files from + the NT Server will run happily enough on an NT4 Workstation. +

    + You need poledit.exe, common.adm and winnt.adm. + It is convenient to put the two *.adm files in the c:\winnt\inf + directory which is where the binary will look for them unless told otherwise. Note also that that + directory is normally 'hidden'. +

    + The Windows NT policy editor is also included with the Service Pack 3 (and + later) for Windows NT 4.0. Extract the files using servicepackname /x, + i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, + poledit.exe and the associated template files (*.adm) should + be extracted as well. It is also possible to downloaded the policy template + files for Office97 and get a copy of the policy editor. Another possible + location is with the Zero Administration Kit available for download from Microsoft. +

    Registry Spoiling

    + With NT4 style registry based policy changes, a large number of settings are not + automatically reversed as the user logs off. Since the settings that were in the + NTConfig.POL file were applied to the client machine registry and that apply to the + hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known + as tattooing. It can have serious consequences down-stream and the administrator must + be extremely careful not to lock out the ability to manage the machine at a later date. +

    MS Windows 200x / XP Professional Policies

    + Windows NT4 System policies allows setting of registry parameters specific to + users, groups and computers (client workstations) that are members of the NT4 + style domain. Such policy file will work with MS Windows 2000 / XP clients also. +

    + New to MS Windows 2000 Microsoft introduced a new style of group policy that confers + a superset of capabilities compared with NT4 style policies. Obviously, the tool used + to create them is different, and the mechanism for implementing them is much changed. +

    + The older NT4 style registry based policies are known as Administrative Templates + in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security + configurations, enforce Internet Explorer browser settings, change and redirect aspects of the + users' desktop (including: the location of My Documents files (directory), as + well as intrinsics of where menu items will appear in the Start menu). An additional new + feature is the ability to make available particular software Windows applications to particular + users and/or groups. +

    + Remember: NT4 policy files are named NTConfig.POL and are stored in the root + of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password + and selects the domain name to which the logon will attempt to take place. During the logon + process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating + server, modifies the local registry values according to the settings in this file. +

    + Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of + a Windows 200x policy file is stored in the Active Directory itself and the other part is stored + in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active + Directory domain controllers. The part that is stored in the Active Directory itself is called the + group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is + known as the group policy template (GPT). +

    + With NT4 clients the policy file is read and executed upon only as each user logs onto the network. + MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine + startup (machine specific part) and when the user logs onto the network the user specific part + is applied. In MS Windows 200x style policy management each machine and/or user may be subject + to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows + the administrator to also set filters over the policy settings. No such equivalent capability + exists with NT4 style policy files. +

    Administration of Win2K / XP Policies

    + Instead of using the tool called The System Policy Editor, commonly called Poledit (from the + executable name poledit.exe), GPOs are created and managed using a + Microsoft Management Console (MMC) snap-in as follows:

    1. + Go to the Windows 200x / XP menu Start->Programs->Administrative Tools + and select the MMC snap-in called Active Directory Users and Computers +

    2. + Select the domain or organizational unit (OU) that you wish to manage, then right click + to open the context menu for that object, select the properties item. +

    3. + Now left click on the Group Policy tab, then left click on the New tab. Type a name + for the new policy you will create. +

    4. + Now left click on the Edit tab to commence the steps needed to create the GPO. +

    + All policy configuration options are controlled through the use of policy administrative + templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. + Beware however, since the .adm files are NOT interchangeable across NT4 and Windows 200x. + The later introduces many new features as well as extended definition capabilities. It is + well beyond the scope of this documentation to explain how to program .adm files, for that + the administrator is referred to the Microsoft Windows Resource Kit for your particular + version of MS Windows. +

    Note

    + The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used + to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you + use this powerful tool. Please refer to the resource kit manuals for specific usage information. +

    Managing Account/User Policies

    +Policies can define a specific user's settings or the settings for a group of users. The resulting +policy file contains the registry settings for all users, groups, and computers that will be using +the policy file. Separate policy files for each user, group, or computer are not not necessary. +

    +If you create a policy that will be automatically downloaded from validating domain controllers, +you should name the file NTconfig.POL. As system administrator, you have the option of renaming the +policy file and, by modifying the Windows NT-based workstation, directing the computer to update +the policy from a manual path. You can do this by either manually changing the registry or by using +the System Policy Editor. This path can even be a local path such that each machine has its own policy file, +but if a change is necessary to all machines, this change must be made individually to each workstation. +

    +When a Windows NT4/200x/XP machine logs onto the network the NETLOGON share on the authenticating domain +controller for the presence of the NTConfig.POL file. If one exists it is downloaded, parsed and then +applied to the user's part of the registry. +

    +MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally, +acquire policy settings through Group Policy Objects (GPOs) that are defined and stored in Active Directory +itself. The key benefit of using AS GPOs is that they impose no registry spoiling effect. +This has considerable advantage compared with the use of NTConfig.POL (NT4) style policy updates. +

    +In addition to user access controls that may be imposed or applied via system and/or group policies +in a manner that works in conjunction with user profiles, the user management environment under +MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied. +Common restrictions that are frequently used includes: +

    +

    Logon Hours
    Password Aging
    Permitted Logon from certain machines only
    Account type (Local or Global)
    User Rights

    +

    Samba Editreg Toolset

    + Describe in detail the benefits of editreg and how to use it. +

    Windows NT4/200x

    + The tools that may be used to configure these types of controls from the MS Windows environment are: + The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). + Under MS Windows 200x/XP this is done using the Microsoft Management Console (MMC) with appropriate + "snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor. +

    Samba PDC

    + With a Samba Domain Controller, the new tools for managing of user account and policy information includes: + smbpasswd, pdbedit, net, rpcclient. + The administrator should read the + man pages for these tools and become familiar with their use. +

    System Startup and Logon Processing Overview

    +The following attempts to document the order of processing of system and user policies following a system +reboot and as part of the user logon: +

    1. + Network starts, then Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming + Convention Provider (MUP) start +

    2. + Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded + and applied. The list may include GPOs that: +

      Apply to the location of machines in a Directory
      Apply only when settings have changed
      Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.

      + No desktop user interface is presented until the above have been processed. +

    3. + Execution of start-up scripts (hidden and synchronous by default). +

    4. + A keyboard action to affect start of logon (Ctrl-Alt-Del). +

    5. + User credentials are validated, User profile is loaded (depends on policy settings). +

    6. + An ordered list of User GPOs is obtained. The list contents depends on what is configured in respect of: + +

      Is user a domain member, thus subject to particular policies
      Loopback enablement, and the state of the loopback policy (Merge or Replace)
      Location of the Active Directory itself
      Has the list of GPOs changed. No processing is needed if not changed.

      +

    7. + User Policies are applied from Active Directory. Note: There are several types. +

    8. + Logon scripts are run. New to Win2K and Active Directory, logon scripts may be obtained based on Group + Policy objects (hidden and executed synchronously). NT4 style logon scripts are then run in a normal + window. +

    9. + The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like and NT4 + Domain) machine (system) policies are applied at start-up, User policies are applied at logon. +

    Common Errors

    +Policy related problems can be very difficult to diagnose and even more difficult to rectify. The following +collection demonstrates only basic issues. +

    Policy Does Not Work

    +Question: We have created the config.pol file and put it in the NETLOGON share. +It has made no difference to our Win XP Pro machines, they just don't see it. IT worked fine with Win 98 but does not +work any longer since we upgraded to Win XP Pro. Any hints? +

    +ANSWER: Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based +platforms. You need to use the NT4 Group Policy Editor to create a file called NTConfig.POL so that +it is in the correct format for your MS Windows XP Pro clients. +

    Prev Up Next
    Chapter 22. Advanced Network Management Home Chapter 24. Desktop Profile Management
    diff --git a/docs/htmldocs/Portability.html b/docs/htmldocs/Portability.html new file mode 100644 index 0000000000..bb2c20ac9f --- /dev/null +++ b/docs/htmldocs/Portability.html @@ -0,0 +1,128 @@ +Chapter 37. Portability
    Chapter 37. Portability
    Prev Part VI. Appendixes Next

    Chapter 37. Portability

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9

    Samba works on a wide range of platforms but the interface all the +platforms provide is not always compatible. This chapter contains +platform-specific information about compiling and using samba.

    HPUX

    +HP's implementation of supplementary groups is, er, non-standard (for +hysterical reasons). There are two group files, /etc/group and +/etc/logingroup; the system maps UIDs to numbers using the former, but +initgroups() reads the latter. Most system admins who know the ropes +symlink /etc/group to /etc/logingroup +(hard link doesn't work for reasons too stupid to go into here). initgroups() will complain if one of the +groups you're in in /etc/logingroup has what it considers to be an invalid +ID, which means outside the range [0..UID_MAX], where UID_MAX is (I think) +60000 currently on HP-UX. This precludes -2 and 65534, the usual nobody +GIDs. +

    +If you encounter this problem, make sure that the programs that are failing +to initgroups() be run as users not in any groups with GIDs outside the +allowed range. +

    This is documented in the HP manual pages under setgroups(2) and passwd(4). +

    +On HPUX you must use gcc or the HP ANSI compiler. The free compiler +that comes with HP-UX is not ANSI compliant and cannot compile +Samba. +

    SCO Unix

    +If you run an old version of SCO Unix then you may need to get important +TCP/IP patches for Samba to work correctly. Without the patch, you may +encounter corrupt data transfers using samba. +

    +The patch you need is UOD385 Connection Drivers SLS. It is available from +SCO (ftp.sco.com, directory SLS, +files uod385a.Z and uod385a.ltr.Z). +

    DNIX

    +DNIX has a problem with seteuid() and setegid(). These routines are +needed for Samba to work correctly, but they were left out of the DNIX +C library for some reason. +

    +For this reason Samba by default defines the macro NO_EID in the DNIX +section of includes.h. This works around the problem in a limited way, +but it is far from ideal, some things still won't work right. +

    +To fix the problem properly you need to assemble the following two +functions and then either add them to your C library or link them into +Samba. +

    +put this in the file setegid.s: +

    +        .globl  _setegid
+_setegid:
+        moveq   #47,d0
+        movl    #100,a0
+        moveq   #1,d1
+        movl    4(sp),a1
+        trap    #9
+        bccs    1$
+        jmp     cerror
+1$:
+        clrl    d0
+        rts
+

    +put this in the file seteuid.s: +

    +        .globl  _seteuid
+_seteuid:
+        moveq   #47,d0
+        movl    #100,a0
+        moveq   #0,d1
+        movl    4(sp),a1
+        trap    #9
+        bccs    1$
+        jmp     cerror
+1$:
+        clrl    d0
+        rts
+

    +after creating the above files you then assemble them using +

    +	$ as seteuid.s
+	$ as setegid.s
+

    +that should produce the files seteuid.o and +setegid.o +

    +then you need to add these to the LIBSM line in the DNIX section of +the Samba Makefile. Your LIBSM line will then look something like this: +

    +LIBSM = setegid.o seteuid.o -ln
+

    +You should then remove the line: +

    +#define NO_EID
+

    from the DNIX section of includes.h

    RedHat Linux Rembrandt-II

    +By default RedHat Rembrandt-II during installation adds an +entry to /etc/hosts as follows: +

    +	127.0.0.1 loopback "hostname"."domainname"
+

    +

    +This causes Samba to loop back onto the loopback interface. +The result is that Samba fails to communicate correctly with +the world and therefor may fail to correctly negotiate who +is the master browse list holder and who is the master browser. +

    +Corrective Action: Delete the entry after the word loopback + in the line starting 127.0.0.1 +

    AIX

    Sequential Read Ahead

    +Disabling Sequential Read Ahead using vmtune -r 0 improves +Samba performance significantly. +

    Solaris

    Locking improvements

    Some people have been experiencing problems with F_SETLKW64/fcntl +when running Samba on Solaris. The built in file locking mechanism was +not scalable. Performance would degrade to the point where processes would +get into loops of trying to lock a file. It would try a lock, then fail, +then try again. The lock attempt was failing before the grant was +occurring. So the visible manifestation of this would be a handful of +processes stealing all of the CPU, and when they were trussed they would +be stuck if F_SETLKW64 loops. +

    +Sun released patches for Solaris 2.6, 8, and 9. The patch for Solaris 7 +has not been released yet. +

    +The patch revision for 2.6 is 105181-34 +for 8 is 108528-19 and for 9 is 112233-04 +

    +After the install of these patches it is recommended to reconfigure +and rebuild samba. +

    Thanks to Joe Meslovich for reporting

    Winbind on Solaris 9

    +Nsswitch on Solaris 9 refuses to use the winbind nss module. This behavior +is fixed by Sun in patch 113476-05 which as of March 2003 is not in any +roll-up packages. +

    Prev Up Next
    Chapter 36. How to compile SAMBA Home Chapter 38. Samba and other CIFS clients
    diff --git a/docs/htmldocs/ProfileMgmt.html b/docs/htmldocs/ProfileMgmt.html new file mode 100644 index 0000000000..0b9a40df62 --- /dev/null +++ b/docs/htmldocs/ProfileMgmt.html @@ -0,0 +1,680 @@ +Chapter 24. Desktop Profile Management
    Chapter 24. Desktop Profile Management
    Prev Part III. Advanced Configuration Next

    Chapter 24. Desktop Profile Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    How does one set up roaming profiles for just one (or a few) user/s or group/s?
    Can NOT use Roaming Profiles
    Changing the default profile

    Features and Benefits

    +Roaming Profiles are feared by some, hated by a few, loved by many, and a Godsend for +some administrators. +

    +Roaming Profiles allow an administrator to make available a consistent user desktop +as the user moves from one machine to another. This chapter provides much information +regarding how to configure and manage Roaming Profiles. +

    +While Roaming Profiles might sound like nirvana to some, they are a real and tangible +problem to others. In particular, users of mobile computing tools, where often there may not +be a sustained network connection, are often better served by purely Local Profiles. +This chapter provides information to help the Samba administrator to deal with those +situations also. +

    Roaming Profiles

    Warning

    +Roaming profiles support is different for Win9x / Me and Windows NT4/200x. +

    +Before discussing how to configure roaming profiles, it is useful to see how +Windows 9x / Me and Windows NT4/200x clients implement these features. +

    +Windows 9x / Me clients send a NetUserGetInfo request to the server to get the user's +profiles location. However, the response does not have room for a separate +profiles location field, only the user's home share. This means that Win9X/Me +profiles are restricted to being stored in the user's home directory. +

    +Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields, +including a separate field for the location of the user's profiles. +

    Samba Configuration for Profile Handling

    +This section documents how to configure Samba for MS Windows client profile support. +

    NT4/200x User Profiles

    +To support Windows NT4/200x clients, in the [global] section of smb.conf set the +following (for example): +

    +

    +	logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath
+

    + + This is typically implemented like: + +

    +		logon path = \\%L\Profiles\%u
+

    +where %L translates to the name of the Samba server and %u translates to the user name +

    +The default for this option is \\%N\%U\profile, +namely \\sambaserver\username\profile. +The \\N%\%U service is created automatically by the [homes] service. If you are using +a samba server for the profiles, you _must_ make the share specified in the logon path +browseable. Please refer to the man page for smb.conf in respect of the different +semantics of %L and %N, as well as %U and %u. +

    Note

    +MS Windows NT/2K clients at times do not disconnect a connection to a server +between logons. It is recommended to NOT use the homes +meta-service name as part of the profile share path. +

    Windows 9x / Me User Profiles

    + To support Windows 9x / Me clients, you must use the logon home parameter. Samba has +now been fixed so that net use /home now works as well, and it, too, relies +on the logon home parameter. +

    +By using the logon home parameter, you are restricted to putting Win9x / Me +profiles in the user's home directory. But wait! There is a trick you +can use. If you set the following in the [global] section of your smb.conf file: +

    +	logon home = \\%L\%U\.profiles
+

    +then your Windows 9x / Me clients will dutifully put their clients in a subdirectory +of your home directory called .profiles (thus making them hidden). +

    +Not only that, but net use /home will also work, because of a feature in +Windows 9x / Me. It removes any directory stuff off the end of the home directory area +and only uses the server and share portion. That is, it looks like you +specified \\%L\%U for logon home. +

    Mixed Windows 9x / Me and Windows NT4/200x User Profiles

    +You can support profiles for both Win9X and WinNT clients by setting both the +logon home and logon path parameters. For example: +

    +	logon home = \\%L\%u\.profiles
+	logon path = \\%L\profiles\%u
+

    Disabling Roaming Profile Support

    + A question often asked is “How may I enforce use of local profiles?” or + “How do I disable Roaming Profiles?” +

    +There are three ways of doing this: +

    In smb.conf

    + Affect the following settings and ALL clients + will be forced to use a local profile: + 

    +			logon home =
+			logon path =
+

    +

    MS Windows Registry:

    + By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This of course modifies registry settings. The full path to the option is: + + 

    +	Local Computer Policy\
+		Computer Configuration\
+			Administrative Templates\
+				System\
+					User Profiles\
+
+	Disable:	Only Allow Local User Profiles
+	Disable:	Prevent Roaming Profile Change from Propagating to the Server
+

    +

    Change of Profile Type:

    + From the start menu right click on the + My Computer icon, select Properties, click on the User Profiles + tab, select the profile you wish to change from Roaming type to Local, click Change Type. +

    +Consult the MS Windows registry guide for your particular MS Windows version for more +information about which registry keys to change to enforce use of only local user +profiles. +

    Note

    +The specifics of how to convert a local profile to a roaming profile, or a roaming profile +to a local one vary according to the version of MS Windows you are running. Consult the +Microsoft MS Windows Resource Kit for your version of Windows for specific information. +

    Windows Client Profile Configuration Information

    Windows 9x / Me Profile Setup

    +When a user first logs in on Windows 9X, the file user.DAT is created, +as are folders Start Menu, Desktop, +Programs and Nethood. +These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, +taking the most recent from each. You will need to use the [global] +options preserve case = yes, short preserve case = yes and +case sensitive = no in order to maintain capital letters in shortcuts +in any of the profile folders. +

    +The user.DAT file contains all the user's preferences. If you wish to +enforce a set of preferences, rename their user.DAT file to user.MAN, +and deny them write access to this file. +

    1. + On the Windows 9x / Me machine, go to Control Panel -> Passwords and + select the User Profiles tab. Select the required level of + roaming preferences. Press OK, but do _not_ allow the computer + to reboot. +

    2. + On the Windows 9x / Me machine, go to Control Panel -> Network -> + Client for Microsoft Networks -> Preferences. Select Log on to + NT Domain. Then, ensure that the Primary Logon is Client for + Microsoft Networks. Press OK, and this time allow the computer + to reboot. +

    +Under Windows 9x / Me Profiles are downloaded from the Primary Logon. +If you have the Primary Logon as 'Client for Novell Networks', then +the profiles and logon script will be downloaded from your Novell +Server. If you have the Primary Logon as 'Windows Logon', then the +profiles will be loaded from the local machine - a bit against the +concept of roaming profiles, it would seem! +

    +You will now find that the Microsoft Networks Login box contains +[user, password, domain] instead of just [user, password]. Type in +the samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this +domain and profiles downloaded from it, if that domain logon server +supports it), user name and user's password. +

    +Once the user has been successfully validated, the Windows 9x / Me machine +will inform you that The user has not logged on before' and asks you + if you wish to save the user's preferences? Select yes. +

    +Once the Windows 9x / Me client comes up with the desktop, you should be able +to examine the contents of the directory specified in the logon path +on the samba server and verify that the Desktop, Start Menu, +Programs and Nethood folders have been created. +

    +These folders will be cached locally on the client, and updated when +the user logs off (if you haven't made them read-only by then). +You will find that if the user creates further folders or short-cuts, +that the client will merge the profile contents downloaded with the +contents of the profile directory already on the local client, taking +the newest folders and short-cuts from each set. +

    +If you have made the folders / files read-only on the samba server, +then you will get errors from the Windows 9x / Me machine on logon and logout, as +it attempts to merge the local and the remote profile. Basically, if +you have any errors reported by the Windows 9x / Me machine, check the Unix file +permissions and ownership rights on the profile directory contents, +on the samba server. +

    +If you have problems creating user profiles, you can reset the user's +local desktop cache, as shown below. When this user then next logs in, +they will be told that they are logging in "for the first time". +

    Warning

    + Before deleting the contents of the + directory listed in the ProfilePath (this is likely to be + c:\windows\profiles\username), ask them if they + have any important files stored on their desktop or in their start menu. + Delete the contents of the directory ProfilePath (making a backup if any + of the files are needed). +

    + This will have the effect of removing the local (read-only hidden + system file) user.DAT in their profile directory, as well as the + local "desktop", "nethood", "start menu" and "programs" folders. +

    1. + instead of logging in under the [user, password, domain] dialog, + press escape. +

    2. + run the regedit.exe program, and look in: +

      + HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList +

      + you will find an entry, for each user, of ProfilePath. Note the + contents of this key (likely to be c:\windows\profiles\username), + then delete the key ProfilePath for the required user. +

      [Exit the registry editor].

    3. + search for the user's .PWL password-caching file in the c:\windows + directory, and delete it. +

    4. + log off the windows 9x / Me client. +

    5. + check the contents of the profile path (see logon path described + above), and delete the user.DAT or user.MAN file for the user, + making a backup if required. +

    +If all else fails, increase samba's debug log levels to between 3 and 10, +and / or run a packet trace program such as ethereal or netmon.exe, and +look for error messages. +

    +If you have access to an Windows NT4/200x server, then first set up roaming profiles +and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine +the example packet traces provided with Windows NT4/200x server, and see what the +differences are with the equivalent samba trace. +

    Windows NT4 Workstation

    +When a user first logs in to a Windows NT Workstation, the profile +NTuser.DAT is created. The profile location can be now specified +through the logon path parameter. +

    +There is a parameter that is now available for use with NT Profiles: +logon drive. This should be set to H: or any other drive, and +should be used in conjunction with the new "logon home" parameter. +

    +The entry for the NT4 profile is a _directory_ not a file. The NT +help on profiles mentions that a directory is also created with a .PDS +extension. The user, while logging in, must have write permission to +create the full profile path (and the folder with the .PDS extension +for those situations where it might be created.) +

    +In the profile directory, Windows NT4 creates more folders than Windows 9x / Me. +It creates Application Data and others, as well as Desktop, Nethood, +Start Menu and Programs. The profile itself is stored in a file +NTuser.DAT. Nothing appears to be stored in the .PDS directory, and +its purpose is currently unknown. +

    +You can use the System Control Panel to copy a local profile onto +a samba server (see NT Help on profiles: it is also capable of firing +up the correct location in the System Control Panel for you). The +NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN +turns a profile into a mandatory one. +

    +The case of the profile is significant. The file must be called +NTuser.DAT or, for a mandatory profile, NTuser.MAN. +

    Windows 2000/XP Professional

    +You must first convert the profile from a local profile to a domain +profile on the MS Windows workstation as follows: +

    1. + Log on as the LOCAL workstation administrator. +

    2. + Right click on the My Computer Icon, select Properties +

    3. + Click on the User Profiles tab +

    4. + Select the profile you wish to convert (click on it once) +

    5. + Click on the button Copy To +

    6. + In the Permitted to use box, click on the Change button. +

    7. + Click on the 'Look in" area that lists the machine name, when you click + here it will open up a selection box. Click on the domain to which the + profile must be accessible. +

      Note

      You will need to log on if a logon box opens up. Eg: In the connect + as: MIDEARTH\root, password: mypassword.

    8. + To make the profile capable of being used by anyone select 'Everyone' +

    9. + Click OK. The Selection box will close. +

    10. + Now click on the Ok button to create the profile in the path you + nominated. +

    +Done. You now have a profile that can be edited using the samba-3.0.0 +profiles tool. +

    Note

    +Under NT/2K the use of mandatory profiles forces the use of MS Exchange +storage of mail data. That keeps desktop profiles usable. +

    Note

    1. +This is a security check new to Windows XP (or maybe only +Windows XP service pack 1). It can be disabled via a group policy in +Active Directory. The policy is:

      Computer Configuration\Administrative Templates\System\User +Profiles\Do not check for user ownership of Roaming Profile Folders

      ...and it should be set to Enabled. +Does the new version of samba have an Active Directory analogue? If so, +then you may be able to set the policy through this. +

      +If you cannot set group policies in samba, then you may be able to set +the policy locally on each machine. If you want to try this, then do +the following (N.B. I don't know for sure that this will work in the +same way as a domain group policy): +

    2. +On the XP workstation log in with an Administrator account. +

    3. Click: Start, Run

    4. Type: mmc

    5. Click: OK

    6. A Microsoft Management Console should appear.

    7. Click: File, Add/Remove Snap-in..., Add

    8. Double-Click: Group Policy

    9. Click: Finish, Close

    10. Click: OK

    11. In the "Console Root" window:

    12. Expand: Local Computer Policy, Computer Configuration, + Administrative Templates, System, User Profiles

    13. Double-Click: Do not check for user ownership of Roaming Profile Folders

    14. Select: Enabled

    15. Click: OK

    16. Close the whole console. You do not need to save the settings (this + refers to the console settings rather than the policies you have + changed).

    17. Reboot

    Sharing Profiles between W9x/Me and NT4/200x/XP workstations

    +Sharing of desktop profiles between Windows versions is NOT recommended. +Desktop profiles are an evolving phenomenon and profiles for later versions +of MS Windows clients add features that may interfere with earlier versions +of MS Windows clients. Probably the more salient reason to NOT mix profiles +is that when logging off an earlier version of MS Windows the older format +of profile contents may overwrite information that belongs to the newer +version resulting in loss of profile information content when that user logs +on again with the newer version of MS Windows. +

    +If you then want to share the same Start Menu / Desktop with W9x/Me, you will +need to specify a common location for the profiles. The smb.conf parameters +that need to be common are logon path and +logon home. +

    +If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory. +

    Profile Migration from Windows NT4/200x Server to Samba

    +There is nothing to stop you specifying any path that you like for the +location of users' profiles. Therefore, you could specify that the +profile be stored on a samba server, or any other SMB server, as long as +that SMB server supports encrypted passwords. +

    Windows NT4 Profile Management Tools

    +Unfortunately, the Resource Kit information is specific to the version of MS Windows +NT4/200x. The correct resource kit is required for each platform. +

    +Here is a quick guide: +

    1. +On your NT4 Domain Controller, right click on My Computer, then +select the tab labelled User Profiles. +

    2. +Select a user profile you want to migrate and click on it. +

      Note

      I am using the term "migrate" loosely. You can copy a profile to +create a group profile. You can give the user 'Everyone' rights to the +profile you copy this to. That is what you need to do, since your samba +domain is not a member of a trust relationship with your NT4 PDC.

    3. Click the Copy To button.

    4. In the box labelled Copy Profile to add your new path, eg: + c:\temp\foobar

    5. Click on the button Change in the Permitted to use box.

    6. Click on the group 'Everyone' and then click OK. This closes the + 'choose user' box.

    7. Now click OK.

    +Follow the above for every profile you need to migrate. +

    Side bar Notes

    +You should obtain the SID of your NT4 domain. You can use smbpasswd to do +this. Read the man page.

    +With Samba-3.0.0 alpha code you can import all you NT4 domain accounts +using the net samsync method. This way you can retain your profile +settings as well as all your users. +

    moveuser.exe

    +The W2K professional resource kit has moveuser.exe. moveuser.exe changes +the security of a profile from one user to another. This allows the account +domain to change, and/or the user name to change. +

    Get SID

    +You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 +Resource Kit. +

    +Windows NT 4.0 stores the local profile information in the registry under +the following key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList +

    +Under the ProfileList key, there will be subkeys named with the SIDs of the +users who have logged on to this computer. (To find the profile information +for the user whose locally cached profile you want to move, find the SID for +the user with the GetSID.exe utility.) Inside of the appropriate user's +subkey, you will see a string value named ProfileImagePath. +

    Mandatory profiles

    +A Mandatory Profile is a profile that the user does NOT have the ability to overwrite. +During the user's session it may be possible to change the desktop environment, but +as the user logs out all changes made will be lost. If it is desired to NOT allow the +user any ability to change the desktop environment then this must be done through +policy settings. See previous chapter. +

    Note

    +Under NO circumstances should the profile directory (or it's contents) be made read-only +as this may render the profile un-usable. +

    +For MS Windows NT4/200x/XP the above method can be used to create mandatory profiles +also. To convert a group profile into a mandatory profile simply locate the NTUser.DAT +file in the copied profile and rename it to NTUser.MAN. +

    +For MS Windows 9x / Me it is the User.DAT file that must be renamed to User.MAN to +affect a mandatory profile. +

    Creating/Managing Group Profiles

    +Most organisations are arranged into departments. There is a nice benefit in +this fact since usually most users in a department will require the same desktop +applications and the same desktop layout. MS Windows NT4/200x/XP will allow the +use of Group Profiles. A Group Profile is a profile that is created firstly using +a template (example) user. Then using the profile migration tool (see above) the +profile is assigned access rights for the user group that needs to be given access +to the group profile. +

    +The next step is rather important. Please note: Instead of assigning a group profile +to users (ie: Using User Manager) on a "per user" basis, the group itself is assigned +the now modified profile. +

    Note

    + Be careful with group profiles, if the user who is a member of a group also + has a personal profile, then the result will be a fusion (merge) of the two. +

    Default Profile for Windows Users

    +MS Windows 9x / Me and NT4/200x/XP will use a default profile for any user for whom +a profile does not already exist. Armed with a knowledge of where the default profile +is located on the Windows workstation, and knowing which registry keys affect the path +from which the default profile is created, it is possible to modify the default profile +to one that has been optimised for the site. This has significant administrative +advantages. +

    MS Windows 9x/Me

    +To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System +Policy Editor or change the registry directly. +

    +To enable default per user profiles in Windows 9x / Me, launch the System Policy Editor, then +select File -> Open Registry, then click on the +Local Computer icon, click on Windows 98 System, +select User Profiles, click on the enable box. Do not forget to save the registry changes. +

    +To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive +HKEY_LOCAL_MACHINE\Network\Logon. Now add a DWORD type key with the name +"User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0. +

    How User Profiles Are Handled in Windows 9x / Me?

    +When a user logs on to a Windows 9x / Me machine, the local profile path, +HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList, is checked +for an existing entry for that user: +

    +If the user has an entry in this registry location, Windows 9x / Me checks for a locally cached +version of the user profile. Windows 9x / Me also checks the user's home directory (or other +specified directory if the location has been modified) on the server for the User Profile. +If a profile exists in both locations, the newer of the two is used. If the User Profile exists +on the server, but does not exist on the local machine, the profile on the server is downloaded +and used. If the User Profile only exists on the local machine, that copy is used. +

    +If a User Profile is not found in either location, the Default User Profile from the Windows 9x / Me +machine is used and is copied to a newly created folder for the logged on user. At log off, any +changes that the user made are written to the user's local profile. If the user has a roaming +profile, the changes are written to the user's profile on the server. +

    MS Windows NT4 Workstation

    +On MS Windows NT4 the default user profile is obtained from the location +%SystemRoot%\Profiles which in a default installation will translate to +C:\WinNT\Profiles. Under this directory on a clean install there will be +three (3) directories: Administrator, All Users, Default User. +

    +The All Users directory contains menu settings that are common across all +system users. The Default User directory contains menu entries that are +customisable per user depending on the profile settings chosen/created. +

    +When a new user first logs onto an MS Windows NT4 machine a new profile is created from: +

    All Users settings
    Default User settings (contains the default NTUser.DAT file)

    +When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain +the following steps are followed in respect of profile handling: +

    1. + The users' account information which is obtained during the logon process contains + the location of the users' desktop profile. The profile path may be local to the + machine or it may be located on a network share. If there exists a profile at the location + of the path from the user account, then this profile is copied to the location + %SystemRoot%\Profiles\%USERNAME%. This profile then inherits the + settings in the All Users profile in the %SystemRoot%\Profiles + location. +

    2. + If the user account has a profile path, but at it's location a profile does not exist, + then a new profile is created in the %SystemRoot%\Profiles\%USERNAME% + directory from reading the Default User profile. +

    3. + If the NETLOGON share on the authenticating server (logon server) contains a policy file + (NTConfig.POL) then it's contents are applied to the NTUser.DAT + which is applied to the HKEY_CURRENT_USER part of the registry. +

    4. + When the user logs out, if the profile is set to be a roaming profile it will be written + out to the location of the profile. The NTuser.DAT file is then + re-created from the contents of the HKEY_CURRENT_USER contents. + Thus, should there not exist in the NETLOGON share an NTConfig.POL at the + next logon, the effect of the previous NTConfig.POL will still be held + in the profile. The effect of this is known as tatooing. +

    +MS Windows NT4 profiles may be Local or Roaming. A Local profile +will stored in the %SystemRoot%\Profiles\%USERNAME% location. A roaming profile will +also remain stored in the same way, unless the following registry key is created: +

    +

    +	HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\
+	"DeleteRoamingCache"=dword:00000001
+

    + +In which case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be +deleted on logout. +

    +Under MS Windows NT4 default locations for common resources (like My Documents +may be redirected to a network share by modifying the following registry keys. These changes may be affected +via use of the System Policy Editor (to do so may require that you create your owns template extension +for the policy editor to allow this to be done through the GUI. Another way to do this is by way of first +creating a default user profile, then while logged in as that user, run regedt32 to edit the key settings. +

    +The Registry Hive key that affects the behaviour of folders that are part of the default user profile +are controlled by entries on Windows NT4 is: +

    +HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\ +

    +The above hive key contains a list of automatically managed folders. The default entries are: +

    +

    Table 24.1. User Shell Folder registry keys default values

    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    NetHood%USERPROFILE%\NetHood
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu %USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup

    +

    +The registry key that contains the location of the default profile settings is: +

    +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders +

    +The default entries are: + +

    Table 24.2. Defaults of profile settings registry keys

    Common Desktop%SystemRoot%\Profiles\All Users\Desktop
    Common Programs%SystemRoot%\Profiles\All Users\Programs
    Common Start Menu%SystemRoot%\Profiles\All Users\Start Menu
    Common Startup%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup

    +

    MS Windows 200x/XP

    Note

    + MS Windows XP Home Edition does use default per user profiles, but can not participate + in domain security, can not log onto an NT/ADS style domain, and thus can obtain the profile + only from itself. While there are benefits in doing this the beauty of those MS Windows + clients that CAN participate in domain logon processes allows the administrator to create + a global default profile and to enforce it through the use of Group Policy Objects (GPOs). +

    +When a new user first logs onto MS Windows 200x/XP machine the default profile is obtained from +C:\Documents and Settings\Default User. The administrator can modify (or change +the contents of this location and MS Windows 200x/XP will gladly use it. This is far from the optimum +arrangement since it will involve copying a new default profile to every MS Windows 200x/XP client +workstation. +

    +When MS Windows 200x/XP participate in a domain security context, and if the default user +profile is not found, then the client will search for a default profile in the NETLOGON share +of the authenticating server. ie: In MS Windows parlance: +%LOGONSERVER%\NETLOGON\Default User and if one exits there it will copy this +to the workstation to the C:\Documents and Settings\ under the Windows +login name of the user. +

    Note

    + This path translates, in Samba parlance, to the smb.conf [NETLOGON] share. The directory + should be created at the root of this share and must be called Default Profile. +

    +If a default profile does not exist in this location then MS Windows 200x/XP will use the local +default profile. +

    +On logging out, the users' desktop profile will be stored to the location specified in the registry +settings that pertain to the user. If no specific policies have been created, or passed to the client +during the login process (as Samba does automatically), then the user's profile will be written to +the local machine only under the path C:\Documents and Settings\%USERNAME%. +

    +Those wishing to modify the default behaviour can do so through three methods: +

    • + Modify the registry keys on the local machine manually and place the new default profile in the + NETLOGON share root - NOT recommended as it is maintenance intensive. +

    • + Create an NT4 style NTConfig.POL file that specified this behaviour and locate this file + in the root of the NETLOGON share along with the new default profile. +

    • + Create a GPO that enforces this through Active Directory, and place the new default profile + in the NETLOGON share. +

    +The Registry Hive key that affects the behaviour of folders that are part of the default user profile +are controlled by entries on Windows 200x/XP is: +

    +HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\ +

    +The above hive key contains a list of automatically managed folders. The default entries are: +

    +

    Table 24.3. Defaults of default user profile paths registry keys

    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Cache%USERPROFILE%\Local Settings\Temporary Internet Files
    Cookies%USERPROFILE%\Cookies
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    History%USERPROFILE%\Local Settings\History
    Local AppData%USERPROFILE%\Local Settings\Application Data
    Local Settings%USERPROFILE%\Local Settings
    My Pictures%USERPROFILE%\My Documents\My Pictures
    NetHood%USERPROFILE%\NetHood
    Personal%USERPROFILE%\My Documents
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu%USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup
    Templates%USERPROFILE%\Templates

    +

    +There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all +the others are of type REG_EXPAND_SZ. +

    +It makes a huge difference to the speed of handling roaming user profiles if all the folders are +stored on a dedicated location on a network server. This means that it will NOT be necessary to +write the Outlook PST file over the network for every login and logout. +

    +To set this to a network location you could use the following examples: +

    %LOGONSERVER%\%USERNAME%\Default Folders

    +This would store the folders in the user's home directory under a directory called Default Folders +You could also use: +

    \\SambaServer\FolderShare\%USERNAME%

    + in which case the default folders will be stored in the server named SambaServer +in the share called FolderShare under a directory that has the name of the MS Windows +user as seen by the Linux/Unix file system. +

    +Please note that once you have created a default profile share, you MUST migrate a user's profile +(default or custom) to it. +

    +MS Windows 200x/XP profiles may be Local or Roaming. +A roaming profile will be cached locally unless the following registry key is created: +

    HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\"DeleteRoamingCache"=dword:00000001

    +In which case, the local cache copy will be deleted on logout. +

    Common Errors

    +The following are some typical errors/problems/questions that have been asked. +

    How does one set up roaming profiles for just one (or a few) user/s or group/s?

    +With samba-2.2.x the choice you have is to enable or disable roaming +profiles support. It is a global only setting. The default is to have +roaming profiles and the default path will locate them in the user's home +directory. +

    +If disabled globally then no-one will have roaming profile ability. +If enabled and you want it to apply only to certain machines, then on +those machines on which roaming profile support is NOT wanted it is then +necessary to disable roaming profile handling in the registry of each such +machine. +

    +With samba-3.0.0 (soon to be released) you can have a global profile +setting in smb.conf _AND_ you can over-ride this by per-user settings +using the Domain User Manager (as with MS Windows NT4/ Win 2Kx). +

    +In any case, you can configure only one profile per user. That profile can +be either: +

    A profile unique to that user
    A mandatory profile (one the user can not change)
    A group profile (really should be mandatory ie:unchangable)

    Can NOT use Roaming Profiles

    +“ + I dont want Roaming profile to be implemented, I just want to give users + local profiles only. +... + Please help me I am totally lost with this error from past two days I tried + everything and googled around quite a bit but of no help. Please help me. +”

    +Your choices are: + + +

    Local profiles

    + I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out +

    Roaming profiles

    +

    can use auto-delete on logout option
    requires a registry key change on workstation

    + + Your choices are: + +

    Personal Roaming profiles

    + - should be preserved on a central server + - workstations 'cache' (store) a local copy + - used in case the profile can not be downloaded + at next logon +

    Group profiles

    - loaded from a central place

    Mandatory profiles

    + - can be personal or group + - can NOT be changed (except by an administrator +

    +

    + +

    +A WinNT4/2K/XP profile can vary in size from 130KB to off the scale. +Outlook PST files are most often part of the profile and can be many GB in +size. On average (in a well controlled environment) roaming profile size of +2MB is a good rule of thumb to use for planning purposes. In an +undisciplined environment I have seen up to 2GB profiles. Users tend to +complain when it take an hour to log onto a workstation but they harvest +the fruits of folly (and ignorance). +

    +The point of all the above is to show that roaming profiles and good +controls of how they can be changed as well as good discipline make up for +a problem free site. +

    +Microsoft's answer to the PST problem is to store all email in an MS +Exchange Server back-end. But this is another story ...! +

    +So, having LOCAL profiles means: + +

    If lots of users user each machine - lot's of local disk storage needed for local profiles
    Every workstation the user logs into has it's own profile - can be very different from machine to machine

    + +On the other hand, having roaming profiles means: +

    The network administrator can control EVERY aspect of user profiles
    With the use of mandatory profiles - a drastic reduction in network management overheads
    User unhappiness about not being able to change their profiles soon fades as they get used to being able to work reliably

    + +

    +I have managed and installed MANY NT/2K networks and have NEVER found one +where users who move from machine to machine are happy with local +profiles. In the long run local profiles bite them. +

    Changing the default profile

    “ +When the client tries to logon to the PDC it looks for a profile to download +where do I put this default profile. +”

    +Firstly, your samba server need to be configured as a domain controller. +

    +	server = user
+    os level = 32 (or more)
+	domain logons = Yes
+

    +Plus you need to have a [netlogon] share that is world readable. +It is a good idea to add a logon script to pre-set printer and +drive connections. There is also a facility for automatically +synchronizing the workstation time clock with that of the logon +server (another good thing to do). +

    Note

    +To invoke auto-deletion of roaming profile from the local +workstation cache (disk storage) you need to use the Group Policy Editor +to create a file called NTConfig.POL with the appropriate entries. This +file needs to be located in the netlogon share root directory.

    +Oh, of course the windows clients need to be members of the domain. +Workgroup machines do NOT do network logons - so they never see domain +profiles. +

    +Secondly, for roaming profiles you need: + + logon path = \\%N\profiles\%U (with some such path) + logon drive = H: (Z: is the default) + + Plus you need a PROFILES share that is world writable. +

    Prev Up Next
    Chapter 23. System and Account Policies Home Chapter 25. PAM based Distributed Authentication
    diff --git a/docs/htmldocs/SWAT.html b/docs/htmldocs/SWAT.html new file mode 100644 index 0000000000..b4067d75d8 --- /dev/null +++ b/docs/htmldocs/SWAT.html @@ -0,0 +1,200 @@ +Chapter 32. SWAT - The Samba Web Administration Tool
    Chapter 32. SWAT - The Samba Web Administration Tool
    Prev Part IV. Migration and Updating Next

    Chapter 32. SWAT - The Samba Web Administration Tool

    John H. Terpstra

    Samba Team

    April 21, 2003

    Table of Contents

    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    +There are many and varied opinions regarding the usefulness or otherwise of SWAT. +No matter how hard one tries to produce the perfect configuration tool it remains +an object of personal taste. SWAT is a tool that will allow web based configuration +of samba. It has a wizard that may help to get samba configured quickly, it has context +sensitive help on each smb.conf parameter, it provides for monitoring of current state +of connection information, and it allows network wide MS Windows network password +management. +

    Features and Benefits

    +There are network administrators who believe that it is a good idea to write systems +documentation inside configuration files, for them SWAT will aways be a nasty tool. SWAT +does not store the configuration file in any intermediate form, rather, it stores only the +parameter settings, so when SWAT writes the smb.conf file to disk it will write only +those parameters that are at other than the default settings. The result is that all comments +will be lost from the smb.conf file. Additionally, the parameters will be written back in +internal ordering. +

    Note

    +So before using SWAT please be warned - SWAT will completely replace your smb.conf with +a fully optimised file that has been stripped of all comments you might have placed there +and only non-default settings will be written to the file. +

    Enabling SWAT for use

    +SWAT should be installed to run via the network super daemon. Depending on which system +your Unix/Linux system has you will have either an inetd or +xinetd based system. +

    +The nature and location of the network super-daemon varies with the operating system +implementation. The control file (or files) can be located in the file +/etc/inetd.conf or in the directory /etc/[x]inet.d +or similar. +

    +The control entry for the older style file might be: +

    +	# swat is the Samba Web Administration Tool
+	swat stream tcp nowait.400 root /usr/sbin/swat swat
+

    +A control file for the newer style xinetd could be: +

    +

    +	# default: off
+	# description: SWAT is the Samba Web Admin Tool. Use swat \
+	#              to configure your Samba server. To use SWAT, \
+	#              connect to port 901 with your favorite web browser.
+	service swat
+	{
+		port    = 901
+		socket_type     = stream
+		wait    = no
+		only_from = localhost
+		user    = root
+		server  = /usr/sbin/swat
+		log_on_failure  += USERID
+		disable = yes
+	}
+

    + +

    +Both the above examples assume that the swat binary has been +located in the /usr/sbin directory. In addition to the above +SWAT will use a directory access point from which it will load it's help files +as well as other control information. The default location for this on most Linux +systems is in the directory /usr/share/samba/swat. The default +location using samba defaults will be /usr/local/samba/swat. +

    +Access to SWAT will prompt for a logon. If you log onto SWAT as any non-root user +the only permission allowed is to view certain aspects of configuration as well as +access to the password change facility. The buttons that will be exposed to the non-root +user are: HOME, STATUS, VIEW, +PASSWORD. The only page that allows +change capability in this case is PASSWORD. +

    +So long as you log onto SWAT as the user root you should obtain +full change and commit ability. The buttons that will be exposed includes: +HOME, GLOBALS, SHARES, PRINTERS, +WIZARD, STATUS, VIEW, PASSWORD. +

    Securing SWAT through SSL

    +Lots of people have asked about how to setup SWAT with SSL to allow for secure remote +administration of Samba. Here is a method that works, courtesy of Markus Krieger +

    +Modifications to the swat setup are as following: +

    1. + install OpenSSL +

    2. + generate certificate and private key + + 

      +root# /usr/bin/openssl req -new -x509 -days 365 -nodes -config \
+ 	/usr/share/doc/packages/stunnel/stunnel.cnf \
+	-out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem
+

    3. + remove swat-entry from [x]inetd +

    4. + start stunnel + + 

      +root# stunnel -p /etc/stunnel/stunnel.pem -d 901 \
+	 -l /usr/local/samba/bin/swat swat 
+

    +afterwords simply contact to swat by using the URL https://myhost:901, accept the certificate +and the SSL connection is up. +

    The SWAT Home Page

    +The SWAT title page provides access to the latest Samba documentation. The manual page for +each samba component is accessible from this page as are the Samba-HOWTO-Collection (this +document) as well as the O'Reilly book "Using Samba". +

    +Administrators who wish to validate their samba configuration may obtain useful information +from the man pages for the diagnostic utilities. These are available from the SWAT home page +also. One diagnostic tool that is NOT mentioned on this page, but that is particularly +useful is ethereal, available from +http://www.ethereal.com. +

    Warning

    +SWAT can be configured to run in demo mode. This is NOT recommended +as it runs SWAT without authentication and with full administrative ability. ie: Allows +changes to smb.conf as well as general operation with root privileges. The option that +creates this ability is the -a flag to swat. Do not use this in any +production environment. +

    Global Settings

    +The Globals button will expose a page that allows configuration of the global parameters +in smb.conf. There are three levels of exposure of the parameters: +

    • + Basic - exposes common configuration options. +

    • + Advanced - exposes configuration options needed in more + complex environments. +

    • + Developer - exposes configuration options that only the brave + will want to tamper with. +

    +To switch to other than Basic editing ability click on either the +Advanced or the Developer dial, then click the +Commit Changes button. +

    +After making any changes to configuration parameters make sure that you click on the +Commit Changes button before moving to another area otherwise +your changes will be immediately lost. +

    Note

    +SWAT has context sensitive help. To find out what each parameter is for simply click the +Help link to the left of the configuration parameter. +

    Share Settings

    +To affect a currently configured share, simply click on the pull down button between the +Choose Share and the Delete Share buttons, +select the share you wish to operate on, then to edit the settings click on the +Choose Share button, to delete the share simply press the +Delete Share button. +

    +To create a new share, next to the button labelled Create Share enter +into the text field the name of the share to be created, then click on the +Create Share button. +

    Printers Settings

    +To affect a currently configured printer, simply click on the pull down button between the +Choose Printer and the Delete Printer buttons, +select the printer you wish to operate on, then to edit the settings click on the +Choose Printer button, to delete the share simply press the +Delete Printer button. +

    +To create a new printer, next to the button labelled Create Printer enter +into the text field the name of the share to be created, then click on the +Create Printer button. +

    The SWAT Wizard

    +The purpose if the SWAT Wizard is to help the Microsoft knowledgeable network administrator +to configure Samba with a minimum of effort. +

    +The Wizard page provides a tool for rewriting the smb.conf file in fully optimised format. +This will also happen if you press the commit button. The two differ in the the rewrite button +ignores any changes that may have been made, while the Commit button causes all changes to be +affected. +

    +The Edit button permits the editing (setting) of the minimal set of +options that may be necessary to create a working Samba server. +

    +Finally, there are a limited set of options that will determine what type of server Samba +will be configured for, whether it will be a WINS server, participate as a WINS client, or +operate with no WINS support. By clicking on one button you can elect to expose (or not) user +home directories. +

    The Status Page

    +The status page serves a limited purpose. Firstly, it allows control of the samba daemons. +The key daemons that create the samba server environment are: smbd, nmbd, winbindd. +

    +The daemons may be controlled individually or as a total group. Additionally, you may set +an automatic screen refresh timing. As MS Windows clients interact with Samba new smbd processes +will be continually spawned. The auto-refresh facility will allow you to track the changing +conditions with minimal effort. +

    +Lastly, the Status page may be used to terminate specific smbd client connections in order to +free files that may be locked. +

    The View Page

    +This page allows the administrator to view the optimised smb.conf file and, if you are +particularly masochistic, will permit you also to see all possible global configuration +parameters and their settings. +

    The Password Change Page

    +The Password Change page is a popular tool. This tool allows the creation, deletion, deactivation +and reactivation of MS Windows networking users on the local machine. Alternatively, you can use +this tool to change a local password for a user account. +

    +When logged in as a non-root account the user will have to provide the old password as well as +the new password (twice). When logged in as root only the new password is +required. +

    +One popular use for this tool is to change user passwords across a range of remote MS Windows +servers. +

    Prev Up Next
    Chapter 31. Migration from NT4 PDC to Samba-3 PDC Home Part V. Troubleshooting
    diff --git a/docs/htmldocs/SambaHA.html b/docs/htmldocs/SambaHA.html new file mode 100644 index 0000000000..ba82f6ad0f --- /dev/null +++ b/docs/htmldocs/SambaHA.html @@ -0,0 +1,4 @@ +Chapter 29. High Availability Options
    Chapter 29. High Availability Options
    Prev Part III. Advanced Configuration Next

    Chapter 29. High Availability Options

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +This chapter did not make it into this release. +It is planned for the published release of this document. +

    Prev Up Next
    Chapter 28. Samba Backup Techniques Home Part IV. Migration and Updating
    diff --git a/docs/htmldocs/ServerType.html b/docs/htmldocs/ServerType.html new file mode 100644 index 0000000000..01f03662ae --- /dev/null +++ b/docs/htmldocs/ServerType.html @@ -0,0 +1,343 @@ +Chapter 4. Server Types and Security Modes
    Chapter 4. Server Types and Security Modes
    Prev Part II. Server Configuration Basics Next

    Chapter 4. Server Types and Security Modes

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Seamless Windows Network Integration
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server

    +This chapter provides information regarding the types of server that Samba may be +configured to be. A Microsoft network administrator who wishes to migrate to or to +use Samba will want to know what, within a Samba context, terms familiar to MS Windows +administrator mean. This means that it is essential also to define how critical security +modes function BEFORE we get into the details of how to configure the server itself. +

    +The chapter provides an overview of the security modes of which Samba is capable +and how these relate to MS Windows servers and clients. +

    +Firstly we should recognise the question so often asked, "Why would I want to use Samba?" +So, in those chapters where the answer may be important you will see a section that highlights +features and benefits. These may be for or against Samba. +

    Features and Benefits

    +Two men were walking down a dusty road, when one suddenly kicked up a small red stone. It +hurt his toe and lodged in his sandal. He took the stone out and cursed it with a passion +and fury fitting his anguish. The other looked at the stone and said, that is a garnet - I +can turn that into a precious gem and some day it will make a princess very happy! +

    +The moral of this tale: Two men, two very different perspectives regarding the same stone. +Like it or not, Samba is like that stone. Treat it the right way and it can bring great +pleasure, but if you are forced upon it and have no time for its secrets then it can be +a source of discomfort. +

    +Samba started out as a project that sought to provide interoperability for MS Windows 3.x +clients with a Unix server. It has grown up a lot since its humble beginnings and now provides +features and functionality fit for large scale deployment. It also has some warts. In sections +like this one we will tell of both. +

    +So now, what are the benefits of features mentioned in this chapter? +

    • + Samba-3 can replace an MS Windows NT4 Domain Controller +

    • + Samba-3 offers excellent interoperability with MS Windows NT4 + style domains as well as natively with Microsoft Active + Directory domains. +

    • + Samba-3 permits full NT4 style Interdomain Trusts +

    • + Samba has security modes that permit more flexible + authentication than is possible with MS Windows NT4 Domain Controllers. +

    • + Samba-3 permits use of multiple account database backends +

    • + The account (password) database backends can be distributed + and replicated using multiple methods. This gives Samba-3 + greater flexibility than MS Windows NT4 and in many cases a + significantly higher utility than Active Directory domains + with MS Windows 200x. +

    Server Types

    Administrators of Microsoft networks often refer to three +different type of servers:

    • Domain Controller

      Primary Domain Controller
      Backup Domain Controller
      ADS Domain Controller

    • Domain Member Server

      Active Directory Member Server
      NT4 Style Domain Member Server

    • Stand Alone Server

    +The chapters covering Domain Control, Backup Domain Control and Domain Membership provide +pertinent information regarding Samba-3 configuration for each of these server roles. +The reader is strongly encouraged to become intimately familiar with the information +presented. +

    Samba Security Modes

    +In this section the function and purpose of Samba's security +modes are described. An accurate understanding of how Samba implements each security +mode as well as how to configure MS Windows clients for each mode will significantly +reduce user complaints and administrator heartache. +

    +In the SMB/CIFS networking world, there are only two types of security: USER Level +and SHARE Level. We refer to these collectively as security levels. In implementing these two security levels Samba provides flexibilities +that are not available with Microsoft Windows NT4 / 200x servers. Samba knows of five (5) +ways that allow the security levels to be implemented. In actual fact, Samba implements +SHARE Level security only one way, but has four ways of implementing +USER Level security. Collectively, we call the Samba implementations +Security Modes. These are: SHARE, USER, DOMAIN, +ADS, and SERVER +modes. They are documented in this chapter. +

    +A SMB server tells the client at startup what security level +it is running. There are two options: share level and +user level. Which of these two the client receives affects +the way the client then tries to authenticate itself. It does not directly affect +(to any great extent) the way the Samba server does security. This may sound strange, +but it fits in with the client/server approach of SMB. In SMB everything is initiated +and controlled by the client, and the server can only tell the client what is +available and whether an action is allowed. +

    User Level Security

    +We will describe user level security first, as it's simpler. +In user level security, the client will send a +session setup command directly after the protocol negotiation. +This contains a username and password. The server can either accept or reject that +username/password combination. Note that at this stage the server has no idea what +share the client will eventually try to connect to, so it can't base the +accept/reject on anything other than: +

    1. The username/password

    2. The name of the client machine

    +If the server accepts the username/password then the client expects to be able to +mount shares (using a tree connection) without specifying a +password. It expects that all access rights will be as the username/password +specified in the session setup. +

    +It is also possible for a client to send multiple session setup +requests. When the server responds, it gives the client a uid to use +as an authentication tag for that username/password. The client can maintain multiple +authentication contexts in this way (WinDD is an example of an application that does this). +

    Example Configuration

    +The smb.conf parameter that sets User Level Security is: +

    +	security = user
+

    +This is the default setting since samba-2.2.x. +

    Share Level Security

    +Ok, now for share level security. In share level security, the client authenticates +itself separately for each share. It will send a password along with each +tree connection (share mount). It does not explicitly send a +username with this operation. The client expects a password to be associated +with each share, independent of the user. This means that Samba has to work out what +username the client probably wants to use. It is never explicitly sent the username. +Some commercial SMB servers such as NT actually associate passwords directly with +shares in share level security, but Samba always uses the unix authentication scheme +where it is a username/password pair that is authenticated, not a share/password pair. +

    +To gain understanding of the MS Windows networking parallels to this, one should think +in terms of MS Windows 9x/Me where one can create a shared folder that provides read-only +or full access, with or without a password. +

    +Many clients send a session setup even if the server is in share +level security. They normally send a valid username but no password. Samba records +this username in a list of possible usernames. When the client +then does a tree connection it also adds to this list the name +of the share they try to connect to (useful for home directories) and any users +listed in the user = smb.conf line. The password is then checked +in turn against these possible usernames. If a match is found +then the client is authenticated as that user. +

    Example Configuration

    +The smb.conf parameter that sets Share Level Security is: +

    +	security = share
+

    +Please note that there are reports that recent MS Windows clients do not like to work +with share mode security servers. You are strongly discouraged from using share level security. +

    Domain Security Mode (User Level Security)

    +When Samba is operating in security = domain mode, +the Samba server has a domain security trust account (a machine account) and will cause +all authentication requests to be passed through to the domain controllers. +

    Example Configuration

    +Samba as a Domain Member Server +

    +This method involves addition of the following parameters in the smb.conf file: +

    +        security = domain
+        workgroup = "name_of_NT_domain"
+

    +In order for this method to work, the Samba server needs to join the MS Windows NT +security domain. This is done as follows: +

    1. On the MS Windows NT domain controller, using + the Server Manager, add a machine account for the Samba server. +

    2. Next, on the Unix/Linux system execute:

      root# smbpasswd -j DOMAIN_NAME -r PDC_NAME (samba-2.x)

      root# net join -U administrator%password (samba-3)

    Note

    +As of Samba-2.2.4 the Samba 2.2.x series can auto-join a Windows NT4 style Domain just +by executing: +

    +root# smbpasswd -j DOMAIN_NAME -r PDC_NAME -U Administrator%password
+

    + +As of Samba-3 the same can be done by executing: +

    +root# net join -U Administrator%password
+

    +It is not necessary with Samba-3 to specify the DOMAIN_NAME or the PDC_NAME as it +figures this out from the smb.conf file settings. +

    +Use of this mode of authentication does require there to be a standard Unix account +for each user in order to assign a uid once the account has been authenticated by +the remote Windows DC. This account can be blocked to prevent logons by clients other than +MS Windows through things such as setting an invalid shell in the +/etc/passwd entry. +

    +An alternative to assigning UIDs to Windows users on a Samba member server is +presented in the Winbind Overview chapter +in this HOWTO collection. +

    +For more information of being a domain member, see the Domain +Member section of this Howto. +

    ADS Security Mode (User Level Security)

    +Both Samba 2.2 and 3.0 can join an Active Directory domain. This is +possible even if the domain is run in native mode. Active Directory in +native mode perfectly allows NT4-style domain members, contrary to +popular belief. The only thing that Active Directory in native mode +prohibits is Backup Domain Controllers running NT4. +

    +If you are running Active Directory starting with Samba 3.0 you can +however join as a native AD member. Why would you want to do that? +Your security policy might prohibit the use of NT-compatible +authentication protocols. All your machines are running Windows 2000 +and above and all use full Kerberos. In this case Samba as a NT4-style +domain would still require NT-compatible authentication data. Samba in +AD-member mode can accept Kerberos. +

    Example Configuration

    +	realm = your.kerberos.REALM
+	security = ADS
+

    + The following parameter may be required: +

    +	ads server = your.kerberos.server
+

    +Please refer to the Domain Membership and Active Directory +Membership sections for more information regarding this configuration option. +

    Server Security (User Level Security)

    +Server security mode is a left over from the time when Samba was not capable of acting +as a domain member server. It is highly recommended NOT to use this feature. Server +security mode has many draw backs. The draw backs include: +

    Potential Account Lockout on MS Windows NT4/200x password servers
    Lack of assurance that the password server is the one specified
    Does not work with Winbind, particularly needed when storing profiles remotely
    This mode may open connections to the password server, and keep them open for extended periods.
    Security on the Samba server breaks badly when the remote password server suddenly shuts down
    With this mode there is NO security account in the domain that the password server belongs to for the Samba server.

    +In server security mode the Samba server reports to the client that it is in user level +security. The client then does a session setup as described earlier. +The Samba server takes the username/password that the client sends and attempts to login to the +password server by sending exactly the same username/password that +it got from the client. If that server is in user level security and accepts the password, +then Samba accepts the clients connection. This allows the Samba server to use another SMB +server as the password server. +

    +You should also note that at the very start of all this, where the server tells the client +what security level it is in, it also tells the client if it supports encryption. If it +does then it supplies the client with a random cryptkey. The client will then send all +passwords in encrypted form. Samba supports this type of encryption by default. +

    +The parameter security = server means that Samba reports to clients that +it is running in user mode but actually passes off all authentication +requests to another user mode server. This requires an additional +parameter password server that points to the real authentication server. +That real authentication server can be another Samba server or can be a Windows NT server, +the later natively capable of encrypted password support. +

    Note

    +When Samba is running in server security mode it is essential that +the parameter password server is set to the precise NetBIOS machine +name of the target authentication server. Samba can NOT determine this from NetBIOS name +lookups because the choice of the target authentication server is arbitrary and can not +be determined from a domain name. In essence, a Samba server that is in +server security mode is operating in what used to be known as +workgroup mode. +

    Example Configuration

    +Using MS Windows NT as an authentication server +

    +This method involves the additions of the following parameters in the smb.conf file: +

    +        encrypt passwords = Yes
+        security = server
+        password server = "NetBIOS_name_of_a_DC"
+

    +There are two ways of identifying whether or not a username and password pair was valid +or not. One uses the reply information provided as part of the authentication messaging +process, the other uses just an error code. +

    +The down-side of this mode of configuration is the fact that for security reasons Samba +will send the password server a bogus username and a bogus password and if the remote +server fails to reject the username and password pair then an alternative mode of +identification of validation is used. Where a site uses password lock out after a +certain number of failed authentication attempts this will result in user lockouts. +

    +Use of this mode of authentication does require there to be a standard Unix account +for the user, though this account can be blocked to prevent logons by non-SMB/CIFS clients. +

    Seamless Windows Network Integration

    +MS Windows clients may use encrypted passwords as part of a challenge/response +authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or clear text strings for simple +password based authentication. It should be realized that with the SMB protocol, +the password is passed over the network either in plain text or encrypted, but +not both in the same authentication request. +

    +When encrypted passwords are used, a password that has been entered by the user +is encrypted in two ways: +

    • An MD4 hash of the UNICODE of the password + string. This is known as the NT hash. +

    • The password is converted to upper case, + and then padded or truncated to 14 bytes. This string is + then appended with 5 bytes of NULL characters and split to + form two 56 bit DES keys to encrypt a "magic" 8 byte value. + The resulting 16 bytes form the LanMan hash. +

    +MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0 +pre-service pack 3 will use either mode of password authentication. All +versions of MS Windows that follow these versions no longer support plain +text passwords by default. +

    +MS Windows clients have a habit of dropping network mappings that have been idle +for 10 minutes or longer. When the user attempts to use the mapped drive +connection that has been dropped, the client re-establishes the connection using +a cached copy of the password. +

    +When Microsoft changed the default password mode, support was dropped for caching +of the plain text password. This means that when the registry parameter is changed +to re-enable use of plain text passwords it appears to work, but when a dropped +service connection mapping attempts to revalidate it will fail if the remote +authentication server does not support encrypted passwords. This means that it +is definitely not a good idea to re-enable plain text password support in such clients. +

    +The following parameters can be used to work around the issue of Windows 9x clients +upper casing usernames and password before transmitting them to the SMB server +when using clear text authentication. +

    +        password level = integer
+        username level = integer
+

    +By default Samba will lower case the username before attempting to lookup the user +in the database of local system accounts. Because UNIX usernames conventionally +only contain lower case character, the username level parameter +is rarely needed. +

    +However, passwords on UNIX systems often make use of mixed case characters. +This means that in order for a user on a Windows 9x client to connect to a Samba +server using clear text authentication, the password level +must be set to the maximum number of upper case letter which could +appear is a password. Note that the server OS uses the traditional DES version +of crypt(), a password level of 8 will result in case +insensitive passwords as seen from Windows users. This will also result in longer +login times as Samba has to compute the permutations of the password string and +try them one by one until a match is located (or all combinations fail). +

    +The best option to adopt is to enable support for encrypted passwords where ever +Samba is used. Most attempts to apply the registry change to re-enable plain text +passwords will eventually lead to user complaints and unhappiness. +

    Common Errors

    +We all make mistakes. It is Ok to make mistakes, so long as they are made in the right places +and at the right time. A mistake that causes lost productivity is seldom tolerated. A mistake +made in a developmental test lab is expected. +

    +Here we look at common mistakes and misapprehensions that have been the subject of discussions +on the Samba mailing lists. Many of these are avoidable by doing you homework before attempting +a Samba implementation. Some are the result of misunderstanding of the English language. The +English language has many turns of phrase that are potentially vague and may be highly confusing +to those for whom English is not their native tongue. +

    What makes Samba a SERVER?

    +To some the nature of the Samba security mode is very obvious, but entirely +wrong all the same. It is assumed that security = server means that Samba +will act as a server. Not so! See above - this setting means that Samba will try +to use another SMB server as its source of user authentication alone. +

    What makes Samba a Domain Controller?

    +The smb.conf parameter security = domain does NOT really make Samba behave +as a Domain Controller! This setting means we want Samba to be a domain member! +

    What makes Samba a Domain Member?

    +Guess! So many others do. But whatever you do, do NOT think that security = user +makes Samba act as a domain member. Read the manufacturers manual before the warranty expires! See +the Domain Member section of this Howto for more information. +

    Constantly Losing Connections to Password Server

    +Why does server_validate() simply give up rather than re-establishing its connection to the +password server? Though I am not fluent in the SMB protocol, perhaps the cluster server +process passes along to its client workstation the session key it receives from the password +server, which means the password hashes submitted by the client would not work on a subsequent +connection, whose session key would be different. So server_validate() must give up. +

    +Indeed. That's why security = server is at best a nasty hack. Please use security = domain. +security = server mode is also known as pass-through authentication. +

    Prev Up Next
    Part II. Server Configuration Basics Home Chapter 5. Domain Control
    diff --git a/docs/htmldocs/StandAloneServer.html b/docs/htmldocs/StandAloneServer.html new file mode 100644 index 0000000000..a3bdf439af --- /dev/null +++ b/docs/htmldocs/StandAloneServer.html @@ -0,0 +1,143 @@ +Chapter 8. Stand-Alone Servers
    Chapter 8. Stand-Alone Servers
    Prev Part II. Server Configuration Basics Next

    Chapter 8. Stand-Alone Servers

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors

    +Stand-Alone servers are independent of Domain Controllers on the network. +They are NOT domain members and function more like workgroup servers. In many +cases a stand-alone server is configured with a minimum of security control +with the intent that all data served will be readily accessible to all users. +

    Features and Benefits

    +Stand-Alone servers can be as secure or as insecure as needs dictate. They can +have simple or complex configurations. Above all, despite the hoopla about +Domain security they remain a very common installation. +

    +If all that is needed is a server for read-only files, or for +printers alone, it may not make sense to affect a complex installation. +For example: A drafting office needs to store old drawings and reference +standards. No-one can write files to the server as it is legislatively +important that all documents remain unaltered. A share mode read-only stand-alone +server is an ideal solution. +

    +Another situation that warrants simplicity is an office that has many printers +that are queued off a single central server. Everyone needs to be able to print +to the printers, there is no need to affect any access controls and no files will +be served from the print server. Again a share mode stand-alone server makes +a great solution. +

    Background

    +The term stand-alone server means that the server +will provide local authentication and access control for all resources +that are available from it. In general this means that there will be a +local user database. In more technical terms, it means that resources +on the machine will be made available in either SHARE mode or in +USER mode. +

    +No special action is needed other than to create user accounts. Stand-alone +servers do NOT provide network logon services. This means that machines that +use this server do NOT perform a domain logon to it. Whatever logon facility +the workstations are subject to is independent of this machine. It is however +necessary to accommodate any network user so that the logon name they use will +be translated (mapped) locally on the stand-alone server to a locally known +user name. There are several ways this can be done. +

    +Samba tends to blur the distinction a little in respect of what is +a stand-alone server. This is because the authentication database may be +local or on a remote server, even if from the Samba protocol perspective +the Samba server is NOT a member of a domain security context. +

    +Through the use of PAM (Pluggable Authentication Modules) and nsswitch +(the name service switcher) the source of authentication may reside on +another server. We would be inclined to call this the authentication server. +This means that the Samba server may use the local Unix/Linux system password database +(/etc/passwd or /etc/shadow), may use a +local smbpasswd file, or may use +an LDAP back end, or even via PAM and Winbind another CIFS/SMB server +for authentication. +

    Example Configuration

    +The following examples are designed to inspire simplicity. It is too easy to +attempt a high level of creativity and to introduce too much complexity in +server and network design. +

    Reference Documentation Server

    +Configuration of a read-only data server that EVERYONE can access is very simple. +Here is the smb.conf file that will do this. Assume that all the reference documents +are stored in the directory /export, that the documents are owned by a user other than +nobody. No home directories are shared, that are no users in the /etc/passwd +Unix system database. This is a very simple system to administer. +

    +	# Global parameters
+	[global]
+		workgroup = MYGROUP
+		netbios name = REFDOCS
+		security = SHARE
+		passdb backend = guest
+		wins server = 192.168.1.1
+
+	[data]
+		comment = Data
+		path = /export
+		guest only = Yes
+

    +In the above example the machine name is set to REFDOCS, the workgroup is set to the name +of the local workgroup so that the machine will appear in with systems users are familiar +with. The only password backend required is the "guest" backend so as to allow default +unprivileged account names to be used. Given that there is a WINS server on this network +we do use it. +

    Central Print Serving

    +Configuration of a simple print server is very simple if you have all the right tools +on your system. +

    Assumptions:

    1. + The print server must require no administration +

    2. + The print spooling and processing system on our print server will be CUPS. + (Please refer to the CUPS Printing chapter for more information). +

    3. + All printers that the print server will service will be network + printers. They will be correctly configured, by the administrator, + in the CUPS environment. +

    4. + All workstations will be installed using postscript drivers. The printer + of choice is the Apple Color LaserWriter. +

    +In this example our print server will spool all incoming print jobs to +/var/spool/samba until the job is ready to be submitted by +Samba to the CUPS print processor. Since all incoming connections will be as +the anonymous (guest) user, two things will be required: +

    Enabling Anonymous Printing

    • + The Unix/Linux system must have a guest account. + The default for this is usually the account nobody. + To find the correct name to use for your version of Samba do the + following: + 

      +$ testparm -s -v | grep "guest account"
+

      + Then make sure that this account exists in your system password + database (/etc/passwd). +

    • + The directory into which Samba will spool the file must have write + access for the guest account. The following commands will ensure that + this directory is available for use: + 

      +root# mkdir /var/spool/samba
+root# chown nobody.nobody /var/spool/samba
+root# chmod a+rwt /var/spool/samba
+

      +

    +

    +	# Global parameters
+	[global]
+		workgroup = MYGROUP
+		netbios name = PTRSVR1
+		security = SHARE
+		passdb backend = guest
+		wins server = 192.168.1.1
+
+	[printers]
+		comment = All Printers
+		path = /var/spool/samba
+		printer admin = root
+		guest ok = Yes
+		printable = Yes
+		printing = cups
+		use client driver = Yes
+		browseable = No
+

    +

    Common Errors

    +The greatest mistake so often made is to make a network configuration too complex. +It pays to use the simplest solution that will meet the needs of the moment. +

    Prev Up Next
    Chapter 7. Domain Membership Home Chapter 9. MS Windows Network Configuration Guide
    diff --git a/docs/htmldocs/VFS.html b/docs/htmldocs/VFS.html new file mode 100644 index 0000000000..6b520d792a --- /dev/null +++ b/docs/htmldocs/VFS.html @@ -0,0 +1,105 @@ +Chapter 20. Stackable VFS modules
    Chapter 20. Stackable VFS modules
    Prev Part III. Advanced Configuration Next

    Chapter 20. Stackable VFS modules

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Tim Potter

    Simo Sorce

    original vfs_skel README

    Alexander Bokovoy

    original vfs_netatalk docs

    Stefan Metzmacher

    Update for multiple modules

    Table of Contents

    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    Common Errors

    Features and Benefits

    +Since Samba-3, there is support for stackable VFS(Virtual File System) modules. +Samba passes each request to access the unix file system thru the loaded VFS modules. +This chapter covers all the modules that come with the samba source and references to +some external modules. +

    Discussion

    +If not supplied with your platform distribution binary Samba package you may have problems +to compile these modules, as shared libraries are compiled and linked in different ways +on different systems. They currently have been tested against GNU/Linux and IRIX. +

    +To use the VFS modules, create a share similar to the one below. The +important parameter is the vfs objects parameter where +you can list one or more VFS modules by name. For example, to log all access +to files and put deleted files in a recycle bin: + +

    +[audit]
+        comment = Audited /data directory
+        path = /data
+        vfs objects = audit recycle
+        writeable = yes
+        browseable = yes
+

    +

    +The modules are used in the order in which they are specified. +

    +Samba will attempt to load modules from the lib +directory in the root directory of the samba installation (usually +/usr/lib/samba/vfs or /usr/local/samba/lib/vfs +). +

    +Some modules can be used twice for the same share. +This can be done using a configuration similar to the one below. + +

    +[test]
+        comment = VFS TEST
+        path = /data
+        writeable = yes
+        browseable = yes
+        vfs objects = example:example1 example example:test
+		example1: parameter = 1
+		example:  parameter = 5
+		test:	  parameter = 7
+

    +

    Included modules

    audit

    + A simple module to audit file access to the syslog + facility. The following operations are logged: +

    share
    connect/disconnect
    directory opens/create/remove
    file open/close/rename/unlink/chmod

    +

    extd_audit

    + This module is identical with the audit module above except + that it sends audit logs to both syslog as well as the smbd log file/s. The + loglevel for this module is set in the smb.conf file. +

    + The logging information that will be written to the smbd log file is controlled by + the log level parameter in smb.conf. The + following information will be recorded: +

    Table 20.1. Extended Auditing Log Information

    Log LevelLog Details - File and Directory Operations
    0Creation / Deletion
    1Create / Delete / Rename / Permission Changes
    2Create / Delete / Rename / Perm Change / Open / Close

    fake_perms

    + This module was created to allow Roaming Profile files and directories to be set (on the Samba server + under Unix) as read only. This module will if installed on the Profiles share will report to the client + that the Profile files and directories are writable. This satisfies the client even though the files + will never be overwritten as the client logs out or shuts down. +

    recycle

    + A recycle-bin like module. When used any unlink call + will be intercepted and files moved to the recycle + directory instead of being deleted. +

    Supported options: +

    recycle:repository

    FIXME

    recycle:keeptree

    FIXME

    recycle:versions

    FIXME

    recycle:touch

    FIXME

    recycle:maxsize

    FIXME

    recycle:exclude

    FIXME

    recycle:exclude_dir

    FIXME

    recycle:noversions

    FIXME

    +

    netatalk

    + A netatalk module, that will ease co-existence of samba and + netatalk file sharing services. +

    Advantages compared to the old netatalk module: +

    it doesn't care about creating of .AppleDouble forks, just keeps them in sync
    if a share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically

    +

    VFS modules available elsewhere

    +This section contains a listing of various other VFS modules that +have been posted but don't currently reside in the Samba CVS +tree for one reason or another (e.g. it is easy for the maintainer +to have his or her own CVS tree). +

    +No statements about the stability or functionality of any module +should be implied due to its presence here. +

    DatabaseFS

    + URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php +

    By Eric Lorimer.

    + I have created a VFS module which implements a fairly complete read-only + filesystem. It presents information from a database as a filesystem in + a modular and generic way to allow different databases to be used + (originally designed for organizing MP3s under directories such as + "Artists," "Song Keywords," etc... I have since applied it to a student + roster database very easily). The directory structure is stored in the + database itself and the module makes no assumptions about the database + structure beyond the table it requires to run. +

    + Any feedback would be appreciated: comments, suggestions, patches, + etc... If nothing else, hopefully it might prove useful for someone + else who wishes to create a virtual filesystem. +

    vscan

    URL: http://www.openantivirus.org/

    + samba-vscan is a proof-of-concept module for Samba, which + uses the VFS (virtual file system) features of Samba 2.2.x/3.0 + alphaX. Of course, Samba has to be compiled with VFS support. + samba-vscan supports various virus scanners and is maintained + by Rainer Link. +

    Common Errors

    +There must be some gotchas we should record here! Jelmer??? +

    Prev Up Next
    Chapter 19. CUPS Printing Support in Samba 3.0 Home Chapter 21. Integrated Logon Support using Winbind
    diff --git a/docs/htmldocs/index.html b/docs/htmldocs/index.html new file mode 100755 index 0000000000..f7bc47b7c8 --- /dev/null +++ b/docs/htmldocs/index.html @@ -0,0 +1,76 @@ +SAMBA Project Documentation
    SAMBA Project Documentation
       Next

    SAMBA Project Documentation

    Edited by

    Jelmer R. Vernooij

    John H. Terpstra

    Gerald (Jerry) Carter

    +This documentation is distributed under the GNU General Public License (GPL) +version 2. A copy of the license is included with the Samba source +distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt +

    Attributions.  +

    Introduction to Samba
    How to Install and Test SAMBA
    Fast Start for the Impatient
    Server Types and Security Modes
    Domain Control
    Backup Domain Control
    Domain Membership
    Stand-Alone Servers
    MS Windows Network Configuration Guide
    Samba / MS Windows Network Browsing Guide
    Account Information Databases
    Mapping MS Windows and Unix Groups
    File, Directory and Share Access Controls
    File and Record Locking
    Securing Samba
    Interdomain Trust Relationships
    Hosting a Microsoft Distributed File System tree on Samba
    Classical Printing Support
    CUPS Printing Support in Samba 3.0
    Stackable VFS modules

    • Jelmer Vernooij <jelmer@samba.org>

    • John Terpstra <jht@samba.org>

    • Tim Potter

    • Simo Sorce (original vfs_skel README)

    • Alexander Bokovoy (original vfs_netatalk docs)

    • Stefan Metzmacher (Update for multiple modules)

    Integrated Logon Support using Winbind
    Advanced Network Management
    System and Account Policies
    Desktop Profile Management
    PAM based Distributed Authentication
    Integrating MS Windows networks with Samba
    Unicode/Charsets
    Samba Backup Techniques
    High Availability Options
    Upgrading from Samba-2.x to Samba-3.0.0
    Migration from NT4 PDC to Samba-3 PDC
    SWAT - The Samba Web Administration Tool
    The Samba checklist
    Analysing and solving samba problems
    Reporting Bugs
    How to compile SAMBA
    Portability
    Samba and other CIFS clients
    Samba Performance Tuning
    DNS and DHCP Configuration Guide
    Further Resources

    + +

    Monday April 21, 2003

    Abstract

    +This book is a collection of HOWTOs added to Samba documentation over the years. +Samba is always under development, and so is its' documentation. This release of the +documentation represents a major revision or layout as well as contents. +The most recent version of this document can be found at +http://www.samba.org/ +on the "Documentation" page. Please send updates to +Jelmer Vernooij, +John H. Terpstra or +Gerald (Jerry) Carter. +

    +The Samba-Team would like to express sincere thanks to the many people who have with +or without their knowledge contributed to this update. The size and scope of this +project would not have been possible without significant community contribution. A not +insignificant number of ideas for inclusion (if not content itself) has been obtained +from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. +Please keep publishing your Unofficial HOWTOs - they are a source of inspiration and +application knowledge that is most to be desired by many Samba users and administrators. +

    Table of Contents

    I. General Installation
    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your + server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client
    What If Things Don't Work?
    Common Errors
    Why are so many smbd processes eating memory?
    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs
    3. Fast Start for the Impatient
    Note
    II. Server Configuration Basics
    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Seamless Windows Network Integration
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." +or "Cannot join domain, the credentials supplied conflict with an +existing set.." when creating a machine trust account.
    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not +exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, +I get a message about my account being disabled.
    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    III. Advanced Configuration
    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    11. Account Information Databases
    Features and Benefits
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and Unix
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon - Users not in Samba SAM
    Users are being added to the wrong backend database
    auth methods does not work
    12. Mapping MS Windows and Unix Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with Unix File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and Unix Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask + parameters
    Interaction with the standard Samba file attribute + mapping
    Common Errors
    Users can not write to a public share
    I have set force user and Samba still makes root the owner of all the files + I touch!
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    Common Errors
    Tell me about Trust Relationships using Samba
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    Parameters for Backwards Compatibility
    Parameters no longer in use
    A simple Configuration to Print with Samba-3
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print with Samba-3
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various Unix Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba-3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with +rpcclient
    "The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure)
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a +different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba-3
    Publishing Printer Information in Active Directory or LDAP
    Common Errors and Problems
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for +CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for +application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download
    GDI on Windows -- PostScript on Unix
    Windows Drivers, GDI and EMF
    Unix Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and +native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many +Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel +Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for +cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Caveats to be considered
    What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver?
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsm completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the +Client
    Installing PostScript Driver Files manually (using +rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Commandline Driver Installation in 15 little Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    When not to use Samba to print to +CUPS
    In Case of Trouble.....
    Where to find Documentation
    How to ask for Help
    Where to find Help
    Appendix
    Printing from CUPS to Windows attached +Printers
    More CUPS filtering Chains
    Trouble Shooting Guidelines to fix typical Samba printing +Problems
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    Common Errors
    21. Integrated Logon Support using Winbind
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    How does one set up roaming profiles for just one (or a few) user/s or group/s?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    My Boomerang Won't Come Back
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    IV. Migration and Updating
    30. Upgrading from Samba-2.x to Samba-3.0.0
    Charsets
    Obsolete configuration options
    Password Backend
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    V. Troubleshooting
    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    Still having troubles?
    34. Analysing and solving samba problems
    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches
    VI. Appendixes
    36. How to compile SAMBA
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    Common Errors
    37. Portability
    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba?
    How do I get printer driver download working + for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Books
    Index

    List of Figures

    19.1. Windows Printing to a local Printer
    19.2. Printing to a Postscript Printer
    19.3. Ghostscript as a RIP for non-postscript printers
    19.4. Prefiltering in CUPS to form Postscript
    19.5. Adding Device-specific Print Options
    19.6. Postscript to intermediate Raster format
    19.7. CUPS-raster production using Ghostscript
    19.8. Image format to CUPS-raster format conversion
    19.9. Raster to Printer Specific formats
    19.10. cupsomatic/foomatic processing versus Native CUPS
    19.11. Print Driver execution on the Client
    19.12. Print Driver execution on the Server
    19.13. Printing via CUPS/samba server
    19.14. cupsaddsmb flowchart
    19.15. CUPS Printing Overview

    List of Tables

    7.1. Assumptions
    10.1. Browse subnet example 1
    10.2. Browse subnet example 2
    10.3. Browse subnet example 3
    10.4. Browse subnet example 4
    11.1. Attributes in the sambaSamAccount objectclass (LDAP)
    11.2. Basic smb.conf options for MySQL passdb backend
    11.3. MySQL field names for MySQL passdb backend
    13.1. Managing directories with unix and windows
    13.2. User and Group Based Controls
    13.3. File and Directory Permission Based Controls
    13.4. Other Controls
    20.1. Extended Auditing Log Information
    24.1. User Shell Folder registry keys default values
    24.2. Defaults of profile settings registry keys
    24.3. Defaults of default user profile paths registry keys
    25.1. Options recognized by pam_smbpass
    31.1. The 3 Major Site Types
    31.2. Nature of the Conversion Choices

    List of Examples

    12.1. smbgrpadd.sh
    13.1. Example File
       Next
       Part I. General Installation
    diff --git a/docs/htmldocs/ix01.html b/docs/htmldocs/ix01.html new file mode 100644 index 0000000000..4f706aed70 --- /dev/null +++ b/docs/htmldocs/ix01.html @@ -0,0 +1 @@ +Index
    Index
    Prev   

    Index

    Prev Up 
    Chapter 41. Further Resources Home 
    diff --git a/docs/htmldocs/locking.html b/docs/htmldocs/locking.html new file mode 100644 index 0000000000..a128cac7ce --- /dev/null +++ b/docs/htmldocs/locking.html @@ -0,0 +1,656 @@ +Chapter 14. File and Record Locking
    Chapter 14. File and Record Locking
    Prev Part III. Advanced Configuration Next

    Chapter 14. File and Record Locking

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Eric Roseme

    HP Oplocks Usage Recommendations Whitepaper

    Table of Contents

    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Additional Reading

    +One area which causes trouble for many network administrators is locking. +The extent of the problem is readily evident from searches over the internet. +

    Features and Benefits

    +Samba provides all the same locking semantics that MS Windows clients expect +and that MS Windows NT4 / 200x servers provide also. +

    +The term locking has exceptionally broad meaning and covers +a range of functions that are all categorized under this one term. +

    +Opportunistic locking is a desirable feature when it can enhance the +perceived performance of applications on a networked client. However, the +opportunistic locking protocol is not robust, and therefore can +encounter problems when invoked beyond a simplistic configuration, or +on extended, slow, or faulty networks. In these cases, operating +system management of opportunistic locking and/or recovering from +repetitive errors can offset the perceived performance advantage that +it is intended to provide. +

    +The MS Windows network administrator needs to be aware that file and record +locking semantics (behaviour) can be controlled either in Samba or by way of registry +settings on the MS Windows client. +

    Note

    +Sometimes it is necessary to disable locking control settings BOTH on the Samba +server as well as on each MS Windows client! +

    Discussion

    +There are two types of locking which need to be performed by a SMB server. +The first is record locking which allows a client to lock +a range of bytes in a open file. The second is the deny modes +that are specified when a file is open. +

    +Record locking semantics under Unix is very different from record locking under +Windows. Versions of Samba before 2.2 have tried to use the native fcntl() unix +system call to implement proper record locking between different Samba clients. +This can not be fully correct due to several reasons. The simplest is the fact +that a Windows client is allowed to lock a byte range up to 2^32 or 2^64, +depending on the client OS. The unix locking only supports byte ranges up to 2^31. +So it is not possible to correctly satisfy a lock request above 2^31. There are +many more differences, too many to be listed here. +

    +Samba 2.2 and above implements record locking completely independent of the +underlying unix system. If a byte range lock that the client requests happens +to fall into the range 0-2^31, Samba hands this request down to the Unix system. +All other locks can not be seen by unix anyway. +

    +Strictly a SMB server should check for locks before every read and write call on +a file. Unfortunately with the way fcntl() works this can be slow and may overstress +the rpc.lockd. It is also almost always unnecessary as clients are supposed to +independently make locking calls before reads and writes anyway if locking is +important to them. By default Samba only makes locking calls when explicitly asked +to by a client, but if you set strict locking = yes then it +will make lock checking calls on every read and write. +

    +You can also disable by range locking completely using locking = no. +This is useful for those shares that don't support locking or don't need it +(such as cdroms). In this case Samba fakes the return codes of locking calls to +tell clients that everything is OK. +

    +The second class of locking is the deny modes. These +are set by an application when it opens a file to determine what types of +access should be allowed simultaneously with its open. A client may ask for +DENY_NONE, DENY_READ, +DENY_WRITE or DENY_ALL. There are also special compatibility +modes called DENY_FCB and DENY_DOS. +

    Opportunistic Locking Overview

    +Opportunistic locking (Oplocks) is invoked by the Windows file system +(as opposed to an API) via registry entries (on the server AND client) +for the purpose of enhancing network performance when accessing a file +residing on a server. Performance is enhanced by caching the file +locally on the client which allows: +

    Read-ahead:

    + The client reads the local copy of the file, eliminating network latency +

    Write caching:

    + The client writes to the local copy of the file, eliminating network latency +

    Lock caching:

    + The client caches application locks locally, eliminating network latency +

    +The performance enhancement of oplocks is due to the opportunity of +exclusive access to the file - even if it is opened with deny-none - +because Windows monitors the file's status for concurrent access from +other processes. +

    Windows defines 4 kinds of Oplocks:

    Level1 Oplock:

    + The redirector sees that the file was opened with deny + none (allowing concurrent access), verifies that no + other process is accessing the file, checks that + oplocks are enabled, then grants deny-all/read-write/exclusive + access to the file. The client now performs + operations on the cached local file. +

    + If a second process attempts to open the file, the open + is deferred while the redirector "breaks" the original + oplock. The oplock break signals the caching client to + write the local file back to the server, flush the + local locks, and discard read-ahead data. The break is + then complete, the deferred open is granted, and the + multiple processes can enjoy concurrent file access as + dictated by mandatory or byte-range locking options. + However, if the original opening process opened the + file with a share mode other than deny-none, then the + second process is granted limited or no access, despite + the oplock break. +

    Level2 Oplock:

    + Performs like a level1 oplock, except caching is only + operative for reads. All other operations are performed + on the server disk copy of the file. +

    Filter Oplock:

    + Does not allow write or delete file access +

    Batch Oplock:

    + Manipulates file openings and closings - allows caching + of file attributes +

    +An important detail is that oplocks are invoked by the file system, not +an application API. Therefore, an application can close an oplocked +file, but the file system does not relinquish the oplock. When the +oplock break is issued, the file system then simply closes the file in +preparation for the subsequent open by the second process. +

    +Opportunistic Locking is actually an improper name for this feature. +The true benefit of this feature is client-side data caching, and +oplocks is merely a notification mechanism for writing data back to the +networked storage disk. The limitation of opportunistic locking is the +reliability of the mechanism to process an oplock break (notification) +between the server and the caching client. If this exchange is faulty +(usually due to timing out for any number of reasons) then the +client-side caching benefit is negated. +

    +The actual decision that a user or administrator should consider is +whether it is sensible to share amongst multiple users data that will +be cached locally on a client. In many cases the answer is no. +Deciding when to cache or not cache data is the real question, and thus +"opportunistic locking" should be treated as a toggle for client-side +caching. Turn it "ON" when client-side caching is desirable and +reliable. Turn it "OFF" when client-side caching is redundant, +unreliable, or counter-productive. +

    +Opportunistic locking is by default set to "on" by Samba on all +configured shares, so careful attention should be given to each case to +determine if the potential benefit is worth the potential for delays. +The following recommendations will help to characterize the environment +where opportunistic locking may be effectively configured. +

    +Windows Opportunistic Locking is a lightweight performance-enhancing +feature. It is not a robust and reliable protocol. Every +implementation of Opportunistic Locking should be evaluated as a +tradeoff between perceived performance and reliability. Reliability +decreases as each successive rule above is not enforced. Consider a +share with oplocks enabled, over a wide area network, to a client on a +South Pacific atoll, on a high-availability server, serving a +mission-critical multi-user corporate database, during a tropical +storm. This configuration will likely encounter problems with oplocks. +

    +Oplocks can be beneficial to perceived client performance when treated +as a configuration toggle for client-side data caching. If the data +caching is likely to be interrupted, then oplock usage should be +reviewed. Samba enables opportunistic locking by default on all +shares. Careful attention should be given to the client usage of +shared data on the server, the server network reliability, and the +opportunistic locking configuration of each share. +n mission critical high availability environments, data integrity is +often a priority. Complex and expensive configurations are implemented +to ensure that if a client loses connectivity with a file server, a +failover replacement will be available immediately to provide +continuous data availability. +

    +Windows client failover behavior is more at risk of application +interruption than other platforms because it is dependant upon an +established TCP transport connection. If the connection is interrupted +- as in a file server failover - a new session must be established. +It is rare for Windows client applications to be coded to recover +correctly from a transport connection loss, therefore most applications +will experience some sort of interruption - at worst, abort and +require restarting. +

    +If a client session has been caching writes and reads locally due to +opportunistic locking, it is likely that the data will be lost when the +application restarts, or recovers from the TCP interrupt. When the TCP +connection drops, the client state is lost. When the file server +recovers, an oplock break is not sent to the client. In this case, the +work from the prior session is lost. Observing this scenario with +oplocks disabled, and the client was writing data to the file server +real-time, then the failover will provide the data on disk as it +existed at the time of the disconnect. +

    +In mission critical high availability environments, careful attention +should be given to opportunistic locking. Ideally, comprehensive +testing should be done with all affected applications with oplocks +enabled and disabled. +

    Exclusively Accessed Shares

    +Opportunistic locking is most effective when it is confined to shares +that are exclusively accessed by a single user, or by only one user at +a time. Because the true value of opportunistic locking is the local +client caching of data, any operation that interrupts the caching +mechanism will cause a delay. +

    +Home directories are the most obvious examples of where the performance +benefit of opportunistic locking can be safely realized. +

    Multiple-Accessed Shares or Files

    +As each additional user accesses a file in a share with opportunistic +locking enabled, the potential for delays and resulting perceived poor +performance increases. When multiple users are accessing a file on a +share that has oplocks enabled, the management impact of sending and +receiving oplock breaks, and the resulting latency while other clients +wait for the caching client to flush data, offset the performance gains +of the caching user. +

    +As each additional client attempts to access a file with oplocks set, +the potential performance improvement is negated and eventually results +in a performance bottleneck. +

    Unix or NFS Client Accessed Files

    +Local Unix and NFS clients access files without a mandatory +file locking mechanism. Thus, these client platforms are incapable of +initiating an oplock break request from the server to a Windows client +that has a file cached. Local Unix or NFS file access can therefore +write to a file that has been cached by a Windows client, which +exposes the file to likely data corruption. +

    +If files are shared between Windows clients, and either local Unix +or NFS users, then turn opportunistic locking off. +

    Slow and/or Unreliable Networks

    +The biggest potential performance improvement for opportunistic locking +occurs when the client-side caching of reads and writes delivers the +most differential over sending those reads and writes over the wire. +This is most likely to occur when the network is extremely slow, +congested, or distributed (as in a WAN). However, network latency also +has a very high impact on the reliability of the oplock break +mechanism, and thus increases the likelihood of encountering oplock +problems that more than offset the potential perceived performance +gain. Of course, if an oplock break never has to be sent, then this is +the most advantageous scenario to utilize opportunistic locking. +

    +If the network is slow, unreliable, or a WAN, then do not configure +opportunistic locking if there is any chance of multiple users +regularly opening the same file. +

    Multi-User Databases

    +Multi-user databases clearly pose a risk due to their very nature - +they are typically heavily accessed by numerous users at random +intervals. Placing a multi-user database on a share with opportunistic +locking enabled will likely result in a locking management bottleneck +on the Samba server. Whether the database application is developed +in-house or a commercially available product, ensure that the share +has opportunistic locking disabled. +

    PDM Data Shares

    +Process Data Management (PDM) applications such as IMAN, Enovia, and +Clearcase, are increasing in usage with Windows client platforms, and +therefore SMB data stores. PDM applications manage multi-user +environments for critical data security and access. The typical PDM +environment is usually associated with sophisticated client design +applications that will load data locally as demanded. In addition, the +PDM application will usually monitor the data-state of each client. +In this case, client-side data caching is best left to the local +application and PDM server to negotiate and maintain. It is +appropriate to eliminate the client OS from any caching tasks, and the +server from any oplock management, by disabling opportunistic locking on +the share. +

    Beware of Force User

    +Samba includes an smb.conf parameter called force user that changes +the user accessing a share from the incoming user to whatever user is +defined by the smb.conf variable. If opportunistic locking is enabled +on a share, the change in user access causes an oplock break to be sent +to the client, even if the user has not explicitly loaded a file. In +cases where the network is slow or unreliable, an oplock break can +become lost without the user even accessing a file. This can cause +apparent performance degradation as the client continually reconnects +to overcome the lost oplock break. +

    +Avoid the combination of the following: +

    • + force user in the smb.conf share configuration. +

    • + Slow or unreliable networks +

    • + Opportunistic Locking Enabled +

    Advanced Samba Opportunistic Locking Parameters

    +Samba provides opportunistic locking parameters that allow the +administrator to adjust various properties of the oplock mechanism to +account for timing and usage levels. These parameters provide good +versatility for implementing oplocks in environments where they would +likely cause problems. The parameters are: +oplock break wait time, +oplock contention limit. +

    +For most users, administrators, and environments, if these parameters +are required, then the better option is to simply turn oplocks off. +The samba SWAT help text for both parameters reads "DO NOT CHANGE THIS +PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." +This is good advice. +

    Mission Critical High Availability

    +In mission critical high availability environments, data integrity is +often a priority. Complex and expensive configurations are implemented +to ensure that if a client loses connectivity with a file server, a +failover replacement will be available immediately to provide +continuous data availability. +

    +Windows client failover behavior is more at risk of application +interruption than other platforms because it is dependant upon an +established TCP transport connection. If the connection is interrupted +- as in a file server failover - a new session must be established. +It is rare for Windows client applications to be coded to recover +correctly from a transport connection loss, therefore most applications +will experience some sort of interruption - at worst, abort and +require restarting. +

    +If a client session has been caching writes and reads locally due to +opportunistic locking, it is likely that the data will be lost when the +application restarts, or recovers from the TCP interrupt. When the TCP +connection drops, the client state is lost. When the file server +recovers, an oplock break is not sent to the client. In this case, the +work from the prior session is lost. Observing this scenario with +oplocks disabled, and the client was writing data to the file server +real-time, then the failover will provide the data on disk as it +existed at the time of the disconnect. +

    +In mission critical high availability environments, careful attention +should be given to opportunistic locking. Ideally, comprehensive +testing should be done with all affected applications with oplocks +enabled and disabled. +

    Samba Opportunistic Locking Control

    +Opportunistic Locking is a unique Windows file locking feature. It is +not really file locking, but is included in most discussions of Windows +file locking, so is considered a defacto locking feature. +Opportunistic Locking is actually part of the Windows client file +caching mechanism. It is not a particularly robust or reliable feature +when implemented on the variety of customized networks that exist in +enterprise computing. +

    +Like Windows, Samba implements Opportunistic Locking as a server-side +component of the client caching mechanism. Because of the lightweight +nature of the Windows feature design, effective configuration of +Opportunistic Locking requires a good understanding of its limitations, +and then applying that understanding when configuring data access for +each particular customized network and client usage state. +

    +Opportunistic locking essentially means that the client is allowed to download and cache +a file on their hard drive while making changes; if a second client wants to access the +file, the first client receives a break and must synchronise the file back to the server. +This can give significant performance gains in some cases; some programs insist on +synchronising the contents of the entire file back to the server for a single change. +

    +Level1 Oplocks (aka just plain "oplocks") is another term for opportunistic locking. +

    +Level2 Oplocks provides opportunistic locking for a file that will be treated as +read only. Typically this is used on files that are read-only or +on files that the client has no initial intention to write to at time of opening the file. +

    +Kernel Oplocks are essentially a method that allows the Linux kernel to co-exist with +Samba's oplocked files, although this has provided better integration of MS Windows network +file locking with the under lying OS, SGI IRIX and Linux are the only two OS's that are +oplock aware at this time. +

    +Unless your system supports kernel oplocks, you should disable oplocks if you are +accessing the same files from both Unix/Linux and SMB clients. Regardless, oplocks should +always be disabled if you are sharing a database file (e.g., Microsoft Access) between +multiple clients, as any break the first client receives will affect synchronisation of +the entire file (not just the single record), which will result in a noticeable performance +impairment and, more likely, problems accessing the database in the first place. Notably, +Microsoft Outlook's personal folders (*.pst) react very badly to oplocks. If in doubt, +disable oplocks and tune your system from that point. +

    +If client-side caching is desirable and reliable on your network, you will benefit from +turning on oplocks. If your network is slow and/or unreliable, or you are sharing your +files among other file sharing mechanisms (e.g., NFS) or across a WAN, or multiple people +will be accessing the same files frequently, you probably will not benefit from the overhead +of your client sending oplock breaks and will instead want to disable oplocks for the share. +

    +Another factor to consider is the perceived performance of file access. If oplocks provide no +measurable speed benefit on your network, it might not be worth the hassle of dealing with them. +

    Example Configuration

    +In the following we examine two distinct aspects of Samba locking controls. +

    Disabling Oplocks

    +You can disable oplocks on a per-share basis with the following: +

    +

    +[acctdata]
+	oplocks = False
+	level2 oplocks = False
+

    +

    +The default oplock type is Level1. Level2 Oplocks are enabled on a per-share basis +in the smb.conf file. +

    +Alternately, you could disable oplocks on a per-file basis within the share: +

    +

    +	veto oplock files = /*.mdb/*.MDB/*.dbf/*.DBF/
+

    +

    +If you are experiencing problems with oplocks as apparent from Samba's log entries, +you may want to play it safe and disable oplocks and level2 oplocks. +

    Disabling Kernel OpLocks

    +Kernel OpLocks is an smb.conf parameter that notifies Samba (if +the UNIX kernel has the capability to send a Windows client an oplock +break) when a UNIX process is attempting to open the file that is +cached. This parameter addresses sharing files between UNIX and +Windows with Oplocks enabled on the Samba server: the UNIX process +can open the file that is Oplocked (cached) by the Windows client and +the smbd process will not send an oplock break, which exposes the file +to the risk of data corruption. If the UNIX kernel has the ability to +send an oplock break, then the kernel oplocks parameter enables Samba +to send the oplock break. Kernel oplocks are enabled on a per-server +basis in the smb.conf file. +

    +

    +[global]
+kernel oplocks = yes
+

    +The default is "no". +

    +Veto OpLocks is an smb.conf parameter that identifies specific files for +which Oplocks are disabled. When a Windows client opens a file that +has been configured for veto oplocks, the client will not be granted +the oplock, and all operations will be executed on the original file on +disk instead of a client-cached file copy. By explicitly identifying +files that are shared with UNIX processes, and disabling oplocks for +those files, the server-wide Oplock configuration can be enabled to +allow Windows clients to utilize the performance benefit of file +caching without the risk of data corruption. Veto Oplocks can be +enabled on a per-share basis, or globally for the entire server, in the +smb.conf file: +

    +

    <title>Example Veto OpLock Settings</title>
+[global]
+        veto oplock files = /filename.htm/*.txt/
+
+[share_name]
+        veto oplock files = /*.exe/filename.ext/
+

    +

    +Oplock break wait time is an smb.conf parameter that adjusts the time +interval for Samba to reply to an oplock break request. Samba +recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND +UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Wait Time can only be +configured globally in the smb.conf file: +

    +

    +[global]
+          oplock break wait time =  0 (default)
+

    +

    +Oplock break contention limit is an smb.conf parameter that limits the +response of the Samba server to grant an oplock if the configured +number of contending clients reaches the limit specified by the +parameter. Samba recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU +HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break +Contention Limit can be enable on a per-share basis, or globally for +the entire server, in the smb.conf file: +

    +

    +[global]
+          oplock break contention limit =  2 (default)
+
+[share_name]
+         oplock break contention limit =  2 (default)
+

    +

    MS Windows Opportunistic Locking and Caching Controls

    +There is a known issue when running applications (like Norton Anti-Virus) on a Windows 2000/ XP +workstation computer that can affect any application attempting to access shared database files +across a network. This is a result of a default setting configured in the Windows 2000/XP +operating system known as Opportunistic Locking. When a workstation +attempts to access shared data files located on another Windows 2000/XP computer, +the Windows 2000/XP operating system will attempt to increase performance by locking the +files and caching information locally. When this occurs, the application is unable to +properly function, which results in an Access Denied + error message being displayed during network operations. +

    +All Windows operating systems in the NT family that act as database servers for data files +(meaning that data files are stored there and accessed by other Windows PCs) may need to +have opportunistic locking disabled in order to minimize the risk of data file corruption. +This includes Windows 9x/Me, Windows NT, Windows 200x and Windows XP. +

    +If you are using a Windows NT family workstation in place of a server, you must also +disable opportunistic locking (oplocks) on that workstation. For example, if you use a +PC with the Windows NT Workstation operating system instead of Windows NT Server, and you +have data files located on it that are accessed from other Windows PCs, you may need to +disable oplocks on that system. +

    +The major difference is the location in the Windows registry where the values for disabling +oplocks are entered. Instead of the LanManServer location, the LanManWorkstation location +may be used. +

    +You can verify (or change or add, if necessary) this Registry value using the Windows +Registry Editor. When you change this registry value, you will have to reboot the PC +to ensure that the new setting goes into effect. +

    +The location of the client registry entry for opportunistic locking has changed in +Windows 2000 from the earlier location in Microsoft Windows NT. +

    Note

    +Windows 2000 will still respect the EnableOplocks registry value used to disable oplocks +in earlier versions of Windows. +

    +You can also deny the granting of opportunistic locks by changing the following registry entries: +

    +

    +	HKEY_LOCAL_MACHINE\System\
+		CurrentControlSet\Services\MRXSmb\Parameters\
+
+		OplocksDisabled REG_DWORD 0 or 1
+		Default: 0 (not disabled)
+

    +

    Note

    +The OplocksDisabled registry value configures Windows clients to either request or not +request opportunistic locks on a remote file. To disable oplocks, the value of + OplocksDisabled must be set to 1. +

    +

    +	HKEY_LOCAL_MACHINE\System\
+		CurrentControlSet\Services\LanmanServer\Parameters
+
+		EnableOplocks REG_DWORD 0 or 1
+		Default: 1 (Enabled by Default)
+
+		EnableOpLockForceClose REG_DWORD 0 or 1
+		Default: 0 (Disabled by Default)
+

    +

    Note

    +The EnableOplocks value configures Windows-based servers (including Workstations sharing +files) to allow or deny opportunistic locks on local files. +

    +To force closure of open oplocks on close or program exit EnableOpLockForceClose must be set to 1. +

    +An illustration of how level II oplocks work: +

    • + Station 1 opens the file, requesting oplock. +

    • + Since no other station has the file open, the server grants station 1 exclusive oplock. +

    • + Station 2 opens the file, requesting oplock. +

    • + Since station 1 has not yet written to the file, the server asks station 1 to Break + to Level II Oplock. +

    • + Station 1 complies by flushing locally buffered lock information to the server. +

    • + Station 1 informs the server that it has Broken to Level II Oplock (alternatively, + station 1 could have closed the file). +

    • + The server responds to station 2's open request, granting it level II oplock. + Other stations can likewise open the file and obtain level II oplock. +

    • + Station 2 (or any station that has the file open) sends a write request SMB. + The server returns the write response. +

    • + The server asks all stations that have the file open to Break to None, meaning no + station holds any oplock on the file. Because the workstations can have no cached + writes or locks at this point, they need not respond to the break-to-none advisory; + all they need do is invalidate locally cashed read-ahead data. +

    Workstation Service Entries

    +	\HKEY_LOCAL_MACHINE\System\
+		CurrentControlSet\Services\LanmanWorkstation\Parameters
+
+	UseOpportunisticLocking   REG_DWORD   0 or 1
+	Default: 1 (true)
+

    +Indicates whether the redirector should use opportunistic-locking (oplock) performance +enhancement. This parameter should be disabled only to isolate problems. +

    Server Service Entries

    +	\HKEY_LOCAL_MACHINE\System\
+		CurrentControlSet\Services\LanmanServer\Parameters
+
+	EnableOplocks   REG_DWORD   0 or 1
+	Default: 1 (true)
+

    +Specifies whether the server allows clients to use oplocks on files. Oplocks are a +significant performance enhancement, but have the potential to cause lost cached +data on some networks, particularly wide-area networks. +

    +	MinLinkThroughput   REG_DWORD   0 to infinite bytes per second
+	Default: 0
+

    +Specifies the minimum link throughput allowed by the server before it disables +raw and opportunistic locks for this connection. +

    +	MaxLinkDelay   REG_DWORD   0 to 100,000 seconds
+	Default: 60
+

    +Specifies the maximum time allowed for a link delay. If delays exceed this number, +the server disables raw I/O and opportunistic locking for this connection. +

    +	OplockBreakWait   REG_DWORD   10 to 180 seconds
+	Default: 35
+

    +Specifies the time that the server waits for a client to respond to an oplock break +request. Smaller values can allow detection of crashed clients more quickly but can +potentially cause loss of cached data. +

    Persistent Data Corruption

    +If you have applied all of the settings discussed in this paper but data corruption problems +and other symptoms persist, here are some additional things to check out: +

    +We have credible reports from developers that faulty network hardware, such as a single +faulty network card, can cause symptoms similar to read caching and data corruption. +If you see persistent data corruption even after repeated reindexing, you may have to +rebuild the data files in question. This involves creating a new data file with the +same definition as the file to be rebuilt and transferring the data from the old file +to the new one. There are several known methods for doing this that can be found in +our Knowledge Base. +

    Common Errors

    +In some sites locking problems surface as soon as a server is installed, in other sites +locking problems may not surface for a long time. Almost without exception, when a locking +problem does surface it will cause embarrassment and potential data corruption. +

    +Over the past few years there have been a number of complaints on the samba mailing lists +that have claimed that samba caused data corruption. Three causes have been identified +so far: +

    • + Incorrect configuration of opportunistic locking (incompatible with the application + being used. This is a VERY common problem even where MS Windows NT4 or MS Windows 200x + based servers were in use. It is imperative that the software application vendors' + instructions for configuration of file locking should be followed. If in doubt, + disable oplocks on both the server and the client. Disabling of all forms of file + caching on the MS Windows client may be necessary also. +

    • + Defective network cards, cables, or HUBs / Switched. This is generally a more + prevalent factor with low cost networking hardware, though occasionally there + have been problems with incompatibilities in more up market hardware also. +

    • + There have been some random reports of samba log files being written over data + files. This has been reported by very few sites (about 5 in the past 3 years) + and all attempts to reproduce the problem have failed. The Samba-Team has been + unable to catch this happening and thus has NOT been able to isolate any particular + cause. Considering the millions of systems that use samba, for the sites that have + been affected by this as well as for the Samba-Team this is a frustrating and + a vexing challenge. If you see this type of thing happening please create a bug + report on https://bugzilla.samba.org without delay. Make sure that you give as much + information as you possibly can to help isolate the cause and to allow reproduction + of the problem (an essential step in problem isolation and correction). +

    locking.tdb error messages

    + 

    +	> We are seeing lots of errors in the samba logs like:
+	>
+	>    tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic
+	> 0x4d6f4b61 at offset=36116
+	>
+	> What do these mean?
+

    +

    + Corrupted tdb. Stop all instances of smbd, delete locking.tdb, restart smbd. +

    Additional Reading

    +You may want to check for an updated version of this white paper on our Web site from +time to time. Many of our white papers are updated as information changes. For those papers, +the Last Edited date is always at the top of the paper. +

    +Section of the Microsoft MSDN Library on opportunistic locking: +

    +Opportunistic Locks, Microsoft Developer Network (MSDN), Windows Development > +Windows Base Services > Files and I/O > SDK Documentation > File Storage > File Systems +> About File Systems > Opportunistic Locks, Microsoft Corporation. +http://msdn.microsoft.com/library/en-us/fileio/storage_5yk3.asp +

    +Microsoft Knowledge Base Article Q224992 "Maintaining Transactional Integrity with OPLOCKS", +Microsoft Corporation, April 1999, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q224992. +

    +Microsoft Knowledge Base Article Q296264 "Configuring Opportunistic Locking in Windows 2000", +Microsoft Corporation, April 2001, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296264. +

    +Microsoft Knowledge Base Article Q129202 "PC Ext: Explanation of Opportunistic Locking on Windows NT", + Microsoft Corporation, April 1995, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202. +

    Prev Up Next
    Chapter 13. File, Directory and Share Access Controls Home Chapter 15. Securing Samba
    diff --git a/docs/htmldocs/migration.html b/docs/htmldocs/migration.html new file mode 100644 index 0000000000..b8027a62ea --- /dev/null +++ b/docs/htmldocs/migration.html @@ -0,0 +1 @@ +Part IV. Migration and Updating
    Part IV. Migration and Updating
    Prev   Next

    Migration and Updating

    Table of Contents

    30. Upgrading from Samba-2.x to Samba-3.0.0
    Charsets
    Obsolete configuration options
    Password Backend
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    Prev Up Next
    Chapter 29. High Availability Options Home Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    diff --git a/docs/htmldocs/tdbbackup.8.html b/docs/htmldocs/tdbbackup.8.html new file mode 100644 index 0000000000..d91b41cf77 --- /dev/null +++ b/docs/htmldocs/tdbbackup.8.html @@ -0,0 +1,35 @@ +tdbbackup

    Name

    tdbbackup — tool for backing up and for validating the integrity of samba .tdb files

    Synopsis

    tdbbackup [-s suffix] [-v] [-h]

    DESCRIPTION

    This tool is part of the Samba(1) suite.

    tdbbackup is a tool that may be used to backup samba .tdb + files. This tool may also be used to verify the integrity of the .tdb files prior + to samba startup, in which case, if it find file damage and it finds a prior backup + it will restore the backup file. +

    OPTIONS

    -h

    + Get help information. +

    -s suffix

    + The -s option allows the adminisistrator to specify a file + backup extension. This way it is possible to keep a history of tdb backup + files by using a new suffix for each backup. +

    -v

    + The -v will check the database for damages (currupt data) + which if detected causes the backup to be restored. +

    COMMANDS

    GENERAL INFORMATION

    + The tdbbackup utility should be run as soon as samba has shut down. + Do NOT run this command on a live database. Typical usage for the command will be: +

    tdbbackup [-s suffix] *.tdb

    + Before restarting samba the following command may be run to validate .tdb files: +

    tdbbackup -v [-s suffix] *.tdb

    + Samba .tdb files are stored in various locations, be sure to run backup all + .tdb file on the system. Imporatant files includes: +

    • + secrets.tdb - usual location is in the /usr/local/samba/private + directory, or on some systems in /etc/samba. +

    • + passdb.tdb - usual location is in the /usr/local/samba/private + directory, or on some systems in /etc/samba. +

    • + *.tdb located in the /usr/local/samba/var directory or on some + systems in the /var/cache or /var/lib/samba directories. +

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    AUTHOR

    + The original Samba software and related utilities were created by Andrew Tridgell. + Samba is now developed by the Samba Team as an Open Source project similar to the way + the Linux kernel is developed. +

    The tdbbackup man page was written by John H Terpstra.

    diff --git a/docs/htmldocs/troubleshooting.html b/docs/htmldocs/troubleshooting.html new file mode 100644 index 0000000000..582beeb6b0 --- /dev/null +++ b/docs/htmldocs/troubleshooting.html @@ -0,0 +1 @@ +Part V. Troubleshooting
    Part V. Troubleshooting
    Prev   Next

    Troubleshooting

    Table of Contents

    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    Still having troubles?
    34. Analysing and solving samba problems
    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches
    Prev Up Next
    Chapter 32. SWAT - The Samba Web Administration Tool Home Chapter 33. The Samba checklist
    diff --git a/docs/htmldocs/upgrading-to-3.0.html b/docs/htmldocs/upgrading-to-3.0.html new file mode 100644 index 0000000000..ac559fa129 --- /dev/null +++ b/docs/htmldocs/upgrading-to-3.0.html @@ -0,0 +1,19 @@ +Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    Prev Part IV. Migration and Updating Next

    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0

    Jelmer R. Vernooij

    The Samba Team

    25 October 2002

    Table of Contents

    Charsets
    Obsolete configuration options
    Password Backend

    Charsets

    You might experience problems with special characters +when communicating with old DOS clients. Codepage +support has changed in samba 3.0. Read the chapter +Unicode support for details. +

    Obsolete configuration options

    +In 3.0, the following configuration options have been removed. +

    printer driver (replaced by new driver procedures)
    printer driver file (replaced by new driver procedures)
    printer driver location (replaced by new driver procedures)
    use rhosts
    postscript
    client code page (replaced by dos charset)
    vfs path
    vfs options

    Password Backend

    +Effective with the release of samba-3 it is now imperative that the password backend +be correctly defined in smb.conf. +

    +Those migrating from samba-2.x with plaintext password support need the following: +passdb backend = guest. +

    +Those migrating from samba-2.x with encrypted password support should add to smb.conf +passdb backend = smbpasswd, guest. +

    +LDAP using Samba-2.x systems can continue to operate with the following entry +passdb backend = ldapsam_compat, guest. +

    Prev Up Next
    Part IV. Migration and Updating Home Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    diff --git a/docs/manpages/Samba.7 b/docs/manpages/Samba.7 new file mode 100644 index 0000000000..bd0cfa3d48 --- /dev/null +++ b/docs/manpages/Samba.7 @@ -0,0 +1,221 @@ +.\"Generated by db2man.xsl. Don't modify this, modify the source. +.de Sh \" Subsection +.br +.if t .Sp +.ne 5 +.PP +\fB\\$1\fR +.PP +.. +.de Sp \" Vertical space (when we can't use .PP) +.if t .sp .5v +.if n .sp +.. +.de Ip \" List item +.br +.ie \\n(.$>=3 .ne \\$3 +.el .ne 3 +.IP "\\$1" \\$2 +.. +.TH "SAMBA" 7 "" "" "" +.SH NAME +Samba \- A Windows SMB/CIFS fileserver for UNIX +.SH "SYNOPSIS" + +.nf +\fBSamba\fR +.fi + +.SH "DESCRIPTION" + +.PP +The Samba software suite is a collection of programs that implements the Server Message Block (commonly abbreviated as SMB) protocol for UNIX systems\&. This protocol is sometimes also referred to as the Common Internet File System (CIFS)\&. For a more thorough description, see http://www\&.ubiqx\&.org/cifs/\&. Samba also implements the NetBIOS protocol in nmbd\&. + +.TP +\fBsmbd\fR(8) +The \fBsmbd\fR daemon provides the file and print services to SMB clients, such as Windows 95/98, Windows NT, Windows for Workgroups or LanManager\&. The configuration file for this daemon is described in \fBsmb.conf\fR(5) + + +.TP +\fBnmbd\fR(8) +The \fBnmbd\fR daemon provides NetBIOS nameservice and browsing support\&. The configuration file for this daemon is described in \fBsmb.conf\fR(5) + + +.TP +\fBsmbclient\fR(1) +The \fBsmbclient\fR program implements a simple ftp-like client\&. This is useful for accessing SMB shares on other compatible servers (such as Windows NT), and can also be used to allow a UNIX box to print to a printer attached to any SMB server (such as a PC running Windows NT)\&. + + +.TP +\fBtestparm\fR(1) +The \fBtestparm\fR utility is a simple syntax checker for Samba's \fBsmb.conf\fR(5) configuration file\&. + + +.TP +\fBtestprns\fR(1) +The \fBtestprns\fR utility supports testing printer names defined in your \fIprintcap\fR file used by Samba\&. + + +.TP +\fBsmbstatus\fR(1) +The \fBsmbstatus\fR tool provides access to information about the current connections to \fBsmbd\fR\&. + + +.TP +\fBnmblookup\fR(1) +The \fBnmblookup\fR tools allows NetBIOS name queries to be made from a UNIX host\&. + + +.TP +\fBsmbgroupedit\fR(8) +The \fBsmbgroupedit\fR tool allows for mapping unix groups to NT Builtin, Domain, or Local groups\&. Also it allows setting priviledges for that group, such as saAddUser, etc\&. + + +.TP +\fBsmbpasswd\fR(8) +The \fBsmbpasswd\fR command is a tool for changing LanMan and Windows NT password hashes on Samba and Windows NT servers\&. + + +.TP +\fBsmbcacls\fR(1) +The \fBsmbcacls\fR command is a tool to set ACL's on remote CIFS servers\&. + + +.TP +\fBsmbsh\fR(1) +The \fBsmbsh\fR command is a program that allows you to run a unix shell with with an overloaded VFS\&. + + +.TP +\fBsmbtree\fR(1) +The \fBsmbtree\fR command is a text-based network neighborhood tool\&. + + +.TP +\fBsmbtar\fR(1) +The \fBsmbtar\fR can make backups of data on CIFS/SMB servers\&. + + +.TP +\fBsmbspool\fR(8) +\fBsmbspool\fR is a helper utility for printing on printers connected to CIFS servers\&. + + +.TP +\fBsmbcontrol\fR(1) +\fBsmbcontrol\fR is a utility that can change the behaviour of running samba daemons\&. + + +.TP +\fBrpcclient\fR(1) +\fBrpcclient\fR is a utility that can be used to execute RPC commands on remote CIFS servers\&. + + +.TP +\fBpdbedit\fR(8) +The \fBpdbedit\fR command can be used to maintain the local user database on a samba server\&. + + +.TP +\fBfindsmb\fR(1) +The \fBfindsmb\fR command can be used to find SMB servers on the local network\&. + + +.TP +\fBnet\fR(8) +The \fBnet\fR command is supposed to work similar to the DOS/Windows NET\&.EXE command\&. + + +.TP +\fBswat\fR(8) +\fBswat\fR is a web-based interface to configuring \fIsmb\&.conf\fR\&. + + +.TP +\fBwinbindd\fR(8) +\fBwinbindd\fR is a daemon that is used for integrating authentication and the user database into unix\&. + + +.TP +\fBwbinfo\fR(1) +\fBwbinfo\fR is a utility that retrieves and stores information related to winbind\&. + + +.TP +\fBeditreg\fR(1) +\fBeditreg\fR is a command-line utility that can edit windows registry files\&. + + +.TP +\fBprofiles\fR(1) +\fBprofiles\fR is a command-line utility that can be used to replace all occurences of a certain SID with another SID\&. + + +.TP +\fBvfstest\fR(1) +\fBvfstest\fR is a utility that can be used to test vfs modules\&. + + +.TP +\fBntlm_auth\fR(1) +\fBntlm_auth\fR is a helper-utility for external programs wanting to do NTLM-authentication\&. + + +.TP +\fBsmbmount\fR(8), \fBsmbumount\fR(8), \fBsmbmount\fR(8) +\fBsmbmount\fR,\fBsmbmnt\fR and \fBsmbmnt\fR are commands that can be used to mount CIFS/SMB shares on Linux\&. + + +.TP +\fBsmbcquotas\fR(1) +\fBsmbcquotas\fR is a tool that can set remote QUOTA's on server with NTFS 5\&. + + +.SH "COMPONENTS" + +.PP +The Samba suite is made up of several components\&. Each component is described in a separate manual page\&. It is strongly recommended that you read the documentation that comes with Samba and the manual pages of those components that you use\&. If the manual pages and documents aren't clear enough then please visithttp://devel\&.samba\&.org for information on how to file a bug report or submit a patch\&. + +.PP +If you require help, visit the Samba webpage athttp://www\&.samba\&.org/ and explore the many option available to you\&. + +.SH "AVAILABILITY" + +.PP +The Samba software suite is licensed under the GNU Public License(GPL)\&. A copy of that license should have come with the package in the file COPYING\&. You are encouraged to distribute copies of the Samba suite, but please obey the terms of this license\&. + +.PP +The latest version of the Samba suite can be obtained via anonymous ftp from samba\&.org in the directory pub/samba/\&. It is also available on several mirror sites worldwide\&. + +.PP +You may also find useful information about Samba on the newsgroup comp\&.protocol\&.smb and the Samba mailing list\&. Details on how to join the mailing list are given in the README file that comes with Samba\&. + +.PP +If you have access to a WWW viewer (such as Mozilla or Konqueror) then you will also find lots of useful information, including back issues of the Samba mailing list, athttp://lists\&.samba\&.org\&. + +.SH "VERSION" + +.PP +This man page is correct for version 3\&.0 of the Samba suite\&. + +.SH "CONTRIBUTIONS" + +.PP +If you wish to contribute to the Samba project, then I suggest you join the Samba mailing list athttp://lists\&.samba\&.org\&. + +.PP +If you have patches to submit, visithttp://devel\&.samba\&.org/ for information on how to do it properly\&. We prefer patches in \fBdiff -u\fR format\&. + +.SH "CONTRIBUTORS" + +.PP +Contributors to the project are now too numerous to mention here but all deserve the thanks of all Samba users\&. To see a full list, look at the\fIchange-log\fR in the source package for the pre-CVS changes and at http://cvs\&.samba\&.org/ for the contributors to Samba post-CVS\&. CVS is the Open Source source code control system used by the Samba Team to develop Samba\&. The project would have been unmanageable without it\&. + +.SH "AUTHOR" + +.PP +The original Samba software and related utilities were created by Andrew Tridgell\&. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed\&. + +.PP +The original Samba man pages were written by Karl Auer\&. The man page sources were converted to YODL format (another excellent piece of Open Source software, available at ftp://ftp\&.icce\&.rug\&.nl/pub/unix/) and updated for the Samba 2\&.0 release by Jeremy Allison\&. The conversion to DocBook for Samba 2\&.2 was done by Gerald Carter\&. The conversion to DocBook XML 4\&.2 for Samba 3\&.0 was done by Alexander Bokovoy\&. + diff --git a/docs/manpages/tdbbackup.8 b/docs/manpages/tdbbackup.8 new file mode 100644 index 0000000000..42be45c6a9 --- /dev/null +++ b/docs/manpages/tdbbackup.8 @@ -0,0 +1,100 @@ +.\"Generated by db2man.xsl. Don't modify this, modify the source. +.de Sh \" Subsection +.br +.if t .Sp +.ne 5 +.PP +\fB\\$1\fR +.PP +.. +.de Sp \" Vertical space (when we can't use .PP) +.if t .sp .5v +.if n .sp +.. +.de Ip \" List item +.br +.ie \\n(.$>=3 .ne \\$3 +.el .ne 3 +.IP "\\$1" \\$2 +.. +.TH "TDBBACKUP" 8 "" "" "" +.SH NAME +tdbbackup \- tool for backing up and for validating the integrity of samba .tdb files +.SH "SYNOPSIS" + +.nf +\fBtdbbackup\fR [-s suffix] [-v] [-h] +.fi + +.SH "DESCRIPTION" + +.PP +This tool is part of the \fBSamba\fR(1) suite\&. + +.PP +\fBtdbbackup\fR is a tool that may be used to backup samba \&.tdb files\&. This tool may also be used to verify the integrity of the \&.tdb files prior to samba startup, in which case, if it find file damage and it finds a prior backup it will restore the backup file\&. + +.SH "OPTIONS" + +.TP +-h +Get help information\&. + + +.TP +-s suffix +The \fB-s\fR option allows the adminisistrator to specify a file backup extension\&. This way it is possible to keep a history of tdb backup files by using a new suffix for each backup\&. + + +.TP +-v +The \fB-v\fR will check the database for damages (currupt data) which if detected causes the backup to be restored\&. + + +.SH "COMMANDS" + +.PP +\fBGENERAL INFORMATION\fR + +.PP +The \fBtdbbackup\fR utility should be run as soon as samba has shut down\&. Do NOT run this command on a live database\&. Typical usage for the command will be: + +.PP +tdbbackup [-s suffix] *\&.tdb + +.PP +Before restarting samba the following command may be run to validate \&.tdb files: + +.PP +tdbbackup -v [-s suffix] *\&.tdb + +.PP +Samba \&.tdb files are stored in various locations, be sure to run backup all \&.tdb file on the system\&. Imporatant files includes: + +.TP 3 +\(bu +\fBsecrets.tdb\fR - usual location is in the /usr/local/samba/private directory, or on some systems in /etc/samba\&. + +.TP +\(bu +\fBpassdb.tdb\fR - usual location is in the /usr/local/samba/private directory, or on some systems in /etc/samba\&. + +.TP +\(bu +\fB*.tdb\fR located in the /usr/local/samba/var directory or on some systems in the /var/cache or /var/lib/samba directories\&. + +.LP + +.SH "VERSION" + +.PP +This man page is correct for version 3\&.0 of the Samba suite\&. + +.SH "AUTHOR" + +.PP +The original Samba software and related utilities were created by Andrew Tridgell\&. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed\&. + +.PP +The tdbbackup man page was written by John H Terpstra\&. + diff --git a/docs/textdocs/README.jis b/docs/textdocs/README.jis new file mode 100644 index 0000000000..50ff0cced7 --- /dev/null +++ b/docs/textdocs/README.jis @@ -0,0 +1,149 @@ +$B!|(B samba $BF|K\8lBP1~$K$D$$$F(B + +1. $BL\E*(B + + $BF|K\8lBP1~$O!"(B + + (1) MS-Windows $B>e$G!"4A;z%U%!%$%kL>$r$I$&$7$F$b07$&I,MW$N$"$k%"%W%j%1!<%7%g%s$,$A$c(B + $B$s$HF0:n$9$k!#Nc$($P!"(BMS-WORD 5 $B$J$I$O!"%$%s%9%H!<%k;~$K4A;z$N%U%!%$%kL>$r>!l9g$K$A$c$s$HBP1~$G$-$k$h$&$K$9$k!#(B + + (2) UNIX $B$O!":G6a$G$O$[$H$s$I$N$b$N$,(B 8 bits $B$N%U%!%$%kL>$r%5%]!<%H$7$F$$$^$9$,!"(B + $BCf$K$O!"$3$l$r%5%]!<%H$7$F$$$J$$$b$N$b$"$j$^$9!#$3$N$h$&$J>l9g$G$b!"(B(1)$B$NL\E*(B + $B$,K~B-$G$-$k$h$&$K$9$k!#(B + + $B$rL\E*$H$7$F$$$^$9!#$=$N$?$a!"F|K\8lBP1~$O!"I,MW:G>.8B$7$+9T$J$C$F$*$j$^$;$s!#(B + + $BF|K\8lBP1~$7$?(B samba $B$rMxMQ$9$k$?$a$K$O!"%3%s%Q%$%k$9$k;~$K!"I,$:!"(BKANJI $B$NDj5A$rDI(B + $B2C$7$F$/$@$5$$!#$3$N%*%W%7%g%s$r;XDj$7$F$$$J$$>l9g$O!"F|K\8l$N%U%!%$%kL>$r@5$7$/07(B + $B$&$3$H$O$G$-$^$;$s!#!J%3%s%Q%$%k$K$D$$$F$O!"2<5-(B 3. $B$r;2>H$7$F2<$5$$!K(B + +2. $BMxMQJ}K!(B + +(1) $BDI2C$7$?%Q%i%a!<%?(B + + smb.conf $B%U%!%$%k$N(B global $B%;%/%7%g%s$K0J2<$N%Q%i%a!<%?$r@_Dj$G$-$k$h$&$K$7$^$7$?!#(B + + [global] + .... + coding system = <$B%3!<%I7O(B> + + $B$3$3$G;XDj$5$l$?%3!<%I7O$,(B UNIX $B>e$N%U%!%$%k%7%9%F%`$N%U%!%$%kL>$N%3!<%I$K$J$j$^$9!#(B + $B@_Dj$G$-$k$b$N$O!"A0$O!"(B':83:49:83:74:83:42:83:58' $B$N$h$&$K!"(B':' $B$N8e$K#27e(B + $B$N(B16$B?J?t$rB3$1$k7A<0$K$J$j$^$9!#(B + $B$3$3$G!"(B':' $B$rB>$NJ8;z$KJQ99$7$?$$>l9g$O!"(Bhex $B$N8e$m$K$=$NJ8;z$r;XDj$7$^$9!#(B + $BNc$($P!"(B@$B$rJQ$o$j$K;H$$$?$$>l9g$O!"(B'hex@'$B$N$h$&$K;XDj$7$^$9!#(B + cap: 7 bits $B$N(B ASCII $B%3!<%I0J30$N%3!<%I$r0J2<$N7A<0$GI=$9J}<0$H$$$&E@$G$O(B + hex$B$HF1MM$G$9$,!"(BCAP (The Columbia AppleTalk Package)$B$H8_49@-$r;}$DJQ49(B + $BJ}<0$H$J$C$F$$$^$9!#(Bhex$B$H$N0c$$$O(B0x80$B0J>e$N%3!<%I$N$_(B':80'$B$N$h$&$KJQ49(B + $B$5$l!"$=$NB>$O(BASCII$B%3!<%I$G8=$5$l$^$9!#(B + $BNc$($P!"(B'$B%*%U%#%9(B'$B$H$$$&L>A0$O!"(B':83I:83t:83B:83X'$B$H$J$j$^$9!#(B + + JIS $B%3!<%I$K$D$$$F$O!"0J2<$NI=$r;2>H$7$F2<$5$$!#(B + $B(#(!(!(!(((!(!(!(!(((!(!(!(!(((!(!(!(!(((!(!(!(!(((!(!(!(!(((!(!(!(!(!(!(!(!(!($(B + $B(";XDj(B $B("4A;z3+;O("4A;z=*N;("%+%J3+;O("%+%J=*N;("1Q?t3+;O("Hw9M(B $B("(B + $B('(!(!(!(+(!(!(!(!(+(!(!(!(!(+(!(!(!(!(+(!(!(!(!(+(!(!(!(!(+(!(!(!(!(!(!(!(!(!()(B + $B("(Bjis7 $B("(B\E$B $B("(B\E(J $B("(B0x0e $B("(B0x0f $B("(B\E(J $B("(Bjis 7$BC10LId9f(B $B("(B + $B("(Bjunet $B("(B\E$B $B("(B\E(J $B("(B\E(I $B("(B\E(J $B("(B\E(J $B("(B7bits $B%3!<%I(B $B("(B + $B("(Bjis8 $B("(B\E$B $B("(B\E(J $B("(B-- $B("(B-- $B("(B\E(J $B("(Bjis 8$BC10LId9f(B $B("(B + $B("(Bj7bb $B("(B\E$B $B("(B\E(B $B("(B0x0e $B("(B0x0f $B("(B\E(B $B("(B $B("(B + $B("(Bj7bj $B("(B\E$B $B("(B\E(J $B("(B0x0e $B("(B0x0f $B("(B\E(J $B("(Bjis7$B$HF1$8(B $B("(B + $B("(Bj7bh $B("(B\E$B $B("(B\E(H $B("(B0x0e $B("(B0x0f $B("(B\E(H $B("(B $B("(B + $B("(Bj7@b $B("(B\E$@ $B("(B\E(B $B("(B0x0e $B("(B0x0f $B("(B\E(B $B("(B $B("(B + $B("(Bj7@j $B("(B\E$@ $B("(B\E(J $B("(B0x0e $B("(B0x0f $B("(B\E(J $B("(B $B("(B + $B("(Bj7@h $B("(B\E$@ $B("(B\E(H $B("(B0x0e $B("(B0x0f $B("(B\E(H $B("(B $B("(B + $B("(Bj8bb $B("(B\E$B $B("(B\E(B $B("(B-- $B("(B-- $B("(B\E(B $B("(B $B("(B + $B("(Bj8bj $B("(B\E$B $B("(B\E(J $B("(B-- $B("(B-- $B("(B\E(J $B("(Bjis8$B$HF1$8(B $B("(B + $B("(Bj8bh $B("(B\E$B $B("(B\E(H $B("(B-- $B("(B-- $B("(B\E(H $B("(B $B("(B + $B("(Bj8@b $B("(B\E@@ $B("(B\E(B $B("(B-- $B("(B-- $B("(B\E(B $B("(B $B("(B + $B("(Bj8@j $B("(B\E$@ $B("(B\E(J $B("(B-- $B("(B-- $B("(B\E(J $B("(B $B("(B + $B("(Bj8@h $B("(B\E$@ $B("(B\E(H $B("(B-- $B("(B-- $B("(B\E(H $B("(B $B("(B + $B("(Bjubb $B("(B\E$B $B("(B\E(B $B("(B\E(I $B("(B\E(B $B("(B\E(B $B("(B $B("(B + $B("(Bjubj $B("(B\E$B $B("(B\E(J $B("(B\E(I $B("(B\E(J $B("(B\E(J $B("(Bjunet$B$HF1$8(B $B("(B + $B("(Bjubh $B("(B\E$B $B("(B\E(H $B("(B\E(I $B("(B\E(H $B("(B\E(H $B("(B $B("(B + $B("(Bju@b $B("(B\E$@ $B("(B\E(B $B("(B\E(I $B("(B\E(B $B("(B\E(B $B("(B $B("(B + $B("(Bju@j $B("(B\E$@ $B("(B\E(J $B("(B\E(I $B("(B\E(J $B("(B\E(J $B("(B $B("(B + $B("(Bju@h $B("(B\E$@ $B("(B\E(H $B("(B\E(I $B("(B\E(H $B("(B\E(H $B("(B $B("(B + $B(&(!(!(!(*(!(!(!(!(*(!(!(!(!(*(!(!(!(!(*(!(!(!(!(*(!(!(!(!(*(!(!(!(!(!(!(!(!(!(%(B + + $B$$$:$l$N>l9g$b!"$9$G$KB8:_$7$F$$$kL>A0$KBP$7$F$O!"4A;z$N3+;O=*N;%7!<%1%s%9$O!"0J2<(B + $B$N$b$N$rG'<1$7$^$9!#(B + $B4A;z$N;O$^$j(B: \E$B $B$+(B \E$@ + $B4A;z$N=*$j(B: \E(J $B$+(B \E(B $B$+(B \E(H + +(2) smbclient $B$N%*%W%7%g%s(B + + $B%/%i%$%"%s%H%W%m%0%i%`$G$b!"4A;z$d2>L>$r4^$s$@%U%!%$%k$r07$($k$h$&$K!" + + $B$3$3$G!"(B<$B%?!<%_%J%k%3!<%I7O(B>$B$K;XDj$G$-$k$b$N$O!">e$N(B<$B%3!<%I7O(B>$B$HF1$8$b$N$G$9!#(B + +(3) $B%G%U%)%k%H(B + + $B%G%U%)%k%H$N%3!<%I7O$O!"%3%s%Q%$%k;~$K7h$^$j$^$9!#(B + +3. $B%3%s%Q%$%k;~$N@_Dj(B + + Makefile $B$K@_Dj$9$k9`L\$r0J2<$K<($7$^$9!#(B + +(1) KANJI $B%U%i%0(B + + $B%3%s%Q%$%k%*%W%7%g%s$K(B -DKANJI=\"$B%3!<%I7O(B\" $B$r;XDj$7$^$9!#$3$N%3!<%I7O$O(B 2. $B$G;X(B + $BDj$9$k$b$N$HF1$8$G$9!#Nc$($P!"(B-DKANJI=\"euc\" $B$r(BFLAGSM $B$K@_Dj$9$k$H(B UNIX $B>e$N%U%!(B + $B%$%kL>$O!"(BEUC $B%3!<%I$K$J$j$^$9!#$3$3$G;XDj$7$?%3!<%I7O$O!"%5!<%P5Z$S%/%i%$%"%s%H(B + $B%W%m%0%i%`$N%G%U%)%k%H$KCM$J$j$^$9!#(B + + $B>0!"%*%W%7%g%sCf$N(B \ $B$d(B " $B$bK:$l$:$K;XDj$7$F2<$5$$!#(B + +3. $B@)8B;v9`(B + +(1) $B4A;z%3!<%I(B + smbd $B$rF0:n$5$;$k%[%9%H$N(B UNIX $B$,%5%]!<%H$7$F$$$J$$4A;z%3!<%I$O!"MxMQ$G$-$J$$$3$H$,(B + $B$"$j$^$9!#JQ$JF0:n$r$9$k$h$&$J$i(B hex $B$N;XDj$r$9$k$N$,NI$$$G$7$g$&!#(B + +(2) smbclient $B%3%^%s%I(B + $B%7%U%H%3!<%I$J$I$N4X78$G!"4A;z$d2>L>$r4^$s$@%U%!%$%kL>$N(B ls $B$NI=<($,Mp$l$k$3$H$,$"$j(B + $B$^$9!#(B + +(3) $B%o%$%k%I%+!<%I$K$D$$$F(B + $B$A$c$s$H$7$?%9%Z%C%/$,$h$/$o$+$i$J$+$C$?$N$G$9$,!"0l1~!"(BDOS/V $B$NF0:n$HF1$8F0:n$r9T$J(B + $B$&$h$&$K$J$C$F$$$^$9!#(B + +(4) $B%m%s%0%U%!%$%kL>$K$D$$$F(B + Windows NT/95 $B$G$O!"%m%s%0%U%!%$%kL>$,07$($^$9!#%m%s%0%U%!%$%kL>$r(B 8.3 $B%U%)!<%^%C%H(B + $B$G07$&$?$a$K!"(Bmangling $B$7$F$$$^$9$,!"$3$NJ}K!$O!"(BNT $B$d(B 95 $B$,9T$J$C$F$$$k(B mangling $B$H(B + $B$O0[$J$j$^$9$N$GCm0U$7$F2<$5$$!#(B + +4. $B>c32Ey$N%l%]!<%H$K$D$$$F(B + + $BF|K\8l$N%U%!%$%kL>$K4X$7$F!"J8;z2=$1Ey$N>c32$,$"$l$P!";d$K%l%]!<%H$7$FD:$1$l$P9,$$$G(B +$B$9!#$?$@$7!"%*%j%8%J%k$+$i$NLdBjE@$d@\Ld$$9g$o$;$k(B +$B$+!"$b$7$/$O%a!<%j%s%0%j%9%H$J$I$X%l%]!<%H$9$k$h$&$K$7$F2<$5$$!#(B + +$B%l%]!<%H$5$l$k>l9g!"MxMQ$5$l$F$$$k4D6-(B(UNIX $B5Z$S(B PC $BB&$N(BOS$B$J$I(B)$B$H$G$-$^$7$?$i@_Dj%U%!(B +$B%$%k$d%m%0$J$I$rE:IU$7$FD:$1$k$H9,$$$G$9!#(B + +5. $B$=$NB>(B + + $B%3!<%IJQ49$O0J2<$NJ}!9$,:n$i$l$?%W%m%0%i%`$rMxMQ$7$F$$$^$9!#(B + + hex $B7A<0(B $BBgLZ!wBgDM!&C^GH(B $B;a(B + cap $B7A<0(B $BI%ED(B $BF;O:(B (michiro@po.iijnet.or.jp)(michiro@dms.toppan.co.jp)$B;a(B + + $B$=$NB>!"$?$/$5$s$NJ}!9$+$i$$$m$$$m$H8f65<($$$?$@$-$"$j$,$H$&$4$6$$$^$7$?!#:#8e$H$b$h(B +$B$m$7$/$*4j$$CW$7$^$9!#(B + +1994$BG/(B10$B7n(B28$BF|(B $BBh#1HG(B +1995$BG/(B 8$B7n(B16$BF|(B $BBh#2HG(B +1995$BG/(B11$B7n(B24$BF|(B $BBh#3HG(B +1996$BG/(B 5$B7n(B13$BF|(B $BBh#4HG(B + +$BF#ED(B $B?r(B fujita@ainix.isac.co.jp + diff --git a/examples/LDAP/export_smbpasswd.pl b/examples/LDAP/export_smbpasswd.pl new file mode 100644 index 0000000000..e4f120bf02 --- /dev/null +++ b/examples/LDAP/export_smbpasswd.pl @@ -0,0 +1,64 @@ +#!/usr/bin/perl +## +## Example script to export ldap entries into an smbpasswd file format +## using the Mozilla PerLDAP module. +## +## writen by jerry@samba.org +## +## ported to Net::LDAP by dkrovich@slackworks.com + +use Net::LDAP; + +###################################################### +## Set these values to whatever you need for your site +## + +$DN="dc=samba,dc=my-domain,dc=com"; +$ROOTDN="cn=Manager,dc=my-domain,dc=com"; +$rootpw = "secret"; +$LDAPSERVER="localhost"; + +## +## end local site variables +###################################################### + +$ldap = Net::LDAP->new($LDAPSERVER) or die "Unable to connect to LDAP server $LDAPSERVER"; + +print "##\n"; +print "## Autogenerated smbpasswd file via ldapsearch\n"; +print "## from $LDAPSERVER ($DN)\n"; +print "##\n"; + +## scheck for the existence of the posixAccount first +$result = $ldap->search ( base => "$DN", + scope => "sub", + filter => "(objectclass=sambaAccount)" + ); + + + +## loop over the entries we found +while ( $entry = $result->shift_entry() ) { + + @uid = $entry->get_value("uid"); + @uidNumber = $entry->get_value("uidNumber"); + @lm_pw = $entry->get_value("lmpassword"); + @nt_pw = $entry->get_value("ntpassword"); + @acct = $entry->get_value("acctFlags"); + @pwdLastSet = $entry->get_value("pwdLastSet"); + + if (($#uid+1) && ($#uidNumber+1)) { + + $lm_pw[0] = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" if (! ($#lm_pw+1)); + $nt_pw[0] = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" if (! ($#nt_pw+1)); + $acct[0] = "[DU ]" if (! ($#acct+1)); + $pwdLastSet[0] = "FFFFFFFF" if (! ($#pwdLastSet+1)); + + print "$uid[0]:$uidNumber[0]:$lm_pw[0]:$nt_pw[0]:$acct[0]:LCT-$pwdLastSet[0]\n"; + } + +} + +$ldap->unbind(); +exit 0; + diff --git a/examples/LDAP/import_smbpasswd.pl b/examples/LDAP/import_smbpasswd.pl new file mode 100644 index 0000000000..61ad33c809 --- /dev/null +++ b/examples/LDAP/import_smbpasswd.pl @@ -0,0 +1,119 @@ +#!/usr/bin/perl +## +## Example script of how you could import a smbpasswd file into an LDAP +## directory using the Mozilla PerLDAP module. +## +## writen by jerry@samba.org +## +## ported to Net::LDAP by dkrovich@slackworks.com + +use Net::LDAP; + +################################################# +## set these to a value appropriate for your site +## + +$DN="ou=people,dc=plainjoe,dc=org"; +$ROOTDN="cn=Manager,dc=plainjoe,dc=org"; +# If you use perl special character in your +# rootpw, escape them: +# $rootpw = "secr\@t" instead of $rootpw = "secr@t" +$rootpw = "n0pass"; +$LDAPSERVER="scooby"; + +## +## end local site variables +################################################# + +$ldap = Net::LDAP->new($LDAPSERVER) or die "Unable to connect to LDAP server $LDAPSERVER"; + +## Bind as $ROOTDN so you can do updates +$mesg = $ldap->bind($ROOTDN, password => $rootpw); +$mesg->error() if $mesg->code(); + +while ( $string = ) { + chomp ($string); + + ## Get the account info from the smbpasswd file + @smbentry = split (/:/, $string); + + ## Check for the existence of a system account + @getpwinfo = getpwnam($smbentry[0]); + if (! @getpwinfo ) { + print STDERR "**$smbentry[0] does not have a system account... \n"; + next; + } + ## Calculate RID = uid*2 +1000 + $rid=@getpwinfo[2]*2+1000; + + ## check and see if account info already exists in LDAP. + $result = $ldap->search ( base => "$DN", + scope => "sub", + filter => "(uid=$smbentry[0])" + ); + + ## If no LDAP entry exists, create one. + if ( $result->count == 0 ) { + $new_entry = Net::LDAP::Entry->new(); + $new_entry->add( dn => "uid=$smbentry[0],$DN", + uid => $smbentry[0], + rid => $rid, + lmPassword => $smbentry[2], + ntPassword => $smbentry[3], + acctFlags => $smbentry[4], + cn => $smbentry[0], + pwdLastSet => hex(substr($smbentry[5],4)), + objectclass => 'sambaAccount' ); + + $result = $ldap->add( $new_entry ); + $result->error() if $result->code(); + print "Adding [uid=" . $smbentry[0] . "," . $DN . "]\n"; + + ## Otherwise, supplement/update the existing entry. + } + elsif ($result->count == 1) + { + # Put the search results into an entry object + $entry = $result->entry(0); + + print "Updating [" . $entry->dn . "]\n"; + + ## Add the objectclass: sambaAccount attribute if it's not there + @values = $entry->get_value( "objectclass" ); + $flag = 1; + foreach $item (@values) { + print "$item\n"; + if ( "$item" eq "sambaAccount" ) { + $flag = 0; + } + } + if ( $flag ) { + ## Adding sambaAccount objectclass requires adding at least rid: + ## uid attribute already exists we know since we searched on it + $entry->add(objectclass => "sambaAccount", + rid => $rid ); + } + + ## Set the other attribute values + $entry->replace(rid => $rid, + lmPassword => $smbentry[2], + ntPassword => $smbentry[3], + acctFlags => $smbentry[4], + pwdLastSet => hex(substr($smbentry[5],4))); + + ## Apply changes to the LDAP server + $updatemesg = $entry->update($ldap); + $updatemesg->error() if $updatemesg->code(); + + ## If we get here, the LDAP search returned more than one value + ## which shouldn't happen under normal circumstances. + } else { + print STDERR "LDAP search returned more than one entry for $smbentry[0]... skipping!\n"; + next; + } +} + +$ldap->unbind(); +exit 0; + + diff --git a/examples/VFS/Makefile.in b/examples/VFS/Makefile.in new file mode 100644 index 0000000000..c368974bd5 --- /dev/null +++ b/examples/VFS/Makefile.in @@ -0,0 +1,43 @@ +CC = @CC@ +CFLAGS = @CFLAGS@ +CPPFLAGS = @CPPFLAGS@ +LDFLAGS = @LDFLAGS@ +LDSHFLAGS = @LDSHFLAGS@ +INSTALLCMD = @INSTALL@ +SAMBA_SOURCE = @SAMBA_SOURCE@ +SHLIBEXT = @SHLIBEXT@ +OBJEXT = @OBJEXT@ +FLAGS = $(CFLAGS) -Iinclude -I$(SAMBA_SOURCE)/include -I$(SAMBA_SOURCE)/ubiqx -I$(SAMBA_SOURCE)/smbwrapper -I. $(CPPFLAGS) -I$(SAMBA_SOURCE) + + +prefix = @prefix@ +libdir = @libdir@ + +VFS_LIBDIR = $(libdir)/vfs + +# Auto target +default: $(patsubst %.c,%.$(SHLIBEXT),$(wildcard *.c)) + +# Pattern rules + +%.$(SHLIBEXT): %.$(OBJEXT) + @echo "Linking $@" + @$(CC) $(LDSHFLAGS) $(LDFLAGS) -o $@ $< + +%.$(OBJEXT): %.c + @echo "Compiling $<" + @$(CC) $(FLAGS) -c $< + + +install: default + $(INSTALLCMD) -d $(VFS_LIBDIR) + $(INSTALLCMD) -m 755 *.$(SHLIBEXT) $(VFS_LIBDIR) + +# Misc targets +clean: + rm -rf .libs + rm -f core *~ *% *.bak *.o *.$(SHLIBEXT) + +distclean: clean + rm config.* Makefile + diff --git a/examples/VFS/autogen.sh b/examples/VFS/autogen.sh new file mode 100755 index 0000000000..fcae16ec5c --- /dev/null +++ b/examples/VFS/autogen.sh @@ -0,0 +1,60 @@ +#!/bin/sh + +# Run this script to build samba from CVS. + +## insert all possible names (only works with +## autoconf 2.x +#TESTAUTOHEADER="autoheader autoheader-2.53" +TESTAUTOCONF="autoconf autoconf-2.53" + +#AUTOHEADERFOUND="0" +AUTOCONFFOUND="0" + + +## +## Look for autoheader +## +#for i in $TESTAUTOHEADER; do +# if which $i > /dev/null 2>&1; then +# if [ `$i --version | head -n 1 | cut -d. -f 2` -ge 53 ]; then +# AUTOHEADER=$i +# AUTOHEADERFOUND="1" +# break +# fi +# fi +#done + +## +## Look for autoconf +## + +for i in $TESTAUTOCONF; do + if which $i > /dev/null 2>&1; then + if [ `$i --version | head -n 1 | cut -d. -f 2` -ge 53 ]; then + AUTOCONF=$i + AUTOCONFFOUND="1" + break + fi + fi +done + + +## +## do we have it? +## +if [ "$AUTOCONFFOUND" = "0" -o "$AUTOHEADERFOUND" = "0" ]; then + echo "$0: need autoconf 2.53 or later to build samba from CVS" >&2 + exit 1 +fi + + + +#echo "$0: running $AUTOHEADER" +#$AUTOHEADER || exit 1 + +echo "$0: running $AUTOCONF" +$AUTOCONF || exit 1 + +echo "Now run ./configure and then make." +exit 0 + diff --git a/examples/VFS/configure.in b/examples/VFS/configure.in new file mode 100644 index 0000000000..a0d1dc9630 --- /dev/null +++ b/examples/VFS/configure.in @@ -0,0 +1,353 @@ +dnl -*- mode: m4-mode -*- +dnl Process this file with autoconf to produce a configure script. + +dnl We must use autotools 2.53 or above +AC_PREREQ(2.53) +AC_INIT(Makefile.in) + +#dnl Uncomment this if you want to use your own define's too +#AC_CONFIG_HEADER(module_config.h) +#dnl To make sure that didn't get #define PACKAGE_* in modules_config.h +#echo "" > confdefs.h + +dnl Checks for programs. +AC_PROG_CC +AC_PROG_INSTALL + +################################################# +# Directory handling stuff to support both the +# legacy SAMBA directories and FHS compliant +# ones... +AC_PREFIX_DEFAULT(/usr/local/samba) + +AC_ARG_WITH(fhs, +[ --with-fhs Use FHS-compliant paths (default=no)], + libdir="\${prefix}/lib/samba", + libdir="\${prefix}/lib") + +AC_SUBST(libdir) + +SAMBA_SOURCE="../../source" +#################################################### +# set the location location of the samba source tree +AC_ARG_WITH(samba-source, +[ --with-samba-source=DIR Where is the samba source tree (../../source)], +[ case "$withval" in + yes|no) + # + # Just in case anybody calls it without argument + # + AC_MSG_WARN([--with-samba-source called without argument - will use default]) + ;; + * ) + SAMBA_SOURCE="$withval" + ;; + esac]) + +AC_SUBST(SAMBA_SOURCE) + +dnl Unique-to-Samba variables we'll be playing with. +AC_SUBST(CC) +AC_SUBST(SHELL) +AC_SUBST(LDSHFLAGS) +AC_SUBST(SONAMEFLAG) +AC_SUBST(SHLD) +AC_SUBST(HOST_OS) +AC_SUBST(PICFLAG) +AC_SUBST(PICSUFFIX) +AC_SUBST(POBAD_CC) +AC_SUBST(SHLIBEXT) +AC_SUBST(INSTALLCLIENTCMD_SH) +AC_SUBST(INSTALLCLIENTCMD_A) +AC_SUBST(SHLIB_PROGS) +AC_SUBST(EXTRA_BIN_PROGS) +AC_SUBST(EXTRA_SBIN_PROGS) +AC_SUBST(EXTRA_ALL_TARGETS) + +AC_ARG_ENABLE(debug, +[ --enable-debug Turn on compiler debugging information (default=no)], + [if eval "test x$enable_debug = xyes"; then + CFLAGS="${CFLAGS} -g" + fi]) + +AC_ARG_ENABLE(developer, [ --enable-developer Turn on developer warnings and debugging (default=no)], + [if eval "test x$enable_developer = xyes"; then + developer=yes + CFLAGS="${CFLAGS} -g -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -DDEBUG_PASSWORD -DDEVELOPER" + fi]) + +# compile with optimization and without debugging by default, but +# allow people to set their own preference. +if test "x$CFLAGS" = x +then + CFLAGS="-O ${CFLAGS}" +fi + + ################################################# + # check for krb5-config from recent MIT and Heimdal kerberos 5 + AC_PATH_PROG(KRB5_CONFIG, krb5-config) + AC_MSG_CHECKING(for working krb5-config) + if test -x "$KRB5_CONFIG"; then + CFLAGS="$CFLAGS `$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" + CPPFLAGS="$CPPFLAGS `$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" + FOUND_KRB5=yes + AC_MSG_RESULT(yes) + else + AC_MSG_RESULT(no. Fallback to previous krb5 detection strategy) + fi + + if test x$FOUND_KRB5 = x"no"; then + ################################################# + # check for location of Kerberos 5 install + AC_MSG_CHECKING(for kerberos 5 install path) + AC_ARG_WITH(krb5, + [ --with-krb5=base-dir Locate Kerberos 5 support (default=/usr)], + [ case "$withval" in + no) + AC_MSG_RESULT(no) + ;; + *) + AC_MSG_RESULT(yes) + CFLAGS="$CFLAGS -I$withval/include" + CPPFLAGS="$CPPFLAGS -I$withval/include" + FOUND_KRB5=yes + ;; + esac ], + AC_MSG_RESULT(no) + ) + fi + +if test x$FOUND_KRB5 = x"no"; then +################################################# +# see if this box has the SuSE location for the heimdal kerberos implementation +AC_MSG_CHECKING(for /usr/include/heimdal) +if test -d /usr/include/heimdal; then + if test -f /usr/lib/heimdal/lib/libkrb5.a; then + CFLAGS="$CFLAGS -I/usr/include/heimdal" + CPPFLAGS="$CPPFLAGS -I/usr/include/heimdal" + AC_MSG_RESULT(yes) + else + CFLAGS="$CFLAGS -I/usr/include/heimdal" + CPPFLAGS="$CPPFLAGS -I/usr/include/heimdal" + AC_MSG_RESULT(yes) + + fi +else + AC_MSG_RESULT(no) +fi +fi + + +if test x$FOUND_KRB5 = x"no"; then +################################################# +# see if this box has the RedHat location for kerberos +AC_MSG_CHECKING(for /usr/kerberos) +if test -d /usr/kerberos -a -f /usr/kerberos/lib/libkrb5.a; then + LDFLAGS="$LDFLAGS -L/usr/kerberos/lib" + CFLAGS="$CFLAGS -I/usr/kerberos/include" + CPPFLAGS="$CPPFLAGS -I/usr/kerberos/include" + AC_MSG_RESULT(yes) +else + AC_MSG_RESULT(no) +fi +fi + + # now check for krb5.h. Some systems have the libraries without the headers! + # note that this check is done here to allow for different kerberos + # include paths + AC_CHECK_HEADERS(krb5.h) + + # now check for gssapi headers. This is also done here to allow for + # different kerberos include paths + AC_CHECK_HEADERS(gssapi.h gssapi/gssapi_generic.h gssapi/gssapi.h com_err.h) + +#dnl Check if we use GNU ld +#LD=ld +#AC_PROG_LD_GNU + +#dnl look for executable suffix +#AC_EXEEXT + +builddir=`pwd` +AC_SUBST(builddir) + +# Assume non-shared by default and override below +BLDSHARED="false" + +# these are the defaults, good for lots of systems +HOST_OS="$host_os" +LDSHFLAGS="-shared" +SONAMEFLAG="#" +SHLD="\${CC}" +PICFLAG="" +PICSUFFIX="po" +POBAD_CC="#" +SHLIBEXT="so" + +if test "$enable_shared" = "yes"; then + # this bit needs to be modified for each OS that is suported by + # smbwrapper. You need to specify how to created a shared library and + # how to compile C code to produce PIC object files + + AC_MSG_CHECKING([ability to build shared libraries]) + + # and these are for particular systems + case "$host_os" in + *linux*) + BLDSHARED="true" + LDSHFLAGS="-shared" + DYNEXP="-Wl,--export-dynamic" + PICFLAG="-fPIC" + SONAMEFLAG="-Wl,-soname=" + ;; + *solaris*) + BLDSHARED="true" + LDSHFLAGS="-G" + SONAMEFLAG="-h " + if test "${GCC}" = "yes"; then + PICFLAG="-fPIC" + if test "${ac_cv_prog_gnu_ld}" = "yes"; then + DYNEXP="-Wl,-E" + fi + else + PICFLAG="-KPIC" + ## ${CFLAGS} added for building 64-bit shared + ## libs using Sun's Compiler + LDSHFLAGS="-G \${CFLAGS}" + POBAD_CC="" + PICSUFFIX="po.o" + fi + ;; + *sunos*) + BLDSHARED="true" + LDSHFLAGS="-G" + SONAMEFLAG="-Wl,-h," + PICFLAG="-KPIC" # Is this correct for SunOS + ;; + *netbsd* | *freebsd*) BLDSHARED="true" + LDSHFLAGS="-shared" + DYNEXP="-Wl,--export-dynamic" + SONAMEFLAG="-Wl,-soname," + PICFLAG="-fPIC -DPIC" + ;; + *openbsd*) BLDSHARED="true" + LDSHFLAGS="-shared" + DYNEXP="-Wl,-Bdynamic" + SONAMEFLAG="-Wl,-soname," + PICFLAG="-fPIC" + ;; + *irix*) + case "$host_os" in + *irix6*) + ;; + esac + ATTEMPT_WRAP32_BUILD=yes + BLDSHARED="true" + LDSHFLAGS="-set_version sgi1.0 -shared" + SONAMEFLAG="-soname " + SHLD="\${LD}" + if test "${GCC}" = "yes"; then + PICFLAG="-fPIC" + else + PICFLAG="-KPIC" + fi + ;; + *aix*) + BLDSHARED="true" + LDSHFLAGS="-Wl,-bexpall,-bM:SRE,-bnoentry,-berok" + DYNEXP="-Wl,-brtl,-bexpall" + PICFLAG="-O2" + if test "${GCC}" != "yes"; then + ## for funky AIX compiler using strncpy() + CFLAGS="$CFLAGS -D_LINUX_SOURCE_COMPAT -qmaxmem=32000" + fi + ;; + *hpux*) + SHLIBEXT="sl" + # Use special PIC flags for the native HP-UX compiler. + if test $ac_cv_prog_cc_Ae = yes; then + BLDSHARED="true" + SHLD="/usr/bin/ld" + LDSHFLAGS="-B symbolic -b -z" + SONAMEFLAG="+h " + PICFLAG="+z" + fi + DYNEXP="-Wl,-E" + ;; + *qnx*) + ;; + *osf*) + BLDSHARED="true" + LDSHFLAGS="-shared" + SONAMEFLAG="-Wl,-soname," + PICFLAG="-fPIC" + ;; + *sco*) + ;; + *unixware*) + BLDSHARED="true" + LDSHFLAGS="-shared" + SONAMEFLAG="-Wl,-soname," + PICFLAG="-KPIC" + ;; + *next2*) + ;; + *dgux*) AC_CHECK_PROG( ROFF, groff, [groff -etpsR -Tascii -man]) + ;; + *sysv4*) + case "$host" in + *-univel-*) + LDSHFLAGS="-G" + DYNEXP="-Bexport" + ;; + *mips-sni-sysv4*) + ;; + esac + ;; + + *sysv5*) + LDSHFLAGS="-G" + ;; + *vos*) + BLDSHARED="false" + LDSHFLAGS="" + ;; + *) + ;; + esac + AC_SUBST(DYNEXP) + AC_MSG_RESULT($BLDSHARED) + AC_MSG_CHECKING([linker flags for shared libraries]) + AC_MSG_RESULT([$LDSHFLAGS]) + AC_MSG_CHECKING([compiler flags for position-independent code]) + AC_MSG_RESULT([$PICFLAGS]) +fi + +####################################################### +# test whether building a shared library actually works +if test $BLDSHARED = true; then +AC_CACHE_CHECK([whether building shared libraries actually works], + [ac_cv_shlib_works],[ + ac_cv_shlib_works=no + # try building a trivial shared library + if test "$PICSUFFIX" = "po"; then + $CC $CPPFLAGS $CFLAGS $PICFLAG -c -o shlib.po ${srcdir-.}/tests/shlib.c && + $CC $CPPFLAGS $CFLAGS `eval echo $LDSHFLAGS` -o "shlib.$SHLIBEXT" shlib.po && + ac_cv_shlib_works=yes + else + $CC $CPPFLAGS $CFLAGS $PICFLAG -c -o shlib.$PICSUFFIX ${srcdir-.}/tests/shlib.c && + mv shlib.$PICSUFFIX shlib.po && + $CC $CPPFLAGS $CFLAGS `eval echo $LDSHFLAGS` -o "shlib.$SHLIBEXT" shlib.po && + ac_cv_shlib_works=yes + fi + rm -f "shlib.$SHLIBEXT" shlib.po +]) +if test $ac_cv_shlib_works = no; then + BLDSHARED=false +fi +fi + + + + +AC_OUTPUT(Makefile) diff --git a/examples/VFS/install-sh b/examples/VFS/install-sh new file mode 100644 index 0000000000..58719246f0 --- /dev/null +++ b/examples/VFS/install-sh @@ -0,0 +1,238 @@ +#! /bin/sh +# +# install - install a program, script, or datafile +# This comes from X11R5. +# +# Calling this script install-sh is preferred over install.sh, to prevent +# `make' implicit rules from creating a file called install from it +# when there is no Makefile. +# +# This script is compatible with the BSD install script, but was written +# from scratch. +# + + +# set DOITPROG to echo to test this script + +# Don't use :- since 4.3BSD and earlier shells don't like it. +doit="${DOITPROG-}" + + +# put in absolute paths if you don't have them in your path; or use env. vars. + +mvprog="${MVPROG-mv}" +cpprog="${CPPROG-cp}" +chmodprog="${CHMODPROG-chmod}" +chownprog="${CHOWNPROG-chown}" +chgrpprog="${CHGRPPROG-chgrp}" +stripprog="${STRIPPROG-strip}" +rmprog="${RMPROG-rm}" +mkdirprog="${MKDIRPROG-mkdir}" + +transformbasename="" +transform_arg="" +instcmd="$mvprog" +chmodcmd="$chmodprog 0755" +chowncmd="" +chgrpcmd="" +stripcmd="" +rmcmd="$rmprog -f" +mvcmd="$mvprog" +src="" +dst="" +dir_arg="" + +while [ x"$1" != x ]; do + case $1 in + -c) instcmd="$cpprog" + shift + continue;; + + -d) dir_arg=true + shift + continue;; + + -m) chmodcmd="$chmodprog $2" + shift + shift + continue;; + + -o) chowncmd="$chownprog $2" + shift + shift + continue;; + + -g) chgrpcmd="$chgrpprog $2" + shift + shift + continue;; + + -s) stripcmd="$stripprog" + shift + continue;; + + -t=*) transformarg=`echo $1 | sed 's/-t=//'` + shift + continue;; + + -b=*) transformbasename=`echo $1 | sed 's/-b=//'` + shift + continue;; + + *) if [ x"$src" = x ] + then + src=$1 + else + # this colon is to work around a 386BSD /bin/sh bug + : + dst=$1 + fi + shift + continue;; + esac +done + +if [ x"$src" = x ] +then + echo "install: no input file specified" + exit 1 +else + true +fi + +if [ x"$dir_arg" != x ]; then + dst=$src + src="" + + if [ -d $dst ]; then + instcmd=: + else + instcmd=mkdir + fi +else + +# Waiting for this to be detected by the "$instcmd $src $dsttmp" command +# might cause directories to be created, which would be especially bad +# if $src (and thus $dsttmp) contains '*'. + + if [ -f $src -o -d $src ] + then + true + else + echo "install: $src does not exist" + exit 1 + fi + + if [ x"$dst" = x ] + then + echo "install: no destination specified" + exit 1 + else + true + fi + +# If destination is a directory, append the input filename; if your system +# does not like double slashes in filenames, you may need to add some logic + + if [ -d $dst ] + then + dst="$dst"/`basename $src` + else + true + fi +fi + +## this sed command emulates the dirname command +dstdir=`echo $dst | sed -e 's,[^/]*$,,;s,/$,,;s,^$,.,'` + +# Make sure that the destination directory exists. +# this part is taken from Noah Friedman's mkinstalldirs script + +# Skip lots of stat calls in the usual case. +if [ ! -d "$dstdir" ]; then +defaultIFS=' +' +IFS="${IFS-${defaultIFS}}" + +oIFS="${IFS}" +# Some sh's can't handle IFS=/ for some reason. +IFS='%' +set - `echo ${dstdir} | sed -e 's@/@%@g' -e 's@^%@/@'` +IFS="${oIFS}" + +pathcomp='' + +while [ $# -ne 0 ] ; do + pathcomp="${pathcomp}${1}" + shift + + if [ ! -d "${pathcomp}" ] ; + then + $mkdirprog "${pathcomp}" + else + true + fi + + pathcomp="${pathcomp}/" +done +fi + +if [ x"$dir_arg" != x ] +then + $doit $instcmd $dst && + + if [ x"$chowncmd" != x ]; then $doit $chowncmd $dst; else true ; fi && + if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dst; else true ; fi && + if [ x"$stripcmd" != x ]; then $doit $stripcmd $dst; else true ; fi && + if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dst; else true ; fi +else + +# If we're going to rename the final executable, determine the name now. + + if [ x"$transformarg" = x ] + then + dstfile=`basename $dst` + else + dstfile=`basename $dst $transformbasename | + sed $transformarg`$transformbasename + fi + +# don't allow the sed command to completely eliminate the filename + + if [ x"$dstfile" = x ] + then + dstfile=`basename $dst` + else + true + fi + +# Make a temp file name in the proper directory. + + dsttmp=$dstdir/#inst.$$# + +# Move or copy the file name to the temp name + + $doit $instcmd $src $dsttmp && + + trap "rm -f ${dsttmp}" 0 && + +# and set any options; do chmod last to preserve setuid bits + +# If any of these fail, we abort the whole thing. If we want to +# ignore errors from any of these, just make sure not to ignore +# errors from the above "$doit $instcmd $src $dsttmp" command. + + if [ x"$chowncmd" != x ]; then $doit $chowncmd $dsttmp; else true;fi && + if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dsttmp; else true;fi && + if [ x"$stripcmd" != x ]; then $doit $stripcmd $dsttmp; else true;fi && + if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dsttmp; else true;fi && + +# Now rename the file to the real destination. + + $doit $rmcmd -f $dstdir/$dstfile && + $doit $mvcmd $dsttmp $dstdir/$dstfile + +fi && + + +exit 0 diff --git a/examples/VFS/skel_opaque.c b/examples/VFS/skel_opaque.c new file mode 100644 index 0000000000..e507dc1094 --- /dev/null +++ b/examples/VFS/skel_opaque.c @@ -0,0 +1,563 @@ +/* + * Skeleton VFS module. Implements passthrough operation of all VFS + * calls to disk functions. + * + * Copyright (C) Tim Potter, 1999-2000 + * Copyright (C) Alexander Bokovoy, 2002 + * Copyright (C) Stefan (metze) Metzmacher, 2003 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + + +#include "includes.h" + +/* PLEASE,PLEASE READ THE VFS MODULES CHAPTER OF THE + SAMBA DEVELOPERS GUIDE!!!!!! + */ + +/* If you take this file as template for your module + * please make sure that you remove all vfswrap_* functions and + * implement your own function!! + * + * for functions you didn't want to provide implement dummy functions + * witch return ERROR and errno = ENOSYS; ! + * + * --metze + */ + +static int skel_connect(vfs_handle_struct *handle, connection_struct *conn, const char *service, const char *user) +{ + return 0; +} + +static void skel_disconnect(vfs_handle_struct *handle, connection_struct *conn) +{ + return; +} + +static SMB_BIG_UINT skel_disk_free(vfs_handle_struct *handle, connection_struct *conn, const char *path, + BOOL small_query, SMB_BIG_UINT *bsize, + SMB_BIG_UINT *dfree, SMB_BIG_UINT *dsize) +{ + return vfswrap_disk_free(NULL, conn, path, small_query, bsize, + dfree, dsize); +} + +static int skel_get_quota(vfs_handle_struct *handle, connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dq) +{ + return vfswrap_get_quota(NULL, conn, qtype, id, dq); +} + +static int skel_set_quota(vfs_handle_struct *handle, connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dq) +{ + return vfswrap_set_quota(NULL, conn, qtype, id, dq); +} + +static DIR *skel_opendir(vfs_handle_struct *handle, connection_struct *conn, const char *fname) +{ + return vfswrap_opendir(NULL, conn, fname); +} + +static struct dirent *skel_readdir(vfs_handle_struct *handle, connection_struct *conn, DIR *dirp) +{ + return vfswrap_readdir(NULL, conn, dirp); +} + +static int skel_mkdir(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) +{ + return vfswrap_mkdir(NULL, conn, path, mode); +} + +static int skel_rmdir(vfs_handle_struct *handle, connection_struct *conn, const char *path) +{ + return vfswrap_rmdir(NULL, conn, path); +} + +static int skel_closedir(vfs_handle_struct *handle, connection_struct *conn, DIR *dir) +{ + return vfswrap_closedir(NULL, conn, dir); +} + +static int skel_open(vfs_handle_struct *handle, connection_struct *conn, const char *fname, int flags, mode_t mode) +{ + return vfswrap_open(NULL, conn, fname, flags, mode); +} + +static int skel_close(vfs_handle_struct *handle, files_struct *fsp, int fd) +{ + return vfswrap_close(NULL, fsp, fd); +} + +static ssize_t skel_read(vfs_handle_struct *handle, files_struct *fsp, int fd, void *data, size_t n) +{ + return vfswrap_read(NULL, fsp, fd, data, n); +} + +static ssize_t skel_write(vfs_handle_struct *handle, files_struct *fsp, int fd, const void *data, size_t n) +{ + return vfswrap_write(NULL, fsp, fd, data, n); +} + +static SMB_OFF_T skel_lseek(vfs_handle_struct *handle, files_struct *fsp, int filedes, SMB_OFF_T offset, int whence) +{ + return vfswrap_lseek(NULL, fsp, filedes, offset, whence); +} + +static int skel_rename(vfs_handle_struct *handle, connection_struct *conn, const char *old, const char *new) +{ + return vfswrap_rename(NULL, conn, old, new); +} + +static int skel_fsync(vfs_handle_struct *handle, files_struct *fsp, int fd) +{ + return vfswrap_fsync(NULL, fsp, fd); +} + +static int skel_stat(vfs_handle_struct *handle, connection_struct *conn, const char *fname, SMB_STRUCT_STAT *sbuf) +{ + return vfswrap_stat(NULL, conn, fname, sbuf); +} + +static int skel_fstat(vfs_handle_struct *handle, files_struct *fsp, int fd, SMB_STRUCT_STAT *sbuf) +{ + return vfswrap_fstat(NULL, fsp, fd, sbuf); +} + +static int skel_lstat(vfs_handle_struct *handle, connection_struct *conn, const char *path, SMB_STRUCT_STAT *sbuf) +{ + return vfswrap_lstat(NULL, conn, path, sbuf); +} + +static int skel_unlink(vfs_handle_struct *handle, connection_struct *conn, const char *path) +{ + return vfswrap_unlink(NULL, conn, path); +} + +static int skel_chmod(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) +{ + return vfswrap_chmod(NULL, conn, path, mode); +} + +static int skel_fchmod(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode) +{ + return vfswrap_fchmod(NULL, fsp, fd, mode); +} + +static int skel_chown(vfs_handle_struct *handle, connection_struct *conn, const char *path, uid_t uid, gid_t gid) +{ + return vfswrap_chown(NULL, conn, path, uid, gid); +} + +static int skel_fchown(vfs_handle_struct *handle, files_struct *fsp, int fd, uid_t uid, gid_t gid) +{ + return vfswrap_fchown(NULL, fsp, fd, uid, gid); +} + +static int skel_chdir(vfs_handle_struct *handle, connection_struct *conn, const char *path) +{ + return vfswrap_chdir(NULL, conn, path); +} + +static char *skel_getwd(vfs_handle_struct *handle, connection_struct *conn, char *buf) +{ + return vfswrap_getwd(NULL, conn, buf); +} + +static int skel_utime(vfs_handle_struct *handle, connection_struct *conn, const char *path, struct utimbuf *times) +{ + return vfswrap_utime(NULL, conn, path, times); +} + +static int skel_ftruncate(vfs_handle_struct *handle, files_struct *fsp, int fd, SMB_OFF_T offset) +{ + return vfswrap_ftruncate(NULL, fsp, fd, offset); +} + +static BOOL skel_lock(vfs_handle_struct *handle, files_struct *fsp, int fd, int op, SMB_OFF_T offset, SMB_OFF_T count, int type) +{ + return vfswrap_lock(NULL, fsp, fd, op, offset, count, type); +} + +static BOOL skel_symlink(vfs_handle_struct *handle, connection_struct *conn, const char *oldpath, const char *newpath) +{ + return vfswrap_symlink(NULL, conn, oldpath, newpath); +} + +static BOOL skel_readlink(vfs_handle_struct *handle, connection_struct *conn, const char *path, char *buf, size_t bufsiz) +{ + return vfswrap_readlink(NULL, conn, path, buf, bufsiz); +} + +static int skel_link(vfs_handle_struct *handle, connection_struct *conn, const char *oldpath, const char *newpath) +{ + return vfswrap_link(NULL, conn, oldpath, newpath); +} + +static int skel_mknod(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode, SMB_DEV_T dev) +{ + return vfswrap_mknod(NULL, conn, path, mode, dev); +} + +static char *skel_realpath(vfs_handle_struct *handle, connection_struct *conn, const char *path, char *resolved_path) +{ + return vfswrap_realpath(NULL, conn, path, resolved_path); +} + +static size_t skel_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, uint32 security_info, struct security_descriptor_info **ppdesc) +{ + errno = ENOSYS; + return 0; +} + +static size_t skel_get_nt_acl(vfs_handle_struct *handle, files_struct *fsp, const char *name, uint32 security_info, struct security_descriptor_info **ppdesc) +{ + errno = ENOSYS; + return 0; +} + +static BOOL skel_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, uint32 security_info_sent, struct security_descriptor_info *psd) +{ + errno = ENOSYS; + return False; +} + +static BOOL skel_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp, const char *name, uint32 security_info_sent, struct security_descriptor_info *psd) +{ + errno = ENOSYS; + return False; +} + +static int skel_chmod_acl(vfs_handle_struct *handle, connection_struct *conn, const char *name, mode_t mode) +{ + errno = ENOSYS; + return -1; +} + +static int skel_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_get_entry(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T theacl, int entry_id, SMB_ACL_ENTRY_T *entry_p) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_get_tag_type(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_TAG_T *tag_type_p) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_get_permset(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_PERMSET_T *permset_p) +{ + errno = ENOSYS; + return -1; +} + +static void *skel_sys_acl_get_qualifier(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry_d) +{ + errno = ENOSYS; + return NULL; +} + +static SMB_ACL_T skel_sys_acl_get_file(vfs_handle_struct *handle, connection_struct *conn, const char *path_p, SMB_ACL_TYPE_T type) +{ + errno = ENOSYS; + return NULL; +} + +static SMB_ACL_T skel_sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp, int fd) +{ + errno = ENOSYS; + return NULL; +} + +static int skel_sys_acl_clear_perms(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_PERMSET_T permset) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_add_perm(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm) +{ + errno = ENOSYS; + return -1; +} + +static char *skel_sys_acl_to_text(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T theacl, ssize_t *plen) +{ + errno = ENOSYS; + return NULL; +} + +static SMB_ACL_T skel_sys_acl_init(vfs_handle_struct *handle, connection_struct *conn, int count) +{ + errno = ENOSYS; + return NULL; +} + +static int skel_sys_acl_create_entry(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T *pacl, SMB_ACL_ENTRY_T *pentry) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_set_tag_type(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_TAG_T tagtype) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_set_qualifier(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry, void *qual) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_set_permset(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_PERMSET_T permset) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_valid(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T theacl ) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_set_file(vfs_handle_struct *handle, connection_struct *conn, const char *name, SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp, int fd, SMB_ACL_T theacl) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_delete_def_file(vfs_handle_struct *handle, connection_struct *conn, const char *path) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_get_perm(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_free_text(vfs_handle_struct *handle, connection_struct *conn, char *text) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_free_acl(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T posix_acl) +{ + errno = ENOSYS; + return -1; +} + +static int skel_sys_acl_free_qualifier(vfs_handle_struct *handle, connection_struct *conn, void *qualifier, SMB_ACL_TAG_T tagtype) +{ + errno = ENOSYS; + return -1; +} + +static ssize_t skel_getxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, void *value, size_t size) +{ + errno = ENOSYS; + return -1; +} + +static ssize_t skel_lgetxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, void *value, size_t +size) +{ + errno = ENOSYS; + return -1; +} + +static ssize_t skel_fgetxattr(vfs_handle_struct *handle, struct files_struct *fsp,int fd, const char *name, void *value, size_t size) +{ + errno = ENOSYS; + return -1; +} + +static ssize_t skel_listxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, char *list, size_t size) +{ + errno = ENOSYS; + return -1; +} + +static ssize_t skel_llistxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, char *list, size_t size) +{ + errno = ENOSYS; + return -1; +} + +static ssize_t skel_flistxattr(vfs_handle_struct *handle, struct files_struct *fsp,int fd, char *list, size_t size) +{ + errno = ENOSYS; + return -1; +} + +static int skel_removexattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name) +{ + errno = ENOSYS; + return -1; +} + +static int skel_lremovexattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name) +{ + errno = ENOSYS; + return -1; +} + +static int skel_fremovexattr(vfs_handle_struct *handle, struct files_struct *fsp,int fd, const char *name) +{ + errno = ENOSYS; + return -1; +} + +static int skel_setxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, const void *value, size_t size, int flags) +{ + errno = ENOSYS; + return -1; +} + +static int skel_lsetxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, const void *value, size_t size, int flags) +{ + errno = ENOSYS; + return -1; +} + +static int skel_fsetxattr(vfs_handle_struct *handle, struct files_struct *fsp,int fd, const char *name, const void *value, size_t size, int flags) +{ + errno = ENOSYS; + return -1; +} + +/* VFS operations structure */ + +static vfs_op_tuple skel_op_tuples[] = { + + /* Disk operations */ + + {SMB_VFS_OP(skel_connect), SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_disconnect), SMB_VFS_OP_DISCONNECT, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_disk_free), SMB_VFS_OP_DISK_FREE, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_get_quota), SMB_VFS_OP_GET_QUOTA, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_set_quota), SMB_VFS_OP_SET_QUOTA, SMB_VFS_LAYER_OPAQUE}, + + /* Directory operations */ + + {SMB_VFS_OP(skel_opendir), SMB_VFS_OP_OPENDIR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_readdir), SMB_VFS_OP_READDIR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_mkdir), SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_rmdir), SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_closedir), SMB_VFS_OP_CLOSEDIR, SMB_VFS_LAYER_OPAQUE}, + + /* File operations */ + + {SMB_VFS_OP(skel_open), SMB_VFS_OP_OPEN, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_close), SMB_VFS_OP_CLOSE, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_read), SMB_VFS_OP_READ, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_write), SMB_VFS_OP_WRITE, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_lseek), SMB_VFS_OP_LSEEK, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_rename), SMB_VFS_OP_RENAME, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_fsync), SMB_VFS_OP_FSYNC, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_stat), SMB_VFS_OP_STAT, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_fstat), SMB_VFS_OP_FSTAT, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_lstat), SMB_VFS_OP_LSTAT, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_unlink), SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_chmod), SMB_VFS_OP_CHMOD, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_fchmod), SMB_VFS_OP_FCHMOD, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_chown), SMB_VFS_OP_CHOWN, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_fchown), SMB_VFS_OP_FCHOWN, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_chdir), SMB_VFS_OP_CHDIR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_getwd), SMB_VFS_OP_GETWD, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_utime), SMB_VFS_OP_UTIME, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_ftruncate), SMB_VFS_OP_FTRUNCATE, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_lock), SMB_VFS_OP_LOCK, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_symlink), SMB_VFS_OP_SYMLINK, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_readlink), SMB_VFS_OP_READLINK, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_link), SMB_VFS_OP_LINK, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_mknod), SMB_VFS_OP_MKNOD, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_realpath), SMB_VFS_OP_REALPATH, SMB_VFS_LAYER_OPAQUE}, + + /* NT File ACL operations */ + + {SMB_VFS_OP(skel_fget_nt_acl), SMB_VFS_OP_FGET_NT_ACL, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_get_nt_acl), SMB_VFS_OP_GET_NT_ACL, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_fset_nt_acl), SMB_VFS_OP_FSET_NT_ACL, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_set_nt_acl), SMB_VFS_OP_SET_NT_ACL, SMB_VFS_LAYER_OPAQUE}, + + /* POSIX ACL operations */ + + {SMB_VFS_OP(skel_chmod_acl), SMB_VFS_OP_CHMOD_ACL, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_fchmod_acl), SMB_VFS_OP_FCHMOD_ACL, SMB_VFS_LAYER_OPAQUE}, + + {SMB_VFS_OP(skel_sys_acl_get_entry), SMB_VFS_OP_SYS_ACL_GET_ENTRY, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_get_tag_type), SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_get_permset), SMB_VFS_OP_SYS_ACL_GET_PERMSET, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_get_qualifier), SMB_VFS_OP_SYS_ACL_GET_QUALIFIER, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_get_file), SMB_VFS_OP_SYS_ACL_GET_FILE, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_get_fd), SMB_VFS_OP_SYS_ACL_GET_FD, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_clear_perms), SMB_VFS_OP_SYS_ACL_CLEAR_PERMS, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_add_perm), SMB_VFS_OP_SYS_ACL_ADD_PERM, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_to_text), SMB_VFS_OP_SYS_ACL_TO_TEXT, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_init), SMB_VFS_OP_SYS_ACL_INIT, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_create_entry), SMB_VFS_OP_SYS_ACL_CREATE_ENTRY, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_set_tag_type), SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_set_qualifier), SMB_VFS_OP_SYS_ACL_SET_QUALIFIER, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_set_permset), SMB_VFS_OP_SYS_ACL_SET_PERMSET, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_valid), SMB_VFS_OP_SYS_ACL_VALID, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_set_file), SMB_VFS_OP_SYS_ACL_SET_FILE, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_set_fd), SMB_VFS_OP_SYS_ACL_SET_FD, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_delete_def_file), SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_get_perm), SMB_VFS_OP_SYS_ACL_GET_PERM, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_free_text), SMB_VFS_OP_SYS_ACL_FREE_TEXT, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_free_acl), SMB_VFS_OP_SYS_ACL_FREE_ACL, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_sys_acl_free_qualifier), SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER, SMB_VFS_LAYER_OPAQUE}, + + /* EA operations. */ + {SMB_VFS_OP(skel_getxattr), SMB_VFS_OP_GETXATTR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_lgetxattr), SMB_VFS_OP_LGETXATTR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_fgetxattr), SMB_VFS_OP_FGETXATTR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_listxattr), SMB_VFS_OP_LISTXATTR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_llistxattr), SMB_VFS_OP_LLISTXATTR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_flistxattr), SMB_VFS_OP_FLISTXATTR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_removexattr), SMB_VFS_OP_REMOVEXATTR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_lremovexattr), SMB_VFS_OP_LREMOVEXATTR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_fremovexattr), SMB_VFS_OP_FREMOVEXATTR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_setxattr), SMB_VFS_OP_SETXATTR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_lsetxattr), SMB_VFS_OP_LSETXATTR, SMB_VFS_LAYER_OPAQUE}, + {SMB_VFS_OP(skel_fsetxattr), SMB_VFS_OP_FSETXATTR, SMB_VFS_LAYER_OPAQUE}, + + {NULL, SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} +}; + +NTSTATUS init_module(void) +{ + return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "skel_opaque", skel_op_tuples); +} diff --git a/examples/VFS/skel_transparent.c b/examples/VFS/skel_transparent.c new file mode 100644 index 0000000000..b2db76c9f9 --- /dev/null +++ b/examples/VFS/skel_transparent.c @@ -0,0 +1,532 @@ +/* + * Skeleton VFS module. Implements passthrough operation of all VFS + * calls to disk functions. + * + * Copyright (C) Tim Potter, 1999-2000 + * Copyright (C) Alexander Bokovoy, 2002 + * Copyright (C) Stefan (metze) Metzmacher, 2003 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + + +#include "includes.h" + +/* PLEASE,PLEASE READ THE VFS MODULES CHAPTER OF THE + SAMBA DEVELOPERS GUIDE!!!!!! + */ + +/* If you take this file as template for your module + * please make sure that you remove all functions you didn't + * want to implement!! + * + * This passthrough operations are useless in reall vfs modules! + * + * --metze + */ + +static int skel_connect(vfs_handle_struct *handle, connection_struct *conn, const char *service, const char *user) +{ + return SMB_VFS_NEXT_CONNECT(handle, conn, service, user); +} + +static void skel_disconnect(vfs_handle_struct *handle, connection_struct *conn) +{ + SMB_VFS_NEXT_DISCONNECT(handle, conn); +} + +static SMB_BIG_UINT skel_disk_free(vfs_handle_struct *handle, connection_struct *conn, const char *path, + BOOL small_query, SMB_BIG_UINT *bsize, + SMB_BIG_UINT *dfree, SMB_BIG_UINT *dsize) +{ + return SMB_VFS_NEXT_DISK_FREE(handle, conn, path, small_query, bsize, + dfree, dsize); +} + +static int skel_get_quota(vfs_handle_struct *handle, connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dq) +{ + return SMB_VFS_NEXT_GET_QUOTA(handle, conn, qtype, id, dq); +} + +static int skel_set_quota(vfs_handle_struct *handle, connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dq) +{ + return SMB_VFS_NEXT_SET_QUOTA(handle, conn, qtype, id, dq); +} + +static DIR *skel_opendir(vfs_handle_struct *handle, connection_struct *conn, const char *fname) +{ + return SMB_VFS_NEXT_OPENDIR(handle, conn, fname); +} + +static struct dirent *skel_readdir(vfs_handle_struct *handle, connection_struct *conn, DIR *dirp) +{ + return SMB_VFS_NEXT_READDIR(handle, conn, dirp); +} + +static int skel_mkdir(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) +{ + return SMB_VFS_NEXT_MKDIR(handle, conn, path, mode); +} + +static int skel_rmdir(vfs_handle_struct *handle, connection_struct *conn, const char *path) +{ + return SMB_VFS_NEXT_RMDIR(handle, conn, path); +} + +static int skel_closedir(vfs_handle_struct *handle, connection_struct *conn, DIR *dir) +{ + return SMB_VFS_NEXT_CLOSEDIR(handle, conn, dir); +} + +static int skel_open(vfs_handle_struct *handle, connection_struct *conn, const char *fname, int flags, mode_t mode) +{ + return SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode); +} + +static int skel_close(vfs_handle_struct *handle, files_struct *fsp, int fd) +{ + return SMB_VFS_NEXT_CLOSE(handle, fsp, fd); +} + +static ssize_t skel_read(vfs_handle_struct *handle, files_struct *fsp, int fd, void *data, size_t n) +{ + return SMB_VFS_NEXT_READ(handle, fsp, fd, data, n); +} + +static ssize_t skel_write(vfs_handle_struct *handle, files_struct *fsp, int fd, const void *data, size_t n) +{ + return SMB_VFS_NEXT_WRITE(handle, fsp, fd, data, n); +} + +static SMB_OFF_T skel_lseek(vfs_handle_struct *handle, files_struct *fsp, int filedes, SMB_OFF_T offset, int whence) +{ + return SMB_VFS_NEXT_LSEEK(handle, fsp, filedes, offset, whence); +} + +static int skel_rename(vfs_handle_struct *handle, connection_struct *conn, const char *old, const char *new) +{ + return SMB_VFS_NEXT_RENAME(handle, conn, old, new); +} + +static int skel_fsync(vfs_handle_struct *handle, files_struct *fsp, int fd) +{ + return SMB_VFS_NEXT_FSYNC(handle, fsp, fd); +} + +static int skel_stat(vfs_handle_struct *handle, connection_struct *conn, const char *fname, SMB_STRUCT_STAT *sbuf) +{ + return SMB_VFS_NEXT_STAT(handle, conn, fname, sbuf); +} + +static int skel_fstat(vfs_handle_struct *handle, files_struct *fsp, int fd, SMB_STRUCT_STAT *sbuf) +{ + return SMB_VFS_NEXT_FSTAT(handle, fsp, fd, sbuf); +} + +static int skel_lstat(vfs_handle_struct *handle, connection_struct *conn, const char *path, SMB_STRUCT_STAT *sbuf) +{ + return SMB_VFS_NEXT_LSTAT(handle, conn, path, sbuf); +} + +static int skel_unlink(vfs_handle_struct *handle, connection_struct *conn, const char *path) +{ + return SMB_VFS_NEXT_UNLINK(handle, conn, path); +} + +static int skel_chmod(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) +{ + return SMB_VFS_NEXT_CHMOD(handle, conn, path, mode); +} + +static int skel_fchmod(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode) +{ + return SMB_VFS_NEXT_FCHMOD(handle, fsp, fd, mode); +} + +static int skel_chown(vfs_handle_struct *handle, connection_struct *conn, const char *path, uid_t uid, gid_t gid) +{ + return SMB_VFS_NEXT_CHOWN(handle, conn, path, uid, gid); +} + +static int skel_fchown(vfs_handle_struct *handle, files_struct *fsp, int fd, uid_t uid, gid_t gid) +{ + return SMB_VFS_NEXT_FCHOWN(handle, fsp, fd, uid, gid); +} + +static int skel_chdir(vfs_handle_struct *handle, connection_struct *conn, const char *path) +{ + return SMB_VFS_NEXT_CHDIR(handle, conn, path); +} + +static char *skel_getwd(vfs_handle_struct *handle, connection_struct *conn, char *buf) +{ + return SMB_VFS_NEXT_GETWD(handle, conn, buf); +} + +static int skel_utime(vfs_handle_struct *handle, connection_struct *conn, const char *path, struct utimbuf *times) +{ + return SMB_VFS_NEXT_UTIME(handle, conn, path, times); +} + +static int skel_ftruncate(vfs_handle_struct *handle, files_struct *fsp, int fd, SMB_OFF_T offset) +{ + return SMB_VFS_NEXT_FTRUNCATE(handle, fsp, fd, offset); +} + +static BOOL skel_lock(vfs_handle_struct *handle, files_struct *fsp, int fd, int op, SMB_OFF_T offset, SMB_OFF_T count, int type) +{ + return SMB_VFS_NEXT_LOCK(handle, fsp, fd, op, offset, count, type); +} + +static BOOL skel_symlink(vfs_handle_struct *handle, connection_struct *conn, const char *oldpath, const char *newpath) +{ + return SMB_VFS_NEXT_SYMLINK(handle, conn, oldpath, newpath); +} + +static BOOL skel_readlink(vfs_handle_struct *handle, connection_struct *conn, const char *path, char *buf, size_t bufsiz) +{ + return SMB_VFS_NEXT_READLINK(handle, conn, path, buf, bufsiz); +} + +static int skel_link(vfs_handle_struct *handle, connection_struct *conn, const char *oldpath, const char *newpath) +{ + return SMB_VFS_NEXT_LINK(handle, conn, oldpath, newpath); +} + +static int skel_mknod(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode, SMB_DEV_T dev) +{ + return SMB_VFS_NEXT_MKNOD(handle, conn, path, mode, dev); +} + +static char *skel_realpath(vfs_handle_struct *handle, connection_struct *conn, const char *path, char *resolved_path) +{ + return SMB_VFS_NEXT_REALPATH(handle, conn, path, resolved_path); +} + +static size_t skel_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, uint32 security_info, struct security_descriptor_info **ppdesc) +{ + return SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, fd, security_info, ppdesc); +} + +static size_t skel_get_nt_acl(vfs_handle_struct *handle, files_struct *fsp, const char *name, uint32 security_info, struct security_descriptor_info **ppdesc) +{ + return SMB_VFS_NEXT_GET_NT_ACL(handle, fsp, name, security_info, ppdesc); +} + +static BOOL skel_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, uint32 security_info_sent, struct security_descriptor_info *psd) +{ + return SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, fd, security_info_sent, psd); +} + +static BOOL skel_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp, const char *name, uint32 security_info_sent, struct security_descriptor_info *psd) +{ + return SMB_VFS_NEXT_SET_NT_ACL(handle, fsp, name, security_info_sent, psd); +} + +static int skel_chmod_acl(vfs_handle_struct *handle, connection_struct *conn, const char *name, mode_t mode) +{ + /* If the underlying VFS doesn't have ACL support... */ + if (!handle->vfs_next.ops.chmod_acl) { + errno = ENOSYS; + return -1; + } + return SMB_VFS_NEXT_CHMOD_ACL(handle, conn, name, mode); +} + +static int skel_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp, int fd, mode_t mode) +{ + /* If the underlying VFS doesn't have ACL support... */ + if (!handle->vfs_next.ops.fchmod_acl) { + errno = ENOSYS; + return -1; + } + return SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, fd, mode); +} + +static int skel_sys_acl_get_entry(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T theacl, int entry_id, SMB_ACL_ENTRY_T *entry_p) +{ + return SMB_VFS_NEXT_SYS_ACL_GET_ENTRY(handle, conn, theacl, entry_id, entry_p); +} + +static int skel_sys_acl_get_tag_type(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_TAG_T *tag_type_p) +{ + return SMB_VFS_NEXT_SYS_ACL_GET_TAG_TYPE(handle, conn, entry_d, tag_type_p); +} + +static int skel_sys_acl_get_permset(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_PERMSET_T *permset_p) +{ + return SMB_VFS_NEXT_SYS_ACL_GET_PERMSET(handle, conn, entry_d, permset_p); +} + +static void *skel_sys_acl_get_qualifier(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry_d) +{ + return SMB_VFS_NEXT_SYS_ACL_GET_QUALIFIER(handle, conn, entry_d); +} + +static SMB_ACL_T skel_sys_acl_get_file(vfs_handle_struct *handle, connection_struct *conn, const char *path_p, SMB_ACL_TYPE_T type) +{ + return SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, conn, path_p, type); +} + +static SMB_ACL_T skel_sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp, int fd) +{ + return SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, fd); +} + +static int skel_sys_acl_clear_perms(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_PERMSET_T permset) +{ + return SMB_VFS_NEXT_SYS_ACL_CLEAR_PERMS(handle, conn, permset); +} + +static int skel_sys_acl_add_perm(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm) +{ + return SMB_VFS_NEXT_SYS_ACL_ADD_PERM(handle, conn, permset, perm); +} + +static char *skel_sys_acl_to_text(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T theacl, ssize_t *plen) +{ + return SMB_VFS_NEXT_SYS_ACL_TO_TEXT(handle, conn, theacl, plen); +} + +static SMB_ACL_T skel_sys_acl_init(vfs_handle_struct *handle, connection_struct *conn, int count) +{ + return SMB_VFS_NEXT_SYS_ACL_INIT(handle, conn, count); +} + +static int skel_sys_acl_create_entry(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T *pacl, SMB_ACL_ENTRY_T *pentry) +{ + return SMB_VFS_NEXT_SYS_ACL_CREATE_ENTRY(handle, conn, pacl, pentry); +} + +static int skel_sys_acl_set_tag_type(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_TAG_T tagtype) +{ + return SMB_VFS_NEXT_SYS_ACL_SET_TAG_TYPE(handle, conn, entry, tagtype); +} + +static int skel_sys_acl_set_qualifier(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry, void *qual) +{ + return SMB_VFS_NEXT_SYS_ACL_SET_QUALIFIER(handle, conn, entry, qual); +} + +static int skel_sys_acl_set_permset(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_PERMSET_T permset) +{ + return SMB_VFS_NEXT_SYS_ACL_SET_PERMSET(handle, conn, entry, permset); +} + +static int skel_sys_acl_valid(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T theacl ) +{ + return SMB_VFS_NEXT_SYS_ACL_VALID(handle, conn, theacl); +} + +static int skel_sys_acl_set_file(vfs_handle_struct *handle, connection_struct *conn, const char *name, SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl) +{ + return SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, conn, name, acltype, theacl); +} + +static int skel_sys_acl_set_fd(vfs_handle_struct *handle, files_struct *fsp, int fd, SMB_ACL_T theacl) +{ + return SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, fd, theacl); +} + +static int skel_sys_acl_delete_def_file(vfs_handle_struct *handle, connection_struct *conn, const char *path) +{ + return SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, conn, path); +} + +static int skel_sys_acl_get_perm(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm) +{ + return SMB_VFS_NEXT_SYS_ACL_GET_PERM(handle, conn, permset, perm); +} + +static int skel_sys_acl_free_text(vfs_handle_struct *handle, connection_struct *conn, char *text) +{ + return SMB_VFS_NEXT_SYS_ACL_FREE_TEXT(handle, conn, text); +} + +static int skel_sys_acl_free_acl(vfs_handle_struct *handle, connection_struct *conn, SMB_ACL_T posix_acl) +{ + return SMB_VFS_NEXT_SYS_ACL_FREE_ACL(handle, conn, posix_acl); +} + +static int skel_sys_acl_free_qualifier(vfs_handle_struct *handle, connection_struct *conn, void *qualifier, SMB_ACL_TAG_T tagtype) +{ + return SMB_VFS_NEXT_SYS_ACL_FREE_QUALIFIER(handle, conn, qualifier, tagtype); +} + +static ssize_t skel_getxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, void *value, size_t size) +{ + return SMB_VFS_NEXT_GETXATTR(handle, conn, path, name, value, size); +} + +static ssize_t skel_lgetxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, void *value, size_t +size) +{ + return SMB_VFS_NEXT_LGETXATTR(handle, conn, path, name, value, size); +} + +static ssize_t skel_fgetxattr(vfs_handle_struct *handle, struct files_struct *fsp,int fd, const char *name, void *value, size_t size) +{ + return SMB_VFS_NEXT_FGETXATTR(handle, fsp, fd, name, value, size); +} + +static ssize_t skel_listxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, char *list, size_t size) +{ + return SMB_VFS_NEXT_LISTXATTR(handle, conn, path, list, size); +} + +static ssize_t skel_llistxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, char *list, size_t size) +{ + return SMB_VFS_NEXT_LLISTXATTR(handle, conn, path, list, size); +} + +static ssize_t skel_flistxattr(vfs_handle_struct *handle, struct files_struct *fsp,int fd, char *list, size_t size) +{ + return SMB_VFS_NEXT_FLISTXATTR(handle, fsp, fd, list, size); +} + +static int skel_removexattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name) +{ + return SMB_VFS_NEXT_REMOVEXATTR(handle, conn, path, name); +} + +static int skel_lremovexattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name) +{ + return SMB_VFS_NEXT_LREMOVEXATTR(handle, conn, path, name); +} + +static int skel_fremovexattr(vfs_handle_struct *handle, struct files_struct *fsp,int fd, const char *name) +{ + return SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, fd, name); +} + +static int skel_setxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, const void *value, size_t size, int flags) +{ + return SMB_VFS_NEXT_SETXATTR(handle, conn, path, name, value, size, flags); +} + +static int skel_lsetxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, const void *value, size_t size, int flags) +{ + return SMB_VFS_NEXT_LSETXATTR(handle, conn, path, name, value, size, flags); +} + +static int skel_fsetxattr(vfs_handle_struct *handle, struct files_struct *fsp,int fd, const char *name, const void *value, size_t size, int flags) +{ + return SMB_VFS_NEXT_FSETXATTR(handle, fsp, fd, name, value, size, flags); +} + +/* VFS operations structure */ + +static vfs_op_tuple skel_op_tuples[] = { + + /* Disk operations */ + + {SMB_VFS_OP(skel_connect), SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_disconnect), SMB_VFS_OP_DISCONNECT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_disk_free), SMB_VFS_OP_DISK_FREE, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_get_quota), SMB_VFS_OP_GET_QUOTA, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_set_quota), SMB_VFS_OP_SET_QUOTA, SMB_VFS_LAYER_TRANSPARENT}, + + /* Directory operations */ + + {SMB_VFS_OP(skel_opendir), SMB_VFS_OP_OPENDIR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_readdir), SMB_VFS_OP_READDIR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_mkdir), SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_rmdir), SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_closedir), SMB_VFS_OP_CLOSEDIR, SMB_VFS_LAYER_TRANSPARENT}, + + /* File operations */ + + {SMB_VFS_OP(skel_open), SMB_VFS_OP_OPEN, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_close), SMB_VFS_OP_CLOSE, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_read), SMB_VFS_OP_READ, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_write), SMB_VFS_OP_WRITE, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_lseek), SMB_VFS_OP_LSEEK, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_rename), SMB_VFS_OP_RENAME, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_fsync), SMB_VFS_OP_FSYNC, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_stat), SMB_VFS_OP_STAT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_fstat), SMB_VFS_OP_FSTAT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_lstat), SMB_VFS_OP_LSTAT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_unlink), SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_chmod), SMB_VFS_OP_CHMOD, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_fchmod), SMB_VFS_OP_FCHMOD, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_chown), SMB_VFS_OP_CHOWN, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_fchown), SMB_VFS_OP_FCHOWN, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_chdir), SMB_VFS_OP_CHDIR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_getwd), SMB_VFS_OP_GETWD, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_utime), SMB_VFS_OP_UTIME, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_ftruncate), SMB_VFS_OP_FTRUNCATE, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_lock), SMB_VFS_OP_LOCK, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_symlink), SMB_VFS_OP_SYMLINK, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_readlink), SMB_VFS_OP_READLINK, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_link), SMB_VFS_OP_LINK, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_mknod), SMB_VFS_OP_MKNOD, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_realpath), SMB_VFS_OP_REALPATH, SMB_VFS_LAYER_TRANSPARENT}, + + /* NT File ACL operations */ + + {SMB_VFS_OP(skel_fget_nt_acl), SMB_VFS_OP_FGET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_get_nt_acl), SMB_VFS_OP_GET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_fset_nt_acl), SMB_VFS_OP_FSET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_set_nt_acl), SMB_VFS_OP_SET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT}, + + /* POSIX ACL operations */ + + {SMB_VFS_OP(skel_chmod_acl), SMB_VFS_OP_CHMOD_ACL, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_fchmod_acl), SMB_VFS_OP_FCHMOD_ACL, SMB_VFS_LAYER_TRANSPARENT}, + + {SMB_VFS_OP(skel_sys_acl_get_entry), SMB_VFS_OP_SYS_ACL_GET_ENTRY, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_get_tag_type), SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_get_permset), SMB_VFS_OP_SYS_ACL_GET_PERMSET, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_get_qualifier), SMB_VFS_OP_SYS_ACL_GET_QUALIFIER, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_get_file), SMB_VFS_OP_SYS_ACL_GET_FILE, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_get_fd), SMB_VFS_OP_SYS_ACL_GET_FD, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_clear_perms), SMB_VFS_OP_SYS_ACL_CLEAR_PERMS, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_add_perm), SMB_VFS_OP_SYS_ACL_ADD_PERM, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_to_text), SMB_VFS_OP_SYS_ACL_TO_TEXT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_init), SMB_VFS_OP_SYS_ACL_INIT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_create_entry), SMB_VFS_OP_SYS_ACL_CREATE_ENTRY, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_set_tag_type), SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_set_qualifier), SMB_VFS_OP_SYS_ACL_SET_QUALIFIER, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_set_permset), SMB_VFS_OP_SYS_ACL_SET_PERMSET, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_valid), SMB_VFS_OP_SYS_ACL_VALID, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_set_file), SMB_VFS_OP_SYS_ACL_SET_FILE, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_set_fd), SMB_VFS_OP_SYS_ACL_SET_FD, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_delete_def_file), SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_get_perm), SMB_VFS_OP_SYS_ACL_GET_PERM, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_free_text), SMB_VFS_OP_SYS_ACL_FREE_TEXT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_free_acl), SMB_VFS_OP_SYS_ACL_FREE_ACL, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_sys_acl_free_qualifier), SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER, SMB_VFS_LAYER_TRANSPARENT}, + + /* EA operations. */ + {SMB_VFS_OP(skel_getxattr), SMB_VFS_OP_GETXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_lgetxattr), SMB_VFS_OP_LGETXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_fgetxattr), SMB_VFS_OP_FGETXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_listxattr), SMB_VFS_OP_LISTXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_llistxattr), SMB_VFS_OP_LLISTXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_flistxattr), SMB_VFS_OP_FLISTXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_removexattr), SMB_VFS_OP_REMOVEXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_lremovexattr), SMB_VFS_OP_LREMOVEXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_fremovexattr), SMB_VFS_OP_FREMOVEXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_setxattr), SMB_VFS_OP_SETXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_lsetxattr), SMB_VFS_OP_LSETXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(skel_fsetxattr), SMB_VFS_OP_FSETXATTR, SMB_VFS_LAYER_TRANSPARENT}, + + {NULL, SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} +}; + +NTSTATUS init_module(void) +{ + return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "skel_transparent", skel_op_tuples); +} diff --git a/examples/pdb/sambapdb.dtd b/examples/pdb/sambapdb.dtd new file mode 100644 index 0000000000..1f4054ddec --- /dev/null +++ b/examples/pdb/sambapdb.dtd @@ -0,0 +1,46 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/packaging/Debian/debian/patches/krb5-vars.patch b/packaging/Debian/debian/patches/krb5-vars.patch new file mode 100644 index 0000000000..28ee4855d8 --- /dev/null +++ b/packaging/Debian/debian/patches/krb5-vars.patch @@ -0,0 +1,685 @@ +--- samba_3_0/source/Makefile.in.orig 2003-07-15 12:26:55.000000000 -0400 ++++ samba_3_0/source/Makefile.in 2003-07-15 12:26:57.000000000 -0400 +@@ -32,7 +32,6 @@ + ACLLIBS=@ACLLIBS@ + PASSDBLIBS=@PASSDBLIBS@ + IDMAP_LIBS=@IDMAP_LIBS@ +-ADSLIBS=@ADSLIBS@ + KRB5LIBS=@KRB5_LIBS@ + LDAPLIBS=@LDAP_LIBS@ + +@@ -735,12 +734,12 @@ + + bin/smbd@EXEEXT@: $(SMBD_OBJ) @BUILD_POPT@ bin/.dummy + @echo Linking $@ +- @$(CC) $(FLAGS) -o $@ $(SMBD_OBJ) $(ADSLIBS) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ ++ @$(CC) $(FLAGS) -o $@ $(SMBD_OBJ) $(KRB5LIBS) $(LDAPLIBS) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ + $(AUTHLIBS) $(ACLLIBS) $(PASSDBLIBS) $(LIBS) @POPTLIBS@ + + bin/nmbd@EXEEXT@: $(NMBD_OBJ) @BUILD_POPT@ bin/.dummy + @echo Linking $@ +- @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(ADSLIBS) ++ @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) + + bin/wrepld@EXEEXT@: $(WREPL_OBJ) @BUILD_POPT@ bin/.dummy + @echo Linking $@ +@@ -749,19 +748,19 @@ + bin/swat@EXEEXT@: $(SWAT_OBJ) @BUILD_POPT@ bin/.dummy + @echo Linking $@ + @$(CC) $(FLAGS) -o $@ $(SWAT_OBJ) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ +- $(AUTHLIBS) $(LIBS) $(PASSDBLIBS) @POPTLIBS@ $(KRB5LIBS) ++ $(AUTHLIBS) $(LIBS) $(PASSDBLIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) + + bin/rpcclient@EXEEXT@: $(RPCCLIENT_OBJ) @BUILD_POPT@ bin/.dummy + @echo Linking $@ +- @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(RPCCLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(ADSLIBS) ++ @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(RPCCLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) + + bin/smbclient@EXEEXT@: $(CLIENT_OBJ) @BUILD_POPT@ bin/.dummy + @echo Linking $@ +- @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(ADSLIBS) ++ @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) + + bin/net@EXEEXT@: $(NET_OBJ) @BUILD_POPT@ bin/.dummy + @echo Linking $@ +- @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(ADSLIBS) $(PASSDBLIBS) ++ @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) $(PASSDBLIBS) + + bin/profiles@EXEEXT@: $(PROFILES_OBJ) @BUILD_POPT@ bin/.dummy + @echo Linking $@ +@@ -809,7 +808,7 @@ + + bin/smbpasswd@EXEEXT@: $(SMBPASSWD_OBJ) bin/.dummy + @echo Linking $@ +- @$(CC) $(FLAGS) -o $@ $(SMBPASSWD_OBJ) $(PASSDBLIBS) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) ++ @$(CC) $(FLAGS) -o $@ $(SMBPASSWD_OBJ) $(PASSDBLIBS) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + + bin/pdbedit@EXEEXT@: $(PDBEDIT_OBJ) @BUILD_POPT@ bin/.dummy + @echo Linking $@ +@@ -881,7 +880,7 @@ + + bin/smbw_sample@EXEEXT@: $(SMBW_OBJ) utils/smbw_sample.o bin/.dummy + @echo Linking $@ +- @$(CC) $(FLAGS) -o $@ $(SMBW_OBJ) utils/smbw_sample.o $(LDFLAGS) $(LIBS) $(KRB5LIBS) ++ @$(CC) $(FLAGS) -o $@ $(SMBW_OBJ) utils/smbw_sample.o $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + + bin/smbsh@EXEEXT@: $(SMBSH_OBJ) bin/.dummy + @echo Linking $@ +@@ -890,12 +889,14 @@ + bin/smbwrapper.@SHLIBEXT@: $(PICOBJS) bin/.dummy + @echo Linking shared library $@ + @$(SHLD) $(LDSHFLAGS) -o $@ $(PICOBJS) $(LIBS) \ +- @SONAMEFLAG@`basename $@` $(KRB5LIBS) ++ $(KRB5LIBS) $(LDAPLIBS) \ ++ @SONAMEFLAG@`basename $@` + + bin/libsmbclient.@SHLIBEXT@: $(LIBSMBCLIENT_PICOBJS) + @echo Linking libsmbclient shared library $@ + @$(SHLD) $(LDSHFLAGS) -o $@ $(LIBSMBCLIENT_PICOBJS) $(LDFLAGS) $(LIBS) \ +- $(KRB5LIBS) @SONAMEFLAG@`basename $@`.$(LIBSMBCLIENT_MAJOR) ++ $(KRB5LIBS) $(LDAPLIBS) \ ++ @SONAMEFLAG@`basename $@`.$(LIBSMBCLIENT_MAJOR) + + bin/libsmbclient.a: $(LIBSMBCLIENT_PICOBJS) + @echo Linking libsmbclient non-shared library $@ +@@ -905,7 +906,8 @@ + bin/libbigballofmud.@SHLIBEXT@: $(LIBBIGBALLOFMUD_PICOBJS) + @echo Linking bigballofmud shared library $@ + @$(SHLD) $(LDSHFLAGS) -o $@ $(LIBBIGBALLOFMUD_PICOBJS) $(LIBS) \ +- @SONAMEFLAG@`basename $@`.$(LIBBIGBALLOFMUD_MAJOR) $(PASSDBLIBS) $(IDMAP_LIBS) $(ADSLIBS) ++ $(PASSDBLIBS) $(IDMAP_LIBS) $(KRB5LIBS) $(LDAPLIBS) \ ++ @SONAMEFLAG@`basename $@`.$(LIBBIGBALLOFMUD_MAJOR) + ln -snf libbigballofmud.so bin/libbigballofmud.so.0 + + # It would be nice to build a static bigballofmud too, but when I try +diff -uNr samba-3.0.0beta2.orig/source/aclocal.m4 samba-3.0.0beta2/source/aclocal.m4 +--- samba-3.0.0beta2.orig/source/aclocal.m4 2003-07-01 15:44:25.000000000 -0500 ++++ samba-3.0.0beta2/source/aclocal.m4 2003-07-05 16:22:30.000000000 -0500 +@@ -111,6 +111,113 @@ + esac + ]) + ++# AC_CHECK_LIB_EXT(LIBRARY, [EXT_LIBS], [FUNCTION], ++# [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND], ++# [ADD-ACTION-IF-FOUND],[OTHER-LIBRARIES]) ++# ------------------------------------------------------ ++# ++# Use a cache variable name containing both the library and function name, ++# because the test really is for library $1 defining function $3, not ++# just for library $1. Separate tests with the same $1 and different $3s ++# may have different results. ++# ++# Note that using directly AS_VAR_PUSHDEF([ac_Lib], [ac_cv_lib_$1_$3]) ++# is asking for troubles, since AC_CHECK_LIB($lib, fun) would give ++# ac_cv_lib_$lib_fun, which is definitely not what was meant. Hence ++# the AS_LITERAL_IF indirection. ++# ++# FIXME: This macro is extremely suspicious. It DEFINEs unconditionnally, ++# whatever the FUNCTION, in addition to not being a *S macro. Note ++# that the cache does depend upon the function we are looking for. ++# ++# It is on purpose we used `ac_check_lib_ext_save_LIBS' and not just ++# `ac_save_LIBS': there are many macros which don't want to see `LIBS' ++# changed but still want to use AC_CHECK_LIB_EXT, so they save `LIBS'. ++# And ``ac_save_LIBS' is too tempting a name, so let's leave them some ++# freedom. ++AC_DEFUN([AC_CHECK_LIB_EXT], ++[ ++AH_CHECK_LIB_EXT([$1]) ++ac_check_lib_ext_save_LIBS=$LIBS ++LIBS="-l$1 $$2 $7 $LIBS" ++AS_LITERAL_IF([$1], ++ [AS_VAR_PUSHDEF([ac_Lib_ext], [ac_cv_lib_ext_$1])], ++ [AS_VAR_PUSHDEF([ac_Lib_ext], [ac_cv_lib_ext_$1''])])dnl ++ ++m4_ifval([$3], ++ [ ++ AH_CHECK_FUNC_EXT([$3]) ++ AS_LITERAL_IF([$1], ++ [AS_VAR_PUSHDEF([ac_Lib_func], [ac_cv_lib_ext_$1_$3])], ++ [AS_VAR_PUSHDEF([ac_Lib_func], [ac_cv_lib_ext_$1''_$3])])dnl ++ AC_CACHE_CHECK([for $3 in -l$1], ac_Lib_func, ++ [AC_TRY_LINK_FUNC($3, ++ [AS_VAR_SET(ac_Lib_func, yes); ++ AS_VAR_SET(ac_Lib_ext, yes)], ++ [AS_VAR_SET(ac_Lib_func, no); ++ AS_VAR_SET(ac_Lib_ext, no)]) ++ ]) ++ AS_IF([test AS_VAR_GET(ac_Lib_func) = yes], ++ [AC_DEFINE_UNQUOTED(AS_TR_CPP(HAVE_$3))])dnl ++ AS_VAR_POPDEF([ac_Lib_func])dnl ++ ],[ ++ AC_CACHE_CHECK([for -l$1], ac_Lib_ext, ++ [AC_TRY_LINK_FUNC([main], ++ [AS_VAR_SET(ac_Lib_ext, yes)], ++ [AS_VAR_SET(ac_Lib_ext, no)]) ++ ]) ++ ]) ++LIBS=$ac_check_lib_ext_save_LIBS ++ ++AS_IF([test AS_VAR_GET(ac_Lib_ext) = yes], ++ [m4_default([$4], ++ [AC_DEFINE_UNQUOTED(AS_TR_CPP(HAVE_LIB$1)) ++ case "$$2" in ++ *-l$1*) ++ ;; ++ *) ++ $2="$$2 -l$1" ++ ;; ++ esac]) ++ [$6] ++ ], ++ [$5])dnl ++AS_VAR_POPDEF([ac_Lib_ext])dnl ++])# AC_CHECK_LIB_EXT ++ ++# AH_CHECK_LIB_EXT(LIBNAME) ++# --------------------- ++m4_define([AH_CHECK_LIB_EXT], ++[AH_TEMPLATE(AS_TR_CPP(HAVE_LIB$1), ++ [Define to 1 if you have the `]$1[' library (-l]$1[).])]) ++ ++# AC_CHECK_FUNCS_EXT(FUNCTION, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND]) ++# ----------------------------------------------------------------- ++dnl check for a function in a $LIBS and $OTHER_LIBS libraries variable. ++dnl AC_CHECK_FUNC_EXT(func,OTHER_LIBS,IF-TRUE,IF-FALSE) ++AC_DEFUN([AC_CHECK_FUNC_EXT], ++[ ++ AH_CHECK_FUNC_EXT($1) ++ ac_check_func_ext_save_LIBS=$LIBS ++ LIBS="$2 $LIBS" ++ AS_VAR_PUSHDEF([ac_var], [ac_cv_func_ext_$1])dnl ++ AC_CACHE_CHECK([for $1], ac_var, ++ [AC_LINK_IFELSE([AC_LANG_FUNC_LINK_TRY([$1])], ++ [AS_VAR_SET(ac_var, yes)], ++ [AS_VAR_SET(ac_var, no)])]) ++ LIBS=$ac_check_func_ext_save_LIBS ++ AS_IF([test AS_VAR_GET(ac_var) = yes], ++ [AC_DEFINE_UNQUOTED(AS_TR_CPP([HAVE_$1])) $3], ++ [$4])dnl ++AS_VAR_POPDEF([ac_var])dnl ++])# AC_CHECK_FUNC ++ ++# AH_CHECK_FUNC_EXT(FUNCNAME) ++# --------------------- ++m4_define([AH_CHECK_FUNC_EXT], ++[AH_TEMPLATE(AS_TR_CPP(HAVE_$1), ++ [Define to 1 if you have the `]$1[' function.])]) ++ + dnl Define an AC_DEFINE with ifndef guard. + dnl AC_N_DEFINE(VARIABLE [, VALUE]) + define(AC_N_DEFINE, +diff -uNr samba-3.0.0beta2.orig/source/configure.in samba-3.0.0beta2/source/configure.in +--- samba-3.0.0beta2.orig/source/configure.in 2003-07-05 16:22:00.000000000 -0500 ++++ samba-3.0.0beta2/source/configure.in 2003-07-05 16:23:53.000000000 -0500 +@@ -162,12 +162,10 @@ + AC_SUBST(PRINTLIBS) + AC_SUBST(AUTHLIBS) + AC_SUBST(ACLLIBS) +-AC_SUBST(ADSLIBS) + AC_SUBST(PASSDBLIBS) + AC_SUBST(IDMAP_LIBS) + AC_SUBST(KRB5_LIBS) + AC_SUBST(LDAP_LIBS) +-AC_SUBST(LDAP_OBJ) + AC_SUBST(SHLIB_PROGS) + AC_SUBST(SMBWRAPPER) + AC_SUBST(EXTRA_BIN_PROGS) +@@ -2105,14 +2103,107 @@ + AC_MSG_RESULT(no) + ) + ++######################################################## ++# Compile with LDAP support? ++ ++with_ldap_support=auto ++AC_MSG_CHECKING([for LDAP support]) ++ ++AC_ARG_WITH(ldap, ++[ --with-ldap LDAP support (default yes)], ++[ case "$withval" in ++ yes|no) ++ with_ldap_support=$withval ++ ;; ++ esac ]) ++ ++AC_MSG_RESULT($with_ldap_support) ++ ++SMBLDAP="" ++SMBLDAP_PROTO="" ++AC_SUBST(SMBLDAP) ++AC_SUBST(SMBLDAP_PROTO) ++if test x"$with_ldap_support" != x"no"; then ++ ++ ################################################################## ++ # first test for ldap.h and lber.h ++ # (ldap.h is required for this test) ++ AC_CHECK_HEADERS(ldap.h lber.h) ++ ++ if test x"$ac_cv_header_ldap_h" != x"yes"; then ++ if test x"$with_ldap_support" = x"yes"; then ++ AC_MSG_ERROR(ldap.h is needed for LDAP support) ++ else ++ AC_MSG_WARN(ldap.h is needed for LDAP support) ++ fi ++ ++ with_ldap_support=no ++ fi ++fi ++ ++if test x"$with_ldap_support" != x"no"; then ++ ac_save_LIBS=$LIBS ++ ++ ################################################################## ++ # we might need the lber lib on some systems. To avoid link errors ++ # this test must be before the libldap test ++ AC_CHECK_LIB_EXT(lber, LDAP_LIBS, ber_scanf) ++ ++ ######################################################## ++ # now see if we can find the ldap libs in standard paths ++ AC_CHECK_LIB_EXT(ldap, LDAP_LIBS, ldap_init) ++ ++ AC_CHECK_FUNC_EXT(ldap_domain2hostlist,$LDAP_LIBS) ++ ++ ######################################################## ++ # If we have LDAP, does it's rebind procedure take 2 or 3 arguments? ++ # Check found in pam_ldap 145. ++ AC_CHECK_FUNC_EXT(ldap_set_rebind_proc,$LDAP_LIBS) ++ ++ LIBS="$LIBS $LDAP_LIBS" ++ AC_CACHE_CHECK(whether ldap_set_rebind_proc takes 3 arguments, smb_ldap_cv_ldap_set_rebind_proc, [ ++ AC_TRY_COMPILE([ ++ #include ++ #include ], ++ [ldap_set_rebind_proc(0, 0, 0);], ++ [smb_ldap_cv_ldap_set_rebind_proc=3], ++ [smb_ldap_cv_ldap_set_rebind_proc=2] ++ ) ++ ]) ++ ++ AC_DEFINE_UNQUOTED(LDAP_SET_REBIND_PROC_ARGS, $smb_ldap_cv_ldap_set_rebind_proc, [Number of arguments to ldap_set_rebind_proc]) ++ ++ AC_CHECK_FUNC_EXT(ldap_initialize,$LDAP_LIBS) ++ ++ if test x"$ac_cv_lib_ext_ldap_ldap_init" = x"yes" -a x"$ac_cv_func_ext_ldap_domain2hostlist" = x"yes"; then ++ AC_DEFINE(HAVE_LDAP,1,[Whether ldap is available]) ++ default_static_modules="$default_static_modules pdb_ldap idmap_ldap"; ++ SMBLDAP="lib/smbldap.o" ++ with_ldap_support=yes ++ AC_MSG_CHECKING(whether LDAP support is used) ++ AC_MSG_RESULT(yes) ++ else ++ if test x"$with_ldap_support" = x"yes"; then ++ AC_MSG_ERROR(libldap is needed for LDAP support) ++ else ++ AC_MSG_WARN(libldap is needed for LDAP support) ++ fi ++ ++ LDAP_LIBS="" ++ with_ldap_support=no ++ fi ++ LIBS=$ac_save_LIBS ++fi ++ ++ + ################################################# + # active directory support + + with_ads_support=auto +-AC_MSG_CHECKING([whether to use Active Directory]) ++AC_MSG_CHECKING([for Active Directory and krb5 support]) + + AC_ARG_WITH(ads, +-[ --with-ads Active Directory support (default yes)], ++[ --with-ads Active Directory support (default auto)], + [ case "$withval" in + yes|no) + with_ads_support="$withval" +@@ -2124,22 +2215,28 @@ + FOUND_KRB5=no + KRB5_LIBS="" + ++if test x"$with_ldap_support" != x"yes"; then ++ if test x"$with_ads_support" = x"yes"; then ++ AC_MSG_ERROR(Active Directory Support requires LDAP support) ++ elif test x"$with_ads_support" != x"no"; then ++ AC_MSG_WARN(Active Directory Support requires LDAP support) ++ fi ++ with_ads_support=no ++fi ++ + if test x"$with_ads_support" != x"no"; then + + # Do no harm to the values of CFLAGS and LIBS while testing for + # Kerberos support. + +- ac_save_CFLAGS="$CFLAGS" +- ac_save_LIBS="$LIBS" +- + ################################################# + # check for krb5-config from recent MIT and Heimdal kerberos 5 + AC_PATH_PROG(KRB5_CONFIG, krb5-config) + AC_MSG_CHECKING(for working krb5-config) + if test -x "$KRB5_CONFIG"; then +- LIBS="$LIBS `$KRB5_CONFIG --libs`" +- CFLAGS="$CFLAGS `$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" +- CPPFLAGS="$CPPFLAGS `$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" ++ KRB5_LIBS="`CFLAGS='' $KRB5_CONFIG --libs gssapi`" ++ KRB5_CFLAGS="`$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" ++ KRB5_CPPFLAGS="`$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" + FOUND_KRB5=yes + AC_MSG_RESULT(yes) + else +@@ -2154,18 +2251,23 @@ + [ --with-krb5=base-dir Locate Kerberos 5 support (default=/usr)], + [ case "$withval" in + no) +- AC_MSG_RESULT(no) ++ AC_MSG_RESULT(no krb5-path given) ++ ;; ++ yes) ++ AC_MSG_RESULT(/usr) ++ KRB5_LIBS="-lkrb5" ++ FOUND_KRB5=yes + ;; + *) +- AC_MSG_RESULT(yes) +- LIBS="$LIBS -lkrb5" +- CFLAGS="$CFLAGS -I$withval/include" +- CPPFLAGS="$CPPFLAGS -I$withval/include" +- LDFLAGS="$LDFLAGS -L$withval/lib" ++ AC_MSG_RESULT($withval) ++ KRB5_LIBS="-lkrb5" ++ KRB5_CFLAGS="-I$withval/include" ++ KRB5_CPPFLAGS="-I$withval/include" ++ KRB5_LDFLAGS="-L$withval/lib" + FOUND_KRB5=yes + ;; + esac ], +- AC_MSG_RESULT(no) ++ AC_MSG_RESULT(no krb5-path given) + ) + fi + +@@ -2175,15 +2277,15 @@ + AC_MSG_CHECKING(for /usr/include/heimdal) + if test -d /usr/include/heimdal; then + if test -f /usr/lib/heimdal/lib/libkrb5.a; then +- LIBS="$LIBS -lkrb5" +- CFLAGS="$CFLAGS -I/usr/include/heimdal" +- CPPFLAGS="$CPPFLAGS -I/usr/include/heimdal" +- LDFLAGS="$LDFLAGS -L/usr/lib/heimdal/lib" ++ KRB5_LIBS="-lkrb5" ++ KRB5_CFLAGS="-I/usr/include/heimdal" ++ KRB5_CPPFLAGS="-I/usr/include/heimdal" ++ KRB5_LDFLAGS="-L/usr/lib/heimdal/lib" + AC_MSG_RESULT(yes) + else +- LIBS="$LIBS -lkrb5" +- CFLAGS="$CFLAGS -I/usr/include/heimdal" +- CPPFLAGS="$CPPFLAGS -I/usr/include/heimdal" ++ KRB5_LIBS="-lkrb5" ++ KRB5_CFLAGS="-I/usr/include/heimdal" ++ KRB5_CPPFLAGS="-I/usr/include/heimdal" + AC_MSG_RESULT(yes) + fi + else +@@ -2196,16 +2298,26 @@ + # see if this box has the RedHat location for kerberos + AC_MSG_CHECKING(for /usr/kerberos) + if test -d /usr/kerberos -a -f /usr/kerberos/lib/libkrb5.a; then +- LIBS="$LIBS -lkrb5" +- LDFLAGS="$LDFLAGS -L/usr/kerberos/lib" +- CFLAGS="$CFLAGS -I/usr/kerberos/include" +- CPPFLAGS="$CPPFLAGS -I/usr/kerberos/include" ++ KRB5_LIBS="-lkrb5" ++ KRB5_LDFLAGS="-L/usr/kerberos/lib" ++ KRB5_CFLAGS="-I/usr/kerberos/include" ++ KRB5_CPPFLAGS="-I/usr/kerberos/include" + AC_MSG_RESULT(yes) + else + AC_MSG_RESULT(no) + fi + fi + ++ ac_save_CFLAGS=$CFLAGS ++ ac_save_CPPFLAGS=$CPPFLAGS ++ ac_save_LDFLAGS=$LDFLAGS ++ ++ CFLAGS="$CFLAGS $KRB5_CFLAGS" ++ CPPFLAGS="$CPPFLAGS $KRB5_CPPFLAGS" ++ LDFLAGS="$LDFLAGS $KRB5_LDFLAGS" ++ ++ KRB5_LIBS="$KRB5_LDFLAGS $KRB5_LIBS" ++ + # now check for krb5.h. Some systems have the libraries without the headers! + # note that this check is done here to allow for different kerberos + # include paths +@@ -2225,24 +2337,17 @@ + # Turn off AD support and restore CFLAGS and LIBS variables + + with_ads_support="no" +- +- CFLAGS="$ac_save_CFLAGS" +- LIBS="$ac_save_LIBS" +- +- else +- +- # Get rid of case where $with_ads_support=auto +- +- with_ads_support="yes" +- ++ ++ CFLAGS=$ac_save_CFLAGS ++ CPPFLAGS=$ac_save_CPPFLAGS ++ LDFLAGS=$ac_save_LDFLAGS + fi + fi + + # Now we have determined whether we really want ADS support + +-if test x"$with_ads_support" = x"yes"; then +- +- AC_DEFINE(WITH_ADS,1,[Whether to include Active Directory support]) ++if test x"$with_ads_support" != x"no"; then ++ ac_save_LIBS=$LIBS + + # now check for gssapi headers. This is also done here to allow for + # different kerberos include paths +@@ -2250,62 +2355,45 @@ + + ################################################################## + # we might need the k5crypto and com_err libraries on some systems +- AC_CHECK_LIB(com_err, _et_list) +- AC_CHECK_LIB(k5crypto, krb5_encrypt_data) ++ AC_CHECK_LIB_EXT(com_err, KRB5_LIBS, _et_list) ++ AC_CHECK_LIB_EXT(k5crypto, KRB5_LIBS, krb5_encrypt_data) + + # Heimdal checks. +- AC_CHECK_LIB(crypto, des_set_key) +- AC_CHECK_LIB(asn1, copy_Authenticator) +- AC_CHECK_LIB(roken, roken_getaddrinfo_hostspec) ++ AC_CHECK_LIB_EXT(crypto, KRB5_LIBS, des_set_key) ++ AC_CHECK_LIB_EXT(asn1, KRB5_LIBS, copy_Authenticator) ++ AC_CHECK_LIB_EXT(roken, KRB5_LIBS, roken_getaddrinfo_hostspec) + + # Heimdal checks. On static Heimdal gssapi must be linked before krb5. +- AC_CHECK_LIB(gssapi, gss_display_status, [LIBS="$LIBS -lgssapi -lkrb5"; +- AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) ++ AC_CHECK_LIB_EXT(gssapi, KRB5_LIBS, gss_display_status, [KRB5_LIBS="$KRB5_LIBS -lgssapi -lkrb5"; ++ AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) ++ ++ ######################################################## ++ # now see if we can find the krb5 libs in standard paths ++ # or as specified above ++ AC_CHECK_LIB_EXT(krb5, KRB5_LIBS, krb5_mk_req_extended) ++ ++ ######################################################## ++ # now see if we can find the gssapi libs in standard paths ++ AC_CHECK_LIB_EXT(gssapi_krb5, KRB5_LIBS,gss_display_status,[],[], ++ AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])) + +- AC_CHECK_LIB(krb5, krb5_set_real_time, +- [AC_DEFINE(HAVE_KRB5_SET_REAL_TIME,1, +- [Whether krb5_set_real_time is available])]) +- AC_CHECK_LIB(krb5, krb5_set_default_in_tkt_etypes, +- [AC_DEFINE(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES,1, +- [Whether krb5_set_default_in_tkt_etypes, is available])]) +- AC_CHECK_LIB(krb5, krb5_set_default_tgs_ktypes, +- [AC_DEFINE(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES,1, +- [Whether krb5_set_default_tgs_ktypes is available])]) +- +- AC_CHECK_LIB(krb5, krb5_principal2salt, +- [AC_DEFINE(HAVE_KRB5_PRINCIPAL2SALT,1, +- [Whether krb5_principal2salt is available])]) +- AC_CHECK_LIB(krb5, krb5_use_enctype, +- [AC_DEFINE(HAVE_KRB5_USE_ENCTYPE,1, +- [Whether krb5_use_enctype is available])]) +- AC_CHECK_LIB(krb5, krb5_string_to_key, +- [AC_DEFINE(HAVE_KRB5_STRING_TO_KEY,1, +- [Whether krb5_string_to_key is available])]) +- AC_CHECK_LIB(krb5, krb5_get_pw_salt, +- [AC_DEFINE(HAVE_KRB5_GET_PW_SALT,1, +- [Whether krb5_get_pw_salt is available])]) +- AC_CHECK_LIB(krb5, krb5_string_to_key_salt, +- [AC_DEFINE(HAVE_KRB5_STRING_TO_KEY_SALT,1, +- [Whether krb5_string_to_key_salt is available])]) +- AC_CHECK_LIB(krb5, krb5_auth_con_setkey, +- [AC_DEFINE(HAVE_KRB5_AUTH_CON_SETKEY,1, +- [Whether krb5_auth_con_setkey is available])]) +- AC_CHECK_LIB(krb5, krb5_auth_con_setuseruserkey, +- [AC_DEFINE(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY,1, +- [Whether krb5_auth_con_setuseruserkey is available])]) +- AC_CHECK_LIB(krb5, krb5_locate_kdc, +- [AC_DEFINE(HAVE_KRB5_LOCATE_KDC,1, +- [Whether krb5_locate_kdc is available])]) +- AC_CHECK_LIB(krb5, krb5_get_permitted_enctypes, +- [AC_DEFINE(HAVE_KRB5_GET_PERMITTED_ENCTYPES,1, +- [Whether krb5_get_permitted_enctypes is available])]) +- AC_CHECK_LIB(krb5, krb5_get_default_in_tkt_etypes, +- [AC_DEFINE(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES,1, +- [Whether krb5_get_default_in_tkt_etypes is available])]) +- AC_CHECK_LIB(krb5, krb5_free_ktypes, +- [AC_DEFINE(HAVE_KRB5_FREE_KTYPES,1, +- [Whether krb5_free_ktypes is available])]) ++ AC_CHECK_FUNC_EXT(krb5_set_real_time, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_set_default_in_tkt_etypes, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_set_default_tgs_ktypes, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_principal2salt, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_use_enctype, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_string_to_key, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_get_pw_salt, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_string_to_key_salt, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_auth_con_setkey, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_auth_con_setuseruserkey, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_locate_kdc, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_get_permitted_enctypes, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_get_default_in_tkt_etypes, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_free_ktypes, $KRB5_LIBS) + ++ LIBS="$LIBS $KRB5_LIBS" ++ + AC_CACHE_CHECK([for addrtype in krb5_address], + samba_cv_HAVE_ADDRTYPE_IN_KRB5_ADDRESS,[ + AC_TRY_COMPILE([#include ], +@@ -2365,87 +2453,21 @@ + [Whether the ENCTYPE_ARCFOUR_HMAC_MD5 key type is available]) + fi + +- ######################################################## +- # now see if we can find the krb5 libs in standard paths +- # or as specified above +- AC_CHECK_LIB(krb5, krb5_mk_req_extended, [KRB5_LIBS="$LIBS -lkrb5"; +- KRB5_CFLAGS="$CFLAGS"; +- AC_DEFINE(HAVE_KRB5,1,[Whether KRB5 is available])]) +- +- ######################################################## +- # now see if we can find the gssapi libs in standard paths +- AC_CHECK_LIB(gssapi_krb5, gss_display_status, +- [KRB5_LIBS="$KRB5_LIBS -lgssapi_krb5"; +- AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) +- +- CFLAGS="$ac_save_CFLAGS" +- LIBS="$ac_save_LIBS" +-fi +- +-######################################################## +-# Compile with LDAP support? +- +-LDAP_OBJ="" +-with_ldap_support=yes +-AC_MSG_CHECKING([whether to use LDAP]) +- +-AC_ARG_WITH(ldap, +-[ --with-ldap LDAP support (default yes)], +-[ case "$withval" in +- no) +- with_ldap_support=no +- ;; +- esac ]) +- +-AC_MSG_RESULT($with_ldap_support) +- +-SMBLDAP="" +-if test x"$with_ldap_support" = x"yes"; then +- ac_save_LIBS="$LIBS" +- LIBS="" +- +- ################################################################## +- # we might need the lber lib on some systems. To avoid link errors +- # this test must be before the libldap test +- AC_CHECK_LIB(lber, ber_scanf) +- +- ######################################################## +- # now see if we can find the ldap libs in standard paths +- if test x$have_ldap != xyes; then +- AC_CHECK_LIB(ldap, ldap_init, [ +- LIBS="$LIBS -lldap"; +- AC_CHECK_LIB(ldap, ldap_domain2hostlist, [ +- AC_DEFINE(HAVE_LDAP,1,[Whether ldap is available]) +- AC_CHECK_HEADERS([ldap.h lber.h], +- [default_static_modules="$default_static_modules pdb_ldap idmap_ldap"; +- SMBLDAP="lib/smbldap.o"]) +- ]) +- ]) +- +- ######################################################## +- # If we have LDAP, does it's rebind procedure take 2 or 3 arguments? +- # Check found in pam_ldap 145. +- AC_CHECK_FUNCS(ldap_set_rebind_proc) +- AC_CACHE_CHECK(whether ldap_set_rebind_proc takes 3 arguments, pam_ldap_cv_ldap_set_rebind_proc, [ +- AC_TRY_COMPILE([ +- #include +- #include ], [ldap_set_rebind_proc(0, 0, 0);], [pam_ldap_cv_ldap_set_rebind_proc=3], [pam_ldap_cv_ldap_set_rebind_proc=2]) ]) +- AC_DEFINE_UNQUOTED(LDAP_SET_REBIND_PROC_ARGS, $pam_ldap_cv_ldap_set_rebind_proc, [Number of arguments to ldap_set_rebind_proc]) +- AC_CHECK_FUNCS(ldap_initialize) +- fi +- +- AC_SUBST(SMBLDAP) +- LDAP_LIBS="$LIBS"; +- LIBS="$ac_save_LIBS"; +-else +- # Can't have ADS support without LDAP ++ if test x"$ac_cv_lib_ext_krb5_krb5_mk_req_extended" = x"yes"; then ++ AC_DEFINE(HAVE_KRB5,1,[Whether to have KRB5 support]) ++ AC_DEFINE(WITH_ADS,1,[Whether to include Active Directory support]) ++ AC_MSG_CHECKING(whether Active Directory and krb5 support is used) ++ AC_MSG_RESULT(yes) ++ else + if test x"$with_ads_support" = x"yes"; then +- AC_MSG_ERROR(Active directory support requires LDAP) ++ AC_MSG_ERROR(libkrb5 is needed for Active Directory support) ++ else ++ AC_MSG_WARN(libkrb5 is needed for Active Directory support) + fi +-fi +- +-if test x"$with_ads_support" = x"yes"; then +- ADSLIBS="$LDAP_LIBS $KRB5_LIBS" ++ KRB5_LIBS="" ++ with_ads_support=no ++ fi ++ LIBS="$ac_save_LIBS" + fi + + ######################################################## diff --git a/packaging/Debian/debian/patches/pam_smbpass_linkage.patch b/packaging/Debian/debian/patches/pam_smbpass_linkage.patch new file mode 100644 index 0000000000..022a3a0a28 --- /dev/null +++ b/packaging/Debian/debian/patches/pam_smbpass_linkage.patch @@ -0,0 +1,24 @@ +diff -uNr samba-3.0.0beta2.orig/source/Makefile.in samba-3.0.0beta2/source/Makefile.in +--- samba-3.0.0beta2.orig/source/Makefile.in 2003-07-05 16:24:34.000000000 -0500 ++++ samba-3.0.0beta2/source/Makefile.in 2003-07-05 16:24:54.000000000 -0500 +@@ -579,8 +579,8 @@ + PAM_SMBPASS_OBJ_0 = pam_smbpass/pam_smb_auth.o pam_smbpass/pam_smb_passwd.o \ + pam_smbpass/pam_smb_acct.o pam_smbpass/support.o \ + libsmb/smbencrypt.o libsmb/smbdes.o libsmb/nterr.o \ +- $(PARAM_OBJ) $(LIB_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ) \ +- $(SECRETS_OBJ) $(UBIQX_OBJ) ++ $(LIBSAMBA_OBJ) $(PARAM_OBJ) $(LIB_OBJ) $(PASSDB_OBJ) \ ++ $(GROUPDB_OBJ) $(SECRETS_OBJ) $(UBIQX_OBJ) $(SMBLDAP_OBJ) + + PAM_SMBPASS_PICOOBJ = $(PAM_SMBPASS_OBJ_0:.o=.po) + +@@ -1076,7 +1076,8 @@ + + bin/pam_smbpass.@SHLIBEXT@: $(PAM_SMBPASS_PICOOBJ) + @echo "Linking shared library $@" +- @$(SHLD) $(LDSHFLAGS) -o $@ $(PAM_SMBPASS_PICOOBJ) -lpam $(DYNEXP) $(LIBS) -lc ++ @$(SHLD) $(LDSHFLAGS) -o $@ $(PAM_SMBPASS_PICOOBJ) -lpam $(DYNEXP) \ ++ $(PASSDBLIBS) $(LIBS) -lc + + bin/libmsrpc.a: $(LIBMSRPC_PICOBJ) + @-$(AR) -rc $@ $(LIBMSRPC_PICOBJ) diff --git a/packaging/Debian/debian/patches/smbclient-tar.patch b/packaging/Debian/debian/patches/smbclient-tar.patch new file mode 100644 index 0000000000..e6cdcafbf8 --- /dev/null +++ b/packaging/Debian/debian/patches/smbclient-tar.patch @@ -0,0 +1,43 @@ +diff -uNr samba-3.0.0beta2.orig/source/client/client.c samba-3.0.0beta2/source/client/client.c +--- samba-3.0.0beta2.orig/source/client/client.c 2003-07-01 22:36:24.000000000 -0500 ++++ samba-3.0.0beta2/source/client/client.c 2003-07-06 15:17:36.000000000 -0500 +@@ -2731,6 +2731,7 @@ + int opt; + pstring query_host; + BOOL message = False; ++ char* tar_args = NULL; + extern char tar_type; + pstring term_code; + static const char *new_name_resolve_order = NULL; +@@ -2816,7 +2817,7 @@ + max_protocol = interpret_protocol(poptGetOptArg(pc), max_protocol); + break; + case 'T': +- if (!tar_parseargs(argc, argv, poptGetOptArg(pc), optind)) { ++ if (!(tar_args = poptGetOptArg(pc))) { + poptPrintUsage(pc, stderr, 0); + exit(1); + } +@@ -2848,6 +2849,22 @@ + pstrcpy(cmdline_auth_info.password,poptGetArg(pc)); + } + ++ /* The tar command may take a number of string options; pass ++ everything we have left to tar_parseargs(). */ ++ if (tar_args) { ++ const char **argv2 = poptGetArgs(pc); ++ int argc2 = 0; ++ ++ if (argv2) { ++ while (argv2[argc2]) argc2++; ++ } ++ ++ if (!tar_parseargs(argc2, argv2, tar_args, 0)) { ++ poptPrintUsage(pc, stderr, 0); ++ exit(1); ++ } ++ } ++ + init_names(); + + if(new_name_resolve_order) diff --git a/packaging/Mandrake/swat_16.png.bz2 b/packaging/Mandrake/swat_16.png.bz2 new file mode 100644 index 0000000000..25522cab06 Binary files /dev/null and b/packaging/Mandrake/swat_16.png.bz2 differ diff --git a/packaging/Mandrake/swat_32.png.bz2 b/packaging/Mandrake/swat_32.png.bz2 new file mode 100644 index 0000000000..737d16034f Binary files /dev/null and b/packaging/Mandrake/swat_32.png.bz2 differ diff --git a/packaging/Mandrake/swat_48.png.bz2 b/packaging/Mandrake/swat_48.png.bz2 new file mode 100644 index 0000000000..3e921c1feb Binary files /dev/null and b/packaging/Mandrake/swat_48.png.bz2 differ diff --git a/packaging/RedHat/samba.spec.tmpl b/packaging/RedHat/samba.spec.tmpl new file mode 100644 index 0000000000..4c5a480a27 --- /dev/null +++ b/packaging/RedHat/samba.spec.tmpl @@ -0,0 +1,440 @@ +Summary: Samba SMB client and server +Name: samba +Version: PVERSION +Release: PRELEASE +License: GNU GPL version 2 +Group: Networking +Source: http://download.samba.org/samba/ftp/samba-%{version}.tar.bz2 +Packager: Gerald Carter [Samba-Team] +Requires: pam >= 0.72 kernel >= 2.2.1 glibc >= 2.1.2 +Prereq: chkconfig fileutils +Provides: samba = %{version} +Obsoletes: samba-common, samba-client, samba-swat +BuildRoot: %{_tmppath}/%{name}-%{version}-root +Prefix: /usr + +%description +Samba provides an SMB/CIFS server which can be used to provide +network file and print services to SMB/CIFS clients, including +various versions of MS Windows, OS/2, and other Linux machines. +Samba also provides some SMB clients, which complement the +built-in SMB filesystem in Linux. Samba uses NetBIOS over TCP/IP +(NetBT) protocols and does NOT need NetBEUI (Microsoft Raw NetBIOS +frame) protocol. + +Samba 3.0 also introduces UNICODE support and kerberos/ldap +integration as a member server in a Windows 2000 domain. + +Please refer to the WHATSNEW.txt document for fixup information. +docs directory for implementation details. + +%changelog +* Mon Nov 18 2002 Gerald Carter + - removed change log entries since history + is being maintained in CVS + +%prep +%setup + +%build +## Build main Samba source +cd source + +%ifarch ia64 +libtoolize --copy --force # get it to recognize IA-64 +autoheader +autoconf +EXTRA="-D_LARGEFILE64_SOURCE" +%endif +NUMCPU=`grep processor /proc/cpuinfo | wc -l` +if [ ! -f "configure" ]; then + ./autogen.sh +fi +CFLAGS="$RPM_OPT_FLAGS $EXTRA" ./configure \ + --prefix=%{prefix} \ + --localstatedir=/var \ + --with-configdir=/etc/samba \ + --with-privatedir=/etc/samba \ + --with-fhs \ + --with-quotas \ + --with-smbmount \ + --with-pam \ + --with-pam_smbpass \ + --with-syslog \ + --with-utmp \ + --with-sambabook=%{prefix}/share/swat/using_samba \ + --with-swatdir=%{prefix}/share/swat \ + --with-libsmbclient +make -j${NUMCPU} proto +make -j${NUMCPU} all nsswitch/libnss_wins.so modules +make -j${NUMCPU} debug2html +make -j${NUMCPU} bin/smbspool + +# Remove some permission bits to avoid to many dependencies +find examples docs -type f | xargs -r chmod -x + +%install +rm -rf $RPM_BUILD_ROOT +mkdir -p $RPM_BUILD_ROOT +mkdir -p $RPM_BUILD_ROOT/sbin +mkdir -p $RPM_BUILD_ROOT/etc/samba +mkdir -p $RPM_BUILD_ROOT/etc/{logrotate.d,pam.d,samba} +mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d +mkdir -p $RPM_BUILD_ROOT%{prefix}/{bin,sbin} +mkdir -p $RPM_BUILD_ROOT%{prefix}/share/swat/{images,help,include,using_samba} +mkdir -p $RPM_BUILD_ROOT%{prefix}/share/swat/using_samba/{figs,gifs} +mkdir -p $RPM_BUILD_ROOTMANDIR_MACRO +mkdir -p $RPM_BUILD_ROOT/var/cache/samba +mkdir -p $RPM_BUILD_ROOT/var/{log,run}/samba +mkdir -p $RPM_BUILD_ROOT/var/spool/samba +mkdir -p $RPM_BUILD_ROOT/lib/security +mkdir -p $RPM_BUILD_ROOT%{prefix}/lib/samba/vfs +mkdir -p $RPM_BUILD_ROOT%{prefix}/{lib,include} + +# Install standard binary files +for i in nmblookup smbclient smbpasswd smbstatus testparm testprns \ + rpcclient smbspool smbcacls smbcontrol wbinfo smbmnt net \ + smbcacls pdbedit tdbbackup smbtree +do + install -m755 source/bin/$i $RPM_BUILD_ROOT%{prefix}/bin +done + +for i in mksmbpasswd.sh smbtar findsmb +do + install -m755 source/script/$i $RPM_BUILD_ROOT%{prefix}/bin +done + +# Install secure binary files +for i in smbd nmbd swat smbmount smbumount debug2html winbindd +do + install -m755 source/bin/$i $RPM_BUILD_ROOT%{prefix}/sbin +done + +# we need a symlink for mount to recognise the smb and smbfs filesystem types +ln -sf %{prefix}/sbin/smbmount $RPM_BUILD_ROOT/sbin/mount.smbfs +ln -sf %{prefix}/sbin/smbmount $RPM_BUILD_ROOT/sbin/mount.smb + +# This allows us to get away without duplicating code that +# sombody else can maintain for us. +cd source +make DESTDIR=$RPM_BUILD_ROOT \ + BASEDIR=/usr \ + CONFIGDIR=/etc/samba \ + LIBDIR=%{prefix}/lib/samba \ + VARDIR=/var \ + SBINDIR=%{prefix}/sbin \ + BINDIR=$%{prefix}/bin \ + MANDIR=MANDIR_MACRO \ + SWATDIR=%{prefix}/share/swat \ + SAMBABOOK=%{prefix}/share/swat/using_samba \ + installman installswat installdat installmodules +cd .. + +# Install the nsswitch wins library +install -m755 source/nsswitch/libnss_wins.so $RPM_BUILD_ROOT/lib +( cd $RPM_BUILD_ROOT/lib; ln -sf libnss_wins.so libnss_wins.so.2; ) + +# Install winbind shared libraries +install -m755 source/nsswitch/libnss_winbind.so $RPM_BUILD_ROOT/lib +( cd $RPM_BUILD_ROOT/lib; ln -sf libnss_winbind.so libnss_winbind.so.2; ) +install -m755 source/nsswitch/pam_winbind.so $RPM_BUILD_ROOT/lib/security + +# Install pam_smbpass.so +install -m755 source/bin/pam_smbpass.so $RPM_BUILD_ROOT/lib/security + +# libsmbclient +install -m 755 source/bin/libsmbclient.so $RPM_BUILD_ROOT%{prefix}/lib/ +install -m 755 source/bin/libsmbclient.a $RPM_BUILD_ROOT%{prefix}/lib/ +install -m 644 source/include/libsmbclient.h $RPM_BUILD_ROOT%{prefix}/include/ + +# Install SWAT helper files +#for i in swat/help/*.html docs/htmldocs/*.html +#do +# install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/help +#done +#for i in swat/images/*.gif +#do +# install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/images +#done +#for i in swat/include/*.html +#do +# install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/include +#done + +# Install the miscellany +install -m755 swat/README $RPM_BUILD_ROOT%{prefix}/share/swat/README +install -m755 packaging/RedHat/smbprint $RPM_BUILD_ROOT%{prefix}/bin +install -m755 packaging/RedHat/smb.init $RPM_BUILD_ROOT/etc/rc.d/init.d/smb +install -m755 packaging/RedHat/winbind.init $RPM_BUILD_ROOT/etc/rc.d/init.d/winbind +install -m755 packaging/RedHat/smb.init $RPM_BUILD_ROOT%{prefix}/sbin/samba +install -m644 packaging/RedHat/samba.log $RPM_BUILD_ROOT/etc/logrotate.d/samba +install -m644 packaging/RedHat/smb.conf $RPM_BUILD_ROOT/etc/samba/smb.conf +install -m644 packaging/RedHat/smbusers $RPM_BUILD_ROOT/etc/samba/smbusers +install -m644 packaging/RedHat/samba.pamd $RPM_BUILD_ROOT/etc/pam.d/samba +install -m644 packaging/RedHat/samba.pamd.stack $RPM_BUILD_ROOT/etc/samba/samba.stack +install -m644 packaging/RedHat/samba.xinetd $RPM_BUILD_ROOT/etc/samba/samba.xinetd +echo 127.0.0.1 localhost > $RPM_BUILD_ROOT/etc/samba/lmhosts + +# Remove "*.old" files +find $RPM_BUILD_ROOT -name "*.old" -exec rm -f {} \; + +%clean +rm -rf $RPM_BUILD_ROOT + +%post +if [ "$1" -eq "1" ]; then + /sbin/chkconfig --add smb + /sbin/chkconfig --add winbind + /sbin/chkconfig smb off + /sbin/chkconfig winbind off +fi + +echo "Looking for old /etc/smb.conf..." +if [ -f /etc/smb.conf -a ! -f /etc/samba/smb.conf ]; then + echo "Moving old /etc/smb.conf to /etc/samba/smb.conf" + mv /etc/smb.conf /etc/samba/smb.conf +fi + +echo "Looking for old /etc/smbusers..." +if [ -f /etc/smbusers -a ! -f /etc/samba/smbusers ]; then + echo "Moving old /etc/smbusers to /etc/samba/smbusers" + mv /etc/smbusers /etc/samba/smbusers +fi + +echo "Looking for old /etc/lmhosts..." +if [ -f /etc/lmhosts -a ! -f /etc/samba/lmhosts ]; then + echo "Moving old /etc/lmhosts to /etc/samba/lmhosts" + mv /etc/lmhosts /etc/samba/lmhosts +fi + +echo "Looking for old /etc/MACHINE.SID..." +if [ -f /etc/MACHINE.SID -a ! -f /etc/samba/MACHINE.SID ]; then + echo "Moving old /etc/MACHINE.SID to /etc/samba/MACHINE.SID" + mv /etc/MACHINE.SID /etc/samba/MACHINE.SID +fi + +echo "Looking for old /etc/smbpasswd..." +if [ -f /etc/smbpasswd -a ! -f /etc/samba/smbpasswd ]; then + echo "Moving old /etc/smbpasswd to /etc/samba/smbpasswd" + mv /etc/smbpasswd /etc/samba/smbpasswd +fi + +# +# For 2.2.1 we move the tdb files from /var/lock/samba to /var/cache/samba +# to preserve across reboots. +# +echo "Moving tdb files in /var/lock/samba/*.tdb to /var/cache/samba/*.tdb" +for i in /var/lock/samba/*.tdb +do +if [ -f $i ]; then + newname=`echo $i | sed -e's|var\/lock\/samba|var\/cache\/samba|'` + echo "Moving $i to $newname" + mv $i $newname +fi +done + +# Remove the transient tdb files. +if [ -e /var/cache/samba/brlock.tdb ]; then + rm -f /var/cache/samba/brlock.tdb +fi + +if [ -e /var/cache/samba/unexpected.tdb ]; then + rm -f /var/cache/samba/unexpected.tdb +fi + +if [ -e /var/cache/samba/connections.tdb ]; then + rm -f /var/cache/samba/connections.tdb +fi + +if [ -e /var/cache/samba/locking.tdb ]; then + rm -f /var/cache/samba/locking.tdb +fi + +if [ -e /var/cache/samba/messages.tdb ]; then + rm -f /var/cache/samba/messages.tdb +fi + +if [ -d /var/lock/samba ]; then + rm -rf /var/lock/samba +fi + +# Add swat entry to /etc/services if not already there. +if !( grep ^[:space:]*swat /etc/services > /dev/null ) then + echo 'swat 901/tcp # Add swat service used via inetd' >> /etc/services +fi + +# Add swat entry to /etc/inetd.conf if needed. +if [ -f /etc/inetd.conf ]; then + if !( grep ^[:space:]*swat /etc/inetd.conf > /dev/null ) then + echo 'swat stream tcp nowait.400 root %{prefix}/sbin/swat swat' >> /etc/inetd.conf + killall -1 inetd || : + fi +fi + +# Add swat entry to xinetd.d if needed. +if [ -d $RPM_BUILD_ROOT/etc/xinetd.d -a ! -f /etc/xinetd.d/swat ]; then + mv /etc/samba/samba.xinetd /etc/xinetd.d/swat +else + rm -f /etc/samba/samba.xinetd +fi + +# Install the correct version of the samba pam file, depending on pam version. +if [ -f /lib/security/pam_stack.so ]; then + echo "Installing stack version of /etc/pam.d/samba..." + mv /etc/samba/samba.stack /etc/pam.d/samba +else + echo "Installing non-stack version of /etc/pam.d/samba..." + rm -f /etc/samba/samba.stack +fi + +# Create winbind nss client symlink + +if [ -e /lib/libnss_winbind.so ]; then + ln -sf /lib/libnss_winbind.so /lib/libnss_winbind.so.2 +fi + +%preun +if [ $1 = 0 ] ; then + /sbin/chkconfig --del smb + + # We want to remove the browse.dat and wins.dat files so they can not interfer with a new version of samba! + if [ -e /var/cache/samba/browse.dat ]; then + rm -f /var/cache/samba/browse.dat + fi + if [ -e /var/cache/samba/wins.dat ]; then + rm -f /var/cache/samba/wins.dat + fi + + # Remove the transient tdb files. + if [ -e /var/cache/samba/brlock.tdb ]; then + rm -f /var/cache/samba/brlock.tdb + fi + + if [ -e /var/cache/samba/unexpected.tdb ]; then + rm -f /var/cache/samba/unexpected.tdb + fi + + if [ -e /var/cache/samba/connections.tdb ]; then + rm -f /var/cache/samba/connections.tdb + fi + + if [ -e /var/cache/samba/locking.tdb ]; then + rm -f /var/cache/samba/locking.tdb + fi + + if [ -e /var/cache/samba/messages.tdb ]; then + rm -f /var/cache/samba/messages.tdb + fi + + # Remove winbind nss client symlink + + if [ -L /lib/libnss_winbind.so.2 ]; then + rm -f /lib/libnss_winbind.so.2 + fi +fi + +%postun +# Only delete remnants of samba if this is the final deletion. +if [ $1 = 0 ] ; then + if [ -x /etc/pam.d/samba ]; then + rm -f /etc/pam.d/samba + fi + if [ -e /var/log/samba ]; then + rm -rf /var/log/samba + fi + if [ -e /var/cache/samba ]; then + rm -rf /var/cache/samba + fi + + # Remove swat entries from /etc/inetd.conf and /etc/services + cd /etc + tmpfile=/etc/tmp.$$ + if [ -f /etc/inetd.conf ]; then + # preserve inetd.conf permissions. + cp -p /etc/inetd.conf $tmpfile + sed -e '/^[:space:]*swat.*$/d' /etc/inetd.conf > $tmpfile + mv $tmpfile inetd.conf + fi + # preserve services permissions. + cp -p /etc/services $tmpfile + sed -e '/^[:space:]*swat.*$/d' /etc/services > $tmpfile + mv $tmpfile /etc/services + + # Remove swat entry from /etc/xinetd.d + if [ -f /etc/xinetd.d/swat ]; then + rm -r /etc/xinetd.d/swat + fi +fi + +%files +%defattr(-,root,root) +%doc README COPYING Manifest Read-Manifest-Now +%doc WHATSNEW.txt Roadmap +%doc docs +%doc swat/README +%doc examples +%{prefix}/sbin/smbd +%{prefix}/sbin/nmbd +%{prefix}/sbin/swat +%{prefix}/bin/smbmnt +%{prefix}/sbin/smbmount +%{prefix}/sbin/smbumount +%{prefix}/sbin/winbindd +%{prefix}/sbin/samba +%{prefix}/sbin/debug2html +/sbin/mount.smbfs +/sbin/mount.smb +%{prefix}/bin/mksmbpasswd.sh +%{prefix}/bin/smbclient +%{prefix}/bin/smbspool +%{prefix}/bin/rpcclient +%{prefix}/bin/testparm +%{prefix}/bin/testprns +%{prefix}/bin/findsmb +%{prefix}/bin/smbstatus +%{prefix}/bin/nmblookup +%{prefix}/bin/smbpasswd +%{prefix}/bin/smbtar +%{prefix}/bin/smbprint +%{prefix}/bin/smbcontrol +%{prefix}/bin/wbinfo +%{prefix}/bin/net +%{prefix}/bin/smbcacls +%{prefix}/bin/pdbedit +%{prefix}/bin/tdbbackup +%{prefix}/bin/smbtree +%attr(755,root,root) /lib/libnss_wins.s* +%attr(755,root,root) %{prefix}/lib/samba/vfs/*.so +#%attr(755,root,root) %{prefix}/lib/samba/pdb/*.so +%attr(755,root,root) %{prefix}/lib/samba/*.dat +%{prefix}/include/libsmbclient.h +%{prefix}/lib/libsmbclient.a +%{prefix}/lib/libsmbclient.so +%{prefix}/share/swat/help/* +%{prefix}/share/swat/images/* +%{prefix}/share/swat/include/*.html +%{prefix}/share/swat/lang/*/help/* +%{prefix}/share/swat/lang/*/images/* +%{prefix}/share/swat/lang/*/include/*.html +%{prefix}/share/swat/using_samba/* +%{prefix}/share/swat/README +%config(noreplace) /etc/samba/lmhosts +%config(noreplace) /etc/samba/smb.conf +%config(noreplace) /etc/samba/smbusers +/etc/samba/samba.stack +/etc/samba/samba.xinetd +/etc/rc.d/init.d/smb +/etc/rc.d/init.d/winbind +/etc/logrotate.d/samba +%config(noreplace) /etc/pam.d/samba +MANDIR_MACRO/man1/* +MANDIR_MACRO/man5/* +MANDIR_MACRO/man7/* +MANDIR_MACRO/man8/* +%attr(755,root,root) %dir /var/cache/samba +%dir /var/log/samba +%dir /var/run/samba +%attr(1777,root,root) %dir /var/spool/samba +%attr(-,root,root) /lib/libnss_winbind.so +%attr(-,root,root) /lib/security/pam_winbind.so +%attr(-,root,root) /lib/security/pam_smbpass.so diff --git a/packaging/Solaris/.cvsignore b/packaging/Solaris/.cvsignore new file mode 100644 index 0000000000..3adf27434d --- /dev/null +++ b/packaging/Solaris/.cvsignore @@ -0,0 +1,4 @@ +inetd.conf +pkginfo +prototype +samba.server diff --git a/packaging/SuSE/README b/packaging/SuSE/README new file mode 100644 index 0000000000..5d0af9944a --- /dev/null +++ b/packaging/SuSE/README @@ -0,0 +1,18 @@ +Date: March 29, 2003 + +Note: The current packaging files are NOT officially supported files. +--------------------------------------------------------------------- + +While the SPEC file shows who the original author was, these files imply no warranty of +fitness what so ever. These files are NOT official SuSE files and are NOT supported by +them. If you have ANY problems with the use of these files then please email jht@samba.org +and NOT SuSE support. + + +These files may be used to build Samba-3.0 packages for SuSE Linux 8.1 and/or for +UnitedLinux 1.0 systems. + +Note2: You most likely will need to update to heimdal-0.5.1 or later if you intend to +use any Kerberos functionality. + +- John T. diff --git a/packaging/SuSE/samba-3.0.0-msdfs.diff b/packaging/SuSE/samba-3.0.0-msdfs.diff new file mode 100644 index 0000000000..1e688e64c4 --- /dev/null +++ b/packaging/SuSE/samba-3.0.0-msdfs.diff @@ -0,0 +1,97 @@ +--- source/param/loadparm.c Wed Oct 9 21:17:05 2002 ++++ source/param/loadparm.c Mon Oct 14 16:33:08 2002 +@@ -386,6 +386,8 @@ + BOOL bInheritPerms; + BOOL bInheritACLS; + BOOL bMSDfsRoot; ++ BOOL bMSDfsProxy; ++ char *bMSDfsLinkName; + BOOL bUseClientDriver; + BOOL bDefaultDevmode; + BOOL bNTAclSupport; +@@ -508,6 +510,8 @@ + False, /* bInheritPerms */ + False, /* bInheritACLS */ + False, /* bMSDfsRoot */ ++ False, /* bMSDfsProxy */ ++ NULL, /* bMSDfsLinkName */ + False, /* bUseClientDriver */ + False, /* bDefaultDevmode */ + True, /* bNTAclSupport */ +@@ -1079,6 +1083,8 @@ + + + {"msdfs root", P_BOOL, P_LOCAL, &sDefault.bMSDfsRoot, NULL, NULL, FLAG_SHARE}, ++ {"msdfs proxy", P_BOOL, P_LOCAL, &sDefault.bMSDfsProxy, NULL, NULL, FLAG_SHARE}, ++ {"msdfs link name", P_STRING, P_LOCAL, &sDefault.bMSDfsLinkName, NULL, NULL, FLAG_SHARE}, + {"host msdfs", P_BOOL, P_GLOBAL, &Globals.bHostMSDfs, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + + {"Winbind options", P_SEP, P_SEPARATOR}, +@@ -1730,6 +1736,8 @@ + FN_LOCAL_STRING(lp_veto_oplocks, szVetoOplockFiles) + FN_LOCAL_STRING(lp_driverlocation, szPrinterDriverLocation) + FN_LOCAL_BOOL(lp_msdfs_root, bMSDfsRoot) ++FN_LOCAL_BOOL(lp_msdfs_proxy, bMSDfsProxy) ++FN_LOCAL_STRING(lp_msdfs_link_name, bMSDfsLinkName) + FN_LOCAL_BOOL(lp_autoloaded, autoloaded) + FN_LOCAL_BOOL(lp_preexec_close, bPreexecClose) + FN_LOCAL_BOOL(lp_rootpreexec_close, bRootpreexecClose) +--- source/msdfs/msdfs.c Tue Jul 2 08:34:24 2002 ++++ source/msdfs/msdfs.c Mon Oct 14 16:49:57 2002 +@@ -600,12 +600,38 @@ + int reply_size = 0; + char *pathnamep = pathname; + ++ struct connection_struct conns; ++ struct connection_struct* conn = &conns; ++ int snum; ++ pstring conn_path; ++ struct dfs_path dpi; ++ ++ struct junction_map junction2; ++ parse_dfs_path(pathname, &dpi); ++ pstrcpy(junction2.service_name, dpi.servicename); ++ snum = lp_servicenumber(junction2.service_name); ++ create_conn_struct(conn, snum, conn_path); ++ ++ + ZERO_STRUCT(junction); + + /* get the junction entry */ + if (!pathnamep) + return -1; + ++ if (lp_msdfs_proxy(SNUM(conn))) { ++ DEBUG(10,("running in proxy mode\n")); ++ pstrcpy(pathnamep, "\\"); ++ pstrcat(pathnamep, dpi.hostname); ++ pstrcat(pathnamep, "\\"); ++ pstrcat(pathnamep, dpi.servicename); ++ pstrcat(pathnamep, "\\"); ++ pstrcat(pathnamep, (char *) lp_msdfs_link_name(SNUM(conn))); ++ } else { ++ DEBUG(10,("running in normal mode\n")); ++ } ++ ++ + /* Trim pathname sent by client so it begins with only one backslash. + Two backslashes confuse some dfs clients + */ +@@ -631,6 +657,17 @@ + } + } + ++ if ( lp_msdfs_proxy(SNUM(conn)) ) { ++ DEBUG(10,("running in proxy mode\n")); ++ pstrcpy ( pathnamep, "\\" ); ++ pstrcat ( pathnamep, dpi.hostname); ++ pstrcat ( pathnamep, "\\" ); ++ pstrcat ( pathnamep, dpi.servicename); ++ } else { ++ DEBUG(10,("running in normal mode\n")); ++ } ++ ++ + /* create the referral depeding on version */ + DEBUG(10,("max_referral_level :%d\n",max_referral_level)); + if(max_referral_level<2 || max_referral_level>3) diff --git a/packaging/SuSE/samba-3.0.0-net_ads.diff b/packaging/SuSE/samba-3.0.0-net_ads.diff new file mode 100644 index 0000000000..b1224c0cef --- /dev/null +++ b/packaging/SuSE/samba-3.0.0-net_ads.diff @@ -0,0 +1,140 @@ +diff -Nur source/utils/net.c source/utils/net.c +--- source/utils/net.c Fri Sep 27 09:42:34 2002 ++++ source/utils/net.c Tue Oct 1 12:22:00 2002 +@@ -68,6 +68,7 @@ + int opt_port = 0; + int opt_maxusers = -1; + char *opt_comment = ""; ++char *opt_container = "cn=Users"; + int opt_flags = -1; + int opt_jobid = 0; + int opt_timeout = 0; +@@ -459,6 +460,7 @@ + {"myname", 'n', POPT_ARG_STRING, &opt_requester_name}, + {"conf", 's', POPT_ARG_STRING, &servicesf}, + {"server", 'S', POPT_ARG_STRING, &opt_host}, ++ {"container", 'c', POPT_ARG_STRING, &opt_container}, + {"comment", 'C', POPT_ARG_STRING, &opt_comment}, + {"maxusers", 'M', POPT_ARG_INT, &opt_maxusers}, + {"flags", 'F', POPT_ARG_INT, &opt_flags}, +diff -Nur source/utils/net.h source/utils/net.h +--- source/utils/net.h Tue Jun 25 04:29:09 2002 ++++ source/utils/net.h Tue Oct 1 12:19:51 2002 +@@ -38,10 +38,8 @@ + + extern int opt_maxusers; + extern char *opt_comment; ++extern char *opt_container; + extern int opt_flags; +- +-extern char *opt_comment; +- + extern char *opt_target_workgroup; + extern int opt_long_list_entries; + extern int opt_reboot; +diff -Nur source/utils/net_ads.c source/utils/net_ads.c +--- source/utils/net_ads.c Tue Sep 17 14:15:52 2002 ++++ source/utils/net_ads.c Tue Oct 1 12:33:44 2002 +@@ -255,7 +255,7 @@ + goto done; + } + +- status = ads_add_user_acct(ads, argv[0], opt_comment); ++ status = ads_add_user_acct(ads, argv[0], opt_container, opt_comment); + + if (!ADS_ERR_OK(status)) { + d_printf("Could not add user %s: %s\n", argv[0], +@@ -431,7 +431,7 @@ + goto done; + } + +- status = ads_add_group_acct(ads, argv[0], opt_comment); ++ status = ads_add_group_acct(ads, argv[0], opt_container, opt_comment); + + if (ADS_ERR_OK(status)) { + d_printf("Group %s added\n", argv[0]); +diff -Nur source/utils/net_help.c source/utils/net_help.c +--- source/utils/net_help.c Tue Sep 24 20:10:30 2002 ++++ source/utils/net_help.c Tue Oct 1 13:01:50 2002 +@@ -69,14 +69,14 @@ + "\n\tDelete specified user\n"); + d_printf("\nnet [] user INFO [misc. options] [targets]"\ + "\n\tList the domain groups of the specified user\n"); +- d_printf("\nnet [] user ADD [password] "\ ++ d_printf("\nnet [] user ADD [password] [-c container] "\ + "[-F user flags] [misc. options]"\ + " [targets]\n\tAdd specified user\n"); + + net_common_methods_usage(argc, argv); + net_common_flags_usage(argc, argv); +- d_printf( +- "\t-C or --comment=\tdescriptive comment (for add only)\n"); ++ d_printf("\t-C or --comment=\tdescriptive comment (for add only)\n"); ++ d_printf("\t-c or --container=\tLDAP container, defaults to cn=Users (for add in ADS only)\n"); + return -1; + } + +@@ -85,12 +85,12 @@ + "\n\tList user groups\n\n"); + d_printf("net [] group DELETE [misc. options] [targets]"\ + "\n\tDelete specified group\n"); +- d_printf("\nnet [] group ADD [-C comment]"\ ++ d_printf("\nnet [] group ADD [-C comment] [-c container]"\ + " [misc. options] [targets]\n\tCreate specified group\n"); + net_common_methods_usage(argc, argv); + net_common_flags_usage(argc, argv); +- d_printf( +- "\t-C or --comment=\tdescriptive comment (for add only)\n"); ++ d_printf("\t-C or --comment=\tdescriptive comment (for add only)\n"); ++ d_printf("\t-c or --container=\tLDAP container, defaults to cn=Users (for add in ADS only)\n"); + return -1; + } + +diff -Nur source/libads/ldap_user.c source/libads/ldap_user.c +--- source/libads/ldap_user.c Wed Aug 7 12:33:22 2002 ++++ source/libads/ldap_user.c Tue Oct 1 12:46:08 2002 +@@ -38,7 +38,7 @@ + } + + ADS_STATUS ads_add_user_acct(ADS_STRUCT *ads, const char *user, +- const char *fullname) ++ const char *container, const char *fullname) + { + TALLOC_CTX *ctx; + ADS_MODLIST mods; +@@ -57,7 +60,7 @@ + + if (!(upn = talloc_asprintf(ctx, "%s@%s", user, ads->config.realm))) + goto done; +- if (!(new_dn = talloc_asprintf(ctx, "cn=%s,cn=Users,%s", name, ++ if (!(new_dn = talloc_asprintf(ctx, "cn=%s,%s,%s", name, container, + ads->config.bind_path))) + goto done; + if (!(controlstr = talloc_asprintf(ctx, "%u", UF_NORMAL_ACCOUNT))) +@@ -80,7 +83,7 @@ + } + + ADS_STATUS ads_add_group_acct(ADS_STRUCT *ads, const char *group, +- const char *comment) ++ const char *container, const char *comment) + { + TALLOC_CTX *ctx; + ADS_MODLIST mods; +@@ -93,7 +96,7 @@ + + status = ADS_ERROR(LDAP_NO_MEMORY); + +- if (!(new_dn = talloc_asprintf(ctx, "cn=%s,cn=Users,%s", group, ++ if (!(new_dn = talloc_asprintf(ctx, "cn=%s,%s,%s", group, container, + ads->config.bind_path))) + goto done; + if (!(mods = ads_init_mods(ctx))) +@@ -102,7 +105,7 @@ + ads_mod_str(ctx, &mods, "cn", group); + ads_mod_strlist(ctx, &mods, "objectClass",objectClass); + ads_mod_str(ctx, &mods, "name", group); +- if (comment) ++ if (comment && *comment) + ads_mod_str(ctx, &mods, "description", comment); + ads_mod_str(ctx, &mods, "sAMAccountName", group); + status = ads_gen_add(ads, new_dn, mods); diff --git a/packaging/SuSE/samba-3.0.0-pdb.diff b/packaging/SuSE/samba-3.0.0-pdb.diff new file mode 100644 index 0000000000..4f767c4ac4 --- /dev/null +++ b/packaging/SuSE/samba-3.0.0-pdb.diff @@ -0,0 +1,11 @@ +--- examples/pdb/Makefile Thu Sep 5 02:11:41 2002 ++++ examples/pdb/Makefile Thu Sep 5 02:11:59 2002 +@@ -8,7 +8,7 @@ + SAMBA_INCL = ../../source/include + UBIQX_SRC = ../../source/ubiqx + SMBWR_SRC = ../../source/smbwrapper +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -Wall -g ++CFLAGS = -I/usr/include/heimdal -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -Wall -g + PDB_OBJS = pdb_test.so + + # Default target diff --git a/packaging/SuSE/samba-3.0.0-python.diff b/packaging/SuSE/samba-3.0.0-python.diff new file mode 100644 index 0000000000..8c5931e444 --- /dev/null +++ b/packaging/SuSE/samba-3.0.0-python.diff @@ -0,0 +1,44 @@ +--- source/python/py_common.c 2002-12-22 03:07:40.000000000 +0100 ++++ source/python/py_common.c 2002-11-29 11:50:22.000000000 +0100 +@@ -45,9 +45,6 @@ + + void py_samba_init(void) + { +- extern pstring global_myname; +- char *p; +- + if (initialised) + return; + +@@ -59,11 +56,7 @@ + /* Misc other stuff */ + + load_interfaces(); +- +- fstrcpy(global_myname, myhostname()); +- p = strchr(global_myname, '.'); +- if (p) +- *p = 0; ++ init_names(); + + initialised = True; + } +--- source/python/py_smb.c 2002-11-27 03:54:20.000000000 +0100 ++++ source/python/py_smb.c 2002-11-29 11:50:22.000000000 +0100 +@@ -61,7 +61,6 @@ + static char *kwlist[] = { "called", "calling", NULL }; + char *calling_name = NULL, *called_name; + struct nmb_name calling, called; +- extern pstring global_myname; + BOOL result; + + if (!PyArg_ParseTupleAndKeywords(args, kw, "s|s", kwlist, &called_name, +@@ -69,7 +68,7 @@ + return NULL; + + if (!calling_name) +- calling_name = global_myname; ++ calling_name = global_myname(); + + make_nmb_name(&calling, calling_name, 0x00); + make_nmb_name(&called, called_name, 0x20); diff --git a/packaging/SuSE/samba-3.0.0-vscan.diff b/packaging/SuSE/samba-3.0.0-vscan.diff new file mode 100644 index 0000000000..cb860e3ffb --- /dev/null +++ b/packaging/SuSE/samba-3.0.0-vscan.diff @@ -0,0 +1,80 @@ +--- examples/VFS/samba-vscan-0.3.1/fprot/Makefile 2002-11-26 15:20:17.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.1/fprot/Makefile 2002-12-19 13:26:19.000000000 +0100 +@@ -14,7 +14,7 @@ + SMBWR_SRC = ../../../../source/smbwrapper + SMBVS_INCL = ../include + SMBVS_GLB = ../global +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal + VFS_OBJS = vscan-fprotd.so + SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c vscan-fprotd.c vscan-fprotd_core.c vscan-fprotd.h vscan-fprotd_core.h + OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-fprotd.lo vscan-fprotd_core.lo +--- examples/VFS/samba-vscan-0.3.1/include/vscan-global.h 2002-11-25 16:48:10.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.1/include/vscan-global.h 2002-12-19 13:26:34.000000000 +0100 +@@ -93,7 +93,7 @@ + */ + + #ifndef SAMBA_VERSION_MAJOR +-# define SAMBA_VERSION_MAJOR 2 ++# define SAMBA_VERSION_MAJOR 3 + #endif + + #ifndef SAMBA_VERSION_MINOR +--- examples/VFS/samba-vscan-0.3.1/kaspersky/Makefile 2002-11-28 17:40:35.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.1/kaspersky/Makefile 2002-12-19 13:27:23.000000000 +0100 +@@ -23,9 +23,9 @@ + VFS_OBJS = vscan-kavp.so + + ifdef USE_DEBUG +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal + else +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal + endif + + ifndef USE_KAVPSHAREDLIB +--- examples/VFS/samba-vscan-0.3.1/mks/Makefile 2002-11-26 16:29:55.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.1/mks/Makefile 2002-12-19 13:27:53.000000000 +0100 +@@ -13,7 +13,7 @@ + SMBWR_SRC = ../../../../source/smbwrapper + SMBVS_INCL = ../include + SMBVS_GLB = ../global +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal + VFS_OBJS = vscan-mksd.so + SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c vscan-mksd.c vscan-mksd_core.c vscan-mksd.h vscan-mksd_core.h mks.h mks_c.c + OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-mksd.lo vscan-mksd_core.lo mks_c.lo +--- examples/VFS/samba-vscan-0.3.1/openantivirus/Makefile 2002-11-27 19:24:03.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.1/openantivirus/Makefile 2002-12-19 13:28:10.000000000 +0100 +@@ -15,7 +15,7 @@ + SMBWR_SRC = ../../../../source/smbwrapper + SMBVS_INCL = ../include + SMBVS_GLB = ../global +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal + VFS_OBJS = vscan-oav.so + SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c vscan-oav.c vscan-oav_core.c vscan-oav.h vscan-oav_core.h + OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-oav.lo vscan-oav_core.lo +--- examples/VFS/samba-vscan-0.3.1/sophos/Makefile 2002-11-27 19:24:03.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.1/sophos/Makefile 2002-12-19 13:29:20.000000000 +0100 +@@ -15,7 +15,7 @@ + SMBWR_SRC = ../../../../source/smbwrapper + SMBVS_INCL = ../include + SMBVS_GLB = ../global +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal + VFS_OBJS = vscan-sophos.so + SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c vscan-sophos.c vscan-sophos_core.c vscan-sophos.h vscan-sophos_core.h + OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-sophos.lo vscan-sophos_core.lo +--- examples/VFS/samba-vscan-0.3.1/trend/Makefile 2002-11-27 19:24:03.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.1/trend/Makefile 2002-12-19 13:29:31.000000000 +0100 +@@ -15,7 +15,7 @@ + SMBWR_SRC = ../../../../source/smbwrapper + SMBVS_INCL = ../include + SMBVS_GLB = ../global +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal + VFS_OBJS = vscan-trend.so + SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c vscan-trend.c vscan-trend_core.c vscan-trend.h vscan-trend_core.h + OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-trend.lo vscan-trend_core.lo diff --git a/packaging/SuSE/samba-3.0.0.files.tar.bz2 b/packaging/SuSE/samba-3.0.0.files.tar.bz2 new file mode 100644 index 0000000000..1e8fc9baf0 Binary files /dev/null and b/packaging/SuSE/samba-3.0.0.files.tar.bz2 differ diff --git a/packaging/SuSE/samba-vscan-0.3.1.tar.bz2 b/packaging/SuSE/samba-vscan-0.3.1.tar.bz2 new file mode 100644 index 0000000000..5639279374 Binary files /dev/null and b/packaging/SuSE/samba-vscan-0.3.1.tar.bz2 differ diff --git a/packaging/SuSE/samba3.spec b/packaging/SuSE/samba3.spec new file mode 100644 index 0000000000..dd2860b801 --- /dev/null +++ b/packaging/SuSE/samba3.spec @@ -0,0 +1,764 @@ +# +# spec file for package samba (Version HEAD) CVS +# +# Copyright (c) 2002 SuSE Linux AG, Nuernberg, Germany. +# This file and all modifications and additions to the pristine +# package are under the same license as the package itself. +# +# packaged by Guenther Deschner - work is not finished yet ! + +# neededforbuild acl acl-devel attr attr-devel autoconf automake heimdal-devel heimdal-lib libxml2 libxml2-devel mysql-devel mysql-shared openldap2 openldap2-client openldap2-devel openssl openssl-devel popt popt-devel python python-devel readline readline-devel +# usedforbuild aaa_base aaa_version acl attr bash bind9-utils bison cpio cpp cyrus-sasl db devs diffutils e2fsprogs file filesystem fileutils fillup findutils flex gawk gdbm-devel glibc glibc-devel glibc-locale gpm grep groff gzip kbd less libgcc libstdc++ libxcrypt m4 make man mktemp modutils ncurses ncurses-devel net-tools netcfg pam pam-devel pam-modules patch permissions ps rcs readline sed sendmail sh-utils shadow strace syslogd sysvinit tar texinfo textutils timezone unzip util-linux vim zlib-devel acl-devel attr-devel autoconf automake binutils bzip2 cracklib gcc gdbm gettext heimdal-devel heimdal-lib libtool libxml2 libxml2-devel mysql-devel mysql-shared openldap2 openldap2-client openldap2-devel openssl openssl-devel perl popt popt-devel python python-devel readline-devel rpm zlib + + +Vendor: SuSE Linux AG, GS Berlin, Germany +Distribution: SuSE Linux 8.1 (i386) +Name: samba +Packager: gd@suse.de +License: GPL +Group: Productivity/Networking/Samba +Url: http://www.samba.org +Provides: samba smbfs +Obsoletes: samba-classic samba-ldap +Autoreqprov: on +%define smbwrap 0 +%define mit_kerberos 0 +%define heimdal_kerberos 1 +%define devel 0 +%define head 0 +%define python 1 +%define netatalk 0 +%define newsam 0 +%define samba_ver 3.0.0 +Requires: samba-client = %{samba_ver} +Version: 3.0.0 +Release: %(date +%%j) +Summary: An SMB file server for Unix +Source: %{name}-%{version}.tar.bz2 +Source10: %{name}-%{version}.files.tar.bz2 +Source50: http://prdownloads.sourceforge.net/openantivirus/samba-vscan-%{vscan_ver}.tar.bz2 +Patch1: %{name}-%{version}-pdb.diff +Patch10: %{name}-%{version}-net_ads.diff +Patch22: %{name}-%{version}-msdfs.diff +Patch30: %{name}-%{version}-python.diff +BuildRoot: %{_tmppath}/%{name}-%{version}-buildroot +%define DOCDIR %{_defaultdocdir}/%{name} +%define SWATDIR %{_datadir}/samba/swat +%define vscan_ver 0.3.1 +%define vscan_modules fprot kaspersky mks openantivirus sophos trend +Patch51: %{name}-%{version}-vscan.diff + +%package client +Summary: Samba client utilities +Autoreqprov: on +Requires: cups-libs +Obsoletes: smbclnt samba-classic-client samba-ldap-client +Group: Productivity/Networking/Samba + +%package winbind +Requires: samba-client samba +Summary: Samba Winbind-package +Autoreqprov: on +Group: Productivity/Networking/Samba + +%package utils +Summary: Samba Testing Utilities +Autoreqprov: on +Group: Productivity/Networking/Samba + +%package doc +Summary: Samba Documentation +Autoreqprov: on +Group: Productivity/Networking/Samba + +%package pdb +Summary: Samba PDB-Modules +Autoreqprov: on +Group: Productivity/Networking/Samba + +%package vfs +Summary: Samba VFS-Modules +Autoreqprov: on +Group: Productivity/Networking/Samba + +%if %{newsam} > 0 +%package sam +Summary: Samba SAM-Modules +Autoreqprov: on +Group: Productivity/Networking/Samba +%endif + +%package vscan +Summary: Samba VFS-Modules for Virusscanners +Autoreqprov: on +Group: Productivity/Networking/Samba +Version: 0.3.1 + +%package python +Summary: Samba Python-Modules +Autoreqprov: on +Group: Productivity/Networking/Samba + + + + +%changelog +* Sat Nov 3 2001 - gd@suse.de +- start + + +%prep +[ $RPM_BUILD_ROOT = "/" ] && (echo "your buildroot is /" && exit 0) || rm -rf $RPM_BUILD_ROOT +mkdir $RPM_BUILD_ROOT + +%setup -n %{name}-%{samba_ver} +%setup -T -D -a 50 +cp -ar samba-vscan-%{vscan_ver} examples/VFS/ + +# untar my configs +%setup -T -D -a 10 + +%if %{heimdal_kerberos} > 0 +%patch1 +%patch51 +%endif +#%patch10 +#%patch22 +#%patch30 + +find . -name CVS -print | xargs rm -rf +find . -name ".cvsignore" -print | xargs rm -rf +find . -name "'*.gd'" -print | xargs rm -rvf +find . -name "'*.orig'" -print | xargs rm -rvf + +%build %{name}-%{samba_ver} +%{?suse_update_config:%{suse_update_config -f}} +cd source +./autogen.sh +libtoolize --force --copy +autoconf +export CFLAGS="$RPM_OPT_FLAGS -Wall -O -D_GNU_SOURCE -D_LARGEFILE64_SOURCE" +%ifarch ppc64 +export CFLAGS="$CFLAGS -mminimal-toc" +%endif +CONF_OPTS_BASIC="\ + --prefix=/usr \ + --libdir=/etc/samba \ + --localstatedir=/var/lib/samba \ + --mandir=%{_mandir} \ + --sbindir=/usr/sbin \ + --with-privatedir=/etc/samba \ + --with-piddir=/var/run/samba \ + --with-codepagedir=/usr/share/samba/codepages \ + --with-swatdir=/usr/share/samba/swat \ + --with-smbmount \ + --with-automount \ + --enable-cups \ + --with-msdfs \ + --with-vfs \ + --with-pam \ + --with-pam_smbpass \ + --with-utmp \ + --with-winbind \ + --with-tdbsam \ + --with-ldapsam \ +%if %{smbwrap} + --with-smbwrapper \ +%endif + --with-quotas \ + --with-acl-support \ + --with-python=python2.2 \ + --with-syslog \ +" +CONF_OPTS_HEAD="\ + --with-sam \ +" +CONF_OPTS_HEIMDAL_KERBEROS="\ + --with-krb5impl=heimdal \ +" +CONF_OPTS_HEIMDAL_51_KERBEROS="\ + --with-krb5impl=heimdal \ + --with-krb5includes=/opt/heimdal-0.5.1/include \ + --with-krb5libs=/opt/heimdal-0.5.1/lib \ +" +CONF_OPTS_MIT_KERBEROS="\ + --with-krb5impl=mit \ + --with-krb5includes=/usr/kerberos/include \ + --with-krb5libs=/usr/kerberos/lib \ +" +CONF_OPTS_DEVEL="\ + --enable-developer \ + --enable-krb5developer \ + --with-profiling-data \ +" +CONF_OPTS="$CONF_OPTS_BASIC" +%if %{head} > 0 +CONF_OPTS="$CONF_OPTS $CONF_OPTS_HEAD" +%endif +%if %{heimdal_kerberos} > 0 +CONF_OPTS="$CONF_OPTS $CONF_OPTS_HEIMDAL_KERBEROS" +%endif +%if %{mit_kerberos} > 0 +CONF_OPTS="$CONF_OPTS $CONF_OPTS_MIT_KERBEROS" +%endif +%if %{devel} > 0 +CONF_OPTS="$CONF_OPTS $CONF_OPTS_DEVEL" +%endif + +./configure $CONF_OPTS + +### --with-ldapsam is now standard! +### --with-sendfile-support ---default now +# --with-nisplussam \ +# --with-nisplus_home \ + +# with the new passdb-code we can finaly compile several passdb-backends +# and make our choice at runtime. +# HEAD and thus alpha21 no longer need this +#make proto + +make \ + LOCKDIR=/var/lib/samba \ + LOGFILEBASE=/var/log/samba \ + SBINDIR=/usr/sbin \ + all \ + torture \ + nsswitch/libnss_wins.so \ + debug2html \ + libsmbclient \ + bin/profiles \ + everything + +# everything = nsswitch smbwrapper smbtorture debug2html smbfilter nsswitch/libnss_wins.so + +%if %{newsam} > 0 +make bin/samtest +%endif +make modules + +make -C tdb tdbdump tdbtest tdbtool tdbtorture +# tdbbackup is now in main Makefile + +make talloctort + +# VFS,PDB and SAM +EXAMPLEDIRS="pdb" +for i in $EXAMPLEDIRS; do make -C ../examples/$i; done + +export USE_KAVPSHAREDLIB=0 +for module in %{vscan_modules}; do + make -C ../examples/VFS/%{name}-vscan-%{vscan_ver}/${module}; +done + +# tim potters python +%if %{python} > 0 +make python_ext +%endif + + + +%install + +mkdir -p \ + $RPM_BUILD_ROOT/usr/{bin,sbin} \ + $RPM_BUILD_ROOT/usr/share/{man,samba/{scripts,swat}} \ + $RPM_BUILD_ROOT/usr/lib/samba/{vfs,pdb,sam,vscan} \ + $RPM_BUILD_ROOT/usr/lib/python2.2/lib-dynload \ + $RPM_BUILD_ROOT/usr/include \ + $RPM_BUILD_ROOT/etc/{pam.d,init.d,samba} \ + $RPM_BUILD_ROOT/var/adm \ + $RPM_BUILD_ROOT/sbin \ + $RPM_BUILD_ROOT/lib/security \ + $RPM_BUILD_ROOT/%{DOCDIR} \ + $RPM_BUILD_ROOT/%{DOCDIR}-vscan \ + $RPM_BUILD_ROOT/var/spool/samba \ + $RPM_BUILD_ROOT/var/log/samba \ + $RPM_BUILD_ROOT/var/run/samba \ + $RPM_BUILD_ROOT/var/lib/samba/{netlogon,drivers/{W32X86,WIN40,W32ALPHA,W32MIPS,W32PPC},profiles} + +cd source/ +make install \ + LIBDIR=$RPM_BUILD_ROOT/etc/samba \ + LOGFILEBASE=$RPM_BUILD_ROOT/var/log/samba \ + CONFIGFILE=$RPM_BUILD_ROOT/etc/samba/smb.conf \ + LMHOSTSFILE=$RPM_BUILD_ROOT/etc/samba/lmhosts \ + SWATDIR=$RPM_BUILD_ROOT/usr/share/samba/swat \ + SBINDIR=$RPM_BUILD_ROOT/usr/sbin \ + LOCKDIR=$RPM_BUILD_ROOT/var/lock/samba \ + CODEPAGEDIR=$RPM_BUILD_ROOT/usr/share/samba/codepages \ + DRIVERFILE=$RPM_BUILD_ROOT/etc/samba/printers.def \ + BINDIR=$RPM_BUILD_ROOT/usr/bin \ + SMB_PASSWD_FILE=$RPM_BUILD_ROOT/etc/samba/smbpasswd \ + TDB_PASSWD_FILE=$RPM_BUILD_ROOT/etc/samba/smbpasswd.tdb \ + MANDIR=$RPM_BUILD_ROOT/usr/share/man +cd .. + +# utility scripts +%if %{head} > 0 +scripts="creategroup cvslog.pl scancvslog.pl" +%else +scripts="scancvslog.pl" +%endif +for i in $scripts; do + cp -a source/script/$i $RPM_BUILD_ROOT/usr/share/samba/scripts/ +done + +# move the man-pages (ugly lang thing, fixed in alpha16) +#mv $RPM_BUILD_ROOT/usr/share/man/lang/* $RPM_BUILD_ROOT/usr/share/man/ + +# configuration files +install -m 644 smb.conf* $RPM_BUILD_ROOT/etc/samba/ +install -m 644 shares.conf $RPM_BUILD_ROOT/etc/samba/ +install -m 644 lmhosts $RPM_BUILD_ROOT/etc/samba/ +install -m 600 smbpasswd -o root -g root $RPM_BUILD_ROOT/etc/samba/ + +# pam +install -m 644 samba.pamd $RPM_BUILD_ROOT/etc/pam.d/samba + +# sambamount +ln -sf /usr/bin/smbmount $RPM_BUILD_ROOT/sbin/mount.smbfs + +# start scripts +install rc.smb $RPM_BUILD_ROOT/etc/init.d/smb +ln -sf ../../etc/init.d/smb $RPM_BUILD_ROOT/usr/sbin/rcsmb +install rc.smbfs $RPM_BUILD_ROOT/etc/init.d/smbfs +ln -sf ../../etc/init.d/smbfs $RPM_BUILD_ROOT/usr/sbin/rcsmbfs +install rc.winbind $RPM_BUILD_ROOT/etc/init.d/winbind +ln -sf ../../etc/init.d/winbind $RPM_BUILD_ROOT/usr/sbin/rcwinbind +install rc.wrepl $RPM_BUILD_ROOT/etc/init.d/wrepl +ln -sf ../../etc/init.d/wrepl $RPM_BUILD_ROOT/usr/sbin/rcwrepl + +#### disabled for 8.0 +### rc.config fragment +mkdir -p $RPM_BUILD_ROOT/var/adm/fillup-templates +cp rc.config.samba $RPM_BUILD_ROOT/var/adm/fillup-templates +cp rc.config.winbind $RPM_BUILD_ROOT/var/adm/fillup-templates +cp rc.config.wrepl $RPM_BUILD_ROOT/var/adm/fillup-templates + +# libnss_wins.so +cp source/nsswitch/libnss_wins.so $RPM_BUILD_ROOT/lib/libnss_wins.so +ln -sf /lib/libnss_wins.so $RPM_BUILD_ROOT/lib/libnss_wins.so.2 + +# winbind stuff +cp -a source/nsswitch/pam_winbind.so $RPM_BUILD_ROOT/lib/security/ +cp -a source/nsswitch/libnss_winbind.so $RPM_BUILD_ROOT/lib/ +cp -a source/bin/winbindd $RPM_BUILD_ROOT/usr/sbin/ +ln -sf /lib/libnss_winbind.so $RPM_BUILD_ROOT/lib/libnss_winbind.so.2 + +# pam_smbpass +cp -a source/bin/pam_smbpass.so $RPM_BUILD_ROOT/lib/security/ + +# smbfilter +cp -a source/bin/smbfilter $RPM_BUILD_ROOT/usr/bin/ + + +%{?suse_check} + +## install libsmbclient +install -m0755 source/bin/{libsmbclient.so,libsmbclient.a} $RPM_BUILD_ROOT/%{_libdir} +ln -s /usr/lib/libsmbclient.so $RPM_BUILD_ROOT/%{_libdir}/libsmbclient.so.0 +install -m0644 source/include/libsmbclient.h $RPM_BUILD_ROOT/%{_includedir} + +# install smbtorture and other test-programs +install -m0755 source/bin/smbtorture $RPM_BUILD_ROOT/usr/bin/ +install -m0755 source/bin/talloctort $RPM_BUILD_ROOT/usr/bin/ +install -m0755 source/bin/{msgtest,masktest,locktest*} $RPM_BUILD_ROOT/usr/bin/ +install -m0755 source/bin/{vfstest,nsstest} $RPM_BUILD_ROOT/usr/bin/ +%if %{head} > 0 +%if %{newsam} > 0 +install -m0755 source/bin/samtest $RPM_BUILD_ROOT/usr/bin/ +%endif +%endif + +# install tdb tools +install -m0755 source/tdb/{tdbdump,tdbtest,tdbtool,tdbtorture} $RPM_BUILD_ROOT/usr/bin/ + + +# install VFS-modules +%if %{head} > 0 +install -m0755 source/bin/developer.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ +#install -m0755 examples/VFS/block/block.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ +#install -m0755 examples/VFS/skel.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ +%else +#install -m0755 examples/VFS/block/block.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ +#install -m0755 examples/VFS/skel.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ +%endif +install -m0755 source/bin/vfs_audit.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ +install -m0755 source/bin/vfs_extd_audit.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ +install -m0755 source/bin/vfs_recycle.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ +%if %{netatalk} +install -m0755 source/bin/vfs_netatalk.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ +%endif + +# install PDB-modules +%if %{head} > 0 +install -m0755 source/bin/xml.so $RPM_BUILD_ROOT/%{_libdir}/samba/pdb/ +install -m0755 source/bin/mysql.so $RPM_BUILD_ROOT/%{_libdir}/samba/pdb/ +%else +install -m0755 source/bin/pdb_xml.so $RPM_BUILD_ROOT/%{_libdir}/samba/pdb/ +install -m0755 source/bin/pdb_mysql.so $RPM_BUILD_ROOT/%{_libdir}/samba/pdb/ +%endif +install -m0755 examples/pdb/pdb_test.so $RPM_BUILD_ROOT/%{_libdir}/samba/pdb/ + +# install SAM-modules +%if %{head} > 0 +%if %{newsam} > 0 +install -m0755 examples/sam/sam_skel.so $RPM_BUILD_ROOT/%{_libdir}/samba/sam/ +%endif +%endif + +# install VSCAN-vfs-modules +install -m0755 examples/VFS/%{name}-vscan-%{vscan_ver}/*/*.so $RPM_BUILD_ROOT/%{_libdir}/samba/vscan/ + +# make examples clean +VFS="$RPM_BUILD_DIR/%{name}-%{samba_ver}/examples/VFS" +VSCAN="$VFS/%{name}-vscan-%{vscan_ver}" +PDB="$RPM_BUILD_DIR/%{name}-%{samba_ver}/examples/pdb" +%if %{head} > 0 +%if %{newsam} > 0 +SAM="$RPM_BUILD_DIR/%{name}-%{samba_ver}/examples/sam" +%endif +%endif +dirs="$PDB $SAM" +(for i in $dirs; do make -C $i clean; done) +(for i in %{vscan_modules}; do make -C $VSCAN/$i clean; done) + +%if %{python} > 0 +# install python +cp -a source/build/lib.*/samba $RPM_BUILD_ROOT/usr/lib/python2.2/lib-dynload/ +%endif + +# whats this ? +install -m0755 source/bin/debug2html $RPM_BUILD_ROOT/usr/bin/ + +%if %{smbwrap} +# install smbwrapper +install -m0755 source/bin/smbwrapper.so $RPM_BUILD_ROOT/%{_libdir}/samba/ +install -m0755 source/bin/smbsh $RPM_BUILD_ROOT/usr/bin/ +%endif + +# finally obsolete with alpha17 makefile +# install unicode-codepages +#install -m0755 source/codepages/{lowcase,upcase,valid}.dat $RPM_BUILD_ROOT/etc/samba/ + +# cleanup docs +rm -rf docs/*.[0-9] +chmod 644 `find docs examples -type f` +chmod 755 `find docs examples -type d` +mv COPYING Manifest README Read-Manifest-Now Roadmap WHATSNEW.txt $RPM_BUILD_ROOT/%{DOCDIR}/ +cp source/msdfs/README $RPM_BUILD_ROOT/%{DOCDIR}/README.msdfs +#cp source/nsswitch/README $RPM_BUILD_ROOT/%{DOCDIR}/README.nsswitch +cp source/smbwrapper/README $RPM_BUILD_ROOT/%{DOCDIR}/README.smbwrapper +cp -a docs/* $RPM_BUILD_ROOT/%{DOCDIR} +cp -a examples/ $RPM_BUILD_ROOT/%{DOCDIR} +# save space... +rm -r \ + $RPM_BUILD_ROOT/%{SWATDIR}/using_samba +ln -s %{DOCDIR}/htmldocs/using_samba $RPM_BUILD_ROOT/%{SWATDIR} + + +%post +###### disabled for 8.1 +###echo "Updating etc/rc.config..." +##if [ -x bin/fillup ] ; then +## bin/fillup -q -d = etc/rc.config var/adm/fillup-templates/rc.config.samba +## bin/fillup -q -d = etc/rc.config var/adm/fillup-templates/rc.config.winbind +##else +## echo "ERROR: fillup not found. This should not happen. Please compare" +## echo "etc/rc.config and var/adm/fillup-templates/rc.config.samba and" +## echo "var/adm/fillup-templates/rc.config.winbind and update by hand." +##fi +mkdir -p $RPM_BUILD_ROOT/var/adm/notify/messages +cat << EOF > var/adm/notify/messages/samba-notify +Achtung! + +This is %{name}-%{samba_ver}. Please do not run on production systems. + +You have been warned. +EOF + +# Initialize runlevel links +# +%{fillup_and_insserv smb} +#sbin/insserv /etc/init.d/smb + +%post client +#sbin/insserv /etc/init.d/smbfs +%{fillup_and_insserv -fpy smbfs} +%{fillup_only -ans samba client} + +%postun +%{insserv_cleanup} +#sbin/insserv /etc/init.d/ + +%postun client +%{insserv_cleanup} +#sbin/insserv /etc/init.d/ + +%post winbind +%{fillup_and_insserv winbind} +#sbin/insserv /etc/init.d/winbind + +%postun winbind +%{insserv_cleanup} +#sbin/insserv /etc/init.d/ + +%clean +#make -C source realclean + +%files +%config(noreplace) /etc/samba/smbpasswd +%config /etc/pam.d/samba +%config /etc/init.d/smb +%config /etc/init.d/wrepl +#/usr/bin/make_printerdef +/usr/bin/addtosmbpass +/usr/bin/convert_smbpasswd +/usr/bin/ntlm_auth +/usr/bin/profiles +/usr/bin/smbfilter +/usr/bin/smbpasswd +/usr/bin/smbstatus +/usr/bin/testparm +/usr/bin/testprns +#%doc %{_mandir}/man1/smbrun.1.gz +%doc %{_mandir}/man1/smbsh.1.gz +%doc %{_mandir}/man1/smbstatus.1.gz +%doc %{_mandir}/man1/testparm.1.gz +%doc %{_mandir}/man1/testprns.1.gz +%doc %{_mandir}/man5/smbpasswd.5.gz +%doc %{_mandir}/man7/samba.7.gz +%doc %{_mandir}/man8/nmbd.8.gz +%doc %{_mandir}/man8/smbd.8.gz +%doc %{_mandir}/man8/smbpasswd.8.gz +%doc %{_mandir}/man8/swat.8.gz +/usr/sbin/nmbd +/usr/sbin/smbd +/usr/sbin/swat +/usr/sbin/wrepld +/usr/sbin/rcsmb +/usr/sbin/rcwrepl +#/var/adm/fillup-templates/rc.config.samba +/var/log/samba +/var/spool/samba +/var/run/samba +/var/lib/samba +/usr/share/samba +/lib/security/pam_smbpass.so + +%files client +%config(noreplace) /etc/samba/smb.conf +%config(noreplace) /etc/samba/lmhosts +/etc/samba/lowcase.dat +/etc/samba/upcase.dat +/etc/samba/valid.dat +%config /etc/init.d/smbfs +/usr/sbin/rcsmbfs +/sbin/mount.smbfs +/usr/bin/findsmb +/usr/bin/net +/usr/bin/nmblookup +/usr/bin/pdbedit +/usr/bin/rpcclient +/usr/bin/smbcacls +/usr/bin/smbcontrol +/usr/bin/smbclient +/usr/bin/smbmnt +/usr/bin/smbmount +%if %{smbwrap} +/usr/bin/smbsh +%endif +/usr/bin/smbumount +/usr/bin/smbspool +/usr/bin/smbtar +/usr/bin/smbtree +%doc %{_mandir}/man1/nmblookup.1.gz +%doc %{_mandir}/man1/rpcclient.1.gz +%doc %{_mandir}/man1/smbclient.1.gz +%doc %{_mandir}/man1/smbcacls.1.gz +%doc %{_mandir}/man1/smbcontrol.1.gz +%doc %{_mandir}/man1/smbtar.1.gz +%doc %{_mandir}/man5/lmhosts.5.gz +%doc %{_mandir}/man5/smb.conf.5.gz +%doc %{_mandir}/man8/net.8.gz +%doc %{_mandir}/man8/pdbedit.8.gz +%doc %{_mandir}/man8/smbmnt.8.gz +%doc %{_mandir}/man8/smbmount.8.gz +%doc %{_mandir}/man8/smbspool.8.gz +%doc %{_mandir}/man8/smbumount.8.gz +/usr/include/libsmbclient.h +%if %{smbwrap} +/usr/lib/samba/smbwrapper.so +%endif +/usr/lib/libsmbclient.a +/usr/lib/libsmbclient.so +/usr/lib/libsmbclient.so.0 + +%files winbind +%config(noreplace) /etc/samba/smb.conf.winbind +%config /etc/init.d/winbind +%doc %{_mandir}/man1/wbinfo.1.gz +%doc %{_mandir}/man8/winbindd.8.gz +/usr/bin/wbinfo +%if %{head} > 0 +/usr/bin/ntlm_auth +%endif +/usr/sbin/winbindd +/usr/sbin/rcwinbind +#/var/adm/fillup-templates/rc.config.winbind +/lib/security/pam_winbind.so +/lib/libnss_winbind.so +/lib/libnss_winbind.so.2 +/lib/libnss_wins.so +/lib/libnss_wins.so.2 + +%files utils +/usr/bin/smbtorture +/usr/bin/msgtest +/usr/bin/masktest +/usr/bin/locktest +/usr/bin/locktest2 +/usr/bin/debug2html +/usr/bin/talloctort +/usr/bin/tdbbackup +/usr/bin/tdbdump +/usr/bin/tdbtest +/usr/bin/tdbtool +/usr/bin/tdbtorture +/usr/bin/vfstest +/usr/bin/nsstest +%if %{head} > 0 +%if %{newsam} > 0 +/usr/bin/samtest +%endif +/usr/bin/profiles +/usr/bin/editreg +%endif +%doc %{_mandir}/man1/vfstest.1.gz + +%files doc +%docdir %{DOCDIR} +%{DOCDIR} + +%files pdb +/usr/lib/samba/pdb +%doc examples/pdb/* + +%files vfs +/usr/lib/samba/vfs +%doc examples/VFS/README* +%doc examples/VFS/Makefile* +#doc examples/VFS/audit* +#%doc examples/VFS/block* +#doc examples/VFS/netatalk* +#doc examples/VFS/recycle* +%doc examples/VFS/skel* + +%if %{newsam} > 0 +%files sam +/usr/lib/samba/sam +%if %{head} > 0 +%doc examples/sam/* +%endif +%endif + +%files vscan +/usr/lib/samba/vscan +%doc %{name}-vscan-%{vscan_ver}/{AUTHORS,COPYING,ChangeLog,FAQ,NEWS,README,TODO} + + +%files python +%doc source/python/README +%if %{python} > 0 +/usr/lib/python2.2/lib-dynload/samba +%doc source/python/examples +%doc source/python/gprinterdata +%doc source/python/gtdbtool +%doc source/python/gtkdictbrowser.py +%if %{head} > 0 +%doc source/python/gtkdictbrowser.pyc +%doc source/python/printerdata.pyc +%endif +%endif + +%description +Samba is a suite of programs which work together to allow clients to +access Unix filespace and printers via the SMB protocol (Server Message +Block). +In practice, this means that you can redirect disks and printers to +Unix disks and printers from LAN Manager clients, Windows for +Workgroups 3.11 clients, Windows'95 clients, Windows NT clients +and OS/2 clients. There is +also a Unix client program supplied as part of the suite which allows +Unix users to use an ftp-like interface to access filespace and +printers on any other SMB server. +Samba includes the following programs (in summary): +* smbd, the SMB server. This handles actual connections from clients. +* nmbd, the Netbios name server, which helps clients locate servers. +* smbclient, the Unix-hosted client program. +* smbrun, a little 'glue' program to help the server run external +programs. +* testprns, a program to test server access to printers. +* testparm, a program to test the Samba configuration file for correctness. +* smb.conf, the Samba configuration file. +* smbprint, a sample script to allow a Unix host to use smbclient +to print to an SMB server. +The suite is supplied with full source and is GPLed. +This package expects its config file under /etc/smb.conf . + +Authors: +-------- + Andrew Tridgell + Karl Auer + Jeremy Allison + +SuSE series: n + + +%description client +This package contains all programs, that are needed to act as a samba +client. This includes also smbmount, of course. + +Authors: +-------- + Andrew Tridgell + Karl Auer + Jeremy Allison + +SuSE series: n + + +%description winbind +This is the winbind-daemon and the wbinfo-tool. + +%description utils +Some of the debug-tools for developpers. +Contains: + - debug2html + - locktest + - locktest2 + - masktest + - msgtest + - smbtorture + - talloctort + - several tdb-tools + +%description doc +The Samba Documentation. + +%description vfs +The Samba VFS-Modules. + +%description pdb +The Samba PDB-Modules. + +%if %{newsam} > 0 +%description sam +The Samba SAM-Modules. +%endif + +%description vscan +The Samba VFS-Modules for Virusscanners. + +%description python +The Samba python-Modules. diff --git a/source3/build-me b/source3/build-me new file mode 100755 index 0000000000..a5d3f32f70 --- /dev/null +++ b/source3/build-me @@ -0,0 +1,36 @@ +#!/bin/sh + +umask 022 + +## Build options +CONFIGUREOPT="--enable-debug --enable-developer --with-pam --with-libsmbclient=no --with-static-modules" +export CONFIGUREOPT + +./autogen.sh + +case "$1" in + dmalloc) + env CFLAGS="-Wall" ./configure \ + --enable-dmalloc \ + $CONFIGUREOPT + ;; + insure) + env CFLAGS="-g" CC="insure" ./configure \ + $CONFIGUREOPT + ;; + ccache) + env CFLAGS="-Wall" CC="ccache gcc" ./configure \ + $CONFIGUREOPT + ;; + *) + env CFLAGS="-Wall" ./configure \ + $CONFIGUREOPT + ;; +esac + +## disable optimization +sed 's/-O //g' Makefile | sed 's/-O2 //g' > Makefile.new; /bin/mv -f Makefile.new Makefile + +## build +make proto +make all modules diff --git a/source3/include/smbldap.h b/source3/include/smbldap.h new file mode 100644 index 0000000000..589d01aa6d --- /dev/null +++ b/source3/include/smbldap.h @@ -0,0 +1,142 @@ +/* + Unix SMB/CIFS mplementation. + LDAP protocol helper functions for SAMBA + Copyright (C) Gerald Carter 2001-2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + +*/ + +#ifndef _SMBLDAP_H +#define _SMBLDAP_H + +#ifdef HAVE_LDAP + +/* specify schema versions between 2.2. and 3.0 */ + +#define SCHEMAVER_SAMBAACCOUNT 1 +#define SCHEMAVER_SAMBASAMACCOUNT 2 + +/* objectclass names */ + +#define LDAP_OBJ_SAMBASAMACCOUNT "sambaSamAccount" +#define LDAP_OBJ_SAMBAACCOUNT "sambaAccount" +#define LDAP_OBJ_GROUPMAP "sambaGroupMapping" +#define LDAP_OBJ_DOMINFO "sambaDomain" +#define LDAP_OBJ_IDPOOL "sambaUnixIdPool" +#define LDAP_OBJ_IDMAP_ENTRY "sambaIdmapEntry" +#define LDAP_OBJ_SID_ENTRY "sambaSidEntry" + +#define LDAP_OBJ_ACCOUNT "account" +#define LDAP_OBJ_POSIXACCOUNT "posixAccount" +#define LDAP_OBJ_POSIXGROUP "posixGroup" +#define LDAP_OBJ_OU "organizationalUnit" + +/* some generic attributes that get reused a lot */ + +#define LDAP_ATTRIBUTE_SID "sambaSID" +#define LDAP_ATTRIBUTE_UIDNUMBER "uidNumber" +#define LDAP_ATTRIBUTE_GIDNUMBER "gidNumber" + +/* attribute map table indexes */ + +#define LDAP_ATTR_LIST_END 0 +#define LDAP_ATTR_UID 1 +#define LDAP_ATTR_UIDNUMBER 2 +#define LDAP_ATTR_GIDNUMBER 3 +#define LDAP_ATTR_UNIX_HOME 4 +#define LDAP_ATTR_PWD_LAST_SET 5 +#define LDAP_ATTR_PWD_CAN_CHANGE 6 +#define LDAP_ATTR_PWD_MUST_CHANGE 7 +#define LDAP_ATTR_LOGON_TIME 8 +#define LDAP_ATTR_LOGOFF_TIME 9 +#define LDAP_ATTR_KICKOFF_TIME 10 +#define LDAP_ATTR_CN 11 +#define LDAP_ATTR_DISPLAY_NAME 12 +#define LDAP_ATTR_HOME_PATH 13 +#define LDAP_ATTR_LOGON_SCRIPT 14 +#define LDAP_ATTR_PROFILE_PATH 15 +#define LDAP_ATTR_DESC 16 +#define LDAP_ATTR_USER_WKS 17 +#define LDAP_ATTR_USER_SID 18 +#define LDAP_ATTR_USER_RID 18 +#define LDAP_ATTR_PRIMARY_GROUP_SID 19 +#define LDAP_ATTR_PRIMARY_GROUP_RID 20 +#define LDAP_ATTR_LMPW 21 +#define LDAP_ATTR_NTPW 22 +#define LDAP_ATTR_DOMAIN 23 +#define LDAP_ATTR_OBJCLASS 24 +#define LDAP_ATTR_ACB_INFO 25 +#define LDAP_ATTR_NEXT_USERRID 26 +#define LDAP_ATTR_NEXT_GROUPRID 27 +#define LDAP_ATTR_DOM_SID 28 +#define LDAP_ATTR_HOME_DRIVE 29 +#define LDAP_ATTR_GROUP_SID 30 +#define LDAP_ATTR_GROUP_TYPE 31 +#define LDAP_ATTR_SID 32 +#define LDAP_ATTR_ALGORITHMIC_RID_BASE 33 +#define LDAP_ATTR_NEXT_RID 34 + +typedef struct _attrib_map_entry { + int attrib; + const char *name; +} ATTRIB_MAP_ENTRY; + + +/* structures */ + +extern ATTRIB_MAP_ENTRY attrib_map_v22[]; +extern ATTRIB_MAP_ENTRY attrib_map_v30[]; +extern ATTRIB_MAP_ENTRY dominfo_attr_list[]; +extern ATTRIB_MAP_ENTRY groupmap_attr_list[]; +extern ATTRIB_MAP_ENTRY groupmap_attr_list_to_delete[]; +extern ATTRIB_MAP_ENTRY idpool_attr_list[]; +extern ATTRIB_MAP_ENTRY sidmap_attr_list[]; + +/* Function declarations -- not included in proto.h so we don't + have to worry about LDAP structure types */ + +const char* get_attr_key2string( ATTRIB_MAP_ENTRY table[], int key ); +char** get_attr_list( ATTRIB_MAP_ENTRY table[] ); +void free_attr_list( char **list ); +void smbldap_set_mod (LDAPMod *** modlist, int modop, const char *attribute, const char *value); +void smbldap_make_mod(LDAP *ldap_struct, LDAPMessage *existing, + LDAPMod ***mods, + const char *attribute, const char *newval); +BOOL smbldap_get_single_attribute (LDAP * ldap_struct, LDAPMessage * entry, + const char *attribute, pstring value); + +/** + * Struct to keep the state for all the ldap stuff + * + */ + +struct smbldap_state { + LDAP *ldap_struct; + time_t last_ping; + /* retrive-once info */ + const char *uri; + char *bind_dn; + char *bind_secret; + + unsigned int num_failures; +}; + +#endif /* HAVE_LDAP */ + +struct smbldap_state; + +#endif /* _SMBLDAP_H */ + diff --git a/source3/include/sysquotas.h b/source3/include/sysquotas.h new file mode 100644 index 0000000000..cfdac0609a --- /dev/null +++ b/source3/include/sysquotas.h @@ -0,0 +1,204 @@ +/* + Unix SMB/CIFS implementation. + SYS QUOTA code constants + Copyright (C) Stefan (metze) Metzmacher 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#ifndef _SYSQUOTAS_H +#define _SYSQUOTAS_H + +#ifdef HAVE_SYS_QUOTAS + +/* Sometimes we need this on linux for linux/quota.h */ +#ifdef HAVE_SYS_TYPES_H +#include +#endif + +#ifdef HAVE_ASM_TYPES_H +#include +#endif + +/* + * This shouldn't be neccessary - it should be /usr/include/sys/quota.h + * Unfortunately, RH7.1 ships with a different quota system using struct mem_dqblk + * rather than the struct dqblk defined in /usr/include/sys/quota.h. + * This means we must include linux/quota.h to have a hope of working on + * RH7.1 systems. And it also means this breaks if the kernel is upgraded + * to a Linus 2.4.x (where x > the minor number shipped with RH7.1) until + * Linus synchronises with the AC patches. Sometimes I *hate* Linux :-). JRA. + */ +#ifdef HAVE_LINUX_QUOTA_H +#include +#elif defined(HAVE_SYS_QUOTA_H) +#include +#endif + +#if defined(HAVE_STRUCT_IF_DQBLK) +# define SYS_DQBLK if_dqblk +# define dqb_curblocks dqb_curspace/bsize +#elif defined(HAVE_STRUCT_MEM_DQBLK) +# define SYS_DQBLK mem_dqblk +# define dqb_curblocks dqb_curspace/bsize +#else /* STRUCT_DQBLK */ +# define SYS_DQBLK dqblk +#endif + +#ifndef Q_SETQLIM +#define Q_SETQLIM Q_SETQUOTA +#endif + +/********************************************* + check for XFS QUOTA MANAGER + *********************************************/ +/* on linux */ +#ifdef HAVE_LINUX_XQM_H +# include +# define HAVE_XFS_QUOTA +#else +# ifdef HAVE_XFS_XQM_H +# include +# define HAVE_XFS_QUOTA +# else +# ifdef HAVE_LINUX_DQBLK_XFS_H +# include +# define HAVE_XFS_QUOTA +# endif +# endif +#endif +/* on IRIX */ +#ifdef Q_XGETQUOTA +# ifndef HAVE_XFS_QUOTA +# define HAVE_XFS_QUOTA +# ifndef Q_XQUOTAON +# define Q_XQUOTAON Q_QUOTAON +# endif /* Q_XQUOTAON */ +# ifndef Q_XQUOTAOFF +# define Q_XQUOTAOFF Q_QUOTAOFF +# endif /* Q_XQUOTAOFF */ +# ifndef Q_XGETQSTAT +# define Q_XGETQSTAT Q_GETQSTAT +# endif /* Q_XGETQSTAT */ +# endif /* HAVE_XFS_QUOTA */ +#endif /* Q_XGETQUOTA */ + +#ifdef HAVE_XFS_QUOTA +/* Linux has BBSIZE in + * or + * IRIX has BBSIZE in + */ +#ifdef HAVE_LINUX_XFS_FS_H +#include +#elif defined(HAVE_XFS_XFS_FS_H) +#include +#endif /* *_XFS_FS_H */ + +#ifndef BBSHIFT +#define BBSHIFT 9 +#endif /* BBSHIFT */ +#ifndef BBSIZE +#define BBSIZE (1< +#define HAVE_MNTENT 1 +/*#endif defined(HAVE_MNTENT_H)&&defined(HAVE_SETMNTENT)&&defined(HAVE_GETMNTENT)&&defined(HAVE_ENDMNTENT) */ +#elif defined(HAVE_DEVNM_H)&&defined(HAVE_DEVNM) +#include +#endif /* defined(HAVE_DEVNM_H)&&defined(HAVE_DEVNM) */ + +#endif /* HAVE_SYS_QUOTAS */ + + +#ifndef QUOTABLOCK_SIZE +#define QUOTABLOCK_SIZE 1024 +#endif + +/************************************************** + Some stuff for the sys_quota api. + **************************************************/ + +#define SMB_QUOTAS_NO_LIMIT ((SMB_BIG_UINT)(0)) +#define SMB_QUOTAS_NO_SPACE ((SMB_BIG_UINT)(1)) + +typedef struct _SMB_DISK_QUOTA { + enum SMB_QUOTA_TYPE qtype; + SMB_BIG_UINT bsize; + SMB_BIG_UINT hardlimit; /* In bsize units. */ + SMB_BIG_UINT softlimit; /* In bsize units. */ + SMB_BIG_UINT curblocks; /* In bsize units. */ + SMB_BIG_UINT ihardlimit; /* inode hard limit. */ + SMB_BIG_UINT isoftlimit; /* inode soft limit. */ + SMB_BIG_UINT curinodes; /* Current used inodes. */ + uint32 qflags; +} SMB_DISK_QUOTA; + +#endif /*_SYSQUOTAS_H */ diff --git a/source3/include/vfs_macros.h b/source3/include/vfs_macros.h new file mode 100644 index 0000000000..fdbc1516e3 --- /dev/null +++ b/source3/include/vfs_macros.h @@ -0,0 +1,309 @@ +/* + Unix SMB/CIFS implementation. + VFS wrapper macros + Copyright (C) Stefan (metze) Metzmacher 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#ifndef _VFS_MACROS_H +#define _VFS_MACROS_H + +/******************************************************************* + Don't access conn->vfs.ops.* directly!!! + Use this macros! + (Fixes should go also into the vfs_opaque_* and vfs_next_* macros!) +********************************************************************/ + +/* Disk operations */ +#define SMB_VFS_CONNECT(conn, service, user) ((conn)->vfs.ops.connect((conn)->vfs.handles.connect, (conn), (service), (user))) +#define SMB_VFS_DISCONNECT(conn) ((conn)->vfs.ops.disconnect((conn)->vfs.handles.disconnect, (conn))) +#define SMB_VFS_DISK_FREE(conn, path, small_query, bsize, dfree ,dsize) ((conn)->vfs.ops.disk_free((conn)->vfs.handles.disk_free, (conn), (path), (small_query), (bsize), (dfree), (dsize))) +#define SMB_VFS_GET_QUOTA(conn, qtype, id, qt) ((conn)->vfs.ops.get_quota((conn)->vfs.handles.get_quota, (conn), (qtype), (id), (qt))) +#define SMB_VFS_SET_QUOTA(conn, qtype, id, qt) ((conn)->vfs.ops.set_quota((conn)->vfs.handles.set_quota, (conn), (qtype), (id), (qt))) + +/* Directory operations */ +#define SMB_VFS_OPENDIR(conn, fname) ((conn)->vfs.ops.opendir((conn)->vfs.handles.opendir, (conn), (fname))) +#define SMB_VFS_READDIR(conn, dirp) ((conn)->vfs.ops.readdir((conn)->vfs.handles.readdir, (conn), (dirp))) +#define SMB_VFS_MKDIR(conn, path, mode) ((conn)->vfs.ops.mkdir((conn)->vfs.handles.mkdir,(conn), (path), (mode))) +#define SMB_VFS_RMDIR(conn, path) ((conn)->vfs.ops.rmdir((conn)->vfs.handles.rmdir, (conn), (path))) +#define SMB_VFS_CLOSEDIR(conn, dir) ((conn)->vfs.ops.closedir((conn)->vfs.handles.closedir, (conn), dir)) + +/* File operations */ +#define SMB_VFS_OPEN(conn, fname, flags, mode) ((conn)->vfs.ops.open((conn)->vfs.handles.open, (conn), (fname), (flags), (mode))) +#define SMB_VFS_CLOSE(fsp, fd) ((fsp)->conn->vfs.ops.close((fsp)->conn->vfs.handles.close, (fsp), (fd))) +#define SMB_VFS_READ(fsp, fd, data, n) ((fsp)->conn->vfs.ops.read((fsp)->conn->vfs.handles.read, (fsp), (fd), (data), (n))) +#define SMB_VFS_WRITE(fsp, fd, data, n) ((fsp)->conn->vfs.ops.write((fsp)->conn->vfs.handles.write, (fsp), (fd), (data), (n))) +#define SMB_VFS_LSEEK(fsp, fd, offset, whence) ((fsp)->conn->vfs.ops.lseek((fsp)->conn->vfs.handles.lseek, (fsp), (fd), (offset), (whence))) +#define SMB_VFS_SENDFILE(tofd, fsp, fromfd, header, offset, count) ((fsp)->conn->vfs.ops.sendfile((fsp)->conn->vfs.handles.sendfile, (tofd), (fsp), (fromfd), (header), (offset), (count))) +#define SMB_VFS_RENAME(conn, old, new) ((conn)->vfs.ops.rename((conn)->vfs.handles.rename, (conn), (old), (new))) +#define SMB_VFS_FSYNC(fsp, fd) ((fsp)->conn->vfs.ops.fsync((fsp)->conn->vfs.handles.fsync, (fsp), (fd))) +#define SMB_VFS_STAT(conn, fname, sbuf) ((conn)->vfs.ops.stat((conn)->vfs.handles.stat, (conn), (fname), (sbuf))) +#define SMB_VFS_FSTAT(fsp, fd, sbuf) ((fsp)->conn->vfs.ops.fstat((fsp)->conn->vfs.handles.fstat, (fsp) ,(fd) ,(sbuf))) +#define SMB_VFS_LSTAT(conn, path, sbuf) ((conn)->vfs.ops.lstat((conn)->vfs.handles.lstat, (conn), (path), (sbuf))) +#define SMB_VFS_UNLINK(conn, path) ((conn)->vfs.ops.unlink((conn)->vfs.handles.unlink, (conn), (path))) +#define SMB_VFS_CHMOD(conn, path, mode) ((conn)->vfs.ops.chmod((conn)->vfs.handles.chmod, (conn), (path), (mode))) +#define SMB_VFS_FCHMOD(fsp, fd, mode) ((fsp)->conn->vfs.ops.fchmod((fsp)->conn->vfs.handles.fchmod, (fsp), (fd), (mode))) +#define SMB_VFS_CHOWN(conn, path, uid, gid) ((conn)->vfs.ops.chown((conn)->vfs.handles.chown, (conn), (path), (uid), (gid))) +#define SMB_VFS_FCHOWN(fsp, fd, uid, gid) ((fsp)->conn->vfs.ops.fchown((fsp)->conn->vfs.handles.fchown, (fsp), (fd), (uid), (gid))) +#define SMB_VFS_CHDIR(conn, path) ((conn)->vfs.ops.chdir((conn)->vfs.handles.chdir, (conn), (path))) +#define SMB_VFS_GETWD(conn, buf) ((conn)->vfs.ops.getwd((conn)->vfs.handles.getwd, (conn), (buf))) +#define SMB_VFS_UTIME(conn, path, times) ((conn)->vfs.ops.utime((conn)->vfs.handles.utime, (conn), (path), (times))) +#define SMB_VFS_FTRUNCATE(fsp, fd, offset) ((fsp)->conn->vfs.ops.ftruncate((fsp)->conn->vfs.handles.ftruncate, (fsp), (fd), (offset))) +#define SMB_VFS_LOCK(fsp, fd, op, offset, count, type) ((fsp)->conn->vfs.ops.lock((fsp)->conn->vfs.handles.lock, (fsp), (fd) ,(op), (offset), (count), (type))) +#define SMB_VFS_SYMLINK(conn, oldpath, newpath) ((conn)->vfs.ops.symlink((conn)->vfs.handles.symlink, (conn), (oldpath), (newpath))) +#define SMB_VFS_READLINK(conn, path, buf, bufsiz) ((conn)->vfs.ops.readlink((conn)->vfs.handles.readlink, (conn), (path), (buf), (bufsiz))) +#define SMB_VFS_LINK(conn, oldpath, newpath) ((conn)->vfs.ops.link((conn)->vfs.handles.link, (conn), (oldpath), (newpath))) +#define SMB_VFS_MKNOD(conn, path, mode, dev) ((conn)->vfs.ops.mknod((conn)->vfs.handles.mknod, (conn), (path), (mode), (dev))) +#define SMB_VFS_REALPATH(conn, path, resolved_path) ((conn)->vfs.ops.realpath((conn)->vfs.handles.realpath, (conn), (path), (resolved_path))) + +/* NT ACL operations. */ +#define SMB_VFS_FGET_NT_ACL(fsp, fd, security_info, ppdesc) ((fsp)->conn->vfs.ops.fget_nt_acl((fsp)->conn->vfs.handles.fget_nt_acl, (fsp), (fd), (security_info), (ppdesc))) +#define SMB_VFS_GET_NT_ACL(fsp, name, security_info, ppdesc) ((fsp)->conn->vfs.ops.get_nt_acl((fsp)->conn->vfs.handles.get_nt_acl, (fsp), (name), (security_info), (ppdesc))) +#define SMB_VFS_FSET_NT_ACL(fsp, fd, security_info_sent, psd) ((fsp)->conn->vfs.ops.fset_nt_acl((fsp)->conn->vfs.handles.fset_nt_acl, (fsp), (fd), (security_info_sent), (psd))) +#define SMB_VFS_SET_NT_ACL(fsp, name, security_info_sent, psd) ((fsp)->conn->vfs.ops.set_nt_acl((fsp)->conn->vfs.handles.set_nt_acl, (fsp), (name), (security_info_sent), (psd))) + +/* POSIX ACL operations. */ +#define SMB_VFS_CHMOD_ACL(conn, name, mode) ((conn)->vfs.ops.chmod_acl((conn)->vfs.handles.chmod_acl, (conn), (name), (mode))) +#define SMB_VFS_FCHMOD_ACL(fsp, fd, mode) ((fsp)->conn->vfs.ops.fchmod_acl((fsp)->conn->vfs.handles.chmod_acl, (fsp), (fd), (mode))) + +#define SMB_VFS_SYS_ACL_GET_ENTRY(conn, theacl, entry_id, entry_p) ((conn)->vfs.ops.sys_acl_get_entry((conn)->vfs.handles.sys_acl_get_entry, (conn), (theacl), (entry_id), (entry_p))) +#define SMB_VFS_SYS_ACL_GET_TAG_TYPE(conn, entry_d, tag_type_p) ((conn)->vfs.ops.sys_acl_get_tag_type((conn)->vfs.handles.sys_acl_get_tag_type, (conn), (entry_d), (tag_type_p))) +#define SMB_VFS_SYS_ACL_GET_PERMSET(conn, entry_d, permset_p) ((conn)->vfs.ops.sys_acl_get_permset((conn)->vfs.handles.sys_acl_get_permset, (conn), (entry_d), (permset_p))) +#define SMB_VFS_SYS_ACL_GET_QUALIFIER(conn, entry_d) ((conn)->vfs.ops.sys_acl_get_qualifier((conn)->vfs.handles.sys_acl_get_qualifier, (conn), (entry_d))) +#define SMB_VFS_SYS_ACL_GET_FILE(conn, path_p, type) ((conn)->vfs.ops.sys_acl_get_file((conn)->vfs.handles.sys_acl_get_file, (conn), (path_p), (type))) +#define SMB_VFS_SYS_ACL_GET_FD(fsp, fd) ((fsp)->conn->vfs.ops.sys_acl_get_fd((fsp)->conn->vfs.handles.sys_acl_get_fd, (fsp), (fd))) +#define SMB_VFS_SYS_ACL_CLEAR_PERMS(conn, permset) ((conn)->vfs.ops.sys_acl_clear_perms((conn)->vfs.handles.sys_acl_clear_perms, (conn), (permset))) +#define SMB_VFS_SYS_ACL_ADD_PERM(conn, permset, perm) ((conn)->vfs.ops.sys_acl_add_perm((conn)->vfs.handles.sys_acl_add_perm, (conn), (permset), (perm))) +#define SMB_VFS_SYS_ACL_TO_TEXT(conn, theacl, plen) ((conn)->vfs.ops.sys_acl_to_text((conn)->vfs.handles.sys_acl_to_text, (conn), (theacl), (plen))) +#define SMB_VFS_SYS_ACL_INIT(conn, count) ((conn)->vfs.ops.sys_acl_init((conn)->vfs.handles.sys_acl_init, (conn), (count))) +#define SMB_VFS_SYS_ACL_CREATE_ENTRY(conn, pacl, pentry) ((conn)->vfs.ops.sys_acl_create_entry((conn)->vfs.handles.sys_acl_create_entry, (conn), (pacl), (pentry))) +#define SMB_VFS_SYS_ACL_SET_TAG_TYPE(conn, entry, tagtype) ((conn)->vfs.ops.sys_acl_set_tag_type((conn)->vfs.handles.sys_acl_set_tag_type, (conn), (entry), (tagtype))) +#define SMB_VFS_SYS_ACL_SET_QUALIFIER(conn, entry, qual) ((conn)->vfs.ops.sys_acl_set_qualifier((conn)->vfs.handles.sys_acl_set_qualifier, (conn), (entry), (qual))) +#define SMB_VFS_SYS_ACL_SET_PERMSET(conn, entry, permset) ((conn)->vfs.ops.sys_acl_set_permset((conn)->vfs.handles.sys_acl_set_permset, (conn), (entry), (permset))) +#define SMB_VFS_SYS_ACL_VALID(conn, theacl) ((conn)->vfs.ops.sys_acl_valid((conn)->vfs.handles.sys_acl_valid, (conn), (theacl))) +#define SMB_VFS_SYS_ACL_SET_FILE(conn, name, acltype, theacl) ((conn)->vfs.ops.sys_acl_set_file((conn)->vfs.handles.sys_acl_set_file, (conn), (name), (acltype), (theacl))) +#define SMB_VFS_SYS_ACL_SET_FD(fsp, fd, theacl) ((fsp)->conn->vfs.ops.sys_acl_set_fd((fsp)->conn->vfs.handles.sys_acl_set_fd, (fsp), (fd), (theacl))) +#define SMB_VFS_SYS_ACL_DELETE_DEF_FILE(conn, path) ((conn)->vfs.ops.sys_acl_delete_def_file((conn)->vfs.handles.sys_acl_delete_def_file, (conn), (path))) +#define SMB_VFS_SYS_ACL_GET_PERM(conn, permset, perm) ((conn)->vfs.ops.sys_acl_get_perm((conn)->vfs.handles.sys_acl_get_perm, (conn), (permset), (perm))) +#define SMB_VFS_SYS_ACL_FREE_TEXT(conn, text) ((conn)->vfs.ops.sys_acl_free_text((conn)->vfs.handles.sys_acl_free_text, (conn), (text))) +#define SMB_VFS_SYS_ACL_FREE_ACL(conn, posix_acl) ((conn)->vfs.ops.sys_acl_free_acl((conn)->vfs.handles.sys_acl_free_acl, (conn), (posix_acl))) +#define SMB_VFS_SYS_ACL_FREE_QUALIFIER(conn, qualifier, tagtype) ((conn)->vfs.ops.sys_acl_free_qualifier((conn)->vfs.handles.sys_acl_free_qualifier, (conn), (qualifier), (tagtype))) + +/* EA operations. */ +#define SMB_VFS_GETXATTR(conn,path,name,value,size) ((conn)->vfs.ops.getxattr((conn)->vfs.handles.getxattr,(conn),(path),(name),(value),(size))) +#define SMB_VFS_LGETXATTR(conn,path,name,value,size) ((conn)->vfs.ops.lgetxattr((conn)->vfs.handles.lgetxattr,(conn),(path),(name),(value),(size))) +#define SMB_VFS_FGETXATTR(fsp,fd,name,value,size) ((fsp)->conn->vfs.ops.fgetxattr((fsp)->conn->vfs.handles.fgetxattr,(fsp),(fd),(name),(value),(size))) +#define SMB_VFS_LISTXATTR(conn,path,list,size) ((conn)->vfs.ops.listxattr((conn)->vfs.handles.listxattr,(conn),(path),(list),(size))) +#define SMB_VFS_LLISTXATTR(conn,path,list,size) ((conn)->vfs.ops.llistxattr((conn)->vfs.handles.llistxattr,(conn),(path),(list),(size))) +#define SMB_VFS_FLISTXATTR(fsp,fd,list,size) ((fsp)->conn->vfs.ops.flistxattr((fsp)->conn->vfs.handles.flistxattr,(fsp),(fd),(list),(size))) +#define SMB_VFS_REMOVEXATTR(conn,path,name) ((conn)->vfs.ops.removexattr((conn)->vfs.handles.removexattr,(conn),(path),(name))) +#define SMB_VFS_LREMOVEXATTR(conn,path,name) ((conn)->vfs.ops.lremovexattr((conn)->vfs.handles.lremovexattr,(conn),(path),(name))) +#define SMB_VFS_FREMOVEXATTR(fsp,fd,name) ((fsp)->conn->vfs.ops.fremovexattr((fsp)->conn->vfs.handles.fremovexattr,(fsp),(fd),(name))) +#define SMB_VFS_SETXATTR(conn,path,name,value,size,flags) ((conn)->vfs.ops.setxattr((conn)->vfs.handles.setxattr,(conn),(path),(name),(value),(size),(flags))) +#define SMB_VFS_LSETXATTR(conn,path,name,value,size,flags) ((conn)->vfs.ops.lsetxattr((conn)->vfs.handles.lsetxattr,(conn),(path),(name),(value),(size),(flags))) +#define SMB_VFS_FSETXATTR(fsp,fd,name,value,size,flags) ((fsp)->conn->vfs.ops.fsetxattr((fsp)->conn->vfs.handles.fsetxattr,(fsp),(fd),(name),(value),(size),(flags))) + +/******************************************************************* + Don't access conn->vfs_opaque.ops directly!!! + Use this macros! + (Fixes should also go into the vfs_* and vfs_next_* macros!) +********************************************************************/ + +/* Disk operations */ +#define SMB_VFS_OPAQUE_CONNECT(conn, service, user) ((conn)->vfs_opaque.ops.connect((conn)->vfs_opaque.handles.connect, (conn), (service), (user))) +#define SMB_VFS_OPAQUE_DISCONNECT(conn) ((conn)->vfs_opaque.ops.disconnect((conn)->vfs_opaque.handles.disconnect, (conn))) +#define SMB_VFS_OPAQUE_DISK_FREE(conn, path, small_query, bsize, dfree ,dsize) ((conn)->vfs_opaque.ops.disk_free((conn)->vfs_opaque.handles.disk_free, (conn), (path), (small_query), (bsize), (dfree), (dsize))) +#define SMB_VFS_OPAQUE_GET_QUOTA(conn, qtype, id, qt) ((conn)->vfs_opaque.ops.get_quota((conn)->vfs_opaque.handles.get_quota, (conn), (qtype), (id), (qt))) +#define SMB_VFS_OPAQUE_SET_QUOTA(conn, qtype, id, qt) ((conn)->vfs_opaque.ops.set_quota((conn)->vfs_opaque.handles.set_quota, (conn), (qtype), (id), (qt))) + +/* Directory operations */ +#define SMB_VFS_OPAQUE_OPENDIR(conn, fname) ((conn)->vfs_opaque.ops.opendir((conn)->vfs_opaque.handles.opendir, (conn), (fname))) +#define SMB_VFS_OPAQUE_READDIR(conn, dirp) ((conn)->vfs_opaque.ops.readdir((conn)->vfs_opaque.handles.readdir, (conn), (dirp))) +#define SMB_VFS_OPAQUE_MKDIR(conn, path, mode) ((conn)->vfs_opaque.ops.mkdir((conn)->vfs_opaque.handles.mkdir,(conn), (path), (mode))) +#define SMB_VFS_OPAQUE_RMDIR(conn, path) ((conn)->vfs_opaque.ops.rmdir((conn)->vfs_opaque.handles.rmdir, (conn), (path))) +#define SMB_VFS_OPAQUE_CLOSEDIR(conn, dir) ((conn)->vfs_opaque.ops.closedir((conn)->vfs_opaque.handles.closedir, (conn), dir)) + +/* File operations */ +#define SMB_VFS_OPAQUE_OPEN(conn, fname, flags, mode) ((conn)->vfs_opaque.ops.open((conn)->vfs_opaque.handles.open, (conn), (fname), (flags), (mode))) +#define SMB_VFS_OPAQUE_CLOSE(fsp, fd) ((fsp)->conn->vfs_opaque.ops.close((fsp)->conn->vfs_opaque.handles.close, (fsp), (fd))) +#define SMB_VFS_OPAQUE_READ(fsp, fd, data, n) ((fsp)->conn->vfs_opaque.ops.read((fsp)->conn->vfs_opaque.handles.read, (fsp), (fd), (data), (n))) +#define SMB_VFS_OPAQUE_WRITE(fsp, fd, data, n) ((fsp)->conn->vfs_opaque.ops.write((fsp)->conn->vfs_opaque.handles.write, (fsp), (fd), (data), (n))) +#define SMB_VFS_OPAQUE_LSEEK(fsp, fd, offset, whence) ((fsp)->conn->vfs_opaque.ops.lseek((fsp)->conn->vfs_opaque.handles.lseek, (fsp), (fd), (offset), (whence))) +#define SMB_VFS_OPAQUE_SENDFILE(tofd, fsp, fromfd, header, offset, count) ((fsp)->conn->vfs_opaque.ops.sendfile((fsp)->conn->vfs_opaque.handles.sendfile, (tofd), (fsp), (fromfd), (header), (offset), (count))) +#define SMB_VFS_OPAQUE_RENAME(conn, old, new) ((conn)->vfs_opaque.ops.rename((conn)->vfs_opaque.handles.rename, (conn), (old), (new))) +#define SMB_VFS_OPAQUE_FSYNC(fsp, fd) ((fsp)->conn->vfs_opaque.ops.fsync((fsp)->conn->vfs_opaque.handles.fsync, (fsp), (fd))) +#define SMB_VFS_OPAQUE_STAT(conn, fname, sbuf) ((conn)->vfs_opaque.ops.stat((conn)->vfs_opaque.handles.stat, (conn), (fname), (sbuf))) +#define SMB_VFS_OPAQUE_FSTAT(fsp, fd, sbuf) ((fsp)->conn->vfs_opaque.ops.fstat((fsp)->conn->vfs_opaque.handles.fstat, (fsp) ,(fd) ,(sbuf))) +#define SMB_VFS_OPAQUE_LSTAT(conn, path, sbuf) ((conn)->vfs_opaque.ops.lstat((conn)->vfs_opaque.handles.lstat, (conn), (path), (sbuf))) +#define SMB_VFS_OPAQUE_UNLINK(conn, path) ((conn)->vfs_opaque.ops.unlink((conn)->vfs_opaque.handles.unlink, (conn), (path))) +#define SMB_VFS_OPAQUE_CHMOD(conn, path, mode) ((conn)->vfs_opaque.ops.chmod((conn)->vfs_opaque.handles.chmod, (conn), (path), (mode))) +#define SMB_VFS_OPAQUE_FCHMOD(fsp, fd, mode) ((fsp)->conn->vfs_opaque.ops.fchmod((fsp)->conn->vfs_opaque.handles.fchmod, (fsp), (fd), (mode))) +#define SMB_VFS_OPAQUE_CHOWN(conn, path, uid, gid) ((conn)->vfs_opaque.ops.chown((conn)->vfs_opaque.handles.chown, (conn), (path), (uid), (gid))) +#define SMB_VFS_OPAQUE_FCHOWN(fsp, fd, uid, gid) ((fsp)->conn->vfs_opaque.ops.fchown((fsp)->conn->vfs_opaque.handles.fchown, (fsp), (fd), (uid), (gid))) +#define SMB_VFS_OPAQUE_CHDIR(conn, path) ((conn)->vfs_opaque.ops.chdir((conn)->vfs_opaque.handles.chdir, (conn), (path))) +#define SMB_VFS_OPAQUE_GETWD(conn, buf) ((conn)->vfs_opaque.ops.getwd((conn)->vfs_opaque.handles.getwd, (conn), (buf))) +#define SMB_VFS_OPAQUE_UTIME(conn, path, times) ((conn)->vfs_opaque.ops.utime((conn)->vfs_opaque.handles.utime, (conn), (path), (times))) +#define SMB_VFS_OPAQUE_FTRUNCATE(fsp, fd, offset) ((fsp)->conn->vfs_opaque.ops.ftruncate((fsp)->conn->vfs_opaque.handles.ftruncate, (fsp), (fd), (offset))) +#define SMB_VFS_OPAQUE_LOCK(fsp, fd, op, offset, count, type) ((fsp)->conn->vfs_opaque.ops.lock((fsp)->conn->vfs_opaque.handles.lock, (fsp), (fd) ,(op), (offset), (count), (type))) +#define SMB_VFS_OPAQUE_SYMLINK(conn, oldpath, newpath) ((conn)->vfs_opaque.ops.symlink((conn)->vfs_opaque.handles.symlink, (conn), (oldpath), (newpath))) +#define SMB_VFS_OPAQUE_READLINK(conn, path, buf, bufsiz) ((conn)->vfs_opaque.ops.readlink((conn)->vfs_opaque.handles.readlink, (conn), (path), (buf), (bufsiz))) +#define SMB_VFS_OPAQUE_LINK(conn, oldpath, newpath) ((conn)->vfs_opaque.ops.link((conn)->vfs_opaque.handles.link, (conn), (oldpath), (newpath))) +#define SMB_VFS_OPAQUE_MKNOD(conn, path, mode, dev) ((conn)->vfs_opaque.ops.mknod((conn)->vfs_opaque.handles.mknod, (conn), (path), (mode), (dev))) +#define SMB_VFS_OPAQUE_REALPATH(conn, path, resolved_path) ((conn)->vfs_opaque.ops.realpath((conn)->vfs_opaque.handles.realpath, (conn), (path), (resolved_path))) + +/* NT ACL operations. */ +#define SMB_VFS_OPAQUE_FGET_NT_ACL(fsp, fd, security_info, ppdesc) ((fsp)->conn->vfs_opaque.ops.fget_nt_acl((fsp)->conn->vfs_opaque.handles.fget_nt_acl, (fsp), (fd), (security_info), (ppdesc))) +#define SMB_VFS_OPAQUE_GET_NT_ACL(fsp, name, security_info, ppdesc) ((fsp)->conn->vfs_opaque.ops.get_nt_acl((fsp)->conn->vfs_opaque.handles.get_nt_acl, (fsp), (name), (security_info), (ppdesc))) +#define SMB_VFS_OPAQUE_FSET_NT_ACL(fsp, fd, security_info_sent, psd) ((fsp)->conn->vfs_opaque.ops.fset_nt_acl((fsp)->conn->vfs_opaque.handles.fset_nt_acl, (fsp), (fd), (security_info_sent), (psd))) +#define SMB_VFS_OPAQUE_SET_NT_ACL(fsp, name, security_info_sent, psd) ((fsp)->conn->vfs_opaque.ops.set_nt_acl((fsp)->conn->vfs_opaque.handles.set_nt_acl, (fsp), (name), (security_info_sent), (psd))) + +/* POSIX ACL operations. */ +#define SMB_VFS_OPAQUE_CHMOD_ACL(conn, name, mode) ((conn)->vfs_opaque.ops.chmod_acl((conn)->vfs_opaque.handles.chmod_acl, (conn), (name), (mode))) +#define SMB_VFS_OPAQUE_FCHMOD_ACL(fsp, fd, mode) ((fsp)->conn->vfs_opaque.ops.fchmod_acl((fsp)->conn->vfs_opaque.handles.chmod_acl, (fsp), (fd), (mode))) + +#define SMB_VFS_OPAQUE_SYS_ACL_GET_ENTRY(conn, theacl, entry_id, entry_p) ((conn)->vfs_opaque.ops.sys_acl_get_entry((conn)->vfs_opaque.handles.sys_acl_get_entry, (conn), (theacl), (entry_id), (entry_p))) +#define SMB_VFS_OPAQUE_SYS_ACL_GET_TAG_TYPE(conn, entry_d, tag_type_p) ((conn)->vfs_opaque.ops.sys_acl_get_tag_type((conn)->vfs_opaque.handles.sys_acl_get_tag_type, (conn), (entry_d), (tag_type_p))) +#define SMB_VFS_OPAQUE_SYS_ACL_GET_PERMSET(conn, entry_d, permset_p) ((conn)->vfs_opaque.ops.sys_acl_get_permset((conn)->vfs_opaque.handles.sys_acl_get_permset, (conn), (entry_d), (permset_p))) +#define SMB_VFS_OPAQUE_SYS_ACL_GET_QUALIFIER(conn, entry_d) ((conn)->vfs_opaque.ops.sys_acl_get_qualifier((conn)->vfs_opaque.handles.sys_acl_get_qualifier, (conn), (entry_d))) +#define SMB_VFS_OPAQUE_SYS_ACL_GET_FILE(conn, path_p, type) ((conn)->vfs_opaque.ops.sys_acl_get_file((conn)->vfs_opaque.handles.sys_acl_get_file, (conn), (path_p), (type))) +#define SMB_VFS_OPAQUE_SYS_ACL_GET_FD(fsp, fd) ((fsp)->conn->vfs_opaque.ops.sys_acl_get_fd((fsp)->conn->vfs_opaque.handles.sys_acl_get_fd, (fsp), (fd))) +#define SMB_VFS_OPAQUE_SYS_ACL_CLEAR_PERMS(conn, permset) ((conn)->vfs_opaque.ops.sys_acl_clear_perms((conn)->vfs_opaque.handles.sys_acl_clear_perms, (conn), (permset))) +#define SMB_VFS_OPAQUE_SYS_ACL_ADD_PERM(conn, permset, perm) ((conn)->vfs_opaque.ops.sys_acl_add_perm((conn)->vfs_opaque.handles.sys_acl_add_perm, (conn), (permset), (perm))) +#define SMB_VFS_OPAQUE_SYS_ACL_TO_TEXT(conn, theacl, plen) ((conn)->vfs_opaque.ops.sys_acl_to_text((conn)->vfs_opaque.handles.sys_acl_to_text, (conn), (theacl), (plen))) +#define SMB_VFS_OPAQUE_SYS_ACL_INIT(conn, count) ((conn)->vfs_opaque.ops.sys_acl_init((conn)->vfs_opaque.handles.sys_acl_init, (conn), (count))) +#define SMB_VFS_OPAQUE_SYS_ACL_CREATE_ENTRY(conn, pacl, pentry) ((conn)->vfs_opaque.ops.sys_acl_create_entry((conn)->vfs_opaque.handles.sys_acl_create_entry, (conn), (pacl), (pentry))) +#define SMB_VFS_OPAQUE_SYS_ACL_SET_TAG_TYPE(conn, entry, tagtype) ((conn)->vfs_opaque.ops.sys_acl_set_tag_type((conn)->vfs_opaque.handles.sys_acl_set_tag_type, (conn), (entry), (tagtype))) +#define SMB_VFS_OPAQUE_SYS_ACL_SET_QUALIFIER(conn, entry, qual) ((conn)->vfs_opaque.ops.sys_acl_set_qualifier((conn)->vfs_opaque.handles.sys_acl_set_qualifier, (conn), (entry), (qual))) +#define SMB_VFS_OPAQUE_SYS_ACL_SET_PERMSET(conn, entry, permset) ((conn)->vfs_opaque.ops.sys_acl_set_permset((conn)->vfs_opaque.handles.sys_acl_set_permset, (conn), (entry), (permset))) +#define SMB_VFS_OPAQUE_SYS_ACL_VALID(conn, theacl) ((conn)->vfs_opaque.ops.sys_acl_valid((conn)->vfs_opaque.handles.sys_acl_valid, (conn), (theacl))) +#define SMB_VFS_OPAQUE_SYS_ACL_SET_FILE(conn, name, acltype, theacl) ((conn)->vfs_opaque.ops.sys_acl_set_file((conn)->vfs_opaque.handles.sys_acl_set_file, (conn), (name), (acltype), (theacl))) +#define SMB_VFS_OPAQUE_SYS_ACL_SET_FD(fsp, fd, theacl) ((fsp)->conn->vfs_opaque.ops.sys_acl_set_fd((fsp)->conn->vfs_opaque.handles.sys_acl_set_fd, (fsp), (fd), (theacl))) +#define SMB_VFS_OPAQUE_SYS_ACL_DELETE_DEF_FILE(conn, path) ((conn)->vfs_opaque.ops.sys_acl_delete_def_file((conn)->vfs_opaque.handles.sys_acl_delete_def_file, (conn), (path))) +#define SMB_VFS_OPAQUE_SYS_ACL_GET_PERM(conn, permset, perm) ((conn)->vfs_opaque.ops.sys_acl_get_perm((conn)->vfs_opaque.handles.sys_acl_get_perm, (conn), (permset), (perm))) +#define SMB_VFS_OPAQUE_SYS_ACL_FREE_TEXT(conn, text) ((conn)->vfs_opaque.ops.sys_acl_free_text((conn)->vfs_opaque.handles.sys_acl_free_text, (conn), (text))) +#define SMB_VFS_OPAQUE_SYS_ACL_FREE_ACL(conn, posix_acl) ((conn)->vfs_opaque.ops.sys_acl_free_acl((conn)->vfs_opaque.handles.sys_acl_free_acl, (conn), (posix_acl))) +#define SMB_VFS_OPAQUE_SYS_ACL_FREE_QUALIFIER(conn, qualifier, tagtype) ((conn)->vfs_opaque.ops.sys_acl_free_qualifier((conn)->vfs_opaque.handles.sys_acl_free_qualifier, (conn), (qualifier), (tagtype))) + +/* EA operations. */ +#define SMB_VFS_OPAQUE_GETXATTR(conn,path,name,value,size) ((conn)->vfs_opaque.ops.getxattr((conn)->vfs_opaque.handles.getxattr,(conn),(path),(name),(value),(size))) +#define SMB_VFS_OPAQUE_LGETXATTR(conn,path,name,value,size) ((conn)->vfs_opaque.ops.lgetxattr((conn)->vfs_opaque.handles.lgetxattr,(conn),(path),(name),(value),(size))) +#define SMB_VFS_OPAQUE_FGETXATTR(fsp,fd,name,value,size) ((fsp)->conn->vfs_opaque.ops.fgetxattr((fsp)->conn->vfs_opaque.handles.fgetxattr,(fsp),(fd),(name),(value),(size))) +#define SMB_VFS_OPAQUE_LISTXATTR(conn,path,list,size) ((conn)->vfs_opaque.ops.listxattr((conn)->vfs_opaque.handles.listxattr,(conn),(path),(list),(size))) +#define SMB_VFS_OPAQUE_LLISTXATTR(conn,path,list,size) ((conn)->vfs_opaque.ops.llistxattr((conn)->vfs_opaque.handles.llistxattr,(conn),(path),(list),(size))) +#define SMB_VFS_OPAQUE_FLISTXATTR(fsp,fd,list,size) ((fsp)->conn->vfs_opaque.ops.flistxattr((fsp)->conn->vfs_opaque.handles.flistxattr,(fsp),(fd),(list),(size))) +#define SMB_VFS_OPAQUE_REMOVEXATTR(conn,path,name) ((conn)->vfs_opaque.ops.removexattr((conn)->vfs_opaque.handles.removexattr,(conn),(path),(name))) +#define SMB_VFS_OPAQUE_LREMOVEXATTR(conn,path,name) ((conn)->vfs_opaque.ops.lremovexattr((conn)->vfs_opaque.handles.lremovexattr,(conn),(path),(name))) +#define SMB_VFS_OPAQUE_FREMOVEXATTR(fsp,fd,name) ((fsp)->conn->vfs_opaque.ops.fremovexattr((fsp)->conn->vfs_opaque.handles.fremovexattr,(fsp),(fd),(name))) +#define SMB_VFS_OPAQUE_SETXATTR(conn,path,name,value,size,flags) ((conn)->vfs_opaque.ops.setxattr((conn)->vfs_opaque.handles.setxattr,(conn),(path),(name),(value),(size),(flags))) +#define SMB_VFS_OPAQUE_LSETXATTR(conn,path,name,value,size,flags) ((conn)->vfs_opaque.ops.lsetxattr((conn)->vfs_opaque.handles.lsetxattr,(conn),(path),(name),(value),(size),(flags))) +#define SMB_VFS_OPAQUE_FSETXATTR(fsp,fd,name,value,size,flags) ((fsp)->conn->vfs_opaque.ops.fsetxattr((fsp)->conn->vfs_opaque.handles.fsetxattr,(fsp),(fd),(name),(value),(size),(flags))) + +/******************************************************************* + Don't access handle->vfs_next.ops.* directly!!! + Use this macros! + (Fixes should go also into the vfs_* and vfs_opaque_* macros!) +********************************************************************/ + +/* Disk operations */ +#define SMB_VFS_NEXT_CONNECT(handle, conn, service, user) ((handle)->vfs_next.ops.connect((handle)->vfs_next.handles.connect, (conn), (service), (user))) +#define SMB_VFS_NEXT_DISCONNECT(handle, conn) ((handle)->vfs_next.ops.disconnect((handle)->vfs_next.handles.disconnect, (conn))) +#define SMB_VFS_NEXT_DISK_FREE(handle, conn, path, small_query, bsize, dfree ,dsize) ((handle)->vfs_next.ops.disk_free((handle)->vfs_next.handles.disk_free, (conn), (path), (small_query), (bsize), (dfree), (dsize))) +#define SMB_VFS_NEXT_GET_QUOTA(handle, conn, qtype, id, qt) ((handle)->vfs_next.ops.get_quota((handle)->vfs_next.handles.get_quota, (conn), (qtype), (id), (qt))) +#define SMB_VFS_NEXT_SET_QUOTA(handle, conn, qtype, id, qt) ((handle)->vfs_next.ops.set_quota((handle)->vfs_next.handles.set_quota, (conn), (qtype), (id), (qt))) + +/* Directory operations */ +#define SMB_VFS_NEXT_OPENDIR(handle, conn, fname) ((handle)->vfs_next.ops.opendir((handle)->vfs_next.handles.opendir, (conn), (fname))) +#define SMB_VFS_NEXT_READDIR(handle, conn, dirp) ((handle)->vfs_next.ops.readdir((handle)->vfs_next.handles.readdir, (conn), (dirp))) +#define SMB_VFS_NEXT_MKDIR(handle, conn, path, mode) ((handle)->vfs_next.ops.mkdir((handle)->vfs_next.handles.mkdir,(conn), (path), (mode))) +#define SMB_VFS_NEXT_RMDIR(handle, conn, path) ((handle)->vfs_next.ops.rmdir((handle)->vfs_next.handles.rmdir, (conn), (path))) +#define SMB_VFS_NEXT_CLOSEDIR(handle, conn, dir) ((handle)->vfs_next.ops.closedir((handle)->vfs_next.handles.closedir, (conn), dir)) + +/* File operations */ +#define SMB_VFS_NEXT_OPEN(handle, conn, fname, flags, mode) ((handle)->vfs_next.ops.open((handle)->vfs_next.handles.open, (conn), (fname), (flags), (mode))) +#define SMB_VFS_NEXT_CLOSE(handle, fsp, fd) ((handle)->vfs_next.ops.close((handle)->vfs_next.handles.close, (fsp), (fd))) +#define SMB_VFS_NEXT_READ(handle, fsp, fd, data, n) ((handle)->vfs_next.ops.read((handle)->vfs_next.handles.read, (fsp), (fd), (data), (n))) +#define SMB_VFS_NEXT_WRITE(handle, fsp, fd, data, n) ((handle)->vfs_next.ops.write((handle)->vfs_next.handles.write, (fsp), (fd), (data), (n))) +#define SMB_VFS_NEXT_LSEEK(handle, fsp, fd, offset, whence) ((handle)->vfs_next.ops.lseek((handle)->vfs_next.handles.lseek, (fsp), (fd), (offset), (whence))) +#define SMB_VFS_NEXT_SENDFILE(handle, tofd, fsp, fromfd, header, offset, count) ((handle)->vfs_next.ops.sendfile((handle)->vfs_next.handles.sendfile, (tofd), (fsp), (fromfd), (header), (offset), (count))) +#define SMB_VFS_NEXT_RENAME(handle, conn, old, new) ((handle)->vfs_next.ops.rename((handle)->vfs_next.handles.rename, (conn), (old), (new))) +#define SMB_VFS_NEXT_FSYNC(handle, fsp, fd) ((handle)->vfs_next.ops.fsync((handle)->vfs_next.handles.fsync, (fsp), (fd))) +#define SMB_VFS_NEXT_STAT(handle, conn, fname, sbuf) ((handle)->vfs_next.ops.stat((handle)->vfs_next.handles.stat, (conn), (fname), (sbuf))) +#define SMB_VFS_NEXT_FSTAT(handle, fsp, fd, sbuf) ((handle)->vfs_next.ops.fstat((handle)->vfs_next.handles.fstat, (fsp) ,(fd) ,(sbuf))) +#define SMB_VFS_NEXT_LSTAT(handle, conn, path, sbuf) ((handle)->vfs_next.ops.lstat((handle)->vfs_next.handles.lstat, (conn), (path), (sbuf))) +#define SMB_VFS_NEXT_UNLINK(handle, conn, path) ((handle)->vfs_next.ops.unlink((handle)->vfs_next.handles.unlink, (conn), (path))) +#define SMB_VFS_NEXT_CHMOD(handle, conn, path, mode) ((handle)->vfs_next.ops.chmod((handle)->vfs_next.handles.chmod, (conn), (path), (mode))) +#define SMB_VFS_NEXT_FCHMOD(handle, fsp, fd, mode) ((handle)->vfs_next.ops.fchmod((handle)->vfs_next.handles.fchmod, (fsp), (fd), (mode))) +#define SMB_VFS_NEXT_CHOWN(handle, conn, path, uid, gid) ((handle)->vfs_next.ops.chown((handle)->vfs_next.handles.chown, (conn), (path), (uid), (gid))) +#define SMB_VFS_NEXT_FCHOWN(handle, fsp, fd, uid, gid) ((handle)->vfs_next.ops.fchown((handle)->vfs_next.handles.fchown, (fsp), (fd), (uid), (gid))) +#define SMB_VFS_NEXT_CHDIR(handle, conn, path) ((handle)->vfs_next.ops.chdir((handle)->vfs_next.handles.chdir, (conn), (path))) +#define SMB_VFS_NEXT_GETWD(handle, conn, buf) ((handle)->vfs_next.ops.getwd((handle)->vfs_next.handles.getwd, (conn), (buf))) +#define SMB_VFS_NEXT_UTIME(handle, conn, path, times) ((handle)->vfs_next.ops.utime((handle)->vfs_next.handles.utime, (conn), (path), (times))) +#define SMB_VFS_NEXT_FTRUNCATE(handle, fsp, fd, offset) ((handle)->vfs_next.ops.ftruncate((handle)->vfs_next.handles.ftruncate, (fsp), (fd), (offset))) +#define SMB_VFS_NEXT_LOCK(handle, fsp, fd, op, offset, count, type) ((handle)->vfs_next.ops.lock((handle)->vfs_next.handles.lock, (fsp), (fd) ,(op), (offset), (count), (type))) +#define SMB_VFS_NEXT_SYMLINK(handle, conn, oldpath, newpath) ((handle)->vfs_next.ops.symlink((handle)->vfs_next.handles.symlink, (conn), (oldpath), (newpath))) +#define SMB_VFS_NEXT_READLINK(handle, conn, path, buf, bufsiz) ((handle)->vfs_next.ops.readlink((handle)->vfs_next.handles.readlink, (conn), (path), (buf), (bufsiz))) +#define SMB_VFS_NEXT_LINK(handle, conn, oldpath, newpath) ((handle)->vfs_next.ops.link((handle)->vfs_next.handles.link, (conn), (oldpath), (newpath))) +#define SMB_VFS_NEXT_MKNOD(handle, conn, path, mode, dev) ((handle)->vfs_next.ops.mknod((handle)->vfs_next.handles.mknod, (conn), (path), (mode), (dev))) +#define SMB_VFS_NEXT_REALPATH(handle, conn, path, resolved_path) ((handle)->vfs_next.ops.realpath((handle)->vfs_next.handles.realpath, (conn), (path), (resolved_path))) + +/* NT ACL operations. */ +#define SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, fd, security_info, ppdesc) ((handle)->vfs_next.ops.fget_nt_acl((handle)->vfs_next.handles.fget_nt_acl, (fsp), (fd), (security_info), (ppdesc))) +#define SMB_VFS_NEXT_GET_NT_ACL(handle, fsp, name, security_info, ppdesc) ((handle)->vfs_next.ops.get_nt_acl((handle)->vfs_next.handles.get_nt_acl, (fsp), (name), (security_info), (ppdesc))) +#define SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, fd, security_info_sent, psd) ((handle)->vfs_next.ops.fset_nt_acl((handle)->vfs_next.handles.fset_nt_acl, (fsp), (fd), (security_info_sent), (psd))) +#define SMB_VFS_NEXT_SET_NT_ACL(handle, fsp, name, security_info_sent, psd) ((handle)->vfs_next.ops.set_nt_acl((handle)->vfs_next.handles.set_nt_acl, (fsp), (name), (security_info_sent), (psd))) + +/* POSIX ACL operations. */ +#define SMB_VFS_NEXT_CHMOD_ACL(handle, conn, name, mode) ((handle)->vfs_next.ops.chmod_acl((handle)->vfs_next.handles.chmod_acl, (conn), (name), (mode))) +#define SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, fd, mode) ((handle)->vfs_next.ops.fchmod_acl((handle)->vfs_next.handles.chmod_acl, (fsp), (fd), (mode))) + +#define SMB_VFS_NEXT_SYS_ACL_GET_ENTRY(handle, conn, theacl, entry_id, entry_p) ((handle)->vfs_next.ops.sys_acl_get_entry((handle)->vfs_next.handles.sys_acl_get_entry, (conn), (theacl), (entry_id), (entry_p))) +#define SMB_VFS_NEXT_SYS_ACL_GET_TAG_TYPE(handle, conn, entry_d, tag_type_p) ((handle)->vfs_next.ops.sys_acl_get_tag_type((handle)->vfs_next.handles.sys_acl_get_tag_type, (conn), (entry_d), (tag_type_p))) +#define SMB_VFS_NEXT_SYS_ACL_GET_PERMSET(handle, conn, entry_d, permset_p) ((handle)->vfs_next.ops.sys_acl_get_permset((handle)->vfs_next.handles.sys_acl_get_permset, (conn), (entry_d), (permset_p))) +#define SMB_VFS_NEXT_SYS_ACL_GET_QUALIFIER(handle, conn, entry_d) ((handle)->vfs_next.ops.sys_acl_get_qualifier((handle)->vfs_next.handles.sys_acl_get_qualifier, (conn), (entry_d))) +#define SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, conn, path_p, type) ((handle)->vfs_next.ops.sys_acl_get_file((handle)->vfs_next.handles.sys_acl_get_file, (conn), (path_p), (type))) +#define SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, fd) ((handle)->vfs_next.ops.sys_acl_get_fd((handle)->vfs_next.handles.sys_acl_get_fd, (fsp), (fd))) +#define SMB_VFS_NEXT_SYS_ACL_CLEAR_PERMS(handle, conn, permset) ((handle)->vfs_next.ops.sys_acl_clear_perms((handle)->vfs_next.handles.sys_acl_clear_perms, (conn), (permset))) +#define SMB_VFS_NEXT_SYS_ACL_ADD_PERM(handle, conn, permset, perm) ((handle)->vfs_next.ops.sys_acl_add_perm((handle)->vfs_next.handles.sys_acl_add_perm, (conn), (permset), (perm))) +#define SMB_VFS_NEXT_SYS_ACL_TO_TEXT(handle, conn, theacl, plen) ((handle)->vfs_next.ops.sys_acl_to_text((handle)->vfs_next.handles.sys_acl_to_text, (conn), (theacl), (plen))) +#define SMB_VFS_NEXT_SYS_ACL_INIT(handle, conn, count) ((handle)->vfs_next.ops.sys_acl_init((handle)->vfs_next.handles.sys_acl_init, (conn), (count))) +#define SMB_VFS_NEXT_SYS_ACL_CREATE_ENTRY(handle, conn, pacl, pentry) ((handle)->vfs_next.ops.sys_acl_create_entry((handle)->vfs_next.handles.sys_acl_create_entry, (conn), (pacl), (pentry))) +#define SMB_VFS_NEXT_SYS_ACL_SET_TAG_TYPE(handle, conn, entry, tagtype) ((handle)->vfs_next.ops.sys_acl_set_tag_type((handle)->vfs_next.handles.sys_acl_set_tag_type, (conn), (entry), (tagtype))) +#define SMB_VFS_NEXT_SYS_ACL_SET_QUALIFIER(handle, conn, entry, qual) ((handle)->vfs_next.ops.sys_acl_set_qualifier((handle)->vfs_next.handles.sys_acl_set_qualifier, (conn), (entry), (qual))) +#define SMB_VFS_NEXT_SYS_ACL_SET_PERMSET(handle, conn, entry, permset) ((handle)->vfs_next.ops.sys_acl_set_permset((handle)->vfs_next.handles.sys_acl_set_permset, (conn), (entry), (permset))) +#define SMB_VFS_NEXT_SYS_ACL_VALID(handle, conn, theacl) ((handle)->vfs_next.ops.sys_acl_valid((handle)->vfs_next.handles.sys_acl_valid, (conn), (theacl))) +#define SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, conn, name, acltype, theacl) ((handle)->vfs_next.ops.sys_acl_set_file((handle)->vfs_next.handles.sys_acl_set_file, (conn), (name), (acltype), (theacl))) +#define SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, fd, theacl) ((handle)->vfs_next.ops.sys_acl_set_fd((handle)->vfs_next.handles.sys_acl_set_fd, (fsp), (fd), (theacl))) +#define SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, conn, path) ((handle)->vfs_next.ops.sys_acl_delete_def_file((handle)->vfs_next.handles.sys_acl_delete_def_file, (conn), (path))) +#define SMB_VFS_NEXT_SYS_ACL_GET_PERM(handle, conn, permset, perm) ((handle)->vfs_next.ops.sys_acl_get_perm((handle)->vfs_next.handles.sys_acl_get_perm, (conn), (permset), (perm))) +#define SMB_VFS_NEXT_SYS_ACL_FREE_TEXT(handle, conn, text) ((handle)->vfs_next.ops.sys_acl_free_text((handle)->vfs_next.handles.sys_acl_free_text, (conn), (text))) +#define SMB_VFS_NEXT_SYS_ACL_FREE_ACL(handle, conn, posix_acl) ((handle)->vfs_next.ops.sys_acl_free_acl((handle)->vfs_next.handles.sys_acl_free_acl, (conn), (posix_acl))) +#define SMB_VFS_NEXT_SYS_ACL_FREE_QUALIFIER(handle, conn, qualifier, tagtype) ((handle)->vfs_next.ops.sys_acl_free_qualifier((handle)->vfs_next.handles.sys_acl_free_qualifier, (conn), (qualifier), (tagtype))) + +/* EA operations. */ +#define SMB_VFS_NEXT_GETXATTR(handle,conn,path,name,value,size) ((handle)->vfs_next.ops.getxattr((handle)->vfs_next.handles.getxattr,(conn),(path),(name),(value),(size))) +#define SMB_VFS_NEXT_LGETXATTR(handle,conn,path,name,value,size) ((handle)->vfs_next.ops.lgetxattr((handle)->vfs_next.handles.lgetxattr,(conn),(path),(name),(value),(size))) +#define SMB_VFS_NEXT_FGETXATTR(handle,fsp,fd,name,value,size) ((handle)->vfs_next.ops.fgetxattr((handle)->vfs_next.handles.fgetxattr,(fsp),(fd),(name),(value),(size))) +#define SMB_VFS_NEXT_LISTXATTR(handle,conn,path,list,size) ((handle)->vfs_next.ops.listxattr((handle)->vfs_next.handles.listxattr,(conn),(path),(list),(size))) +#define SMB_VFS_NEXT_LLISTXATTR(handle,conn,path,list,size) ((handle)->vfs_next.ops.llistxattr((handle)->vfs_next.handles.llistxattr,(conn),(path),(list),(size))) +#define SMB_VFS_NEXT_FLISTXATTR(handle,fsp,fd,list,size) ((handle)->vfs_next.ops.flistxattr((handle)->vfs_next.handles.flistxattr,(fsp),(fd),(list),(size))) +#define SMB_VFS_NEXT_REMOVEXATTR(handle,conn,path,name) ((handle)->vfs_next.ops.removexattr((handle)->vfs_next.handles.removexattr,(conn),(path),(name))) +#define SMB_VFS_NEXT_LREMOVEXATTR(handle,conn,path,name) ((handle)->vfs_next.ops.lremovexattr((handle)->vfs_next.handles.lremovexattr,(conn),(path),(name))) +#define SMB_VFS_NEXT_FREMOVEXATTR(handle,fsp,fd,name) ((handle)->vfs_next.ops.fremovexattr((handle)->vfs_next.handles.fremovexattr,(fsp),(fd),(name))) +#define SMB_VFS_NEXT_SETXATTR(handle,conn,path,name,value,size,flags) ((handle)->vfs_next.ops.setxattr((handle)->vfs_next.handles.setxattr,(conn),(path),(name),(value),(size),(flags))) +#define SMB_VFS_NEXT_LSETXATTR(handle,conn,path,name,value,size,flags) ((handle)->vfs_next.ops.lsetxattr((handle)->vfs_next.handles.lsetxattr,(conn),(path),(name),(value),(size),(flags))) +#define SMB_VFS_NEXT_FSETXATTR(handle,fsp,fd,name,value,size,flags) ((handle)->vfs_next.ops.fsetxattr((handle)->vfs_next.handles.fsetxattr,(fsp),(fd),(name),(value),(size),(flags))) + +#endif /* _VFS_MACROS_H */ diff --git a/source3/intl/libgettext.h b/source3/intl/libgettext.h new file mode 100644 index 0000000000..e69de29bb2 diff --git a/source3/lib/smbldap.c b/source3/lib/smbldap.c new file mode 100644 index 0000000000..39c1990dec --- /dev/null +++ b/source3/lib/smbldap.c @@ -0,0 +1,1262 @@ +/* + Unix SMB/CIFS mplementation. + LDAP protocol helper functions for SAMBA + Copyright (C) Jean François Micouleau 1998 + Copyright (C) Gerald Carter 2001-2003 + Copyright (C) Shahms King 2001 + Copyright (C) Andrew Bartlett 2002-2003 + Copyright (C) Stefan (metze) Metzmacher 2002 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + +*/ + +#include "includes.h" +#include "smbldap.h" + +#ifndef LDAP_OPT_SUCCESS +#define LDAP_OPT_SUCCESS 0 +#endif + +/* Try not to hit the up or down server forever */ + +#define SMBLDAP_DONT_PING_TIME 10 /* ping only all 10 seconds */ +#define SMBLDAP_NUM_RETRIES 8 /* retry only 8 times */ + + +/* attributes used by Samba 2.2 */ + +ATTRIB_MAP_ENTRY attrib_map_v22[] = { + { LDAP_ATTR_UID, "uid" }, + { LDAP_ATTR_UIDNUMBER, LDAP_ATTRIBUTE_UIDNUMBER}, + { LDAP_ATTR_GIDNUMBER, LDAP_ATTRIBUTE_GIDNUMBER}, + { LDAP_ATTR_UNIX_HOME, "homeDirectory" }, + { LDAP_ATTR_PWD_LAST_SET, "pwdLastSet" }, + { LDAP_ATTR_PWD_CAN_CHANGE, "pwdCanChange" }, + { LDAP_ATTR_PWD_MUST_CHANGE, "pwdMustChange" }, + { LDAP_ATTR_LOGON_TIME, "logonTime" }, + { LDAP_ATTR_LOGOFF_TIME, "logoffTime" }, + { LDAP_ATTR_KICKOFF_TIME, "kickoffTime" }, + { LDAP_ATTR_CN, "cn" }, + { LDAP_ATTR_DISPLAY_NAME, "displayName" }, + { LDAP_ATTR_HOME_PATH, "smbHome" }, + { LDAP_ATTR_HOME_DRIVE, "homeDrives" }, + { LDAP_ATTR_LOGON_SCRIPT, "scriptPath" }, + { LDAP_ATTR_PROFILE_PATH, "profilePath" }, + { LDAP_ATTR_DESC, "description" }, + { LDAP_ATTR_USER_WKS, "userWorkstations"}, + { LDAP_ATTR_USER_RID, "rid" }, + { LDAP_ATTR_PRIMARY_GROUP_RID, "primaryGroupID"}, + { LDAP_ATTR_LMPW, "lmPassword" }, + { LDAP_ATTR_NTPW, "ntPassword" }, + { LDAP_ATTR_DOMAIN, "domain" }, + { LDAP_ATTR_OBJCLASS, "objectClass" }, + { LDAP_ATTR_ACB_INFO, "acctFlags" }, + { LDAP_ATTR_LIST_END, NULL } +}; + +/* attributes used by Samba 3.0's sambaSamAccount */ + +ATTRIB_MAP_ENTRY attrib_map_v30[] = { + { LDAP_ATTR_UID, "uid" }, + { LDAP_ATTR_UIDNUMBER, LDAP_ATTRIBUTE_UIDNUMBER}, + { LDAP_ATTR_GIDNUMBER, LDAP_ATTRIBUTE_GIDNUMBER}, + { LDAP_ATTR_UNIX_HOME, "homeDirectory" }, + { LDAP_ATTR_PWD_LAST_SET, "sambaPwdLastSet" }, + { LDAP_ATTR_PWD_CAN_CHANGE, "sambaPwdCanChange" }, + { LDAP_ATTR_PWD_MUST_CHANGE, "sambaPwdMustChange" }, + { LDAP_ATTR_LOGON_TIME, "sambaLogonTime" }, + { LDAP_ATTR_LOGOFF_TIME, "sambaLogoffTime" }, + { LDAP_ATTR_KICKOFF_TIME, "sambaKickoffTime" }, + { LDAP_ATTR_CN, "cn" }, + { LDAP_ATTR_DISPLAY_NAME, "displayName" }, + { LDAP_ATTR_HOME_DRIVE, "sambaHomeDrive" }, + { LDAP_ATTR_HOME_PATH, "sambaHomePath" }, + { LDAP_ATTR_LOGON_SCRIPT, "sambaLogonScript" }, + { LDAP_ATTR_PROFILE_PATH, "sambaProfilePath" }, + { LDAP_ATTR_DESC, "description" }, + { LDAP_ATTR_USER_WKS, "sambaUserWorkstations" }, + { LDAP_ATTR_USER_SID, LDAP_ATTRIBUTE_SID }, + { LDAP_ATTR_PRIMARY_GROUP_SID, "sambaPrimaryGroupSID" }, + { LDAP_ATTR_LMPW, "sambaLMPassword" }, + { LDAP_ATTR_NTPW, "sambaNTPassword" }, + { LDAP_ATTR_DOMAIN, "sambaDomainName" }, + { LDAP_ATTR_OBJCLASS, "objectClass" }, + { LDAP_ATTR_ACB_INFO, "sambaAcctFlags" }, + { LDAP_ATTR_LIST_END, NULL } +}; + +/* attributes used for alalocating RIDs */ + +ATTRIB_MAP_ENTRY dominfo_attr_list[] = { + { LDAP_ATTR_DOMAIN, "sambaDomainName" }, + { LDAP_ATTR_NEXT_RID, "sambaNextRid" }, + { LDAP_ATTR_NEXT_USERRID, "sambaNextUserRid" }, + { LDAP_ATTR_NEXT_GROUPRID, "sambaNextGroupRid" }, + { LDAP_ATTR_DOM_SID, LDAP_ATTRIBUTE_SID }, + { LDAP_ATTR_ALGORITHMIC_RID_BASE,"sambaAlgorithmicRidBase"}, + { LDAP_ATTR_OBJCLASS, "objectClass" }, + { LDAP_ATTR_LIST_END, NULL }, +}; + +/* Samba 3.0 group mapping attributes */ + +ATTRIB_MAP_ENTRY groupmap_attr_list[] = { + { LDAP_ATTR_GIDNUMBER, LDAP_ATTRIBUTE_GIDNUMBER}, + { LDAP_ATTR_GROUP_SID, LDAP_ATTRIBUTE_SID }, + { LDAP_ATTR_GROUP_TYPE, "sambaGroupType" }, + { LDAP_ATTR_DESC, "description" }, + { LDAP_ATTR_DISPLAY_NAME, "displayName" }, + { LDAP_ATTR_CN, "cn" }, + { LDAP_ATTR_OBJCLASS, "objectClass" }, + { LDAP_ATTR_LIST_END, NULL } +}; + +ATTRIB_MAP_ENTRY groupmap_attr_list_to_delete[] = { + { LDAP_ATTR_GROUP_SID, LDAP_ATTRIBUTE_SID }, + { LDAP_ATTR_GROUP_TYPE, "sambaGroupType" }, + { LDAP_ATTR_DESC, "description" }, + { LDAP_ATTR_DISPLAY_NAME, "displayName" }, + { LDAP_ATTR_LIST_END, NULL } +}; + +/* idmap_ldap sambaUnixIdPool */ + +ATTRIB_MAP_ENTRY idpool_attr_list[] = { + { LDAP_ATTR_UIDNUMBER, LDAP_ATTRIBUTE_UIDNUMBER}, + { LDAP_ATTR_GIDNUMBER, LDAP_ATTRIBUTE_GIDNUMBER}, + { LDAP_ATTR_OBJCLASS, "objectClass" }, + { LDAP_ATTR_LIST_END, NULL } +}; + +ATTRIB_MAP_ENTRY sidmap_attr_list[] = { + { LDAP_ATTR_SID, LDAP_ATTRIBUTE_SID }, + { LDAP_ATTR_UIDNUMBER, LDAP_ATTRIBUTE_UIDNUMBER}, + { LDAP_ATTR_GIDNUMBER, LDAP_ATTRIBUTE_GIDNUMBER}, + { LDAP_ATTR_OBJCLASS, "objectClass" }, + { LDAP_ATTR_LIST_END, NULL } +}; + +/********************************************************************** + perform a simple table lookup and return the attribute name + **********************************************************************/ + + const char* get_attr_key2string( ATTRIB_MAP_ENTRY table[], int key ) +{ + int i = 0; + + while ( table[i].attrib != LDAP_ATTR_LIST_END ) { + if ( table[i].attrib == key ) + return table[i].name; + i++; + } + + return NULL; +} + + +/********************************************************************** + Return the list of attribute names from a mapping table + **********************************************************************/ + + char** get_attr_list( ATTRIB_MAP_ENTRY table[] ) +{ + char **names; + int i = 0; + + while ( table[i].attrib != LDAP_ATTR_LIST_END ) + i++; + i++; + + names = (char**)malloc( sizeof(char*)*i ); + if ( !names ) { + DEBUG(0,("get_attr_list: out of memory\n")); + return NULL; + } + + i = 0; + while ( table[i].attrib != LDAP_ATTR_LIST_END ) { + names[i] = strdup( table[i].name ); + i++; + } + names[i] = NULL; + + return names; +} + +/********************************************************************* + Cleanup + ********************************************************************/ + + void free_attr_list( char **list ) +{ + int i = 0; + + if ( !list ) + return; + + while ( list[i] ) { + SAFE_FREE( list[i] ); + i+=1; + } + + SAFE_FREE( list ); +} + +/******************************************************************* + find the ldap password +******************************************************************/ +BOOL fetch_ldap_pw(char **dn, char** pw) +{ + char *key = NULL; + size_t size; + + *dn = smb_xstrdup(lp_ldap_admin_dn()); + + if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, *dn) < 0) { + SAFE_FREE(*dn); + DEBUG(0, ("fetch_ldap_pw: asprintf failed!\n")); + } + + *pw=secrets_fetch(key, &size); + SAFE_FREE(key); + + if (!size) { + /* Upgrade 2.2 style entry */ + char *p; + char* old_style_key = strdup(*dn); + char *data; + fstring old_style_pw; + + if (!old_style_key) { + DEBUG(0, ("fetch_ldap_pw: strdup failed!\n")); + return False; + } + + for (p=old_style_key; *p; p++) + if (*p == ',') *p = '/'; + + data=secrets_fetch(old_style_key, &size); + if (!size && size < sizeof(old_style_pw)) { + DEBUG(0,("fetch_ldap_pw: neither ldap secret retrieved!\n")); + SAFE_FREE(old_style_key); + SAFE_FREE(*dn); + return False; + } + + strncpy(old_style_pw, data, size); + old_style_pw[size] = 0; + + SAFE_FREE(data); + + if (!secrets_store_ldap_pw(*dn, old_style_pw)) { + DEBUG(0,("fetch_ldap_pw: ldap secret could not be upgraded!\n")); + SAFE_FREE(old_style_key); + SAFE_FREE(*dn); + return False; + } + if (!secrets_delete(old_style_key)) { + DEBUG(0,("fetch_ldap_pw: old ldap secret could not be deleted!\n")); + } + + SAFE_FREE(old_style_key); + + *pw = smb_xstrdup(old_style_pw); + } + + return True; +} + +/******************************************************************* +search an attribute and return the first value found. +******************************************************************/ + BOOL smbldap_get_single_attribute (LDAP * ldap_struct, LDAPMessage * entry, + const char *attribute, pstring value) +{ + char **values; + + if ( !attribute ) + return False; + + value[0] = '\0'; + + if ((values = ldap_get_values (ldap_struct, entry, attribute)) == NULL) { + DEBUG (10, ("smbldap_get_single_attribute: [%s] = []\n", attribute)); + + return False; + } + + if (convert_string(CH_UTF8, CH_UNIX,values[0], -1, value, sizeof(pstring)) == (size_t)-1) + { + DEBUG(1, ("smbldap_get_single_attribute: string conversion of [%s] = [%s] failed!\n", + attribute, values[0])); + ldap_value_free(values); + return False; + } + + ldap_value_free(values); +#ifdef DEBUG_PASSWORDS + DEBUG (100, ("smbldap_get_single_attribute: [%s] = [%s]\n", attribute, value)); +#endif + return True; +} + +/************************************************************************ + Routine to manage the LDAPMod structure array + manage memory used by the array, by each struct, and values + ***********************************************************************/ + + void smbldap_set_mod (LDAPMod *** modlist, int modop, const char *attribute, const char *value) +{ + LDAPMod **mods; + int i; + int j; + + mods = *modlist; + + /* sanity checks on the mod values */ + + if (attribute == NULL || *attribute == '\0') + return; +#if 0 /* commented out after discussion with abartlet. Do not reenable. + left here so other so re-add similar code --jerry */ + if (value == NULL || *value == '\0') + return; +#endif + + if (mods == NULL) + { + mods = (LDAPMod **) malloc(sizeof(LDAPMod *)); + if (mods == NULL) + { + DEBUG(0, ("make_a_mod: out of memory!\n")); + return; + } + mods[0] = NULL; + } + + for (i = 0; mods[i] != NULL; ++i) { + if (mods[i]->mod_op == modop && !strcasecmp(mods[i]->mod_type, attribute)) + break; + } + + if (mods[i] == NULL) + { + mods = (LDAPMod **) Realloc (mods, (i + 2) * sizeof (LDAPMod *)); + if (mods == NULL) + { + DEBUG(0, ("make_a_mod: out of memory!\n")); + return; + } + mods[i] = (LDAPMod *) malloc(sizeof(LDAPMod)); + if (mods[i] == NULL) + { + DEBUG(0, ("make_a_mod: out of memory!\n")); + return; + } + mods[i]->mod_op = modop; + mods[i]->mod_values = NULL; + mods[i]->mod_type = strdup(attribute); + mods[i + 1] = NULL; + } + + if (value != NULL) + { + char *utf8_value = NULL; + + j = 0; + if (mods[i]->mod_values != NULL) { + for (; mods[i]->mod_values[j] != NULL; j++); + } + mods[i]->mod_values = (char **)Realloc(mods[i]->mod_values, + (j + 2) * sizeof (char *)); + + if (mods[i]->mod_values == NULL) { + DEBUG (0, ("make_a_mod: Memory allocation failure!\n")); + return; + } + + if (push_utf8_allocate(&utf8_value, value) == (size_t)-1) { + DEBUG (0, ("make_a_mod: String conversion failure!\n")); + return; + } + + mods[i]->mod_values[j] = utf8_value; + + mods[i]->mod_values[j + 1] = NULL; + } + *modlist = mods; +} + + +/********************************************************************** + Set attribute to newval in LDAP, regardless of what value the + attribute had in LDAP before. +*********************************************************************/ + void smbldap_make_mod(LDAP *ldap_struct, LDAPMessage *existing, + LDAPMod ***mods, + const char *attribute, const char *newval) +{ + char **values = NULL; + + if (existing != NULL) { + values = ldap_get_values(ldap_struct, existing, attribute); + } + + /* all of our string attributes are case insensitive */ + + if ((values != NULL) && (values[0] != NULL) && + StrCaseCmp(values[0], newval) == 0) + { + + /* Believe it or not, but LDAP will deny a delete and + an add at the same time if the values are the + same... */ + + ldap_value_free(values); + return; + } + + /* Regardless of the real operation (add or modify) + we add the new value here. We rely on deleting + the old value, should it exist. */ + + if ((newval != NULL) && (strlen(newval) > 0)) { + smbldap_set_mod(mods, LDAP_MOD_ADD, attribute, newval); + } + + if (values == NULL) { + /* There has been no value before, so don't delete it. + Here's a possible race: We might end up with + duplicate attributes */ + return; + } + + /* By deleting exactly the value we found in the entry this + should be race-free in the sense that the LDAP-Server will + deny the complete operation if somebody changed the + attribute behind our back. */ + + smbldap_set_mod(mods, LDAP_MOD_DELETE, attribute, values[0]); + ldap_value_free(values); +} + + +/********************************************************************** + Some varients of the LDAP rebind code do not pass in the third 'arg' + pointer to a void*, so we try and work around it by assuming that the + value of the 'LDAP *' pointer is the same as the one we had passed in + **********************************************************************/ + +struct smbldap_state_lookup { + LDAP *ld; + struct smbldap_state *smbldap_state; + struct smbldap_state_lookup *prev, *next; +}; + +static struct smbldap_state_lookup *smbldap_state_lookup_list; + +static struct smbldap_state *smbldap_find_state(LDAP *ld) +{ + struct smbldap_state_lookup *t; + + for (t = smbldap_state_lookup_list; t; t = t->next) { + if (t->ld == ld) { + return t->smbldap_state; + } + } + return NULL; +} + +static void smbldap_delete_state(struct smbldap_state *smbldap_state) +{ + struct smbldap_state_lookup *t; + + for (t = smbldap_state_lookup_list; t; t = t->next) { + if (t->smbldap_state == smbldap_state) { + DLIST_REMOVE(smbldap_state_lookup_list, t); + SAFE_FREE(t); + return; + } + } +} + +static void smbldap_store_state(LDAP *ld, struct smbldap_state *smbldap_state) +{ + struct smbldap_state *tmp_ldap_state; + struct smbldap_state_lookup *t; + struct smbldap_state_lookup *tmp; + + if ((tmp_ldap_state = smbldap_find_state(ld))) { + SMB_ASSERT(tmp_ldap_state == smbldap_state); + return; + } + + t = smb_xmalloc(sizeof(*t)); + ZERO_STRUCTP(t); + + DLIST_ADD_END(smbldap_state_lookup_list, t, tmp); + t->ld = ld; + t->smbldap_state = smbldap_state; +} + +/******************************************************************* + open a connection to the ldap server. +******************************************************************/ +static int smbldap_open_connection (struct smbldap_state *ldap_state) + +{ + int rc = LDAP_SUCCESS; + int version; + BOOL ldap_v3 = False; + LDAP **ldap_struct = &ldap_state->ldap_struct; + +#ifdef HAVE_LDAP_INITIALIZE + DEBUG(10, ("smbldap_open_connection: %s\n", ldap_state->uri)); + + if ((rc = ldap_initialize(ldap_struct, ldap_state->uri)) != LDAP_SUCCESS) { + DEBUG(0, ("ldap_initialize: %s\n", ldap_err2string(rc))); + return rc; + } +#else + + /* Parse the string manually */ + + { + int port = 0; + fstring protocol; + fstring host; + const char *p = ldap_state->uri; + SMB_ASSERT(sizeof(protocol)>10 && sizeof(host)>254); + + /* skip leading "URL:" (if any) */ + if ( strncasecmp( p, "URL:", 4 ) == 0 ) { + p += 4; + } + + sscanf(p, "%10[^:]://%254s[^:]:%d", protocol, host, &port); + + if (port == 0) { + if (strequal(protocol, "ldap")) { + port = LDAP_PORT; + } else if (strequal(protocol, "ldaps")) { + port = LDAPS_PORT; + } else { + DEBUG(0, ("unrecognised protocol (%s)!\n", protocol)); + } + } + + if ((*ldap_struct = ldap_init(host, port)) == NULL) { + DEBUG(0, ("ldap_init failed !\n")); + return LDAP_OPERATIONS_ERROR; + } + + if (strequal(protocol, "ldaps")) { +#ifdef LDAP_OPT_X_TLS + int tls = LDAP_OPT_X_TLS_HARD; + if (ldap_set_option (*ldap_struct, LDAP_OPT_X_TLS, &tls) != LDAP_SUCCESS) + { + DEBUG(0, ("Failed to setup a TLS session\n")); + } + + DEBUG(3,("LDAPS option set...!\n")); +#else + DEBUG(0,("smbldap_open_connection: Secure connection not supported by LDAP client libraries!\n")); + return LDAP_OPERATIONS_ERROR; +#endif + } + } +#endif + + /* Store the LDAP pointer in a lookup list */ + + smbldap_store_state(*ldap_struct, ldap_state); + + /* Upgrade to LDAPv3 if possible */ + + if (ldap_get_option(*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS) + { + if (version != LDAP_VERSION3) + { + version = LDAP_VERSION3; + if (ldap_set_option (*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS) { + ldap_v3 = True; + } + } else { + ldap_v3 = True; + } + } + + if (lp_ldap_ssl() == LDAP_SSL_START_TLS) { +#ifdef LDAP_OPT_X_TLS + if (ldap_v3) { + if ((rc = ldap_start_tls_s (*ldap_struct, NULL, NULL)) != LDAP_SUCCESS) + { + DEBUG(0,("Failed to issue the StartTLS instruction: %s\n", + ldap_err2string(rc))); + return rc; + } + DEBUG (3, ("StartTLS issued: using a TLS connection\n")); + } else { + + DEBUG(0, ("Need LDAPv3 for Start TLS\n")); + return LDAP_OPERATIONS_ERROR; + } +#else + DEBUG(0,("smbldap_open_connection: StartTLS not supported by LDAP client libraries!\n")); + return LDAP_OPERATIONS_ERROR; +#endif + } + + DEBUG(2, ("smbldap_open_connection: connection opened\n")); + return rc; +} + + +/******************************************************************* + a rebind function for authenticated referrals + This version takes a void* that we can shove useful stuff in :-) +******************************************************************/ +#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) +#else +static int rebindproc_with_state (LDAP * ld, char **whop, char **credp, + int *methodp, int freeit, void *arg) +{ + struct smbldap_state *ldap_state = arg; + + /** @TODO Should we be doing something to check what servers we rebind to? + Could we get a referral to a machine that we don't want to give our + username and password to? */ + + if (freeit) { + SAFE_FREE(*whop); + memset(*credp, '\0', strlen(*credp)); + SAFE_FREE(*credp); + } else { + DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n", + ldap_state->bind_dn)); + + *whop = strdup(ldap_state->bind_dn); + if (!*whop) { + return LDAP_NO_MEMORY; + } + *credp = strdup(ldap_state->bind_secret); + if (!*credp) { + SAFE_FREE(*whop); + return LDAP_NO_MEMORY; + } + *methodp = LDAP_AUTH_SIMPLE; + } + return 0; +} +#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ + +/******************************************************************* + a rebind function for authenticated referrals + This version takes a void* that we can shove useful stuff in :-) + and actually does the connection. +******************************************************************/ +#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) +static int rebindproc_connect_with_state (LDAP *ldap_struct, + LDAP_CONST char *url, + ber_tag_t request, + ber_int_t msgid, void *arg) +{ + struct smbldap_state *ldap_state = arg; + int rc; + DEBUG(5,("rebindproc_connect_with_state: Rebinding as \"%s\"\n", + ldap_state->bind_dn)); + + /** @TODO Should we be doing something to check what servers we rebind to? + Could we get a referral to a machine that we don't want to give our + username and password to? */ + + rc = ldap_simple_bind_s(ldap_struct, ldap_state->bind_dn, ldap_state->bind_secret); + + return rc; +} +#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ + +/******************************************************************* + Add a rebind function for authenticated referrals +******************************************************************/ +#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) +#else +# if LDAP_SET_REBIND_PROC_ARGS == 2 +static int rebindproc (LDAP *ldap_struct, char **whop, char **credp, + int *method, int freeit ) +{ + struct smbldap_state *ldap_state = smbldap_find_state(ldap_struct); + + return rebindproc_with_state(ldap_struct, whop, credp, + method, freeit, ldap_state); + +} +# endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/ +#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ + +/******************************************************************* + a rebind function for authenticated referrals + this also does the connection, but no void*. +******************************************************************/ +#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) +# if LDAP_SET_REBIND_PROC_ARGS == 2 +static int rebindproc_connect (LDAP * ld, LDAP_CONST char *url, int request, + ber_int_t msgid) +{ + struct smbldap_state *ldap_state = smbldap_find_state(ld); + + return rebindproc_connect_with_state(ld, url, (ber_tag_t)request, msgid, + ldap_state); +} +# endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/ +#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ + +/******************************************************************* + connect to the ldap server under system privilege. +******************************************************************/ +static int smbldap_connect_system(struct smbldap_state *ldap_state, LDAP * ldap_struct) +{ + int rc; + char *ldap_dn; + char *ldap_secret; + + /* get the password */ + if (!fetch_ldap_pw(&ldap_dn, &ldap_secret)) + { + DEBUG(0, ("ldap_connect_system: Failed to retrieve password from secrets.tdb\n")); + return LDAP_INVALID_CREDENTIALS; + } + + ldap_state->bind_dn = ldap_dn; + ldap_state->bind_secret = ldap_secret; + + /* removed the sasl_bind_s "EXTERNAL" stuff, as my testsuite + (OpenLDAP) doesnt' seem to support it */ + + DEBUG(10,("ldap_connect_system: Binding to ldap server %s as \"%s\"\n", + ldap_state->uri, ldap_dn)); + +#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) +# if LDAP_SET_REBIND_PROC_ARGS == 2 + ldap_set_rebind_proc(ldap_struct, &rebindproc_connect); +# endif +# if LDAP_SET_REBIND_PROC_ARGS == 3 + ldap_set_rebind_proc(ldap_struct, &rebindproc_connect_with_state, (void *)ldap_state); +# endif +#else /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ +# if LDAP_SET_REBIND_PROC_ARGS == 2 + ldap_set_rebind_proc(ldap_struct, &rebindproc); +# endif +# if LDAP_SET_REBIND_PROC_ARGS == 3 + ldap_set_rebind_proc(ldap_struct, &rebindproc_with_state, (void *)ldap_state); +# endif +#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ + + rc = ldap_simple_bind_s(ldap_struct, ldap_dn, ldap_secret); + + if (rc != LDAP_SUCCESS) { + char *ld_error = NULL; + ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, + &ld_error); + DEBUG(ldap_state->num_failures ? 2 : 0, + ("failed to bind to server with dn= %s Error: %s\n\t%s\n", + ldap_dn ? ldap_dn : "(unknown)", ldap_err2string(rc), + ld_error ? ld_error : "(unknown)")); + SAFE_FREE(ld_error); + ldap_state->num_failures++; + return rc; + } + + ldap_state->num_failures = 0; + + DEBUG(3, ("ldap_connect_system: succesful connection to the LDAP server\n")); + return rc; +} + +/********************************************************************** +Connect to LDAP server (called before every ldap operation) +*********************************************************************/ +static int smbldap_open(struct smbldap_state *ldap_state) +{ + int rc; + SMB_ASSERT(ldap_state); + +#ifndef NO_LDAP_SECURITY + if (geteuid() != 0) { + DEBUG(0, ("smbldap_open: cannot access LDAP when not root..\n")); + return LDAP_INSUFFICIENT_ACCESS; + } +#endif + + if ((ldap_state->ldap_struct != NULL) && ((ldap_state->last_ping + SMBLDAP_DONT_PING_TIME) < time(NULL))) { + struct sockaddr_un addr; + socklen_t len = sizeof(addr); + int sd; + if (ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_DESC, &sd) == 0 && + getpeername(sd, (struct sockaddr *) &addr, &len) < 0) { + /* the other end has died. reopen. */ + ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); + ldap_state->ldap_struct = NULL; + ldap_state->last_ping = (time_t)0; + } else { + ldap_state->last_ping = time(NULL); + } + } + + if (ldap_state->ldap_struct != NULL) { + DEBUG(11,("smbldap_open: already connected to the LDAP server\n")); + return LDAP_SUCCESS; + } + + if ((rc = smbldap_open_connection(ldap_state))) { + return rc; + } + + if ((rc = smbldap_connect_system(ldap_state, ldap_state->ldap_struct))) { + ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); + ldap_state->ldap_struct = NULL; + return rc; + } + + + ldap_state->last_ping = time(NULL); + DEBUG(4,("The LDAP server is succesful connected\n")); + + return LDAP_SUCCESS; +} + +/********************************************************************** +Disconnect from LDAP server +*********************************************************************/ +static NTSTATUS smbldap_close(struct smbldap_state *ldap_state) +{ + if (!ldap_state) + return NT_STATUS_INVALID_PARAMETER; + + if (ldap_state->ldap_struct != NULL) { + ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); + ldap_state->ldap_struct = NULL; + } + + smbldap_delete_state(ldap_state); + + DEBUG(5,("The connection to the LDAP server was closed\n")); + /* maybe free the results here --metze */ + + + + return NT_STATUS_OK; +} + +int smbldap_retry_open(struct smbldap_state *ldap_state, int *attempts) +{ + int rc; + + SMB_ASSERT(ldap_state && attempts); + + if (*attempts != 0) { + unsigned int sleep_time; + uint8 rand_byte; + + /* Sleep for a random timeout */ + rand_byte = (char)(sys_random()); + + sleep_time = (((*attempts)*(*attempts))/2)*rand_byte*2; + /* we retry after (0.5, 1, 2, 3, 4.5, 6) seconds + on average. + */ + DEBUG(3, ("Sleeping for %u milliseconds before reconnecting\n", + sleep_time)); + msleep(sleep_time); + } + (*attempts)++; + + if ((rc = smbldap_open(ldap_state))) { + DEBUG(1,("Connection to LDAP Server failed for the %d try!\n",*attempts)); + return rc; + } + + return LDAP_SUCCESS; +} + + +/********************************************************************* + ********************************************************************/ + +int smbldap_search(struct smbldap_state *ldap_state, + const char *base, int scope, const char *filter, + char *attrs[], int attrsonly, + LDAPMessage **res) +{ + int rc = LDAP_SERVER_DOWN; + int attempts = 0; + char *utf8_filter; + + SMB_ASSERT(ldap_state); + + if (push_utf8_allocate(&utf8_filter, filter) == (size_t)-1) { + return LDAP_NO_MEMORY; + } + + while ((rc == LDAP_SERVER_DOWN) && (attempts < SMBLDAP_NUM_RETRIES)) { + + if ((rc = smbldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) + continue; + + rc = ldap_search_s(ldap_state->ldap_struct, base, scope, + utf8_filter, attrs, attrsonly, res); + } + + if (rc == LDAP_SERVER_DOWN) { + DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); + smbldap_close(ldap_state); + } + + SAFE_FREE(utf8_filter); + return rc; +} + +int smbldap_modify(struct smbldap_state *ldap_state, const char *dn, LDAPMod *attrs[]) +{ + int rc = LDAP_SERVER_DOWN; + int attempts = 0; + char *utf8_dn; + + SMB_ASSERT(ldap_state); + + if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) { + return LDAP_NO_MEMORY; + } + + while ((rc == LDAP_SERVER_DOWN) && (attempts < SMBLDAP_NUM_RETRIES)) { + + if ((rc = smbldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) + continue; + + rc = ldap_modify_s(ldap_state->ldap_struct, utf8_dn, attrs); + } + + if (rc == LDAP_SERVER_DOWN) { + DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); + smbldap_close(ldap_state); + } + + SAFE_FREE(utf8_dn); + return rc; +} + +int smbldap_add(struct smbldap_state *ldap_state, const char *dn, LDAPMod *attrs[]) +{ + int rc = LDAP_SERVER_DOWN; + int attempts = 0; + char *utf8_dn; + + SMB_ASSERT(ldap_state); + + if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) { + return LDAP_NO_MEMORY; + } + + while ((rc == LDAP_SERVER_DOWN) && (attempts < SMBLDAP_NUM_RETRIES)) { + + if ((rc = smbldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) + continue; + + rc = ldap_add_s(ldap_state->ldap_struct, utf8_dn, attrs); + } + + if (rc == LDAP_SERVER_DOWN) { + DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); + smbldap_close(ldap_state); + } + + SAFE_FREE(utf8_dn); + return rc; +} + +int smbldap_delete(struct smbldap_state *ldap_state, const char *dn) +{ + int rc = LDAP_SERVER_DOWN; + int attempts = 0; + char *utf8_dn; + + SMB_ASSERT(ldap_state); + + if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) { + return LDAP_NO_MEMORY; + } + + while ((rc == LDAP_SERVER_DOWN) && (attempts < SMBLDAP_NUM_RETRIES)) { + + if ((rc = smbldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) + continue; + + rc = ldap_delete_s(ldap_state->ldap_struct, utf8_dn); + } + + if (rc == LDAP_SERVER_DOWN) { + DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); + smbldap_close(ldap_state); + } + + SAFE_FREE(utf8_dn); + return rc; +} + +int smbldap_extended_operation(struct smbldap_state *ldap_state, + LDAP_CONST char *reqoid, struct berval *reqdata, + LDAPControl **serverctrls, LDAPControl **clientctrls, + char **retoidp, struct berval **retdatap) +{ + int rc = LDAP_SERVER_DOWN; + int attempts = 0; + + if (!ldap_state) + return (-1); + + while ((rc == LDAP_SERVER_DOWN) && (attempts < SMBLDAP_NUM_RETRIES)) { + + if ((rc = smbldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) + continue; + + rc = ldap_extended_operation_s(ldap_state->ldap_struct, reqoid, reqdata, + serverctrls, clientctrls, retoidp, retdatap); + } + + if (rc == LDAP_SERVER_DOWN) { + DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); + smbldap_close(ldap_state); + } + + return rc; +} + +/******************************************************************* + run the search by name. +******************************************************************/ +int smbldap_search_suffix (struct smbldap_state *ldap_state, const char *filter, + char **search_attr, LDAPMessage ** result) +{ + int scope = LDAP_SCOPE_SUBTREE; + int rc; + + DEBUG(2, ("smbldap_search_suffix: searching for:[%s]\n", filter)); + + rc = smbldap_search(ldap_state, lp_ldap_suffix(), scope, filter, search_attr, 0, result); + + if (rc != LDAP_SUCCESS) { + char *ld_error = NULL; + ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, + &ld_error); + DEBUG(0,("smbldap_search_suffix: Problem during the LDAP search: %s (%s)\n", + ld_error?ld_error:"(unknown)", ldap_err2string (rc))); + DEBUG(3,("smbldap_search_suffix: Query was: %s, %s\n", lp_ldap_suffix(), + filter)); + SAFE_FREE(ld_error); + } + + return rc; +} + +/********************************************************************** + Housekeeping + *********************************************************************/ + +void smbldap_free_struct(struct smbldap_state **ldap_state) +{ + smbldap_close(*ldap_state); + + if ((*ldap_state)->bind_secret) { + memset((*ldap_state)->bind_secret, '\0', strlen((*ldap_state)->bind_secret)); + } + + SAFE_FREE((*ldap_state)->bind_dn); + SAFE_FREE((*ldap_state)->bind_secret); + + *ldap_state = NULL; + + /* No need to free any further, as it is talloc()ed */ +} + + +/********************************************************************** + Intitalise the 'general' ldap structures, on which ldap operations may be conducted + *********************************************************************/ + +NTSTATUS smbldap_init(TALLOC_CTX *mem_ctx, const char *location, struct smbldap_state **smbldap_state) +{ + *smbldap_state = talloc_zero(mem_ctx, sizeof(**smbldap_state)); + if (!*smbldap_state) { + DEBUG(0, ("talloc() failed for ldapsam private_data!\n")); + return NT_STATUS_NO_MEMORY; + } + + if (location) { + (*smbldap_state)->uri = talloc_strdup(mem_ctx, location); + } else { + (*smbldap_state)->uri = "ldap://localhost"; + } + return NT_STATUS_OK; +} + +/********************************************************************** + Add the sambaDomain to LDAP, so we don't have to search for this stuff + again. This is a once-add operation for now. + + TODO: Add other attributes, and allow modification. +*********************************************************************/ +static NTSTATUS add_new_domain_info(struct smbldap_state *ldap_state, + const char *domain_name) +{ + fstring sid_string; + fstring algorithmic_rid_base_string; + pstring filter, dn; + LDAPMod **mods = NULL; + int rc; + int ldap_op; + LDAPMessage *result = NULL; + int num_result; + char **attr_list; + + slprintf (filter, sizeof (filter) - 1, "(&(%s=%s)(objectclass=%s))", + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN), + domain_name, LDAP_OBJ_DOMINFO); + + attr_list = get_attr_list( dominfo_attr_list ); + rc = smbldap_search_suffix(ldap_state, filter, attr_list, &result); + free_attr_list( attr_list ); + + if (rc != LDAP_SUCCESS) { + return NT_STATUS_UNSUCCESSFUL; + } + + num_result = ldap_count_entries(ldap_state->ldap_struct, result); + + if (num_result > 1) { + DEBUG (0, ("More than domain with that name exists: bailing out!\n")); + ldap_msgfree(result); + return NT_STATUS_UNSUCCESSFUL; + } + + /* Check if we need to add an entry */ + DEBUG(3,("Adding new domain\n")); + ldap_op = LDAP_MOD_ADD; + + snprintf(dn, sizeof(dn), "%s=%s,%s", get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN), + domain_name, lp_ldap_suffix()); + + /* Free original search */ + ldap_msgfree(result); + + /* make the changes - the entry *must* not already have samba attributes */ + smbldap_set_mod(&mods, LDAP_MOD_ADD, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN), + domain_name); + + /* If we don't have an entry, then ask secrets.tdb for what it thinks. + It may choose to make it up */ + + sid_to_string(sid_string, get_global_sam_sid()); + smbldap_set_mod(&mods, LDAP_MOD_ADD, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOM_SID), sid_string); + + slprintf(algorithmic_rid_base_string, sizeof(algorithmic_rid_base_string) - 1, "%i", algorithmic_rid_base()); + smbldap_set_mod(&mods, LDAP_MOD_ADD, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_ALGORITHMIC_RID_BASE), + algorithmic_rid_base_string); + smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_DOMINFO); + + switch(ldap_op) + { + case LDAP_MOD_ADD: + rc = smbldap_add(ldap_state, dn, mods); + break; + case LDAP_MOD_REPLACE: + rc = smbldap_modify(ldap_state, dn, mods); + break; + default: + DEBUG(0,("Wrong LDAP operation type: %d!\n", ldap_op)); + return NT_STATUS_INVALID_PARAMETER; + } + + if (rc!=LDAP_SUCCESS) { + char *ld_error = NULL; + ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); + DEBUG(1,("failed to %s domain dn= %s with: %s\n\t%s\n", + ldap_op == LDAP_MOD_ADD ? "add" : "modify", + dn, ldap_err2string(rc), + ld_error?ld_error:"unknown")); + SAFE_FREE(ld_error); + + ldap_mods_free(mods, True); + return NT_STATUS_UNSUCCESSFUL; + } + + DEBUG(2,("added: domain = %s in the LDAP database\n", domain_name)); + ldap_mods_free(mods, True); + return NT_STATUS_OK; +} + +/********************************************************************** +Search for the domain info entry +*********************************************************************/ +NTSTATUS smbldap_search_domain_info(struct smbldap_state *ldap_state, + LDAPMessage ** result, const char *domain_name, + BOOL try_add) +{ + NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; + pstring filter; + int rc; + char **attr_list; + int count; + + snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(%s=%s))", + LDAP_OBJ_DOMINFO, + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN), + domain_name); + + DEBUG(2, ("Searching for:[%s]\n", filter)); + + + attr_list = get_attr_list( dominfo_attr_list ); + rc = smbldap_search_suffix(ldap_state, filter, attr_list , result); + free_attr_list( attr_list ); + + if (rc != LDAP_SUCCESS) { + DEBUG(2,("Problem during LDAPsearch: %s\n", ldap_err2string (rc))); + DEBUG(2,("Query was: %s, %s\n", lp_ldap_suffix(), filter)); + } else if (ldap_count_entries(ldap_state->ldap_struct, *result) < 1) { + DEBUG(3, ("Got no domain info entries for domain\n")); + ldap_msgfree(*result); + *result = NULL; + if (try_add && NT_STATUS_IS_OK(ret = add_new_domain_info(ldap_state, domain_name))) { + return smbldap_search_domain_info(ldap_state, result, domain_name, False); + } + else { + DEBUG(0, ("Adding domain info for %s failed with %s\n", + domain_name, nt_errstr(ret))); + return ret; + } + } else if ((count = ldap_count_entries(ldap_state->ldap_struct, *result)) > 1) { + DEBUG(0, ("Got too many (%d) domain info entries for domain %s\n", + count, domain_name)); + ldap_msgfree(*result); + *result = NULL; + return ret; + } else { + return NT_STATUS_OK; + } + + return ret; +} + diff --git a/source3/lib/sysquotas.c b/source3/lib/sysquotas.c new file mode 100644 index 0000000000..efc9e65b9d --- /dev/null +++ b/source3/lib/sysquotas.c @@ -0,0 +1,963 @@ +/* + Unix SMB/CIFS implementation. + System QUOTA function wrappers + Copyright (C) Stefan (metze) Metzmacher 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + + +#ifndef AUTOCONF_TEST + +#include "includes.h" + +#ifdef HAVE_SYS_QUOTAS + +#if defined(HAVE_QUOTACTL_4A) +/* long quotactl(int cmd, char *special, qid_t id, caddr_t addr) */ +/* this is used by: linux,HPUX,IRIX */ + +/**************************************************************************** + Abstract out the old and new Linux quota get calls. +****************************************************************************/ +static int sys_get_vfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp) +{ + int ret = -1; + uint32 qflags = 0; + struct SYS_DQBLK D; + SMB_BIG_UINT bsize = (SMB_BIG_UINT)QUOTABLOCK_SIZE; + + if (!path||!bdev||!dp) + smb_panic("sys_get_vfs_quota: called with NULL pointer"); + + ZERO_STRUCT(D); + ZERO_STRUCT(*dp); + dp->qtype = qtype; + + switch (qtype) { + case SMB_USER_QUOTA_TYPE: + /* we use id.uid == 0 for default quotas */ + if (id.uid == 0) { + ret = 0; + break; + } + + if ((ret = quotactl(QCMD(Q_GETQUOTA,USRQUOTA), bdev, id.uid, (CADDR_T)&D))) { + return ret; + } + + if ((D.dqb_curblocks==0)&& + (D.dqb_bsoftlimit==0)&& + (D.dqb_bhardlimit==0)) { + /* the upper layer functions don't want empty quota records...*/ + return -1; + } + + break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_QUOTA_TYPE: + if ((ret = quotactl(QCMD(Q_GETQUOTA,GRPQUOTA), bdev, id.gid, (CADDR_T)&D))) { + return ret; + } + + if ((D.dqb_curblocks==0)&& + (D.dqb_bsoftlimit==0)&& + (D.dqb_bhardlimit==0)) { + /* the upper layer functions don't want empty quota records...*/ + return -1; + } + + break; +#endif /* HAVE_GROUP_QUOTA */ + case SMB_USER_FS_QUOTA_TYPE: + id.uid = getuid(); + + if ((ret = quotactl(QCMD(Q_GETQUOTA,USRQUOTA), bdev, id.uid, (CADDR_T)&D))==0) { + qflags |= QUOTAS_DENY_DISK; + } + + /* get the default quotas stored in the root's (uid =0) record */ + if ((ret = quotactl(QCMD(Q_GETQUOTA,USRQUOTA), bdev, 0, (CADDR_T)&D))) { + return ret; + } + + ret = 0; + break; + default: + errno = ENOSYS; + return -1; + } + + dp->bsize = bsize; + dp->softlimit = (SMB_BIG_UINT)D.dqb_bsoftlimit; + dp->hardlimit = (SMB_BIG_UINT)D.dqb_bhardlimit; + dp->ihardlimit = (SMB_BIG_UINT)D.dqb_ihardlimit; + dp->isoftlimit = (SMB_BIG_UINT)D.dqb_isoftlimit; + dp->curinodes = (SMB_BIG_UINT)D.dqb_curinodes; + dp->curblocks = (SMB_BIG_UINT)D.dqb_curblocks; + + + dp->qflags = qflags; + + return ret; +} + +/**************************************************************************** + Abstract out the old and new Linux quota set calls. +****************************************************************************/ + +static int sys_set_vfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp) +{ + int ret = -1; + uint32 qflags = 0; + struct SYS_DQBLK D; + SMB_BIG_UINT bsize = (SMB_BIG_UINT)QUOTABLOCK_SIZE; + + if (!path||!bdev||!dp) + smb_panic("sys_set_vfs_quota: called with NULL pointer"); + + ZERO_STRUCT(D); + + if (bsize == dp->bsize) { + D.dqb_bsoftlimit = dp->softlimit; + D.dqb_bhardlimit = dp->hardlimit; + D.dqb_ihardlimit = dp->ihardlimit; + D.dqb_isoftlimit = dp->isoftlimit; + } else { + D.dqb_bsoftlimit = (dp->softlimit*dp->bsize)/bsize; + D.dqb_bhardlimit = (dp->hardlimit*dp->bsize)/bsize; + D.dqb_ihardlimit = (dp->ihardlimit*dp->bsize)/bsize; + D.dqb_isoftlimit = (dp->isoftlimit*dp->bsize)/bsize; + } + + qflags = dp->qflags; + + switch (qtype) { + case SMB_USER_QUOTA_TYPE: + /* we use id.uid == 0 for default quotas */ + if (id.uid>0) { + ret = quotactl(QCMD(Q_SETQLIM,USRQUOTA), bdev, id.uid, (CADDR_T)&D); + } + break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_QUOTA_TYPE: + ret = quotactl(QCMD(Q_SETQLIM,GRPQUOTA), bdev, id.gid, (CADDR_T)&D); + break; +#endif /* HAVE_GROUP_QUOTA */ + case SMB_USER_FS_QUOTA_TYPE: + /* this stuff didn't work as it should: + * switching on/off quota via quotactl() + * didn't work! + * So we only set the default limits + * --metze + * + * On HPUX we didn't have the mount path, + * we need to fix sys_path_to_bdev() + * + */ +#if 0 + uid = getuid(); + + ret = quotactl(QCMD(Q_GETQUOTA,USRQUOTA), bdev, uid, (CADDR_T)&D); + + if ((qflags"AS_DENY_DISK)||(qflags"AS_ENABLED)) { + if (ret == 0) { + char *quota_file = NULL; + + asprintf("a_file,"/%s/%s%s",path, QUOTAFILENAME,USERQUOTAFILE_EXTENSION); + if (quota_file == NULL) { + DEBUG(0,("asprintf() failed!\n")); + errno = ENOMEM; + return -1; + } + + ret = quotactl(QCMD(Q_QUOTAON,USRQUOTA), bdev, -1,(CADDR_T)quota_file); + } else { + ret = 0; + } + } else { + if (ret != 0) { + /* turn off */ + ret = quotactl(QCMD(Q_QUOTAOFF,USRQUOTA), bdev, -1, (CADDR_T)0); + } else { + ret = 0; + } + } + + DEBUG(0,("vfs_fs_quota: ret(%d) errno(%d)[%s] uid(%d) bdev[%s]\n", + ret,errno,strerror(errno),uid,bdev)); +#endif + + /* we use uid == 0 for default quotas */ + ret = quotactl(QCMD(Q_SETQLIM,USRQUOTA), bdev, 0, (CADDR_T)&D); + + break; + + default: + errno = ENOSYS; + return -1; + } + + return ret; +} + +/*#endif HAVE_QUOTACTL_4A */ +#elif defined(HAVE_QUOTACTL_4B) + +#error HAVE_QUOTACTL_4B not implemeted + +/*#endif HAVE_QUOTACTL_4B */ +#elif defined(HAVE_QUOTACTL_3) + +#error HAVE_QUOTACTL_3 not implemented + +/* #endif HAVE_QUOTACTL_3 */ +#else /* NO_QUOTACTL_USED */ + +static int sys_get_vfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp) +{ + int ret = -1; + + if (!path||!bdev||!dp) + smb_panic("sys_get_vfs_quota: called with NULL pointer"); + + errno = ENOSYS; + + return ret; +} + +static int sys_set_vfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp) +{ + int ret = -1; + + if (!path||!bdev||!dp) + smb_panic("sys_set_vfs_quota: called with NULL pointer"); + + errno = ENOSYS; + + return ret; +} + +#endif /* NO_QUOTACTL_USED */ + +#ifdef HAVE_MNTENT +static int sys_path_to_bdev(const char *path, char **mntpath, char **bdev, char **fs) +{ + int ret = -1; + SMB_STRUCT_STAT S; + FILE *fp; + struct mntent *mnt; + SMB_DEV_T devno; + + /* find the block device file */ + + if (!path||!mntpath||!bdev||!fs) + smb_panic("sys_path_to_bdev: called with NULL pointer"); + + (*mntpath) = NULL; + (*bdev) = NULL; + (*fs) = NULL; + + if ( sys_stat(path, &S) == -1 ) + return (-1); + + devno = S.st_dev ; + + fp = setmntent(MOUNTED,"r"); + + while ((mnt = getmntent(fp))) { + if ( sys_stat(mnt->mnt_dir,&S) == -1 ) + continue ; + + if (S.st_dev == devno) { + (*mntpath) = strdup(mnt->mnt_dir); + (*bdev) = strdup(mnt->mnt_fsname); + (*fs) = strdup(mnt->mnt_type); + if ((*mntpath)&&(*bdev)&&(*fs)) { + ret = 0; + } else { + SAFE_FREE(*mntpath); + SAFE_FREE(*bdev); + SAFE_FREE(*fs); + ret = -1; + } + + break; + } + } + + endmntent(fp) ; + + return ret; +} +/* #endif HAVE_MNTENT */ +#elif defined(HAVE_DEVNM) + +/* we have this on HPUX, ... */ +static int sys_path_to_bdev(const char *path, char **mntpath, char **bdev, char **fs) +{ + int ret = -1; + char dev_disk[256]; + SMB_STRUCT_STAT S; + + if (!path||!mntpath||!bdev||!fs) + smb_panic("sys_path_to_bdev: called with NULL pointer"); + + (*mntpath) = NULL; + (*bdev) = NULL; + (*fs) = NULL; + + /* find the block device file */ + + if ((ret=sys_stat(path, &S))!=0) { + return ret; + } + + if ((ret=devnm(S_IFBLK, S.st_dev, dev_disk, 256, 1))!=0) { + return ret; + } + + /* we should get the mntpath right... + * but I don't know how + * --metze + */ + (*mntpath) = strdup(path); + (*bdev) = strdup(dev_disk); + if ((*mntpath)&&(*bdev)) { + ret = 0; + } else { + SAFE_FREE(*mntpath); + SAFE_FREE(*bdev); + ret = -1; + } + + + return ret; +} + +/* #endif HAVE_DEVNM */ +#else +/* we should fake this up...*/ +static int sys_path_to_bdev(const char *path, char **mntpath, char **bdev, char **fs) +{ + int ret = -1; + + if (!path||!mntpath||!bdev||!fs) + smb_panic("sys_path_to_bdev: called with NULL pointer"); + + (*mntpath) = NULL; + (*bdev) = NULL; + (*fs) = NULL; + + (*mntpath) = strdup(path); + if (*mntpath) { + ret = 0; + } else { + SAFE_FREE(*mntpath); + ret = -1; + } + + return ret; +} +#endif + + +/********************************************************* + if we have XFS QUOTAS we should use them + *********************************************************/ +#ifdef HAVE_XFS_QUOTA +/**************************************************************************** + Abstract out the XFS Quota Manager quota get call. +****************************************************************************/ +static int sys_get_xfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp) +{ + int ret; + uint32 qflags = 0; + SMB_BIG_UINT bsize = (SMB_BIG_UINT)BBSIZE; + struct fs_disk_quota D; + struct fs_quota_stat F; + ZERO_STRUCT(D); + ZERO_STRUCT(F); + + if (!bdev||!dp) + smb_panic("sys_get_xfs_quota: called with NULL pointer"); + + ZERO_STRUCT(*dp); + dp->qtype = qtype; + + switch (qtype) { + case SMB_USER_QUOTA_TYPE: + /* we use id.uid == 0 for default quotas */ + if (id.uid == 0) { + ret = 0; + break; + } + if ((ret=quotactl(QCMD(Q_XGETQUOTA,USRQUOTA), bdev, id.uid, (CADDR_T)&D))) + return ret; + break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_QUOTA_TYPE: + if ((ret=quotactl(QCMD(Q_XGETQUOTA,GRPQUOTA), bdev, id.gid, (CADDR_T)&D))) + return ret; + break; +#endif /* HAVE_GROUP_QUOTA */ + case SMB_USER_FS_QUOTA_TYPE: + /* TODO: get quota status from quotactl() ... */ + if ((ret = quotactl(QCMD(Q_XGETQSTAT,USRQUOTA), bdev, -1, (CADDR_T)&F))) + return ret; + + if (F.qs_flags & XFS_QUOTA_UDQ_ENFD) { + qflags |= QUOTAS_DENY_DISK; + } + else if (F.qs_flags & XFS_QUOTA_UDQ_ACCT) { + qflags |= QUOTAS_ENABLED; + } + + /* we use uid == 0 for default quotas */ + if ((ret=quotactl(QCMD(Q_XGETQUOTA,USRQUOTA), bdev, 0, (CADDR_T)&D))) + return ret; + + break; + default: + errno = ENOSYS; + return -1; + } + + dp->bsize = bsize; + dp->softlimit = (SMB_BIG_UINT)D.d_blk_softlimit; + dp->hardlimit = (SMB_BIG_UINT)D.d_blk_hardlimit; + dp->ihardlimit = (SMB_BIG_UINT)D.d_ino_hardlimit; + dp->isoftlimit = (SMB_BIG_UINT)D.d_ino_softlimit; + dp->curinodes = (SMB_BIG_UINT)D.d_icount; + dp->curblocks = (SMB_BIG_UINT)D.d_bcount; + dp->qflags = qflags; + + return ret; +} + +/**************************************************************************** + Abstract out the XFS Quota Manager quota set call. +****************************************************************************/ +static int sys_set_xfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp) +{ + int ret = -1; + uint32 qflags = 0; + SMB_BIG_UINT bsize = (SMB_BIG_UINT)BBSIZE; + struct fs_disk_quota D; + struct fs_quota_stat F; + int q_on = 0; + int q_off = 0; + ZERO_STRUCT(D); + ZERO_STRUCT(F); + + if (!bdev||!dp) + smb_panic("sys_set_xfs_quota: called with NULL pointer"); + + if (bsize == dp->bsize) { + D.d_blk_softlimit = dp->softlimit; + D.d_blk_hardlimit = dp->hardlimit; + D.d_ino_hardlimit = dp->ihardlimit; + D.d_ino_softlimit = dp->isoftlimit; + } else { + D.d_blk_softlimit = (dp->softlimit*dp->bsize)/bsize; + D.d_blk_hardlimit = (dp->hardlimit*dp->bsize)/bsize; + D.d_ino_hardlimit = (dp->ihardlimit*dp->bsize)/bsize; + D.d_ino_softlimit = (dp->isoftlimit*dp->bsize)/bsize; + } + + qflags = dp->qflags; + + switch (qtype) { + case SMB_USER_QUOTA_TYPE: + /* we use uid == 0 for default quotas */ + if (id.uid>0) { + D.d_fieldmask |= FS_DQ_LIMIT_MASK; + ret = quotactl(QCMD(Q_XSETQLIM,USRQUOTA), bdev, id.uid, (CADDR_T)&D); + } + break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_QUOTA_TYPE: + D.d_fieldmask |= FS_DQ_LIMIT_MASK; + ret = quotactl(QCMD(Q_XSETQLIM,GRPQUOTA), bdev, id.gid, (CADDR_T)&D); + break; +#endif /* HAVE_GROUP_QUOTA */ + case SMB_USER_FS_QUOTA_TYPE: + /* TODO */ + quotactl(QCMD(Q_XGETQSTAT,USRQUOTA), bdev, -1, (CADDR_T)&F); + + if (qflags & QUOTAS_DENY_DISK) { + if (!(F.qs_flags & XFS_QUOTA_UDQ_ENFD)) + q_on |= XFS_QUOTA_UDQ_ENFD; + if (!(F.qs_flags & XFS_QUOTA_UDQ_ACCT)) + q_on |= XFS_QUOTA_UDQ_ACCT; + + if (q_on != 0) { + ret = quotactl(QCMD(Q_XQUOTAON,USRQUOTA),bdev, -1, (CADDR_T)&q_on); + } + + } else if (qflags & QUOTAS_ENABLED) { + if (F.qs_flags & XFS_QUOTA_UDQ_ENFD) + q_off |= XFS_QUOTA_UDQ_ENFD; + + if (q_off != 0) { + ret = quotactl(QCMD(Q_XQUOTAOFF,USRQUOTA),bdev, -1, (CADDR_T)&q_off); + } + + if (!(F.qs_flags & XFS_QUOTA_UDQ_ACCT)) + q_on |= XFS_QUOTA_UDQ_ACCT; + + if (q_on != 0) { + ret = quotactl(QCMD(Q_XQUOTAON,USRQUOTA),bdev, -1, (CADDR_T)&q_on); + } + } else { +#if 0 + /* Switch on XFS_QUOTA_UDQ_ACCT didn't work! + * only swittching off XFS_QUOTA_UDQ_ACCT work + */ + if (F.qs_flags & XFS_QUOTA_UDQ_ENFD) + q_off |= XFS_QUOTA_UDQ_ENFD; + if (F.qs_flags & XFS_QUOTA_UDQ_ACCT) + q_off |= XFS_QUOTA_UDQ_ACCT; + + if (q_off !=0) { + ret = quotactl(QCMD(Q_XQUOTAOFF,USRQUOTA),bdev, -1, (CADDR_T)&q_off); + } +#endif + } + + /* we use uid == 0 for default quotas */ + D.d_fieldmask |= FS_DQ_LIMIT_MASK; + ret = quotactl(QCMD(Q_XSETQLIM,USRQUOTA), bdev, 0, (CADDR_T)&D); + break; + default: + errno = ENOSYS; + return -1; + } + + return ret; +} +#endif /* HAVE_XFS_QUOTA */ + + + + + + + + + + + + + + + +/********************************************************************* + Now the list of all filesystem specific quota systems we have found +**********************************************************************/ +static struct { + const char *name; + int (*get_quota)(const char *path, const char *bdev, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp); + int (*set_quota)(const char *path, const char *bdev, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp); +} sys_quota_backends[] = { +#ifdef HAVE_XFS_QUOTA + {"xfs", sys_get_xfs_quota, sys_set_xfs_quota}, +#endif /* HAVE_XFS_QUOTA */ + {NULL, NULL, NULL} +}; + +static int command_get_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp) +{ + const char *get_quota_command; + + get_quota_command = lp_get_quota_command(); + if (get_quota_command && *get_quota_command) { + const char *p; + char *p2; + char **lines; + pstring syscmd; + int _id = -1; + + switch(qtype) { + case SMB_USER_QUOTA_TYPE: + case SMB_USER_FS_QUOTA_TYPE: + _id = id.uid; + break; + case SMB_GROUP_QUOTA_TYPE: + case SMB_GROUP_FS_QUOTA_TYPE: + _id = id.gid; + break; + default: + DEBUG(0,("invalid quota type.\n")); + return -1; + } + + slprintf(syscmd, sizeof(syscmd)-1, + "%s \"%s\" %d %d", + get_quota_command, path, qtype, _id); + + DEBUG (3, ("get_quota: Running command %s\n", syscmd)); + + lines = file_lines_pload(syscmd, NULL); + if (lines) { + char *line = lines[0]; + + DEBUG (3, ("Read output from get_quota, \"r%s\"\n", line)); + + /* we need to deal with long long unsigned here, if supported */ + + dp->qflags = (enum SMB_QUOTA_TYPE)strtoul(line, &p2, 10); + p = p2; + while (p && *p && isspace(*p)) + p++; + if (p && *p) + dp->curblocks = STR_TO_SMB_BIG_UINT(p, &p); + else + goto invalid_param; + while (p && *p && isspace(*p)) + p++; + if (p && *p) + dp->softlimit = STR_TO_SMB_BIG_UINT(p, &p); + else + goto invalid_param; + while (p && *p && isspace(*p)) + p++; + if (p && *p) + dp->hardlimit = STR_TO_SMB_BIG_UINT(p, &p); + else + goto invalid_param; + while (p && *p && isspace(*p)) + p++; + if (p && *p) + dp->curinodes = STR_TO_SMB_BIG_UINT(p, &p); + else + goto invalid_param; + while (p && *p && isspace(*p)) + p++; + if (p && *p) + dp->isoftlimit = STR_TO_SMB_BIG_UINT(p, &p); + else + goto invalid_param; + while (p && *p && isspace(*p)) + p++; + if (p && *p) + dp->ihardlimit = STR_TO_SMB_BIG_UINT(p, &p); + else + goto invalid_param; + while (p && *p && isspace(*p)) + p++; + if (p && *p) + dp->bsize = STR_TO_SMB_BIG_UINT(p, NULL); + else + dp->bsize = 1024; + file_lines_free(lines); + DEBUG (3, ("Parsed output of get_quota, ...\n")); + +#ifdef LARGE_SMB_OFF_T + DEBUGADD (5,( + "qflags:%u curblocks:%llu softlimit:%llu hardlimit:%llu\n" + "curinodes:%llu isoftlimit:%llu ihardlimit:%llu bsize:%llu\n", + dp->qflags,(long long unsigned)dp->curblocks, + (long long unsigned)dp->softlimit,(long long unsigned)dp->hardlimit, + (long long unsigned)dp->curinodes, + (long long unsigned)dp->isoftlimit,(long long unsigned)dp->ihardlimit, + (long long unsigned)dp->bsize)); +#else /* LARGE_SMB_OFF_T */ + DEBUGADD (5,( + "qflags:%u curblocks:%lu softlimit:%lu hardlimit:%lu\n" + "curinodes:%lu isoftlimit:%lu ihardlimit:%lu bsize:%lu\n", + dp->qflags,(long unsigned)dp->curblocks, + (long unsigned)dp->softlimit,(long unsigned)dp->hardlimit, + (long unsigned)dp->curinodes, + (long unsigned)dp->isoftlimit,(long unsigned)dp->ihardlimit, + (long unsigned)dp->bsize)); +#endif /* LARGE_SMB_OFF_T */ + return 0; + } + + DEBUG (0, ("get_quota_command failed!\n")); + return -1; + } + + errno = ENOSYS; + return -1; + +invalid_param: + DEBUG(0,("The output of get_quota_command is invalid!\n")); + return -1; +} + +static int command_set_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp) +{ + const char *set_quota_command; + + set_quota_command = lp_set_quota_command(); + if (set_quota_command && *set_quota_command) { + char **lines; + pstring syscmd; + int _id = -1; + + switch(qtype) { + case SMB_USER_QUOTA_TYPE: + case SMB_USER_FS_QUOTA_TYPE: + _id = id.uid; + break; + case SMB_GROUP_QUOTA_TYPE: + case SMB_GROUP_FS_QUOTA_TYPE: + _id = id.gid; + break; + default: + return -1; + } + +#ifdef LARGE_SMB_OFF_T + slprintf(syscmd, sizeof(syscmd)-1, + "%s \"%s\" %d %d " + "%u %llu %llu " + "%llu %llu %llu ", + set_quota_command, path, qtype, _id, dp->qflags, + (long long unsigned)dp->softlimit,(long long unsigned)dp->hardlimit, + (long long unsigned)dp->isoftlimit,(long long unsigned)dp->ihardlimit, + (long long unsigned)dp->bsize); +#else /* LARGE_SMB_OFF_T */ + slprintf(syscmd, sizeof(syscmd)-1, + "%s \"%s\" %d %d " + "%u %lu %lu " + "%lu %lu %lu ", + set_quota_command, path, qtype, _id, dp->qflags, + (long unsigned)dp->softlimit,(long unsigned)dp->hardlimit, + (long unsigned)dp->isoftlimit,(long unsigned)dp->ihardlimit, + (long unsigned)dp->bsize); +#endif /* LARGE_SMB_OFF_T */ + + + + DEBUG (3, ("get_quota: Running command %s\n", syscmd)); + + lines = file_lines_pload(syscmd, NULL); + if (lines) { + char *line = lines[0]; + + DEBUG (3, ("Read output from set_quota, \"%s\"\n", line)); + + file_lines_free(lines); + + return 0; + } + DEBUG (0, ("set_quota_command failed!\n")); + return -1; + } + + errno = ENOSYS; + return -1; +} + +int sys_get_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp) +{ + int ret = -1; + int i; + BOOL ready = False; + char *mntpath = NULL; + char *bdev = NULL; + char *fs = NULL; + + if (!path||!dp) + smb_panic("sys_get_quota: called with NULL pointer"); + + if (command_get_quota(path, qtype, id, dp)==0) { + return 0; + } else if (errno != ENOSYS) { + return -1; + } + + if ((ret=sys_path_to_bdev(path,&mntpath,&bdev,&fs))!=0) { + return ret; + } + + for (i=0;(fs && sys_quota_backends[i].name && sys_quota_backends[i].get_quota);i++) { + if (strcmp(fs,sys_quota_backends[i].name)==0) { + ret = sys_quota_backends[i].get_quota(mntpath, bdev, qtype, id, dp); + ready = True; + break; + } + } + + if (!ready) { + /* use the default vfs quota functions */ + ret = sys_get_vfs_quota(mntpath, bdev, qtype, id, dp); + } + + SAFE_FREE(mntpath); + SAFE_FREE(bdev); + SAFE_FREE(fs); + + if ((ret!=0)&& (errno == EDQUOT)) { + return 0; + } + + return ret; +} + +int sys_set_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp) +{ + int ret = -1; + int i; + BOOL ready = False; + char *mntpath = NULL; + char *bdev = NULL; + char *fs = NULL; + + /* find the block device file */ + + if (!path||!dp) + smb_panic("get_smb_quota: called with NULL pointer"); + + if (command_set_quota(path, qtype, id, dp)==0) { + return 0; + } else if (errno != ENOSYS) { + return -1; + } + + if ((ret=sys_path_to_bdev(path,&mntpath,&bdev,&fs))!=0) { + return ret; + } + + for (i=0;(fs && sys_quota_backends[i].name && sys_quota_backends[i].set_quota);i++) { + if (strcmp(fs,sys_quota_backends[i].name)==0) { + ret = sys_quota_backends[i].set_quota(mntpath, bdev, qtype, id, dp); + ready = True; + break; + } + } + + if (!ready) { + /* use the default vfs quota functions */ + ret=sys_set_vfs_quota(mntpath, bdev, qtype, id, dp); + } + + SAFE_FREE(mntpath); + SAFE_FREE(bdev); + SAFE_FREE(fs); + + if ((ret!=0)&& (errno == EDQUOT)) { + return 0; + } + + return ret; +} + +#else /* HAVE_SYS_QUOTAS */ + void dummy_sysquotas_c(void) +{ + return; +} +#endif /* HAVE_SYS_QUOTAS */ + +#else /* ! AUTOCONF_TEST */ +/* this is the autoconf driver to test witch quota system we should use */ + +#if defined(HAVE_QUOTACTL_4A) +/* long quotactl(int cmd, char *special, qid_t id, caddr_t addr) */ + +#ifdef HAVE_SYS_TYPES_H +#include +#endif + +#ifdef HAVE_ASM_TYPES_H +#include +#endif + +#if defined(HAVE_LINUX_QUOTA_H) +# include +# if defined(HAVE_STRUCT_IF_DQBLK) +# define SYS_DQBLK if_dqblk +# elif defined(HAVE_STRUCT_MEM_DQBLK) +# define SYS_DQBLK mem_dqblk +# endif +#elif defined(HAVE_SYS_QUOTA_H) +# include +#endif + +#ifndef SYS_DQBLK +#define SYS_DQBLK dqblk +#endif + + int autoconf_quota(void) +{ + int ret = -1; + struct SYS_DQBLK D; + + ret = quotactl(Q_GETQUOTA,"/dev/hda1",0,(void *)&D); + + return ret; +} + +#elif defined(HAVE_QUOTACTL_4B) +/* int quotactl(const char *path, int cmd, int id, char *addr); */ + +#ifdef HAVE_SYS_QUOTA_H +#include +#else /* *BSD */ +#include +#include +#include +#endif + + int autoconf_quota(void) +{ + int ret = -1; + struct dqblk D; + + ret = quotactl("/",Q_GETQUOTA,0,(char *) &D); + + return ret; +} + +#elif defined(HAVE_QUOTACTL_3) +/* int quotactl (char *spec, int request, char *arg); */ + +#ifdef HAVE_SYS_TYPES_H +#include +#endif +#ifdef HAVE_SYS_QUOTA_H +#include +#endif + + int autoconf_quota(void) +{ + int ret = -1; + struct q_request request; + + ret = quotactl("/", Q_GETQUOTA, &request); + + return ret; +} + +#elif defined(HAVE_QUOTACTL_2) + +#error HAVE_QUOTACTL_2 not implemented + +#else + +#error Unknow QUOTACTL prototype + +#endif + + int main(void) +{ + autoconf_quota(); + return 0; +} +#endif /* AUTOCONF_TEST */ diff --git a/source3/libsmb/conncache.c b/source3/libsmb/conncache.c new file mode 100644 index 0000000000..e6604617d6 --- /dev/null +++ b/source3/libsmb/conncache.c @@ -0,0 +1,158 @@ +/* + Unix SMB/CIFS implementation. + + Winbind daemon connection manager + + Copyright (C) Tim Potter 2001 + Copyright (C) Andrew Bartlett 2002 + Copyright (C) Gerald (Jerry) Carter 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + + +#include "includes.h" + +#define FAILED_CONNECTION_CACHE_TIMEOUT 30 /* Seconds between attempts */ + +#define CONNCACHE_ADDR 1 +#define CONNCACHE_NAME 2 + +/* cache entry contains either a server name **or** and IP address as + the key. This means that a server could have two entries (one for each key) */ + +struct failed_connection_cache { + fstring domain_name; + fstring controller; + time_t lookup_time; + NTSTATUS nt_status; + struct failed_connection_cache *prev, *next; +}; + +static struct failed_connection_cache *failed_connection_cache; + +/********************************************************************** + Check for a previously failed connection +**********************************************************************/ + +NTSTATUS check_negative_conn_cache( const char *domain, const char *server ) +{ + struct failed_connection_cache *fcc; + NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + + /* can't check if we don't have strings */ + + if ( !domain || !server ) + return NT_STATUS_OK; + + for (fcc = failed_connection_cache; fcc; fcc = fcc->next) { + + if ( !(strequal(domain, fcc->domain_name) && strequal(server, fcc->controller)) ) + continue; /* no match; check the next entry */ + + /* we have a match so see if it is still current */ + + if ((time(NULL) - fcc->lookup_time) > FAILED_CONNECTION_CACHE_TIMEOUT) + { + /* Cache entry has expired, delete it */ + + DEBUG(10, ("check_negative_conn_cache: cache entry expired for %s, %s\n", + domain, server )); + + DLIST_REMOVE(failed_connection_cache, fcc); + SAFE_FREE(fcc); + + return NT_STATUS_OK; + } + + /* The timeout hasn't expired yet so return false */ + + DEBUG(10, ("check_negative_conn_cache: returning negative entry for %s, %s\n", + domain, server )); + + result = fcc->nt_status; + return result; + } + + /* end of function means no cache entry */ + return NT_STATUS_OK; +} + +/********************************************************************** + Add an entry to the failed conneciton cache (aither a name of dotted + decimal IP +**********************************************************************/ + +void add_failed_connection_entry(const char *domain, const char *server, NTSTATUS result) +{ + struct failed_connection_cache *fcc; + + SMB_ASSERT(!NT_STATUS_IS_OK(result)); + + /* Check we already aren't in the cache. We always have to have + a domain, but maybe not a specific DC name. */ + + for (fcc = failed_connection_cache; fcc; fcc = fcc->next) { + if ( strequal(fcc->domain_name, domain) && strequal(fcc->controller, server) ) + { + DEBUG(10, ("add_failed_connection_entry: domain %s (%s) already tried and failed\n", + domain, server )); + return; + } + } + + /* Create negative lookup cache entry for this domain and controller */ + + if ( !(fcc = (struct failed_connection_cache *)malloc(sizeof(struct failed_connection_cache))) ) + { + DEBUG(0, ("malloc failed in add_failed_connection_entry!\n")); + return; + } + + ZERO_STRUCTP(fcc); + + fstrcpy( fcc->domain_name, domain ); + fstrcpy( fcc->controller, server ); + fcc->lookup_time = time(NULL); + fcc->nt_status = result; + + DEBUG(10,("add_failed_connection_entry: added domain %s (%s) to failed conn cache\n", + domain, server )); + + DLIST_ADD(failed_connection_cache, fcc); +} + +/**************************************************************************** +****************************************************************************/ + +void flush_negative_conn_cache( void ) +{ + struct failed_connection_cache *fcc; + + fcc = failed_connection_cache; + + while (fcc) { + struct failed_connection_cache *fcc_next; + + fcc_next = fcc->next; + DLIST_REMOVE(failed_connection_cache, fcc); + free(fcc); + + fcc = fcc_next; + } + +} + + diff --git a/source3/libsmb/samlogon_cache.c b/source3/libsmb/samlogon_cache.c new file mode 100644 index 0000000000..72c10007bf --- /dev/null +++ b/source3/libsmb/samlogon_cache.c @@ -0,0 +1,238 @@ +/* + Unix SMB/CIFS implementation. + Net_sam_logon info3 helpers + Copyright (C) Alexander Bokovoy 2002. + Copyright (C) Andrew Bartlett 2002. + Copyright (C) Gerald Carter 2003. + Copyright (C) Tim Potter 2003. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" + +#define NETSAMLOGON_TDB "netsamlogon_cache.tdb" + +static TDB_CONTEXT *netsamlogon_tdb = NULL; + +/*********************************************************************** + open the tdb + ***********************************************************************/ + +BOOL netsamlogon_cache_init(void) +{ + if (!netsamlogon_tdb) { + netsamlogon_tdb = tdb_open_log(lock_path(NETSAMLOGON_TDB), 0, + TDB_DEFAULT, O_RDWR | O_CREAT, 0600); + } + + return (netsamlogon_tdb != NULL); +} + + +/*********************************************************************** + Shutdown samlogon_cache database +***********************************************************************/ + +BOOL netsamlogon_cache_shutdown(void) +{ + if(netsamlogon_tdb) + return (tdb_close(netsamlogon_tdb) == 0); + + return True; +} + +/*********************************************************************** + Clear cache getpwnam and getgroups entries from the winbindd cache +***********************************************************************/ +void netsamlogon_clear_cached_user(TDB_CONTEXT *tdb, NET_USER_INFO_3 *user) +{ + fstring domain; + TDB_DATA key; + BOOL got_tdb = False; + + /* We may need to call this function from smbd which will not have + winbindd_cache.tdb open. Open the tdb if a NULL is passed. */ + + if (!tdb) { + tdb = tdb_open_log(lock_path("winbindd_cache.tdb"), 5000, + TDB_DEFAULT, O_RDWR, 0600); + if (!tdb) { + DEBUG(5, ("netsamlogon_clear_cached_user: failed to open cache\n")); + return; + } + got_tdb = True; + } + + unistr2_to_ascii(domain, &user->uni_logon_dom, sizeof(domain) - 1); + + /* Clear U/DOMAIN/RID cache entry */ + + asprintf(&key.dptr, "U/%s/%d", domain, user->user_rid); + key.dsize = strlen(key.dptr) - 1; /* keys are not NULL terminated */ + + DEBUG(10, ("netsamlogon_clear_cached_user: clearing %s\n", key.dptr)); + + tdb_delete(tdb, key); + + SAFE_FREE(key.dptr); + + /* Clear UG/DOMAIN/RID cache entry */ + + asprintf(&key.dptr, "UG/%s/%d", domain, user->user_rid); + key.dsize = strlen(key.dptr) - 1; /* keys are not NULL terminated */ + + DEBUG(10, ("netsamlogon_clear_cached_user: clearing %s\n", key.dptr)); + + tdb_delete(tdb, key); + + SAFE_FREE(key.dptr); + + if (got_tdb) + tdb_close(tdb); +} + +/*********************************************************************** + Store a NET_USER_INFO_3 structure in a tdb for later user +***********************************************************************/ + +BOOL netsamlogon_cache_store(TALLOC_CTX *mem_ctx, NET_USER_INFO_3 *user) +{ + TDB_DATA data; + fstring keystr; + prs_struct ps; + BOOL result = False; + DOM_SID user_sid; + time_t t = time(NULL); + + + if (!netsamlogon_cache_init()) { + DEBUG(0,("netsamlogon_cache_store: cannot open %s for write!\n", NETSAMLOGON_TDB)); + return False; + } + + sid_copy( &user_sid, &user->dom_sid.sid ); + sid_append_rid( &user_sid, user->user_rid ); + + /* Prepare key as DOMAIN-SID/USER-RID string */ + slprintf(keystr, sizeof(keystr), "%s", sid_string_static(&user_sid)); + + DEBUG(10,("netsamlogon_cache_store: SID [%s]\n", keystr)); + + /* Prepare data */ + + prs_init( &ps,MAX_PDU_FRAG_LEN , mem_ctx, MARSHALL); + + if ( !prs_uint32( "timestamp", &ps, 0, (uint32*)&t ) ) + return False; + + if ( net_io_user_info3("", user, &ps, 0, 3) ) + { + data.dsize = prs_offset( &ps ); + data.dptr = prs_data_p( &ps ); + + if (tdb_store_bystring(netsamlogon_tdb, keystr, data, TDB_REPLACE) != -1) + result = True; + + prs_mem_free( &ps ); + } + + return result; +} + +/*********************************************************************** + Retrieves a NET_USER_INFO_3 structure from a tdb. Caller must + free the user_info struct (malloc()'d memory) +***********************************************************************/ + +NET_USER_INFO_3* netsamlogon_cache_get( TALLOC_CTX *mem_ctx, DOM_SID *user_sid) +{ + NET_USER_INFO_3 *user = NULL; + TDB_DATA data, key; + prs_struct ps; + fstring keystr; + uint32 t; + + if (!netsamlogon_cache_init()) { + DEBUG(0,("netsamlogon_cache_store: cannot open %s for write!\n", NETSAMLOGON_TDB)); + return False; + } + + /* Prepare key as DOMAIN-SID/USER-RID string */ + slprintf(keystr, sizeof(keystr), "%s", sid_string_static(user_sid)); + DEBUG(10,("netsamlogon_cache_get: SID [%s]\n", keystr)); + key.dptr = keystr; + key.dsize = strlen(keystr)+1; + data = tdb_fetch( netsamlogon_tdb, key ); + + if ( data.dptr ) { + + if ( (user = (NET_USER_INFO_3*)malloc(sizeof(NET_USER_INFO_3))) == NULL ) + return NULL; + + prs_init( &ps, 0, mem_ctx, UNMARSHALL ); + prs_give_memory( &ps, data.dptr, data.dsize, True ); + + if ( !prs_uint32( "timestamp", &ps, 0, &t ) ) { + prs_mem_free( &ps ); + return False; + } + + if ( !net_io_user_info3("", user, &ps, 0, 3) ) { + SAFE_FREE( user ); + } + + prs_mem_free( &ps ); + +#if 0 /* The netsamlogon cache needs to hang around. Something about + this feels wrong, but it is the only way we can get all of the + groups. The old universal groups cache didn't expire either. + --jerry */ + { + time_t now = time(NULL); + uint32 time_diff; + + /* is the entry expired? */ + time_diff = now - t; + + if ( (time_diff < 0 ) || (time_diff > lp_winbind_cache_time()) ) { + DEBUG(10,("netsamlogon_cache_get: cache entry expired \n")); + tdb_delete( netsamlogon_tdb, key ); + SAFE_FREE( user ); + } +#endif + } + + return user; +} + +BOOL netsamlogon_cache_have(DOM_SID *user_sid) +{ + TALLOC_CTX *mem_ctx = talloc_init("netsamlogon_cache_have"); + NET_USER_INFO_3 *user = NULL; + BOOL result; + + if (!mem_ctx) + return False; + + user = netsamlogon_cache_get(mem_ctx, user_sid); + + result = (user != NULL); + + talloc_destroy(mem_ctx); + SAFE_FREE(user); + + return result; +} diff --git a/source3/mainpage.dox b/source3/mainpage.dox new file mode 100644 index 0000000000..8b72f80462 --- /dev/null +++ b/source3/mainpage.dox @@ -0,0 +1,7 @@ +/** + +@mainpage + +@li \ref CodingSuggestions + +**/ diff --git a/source3/modules/weird.c b/source3/modules/weird.c new file mode 100644 index 0000000000..444853f383 --- /dev/null +++ b/source3/modules/weird.c @@ -0,0 +1,131 @@ +/* + Unix SMB/CIFS implementation. + Samba module with developer tools + Copyright (C) Andrew Tridgell 2001 + Copyright (C) Jelmer Vernooij 2002 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" + +static struct { + char from; + char *to; + int len; +} weird_table[] = { + {'q', "^q^", 3}, + {'Q', "^Q^", 3}, + {0, NULL} +}; + +static size_t weird_pull(void *cd, char **inbuf, size_t *inbytesleft, + char **outbuf, size_t *outbytesleft) +{ + while (*inbytesleft >= 1 && *outbytesleft >= 2) { + int i; + int done = 0; + for (i=0;weird_table[i].from;i++) { + if (strncmp((*inbuf), + weird_table[i].to, + weird_table[i].len) == 0) { + if (*inbytesleft < weird_table[i].len) { + DEBUG(0,("ERROR: truncated weird string\n")); + /* smb_panic("weird_pull"); */ + + } else { + (*outbuf)[0] = weird_table[i].from; + (*outbuf)[1] = 0; + (*inbytesleft) -= weird_table[i].len; + (*outbytesleft) -= 2; + (*inbuf) += weird_table[i].len; + (*outbuf) += 2; + done = 1; + break; + } + } + } + if (done) continue; + (*outbuf)[0] = (*inbuf)[0]; + (*outbuf)[1] = 0; + (*inbytesleft) -= 1; + (*outbytesleft) -= 2; + (*inbuf) += 1; + (*outbuf) += 2; + } + + if (*inbytesleft > 0) { + errno = E2BIG; + return -1; + } + + return 0; +} + +static size_t weird_push(void *cd, char **inbuf, size_t *inbytesleft, + char **outbuf, size_t *outbytesleft) +{ + int ir_count=0; + + while (*inbytesleft >= 2 && *outbytesleft >= 1) { + int i; + int done=0; + for (i=0;weird_table[i].from;i++) { + if ((*inbuf)[0] == weird_table[i].from && + (*inbuf)[1] == 0) { + if (*outbytesleft < weird_table[i].len) { + DEBUG(0,("No room for weird character\n")); + /* smb_panic("weird_push"); */ + } else { + memcpy(*outbuf, weird_table[i].to, + weird_table[i].len); + (*inbytesleft) -= 2; + (*outbytesleft) -= weird_table[i].len; + (*inbuf) += 2; + (*outbuf) += weird_table[i].len; + done = 1; + break; + } + } + } + if (done) continue; + + (*outbuf)[0] = (*inbuf)[0]; + if ((*inbuf)[1]) ir_count++; + (*inbytesleft) -= 2; + (*outbytesleft) -= 1; + (*inbuf) += 2; + (*outbuf) += 1; + } + + if (*inbytesleft == 1) { + errno = EINVAL; + return -1; + } + + if (*inbytesleft > 1) { + errno = E2BIG; + return -1; + } + + return ir_count; +} + +struct charset_functions weird_functions = {"WEIRD", weird_pull, weird_push}; + +NTSTATUS charset_weird_init(void) +{ + return smb_register_charset(&weird_functions); +} diff --git a/source3/nsswitch/winbindd_acct.c b/source3/nsswitch/winbindd_acct.c new file mode 100644 index 0000000000..a1cd1d5f19 --- /dev/null +++ b/source3/nsswitch/winbindd_acct.c @@ -0,0 +1,1209 @@ +/* + Unix SMB/CIFS implementation. + + Winbind account management functions + + Copyright (C) by Gerald (Jerry) Carter 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "winbindd.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_WINBIND + +#define WBKEY_PASSWD "WBA_PASSWD" +#define WBKEY_GROUP "WBA_GROUP" + +#define NUM_PW_FIELDS 7 +#define NUM_GRP_FIELDS 4 + +/* Globals */ + +static TDB_CONTEXT *account_tdb; + +extern userdom_struct current_user_info; + +struct _check_primary_grp { + gid_t gid; + BOOL found; +}; + +/********************************************************************** +**********************************************************************/ + +static void free_winbindd_gr( WINBINDD_GR *grp ) +{ + int i; + + if ( !grp ) + return; + + for ( i=0; inum_gr_mem; i++ ) + SAFE_FREE( grp->gr_mem[i] ); + + SAFE_FREE( grp->gr_mem ); + + return; +} + +/***************************************************************************** + Initialise auto-account database. +*****************************************************************************/ + +static BOOL winbindd_accountdb_init(void) +{ + /* see if we've already opened the tdb */ + + if ( account_tdb ) + return True; + + /* Nope. Try to open it */ + + if (!(account_tdb = tdb_open_log(lock_path("winbindd_idmap.tdb"), 0, + TDB_DEFAULT, O_RDWR | O_CREAT, 0600))) + { + /* last chance -- maybe idmap has already opened it */ + if ( !(account_tdb = idmap_tdb_handle()) ) { + + DEBUG(0, ("winbindd_idmap_init: Unable to open idmap database\n")); + return False; + } + } + + /* yeah! */ + + return True; +} + +/********************************************************************** + Convert a string in /etc/passwd format to a struct passwd* entry +**********************************************************************/ + +static WINBINDD_PW* string2passwd( char *string ) +{ + static WINBINDD_PW pw; + char *p, *str; + char *fields[NUM_PW_FIELDS]; + int i; + + if ( !string ) + return NULL; + + ZERO_STRUCTP( &pw ); + + DEBUG(10,("string2passwd: converting \"%s\"\n", string)); + + ZERO_STRUCT( fields ); + + for ( i=0, str=string; ipw_name ) + return NULL; + + DEBUG(10,("passwd2string: converting passwd struct for %s\n", + pw->pw_name)); + + ret = snprintf( string, sizeof(string), "%s:%s:%d:%d:%s:%s:%s", + pw->pw_name, + pw->pw_passwd ? pw->pw_passwd : "x", + pw->pw_uid, + pw->pw_gid, + pw->pw_gecos, + pw->pw_dir, + pw->pw_shell ); + + if ( ret < 0 ) { + DEBUG(0,("passwd2string: snprintf() failed!\n")); + return NULL; + } + + return string; +} + +/********************************************************************** + Convert a string in /etc/group format to a struct group* entry +**********************************************************************/ + +static WINBINDD_GR* string2group( char *string ) +{ + static WINBINDD_GR grp; + char *p, *str; + char *fields[NUM_GRP_FIELDS]; + int i; + char **gr_members = NULL; + int num_gr_members = 0; + + if ( !string ) + return NULL; + + ZERO_STRUCTP( &grp ); + + DEBUG(10,("string2group: converting \"%s\"\n", string)); + + ZERO_STRUCT( fields ); + + for ( i=0, str=string; igr_name ) + return NULL; + + DEBUG(10,("group2string: converting passwd struct for %s\n", + grp->gr_name)); + + if ( grp->num_gr_mem ) { + int idx = 0; + + member = grp->gr_mem[0]; + size = 0; + num_members = 0; + + while ( member ) { + size += strlen(member) + 1; + num_members++; + member = grp->gr_mem[num_members]; + } + + gr_mem_str = smb_xmalloc(size); + + for ( i=0; igr_mem[i] ); + idx += strlen(grp->gr_mem[i]) + 1; + } + /* add trailing NULL (also removes trailing ',' */ + gr_mem_str[size-1] = '\0'; + } + else { + /* no members */ + gr_mem_str = smb_xmalloc(sizeof(fstring)); + fstrcpy( gr_mem_str, "" ); + } + + ret = snprintf( string, sizeof(string)-1, "%s:%s:%d:%s", + grp->gr_name, + grp->gr_passwd ? grp->gr_passwd : "*", + grp->gr_gid, + gr_mem_str ); + + SAFE_FREE( gr_mem_str ); + + if ( ret < 0 ) { + DEBUG(0,("group2string: snprintf() failed!\n")); + return NULL; + } + + return string; +} + +/********************************************************************** +**********************************************************************/ + +static char* acct_userkey_byname( const char *name ) +{ + static fstring key; + + snprintf( key, sizeof(key), "%s/NAME/%s", WBKEY_PASSWD, name ); + + return key; +} + +/********************************************************************** +**********************************************************************/ + +static char* acct_userkey_byuid( uid_t uid ) +{ + static fstring key; + + snprintf( key, sizeof(key), "%s/UID/%d", WBKEY_PASSWD, uid ); + + return key; +} + +/********************************************************************** +**********************************************************************/ + +static char* acct_groupkey_byname( const char *name ) +{ + static fstring key; + + snprintf( key, sizeof(key), "%s/NAME/%s", WBKEY_GROUP, name ); + + return key; +} + +/********************************************************************** +**********************************************************************/ + +static char* acct_groupkey_bygid( gid_t gid ) +{ + static fstring key; + + snprintf( key, sizeof(key), "%s/GID/%d", WBKEY_GROUP, gid ); + + return key; +} + +/********************************************************************** +**********************************************************************/ + +WINBINDD_PW* wb_getpwnam( const char * name ) +{ + char *keystr; + TDB_DATA data; + static WINBINDD_PW *pw; + + if ( !account_tdb && !winbindd_accountdb_init() ) { + DEBUG(0,("wb_getpwnam: Failed to open winbindd account db\n")); + return NULL; + } + + + keystr = acct_userkey_byname( name ); + + data = tdb_fetch_bystring( account_tdb, keystr ); + + pw = NULL; + + if ( data.dptr ) { + pw = string2passwd( data.dptr ); + SAFE_FREE( data.dptr ); + } + + DEBUG(5,("wb_getpwnam: %s user (%s)\n", + (pw ? "Found" : "Did not find"), name )); + + return pw; +} + +/********************************************************************** +**********************************************************************/ + +WINBINDD_PW* wb_getpwuid( const uid_t uid ) +{ + char *keystr; + TDB_DATA data; + static WINBINDD_PW *pw; + + if ( !account_tdb && !winbindd_accountdb_init() ) { + DEBUG(0,("wb_getpwuid: Failed to open winbindd account db\n")); + return NULL; + } + + data = tdb_fetch_bystring( account_tdb, acct_userkey_byuid(uid) ); + if ( !data.dptr ) { + DEBUG(4,("wb_getpwuid: failed to locate uid == %d\n", uid)); + return NULL; + } + keystr = acct_userkey_byname( data.dptr ); + + SAFE_FREE( data.dptr ); + + data = tdb_fetch_bystring( account_tdb, keystr ); + + pw = NULL; + + if ( data.dptr ) { + pw = string2passwd( data.dptr ); + SAFE_FREE( data.dptr ); + } + + DEBUG(5,("wb_getpwuid: %s user (uid == %d)\n", + (pw ? "Found" : "Did not find"), uid )); + + return pw; +} + +/********************************************************************** +**********************************************************************/ + +BOOL wb_storepwnam( const WINBINDD_PW *pw ) +{ + char *namekey, *uidkey; + TDB_DATA data; + char *str; + int ret = 0; + fstring username; + + if ( !account_tdb && !winbindd_accountdb_init() ) { + DEBUG(0,("wb_storepwnam: Failed to open winbindd account db\n")); + return False; + } + + namekey = acct_userkey_byname( pw->pw_name ); + + /* lock the main entry first */ + + if ( tdb_lock_bystring(account_tdb, namekey, 0) == -1 ) { + DEBUG(0,("wb_storepwnam: Failed to lock %s\n", namekey)); + return False; + } + + str = passwd2string( pw ); + + data.dptr = str; + data.dsize = strlen(str) + 1; + + if ( (tdb_store_bystring(account_tdb, namekey, data, TDB_REPLACE)) == -1 ) { + DEBUG(0,("wb_storepwnam: Failed to store \"%s\"\n", str)); + ret = -1; + goto done; + } + + /* store the uid index */ + + uidkey = acct_userkey_byuid(pw->pw_uid); + + fstrcpy( username, pw->pw_name ); + data.dptr = username; + data.dsize = strlen(username) + 1; + + if ( (tdb_store_bystring(account_tdb, uidkey, data, TDB_REPLACE)) == -1 ) { + DEBUG(0,("wb_storepwnam: Failed to store uid key \"%s\"\n", str)); + tdb_delete_bystring(account_tdb, namekey); + ret = -1; + goto done; + } + + DEBUG(10,("wb_storepwnam: Success -> \"%s\"\n", str)); + +done: + tdb_unlock_bystring( account_tdb, namekey ); + + return ( ret == 0 ); +} + +/********************************************************************** +**********************************************************************/ + +WINBINDD_GR* wb_getgrnam( const char * name ) +{ + char *keystr; + TDB_DATA data; + static WINBINDD_GR *grp; + + if ( !account_tdb && !winbindd_accountdb_init() ) { + DEBUG(0,("wb_getgrnam: Failed to open winbindd account db\n")); + return NULL; + } + + + keystr = acct_groupkey_byname( name ); + + data = tdb_fetch_bystring( account_tdb, keystr ); + + grp = NULL; + + if ( data.dptr ) { + grp = string2group( data.dptr ); + SAFE_FREE( data.dptr ); + } + + DEBUG(5,("wb_getgrnam: %s group (%s)\n", + (grp ? "Found" : "Did not find"), name )); + + return grp; +} + +/********************************************************************** +**********************************************************************/ + +WINBINDD_GR* wb_getgrgid( gid_t gid ) +{ + char *keystr; + TDB_DATA data; + static WINBINDD_GR *grp; + + if ( !account_tdb && !winbindd_accountdb_init() ) { + DEBUG(0,("wb_getgrgid: Failed to open winbindd account db\n")); + return NULL; + } + + data = tdb_fetch_bystring( account_tdb, acct_groupkey_bygid(gid) ); + if ( !data.dptr ) { + DEBUG(4,("wb_getgrgid: failed to locate gid == %d\n", gid)); + return NULL; + } + keystr = acct_groupkey_byname( data.dptr ); + + SAFE_FREE( data.dptr ); + + data = tdb_fetch_bystring( account_tdb, keystr ); + + grp = NULL; + + if ( data.dptr ) { + grp = string2group( data.dptr ); + SAFE_FREE( data.dptr ); + } + + DEBUG(5,("wb_getgrgid: %s group (gid == %d)\n", + (grp ? "Found" : "Did not find"), gid )); + + return grp; +} + +/********************************************************************** +**********************************************************************/ + +BOOL wb_storegrnam( const WINBINDD_GR *grp ) +{ + char *namekey, *gidkey; + TDB_DATA data; + char *str; + int ret = 0; + fstring groupname; + + if ( !account_tdb && !winbindd_accountdb_init() ) { + DEBUG(0,("wb_storepwnam: Failed to open winbindd account db\n")); + return False; + } + + namekey = acct_groupkey_byname( grp->gr_name ); + + /* lock the main entry first */ + + if ( tdb_lock_bystring(account_tdb, namekey, 0) == -1 ) { + DEBUG(0,("wb_storegrnam: Failed to lock %s\n", namekey)); + return False; + } + + str = group2string( grp ); + + data.dptr = str; + data.dsize = strlen(str) + 1; + + if ( (tdb_store_bystring(account_tdb, namekey, data, TDB_REPLACE)) == -1 ) { + DEBUG(0,("wb_storegrnam: Failed to store \"%s\"\n", str)); + ret = -1; + goto done; + } + + /* store the gid index */ + + gidkey = acct_groupkey_bygid(grp->gr_gid); + + fstrcpy( groupname, grp->gr_name ); + data.dptr = groupname; + data.dsize = strlen(groupname) + 1; + + if ( (tdb_store_bystring(account_tdb, gidkey, data, TDB_REPLACE)) == -1 ) { + DEBUG(0,("wb_storegrnam: Failed to store gid key \"%s\"\n", str)); + tdb_delete_bystring(account_tdb, namekey); + ret = -1; + goto done; + } + + DEBUG(10,("wb_storegrnam: Success -> \"%s\"\n", str)); + +done: + tdb_unlock_bystring( account_tdb, namekey ); + + return ( ret == 0 ); +} + +/********************************************************************** +**********************************************************************/ + +static BOOL wb_addgrpmember( WINBINDD_GR *grp, const char *user ) +{ + int i; + char **members; + + if ( !grp || !user ) + return False; + + for ( i=0; inum_gr_mem; i++ ) { + if ( StrCaseCmp( grp->gr_mem[i], user ) == 0 ) + return True; + } + + /* add one new slot and keep an extra for the terminating NULL */ + members = Realloc( grp->gr_mem, (grp->num_gr_mem+2)*sizeof(char*) ); + if ( !members ) + return False; + + grp->gr_mem = members; + grp->gr_mem[grp->num_gr_mem++] = smb_xstrdup(user); + grp->gr_mem[grp->num_gr_mem] = NULL; + + return True; +} + +/********************************************************************** +**********************************************************************/ + +static BOOL wb_delgrpmember( WINBINDD_GR *grp, const char *user ) +{ + int i; + BOOL found = False; + + if ( !grp || !user ) + return False; + + for ( i=0; inum_gr_mem && !found; i++ ) { + if ( StrCaseCmp( grp->gr_mem[i], user ) == 0 ) + found = True; + } + + if ( !found ) + return False; + + /* still some remaining members */ + + if ( grp->num_gr_mem > 1 ) { + memmove( grp->gr_mem[i], grp->gr_mem[i+1], sizeof(char*)*(grp->num_gr_mem-(i+1)) ); + grp->num_gr_mem--; + } + else { /* last one */ + free_winbindd_gr( grp ); + grp->gr_mem = NULL; + grp->num_gr_mem = 0; + } + + return True; +} + +/********************************************************************** +**********************************************************************/ + +static int cleangroups_traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA dbuf, + void *state) +{ + int len; + fstring key; + char *name = (char*)state; + + snprintf( key, sizeof(key), "%s/NAME", WBKEY_GROUP ); + len = strlen(key); + + /* if this is a group entry then, check the members */ + + if ( (strncmp(kbuf.dptr, key, len) == 0) && dbuf.dptr ) { + WINBINDD_GR *grp; + + if ( !(grp = string2group( dbuf.dptr )) ) { + DEBUG(0,("cleangroups_traverse_fn: Failure to parse [%s]\n", + dbuf.dptr)); + return 0; + } + + /* just try to delete the user and rely on wb_delgrpmember() + to tell you whether or not the group changed. This is more + effecient than testing group membership first since the + checks for deleting a user from a group is essentially the + same as checking if he/she is a member */ + + if ( wb_delgrpmember( grp, name ) ) { + DEBUG(10,("cleanupgroups_traverse_fn: Removed user (%s) from group (%s)\n", + name, grp->gr_name)); + wb_storegrnam( grp ); + } + + free_winbindd_gr( grp ); + } + + return 0; +} + +/********************************************************************** +**********************************************************************/ + +static BOOL wb_delete_user( WINBINDD_PW *pw) +{ + char *namekey; + char *uidkey; + + if ( !account_tdb && !winbindd_accountdb_init() ) { + DEBUG(0,("wb_delete_user: Failed to open winbindd account db\n")); + return False; + } + + namekey = acct_userkey_byname( pw->pw_name ); + + /* lock the main entry first */ + + if ( tdb_lock_bystring(account_tdb, namekey, 0) == -1 ) { + DEBUG(0,("wb_delete_user: Failed to lock %s\n", namekey)); + return False; + } + + /* remove user from all groups */ + + tdb_traverse(account_tdb, cleangroups_traverse_fn, (void *)pw->pw_name); + + /* remove the user */ + uidkey = acct_userkey_byuid( pw->pw_uid ); + + tdb_delete_bystring( account_tdb, namekey ); + tdb_delete_bystring( account_tdb, uidkey ); + + tdb_unlock_bystring( account_tdb, namekey ); + + return True; +} + +/********************************************************************** +**********************************************************************/ + +static int isprimarygroup_traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, + TDB_DATA dbuf, void *params) +{ + int len; + fstring key; + struct _check_primary_grp *check = (struct _check_primary_grp*)params; + + snprintf( key, sizeof(key), "%s/NAME", WBKEY_PASSWD ); + len = strlen(key); + + /* if this is a group entry then, check the members */ + + if ( (strncmp(kbuf.dptr, key, len) == 0) && dbuf.dptr ) { + WINBINDD_PW *pw;; + + if ( !(pw = string2passwd( dbuf.dptr )) ) { + DEBUG(0,("isprimarygroup_traverse_fn: Failure to parse [%s]\n", + dbuf.dptr)); + return 0; + } + + if ( check->gid == pw->pw_gid ) { + check->found = True; + return 1; + } + } + + return 0; +} + + +/********************************************************************** +**********************************************************************/ + +static BOOL wb_delete_group( WINBINDD_GR *grp ) +{ + struct _check_primary_grp check; + char *namekey; + char *gidkey; + + if ( !account_tdb && !winbindd_accountdb_init() ) { + DEBUG(0,("wb_delete_group: Failed to open winbindd account db\n")); + return False; + } + + /* lock the main entry first */ + + namekey = acct_groupkey_byname( grp->gr_name ); + if ( tdb_lock_bystring(account_tdb, namekey, 0) == -1 ) { + DEBUG(0,("wb_delete_group: Failed to lock %s\n", namekey)); + return False; + } + + /* is this group the primary group for any user? If + so deny delete */ + + check.found = False; + tdb_traverse(account_tdb, isprimarygroup_traverse_fn, (void *)&check); + + if ( check.found ) { + DEBUG(4,("wb_delete_group: Cannot delete group (%s) since it " + "is the primary group for some users\n", grp->gr_name)); + return False; + } + + /* We're clear. Delete the group */ + + DEBUG(5,("wb_delete_group: Removing group (%s)\n", grp->gr_name)); + + gidkey = acct_groupkey_bygid( grp->gr_gid ); + + tdb_delete_bystring( account_tdb, namekey ); + tdb_delete_bystring( account_tdb, gidkey ); + + tdb_unlock_bystring( account_tdb, namekey ); + + return True; +} + +/********************************************************************** + Create a new "UNIX" user for the system given a username +**********************************************************************/ + +enum winbindd_result winbindd_create_user(struct winbindd_cli_state *state) +{ + char *user, *group; + unid_t id; + WINBINDD_PW pw; + WINBINDD_GR *wb_grp; + struct group *unix_grp; + gid_t primary_gid; + uint32 flags = state->request.flags; + uint32 rid; + + if ( !state->privileged ) { + DEBUG(2, ("winbindd_create_user: non-privileged access denied!\n")); + return WINBINDD_ERROR; + } + + /* Ensure null termination */ + state->request.data.acct_mgt.username[sizeof(state->request.data.acct_mgt.username)-1]='\0'; + state->request.data.acct_mgt.groupname[sizeof(state->request.data.acct_mgt.groupname)-1]='\0'; + + user = state->request.data.acct_mgt.username; + group = state->request.data.acct_mgt.groupname; + + DEBUG(3, ("[%5d]: create_user: user=>(%s), group=>(%s)\n", + state->pid, user, group)); + + if ( !*group ) + group = lp_template_primary_group(); + + /* validate the primary group + 1) lookup in local tdb first + 2) call getgrnam() as a last resort */ + + if ( (wb_grp=wb_getgrnam(group)) != NULL ) { + primary_gid = wb_grp->gr_gid; + free_winbindd_gr( wb_grp ); + } + else if ( (unix_grp=sys_getgrnam(group)) != NULL ) { + primary_gid = unix_grp->gr_gid; + } + else { + DEBUG(2,("winbindd_create_user: Cannot validate gid for group (%s)\n", group)); + return WINBINDD_ERROR; + } + + /* get a new uid */ + + if ( !NT_STATUS_IS_OK(idmap_allocate_id( &id, ID_USERID)) ) { + DEBUG(0,("winbindd_create_user: idmap_allocate_id() failed!\n")); + return WINBINDD_ERROR; + } + + /* The substitution of %U and %D in the 'template homedir' is done + by lp_string() calling standard_sub_basic(). */ + + fstrcpy( current_user_info.smb_name, user ); + sub_set_smb_name( user ); + fstrcpy( current_user_info.domain, get_global_sam_name() ); + + /* fill in the passwd struct */ + + fstrcpy( pw.pw_name, user ); + fstrcpy( pw.pw_passwd, "x" ); + fstrcpy( pw.pw_gecos, user); + fstrcpy( pw.pw_dir, lp_template_homedir() ); + fstrcpy( pw.pw_shell, lp_template_shell() ); + + pw.pw_uid = id.uid; + pw.pw_gid = primary_gid; + + /* store the new entry */ + + if ( !wb_storepwnam(&pw) ) + return WINBINDD_ERROR; + + /* do we need a new RID? */ + + if ( flags & WBFLAG_ALLOCATE_RID ) { + if ( !NT_STATUS_IS_OK(idmap_allocate_rid(&rid, USER_RID_TYPE)) ) { + DEBUG(0,("winbindd_create_user: RID allocation failure! Cannot create user (%s)\n", + user)); + wb_delete_user( &pw ); + + return WINBINDD_ERROR; + } + + state->response.data.rid = rid; + } + + return WINBINDD_OK; +} + +/********************************************************************** + Create a new "UNIX" group for the system given a username +**********************************************************************/ + +enum winbindd_result winbindd_create_group(struct winbindd_cli_state *state) +{ + char *group; + unid_t id; + WINBINDD_GR grp; + uint32 flags = state->request.flags; + uint32 rid; + + if ( !state->privileged ) { + DEBUG(2, ("winbindd_create_group: non-privileged access denied!\n")); + return WINBINDD_ERROR; + } + + /* Ensure null termination */ + state->request.data.acct_mgt.groupname[sizeof(state->request.data.acct_mgt.groupname)-1]='\0'; + group = state->request.data.acct_mgt.groupname; + + DEBUG(3, ("[%5d]: create_group: (%s)\n", state->pid, group)); + + /* get a new uid */ + + if ( !NT_STATUS_IS_OK(idmap_allocate_id( &id, ID_GROUPID)) ) { + DEBUG(0,("winbindd_create_group: idmap_allocate_id() failed!\n")); + return WINBINDD_ERROR; + } + + /* fill in the group struct */ + + fstrcpy( grp.gr_name, group ); + fstrcpy( grp.gr_passwd, "*" ); + + grp.gr_gid = id.gid; + grp.gr_mem = NULL; /* start with no members */ + grp.num_gr_mem = 0; + + if ( !wb_storegrnam(&grp) ) + return WINBINDD_ERROR; + + /* do we need a new RID? */ + + if ( flags & WBFLAG_ALLOCATE_RID ) { + if ( !NT_STATUS_IS_OK(idmap_allocate_rid(&rid, GROUP_RID_TYPE)) ) { + DEBUG(0,("winbindd_create_group: RID allocation failure! Cannot create group (%s)\n", + group)); + wb_delete_group( &grp ); + + return WINBINDD_ERROR; + } + + state->response.data.rid = rid; + } + + return WINBINDD_OK; +} + +/********************************************************************** + Add a user to the membership for a group. +**********************************************************************/ + +enum winbindd_result winbindd_add_user_to_group(struct winbindd_cli_state *state) +{ + WINBINDD_PW *pw; + WINBINDD_GR *grp; + char *user, *group; + BOOL ret; + + if ( !state->privileged ) { + DEBUG(2, ("winbindd_add_user_to_group: non-privileged access denied!\n")); + return WINBINDD_ERROR; + } + + /* Ensure null termination */ + state->request.data.acct_mgt.groupname[sizeof(state->request.data.acct_mgt.groupname)-1]='\0'; + state->request.data.acct_mgt.username[sizeof(state->request.data.acct_mgt.username)-1]='\0'; + group = state->request.data.acct_mgt.groupname; + user = state->request.data.acct_mgt.username; + + DEBUG(3, ("[%5d]: add_user_to_group: add %s to %s\n", state->pid, + user, group)); + + /* make sure it is a valid user */ + + if ( !(pw = wb_getpwnam( user )) ) { + DEBUG(4,("winbindd_add_user_to_group: Cannot add a non-existent user\n")); + return WINBINDD_ERROR; + } + + /* make sure it is a valid group */ + + if ( !(grp = wb_getgrnam( group )) ) { + DEBUG(4,("winbindd_add_user_to_group: Cannot add a user to a non-extistent group\n")); + return WINBINDD_ERROR; + } + + if ( !wb_addgrpmember( grp, user ) ) + return WINBINDD_ERROR; + + ret = wb_storegrnam(grp); + + free_winbindd_gr( grp ); + + return ( ret ? WINBINDD_OK : WINBINDD_ERROR ); +} + +/********************************************************************** + Remove a user from the membership of a group +**********************************************************************/ + +enum winbindd_result winbindd_remove_user_from_group(struct winbindd_cli_state *state) +{ + WINBINDD_GR *grp; + char *user, *group; + BOOL ret; + + if ( !state->privileged ) { + DEBUG(2, ("winbindd_remove_user_from_group: non-privileged access denied!\n")); + return WINBINDD_ERROR; + } + + /* Ensure null termination */ + state->request.data.acct_mgt.groupname[sizeof(state->request.data.acct_mgt.groupname)-1]='\0'; + state->request.data.acct_mgt.username[sizeof(state->request.data.acct_mgt.username)-1]='\0'; + group = state->request.data.acct_mgt.groupname; + user = state->request.data.acct_mgt.username; + + DEBUG(3, ("[%5d]: remove_user_to_group: delete %s from %s\n", state->pid, + user, group)); + + /* don't worry about checking the username since we're removing it anyways */ + + /* make sure it is a valid group */ + + if ( !(grp = wb_getgrnam( group )) ) { + DEBUG(4,("winbindd_remove_user_to_group: Cannot remove a user to a non-extistent group\n")); + return WINBINDD_ERROR; + } + + if ( !wb_delgrpmember( grp, user ) ) + return WINBINDD_ERROR; + + ret = wb_storegrnam(grp); + + free_winbindd_gr( grp ); + + return ( ret ? WINBINDD_OK : WINBINDD_ERROR ); +} + +/********************************************************************** + Set the primary group membership of a user +**********************************************************************/ + +enum winbindd_result winbindd_set_user_primary_group(struct winbindd_cli_state *state) +{ + WINBINDD_PW *pw; + WINBINDD_GR *grp; + char *user, *group; + + if ( !state->privileged ) { + DEBUG(2, ("winbindd_set_user_primary_group: non-privileged access denied!\n")); + return WINBINDD_ERROR; + } + + /* Ensure null termination */ + state->request.data.acct_mgt.groupname[sizeof(state->request.data.acct_mgt.groupname)-1]='\0'; + state->request.data.acct_mgt.username[sizeof(state->request.data.acct_mgt.username)-1]='\0'; + group = state->request.data.acct_mgt.groupname; + user = state->request.data.acct_mgt.username; + + DEBUG(3, ("[%5d]: set_user_primary_grou:p group %s for user %s\n", state->pid, + group, user)); + + /* make sure it is a valid user */ + + if ( !(pw = wb_getpwnam( user )) ) { + DEBUG(4,("winbindd_add_user_to_group: Cannot add a non-existent user\n")); + return WINBINDD_ERROR; + } + + /* make sure it is a valid group */ + + if ( !(grp = wb_getgrnam( group )) ) { + DEBUG(4,("winbindd_add_user_to_group: Cannot add a user to a non-extistent group\n")); + return WINBINDD_ERROR; + } + + pw->pw_gid = grp->gr_gid; + + free_winbindd_gr( grp ); + + return ( wb_storepwnam(pw) ? WINBINDD_OK : WINBINDD_ERROR ); +} + +/********************************************************************** + Delete a user from the winbindd account tdb. +**********************************************************************/ + +enum winbindd_result winbindd_delete_user(struct winbindd_cli_state *state) +{ + WINBINDD_PW *pw; + char *user; + + if ( !state->privileged ) { + DEBUG(2, ("winbindd_delete_user: non-privileged access denied!\n")); + return WINBINDD_ERROR; + } + + /* Ensure null termination */ + state->request.data.acct_mgt.username[sizeof(state->request.data.acct_mgt.username)-1]='\0'; + user = state->request.data.acct_mgt.username; + + DEBUG(3, ("[%5d]: delete_user: %s\n", state->pid, user)); + + /* make sure it is a valid user */ + + if ( !(pw = wb_getpwnam( user )) ) { + DEBUG(4,("winbindd_delete_user: Cannot delete a non-existent user\n")); + return WINBINDD_ERROR; + } + + return ( wb_delete_user(pw) ? WINBINDD_OK : WINBINDD_ERROR ); +} + +/********************************************************************** + Delete a group from winbindd's account tdb. +**********************************************************************/ + +enum winbindd_result winbindd_delete_group(struct winbindd_cli_state *state) +{ + WINBINDD_GR *grp; + char *group; + BOOL ret; + + if ( !state->privileged ) { + DEBUG(2, ("winbindd_delete_group: non-privileged access denied!\n")); + return WINBINDD_ERROR; + } + + /* Ensure null termination */ + state->request.data.acct_mgt.username[sizeof(state->request.data.acct_mgt.groupname)-1]='\0'; + group = state->request.data.acct_mgt.groupname; + + DEBUG(3, ("[%5d]: delete_group: %s\n", state->pid, group)); + + /* make sure it is a valid group */ + + if ( !(grp = wb_getgrnam( group )) ) { + DEBUG(4,("winbindd_delete_group: Cannot delete a non-existent group\n")); + return WINBINDD_ERROR; + } + + ret = wb_delete_group(grp); + + free_winbindd_gr( grp ); + + return ( ret ? WINBINDD_OK : WINBINDD_ERROR ); +} + + + diff --git a/source3/pam_smbpass/.cvsignore b/source3/pam_smbpass/.cvsignore new file mode 100644 index 0000000000..6d609cec52 --- /dev/null +++ b/source3/pam_smbpass/.cvsignore @@ -0,0 +1 @@ +*.po diff --git a/source3/passdb/pdb_plugin.c b/source3/passdb/pdb_plugin.c new file mode 100644 index 0000000000..ea67da23a5 --- /dev/null +++ b/source3/passdb/pdb_plugin.c @@ -0,0 +1,78 @@ +/* + Unix SMB/CIFS implementation. + Loadable passdb module interface. + Copyright (C) Jelmer Vernooij 2002 + Copyright (C) Andrew Bartlett 2002 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_PASSDB + +NTSTATUS pdb_init_plugin(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location) +{ + void * dl_handle; + char *plugin_location, *plugin_name, *p; + pdb_init_function plugin_init; + int (*plugin_version)(void); + + if (location == NULL) { + DEBUG(0, ("The plugin module needs an argument!\n")); + return NT_STATUS_UNSUCCESSFUL; + } + + plugin_name = smb_xstrdup(location); + p = strchr(plugin_name, ':'); + if (p) { + *p = 0; + plugin_location = p+1; + trim_string(plugin_location, " ", " "); + } else plugin_location = NULL; + trim_string(plugin_name, " ", " "); + + DEBUG(5, ("Trying to load sam plugin %s\n", plugin_name)); + dl_handle = sys_dlopen(plugin_name, RTLD_NOW ); + if (!dl_handle) { + DEBUG(0, ("Failed to load sam plugin %s using sys_dlopen (%s)\n", plugin_name, sys_dlerror())); + return NT_STATUS_UNSUCCESSFUL; + } + + plugin_version = sys_dlsym(dl_handle, "pdb_version"); + if (!plugin_version) { + sys_dlclose(dl_handle); + DEBUG(0, ("Failed to find function 'pdb_version' using sys_dlsym in sam plugin %s (%s)\n", plugin_name, sys_dlerror())); + return NT_STATUS_UNSUCCESSFUL; + } + + if (plugin_version() != PASSDB_INTERFACE_VERSION) { + sys_dlclose(dl_handle); + DEBUG(0, ("Wrong PASSDB_INTERFACE_VERSION! sam plugin has version %d and version %d is needed! Please update!\n", + plugin_version(),PASSDB_INTERFACE_VERSION)); + return NT_STATUS_UNSUCCESSFUL; + } + + plugin_init = sys_dlsym(dl_handle, "pdb_init"); + if (!plugin_init) { + sys_dlclose(dl_handle); + DEBUG(0, ("Failed to find function 'pdb_init' using sys_dlsym in sam plugin %s (%s)\n", plugin_name, sys_dlerror())); + return NT_STATUS_UNSUCCESSFUL; + } + + DEBUG(5, ("Starting sam plugin %s with location %s\n", plugin_name, plugin_location)); + return plugin_init(pdb_context, pdb_method, plugin_location); +} diff --git a/source3/script/mkbuildoptions.awk b/source3/script/mkbuildoptions.awk new file mode 100644 index 0000000000..cdc5bd9881 --- /dev/null +++ b/source3/script/mkbuildoptions.awk @@ -0,0 +1,262 @@ +BEGIN { + print "/* "; + print " Unix SMB/CIFS implementation."; + print " Build Options for Samba Suite"; + print " Copyright (C) Vance Lankhaar 2003"; + print " Copyright (C) Andrew Bartlett 2001"; + print " "; + print " This program is free software; you can redistribute it and/or modify"; + print " it under the terms of the GNU General Public License as published by"; + print " the Free Software Foundation; either version 2 of the License, or"; + print " (at your option) any later version."; + print " "; + print " This program is distributed in the hope that it will be useful,"; + print " but WITHOUT ANY WARRANTY; without even the implied warranty of"; + print " MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the"; + print " GNU General Public License for more details."; + print " "; + print " You should have received a copy of the GNU General Public License"; + print " along with this program; if not, write to the Free Software"; + print " Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA."; + print "*/"; + print ""; + print "#include \"includes.h\""; + print "#include \"build_env.h\""; + print "#include \"dynconfig.h\""; + print ""; + print "static void output(BOOL screen, const char *format, ...) PRINTF_ATTRIBUTE(2,3);"; + print ""; + print ""; + print "/****************************************************************************"; + print "helper function for build_options"; + print "****************************************************************************/"; + print "static void output(BOOL screen, const char *format, ...)"; + print "{"; + print " char *ptr;"; + print " va_list ap;"; + print " "; + print " va_start(ap, format);"; + print " vasprintf(&ptr,format,ap);"; + print " va_end(ap);"; + print ""; + print " if (screen) {"; + print " d_printf(\"%s\", ptr);"; + print " } else {"; + print " DEBUG(4,(\"%s\", ptr));"; + print " }"; + print " "; + print " SAFE_FREE(ptr);"; + print "}"; + print ""; + print "/****************************************************************************"; + print "options set at build time for the samba suite"; + print "****************************************************************************/"; + print "void build_options(BOOL screen)"; + print "{"; + print " if ((DEBUGLEVEL < 4) && (!screen)) {"; + print " return;"; + print " }"; + print ""; + print "#ifdef _BUILD_ENV_H"; + print " /* Output information about the build environment */"; + print " output(screen,\"Build environment:\\n\");"; + print " output(screen,\" Built by: %s@%s\\n\",BUILD_ENV_USER,BUILD_ENV_HOST);"; + print " output(screen,\" Built on: %s\\n\",BUILD_ENV_DATE);"; + print ""; + print " output(screen,\" Built using: %s\\n\",BUILD_ENV_COMPILER);"; + print " output(screen,\" Build host: %s\\n\",BUILD_ENV_UNAME);"; + print " output(screen,\" SRCDIR: %s\\n\",BUILD_ENV_SRCDIR);"; + print " output(screen,\" BUILDDIR: %s\\n\",BUILD_ENV_BUILDDIR);"; + print ""; + print " "; + print "#endif"; + print ""; + + print " /* Output various paths to files and directories */"; + print " output(screen,\"\\nPaths:\\n\");"; + + print " output(screen,\" SBINDIR: %s\\n\", dyn_SBINDIR);"; + print " output(screen,\" BINDIR: %s\\n\", dyn_BINDIR);"; + print " output(screen,\" SWATDIR: %s\\n\", dyn_SWATDIR);"; + + print " output(screen,\" CONFIGFILE: %s\\n\", dyn_CONFIGFILE);"; + print " output(screen,\" LOGFILEBASE: %s\\n\", dyn_LOGFILEBASE);"; + print " output(screen,\" LMHOSTSFILE: %s\\n\",dyn_LMHOSTSFILE);"; + + print " output(screen,\" LIBDIR: %s\\n\",dyn_LIBDIR);"; + print " output(screen,\" SHLIBEXT: %s\\n\",dyn_SHLIBEXT);"; + + print " output(screen,\" LOCKDIR: %s\\n\",dyn_LOCKDIR);"; + print " output(screen,\" PIDDIR: %s\\n\", dyn_PIDDIR);"; + + print " output(screen,\" SMB_PASSWD_FILE: %s\\n\",dyn_SMB_PASSWD_FILE);"; + print " output(screen,\" PRIVATE_DIR: %s\\n\",dyn_PRIVATE_DIR);"; + print ""; + + +################################################## +# predefine first element of *_ary +# predefine *_i (num of elements in *_ary) + with_ary[0]=""; + with_i=0; + have_ary[0]=""; + have_i=0; + utmp_ary[0]=""; + utmp_i=0; + misc_ary[0]=""; + misc_i=0; + sys_ary[0]=""; + sys_i=0; + headers_ary[0]=""; + headers_i=0; + in_comment = 0; +} + +# capture single line comments +/^\/\* (.*?)\*\// { + last_comment = $0; + next; +} + +# end capture multi-line comments +/(.*?)\*\// { + last_comment = last_comment $0; + in_comment = 0; + next; +} + +# capture middle lines of multi-line comments +in_comment { + last_comment = last_comment $0; + next; +} + +# begin capture multi-line comments +/^\/\* (.*?)/ { + last_comment = $0; + in_comment = 1; + next +} + +################################################## +# if we have an #undef and a last_comment, store it +/^\#undef/ { + split($0,a); + comments_ary[a[2]] = last_comment; + last_comment = ""; +} + +################################################## +# for each line, sort into appropriate section +# then move on + +/^\#undef WITH/ { + with_ary[with_i++] = a[2]; + # we want (I think) to allow --with to show up in more than one place, so no next +} + + +/^\#undef HAVE_UT_UT_/ || /^\#undef .*UTMP/ { + utmp_ary[utmp_i++] = a[2]; + next; +} + +/^\#undef HAVE_SYS_.*?_H$/ { + sys_ary[sys_i++] = a[2]; + next; +} + +/^\#undef HAVE_.*?_H$/ { + headers_ary[headers_i++] = a[2]; + next; +} + +/^\#undef HAVE_/ { + have_ary[have_i++] = a[2]; + next; +} + +/^\#undef/ { + misc_ary[misc_i++] = a[2]; + next; +} + + +################################################## +# simple sort function +function sort(ARRAY, ELEMENTS) { + for (i = 1; i <= ELEMENTS; ++i) { + for (j = i; (j-1) in ARRAY && (j) in ARRAY && ARRAY[j-1] > ARRAY[j]; --j) { + temp = ARRAY[j]; + ARRAY[j] = ARRAY[j-1]; + ARRAY[j-1] = temp; + } + } + return; +} + + +################################################## +# output code from list of defined +# expects: ARRAY an array of things defined +# ELEMENTS number of elements in ARRAY +# TITLE title for section +# returns: nothing +function output(ARRAY, ELEMENTS, TITLE) { + + # add section header + print "\n\t/* Show " TITLE " */"; + print "\toutput(screen, \"\\n " TITLE ":\\n\");\n"; + + + # sort element using bubble sort (slow, but easy) + sort(ARRAY, ELEMENTS); + + # loop through array of defines, outputting code + for (i = 0; i < ELEMENTS; i++) { + print "#ifdef " ARRAY[i]; + + # I don't know which one to use.... + + print "\toutput(screen, \" " ARRAY[i] "\\n\");"; + #printf "\toutput(screen, \" %s\\n %s\\n\\n\");\n", comments_ary[ARRAY[i]], ARRAY[i]; + #printf "\toutput(screen, \" %-35s %s\\n\");\n", ARRAY[i], comments_ary[ARRAY[i]]; + + print "#endif"; + } + return; +} + +END { + ################################################## + # add code to show various options + print "/* Output various other options (as gleaned from include/config.h.in) */"; + output(sys_ary, sys_i, "System Headers"); + output(headers_ary, headers_i, "Headers"); + output(utmp_ary, utmp_i, "UTMP Options"); + output(have_ary, have_i, "HAVE_* Defines"); + output(with_ary, with_i, "--with Options"); + output(misc_ary, misc_i, "Build Options"); + + ################################################## + # add code to display the various type sizes + print " /* Output the sizes of the various types */"; + print " output(screen, \"\\nType sizes:\\n\");"; + print " output(screen, \" sizeof(char): %u\\n\",sizeof(char));"; + print " output(screen, \" sizeof(int): %u\\n\",sizeof(int));"; + print " output(screen, \" sizeof(long): %u\\n\",sizeof(long));"; + print " output(screen, \" sizeof(uint8): %u\\n\",sizeof(uint8));"; + print " output(screen, \" sizeof(uint16): %u\\n\",sizeof(uint16));"; + print " output(screen, \" sizeof(uint32): %u\\n\",sizeof(uint32));"; + print " output(screen, \" sizeof(short): %u\\n\",sizeof(short));"; + print " output(screen, \" sizeof(void*): %u\\n\",sizeof(void*));"; + + ################################################## + # add code to give information about modules + print " output(screen, \"\\nBuiltin modules:\\n\");"; + print " output(screen, \" %s\\n\", STRING_STATIC_MODULES);"; + + print "}"; + +} + diff --git a/source3/smbd/fake_file.c b/source3/smbd/fake_file.c new file mode 100644 index 0000000000..86d78e039a --- /dev/null +++ b/source3/smbd/fake_file.c @@ -0,0 +1,166 @@ +/* + Unix SMB/CIFS implementation. + FAKE FILE suppport, for faking up special files windows want access to + Copyright (C) Stefan (metze) Metzmacher 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" + +/**************************************************************************** + Open a file with a share mode. +****************************************************************************/ +files_struct *open_fake_file_shared1(enum FAKE_FILE_TYPE fake_file_type, connection_struct *conn,char *fname, + SMB_STRUCT_STAT *psbuf, + uint32 desired_access, + int share_mode,int ofun, mode_t mode,int oplock_request, + int *Access,int *action) +{ + extern struct current_user current_user; + int flags=0; + files_struct *fsp = NULL; + + if (fake_file_type == 0) { + return open_file_shared1(conn,fname,psbuf,desired_access, + share_mode,ofun,mode, + oplock_request,Access,action); + } + + /* access check */ + if (conn->admin_user != True) { + DEBUG(1,("access_denied to service[%s] file[%s] user[%s]\n", + lp_servicename(SNUM(conn)),fname,conn->user)); + errno = EACCES; + return NULL; + } + + fsp = file_new(conn); + if(!fsp) + return NULL; + + DEBUG(5,("open_fake_file_shared1: fname = %s, FID = %d, share_mode = %x, ofun = %x, mode = %o, oplock request = %d\n", + fname, fsp->fnum, share_mode, ofun, (int)mode, oplock_request )); + + if (!check_name(fname,conn)) { + file_free(fsp); + return NULL; + } + + fsp->fd = -1; + fsp->mode = psbuf->st_mode; + fsp->inode = psbuf->st_ino; + fsp->dev = psbuf->st_dev; + fsp->vuid = current_user.vuid; + fsp->size = psbuf->st_size; + fsp->pos = -1; + fsp->can_lock = True; + fsp->can_read = ((flags & O_WRONLY)==0); + fsp->can_write = ((flags & (O_WRONLY|O_RDWR))!=0); + fsp->share_mode = 0; + fsp->desired_access = desired_access; + fsp->print_file = False; + fsp->modified = False; + fsp->oplock_type = NO_OPLOCK; + fsp->sent_oplock_break = NO_BREAK_SENT; + fsp->is_directory = False; + fsp->is_stat = False; + fsp->directory_delete_on_close = False; + fsp->conn = conn; + string_set(&fsp->fsp_name,fname); + fsp->wcp = NULL; /* Write cache pointer. */ + + fsp->fake_file_handle = init_fake_file_handle(fake_file_type); + + if (fsp->fake_file_handle==NULL) { + file_free(fsp); + return NULL; + } + + conn->num_files_open++; + return fsp; +} + +static FAKE_FILE fake_files[] = { +#ifdef WITH_QUOTAS + {FAKE_FILE_NAME_QUOTA, FAKE_FILE_TYPE_QUOTA, init_quota_handle, destroy_quota_handle}, +#endif /* WITH_QUOTAS */ + {NULL, FAKE_FILE_TYPE_NONE, NULL, NULL } +}; + +int is_fake_file(char *fname) +{ + int i; + + if (!fname) + return 0; + + for (i=0;fake_files[i].name!=NULL;i++) { + if (strncmp(fname,fake_files[i].name,strlen(fake_files[i].name))==0) { + DEBUG(5,("is_fake_file: [%s] is a fake file\n",fname)); + return fake_files[i].type; + } + } + + return FAKE_FILE_TYPE_NONE; +} + +struct _FAKE_FILE_HANDLE *init_fake_file_handle(enum FAKE_FILE_TYPE type) +{ + TALLOC_CTX *mem_ctx = NULL; + FAKE_FILE_HANDLE *fh = NULL; + int i; + + for (i=0;fake_files[i].name!=NULL;i++) { + if (fake_files[i].type==type) { + DEBUG(5,("init_fake_file_handle: for [%s]\n",fake_files[i].name)); + + if ((mem_ctx=talloc_init("fake_file_handle"))==NULL) { + DEBUG(0,("talloc_init(fake_file_handle) failed.\n")); + return NULL; + } + + if ((fh =(FAKE_FILE_HANDLE *)talloc_zero(mem_ctx, sizeof(FAKE_FILE_HANDLE)))==NULL) { + DEBUG(0,("talloc_zero() failed.\n")); + talloc_destroy(mem_ctx); + return NULL; + } + + fh->type = type; + fh->mem_ctx = mem_ctx; + + if (fake_files[i].init_pd) + fh->pd = fake_files[i].init_pd(fh->mem_ctx); + + fh->free_pd = fake_files[i].free_pd; + + return fh; + } + } + + return NULL; +} + +void destroy_fake_file_handle(FAKE_FILE_HANDLE **fh) +{ + if (!fh||!(*fh)) + return ; + + if ((*fh)->free_pd) + (*fh)->free_pd(&(*fh)->pd); + + talloc_destroy((*fh)->mem_ctx); + (*fh) = NULL; +} diff --git a/source3/smbd/ntquotas.c b/source3/smbd/ntquotas.c new file mode 100644 index 0000000000..2e865000ec --- /dev/null +++ b/source3/smbd/ntquotas.c @@ -0,0 +1,259 @@ +/* + Unix SMB/CIFS implementation. + NT QUOTA suppport + Copyright (C) Stefan (metze) Metzmacher 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" + +static SMB_BIG_UINT limit_nt2unix(SMB_BIG_UINT in, SMB_BIG_UINT bsize) +{ + SMB_BIG_UINT ret = (SMB_BIG_UINT)0; + + ret = (SMB_BIG_UINT)(in/bsize); + if (in>0 && ret==0) { + /* we have to make sure that a overflow didn't set NO_LIMIT */ + ret = (SMB_BIG_UINT)1; + } + + if (in == SMB_NTQUOTAS_NO_LIMIT) + ret = SMB_QUOTAS_NO_LIMIT; + else if (in == SMB_NTQUOTAS_NO_SPACE) + ret = SMB_QUOTAS_NO_SPACE; + else if (in == SMB_NTQUOTAS_NO_ENTRY) + ret = SMB_QUOTAS_NO_LIMIT; + + return ret; +} + +static SMB_BIG_UINT limit_unix2nt(SMB_BIG_UINT in, SMB_BIG_UINT bsize) +{ + SMB_BIG_UINT ret = (SMB_BIG_UINT)0; + + ret = (SMB_BIG_UINT)(in*bsize); + + if (ret < in) { + /* we overflow */ + ret = SMB_NTQUOTAS_NO_LIMIT; + } + + if (in == SMB_QUOTAS_NO_LIMIT) + ret = SMB_NTQUOTAS_NO_LIMIT; + + return ret; +} + +static SMB_BIG_UINT limit_blk2inodes(SMB_BIG_UINT in) +{ + SMB_BIG_UINT ret = (SMB_BIG_UINT)0; + + ret = (SMB_BIG_UINT)(in/2); + + if (ret == 0 && in != 0) + ret = (SMB_BIG_UINT)1; + + return ret; +} + +int vfs_get_ntquota(files_struct *fsp, enum SMB_QUOTA_TYPE qtype, DOM_SID *psid, SMB_NTQUOTA_STRUCT *qt) +{ + int ret; + SMB_DISK_QUOTA D; + unid_t id; + + ZERO_STRUCT(D); + + if (!fsp||!fsp->conn||!qt) + return (-1); + + ZERO_STRUCT(*qt); + + id.uid = -1; + + if (psid && !NT_STATUS_IS_OK(sid_to_uid(psid, &id.uid))) { + DEBUG(0,("sid_to_uid: failed, SID[%s]\n", + sid_string_static(psid))); + } + + ret = SMB_VFS_GET_QUOTA(fsp->conn, qtype, id, &D); + + if (psid) + qt->sid = *psid; + + if (ret!=0) { + return ret; + } + + qt->usedspace = (SMB_BIG_UINT)D.curblocks*D.bsize; + qt->softlim = limit_unix2nt(D.softlimit, D.bsize); + qt->hardlim = limit_unix2nt(D.hardlimit, D.bsize); + qt->qflags = D.qflags; + + + return 0; +} + +int vfs_set_ntquota(files_struct *fsp, enum SMB_QUOTA_TYPE qtype, DOM_SID *psid, SMB_NTQUOTA_STRUCT *qt) +{ + int ret; + SMB_DISK_QUOTA D; + unid_t id; + ZERO_STRUCT(D); + + if (!fsp||!fsp->conn||!qt) + return (-1); + + id.uid = -1; + + D.bsize = (SMB_BIG_UINT)QUOTABLOCK_SIZE; + + D.softlimit = limit_nt2unix(qt->softlim,D.bsize); + D.hardlimit = limit_nt2unix(qt->hardlim,D.bsize); + D.qflags = qt->qflags; + + D.isoftlimit = limit_blk2inodes(D.softlimit); + D.ihardlimit = limit_blk2inodes(D.hardlimit); + + if (psid && !NT_STATUS_IS_OK(sid_to_uid(psid, &id.uid))) { + DEBUG(0,("sid_to_uid: failed, SID[%s]\n", + sid_string_static(psid))); + } + + ret = SMB_VFS_SET_QUOTA(fsp->conn, qtype, id, &D); + + return ret; +} + +static BOOL allready_in_quota_list(SMB_NTQUOTA_LIST *qt_list, uid_t uid) +{ + SMB_NTQUOTA_LIST *tmp_list = NULL; + + if (!qt_list) + return False; + + for (tmp_list=qt_list;tmp_list!=NULL;tmp_list=tmp_list->next) { + if (tmp_list->uid == uid) { + return True; + } + } + + return False; +} + +int vfs_get_user_ntquota_list(files_struct *fsp, SMB_NTQUOTA_LIST **qt_list) +{ + struct passwd *usr; + TALLOC_CTX *mem_ctx = NULL; + + if (!fsp||!fsp->conn||!qt_list) + return (-1); + + *qt_list = NULL; + + if ((mem_ctx=talloc_init("SMB_USER_QUOTA_LIST"))==NULL) { + DEBUG(0,("talloc_init() failed\n")); + return (-1); + } + + sys_setpwent(); + while ((usr = sys_getpwent()) != NULL) { + SMB_NTQUOTA_STRUCT tmp_qt; + SMB_NTQUOTA_LIST *tmp_list_ent; + DOM_SID sid; + + ZERO_STRUCT(tmp_qt); + + if (allready_in_quota_list((*qt_list),usr->pw_uid)) { + DEBUG(5,("record for uid[%ld] allready in the list\n",(long)usr->pw_uid)); + continue; + } + + if (!NT_STATUS_IS_OK(uid_to_sid(&sid, usr->pw_uid))) { + DEBUG(0,("uid_to_sid failed for %ld\n",(long)usr->pw_uid)); + continue; + } + + if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &tmp_qt)!=0) { + DEBUG(1,("no quota entry for sid[%s] path[%s]\n", + sid_string_static(&sid),fsp->conn->connectpath)); + continue; + } + + DEBUG(15,("quota entry for id[%s] path[%s]\n", + sid_string_static(&sid),fsp->conn->connectpath)); + + if ((tmp_list_ent=(SMB_NTQUOTA_LIST *)talloc_zero(mem_ctx,sizeof(SMB_NTQUOTA_LIST)))==NULL) { + DEBUG(0,("talloc_zero() failed\n")); + *qt_list = NULL; + talloc_destroy(mem_ctx); + return (-1); + } + + if ((tmp_list_ent->quotas=(SMB_NTQUOTA_STRUCT *)talloc_zero(mem_ctx,sizeof(SMB_NTQUOTA_STRUCT)))==NULL) { + DEBUG(0,("talloc_zero() failed\n")); + *qt_list = NULL; + talloc_destroy(mem_ctx); + return (-1); + } + + tmp_list_ent->uid = usr->pw_uid; + memcpy(tmp_list_ent->quotas,&tmp_qt,sizeof(tmp_qt)); + tmp_list_ent->mem_ctx = mem_ctx; + + DLIST_ADD((*qt_list),tmp_list_ent); + + } + sys_endpwent(); + + return 0; +} + +void *init_quota_handle(TALLOC_CTX *mem_ctx) +{ + SMB_NTQUOTA_HANDLE *qt_handle; + + if (!mem_ctx) + return False; + + qt_handle = (SMB_NTQUOTA_HANDLE *)talloc_zero(mem_ctx,sizeof(SMB_NTQUOTA_HANDLE)); + if (qt_handle==NULL) { + DEBUG(0,("talloc_zero() failed\n")); + return NULL; + } + + return (void *)qt_handle; +} + +void destroy_quota_handle(void **pqt_handle) +{ + SMB_NTQUOTA_HANDLE *qt_handle = NULL; + if (!pqt_handle||!(*pqt_handle)) + return; + + qt_handle = (*pqt_handle); + + + if (qt_handle->quota_list) + free_ntquota_list(&qt_handle->quota_list); + + qt_handle->quota_list = NULL; + qt_handle->tmp_list = NULL; + qt_handle = NULL; + + return; +} + diff --git a/source3/tdb/tdbback.c b/source3/tdb/tdbback.c new file mode 100644 index 0000000000..744cface55 --- /dev/null +++ b/source3/tdb/tdbback.c @@ -0,0 +1,201 @@ +/* + Unix SMB/CIFS implementation. + low level tdb backup and restore utility + Copyright (C) Andrew Tridgell 2002 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "tdb.h" + +static int failed; + +char *add_suffix(const char *name, const char *suffix) +{ + char *ret; + int len = strlen(name) + strlen(suffix) + 1; + ret = malloc(len); + if (!ret) { + fprintf(stderr,"Out of memory!\n"); + exit(1); + } + strncpy(ret, name, len); + strncat(ret, suffix, len); + return ret; +} + +static int copy_fn(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA dbuf, void *state) +{ + TDB_CONTEXT *tdb_new = (TDB_CONTEXT *)state; + + if (tdb_store(tdb_new, key, dbuf, TDB_INSERT) != 0) { + fprintf(stderr,"Failed to insert into %s\n", tdb_new->name); + failed = 1; + return 1; + } + return 0; +} + + +static int test_fn(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA dbuf, void *state) +{ + return 0; +} + +/* + carefully backup a tdb, validating the contents and + only doing the backup if its OK + this function is also used for restore +*/ +int backup_tdb(const char *old_name, const char *new_name) +{ + TDB_CONTEXT *tdb; + TDB_CONTEXT *tdb_new; + char *tmp_name; + struct stat st; + int count1, count2; + + tmp_name = add_suffix(new_name, ".tmp"); + + /* stat the old tdb to find its permissions */ + if (stat(old_name, &st) != 0) { + perror(old_name); + return 1; + } + + /* open the old tdb */ + tdb = tdb_open(old_name, 0, 0, O_RDWR, 0); + if (!tdb) { + printf("Failed to open %s\n", old_name); + return 1; + } + + /* create the new tdb */ + unlink(tmp_name); + tdb_new = tdb_open(tmp_name, tdb->header.hash_size, + TDB_DEFAULT, O_RDWR|O_CREAT|O_EXCL, + st.st_mode & 0777); + if (!tdb_new) { + perror(tmp_name); + free(tmp_name); + return 1; + } + + /* lock the old tdb */ + if (tdb_lockall(tdb) != 0) { + fprintf(stderr,"Failed to lock %s\n", old_name); + tdb_close(tdb); + tdb_close(tdb_new); + unlink(tmp_name); + free(tmp_name); + return 1; + } + + failed = 0; + + /* traverse and copy */ + count1 = tdb_traverse(tdb, copy_fn, (void *)tdb_new); + if (count1 < 0 || failed) { + fprintf(stderr,"failed to copy %s\n", old_name); + tdb_close(tdb); + tdb_close(tdb_new); + unlink(tmp_name); + free(tmp_name); + return 1; + } + + /* close the old tdb */ + tdb_close(tdb); + + /* close the new tdb and re-open read-only */ + tdb_close(tdb_new); + tdb_new = tdb_open(tmp_name, 0, TDB_DEFAULT, O_RDONLY, 0); + if (!tdb_new) { + fprintf(stderr,"failed to reopen %s\n", tmp_name); + unlink(tmp_name); + perror(tmp_name); + free(tmp_name); + return 1; + } + + /* traverse the new tdb to confirm */ + count2 = tdb_traverse(tdb_new, test_fn, 0); + if (count2 != count1) { + fprintf(stderr,"failed to copy %s\n", old_name); + tdb_close(tdb_new); + unlink(tmp_name); + free(tmp_name); + return 1; + } + + /* make sure the new tdb has reached stable storage */ + fsync(tdb_new->fd); + + /* close the new tdb and rename it to .bak */ + tdb_close(tdb_new); + unlink(new_name); + if (rename(tmp_name, new_name) != 0) { + perror(new_name); + free(tmp_name); + return 1; + } + + free(tmp_name); + + return 0; +} + + + +/* + verify a tdb and if it is corrupt then restore from *.bak +*/ +int verify_tdb(const char *fname, const char *bak_name) +{ + TDB_CONTEXT *tdb; + int count = -1; + + /* open the tdb */ + tdb = tdb_open(fname, 0, 0, O_RDONLY, 0); + + /* traverse the tdb, then close it */ + if (tdb) { + count = tdb_traverse(tdb, test_fn, NULL); + tdb_close(tdb); + } + + /* count is < 0 means an error */ + if (count < 0) { + printf("restoring %s\n", fname); + return backup_tdb(bak_name, fname); + } + + printf("%s : %d records\n", fname, count); + + return 0; +} diff --git a/source3/tdb/tdbback.h b/source3/tdb/tdbback.h new file mode 100644 index 0000000000..7ebeaa494d --- /dev/null +++ b/source3/tdb/tdbback.h @@ -0,0 +1,23 @@ +/* + Unix SMB/CIFS implementation. + low level tdb backup and restore utility + Copyright (C) Andrew Tridgell 2002 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +char *add_suffix(const char *name, const char *suffix); +int backup_tdb(const char *old_name, const char *new_name); +int verify_tdb(const char *fname, const char *bak_name); diff --git a/source3/utils/net_idmap.c b/source3/utils/net_idmap.c new file mode 100644 index 0000000000..689d4ff813 --- /dev/null +++ b/source3/utils/net_idmap.c @@ -0,0 +1,156 @@ +/* + Samba Unix/Linux SMB client library + Distributed SMB/CIFS Server Management Utility + Copyright (C) 2003 Andrew Bartlett (abartlet@samba.org) + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ + +#include "includes.h" +#include "../utils/net.h" + + +/*********************************************************** + Helper function for net_idmap_dump. Dump one entry. + **********************************************************/ +static int net_idmap_dump_one_entry(TDB_CONTEXT *tdb, + TDB_DATA key, + TDB_DATA data, + void *unused) +{ + if (strcmp(key.dptr, "USER HWM") == 0) { + printf("USER HWM %d\n", IVAL(data.dptr,0)); + return 0; + } + + if (strcmp(key.dptr, "GROUP HWM") == 0) { + printf("GROUP HWM %d\n", IVAL(data.dptr,0)); + return 0; + } + + if (strncmp(key.dptr, "S-", 2) != 0) + return 0; + + printf("%s %s\n", data.dptr, key.dptr); + return 0; +} + +/*********************************************************** + Dump the current idmap + **********************************************************/ +static int net_idmap_dump(int argc, const char **argv) +{ + TDB_CONTEXT *idmap_tdb; + + if ( argc != 1 ) + return net_help_idmap( argc, argv ); + + idmap_tdb = tdb_open_log(argv[0], 0, TDB_DEFAULT, O_RDONLY, 0); + + if (idmap_tdb == NULL) { + d_printf("Could not open idmap: %s\n", argv[0]); + return -1; + } + + tdb_traverse(idmap_tdb, net_idmap_dump_one_entry, NULL); + + tdb_close(idmap_tdb); + + return 0; +} + +/*********************************************************** + Write entries from stdin to current local idmap + **********************************************************/ +static int net_idmap_restore(int argc, const char **argv) +{ + if (!idmap_init(lp_idmap_backend())) { + d_printf("Could not init idmap\n"); + return -1; + } + + while (!feof(stdin)) { + fstring line, sid_string; + int len; + unid_t id; + int type = ID_EMPTY; + DOM_SID sid; + + if (fgets(line, sizeof(line)-1, stdin) == NULL) + break; + + len = strlen(line); + + if ( (len > 0) && (line[len-1] == '\n') ) + line[len-1] = '\0'; + + if (sscanf(line, "GID %d %s", &id.gid, sid_string) == 2) { + type = ID_GROUPID; + } + + if (sscanf(line, "UID %d %s", &id.uid, sid_string) == 2) { + type = ID_USERID; + } + + if (type == ID_EMPTY) { + d_printf("ignoring invalid line [%s]\n", line); + continue; + } + + if (!string_to_sid(&sid, sid_string)) { + d_printf("ignoring invalid sid [%s]\n", sid_string); + continue; + } + + if (!NT_STATUS_IS_OK(idmap_set_mapping(&sid, id, type))) { + d_printf("Could not set mapping of %s %d to sid %s\n", + (type == ID_GROUPID) ? "GID" : "UID", + (type == ID_GROUPID) ? id.gid : id.uid, + sid_string_static(&sid)); + continue; + } + + } + + idmap_close(); + return 0; +} + +int net_help_idmap(int argc, const char **argv) +{ + d_printf("net idmap dump filename"\ + "\n Dump current id mapping\n"); + + d_printf("net idmap restore"\ + "\n Restore entries from stdin to current local idmap\n"); + + return -1; +} + +/*********************************************************** + Look at the current idmap + **********************************************************/ +int net_idmap(int argc, const char **argv) +{ + struct functable func[] = { + {"dump", net_idmap_dump}, + {"restore", net_idmap_restore}, + {"help", net_help_idmap}, + {NULL, NULL} + }; + + return net_run_function(argc, argv, func, net_help_idmap); +} + + diff --git a/testsuite/build_farm/torture-DIR1.test b/testsuite/build_farm/torture-DIR1.test new file mode 100644 index 0000000000..6cc075e9ba --- /dev/null +++ b/testsuite/build_farm/torture-DIR1.test @@ -0,0 +1,2 @@ +. torture_setup.fns +test_torture "DIR1" diff --git a/testsuite/build_farm/torture-FDSESS.test b/testsuite/build_farm/torture-FDSESS.test new file mode 100644 index 0000000000..e8af277d43 --- /dev/null +++ b/testsuite/build_farm/torture-FDSESS.test @@ -0,0 +1,2 @@ +. torture_setup.fns +test_torture "FDPASS" diff --git a/testsuite/build_farm/torture-LOCK6.test b/testsuite/build_farm/torture-LOCK6.test new file mode 100644 index 0000000000..78e139e310 --- /dev/null +++ b/testsuite/build_farm/torture-LOCK6.test @@ -0,0 +1,2 @@ +. torture_setup.fns +test_torture "LOCK6" diff --git a/testsuite/build_farm/torture-LOCK7.test b/testsuite/build_farm/torture-LOCK7.test new file mode 100644 index 0000000000..fc967fca57 --- /dev/null +++ b/testsuite/build_farm/torture-LOCK7.test @@ -0,0 +1,2 @@ +. torture_setup.fns +test_torture "LOCK7" diff --git a/testsuite/build_farm/torture-MANGLE.test b/testsuite/build_farm/torture-MANGLE.test new file mode 100644 index 0000000000..5a3d478a45 --- /dev/null +++ b/testsuite/build_farm/torture-MANGLE.test @@ -0,0 +1,2 @@ +. torture_setup.fns +test_torture "MANGLE" diff --git a/testsuite/build_farm/torture-PROPERTIES.test b/testsuite/build_farm/torture-PROPERTIES.test new file mode 100644 index 0000000000..91fde27f8a --- /dev/null +++ b/testsuite/build_farm/torture-PROPERTIES.test @@ -0,0 +1,2 @@ +. torture_setup.fns +test_torture "PROPERTIES" diff --git a/testsuite/build_farm/torture-TCON1.test b/testsuite/build_farm/torture-TCON1.test new file mode 100644 index 0000000000..3c9267640d --- /dev/null +++ b/testsuite/build_farm/torture-TCON1.test @@ -0,0 +1,2 @@ +. torture_setup.fns +test_torture "TCON1" diff --git a/testsuite/build_farm/torture-TCON2.test b/testsuite/build_farm/torture-TCON2.test new file mode 100644 index 0000000000..1f30a975da --- /dev/null +++ b/testsuite/build_farm/torture-TCON2.test @@ -0,0 +1,2 @@ +. torture_setup.fns +test_torture "TCON2" diff --git a/testsuite/build_farm/torture-TCONDEV.test b/testsuite/build_farm/torture-TCONDEV.test new file mode 100644 index 0000000000..18bd5345fb --- /dev/null +++ b/testsuite/build_farm/torture-TCONDEV.test @@ -0,0 +1,2 @@ +. torture_setup.fns +test_torture "TCONDEV" -- cgit From 04382a5266fd618e81d8ac454db9a04a1fda7c1b Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Thu, 17 Jul 2003 01:58:36 +0000 Subject: should not have been checked in. My fault (This used to be commit af0efeeccfc6f4bc78c6baafd2bded404cc2a551) --- source3/build-me | 36 ------------------------------------ 1 file changed, 36 deletions(-) delete mode 100755 source3/build-me diff --git a/source3/build-me b/source3/build-me deleted file mode 100755 index a5d3f32f70..0000000000 --- a/source3/build-me +++ /dev/null @@ -1,36 +0,0 @@ -#!/bin/sh - -umask 022 - -## Build options -CONFIGUREOPT="--enable-debug --enable-developer --with-pam --with-libsmbclient=no --with-static-modules" -export CONFIGUREOPT - -./autogen.sh - -case "$1" in - dmalloc) - env CFLAGS="-Wall" ./configure \ - --enable-dmalloc \ - $CONFIGUREOPT - ;; - insure) - env CFLAGS="-g" CC="insure" ./configure \ - $CONFIGUREOPT - ;; - ccache) - env CFLAGS="-Wall" CC="ccache gcc" ./configure \ - $CONFIGUREOPT - ;; - *) - env CFLAGS="-Wall" ./configure \ - $CONFIGUREOPT - ;; -esac - -## disable optimization -sed 's/-O //g' Makefile | sed 's/-O2 //g' > Makefile.new; /bin/mv -f Makefile.new Makefile - -## build -make proto -make all modules -- cgit From c39c02e1aeeb74e8c45b32d99d9354eb66040171 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Thu, 17 Jul 2003 02:49:26 +0000 Subject: fix the build. Ifdef out some code (This used to be commit e66541d0e1befec5d589890994454dd639ea0665) --- source3/rpc_client/cli_lsarpc.c | 3 + source3/rpc_parse/parse_lsa.c | 18 +- source3/smbd/build_options.c | 532 ---------------------------------------- 3 files changed, 13 insertions(+), 540 deletions(-) delete mode 100644 source3/smbd/build_options.c diff --git a/source3/rpc_client/cli_lsarpc.c b/source3/rpc_client/cli_lsarpc.c index db873236e4..b01cf8ed4a 100644 --- a/source3/rpc_client/cli_lsarpc.c +++ b/source3/rpc_client/cli_lsarpc.c @@ -1257,6 +1257,7 @@ NTSTATUS cli_lsa_remove_account_rights(struct cli_state *cli, TALLOC_CTX *mem_ct POLICY_HND *pol, DOM_SID sid, BOOL removeall, uint32 count, const char **privs_name) { +#if 0 prs_struct qbuf, rbuf; LSA_Q_REMOVE_ACCT_RIGHTS q; LSA_R_REMOVE_ACCT_RIGHTS r; @@ -1290,6 +1291,8 @@ NTSTATUS cli_lsa_remove_account_rights(struct cli_state *cli, TALLOC_CTX *mem_ct done: return result; +#endif + return NT_STATUS_UNSUCCESSFUL; } diff --git a/source3/rpc_parse/parse_lsa.c b/source3/rpc_parse/parse_lsa.c index 7ff2aa7d01..d8c3b4e3c3 100644 --- a/source3/rpc_parse/parse_lsa.c +++ b/source3/rpc_parse/parse_lsa.c @@ -2382,10 +2382,11 @@ void init_r_add_acct_rights(LSA_R_ADD_ACCT_RIGHTS *q_r) } +#if 0 /******************************************************************* Inits an LSA_Q_REMOVE_ACCT_RIGHTS structure. ********************************************************************/ -void init_q_remove_acct_rights(LSA_Q_REMOVE_ACCT_RIGHTS *q_q, + void init_q_remove_acct_rights(LSA_Q_REMOVE_ACCT_RIGHTS *q_q, POLICY_HND *hnd, DOM_SID *sid, uint32 removeall, @@ -2404,7 +2405,7 @@ void init_q_remove_acct_rights(LSA_Q_REMOVE_ACCT_RIGHTS *q_q, /******************************************************************* reads or writes a LSA_Q_REMOVE_ACCT_RIGHTS structure. ********************************************************************/ -BOOL lsa_io_q_remove_acct_rights(const char *desc, LSA_Q_REMOVE_ACCT_RIGHTS *q_q, prs_struct *ps, int depth) + BOOL lsa_io_q_remove_acct_rights(const char *desc, LSA_Q_REMOVE_ACCT_RIGHTS *q_q, prs_struct *ps, int depth) { prs_debug(ps, depth, desc, "lsa_io_q_remove_acct_rights"); depth++; @@ -2430,7 +2431,7 @@ BOOL lsa_io_q_remove_acct_rights(const char *desc, LSA_Q_REMOVE_ACCT_RIGHTS *q_q /******************************************************************* reads or writes a LSA_R_REMOVE_ACCT_RIGHTS structure. ********************************************************************/ -BOOL lsa_io_r_remove_acct_rights(const char *desc, LSA_R_REMOVE_ACCT_RIGHTS *r_c, prs_struct *ps, int depth) + BOOL lsa_io_r_remove_acct_rights(const char *desc, LSA_R_REMOVE_ACCT_RIGHTS *r_c, prs_struct *ps, int depth) { prs_debug(ps, depth, desc, "lsa_io_r_remove_acct_rights"); depth++; @@ -2444,7 +2445,7 @@ BOOL lsa_io_r_remove_acct_rights(const char *desc, LSA_R_REMOVE_ACCT_RIGHTS *r_c /******************************************************************* Inits an LSA_R_REMOVE_ACCT_RIGHTS structure. ********************************************************************/ -void init_r_remove_acct_rights(LSA_R_REMOVE_ACCT_RIGHTS *q_r) + void init_r_remove_acct_rights(LSA_R_REMOVE_ACCT_RIGHTS *q_r) { DEBUG(5, ("init_r_remove_acct_rights\n")); } @@ -2452,7 +2453,7 @@ void init_r_remove_acct_rights(LSA_R_REMOVE_ACCT_RIGHTS *q_r) /******************************************************************* Inits an LSA_Q_ENUM_ACCT_WITH_RIGHT structure. ********************************************************************/ -void init_q_enum_acct_with_right(LSA_Q_ENUM_ACCT_WITH_RIGHT *q_q, + void init_q_enum_acct_with_right(LSA_Q_ENUM_ACCT_WITH_RIGHT *q_q, POLICY_HND *hnd, const char *right) { @@ -2469,7 +2470,7 @@ void init_q_enum_acct_with_right(LSA_Q_ENUM_ACCT_WITH_RIGHT *q_q, /******************************************************************* reads or writes a LSA_Q_ENUM_ACCT_WITH_RIGHT structure. ********************************************************************/ -BOOL lsa_io_q_enum_acct_with_right(const char *desc, LSA_Q_ENUM_ACCT_WITH_RIGHT *q_q, prs_struct *ps, int depth) + BOOL lsa_io_q_enum_acct_with_right(const char *desc, LSA_Q_ENUM_ACCT_WITH_RIGHT *q_q, prs_struct *ps, int depth) { prs_debug(ps, depth, desc, "lsa_io_q_enum_acct_with_right"); depth++; @@ -2497,7 +2498,7 @@ BOOL lsa_io_q_enum_acct_with_right(const char *desc, LSA_Q_ENUM_ACCT_WITH_RIGHT /******************************************************************* reads or writes a LSA_R_ENUM_ACCT_WITH_RIGHT structure. ********************************************************************/ -BOOL lsa_io_r_enum_acct_with_right(const char *desc, LSA_R_ENUM_ACCT_WITH_RIGHT *r_c, prs_struct *ps, int depth) + BOOL lsa_io_r_enum_acct_with_right(const char *desc, LSA_R_ENUM_ACCT_WITH_RIGHT *r_c, prs_struct *ps, int depth) { prs_debug(ps, depth, desc, "lsa_io_r_enum_acct_with_right"); depth++; @@ -2517,7 +2518,7 @@ BOOL lsa_io_r_enum_acct_with_right(const char *desc, LSA_R_ENUM_ACCT_WITH_RIGHT /******************************************************************* Inits an LSA_R_ENUM_ACCT_WITH_RIGHT structure. ********************************************************************/ -void init_r_enum_acct_with_right(LSA_R_ENUM_ACCT_WITH_RIGHT *r_c, + void init_r_enum_acct_with_right(LSA_R_ENUM_ACCT_WITH_RIGHT *r_c, uint32 count, DOM_SID *sids) { @@ -2526,3 +2527,4 @@ void init_r_enum_acct_with_right(LSA_R_ENUM_ACCT_WITH_RIGHT *r_c, r_c->count = count; init_sid_array(&r_c->sids, count, sids); } +#endif diff --git a/source3/smbd/build_options.c b/source3/smbd/build_options.c deleted file mode 100644 index 43335666a6..0000000000 --- a/source3/smbd/build_options.c +++ /dev/null @@ -1,532 +0,0 @@ -/* - Unix SMB/CIFS implementation. - Build Options for Samba Suite - Copyright (C) Vance Lankhaar 2001 - Copyright (C) Andrew Bartlett 2001 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" -#include "build_env.h" -#include "dynconfig.h" - -static void output(BOOL screen, const char *format, ...) PRINTF_ATTRIBUTE(2,3); - -/* -#define OUTPUT(x) snprintf(outstring,sizeof(outstring),x); output(screen,outstring); -*/ -/**************************************************************************** -helper function for build_options -****************************************************************************/ -static void output(BOOL screen, const char *format, ...) -{ - char *ptr; - va_list ap; - - va_start(ap, format); - vasprintf(&ptr,format,ap); - va_end(ap); - - if (screen) { - d_printf("%s", ptr); - } else { - DEBUG(4,("%s", ptr)); - } - - SAFE_FREE(ptr); -} - -/**************************************************************************** -options set at build time for the samba suite -****************************************************************************/ -void build_options(BOOL screen) -{ - if ((DEBUGLEVEL < 4) && (!screen)) { - return; - } - -#ifdef _BUILD_ENV_H - /* Output information about the build environment */ - output(screen,"Build environment:\n"); - output(screen," Built by: %s@%s\n",BUILD_ENV_USER,BUILD_ENV_HOST); - output(screen," Built on: %s\n",BUILD_ENV_DATE); - - output(screen," Built using: %s\n",BUILD_ENV_COMPILER); - output(screen," Build host: %s\n",BUILD_ENV_UNAME); - output(screen," SRCDIR: %s\n",BUILD_ENV_SRCDIR); - output(screen," BUILDDIR: %s\n",BUILD_ENV_BUILDDIR); - - -#endif - - /* Output various options (most correspond to --with options) */ - output(screen,"\nBuild options:\n"); -#ifdef WITH_SMBWRAPPER - output(screen," WITH_SMBWRAPPER\n"); -#endif -#ifdef WITH_AFS - output(screen," WITH_AFS\n"); -#endif -#ifdef WITH_DFS - output(screen," WITH_DFS\n"); -#endif -#ifdef KRB4_AUTH - output(screen," KRB4_AUTH"); -#endif -#ifdef HAVE_KRB5 - output(screen," HAVE_KRB5"); -#endif -#ifdef HAVE_GSSAPI - output(screen," HAVE_GSSAPI"); -#endif -#ifdef HAVE_LDAP - output(screen," HAVE_LDAP"); -#endif -#ifdef WITH_AUTOMOUNT - output(screen," WITH_AUTOMOUNT\n"); -#endif -#ifdef WITH_SMBMOUNT - output(screen," WITH_SMBMOUNT\n"); -#endif -#ifdef WITH_PAM - output(screen," WITH_PAM\n"); -#endif -#ifdef WITH_NISPLUS_HOME - output(screen," WITH_NISPLUS_HOME\n"); -#endif -#ifdef WITH_SYSLOG - output(screen," WITH_SYSLOG\n"); -#endif -#ifdef WITH_PROFILE - output(screen," WITH_PROFILE\n"); -#endif -#ifdef WITH_QUOTAS - output(screen," WITH_QUOTAS\n"); -#endif -#ifdef WITH_VFS - output(screen," WITH_VFS\n"); -#endif -#ifdef USE_SPINLOCKS - output(screen," USE_SPINLOCKS\n"); -#endif -#ifdef SPARC_SPINLOCKS - output(screen," SPARC_SPINLOCKS\n"); -#endif -#ifdef INTEL_SPINLOCKS - output(screen," INTEL_SPINLOCKS\n"); -#endif -#ifdef MIPS_SPINLOCKS - output(screen," MIPS_SPINLOCKS\n"); -#endif -#ifdef POWERPC_SPINLOCKS - output(screen," POWERPC_SPINLOCKS\n"); -#endif -#ifdef HAVE_UNIXWARE_ACLS - output(screen," HAVE_UNIXWARE_ACLS\n"); -#endif -#ifdef HAVE_SOLARIS_ACLS - output(screen," HAVE_SOLARIS_ACLS\n"); -#endif -#ifdef HAVE_IRIX_ACLS - output(screen," HAVE_IRIX_ACLS\n"); -#endif -#ifdef HAVE_AIX_ACLS - output(screen," HAVE_AIX_ACLS\n"); -#endif -#ifdef HAVE_POSIX_ACLS - output(screen," HAVE_POSIX_ACLS\n"); -#endif -#ifdef HAVE_TRU64_ACLS - output(screen," HAVE_TRU64_ACLS\n"); -#endif - -#ifdef HAVE_ACL_GET_PERM_NP - output(screen," HAVE_ACL_GET_PERM_NP\n"); -#endif -#ifdef HAVE_NO_ACLS - output(screen," HAVE_NO_ACLS\n"); -#endif -#ifdef HAVE_LIBREADLINE - output(screen," HAVE_LIBREADLINE\n"); -#endif -#ifdef WITH_LIBICONV - output(screen," WITH_LIBICONV: %s\n",WITH_LIBICONV); -#endif - - - /* Output various paths to files and directories */ - output(screen,"\nPaths:\n"); - output(screen," CONFIGFILE: %s\n", dyn_CONFIGFILE); -#ifdef PRIVATE_DIR - output(screen," PRIVATE_DIR: %s\n",PRIVATE_DIR); -#endif -#ifdef LMHOSTSFILE - output(screen," LMHOSTSFILE: %s\n",LMHOSTSFILE); -#endif - output(screen," SBINDIR: %s\n", dyn_SBINDIR); - output(screen," BINDIR: %s\n", dyn_BINDIR); - output(screen," LOCKDIR: %s\n",dyn_LOCKDIR); - output(screen," LOGFILEBASE: %s\n", dyn_LOGFILEBASE); - - /*Output various other options (most map to defines in the configure script*/ - output(screen,"\nOther Build Options:\n"); -#ifdef HAVE_VOLATILE - output(screen," HAVE_VOLATILE\n"); -#endif -#ifdef HAVE_SHADOW_H - output(screen," HAVE_SHADOW_H\n"); -#endif -#ifdef HAVE_CRYPT - output(screen," HAVE_CRYPT\n"); -#endif -#ifdef USE_BOTH_CRYPT_CALLS - output(screen," USE_BOTH_CRYPT_CALLS\n"); -#endif -#ifdef HAVE_TRUNCATED_SALT - output(screen," HAVE_TRUNCATED_SALT\n"); -#endif -#ifdef HAVE_CUPS - output(screen," HAVE_CUPS\n"); -#endif -#ifdef HAVE_CUPS_CUPS_H - output(screen," HAVE_CUPS_CUPS_H\n"); -#endif -#ifdef HAVE_CUPS_LANGUAGE_H - output(screen," HAVE_CUPS_LANGUAGE_H\n"); -#endif -#ifdef HAVE_DLOPEN - output(screen," HAVE_DLOPEN\n"); -#endif -#ifdef HAVE_DLCLOSE - output(screen," HAVE_DLCLOSE\n"); -#endif -#ifdef HAVE_DLSYM - output(screen," HAVE_DLSYM\n"); -#endif -#ifdef HAVE_DLERROR - output(screen," HAVE_DLERROR\n"); -#endif -#ifdef HAVE_UNIXSOCKET - output(screen," HAVE_UNIXSOCKET\n"); -#endif -#ifdef HAVE_SOCKLEN_T_TYPE - output(screen," HAVE_SOCKLEN_T_TYPE\n"); -#endif -#ifdef HAVE_SIG_ATOMIC_T_TYPE - output(screen," HAVE_SIG_ATOMIC_T_TYPE\n"); -#endif -#ifdef HAVE_SETRESUID - output(screen," HAVE_SETRESUID\n"); -#endif -#ifdef HAVE_SETRESGID - output(screen," HAVE_SETRESGID\n"); -#endif -#ifdef HAVE_CONNECT - output(screen," HAVE_CONNECT\n"); -#endif -#ifdef HAVE_YP_GET_DEFAULT_DOMAIN - output(screen," HAVE_YP_GET_DEFAULT_DOMAIN\n"); -#endif -#ifdef HAVE_STAT64 - output(screen," HAVE_STAT64\n"); -#endif -#ifdef HAVE_LSTAT64 - output(screen," HAVE_LSTAT64\n"); -#endif -#ifdef HAVE_FSTAT64 - output(screen," HAVE_FSTAT64\n"); -#endif -#ifdef HAVE_STRCASECMP - output(screen," HAVE_STRCASECMP\n"); -#endif -#ifdef HAVE_MEMSET - output(screen," HAVE_MEMSET\n"); -#endif -#ifdef HAVE_LONGLONG - output(screen," HAVE_LONGLONG\n"); -#endif -#ifdef COMPILER_SUPPORTS_LL - output(screen," COMPILER_SUPPORTS_LL\n"); -#endif -#ifdef SIZEOF_OFF_T - output(screen," SIZEOF_OFF_T: %d\n",SIZEOF_OFF_T); -#endif -#ifdef HAVE_OFF64_T - output(screen," HAVE_OFF64_T\n"); -#endif -#ifdef SIZEOF_INO_T - output(screen," SIZEOF_INO_T: %d\n",SIZEOF_INO_T); -#endif -#ifdef HAVE_INO64_T - output(screen," HAVE_INO64_T\n"); -#endif -#ifdef HAVE_STRUCT_DIRENT64 - output(screen," HAVE_STRUCT_DIRENT64\n"); -#endif -#ifdef HAVE_UNSIGNED_CHAR - output(screen," HAVE_UNSIGNED_CHAR\n"); -#endif -#ifdef HAVE_SOCK_SIN_LEN - output(screen," HAVE_SOCK_SIN_LEN\n"); -#endif -#ifdef SEEKDIR_RETURNS_VOID - output(screen," SEEKDIR_RETURNS_VOID\n"); -#endif -#ifdef HAVE_FUNCTION_MACRO - output(screen," HAVE_FUNCTION_MACRO\n"); -#endif -#ifdef HAVE_GETTIMEOFDAY - output(screen," HAVE_GETTIMEOFDAY\n"); -#endif -#ifdef HAVE_C99_VSNPRINTF - output(screen," HAVE_C99_VSNPRINTF\n"); -#endif -#ifdef HAVE_BROKEN_READDIR - output(screen," HAVE_BROKEN_READDIR\n"); -#endif -#ifdef HAVE_NATIVE_ICONV - output(screen," HAVE_NATIVE_ICONV\n"); -#endif -#ifdef HAVE_KERNEL_OPLOCKS_LINUX - output(screen," HAVE_KERNEL_OPLOCKS_LINUX\n"); -#endif -#ifdef HAVE_KERNEL_CHANGE_NOTIFY - output(screen," HAVE_KERNEL_CHANGE_NOTIFY\n"); -#endif -#ifdef HAVE_KERNEL_SHARE_MODES - output(screen," HAVE_KERNEL_SHARE_MODES\n"); -#endif -#ifdef HAVE_KERNEL_OPLOCKS_IRIX - output(screen," HAVE_KERNEL_OPLOCKS_IRIX\n"); -#endif -#ifdef HAVE_IRIX_SPECIFIC_CAPABILITIES - output(screen," HAVE_IRIX_SPECIFIC_CAPABILITIES\n"); -#endif -#ifdef HAVE_INT16_FROM_RPC_RPC_H - output(screen," HAVE_INT16_FROM_RPC_RPC_H\n"); -#endif -#ifdef HAVE_UINT16_FROM_RPC_RPC_H - output(screen," HAVE_UINT16_FROM_RPC_RPC_H\n"); -#endif -#ifdef HAVE_INT32_FROM_RPC_RPC_H - output(screen," HAVE_INT16_FROM_RPC_RPC_H\n"); -#endif -#ifdef HAVE_UINT32_FROM_RPC_RPC_H - output(screen," HAVE_UINT32_FROM_RPC_RPC_H\n"); -#endif -#ifdef HAVE_RPC_AUTH_ERROR_CONFLICT - output(screen," HAVE_RPC_AUTH_ERROR_CONFLICT\n"); -#endif -#ifdef HAVE_FTRUNCATE_EXTEND - output(screen," HAVE_FTRUNCATE_EXTEND\n"); -#endif -#ifdef HAVE_WORKING_AF_LOCAL - output(screen," HAVE_WORKING_AF_LOCAL\n"); -#endif -#ifdef HAVE_BROKEN_GETGROUPS - output(screen," HAVE_BROKEN_GETGROUPS\n"); -#endif -#ifdef REPLACE_GETPASS - output(screen," REPLACE_GETPASS\n"); -#endif -#ifdef REPLACE_INET_NTOA - output(screen," REPLACE_INET_NTOA\n"); -#endif -#ifdef HAVE_SECURE_MKSTEMP - output(screen," HAVE_SECURE_MKSTEMP\n"); -#endif -#ifdef SYSCONF_SC_NGROUPS_MAX - output(screen," SYSCONF_SC_NGROUPS_MAX\n"); -#endif -#ifdef HAVE_IFACE_AIX - output(screen," HAVE_IFACE_AIX\n"); -#endif -#ifdef HAVE_IFACE_IFCONF - output(screen," HAVE_IFACE_IFCONF\n"); -#endif -#ifdef HAVE_IFACE_IFREQ - output(screen," HAVE_IFACE_IFREQ\n"); -#endif -#ifdef USE_SETRESUID - output(screen," USE_SETRESUID\n"); -#endif -#ifdef USE_SETRESGID - output(screen," USE_SETREUID\n"); -#endif -#ifdef USE_SETEUID - output(screen," USE_SETEUID\n"); -#endif -#ifdef USE_SETUIDX - output(screen," USE_SETUIDX\n"); -#endif -#ifdef HAVE_MMAP - output(screen," HAVE_MMAP\n"); -#endif -#ifdef MMAP_BLACKLIST - output(screen," MMAP_BLACKLIST\n"); -#endif -#ifdef FTRUNCATE_NEEDS_ROOT - output(screen," FTRUNCATE_NEEDS_ROOT\n"); -#endif -#ifdef HAVE_FCNTL_LOCK - output(screen," HAVE_FCNTL_LOCK\n"); -#endif -#ifdef HAVE_BROKEN_FCNTL64_LOCKS - output(screen," HAVE_BROKEN_FCNTL64_LOCKS\n"); -#endif -#ifdef HAVE_STRUCT_FLOCK64 - output(screen," HAVE_STRUCT_FLOCK64\n"); -#endif -#ifdef BROKEN_NISPLUS_INCLUDE_FILES - output(screen," BROKEN_NISPLUS_INCLUDE_FILES\n"); -#endif -#ifdef HAVE_LIBPAM - output(screen," HAVE_LIBPAM\n"); -#endif -#ifdef STAT_STATVFS64 - output(screen," STAT_STATVFS64\n"); -#endif -#ifdef STAT_STATVFS - output(screen," STAT_STATVFS\n"); -#endif -#ifdef STAT_STATFS3_OSF1 - output(screen," STAT_STATFS3_OSF1\n"); -#endif -#ifdef STAT_STATFS2_BSIZE - output(screen," STAT_STATFS2_BSIZE\n"); -#endif -#ifdef STAT_STATFS4 - output(screen," STAT_STATFS4\n"); -#endif -#ifdef STAT_STATFS2_FSIZE - output(screen," STAT_STATFS2_FSIZE\n"); -#endif -#ifdef STAT_STATFS2_FS_DATA - output(screen," STAT_STATFS2_FS_DATA\n"); -#endif -#ifdef HAVE_EXPLICIT_LARGEFILE_SUPPORT - output(screen," HAVE_EXPLICIT_LARGEFILE_SUPPORT\n"); -#endif - -#ifdef WITH_UTMP - /* Output UTMP Stuff */ - output(screen,"\nUTMP Related:\n"); - output(screen," WITH_UTMP\n"); - -#ifdef HAVE_UTIMBUF - output(screen," HAVE_UTIMBUF\n"); -#endif -#ifdef HAVE_UT_UT_NAME - output(screen," HAVE_UT_UT_NAME\n"); -#endif -#ifdef HAVE_UT_UT_USER - output(screen," HAVE_UT_UT_USER\n"); -#endif -#ifdef HAVE_UT_UT_ID - output(screen," HAVE_UT_UT_ID\n"); -#endif -#ifdef HAVE_UT_UT_HOST - output(screen," HAVE_UT_UT_HOST\n"); -#endif -#ifdef HAVE_UT_UT_TIME - output(screen," HAVE_UT_UT_TIME\n"); -#endif -#ifdef HAVE_UT_UT_TV - output(screen," HAVE_UT_UT_TV\n"); -#endif -#ifdef HAVE_UT_UT_TYPE - output(screen," HAVE_UT_UT_TYPE\n"); -#endif -#ifdef HAVE_UT_UT_PID - output(screen," HAVE_UT_UT_PID\n"); -#endif -#ifdef HAVE_UT_UT_EXIT - output(screen," HAVE_UT_UT_EXIT\n"); -#endif -#ifdef HAVE_UT_UT_ADDR - output(screen," HAVE_UT_UT_ADDR\n"); -#endif -#ifdef PUTUTLINE_RETURNS_UTMP - output(screen," PUTUTLINE_RETURNS_UTMP\n"); -#endif -#ifdef HAVE_UX_UT_SYSLEN - output(screen," HAVE_UX_UT_SYSLEN\n"); -#endif -#endif /* WITH_UTMP */ - - /* Output Build OS */ - output(screen,"\nBuilt for host os:\n"); -#ifdef LINUX - output(screen," LINUX\n"); -#endif -#ifdef SUNOS5 - output(screen," SUNOS5\n"); -#endif -#ifdef SUNOS4 - output(screen," SUNOS4\n"); -#endif - /* BSD Isn't Defined in the configure script, but there is something about it in include/config.h.in (and I guess acconfig.h) */ -#ifdef BSD - output(screen," BSD\n"); -#endif -#ifdef IRIX - output(screen," IRIX\n"); -#endif -#ifdef IRIX6 - output(screen," IRIX6\n"); -#endif -#ifdef AIX - output(screen," AIX\n"); -#endif -#ifdef HPUX - output(screen," HPUX\n"); -#endif -#ifdef QNX - output(screen," QNX\n"); -#endif -#ifdef OSF1 - output(screen," OSF1\n"); -#endif -#ifdef SCO - output(screen," SCO\n"); -#endif -#ifdef UNIXWARE - output(screen," UNIXWARE\n"); -#endif -#ifdef NEXT2 - output(screen," NEXT2\n"); -#endif -#ifdef RELIANTUNIX - output(screen," RELIANTUNIX\n"); -#endif - - /* Output the sizes of the various types */ - output(screen,"\nType sizes:\n"); - output(screen," sizeof(char): %d\n",sizeof(char)); - output(screen," sizeof(int): %d\n",sizeof(int)); - output(screen," sizeof(long): %d\n",sizeof(long)); - output(screen," sizeof(uint8): %d\n",sizeof(uint8)); - output(screen," sizeof(uint16): %d\n",sizeof(uint16)); - output(screen," sizeof(uint32): %d\n",sizeof(uint32)); - output(screen," sizeof(short): %d\n",sizeof(short)); - output(screen," sizeof(void*): %d\n",sizeof(void*)); - - output(screen,"\nBuiltin modules:\n"); - output(screen,"%s\n", STRING_STATIC_MODULES); -} - - - -- cgit From 7efce478976e2ac71bcaf4e4d1049bb263634711 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 23 Jul 2003 20:10:25 +0000 Subject: connect to the right realm or domain for trusted AD domains (This used to be commit ae14f8364398f07fc3e7c7861cd39fe528f3fe7a) --- source3/libads/ldap.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c index 92f7f7645a..cf6f9375f8 100644 --- a/source3/libads/ldap.c +++ b/source3/libads/ldap.c @@ -109,12 +109,8 @@ static BOOL ads_find_dc(ADS_STRUCT *ads) /* realm */ c_realm = ads->server.realm; - if (!c_realm || !*c_realm) { - c_realm = lp_realm(); - } - if ( c_realm ) + if (c_realm && *c_realm) got_realm = True; - again: /* we need to try once with the realm name and fallback to the @@ -122,10 +118,10 @@ again: if ( !got_realm && !lp_disable_netbios() ) { c_realm = ads->server.workgroup; - if (!c_realm || !*c_realm) - c_realm = lp_workgroup(); - if (!c_realm) + if (!c_realm || !*c_realm) { + DEBUG(0,("ads_find_dc: no realm or workgroup! Was the structure initialized?\n")); return False; + } } pstrcpy( realm, c_realm ); -- cgit From 04bf12b176d5abe06b7f1401810369bcafe0b611 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Sat, 2 Aug 2003 20:06:57 +0000 Subject: port latest changes from SAMBA_3_0 tree (This used to be commit 3101c236b8241dc0183995ffceed551876427de4) --- source3/Makefile.in | 79 +- source3/aclocal.m4 | 107 ++ source3/auth/auth.c | 2 +- source3/auth/auth_domain.c | 4 +- source3/auth/auth_ntlmssp.c | 1 - source3/auth/auth_sam.c | 12 +- source3/auth/auth_util.c | 8 +- source3/client/client.c | 38 +- source3/client/clitar.c | 2550 +++++++++++++++++------------------ source3/client/smbspool.c | 2 +- source3/client/tree.c | 6 +- source3/configure.in | 418 +++--- source3/dynconfig.c | 2 +- source3/groupdb/mapping.c | 2 +- source3/include/authdata.h | 2 +- source3/include/byteorder.h | 2 +- source3/include/charset.h | 6 +- source3/include/client.h | 12 - source3/include/dynconfig.h | 2 +- source3/include/idmap.h | 2 +- source3/include/includes.h | 12 +- source3/include/popt_common.h | 1 + source3/include/rpc_ds.h | 62 +- source3/include/rpc_samr.h | 3 +- source3/include/rpc_secdes.h | 20 +- source3/include/smb.h | 26 +- source3/include/smbldap.h | 3 + source3/include/sysquotas.h | 16 + source3/include/version.h | 2 +- source3/include/vfs.h | 3 + source3/lib/account_pol.c | 2 +- source3/lib/charcnv.c | 120 +- source3/lib/popt_common.c | 25 +- source3/lib/replace.c | 18 - source3/lib/smbldap.c | 48 +- source3/lib/snprintf.c | 6 +- source3/lib/substitute.c | 4 +- source3/lib/sysquotas.c | 234 +++- source3/lib/username.c | 4 +- source3/lib/util.c | 4 +- source3/lib/util_file.c | 4 +- source3/lib/util_sock.c | 184 +-- source3/lib/util_str.c | 67 +- source3/lib/util_unistr.c | 76 -- source3/lib/util_uuid.c | 2 +- source3/libads/authdata.c | 2 +- source3/libads/kerberos_verify.c | 52 +- source3/libads/ldap.c | 94 +- source3/libads/ldap_printer.c | 2 +- source3/libads/ldap_user.c | 2 +- source3/libads/sasl.c | 3 +- source3/libsmb/asn1.c | 6 +- source3/libsmb/cliconnect.c | 34 +- source3/libsmb/clientgen.c | 27 +- source3/libsmb/clierror.c | 5 +- source3/libsmb/clikrb5.c | 36 +- source3/libsmb/clilist.c | 45 +- source3/libsmb/cliprint.c | 12 +- source3/libsmb/clispnego.c | 8 +- source3/libsmb/clitrans.c | 96 +- source3/libsmb/errormap.c | 1 + source3/libsmb/nmblib.c | 14 +- source3/libsmb/ntlmssp.c | 4 +- source3/libsmb/ntlmssp_parse.c | 2 +- source3/libsmb/ntlmssp_sign.c | 14 +- source3/libsmb/smb_signing.c | 730 ++++++++-- source3/libsmb/trustdom_cache.c | 2 +- source3/libsmb/trusts_util.c | 2 +- source3/locking/locking.c | 10 +- source3/nmbd/nmbd_processlogon.c | 3 +- source3/nsswitch/wb_common.c | 2 + source3/nsswitch/wbinfo.c | 2 +- source3/nsswitch/winbindd.c | 34 +- source3/nsswitch/winbindd.h | 2 +- source3/nsswitch/winbindd_acct.c | 63 +- source3/nsswitch/winbindd_ads.c | 85 +- source3/nsswitch/winbindd_cache.c | 8 +- source3/nsswitch/winbindd_cm.c | 39 +- source3/nsswitch/winbindd_group.c | 26 +- source3/nsswitch/winbindd_misc.c | 18 +- source3/nsswitch/winbindd_pam.c | 55 +- source3/nsswitch/winbindd_sid.c | 24 +- source3/nsswitch/winbindd_user.c | 24 +- source3/nsswitch/winbindd_util.c | 85 +- source3/nsswitch/winbindd_wins.c | 4 +- source3/nsswitch/wins.c | 48 +- source3/param/loadparm.c | 850 ++++++------ source3/passdb/passdb.c | 10 +- source3/passdb/pdb_get_set.c | 9 + source3/passdb/pdb_ldap.c | 60 +- source3/passdb/pdb_smbpasswd.c | 21 +- source3/passdb/pdb_tdb.c | 61 +- source3/passdb/secrets.c | 6 +- source3/printing/notify.c | 8 +- source3/printing/pcap.c | 4 +- source3/python/py_common.c | 2 +- source3/python/py_lsa.c | 27 +- source3/python/py_ntsec.c | 39 +- source3/python/py_smb.c | 42 +- source3/python/py_winbind.c | 6 +- source3/rpc_client/cli_ds.c | 68 +- source3/rpc_client/cli_lsarpc.c | 3 - source3/rpc_client/cli_netlogon.c | 3 +- source3/rpc_client/cli_pipe.c | 72 +- source3/rpc_client/cli_srvsvc.c | 2 +- source3/rpc_parse/parse_ds.c | 190 ++- source3/rpc_parse/parse_lsa.c | 145 +- source3/rpc_parse/parse_prs.c | 4 +- source3/rpc_parse/parse_samr.c | 3 +- source3/rpc_server/srv_dfs.c | 2 +- source3/rpc_server/srv_lsa.c | 3 +- source3/rpc_server/srv_lsa_nt.c | 2 +- source3/rpc_server/srv_netlog.c | 2 +- source3/rpc_server/srv_netlog_nt.c | 2 +- source3/rpc_server/srv_pipe.c | 7 +- source3/rpc_server/srv_reg.c | 2 +- source3/rpc_server/srv_reg_nt.c | 6 +- source3/rpc_server/srv_samr.c | 3 +- source3/rpc_server/srv_samr_nt.c | 34 +- source3/rpc_server/srv_spoolss.c | 2 +- source3/rpc_server/srv_spoolss_nt.c | 34 +- source3/rpc_server/srv_srvsvc.c | 2 +- source3/rpc_server/srv_wkssvc.c | 2 +- source3/rpcclient/cmd_ds.c | 22 +- source3/rpcclient/cmd_samr.c | 2 +- source3/rpcclient/rpcclient.c | 86 +- source3/sam/idmap.c | 7 +- source3/sam/idmap_tdb.c | 28 +- source3/sam/idmap_util.c | 8 +- source3/smbd/blocking.c | 498 +++---- source3/smbd/change_trust_pw.c | 2 +- source3/smbd/chgpasswd.c | 15 +- source3/smbd/close.c | 4 +- source3/smbd/ipc.c | 11 +- source3/smbd/lanman.c | 112 +- source3/smbd/mangle_hash.c | 7 +- source3/smbd/negprot.c | 20 + source3/smbd/notify.c | 6 +- source3/smbd/ntquotas.c | 2 +- source3/smbd/nttrans.c | 7 + source3/smbd/open.c | 24 +- source3/smbd/oplock.c | 14 +- source3/smbd/password.c | 56 +- source3/smbd/process.c | 671 +++++---- source3/smbd/reply.c | 58 +- source3/smbd/service.c | 2 +- source3/smbd/sesssetup.c | 71 +- source3/smbd/statcache.c | 33 +- source3/smbd/trans2.c | 16 +- source3/smbd/utmp.c | 4 +- source3/tdb/tdbtool.c | 73 +- source3/torture/cmd_vfs.c | 9 +- source3/torture/locktest.c | 2 +- source3/torture/locktest2.c | 4 +- source3/torture/mangle_test.c | 2 +- source3/torture/nsstest.c | 18 +- source3/torture/torture.c | 8 +- source3/utils/net.c | 32 +- source3/utils/net_ads.c | 8 +- source3/utils/net_cache.c | 2 +- source3/utils/net_idmap.c | 9 +- source3/utils/net_rpc_samsync.c | 13 +- source3/utils/net_time.c | 4 +- source3/utils/ntlm_auth.c | 509 ++++++- source3/utils/pdbedit.c | 22 +- source3/utils/smbcacls.c | 3 +- source3/utils/smbcontrol.c | 6 - source3/utils/smbcquotas.c | 3 +- source3/utils/smbpasswd.c | 15 - source3/utils/status.c | 5 - source3/web/statuspage.c | 2 +- source3/web/swat.c | 56 +- 172 files changed, 6162 insertions(+), 4095 deletions(-) diff --git a/source3/Makefile.in b/source3/Makefile.in index 73ff436c6f..4674fd07ae 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -3,7 +3,7 @@ # Copyright Andrew Tridgell 1992-1998 # Copyright (C) 2001 by Martin Pool # Copyright Andrew Bartlett 2002 -# Copyright (C) 2003 Anthony Liguori +# Copyright (C) 2003 Jim McDonough # Copyright (C) 2002-2003 Jelmer Vernooij ########################################################################### @@ -32,7 +32,6 @@ AUTHLIBS=@AUTHLIBS@ ACLLIBS=@ACLLIBS@ PASSDBLIBS=@PASSDBLIBS@ IDMAP_LIBS=@IDMAP_LIBS@ -ADSLIBS=@ADSLIBS@ KRB5LIBS=@KRB5_LIBS@ LDAPLIBS=@LDAP_LIBS@ @@ -165,7 +164,7 @@ SMBLDAP_OBJ = @SMBLDAP@ LIB_OBJ = lib/charcnv.o lib/debug.o lib/fault.o \ lib/getsmbpass.o lib/interface.o lib/md4.o \ - lib/interfaces.o lib/pidfile.o lib/replace.o \ + lib/interfaces.o lib/pidfile.o lib/replace.o lib/replace1.o \ lib/signal.o lib/system.o lib/sendfile.o lib/time.o \ lib/ufc.o lib/genrand.o lib/username.o \ lib/util_getent.o lib/util_pw.o lib/access.o lib/smbrun.o \ @@ -176,7 +175,7 @@ LIB_OBJ = lib/charcnv.o lib/debug.o lib/fault.o \ lib/util.o lib/util_sock.o lib/sock_exec.o lib/util_sec.o \ lib/talloc.o lib/hash.o lib/substitute.o lib/fsusage.o \ lib/ms_fnmatch.o lib/select.o lib/messages.o \ - lib/tallocmsg.o lib/dmallocmsg.o \ + lib/tallocmsg.o lib/dmallocmsg.o libsmb/smb_signing.o \ lib/md5.o lib/hmacmd5.o lib/iconv.o lib/smbpasswd.o \ nsswitch/wb_client.o nsswitch/wb_common.o \ lib/pam_errors.o intl/lang_tdb.o lib/account_pol.o \ @@ -216,7 +215,7 @@ LIBSMB_OBJ = libsmb/clientgen.o libsmb/cliconnect.o libsmb/clifile.o \ libsmb/clirap.o libsmb/clierror.o libsmb/climessage.o \ libsmb/clireadwrite.o libsmb/clilist.o libsmb/cliprint.o \ libsmb/clitrans.o libsmb/clisecdesc.o libsmb/clidgram.o \ - libsmb/clistr.o libsmb/smb_signing.o \ + libsmb/clistr.o \ libsmb/cliquota.o libsmb/clifsinfo.o \ libsmb/smberr.o libsmb/credentials.o libsmb/pwd_cache.o \ libsmb/clioplock.o libsmb/errormap.o libsmb/clirap2.o \ @@ -300,6 +299,7 @@ VFS_EXTD_AUDIT_OBJ = modules/vfs_extd_audit.o VFS_FAKE_PERMS_OBJ = modules/vfs_fake_perms.o VFS_RECYCLE_OBJ = modules/vfs_recycle.o VFS_NETATALK_OBJ = modules/vfs_netatalk.o +VFS_DEFAULT_QUOTA_OBJ = modules/vfs_default_quota.o PLAINTEXT_AUTH_OBJ = auth/pampass.o auth/pass_check.o @@ -389,17 +389,18 @@ SWAT_OBJ1 = web/cgi.o web/diagnose.o web/startstop.o web/statuspage.o \ SWAT_OBJ = $(SWAT_OBJ1) $(PARAM_OBJ) $(PRINTING_OBJ) $(LIBSMB_OBJ) \ $(LOCKING_OBJ) $(PASSDB_OBJ) $(SECRETS_OBJ) $(KRBCLIENT_OBJ) \ $(UBIQX_OBJ) $(LIB_OBJ) $(GROUPDB_OBJ) $(PLAINTEXT_AUTH_OBJ) \ - $(POPT_LIB_OBJ) $(SMBLDAP_OBJ) + $(POPT_LIB_OBJ) $(SMBLDAP_OBJ) lib/dummyroot.o SMBSH_OBJ = smbwrapper/smbsh.o smbwrapper/shared.o \ $(PARAM_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) STATUS_OBJ = utils/status.o $(LOCKING_OBJ) $(PARAM_OBJ) \ - $(UBIQX_OBJ) $(PROFILE_OBJ) $(LIB_OBJ) $(POPT_LIB_OBJ) + $(UBIQX_OBJ) $(PROFILE_OBJ) $(LIB_OBJ) $(POPT_LIB_OBJ) \ + lib/dummyroot.o libsmb/errormap.o SMBCONTROL_OBJ = utils/smbcontrol.o $(LOCKING_OBJ) $(PARAM_OBJ) \ $(UBIQX_OBJ) $(PROFILE_OBJ) $(LIB_OBJ) $(POPT_LIB_OBJ) \ - printing/notify.o printing/printing_db.o + printing/notify.o printing/printing_db.o lib/dummyroot.o libsmb/errormap.o SMBTREE_OBJ = utils/smbtree.o $(LOCKING_OBJ) $(PARAM_OBJ) \ $(UBIQX_OBJ) $(PROFILE_OBJ) $(LIB_OBJ) $(LIBSMB_OBJ) \ @@ -414,11 +415,11 @@ TESTPRNS_OBJ = utils/testprns.o $(PARAM_OBJ) $(PRINTING_OBJ) $(UBIQX_OBJ) \ SMBPASSWD_OBJ = utils/smbpasswd.o $(PARAM_OBJ) $(SECRETS_OBJ) \ $(LIBSMB_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ)\ $(UBIQX_OBJ) $(LIB_OBJ) $(KRBCLIENT_OBJ) \ - $(SMBLDAP_OBJ) + $(SMBLDAP_OBJ) lib/dummyroot.o PDBEDIT_OBJ = utils/pdbedit.o $(PARAM_OBJ) $(PASSDB_OBJ) $(LIBSAMBA_OBJ) \ $(UBIQX_OBJ) $(LIB_OBJ) $(GROUPDB_OBJ) $(SECRETS_OBJ) \ - $(POPT_LIB_OBJ) $(SMBLDAP_OBJ) + $(POPT_LIB_OBJ) $(SMBLDAP_OBJ) lib/dummyroot.o RPCCLIENT_OBJ1 = rpcclient/rpcclient.o rpcclient/cmd_lsarpc.o \ rpcclient/cmd_samr.o rpcclient/cmd_spoolss.o \ @@ -432,9 +433,9 @@ RPCCLIENT_OBJ = $(RPCCLIENT_OBJ1) \ $(RPC_PARSE_OBJ) $(PASSDB_OBJ) $(LIBMSRPC_OBJ) \ $(READLINE_OBJ) $(GROUPDB_OBJ) $(KRBCLIENT_OBJ) \ $(LIBADS_OBJ) $(SECRETS_OBJ) $(POPT_LIB_OBJ) \ - $(SMBLDAP_OBJ) $(DCUTIL_OBJ) + $(SMBLDAP_OBJ) $(DCUTIL_OBJ) lib/dummyroot.o -PAM_WINBIND_OBJ = nsswitch/pam_winbind.po nsswitch/wb_common.po lib/snprintf.po +PAM_WINBIND_OBJ = nsswitch/pam_winbind.po nsswitch/wb_common.po lib/replace1.po lib/snprintf.po SMBW_OBJ1 = smbwrapper/smbw.o \ smbwrapper/smbw_dir.o smbwrapper/smbw_stat.o \ @@ -460,7 +461,7 @@ LIBBIGBALLOFMUD_MAJOR = 0 LIBBIGBALLOFMUD_OBJ = $(PARAM_OBJ) $(LIB_OBJ) $(UBIQX_OBJ) $(SECRETS_OBJ) \ $(LIBSMB_OBJ) $(LIBMSRPC_OBJ) $(RPC_PARSE_OBJ) $(PASSDB_OBJ) \ - $(GROUPDB_OBJ) $(KRBCLIENT_OBJ) $(SMBLDAP_OBJ) + $(GROUPDB_OBJ) $(KRBCLIENT_OBJ) $(SMBLDAP_OBJ) lib/dummyroot.o LIBBIGBALLOFMUD_PICOBJS = $(LIBBIGBALLOFMUD_OBJ:.o=.po) @@ -480,7 +481,7 @@ NET_OBJ = $(NET_OBJ1) $(PARAM_OBJ) $(SECRETS_OBJ) $(LIBSMB_OBJ) \ $(KRBCLIENT_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) \ $(LIBMSRPC_OBJ) $(IDMAP_OBJ) \ $(LIBADS_OBJ) $(LIBADS_SERVER_OBJ) $(POPT_LIB_OBJ) \ - $(SMBLDAP_OBJ) $(DCUTIL_OBJ) + $(SMBLDAP_OBJ) $(DCUTIL_OBJ) lib/dummyroot.o lib/server_mutex.o CUPS_OBJ = client/smbspool.o $(PARAM_OBJ) $(LIBSMB_OBJ) $(UBIQX_OBJ) \ $(LIB_OBJ) $(KRBCLIENT_OBJ) @@ -559,7 +560,7 @@ PROTO_OBJ = $(SMBD_OBJ_MAIN) \ $(LIB_SMBD_OBJ) $(SAM_OBJ) $(REGISTRY_OBJ) $(POPT_LIB_OBJ) \ $(RPC_LSA_OBJ) $(RPC_NETLOG_OBJ) $(RPC_SAMR_OBJ) $(RPC_REG_OBJ) \ $(RPC_SVC_OBJ) $(RPC_WKS_OBJ) $(RPC_DFS_OBJ) $(RPC_SPOOLSS_OBJ) \ - $(RPC_ECHO_OBJ) $(SMBLDAP_OBJ) $(IDMAP_OBJ) + $(RPC_ECHO_OBJ) $(SMBLDAP_OBJ) $(IDMAP_OBJ) libsmb/spnego.o WINBIND_WINS_NSS_OBJ = nsswitch/wins.o $(PARAM_OBJ) $(UBIQX_OBJ) \ $(LIBSMB_OBJ) $(LIB_OBJ) $(NSSWINS_OBJ) @@ -601,21 +602,22 @@ WINBINDD_OBJ = \ $(LIBSMB_OBJ) $(LIBMSRPC_OBJ) $(RPC_PARSE_OBJ) \ $(PROFILE_OBJ) $(SLCACHE_OBJ) $(SMBLDAP_OBJ) \ $(SECRETS_OBJ) $(LIBADS_OBJ) $(KRBCLIENT_OBJ) $(POPT_LIB_OBJ) \ - $(DCUTIL_OBJ) $(IDMAP_OBJ) + $(DCUTIL_OBJ) $(IDMAP_OBJ) lib/dummyroot.o WBINFO_OBJ = nsswitch/wbinfo.o $(LIBSAMBA_OBJ) $(PARAM_OBJ) $(LIB_OBJ) \ $(UBIQX_OBJ) $(SECRETS_OBJ) $(POPT_LIB_OBJ) -WINBIND_NSS_OBJ = nsswitch/wb_common.o @WINBIND_NSS_EXTRA_OBJS@ +WINBIND_NSS_OBJ = nsswitch/wb_common.o lib/replace1.o @WINBIND_NSS_EXTRA_OBJS@ -WINBIND_NSS_PICOBJS = $(WINBIND_NSS_OBJ:.o=.po) +WINBIND_NSS_PICOBJS = $(WINBIND_NSS_OBJ:.o=.po) lib/snprintf.po POPT_OBJS=popt/findme.o popt/popt.o popt/poptconfig.o \ popt/popthelp.o popt/poptparse.o TDBBACKUP_OBJ = tdb/tdbbackup.o tdb/tdbback.o $(TDBBASE_OBJ) -NTLM_AUTH_OBJ = utils/ntlm_auth.o $(LIBSAMBA_OBJ) $(POPT_LIB_OBJ) +NTLM_AUTH_OBJ = utils/ntlm_auth.o $(LIBSAMBA_OBJ) $(POPT_LIB_OBJ) \ + libsmb/asn1.o libsmb/spnego.o ###################################################################### # now the rules... @@ -727,12 +729,12 @@ bin/.dummy: bin/smbd@EXEEXT@: $(SMBD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBD_OBJ) $(ADSLIBS) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ + @$(CC) $(FLAGS) -o $@ $(SMBD_OBJ) $(KRB5LIBS) $(LDAPLIBS) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ $(AUTHLIBS) $(ACLLIBS) $(PASSDBLIBS) $(LIBS) @POPTLIBS@ bin/nmbd@EXEEXT@: $(NMBD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(ADSLIBS) + @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) bin/wrepld@EXEEXT@: $(WREPL_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @@ -741,19 +743,19 @@ bin/wrepld@EXEEXT@: $(WREPL_OBJ) @BUILD_POPT@ bin/.dummy bin/swat@EXEEXT@: $(SWAT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @$(CC) $(FLAGS) -o $@ $(SWAT_OBJ) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ - $(AUTHLIBS) $(LIBS) $(PASSDBLIBS) @POPTLIBS@ $(KRB5LIBS) + $(AUTHLIBS) $(LIBS) $(PASSDBLIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) bin/rpcclient@EXEEXT@: $(RPCCLIENT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(RPCCLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(ADSLIBS) + @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(RPCCLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) bin/smbclient@EXEEXT@: $(CLIENT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(ADSLIBS) + @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) bin/net@EXEEXT@: $(NET_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(ADSLIBS) $(PASSDBLIBS) + @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) $(PASSDBLIBS) bin/profiles@EXEEXT@: $(PROFILES_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @@ -801,7 +803,7 @@ bin/smbtree@EXEEXT@: $(SMBTREE_OBJ) @BUILD_POPT@ bin/.dummy bin/smbpasswd@EXEEXT@: $(SMBPASSWD_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBPASSWD_OBJ) $(PASSDBLIBS) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBPASSWD_OBJ) $(PASSDBLIBS) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) bin/pdbedit@EXEEXT@: $(PDBEDIT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @@ -873,7 +875,7 @@ bin/smbfilter@EXEEXT@: $(SMBFILTER_OBJ) bin/.dummy bin/smbw_sample@EXEEXT@: $(SMBW_OBJ) utils/smbw_sample.o bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBW_OBJ) utils/smbw_sample.o $(LDFLAGS) $(LIBS) $(KRB5LIBS) + @$(CC) $(FLAGS) -o $@ $(SMBW_OBJ) utils/smbw_sample.o $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) bin/smbsh@EXEEXT@: $(SMBSH_OBJ) bin/.dummy @echo Linking $@ @@ -882,12 +884,14 @@ bin/smbsh@EXEEXT@: $(SMBSH_OBJ) bin/.dummy bin/smbwrapper.@SHLIBEXT@: $(PICOBJS) bin/.dummy @echo Linking shared library $@ @$(SHLD) $(LDSHFLAGS) -o $@ $(PICOBJS) $(LIBS) \ - @SONAMEFLAG@`basename $@` $(KRB5LIBS) + $(KRB5LIBS) $(LDAPLIBS) \ + @SONAMEFLAG@`basename $@` bin/libsmbclient.@SHLIBEXT@: $(LIBSMBCLIENT_PICOBJS) @echo Linking libsmbclient shared library $@ @$(SHLD) $(LDSHFLAGS) -o $@ $(LIBSMBCLIENT_PICOBJS) $(LDFLAGS) $(LIBS) \ - $(KRB5LIBS) @SONAMEFLAG@`basename $@`.$(LIBSMBCLIENT_MAJOR) + $(KRB5LIBS) $(LDAPLIBS) \ + @SONAMEFLAG@`basename $@`.$(LIBSMBCLIENT_MAJOR) bin/libsmbclient.a: $(LIBSMBCLIENT_PICOBJS) @echo Linking libsmbclient non-shared library $@ @@ -897,7 +901,8 @@ bin/libsmbclient.a: $(LIBSMBCLIENT_PICOBJS) bin/libbigballofmud.@SHLIBEXT@: $(LIBBIGBALLOFMUD_PICOBJS) @echo Linking bigballofmud shared library $@ @$(SHLD) $(LDSHFLAGS) -o $@ $(LIBBIGBALLOFMUD_PICOBJS) $(LIBS) \ - @SONAMEFLAG@`basename $@`.$(LIBBIGBALLOFMUD_MAJOR) $(PASSDBLIBS) $(IDMAP_LIBS) $(ADSLIBS) + $(PASSDBLIBS) $(IDMAP_LIBS) $(KRB5LIBS) $(LDAPLIBS) \ + @SONAMEFLAG@`basename $@`.$(LIBBIGBALLOFMUD_MAJOR) ln -snf libbigballofmud.so bin/libbigballofmud.so.0 # It would be nice to build a static bigballofmud too, but when I try @@ -963,7 +968,8 @@ bin/winbindd@EXEEXT@: $(WINBINDD_OBJ) @BUILD_POPT@ bin/.dummy @WINBIND_WINS_NSS@: $(WINBIND_WINS_NSS_PICOBJS) @echo "Linking $@" - @$(SHLD) $(LDSHFLAGS) -o $@ $(WINBIND_WINS_NSS_PICOBJS) -lc \ + @$(SHLD) $(LDSHFLAGS) -o $@ $(WINBIND_WINS_NSS_PICOBJS) \ + $(KRBCLIENT_OBJ) $(LDAPLIBS) $(KRB5LIBS) -lc \ @SONAMEFLAG@`basename $@` nsswitch/pam_winbind.@SHLIBEXT@: $(PAM_WINBIND_OBJ) bin/.dummy @@ -1054,6 +1060,11 @@ bin/fake_perms.@SHLIBEXT@: $(VFS_FAKE_PERMS_OBJ:.o=.po) @$(SHLD) $(LDSHFLAGS) -o $@ $(VFS_FAKE_PERMS_OBJ:.o=.po) \ @SONAMEFLAG@`basename $@` +bin/default_quota.@SHLIBEXT@: $(VFS_DEFAULT_QUOTA_OBJ:.o=.po) + @echo "Building plugin $@" + @$(SHLD) $(LDSHFLAGS) -o $@ $(VFS_DEFAULT_QUOTA_OBJ:.o=.po) \ + @SONAMEFLAG@`basename $@` + bin/wbinfo@EXEEXT@: $(WBINFO_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @$(LINK) -o $@ $(WBINFO_OBJ) $(LIBS) @POPTLIBS@ @@ -1138,7 +1149,7 @@ installclientlib: installdirs libsmbclient PYTHON_OBJS = $(PARAM_OBJ) $(LIB_OBJ) $(LIBSMB_OBJ) $(RPC_PARSE_OBJ) \ $(UBIQX_OBJ) $(LIBMSRPC_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ) \ - $(SECRETS_OBJ) $(KRBCLIENT_OBJ) + $(SECRETS_OBJ) $(KRBCLIENT_OBJ) $(SMBLDAP_OBJ) lib/dummyroot.o PYTHON_PICOBJS = $(PYTHON_OBJS:.o=.po) @@ -1149,7 +1160,7 @@ python_ext: $(PYTHON_PICOBJS) fi PYTHON_OBJS="$(PYTHON_PICOBJS)" \ PYTHON_CFLAGS="$(CFLAGS) $(CPPFLAGS) $(FLAGS)" \ - LIBS="$(LIBS) $(PASSDBLIBS) $(IDMAP_LIBS) $(KRB5LIBS)" \ + LIBS="$(LIBS) $(PASSDBLIBS) $(IDMAP_LIBS) $(KRB5LIBS) $(LDAPLIBS)" \ $(PYTHON) python/setup.py build python_install: $(PYTHON_PICOBJS) @@ -1185,7 +1196,7 @@ showlayout: @echo " mandir: $(MANDIR)" -uninstall: uninstallman uninstallbin uninstallscripts +uninstall: uninstallman uninstallbin uninstallscripts uninstallmodules uninstallman: @$(SHELL) $(srcdir)/script/uninstallman.sh $(DESTDIR)$(MANDIR) $(srcdir) $(man_langs) diff --git a/source3/aclocal.m4 b/source3/aclocal.m4 index 21358e2a71..3a49f7e249 100644 --- a/source3/aclocal.m4 +++ b/source3/aclocal.m4 @@ -111,6 +111,113 @@ AC_DEFUN(AC_LIBTESTFUNC, esac ]) +# AC_CHECK_LIB_EXT(LIBRARY, [EXT_LIBS], [FUNCTION], +# [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND], +# [ADD-ACTION-IF-FOUND],[OTHER-LIBRARIES]) +# ------------------------------------------------------ +# +# Use a cache variable name containing both the library and function name, +# because the test really is for library $1 defining function $3, not +# just for library $1. Separate tests with the same $1 and different $3s +# may have different results. +# +# Note that using directly AS_VAR_PUSHDEF([ac_Lib], [ac_cv_lib_$1_$3]) +# is asking for troubles, since AC_CHECK_LIB($lib, fun) would give +# ac_cv_lib_$lib_fun, which is definitely not what was meant. Hence +# the AS_LITERAL_IF indirection. +# +# FIXME: This macro is extremely suspicious. It DEFINEs unconditionnally, +# whatever the FUNCTION, in addition to not being a *S macro. Note +# that the cache does depend upon the function we are looking for. +# +# It is on purpose we used `ac_check_lib_ext_save_LIBS' and not just +# `ac_save_LIBS': there are many macros which don't want to see `LIBS' +# changed but still want to use AC_CHECK_LIB_EXT, so they save `LIBS'. +# And ``ac_save_LIBS' is too tempting a name, so let's leave them some +# freedom. +AC_DEFUN([AC_CHECK_LIB_EXT], +[ +AH_CHECK_LIB_EXT([$1]) +ac_check_lib_ext_save_LIBS=$LIBS +LIBS="-l$1 $$2 $7 $LIBS" +AS_LITERAL_IF([$1], + [AS_VAR_PUSHDEF([ac_Lib_ext], [ac_cv_lib_ext_$1])], + [AS_VAR_PUSHDEF([ac_Lib_ext], [ac_cv_lib_ext_$1''])])dnl + +m4_ifval([$3], + [ + AH_CHECK_FUNC_EXT([$3]) + AS_LITERAL_IF([$1], + [AS_VAR_PUSHDEF([ac_Lib_func], [ac_cv_lib_ext_$1_$3])], + [AS_VAR_PUSHDEF([ac_Lib_func], [ac_cv_lib_ext_$1''_$3])])dnl + AC_CACHE_CHECK([for $3 in -l$1], ac_Lib_func, + [AC_TRY_LINK_FUNC($3, + [AS_VAR_SET(ac_Lib_func, yes); + AS_VAR_SET(ac_Lib_ext, yes)], + [AS_VAR_SET(ac_Lib_func, no); + AS_VAR_SET(ac_Lib_ext, no)]) + ]) + AS_IF([test AS_VAR_GET(ac_Lib_func) = yes], + [AC_DEFINE_UNQUOTED(AS_TR_CPP(HAVE_$3))])dnl + AS_VAR_POPDEF([ac_Lib_func])dnl + ],[ + AC_CACHE_CHECK([for -l$1], ac_Lib_ext, + [AC_TRY_LINK_FUNC([main], + [AS_VAR_SET(ac_Lib_ext, yes)], + [AS_VAR_SET(ac_Lib_ext, no)]) + ]) + ]) +LIBS=$ac_check_lib_ext_save_LIBS + +AS_IF([test AS_VAR_GET(ac_Lib_ext) = yes], + [m4_default([$4], + [AC_DEFINE_UNQUOTED(AS_TR_CPP(HAVE_LIB$1)) + case "$$2" in + *-l$1*) + ;; + *) + $2="$$2 -l$1" + ;; + esac]) + [$6] + ], + [$5])dnl +AS_VAR_POPDEF([ac_Lib_ext])dnl +])# AC_CHECK_LIB_EXT + +# AH_CHECK_LIB_EXT(LIBNAME) +# --------------------- +m4_define([AH_CHECK_LIB_EXT], +[AH_TEMPLATE(AS_TR_CPP(HAVE_LIB$1), + [Define to 1 if you have the `]$1[' library (-l]$1[).])]) + +# AC_CHECK_FUNCS_EXT(FUNCTION, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND]) +# ----------------------------------------------------------------- +dnl check for a function in a $LIBS and $OTHER_LIBS libraries variable. +dnl AC_CHECK_FUNC_EXT(func,OTHER_LIBS,IF-TRUE,IF-FALSE) +AC_DEFUN([AC_CHECK_FUNC_EXT], +[ + AH_CHECK_FUNC_EXT($1) + ac_check_func_ext_save_LIBS=$LIBS + LIBS="$2 $LIBS" + AS_VAR_PUSHDEF([ac_var], [ac_cv_func_ext_$1])dnl + AC_CACHE_CHECK([for $1], ac_var, + [AC_LINK_IFELSE([AC_LANG_FUNC_LINK_TRY([$1])], + [AS_VAR_SET(ac_var, yes)], + [AS_VAR_SET(ac_var, no)])]) + LIBS=$ac_check_func_ext_save_LIBS + AS_IF([test AS_VAR_GET(ac_var) = yes], + [AC_DEFINE_UNQUOTED(AS_TR_CPP([HAVE_$1])) $3], + [$4])dnl +AS_VAR_POPDEF([ac_var])dnl +])# AC_CHECK_FUNC + +# AH_CHECK_FUNC_EXT(FUNCNAME) +# --------------------- +m4_define([AH_CHECK_FUNC_EXT], +[AH_TEMPLATE(AS_TR_CPP(HAVE_$1), + [Define to 1 if you have the `]$1[' function.])]) + dnl Define an AC_DEFINE with ifndef guard. dnl AC_N_DEFINE(VARIABLE [, VALUE]) define(AC_N_DEFINE, diff --git a/source3/auth/auth.c b/source3/auth/auth.c index a2486acbd1..8316c4b617 100644 --- a/source3/auth/auth.c +++ b/source3/auth/auth.c @@ -512,7 +512,7 @@ NTSTATUS make_auth_context_fixed(struct auth_context **auth_context, uchar chal[ return nt_status; } - (*auth_context)->challenge = data_blob(chal, 8); + (*auth_context)->challenge = data_blob_talloc((*auth_context)->mem_ctx, chal, 8); (*auth_context)->challenge_set_by = "fixed"; return nt_status; } diff --git a/source3/auth/auth_domain.c b/source3/auth/auth_domain.c index 56bd6b9aca..aacea261fe 100644 --- a/source3/auth/auth_domain.c +++ b/source3/auth/auth_domain.c @@ -69,7 +69,7 @@ static NTSTATUS connect_to_domain_password_server(struct cli_state **cli, /* Attempt connection */ *retry = True; result = cli_full_connection(cli, global_myname(), dc_name, &dc_ip, 0, - "IPC$", "IPC", "", "", "", 0, retry); + "IPC$", "IPC", "", "", "", 0, Undefined, retry); if (!NT_STATUS_IS_OK(result)) { /* map to something more useful */ @@ -104,7 +104,7 @@ machine %s. Error was : %s.\n", dc_name, cli_errstr(*cli))); return NT_STATUS_NO_LOGON_SERVERS; } - snprintf((*cli)->mach_acct, sizeof((*cli)->mach_acct) - 1, "%s$", setup_creds_as); + fstr_sprintf((*cli)->mach_acct, "%s$", setup_creds_as); if (!(*cli)->mach_acct) { release_server_mutex(); diff --git a/source3/auth/auth_ntlmssp.c b/source3/auth/auth_ntlmssp.c index a381219d74..3af0cbaada 100644 --- a/source3/auth/auth_ntlmssp.c +++ b/source3/auth/auth_ntlmssp.c @@ -135,4 +135,3 @@ NTSTATUS auth_ntlmssp_update(AUTH_NTLMSSP_STATE *auth_ntlmssp_state, { return ntlmssp_server_update(auth_ntlmssp_state->ntlmssp_state, request, reply); } - diff --git a/source3/auth/auth_sam.c b/source3/auth/auth_sam.c index 012696f46a..fb66d53cd4 100644 --- a/source3/auth/auth_sam.c +++ b/source3/auth/auth_sam.c @@ -44,12 +44,12 @@ static BOOL smb_pwd_check_ntlmv1(const DATA_BLOB *nt_response, } if (sec_blob->length != 8) { - DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect challenge size (%d)\n", sec_blob->length)); + DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect challenge size (%lu)\n", (unsigned long)sec_blob->length)); return False; } if (nt_response->length != 24) { - DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect password length (%d)\n", nt_response->length)); + DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect password length (%lu)\n", (unsigned long)nt_response->length)); return False; } @@ -103,8 +103,8 @@ static BOOL smb_pwd_check_ntlmv2(const DATA_BLOB *ntv2_response, /* We MUST have more than 16 bytes, or the stuff below will go crazy. No known implementation sends less than the 24 bytes for LMv2, let alone NTLMv2. */ - DEBUG(0, ("smb_pwd_check_ntlmv2: incorrect password length (%d)\n", - ntv2_response->length)); + DEBUG(0, ("smb_pwd_check_ntlmv2: incorrect password length (%lu)\n", + (unsigned long)ntv2_response->length)); return False; } @@ -233,8 +233,8 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, if (auth_flags & AUTH_FLAG_LM_RESP) { if (user_info->lm_resp.length != 24) { - DEBUG(2,("sam_password_ok: invalid LanMan password length (%d) for user %s\n", - user_info->nt_resp.length, pdb_get_username(sampass))); + DEBUG(2,("sam_password_ok: invalid LanMan password length (%lu) for user %s\n", + (unsigned long)user_info->nt_resp.length, pdb_get_username(sampass))); } if (!lp_lanman_auth()) { diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c index 8e1b420b47..5403ee8c39 100644 --- a/source3/auth/auth_util.c +++ b/source3/auth/auth_util.c @@ -68,7 +68,7 @@ void auth_add_user_script(const char *domain, const char *username) * user on the fly, do so. */ - if ( lp_adduser_script() ) + if ( *lp_adduser_script() ) smb_create_user(domain, username, NULL); else { DEBUG(10,("auth_add_user_script: no 'add user script'. Asking winbindd\n")); @@ -133,7 +133,7 @@ static NTSTATUS make_user_info(auth_usersupplied_info **user_info, *user_info = malloc(sizeof(**user_info)); if (!user_info) { - DEBUG(0,("malloc failed for user_info (size %d)\n", sizeof(*user_info))); + DEBUG(0,("malloc failed for user_info (size %lu)\n", (unsigned long)sizeof(*user_info))); return NT_STATUS_NO_MEMORY; } @@ -489,9 +489,9 @@ void debug_nt_user_token(int dbg_class, int dbg_lev, NT_USER_TOKEN *token) DEBUGC(dbg_class, dbg_lev, ("NT user token of user %s\n", sid_to_string(sid_str, &token->user_sids[0]) )); - DEBUGADDC(dbg_class, dbg_lev, ("contains %i SIDs\n", token->num_sids)); + DEBUGADDC(dbg_class, dbg_lev, ("contains %lu SIDs\n", (unsigned long)token->num_sids)); for (i = 0; i < token->num_sids; i++) - DEBUGADDC(dbg_class, dbg_lev, ("SID[%3i]: %s\n", i, + DEBUGADDC(dbg_class, dbg_lev, ("SID[%3lu]: %s\n", (unsigned long)i, sid_to_string(sid_str, &token->user_sids[i]))); } diff --git a/source3/client/client.c b/source3/client/client.c index d9c3a7aa1b..ec29f44e6e 100644 --- a/source3/client/client.c +++ b/source3/client/client.c @@ -438,7 +438,8 @@ static void add_to_do_list_queue(const char* entry) } if (do_list_queue) { - pstrcpy(do_list_queue + do_list_queue_end, entry); + safe_strcpy_base(do_list_queue + do_list_queue_end, + entry, do_list_queue, do_list_queue_size); do_list_queue_end = new_end; DEBUG(4,("added %s to do_list_queue (start=%d, end=%d)\n", entry, (int)do_list_queue_start, (int)do_list_queue_end)); @@ -481,6 +482,11 @@ static void do_list_helper(file_info *f, const char *mask, void *state) pstring mask2; char *p; + if (!f->name[0]) { + d_printf("Empty dir name returned. Possible server misconfiguration.\n"); + return; + } + pstrcpy(mask2, mask); p = strrchr_m(mask2,'\\'); if (!p) return; @@ -2285,9 +2291,9 @@ static char **remote_completion(const char *text, int len) if (i > 0) { strncpy(info.dirmask, text, i+1); info.dirmask[i+1] = 0; - snprintf(dirmask, sizeof(dirmask), "%s%*s*", cur_dir, i-1, text); + pstr_sprintf(dirmask, "%s%*s*", cur_dir, i-1, text); } else - snprintf(dirmask, sizeof(dirmask), "%s*", cur_dir); + pstr_sprintf(dirmask, "%s*", cur_dir); if (cli_list(cli, dirmask, aDIR | aSYSTEM | aHIDDEN, completion_remote_filter, &info) < 0) goto cleanup; @@ -2523,6 +2529,8 @@ static struct cli_state *do_connect(const char *server, const char *share) c->protocol = max_protocol; c->use_kerberos = use_kerberos; + cli_setup_signing_state(c, cmdline_auth_info.signing_state); + if (!cli_session_request(c, &calling, &called)) { char *p; @@ -2816,9 +2824,25 @@ static void remember_query_host(const char *arg, max_protocol = interpret_protocol(poptGetOptArg(pc), max_protocol); break; case 'T': - if (!tar_parseargs(argc, argv, poptGetOptArg(pc), optind)) { - poptPrintUsage(pc, stderr, 0); - exit(1); + /* We must use old option processing for this. Find the + * position of the -T option in the raw argv[]. */ + { + int i, optnum; + for (i = 1; i < argc; i++) { + if (strncmp("-T", argv[i],2)==0) + break; + } + i++; + if (!(optnum = tar_parseargs(argc, argv, poptGetOptArg(pc), i))) { + poptPrintUsage(pc, stderr, 0); + exit(1); + } + /* Now we must eat (optnum - i) options - they have + * been processed by tar_parseargs(). + */ + optnum -= i; + for (i = 0; i < optnum; i++) + poptGetOptArg(pc); } break; case 'D': @@ -2843,7 +2867,7 @@ static void remember_query_host(const char *arg, } } - if (poptPeekArg(pc)) { + if (poptPeekArg(pc) && !cmdline_auth_info.got_pass) { cmdline_auth_info.got_pass = True; pstrcpy(cmdline_auth_info.password,poptGetArg(pc)); } diff --git a/source3/client/clitar.c b/source3/client/clitar.c index 765bc2a659..5295de8010 100644 --- a/source3/client/clitar.c +++ b/source3/client/clitar.c @@ -43,27 +43,23 @@ static int clipfind(char **aret, int ret, char *tok); typedef struct file_info_struct file_info2; -struct file_info_struct -{ - SMB_BIG_UINT size; - uint16 mode; - uid_t uid; - gid_t gid; - /* These times are normally kept in GMT */ - time_t mtime; - time_t atime; - time_t ctime; - char *name; /* This is dynamically allocate */ - - file_info2 *next, *prev; /* Used in the stack ... */ - +struct file_info_struct { + SMB_BIG_UINT size; + uint16 mode; + uid_t uid; + gid_t gid; + /* These times are normally kept in GMT */ + time_t mtime; + time_t atime; + time_t ctime; + char *name; /* This is dynamically allocate */ + + file_info2 *next, *prev; /* Used in the stack ... */ }; -typedef struct -{ - file_info2 *top; - int items; - +typedef struct { + file_info2 *top; + int items; } stack; #define SEPARATORS " \t\n\r" @@ -145,285 +141,284 @@ static void unfixtarname(char *tptr, char *fp, int l, BOOL first); /******************************************************************* Create a string of size size+1 (for the null) *******************************************************************/ + static char *string_create_s(int size) { - char *tmp; + char *tmp; - tmp = (char *)malloc(size+1); + tmp = (char *)malloc(size+1); - if (tmp == NULL) { - - DEBUG(0, ("Out of memory in string_create_s\n")); - - } - - return(tmp); + if (tmp == NULL) { + DEBUG(0, ("Out of memory in string_create_s\n")); + } + return(tmp); } /**************************************************************************** Write a tar header to buffer ****************************************************************************/ + static void writetarheader(int f, const char *aname, SMB_BIG_UINT size, time_t mtime, const char *amode, unsigned char ftype) { - union hblock hb; - int i, chk, l; - char *jp; + union hblock hb; + int i, chk, l; + char *jp; - DEBUG(5, ("WriteTarHdr, Type = %c, Size= %.0f, Name = %s\n", ftype, (double)size, aname)); + DEBUG(5, ("WriteTarHdr, Type = %c, Size= %.0f, Name = %s\n", ftype, (double)size, aname)); - memset(hb.dummy, 0, sizeof(hb.dummy)); + memset(hb.dummy, 0, sizeof(hb.dummy)); - l=strlen(aname); - if (l >= NAMSIZ - 1) { - /* write a GNU tar style long header */ - char *b; - b = (char *)malloc(l+TBLOCK+100); - if (!b) { - DEBUG(0,("out of memory\n")); - exit(1); - } - writetarheader(f, "/./@LongLink", l+2, 0, " 0 \0", 'L'); - memset(b, 0, l+TBLOCK+100); - fixtarname(b, aname, l); - i = strlen(b)+1; - DEBUG(5, ("File name in tar file: %s, size=%d, \n", b, (int)strlen(b))); - dotarbuf(f, b, TBLOCK*(((i-1)/TBLOCK)+1)); - SAFE_FREE(b); - } - - /* use l + 1 to do the null too */ - fixtarname(hb.dbuf.name, aname, (l >= NAMSIZ) ? NAMSIZ : l + 1); - - if (lowercase) - strlower_m(hb.dbuf.name); - - /* write out a "standard" tar format header */ - - hb.dbuf.name[NAMSIZ-1]='\0'; - safe_strcpy(hb.dbuf.mode, amode, sizeof(hb.dbuf.mode)-1); - oct_it((SMB_BIG_UINT)0, 8, hb.dbuf.uid); - oct_it((SMB_BIG_UINT)0, 8, hb.dbuf.gid); - oct_it((SMB_BIG_UINT) size, 13, hb.dbuf.size); - if (size > (SMB_BIG_UINT)077777777777LL) { - - /* This is a non-POSIX compatible extention to store files - greater than 8GB. */ - - memset(hb.dbuf.size, 0, 4); - hb.dbuf.size[0]=128; - for (i = 8, jp=(char*)&size; i; i--) - hb.dbuf.size[i+3] = *(jp++); - } - oct_it((SMB_BIG_UINT) mtime, 13, hb.dbuf.mtime); - memcpy(hb.dbuf.chksum, " ", sizeof(hb.dbuf.chksum)); - memset(hb.dbuf.linkname, 0, NAMSIZ); - hb.dbuf.linkflag=ftype; + l=strlen(aname); + if (l >= NAMSIZ - 1) { + /* write a GNU tar style long header */ + char *b; + b = (char *)malloc(l+TBLOCK+100); + if (!b) { + DEBUG(0,("out of memory\n")); + exit(1); + } + writetarheader(f, "/./@LongLink", l+2, 0, " 0 \0", 'L'); + memset(b, 0, l+TBLOCK+100); + fixtarname(b, aname, l); + i = strlen(b)+1; + DEBUG(5, ("File name in tar file: %s, size=%d, \n", b, (int)strlen(b))); + dotarbuf(f, b, TBLOCK*(((i-1)/TBLOCK)+1)); + SAFE_FREE(b); + } + + /* use l + 1 to do the null too */ + fixtarname(hb.dbuf.name, aname, (l >= NAMSIZ) ? NAMSIZ : l + 1); + + if (lowercase) + strlower_m(hb.dbuf.name); + + /* write out a "standard" tar format header */ + + hb.dbuf.name[NAMSIZ-1]='\0'; + safe_strcpy(hb.dbuf.mode, amode, sizeof(hb.dbuf.mode)-1); + oct_it((SMB_BIG_UINT)0, 8, hb.dbuf.uid); + oct_it((SMB_BIG_UINT)0, 8, hb.dbuf.gid); + oct_it((SMB_BIG_UINT) size, 13, hb.dbuf.size); + if (size > (SMB_BIG_UINT)077777777777LL) { + + /* This is a non-POSIX compatible extention to store files + greater than 8GB. */ + + memset(hb.dbuf.size, 0, 4); + hb.dbuf.size[0]=128; + for (i = 8, jp=(char*)&size; i; i--) + hb.dbuf.size[i+3] = *(jp++); + } + oct_it((SMB_BIG_UINT) mtime, 13, hb.dbuf.mtime); + memcpy(hb.dbuf.chksum, " ", sizeof(hb.dbuf.chksum)); + memset(hb.dbuf.linkname, 0, NAMSIZ); + hb.dbuf.linkflag=ftype; - for (chk=0, i=sizeof(hb.dummy), jp=hb.dummy; --i>=0;) chk+=(0xFF & *jp++); + for (chk=0, i=sizeof(hb.dummy), jp=hb.dummy; --i>=0;) + chk+=(0xFF & *jp++); - oct_it((SMB_BIG_UINT) chk, 8, hb.dbuf.chksum); - hb.dbuf.chksum[6] = '\0'; + oct_it((SMB_BIG_UINT) chk, 8, hb.dbuf.chksum); + hb.dbuf.chksum[6] = '\0'; - (void) dotarbuf(f, hb.dummy, sizeof(hb.dummy)); + (void) dotarbuf(f, hb.dummy, sizeof(hb.dummy)); } /**************************************************************************** Read a tar header into a hblock structure, and validate ***************************************************************************/ + static long readtarheader(union hblock *hb, file_info2 *finfo, char *prefix) { - long chk, fchk; - int i; - char *jp; - - /* - * read in a "standard" tar format header - we're not that interested - * in that many fields, though - */ - - /* check the checksum */ - for (chk=0, i=sizeof(hb->dummy), jp=hb->dummy; --i>=0;) chk+=(0xFF & *jp++); + long chk, fchk; + int i; + char *jp; - if (chk == 0) - return chk; - - /* compensate for blanks in chksum header */ - for (i=sizeof(hb->dbuf.chksum), jp=hb->dbuf.chksum; --i>=0;) - chk-=(0xFF & *jp++); + /* + * read in a "standard" tar format header - we're not that interested + * in that many fields, though + */ - chk += ' ' * sizeof(hb->dbuf.chksum); + /* check the checksum */ + for (chk=0, i=sizeof(hb->dummy), jp=hb->dummy; --i>=0;) + chk+=(0xFF & *jp++); - fchk=unoct(hb->dbuf.chksum, sizeof(hb->dbuf.chksum)); + if (chk == 0) + return chk; - DEBUG(5, ("checksum totals chk=%ld fchk=%ld chksum=%s\n", - chk, fchk, hb->dbuf.chksum)); + /* compensate for blanks in chksum header */ + for (i=sizeof(hb->dbuf.chksum), jp=hb->dbuf.chksum; --i>=0;) + chk-=(0xFF & *jp++); - if (fchk != chk) - { - DEBUG(0, ("checksums don't match %ld %ld\n", fchk, chk)); - dump_data(5, (char *)hb - TBLOCK, TBLOCK *3); - return -1; - } + chk += ' ' * sizeof(hb->dbuf.chksum); - if ((finfo->name = string_create_s(strlen(prefix) + strlen(hb -> dbuf.name) + 3)) == NULL) { + fchk=unoct(hb->dbuf.chksum, sizeof(hb->dbuf.chksum)); - DEBUG(0, ("Out of space creating file_info2 for %s\n", hb -> dbuf.name)); - return(-1); + DEBUG(5, ("checksum totals chk=%ld fchk=%ld chksum=%s\n", + chk, fchk, hb->dbuf.chksum)); - } + if (fchk != chk) { + DEBUG(0, ("checksums don't match %ld %ld\n", fchk, chk)); + dump_data(5, (char *)hb - TBLOCK, TBLOCK *3); + return -1; + } - safe_strcpy(finfo->name, prefix, strlen(prefix) + strlen(hb -> dbuf.name) + 3); + if ((finfo->name = string_create_s(strlen(prefix) + strlen(hb -> dbuf.name) + 3)) == NULL) { + DEBUG(0, ("Out of space creating file_info2 for %s\n", hb -> dbuf.name)); + return(-1); + } - /* use l + 1 to do the null too; do prefix - prefcnt to zap leading slash */ - unfixtarname(finfo->name + strlen(prefix), hb->dbuf.name, - strlen(hb->dbuf.name) + 1, True); + safe_strcpy(finfo->name, prefix, strlen(prefix) + strlen(hb -> dbuf.name) + 3); + + /* use l + 1 to do the null too; do prefix - prefcnt to zap leading slash */ + unfixtarname(finfo->name + strlen(prefix), hb->dbuf.name, + strlen(hb->dbuf.name) + 1, True); + + /* can't handle some links at present */ + if ((hb->dbuf.linkflag != '0') && (hb -> dbuf.linkflag != '5')) { + if (hb->dbuf.linkflag == 0) { + DEBUG(6, ("Warning: NULL link flag (gnu tar archive ?) %s\n", + finfo->name)); + } else { + if (hb -> dbuf.linkflag == 'L') { /* We have a longlink */ + /* Do nothing here at the moment. do_tarput will handle this + as long as the longlink gets back to it, as it has to advance + the buffer pointer, etc */ + } else { + DEBUG(0, ("this tar file appears to contain some kind \ +of link other than a GNUtar Longlink - ignoring\n")); + return -2; + } + } + } + + if ((unoct(hb->dbuf.mode, sizeof(hb->dbuf.mode)) & S_IFDIR) || + (*(finfo->name+strlen(finfo->name)-1) == '\\')) { + finfo->mode=aDIR; + } else { + finfo->mode=0; /* we don't care about mode at the moment, we'll + * just make it a regular file */ + } - /* can't handle some links at present */ - if ((hb->dbuf.linkflag != '0') && (hb -> dbuf.linkflag != '5')) { - if (hb->dbuf.linkflag == 0) { - DEBUG(6, ("Warning: NULL link flag (gnu tar archive ?) %s\n", - finfo->name)); - } else { - if (hb -> dbuf.linkflag == 'L') { /* We have a longlink */ - /* Do nothing here at the moment. do_tarput will handle this - as long as the longlink gets back to it, as it has to advance - the buffer pointer, etc */ + /* + * Bug fix by richard@sj.co.uk + * + * REC: restore times correctly (as does tar) + * We only get the modification time of the file; set the creation time + * from the mod. time, and the access time to current time + */ + finfo->mtime = finfo->ctime = strtol(hb->dbuf.mtime, NULL, 8); + finfo->atime = time(NULL); + finfo->size = unoct(hb->dbuf.size, sizeof(hb->dbuf.size)); - } else { - DEBUG(0, ("this tar file appears to contain some kind of link other than a GNUtar Longlink - ignoring\n")); - return -2; - } - } - } - - if ((unoct(hb->dbuf.mode, sizeof(hb->dbuf.mode)) & S_IFDIR) - || (*(finfo->name+strlen(finfo->name)-1) == '\\')) - { - finfo->mode=aDIR; - } - else - finfo->mode=0; /* we don't care about mode at the moment, we'll - * just make it a regular file */ - /* - * Bug fix by richard@sj.co.uk - * - * REC: restore times correctly (as does tar) - * We only get the modification time of the file; set the creation time - * from the mod. time, and the access time to current time - */ - finfo->mtime = finfo->ctime = strtol(hb->dbuf.mtime, NULL, 8); - finfo->atime = time(NULL); - finfo->size = unoct(hb->dbuf.size, sizeof(hb->dbuf.size)); - - return True; + return True; } /**************************************************************************** Write out the tar buffer to tape or wherever ****************************************************************************/ + static int dotarbuf(int f, char *b, int n) { - int fail=1, writ=n; - - if (dry_run) { - return writ; - } - /* This routine and the next one should be the only ones that do write()s */ - if (tp + n >= tbufsiz) - { - int diff; - - diff=tbufsiz-tp; - memcpy(tarbuf + tp, b, diff); - fail=fail && (1+write(f, tarbuf, tbufsiz)); - n-=diff; - b+=diff; - tp=0; - - while (n >= tbufsiz) - { - fail=fail && (1 + write(f, b, tbufsiz)); - n-=tbufsiz; - b+=tbufsiz; + int fail=1, writ=n; + + if (dry_run) { + return writ; + } + /* This routine and the next one should be the only ones that do write()s */ + if (tp + n >= tbufsiz) { + int diff; + + diff=tbufsiz-tp; + memcpy(tarbuf + tp, b, diff); + fail=fail && (1+write(f, tarbuf, tbufsiz)); + n-=diff; + b+=diff; + tp=0; + + while (n >= tbufsiz) { + fail=fail && (1 + write(f, b, tbufsiz)); + n-=tbufsiz; + b+=tbufsiz; + } } - } - if (n>0) { - memcpy(tarbuf+tp, b, n); - tp+=n; - } - return(fail ? writ : 0); + if (n>0) { + memcpy(tarbuf+tp, b, n); + tp+=n; + } + + return(fail ? writ : 0); } /**************************************************************************** Write zeros to buffer / tape ****************************************************************************/ + static void dozerobuf(int f, int n) { - /* short routine just to write out n zeros to buffer - - * used to round files to nearest block - * and to do tar EOFs */ + /* short routine just to write out n zeros to buffer - + * used to round files to nearest block + * and to do tar EOFs */ - if (dry_run) - return; + if (dry_run) + return; - if (n+tp >= tbufsiz) - { - memset(tarbuf+tp, 0, tbufsiz-tp); - - write(f, tarbuf, tbufsiz); - memset(tarbuf, 0, (tp+=n-tbufsiz)); - } - else - { - memset(tarbuf+tp, 0, n); - tp+=n; - } + if (n+tp >= tbufsiz) { + memset(tarbuf+tp, 0, tbufsiz-tp); + write(f, tarbuf, tbufsiz); + memset(tarbuf, 0, (tp+=n-tbufsiz)); + } else { + memset(tarbuf+tp, 0, n); + tp+=n; + } } /**************************************************************************** Malloc tape buffer ****************************************************************************/ + static void initarbuf(void) { - /* initialize tar buffer */ - tbufsiz=blocksize*TBLOCK; - tarbuf=malloc(tbufsiz); /* FIXME: We might not get the buffer */ + /* initialize tar buffer */ + tbufsiz=blocksize*TBLOCK; + tarbuf=malloc(tbufsiz); /* FIXME: We might not get the buffer */ - /* reset tar buffer pointer and tar file counter and total dumped */ - tp=0; ntarf=0; ttarf=0; + /* reset tar buffer pointer and tar file counter and total dumped */ + tp=0; ntarf=0; ttarf=0; } /**************************************************************************** Write two zero blocks at end of file ****************************************************************************/ + static void dotareof(int f) { - SMB_STRUCT_STAT stbuf; - /* Two zero blocks at end of file, write out full buffer */ + SMB_STRUCT_STAT stbuf; + /* Two zero blocks at end of file, write out full buffer */ - if (dry_run) - return; + if (dry_run) + return; - (void) dozerobuf(f, TBLOCK); - (void) dozerobuf(f, TBLOCK); + (void) dozerobuf(f, TBLOCK); + (void) dozerobuf(f, TBLOCK); - if (sys_fstat(f, &stbuf) == -1) - { - DEBUG(0, ("Couldn't stat file handle\n")); - return; - } + if (sys_fstat(f, &stbuf) == -1) { + DEBUG(0, ("Couldn't stat file handle\n")); + return; + } - /* Could be a pipe, in which case S_ISREG should fail, - * and we should write out at full size */ - if (tp > 0) write(f, tarbuf, S_ISREG(stbuf.st_mode) ? tp : tbufsiz); + /* Could be a pipe, in which case S_ISREG should fail, + * and we should write out at full size */ + if (tp > 0) + write(f, tarbuf, S_ISREG(stbuf.st_mode) ? tp : tbufsiz); } /**************************************************************************** (Un)mangle DOS pathname, make nonabsolute ****************************************************************************/ + static void fixtarname(char *tptr, const char *fp, int l) { /* add a '.' to start of file name, convert from ugly dos \'s in path @@ -437,43 +432,43 @@ static void fixtarname(char *tptr, const char *fp, int l) /**************************************************************************** Convert from decimal to octal string ****************************************************************************/ + static void oct_it (SMB_BIG_UINT value, int ndgs, char *p) { - /* Converts long to octal string, pads with leading zeros */ + /* Converts long to octal string, pads with leading zeros */ - /* skip final null, but do final space */ - --ndgs; - p[--ndgs] = ' '; + /* skip final null, but do final space */ + --ndgs; + p[--ndgs] = ' '; - /* Loop does at least one digit */ - do { - p[--ndgs] = '0' + (char) (value & 7); - value >>= 3; - } - while (ndgs > 0 && value != 0); + /* Loop does at least one digit */ + do { + p[--ndgs] = '0' + (char) (value & 7); + value >>= 3; + } while (ndgs > 0 && value != 0); - /* Do leading zeros */ - while (ndgs > 0) - p[--ndgs] = '0'; + /* Do leading zeros */ + while (ndgs > 0) + p[--ndgs] = '0'; } /**************************************************************************** Convert from octal string to long ***************************************************************************/ + static long unoct(char *p, int ndgs) { - long value=0; - /* Converts octal string to long, ignoring any non-digit */ + long value=0; + /* Converts octal string to long, ignoring any non-digit */ - while (--ndgs) - { - if (isdigit((int)*p)) - value = (value << 3) | (long) (*p - '0'); + while (--ndgs) { + if (isdigit((int)*p)) + value = (value << 3) | (long) (*p - '0'); - p++; - } + p++; + } - return value; + return value; } /**************************************************************************** @@ -481,90 +476,86 @@ Compare two strings in a slash insensitive way, allowing s1 to match s2 if s1 is an "initial" string (up to directory marker). Thus, if s2 is a file in any subdirectory of s1, declare a match. ***************************************************************************/ + static int strslashcmp(char *s1, char *s2) { - char *s1_0=s1; + char *s1_0=s1; - while(*s1 && *s2 && - (*s1 == *s2 - || tolower(*s1) == tolower(*s2) - || (*s1 == '\\' && *s2=='/') - || (*s1 == '/' && *s2=='\\'))) { - s1++; s2++; - } + while(*s1 && *s2 && (*s1 == *s2 || tolower(*s1) == tolower(*s2) || + (*s1 == '\\' && *s2=='/') || (*s1 == '/' && *s2=='\\'))) { + s1++; s2++; + } - /* if s1 has a trailing slash, it compared equal, so s1 is an "initial" - string of s2. - */ - if (!*s1 && s1 != s1_0 && (*(s1-1) == '/' || *(s1-1) == '\\')) return 0; + /* if s1 has a trailing slash, it compared equal, so s1 is an "initial" + string of s2. + */ + if (!*s1 && s1 != s1_0 && (*(s1-1) == '/' || *(s1-1) == '\\')) + return 0; - /* ignore trailing slash on s1 */ - if (!*s2 && (*s1 == '/' || *s1 == '\\') && !*(s1+1)) return 0; + /* ignore trailing slash on s1 */ + if (!*s2 && (*s1 == '/' || *s1 == '\\') && !*(s1+1)) + return 0; - /* check for s1 is an "initial" string of s2 */ - if ((*s2 == '/' || *s2 == '\\') && !*s1) return 0; + /* check for s1 is an "initial" string of s2 */ + if ((*s2 == '/' || *s2 == '\\') && !*s1) + return 0; - return *s1-*s2; + return *s1-*s2; } - /**************************************************************************** Ensure a remote path exists (make if necessary) ***************************************************************************/ + static BOOL ensurepath(char *fname) { - /* *must* be called with buffer ready malloc'ed */ - /* ensures path exists */ - - char *partpath, *ffname; - char *p=fname, *basehack; - - DEBUG(5, ( "Ensurepath called with: %s\n", fname)); + /* *must* be called with buffer ready malloc'ed */ + /* ensures path exists */ - partpath = string_create_s(strlen(fname)); - ffname = string_create_s(strlen(fname)); + char *partpath, *ffname; + char *p=fname, *basehack; - if ((partpath == NULL) || (ffname == NULL)){ + DEBUG(5, ( "Ensurepath called with: %s\n", fname)); - DEBUG(0, ("Out of memory in ensurepath: %s\n", fname)); - return(False); + partpath = string_create_s(strlen(fname)); + ffname = string_create_s(strlen(fname)); - } + if ((partpath == NULL) || (ffname == NULL)){ + DEBUG(0, ("Out of memory in ensurepath: %s\n", fname)); + return(False); + } - *partpath = 0; + *partpath = 0; - /* fname copied to ffname so can strtok */ + /* fname copied to ffname so can strtok */ - safe_strcpy(ffname, fname, strlen(fname)); + safe_strcpy(ffname, fname, strlen(fname)); - /* do a `basename' on ffname, so don't try and make file name directory */ - if ((basehack=strrchr_m(ffname, '\\')) == NULL) - return True; - else - *basehack='\0'; + /* do a `basename' on ffname, so don't try and make file name directory */ + if ((basehack=strrchr_m(ffname, '\\')) == NULL) + return True; + else + *basehack='\0'; - p=strtok(ffname, "\\"); + p=strtok(ffname, "\\"); - while (p) - { - safe_strcat(partpath, p, strlen(fname) + 1); + while (p) { + safe_strcat(partpath, p, strlen(fname) + 1); - if (!cli_chkpath(cli, partpath)) { - if (!cli_mkdir(cli, partpath)) - { - DEBUG(0, ("Error mkdirhiering\n")); - return False; - } - else - DEBUG(3, ("mkdirhiering %s\n", partpath)); - - } + if (!cli_chkpath(cli, partpath)) { + if (!cli_mkdir(cli, partpath)) { + DEBUG(0, ("Error mkdirhiering\n")); + return False; + } else { + DEBUG(3, ("mkdirhiering %s\n", partpath)); + } + } - safe_strcat(partpath, "\\", strlen(fname) + 1); - p = strtok(NULL,"/\\"); - } + safe_strcat(partpath, "\\", strlen(fname) + 1); + p = strtok(NULL,"/\\"); + } - return True; + return True; } static int padit(char *buf, int bufsize, int padsize) @@ -583,7 +574,6 @@ static int padit(char *buf, int bufsize, int padsize) return berr; } - static void do_setrattr(char *name, uint16 attr, int set) { uint16 oldattr; @@ -601,268 +591,258 @@ static void do_setrattr(char *name, uint16 attr, int set) } } - /**************************************************************************** append one remote file to the tar file ***************************************************************************/ + static void do_atar(char *rname,char *lname,file_info *finfo1) { - int fnum; - SMB_BIG_UINT nread=0; - char ftype; - file_info2 finfo; - BOOL close_done = False; - BOOL shallitime=True; - char data[65520]; - int read_size = 65520; - int datalen=0; - - struct timeval tp_start; - GetTimeOfDay(&tp_start); - - ftype = '0'; /* An ordinary file ... */ - - if (finfo1) { - finfo.size = finfo1 -> size; - finfo.mode = finfo1 -> mode; - finfo.uid = finfo1 -> uid; - finfo.gid = finfo1 -> gid; - finfo.mtime = finfo1 -> mtime; - finfo.atime = finfo1 -> atime; - finfo.ctime = finfo1 -> ctime; - finfo.name = finfo1 -> name; - } - else { - finfo.size = def_finfo.size; - finfo.mode = def_finfo.mode; - finfo.uid = def_finfo.uid; - finfo.gid = def_finfo.gid; - finfo.mtime = def_finfo.mtime; - finfo.atime = def_finfo.atime; - finfo.ctime = def_finfo.ctime; - finfo.name = def_finfo.name; - } - - if (dry_run) - { - DEBUG(3,("skipping file %s of size %12.0f bytes\n", - finfo.name, - (double)finfo.size)); - shallitime=0; - ttarf+=finfo.size + TBLOCK - (finfo.size % TBLOCK); - ntarf++; - return; - } - - fnum = cli_open(cli, rname, O_RDONLY, DENY_NONE); - - dos_clean_name(rname); - - if (fnum == -1) { - DEBUG(0,("%s opening remote file %s (%s)\n", - cli_errstr(cli),rname, cur_dir)); - return; - } - - finfo.name = string_create_s(strlen(rname)); - if (finfo.name == NULL) { - DEBUG(0, ("Unable to allocate space for finfo.name in do_atar\n")); - return; - } - - safe_strcpy(finfo.name,rname, strlen(rname)); - if (!finfo1) { - if (!cli_getattrE(cli, fnum, &finfo.mode, &finfo.size, NULL, &finfo.atime, &finfo.mtime)) { - DEBUG(0, ("getattrE: %s\n", cli_errstr(cli))); - return; - } - finfo.ctime = finfo.mtime; - } - - DEBUG(3,("file %s attrib 0x%X\n",finfo.name,finfo.mode)); - - if (tar_inc && !(finfo.mode & aARCH)) - { - DEBUG(4, ("skipping %s - archive bit not set\n", finfo.name)); - shallitime=0; - } - else if (!tar_system && (finfo.mode & aSYSTEM)) - { - DEBUG(4, ("skipping %s - system bit is set\n", finfo.name)); - shallitime=0; - } - else if (!tar_hidden && (finfo.mode & aHIDDEN)) - { - DEBUG(4, ("skipping %s - hidden bit is set\n", finfo.name)); - shallitime=0; - } - else - { - DEBUG(3,("getting file %s of size %.0f bytes as a tar file %s", - finfo.name, - (double)finfo.size, - lname)); + int fnum; + SMB_BIG_UINT nread=0; + char ftype; + file_info2 finfo; + BOOL close_done = False; + BOOL shallitime=True; + char data[65520]; + int read_size = 65520; + int datalen=0; + + struct timeval tp_start; + + GetTimeOfDay(&tp_start); + + ftype = '0'; /* An ordinary file ... */ + + if (finfo1) { + finfo.size = finfo1 -> size; + finfo.mode = finfo1 -> mode; + finfo.uid = finfo1 -> uid; + finfo.gid = finfo1 -> gid; + finfo.mtime = finfo1 -> mtime; + finfo.atime = finfo1 -> atime; + finfo.ctime = finfo1 -> ctime; + finfo.name = finfo1 -> name; + } else { + finfo.size = def_finfo.size; + finfo.mode = def_finfo.mode; + finfo.uid = def_finfo.uid; + finfo.gid = def_finfo.gid; + finfo.mtime = def_finfo.mtime; + finfo.atime = def_finfo.atime; + finfo.ctime = def_finfo.ctime; + finfo.name = def_finfo.name; + } + + if (dry_run) { + DEBUG(3,("skipping file %s of size %12.0f bytes\n", finfo.name, + (double)finfo.size)); + shallitime=0; + ttarf+=finfo.size + TBLOCK - (finfo.size % TBLOCK); + ntarf++; + return; + } + + fnum = cli_open(cli, rname, O_RDONLY, DENY_NONE); + + dos_clean_name(rname); + + if (fnum == -1) { + DEBUG(0,("%s opening remote file %s (%s)\n", + cli_errstr(cli),rname, cur_dir)); + return; + } + + finfo.name = string_create_s(strlen(rname)); + if (finfo.name == NULL) { + DEBUG(0, ("Unable to allocate space for finfo.name in do_atar\n")); + return; + } + + safe_strcpy(finfo.name,rname, strlen(rname)); + if (!finfo1) { + if (!cli_getattrE(cli, fnum, &finfo.mode, &finfo.size, NULL, &finfo.atime, &finfo.mtime)) { + DEBUG(0, ("getattrE: %s\n", cli_errstr(cli))); + return; + } + finfo.ctime = finfo.mtime; + } + + DEBUG(3,("file %s attrib 0x%X\n",finfo.name,finfo.mode)); + + if (tar_inc && !(finfo.mode & aARCH)) { + DEBUG(4, ("skipping %s - archive bit not set\n", finfo.name)); + shallitime=0; + } else if (!tar_system && (finfo.mode & aSYSTEM)) { + DEBUG(4, ("skipping %s - system bit is set\n", finfo.name)); + shallitime=0; + } else if (!tar_hidden && (finfo.mode & aHIDDEN)) { + DEBUG(4, ("skipping %s - hidden bit is set\n", finfo.name)); + shallitime=0; + } else { + DEBUG(3,("getting file %s of size %.0f bytes as a tar file %s", + finfo.name, (double)finfo.size, lname)); - /* write a tar header, don't bother with mode - just set to 100644 */ - writetarheader(tarhandle, rname, finfo.size, finfo.mtime, "100644 \0", ftype); + /* write a tar header, don't bother with mode - just set to 100644 */ + writetarheader(tarhandle, rname, finfo.size, finfo.mtime, "100644 \0", ftype); - while (nread < finfo.size && !close_done) { + while (nread < finfo.size && !close_done) { - DEBUG(3,("nread=%.0f\n",(double)nread)); + DEBUG(3,("nread=%.0f\n",(double)nread)); - datalen = cli_read(cli, fnum, data, nread, read_size); + datalen = cli_read(cli, fnum, data, nread, read_size); - if (datalen == -1) { - DEBUG(0,("Error reading file %s : %s\n", rname, cli_errstr(cli))); - break; - } + if (datalen == -1) { + DEBUG(0,("Error reading file %s : %s\n", rname, cli_errstr(cli))); + break; + } - nread += datalen; - - /* if file size has increased since we made file size query, truncate - read so tar header for this file will be correct. - */ - - if (nread > finfo.size) { - datalen -= nread - finfo.size; - DEBUG(0,("File size change - truncating %s to %.0f bytes\n", finfo.name, (double)finfo.size)); - } - - /* add received bits of file to buffer - dotarbuf will - * write out in 512 byte intervals */ - if (dotarbuf(tarhandle,data,datalen) != datalen) { - DEBUG(0,("Error writing to tar file - %s\n", strerror(errno))); - break; - } + nread += datalen; + + /* if file size has increased since we made file size query, truncate + read so tar header for this file will be correct. + */ + + if (nread > finfo.size) { + datalen -= nread - finfo.size; + DEBUG(0,("File size change - truncating %s to %.0f bytes\n", + finfo.name, (double)finfo.size)); + } + + /* add received bits of file to buffer - dotarbuf will + * write out in 512 byte intervals */ + + if (dotarbuf(tarhandle,data,datalen) != datalen) { + DEBUG(0,("Error writing to tar file - %s\n", strerror(errno))); + break; + } - if (datalen == 0) { - DEBUG(0,("Error reading file %s. Got 0 bytes\n", rname)); - break; - } - - datalen=0; - } - - /* pad tar file with zero's if we couldn't get entire file */ - if (nread < finfo.size) { - DEBUG(0, ("Didn't get entire file. size=%.0f, nread=%d\n", (double)finfo.size, (int)nread)); - if (padit(data, sizeof(data), finfo.size - nread)) - DEBUG(0,("Error writing tar file - %s\n", strerror(errno))); - } - - /* round tar file to nearest block */ - if (finfo.size % TBLOCK) - dozerobuf(tarhandle, TBLOCK - (finfo.size % TBLOCK)); + if (datalen == 0) { + DEBUG(0,("Error reading file %s. Got 0 bytes\n", rname)); + break; + } + + datalen=0; + } + + /* pad tar file with zero's if we couldn't get entire file */ + if (nread < finfo.size) { + DEBUG(0, ("Didn't get entire file. size=%.0f, nread=%d\n", + (double)finfo.size, (int)nread)); + if (padit(data, sizeof(data), finfo.size - nread)) + DEBUG(0,("Error writing tar file - %s\n", strerror(errno))); + } + + /* round tar file to nearest block */ + if (finfo.size % TBLOCK) + dozerobuf(tarhandle, TBLOCK - (finfo.size % TBLOCK)); - ttarf+=finfo.size + TBLOCK - (finfo.size % TBLOCK); - ntarf++; - } + ttarf+=finfo.size + TBLOCK - (finfo.size % TBLOCK); + ntarf++; + } - cli_close(cli, fnum); + cli_close(cli, fnum); - if (shallitime) - { - struct timeval tp_end; - int this_time; + if (shallitime) { + struct timeval tp_end; + int this_time; - /* if shallitime is true then we didn't skip */ - if (tar_reset && !dry_run) - (void) do_setrattr(finfo.name, aARCH, ATTRRESET); + /* if shallitime is true then we didn't skip */ + if (tar_reset && !dry_run) + (void) do_setrattr(finfo.name, aARCH, ATTRRESET); - GetTimeOfDay(&tp_end); - this_time = - (tp_end.tv_sec - tp_start.tv_sec)*1000 + - (tp_end.tv_usec - tp_start.tv_usec)/1000; - get_total_time_ms += this_time; - get_total_size += finfo.size; - - if (tar_noisy) - { - DEBUG(0, ("%12.0f (%7.1f kb/s) %s\n", - (double)finfo.size, finfo.size / MAX(0.001, (1.024*this_time)), - finfo.name)); - } + GetTimeOfDay(&tp_end); + this_time = (tp_end.tv_sec - tp_start.tv_sec)*1000 + (tp_end.tv_usec - tp_start.tv_usec)/1000; + get_total_time_ms += this_time; + get_total_size += finfo.size; + + if (tar_noisy) { + DEBUG(0, ("%12.0f (%7.1f kb/s) %s\n", + (double)finfo.size, finfo.size / MAX(0.001, (1.024*this_time)), + finfo.name)); + } - /* Thanks to Carel-Jan Engel (ease@mail.wirehub.nl) for this one */ - DEBUG(3,("(%g kb/s) (average %g kb/s)\n", - finfo.size / MAX(0.001, (1.024*this_time)), - get_total_size / MAX(0.001, (1.024*get_total_time_ms)))); - } + /* Thanks to Carel-Jan Engel (ease@mail.wirehub.nl) for this one */ + DEBUG(3,("(%g kb/s) (average %g kb/s)\n", + finfo.size / MAX(0.001, (1.024*this_time)), + get_total_size / MAX(0.001, (1.024*get_total_time_ms)))); + } } /**************************************************************************** Append single file to tar file (or not) ***************************************************************************/ + static void do_tar(file_info *finfo) { - pstring rname; + pstring rname; - if (strequal(finfo->name,"..") || strequal(finfo->name,".")) - return; + if (strequal(finfo->name,"..") || strequal(finfo->name,".")) + return; - /* Is it on the exclude list ? */ - if (!tar_excl && clipn) { - pstring exclaim; + /* Is it on the exclude list ? */ + if (!tar_excl && clipn) { + pstring exclaim; - DEBUG(5, ("Excl: strlen(cur_dir) = %d\n", (int)strlen(cur_dir))); + DEBUG(5, ("Excl: strlen(cur_dir) = %d\n", (int)strlen(cur_dir))); - pstrcpy(exclaim, cur_dir); - *(exclaim+strlen(exclaim)-1)='\0'; + pstrcpy(exclaim, cur_dir); + *(exclaim+strlen(exclaim)-1)='\0'; - pstrcat(exclaim, "\\"); - pstrcat(exclaim, finfo->name); + pstrcat(exclaim, "\\"); + pstrcat(exclaim, finfo->name); - DEBUG(5, ("...tar_re_search: %d\n", tar_re_search)); + DEBUG(5, ("...tar_re_search: %d\n", tar_re_search)); - if ((!tar_re_search && clipfind(cliplist, clipn, exclaim)) || + if ((!tar_re_search && clipfind(cliplist, clipn, exclaim)) || #ifdef HAVE_REGEX_H - (tar_re_search && !regexec(preg, exclaim, 0, NULL, 0))) { + (tar_re_search && !regexec(preg, exclaim, 0, NULL, 0))) { #else - (tar_re_search && mask_match(exclaim, cliplist[0], True))) { + (tar_re_search && mask_match(exclaim, cliplist[0], True))) { #endif - DEBUG(3,("Skipping file %s\n", exclaim)); - return; - } - } - - if (finfo->mode & aDIR) - { - pstring saved_curdir; - pstring mtar_mask; - - pstrcpy(saved_curdir, cur_dir); - - DEBUG(5, ("Sizeof(cur_dir)=%d, strlen(cur_dir)=%d, strlen(finfo->name)=%d\nname=%s,cur_dir=%s\n", (int)sizeof(cur_dir), (int)strlen(cur_dir), (int)strlen(finfo->name), finfo->name, cur_dir)); - - pstrcat(cur_dir,finfo->name); - pstrcat(cur_dir,"\\"); - - DEBUG(5, ("Writing a dir, Name = %s\n", cur_dir)); - - /* write a tar directory, don't bother with mode - just set it to - * 40755 */ - writetarheader(tarhandle, cur_dir, 0, finfo->mtime, "040755 \0", '5'); - if (tar_noisy) { - DEBUG(0,(" directory %s\n", cur_dir)); - } - ntarf++; /* Make sure we have a file on there */ - pstrcpy(mtar_mask,cur_dir); - pstrcat(mtar_mask,"*"); - DEBUG(5, ("Doing list with mtar_mask: %s\n", mtar_mask)); - do_list(mtar_mask, attribute, do_tar, False, True); - pstrcpy(cur_dir,saved_curdir); - } - else - { - pstrcpy(rname,cur_dir); - pstrcat(rname,finfo->name); - do_atar(rname,finfo->name,finfo); - } + DEBUG(3,("Skipping file %s\n", exclaim)); + return; + } + } + + if (finfo->mode & aDIR) { + pstring saved_curdir; + pstring mtar_mask; + + pstrcpy(saved_curdir, cur_dir); + + DEBUG(5, ("Sizeof(cur_dir)=%d, strlen(cur_dir)=%d, \ +strlen(finfo->name)=%d\nname=%s,cur_dir=%s\n", + (int)sizeof(cur_dir), (int)strlen(cur_dir), + (int)strlen(finfo->name), finfo->name, cur_dir)); + + pstrcat(cur_dir,finfo->name); + pstrcat(cur_dir,"\\"); + + DEBUG(5, ("Writing a dir, Name = %s\n", cur_dir)); + + /* write a tar directory, don't bother with mode - just set it to + * 40755 */ + writetarheader(tarhandle, cur_dir, 0, finfo->mtime, "040755 \0", '5'); + if (tar_noisy) { + DEBUG(0,(" directory %s\n", cur_dir)); + } + ntarf++; /* Make sure we have a file on there */ + pstrcpy(mtar_mask,cur_dir); + pstrcat(mtar_mask,"*"); + DEBUG(5, ("Doing list with mtar_mask: %s\n", mtar_mask)); + do_list(mtar_mask, attribute, do_tar, False, True); + pstrcpy(cur_dir,saved_curdir); + } else { + pstrcpy(rname,cur_dir); + pstrcat(rname,finfo->name); + do_atar(rname,finfo->name,finfo); + } } /**************************************************************************** Convert from UNIX to DOS file names ***************************************************************************/ + static void unfixtarname(char *tptr, char *fp, int l, BOOL first) { /* remove '.' from start of file name, convert from unix /'s to @@ -886,79 +866,72 @@ static void unfixtarname(char *tptr, char *fp, int l, BOOL first) string_replace(tptr, '/', '\\'); } - /**************************************************************************** Move to the next block in the buffer, which may mean read in another set of blocks. FIXME, we should allow more than one block to be skipped. ****************************************************************************/ + static int next_block(char *ltarbuf, char **bufferp, int bufsiz) { - int bufread, total = 0; - - DEBUG(5, ("Advancing to next block: %0lx\n", (unsigned long)*bufferp)); - *bufferp += TBLOCK; - total = TBLOCK; - - if (*bufferp >= (ltarbuf + bufsiz)) { - - DEBUG(5, ("Reading more data into ltarbuf ...\n")); - - /* - * Bugfix from Bob Boehmer - * Fixes bug where read can return short if coming from - * a pipe. - */ - - bufread = read(tarhandle, ltarbuf, bufsiz); - total = bufread; - - while (total < bufsiz) { - if (bufread < 0) { /* An error, return false */ - return (total > 0 ? -2 : bufread); - } - if (bufread == 0) { - if (total <= 0) { - return -2; - } - break; - } - bufread = read(tarhandle, <arbuf[total], bufsiz - total); - total += bufread; - } - - DEBUG(5, ("Total bytes read ... %i\n", total)); - - *bufferp = ltarbuf; + int bufread, total = 0; + + DEBUG(5, ("Advancing to next block: %0lx\n", (unsigned long)*bufferp)); + *bufferp += TBLOCK; + total = TBLOCK; + + if (*bufferp >= (ltarbuf + bufsiz)) { + + DEBUG(5, ("Reading more data into ltarbuf ...\n")); + + /* + * Bugfix from Bob Boehmer + * Fixes bug where read can return short if coming from + * a pipe. + */ + + bufread = read(tarhandle, ltarbuf, bufsiz); + total = bufread; + + while (total < bufsiz) { + if (bufread < 0) { /* An error, return false */ + return (total > 0 ? -2 : bufread); + } + if (bufread == 0) { + if (total <= 0) { + return -2; + } + break; + } + bufread = read(tarhandle, <arbuf[total], bufsiz - total); + total += bufread; + } - } + DEBUG(5, ("Total bytes read ... %i\n", total)); - return(total); + *bufferp = ltarbuf; + } + return(total); } /* Skip a file, even if it includes a long file name? */ static int skip_file(int skipsize) { - int dsize = skipsize; - - DEBUG(5, ("Skiping file. Size = %i\n", skipsize)); - - /* FIXME, we should skip more than one block at a time */ - - while (dsize > 0) { + int dsize = skipsize; - if (next_block(tarbuf, &buffer_p, tbufsiz) <= 0) { + DEBUG(5, ("Skiping file. Size = %i\n", skipsize)); - DEBUG(0, ("Empty file, short tar file, or read error: %s\n", strerror(errno))); - return(False); + /* FIXME, we should skip more than one block at a time */ - } - - dsize -= TBLOCK; - - } + while (dsize > 0) { + if (next_block(tarbuf, &buffer_p, tbufsiz) <= 0) { + DEBUG(0, ("Empty file, short tar file, or read error: %s\n", strerror(errno))); + return(False); + } + dsize -= TBLOCK; + } - return(True); + return(True); } /************************************************************* @@ -969,103 +942,94 @@ static int skip_file(int skipsize) static int get_file(file_info2 finfo) { - int fnum = -1, pos = 0, dsize = 0, bpos = 0; - SMB_BIG_UINT rsize = 0; - - DEBUG(5, ("get_file: file: %s, size %.0f\n", finfo.name, (double)finfo.size)); - - if (ensurepath(finfo.name) && - (fnum=cli_open(cli, finfo.name, O_RDWR|O_CREAT|O_TRUNC, DENY_NONE)) == -1) { - DEBUG(0, ("abandoning restore\n")); - return(False); - } - - /* read the blocks from the tar file and write to the remote file */ - - rsize = finfo.size; /* This is how much to write */ - - while (rsize > 0) { + int fnum = -1, pos = 0, dsize = 0, bpos = 0; + SMB_BIG_UINT rsize = 0; - /* We can only write up to the end of the buffer */ + DEBUG(5, ("get_file: file: %s, size %.0f\n", finfo.name, (double)finfo.size)); - dsize = MIN(tbufsiz - (buffer_p - tarbuf) - bpos, 65520); /* Calculate the size to write */ - dsize = MIN(dsize, rsize); /* Should be only what is left */ - DEBUG(5, ("writing %i bytes, bpos = %i ...\n", dsize, bpos)); - - if (cli_write(cli, fnum, 0, buffer_p + bpos, pos, dsize) != dsize) { - DEBUG(0, ("Error writing remote file\n")); - return 0; - } - - rsize -= dsize; - pos += dsize; - - /* Now figure out how much to move in the buffer */ + if (ensurepath(finfo.name) && + (fnum=cli_open(cli, finfo.name, O_RDWR|O_CREAT|O_TRUNC, DENY_NONE)) == -1) { + DEBUG(0, ("abandoning restore\n")); + return(False); + } - /* FIXME, we should skip more than one block at a time */ + /* read the blocks from the tar file and write to the remote file */ - /* First, skip any initial part of the part written that is left over */ - /* from the end of the first TBLOCK */ + rsize = finfo.size; /* This is how much to write */ - if ((bpos) && ((bpos + dsize) >= TBLOCK)) { + while (rsize > 0) { - dsize -= (TBLOCK - bpos); /* Get rid of the end of the first block */ - bpos = 0; + /* We can only write up to the end of the buffer */ + dsize = MIN(tbufsiz - (buffer_p - tarbuf) - bpos, 65520); /* Calculate the size to write */ + dsize = MIN(dsize, rsize); /* Should be only what is left */ + DEBUG(5, ("writing %i bytes, bpos = %i ...\n", dsize, bpos)); - if (next_block(tarbuf, &buffer_p, tbufsiz) <=0) { /* and skip the block */ - DEBUG(0, ("Empty file, short tar file, or read error: %s\n", strerror(errno))); - return False; + if (cli_write(cli, fnum, 0, buffer_p + bpos, pos, dsize) != dsize) { + DEBUG(0, ("Error writing remote file\n")); + return 0; + } - } + rsize -= dsize; + pos += dsize; - } + /* Now figure out how much to move in the buffer */ - /* - * Bugfix from Bob Boehmer . - * If the file being extracted is an exact multiple of - * TBLOCK bytes then we don't want to extract the next - * block from the tarfile here, as it will be done in - * the caller of get_file(). - */ + /* FIXME, we should skip more than one block at a time */ - while (((rsize != 0) && (dsize >= TBLOCK)) || - ((rsize == 0) && (dsize > TBLOCK))) { + /* First, skip any initial part of the part written that is left over */ + /* from the end of the first TBLOCK */ - if (next_block(tarbuf, &buffer_p, tbufsiz) <=0) { - DEBUG(0, ("Empty file, short tar file, or read error: %s\n", strerror(errno))); - return False; - } + if ((bpos) && ((bpos + dsize) >= TBLOCK)) { + dsize -= (TBLOCK - bpos); /* Get rid of the end of the first block */ + bpos = 0; - dsize -= TBLOCK; - } + if (next_block(tarbuf, &buffer_p, tbufsiz) <=0) { /* and skip the block */ + DEBUG(0, ("Empty file, short tar file, or read error: %s\n", strerror(errno))); + return False; + } + } - bpos = dsize; + /* + * Bugfix from Bob Boehmer . + * If the file being extracted is an exact multiple of + * TBLOCK bytes then we don't want to extract the next + * block from the tarfile here, as it will be done in + * the caller of get_file(). + */ - } + while (((rsize != 0) && (dsize >= TBLOCK)) || + ((rsize == 0) && (dsize > TBLOCK))) { - /* Now close the file ... */ + if (next_block(tarbuf, &buffer_p, tbufsiz) <=0) { + DEBUG(0, ("Empty file, short tar file, or read error: %s\n", strerror(errno))); + return False; + } - if (!cli_close(cli, fnum)) { - DEBUG(0, ("Error closing remote file\n")); - return(False); - } + dsize -= TBLOCK; + } + bpos = dsize; + } - /* Now we update the creation date ... */ + /* Now close the file ... */ - DEBUG(5, ("Updating creation date on %s\n", finfo.name)); + if (!cli_close(cli, fnum)) { + DEBUG(0, ("Error closing remote file\n")); + return(False); + } - if (!cli_setatr(cli, finfo.name, finfo.mode, finfo.mtime)) { - if (tar_real_noisy) { - DEBUG(0, ("Could not set time on file: %s\n", finfo.name)); - /*return(False); */ /* Ignore, as Win95 does not allow changes */ - } - } + /* Now we update the creation date ... */ + DEBUG(5, ("Updating creation date on %s\n", finfo.name)); - ntarf++; + if (!cli_setatr(cli, finfo.name, finfo.mode, finfo.mtime)) { + if (tar_real_noisy) { + DEBUG(0, ("Could not set time on file: %s\n", finfo.name)); + /*return(False); */ /* Ignore, as Win95 does not allow changes */ + } + } - DEBUG(0, ("restore tar file %s of size %.0f bytes\n", finfo.name, (double)finfo.size)); - - return(True); + ntarf++; + DEBUG(0, ("restore tar file %s of size %.0f bytes\n", finfo.name, (double)finfo.size)); + return(True); } /* Create a directory. We just ensure that the path exists and return as there @@ -1073,214 +1037,167 @@ static int get_file(file_info2 finfo) */ static int get_dir(file_info2 finfo) { + DEBUG(0, ("restore directory %s\n", finfo.name)); - DEBUG(0, ("restore directory %s\n", finfo.name)); - - if (!ensurepath(finfo.name)) { - - DEBUG(0, ("Problems creating directory\n")); - return(False); - - } - - ntarf++; - return(True); - + if (!ensurepath(finfo.name)) { + DEBUG(0, ("Problems creating directory\n")); + return(False); + } + ntarf++; + return(True); } + /* Get a file with a long file name ... first file has file name, next file has the data. We only want the long file name, as the loop in do_tarput will deal with the rest. */ static char * get_longfilename(file_info2 finfo) { - int namesize = strlen(finfo.name) + strlen(cur_dir) + 2; - char *longname = malloc(namesize); - int offset = 0, left = finfo.size; - BOOL first = True; - - DEBUG(5, ("Restoring a long file name: %s\n", finfo.name)); - DEBUG(5, ("Len = %.0f\n", (double)finfo.size)); - - if (longname == NULL) { - - DEBUG(0, ("could not allocate buffer of size %d for longname\n", - namesize)); - return(NULL); - } - - /* First, add cur_dir to the long file name */ + int namesize = strlen(finfo.name) + strlen(cur_dir) + 2; + char *longname = malloc(namesize); + int offset = 0, left = finfo.size; + BOOL first = True; - if (strlen(cur_dir) > 0) { - strncpy(longname, cur_dir, namesize); - offset = strlen(cur_dir); - } + DEBUG(5, ("Restoring a long file name: %s\n", finfo.name)); + DEBUG(5, ("Len = %.0f\n", (double)finfo.size)); - /* Loop through the blocks picking up the name */ - - while (left > 0) { - - if (next_block(tarbuf, &buffer_p, tbufsiz) <= 0) { + if (longname == NULL) { + DEBUG(0, ("could not allocate buffer of size %d for longname\n", namesize)); + return(NULL); + } - DEBUG(0, ("Empty file, short tar file, or read error: %s\n", strerror(errno))); - return(NULL); + /* First, add cur_dir to the long file name */ - } + if (strlen(cur_dir) > 0) { + strncpy(longname, cur_dir, namesize); + offset = strlen(cur_dir); + } - unfixtarname(longname + offset, buffer_p, MIN(TBLOCK, finfo.size), first--); - DEBUG(5, ("UnfixedName: %s, buffer: %s\n", longname, buffer_p)); + /* Loop through the blocks picking up the name */ - offset += TBLOCK; - left -= TBLOCK; + while (left > 0) { + if (next_block(tarbuf, &buffer_p, tbufsiz) <= 0) { + DEBUG(0, ("Empty file, short tar file, or read error: %s\n", strerror(errno))); + return(NULL); + } - } + unfixtarname(longname + offset, buffer_p, MIN(TBLOCK, finfo.size), first--); + DEBUG(5, ("UnfixedName: %s, buffer: %s\n", longname, buffer_p)); - return(longname); + offset += TBLOCK; + left -= TBLOCK; + } + return(longname); } static void do_tarput(void) { - file_info2 finfo; - struct timeval tp_start; - char *longfilename = NULL, linkflag; - int skip = False; - - GetTimeOfDay(&tp_start); - - DEBUG(5, ("RJS do_tarput called ...\n")); - - buffer_p = tarbuf + tbufsiz; /* init this to force first read */ - - /* Now read through those files ... */ - - while (True) { - - /* Get us to the next block, or the first block first time around */ - - if (next_block(tarbuf, &buffer_p, tbufsiz) <= 0) { - - DEBUG(0, ("Empty file, short tar file, or read error: %s\n", strerror(errno))); - - return; - - } - - DEBUG(5, ("Reading the next header ...\n")); - - switch (readtarheader((union hblock *) buffer_p, &finfo, cur_dir)) { - - case -2: /* Hmm, not good, but not fatal */ - DEBUG(0, ("Skipping %s...\n", finfo.name)); - if ((next_block(tarbuf, &buffer_p, tbufsiz) <= 0) && - !skip_file(finfo.size)) { - - DEBUG(0, ("Short file, bailing out...\n")); - return; - - } - - break; - - case -1: - DEBUG(0, ("abandoning restore, -1 from read tar header\n")); - return; - - case 0: /* chksum is zero - looks like an EOF */ - DEBUG(0, ("tar: restored %d files and directories\n", ntarf)); - return; /* Hmmm, bad here ... */ - - default: - /* No action */ - - break; - - } + file_info2 finfo; + struct timeval tp_start; + char *longfilename = NULL, linkflag; + int skip = False; + + GetTimeOfDay(&tp_start); + DEBUG(5, ("RJS do_tarput called ...\n")); + + buffer_p = tarbuf + tbufsiz; /* init this to force first read */ + + /* Now read through those files ... */ + while (True) { + /* Get us to the next block, or the first block first time around */ + if (next_block(tarbuf, &buffer_p, tbufsiz) <= 0) { + DEBUG(0, ("Empty file, short tar file, or read error: %s\n", strerror(errno))); + return; + } - /* Now, do we have a long file name? */ + DEBUG(5, ("Reading the next header ...\n")); - if (longfilename != NULL) { + switch (readtarheader((union hblock *) buffer_p, &finfo, cur_dir)) { + case -2: /* Hmm, not good, but not fatal */ + DEBUG(0, ("Skipping %s...\n", finfo.name)); + if ((next_block(tarbuf, &buffer_p, tbufsiz) <= 0) && !skip_file(finfo.size)) { + DEBUG(0, ("Short file, bailing out...\n")); + return; + } + break; - SAFE_FREE(finfo.name); /* Free the space already allocated */ - finfo.name = longfilename; - longfilename = NULL; + case -1: + DEBUG(0, ("abandoning restore, -1 from read tar header\n")); + return; - } + case 0: /* chksum is zero - looks like an EOF */ + DEBUG(0, ("tar: restored %d files and directories\n", ntarf)); + return; /* Hmmm, bad here ... */ - /* Well, now we have a header, process the file ... */ + default: + /* No action */ + break; + } - /* Should we skip the file? We have the long name as well here */ + /* Now, do we have a long file name? */ + if (longfilename != NULL) { + SAFE_FREE(finfo.name); /* Free the space already allocated */ + finfo.name = longfilename; + longfilename = NULL; + } - skip = clipn && - ((!tar_re_search && clipfind(cliplist, clipn, finfo.name) ^ tar_excl) + /* Well, now we have a header, process the file ... */ + /* Should we skip the file? We have the long name as well here */ + skip = clipn && ((!tar_re_search && clipfind(cliplist, clipn, finfo.name) ^ tar_excl) || #ifdef HAVE_REGEX_H - || (tar_re_search && !regexec(preg, finfo.name, 0, NULL, 0))); + (tar_re_search && !regexec(preg, finfo.name, 0, NULL, 0))); #else - || (tar_re_search && mask_match(finfo.name, cliplist[0], True))); + (tar_re_search && mask_match(finfo.name, cliplist[0], True))); #endif - DEBUG(5, ("Skip = %i, cliplist=%s, file=%s\n", skip, (cliplist?cliplist[0]:NULL), finfo.name)); - - if (skip) { - - skip_file(finfo.size); - continue; - - } - - /* We only get this far if we should process the file */ - linkflag = ((union hblock *)buffer_p) -> dbuf.linkflag; - - switch (linkflag) { - - case '0': /* Should use symbolic names--FIXME */ - - /* - * Skip to the next block first, so we can get the file, FIXME, should - * be in get_file ... - * The 'finfo.size != 0' fix is from Bob Boehmer - * Fixes bug where file size in tarfile is zero. - */ - - if ((finfo.size != 0) && next_block(tarbuf, &buffer_p, tbufsiz) <=0) { - DEBUG(0, ("Short file, bailing out...\n")); - return; - } - if (!get_file(finfo)) { - DEBUG(0, ("Abandoning restore\n")); - return; - - } - break; - - case '5': - if (!get_dir(finfo)) { - DEBUG(0, ("Abandoning restore \n")); - return; - } - break; - - case 'L': - longfilename = get_longfilename(finfo); - if (!longfilename) { - DEBUG(0, ("abandoning restore\n")); - return; - - } - DEBUG(5, ("Long file name: %s\n", longfilename)); - break; - - default: - skip_file(finfo.size); /* Don't handle these yet */ - break; - - } - - } - + DEBUG(5, ("Skip = %i, cliplist=%s, file=%s\n", skip, (cliplist?cliplist[0]:NULL), finfo.name)); + if (skip) { + skip_file(finfo.size); + continue; + } + /* We only get this far if we should process the file */ + linkflag = ((union hblock *)buffer_p) -> dbuf.linkflag; + switch (linkflag) { + case '0': /* Should use symbolic names--FIXME */ + /* + * Skip to the next block first, so we can get the file, FIXME, should + * be in get_file ... + * The 'finfo.size != 0' fix is from Bob Boehmer + * Fixes bug where file size in tarfile is zero. + */ + if ((finfo.size != 0) && next_block(tarbuf, &buffer_p, tbufsiz) <=0) { + DEBUG(0, ("Short file, bailing out...\n")); + return; + } + if (!get_file(finfo)) { + DEBUG(0, ("Abandoning restore\n")); + return; + } + break; + case '5': + if (!get_dir(finfo)) { + DEBUG(0, ("Abandoning restore \n")); + return; + } + break; + case 'L': + longfilename = get_longfilename(finfo); + if (!longfilename) { + DEBUG(0, ("abandoning restore\n")); + return; + } + DEBUG(5, ("Long file name: %s\n", longfilename)); + break; + + default: + skip_file(finfo.size); /* Don't handle these yet */ + break; + } + } } - /* * samba interactive commands */ @@ -1288,577 +1205,594 @@ static void do_tarput(void) /**************************************************************************** Blocksize command ***************************************************************************/ + int cmd_block(void) { - fstring buf; - int block; - - if (!next_token_nr(NULL,buf,NULL,sizeof(buf))) - { - DEBUG(0, ("blocksize \n")); - return 1; - } - - block=atoi(buf); - if (block < 0 || block > 65535) - { - DEBUG(0, ("blocksize out of range")); - return 1; - } - - blocksize=block; - DEBUG(2,("blocksize is now %d\n", blocksize)); - - return 0; + fstring buf; + int block; + + if (!next_token_nr(NULL,buf,NULL,sizeof(buf))) { + DEBUG(0, ("blocksize \n")); + return 1; + } + + block=atoi(buf); + if (block < 0 || block > 65535) { + DEBUG(0, ("blocksize out of range")); + return 1; + } + + blocksize=block; + DEBUG(2,("blocksize is now %d\n", blocksize)); + + return 0; } /**************************************************************************** command to set incremental / reset mode ***************************************************************************/ + int cmd_tarmode(void) { - fstring buf; - - while (next_token_nr(NULL,buf,NULL,sizeof(buf))) { - if (strequal(buf, "full")) - tar_inc=False; - else if (strequal(buf, "inc")) - tar_inc=True; - else if (strequal(buf, "reset")) - tar_reset=True; - else if (strequal(buf, "noreset")) - tar_reset=False; - else if (strequal(buf, "system")) - tar_system=True; - else if (strequal(buf, "nosystem")) - tar_system=False; - else if (strequal(buf, "hidden")) - tar_hidden=True; - else if (strequal(buf, "nohidden")) - tar_hidden=False; - else if (strequal(buf, "verbose") || strequal(buf, "noquiet")) - tar_noisy=True; - else if (strequal(buf, "quiet") || strequal(buf, "noverbose")) - tar_noisy=False; - else DEBUG(0, ("tarmode: unrecognised option %s\n", buf)); - } - - DEBUG(0, ("tarmode is now %s, %s, %s, %s, %s\n", - tar_inc ? "incremental" : "full", - tar_system ? "system" : "nosystem", - tar_hidden ? "hidden" : "nohidden", - tar_reset ? "reset" : "noreset", - tar_noisy ? "verbose" : "quiet")); - - return 0; + fstring buf; + + while (next_token_nr(NULL,buf,NULL,sizeof(buf))) { + if (strequal(buf, "full")) + tar_inc=False; + else if (strequal(buf, "inc")) + tar_inc=True; + else if (strequal(buf, "reset")) + tar_reset=True; + else if (strequal(buf, "noreset")) + tar_reset=False; + else if (strequal(buf, "system")) + tar_system=True; + else if (strequal(buf, "nosystem")) + tar_system=False; + else if (strequal(buf, "hidden")) + tar_hidden=True; + else if (strequal(buf, "nohidden")) + tar_hidden=False; + else if (strequal(buf, "verbose") || strequal(buf, "noquiet")) + tar_noisy=True; + else if (strequal(buf, "quiet") || strequal(buf, "noverbose")) + tar_noisy=False; + else + DEBUG(0, ("tarmode: unrecognised option %s\n", buf)); + } + + DEBUG(0, ("tarmode is now %s, %s, %s, %s, %s\n", + tar_inc ? "incremental" : "full", + tar_system ? "system" : "nosystem", + tar_hidden ? "hidden" : "nohidden", + tar_reset ? "reset" : "noreset", + tar_noisy ? "verbose" : "quiet")); + return 0; } /**************************************************************************** Feeble attrib command ***************************************************************************/ + int cmd_setmode(void) { - char *q; - fstring buf; - pstring fname; - uint16 attra[2]; - int direct=1; - - attra[0] = attra[1] = 0; - - if (!next_token_nr(NULL,buf,NULL,sizeof(buf))) - { - DEBUG(0, ("setmode <[+|-]rsha>\n")); - return 1; - } - - pstrcpy(fname, cur_dir); - pstrcat(fname, buf); - - while (next_token_nr(NULL,buf,NULL,sizeof(buf))) { - q=buf; - - while(*q) - switch (*q++) { - case '+': direct=1; - break; - case '-': direct=0; - break; - case 'r': attra[direct]|=aRONLY; - break; - case 'h': attra[direct]|=aHIDDEN; - break; - case 's': attra[direct]|=aSYSTEM; - break; - case 'a': attra[direct]|=aARCH; - break; - default: DEBUG(0, ("setmode \n")); - return 1; - } - } + char *q; + fstring buf; + pstring fname; + uint16 attra[2]; + int direct=1; + + attra[0] = attra[1] = 0; - if (attra[ATTRSET]==0 && attra[ATTRRESET]==0) - { - DEBUG(0, ("setmode <[+|-]rsha>\n")); - return 1; - } + if (!next_token_nr(NULL,buf,NULL,sizeof(buf))) { + DEBUG(0, ("setmode <[+|-]rsha>\n")); + return 1; + } + + pstrcpy(fname, cur_dir); + pstrcat(fname, buf); + + while (next_token_nr(NULL,buf,NULL,sizeof(buf))) { + q=buf; + + while(*q) { + switch (*q++) { + case '+': + direct=1; + break; + case '-': + direct=0; + break; + case 'r': + attra[direct]|=aRONLY; + break; + case 'h': + attra[direct]|=aHIDDEN; + break; + case 's': + attra[direct]|=aSYSTEM; + break; + case 'a': + attra[direct]|=aARCH; + break; + default: + DEBUG(0, ("setmode \n")); + return 1; + } + } + } - DEBUG(2, ("\nperm set %d %d\n", attra[ATTRSET], attra[ATTRRESET])); - do_setrattr(fname, attra[ATTRSET], ATTRSET); - do_setrattr(fname, attra[ATTRRESET], ATTRRESET); + if (attra[ATTRSET]==0 && attra[ATTRRESET]==0) { + DEBUG(0, ("setmode <[+|-]rsha>\n")); + return 1; + } - return 0; + DEBUG(2, ("\nperm set %d %d\n", attra[ATTRSET], attra[ATTRRESET])); + do_setrattr(fname, attra[ATTRSET], ATTRSET); + do_setrattr(fname, attra[ATTRRESET], ATTRRESET); + return 0; } /**************************************************************************** Principal command for creating / extracting ***************************************************************************/ + int cmd_tar(void) { - fstring buf; - char **argl; - int argcl; - - if (!next_token_nr(NULL,buf,NULL,sizeof(buf))) - { - DEBUG(0,("tar [IXbgan] \n")); - return 1; - } - - argl=toktocliplist(&argcl, NULL); - if (!tar_parseargs(argcl, argl, buf, 0)) - return 1; + fstring buf; + char **argl; + int argcl; - process_tar(); + if (!next_token_nr(NULL,buf,NULL,sizeof(buf))) { + DEBUG(0,("tar [IXbgan] \n")); + return 1; + } - SAFE_FREE(argl); + argl=toktocliplist(&argcl, NULL); + if (!tar_parseargs(argcl, argl, buf, 0)) + return 1; - return 0; + process_tar(); + SAFE_FREE(argl); + return 0; } /**************************************************************************** Command line (option) version ***************************************************************************/ + int process_tar(void) { - initarbuf(); - switch(tar_type) { - case 'x': + initarbuf(); + switch(tar_type) { + case 'x': #if 0 - do_tarput2(); + do_tarput2(); #else - do_tarput(); + do_tarput(); #endif - SAFE_FREE(tarbuf); - close(tarhandle); - break; - case 'r': - case 'c': - if (clipn && tar_excl) { - int i; - pstring tarmac; - - for (i=0; i= inclusion_buffer_size) { - char *ib; - inclusion_buffer_size *= 2; - ib = Realloc(inclusion_buffer,inclusion_buffer_size); - if (! ib) { - DEBUG(0,("failure enlarging inclusion buffer to %d bytes\n", - inclusion_buffer_size)); - error = 1; - break; - } - else inclusion_buffer = ib; - } + if ((strlen(buf) + 1 + inclusion_buffer_sofar) >= inclusion_buffer_size) { + char *ib; + inclusion_buffer_size *= 2; + ib = Realloc(inclusion_buffer,inclusion_buffer_size); + if (! ib) { + DEBUG(0,("failure enlarging inclusion buffer to %d bytes\n", + inclusion_buffer_size)); + error = 1; + break; + } else { + inclusion_buffer = ib; + } + } - safe_strcpy(inclusion_buffer + inclusion_buffer_sofar, buf, inclusion_buffer_size - inclusion_buffer_sofar); - inclusion_buffer_sofar += strlen(buf) + 1; - clipn++; - } - x_fclose(inclusion); - - if (! error) { - /* Allocate an array of clipn + 1 char*'s for cliplist */ - cliplist = malloc((clipn + 1) * sizeof(char *)); - if (cliplist == NULL) { - DEBUG(0,("failure allocating memory for cliplist\n")); - error = 1; - } else { - cliplist[clipn] = NULL; - p = inclusion_buffer; - for (i = 0; (! error) && (i < clipn); i++) { - /* set current item to NULL so array will be null-terminated even if - * malloc fails below. */ - cliplist[i] = NULL; - if ((tmpstr = (char *)malloc(strlen(p)+1)) == NULL) { - DEBUG(0, ("Could not allocate space for a cliplist item, # %i\n", i)); - error = 1; - } else { - unfixtarname(tmpstr, p, strlen(p) + 1, True); - cliplist[i] = tmpstr; - if ((p = strchr_m(p, '\000')) == NULL) { - DEBUG(0,("INTERNAL ERROR: inclusion_buffer is of unexpected contents.\n")); - abort(); - } + safe_strcpy(inclusion_buffer + inclusion_buffer_sofar, buf, inclusion_buffer_size - inclusion_buffer_sofar); + inclusion_buffer_sofar += strlen(buf) + 1; + clipn++; + } + x_fclose(inclusion); + + if (! error) { + /* Allocate an array of clipn + 1 char*'s for cliplist */ + cliplist = malloc((clipn + 1) * sizeof(char *)); + if (cliplist == NULL) { + DEBUG(0,("failure allocating memory for cliplist\n")); + error = 1; + } else { + cliplist[clipn] = NULL; + p = inclusion_buffer; + for (i = 0; (! error) && (i < clipn); i++) { + /* set current item to NULL so array will be null-terminated even if + * malloc fails below. */ + cliplist[i] = NULL; + if ((tmpstr = (char *)malloc(strlen(p)+1)) == NULL) { + DEBUG(0, ("Could not allocate space for a cliplist item, # %i\n", i)); + error = 1; + } else { + unfixtarname(tmpstr, p, strlen(p) + 1, True); + cliplist[i] = tmpstr; + if ((p = strchr_m(p, '\000')) == NULL) { + DEBUG(0,("INTERNAL ERROR: inclusion_buffer is of unexpected contents.\n")); + abort(); + } + } + ++p; + } + must_free_cliplist = True; + } + } + + SAFE_FREE(inclusion_buffer); + if (error) { + if (cliplist) { + char **pp; + /* We know cliplist is always null-terminated */ + for (pp = cliplist; *pp; ++pp) { + SAFE_FREE(*pp); + } + SAFE_FREE(cliplist); + cliplist = NULL; + must_free_cliplist = False; + } + return 0; } - ++p; - } - must_free_cliplist = True; - } - } - - SAFE_FREE(inclusion_buffer); - if (error) { - if (cliplist) { - char **pp; - /* We know cliplist is always null-terminated */ - for (pp = cliplist; *pp; ++pp) { - SAFE_FREE(*pp); - } - SAFE_FREE(cliplist); - cliplist = NULL; - must_free_cliplist = False; - } - return 0; - } - /* cliplist and its elements are freed at the end of process_tar. */ - return 1; + /* cliplist and its elements are freed at the end of process_tar. */ + return 1; } /**************************************************************************** Parse tar arguments. Sets tar_type, tar_excl, etc. ***************************************************************************/ + int tar_parseargs(int argc, char *argv[], char *Optarg, int Optind) { - char tar_clipfl='\0'; - - /* Reset back to defaults - could be from interactive version - * reset mode and archive mode left as they are though - */ - tar_type='\0'; - tar_excl=True; - dry_run=False; - - while (*Optarg) - switch(*Optarg++) { - case 'c': - tar_type='c'; - break; - case 'x': - if (tar_type=='c') { - printf("Tar must be followed by only one of c or x.\n"); - return 0; - } - tar_type='x'; - break; - case 'b': - if (Optind>=argc || !(blocksize=atoi(argv[Optind]))) { - DEBUG(0,("Option b must be followed by valid blocksize\n")); - return 0; - } else { - Optind++; - } - break; - case 'g': - tar_inc=True; - break; - case 'N': - if (Optind>=argc) { - DEBUG(0,("Option N must be followed by valid file name\n")); - return 0; - } else { - SMB_STRUCT_STAT stbuf; - extern time_t newer_than; + int newOptind = Optind; + char tar_clipfl='\0'; + + /* Reset back to defaults - could be from interactive version + * reset mode and archive mode left as they are though + */ + tar_type='\0'; + tar_excl=True; + dry_run=False; + + while (*Optarg) { + switch(*Optarg++) { + case 'c': + tar_type='c'; + break; + case 'x': + if (tar_type=='c') { + printf("Tar must be followed by only one of c or x.\n"); + return 0; + } + tar_type='x'; + break; + case 'b': + if (Optind>=argc || !(blocksize=atoi(argv[Optind]))) { + DEBUG(0,("Option b must be followed by valid blocksize\n")); + return 0; + } else { + Optind++; + newOptind++; + } + break; + case 'g': + tar_inc=True; + break; + case 'N': + if (Optind>=argc) { + DEBUG(0,("Option N must be followed by valid file name\n")); + return 0; + } else { + SMB_STRUCT_STAT stbuf; + extern time_t newer_than; - if (sys_stat(argv[Optind], &stbuf) == 0) { - newer_than = stbuf.st_mtime; - DEBUG(1,("Getting files newer than %s", - asctime(LocalTime(&newer_than)))); - Optind++; - } else { - DEBUG(0,("Error setting newer-than time\n")); - return 0; + if (sys_stat(argv[Optind], &stbuf) == 0) { + newer_than = stbuf.st_mtime; + DEBUG(1,("Getting files newer than %s", + asctime(LocalTime(&newer_than)))); + newOptind++; + Optind++; + } else { + DEBUG(0,("Error setting newer-than time\n")); + return 0; + } + } + break; + case 'a': + tar_reset=True; + break; + case 'q': + tar_noisy=False; + break; + case 'I': + if (tar_clipfl) { + DEBUG(0,("Only one of I,X,F must be specified\n")); + return 0; + } + tar_clipfl='I'; + break; + case 'X': + if (tar_clipfl) { + DEBUG(0,("Only one of I,X,F must be specified\n")); + return 0; + } + tar_clipfl='X'; + break; + case 'F': + if (tar_clipfl) { + DEBUG(0,("Only one of I,X,F must be specified\n")); + return 0; + } + tar_clipfl='F'; + break; + case 'r': + DEBUG(0, ("tar_re_search set\n")); + tar_re_search = True; + break; + case 'n': + if (tar_type == 'c') { + DEBUG(0, ("dry_run set\n")); + dry_run = True; + } else { + DEBUG(0, ("n is only meaningful when creating a tar-file\n")); + return 0; + } + break; + default: + DEBUG(0,("Unknown tar option\n")); + return 0; + } } - } - break; - case 'a': - tar_reset=True; - break; - case 'q': - tar_noisy=False; - break; - case 'I': - if (tar_clipfl) { - DEBUG(0,("Only one of I,X,F must be specified\n")); - return 0; - } - tar_clipfl='I'; - break; - case 'X': - if (tar_clipfl) { - DEBUG(0,("Only one of I,X,F must be specified\n")); - return 0; - } - tar_clipfl='X'; - break; - case 'F': - if (tar_clipfl) { - DEBUG(0,("Only one of I,X,F must be specified\n")); - return 0; - } - tar_clipfl='F'; - break; - case 'r': - DEBUG(0, ("tar_re_search set\n")); - tar_re_search = True; - break; - case 'n': - if (tar_type == 'c') { - DEBUG(0, ("dry_run set\n")); - dry_run = True; - } else { - DEBUG(0, ("n is only meaningful when creating a tar-file\n")); - return 0; - } - break; - default: - DEBUG(0,("Unknown tar option\n")); - return 0; - } - - if (!tar_type) { - printf("Option T must be followed by one of c or x.\n"); - return 0; - } - - /* tar_excl is true if cliplist lists files to be included. - * Both 'I' and 'F' mean include. */ - tar_excl=tar_clipfl!='X'; - - if (tar_clipfl=='F') { - if (argc-Optind-1 != 1) { - DEBUG(0,("Option F must be followed by exactly one filename.\n")); - return 0; - } - if (! read_inclusion_file(argv[Optind+1])) { - return 0; - } - } else if (Optind+1=argc || !strcmp(argv[Optind], "-")) { - /* Sets tar handle to either 0 or 1, as appropriate */ - tarhandle=(tar_type=='c'); - /* - * Make sure that dbf points to stderr if we are using stdout for - * tar output - */ - if (tarhandle == 1) - dbf = x_stderr; - } else { - if (tar_type=='c' && (dry_run || strcmp(argv[Optind], "/dev/null")==0)) - { - if (!dry_run) { - DEBUG(0,("Output is /dev/null, assuming dry_run\n")); - dry_run = True; + clipn=argc-Optind-1; + cliplist=argv+Optind+1; + newOptind += clipn; + } + + if (Optind>=argc || !strcmp(argv[Optind], "-")) { + /* Sets tar handle to either 0 or 1, as appropriate */ + tarhandle=(tar_type=='c'); + /* + * Make sure that dbf points to stderr if we are using stdout for + * tar output + */ + if (tarhandle == 1) { + dbf = x_stderr; + } + if (!strcmp(argv[Optind], "-")) { + newOptind++; + } + + } else { + if (tar_type=='c' && (dry_run || strcmp(argv[Optind], "/dev/null")==0)) { + if (!dry_run) { + DEBUG(0,("Output is /dev/null, assuming dry_run\n")); + dry_run = True; + } + tarhandle=-1; + } else if ((tar_type=='x' && (tarhandle = sys_open(argv[Optind], O_RDONLY, 0)) == -1) + || (tar_type=='c' && (tarhandle=sys_creat(argv[Optind], 0644)) < 0)) { + DEBUG(0,("Error opening local file %s - %s\n", argv[Optind], strerror(errno))); + return(0); + } + newOptind++; } - tarhandle=-1; - } else - if ((tar_type=='x' && (tarhandle = sys_open(argv[Optind], O_RDONLY, 0)) == -1) - || (tar_type=='c' && (tarhandle=sys_creat(argv[Optind], 0644)) < 0)) - { - DEBUG(0,("Error opening local file %s - %s\n", - argv[Optind], strerror(errno))); - return(0); - } - } - return 1; + return newOptind; } diff --git a/source3/client/smbspool.c b/source3/client/smbspool.c index 68165792da..5daefec5a5 100644 --- a/source3/client/smbspool.c +++ b/source3/client/smbspool.c @@ -282,7 +282,7 @@ smb_connect(const char *workgroup, /* I - Workgroup */ get_myname(myname); nt_status = cli_full_connection(&c, myname, server, NULL, 0, share, "?????", - username, workgroup, password, 0, NULL); + username, workgroup, password, 0, Undefined, NULL); if (!NT_STATUS_IS_OK(nt_status)) { fprintf(stderr, "ERROR: Connection failed with error %s\n", nt_errstr(nt_status)); diff --git a/source3/client/tree.c b/source3/client/tree.c index 3b90d15f65..97ad7742e3 100644 --- a/source3/client/tree.c +++ b/source3/client/tree.c @@ -69,7 +69,7 @@ static void tree_error_message(gchar *message) { * workgroup type and return a path from there */ -static char path_string[1024]; +static pstring path_string; char *get_path(GtkWidget *item) { @@ -112,7 +112,7 @@ char *get_path(GtkWidget *item) * Now, build the path */ - snprintf(path_string, sizeof(path_string), "smb:/"); + pstrcpy( path_string, "smb:/" ); for (j = i - 1; j >= 0; j--) { @@ -151,7 +151,7 @@ static void cb_select_child (GtkWidget *root_tree, GtkWidget *child, char dirbuf[512]; struct smbc_dirent *dirp; struct stat st1; - char path[1024], path1[1024]; + pstring path, path1; g_print ("select_child called for root tree %p, subtree %p, child %p\n", root_tree, subtree, child); diff --git a/source3/configure.in b/source3/configure.in index fd7ee9fc30..f964bc719f 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -152,12 +152,10 @@ AC_SUBST(LIBSMBCLIENT) AC_SUBST(PRINTLIBS) AC_SUBST(AUTHLIBS) AC_SUBST(ACLLIBS) -AC_SUBST(ADSLIBS) AC_SUBST(PASSDBLIBS) AC_SUBST(IDMAP_LIBS) AC_SUBST(KRB5_LIBS) AC_SUBST(LDAP_LIBS) -AC_SUBST(LDAP_OBJ) AC_SUBST(SHLIB_PROGS) AC_SUBST(SMBWRAPPER) AC_SUBST(EXTRA_BIN_PROGS) @@ -289,7 +287,7 @@ dnl These have to be built static: default_static_modules="pdb_smbpasswd pdb_tdbsam rpc_lsa rpc_samr rpc_reg rpc_wks rpc_net rpc_dfs rpc_srv rpc_spoolss auth_rhosts auth_sam auth_unix auth_winbind auth_server auth_domain auth_builtin" dnl These are preferably build shared, and static if dlopen() is not available -default_shared_modules="vfs_recycle vfs_audit vfs_extd_audit vfs_netatalk vfs_fake_perms" +default_shared_modules="vfs_recycle vfs_audit vfs_extd_audit vfs_netatalk vfs_fake_perms vfs_default_quota" if test "x$developer" = xyes; then default_static_modules="$default_static_modules rpc_echo" @@ -552,7 +550,7 @@ AC_CHECK_HEADERS(shadow.h netinet/ip.h netinet/tcp.h netinet/in_systm.h netinet/ AC_CHECK_HEADERS(nss.h nss_common.h ns_api.h sys/security.h security/pam_appl.h security/pam_modules.h) AC_CHECK_HEADERS(stropts.h poll.h) AC_CHECK_HEADERS(sys/capability.h syscall.h sys/syscall.h) -AC_CHECK_HEADERS(sys/acl.h attr/xattr.h sys/cdefs.h glob.h) +AC_CHECK_HEADERS(sys/acl.h sys/attributes.h attr/xattr.h sys/cdefs.h glob.h) # For experimental utmp support (lastlog on some BSD-like systems) AC_CHECK_HEADERS(utmp.h utmpx.h lastlog.h) @@ -843,7 +841,7 @@ AC_CHECK_FUNCS(setpriv setgidx setuidx setgroups sysconf mktime rename ftruncate AC_CHECK_FUNCS(lstat64 fopen64 atexit grantpt dup2 lseek64 ftruncate64 readdir64) AC_CHECK_FUNCS(fseek64 fseeko64 ftell64 ftello64 setluid getpwanam setlinebuf) AC_CHECK_FUNCS(srandom random srand rand setenv usleep strcasecmp fcvt fcvtl symlink readlink) -AC_CHECK_FUNCS(syslog vsyslog getgrouplist timegm) +AC_CHECK_FUNCS(syslog vsyslog timegm) AC_CHECK_FUNCS(setlocale nl_langinfo) # setbuffer, shmget, shm_open are needed for smbtorture AC_CHECK_FUNCS(setbuffer shmget shm_open backtrace_symbols) @@ -866,6 +864,38 @@ AC_CHECK_FUNCS(pread _pread __pread pread64 _pread64 __pread64) AC_CHECK_FUNCS(pwrite _pwrite __pwrite pwrite64 _pwrite64 __pwrite64) AC_CHECK_FUNCS(open64 _open64 __open64 creat64) +# +# +# +case "$host_os" in + *linux*) + # glibc <= 2.3.2 has a broken getgrouplist + AC_TRY_RUN([ +#include +#include +main() { + /* glibc up to 2.3 has a broken getgrouplist */ +#if defined(__GLIBC__) && defined(__GLIBC_MINOR__) + int libc_major = __GLIBC__; + int libc_minor = __GLIBC_MINOR__; + + if (libc_major < 2) + exit(1); + if ((libc_major == 2) && (libc_minor <= 3)) + exit(1); +#endif + exit(0); +} +], [linux_getgrouplist_ok=yes], [linux_getgrouplist_ok=no]) + if test x"$linux_getgrouplist_ok" = x"yes"; then + AC_DEFINE(HAVE_GETGROUPLIST, 1, [Have good getgrouplist]) + fi + ;; + *) + AC_CHECK_FUNCS(getgrouplist) + ;; +esac + # # stat64 family may need on some systems, notably ReliantUNIX # @@ -946,6 +976,8 @@ AC_SEARCH_LIBS(getxattr, [attr]) AC_CHECK_FUNCS(getxattr lgetxattr fgetxattr listxattr llistxattr) AC_CHECK_FUNCS(flistxattr removexattr lremovexattr fremovexattr) AC_CHECK_FUNCS(setxattr lsetxattr fsetxattr) +AC_CHECK_FUNCS(attr_get attr_list attr_set attr_remove) +AC_CHECK_FUNCS(attr_getf attr_listf attr_setf attr_removef) # Assume non-shared by default and override below BLDSHARED="false" @@ -2095,14 +2127,105 @@ AC_ARG_WITH(dfs, AC_MSG_RESULT(no) ) +######################################################## +# Compile with LDAP support? + +with_ldap_support=auto +AC_MSG_CHECKING([for LDAP support]) + +AC_ARG_WITH(ldap, +[ --with-ldap LDAP support (default yes)], +[ case "$withval" in + yes|no) + with_ldap_support=$withval + ;; + esac ]) + +AC_MSG_RESULT($with_ldap_support) + +SMBLDAP="" +AC_SUBST(SMBLDAP) +if test x"$with_ldap_support" != x"no"; then + + ################################################################## + # first test for ldap.h and lber.h + # (ldap.h is required for this test) + AC_CHECK_HEADERS(ldap.h lber.h) + + if test x"$ac_cv_header_ldap_h" != x"yes"; then + if test x"$with_ldap_support" = x"yes"; then + AC_MSG_ERROR(ldap.h is needed for LDAP support) + else + AC_MSG_WARN(ldap.h is needed for LDAP support) + fi + + with_ldap_support=no + fi +fi + +if test x"$with_ldap_support" != x"no"; then + ac_save_LIBS=$LIBS + + ################################################################## + # we might need the lber lib on some systems. To avoid link errors + # this test must be before the libldap test + AC_CHECK_LIB_EXT(lber, LDAP_LIBS, ber_scanf) + + ######################################################## + # now see if we can find the ldap libs in standard paths + AC_CHECK_LIB_EXT(ldap, LDAP_LIBS, ldap_init) + + AC_CHECK_FUNC_EXT(ldap_domain2hostlist,$LDAP_LIBS) + + ######################################################## + # If we have LDAP, does it's rebind procedure take 2 or 3 arguments? + # Check found in pam_ldap 145. + AC_CHECK_FUNC_EXT(ldap_set_rebind_proc,$LDAP_LIBS) + + LIBS="$LIBS $LDAP_LIBS" + AC_CACHE_CHECK(whether ldap_set_rebind_proc takes 3 arguments, smb_ldap_cv_ldap_set_rebind_proc, [ + AC_TRY_COMPILE([ + #include + #include ], + [ldap_set_rebind_proc(0, 0, 0);], + [smb_ldap_cv_ldap_set_rebind_proc=3], + [smb_ldap_cv_ldap_set_rebind_proc=2] + ) + ]) + + AC_DEFINE_UNQUOTED(LDAP_SET_REBIND_PROC_ARGS, $smb_ldap_cv_ldap_set_rebind_proc, [Number of arguments to ldap_set_rebind_proc]) + + AC_CHECK_FUNC_EXT(ldap_initialize,$LDAP_LIBS) + + if test x"$ac_cv_lib_ext_ldap_ldap_init" = x"yes" -a x"$ac_cv_func_ext_ldap_domain2hostlist" = x"yes"; then + AC_DEFINE(HAVE_LDAP,1,[Whether ldap is available]) + default_static_modules="$default_static_modules pdb_ldap idmap_ldap"; + SMBLDAP="lib/smbldap.o" + with_ldap_support=yes + AC_MSG_CHECKING(whether LDAP support is used) + AC_MSG_RESULT(yes) + else + if test x"$with_ldap_support" = x"yes"; then + AC_MSG_ERROR(libldap is needed for LDAP support) + else + AC_MSG_WARN(libldap is needed for LDAP support) + fi + + LDAP_LIBS="" + with_ldap_support=no + fi + LIBS=$ac_save_LIBS +fi + + ################################################# # active directory support with_ads_support=auto -AC_MSG_CHECKING([whether to use Active Directory]) +AC_MSG_CHECKING([for Active Directory and krb5 support]) AC_ARG_WITH(ads, -[ --with-ads Active Directory support (default yes)], +[ --with-ads Active Directory support (default auto)], [ case "$withval" in yes|no) with_ads_support="$withval" @@ -2114,22 +2237,34 @@ AC_MSG_RESULT($with_ads_support) FOUND_KRB5=no KRB5_LIBS="" +if test x"$with_ldap_support" != x"yes"; then + if test x"$with_ads_support" = x"yes"; then + AC_MSG_ERROR(Active Directory Support requires LDAP support) + elif test x"$with_ads_support" != x"no"; then + AC_MSG_WARN(Active Directory Support requires LDAP support) + fi + with_ads_support=no +fi + if test x"$with_ads_support" != x"no"; then # Do no harm to the values of CFLAGS and LIBS while testing for # Kerberos support. - ac_save_CFLAGS="$CFLAGS" - ac_save_LIBS="$LIBS" - ################################################# # check for krb5-config from recent MIT and Heimdal kerberos 5 AC_PATH_PROG(KRB5_CONFIG, krb5-config) AC_MSG_CHECKING(for working krb5-config) if test -x "$KRB5_CONFIG"; then - LIBS="$LIBS `$KRB5_CONFIG --libs`" - CFLAGS="$CFLAGS `$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" - CPPFLAGS="$CPPFLAGS `$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" + ac_save_CFLAGS=$CFLAGS + CFLAGS="";export CFLAGS + ac_save_LDFLAGS=$LDFLAGS + LDFLAGS="";export LDFLAGS + KRB5_LIBS="`$KRB5_CONFIG --libs gssapi`" + KRB5_CFLAGS="`$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" + KRB5_CPPFLAGS="`$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" + CFLAGS=$ac_save_CFLAGS;export CFLAGS + LDFLAGS=$ac_save_LDFLAGS;export LDFLAGS FOUND_KRB5=yes AC_MSG_RESULT(yes) else @@ -2144,18 +2279,21 @@ if test x"$with_ads_support" != x"no"; then [ --with-krb5=base-dir Locate Kerberos 5 support (default=/usr)], [ case "$withval" in no) - AC_MSG_RESULT(no) + AC_MSG_RESULT(no krb5-path given) + ;; + yes) + AC_MSG_RESULT(/usr) + FOUND_KRB5=yes ;; *) - AC_MSG_RESULT(yes) - LIBS="$LIBS -lkrb5" - CFLAGS="$CFLAGS -I$withval/include" - CPPFLAGS="$CPPFLAGS -I$withval/include" - LDFLAGS="$LDFLAGS -L$withval/lib" + AC_MSG_RESULT($withval) + KRB5_CFLAGS="-I$withval/include" + KRB5_CPPFLAGS="-I$withval/include" + KRB5_LDFLAGS="-L$withval/lib" FOUND_KRB5=yes ;; esac ], - AC_MSG_RESULT(no) + AC_MSG_RESULT(no krb5-path given) ) fi @@ -2165,15 +2303,13 @@ if test x"$with_ads_support" != x"no"; then AC_MSG_CHECKING(for /usr/include/heimdal) if test -d /usr/include/heimdal; then if test -f /usr/lib/heimdal/lib/libkrb5.a; then - LIBS="$LIBS -lkrb5" - CFLAGS="$CFLAGS -I/usr/include/heimdal" - CPPFLAGS="$CPPFLAGS -I/usr/include/heimdal" - LDFLAGS="$LDFLAGS -L/usr/lib/heimdal/lib" + KRB5_CFLAGS="-I/usr/include/heimdal" + KRB5_CPPFLAGS="-I/usr/include/heimdal" + KRB5_LDFLAGS="-L/usr/lib/heimdal/lib" AC_MSG_RESULT(yes) else - LIBS="$LIBS -lkrb5" - CFLAGS="$CFLAGS -I/usr/include/heimdal" - CPPFLAGS="$CPPFLAGS -I/usr/include/heimdal" + KRB5_CFLAGS="-I/usr/include/heimdal" + KRB5_CPPFLAGS="-I/usr/include/heimdal" AC_MSG_RESULT(yes) fi else @@ -2186,16 +2322,25 @@ if test x"$with_ads_support" != x"no"; then # see if this box has the RedHat location for kerberos AC_MSG_CHECKING(for /usr/kerberos) if test -d /usr/kerberos -a -f /usr/kerberos/lib/libkrb5.a; then - LIBS="$LIBS -lkrb5" - LDFLAGS="$LDFLAGS -L/usr/kerberos/lib" - CFLAGS="$CFLAGS -I/usr/kerberos/include" - CPPFLAGS="$CPPFLAGS -I/usr/kerberos/include" + KRB5_LDFLAGS="-L/usr/kerberos/lib" + KRB5_CFLAGS="-I/usr/kerberos/include" + KRB5_CPPFLAGS="-I/usr/kerberos/include" AC_MSG_RESULT(yes) else AC_MSG_RESULT(no) fi fi + ac_save_CFLAGS=$CFLAGS + ac_save_CPPFLAGS=$CPPFLAGS + ac_save_LDFLAGS=$LDFLAGS + + CFLAGS="$CFLAGS $KRB5_CFLAGS" + CPPFLAGS="$CPPFLAGS $KRB5_CPPFLAGS" + LDFLAGS="$LDFLAGS $KRB5_LDFLAGS" + + KRB5_LIBS="$KRB5_LDFLAGS $KRB5_LIBS" + # now check for krb5.h. Some systems have the libraries without the headers! # note that this check is done here to allow for different kerberos # include paths @@ -2215,24 +2360,17 @@ if test x"$with_ads_support" != x"no"; then # Turn off AD support and restore CFLAGS and LIBS variables with_ads_support="no" - - CFLAGS="$ac_save_CFLAGS" - LIBS="$ac_save_LIBS" - - else - - # Get rid of case where $with_ads_support=auto - - with_ads_support="yes" - + + CFLAGS=$ac_save_CFLAGS + CPPFLAGS=$ac_save_CPPFLAGS + LDFLAGS=$ac_save_LDFLAGS fi fi # Now we have determined whether we really want ADS support -if test x"$with_ads_support" = x"yes"; then - - AC_DEFINE(WITH_ADS,1,[Whether to include Active Directory support]) +if test x"$with_ads_support" != x"no"; then + ac_save_LIBS=$LIBS # now check for gssapi headers. This is also done here to allow for # different kerberos include paths @@ -2240,62 +2378,46 @@ if test x"$with_ads_support" = x"yes"; then ################################################################## # we might need the k5crypto and com_err libraries on some systems - AC_CHECK_LIB(com_err, _et_list) - AC_CHECK_LIB(k5crypto, krb5_encrypt_data) + AC_CHECK_LIB_EXT(com_err, KRB5_LIBS, _et_list) + AC_CHECK_LIB_EXT(k5crypto, KRB5_LIBS, krb5_encrypt_data) # Heimdal checks. - AC_CHECK_LIB(crypto, des_set_key) - AC_CHECK_LIB(asn1, copy_Authenticator) - AC_CHECK_LIB(roken, roken_getaddrinfo_hostspec) + AC_CHECK_LIB_EXT(crypto, KRB5_LIBS, des_set_key) + AC_CHECK_LIB_EXT(asn1, KRB5_LIBS, copy_Authenticator) + AC_CHECK_LIB_EXT(roken, KRB5_LIBS, roken_getaddrinfo_hostspec) # Heimdal checks. On static Heimdal gssapi must be linked before krb5. - AC_CHECK_LIB(gssapi, gss_display_status, [LIBS="$LIBS -lgssapi -lkrb5"; - AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) - - AC_CHECK_LIB(krb5, krb5_set_real_time, - [AC_DEFINE(HAVE_KRB5_SET_REAL_TIME,1, - [Whether krb5_set_real_time is available])]) - AC_CHECK_LIB(krb5, krb5_set_default_in_tkt_etypes, - [AC_DEFINE(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES,1, - [Whether krb5_set_default_in_tkt_etypes, is available])]) - AC_CHECK_LIB(krb5, krb5_set_default_tgs_ktypes, - [AC_DEFINE(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES,1, - [Whether krb5_set_default_tgs_ktypes is available])]) - - AC_CHECK_LIB(krb5, krb5_principal2salt, - [AC_DEFINE(HAVE_KRB5_PRINCIPAL2SALT,1, - [Whether krb5_principal2salt is available])]) - AC_CHECK_LIB(krb5, krb5_use_enctype, - [AC_DEFINE(HAVE_KRB5_USE_ENCTYPE,1, - [Whether krb5_use_enctype is available])]) - AC_CHECK_LIB(krb5, krb5_string_to_key, - [AC_DEFINE(HAVE_KRB5_STRING_TO_KEY,1, - [Whether krb5_string_to_key is available])]) - AC_CHECK_LIB(krb5, krb5_get_pw_salt, - [AC_DEFINE(HAVE_KRB5_GET_PW_SALT,1, - [Whether krb5_get_pw_salt is available])]) - AC_CHECK_LIB(krb5, krb5_string_to_key_salt, - [AC_DEFINE(HAVE_KRB5_STRING_TO_KEY_SALT,1, - [Whether krb5_string_to_key_salt is available])]) - AC_CHECK_LIB(krb5, krb5_auth_con_setkey, - [AC_DEFINE(HAVE_KRB5_AUTH_CON_SETKEY,1, - [Whether krb5_auth_con_setkey is available])]) - AC_CHECK_LIB(krb5, krb5_auth_con_setuseruserkey, - [AC_DEFINE(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY,1, - [Whether krb5_auth_con_setuseruserkey is available])]) - AC_CHECK_LIB(krb5, krb5_locate_kdc, - [AC_DEFINE(HAVE_KRB5_LOCATE_KDC,1, - [Whether krb5_locate_kdc is available])]) - AC_CHECK_LIB(krb5, krb5_get_permitted_enctypes, - [AC_DEFINE(HAVE_KRB5_GET_PERMITTED_ENCTYPES,1, - [Whether krb5_get_permitted_enctypes is available])]) - AC_CHECK_LIB(krb5, krb5_get_default_in_tkt_etypes, - [AC_DEFINE(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES,1, - [Whether krb5_get_default_in_tkt_etypes is available])]) - AC_CHECK_LIB(krb5, krb5_free_ktypes, - [AC_DEFINE(HAVE_KRB5_FREE_KTYPES,1, - [Whether krb5_free_ktypes is available])]) + AC_CHECK_LIB_EXT(gssapi, KRB5_LIBS, gss_display_status,[],[], + AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])) + ######################################################## + # now see if we can find the krb5 libs in standard paths + # or as specified above + AC_CHECK_LIB_EXT(krb5, KRB5_LIBS, krb5_mk_req_extended) + + ######################################################## + # now see if we can find the gssapi libs in standard paths + AC_CHECK_LIB_EXT(gssapi_krb5, KRB5_LIBS,gss_display_status,[],[], + AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])) + + AC_CHECK_FUNC_EXT(krb5_set_real_time, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_set_default_in_tkt_etypes, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_set_default_tgs_ktypes, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_principal2salt, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_use_enctype, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_string_to_key, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_get_pw_salt, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_string_to_key_salt, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_auth_con_setkey, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_auth_con_setuseruserkey, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_locate_kdc, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_get_permitted_enctypes, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_get_default_in_tkt_etypes, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_free_ktypes, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_principal_get_comp_string, $KRB5_LIBS) + + LIBS="$LIBS $KRB5_LIBS" + AC_CACHE_CHECK([for addrtype in krb5_address], samba_cv_HAVE_ADDRTYPE_IN_KRB5_ADDRESS,[ AC_TRY_COMPILE([#include ], @@ -2355,87 +2477,34 @@ if test x"$with_ads_support" = x"yes"; then [Whether the ENCTYPE_ARCFOUR_HMAC_MD5 key type is available]) fi - ######################################################## - # now see if we can find the krb5 libs in standard paths - # or as specified above - AC_CHECK_LIB(krb5, krb5_mk_req_extended, [KRB5_LIBS="$LIBS -lkrb5"; - KRB5_CFLAGS="$CFLAGS"; - AC_DEFINE(HAVE_KRB5,1,[Whether KRB5 is available])]) + AC_CACHE_CHECK([for the krb5_princ_component macro], + samba_cv_HAVE_KRB5_PRINC_COMPONENT,[ + AC_TRY_LINK([#include ], + [const krb5_data *pkdata; krb5_context context; krb5_principal principal; pkdata = krb5_princ_component(context, principal, 0);], + samba_cv_HAVE_KRB5_PRINC_COMPONENT=yes, + samba_cv_HAVE_KRB5_PRINC_COMPONENT=no)]) - ######################################################## - # now see if we can find the gssapi libs in standard paths - AC_CHECK_LIB(gssapi_krb5, gss_display_status, - [KRB5_LIBS="$KRB5_LIBS -lgssapi_krb5"; - AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) - - CFLAGS="$ac_save_CFLAGS" - LIBS="$ac_save_LIBS" -fi - -######################################################## -# Compile with LDAP support? - -LDAP_OBJ="" -with_ldap_support=yes -AC_MSG_CHECKING([whether to use LDAP]) - -AC_ARG_WITH(ldap, -[ --with-ldap LDAP support (default yes)], -[ case "$withval" in - no) - with_ldap_support=no - ;; - esac ]) - -AC_MSG_RESULT($with_ldap_support) + if test x"$samba_cv_HAVE_KRB5_PRINC_COMPONENT" = x"yes"; then + AC_DEFINE(HAVE_KRB5_PRINC_COMPONENT,1, + [Whether krb5_princ_component is available]) + fi -SMBLDAP="" -if test x"$with_ldap_support" = x"yes"; then - ac_save_LIBS="$LIBS" - LIBS="" - ################################################################## - # we might need the lber lib on some systems. To avoid link errors - # this test must be before the libldap test - AC_CHECK_LIB(lber, ber_scanf) - - ######################################################## - # now see if we can find the ldap libs in standard paths - if test x$have_ldap != xyes; then - AC_CHECK_LIB(ldap, ldap_init, [ - LIBS="$LIBS -lldap"; - AC_CHECK_LIB(ldap, ldap_domain2hostlist, [ - AC_DEFINE(HAVE_LDAP,1,[Whether ldap is available]) - AC_CHECK_HEADERS([ldap.h lber.h], - [default_static_modules="$default_static_modules pdb_ldap idmap_ldap"; - SMBLDAP="lib/smbldap.o"]) - ]) - ]) - - ######################################################## - # If we have LDAP, does it's rebind procedure take 2 or 3 arguments? - # Check found in pam_ldap 145. - AC_CHECK_FUNCS(ldap_set_rebind_proc) - AC_CACHE_CHECK(whether ldap_set_rebind_proc takes 3 arguments, pam_ldap_cv_ldap_set_rebind_proc, [ - AC_TRY_COMPILE([ - #include - #include ], [ldap_set_rebind_proc(0, 0, 0);], [pam_ldap_cv_ldap_set_rebind_proc=3], [pam_ldap_cv_ldap_set_rebind_proc=2]) ]) - AC_DEFINE_UNQUOTED(LDAP_SET_REBIND_PROC_ARGS, $pam_ldap_cv_ldap_set_rebind_proc, [Number of arguments to ldap_set_rebind_proc]) - AC_CHECK_FUNCS(ldap_initialize) - fi - - AC_SUBST(SMBLDAP) - LDAP_LIBS="$LIBS"; - LIBS="$ac_save_LIBS"; -else - # Can't have ADS support without LDAP + if test x"$ac_cv_lib_ext_krb5_krb5_mk_req_extended" = x"yes"; then + AC_DEFINE(HAVE_KRB5,1,[Whether to have KRB5 support]) + AC_DEFINE(WITH_ADS,1,[Whether to include Active Directory support]) + AC_MSG_CHECKING(whether Active Directory and krb5 support is used) + AC_MSG_RESULT(yes) + else if test x"$with_ads_support" = x"yes"; then - AC_MSG_ERROR(Active directory support requires LDAP) + AC_MSG_ERROR(libkrb5 is needed for Active Directory support) + else + AC_MSG_WARN(libkrb5 is needed for Active Directory support) fi -fi - -if test x"$with_ads_support" = x"yes"; then - ADSLIBS="$LDAP_LIBS $KRB5_LIBS" + KRB5_LIBS="" + with_ads_support=no + fi + LIBS="$ac_save_LIBS" fi ######################################################## @@ -3641,7 +3710,7 @@ WINBIND_WINS_NSS="nsswitch/libnss_wins.$SHLIBEXT" WINBIND_NSS_LDSHFLAGS=$LDSHFLAGS case "$host_os" in - *linux*) + *linux*|*freebsd*) WINBIND_NSS_EXTRA_OBJS="nsswitch/winbind_nss_linux.o" ;; *irix*) @@ -3887,6 +3956,7 @@ SMB_MODULE(vfs_audit, \$(VFS_AUDIT_OBJ), "bin/audit.$SHLIBEXT", VFS) SMB_MODULE(vfs_extd_audit, \$(VFS_EXTD_AUDIT_OBJ), "bin/extd_audit.$SHLIBEXT", VFS) SMB_MODULE(vfs_netatalk, \$(VFS_NETATALK_OBJ), "bin/netatalk.$SHLIBEXT", VFS) SMB_MODULE(vfs_fake_perms, \$(VFS_FAKE_PERMS_OBJ), "bin/fake_perms.$SHLIBEXT", VFS) +SMB_MODULE(vfs_default_quota, \$(VFS_DEFAULT_QUOTA_OBJ), "bin/default_quota.$SHLIBEXT", VFS) SMB_SUBSYSTEM(VFS) AC_DEFINE_UNQUOTED(STRING_STATIC_MODULES, "$string_static_modules", [String list of builtin modules]) @@ -3903,10 +3973,10 @@ fi AC_MSG_RESULT([Using libraries:]) AC_MSG_RESULT([ LIBS = $LIBS]) -if test x"$with_ads_support" = x"yes"; then +if test x"$with_ads_support" != x"no"; then AC_MSG_RESULT([ KRB5_LIBS = $KRB5_LIBS]) fi -if test x"$with_ldap_support" = x"yes"; then +if test x"$with_ldap_support" != x"no"; then AC_MSG_RESULT([ LDAP_LIBS = $LDAP_LIBS]) fi diff --git a/source3/dynconfig.c b/source3/dynconfig.c index 4577c3947c..34c716926c 100644 --- a/source3/dynconfig.c +++ b/source3/dynconfig.c @@ -1,7 +1,7 @@ /* Unix SMB/CIFS implementation. Copyright (C) 2001 by Martin Pool - Copyright (C) 2003 by Anthony Liguori + Copyright (C) 2003 by Jim McDonough This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by diff --git a/source3/groupdb/mapping.c b/source3/groupdb/mapping.c index 3d2af5d0ba..cd903fa28b 100644 --- a/source3/groupdb/mapping.c +++ b/source3/groupdb/mapping.c @@ -509,7 +509,7 @@ BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map) return False; } - DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%d\n",map->gid)); + DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid)); if ( (grp=getgrgid(map->gid)) == NULL) { DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n")); diff --git a/source3/include/authdata.h b/source3/include/authdata.h index 0798b72bdf..9d80745fb0 100644 --- a/source3/include/authdata.h +++ b/source3/include/authdata.h @@ -1,7 +1,7 @@ /* Unix SMB/CIFS implementation. Kerberos authorization data - Copyright (C) Jim McDonough 2003 + Copyright (C) Jim McDonough 2003 This program is free software; you can redistribute it and/or modify diff --git a/source3/include/byteorder.h b/source3/include/byteorder.h index c262dd2d33..0eef557306 100644 --- a/source3/include/byteorder.h +++ b/source3/include/byteorder.h @@ -105,7 +105,7 @@ it also defines lots of intermediate macros, just ignore those :-) #define CAREFUL_ALIGNMENT 1 #endif -#define CVAL(buf,pos) (((const unsigned char *)(buf))[pos]) +#define CVAL(buf,pos) ((unsigned)(((const unsigned char *)(buf))[pos])) #define CVAL_NC(buf,pos) (((unsigned char *)(buf))[pos]) /* Non-const version of CVAL */ #define PVAL(buf,pos) (CVAL(buf,pos)) #define SCVAL(buf,pos,val) (CVAL_NC(buf,pos) = (val)) diff --git a/source3/include/charset.h b/source3/include/charset.h index c56984ca7b..f999a9cf72 100644 --- a/source3/include/charset.h +++ b/source3/include/charset.h @@ -24,9 +24,9 @@ typedef enum {CH_UCS2=0, CH_UNIX=1, CH_DISPLAY=2, CH_DOS=3, CH_UTF8=4} charset_t #define NUM_CHARSETS 5 -/* - * for each charset we have a function that pulls from that charset to - * a ucs2 buffer, and a function that pushes to a ucs2 buffer +/* + * for each charset we have a function that pushes from that charset to a ucs2 + * buffer, and a function that pulls from ucs2 buffer to that charset. * */ struct charset_functions { diff --git a/source3/include/client.h b/source3/include/client.h index fad2c099b9..598e6c0bda 100644 --- a/source3/include/client.h +++ b/source3/include/client.h @@ -57,18 +57,6 @@ struct print_job_info time_t t; }; -typedef struct smb_sign_info { - void (*sign_outgoing_message)(struct cli_state *cli); - BOOL (*check_incoming_message)(struct cli_state *cli); - void (*free_signing_context)(struct cli_state *cli); - void *signing_context; - - BOOL negotiated_smb_signing; - BOOL allow_smb_signing; - BOOL doing_signing; - BOOL mandatory_signing; -} smb_sign_info; - struct cli_state { int port; int fd; diff --git a/source3/include/dynconfig.h b/source3/include/dynconfig.h index ce256f0613..a74d77e41f 100644 --- a/source3/include/dynconfig.h +++ b/source3/include/dynconfig.h @@ -1,7 +1,7 @@ /* Unix SMB/CIFS implementation. Copyright (C) 2001 by Martin Pool - Copyright (C) 2003 by Anthony Liguori + Copyright (C) 2003 by Jim McDonough This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by diff --git a/source3/include/idmap.h b/source3/include/idmap.h index ae7e4e5101..20b1015285 100644 --- a/source3/include/idmap.h +++ b/source3/include/idmap.h @@ -5,7 +5,7 @@ Idmap headers - Copyright (C) Anthony Liguori 2003 + Copyright (C) Jim McDonough 2003 Copyright (C) Simo Sorce 2003 This library is free software; you can redistribute it and/or diff --git a/source3/include/includes.h b/source3/include/includes.h index edaeda3abe..eb7f73b9d3 100644 --- a/source3/include/includes.h +++ b/source3/include/includes.h @@ -835,6 +835,8 @@ extern int errno; #include "nsswitch/winbind_client.h" +#include "spnego.h" + /* * Type for wide character dirent structure. * Only d_name is defined by POSIX. @@ -1232,6 +1234,14 @@ int snprintf(char *,size_t ,const char *, ...) PRINTF_ATTRIBUTE(3,4); int asprintf(char **,const char *, ...) PRINTF_ATTRIBUTE(2,3); #endif +/* Fix prototype problem with non-C99 compliant snprintf implementations, esp + HPUX 11. Don't change the sense of this #if statement. Read the comments + in lib/snprint.c if you think you need to. See also bugzilla bug 174. */ + +#if !defined(HAVE_SNPRINTF) || !defined(HAVE_C99_VSNPRINTF) +#define snprintf smb_snprintf +#endif + void sys_adminlog(int priority, const char *format_str, ...) PRINTF_ATTRIBUTE(2,3); int pstr_sprintf(pstring s, const char *fmt, ...) PRINTF_ATTRIBUTE(2,3); @@ -1288,7 +1298,7 @@ krb5_const_principal get_principal_from_tkt(krb5_ticket *tkt); krb5_error_code krb5_locate_kdc(krb5_context ctx, const krb5_data *realm, struct sockaddr **addr_pp, int *naddrs, int get_masters); krb5_error_code get_kerberos_allowed_etypes(krb5_context context, krb5_enctype **enctypes); void free_kerberos_etypes(krb5_context context, krb5_enctype *enctypes); -BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, uint8 session_key[16]); +BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, uint8 session_key[16], BOOL remote); #endif /* HAVE_KRB5 */ /* TRUE and FALSE are part of the C99 standard and gcc, but diff --git a/source3/include/popt_common.h b/source3/include/popt_common.h index 57850bf682..6db30fbc0a 100644 --- a/source3/include/popt_common.h +++ b/source3/include/popt_common.h @@ -41,6 +41,7 @@ struct user_auth_info { pstring password; BOOL got_pass; BOOL use_kerberos; + int signing_state; }; extern struct user_auth_info cmdline_auth_info; diff --git a/source3/include/rpc_ds.h b/source3/include/rpc_ds.h index c01d10554e..7350fdba1f 100644 --- a/source3/include/rpc_ds.h +++ b/source3/include/rpc_ds.h @@ -28,6 +28,10 @@ #define DS_GETPRIMDOMINFO 0x00 +/* Opcodes available on PIPE_NETLOGON */ + +#define DS_ENUM_DOM_TRUSTS 0x28 + /* macros for RPC's */ @@ -50,10 +54,9 @@ typedef struct GUID domain_guid; UNISTR2 netbios_domain; - /* these 2 might be reversed in order. I can't tell from - my tests as both values are the same --jerry */ - UNISTR2 dns_domain; - UNISTR2 forest_domain; + + UNISTR2 dns_domain; /* our dns domain */ + UNISTR2 forest_domain; /* root domain of the forest to which we belong */ } DSROLE_PRIMARY_DOMAIN_INFO_BASIC; typedef struct @@ -85,7 +88,58 @@ typedef struct NTSTATUS status; } DS_R_GETPRIMDOMINFO; +typedef struct { + /* static portion of structure */ + uint32 netbios_ptr; + uint32 dns_ptr; + uint32 flags; + uint32 parent_index; + uint32 trust_type; + uint32 trust_attributes; + uint32 sid_ptr; + GUID guid; + + UNISTR2 netbios_domain; + UNISTR2 dns_domain; + DOM_SID2 sid; + +} DS_DOMAIN_TRUSTS; + +typedef struct { + + uint32 ptr; + uint32 max_count; + DS_DOMAIN_TRUSTS *trusts; + +} DS_DOMAIN_TRUSTS_CTR; + +#define DS_DOMAIN_IN_FOREST 0x0001 /* domains in the forest to which + we belong; even different domain trees */ +#define DS_DOMAIN_DIRECT_OUTBOUND 0x0002 /* trusted domains */ +#define DS_DOMAIN_TREE_ROOT 0x0004 /* root of our forest; also available in + DsRoleGetPrimaryDomainInfo() */ +#define DS_DOMAIN_PRIMARY 0x0008 /* our domain */ +#define DS_DOMAIN_NATIVE_MODE 0x0010 /* native mode AD servers */ +#define DS_DOMAIN_DIRECT_INBOUND 0x0020 /* trusting domains */ + +/* DS_Q_ENUM_DOM_TRUSTS - DsEnumerateDomainTrusts() request */ +typedef struct +{ + uint32 server_ptr; + UNISTR2 server; + uint32 flags; + +} DS_Q_ENUM_DOM_TRUSTS; + +/* DS_R_ENUM_DOM_TRUSTS - DsEnumerateDomainTrusts() response */ +typedef struct +{ + uint32 num_domains; + DS_DOMAIN_TRUSTS_CTR domains; + + NTSTATUS status; +} DS_R_ENUM_DOM_TRUSTS; #endif /* _RPC_DS_H */ diff --git a/source3/include/rpc_samr.h b/source3/include/rpc_samr.h index 7d28a0f3a7..8ec274176a 100644 --- a/source3/include/rpc_samr.h +++ b/source3/include/rpc_samr.h @@ -5,8 +5,7 @@ Copyright (C) Luke Kenneth Casson Leighton 1996-2000 Copyright (C) Paul Ashton 1997-2000 Copyright (C) Jean François Micouleau 1998-2001 - Copyright (C) Anthony Liguori 2002 - Copyright (C) Jim McDonough 2002 + Copyright (C) Jim McDonough 2002 This program is free software; you can redistribute it and/or modify diff --git a/source3/include/rpc_secdes.h b/source3/include/rpc_secdes.h index fb7060cde3..5e718f8167 100644 --- a/source3/include/rpc_secdes.h +++ b/source3/include/rpc_secdes.h @@ -305,12 +305,12 @@ typedef struct standard_mapping { SA_RIGHT_FILE_EXECUTE) -/* SAM Object specific access rights */ +/* SAM server specific access rights */ -#define SA_RIGHT_SAM_UNKNOWN_1 0x00000001 +#define SA_RIGHT_SAM_CONNECT_SERVER 0x00000001 #define SA_RIGHT_SAM_SHUTDOWN_SERVER 0x00000002 -#define SA_RIGHT_SAM_UNKNOWN_4 0x00000004 -#define SA_RIGHT_SAM_UNKNOWN_8 0x00000008 +#define SA_RIGHT_SAM_INITIALISE_SERVER 0x00000004 +#define SA_RIGHT_SAM_CREATE_DOMAIN 0x00000008 #define SA_RIGHT_SAM_ENUM_DOMAINS 0x00000010 #define SA_RIGHT_SAM_OPEN_DOMAIN 0x00000020 @@ -326,14 +326,14 @@ typedef struct standard_mapping { #define GENERIC_RIGHTS_SAM_WRITE \ (STANDARD_RIGHTS_WRITE_ACCESS | \ - SA_RIGHT_SAM_UNKNOWN_8 | \ - SA_RIGHT_SAM_UNKNOWN_4 | \ + SA_RIGHT_SAM_CREATE_DOMAIN | \ + SA_RIGHT_SAM_INITIALISE_SERVER | \ SA_RIGHT_SAM_SHUTDOWN_SERVER) #define GENERIC_RIGHTS_SAM_EXECUTE \ (STANDARD_RIGHTS_EXECUTE_ACCESS | \ SA_RIGHT_SAM_OPEN_DOMAIN | \ - SA_RIGHT_SAM_UNKNOWN_1) + SA_RIGHT_SAM_CONNECT_SERVER) /* Domain Object specific access rights */ @@ -388,8 +388,8 @@ typedef struct standard_mapping { #define SA_RIGHT_USER_CHANGE_PASSWORD 0x00000040 #define SA_RIGHT_USER_SET_PASSWORD 0x00000080 #define SA_RIGHT_USER_GET_GROUPS 0x00000100 -#define SA_RIGHT_USER_UNKNOWN_200 0x00000200 -#define SA_RIGHT_USER_UNKNOWN_400 0x00000400 +#define SA_RIGHT_USER_READ_GROUP_MEM 0x00000200 +#define SA_RIGHT_USER_CHANGE_GROUP_MEM 0x00000400 #define SA_RIGHT_USER_ALL_ACCESS 0x000007FF @@ -399,7 +399,7 @@ typedef struct standard_mapping { #define GENERIC_RIGHTS_USER_READ \ (STANDARD_RIGHTS_READ_ACCESS | \ - SA_RIGHT_USER_UNKNOWN_200 | \ + SA_RIGHT_USER_READ_GROUP_MEM | \ SA_RIGHT_USER_GET_GROUPS | \ SA_RIGHT_USER_ACCT_FLAGS_EXPIRY | \ SA_RIGHT_USER_GET_LOGONINFO | \ diff --git a/source3/include/smb.h b/source3/include/smb.h index d2714e78bc..deeb61034d 100644 --- a/source3/include/smb.h +++ b/source3/include/smb.h @@ -42,6 +42,7 @@ #define SMB_PORT2 139 #define SMB_PORTS "445 139" +#define Undefined (-1) #define False (0) #define True (1) #define Auto (2) @@ -79,9 +80,7 @@ typedef int BOOL; #define READ_TIMEOUT 1 #define READ_EOF 2 #define READ_ERROR 3 - -/* This error code can go into the client smb_rw_error. */ -#define WRITE_ERROR 4 +#define WRITE_ERROR 4 /* This error code can go into the client smb_rw_error. */ #define READ_BAD_SIG 5 #define DIR_STRUCT_SIZE 43 @@ -707,13 +706,14 @@ struct bitmap { unsigned int n; }; -#define FLAG_BASIC 0x0001 /* fundamental options */ +/* The following flags are used in SWAT */ +#define FLAG_BASIC 0x0001 /* Display only in BASIC view */ #define FLAG_SHARE 0x0002 /* file sharing options */ #define FLAG_PRINT 0x0004 /* printing options */ #define FLAG_GLOBAL 0x0008 /* local options that should be globally settable in SWAT */ #define FLAG_WIZARD 0x0010 /* Parameters that the wizard will operate on */ -#define FLAG_ADVANCED 0x0020 /* Parameters that the wizard will operate on */ -#define FLAG_DEVELOPER 0x0040 /* Parameters that the wizard will operate on */ +#define FLAG_ADVANCED 0x0020 /* Parameters that will be visible in advanced view */ +#define FLAG_DEVELOPER 0x0040 /* No longer used */ #define FLAG_DEPRECATED 0x1000 /* options that should no longer be used */ #define FLAG_HIDE 0x2000 /* options that should be hidden in SWAT */ #define FLAG_DOS_STRING 0x4000 /* convert from UNIX to DOS codepage when reading this string. */ @@ -1630,4 +1630,18 @@ struct ip_service { unsigned port; }; +/* Used by the SMB signing functions. */ + +typedef struct smb_sign_info { + void (*sign_outgoing_message)(char *outbuf, struct smb_sign_info *si); + BOOL (*check_incoming_message)(char *inbuf, struct smb_sign_info *si); + void (*free_signing_context)(struct smb_sign_info *si); + void *signing_context; + + BOOL negotiated_smb_signing; + BOOL allow_smb_signing; + BOOL doing_signing; + BOOL mandatory_signing; +} smb_sign_info; + #endif /* _SMB_H */ diff --git a/source3/include/smbldap.h b/source3/include/smbldap.h index 589d01aa6d..826fc3c55a 100644 --- a/source3/include/smbldap.h +++ b/source3/include/smbldap.h @@ -132,6 +132,9 @@ struct smbldap_state { char *bind_secret; unsigned int num_failures; + + time_t last_use; + smb_event_id_t event_id; }; #endif /* HAVE_LDAP */ diff --git a/source3/include/sysquotas.h b/source3/include/sysquotas.h index cfdac0609a..b803e6277a 100644 --- a/source3/include/sysquotas.h +++ b/source3/include/sysquotas.h @@ -189,6 +189,22 @@ #define SMB_QUOTAS_NO_LIMIT ((SMB_BIG_UINT)(0)) #define SMB_QUOTAS_NO_SPACE ((SMB_BIG_UINT)(1)) +#define SMB_QUOTAS_SET_NO_LIMIT(dp) \ +{\ + (dp)->softlimit = SMB_QUOTAS_NO_LIMIT;\ + (dp)->hardlimit = SMB_QUOTAS_NO_LIMIT;\ + (dp)->isoftlimit = SMB_QUOTAS_NO_LIMIT;\ + (dp)->ihardlimit = SMB_QUOTAS_NO_LIMIT;\ +} + +#define SMB_QUOTAS_SET_NO_SPACE(dp) \ +{\ + (dp)->softlimit = SMB_QUOTAS_NO_SPACE;\ + (dp)->hardlimit = SMB_QUOTAS_NO_SPACE;\ + (dp)->isoftlimit = SMB_QUOTAS_NO_SPACE;\ + (dp)->ihardlimit = SMB_QUOTAS_NO_SPACE;\ +} + typedef struct _SMB_DISK_QUOTA { enum SMB_QUOTA_TYPE qtype; SMB_BIG_UINT bsize; diff --git a/source3/include/version.h b/source3/include/version.h index 5e2d47e1de..68bc140daf 100644 --- a/source3/include/version.h +++ b/source3/include/version.h @@ -1 +1 @@ -#define VERSION "3.0.0beta3" +#define VERSION "3.0.0rc1" diff --git a/source3/include/vfs.h b/source3/include/vfs.h index 924d706321..452f4dc23b 100644 --- a/source3/include/vfs.h +++ b/source3/include/vfs.h @@ -466,6 +466,9 @@ typedef struct vfs_handle_struct { } \ } +/* Check whether module-specific data handle was already allocated or not */ +#define SMB_VFS_HANDLE_TEST_DATA(handle) ( !(handle) || !(handle)->data ? False : True ) + #define SMB_VFS_OP(x) ((void *) x) diff --git a/source3/lib/account_pol.c b/source3/lib/account_pol.c index e8b382c7ab..dc131985a1 100644 --- a/source3/lib/account_pol.c +++ b/source3/lib/account_pol.c @@ -53,7 +53,7 @@ BOOL init_account_policy(void) account_policy_set(AP_MIN_PASSWORD_LEN, MINPASSWDLENGTH); /* 5 chars minimum */ account_policy_set(AP_PASSWORD_HISTORY, 0); /* don't keep any old password */ account_policy_set(AP_USER_MUST_LOGON_TO_CHG_PASS, 0); /* don't force user to logon */ - account_policy_set(AP_MAX_PASSWORD_AGE, MAX_PASSWORD_AGE); /* 21 days */ + account_policy_set(AP_MAX_PASSWORD_AGE, (uint32)-1); /* don't expire */ account_policy_set(AP_MIN_PASSWORD_AGE, 0); /* 0 days */ account_policy_set(AP_LOCK_ACCOUNT_DURATION, 0); /* lockout for 0 minutes */ account_policy_set(AP_RESET_COUNT_TIME, 0); /* reset immediatly */ diff --git a/source3/lib/charcnv.c b/source3/lib/charcnv.c index 4e9c2c1592..ca5e378970 100644 --- a/source3/lib/charcnv.c +++ b/source3/lib/charcnv.c @@ -190,8 +190,8 @@ size_t convert_string(charset_t from, charset_t to, break; case E2BIG: reason="No more room"; - DEBUG(0, ("convert_string: Required %d, available %d\n", - srclen, destlen)); + DEBUG(0, ("convert_string: Required %lu, available %lu\n", + (unsigned long)srclen, (unsigned long)destlen)); /* we are not sure we need srclen bytes, may be more, may be less. We only know we need more than destlen @@ -319,8 +319,7 @@ size_t unix_strupper(const char *src, size_t srclen, char *dest, size_t destlen) size_t size; smb_ucs2_t *buffer; - size = convert_string_allocate(CH_UNIX, CH_UCS2, src, srclen, - (void **) &buffer); + size = push_ucs2_allocate(&buffer, src); if (size == -1) { smb_panic("failed to create UCS2 buffer"); } @@ -334,6 +333,33 @@ size_t unix_strupper(const char *src, size_t srclen, char *dest, size_t destlen) return size; } +/** + strdup() a unix string to upper case. +**/ + +char *strdup_upper(const char *s) +{ + size_t size; + smb_ucs2_t *buffer; + char *out_buffer; + + size = push_ucs2_allocate(&buffer, s); + if (size == -1) { + return NULL; + } + + strupper_w(buffer); + + size = pull_ucs2_allocate(&out_buffer, buffer); + SAFE_FREE(buffer); + + if (size == -1) { + return NULL; + } + + return out_buffer; +} + size_t unix_strlower(const char *src, size_t srclen, char *dest, size_t destlen) { size_t size; @@ -353,6 +379,32 @@ size_t unix_strlower(const char *src, size_t srclen, char *dest, size_t destlen) return size; } +/** + strdup() a unix string to lower case. +**/ + +char *strdup_lower(const char *s) +{ + size_t size; + smb_ucs2_t *buffer; + char *out_buffer; + + size = push_ucs2_allocate(&buffer, s); + if (size == -1) { + return NULL; + } + + strlower_w(buffer); + + size = pull_ucs2_allocate(&out_buffer, buffer); + SAFE_FREE(buffer); + + if (size == -1) { + return NULL; + } + + return out_buffer; +} static size_t ucs2_align(const void *base_ptr, const void *p, int flags) { @@ -480,18 +532,11 @@ size_t push_ucs2(const void *base_ptr, void *dest, const char *src, size_t dest_ { size_t len=0; size_t src_len = strlen(src); - pstring tmpbuf; /* treat a pstring as "unlimited" length */ if (dest_len == (size_t)-1) dest_len = sizeof(pstring); - if (flags & STR_UPPER) { - pstrcpy(tmpbuf, src); - strupper_m(tmpbuf); - src = tmpbuf; - } - if (flags & STR_TERMINATE) src_len++; @@ -506,6 +551,18 @@ size_t push_ucs2(const void *base_ptr, void *dest, const char *src, size_t dest_ dest_len &= ~1; len += convert_string(CH_UNIX, CH_UCS2, src, src_len, dest, dest_len); + + if (flags & STR_UPPER) { + smb_ucs2_t *dest_ucs2 = dest; + size_t i; + for (i = 0; i < (dest_len / 2) && dest_ucs2[i]; i++) { + smb_ucs2_t v = toupper_w(dest_ucs2[i]); + if (v != dest_ucs2[i]) { + dest_ucs2[i] = v; + } + } + } + return len; } @@ -809,44 +866,3 @@ size_t align_string(const void *base_ptr, const char *p, int flags) return 0; } -/** - Convert from unix to ucs2 charset and return the - allocated and converted string or NULL if an error occurred. - You must provide a zero terminated string. - The returning string will be zero terminated. -**/ - -smb_ucs2_t *acnv_uxu2(const char *src) -{ - size_t slen; - size_t dlen; - void *dest; - - slen = strlen(src) + 1; - dlen = convert_string_allocate(CH_UNIX, CH_UCS2, src, slen, &dest); - if (dlen == (size_t)-1) - return NULL; - else - return dest; -} - -/** - Convert from dos to ucs2 charset and return the - allocated and converted string or NULL if an error occurred. - You must provide a zero terminated string. - The returning string will be zero terminated. -**/ - -smb_ucs2_t *acnv_dosu2(const char *src) -{ - size_t slen; - size_t dlen; - void *dest; - - slen = strlen(src) + 1; - dlen = convert_string_allocate(CH_DOS, CH_UCS2, src, slen, &dest); - if (dlen == (size_t)-1) - return NULL; - else - return dest; -} diff --git a/source3/lib/popt_common.c b/source3/lib/popt_common.c index b8e77b2d9e..af1cbcfe80 100644 --- a/source3/lib/popt_common.c +++ b/source3/lib/popt_common.c @@ -258,19 +258,21 @@ static void get_credentials_file(const char *file, struct user_auth_info *info) * -A,--authentication-file * -k,--use-kerberos * -N,--no-pass + * -S,--signing */ static void popt_common_credentials_callback(poptContext con, - enum poptCallbackReason reason, - const struct poptOption *opt, - const char *arg, const void *data) + enum poptCallbackReason reason, + const struct poptOption *opt, + const char *arg, const void *data) { char *p; if (reason == POPT_CALLBACK_REASON_PRE) { cmdline_auth_info.use_kerberos = False; cmdline_auth_info.got_pass = False; + cmdline_auth_info.signing_state = Undefined; pstrcpy(cmdline_auth_info.username, "GUEST"); if (getenv("LOGNAME"))pstrcpy(cmdline_auth_info.username,getenv("LOGNAME")); @@ -327,6 +329,22 @@ static void popt_common_credentials_callback(poptContext con, cmdline_auth_info.got_pass = True; #endif break; + + case 'S': + { + cmdline_auth_info.signing_state = -1; + if (strequal(arg, "off") || strequal(arg, "no") || strequal(arg, "false")) + cmdline_auth_info.signing_state = False; + else if (strequal(arg, "on") || strequal(arg, "yes") || strequal(arg, "true")) + cmdline_auth_info.signing_state = True; + else if (strequal(arg, "force") || strequal(arg, "required") || strequal(arg, "forced")) + cmdline_auth_info.signing_state = Required; + else { + fprintf(stderr, "Unknown signing option %s\n", arg ); + exit(1); + } + } + break; } } @@ -338,5 +356,6 @@ struct poptOption popt_common_credentials[] = { { "no-pass", 'N', POPT_ARG_NONE, &cmdline_auth_info.got_pass, 0, "Don't ask for a password" }, { "kerberos", 'k', POPT_ARG_NONE, &cmdline_auth_info.use_kerberos, 'k', "Use kerberos (active directory) authentication" }, { "authentication-file", 'A', POPT_ARG_STRING, NULL, 'A', "Get the credentials from a file", "FILE" }, + { "signing", 'S', POPT_ARG_STRING, NULL, 'S', "Set the client signing state", "on|off|required" }, POPT_TABLEEND }; diff --git a/source3/lib/replace.c b/source3/lib/replace.c index 0c62ec9bfa..cd48b8d160 100644 --- a/source3/lib/replace.c +++ b/source3/lib/replace.c @@ -447,21 +447,3 @@ char *rep_inet_ntoa(struct in_addr ip) return t; } #endif - -#ifndef HAVE_SETENV - int setenv(const char *name, const char *value, int overwrite) -{ - char *p = NULL; - int ret = -1; - - asprintf(&p, "%s=%s", name, value); - - if (overwrite || getenv(name)) { - if (p) ret = putenv(p); - } else { - ret = 0; - } - - return ret; -} -#endif diff --git a/source3/lib/smbldap.c b/source3/lib/smbldap.c index 39c1990dec..3f56d066ec 100644 --- a/source3/lib/smbldap.c +++ b/source3/lib/smbldap.c @@ -5,7 +5,7 @@ Copyright (C) Gerald Carter 2001-2003 Copyright (C) Shahms King 2001 Copyright (C) Andrew Bartlett 2002-2003 - Copyright (C) Stefan (metze) Metzmacher 2002 + Copyright (C) Stefan (metze) Metzmacher 2002-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -35,6 +35,8 @@ #define SMBLDAP_DONT_PING_TIME 10 /* ping only all 10 seconds */ #define SMBLDAP_NUM_RETRIES 8 /* retry only 8 times */ +#define SMBLDAP_IDLE_TIME 150 /* After 2.5 minutes disconnect */ + /* attributes used by Samba 2.2 */ @@ -925,6 +927,8 @@ int smbldap_search(struct smbldap_state *ldap_state, smbldap_close(ldap_state); } + ldap_state->last_use = time(NULL); + SAFE_FREE(utf8_filter); return rc; } @@ -954,6 +958,8 @@ int smbldap_modify(struct smbldap_state *ldap_state, const char *dn, LDAPMod *at smbldap_close(ldap_state); } + ldap_state->last_use = time(NULL); + SAFE_FREE(utf8_dn); return rc; } @@ -983,6 +989,8 @@ int smbldap_add(struct smbldap_state *ldap_state, const char *dn, LDAPMod *attrs smbldap_close(ldap_state); } + ldap_state->last_use = time(NULL); + SAFE_FREE(utf8_dn); return rc; } @@ -1012,6 +1020,8 @@ int smbldap_delete(struct smbldap_state *ldap_state, const char *dn) smbldap_close(ldap_state); } + ldap_state->last_use = time(NULL); + SAFE_FREE(utf8_dn); return rc; } @@ -1041,6 +1051,8 @@ int smbldap_extended_operation(struct smbldap_state *ldap_state, smbldap_close(ldap_state); } + ldap_state->last_use = time(NULL); + return rc; } @@ -1071,6 +1083,24 @@ int smbldap_search_suffix (struct smbldap_state *ldap_state, const char *filter, return rc; } +static void smbldap_idle_fn(void **data, time_t *interval, time_t now) +{ + struct smbldap_state *state = (struct smbldap_state *)(*data); + + if (state->ldap_struct == NULL) { + DEBUG(10,("ldap connection not connected...\n")); + return; + } + + if ((state->last_use+SMBLDAP_IDLE_TIME) > now) { + DEBUG(10,("ldap connection not idle...\n")); + return; + } + + DEBUG(7,("ldap connection idle...closing connection\n")); + smbldap_close(state); +} + /********************************************************************** Housekeeping *********************************************************************/ @@ -1086,6 +1116,8 @@ void smbldap_free_struct(struct smbldap_state **ldap_state) SAFE_FREE((*ldap_state)->bind_dn); SAFE_FREE((*ldap_state)->bind_secret); + smb_unregister_idle_event((*ldap_state)->event_id); + *ldap_state = NULL; /* No need to free any further, as it is talloc()ed */ @@ -1109,6 +1141,16 @@ NTSTATUS smbldap_init(TALLOC_CTX *mem_ctx, const char *location, struct smbldap_ } else { (*smbldap_state)->uri = "ldap://localhost"; } + + (*smbldap_state)->event_id = + smb_register_idle_event(smbldap_idle_fn, (void *)(*smbldap_state), + SMBLDAP_IDLE_TIME); + + if ((*smbldap_state)->event_id == SMB_EVENT_ID_INVALID) { + DEBUG(0,("Failed to register LDAP idle event!\n")); + return NT_STATUS_INVALID_HANDLE; + } + return NT_STATUS_OK; } @@ -1155,7 +1197,7 @@ static NTSTATUS add_new_domain_info(struct smbldap_state *ldap_state, DEBUG(3,("Adding new domain\n")); ldap_op = LDAP_MOD_ADD; - snprintf(dn, sizeof(dn), "%s=%s,%s", get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN), + pstr_sprintf(dn, "%s=%s,%s", get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN), domain_name, lp_ldap_suffix()); /* Free original search */ @@ -1220,7 +1262,7 @@ NTSTATUS smbldap_search_domain_info(struct smbldap_state *ldap_state, char **attr_list; int count; - snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(%s=%s))", + pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))", LDAP_OBJ_DOMINFO, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN), domain_name); diff --git a/source3/lib/snprintf.c b/source3/lib/snprintf.c index 9b9ceb60ca..a2f9f592db 100644 --- a/source3/lib/snprintf.c +++ b/source3/lib/snprintf.c @@ -823,12 +823,10 @@ static void dopr_outch(char *buffer, size_t *currlen, size_t maxlen, char c) * * The logic for these two is that we need our own definition if the * OS *either* has no definition of *sprintf, or if it does have one - * that doesn't work properly according to the autoconf test. Perhaps - * these should really be smb_snprintf to avoid conflicts with buggy - * linkers? -- mbp + * that doesn't work properly according to the autoconf test. */ #if !defined(HAVE_SNPRINTF) || !defined(HAVE_C99_VSNPRINTF) - int snprintf(char *str,size_t count,const char *fmt,...) +int smb_snprintf(char *str,size_t count,const char *fmt,...) { size_t ret; va_list ap; diff --git a/source3/lib/substitute.c b/source3/lib/substitute.c index ac2cf687c4..c0d0096806 100644 --- a/source3/lib/substitute.c +++ b/source3/lib/substitute.c @@ -58,8 +58,8 @@ void set_local_machine_name(const char* local_name, BOOL perm) fstrcpy(tmp_local_machine,local_name); trim_string(tmp_local_machine," "," "); - strlower_m(tmp_local_machine); alpha_strcpy(local_machine,tmp_local_machine,SAFE_NETBIOS_CHARS,sizeof(local_machine)-1); + strlower_m(local_machine); } /** @@ -80,8 +80,8 @@ void set_remote_machine_name(const char* remote_name, BOOL perm) fstrcpy(tmp_remote_machine,remote_name); trim_string(tmp_remote_machine," "," "); - strlower_m(tmp_remote_machine); alpha_strcpy(remote_machine,tmp_remote_machine,SAFE_NETBIOS_CHARS,sizeof(remote_machine)-1); + strlower_m(remote_machine); } const char* get_remote_machine_name(void) diff --git a/source3/lib/sysquotas.c b/source3/lib/sysquotas.c index efc9e65b9d..617f624dae 100644 --- a/source3/lib/sysquotas.c +++ b/source3/lib/sysquotas.c @@ -48,12 +48,6 @@ static int sys_get_vfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ switch (qtype) { case SMB_USER_QUOTA_TYPE: - /* we use id.uid == 0 for default quotas */ - if (id.uid == 0) { - ret = 0; - break; - } - if ((ret = quotactl(QCMD(Q_GETQUOTA,USRQUOTA), bdev, id.uid, (CADDR_T)&D))) { return ret; } @@ -88,13 +82,19 @@ static int sys_get_vfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ qflags |= QUOTAS_DENY_DISK; } - /* get the default quotas stored in the root's (uid =0) record */ - if ((ret = quotactl(QCMD(Q_GETQUOTA,USRQUOTA), bdev, 0, (CADDR_T)&D))) { - return ret; + ret = 0; + break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_FS_QUOTA_TYPE: + id.gid = getgid(); + + if ((ret = quotactl(QCMD(Q_GETQUOTA,GRPQUOTA), bdev, id.gid, (CADDR_T)&D))==0) { + qflags |= QUOTAS_DENY_DISK; } ret = 0; break; +#endif /* HAVE_GROUP_QUOTA */ default: errno = ENOSYS; return -1; @@ -122,6 +122,7 @@ static int sys_set_vfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ { int ret = -1; uint32 qflags = 0; + uint32 oldqflags = 0; struct SYS_DQBLK D; SMB_BIG_UINT bsize = (SMB_BIG_UINT)QUOTABLOCK_SIZE; @@ -146,10 +147,7 @@ static int sys_set_vfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ switch (qtype) { case SMB_USER_QUOTA_TYPE: - /* we use id.uid == 0 for default quotas */ - if (id.uid>0) { - ret = quotactl(QCMD(Q_SETQLIM,USRQUOTA), bdev, id.uid, (CADDR_T)&D); - } + ret = quotactl(QCMD(Q_SETQLIM,USRQUOTA), bdev, id.uid, (CADDR_T)&D); break; #ifdef HAVE_GROUP_QUOTA case SMB_GROUP_QUOTA_TYPE: @@ -160,7 +158,7 @@ static int sys_set_vfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ /* this stuff didn't work as it should: * switching on/off quota via quotactl() * didn't work! - * So we only set the default limits + * So we just return 0 * --metze * * On HPUX we didn't have the mount path, @@ -168,9 +166,9 @@ static int sys_set_vfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ * */ #if 0 - uid = getuid(); + id.uid = getuid(); - ret = quotactl(QCMD(Q_GETQUOTA,USRQUOTA), bdev, uid, (CADDR_T)&D); + ret = quotactl(QCMD(Q_GETQUOTA,USRQUOTA), bdev, id.uid, (CADDR_T)&D); if ((qflags"AS_DENY_DISK)||(qflags"AS_ENABLED)) { if (ret == 0) { @@ -197,14 +195,79 @@ static int sys_set_vfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ } DEBUG(0,("vfs_fs_quota: ret(%d) errno(%d)[%s] uid(%d) bdev[%s]\n", - ret,errno,strerror(errno),uid,bdev)); + ret,errno,strerror(errno),id.uid,bdev)); +#else + id.uid = getuid(); + + if ((ret = quotactl(QCMD(Q_GETQUOTA,USRQUOTA), bdev, id.uid, (CADDR_T)&D))==0) { + oldqflags |= QUOTAS_DENY_DISK; + } + + if (oldqflags == qflags) { + ret = 0; + } else { + ret = -1; + } #endif - - /* we use uid == 0 for default quotas */ - ret = quotactl(QCMD(Q_SETQLIM,USRQUOTA), bdev, 0, (CADDR_T)&D); - break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_FS_QUOTA_TYPE: + /* this stuff didn't work as it should: + * switching on/off quota via quotactl() + * didn't work! + * So we just return 0 + * --metze + * + * On HPUX we didn't have the mount path, + * we need to fix sys_path_to_bdev() + * + */ +#if 0 + id.gid = getgid(); + + ret = quotactl(QCMD(Q_GETQUOTA,GRPQUOTA), bdev, id, (CADDR_T)&D); + + if ((qflags"AS_DENY_DISK)||(qflags"AS_ENABLED)) { + if (ret == 0) { + char *quota_file = NULL; + + asprintf("a_file,"/%s/%s%s",path, QUOTAFILENAME,GROUPQUOTAFILE_EXTENSION); + if (quota_file == NULL) { + DEBUG(0,("asprintf() failed!\n")); + errno = ENOMEM; + return -1; + } + + ret = quotactl(QCMD(Q_QUOTAON,GRPQUOTA), bdev, -1,(CADDR_T)quota_file); + } else { + ret = 0; + } + } else { + if (ret != 0) { + /* turn off */ + ret = quotactl(QCMD(Q_QUOTAOFF,GRPQUOTA), bdev, -1, (CADDR_T)0); + } else { + ret = 0; + } + } + + DEBUG(0,("vfs_fs_quota: ret(%d) errno(%d)[%s] uid(%d) bdev[%s]\n", + ret,errno,strerror(errno),id.gid,bdev)); +#else + id.gid = getgid(); + + if ((ret = quotactl(QCMD(Q_GETQUOTA,GRPQUOTA), bdev, id.gid, (CADDR_T)&D))==0) { + oldqflags |= QUOTAS_DENY_DISK; + } + if (oldqflags == qflags) { + ret = 0; + } else { + ret = -1; + } +#endif + break; +#endif /* HAVE_GROUP_QUOTA */ default: errno = ENOSYS; return -1; @@ -383,7 +446,7 @@ static int sys_path_to_bdev(const char *path, char **mntpath, char **bdev, char ****************************************************************************/ static int sys_get_xfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp) { - int ret; + int ret = -1; uint32 qflags = 0; SMB_BIG_UINT bsize = (SMB_BIG_UINT)BBSIZE; struct fs_disk_quota D; @@ -399,11 +462,6 @@ static int sys_get_xfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ switch (qtype) { case SMB_USER_QUOTA_TYPE: - /* we use id.uid == 0 for default quotas */ - if (id.uid == 0) { - ret = 0; - break; - } if ((ret=quotactl(QCMD(Q_XGETQUOTA,USRQUOTA), bdev, id.uid, (CADDR_T)&D))) return ret; break; @@ -413,10 +471,8 @@ static int sys_get_xfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ return ret; break; #endif /* HAVE_GROUP_QUOTA */ - case SMB_USER_FS_QUOTA_TYPE: - /* TODO: get quota status from quotactl() ... */ - if ((ret = quotactl(QCMD(Q_XGETQSTAT,USRQUOTA), bdev, -1, (CADDR_T)&F))) - return ret; + case SMB_USER_FS_QUOTA_TYPE: + quotactl(QCMD(Q_XGETQSTAT,USRQUOTA), bdev, -1, (CADDR_T)&F); if (F.qs_flags & XFS_QUOTA_UDQ_ENFD) { qflags |= QUOTAS_DENY_DISK; @@ -425,11 +481,24 @@ static int sys_get_xfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ qflags |= QUOTAS_ENABLED; } - /* we use uid == 0 for default quotas */ - if ((ret=quotactl(QCMD(Q_XGETQUOTA,USRQUOTA), bdev, 0, (CADDR_T)&D))) - return ret; + ret = 0; break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_FS_QUOTA_TYPE: + quotactl(QCMD(Q_XGETQSTAT,GRPQUOTA), bdev, -1, (CADDR_T)&F); + + if (F.qs_flags & XFS_QUOTA_UDQ_ENFD) { + qflags |= QUOTAS_DENY_DISK; + } + else if (F.qs_flags & XFS_QUOTA_UDQ_ACCT) { + qflags |= QUOTAS_ENABLED; + } + + ret = 0; + + break; +#endif /* HAVE_GROUP_QUOTA */ default: errno = ENOSYS; return -1; @@ -481,11 +550,8 @@ static int sys_set_xfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ switch (qtype) { case SMB_USER_QUOTA_TYPE: - /* we use uid == 0 for default quotas */ - if (id.uid>0) { - D.d_fieldmask |= FS_DQ_LIMIT_MASK; - ret = quotactl(QCMD(Q_XSETQLIM,USRQUOTA), bdev, id.uid, (CADDR_T)&D); - } + D.d_fieldmask |= FS_DQ_LIMIT_MASK; + ret = quotactl(QCMD(Q_XSETQLIM,USRQUOTA), bdev, id.uid, (CADDR_T)&D); break; #ifdef HAVE_GROUP_QUOTA case SMB_GROUP_QUOTA_TYPE: @@ -494,7 +560,6 @@ static int sys_set_xfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ break; #endif /* HAVE_GROUP_QUOTA */ case SMB_USER_FS_QUOTA_TYPE: - /* TODO */ quotactl(QCMD(Q_XGETQSTAT,USRQUOTA), bdev, -1, (CADDR_T)&F); if (qflags & QUOTAS_DENY_DISK) { @@ -505,6 +570,8 @@ static int sys_set_xfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ if (q_on != 0) { ret = quotactl(QCMD(Q_XQUOTAON,USRQUOTA),bdev, -1, (CADDR_T)&q_on); + } else { + ret = 0; } } else if (qflags & QUOTAS_ENABLED) { @@ -513,6 +580,8 @@ static int sys_set_xfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ if (q_off != 0) { ret = quotactl(QCMD(Q_XQUOTAOFF,USRQUOTA),bdev, -1, (CADDR_T)&q_off); + } else { + ret = 0; } if (!(F.qs_flags & XFS_QUOTA_UDQ_ACCT)) @@ -520,6 +589,8 @@ static int sys_set_xfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ if (q_on != 0) { ret = quotactl(QCMD(Q_XQUOTAON,USRQUOTA),bdev, -1, (CADDR_T)&q_on); + } else { + ret = 0; } } else { #if 0 @@ -533,14 +604,71 @@ static int sys_set_xfs_quota(const char *path, const char *bdev, enum SMB_QUOTA_ if (q_off !=0) { ret = quotactl(QCMD(Q_XQUOTAOFF,USRQUOTA),bdev, -1, (CADDR_T)&q_off); + } else { + ret = 0; } +#else + ret = -1; #endif } + + break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_FS_QUOTA_TYPE: + quotactl(QCMD(Q_XGETQSTAT,GRPQUOTA), bdev, -1, (CADDR_T)&F); - /* we use uid == 0 for default quotas */ - D.d_fieldmask |= FS_DQ_LIMIT_MASK; - ret = quotactl(QCMD(Q_XSETQLIM,USRQUOTA), bdev, 0, (CADDR_T)&D); + if (qflags & QUOTAS_DENY_DISK) { + if (!(F.qs_flags & XFS_QUOTA_UDQ_ENFD)) + q_on |= XFS_QUOTA_UDQ_ENFD; + if (!(F.qs_flags & XFS_QUOTA_UDQ_ACCT)) + q_on |= XFS_QUOTA_UDQ_ACCT; + + if (q_on != 0) { + ret = quotactl(QCMD(Q_XQUOTAON,GRPQUOTA),bdev, -1, (CADDR_T)&q_on); + } else { + ret = 0; + } + + } else if (qflags & QUOTAS_ENABLED) { + if (F.qs_flags & XFS_QUOTA_UDQ_ENFD) + q_off |= XFS_QUOTA_UDQ_ENFD; + + if (q_off != 0) { + ret = quotactl(QCMD(Q_XQUOTAOFF,GRPQUOTA),bdev, -1, (CADDR_T)&q_off); + } else { + ret = 0; + } + + if (!(F.qs_flags & XFS_QUOTA_UDQ_ACCT)) + q_on |= XFS_QUOTA_UDQ_ACCT; + + if (q_on != 0) { + ret = quotactl(QCMD(Q_XQUOTAON,GRPQUOTA),bdev, -1, (CADDR_T)&q_on); + } else { + ret = 0; + } + } else { +#if 0 + /* Switch on XFS_QUOTA_UDQ_ACCT didn't work! + * only swittching off XFS_QUOTA_UDQ_ACCT work + */ + if (F.qs_flags & XFS_QUOTA_UDQ_ENFD) + q_off |= XFS_QUOTA_UDQ_ENFD; + if (F.qs_flags & XFS_QUOTA_UDQ_ACCT) + q_off |= XFS_QUOTA_UDQ_ACCT; + + if (q_off !=0) { + ret = quotactl(QCMD(Q_XQUOTAOFF,GRPQUOTA),bdev, -1, (CADDR_T)&q_off); + } else { + ret = 0; + } +#else + ret = -1; +#endif + } + break; +#endif /* HAVE_GROUP_QUOTA */ default: errno = ENOSYS; return -1; @@ -783,12 +911,17 @@ int sys_get_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DI } if ((ret=sys_path_to_bdev(path,&mntpath,&bdev,&fs))!=0) { + DEBUG(0,("sys_path_to_bdev() failed for path [%s]!\n",path)); return ret; } for (i=0;(fs && sys_quota_backends[i].name && sys_quota_backends[i].get_quota);i++) { if (strcmp(fs,sys_quota_backends[i].name)==0) { ret = sys_quota_backends[i].get_quota(mntpath, bdev, qtype, id, dp); + if (ret!=0) { + DEBUG(10,("sys_get_%s_quota() failed for mntpath[%s] bdev[%s] qtype[%d] id[%d] ret[%d].\n", + fs,mntpath,bdev,qtype,(qtype==SMB_GROUP_QUOTA_TYPE?id.gid:id.uid),ret)); + } ready = True; break; } @@ -796,7 +929,11 @@ int sys_get_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DI if (!ready) { /* use the default vfs quota functions */ - ret = sys_get_vfs_quota(mntpath, bdev, qtype, id, dp); + ret=sys_get_vfs_quota(mntpath, bdev, qtype, id, dp); + if (ret!=0) { + DEBUG(10,("sys_get_%s_quota() failed for mntpath[%s] bdev[%s] qtype[%d] id[%d] ret[%d].\n", + "vfs",mntpath,bdev,qtype,(qtype==SMB_GROUP_QUOTA_TYPE?id.gid:id.uid),ret)); + } } SAFE_FREE(mntpath); @@ -831,12 +968,17 @@ int sys_set_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DI } if ((ret=sys_path_to_bdev(path,&mntpath,&bdev,&fs))!=0) { + DEBUG(0,("sys_path_to_bdev() failed for path [%s]!\n",path)); return ret; } for (i=0;(fs && sys_quota_backends[i].name && sys_quota_backends[i].set_quota);i++) { if (strcmp(fs,sys_quota_backends[i].name)==0) { ret = sys_quota_backends[i].set_quota(mntpath, bdev, qtype, id, dp); + if (ret!=0) { + DEBUG(10,("sys_set_%s_quota() failed for mntpath[%s] bdev[%s] qtype[%d] id[%d] ret[%d].\n", + fs,mntpath,bdev,qtype,(qtype==SMB_GROUP_QUOTA_TYPE?id.gid:id.uid),ret)); + } ready = True; break; } @@ -845,6 +987,10 @@ int sys_set_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DI if (!ready) { /* use the default vfs quota functions */ ret=sys_set_vfs_quota(mntpath, bdev, qtype, id, dp); + if (ret!=0) { + DEBUG(10,("sys_set_%s_quota() failed for mntpath[%s] bdev[%s] qtype[%d] id[%d] ret[%d].\n", + "vfs",mntpath,bdev,qtype,(qtype==SMB_GROUP_QUOTA_TYPE?id.gid:id.uid),ret)); + } } SAFE_FREE(mntpath); diff --git a/source3/lib/username.c b/source3/lib/username.c index 98b8f33aae..6321d47021 100644 --- a/source3/lib/username.c +++ b/source3/lib/username.c @@ -386,7 +386,7 @@ static BOOL user_in_winbind_group_list(const char *user, const char *gname, BOOL if ( DEBUGLEVEL >= 10 ) { DEBUG(10,("user_in_winbind_group_list: using groups -- ")); for ( i=0; i 2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -2247,7 +2247,7 @@ char *pid_path(const char *name) char *lib_path(const char *name) { static pstring fname; - snprintf(fname, sizeof(fname), "%s/%s", dyn_LIBDIR, name); + fstr_sprintf(fname, "%s/%s", dyn_LIBDIR, name); return fname; } diff --git a/source3/lib/util_file.c b/source3/lib/util_file.c index 02acbd4d7e..638a6ca342 100644 --- a/source3/lib/util_file.c +++ b/source3/lib/util_file.c @@ -455,8 +455,8 @@ void *map_file(char *fname, size_t size) p = file_load(fname, &s2); if (!p) return NULL; if (s2 != size) { - DEBUG(1,("incorrect size for %s - got %d expected %d\n", - fname, s2, size)); + DEBUG(1,("incorrect size for %s - got %lu expected %lu\n", + fname, (unsigned long)s2, (unsigned long)size)); if (p) free(p); return NULL; } diff --git a/source3/lib/util_sock.c b/source3/lib/util_sock.c index 1bd4c3a96b..b8b8471708 100644 --- a/source3/lib/util_sock.c +++ b/source3/lib/util_sock.c @@ -289,7 +289,7 @@ ssize_t read_socket_with_timeout(int fd,char *buf,size_t mincnt,size_t maxcnt,un } /**************************************************************************** - read data from the client, reading exactly N bytes. + Read data from the client, reading exactly N bytes. ****************************************************************************/ ssize_t read_data(int fd,char *buffer,size_t N) @@ -397,7 +397,7 @@ static ssize_t write_socket_data(int fd,char *buffer,size_t N) } /**************************************************************************** -write to a socket + Write to a socket. ****************************************************************************/ ssize_t write_socket(int fd,char *buf,size_t len) @@ -416,7 +416,7 @@ ssize_t write_socket(int fd,char *buf,size_t len) } /**************************************************************************** -send a keepalive packet (rfc1002) + Send a keepalive packet (rfc1002). ****************************************************************************/ BOOL send_keepalive(int client) @@ -431,11 +431,11 @@ BOOL send_keepalive(int client) /**************************************************************************** -read 4 bytes of a smb packet and return the smb length of the packet -store the result in the buffer -This version of the function will return a length of zero on receiving -a keepalive packet. -timeout is in milliseconds. + Read 4 bytes of a smb packet and return the smb length of the packet. + Store the result in the buffer. + This version of the function will return a length of zero on receiving + a keepalive packet. + Timeout is in milliseconds. ****************************************************************************/ static ssize_t read_smb_length_return_keepalive(int fd,char *inbuf,unsigned int timeout) @@ -466,10 +466,10 @@ static ssize_t read_smb_length_return_keepalive(int fd,char *inbuf,unsigned int } /**************************************************************************** -read 4 bytes of a smb packet and return the smb length of the packet -store the result in the buffer. This version of the function will -never return a session keepalive (length of zero). -timeout is in milliseconds. + Read 4 bytes of a smb packet and return the smb length of the packet. + Store the result in the buffer. This version of the function will + never return a session keepalive (length of zero). + Timeout is in milliseconds. ****************************************************************************/ ssize_t read_smb_length(int fd,char *inbuf,unsigned int timeout) @@ -493,11 +493,10 @@ ssize_t read_smb_length(int fd,char *inbuf,unsigned int timeout) } /**************************************************************************** - read an smb from a fd. Note that the buffer *MUST* be of size - BUFFER_SIZE+SAFETY_MARGIN. - The timeout is in milliseconds. - This function will return on a - receipt of a session keepalive packet. + Read an smb from a fd. Note that the buffer *MUST* be of size + BUFFER_SIZE+SAFETY_MARGIN. + The timeout is in milliseconds. + This function will return on receipt of a session keepalive packet. ****************************************************************************/ BOOL receive_smb(int fd,char *buffer, unsigned int timeout) @@ -553,11 +552,19 @@ BOOL receive_smb(int fd,char *buffer, unsigned int timeout) } } + /* Check the incoming SMB signature. */ + if (!srv_check_sign_mac(buffer)) { + DEBUG(0, ("receive_smb: SMB Signature verification failed on incoming packet!\n")); + if (smb_read_error == 0) + smb_read_error = READ_BAD_SIG; + return False; + }; + return(True); } /**************************************************************************** - send an smb to a fd + Send an smb to a fd. ****************************************************************************/ BOOL send_smb(int fd,char *buffer) @@ -565,6 +572,10 @@ BOOL send_smb(int fd,char *buffer) size_t len; size_t nwritten=0; ssize_t ret; + + /* Sign the outgoing packet if required. */ + srv_calculate_sign_mac(buffer); + len = smb_len(buffer) + 4; while (nwritten < len) { @@ -647,80 +658,86 @@ int open_socket_in( int type, int port, int dlevel, uint32 socket_addr, BOOL reb } /**************************************************************************** - create an outgoing socket. timeout is in milliseconds. - **************************************************************************/ + Create an outgoing socket. timeout is in milliseconds. +**************************************************************************/ int open_socket_out(int type, struct in_addr *addr, int port ,int timeout) { - struct sockaddr_in sock_out; - int res,ret; - int connect_loop = 10; - int increment = 10; + struct sockaddr_in sock_out; + int res,ret; + int connect_loop = 10; + int increment = 10; - /* create a socket to write to */ - res = socket(PF_INET, type, 0); - if (res == -1) - { DEBUG(0,("socket error\n")); return -1; } + /* create a socket to write to */ + res = socket(PF_INET, type, 0); + if (res == -1) { + DEBUG(0,("socket error\n")); + return -1; + } - if (type != SOCK_STREAM) return(res); + if (type != SOCK_STREAM) + return(res); - memset((char *)&sock_out,'\0',sizeof(sock_out)); - putip((char *)&sock_out.sin_addr,(char *)addr); + memset((char *)&sock_out,'\0',sizeof(sock_out)); + putip((char *)&sock_out.sin_addr,(char *)addr); - sock_out.sin_port = htons( port ); - sock_out.sin_family = PF_INET; + sock_out.sin_port = htons( port ); + sock_out.sin_family = PF_INET; - /* set it non-blocking */ - set_blocking(res,False); + /* set it non-blocking */ + set_blocking(res,False); - DEBUG(3,("Connecting to %s at port %d\n",inet_ntoa(*addr),port)); + DEBUG(3,("Connecting to %s at port %d\n",inet_ntoa(*addr),port)); - /* and connect it to the destination */ -connect_again: - ret = connect(res,(struct sockaddr *)&sock_out,sizeof(sock_out)); - - /* Some systems return EAGAIN when they mean EINPROGRESS */ - if (ret < 0 && (errno == EINPROGRESS || errno == EALREADY || - errno == EAGAIN) && (connect_loop < timeout) ) { - msleep(connect_loop); - connect_loop += increment; - if (increment < 250) { - /* After 8 rounds we end up at a max of 255 msec */ - increment *= 1.5; - } - goto connect_again; - } - - if (ret < 0 && (errno == EINPROGRESS || errno == EALREADY || - errno == EAGAIN)) { - DEBUG(1,("timeout connecting to %s:%d\n",inet_ntoa(*addr),port)); - close(res); - return -1; - } + /* and connect it to the destination */ + connect_again: + + ret = connect(res,(struct sockaddr *)&sock_out,sizeof(sock_out)); + + /* Some systems return EAGAIN when they mean EINPROGRESS */ + if (ret < 0 && (errno == EINPROGRESS || errno == EALREADY || + errno == EAGAIN) && (connect_loop < timeout) ) { + msleep(connect_loop); + connect_loop += increment; + if (increment < 250) { + /* After 8 rounds we end up at a max of 255 msec */ + increment *= 1.5; + } + goto connect_again; + } + + if (ret < 0 && (errno == EINPROGRESS || errno == EALREADY || + errno == EAGAIN)) { + DEBUG(1,("timeout connecting to %s:%d\n",inet_ntoa(*addr),port)); + close(res); + return -1; + } #ifdef EISCONN - if (ret < 0 && errno == EISCONN) { - errno = 0; - ret = 0; - } + + if (ret < 0 && errno == EISCONN) { + errno = 0; + ret = 0; + } #endif - if (ret < 0) { - DEBUG(2,("error connecting to %s:%d (%s)\n", - inet_ntoa(*addr),port,strerror(errno))); - close(res); - return -1; - } + if (ret < 0) { + DEBUG(2,("error connecting to %s:%d (%s)\n", + inet_ntoa(*addr),port,strerror(errno))); + close(res); + return -1; + } - /* set it blocking again */ - set_blocking(res,True); + /* set it blocking again */ + set_blocking(res,True); - return res; + return res; } -/* - open a connected UDP socket to host on port -*/ +/**************************************************************************** + Open a connected UDP socket to host on port +**************************************************************************/ + int open_udp_socket(const char *host, int port) { int type = SOCK_DGRAM; @@ -783,9 +800,10 @@ struct in_addr *client_inaddr(struct sockaddr *sa) } /******************************************************************* - matchname - determine if host name matches IP address. Used to - confirm a hostname lookup to prevent spoof attacks - ******************************************************************/ + Matchname - determine if host name matches IP address. Used to + confirm a hostname lookup to prevent spoof attacks. +******************************************************************/ + static BOOL matchname(char *remotehost,struct in_addr addr) { struct hostent *hp; @@ -828,10 +846,10 @@ static BOOL matchname(char *remotehost,struct in_addr addr) return False; } - /******************************************************************* - return the DNS name of the remote end of a socket - ******************************************************************/ + Return the DNS name of the remote end of a socket. +******************************************************************/ + char *get_socket_name(int fd, BOOL force_lookup) { static pstring name_buf; @@ -881,8 +899,9 @@ char *get_socket_name(int fd, BOOL force_lookup) } /******************************************************************* - return the IP addr of the remote end of a socket as a string + Return the IP addr of the remote end of a socket as a string. ******************************************************************/ + char *get_socket_addr(int fd) { struct sockaddr sa; @@ -906,7 +925,6 @@ char *get_socket_addr(int fd) return addr_buf; } - /******************************************************************* Create protected unix domain socket. @@ -968,7 +986,7 @@ int create_pipe_sock(const char *socket_dir, goto out_umask; } - snprintf(path, sizeof(path), "%s/%s", socket_dir, socket_name); + pstr_sprintf(path, "%s/%s", socket_dir, socket_name); unlink(path); memset(&sunaddr, 0, sizeof(sunaddr)); diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c index 96fbc3f124..7569a39e6a 100644 --- a/source3/lib/util_str.c +++ b/source3/lib/util_str.c @@ -181,7 +181,9 @@ int StrCaseCmp(const char *s, const char *t) { const char * ps, * pt; - pstring buf1, buf2; + size_t size; + smb_ucs2_t *buffer_s, *buffer_t; + int ret; for (ps = s, pt = t; ; ps++, pt++) { char us, ut; @@ -206,16 +208,25 @@ int StrCaseCmp(const char *s, const char *t) return +1; } - /* TODO: Don't do this with a fixed-length buffer. This could - * still be much more efficient. */ - /* TODO: Hardcode a char-by-char comparison for UTF-8, which - * can be much faster. */ - /* TODO: Test case for this! */ - - unix_strupper(ps, strlen(ps)+1, buf1, sizeof(buf1)); - unix_strupper(pt, strlen(pt)+1, buf2, sizeof(buf2)); - - return strcmp(buf1, buf2); + size = push_ucs2_allocate(&buffer_s, s); + if (size == (size_t)-1) { + return strcmp(s, t); + /* Not quite the right answer, but finding the right one + under this failure case is expensive, and it's pretty close */ + } + + size = push_ucs2_allocate(&buffer_t, t); + if (size == (size_t)-1) { + SAFE_FREE(buffer_s); + return strcmp(s, t); + /* Not quite the right answer, but finding the right one + under this failure case is expensive, and it's pretty close */ + } + + ret = strcasecmp_w(buffer_s, buffer_t); + SAFE_FREE(buffer_s); + SAFE_FREE(buffer_t); + return ret; } @@ -351,7 +362,7 @@ BOOL strisnormal(const char *s) NOTE: oldc and newc must be 7 bit characters **/ -void string_replace(char *s,char oldc,char newc) +void string_replace(pstring s,char oldc,char newc) { push_ucs2(NULL, tmpbuf,s, sizeof(tmpbuf), STR_TERMINATE); string_replace_w(tmpbuf, UCS2_CHAR(oldc), UCS2_CHAR(newc)); @@ -1155,21 +1166,6 @@ void strlower_m(char *s) unix_strlower(s,strlen(s)+1,s,strlen(s)+1); } -/** - Duplicate convert a string to lower case. -**/ - -char *strdup_lower(const char *s) -{ - char *t = strdup(s); - if (t == NULL) { - DEBUG(0, ("strdup_lower: Out of memory!\n")); - return NULL; - } - strlower_m(t); - return t; -} - /** Convert a string to upper case. **/ @@ -1194,21 +1190,6 @@ void strupper_m(char *s) unix_strupper(s,strlen(s)+1,s,strlen(s)+1); } -/** - Convert a string to upper case. -**/ - -char *strdup_upper(const char *s) -{ - char *t = strdup(s); - if (t == NULL) { - DEBUG(0, ("strdup_upper: Out of memory!\n")); - return NULL; - } - strupper_m(t); - return t; -} - /** Return a RFC2254 binary string representation of a buffer. Used in LDAP filters. @@ -1575,7 +1556,7 @@ int ipstr_list_parse(const char* ipstr_list, struct ip_service **ip_list) count = count_chars(ipstr_list, IPSTR_LIST_CHAR) + 1; if ( (*ip_list = (struct ip_service*)malloc(count * sizeof(struct ip_service))) == NULL ) { - DEBUG(0,("ipstr_list_parse: malloc failed for %d entries\n", count)); + DEBUG(0,("ipstr_list_parse: malloc failed for %lu entries\n", (unsigned long)count)); return 0; } diff --git a/source3/lib/util_unistr.c b/source3/lib/util_unistr.c index ae000fba02..fd51f3c57d 100644 --- a/source3/lib/util_unistr.c +++ b/source3/lib/util_unistr.c @@ -759,82 +759,6 @@ smb_ucs2_t *strstr_wa(const smb_ucs2_t *s, const char *ins) return NULL; } -/******************************************************************* -copy a string with max len -********************************************************************/ - -smb_ucs2_t *strncpy_wa(smb_ucs2_t *dest, const char *src, const size_t max) -{ - smb_ucs2_t *ucs2_src; - - if (!dest || !src) return NULL; - if (!(ucs2_src = acnv_uxu2(src))) - return NULL; - - strncpy_w(dest, ucs2_src, max); - SAFE_FREE(ucs2_src); - return dest; -} - -/******************************************************************* -convert and duplicate an ascii string -********************************************************************/ -smb_ucs2_t *strdup_wa(const char *src) -{ - return strndup_wa(src, 0); -} - -/* if len == 0 then duplicate the whole string */ -smb_ucs2_t *strndup_wa(const char *src, size_t len) -{ - smb_ucs2_t *dest, *s; - - s = acnv_dosu2(src); - if (!len) len = strlen_w(s); - dest = (smb_ucs2_t *)malloc((len + 1) * sizeof(smb_ucs2_t)); - if (!dest) { - DEBUG(0,("strdup_w: out of memory!\n")); - SAFE_FREE(s); - return NULL; - } - - memcpy(dest, src, len * sizeof(smb_ucs2_t)); - dest[len] = 0; - - SAFE_FREE(s); - return dest; -} - -/******************************************************************* -append a string of len bytes and add a terminator -********************************************************************/ - -smb_ucs2_t *strncat_wa(smb_ucs2_t *dest, const char *src, const size_t max) -{ - smb_ucs2_t *ucs2_src; - - if (!dest || !src) return NULL; - if (!(ucs2_src = acnv_uxu2(src))) - return NULL; - - strncat_w(dest, ucs2_src, max); - SAFE_FREE(ucs2_src); - return dest; -} - -smb_ucs2_t *strcat_wa(smb_ucs2_t *dest, const char *src) -{ - smb_ucs2_t *ucs2_src; - - if (!dest || !src) return NULL; - if (!(ucs2_src = acnv_uxu2(src))) - return NULL; - - strcat_w(dest, ucs2_src); - SAFE_FREE(ucs2_src); - return dest; -} - BOOL trim_string_wa(smb_ucs2_t *s, const char *front, const char *back) { diff --git a/source3/lib/util_uuid.c b/source3/lib/util_uuid.c index 83553ec28e..56f0ecd85b 100644 --- a/source3/lib/util_uuid.c +++ b/source3/lib/util_uuid.c @@ -2,7 +2,7 @@ * Unix SMB/CIFS implementation. * UUID server routines * Copyright (C) Theodore Ts'o 1996, 1997, - * Copyright (C) Jim McDonough 2002. + * Copyright (C) Jim McDonough 2002. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/source3/libads/authdata.c b/source3/libads/authdata.c index c554a02e90..50a9ef2718 100644 --- a/source3/libads/authdata.c +++ b/source3/libads/authdata.c @@ -1,7 +1,7 @@ /* Unix SMB/CIFS implementation. kerberos authorization data (PAC) utility library - Copyright (C) Jim McDonough 2003 + Copyright (C) Jim McDonough 2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by diff --git a/source3/libads/kerberos_verify.c b/source3/libads/kerberos_verify.c index 25b7f9d948..48b61cd1f2 100644 --- a/source3/libads/kerberos_verify.c +++ b/source3/libads/kerberos_verify.c @@ -60,13 +60,13 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, ZERO_STRUCTP(ap_rep); if (!secrets_init()) { - DEBUG(1,("secrets_init failed\n")); + DEBUG(1,("ads_verify_ticket: secrets_init failed\n")); return NT_STATUS_LOGON_FAILURE; } password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); if (!password_s) { - DEBUG(1,("failed to fetch machine password\n")); + DEBUG(1,("ads_verify_ticket: failed to fetch machine password\n")); return NT_STATUS_LOGON_FAILURE; } @@ -75,13 +75,13 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, ret = krb5_init_context(&context); if (ret) { - DEBUG(1,("krb5_init_context failed (%s)\n", error_message(ret))); + DEBUG(1,("ads_verify_ticket: krb5_init_context failed (%s)\n", error_message(ret))); return NT_STATUS_LOGON_FAILURE; } ret = krb5_set_default_realm(context, ads->auth.realm); if (ret) { - DEBUG(1,("krb5_set_default_realm failed (%s)\n", error_message(ret))); + DEBUG(1,("ads_verify_ticket: krb5_set_default_realm failed (%s)\n", error_message(ret))); sret = NT_STATUS_LOGON_FAILURE; goto out; } @@ -92,7 +92,7 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, ret = krb5_auth_con_init(context, &auth_context); if (ret) { - DEBUG(1,("krb5_auth_con_init failed (%s)\n", error_message(ret))); + DEBUG(1,("ads_verify_ticket: krb5_auth_con_init failed (%s)\n", error_message(ret))); sret = NT_STATUS_LOGON_FAILURE; goto out; } @@ -102,32 +102,31 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, asprintf(&host_princ_s, "HOST/%s@%s", myname, lp_realm()); ret = krb5_parse_name(context, host_princ_s, &host_princ); if (ret) { - DEBUG(1,("krb5_parse_name(%s) failed (%s)\n", host_princ_s, error_message(ret))); + DEBUG(1,("ads_verify_ticket: krb5_parse_name(%s) failed (%s)\n", + host_princ_s, error_message(ret))); sret = NT_STATUS_LOGON_FAILURE; goto out; } /* - * JRA. We must set the rcache and the allowed addresses in the auth_context - * here. This will prevent replay attacks and ensure the client has got a key from - * the correct IP address. + * JRA. We must set the rcache here. This will prevent replay attacks. */ ret = krb5_get_server_rcache(context, krb5_princ_component(context, host_princ, 0), &rcache); if (ret) { - DEBUG(1,("krb5_get_server_rcache failed (%s)\n", error_message(ret))); + DEBUG(1,("ads_verify_ticket: krb5_get_server_rcache failed (%s)\n", error_message(ret))); sret = NT_STATUS_LOGON_FAILURE; goto out; } ret = krb5_auth_con_setrcache(context, auth_context, rcache); if (ret) { - DEBUG(1,("krb5_auth_con_setrcache failed (%s)\n", error_message(ret))); + DEBUG(1,("ads_verify_ticket: krb5_auth_con_setrcache failed (%s)\n", error_message(ret))); sret = NT_STATUS_LOGON_FAILURE; goto out; } - /* Now we need to add the addresses.... JRA. */ + /* CIFS doesn't use addresses in tickets. This would breat NAT. JRA */ if (!(key = (krb5_keyblock *)malloc(sizeof(*key)))) { sret = NT_STATUS_NO_MEMORY; @@ -135,13 +134,22 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, } if ((ret = get_kerberos_allowed_etypes(context, &enctypes))) { - DEBUG(1,("krb5_get_permitted_enctypes failed (%s)\n", + DEBUG(1,("ads_verify_ticket: krb5_get_permitted_enctypes failed (%s)\n", error_message(ret))); sret = NT_STATUS_LOGON_FAILURE; goto out; } - /* we need to setup a auth context with each possible encoding type in turn */ + /* Lock a mutex surrounding the replay as there is no locking in the MIT krb5 + * code surrounding the replay cache... */ + + if (!grab_server_mutex("replay cache mutex")) { + DEBUG(1,("ads_verify_ticket: unable to protect replay cache with mutex.\n")); + sret = NT_STATUS_LOGON_FAILURE; + goto out; + } + + /* We need to setup a auth context with each possible encoding type in turn. */ for (i=0;enctypes[i];i++) { if (create_kerberos_key_from_string(context, host_princ, &password, key, enctypes[i])) { continue; @@ -154,14 +162,22 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, if (!(ret = krb5_rd_req(context, &auth_context, &packet, NULL, keytab, NULL, &tkt))) { + DEBUG(10,("ads_verify_ticket: enc type [%u] decrypted message !\n", + (unsigned int)enctypes[i] )); free_kerberos_etypes(context, enctypes); auth_ok = True; break; } + + DEBUG((ret != KRB5_BAD_ENCTYPE) ? 3 : 10, + ("ads_verify_ticket: enc type [%u] failed to decrypt with error %s\n", + (unsigned int)enctypes[i], error_message(ret))); } + release_server_mutex(); + if (!auth_ok) { - DEBUG(3,("krb5_rd_req with auth failed (%s)\n", + DEBUG(3,("ads_verify_ticket: krb5_rd_req with auth failed (%s)\n", error_message(ret))); sret = NT_STATUS_LOGON_FAILURE; goto out; @@ -169,7 +185,7 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, ret = krb5_mk_rep(context, auth_context, &packet); if (ret) { - DEBUG(3,("Failed to generate mutual authentication reply (%s)\n", + DEBUG(3,("ads_verify_ticket: Failed to generate mutual authentication reply (%s)\n", error_message(ret))); sret = NT_STATUS_LOGON_FAILURE; goto out; @@ -178,7 +194,7 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, *ap_rep = data_blob(packet.data, packet.length); free(packet.data); - get_krb5_smb_session_key(context, auth_context, session_key); + get_krb5_smb_session_key(context, auth_context, session_key, True); #ifdef DEBUG_PASSWORD DEBUG(10,("SMB session key (from ticket) follows:\n")); dump_data(10, session_key, 16); @@ -205,7 +221,7 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, if ((ret = krb5_unparse_name(context, get_principal_from_tkt(tkt), principal))) { - DEBUG(3,("krb5_unparse_name failed (%s)\n", + DEBUG(3,("ads_verify_ticket: krb5_unparse_name failed (%s)\n", error_message(ret))); sret = NT_STATUS_LOGON_FAILURE; goto out; diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c index cf6f9375f8..5a12288b16 100644 --- a/source3/libads/ldap.c +++ b/source3/libads/ldap.c @@ -3,7 +3,7 @@ ads (active directory) utility library Copyright (C) Andrew Tridgell 2001 Copyright (C) Remus Koos 2001 - Copyright (C) Jim McDonough 2002 + Copyright (C) Jim McDonough 2002 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -106,12 +106,24 @@ static BOOL ads_find_dc(ADS_STRUCT *ads) struct ip_service *ip_list; pstring realm; BOOL got_realm = False; + BOOL use_own_domain = False; + + /* if the realm and workgroup are both empty, assume they are ours */ /* realm */ c_realm = ads->server.realm; + + if ( !c_realm || !*c_realm ) { + /* special case where no realm and no workgroup means our own */ + if ( !ads->server.workgroup || !*ads->server.workgroup ) { + use_own_domain = True; + c_realm = lp_realm(); + } + } + if (c_realm && *c_realm) got_realm = True; - + again: /* we need to try once with the realm name and fallback to the netbios domain name if we fail (if netbios has not been disabled */ @@ -119,7 +131,12 @@ again: if ( !got_realm && !lp_disable_netbios() ) { c_realm = ads->server.workgroup; if (!c_realm || !*c_realm) { - DEBUG(0,("ads_find_dc: no realm or workgroup! Was the structure initialized?\n")); + if ( use_own_domain ) + c_realm = lp_workgroup(); + } + + if ( !c_realm || !*c_realm ) { + DEBUG(0,("ads_find_dc: no realm or workgroup! Don't know what to do\n")); return False; } } @@ -1871,77 +1888,6 @@ ADS_STATUS ads_server_info(ADS_STRUCT *ads) return ADS_SUCCESS; } - -/** - * find the list of trusted domains - * @param ads connection to ads server - * @param mem_ctx TALLOC_CTX for allocating results - * @param num_trusts pointer to number of trusts - * @param names pointer to trusted domain name list - * @param sids pointer to list of sids of trusted domains - * @return the count of SIDs pulled - **/ -ADS_STATUS ads_trusted_domains(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, - int *num_trusts, - char ***names, - char ***alt_names, - DOM_SID **sids) -{ - const char *attrs[] = {"name", "flatname", "securityIdentifier", - "trustDirection", NULL}; - ADS_STATUS status; - void *res, *msg; - int count, i; - - *num_trusts = 0; - - status = ads_search(ads, &res, "(objectcategory=trustedDomain)", attrs); - if (!ADS_ERR_OK(status)) return status; - - count = ads_count_replies(ads, res); - if (count == 0) { - ads_msgfree(ads, res); - return ADS_ERROR(LDAP_NO_RESULTS_RETURNED); - } - - (*names) = talloc(mem_ctx, sizeof(char *) * count); - (*alt_names) = talloc(mem_ctx, sizeof(char *) * count); - (*sids) = talloc(mem_ctx, sizeof(DOM_SID) * count); - if (! *names || ! *sids) return ADS_ERROR(LDAP_NO_MEMORY); - - for (i=0, msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) { - uint32 direction; - - /* direction is a 2 bit bitfield, 1 means they trust us - but we don't trust them, so we should not list them - as users from that domain can't login */ - if (ads_pull_uint32(ads, msg, "trustDirection", &direction) && - direction == 1) { - continue; - } - - (*names)[i] = ads_pull_string(ads, mem_ctx, msg, "name"); - (*alt_names)[i] = ads_pull_string(ads, mem_ctx, msg, "flatname"); - - if ((*alt_names)[i] && (*alt_names)[i][0]) { - /* we prefer the flatname as the primary name - for consistency with RPC */ - char *name = (*alt_names)[i]; - (*alt_names)[i] = (*names)[i]; - (*names)[i] = name; - } - if (ads_pull_sid(ads, msg, "securityIdentifier", &(*sids)[i])) { - i++; - } - } - - ads_msgfree(ads, res); - - *num_trusts = i; - - return ADS_SUCCESS; -} - /** * find the domain sid for our domain * @param ads connection to ads server diff --git a/source3/libads/ldap_printer.c b/source3/libads/ldap_printer.c index b650a5eb38..1448074ea0 100644 --- a/source3/libads/ldap_printer.c +++ b/source3/libads/ldap_printer.c @@ -1,7 +1,7 @@ /* Unix SMB/CIFS implementation. ads (active directory) printer utility library - Copyright (C) Jim McDonough 2002 + Copyright (C) Jim McDonough 2002 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by diff --git a/source3/libads/ldap_user.c b/source3/libads/ldap_user.c index e70249dd78..56a0d8013b 100644 --- a/source3/libads/ldap_user.c +++ b/source3/libads/ldap_user.c @@ -1,7 +1,7 @@ /* Unix SMB/CIFS implementation. ads (active directory) utility library - Copyright (C) Jim McDonough 2002 + Copyright (C) Jim McDonough 2002 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c index 598208b17f..910ff3f4dc 100644 --- a/source3/libads/sasl.c +++ b/source3/libads/sasl.c @@ -124,9 +124,10 @@ static ADS_STATUS ads_sasl_spnego_krb5_bind(ADS_STRUCT *ads, const char *princip { DATA_BLOB blob; struct berval cred, *scred; + unsigned char sk[16]; int rc; - blob = spnego_gen_negTokenTarg(principal, ads->auth.time_offset); + blob = spnego_gen_negTokenTarg(principal, ads->auth.time_offset, sk); if (!blob.data) { return ADS_ERROR(LDAP_OPERATIONS_ERROR); diff --git a/source3/libsmb/asn1.c b/source3/libsmb/asn1.c index 09d4fbb6c9..576491dd3b 100644 --- a/source3/libsmb/asn1.c +++ b/source3/libsmb/asn1.c @@ -322,9 +322,9 @@ BOOL asn1_read_OID(ASN1_DATA *data, char **OID) asn1_read_uint8(data, &b); oid[0] = 0; - snprintf(el, sizeof(el), "%u", b/40); + fstr_sprintf(el, "%u", b/40); pstrcat(oid, el); - snprintf(el, sizeof(el), " %u", b%40); + fstr_sprintf(el, " %u", b%40); pstrcat(oid, el); while (asn1_tag_remaining(data) > 0) { @@ -333,7 +333,7 @@ BOOL asn1_read_OID(ASN1_DATA *data, char **OID) asn1_read_uint8(data, &b); v = (v<<7) | (b&0x7f); } while (!data->has_error && b & 0x80); - snprintf(el, sizeof(el), " %u", v); + fstr_sprintf(el, " %u", v); pstrcat(oid, el); } diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c index fa9af19bf5..94fe04a480 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c @@ -190,7 +190,7 @@ static BOOL cli_session_setup_plaintext(struct cli_state *cli, const char *user, char *p; fstring lanman; - snprintf( lanman, sizeof(lanman), "Samba %s", VERSION ); + fstr_sprintf( lanman, "Samba %s", VERSION ); set_message(cli->outbuf,13,0,True); SCVAL(cli->outbuf,smb_com,SMBsesssetupX); @@ -301,7 +301,7 @@ static BOOL cli_session_setup_nt1(struct cli_state *cli, const char *user, lm_response = data_blob(NULL, 24); SMBencrypt(pass,cli->secblob.data, lm_response.data); } else { - /* LM disabled, place NT# in LM feild instead */ + /* LM disabled, place NT# in LM field instead */ lm_response = data_blob(nt_response.data, nt_response.length); } @@ -472,6 +472,7 @@ static DATA_BLOB cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob) /**************************************************************************** Use in-memory credentials cache ****************************************************************************/ + static void use_in_memory_ccache(void) { setenv(KRB5_ENV_CCNAME, "MEMORY:cliconnect", 1); } @@ -483,18 +484,23 @@ static void use_in_memory_ccache(void) { static BOOL cli_session_setup_kerberos(struct cli_state *cli, const char *principal, const char *workgroup) { DATA_BLOB blob2, negTokenTarg; - + unsigned char session_key_krb5[16]; + DATA_BLOB null_blob = data_blob(NULL, 0); + DEBUG(2,("Doing kerberos session setup\n")); /* generate the encapsulated kerberos5 ticket */ - negTokenTarg = spnego_gen_negTokenTarg(principal, 0); + negTokenTarg = spnego_gen_negTokenTarg(principal, 0, session_key_krb5); - if (!negTokenTarg.data) return False; + if (!negTokenTarg.data) + return False; #if 0 file_save("negTokenTarg.dat", negTokenTarg.data, negTokenTarg.length); #endif + cli_simple_set_signing(cli, session_key_krb5, null_blob); + blob2 = cli_session_setup_blob(cli, negTokenTarg); /* we don't need this blob for kerberos */ @@ -551,7 +557,7 @@ static BOOL cli_session_setup_ntlmssp(struct cli_state *cli, const char *user, blob_in, &blob_out); data_blob_free(&blob_in); if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { - DATA_BLOB null = data_blob(NULL, 0); + DATA_BLOB null_blob = data_blob(NULL, 0); if (turn == 1) { /* and wrap it in a SPNEGO wrapper */ msg1 = gen_negTokenInit(OID_NTLMSSP, blob_out); @@ -562,7 +568,7 @@ static BOOL cli_session_setup_ntlmssp(struct cli_state *cli, const char *user, cli_simple_set_signing(cli, ntlmssp_state->session_key.data, - null); + null_blob); /* now send that blob on its way */ if (!cli_session_setup_blob_send(cli, msg1)) { @@ -630,7 +636,7 @@ static BOOL cli_session_setup_spnego(struct cli_state *cli, const char *user, BOOL got_kerberos_mechanism = False; DATA_BLOB blob; - DEBUG(2,("Doing spnego session setup (blob length=%d)\n", cli->secblob.length)); + DEBUG(2,("Doing spnego session setup (blob length=%lu)\n", (unsigned long)cli->secblob.length)); /* the server might not even do spnego */ if (cli->secblob.length <= 16) { @@ -989,6 +995,11 @@ BOOL cli_negprot(struct cli_state *cli) cli->protocol = prots[SVAL(cli->inbuf,smb_vwv0)].prot; + if ((cli->protocol < PROTOCOL_NT1) && cli->sign_info.mandatory_signing) { + DEBUG(1,("cli_negprot: SMB signing is mandatory and the selected protocol level doesn't support it.\n")); + return False; + } + if (cli->protocol >= PROTOCOL_NT1) { /* NT protocol */ cli->sec_mode = CVAL(cli->inbuf,smb_vwv1); @@ -1015,7 +1026,7 @@ BOOL cli_negprot(struct cli_state *cli) if ((cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED)) { /* Fail if signing is mandatory and we don't want to support it. */ - if (!lp_client_signing()) { + if (!cli->sign_info.allow_smb_signing) { DEBUG(1,("cli_negprot: SMB signing is mandatory and we have disabled it.\n")); return False; } @@ -1248,6 +1259,7 @@ NTSTATUS cli_full_connection(struct cli_state **output_cli, const char *service, const char *service_type, const char *user, const char *domain, const char *password, int flags, + int signing_state, BOOL *retry) { struct ntuser_creds creds; @@ -1310,6 +1322,8 @@ again: return NT_STATUS_UNSUCCESSFUL; } + cli_setup_signing_state(cli, signing_state); + if (flags & CLI_FULL_CONNECTION_DONT_SPNEGO) cli->use_spnego = False; else if (flags & CLI_FULL_CONNECTION_USE_KERBEROS) @@ -1480,7 +1494,7 @@ struct cli_state *get_ipc_connect(char *server, struct in_addr *server_ip, nt_status = cli_full_connection(&cli, myname, server, server_ip, 0, "IPC$", "IPC", user_info->username, lp_workgroup(), user_info->password, - CLI_FULL_CONNECTION_ANNONYMOUS_FALLBACK, NULL); + CLI_FULL_CONNECTION_ANNONYMOUS_FALLBACK, Undefined, NULL); if (NT_STATUS_IS_OK(nt_status)) { return cli; diff --git a/source3/libsmb/clientgen.c b/source3/libsmb/clientgen.c index 58c5ad8cd3..bc5f1462cc 100644 --- a/source3/libsmb/clientgen.c +++ b/source3/libsmb/clientgen.c @@ -141,7 +141,7 @@ BOOL cli_send_smb(struct cli_state *cli) if (cli->fd == -1) return False; - cli_caclulate_sign_mac(cli); + cli_calculate_sign_mac(cli); len = smb_len(cli->outbuf) + 4; @@ -157,6 +157,10 @@ BOOL cli_send_smb(struct cli_state *cli) } nwritten += ret; } + /* Increment the mid so we can tell between responses. */ + cli->mid++; + if (!cli->mid) + cli->mid++; return True; } @@ -208,6 +212,27 @@ void cli_init_creds(struct cli_state *cli, const struct ntuser_creds *usr) cli->user_name, cli->domain)); } +/**************************************************************************** + Set the signing state (used from the command line). +****************************************************************************/ + +void cli_setup_signing_state(struct cli_state *cli, int signing_state) +{ + if (signing_state == Undefined) + return; + + if (signing_state == False) { + cli->sign_info.allow_smb_signing = False; + cli->sign_info.mandatory_signing = False; + return; + } + + cli->sign_info.allow_smb_signing = True; + + if (signing_state == Required) + cli->sign_info.mandatory_signing = True; +} + /**************************************************************************** Initialise a client structure. ****************************************************************************/ diff --git a/source3/libsmb/clierror.c b/source3/libsmb/clierror.c index 9ee181a90f..c27e1955e2 100644 --- a/source3/libsmb/clierror.c +++ b/source3/libsmb/clierror.c @@ -108,7 +108,7 @@ const char *cli_errstr(struct cli_state *cli) break; case READ_BAD_SIG: slprintf(cli_error_message, sizeof(cli_error_message) - 1, - "Server packet had invalid SMB signiture!"); + "Server packet had invalid SMB signature!"); break; default: slprintf(cli_error_message, sizeof(cli_error_message) - 1, @@ -371,6 +371,9 @@ BOOL cli_is_error(struct cli_state *cli) { uint32 flgs2 = SVAL(cli->inbuf,smb_flg2), rcls = 0; + if (cli->fd == -1 && cli->smb_rw_error != 0) + return True; + if (flgs2 & FLAGS2_32_BIT_ERROR_CODES) { /* Return error is error bits are set */ rcls = IVAL(cli->inbuf, smb_rcls); diff --git a/source3/libsmb/clikrb5.c b/source3/libsmb/clikrb5.c index fd5dd91325..beac8cb2c1 100644 --- a/source3/libsmb/clikrb5.c +++ b/source3/libsmb/clikrb5.c @@ -305,7 +305,7 @@ cleanup_princ: /* get a kerberos5 ticket for the given service */ -DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset) +DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset, unsigned char session_key_krb5[16]) { krb5_error_code retval; krb5_data packet; @@ -345,13 +345,15 @@ DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset) } if ((retval = ads_krb5_mk_req(context, - &auth_context, - 0, - principal, - ccdef, &packet))) { + &auth_context, + AP_OPTS_USE_SUBKEY, + principal, + ccdef, &packet))) { goto failed; } + get_krb5_smb_session_key(context, auth_context, session_key_krb5, False); + ret = data_blob(packet.data, packet.length); /* Hmm, heimdal dooesn't have this - what's the correct call? */ /* krb5_free_data_contents(context, &packet); */ @@ -365,17 +367,22 @@ failed: return data_blob(NULL, 0); } - BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, uint8 session_key[16]) + BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, uint8 session_key[16], BOOL remote) { #ifdef ENCTYPE_ARCFOUR_HMAC krb5_keyblock *skey; #endif BOOL ret = False; + krb5_error_code err; memset(session_key, 0, 16); #ifdef ENCTYPE_ARCFOUR_HMAC - if (krb5_auth_con_getremotesubkey(context, auth_context, &skey) == 0 && skey != NULL) { + if (remote) + err = krb5_auth_con_getremotesubkey(context, auth_context, &skey); + else + err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey); + if (err == 0 && skey != NULL) { if (KRB5_KEY_TYPE(skey) == ENCTYPE_ARCFOUR_HMAC && KRB5_KEY_LENGTH(skey) == 16) { @@ -388,9 +395,22 @@ failed: return ret; } + + +#if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT) + const krb5_data *krb5_princ_component(krb5_context context, krb5_principal principal, int i ) +{ + static krb5_data kdata; + + kdata.data = krb5_principal_get_comp_string(context, principal, i); + kdata.length = strlen(kdata.data); + return &kdata; +} +#endif + #else /* HAVE_KRB5 */ /* this saves a few linking headaches */ -DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset) +DATA_BLOB cli_krb5_get_ticket(const char *principal, time_t time_offset, unsigned char session_key_krb5[16]) { DEBUG(0,("NO KERBEROS SUPPORT\n")); return data_blob(NULL, 0); diff --git a/source3/libsmb/clilist.c b/source3/libsmb/clilist.c index 5bd1283ab7..7822987ada 100644 --- a/source3/libsmb/clilist.c +++ b/source3/libsmb/clilist.c @@ -101,13 +101,20 @@ static int interpret_long_filename(struct cli_state *cli, cheap to calculate, I suppose, as no DST tables will be needed */ - finfo->ctime = interpret_long_date(p); p += 8; - finfo->atime = interpret_long_date(p); p += 8; - finfo->mtime = interpret_long_date(p); p += 8; p += 8; - finfo->size = IVAL2_TO_SMB_BIG_UINT(p,0); p += 8; + finfo->ctime = interpret_long_date(p); + p += 8; + finfo->atime = interpret_long_date(p); + p += 8; + finfo->mtime = interpret_long_date(p); + p += 8; + p += 8; + finfo->size = IVAL2_TO_SMB_BIG_UINT(p,0); + p += 8; p += 8; /* alloc size */ - finfo->mode = CVAL(p,0); p += 4; - namelen = IVAL(p,0); p += 4; + finfo->mode = CVAL(p,0); + p += 4; + namelen = IVAL(p,0); + p += 4; p += 4; /* EA size */ slen = SVAL(p, 0); p += 2; @@ -138,7 +145,11 @@ static int interpret_long_filename(struct cli_state *cli, int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute, void (*fn)(file_info *, const char *, void *), void *state) { +#if 0 + int max_matches = 1366; /* Match W2k - was 512. */ +#else int max_matches = 512; +#endif int info_level; char *p, *p2; pstring mask; @@ -200,7 +211,12 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute, &setup, 1, 0, /* setup, length, max */ param, param_len, 10, /* param, length, max */ NULL, 0, - cli->max_xmit /* data, length, max */ +#if 0 + /* w2k value. */ + MIN(16384,cli->max_xmit) /* data, length, max. */ +#else + cli->max_xmit /* data, length, max. */ +#endif )) { break; } @@ -214,7 +230,8 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute, uint8 eclass; uint32 ecode; cli_dos_error(cli, &eclass, &ecode); - if (eclass != ERRSRV || ecode != ERRerror) break; + if (eclass != ERRSRV || ecode != ERRerror) + break; msleep(100); continue; } @@ -222,7 +239,8 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute, if (cli_is_error(cli) || !rdata || !rparam) break; - if (total_received == -1) total_received = 0; + if (total_received == -1) + total_received = 0; /* parse out some important return info */ p = rparam; @@ -245,8 +263,7 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute, /* we might need the lastname for continuations */ if (ff_lastname > 0) { - switch(info_level) - { + switch(info_level) { case 260: clistr_pull(cli, mask, p+ff_lastname, sizeof(mask), @@ -270,8 +287,9 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute, if (!tdl) { DEBUG(0,("cli_list_new: Failed to expand dirlist\n")); break; + } else { + dirlist = tdl; } - else dirlist = tdl; /* put in a length for the last entry, to ensure we can chain entries into the next packet */ @@ -291,7 +309,8 @@ int cli_list_new(struct cli_state *cli,const char *Mask,uint16 attribute, DEBUG(3,("received %d entries (eos=%d)\n", ff_searchcount,ff_eos)); - if (ff_searchcount > 0) loop_count = 0; + if (ff_searchcount > 0) + loop_count = 0; First = False; } diff --git a/source3/libsmb/cliprint.c b/source3/libsmb/cliprint.c index bfa33bc514..f302c045a5 100644 --- a/source3/libsmb/cliprint.c +++ b/source3/libsmb/cliprint.c @@ -65,16 +65,16 @@ int cli_print_queue(struct cli_state *cli, p = param; SSVAL(p,0,76); /* API function number 76 (DosPrintJobEnum) */ p += 2; - pstrcpy(p,"zWrLeh"); /* parameter description? */ + pstrcpy_base(p,"zWrLeh", param); /* parameter description? */ p = skip_string(p,1); - pstrcpy(p,"WWzWWDDzz"); /* returned data format */ + pstrcpy_base(p,"WWzWWDDzz", param); /* returned data format */ p = skip_string(p,1); - pstrcpy(p,cli->share); /* name of queue */ + pstrcpy_base(p,cli->share, param); /* name of queue */ p = skip_string(p,1); SSVAL(p,0,2); /* API function level 2, PRJINFO_2 data structure */ SSVAL(p,2,1000); /* size of bytes of returned data buffer */ p += 4; - pstrcpy(p,""); /* subformat */ + pstrcpy_base(p,"", param); /* subformat */ p = skip_string(p,1); DEBUG(4,("doing cli_print_queue for %s\n", cli->share)); @@ -133,9 +133,9 @@ int cli_printjob_del(struct cli_state *cli, int job) p = param; SSVAL(p,0,81); /* DosPrintJobDel() */ p += 2; - pstrcpy(p,"W"); + pstrcpy_base(p,"W", param); p = skip_string(p,1); - pstrcpy(p,""); + pstrcpy_base(p,"", param); p = skip_string(p,1); SSVAL(p,0,job); p += 2; diff --git a/source3/libsmb/clispnego.c b/source3/libsmb/clispnego.c index bb48f57915..b0570b09b6 100644 --- a/source3/libsmb/clispnego.c +++ b/source3/libsmb/clispnego.c @@ -2,7 +2,7 @@ Unix SMB/CIFS implementation. simple kerberos5/SPNEGO routines Copyright (C) Andrew Tridgell 2001 - Copyright (C) Jim McDonough 2002 + Copyright (C) Jim McDonough 2002 Copyright (C) Luke Howard 2003 This program is free software; you can redistribute it and/or modify @@ -323,13 +323,13 @@ BOOL spnego_parse_krb5_wrap(DATA_BLOB blob, DATA_BLOB *ticket, uint8 tok_id[2]) generate a SPNEGO negTokenTarg packet, ready for a EXTENDED_SECURITY kerberos session setup */ -DATA_BLOB spnego_gen_negTokenTarg(const char *principal, int time_offset) +DATA_BLOB spnego_gen_negTokenTarg(const char *principal, int time_offset, unsigned char session_key_krb5[16]) { DATA_BLOB tkt, tkt_wrapped, targ; const char *krb_mechs[] = {OID_KERBEROS5_OLD, OID_NTLMSSP, NULL}; - /* get a kerberos ticket for the service */ - tkt = cli_krb5_get_ticket(principal, time_offset); + /* get a kerberos ticket for the service and extract the session key */ + tkt = cli_krb5_get_ticket(principal, time_offset, session_key_krb5); /* wrap that up in a nice GSS-API wrapping */ tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ); diff --git a/source3/libsmb/clitrans.c b/source3/libsmb/clitrans.c index 3d3cd427d7..e6771ac688 100644 --- a/source3/libsmb/clitrans.c +++ b/source3/libsmb/clitrans.c @@ -40,6 +40,7 @@ BOOL cli_send_trans(struct cli_state *cli, int trans, char *outdata,*outparam; char *p; int pipe_name_len=0; + uint16 mid; this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */ this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam)); @@ -49,6 +50,7 @@ BOOL cli_send_trans(struct cli_state *cli, int trans, SCVAL(cli->outbuf,smb_com,trans); SSVAL(cli->outbuf,smb_tid, cli->cnum); cli_setup_packet(cli); + mid = cli->mid; if (pipe_name) { pipe_name_len = clistr_push(cli, smb_buf(cli->outbuf), pipe_name, -1, STR_TERMINATE); @@ -84,13 +86,19 @@ BOOL cli_send_trans(struct cli_state *cli, int trans, cli_setup_bcc(cli, outdata+this_ldata); show_msg(cli->outbuf); - if (!cli_send_smb(cli)) + + cli_signing_trans_start(cli); + if (!cli_send_smb(cli)) { + cli_signing_trans_stop(cli); return False; + } if (this_ldata < ldata || this_lparam < lparam) { /* receive interim response */ - if (!cli_receive_smb(cli) || cli_is_error(cli)) + if (!cli_receive_smb(cli) || cli_is_error(cli)) { + cli_signing_trans_stop(cli); return(False); + } tot_data = this_ldata; tot_param = this_lparam; @@ -122,9 +130,15 @@ BOOL cli_send_trans(struct cli_state *cli, int trans, memcpy(outdata,data+tot_data,this_ldata); cli_setup_bcc(cli, outdata+this_ldata); + /* Ensure this packet has the same MID as + * the primary. Important in signing. JRA. */ + cli->mid = mid; + show_msg(cli->outbuf); - if (!cli_send_smb(cli)) + if (!cli_send_smb(cli)) { + cli_signing_trans_stop(cli); return False; + } tot_data += this_ldata; tot_param += this_lparam; @@ -151,8 +165,10 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, *data_len = *param_len = 0; - if (!cli_receive_smb(cli)) + if (!cli_receive_smb(cli)) { + cli_signing_trans_stop(cli); return False; + } show_msg(cli->inbuf); @@ -161,6 +177,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, DEBUG(0,("Expected %s response, got command 0x%02x\n", trans==SMBtrans?"SMBtrans":"SMBtrans2", CVAL(cli->inbuf,smb_com))); + cli_signing_trans_stop(cli); return(False); } @@ -171,8 +188,10 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, */ status = cli_nt_error(cli); - if (NT_STATUS_IS_ERR(status)) + if (NT_STATUS_IS_ERR(status)) { + cli_signing_trans_stop(cli); return False; + } /* parse out the lengths */ total_data = SVAL(cli->inbuf,smb_tdrcnt); @@ -183,6 +202,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, tdata = Realloc(*data,total_data); if (!tdata) { DEBUG(0,("cli_receive_trans: failed to enlarge data buffer\n")); + cli_signing_trans_stop(cli); return False; } else @@ -193,6 +213,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, tparam = Realloc(*param,total_param); if (!tparam) { DEBUG(0,("cli_receive_trans: failed to enlarge param buffer\n")); + cli_signing_trans_stop(cli); return False; } else @@ -206,6 +227,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, if (this_data + *data_len > total_data || this_param + *param_len > total_param) { DEBUG(1,("Data overflow in cli_receive_trans\n")); + cli_signing_trans_stop(cli); return False; } @@ -214,6 +236,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, this_param + *param_len < this_param || this_param + *param_len < *param_len) { DEBUG(1,("Data overflow in cli_receive_trans\n")); + cli_signing_trans_stop(cli); return False; } @@ -226,6 +249,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, data_offset_out + this_data < data_offset_out || data_offset_out + this_data < this_data) { DEBUG(1,("Data overflow in cli_receive_trans\n")); + cli_signing_trans_stop(cli); return False; } if (data_offset_in > cli->bufsize || @@ -233,6 +257,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, data_offset_in + this_data < data_offset_in || data_offset_in + this_data < this_data) { DEBUG(1,("Data overflow in cli_receive_trans\n")); + cli_signing_trans_stop(cli); return False; } @@ -247,6 +272,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, param_offset_out + this_param < param_offset_out || param_offset_out + this_param < this_param) { DEBUG(1,("Param overflow in cli_receive_trans\n")); + cli_signing_trans_stop(cli); return False; } if (param_offset_in > cli->bufsize || @@ -254,6 +280,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, param_offset_in + this_param < param_offset_in || param_offset_in + this_param < this_param) { DEBUG(1,("Param overflow in cli_receive_trans\n")); + cli_signing_trans_stop(cli); return False; } @@ -265,8 +292,10 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, if (total_data <= *data_len && total_param <= *param_len) break; - if (!cli_receive_smb(cli)) - return False; + if (!cli_receive_smb(cli)) { + cli_signing_trans_stop(cli); + return False; + } show_msg(cli->inbuf); @@ -275,9 +304,11 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, DEBUG(0,("Expected %s response, got command 0x%02x\n", trans==SMBtrans?"SMBtrans":"SMBtrans2", CVAL(cli->inbuf,smb_com))); + cli_signing_trans_stop(cli); return(False); } if (NT_STATUS_IS_ERR(cli_nt_error(cli))) { + cli_signing_trans_stop(cli); return(False); } @@ -292,6 +323,7 @@ BOOL cli_receive_trans(struct cli_state *cli,int trans, } + cli_signing_trans_stop(cli); return(True); } @@ -309,6 +341,7 @@ BOOL cli_send_nt_trans(struct cli_state *cli, unsigned int i; unsigned int this_ldata,this_lparam; unsigned int tot_data=0,tot_param=0; + uint16 mid; char *outdata,*outparam; this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */ @@ -319,6 +352,7 @@ BOOL cli_send_nt_trans(struct cli_state *cli, SCVAL(cli->outbuf,smb_com,SMBnttrans); SSVAL(cli->outbuf,smb_tid, cli->cnum); cli_setup_packet(cli); + mid = cli->mid; outparam = smb_buf(cli->outbuf)+3; outdata = outparam+this_lparam; @@ -347,13 +381,18 @@ BOOL cli_send_nt_trans(struct cli_state *cli, cli_setup_bcc(cli, outdata+this_ldata); show_msg(cli->outbuf); - if (!cli_send_smb(cli)) + cli_signing_trans_start(cli); + if (!cli_send_smb(cli)) { + cli_signing_trans_stop(cli); return False; + } if (this_ldata < ldata || this_lparam < lparam) { /* receive interim response */ - if (!cli_receive_smb(cli) || cli_is_error(cli)) + if (!cli_receive_smb(cli) || cli_is_error(cli)) { + cli_signing_trans_stop(cli); return(False); + } tot_data = this_ldata; tot_param = this_lparam; @@ -384,9 +423,16 @@ BOOL cli_send_nt_trans(struct cli_state *cli, memcpy(outdata,data+tot_data,this_ldata); cli_setup_bcc(cli, outdata+this_ldata); + /* Ensure this packet has the same MID as + * the primary. Important in signing. JRA. */ + cli->mid = mid; + show_msg(cli->outbuf); - if (!cli_send_smb(cli)) + + if (!cli_send_smb(cli)) { + cli_signing_trans_stop(cli); return False; + } tot_data += this_ldata; tot_param += this_lparam; @@ -396,8 +442,6 @@ BOOL cli_send_nt_trans(struct cli_state *cli, return(True); } - - /**************************************************************************** receive a SMB nttrans response allocating the necessary memory ****************************************************************************/ @@ -416,8 +460,10 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, *data_len = *param_len = 0; - if (!cli_receive_smb(cli)) + if (!cli_receive_smb(cli)) { + cli_signing_trans_stop(cli); return False; + } show_msg(cli->inbuf); @@ -425,6 +471,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, if (CVAL(cli->inbuf,smb_com) != SMBnttrans) { DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n", CVAL(cli->inbuf,smb_com))); + cli_signing_trans_stop(cli); return(False); } @@ -435,8 +482,10 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, */ if (cli_is_dos_error(cli)) { cli_dos_error(cli, &eclass, &ecode); - if (cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata)) + if (cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata)) { + cli_signing_trans_stop(cli); return(False); + } } /* parse out the lengths */ @@ -448,6 +497,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, tdata = Realloc(*data,total_data); if (!tdata) { DEBUG(0,("cli_receive_nt_trans: failed to enlarge data buffer to %d\n",total_data)); + cli_signing_trans_stop(cli); return False; } else { *data = tdata; @@ -458,6 +508,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, tparam = Realloc(*param,total_param); if (!tparam) { DEBUG(0,("cli_receive_nt_trans: failed to enlarge param buffer to %d\n", total_param)); + cli_signing_trans_stop(cli); return False; } else { *param = tparam; @@ -471,6 +522,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, if (this_data + *data_len > total_data || this_param + *param_len > total_param) { DEBUG(1,("Data overflow in cli_receive_nt_trans\n")); + cli_signing_trans_stop(cli); return False; } @@ -479,6 +531,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, this_param + *param_len < this_param || this_param + *param_len < *param_len) { DEBUG(1,("Data overflow in cli_receive_nt_trans\n")); + cli_signing_trans_stop(cli); return False; } @@ -491,6 +544,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, data_offset_out + this_data < data_offset_out || data_offset_out + this_data < this_data) { DEBUG(1,("Data overflow in cli_receive_nt_trans\n")); + cli_signing_trans_stop(cli); return False; } if (data_offset_in > cli->bufsize || @@ -498,6 +552,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, data_offset_in + this_data < data_offset_in || data_offset_in + this_data < this_data) { DEBUG(1,("Data overflow in cli_receive_nt_trans\n")); + cli_signing_trans_stop(cli); return False; } @@ -513,6 +568,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, param_offset_out + this_param < param_offset_out || param_offset_out + this_param < this_param) { DEBUG(1,("Param overflow in cli_receive_nt_trans\n")); + cli_signing_trans_stop(cli); return False; } if (param_offset_in > cli->bufsize || @@ -520,6 +576,7 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, param_offset_in + this_param < param_offset_in || param_offset_in + this_param < this_param) { DEBUG(1,("Param overflow in cli_receive_nt_trans\n")); + cli_signing_trans_stop(cli); return False; } @@ -532,8 +589,10 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, if (total_data <= *data_len && total_param <= *param_len) break; - if (!cli_receive_smb(cli)) + if (!cli_receive_smb(cli)) { + cli_signing_trans_stop(cli); return False; + } show_msg(cli->inbuf); @@ -541,13 +600,15 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, if (CVAL(cli->inbuf,smb_com) != SMBnttrans) { DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n", CVAL(cli->inbuf,smb_com))); + cli_signing_trans_stop(cli); return(False); } if (cli_is_dos_error(cli)) { cli_dos_error(cli, &eclass, &ecode); - if(cli->nt_pipe_fnum == 0 || - !(eclass == ERRDOS && ecode == ERRmoredata)) + if(cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata)) { + cli_signing_trans_stop(cli); return(False); + } } /* parse out the total lengths again - they can shrink! */ if (SVAL(cli->inbuf,smb_ntr_TotalDataCount) < total_data) @@ -559,5 +620,6 @@ BOOL cli_receive_nt_trans(struct cli_state *cli, break; } + cli_signing_trans_stop(cli); return(True); } diff --git a/source3/libsmb/errormap.c b/source3/libsmb/errormap.c index 8ee5ee3d31..3d99e3d5e5 100644 --- a/source3/libsmb/errormap.c +++ b/source3/libsmb/errormap.c @@ -1498,6 +1498,7 @@ const struct unix_error_map unix_dos_nt_errmap[] = { { ENFILE, ERRDOS, ERRnofids, NT_STATUS_TOO_MANY_OPENED_FILES }, { EMFILE, ERRDOS, ERRnofids, NT_STATUS_TOO_MANY_OPENED_FILES }, { ENOSPC, ERRHRD, ERRdiskfull, NT_STATUS_DISK_FULL }, + { ENOMEM, ERRDOS, ERRnomem, NT_STATUS_NO_MEMORY }, #ifdef EDQUOT { EDQUOT, ERRHRD, ERRdiskfull, NT_STATUS_DISK_FULL }, #endif diff --git a/source3/libsmb/nmblib.c b/source3/libsmb/nmblib.c index 157a2bb43c..6ee05f0104 100644 --- a/source3/libsmb/nmblib.c +++ b/source3/libsmb/nmblib.c @@ -1129,12 +1129,14 @@ char *dns_to_netbios_name(char *dns_name) /**************************************************************************** -interpret the weird netbios "name". Return the name type +interpret the weird netbios "name" into a unix fstring. Return the name type ****************************************************************************/ -static int name_interpret(char *in,char *out) +static int name_interpret(char *in, fstring name) { int ret; int len = (*in++) / 2; + fstring out_string; + char *out = out_string; *out=0; @@ -1150,8 +1152,8 @@ static int name_interpret(char *in,char *out) in += 2; out++; } - *out = 0; ret = out[-1]; + out[-1] = 0; #ifdef NETBIOS_SCOPE /* Handle any scope names */ @@ -1165,6 +1167,8 @@ static int name_interpret(char *in,char *out) in += len; } #endif + pull_ascii(name, out_string, sizeof(fstring), sizeof(out_string), STR_TERMINATE); + return(ret); } @@ -1245,9 +1249,9 @@ static char *name_ptr(char *buf,int ofs) } /**************************************************************************** -extract a netbios name from a buf +extract a netbios name from a buf (into a unix string) return name type ****************************************************************************/ -int name_extract(char *buf,int ofs,char *name) +int name_extract(char *buf,int ofs, fstring name) { char *p = name_ptr(buf,ofs); int d = PTR_DIFF(p,buf+ofs); diff --git a/source3/libsmb/ntlmssp.c b/source3/libsmb/ntlmssp.c index 66dc6e08eb..a50ae9b70f 100644 --- a/source3/libsmb/ntlmssp.c +++ b/source3/libsmb/ntlmssp.c @@ -279,8 +279,8 @@ static NTSTATUS ntlmssp_server_auth(struct ntlmssp_state *ntlmssp_state, data_blob_free(&sess_key); - DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%d len2=%d\n", - ntlmssp_state->user, ntlmssp_state->domain, ntlmssp_state->workstation, ntlmssp_state->lm_resp.length, ntlmssp_state->nt_resp.length)); + DEBUG(3,("Got user=[%s] domain=[%s] workstation=[%s] len1=%lu len2=%lu\n", + ntlmssp_state->user, ntlmssp_state->domain, ntlmssp_state->workstation, (unsigned long)ntlmssp_state->lm_resp.length, (unsigned long)ntlmssp_state->nt_resp.length)); #if 0 file_save("nthash1.dat", &ntlmssp_state->nt_resp.data, &ntlmssp_state->nt_resp.length); diff --git a/source3/libsmb/ntlmssp_parse.c b/source3/libsmb/ntlmssp_parse.c index f53afcdcd0..3c6da349e4 100644 --- a/source3/libsmb/ntlmssp_parse.c +++ b/source3/libsmb/ntlmssp_parse.c @@ -2,7 +2,7 @@ Unix SMB/CIFS implementation. simple kerberos5/SPNEGO routines Copyright (C) Andrew Tridgell 2001 - Copyright (C) Jim McDonough 2002 + Copyright (C) Jim McDonough 2002 Copyright (C) Andrew Bartlett 2002-2003 This program is free software; you can redistribute it and/or modify diff --git a/source3/libsmb/ntlmssp_sign.c b/source3/libsmb/ntlmssp_sign.c index 748c008963..ecaef808c9 100644 --- a/source3/libsmb/ntlmssp_sign.c +++ b/source3/libsmb/ntlmssp_sign.c @@ -102,7 +102,7 @@ enum ntlmssp_direction { NTLMSSP_RECEIVE }; -static NTSTATUS ntlmssp_make_packet_signiture(NTLMSSP_CLIENT_STATE *ntlmssp_state, +static NTSTATUS ntlmssp_make_packet_signature(NTLMSSP_CLIENT_STATE *ntlmssp_state, const uchar *data, size_t length, enum ntlmssp_direction direction, DATA_BLOB *sig) @@ -148,7 +148,7 @@ NTSTATUS ntlmssp_client_sign_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, const uchar *data, size_t length, DATA_BLOB *sig) { - NTSTATUS nt_status = ntlmssp_make_packet_signiture(ntlmssp_state, data, length, NTLMSSP_SEND, sig); + NTSTATUS nt_status = ntlmssp_make_packet_signature(ntlmssp_state, data, length, NTLMSSP_SEND, sig); /* increment counter on send */ ntlmssp_state->ntlmssp_seq_num++; @@ -169,11 +169,11 @@ NTSTATUS ntlmssp_client_check_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, NTSTATUS nt_status; if (sig->length < 8) { - DEBUG(0, ("NTLMSSP packet check failed due to short signiture (%u bytes)!\n", + DEBUG(0, ("NTLMSSP packet check failed due to short signature (%u bytes)!\n", sig->length)); } - nt_status = ntlmssp_make_packet_signiture(ntlmssp_state, data, + nt_status = ntlmssp_make_packet_signature(ntlmssp_state, data, length, NTLMSSP_RECEIVE, &local_sig); if (!NT_STATUS_IS_OK(nt_status)) { @@ -188,7 +188,7 @@ NTSTATUS ntlmssp_client_check_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, DEBUG(5, ("BAD SIG: got signature of\n")); dump_data(5, sig->data, sig->length); - DEBUG(0, ("NTLMSSP packet check failed due to invalid signiture!\n")); + DEBUG(0, ("NTLMSSP packet check failed due to invalid signature!\n")); return NT_STATUS_ACCESS_DENIED; } @@ -328,7 +328,7 @@ NTSTATUS ntlmssp_client_sign_init(NTLMSSP_CLIENT_STATE *ntlmssp_state) } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) { if (!ntlmssp_state->session_key.data || ntlmssp_state->session_key.length < 8) { - /* can't sign or check signitures yet */ + /* can't sign or check signatures yet */ DEBUG(5, ("NTLMSSP Sign/Seal - cannot use LM KEY yet\n")); return NT_STATUS_UNSUCCESSFUL; } @@ -340,7 +340,7 @@ NTSTATUS ntlmssp_client_sign_init(NTLMSSP_CLIENT_STATE *ntlmssp_state) sizeof(ntlmssp_state->ntlmssp_hash)); } else { if (!ntlmssp_state->session_key.data || ntlmssp_state->session_key.length < 16) { - /* can't sign or check signitures yet */ + /* can't sign or check signatures yet */ DEBUG(5, ("NTLMSSP Sign/Seal - cannot use NT KEY yet\n")); return NT_STATUS_UNSUCCESSFUL; } diff --git a/source3/libsmb/smb_signing.c b/source3/libsmb/smb_signing.c index d4f77bf07c..4167452953 100644 --- a/source3/libsmb/smb_signing.c +++ b/source3/libsmb/smb_signing.c @@ -1,7 +1,7 @@ /* Unix SMB/CIFS implementation. SMB Signing Code - Copyright (C) Jeremy Allison 2002. + Copyright (C) Jeremy Allison 2003. Copyright (C) Andrew Bartlett 2002-2003 This program is free software; you can redistribute it and/or modify @@ -28,9 +28,17 @@ struct outstanding_packet_lookup { struct outstanding_packet_lookup *prev, *next; }; +/* Store the data for an ongoing trans/trans2/nttrans operation. */ +struct trans_info_context { + uint16 mid; + uint32 send_seq_num; + uint32 reply_seq_num; +}; + struct smb_basic_signing_context { DATA_BLOB mac_key; uint32 send_seq_num; + struct trans_info_context *trans_info; struct outstanding_packet_lookup *outstanding_packet_list; }; @@ -46,6 +54,8 @@ static void store_sequence_for_reply(struct outstanding_packet_lookup **list, DLIST_ADD_END(*list, t, tmp); t->mid = mid; t->reply_seq_num = reply_seq_num; + DEBUG(10,("store_sequence_for_reply: stored seq = %u mid = %u\n", + (unsigned int)reply_seq_num, (unsigned int)mid )); } static BOOL get_sequence_for_reply(struct outstanding_packet_lookup **list, @@ -56,12 +66,13 @@ static BOOL get_sequence_for_reply(struct outstanding_packet_lookup **list, for (t = *list; t; t = t->next) { if (t->mid == mid) { *reply_seq_num = t->reply_seq_num; + DEBUG(10,("get_sequence_for_reply: found seq = %u mid = %u\n", + (unsigned int)t->reply_seq_num, (unsigned int)t->mid )); DLIST_REMOVE(*list, t); + SAFE_FREE(t); return True; } } - DEBUG(0, ("Unexpected incoming packet, it's MID (%u) does not match" - " a MID in our outstanding list!\n", mid)); return False; } @@ -81,7 +92,7 @@ static BOOL cli_set_smb_signing_common(struct cli_state *cli) } if (cli->sign_info.free_signing_context) - cli->sign_info.free_signing_context(cli); + cli->sign_info.free_signing_context(&cli->sign_info); /* These calls are INCOMPATIBLE with SMB signing */ cli->readbraw_supported = False; @@ -94,42 +105,107 @@ static BOOL cli_set_smb_signing_common(struct cli_state *cli) SMB signing - Common code for 'real' implementations ************************************************************/ -static BOOL cli_set_smb_signing_real_common(struct cli_state *cli) +static BOOL set_smb_signing_real_common(struct smb_sign_info *si) { - if (cli->sign_info.mandatory_signing) { + if (si->mandatory_signing) { DEBUG(5, ("Mandatory SMB signing enabled!\n")); - cli->sign_info.doing_signing = True; } + si->doing_signing = True; DEBUG(5, ("SMB signing enabled!\n")); return True; } -static void cli_mark_packet_signed(struct cli_state *cli) +static void mark_packet_signed(char *outbuf) { uint16 flags2; - flags2 = SVAL(cli->outbuf,smb_flg2); + flags2 = SVAL(outbuf,smb_flg2); flags2 |= FLAGS2_SMB_SECURITY_SIGNATURES; - SSVAL(cli->outbuf,smb_flg2, flags2); + SSVAL(outbuf,smb_flg2, flags2); +} + +/*********************************************************** + SMB signing - NULL implementation - calculate a MAC to send. +************************************************************/ + +static void null_sign_outgoing_message(char *outbuf, struct smb_sign_info *si) +{ + /* we can't zero out the sig, as we might be trying to send a + session request - which is NBT-level, not SMB level and doesn't + have the field */ + return; +} + +/*********************************************************** + SMB signing - NULL implementation - check a MAC sent by server. +************************************************************/ + +static BOOL null_check_incoming_message(char *inbuf, struct smb_sign_info *si) +{ + return True; } -static BOOL cli_signing_good(struct cli_state *cli, BOOL good) +/*********************************************************** + SMB signing - NULL implementation - free signing context +************************************************************/ + +static void null_free_signing_context(struct smb_sign_info *si) { - DEBUG(10, ("got SMB signature of\n")); - dump_data(10,&cli->inbuf[smb_ss_field] , 8); + return; +} - if (good && !cli->sign_info.doing_signing) { - cli->sign_info.doing_signing = True; +/** + SMB signing - NULL implementation - setup the MAC key. + + @note Used as an initialisation only - it will not correctly + shut down a real signing mechanism +*/ + +static BOOL null_set_signing(struct smb_sign_info *si) +{ + si->signing_context = NULL; + + si->sign_outgoing_message = null_sign_outgoing_message; + si->check_incoming_message = null_check_incoming_message; + si->free_signing_context = null_free_signing_context; + + return True; +} + +/** + * Free the signing context + */ + +static void free_signing_context(struct smb_sign_info *si) +{ + if (si->free_signing_context) { + si->free_signing_context(si); + si->signing_context = NULL; + } + + null_set_signing(si); +} + + +static BOOL signing_good(char *inbuf, struct smb_sign_info *si, BOOL good) +{ + if (good && !si->doing_signing) { + si->doing_signing = True; } if (!good) { - if (cli->sign_info.doing_signing) { - DEBUG(1, ("SMB signature check failed!\n")); + if (si->doing_signing) { + struct smb_basic_signing_context *data = si->signing_context; + + /* W2K sends a bad first signature but the sign engine is on.... JRA. */ + if (data->send_seq_num > 1) + DEBUG(1, ("signing_good: SMB signature check failed!\n")); + return False; } else { - DEBUG(3, ("Server did not sign reply correctly\n")); - cli_free_signing_context(cli); + DEBUG(3, ("signing_good: Peer did not sign reply correctly\n")); + free_signing_context(si); return False; } } @@ -155,13 +231,15 @@ static void simple_packet_signature(struct smb_basic_signing_context *data, * We do this here, to avoid modifying the packet. */ + DEBUG(10,("simple_packet_signature: sequence number %u\n", seq_number )); + SIVAL(sequence_buf, 0, seq_number); SIVAL(sequence_buf, 4, 0); /* Calculate the 16 byte MAC - but don't alter the data in the incoming packet. - This makes for a bit for fussing about, but it's not too bad. + This makes for a bit of fussing about, but it's not too bad. */ MD5Init(&md5_ctx); @@ -179,82 +257,130 @@ static void simple_packet_signature(struct smb_basic_signing_context *data, MD5Update(&md5_ctx, buf + offset_end_of_sig, smb_len(buf) - (offset_end_of_sig - 4)); - /* caclulate the MD5 sig */ + /* calculate the MD5 sig */ MD5Final(calc_md5_mac, &md5_ctx); } /*********************************************************** - SMB signing - Simple implementation - send the MAC. + SMB signing - Client implementation - send the MAC. ************************************************************/ -static void cli_simple_sign_outgoing_message(struct cli_state *cli) +static void client_sign_outgoing_message(char *outbuf, struct smb_sign_info *si) { unsigned char calc_md5_mac[16]; - struct smb_basic_signing_context *data = cli->sign_info.signing_context; + struct smb_basic_signing_context *data = si->signing_context; + uint32 send_seq_num; + + if (!si->doing_signing) + return; + + /* JRA Paranioa test - we should be able to get rid of this... */ + if (smb_len(outbuf) < (smb_ss_field + 8 - 4)) { + DEBUG(1, ("client_sign_outgoing_message: Logic error. Can't check signature on short packet! smb_len = %u\n", + smb_len(outbuf) )); + abort(); + } /* mark the packet as signed - BEFORE we sign it...*/ - cli_mark_packet_signed(cli); + mark_packet_signed(outbuf); - simple_packet_signature(data, cli->outbuf, data->send_seq_num, - calc_md5_mac); + if (data->trans_info) + send_seq_num = data->trans_info->send_seq_num; + else + send_seq_num = data->send_seq_num; - DEBUG(10, ("sent SMB signature of\n")); + simple_packet_signature(data, outbuf, send_seq_num, calc_md5_mac); + + DEBUG(10, ("client_sign_outgoing_message: sent SMB signature of\n")); dump_data(10, calc_md5_mac, 8); - memcpy(&cli->outbuf[smb_ss_field], calc_md5_mac, 8); + memcpy(&outbuf[smb_ss_field], calc_md5_mac, 8); /* cli->outbuf[smb_ss_field+2]=0; Uncomment this to test if the remote server actually verifies signatures...*/ + if (data->trans_info) + return; + data->send_seq_num++; store_sequence_for_reply(&data->outstanding_packet_list, - cli->mid, + SVAL(outbuf,smb_mid), data->send_seq_num); data->send_seq_num++; } /*********************************************************** - SMB signing - Simple implementation - check a MAC sent by server. + SMB signing - Client implementation - check a MAC sent by server. ************************************************************/ -static BOOL cli_simple_check_incoming_message(struct cli_state *cli) +static BOOL client_check_incoming_message(char *inbuf, struct smb_sign_info *si) { BOOL good; uint32 reply_seq_number; unsigned char calc_md5_mac[16]; unsigned char *server_sent_mac; - struct smb_basic_signing_context *data = cli->sign_info.signing_context; + struct smb_basic_signing_context *data = si->signing_context; + + if (!si->doing_signing) + return True; - if (!get_sequence_for_reply(&data->outstanding_packet_list, - SVAL(cli->inbuf, smb_mid), + if (smb_len(inbuf) < (smb_ss_field + 8 - 4)) { + DEBUG(1, ("client_check_incoming_message: Can't check signature on short packet! smb_len = %u\n", smb_len(inbuf))); + return False; + } + + if (data->trans_info) { + reply_seq_number = data->trans_info->reply_seq_num; + } else if (!get_sequence_for_reply(&data->outstanding_packet_list, + SVAL(inbuf, smb_mid), &reply_seq_number)) { + DEBUG(1, ("client_check_incoming_message: failed to get sequence number %u for reply.\n", + (unsigned int) SVAL(inbuf, smb_mid) )); return False; } - simple_packet_signature(data, cli->inbuf, reply_seq_number, calc_md5_mac); + simple_packet_signature(data, inbuf, reply_seq_number, calc_md5_mac); - server_sent_mac = &cli->inbuf[smb_ss_field]; + server_sent_mac = &inbuf[smb_ss_field]; good = (memcmp(server_sent_mac, calc_md5_mac, 8) == 0); if (!good) { - DEBUG(5, ("BAD SIG: wanted SMB signature of\n")); + DEBUG(5, ("client_check_incoming_message: BAD SIG: wanted SMB signature of\n")); dump_data(5, calc_md5_mac, 8); - DEBUG(5, ("BAD SIG: got SMB signature of\n")); + DEBUG(5, ("client_check_incoming_message: BAD SIG: got SMB signature of\n")); dump_data(5, server_sent_mac, 8); +#if 1 /* JRATEST */ + { + int i; + reply_seq_number -= 5; + for (i = 0; i < 10; i++, reply_seq_number++) { + simple_packet_signature(data, inbuf, reply_seq_number, calc_md5_mac); + if (memcmp(server_sent_mac, calc_md5_mac, 8) == 0) { + DEBUG(0,("client_check_incoming_message: out of seq. seq num %u matches.\n", + reply_seq_number )); + break; + } + } + } +#endif /* JRATEST */ + + } else { + DEBUG(10, ("client_check_incoming_message:: seq %u: got good SMB signature of\n", (unsigned int)reply_seq_number)); + dump_data(10, server_sent_mac, 8); } - return cli_signing_good(cli, good); + return signing_good(inbuf, si, good); } /*********************************************************** SMB signing - Simple implementation - free signing context ************************************************************/ -static void cli_simple_free_signing_context(struct cli_state *cli) +static void simple_free_signing_context(struct smb_sign_info *si) { - struct smb_basic_signing_context *data = cli->sign_info.signing_context; + struct smb_basic_signing_context *data = si->signing_context; struct outstanding_packet_lookup *list = data->outstanding_packet_list; while (list) { @@ -264,7 +390,11 @@ static void cli_simple_free_signing_context(struct cli_state *cli) } data_blob_free(&data->mac_key); - SAFE_FREE(cli->sign_info.signing_context); + + if (data->trans_info) + SAFE_FREE(data->trans_info); + + SAFE_FREE(si->signing_context); return; } @@ -284,18 +414,29 @@ BOOL cli_simple_set_signing(struct cli_state *cli, const uchar user_session_key[ return False; } - if (!cli_set_smb_signing_real_common(cli)) { + if (!set_smb_signing_real_common(&cli->sign_info)) { return False; } data = smb_xmalloc(sizeof(*data)); + memset(data, '\0', sizeof(*data)); cli->sign_info.signing_context = data; data->mac_key = data_blob(NULL, response.length + 16); memcpy(&data->mac_key.data[0], user_session_key, 16); - memcpy(&data->mac_key.data[16],response.data, response.length); + + DEBUG(10, ("cli_simple_set_signing: user_session_key\n")); + dump_data(10, user_session_key, 16); + + if (response.length) { + memcpy(&data->mac_key.data[16],response.data, response.length); + DEBUG(10, ("cli_simple_set_signing: response_data\n")); + dump_data(10, response.data, response.length); + } else { + DEBUG(10, ("cli_simple_set_signing: NULL response_data\n")); + } /* Initialise the sequence number */ data->send_seq_num = 0; @@ -303,73 +444,68 @@ BOOL cli_simple_set_signing(struct cli_state *cli, const uchar user_session_key[ /* Initialise the list of outstanding packets */ data->outstanding_packet_list = NULL; - cli->sign_info.sign_outgoing_message = cli_simple_sign_outgoing_message; - cli->sign_info.check_incoming_message = cli_simple_check_incoming_message; - cli->sign_info.free_signing_context = cli_simple_free_signing_context; + cli->sign_info.sign_outgoing_message = client_sign_outgoing_message; + cli->sign_info.check_incoming_message = client_check_incoming_message; + cli->sign_info.free_signing_context = simple_free_signing_context; return True; } /*********************************************************** - SMB signing - NULL implementation - calculate a MAC to send. + Tell client code we are in a multiple trans reply state. ************************************************************/ -static void cli_null_sign_outgoing_message(struct cli_state *cli) +void cli_signing_trans_start(struct cli_state *cli) { - /* we can't zero out the sig, as we might be trying to send a - session request - which is NBT-level, not SMB level and doesn't - have the field */ - return; -} + struct smb_basic_signing_context *data = cli->sign_info.signing_context; -/*********************************************************** - SMB signing - NULL implementation - check a MAC sent by server. -************************************************************/ + if (!cli->sign_info.doing_signing || !data) + return; -static BOOL cli_null_check_incoming_message(struct cli_state *cli) -{ - return True; + data->trans_info = smb_xmalloc(sizeof(struct trans_info_context)); + ZERO_STRUCTP(data->trans_info); + + data->trans_info->send_seq_num = data->send_seq_num; + data->trans_info->mid = SVAL(cli->outbuf,smb_mid); + data->trans_info->reply_seq_num = data->send_seq_num+1; + + DEBUG(10,("cli_signing_trans_start: storing mid = %u, reply_seq_num = %u, send_seq_num = %u \ +data->send_seq_num = %u\n", + (unsigned int)data->trans_info->mid, + (unsigned int)data->trans_info->reply_seq_num, + (unsigned int)data->trans_info->send_seq_num, + (unsigned int)data->send_seq_num )); } /*********************************************************** - SMB signing - NULL implementation - free signing context + Tell client code we are out of a multiple trans reply state. ************************************************************/ -static void cli_null_free_signing_context(struct cli_state *cli) +void cli_signing_trans_stop(struct cli_state *cli) { - return; -} + struct smb_basic_signing_context *data = cli->sign_info.signing_context; -/** - SMB signing - NULL implementation - setup the MAC key. + if (!cli->sign_info.doing_signing || !data) + return; - @note Used as an initialisation only - it will not correctly - shut down a real signing mechanism -*/ + SAFE_FREE(data->trans_info); + data->trans_info = NULL; -BOOL cli_null_set_signing(struct cli_state *cli) -{ - cli->sign_info.signing_context = NULL; - - cli->sign_info.sign_outgoing_message = cli_null_sign_outgoing_message; - cli->sign_info.check_incoming_message = cli_null_check_incoming_message; - cli->sign_info.free_signing_context = cli_null_free_signing_context; - - return True; + data->send_seq_num += 2; } /*********************************************************** SMB signing - TEMP implementation - calculate a MAC to send. ************************************************************/ -static void cli_temp_sign_outgoing_message(struct cli_state *cli) +static void temp_sign_outgoing_message(char *outbuf, struct smb_sign_info *si) { /* mark the packet as signed - BEFORE we sign it...*/ - cli_mark_packet_signed(cli); + mark_packet_signed(outbuf); /* I wonder what BSRSPYL stands for - but this is what MS actually sends! */ - memcpy(&cli->outbuf[smb_ss_field], "BSRSPYL ", 8); + memcpy(&outbuf[smb_ss_field], "BSRSPYL ", 8); return; } @@ -377,7 +513,7 @@ static void cli_temp_sign_outgoing_message(struct cli_state *cli) SMB signing - TEMP implementation - check a MAC sent by server. ************************************************************/ -static BOOL cli_temp_check_incoming_message(struct cli_state *cli) +static BOOL temp_check_incoming_message(char *inbuf, struct smb_sign_info *si) { return True; } @@ -386,7 +522,7 @@ static BOOL cli_temp_check_incoming_message(struct cli_state *cli) SMB signing - TEMP implementation - free signing context ************************************************************/ -static void cli_temp_free_signing_context(struct cli_state *cli) +static void temp_free_signing_context(struct smb_sign_info *si) { return; } @@ -395,6 +531,15 @@ static void cli_temp_free_signing_context(struct cli_state *cli) SMB signing - NULL implementation - setup the MAC key. ************************************************************/ +BOOL cli_null_set_signing(struct cli_state *cli) +{ + return null_set_signing(&cli->sign_info); +} + +/*********************************************************** + SMB signing - temp implementation - setup the MAC key. +************************************************************/ + BOOL cli_temp_set_signing(struct cli_state *cli) { if (!cli_set_smb_signing_common(cli)) { @@ -403,58 +548,427 @@ BOOL cli_temp_set_signing(struct cli_state *cli) cli->sign_info.signing_context = NULL; - cli->sign_info.sign_outgoing_message = cli_temp_sign_outgoing_message; - cli->sign_info.check_incoming_message = cli_temp_check_incoming_message; - cli->sign_info.free_signing_context = cli_temp_free_signing_context; + cli->sign_info.sign_outgoing_message = temp_sign_outgoing_message; + cli->sign_info.check_incoming_message = temp_check_incoming_message; + cli->sign_info.free_signing_context = temp_free_signing_context; return True; } -/** - * Free the signing context - */ - -void cli_free_signing_context(struct cli_state *cli) +void cli_free_signing_context(struct cli_state *cli) { - if (cli->sign_info.free_signing_context) - cli->sign_info.free_signing_context(cli); - - cli_null_set_signing(cli); + free_signing_context(&cli->sign_info); } /** * Sign a packet with the current mechanism */ -void cli_caclulate_sign_mac(struct cli_state *cli) +void cli_calculate_sign_mac(struct cli_state *cli) { - cli->sign_info.sign_outgoing_message(cli); + cli->sign_info.sign_outgoing_message(cli->outbuf, &cli->sign_info); } /** * Check a packet with the current mechanism * @return False if we had an established signing connection - * which had a back checksum, True otherwise + * which had a bad checksum, True otherwise. */ BOOL cli_check_sign_mac(struct cli_state *cli) +{ + if (!cli->sign_info.check_incoming_message(cli->inbuf, &cli->sign_info)) { + free_signing_context(&cli->sign_info); + return False; + } + return True; +} + +static BOOL packet_is_oplock_break(char *buf) +{ + if (CVAL(buf,smb_com) != SMBlockingX) + return False; + + if (CVAL(buf,smb_vwv3) != LOCKING_ANDX_OPLOCK_RELEASE) + return False; + + return True; +} + +/*********************************************************** + SMB signing - Server implementation - send the MAC. +************************************************************/ + +static void srv_sign_outgoing_message(char *outbuf, struct smb_sign_info *si) +{ + unsigned char calc_md5_mac[16]; + struct smb_basic_signing_context *data = si->signing_context; + uint32 send_seq_number = data->send_seq_num; + BOOL was_deferred_packet = False; + uint16 mid; + + if (!si->doing_signing) { + if (si->allow_smb_signing && si->negotiated_smb_signing) { + mid = SVAL(outbuf, smb_mid); + + was_deferred_packet = get_sequence_for_reply(&data->outstanding_packet_list, + mid, &send_seq_number); + if (!was_deferred_packet) { + /* + * Is this an outgoing oplock break ? If so, store the + * mid in the outstanding list. + */ + + if (packet_is_oplock_break(outbuf)) { + store_sequence_for_reply(&data->outstanding_packet_list, + mid, data->send_seq_num); + } + + data->send_seq_num++; + } + } + return; + } + + /* JRA Paranioa test - we should be able to get rid of this... */ + if (smb_len(outbuf) < (smb_ss_field + 8 - 4)) { + DEBUG(1, ("srv_sign_outgoing_message: Logic error. Can't send signature on short packet! smb_len = %u\n", + smb_len(outbuf) )); + abort(); + } + + /* mark the packet as signed - BEFORE we sign it...*/ + mark_packet_signed(outbuf); + + mid = SVAL(outbuf, smb_mid); + + /* See if this is a reply for a deferred packet. */ + was_deferred_packet = get_sequence_for_reply(&data->outstanding_packet_list, mid, &send_seq_number); + + if (data->trans_info && (data->trans_info->mid == mid)) { + /* This is a reply in a trans stream. Use the sequence + * number associated with the stream mid. */ + send_seq_number = data->trans_info->send_seq_num; + } + + simple_packet_signature(data, outbuf, send_seq_number, calc_md5_mac); + + DEBUG(10, ("srv_sign_outgoing_message: seq %u: sent SMB signature of\n", (unsigned int)send_seq_number)); + dump_data(10, calc_md5_mac, 8); + + memcpy(&outbuf[smb_ss_field], calc_md5_mac, 8); + +/* cli->outbuf[smb_ss_field+2]=0; + Uncomment this to test if the remote server actually verifies signatures...*/ + + if (!was_deferred_packet) { + if (!data->trans_info) { + /* Always increment if not in a trans stream. */ + data->send_seq_num++; + } else if ((data->trans_info->send_seq_num == data->send_seq_num) || (data->trans_info->mid != mid)) { + /* Increment if this is the first reply in a trans stream or a + * packet that doesn't belong to this stream (different mid). */ + data->send_seq_num++; + } + } +} + +/*********************************************************** + SMB signing - Server implementation - check a MAC sent by server. +************************************************************/ + +static BOOL srv_check_incoming_message(char *inbuf, struct smb_sign_info *si) { BOOL good; + struct smb_basic_signing_context *data = si->signing_context; + uint32 reply_seq_number = data->send_seq_num; + unsigned char calc_md5_mac[16]; + unsigned char *server_sent_mac; + uint mid; + + if (!si->doing_signing) + return True; - if (smb_len(cli->inbuf) < (smb_ss_field + 8 - 4)) { - DEBUG(cli->sign_info.doing_signing ? 1 : 10, ("Can't check signature on short packet! smb_len = %u\n", smb_len(cli->inbuf))); - good = False; + if (smb_len(inbuf) < (smb_ss_field + 8 - 4)) { + DEBUG(1, ("srv_check_incoming_message: Can't check signature on short packet! smb_len = %u\n", smb_len(inbuf))); + return False; + } + + mid = SVAL(inbuf, smb_mid); + + /* Is this part of a trans stream ? */ + if (data->trans_info && (data->trans_info->mid == mid)) { + /* If so we don't increment the sequence. */ + reply_seq_number = data->trans_info->reply_seq_num; } else { - good = cli->sign_info.check_incoming_message(cli); + /* We always increment the sequence number. */ + data->send_seq_num++; + /* Oplock break requests store an outgoing mid in the packet list. */ + if (packet_is_oplock_break(inbuf)) + get_sequence_for_reply(&data->outstanding_packet_list, mid, &reply_seq_number); } + simple_packet_signature(data, inbuf, reply_seq_number, calc_md5_mac); + + server_sent_mac = &inbuf[smb_ss_field]; + good = (memcmp(server_sent_mac, calc_md5_mac, 8) == 0); + if (!good) { - if (cli->sign_info.doing_signing) { - return False; - } else { - cli_free_signing_context(cli); + + DEBUG(5, ("srv_check_incoming_message: BAD SIG: wanted SMB signature of\n")); + dump_data(5, calc_md5_mac, 8); + + DEBUG(5, ("srv_check_incoming_message: BAD SIG: got SMB signature of\n")); + dump_data(5, server_sent_mac, 8); + +#if 1 /* JRATEST */ + { + int i; + reply_seq_number -= 5; + for (i = 0; i < 10; i++, reply_seq_number++) { + simple_packet_signature(data, inbuf, reply_seq_number, calc_md5_mac); + if (memcmp(server_sent_mac, calc_md5_mac, 8) == 0) { + DEBUG(0,("srv_check_incoming_message: out of seq. seq num %u matches.\n", + reply_seq_number )); + break; + } + } } +#endif /* JRATEST */ + + } else { + DEBUG(10, ("srv_check_incoming_message: seq %u: got good SMB signature of\n", (unsigned int)reply_seq_number)); + dump_data(10, server_sent_mac, 8); } + return signing_good(inbuf, si, good); +} - return True; +/*********************************************************** + SMB signing - server API's. +************************************************************/ + +static struct smb_sign_info srv_sign_info = { + null_sign_outgoing_message, + null_check_incoming_message, + null_free_signing_context, + NULL, + False, + False, + False, + False +}; + +/*********************************************************** + Turn signing off or on for oplock break code. +************************************************************/ + +BOOL srv_oplock_set_signing(BOOL onoff) +{ + BOOL ret = srv_sign_info.doing_signing; + srv_sign_info.doing_signing = onoff; + return ret; +} + +/*********************************************************** + Called to validate an incoming packet from the client. +************************************************************/ + +BOOL srv_check_sign_mac(char *inbuf) +{ + /* Check if it's a session keepalive. */ + if(CVAL(inbuf,0) == SMBkeepalive) + return True; + + return srv_sign_info.check_incoming_message(inbuf, &srv_sign_info); +} + +/*********************************************************** + Called to sign an outgoing packet to the client. +************************************************************/ + +void srv_calculate_sign_mac(char *outbuf) +{ + /* Check if it's a session keepalive. */ + /* JRA Paranioa test - do we ever generate these in the server ? */ + if(CVAL(outbuf,0) == SMBkeepalive) + return; + + srv_sign_info.sign_outgoing_message(outbuf, &srv_sign_info); +} + +/*********************************************************** + Called by server to defer an outgoing packet. +************************************************************/ + +void srv_defer_sign_response(uint16 mid) +{ + struct smb_basic_signing_context *data; + + if (!srv_sign_info.doing_signing) + return; + + data = (struct smb_basic_signing_context *)srv_sign_info.signing_context; + + if (!data) + return; + + store_sequence_for_reply(&data->outstanding_packet_list, + mid, data->send_seq_num); + data->send_seq_num++; +} + +/*********************************************************** + Called to remove sequence records when a deferred packet is + cancelled by mid. This should never find one.... +************************************************************/ + +void srv_cancel_sign_response(uint16 mid) +{ + struct smb_basic_signing_context *data; + uint32 dummy_seq; + + if (!srv_sign_info.doing_signing) + return; + + data = (struct smb_basic_signing_context *)srv_sign_info.signing_context; + + if (!data) + return; + + DEBUG(10,("srv_cancel_sign_response: for mid %u\n", (unsigned int)mid )); + + while (get_sequence_for_reply(&data->outstanding_packet_list, mid, &dummy_seq)) + ; +} + +/*********************************************************** + Called by server negprot when signing has been negotiated. +************************************************************/ + +void srv_set_signing_negotiated(void) +{ + srv_sign_info.allow_smb_signing = True; + srv_sign_info.negotiated_smb_signing = True; + if (lp_server_signing() == Required) + srv_sign_info.mandatory_signing = True; + + srv_sign_info.sign_outgoing_message = temp_sign_outgoing_message; + srv_sign_info.check_incoming_message = temp_check_incoming_message; + srv_sign_info.free_signing_context = temp_free_signing_context; +} + +/*********************************************************** + Returns whether signing is active. We can't use sendfile or raw + reads/writes if it is. +************************************************************/ + +BOOL srv_is_signing_active(void) +{ + return srv_sign_info.doing_signing; +} + +/*********************************************************** + Tell server code we are in a multiple trans reply state. +************************************************************/ + +void srv_signing_trans_start(uint16 mid) +{ + struct smb_basic_signing_context *data; + + if (!srv_sign_info.doing_signing) + return; + + data = (struct smb_basic_signing_context *)srv_sign_info.signing_context; + if (!data) + return; + + data->trans_info = smb_xmalloc(sizeof(struct trans_info_context)); + ZERO_STRUCTP(data->trans_info); + + data->trans_info->reply_seq_num = data->send_seq_num-1; + data->trans_info->mid = mid; + data->trans_info->send_seq_num = data->send_seq_num; + + DEBUG(10,("srv_signing_trans_start: storing mid = %u, reply_seq_num = %u, send_seq_num = %u \ +data->send_seq_num = %u\n", + (unsigned int)mid, + (unsigned int)data->trans_info->reply_seq_num, + (unsigned int)data->trans_info->send_seq_num, + (unsigned int)data->send_seq_num )); +} + +/*********************************************************** + Tell server code we are out of a multiple trans reply state. +************************************************************/ + +void srv_signing_trans_stop(void) +{ + struct smb_basic_signing_context *data; + + if (!srv_sign_info.doing_signing) + return; + + data = (struct smb_basic_signing_context *)srv_sign_info.signing_context; + if (!data || !data->trans_info) + return; + + DEBUG(10,("srv_signing_trans_stop: removing mid = %u, reply_seq_num = %u, send_seq_num = %u \ +data->send_seq_num = %u\n", + (unsigned int)data->trans_info->mid, + (unsigned int)data->trans_info->reply_seq_num, + (unsigned int)data->trans_info->send_seq_num, + (unsigned int)data->send_seq_num )); + + SAFE_FREE(data->trans_info); + data->trans_info = NULL; +} + +/*********************************************************** + Turn on signing from this packet onwards. +************************************************************/ + +void srv_set_signing(const uchar user_session_key[16], const DATA_BLOB response) +{ + struct smb_basic_signing_context *data; + + if (!user_session_key) + return; + + if (!srv_sign_info.negotiated_smb_signing && !srv_sign_info.mandatory_signing) { + DEBUG(5,("srv_set_signing: signing negotiated = %u, mandatory_signing = %u. Not allowing smb signing.\n", + (unsigned int)srv_sign_info.negotiated_smb_signing, + (unsigned int)srv_sign_info.mandatory_signing )); + return; + } + + /* Once we've turned on, ignore any more sessionsetups. */ + if (srv_sign_info.doing_signing) { + return; + } + + if (srv_sign_info.free_signing_context) + srv_sign_info.free_signing_context(&srv_sign_info); + + srv_sign_info.doing_signing = True; + + data = smb_xmalloc(sizeof(*data)); + memset(data, '\0', sizeof(*data)); + + srv_sign_info.signing_context = data; + + data->mac_key = data_blob(NULL, response.length + 16); + + memcpy(&data->mac_key.data[0], user_session_key, 16); + if (response.length) + memcpy(&data->mac_key.data[16],response.data, response.length); + + /* Initialise the sequence number */ + data->send_seq_num = 0; + + /* Initialise the list of outstanding packets */ + data->outstanding_packet_list = NULL; + + srv_sign_info.sign_outgoing_message = srv_sign_outgoing_message; + srv_sign_info.check_incoming_message = srv_check_incoming_message; + srv_sign_info.free_signing_context = simple_free_signing_context; } diff --git a/source3/libsmb/trustdom_cache.c b/source3/libsmb/trustdom_cache.c index 8378125088..0128d08006 100644 --- a/source3/libsmb/trustdom_cache.c +++ b/source3/libsmb/trustdom_cache.c @@ -223,7 +223,7 @@ BOOL trustdom_cache_store_timestamp( uint32 t, time_t timeout ) if (!gencache_init()) return False; - snprintf(value, sizeof(value), "%d", t ); + fstr_sprintf(value, "%d", t ); if (!gencache_set(TDOMTSKEY, value, timeout)) { DEBUG(5, ("failed to set timestamp for trustdom_cache\n")); diff --git a/source3/libsmb/trusts_util.c b/source3/libsmb/trusts_util.c index 77e63709aa..610f4b3c03 100644 --- a/source3/libsmb/trusts_util.c +++ b/source3/libsmb/trusts_util.c @@ -154,7 +154,7 @@ BOOL enumerate_domain_trusts( TALLOC_CTX *mem_ctx, const char *domain, /* setup the anonymous connection */ result = cli_full_connection( &cli, global_myname(), dc_name, &dc_ip, 0, "IPC$", "IPC", - "", "", "", 0, &retry); + "", "", "", 0, Undefined, &retry); if ( !NT_STATUS_IS_OK(result) ) goto done; diff --git a/source3/locking/locking.c b/source3/locking/locking.c index 1a5757f817..4475f1446f 100644 --- a/source3/locking/locking.c +++ b/source3/locking/locking.c @@ -125,7 +125,11 @@ static NTSTATUS do_lock(files_struct *fsp,connection_struct *conn, uint16 lock_p */ if (!set_posix_lock(fsp, offset, count, lock_type)) { - status = NT_STATUS_LOCK_NOT_GRANTED; + if (errno == EACCES || errno == EAGAIN) + status = NT_STATUS_FILE_LOCK_CONFLICT; + else + status = map_nt_error_from_unix(errno); + /* * We failed to map - we must now remove the brl * lock entry. @@ -380,8 +384,8 @@ char *share_mode_str(int num, share_mode_entry *e) static pstring share_str; slprintf(share_str, sizeof(share_str)-1, "share_mode_entry[%d]: \ -pid = %u, share_mode = 0x%x, desired_access = 0x%x, port = 0x%x, type= 0x%x, file_id = %lu, dev = 0x%x, inode = %.0f", - num, e->pid, e->share_mode, (unsigned int)e->desired_access, e->op_port, e->op_type, e->share_file_id, +pid = %lu, share_mode = 0x%x, desired_access = 0x%x, port = 0x%x, type= 0x%x, file_id = %lu, dev = 0x%x, inode = %.0f", + num, (unsigned long)e->pid, e->share_mode, (unsigned int)e->desired_access, e->op_port, e->op_type, e->share_file_id, (unsigned int)e->dev, (double)e->inode ); return share_str; diff --git a/source3/nmbd/nmbd_processlogon.c b/source3/nmbd/nmbd_processlogon.c index 42edcc871f..bc3540af70 100644 --- a/source3/nmbd/nmbd_processlogon.c +++ b/source3/nmbd/nmbd_processlogon.c @@ -4,8 +4,7 @@ Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 Copyright (C) Jeremy Allison 1994-1998 - Copyright (C) Jim McDonough 2002 - Copyright (C) Anthony Liguori 2002 + Copyright (C) Jim McDonough 2002 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by diff --git a/source3/nsswitch/wb_common.c b/source3/nsswitch/wb_common.c index acaf0ed17c..79553e9e4f 100644 --- a/source3/nsswitch/wb_common.c +++ b/source3/nsswitch/wb_common.c @@ -239,6 +239,8 @@ int winbind_open_pipe_sock(void) } } + SAFE_FREE(response.extra_data); + return winbindd_fd; #else return -1; diff --git a/source3/nsswitch/wbinfo.c b/source3/nsswitch/wbinfo.c index f533799370..fcd7d2d508 100644 --- a/source3/nsswitch/wbinfo.c +++ b/source3/nsswitch/wbinfo.c @@ -1074,7 +1074,7 @@ int main(int argc, char **argv) goto done; } break; - case 'P': + case 'p': if (!wbinfo_ping()) { d_printf("could not ping winbindd!\n"); goto done; diff --git a/source3/nsswitch/winbindd.c b/source3/nsswitch/winbindd.c index 0860d701d8..8345fa11d0 100644 --- a/source3/nsswitch/winbindd.c +++ b/source3/nsswitch/winbindd.c @@ -27,20 +27,6 @@ BOOL opt_nocache = False; BOOL opt_dual_daemon = True; -/***************************************************************************** - stubb functions -****************************************************************************/ - -void become_root( void ) -{ - return; -} - -void unbecome_root( void ) -{ - return; -} - /* Reload configuration */ static BOOL reload_services_file(BOOL test) @@ -131,8 +117,8 @@ static void winbindd_status(void) if (DEBUGLEVEL >= 2 && winbindd_num_clients()) { DEBUG(2, ("\tclient list:\n")); for(tmp = winbindd_client_list(); tmp; tmp = tmp->next) { - DEBUG(2, ("\t\tpid %d, sock %d, rbl %d, wbl %d\n", - tmp->pid, tmp->sock, tmp->read_buf_len, + DEBUG(2, ("\t\tpid %lu, sock %d, rbl %d, wbl %d\n", + (unsigned long)tmp->pid, tmp->sock, tmp->read_buf_len, tmp->write_buf_len)); } } @@ -172,7 +158,7 @@ static void terminate(void) idmap_close(); /* Remove socket file */ - snprintf(path, sizeof(path), "%s/%s", + pstr_sprintf(path, "%s/%s", WINBINDD_SOCKET_DIR, WINBINDD_SOCKET_NAME); unlink(path); exit(0); @@ -471,8 +457,8 @@ void winbind_client_read(struct winbindd_cli_state *state) /* Read failed, kill client */ if (n == -1 || n == 0) { - DEBUG(5,("read failed on sock %d, pid %d: %s\n", - state->sock, state->pid, + DEBUG(5,("read failed on sock %d, pid %lu: %s\n", + state->sock, (unsigned long)state->pid, (n == -1) ? strerror(errno) : "EOF")); state->finished = True; @@ -519,8 +505,8 @@ static void client_write(struct winbindd_cli_state *state) if (num_written == -1 || num_written == 0) { - DEBUG(3,("write failed on sock %d, pid %d: %s\n", - state->sock, state->pid, + DEBUG(3,("write failed on sock %d, pid %lu: %s\n", + state->sock, (unsigned long)state->pid, (num_written == -1) ? strerror(errno) : "EOF")); state->finished = True; @@ -726,8 +712,8 @@ static void process_loop(void) if (state->read_buf_len >= sizeof(uint32) && *(uint32 *) &state->request != sizeof(state->request)) { - DEBUG(0,("process_loop: Invalid request size from pid %d: %d bytes sent, should be %d\n", - state->request.pid, *(uint32 *) &state->request, sizeof(state->request))); + DEBUG(0,("process_loop: Invalid request size from pid %lu: %d bytes sent, should be %d\n", + (unsigned long)state->request.pid, *(uint32 *) &state->request, sizeof(state->request))); remove_client(state); break; @@ -838,7 +824,7 @@ int main(int argc, char **argv) exit(1); } - snprintf(logfile, sizeof(logfile), "%s/log.winbindd", dyn_LOGFILEBASE); + pstr_sprintf(logfile, "%s/log.winbindd", dyn_LOGFILEBASE); lp_set_logfile(logfile); setup_logging("winbindd", log_stdout); reopen_logs(); diff --git a/source3/nsswitch/winbindd.h b/source3/nsswitch/winbindd.h index 2acb89b24b..677afa1849 100644 --- a/source3/nsswitch/winbindd.h +++ b/source3/nsswitch/winbindd.h @@ -4,7 +4,7 @@ Winbind daemon for ntdom nss module Copyright (C) Tim Potter 2000 - Copyright (C) Anthony Liguori 2003 + Copyright (C) Jim McDonough 2003 This library is free software; you can redistribute it and/or modify it under the terms of the GNU Library General Public diff --git a/source3/nsswitch/winbindd_acct.c b/source3/nsswitch/winbindd_acct.c index a1cd1d5f19..8abfd17110 100644 --- a/source3/nsswitch/winbindd_acct.c +++ b/source3/nsswitch/winbindd_acct.c @@ -136,8 +136,8 @@ static WINBINDD_PW* string2passwd( char *string ) /* last minute sanity checks */ if ( pw.pw_uid==0 || pw.pw_gid==0 ) { - DEBUG(0,("string2passwd: Failure! uid==%d, gid==%d\n", - pw.pw_uid, pw.pw_gid)); + DEBUG(0,("string2passwd: Failure! uid==%lu, gid==%lu\n", + (unsigned long)pw.pw_uid, (unsigned long)pw.pw_gid)); return NULL; } @@ -161,17 +161,17 @@ static char* passwd2string( const WINBINDD_PW *pw ) DEBUG(10,("passwd2string: converting passwd struct for %s\n", pw->pw_name)); - ret = snprintf( string, sizeof(string), "%s:%s:%d:%d:%s:%s:%s", + ret = pstr_sprintf( string, "%s:%s:%lu:%lu:%s:%s:%s", pw->pw_name, pw->pw_passwd ? pw->pw_passwd : "x", - pw->pw_uid, - pw->pw_gid, + (unsigned long)pw->pw_uid, + (unsigned long)pw->pw_gid, pw->pw_gecos, pw->pw_dir, pw->pw_shell ); if ( ret < 0 ) { - DEBUG(0,("passwd2string: snprintf() failed!\n")); + DEBUG(0,("passwd2string: pstr_sprintf() failed!\n")); return NULL; } @@ -247,7 +247,7 @@ static WINBINDD_GR* string2group( char *string ) /* last minute sanity checks */ if ( grp.gr_gid == 0 ) { - DEBUG(0,("string2group: Failure! gid==%d\n", grp.gr_gid)); + DEBUG(0,("string2group: Failure! gid==%lu\n", (unsigned long)grp.gr_gid)); SAFE_FREE( gr_members ); return NULL; } @@ -303,16 +303,16 @@ static char* group2string( const WINBINDD_GR *grp ) fstrcpy( gr_mem_str, "" ); } - ret = snprintf( string, sizeof(string)-1, "%s:%s:%d:%s", + ret = pstr_sprintf( string, "%s:%s:%lu:%s", grp->gr_name, grp->gr_passwd ? grp->gr_passwd : "*", - grp->gr_gid, + (unsigned long)grp->gr_gid, gr_mem_str ); SAFE_FREE( gr_mem_str ); if ( ret < 0 ) { - DEBUG(0,("group2string: snprintf() failed!\n")); + DEBUG(0,("group2string: pstr_sprintf() failed!\n")); return NULL; } @@ -326,7 +326,7 @@ static char* acct_userkey_byname( const char *name ) { static fstring key; - snprintf( key, sizeof(key), "%s/NAME/%s", WBKEY_PASSWD, name ); + fstr_sprintf( key, "%s/NAME/%s", WBKEY_PASSWD, name ); return key; } @@ -338,7 +338,7 @@ static char* acct_userkey_byuid( uid_t uid ) { static fstring key; - snprintf( key, sizeof(key), "%s/UID/%d", WBKEY_PASSWD, uid ); + fstr_sprintf( key, "%s/UID/%lu", WBKEY_PASSWD, (unsigned long)uid ); return key; } @@ -350,7 +350,7 @@ static char* acct_groupkey_byname( const char *name ) { static fstring key; - snprintf( key, sizeof(key), "%s/NAME/%s", WBKEY_GROUP, name ); + fstr_sprintf( key, "%s/NAME/%s", WBKEY_GROUP, name ); return key; } @@ -362,7 +362,7 @@ static char* acct_groupkey_bygid( gid_t gid ) { static fstring key; - snprintf( key, sizeof(key), "%s/GID/%d", WBKEY_GROUP, gid ); + fstr_sprintf( key, "%s/GID/%lu", WBKEY_GROUP, (unsigned long)gid ); return key; } @@ -415,7 +415,7 @@ WINBINDD_PW* wb_getpwuid( const uid_t uid ) data = tdb_fetch_bystring( account_tdb, acct_userkey_byuid(uid) ); if ( !data.dptr ) { - DEBUG(4,("wb_getpwuid: failed to locate uid == %d\n", uid)); + DEBUG(4,("wb_getpwuid: failed to locate uid == %lu\n", (unsigned long)uid)); return NULL; } keystr = acct_userkey_byname( data.dptr ); @@ -431,8 +431,8 @@ WINBINDD_PW* wb_getpwuid( const uid_t uid ) SAFE_FREE( data.dptr ); } - DEBUG(5,("wb_getpwuid: %s user (uid == %d)\n", - (pw ? "Found" : "Did not find"), uid )); + DEBUG(5,("wb_getpwuid: %s user (uid == %lu)\n", + (pw ? "Found" : "Did not find"), (unsigned long)uid )); return pw; } @@ -544,7 +544,8 @@ WINBINDD_GR* wb_getgrgid( gid_t gid ) data = tdb_fetch_bystring( account_tdb, acct_groupkey_bygid(gid) ); if ( !data.dptr ) { - DEBUG(4,("wb_getgrgid: failed to locate gid == %d\n", gid)); + DEBUG(4,("wb_getgrgid: failed to locate gid == %lu\n", + (unsigned long)gid)); return NULL; } keystr = acct_groupkey_byname( data.dptr ); @@ -560,8 +561,8 @@ WINBINDD_GR* wb_getgrgid( gid_t gid ) SAFE_FREE( data.dptr ); } - DEBUG(5,("wb_getgrgid: %s group (gid == %d)\n", - (grp ? "Found" : "Did not find"), gid )); + DEBUG(5,("wb_getgrgid: %s group (gid == %lu)\n", + (grp ? "Found" : "Did not find"), (unsigned long)gid )); return grp; } @@ -697,7 +698,7 @@ static int cleangroups_traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, TDB_DATA fstring key; char *name = (char*)state; - snprintf( key, sizeof(key), "%s/NAME", WBKEY_GROUP ); + fstr_sprintf( key, "%s/NAME", WBKEY_GROUP ); len = strlen(key); /* if this is a group entry then, check the members */ @@ -776,7 +777,7 @@ static int isprimarygroup_traverse_fn(TDB_CONTEXT *the_tdb, TDB_DATA kbuf, fstring key; struct _check_primary_grp *check = (struct _check_primary_grp*)params; - snprintf( key, sizeof(key), "%s/NAME", WBKEY_PASSWD ); + fstr_sprintf( key, "%s/NAME", WBKEY_PASSWD ); len = strlen(key); /* if this is a group entry then, check the members */ @@ -875,8 +876,8 @@ enum winbindd_result winbindd_create_user(struct winbindd_cli_state *state) user = state->request.data.acct_mgt.username; group = state->request.data.acct_mgt.groupname; - DEBUG(3, ("[%5d]: create_user: user=>(%s), group=>(%s)\n", - state->pid, user, group)); + DEBUG(3, ("[%5lu]: create_user: user=>(%s), group=>(%s)\n", + (unsigned long)state->pid, user, group)); if ( !*group ) group = lp_template_primary_group(); @@ -965,7 +966,7 @@ enum winbindd_result winbindd_create_group(struct winbindd_cli_state *state) state->request.data.acct_mgt.groupname[sizeof(state->request.data.acct_mgt.groupname)-1]='\0'; group = state->request.data.acct_mgt.groupname; - DEBUG(3, ("[%5d]: create_group: (%s)\n", state->pid, group)); + DEBUG(3, ("[%5lu]: create_group: (%s)\n", (unsigned long)state->pid, group)); /* get a new uid */ @@ -1025,7 +1026,7 @@ enum winbindd_result winbindd_add_user_to_group(struct winbindd_cli_state *state group = state->request.data.acct_mgt.groupname; user = state->request.data.acct_mgt.username; - DEBUG(3, ("[%5d]: add_user_to_group: add %s to %s\n", state->pid, + DEBUG(3, ("[%5lu]: add_user_to_group: add %s to %s\n", (unsigned long)state->pid, user, group)); /* make sure it is a valid user */ @@ -1073,7 +1074,7 @@ enum winbindd_result winbindd_remove_user_from_group(struct winbindd_cli_state * group = state->request.data.acct_mgt.groupname; user = state->request.data.acct_mgt.username; - DEBUG(3, ("[%5d]: remove_user_to_group: delete %s from %s\n", state->pid, + DEBUG(3, ("[%5lu]: remove_user_to_group: delete %s from %s\n", (unsigned long)state->pid, user, group)); /* don't worry about checking the username since we're removing it anyways */ @@ -1116,8 +1117,8 @@ enum winbindd_result winbindd_set_user_primary_group(struct winbindd_cli_state * group = state->request.data.acct_mgt.groupname; user = state->request.data.acct_mgt.username; - DEBUG(3, ("[%5d]: set_user_primary_grou:p group %s for user %s\n", state->pid, - group, user)); + DEBUG(3, ("[%5lu]: set_user_primary_group: group %s for user %s\n", + (unsigned long)state->pid, group, user)); /* make sure it is a valid user */ @@ -1158,7 +1159,7 @@ enum winbindd_result winbindd_delete_user(struct winbindd_cli_state *state) state->request.data.acct_mgt.username[sizeof(state->request.data.acct_mgt.username)-1]='\0'; user = state->request.data.acct_mgt.username; - DEBUG(3, ("[%5d]: delete_user: %s\n", state->pid, user)); + DEBUG(3, ("[%5lu]: delete_user: %s\n", (unsigned long)state->pid, user)); /* make sure it is a valid user */ @@ -1189,7 +1190,7 @@ enum winbindd_result winbindd_delete_group(struct winbindd_cli_state *state) state->request.data.acct_mgt.username[sizeof(state->request.data.acct_mgt.groupname)-1]='\0'; group = state->request.data.acct_mgt.groupname; - DEBUG(3, ("[%5d]: delete_group: %s\n", state->pid, group)); + DEBUG(3, ("[%5lu]: delete_group: %s\n", (unsigned long)state->pid, group)); /* make sure it is a valid group */ diff --git a/source3/nsswitch/winbindd_ads.c b/source3/nsswitch/winbindd_ads.c index 462dd21531..7140dc35a0 100644 --- a/source3/nsswitch/winbindd_ads.c +++ b/source3/nsswitch/winbindd_ads.c @@ -801,24 +801,91 @@ static NTSTATUS trusted_domains(struct winbindd_domain *domain, char ***alt_names, DOM_SID **dom_sids) { - ADS_STRUCT *ads; - ADS_STATUS rc; + NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DS_DOMAIN_TRUSTS *domains = NULL; + int count = 0; + int i; + struct cli_state *cli = NULL; + /* i think we only need our forest and downlevel trusted domains */ + uint32 flags = DS_DOMAIN_IN_FOREST | DS_DOMAIN_DIRECT_OUTBOUND; DEBUG(3,("ads: trusted_domains\n")); *num_domains = 0; - *names = NULL; + *alt_names = NULL; + *names = NULL; + *dom_sids = NULL; + + if ( !NT_STATUS_IS_OK(result = cm_fresh_connection(domain->name, PI_NETLOGON, &cli)) ) { + DEBUG(5, ("trusted_domains: Could not open a connection to %s for PIPE_NETLOGON (%s)\n", + domain->name, nt_errstr(result))); + return NT_STATUS_UNSUCCESSFUL; + } + + if ( NT_STATUS_IS_OK(result) ) + result = cli_ds_enum_domain_trusts( cli, mem_ctx, cli->desthost, flags, &domains, &count ); + + if ( NT_STATUS_IS_OK(result) && count) { + + /* Allocate memory for trusted domain names and sids */ - ads = ads_cached_connection(domain); + if ( !(*names = (char **)talloc(mem_ctx, sizeof(char *) * count)) ) { + DEBUG(0, ("trusted_domains: out of memory\n")); + result = NT_STATUS_NO_MEMORY; + goto done; + } - if (!ads) { - domain->last_status = NT_STATUS_SERVER_DISABLED; - return NT_STATUS_UNSUCCESSFUL; + if ( !(*alt_names = (char **)talloc(mem_ctx, sizeof(char *) * count)) ) { + DEBUG(0, ("trusted_domains: out of memory\n")); + result = NT_STATUS_NO_MEMORY; + goto done; + } + + if ( !(*dom_sids = (DOM_SID *)talloc(mem_ctx, sizeof(DOM_SID) * count)) ) { + DEBUG(0, ("trusted_domains: out of memory\n")); + result = NT_STATUS_NO_MEMORY; + goto done; + } + + /* Copy across names and sids */ + + for (i = 0; i < count; i++) { + fstring tmp; + fstring tmp2; + + (*names)[i] = NULL; + (*alt_names)[i] = NULL; + ZERO_STRUCT( (*dom_sids)[i] ); + + if ( domains[i].netbios_ptr ) { + unistr2_to_ascii(tmp, &domains[i].netbios_domain, sizeof(tmp) - 1); + (*names)[i] = talloc_strdup(mem_ctx, tmp); + } + + if ( domains[i].dns_ptr ) { + unistr2_to_ascii(tmp2, &domains[i].dns_domain, sizeof(tmp2) - 1); + (*alt_names)[i] = talloc_strdup(mem_ctx, tmp2); + } + + /* sometimes we will get back a NULL SID from this call */ + + if ( domains[i].sid_ptr ) + sid_copy(&(*dom_sids)[i], &domains[i].sid.sid); + } + + *num_domains = count; } - rc = ads_trusted_domains(ads, mem_ctx, num_domains, names, alt_names, dom_sids); +done: + + SAFE_FREE( domains ); + + /* remove connection; This is a special case to the \NETLOGON pipe */ + + if ( cli ) + cli_shutdown( cli ); - return ads_ntstatus(rc); + return result; } /* find the domain sid for a domain */ diff --git a/source3/nsswitch/winbindd_cache.c b/source3/nsswitch/winbindd_cache.c index 2da2a9e641..2891a4fa68 100644 --- a/source3/nsswitch/winbindd_cache.c +++ b/source3/nsswitch/winbindd_cache.c @@ -106,7 +106,7 @@ static struct winbind_cache *get_cache(struct winbindd_domain *domain) case SEC_ADS: { extern struct winbindd_methods ads_methods; /* always obey the lp_security parameter for our domain */ - if ( strequal(lp_realm(), domain->alt_name) ) { + if ( strequal(lp_realm(), domain->alt_name) || strequal(lp_workgroup(), domain->name) ) { domain->backend = &ads_methods; break; } @@ -256,7 +256,7 @@ static NTSTATUS fetch_cache_seqnum( struct winbindd_domain *domain, time_t now ) return NT_STATUS_UNSUCCESSFUL; } - snprintf( key, sizeof(key), "SEQNUM/%s", domain->name ); + fstr_sprintf( key, "SEQNUM/%s", domain->name ); data = tdb_fetch_bystring( wcache->tdb, key ); if ( !data.dptr || data.dsize!=8 ) { @@ -295,7 +295,7 @@ static NTSTATUS store_cache_seqnum( struct winbindd_domain *domain ) return NT_STATUS_UNSUCCESSFUL; } - snprintf( key_str, sizeof(key_str), "SEQNUM/%s", domain->name ); + fstr_sprintf( key_str, "SEQNUM/%s", domain->name ); key.dptr = key_str; key.dsize = strlen(key_str)+1; @@ -328,6 +328,8 @@ static void refresh_sequence_number(struct winbindd_domain *domain, BOOL force) time_t t = time(NULL); unsigned cache_time = lp_winbind_cache_time(); + get_cache( domain ); + /* trying to reconnect is expensive, don't do it too often */ if (domain->sequence_number == DOM_SEQUENCE_NONE) { cache_time *= 8; diff --git a/source3/nsswitch/winbindd_cm.c b/source3/nsswitch/winbindd_cm.c index 7f35167778..f07117b5ab 100644 --- a/source3/nsswitch/winbindd_cm.c +++ b/source3/nsswitch/winbindd_cm.c @@ -152,7 +152,8 @@ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index, result = cli_full_connection(&new_conn->cli, global_myname(), new_conn->controller, &dc_ip, 0, "IPC$", "IPC", ipc_username, ipc_domain, - ipc_password, CLI_FULL_CONNECTION_ANNONYMOUS_FALLBACK, &retry); + ipc_password, CLI_FULL_CONNECTION_ANNONYMOUS_FALLBACK, + Undefined, &retry); secrets_named_mutex_release(new_conn->controller); @@ -169,6 +170,11 @@ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index, return result; } + /* set the domain if empty; needed for schannel connections */ + if ( !*new_conn->cli->domain ) + fstrcpy( new_conn->cli->domain, domain ); + + if ( !cli_nt_session_open (new_conn->cli, pipe_index) ) { result = NT_STATUS_PIPE_NOT_AVAILABLE; /* @@ -188,6 +194,25 @@ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index, return NT_STATUS_OK; } +/************************************************************************ + Wrapper around statuc cm_open_connection to retreive a freshly + setup cli_state struct +************************************************************************/ + +NTSTATUS cm_fresh_connection(const char *domain, const int pipe_index, + struct cli_state **cli) +{ + NTSTATUS result; + struct winbindd_cm_conn conn; + + result = cm_open_connection( domain, pipe_index, &conn ); + + if ( NT_STATUS_IS_OK(result) ) + *cli = conn.cli; + + return result; +} + /* Return true if a connection is still alive */ static BOOL connection_ok(struct winbindd_cm_conn *conn) @@ -320,13 +345,11 @@ BOOL cm_check_for_native_mode_win2k( const char *domain ) done: -#if 0 - /* - * I don't think we need to shutdown here ? JRA. - */ + /* close the connection; no other cals use this pipe and it is called only + on reestablishing the domain list --jerry */ + if ( conn.cli ) cli_shutdown( conn.cli ); -#endif return ret; } @@ -488,14 +511,14 @@ NTSTATUS cm_get_netlogon_cli(const char *domain, if (!NT_STATUS_IS_OK(result)) return result; - snprintf(lock_name, sizeof(lock_name), "NETLOGON\\%s", conn->controller); + fstr_sprintf(lock_name, "NETLOGON\\%s", conn->controller); if (!(got_mutex = secrets_named_mutex(lock_name, WINBIND_SERVER_MUTEX_WAIT_TIME))) { DEBUG(0,("cm_get_netlogon_cli: mutex grab failed for %s\n", conn->controller)); } if ( sec_channel_type == SEC_CHAN_DOMAIN ) - snprintf(conn->cli->mach_acct, sizeof(conn->cli->mach_acct) - 1, "%s$", lp_workgroup()); + fstr_sprintf(conn->cli->mach_acct, "%s$", lp_workgroup()); result = cli_nt_establish_netlogon(conn->cli, sec_channel_type, trust_passwd); diff --git a/source3/nsswitch/winbindd_group.c b/source3/nsswitch/winbindd_group.c index d67d48d506..96c121685a 100644 --- a/source3/nsswitch/winbindd_group.c +++ b/source3/nsswitch/winbindd_group.c @@ -232,7 +232,7 @@ enum winbindd_result winbindd_getgrnam(struct winbindd_cli_state *state) /* Ensure null termination */ state->request.data.groupname[sizeof(state->request.data.groupname)-1]='\0'; - DEBUG(3, ("[%5d]: getgrnam %s\n", state->pid, + DEBUG(3, ("[%5lu]: getgrnam %s\n", (unsigned long)state->pid, state->request.data.groupname)); /* Parse domain and groupname */ @@ -334,8 +334,8 @@ enum winbindd_result winbindd_getgrgid(struct winbindd_cli_state *state) int gr_mem_len; char *gr_mem; - DEBUG(3, ("[%5d]: getgrgid %d\n", state->pid, - state->request.data.gid)); + DEBUG(3, ("[%5lu]: getgrgid %lu\n", (unsigned long)state->pid, + (unsigned long)state->request.data.gid)); /* Bug out if the gid isn't in the winbind range */ @@ -360,8 +360,8 @@ enum winbindd_result winbindd_getgrgid(struct winbindd_cli_state *state) /* Get rid from gid */ if (!NT_STATUS_IS_OK(idmap_gid_to_sid(&group_sid, state->request.data.gid))) { - DEBUG(1, ("could not convert gid %d to rid\n", - state->request.data.gid)); + DEBUG(1, ("could not convert gid %lu to rid\n", + (unsigned long)state->request.data.gid)); return WINBINDD_ERROR; } @@ -416,7 +416,7 @@ enum winbindd_result winbindd_setgrent(struct winbindd_cli_state *state) { struct winbindd_domain *domain; - DEBUG(3, ("[%5d]: setgrent\n", state->pid)); + DEBUG(3, ("[%5lu]: setgrent\n", (unsigned long)state->pid)); /* Check user has enabled this */ @@ -469,7 +469,7 @@ enum winbindd_result winbindd_setgrent(struct winbindd_cli_state *state) enum winbindd_result winbindd_endgrent(struct winbindd_cli_state *state) { - DEBUG(3, ("[%5d]: endgrent\n", state->pid)); + DEBUG(3, ("[%5lu]: endgrent\n", (unsigned long)state->pid)); free_getent_state(state->getgrent_state); state->getgrent_state = NULL; @@ -605,7 +605,7 @@ enum winbindd_result winbindd_getgrent(struct winbindd_cli_state *state) int num_groups, group_list_ndx = 0, i, gr_mem_list_len = 0; char *new_extra_data, *gr_mem_list = NULL; - DEBUG(3, ("[%5d]: getgrent\n", state->pid)); + DEBUG(3, ("[%5lu]: getgrent\n", (unsigned long)state->pid)); /* Check user has enabled this */ @@ -691,7 +691,7 @@ enum winbindd_result winbindd_getgrent(struct winbindd_cli_state *state) goto tryagain; } - DEBUG(10, ("got gid %d for group %x\n", group_gid, + DEBUG(10, ("got gid %lu for group %x\n", (unsigned long)group_gid, name_list[ent->sam_entry_index].rid)); /* Fill in group entry */ @@ -825,7 +825,7 @@ enum winbindd_result winbindd_list_groups(struct winbindd_cli_state *state) char *ted = NULL; unsigned int extra_data_len = 0, i; - DEBUG(3, ("[%5d]: list groups\n", state->pid)); + DEBUG(3, ("[%5lu]: list groups\n", (unsigned long)state->pid)); /* Enumerate over trusted domains */ @@ -915,7 +915,7 @@ enum winbindd_result winbindd_getgroups(struct winbindd_cli_state *state) /* Ensure null termination */ state->request.data.username[sizeof(state->request.data.username)-1]='\0'; - DEBUG(3, ("[%5d]: getgroups %s\n", state->pid, + DEBUG(3, ("[%5lu]: getgroups %s\n", (unsigned long)state->pid, state->request.data.username)); if (!(mem_ctx = talloc_init("winbindd_getgroups(%s)", @@ -1009,9 +1009,9 @@ enum winbindd_result winbindd_getgroups(struct winbindd_cli_state *state) /* We've jumped through a lot of hoops to get here */ DEBUG(10, ("winbindd_getgroups: mapped other sid %s to " - "gid %d\n", sid_string_static( + "gid %lu\n", sid_string_static( &info3->other_sids[i].sid), - gid_list[num_gids])); + (unsigned long)gid_list[num_gids])); num_gids++; } diff --git a/source3/nsswitch/winbindd_misc.c b/source3/nsswitch/winbindd_misc.c index 8d7cdc4731..740b760b93 100644 --- a/source3/nsswitch/winbindd_misc.c +++ b/source3/nsswitch/winbindd_misc.c @@ -35,7 +35,7 @@ enum winbindd_result winbindd_check_machine_acct(struct winbindd_cli_state *stat int num_retries = 0; struct cli_state *cli; uint32 sec_channel_type; - DEBUG(3, ("[%5d]: check machine account\n", state->pid)); + DEBUG(3, ("[%5lu]: check machine account\n", (unsigned long)state->pid)); /* Get trust account password */ @@ -95,7 +95,7 @@ enum winbindd_result winbindd_list_trusted_domains(struct winbindd_cli_state int total_entries = 0, extra_data_len = 0; char *ted, *extra_data = NULL; - DEBUG(3, ("[%5d]: list trusted domains\n", state->pid)); + DEBUG(3, ("[%5lu]: list trusted domains\n", (unsigned long)state->pid)); /* We need to refresh the trusted domain list as the domains may have changed since we last looked. There may be a sequence @@ -149,7 +149,7 @@ enum winbindd_result winbindd_show_sequence(struct winbindd_cli_state *state) struct winbindd_domain *domain; char *extra_data = NULL; - DEBUG(3, ("[%5d]: show sequence\n", state->pid)); + DEBUG(3, ("[%5lu]: show sequence\n", (unsigned long)state->pid)); extra_data = strdup(""); @@ -181,7 +181,7 @@ enum winbindd_result winbindd_show_sequence(struct winbindd_cli_state *state) enum winbindd_result winbindd_ping(struct winbindd_cli_state *state) { - DEBUG(3, ("[%5d]: ping\n", state->pid)); + DEBUG(3, ("[%5lu]: ping\n", (unsigned long)state->pid)); return WINBINDD_OK; } @@ -191,7 +191,7 @@ enum winbindd_result winbindd_ping(struct winbindd_cli_state enum winbindd_result winbindd_info(struct winbindd_cli_state *state) { - DEBUG(3, ("[%5d]: request misc info\n", state->pid)); + DEBUG(3, ("[%5lu]: request misc info\n", (unsigned long)state->pid)); state->response.data.info.winbind_separator = *lp_winbind_separator(); fstrcpy(state->response.data.info.samba_version, VERSION); @@ -204,7 +204,7 @@ enum winbindd_result winbindd_info(struct winbindd_cli_state *state) enum winbindd_result winbindd_interface_version(struct winbindd_cli_state *state) { - DEBUG(3, ("[%5d]: request interface version\n", state->pid)); + DEBUG(3, ("[%5lu]: request interface version\n", (unsigned long)state->pid)); state->response.data.interface_version = WINBIND_INTERFACE_VERSION; @@ -216,7 +216,7 @@ enum winbindd_result winbindd_interface_version(struct winbindd_cli_state *state enum winbindd_result winbindd_domain_name(struct winbindd_cli_state *state) { - DEBUG(3, ("[%5d]: request domain name\n", state->pid)); + DEBUG(3, ("[%5lu]: request domain name\n", (unsigned long)state->pid)); fstrcpy(state->response.data.domain_name, lp_workgroup()); @@ -228,7 +228,7 @@ enum winbindd_result winbindd_domain_name(struct winbindd_cli_state *state) enum winbindd_result winbindd_netbios_name(struct winbindd_cli_state *state) { - DEBUG(3, ("[%5d]: request netbios name\n", state->pid)); + DEBUG(3, ("[%5lu]: request netbios name\n", (unsigned long)state->pid)); fstrcpy(state->response.data.netbios_name, global_myname()); @@ -240,7 +240,7 @@ enum winbindd_result winbindd_netbios_name(struct winbindd_cli_state *state) enum winbindd_result winbindd_priv_pipe_dir(struct winbindd_cli_state *state) { - DEBUG(3, ("[%5d]: request location of privileged pipe\n", state->pid)); + DEBUG(3, ("[%5lu]: request location of privileged pipe\n", (unsigned long)state->pid)); state->response.extra_data = strdup(get_winbind_priv_pipe_dir()); if (!state->response.extra_data) diff --git a/source3/nsswitch/winbindd_pam.c b/source3/nsswitch/winbindd_pam.c index 8df0f621c0..a8908487c1 100644 --- a/source3/nsswitch/winbindd_pam.c +++ b/source3/nsswitch/winbindd_pam.c @@ -53,55 +53,6 @@ static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx, return NT_STATUS_OK; } -/******************************************************************* - wrapper around retreiving the trsut account password -*******************************************************************/ - -static BOOL get_trust_pw(const char *domain, uint8 ret_pwd[16], - time_t *pass_last_set_time, uint32 *channel) -{ - DOM_SID sid; - char *pwd; - - /* if we are a DC and this is not our domain, then lookup an account - for the domain trust */ - - if ( IS_DC && !strequal(domain, lp_workgroup()) && lp_allow_trusted_domains() ) - { - if ( !secrets_fetch_trusted_domain_password(domain, &pwd, &sid, - pass_last_set_time) ) - { - DEBUG(0, ("get_trust_pw: could not fetch trust account " - "password for trusted domain %s\n", domain)); - return False; - } - - *channel = SEC_CHAN_DOMAIN; - E_md4hash(pwd, ret_pwd); - SAFE_FREE(pwd); - - return True; - } - else /* just get the account for our domain (covers - ROLE_DOMAIN_MEMBER as well */ - { - /* get the machine trust account for our domain */ - - if ( !secrets_fetch_trust_account_password (lp_workgroup(), ret_pwd, - pass_last_set_time, channel) ) - { - DEBUG(0, ("get_trust_pw: could not fetch trust account " - "password for my domain %s\n", domain)); - return False; - } - - return True; - } - - /* Failure */ - return False; -} - /********************************************************************** Authenticate a user with a clear test password **********************************************************************/ @@ -131,7 +82,7 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) /* Ensure null termination */ state->request.data.auth.pass[sizeof(state->request.data.auth.pass)-1]='\0'; - DEBUG(3, ("[%5d]: pam auth %s\n", state->pid, + DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state->pid, state->request.data.auth.user)); if (!(mem_ctx = talloc_init("winbind pam auth for %s", state->request.data.auth.user))) { @@ -305,7 +256,7 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) goto done; } - DEBUG(3, ("[%5d]: pam auth crap domain: %s user: %s\n", state->pid, + DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid, domain, user)); if ( !get_trust_pw(domain, trust_passwd, &last_change_time, &sec_channel_type) ) { @@ -436,7 +387,7 @@ enum winbindd_result winbindd_pam_chauthtok(struct winbindd_cli_state *state) fstring domain, user; CLI_POLICY_HND *hnd; - DEBUG(3, ("[%5d]: pam chauthtok %s\n", state->pid, + DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state->pid, state->request.data.chauthtok.user)); /* Setup crap */ diff --git a/source3/nsswitch/winbindd_sid.c b/source3/nsswitch/winbindd_sid.c index 676beae3aa..98a6fce24b 100644 --- a/source3/nsswitch/winbindd_sid.c +++ b/source3/nsswitch/winbindd_sid.c @@ -39,7 +39,7 @@ enum winbindd_result winbindd_lookupsid(struct winbindd_cli_state *state) /* Ensure null termination */ state->request.data.sid[sizeof(state->request.data.sid)-1]='\0'; - DEBUG(3, ("[%5d]: lookupsid %s\n", state->pid, + DEBUG(3, ("[%5lu]: lookupsid %s\n", (unsigned long)state->pid, state->request.data.sid)); /* Lookup sid from PDC using lsa_lookup_sids() */ @@ -90,7 +90,7 @@ enum winbindd_result winbindd_lookupname(struct winbindd_cli_state *state) /* Ensure null termination */ state->request.data.sid[sizeof(state->request.data.name.name)-1]='\0'; - DEBUG(3, ("[%5d]: lookupname %s%s%s\n", state->pid, + DEBUG(3, ("[%5lu]: lookupname %s%s%s\n", (unsigned long)state->pid, state->request.data.name.dom_name, lp_winbind_separator(), state->request.data.name.name)); @@ -127,7 +127,7 @@ enum winbindd_result winbindd_sid_to_uid(struct winbindd_cli_state *state) /* Ensure null termination */ state->request.data.sid[sizeof(state->request.data.sid)-1]='\0'; - DEBUG(3, ("[%5d]: sid to uid %s\n", state->pid, + DEBUG(3, ("[%5lu]: sid to uid %s\n", (unsigned long)state->pid, state->request.data.sid)); /* Split sid into domain sid and user rid */ @@ -159,7 +159,7 @@ enum winbindd_result winbindd_sid_to_gid(struct winbindd_cli_state *state) /* Ensure null termination */ state->request.data.sid[sizeof(state->request.data.sid)-1]='\0'; - DEBUG(3, ("[%5d]: sid to gid %s\n", state->pid, + DEBUG(3, ("[%5lu]: sid to gid %s\n", (unsigned long)state->pid, state->request.data.sid)); if (!string_to_sid(&sid, state->request.data.sid)) { @@ -192,13 +192,13 @@ enum winbindd_result winbindd_uid_to_sid(struct winbindd_cli_state *state) return WINBINDD_ERROR; } - DEBUG(3, ("[%5d]: uid to sid %d\n", state->pid, - state->request.data.uid)); + DEBUG(3, ("[%5lu]: uid to sid %lu\n", (unsigned long)state->pid, + (unsigned long)state->request.data.uid)); /* Lookup rid for this uid */ if (!NT_STATUS_IS_OK(idmap_uid_to_sid(&sid, state->request.data.uid))) { - DEBUG(1, ("Could not convert uid %d to rid\n", - state->request.data.uid)); + DEBUG(1, ("Could not convert uid %lu to rid\n", + (unsigned long)state->request.data.uid)); return WINBINDD_ERROR; } @@ -221,13 +221,13 @@ enum winbindd_result winbindd_gid_to_sid(struct winbindd_cli_state *state) return WINBINDD_ERROR; } - DEBUG(3, ("[%5d]: gid to sid %d\n", state->pid, - state->request.data.gid)); + DEBUG(3, ("[%5lu]: gid to sid %lu\n", (unsigned long)state->pid, + (unsigned long)state->request.data.gid)); /* Lookup sid for this uid */ if (!NT_STATUS_IS_OK(idmap_gid_to_sid(&sid, state->request.data.gid))) { - DEBUG(1, ("Could not convert gid %d to sid\n", - state->request.data.gid)); + DEBUG(1, ("Could not convert gid %lu to sid\n", + (unsigned long)state->request.data.gid)); return WINBINDD_ERROR; } diff --git a/source3/nsswitch/winbindd_user.c b/source3/nsswitch/winbindd_user.c index c49c41687b..c0b0d94167 100644 --- a/source3/nsswitch/winbindd_user.c +++ b/source3/nsswitch/winbindd_user.c @@ -108,7 +108,7 @@ enum winbindd_result winbindd_getpwnam(struct winbindd_cli_state *state) /* Ensure null termination */ state->request.data.username[sizeof(state->request.data.username)-1]='\0'; - DEBUG(3, ("[%5d]: getpwnam %s\n", state->pid, + DEBUG(3, ("[%5lu]: getpwnam %s\n", (unsigned long)state->pid, state->request.data.username)); /* Parse domain and username */ @@ -131,7 +131,7 @@ enum winbindd_result winbindd_getpwnam(struct winbindd_cli_state *state) /* should we deal with users for our domain? */ if ( lp_winbind_trusted_domains_only() && strequal(name_domain, lp_workgroup())) { - DEBUG(7,("winbindd_getpenam: My domain -- rejecting getpwnam() for %s\\%s.\n", + DEBUG(7,("winbindd_getpwnam: My domain -- rejecting getpwnam() for %s\\%s.\n", name_domain, name_user)); return WINBINDD_ERROR; } @@ -209,8 +209,8 @@ enum winbindd_result winbindd_getpwuid(struct winbindd_cli_state *state) (state->request.data.uid > server_state.uid_high)) return WINBINDD_ERROR; - DEBUG(3, ("[%5d]: getpwuid %d\n", state->pid, - state->request.data.uid)); + DEBUG(3, ("[%5lu]: getpwuid %lu\n", (unsigned long)state->pid, + (unsigned long)state->request.data.uid)); /* always try local tdb first */ @@ -222,8 +222,8 @@ enum winbindd_result winbindd_getpwuid(struct winbindd_cli_state *state) /* Get rid from uid */ if (!NT_STATUS_IS_OK(idmap_uid_to_sid(&user_sid, state->request.data.uid))) { - DEBUG(1, ("could not convert uid %d to SID\n", - state->request.data.uid)); + DEBUG(1, ("could not convert uid %lu to SID\n", + (unsigned long)state->request.data.uid)); return WINBINDD_ERROR; } @@ -246,8 +246,8 @@ enum winbindd_result winbindd_getpwuid(struct winbindd_cli_state *state) /* Get some user info */ - if (!(mem_ctx = talloc_init("winbind_getpwuid(%d)", - state->request.data.uid))) { + if (!(mem_ctx = talloc_init("winbind_getpwuid(%lu)", + (unsigned long)state->request.data.uid))) { DEBUG(1, ("out of memory\n")); return WINBINDD_ERROR; @@ -295,7 +295,7 @@ enum winbindd_result winbindd_setpwent(struct winbindd_cli_state *state) { struct winbindd_domain *domain; - DEBUG(3, ("[%5d]: setpwent\n", state->pid)); + DEBUG(3, ("[%5lu]: setpwent\n", (unsigned long)state->pid)); /* Check user has enabled this */ @@ -359,7 +359,7 @@ enum winbindd_result winbindd_setpwent(struct winbindd_cli_state *state) enum winbindd_result winbindd_endpwent(struct winbindd_cli_state *state) { - DEBUG(3, ("[%5d]: endpwent\n", state->pid)); + DEBUG(3, ("[%5lu]: endpwent\n", (unsigned long)state->pid)); free_getent_state(state->getpwent_state); state->getpwent_state = NULL; @@ -474,7 +474,7 @@ enum winbindd_result winbindd_getpwent(struct winbindd_cli_state *state) struct winbindd_pw *user_list; int num_users, user_list_ndx = 0, i; - DEBUG(3, ("[%5d]: getpwent\n", state->pid)); + DEBUG(3, ("[%5lu]: getpwent\n", (unsigned long)state->pid)); /* Check user has enabled this */ @@ -581,7 +581,7 @@ enum winbindd_result winbindd_list_users(struct winbindd_cli_state *state) TALLOC_CTX *mem_ctx; enum winbindd_result rv = WINBINDD_ERROR; - DEBUG(3, ("[%5d]: list users\n", state->pid)); + DEBUG(3, ("[%5lu]: list users\n", (unsigned long)state->pid)); if (!(mem_ctx = talloc_init("winbindd_list_users"))) return WINBINDD_ERROR; diff --git a/source3/nsswitch/winbindd_util.c b/source3/nsswitch/winbindd_util.c index 6177c46aef..a810e503a0 100644 --- a/source3/nsswitch/winbindd_util.c +++ b/source3/nsswitch/winbindd_util.c @@ -111,7 +111,7 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const fstrcpy(domain->name, alt_name); fstrcpy(domain->alt_name, domain_name); } else { - fstrcpy(domain->name, domain_name); + fstrcpy(domain->name, domain_name); if (alt_name) { fstrcpy(domain->alt_name, alt_name); } @@ -174,8 +174,11 @@ void rescan_trusted_domains(BOOL force) char **names; char **alt_names; int num_domains = 0; - DOM_SID *dom_sids; + DOM_SID *dom_sids, null_sid; int i; + struct winbindd_domain *new_domain; + + ZERO_STRUCTP(&null_sid); result = domain->methods->trusted_domains(domain, mem_ctx, &num_domains, &names, &alt_names, &dom_sids); @@ -183,12 +186,34 @@ void rescan_trusted_domains(BOOL force) continue; } - /* Add each domain to the trusted domain list. Each domain inherits - the access methods of its parent */ + /* Add each domain to the trusted domain list */ + for(i = 0; i < num_domains; i++) { DEBUG(10,("Found domain %s\n", names[i])); add_trusted_domain(names[i], alt_names?alt_names[i]:NULL, domain->methods, &dom_sids[i]); + + /* if the SID was empty, we better set it now */ + + if ( sid_equal(&dom_sids[i], &null_sid) ) { + + new_domain = find_domain_from_name(names[i]); + + /* this should never happen */ + if ( !new_domain ) { + DEBUG(0,("rescan_trust_domains: can't find the domain I just added! [%s]\n", + names[i])); + break; + } + + /* call the cache method; which will operate on the winbindd_domain \ + passed in and choose either rpc or ads as appropriate */ + + result = domain->methods->domain_sid( new_domain, &new_domain->sid ); + + if ( NT_STATUS_IS_OK(result) ) + sid_copy( &dom_sids[i], &domain->sid ); + } /* store trusted domain in the cache */ trustdom_cache_store(names[i], alt_names ? alt_names[i] : NULL, @@ -209,7 +234,7 @@ BOOL init_domain_list(void) free_domain_list(); /* Add ourselves as the first entry */ - domain = add_trusted_domain(lp_workgroup(), NULL, &cache_methods, NULL); + domain = add_trusted_domain( lp_workgroup(), NULL, &cache_methods, NULL); if (!secrets_fetch_domain_sid(domain->name, &domain->sid)) { DEBUG(1, ("Could not fetch sid for our domain %s\n", domain->name)); @@ -782,3 +807,53 @@ BOOL winbindd_upgrade_idmap(void) return idmap_convert(idmap_name); } + +/******************************************************************* + wrapper around retrieving the trust account password +*******************************************************************/ + +BOOL get_trust_pw(const char *domain, uint8 ret_pwd[16], + time_t *pass_last_set_time, uint32 *channel) +{ + DOM_SID sid; + char *pwd; + + /* if we are a DC and this is not our domain, then lookup an account + for the domain trust */ + + if ( IS_DC && !strequal(domain, lp_workgroup()) && lp_allow_trusted_domains() ) + { + if ( !secrets_fetch_trusted_domain_password(domain, &pwd, &sid, + pass_last_set_time) ) + { + DEBUG(0, ("get_trust_pw: could not fetch trust account " + "password for trusted domain %s\n", domain)); + return False; + } + + *channel = SEC_CHAN_DOMAIN; + E_md4hash(pwd, ret_pwd); + SAFE_FREE(pwd); + + return True; + } + else /* just get the account for our domain (covers + ROLE_DOMAIN_MEMBER as well */ + { + /* get the machine trust account for our domain */ + + if ( !secrets_fetch_trust_account_password (lp_workgroup(), ret_pwd, + pass_last_set_time, channel) ) + { + DEBUG(0, ("get_trust_pw: could not fetch trust account " + "password for my domain %s\n", domain)); + return False; + } + + return True; + } + + /* Failure */ + return False; +} + diff --git a/source3/nsswitch/winbindd_wins.c b/source3/nsswitch/winbindd_wins.c index 66903e250d..49bee2dc9f 100644 --- a/source3/nsswitch/winbindd_wins.c +++ b/source3/nsswitch/winbindd_wins.c @@ -137,7 +137,7 @@ enum winbindd_result winbindd_wins_byip(struct winbindd_cli_state *state) /* Ensure null termination */ state->request.data.winsreq[sizeof(state->request.data.winsreq)-1]='\0'; - DEBUG(3, ("[%5d]: wins_byip %s\n", state->pid, + DEBUG(3, ("[%5lu]: wins_byip %s\n", (unsigned long)state->pid, state->request.data.winsreq)); *response = '\0'; @@ -184,7 +184,7 @@ enum winbindd_result winbindd_wins_byname(struct winbindd_cli_state *state) /* Ensure null termination */ state->request.data.winsreq[sizeof(state->request.data.winsreq)-1]='\0'; - DEBUG(3, ("[%5d]: wins_byname %s\n", state->pid, + DEBUG(3, ("[%5lu]: wins_byname %s\n", (unsigned long)state->pid, state->request.data.winsreq)); *response = '\0'; diff --git a/source3/nsswitch/wins.c b/source3/nsswitch/wins.c index 62493ef0a9..87dac60192 100644 --- a/source3/nsswitch/wins.c +++ b/source3/nsswitch/wins.c @@ -86,29 +86,6 @@ static void nss_wins_init(void) load_interfaces(); } -static struct node_status *lookup_byaddr_backend(char *addr, int *count) -{ - int fd; - struct in_addr ip; - struct nmb_name nname; - struct node_status *status; - - if (!initialised) { - nss_wins_init(); - } - - fd = wins_lookup_open_socket_in(); - if (fd == -1) - return NULL; - - make_nmb_name(&nname, "*", 0); - ip = *interpret_addr2(addr); - status = node_status_query(fd,&nname,ip, count); - - close(fd); - return status; -} - static struct in_addr *lookup_byname_backend(const char *name, int *count) { int fd = -1; @@ -149,8 +126,31 @@ static struct in_addr *lookup_byname_backend(const char *name, int *count) return ret; } - #ifdef HAVE_NS_API_H + +static struct node_status *lookup_byaddr_backend(char *addr, int *count) +{ + int fd; + struct in_addr ip; + struct nmb_name nname; + struct node_status *status; + + if (!initialised) { + nss_wins_init(); + } + + fd = wins_lookup_open_socket_in(); + if (fd == -1) + return NULL; + + make_nmb_name(&nname, "*", 0); + ip = *interpret_addr2(addr); + status = node_status_query(fd,&nname,ip, count); + + close(fd); + return status; +} + /* IRIX version */ int init(void) diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index dd429fa688..8bd50f35de 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -8,7 +8,7 @@ Copyright (C) Simo Sorce 2001 Copyright (C) Alexander Bokovoy 2002 Copyright (C) Stefan (metze) Metzmacher 2002 - Copyright (C) Anthony Liguori 2003 + Copyright (C) Jim McDonough 2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -292,6 +292,7 @@ typedef struct int restrict_anonymous; int name_cache_timeout; int client_signing; + int server_signing; param_opt_struct *param_opt; } global; @@ -693,15 +694,17 @@ static const struct enum_list enum_smb_signing_vals[] = { {False, "False"}, {False, "0"}, {False, "Off"}, + {False, "disabled"}, {True, "Yes"}, {True, "True"}, {True, "1"}, {True, "On"}, - {Required, "Required"}, - {Required, "Mandatory"}, - {Required, "Force"}, - {Required, "Forced"}, - {Required, "Enforced"}, + {True, "enabled"}, + {Required, "required"}, + {Required, "mandatory"}, + {Required, "force"}, + {Required, "forced"}, + {Required, "enforced"}, {-1, NULL} }; @@ -735,427 +738,432 @@ static const struct enum_list enum_map_to_guest[] = { }; /* Note: We do not initialise the defaults union - it is not allowed in ANSI C - * - * Note: We have a flag called FLAG_DEVELOPER but is not used at this time, it - * is implied in current control logic. This may change at some later time. A - * flag value of 0 means - show as development option only. * * The FLAG_HIDE is explicit. Paramters set this way do NOT appear in any edit * screen in SWAT. This is used to exclude parameters as well as to squash all * parameters that have been duplicated by pseudonyms. + * + * NOTE: To display a parameter in BASIC view set FLAG_BASIC + * Any parameter that does NOT have FLAG_ADVANCED will not disply at all + * Set FLAG_SHARE and FLAG_PRINT to specifically display parameters in + * respective views. */ + static struct parm_struct parm_table[] = { - {"Base Options", P_SEP, P_SEPARATOR}, - - {"dos charset", P_STRING, P_GLOBAL, &Globals.dos_charset, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"unix charset", P_STRING, P_GLOBAL, &Globals.unix_charset, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"display charset", P_STRING, P_GLOBAL, &Globals.display_charset, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"comment", P_STRING, P_LOCAL, &sDefault.comment, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT | FLAG_DEVELOPER}, - {"path", P_STRING, P_LOCAL, &sDefault.szPath, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT | FLAG_DEVELOPER}, - {"directory", P_STRING, P_LOCAL, &sDefault.szPath, NULL, NULL, FLAG_HIDE}, - {"workgroup", P_USTRING, P_GLOBAL, &Globals.szWorkgroup, handle_workgroup, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"realm", P_USTRING, P_GLOBAL, &Globals.szRealm, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"netbios name", P_USTRING, P_GLOBAL, &Globals.szNetbiosName, handle_netbios_name, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"netbios aliases", P_LIST, P_GLOBAL, &Globals.szNetbiosAliases, handle_netbios_aliases, NULL, FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"netbios scope", P_USTRING, P_GLOBAL, &Globals.szNetbiosScope, handle_netbios_scope, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"server string", P_STRING, P_GLOBAL, &Globals.szServerString, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_DEVELOPER}, - {"interfaces", P_LIST, P_GLOBAL, &Globals.szInterfaces, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"bind interfaces only", P_BOOL, P_GLOBAL, &Globals.bBindInterfacesOnly, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - - {"Security Options", P_SEP, P_SEPARATOR}, - - {"security", P_ENUM, P_GLOBAL, &Globals.security, NULL, enum_security, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"auth methods", P_LIST, P_GLOBAL, &Globals.AuthMethods, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"encrypt passwords", P_BOOL, P_GLOBAL, &Globals.bEncryptPasswords, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"update encrypted", P_BOOL, P_GLOBAL, &Globals.bUpdateEncrypt, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_DEVELOPER}, - {"client schannel", P_ENUM, P_GLOBAL, &Globals.clientSchannel, NULL, enum_bool_auto, FLAG_BASIC | FLAG_ADVANCED | FLAG_DEVELOPER}, - {"server schannel", P_ENUM, P_GLOBAL, &Globals.serverSchannel, NULL, enum_bool_auto, FLAG_BASIC | FLAG_ADVANCED | FLAG_DEVELOPER}, - {"allow trusted domains", P_BOOL, P_GLOBAL, &Globals.bAllowTrustedDomains, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"hosts equiv", P_STRING, P_GLOBAL, &Globals.szHostsEquiv, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"min passwd length", P_INTEGER, P_GLOBAL, &Globals.min_passwd_length, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"min password length", P_INTEGER, P_GLOBAL, &Globals.min_passwd_length, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"map to guest", P_ENUM, P_GLOBAL, &Globals.map_to_guest, NULL, enum_map_to_guest, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"null passwords", P_BOOL, P_GLOBAL, &Globals.bNullPasswords, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"obey pam restrictions", P_BOOL, P_GLOBAL, &Globals.bObeyPamRestrictions, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"password server", P_STRING, P_GLOBAL, &Globals.szPasswordServer, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"smb passwd file", P_STRING, P_GLOBAL, &Globals.szSMBPasswdFile, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"private dir", P_STRING, P_GLOBAL, &Globals.szPrivateDir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"passdb backend", P_LIST, P_GLOBAL, &Globals.szPassdbBackend, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"algorithmic rid base", P_INTEGER, P_GLOBAL, &Globals.AlgorithmicRidBase, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"root directory", P_STRING, P_GLOBAL, &Globals.szRootdir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"root dir", P_STRING, P_GLOBAL, &Globals.szRootdir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"root", P_STRING, P_GLOBAL, &Globals.szRootdir, NULL, NULL, FLAG_HIDE | FLAG_DEVELOPER}, - {"guest account", P_STRING, P_GLOBAL, &Globals.szGuestaccount, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"pam password change", P_BOOL, P_GLOBAL, &Globals.bPamPasswordChange, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"passwd program", P_STRING, P_GLOBAL, &Globals.szPasswdProgram, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"passwd chat", P_STRING, P_GLOBAL, &Globals.szPasswdChat, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"passwd chat debug", P_BOOL, P_GLOBAL, &Globals.bPasswdChatDebug, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"username map", P_STRING, P_GLOBAL, &Globals.szUsernameMap, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"password level", P_INTEGER, P_GLOBAL, &Globals.pwordlevel, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"username level", P_INTEGER, P_GLOBAL, &Globals.unamelevel, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"unix password sync", P_BOOL, P_GLOBAL, &Globals.bUnixPasswdSync, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"restrict anonymous", P_INTEGER, P_GLOBAL, &Globals.restrict_anonymous, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"lanman auth", P_BOOL, P_GLOBAL, &Globals.bLanmanAuth, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"ntlm auth", P_BOOL, P_GLOBAL, &Globals.bNTLMAuth, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"client NTLMv2 auth", P_BOOL, P_GLOBAL, &Globals.bClientNTLMv2Auth, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"client lanman auth", P_BOOL, P_GLOBAL, &Globals.bClientLanManAuth, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"client plaintext auth", P_BOOL, P_GLOBAL, &Globals.bClientPlaintextAuth, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"username", P_STRING, P_LOCAL, &sDefault.szUsername, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"user", P_STRING, P_LOCAL, &sDefault.szUsername, NULL, NULL, FLAG_HIDE}, - {"users", P_STRING, P_LOCAL, &sDefault.szUsername, NULL, NULL, FLAG_HIDE}, - - {"invalid users", P_LIST, P_LOCAL, &sDefault.szInvalidUsers, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"valid users", P_LIST, P_LOCAL, &sDefault.szValidUsers, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"admin users", P_LIST, P_LOCAL, &sDefault.szAdminUsers, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"read list", P_LIST, P_LOCAL, &sDefault.readlist, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"write list", P_LIST, P_LOCAL, &sDefault.writelist, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"printer admin", P_LIST, P_LOCAL, &sDefault.printer_admin, NULL, NULL, FLAG_GLOBAL | FLAG_PRINT}, - {"force user", P_STRING, P_LOCAL, &sDefault.force_user, NULL, NULL, FLAG_SHARE}, - {"force group", P_STRING, P_LOCAL, &sDefault.force_group, NULL, NULL, FLAG_SHARE}, - {"group", P_STRING, P_LOCAL, &sDefault.force_group, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"read only", P_BOOL, P_LOCAL, &sDefault.bRead_only, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE}, - {"write ok", P_BOOLREV, P_LOCAL, &sDefault.bRead_only, NULL, NULL, FLAG_HIDE}, - {"writeable", P_BOOLREV, P_LOCAL, &sDefault.bRead_only, NULL, NULL, FLAG_HIDE}, - {"writable", P_BOOLREV, P_LOCAL, &sDefault.bRead_only, NULL, NULL, FLAG_HIDE}, - - {"create mask", P_OCTAL, P_LOCAL, &sDefault.iCreate_mask, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"create mode", P_OCTAL, P_LOCAL, &sDefault.iCreate_mask, NULL, NULL, FLAG_GLOBAL}, - {"force create mode", P_OCTAL, P_LOCAL, &sDefault.iCreate_force_mode, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"security mask", P_OCTAL, P_LOCAL, &sDefault.iSecurity_mask, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"force security mode", P_OCTAL, P_LOCAL, &sDefault.iSecurity_force_mode, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"directory mask", P_OCTAL, P_LOCAL, &sDefault.iDir_mask, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"directory mode", P_OCTAL, P_LOCAL, &sDefault.iDir_mask, NULL, NULL, FLAG_GLOBAL}, - {"force directory mode", P_OCTAL, P_LOCAL, &sDefault.iDir_force_mode, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"directory security mask", P_OCTAL, P_LOCAL, &sDefault.iDir_Security_mask, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"force directory security mode", P_OCTAL, P_LOCAL, &sDefault.iDir_Security_force_mode, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE}, - {"inherit permissions", P_BOOL, P_LOCAL, &sDefault.bInheritPerms, NULL, NULL, FLAG_SHARE}, - {"inherit acls", P_BOOL, P_LOCAL, &sDefault.bInheritACLS, NULL, NULL, FLAG_SHARE}, - {"guest only", P_BOOL, P_LOCAL, &sDefault.bGuest_only, NULL, NULL, FLAG_SHARE}, - {"only guest", P_BOOL, P_LOCAL, &sDefault.bGuest_only, NULL, NULL, FLAG_HIDE}, - - {"guest ok", P_BOOL, P_LOCAL, &sDefault.bGuest_ok, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT | FLAG_DEVELOPER}, - {"public", P_BOOL, P_LOCAL, &sDefault.bGuest_ok, NULL, NULL, FLAG_HIDE}, - - {"only user", P_BOOL, P_LOCAL, &sDefault.bOnlyUser, NULL, NULL, FLAG_SHARE}, - {"hosts allow", P_LIST, P_LOCAL, &sDefault.szHostsallow, NULL, NULL, FLAG_GLOBAL | FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT | FLAG_DEVELOPER}, - {"allow hosts", P_LIST, P_LOCAL, &sDefault.szHostsallow, NULL, NULL, FLAG_HIDE}, - {"hosts deny", P_LIST, P_LOCAL, &sDefault.szHostsdeny, NULL, NULL, FLAG_GLOBAL | FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT | FLAG_DEVELOPER}, - {"deny hosts", P_LIST, P_LOCAL, &sDefault.szHostsdeny, NULL, NULL, FLAG_HIDE}, - {"preload modules", P_LIST, P_GLOBAL, &Globals.szPreloadModules, NULL, NULL, FLAG_BASIC | FLAG_GLOBAL}, - - {"Logging Options", P_SEP, P_SEPARATOR}, - - {"log level", P_STRING, P_GLOBAL, &Globals.szLogLevel, handle_debug_list, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"debuglevel", P_STRING, P_GLOBAL, &Globals.szLogLevel, handle_debug_list, NULL, FLAG_HIDE}, - {"syslog", P_INTEGER, P_GLOBAL, &Globals.syslog, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"syslog only", P_BOOL, P_GLOBAL, &Globals.bSyslogOnly, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"log file", P_STRING, P_GLOBAL, &Globals.szLogFile, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"max log size", P_INTEGER, P_GLOBAL, &Globals.max_log_size, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"timestamp logs", P_BOOL, P_GLOBAL, &Globals.bTimestampLogs, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"debug timestamp", P_BOOL, P_GLOBAL, &Globals.bTimestampLogs, NULL, NULL, FLAG_DEVELOPER}, - {"debug hires timestamp", P_BOOL, P_GLOBAL, &Globals.bDebugHiresTimestamp, NULL, NULL, FLAG_DEVELOPER}, - {"debug pid", P_BOOL, P_GLOBAL, &Globals.bDebugPid, NULL, NULL, FLAG_DEVELOPER}, - {"debug uid", P_BOOL, P_GLOBAL, &Globals.bDebugUid, NULL, NULL, FLAG_DEVELOPER}, - - {"Protocol Options", P_SEP, P_SEPARATOR}, - - {"smb ports", P_STRING, P_GLOBAL, &Globals.smb_ports, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"protocol", P_ENUM, P_GLOBAL, &Globals.maxprotocol, NULL, enum_protocol, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"large readwrite", P_BOOL, P_GLOBAL, &Globals.bLargeReadwrite, NULL, NULL, FLAG_DEVELOPER}, - {"max protocol", P_ENUM, P_GLOBAL, &Globals.maxprotocol, NULL, enum_protocol, FLAG_DEVELOPER}, - {"min protocol", P_ENUM, P_GLOBAL, &Globals.minprotocol, NULL, enum_protocol, FLAG_DEVELOPER}, - {"unicode", P_BOOL, P_GLOBAL, &Globals.bUnicode, NULL, NULL, FLAG_DEVELOPER}, - {"read bmpx", P_BOOL, P_GLOBAL, &Globals.bReadbmpx, NULL, NULL, FLAG_DEVELOPER}, - {"read raw", P_BOOL, P_GLOBAL, &Globals.bReadRaw, NULL, NULL, FLAG_DEVELOPER}, - {"write raw", P_BOOL, P_GLOBAL, &Globals.bWriteRaw, NULL, NULL, FLAG_DEVELOPER}, - {"disable netbios", P_BOOL, P_GLOBAL, &Globals.bDisableNetbios, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"acl compatibility", P_STRING, P_GLOBAL, &Globals.szAclCompat, handle_acl_compatibility, NULL, FLAG_SHARE | FLAG_GLOBAL | FLAG_ADVANCED | FLAG_DEVELOPER}, - {"nt acl support", P_BOOL, P_LOCAL, &sDefault.bNTAclSupport, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE | FLAG_ADVANCED | FLAG_DEVELOPER}, - {"nt pipe support", P_BOOL, P_GLOBAL, &Globals.bNTPipeSupport, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"nt status support", P_BOOL, P_GLOBAL, &Globals.bNTStatusSupport, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"profile acls", P_BOOL, P_LOCAL, &sDefault.bProfileAcls, NULL, NULL, FLAG_GLOBAL | FLAG_SHARE | FLAG_ADVANCED}, - - {"announce version", P_STRING, P_GLOBAL, &Globals.szAnnounceVersion, NULL, NULL, FLAG_DEVELOPER}, - {"announce as", P_ENUM, P_GLOBAL, &Globals.announce_as, NULL, enum_announce_as, FLAG_DEVELOPER}, - {"map acl inherit", P_BOOL, P_LOCAL, &sDefault.bMap_acl_inherit, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"max mux", P_INTEGER, P_GLOBAL, &Globals.max_mux, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"max xmit", P_INTEGER, P_GLOBAL, &Globals.max_xmit, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"name resolve order", P_STRING, P_GLOBAL, &Globals.szNameResolveOrder, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"max ttl", P_INTEGER, P_GLOBAL, &Globals.max_ttl, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"max wins ttl", P_INTEGER, P_GLOBAL, &Globals.max_wins_ttl, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"min wins ttl", P_INTEGER, P_GLOBAL, &Globals.min_wins_ttl, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"time server", P_BOOL, P_GLOBAL, &Globals.bTimeServer, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"unix extensions", P_BOOL, P_GLOBAL, &Globals.bUnixExtensions, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"use spnego", P_BOOL, P_GLOBAL, &Globals.bUseSpnego, NULL, NULL, FLAG_DEVELOPER}, - {"client signing", P_ENUM, P_GLOBAL, &Globals.client_signing, NULL, enum_smb_signing_vals, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"client use spnego", P_BOOL, P_GLOBAL, &Globals.bClientUseSpnego, NULL, NULL, FLAG_DEVELOPER}, - - {"Tuning Options", P_SEP, P_SEPARATOR}, - - {"block size", P_INTEGER, P_LOCAL, &sDefault.iBlock_size, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"change notify timeout", P_INTEGER, P_GLOBAL, &Globals.change_notify_timeout, NULL, NULL, FLAG_DEVELOPER}, - {"deadtime", P_INTEGER, P_GLOBAL, &Globals.deadtime, NULL, NULL, FLAG_DEVELOPER}, - {"getwd cache", P_BOOL, P_GLOBAL, &use_getwd_cache, NULL, NULL, FLAG_DEVELOPER}, - {"keepalive", P_INTEGER, P_GLOBAL, &keepalive, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"kernel change notify", P_BOOL, P_GLOBAL, &Globals.bKernelChangeNotify, NULL, NULL, FLAG_DEVELOPER}, - - {"lpq cache time", P_INTEGER, P_GLOBAL, &Globals.lpqcachetime, NULL, NULL, FLAG_DEVELOPER}, - {"max smbd processes", P_INTEGER, P_GLOBAL, &Globals.iMaxSmbdProcesses, NULL, NULL, FLAG_DEVELOPER}, - {"max connections", P_INTEGER, P_LOCAL, &sDefault.iMaxConnections, NULL, NULL, FLAG_SHARE}, - {"paranoid server security", P_BOOL, P_GLOBAL, &Globals.paranoid_server_security, NULL, NULL, FLAG_DEVELOPER}, - {"max disk size", P_INTEGER, P_GLOBAL, &Globals.maxdisksize, NULL, NULL, FLAG_DEVELOPER}, - {"max open files", P_INTEGER, P_GLOBAL, &Globals.max_open_files, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"min print space", P_INTEGER, P_LOCAL, &sDefault.iMinPrintSpace, NULL, NULL, FLAG_PRINT}, - {"read size", P_INTEGER, P_GLOBAL, &Globals.ReadSize, NULL, NULL, FLAG_DEVELOPER}, - - {"socket options", P_GSTRING, P_GLOBAL, user_socket_options, NULL, NULL, FLAG_DEVELOPER}, - {"strict allocate", P_BOOL, P_LOCAL, &sDefault.bStrictAllocate, NULL, NULL, FLAG_SHARE}, - {"strict sync", P_BOOL, P_LOCAL, &sDefault.bStrictSync, NULL, NULL, FLAG_SHARE}, - {"sync always", P_BOOL, P_LOCAL, &sDefault.bSyncAlways, NULL, NULL, FLAG_SHARE}, - {"use mmap", P_BOOL, P_GLOBAL, &Globals.bUseMmap, NULL, NULL, FLAG_DEVELOPER}, - {"use sendfile", P_BOOL, P_LOCAL, &sDefault.bUseSendfile, NULL, NULL, FLAG_SHARE}, - {"hostname lookups", P_BOOL, P_GLOBAL, &Globals.bHostnameLookups, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"write cache size", P_INTEGER, P_LOCAL, &sDefault.iWriteCacheSize, NULL, NULL, FLAG_SHARE}, - - {"name cache timeout", P_INTEGER, P_GLOBAL, &Globals.name_cache_timeout, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"Printing Options", P_SEP, P_SEPARATOR}, - - {"max reported print jobs", P_INTEGER, P_LOCAL, &sDefault.iMaxReportedPrintJobs, NULL, NULL, FLAG_PRINT}, - {"max print jobs", P_INTEGER, P_LOCAL, &sDefault.iMaxPrintJobs, NULL, NULL, FLAG_PRINT}, - {"load printers", P_BOOL, P_GLOBAL, &Globals.bLoadPrinters, NULL, NULL, FLAG_PRINT}, - {"printcap name", P_STRING, P_GLOBAL, &Globals.szPrintcapname, NULL, NULL, FLAG_PRINT | FLAG_DEVELOPER}, - {"printcap", P_STRING, P_GLOBAL, &Globals.szPrintcapname, NULL, NULL, FLAG_HIDE}, - {"printable", P_BOOL, P_LOCAL, &sDefault.bPrint_ok, NULL, NULL, FLAG_PRINT}, - {"print ok", P_BOOL, P_LOCAL, &sDefault.bPrint_ok, NULL, NULL, FLAG_HIDE}, - {"printing", P_ENUM, P_LOCAL, &sDefault.iPrinting, NULL, enum_printing, FLAG_PRINT | FLAG_GLOBAL}, - {"print command", P_STRING, P_LOCAL, &sDefault.szPrintcommand, NULL, NULL, FLAG_PRINT | FLAG_GLOBAL}, - {"disable spoolss", P_BOOL, P_GLOBAL, &Globals.bDisableSpoolss, NULL, NULL, FLAG_PRINT | FLAG_GLOBAL}, - {"lpq command", P_STRING, P_LOCAL, &sDefault.szLpqcommand, NULL, NULL, FLAG_PRINT | FLAG_GLOBAL}, - {"lprm command", P_STRING, P_LOCAL, &sDefault.szLprmcommand, NULL, NULL, FLAG_PRINT | FLAG_GLOBAL}, - {"lppause command", P_STRING, P_LOCAL, &sDefault.szLppausecommand, NULL, NULL, FLAG_PRINT | FLAG_GLOBAL}, - {"lpresume command", P_STRING, P_LOCAL, &sDefault.szLpresumecommand, NULL, NULL, FLAG_PRINT | FLAG_GLOBAL}, - {"queuepause command", P_STRING, P_LOCAL, &sDefault.szQueuepausecommand, NULL, NULL, FLAG_PRINT | FLAG_GLOBAL}, - {"queueresume command", P_STRING, P_LOCAL, &sDefault.szQueueresumecommand, NULL, NULL, FLAG_PRINT | FLAG_GLOBAL}, - - {"enumports command", P_STRING, P_GLOBAL, &Globals.szEnumPortsCommand, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"addprinter command", P_STRING, P_GLOBAL, &Globals.szAddPrinterCommand, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"deleteprinter command", P_STRING, P_GLOBAL, &Globals.szDeletePrinterCommand, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"show add printer wizard", P_BOOL, P_GLOBAL, &Globals.bMsAddPrinterWizard, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"os2 driver map", P_STRING, P_GLOBAL, &Globals.szOs2DriverMap, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"printer name", P_STRING, P_LOCAL, &sDefault.szPrintername, NULL, NULL, FLAG_PRINT}, - {"printer", P_STRING, P_LOCAL, &sDefault.szPrintername, NULL, NULL, FLAG_HIDE}, - {"use client driver", P_BOOL, P_LOCAL, &sDefault.bUseClientDriver, NULL, NULL, FLAG_PRINT}, - {"default devmode", P_BOOL, P_LOCAL, &sDefault.bDefaultDevmode, NULL, NULL, FLAG_PRINT}, - - {"Filename Handling", P_SEP, P_SEPARATOR}, - {"strip dot", P_BOOL, P_GLOBAL, &Globals.bStripDot, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"mangling method", P_STRING, P_GLOBAL, &Globals.szManglingMethod, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"mangle prefix", P_INTEGER, P_GLOBAL, &Globals.mangle_prefix, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"mangled stack", P_INTEGER, P_GLOBAL, &Globals.mangled_stack, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"default case", P_ENUM, P_LOCAL, &sDefault.iDefaultCase, NULL, enum_case, FLAG_SHARE}, - {"case sensitive", P_BOOL, P_LOCAL, &sDefault.bCaseSensitive, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"casesignames", P_BOOL, P_LOCAL, &sDefault.bCaseSensitive, NULL, NULL, FLAG_HIDE}, - {"preserve case", P_BOOL, P_LOCAL, &sDefault.bCasePreserve, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"short preserve case", P_BOOL, P_LOCAL, &sDefault.bShortCasePreserve, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"mangle case", P_BOOL, P_LOCAL, &sDefault.bCaseMangle, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"mangling char", P_CHAR, P_LOCAL, &sDefault.magic_char, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"hide dot files", P_BOOL, P_LOCAL, &sDefault.bHideDotFiles, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"hide special files", P_BOOL, P_LOCAL, &sDefault.bHideSpecialFiles, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"hide unreadable", P_BOOL, P_LOCAL, &sDefault.bHideUnReadable, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"hide unwriteable files", P_BOOL, P_LOCAL, &sDefault.bHideUnWriteableFiles, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"delete veto files", P_BOOL, P_LOCAL, &sDefault.bDeleteVetoFiles, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"veto files", P_STRING, P_LOCAL, &sDefault.szVetoFiles, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL }, - {"hide files", P_STRING, P_LOCAL, &sDefault.szHideFiles, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL }, - {"veto oplock files", P_STRING, P_LOCAL, &sDefault.szVetoOplockFiles, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL }, - {"map system", P_BOOL, P_LOCAL, &sDefault.bMap_system, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"map hidden", P_BOOL, P_LOCAL, &sDefault.bMap_hidden, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"map archive", P_BOOL, P_LOCAL, &sDefault.bMap_archive, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"mangled names", P_BOOL, P_LOCAL, &sDefault.bMangledNames, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"mangled map", P_STRING, P_LOCAL, &sDefault.szMangledMap, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"stat cache", P_BOOL, P_GLOBAL, &Globals.bStatCache, NULL, NULL, FLAG_DEVELOPER}, - - {"Domain Options", P_SEP, P_SEPARATOR}, - - {"machine password timeout", P_INTEGER, P_GLOBAL, &Globals.machine_password_timeout, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - - {"Logon Options", P_SEP, P_SEPARATOR}, - - {"add user script", P_STRING, P_GLOBAL, &Globals.szAddUserScript, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"delete user script", P_STRING, P_GLOBAL, &Globals.szDelUserScript, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"add group script", P_STRING, P_GLOBAL, &Globals.szAddGroupScript, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"delete group script", P_STRING, P_GLOBAL, &Globals.szDelGroupScript, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"add user to group script", P_STRING, P_GLOBAL, &Globals.szAddUserToGroupScript, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"delete user from group script", P_STRING, P_GLOBAL, &Globals.szDelUserFromGroupScript, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"set primary group script", P_STRING, P_GLOBAL, &Globals.szSetPrimaryGroupScript, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"add machine script", P_STRING, P_GLOBAL, &Globals.szAddMachineScript, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"shutdown script", P_STRING, P_GLOBAL, &Globals.szShutdownScript, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"abort shutdown script", P_STRING, P_GLOBAL, &Globals.szAbortShutdownScript, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"logon script", P_STRING, P_GLOBAL, &Globals.szLogonScript, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"logon path", P_STRING, P_GLOBAL, &Globals.szLogonPath, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"logon drive", P_STRING, P_GLOBAL, &Globals.szLogonDrive, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"logon home", P_STRING, P_GLOBAL, &Globals.szLogonHome, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"domain logons", P_BOOL, P_GLOBAL, &Globals.bDomainLogons, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"Browse Options", P_SEP, P_SEPARATOR}, - - {"os level", P_INTEGER, P_GLOBAL, &Globals.os_level, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_DEVELOPER}, - {"lm announce", P_ENUM, P_GLOBAL, &Globals.lm_announce, NULL, enum_bool_auto, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"lm interval", P_INTEGER, P_GLOBAL, &Globals.lm_interval, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"preferred master", P_ENUM, P_GLOBAL, &Globals.bPreferredMaster, NULL, enum_bool_auto, FLAG_BASIC | FLAG_ADVANCED | FLAG_DEVELOPER}, - {"prefered master", P_ENUM, P_GLOBAL, &Globals.bPreferredMaster, NULL, enum_bool_auto, FLAG_HIDE}, - {"local master", P_BOOL, P_GLOBAL, &Globals.bLocalMaster, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_DEVELOPER}, - {"domain master", P_ENUM, P_GLOBAL, &Globals.bDomainMaster, NULL, enum_bool_auto, FLAG_BASIC | FLAG_ADVANCED | FLAG_DEVELOPER}, - {"browse list", P_BOOL, P_GLOBAL, &Globals.bBrowseList, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"browseable", P_BOOL, P_LOCAL, &sDefault.bBrowseable, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT | FLAG_DEVELOPER}, - {"browsable", P_BOOL, P_LOCAL, &sDefault.bBrowseable, NULL, NULL, FLAG_HIDE}, - {"enhanced browsing", P_BOOL, P_GLOBAL, &Globals.enhanced_browsing, NULL, NULL, FLAG_DEVELOPER | FLAG_ADVANCED}, - - {"WINS Options", P_SEP, P_SEPARATOR}, - - {"dns proxy", P_BOOL, P_GLOBAL, &Globals.bDNSproxy, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"wins proxy", P_BOOL, P_GLOBAL, &Globals.bWINSproxy, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"wins server", P_LIST, P_GLOBAL, &Globals.szWINSservers, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"wins support", P_BOOL, P_GLOBAL, &Globals.bWINSsupport, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, - {"wins hook", P_STRING, P_GLOBAL, &Globals.szWINSHook, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"wins partners", P_STRING, P_GLOBAL, &Globals.szWINSPartners, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER}, + {"Base Options", P_SEP, P_SEPARATOR}, + + {"dos charset", P_STRING, P_GLOBAL, &Globals.dos_charset, NULL, NULL, FLAG_ADVANCED}, + {"unix charset", P_STRING, P_GLOBAL, &Globals.unix_charset, NULL, NULL, FLAG_ADVANCED}, + {"display charset", P_STRING, P_GLOBAL, &Globals.display_charset, NULL, NULL, FLAG_ADVANCED}, + {"comment", P_STRING, P_LOCAL, &sDefault.comment, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, + {"path", P_STRING, P_LOCAL, &sDefault.szPath, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, + {"directory", P_STRING, P_LOCAL, &sDefault.szPath, NULL, NULL, FLAG_HIDE}, + {"workgroup", P_USTRING, P_GLOBAL, &Globals.szWorkgroup, handle_workgroup, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD}, +#ifdef WITH_ADS + {"realm", P_USTRING, P_GLOBAL, &Globals.szRealm, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD}, +#endif + {"netbios name", P_USTRING, P_GLOBAL, &Globals.szNetbiosName, handle_netbios_name, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD}, + {"netbios aliases", P_LIST, P_GLOBAL, &Globals.szNetbiosAliases, handle_netbios_aliases, NULL, FLAG_ADVANCED}, + {"netbios scope", P_USTRING, P_GLOBAL, &Globals.szNetbiosScope, handle_netbios_scope, NULL, FLAG_ADVANCED}, + {"server string", P_STRING, P_GLOBAL, &Globals.szServerString, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED }, + {"interfaces", P_LIST, P_GLOBAL, &Globals.szInterfaces, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD}, + {"bind interfaces only", P_BOOL, P_GLOBAL, &Globals.bBindInterfacesOnly, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD}, + + {"Security Options", P_SEP, P_SEPARATOR}, + + {"security", P_ENUM, P_GLOBAL, &Globals.security, NULL, enum_security, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD}, + {"auth methods", P_LIST, P_GLOBAL, &Globals.AuthMethods, NULL, NULL, FLAG_ADVANCED}, + {"encrypt passwords", P_BOOL, P_GLOBAL, &Globals.bEncryptPasswords, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD}, + {"update encrypted", P_BOOL, P_GLOBAL, &Globals.bUpdateEncrypt, NULL, NULL, FLAG_ADVANCED}, + {"client schannel", P_ENUM, P_GLOBAL, &Globals.clientSchannel, NULL, enum_bool_auto, FLAG_BASIC | FLAG_ADVANCED}, + {"server schannel", P_ENUM, P_GLOBAL, &Globals.serverSchannel, NULL, enum_bool_auto, FLAG_BASIC | FLAG_ADVANCED}, + {"allow trusted domains", P_BOOL, P_GLOBAL, &Globals.bAllowTrustedDomains, NULL, NULL, FLAG_ADVANCED}, + {"hosts equiv", P_STRING, P_GLOBAL, &Globals.szHostsEquiv, NULL, NULL, FLAG_ADVANCED}, + {"min passwd length", P_INTEGER, P_GLOBAL, &Globals.min_passwd_length, NULL, NULL, FLAG_ADVANCED}, + {"min password length", P_INTEGER, P_GLOBAL, &Globals.min_passwd_length, NULL, NULL, FLAG_ADVANCED}, + {"map to guest", P_ENUM, P_GLOBAL, &Globals.map_to_guest, NULL, enum_map_to_guest, FLAG_ADVANCED}, + {"null passwords", P_BOOL, P_GLOBAL, &Globals.bNullPasswords, NULL, NULL, FLAG_ADVANCED}, + {"obey pam restrictions", P_BOOL, P_GLOBAL, &Globals.bObeyPamRestrictions, NULL, NULL, FLAG_ADVANCED}, + {"password server", P_STRING, P_GLOBAL, &Globals.szPasswordServer, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD}, + {"smb passwd file", P_STRING, P_GLOBAL, &Globals.szSMBPasswdFile, NULL, NULL, FLAG_ADVANCED}, + {"private dir", P_STRING, P_GLOBAL, &Globals.szPrivateDir, NULL, NULL, FLAG_ADVANCED}, + {"passdb backend", P_LIST, P_GLOBAL, &Globals.szPassdbBackend, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD}, + {"algorithmic rid base", P_INTEGER, P_GLOBAL, &Globals.AlgorithmicRidBase, NULL, NULL, FLAG_ADVANCED}, + {"root directory", P_STRING, P_GLOBAL, &Globals.szRootdir, NULL, NULL, FLAG_ADVANCED}, + {"root dir", P_STRING, P_GLOBAL, &Globals.szRootdir, NULL, NULL, FLAG_HIDE}, + {"root", P_STRING, P_GLOBAL, &Globals.szRootdir, NULL, NULL, FLAG_HIDE}, + {"guest account", P_STRING, P_GLOBAL, &Globals.szGuestaccount, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED}, + + {"pam password change", P_BOOL, P_GLOBAL, &Globals.bPamPasswordChange, NULL, NULL, FLAG_ADVANCED}, + {"passwd program", P_STRING, P_GLOBAL, &Globals.szPasswdProgram, NULL, NULL, FLAG_ADVANCED}, + {"passwd chat", P_STRING, P_GLOBAL, &Globals.szPasswdChat, NULL, NULL, FLAG_ADVANCED}, + {"passwd chat debug", P_BOOL, P_GLOBAL, &Globals.bPasswdChatDebug, NULL, NULL, FLAG_ADVANCED}, + {"username map", P_STRING, P_GLOBAL, &Globals.szUsernameMap, NULL, NULL, FLAG_ADVANCED}, + {"password level", P_INTEGER, P_GLOBAL, &Globals.pwordlevel, NULL, NULL, FLAG_ADVANCED}, + {"username level", P_INTEGER, P_GLOBAL, &Globals.unamelevel, NULL, NULL, FLAG_ADVANCED}, + {"unix password sync", P_BOOL, P_GLOBAL, &Globals.bUnixPasswdSync, NULL, NULL, FLAG_ADVANCED}, + {"restrict anonymous", P_INTEGER, P_GLOBAL, &Globals.restrict_anonymous, NULL, NULL, FLAG_ADVANCED}, + {"lanman auth", P_BOOL, P_GLOBAL, &Globals.bLanmanAuth, NULL, NULL, FLAG_ADVANCED}, + {"ntlm auth", P_BOOL, P_GLOBAL, &Globals.bNTLMAuth, NULL, NULL, FLAG_ADVANCED}, + {"client NTLMv2 auth", P_BOOL, P_GLOBAL, &Globals.bClientNTLMv2Auth, NULL, NULL, FLAG_ADVANCED}, + {"client lanman auth", P_BOOL, P_GLOBAL, &Globals.bClientLanManAuth, NULL, NULL, FLAG_ADVANCED}, + {"client plaintext auth", P_BOOL, P_GLOBAL, &Globals.bClientPlaintextAuth, NULL, NULL, FLAG_ADVANCED}, + + {"username", P_STRING, P_LOCAL, &sDefault.szUsername, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"user", P_STRING, P_LOCAL, &sDefault.szUsername, NULL, NULL, FLAG_HIDE}, + {"users", P_STRING, P_LOCAL, &sDefault.szUsername, NULL, NULL, FLAG_HIDE}, + + {"invalid users", P_LIST, P_LOCAL, &sDefault.szInvalidUsers, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"valid users", P_LIST, P_LOCAL, &sDefault.szValidUsers, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"admin users", P_LIST, P_LOCAL, &sDefault.szAdminUsers, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"read list", P_LIST, P_LOCAL, &sDefault.readlist, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"write list", P_LIST, P_LOCAL, &sDefault.writelist, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"printer admin", P_LIST, P_LOCAL, &sDefault.printer_admin, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_PRINT}, + {"force user", P_STRING, P_LOCAL, &sDefault.force_user, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"force group", P_STRING, P_LOCAL, &sDefault.force_group, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"group", P_STRING, P_LOCAL, &sDefault.force_group, NULL, NULL, FLAG_ADVANCED}, + + {"read only", P_BOOL, P_LOCAL, &sDefault.bRead_only, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE}, + {"write ok", P_BOOLREV, P_LOCAL, &sDefault.bRead_only, NULL, NULL, FLAG_HIDE}, + {"writeable", P_BOOLREV, P_LOCAL, &sDefault.bRead_only, NULL, NULL, FLAG_HIDE}, + {"writable", P_BOOLREV, P_LOCAL, &sDefault.bRead_only, NULL, NULL, FLAG_HIDE}, + + {"create mask", P_OCTAL, P_LOCAL, &sDefault.iCreate_mask, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"create mode", P_OCTAL, P_LOCAL, &sDefault.iCreate_mask, NULL, NULL, FLAG_HIDE}, + {"force create mode", P_OCTAL, P_LOCAL, &sDefault.iCreate_force_mode, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"security mask", P_OCTAL, P_LOCAL, &sDefault.iSecurity_mask, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"force security mode", P_OCTAL, P_LOCAL, &sDefault.iSecurity_force_mode, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"directory mask", P_OCTAL, P_LOCAL, &sDefault.iDir_mask, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"directory mode", P_OCTAL, P_LOCAL, &sDefault.iDir_mask, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL}, + {"force directory mode", P_OCTAL, P_LOCAL, &sDefault.iDir_force_mode, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"directory security mask", P_OCTAL, P_LOCAL, &sDefault.iDir_Security_mask, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"force directory security mode", P_OCTAL, P_LOCAL, &sDefault.iDir_Security_force_mode, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + {"inherit permissions", P_BOOL, P_LOCAL, &sDefault.bInheritPerms, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"inherit acls", P_BOOL, P_LOCAL, &sDefault.bInheritACLS, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"guest only", P_BOOL, P_LOCAL, &sDefault.bGuest_only, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"only guest", P_BOOL, P_LOCAL, &sDefault.bGuest_only, NULL, NULL, FLAG_HIDE}, + + {"guest ok", P_BOOL, P_LOCAL, &sDefault.bGuest_ok, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, + {"public", P_BOOL, P_LOCAL, &sDefault.bGuest_ok, NULL, NULL, FLAG_HIDE}, + + {"only user", P_BOOL, P_LOCAL, &sDefault.bOnlyUser, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"hosts allow", P_LIST, P_LOCAL, &sDefault.szHostsallow, NULL, NULL, FLAG_GLOBAL | FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, + {"allow hosts", P_LIST, P_LOCAL, &sDefault.szHostsallow, NULL, NULL, FLAG_HIDE}, + {"hosts deny", P_LIST, P_LOCAL, &sDefault.szHostsdeny, NULL, NULL, FLAG_GLOBAL | FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, + {"deny hosts", P_LIST, P_LOCAL, &sDefault.szHostsdeny, NULL, NULL, FLAG_HIDE}, + {"preload modules", P_LIST, P_GLOBAL, &Globals.szPreloadModules, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL}, + + {"Logging Options", P_SEP, P_SEPARATOR}, + + {"log level", P_STRING, P_GLOBAL, &Globals.szLogLevel, handle_debug_list, NULL, FLAG_ADVANCED}, + {"debuglevel", P_STRING, P_GLOBAL, &Globals.szLogLevel, handle_debug_list, NULL, FLAG_HIDE}, + {"syslog", P_INTEGER, P_GLOBAL, &Globals.syslog, NULL, NULL, FLAG_ADVANCED}, + {"syslog only", P_BOOL, P_GLOBAL, &Globals.bSyslogOnly, NULL, NULL, FLAG_ADVANCED}, + {"log file", P_STRING, P_GLOBAL, &Globals.szLogFile, NULL, NULL, FLAG_ADVANCED}, + + {"max log size", P_INTEGER, P_GLOBAL, &Globals.max_log_size, NULL, NULL, FLAG_ADVANCED}, + {"timestamp logs", P_BOOL, P_GLOBAL, &Globals.bTimestampLogs, NULL, NULL, FLAG_ADVANCED}, + {"debug timestamp", P_BOOL, P_GLOBAL, &Globals.bTimestampLogs, NULL, NULL, FLAG_ADVANCED}, + {"debug hires timestamp", P_BOOL, P_GLOBAL, &Globals.bDebugHiresTimestamp, NULL, NULL, FLAG_ADVANCED}, + {"debug pid", P_BOOL, P_GLOBAL, &Globals.bDebugPid, NULL, NULL, FLAG_ADVANCED}, + {"debug uid", P_BOOL, P_GLOBAL, &Globals.bDebugUid, NULL, NULL, FLAG_ADVANCED}, + + {"Protocol Options", P_SEP, P_SEPARATOR}, + + {"smb ports", P_STRING, P_GLOBAL, &Globals.smb_ports, NULL, NULL, FLAG_ADVANCED}, + {"protocol", P_ENUM, P_GLOBAL, &Globals.maxprotocol, NULL, enum_protocol, FLAG_ADVANCED}, + {"large readwrite", P_BOOL, P_GLOBAL, &Globals.bLargeReadwrite, NULL, NULL, FLAG_ADVANCED}, + {"max protocol", P_ENUM, P_GLOBAL, &Globals.maxprotocol, NULL, enum_protocol, FLAG_ADVANCED}, + {"min protocol", P_ENUM, P_GLOBAL, &Globals.minprotocol, NULL, enum_protocol, FLAG_ADVANCED}, + {"unicode", P_BOOL, P_GLOBAL, &Globals.bUnicode, NULL, NULL, FLAG_ADVANCED}, + {"read bmpx", P_BOOL, P_GLOBAL, &Globals.bReadbmpx, NULL, NULL, FLAG_ADVANCED}, + {"read raw", P_BOOL, P_GLOBAL, &Globals.bReadRaw, NULL, NULL, FLAG_ADVANCED}, + {"write raw", P_BOOL, P_GLOBAL, &Globals.bWriteRaw, NULL, NULL, FLAG_ADVANCED}, + {"disable netbios", P_BOOL, P_GLOBAL, &Globals.bDisableNetbios, NULL, NULL, FLAG_ADVANCED}, + + {"acl compatibility", P_STRING, P_GLOBAL, &Globals.szAclCompat, handle_acl_compatibility, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"nt acl support", P_BOOL, P_LOCAL, &sDefault.bNTAclSupport, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"nt pipe support", P_BOOL, P_GLOBAL, &Globals.bNTPipeSupport, NULL, NULL, FLAG_ADVANCED}, + {"nt status support", P_BOOL, P_GLOBAL, &Globals.bNTStatusSupport, NULL, NULL, FLAG_ADVANCED}, + {"profile acls", P_BOOL, P_LOCAL, &sDefault.bProfileAcls, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE}, + + {"announce version", P_STRING, P_GLOBAL, &Globals.szAnnounceVersion, NULL, NULL, FLAG_ADVANCED}, + {"announce as", P_ENUM, P_GLOBAL, &Globals.announce_as, NULL, enum_announce_as, FLAG_ADVANCED}, + {"map acl inherit", P_BOOL, P_LOCAL, &sDefault.bMap_acl_inherit, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"max mux", P_INTEGER, P_GLOBAL, &Globals.max_mux, NULL, NULL, FLAG_ADVANCED}, + {"max xmit", P_INTEGER, P_GLOBAL, &Globals.max_xmit, NULL, NULL, FLAG_ADVANCED}, + + {"name resolve order", P_STRING, P_GLOBAL, &Globals.szNameResolveOrder, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD}, + {"max ttl", P_INTEGER, P_GLOBAL, &Globals.max_ttl, NULL, NULL, FLAG_ADVANCED}, + {"max wins ttl", P_INTEGER, P_GLOBAL, &Globals.max_wins_ttl, NULL, NULL, FLAG_ADVANCED}, + {"min wins ttl", P_INTEGER, P_GLOBAL, &Globals.min_wins_ttl, NULL, NULL, FLAG_ADVANCED}, + {"time server", P_BOOL, P_GLOBAL, &Globals.bTimeServer, NULL, NULL, FLAG_ADVANCED}, + {"unix extensions", P_BOOL, P_GLOBAL, &Globals.bUnixExtensions, NULL, NULL, FLAG_ADVANCED}, + {"use spnego", P_BOOL, P_GLOBAL, &Globals.bUseSpnego, NULL, NULL, FLAG_ADVANCED}, + {"client signing", P_ENUM, P_GLOBAL, &Globals.client_signing, NULL, enum_smb_signing_vals, FLAG_ADVANCED}, + {"server signing", P_ENUM, P_GLOBAL, &Globals.server_signing, NULL, enum_smb_signing_vals, FLAG_ADVANCED}, + {"client use spnego", P_BOOL, P_GLOBAL, &Globals.bClientUseSpnego, NULL, NULL, FLAG_ADVANCED}, + + {"Tuning Options", P_SEP, P_SEPARATOR}, + + {"block size", P_INTEGER, P_LOCAL, &sDefault.iBlock_size, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"change notify timeout", P_INTEGER, P_GLOBAL, &Globals.change_notify_timeout, NULL, NULL, FLAG_ADVANCED}, + {"deadtime", P_INTEGER, P_GLOBAL, &Globals.deadtime, NULL, NULL, FLAG_ADVANCED}, + {"getwd cache", P_BOOL, P_GLOBAL, &use_getwd_cache, NULL, NULL, FLAG_ADVANCED}, + {"keepalive", P_INTEGER, P_GLOBAL, &keepalive, NULL, NULL, FLAG_ADVANCED}, + {"kernel change notify", P_BOOL, P_GLOBAL, &Globals.bKernelChangeNotify, NULL, NULL, FLAG_ADVANCED}, + + {"lpq cache time", P_INTEGER, P_GLOBAL, &Globals.lpqcachetime, NULL, NULL, FLAG_ADVANCED}, + {"max smbd processes", P_INTEGER, P_GLOBAL, &Globals.iMaxSmbdProcesses, NULL, NULL, FLAG_ADVANCED}, + {"max connections", P_INTEGER, P_LOCAL, &sDefault.iMaxConnections, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"paranoid server security", P_BOOL, P_GLOBAL, &Globals.paranoid_server_security, NULL, NULL, FLAG_ADVANCED}, + {"max disk size", P_INTEGER, P_GLOBAL, &Globals.maxdisksize, NULL, NULL, FLAG_ADVANCED}, + {"max open files", P_INTEGER, P_GLOBAL, &Globals.max_open_files, NULL, NULL, FLAG_ADVANCED}, + {"min print space", P_INTEGER, P_LOCAL, &sDefault.iMinPrintSpace, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT}, + {"read size", P_INTEGER, P_GLOBAL, &Globals.ReadSize, NULL, NULL, FLAG_ADVANCED}, + + {"socket options", P_GSTRING, P_GLOBAL, user_socket_options, NULL, NULL, FLAG_ADVANCED}, + {"strict allocate", P_BOOL, P_LOCAL, &sDefault.bStrictAllocate, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"strict sync", P_BOOL, P_LOCAL, &sDefault.bStrictSync, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"sync always", P_BOOL, P_LOCAL, &sDefault.bSyncAlways, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"use mmap", P_BOOL, P_GLOBAL, &Globals.bUseMmap, NULL, NULL, FLAG_ADVANCED}, + {"use sendfile", P_BOOL, P_LOCAL, &sDefault.bUseSendfile, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"hostname lookups", P_BOOL, P_GLOBAL, &Globals.bHostnameLookups, NULL, NULL, FLAG_ADVANCED}, + {"write cache size", P_INTEGER, P_LOCAL, &sDefault.iWriteCacheSize, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + + {"name cache timeout", P_INTEGER, P_GLOBAL, &Globals.name_cache_timeout, NULL, NULL, FLAG_ADVANCED}, + + {"Printing Options", P_SEP, P_SEPARATOR}, + + {"max reported print jobs", P_INTEGER, P_LOCAL, &sDefault.iMaxReportedPrintJobs, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT}, + {"max print jobs", P_INTEGER, P_LOCAL, &sDefault.iMaxPrintJobs, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT}, + {"load printers", P_BOOL, P_GLOBAL, &Globals.bLoadPrinters, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT}, + {"printcap name", P_STRING, P_GLOBAL, &Globals.szPrintcapname, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT}, + {"printcap", P_STRING, P_GLOBAL, &Globals.szPrintcapname, NULL, NULL, FLAG_HIDE}, + {"printable", P_BOOL, P_LOCAL, &sDefault.bPrint_ok, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT}, + {"print ok", P_BOOL, P_LOCAL, &sDefault.bPrint_ok, NULL, NULL, FLAG_HIDE}, + {"printing", P_ENUM, P_LOCAL, &sDefault.iPrinting, NULL, enum_printing, FLAG_ADVANCED | FLAG_PRINT | FLAG_GLOBAL}, + {"print command", P_STRING, P_LOCAL, &sDefault.szPrintcommand, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT | FLAG_GLOBAL}, + {"disable spoolss", P_BOOL, P_GLOBAL, &Globals.bDisableSpoolss, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT | FLAG_GLOBAL}, + {"lpq command", P_STRING, P_LOCAL, &sDefault.szLpqcommand, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT | FLAG_GLOBAL}, + {"lprm command", P_STRING, P_LOCAL, &sDefault.szLprmcommand, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT | FLAG_GLOBAL}, + {"lppause command", P_STRING, P_LOCAL, &sDefault.szLppausecommand, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT | FLAG_GLOBAL}, + {"lpresume command", P_STRING, P_LOCAL, &sDefault.szLpresumecommand, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT | FLAG_GLOBAL}, + {"queuepause command", P_STRING, P_LOCAL, &sDefault.szQueuepausecommand, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT | FLAG_GLOBAL}, + {"queueresume command", P_STRING, P_LOCAL, &sDefault.szQueueresumecommand, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT | FLAG_GLOBAL}, + + {"enumports command", P_STRING, P_GLOBAL, &Globals.szEnumPortsCommand, NULL, NULL, FLAG_ADVANCED}, + {"addprinter command", P_STRING, P_GLOBAL, &Globals.szAddPrinterCommand, NULL, NULL, FLAG_ADVANCED}, + {"deleteprinter command", P_STRING, P_GLOBAL, &Globals.szDeletePrinterCommand, NULL, NULL, FLAG_ADVANCED}, + {"show add printer wizard", P_BOOL, P_GLOBAL, &Globals.bMsAddPrinterWizard, NULL, NULL, FLAG_ADVANCED}, + {"os2 driver map", P_STRING, P_GLOBAL, &Globals.szOs2DriverMap, NULL, NULL, FLAG_ADVANCED}, + + {"printer name", P_STRING, P_LOCAL, &sDefault.szPrintername, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT}, + {"printer", P_STRING, P_LOCAL, &sDefault.szPrintername, NULL, NULL, FLAG_HIDE}, + {"use client driver", P_BOOL, P_LOCAL, &sDefault.bUseClientDriver, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT}, + {"default devmode", P_BOOL, P_LOCAL, &sDefault.bDefaultDevmode, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT}, + + {"Filename Handling", P_SEP, P_SEPARATOR}, + {"strip dot", P_BOOL, P_GLOBAL, &Globals.bStripDot, NULL, NULL, FLAG_ADVANCED}, + {"mangling method", P_STRING, P_GLOBAL, &Globals.szManglingMethod, NULL, NULL, FLAG_ADVANCED}, + {"mangle prefix", P_INTEGER, P_GLOBAL, &Globals.mangle_prefix, NULL, NULL, FLAG_ADVANCED}, + + {"mangled stack", P_INTEGER, P_GLOBAL, &Globals.mangled_stack, NULL, NULL, FLAG_ADVANCED}, + {"default case", P_ENUM, P_LOCAL, &sDefault.iDefaultCase, NULL, enum_case, FLAG_ADVANCED | FLAG_SHARE}, + {"case sensitive", P_BOOL, P_LOCAL, &sDefault.bCaseSensitive, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"casesignames", P_BOOL, P_LOCAL, &sDefault.bCaseSensitive, NULL, NULL, FLAG_HIDE}, + {"preserve case", P_BOOL, P_LOCAL, &sDefault.bCasePreserve, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"short preserve case", P_BOOL, P_LOCAL, &sDefault.bShortCasePreserve, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"mangle case", P_BOOL, P_LOCAL, &sDefault.bCaseMangle, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"mangling char", P_CHAR, P_LOCAL, &sDefault.magic_char, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"hide dot files", P_BOOL, P_LOCAL, &sDefault.bHideDotFiles, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"hide special files", P_BOOL, P_LOCAL, &sDefault.bHideSpecialFiles, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"hide unreadable", P_BOOL, P_LOCAL, &sDefault.bHideUnReadable, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"hide unwriteable files", P_BOOL, P_LOCAL, &sDefault.bHideUnWriteableFiles, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"delete veto files", P_BOOL, P_LOCAL, &sDefault.bDeleteVetoFiles, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"veto files", P_STRING, P_LOCAL, &sDefault.szVetoFiles, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL }, + {"hide files", P_STRING, P_LOCAL, &sDefault.szHideFiles, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL }, + {"veto oplock files", P_STRING, P_LOCAL, &sDefault.szVetoOplockFiles, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL }, + {"map system", P_BOOL, P_LOCAL, &sDefault.bMap_system, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"map hidden", P_BOOL, P_LOCAL, &sDefault.bMap_hidden, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"map archive", P_BOOL, P_LOCAL, &sDefault.bMap_archive, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"mangled names", P_BOOL, P_LOCAL, &sDefault.bMangledNames, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"mangled map", P_STRING, P_LOCAL, &sDefault.szMangledMap, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"stat cache", P_BOOL, P_GLOBAL, &Globals.bStatCache, NULL, NULL, FLAG_ADVANCED}, + + {"Domain Options", P_SEP, P_SEPARATOR}, + + {"machine password timeout", P_INTEGER, P_GLOBAL, &Globals.machine_password_timeout, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD}, + + {"Logon Options", P_SEP, P_SEPARATOR}, + + {"add user script", P_STRING, P_GLOBAL, &Globals.szAddUserScript, NULL, NULL, FLAG_ADVANCED}, + {"delete user script", P_STRING, P_GLOBAL, &Globals.szDelUserScript, NULL, NULL, FLAG_ADVANCED}, + {"add group script", P_STRING, P_GLOBAL, &Globals.szAddGroupScript, NULL, NULL, FLAG_ADVANCED}, + {"delete group script", P_STRING, P_GLOBAL, &Globals.szDelGroupScript, NULL, NULL, FLAG_ADVANCED}, + {"add user to group script", P_STRING, P_GLOBAL, &Globals.szAddUserToGroupScript, NULL, NULL, FLAG_ADVANCED}, + {"delete user from group script", P_STRING, P_GLOBAL, &Globals.szDelUserFromGroupScript, NULL, NULL, FLAG_ADVANCED}, + {"set primary group script", P_STRING, P_GLOBAL, &Globals.szSetPrimaryGroupScript, NULL, NULL, FLAG_ADVANCED}, + {"add machine script", P_STRING, P_GLOBAL, &Globals.szAddMachineScript, NULL, NULL, FLAG_ADVANCED}, + {"shutdown script", P_STRING, P_GLOBAL, &Globals.szShutdownScript, NULL, NULL, FLAG_ADVANCED}, + {"abort shutdown script", P_STRING, P_GLOBAL, &Globals.szAbortShutdownScript, NULL, NULL, FLAG_ADVANCED}, + + {"logon script", P_STRING, P_GLOBAL, &Globals.szLogonScript, NULL, NULL, FLAG_ADVANCED}, + {"logon path", P_STRING, P_GLOBAL, &Globals.szLogonPath, NULL, NULL, FLAG_ADVANCED}, + {"logon drive", P_STRING, P_GLOBAL, &Globals.szLogonDrive, NULL, NULL, FLAG_ADVANCED}, + {"logon home", P_STRING, P_GLOBAL, &Globals.szLogonHome, NULL, NULL, FLAG_ADVANCED}, + {"domain logons", P_BOOL, P_GLOBAL, &Globals.bDomainLogons, NULL, NULL, FLAG_ADVANCED}, + + {"Browse Options", P_SEP, P_SEPARATOR}, + + {"os level", P_INTEGER, P_GLOBAL, &Globals.os_level, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED}, + {"lm announce", P_ENUM, P_GLOBAL, &Globals.lm_announce, NULL, enum_bool_auto, FLAG_ADVANCED}, + {"lm interval", P_INTEGER, P_GLOBAL, &Globals.lm_interval, NULL, NULL, FLAG_ADVANCED}, + {"preferred master", P_ENUM, P_GLOBAL, &Globals.bPreferredMaster, NULL, enum_bool_auto, FLAG_BASIC | FLAG_ADVANCED}, + {"prefered master", P_ENUM, P_GLOBAL, &Globals.bPreferredMaster, NULL, enum_bool_auto, FLAG_HIDE}, + {"local master", P_BOOL, P_GLOBAL, &Globals.bLocalMaster, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED}, + {"domain master", P_ENUM, P_GLOBAL, &Globals.bDomainMaster, NULL, enum_bool_auto, FLAG_BASIC | FLAG_ADVANCED}, + {"browse list", P_BOOL, P_GLOBAL, &Globals.bBrowseList, NULL, NULL, FLAG_ADVANCED}, + {"browseable", P_BOOL, P_LOCAL, &sDefault.bBrowseable, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, + {"browsable", P_BOOL, P_LOCAL, &sDefault.bBrowseable, NULL, NULL, FLAG_HIDE}, + {"enhanced browsing", P_BOOL, P_GLOBAL, &Globals.enhanced_browsing, NULL, NULL, FLAG_ADVANCED}, + + {"WINS Options", P_SEP, P_SEPARATOR}, + + {"dns proxy", P_BOOL, P_GLOBAL, &Globals.bDNSproxy, NULL, NULL, FLAG_ADVANCED}, + {"wins proxy", P_BOOL, P_GLOBAL, &Globals.bWINSproxy, NULL, NULL, FLAG_ADVANCED}, + + {"wins server", P_LIST, P_GLOBAL, &Globals.szWINSservers, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD}, + {"wins support", P_BOOL, P_GLOBAL, &Globals.bWINSsupport, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD}, + {"wins hook", P_STRING, P_GLOBAL, &Globals.szWINSHook, NULL, NULL, FLAG_ADVANCED}, + {"wins partners", P_STRING, P_GLOBAL, &Globals.szWINSPartners, NULL, NULL, FLAG_ADVANCED | FLAG_WIZARD}, + + {"Locking Options", P_SEP, P_SEPARATOR}, + + {"blocking locks", P_BOOL, P_LOCAL, &sDefault.bBlockingLocks, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"csc policy", P_ENUM, P_LOCAL, &sDefault.iCSCPolicy, NULL, enum_csc_policy, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"fake oplocks", P_BOOL, P_LOCAL, &sDefault.bFakeOplocks, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"kernel oplocks", P_BOOL, P_GLOBAL, &Globals.bKernelOplocks, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL}, + {"locking", P_BOOL, P_LOCAL, &sDefault.bLocking, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"lock spin count", P_INTEGER, P_GLOBAL, &Globals.iLockSpinCount, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL}, + {"lock spin time", P_INTEGER, P_GLOBAL, &Globals.iLockSpinTime, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL}, + + {"oplocks", P_BOOL, P_LOCAL, &sDefault.bOpLocks, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"level2 oplocks", P_BOOL, P_LOCAL, &sDefault.bLevel2OpLocks, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"oplock break wait time", P_INTEGER, P_GLOBAL, &Globals.oplock_break_wait_time, NULL, NULL, FLAG_ADVANCED | FLAG_GLOBAL}, + {"oplock contention limit", P_INTEGER, P_LOCAL, &sDefault.iOplockContentionLimit, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"posix locking", P_BOOL, P_LOCAL, &sDefault.bPosixLocking, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"strict locking", P_BOOL, P_LOCAL, &sDefault.bStrictLocking, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"share modes", P_BOOL, P_LOCAL, &sDefault.bShareModes, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + + {"Ldap Options", P_SEP, P_SEPARATOR}, - {"Locking Options", P_SEP, P_SEPARATOR}, - - {"blocking locks", P_BOOL, P_LOCAL, &sDefault.bBlockingLocks, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"csc policy", P_ENUM, P_LOCAL, &sDefault.iCSCPolicy, NULL, enum_csc_policy, FLAG_SHARE | FLAG_GLOBAL}, - {"fake oplocks", P_BOOL, P_LOCAL, &sDefault.bFakeOplocks, NULL, NULL, FLAG_SHARE}, - {"kernel oplocks", P_BOOL, P_GLOBAL, &Globals.bKernelOplocks, NULL, NULL, FLAG_GLOBAL}, - {"locking", P_BOOL, P_LOCAL, &sDefault.bLocking, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"lock spin count", P_INTEGER, P_GLOBAL, &Globals.iLockSpinCount, NULL, NULL, FLAG_GLOBAL}, - {"lock spin time", P_INTEGER, P_GLOBAL, &Globals.iLockSpinTime, NULL, NULL, FLAG_GLOBAL}, - - {"oplocks", P_BOOL, P_LOCAL, &sDefault.bOpLocks, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"level2 oplocks", P_BOOL, P_LOCAL, &sDefault.bLevel2OpLocks, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"oplock break wait time", P_INTEGER, P_GLOBAL, &Globals.oplock_break_wait_time, NULL, NULL, FLAG_GLOBAL}, - {"oplock contention limit", P_INTEGER, P_LOCAL, &sDefault.iOplockContentionLimit, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"posix locking", P_BOOL, P_LOCAL, &sDefault.bPosixLocking, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"strict locking", P_BOOL, P_LOCAL, &sDefault.bStrictLocking, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"share modes", P_BOOL, P_LOCAL, &sDefault.bShareModes, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - - {"Ldap Options", P_SEP, P_SEPARATOR}, - #ifdef WITH_LDAP_SAMCONFIG - {"ldap server", P_STRING, P_GLOBAL, &Globals.szLdapServer, NULL, NULL, 0}, - {"ldap port", P_INTEGER, P_GLOBAL, &Globals.ldap_port, NULL, NULL, 0}, + {"ldap server", P_STRING, P_GLOBAL, &Globals.szLdapServer, NULL, NULL, FLAG_ADVANCED}, + {"ldap port", P_INTEGER, P_GLOBAL, &Globals.ldap_port, NULL, NULL, FLAG_ADVANCED}, #endif - {"ldap suffix", P_STRING, P_GLOBAL, &Globals.szLdapSuffix, handle_ldap_suffix, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"ldap machine suffix", P_STRING, P_GLOBAL, &Globals.szLdapMachineSuffix, handle_ldap_sub_suffix, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"ldap user suffix", P_STRING, P_GLOBAL, &Globals.szLdapUserSuffix, handle_ldap_sub_suffix, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"ldap group suffix", P_STRING, P_GLOBAL, &Globals.szLdapGroupSuffix, handle_ldap_sub_suffix, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"ldap idmap suffix", P_STRING, P_GLOBAL, &Globals.szLdapIdmapSuffix, handle_ldap_sub_suffix, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"ldap filter", P_STRING, P_GLOBAL, &Globals.szLdapFilter, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"ldap admin dn", P_STRING, P_GLOBAL, &Globals.szLdapAdminDn, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"ldap ssl", P_ENUM, P_GLOBAL, &Globals.ldap_ssl, NULL, enum_ldap_ssl, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"ldap passwd sync", P_ENUM, P_GLOBAL, &Globals.ldap_passwd_sync, NULL, enum_ldap_passwd_sync, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"ldap trust ids", P_BOOL, P_GLOBAL, &Globals.ldap_trust_ids, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"ldap delete dn", P_BOOL, P_GLOBAL, &Globals.ldap_delete_dn, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"Miscellaneous Options", P_SEP, P_SEPARATOR}, - {"add share command", P_STRING, P_GLOBAL, &Globals.szAddShareCommand, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"change share command", P_STRING, P_GLOBAL, &Globals.szChangeShareCommand, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"delete share command", P_STRING, P_GLOBAL, &Globals.szDeleteShareCommand, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"config file", P_STRING, P_GLOBAL, &Globals.szConfigFile, NULL, NULL, FLAG_HIDE}, - {"preload", P_STRING, P_GLOBAL, &Globals.szAutoServices, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"auto services", P_STRING, P_GLOBAL, &Globals.szAutoServices, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"ldap suffix", P_STRING, P_GLOBAL, &Globals.szLdapSuffix, handle_ldap_suffix, NULL, FLAG_ADVANCED}, + {"ldap machine suffix", P_STRING, P_GLOBAL, &Globals.szLdapMachineSuffix, handle_ldap_sub_suffix, NULL, FLAG_ADVANCED}, + {"ldap user suffix", P_STRING, P_GLOBAL, &Globals.szLdapUserSuffix, handle_ldap_sub_suffix, NULL, FLAG_ADVANCED}, + {"ldap group suffix", P_STRING, P_GLOBAL, &Globals.szLdapGroupSuffix, handle_ldap_sub_suffix, NULL, FLAG_ADVANCED}, + {"ldap idmap suffix", P_STRING, P_GLOBAL, &Globals.szLdapIdmapSuffix, handle_ldap_sub_suffix, NULL, FLAG_ADVANCED}, + {"ldap filter", P_STRING, P_GLOBAL, &Globals.szLdapFilter, NULL, NULL, FLAG_ADVANCED}, + {"ldap admin dn", P_STRING, P_GLOBAL, &Globals.szLdapAdminDn, NULL, NULL, FLAG_ADVANCED}, + {"ldap ssl", P_ENUM, P_GLOBAL, &Globals.ldap_ssl, NULL, enum_ldap_ssl, FLAG_ADVANCED}, + {"ldap passwd sync", P_ENUM, P_GLOBAL, &Globals.ldap_passwd_sync, NULL, enum_ldap_passwd_sync, FLAG_ADVANCED}, + {"ldap trust ids", P_BOOL, P_GLOBAL, &Globals.ldap_trust_ids, NULL, NULL, FLAG_ADVANCED}, + {"ldap delete dn", P_BOOL, P_GLOBAL, &Globals.ldap_delete_dn, NULL, NULL, FLAG_ADVANCED}, + + {"Miscellaneous Options", P_SEP, P_SEPARATOR}, + {"add share command", P_STRING, P_GLOBAL, &Globals.szAddShareCommand, NULL, NULL, FLAG_ADVANCED}, + {"change share command", P_STRING, P_GLOBAL, &Globals.szChangeShareCommand, NULL, NULL, FLAG_ADVANCED}, + {"delete share command", P_STRING, P_GLOBAL, &Globals.szDeleteShareCommand, NULL, NULL, FLAG_ADVANCED}, + + {"config file", P_STRING, P_GLOBAL, &Globals.szConfigFile, NULL, NULL, FLAG_HIDE}, + {"preload", P_STRING, P_GLOBAL, &Globals.szAutoServices, NULL, NULL, FLAG_ADVANCED}, + {"auto services", P_STRING, P_GLOBAL, &Globals.szAutoServices, NULL, NULL, FLAG_ADVANCED}, + {"lock directory", P_STRING, P_GLOBAL, &Globals.szLockDir, NULL, NULL, FLAG_ADVANCED}, {"lock dir", P_STRING, P_GLOBAL, &Globals.szLockDir, NULL, NULL, FLAG_HIDE}, - {"lock directory", P_STRING, P_GLOBAL, &Globals.szLockDir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"pid directory", P_STRING, P_GLOBAL, &Globals.szPidDir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"pid directory", P_STRING, P_GLOBAL, &Globals.szPidDir, NULL, NULL, FLAG_ADVANCED}, #ifdef WITH_UTMP - {"utmp directory", P_STRING, P_GLOBAL, &Globals.szUtmpDir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"wtmp directory", P_STRING, P_GLOBAL, &Globals.szWtmpDir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"utmp", P_BOOL, P_GLOBAL, &Globals.bUtmp, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"utmp directory", P_STRING, P_GLOBAL, &Globals.szUtmpDir, NULL, NULL, FLAG_ADVANCED}, + {"wtmp directory", P_STRING, P_GLOBAL, &Globals.szWtmpDir, NULL, NULL, FLAG_ADVANCED}, + {"utmp", P_BOOL, P_GLOBAL, &Globals.bUtmp, NULL, NULL, FLAG_ADVANCED}, #endif - - {"default service", P_STRING, P_GLOBAL, &Globals.szDefaultService, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"default", P_STRING, P_GLOBAL, &Globals.szDefaultService, NULL, NULL, FLAG_DEVELOPER}, - {"message command", P_STRING, P_GLOBAL, &Globals.szMsgCommand, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"dfree command", P_STRING, P_GLOBAL, &Globals.szDfree, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"get quota command", P_STRING, P_GLOBAL, &Globals.szGetQuota, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"set quota command", P_STRING, P_GLOBAL, &Globals.szSetQuota, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"remote announce", P_STRING, P_GLOBAL, &Globals.szRemoteAnnounce, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"remote browse sync", P_STRING, P_GLOBAL, &Globals.szRemoteBrowseSync, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"socket address", P_STRING, P_GLOBAL, &Globals.szSocketAddress, NULL, NULL, FLAG_DEVELOPER}, - {"homedir map", P_STRING, P_GLOBAL, &Globals.szNISHomeMapName, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"time offset", P_INTEGER, P_GLOBAL, &extra_time_offset, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"NIS homedir", P_BOOL, P_GLOBAL, &Globals.bNISHomeMap, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"-valid", P_BOOL, P_LOCAL, &sDefault.valid, NULL, NULL, FLAG_HIDE}, - - {"copy", P_STRING, P_LOCAL, &sDefault.szCopy, handle_copy, NULL, FLAG_HIDE}, - {"include", P_STRING, P_LOCAL, &sDefault.szInclude, handle_include, NULL, FLAG_HIDE}, - {"exec", P_STRING, P_LOCAL, &sDefault.szPreExec, NULL, NULL, FLAG_SHARE | FLAG_PRINT}, - {"preexec", P_STRING, P_LOCAL, &sDefault.szPreExec, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"preexec close", P_BOOL, P_LOCAL, &sDefault.bPreexecClose, NULL, NULL, FLAG_SHARE}, - {"postexec", P_STRING, P_LOCAL, &sDefault.szPostExec, NULL, NULL, FLAG_SHARE | FLAG_PRINT}, - {"root preexec", P_STRING, P_LOCAL, &sDefault.szRootPreExec, NULL, NULL, FLAG_SHARE | FLAG_PRINT}, - {"root preexec close", P_BOOL, P_LOCAL, &sDefault.bRootpreexecClose, NULL, NULL, FLAG_SHARE}, - {"root postexec", P_STRING, P_LOCAL, &sDefault.szRootPostExec, NULL, NULL, FLAG_SHARE | FLAG_PRINT}, - {"available", P_BOOL, P_LOCAL, &sDefault.bAvailable, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, - {"volume", P_STRING, P_LOCAL, &sDefault.volume, NULL, NULL, FLAG_SHARE }, - {"fstype", P_STRING, P_LOCAL, &sDefault.fstype, NULL, NULL, FLAG_SHARE}, - {"set directory", P_BOOLREV, P_LOCAL, &sDefault.bNo_set_dir, NULL, NULL, FLAG_SHARE}, - {"source environment", P_STRING, P_GLOBAL, &Globals.szSourceEnv, handle_source_env, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"wide links", P_BOOL, P_LOCAL, &sDefault.bWidelinks, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"follow symlinks", P_BOOL, P_LOCAL, &sDefault.bSymlinks, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"dont descend", P_STRING, P_LOCAL, &sDefault.szDontdescend, NULL, NULL, FLAG_SHARE}, - {"magic script", P_STRING, P_LOCAL, &sDefault.szMagicScript, NULL, NULL, FLAG_SHARE}, - {"magic output", P_STRING, P_LOCAL, &sDefault.szMagicOutput, NULL, NULL, FLAG_SHARE}, - {"delete readonly", P_BOOL, P_LOCAL, &sDefault.bDeleteReadonly, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"dos filemode", P_BOOL, P_LOCAL, &sDefault.bDosFilemode, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"dos filetimes", P_BOOL, P_LOCAL, &sDefault.bDosFiletimes, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"dos filetime resolution", P_BOOL, P_LOCAL, &sDefault.bDosFiletimeResolution, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - - {"fake directory create times", P_BOOL, P_LOCAL, &sDefault.bFakeDirCreateTimes, NULL, NULL, FLAG_SHARE | FLAG_GLOBAL}, - {"panic action", P_STRING, P_GLOBAL, &Globals.szPanicAction, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"hide local users", P_BOOL, P_GLOBAL, &Globals.bHideLocalUsers, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"VFS module options", P_SEP, P_SEPARATOR}, - - {"vfs objects", P_LIST, P_LOCAL, &sDefault.szVfsObjects, NULL, NULL, FLAG_SHARE}, - {"vfs object", P_LIST, P_LOCAL, &sDefault.szVfsObjects, NULL, NULL, FLAG_SHARE | FLAG_HIDE}, - - {"msdfs root", P_BOOL, P_LOCAL, &sDefault.bMSDfsRoot, NULL, NULL, FLAG_SHARE}, - {"msdfs proxy", P_STRING, P_LOCAL, &sDefault.szMSDfsProxy, NULL, NULL, FLAG_SHARE}, - {"host msdfs", P_BOOL, P_GLOBAL, &Globals.bHostMSDfs, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"Winbind options", P_SEP, P_SEPARATOR}, - - {"enable rid algorithm", P_BOOL, P_GLOBAL, &Globals.bEnableRidAlgorithm, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER | FLAG_DEPRECATED}, - {"idmap backend", P_STRING, P_GLOBAL, &Globals.szIdmapBackend, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"idmap uid", P_STRING, P_GLOBAL, &Globals.szIdmapUID, handle_idmap_uid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"winbind uid", P_STRING, P_GLOBAL, &Globals.szIdmapUID, handle_idmap_uid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER }, - {"idmap gid", P_STRING, P_GLOBAL, &Globals.szIdmapGID, handle_idmap_gid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"winbind gid", P_STRING, P_GLOBAL, &Globals.szIdmapGID, handle_idmap_gid, NULL, FLAG_ADVANCED | FLAG_DEVELOPER }, - {"template primary group", P_STRING, P_GLOBAL, &Globals.szTemplatePrimaryGroup, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"template homedir", P_STRING, P_GLOBAL, &Globals.szTemplateHomedir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"template shell", P_STRING, P_GLOBAL, &Globals.szTemplateShell, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"winbind separator", P_STRING, P_GLOBAL, &Globals.szWinbindSeparator, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"winbind cache time", P_INTEGER, P_GLOBAL, &Globals.winbind_cache_time, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"winbind enable local accounts", P_BOOL, P_GLOBAL, &Globals.bWinbindEnableLocalAccounts, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"winbind enum users", P_BOOL, P_GLOBAL, &Globals.bWinbindEnumUsers, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"winbind enum groups", P_BOOL, P_GLOBAL, &Globals.bWinbindEnumGroups, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"winbind use default domain", P_BOOL, P_GLOBAL, &Globals.bWinbindUseDefaultDomain, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"winbind trusted domains only", P_BOOL, P_GLOBAL, &Globals.bWinbindTrustedDomainsOnly, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {NULL, P_BOOL, P_NONE, NULL, NULL, NULL, 0} + {"default service", P_STRING, P_GLOBAL, &Globals.szDefaultService, NULL, NULL, FLAG_ADVANCED}, + {"default", P_STRING, P_GLOBAL, &Globals.szDefaultService, NULL, NULL, FLAG_ADVANCED}, + {"message command", P_STRING, P_GLOBAL, &Globals.szMsgCommand, NULL, NULL, FLAG_ADVANCED}, + {"dfree command", P_STRING, P_GLOBAL, &Globals.szDfree, NULL, NULL, FLAG_ADVANCED}, + {"get quota command", P_STRING, P_GLOBAL, &Globals.szGetQuota, NULL, NULL, FLAG_ADVANCED}, + {"set quota command", P_STRING, P_GLOBAL, &Globals.szSetQuota, NULL, NULL, FLAG_ADVANCED}, + {"remote announce", P_STRING, P_GLOBAL, &Globals.szRemoteAnnounce, NULL, NULL, FLAG_ADVANCED}, + {"remote browse sync", P_STRING, P_GLOBAL, &Globals.szRemoteBrowseSync, NULL, NULL, FLAG_ADVANCED}, + {"socket address", P_STRING, P_GLOBAL, &Globals.szSocketAddress, NULL, NULL, FLAG_ADVANCED}, + {"homedir map", P_STRING, P_GLOBAL, &Globals.szNISHomeMapName, NULL, NULL, FLAG_ADVANCED}, + {"time offset", P_INTEGER, P_GLOBAL, &extra_time_offset, NULL, NULL, FLAG_ADVANCED}, + {"NIS homedir", P_BOOL, P_GLOBAL, &Globals.bNISHomeMap, NULL, NULL, FLAG_ADVANCED}, + {"-valid", P_BOOL, P_LOCAL, &sDefault.valid, NULL, NULL, FLAG_HIDE}, + + {"copy", P_STRING, P_LOCAL, &sDefault.szCopy, handle_copy, NULL, FLAG_HIDE}, + {"include", P_STRING, P_LOCAL, &sDefault.szInclude, handle_include, NULL, FLAG_HIDE}, + {"exec", P_STRING, P_LOCAL, &sDefault.szPreExec, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, + {"preexec", P_STRING, P_LOCAL, &sDefault.szPreExec, NULL, NULL, FLAG_ADVANCED}, + + {"preexec close", P_BOOL, P_LOCAL, &sDefault.bPreexecClose, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"postexec", P_STRING, P_LOCAL, &sDefault.szPostExec, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, + {"root preexec", P_STRING, P_LOCAL, &sDefault.szRootPreExec, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, + {"root preexec close", P_BOOL, P_LOCAL, &sDefault.bRootpreexecClose, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"root postexec", P_STRING, P_LOCAL, &sDefault.szRootPostExec, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, + {"available", P_BOOL, P_LOCAL, &sDefault.bAvailable, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, + {"volume", P_STRING, P_LOCAL, &sDefault.volume, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE }, + {"fstype", P_STRING, P_LOCAL, &sDefault.fstype, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"set directory", P_BOOLREV, P_LOCAL, &sDefault.bNo_set_dir, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"source environment", P_STRING, P_GLOBAL, &Globals.szSourceEnv, handle_source_env, NULL, FLAG_ADVANCED}, + {"wide links", P_BOOL, P_LOCAL, &sDefault.bWidelinks, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"follow symlinks", P_BOOL, P_LOCAL, &sDefault.bSymlinks, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"dont descend", P_STRING, P_LOCAL, &sDefault.szDontdescend, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"magic script", P_STRING, P_LOCAL, &sDefault.szMagicScript, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"magic output", P_STRING, P_LOCAL, &sDefault.szMagicOutput, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"delete readonly", P_BOOL, P_LOCAL, &sDefault.bDeleteReadonly, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"dos filemode", P_BOOL, P_LOCAL, &sDefault.bDosFilemode, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"dos filetimes", P_BOOL, P_LOCAL, &sDefault.bDosFiletimes, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"dos filetime resolution", P_BOOL, P_LOCAL, &sDefault.bDosFiletimeResolution, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + + {"fake directory create times", P_BOOL, P_LOCAL, &sDefault.bFakeDirCreateTimes, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"panic action", P_STRING, P_GLOBAL, &Globals.szPanicAction, NULL, NULL, FLAG_ADVANCED}, + {"hide local users", P_BOOL, P_GLOBAL, &Globals.bHideLocalUsers, NULL, NULL, FLAG_ADVANCED}, + + {"VFS module options", P_SEP, P_SEPARATOR}, + + {"vfs objects", P_LIST, P_LOCAL, &sDefault.szVfsObjects, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"vfs object", P_LIST, P_LOCAL, &sDefault.szVfsObjects, NULL, NULL, FLAG_HIDE}, + + + {"msdfs root", P_BOOL, P_LOCAL, &sDefault.bMSDfsRoot, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"msdfs proxy", P_STRING, P_LOCAL, &sDefault.szMSDfsProxy, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE}, + {"host msdfs", P_BOOL, P_GLOBAL, &Globals.bHostMSDfs, NULL, NULL, FLAG_ADVANCED}, + + {"Winbind options", P_SEP, P_SEPARATOR}, + + {"enable rid algorithm", P_BOOL, P_GLOBAL, &Globals.bEnableRidAlgorithm, NULL, NULL, FLAG_DEPRECATED}, + {"idmap backend", P_STRING, P_GLOBAL, &Globals.szIdmapBackend, NULL, NULL, FLAG_ADVANCED}, + {"idmap uid", P_STRING, P_GLOBAL, &Globals.szIdmapUID, handle_idmap_uid, NULL, FLAG_ADVANCED}, + {"winbind uid", P_STRING, P_GLOBAL, &Globals.szIdmapUID, handle_idmap_uid, NULL, FLAG_ADVANCED}, + {"idmap gid", P_STRING, P_GLOBAL, &Globals.szIdmapGID, handle_idmap_gid, NULL, FLAG_ADVANCED}, + {"winbind gid", P_STRING, P_GLOBAL, &Globals.szIdmapGID, handle_idmap_gid, NULL, FLAG_ADVANCED}, + {"template primary group", P_STRING, P_GLOBAL, &Globals.szTemplatePrimaryGroup, NULL, NULL, FLAG_ADVANCED}, + {"template homedir", P_STRING, P_GLOBAL, &Globals.szTemplateHomedir, NULL, NULL, FLAG_ADVANCED}, + {"template shell", P_STRING, P_GLOBAL, &Globals.szTemplateShell, NULL, NULL, FLAG_ADVANCED}, + {"winbind separator", P_STRING, P_GLOBAL, &Globals.szWinbindSeparator, NULL, NULL, FLAG_ADVANCED}, + {"winbind cache time", P_INTEGER, P_GLOBAL, &Globals.winbind_cache_time, NULL, NULL, FLAG_ADVANCED}, + {"winbind enable local accounts", P_BOOL, P_GLOBAL, &Globals.bWinbindEnableLocalAccounts, NULL, NULL, FLAG_ADVANCED}, + {"winbind enum users", P_BOOL, P_GLOBAL, &Globals.bWinbindEnumUsers, NULL, NULL, FLAG_ADVANCED}, + {"winbind enum groups", P_BOOL, P_GLOBAL, &Globals.bWinbindEnumGroups, NULL, NULL, FLAG_ADVANCED}, + {"winbind use default domain", P_BOOL, P_GLOBAL, &Globals.bWinbindUseDefaultDomain, NULL, NULL, FLAG_ADVANCED}, + {"winbind trusted domains only", P_BOOL, P_GLOBAL, &Globals.bWinbindTrustedDomainsOnly, NULL, NULL, FLAG_ADVANCED}, + + {NULL, P_BOOL, P_NONE, NULL, NULL, NULL, 0} }; /*************************************************************************** @@ -1860,7 +1868,7 @@ FN_LOCAL_BOOL(lp_inherit_acls, bInheritACLS) FN_LOCAL_BOOL(lp_use_client_driver, bUseClientDriver) FN_LOCAL_BOOL(lp_default_devmode, bDefaultDevmode) FN_LOCAL_BOOL(lp_nt_acl_support, bNTAclSupport) -FN_LOCAL_BOOL(lp_use_sendfile, bUseSendfile) +FN_LOCAL_BOOL(_lp_use_sendfile, bUseSendfile) FN_LOCAL_BOOL(lp_profile_acls, bProfileAcls) FN_LOCAL_BOOL(lp_map_acl_inherit, bMap_acl_inherit) FN_LOCAL_INTEGER(lp_create_mask, iCreate_mask) @@ -1885,7 +1893,8 @@ FN_GLOBAL_INTEGER(lp_winbind_cache_time, &Globals.winbind_cache_time) FN_GLOBAL_BOOL(lp_hide_local_users, &Globals.bHideLocalUsers) FN_GLOBAL_INTEGER(lp_algorithmic_rid_base, &Globals.AlgorithmicRidBase) FN_GLOBAL_INTEGER(lp_name_cache_timeout, &Globals.name_cache_timeout) -FN_GLOBAL_BOOL(lp_client_signing, &Globals.client_signing) +FN_GLOBAL_INTEGER(lp_client_signing, &Globals.client_signing) +FN_GLOBAL_INTEGER(lp_server_signing, &Globals.server_signing) /* local prototypes */ @@ -4286,3 +4295,12 @@ int lp_maxprintjobs(int snum) return maxjobs; } + +/******************************************************************* + Ensure we don't use sendfile if server smb signing is active. +********************************************************************/ + +BOOL lp_use_sendfile(int snum) +{ + return (_lp_use_sendfile(snum) && !srv_is_signing_active()); +} diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c index 9a99e07d82..e440e064ef 100644 --- a/source3/passdb/passdb.c +++ b/source3/passdb/passdb.c @@ -1056,7 +1056,7 @@ DOM_SID *local_uid_to_sid(DOM_SID *psid, uid_t uid) unix_pw = sys_getpwuid( uid ); if ( !unix_pw ) { - DEBUG(4,("local_uid_to_sid: host has know idea of uid %d\n", uid)); + DEBUG(4,("local_uid_to_sid: host has know idea of uid %lu\n", (unsigned long)uid)); return NULL; } @@ -1072,8 +1072,8 @@ DOM_SID *local_uid_to_sid(DOM_SID *psid, uid_t uid) if ( ret ) sid_copy( psid, pdb_get_user_sid(sampw) ); else { - DEBUG(4,("local_uid_to_sid: User %s [uid == %d] has no samba account\n", - unix_pw->pw_name, uid)); + DEBUG(4,("local_uid_to_sid: User %s [uid == %lu] has no samba account\n", + unix_pw->pw_name, (unsigned long)uid)); if ( !lp_enable_rid_algorithm() ) return NULL; @@ -1667,8 +1667,8 @@ uint32 init_buffer_from_sam (uint8 **buf, const SAM_ACCOUNT *sampass, BOOL size_ /* check to make sure we got it correct */ if (buflen != len) { - DEBUG(0, ("init_buffer_from_sam: somthing odd is going on here: bufflen (%d) != len (%d) in tdb_pack operations!\n", - buflen, len)); + DEBUG(0, ("init_buffer_from_sam: somthing odd is going on here: bufflen (%lu) != len (%lu) in tdb_pack operations!\n", + (unsigned long)buflen, (unsigned long)len)); /* error */ SAFE_FREE (*buf); return (-1); diff --git a/source3/passdb/pdb_get_set.c b/source3/passdb/pdb_get_set.c index ba07a4e01c..1505458551 100644 --- a/source3/passdb/pdb_get_set.c +++ b/source3/passdb/pdb_get_set.c @@ -1027,9 +1027,18 @@ BOOL pdb_set_backend_private_data (SAM_ACCOUNT *sampass, void *private_data, if (!sampass) return False; +#if 0 + /* With this check backend_private_data_free_fn is *never* set + as the methods are never set anywhere. What is this + supposed to do ???? + + Volker + */ + /* does this backend 'own' this SAM_ACCOUNT? */ if (my_methods != sampass->private.backend_private_methods) return False; +#endif if (sampass->private.backend_private_data && sampass->private.backend_private_data_free_fn) { sampass->private.backend_private_data_free_fn(&sampass->private.backend_private_data); diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c index a4ee4dbd4b..aee6495759 100644 --- a/source3/passdb/pdb_ldap.c +++ b/source3/passdb/pdb_ldap.c @@ -104,7 +104,7 @@ struct ldapsam_privates { static void private_data_free_fn(void **result) { - ldap_memfree(*result); + ldap_msgfree(*result); *result = NULL; } @@ -161,10 +161,10 @@ static const char* get_objclass_filter( int schema_ver ) switch( schema_ver ) { case SCHEMAVER_SAMBAACCOUNT: - snprintf( objclass_filter, sizeof(objclass_filter)-1, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT ); + fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT ); break; case SCHEMAVER_SAMBASAMACCOUNT: - snprintf( objclass_filter, sizeof(objclass_filter)-1, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT ); + fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT ); break; default: DEBUG(0,("pdb_ldapsam: get_objclass_filter(): Invalid schema version specified!\n")); @@ -192,7 +192,7 @@ static int ldapsam_search_suffix_by_name (struct ldapsam_privates *ldap_state, * in the filter expression, replace %u with the real name * so in ldap filter, %u MUST exist :-) */ - snprintf(filter, sizeof(filter)-1, "(&%s%s)", lp_ldap_filter(), + pstr_sprintf(filter, "(&%s%s)", lp_ldap_filter(), get_objclass_filter(ldap_state->schema_ver)); /* @@ -217,7 +217,7 @@ static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state, pstring filter; int rc; - snprintf(filter, sizeof(filter)-1, "(&(rid=%i)%s)", rid, + pstr_sprintf(filter, "(&(rid=%i)%s)", rid, get_objclass_filter(ldap_state->schema_ver)); rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result); @@ -236,7 +236,7 @@ static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state, int rc; fstring sid_string; - snprintf(filter, sizeof(filter)-1, "(&(%s=%s)%s)", + pstr_sprintf(filter, "(&(%s=%s)%s)", get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), sid_to_string(sid_string, sid), get_objclass_filter(ldap_state->schema_ver)); @@ -956,7 +956,7 @@ static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, BOOL update) pstring filter; char **attr_list; - snprintf( filter, sizeof(filter)-1, "(&%s%s)", lp_ldap_filter(), + pstr_sprintf( filter, "(&%s%s)", lp_ldap_filter(), get_objclass_filter(ldap_state->schema_ver)); all_string_sub(filter, "%u", "*", sizeof(pstring)); @@ -1162,7 +1162,7 @@ static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUNT } /******************************************************************** -Do the actual modification - also change a plaittext passord if +Do the actual modification - also change a plaintext passord if it it set. **********************************************************************/ @@ -1377,6 +1377,7 @@ static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, SAM_A if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd, element_is_changed)) { DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n")); + ldap_memfree(dn); return NT_STATUS_UNSUCCESSFUL; } @@ -1384,11 +1385,13 @@ static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, SAM_A DEBUG(4,("mods is empty: nothing to update for user: %s\n", pdb_get_username(newpwd))); ldap_mods_free(mods, True); + ldap_memfree(dn); return NT_STATUS_OK; } ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, element_is_changed); ldap_mods_free(mods,True); + ldap_memfree(dn); if (!NT_STATUS_IS_OK(ret)) { char *ld_error = NULL; @@ -1516,7 +1519,7 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO /* There might be a SID for this account already - say an idmap entry */ - snprintf(filter, sizeof(filter)-1, "(&(%s=%s)(|(objectClass=%s)(objectClass=%s)))", + pstr_sprintf(filter, "(&(%s=%s)(|(objectClass=%s)(objectClass=%s)))", get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), sid_to_string(sid_string, sid), LDAP_OBJ_IDMAP_ENTRY, @@ -1698,7 +1701,7 @@ static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, get_attr_key2string( groupmap_attr_list, LDAP_ATTR_CN), temp)) { DEBUG(0, ("Attributes cn not found either " - "for gidNumber(%i)\n",map->gid)); + "for gidNumber(%lu)\n",(unsigned long)map->gid)); return False; } } @@ -1734,7 +1737,7 @@ static BOOL init_ldap_from_group(LDAP *ldap_struct, sid_to_string(tmp, &map->sid); smbldap_make_mod(ldap_struct, existing, mods, get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID), tmp); - snprintf(tmp, sizeof(tmp)-1, "%i", map->sid_name_use); + pstr_sprintf(tmp, "%i", map->sid_name_use); smbldap_make_mod(ldap_struct, existing, mods, get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), tmp); @@ -1805,7 +1808,7 @@ static NTSTATUS ldapsam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map, { pstring filter; - snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(%s=%s))", + pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))", LDAP_OBJ_GROUPMAP, get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID), sid_string_static(&sid)); @@ -1821,10 +1824,10 @@ static NTSTATUS ldapsam_getgrgid(struct pdb_methods *methods, GROUP_MAP *map, { pstring filter; - snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(%s=%d))", + pstr_sprintf(filter, "(&(objectClass=%s)(%s=%lu))", LDAP_OBJ_GROUPMAP, get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER), - gid); + (unsigned long)gid); return ldapsam_getgroup(methods, filter, map); } @@ -1842,7 +1845,7 @@ static NTSTATUS ldapsam_getgrnam(struct pdb_methods *methods, GROUP_MAP *map, return NT_STATUS_NO_MEMORY; } - snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(|(%s=%s)(%s=%s)))", + pstr_sprintf(filter, "(&(objectClass=%s)(|(%s=%s)(%s=%s)))", LDAP_OBJ_GROUPMAP, get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), escape_name, get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN), escape_name); @@ -1861,10 +1864,10 @@ static int ldapsam_search_one_group_by_gid(struct ldapsam_privates *ldap_state, { pstring filter; - snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(%s=%i))", + pstr_sprintf(filter, "(&(objectClass=%s)(%s=%lu))", LDAP_OBJ_POSIXGROUP, get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER), - gid); + (unsigned long)gid); return ldapsam_search_one_group(ldap_state, filter, result); } @@ -1891,23 +1894,26 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, if (NT_STATUS_IS_OK(ldapsam_getgrgid(methods, &dummy, map->gid))) { - DEBUG(0, ("Group %i already exists in LDAP\n", map->gid)); + DEBUG(0, ("Group %ld already exists in LDAP\n", (unsigned long)map->gid)); return NT_STATUS_UNSUCCESSFUL; } rc = ldapsam_search_one_group_by_gid(ldap_state, map->gid, &result); if (rc != LDAP_SUCCESS) { + ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; } count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); - if ( count == 0 ) + if ( count == 0 ) { + ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; + } if (count > 1) { - DEBUG(2, ("Group %i must exist exactly once in LDAP\n", - map->gid)); + DEBUG(2, ("Group %lu must exist exactly once in LDAP\n", + (unsigned long)map->gid)); ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; } @@ -1941,13 +1947,13 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, char *ld_error = NULL; ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); - DEBUG(0, ("failed to add group %i error: %s (%s)\n", map->gid, + DEBUG(0, ("failed to add group %lu error: %s (%s)\n", (unsigned long)map->gid, ld_error ? ld_error : "(unknown)", ldap_err2string(rc))); SAFE_FREE(ld_error); return NT_STATUS_UNSUCCESSFUL; } - DEBUG(2, ("successfully modified group %i in LDAP\n", map->gid)); + DEBUG(2, ("successfully modified group %lu in LDAP\n", (unsigned long)map->gid)); return NT_STATUS_OK; } @@ -2002,12 +2008,12 @@ static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods, char *ld_error = NULL; ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); - DEBUG(0, ("failed to modify group %i error: %s (%s)\n", map->gid, + DEBUG(0, ("failed to modify group %lu error: %s (%s)\n", (unsigned long)map->gid, ld_error ? ld_error : "(unknown)", ldap_err2string(rc))); SAFE_FREE(ld_error); } - DEBUG(2, ("successfully modified group %i in LDAP\n", map->gid)); + DEBUG(2, ("successfully modified group %lu in LDAP\n", (unsigned long)map->gid)); return NT_STATUS_OK; } @@ -2026,7 +2032,7 @@ static NTSTATUS ldapsam_delete_group_mapping_entry(struct pdb_methods *methods, sid_to_string(sidstring, &sid); - snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(%s=%s))", + pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))", LDAP_OBJ_GROUPMAP, LDAP_ATTRIBUTE_SID, sidstring); rc = ldapsam_search_one_group(ldap_state, filter, &result); @@ -2054,7 +2060,7 @@ static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods, BOOL update) int rc; char **attr_list; - snprintf( filter, sizeof(filter)-1, "(objectclass=%s)", LDAP_OBJ_GROUPMAP); + pstr_sprintf( filter, "(objectclass=%s)", LDAP_OBJ_GROUPMAP); attr_list = get_attr_list( groupmap_attr_list ); rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(), LDAP_SCOPE_SUBTREE, filter, diff --git a/source3/passdb/pdb_smbpasswd.c b/source3/passdb/pdb_smbpasswd.c index 055e8e71ba..8171b65adc 100644 --- a/source3/passdb/pdb_smbpasswd.c +++ b/source3/passdb/pdb_smbpasswd.c @@ -179,8 +179,25 @@ static FILE *startsmbfilepwent(const char *pfile, enum pwf_access_type type, int DEBUG(10, ("startsmbfilepwent_internal: opening file %s\n", pfile)); if((fp = sys_fopen(pfile, open_mode)) == NULL) { - DEBUG(0, ("startsmbfilepwent_internal: unable to open file %s. Error was %s\n", pfile, strerror(errno) )); - return NULL; + + /* + * If smbpasswd file doesn't exist, then create new one. This helps to avoid + * confusing error msg when adding user account first time. + */ + if (errno == ENOENT) { + if ((fp = sys_fopen(pfile, "a+")) != NULL) { + DEBUG(0, ("startsmbfilepwent_internal: file %s did not exist. File successfully created.\n", pfile)); + + } else { + DEBUG(0, ("startsmbfilepwent_internal: file %s did not exist. Couldn't create new one. Error was: %s", + pfile, strerror(errno))); + return NULL; + } + + } else { + DEBUG(0, ("startsmbfilepwent_internal: unable to open file %s. Error was: %s\n", pfile, strerror(errno))); + return NULL; + } } if (!pw_file_lock(fileno(fp), lock_type, 5, lock_depth)) { diff --git a/source3/passdb/pdb_tdb.c b/source3/passdb/pdb_tdb.c index 1078a5bd26..7c2156455a 100644 --- a/source3/passdb/pdb_tdb.c +++ b/source3/passdb/pdb_tdb.c @@ -180,6 +180,24 @@ static NTSTATUS tdbsam_getsampwnam (struct pdb_methods *my_methods, SAM_ACCOUNT /* open the accounts TDB */ if (!(pwd_tdb = tdb_open_log(tdb_state->tdbsam_location, 0, TDB_DEFAULT, O_RDONLY, 0600))) { + + if (errno == ENOENT) { + /* + * TDB file doesn't exist, so try to create new one. This is useful to avoid + * confusing error msg when adding user account first time + */ + if (!(pwd_tdb = tdb_open_log(tdb_state->tdbsam_location, 0, TDB_DEFAULT, O_CREAT, 0600))) { + DEBUG(0, ("pdb_getsampwnam: TDB passwd (%s) did not exist. File successfully created.\n", + tdb_state->tdbsam_location)); + } else { + DEBUG(0, ("pdb_getsampwnam: TDB passwd (%s) does not exist. Couldn't create new one. Error was: %s\n", + tdb_state->tdbsam_location, strerror(errno))); + } + + /* requested user isn't there anyway */ + nt_status = NT_STATUS_NO_SUCH_USER; + return nt_status; + } DEBUG(0, ("pdb_getsampwnam: Unable to open TDB passwd (%s)!\n", tdb_state->tdbsam_location)); return nt_status; } @@ -419,49 +437,6 @@ done: return (ret); } -#if 0 -/*************************************************************************** - Allocates a new RID and returns it to the caller as a domain sid - - NOTE: Use carefullt, do not waste RIDs they are a limited resource! - - SSS - ***************************************************************************/ - -static NTSTATUS tdbsam_get_next_sid (struct pdb_methods *my_methods, DOM_SID *sid) -{ - NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - struct tdbsam_privates *tdb_state = (struct tdbsam_privates *)my_methods->private_data; - TDB_CONTEXT *pwd_tdb; - uint32 rid; - - if (sid == NULL) { - return NT_STATUS_INVALID_PARAMETER; - } - - pwd_tdb = tdb_open_log(tdb_state->tdbsam_location, 0, TDB_DEFAULT, O_RDWR | O_CREAT, 0600); - if (!pwd_tdb) - { - DEBUG(0, ("tdbsam_get_next_sid: Unable to open TDB passwd (%s)!\n", tdb_state->tdbsam_location)); - return NT_STATUS_UNSUCCESSFUL; - } - - rid = BASE_RID; - if (tdb_change_uint32_atomic(pwd_tdb, "RID_COUNTER", &rid, 1)) { - - sid_copy(sid, get_global_sam_sid()); - if (!sid_append_rid(sid, rid)) { - goto done; - } - - ret = NT_STATUS_OK; - } - -done: - tdb_close (pwd_tdb); - return ret; -} -#endif - /*************************************************************************** Modifies an existing SAM_ACCOUNT ****************************************************************************/ diff --git a/source3/passdb/secrets.c b/source3/passdb/secrets.c index bad8e96865..23413e4026 100644 --- a/source3/passdb/secrets.c +++ b/source3/passdb/secrets.c @@ -195,11 +195,11 @@ const char *trust_keystr(const char *domain) * * @return stored password's key **/ -char *trustdom_keystr(const char *domain) +static char *trustdom_keystr(const char *domain) { - static char* keystr; + static pstring keystr; - asprintf(&keystr, "%s/%s", SECRETS_DOMTRUST_ACCT_PASS, domain); + pstr_sprintf(keystr, "%s/%s", SECRETS_DOMTRUST_ACCT_PASS, domain); strupper_m(keystr); return keystr; diff --git a/source3/printing/notify.c b/source3/printing/notify.c index 479d883134..e2146d5018 100644 --- a/source3/printing/notify.c +++ b/source3/printing/notify.c @@ -164,8 +164,8 @@ static void print_notify_send_messages_to_printer(const char *printer, unsigned } } - DEBUG(5, ("print_notify_send_messages_to_printer: sending %d print notify message%s to printer %s\n", - msg_count, msg_count != 1 ? "s" : "", printer)); + DEBUG(5, ("print_notify_send_messages_to_printer: sending %lu print notify message%s to printer %s\n", + (unsigned long)msg_count, msg_count != 1 ? "s" : "", printer)); /* * Get the list of PID's to send to. @@ -272,8 +272,8 @@ in notify_queue\n", msg->type, msg->field, msg->printer)); /* allocate a new msg structure and copy the fields */ if ( !(pnqueue->msg = (SPOOLSS_NOTIFY_MSG*)talloc(send_ctx, sizeof(SPOOLSS_NOTIFY_MSG))) ) { - DEBUG(0,("send_spoolss_notify2_msg: talloc() of size [%d] failed!\n", - sizeof(SPOOLSS_NOTIFY_MSG))); + DEBUG(0,("send_spoolss_notify2_msg: talloc() of size [%lu] failed!\n", + (unsigned long)sizeof(SPOOLSS_NOTIFY_MSG))); return; } copy_notify2_msg(pnqueue->msg, msg); diff --git a/source3/printing/pcap.c b/source3/printing/pcap.c index 1bdbf4a789..a5fb53a320 100644 --- a/source3/printing/pcap.c +++ b/source3/printing/pcap.c @@ -208,7 +208,7 @@ static BOOL ScanQconfig(char *psz,char *pszPrintername) /* probably a good printer ??? */ free (line); SAFE_FREE(pName); - fclose(pfile); + x_fclose(pfile); return(True); } @@ -222,7 +222,7 @@ static BOOL ScanQconfig(char *psz,char *pszPrintername) /* it's a good virtual printer */ free (line); SAFE_FREE(pName); - fclose(pfile); + x_fclose(pfile); return(True); } break; diff --git a/source3/python/py_common.c b/source3/python/py_common.c index ea092d9370..02d22bbdab 100644 --- a/source3/python/py_common.c +++ b/source3/python/py_common.c @@ -223,7 +223,7 @@ struct cli_state *open_pipe_creds(char *server, PyObject *creds, result = cli_full_connection( &cli, NULL, server, NULL, 0, "IPC$", "IPC", - username, domain, password, 0, NULL); + username, domain, password, 0, Undefined, NULL); if (!NT_STATUS_IS_OK(result)) { *errstr = strdup("error connecting to IPC$ pipe"); diff --git a/source3/python/py_lsa.c b/source3/python/py_lsa.c index c063dcba81..4204f43f7b 100644 --- a/source3/python/py_lsa.c +++ b/source3/python/py_lsa.c @@ -213,6 +213,7 @@ static PyObject *lsa_lookup_sids(PyObject *self, PyObject *args, char **domains, **names; uint32 *types; lsa_policy_hnd_object *hnd = (lsa_policy_hnd_object *)self; + TALLOC_CTX *mem_ctx = NULL; DOM_SID *sids; if (!PyArg_ParseTuple(args, "O", &py_sids)) @@ -223,12 +224,17 @@ static PyObject *lsa_lookup_sids(PyObject *self, PyObject *args, return NULL; } + if (!(mem_ctx = talloc_init("lsa_open_policy"))) { + PyErr_SetString(lsa_error, "unable to init talloc context\n"); + goto done; + } + if (PyList_Check(py_sids)) { /* Convert dictionary to char ** array */ num_sids = PyList_Size(py_sids); - sids = (DOM_SID *)talloc(hnd->mem_ctx, num_sids * sizeof(DOM_SID)); + sids = (DOM_SID *)talloc(mem_ctx, num_sids * sizeof(DOM_SID)); memset(sids, 0, num_sids * sizeof(DOM_SID)); @@ -237,7 +243,8 @@ static PyObject *lsa_lookup_sids(PyObject *self, PyObject *args, if (!string_to_sid(&sids[i], PyString_AsString(obj))) { PyErr_SetString(PyExc_ValueError, "string_to_sid failed"); - return NULL; + result = NULL; + goto done; } } @@ -246,21 +253,23 @@ static PyObject *lsa_lookup_sids(PyObject *self, PyObject *args, /* Just a single element */ num_sids = 1; - sids = (DOM_SID *)talloc(hnd->mem_ctx, sizeof(DOM_SID)); + sids = (DOM_SID *)talloc(mem_ctx, sizeof(DOM_SID)); if (!string_to_sid(&sids[0], PyString_AsString(py_sids))) { PyErr_SetString(PyExc_ValueError, "string_to_sid failed"); - return NULL; + result = NULL; + goto done; } } - ntstatus = cli_lsa_lookup_sids(hnd->cli, hnd->mem_ctx, &hnd->pol, + ntstatus = cli_lsa_lookup_sids(hnd->cli, mem_ctx, &hnd->pol, num_sids, sids, &domains, &names, &types); if (!NT_STATUS_IS_OK(ntstatus)) { PyErr_SetObject(lsa_ntstatus, py_ntstatus_tuple(ntstatus)); - return NULL; + result = NULL; + goto done; } result = PyList_New(num_sids); @@ -274,7 +283,11 @@ static PyObject *lsa_lookup_sids(PyObject *self, PyObject *args, PyList_SetItem(result, i, obj); } - + + done: + if (mem_ctx) + talloc_destroy(mem_ctx); + return result; } diff --git a/source3/python/py_ntsec.c b/source3/python/py_ntsec.c index 47524d8e19..3d408e0bda 100644 --- a/source3/python/py_ntsec.c +++ b/source3/python/py_ntsec.c @@ -58,14 +58,14 @@ BOOL py_from_ACE(PyObject **dict, SEC_ACE *ace) return True; } - *dict = PyDict_New(); - - PyDict_SetItemString(*dict, "type", PyInt_FromLong(ace->type)); - PyDict_SetItemString(*dict, "flags", PyInt_FromLong(ace->flags)); - PyDict_SetItemString(*dict, "mask", PyInt_FromLong(ace->info.mask)); + *dict = Py_BuildValue("{sisisi}", "type", ace->type, + "flags", ace->flags, + "mask", ace->info.mask); - if (py_from_SID(&obj, &ace->trustee)) + if (py_from_SID(&obj, &ace->trustee)) { PyDict_SetItemString(*dict, "trustee", obj); + Py_DECREF(obj); + } return True; } @@ -125,10 +125,6 @@ BOOL py_from_ACL(PyObject **dict, SEC_ACL *acl) return True; } - *dict = PyDict_New(); - - PyDict_SetItemString(*dict, "revision", PyInt_FromLong(acl->revision)); - ace_list = PyList_New(acl->num_aces); for (i = 0; i < acl->num_aces; i++) { @@ -138,7 +134,8 @@ BOOL py_from_ACL(PyObject **dict, SEC_ACL *acl) PyList_SetItem(ace_list, i, obj); } - PyDict_SetItemString(*dict, "ace_list", ace_list); + *dict = Py_BuildValue("{sisN}", "revision", acl->revision, + "ace_list", ace_list); return True; } @@ -181,19 +178,29 @@ BOOL py_from_SECDESC(PyObject **dict, SEC_DESC *sd) *dict = PyDict_New(); - PyDict_SetItemString(*dict, "revision", PyInt_FromLong(sd->revision)); + obj = PyInt_FromLong(sd->revision); + PyDict_SetItemString(*dict, "revision", obj); + Py_DECREF(obj); - if (py_from_SID(&obj, sd->owner_sid)) + if (py_from_SID(&obj, sd->owner_sid)) { PyDict_SetItemString(*dict, "owner_sid", obj); + Py_DECREF(obj); + } - if (py_from_SID(&obj, sd->grp_sid)) + if (py_from_SID(&obj, sd->grp_sid)) { PyDict_SetItemString(*dict, "group_sid", obj); + Py_DECREF(obj); + } - if (py_from_ACL(&obj, sd->dacl)) + if (py_from_ACL(&obj, sd->dacl)) { PyDict_SetItemString(*dict, "dacl", obj); + Py_DECREF(obj); + } - if (py_from_ACL(&obj, sd->sacl)) + if (py_from_ACL(&obj, sd->sacl)) { PyDict_SetItemString(*dict, "sacl", obj); + Py_DECREF(obj); + } return True; } diff --git a/source3/python/py_smb.c b/source3/python/py_smb.c index d37b73cceb..bb84a337c9 100644 --- a/source3/python/py_smb.c +++ b/source3/python/py_smb.c @@ -238,7 +238,8 @@ static PyObject *py_smb_query_secdesc(PyObject *self, PyObject *args, if (cli_is_error(cli->cli)) { PyErr_SetString(PyExc_RuntimeError, "query_secdesc failed"); - return NULL; + result = NULL; + goto done; } if (!secdesc) { @@ -342,11 +343,48 @@ static PyMethodDef smb_methods[] = { { "connect", (PyCFunction)py_smb_connect, METH_VARARGS | METH_KEYWORDS, "Connect to a host" }, + /* Other stuff - this should really go into a samba config module + but for the moment let's leave it here. */ + + { "setup_logging", (PyCFunction)py_setup_logging, + METH_VARARGS | METH_KEYWORDS, + "Set up debug logging.\n" +"\n" +"Initialises Samba's debug logging system. One argument is expected which\n" +"is a boolean specifying whether debugging is interactive and sent to stdout\n" +"or logged to a file.\n" +"\n" +"Example:\n" +"\n" +">>> smb.setup_logging(interactive = 1)" }, + + { "get_debuglevel", (PyCFunction)get_debuglevel, + METH_VARARGS, + "Set the current debug level.\n" +"\n" +"Example:\n" +"\n" +">>> smb.get_debuglevel()\n" +"0" }, + + { "set_debuglevel", (PyCFunction)set_debuglevel, + METH_VARARGS, + "Get the current debug level.\n" +"\n" +"Example:\n" +"\n" +">>> smb.set_debuglevel(10)" }, + { NULL } }; static void py_cli_state_dealloc(PyObject* self) { + cli_state_object *cli = (cli_state_object *)self; + + if (cli->cli) + cli_shutdown(cli->cli); + PyObject_Del(self); } @@ -395,5 +433,5 @@ void initsmb(void) py_samba_init(); setup_logging("smb", True); - DEBUGLEVEL = 10; + DEBUGLEVEL = 3; } diff --git a/source3/python/py_winbind.c b/source3/python/py_winbind.c index db66be2321..ebceb95d71 100644 --- a/source3/python/py_winbind.c +++ b/source3/python/py_winbind.c @@ -259,14 +259,14 @@ static PyObject *py_config_dict(void) PyDict_SetItemString(result, "template_shell", PyString_FromString(lp_template_shell())); - /* Winbind uid/gid range */ + /* idmap uid/gid range */ - if (lp_winbind_uid(&ulow, &uhi)) { + if (lp_idmap_uid(&ulow, &uhi)) { PyDict_SetItemString(result, "uid_low", PyInt_FromLong(ulow)); PyDict_SetItemString(result, "uid_high", PyInt_FromLong(uhi)); } - if (lp_winbind_gid(&glow, &ghi)) { + if (lp_idmap_gid(&glow, &ghi)) { PyDict_SetItemString(result, "gid_low", PyInt_FromLong(glow)); PyDict_SetItemString(result, "gid_high", PyInt_FromLong(ghi)); } diff --git a/source3/rpc_client/cli_ds.c b/source3/rpc_client/cli_ds.c index f0edeca000..a7a093328c 100644 --- a/source3/rpc_client/cli_ds.c +++ b/source3/rpc_client/cli_ds.c @@ -22,6 +22,10 @@ /* implementations of client side DsXXX() functions */ +/******************************************************************** + Get information about the server and directory services +********************************************************************/ + NTSTATUS cli_ds_getprimarydominfo(struct cli_state *cli, TALLOC_CTX *mem_ctx, uint16 level, DS_DOMINFO_CTR *ctr) { @@ -40,7 +44,7 @@ NTSTATUS cli_ds_getprimarydominfo(struct cli_state *cli, TALLOC_CTX *mem_ctx, q.level = level; - if (!ds_io_q_getprimdominfo("", &q, &qbuf, 0) + if (!ds_io_q_getprimdominfo("", &qbuf, 0, &q) || !rpc_api_pipe_req(cli, DS_GETPRIMDOMINFO, &qbuf, &rbuf)) { result = NT_STATUS_UNSUCCESSFUL; goto done; @@ -48,7 +52,7 @@ NTSTATUS cli_ds_getprimarydominfo(struct cli_state *cli, TALLOC_CTX *mem_ctx, /* Unmarshall response */ - if (!ds_io_r_getprimdominfo("", &r, &rbuf, 0)) { + if (!ds_io_r_getprimdominfo("", &rbuf, 0, &r)) { result = NT_STATUS_UNSUCCESSFUL; goto done; } @@ -71,3 +75,63 @@ done: return result; } + +/******************************************************************** + Enumerate trusted domains in an AD forest +********************************************************************/ + +NTSTATUS cli_ds_enum_domain_trusts(struct cli_state *cli, TALLOC_CTX *mem_ctx, + const char *server, uint32 flags, + DS_DOMAIN_TRUSTS **trusts, uint32 *num_domains) +{ + prs_struct qbuf, rbuf; + DS_Q_ENUM_DOM_TRUSTS q; + DS_R_ENUM_DOM_TRUSTS r; + NTSTATUS result; + + ZERO_STRUCT(q); + ZERO_STRUCT(r); + + /* Initialise parse structures */ + + prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL); + prs_init(&rbuf, 0, mem_ctx, UNMARSHALL); + + init_q_ds_enum_domain_trusts( &q, server, flags ); + + if (!ds_io_q_enum_domain_trusts("", &qbuf, 0, &q) + || !rpc_api_pipe_req(cli, DS_ENUM_DOM_TRUSTS, &qbuf, &rbuf)) { + result = NT_STATUS_UNSUCCESSFUL; + goto done; + } + + /* Unmarshall response */ + + if (!ds_io_r_enum_domain_trusts("", &rbuf, 0, &r)) { + result = NT_STATUS_UNSUCCESSFUL; + goto done; + } + + result = r.status; + + if ( NT_STATUS_IS_OK(result) ) { + int i; + + *num_domains = r.num_domains; + *trusts = (DS_DOMAIN_TRUSTS*)smb_xmalloc(r.num_domains*sizeof(DS_DOMAIN_TRUSTS)); + + memcpy( *trusts, r.domains.trusts, r.num_domains*sizeof(DS_DOMAIN_TRUSTS) ); + for ( i=0; ipipe_auth_flags & AUTH_PIPE_NETSEC) { + } else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) { RPC_AUTH_NETSEC_NEG netsec_neg; /* Use lp_workgroup() if domain not specified */ - if (!domain || !domain[0]) + if (!domain || !domain[0]) { + DEBUG(10,("create_rpc_bind_req: no domain; assuming my own\n")); domain = lp_workgroup(); + } init_rpc_auth_netsec_neg(&netsec_neg, domain, my_name); @@ -715,7 +717,8 @@ static NTSTATUS create_rpc_bind_req(struct cli_state *cli, prs_struct *rpc_out, /* Auth len in the rpc header doesn't include auth_header. */ auth_len = prs_offset(&auth_info) - saved_hdr_offset; } - /* create the request RPC_HDR */ + + /* Create the request RPC_HDR */ init_rpc_hdr(&hdr, RPC_BIND, 0x3, rpc_call_id, RPC_HEADER_LEN + RPC_HDR_RB_LEN + prs_offset(&auth_info), auth_len); @@ -1021,11 +1024,6 @@ BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num, static const uchar netsec_sig[8] = NETSEC_SIGNATURE; static const uchar nullbytes[8] = { 0,0,0,0,0,0,0,0 }; size_t parse_offset_marker; - if ((cli->auth_info.seq_num & 1) != 0) { - DEBUG(0,("SCHANNEL ERROR: seq_num must be even in client (seq_num=%d)\n", - cli->auth_info.seq_num)); - } - DEBUG(10,("SCHANNEL seq_num=%d\n", cli->auth_info.seq_num)); init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes, @@ -1573,9 +1571,6 @@ NTSTATUS cli_nt_establish_netlogon(struct cli_state *cli, int sec_chan, } } - /* doing schannel, not per-user auth */ - cli->pipe_auth_flags = AUTH_PIPE_NETSEC | AUTH_PIPE_SIGN | AUTH_PIPE_SEAL; - if (!rpc_pipe_bind(cli, PI_NETLOGON, global_myname())) { DEBUG(2,("rpc bind to %s failed\n", PIPE_NETLOGON)); cli_close(cli, cli->nt_pipe_fnum); @@ -1586,6 +1581,57 @@ NTSTATUS cli_nt_establish_netlogon(struct cli_state *cli, int sec_chan, } +NTSTATUS cli_nt_setup_netsec(struct cli_state *cli, int sec_chan, + const uchar trust_password[16]) +{ + NTSTATUS result; + uint32 neg_flags = 0x000001ff; + cli->pipe_auth_flags = 0; + + if (lp_client_schannel() == False) { + return NT_STATUS_OK; + } + + if (!cli_nt_session_open(cli, PI_NETLOGON)) { + DEBUG(0, ("Could not initialise %s\n", + get_pipe_name_from_index(PI_NETLOGON))); + return NT_STATUS_UNSUCCESSFUL; + } + + if (lp_client_schannel() != False) + neg_flags |= NETLOGON_NEG_SCHANNEL; + + neg_flags |= NETLOGON_NEG_SCHANNEL; + + result = cli_nt_setup_creds(cli, sec_chan, trust_password, + &neg_flags, 2); + + if (!(neg_flags & NETLOGON_NEG_SCHANNEL) + && lp_client_schannel() == True) { + DEBUG(1, ("Could not negotiate SCHANNEL with the DC!\n")); + result = NT_STATUS_UNSUCCESSFUL; + } + + if (!NT_STATUS_IS_OK(result)) { + ZERO_STRUCT(cli->auth_info.sess_key); + ZERO_STRUCT(cli->sess_key); + cli->pipe_auth_flags = 0; + cli_nt_session_close(cli); + return result; + } + + memcpy(cli->auth_info.sess_key, cli->sess_key, + sizeof(cli->auth_info.sess_key)); + + cli->saved_netlogon_pipe_fnum = cli->nt_pipe_fnum; + cli->nt_pipe_fnum = 0; + + /* doing schannel, not per-user auth */ + cli->pipe_auth_flags = AUTH_PIPE_NETSEC | AUTH_PIPE_SIGN | AUTH_PIPE_SEAL; + + return NT_STATUS_OK; +} + const char *cli_pipe_get_name(struct cli_state *cli) { return cli->pipe_name; diff --git a/source3/rpc_client/cli_srvsvc.c b/source3/rpc_client/cli_srvsvc.c index 6cd18f2e43..27349b7295 100644 --- a/source3/rpc_client/cli_srvsvc.c +++ b/source3/rpc_client/cli_srvsvc.c @@ -4,7 +4,7 @@ Copyright (C) Andrew Tridgell 1994-2000 Copyright (C) Luke Kenneth Casson Leighton 1996-2000 Copyright (C) Tim Potter 2001 - Copyright (C) Jim McDonough 2002 + Copyright (C) Jim McDonough 2002 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by diff --git a/source3/rpc_parse/parse_ds.c b/source3/rpc_parse/parse_ds.c index ab07631831..f954806036 100644 --- a/source3/rpc_parse/parse_ds.c +++ b/source3/rpc_parse/parse_ds.c @@ -1,7 +1,8 @@ /* * Unix SMB/CIFS implementation. * RPC Pipe client / server routines - * Copyright (C) Gerald Carter 2002 + + * Copyright (C) Gerald Carter 2002-2003 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -20,6 +21,9 @@ #include "includes.h" +/************************************************************************ +************************************************************************/ + static BOOL ds_io_dominfobasic( const char *desc, prs_struct *ps, int depth, DSROLE_PRIMARY_DOMAIN_INFO_BASIC **basic) { DSROLE_PRIMARY_DOMAIN_INFO_BASIC *p = *basic; @@ -68,7 +72,10 @@ static BOOL ds_io_dominfobasic( const char *desc, prs_struct *ps, int depth, DSR } -BOOL ds_io_q_getprimdominfo( const char *desc, DS_Q_GETPRIMDOMINFO *q_u, prs_struct *ps, int depth) +/************************************************************************ +************************************************************************/ + +BOOL ds_io_q_getprimdominfo( const char *desc, prs_struct *ps, int depth, DS_Q_GETPRIMDOMINFO *q_u) { prs_debug(ps, depth, desc, "ds_io_q_getprimdominfo"); depth++; @@ -82,7 +89,10 @@ BOOL ds_io_q_getprimdominfo( const char *desc, DS_Q_GETPRIMDOMINFO *q_u, prs_str return True; } -BOOL ds_io_r_getprimdominfo( const char *desc, DS_R_GETPRIMDOMINFO *r_u, prs_struct *ps, int depth) +/************************************************************************ +************************************************************************/ + +BOOL ds_io_r_getprimdominfo( const char *desc, prs_struct *ps, int depth, DS_R_GETPRIMDOMINFO *r_u) { prs_debug(ps, depth, desc, "ds_io_r_getprimdominfo"); depth++; @@ -120,3 +130,177 @@ BOOL ds_io_r_getprimdominfo( const char *desc, DS_R_GETPRIMDOMINFO *r_u, prs_str return True; } + +/************************************************************************ + initialize a DS_ENUM_DOM_TRUSTS structure +************************************************************************/ + +BOOL init_q_ds_enum_domain_trusts( DS_Q_ENUM_DOM_TRUSTS *q, const char *server, + uint32 flags ) +{ + int len; + + q->flags = flags; + + if ( server && *server ) + q->server_ptr = 1; + else + q->server_ptr = 0; + + len = q->server_ptr ? strlen(server)+1 : 0; + + init_unistr2( &q->server, server, len ); + + return True; +} + +/************************************************************************ +************************************************************************/ + +static BOOL ds_io_domain_trusts( const char *desc, prs_struct *ps, int depth, DS_DOMAIN_TRUSTS *trust) +{ + prs_debug(ps, depth, desc, "ds_io_dom_trusts_ctr"); + depth++; + + if ( !prs_uint32( "netbios_ptr", ps, depth, &trust->netbios_ptr ) ) + return False; + + if ( !prs_uint32( "dns_ptr", ps, depth, &trust->dns_ptr ) ) + return False; + + if ( !prs_uint32( "flags", ps, depth, &trust->flags ) ) + return False; + + if ( !prs_uint32( "parent_index", ps, depth, &trust->parent_index ) ) + return False; + + if ( !prs_uint32( "trust_type", ps, depth, &trust->trust_type ) ) + return False; + + if ( !prs_uint32( "trust_attributes", ps, depth, &trust->trust_attributes ) ) + return False; + + if ( !prs_uint32( "sid_ptr", ps, depth, &trust->sid_ptr ) ) + return False; + + if ( !prs_uint8s(False, "guid", ps, depth, trust->guid.info, GUID_SIZE) ) + return False; + + return True; +} + +/************************************************************************ +************************************************************************/ + +static BOOL ds_io_dom_trusts_ctr( const char *desc, prs_struct *ps, int depth, DS_DOMAIN_TRUSTS_CTR *ctr) +{ + int i; + + prs_debug(ps, depth, desc, "ds_io_dom_trusts_ctr"); + depth++; + + if ( !prs_uint32( "ptr", ps, depth, &ctr->ptr ) ) + return False; + + if ( !prs_uint32( "max_count", ps, depth, &ctr->max_count ) ) + return False; + + /* are we done? */ + + if ( ctr->max_count == 0 ) + return True; + + /* allocate the domain trusts array are parse it */ + + ctr->trusts = (DS_DOMAIN_TRUSTS*)talloc(ps->mem_ctx, sizeof(DS_DOMAIN_TRUSTS)*ctr->max_count); + + if ( !ctr->trusts ) + return False; + + /* this stinks; the static portion o fthe structure is read here and then + we need another loop to read the UNISTR2's and SID's */ + + for ( i=0; imax_count;i++ ) { + if ( !ds_io_domain_trusts("domain_trusts", ps, depth, &ctr->trusts[i] ) ) + return False; + } + + for ( i=0; imax_count; i++ ) { + + if ( !smb_io_unistr2("netbios_domain", &ctr->trusts[i].netbios_domain, ctr->trusts[i].netbios_ptr, ps, depth) ) + return False; + + if(!prs_align(ps)) + return False; + + if ( !smb_io_unistr2("dns_domain", &ctr->trusts[i].dns_domain, ctr->trusts[i].dns_ptr, ps, depth) ) + return False; + + if(!prs_align(ps)) + return False; + + if ( ctr->trusts[i].sid_ptr ) { + if ( !smb_io_dom_sid2("sid", &ctr->trusts[i].sid, ps, depth ) ) + return False; + } + } + + return True; +} + +/************************************************************************ + initialize a DS_ENUM_DOM_TRUSTS request +************************************************************************/ + +BOOL ds_io_q_enum_domain_trusts( const char *desc, prs_struct *ps, int depth, DS_Q_ENUM_DOM_TRUSTS *q_u) +{ + prs_debug(ps, depth, desc, "ds_io_q_enum_domain_trusts"); + depth++; + + if ( !prs_align(ps) ) + return False; + + if ( !prs_uint32( "server_ptr", ps, depth, &q_u->server_ptr ) ) + return False; + + if ( !smb_io_unistr2("server", &q_u->server, q_u->server_ptr, ps, depth) ) + return False; + + if ( !prs_align(ps) ) + return False; + + if ( !prs_uint32( "flags", ps, depth, &q_u->flags ) ) + return False; + + return True; +} + +/************************************************************************ +************************************************************************/ + +BOOL ds_io_r_enum_domain_trusts( const char *desc, prs_struct *ps, int depth, DS_R_ENUM_DOM_TRUSTS *r_u) +{ + prs_debug(ps, depth, desc, "ds_io_r_enum_domain_trusts"); + depth++; + + if(!prs_align(ps)) + return False; + + if ( !prs_uint32( "num_domains", ps, depth, &r_u->num_domains ) ) + return False; + + if ( r_u->num_domains ) { + if ( !ds_io_dom_trusts_ctr("domains", ps, depth, &r_u->domains ) ) + return False; + } + + if(!prs_align(ps)) + return False; + + if ( !prs_ntstatus("status", ps, depth, &r_u->status ) ) + return False; + + return True; +} + + diff --git a/source3/rpc_parse/parse_lsa.c b/source3/rpc_parse/parse_lsa.c index d8c3b4e3c3..07b0da7e9c 100644 --- a/source3/rpc_parse/parse_lsa.c +++ b/source3/rpc_parse/parse_lsa.c @@ -5,7 +5,7 @@ * Copyright (C) Luke Kenneth Casson Leighton 1996-1997, * Copyright (C) Paul Ashton 1997, * Copyright (C) Andrew Bartlett 2002, - * Copyright (C) Jim McDonough 2002. + * Copyright (C) Jim McDonough 2002. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -2219,21 +2219,18 @@ BOOL lsa_io_r_query_info2(const char *desc, LSA_R_QUERY_INFO2 *r_c, if(!prs_uint32("ptr", ps, depth, &r_c->ptr)) return False; - - if (r_c->ptr != 0) { - if(!prs_uint16("info_class", ps, depth, &r_c->info_class)) + if(!prs_uint16("info_class", ps, depth, &r_c->info_class)) + return False; + switch(r_c->info_class) { + case 0x000c: + if (!lsa_io_dns_dom_info("info12", &r_c->info.dns_dom_info, + ps, depth)) return False; - switch(r_c->info_class) { - case 0x000c: - if (!lsa_io_dns_dom_info("info12", &r_c->info.dns_dom_info, - ps, depth)) - return False; break; - default: - DEBUG(0,("lsa_io_r_query_info2: unknown info class %d\n", - r_c->info_class)); - return False; - } + default: + DEBUG(0,("lsa_io_r_query_info2: unknown info class %d\n", + r_c->info_class)); + return False; } if(!prs_align(ps)) @@ -2304,19 +2301,6 @@ BOOL lsa_io_r_enum_acct_rights(const char *desc, LSA_R_ENUM_ACCT_RIGHTS *r_c, pr return True; } -/******************************************************************* - Inits an LSA_R_ENUM_ACCT_RIGHTS structure. -********************************************************************/ -void init_r_enum_acct_rights(LSA_R_ENUM_ACCT_RIGHTS *q_r, - uint32 count, - const char **rights) -{ - DEBUG(5, ("init_r_enum_acct_rights\n")); - - q_r->count = count; - init_unistr2_array(&q_r->rights, count, rights); -} - /******************************************************************* Inits an LSA_Q_ADD_ACCT_RIGHTS structure. @@ -2332,6 +2316,7 @@ void init_q_add_acct_rights(LSA_Q_ADD_ACCT_RIGHTS *q_q, q_q->pol = *hnd; init_dom_sid2(&q_q->sid, sid); init_unistr2_array(&q_q->rights, count, rights); + q_q->count = 5; } @@ -2372,21 +2357,11 @@ BOOL lsa_io_r_add_acct_rights(const char *desc, LSA_R_ADD_ACCT_RIGHTS *r_c, prs_ return True; } -/******************************************************************* - Inits an LSA_R_ADD_ACCT_RIGHTS structure. -********************************************************************/ -void init_r_add_acct_rights(LSA_R_ADD_ACCT_RIGHTS *q_r) -{ - DEBUG(5, ("init_r_add_acct_rights\n")); - /* oh what a silly function! */ -} - -#if 0 /******************************************************************* Inits an LSA_Q_REMOVE_ACCT_RIGHTS structure. ********************************************************************/ - void init_q_remove_acct_rights(LSA_Q_REMOVE_ACCT_RIGHTS *q_q, +void init_q_remove_acct_rights(LSA_Q_REMOVE_ACCT_RIGHTS *q_q, POLICY_HND *hnd, DOM_SID *sid, uint32 removeall, @@ -2399,13 +2374,14 @@ void init_r_add_acct_rights(LSA_R_ADD_ACCT_RIGHTS *q_r) init_dom_sid2(&q_q->sid, sid); q_q->removeall = removeall; init_unistr2_array(&q_q->rights, count, rights); + q_q->count = 5; } /******************************************************************* reads or writes a LSA_Q_REMOVE_ACCT_RIGHTS structure. ********************************************************************/ - BOOL lsa_io_q_remove_acct_rights(const char *desc, LSA_Q_REMOVE_ACCT_RIGHTS *q_q, prs_struct *ps, int depth) +BOOL lsa_io_q_remove_acct_rights(const char *desc, LSA_Q_REMOVE_ACCT_RIGHTS *q_q, prs_struct *ps, int depth) { prs_debug(ps, depth, desc, "lsa_io_q_remove_acct_rights"); depth++; @@ -2429,9 +2405,9 @@ reads or writes a LSA_Q_REMOVE_ACCT_RIGHTS structure. } /******************************************************************* -reads or writes a LSA_R_REMOVE_ACCT_RIGHTS structure. +reads or writes a LSA_R_ENUM_ACCT_RIGHTS structure. ********************************************************************/ - BOOL lsa_io_r_remove_acct_rights(const char *desc, LSA_R_REMOVE_ACCT_RIGHTS *r_c, prs_struct *ps, int depth) +BOOL lsa_io_r_remove_acct_rights(const char *desc, LSA_R_REMOVE_ACCT_RIGHTS *r_c, prs_struct *ps, int depth) { prs_debug(ps, depth, desc, "lsa_io_r_remove_acct_rights"); depth++; @@ -2441,90 +2417,3 @@ reads or writes a LSA_R_REMOVE_ACCT_RIGHTS structure. return True; } - -/******************************************************************* - Inits an LSA_R_REMOVE_ACCT_RIGHTS structure. -********************************************************************/ - void init_r_remove_acct_rights(LSA_R_REMOVE_ACCT_RIGHTS *q_r) -{ - DEBUG(5, ("init_r_remove_acct_rights\n")); -} - -/******************************************************************* - Inits an LSA_Q_ENUM_ACCT_WITH_RIGHT structure. -********************************************************************/ - void init_q_enum_acct_with_right(LSA_Q_ENUM_ACCT_WITH_RIGHT *q_q, - POLICY_HND *hnd, - const char *right) -{ - DEBUG(5, ("init_q_enum_acct_with_right\n")); - - q_q->pol = *hnd; - init_unistr2(&q_q->right, right, strlen(right)); - init_str_hdr(&q_q->right_hdr, - q_q->right.uni_max_len*2, - q_q->right.uni_max_len*2, right?1:0); -} - - -/******************************************************************* -reads or writes a LSA_Q_ENUM_ACCT_WITH_RIGHT structure. -********************************************************************/ - BOOL lsa_io_q_enum_acct_with_right(const char *desc, LSA_Q_ENUM_ACCT_WITH_RIGHT *q_q, prs_struct *ps, int depth) -{ - prs_debug(ps, depth, desc, "lsa_io_q_enum_acct_with_right"); - depth++; - - if (!smb_io_pol_hnd("", &q_q->pol, ps, depth)) - return False; - - if (!prs_uint32("ref_id ", ps, depth, &q_q->right_hdr.buffer)) - return False; - - if (UNMARSHALLING(ps) && q_q->right_hdr.buffer == 0) { - return True; - } - - if (!smb_io_strhdr("", &q_q->right_hdr, ps, depth)) - return False; - - if (!smb_io_unistr2("", &q_q->right, q_q->right_hdr.buffer, ps, depth)) - return False; - - return True; -} - - -/******************************************************************* -reads or writes a LSA_R_ENUM_ACCT_WITH_RIGHT structure. -********************************************************************/ - BOOL lsa_io_r_enum_acct_with_right(const char *desc, LSA_R_ENUM_ACCT_WITH_RIGHT *r_c, prs_struct *ps, int depth) -{ - prs_debug(ps, depth, desc, "lsa_io_r_enum_acct_with_right"); - depth++; - - if (!prs_uint32("count ", ps, depth, &r_c->count)) - return False; - - if (!smb_io_sid_array("sids ", &r_c->sids, ps, depth)) - return False; - - if(!prs_ntstatus("status", ps, depth, &r_c->status)) - return False; - - return True; -} - -/******************************************************************* - Inits an LSA_R_ENUM_ACCT_WITH_RIGHT structure. -********************************************************************/ - void init_r_enum_acct_with_right(LSA_R_ENUM_ACCT_WITH_RIGHT *r_c, - uint32 count, - DOM_SID *sids) -{ - DEBUG(5, ("init_r_enum_acct_with_right\n")); - - r_c->count = count; - init_sid_array(&r_c->sids, count, sids); -} -#endif diff --git a/source3/rpc_parse/parse_prs.c b/source3/rpc_parse/parse_prs.c index efd4914c66..11d8658b15 100644 --- a/source3/rpc_parse/parse_prs.c +++ b/source3/rpc_parse/parse_prs.c @@ -1473,7 +1473,7 @@ void netsec_encode(struct netsec_auth_struct *a, int auth_flags, { uchar digest_final[16]; - DEBUG(10,("SCHANNEL: netsec_encode seq_num=%d data_len=%d\n", a->seq_num, data_len)); + DEBUG(10,("SCHANNEL: netsec_encode seq_num=%d data_len=%lu\n", a->seq_num, (unsigned long)data_len)); dump_data_pw("a->sess_key:\n", a->sess_key, sizeof(a->sess_key)); RSIVAL(verf->seq_num, 0, a->seq_num); @@ -1544,7 +1544,7 @@ BOOL netsec_decode(struct netsec_auth_struct *a, int auth_flags, break; } - DEBUG(10,("SCHANNEL: netsec_decode seq_num=%d data_len=%d\n", a->seq_num, data_len)); + DEBUG(10,("SCHANNEL: netsec_decode seq_num=%d data_len=%lu\n", a->seq_num, (unsigned long)data_len)); dump_data_pw("a->sess_key:\n", a->sess_key, sizeof(a->sess_key)); dump_data_pw("seq_num:\n", seq_num, sizeof(seq_num)); diff --git a/source3/rpc_parse/parse_samr.c b/source3/rpc_parse/parse_samr.c index 45c81deb89..fce3195225 100644 --- a/source3/rpc_parse/parse_samr.c +++ b/source3/rpc_parse/parse_samr.c @@ -7,8 +7,7 @@ * Copyright (C) Elrond 2000, * Copyright (C) Jeremy Allison 2001, * Copyright (C) Jean François Micouleau 1998-2001, - * Copyright (C) Anthony Liguori 2002, - * Copyright (C) Jim McDonough 2002. + * Copyright (C) Jim McDonough 2002. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/source3/rpc_server/srv_dfs.c b/source3/rpc_server/srv_dfs.c index 75a24174ea..27bb0732b4 100644 --- a/source3/rpc_server/srv_dfs.c +++ b/source3/rpc_server/srv_dfs.c @@ -5,7 +5,7 @@ * Copyright (C) Luke Kenneth Casson Leighton 1996-1997, * Copyright (C) Shirish Kalele 2000, * Copyright (C) Jeremy Allison 2001, - * Copyright (C) Anthony Liguori 2003. + * Copyright (C) Jim McDonough 2003. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/source3/rpc_server/srv_lsa.c b/source3/rpc_server/srv_lsa.c index 679cfb73bb..34812b15d9 100644 --- a/source3/rpc_server/srv_lsa.c +++ b/source3/rpc_server/srv_lsa.c @@ -5,8 +5,7 @@ * Copyright (C) Luke Kenneth Casson Leighton 1996-1997, * Copyright (C) Paul Ashton 1997, * Copyright (C) Jeremy Allison 2001, - * Copyright (C) Jim McDonough 2002, - * Copyright (C) Anthony Liguori 2003. + * Copyright (C) Jim McDonough 2002-2003. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c index ca3021a876..9eafcb8dc3 100644 --- a/source3/rpc_server/srv_lsa_nt.c +++ b/source3/rpc_server/srv_lsa_nt.c @@ -6,7 +6,7 @@ * Copyright (C) Paul Ashton 1997, * Copyright (C) Jeremy Allison 2001, * Copyright (C) Rafal Szczesniak 2002, - * Copyright (C) Jim McDonough 2002. + * Copyright (C) Jim McDonough 2002. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/source3/rpc_server/srv_netlog.c b/source3/rpc_server/srv_netlog.c index 0cd4073177..d1be2f3723 100644 --- a/source3/rpc_server/srv_netlog.c +++ b/source3/rpc_server/srv_netlog.c @@ -5,7 +5,7 @@ * Copyright (C) Luke Kenneth Casson Leighton 1996-1997, * Copyright (C) Paul Ashton 1997, * Copyright (C) Jeremy Allison 1998-2001, - * Copyright (C) Anthony Liguori 2003. + * Copyright (C) Jim McDonough 2003. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/source3/rpc_server/srv_netlog_nt.c b/source3/rpc_server/srv_netlog_nt.c index c4a87d2e26..602cd7d2d5 100644 --- a/source3/rpc_server/srv_netlog_nt.c +++ b/source3/rpc_server/srv_netlog_nt.c @@ -5,7 +5,7 @@ * Copyright (C) Luke Kenneth Casson Leighton 1996-1997, * Copyright (C) Paul Ashton 1997. * Copyright (C) Jeremy Allison 1998-2001. - * Copyirht (C) Andrew Bartlett 2001. + * Copyright (C) Andrew Bartlett 2001. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c index 9a63ebc7a3..594cb3a9ae 100644 --- a/source3/rpc_server/srv_pipe.c +++ b/source3/rpc_server/srv_pipe.c @@ -5,7 +5,7 @@ * Copyright (C) Luke Kenneth Casson Leighton 1996-1998, * Copyright (C) Paul Ashton 1997-1998, * Copyright (C) Jeremy Allison 1999, - * Copyright (C) Anthony Liguori 2003. + * Copyright (C) Jim McDonough 2003. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -277,11 +277,6 @@ BOOL create_next_pdu(pipes_struct *p) prs_init(&rverf, 0, p->mem_ctx, MARSHALL); prs_init(&rauth, 0, p->mem_ctx, MARSHALL); - if ((p->netsec_auth.seq_num & 1) == 0) { - DEBUG(0,("SCHANNEL ERROR: seq_num must be odd in server! (seq_num=%d)\n", - p->netsec_auth.seq_num)); - } - init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes, nullbytes, nullbytes); netsec_encode(&p->netsec_auth, diff --git a/source3/rpc_server/srv_reg.c b/source3/rpc_server/srv_reg.c index 43bb1ad86a..e1a02103f7 100644 --- a/source3/rpc_server/srv_reg.c +++ b/source3/rpc_server/srv_reg.c @@ -7,7 +7,7 @@ * Copyright (C) Marc Jacobsen 2000, * Copyright (C) Jeremy Allison 2001, * Copyright (C) Gerald Carter 2002, - * Copyright (C) Anthony Liguori 2003. + * Copyright (C) Jim McDonough 2003. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/source3/rpc_server/srv_reg_nt.c b/source3/rpc_server/srv_reg_nt.c index 5632544909..a4e3638be6 100644 --- a/source3/rpc_server/srv_reg_nt.c +++ b/source3/rpc_server/srv_reg_nt.c @@ -596,11 +596,11 @@ NTSTATUS _reg_shutdown(pipes_struct *p, REG_Q_SHUTDOWN *q_u, REG_R_SHUTDOWN *r_u /* security check */ alpha_strcpy (chkmsg, message, NULL, sizeof(message)); /* timeout */ - snprintf(timeout, sizeof(timeout), "%d", q_u->timeout); + fstr_sprintf(timeout, "%d", q_u->timeout); /* reboot */ - snprintf(r, sizeof(r), (q_u->reboot) ? SHUTDOWN_R_STRING : ""); + fstr_sprintf(r, (q_u->reboot) ? SHUTDOWN_R_STRING : ""); /* force */ - snprintf(f, sizeof(f), (q_u->force) ? SHUTDOWN_F_STRING : ""); + fstr_sprintf(f, (q_u->force) ? SHUTDOWN_F_STRING : ""); pstrcpy(shutdown_script, lp_shutdown_script()); diff --git a/source3/rpc_server/srv_samr.c b/source3/rpc_server/srv_samr.c index 9250b023d3..86ff039683 100644 --- a/source3/rpc_server/srv_samr.c +++ b/source3/rpc_server/srv_samr.c @@ -6,8 +6,7 @@ * Copyright (C) Paul Ashton 1997, * Copyright (C) Marc Jacobsen 1999, * Copyright (C) Jean François Micouleau 1998-2001, - * Copyright (C) Anthony Liguori 2002-2003, - * Copyright (C) Jim McDonough 2002. + * Copyright (C) Jim McDonough 2002-2003. * * Split into interface and implementation modules by, * diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c index 9324fd4765..14aad5d6f8 100644 --- a/source3/rpc_server/srv_samr_nt.c +++ b/source3/rpc_server/srv_samr_nt.c @@ -7,8 +7,7 @@ * Copyright (C) Marc Jacobsen 1999, * Copyright (C) Jeremy Allison 2001-2002, * Copyright (C) Jean François Micouleau 1998-2001, - * Copyright (C) Anthony Liguori 2002, - * Copyright (C) Jim McDonough 2002. + * Copyright (C) Jim McDonough 2002. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -1517,17 +1516,17 @@ NTSTATUS _samr_lookup_names(pipes_struct *p, SAMR_Q_LOOKUP_NAMES *q_u, SAMR_R_LO NTSTATUS _samr_chgpasswd_user(pipes_struct *p, SAMR_Q_CHGPASSWD_USER *q_u, SAMR_R_CHGPASSWD_USER *r_u) { - fstring user_name; - fstring wks; + fstring user_name; + fstring wks; - DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__)); + DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__)); - r_u->status = NT_STATUS_OK; + r_u->status = NT_STATUS_OK; - rpcstr_pull(user_name, q_u->uni_user_name.buffer, sizeof(user_name), q_u->uni_user_name.uni_str_len*2, 0); - rpcstr_pull(wks, q_u->uni_dest_host.buffer, sizeof(wks), q_u->uni_dest_host.uni_str_len*2,0); + rpcstr_pull(user_name, q_u->uni_user_name.buffer, sizeof(user_name), q_u->uni_user_name.uni_str_len*2, 0); + rpcstr_pull(wks, q_u->uni_dest_host.buffer, sizeof(wks), q_u->uni_dest_host.uni_str_len*2,0); - DEBUG(5,("samr_chgpasswd_user: user: %s wks: %s\n", user_name, wks)); + DEBUG(5,("samr_chgpasswd_user: user: %s wks: %s\n", user_name, wks)); /* * Pass the user through the NT -> unix user mapping @@ -1541,14 +1540,14 @@ NTSTATUS _samr_chgpasswd_user(pipes_struct *p, SAMR_Q_CHGPASSWD_USER *q_u, SAMR_ * is case insensitive. */ - r_u->status = pass_oem_change(user_name, q_u->lm_newpass.pass, q_u->lm_oldhash.hash, - q_u->nt_newpass.pass, q_u->nt_oldhash.hash); + r_u->status = pass_oem_change(user_name, q_u->lm_newpass.pass, q_u->lm_oldhash.hash, + q_u->nt_newpass.pass, q_u->nt_oldhash.hash); - init_samr_r_chgpasswd_user(r_u, r_u->status); + init_samr_r_chgpasswd_user(r_u, r_u->status); - DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__)); + DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__)); - return r_u->status; + return r_u->status; } /******************************************************************* @@ -2259,7 +2258,7 @@ NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_ * now have some sainity-checking to match. */ - DEBUG(10,("checking account %s at pos %d for $ termination\n",account, strlen(account)-1)); + DEBUG(10,("checking account %s at pos %lu for $ termination\n",account, (unsigned long)strlen(account)-1)); /* * we used to have code here that made sure the acb_info flags @@ -2761,8 +2760,9 @@ static BOOL set_unix_primary_group(SAM_ACCOUNT *sampass) grp = getgrgid(gid); if (grp == NULL) { - DEBUG(2,("Could not find primary group %d for " - "user %s\n", gid, pdb_get_username(sampass))); + DEBUG(2,("Could not find primary group %lu for " + "user %s\n", (unsigned long)gid, + pdb_get_username(sampass))); return False; } diff --git a/source3/rpc_server/srv_spoolss.c b/source3/rpc_server/srv_spoolss.c index 3e9ed9e39f..fa0ca8478c 100755 --- a/source3/rpc_server/srv_spoolss.c +++ b/source3/rpc_server/srv_spoolss.c @@ -6,7 +6,7 @@ * Copyright (C) Jean François Micouleau 1998-2000, * Copyright (C) Jeremy Allison 2001, * Copyright (C) Gerald Carter 2001-2002, - * Copyright (C) Anthony Liguori 2003. + * Copyright (C) Jim McDonough 2003. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c index 2d316051af..8237298ebb 100644 --- a/source3/rpc_server/srv_spoolss_nt.c +++ b/source3/rpc_server/srv_spoolss_nt.c @@ -478,7 +478,7 @@ static BOOL set_printer_hnd_name(Printer_entry *Printer, char *handlename) fstring sname; BOOL found=False; - DEBUG(4,("Setting printer name=%s (len=%d)\n", handlename, strlen(handlename))); + DEBUG(4,("Setting printer name=%s (len=%lu)\n", handlename, (unsigned long)strlen(handlename))); if (Printer->printer_type==PRINTER_HANDLE_IS_PRINTSERVER) { ZERO_STRUCT(Printer->dev.printerservername); @@ -497,7 +497,7 @@ static BOOL set_printer_hnd_name(Printer_entry *Printer, char *handlename) aprinter=handlename; } - DEBUGADD(5,("searching for [%s] (len=%d)\n", aprinter, strlen(aprinter))); + DEBUGADD(5,("searching for [%s] (len=%lu)\n", aprinter, (unsigned long)strlen(aprinter))); /* * The original code allowed smbd to store a printer name that @@ -563,7 +563,7 @@ static BOOL open_printer_hnd(pipes_struct *p, POLICY_HND *hnd, char *name, uint3 new_printer->notify.option=NULL; - if ( !(new_printer->ctx = talloc_init("Printer Entry [0x%x]", (uint32)hnd)) ) { + if ( !(new_printer->ctx = talloc_init("Printer Entry [%p]", hnd)) ) { DEBUG(0,("open_printer_hnd: talloc_init() failed!\n")); close_printer_handle(p, hnd); return False; @@ -1176,7 +1176,7 @@ static void receive_notify2_message_list(int msg_type, pid_t src, void *msg, siz msg_count = IVAL(buf, 0); msg_ptr = buf + 4; - DEBUG(5, ("receive_notify2_message_list: got %d messages in list\n", msg_count)); + DEBUG(5, ("receive_notify2_message_list: got %lu messages in list\n", (unsigned long)msg_count)); if (msg_count == 0) { DEBUG(0,("receive_notify2_message_list: bad message format (msg_count == 0) !\n")); @@ -2393,9 +2393,7 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint if (!StrCaseCmp(value, "DefaultSpoolDirectory")) { - fstring string; - - fstrcpy(string, string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH)); + const char *string="C:\\PRINTERS"; *type = 0x1; *needed = 2*(strlen(string)+1); if((*data = (uint8 *)talloc(ctx, ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL) @@ -2411,7 +2409,7 @@ static WERROR getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint } if (!StrCaseCmp(value, "Architecture")) { - pstring string="Windows NT x86"; + const char *string="Windows NT x86"; *type = 0x1; *needed = 2*(strlen(string)+1); if((*data = (uint8 *)talloc(ctx, ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL) @@ -5135,7 +5133,7 @@ static uint32 init_unistr_array(uint16 **uni_array, fstring *char_array, const c else pstrcpy( line, v ); - DEBUGADD(6,("%d:%s:%d\n", i, line, strlen(line))); + DEBUGADD(6,("%d:%s:%lu\n", i, line, (unsigned long)strlen(line))); /* add one extra unit16 for the second terminating NULL */ @@ -7912,6 +7910,11 @@ WERROR _spoolss_setprinterdata( pipes_struct *p, SPOOL_Q_SETPRINTERDATA *q_u, SP return WERR_BADFID; } + if ( Printer->printer_type == PRINTER_HANDLE_IS_PRINTSERVER ) { + DEBUG(10,("_spoolss_setprinterdata: Not implemented for server handles yet\n")); + return WERR_INVALID_PARAM; + } + if (!get_printer_snum(p,handle, &snum)) return WERR_BADFID; @@ -8698,7 +8701,7 @@ WERROR _spoolss_getprinterdataex(pipes_struct *p, SPOOL_Q_GETPRINTERDATAEX *q_u, /* Is the handle to a printer or to the server? */ if (Printer->printer_type == PRINTER_HANDLE_IS_PRINTSERVER) { - DEBUG(10,("_spoolss_getprinterdatex: Not implemented for server handles yet\n")); + DEBUG(10,("_spoolss_getprinterdataex: Not implemented for server handles yet\n")); status = WERR_INVALID_PARAM; goto done; } @@ -8780,10 +8783,15 @@ WERROR _spoolss_setprinterdataex(pipes_struct *p, SPOOL_Q_SETPRINTERDATAEX *q_u, SetPrinterData if key is "PrinterDriverData" */ if (!Printer) { - DEBUG(2,("_spoolss_setprinterdata: Invalid handle (%s:%u:%u).\n", OUR_HANDLE(handle))); + DEBUG(2,("_spoolss_setprinterdataex: Invalid handle (%s:%u:%u).\n", OUR_HANDLE(handle))); return WERR_BADFID; } + if ( Printer->printer_type == PRINTER_HANDLE_IS_PRINTSERVER ) { + DEBUG(10,("_spoolss_setprinterdataex: Not implemented for server handles yet\n")); + return WERR_INVALID_PARAM; + } + if ( !get_printer_snum(p,handle, &snum) ) return WERR_BADFID; @@ -9092,8 +9100,8 @@ WERROR _spoolss_enumprinterdataex(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATAEX *q_ { if ( (enum_values=talloc(p->mem_ctx, num_entries*sizeof(PRINTER_ENUM_VALUES))) == NULL ) { - DEBUG(0,("_spoolss_enumprinterdataex: talloc() failed to allocate memory for [%d] bytes!\n", - num_entries*sizeof(PRINTER_ENUM_VALUES))); + DEBUG(0,("_spoolss_enumprinterdataex: talloc() failed to allocate memory for [%lu] bytes!\n", + (unsigned long)num_entries*sizeof(PRINTER_ENUM_VALUES))); result = WERR_NOMEM; goto done; } diff --git a/source3/rpc_server/srv_srvsvc.c b/source3/rpc_server/srv_srvsvc.c index deba122421..0da3cf70dd 100644 --- a/source3/rpc_server/srv_srvsvc.c +++ b/source3/rpc_server/srv_srvsvc.c @@ -5,7 +5,7 @@ * Copyright (C) Luke Kenneth Casson Leighton 1996-1997, * Copyright (C) Paul Ashton 1997, * Copyright (C) Jeremy Allison 2001, - * Copyright (C) Anthony Liguori 2003. + * Copyright (C) Jim McDonough 2003. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/source3/rpc_server/srv_wkssvc.c b/source3/rpc_server/srv_wkssvc.c index 8efa29fd0b..856f451779 100644 --- a/source3/rpc_server/srv_wkssvc.c +++ b/source3/rpc_server/srv_wkssvc.c @@ -4,7 +4,7 @@ * Copyright (C) Andrew Tridgell 1992-1997, * Copyright (C) Luke Kenneth Casson Leighton 1996-1997, * Copyright (C) Paul Ashton 1997, - * Copyright (C) Anthony Liguori 2003. + * Copyright (C) Jim McDonough 2003. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/source3/rpcclient/cmd_ds.c b/source3/rpcclient/cmd_ds.c index 4c2f52e291..721bd59ba0 100644 --- a/source3/rpcclient/cmd_ds.c +++ b/source3/rpcclient/cmd_ds.c @@ -47,13 +47,33 @@ static NTSTATUS cmd_ds_dsrole_getprimarydominfo(struct cli_state *cli, return result; } +static NTSTATUS cmd_ds_enum_domain_trusts(struct cli_state *cli, + TALLOC_CTX *mem_ctx, int argc, + const char **argv) +{ + NTSTATUS result; + uint32 flags = 0x1; + DS_DOMAIN_TRUSTS *trusts = NULL; + int num_domains = 0; + + result = cli_ds_enum_domain_trusts( cli, mem_ctx, cli->desthost, flags, + &trusts, &num_domains ); + + printf( "%d domains returned\n", num_domains ); + + SAFE_FREE( trusts ); + + return result; +} + /* List of commands exported by this module */ struct cmd_set ds_commands[] = { { "LSARPC-DS" }, - { "dsroledominfo", RPC_RTYPE_NTSTATUS, cmd_ds_dsrole_getprimarydominfo, NULL, PI_LSARPC_DS, "Get Primary Domain Information", "" }, + { "dsroledominfo", RPC_RTYPE_NTSTATUS, cmd_ds_dsrole_getprimarydominfo, NULL, PI_LSARPC_DS, "Get Primary Domain Information", "" }, + { "dsenumdomtrusts", RPC_RTYPE_NTSTATUS, cmd_ds_enum_domain_trusts, NULL, PI_NETLOGON, "Enumerate all trusted domains in an AD forest", "" }, { NULL } }; diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c index 40d01d0f5a..722d66621a 100644 --- a/source3/rpcclient/cmd_samr.c +++ b/source3/rpcclient/cmd_samr.c @@ -125,7 +125,7 @@ static const char *display_time(NTTIME nttime) mins=(sec - (days*60*60*24) - (hours*60*60) ) / 60; secs=sec - (days*60*60*24) - (hours*60*60) - (mins*60); - snprintf(string, sizeof(string)-1, "%u days, %u hours, %u minutes, %u seconds", days, hours, mins, secs); + fstr_sprintf(string, "%u days, %u hours, %u minutes, %u seconds", days, hours, mins, secs); return (string); } diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c index af021962f5..831d2beaa4 100644 --- a/source3/rpcclient/rpcclient.c +++ b/source3/rpcclient/rpcclient.c @@ -37,21 +37,6 @@ static struct cmd_list { struct cmd_set *cmd_set; } *cmd_list; -/***************************************************************************** - stubb functions -****************************************************************************/ - -void become_root( void ) -{ - return; -} - -void unbecome_root( void ) -{ - return; -} - - /**************************************************************************** handle completion of commands for readline ****************************************************************************/ @@ -370,66 +355,64 @@ static NTSTATUS cmd_none(struct cli_state *cli, TALLOC_CTX *mem_ctx, static NTSTATUS cmd_schannel(struct cli_state *cli, TALLOC_CTX *mem_ctx, int argc, const char **argv) { + NTSTATUS ret; uchar trust_password[16]; uint32 sec_channel_type; - uint32 neg_flags = 0x000001ff; - NTSTATUS result; static uchar zeros[16]; + if (argc == 2) { + strhex_to_str(cli->auth_info.sess_key, + strlen(argv[1]), + argv[1]); + memcpy(cli->sess_key, cli->auth_info.sess_key, sizeof(cli->sess_key)); + + cli->pipe_auth_flags = AUTH_PIPE_NETSEC; + cli->pipe_auth_flags |= AUTH_PIPE_SIGN; + cli->pipe_auth_flags |= AUTH_PIPE_SEAL; + + return NT_STATUS_OK; + } + /* Cleanup */ - if ((memcmp(cli->auth_info.sess_key, zeros, sizeof(cli->auth_info.sess_key)) != 0) - && (cli->saved_netlogon_pipe_fnum != 0)) { + if ((memcmp(cli->auth_info.sess_key, zeros, sizeof(cli->auth_info.sess_key)) != 0)) { if (cli->pipe_auth_flags == (AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN|AUTH_PIPE_SEAL)) { + /* already in this mode nothing to do */ return NT_STATUS_OK; } else { - /* still have session, just need to use it again */ + /* schannel is setup, just need to use it again */ cli->pipe_auth_flags = AUTH_PIPE_NETSEC; cli->pipe_auth_flags |= AUTH_PIPE_SIGN; cli->pipe_auth_flags |= AUTH_PIPE_SEAL; if (cli->nt_pipe_fnum != 0) cli_nt_session_close(cli); + return NT_STATUS_OK; } } if (cli->nt_pipe_fnum != 0) cli_nt_session_close(cli); - cli->pipe_auth_flags = 0; - + cli->pipe_auth_flags = AUTH_PIPE_NETSEC; + cli->pipe_auth_flags |= AUTH_PIPE_SIGN; + cli->pipe_auth_flags |= AUTH_PIPE_SEAL; + if (!secrets_fetch_trust_account_password(lp_workgroup(), trust_password, NULL, &sec_channel_type)) { return NT_STATUS_UNSUCCESSFUL; } - - if (!cli_nt_session_open(cli, PI_NETLOGON)) { - DEBUG(0, ("Could not initialise %s\n", - get_pipe_name_from_index(PI_NETLOGON))); - return NT_STATUS_UNSUCCESSFUL; - } - - neg_flags |= NETLOGON_NEG_SCHANNEL; - result = cli_nt_setup_creds(cli, sec_channel_type, trust_password, - &neg_flags, 2); - - if (!NT_STATUS_IS_OK(result)) { - ZERO_STRUCT(cli->auth_info.sess_key); - cli->pipe_auth_flags = 0; - return result; + ret = cli_nt_setup_netsec(cli, sec_channel_type, trust_password); + if (NT_STATUS_IS_OK(ret)) { + char *hex_session_key; + hex_encode(cli->auth_info.sess_key, + sizeof(cli->auth_info.sess_key), + &hex_session_key); + printf("Got Session key: %s\n", hex_session_key); + SAFE_FREE(hex_session_key); } - - memcpy(cli->auth_info.sess_key, cli->sess_key, - sizeof(cli->auth_info.sess_key)); - - cli->saved_netlogon_pipe_fnum = cli->nt_pipe_fnum; - - cli->pipe_auth_flags = AUTH_PIPE_NETSEC; - cli->pipe_auth_flags |= AUTH_PIPE_SIGN; - cli->pipe_auth_flags |= AUTH_PIPE_SEAL; - - return NT_STATUS_OK; + return ret; } /* Built in rpcclient commands */ @@ -536,7 +519,9 @@ static NTSTATUS do_cmd(struct cli_state *cli, } } - if ((cmd_entry->pipe_idx == PI_NETLOGON) && !(cli->pipe_auth_flags & AUTH_PIPE_NETSEC)) { + /* some of the DsXXX commands use the netlogon pipe */ + + if (lp_client_schannel() && (cmd_entry->pipe_idx == PI_NETLOGON) && !(cli->pipe_auth_flags & AUTH_PIPE_NETSEC)) { uint32 neg_flags = 0x000001ff; uint32 sec_channel_type; @@ -741,7 +726,8 @@ out_free: opt_ipaddr ? &server_ip : NULL, 0, "IPC$", "IPC", cmdline_auth_info.username, lp_workgroup(), - cmdline_auth_info.password, 0, NULL); + cmdline_auth_info.password, 0, + cmdline_auth_info.signing_state,NULL); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0,("Cannot connect to server. Error was %s\n", nt_errstr(nt_status))); diff --git a/source3/sam/idmap.c b/source3/sam/idmap.c index 7a8f270e15..4d8b768c2f 100644 --- a/source3/sam/idmap.c +++ b/source3/sam/idmap.c @@ -2,7 +2,7 @@ Unix SMB/CIFS implementation. ID Mapping Copyright (C) Tim Potter 2000 - Copyright (C) Anthony Liguori 2003 + Copyright (C) Jim McDonough 2003 Copyright (C) Simo Sorce 2003 Copyright (C) Jeremy Allison 2003. @@ -153,10 +153,11 @@ NTSTATUS idmap_set_mapping(const DOM_SID *sid, unid_t id, int id_type) struct idmap_methods *map = remote_map; DOM_SID tmp_sid; - DEBUG(10, ("idmap_set_mapping: Set %s to %s %d\n", + DEBUG(10, ("idmap_set_mapping: Set %s to %s %lu\n", sid_string_static(sid), ((id_type & ID_TYPEMASK) == ID_USERID) ? "UID" : "GID", - ((id_type & ID_TYPEMASK) == ID_USERID) ? id.uid : id.gid)); + ((id_type & ID_TYPEMASK) == ID_USERID) ? (unsigned long)id.uid : + (unsigned long)id.gid)); if ( (NT_STATUS_IS_OK(cache_map-> get_sid_from_id(&tmp_sid, id, diff --git a/source3/sam/idmap_tdb.c b/source3/sam/idmap_tdb.c index 7f8dce1f1a..2055103898 100644 --- a/source3/sam/idmap_tdb.c +++ b/source3/sam/idmap_tdb.c @@ -4,7 +4,7 @@ idmap TDB backend Copyright (C) Tim Potter 2000 - Copyright (C) Anthony Liguori 2003 + Copyright (C) Jim McDonough 2003 Copyright (C) Simo Sorce 2003 This program is free software; you can redistribute it and/or modify @@ -116,7 +116,8 @@ static NTSTATUS db_allocate_id(unid_t *id, int id_type) /* check it is in the range */ if (hwm > idmap_state.uid_high) { - DEBUG(0, ("idmap Fatal Error: UID range full!! (max: %u)\n", idmap_state.uid_high)); + DEBUG(0, ("idmap Fatal Error: UID range full!! (max: %lu)\n", + (unsigned long)idmap_state.uid_high)); return NT_STATUS_UNSUCCESSFUL; } @@ -129,7 +130,8 @@ static NTSTATUS db_allocate_id(unid_t *id, int id_type) /* recheck it is in the range */ if (hwm > idmap_state.uid_high) { - DEBUG(0, ("idmap Fatal Error: UID range full!! (max: %u)\n", idmap_state.uid_high)); + DEBUG(0, ("idmap Fatal Error: UID range full!! (max: %lu)\n", + (unsigned long)idmap_state.uid_high)); return NT_STATUS_UNSUCCESSFUL; } @@ -144,7 +146,8 @@ static NTSTATUS db_allocate_id(unid_t *id, int id_type) /* check it is in the range */ if (hwm > idmap_state.gid_high) { - DEBUG(0, ("idmap Fatal Error: GID range full!! (max: %u)\n", idmap_state.gid_high)); + DEBUG(0, ("idmap Fatal Error: GID range full!! (max: %lu)\n", + (unsigned long)idmap_state.gid_high)); return NT_STATUS_UNSUCCESSFUL; } @@ -158,7 +161,8 @@ static NTSTATUS db_allocate_id(unid_t *id, int id_type) /* recheck it is in the range */ if (hwm > idmap_state.gid_high) { - DEBUG(0, ("idmap Fatal Error: GID range full!! (max: %u)\n", idmap_state.gid_high)); + DEBUG(0, ("idmap Fatal Error: GID range full!! (max: %lu)\n", + (unsigned long)idmap_state.gid_high)); return NT_STATUS_UNSUCCESSFUL; } @@ -185,10 +189,10 @@ static NTSTATUS internal_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) switch (id_type & ID_TYPEMASK) { case ID_USERID: - slprintf(keystr, sizeof(keystr), "UID %d", id.uid); + slprintf(keystr, sizeof(keystr), "UID %lu", (unsigned long)id.uid); break; case ID_GROUPID: - slprintf(keystr, sizeof(keystr), "GID %d", id.gid); + slprintf(keystr, sizeof(keystr), "GID %lu", (unsigned long)id.gid); break; default: return NT_STATUS_UNSUCCESSFUL; @@ -374,9 +378,11 @@ static NTSTATUS db_get_id_from_sid(unid_t *id, int *id_type, const DOM_SID *sid) /* Store the UID side */ /* Store new id */ if (*id_type & ID_USERID) { - slprintf(ugid_str, sizeof(ugid_str), "UID %d", (*id).uid); + slprintf(ugid_str, sizeof(ugid_str), "UID %lu", + (unsigned long)((*id).uid)); } else { - slprintf(ugid_str, sizeof(ugid_str), "GID %d", (*id).gid); + slprintf(ugid_str, sizeof(ugid_str), "GID %lu", + (unsigned long)((*id).gid)); } ugid_data.dptr = ugid_str; @@ -430,9 +436,9 @@ static NTSTATUS db_set_mapping(const DOM_SID *sid, unid_t id, int id_type) ksid.dsize = strlen(ksidstr) + 1; if (id_type & ID_USERID) { - slprintf(kidstr, sizeof(kidstr), "UID %d", id.uid); + slprintf(kidstr, sizeof(kidstr), "UID %lu", (unsigned long)id.uid); } else if (id_type & ID_GROUPID) { - slprintf(kidstr, sizeof(kidstr), "GID %d", id.gid); + slprintf(kidstr, sizeof(kidstr), "GID %lu", (unsigned long)id.gid); } else { return NT_STATUS_INVALID_PARAMETER; } diff --git a/source3/sam/idmap_util.c b/source3/sam/idmap_util.c index f767cc898c..f794ea5173 100644 --- a/source3/sam/idmap_util.c +++ b/source3/sam/idmap_util.c @@ -146,7 +146,7 @@ NTSTATUS idmap_uid_to_sid(DOM_SID *sid, uid_t uid) unid_t id; int flags; - DEBUG(10,("idmap_uid_to_sid: uid = [%d]\n", uid)); + DEBUG(10,("idmap_uid_to_sid: uid = [%lu]\n", (unsigned long)uid)); flags = ID_USERID; id.uid = uid; @@ -164,7 +164,7 @@ NTSTATUS idmap_gid_to_sid(DOM_SID *sid, gid_t gid) unid_t id; int flags; - DEBUG(10,("idmap_gid_to_sid: gid = [%d]\n", gid)); + DEBUG(10,("idmap_gid_to_sid: gid = [%lu]\n", (unsigned long)gid)); flags = ID_GROUPID; #if 0 /* JERRY */ @@ -195,7 +195,7 @@ NTSTATUS idmap_sid_to_uid(const DOM_SID *sid, uid_t *uid, uint32 flags) ret = idmap_get_id_from_sid(&id, &flags, sid); if ( NT_STATUS_IS_OK(ret) ) { - DEBUG(10,("idmap_sid_to_uid: uid = [%d]\n", id.uid)); + DEBUG(10,("idmap_sid_to_uid: uid = [%lu]\n", (unsigned long)id.uid)); *uid = id.uid; } @@ -225,7 +225,7 @@ NTSTATUS idmap_sid_to_gid(const DOM_SID *sid, gid_t *gid, uint32 flags) if ( NT_STATUS_IS_OK(ret) ) { - DEBUG(10,("idmap_sid_to_gid: gid = [%d]\n", id.gid)); + DEBUG(10,("idmap_sid_to_gid: gid = [%lu]\n", (unsigned long)id.gid)); *gid = id.gid; } diff --git a/source3/smbd/blocking.c b/source3/smbd/blocking.c index 2802fbb151..fed3a51b88 100644 --- a/source3/smbd/blocking.c +++ b/source3/smbd/blocking.c @@ -28,16 +28,16 @@ extern char *OutBuffer; *****************************************************************************/ typedef struct { - ubi_slNode msg_next; - int com_type; - files_struct *fsp; - time_t expire_time; - int lock_num; - SMB_BIG_UINT offset; - SMB_BIG_UINT count; - uint16 lock_pid; - char *inbuf; - int length; + ubi_slNode msg_next; + int com_type; + files_struct *fsp; + time_t expire_time; + int lock_num; + SMB_BIG_UINT offset; + SMB_BIG_UINT count; + uint16 lock_pid; + char *inbuf; + int length; } blocking_lock_record; static ubi_slList blocking_lock_queue = { NULL, (ubi_slNodePtr)&blocking_lock_queue, 0}; @@ -48,8 +48,8 @@ static ubi_slList blocking_lock_queue = { NULL, (ubi_slNodePtr)&blocking_lock_qu static void free_blocking_lock_record(blocking_lock_record *blr) { - SAFE_FREE(blr->inbuf); - SAFE_FREE(blr); + SAFE_FREE(blr->inbuf); + SAFE_FREE(blr); } /**************************************************************************** @@ -58,17 +58,17 @@ static void free_blocking_lock_record(blocking_lock_record *blr) static files_struct *get_fsp_from_pkt(char *inbuf) { - switch(CVAL(inbuf,smb_com)) { - case SMBlock: - case SMBlockread: - return file_fsp(inbuf,smb_vwv0); - case SMBlockingX: - return file_fsp(inbuf,smb_vwv2); - default: - DEBUG(0,("get_fsp_from_pkt: PANIC - unknown type on blocking lock queue - exiting.!\n")); - exit_server("PANIC - unknown type on blocking lock queue"); - } - return NULL; /* Keep compiler happy. */ + switch(CVAL(inbuf,smb_com)) { + case SMBlock: + case SMBlockread: + return file_fsp(inbuf,smb_vwv0); + case SMBlockingX: + return file_fsp(inbuf,smb_vwv2); + default: + DEBUG(0,("get_fsp_from_pkt: PANIC - unknown type on blocking lock queue - exiting.!\n")); + exit_server("PANIC - unknown type on blocking lock queue"); + } + return NULL; /* Keep compiler happy. */ } /**************************************************************************** @@ -77,7 +77,7 @@ static files_struct *get_fsp_from_pkt(char *inbuf) static BOOL in_chained_smb(void) { - return (chain_size != 0); + return (chain_size != 0); } static void received_unlock_msg(int msg_type, pid_t src, void *buf, size_t len); @@ -89,66 +89,68 @@ static void received_unlock_msg(int msg_type, pid_t src, void *buf, size_t len); BOOL push_blocking_lock_request( char *inbuf, int length, int lock_timeout, int lock_num, uint16 lock_pid, SMB_BIG_UINT offset, SMB_BIG_UINT count) { - static BOOL set_lock_msg; - blocking_lock_record *blr; - NTSTATUS status; - - if(in_chained_smb() ) { - DEBUG(0,("push_blocking_lock_request: cannot queue a chained request (currently).\n")); - return False; - } - - /* - * Now queue an entry on the blocking lock queue. We setup - * the expiration time here. - */ - - if((blr = (blocking_lock_record *)malloc(sizeof(blocking_lock_record))) == NULL) { - DEBUG(0,("push_blocking_lock_request: Malloc fail !\n" )); - return False; - } - - if((blr->inbuf = (char *)malloc(length)) == NULL) { - DEBUG(0,("push_blocking_lock_request: Malloc fail (2)!\n" )); - SAFE_FREE(blr); - return False; - } - - blr->com_type = CVAL(inbuf,smb_com); - blr->fsp = get_fsp_from_pkt(inbuf); - blr->expire_time = (lock_timeout == -1) ? (time_t)-1 : time(NULL) + (time_t)lock_timeout; - blr->lock_num = lock_num; - blr->lock_pid = lock_pid; - blr->offset = offset; - blr->count = count; - memcpy(blr->inbuf, inbuf, length); - blr->length = length; - - /* Add a pending lock record for this. */ - status = brl_lock(blr->fsp->dev, blr->fsp->inode, blr->fsp->fnum, - lock_pid, sys_getpid(), blr->fsp->conn->cnum, - offset, count, - PENDING_LOCK); - - if (!NT_STATUS_IS_OK(status)) { - DEBUG(0,("push_blocking_lock_request: failed to add PENDING_LOCK record.\n")); - free_blocking_lock_record(blr); - return False; - } + static BOOL set_lock_msg; + blocking_lock_record *blr; + NTSTATUS status; + + if(in_chained_smb() ) { + DEBUG(0,("push_blocking_lock_request: cannot queue a chained request (currently).\n")); + return False; + } + + /* + * Now queue an entry on the blocking lock queue. We setup + * the expiration time here. + */ - ubi_slAddTail(&blocking_lock_queue, blr); + if((blr = (blocking_lock_record *)malloc(sizeof(blocking_lock_record))) == NULL) { + DEBUG(0,("push_blocking_lock_request: Malloc fail !\n" )); + return False; + } + + if((blr->inbuf = (char *)malloc(length)) == NULL) { + DEBUG(0,("push_blocking_lock_request: Malloc fail (2)!\n" )); + SAFE_FREE(blr); + return False; + } - /* Ensure we'll receive messages when this is unlocked. */ - if (!set_lock_msg) { - message_register(MSG_SMB_UNLOCK, received_unlock_msg); - set_lock_msg = True; - } + blr->com_type = CVAL(inbuf,smb_com); + blr->fsp = get_fsp_from_pkt(inbuf); + blr->expire_time = (lock_timeout == -1) ? (time_t)-1 : time(NULL) + (time_t)lock_timeout; + blr->lock_num = lock_num; + blr->lock_pid = lock_pid; + blr->offset = offset; + blr->count = count; + memcpy(blr->inbuf, inbuf, length); + blr->length = length; + + /* Add a pending lock record for this. */ + status = brl_lock(blr->fsp->dev, blr->fsp->inode, blr->fsp->fnum, + lock_pid, sys_getpid(), blr->fsp->conn->cnum, + offset, count, PENDING_LOCK); + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("push_blocking_lock_request: failed to add PENDING_LOCK record.\n")); + free_blocking_lock_record(blr); + return False; + } + + ubi_slAddTail(&blocking_lock_queue, blr); + + /* Ensure we'll receive messages when this is unlocked. */ + if (!set_lock_msg) { + message_register(MSG_SMB_UNLOCK, received_unlock_msg); + set_lock_msg = True; + } - DEBUG(3,("push_blocking_lock_request: lock request length=%d blocked with expiry time %d (+%d) \ + DEBUG(3,("push_blocking_lock_request: lock request length=%d blocked with expiry time %d (+%d) \ for fnum = %d, name = %s\n", length, (int)blr->expire_time, lock_timeout, - blr->fsp->fnum, blr->fsp->fsp_name )); + blr->fsp->fnum, blr->fsp->fsp_name )); - return True; + /* Push the MID of this packet on the signing queue. */ + srv_defer_sign_response(SVAL(inbuf,smb_mid)); + + return True; } /**************************************************************************** @@ -170,27 +172,27 @@ static void send_blocking_reply(char *outbuf, int outsize) static void reply_lockingX_success(blocking_lock_record *blr) { - char *outbuf = OutBuffer; - int bufsize = BUFFER_SIZE; - char *inbuf = blr->inbuf; - int outsize = 0; + char *outbuf = OutBuffer; + int bufsize = BUFFER_SIZE; + char *inbuf = blr->inbuf; + int outsize = 0; - construct_reply_common(inbuf, outbuf); - set_message(outbuf,2,0,True); + construct_reply_common(inbuf, outbuf); + set_message(outbuf,2,0,True); - /* - * As this message is a lockingX call we must handle - * any following chained message correctly. - * This is normally handled in construct_reply(), - * but as that calls switch_message, we can't use - * that here and must set up the chain info manually. - */ + /* + * As this message is a lockingX call we must handle + * any following chained message correctly. + * This is normally handled in construct_reply(), + * but as that calls switch_message, we can't use + * that here and must set up the chain info manually. + */ - outsize = chain_reply(inbuf,outbuf,blr->length,bufsize); + outsize = chain_reply(inbuf,outbuf,blr->length,bufsize); - outsize += chain_size; + outsize += chain_size; - send_blocking_reply(outbuf,outsize); + send_blocking_reply(outbuf,outsize); } /**************************************************************************** @@ -492,18 +494,18 @@ Waiting....\n", static BOOL blocking_lock_record_process(blocking_lock_record *blr) { - switch(blr->com_type) { - case SMBlock: - return process_lock(blr); - case SMBlockread: - return process_lockread(blr); - case SMBlockingX: - return process_lockingX(blr); - default: - DEBUG(0,("blocking_lock_record_process: PANIC - unknown type on blocking lock queue - exiting.!\n")); - exit_server("PANIC - unknown type on blocking lock queue"); - } - return False; /* Keep compiler happy. */ + switch(blr->com_type) { + case SMBlock: + return process_lock(blr); + case SMBlockread: + return process_lockread(blr); + case SMBlockingX: + return process_lockingX(blr); + default: + DEBUG(0,("blocking_lock_record_process: PANIC - unknown type on blocking lock queue - exiting.!\n")); + exit_server("PANIC - unknown type on blocking lock queue"); + } + return False; /* Keep compiler happy. */ } /**************************************************************************** @@ -512,27 +514,27 @@ static BOOL blocking_lock_record_process(blocking_lock_record *blr) void remove_pending_lock_requests_by_fid(files_struct *fsp) { - blocking_lock_record *blr = (blocking_lock_record *)ubi_slFirst( &blocking_lock_queue ); - blocking_lock_record *prev = NULL; + blocking_lock_record *blr = (blocking_lock_record *)ubi_slFirst( &blocking_lock_queue ); + blocking_lock_record *prev = NULL; - while(blr != NULL) { - if(blr->fsp->fnum == fsp->fnum) { + while(blr != NULL) { + if(blr->fsp->fnum == fsp->fnum) { - DEBUG(10,("remove_pending_lock_requests_by_fid - removing request type %d for \ + DEBUG(10,("remove_pending_lock_requests_by_fid - removing request type %d for \ file %s fnum = %d\n", blr->com_type, fsp->fsp_name, fsp->fnum )); - brl_unlock(blr->fsp->dev, blr->fsp->inode, blr->fsp->fnum, - blr->lock_pid, sys_getpid(), blr->fsp->conn->cnum, - blr->offset, blr->count, True, NULL, NULL); + brl_unlock(blr->fsp->dev, blr->fsp->inode, blr->fsp->fnum, + blr->lock_pid, sys_getpid(), blr->fsp->conn->cnum, + blr->offset, blr->count, True, NULL, NULL); - free_blocking_lock_record((blocking_lock_record *)ubi_slRemNext( &blocking_lock_queue, prev)); - blr = (blocking_lock_record *)(prev ? ubi_slNext(prev) : ubi_slFirst(&blocking_lock_queue)); - continue; - } + free_blocking_lock_record((blocking_lock_record *)ubi_slRemNext( &blocking_lock_queue, prev)); + blr = (blocking_lock_record *)(prev ? ubi_slNext(prev) : ubi_slFirst(&blocking_lock_queue)); + continue; + } - prev = blr; - blr = (blocking_lock_record *)ubi_slNext(blr); - } + prev = blr; + blr = (blocking_lock_record *)ubi_slNext(blr); + } } /**************************************************************************** @@ -541,28 +543,28 @@ file %s fnum = %d\n", blr->com_type, fsp->fsp_name, fsp->fnum )); void remove_pending_lock_requests_by_mid(int mid) { - blocking_lock_record *blr = (blocking_lock_record *)ubi_slFirst( &blocking_lock_queue ); - blocking_lock_record *prev = NULL; + blocking_lock_record *blr = (blocking_lock_record *)ubi_slFirst( &blocking_lock_queue ); + blocking_lock_record *prev = NULL; - while(blr != NULL) { - if(SVAL(blr->inbuf,smb_mid) == mid) { - files_struct *fsp = blr->fsp; + while(blr != NULL) { + if(SVAL(blr->inbuf,smb_mid) == mid) { + files_struct *fsp = blr->fsp; - DEBUG(10,("remove_pending_lock_requests_by_mid - removing request type %d for \ + DEBUG(10,("remove_pending_lock_requests_by_mid - removing request type %d for \ file %s fnum = %d\n", blr->com_type, fsp->fsp_name, fsp->fnum )); - blocking_lock_reply_error(blr,NT_STATUS_CANCELLED); - brl_unlock(blr->fsp->dev, blr->fsp->inode, blr->fsp->fnum, - blr->lock_pid, sys_getpid(), blr->fsp->conn->cnum, - blr->offset, blr->count, True, NULL, NULL); - free_blocking_lock_record((blocking_lock_record *)ubi_slRemNext( &blocking_lock_queue, prev)); - blr = (blocking_lock_record *)(prev ? ubi_slNext(prev) : ubi_slFirst(&blocking_lock_queue)); - continue; - } - - prev = blr; - blr = (blocking_lock_record *)ubi_slNext(blr); - } + blocking_lock_reply_error(blr,NT_STATUS_CANCELLED); + brl_unlock(blr->fsp->dev, blr->fsp->inode, blr->fsp->fnum, + blr->lock_pid, sys_getpid(), blr->fsp->conn->cnum, + blr->offset, blr->count, True, NULL, NULL); + free_blocking_lock_record((blocking_lock_record *)ubi_slRemNext( &blocking_lock_queue, prev)); + blr = (blocking_lock_record *)(prev ? ubi_slNext(prev) : ubi_slFirst(&blocking_lock_queue)); + continue; + } + + prev = blr; + blr = (blocking_lock_record *)ubi_slNext(blr); + } } /**************************************************************************** @@ -611,112 +613,112 @@ unsigned blocking_locks_timeout(unsigned default_timeout) void process_blocking_lock_queue(time_t t) { - blocking_lock_record *blr = (blocking_lock_record *)ubi_slFirst( &blocking_lock_queue ); - blocking_lock_record *prev = NULL; - - if(blr == NULL) - return; - - /* - * Go through the queue and see if we can get any of the locks. - */ - - while(blr != NULL) { - connection_struct *conn = NULL; - uint16 vuid; - files_struct *fsp = NULL; - - /* - * Ensure we don't have any old chain_fsp values - * sitting around.... - */ - chain_size = 0; - file_chain_reset(); - fsp = blr->fsp; - - conn = conn_find(SVAL(blr->inbuf,smb_tid)); - vuid = (lp_security() == SEC_SHARE) ? UID_FIELD_INVALID : - SVAL(blr->inbuf,smb_uid); - - DEBUG(5,("process_blocking_lock_queue: examining pending lock fnum = %d for file %s\n", - fsp->fnum, fsp->fsp_name )); - - if((blr->expire_time != -1) && (blr->expire_time <= t)) { - /* - * Lock expired - throw away all previously - * obtained locks and return lock error. - */ - DEBUG(5,("process_blocking_lock_queue: pending lock fnum = %d for file %s timed out.\n", - fsp->fnum, fsp->fsp_name )); - - brl_unlock(fsp->dev, fsp->inode, fsp->fnum, - blr->lock_pid, sys_getpid(), conn->cnum, - blr->offset, blr->count, True, NULL, NULL); - - blocking_lock_reply_error(blr,NT_STATUS_FILE_LOCK_CONFLICT); - free_blocking_lock_record((blocking_lock_record *)ubi_slRemNext( &blocking_lock_queue, prev)); - blr = (blocking_lock_record *)(prev ? ubi_slNext(prev) : ubi_slFirst(&blocking_lock_queue)); - continue; - } - - if(!change_to_user(conn,vuid)) { - DEBUG(0,("process_blocking_lock_queue: Unable to become user vuid=%d.\n", - vuid )); - /* - * Remove the entry and return an error to the client. - */ - blocking_lock_reply_error(blr,NT_STATUS_ACCESS_DENIED); - - brl_unlock(fsp->dev, fsp->inode, fsp->fnum, - blr->lock_pid, sys_getpid(), conn->cnum, - blr->offset, blr->count, True, NULL, NULL); - - free_blocking_lock_record((blocking_lock_record *)ubi_slRemNext( &blocking_lock_queue, prev)); - blr = (blocking_lock_record *)(prev ? ubi_slNext(prev) : ubi_slFirst(&blocking_lock_queue)); - continue; - } - - if(!set_current_service(conn,True)) { - DEBUG(0,("process_blocking_lock_queue: Unable to become service Error was %s.\n", strerror(errno) )); - /* - * Remove the entry and return an error to the client. - */ - blocking_lock_reply_error(blr,NT_STATUS_ACCESS_DENIED); - - brl_unlock(fsp->dev, fsp->inode, fsp->fnum, - blr->lock_pid, sys_getpid(), conn->cnum, - blr->offset, blr->count, True, NULL, NULL); - - free_blocking_lock_record((blocking_lock_record *)ubi_slRemNext( &blocking_lock_queue, prev)); - blr = (blocking_lock_record *)(prev ? ubi_slNext(prev) : ubi_slFirst(&blocking_lock_queue)); - change_to_root_user(); - continue; - } - - /* - * Go through the remaining locks and try and obtain them. - * The call returns True if all locks were obtained successfully - * and False if we still need to wait. - */ - - if(blocking_lock_record_process(blr)) { - - brl_unlock(fsp->dev, fsp->inode, fsp->fnum, - blr->lock_pid, sys_getpid(), conn->cnum, - blr->offset, blr->count, True, NULL, NULL); - - free_blocking_lock_record((blocking_lock_record *)ubi_slRemNext( &blocking_lock_queue, prev)); - blr = (blocking_lock_record *)(prev ? ubi_slNext(prev) : ubi_slFirst(&blocking_lock_queue)); - change_to_root_user(); - continue; - } - - change_to_root_user(); - - /* - * Move to the next in the list. - */ - prev = blr; - blr = (blocking_lock_record *)ubi_slNext(blr); - } + blocking_lock_record *blr = (blocking_lock_record *)ubi_slFirst( &blocking_lock_queue ); + blocking_lock_record *prev = NULL; + + if(blr == NULL) + return; + + /* + * Go through the queue and see if we can get any of the locks. + */ + + while(blr != NULL) { + connection_struct *conn = NULL; + uint16 vuid; + files_struct *fsp = NULL; + + /* + * Ensure we don't have any old chain_fsp values + * sitting around.... + */ + chain_size = 0; + file_chain_reset(); + fsp = blr->fsp; + + conn = conn_find(SVAL(blr->inbuf,smb_tid)); + vuid = (lp_security() == SEC_SHARE) ? UID_FIELD_INVALID : + SVAL(blr->inbuf,smb_uid); + + DEBUG(5,("process_blocking_lock_queue: examining pending lock fnum = %d for file %s\n", + fsp->fnum, fsp->fsp_name )); + + if((blr->expire_time != -1) && (blr->expire_time <= t)) { + /* + * Lock expired - throw away all previously + * obtained locks and return lock error. + */ + DEBUG(5,("process_blocking_lock_queue: pending lock fnum = %d for file %s timed out.\n", + fsp->fnum, fsp->fsp_name )); + + brl_unlock(fsp->dev, fsp->inode, fsp->fnum, + blr->lock_pid, sys_getpid(), conn->cnum, + blr->offset, blr->count, True, NULL, NULL); + + blocking_lock_reply_error(blr,NT_STATUS_FILE_LOCK_CONFLICT); + free_blocking_lock_record((blocking_lock_record *)ubi_slRemNext( &blocking_lock_queue, prev)); + blr = (blocking_lock_record *)(prev ? ubi_slNext(prev) : ubi_slFirst(&blocking_lock_queue)); + continue; + } + + if(!change_to_user(conn,vuid)) { + DEBUG(0,("process_blocking_lock_queue: Unable to become user vuid=%d.\n", + vuid )); + /* + * Remove the entry and return an error to the client. + */ + blocking_lock_reply_error(blr,NT_STATUS_ACCESS_DENIED); + + brl_unlock(fsp->dev, fsp->inode, fsp->fnum, + blr->lock_pid, sys_getpid(), conn->cnum, + blr->offset, blr->count, True, NULL, NULL); + + free_blocking_lock_record((blocking_lock_record *)ubi_slRemNext( &blocking_lock_queue, prev)); + blr = (blocking_lock_record *)(prev ? ubi_slNext(prev) : ubi_slFirst(&blocking_lock_queue)); + continue; + } + + if(!set_current_service(conn,True)) { + DEBUG(0,("process_blocking_lock_queue: Unable to become service Error was %s.\n", strerror(errno) )); + /* + * Remove the entry and return an error to the client. + */ + blocking_lock_reply_error(blr,NT_STATUS_ACCESS_DENIED); + + brl_unlock(fsp->dev, fsp->inode, fsp->fnum, + blr->lock_pid, sys_getpid(), conn->cnum, + blr->offset, blr->count, True, NULL, NULL); + + free_blocking_lock_record((blocking_lock_record *)ubi_slRemNext( &blocking_lock_queue, prev)); + blr = (blocking_lock_record *)(prev ? ubi_slNext(prev) : ubi_slFirst(&blocking_lock_queue)); + change_to_root_user(); + continue; + } + + /* + * Go through the remaining locks and try and obtain them. + * The call returns True if all locks were obtained successfully + * and False if we still need to wait. + */ + + if(blocking_lock_record_process(blr)) { + + brl_unlock(fsp->dev, fsp->inode, fsp->fnum, + blr->lock_pid, sys_getpid(), conn->cnum, + blr->offset, blr->count, True, NULL, NULL); + + free_blocking_lock_record((blocking_lock_record *)ubi_slRemNext( &blocking_lock_queue, prev)); + blr = (blocking_lock_record *)(prev ? ubi_slNext(prev) : ubi_slFirst(&blocking_lock_queue)); + change_to_root_user(); + continue; + } + + change_to_root_user(); + + /* + * Move to the next in the list. + */ + prev = blr; + blr = (blocking_lock_record *)ubi_slNext(blr); + } } diff --git a/source3/smbd/change_trust_pw.c b/source3/smbd/change_trust_pw.c index 4993e285ca..2eff77b1f7 100644 --- a/source3/smbd/change_trust_pw.c +++ b/source3/smbd/change_trust_pw.c @@ -58,7 +58,7 @@ NTSTATUS change_trust_account_password( const char *domain, const char *remote_m NULL, 0, "IPC$", "IPC", "", "", - "", 0, NULL))) + "", 0, Undefined, NULL))) { DEBUG(0,("modify_trust_password: Connection to %s failed!\n", remote_machine)); nt_status = NT_STATUS_UNSUCCESSFUL; diff --git a/source3/smbd/chgpasswd.c b/source3/smbd/chgpasswd.c index 5c1d9a79a6..6bc8626d81 100644 --- a/source3/smbd/chgpasswd.c +++ b/source3/smbd/chgpasswd.c @@ -674,6 +674,8 @@ BOOL check_lanman_password(char *user, uchar * pass1, Code to change the lanman hashed password. It nulls out the NT hashed password as it will no longer be valid. + NOTE this function is designed to be called as root. Check the old password + is correct before calling. JRA. ************************************************************/ BOOL change_lanman_password(SAM_ACCOUNT *sampass, uchar *pass2) @@ -730,9 +732,7 @@ BOOL change_lanman_password(SAM_ACCOUNT *sampass, uchar *pass2) } /* Now flush the sam_passwd struct to persistent storage */ - become_root(); ret = pdb_update_sam_account (sampass); - unbecome_root(); return ret; } @@ -740,6 +740,7 @@ BOOL change_lanman_password(SAM_ACCOUNT *sampass, uchar *pass2) /*********************************************************** Code to check and change the OEM hashed password. ************************************************************/ + NTSTATUS pass_oem_change(char *user, uchar * lmdata, uchar * lmhash, uchar * ntdata, uchar * nthash) @@ -747,8 +748,7 @@ NTSTATUS pass_oem_change(char *user, fstring new_passwd; const char *unix_user; SAM_ACCOUNT *sampass = NULL; - NTSTATUS nt_status - = check_oem_password(user, lmdata, lmhash, ntdata, nthash, + NTSTATUS nt_status = check_oem_password(user, lmdata, lmhash, ntdata, nthash, &sampass, new_passwd, sizeof(new_passwd)); if (!NT_STATUS_IS_OK(nt_status)) @@ -765,7 +765,10 @@ NTSTATUS pass_oem_change(char *user, unix_user = pdb_get_username(sampass); + /* We've already checked the old password here.... */ + become_root(); nt_status = change_oem_password(sampass, NULL, new_passwd); + unbecome_root(); memset(new_passwd, 0, sizeof(new_passwd)); @@ -942,6 +945,8 @@ static NTSTATUS check_oem_password(const char *user, /*********************************************************** Code to change the oem password. Changes both the lanman and NT hashes. Old_passwd is almost always NULL. + NOTE this function is designed to be called as root. Check the old password + is correct before calling. JRA. ************************************************************/ NTSTATUS change_oem_password(SAM_ACCOUNT *hnd, char *old_passwd, char *new_passwd) @@ -997,9 +1002,7 @@ NTSTATUS change_oem_password(SAM_ACCOUNT *hnd, char *old_passwd, char *new_passw } /* Now write it into the file. */ - become_root(); ret = pdb_update_sam_account (hnd); - unbecome_root(); if (!ret) { return NT_STATUS_ACCESS_DENIED; diff --git a/source3/smbd/close.c b/source3/smbd/close.c index 1be13270ba..0700aeaa0a 100644 --- a/source3/smbd/close.c +++ b/source3/smbd/close.c @@ -163,8 +163,8 @@ static int close_normal_file(files_struct *fsp, BOOL normal_close) share_entry_count = del_share_mode(fsp, &share_entry); - DEBUG(10,("close_normal_file: share_entry_count = %d for file %s\n", - share_entry_count, fsp->fsp_name )); + DEBUG(10,("close_normal_file: share_entry_count = %lu for file %s\n", + (unsigned long)share_entry_count, fsp->fsp_name )); /* * We delete on close if it's the last open, and the diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c index 85e28f5d17..39072f9b91 100644 --- a/source3/smbd/ipc.c +++ b/source3/smbd/ipc.c @@ -428,6 +428,8 @@ int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int } + srv_signing_trans_start(SVAL(inbuf,smb_mid)); + if (pscnt < tpscnt || dscnt < tdscnt) { /* We need to send an interim response then receive the rest of the parameter/data bytes */ @@ -455,6 +457,7 @@ int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int SAFE_FREE(data); SAFE_FREE(setup); END_PROFILE(SMBtrans); + srv_signing_trans_stop(); return(ERROR_DOS(ERRSRV,ERRerror)); } @@ -506,11 +509,10 @@ int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int memcpy(data+ddisp,smb_base(inbuf)+doff,dcnt); } } - - + DEBUG(3,("trans <%s> data=%u params=%u setup=%u\n", name,tdscnt,tpscnt,suwcnt)); - + /* * WinCE wierdness.... */ @@ -542,6 +544,8 @@ int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int SAFE_FREE(params); SAFE_FREE(setup); + srv_signing_trans_stop(); + if (close_on_completion) close_cnum(conn,vuid); @@ -561,6 +565,7 @@ int reply_trans(connection_struct *conn, char *inbuf,char *outbuf, int size, int bad_param: + srv_signing_trans_stop(); DEBUG(0,("reply_trans: invalid trans parameters\n")); SAFE_FREE(data); SAFE_FREE(params); diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c index 04d6a9a8a8..a5f7a7b2ea 100644 --- a/source3/smbd/lanman.c +++ b/source3/smbd/lanman.c @@ -1897,76 +1897,78 @@ static BOOL api_SetUserPassword(connection_struct *conn,uint16 vuid, char *param char **rdata,char **rparam, int *rdata_len,int *rparam_len) { - char *p = skip_string(param+2,2); - fstring user; - fstring pass1,pass2; + char *p = skip_string(param+2,2); + fstring user; + fstring pass1,pass2; - pull_ascii_fstring(user,p); + pull_ascii_fstring(user,p); - p = skip_string(p,1); + p = skip_string(p,1); - memset(pass1,'\0',sizeof(pass1)); - memset(pass2,'\0',sizeof(pass2)); - memcpy(pass1,p,16); - memcpy(pass2,p+16,16); + memset(pass1,'\0',sizeof(pass1)); + memset(pass2,'\0',sizeof(pass2)); + memcpy(pass1,p,16); + memcpy(pass2,p+16,16); - *rparam_len = 4; - *rparam = REALLOC(*rparam,*rparam_len); + *rparam_len = 4; + *rparam = REALLOC(*rparam,*rparam_len); - *rdata_len = 0; + *rdata_len = 0; - SSVAL(*rparam,0,NERR_badpass); - SSVAL(*rparam,2,0); /* converter word */ + SSVAL(*rparam,0,NERR_badpass); + SSVAL(*rparam,2,0); /* converter word */ - DEBUG(3,("Set password for <%s>\n",user)); + DEBUG(3,("Set password for <%s>\n",user)); - /* - * Attempt to verify the old password against smbpasswd entries - * Win98 clients send old and new password in plaintext for this call. - */ + /* + * Attempt to verify the old password against smbpasswd entries + * Win98 clients send old and new password in plaintext for this call. + */ - { - auth_serversupplied_info *server_info = NULL; - DATA_BLOB password = data_blob(pass1, strlen(pass1)+1); - if (NT_STATUS_IS_OK(check_plaintext_password(user,password,&server_info))) { - - if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2))) - { - SSVAL(*rparam,0,NERR_Success); - } - - free_server_info(&server_info); - } - data_blob_clear_free(&password); - } + { + auth_serversupplied_info *server_info = NULL; + DATA_BLOB password = data_blob(pass1, strlen(pass1)+1); - /* - * If the plaintext change failed, attempt - * the old encrypted method. NT will generate this - * after trying the samr method. Note that this - * method is done as a last resort as this - * password change method loses the NT password hash - * and cannot change the UNIX password as no plaintext - * is received. - */ + if (NT_STATUS_IS_OK(check_plaintext_password(user,password,&server_info))) { - if(SVAL(*rparam,0) != NERR_Success) - { - SAM_ACCOUNT *hnd = NULL; + become_root(); + if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2))) { + SSVAL(*rparam,0,NERR_Success); + } + unbecome_root(); - if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd) && - change_lanman_password(hnd,pass2)) - { - SSVAL(*rparam,0,NERR_Success); - } - pdb_free_sam(&hnd); - } + free_server_info(&server_info); + } + data_blob_clear_free(&password); + } + /* + * If the plaintext change failed, attempt + * the old encrypted method. NT will generate this + * after trying the samr method. Note that this + * method is done as a last resort as this + * password change method loses the NT password hash + * and cannot change the UNIX password as no plaintext + * is received. + */ + + if(SVAL(*rparam,0) != NERR_Success) { + SAM_ACCOUNT *hnd = NULL; - memset((char *)pass1,'\0',sizeof(fstring)); - memset((char *)pass2,'\0',sizeof(fstring)); + if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd)) { + become_root(); + if (change_lanman_password(hnd,pass2)) { + SSVAL(*rparam,0,NERR_Success); + } + unbecome_root(); + pdb_free_sam(&hnd); + } + } + + memset((char *)pass1,'\0',sizeof(fstring)); + memset((char *)pass2,'\0',sizeof(fstring)); - return(True); + return(True); } /**************************************************************************** diff --git a/source3/smbd/mangle_hash.c b/source3/smbd/mangle_hash.c index ac8e425fd3..ac2d7681e8 100644 --- a/source3/smbd/mangle_hash.c +++ b/source3/smbd/mangle_hash.c @@ -313,6 +313,7 @@ static BOOL is_8_3(const char *fname, BOOL check_case, BOOL allow_wildcards) const char *f; smb_ucs2_t *ucs2name; NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; + size_t size; if (!fname || !*fname) return False; @@ -324,9 +325,9 @@ static BOOL is_8_3(const char *fname, BOOL check_case, BOOL allow_wildcards) if (strlen(f) > 12) return False; - ucs2name = acnv_uxu2(f); - if (!ucs2name) { - DEBUG(0,("is_8_3: internal error acnv_uxu2() failed!\n")); + size = push_ucs2_allocate(&ucs2name, f); + if (size == (size_t)-1) { + DEBUG(0,("is_8_3: internal error push_ucs2_allocate() failed!\n")); goto done; } diff --git a/source3/smbd/negprot.c b/source3/smbd/negprot.c index f452dd845b..28e3cf97d1 100644 --- a/source3/smbd/negprot.c +++ b/source3/smbd/negprot.c @@ -277,6 +277,22 @@ static int reply_nt1(char *inbuf, char *outbuf) if (global_encrypted_passwords_negotiated) secword |= NEGOTIATE_SECURITY_CHALLENGE_RESPONSE; + if (lp_server_signing()) { + if (lp_security() >= SEC_USER) { + secword |= NEGOTIATE_SECURITY_SIGNATURES_ENABLED; + /* No raw mode with smb signing. */ + capabilities &= ~CAP_RAW_MODE; + if (lp_server_signing() == Required) + secword |=NEGOTIATE_SECURITY_SIGNATURES_REQUIRED; + srv_set_signing_negotiated(); + } else { + DEBUG(0,("reply_nt1: smb signing is incompatible with share level security !\n")); + if (lp_server_signing() == Required) { + exit_server("reply_nt1: smb signing required and share level security selected."); + } + } + } + set_message(outbuf,17,0,True); SCVAL(outbuf,smb_vwv1,secword); @@ -521,6 +537,10 @@ int reply_negprot(connection_struct *conn, DEBUG( 5, ( "negprot index=%d\n", choice ) ); + if ((lp_server_signing() == Required) && (Protocol < PROTOCOL_NT1)) { + exit_server("SMB signing is required and client negotiated a downlevel protocol"); + } + END_PROFILE(SMBnegprot); return(outsize); } diff --git a/source3/smbd/notify.c b/source3/smbd/notify.c index de1b331778..9adf827c79 100644 --- a/source3/smbd/notify.c +++ b/source3/smbd/notify.c @@ -44,6 +44,7 @@ static struct change_notify *change_notify_list; /**************************************************************************** Setup the common parts of the return packet and send it. *****************************************************************************/ + static void change_notify_reply_packet(char *inbuf, NTSTATUS error_code) { char outbuf[smb_size+38]; @@ -178,7 +179,7 @@ BOOL change_notify_set(char *inbuf, files_struct *fsp, connection_struct *conn, struct change_notify *cnbp; if((cnbp = (struct change_notify *)malloc(sizeof(*cnbp))) == NULL) { - DEBUG(0,("call_nt_transact_notify_change: malloc fail !\n" )); + DEBUG(0,("change_notify_set: malloc fail !\n" )); return -1; } @@ -197,6 +198,9 @@ BOOL change_notify_set(char *inbuf, files_struct *fsp, connection_struct *conn, DLIST_ADD(change_notify_list, cnbp); + /* Push the MID of this packet on the signing queue. */ + srv_defer_sign_response(SVAL(inbuf,smb_mid)); + return True; } diff --git a/source3/smbd/ntquotas.c b/source3/smbd/ntquotas.c index 2e865000ec..88d7c4e164 100644 --- a/source3/smbd/ntquotas.c +++ b/source3/smbd/ntquotas.c @@ -188,7 +188,7 @@ int vfs_get_user_ntquota_list(files_struct *fsp, SMB_NTQUOTA_LIST **qt_list) } if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &tmp_qt)!=0) { - DEBUG(1,("no quota entry for sid[%s] path[%s]\n", + DEBUG(5,("no quota entry for sid[%s] path[%s]\n", sid_string_static(&sid),fsp->conn->connectpath)); continue; } diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c index c574d9d563..3ffa6efa77 100644 --- a/source3/smbd/nttrans.c +++ b/source3/smbd/nttrans.c @@ -1443,6 +1443,7 @@ int reply_ntcancel(connection_struct *conn, START_PROFILE(SMBntcancel); remove_pending_change_notify_requests_by_mid(mid); remove_pending_lock_requests_by_mid(mid); + srv_cancel_sign_response(mid); DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid)); @@ -2321,6 +2322,8 @@ due to being in oplock break state.\n", (unsigned int)function_code )); dump_data(10, data, data_count); } + srv_signing_trans_start(SVAL(inbuf,smb_mid)); + if(num_data_sofar < total_data_count || num_params_sofar < total_parameter_count) { /* We need to send an interim response then receive the rest of the parameter/data bytes */ @@ -2484,6 +2487,7 @@ due to being in oplock break state.\n", (unsigned int)function_code )); SAFE_FREE(params); SAFE_FREE(data); END_PROFILE(SMBnttrans); + srv_signing_trans_stop(); return ERROR_DOS(ERRSRV,ERRerror); } @@ -2494,6 +2498,8 @@ due to being in oplock break state.\n", (unsigned int)function_code )); an error packet. */ + srv_signing_trans_stop(); + SAFE_FREE(setup); SAFE_FREE(params); SAFE_FREE(data); @@ -2504,6 +2510,7 @@ due to being in oplock break state.\n", (unsigned int)function_code )); bad_param: + srv_signing_trans_stop(); SAFE_FREE(params); SAFE_FREE(data); SAFE_FREE(setup); diff --git a/source3/smbd/open.c b/source3/smbd/open.c index 6d03eaa29a..5f49640aa4 100644 --- a/source3/smbd/open.c +++ b/source3/smbd/open.c @@ -125,6 +125,7 @@ static BOOL open_file(files_struct *fsp,connection_struct *conn, directory. */ flags &= ~O_CREAT; + local_flags &= ~O_CREAT; } } @@ -166,6 +167,14 @@ static BOOL open_file(files_struct *fsp,connection_struct *conn, local_flags |= O_NONBLOCK; #endif + /* Don't create files with Microsoft wildcard characters. */ + if ((local_flags & O_CREAT) && !VALID_STAT(*psbuf) && ms_has_wild(fname)) { + unix_ERR_class = ERRDOS; + unix_ERR_code = ERRinvalidname; + unix_ERR_ntstatus = NT_STATUS_OBJECT_NAME_INVALID; + return False; + } + /* Actually do the open */ fsp->fd = fd_open(conn, fname, local_flags, mode); if (fsp->fd == -1) { @@ -675,8 +684,8 @@ dev = %x, inode = %.0f\n", old_shares[i].op_type, fname, (unsigned int)dev, (dou dev = %x, inode = %.0f. Deleting it to continue...\n", (int)broken_entry.pid, fname, (unsigned int)dev, (double)inode)); if (process_exists(broken_entry.pid)) { - DEBUG(0,("open_mode_check: Existent process %d left active oplock.\n", - broken_entry.pid )); + DEBUG(0,("open_mode_check: Existent process %lu left active oplock.\n", + (unsigned long)broken_entry.pid )); } if (del_share_entry(dev, inode, &broken_entry, NULL) == -1) { @@ -874,7 +883,7 @@ files_struct *open_file_shared1(connection_struct *conn,char *fname, SMB_STRUCT_ if (file_existed && (GET_FILE_OPEN_DISPOSITION(ofun) == FILE_EXISTS_TRUNCATE)) { if (!open_match_attributes(conn, fname, psbuf->st_mode, mode, &new_mode)) { DEBUG(5,("open_file_shared: attributes missmatch for file %s (0%o, 0%o)\n", - fname, psbuf->st_mode, mode )); + fname, (int)psbuf->st_mode, (int)mode )); file_free(fsp); errno = EACCES; return NULL; @@ -1290,6 +1299,15 @@ files_struct *open_directory(connection_struct *conn, char *fname, SMB_STRUCT_ST return NULL; } + if (ms_has_wild(fname)) { + file_free(fsp); + DEBUG(5,("open_directory: failing create on filename %s with wildcards\n", fname)); + unix_ERR_class = ERRDOS; + unix_ERR_code = ERRinvalidname; + unix_ERR_ntstatus = NT_STATUS_OBJECT_NAME_INVALID; + return NULL; + } + if(vfs_MkDir(conn,fname, unix_mode(conn,aDIR, fname)) < 0) { DEBUG(2,("open_directory: unable to create %s. Error was %s\n", fname, strerror(errno) )); diff --git a/source3/smbd/oplock.c b/source3/smbd/oplock.c index 8525687793..19e6956d9e 100644 --- a/source3/smbd/oplock.c +++ b/source3/smbd/oplock.c @@ -660,6 +660,7 @@ static BOOL oplock_break(SMB_DEV_T dev, SMB_INO_T inode, unsigned long file_id, time_t start_time; BOOL shutdown_server = False; BOOL oplock_timeout = False; + BOOL sign_state; connection_struct *saved_user_conn; connection_struct *saved_fsp_conn; int saved_vuid; @@ -742,8 +743,16 @@ static BOOL oplock_break(SMB_DEV_T dev, SMB_INO_T inode, unsigned long file_id, /* Remember if we just sent a break to level II on this file. */ fsp->sent_oplock_break = using_levelII? LEVEL_II_BREAK_SENT:EXCLUSIVE_BREAK_SENT; - if (!send_smb(smbd_server_fd(), outbuf)) + /* Save the server smb signing state. */ + sign_state = srv_oplock_set_signing(False); + + if (!send_smb(smbd_server_fd(), outbuf)) { + srv_oplock_set_signing(sign_state); exit_server("oplock_break: send_smb failed."); + } + + /* Restore the sign state to what it was. */ + srv_oplock_set_signing(sign_state); /* We need this in case a readraw crosses on the wire. */ global_oplock_break = True; @@ -791,6 +800,9 @@ static BOOL oplock_break(SMB_DEV_T dev, SMB_INO_T inode, unsigned long file_id, } else if (smb_read_error == READ_ERROR) { DEBUG( 0, ("oplock_break: receive_smb error (%s)\n", strerror(errno)) ); shutdown_server = True; + } else if (smb_read_error == READ_BAD_SIG) { + DEBUG( 0, ("oplock_break: bad signature from client\n" )); + shutdown_server = True; } else if (smb_read_error == READ_TIMEOUT) { DEBUG( 0, ( "oplock_break: receive_smb timed out after %d seconds.\n", OPLOCK_BREAK_TIMEOUT ) ); oplock_timeout = True; diff --git a/source3/smbd/password.c b/source3/smbd/password.c index e2c143f1e2..b988f2ec74 100644 --- a/source3/smbd/password.c +++ b/source3/smbd/password.c @@ -29,10 +29,11 @@ static int next_vuid = VUID_OFFSET; static int num_validated_vuids; /**************************************************************************** -check if a uid has been validated, and return an pointer to the user_struct -if it has. NULL if not. vuid is biased by an offset. This allows us to -tell random client vuid's (normally zero) from valid vuids. + Check if a uid has been validated, and return an pointer to the user_struct + if it has. NULL if not. vuid is biased by an offset. This allows us to + tell random client vuid's (normally zero) from valid vuids. ****************************************************************************/ + user_struct *get_valid_user_struct(uint16 vuid) { user_struct *usp; @@ -54,8 +55,9 @@ user_struct *get_valid_user_struct(uint16 vuid) } /**************************************************************************** -invalidate a uid + Invalidate a uid. ****************************************************************************/ + void invalidate_vuid(uint16 vuid) { user_struct *vuser = get_valid_user_struct(vuid); @@ -85,8 +87,9 @@ void invalidate_vuid(uint16 vuid) } /**************************************************************************** -invalidate all vuid entries for this process + Invalidate all vuid entries for this process. ****************************************************************************/ + void invalidate_all_vuids(void) { user_struct *usp, *next=NULL; @@ -108,7 +111,7 @@ void invalidate_all_vuids(void) * */ -int register_vuid(auth_serversupplied_info *server_info, const char *smb_name) +int register_vuid(auth_serversupplied_info *server_info, DATA_BLOB response_blob, const char *smb_name) { user_struct *vuser = NULL; @@ -238,38 +241,42 @@ int register_vuid(auth_serversupplied_info *server_info, const char *smb_name) vuser->homes_snum = -1; } + if (lp_server_signing() && !vuser->guest && !srv_is_signing_active()) { + /* Try and turn on server signing on the first non-guest sessionsetup. */ + srv_set_signing(vuser->session_key, response_blob); + } + return vuser->vuid; } - /**************************************************************************** -add a name to the session users list + Add a name to the session users list. ****************************************************************************/ + void add_session_user(const char *user) { - fstring suser; - struct passwd *passwd; + fstring suser; + struct passwd *passwd; - if (!(passwd = Get_Pwnam(user))) return; + if (!(passwd = Get_Pwnam(user))) + return; - fstrcpy(suser,passwd->pw_name); + fstrcpy(suser,passwd->pw_name); - if (suser && *suser && !in_list(suser,session_users,False)) - { - if (strlen(suser) + strlen(session_users) + 2 >= sizeof(pstring)) - DEBUG(1,("Too many session users??\n")); - else - { - pstrcat(session_users," "); - pstrcat(session_users,suser); + if (suser && *suser && !in_list(suser,session_users,False)) { + if (strlen(suser) + strlen(session_users) + 2 >= sizeof(pstring)) { + DEBUG(1,("Too many session users??\n")); + } else { + pstrcat(session_users," "); + pstrcat(session_users,suser); + } } - } } - /**************************************************************************** -check if a username is valid + Check if a username is valid. ****************************************************************************/ + BOOL user_ok(const char *user,int snum, gid_t *groups, size_t n_groups) { char **valid, **invalid; @@ -308,8 +315,9 @@ BOOL user_ok(const char *user,int snum, gid_t *groups, size_t n_groups) } /**************************************************************************** -validate a group username entry. Return the username or NULL + Validate a group username entry. Return the username or NULL. ****************************************************************************/ + static char *validate_group(char *group, DATA_BLOB password,int snum) { #ifdef HAVE_NETGROUP diff --git a/source3/smbd/process.c b/source3/smbd/process.c index 18acb35f7a..dce1c4bc03 100644 --- a/source3/smbd/process.c +++ b/source3/smbd/process.c @@ -53,9 +53,9 @@ extern int max_send; ****************************************************************************/ typedef struct { - ubi_slNode msg_next; - char *msg_buf; - int msg_len; + ubi_slNode msg_next; + char *msg_buf; + int msg_len; } pending_message_list; static ubi_slList smb_oplock_queue = { NULL, (ubi_slNodePtr)&smb_oplock_queue, 0}; @@ -67,29 +67,30 @@ static ubi_slList smb_oplock_queue = { NULL, (ubi_slNodePtr)&smb_oplock_queue, 0 static BOOL push_message(ubi_slList *list_head, char *buf, int msg_len) { - pending_message_list *msg = (pending_message_list *) + pending_message_list *msg = (pending_message_list *) malloc(sizeof(pending_message_list)); - if(msg == NULL) - { - DEBUG(0,("push_message: malloc fail (1)\n")); - return False; - } + if(msg == NULL) { + DEBUG(0,("push_message: malloc fail (1)\n")); + return False; + } - msg->msg_buf = (char *)malloc(msg_len); - if(msg->msg_buf == NULL) - { - DEBUG(0,("push_message: malloc fail (2)\n")); - SAFE_FREE(msg); - return False; - } + msg->msg_buf = (char *)malloc(msg_len); + if(msg->msg_buf == NULL) { + DEBUG(0,("push_message: malloc fail (2)\n")); + SAFE_FREE(msg); + return False; + } + + memcpy(msg->msg_buf, buf, msg_len); + msg->msg_len = msg_len; - memcpy(msg->msg_buf, buf, msg_len); - msg->msg_len = msg_len; + ubi_slAddTail( list_head, msg); - ubi_slAddTail( list_head, msg); + /* Push the MID of this packet on the signing queue. */ + srv_defer_sign_response(SVAL(buf,smb_mid)); - return True; + return True; } /**************************************************************************** @@ -295,28 +296,29 @@ BOOL receive_next_smb(char *inbuf, int bufsize, int timeout) void respond_to_all_remaining_local_messages(void) { - char buffer[1024]; - - /* - * Assert we have no exclusive open oplocks. - */ - - if(get_number_of_exclusive_open_oplocks()) { - DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n", - get_number_of_exclusive_open_oplocks() )); - return; - } - - /* - * Keep doing receive_local_message with a 1 ms timeout until - * we have no more messages. - */ - while(receive_local_message(buffer, sizeof(buffer), 1)) { - /* Deal with oplock break requests from other smbd's. */ - process_local_message(buffer, sizeof(buffer)); - } - - return; + char buffer[1024]; + + /* + * Assert we have no exclusive open oplocks. + */ + + if(get_number_of_exclusive_open_oplocks()) { + DEBUG(0,("respond_to_all_remaining_local_messages: PANIC : we have %d exclusive oplocks.\n", + get_number_of_exclusive_open_oplocks() )); + return; + } + + /* + * Keep doing receive_local_message with a 1 ms timeout until + * we have no more messages. + */ + + while(receive_local_message(buffer, sizeof(buffer), 1)) { + /* Deal with oplock break requests from other smbd's. */ + process_local_message(buffer, sizeof(buffer)); + } + + return; } @@ -339,13 +341,11 @@ force write permissions on print services. functions. Any message that has a NULL function is unimplemented - please feel free to contribute implementations! */ -static const struct smb_message_struct -{ - const char *name; - int (*fn)(connection_struct *conn, char *, char *, int, int); - int flags; -} - smb_messages[256] = { +static const struct smb_message_struct { + const char *name; + int (*fn)(connection_struct *conn, char *, char *, int, int); + int flags; +} smb_messages[256] = { /* 0x00 */ { "SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE}, /* 0x01 */ { "SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE}, @@ -849,67 +849,62 @@ set. Ignoring max smbd restriction.\n")); } /**************************************************************************** - process an smb from the client - split out from the smbd_process() code so - it can be used by the oplock break code. + Process an smb from the client - split out from the smbd_process() code so + it can be used by the oplock break code. ****************************************************************************/ + void process_smb(char *inbuf, char *outbuf) { - static int trans_num; - int msg_type = CVAL(inbuf,0); - int32 len = smb_len(inbuf); - int nread = len + 4; - - DO_PROFILE_INC(smb_count); - - if (trans_num == 0) { - /* on the first packet, check the global hosts allow/ hosts - deny parameters before doing any parsing of the packet - passed to us by the client. This prevents attacks on our - parsing code from hosts not in the hosts allow list */ - if (smbd_process_limit() || - !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1))) { - /* send a negative session response "not listening on calling - name" */ - static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81}; - DEBUG( 1, ( "Connection denied from %s\n", - client_addr() ) ); - (void)send_smb(smbd_server_fd(),(char *)buf); - exit_server("connection denied"); - } - } - - DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type, len ) ); - DEBUG( 3, ( "Transaction %d of length %d\n", trans_num, nread ) ); - - if (msg_type == 0) - show_msg(inbuf); - else if(msg_type == SMBkeepalive) - return; /* Keepalive packet. */ - - nread = construct_reply(inbuf,outbuf,nread,max_send); + static int trans_num; + int msg_type = CVAL(inbuf,0); + int32 len = smb_len(inbuf); + int nread = len + 4; + + DO_PROFILE_INC(smb_count); + + if (trans_num == 0) { + /* on the first packet, check the global hosts allow/ hosts + deny parameters before doing any parsing of the packet + passed to us by the client. This prevents attacks on our + parsing code from hosts not in the hosts allow list */ + if (smbd_process_limit() || + !check_access(smbd_server_fd(), lp_hostsallow(-1), lp_hostsdeny(-1))) { + /* send a negative session response "not listening on calling name" */ + static unsigned char buf[5] = {0x83, 0, 0, 1, 0x81}; + DEBUG( 1, ( "Connection denied from %s\n", client_addr() ) ); + (void)send_smb(smbd_server_fd(),(char *)buf); + exit_server("connection denied"); + } + } + + DEBUG( 6, ( "got message type 0x%x of len 0x%x\n", msg_type, len ) ); + DEBUG( 3, ( "Transaction %d of length %d\n", trans_num, nread ) ); + + if (msg_type == 0) + show_msg(inbuf); + else if(msg_type == SMBkeepalive) + return; /* Keepalive packet. */ + + nread = construct_reply(inbuf,outbuf,nread,max_send); - if(nread > 0) - { - if (CVAL(outbuf,0) == 0) - show_msg(outbuf); + if(nread > 0) { + if (CVAL(outbuf,0) == 0) + show_msg(outbuf); - if (nread != smb_len(outbuf) + 4) - { - DEBUG(0,("ERROR: Invalid message response size! %d %d\n", - nread, smb_len(outbuf))); - } - else - if (!send_smb(smbd_server_fd(),outbuf)) - exit_server("process_smb: send_smb failed."); - } - trans_num++; + if (nread != smb_len(outbuf) + 4) { + DEBUG(0,("ERROR: Invalid message response size! %d %d\n", + nread, smb_len(outbuf))); + } else if (!send_smb(smbd_server_fd(),outbuf)) { + exit_server("process_smb: send_smb failed."); + } + } + trans_num++; } - - /**************************************************************************** -return a string containing the function name of a SMB command + Return a string containing the function name of a SMB command. ****************************************************************************/ + const char *smb_fn_name(int type) { const char *unknown_name = "SMBunknown"; @@ -949,92 +944,94 @@ void construct_reply_common(char *inbuf,char *outbuf) } /**************************************************************************** - construct a chained reply and add it to the already made reply - **************************************************************************/ + Construct a chained reply and add it to the already made reply +****************************************************************************/ + int chain_reply(char *inbuf,char *outbuf,int size,int bufsize) { - static char *orig_inbuf; - static char *orig_outbuf; - int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0); - unsigned smb_off2 = SVAL(inbuf,smb_vwv1); - char *inbuf2, *outbuf2; - int outsize2; - char inbuf_saved[smb_wct]; - char outbuf_saved[smb_wct]; - int wct = CVAL(outbuf,smb_wct); - int outsize = smb_size + 2*wct + SVAL(outbuf,smb_vwv0+2*wct); - - /* maybe its not chained */ - if (smb_com2 == 0xFF) { - SCVAL(outbuf,smb_vwv0,0xFF); - return outsize; - } - - if (chain_size == 0) { - /* this is the first part of the chain */ - orig_inbuf = inbuf; - orig_outbuf = outbuf; - } - - /* - * The original Win95 redirector dies on a reply to - * a lockingX and read chain unless the chain reply is - * 4 byte aligned. JRA. - */ - - outsize = (outsize + 3) & ~3; - - /* we need to tell the client where the next part of the reply will be */ - SSVAL(outbuf,smb_vwv1,smb_offset(outbuf+outsize,outbuf)); - SCVAL(outbuf,smb_vwv0,smb_com2); - - /* remember how much the caller added to the chain, only counting stuff - after the parameter words */ - chain_size += outsize - smb_wct; - - /* work out pointers into the original packets. The - headers on these need to be filled in */ - inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct; - outbuf2 = orig_outbuf + SVAL(outbuf,smb_vwv1) + 4 - smb_wct; - - /* remember the original command type */ - smb_com1 = CVAL(orig_inbuf,smb_com); - - /* save the data which will be overwritten by the new headers */ - memcpy(inbuf_saved,inbuf2,smb_wct); - memcpy(outbuf_saved,outbuf2,smb_wct); - - /* give the new packet the same header as the last part of the SMB */ - memmove(inbuf2,inbuf,smb_wct); - - /* create the in buffer */ - SCVAL(inbuf2,smb_com,smb_com2); - - /* create the out buffer */ - construct_reply_common(inbuf2, outbuf2); - - DEBUG(3,("Chained message\n")); - show_msg(inbuf2); - - /* process the request */ - outsize2 = switch_message(smb_com2,inbuf2,outbuf2,size-chain_size, - bufsize-chain_size); - - /* copy the new reply and request headers over the old ones, but - preserve the smb_com field */ - memmove(orig_outbuf,outbuf2,smb_wct); - SCVAL(orig_outbuf,smb_com,smb_com1); - - /* restore the saved data, being careful not to overwrite any - data from the reply header */ - memcpy(inbuf2,inbuf_saved,smb_wct); - { - int ofs = smb_wct - PTR_DIFF(outbuf2,orig_outbuf); - if (ofs < 0) ofs = 0; - memmove(outbuf2+ofs,outbuf_saved+ofs,smb_wct-ofs); - } - - return outsize2; + static char *orig_inbuf; + static char *orig_outbuf; + int smb_com1, smb_com2 = CVAL(inbuf,smb_vwv0); + unsigned smb_off2 = SVAL(inbuf,smb_vwv1); + char *inbuf2, *outbuf2; + int outsize2; + char inbuf_saved[smb_wct]; + char outbuf_saved[smb_wct]; + int wct = CVAL(outbuf,smb_wct); + int outsize = smb_size + 2*wct + SVAL(outbuf,smb_vwv0+2*wct); + + /* maybe its not chained */ + if (smb_com2 == 0xFF) { + SCVAL(outbuf,smb_vwv0,0xFF); + return outsize; + } + + if (chain_size == 0) { + /* this is the first part of the chain */ + orig_inbuf = inbuf; + orig_outbuf = outbuf; + } + + /* + * The original Win95 redirector dies on a reply to + * a lockingX and read chain unless the chain reply is + * 4 byte aligned. JRA. + */ + + outsize = (outsize + 3) & ~3; + + /* we need to tell the client where the next part of the reply will be */ + SSVAL(outbuf,smb_vwv1,smb_offset(outbuf+outsize,outbuf)); + SCVAL(outbuf,smb_vwv0,smb_com2); + + /* remember how much the caller added to the chain, only counting stuff + after the parameter words */ + chain_size += outsize - smb_wct; + + /* work out pointers into the original packets. The + headers on these need to be filled in */ + inbuf2 = orig_inbuf + smb_off2 + 4 - smb_wct; + outbuf2 = orig_outbuf + SVAL(outbuf,smb_vwv1) + 4 - smb_wct; + + /* remember the original command type */ + smb_com1 = CVAL(orig_inbuf,smb_com); + + /* save the data which will be overwritten by the new headers */ + memcpy(inbuf_saved,inbuf2,smb_wct); + memcpy(outbuf_saved,outbuf2,smb_wct); + + /* give the new packet the same header as the last part of the SMB */ + memmove(inbuf2,inbuf,smb_wct); + + /* create the in buffer */ + SCVAL(inbuf2,smb_com,smb_com2); + + /* create the out buffer */ + construct_reply_common(inbuf2, outbuf2); + + DEBUG(3,("Chained message\n")); + show_msg(inbuf2); + + /* process the request */ + outsize2 = switch_message(smb_com2,inbuf2,outbuf2,size-chain_size, + bufsize-chain_size); + + /* copy the new reply and request headers over the old ones, but + preserve the smb_com field */ + memmove(orig_outbuf,outbuf2,smb_wct); + SCVAL(orig_outbuf,smb_com,smb_com1); + + /* restore the saved data, being careful not to overwrite any + data from the reply header */ + memcpy(inbuf2,inbuf_saved,smb_wct); + + { + int ofs = smb_wct - PTR_DIFF(outbuf2,orig_outbuf); + if (ofs < 0) ofs = 0; + memmove(outbuf2+ofs,outbuf_saved+ofs,smb_wct-ofs); + } + + return outsize2; } /**************************************************************************** @@ -1065,17 +1062,16 @@ static int setup_select_timeout(void) void check_reload(int t) { - static time_t last_smb_conf_reload_time = 0; + static time_t last_smb_conf_reload_time = 0; - if(last_smb_conf_reload_time == 0) - last_smb_conf_reload_time = t; + if(last_smb_conf_reload_time == 0) + last_smb_conf_reload_time = t; - if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) - { - reload_services(True); - reload_after_sighup = False; - last_smb_conf_reload_time = t; - } + if (reload_after_sighup || (t >= last_smb_conf_reload_time+SMBD_RELOAD_CHECK)) { + reload_services(True); + reload_after_sighup = False; + last_smb_conf_reload_time = t; + } } /**************************************************************************** @@ -1084,165 +1080,164 @@ void check_reload(int t) static BOOL timeout_processing(int deadtime, int *select_timeout, time_t *last_timeout_processing_time) { - static time_t last_keepalive_sent_time = 0; - static time_t last_idle_closed_check = 0; - time_t t; - BOOL allidle = True; - extern int keepalive; - - if (smb_read_error == READ_EOF) - { - DEBUG(3,("end of file from client\n")); - return False; - } - - if (smb_read_error == READ_ERROR) - { - DEBUG(3,("receive_smb error (%s) exiting\n", - strerror(errno))); - return False; - } - - *last_timeout_processing_time = t = time(NULL); - - if(last_keepalive_sent_time == 0) - last_keepalive_sent_time = t; - - if(last_idle_closed_check == 0) - last_idle_closed_check = t; - - /* become root again if waiting */ - change_to_root_user(); - - /* run all registered idle events */ - smb_run_idle_events(t); - - /* check if we need to reload services */ - check_reload(t); - - /* automatic timeout if all connections are closed */ - if (conn_num_open()==0 && (t - last_idle_closed_check) >= IDLE_CLOSED_TIMEOUT) - { - DEBUG( 2, ( "Closing idle connection\n" ) ); - return False; - } - else - last_idle_closed_check = t; - - if (keepalive && (t - last_keepalive_sent_time)>keepalive) - { - extern struct auth_context *negprot_global_auth_context; - if (!send_keepalive(smbd_server_fd())) { - DEBUG( 2, ( "Keepalive failed - exiting.\n" ) ); - return False; - } - - /* send a keepalive for a password server or the like. - This is attached to the auth_info created in the - negprot */ - if (negprot_global_auth_context - && negprot_global_auth_context->challenge_set_method - && negprot_global_auth_context->challenge_set_method->send_keepalive) { - negprot_global_auth_context->challenge_set_method->send_keepalive - (&negprot_global_auth_context->challenge_set_method->private_data); - } - - last_keepalive_sent_time = t; - } - - /* check for connection timeouts */ - allidle = conn_idle_all(t, deadtime); - - if (allidle && conn_num_open()>0) { - DEBUG(2,("Closing idle connection 2.\n")); - return False; - } - - if(global_machine_password_needs_changing && - /* for ADS we need to do a regular ADS password change, not a domain - password change */ - lp_security() == SEC_DOMAIN) - { - unsigned char trust_passwd_hash[16]; - time_t lct; - - /* - * We're in domain level security, and the code that - * read the machine password flagged that the machine - * password needs changing. - */ - - /* - * First, open the machine password file with an exclusive lock. - */ - - if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) { - DEBUG(0,("process: unable to lock the machine account password for \ + static time_t last_keepalive_sent_time = 0; + static time_t last_idle_closed_check = 0; + time_t t; + BOOL allidle = True; + extern int keepalive; + + if (smb_read_error == READ_EOF) { + DEBUG(3,("timeout_processing: End of file from client (client has disconnected).\n")); + return False; + } + + if (smb_read_error == READ_ERROR) { + DEBUG(3,("timeout_processing: receive_smb error (%s) Exiting\n", + strerror(errno))); + return False; + } + + if (smb_read_error == READ_BAD_SIG) { + DEBUG(3,("timeout_processing: receive_smb error bad smb signature. Exiting\n")); + return False; + } + + *last_timeout_processing_time = t = time(NULL); + + if(last_keepalive_sent_time == 0) + last_keepalive_sent_time = t; + + if(last_idle_closed_check == 0) + last_idle_closed_check = t; + + /* become root again if waiting */ + change_to_root_user(); + + /* run all registered idle events */ + smb_run_idle_events(t); + + /* check if we need to reload services */ + check_reload(t); + + /* automatic timeout if all connections are closed */ + if (conn_num_open()==0 && (t - last_idle_closed_check) >= IDLE_CLOSED_TIMEOUT) { + DEBUG( 2, ( "Closing idle connection\n" ) ); + return False; + } else { + last_idle_closed_check = t; + } + + if (keepalive && (t - last_keepalive_sent_time)>keepalive) { + extern struct auth_context *negprot_global_auth_context; + if (!send_keepalive(smbd_server_fd())) { + DEBUG( 2, ( "Keepalive failed - exiting.\n" ) ); + return False; + } + + /* send a keepalive for a password server or the like. + This is attached to the auth_info created in the + negprot */ + if (negprot_global_auth_context && negprot_global_auth_context->challenge_set_method + && negprot_global_auth_context->challenge_set_method->send_keepalive) { + + negprot_global_auth_context->challenge_set_method->send_keepalive + (&negprot_global_auth_context->challenge_set_method->private_data); + } + + last_keepalive_sent_time = t; + } + + /* check for connection timeouts */ + allidle = conn_idle_all(t, deadtime); + + if (allidle && conn_num_open()>0) { + DEBUG(2,("Closing idle connection 2.\n")); + return False; + } + + if(global_machine_password_needs_changing && + /* for ADS we need to do a regular ADS password change, not a domain + password change */ + lp_security() == SEC_DOMAIN) { + + unsigned char trust_passwd_hash[16]; + time_t lct; + + /* + * We're in domain level security, and the code that + * read the machine password flagged that the machine + * password needs changing. + */ + + /* + * First, open the machine password file with an exclusive lock. + */ + + if (secrets_lock_trust_account_password(lp_workgroup(), True) == False) { + DEBUG(0,("process: unable to lock the machine account password for \ machine %s in domain %s.\n", global_myname(), lp_workgroup() )); - return True; - } + return True; + } - if(!secrets_fetch_trust_account_password(lp_workgroup(), - trust_passwd_hash, - &lct, NULL)) { - DEBUG(0,("process: unable to read the machine account password for \ + if(!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd_hash, &lct, NULL)) { + DEBUG(0,("process: unable to read the machine account password for \ machine %s in domain %s.\n", global_myname(), lp_workgroup())); - secrets_lock_trust_account_password(lp_workgroup(), False); - return True; - } + secrets_lock_trust_account_password(lp_workgroup(), False); + return True; + } - /* - * Make sure someone else hasn't already done this. - */ + /* + * Make sure someone else hasn't already done this. + */ - if(t < lct + lp_machine_password_timeout()) { - global_machine_password_needs_changing = False; - secrets_lock_trust_account_password(lp_workgroup(), False); - return True; - } + if(t < lct + lp_machine_password_timeout()) { + global_machine_password_needs_changing = False; + secrets_lock_trust_account_password(lp_workgroup(), False); + return True; + } - /* always just contact the PDC here */ + /* always just contact the PDC here */ - change_trust_account_password( lp_workgroup(), NULL); - global_machine_password_needs_changing = False; - secrets_lock_trust_account_password(lp_workgroup(), False); - } - - /* - * Check to see if we have any blocking locks - * outstanding on the queue. - */ - process_blocking_lock_queue(t); - - /* update printer queue caches if necessary */ + change_trust_account_password( lp_workgroup(), NULL); + global_machine_password_needs_changing = False; + secrets_lock_trust_account_password(lp_workgroup(), False); + } + + /* + * Check to see if we have any blocking locks + * outstanding on the queue. + */ + process_blocking_lock_queue(t); + + /* update printer queue caches if necessary */ - update_monitored_printq_cache(); + update_monitored_printq_cache(); - /* - * Check to see if we have any change notifies - * outstanding on the queue. - */ - process_pending_change_notify_queue(t); + /* + * Check to see if we have any change notifies + * outstanding on the queue. + */ + process_pending_change_notify_queue(t); - /* - * Now we are root, check if the log files need pruning. - * Force a log file check. - */ - force_check_log_size(); - check_log_size(); + /* + * Now we are root, check if the log files need pruning. + * Force a log file check. + */ + force_check_log_size(); + check_log_size(); - /* Send any queued printer notify message to interested smbd's. */ + /* Send any queued printer notify message to interested smbd's. */ - print_notify_send_messages(0); + print_notify_send_messages(0); - /* - * Modify the select timeout depending upon - * what we have remaining in our queues. - */ + /* + * Modify the select timeout depending upon + * what we have remaining in our queues. + */ - *select_timeout = setup_select_timeout(); + *select_timeout = setup_select_timeout(); - return True; + return True; } /**************************************************************************** diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c index e7f01ad02f..71312295f4 100644 --- a/source3/smbd/reply.c +++ b/source3/smbd/reply.c @@ -48,8 +48,6 @@ int reply_special(char *inbuf,char *outbuf) int msg_type = CVAL(inbuf,0); int msg_flags = CVAL(inbuf,1); pstring name1,name2; - - int len; char name_type = 0; static BOOL already_got_session = False; @@ -75,23 +73,16 @@ int reply_special(char *inbuf,char *outbuf) return(0); } name_extract(inbuf,4,name1); - name_extract(inbuf,4 + name_len(inbuf + 4),name2); + name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2); DEBUG(2,("netbios connect: name1=%s name2=%s\n", name1,name2)); - name1[15] = 0; - - len = strlen(name2); - if (len == 16) { - name_type = name2[15]; - name2[15] = 0; - } - set_local_machine_name(name1, True); set_remote_machine_name(name2, True); - DEBUG(2,("netbios connect: local=%s remote=%s\n", - get_local_machine_name(), get_remote_machine_name() )); + DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n", + get_local_machine_name(), get_remote_machine_name(), + name_type)); if (name_type == 'R') { /* We are being asked for a pathworks session --- @@ -1281,6 +1272,16 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name) *directory = *mask = 0; + /* We must check for wildcards in the name given + * directly by the client - before any unmangling. + * This prevents an unmangling of a UNIX name containing + * a DOS wildcard like '*' or '?' from unmangling into + * a wildcard delete which was not intended. + * FIX for #226. JRA. + */ + + has_wild = ms_has_wild(name); + rc = unix_convert(name,conn,0,&bad_path,&sbuf); p = strrchr_m(name,'/'); @@ -1305,13 +1306,12 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name) if (!rc && mangle_is_mangled(mask)) mangle_check_cache( mask ); - has_wild = ms_has_wild(mask); - if (!has_wild) { pstrcat(directory,"/"); pstrcat(directory,mask); error = can_delete(directory,conn,dirtype); - if (!NT_STATUS_IS_OK(error)) return error; + if (!NT_STATUS_IS_OK(error)) + return error; if (SMB_VFS_UNLINK(conn,directory) == 0) { count++; @@ -1338,12 +1338,15 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name) pstring fname; pstrcpy(fname,dname); - if(!mask_match(fname, mask, case_sensitive)) continue; + if(!mask_match(fname, mask, case_sensitive)) + continue; slprintf(fname,sizeof(fname)-1, "%s/%s",directory,dname); error = can_delete(fname,conn,dirtype); - if (!NT_STATUS_IS_OK(error)) continue; - if (SMB_VFS_UNLINK(conn,fname) == 0) count++; + if (!NT_STATUS_IS_OK(error)) + continue; + if (SMB_VFS_UNLINK(conn,fname) == 0) + count++; DEBUG(3,("unlink_internals: succesful unlink [%s]\n",fname)); } CloseDir(dirptr); @@ -1379,7 +1382,8 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size DEBUG(3,("reply_unlink : %s\n",name)); status = unlink_internals(conn, dirtype, name); - if (!NT_STATUS_IS_OK(status)) return ERROR_NT(status); + if (!NT_STATUS_IS_OK(status)) + return ERROR_NT(status); /* * Win2k needs a changenotify request response before it will @@ -1472,6 +1476,10 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s files_struct *fsp; START_PROFILE(SMBreadbraw); + if (srv_is_signing_active()) { + exit_server("reply_readbraw: SMB signing is active - raw reads/writes are disallowed."); + } + /* * Special check if an oplock break has been issued * and the readraw request croses on the wire, we must @@ -1870,6 +1878,10 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size, int outsize = 0; START_PROFILE(SMBwritebraw); + if (srv_is_signing_active()) { + exit_server("reply_readbraw: SMB signing is active - raw reads/writes are disallowed."); + } + CHECK_FSP(fsp,conn); CHECK_WRITE(fsp); @@ -2828,7 +2840,11 @@ NTSTATUS mkdir_internal(connection_struct *conn, pstring directory) int ret= -1; unix_convert(directory,conn,0,&bad_path,&sbuf); - + + if (ms_has_wild(directory)) { + return NT_STATUS_OBJECT_NAME_INVALID; + } + if (check_name(directory, conn)) ret = vfs_MkDir(conn,directory,unix_mode(conn,aDIR,directory)); diff --git a/source3/smbd/service.c b/source3/smbd/service.c index 18e0887071..c2855487a5 100644 --- a/source3/smbd/service.c +++ b/source3/smbd/service.c @@ -661,7 +661,7 @@ static connection_struct *make_connection_snum(int snum, user_struct *vuser, #else /* the alternative is just to check the directory exists */ if (stat(conn->connectpath, &st) != 0 || !S_ISDIR(st.st_mode)) { - DEBUG(0,("'%s' is not a directory, when connecting to [%s]\n", conn->connectpath, lp_servicename(SNUM(conn)))); + DEBUG(0,("'%s' does not exist or is not a directory, when connecting to [%s]\n", conn->connectpath, lp_servicename(SNUM(conn)))); change_to_root_user(); yield_connection(conn, lp_servicename(SNUM(conn))); conn_free(conn); diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c index 7d77ed3071..88b442215d 100644 --- a/source3/smbd/sesssetup.c +++ b/source3/smbd/sesssetup.c @@ -3,7 +3,7 @@ handle SMBsessionsetup Copyright (C) Andrew Tridgell 1998-2001 Copyright (C) Andrew Bartlett 2001 - Copyright (C) Jim McDonough 2002 + Copyright (C) Jim McDonough 2002 Copyright (C) Luke Howard 2003 This program is free software; you can redistribute it and/or modify @@ -62,7 +62,7 @@ static int add_signature(char *outbuf, char *p) char *start = p; fstring lanman; - snprintf( lanman, sizeof(lanman), "Samba %s", VERSION ); + fstr_sprintf( lanman, "Samba %s", VERSION ); p += srvstr_push(outbuf, p, "Unix", -1, STR_TERMINATE); p += srvstr_push(outbuf, p, lanman, -1, STR_TERMINATE); @@ -153,6 +153,7 @@ static int reply_spnego_kerberos(connection_struct *conn, uint8 session_key[16]; uint8 tok_id[2]; BOOL foreign = False; + DATA_BLOB nullblob = data_blob(NULL, 0); ZERO_STRUCT(ticket); ZERO_STRUCT(auth_data); @@ -235,7 +236,7 @@ static int reply_spnego_kerberos(connection_struct *conn, memcpy(server_info->session_key, session_key, sizeof(session_key)); /* register_vuid keeps the server info */ - sess_vuid = register_vuid(server_info, user); + sess_vuid = register_vuid(server_info, nullblob, user); free(user); @@ -250,6 +251,16 @@ static int reply_spnego_kerberos(connection_struct *conn, } SSVAL(outbuf, smb_uid, sess_vuid); + + if (!server_info->guest) { + /* We need to start the signing engine + * here but a W2K client sends the old + * "BSRSPYL " signature instead of the + * correct one. Subsequent packets will + * be correct. + */ + srv_check_sign_mac(inbuf); + } } /* wrap that up in a nice GSS-API wrapping */ @@ -275,7 +286,7 @@ static int reply_spnego_kerberos(connection_struct *conn, End the NTLMSSP exchange context if we are OK/complete fail ***************************************************************************/ -static BOOL reply_spnego_ntlmssp(connection_struct *conn, char *outbuf, +static BOOL reply_spnego_ntlmssp(connection_struct *conn, char *inbuf, char *outbuf, AUTH_NTLMSSP_STATE **auth_ntlmssp_state, DATA_BLOB *ntlmssp_blob, NTSTATUS nt_status) { @@ -294,8 +305,10 @@ static BOOL reply_spnego_ntlmssp(connection_struct *conn, char *outbuf, if (NT_STATUS_IS_OK(nt_status)) { int sess_vuid; + DATA_BLOB nullblob = data_blob(NULL, 0); + /* register_vuid keeps the server info */ - sess_vuid = register_vuid(server_info, (*auth_ntlmssp_state)->ntlmssp_state->user); + sess_vuid = register_vuid(server_info, nullblob, (*auth_ntlmssp_state)->ntlmssp_state->user); (*auth_ntlmssp_state)->server_info = NULL; if (sess_vuid == -1) { @@ -310,6 +323,16 @@ static BOOL reply_spnego_ntlmssp(connection_struct *conn, char *outbuf, } SSVAL(outbuf,smb_uid,sess_vuid); + + if (!server_info->guest) { + /* We need to start the signing engine + * here but a W2K client sends the old + * "BSRSPYL " signature instead of the + * correct one. Subsequent packets will + * be correct. + */ + srv_check_sign_mac(inbuf); + } } } @@ -348,16 +371,27 @@ static int reply_spnego_negotiate(connection_struct *conn, if (!parse_negTokenTarg(blob1, OIDs, &secblob)) { return ERROR_NT(NT_STATUS_LOGON_FAILURE); } + + /* only look at the first OID for determining the mechToken -- + accoirding to RFC2478, we should choose the one we want + and renegotiate, but i smell a client bug here.. + + Problem observed when connecting to a member (samba box) + of an AD domain as a user in a Samba domain. Samba member + server sent back krb5/mskrb5/ntlmssp as mechtypes, but the + client (2ksp3) replied with ntlmssp/mskrb5/krb5 and an + NTLMSSP mechtoken. --jerry */ + if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || + strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) { + got_kerberos = True; + } + for (i=0;OIDs[i];i++) { DEBUG(3,("Got OID %s\n", OIDs[i])); - if (strcmp(OID_KERBEROS5, OIDs[i]) == 0 || - strcmp(OID_KERBEROS5_OLD, OIDs[i]) == 0) { - got_kerberos = True; - } free(OIDs[i]); } - DEBUG(3,("Got secblob of size %d\n", secblob.length)); + DEBUG(3,("Got secblob of size %lu\n", (unsigned long)secblob.length)); #ifdef HAVE_KRB5 if (got_kerberos && (SEC_ADS == lp_security())) { @@ -382,7 +416,7 @@ static int reply_spnego_negotiate(connection_struct *conn, data_blob_free(&secblob); - reply_spnego_ntlmssp(conn, outbuf, &global_ntlmssp_state, + reply_spnego_ntlmssp(conn, inbuf, outbuf, &global_ntlmssp_state, &chal, nt_status); data_blob_free(&chal); @@ -419,7 +453,7 @@ static int reply_spnego_auth(connection_struct *conn, char *inbuf, char *outbuf, data_blob_free(&auth); - reply_spnego_ntlmssp(conn, outbuf, &global_ntlmssp_state, + reply_spnego_ntlmssp(conn, inbuf, outbuf, &global_ntlmssp_state, &auth_reply, nt_status); data_blob_free(&auth_reply); @@ -742,7 +776,6 @@ int reply_sesssetup_and_X(connection_struct *conn, char *inbuf,char *outbuf, free_user_info(&user_info); data_blob_free(&lm_resp); - data_blob_free(&nt_resp); data_blob_clear_free(&plaintext_password); if (!NT_STATUS_IS_OK(nt_status)) { @@ -750,9 +783,10 @@ int reply_sesssetup_and_X(connection_struct *conn, char *inbuf,char *outbuf, } if (!NT_STATUS_IS_OK(nt_status)) { + data_blob_free(&nt_resp); return ERROR_NT(nt_status_squash(nt_status)); } - + /* it's ok - setup a reply */ set_message(outbuf,3,0,True); if (Protocol >= PROTOCOL_NT1) { @@ -770,12 +804,17 @@ int reply_sesssetup_and_X(connection_struct *conn, char *inbuf,char *outbuf, to a uid can get through without a password, on the same VC */ /* register_vuid keeps the server info */ - sess_vuid = register_vuid(server_info, sub_user); - + sess_vuid = register_vuid(server_info, nt_resp, sub_user); + data_blob_free(&nt_resp); + if (sess_vuid == -1) { return ERROR_NT(NT_STATUS_LOGON_FAILURE); } + if (!server_info->guest && !srv_check_sign_mac(inbuf)) { + exit_server("reply_sesssetup_and_X: bad smb signature"); + } + SSVAL(outbuf,smb_uid,sess_vuid); SSVAL(inbuf,smb_uid,sess_vuid); diff --git a/source3/smbd/statcache.c b/source3/smbd/statcache.c index 22b8a33a1e..fbebdb240f 100644 --- a/source3/smbd/statcache.c +++ b/source3/smbd/statcache.c @@ -98,7 +98,12 @@ void stat_cache_add( const char *full_orig_name, const char *orig_translated_pat translated_path_length--; } - original_path = strdup(full_orig_name); + if(case_sensitive) { + original_path = strdup(full_orig_name); + } else { + original_path = strdup_upper(full_orig_name); + } + if (!original_path) { SAFE_FREE(translated_path); return; @@ -111,9 +116,6 @@ void stat_cache_add( const char *full_orig_name, const char *orig_translated_pat original_path_length--; } - if(!case_sensitive) - strupper_m(original_path); - if (original_path_length != translated_path_length) { if (original_path_length < translated_path_length) { DEBUG(0, ("OOPS - tried to store stat cache entry for werid length paths [%s] %u and [%s] %u)!\n", @@ -161,6 +163,7 @@ void stat_cache_add( const char *full_orig_name, const char *orig_translated_pat } scp->original_path = scp->names; + /* pointer into the structure... */ scp->translated_path = scp->names + original_path_length + 1; safe_strcpy(scp->original_path, original_path, original_path_length); safe_strcpy(scp->translated_path, translated_path, translated_path_length); @@ -194,7 +197,7 @@ BOOL stat_cache_lookup(connection_struct *conn, pstring name, pstring dirpath, char **start, SMB_STRUCT_STAT *pst) { stat_cache_entry *scp; - pstring chk_name; + char *chk_name; size_t namelen; hash_element *hash_elem; char *sp; @@ -218,10 +221,20 @@ BOOL stat_cache_lookup(connection_struct *conn, pstring name, pstring dirpath, return False; } - pstrcpy(chk_name, name); + if (case_sensitive) { + chk_name = strdup(name); + if (!chk_name) { + DEBUG(0, ("stat_cache_lookup: strdup failed!\n")); + return False; + } + + } else { + chk_name = strdup_upper(name); + if (!chk_name) { + DEBUG(0, ("stat_cache_lookup: strdup_upper failed!\n")); + return False; + } - if(!case_sensitive) { - strupper_m( chk_name ); /* * In some language encodings the length changes * if we uppercase. We need to treat this differently @@ -252,11 +265,13 @@ BOOL stat_cache_lookup(connection_struct *conn, pstring name, pstring dirpath, * We reached the end of the name - no match. */ DO_PROFILE_INC(statcache_misses); + SAFE_FREE(chk_name); return False; } if((*chk_name == '\0') || (strcmp(chk_name, ".") == 0) || (strcmp(chk_name, "..") == 0)) { DO_PROFILE_INC(statcache_misses); + SAFE_FREE(chk_name); return False; } } else { @@ -265,6 +280,7 @@ BOOL stat_cache_lookup(connection_struct *conn, pstring name, pstring dirpath, if(SMB_VFS_STAT(conn,scp->translated_path, pst) != 0) { /* Discard this entry - it doesn't exist in the filesystem. */ hash_remove(&stat_cache, hash_elem); + SAFE_FREE(chk_name); return False; } @@ -290,6 +306,7 @@ BOOL stat_cache_lookup(connection_struct *conn, pstring name, pstring dirpath, ++*start; pstrcpy(dirpath, scp->translated_path); + SAFE_FREE(chk_name); return (namelen == scp->translated_path_length); } } diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c index bdcd04443e..86906fa5be 100644 --- a/source3/smbd/trans2.c +++ b/source3/smbd/trans2.c @@ -326,7 +326,13 @@ static BOOL exact_match(char *str,char *mask, BOOL case_sig) return False; if (case_sig) return strcmp(str,mask)==0; - return StrCaseCmp(str,mask) == 0; + if (StrCaseCmp(str,mask) != 0) { + return False; + } + if (ms_has_wild(str)) { + return False; + } + return True; } /**************************************************************************** @@ -1906,7 +1912,7 @@ static int call_trans2qfilepathinfo(connection_struct *conn, if (strequal(base_name,".")) { pstrcpy(dos_fname, "\\"); } else { - snprintf(dos_fname, sizeof(dos_fname), "\\%s", fname); + pstr_sprintf(dos_fname, "\\%s", fname); string_replace(dos_fname, '/', '\\'); } @@ -3353,6 +3359,8 @@ int reply_trans2(connection_struct *conn, memcpy( data, smb_base(inbuf) + dsoff, num_data); } + srv_signing_trans_start(SVAL(inbuf,smb_mid)); + if(num_data_sofar < total_data || num_params_sofar < total_params) { /* We need to send an interim response then receive the rest of the parameter/data bytes */ @@ -3525,6 +3533,7 @@ int reply_trans2(connection_struct *conn, SAFE_FREE(params); SAFE_FREE(data); END_PROFILE(SMBtrans2); + srv_signing_trans_stop(); return ERROR_DOS(ERRSRV,ERRerror); } @@ -3535,6 +3544,8 @@ int reply_trans2(connection_struct *conn, an error packet. */ + srv_signing_trans_stop(); + SAFE_FREE(params); SAFE_FREE(data); END_PROFILE(SMBtrans2); @@ -3544,6 +3555,7 @@ int reply_trans2(connection_struct *conn, bad_param: + srv_signing_trans_stop(); SAFE_FREE(params); SAFE_FREE(data); END_PROFILE(SMBtrans2); diff --git a/source3/smbd/utmp.c b/source3/smbd/utmp.c index 9833a11f2d..6ff2f586ba 100644 --- a/source3/smbd/utmp.c +++ b/source3/smbd/utmp.c @@ -491,8 +491,8 @@ static BOOL sys_utmp_fill(struct utmp *u, * If size limit proves troublesome, then perhaps use "ut_id_encode()". */ if (strlen(id_str) > sizeof(u->ut_line)) { - DEBUG(1,("id_str [%s] is too long for %d char utmp field\n", - id_str, sizeof(u->ut_line))); + DEBUG(1,("id_str [%s] is too long for %lu char utmp field\n", + id_str, (unsigned long)sizeof(u->ut_line))); return False; } utmp_strcpy(u->ut_line, id_str, sizeof(u->ut_line)); diff --git a/source3/tdb/tdbtool.c b/source3/tdb/tdbtool.c index 221ef4a5f2..92009dcef4 100644 --- a/source3/tdb/tdbtool.c +++ b/source3/tdb/tdbtool.c @@ -118,6 +118,7 @@ static void help(void) " erase : erase the database\n" " dump : dump the database as strings\n" " insert key data : insert a record\n" +" move key file : move a record to a destination tdb\n" " store key data : store a record (replace)\n" " show key : show a record by key\n" " delete key : delete a record by key\n" @@ -251,16 +252,26 @@ static void show_tdb(void) } key.dptr = k; -/* key.dsize = strlen(k)+1;*/ - key.dsize = strlen(k); + key.dsize = strlen(k)+1; dbuf = tdb_fetch(tdb, key); if (!dbuf.dptr) { - terror("fetch failed"); - return; + /* maybe it is non-NULL terminated key? */ + key.dsize = strlen(k); + dbuf = tdb_fetch(tdb, key); + + if ( !dbuf.dptr ) { + terror("fetch failed"); + return; + } } + /* printf("%s : %*.*s\n", k, (int)dbuf.dsize, (int)dbuf.dsize, dbuf.dptr); */ print_rec(tdb, key, dbuf, NULL); + + free( dbuf.dptr ); + + return; } static void delete_tdb(void) @@ -281,6 +292,57 @@ static void delete_tdb(void) } } +static void move_rec(void) +{ + char *k = get_token(1); + char *file = get_token(0); + TDB_DATA key, dbuf; + TDB_CONTEXT *dst_tdb; + + if (!k) { + help(); + return; + } + + if ( !file ) { + terror("need destination tdb name"); + return; + } + + key.dptr = k; + key.dsize = strlen(k)+1; + + dbuf = tdb_fetch(tdb, key); + if (!dbuf.dptr) { + /* maybe it is non-NULL terminated key? */ + key.dsize = strlen(k); + dbuf = tdb_fetch(tdb, key); + + if ( !dbuf.dptr ) { + terror("fetch failed"); + return; + } + } + + print_rec(tdb, key, dbuf, NULL); + + dst_tdb = tdb_open(file, 0, 0, O_RDWR, 0600); + if ( !dst_tdb ) { + terror("unable to open destination tdb"); + return; + } + + if ( tdb_store( dst_tdb, key, dbuf, TDB_REPLACE ) == -1 ) { + terror("failed to move record"); + } + else + printf("record moved\n"); + + tdb_close( dst_tdb ); + + return; +} + #if 0 static int print_conn_key(TDB_DATA key) { @@ -455,6 +517,9 @@ int main(int argc, char *argv[]) } else if (strcmp(tok,"dump") == 0) { bIterate = 0; tdb_traverse(tdb, print_rec, NULL); + } else if (strcmp(tok,"move") == 0) { + bIterate = 0; + move_rec(); } else if (strcmp(tok,"list") == 0) { tdb_dump_all(tdb); } else if (strcmp(tok, "free") == 0) { diff --git a/source3/torture/cmd_vfs.c b/source3/torture/cmd_vfs.c index f74fcedcf4..d91dbf50e0 100644 --- a/source3/torture/cmd_vfs.c +++ b/source3/torture/cmd_vfs.c @@ -528,7 +528,8 @@ static NTSTATUS cmd_stat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, c printf(" Inode: %10u", (unsigned int)st.st_ino); printf(" Links: %10u\n", (unsigned int)st.st_nlink); printf(" Access: %05o", (st.st_mode) & 007777); - printf(" Uid: %5d/%.16s Gid: %5d/%.16s\n", st.st_uid, user, st.st_gid, group); + printf(" Uid: %5lu/%.16s Gid: %5lu/%.16s\n", (unsigned long)st.st_uid, user, + (unsigned long)st.st_gid, group); printf(" Access: %s", ctime(&(st.st_atime))); printf(" Modify: %s", ctime(&(st.st_mtime))); printf(" Change: %s", ctime(&(st.st_ctime))); @@ -590,7 +591,8 @@ static NTSTATUS cmd_fstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, printf(" Inode: %10u", (unsigned int)st.st_ino); printf(" Links: %10u\n", (unsigned int)st.st_nlink); printf(" Access: %05o", (st.st_mode) & 007777); - printf(" Uid: %5d/%.16s Gid: %5d/%.16s\n", st.st_uid, user, st.st_gid, group); + printf(" Uid: %5lu/%.16s Gid: %5lu/%.16s\n", (unsigned long)st.st_uid, user, + (unsigned long)st.st_gid, group); printf(" Access: %s", ctime(&(st.st_atime))); printf(" Modify: %s", ctime(&(st.st_mtime))); printf(" Change: %s", ctime(&(st.st_ctime))); @@ -640,7 +642,8 @@ static NTSTATUS cmd_lstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, printf(" Inode: %10u", (unsigned int)st.st_ino); printf(" Links: %10u\n", (unsigned int)st.st_nlink); printf(" Access: %05o", (st.st_mode) & 007777); - printf(" Uid: %5d/%.16s Gid: %5d/%.16s\n", st.st_uid, user, st.st_gid, group); + printf(" Uid: %5lu/%.16s Gid: %5lu/%.16s\n", (unsigned long)st.st_uid, user, + (unsigned long)st.st_gid, group); printf(" Access: %s", ctime(&(st.st_atime))); printf(" Modify: %s", ctime(&(st.st_mtime))); printf(" Change: %s", ctime(&(st.st_ctime))); diff --git a/source3/torture/locktest.c b/source3/torture/locktest.c index 63b9590dd6..86379bf3b6 100644 --- a/source3/torture/locktest.c +++ b/source3/torture/locktest.c @@ -157,7 +157,7 @@ static struct cli_state *connect_one(char *share, int snum) zero_ip(&ip); - slprintf(myname,sizeof(myname), "lock-%u-%u", getpid(), count++); + slprintf(myname,sizeof(myname), "lock-%lu-%u", (unsigned long)getpid(), count++); make_nmb_name(&calling, myname, 0x0); make_nmb_name(&called , server, 0x20); diff --git a/source3/torture/locktest2.c b/source3/torture/locktest2.c index 97844b5609..5fbaf9ec58 100644 --- a/source3/torture/locktest2.c +++ b/source3/torture/locktest2.c @@ -173,11 +173,11 @@ static struct cli_state *connect_one(char *share) } } - slprintf(myname,sizeof(myname), "lock-%u-%u", getpid(), count++); + slprintf(myname,sizeof(myname), "lock-%lu-%u", (unsigned long)getpid(), count++); nt_status = cli_full_connection(&c, myname, server_n, NULL, 0, share, "?????", username, lp_workgroup(), password, 0, - NULL); + Undefined, NULL); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("cli_full_connection failed with error %s\n", nt_errstr(nt_status))); diff --git a/source3/torture/mangle_test.c b/source3/torture/mangle_test.c index 660d4d17af..9a719349b6 100644 --- a/source3/torture/mangle_test.c +++ b/source3/torture/mangle_test.c @@ -54,7 +54,7 @@ static BOOL test_one(struct cli_state *cli, const char *name) return False; } - snprintf(name2, sizeof(name2), "\\mangle_test\\%s", shortname); + fstr_sprintf(name2, "\\mangle_test\\%s", shortname); if (!cli_unlink(cli, name2)) { printf("unlink of %s (%s) failed (%s)\n", name2, name, cli_errstr(cli)); diff --git a/source3/torture/nsstest.c b/source3/torture/nsstest.c index 0a08cb6e8f..a803cd7e71 100644 --- a/source3/torture/nsstest.c +++ b/source3/torture/nsstest.c @@ -29,11 +29,11 @@ static int total_errors; static void *find_fn(const char *name) { - char s[1024]; + pstring s; static void *h; void *res; - snprintf(s,sizeof(s), "_nss_%s_%s", nss_name, name); + pstr_sprintf(s, "_nss_%s_%s", nss_name, name); if (!h) { h = sys_dlopen(so_path, RTLD_LAZY); @@ -296,11 +296,11 @@ static int nss_initgroups(char *user, gid_t group, gid_t **groups, long int *sta static void print_passwd(struct passwd *pwd) { - printf("%s:%s:%d:%d:%s:%s:%s\n", + printf("%s:%s:%lu:%lu:%s:%s:%s\n", pwd->pw_name, pwd->pw_passwd, - pwd->pw_uid, - pwd->pw_gid, + (unsigned long)pwd->pw_uid, + (unsigned long)pwd->pw_gid, pwd->pw_gecos, pwd->pw_dir, pwd->pw_shell); @@ -309,10 +309,10 @@ static void print_passwd(struct passwd *pwd) static void print_group(struct group *grp) { int i; - printf("%s:%s:%d: ", + printf("%s:%s:%lu: ", grp->gr_name, grp->gr_passwd, - grp->gr_gid); + (unsigned long)grp->gr_gid); if (!grp->gr_mem[0]) { printf("\n"); @@ -343,9 +343,9 @@ static void nss_test_initgroups(char *name, gid_t gid) } for (i=0; iauth.flags |= ADS_AUTH_NO_BIND; } @@ -89,7 +89,7 @@ static int net_ads_info(int argc, const char **argv) { ADS_STRUCT *ads; - ads = ads_init(NULL, NULL, opt_host); + ads = ads_init(NULL, opt_target_workgroup, opt_host); if (ads) { ads->auth.flags |= ADS_AUTH_NO_BIND; @@ -129,7 +129,7 @@ static ADS_STRUCT *ads_startup(void) BOOL second_time = False; char *cp; - ads = ads_init(NULL, NULL, opt_host); + ads = ads_init(NULL, opt_target_workgroup, opt_host); if (!opt_user_name) { opt_user_name = "administrator"; @@ -848,7 +848,7 @@ static int net_ads_printer_publish(int argc, const char **argv) opt_user_name, opt_workgroup, opt_password ? opt_password : "", CLI_FULL_CONNECTION_USE_KERBEROS, - NULL); + Undefined, NULL); if (NT_STATUS_IS_ERR(nt_status)) { d_printf("Unable to open a connnection to %s to obtain data " diff --git a/source3/utils/net_cache.c b/source3/utils/net_cache.c index 8dd9db599d..a955916458 100644 --- a/source3/utils/net_cache.c +++ b/source3/utils/net_cache.c @@ -214,7 +214,7 @@ static int net_cache_del(int argc, const char **argv) const char *keystr = argv[0]; if (argc < 1) { - d_printf("\nUsage: net cache add \n"); + d_printf("\nUsage: net cache del \n"); return -1; } diff --git a/source3/utils/net_idmap.c b/source3/utils/net_idmap.c index 689d4ff813..b035d8d2f1 100644 --- a/source3/utils/net_idmap.c +++ b/source3/utils/net_idmap.c @@ -95,10 +95,14 @@ static int net_idmap_restore(int argc, const char **argv) if ( (len > 0) && (line[len-1] == '\n') ) line[len-1] = '\0'; + /* Yuck - this is broken for sizeof(gid_t) != sizeof(int) */ + if (sscanf(line, "GID %d %s", &id.gid, sid_string) == 2) { type = ID_GROUPID; } + /* Yuck - this is broken for sizeof(uid_t) != sizeof(int) */ + if (sscanf(line, "UID %d %s", &id.uid, sid_string) == 2) { type = ID_USERID; } @@ -114,9 +118,10 @@ static int net_idmap_restore(int argc, const char **argv) } if (!NT_STATUS_IS_OK(idmap_set_mapping(&sid, id, type))) { - d_printf("Could not set mapping of %s %d to sid %s\n", + d_printf("Could not set mapping of %s %lu to sid %s\n", (type == ID_GROUPID) ? "GID" : "UID", - (type == ID_GROUPID) ? id.gid : id.uid, + (type == ID_GROUPID) ? (unsigned long)id.gid: + (unsigned long)id.uid, sid_string_static(&sid)); continue; } diff --git a/source3/utils/net_rpc_samsync.c b/source3/utils/net_rpc_samsync.c index e5e9a68b2e..9eadbbbade 100644 --- a/source3/utils/net_rpc_samsync.c +++ b/source3/utils/net_rpc_samsync.c @@ -400,8 +400,7 @@ sam_account_from_delta(SAM_ACCOUNT *account, SAM_ACCOUNT_INFO *delta) return NT_STATUS_OK; } -static NTSTATUS -fetch_account_info(uint32 rid, SAM_ACCOUNT_INFO *delta) +static NTSTATUS fetch_account_info(uint32 rid, SAM_ACCOUNT_INFO *delta) { NTSTATUS nt_ret; fstring account; @@ -429,6 +428,7 @@ fetch_account_info(uint32 rid, SAM_ACCOUNT_INFO *delta) (delta->acb_info & ACB_DOMTRUST) ) { pstrcpy(add_script, lp_addmachine_script()); } else { + *add_script = '\0'; DEBUG(1, ("Unknown user type: %s\n", smbpasswd_encode_acb_info(delta->acb_info))); } @@ -439,8 +439,7 @@ fetch_account_info(uint32 rid, SAM_ACCOUNT_INFO *delta) add_ret = smbrun(add_script,NULL); DEBUG(1,("fetch_account: Running the command `%s' " "gave %d\n", add_script, add_ret)); - } - else { + } else { DEBUG(8,("fetch_account_info: no add user/machine script. Asking winbindd\n")); /* don't need a RID allocated since the user already has a SID */ @@ -487,8 +486,8 @@ fetch_account_info(uint32 rid, SAM_ACCOUNT_INFO *delta) } else { if (map.gid != passwd->pw_gid) { if (!(grp = getgrgid(map.gid))) { - DEBUG(0, ("Could not find unix group %d for user %s (group SID=%s)\n", - map.gid, pdb_get_username(sam_account), sid_string_static(&group_sid))); + DEBUG(0, ("Could not find unix group %lu for user %s (group SID=%s)\n", + (unsigned long)map.gid, pdb_get_username(sam_account), sid_string_static(&group_sid))); } else { smb_set_primary_group(grp->gr_name, pdb_get_username(sam_account)); } @@ -585,7 +584,7 @@ fetch_group_mem_info(uint32 rid, SAM_GROUP_MEM_INFO *delta) } if (!(grp = getgrgid(map.gid))) { - DEBUG(0, ("Could not find unix group %d\n", map.gid)); + DEBUG(0, ("Could not find unix group %lu\n", (unsigned long)map.gid)); return NT_STATUS_NO_SUCH_GROUP; } diff --git a/source3/utils/net_time.c b/source3/utils/net_time.c index 40619a0796..45c1783805 100644 --- a/source3/utils/net_time.c +++ b/source3/utils/net_time.c @@ -71,12 +71,12 @@ static time_t nettime(int *zone) /* return a time as a string ready to be passed to /bin/date */ static char *systime(time_t t) { - static char s[100]; + static fstring s; struct tm *tm; tm = localtime(&t); - snprintf(s, sizeof(s), "%02d%02d%02d%02d%04d.%02d", + fstr_sprintf(s, "%02d%02d%02d%02d%04d.%02d", tm->tm_mon+1, tm->tm_mday, tm->tm_hour, tm->tm_min, tm->tm_year + 1900, tm->tm_sec); return s; diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c index 3dfa157bda..1d36a7ce52 100644 --- a/source3/utils/ntlm_auth.c +++ b/source3/utils/ntlm_auth.c @@ -32,7 +32,9 @@ enum squid_mode { SQUID_2_4_BASIC, SQUID_2_5_BASIC, - SQUID_2_5_NTLMSSP + SQUID_2_5_NTLMSSP, + GSS_SPNEGO, + GSS_SPNEGO_CLIENT }; @@ -342,6 +344,501 @@ static void manage_squid_basic_request(enum squid_mode squid_mode, } } +static void offer_gss_spnego_mechs(void) { + + DATA_BLOB token; + ASN1_DATA asn1; + SPNEGO_DATA spnego; + ssize_t len; + char *reply_base64; + + ZERO_STRUCT(spnego); + + /* Server negTokenInit (mech offerings) */ + spnego.type = SPNEGO_NEG_TOKEN_INIT; + spnego.negTokenInit.mechTypes = smb_xmalloc(sizeof(char *) * 2); + spnego.negTokenInit.mechTypes[0] = smb_xstrdup(OID_NTLMSSP); + spnego.negTokenInit.mechTypes[1] = NULL; + + ZERO_STRUCT(asn1); + asn1_push_tag(&asn1, ASN1_SEQUENCE(0)); + asn1_push_tag(&asn1, ASN1_CONTEXT(0)); + asn1_write_GeneralString(&asn1, "NONE"); + asn1_pop_tag(&asn1); + asn1_pop_tag(&asn1); + spnego.negTokenInit.mechListMIC = data_blob(asn1.data, asn1.length); + asn1_free(&asn1); + + len = write_spnego_data(&token, &spnego); + free_spnego_data(&spnego); + + if (len == -1) { + DEBUG(1, ("Could not write SPNEGO data blob\n")); + x_fprintf(x_stdout, "BH\n"); + return; + } + + reply_base64 = base64_encode_data_blob(token); + x_fprintf(x_stdout, "TT %s *\n", reply_base64); + + SAFE_FREE(reply_base64); + data_blob_free(&token); + DEBUG(10, ("sent SPNEGO negTokenInit\n")); + return; +} + +static void manage_gss_spnego_request(enum squid_mode squid_mode, + char *buf, int length) +{ + static NTLMSSP_STATE *ntlmssp_state = NULL; + SPNEGO_DATA spnego; + DATA_BLOB request, token; + NTSTATUS status; + ssize_t len; + + const char *reply_code; + char *reply_base64; + pstring reply_argument; + + if (strlen(buf) < 2) { + + if (ntlmssp_state != NULL) { + DEBUG(1, ("Request for initial SPNEGO request where " + "we already have a state\n")); + x_fprintf(x_stdout, "BH\n"); + return; + } + + DEBUG(1, ("NTLMSSP query [%s] invalid", buf)); + x_fprintf(x_stdout, "BH\n"); + return; + } + + if ( (strlen(buf) == 2) && (strcmp(buf, "YR") == 0) ) { + + /* Initial request, get the negTokenInit offering + mechanisms */ + + offer_gss_spnego_mechs(); + return; + } + + /* All subsequent requests are "KK" (Knock, Knock ;)) and have + a blob. This might be negTokenInit or negTokenTarg */ + + if ( (strlen(buf) <= 3) || (strncmp(buf, "KK", 2) != 0) ) { + DEBUG(1, ("GSS-SPNEGO query [%s] invalid\n", buf)); + x_fprintf(x_stdout, "BH\n"); + return; + } + + request = base64_decode_data_blob(buf + 3); + len = read_spnego_data(request, &spnego); + data_blob_free(&request); + + if (len == -1) { + DEBUG(1, ("GSS-SPNEGO query [%s] invalid", buf)); + x_fprintf(x_stdout, "BH\n"); + return; + } + + if (spnego.type == SPNEGO_NEG_TOKEN_INIT) { + + /* Second request from Client. This is where the + client offers its mechanism to use. We currently + only support NTLMSSP, the decision for Kerberos + would be taken here. */ + + if ( (spnego.negTokenInit.mechTypes == NULL) || + (spnego.negTokenInit.mechTypes[0] == NULL) ) { + DEBUG(1, ("Client did not offer any mechanism")); + x_fprintf(x_stdout, "BH\n"); + return; + } + + if ( strcmp(spnego.negTokenInit.mechTypes[0], OID_NTLMSSP) != 0 ) { + DEBUG(1, ("Client did not choose NTLMSSP but %s\n", + spnego.negTokenInit.mechTypes[0])); + x_fprintf(x_stdout, "BH\n"); + return; + } + + if ( spnego.negTokenInit.mechToken.data == NULL ) { + DEBUG(1, ("Client did not provide NTLMSSP data\n")); + x_fprintf(x_stdout, "BH\n"); + return; + } + + if ( ntlmssp_state != NULL ) { + DEBUG(1, ("Client wants a new NTLMSSP challenge, but " + "already got one\n")); + x_fprintf(x_stdout, "BH\n"); + ntlmssp_server_end(&ntlmssp_state); + return; + } + + ntlmssp_server_start(&ntlmssp_state); + ntlmssp_state->check_password = winbind_pw_check; + ntlmssp_state->get_domain = get_winbind_domain; + ntlmssp_state->get_global_myname = get_winbind_netbios_name; + + DEBUG(10, ("got NTLMSSP packet:\n")); + dump_data(10, spnego.negTokenInit.mechToken.data, + spnego.negTokenInit.mechToken.length); + + free_spnego_data(&spnego); + + spnego.type = SPNEGO_NEG_TOKEN_TARG; + spnego.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE; + spnego.negTokenTarg.supportedMech = strdup(OID_NTLMSSP); + + status = ntlmssp_server_update(ntlmssp_state, + spnego.negTokenInit.mechToken, + &spnego.negTokenTarg.responseToken); + + } else { + + /* spnego.type == SPNEGO_NEG_TOKEN_TARG */ + + DATA_BLOB response; + + if (spnego.negTokenTarg.responseToken.data == NULL) { + DEBUG(1, ("Got a negTokenArg without a responseToken!\n")); + x_fprintf(x_stdout, "BH\n"); + return; + } + + status = ntlmssp_server_update(ntlmssp_state, + spnego.negTokenTarg.responseToken, + &response); + + data_blob_free(&spnego.negTokenTarg.responseToken); + + spnego.negTokenTarg.responseToken = response; + + } + + if (NT_STATUS_IS_OK(status)) { + spnego.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED; + reply_code = "AF"; + pstr_sprintf(reply_argument, "%s\\%s", + ntlmssp_state->domain, ntlmssp_state->user); + } else if (NT_STATUS_EQUAL(status, + NT_STATUS_MORE_PROCESSING_REQUIRED)) { + spnego.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE; + reply_code = "TT"; + pstr_sprintf(reply_argument, "*"); + } else { + spnego.negTokenTarg.negResult = SPNEGO_REJECT; + reply_code = "NA"; + pstrcpy(reply_argument, nt_errstr(status)); + } + + len = write_spnego_data(&token, &spnego); + free_spnego_data(&spnego); + + if (len == -1) { + DEBUG(1, ("Could not write SPNEGO data blob\n")); + x_fprintf(x_stdout, "BH\n"); + return; + } + + reply_base64 = base64_encode_data_blob(token); + + x_fprintf(x_stdout, "%s %s %s\n", + reply_code, reply_base64, reply_argument); + + SAFE_FREE(reply_base64); + data_blob_free(&token); + + if (NT_STATUS_IS_OK(status)) { + ntlmssp_server_end(&ntlmssp_state); + } + + return; +} + +static NTLMSSP_CLIENT_STATE *client_ntlmssp_state = NULL; + +static void manage_client_ntlmssp_init(SPNEGO_DATA spnego) +{ + NTSTATUS status; + DATA_BLOB null_blob = data_blob(NULL, 0); + DATA_BLOB to_server; + char *to_server_base64; + const char *my_mechs[] = {OID_NTLMSSP, NULL}; + + DEBUG(10, ("Got spnego negTokenInit with NTLMSSP\n")); + + if (client_ntlmssp_state != NULL) { + DEBUG(1, ("Request for initial SPNEGO request where " + "we already have a state\n")); + x_fprintf(x_stdout, "BH\n"); + return; + } + + if ( (opt_username == NULL) || (opt_domain == NULL) ) { + DEBUG(1, ("Need username and domain for NTLMSSP\n")); + x_fprintf(x_stdout, "BH\n"); + return; + } + + if (opt_password == NULL) { + + /* Request a password from the calling process. After + sending it, the calling process should retry with + the negTokenInit. */ + + DEBUG(10, ("Requesting password\n")); + x_fprintf(x_stdout, "PW\n"); + return; + } + + status = ntlmssp_client_start(&client_ntlmssp_state); + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1, ("Could not start NTLMSSP client: %s\n", + nt_errstr(status))); + x_fprintf(x_stdout, "BH\n"); + ntlmssp_client_end(&client_ntlmssp_state); + return; + } + + status = ntlmssp_set_username(client_ntlmssp_state, opt_username); + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1, ("Could not set username: %s\n", + nt_errstr(status))); + x_fprintf(x_stdout, "BH\n"); + ntlmssp_client_end(&client_ntlmssp_state); + return; + } + + status = ntlmssp_set_domain(client_ntlmssp_state, opt_domain); + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1, ("Could not set domain: %s\n", + nt_errstr(status))); + x_fprintf(x_stdout, "BH\n"); + ntlmssp_client_end(&client_ntlmssp_state); + return; + } + + status = ntlmssp_set_password(client_ntlmssp_state, opt_password); + + if (!NT_STATUS_IS_OK(status)) { + DEBUG(1, ("Could not set password: %s\n", + nt_errstr(status))); + x_fprintf(x_stdout, "BH\n"); + ntlmssp_client_end(&client_ntlmssp_state); + return; + } + + spnego.type = SPNEGO_NEG_TOKEN_INIT; + spnego.negTokenInit.mechTypes = my_mechs; + spnego.negTokenInit.reqFlags = 0; + spnego.negTokenInit.mechListMIC = null_blob; + + status = ntlmssp_client_update(client_ntlmssp_state, null_blob, + &spnego.negTokenInit.mechToken); + + if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { + DEBUG(1, ("Expected MORE_PROCESSING_REQUIRED, got: %s\n", + nt_errstr(status))); + x_fprintf(x_stdout, "BH\n"); + ntlmssp_client_end(&client_ntlmssp_state); + return; + } + + write_spnego_data(&to_server, &spnego); + data_blob_free(&spnego.negTokenInit.mechToken); + + to_server_base64 = base64_encode_data_blob(to_server); + data_blob_free(&to_server); + x_fprintf(x_stdout, "KK %s\n", to_server_base64); + SAFE_FREE(to_server_base64); + return; +} + +static void manage_client_ntlmssp_targ(SPNEGO_DATA spnego) +{ + NTSTATUS status; + DATA_BLOB null_blob = data_blob(NULL, 0); + DATA_BLOB request; + DATA_BLOB to_server; + char *to_server_base64; + + DEBUG(10, ("Got spnego negTokenTarg with NTLMSSP\n")); + + if (client_ntlmssp_state == NULL) { + DEBUG(1, ("Got NTLMSSP tArg without a client state\n")); + x_fprintf(x_stdout, "BH\n"); + ntlmssp_client_end(&client_ntlmssp_state); + return; + } + + if (spnego.negTokenTarg.negResult == SPNEGO_REJECT) { + x_fprintf(x_stdout, "NA\n"); + ntlmssp_client_end(&client_ntlmssp_state); + return; + } + + if (spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_COMPLETED) { + x_fprintf(x_stdout, "AF\n"); + ntlmssp_client_end(&client_ntlmssp_state); + return; + } + + status = ntlmssp_client_update(client_ntlmssp_state, + spnego.negTokenTarg.responseToken, + &request); + + if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { + DEBUG(1, ("Expected MORE_PROCESSING_REQUIRED from " + "ntlmssp_client_update, got: %s\n", + nt_errstr(status))); + x_fprintf(x_stdout, "BH\n"); + data_blob_free(&request); + ntlmssp_client_end(&client_ntlmssp_state); + return; + } + + spnego.type = SPNEGO_NEG_TOKEN_TARG; + spnego.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE; + spnego.negTokenTarg.supportedMech = OID_NTLMSSP; + spnego.negTokenTarg.responseToken = request; + spnego.negTokenTarg.mechListMIC = null_blob; + + write_spnego_data(&to_server, &spnego); + data_blob_free(&request); + + to_server_base64 = base64_encode_data_blob(to_server); + data_blob_free(&to_server); + x_fprintf(x_stdout, "KK %s\n", to_server_base64); + SAFE_FREE(to_server_base64); + return; +} + +static void manage_client_krb5_init(SPNEGO_DATA spnego) +{ + DEBUG(1, ("to be done ... \n")); + x_fprintf(x_stdout, "BH\n"); + return; +} + +static void manage_client_krb5_targ(SPNEGO_DATA spnego) +{ + DEBUG(1, ("Got a negTokenTarg with a Kerberos token. This should not " + "happen!\n")); + x_fprintf(x_stdout, "BH\n"); + return; +} + +static void manage_gss_spnego_client_request(enum squid_mode squid_mode, + char *buf, int length) +{ + DATA_BLOB request; + SPNEGO_DATA spnego; + ssize_t len; + + if (strlen(buf) <= 3) { + DEBUG(1, ("SPNEGO query [%s] too short\n", buf)); + x_fprintf(x_stdout, "BH\n"); + return; + } + + request = base64_decode_data_blob(buf+3); + + if (strncmp(buf, "PW ", 3) == 0) { + + /* We asked for a password and obviously got it :-) */ + + opt_password = strndup(request.data, request.length); + + if (opt_password == NULL) { + DEBUG(1, ("Out of memory\n")); + x_fprintf(x_stdout, "BH\n"); + data_blob_free(&request); + return; + } + + x_fprintf(x_stdout, "OK\n"); + data_blob_free(&request); + return; + } + + if ( (strncmp(buf, "TT ", 3) != 0) && + (strncmp(buf, "AF ", 3) != 0) && + (strncmp(buf, "NA ", 3) != 0) ) { + DEBUG(1, ("SPNEGO request [%s] invalid\n", buf)); + x_fprintf(x_stdout, "BH\n"); + data_blob_free(&request); + return; + } + + /* So we got a server challenge to generate a SPNEGO + client-to-server request... */ + + len = read_spnego_data(request, &spnego); + data_blob_free(&request); + + if (len == -1) { + DEBUG(1, ("Could not read SPNEGO data for [%s]\n", buf)); + x_fprintf(x_stdout, "BH\n"); + return; + } + + if (spnego.type == SPNEGO_NEG_TOKEN_INIT) { + + /* The server offers a list of mechanisms */ + + const char **mechType = spnego.negTokenInit.mechTypes; + + while (*mechType != NULL) { + + if (strcmp(*mechType, OID_NTLMSSP) == 0) { + manage_client_ntlmssp_init(spnego); + goto out; + } + + if (strcmp(*mechType, OID_KERBEROS5_OLD) == 0) { + manage_client_krb5_init(spnego); + goto out; + } + + mechType++; + } + + DEBUG(1, ("Server offered no compatible mechanism\n")); + x_fprintf(x_stdout, "BH\n"); + return; + } + + if (spnego.type == SPNEGO_NEG_TOKEN_TARG) { + + if (strcmp(spnego.negTokenTarg.supportedMech, + OID_NTLMSSP) == 0) { + manage_client_ntlmssp_targ(spnego); + goto out; + } + + if (strcmp(spnego.negTokenTarg.supportedMech, + OID_KERBEROS5_OLD) == 0) { + manage_client_krb5_targ(spnego); + goto out; + } + + } + + DEBUG(1, ("Got an SPNEGO token I could not handle [%s]!\n", buf)); + x_fprintf(x_stdout, "BH\n"); + return; + + out: + free_spnego_data(&spnego); + return; +} + static void manage_squid_request(enum squid_mode squid_mode) { char buf[SQUID_BUFFER_SIZE+1]; @@ -383,6 +880,10 @@ static void manage_squid_request(enum squid_mode squid_mode) manage_squid_basic_request(squid_mode, buf, length); } else if (squid_mode == SQUID_2_5_NTLMSSP) { manage_squid_ntlmssp_request(squid_mode, buf, length); + } else if (squid_mode == GSS_SPNEGO) { + manage_gss_spnego_request(squid_mode, buf, length); + } else if (squid_mode == GSS_SPNEGO_CLIENT) { + manage_gss_spnego_client_request(squid_mode, buf, length); } } @@ -1334,6 +1835,10 @@ enum { squid_stream(SQUID_2_5_BASIC); } else if (strcmp(helper_protocol, "squid-2.4-basic")== 0) { squid_stream(SQUID_2_4_BASIC); + } else if (strcmp(helper_protocol, "gss-spnego")== 0) { + squid_stream(GSS_SPNEGO); + } else if (strcmp(helper_protocol, "gss-spnego-client") == 0) { + squid_stream(GSS_SPNEGO_CLIENT); } else { x_fprintf(x_stderr, "unknown helper protocol [%s]\n", helper_protocol); exit(1); @@ -1372,7 +1877,7 @@ enum { } else { fstring user; - snprintf(user, sizeof(user)-1, "%s%c%s", opt_domain, winbind_separator(), opt_username); + fstr_sprintf(user, "%s%c%s", opt_domain, winbind_separator(), opt_username); if (!check_plaintext_auth(user, opt_password, True)) { exit(1); } diff --git a/source3/utils/pdbedit.c b/source3/utils/pdbedit.c index 96d0d3c057..0f1f6edf08 100644 --- a/source3/utils/pdbedit.c +++ b/source3/utils/pdbedit.c @@ -51,21 +51,6 @@ #define MASK_ALWAYS_GOOD 0x0000001F #define MASK_USER_GOOD 0x00401F00 -/***************************************************************************** - stubb functions -****************************************************************************/ - -void become_root( void ) -{ - return; -} - -void unbecome_root( void ) -{ - return; -} - - /********************************************************* Add all currently available users to another db ********************************************************/ @@ -176,16 +161,17 @@ static int print_sam_info (SAM_ACCOUNT *sam_pwent, BOOL verbosity, BOOL smbpwdst pdb_sethexpwd(lm_passwd, pdb_get_lanman_passwd(sam_pwent), pdb_get_acct_ctrl(sam_pwent)); pdb_sethexpwd(nt_passwd, pdb_get_nt_passwd(sam_pwent), pdb_get_acct_ctrl(sam_pwent)); - printf("%s:%d:%s:%s:%s:LCT-%08X:\n", + printf("%s:%lu:%s:%s:%s:LCT-%08X:\n", pdb_get_username(sam_pwent), - uid, + (unsigned long)uid, lm_passwd, nt_passwd, pdb_encode_acct_ctrl(pdb_get_acct_ctrl(sam_pwent),NEW_PW_FORMAT_SPACE_PADDED_LEN), (uint32)pdb_get_pass_last_set_time(sam_pwent)); } else { uid = nametouid(pdb_get_username(sam_pwent)); - printf ("%s:%d:%s\n", pdb_get_username(sam_pwent), uid, pdb_get_fullname(sam_pwent)); + printf ("%s:%lu:%s\n", pdb_get_username(sam_pwent), (unsigned long)uid, + pdb_get_fullname(sam_pwent)); } return 0; diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c index 69dc2dd47a..c90c042106 100644 --- a/source3/utils/smbcacls.c +++ b/source3/utils/smbcacls.c @@ -724,7 +724,8 @@ static struct cli_state *connect_one(const char *share) &ip, 0, share, "?????", cmdline_auth_info.username, lp_workgroup(), - cmdline_auth_info.password, 0, NULL))) { + cmdline_auth_info.password, 0, + cmdline_auth_info.signing_state, NULL))) { return c; } else { DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); diff --git a/source3/utils/smbcontrol.c b/source3/utils/smbcontrol.c index b7333f2317..190627e2a5 100644 --- a/source3/utils/smbcontrol.c +++ b/source3/utils/smbcontrol.c @@ -591,12 +591,6 @@ static const struct { { NULL } }; -/* Yuck - we need these because we link to printing*.o even though - they aren't used. */ - -void become_root(void) {} -void unbecome_root(void) {} - /* Display usage information */ static void usage(poptContext *pc) diff --git a/source3/utils/smbcquotas.c b/source3/utils/smbcquotas.c index 9c7379ca2a..64321d5bfc 100644 --- a/source3/utils/smbcquotas.c +++ b/source3/utils/smbcquotas.c @@ -371,7 +371,8 @@ static struct cli_state *connect_one(const char *share) &ip, 0, share, "?????", cmdline_auth_info.username, lp_workgroup(), - cmdline_auth_info.password, 0, NULL))) { + cmdline_auth_info.password, 0, + cmdline_auth_info.signing_state, NULL))) { return c; } else { DEBUG(0,("cli_full_connection failed! (%s)\n", nt_errstr(nt_status))); diff --git a/source3/utils/smbpasswd.c b/source3/utils/smbpasswd.c index eade5331af..6ab6d35e73 100644 --- a/source3/utils/smbpasswd.c +++ b/source3/utils/smbpasswd.c @@ -37,21 +37,6 @@ static const char *remote_machine = NULL; static fstring ldap_secret; -/***************************************************************************** - stubb functions -****************************************************************************/ - -void become_root( void ) -{ - return; -} - -void unbecome_root( void ) -{ - return; -} - - /********************************************************* Print command usage on stderr and die. **********************************************************/ diff --git a/source3/utils/status.c b/source3/utils/status.c index bbaeecdd6b..8bf67fc4d6 100644 --- a/source3/utils/status.c +++ b/source3/utils/status.c @@ -45,11 +45,6 @@ static int locks_only = 0; /* Added by RJS */ static BOOL processes_only=False; static int show_brl; -/* we need these because we link to locking*.o */ - void become_root(void) {} - void unbecome_root(void) {} - - /* added by OH */ static void Ucrit_addUsername(const char *username) { diff --git a/source3/web/statuspage.c b/source3/web/statuspage.c index 44461232b8..c579e8f112 100644 --- a/source3/web/statuspage.c +++ b/source3/web/statuspage.c @@ -93,7 +93,7 @@ static char *mapPid2Machine (pid_t pid) } /* PID not in list or machine name NULL? return pid as string */ - snprintf (pidbuf, sizeof (pidbuf) - 1, "%d", pid); + snprintf (pidbuf, sizeof (pidbuf) - 1, "%lu", (unsigned long)pid); return pidbuf; } diff --git a/source3/web/swat.c b/source3/web/swat.c index d97278c485..a1c132a088 100644 --- a/source3/web/swat.c +++ b/source3/web/swat.c @@ -51,10 +51,6 @@ static int iNumNonAutoPrintServices = 0; #define ENABLE_USER_FLAG "enable_user_flag" #define RHOST "remote_host" -/* we need these because we link to locking*.o */ - void become_root(void) {} - void unbecome_root(void) {} - /**************************************************************************** ****************************************************************************/ static int enum_index(int value, const struct enum_list *enumlist) @@ -168,12 +164,12 @@ static const char* get_parm_translated( static pstring output; if(strcmp(pLabel, pTranslated) != 0) { - snprintf(output, sizeof(output), + pstr_sprintf(output, " %s       %s
    %s", pAnchor, pHelp, pLabel, pTranslated); return output; } - snprintf(output, sizeof(output), + pstr_sprintf(output, " %s       %s", pAnchor, pHelp, pLabel); return output; @@ -316,9 +312,10 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte if (printers & !(parm->flags & FLAG_PRINT)) continue; if (!printers & !(parm->flags & FLAG_SHARE)) continue; } - if (parm_filter == FLAG_BASIC) { + + if (!( parm_filter & FLAG_ADVANCED )) { if (!(parm->flags & FLAG_BASIC)) { - void *ptr = parm->ptr; + void *ptr = parm->ptr; if (parm->class == P_LOCAL && snum >= 0) { ptr = lp_local_ptr(snum, ptr); @@ -359,16 +356,15 @@ static void show_parameters(int snum, int allparameters, unsigned int parm_filte break; case P_SEP: continue; - } + } } if (printers && !(parm->flags & FLAG_PRINT)) continue; } - if (parm_filter == FLAG_WIZARD) { - if (!((parm->flags & FLAG_WIZARD))) continue; - } - if (parm_filter == FLAG_ADVANCED) { - if (!((parm->flags & FLAG_ADVANCED))) continue; - } + + if ((parm_filter & FLAG_WIZARD) && !(parm->flags & FLAG_WIZARD)) continue; + + if ((parm_filter & FLAG_ADVANCED) && !(parm->flags & FLAG_ADVANCED)) continue; + if (heading && heading != last_heading) { d_printf("
    %s
    \n"); + if ( cgi_variable("ViewMode") ) mode = atoi(cgi_variable("ViewMode")); + if ( cgi_variable("BasicMode")) + mode = 0; + if ( cgi_variable("AdvMode")) + mode = 1; + ViewModeBoxes( mode ); switch ( mode ) { case 0: @@ -864,9 +869,6 @@ static void shares_page(void) case 1: parm_filter = FLAG_ADVANCED; break; - case 2: - parm_filter = FLAG_DEVELOPER; - break; } d_printf("
    \n"); d_printf("\n", _("Choose Share")); @@ -1196,6 +1198,11 @@ static void printers_page(void) if ( cgi_variable("ViewMode") ) mode = atoi(cgi_variable("ViewMode")); + if ( cgi_variable("BasicMode")) + mode = 0; + if ( cgi_variable("AdvMode")) + mode = 1; + ViewModeBoxes( mode ); switch ( mode ) { case 0: @@ -1204,9 +1211,6 @@ static void printers_page(void) case 1: parm_filter = FLAG_ADVANCED; break; - case 2: - parm_filter = FLAG_DEVELOPER; - break; } d_printf("
    \n"); d_printf("\n", _("Choose Printer")); -- cgit From a50367ee119d0acf1bcaaf93f8c6fcc8fa68c999 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 19 Aug 2003 21:42:58 +0000 Subject: removing using_samba docs from samba cvs module (not are in a separate cvs module) (This used to be commit 4729e9cd52519c06c4be857d77bbccc2688b3cea) --- docs/htmldocs/using_samba/appa_01.html | 153 -- docs/htmldocs/using_samba/appa_02.html | 100 - docs/htmldocs/using_samba/appa_03.html | 325 --- docs/htmldocs/using_samba/appa_04.html | 135 -- docs/htmldocs/using_samba/appa_05.html | 460 ---- docs/htmldocs/using_samba/appb_01.html | 162 -- docs/htmldocs/using_samba/appb_02.html | 342 --- docs/htmldocs/using_samba/appb_03.html | 876 ------- docs/htmldocs/using_samba/appc_01.html | 3497 --------------------------- docs/htmldocs/using_samba/appd_01.html | 1907 --------------- docs/htmldocs/using_samba/appe_01.html | 96 - docs/htmldocs/using_samba/appf_01.html | 315 --- docs/htmldocs/using_samba/ch01_01.html | 167 -- docs/htmldocs/using_samba/ch01_02.html | 212 -- docs/htmldocs/using_samba/ch01_03.html | 444 ---- docs/htmldocs/using_samba/ch01_04.html | 277 --- docs/htmldocs/using_samba/ch01_05.html | 130 - docs/htmldocs/using_samba/ch01_06.html | 90 - docs/htmldocs/using_samba/ch01_07.html | 138 -- docs/htmldocs/using_samba/ch01_08.html | 89 - docs/htmldocs/using_samba/ch02_01.html | 197 -- docs/htmldocs/using_samba/ch02_02.html | 338 --- docs/htmldocs/using_samba/ch02_03.html | 235 -- docs/htmldocs/using_samba/ch02_04.html | 186 -- docs/htmldocs/using_samba/ch02_05.html | 195 -- docs/htmldocs/using_samba/ch02_06.html | 108 - docs/htmldocs/using_samba/ch03_01.html | 277 --- docs/htmldocs/using_samba/ch03_02.html | 260 -- docs/htmldocs/using_samba/ch03_03.html | 579 ----- docs/htmldocs/using_samba/ch04_01.html | 415 ---- docs/htmldocs/using_samba/ch04_02.html | 211 -- docs/htmldocs/using_samba/ch04_03.html | 190 -- docs/htmldocs/using_samba/ch04_04.html | 214 -- docs/htmldocs/using_samba/ch04_05.html | 309 --- docs/htmldocs/using_samba/ch04_06.html | 414 ---- docs/htmldocs/using_samba/ch04_07.html | 151 -- docs/htmldocs/using_samba/ch04_08.html | 423 ---- docs/htmldocs/using_samba/ch05_01.html | 786 ------ docs/htmldocs/using_samba/ch05_02.html | 429 ---- docs/htmldocs/using_samba/ch05_03.html | 426 ---- docs/htmldocs/using_samba/ch05_04.html | 433 ---- docs/htmldocs/using_samba/ch05_05.html | 399 --- docs/htmldocs/using_samba/ch06_01.html | 221 -- docs/htmldocs/using_samba/ch06_02.html | 423 ---- docs/htmldocs/using_samba/ch06_03.html | 384 --- docs/htmldocs/using_samba/ch06_04.html | 738 ------ docs/htmldocs/using_samba/ch06_05.html | 333 --- docs/htmldocs/using_samba/ch06_06.html | 537 ---- docs/htmldocs/using_samba/ch07_01.html | 565 ----- docs/htmldocs/using_samba/ch07_02.html | 757 ------ docs/htmldocs/using_samba/ch07_03.html | 404 ---- docs/htmldocs/using_samba/ch08_01.html | 267 -- docs/htmldocs/using_samba/ch08_02.html | 156 -- docs/htmldocs/using_samba/ch08_03.html | 472 ---- docs/htmldocs/using_samba/ch08_04.html | 168 -- docs/htmldocs/using_samba/ch08_05.html | 396 --- docs/htmldocs/using_samba/ch08_06.html | 509 ---- docs/htmldocs/using_samba/ch08_07.html | 143 -- docs/htmldocs/using_samba/ch09_01.html | 397 --- docs/htmldocs/using_samba/ch09_02.html | 1772 -------------- docs/htmldocs/using_samba/ch09_03.html | 136 -- docs/htmldocs/using_samba/figs/sam.0101.gif | Bin 9850 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0102.gif | Bin 10938 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0103.gif | Bin 5823 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0104.gif | Bin 20973 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0105.gif | Bin 11432 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0106.gif | Bin 4658 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0107.gif | Bin 10347 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0108.gif | Bin 21228 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0109.gif | Bin 21762 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0110.gif | Bin 6227 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0111.gif | Bin 8247 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0112.gif | Bin 13955 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0113.gif | Bin 12108 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0114.gif | Bin 24643 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0201.gif | Bin 5401 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0202.gif | Bin 21864 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0203.gif | Bin 19066 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0204.gif | Bin 13719 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0301.gif | Bin 11604 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0302.gif | Bin 12184 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0303.gif | Bin 4121 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0304.gif | Bin 4872 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0305.gif | Bin 14146 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0306.gif | Bin 8055 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0307.gif | Bin 12529 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0308.gif | Bin 16162 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0309.gif | Bin 11689 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0310.gif | Bin 12693 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0311.gif | Bin 13347 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0312.gif | Bin 9694 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0313.gif | Bin 10215 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0314.gif | Bin 5199 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0315.gif | Bin 5979 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0316.gif | Bin 9579 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0317.gif | Bin 14849 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0318.gif | Bin 9998 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0319.gif | Bin 10874 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0320.gif | Bin 10919 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0321.gif | Bin 10805 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0322.gif | Bin 15031 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0323.gif | Bin 13656 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0324.gif | Bin 11731 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0325.gif | Bin 14093 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0326.gif | Bin 7093 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0327.gif | Bin 5959 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0328.gif | Bin 7816 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0401.gif | Bin 8351 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0402.gif | Bin 8591 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0403.gif | Bin 9284 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0404.gif | Bin 5239 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0405.gif | Bin 6754 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0406.gif | Bin 5708 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0407.gif | Bin 10212 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0501.gif | Bin 15642 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0502.gif | Bin 7757 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0503.gif | Bin 8100 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0504.gif | Bin 7238 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0505.gif | Bin 7634 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0506.gif | Bin 13586 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0507.gif | Bin 8965 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0508.gif | Bin 15146 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0601.gif | Bin 10033 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0602.gif | Bin 9024 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0603.gif | Bin 6005 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0604.gif | Bin 12210 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0605.gif | Bin 13525 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0606.gif | Bin 16887 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0701.gif | Bin 5898 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0702.gif | Bin 3723 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0703.gif | Bin 13047 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0704.gif | Bin 7515 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0705.gif | Bin 10366 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0706.gif | Bin 25083 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0707.gif | Bin 11071 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0708.gif | Bin 7773 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0709.gif | Bin 14114 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0801.gif | Bin 12132 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0802.gif | Bin 15299 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0803.gif | Bin 9690 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0804.gif | Bin 11211 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0805.gif | Bin 11927 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0901.gif | Bin 16309 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0902.gif | Bin 26399 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0903.gif | Bin 18573 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0904.gif | Bin 8977 -> 0 bytes docs/htmldocs/using_samba/figs/sam.0905.gif | Bin 8062 -> 0 bytes docs/htmldocs/using_samba/figs/sam.aa01.gif | Bin 15078 -> 0 bytes docs/htmldocs/using_samba/figs/sam.ab01.gif | Bin 10028 -> 0 bytes docs/htmldocs/using_samba/figs/sam.ab02.gif | Bin 8422 -> 0 bytes docs/htmldocs/using_samba/gifs/index.gif | Bin 565 -> 0 bytes docs/htmldocs/using_samba/gifs/samba.s.gif | Bin 6284 -> 0 bytes docs/htmldocs/using_samba/gifs/txthome.gif | Bin 320 -> 0 bytes docs/htmldocs/using_samba/gifs/txtnexta.gif | Bin 419 -> 0 bytes docs/htmldocs/using_samba/gifs/txtpreva.gif | Bin 588 -> 0 bytes docs/htmldocs/using_samba/index.html | 168 -- docs/htmldocs/using_samba/inx.html | 1344 ---------- docs/htmldocs/using_samba/licenseinfo.html | 181 -- docs/htmldocs/using_samba/this_edition.html | 48 - 159 files changed, 27609 deletions(-) delete mode 100644 docs/htmldocs/using_samba/appa_01.html delete mode 100644 docs/htmldocs/using_samba/appa_02.html delete mode 100644 docs/htmldocs/using_samba/appa_03.html delete mode 100644 docs/htmldocs/using_samba/appa_04.html delete mode 100644 docs/htmldocs/using_samba/appa_05.html delete mode 100644 docs/htmldocs/using_samba/appb_01.html delete mode 100644 docs/htmldocs/using_samba/appb_02.html delete mode 100644 docs/htmldocs/using_samba/appb_03.html delete mode 100644 docs/htmldocs/using_samba/appc_01.html delete mode 100644 docs/htmldocs/using_samba/appd_01.html delete mode 100644 docs/htmldocs/using_samba/appe_01.html delete mode 100644 docs/htmldocs/using_samba/appf_01.html delete mode 100644 docs/htmldocs/using_samba/ch01_01.html delete mode 100644 docs/htmldocs/using_samba/ch01_02.html delete mode 100644 docs/htmldocs/using_samba/ch01_03.html delete mode 100644 docs/htmldocs/using_samba/ch01_04.html delete mode 100644 docs/htmldocs/using_samba/ch01_05.html delete mode 100644 docs/htmldocs/using_samba/ch01_06.html delete mode 100644 docs/htmldocs/using_samba/ch01_07.html delete mode 100644 docs/htmldocs/using_samba/ch01_08.html delete mode 100644 docs/htmldocs/using_samba/ch02_01.html delete mode 100644 docs/htmldocs/using_samba/ch02_02.html delete mode 100644 docs/htmldocs/using_samba/ch02_03.html delete mode 100644 docs/htmldocs/using_samba/ch02_04.html delete mode 100644 docs/htmldocs/using_samba/ch02_05.html delete mode 100644 docs/htmldocs/using_samba/ch02_06.html delete mode 100644 docs/htmldocs/using_samba/ch03_01.html delete mode 100644 docs/htmldocs/using_samba/ch03_02.html delete mode 100644 docs/htmldocs/using_samba/ch03_03.html delete mode 100644 docs/htmldocs/using_samba/ch04_01.html delete mode 100644 docs/htmldocs/using_samba/ch04_02.html delete mode 100644 docs/htmldocs/using_samba/ch04_03.html delete mode 100644 docs/htmldocs/using_samba/ch04_04.html delete mode 100644 docs/htmldocs/using_samba/ch04_05.html delete mode 100644 docs/htmldocs/using_samba/ch04_06.html delete mode 100644 docs/htmldocs/using_samba/ch04_07.html delete mode 100644 docs/htmldocs/using_samba/ch04_08.html delete mode 100644 docs/htmldocs/using_samba/ch05_01.html delete mode 100644 docs/htmldocs/using_samba/ch05_02.html delete mode 100644 docs/htmldocs/using_samba/ch05_03.html delete mode 100644 docs/htmldocs/using_samba/ch05_04.html delete mode 100644 docs/htmldocs/using_samba/ch05_05.html delete mode 100644 docs/htmldocs/using_samba/ch06_01.html delete mode 100644 docs/htmldocs/using_samba/ch06_02.html delete mode 100644 docs/htmldocs/using_samba/ch06_03.html delete mode 100644 docs/htmldocs/using_samba/ch06_04.html delete mode 100644 docs/htmldocs/using_samba/ch06_05.html delete mode 100644 docs/htmldocs/using_samba/ch06_06.html delete mode 100644 docs/htmldocs/using_samba/ch07_01.html delete mode 100644 docs/htmldocs/using_samba/ch07_02.html delete mode 100644 docs/htmldocs/using_samba/ch07_03.html delete mode 100644 docs/htmldocs/using_samba/ch08_01.html delete mode 100644 docs/htmldocs/using_samba/ch08_02.html delete mode 100644 docs/htmldocs/using_samba/ch08_03.html delete mode 100644 docs/htmldocs/using_samba/ch08_04.html delete mode 100644 docs/htmldocs/using_samba/ch08_05.html delete mode 100644 docs/htmldocs/using_samba/ch08_06.html delete mode 100644 docs/htmldocs/using_samba/ch08_07.html delete mode 100644 docs/htmldocs/using_samba/ch09_01.html delete mode 100644 docs/htmldocs/using_samba/ch09_02.html delete mode 100644 docs/htmldocs/using_samba/ch09_03.html delete mode 100644 docs/htmldocs/using_samba/figs/sam.0101.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0102.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0103.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0104.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0105.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0106.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0107.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0108.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0109.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0110.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0111.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0112.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0113.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0114.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0201.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0202.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0203.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0204.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0301.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0302.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0303.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0304.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0305.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0306.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0307.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0308.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0309.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0310.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0311.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0312.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0313.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0314.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0315.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0316.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0317.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0318.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0319.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0320.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0321.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0322.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0323.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0324.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0325.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0326.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0327.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0328.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0401.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0402.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0403.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0404.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0405.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0406.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0407.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0501.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0502.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0503.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0504.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0505.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0506.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0507.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0508.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0601.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0602.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0603.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0604.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0605.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0606.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0701.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0702.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0703.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0704.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0705.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0706.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0707.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0708.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0709.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0801.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0802.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0803.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0804.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0805.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0901.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0902.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0903.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0904.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.0905.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.aa01.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.ab01.gif delete mode 100644 docs/htmldocs/using_samba/figs/sam.ab02.gif delete mode 100644 docs/htmldocs/using_samba/gifs/index.gif delete mode 100644 docs/htmldocs/using_samba/gifs/samba.s.gif delete mode 100644 docs/htmldocs/using_samba/gifs/txthome.gif delete mode 100644 docs/htmldocs/using_samba/gifs/txtnexta.gif delete mode 100644 docs/htmldocs/using_samba/gifs/txtpreva.gif delete mode 100644 docs/htmldocs/using_samba/index.html delete mode 100644 docs/htmldocs/using_samba/inx.html delete mode 100644 docs/htmldocs/using_samba/licenseinfo.html delete mode 100644 docs/htmldocs/using_samba/this_edition.html diff --git a/docs/htmldocs/using_samba/appa_01.html b/docs/htmldocs/using_samba/appa_01.html deleted file mode 100644 index 30080dffbf..0000000000 --- a/docs/htmldocs/using_samba/appa_01.html +++ /dev/null @@ -1,153 +0,0 @@ - - - -[Appendix A] Configuring Samba with SSL - -
    - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 9.3 Extra Resources - - -Appendix A - -Next: A.2 Requirements
     
    -
    -
    -
    -

    - -A. Configuring Samba with SSL

    -

    - -Contents:
    - -About Certificates
    - -Requirements
    - -Installing SSLeay
    - -Setting Up SSL Proxy
    - -SSL Configuration Options

    -

    This appendix describes how to set up Samba to use secure connections between the Samba server and its clients. The protocol used here is Netscape's Secure Sockets Layer (SSL). For this example, we will establish a secure connection between a Samba server and a Windows NT workstation.

    -Before we begin, we will assume that you are familiar with the fundamentals of public-key cryptography and X.509 certificates. If not, we highly recommend Bruce Schneier's -Applied Cryptography, 2nd Edition (Wiley) as the premiere source for learning the many secret faces of cryptography.

    -If you would like more information on Samba and SSL, be sure to look at the document -SSLeay.txt in the -docs/textdocs directory of the Samba distribution, which is the basis for this appendix.

    -

    - -A.1 About Certificates

    -Here are a few quick questions and answers from the -SSLeay.txt file in the Samba documentation, regarding the benefits of SSL and certificates. This text was written by Christian Starkjohann for the Samba projects.

    -

    - -A.1.1 What is a Certificate?

    -A certifcate is issued by an issuer, usually a -Certification Authority (CA), who confirms something by issuing the certificate. The subject of this confirmation depends on the CA's policy. CAs for secure web servers (used for shopping malls, etc.) usually attest only that the given public key belongs the given domain name. Company-wide CAs might attest that you are an employee of the company, that you have permissions to use a server, and so on.

    -

    - -A.1.2 What is an X.509 certificate, technically?

    -Technically, the certificate is a block of data signed by the certificate issuer (the CA). The relevant fields are:

      -
    • -

      - -Unique identifier (name) of the certificate issuer

    • -

      - -Time range during which the certificate is valid

    • -

      - -Unique identifier (name) of the certified object

    • -

      - -Public key of the certified object

    • -

      - -The issuer's signature over all the above

    -If this certificate is to be verified, the verifier must have a table of the names and public keys of trusted CAs. For simplicity, these tables should list certificates issued by the respective CAs for themselves (self-signed certificates).

    -

    - -A.1.3 What are the implications of this certificate structure?

    -Four implications follow:

      -
    • -

      - -Because the certificate contains the subjects's public key, the certificate and the private key together are all that is needed to encrypt and decrypt.

    • -

      - -To verify certificates, you need the certificates of all CAs you trust.

    • -

      - -The simplest form of a dummy-certificate is one that is signed by the subject.

    • -

      - -A CA is needed. The client can't simply issue local certificates for servers it trusts because the server determines which certificate it presents.

    -
    -
    -
    - - -
    - -Previous: 9.3 Extra Resources - - - -Next: A.2 Requirements
    -9.3 Extra Resources - -Book Index -A.2 Requirements
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/appa_02.html b/docs/htmldocs/using_samba/appa_02.html deleted file mode 100644 index e69b2fd912..0000000000 --- a/docs/htmldocs/using_samba/appa_02.html +++ /dev/null @@ -1,100 +0,0 @@ - - - -[Appendix A] A.2 Requirements - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: A.1 About Certificates - - - -Appendix A
    -Configuring Samba with SSL    		 - -Next: A.3 Installing SSLeay
     
    -
    -
    -
    -

    - -A.2 Requirements

    To set up SSL connections, you will need to download two programs in addition to Samba:

    -
    SSLeay
    -

    -Eric Young's implementation of the Secure Socket's Layer (SSL) protocol as a series of Unix programming libraries

    SSL Proxy
    -

    -A freeware SSL application from Objective Development, which can be used to proxy a secure link on Unix or Windows NT platforms

    -These two products assist with the server and client side of the encrypted SSL connection. The SSLeay libraries are compiled and installed directly on the Unix system. SSL Proxy, on the other hand, can be downloaded and compiled (or downloaded in binary format) and located on the client side. If you intend to have a Windows NT client or a Samba client on the other end of the SSL connection, you will not require a special setup.

    -SSL Proxy, however, does not work on Windows 95/98 machines. Therefore, if you want to have a secure connection between a Samba server and Windows 95/98 client, you will need to place either a Unix server or a Windows NT machine on the same subnet with the Windows 9 -x clients and route all network connections through the SSL-Proxy-enabled machine. See -Figure A.1.

    - -Figure A.1: Two possible ways of proxying Windows 95/98 clients

    Figure A.1

    -For the purposes of this chapter, we will create a simple SSL connection between the Samba server and a Windows NT client. This configuration can be used to set up more complex networks at the administrator's discretion.

    -
    -
    -
    - - -
    - -Previous: A.1 About Certificates - - - -Next: A.3 Installing SSLeay
    -A.1 About Certificates - -Book Index -A.3 Installing SSLeay
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/appa_03.html b/docs/htmldocs/using_samba/appa_03.html deleted file mode 100644 index f8cdb13931..0000000000 --- a/docs/htmldocs/using_samba/appa_03.html +++ /dev/null @@ -1,325 +0,0 @@ - - - -[Appendix A] A.3 Installing SSLeay - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: A.2 Requirements - - - -Appendix A
    -Configuring Samba with SSL    		 - -Next: A.4 Setting Up SSL Proxy
     
    -
    -
    -
    -

    - -A.3 Installing SSLeay

    -Samba uses the SSLeay package, written by Eric Young, to provide Secure Sockets Layer support on the server side. Because of U.S. export law, however, the SSLeay package cannot be shipped with Samba distributions that are based in the United States. For that reason, the Samba creators decided to leave it as a separate package entirely. You can download the SSLeay distribution from any of the following sites:

    -The latest version as of this printing is 0.9.0b. Download it to the same server as the Samba distribution, then uncompress and untar it. You should be left with a directory entitled -SSLeay-0.9.0b. After changing to that directory, you will need to configure and build the SSL encryption package in the same way that you did with Samba.

    -SSLeay uses a Perl-based -configure script. This script modifies the Makefile that constructs the utilities and libraries of the SSLeay package. However, the default script is hardcoded to find Perl at -/usr/local/bin/perl. You may need to change the -configure script to point to the location of the Perl executable file on your Unix system. For example, you can type the following to locate the Perl executable:

    # which perl
-/usr/bin/perl

    -Then modify the first line of the -configure script to force it to use the correct Perl executable. For example, on our Red Hat Linux system:

    -#!/usr/bin/perl
-#
-# see PROBLEMS for instructions on what sort of things to do
-# when tracking a bug -tjh
-...

    -After that, you need to run the -configure script by specifying a target platform for the distribution. This target platform can be any of the following:

    -BC-16              BC-32              FreeBSD            NetBSD-m86
-NetBSD-sparc       NetBSD-x86         SINIX-N            VC-MSDOS
-VC-NT              VC-W31-16          VC-W31-32          VC-WIN16
-VC-WIN32           aix-cc             aix-gcc            alpha-cc
-alpha-gcc          alpha400-cc        cc                 cray-t90-cc
-debug              debug-irix-cc      debug-linux-elf    dgux-R3-gcc
-dgux-R4-gcc        dgux-R4-x86-gcc    dist               gcc
-hpux-cc            hpux-gcc           hpux-kr-cc         irix-cc
-irix-gcc           linux-aout         linux-elf          ncr-scde
-nextstep           purify             sco5-cc            solaris-sparc-cc
-solaris-sparc-gcc  solaris-sparc-sc4  solaris-usparc-sc4 solaris-x86-gcc
-sunos-cc           sunos-gcc          unixware-2.0       unixware

    -For our system, we would enter the following:

    -# ./Configure linux-elf
-CC            =gcc
-CFLAG         =-DL_ENDIAN -DTERMIO -DBN_ASM -O3 -fomit-frame-pointer 
-EX_LIBS       =
-BN_MULW       =asm/bn86-elf.o
-DES_ENC       =asm/dx86-elf.o asm/yx86-elf.o
-BF_ENC        =asm/bx86-elf.o
-CAST_ENC      =asm/cx86-elf.o
-RC4_ENC       =asm/rx86-elf.o
-RC5_ENC       =asm/r586-elf.o
-MD5_OBJ_ASM   =asm/mx86-elf.o
-SHA1_OBJ_ASM  =asm/sx86-elf.o
-RMD160_OBJ_ASM=asm/rm86-elf.o
-THIRTY_TWO_BIT mode
-DES_PTR used
-DES_RISC1 used
-DES_UNROLL used
-BN_LLONG mode
-RC4_INDEX mode

    -After the package has been configured, you can build it by typing -make. If the build did not successfully complete, consult the documentation that comes with the distribution or the FAQ at http://www.cryptsoft.com/ssleay/ for more information on what may have happened. If the build did complete, type -make -install to install the libraries on the system. Note that the makefile installs the package in -/usr/local/ssl by default. If you decide to install it in another directory, remember the directory when configuring Samba to use SSL.

    -

    - -A.3.1 Configuring SSLeay for Your System

    -The first thing you need to do is to set the -PATH environment variable on your system to include the -/bin directory of the SSL distribution. This can be done with the following statement:

    -PATH=$PATH:/usr/local/ssl/bin

    -That's the easy part. Following that, you will need to create a random series of characters that will be used to prime SSLeay's random number generator. The random number generator will be used to create key pairs for both the clients and the server. You can create this random series by filling a text file of a long series of random characters. For example, you can use your favorite editor to create a text file with random characters, or use this command and enter arbitrary characters at the standard input:

    -cat >/tmp/private.txt

    -The Samba documentation recommends that you type characters for longer than a minute before interrupting the input stream by hitting Control-D. Try not to type only the characters that are under your fingers on the keyboard; throw in some symbols and numbers as well. Once you've completed the random file, you can prime the random number generator with the following command:

    -# ssleay genrsa -rand /tmp/private.txt >/dev/null
-2451 semi-random bytes loaded
-Generating RSA private key, 512 bit long modulus
-..+++++
-.................................+++++
-e is 65537 (0x10001)

    -You can safely ignore the output of this command. After it has completed, remove the series of characters used to create the key because this could be used to recreate any private keys that were generated from this random number generator:

    -rm -f /tmp/private.txt

    -The result of this command is the hidden file . -rnd, which is stored in your home directory. SSLeay will use this file when creating key pairs in the future.

    -

    - -A.3.2 Configuring Samba to use SSL

    At this point, you can compile Samba to use SSL. Recall that in Chapter 2, Installing Samba on a Unix System, we said you have to first run the configure script, which initializes the makefile, before you compile Samba. In order to use SSL with Samba, you will need to reconfigure the makefile:

    -./configure --with-ssl

    -After that, you can compile Samba with the following commands:

    # make clean
-# make all

    -If you encounter an error that says the -smbd executable is missing the file -ssl.h, you probably didn't install SSLeay in the default directory. Use the configure option ---with-sslinc to point to the base directory of the SSL distribution - in this case, the directory that contains -include/ssl.h.

    -On the other hand, if you have a clean compile, you're ready to move on to the next step: creating certificates.

    -

    - -A.3.3 Becoming a Certificate Authority

    - -The SSL protocol requires the use of X.509 certificates in the protocol handshake to ensure that either one or both parties involved in the communication are indeed who they say they are. Certificates in real life, such as those use for SSL connections on public web sites, can cost in the arena of $300 a year. This is because the certificate must have a digital signature placed on it by a -certificate authority. A certificate authority is an entity that vouches for the authenticity of a digital certificate by signing it with its own private key. This way, anyone who wishes to check the authenticity of the certificate can simply use the certificate authority's public key to check the signature.

    -You are allowed to use a public certificate authority with SSLeay. However, you don't have to. Instead, SSLeay will allow you to declare yourself a trusted certificate authority - specifying which clients you choose to trust and which clients you do not. In order to do this, you will need to perform several tasks with the SSLeay distribution.

    -The first thing you need to do is specify a secure location where the certificates of the clients and potentially the server will be stored. We have chosen -/etc/certificates as our default. Execute the following commands as -root: 

    # cd /etc
-# mkdir certificates
-# chmod 700 certificates

    -Note that we shut out all access to users other than -root for this directory. This is very important.

    -Next, you need to set up the SSLeay scripts and configuration files to use the certificates stored in this directory. In order to do this, first modify the -CA.sh script located at -/usr/local/ssl/bin/CA.sh to specify the location of the directory you just created. Find the line that contains the following entry:

    -CATOP=./demoCA

    -Then change it to:

    -CATOP=/etc/certificates

    -Next, you need to modify the -/usr/local/ssl/lib/ssleay.cnf file to specify the same directory. Find the entry:

    -[ CA_default ]
-dir     = ./demoCA             # Where everything is kept

    -Then change it to:

    -[ CA_default ]
-dir     =  /etc/certificates   # Where everything is kept

    -Next, run the certificate authority setup script, -CA.sh, in order to create the certificates. Be sure to do this as the same user that you used to prime the random number generator above:

    -/usr/local/ssl/bin/CA.sh -newca
-mkdir: cannot make directory '/etc/certificates': File exists
-CA certificate filename (or enter to create)

    -Press the Enter key to create a certificate for the CA. You should then see:

    -Making CA certificate ...
-Using configuration from /usr/local/ssl/lib/ssleay.cnf
-Generating a 1024 bit RSA private key
-.............................+++++
-.....................+++++
-writing new private key to /etc/certificates/private/cakey.pem
-Enter PEM pass phrase:

    -Enter a new pass phrase for your certificate. You will need to enter it twice correctly before SSLeay will accept it:

    -Enter PEM pass phrase:
-Verifying password - Enter PEM pass phrase:

    -Be sure to remember this pass phrase. You will need it to sign the client certificates in the future. Once SSLeay has accepted the pass phrase, it will continue on with a series of questions for each of the fields in the X509 certificate:

    -You are about to be asked to enter information that will be
-incorporated into your certificate request.
-What you are about to enter is what is called a Distinguished
-Name or a DN.
-There are quite a few fields but you can leave some blank
-For some fields there will be a default value,
-If you enter '.', the field will be left blank.

    -Fill out the remainder of the fields with information about your organization. For example, our certificate looks like this:

    -Country Name (2 letter code) [AU]:
-
-US
-State or Province Name (full name) [Some-State]:
-
-California
-Locality Name (eg, city) []:
-
-Sebastopol
-Organization Name (eg, company) []:
-
-O'Reilly
-Organizational Unit Name (eg, section) []:
-
-Books
-Common Name (eg, YOUR name) []:
-
-John Doe
-Email Address []:
-
-doe@ora.com

    -After that, SSLeay will be configured as a certificate authority and can be used to sign certificates for client machines that will be connecting to the Samba server.

    -

    - -A.3.4 Creating Certificates for Clients

    -It's simple to create a certificate for a client machine. First, you need to generate a public/private key pair for each entity, create a certificate request file, and then use -SSLeay to sign the file as a trusted authority.

    -For our example client -phoenix, this boils down to three SSLeay commands. The first generates a key pair for the client and places it in the file -phoenix.key. The private key will be encrypted, in this case using triple DES. Enter a pass phrase when requested below - you'll need it for the next step:

    -# ssleay genrsa -des3 1024 >phoenix.key
-1112 semi-random bytes loaded
-Generating RSA private key, 1024 bit long modulus
-........................................+++++
-.............+++++
-e is 65537 (0x10001)
-Enter PEM pass phrase:
-Verifying password - Enter PEM pass phrase:

    -After that command has completed, type in the following command:

    # ssleay req -new -key phoenix.key -out phoenix-csr
-Enter PEM pass phrase:

    -Enter the pass phrase for the client certificate you just created (not the certificate authority). At this point, you will need to answer the questionnaire again, this time for the client machine. In addition, you must type in a challenge password and an optional company name - those do not matter here. When the command completes, you will have a certificate request in the file -phoenix-csr.

    -Then, you must sign the certificate request as the trusted certificate authority. Type in the following command:

    # ssleay ca -days 1000 -inflies phoenix-csr >phoenix.pem

    -This command will prompt you to enter the PEM pass phrase of the -certificate authority. Be sure that you do not enter the PEM pass phrase of the client certificate that you just created. After entering the correct pass phrase, you should see the following:

    -Check that the request matches the signature
-Signature ok
-The Subjects Distinguished Name is as follows:
-...

    -This will be followed by the information that you just entered for the client certificate. If there is an error in the fields, the program will notify you. On the other hand, if everything is fine, SSLeay will confirm that it should sign the certificate and commit it to the database. This adds a record of the certificate to the -/etc/certificates/newcerts directory.

    -The operative files at the end of this exercise are the -phoenix.key and -phoenix.pem files, which reside in the current directory. These files will be passed off to the client with whom the SSL-enabled Samba server will interact, and will be used by SSL Proxy. -

    -

    -A.3.5 Configuring the Samba Server

    -The next step is to modify the Samba configuration file to include the following setup options. These options assume that you created the certificates directory for the certificate authority at -/etc/certificates :

    -[global]
-	ssl = yes
-	ssl server cert = /etc/certificates/cacert.pem
-	ssl server key = /etc/certificates/private/cakey.pem
-	ssl CA certDir = /etc/certificates

    -At this point, you will need to kill the Samba daemons and restart them manually:

    -# nmbd -D
-# smbd -D
-Enter PEM pass phrase:

    -You will need to enter the PEM pass phrase of the certificate authority to start up the Samba daemons. Note that this may present a problem in terms of starting the program using ordinary means. However, you can get around this using advanced scripting languages, such as Expect or Python.

    -

    - -A.3.6 Testing with smbclient

    -A good way to test whether Samba is working properly is to use the - smbclient program. On the Samba server, enter the following command, substituting the appropriate share and user for a connection:

    -# smbclient //hydra/data -U tom

    -You should see several debugging statements followed by a line indicating the negotiated cipher, such as:

    -SSL: negotiated cipher: DES-CBC3-SHA

    -After that, you can enter your password and connect to the share normally. If this works, you can be sure that Samba is correctly supporting SSL connections. Now, on to the client setup.

    -
    -
    -
    - - -
    - -Previous: A.2 Requirements - - - -Next: A.4 Setting Up SSL Proxy
    -A.2 Requirements - -Book Index -A.4 Setting Up SSL Proxy
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/appa_04.html b/docs/htmldocs/using_samba/appa_04.html deleted file mode 100644 index d4f99e2951..0000000000 --- a/docs/htmldocs/using_samba/appa_04.html +++ /dev/null @@ -1,135 +0,0 @@ - - - -[Appendix A] A.4 Setting Up SSL Proxy - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: A.3 Installing SSLeay - - - -Appendix A
    -Configuring Samba with SSL    		 - -Next: A.5 SSL Configuration Options
     
    - -
    -
    -

    - -A.4 Setting Up SSL Proxy

    -The SSL Proxy program is available as a standalone binary or as source code. You can download it from -http://obdev.at/Products/sslproxy.html.

    -Once it is downloaded, you can configure and compile it like Samba. We will configure it on a Windows NT system. However, setting it up for a Unix system involves a nearly identical series of steps. Be sure that you are the superuser (administrator) for the next series of steps.

    -If you downloaded the binary for Windows NT, you should have the following files in a directory:

      -
    • -

      - - -cygwinb19.dll

    • -

      - - -README.TXT

    • -

      - - -sslproxy.exe

    • -

      - - -dummyCert.pem

    -The only one that you will be interested in is the SSL Proxy executable. Copy over the -phoenix.pem and -phoenix.key files that you generated earlier for the client to the same directory as the SSL proxy executable. Make sure that the directory is secure from the prying eyes of other users.

    -The next step is to ensure that the Windows NT machine can resolve the NetBIOS name of the Samba server. This means that you should either have a WINS server up and running (the Samba server can perform this task with the -wins -support -= -yes option) or have it listed in the appropriate -hosts file of the system. See Chapter 7, Printing and Name Resolution, for more information on WINS server.[1]

    -
    -

    -[1] If you are running SSL Proxy on a Unix server, you should ensure that the DNS name of the Samba server can be resolved.

    -Finally, start up SSL Proxy with the following command. Here, we assume that -hydra is the name of the Samba server:

    -# C:\SSLProxy>sslproxy -l 139 -R hydra -r 139 -n -c phoenix.pem -k phoenix.key

    -This tells SSL Proxy to listen for connections to port 139 and relay those requests to port 139 on the NetBIOS machine -hydra. It also instructs SSL Proxy to use the -phoenix.pem and -phoenix.key files to generate the certificate and keys necessary to initiate the SSL connection. SSL Proxy responds with:

    -Enter PEM pass phrase:

    -Enter the PEM pass phrase of the client keypair that you generated, -not the certificate authority. You should then see the following output:

    -SSL: No verify locations, trying default
-proxy ready, listening for connections

    -That should take care of the client. You can place this command in a startup sequence on either Unix or Windows NT if you want this functionality available at all times. Be sure to set any clients you have connecting to the NT server (including the NT server itself) to point to this server instead of the Samba server.

    -After you've completed setting this up, try to connect using clients that proxy through the NT server. You should find that it works almost transparently.

    -
    -
    -
    - - -
    - -Previous: A.3 Installing SSLeay - - - -Next: A.5 SSL Configuration Options
    -A.3 Installing SSLeay - -Book Index -A.5 SSL Configuration Options
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/appa_05.html b/docs/htmldocs/using_samba/appa_05.html deleted file mode 100644 index 2048040ec9..0000000000 --- a/docs/htmldocs/using_samba/appa_05.html +++ /dev/null @@ -1,460 +0,0 @@ - - - -[Appendix A] A.5 SSL Configuration Options - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: A.4 Setting Up SSL Proxy - - - -Appendix A
    -Configuring Samba with SSL    		 - -Next: B. Samba Performance Tuning
     
    - -
    -
    -

    - -A.5 SSL Configuration Options

    -Table A.1 summarizes the configuration options introduced in the previous section for using SSL. Note that all of these options are global in scope; in other words, they must appear in the -[global] section of the configuration file.


    - - - - - - - - - - - - - - - - - - -
    - -Table A.1: SSL Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -ssl

    		 -

    -boolean

    		 -

    -Indicates whether SSL mode is enabled with Samba.

    		 -

    - -no

    		 -

    -Global

    -

    - -ssl hosts

    		 -

    -string (list of addresses)

    		 -

    -Specifies a list of hosts that must always connect using SSL.

    		 -

    -None

    		 -

    -Global

    -

    - -ssl hosts resign

    		 -

    -string (list of addresses)

    		 -

    -Specifies a list of hosts that never connect using SS.

    		 -

    -None

    		 -

    -Global

    -

    - -ssl CA certDir

    		 -

    -string (fully-qualified pathname)

    		 -

    -Specifies the directory where the certificates are stored.

    		 -

    -None

    		 -

    -Global

    -

    - -ssl CA certFile

    		 -

    -string (fully-qualified pathname)

    		 -

    -Specifies a file that contains all of the certificates for Samba.

    		 -

    -None

    		 -

    -Global

    -

    - -ssl server cert

    		 -

    -string (fully-qualified pathname)

    		 -

    -Specifies the location of the server's certificate.

    		 -

    -None

    		 -

    -Global

    -

    - -ssl server key

    		 -

    -string (fully-qualified pathname)

    		 -

    -Specifies the location of the server's private key.

    		 -

    -None

    		 -

    -Global

    -

    - -ssl client cert

    		 -

    -string (fully-qualified pathname)

    		 -

    -Specifies the location of the client's certificate.

    		 -

    -None

    		 -

    -Global

    -

    - -ssl client key

    		 -

    -string (fully-qualified pathname)

    		 -

    -Specifies the location of the client's private key.

    		 -

    -None

    		 -

    -Global

    -

    - -ssl require clientcert

    		 -

    -boolean

    		 -

    -Indicates whether Samba should require each client to have a certificate.

    		 -

    - -no

    		 -

    -Global

    -

    - -ssl require servercert

    		 -

    -boolean

    		 -

    -Indicates whether the server itself should have a certificate.

    		 -

    - -no

    		 -

    -Global

    -

    - -ssl ciphers

    		 -

    -String

    		-

    -Specifies the cipher suite to use during protocol negotiation.

    		 -

    -None

    		 -

    -Global

    -

    - -ssl version

    		 -

    - -ssl2or3, -ssl3, or -tls1

    		 -

    -Specifies the version of SSL to use.

    		 -

    - -ssl2or3

    		 -

    -Global

    -

    - -ssl compatibility

    		 -

    -boolean

    		 -

    -Indicates whether compatibility with other implementations of SSL should be activated.

    		 -

    - -no

    		 -

    -Global

    -

    - -A.5.1 ssl

    -This global option configures Samba to use SSL for communication between itself and clients. The default value of this option is -no. You can reset it as follows:

    -[global]
-	ssl = yes

    -Note that in order to use this option, you must have a proxy for Windows 95/98 clients, such as in the model presented earlier in this chapter.

    -

    - -A.5.2 ssl hosts

    -This option specifies the hosts that will be forced into using SSL. The syntax for specifying hosts and addresses is the same as the -hosts -allow and the -hosts -deny configuration options. For example:

    -[global]
-	ssl = yes
-	ssl hosts = 192.168.220.

    -This example specifies that all hosts that fall into the 192.168.220 subnet must use SSL connections with the client. This type of structure is useful if you know that various connections will be made by a subnet that lies across an untrusted network, such as the Internet. If neither this option nor the -ssl -hosts -resign option has been specified, and -ssl is set to -yes, Samba will allow only SSL connections from all clients.

    -

    - -A.5.3 ssl hosts resign

    -This option specifies the hosts that will -not be forced into SSL mode. The syntax for specifying hosts and addresses is the same as the -hosts -allow and the -hosts -deny configuration options. For example:

    -[global]
-	ssl = yes
-	ssl hosts resign = 160.2.310. 160.2.320.

    -This example specifies that all hosts that fall into the 160.2.310 or 160.2.320 subnets will not use SSL connections with the client. If neither this option nor the -ssl -hosts option has been specified, and -ssl is set to -yes, Samba will allow only SSL connections from all clients.

    -

    - -A.5.4 ssl CA certDir

    -This option specifies the directory containing the certificate authority's certificates that Samba will use to authenticate clients. There must be one file in this directory for each certificate authority, named as specified earlier in this chapter. Any other files in this directory are ignored. For example:

    -[global]
-	ssl = yes
-	ssl hosts = 192.168.220.
-	ssl CA certDir = /usr/local/samba/cert

    -There is no default for this option. You can alternatively use the option -ssl -CA -certFile if you wish to place all the certificate authority information in the same file.

    -

    - -A.5.5 ssl CA certFile

    -This option specifies a file that contains the certificate authority's certificates that Samba will use to authenticate clients. This option differs from -ssl -CA -certDir in that there is only one file used for all the certificate authorities. An example of its usage follows:

    -[global]
-	ssl = yes
-	ssl hosts = 192.168.220.
-	ssl CA certFile = /usr/local/samba/cert/certFile

    -There is no default for this option. You can also use the option -ssl -CA -certDir if you wish to have a separate file for each certificate authority that Samba trusts.

    -

    - -A.5.6 ssl server cert

    -This option specifies the location of the server's certificate. This option is mandatory; the server must have a certificate in order to use SSL. For example: 

    -[global]
-	ssl = yes
-	ssl hosts = 192.168.220.
-	ssl CA certFile = /usr/local/samba/cert/certFile
-	ssl server cert = /usr/local/samba/private/server.pem

    -There is no default for this option. Note that the certificate may contain the private key for the server.

    -

    - -A.5.7 ssl server key

    -This option specifies the location of the server's private key. You should ensure that the location of the file cannot be accessed by anyone other than -root. For example:

    -[global]
-	ssl = yes
-	ssl hosts = 192.168.220.
-	ssl CA certFile = /usr/local/samba/cert/certFile
-	ssl server key = /usr/local/samba/private/samba.pem

    -There is no default for this option. Note that the private key may be contained in the certificate for the server.

    -

    - -A.5.8 ssl client cert

    -This option specifies the location of the client's certificate. The certificate may be requested by the Samba server with the -ssl -require -clientcert option; the certificate is also used by -smbclient. For example: 

    -[global]
-    ssl = yes
-    ssl hosts = 192.168.220.
-    ssl CA certFile = /usr/local/samba/cert/certFile
-    ssl server cert = /usr/local/ssl/private/server.pem
-    ssl client cert= /usr/local/ssl/private/clientcert.pem

    -There is no default for this option.

    -

    - -A.5.9 ssl client key

    -This option specifies the location of the client's private key. You should ensure that the location of the file cannot be accessed by anyone other than -root. For example:

    -[global]
-	ssl = yes
-	ssl hosts = 192.168.220.
-	ssl CA certDir = /usr/local/samba/cert/
-	ssl server key = /usr/local/ssl/private/samba.pem
-	ssl client key = /usr/local/ssl/private/clients.pem

    -There is no default for this option. This option is only needed if the client has a certificate.

    -

    - -A.5.10 ssl require clientcert

    -This option specifies whether the client is required to have a certificate. The certificates listed with either the -ssl -CA -certDir or the -ssl -CA -certFile will be searched to confirm that the client has a valid certificate and is authorized to connect to the Samba server. The value of this option is a simple boolean. For example:

    -[global]
-	ssl = yes
-	ssl hosts = 192.168.220.
-	ssl CA certFile = /usr/local/samba/cert/certFile
-	ssl require clientcert = yes

    -We recommend that you require certificates from all clients that could be connecting to the Samba server. The default value for this option is -no.

    -

    - -A.5.11 ssl require servercert

    -This option specifies whether the server is required to have a certificate. Again, this will be used by the -smbclient program. The value of this option is a simple boolean. For example:

    -[global]
-	ssl = yes
-	ssl hosts = 192.168.220.
-	ssl CA certFile = /usr/local/samba/cert/certFile
-	ssl require clientcert = yes
-	ssl require servercert = yes

    -Although we recommend that you require certificates from all clients that could be connecting to the Samba server, a server certificate is not required. It is, however, recommended. The default value for this option is -no.

    -

    - -A.5.12 ssl ciphers

    -This option sets the ciphers on which SSL will decide during the negotiation phase of the SSL connection. Samba can use any of the following ciphers:

    -DEFAULT
-DES-CFB-M1
-NULL-MD5
-RC4-MD5
-EXP-RC4-MD5
-RC2-CBC-MD5
-EXP-RC2-CBC-MD5
-IDEA-CBC-MD5
-DES-CBC-MD5
-DES-CBC-SHA
-DES-CBC3-MD5
-DES-CBC3-SHA
-RC4-64-MD5
-NULL

    -It is best not to set this option unless you are familiar with the SSL protocol and want to mandate a specific cipher suite.

    -

    - -A.5.13 ssl version

    -This global option specifies the version of SSL that Samba will use when handling encrypted connections. The default value is -ssl2or3, which specifies that either version 2 or 3 of the SSL protocol can be used, depending on which version is negotiated in the handshake between the server and the client. However, if you want Samba to use only a specific version of the protocol, you can specify the following:

    -[global]
-	ssl version = ssl3

    -Again, it is best not to set this option unless you are familiar with the SSL protocol and want to mandate a specific version.

    -

    - -A.5.14 ssl compatibility

    -This global option specifies whether Samba should be configured to use other versions of SSL. However, because no other versions exist at this writing, the issue is moot and the variable should always be left at the default.

    -
    -
    -
    - - -
    - -Previous: A.4 Setting Up SSL Proxy - - - -Next: B. Samba Performance Tuning
    A.4 Setting Up SSL Proxy - -Book Index -B. Samba Performance Tuning
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/appb_01.html b/docs/htmldocs/using_samba/appb_01.html deleted file mode 100644 index 4e1ec529af..0000000000 --- a/docs/htmldocs/using_samba/appb_01.html +++ /dev/null @@ -1,162 +0,0 @@ - - - -[Appendix B] Samba Performance Tuning - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: A.5 SSL Configuration Options - - -Appendix B - -Next: B.2 Samba Tuning
     
    - -
    -
    -

    - -B. Samba Performance Tuning

    -

    - -Contents:
    - -A Simple Benchmark
    - -Samba Tuning
    - -Sizing Samba Servers

    -

    This appendix discusses various ways of performance tuning and system sizing with Samba. -Performance tuning is the art of finding bottlenecks and adjusting to eliminate them. -Sizing is the practice of eliminating bottlenecks by spending money to avoid having them in the first place. Normally, you won't have to worry about either with Samba. On a completely untuned server, Samba will happily support a small community of users. However, on a properly tuned server, Samba will support at least twice as many users. This chapter is devoted to outlining various performance-tuning and sizing techniques that you can use if you want to stretch your Samba server to the limit.

    -

    - -B.1 A Simple Benchmark

    How do you know if you're getting reasonable performance? A simple benchmark is to compare Samba with FTP. -Table B.1 shows the throughput, in kilobytes per second, of a pair of servers: a medium-size Sun SPARC Ultra and a small Linux Pentium server. Numbers are reported in kilobytes per second (KB/s).


    - - - - - - - - -
    - -Table B.1: Sample Benchmark Benchmarks
    -

    -Command

    		 -

    -FTP

    		 -

    -Untuned Samba

    		 -

    -Tuned Samba

    -

    -Sparc get

    		 -

    -1014.5

    		 -

    -645.3

    		 -

    -866.7

    -

    -Sparc put

    		 -

    -379.8

    		-

    -386.1

    		 -

    -329.5

    -

    -Pentium get

    		 -

    -973.27

    		 -

    -N/A

    		 -

    -725

    -

    -Pentium put

    		 -

    -1014.5

    		 -

    -N/A

    		 -

    -1100

    -If you run the same tests on your server, you probably won't see the same numbers. However, you -should see similar ratios of Samba to FTP, probably in the range of 68 to 80 percent. It's not a good idea to base -all of Samba's throughput against FTP. The golden rule to remember is this: if Samba is much slower than FTP, it's time to tune it.

    -You might think that an equivalent test would be to compare Samba to NFS. In reality, however, it's much less useful to compare their speeds. Depending entirely on whose version of NFS you have and how well it's tuned, Samba can be slower or faster than NFS. We usually find that Samba is faster, but watch out; NFS uses a different algorithm from Samba, so tuning options that are optimal for NFS may be detrimental for Samba. If you run Samba on a well-tuned NFS server, Samba may perform rather badly.

    -A more popular benchmark is Ziff-Davis' -NetBench, a simulation of many users on client machines running word processors and accessing data on the SMB server. It's not a prefect measure (each NetBench client does about ten times the work of a normal user on our site), but it is a fair comparison of similar servers. In tests performed by Jeremy Allison in November 1998, Samba 2.0 on a SGI multiprocessor outperformed NT Server 4.0 (Patch Level 2) on an equivalent high-end Compaq. This was confirmed and strengthened by a Sm@rt Reseller test of NT and Linux on identical hardware in February 1999.

    -In April 1999, the Mindcraft test lab released a report about a test showing that Samba on a four-processor Linux machine was significantly slower than native file serving on the same machine running Windows NT. While the original report was slammed by the Open Source community because it was commissioned by Microsoft and tuned the systems to favor Windows NT, a subsequent test was fairer and generally admitted to reveal some areas where Linux needed to improve its performance, especially on multiprocessors. Little was said about Samba itself. Samba is known to scale well on multiprocessors, and exceeds 440MB/s on a four-processor SGI O200, beating Mindcraft's 310MB/s.

    -Relative performance will probably change as NT and PC hardware get faster, of course, but Samba is improving as well. For example, Samba 1.9.18 was faster only with more than 35 clients. Samba 2.0, however, is faster regardless of the number of clients. In short, Samba is very competitive with the best networking software in the industry, and is only getting better.

    -As we went to press, Andrew Tridgell released the alpha-test version suite of benchmarking programs for Samba and SMB networks. Expect even more work on performance from the Samba team in the future.

    -
    -
    -
    - - -
    - -Previous: A.5 SSL Configuration Options - - - -Next: B.2 Samba Tuning
    -A.5 SSL Configuration Options - -Book Index -B.2 Samba Tuning
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/appb_02.html b/docs/htmldocs/using_samba/appb_02.html deleted file mode 100644 index 4d2ce9ae3a..0000000000 --- a/docs/htmldocs/using_samba/appb_02.html +++ /dev/null @@ -1,342 +0,0 @@ - - - -[Appendix B] B.2 Samba Tuning - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: B.1 A Simple Benchmark - - - -Appendix B
    -Samba Performance Tuning    		 - -Next: B.3 Sizing Samba Servers
     
    - -
    -
    -

    - -B.2 Samba Tuning

    That being said, let's discuss how you can take an already fast networking package and make it even faster.

    -

    - -B.2.1 Benchmarking

    Benchmarking is an arcane and somewhat black art, but the level of expertise needed for simple performance tuning is fairly low. Since the Samba server's goal in life is to transfer files, we will examine only throughput, not response time to particular events, under the benchmarking microscope. After all, it's relatively easy to measure file transfer speed, and Samba doesn't suffer too badly from response-time problems that would require more sophisticated techniques.

    -Our basic strategy for this work will be:

      -
    • -

      - -Find a reasonably-sized file to copy and a program that reports on copy speeds, such as -smbclient.

    • -

      - -Find a quiet (or typical) time to do the test.

    • -

      - -Pre-run each test a few times to preload buffers.

    • -

      - -Run tests several times and watch for unusual results.

    • -

      - -Record each run in detail.

    • -

      - -Compare the average of the valid runs to expected values.

    -After establishing a baseline using this method, we can adjust a single parameter and do the measurements all over again. An empty table for your tests is provided at the end of this chapter.

    -

    - -B.2.2 Things to Tweak

    -There are literally thousands of Samba setting combinations that you can use in search of that perfect server. Those of us with lives outside of system administration, however, can narrow down the number of options to those listed in this section, which are the most likely to affect overall throughput. They are presented roughly in order of impact.

    -

    - -B.2.2.1 Log level

    This is an obvious one. Increasing the logging level (log -level or -debug -level configuration options) is a good way to debug a problem, unless you happen to be searching for a performance problem! As mentioned in Chapter 4, Disk Shares, Samba produces a ton of debugging messages at level 3 and above, and writing them to disk or syslog is a slow operation. In our -smbclient/ftp tests, raising the log level from 0 to 3 cut the untuned -get -speed from 645.3 to 622.2KB/s, or roughly 5 percent. Higher log levels were even worse.

    -

    - -B.2.2.2 Socket options

    -The next thing to look at are the -socket -options configuration options. These are really host system tuning options, but they're set on a per-connection basis, and can be reset by Samba on the sockets it employs by adding -socket -options -= -option to the -[global] section of your -smb.conf file. Not all of these options are supported by all vendors; check your vendor's manual pages on -setsockopt (1) or -socket (5) for details.

    -The main options are:

    -
    - -TCP_NODELAY
    -

    -Have the server send as many packets as necessary to keep delay low. This is used on telnet connections to give good response time, and is used - somewhat counter-intuitively - to get good speed even when doing small requests or when acknowledgments are delayed (as seems to occur with Microsoft TCP/IP). This is worth a 30-50 percent speedup by itself. Incidentally, in Samba 2.0.4, -socket -options -= -TCP_NODELAY became the default value for that option.

    - -IPTOS_LOWDELAY
    -

    -This is another option that trades off throughput for lower delay, but which affects routers and other systems, not the server. All the IPTOS options are new; they're not supported by all operating systems and routers. If they are supported, set -IPTOS_LOWDELAY whenever you set -TCP_NODELAY.

    - -SO_SNDBUF -and -SO_RCVBUF
    -

    -The send and receive buffers can often be the reset to a value higher than that of the operating system. This yields a marginal increase of speed (until it reaches a point of diminishing returns).

    - -SO_KEEPALIVE
    -

    -This initiates a periodic (four-hour) check to see if the client has disappeared. Expired connections are addressed somewhat better with Samba's -keepalive and -dead -time options. All three eventually arrange to close dead connections, returning unused memory and process-table entries to the operating system.

    -There are several other socket options you might look at, (e.g., -SO_SNDLOWAT), but they vary in availability from vendor to vendor. You probably want to look at -TCP/IP Illustrated if you're interested in exploring more of these options for performance tuning with Samba.

    -

    - -B.2.2.3 read raw and write raw

    These are important performance configuration options; they enable Samba to use large reads and writes to the network, of up to 64KB in a single SMB request. They also require the largest SMB packet structures, -SMBreadraw and -SMBwriteraw, from which the options take their names. Note that this is not the same as a Unix -raw read. This Unix term usually refers to reading disks without using the files system, quite a different sense from the one described here for Samba.

    -In the past, some client programs failed if you tried to use -read -raw. As far as we know, no client suffers from this problem any more. Read and write raw default to -yes, and should be left on unless you find you have one of the buggy clients.

    -

    - -B.2.2.4 Opportunistic locking

    Opportunistic locks, or -oplocks, allow clients to cache files locally, improving performance on the order of 30 percent. This option is now enabled by default. For read-only files, the -fake -oplocks provides the same functionality without actually doing any caching. If you have files that cannot be cached, -oplocks can be turned off.

    -Database files should never be cached, nor should any files that are updated both on the server and the client and whose changes must be immediately visible. For these files, the -veto -oplock -files option allows you to specify a list of individual files or a pattern containing wildcards to avoid caching. -oplocks can be turned off on a share-by-share basis if you have large groups of files you don't want cached on clients. See Chapter 5, Browsing and Advanced Disk Shares, for more information on opportunistic locks.

    -

    - -B.2.2.5 IP packet size (MTU)

    Networks generally set a limit to the size of an individual transmission or packet This is called the Maximum Segment Size, or if the packet header size is included, the Maximum Transport Unit (MTU). This MTU is not set by Samba, but Samba needs to use a -max -xmit (write size) bigger than the MTU, or throughput will be reduced. This is discussed in further detail in the following note. The MTU is normally preset to 1500 bytes on an Ethernet and 4098 bytes on FDDI. In general, having it too low cuts throughput, and having it too high causes a sudden performance dropoff due to fragmentation and retransmissions.

    -If you are communicating over a router, some systems will assume the router is a serial link (e.g., a T1) and set the MTU to more or less 536 bytes. Windows 95 makes this mistake, which causes nearby clients to perform well, but clients on the other side of the router to be noticeably slower. If the client makes the opposite error and uses a large MTU on a link which demands a small one, the packets will be broken up into fragments. This slows transfers slightly, and any networking errors will cause multiple fragments to be retransmitted, which slows Samba significantly. Fortunately, you can modify the Windows MTU size to prevent either error. To understand this in more detail, see "The Windows 95 Networking Frequently Asked Questions (FAQ)" at -http://www.stanford.edu/~llurch/win95netbugs/faq.html, which explains how to override the Windows MTU and Window Size.

    -

    - - -B.2.2.6 The TCP receive window

    TCP/IP works by breaking down data into small packets that can be transmitted from one machine to another. When each packet is transmitted, it contains a checksum that allows the receiver to check the packet data for potential errors in transmission. Theoretically, when a packet is received and verified, an acknowledgment packet should be sent back to the sender that essentially says, "Everything arrived intact: please continue."

    -In order to keep things moving, however, TCP accepts a range (window) of packets that allows a sender to keep transmitting without having to wait for an acknowledgment of every single packet. (It can then bundle a group of acknowledgments and transmit them back to the sender at the same time.) In other words, this receive window is the number of bytes that the sender can transmit before it has to stop and wait for a receiver's acknowledgment. Like the MTU, it is automatically set based on the type of connection. Having the window too small causes a lot of unnecessary waiting for acknowledgment messages. Various operating systems set moderate buffer sizes on a per-socket basis to keep one program from hogging all the memory.

    -The buffer sizes are assigned in bytes, such as -SO_SNDBUF=8192 in the -socket -options line. Thus, an example -socket -options configuration option is: 

    -socket options = SO_SNDBUF=8192

    -Normally, one tries to set these socket options higher than the default: 4098 in SunOS 4.1.3 and SVR4, and 8192-16384 in AIX, Solaris, and BSD. 16384 has been suggested as a good starting point: in a non-Samba test mentioned in Stevens' book, it yielded a 40 percent improvement. You'll need to experiment, because performance will fall off again if you set the sizes too high. This is illustrated in -Figure B.1, a test done on a particular Linux system.

    - -Figure B.1: SO_SNDBUF size and performance

    Figure B.1

    -Setting the socket options -O_SNDBUF and -SO_RCVBUF to less than the default is inadvisable. Setting them higher improves performance, up to a network-specific limit. However, once you exceed that limit, performance will abruptly level off.

    -

    - -B.2.2.7 max xmit

    In Samba, the option that is directly related with the MTU and window size is -max -xmit. This option sets the largest block of data Samba will try to write at any one time. It's sometimes known as the -write size, although that is not the name of the Samba configuration option.

    -Because the percentage of each block required for overhead falls as the blocks get larger, max xmit is conventionally set as large as possible. It defaults to the protocol's upper limit, which is 64 kilobytes. The smallest value that doesn't cause significant slowdowns is 2048. If it is set low enough, it will limit the largest packet size that Samba will be able to negotiate. This can be used to simulate a small MTU if you need to test an unreliable network connection. However, such a test should not be used in production for reducing the effective MTU.

    -

    - -B.2.2.8 read size

    If -max -xmit is commonly called the write size, you'd expect -read -size to be the maximum amount of data that Samba would want to read from the client via the network. Actually, it's not. In fact, it's an option to trigger -write ahead. This means that if Samba gets behind reading from the disk and writing to the network (or vice versa) by the specified amount, it will start overlapping network writes with disk reads (or vice versa).

    -The read size doesn't have a big performance effect on Unix, unless you set its value quite small. At that point, it causes a detectable slowdown. For this reason, it defaults to 2048 and can't be set lower than 1024.

    - -

    - -B.2.2.9 read prediction

    - -

    Besides being counterintuitive, this option is also -obsolete. It enables Samba to read ahead on files opened read only by the -clients. The option is disabled in Samba 2.0 (and late 1.9) because it -interferes with opportunistic locking.

    - -

    - -B.2.2.10 write cache size

    - -

    -This parameter was introduced in Samba 2.0.7 to allow tuning the -write-size of RAID disks, as well as allowing general caching of -writes on machines with lots of memory but slow disks.

    - -

    It specifies in bytes the size of a per-file write cache that -Samba will create for an oplocked file. This can improve performance -significantly by causing writes to be done in large -chunk sizes.

    - -

    Up to 10 write caches can be active simultaneously per smbd, each of -the specified size, allocated to the first 10 oplocked files. As with -other filesystem caches, crashing before the data is written can corrupt -files.

    - -

    Setting sync always will override the -write caching, and setting strict sync will -allow Windows clients to override it. Alas, Windows Explorer defaults -to setting the sync bit, so setting strict sync -can be a big performance hit.

    - -

    As it's new, we haven't many reports on the performance increase, and -merely suspect it will be considerable.

    -
    - - - -

    - -B.2.3 Other Samba Options

    The following Samba options will affect performance if they're set incorrectly, much like the debug level. They're mentioned here so you will know what to look out for:

    -
    -hide files
    -

    -Providing a pattern to identify files hidden by the Windows client -hide -files will result in any file matching the pattern being passed to the client with the DOS hidden attribute set. It requires a pattern match per file when listing directories, and slows the server noticeably.

    - -lpq cache time
    -

    If your -lpq (printer queue contents) command takes a long time to complete, you should increase -lpq -cache -time to a value higher than the actual time required for -lpq to execute, so as to keep Samba from starting a new query when one's already running. The default is 10 seconds, which is reasonable.

    - -strict locking
    -

    Setting the -strict -locking option causes Samba to check for locks on every access, not just when asked to by the client. The option is primarily a bug-avoidance feature, and can prevent ill-behaved DOS and Windows applications from corrupting shared files. However, it is slow and should typically be avoided.

    - -strict sync
    -

    Setting -strict -sync will cause Samba to write each packet to disk and wait for the write to complete whenever the client sets the sync bit in a packet. Windows 98 Explorer sets the bit in all packets transmitted, so if you turn this on, anyone with Windows 98 will think Samba servers are horribly slow.

    - -sync always
    -

    Setting -sync -always causes Samba to flush every write to disk. This is good if your server crashes constantly, but the performance costs are immense. SMB servers normally use oplocks and automatic reconnection to avoid the ill effects of crashes, so setting this option is not normally necessary.

    -wide links
    -

    -Turning off -wide -links prevents Samba from following symbolic links in one file share to files that are not in the share. It is turned on by default, since following links in Unix is not a security problem. Turning it off requires extra processing on every file open. If you do turn off wide links, be sure to turn on -getwd -cache to cache some of the required data.

    -There is also a -follow -symlinks option that can be turned off to prevent following any symbolic links at all. However, this option does not pose a performance problem.

    -getwd cache
    -

    -This option caches the path to the current directory, avoiding long tree-walks to discover it. It's a nice performance improvement on a printer server or if you've turned off -wide -links.

    -

    - -B.2.4 Our Recommendations

    Here's an -smb.conf file that incorporates the recommended performance enhancements so far. Comments have been added on the right side.

    -[global] 
-	log level = 1                      # Default is 0 
-	socket options = TCP_NODELAY IPTOS_LOWDELAY 
-	read raw = yes                     # Default 
-	write raw = yes                    # Default 
-	oplocks = yes                      # Default 
-	max xmit = 65535                   # Default 
-	dead time = 15                     # Default is 0
-	getwd cache = yes
-	lpq cache = 30
-[okplace] 
-	veto oplock files = this/that/theotherfile
-[badplace] 
-	oplocks = no
    -
    -
    -
    - - -
    - -Previous: B.1 A Simple Benchmark - - - -Next: B.3 Sizing Samba Servers
    -B.1 A Simple Benchmark - -Book Index -B.3 Sizing Samba Servers
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/appb_03.html b/docs/htmldocs/using_samba/appb_03.html deleted file mode 100644 index 115be4daa3..0000000000 --- a/docs/htmldocs/using_samba/appb_03.html +++ /dev/null @@ -1,876 +0,0 @@ - - - -[Appendix B] B.3 Sizing Samba Servers - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: B.2 Samba Tuning - - - -Appendix B
    -Samba Performance Tuning    		 - -Next: C. Samba Configuration Option Quick Reference
     
    - -
    -
    -

    - -B.3 Sizing Samba Servers

    Sizing is a way to prevent bottlenecks before they occur. The preferred way to do this is to know how many requests per second or how many kilobytes per second the clients will need, and ensure that all the components of the server provide at least that many.

    -

    - -B.3.1 The Bottlenecks

    The three primary bottlenecks you should worry about are CPU, disk I/O, and the network. For most machines, CPUs are rarely a bottleneck. A single Sun SPARC 10 CPU can start (and complete) between 700 and 800 I/O operations a second, giving approximately 5,600 to 6,400KB/s of throughput when the data averages around 8KBs (a common buffer size). A single Intel Pentium 133 can do less only because of somewhat slower cache and bus interfaces, not due to lack of CPU power. Purpose-designed Pentium servers, like some Compaq servers, will be able to start 700 operations per CPUs, on up to four CPUs.

    -Too little memory, on the other hand, can easily be a bottleneck; each Samba process will use between 600 and 800KB on Intel Linux, and more on RISC CPUs. Having less will cause an increase in virtual memory paging and therefore a performance hit. On Solaris, where it has been measured, -smbd will use 2.6 MB for program and shared libraries, plus 768KB for each connected client. -nmbd occupies 2.1 MB, plus 496KB extra for its (single) auxiliary process.

    -Hard disks will always bottleneck at a specific number of I/O operations per second: for example, each 7200 RPM SCSI disk is capable of performing 70 operations per second, for a throughput of 560KB/s; a 4800 RPM disk will perform fewer than 50, for a throughput of 360KB/s. A single IDE disk will do still fewer. If the disks are independent, or striped together in a RAID 1 configuration, they will each peak out at 400 to 560KB/s and will scale linearly as you add more. Note that this is true only of RAID 1. RAID levels other than 1 (striping) add extra overhead.

    -Ethernets (and other networks) are obvious bottleneck: a 10 Mb/s (mega -bits/second) Ethernet will handle around 1100KB/s (kilo -bytes/s) using 1500-byte packets A 100 Mb/s Fast Ethernet will bottleneck below 65,000KB/s with the same packet size. FDDI, at 155 Mb/s will top out at approximately 6,250KB/s, but gives good service at even 100 percent load and transmits much larger packets (4KB).

    -ATM should be much better, but as of the writing of this book it was too new to live up to its potential; it seems to deliver around 7,125 Mb/s using 9KB packets.

    -Of course, there can be other bottlenecks: more than one IDE disk per controller is not good, as are more than three 3600 SCSI-I disks per slow/narrow controller, or more than three 7200 SCSI-II disks per SCSI-II fast/wide controller. RAID 5 is also slow, as it requires twice as many writes as independent disks or RAID 1.

    -After the second set of Ethernets and the second disk controller, start worrying about bus bandwidth, especially if you are using ISA/EISA buses.

    -

    - -B.3.2 Reducing Bottlenecks

    From the information above we can work out a model that will tell us the maximum capability of a given machine. The data is mostly taken from Brian Wong's -Configuration and Capacity Planning for Solaris Servers, -[1] so there is a slight Sun bias to our examples.

    -A word of warning: this is not a complete model. Don't assume that this model will predict every bottleneck or even be within 10 percent in its estimates. A model to predict performance instead of one to warn you of bottlenecks would be much more complex and would contain rules like "not more than three disks per SCSI chain". (A good book on real models is Raj Jain's -The Art of Computer Systems Performance Analysis.[2]) With that warning, we present the system in -Figure B.2.

    -
    -

    -[2] See Jain. Raj, -The Art of Computer Systems Performance Analysis, New York, NY (John Wiley and Sons), 1991, ISBN 0-47-150336-3.

    - -Figure B.2: Data flow through a Samba server, with possible bottlenecks

    Figure B.2

    -The flow of data should be obvious. For example, on a read, data flows from the disk, across the bus, through or past the CPU, and to the network interface card (NIC). It is then broken up into packets and sent across the network. Our strategy here is to follow the data through the system and see what bottlenecks will choke it off. Believe it or not, it's rather easy to make a set of tables that list the maximum performance of common disks, CPUs, and network cards on a system. So that's exactly what we're going to do.

    -Let's take a concrete example: a Linux Pentium 133 MHz machine with a single 7200 RPM data disk, a PCI bus, and a 10-Mb/s Ethernet card. This is a perfectly reasonable server. We start with -Table B.2, which describes the hard drive - the first potential bottleneck in the system.


    - - - - - - - -
    - -Table B.2: Disk Throughput
    -

    -Disk RPM

    		 -

    -I/O Operations/second

    		 -

    -KB/second

    -

    -7200

    		 -

    -70

    		 -

    -560

    -

    -4800

    		 -

    -60

    		 -

    -480

    -

    -3600

    		 -

    -40

    		 -

    -320

    -Disk throughput is the number of kilobytes of data that a disk can transfer per second. It is computed from the number of 8KB I/O operations per second a disk can perform, which in turn is strongly influenced by disk RPM and bit density. In effect, the question is: how much data can pass below the drive heads in one second? With a single 7200 RPM disk, the example server will give us 70 I/O operations per second at roughly 560KB/s.

    -The second possible bottleneck is the CPU. The data doesn't actually flow through the CPU on any modern machines, so we have to compute throughput somewhat indirectly.

    -The CPU has to issue I/O requests and handle the interrupts coming back, then transfer the data across the bus to the network card. From much past experimentation, we know that the overhead that dominates the processing is consistently in the filesystem code, so we can ignore the other software being run. We compute the throughput by just multiplying the (measured) number of file I/O operations per second that a CPU can process by the same 8K average request size. This gives us the results shown in -Table B.3.


    - - - - - - - - - -
    - -Table B.3: CPU Throughput
    -

    -CPU

    		 -

    -I/O Operations/second

    		 -

    -KB/second

    -

    -Intel Pentium 133

    		 -

    -700

    -    		 -

    -5,600

    -
    -

    -Dual Pentium 133

    		 -

    -1,200

    -    		 -

    -9,600

    -
    -

    -Sun SPARC II

    		 -

    -660

    -    		 -

    -5,280

    -
    -

    -Sun SPARC 10

    		 -

    -750

    -    		 -

    -6,000

    -
    -

    -Sun Ultra 200

    		 -

    -2,650

    -    		 -

    -21,200

    -

    -Now we put the disk and the CPU together: in the Linux example, we have a single 7200 RPM disk, which can give us 560KB/s, and a CPU capable of starting 700 I/O operations, which could give us 5600KB/s. So far, as you would expect, our bottleneck is clearly going to be the hard disk.

    -The last potential bottleneck is the network. If the network speed is below 100 Mb/s, the bottleneck will be the network speed. After that, the design of the network card is more likely to slow us down. -Table B.4 shows us the average throughput of many types of data networks. Although network speed is conventionally measured in bits per second, -Table B.4 lists bytes per second to make comparison with the disk and CPU (Table B.2 and -Table B.3) easier.


    - - - - - - - - - - - -
    - -Table B.4: Network Throughput
    -

    -Network Type

    		 -

    -KB/second

    -

    - ISDN

    		-

    - 16

    -

    - T1

    		-

    - 197

    -

    - Ethernet 10m

    		-

    - 1,113

    -

    - Token ring

    		-

    - 1,500

    -

    - FDDI

    		-

    - 6,250

    -

    - Ethernet 100m

    		-

    - 6,500[3]

    -

    - ATM 155

    		-

    - 7,125a

    -
    -

    -[3] These will increase. For example, Crays, Sun Ultras, and DEC/Compaq Alphas already have bettered these figures.

    -In the running example, we have a bottleneck at 560KB/s due to the disk. -Table B.4 shows us that a standard 10 megabit per second Ethernet (1,113KB/s) is far faster than the disk. Therefore, the hard disk is still the limiting factor. (This scenario, by the way, is very common.) Just by looking at the tables, we can predict that small servers won't have CPU problems, and that large ones with multiple CPUs will support striping and multiple Ethernets long before they start running out of CPU power. This, in fact, is exactly what happens.

    -

    - -B.3.3 Practical Examples

    -An example from -Configuration and Capacity Planning for Solaris Servers (Wong) shows that a dual-processor SPARCstation 20/712 with four Ethernets and six 2.1 GB disks will spend all its time waiting for the disks to return some data. If it was loaded with disks (Brian Wong suggests as many as 34 of them), it would still be held below 1,200KB/s by the Ethernet cards. To get the performance the machine is capable of, we would need to configure multiple Ethernets, 100 Mbps Fast Ethernet, or 155 Mbps FDDI.

    -The progression you'd work through to get that conclusion looks something like -Table B.5.


    - - - - - - - - - -
    - -Table B.5: Tuning a Medium-Sized Server
    -

    -Machine

    		 -

    -Disk Throughput

    		 -

    -CPU Throughput

    		 -

    -Network Throughput

    		 -

    -Actual Throughput

    -

    -Dual SPARC 10, 1 disk

    		-

    - -560

    -    		 -

    -6000

    -    		 -

    -1,113

    -    		 -

    -560

    -
    -

    -Add 5 more disks

    		-

    -3,360

    -    		 -

    -6000

    -    		 -

    - -1,113

    -    		 -

    -1,113

    -
    -

    -Add 3 more Ethernets

    		-

    - -3,360

    -    		 -

    -16000

    -    		 -

    -4,452

    -    		 -

    -3,360

    -
    -

    -Change to using a 20-disk array

    		-

    -11,200

    -    		 -

    -6000

    -    		 -

    - -4,452

    -    		 -

    -4,452

    -
    -

    -Use dual 100 Mbps ether

    		-

    - -11,200

    -    		 -

    -6000

    -    		 -

    -13,000

    -    		 -

    -11,200

    -

    -Initially, the bottleneck is the disk with only 560 MB/s of throughput available. Our solution is to add five more disks. This gives us more throughput on the disks than on the Ethernet, so then the Ethernet becomes the problem. Consequently, as we continue to expand, we go back and forth several times between these two. As you add disks, CPUs, and network cards, the bottleneck moves. Essentially, the strategy is to add more equipment to try to avoid each bottleneck until you reach your target performance, or (unfortunately) you either can't add any more or run out of money.

    -Our experience bears out this kind of calculation; a large SPARC 10 file server that one author maintained was quite capable of saturating an Ethernet plus about a third of an FDDI ring when using two processors. It did nearly as well with a single processor, albeit with a fast operating system and judicious over-optimization.

    -The same process applies to other brands of purpose-designed servers. We found the same rules applied to DECstation 2100s as to the newest Alphas or Compaqs, old MIPS 3350s and new SGI O2s. In general, a machine offering multi-CPU server configurations will have enough bus bandwidth and CPU power to reliably bottleneck on hard disk I/O when doing file service. As one would hope, considering the cost!

    -

    - -B.3.4 How Many Clients can Samba Handle?

    -Well, that depends entirely on how much data each user consumes. A small server with three SCSI-1 disks, which can serve about 960KB/s of data, will support between 36 and 80 clients in an ordinary office environment where they are typically loading, and saving equal-sized spreadsheets or word processing documents (36 clients × 2.3 transfers/second × 12k file 1 MB/s).

    -On the same server in a development environment with programmers running a fairly heavy edit-compile-test cycle, one can easily see requests for 1 MB/s, limiting the server to 25 or fewer clients. To take this a bit further, an imaging system whose clients each require 10 MB/s will perform poorly no matter how big a server is if they're all on a 10 MB/s Ethernet. And so on.

    -If you don't know how much data an average user consumes, you can size your Samba servers by patterning them after existing NFS, Netware, or LAN Manager servers. You should be especially careful that the new servers have as many disks and disk controllers as the ones you've copied. This technique is appropriately called "punt and hope."

    -If you know how many clients an existing server can support, you're in -much better shape. You can analyze the server to see what its maximum capacity is and use that to estimate how much data they must be demanding. For example, if serving home directories to 30 PCs from a PC server with two IDE disks is just too slow, and 25 clients is about right, then you can safely assume you're bottlenecked on Ethernet I/O (approximately 375KB) rather than disk I/O (up to 640KB). If so, you can then conclude that the clients are demanding 15 (that is, 375/25)KB/s on average.

    -Supporting a new lab of 75 clients will mean you'll need 1,125KB/s, spread over multiple (preferably three) Ethernets, and a server with at least three 7200 RPM disks and a CPU capable of keeping up. These requirements can be met by a Pentium 133 or above with the bus architecture to drive them all at full speed (e.g., PCI).

    -A custom-built PC server or a multiprocessor-capable workstation like a Sun Sparc, a DEC/Compaq Alpha, an SGI, or the like, would scale up easier, as would a machine with fast Ethernet, plus a switching hub to drive the client machines on individual 10 MB/s Ethernets.

    -

    - -B.3.4.1 How to guess

    -If you have no idea at all what you need, the best thing is to try to guess based on someone else's experience. Each individual client machine can average from less than 1 I/O per second (normal PC or Mac used for sales/accounting) to as much as 4 (fast workstation using large applications). A fast workstation running a compiler can happily average 3-4 MB/s in data transfer requests, and an imaging system can demand even more.

    -Our recommendation? Spy on someone with a similar configuration and try to estimate their bandwidth requirements from their bottlenecks and the volume of the screams from their users. We also recommend Brian Wong's -Configuration and Capacity Planning for Solaris Servers. While he uses Sun Solaris foremost in his examples, his bottlenecks are disks and network cards, which are common among all the major vendors. His tables for FTP servers also come very close to what we calculated for Samba servers, and make a good starting point.

    -

    -B.3.5 Measurement Forms

    -Table B.6 and -Table B.7 are empty tables that you can use for copying and recording data. The bottleneck calculation in the previous example can be done in a spreadsheet, or manually with Table B-8. If Samba is as good as or better than FTP, and if there aren't any individual test runs that are much different from the average, you have a well-configured system. If loopback isn't much faster than anything else, you have a problem with your TCP/IP software. If both FTP and Samba are slow, you probably have a problem with your networking: a faulty Ethernet card will produce this, as will accidentally setting an Ethernet card to half-duplex when it's not connected to a half-duplex hub. Remember that CPU and disk speeds are commonly measured in bytes, network speeds in bits.

    -We've included columns for both bytes and bits in the tables. In the last column, we compare results to 10 Mb/s because that's the speed of a traditional Ethernet. -


    - - - - - - - - - - - -
    - -Table B.6: Ethernet Interface to Same Host: FTP
    -

    -Run No

    		 -

    -Size in Bytes

    		 -

    -Time (sec)

    		-

    -Bytes/sec

    		 -

    -Bits/sec

    		 -

    -% of 10 Mb/s

    -

    -1

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -2

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -3

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -4

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -5

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -Average:

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -Deviation:

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -


    - - - - - - - - - - - -
    - -Table B.7: Ethernet Interface to Same Host: FTP
    -

    -Run No

    		 -

    -Size in Bytes

    		 -

    -Time, sec

    		-

    -Bytes/sec

    		 -

    -Bits/sec

    		 -

    -% of 10 Mb/s

    -

    -1

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -2

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -3

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -4

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -5

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -Average:

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -Deviation:

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -


    - - - - - - - - - - - -
    - -Table B.8: Bottleneck Calculation Table
    -

    -CPU

    		 -

    -CPUThroughput

    		 -

    -Number of Disks

    		 -

    -Disk Throughput

    		 -

    -Number of Networks

    		 -

    -Network Throughput

    		 -

    -Total Throughput

    -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    		 -

    -

    -In -Table B.8:

      -
    • -

      - -CPU throughput = (KB/second from Figure 6-5) × (number of CPUs)

    • -

      - -Disk throughput = (KB/second from Figure 6-4) × (number of disks)

    • -

      - -Network throughput = (KB/second from Figure 6-6) × (number of networks)

    • -

      - -Total throughput = min (Disk, CPU, and Network throughput)

    -A typical test, in this case for an FTP -get, would be entered as in Table B-9: -


    - - - - - - - - - - - -
    - -Table B.9: Ethernet Interface to Same Host: FTP
    -

    -Run No

    		 -

    -Size in Bytes

    		 -

    -Time, sec

    		-

    -Bytes/sec

    		 -

    -Bits/sec

    		 -

    -% of 10 Mb/s

    -

    -1

    		 -

    -1812898

    		 -

    -2.3

    		 -

    -761580

    		 -

    -

    		 -

    -

    -

    -2

    		 -

    -

    		 -

    -2.3

    		 -

    -767820

    		 -

    -

    		 -

    -

    -

    -3

    		 -

    -

    		 -

    -2.4

    		 -

    -747420

    		 -

    -

    		 -

    -

    -

    -4

    		 -

    -

    		 -

    -2.3

    		 -

    -760020

    		 -

    -

    		 -

    -

    -

    -5

    		 -

    -

    		 -

    -2.3

    		 -

    -772700

    		 -

    -

    		 -

    -

    -

    -Average:

    		 -

    -

    		 -

    -2.32

    		 -

    -777310

    		 -

    -6218480

    		 -

    -62

    -

    -Deviation:

    		 -

    -

    		 -

    -0.04

    		 -

    -

    		 -

    -

    		 -

    -

    -The Sparc example we used earlier would look like Table B-10. -

    -

    -
    -
    -
    - - -
    - -Previous: B.2 Samba Tuning - - - -Next: C. Samba Configuration Option Quick Reference
    -B.2 Samba Tuning - -Book Index -C. Samba Configuration Option Quick Reference
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/appc_01.html b/docs/htmldocs/using_samba/appc_01.html deleted file mode 100644 index cd9d1ede35..0000000000 --- a/docs/htmldocs/using_samba/appc_01.html +++ /dev/null @@ -1,3497 +0,0 @@ - - -[Appendix C] Samba Configuration Option Quick Reference - - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: B.3 Sizing Samba Servers - - -Appendix C - -Next: D. Downloading Samba with CVS
     
    - -
    -
    -

    - -C. Samba Configuration Option Quick Reference

    The following pages list each of the Samba configuration options. If an option is applicable only to the global section, "[global]" will appear before its name. Any lists mentioned are space separated, except where noted. A glossary of terms follows the options.

    - -
    -
    admin users = user list -

    Default: NULL

    -
    -

    Allowable values: user list

    - -

    -List of users who will be granted root permissions on the share by Samba.

    -
    -
    -
    -

     

    - -
    -
    allow hosts = host list -

    Default: NULL

    -
    -

    Allowable values: any

    - -

    -Synonym for -hosts allow. List of machines that may connect to a share.

    -
    -
    -
    -

     

    - -
    -
    alternate permissions = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Obsolete. Has no effect in Samba 2. Files will be shown as read-only if the owner can't write them. In Samba 1.9 and earlier, setting this option would set the DOS filesystem read-only attribute on any file the user couldn't read. This in turn required the -delete readonly option.

    -
    -
    -
    -

     

    - -
    -
    [global] announce as = system type -

    Default: NT

    -
    -

    Allowable values: NT, Win95, WfW

    - -

    -Have Samba announce itself as something other than an NT server. Discouraged because it interferes with serving browse lists.

    -
    -
    -
    -

     

    - -
    -
    [global] announce version = number.number -

    Default: 4.2

    -
    -

    Allowable values: any

    - -

    -Instructs Samba to announce itself as an older version SMB server. Discouraged.

    -
    -
    -
    -

     

    - -
    -
    [global] auto services = share list -

    Default: NULL

    -
    -

    Allowable values: any shares

    - -

    -List of shares that will always appear in browse lists. A synonym is -preload.

    -
    -
    -
    -

     

    - -
    -
    available = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -If set to NO, denies access to a share. Doesn't affect browsing.

    -
    -
    -
    -

     

    - -
    -
    [global] bind interfaces only = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If set to YES, shares and browsing will be provided only on interfaces in an interfaces list (see -interfaces). New in Samba 1.9.18. If you set this option to YES, be sure to add 127.0.0.1 to the interfaces list to allow -smbpasswd to connect to the local machine to change passwords. This is a convienence option; it does not improve security.

    -
    -
    -
    -

     

    - -
    -
    browsable = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -Allows a share to be announced in browse lists.

    -
    -
    -
    -

     

    - -
    -
    blocking locks = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, honors byte range lock requests with time limits for queuing the request and retrying it until the time period expires. New in Samba 2.0.

    -
    -
    -
    -

     

    - -
    -
    [global] browse list = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -Turns on/off -browse -list from this server. Avoid changing.

    -
    -
    -
    -

     

    - -
    -
    [global] case sensitive = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, uses exactly the case the client supplied when trying to resolve a filename. If NO, matches either upper- or lowercase name. Avoid changing.

    -
    -
    -
    -

     

    - -
    -
    [global] case sig names = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Synonym for -case sensitive.

    -
    -
    -
    -

     

    - -
    -
    [global] change notify timeout = number -

    Default: 60

    -
    -

    Allowable values: positive number

    - -

    -Sets the number of seconds between checks when a client asks for notification of changes in a directory. Introduced in Samba 2.0 to limit the performance cost of the checks. Avoid lowering.

    -
    -
    -
    -

     

    - -
    -
    character set = name -

    Default: NULL

    -
    -

    Allowable values: ISO8859-1, ISO8859-2, ISO8859-5, KOI8-R

    - -

    -If set, translates from DOS code pages to the Western European (ISO8859-1), Eastern European (ISO8859-2), Russian Cyrillic (ISO8859-5), or Alternate Russian (KOI8-R) character set. The -client code page must be set to 850.

    -
    -
    -
    -

     

    - -
    -
    client code page = name -

    Default: 437 (US MS-DOS)

    -
    -

    Allowable values: See Table 8.4

    - -

    -Sets the DOS code page explicitly, overriding any previous -valid chars settings. Examples of values are 850 for European, 437 is the US standard, and 932 for Japanese Shift-JIS. Introduced in Samba 1.9.19.

    -
    -
    -
    -

     

    - -
    -
    coding system = code -

    Default: NULL

    -
    -

    Allowable values: euc, cap, hex, hexN, sjis, j8bb, j8bj, jis8, j8bh, j8@b, j8@j, j8@h, j7bb, j7bj, jis7, j7bh, j7@b, j7@j, j7@h, jubb, jubj, junet, jubh, ju@b, ju@j, ju@h

    - -

    -Sets the coding system used, notably for Kanji. This is employed for filenames and should correspond to the code page in use. The -client code page option must be set to 932 (Japanese Shift-JIS). Introduced in Samba 2.0.

    -
    -
    -
    -

     

    - -
    -
    comment = text -

    Default: NULL

    -
    -

    Allowable values: a text string or NULL

    - -

    -Sets the comment that appears beside a share in a NET VIEW or the details list of a Microsoft directory window. See also the -server string configuration option.

    -
    -
    -
    -

     

    - -
    -
    [global] config file = pathname -

    Default: NULL

    -
    -

    Allowable values: Unix pathname

    - -

    -Selects an additional Samba configuration file to read instead of the current one. Used to relocate the configuration file, or used with %-variables to select custom configuration files for some users or machines.

    -
    -
    -
    -

     

    - -
    -
    copy = section name -

    Default: NULL

    -
    -

    Allowable values: existing section's name

    - -

    -Copies the configuration of a previously seen share into the share where it appears. Used with %-variables to select custom configurations for machines, architectures and users. The copied section must be earlier in the configuration file. Copied options are of lesser priority than those explicitly listed in the section.

    -
    -
    -
    -

     

    - -
    -
    create mask = octal value -

    Default: 0744

    -
    -

    Allowable values: octal permission bits, 0-0777

    - -

    -Also called -create mode. Sets the maximum allowable permissions for new files (e.g., 0755). See also -directory mask. To require certain permissions to be set, see -force create mask/force directory mask. This option stopped affecting directories in Samba 1.9.17, and the default value changed in Samba 2.0.

    -
    -
    -
    -

     

    - -
    -
    create mode = octal permission bits -

    Default: 0744

    -
    -

    Allowable values: octal permission bits, 0-0777

    - -

    -Synonym for -create mask.

    -
    -
    -
    -

     

    - -
    -
    [global] deadtime = minutes -

    Default: 0

    -
    -

    Allowable values: minutes

    - -

    -The time in minutes before an unused connection will be terminated. Zero means forever. Used to keep clients from tying up server resources forever. If used, clients will have to auto-reconnect after minutes of inactivity. See also -keepalive.

    -
    -
    -
    -

     

    - -
    -
    [global] debug level = number -

    Default: 0

    -
    -

    Allowable values: number

    - -

    -Sets the logging level used. Values of 3 or more slow Samba noticeably. A synonym is -log level. Recommended value: 1.

    -
    -
    -
    -

     

    - -
    -
    [global] debug timestamp = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -Timestamps all log messages. Can be turned off when it's not useful (e.g., in debugging). New in Samba 2.0.

    -
    -
    -
    -

     

    - -
    -
    [global] default = name -

    Default: NULL

    -
    -

    Allowable values: share name

    - -

    -Also called -default service. The name of a service (share) to provide if someone requests a service they don't have permission to use or which doesn't exist. As of Samba 1.9.14, the path will be set from the name the client specified, with any "_" characters changed to "/" characters, allowing access to any directory on the Samba server. Use is strongly discouraged.

    -
    -
    -
    -

     

    - -
    -
    default case = case -

    Default: LOWER

    -
    -

    Allowable values: LOWER, UPPER

    - -

    -Sets the case in which to store new filenames. LOWER indicates mixed case, UPPER indicates uppercase letters.

    -
    -
    -
    -

     

    - -
    -
    [global] default service = share name -

    Default: NULL

    -
    -

    Allowable values: share name

    - -

    -Synonym for -default.

    -
    -
    -
    -

     

    - -
    -
    delete readonly = boolean -

    Default: NO

    -
    -

    Allowable values: NO, YES

    - -

    -Allow delete requests to remove read-only files. This is not allowed in DOS/Windows, but is normal in Unix, which has separate directory permissions. Used with programs like RCS, or with the older -alternate permissions option.

    -
    -
    -
    -

     

    - -
    -
    delete veto files = boolean -

    Default: NO

    -
    -

    Allowable values: NO, YES

    - -

    -Allow delete requests for a directory containing files or subdirectories the user can't see due to the -veto files option. If set to NO, the directory will not be deleted and will still contain invisible files.

    -
    -
    -
    -

     

    - -
    -
    deny hosts = host list -

    Default: NULL

    -
    -

    Allowable values: host list

    - -

    -A synonym is -hosts deny. Specifies a list of machines from which to refuse connections or shares.

    -
    -
    -
    -

     

    - -
    -
    [global] dfree command = command -

    Default: varies

    -
    -

    Allowable values: shell command

    - -

    -A command to run on the server to return disk free space. Not needed unless the OS command does not work properly.

    -
    -
    -
    -

     

    - -
    -
    directory = pathname -

    Default: NULL

    -
    -

    Allowable values: pathname

    - -

    -Synonym for -path. A directory provided by a file share, or used by a printer share. Set automatically in the -[homes] share to user's home directory, otherwise defaults to - /tmp.

    -
    -
    -
    -

     

    - -
    -
    directory mask = octal permission bits -

    Default: 0755

    -
    -

    Allowable values: octal value from 0 to 0777

    - -

    -Also called -directory mode. Sets the maximum allowable permissions for newly created directories. To require certain permissions be set, see the -force create mask and -force directory mask options.

    -
    -
    -
    -

     

    - -
    -
    directory mode = octal permission bits -

    Default: 0755

    -
    -

    Allowable values: octal value from 0 to 0777

    - -

    -Synonym for -directory mask.

    -
    -
    -
    -

     

    - -
    -
    [global] dns proxy = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -If set to YES, and if -wins server = YES, look up hostnames in DNS if they are not found using WINS.

    -
    -
    -
    -

     

    - -
    -
    [global] domain logons = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Allow Windows 95/98 or NT clients to log on to an NT-like domain.

    -
    -
    -
    -

     

    - -
    -
    [global] domain master = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Become a domain master browser list collector if possible for the entire workgroup/domain.

    -
    -
    -
    -

     

    - -
    -
    dont descend = comma-list -

    Default: NULL

    -
    -

    Allowable values: comma-separated list of paths

    - -

    -Does not allow a change directory or search in the directories specified. This is a browsing convenience option; it doesn't provide any extra security.

    -
    -
    -
    -

     

    - -
    -
    dos filetimes = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Allow non-owners to change file times if they can write to the file. See also -dos filetime resolution.

    -
    -
    -
    -

     

    - -
    -
    dos filetime resolution = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Set file times on Unix to match DOS standards (round to next even second). Recommended if using Visual C++ or a PC -make program to avoid remaking the programs unnecesarily. Use with the -dos filetimes option.

    -
    -
    -
    -

     

    - -
    -
    [global] encrypt passwords = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Uses Windows NT-style password encryption. Requires an -smbpasswd on the Samba server.

    -
    -
    -
    -

     

    - -
    -
    exec = command -

    Default: NULL

    -
    -

    Allowable values: shell command

    - -

    -Synonym of -preexec, a command to run as the user just before connecting to the share.

    -
    -
    -
    -

     

    - -
    -
    fake directory create times = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Bug fix for users of Microsoft -nmake. If set, Samba will set directory create times such that -nmake won't remake all files every time.

    -
    -
    -
    -

     

    - -
    -
    fake oplocks = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Return YES whenever a client asks if it can lock a file and cache it locally, but does not enforce lock on the server. Use only for read-only disks, as Samba now supports real -oplocks and has per-file overrides. See also -oplocks and -veto oplock files.

    -
    -
    -
    -

     

    - -
    -
    follow symlinks = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, Samba will follow symlinks in a file share or shares. See the -wide links option if you want to restrict symlinks to just the current share.

    -
    -
    -
    -

     

    - -
    -
    force create mask = octal permission bits -

    Default: 0

    -
    -

    Allowable values: octal value from 0 to 0777

    - -

    -Provides bits that will be -ORed into the permissions of newly created files. Used with the -create mode configuration option.

    -
    -
    -
    -

     

    - -
    -
    force create mode = octal permission bits -

    Default: 0

    -
    -

    Allowable values: octal value from 0 to 0777

    - -

    -Synonym for -force create mask.

    -
    -
    -
    -

     

    - -
    -
    force directory mask = octal permission bits -

    Default: 0

    -
    -

    Allowable values: octal value from 0 to 0777

    - -

    -Provides bits that will be -ORed into the permissions of newly created directories, forcing those bits to be set. Used with -directory mode.

    -
    -
    -
    -

     

    - -
    -
    force directory mode = octal permission bits -

    Default: 0

    -
    -

    Allowable values: octal value from 0 to 0777

    - -

    -Synonym for -force -directory -mask.

    -
    -
    -
    -

     

    - -
    -
    force group = unix group -

    Default: NULL

    -
    -

    Allowable values: group

    - -

    -Sets the effective group name assigned to all users accessing a share. Used to override user's normal groups.

    -
    -
    -
    -

     

    - -
    -
    force user = name -

    Default: NULL

    -
    -

    Allowable values: username

    - -

    -Sets the effective username assigned to all users accessing a share. Discouraged.

    -
    -
    -
    -

     

    - -
    -
    fstype = string -

    Default: NTFS

    -
    -

    Allowable values: NTFS, FAT, Samba

    - -

    -Sets the filesystem type reported to the client.

    -
    -
    -
    -

     

    - -
    -
    [global] getwd cache = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Cache current directory for performance. Recommended with the -wide links option.

    -
    -
    -
    -

     

    - -
    -
    group = group -

    Default: NULL

    -
    -

    Allowable values: unix group

    - -

    -An obsolete form of -force group.

    -
    -
    -
    -

     

    - -
    -
    guest account = user -

    Default: NULL

    -
    -

    Allowable values: username

    - -

    -Sets the name of the unprivileged Unix account to use for tasks like printing and for accessing shares marked with -guest ok.

    -
    -
    -
    -

     

    - -
    -
    guest ok = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, passwords are not needed for this share. Synonym of -public.

    -
    -
    -
    -

     

    - -
    -
    guest only = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Forces user of a share to do so as the guest account. Requires -guest -ok or -public to be -yes.

    -
    -
    -
    -

     

    - -
    -
    hide dot files = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -Treats files beginning with a dot in a share as if they had the DOS/Windows hidden attribute set.

    -
    -
    -
    -

     

    - -
    -
    hide files = slash-separated list -

    Default: NULL

    -
    -

    Allowable values: list of patterns, separated by -/ characters

    - -

    -List of file or directory names to set the DOS hidden attribute on. Names may contain -? or -* pattern-characters and -%-variables. See also -hide -dot -files and -veto -files.

    -
    -
    -
    -

     

    - -
    -
    [global] homedir map = NIS map name -

    Default: auto.home

    -
    -

    Allowable values: NIS map name

    - -

    -Used with -nis homedir to locate user's Unix home directory from Sun NIS (not NIS+).

    -
    -
    -
    -

     

    - -
    -
    hosts allow = host list -

    Default: NULL

    -
    -

    Allowable values: list of hostnames

    - -

    -Synonym of -allow hosts, a list of machines that can access a share or shares. If NULL (the default) any machine can access the share unless there is a -hosts deny option.

    -
    -
    -
    -

     

    - -
    -
    hosts deny = host list -

    Default: NULL

    -
    -

    Allowable values: list of hostnames

    - -

    -Synonym of -deny hosts, a list of machines that cannot connect to a share or shares.

    -
    -
    -
    -

     

    - -
    -
    [global] hosts equiv = pathname -

    Default: NULL

    -
    -

    Allowable values: pathname

    - -

    -Path to a file of trusted machines from which password-less logins are allowed. Strongly discouraged, because Windows/NT users can always override the user name, the only security in this scheme.

    -
    -
    -
    -

     

    - -
    -
    include = pathname -

    Default: NULL

    -
    -

    Allowable values: pathname

    - -

    -Include the named file in -smb.conf at the line where it appears. This option does not understand the variables -%u (user), -%P (current share's root directory), or -%S (current share name), because they are not set at the time the file is read.

    -
    -
    -
    -

     

    - - - -
    -
    inherit permissions = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If set, subdirectories will be created with the same permissions -as the directory they are in. This overrides -create mask, directory mask, force create mode - and force directory mode, but -not map archive, map hidden and -map system. Will never set the setuid - bit. New in 2.0.7, this is a means of ensuring Unix permissions -can be propagated to subdirectories, especially in [homes].

    - -

    -
    -
    -

     

    - - -
    -
    [global] interfaces = interface list -

    Default: NULL

    -
    -

    Allowable values: IP addresses separated by spaces

    - -

    -Sets the interfaces to which Samba will respond. The default is the machine's primary interface only. Recommended on multihomed machines or to override erroneous addresses and netmasks.

    -
    -
    -
    -

     

    - -
    -
    invalid users = user list -

    Default: NULL

    -
    -

    Allowable values: list of users

    - -

    -List of users that will not be permitted access to a share or shares.

    -
    -
    -
    -

     

    - -
    -
    [global] keepalive = number -

    Default: 0

    -
    -

    Allowable values: number of seconds

    - -

    -Number of seconds between checks for a crashed client. The default of 0 causes no checks to be performed. Recommended if you want checks more often than every four hours. 3600 (10 minutes) is reasonable. See also -socket options for another approach.

    -
    -
    -
    -

     

    - -
    -
    [global] kernel oplocks = boolean -

    Default: automatic

    -
    -

    Allowable values: YES, NO

    - -

    -Break oplock when a Unix process accesses an -oplocked file, preventing corruption. Set to YES on operating systems supporting this, otherwise set to NO. New in Samba 2.0; supported on SGI, and hopefully soon on Linux and BSD. Avoid changing.

    -
    -
    -
    -

     

    - -
    -
    [global] ldap filter = various -

    Default: varies

    -
    -

    Allowable values: various

    - -

    -Options beginning with -ldap are part of an experimental (circa Samba 2.0) use of the Lightweight Directory Access Protocol (LDAP) general directory/distributed database for user, name, and host information. This option is reserved for future use.

    -
    -
    -
    -

     

    - -
    -
    [global] ldap port = various -

    Default: various

    -
    -

    Allowable values: various

    - -

    -Options beginning with -ldap are part of an experimental (circa Samba 2.0) use of the Lightweight Directory Access Protocol (LDAP) general directory/distributed database for user, name, and host information. This option is reserved for future use.

    -
    -
    -
    -

     

    - -
    -
    [global] ldap root = various -

    Default: various

    -
    -

    Allowable values: various

    - -

    -Options beginning with -ldap are part of an experimental (circa Samba 2.0) use of the Lightweight Directory Access Protocol (LDAP) general directory/distributed database for user, name, and host information. This option is reserved for future use.

    -
    -
    -
    -

     

    - -
    -
    [global] ldap server = various -

    Default: various

    -
    -

    Allowable values: various

    - -

    -Options beginning with -ldap are part of an experimental (circa Samba 2.0) use of the Lightweight Directory Access Protocol (LDAP) general directory/distributed database for user, name, and host information. This option is reserved for future use.

    -
    -
    -
    -

     

    - -
    -
    [global] ldap suffix = various -

    Default: various

    -
    -

    Allowable values: various

    - -

    -Options beginning with -ldap are part of an experimental (circa Samba 2.0) use of the Lightweight Directory Access Protocol (LDAP) general directory/distributed database for user, name, and host information. This option is reserved for future use.

    -
    -
    -
    -

     

    - -
    -
    [global] load printers = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -Load all printer names from the system printer capabilities into browse list. Uses configuration options from the -[printers] section.

    -
    -
    -
    -

     

    - -
    -
    [global] local master = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -Stands for election as the local master browser. See also -domain master and -os level.

    -
    -
    -
    -

     

    - -
    -
    [global] lm announce = value -

    Default: AUTO

    -
    -

    Allowable values: AUTO, YES, NO

    - -

    -Produce OS/2 SMB broadcasts at an interval specified by the -lm interval option. YES/NO turns them on/off unconditionally. AUTO causes the Samba server to wait for a LAN Manager announcement from another client before sending one out. Required for OS/2 client browsing.

    -
    -
    -
    -

     

    - -
    -
    [global] lm interval = seconds -

    Default: 60

    -
    -

    Allowable values: number

    - -

    -Sets the time period, in seconds, between OS/2 SMB broadcast announcements.

    -
    -
    -
    -

     

    - -
    -
    [global] lock directory = pathname -

    Default: -/usr/local/samba/var/locks

    -
    -

    Allowable values: pathname

    - -

    -Set a directory to keep lock files in. The directory must be writable by Samba, readable by everyone.

    -
    -
    -
    -

     

    - -
    -
    locking = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -Perform file locking. If set to NO, Samba will accept lock requests but will not actually lock resources. Recommended only for read-only file systems.

    -
    -
    -
    -

     

    - -
    -
    [global] log file = pathname -

    Default: varies

    -
    -

    Allowable values: pathname

    - -

    -Set name and location of the log file. Allows all %-variables.

    -
    -
    -
    -

     

    - -
    -
    [global] log level = number -

    Default: 0

    -
    -

    Allowable values: number

    - -

    -A synonym of -debug level. Sets the logging level used. Values of 3 or more slow the system noticeably.

    -
    -
    -
    -

     

    - -
    -
    [global] logon drive = drive -

    Default: None

    -
    -

    Allowable values: DOS drive name

    - -

    -Sets the drive on Windows NT (only) of the -logon path.

    -
    -
    -
    -

     

    - -
    -
    [global] logon home = path -

    Default: -\\%

    -
    -

    Allowable values: Unix pathname

    - -

    -Sets the home directory of a Windows 95/98 or NT Workstation user. Allows -NET -USE -H:/HOME from the command prompt.

    -
    -
    -
    -

     

    - -
    -
    [global] logon path = pathname -

    Default: -\\N\%U\profile

    -
    -

    Allowable values: Windows pathname

    - -

    -Sets path to Windows profile directory. This contains -USER.MAN and/or -USER.DAT profile files and the Windows 95 Desktop, Start Menu, Network Neighborhood, and programs folders.

    -
    -
    -
    -

     

    - -
    -
    [global] logon script = pathname -

    Default: NULL

    -
    -

    Allowable values: pathname

    - -

    -Sets pathname relative to -[netlogin] share of a DOS/NT script to run on the client at login time. Allows all %-variables.

    -
    -
    -
    -

     

    - -
    -
    lppause command = /absolute_ path/command -

    Default: varies

    -
    -

    Allowable values: fully-qualfied Unix shell command

    - -

    -Sets the command to pause a print job. Honors the -%p (printer name) and -%j (job number) variables.

    -
    -
    -
    -

     

    - -
    -
    lpresume command = /absolute_ path/command -

    Default: varies

    -
    -

    Allowable values: fully-qualified Unix shell command

    - -

    -Sets the command to resume a paused print job. Honors the -%p (printer name) and -%j (job number) variables.

    -
    -
    -
    -

     

    - -
    -
    [global] lpq cache time = seconds -

    Default: 10

    -
    -

    Allowable values: number of seconds

    - -

    -Sets how long to keep print queue (lpq) status is cached, in seconds.

    -
    -
    -
    -

     

    - -
    -
    lpq command = /absolute_ path/command -

    Default: varies

    -
    -

    Allowable values: fully-qualfied Unix shell command

    - -

    -Sets the command used to get printer status. Usually initialized to a default value by the -printing option. Honors the -%p (printer name) variable.

    -
    -
    -
    -

     

    - -
    -
    lprm command = /absolute_ path/command -

    Default: varies

    -
    -

    Allowable values: fully-qualified Unix shell command

    - -

    -Sets the command to delete a print job. Usually initialized to a default value by the -printing option. Honors the -%p (printer name) and -%j (job number) variables.

    -
    -
    -
    -

     

    - -
    -
    machine password timeout = seconds -

    Default: 604,800

    -
    -

    Allowable values: number of seconds

    - -

    -Sets the period between (NT domain) machine password changes. Default is 1 week, or 604,800 seconds.

    -
    -
    -
    -

     

    - -
    -
    magic output = pathname -

    Default: -script.out

    -
    -

    Allowable values: Unix pathname

    - -

    -Sets the output file for the discouraged -magic scripts option. Default is the script name, followed by the extension -.out.

    -
    -
    -
    -

     

    - -
    -
    magic script = pathname -

    Default: NULL

    -
    -

    Allowable values: Unix pathname

    - -

    -Sets a filename for execution via a shell whenever the file is closed from the client, to allow clients to run commands on the server.

    -
    -
    -
    -

     

    - -
    -
    mangle case = boolean -

    Default: NO

    -
    -

    Allowable values: allowable values: YES, NO

    - -

    -Mangle a name if it is in mixed case.

    -
    -
    -
    -

     

    - -
    -
    mangled map = map list -

    Default: NULL

    -
    -

    Allowable values: list of to-from pairs

    - -

    -Set up a table of names to remap (e.g., -.html to -.htm).

    -
    -
    -
    -

     

    - -
    -
    mangled names = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -Sets Samba to abbreviate names that are too long or have unsupported characters to the DOS 8.3 style.

    -
    -
    -
    -

     

    - -
    -
    mangling char = character -

    Default: ~

    -
    -

    Allowable values: character

    - -

    -Sets the unique mangling character used in all mangled names.

    -
    -
    -
    -

     

    - -
    -
    [global] mangled stack = number -

    Default: 50

    -
    -

    Allowable values: number

    - -

    -Sets the size of a cache of recently-mangled filenames.

    -
    -
    -
    -

     

    - -
    -
    map aliasname = pathname -

    Default: NULL

    -
    -

    Allowable values: Unix pathname

    - -

    -Points to a file of Unix group/NT group pairs, one per line. This is used to map NT aliases to Unix group names. See also the configuration options -username -map and -map -groupname. Introduced in Samba 2.0.

    -
    -
    -
    -

     

    - -
    -
    map archive = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, Samba sets the executable-by-user (0100) bit on Unix files if the DOS archive attribute is set. Recommended: if used, the -create mask must contain the 0100 bit.

    -
    -
    -
    -

     

    - -
    -
    map hidden = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, sets executable-by-other (0001) bit on Unix files if the DOS hidden attribute is set. If used, the -create mask option must contain the 0001 bit.

    -
    -
    -
    -

     

    - -
    -
    map groupname = pathname -

    Default: NULL

    -
    -

    Allowable values: pathname

    - -

    -Points to a file of Unix group/NT group, one per line. This is used to map NT group names to Unix group names. See also the configuration options -username -map and -map -aliasname. Introduced in Samba 2.0.

    -
    -
    -
    -

     

    - -
    -
    map system = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, Samba sets the executable-by-group (0010) bit on Unix files if the DOS system attribute is set. If used, the -create mask must contain the 0010 bit.

    -
    -
    -
    -

     

    - -
    -
    max connections = number -

    Default: 0 (infinity)

    -
    -

    Allowable values: number

    - -

    -Set maximum number of connections allowed to a share from each individual client machine.

    -
    -
    -
    -

     

    - -
    -
    [global] max disk size = number -

    Default: 0 (unchanged)

    -
    -

    Allowable values: size in MB

    - -

    -Sets maximum disk size/free-space size (in megabytes) to return to client. Some clients or applications can't understand large maximum disk sizes.

    -
    -
    -
    -

     

    - -
    -
    [global] max log size = number -

    Default: 5000

    -
    -

    Allowable values: size in KB

    - -

    -Sets the size (in kilobytes) at which Samba will start a new log file. The current log file will be renamed with an -.old extension, replacing any previous file with that name.

    -
    -
    -
    -

     

    - -
    -
    [global] max mux = number -

    Default: 50

    -
    -

    Allowable values: number

    - -

    -Sets the number of simultaneous operations that Samba clients may make. Avoid changing.

    -
    -
    -
    -

     

    - -
    -
    [global] max packet = number -

    Default: N/A

    -
    -

    Allowable values: number

    - -

    -Synonym for -packet size. Obsolete as of Samba 1.7. Use -max xmit instead.

    -
    -
    -
    -

     

    - -
    -
    [global] max open files = number -

    Default: 10,000

    -
    -

    Allowable values: number

    - -

    -Limits the number of files a Samba process will try to keep open at one time. Samba allows you to set this to less than the Unix maximum. This option is a workaround for a separate problem. Avoid changing. This option was introduced in Samba 2.0.

    -
    -
    -
    -

     

    - -
    -
    [global] max ttl = seconds -

    Default: 14400 (4 hrs)

    -
    -

    Allowable values: time in seconds

    - -

    -Sets the time to keep NetBIOS names in -nmbd cache while trying to perform a lookup on it. Avoid changing.

    -
    -
    -
    -

     

    - -
    -
    [global] max wins ttl = seconds -

    Default: 259200 (3 days)

    -
    -

    Allowable values: time in seconds

    - -

    -Limits time-to-live of a NetBIOS name in -nmbd WINS cache, in seconds. Avoid changing.

    -
    -
    -
    -

     

    - -
    -
    [global] max xmit = bytes -

    Default: 65535

    -
    -

    Allowable values: size in bytes

    - -

    -Sets maximum packet size that will be negotiated by Samba. Tuning parameter for slow links and older client bugs. Values less than 2048 are discouraged.

    -
    -
    -
    -

     

    - -
    -
    [global] message command = /absolute_ path/command -

    Default: NULL

    -
    -

    Allowable values: shell command

    - -

    -Sets the command on the server to run when a WinPopup message arrives from a client. The command must end in "&" to allow immediate return. Honors all %-variables except -%u (user), and supports the extra variables -%s (filename the message is in), -%t (destination machine), and -%f (from).

    -
    -
    -
    -

     

    - -
    -
    min print space = kilobytes -

    Default: 0 (unlimited)

    -
    -

    Allowable values: space in KB

    - -

    -Sets minimum spool space required before accepting a print request.

    -
    -
    -
    -

     

    - - -
    -
    min password length = characters -

    Default: 5

    -
    -

    Allowable values: decimal number of characters

    - -

    -Sets the shortest password Samba will pass to the Unix passwd command. -

    -
    -
    -

     

    - - -
    -
    [global] min wins ttl = seconds -

    Default: 21600 (6 hrs)

    -
    -

    Allowable values: time in seconds

    - -

    -Sets minimum time-to-live of a NetBIOS name in -nmbd WINS cache, in seconds. Avoid changing.

    -
    -
    -
    -

     

    - -
    -
    name resolve order = list -

    Default: lmhosts wins hosts bcast

    -
    -

    Allowable values: list of lmhosts, wins, hosts and bcast

    - -

    -Sets order of lookup when trying to get IP address from names. The -hosts parameter carrries out a regular name look up using the server's normal sources: -/etc/hosts, DNS, NIS, or a combination of them. Introduced in Samba 1.9.18p4.

    -
    -
    -
    -

     

    - -
    -
    [global] netbios aliases = list -

    Default: NULL

    -
    -

    Allowable values: list of netbios names

    - -

    -Adds additional NetBIOS names by which a Samba server will advertise itself.

    -
    -
    -
    -

     

    - -
    -
    netbios name = hostname -

    Default: varies

    -
    -

    Allowable values: host name

    - -

    -Sets the NetBIOS name by which a Samba server is known, or primary name if NetBIOS aliases exist.

    -
    -
    -
    -

     

    - - - -
    -
    netbios scope = string -

    Default: NULL

    -
    -

    Allowable values: string

    - -

    -Sets the NetBIOS scope string. Samba will not communicate with a machine -with a different scope. This was an early predecessor of workgroups: avoid -setting it. Added in 2.0.7. -

    -
    -
    -

     

    - - -
    -
    [global] networkstation user login = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -If set to NO, clients will not do a full login when -security = server. Avoid changing. Turning it off is a temporary workaround (introduced in Samba 1.9.18p3) for NT trusted domains bug. Automatic correction was introduced in Samba 1.9.18p10; the parameter may eventually be removed.

    -
    -
    -
    -

     

    - -
    -
    [global] nis homedir = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, the -homedir map will be used to look up the user's home-directory server name and return it to the client. The client will contact that machine to connect to the share. This avoids mounting from a machine that doesn't actually have the disk. The machine with the home directories must be an SMB server.

    -
    -
    -
    -

     

    - -
    -
    [global] nt pipe support = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -Allows turning off NT-specific pipe calls. This is a developer/benchmarking option and may be removed in the future. Avoid changing.

    -
    -
    -
    -

     

    - -
    -
    [global] nt smb support = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, allow NT-specific SMBs to be used. This is a developer/benchmarking option and may be removed in the future. Avoid changing.

    -
    -
    -
    -

     

    - -
    -
    [global] null passwords = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, allows access to accounts that have null passwords. Strongly discouraged.

    -
    -
    -
    -

     

    - -
    -
    ole locking compatibility = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, locking ranges will be mapped to avoid Unix locks crashing when Windows uses locks above 32KB. You should avoid changing this option. Introduced in Samba 1.9.18p10.

    -
    -
    -
    -

     

    - -
    -
    only guest = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -A synonym for -guest only. Forces user of a share to login as the guest account.

    -
    -
    -
    -

     

    - -
    -
    only user = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Requires that users of the share be on a -username = list.

    -
    -
    -
    -

     

    - -
    -
    oplocks = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, support local caching of -opportunistic locked files on client. This option is recommended because it improves performance by about 30%. See also -fake -oplocks and -veto -oplock -files.

    -
    -
    -
    -

     

    - -
    -
    [global] os level = number -

    Default: 0

    -
    -

    Allowable values: number

    - -

    -Sets the candidacy of the server when electing a browse master. Used with the -domain -master or -local -master options. You can set a higher value than a competing operating system if you want Samba to win. Windows for Workgroups and Windows 95 use 1, Windows NT client uses 17, and Windows NT Server uses 33.

    -
    -
    -
    -

     

    - -
    -
    [global] packet size = bytes -

    Default: 65535

    -
    -

    Allowable values: number in bytes

    - -

    -Obsolete. Discouraged synonym of -max packet. See -max xmit.

    -
    -
    -
    -

     

    - -
    -
    [global] passwd chat debug = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Logs an entire password chat, including passwords passed, with a log level of 100. For debugging only. Introduced in Samba 1.9.18p5.

    -
    -
    -
    -

     

    - -
    -
    [global] passwd chat = command sequence -

    Default: compiled-in value

    -
    -

    Allowable values: Unix server commands

    - -

    -Sets the command used to change passwords on the server. Supports the variables -%o (old password) and -%n (new password) and allows -\r -\n -\t and -\s (space) escapes in the sequence.

    -
    -
    -
    -

     

    - -
    -
    [global] passwd program = program -

    Default: NULL

    -
    -

    Allowable values: Unix server program

    - -

    -Sets the command used to change user's password. Will be run as -root. Supports -%u (user).

    -
    -
    -
    -

     

    - -
    -
    [global] password level = number -

    Default: 0

    -
    -

    Allowable values: number

    - -

    -Specifies the number of uppercase letter permutations used to match passwords. Workaround for clients that change passwords to a single case before sending them to the Samba server. Causes repeated login attempts with passwords in different cases, which can trigger account lockouts.

    -
    -
    -
    -

     

    - -
    -
    [global] password server = netbios names -

    Default: NULL

    -
    -

    Allowable values: list of NetBIOS names

    - -

    -A list of SMB servers that will validate passwords for you. Used with an NT password server (PDC or BDC) and the -security -= -server or -security -= -domain configuration options. Caution: an NT password server must allow logins from the Samba server.

    -
    -
    -
    -

     

    - -
    -
    panic action = /absolute_ path/command -

    Default: NULL

    -
    -

    Allowable values: fully-qualfied Unix shell command

    - -

    -Sets the command to run when Samba panics. For Samba developers and testers, -/usr/bin/X11/xterm -display :0 -e gdb /samba/bin/smbd %d is a possible value.

    -
    -
    -
    -

     

    - -
    -
    path = pathname -

    Default: varies

    -
    -

    Allowable values: pathname

    - -

    -Sets the path to the directory provided by a file share or used by a printer share. Set automatically in -[homes] share to user's home directory, otherwise defaults to - /tmp. Honors the -%u (user) and -%m (machine) variables.

    -
    -
    -
    -

     

    - -
    -
    postexec = /absolute_ path/command -

    Default: NULL

    -
    -

    Allowable values: fully-qualified Unix shell command

    - -

    -Sets a command to run as the user after disconnecting from the share. See also the options -preexec, -root preexec, and -root postexec.

    -
    -
    -
    -

     

    - -
    -
    postscript = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Flags a printer as PostScript to avoid a Windows bug by inserting -%! as the first line. Works only if printer actually is PostScript compatible.

    -
    -
    -
    -

     

    - -
    -
    preexec = /absolute_ path/command -

    Default: NULL

    -
    -

    Allowable values: fully-qualified Unix shell command

    - -

    -Sets a command to run as the user before connecting to the share. See also the options -postexec, -root preexec, and -root postexec.

    -
    -
    -
    -

     

    - -
    -
    [global] preferred master = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, Samba is preferred to become the master browser. Causes Samba to call a browsing election when it comes online.

    -
    -
    -
    -

     

    - -
    -
    preload = share list -

    Default: NULL

    -
    -

    Allowable values: list of services

    - -

    -Synonym of -auto -services. Specifies a list of shares that will always appear in browse lists.

    -
    -
    -
    -

     

    - -
    -
    preserve case = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If set to YES, this option leaves filenames in the case sent by client. If no, it forces filenames to the case specified by the -default -case option. See also -short preserve case.

    -
    -
    -
    -

     

    - -
    -
    print command = /absolute_ path/command -

    Default: varies

    -
    -

    Allowable values: fully-qualified Unix shell command

    - -

    -Sets the command used to send a spooled file to the printer. Usually initialized to a default value by the -printing option. This option honors the -%p (printer name), -%s (spool file) and -%f (spool file as a relative path) variables. Note that the command in the value of the option must include file deletion of the spool file.

    -
    -
    -
    -

     

    - -
    -
    print ok = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Synonym of -printable.

    -
    -
    -
    -

     

    - -
    -
    printable = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Sets a share to be a print share. Required for all printers.

    -
    -
    -
    -

     

    - -
    -
    [global] printcap name = pathname -

    Default: -/etc/printcap

    -
    -

    Allowable values: pathname

    - -

    -Sets the path to the printer capabilities file used by the -[printers] share. The default value changes to -/etc/qconfig under AIX and -lpstat on System V.

    -
    -
    -
    -

     

    - -
    -
    printer = name -

    Default: -lp

    -
    -

    Allowable values: printer name

    - -

    -Sets the name of the Unix printer.

    -
    -
    -
    -

     

    - -
    -
    printer driver = printer driver name -

    Default: NULL

    -
    -

    Allowable values: exact printer driver string used by Windows

    - -

    -Sets the string to pass to Windows when asked what driver to use to prepare files for a printer share. Note that the value is case sensitive.

    -
    -
    -
    -

     

    - -
    -
    [global] printer driver file = path -

    Default: -samba-lib/printers.def

    -
    -

    Allowable values: Unix pathname

    - -

    -Sets the location of a - msprint.def file, usable by Windows 95/98.

    -
    -
    -
    -

     

    - -
    -
    printer driver location = path -

    Default: -\\server\PRINTER$

    -
    -

    Allowable values: Windows network path

    - -

    -Sets the location of the driver for a particular printer. The value is a pathname for a share that stores the printer driver files.

    -
    -
    -
    -

     

    - -
    -
    printer name = name -

    Default: NULL

    -
    -

    Allowable values: name

    - -

    -Synonym of -printer.

    -
    -
    -
    -

     

    - -
    -
    printing = style -

    Default: bsd

    -
    -

    Allowable values: bsd, sysv, hpux, aix, qnx, plp, lprng

    - -

    -Sets printing style to one of the above, instead of the compiled-in value. This sets initial values of at least the -print -command, -print -command, -lpq -command, and -lprm -command.

    -
    -
    -
    -

     

    - -
    -
    [global] protocol = protocol -

    Default: NT1

    -
    -

    Allowable values: NT1, LANMAN2, LANMAN1, COREPLUS, CORE

    - -

    -Sets SMB protocol version to one of the allowable values. Resetting is highly discouraged. Only for backwards compatibility with older-client bugs.

    -
    -
    -
    -

     

    - -
    -
    public = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, passwords are not needed for this share. A synonym is -guest ok.

    -
    -
    -
    -

     

    - -
    -
    queuepause command = /absolute_ path/command -

    Default: varies

    -
    -

    Allowable values: valid Unix command

    - -

    -Sets the command used to pause a print queue. Usually initialized to a default value by the -printing option. Introduced in Samba 1.9.18p10.

    -
    -
    -
    -

     

    - -
    -
    queueresume command = /absolute_ path/command -

    Default: varies

    -
    -

    Allowable values: valid Unix command

    - -

    -Sets the command used to resume a print queue. Usually initialized to a default value by the -printing option. Introduced in Samba 1.9.18p10.

    -
    -
    -
    -

     

    - -
    -
    read bmpx = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Obsolete. Do not change.

    -
    -
    -
    -

     

    - -
    -
    read list = comma-separated list -

    Default: NULL

    -
    -

    Allowable values: comma-separated list of users

    - -

    -Specifies a list of users given read-only access to a writeable share.

    -
    -
    -
    -

     

    - -
    -
    read only = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Sets a share to read-only. Antonym of -writable and -write ok.

    -
    -
    -
    -

     

    - -
    -
    [global] read prediction = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Reads ahead data for read-only files. Obsolete; removed in Samba 2.0.

    -
    -
    -
    -

     

    - -
    -
    [global] read raw = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -Allows fast streaming reads over TCP using 64K buffers. Recommended.

    -
    -
    -
    -

     

    - -
    -
    [global] read size = bytes -

    Default: 2048

    -
    -

    Allowable values: size in bytes

    - -

    -Sets a buffering option for servers with mismatched disk and network speeds. Requires experimentation. Avoid changing. Should not exceed 65536.

    -
    -
    -
    -

     

    - -
    -
    [global] remote announce = remote list -

    Default: NULL

    -
    -

    Allowable values: list of remote addresses

    - -

    -Adds workgroups to the list on which the Samba server will announce itself. Specified as IP address/workgroup (for instance, 192.168.220.215/SIMPLE) with multiple groups separated by spaces. Allows directed broadcasts. The server will appear on those workgroup's browse lists. Does not require WINS.

    -
    -
    -
    -

     

    - -
    -
    [global] remote browse sync = address list -

    Default: NULL

    -
    -

    Allowable values: IP-address list

    - -

    -Enables Samba-only browse list synchronization with other Samba local master browsers. Addresses can be specific addresses or directed broadcasts (i.e., ###.###.###.255). The latter will cause Samba to hunt down the local master.

    -
    -
    -
    -

     

    - -
    -
    revalidate = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If set to YES, requires users to re-enter passwords even after a successful initial logon to a share with a password.

    -
    -
    -
    -

     

    - -
    -
    [global] root = pathname -

    Default: NULL

    -
    -

    Allowable values: Unix pathname

    - -

    -Synonym for -root directory.

    -
    -
    -
    -

     

    - -
    -
    [global] root dir = pathname -

    Default: NULL

    -
    -

    Allowable values: Unix pathname

    - -

    -Synonym for -root directory.

    -
    -
    -
    -

     

    - -
    -
    [global] root directory = pathname -

    Default: NULL

    -
    -

    Allowable values: Unix pathname

    - -

    -Specifies a directory to -chroot() to before starting daemons. Prevents any access below that directory tree. See also the -wide links configuration option.

    -
    -
    -
    -

     

    - -
    -
    root postexec = /absolute_ path/command -

    Default: NULL

    -
    -

    Allowable values: fully-qualified Unix shell command

    - -

    -Sets a command to run as root after disconnecting from the share. See also -preexec, -postexec, and -root -preexec configuration options. Runs after the user's -postexec command. Use with caution.

    -
    -
    -
    -

     

    - -
    -
    root preexec = /absolute_ path/command -

    Default: NULL

    -
    -

    Allowable values: fully-qualified Unix shell command

    - -

    -Sets a command to run as root before connecting to the share. See also -preexec, -postexec, and -root -postexec configuration options. Runs before the user's -preexec command. Use with caution.

    -
    -
    -
    -

     

    - -
    -
    [global] security = value -

    Default: share in Samba 1.0, user in 2.0

    -
    -

    Allowable values: share, user, server, domain

    - -

    -Sets password-security policy. If -security -= -share, services have a shared password, available to everyone. If -security -= -user, users have (Unix) accounts and passwords. If -security -= -server, users have accounts and passwords and a separate machine authenticates them for Samba. If -security -= -domain, full NT-domain authentication is done. See also the -password server and -encrypted passwords configuration options.

    -
    -
    -
    -

     

    - -
    -
    [global] server string = text -

    Default: Samba -%v in 2.0

    -
    -

    Allowable values: string

    - -

    -Sets the name that appears beside a server in browse lists. Honors the -%v (Samba version number) and -%h (hostname) variables.

    -
    -
    -
    -

     

    - -
    -
    set directory = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Allows DEC Pathworks client to use the -set dir command.

    -
    -
    -
    -

     

    - -
    -
    [global] shared file entries = number -

    Default: 113

    -
    -

    Allowable values: number

    - -

    -Obsolete; do not use.

    -
    -
    -
    -

     

    - -
    -
    shared mem size = bytes -

    Default: 102400

    -
    -

    Allowable values: size in bytes

    - -

    -If compiled with FAST_SHARE_MODES (mmap), sets the shared memory size in bytes. Avoid changing.

    -
    -
    -
    -

     

    - -
    -
    [global] smb passwd file = path -

    Default: -/usr/local/samba/private/smbpasswd

    -
    -

    Allowable values: Unix pathname

    - -

    -Overrides compiled-in path to password file if -encrypted passwords -= -yes.

    -
    -
    -
    -

     

    - -
    -
    [global] smbrun = /absolute_ path/command -

    Default: compiled-in value

    -
    -

    Allowable values: smbrun command

    - -

    -Overrides compiled-in path to -smbrun binary. Avoid changing.

    -
    -
    -
    -

     

    - -
    -
    share modes = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -If set to YES, this option supports Windows-style whole-file (deny mode) locks.

    -
    -
    -
    -

     

    - -
    -
    short preserve case = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If set to YES, leaves mangled 8.3-style filenames in the case sent by client. If no, it forces the case to that specified by the -default case option. See also -preserve case.

    -
    -
    -
    -

     

    - -
    -
    [global] socket address = IP address -

    Default: NULL

    -
    -

    Allowable values: IP address

    - -

    -Sets address on which to listen for connections. Default is to listen to all addresses. Used to support multiple virtual interfaces on one server. Highly discouraged.

    -
    -
    -
    -

     

    - -
    -
    [global] socket options = socket option list -

    Default: NULL

    -
    -

    Allowable values: list

    - -

    -Sets OS-specific socket options. -SO_KEEPALIVE has TCP check clients every 4 hours to see if they are still accessible. -TCP_NODELAY sends even tiny packets to keep delay low. Recommended wherever the operating system supports them. See Appendix B, Samba Performance Tuning, for more information.

    -
    -
    -
    -

     

    - - - -
    -
    [global] source environment = string -

    Default: NULL

    -
    -

    Allowable values: pathname

    - -

    -This pathname parameter causes Samba to read a list of environment -variables from a named file on startup. This can be useful in setting -up Samba in a clustered environment. This is new in 2.0.7.

    - -

    The file must be owned by root and not be world writable, -and if the filename begins with a "|" (pipe) character, it must point to -a command which is neither world writable nor resides -in a world writable directory.

    - -

    The data should be in the form of lines such as -SAMBA_NETBIOS_NAME=myhostname. -This variable will then be available in the smb.conf files as $%SAMBA_NETBIOS_NAME.

    - -
    -
    -
    -

     

    - - -
    -
    [global] status = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, logs connections to a file (or shared memory) accessible to -smbstatus.

    -
    -
    -
    -

     

    - -
    -
    strict sync = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If set to YES, Samba will synchronize to disk whenever the client sets the sync bit in a packet. If set to NO, Samba flushes data to disk whenever buffers fill. Defaults to NO because Windows 98 Explorer sets the bit (incorrectly) in all packets. Introduced in Samba 1.9.18p10.

    -
    -
    -
    -

     

    - -
    -
    strict locking = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If set to YES, Samba checks locks on every access, not just on demand and at open time. Not recommended.

    -
    -
    -
    -

     

    - -
    -
    [global] strip dot = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Removes trailing dots from filenames. Use -mangled map instead.

    -
    -
    -
    -

     

    - -
    -
    [global] syslog = number -

    Default: 1

    -
    -

    Allowable values: number

    - -

    -Sets number of Samba log messages to send to -syslog. Higher is more verbose. The -syslog.conf file must have suitable logging enabled.

    -
    -
    -
    -

     

    - -
    -
    [global] syslog only = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If set to YES, log only to -syslog, not standard Samba log files.

    -
    -
    -
    -

     

    - -
    -
    sync always = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If set to YES, Samba calls - fsync(3) after every write. Avoid except for debugging crashing servers.

    -
    -
    -
    -

     

    - -
    -
    [global] time offset = minutes -

    Default: 0

    -
    -

    Allowable values: minutes

    - -

    -Sets number of minutes to add to system time zone calculation. Provided to fix a client daylight-savings bug; not recommended.

    -
    -
    -
    -

     

    - -
    -
    [global] time server = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If YES, -nmbd will provide time service to its clients.

    -
    -
    -
    -

     

    - -
    -
    unix password sync = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If set, will attempt to change the user's Unix password whenever the user changes his or her SMB password. Used to ease synchronization of Unix and Microsoft password databases. Added in Samba 1.9.18p4. See also -passwd chat.

    -
    -
    -
    -

     

    - -
    -
    unix realname = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -If set, will provide the GCOS field of -/etc/passwd to the client as the user's full name.

    -
    -
    -
    -

     

    - -
    -
    update encrypted = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -Updates the Microsoft-format password file when a user logs in with unencrypted passwords. Provided to ease conversion to encryped passwords for Windows 95/98 and NT. Added in Samba 1.9.18p5.

    -
    -
    -
    -

     

    - -
    -
    user = comma-separated list -

    Default: NULL

    -
    -

    Allowable values: comma-separated list of user names

    - -

    -Synonym for -username.

    -
    -
    -
    -

     

    - -
    -
    username = comma-separated list -

    Default: NULL

    -
    -

    Allowable values: comma-separated list of user names

    - -

    -Sets a list of users to try to log in as for a share or shares with share-level security. Synonyms are -user and -users. Discouraged. Use -NET USE \\server\share %user from the client instead.

    -
    -
    -
    -

     

    - -
    -
    username level = number -

    Default: 0

    -
    -

    Allowable values: number

    - -

    -Number of uppercase letter permutations allowed to match Unix usernames. Workaround for Windows feature (single-case usernames). Use is discouraged.

    -
    -
    -
    -

     

    - -
    -
    [global] username map = pathname -

    Default: NULL

    -
    -

    Allowable values: pathname

    - -

    -Names a file of Unix-to-Windows name pairs; used to map different spellings of account names and those Windows usernames longer than eight characters.

    -
    -
    -
    -

     

    - - -
    -
    [global] utmp = boolean -

    Default: NO

    -
    -

    Allowable values: YES, NO

    - -

    -This is available if Samba has been configured with the option - --with-utmp. -If set, Samba will add utmp/utmpx records whenever a -connection is made to a Samba server. New in 2.0.7, sites may use this -to record the user connecting to a Samba share. -

    -
    -
    -
    -

     

    - - -
    -
    [global] utmp directory = string -

    Default: NULL

    -
    -

    Allowable values: pathname

    - -

    -This is available if Samba has been configured with the option ---with-utmp. If it and -utmp are set, Samba will look in the specified directory -insteqad of the default system directory for utmp/utmpx files. -New in 2.0.7, also called utmp dir. -

    -
    -
    -
    -

     

    - -
    -
    write cache size = decimal number -

    Default: 0 (Disabled)

    -
    -

    Allowable values: decimal number of bytes

    - -

    -Sets the size of a write buffer that Samba uses to pre-accumulate -write into, so as to write with a particular size that's optimal for -a given filesystem. Typically this is used with RAID drives, which -have a preferred write size, systems with large memory and slow disks, etc.

    - -

    As of Samba 2.0.7, this applies to the first 10 oplocked files, -which are also found in shares where this option is set. -

    -
    -
    -
    -

     

    - - -
    -
    write ok = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -Synonym of the -writable configuration option.

    -
    -
    -
    -

     

    - -
    -
    [global] write raw = boolean -

    Default: YES

    -
    -

    Allowable values: YES, NO

    - -

    -Allows fast streaming writes over TCP, using 64KB buffers. Recommended.

    -
    -
    - -

    Glossary of Configuration Values

    -
    -
    Address list
    -

    -A space-separated list of IP addresses in ###.###.###.### format.

    -Comma-separated list
    -

    -A list of items separated by commas.

    -Command
    -

    -A Unix command, with full path and parameters.

    -Host list
    -

    -A space-separated list of hosts. Allows IP addresses, address masks, domain names, ALL, and EXCEPT

    -Interface list
    -

    -A space-separated list of interfaces, in either address/netmask or address/n-bits format. For example, 192.168.2.10/24 or 192.168.2.10/255.255.255.0

    -Map list
    -

    -A space-separated list of file-remapping strings such as -(*.html -*.htm).

    -Remote list
    -

    -A space-separated list of subnet-broadcast-address/workgroup pairs. For example, 192.168.2.255/SERVERS 192.168.4.255/STAFF.

    -Service (share) list
    -

    -A space-separated list of share names, without the enclosing square brackets.

    -Slash-list
    -

    -A list of filenames, separated by "/" characters to allow embedded spaces. For example, -/.*/fred -flintstone/*.frk/.

    -Text
    -

    -One line of text.

    -User list
    -

    -A space-separated list of usernames. In Samba 1.9, -@group-name will include everyone in Unix group -group-name. In Samba 2.0, -@group-name includes whomever is in the NIS netgroup -group_name if one exists, otherwise whomever is in the Unix group -group_name. In addition, + -group_name is a Unix group, & -group_name is an NIS netgroup, and &+ and +& cause an ordered search of both Unix and NIS groups.

    -
    -

    Configuration File Variables

    -

    - -Table C.1 lists of Samba configuration file variables.


    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    - -Table C.1: Variables in Alphabetic Order
    -

    -Name

    		 -

    -Meaning

    -

    - -%a

    		 -

    -Client's architecture (one of Samba, WfWg, WinNT, Win95, or UNKNOWN)

    -

    - -%d

    		 -

    -Current server process's processID

    -

    - -%f

    		 -

    -Print-spool file as a relative path (printing only)

    -

    - -%f

    		 -

    -User from which a message was sent (messages only)

    -

    - -%G

    		 -

    -Primary group name of -%U (requested username)

    -

    - -%g

    		 -

    -Primary group name of -%u (actual username)

    -

    - -%H

    		 -

    -Home directory of -%u (actual username)

    -

    - -%h

    		 -

    -Samba server's (Internet) hostname

    -

    - -%I

    		 -

    -Client's IP address

    -

    - -%j

    		 -

    -Print job number (printing only)

    -

    - -%L

    		 -

    -Samba server's NetBIOS name (virtual servers have multiple names)

    -

    - -%M

    		 -

    -Client's (Internet) hostname

    -

    - -%m

    		 -

    -Client's NetBIOS name

    -

    - -%n

    		 -

    -New password (password change only)

    -

    - -%N

    		 -

    -Name of the NIS home directory server (without NIS, same as -%L)

    -

    - -%o

    		 -

    -Old password (password change only)

    -

    - -%P

    		 -

    -Current share's root directory (actual)

    -

    - -%p

    		 -

    -Current share's root directory (in an NIS homedir map)

    -

    - -%p

    		 -

    -Print filename (printing only)

    -

    - -%R

    		 -

    -Protocol level in use (one of CORE, COREPLUS, LANMAN1, LANMAN2, or NT1)

    -

    - -%S

    		 -

    -Current share's name

    -

    - -%s

    		 -

    -Filename the message is in (messages only)

    -

    - -%s

    		 -

    -Print-spool file name (printing only)

    -

    - -%T

    		 -

    -Current date and time

    -

    - -%t

    		 -

    -Destination machine (messages only)

    -

    - -%u

    		 -

    -Current share's username

    -

    - -%U

    		 -

    -Requested username for current share

    -

    - -%v

    		 -

    -Samba version

    -
    -
    -
    - - -
    - -Previous: B.3 Sizing Samba Servers - - - -Next: D. Summary of Samba Daemons and Commands
    -B.3 Sizing Samba Servers - -Book Index -D. Summary of Samba Daemons and Commands
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/appd_01.html b/docs/htmldocs/using_samba/appd_01.html deleted file mode 100644 index 5e3bd16aa4..0000000000 --- a/docs/htmldocs/using_samba/appd_01.html +++ /dev/null @@ -1,1907 +0,0 @@ - - -Appendix D - - - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: C. Samba Configuration Option Quick Reference - - -Appendix D - -Next: E. Downloading Samba with CVS
     
    - - -
    -
    -

    Appendix D
    -Summary of Samba Daemons and Commands

    - -

    -This appendix is a reference listing of command-line options and other information to help you use the executables that come with Samba distribution. - -

    -

    Samba Distribution Programs

    -

    The following sections provide information about the command-line parameters for Samba programs.

    -
    -

    smbd

    -

    The smbd - program provides Samba's file and printer services, using one TCP/IP stream and one daemon per client. It is controlled from the default configuration file, samba_dir/lib/smb.conf, and can be overridden by command-line options.

    -

    The configuration file is automatically re-evaluated every minute. If it has changed, most new options are immediately effective. You can force Samba to immediately reload the configuration file if you send a SIGHUP to smbd -. Reloading the configuration file, however, will not affect any clients that are already connected. To escape this "grandfather" configuration, a client would need to disconnect and reconnect, or the server itself would have to be restarted, forcing all clients to reconnect.

    -
    -

    Other signals

    -

    To shut down a smbd - process, send it the termination signal SIGTERM (-15) which allows it to die gracefully instead of a SIGKILL (-9). To increment the debug logging level of smbd - at runtime, send the program a SIGUSR1 signal. To decrement it at runtime, send the program a SIGUSR2 signal.

    -
    -
    -

    Command-line options

    -
    -
    -

    -D -

    -
      -
    • The smbd - program is run as a daemon. This is the recommended way to use smbd (it is also the default action). In addition, smbd can also be run from inetd.
      • -
    -
    -
    -

    -d - debuglevel -

    -
      -
    • Sets the debug (sometimes called logging) level. The level can range from 0 all the way to 10. Specifying the value on the command line overrides the value specified in the smb.conf - file. Debug level 0 logs only the most important messages; level 1 is normal; levels 3 and above are primarily for debugging and slow smbd - considerably.
      • -
    -
    -

    -h -

    -
      -
    • Prints command-line usage information for the smbd - program.
      • -
    -
    -

    Testing/debugging options

    -
    -
    -
    -

    -a -

    -
      -
    • If this is specified, each new connection to the Samba server will append all logging messages to the log file. This option is the opposite of -o, and is the default.
      • -
    -
    -
    -

    -i - scope -

    -
      -
    •  
      • -
    • This sets a NetBIOS scope identifier. Only machines with the same identifier will communicate with the server. The scope identifier was a predecessor to workgroups, and this option is included only for backwards compatibility.
      • -
    -
    -
    -
    -

    -l - log_file -

    -
      -
    • Send the log messages to somewhere other than the location compiled in or specified in the smb.conf file. The default is often /usr/local/samba/var/log.smb, /usr/samba/var/log.smb, or /var/log/log.smb. The first two are strongly discouraged on Linux, where /usr - may be a read-only filesystem.
      • -
    -
    -
    -

    -O - socket_options -

    -
      -
    • This sets the TCP/IP socket options, using the same parameters as the socket - options - configuration option. It is often used for performance tuning and testing.
      • -
    -
    -

    -o -

    -
      -
    • This option is the opposite of -a. It causes log files to be overwritten when opened. Using this option saves hunting for the right log entries if you are performing a series of tests and inspecting the log file each time.
      • -
    -
    -
    -

    -P -

    -
      -
    • This option forces smbd - not to send any network data out. This option is typically used only by Samba developers.
      • -
    -
    -
    -

    -P -

    -
      -
    • This option forces smbd - not to send any network data out. This option is typically used only by Samba developers.
      • -
    -
    -
    -
    -

    -p - port_number -

    -
      -
    • This sets the TCP/IP port number that the server will accept requests from. Currently, all Microsoft clients send only to the default port: 139.
      • -
    -
    -
    -

    -s - configuration_file -

    -
      -
    • Specifies the location of the Samba configuration file. Although the file defaults to /usr/local/samba/lib/smb.conf, you can override it here on the command line, typically for debugging.
      • -
    -
    -
    -
    -

    nmbd

    -

    The nmbd - program is Samba's NetBIOS name and browsing daemon. It replies to broadcast NetBIOS over TCP/IP (NBT) name-service requests from SMB clients and optionally to Microsoft's Windows Internet Name Service (WINS) requests. Both of these are versions of the name-to-address lookup required by SMB clients. The broadcast version uses UDP/IP broadcast on the local subnet only, while WINS uses TCP/IP, which may be routed. If running as a WINS server, nmbd - keeps a current name and address database in the file wins.dat in the samba_dir/var/locks directory.

    -

    An active nmbd - program can also respond to browsing protocol requests used by the Windows Network Neighborhood. Browsing is a combined advertising, service announcement, and active directory protocol. This protocol provides a dynamic directory of servers and the disks and printers that the servers are providing. As with WINS, this was initially done by making UDP/IP broadcasts on the local subnet. Now, with the concept of a local master browser, it is done by making TCP/IP connections to a server. If nmbd - is acting as a local master browser, it stores the browsing database in the file browse.dat in the samba_dir/var/locks directory.

    -
    -

    Signals

    -

    Like smbd, the nmbd program responds to several Unix signals. Sending nmbd - a SIGHUP signal will cause it to dump the names it knows about to the file namelist.debug - in the samba_dir -/locks - directory and its browsing database to the browse.dat -file in the same directory. To shut down a nmbd - process send it a SIGTERM (-15) signal instead of a SIGKILL (-9) to allow it to die gracefully. You can increment the debug logging level of nmbd - by sending it a SIGUSR1 signal; you can decrement it by sending a SIGUSR2 signal.

    -
    -
    -

    Command-line options

    -
    -
    -

    -D -

    -
      -
    • Instructs the nmbd - program to run as a daemon. This is the recommended way to use nmbd. In addition, nmbd can also be run from inetd.
      • -
    -
    -
    -

    -d - debuglevel -

    -
      -
    • Sets the debug (sometimes called logging) level. The level can range from 0, all the way to 10. Specifying the value on the command line overrides the value specified in the smb.conf - file. Debug level 0 logs only the most important messages; level 1 is normal; level 3 and above are primarily for debugging, and slow nmbd - considerably.
      • -
    -
    -

    -h -

    -
      -
    • Prints command-line usage information for the nmbd program (also -?).
      • -
    -
    -

    Testing/debugging options

    -
    -
    -
    -

    -a -

    -
      -
    • If this is specified, each new connection to the Samba server will append all logging messages to the log file. This option is the opposite of -o, and is the default.
      • -
    -
    -
    -
    -

    -H - hosts_ file -

    -
      -
    • This option loads a standard hosts - file for name resolution.
      • -
    -
    -
    -

    -i - scope -

    -
      -
    • This sets a NetBIOS scope identifier. Only machines with the same identifier will communicate with the server. The scope identifier was a predecessor to workgroups, and this option is included only for backward compatibility.
      • -
    -
    -
    -

    -l - log_file -

    -
      -
    • Sends the log messages to somewhere other than the location compiled-in or specified in the smb.conf file. The default is often /usr/local/samba/var/log.nmb, /usr/samba/var/log.nmb, or /var/log/log.nmb. The first two are strongly discouraged on Linux, where /usr - may be a read-only filesystem.
      • -
    -
    -
    -

    -n - NetBIOS_name -

    -
      -
    • This option allows you to override the NetBIOS name by which the daemon will advertise itself. Specifying the option on the command line overrides the netbios - name - option in the Samba configuration file.
      • -
    -
    -
    -

    -O - socket_options -

    -
      -
    • This sets the TCP/IP socket options, using the same parameters as the socket - options - configuration option. It is often used for performance tuning and testing.
      • -
    -
    -

    -o -

    -
      -
    • This option is the opposite of -a -. It causes log files to be overwritten when opened. Using this option saves hunting for the right log entries if you are performing a series of tests and inspecting the log file each time.
      • -
    -
    -
    -
    -

    -p - port_number -

    -
      -
    • This sets the UDP/IP port number from which the server will accept requests. Currently, all Microsoft clients send only to the default port: 137.
      • -
    -
    -
    -

    -s - configuration_file -

    -
      -
    • Specifies the location of the Samba configuration file. Although the file defaults to /usr/local/samba/lib/smb.conf, you can override it here on the command line, typically for debugging.
      • -
    -
    -
    -

    -v -

    -
      -
    • This option prints the current version of Samba.
      • -
    -
    -
    -
    -

    Samba Startup File

    -

    Samba is normally started by running it from your Unix system's rc - files at boot time. For systems with a System V-like set of /etc/rcN.d - directories, this can be done by placing a suitably named script in the /rc - directory. Usually, the script starting Samba is called S91samba -, while the script stopping or "killing" Samba is called K91samba. -On Linux, the usual subdirectory for the scripts is /etc/rc2.d. - On Solaris, the directory is /etc/rc3.d -. For machines with /etc/rc.local - files, you would normally add the following lines to that file:

    -

    /usr/local/samba/bin/smbd -D

    -

    /usr/local/samba/bin/nmbd -D

    -

    The following example script supports two extra commands, status - and restart, in addition to the normal start - and stop - for System V machines:

    - -
    -#!/bin/sh
-#
-# /etc/rc2.d./S91Samba  --manage the SMB server in a System V manner
-#
-OPTS="-D"
-#DEBUG=-d3
-PS="ps  ax"
-SAMBA_DIR=/usr/local/samba
-case "$1" in
-'start')
-	echo "samba "
-	$SAMBA_DIR/bin/smbd $OPTS $DEBUG
-	$SAMBA_DIR/bin/nmbd $OPTS $DEBUG
-	;;
-'stop')
-	echo "Stopping samba"
-	$PS | awk '/usr.local.samba.bin/ { print $1}' |\
-	xargs kill
-	;;
-'status')
-	x=`$PS | grep -v grep | grep '$SAMBA_DIR/bin'`
-	if [ ! "$x" ]; then
-		echo "No samba processes running"
-	else
-		echo "  PID TT STAT  TIME COMMAND"
-		echo "$x"
-	fi
-	;;
-'restart')
-	/etc/rc2.d/S91samba stop
-	/etc/rc2.d/S91samba start
-	/etc/rc2.d/S91samba status
-	;;
-*)
-	echo "$0: Usage error -- you must say $0 start, stop, status or restart."
-	;;
-esac
-exit
-
    -

    You'll need to set the actual paths and ps - options to suit the machine you're using. In addition, you might want to add additional commands to tell Samba to reload its smb.conf - file or dump its nmbd - tables, depending on your actual needs.

    -
    -
    -

    smbsh

    -

    The smbsh - program lets you use a remote Windows share on your Samba server as if the share was a regular Unix directory. When it's run, it provides an extra directory tree under /smb. Subdirectories of /smb - are servers, and subdirectories of the servers are their individual disk and printer shares. Commands run by smbsh - treat the /smb - filesystem as if it were local to Unix. This means that you don't need smbmount - in your kernel to mount Windows filesystems the way you mount with NFS filesystems. However, you do need to configure Samba with the --with-smbwrappers - option to enable smbsh.

    -
    -

    Options

    -
    -
    -

    -d - debuglevel

    -
      -
    • Sets the debug (sometimes called logging) level. The level can range from 0, the default, all the way to 10. Debug level 0 logs only the most important messages; level 1 is normal; level 3 and above are primarily for debugging, and slow smbsh - considerably.
      • -
    -
    -
    -

    -l - logfile -

    -
      -
    • Sets the name of the logfile to use.
      • -
    -
    -
    -

    -P - prefix -

    -
      -
    • Sets the root directory to mount the SMB filesystem. The default is /smb.
      • -
    -
    -
    -

    -R - resolve order -

    -
      -
    • Sets the resolve order of the name servers. This option is similar to the resolve order - configuration option, and can take any of the four parameters, lmhosts, host, wins, and bcast, in any order.
      • -
    -
    -
    -

    -U - user -

    -
      -
    • Supports user%password. -
      • -
    -
    -
    -

    -W - workgroup -

    -
      -
    • Sets the NetBIOS workgroup to which the client will connect.
      • -
    -
    -
    -
    -

    smbclient

    -

    The smbclient - program is the maid-of-all-work of the Samba suite. Initially intended as a testing tool, it has become a full command-line Unix client, with an FTP-like interactive client. Some of its options are still used for testing and tuning, and it makes a simple tool for ensuring that Samba is running on a server.

    -

    It's convenient to look at smbclient - as a suite of programs:

    -
      -
    • FTP-like interactive file transfer program
      • -
    • Interactive printing program
      • -
    • Interactive tar program
      • -
    • Command-line message program
      • -
    • Command-line tar - program (but see smbtar - later)
      • -
    • "What services do you have" query program
      • -
    • Command-line debugging program
      • -
    -
    -

    General command-line options

    -

    The program has the usual set of smbd --like options, which apply to all the interactive and command-line use. The syntax is:

    -

    smbclient //server_name -/share_name - [password -] [-options -]

    -

    Here is an explanation of each of the command-line options:

    -
    -
    -

    -d - debug_level -

    -
      -
    • Sets the debug (logging) level, from 0 to 10, with A - for all. Overrides the value in smb.conf. Debug level 0 logs only the most important messages; level 1 is normal; debug level 3 and above are for debugging, and slow smbclient - considerably.
      • -
    -
    -

    -h -

    -
      -
    • Prints the command-line help information (usage) for smbclient.
      • -
    -
    -
    -
    -

    -n - NetBIOS_name -

    -

    Allows you to override the NetBIOS name by which the program will advertise itself.

    -
    -

    Smbclient operations

    -

    Running smbclient//server_name/share - will cause it to prompt you for a username and password. If the login is successful, it will connect to the share and give you a prompt much like an FTP prompt (the backslash in the prompt will be replaced by the current directory within the share as you move around the filesystem):

    -

    smb:\>

    -

    From this command line, you can use several FTP-like commands, as listed below. Arguments in square brackets are optional.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    -

     

    -

    smbclient Commands

    -
    -

    Command

    -    		 -

    Description

    -
    -

    ? - command -

    -    		 -

    Provides list of commands or help on specified command.

    -
    -

    help - [command]

    -    		 -

    Provides list of commands or help on specified command.

    -
    -

    ! - [command]

    -    		 -

    If a command is specified, it will be run in a local shell. If not, you will be placed into a local shell on the client.

    -
    -

    dir - [filename]

    -    		 -

    Displays any files matching filename - in the current directory on the server, or all files if filename - is omitted.

    -
    -

    ls - [filename]

    -    		 -

    Displays any files matching filename - in the current directory on the server, or all files if filename - is omitted.

    -
    -

    cd - [directory]

    -    		 -

    If directory - is specified, changes to the specified directory on the remote server. If not, reports the current directory on the remote machine.

    -
    -

    lcd - [directory]

    -    		 -

    If directory - is specified, the current directory on the local machine will be changed. If not, the name of the current directory on the local machine will be reported.

    -
    -

    get - remotefile -[localfile]

    -    		 -

    Copies the file remotefile to the local machine. If a localfile - is specified, uses that name to copy the file to. Treats the file as binary; does not - do LF to CR/LF conversions.

    -
    -

    put - localfile -[remotefile]

    -    		 -

    Copies localfile - to the remote machine. If a remotefile - is specified, uses that as the name to copy to on the remote server. Treats the file as binary; does not - do LF to CR/LF conversions.

    -
    -

    mget - pattern -

    -    		 -

    Gets all files matching pattern - from the remote machine.

    -
    -

    mput - pattern -

    -    		 -

    Places all local files matching pattern - on the remote machine.

    -
    -

    prompt -

    -    		 -

    Toggles interactive prompting on and off for mget and mput.

    -
    -

    lowercase ON -
    - -(or OFF)

    -    		 -

    If lowercase is on, smbclient - will convert filenames to lowercase during an mget - or get - (but not a mput or put).

    -
    -

    del - filename -

    -    		 -

    Delete a file on the remote machine.

    -
    -

    md - directory -

    -    		 -

    Create a directory on the remote machine.

    -
    -

    mkdir - directory -

    -    		 -

    Create a directory on the remote machine.

    -
    -

    rd - directory -

    -    		 -

    Remove the specified directory on the remote machine.

    -
    -

    rmdir - directory -

    -    		 -

    Remove the specified directory on the remote machine.

    -
    -

    setmode - filename - [+|-]rsha -

    -    		 -

    Set DOS filesystem attribute bits, using Unix-like modes. r - is read-only, s - is system, h - is hidden, and a - is archive.

    -
    -

    exit -

    -    		 -

    Exits smbclient.

    -
    -

    quit -

    -    		 -

    Exits smbclient.

    -
    -

    There are also mask and recursive commands for large copies; see the smbclient - manual page for details on how to use these. With the exception of mask, recursive, and the lack of an ASCII transfer mode, smbclient - works exactly the same as FTP. Note that because it does binary transfers, Windows files copied to Unix will have lines ending in carriage-return and linefeed (\r\n), not Unix's linefeed (\n).

    -
    -
    -

    Printing commands

    -

    The smbclient - program can also be used for access to a printer by connecting to a print share. Once connected, the commands shown below can be used to print.

    - - - - - - - - - - - - - - - - - - -
    -

     

    -

    smbclient Printing Commands

    -
    -

    Command

    -    		 -

    Description

    -
    -

    print - filename -

    -    		 -

    Prints the file by copying it from the local machine to the remote one and then submitting it as a print job there.

    -
    -

    printmode - text -| graphics -

    -    		 -

    Instructs the server that the following files will be plain text (ASCII) or the binary graphics format that the printer requires. It's up to the user to ensure that the file is indeed the right kind.

    -
    -

    queue -

    -    		 -

    Displays the queue for the print share you're connected to, showing job ID, name, size, and status.

    -
    -
    -
    -
    -

    Finally, to print from the smbclient, use the -c - option:

    -

    cat printfile - | smbclient //server -/printer_name - -c "print -"

    -
    -

    Tar commands

    -

    smbclient - can tar up files from a file share. This is normally done from the command line using the smbtar - command, but the commands shown below are also available interactively.

    - - - - - - - - - - - - - - - - - - -
    -

     

    -

    smbclient Tar Commands

    -
    -

    Command

    -    		 -

    Description

    -
    -

    tar c|x[IXbgNa] - operands -

    -    		 -

    Performs a creation or extraction tar similar to the command-line program.

    -
    -

    blocksize - size -

    -    		 -

    Sets the block size to be used by tar, in 512-byte blocks.

    -
    -

    tarmode full|inc|reset|
    - -noreset     -

    -    		 -

    Makes tar - pay attention to DOS archive bit for all following commands. In full - mode (the default), tar - will back up everything. In inc - (incremental) mode, tar - will back up only those files with the archive bit set. In reset - mode, tar - will reset the archive bit on all files it backs up (this requires the share to be writable), and in noreset - mode the archive bit will not be reset even after the file has been backed up.

    -
    -
    -
    -

    Command-line message program options

    -
    -
    -
    -

    -M - NetBIOS_machine_name -

    -
      -
    • This option allows you to send immediate messages using the WinPopup protocol to another computer. Once a connection is established, you can type your message, pressing control-D to end. If WinPopup is not running on the receiving machine, the program returns an error.
      • -
    -
    -
    -

    -U - user -

    -
      -
    • This -option allows you to indirectly control the FROM part of the message.
      • -
    -
    -

    Command-line tar program options

    -

    The -T - (tar), -D - (starting directory), and -c - (command) options are used together to tar up files interactively. This is better done with smbtar, which will be discussed shortly. We don't recommend using smbclient - directly as a tar - program.

    -
    -
    -
    -

    -D - initial_directory -

    -
      -
    • Changes to initial directory before starting.
      • -
    -
    -
    -

    -c - command_string -

    -
      -
    • Passes a command string to the smbclient - command interpreter, which treats it as a semicolon-separated list of commands to be executed. This is handy to say things such as tarmode inc, for example, which forces smbclient - -T - to back up only files with the archive bit set.
      • -
    -
    -
    -

    -T - command filename -

    -
      -
    • Runs the tar - driver, which is gtar - compatible. The two main commands are: c - (create) and x - (extract), which may be followed by any of:
      • -
    -
    -

    a -

    -

    Resets archive bits once files are saved.

    -
    -
    -
    b - size -
    -

    Sets blocksize in 512-byte units.

    -
    -

    g -

    -

    Backs up only files with the archive bit set.

    -
    -
    -
    -
    I - file -
    -

    Includes files and directories (this is the default). Does not do pattern-matching.

    -
    -
    -
    N - filename -
    -

    Backs up only those files newer than filename. -

    -
    -

    q -

    -

    Does not produce diagnostics.

    -
    -
    -
    -
    X - file -
    -

    Excludes files.

    -
    -

    Command-line query program

    -

    If smbclient - is run as:

    -

    smbclient -L server_name -

    -

    it will list the shares and other services that machine provides. This is handy if you don't have smbwrappers. It can also be helpful as a testing program in its own right.

    -
    -
    -

    Command-line debugging /diagnostic program options

    -

    Any of the various modes of operation of smbclient - can be used with the debugging and testing command-line options:

    -
    -
    -
    -
    -

    -B - IP_addr -

    -
      -
    • Sets the broadcast address.
      • -
    -
    -
    -

    -d - debug_level -

    -
      -
    • Sets the debug (sometimes called logging) level. The level can range from 0 all the way to 10. In addition, you can specify A - for all debugging options. Debug level 0 logs only the most important messages; level 1 is normal; level 3 and above are primarily for debugging and slow operations considerably.
      • -
    -
    -

    -E -

    -
      -
    • Sends all messages to stderr instead of stdout.
      • -
    -
    -
    -
    -

    -I - IP_address -

    -
      -
    • Sets the IP address of the server to which it connects.
      • -
    -
    -
    -

    -i - scope -

    -
      -
    • This sets a NetBIOS scope identifier. Only machines with the same identifier will communicate with the server. The scope identifier was a predecessor to workgroups, and this option is included only for backward compatibility.
      • -
    -
    -
    -

    -l - log_file -

    -
      -
    • Sends the log messages to the specified file.
      • -
    -
    -

    -N -

    -
      -
    • Suppresses the password prompt. Unless a password is specified on the command line or this parameter is specified, the client will prompt for a password.
      • -
    -
    -
    -
    -

    -n - NetBIOS_name -

    -

    This option allows you to override the NetBIOS name by which the daemon will advertise itself.

    -
    -
    -

    -O - socket_options -

    -
      -
    • Sets the TCP/IP socket options using the same parameters as the socket - options - configuration option. It is often used for performance tuning and testing.
      • -
    -
    -
    -

    -p - port_number -

    -
      -
    • Sets the port number from which the client will accept requests.
      • -
    -
    -
    -

    -R - resolve_order -

    -
      -
    • Sets the resolve order of the name servers. This option is similar to the resolve - order - configuration option, and can take any of the four parameters, lmhosts, host, wins, and bcast, in any order.
      • -
    -
    -
    -

    -s - configuration_file -

    -
      -
    • Specifies the location of the Samba configuration file. Used for debugging.
      • -
    -
    -
    -

    -t - terminal_code -

    -
      -
    • Sets the terminal code for Asian languages.
      • -
    -
    -
    -

    -U - username -

    -
      -
    • Sets the username and optionally password (e.g., -U - fred%secret).
      • -
    -
    -
    -

    -W - workgroup -

    -
      -
    • Specifies the workgroup that you want the client to connect as.
      • -
    -

    If you want to test a particular name service, run smbclient - with -R - and just the name of the service. This will force smbclient - to use only the service you gave. -

    -
    -
    -
    -

    smbstatus

    -

    The smbstatus - program lists the current connections on a Samba server. There are three separate sections. The first section lists various shares that are in use by specific users. The second section lists the locked files that Samba currently has on all of its shares. Finally, the third section lists the amount of memory usage for each of the shares. For example:

    -
    -# smbstatus
-
-Samba version 2.0.3
-Service      uid      gid      pid     machine
-----------------------------------------------
-network      davecb   davecb   7470   phoenix  (192.168.220.101) Sun May 16 
-network      davecb   davecb   7589   chimaera (192.168.220.102) Sun May 16 
- 
-Locked files:
-Pid    DenyMode   R/W        Oplock           Name
---------------------------------------------------
-7589   DENY_NONE  RDONLY   EXCLUSIVE+BATCH  /home/samba/quicken/inet/common/system/help.bmp   Sun May 16 21:23:40 1999
-7470   DENY_WRITE RDONLY   NONE             /home/samba/word/office/findfast.exe              Sun May 16 20:51:08 1999
-7589   DENY_WRITE RDONLY   EXCLUSIVE+BATCH  /home/samba/quicken/lfbmp70n.dll                  Sun May 16 21:23:39 1999
-7589   DENY_WRITE RDWR     EXCLUSIVE+BATCH  /home/samba/quicken/inet/qdata/runtime.dat        Sun May 16 21:23:41 1999
-7470   DENY_WRITE RDONLY   EXCLUSIVE+BATCH  /home/samba/word/office/osa.exe                   Sun May 16 20:51:09 1999
-7589   DENY_WRITE RDONLY   NONE             /home/samba/quicken/qversion.dll                  Sun May 16 21:20:33 1999
-7470   DENY_WRITE RDONLY   NONE             /home/samba/quicken/qversion.dll                  Sun May 16 20:51:11 1999
- 
-Share mode memory usage (bytes):
-   1043432(99%) free + 4312(0%) used + 832(0%) overhead = 1048576(100%) total
-
    -
    -

    Options

    -
    -
    -

    -b -

    -
      -
    • Forces smbstatus - to produce brief output. This includes the version of Samba and auditing information about the users that have logged into the server.
      • -
    -
    -
    -

    -d -

    -
      -
    • Gives verbose output, including each of the three reporting sections listed in the previous example. This is the default.
      • -
    -
    -
    -

    -L -

    -
      -
    • Forces smbstatus - to print only the current file locks it has. This corresponds to the second section in a verbose output.
      • -
    -
    -
    -

    -p -

    -
      -
    • Prints a list of smbd - process IDs only. This is often used for scripts.
      • -
    -
    -
    -

    -S -

    -
      -
    • Prints only a list of shares and their connections. This corresponds to the first section in a verbose output.
      • -
    -
    -
    -

    -s - configuration_file -

    -
      -
    • Sets the Samba configuration file to use when processing this command.
      • -
    -
    -
    -

    -u - username -

    -
      -
    • Limits the smbstatus - report to the activity of a single user.
      • -
    -
    -
    -
    -

    smbtar

    -

    The smbtar - program is a shell script on top of smbclient - that gives the program more intelligible options when doing tar operations. Functionally, it is equivalent to the Unix tar - program.

    -
    -

    Options

    -
    -
    -

    -a -

    -
      -
    • Resets the archive bit mode
      • -
    -
    -
    -

    -b - blocksize -

    -
      -
    • Blocking size. Defaults to 20.
      • -
    -
    -
    -

    -d - directory -

    -
      -
    • Changes to initial directory before restoring or backing up files.
      • -
    -
    -

    -i -

    -
      -
    • Incremental mode; tar files are backed up only if they have the DOS archive bit set. The archive bit is reset after each file is read.
      • -
    -
    -
    -
    -

    -l - log_level -

    -
      -
    • Sets the logging level.
      • -
    -
    -
    -

    -N - filename -

    -
      -
    • Backs up only the files newer than the last modification date of filename. For incremental backups.
      • -
    -
    -
    -

    -p - password -

    -
      -
    • Specifies the password to use to access a share.
      • -
    -
    -

    -r -

    -
      -
    • Restores files to the share from the tar file.
      • -
    -
    -
    -
    -

    -s - server -

    -
      -
    • Specifies the SMB/CIFS server in which the share resides.
      • -
    -
    -
    -

    -t - tape -

    -
      -
    • Tape device or file. Default is the value of the environment variable $TAPE, or tar.out - if $TAPE - isn't set.
      • -
    -
    -
    -

    -u - user -

    -
      -
    • Specifies the user to connect to the share as. You can specify the password as well, in the format username%password.
      • -
    -
    -

    -v -

    -
      -
    • Specifies the use of verbose mode.
      • -
    -
    -
    -
    -

    -X - file -

    -
      -
    • Tells smbtar - to exclude the specified file from the tar - create or restore.
      • -
    -
    -
    -

    -x - share -

    -
      -
    • States the share name on the server to connect to. The default is backup, which is a common share name to perform backups with.
      • -
    -
    -
    -

    For example, a trivial backup command to archive the data for user sue - is:

    -

    # smbtar -s pc_name -x sue -u sue -p secret -t sue.tar -

    -
    -
    -
    -

    nmblookup

    -

    The nmblookup - program is a client program that exercises the NetBIOS-over-UDP/IP name service for resolving NBT machine names into IP addresses. The command works by broadcasting its queries on the local subnet until a machine with that name responds. You can think of it as a Windows nslookup(1) -or dig(1). -This is useful for looking up both normal NetBIOS names, and the odd ones like __MSBROWSE__ - that the Windows name services use to provide directory-like services. If you wish to query for a particular type of NetBIOS name, add the NetBIOS <type> - to the end of the name.

    -

    The command line is:

    -

    nmblookup [-options] name -

    -

    The options supported are:

    -
    -

    -A -

    -
      -
    • Interprets name - as an IP address and do a node-status query on this address.
      • -
    -
    -
    -

    -B - broadcast _address -

    -
      -
    • Sends the query to the given broadcast address. The default is to send the query to the broadcast address of the primary network interface.
      • -
    -
    -
    -

    -d - debuglevel -

    -
      -
    • Sets the debug (sometimes called logging) level. The level can range from 0 all the way to 10. Debug level 0 logs only the most important messages; level 1 is normal; level 3 and above are primarily for debugging and slow the program considerably.
      • -
    -
    -

    -h -

    -
      -
    • Prints command-line usage information for the program.
      • -
    -
    -
    -
    -

    -i - scope -

    -
      -
    • Sets a NetBIOS scope identifier. Only machines with the same identifier will communicate with the server. The scope identifier was a predecessor to workgroups, and this option is included only for backward compatibility.
      • -
    -
    -

    -M -

    -
      -
    • Searches for a local master browser. This is done with a broadcast searching for a machine that will respond to the special name __MSBROWSE__, and then asking that machine for information, instead of broadcasting the query itself.
      • -
    -
    -
    -

    -R -

    -
      -
    • Sets the recursion desired bit in the packet. This will cause the machine that responds to try to do a WINS lookup and return the address and any other information the WINS server has saved.
      • -
    -
    -
    -

    -r -

    -
      -
    • Use the root port of 137 for Windows 95 machines.
      • -
    -
    -
    -

    -S -

    -
      -
    • Once the name query has returned an IP address, does a node status query as well. This returns all the resource types that the machine knows about, with their numeric attributes. For example:
      • -
    -
    -% nmblookup -d 4 -S elsbeth
-received 6 names
-      ELSBETH                <00> - <GROUP> B <ACTIVE>
-      ELSBETH                <03> -         B <ACTIVE>
-      ELSBETH                <1d> -         B <ACTIVE>
-      ELSBETH                <1e> - <GROUP> B <ACTIVE>
-      ELSBETH                <20> -         B <ACTIVE>
-      ..__MSBROWSE__..       <01> - <GROUP> B <ACTIVE>
-
    -
    -
    -
    -

    -s - configuration_file -

    -
      -
    • Specifies the location of the Samba configuration file. Although the file defaults to /usr/local/samba/lib/smb.conf, you can override it here on the command-line, normally for debugging.
      • -
    -
    -

    -T -

    -
      -
    • This option can be used to translate IP addresses into resolved names.
      • -
    -
    -
    -
    -

    -U - unicast_address -

    -
      -
    • Performs a unicast query to the specified address. Used with -R - to query WINS servers.
      • -
    -

    Note that there is no workgroup option for nmblookup; you can get around this by putting workgroup - = - workgroup_name -in a file and passing it to nmblookup - with the -s - smb.conf_file - option.

    -
    -
    -
    -

    smbpasswd

    -

    The smbpasswd - password has two distinct sets of functions. When run by users, it changes their encrypted passwords. When run by root, it updates the encrypted password file. When run by an ordinary user with no options, it connects to the primary domain controller and changes his or her Windows password.

    -

    The program will fail if smbd - is not operating, if the hosts - allow - or hosts - deny - configuration options will not permit connections from localhost (IP address 127.0.0.1), or the encrypted - passwords - = - no - option is set.

    -
    -

    Regular user options

    -
    -
    -

    -D - debug_level -

    -
      -
    • Sets the debug (also called logging) level. The level can range from 0 to 10. Debug level 0 logs only the most important messages; level 1 is normal; level 3 and above are primarily for debugging and slow the program considerably.
      • -
    -
    -

    -h -

    -
      -
    • Prints command-line usage information for the program.
      • -
    -
    -
    -
    -

    -r - remote_machine_name -

    -
      -
    • Specifies on which machine the password should change. The remote machine must be a primary domain controller (PDC).
      • -
    -
    -
    -

    -R - resolve_order -

    -
      -
    • Sets the resolve order of the name servers. This option is similar to the resolve - order - configuration option, and can take any of the four parameters, lmhosts, host, wins, and bcast, in any order.
      • -
    -
    -
    -

    -U - username -

    -
      -
    • Used only with -r, to modify a username that is spelled differently on the remote machine.
      • -
    -
    -

    Root-only options

    -
    -
    -
    -

    -a - username -

    -
      -
    • Adds a user to the encrypted password file.
      • -
    -
    -
    -

    -d - username -

    -
      -
    • Disables a user in the encrypted password file.
      • -
    -
    -
    -

    -e - username -

    -
      -
    • Enables a disabled user in the encrypted password file.
      • -
    -
    -
    -

    -m - machine_name -

    -
      -
    • Changes a machine account's password. The machine accounts are used to authenticate machines when they connect to a primary or backup domain controller.
      • -
    -
    -
    -

    -j - domain_name -

    -
      -
    • Adds a Samba server to a Windows NT Domain.
      • -
    -
    -

    -n -

    -
      -
    • Sets no password for the user.
      • -
    -
    -
    -
    -

    -s - username -

    -
      -
    • Causes smbpasswd - to be silent and to read its old and new passwords from standard input, rather than from /dev/tty. This is useful for writing scripts.
      • -
    -
    -
    -
    -

    testparm

    -

    The testparm - program checks an smb.conf - file for obvious errors and self-consistency. Its command line is:

    -

    testparm [options] configfile_name [hostname IP_addr] -

    -

    If the configuration file is not specified, the file at samba_dir -/lib/smb.conf - is checked by default. If you specify a hostname and an IP address, an extra check will be made to ensure that the specified machine would be allowed to connect to Samba. If a hostname is specified, an IP address should be present as well.

    -
    -

    Options

    -
    -
    -

    -h -

    -
      -
    • Prints command-line information for the program.
      • -
    -
    -
    -

    -L - server_name

    -
      -
    • Resets the %L - configuration variable to the specified server name.
      • -
    -
    -

    -s -

    -
      -
    • This option prevents the testparm - program from prompting the user to press the Enter key before printing a list of the configuration options for the server.
      • -
    -
    -
    -
    -
    -

    testprns

    -

    The testprns - program checks a specified printer name against the system printer capabilities (printcap) file. Its command line is:

    -

    testprns printername - [printcapname]

    -

    If the printcapname - isn't specified, Samba attempts to use one located in the smb.conf - file. If one isn't specified there, Samba will try /etc/printcap. If that fails, the program will generate an error.

    -
    -
    -

    rpcclient

    -

    This is a new client that exercises the RPC (remote procedure call) interfaces of an SMB server. Like smbclient, rpcclient - started its life as a test program for the Samba developers and will likely stay that way for a while. Its command line is:

    -

    rpcclient //server/share -

    -

    The command-line options are the same as the Samba 2.0 smbclient, and the operations you can try are listed below.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    -

     

    -

    rpcclient commands

    -
    -

    Command

    -    		 -

    Description

    -
    -

    regenum keyname -

    -    		 -

    Registry Enumeration (keys, values)

    -
    -

    regdeletekey keyname -

    -    		 -

    Registry Key Delete

    -
    -

    regcreatekey keyname [keyvalue] -

    -    		 -

    Registry Key Create

    -
    -

    regquerykey keyname -

    -    		 -

    Registry Key Query

    -
    -

    regdeleteval valname -

    -    		 -

    Registry Value Delete

    -
    -

    regcreateval valname valtype value -

    -    		 -

    Registry Key Create

    -
    -

    reggetsec keyname -

    -    		 -

    Registry Key Security

    -
    -

    regtestsec keyname -

    -    		 -

    Test Registry Key Security

    -
    -

    ntlogin [username] [password] -

    -    		 -

    NT Domain Login Test

    -
    -

    wksinfo -

    -    		 -

    Workstation Query Info

    -
    -

    srvinfo -

    -    		 -

    Server Query Info

    -
    -

    srvsessions -

    -    		 -

    List Sessions on a Server

    -
    -

    srvshares -

    -    		 -

    List shares on a server

    -
    -

    srvconnections -

    -    		 -

    List connections on a server

    -
    -

    srvfiles -

    -    		 -

    List files on a server

    -
    -

    lsaquery -

    -    		 -

    Query Info Policy (domain member or server)

    -
    -

    lookupsids -

    -    		 -

    Resolve names from SIDs

    -
    -

    ntpass -

    -    		 -

    NT SAM Password Change

    -
    -
    -
    -

    tcpdump

    -

    The tcpdump - utility, a classic system administration tool, dumps all the packet headers it sees on an interface that match an expression. The version included in the Samba distribution is enhanced to understand the SMB protocol. The expression - is a logical expression with "and," "or," and "not," although sometimes it's very simple. For example, host - escrime - would select every packet going to or from escrime. The expression is normally one or more of:

    -
      -
    • host - name -
      • -
    • net network_number -
      • -
    • port - number -
      • -
    • src - name -
      • -
    • dst - name -
      • -
    -

    The most common options are src - (source), dst - (destination), and port. For example, in the book we used the command:

    -

    tcpdump port not telnet

    -

    This dumps all the packets except telnet; we were logged-in via telnet and wanted to see only the SMB packets.

    -

    Another tcpdump - example is selecting traffic between server and either sue - or joe:

    -

    tcpdump host server and \(sue or joe \)

    -

    We recommend using the -s - 1500 - option so that you capture all of the SMB messages sent, instead of just the header information.

    -
    -

    Options

    -

    There are many options, and many other kinds of expressions that can be used with tcpdump. See the manual page for details on the advanced options. The most common options are as follows:

    -
    -
    -

    -c - count -

    -
      -
    • Forces the program to exit after receiving the specified number of packets.
      • -
    -
    -
    -

    -F - file -

    -
      -
    • Reads the expression from the specified file and ignores expressions on the command line.
      • -
    -
    -
    -

    -i - interface -

    -
      -
    • Forces the program to listen on the specified interface.
      • -
    -
    -
    -

    -r - file -

    -
      -
    • Reads packets from the specified file (captured with -w).
      • -
    -
    -
    -

    -s - length -

    -
      -
    • Saves the specified number of bytes of data from each packet (rather than 68 bytes).
      • -
    -
    -
    -

    -w - file -

    -
      -
    • Writes the packets to the specified file.
      • -
    -
    -
    -
    -
    -
    - - -
    -
    -
    - - -
    - -Previous: Appendix C. - - - -Next: Appendix E.
    -C. Samba Configuration Option Quick Reference - -Book Index -E. Downloading Samba with CVS
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - - diff --git a/docs/htmldocs/using_samba/appe_01.html b/docs/htmldocs/using_samba/appe_01.html deleted file mode 100644 index 199fade696..0000000000 --- a/docs/htmldocs/using_samba/appe_01.html +++ /dev/null @@ -1,96 +0,0 @@ - - -[Appendix E] Downloading Samba with CVS - - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - - - -
    - -Previous: Appendix D. - - -Appendix E - -Next: Appendix F.
    - 
    - -
    -
    -

    Appendix E. Downloading Samba with CVS

    -

    This appendix contains information on how to download the latest source version of Samba using the Concurrent Versions System (CVS). CVS is a freely available configuration management tool available from Cyclic Software and is distributed under the GNU General Public License. You can download the latest copy from -http://www.cyclic.com/.

    CVS works on top of the GNU Revision Control System (RCS). Many Unix systems come preinstalled with RCS. However, if you want to download the latest version of RCS, you can find it at http://ftp.gnu.org/gnu/rcs/.

    -One of the nicest things about CVS is its ability to handle remote logins. This means that people across the globe on the Internet can download and update various source files for any project that uses a CVS repository. Such is the case with Samba. Once you have RCS and CVS installed on your system, you must first log in to the Samba source server with the following command:

    -cvs -d :pserver:cvs@cvs.samba.org:/cvsroot login

    -This tells CVS to connect to the CVS server at -cvs.samba.org. Once you are connected, you can download the latest source tree with the following command:

    -cvs -d :pserver:cvs@cvs.samba.org:/cvsroot co samba

    -This will download the entire Samba distribution (file by file) into a directory entitled -/samba, which it will create on your hard drive. This directory will have the same structure as the Samba source distribution described in Chapter 2, Installing Samba on a Unix System. It includes source and header files, documentation, and sample configuration files to help get you started. After that is completed, you can follow the instructions in Chapter 2 to configure and compile Samba on your server.

    -
    -
    -
    - - -
    - -Previous: Appendix D. - - - -Next: Appendix F.
    -Appendix D: Summary of Samba Daemons and Commands - -Book Index -F. Sample Configuration File
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/appf_01.html b/docs/htmldocs/using_samba/appf_01.html deleted file mode 100644 index 9b70947225..0000000000 --- a/docs/htmldocs/using_samba/appf_01.html +++ /dev/null @@ -1,315 +0,0 @@ - - - -[Appendix F] Sample Configuration File - - - - - - - - - - - - - - - - - - - -
    - - - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    - -
    - - -
    -
    - - - -
    - -Previous: D. Downloading Samba with CVS - - -Appendix F - 
      - -
    - - -
    -
    -

    - -F. Sample Configuration File

    This appendix gives an example of a production -smb.conf file and looks at how many of the options are used in practice. The following is a slightly disguised version of one we used at a corporation with five Linux servers, five Windows for Workgroups clients and three NT Workstation clients:

    -# smb.conf -- File Server System for: 1 Example.COM  BSC & Management Office 
-[globals]
-	workgroup = 1EG_BSC
-	interfaces = 10.10.1.14/24

    -We provide this service on only one of the machine's interfaces. The -interfaces option sets its address and netmask, where -/24 is the same as using the netmask 255.255.255.0:

    -	comment = Samba ver. %v
-	preexec = csh -c `echo /usr/samba/bin/smbclient \
-                     -M %m -I %I` &

    -We use the -preexec command to log information about all connections by machine name (%m) and IP address (%I):

    -	# smbstatus will output various info on current status
-	status = yes
-	browseable = yes
-	printing = bsd
-
-	# the username that will be used for access to services
-	# specified with 'guest = ok'
-	guest account = samba

    -The default guest account was -nobody, uid -1, which produced log messages on one of our machines saying "your server is being unfriendly," so we created a specific Samba guest account for browsing and printing:

    -	# superuser account - admin privilages to shares, with no
-	# restrictions
-	# WARNING - use this with care: files can be modified,
-	# regardless of file permissions
-	admin users = root
-
-	# who is NOT allowed to connect to ANY service
-	invalid users = @wheel, mail, deamon, adt

    -Daemons can't use Samba, only people. The -invalid -users option closes a security hole; it prevents intruders from breaking in by pretending to be a daemon process.

    -	# hosts that are ALLOWED or DENIED from connecting to ANY service
-	hosts allow = 10.10.1.
-	hosts deny = 10.10.1.6
-	
-	# where the lock files will be located
-	lock directory = /var/lock/samba/locks
-		
-	# debug log files 
-	# %m = separate log for each NetBIOS name (each machine)
-	log file = /var/log/samba/log.%m
-
-	# We send priority 0, 1 and 2 messages to the system logs
-	syslog = 2
-		
-	# If a WinPopup message is sent to the server,
-	# redirect it to a user via e-mail
-	
-	message command = /bin/mail -s 'message from #% on %m' \
-						 pkelly < %s; rm %s
-
-# ---------------------------------------------------
-# [globals] Performance Tuning
-# ---------------------------------------------------
-	
-	# caching algorithm to reduce time doing getwd() calls.  
-	getwd cache = yes
-
-	socket options = TCP_NODELAY
-
-	# tell the server whether the client is present and
-	# responding in seconds
-	keep alive = 60
-
-	# num minutes of inactivity before a connection is
-	# considered dead
-	dead time = 30 
-
-	read prediction = yes
-	share modes = yes
-	max xmit = 17384 
-	read size = 512

    -The -share -modes, -max, -xinit, and -read -size options are machine-specific (see Appendix B, Samba Performance Tuning): 

    -	# locking is done by the server
-	locking = yes
-
-	# control whether dos style attributes should be mapped
-	# to unix execute bits
-	map hidden = yes
-	map archive = yes
-	map system = yes

    -The three -map options will work only on shares with a create mode that includes the execute bits (0111). Our -homes and -printers shares won't honor them, but the [www] share will:

    -# ---------------------------------------------------------
-# [globals] Security and Domain Logon Services
-# ---------------------------------------------------------	
-# connections are made with UID and GID, not as shares
-	security = user
-
-# boolean variable that controls whether passwords
-# will be encrypted
-	encrypt passwords = yes
-	passwd chat = "*New password:*" %n\r "*New password (again):*" %n\r \ "*Password changed*"
-	passwd program = /usr/bin/passwd %u
-	
-# Always become the local master browser
-	domain master = yes
-	preferred master = yes
-	os level = 34
-	
-# For domain logons to work correctly. Samba acts as a
-# primary domain controller.
-	domain logons = yes
-	
-# Logon script to run for user off the server each time
-# username (%U) logs in.  Set the time, connect to shares,
-# virus checks, etc.
-	logon script = scripts\%U.bat
-
-[netlogon]
-	comment = "Domain Logon Services"
-	path = /u/netlogon
-	writable = yes
-	create mode = 444
-	guest ok = no
-	volume = "Network"

    -This share, discussed in Chapter 6, Users, Security, and Domains, is required for Samba to work smoothly in a Windows NT domain:

    -# -----------------------------------------------------------
-# [homes] User Home Directories
-# -----------------------------------------------------------
-[homes]
-	comment = "Home Directory for : %u "
-	path = /u/users/%u

    -The password file of the Samba server specifies each person's home directory as -/home/machine_name/person, which NFS converts to point to the actual physicl location under -/u/users. The -path option in the -[homes] share tells Samba the actual (non-NFS) location:

    -	guest ok = no
-	read only = no
-	create mode = 644
-	writable = yes
-	browseable = no 
-
-# -----------------------------------------------------------
-# [printers] System Printers
-# -----------------------------------------------------------
-[printers]
-	comment = "Printers"
-	path = /var/spool/lpd/samba
-	printcap name = /etc/printcap
-	printable = yes
-	public = no 
-	writable = no
-
-	lpq command = /usr/bin/lpq -P%p
-	lprm command = /usr/bin/lprm -P%p %j
-	lppause command = /usr/sbin/lpc stop %p
-	lpresume command = /usr/sbin/lpc start %p
-
-	create mode = 0700
-
-	browseable = no 
-	load printers = yes  
-
-# -----------------------------------------------------------
-# Specific Descriptions: [programs] [data] [retail]
-# -----------------------------------------------------------
-[programs]
-	comment = "Shared Programs %T"
-	volume = "programs"

    -Shared Programs shows up in the Network Neighborhood, and -programs is the volume name you specify when an installation program wants to know the label of the CD-ROM from which it thinks it's loading:

    -	path = /u/programs
-	public = yes
-	writeable = yes
-	printable = no
-	create mode = 664
-[cdrom]
-	comment = "Unix CDROM"
-	path = /u/cdrom
-	public = no 
-	writeable = no 
-	printable = no
-	volume = "cdrom"
-
-[data]
-	comment =  "Data Directories %T"
-	path = /u/data
-	public = no
-	create mode = 770
-	writeable = yes
-	volume = "data"
-
-[nt4]
-	comment =  "NT4 Server"
-	path = /u/systems/nt4
-	public = yes 
-	create mode = 770
-	writeable = yes
-	volume = "nt4_server"
-
-[www]
-	comment =  "WWW System"
-	path = /usr/www/http
-	public = yes 
-	create mode = 775
-	writeable = yes
-	volume = "www_system"

    -The -[www] share is the directory used on the Unix server to serve web pages. Samba makes the directory available to local PC users so the art department can update web pages.

    -
    -
    -
    - - -
    - -Previous: D. Downloading Samba with CVS - - 
    -D. Downloading Samba with CVS - -Book Index - 
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch01_01.html b/docs/htmldocs/using_samba/ch01_01.html deleted file mode 100644 index 0651fa823c..0000000000 --- a/docs/htmldocs/using_samba/ch01_01.html +++ /dev/null @@ -1,167 +0,0 @@ - - -[Chapter 1] 1.1 Learning Samba - - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - - - - - -
    - - - -Next: 1.2 What Can Samba Do For Me? -
      -
    -
    - -
    -
    -

    1. Learning the Samba

    -

    If you are a typical system administrator, then you know what it means to be swamped with work. Your daily routine is filled with endless hardware incompatibility issues, system outages, data backup problems, and a steady stream of angry users. So adding another program to the mix of tools that you have to maintain may sound a bit perplexing. However, if you're determined to reduce the complexity of your work environment, as well as the workload of keeping it running smoothly, Samba may be the tool you've been waiting for.

    - -

    A case in point: one of the authors of this book used to look after 70 Unix developers sharing 5 Unix servers. His neighbor administered 20 Windows 3.1 users and 5 OS/2 and Windows NT servers. To put it mildly, the Windows 3.1 administrator was swamped. When he finally left - and the domain controller melted - Samba was brought to the rescue. Our author quickly replaced the Windows NT and OS/2 servers with Samba running on a Unix server, and eventually bought PCs for most of the company developers. However, he did the latter without hiring a new PC administrator; the administrator now manages one centralized Unix application instead of fifty distributed PCs.

    - -

    If you know you're facing a problem with your network and you're sure there is a better way, we encourage you to start reading this book. Or, if you've heard about Samba and you want to see what it can do for you, this is also the place to start. We'll get you started on the path to understanding Samba and its potential. Before long, you can provide Unix services to all your Windows machines - all without spending tons of extra time or money. Sound enticing? Great, then let's get started.

    - - -

    1.1 What is Samba?

    - -

    Samba is a suite of Unix applications that speak the SMB (Server Message Block) protocol. Many operating systems, including Windows and OS/2, use SMB to perform client-server networking. By supporting this protocol, Samba allows Unix servers to get in on the action, communicating with the same networking protocol as Microsoft Windows products. Thus, a Samba-enabled Unix machine can masquerade as a server on your Microsoft network and offer the following services:

    - -
      -
    • - -

      Share one or more filesystems

      - -
      • -
    • - -

      Share printers installed on both the server and its clients

      - -
      • -
    • - -

      Assist clients with Network Neighborhood browsing

      - -
      • -
    • - -

      Authenticate clients logging onto a Windows domain

      - -
      • -
    • - -

      Provide or assist with WINS name server resolution

      - -
      • -
    - -

    Samba is the brainchild of Andrew Tridgell, who currently heads the Samba development team from his home of Canberra, Australia. The project was born in 1991 when Andrew created a fileserver program for his local network that supported an odd DEC protocol from Digital Pathworks. Although he didn't know it at the time, that protocol later turned out to be SMB. A few years later, he expanded upon his custom-made SMB server and began distributing it as a product on the Internet under the name SMB Server. However, Andrew couldn't keep that name - it already belonged to another company's product - so he tried the following Unix renaming approach:

    - -
    -grep -i 's.*m.*b' /usr/dict/words
    - -

    And the response was:

    - -
    -salmonberry samba sawtimber scramble
    - -

    Thus, the name "Samba" was born. - -

    Which is a good thing, because our marketing people highly doubt you would have picked up a book called "Using Salmonberry"!

    - -

    - -

    Today, the Samba suite revolves around a pair of Unix daemons that provide shared resources - or shares - to SMB clients on the network. (Shares are sometimes called services as well.) These daemons are:

    - -
    -
    smbd
    -
    - -

    A daemon that allows file and printer sharing on an SMB network and provides authentication and authorization for SMB clients.

    - -
    - -
    nmbd
    -
    - -

    A daemon that looks after the Windows Internet Name Service (WINS), and assists with browsing.

    - -
    -
    - -

    Samba is currently maintained and extended by a group of volunteers under the active supervision of Andrew Tridgell. Like the Linux operating system, Samba is considered Open Source software (OSS) by its authors, and is distributed under the GNU General Public License (GPL). Since its inception, development of Samba has been sponsored in part by the Australian National University, where Andrew Tridgell earned his Ph.D. [1] - In addition, some development has been sponsored by independent vendors such as Whistle and SGI. It is a true testament to Samba that both commercial and non-commercial entities are prepared to spend money to support an Open Source effort.

    -
    -

    [1] At the time of this printing, Andrew had completed his Ph.D. work and had joined San Francisco-based LinuxCare.

    -
    -

    Microsoft has also contributed materially by putting forward its definition of SMB and the Internet-savvy Common Internet File System (CIFS), as a public Request for Comments (RFC), a standards document. The CIFS protocol is Microsoft's renaming of future versions of the SMB protocol that will be used in Windows products - the two terms can be used interchangeably in this book. Hence, you will often see the protocol written as "SMB/CIFS."

    -
    -
    -
    - - - -
    - - - - - -Next: 1.2 What Can Samba Do For Me?
    - -Book Index -1.1 Learning Samba
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch01_02.html b/docs/htmldocs/using_samba/ch01_02.html deleted file mode 100644 index 9ccb2dfeee..0000000000 --- a/docs/htmldocs/using_samba/ch01_02.html +++ /dev/null @@ -1,212 +0,0 @@ - - - -[Chapter 1] 1.2 What Can Samba Do For Me? - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 1.1 What is Samba? - - - -Chapter 1
    -Learning the Samba    		 - -Next: 1.3 Getting Familiar with a SMB/CIFS Network
     
    - -
    -
    -

    - -1.2 What Can Samba Do For Me?

    -As explained earlier, Samba can help Windows and Unix machines coexist in the same network. However, there are some specific reasons why you might want to set up a Samba server on your network:

      -
    • -

      - -You don't want to pay for - or can't afford - a full-fledged Windows NT server, yet you still need the functionality that one provides.

    • -

      - -You want to provide a common area for data or user directories in order to transition from a Windows server to a Unix one, or vice versa.

    • -

      - -You want to be able to share printers across both Windows and Unix workstations.

    • -

      - -You want to be able to access NT files from a Unix server.

    -Let's take a quick tour of Samba in action. Assume that we have the following basic network configuration: a Samba-enabled Unix machine, to which we will assign the name -hydra, and a pair of Windows clients, to which we will assign the names -phoenix and -chimaera, all connected via a local area network (LAN). Let's also assume that -hydra also has a local inkjet printer connected to it, -lp, and a disk share named -network - both of which it can offer to the other two machines. A graphic of this network is shown in -Figure 1.1.

    - -Figure 1.1: A simple network setup with a Samba server

    Figure 1.1

    -In this network, each of the computers listed share the same -workgroup. A workgroup is simply a group nametag that identifies an arbitrary collection of computers and their resources on an SMB network. There can be several workgroups on the network at any time, but for our basic network example, we'll have only one: the SIMPLE workgroup.

    -

    - -1.2.1 Sharing a Disk Service

    If everything is properly configured, we should be able to see the Samba server, -hydra, through the Network Neighborhood of the -phoenix Windows desktop. In fact, -Figure 1.2 shows the Network Neighborhood of the -phoenix computer, including -hydra and each of the computers that reside in the SIMPLE workgroup. Note the Entire Network icon at the top of the list. As we just mentioned, there can be more than one workgroup on an SMB network at any given time. If a user clicks on the Entire Network icon, he or she will see a list of all the workgroups that currently exist on the network.

    - -Figure 1.2: The Network Neighborhood directory

    Figure 1.2

    -We can take a closer look at the -hydra server by double-clicking on its icon. This contacts -hydra itself and requests a list of its -shares - the file and printer resources - that the machine provides. In this case, there is a printer entitled -lp and a disk share entitled -network on the server, as shown in -Figure 1.3. Note that the Windows display shows hostnames in mixed case (Hydra). Case is irrelevant in hostnames, so you may see hydra, Hydra, and HYDRA in various displays or command output, but they all refer to a single system. Thanks to Samba, Windows 98 sees the Unix server as a valid SMB server, and can access the -network folder as if it were just another system folder.

    - -Figure 1.3: Shares available on the hydra sever as viewed from phoenix

    Figure 1.3

    -One popular feature of Windows 95/98/NT is that you can map a letter-drive to a known network directory using the Map Network Drive option in the Windows Explorer.[3] Once you do so, your applications can access the folder across the network with a standard drive letter. Hence, you can store data on it, install and run programs from it, and even password-protect it against unwanted visitors. See -Figure 1.4 for an example of mapping a letter-drive to a network directory.

    -
    -

    -[3] You can also right-click on the shared resource in the Network Neighborhood, and then select the Map Network Drive menu item.

    - -Figure 1.4: Mapping a network drive to a Windows letter-drive

    Figure 1.4

    -Take a look at the Path: entry in the dialog box of -Figure 1.4. An equivalent way to represent a directory on a network machine is by using two backslashes, followed by the name of the networked machine, another backslash, and the networked directory of the machine, as shown below:

    - -
    \\network-machine\directory
    - -

    -This is known as the -UNC (Universal Naming Convention) in the Windows world. For example, the dialog box in -Figure 1.4 represents the network directory on the -hydra server as:

    - -
    \\HYDRA\network

    - -If this looks somewhat familiar to you, you're probably thinking of -uniform resource locators (URLs), which are addresses that web browsers such as Netscape Navigator and Internet Explorer use to resolve machines across the Internet. Be sure not to confuse the two: web browsers typically use forward slashes instead of back slashes, and they precede the initial slashes with the data transfer protocol (i.e., ftp, http) and a colon (:). In reality, URLs and UNCs are two completely separate things.

    -Once the network drive is set up, Windows and its programs will behave as if the networked directory was a fixed disk. If you have any applications that support multiuser functionality on a network, you can install those programs on the network drive.[4] -Figure 1.5 shows the resulting network drive as it would appear with other storage devices in the Windows 98 client. Note the pipeline attachment in the icon for the G: drive; this indicates that it is a network drive instead of a fixed drive.

    -
    -

    -[4] Be warned that many end-user license agreements forbid installing a program on a network such that multiple clients can access it. Check the legal agreements that accompany the product to be absolutely sure.

    - -Figure 1.5: The Network directory mapped to the client letter-drive G

    Figure 1.5

    -From our Windows NT Workstation machine, -chimaera, Samba looks almost identical to Windows 98. -Figure 1.6 shows the same view of the -hydra server from the Windows NT 4.0 Network Neighborhood. Setting up the network drive using the Map Network Drive option in Windows NT Workstation 4.0 would have identical results as well.

    - -Figure 1.6: Shares available on hydra (viewed from chimaera)

    Figure 1.6
    -

    - -1.2.2 Sharing a Printer

    You probably noticed that the printer -lp appeared under the available shares for -hydra in -Figure 1.3. This indicates that the Unix server has a printer that can be shared by the various SMB clients in the workgroup. Data sent to the printer from any of the clients will be spooled on the Unix server and printed in the order it is received.

    Setting up a Samba-enabled printer on the Windows side is even easier than setting up a disk share. By double-clicking on the printer and identifying the manufacturer and model, you can install a driver for this printer on the Windows client. Windows can then properly format any information sent to the network printer and access it as if it were a local printer (we show you how to do this later in the chapter). -Figure 1.7 shows the resulting network printer in the Printers window of Windows 98. Again, note the pipeline attachment below the printer, which identifies it as being on a network.

    - -Figure 1.7: A network printer available on hydra (viewed from chimaera)

    Figure 1.7
    -

    - -1.2.2.1 Seeing things from the Unix side

    -As mentioned earlier, Samba appears in Unix as a set of daemon programs. You can view them with the Unix -ps and -netstat commands, you can read any messages they generate through custom debug files or the Unix -syslog (depending on how Samba is set up), and you can configure it from a single Samba properties file: smb.conf. In addition, if you want to get an idea of what each of the daemons are doing, Samba has a program called -smbstatus that will lay it all on the line. Here is how it works:

    - -
    # smbstatus
-
    -Samba version 2.0.4
-Service      uid      gid      pid     machine
-----------------------------------------------
-network      davecb   davecb   7470   phoenix  (192.168.220.101) Sun May 16 
-network      davecb   davecb   7589   chimaera (192.168.220.102) Sun May 16 
-
-Locked files:
-Pid    DenyMode   R/W        Oplock          Name
---------------------------------------------------
-7589   DENY_NONE  RDONLY     EXCLUSIVE+BATCH /home/samba/quicken/inet/common/system/help.bmp  Sun May 16 21:23:40 1999
-7470   DENY_WRITE RDONLY     NONE            /home/samba/word/office/findfast.exe             Sun May 16 20:51:08 1999
-7589   DENY_WRITE RDONLY     EXCLUSIVE+BATCH /home/samba/quicken/lfbmp70n.dll                 Sun May 16 21:23:39 1999
-7589   DENY_WRITE RDWR       EXCLUSIVE+BATCH /home/samba/quicken/inet/qdata/runtime.dat       Sun May 16 21:23:41 1999
-7470   DENY_WRITE RDONLY     EXCLUSIVE+BATCH /home/samba/word/office/osa.exe                  Sun May 16 20:51:09 1999
-7589   DENY_WRITE RDONLY     NONE            /home/samba/quicken/qversion.dll                 Sun May 16 21:20:33 1999
-7470   DENY_WRITE RDONLY     NONE            /home/samba/quicken/qversion.dll                 Sun May 16 20:51:11 1999
-
-Share mode memory usage (bytes):
-   1043432(99%) free + 4312(0%) used + 832(0%) overhead = 1048576(100%) total

    -The Samba status from this output provides three sets of data, each divided into separate sections. The first section tells which systems have connected to the Samba server, identifying each client by its machine name (phoenix and chimaera) and IP address. The second section reports the name and status of the files that are currently in use on a share on the server, including the read/write status and any locks on the files. Finally, Samba reports the amount of memory it has currently allocated to the shares that it administers, including the amount actively used by the shares plus additional overhead. (Note that this is not the same as the total amount of memory that the -smbd or -nmbd processes are using.)

    -Don't worry if you don't understand these statistics; they will become easier to understand as you move through the book.

    -
    -
    -
    - - -
    - -Previous: 1.1 What is Samba? - - - -Next: 1.3 Getting Familiar with a SMB/CIFS Network
    -1.1 What is Samba? - -Book Index -1.3 Getting Familiar with a SMB/CIFS Network
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch01_03.html b/docs/htmldocs/using_samba/ch01_03.html deleted file mode 100644 index 67a8677530..0000000000 --- a/docs/htmldocs/using_samba/ch01_03.html +++ /dev/null @@ -1,444 +0,0 @@ - - - -[Chapter 1] 1.3 Getting Familiar with a SMB/CIFS Network - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 1.2 What Can Samba Do For Me? - - - -Chapter 1
    -Learning the Samba    		 - -Next: 1.4 Microsoft Implementations
     
    - -
    -
    -

    - -1.3 Getting Familiar with a SMB/CIFS Network

    Now that you have had a brief tour of Samba, let's take some time to get familiar with Samba's adopted environment: an SMB/CIFS network. Networking with SMB is significantly different from working with a Unix TCP/IP network, because there are several new concepts to learn and a lot of information to cover. First, we will discuss the basic concepts behind an SMB network, followed by some Microsoft implementations of it, and finally we will show you where a Samba server can and cannot fit into the picture.

    -

    - -1.3.1 Understanding NetBIOS

    -To begin, let's step back in time. In 1984, IBM authored a simple application programming interface (API) for networking its computers called the -Network Basic Input/Output System (NetBIOS). The NetBIOS API provided a rudimentary design for an application to connect and share data with other computers.

    -It's helpful to think of the NetBIOS API as networking extensions to the standard BIOS API calls. With BIOS, each low-level call is confined to the hardware of the local machine and doesn't need any help traveling to its destination. NetBIOS, however, originally had to exchange instructions with computers across IBM PC or Token Ring networks. It therefore required a low-level transport protocol to carry its requests from one computer to the next.

    -In late 1985, IBM released one such protocol, which it merged with the NetBIOS API to become the -NetBIOS Extended User Interface (NetBEUI). NetBEUI was designed for small local area networks (LANs), and it let each machine claim a name (up to 15 characters) that wasn't already in use on the network. By a "small LAN," we mean fewer than 255 nodes on the network - which was considered a practical restriction in 1985!

    -The NetBEUI protocol was very popular with networking applications, including those running under Windows for Workgroups. Later, implementations of NetBIOS over Novell's IPX networking protocols also emerged, which competed with NetBEUI. However, the networking protocols of choice for the burgeoning Internet community were TCP/IP and UDP/IP, and implementing the NetBIOS APIs over those protocols soon became a necessity.

    -Recall that TCP/IP uses numbers to represent computer addresses, such as 192.168.220.100, while NetBIOS uses only names. This was a major issue when trying to mesh the two protocols together. In 1987, the Internet Engineering Task Force (IETF) published a series of standardization documents, titled RFC 1001 and 1002, that outlined how NetBIOS would work over a TCP/UDP network. This set of documents still governs each of the implementations that exist today, including those provided by Microsoft with their Windows operating systems as well as the Samba suite.

    -Since then, the standard this document governs has become known as -NetBIOS over TCP/IP, or NBT for short. The NBT standard (RFC 1001/1002) currently outlines a trio of services on a network:

      -
    • -

      - -A name service

    • -

      - -Two communication services:

        -
      • -

        - -Datagrams

      • -

        - -Sessions

    -The name service solves the name-to-address problem mentioned earlier; it allows each computer to declare a specific name on the network that can be translated to a machine-readable IP address, much like today's DNS on the Internet. The datagram and session services are both secondary communication protocols used to transmit data back and forth from NetBIOS machines across the network.

    -

    - -1.3.2 Getting a Name

    For a human being, getting a name is easy. However, for a machine on a NetBIOS network, it can be a little more complicated. Let's look at a few of the issues.

    -In the NetBIOS world, when each machine comes online, it wants to claim a name for itself; this is called -name registration. However, no two machines in the same workgroup should be able to claim the same name; this would cause endless confusion for any machine that wanted to communicate with either machine. There are two different approaches to ensuring that this doesn't happen:

      -
    • -

      - -Use a -NetBIOS Name Server (NBNS) to keep track of which hosts have registered a NetBIOS name.

    • -

      - -Allow each machine on the network to defend its name in the event that another machine attempts to use it.

    - -Figure 1.8 illustrates a (failed) name registration, with and without a NetBIOS Name Server.

    - -Figure 1.8: NBNS versus non-NBNS name registration

    Figure 1.8

    -In addition, there must be a way to resolve a NetBIOS name to a specific IP address as mentioned earlier; this is known as -name resolution. There are two different approaches with NBT here as well:

      -
    • -

      - -Have each machine report back its IP address when it "hears" a broadcast request for its NetBIOS name.

    • -

      - -Use the NBNS to help resolve NetBIOS names to IP addresses.

    - -Figure 1.9 illustrates the two types of name resolution.

    - -Figure 1.9: NBNS versus non-NBNS name resolution

    Figure 1.9

    -As you might expect, having an NBNS on your network can help out tremendously. To see exactly why, let's look at the non-NBNS method.

    -Here, when a client machine boots, it will broadcast a message declaring that it wishes to register a specified NetBIOS name as its own. If nobody objects to the use of the name after multiple registration attempts, it keeps the name. On the other hand, if another machine on the local subnet is currently using the requested name, it will send a message back to the requesting client that the name is already taken. This is known as -defending the hostname. This type of system comes in handy when one client has unexpectedly dropped off the network - another can take its name unchallenged - but it does incur an inordinate amount of traffic on the network for something as simple as name registration.

    -With an NBNS, the same thing occurs, except that the communication is confined to the requesting machine and the NBNS server. No broadcasting occurs when the machine wishes to register the name; the registration message is simply sent directly from the client to NBNS server and the NBNS server replies whether or not the name is already taken. This is known as -point-to-point communication, and is often beneficial on networks with more than one subnet. This is because routers are often preconfigured to block incoming packets that are broadcast to all machines in the subnet.

    -The same principles apply to name resolution. Without an NBNS, NetBIOS name resolution would also be done with a broadcast mechanism. All request packets would be sent to each computer in the network, with the hope that one machine that might be affected will respond directly back to the machine that asked. At this point, it's clear that using an NBNS server and point-to-point communication for this purpose is far less taxing on the network than flooding the network with broadcasts for every name resolution request.

    -

    - -1.3.3 Node Types

    How can you tell what strategy each client on your network will use when performing name registration and resolution? Each machine on an NBT network earns one of the following designations, depending on how it handles name registration and resolution: b-node, p-node, m-node, and h-node. The behaviors of each type of node are summarized in -Table 1.1.


    - - - - - - - - -
    - -Table 1.1: NetBIOS Node Types
    -

    -Role

    		 -

    -Value

    -

    -b-node

    		 -

    -Uses broadcast registration and resolution only.

    -

    -p-node

    		 -

    -Uses point-to-point registration and resolution only.

    -

    -m-node

    		 -

    -Uses broadcast for registration. If successful, it notifies the NBNS server of the result. Uses broadcast for resolution; uses NBNS server if broadcast is unsuccessful.

    -

    -h-node (hybrid)

    		 -

    -Uses NBNS server for registration and resolution; uses broadcast if the NBNS server is unresponsive or inoperative.

    -In the case of Windows clients, you will usually find them listed as -h-nodes or -hybrid nodes. Incidentally, h-nodes were invented later by Microsoft, as a more fault-tolerant route, and do not appear in RFC 1001/1002.

    -You can find out the node type of any Windows machine by typing the command -ipconfig -/all and searching for the line that says -Node Type.

    - -
    C:\> ipconfig /all
-
    -Windows 98 IP Configuration
-...
-  Node Type .  .  .  .  .  .  .  .  .  .  : Hybrid
-...
    -

    - -1.3.4 What's in a Name?

    -The names NetBIOS uses are quite different from the DNS hostnames you might be familiar with. First, NetBIOS names exist in a flat namespace. In other words, there are no qualifiers such as ora.com or samba.org to section off hostnames; there is only a single unique name to represent each computer. Second, NetBIOS names are allowed to be only 15 characters, may not begin with an asterisk (*), and can consist only of standard alphanumeric characters (a-z, A-Z, 0-9) and the following:

    -! @ # $ % ^ & ( ) - ' { } . ~

    -Although you are allowed to use a period (.) in a NetBIOS name, we recommend against it because those names are not guaranteed to work in future versions of NetBIOS over TCP/IP.

    -It's not a coincidence that all valid DNS names are also valid NetBIOS names. In fact, the DNS name for a Samba server is often reused as its NetBIOS name. For example, if you had a machine -phoenix.ora.com, its NetBIOS name would likely be PHOENIX (followed by 8 blanks).

    -

    - -1.3.4.1 Resource names and types

    -With NetBIOS, a machine not only advertises its presence, but also tells others what types of services it offers. For example, -phoenix can indicate that it's not just a workstation, but is also a file server and can receive WinPopup messages. This is done by adding a 16th byte to the end of the machine (resource) name, called the resource type, and registering the name more than once. See -Figure 1.10.

    - -Figure 1.10: The structure of NetBIOS names

    Figure 1.10

    -The one-byte resource type indicates a unique service the named machine provides. In this book, you will often see the resource type shown in angled brackets (<>) after the NetBIOS name, such as:

    PHOENIX<00>

    -You can see which names are registered for a particular NBT machine using the Windows command-line NBTSTAT utility. Because these services are unique (i.e., there cannot be more than one registered), you will see them listed as type UNIQUE in the output. For example, the following partial output describes the -hydra server:

    D:\> NBTSTAT -a hydra
    -       NetBIOS Remote Machine Name Table
-   Name               Type         Status
----------------------------------------------
-HYDRA          <00>  UNIQUE      Registered
-HYDRA          <03>  UNIQUE      Registered
-HYDRA          <20>  UNIQUE      Registered
-...

    -This says the server has registered the NetBIOS name -hydra as a machine (workstation) name, a recipient of WinPopup messages, and a file server. Some possible attributes a name can have are listed in -Table 1.2.


    - - - - - - - - - - - - - - -
    - -Table 1.2: NetBIOS Unique Resource Types
    -

    Named Resource

    		 -

    Hexidecimal Byte Value

    -

    -Standard Workstation Service

    		 -

    -00

    -

    -Messenger Service (WinPopup)

    		 -

    -03

    -

    -RAS Server Service

    		 -

    -06

    -

    -Domain Master Browser Service (associated with primary domain controller)

    		 -

    -1B

    -

    -Master Browser name

    		 -

    -1D

    -

    -NetDDE Service

    		 -

    -1F

    -

    -Fileserver (including printer server)

    		 -

    -20

    -

    -RAS Client Service

    		 -

    -21

    -

    -Network Monitor Agent

    		 -

    -BE

    -

    -Network Monitor Utility

    		 -

    -BF

    -Note that because DNS names don't have resource types, the designers intentionally made hexidecimal value 20 (an ASCII space) default to the type for a file server.

    -

    - -1.3.4.2 Group names and types

    SMB also uses the concept of groups, with which machines can register themselves. Earlier, we mentioned that the machines in our example belonged to a -workgroup, which is a partition of machines on the same network. For example, a business might very easily have an ACCOUNTING and a SALES workgroup, each with different servers and printers. In the Windows world, a workgroup and an SMB group are the same thing.

    -Continuing our NBTSTAT example, the -hydra Samba server is also a member of the SIMPLE workgroup (the GROUP attribute hex 00), and will stand for election as a browse master (GROUP attribute 1E). Here is the remainder of the NBTSTAT utility output:

    -       NetBIOS Remote Machine Name Table, continued
-   Name               Type         Status
----------------------------------------------
-SIMPLE           <00>  GROUP       Registered
-SIMPLE           <1E>  GROUP       Registered
-..__MSBROWSE__.  <01>  GROUP       Registered

    -The possible group attributes a machine can have are illustrated in -Table 1.3. More information is available in Windows NT in a Nutshell by Eric Pearce, also published by O'Reilly.


    - - - - - - - - - - -
    - -Table 1.3: NetBIOS Group Resource Types
    -

    -Named Resource

    		-

    Hexidecimal Byte Value

    -

    -Standard Workstation group

    		 -

    -00

    -

    -Logon Server

    		-

    -1C

    -

    -Master Browser name

    		-

    -1D

    -

    -Normal Group name (used in browser elections)

    		 -

    -1E

    -

    -Internet Group name (administrative)

    		 -

    -20

    -

    - -<01><02>__MSBROWSE__<02>

    		 -

    -01

    -The final entry, -__MSBROWSE__, is used to announce a group to other master browsers. The nonprinting characters in the name show up as dots in a NBTSTAT printout. Don't worry if you don't understand all of the resource or group types. Some of them you will not need with Samba, and others you will pick up as you move through the rest of the chapter. The important thing to remember here is the logistics of the naming mechanism.

    -

    - -1.3.5 Datagrams and Sessions

    - -At this point, let's digress to introduce another responsibility of NBT: to provide connection services between two NetBIOS machines. There are actually two services offered by NetBIOS over TCP/IP: the -session service and the -datagram service. Understanding how these two services work is not essential to using Samba, but it does give you an idea of how NBT works and how to troubleshoot Samba when it doesn't work.

    -The datagram service has no stable connection between one machine and another. Packets of data are simply sent or broadcast from one machine to another, without regard for the order that they arrive at the destination, or even if they arrive at all. The use of datagrams is not as network intensive as sessions, although they can bog down a network if used unwisely (remember broadcast name resolution earlier?) Datagrams, therefore, are used for quickly sending simple blocks of data to one or more machines. The datagram service communicates using the simple primitives shown in -Table 1.4.


    - - - - - - - - -
    - -Table 1.4: Datagram Primitives
    -

    -Primitive

    		 -

    -Description

    -

    -Send Datagram

    		 -

    -Send datagram packet to machine or groups of machines.

    -

    -Send Broadcast Datagram

    		 -

    -Broadcast datagram to any machine waiting with a Receive Broadcast Datagram.

    -

    -Receive Datagram

    		 -

    -Receive a datagram from a machine.

    -

    -Receive Broadcast Datagram

    		 -

    -Wait for a broadcast datagram.

    -The session service is more complex. Sessions are a communication method that, in theory, offers the ability to detect problematic or inoperable connections between two NetBIOS applications. It helps to think of an NBT session in terms of a telephone call.[5] A full-duplex connection is opened between a caller machine and a called machine, and it must remain open throughout the duration of their conversation. Each side knows who the caller and the called machine is, and can communicate with the simple primitives shown in -Table 1.5.

    -
    -

    -[5] As you can see in RFC 1001, the telephone analogy was strongly evident in the creation of the NBT service.


    - - - - - - - - - - -
    - -Table 1.5: Session Primitives
    -

    -Primitive

    		 -

    -Description

    -

    -Call

    		 -

    -Initiate a session with a machine listening under a specified name.

    -

    -Listen

    		 -

    -Wait for a call from a known caller or any caller.

    -

    -Hang-up

    		 -

    -Exit a call.

    -

    -Send

    		 -

    -Send data to the other machine.

    -

    -Receive

    		 -

    -Receive data from the other machine.

    -

    -Session Status

    		 -

    -Get information on requested sessions.

    -Sessions are the backbone of resource sharing on an NBT network. They are typically used for establishing stable connections from client machines to disk or printer shares on a server. The client "calls" the server and starts trading information such as which files it wishes to open, which data it wishes to exchange, etc. These calls can last a long time - hours, even days - and all of this occurs within the context of a single connection. If there is an error, the session software (TCP) will retransmit until the data is received properly, unlike the "punt-and-pray" approach of the datagram service (UDP).

    -In truth, while sessions are supposed to be able to handle problematic communications, they often don't. As you've probably already discovered when using Windows networks, this is a serious detriment to using NBT sessions. If the connection is interrupted for some reason, session information that is open between the two computers can easily become invalidated. If that happens, the only way to regain the session information is for the same two computers to call each other again and start over.

    -If you want more information on each of these services, we recommend you look at RFC 1001. However, there are two important things to remember here:

      -
    • -

      - -Sessions always occur between -two NetBIOS machines - no more and no less. If a session service is interrupted, the client is supposed to store sufficient state information for it to re-establish the connection. However, in practice, this is rarely the case.

    • -

      - -Datagrams can be broadcast to multiple machines, but they are unreliable. In other words, there is no way for the source to know that the datagrams it sent have indeed arrived at their - destinations.

    -
    -
    -
    - - -
    - -Previous: 1.2 What Can Samba Do For Me? - - - -Next: 1.4 Microsoft Implementations
    -1.2 What Can Samba Do For Me? - -Book Index -1.4 Microsoft Implementations
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch01_04.html b/docs/htmldocs/using_samba/ch01_04.html deleted file mode 100644 index 15a1943e6e..0000000000 --- a/docs/htmldocs/using_samba/ch01_04.html +++ /dev/null @@ -1,277 +0,0 @@ - - - -[Chapter 1] 1.4 Microsoft Implementations - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 1.3 Getting Familiar with a SMB/CIFS Network - - - -Chapter 1
    -Learning the Samba    		 - -Next: 1.5 An Overview of the Samba Distribution
     
    - -
    -
    -

    - -1.4 Microsoft Implementations

    With that amount of background, we can now talk about some of Microsoft's implementations of the preceding concepts in the CIFS/SMB networking world. And, as you might expect, there are some complex extensions to introduce as well.

    -

    - -1.4.1 Windows Domains

    Recall that a workgroup is a collection of SMB computers that all reside on a subnet and subscribe to the same SMB group. A -Windows domain goes a step further. It is a workgroup of SMB machines that has one addition: a server acting as a -domain controller. You must have a domain controller in order to have a Windows domain.[6] Otherwise, it is only a workgroup. See -Figure 1.11.

    -
    -

    -[6] Windows domains are called "Windows NT domains" by Microsoft because they assume that Windows NT machines will take the role of the domain controller. However, because Samba can perform this function as well, we'll simply call them "Windows domains" to avoid confusion.

    - -Figure 1.11: A simple Windows domain

    Figure 1.11

    There are currently two separate protocols used by a domain controller (logon server): one for communicating with Windows 95/98 machines and one for communicating with Windows NT machines. While Samba currently implements the domain controller protocol for Windows 95/98 (which allows it to act as a domain controller for Windows 9 -x machines), it still does not fully support the protocol for Windows NT computers. However, the Samba team promises that support for the Windows NT domain controller protocol is forthcoming in Samba 2.1.

    -Why all the difficulty? The protocol that Windows domain controllers use to communicate with their clients and other domain controllers is proprietary and has not been released by Microsoft. This has forced the Samba development team to reverse-engineer the domain controller protocol to see which codes perform specific tasks.

    -

    - -1.4.1.1 Domain controllers

    -The domain controller is the nerve center of a Windows domain, much like an NIS server is the nerve center of the Unix network information service. Domain controllers have a variety of responsibilities. One responsibility that you need to be concerned with is -authentication. Authentication is the process of granting or denying a user access to a shared resource on another network machine, typically through the use of a password.

    -Each domain controller uses a -security account manager (SAM) to maintain a list of username-password combinations. The domain controller then forms a central repository of passwords that are tied to usernames (one password per user), which is more efficient than each client machine maintaining hundreds of passwords for every network resource available.

    -On a Windows domain, when a non-authenticated client requests access to a server's shares, the server will turn around and ask the domain controller whether that user is authenticated. If it is, the server will establish a session connection with the access rights it has for that service and user. If not, the connection is denied. Once a user is authenticated by the domain controller, a special authenticated token will be returned to the client so that the user will not need to relogin to other resources on that domain. At this point, the user is considered "logged in" to the domain itself. See -Figure 1.12.

    - -Figure 1.12: Using a domain controller for authentication

    Figure 1.12
    -

    - -1.4.1.2 Primary and backup domain controllers

    Redundancy is a key idea behind a Windows domain. The domain controller that is currently active on a domain is called the -primary domain controller (PDC). There can be one or more -backup domain controllers (BDCs) in the domain as well, which will take over in the event that the primary domain controller fails or becomes inaccessible. BDCs frequently synchronize their SAM data with the primary domain controller so that, if the need arises, any one of them can perform DC services transparently without impacting its clients. Note that BDCs, however, have only read-only copies of the SAM; they can update their data only by synchronizing with a PDC. A server in a Windows domain can use the SAM of any primary or backup domain controller to authenticate a user who attempts to access its resources and logon to the domain.

    -Note that in many aspects, the behaviors of a Windows workgroup and a Windows domain overlap. This is not accidental since the concept of Windows domains did not evolve until Windows NT 3.5 was introduced, and Windows domains were forced to remain backwards compatible with the workgroups present in Windows for Workgroups 3.1. The key thing to remember here is that a Windows domain is simply a Windows workgroup with one or more domain controllers added.

    -Samba can function as a primary domain controller for Windows 95/98 machines without any problems. However, Samba 2.0 can act as a primary domain controller only for authentication purposes; it currently cannot assume any other PDC responsibilities. (By the time you read this, Samba 2.1 may be available so you can use Samba as a PDC for NT clients.) Also, because of the closed protocol used by Microsoft to synchronize SAM data, Samba currently cannot serve as a backup domain controller.

    -

    - -1.4.2 Browsing

    Browsing is a high-level answer to the user question: "What machines are out there on the Windows network?" Note that there is no connection with a World Wide Web browser, apart from the general idea of "discovering what's there." And, like the Web, what's out there can change without warning.

    -Before browsing, users had to know the name of the specific computer they wanted to connect to on the network, and then manually enter a UNC such as the following into an application or file manager to access resources:

    -\\HYDRA\network\

    -With browsing, however, you can examine the contents of a machine using a standard point-and-click GUI - in this case, the Network Neighborhood window in a Windows client.

    -

    - -1.4.2.1 Levels of browsing

    -As we hinted at the beginning of the chapter, there are actually two types of browsing that you will encounter in an SMB/CIFS network:

      -
    • -

      - -Browsing a list of machines (with shared resources)

    • -

      - -Browsing the shared resources of a specific machine

    Let's look at the first one. On each Windows workgroup (or domain) subnet, one computer has the responsibility of maintaining a list of the machines that are currently accessible through the network. This computer is called the -local master browser, and the list that it maintains is called the -browse list. Machines on a subnet use the browse list in order to cut down on the amount of network traffic generated while browsing. Instead of each computer dynamically polling to determine a list of the currently available machines, the computer can simply query the local master browser to obtain a complete, up-to-date list.

    To browse the actual resources on a machine, a user must connect to the specific machine; this information cannot be obtained from the browse list. Browsing the list of resources on a machine can be done by clicking on the machine's icon when it is presented in the Network Neighborhood in Windows 95/98 or NT. As you saw at the opening of the chapter, the machine will respond with a list of shared resources that can be accessed if that user is successfully authenticated.

    -Each of the servers on a Windows workgroup is required to announce its presence to the local master browser after it has registered a NetBIOS name, and (theoretically) announce that it is leaving the workgroup when it is shut down. It is the local master browser's responsibility to record what the servers have announced. Note that the local master browser is not necessarily the same machine as a NetBIOS name server (NBNS), which we discussed earlier.

    -

    - -WARNING: The Windows Network Neighborhood can behave oddly: until you select a particular machine to browse, the Network Neighborhood window may contain data that is not up-to-date. That means that the Network Neighborhood window can be showing machines that have crashed, or can be missing machines that haven't been noticed yet. Put succinctly, once you've selected a server and connected to it, you can be a lot more confident that the shares and printers really exist on the network.

    -Unlike the roles you've seen earlier, almost any Windows machine (NT Server, NT Workstation, 98, 95, or Windows 3.1 for Workgroups) can act as a local master browser. As with the domain controller, the local master browser can have one or more -backup browsers on the local subnet that will take over in the event that the local master browser fails or becomes inaccessible. To ensure fluid operation, the local backup browsers will frequently synchronize their browse list with the local master browser. Let's update our Windows domain diagram to include both a local master and local backup browser. The result is shown in -Figure 1.13.

    - -Figure 1.13: A Windows domain with a local master and local backup browser

    Figure 1.13

    -Here is how to calculate the minimum number of backup browsers that will be allocated on a workgroup:

      -
    • -

      - -If there are between 1 and 32 Windows NT workstations on the network, or between 1 and 16 Windows 95/98 machines on the network, the local master browser allocates one backup browser in addition to the local master browser.

    • -

      - -If the number of Windows NT workstations falls between 33 and 64, or the number of Windows 95/98 workstations falls between 17 and 32, the local master browser allocates two backup browsers.

    • -

      - -For each group of 32 NT workstations or 16 Windows 95/98 machines beyond this, the local master browser allocates another backup browser.

    -There is currently no upper limit on the number of backup browsers that can be allocated by the local master browser.

    -

    - -1.4.2.2 Browsing elections

    -Browsing is a critical aspect of any Windows workgroup. However, not everything runs perfectly on any network. For example, let's say that the Windows NT Server on the desk of a small company's CEO is the local master browser - that is, until he switches it off while plugging in his massage chair. At this point the Windows NT Workstation in the spare parts department might agree to take over the job. However, that computer is currently running a large, poorly written program that has brought its processor to its knees. The moral: browsing has to be very tolerant of servers coming and going. Because nearly every Windows machine can serve as a browser, there has to be a way of deciding at any time who will take on the job. This decision-making process is called an -election.

    -An election algorithm is built into nearly all Windows operating systems such that they can each agree who is going to be a local master browser and who will be local backup browsers. An election can be forced at any time. For example, let's assume that the CEO has finished his massage and reboots his server. As the server comes online, it will announce its presence and an election will take place to see if the PC in the spare parts department should still be the master browser.

    -When an election is performed, each machine broadcasts via datagrams information about itself. This information includes the following:

      -
    • -

      - -The version of the election protocol used

    • -

      - -The operating system on the machine

    • -

      - -The amount of time the client has been on the network

    • -

      - -The hostname of the client

    -These values determine which operating system has seniority and will fulfill the role of the local master browser. (Chapter 6, Users, Security, and Domains, describes the election process in more detail.) The architecture developed to achieve this is not elegant and has built-in security problems. While a browsing domain can be integrated with domain security, the election algorithm does not take into consideration which computers become browsers. Thus it is possible for any machine running a browser service to register itself as participating in the browsing election, and (after winning) being able to change the browse list. Nevertheless, browsing is a key feature of Windows networking and backwards compatibility requirements will ensure that it is in use for years to come.

    -

    - -1.4.3 Can a Windows Workgroup Span Multiple Subnets?

    Yes, but most people who have done it have had their share of headaches. Spanning multiple subnets was not part of the initial design of Windows NT 3.5 or Windows for Workgroups. As a result, a Windows domain that spans two or more subnets is, in reality, the "gluing" together of two or more workgroups that share an identical name. The good news is that you can still use a primary domain controller to control authentication across each of the subnets. The bad news is that things are not as simple with browsing.

    -As mentioned previously, each subnet must have its own local master browser. When a Windows domain spans multiple subnets, a system administrator will have to assign one of the machines as the -domain master browser. The domain master browser will keep a browse list for the entire Windows domain. This browse list is created by periodically synchronizing the browse lists of each of the local master browsers with the browse list of the domain master browser. After the synchronization, the local master browser and the domain master browser should contain identical entries. See -Figure 1.14 for an illustration.

    - -Figure 1.14: A workgroup that spans more than one subnet

    Figure 1.14

    -Sound good? Well, it's not quite nirvana for the following reasons:

      -
    • -

      - -If it exists, a primary domain controller always plays the role of the domain master browser. By Microsoft design, the two always share the NetBIOS resource type <1B>, and (unfortunately) cannot be separated.

    • -

      - -Windows 95/98 machines cannot become -or -even contact a domain master browser. The Samba group feels that this is a marketing decision from Microsoft that forces customers to have at least one Windows NT workstation (or Samba server) on each subnet of a multi-subnet workgroup.

    -Each subnet's local master browser continues to maintain the browse list for its subnet, for which it becomes authoritative. So if a computer wants to see a list of servers within its own subnet, the local master browser of that subnet will be queried. If a computer wants to see a list of servers outside the subnet, it can still go only as far as the local master browser. This works because, at appointed intervals, the authoritative browse list of a subnet's local master browser is synchronized with the domain master browser, which is synchronized with the local master browser of the other subnets in the domain. This is called -browse list propagation.

    -Samba can act as a domain master browser on a Windows domain if required. In addition, it can also act as a local master browser for a Windows subnet, synchronizing its browse list with the domain master browser.

    -

    - -1.4.4 The Windows Internet Name Service (WINS)

    -The Windows Internet Name Service (WINS) is Microsoft's implementation of a NetBIOS name server (NBNS). As such, WINS inherits much of NetBIOS's characteristics. First, WINS is flat; you can only have machines named -fred or workgroups like CANADA or USA. In addition, WINS is dynamic: when a client first comes online, it is required to report its hostname, its address, and its workgroup to the local WINS server. This WINS server will retain the information so long as the client periodically refreshes its WINS registration, which indicates that it's still connected to the network. Note that WINS servers are not domain or workgroup specific; they can appear anywhere and serve anyone.

    -Multiple WINS servers can be set to synchronize with each other after a specified amount of time. This allows entries for machines that come online and offline on the network to propagate from one WINS server to another. While in theory this seems efficient, it can quickly become cumbersome if there are several WINS servers covering a network. Because WINS services can cross multiple subnets (you'll either hardcode the address of a WINS server in each of your clients or obtain it via DHCP), it is often more efficient to have each Windows client, no matter how many Windows domains there are, point themselves to the same WINS server. That way, there will only be one authoritative WINS server with the correct information, instead of several WINS servers continually struggling to synchronize themselves with the most recent changes.

    -The currently active WINS server is known as the -primary WINS server. You can also install a secondary WINS server, which will take over in the event that the primary WINS server fails or becomes inaccessible. Note that there is no election to determine which machine becomes a primary or backup WINS server - the choice of WINS servers is static and must be predetermined by the system administrator. Both the primary and any backup WINS servers will synchronize their address databases on a periodic basis.

    -In the Windows family of operating systems, only an NT Workstation or an NT server can serve as a -WINS server. Samba can also function as a primary WINS server, but not a secondary WINS server.

    -

    - -1.4.5 What Can Samba Do?

    Whew! Bet you never thought Microsoft networks would be that complex, did you? Now, let's wrap up by showing where Samba can help out. -Table 1.6 summarizes which roles Samba can and cannot play in a Windows NT Domain or Windows workgroup. As you can see, because many of the NT domain protocols are proprietary and have not been documented by Microsoft, Samba cannot properly synchronize its data with a Microsoft server and cannot act as a backup in most roles. However, with version 2.0. -x, Samba does have limited support for the primary domain controller's authentication protocols and is gaining more functionality every day.


    - - - - - - - - - - - - - - -
    - -Table 1.6: Samba Roles (as of 2.0.4b)
    -

    -Role

    		 -

    -Can Perform?

    -

    -File Server

    		 -

    -Yes

    -

    -Printer Server

    		 -

    -Yes

    -

    -Primary Domain Controller

    		 -

    -Yes (Samba 2.1 or higher recommended)

    -

    -Backup Domain Controller

    		 -

    -No

    -

    -Windows 95/98 Authentication

    		 -

    -Yes

    -

    -Local Master Browser

    		 -

    -Yes

    -

    -Local Backup Browser

    		 -

    -No

    -

    -Domain Master Browser

    		 -

    -Yes

    -

    -Primary WINS Server

    		 -

    -Yes

    -

    -Secondary WINS Server

    		 -

    -No

    -
    -
    -
    - - -
    - -Previous: 1.3 Getting Familiar with a SMB/CIFS Network - - - -Next: 1.5 An Overview of the Samba Distribution
    -1.3 Getting Familiar with a SMB/CIFS Network - -Book Index -1.5 An Overview of the Samba Distribution
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch01_05.html b/docs/htmldocs/using_samba/ch01_05.html deleted file mode 100644 index 0989ddfb91..0000000000 --- a/docs/htmldocs/using_samba/ch01_05.html +++ /dev/null @@ -1,130 +0,0 @@ - - - -[Chapter 1] 1.5 An Overview of the Samba Distribution - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 1.4 Microsoft Implementations - - - -Chapter 1
    -Learning the Samba    		 - -Next: 1.6 How Can I Get Samba?
     
    - -
    -
    -

    - -1.5 An Overview of the Samba Distribution

    -As mentioned earlier, Samba actually contains several programs that serve different but related purposes. Let's introduce each of them briefly, and show how they work together. The majority of the programs that come with the Samba distribution center on its two daemons. Let's take a refined look at the responsibilities of each daemon:

    -
    - -smbd
    -

    -The -smbd daemon is responsible for managing the shared resources between the Samba server machine and its clients. It provides file, print, and browser services to -SMB clients across one or more networks. -smdb handles all notifications between the Samba server and the network clients. In addition, it is responsible for user authentication, resource locking, and data sharing through the -SMB protocol.

    - -nmbd
    -

    -The -nmbd daemon is a simple nameserver that mimics the WINS and NetBIOS name server functionality, as you might expect to encounter with the LAN Manager package. This daemon listens for nameserver requests and provides the appropriate information when called upon. It also provides browse lists for the Network Neighborhood and participates in browsing elections.

    -The Samba distribution also comes with a small set of Unix command-line tools:

    -
    -smbclient
    -

    -An FTP-like Unix client that can be used to connect to Samba shares

    -smbtar
    -

    -A program for backing up data in shares, similar to the Unix -tar command

    -nmblookup
    -

    -A program that provides NetBIOS over TCP/IP name lookups

    -smbpasswd
    -

    -A program that allows an administrator to change the encrypted passwords used by Samba

    -smbstatus
    -

    -A program for reporting the current network connections to the shares on a Samba server

    -testparm
    -

    -A simple program to validate the Samba configuration file

    -testprns
    -

    -A program that tests whether various printers are recognized by the -smbd daemon

    -Each significant release of Samba goes through a significant exposure test before it's announced. In addition, it is quickly updated afterward if problems or unwanted side-effects are found. The latest stable distribution as of this writing is Samba 2.0.5, the long-awaited production version of Samba 2.0. This book focuses on the functionality supported in Samba 2.0, as opposed to the older 1.9. -x versions of Samba, which are now obsolete.

    -
    -
    -
    - - -
    - -Previous: 1.4 Microsoft Implementations - - - -Next: 1.6 How Can I Get Samba?
    -1.4 Microsoft Implementations - -Book Index -1.6 How Can I Get Samba?
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch01_06.html b/docs/htmldocs/using_samba/ch01_06.html deleted file mode 100644 index f3b46b2313..0000000000 --- a/docs/htmldocs/using_samba/ch01_06.html +++ /dev/null @@ -1,90 +0,0 @@ - - - -[Chapter 1] 1.6 How Can I Get Samba? - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 1.5 An Overview of the Samba Distribution - - - -Chapter 1
    -Learning the Samba    		 - -Next: 1.7 What's New in Samba 2.0?
     
    - -
    -
    -

    - -1.6 How Can I Get Samba?

    Samba is available in both binary and source format from a set of mirror sites across the Internet. The primary home site for Samba is located at http://www.samba.org/.

    -However, if you don't want to wait for packets to arrive all the way from Australia, mirror sites for Samba can be found at any of several locations on the Internet. A list of mirrors is given at the primary Samba home page.

    -In addition, a CD-ROM distribution is available in the back of this book. We strongly encourage you to start with the CD-ROM if this is your first time using Samba. We've included source and binaries up to Samba 2.0.5 with this book. In addition, several of the testing tools that we refer to through the book are conveniently packaged on the CD-ROM.

    -
    -
    -
    - - -
    - -Previous: 1.5 An Overview of the Samba Distribution - - - -Next: 1.7 What's New in Samba 2.0?
    -1.5 An Overview of the Samba Distribution - -Book Index -1.7 What's New in Samba 2.0?
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch01_07.html b/docs/htmldocs/using_samba/ch01_07.html deleted file mode 100644 index a5fd482b03..0000000000 --- a/docs/htmldocs/using_samba/ch01_07.html +++ /dev/null @@ -1,138 +0,0 @@ - - - -[Chapter 1] 1.7 What's New in Samba 2.0? - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 1.6 How Can I Get Samba? - - - -Chapter 1
    -Learning the Samba    		 - -Next: 1.8 And That's Not All...
     
    - -
    -
    -

    - -1.7 What's New in Samba 2.0?

    Samba 2.0 was an eagerly-awaited package. The big additions to Samba 2.0 are more concrete support for NT Domains and the new Samba Web Administration Tool (SWAT), a browser-based utility for configuring Samba. However, there are dozens of other improvements that were introduced in the summer and fall of 1998.

    -

    - -1.7.1 NT Domains

    -Samba's support for NT Domains (starting with version 2.0. -x) produced a big improvement: it allows SMB servers to use its authentication mechanisms, which is essential for future NT compatibility, and to support -NT domain logons. Domain logons allow a user to log in to a Windows NT domain and use all the computers in the domain without logging into them individually. Previous to version 2.0.0, Samba supported Windows 95/98 logon services, but not NT domain logons. Although domain logons support is not complete is Samba 2.0, it is partially implemented.

    -

    - -1.7.2 Ease of Administration

    SWAT, the Samba Web Administration Tool, makes it easy to set up a server and change its configuration, without giving up the simple text-based configuration file. SWAT provides a graphical interface to the resources that Samba shares with its clients. In addition, SWAT saves considerable experimentation and memory work in setting up or changing configurations across the network. You can even create an initial setup with SWAT and then modify the file later by hand, or vice versa. Samba will not complain.

    -On the compilation side, GNU -autoconf is now used to make the task of initial compilation and setup easier so you can get to SWAT quicker.

    -

    - -1.7.3 Performance

    -There are major performance and scalability increases in Samba: the code has been reorganized and -nmbd (the Samba name service daemon) heavily rewritten:

      -
    • -

      - -Name/browsing service now supports approximately 35,000 simultaneous clients.

    • -

      - -File and print services support 500 concurrent users from a single medium-sized server without noticeable performance degradation.

    • -

      - -Linux/Samba on identical hardware now consistently performs better than NT Server. And best of all, Samba is improving.

    • -

      - -Improved "opportunistic" locking allows client machines to cache entire files locally, greatly improving speed without running the risk of accidentally overwriting the cached files.

    -

    - -1.7.4 More Features

    -There are several additional features in Samba 2.0. You can now have multiple Samba aliases on the same machine, each pretending to be a different server, a feature similar to virtual hosts in modern web servers. This allows a host to serve multiple departments and groups, or provide disk shares with normal username/password security while also providing printers to everyone without any security. Printing has been changed to make it easier for Unix System V owners: Samba can now find the available printers automatically, just as it does with Berkeley-style printing. In addition, Samba now has the capability to use multiple code pages, so it can be used with non-European languages, and to use the Secure Sockets Layer protocol (SSL) to encrypt all the data it sends across the Internet, instead of just passwords.[7]

    -
    -

    -[7] If you reside in the United States, there are some federal rules and regulations dealing with strong cryptography. We'll talk about his later when we set up Samba and SSL in Appendix A, -Configuring Samba with SSL.

    -

    - -1.7.5 Compatibility Improvements

    -At the same time as it's becoming more capable, Samba is also becoming more compatible with Windows NT. Samba has always supported Microsoft-style password encryption. It now provides tools and options for changing over to Microsoft encryption, and for keeping the Unix and Microsoft password files synchronized while doing so. Finally, a Samba master browser can be instructed to hunt down and synchronize itself with other SMB servers on different LANs, allowing SMB to work seamlessly across multiple networks. Samba uses a different method of accomplishing this from the Microsoft method, which is undocumented.

    -

    - -1.7.6 Smbwrapper

    -Finally, there is an entirely new version of the Unix client called -smbwrapper. Instead of a kernel module that allows Linux to act as a Samba client, there is now a command-line entry to load the library that provides a complete SMB filesystem on some brands of Unix. Once loaded, the command -ls -/smb will list all the machines in your workgroup, and -cd /smb/server_name/share_name will take you to a particular share (shared directory), similar to the Network File System (NFS). As of this writing, -smbwrapper currently runs on Linux, Solaris, SunOS 4, IRIX, and OSF/1, and is expected to run on several more operating systems in the near future.

    -
    -
    -
    - - -
    - -Previous: 1.6 How Can I Get Samba? - - - -Next: 1.8 And That's Not All...
    -1.6 How Can I Get Samba? - -Book Index -1.8 And That's Not All...
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch01_08.html b/docs/htmldocs/using_samba/ch01_08.html deleted file mode 100644 index 0ea2d0331c..0000000000 --- a/docs/htmldocs/using_samba/ch01_08.html +++ /dev/null @@ -1,89 +0,0 @@ - - - -[Chapter 1] 1.8 And That's Not All... - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 1.7 What's New in Samba 2.0? - - - -Chapter 1
    -Learning the Samba    		 - -Next: 2. Installing Samba on a Unix System
     
    - -
    -
    -

    - -1.8 And That's Not All...

    -Samba is a wonderful tool with potential for even the smallest SMB/CIFS network. This chapter presented you with a thorough introduction to what Samba is, and more importantly, how it fits into a Windows network. The next series of chapters will help you set up Samba on both the Unix server side, where its two daemons reside, as well as configure the Windows 95, 98, and NT clients to work with Samba. Before long, the aches and pains of your heterogeneous network may seem like a thing of the past. Welcome to the wonderful world of Samba!

    -
    -
    -
    - - -
    - -Previous: 1.7 What's New in Samba 2.0? - - - -Next: 2. Installing Samba on a Unix System
    -1.7 What's New in Samba 2.0? - -Book Index -2. Installing Samba on a Unix System
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch02_01.html b/docs/htmldocs/using_samba/ch02_01.html deleted file mode 100644 index a90a52d8ab..0000000000 --- a/docs/htmldocs/using_samba/ch02_01.html +++ /dev/null @@ -1,197 +0,0 @@ - - - -[Chapter 2] Installing Samba on a Unix System - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 1.8 And That's Not All... - - -Chapter 2 - -Next: 2.2 Configuring Samba
     
    - -
    -
    -

    - -2. Installing Samba on a Unix System

    -

    - -Contents:
    - -Downloading the Samba Distribution
    - -Configuring Samba
    - -Compiling and Installing Samba
    - -A Basic Samba Configuration File
    - -Starting the Samba Daemons
    - -Testing the Samba Daemons

    -

    Now that you know what Samba can do for you and your users, it's time to get your own network set up. Let's start with the installation of Samba itself on a Unix system. When dancing the samba, one learns by taking small steps. It's just the same when installing Samba; we need to teach it step by step. This chapter will help you to start off on the right foot.

    -For illustrative purposes, we will be installing the 2.0.4 version of the Samba server on a Linux[1] system running version 2.0.31 of the kernel. However, the installation steps are the same for all of the platforms that Samba supports. A typical installation will take about an hour to complete, including downloading the source files and compiling them, setting up the configuration files, and testing the server.

    -
    -

    -[1] If you haven't heard of Linux yet, then you're in for a treat. Linux is a freely distributed Unix-like operating system that runs on the Intel x86, Motorola PowerPC, and Sun Sparc platforms. The operating system is relatively easy to configure, extremely robust, and is gaining in popularity. You can get more information on the Linux operating system at http://www.linux.org/.

    Here is an overview of the steps:

      -
    1. -

      - -Download the source or binary files.

    2. -

      - -Read the installation documentation.

    3. -

      - -Configure a makefile.

    4. -

      - -Compile the server code.

    5. -

      - -Install the server files.

    6. -

      - -Create a Samba configuration file.

    7. -

      - -Test the configuration file.

    8. -

      - -Start the Samba daemons.

    9. -

      - -Test the Samba daemons.

    -

    - - -2.1 Downloading the Samba Distribution

    If you want to get started quickly, the CD-ROM packaged with this book contains both the sources and binaries of Samba that were available as this book went to print. The CD is a mirror image of the files and directories on the Samba download server: -ftp.samba.org.

    -On the other hand, if you want to download the latest version, the primary web site for the Samba software is http://www.samba.org. Once connected to this page, you'll see links to several Samba mirror sites across the world, both for the standard Samba web pages and sites devoted exclusively to downloading Samba. For the best performance, choose a site that is closest to your own geographic location.

    -The standard Samba web sites have Samba documentation and tutorials, mailing list archives, and the latest Samba news, as well as source and binary distributions of Samba. The download sites (sometimes called -FTP sites) have only the source and binary distributions. Unless you specifically want an older version of the Samba server or are going to install a binary distribution, download the latest source distribution from the closest mirror site. This distribution is always named:

    samba-latest.tar.gz

    -If you choose to use the version of Samba that is located on the CD-ROM packaged with this book, you should find the latest Samba distribution in the base directory.

    -

    - -2.1.1 Binary or Source?

    Precompiled packages are also available for a large number of Unix platforms. These packages contain binaries for each of the Samba executables as well as the standard Samba documentation. Note that while installing a binary distribution can save you a fair amount of trouble and time, there are a couple of issues that you should keep in mind when deciding whether to use the binary or compile the source yourself:

      -
    • -

      - -The binary packages can lag behind the latest version of the software by one or two (maybe more) minor releases, especially after a series of small changes and for less popular platforms. Compare the release notes for the source and binary packages to make sure that there aren't any new features that you need on your platform. This is especially true of the sources and binaries on the CD-ROM: at the time this book went to print, they were from the latest production release of Samba. However, development is ongoing, so the beta-test versions on the Internet will be newer.

    • -

      - -If you use a precompiled binary, you will need to ensure that you have the correct libraries required by the executables. On some platforms the executables are statically linked so this isn't an issue, but on modern Unix operating systems (e.g., Linux, SGI Irix, Solaris, HP-UX, etc.), libraries are often dynamically linked. This means that the binary looks for the right version of each library on your system, so you may have to install a new version of a library. The -README file or -makefile that accompanies the binary distribution should list any special requirements.[2]

      -
      -

      -[2] This is especially true with programs that use -glibc-2.1 (which comes standard with Red Hat Linux 6). This library caused quite a consternation in the development community when it was released because it was incompatable with previous versions of glibc.

      Many machines with shared libraries come with a nifty tool called ldd. This tool will tell you which libraries a specific binary requires and which libraries on the system satisfy that requirement. For example, checking the -smbd program on our test machine gave us:

    $ ldd smbd
-
    -libreadline.so.3 => /usr/lib/libreadline.so.3
-libdl.so.2 => /lib/libdl.so.2
-libcrypt.so.1 => /lib/libcrypt.so.1
-libc.so.6 => /lib/libc.so.6
-libtermcap.so.2 => /lib/libtermcap.so.2
-/lib/ld-linux.so.2 => /lib/ld-linux.so.2
      -
    • -

      -If there are any incompatibilities between Samba and specific libraries on your machine, the distribution-specific documentation should highlight those.

    • -

      - -Keep in mind that each binary distribution carries preset values about the target platform, such as default directories and configuration option values. Again, check the documentation and the makefile included in the source directory to see which directives and variables were used when the binary was compiled. In some cases, these will not be appropriate for your situation.

      -A few configuration items can be reset with command-line options at runtime instead of at compile time. For example, if your binary tries to place any log, lock, or status files in the "wrong" place (for example, in -/usr/local), you can override this without recompiling.

    -One point worth mentioning is that the Samba source requires an ANSI C compiler. If you are on a platform with a non-ANSI compiler, such as the -cc compiler on SunOS version 4, you'll have to install an ANSI-compliant compiler such as -gcc before you do anything else.[3] If installing a compiler isn't something you want to wrestle with, you can start off with a binary package. However, for the most flexibility and compatibility on your system, we always recommend compiling from the latest source.

    -
    -

    -[3] -gcc binaries are available for almost every modern machine. See -http://www.gnu.org/ for a list of sites with -gcc and other GNU software.

    -

    - -2.1.2 Read the Documentation

    This sounds like an obvious thing to say, but there have probably been times where you have uncompressed a package, blindly typed -configure, -make, and -make -install, and walked away to get another cup of coffee. We'll be the first to admit that we do that, many more times than we should. It's a bad idea - especially when planning a network with Samba.

    -Samba 2.0 automatically configures itself prior to compilation. This reduces the likelihood of a machine-specific problem, but there may be an option mentioned in the -README file that you end up wishing for after Samba's been installed. With both source and binary packages you'll find a large number of documents in the -docs directory, in a variety of formats. The most important files to look at in the distribution are:

    -WHATSNEW.txt
-docs/textdocs/UNIX_INSTALL.txt

    -These files tell you what features you can expect in your Samba distribution, and will highlight common installation problems that you're likely to face. Be sure to look over both of them before you start the compilation process.

    -
    -
    -
    - - -
    - -Previous: 1.8 And That's Not All... - - - -Next: 2.2 Configuring Samba
    -1.8 And That's Not All... - -Book Index -2.2 Configuring Samba
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch02_02.html b/docs/htmldocs/using_samba/ch02_02.html deleted file mode 100644 index 3556314b43..0000000000 --- a/docs/htmldocs/using_samba/ch02_02.html +++ /dev/null @@ -1,338 +0,0 @@ - - - -[Chapter 2] 2.2 Configuring Samba - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 2.1 Downloading the Samba Distribution - - - -Chapter 2
    -Installing Samba on a Unix System    		 - -Next: 2.3 Compiling and Installing Samba
     
    - -
    -
    -

    - -2.2 Configuring Samba

    The source distribution of Samba 2.0 and above doesn't initially have a makefile. Instead, one is generated through a GNU -configure script, which is located in the -samba-2.0.x /source/ directory. The -configure script, which must be run as root, takes care of the machine-specific issues of building Samba. However, you still may want to decide on some global options. Global options can be set by passing options on the command-line:

    -# ./configure --with-ssl

    -For example, this will configure the Samba makefile with support for the Secure Sockets Layer (SSL) encryption protocol. If you would like a complete list of options, type the following:

    -# ./configure --help

    Each of these options enable or disable various features. You typically enable a feature by specifying the ---with- - -feature option, which will cause the feature to be compiled and installed. Likewise, if you specify a ---without- - -feature option, the feature will be disabled. As of Samba 2.0.5, each of the following features is disabled by default:

    -
    - ---with-smbwrapper
    -

    -Include SMB wrapper support, which allows executables on the Unix side to access SMB/CIFS filesystems as if they were regular Unix filesystems. We recommend using this option. However, at this time this book went to press, there were several incompatibilities between the -smbwrapper package and the GNU -libc version 2.1, and it would not compile on Red Hat 6.0. Look for more information on these incompatibilities on the Samba home page.

    - ---with-afs
    -

    -Include support of the Andrew Filesystem from Carnegie Mellon University. If you're going to serve AFS files via Samba, we recommend compiling Samba once first without enabling this feature to ensure that everything runs smoothly. Once that version is working smoothly, recompile Samba with this feature enabled and compare any errors you might receive against the previous setup.

    - ---with-dfs
    -

    -Include support for DFS, a later version of AFS, used by OSF/1 (Digital Unix). Note that this is -not the same as Microsoft DFS, which is an entirely different filesystem. Again, we recommend compiling Samba once first without this feature to ensure that everything runs smoothly, then recompile with this feature to compare any errors against the previous setup.

    - ---with-krb4=base-directory
    -

    -Include support for Kerberos version 4.0, explicitly specifying the base directory of the distribution. Kerberos is a network security protocol from MIT that uses private key cryptography to provide strong security between nodes. Incidentally, Microsoft has announced that Kerberos 5.0 will be the standard authentication mechanism for Microsoft Windows 2000 (NT 5.0). However, the Kerberos 5.0 authentication mechanisms are quite different from the Kerberos 4.0 security mechanisms. If you have Kerberos version 4 on your system, the Samba team recommends that you upgrade and use the ---with-krb5 option (see the next item). You can find more information on Kerberos at http://web.mit.edu/kerberos/www.

    - ---with-krb5=base-directory
    -

    -Include support for Kerberos version 5.0, explicitly specifying the base directory of the distribution. Microsoft has announced that Kerberos 5.0 will be the standard authentication mechanism for Microsoft Windows 2000 (NT 5.0). However, there is no guarantee that Microsoft will not extend Kerberos for their own needs in the future. Currently, Samba's Kerberos support only uses a plaintext password interface and not an encrypted one. You can find more information on Kerberos at its home page: http://web.mit.edu/kerberos/www.

    - ---with-automount
    -

    -Include support for automounter, a feature often used on sites that offer NFS.

    - ---with-smbmount
    -

    -Include -smbmount support, which is for Linux only. This feature wasn't being maintained at the time the book was written, so the Samba team made it an optional feature and provided -smbwrapper instead. The -smbwrapper feature works on more Unix platforms than -smbmount, so you'll usually want to use ---with-smbwrapper instead of this option.

    - ---with-pam
    -

    -Include support for pluggable authentication modules (PAM), an authentication feature common in the Linux operating system.

    - ---with-ldap
    -

    -Include support for the Lightweight Directory Access Protocol (LDAP). A future version of LDAP will be used in the Windows 2000 (NT 5.0) operating system; this Samba support is experimental. LDAP is a flexible client-server directory protocol that can carry information such as certificates and group memberships.[4]

    -
    -

    -[4] By -directory, we don't mean a directory in a file system, but instead an indexed directory (such as a phone directory). Information is stored and can be easily retrieved in a public LDAP system.

    - ---with-nis
    -

    -Include support for getting password-file information from NIS (network yellow pages).

    - ---with-nisplus
    -

    -Include support for obtaining password-file information from NIS+, the successor to NIS.

    - ---with-ssl
    -

    -Include experimental support for the Secure Sockets Layer (SSL), which is used to provide encrypted connections from client to server. Appendix A, Configuring Samba with SSL, describes setting up Samba with SSL support.

    - ---with-nisplus-home
    -

    -Include support for locating which server contains a particular user's home directory and telling the client to connect to it. Requires ---with-nis and, usually, ---with-automounter.

    - ---with-mmap
    -

    -Include experimental memory mapping code. This is not required for fast locking, which already uses mmap or System V shared memory.

    - ---with-syslog
    -

    -Include support for using the SYSLOG utility for logging information generated from the Samba server. There are a couple of Samba configuration options that you can use to enable SYSLOG support; Chapter 4, Disk Shares , discusses these options.

    - ---with-netatalk
    -

    -Include experimental support for interoperating with the (Macintosh) Netatalk file server.

    - ---with-quotas
    -

    -Include disk-quota support.

    -Because each of these options is disabled by default, none of these features are essential to Samba. However, you may want to come back and build a modified version of Samba if you discover that you need one at a later time.

    -In addition, -Table 2.1 shows some other parameters that you can give the -configure script if you wish to store parts of the Samba distribution in different places, perhaps to make use of multiple disks or partitions. Note that the defaults sometimes refer to a prefix specified earlier in the table.


    - - - - - - - - - - - - - - -
    - -Table 2.1: Additional Configure Options
    -

    -Option

    		 -

    -Meaning

    		 -

    -Default

    -

    - ---prefix=directory

    		 -

    -Install architecture-independent files at the base directory specified.

    		 -

    - -/usr/local/samba

    -

    - ---eprefix=directory

    		 -

    -Install architecture-dependent files at the base directory specified.

    		 -

    - -/usr/local/samba

    -

    - ---bindir=directory

    		 -

    -Install user executables in the directory specified.

    		 -

    - - -eprefix/bin

    -

    - ---sbindir=directory

    		 -

    -Install administrator executables in the directory specified.

    		 -

    - - -eprefix/bin

    -

    - ---libexecdir=directory

    		 -

    -Install program executables in the directory specified.

    		 -

    - - -eprefix/libexec

    -

    - ---datadir=directory

    		 -

    -Install read-only architecture independent data in the directory specified.

    		 -

    - - -prefix/share

    -

    - ---libdir=directory

    		 -

    -Install program libraries in the directory specified.

    		 -

    - - -eprefix/lib

    -

    - ---includedir=directory

    		 -

    -Install package include files in the directory specified.

    		 -

    - - -prefix/include

    -

    - ---infodir=directory

    		 -

    -Install additional information files in the directory specified.

    		 -

    - - -prefix/info

    -

    - ---mandir=directory

    		 -

    -Install manual pages in the directory specified.

    		-

    - - -prefix/man

    -Again, before running the -configure script, it is important that you are the root user on the system. Otherwise, you may get a warning such as:

    -configure: warning: running as non-root will disable some tests

    -You don't want any test to be disabled when the Samba makefile is being created; this leaves the potential for errors down the road when compiling or running Samba on your system.

    -Here is a sample execution of the -configure script, which creates a Samba 2.0.4 makefile for the Linux platform. Note that you must run the configure script in the -source directory, and that several lines from the middle of the excerpt have been omitted:

    -# cd samba-2.0.4b/source/
-# ./configure | tee mylog
-
-loading cache ./config.cache
-checking for gcc... (cached) gcc
-checking whether the C compiler (gcc -O) works... yes
-checking whether the C compiler (gcc -O) is a cross-compiler... no
-checking whether we are using GNU C... (cached) yes
-checking whether gcc accepts -g... (cached) yes
-checking for a BSD compatible install... (cached) /usr/bin/install -c
-
-...(content omitted)...
-
-checking configure summary
-configure OK
-creating ./config.status
-creating include/stamp-h
-creating Makefile
-creating include/config.h

    -In general, any message from -configure that doesn't begin with the words -checking or -creating is an error; it often helps to redirect the output of the configure script to a file so you can quickly search for errors, as we did with the -tee command above. If there was an error during configuration, more detailed information about it can be found in the -config.log file, which is written to the local directory by the -configure script.

    -If the configuration works, you'll see a -checking -configure -summary message followed by a -configure -OK message and four or five file creation messages. So far, so good.... Next step: compiling.

    -
    -
    -
    - - -
    - -Previous: 2.1 Downloading the Samba Distribution - - - -Next: 2.3 Compiling and Installing Samba
    -2.1 Downloading the Samba Distribution - -Book Index -2.3 Compiling and Installing Samba
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch02_03.html b/docs/htmldocs/using_samba/ch02_03.html deleted file mode 100644 index c4313736d8..0000000000 --- a/docs/htmldocs/using_samba/ch02_03.html +++ /dev/null @@ -1,235 +0,0 @@ - - - -[Chapter 2] 2.3 Compiling and Installing Samba - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 2.2 Configuring Samba - - - -Chapter 2
    -Installing Samba on a Unix System    		 - -Next: 2.4 A Basic Samba Configuration File
     
    - -
    -
    -

    - -2.3 Compiling and Installing Samba

    At this point you should be ready to build the Samba executables. Compiling is also easy: in the -source directory, type -make on the command line. The -make utility will produce a stream of explanatory and success messages, beginning with:

    -Using FLAGS = -O -Iinclude ...

    -This build includes compiles for both -smbd and -nmbd, and ends in a linking command for -bin/make_ printerdef. For example, here is a sample make of Samba version 2.0.4 on a Linux server:

    # make
-Using FLAGS =  -O -Iinclude -I./include -I./ubiqx -I./smbwrapper  -DSMBLOGFILE="/usr/local/samba/var/log.smb" -DNMBLOGFILE="/usr/local/samba/var/log.nmb" -DCONFIGFILE="/usr/local/samba/lib/smb.conf" -DLMHOSTSFILE="/usr/local/samba/lib/lmhosts"   -DSWATDIR="/usr/local/samba/swat" -DSBINDIR="/usr/local/samba/bin" -DLOCKDIR="/usr/local/samba/var/locks" -DSMBRUN="/usr/local/samba/bin/smbrun" -DCODEPAGEDIR="/usr/local/samba/lib/codepages" -DDRIVERFILE="/usr/local/samba/lib/printers.def" -DBINDIR="/usr/local/samba/bin" -DHAVE_INCLUDES_H -DPASSWD_PROGRAM="/bin/passwd" -DSMB_PASSWD_FILE="/usr/local/samba/private/smbpasswd"
-Using FLAGS32 =  -O -Iinclude -I./include -I./ubiqx -I./smbwrapper  -DSMBLOGFILE="/usr/local/samba/var/log.smb" -DNMBLOGFILE="/usr/local/samba/var/log.nmb" -DCONFIGFILE="/usr/local/samba/lib/smb.conf" -DLMHOSTSFILE="/usr/local/samba/lib/lmhosts"   -DSWATDIR="/usr/local/samba/swat" -DSBINDIR="/usr/local/samba/bin" -DLOCKDIR="/usr/local/samba/var/locks" -DSMBRUN="/usr/local/samba/bin/smbrun" -DCODEPAGEDIR="/usr/local/samba/lib/codepages" -DDRIVERFILE="/usr/local/samba/lib/printers.def" -DBINDIR="/usr/local/samba/bin" -DHAVE_INCLUDES_H -DPASSWD_PROGRAM="/bin/passwd" -DSMB_PASSWD_FILE="/usr/local/samba/private/smbpasswd"
-Using LIBS = -lreadline -ldl  -lcrypt -lpam
-Compiling smbd/server.c
-Compiling smbd/files.c
-Compiling smbd/chgpasswd.c
-
-...(content omitted)...
-
-Compiling rpcclient/cmd_samr.c
-Compiling rpcclient/cmd_reg.c
-Compiling rpcclient/cmd_srvsvc.c
-Compiling rpcclient/cmd_netlogon.c
-Linking bin/rpcclient
-Compiling utils/smbpasswd.c
-Linking bin/smbpasswd
-Compiling utils/make_smbcodepage.c
-Linking bin/make_smbcodepage
-Compiling utils/nmblookup.c
-Linking bin/nmblookup
-Compiling utils/make_printerdef.c
-Linking bin/make_printerdef

    -If you encounter problems when compiling, check the Samba documentation to see if it is easily fixable. Another possibility is to search or post to the Samba mailing lists, which are given at the end of Chapter 9, and on the Samba home page. Most compilation issues are system specific and almost always easy to overcome.

    -Now that the files have been compiled, you can install them into the directories you identified with the command:

    # make install

    -If you happen to be upgrading, your old Samba files will be saved with the extension - .old, and you can go back to that previous version with the command -make -revert. After doing a -make -install, you should copy the -.old files (if they exist) to a new location or name. Otherwise, the next time you install Samba, the original -.old will be overwritten without warning and you could lose your earlier version. If you configured Samba to use the default locations for files, the new files will be installed in the directories listed in -Table 2.2. Remember that you need to perform the installation from an account that has write privileges on these target directories; this is typically the root account.


    - - - - - - - - - - - -
    - -Table 2.2: Samba Installation Directories
    -

    -Directory

    		 -

    -Description

    -

    - -/usr/local/samba

    		 -

    Main tree

    -

    - -/usr/local/samba/bin

    		 -

    -Binaries

    -

    - -/usr/local/samba/lib

    		 -

    - -smb.conf, -lmhosts, configuration files, etc.

    -

    - -/usr/local/samba/man

    		 -

    -Samba documentation

    -

    - -/usr/local/samba/private

    		 -

    -Samba encrypted password file

    -

    - -/usr/local/samba/swat

    		 -

    -SWAT files

    -

    - -/usr/local/samba/var

    		 -

    -Samba log files, lock files, browse list info, shared memory files, process ID files

    -Throughout the remainder of the book, we occasionally refer to the location of the main tree as - -samba_dir. In most configurations, this is the base directory of the installed Samba package: -/usr/local/samba.

    -

    - -WARNING: Watch out if you've made -/usr a read-only partition. You will want to put the logs, locks, and password files somewhere else.

    -Here is the installation that we performed on our machine. You can see that we used -/usr/local/samba as the base directory for the distribution (e.g., - -samba_dir):

    -# make install
-Using FLAGS = -O -Iinclude -I./include -I./ubiqx -I./smbwrapper  -DSMBLOGFILE="/usr/local/samba/var/log.smb" -DNMBLOGFILE="/usr/local/samba/var/log.nmb" -DCONFIGFILE="/usr/local/samba/lib/smb.conf" -
-
-...(content omitted)...
-
-The binaries are installed. You may restore the old binaries
-(if there were any) using the command "make revert". You may
-uninstall the binaries using the command "make uninstallbin"
-or "make uninstall" to uninstall binaries, man pages and shell
-scripts.
-
-...(content omitted)...
-
-============================================================
-The SWAT files have been installed. Remember to read the 
-README for information on enabling and using SWAT.
-============================================================

    -If the last message is about SWAT, you've successfully installed all the files. Congratulations! You now have Samba on your system!

    -

    - -2.3.1 Final Installation Steps

    There are a couple of final steps to perform. Specifically, add the Samba Web Administration Tool (SWAT) to the -/etc/services and -/etc/inetd.conf configuration files. SWAT runs as a daemon under -inetd and provides a forms-based editor in your web browser for creating and modifying SMB configuration files.

      -
    1. -

      - -To add SWAT, add the following line to the end of the -/etc/services file:

    -swat   901/tcp
      -
    1. -

      - -Add these lines to -/etc/inetd.conf. (Check your -inetd.conf manual page to see the exact format of the - inetd.conf file if it differs from the following example.) Don't forget to change the path to the SWAT binary if you installed it in a different location from the default -/usr/local/samba.

    -swat   stream  tcp  nowait.400  root  /usr/local/samba/bin/swat  swat

    -And that's pretty much it for the installation. Before you can start up Samba, however, you need to create a configuration file for it.

    -
    -
    -
    - - -
    - -Previous: 2.2 Configuring Samba - - - -Next: 2.4 A Basic Samba Configuration File
    -2.2 Configuring Samba - -Book Index -2.4 A Basic Samba Configuration File
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch02_04.html b/docs/htmldocs/using_samba/ch02_04.html deleted file mode 100644 index 608a1e2c40..0000000000 --- a/docs/htmldocs/using_samba/ch02_04.html +++ /dev/null @@ -1,186 +0,0 @@ - - - -[Chapter 2] 2.4 A Basic Samba Configuration File - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 2.3 Compiling and Installing Samba - - - -Chapter 2
    -Installing Samba on a Unix System    		 - -Next: 2.5 Starting the Samba Daemons
     
    - -
    -
    -

    - -2.4 A Basic Samba Configuration File

    -The key to configuring Samba is its lone configuration file: -smb.conf. This configuration file can be very simple or extremely complex, and the rest of this book is devoted to helping you get deeply personal with this file. For now, however, we'll show you how to set up a single file service, which will allow you to fire up the Samba daemons and see that everything is running as it should be. In later chapters, you will see how to configure Samba for more complicated and interesting tasks.

    -The installation process does not automatically create an -smb.conf configuration file, although several example files are included in the Samba distribution. To test the server software, though, we'll use the following file. It should be named -smb.conf and placed in the -/usr/local/samba/lib directory.[5]

    -
    -

    -[5] If you did not compile Samba, but instead downloaded a binary, check with the documentation for the package to find out where it expects the -smb.conf file. If Samba came preinstalled with your Unix system, there is probably already an -smb.conf file somewhere on your system.

    -[global]
-	workgroup = SIMPLE 
-[test] 
-	comment = For testing only, please
-	path = /export/samba/test
-	read only = no
-	guest ok = yes

    -This brief configuration file tells the Samba server to offer the directory -/export/samba/test on the server as an SMB/CIFS share called test. The server also becomes part of the named workgroup SIMPLE, which each of the clients must also be a part of. (Use your own workgroup here if you already know what it is.) We'll use the -[test] share in the next chapter to set up the Windows clients. For now, you can complete the setup by performing the following commands as root on your Unix server:

    # mkdir /export/samba/test
-# chmod 777 /export/samba/test

    -We should point out that in terms of system security, this is the worst setup possible. For the moment, however, we only wish to test Samba, so we'll leave security out of the picture. In addition, there are some encrypted password issues that we will encounter with Windows clients later on, so this setup will afford us the least amount of headaches.

    -If you are using Windows 98 or Windows NT Service Pack 3 or above, you must add the following entry to the -[global] section of the Samba configuration file: -encrypt passwords = yes. In addition, you must use the -smbpassword program (typically located in -/usr/local/samba/bin/) to reenter the username/password combinations of those users on the Unix server who should be able to access shares into Samba's encrypted client database. For example, if you wanted to allow Unix user -steve to access shares from an SMB client, you could type: -smbpassword -a steve. The first time a user is added, the program will output an error saying that the encrypted password database does not exist. Don't worry, it will then create the database for you. Make sure that the username/password combinations that you add to the encrypted database match the usernames and passwords that you intend to use on the Windows client side.

    -

    - -2.4.1 Using SWAT

    With Samba 2.0, creating a configuration file is even easier than writing a configuration file by hand. You can use your browser to connect to http://localhost:901, and log on as the root account, as shown in -Figure 2.1.

    - -Figure 2.1: SWAT login

    Figure 2.1

    -After logging in, press the GLOBALS button at the top of the screen. You should see the Global Variables page shown in -Figure 2.2.

    - -Figure 2.2: SWAT Global Variables page

    Figure 2.2

    -In this example, set the workgroup field to SIMPLE and the security field to USER. The only other option you need to change from the menu is one determining which system on the LAN resolves NetBIOS addresses; this system is called the -WINS server. At the very bottom of the page, set the wins support field to Yes, unless you already have a WINS server on your network. If you do, put the WINS server's IP address in the wins server field instead. Then return to the top and press the Commit Changes button to write the changes out to the -smb.conf file.

    - -Figure 2.3: SWAT Share Creation screen

    Figure 2.3

    -Next, press the Shares icon. You should see a page similar to -Figure 2.3. Choose Test in the field beside the Choose Share button. You will see the Share Parameters screen, as shown in -Figure 2.4. We added a comment to remind us that this is a test share in the -smb.conf file. SWAT has copies of all that information here.

    - -Figure 2.4: SWAT Share Parameters screen

    Figure 2.4

    -If you press the View button, SWAT shows you the following -smb.conf file:

    -# Samba config file created using SWAT
-# from localhost (127.0.0.1)
-# Date: 1998/11/27 15:42:40
-
-# Global parameters
-        workgroup = SIMPLE
-[test]
-        comment = For testing only, please
-        path = /export/samba/test
-        read only = no
-        guest ok = yes

    -Once this configuration file is completed, you can skip the next step because the output of SWAT is guaranteed to be syntactically correct.

    -

    - -2.4.2 Testing the Configuration File

    If you didn't use SWAT to create your configuration file, you should probably test it to ensure that it is syntactically correct. It may seem silly to run a test program against an eight-line configuration file, but it's good practice for the real ones that we'll be writing later on.

    -The test parser, -testparm, examines an -smb.conf file for syntax errors and reports any it finds along with a list of the services enabled on your machine. An example follows; you'll notice that in our haste to get the server running we mistyped -workgroup as -workgrp (the output is often lengthy, so we recommend capturing the last parts with the -tee command):

    -Load smb config files from smb.conf
-Unknown parameter encountered: "workgrp"
-Ignoring unknown parameter "workgrp"
-Processing section "[test]"
-Loaded services file OK.
-Press enter to see a dump of your service definitions
-# Global parameters
-[global]
-        workgroup = WORKGROUP
-        netbios name = 
-        netbios aliases = 
-        server string = Samba 2.0.5a
-        interfaces = 
-        bind interfaces only = No
-
-...(content omitted)...
-
-[test]
-        comment = For testing only, please               
-	path = /export/samba/test
-        read only = No
-        guest ok = Yes

    -The interesting parts are at the top and bottom. The top of the output will flag any syntax errors that you may have made, and the bottom lists the services that the server thinks it should offer. A word of advice: make sure that you and the server have the same expectations.

    -If everything looks good, then you are ready to fire up the server daemons!

    -
    -
    -
    - - -
    - -Previous: 2.3 Compiling and Installing Samba - - - -Next: 2.5 Starting the Samba Daemons
    -2.3 Compiling and Installing Samba - -Book Index -2.5 Starting the Samba Daemons
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch02_05.html b/docs/htmldocs/using_samba/ch02_05.html deleted file mode 100644 index 95d506e5e9..0000000000 --- a/docs/htmldocs/using_samba/ch02_05.html +++ /dev/null @@ -1,195 +0,0 @@ - - - -[Chapter 2] 2.5 Starting the Samba Daemons - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 2.4 A Basic Samba Configuration File - - - -Chapter 2
    -Installing Samba on a Unix System    		 - -Next: 2.6 Testing the Samba Daemons
     
    - -
    -
    -

    - -2.5 Starting the Samba Daemons

    -There are two Samba processes, -smbd and -nmbd, that need to be running for Samba to work correctly. There are three ways to start:

      -
    • -

      - -By hand

    • -

      - -As stand-alone daemons

    • -

      - -From -inetd

    -

    - -2.5.1 Starting the Daemons by Hand

    -If you're in a hurry, you can start the Samba daemons by hand. As root, simply enter the following commands:

    -# /usr/local/samba/bin/smbd -D
-# /usr/local/samba/bin/nmbd -D

    -At this point, Samba will be running on your system and will be ready to accept connections.

    -

    - -2.5.2 Stand-alone Daemons

    -To run the Samba processes as stand-alone daemons, you need to add the commands listed in the previous section to your standard Unix startup scripts. This varies depending on whether you have a BSD-style Unix system or a System V Unix.

    -

    - -2.5.2.1 BSD Unix

    -WIth a BSD-style Unix, you need to append the following code to the -rc.local file, which is typically found in the -/etc or -/etc/rc.d directories:

    -if [ -x /usr/local/samba/bin/smbd]; then
-	echo "Starting smbd..."
-	/usr/local/samba/bin/smbd -D
-	echo "Starting nmbd..."
-	/usr/local/samba/bin/nmbd -D
-fi

    -This code is very simple; it checks to see if the -smbd file has execute permissions on it, and if it does, it starts up each of the Samba daemons on system boot.

    -

    - -2.5.2.2 System V Unix

    -With System V, things can get a little more complex. System V typically uses scripts to start and stop daemons on the system. Hence, you need to instruct Samba how to operate when it starts and when it stops. You can modify the contents of the -/etc/rc.local directory and add something similar to the following program entitled -smb:

    -#!/bin/sh
-
-# Contains the "killproc" function on Red Hat Linux
-./etc/rc.d/init.d/functions
-
-PATH="/usr/local/samba/bin:$PATH"
-
-case $1 in 
-	'start')
-		echo "Starting smbd..."
-		smbd -D
-		echo "Starting nmbd..."
-		nmbd -D
-		;;
-	'stop')
-		echo "Stopping smbd and nmbd..."
-		killproc smbd
-		killproc nmbd
-		rm -f /usr/local/samba/var/locks/smbd.pid
-		rm -f /usr/local/samba/var/locks/nmbd.pid
-		;;
-	*)
-		echo "usage: smb {start|stop}"
-		;;
-esac

    -With this script, you can start and stop the SMB service with the following commands:

    -# /etc/rc.local/smb start
-Starting smbd...
-Starting nmbd...
-# /etc/rc.local/smb stop
-Stopping smbd and nmbd...
    -

    - -2.5.3 Starting From Inetd

    -The -inetd daemon is a Unix system's Internet "super daemon." It listens on TCP ports defined in -/etc/services and executes the appropriate program for each port, which is defined in -/etc/inetd.conf. The advantage of this scheme is that you can have a large number of daemons ready to answer queries, but they don't all have to be running. Instead, the -inetd daemon listens in places of all the others. The penalty is a small overhead cost of creating a new daemon process, and the fact that you need to edit two files rather than one to set things up. This is handy if you have only one or two users or your machine has too many daemons already. It's also easier to perform an upgrade without disturbing an existing connection.

    -If you wish to start from -inetd, first open -/etc/services in your text editor. If you don't already have them defined, add the following two lines:

    -netbios-ssn     139/tcp
-netbios-ns      137/udp

    -Next, edit -/etc/inetd.conf. Look for the following two lines and add them if they don't exist. If you already have -smbd and -nmbd lines in the file, edit them to point at the new -smbd and -nmbd you've installed. Your brand of Unix may use a slightly different syntax in this file; use the existing entries and the -inetd.conf manual page as a guide:

    -netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd 
-netbios-ns  dgram  udp wait   root /usr/local/samba/bin/nmbd nmbd

    -Finally, kill any -smbd or -nmbd processes and send the -inetd process a hangup (HUP) signal. (The -inetd daemon rereads its configuration file on a HUP signal.) To do this, use the -ps command to find its process ID, then signal it with the following command:

    -# kill -HUP process_id

    -After that, Samba should be up and running.

    -
    -
    -
    - - -
    - -Previous: 2.4 A Basic Samba Configuration File - - - -Next: 2.6 Testing the Samba Daemons
    -2.4 A Basic Samba Configuration File - -Book Index -2.6 Testing the Samba Daemons
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch02_06.html b/docs/htmldocs/using_samba/ch02_06.html deleted file mode 100644 index 46adba5d3b..0000000000 --- a/docs/htmldocs/using_samba/ch02_06.html +++ /dev/null @@ -1,108 +0,0 @@ - - - -[Chapter 2] 2.6 Testing the Samba Daemons - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 2.5 Starting the Samba Daemons - - - -Chapter 2
    -Installing Samba on a Unix System    		 - -Next: 3. Configuring Windows Clients
     
    - -
    -
    -

    - -2.6 Testing the Samba Daemons

    It's hard to believe, but we're nearly done with the Samba server setup. All that's left to do is to make sure that everything is working as we think it should. A convenient way to do this is to use the smbclient program to examine what the server is offering to the network. If everything is set up properly, you should be able to do the following:

    -# smbclient -U% -L localhost
-
-Added interface ip=192.168.220.100 bcast=192.168.220.255 nmask=255.255.255.0
-Domain=[SIMPLE] OS=[Unix] Server=[Samba 2.0.5a]
-
-        Sharename      Type      Comment
-        ---------      ----      -------
-        test           Disk      For testing only, please
-        IPC$           IPC       IPC Service (Samba 2.0.5a)
-
-        Server               	    Comment
-        ---------            	    -------
-        HYDRA                	    Samba 2.0.5a
-
-        Workgroup            	    Master
-        ---------            	    -------
-        SIMPLE               	    HYDRA

    -If there is a problem, don't panic! Try to start the daemons manually, and check the system output or the debug files at -/usr/local/samba/var/log.smb to see if you can determine what happened. If you think it may be a more serious problem, skip to Chapter 7, Printing and Name Resolution, for help on troubleshooting the Samba daemons.

    -If it worked, congratulations! You now have successfully set up the Samba server with a disk share. It's a simple one, but we can use it to set up and test the Windows 95 and NT clients in the next chapter. Then we will start making it more interesting by adding services such as home directories, printers, and security, and seeing how to integrate the server into a larger Windows domain.

    -
    -
    -
    - - -
    - -Previous: 2.5 Starting the Samba Daemons - - - -Next: 3. Configuring Windows Clients
    -2.5 Starting the Samba Daemons - -Book Index -3. Configuring Windows Clients
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch03_01.html b/docs/htmldocs/using_samba/ch03_01.html deleted file mode 100644 index 915befad0f..0000000000 --- a/docs/htmldocs/using_samba/ch03_01.html +++ /dev/null @@ -1,277 +0,0 @@ - - - -[Chapter 3] Configuring Windows Clients - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 2.6 Testing the Samba Daemons - - -Chapter 3 - -Next: 3.2 Setting Up Windows NT 4.0 Computers
     
    - -
    -
    -

    - -3. Configuring Windows Clients

    -

    - -Contents:
    - -Setting Up Windows 95/98 Computers
    - -Setting Up Windows NT 4.0 Computers
    - -An Introduction to SMB/CIFS

    -

    You'll be glad to know that configuring Windows to use your new Samba server is quite simple. SMB is Microsoft's native language for resource sharing on a local area network, so much of the installation and setup on the Windows client side has been taken care of already. The primary issues that we will cover in this chapter involve communication and coordination between Windows and Unix, two completely different operating systems.

    -Samba uses TCP/IP to talk to its clients on the network. If you aren't already using TCP/IP on your Windows computers, this chapter will show you how to install it. Then you'll need to configure your Windows machines to operate on a TCP/IP network. Once these two requirements have been taken care of, we can show how to access a shared disk on the Samba server.

    -This chapter is divided into three sections. The first section covers setting up Windows 95/98 computers while the second covers Windows NT 4.0 machines. The final section provides some prerequisite information on how SMB connections are made from Windows clients and servers, which is useful as we move into the later chapters of the book.

    -

    - - -3.1 Setting Up Windows 95/98 Computers

    Unfortunately, Windows 95/98 wasn't designed for a PC to have more than one user; that concept is more inherent to a Unix operating system or Windows NT. However, Windows 95/98 does have -limited support for multiple users: if you tell it, the operating system will keep a separate profile (desktop layout) and password file for each user. This is a far cry from true multiuser security. In other words, Windows 95/98 won't try to keep one user from destroying the work of another on the local hard drive like Unix, but profiles are a place to start.

    -

    - -3.1.1 Accounts and Passwords

    The first thing we need to do is to tell Windows to keep user profiles separate, and to collect usernames and passwords to authenticate anyone trying to access a Samba share. We do so via the Password settings in the Control Panel. If you are not familiar with the Windows Control Panel, you can access it by choosing the Settings menu item from the pop-up menu of the Start button in the lower-left corner of the screen. Alternatively, you'll find it as a folder under the icon in the upper-left corner that represents your computer and is typically labeled My Computer.

    -After selecting the Passwords icon in the Control Panel, click on the User Profiles tab on the far right. You should see the dialog box shown in -Figure 3.1. Then click the lower of the two radio buttons that starts "Users can customize their preferences...." This causes Windows to store a separate profile for each user, and saves the username and password you provide, which it will use later when it connects to an SMB/CIFS server. Finally, check -both the options under the User Profile Settings border, as shown in the figure.

    - -Figure 3.1: The Passwords Properties panel

    Figure 3.1

    -The next step is to select the Change Passwords tab on the left side of the dialog box. In order for Samba to allow you access to its shares, the username and password you give to Windows must match the account and password on the Samba server. If you don't have this tab in your dialog box, don't worry; it's probably because you haven't given yourself a Windows username and password yet. Simply click the OK button at the bottom and respond Yes when Windows asks to reboot. Then, skip down to the section entitled -Section 3.1.1.2, Logging in for the first time.

    -

    - -3.1.1.1 Changing the Windows password

    After selecting the Change Passwords tab, the dialog box in -Figure 3.2 will appear.

    - -Figure 3.2: The Change Passwords tab

    Figure 3.2

    -Select the Change Windows Password button. The Change Windows Password dialog box should appear, as shown in -Figure 3.3. From here, you can change your password to match the password of the account on the Samba server through which you intend to log in.

    - -Figure 3.3: The Change Windows Password dialog box

    Figure 3.3
    -

    - -3.1.1.2 Logging in for the first time

    If you didn't have a Change Passwords tab in the Passwords Properties window, then after Windows has finished rebooting, it will ask you to log in with a username and a password. Give yourself the same username and password that you have on the Samba server. After confirming your new username and password, or if you already have one, Windows should ask you if you want to have a profile, using the dialog shown in -Figure 3.4.

    - -Figure 3.4: Windows Networking profiles

    Figure 3.4

    -Answer Yes, upon which Windows will create a separate profile and password file for you and save a copy of your password in the file. Now when you connect to Samba, Windows will send its password, which will be used to authenticate you for each share. We won't worry about profiles for the moment; we'll cover them in Chapter 6, Users, Security, and Domains. We should point out, however, that there is a small security risk: someone can steal the password file and decrypt the passwords because it's weakly encrypted. Unfortunately, there isn't a solution to this with Windows 95/98. In Windows 2000 (NT 5.0), the password encryption should be replaced with a much better algorithm.

    -

    - -3.1.2 Setting Up the Network

    The next thing we need to do is make sure we have the TCP/IP networking protocol set up correctly. To do this, double-click on the Network icon in the Control Panel. You should see the network configuration dialog box, as shown in -Figure 3.5.

    - -Figure 3.5: The Windows 95/98 Network panel

    Figure 3.5

    -Microsoft networking works by binding specific protocols, such as IPX or TCP/IP, to a specific hardware device, such as an Ethernet card or a dialup connection. By routing a protocol through a hardware device, the machine can act as a client or server for a particular type of network. For Samba, we are interested in binding the TCP/IP protocol through a networking device, making the machine a client for Microsoft networks. Thus, when the dialog box appears, you should see at least the Client for Microsoft Networks component installed on the machine, and hopefully a networking device (preferably an Ethernet card) bound to the TCP/IP protocol. If there is only one networking hardware device, you'll see the TCP/IP protocol listed below that device. If it appears similar to -Figure 3.5, the protocol is bound to the device.

    -You may also see "File and printer sharing for Microsoft Networks," which is useful. In addition, you might see NetBEUI or Novell Networking, which are standard with Windows installations but undesirable when TCP/IP is running. Remove NetBEUI if you possibly can - it's unnecessary and makes debugging Windows browsing difficult. If you don't have any Novell servers on your network, you can remove Novell (IPX/SPX) as well.

    -

    - -3.1.2.1 Adding TCP/IP

    If you don't see TCP/IP listed at all, you'll need to install the protocol. If you already have TCP/IP, skip this section, and continue with the section -Section 3.1.3, Setting Your Name and Workgroup, later in this chapter.

    -Installing TCP/IP isn't difficult since Microsoft distributes its own version of TCP/IP for free on their installation CD-ROM. You can add the protocol by clicking on the Add button below the component window. Indicate that you wish to add a specific protocol by selecting Protocol and clicking Add... on the following dialog box, which should look similar to -Figure 3.6.

    - -Figure 3.6: Selecting a protocol to install

    Figure 3.6

    -After that, select the protocol TCP/IP from manufacturer Microsoft, as shown in -Figure 3.7, then click OK. After doing so, you will be returned to the network dialog. Click OK there to close the dialog box, upon which Windows will install the necessary components from disk and reboot the machine.

    - -Figure 3.7: Selecting a protocol to install

    Figure 3.7
    -

    - -3.1.2.2 Configuring TCP/IP

    If you have more than one networking device (for example, both an Ethernet card and a dialup networking modem), each appropriate hardware device should be "linked" to the TCP/IP protocol with an arrow, as shown in -Figure 3.8. Select the TCP/IP protocol linked to the networking device that will be accessing the Samba network. When it is highlighted, click the Properties button.

    - -Figure 3.8: Selecting the correct TCP/IP protocol

    Figure 3.8

    -After doing so, the TCP/IP Properties panel for that device is displayed, as shown in -Figure 3.9.

    - -Figure 3.9: STCP/IP Properties panel

    Figure 3.9

    -There are seven tabs near the top of this panel, and you will need to configure four of them:

      -
    • -

      - -IP address

    • -

      - -DNS configuration

    • -

      - -WINS configuration

    • -

      - -Bindings

    -

    - -3.1.2.3 IP Address tab

    -The IP Address tab is shown in -Figure 3.9. Press the "Specify an IP address" radio button and enter the client's address and subnet mask in the space provided. You or your network manager should have selected an address for the machine. The values should place the computer on the same subnet as the Samba server. For example, if the server's address is 192.168.236.86, and its network mask 255.255.255.0, you might use address 192.168.236.10 (if it is available) for the Windows 98 computer, along with the same netmask as the server. If you already use DHCP on your network to provide IP addresses to Windows machines, select the "Obtain an IP address automatically" button.

    -

    - -3.1.2.4 DNS Configuration tab

    Domain Name Service (DNS) is responsible for translating Internet computer names such as -hobbes.example.com into machine-readable IP addresses such as 192.168.236.10. There are two ways to accomplish this on a Windows 98 machine: you can specify a server to do the translation for you or you can keep a local list of name/address pairs to refer to.

    -Networks that are connected to the Internet typically use a server, since the hosts files required would otherwise be huge. For an unconnected LAN, the list of possible hosts is small and well-known and might be kept on a Unix machine in the -/etc/hosts file. If you are in doubt as to whether a DNS server is being used, or what its address might be, look at the file -/etc/resolv.conf on your Unix servers. Any machine using DNS will have this file, which looks like:

    -#resolv.conf
-domain example.com
-nameserver 127.0.0.1
-nameserver 192.168.236.20

    -In the example shown, the second -nameserver line in the list contains the IP address of another machine on the local network: 192.168.236.20. It's a good candidate for a DNS server.[1]

    -
    -

    -[1] We can disqualify the other address because every Unix machine has a localhost address of 127.0.0.1 whether it is connected to a network or not. This address is required for some system tools to operate correctly.

    -You must type the correct IP address of one or more DNS servers (note that you -cannot use its Internet name, such as -dns.oreilly.com) into the appropriate field in -Figure 3.10. Be sure not to use 127.0.0.1 - that will never be the correct DNS server address!

    -Try to select addresses on your own network. Any name servers listed in -/etc/resolv.conf should work, but you'll get better performance by using a server nearby. (If you don't find -/etc/resolv.conf files on your Unix machines, just disable DNS until you can find the address of at least one DNS server.) Let's assume you only have one DNS server, and its address is 192.168.236.20. Click the Enable DNS radio button, as shown in -Figure 3.10, and add the server's address to the top DNS Server Search Order field.

    - -Figure 3.10: The DNS Configuration tab

    Figure 3.10

    -Also, provide the name of the Windows 95/98 machine and the Internet domain you're in. You can safely ignore the Domain Suffix Search Order field for anything related to Samba.

    -

    - -3.1.2.5 WINS Configuration tab

    WINS is the Windows Internet Name Service, its version of a NetBIOS name server. If you've enabled WINS on Samba, you must tell Windows the Samba server's address. If you are using WINS servers that are entirely Windows NT, enter each of them here as well. The dialog box shown after selecting the WINS Configuration tab is shown in -Figure 3.11.

    - -Figure 3.11: The WINS Configuration tab

    Figure 3.11
    -

    - -WARNING: Do -not mix a Samba WINS server and a Windows NT server as a primary/backup combination in the WINS dialog. Because the two cannot replicate their databases, this will cause name resolution to perform incorrectly.

    -From here, select Enable WINS Resolution and enter the WINS server's address in the space provided, then press Add. Do not enter anything in the Scope ID field.

    -

    - -3.1.2.6 Hosts files

    If you do not have either DNS or WINS, and you don't wish to use broadcast resolution, you'll need to provide a table of IP addresses and hostnames, in the standard Unix -/etc/hosts format. On a Windows machine, this goes in \WINDOWS\HOSTS under whichever drive you installed Windows on (typically C:\). A sample host file follows:

    -# 127.0.0.1        localhost
-192.168.236.1      escrime.example.com 	escrime
-192.168.236.2      riposte.example.com 	riposte
-192.168.236.3      wizzin.example.com 	wizzin
-192.168.236.4      touche.example.com 	touche
-192.168.236.10     hobbes.example.com 	hobbes

    -You can copy this file directly from any of your Unix machines' -/etc/hosts; the format is identical. However, -you should only use hosts files in Windows as a last resort for name resolution.

    -

    - -3.1.2.7 Check the bindings

    -The final tab to look at is Bindings, as shown in -Figure 3.12.

    - -Figure 3.12: The Bindings tab

    Figure 3.12

    -You should have a check beside Client for Microsoft Networks, indicating that it's using TCP/IP. If you have "File and printer sharing for Microsoft Networks" in the dialog, it should also be checked, as shown in the figure.

    -

    - -3.1.3 Setting Your Name and Workgroup

    Finally, press the OK button in the TCP/IP configuration panel, and you'll be taken back to the Network Configuration screen. Then select the Identification tab, which will take you to the dialog box shown in -Figure 3.13.

    - -Figure 3.13: The Identification tab

    Figure 3.13

    -Here, for the second time, set your machine's name. This time, instead of your DNS hostname and domain, you're setting your NetBIOS name. However, it is best to make this the -same as your hostname. Try not to make a spelling mistake: it can be very confusing to configure a machine if TCP thinks it's -fred and SMB thinks its -ferd !

    -You also set your workgroup name here. In our case, it's SIMPLE, but if you used a different one in Chapter 2, Installing Samba on a Unix System, when creating the Samba configuration file, use that here as well. Try to avoid calling it WORKGROUP or you'll be in the same workgroup as every unconfigured (or ill-configured) machine in the world.

    -

    - -3.1.4 Accessing the Samba Server

    Click on the OK button to complete the configuration; you will need to reboot in order for your changes to take effect.

    -Now for the big moment. Your Samba server is running, and you have set up your Windows 95/98 client to communicate with it. After rebooting, log in and double-click the Network Neighborhood icon on the desktop. You should see your Samba server listed as a member of the workgroup, as shown in -Figure 3.14.

    - -Figure 3.14: Windows Network Neighborhood

    Figure 3.14

    -Double-clicking the server name will show the resources that the server is offering to the network, as shown in -Figure 3.15 (in this case a printer and the -test directory).

    - -Figure 3.15: Shares on Server

    Figure 3.15
    -

    - -WARNING: If you are presented with a dialog requesting the password for a user -IPC$, then Samba did not accept the password that was sent from the client. In this case, the username and the password that were created on the client side -must match the username/password combination on the Samba server. If you are using Windows 98 or Windows NT Service Pack 3 or above, this is probably because the client is sending encrypted passwords instead of plaintext passwords. You can remedy this situation by performing two steps on the Samba server. First, add the following entry to the -[global] section of your Samba configuration file: -encrypt password=yes. Second, find the -smbpasswd program on the samba server (it is located in -/usr/local/samba/bin by default) and use it to add an entry to Samba's encrypted password database. For example, to add user -steve to Samba's encrypted password database, type - -smbpasswd -a steve. The first time you enter this password, the program will output an error message indicating that the password database does not exist; it will then create the database, which is typically stored in -/usr/local/samba/private/smbpasswd.

    -If you don't see the server listed, start Windows Explorer (not Internet Explorer!) and select Map Network Drive from the Tools menu. This will give you a dialog box into which you can type the name of your server and the share -test in the Windows UNC format: \\server\test, like we did in the first chapter. This should attempt to contact the Samba server and its temporary share. If things still aren't right, go to Chapter 9, Troubleshooting Samba, for troubleshooting assistance.

    -
    -
    -
    - - -
    - -Previous: 2.6 Testing the Samba Daemons - - - -Next: 3.2 Setting Up Windows NT 4.0 Computers
    -2.6 Testing the Samba Daemons - -Book Index -3.2 Setting Up Windows NT 4.0 Computers
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch03_02.html b/docs/htmldocs/using_samba/ch03_02.html deleted file mode 100644 index fd87daac72..0000000000 --- a/docs/htmldocs/using_samba/ch03_02.html +++ /dev/null @@ -1,260 +0,0 @@ - - - -[Chapter 3] 3.2 Setting Up Windows NT 4.0 Computers - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 3.1 Setting Up Windows 95/98 Computers - - - -Chapter 3
    -Configuring Windows Clients    		 - -Next: 3.3 An Introduction to SMB/CIFS
     
    - -
    -
    -

    - -3.2 Setting Up Windows NT 4.0 Computers

    Configuring Windows NT is a little different than configuring Windows 95/98. In order to use Samba with Windows NT, you will need both the Workstation service and the TCP/IP protocol. Both come standard with NT, but we'll work through installing and configuring them because they may not be configured correctly.

    -There are six basic steps:

      -
    1. -

      - -Assign the machine a name.

    2. -

      - -Install the Workstation service.

    3. -

      - -Install the TCP/IP protocol.

    4. -

      - -Set the machine's name and IP address.

    5. -

      - -Configure the DNS and WINS name services.

    6. -

      - -Bind the protocol and service together.

    -

    - -3.2.1 Basic Configuration

    This section presents an outline of the steps to follow for getting Windows NT to cooperate with Samba. If you need more details on Windows NT network administration, refer to Craig Hunt and Robert Bruce Thompsom's -Windows NT TCP/IP Network Administration (O'Reilly), an excellent guide. You should perform these steps as the "Administrator" user.

    -

    - -3.2.1.1 Name the machine

    The first thing you need to do is to give the machine a NetBIOS name. From the Control Panel, double click on the Network icon. This will take you to the Network dialog box for the machine. The first tab in this dialog box should be the Identification tab, as illustrated in -Figure 3.16.

    - -Figure 3.16: Network panel Identification tab

    Figure 3.16

    -Here, you need to identify your machine with a name (we use the name Artish here) and change the default workgroup to the one you specified in the -smb.conf file of your Samba server. In this case, the workgroup name is SIMPLE. However, you cannot edit either name here (as you could in Windows 95/98), but instead must use the Change button below the two text fields. Pressing this button raises an Identification Changes dialog box, where you can reset the workgroup and the machine name, as shown in -Figure 3.17.

    - -Figure 3.17: Changing the identification

    Figure 3.17

    A word of warning: you will have to set the machine name again later while configuring TCP/IP, so be sure that the two names match. The name you set here is the NetBIOS name. You're allowed to make it different from the TCP/IP hostname, but doing so is usually not a good thing. Don't worry that Windows NT forces the computer name and the workgroup to be all capital letters; it's smart enough to figure out what you mean when it connects to the network.

    -

    - -3.2.1.2 Installing the TCP/IP protocol

    Next, select the Protocols tab in the Network dialog box, and look to see if you have the TCP/IP protocol installed, as shown in -Figure 3.18.

    - -Figure 3.18: The Protocols tab

    Figure 3.18

    -If the protocol is not installed, you need to add it. Press the Add button, which will display the Select Network Protocol dialog box shown in -Figure 3.19. Unlike Windows 95/98, you should immediately see the TCP/IP protocol as one of the last protocols listed.

    - -Figure 3.19: Select Network Protocol dialog box

    Figure 3.19

    -Select TCP/IP - as the protocol and confirm it. If possible, install only the TCP/IP protocol. You usually do not want NetBEUI installed because this causes the machine to look for services under two different protocols, only one of which is likely in use.[2]

    -
    -

    -[2] A common occurrence: after looking at the unused protocol for a while, the machine will time out and try the good one. This fruitless searching gives you terrible performance and mysterious delays.

    -

    - -3.2.1.3 Installing the Workstation service

    After installing TCP/IP, press the Services tab in the Network panel and check that you have a Workstation service, as shown at the end of the list in -Figure 3.20.

    - -Figure 3.20: Network Services panel dialog box

    Figure 3.20

    -This service is actually the Microsoft Networking Client, which allows the machine to access SMB services. The Workstation service is mandatory. The service is installed by default on both Windows NT Workstation 4.0 and Server 4.0. If it's not there, you can install it much like TCP/IP. In this case you need to press the Add button and then select Workstation Service, as shown in -Figure 3.21.

    - -Figure 3.21: Select Network Service dialog box

    Figure 3.21
    -

    - -3.2.2 Configuring TCP/IP

    After you've installed the Workstation service, return to the Protocols tab and select the TCP/IP Protocol entry in the window. Then click the Properties button below the window. The Microsoft TCP/IP Protocol panel will be displayed. There are five tabs on the Windows NT panel, and (like Windows 95/98) you will need to work on three of them:

      -
    • -

      - -IP address

    • -

      - -DNS

    • -

      - -WINS address

    -

    - -3.2.2.1 IP Address tab

    The IP Address tab is shown in -Figure 3.22.

    - -Figure 3.22: Microsoft TCP/IP Properties for Windows NT

    Figure 3.22

    Select the "Specify an IP address" radio button and enter the computer's address and subnet mask in the space provided for the proper adapter (Ethernet card). You or your network manager should have selected an address for the client on the same subnet (LAN) as the Samba server. For example, if the server's address is 192.168.236.86 and its network mask 255.255.255.0, you might use the address 192.168.236.10, if it is available, for the NT workstation, along with the same netmask. If you use DHCP on your network, select the "Obtain an IP Address from a DHCP server" button.

    -If you don't have an IP address to use, and you are on a network by yourself, steal ours, as the 192.168. -x.x subnet is specifically reserved by the Internic for LANs. If you're not by yourself, see your system administrator for some available addresses on your network.

    -The gateway field refers to a machine typically known as a -router. If you have routers connecting multiple networks, you should put in the IP address of the one on your subnet.

    -

    - -3.2.2.2 DNS tab

    Next we go to the tab for DNS, as shown in -Figure 3.23. This brings up the DNS panel.

    - -Figure 3.23: The DNS panel

    Figure 3.23

    -The Domain Name System (DNS) is responsible for translating human-readable computer names such as -atrish.example.com into IP addresses such as 192.168.236.10. There are two ways to accomplish this on a NT machine. First, you can specify a DNS server to do the translation for you, or you can keep a local list of name/address pairs for your workstation to refer to.

    -For a LAN that's not on the Internet, the list of possible hosts is typically small and well known, and may be kept in a file locally. Networks that are connected to the Internet typically use DNS service since it isn't possible to guess ahead of time what addresses you might be accessing out on the net. If you are in doubt as to whether a DNS server is being used, or what its address might be, look at the file -/etc/resolv.conf on your Samba server: any machine using DNS will have this file. It looks like the following:

    -#resolv.conf 
-domain example.com 
-nameserver 127.0.0.1 
-nameserver 192.168.236.20

    -In this example, the first nameserver in the list is 127.0.0.1, which indicates that the Samba server is also a DNS server for this LAN.[3] In that case, you would use its network IP address (not 127.0.0.1, its localhost address) when filling in the DNS Configuration dialog box. Otherwise, use the other addresses you find in the lines beginning with -nameserver. Try to select ones on your own network. Any name servers listed in -/etc/resolv.conf should work, but you'll get better performance by using a server nearby.

    -
    -

    -[3] The address 127.0.0.1 is known as the -localhost address, and always refers to itself. For example, if you type -ping 127.0.0.1 on a Unix server, you should always get a response, as you're pinging the host itself.

    -Finally, enter the machine name once more, making sure that it's the same one listed in the Identification tab of the Network dialog box (before the NetBIOS name). Also, enter the DNS domain on which this machine resides. For example, if your workstation has a domain name such as -example.com, enter it here. You can safely ignore the other options.

    -

    - -3.2.2.3 WINS Address tab

    If you are not using a DNS server, you still need a way of translating NetBIOS names to addresses and back again. We recommend that you configure both DNS and WINS; NT has a preference for WINS and WINS can use DNS as a fallback if it cannot resolve any machine address. The WINS Address tab is shown in -Figure 3.24.

    - -Figure 3.24: The WINS Address tab

    Figure 3.24

    -If you have a WINS server, enter its address in the space marked Primary WINS Server. If your Samba server is providing WINS service (in other words, you have the line -wins -service -= -yes in the -smb.conf file of your Samba server), provide the Samba server's IP address here. Otherwise, provide the address of another WINS server on your network.

    -You probably noticed that there is a field here for the adaptor; this field must specify the Ethernet adaptor that you're running TCP/IP on so that WINS will provide name service on the correct network. If you have both a LAN and a dialup adaptor, make sure you have the LAN's adaptor here.

    -Finally, select the "Enable DNS for Windows Resolution" checkbox, so WINS will try DNS as a fallback if it can't find a name. You can safely ignore the other options.

    -

    - -3.2.2.4 Hosts files

    If you don't have either DNS or WINS, and you don't wish to use broadcast name resolution, you'll need to provide a table of IP addresses and hosts names, in standard Unix -/etc/hosts format. We recommend against this because maintenance of this file on any dynamic network is troublesome, but we will explain it just the same. The Windows host file should appear in the -\WINDOWS\HOSTS directory of whatever local drive Windows is installed on. A sample follows:

    -127.0.0.1        localhost
-192.168.236.1    escrime    escrime.example.com 
-192.168.236.2    riposte    riposte.example.com 
-192.168.236.3    wizzin     wizzin.example.com 
-192.168.236.4    touche     touche.example.com 
-192.168.236.5    gurgi      gurgi.example.com 
-192.168.236.6    jessiac    jessiac.example.com 
-192.168.236.7    skyline    skyline.example.com

    -If you wish, you can copy the contents directly from the Samba server's - /etc/hosts. The format is identical. This file will then serve the same purpose as the hosts file on the Unix server. Again, -hosts files on Windows should only be used as a last resort.

    -

    - -3.2.2.5 Bindings

    -The term -bindings is a way of saying "connected together at configuration time." It means that the TCP/IP protocol will channel through the Ethernet card (instead of, say, a dialup connection), and is actually connected properly. If you return to the Network dialog box and set the Show field to "all services" and click on all the + buttons in the tree, you should see a display similar to -Figure 3.25.

    - -Figure 3.25: Service bindings

    Figure 3.25

    -This means that the Workstation, Server, and NetBIOS interface services are connected to the WINS client. This is the correct binding for Microsoft TCP/IP.

    -

    - -3.2.3 Connecting to the Samba Server

    You can safely leave the default values for the remainder of the tabs in the Network dialog box. Click on the OK button to complete the configuration. Once the proper files are loaded (if any), you will need to reboot in order for your changes to take effect.

    -Now for the big moment. Your Samba server is running and you have set up your NT client to communicate with it. After the machine reboots, login and double-click the Network Neighborhood icon on the desktop, and you should see your Samba server listed as a member of the workgroup, as shown in -Figure 3.26.

    - -Figure 3.26: Windows NT Network Neighborhood

    Figure 3.26

    Double-clicking the server name will show the resources that the server is offering to the network, as shown in -Figure 3.27. In this case, the test and the default printer are offered to the Window NT workstation. For more information, see the warning under the "Accessing the Samba Server" section, earlier in this chapter.

    - -Figure 3.27: Server's shares

    Figure 3.27
    -

    - -WARNING: If you are presented with a dialog requesting the password for a user -IPC$, then Samba did not accept the password that was sent from the client. In this case, the username and the password that were created on the client side -must match the username/password combination on the Samba server. If you are using Windows 98 or Windows NT Service Pack 3 or above, this is probably because the client is sending encrypted passwords instead of plaintext passwords. You can remedy this situation by performing two steps on the Samba server. First, add the following entry to the -[global] section of your Samba configuration file: -encrypt password=yes. Second, find the -smbpasswd program on the samba server (it is located in -/usr/local/samba/bin by default) and use it to add an entry to Samba's encrypted password database. For example, to add user -steve to Samba's encrypted password database, type - -smbpasswd -a steve. The first time you enter this password, the program will output an error message indicating that the password database does not exist; it will then create the database, which is typically stored in -/usr/local/samba/private/smbpasswd.

    -If you don't see the server listed, don't panic. Start the Windows NT Explorer (not Internet Explorer!) and select Map Network Drive from the Tools menu. A dialog box appears that allows you to type the name of your server and its share directory in Windows format. For example, you would enter -\\server\temp if your server happened to be named "server." If things still aren't right, go directly to the section "The Fault Tree" in Chapter 9, to see if you can troubleshoot what is wrong with the network.

    -If it works, congratulations! Try writing to the server and sending data to the network printer. You will be pleasantly surprised how seamlessly everything works! Now that you've finished setting up the Samba server and its clients, we can starting talking about how Samba works and how to configure it to your liking.

    -
    -
    -
    - - -
    - -Previous: 3.1 Setting Up Windows 95/98 Computers - - - -Next: 3.3 An Introduction to SMB/CIFS
    -3.1 Setting Up Windows 95/98 Computers - -Book Index -3.3 An Introduction to SMB/CIFS
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch03_03.html b/docs/htmldocs/using_samba/ch03_03.html deleted file mode 100644 index d3efd007aa..0000000000 --- a/docs/htmldocs/using_samba/ch03_03.html +++ /dev/null @@ -1,579 +0,0 @@ - - - -[Chapter 3] 3.3 An Introduction to SMB/CIFS - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 3.2 Setting Up Windows NT 4.0 Computers - - - -Chapter 3
    -Configuring Windows Clients    		 - -Next: 4. Disk Shares
     
    - -
    -
    -

    - -3.3 An Introduction to SMB/CIFS

    We'll wrap up this chapter with a short tutorial on SMB/CIFS. SMB/CIFS is the protocol that Windows 95/98 and NT machines use to communicate with the Samba server and each other. At a high level, the SMB protocol suite is relatively simple. It includes commands for all of the file and print operations that you might do on a local disk or printer, such as:

      -
    • -

      - - Opening and closing a file

    • -

      - - Creating and deleting files and directories

    • -

      - - Reading and writing a file

    • -

      - - Searching for files

    • -

      - - Queueing and dequeueing files to a print spool

    -Each of these operations can be encoded into an SMB message and transmitted to and from a server. The original name SMB comes from their data format: these are versions of the standard DOS system-call data structures, or -Server Message Blocks, redesigned for transmitting to another machine across a network.

    -

    - -3.3.1 SMB Format

    Richard Sharpe of the Samba team defines SMB as a "request-response" protocol.[4] In effect, this means that a client sends an SMB request to a server, and the server sends an SMB response back to the client. Rarely does a server send a message that is not in response to a client.

    -
    -

    -[4] See -http://anu.samba.org/cifs/docs/what-is-smb.html for Richard's excellent summary of SMB.

    -An SMB message is not as complex as you might think. Let's take a closer look at the internal structure of such a message. It can be broken down into two parts: the -header, which is a fixed size, and the -command string, whose size can vary dramatically based on the contents of the message.

    -

    - -3.3.1.1 SMB header format

    - -Table 3.1 shows the format of an SMB header. SMB commands are not required to use all the fields in the SMB header. For example, when a client first attempts to connect to a server, it does not yet have a tree identifier (TID) value - one is assigned after it successfully connects - so a null TID (0xFFFF) is placed in its header field. Other fields may be padded with zeros when not used.

    -The fields of the SMB header are listed in -Table 3.1.


    - - - - - - - - - - - - - - - -
    - -Table 3.1: SMB Header Fields
    -

    -Field

    		 -

    -Size (bytes)

    		 -

    -Description

    -

    - -0xFF 'SMB'

    		 -

    - -1

    		 -

    Protocol identifier

    -

    - -COM

    		 -

    - -1

    		 -

    -Command code, from 0x00 to 0xFF

    -

    - -RCLS

    		 -

    - -1

    		 -

    -Error class

    -

    - -REH

    		 -

    - -1

    		 -

    -Reserved

    -

    - -ERR

    		 -

    - -2

    		 -

    -Error code

    -

    - -REB

    		 -

    - -1

    		 -

    -Reserved

    -

    - -RES

    		 -

    - -14

    		 -

    -Reserved

    -

    - -TID

    		 -

    - -2

    		 -

    -Tree identifier; a unique ID for a resource in use by client

    -

    - -PID

    		 -

    - -2

    		 -

    -Caller process ID

    -

    - -UID

    		 -

    - -2

    		 -

    -User identifier

    -

    - -MID

    		 -

    - -2

    		 -

    -Multiplex identifier; used to route requests inside a process

    -

    - -3.3.1.2 SMB command format

    - -Immediately after the header is a variable number of bytes that constitute an SMB command or reply. Each command, such as Open File (COM field identifier: SMBopen) or Get Print Queue (SMBsplretq), has its own set of parameters and data. Like the SMB header fields, not all of the command fields need to be filled, depending on the specific command. For example, the Get Server Attributes (SMBdskattr) command sets the WCT and BCC fields to zero. The fields of the command segment are shown in -Table 3.2.


    - - - - - - - - -
    - -Table 3.2: SMB Command Contents
    -

    -Field

    		 -

    -Size in Bytes

    		 -

    -Description

    -

    - -WCT

    		 -

    - -1

    		 -

    - -Word count

    -

    - -VWV

    		 -

    -Variable

    		 -

    -Parameter words (size given by WCT)

    -

    - -BCC

    		 -

    - -2

    		 -

    -Parameter byte count

    -

    - -DATA

    		 -

    -Variable

    		 -

    -Data (size given by BCC)

    -Don't worry if you don't understand each of these fields; they are not necessary for using Samba at an administrator level. However, they do come in handy when debugging system messages. We will show you some of the more common SMB messages that clients and servers send using a modified version of -tcpdump later in this section. (If you would like an SMB sniffer with a graphical interface, try "ethereal," which uses the GTK libraries; see the Samba homepage for more information on this tool.)

    -If you would like more information on each of the commands for the SMB protocol, see the SMB/CIFS documentation at ftp://ftp.microsoft.com/developr/drg/CIFS/.

    -

    - -3.3.1.3 SMB variations

    -The SMB protocol has been extended with new commands several times since its inception. Each new version is backwards compatible with the previous versions. This makes it quite possible for a LAN to have various clients and servers running different versions of the SMB protocol at once.

    - -Table 3.3 outlines the major versions of the SMB protocol. Within each "dialect" of SMB are many sub-versions that include commands supporting particular releases of major operating systems. The ID string is used by clients and servers to determine what level of the protocol they will speak to each other.


    - - - - - - - - - - - - -
    - -Table 3.3: SMB Protocol Dialects
    -

    -Protocol Name

    		 -

    -ID String

    		 -

    -Used By

    -

    -Core

    		 -

    - -PC NETWORK PROGRAM 1.0

    		 -

    -

    -

    -Core Plus

    		-

    - -MICROSOFT NETWORKS 1.03

    		-

    -

    -

    -LAN Manager 1.0

    		-

    - -LANMAN1.0

    		 -

    -

    -

    -LAN Manager 2.0

    		-

    - -LM1.2X002

    		 -

    -

    -

    -LAN Manager 2.1

    		-

    - -LANMAN2.1

    		 -

    -

    -

    -NT LAN Manager 1.0

    		 -

    - -NT LM 0.12

    		 -

    -Windows NT 4.0

    -

    -Samba's NT LM 0.12

    		 -

    - -Samba

    		 -

    -Samba

    -

    -Common Internet File System

    		 -

    - -CIFS 1.0

    		 -

    -Windows 2000

    -Samba implements the -NT -LM -0.12 specification for NT LAN Manager 1.0. It is backwards compatible with all of the other SMB variants. The CIFS specification is, in reality, LAN Manager 0.12 with a few specific additions.

    -

    - -3.3.2 SMB Clients and Servers

    -As mentioned earlier, SMB is a client/server protocol. In the purest sense, this means that a client sends a request to a server, which acts on the request and returns a reply. However, the client/server roles can often be reversed, sometimes within the context of a single SMB session. For example, consider the two Windows 95/98 computers in -Figure 3.28. The computer named WIZZIN shares a printer to the network, and the computer named ESCRIME shares a disk directory. WIZZIN is in the client role when accessing ESCRIME's network drive, and in the server role when printing a job for ESCRIME.

    - -Figure 3.28: Two computers that both have resources to share

    Figure 3.28

    -This brings out an important point in Samba terminology:

      -
    • -

      - -A -server is a machine with a resource to share.

    • -

      - -A -client is a machine that wishes to use that resource.

    • -

      - -A server can be a client (of another computer's resource) at any given time.

    -Note that there are no implications as to the amount of resources that make up a server, or whether it has a large disk space or fast processor. A server could be an old 486 with a printer attached to it, or it could be an UltraSparc station with a 10 gigabyte disk service.

    -Microsoft Windows products have both the SMB client and server built in to the operating system. Wndows NT 4.0 uses a newer SMB protocol than Windows for Workgroups, and it offers an enhanced form of network security which will be discussed in Chapter 6. In addition, there are a large number of commercial SMB server products available from companies such as Sun, Compaq, SCO, Hewlett-Packard, Syntax, and IBM. Unfortunately, on the client side there are far fewer offerings, limited mainly to Digital Equipment's Pathworks product, and of course, Samba.

    -

    - -3.3.3 A Simple SMB Connection

    Before we close this chapter, let's take a look at a simple SMB connection. This is some pretty technical data - which isn't really necessary to administer Samba - so you can skip over it if you like. We present this information largely as a way to help you get familiar with how the SMB protocol negotiates connections with other computers on the network.

    -There are four steps that the client and server must complete in order to establish a connection to a resource:

      -
    1. -

      - - Establish a virtual connection.

    2. -

      - - Negotiate the protocol variant to speak.

    3. -

      - - Set session parameters.

    4. -

      - - Make a tree connection to a resource.

    -We will examine each of these steps through the eyes of a useful tool that we mentioned earlier: the modified -tcpdump that is available from the Samba web site.

    -You can download this program at -samba.org in the -samba/ftp/tcpdump-smb directory; the latest version as of this writing is 3.4-5. Use this program as you would use the standard -tcpdump application, but add the --s 1500 switch to ensure that you get the whole packet and not just the first few bytes.

    -

    - -3.3.3.1 Establishing a virtual connection

    When a user first makes a request to access a network disk or send a print job to a remote printer, NetBIOS takes care of making a connection at the session layer. The result is a bidirectional virtual channel between the client and server. In reality, there are only two messages that the client and server need to establish this connection. This is shown in the following example session request and response, as captured by -tcpdump :

    ->>> NBT Packet
-NBT Session Request
-Flags=0x81000044
-Destination=ESCRIME      NameType=0x20 (Server)
-Source=WIZZIN            NameType=0x00 (Workstation)
-
->>> NBT Packet
-NBT Session Granted
-Flags=0x82000000
    -

    - -3.3.4 Negotiating the Protocol Variant

    At this point, there is an open channel between the client and server. Next, the client sends a message to the server to negotiate an SMB protocol. As mentioned earlier, the client sets its tree identifier (TID) field to zero, since it does not yet know what TID to use. A -tree identifier is a number that represents a connection to a share on a server.

    -The command in the message is -SMBnegprot, a request to negotiate a protocol variant that will be used for the entire session. Note that the client sends to the server a list of all of the variants that it can speak, not vice versa.

    -The server responds to the -SMBnegprot request with an index into the list of variants that the client offered, starting with index 0, or with the value 0xFF if none of the protocol variants are acceptable. Continuing this example, the server responds with the value 5, which indicates that the -NT -LM -0.12 dialect will be used for the remainder of the session:

    ->>> NBT Packet
-NBT Session Packet
-Flags=0x0
-Length=154
-
-SMB PACKET: SMBnegprot (REQUEST)
-SMB Command   =  0x72
-Error class   =  0x0
-Error code    =  0
-Flags1        =  0x0
-Flags2        =  0x0
-Tree ID       =  0
-Proc ID       =  5371
-UID           =  0
-MID           =  385
-Word Count    =  0
-Dialect=PC NETWORK PROGRAM 1.0
-Dialect=MICROSOFT NETWORKS 3.0
-Dialect=DOS LM1.2X002
-Dialect=DOS LANMAN2.1
-Dialect=Windows for Workgroups 3.1a
-Dialect=NT LM 0.12
-
->>> NBT Packet
-NBT Session Packet
-Flags=0x0
-Length=69
-
-SMB PACKET: SMBnegprot (REPLY)
-SMB Command   =  0x72
-Error class   =  0x0
-Error code    =  0
-Flags1        =  0x0
-Flags2        =  0x1
-Tree ID       =  0
-Proc ID       =  5371
-UID           =  0
-MID           =  385
-Word Count    =  02
-[000] 05 00
    -

    - -3.3.5 Set Session and Login Parameters

    The next step is to transmit session and login parameters for the session. This includes the account name and password (if there is one), the workgroup name, the maximum size of data that can be transferred, and the number of pending requests that may be in the queue at any one time.

    -In the following example, the Session Setup command presented allows for an additional SMB command to be piggybacked onto it. The letter X at the end of the command name indicates this, and the hexadecimal code of the second command is given in the -Com2 field. In this case the command is -0x75, which is the Tree Connect and X command. The -SMBtconX message looks for the name of the resource in the -smb_buf buffer. (This is the last field listed in the following request.) In this example, -smb_buf contains the string -\\ESCRIME\PUBLIC, which is the full pathname to a shared directory on node ESCRIME. Using the "and X" commands like this speeds up each transaction, since the server doesn't have to wait on the client to make a second request.

    -Note that the TID is still zero. The server will provide a TID to the client once the session has been established and a connection has been made to the requested resource. In addition, note that the password is sent in the open. We can change this later using encrypted passwords:

    ->>> NBT Packet
-NBT Session Packet
-Flags=0x0
-Length=139
-
-SMB PACKET: SMBsesssetupX (REQUEST)
-SMB Command   =  0x73
-Error class   =  0x0
-Error code    =  0
-Flags1        =  0x10
-Flags2        =  0x0
-Tree ID       =  0
-Proc ID       =  5371
-UID           =  1
-MID           =  385
-Word Count    =  13
-Com2=0x75
-Res1=0x0
-Off2=106
-MaxBuffer=2920
-MaxMpx=2
-VcNumber=0
-SessionKey=0x1FF2
-CaseInsensitivePasswordLength=1
-CaseSensitivePasswordLength=1
-Res=0x0
-Capabilities=0x1
-Pass1&Pass2&Account&Domain&OS&LanMan=  
-  KRISTIN PARKSTR Windows 4.0 Windows 4.0
-PassLen=2
-Passwd&Path&Device=
-smb_bcc=22
-smb_buf[]=\\ESCRIME\PUBLIC
    -

    - -3.3.6 Making Connection to a Resource

    For the final step, the server returns a TID to the client, indicating that the user has been authorized access and that the resource is ready to be used. It also sets the -ServiceType field to "A" to indicate that this is a file service. Available service types are:

      -
    • -

      - - "A" for a disk or file

    • -

      - - "LPT1" for a spooled output

    • -

      - - "COMM" for a direct-connect printer or modem

    • -

      - - "IPC" for a named pipe

    -The output is:

    ->>> NBT Packet
-NBT Session Packet
-Flags=0x0
-Length=78
-
-SMB PACKET: SMBsesssetupX (REPLY)
-SMB Command   =  0x73
-Error class   =  0x0
-Error code    =  0
-Flags1        =  0x80
-Flags2        =  0x1
-Tree ID       =  121
-Proc ID       =  5371
-UID           =  1
-MID           =  385
-Word Count    =  3
-Com2=0x75
-Off2=68
-Action=0x1
-[000] Unix Samba 1.9.1
-[010] PARKSTR
-
-SMB PACKET: SMBtconX (REPLY) (CHAINED)
-smbvwv[]=
-Com2=0xFF
-Off2=78
-smbbuf[]=
-ServiceType=A:

    -Now that a TID has been assigned, the client may issue any sort of command that it would use on a local disk drive. It can open files, read and write to them, delete them, create new files, search for filenames, and so on.

    -
    -
    -
    - - -
    - -Previous: 3.2 Setting Up Windows NT 4.0 Computers - - - -Next: 4. Disk Shares
    -3.2 Setting Up Windows NT 4.0 Computers - -Book Index -4. Disk Shares
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch04_01.html b/docs/htmldocs/using_samba/ch04_01.html deleted file mode 100644 index 1cc3494d29..0000000000 --- a/docs/htmldocs/using_samba/ch04_01.html +++ /dev/null @@ -1,415 +0,0 @@ - - - -[Chapter 4] Disk Shares - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 3.3 An Introduction to SMB/CIFS - - -Chapter 4 - -Next: 4.2 Special Sections
     
    - -
    -
    -

    - -4. Disk Shares

    -

    - -Contents:
    - -Learning the Samba Configuration File
    - -Special Sections
    - -Configuration File Options
    - -Server Configuration
    - -Disk Share Configuration
    - -Networking Options with Samba
    - -Virtual Servers
    - -Logging Configuration Options

    -

    In the previous three chapters, we showed you how to install Samba on a Unix server and set up Windows clients to use a simple disk share. This chapter will show you how Samba can assume more productive roles on your network.

    -Samba's daemons, -smbd and -nmbd, are controlled through a single ASCII file, -smb.conf, that can contain over 200 unique options. These options define how Samba reacts to the network around it, including everything from simple permissions to encrypted connections and NT domains. The next five chapters are designed to help you get familiar with this file and its options. Some of these options you will use and change frequently; others you may never use - it all depends on how much functionality you want Samba to offer its clients.

    -This chapter introduces the structure of the Samba configuration file and shows you how to use these options to create and modify disk shares. Subsequent chapters will discuss browsing, how to configure users, security, domains, and printers, and a host of other myriad topics that you can implement with Samba on your network.

    -

    - - -4.1 Learning the Samba Configuration File

    - -Here is an -example of a Samba configuration file. If you have worked with a Windows .INI file, the structure of the -smb.conf file should look very familiar: 

    -[global] 
-	log level = 1 
-	max log size = 1000
-	socket options = TCP_NODELAY IPTOS_LOWDELAY 
-	guest ok = no
-[homes] 
-	browseable = no
-	map archive = yes
-[printers] 
-	path = /usr/tmp
-	guest ok = yes
-	printable = yes
-	min print space = 2000
-[test]
-	browseable = yes
-	read only = yes
-	guest ok = yes
-	path = /export/samba/test

    -Although you may not understand the contents yet, this is a good configuration file to grab if you're in a hurry. (If you're not, we'll create a new one from scratch shortly.) In a nutshell, this configuration file sets up basic debug logging in a default log file not to exceed 1MB, optimizes TCP/IP socket connections between the Samba server and any SMB clients, and allows Samba to create a disk share for each user that has a standard Unix account on the server. In addition, each of the printers registered on the server will be publicly available, as will a single read-only share that maps to the -/export/samba/test directory. The last part of this file is similar to the disk share you used to test Samba in Chapter 2, Installing Samba on a Unix System.

    -

    - -4.1.1 Configuration File Structure

    - -Let's take another look at this configuration file, this time from a higher level:

    -[global] 
-	...
-[homes] 
-	...
-[printers] 
-	...
-[test] 
-	...

    -The names inside the square brackets delineate unique sections of the -smb.conf file; each section names the -share (or service) that the section refers to. For example, the -[test] and -[homes] sections are each unique disk shares; they contain options that map to specific directories on the Samba server. The -[printers] share contains options that map to various printers on the server. All the sections defined in the -smb.conf file, with the exception of the -[global] section, will be available as a disk or printer share to clients connecting to the Samba server.

    -The remaining lines are individual configuration options unique to that share. These options will continue until a new bracketed section is encountered, or until the end of the file is reached. Each configuration option follows a simple format:

    option = value

    -Options in the -smb.conf file are set by assigning a value to them. We should warn you up front that some of the option names in Samba are poorly chosen. For example, -read -only is self-explanatory, and is typical of many recent Samba options. -public is an older option, and is vague; it now has a less-confusing synonym -guest -ok (may be accessed by guests). We describe some of the more common historical names in this chapter in sections that highlight each major task. In addition, Appendix C, Samba Configuration Option Quick Reference, contains an alphabetical index of all the configuration options and their meanings.

    -

    - -4.1.1.1 Whitespaces, quotes, and commas

    -An important item to remember about configuration options is that all whitespaces in the - -value are significant. For example, consider the following option:

    -volume = The Big Bad Hard Drive Number 3543

    -Samba strips away the spaces between the final -e in -volume and the first -T in -The. These whitespaces are insignificant. The rest of the whitespaces are significant and will be recognized and preserved by Samba when reading in the file. Space is not significant in option names (such as -guest -ok), but we recommend you follow convention and keep spaces between the words of options.

    -If you feel safer including quotation marks at the beginning and ending of a configuration option's value, you may do so. Samba will ignore these quotation marks when it encounters them. Never use quotation marks around an option itself; Samba will treat this as an error.

    -Finally, you can use whitespaces to separate a series of values in a list, or you can use commas. These two options are equivalent:

    -netbios aliases = sales, accounting, payroll
-netbios aliases = sales accounting payroll

    -In some values, however, you must use one form of separation - spaces in some cases, commas in others.

    -

    - -4.1.1.2 Capitalization

    Capitalization is not important in the Samba configuration file except in locations where it would confuse the underlying operating system. For example, let's assume that you included the following option in a share that pointed to -/export/samba/simple :

    -PATH = /EXPORT/SAMBA/SIMPLE

    -Samba would have no problem with the -path configuration option appearing entirely in capital letters. However, when it tries to connect to the given directory, it would be unsuccessful because the Unix filesystem in the underlying operating system -is case sensitive. Consequently, the path listed would not be found and clients would be unable to connect to the share.

    -

    - -4.1.1.3 Line continuation

    -You can continue a line in the Samba configuration file using the backslash, as follows:

    -comment = The first share that has the primary copies \
-          of the new Teamworks software product.

    -Because of the backslash, these two lines will be treated as one line by Samba. The second line begins at the first non-whitespace character that Samba encounters; in this case, the -o in -of.

    -

    - -4.1.1.4 Comments

    -You can insert comments in the -smb.conf configuration file by preceding a line with either a hash mark (#) or a semicolon (;). Both characters are equivalent. For example, the first three lines in the following example would be considered comments:

    -#  This is the printers section. We have given a minimum print 
-;  space of 2000 to prevent some errors that we've seen when
-;  the spooler runs out of space.
-
-[printers] 
-	public = yes
-	min print space = 2000

    -Samba will ignore all comment lines in its configuration file; there are no limitations to what can be placed on a comment line after the initial hash mark or semicolon. Note that the line continuation character (\) will -not be honored on a commented line. Like the rest of the line, it is ignored.

    -

    - -4.1.1.5 Changes at runtime

    You can modify the -smb.conf configuration file and any of its options at any time while the Samba daemons are running. By default, Samba checks the configuration file every 60 seconds for changes. If it finds any, the changes are immediately put into effect. If you don't wish to wait that long, you can force a reload by either sending a SIGHUP signal to the -smbd and -nmbd processes, or simply restarting the daemons.

    -For example, if the -smbd process was 893, you could force it to reread the configuration file with the following command:

    -# kill -SIGHUP 893

    -Not all changes will be immediately recognized by clients. For example, changes to a share that is currently in use will not be registered until the client disconnects and reconnects to that share. In addition, server-specific parameters such as the workgroup or NetBIOS name of the server will not register immediately either. This keeps active clients from being suddenly disconnected or encountering unexpected access problems while a session is open. -

    -

    - -4.1.2 Variables

    - -Samba includes a complete set of variables for determining characteristics of the Samba server and the clients to which it connects. Each of these variables begins with a percent sign, followed by a single uppercase or lowercase letter, and can be used only on the right side of a configuration option (e.g., after the equal sign):

    -[pub]
-    path = /home/ftp/pub/%a

    -The -%a stands for the client machine's architecture (e.g., -WinNT for Windows NT, -Win95 for Windows 95 or 98, or -WfWg for Windows for Workgroups). Because of this, Samba will assign a unique path for the -[pub] share to client machines running Windows NT, a different path for client machines running Windows 95, and another path for Windows for Workgroups. In other words, the paths that each client would see as its share differ according to the client's architecture, as follows:

    -/home/ftp/pub/WinNT
-/home/ftp/pub/Win95
-/home/ftp/pub/WfWg

    -Using variables in this manner comes in handy if you wish to have different users run custom configurations based on their own unique characteristics or conditions. Samba has 19 variables, as shown in -Table 4.1.


    - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    - -Table 4.1: Samba Variables
    -

    -Variable

    		 -

    -Definition

    -

    -Client variables

    -

    - -%a

    		 -

    - -Client's architecture (e.g., Samba, WfWg, WinNT, Win95, or UNKNOWN)

    -

    - -%I

    		 -

    -Client's IP address (e.g., 192.168.220.100)

    -

    -%m

    		 -

    -Client's NetBIOS name

    -

    - -%M

    		 -

    -Client's DNS name

    -

    -User variables

    -

    - -%g

    		 -

    -Primary group of -%u

    -

    - -%G

    		 -

    -Primary group of -%U

    -

    - -%H

    		 -

    -Home directory of -%u

    -

    - -%u

    		 -

    -Current Unix username

    -

    - -%U

    		 -

    -Requested client username (not always used by Samba)

    -

    - -Share variables

    -

    - -%p

    		 -

    -Automounter's path to the share's root directory, if different from -%P

    -

    - -%P

    		 -

    -Current share's root directory

    -

    - -%S

    		 -

    -Current share's name

    -

    - -Server variables

    -

    - -%d

    		 -

    -Current server process ID

    -

    - -%h

    		 -

    -Samba server's DNS hostname

    -

    - -%L

    		 -

    -Samba server's NetBIOS name

    -

    - -%N

    		 -

    -Home directory server, from the automount map

    -

    - -%v

    		 -

    -Samba version

    -

    - -Miscellaneous variables

    -

    - -%R

    		 -

    -The SMB protocol level that was negotiated

    -

    - -%T

    		 -

    -The current date and time

    Here's another example of using variables: let's say that there are five clients on your network, but one client, -fred, requires a slightly different -[homes] configuration loaded when it connects to the Samba server. With Samba, it's simple to attack such a problem: 

    -[homes] 
-	...
-	include = /usr/local/samba/lib/smb.conf.%m
-	...

    -The -include option here causes a separate configuration file for each particular NetBIOS machine (%m) to be read in addition to the current file. If the hostname of the client machine is -fred, and if a -smb.conf.fred file exists in the - -samba_dir -/lib/ directory (or whatever directory you've specified for your configuration files), Samba will insert that configuration file into the default one. If any configuration options are restated in -smb.conf.fred, those values will override any options previously encountered in that share. Note that we say "previously." If any options are restated in the main configuration file after the -include option, Samba will honor those restated values for the share in which they are defined.

    -Here's the important part: if there is no such file, Samba will not generate an error. In fact, it won't do anything at all. This allows you to create only one extra configuration file for -fred when using this strategy, instead of one for each NetBIOS machine that is on the network.

    -Machine-specific configuration files can be used both to customize particular clients and to make debugging Samba easier. Consider the latter; if we have one client with a problem, we can use this approach to give it a private log file with a more verbose logging level. This allows us to see what Samba is doing without slowing down all the other clients or overflowing the disk with useless logs. Remember, with large networks you may not always have the option to restart the Samba server to perform debugging!

    -You can use each of the variables in -Table 4.1 to give custom values to a variety of Samba options. We will highlight several of these options as we move through the next few chapters. -

    -
    -
    -
    - - -
    - -Previous: 3.3 An Introduction to SMB/CIFS - - - -Next: 4.2 Special Sections
    -3.3 An Introduction to SMB/CIFS - -Book Index -4.2 Special Sections
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch04_02.html b/docs/htmldocs/using_samba/ch04_02.html deleted file mode 100644 index d0b554e941..0000000000 --- a/docs/htmldocs/using_samba/ch04_02.html +++ /dev/null @@ -1,211 +0,0 @@ - - - -[Chapter 4] 4.2 Special Sections - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 4.1 Learning the Samba Configuration File - - - -Chapter 4
    -Disk Shares     		- -Next: 4.3 Configuration File Options
     
    - -
    -
    -

    - -4.2 Special Sections

    - -Now that we've gotten our feet wet with variables, there are a few special sections of the Samba configuration file that we should talk about. Again, don't worry if you do not understand each and every configuration options listed below; we'll go over each of them over the course of the upcoming chapters.

    -

    - -4.2.1 The [ globals] Section

    -The -[globals] section appears in virtually every Samba configuration file, even though it is not mandatory to define one. Any option set in this section of the file will apply to all the other shares, as if the contents of the section were copied into the share itself. There is one catch: other sections can list the same option in their section with a new value; this has the effect of overriding the value specified in the -[globals] section.

    -To illustrate this, let's again look at the opening example of the chapter:

    -[global] 
-	log level = 1 
-	max log size = 1000
-	socket options = TCP_NODELAY IPTOS_LOWDELAY 
-	guest ok = no
-[homes] 
-	browseable = no
-	map archive = yes
-[printers] 
-	path = /usr/tmp
-	guest ok = yes
-	printable = yes
-	min print space = 2000
-[test] 
-	browseable = yes
-	read only = yes
-	guest ok = yes
-	path = /export/samba/test

    -In the previous example, if we were going to connect a client to the -[test] share, Samba would first read in the -[globals] section. At that point, it would set the option -guest -ok -= -no as the global default for each share it encounters throughout the configuration file. This includes the -[homes] and -[printers] shares. When it reads in the -[test] share, however, it would then find the configuration option -guest -ok -= -yes, and override the default from the -[globals] section with the value -yes in the context of the -[pub] share.

    -Any option that appears outside of a section (before the first marked section) is also assumed to be a global option.

    -

    - -4.2.2 The [homes] Section

    -If a client attempts to connect to a share that doesn't appear in the -smb.conf file, Samba will search for a -[homes] share in the configuration file. If one exists, the unidentified share name is assumed to be a Unix username, which is queried in the password database of the Samba server. If that username appears, Samba assumes the client is a Unix user trying to connect to his or her home directory on the server.

    -For example, assume a client machine is connecting to the Samba server -hydra for the first time, and tries to connect to a share named [alice]. There is no -[alice] share defined in the -smb.conf file, but there is a -[homes], so Samba searches the password database file and finds an alice user account is present on the system. Samba then checks the password provided by the client against user alice's Unix password - either with the password database file if it's using non-encrypted passwords, or Samba's -smbpasswd file if encrypted passwords are in use. If the passwords match, then Samba knows it has guessed right: the user alice is trying to connect to her home directory. Samba will then create a share called [alice] for her.

    -The process of using the -[homes] section to create users (and dealing with their passwords) is discussed in more detail in the Chapter 6, Users, Security, and Domains.

    -

    - -4.2.3 The [printers] Section

    -The third special section is called -[printers] and is similar to -[homes]. If a client attempts to connect to a share that isn't in the -smb.conf file, and its name can't be found in the password file, Samba will check to see if it is a printer share. Samba does this by reading the printer capabilities file (usually -/etc/printcap) to see if the share name appears there.[1] If it does, Samba creates a share named after the printer.

    -
    -

    -[1] Depending on your system, this file may not be -/etc/printcap. You can use the -testparm command that comes with Samba to determine the value of the -printcap -name configuration option; this was the default value chosen when Samba was compiled.

    -Like -[homes], this means you don't have to maintain a share for each of your system printers in the -smb.conf file. Instead, Samba honors the Unix printer registry if you request it to, and provides the registered printers to the client machines. There is, however, an obvious limitation: if you have an account named -fred and a printer named -fred, Samba will always find the user account first, even if the client really needed to connect to the printer.

    -The process of setting up the -[printers] share is discussed in more detail in Chapter 7, Printing and Name Resolution. -

    -

    - -4.2.4 Configuration Options

    - -Options in the Samba configuration files fall into one of two categories: -global or -share. Each category dictates where an option can appear in the configuration file.

    -
    -Global
    -

    Global options -must appear in the -[global] section and nowhere else. These are options that typically apply to the behavior of the Samba server itself, and not to any of its shares.

    -Share
    -

    Share options can appear in specific shares, or they can appear in the -[global] section. If they appear in the -[global] section, they will define a default behavior for all shares, unless a share overrides the option with a value of its own.

    -In addition, the values that a configuration option can take can be divided into four categories. They are as follows:

    -
    -Boolean
    -

    These are simply yes or no values, but can be represented by any of the following: -yes, -no, -true, -false, -0, -1. The values are case insensitive: -YES is the same as -yes.

    -Numerical
    -

    An integer, hexidecimal, or octal number. The standard -0x -nn syntax is used for hexadecimal and -0 -nnn for octal.

    -String
    -

    -A string of case-sensitive characters, such as a filename or a username.

    -Enumerated list
    -

    -A finite list of known values. In effect, a boolean is an enumerated list with only two values. -

    -
    -
    -
    - - -
    - -Previous: 4.1 Learning the Samba Configuration File - - - -Next: 4.3 Configuration File Options
    -4.1 Learning the Samba Configuration File - -Book Index -4.3 Configuration File Options
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch04_03.html b/docs/htmldocs/using_samba/ch04_03.html deleted file mode 100644 index 3e5ae73865..0000000000 --- a/docs/htmldocs/using_samba/ch04_03.html +++ /dev/null @@ -1,190 +0,0 @@ - - - -[Chapter 4] 4.3 Configuration File Options - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 4.2 Special Sections - - - -Chapter 4
    -Disk Shares     		- -Next: 4.4 Server Configuration
     
    - -
    -
    -

    - -4.3 Configuration File Options

    -Samba has well over 200 configuration options at its disposal. So let's start off easy by introducing some of the options you can use to modify the configuration file itself.

    -As we hinted earlier in the chapter, configuration files are by no means static. You can instruct Samba to include or even replace configuration options as it is processing them. The options to do this are summarized in -Table 4.2.


    - - - - - - - -
    - -Table 4.2: Configuration File Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -config file

    		 -

    -string (fully-qualified name)

    		 -

    -Sets the location of a configuration file to use instead of the current one.

    		 -

    -None

    		 -

    -Global

    -

    - -include

    		 -

    -string (fully-qualified name)

    		 -

    -Specifies an additional segment of configuration options to be included at this point in the configuration file.

    		 -

    -None

    		 -

    -Global

    -

    - -copy

    		 -

    -string (name of share)

    		 -

    -Allows you to clone the configuration options of another share in the current share.

    		 -

    -None

    		 -

    -Share

    -

    - -4.3.1 config file

    -The global -config -file option specifies a replacement configuration file that will be loaded when the option is encountered. If the target file exists, the remainder of the current configuration file, as well as the options encounter so far, will be discarded; Samba will configure itself entirely with the options in the new file. The -config -file option takes advantage of the variables above, which is useful in the event that you want load a special configuration file based on the machine name or user of the client that it connecting.

    -For example, the following line instructs Samba to use a configuration file specified by the NetBIOS name of the client connecting, if such a file exists. If it does, options specified in the original configuration file are ignored. The following example attempts to lead a new configuration file based on the client's NetBIOS name: 

    -[global]
-	config file = /usr/local/samba/lib/smb.conf.%m

    -If the configuration file specified does not exist, the option is ignored and Samba will continue to configure itself based on the current file.

    -

    - -4.3.2 include

    -This option, discussed in greater detail earlier, copies the target file into the current configuration file at the point specified, as shown in -Figure 4.1. This option also takes advantage of the variables specified earlier in the chapter, which is useful in the event that you want load configuration options based on the machine name or user of the client that it connecting. You can use this option as follows:

    -[global]
-	include = /usr/local/samba/lib/smb.conf.%m

    -If the configuration file specified does not exist, the option is ignored. Remember that any option specified previously is overridden. In -Figure 4.1, all three options will override their previous values.

    - -Figure 4.1: The include option in a Samba configuration file

    Figure 4.1

    -The -include option cannot understand the variables -%u (user), -%p (current share's rout directory), or -%s (current share) because they are not set at the time the file is read.

    -

    - -4.3.3 copy

    -The -copy configuration option allows you to clone the configuration options of the share name that you specify in the current share. The target share must appear earlier in the configuration file than the share that is performing the copy. For example:

    -[template]
-	writable = yes
-	browsable = yes
-	valid users = andy, dave, peter
-
-[data]
-	path = /usr/local/samba
-	copy = template

    -Note that any options in the share that invoked the -copy directive will override those in the cloned share; it does not matter whether they appear before or after the -copy - directive. -

    -
    -
    -
    - - -
    - -Previous: 4.2 Special Sections - - - -Next: 4.4 Server Configuration
    -4.2 Special Sections - -Book Index -4.4 Server Configuration
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch04_04.html b/docs/htmldocs/using_samba/ch04_04.html deleted file mode 100644 index 5eac6db9e5..0000000000 --- a/docs/htmldocs/using_samba/ch04_04.html +++ /dev/null @@ -1,214 +0,0 @@ - - - -[Chapter 4] 4.4 Server Configuration - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 4.3 Configuration File Options - - - -Chapter 4
    -Disk Shares     		- -Next: 4.5 Disk Share Configuration
     
    - -
    -
    -

    - -4.4 Server Configuration

    Now it's time to begin configuring your Samba server. Let's introduce three basic configuration options that can appear in the -[global] section of your -smb.conf file:

    -[global]
-	#  Server configuration parameters
-	netbios name = HYDRA
-	server string = Samba %v on (%L)
-	workgroup = SIMPLE

    -This configuration file is pretty simple; it advertises the Samba server on a NBT network under the NetBIOS name -hydra. In addition, the machine belongs to the workgroup SIMPLE and displays a description to clients that includes the Samba version number as well as the NetBIOS name of the Samba server.

    -If you had to enter -encrypt passwords=yes in your earlier configuration file, you should do so here as well.

    -Go ahead and try this configuration file. Create a file named -smb.conf under the -/usr/local/samba/lib directory with the text listed above. Then reset the Samba server and use a Windows client to verify the results. Be sure that your Windows clients are in the SIMPLE workgroup as well. After clicking on the Network Neighborhood on a Windows client, you should see a window similar to -Figure 4.2. (In this figure, -phoenix and -chimaera are our Windows clients.)

    - -Figure 4.2: Network Neighborhood showing the Samba server

    Figure 4.2

    -You can verify the -server -string by listing the details of the Network Neighborhood window (select the Details menu item under the View menu), at which point you should see a window similar to -Figure 4.3.

    - -Figure 4.3: Network Neighborhood details listing

    Figure 4.3

    -If you were to click on the Hydra icon, a window should appear that shows the services that it provides. In this case, the window would be completely empty because there are no shares on the server yet.

    -

    - -4.4.1 Server Configuration Options

    -Table 4.3 summarizes the server configuration options introduced previously. Note that all three of these options are global in scope; in other words, they must appear in the -[global] section of the configuration file.


    - - - - - - - -
    - -Table 4.3: Server Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -netbios name

    		 -

    -string

    		 -

    -Sets the primary NetBIOS name of the Samba server.

    		 -

    -Server DNS hostname

    		 -

    -Global

    -

    - -server string

    		 -

    -string

    		 -

    -Sets a descriptive string for the Samba server.

    		 -

    - -Samba %v

    		 -

    -Global

    -

    - -workgroup

    		 -

    -string

    		 -

    -Sets the NetBIOS group of machines that the server belongs to.

    		 -

    -Defined at compile time

    		 -

    -Global

    -

    - -4.4.1.1 netbios name

    -The -netbios -name option allows you to set the NetBIOS name of the server. For example:

    -netbios name = YORKVM1

    -The default value for this configuration option is the server's hostname; that is, the first part of its complete DNS machine name. For example, a machine with the DNS name -ruby.ora.com would be given the NetBIOS name -RUBY by default. While you can use this option to restate the machine's NetBIOS name in the configuration file (as we did previously), it is more commonly used to assign the Samba server a NetBIOS name other than its current DNS name. Remember that the name given must follow the rules for valid NetBIOS machine names as outlines in Chapter 1, Learning the Samba.

    -Changing the NetBIOS name of the server is not recommended unless you have a good reason. One such reason might be if the hostname of the machine is not unique because the LAN is divided over two or more DNS domains. For example, YORKVM1 is a good NetBIOS candidate for vm1.york.example.com to differentiate it from -vm1.falkirk.example.com, which has the same hostname but resides in a different DNS domain.

    -Another use of this option is for relocating SMB services from a dead or retired machine. For example, if -SALES is the SMB server for the department, and it suddenly dies, you could immediately reset -netbios -name -= -SALES on a backup Samba machine that's taking over for it. Users won't have to change their drive mappings to a different machine; new connections to -SALES will simply go to the new machine.

    -

    - -4.4.1.2 server string

    -The -server -string parameter defines a comment string that will appear next to the server name in both the Network Neighborhood (when shown with the Details menu) and the comment entry of the Microsoft Windows print manager. You can use the standard variables to provide information in the description. For example, our entry earlier was:

    -[global]
-	server string = Samba %v on (%h)

    -The default for this option simply presents the current version of Samba and is equivalent to:

    -server string = Samba %v
    -

    - -4.4.1.3 workgroup

    -The -workgroup parameter sets the current workgroup where the Samba server will advertise itself. Clients that wish to access shares on the Samba server should be on the same NetBIOS workgroup. Remember that workgroups are really just NetBIOS group names, and must follow the standard NetBIOS naming conventions outlined in Chapter 1. For example:

    -[global]
-	workgroup = SIMPLE

    -The default option for this parameter is set at compile time. If the entry is not changed in the makefile, it will be -WORKGROUP. Because this tends to be the workgroup name of every unconfigured NetBIOS network, we recommend that you always set your workgroup name in the Samba configuration file.[2]

    -
    -

    -[2] We should also mention that it is an inherently bad idea to have a workgroup that shares the same name as a server.

    -
    -
    -
    - - -
    - -Previous: 4.3 Configuration File Options - - - -Next: 4.5 Disk Share Configuration
    -4.3 Configuration File Options - -Book Index -4.5 Disk Share Configuration
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch04_05.html b/docs/htmldocs/using_samba/ch04_05.html deleted file mode 100644 index ecb8acfebf..0000000000 --- a/docs/htmldocs/using_samba/ch04_05.html +++ /dev/null @@ -1,309 +0,0 @@ - - - -[Chapter 4] 4.5 Disk Share Configuration - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 4.4 Server Configuration - - - -Chapter 4
    -Disk Shares     		- -Next: 4.6 Networking Options with Samba
     
    - -
    -
    -

    - -4.5 Disk Share Configuration

    We mentioned in the previous section that there were no disk shares on the -hydra server. Let's continue with the configuration file and create an empty disk share called [data]. Here are the additions that will do it:

    -[global]
-	netbios name = HYDRA
-	server string = Samba %v on (%L)
-	workgroup = SIMPLE
-
-[data]
-	path = /export/samba/data
-	comment = Data Drive
-	volume = Sample-Data-Drive
-	writeable = yes
-	guest ok = yes

    -The -[data] share is typical for a Samba disk share. The share maps to a directory on the Samba server: -/export/samba/data. We've also provided a comment that describes the share as a -Data -Drive, as well as a volume name for the share itself.

    -The share is set to writeable so that users can write data to it; the default with Samba is to create a read-only share. As a result, this option needs to be explicitly set for each disk share you wish to make writeable.

    -You may have noticed that we set the -guest -ok parameter to -yes. While this isn't very security-conscious, there are some password issues that we need to understand before setting up individual users and authentication. For the moment, this will sidestep those issues and let anyone connect to the share.

    -Go ahead and make these additions to your configuration file. In addition, create the -/export/samba/data directory as root on your Samba machine with the following commands:

    # mkdir /export/samba/data
-# chmod 777 /export/samba/data

    -Now, if you connect to the -hydra server again (you can do this by clicking on its icon in the Windows Network Neighborhood), you should see a single share listed entitled -data, as shown in -Figure 4.4. This share should also have read/write access to it. Try creating or copying a file into the share. Or, if you're really feeling adventurous, you can even try mapping a network drive to it!

    - -Figure 4.4: The initial data share on the Samba server

    Figure 4.4
    -

    - -4.5.1 Disk Share Configuration Options

    The basic Samba configuration options for disk shares previously introduced are listed in -Table 4.4.


    - - - - - - - - - - -
    - -Table 4.4: Basic Share Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -path (directory)

    		 -

    -string (fully-qualified pathname)

    		 -

    -Sets the Unix directory that will be provided for a disk share or used for spooling by a printer share

    		 -

    - -/tmp

    		 -

    -Share

    -

    - -guest ok (public)

    		 -

    -boolean

    		 -

    -If set to -yes, authentication is not needed to access this share

    		 -

    - -no

    		 -

    -Share

    -

    - -comment

    		 -

    -string

    		 -

    -Sets the comment that appears with the share

    		 -

    -None

    		 -

    -Share

    -

    - -volume

    		 -

    -string

    		 -

    -Sets the volume name: the DOS name of the physical drive

    		 -

    -Share name

    		 -

    -Share

    -

    - -read only

    		 -

    -boolean

    		 -

    -If -yes, allows read only access to a share.

    		 -

    - -yes

    		 -

    -Share

    -

    - -writeable (write ok)

    		 -

    -boolean

    		 -

    -If -no, allows read only access to a share.

    		 -

    - -no

    		 -

    -Share

    -

    - -4.5.1.1 path

    This option, which has the synonym -directory, indicates the pathname at the root of the file or printing share. You can choose any path on the Samba server, so long as the owner of the Samba process that is connecting has read and write access to that directory. If the path is for a printing share, it should point to a temporary directory where files can be written on the server before being spooled to the target printer (/tmp and -/var/spool are popular choices). If this path is for a disk share, the contents of the folder representing the share name on the client will match the content of the directory on the Samba server. For example, if we have the following disk share listed in our configuration file:

    -[network]
-	path = /export/samba/network
-	writable = yes
-
-	guest ok = yes

    -And the contents of the directory -/usr/local/network on the Unix side are:

    $ ls -al /export/samba/network
-
    -drwxrwxrwx  9  root   nobody  1024  Feb 16 17:17  .
-drwxr-xr-x  9  nobody nobody  1024  Feb 16 17:17  ..
-drwxr-xr-x  9  nobody nobody  1024  Feb 16 17:17  quicken
-drwxr-xr-x  9  nobody nobody  1024  Feb 16 17:17  tax98
-drwxr-xr-x  9  nobody nobody  1024  Feb 16 17:17  taxdocuments

    -Then we should see the equivalent of -Figure 4.5 on the client side.

    - -Figure 4.5: Windows client view of a network filesystem specified by path

    Figure 4.5
    -

    - -4.5.1.2 guest ok

    -This option (which has an older synonym -public) allows or prohibits guest access to a share. The default value is -no. If set to -yes, it means that no username or password will be needed to connect to the share. When a user connects, the access rights will be equivalent to the designated guest user. The default account to which Samba offers the share is -nobody. However, this can be reset with the -guest -account configuration option. For example, the following lines allow guest user access to the -[accounting] share with the permissions of the -ftp account:

    -[global]
-	guest account = ftp
-[accounting]
-	path = /usr/local/account
-	guest ok = yes

    -Note that users can still connect to the share using a valid username/password combination. If successful, they will hold the access rights granted by their own account and not the guest account. If a user attempts to log in and fails, however, he or she will default to the access rights of the guest account. You can mandate that every user who attaches to the share will be using the guest account (and will have the permissions of the guest) by setting the option -guest -only -= -yes.

    -

    - -4.5.1.3 comment

    -The -comment option allows you to enter a comment that will be sent to the client when it attempts to browse the share. The user can see the comment by listing Details on the share folder under the appropriate computer in the Windows Network Neighborhood, or type the command -NET -VIEW at an MS-DOS prompt. For example, here is how you might insert a comment for a -[network] share:

    -[network]
-	comment = Network Drive
-	path = /export/samba/network

    -This yields a folder similar to -Figure 4.6 on the client side. Note that with the current configuration of Windows, this comment will not be shown once a share is mapped to a Windows network drive.

    - -Figure 4.6: Windows client view of a share comment

    Figure 4.6

    -Be sure not to confuse the -comment option, which documents a Samba server's shares, with the -server -string option, which documents the server itself.

    -

    - -4.5.1.4 volume

    -This option allows you to specify the volume name of the share as reported by SMB. This normally resolves to the name of the share given in the -smb.conf file. However, if you wish to name it something else (for whatever reason) you can do so with this option.

    -For example, an installer program may check the volume name of a CD-ROM to make sure the right CD-ROM is in the drive before attempting to install it. If you copy the contents of the CD-ROM into a network share, and wish to install from there, you can use this option to get around the issue:

    -[network]
-	comment = Network Drive
-	volume = ASVP-102-RTYUIKA
-	path = /home/samba/network
    -

    - -4.5.1.5 read only and writeable

    -The options -read -only and -writeable (or -write -ok) are really two ways of saying the same thing, but approached from opposite ends. For example, you can set either of the following options in the -[global] section or in an individual share:

    -read only = yes
-writeable = no

    -If either option is set as shown, data can be read from a share, but cannot be written to it. You might think you would need this option only if you were creating a read-only share. However, note that this read-only behavior is the -default action for shares; if you want to be able to write data to a share, you must explicitly specify one of the following options in the configuration file for each share:

    -read only = no
-writeable = yes

    -Note that if you specify more than one occurrence of either option, Samba will adhere to the last value it encounters for the share.

    -
    -
    -
    - - -
    - -Previous: 4.4 Server Configuration - - - -Next: 4.6 Networking Options with Samba
    -4.4 Server Configuration - -Book Index -4.6 Networking Options with Samba
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch04_06.html b/docs/htmldocs/using_samba/ch04_06.html deleted file mode 100644 index 897523cc55..0000000000 --- a/docs/htmldocs/using_samba/ch04_06.html +++ /dev/null @@ -1,414 +0,0 @@ - - - -[Chapter 4] 4.6 Networking Options with Samba - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 4.5 Disk Share Configuration - - - -Chapter 4
    -Disk Shares     		- -Next: 4.7 Virtual Servers
     
    - -
    -
    -

    - -4.6 Networking Options with Samba

    If you're running Samba on a multi-homed machine (that is, one on multiple subnets), or even if you want to implement a security policy on your own subnet, you should take a close look at the networking configuration options:

    -For the purposes of this exercise, let's assume that our Samba server is connected to a network with more than one subnet. Specifically, the machine can access both the 192.168.220.* and 134.213.233.* subnets. Here are our additions to the ongoing configuration file for the networking configuration options:

    -[global]
-	netbios name = HYDRA
-	server string = Samba %v on (%L)
-	workgroup = SIMPLE
-
-	#  Networking configuration options
-	hosts allow = 192.168.220. 134.213.233. localhost
-	hosts deny = 192.168.220.102
-	interfaces = 192.168.220.100/255.255.255.0 \
-					134.213.233.110/255.255.255.0
-	bind interfaces only = yes
-
-[data]
-	path = /home/samba/data
-	guest ok = yes
-	comment = Data Drive
-	volume = Sample-Data-Drive
-	writeable = yes
-

    Let's first talk about the -hosts -allow and -hosts -deny options. If these options sound familiar, you're probably thinking of the -hosts.allow and -hosts.deny files that are found in the -/etc directories of many Unix systems. The purpose of these options is identical to those files; they provide a means of security by allowing or denying the connections of other hosts based on their IP addresses. Why not just use the -hosts.allow and -hosts.deny files themselves? Because there may be services on the server that you want others to access without giving them access Samba's disk or printer shares

    -With the -hosts -allow option above, we've specified a cropped IP address: 192.168.220. (Note that there is still a third period; it's just missing the fourth number.) This is equivalent to saying: "All hosts on the 192.168.220 subnet." However, we've explicitly specified in a hosts deny line that 192.168.220.102 is not to be allowed access.

    -You might be wondering: why will 192.168.220.102 be denied even though it is still in the subnet matched by the -hosts -allow option? Here is how Samba sorts out the rules specified by -hosts -allow and -hosts -deny:

      -
    1. -

      - -If there are no -allow or -deny options defined anywhere in -smb.conf, Samba will allow connections from any machine allowed by the system itself.

    2. -

      - -If there are -hosts -allow or -hosts -deny options defined in the -[global] section of -smb.conf, they will apply to all shares, even if the shares have an overriding option defined.

    3. -

      - -If there is only a -hosts -allow option defined for a share, only the hosts listed will be allowed to use the share. All others will be denied.

    4. -

      - -If there is only a -hosts -deny option defined for a share, any machine which is not on the list will be able to use the share.

    5. -

      - -If both a -hosts -allow and -hosts -deny option are defined, a host must appear in the allow list and not appear in the deny list (in any form) in order to access the share. Otherwise, the host will not be allowed.

      -

      - -WARNING: Take care that you don't explicitly allow a host to access a share, but then deny access to the entire subnet of which the host is part.

    -Let's look at another example of that final item. Consider the following options:

    -hosts allow = 111.222.
-hosts deny = 111.222.333.

    -In this case, only the hosts that belong to the subnet 111.222.*.* will be allowed access to the Samba shares. However, if a client belongs to the 111.222.333.* subnet, it will be denied access, even though it still matches the qualifications outlined by -hosts -allow. The client must appear on the -hosts -allow list and -must not appear on the -hosts -deny list in order to gain access to a Samba share. If a computer attempts to access a share to which it is not allowed access, it will receive an error message.

    -The other two options that we've specified are the -interfaces and the -bind -interface -only address. Let's look at the -interfaces option first. Samba, by default, sends data only from the primary network interface, which in our example is the 192.168.220.100 subnet. If we would like it to send data to more than that one interface, we need to specify the complete list with the -interfaces option. In the previous example, we've bound Samba to interface with both subnets (192.168.220 and 134.213.233) on which the machine is operating by specifying the other network interface address: 134.213.233.100. If you have more than one interface on your computer, you should always set this option as there is no guarantee that the primary interface that Samba chooses will be the right one.

    -Finally, the -bind -interfaces -only option instructs the -nmbd process not to accept any broadcast messages other than those subnets specified with the -interfaces option. Note that this is different from the -hosts -allow and -hosts -deny options, which prevent machines from making connections to services, but not from receiving broadcast messages. Using the -bind -interfaces -only option is a way to shut out even datagrams from foreign subnets from being received by the Samba server. In addition, it instructs the -smbd process to bind to only the interface list given by the -interfaces option. This restricts the networks that Samba will serve.

    -

    - -4.6.1 Networking Options

    The networking options we introduced above are summarized in -Table 4.5.


    - - - - - - - - - -
    - -Table 4.5: Networking Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -hosts allow (allow hosts)

    		 -

    -string (list of hostnames)

    		 -

    -Specifies the machines that can connect to Samba.

    		 -

    -none

    		 -

    -Share

    -

    - -hosts deny (deny hosts)

    		 -

    -string (list of hostnames)

    		 -

    -Specifies the machines that cannot connect to Samba.

    		 -

    -none

    		 -

    -Share

    -

    - -interfaces

    		 -

    -string (list of IP/netmask combinations)

    		 -

    -Sets the network interfaces Samba will respond to. Allows correcting defaults.

    		 -

    -system-dependent

    		 -

    -Global

    -

    - -bind

    - -interfaces only

    		 -

    -boolean

    		 -

    -If set to -yes, Samba will bind only to those interfaces specified by the -interfaces option.

    		 -

    - -no

    		 -

    -Global

    -

    - -socket

    - -address

    		 -

    -string (IP address)

    		 -

    -Sets IP address to listen on, for use with multiple virtual interfaces on a server.

    		 -

    -none

    		 -

    -Global

    -

    - -4.6.1.1 hosts allow

    The -hosts -allow option (sometimes written as -allow -hosts) specifies the machines that have permission to access shares on the Samba server, written as a comma- or space-separated list of names of machines or their IP addresses. You can gain quite a bit of security by simply placing your LAN's subnet address in this option. For example, we specified the following in our example:

    -hosts allow = 192.168.220. localhost

    -Note that we placed -localhost after the subnet address. One of the most common mistakes when attempting to use the -hosts -allow option is to accidentally disallow the Samba server from communicating with itself. The -smbpasswd program will occasionally need to connect to the Samba server as a client in order to change a user's encrypted password. In addition, local browsing propagation requires local host access. If this option is enabled and the localhost address is not specified, the locally-generated packets requesting the change of the encrypted password will be discarded by Samba, and browsing propagation will not work properly. To avoid this, explicitly allow the loopback address (either -localhost or -127.0.0.1) to be used.[3]

    -
    -

    -[3] Starting with Samba 2.0.5, -localhost will automatically be allowed unless it is explicitly denied.

    -You can specify any of the following formats for this option:

      -
    • -

      - -Hostnames, such as -ftp.example.com.

    • -

      - -IP addresses, like -130.63.9.252.

    • -

      - -Domain names, which can be differentiated from individual hostnames because they start with a dot. For example, .ora.com represents all machines within the -ora.com domain.

    • -

      - -Netgroups, which start with an at-sign, such as -@printerhosts. Netgroups are available on systems running yellow pages/NIS or NIS+, but rarely otherwise. If netgroups are supported on your system, there should be a -netgroups manual page that describes them in more detail.

    • -

      - -Subnets, which end with a dot. For example, -130.63.9. means all the machines whose IP addresses begin with 130.63.9.

    • -

      - -The keyword -ALL, which allows any client access.

    • -

      - -The keyword -EXCEPT followed by more one or more names, IP addresses, domain names, netgroups, or subnets. For example, you could specify that Samba allow all hosts except those on the 192.168.110 subnet with -hosts -allow -= -ALL -EXCEPT -192.168.110. (remember the trailing dot).

    -Using the -ALL keyword is almost always a bad idea, since it means that anyone on any network can browse your files if they guess the name of your server.

    -Note that there is no default value for the -hosts -allow configuration option, although the default course of action in the event that neither option is specified is to allow access from all sources. In addition, if you specify this option in the -[global] section of the configuration file, it will override any -hosts -allow options defined shares.

    -

    - -4.6.1.2 hosts deny

    -The -hosts -deny option (also -deny -hosts) specifies machines that do not have permission to access a share, written as a comma- or space-separated list of machine names or their IP addresses. Use the same format as specifying clients as the -hosts -allow option above. For example, to restrict access to the server from everywhere but -example.com, you could write:

    -hosts deny = ALL EXCEPT .example.com

    -Like -hosts -allow, there is no default value for the -hosts -deny configuration option, although the default course of action in the event that neither option is specified is to allow access from all sources. Also, if you specify this option in the -[global] section of the configuration file, it will override any -hosts -deny options defined in shares. If you wish to deny -hosts access to specific shares, omit both the -hosts -allow and -hosts -deny options in the -[global] section of the configuration file.

    -

    - -4.6.1.3 interfaces

    The -interfaces option outlines the network addresses to which you want the Samba server to recognize and respond. This option is handy if you have a computer that resides on more than one network subnet. If this option is not set, Samba searches for the primary network interface of the server (typically the first Ethernet card) upon startup and configures itself to operate on only that subnet. If the server is configured for more than one subnet and you do not specify this option, Samba will only work on the first subnet it encounters. You must use this option to force Samba to serve the other subnets on your network.

    -The value of this option is one or more sets of IP address/netmask pairs, such as the following:

    -interfaces = 192.168.220.100/255.255.255.0 192.168.210.30/255.255.255.0

    -You can optionally specify a CIDR format bitmask, as follows:

    -interfaces = 192.168.220.100/24 192.168.210.30/24

    -The bitmask number specifies the first number of bits that will be turned on in the netmask. For example, the number 24 means that the first 24 (of 32) bits will be activated in the bit mask, which is the same as saying 255.255.255.0. Likewise, 16 would be equal to 255.255.0.0, and 8 would be equal to 255.0.0.0.

    -This option may not work correctly if you are using DHCP.

    -

    - -4.6.1.4 bind interfaces only

    -The -bind -interfaces -only option can be used to force the -smbd and -nmbd processes to serve SMB requests to only those addresses specified by the -interfaces option. The -nmbd process normally binds to the all addresses interface (0.0.0.0.) on ports 137 and 138, allowing it to receive broadcasts from anywhere. However, you can override this behavior with the following:

    -bind interfaces only = yes

    -This will cause both Samba processes to ignore any packets whose origination address does not match the broadcast address(es) specified by the -interfaces option, including broadcast packets. With -smbd, this option will cause Samba to not serve file requests to subnets other than those listed in the -interfaces option. You should avoid using this option if you want to allow temporary network connections, such as those created through SLIP or PPP. It's very rare that this option is needed, and it should only be used by experts.

    -If you set -bind interfaces only to -yes, you should add the localhost address (127.0.01) to the "interfaces" list. Otherwise, -smbpasswd will be unable to connect to the server using its default mode in order to change a password.

    -

    - -4.6.1.5 socket address

    The -socket -address option dictates which of the addresses specified with the -interfaces parameter Samba should listen on for connections. Samba accepts connections on all addresses specified by default. When used in an -smb.conf file, this option will force Samba to listen on only one IP address. For example:

    -interfaces = 192.168.220.100/24 192.168.210.30/24
-socket address = 192.168.210.30

    -This option is a programmer's tool and we recommend that you do not use it.

    -
    -
    -
    - - -
    - -Previous: 4.5 Disk Share Configuration - - - -Next: 4.7 Virtual Servers
    -4.5 Disk Share Configuration - -Book Index -4.7 Virtual Servers
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch04_07.html b/docs/htmldocs/using_samba/ch04_07.html deleted file mode 100644 index 6f5d495a0b..0000000000 --- a/docs/htmldocs/using_samba/ch04_07.html +++ /dev/null @@ -1,151 +0,0 @@ - - - -[Chapter 4] 4.7 Virtual Servers - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 4.6 Networking Options with Samba - - - -Chapter 4
    -Disk Shares     		- -Next: 4.8 Logging Configuration Options
     
    - -
    -
    -

    - -4.7 Virtual Servers

    Virtual servers are a technique for creating the illusion of multiple NetBIOS servers on the network, when in reality there is only one. The technique is simple to implement: a machine simply registers more than one NetBIOS name in association with its IP address. There are tangible benefits to doing this.

    -The accounting department, for example, might have an -accounting server, and clients of it would see just the accounting disks and printers. The marketing department could have their own server, -marketing, with their own reports, and so on. However, all the services would be provided by one medium-sized Unix workstation (and one relaxed administrator), instead of having one small server and one administrator per department.

    -Samba will allow a Unix server to use more than one NetBIOS name with the -netbios -aliases option. See -Table 4.6.


    - - - - - -
    - -Table 4.6: Virtual Server Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -netbios aliases

    		 -

    List of NetBIOS names

    		 -

    -Additional NetBIOS names to respond to, for use with multiple "virtual" Samba servers.

    		 -

    -None

    		 -

    -Global

    -

    - -4.7.1 netbios aliases

    -The -netbios -aliases option can be used to give the Samba server more than one NetBIOS name. Each NetBIOS name listed as a value will be displayed in the Network Neighborhood of a browsing machine. When a connection is requested to any machine, however, it will connect to the same Samba server.

    -This might come in handy, for example, if you're transferring three departments' data to a single Unix server with modern large disks, and are retiring or reallocating the old NT servers. If the three servers are called -sales, -accounting, and -admin, you can have Samba represent all three servers with the following options:

    -[global]
-	netbios aliases = sales accounting admin
-	include = /usr/local/samba/lib/smb.conf.%L

    -See -Figure 4.7 for what the Network Neighborhood would display from a client.When a client attempts to connect to Samba, it will specify the name of the server that it's trying to connect to, which you can access through the -%L variable. If the requested server is -sales, Samba will include the -/usr/local/samba/lib/smb.conf.sales file. This file might contain global and share declarations exclusively for the sales team, such as the following:

    -[global]
-	workgroup = SALES
-	hosts allow = 192.168.10.255
-
-[sales1998]
-	path = /usr/local/samba/sales/sales1998/
-...

    -This particular example would set the workgroup to SALES as well, and set the IP address to allow connections only from the SALES subnet (192.168.10). In addition, it would offer shares specific to the sales department.

    - -Figure 4.7: Using NetBIOS aliases for a Samba server

    Figure 4.7
    -
    -
    -
    - - -
    - -Previous: 4.6 Networking Options with Samba - - - -Next: 4.8 Logging Configuration Options
    -4.6 Networking Options with Samba - -Book Index -4.8 Logging Configuration Options
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch04_08.html b/docs/htmldocs/using_samba/ch04_08.html deleted file mode 100644 index 7336022e15..0000000000 --- a/docs/htmldocs/using_samba/ch04_08.html +++ /dev/null @@ -1,423 +0,0 @@ - - - -[Chapter 4] 4.8 Logging Configuration Options - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 4.7 Virtual Servers - - - -Chapter 4
    -Disk Shares     		- -Next: 5. Browsing and Advanced Disk Shares
     
    - -
    -
    -

    - -4.8 Logging Configuration Options

    Occasionally, we need to find out what Samba is up to. This is especially true when Samba is performing an unexpected action or is not performing at all. To find out this information, we need to check Samba's log files to see exactly why it did what it did.

    -Samba log files can be as brief or verbose as you like. Here is an example of what a Samba log file looks like:

    -[1999/07/21 13:23:25, 3] smbd/service.c:close_cnum(514)
-  phoenix (192.168.220.101) closed connection to service IPC$
-[1999/07/21 13:23:25, 3] smbd/connection.c:yield_connection(40)
-  Yielding connection to IPC$
-[1999/07/21 13:23:25, 3] smbd/process.c:process_smb(615)
-  Transaction 923 of length 49
-[1999/07/21 13:23:25, 3] smbd/process.c:switch_message(448)
-  switch message SMBread (pid 467)
-[1999/07/21 13:23:25, 3] lib/doscalls.c:dos_ChDir(336)
-  dos_ChDir to /home/samba
-[1999/07/21 13:23:25, 3] smbd/reply.c:reply_read(2199)
-  read fnum=4207 num=2820 nread=2820
-[1999/07/21 13:23:25, 3] smbd/process.c:process_smb(615)
-  Transaction 924 of length 55
-[1999/07/21 13:23:25, 3] smbd/process.c:switch_message(448)
-  switch message SMBreadbraw (pid 467)
-[1999/07/21 13:23:25, 3] smbd/reply.c:reply_readbraw(2053)
-  readbraw fnum=4207 start=130820 max=1276 min=0 nread=1276
-[1999/07/21 13:23:25, 3] smbd/process.c:process_smb(615)
-  Transaction 925 of length 55
-[1999/07/21 13:23:25, 3] smbd/process.c:switch_message(448)
-  switch message SMBreadbraw (pid 467)

    -Many of these options are of use only to Samba programmers. However, we will go over the meaning of some of these entries in more detail in Chapter 9, Troubleshooting Samba.

    -Samba contains six options that allow users to describe how and where logging information should be written. Each of these options are global options and cannot appear inside a share definition. Here is an up-to-date configuration file that covers each of the share and logging options that we've seen so far:

    -[global]
-	netbios name = HYDRA
-	server string = Samba %v on (%I)
-	workgroup = SIMPLE
-
-	#  Networking configuration options
-	hosts allow = 192.168.220. 134.213.233. localhost
-	hosts deny = 192.168.220.102
-	interfaces = 192.168.220.100/255.255.255.0 \
-					134.213.233.110/255.255.255.0
-	bind interfaces only = yes
-
-	# Debug logging information
-	log level = 2
-	log file = /var/log/samba.log.%m
-	max log size = 50
-	debug timestamp = yes
-
-[data]
-	path = /home/samba/data
-	browseable = yes
-	guest ok = yes
-	comment = Data Drive
-	volume = Sample-Data-Drive
-	writeable = yes
-

    - Here, we've added a custom log file that reports information up to debug level 2. This is a relatively light debugging level. The logging level ranges from 1 to 10, where level 1 provides only a small amount of information and level 10 provides a plethora of low-level information. Level 2 will provide us with useful debugging information without wasting disk space on our server. In practice, you should avoid using log levels greater than 3 unless you are programming Samba.

    -This file is located in the -/var/log directory thanks to the -log -file configuration option. However, we can use variable substitution to create log files specifically for individual users or clients, such as with the -%m variable in the following line:

    -log file = /usr/local/logs/samba.log.%m

    -Isolating the log messages can be invaluable in tracking down a network error if you know the problem is coming from a specific machine or user.

    -We've added another precaution to the log files: no one log file can exceed 50 kilobytes in size, as specified by the -max -log -size option. If a log file exceeds this size, the contents are moved to a file with the same name but with the suffix -.old appended. If the -.old file already exists, it is overwritten and its contents are lost. The original file is cleared, waiting to receive new logging information. This prevents the hard drive from being overwhelmed with Samba log files during the life of our daemons.

    -For convenience, we have decided to leave the debug timestamp in the logs with the -debug -timestamp option, which is the default behavior. This will place a timestamp next to each message in the logging file. If we were not interested in this information, we could specify -no for this option instead.

    -

    - -4.8.1 Using syslog

    -If you wish to use the system logger (syslog) in addition to or in place of the standard Samba logging file, Samba provides options for this as well. However, to use -syslog, the first thing you will have to do is make sure that Samba was built with the -configure ---with-syslog option. See Chapter 2 for more information on configuring and compiling Samba.

    -Once that is done, you will need to configure your -/etc/syslog.conf to accept logging information from Samba. If there is not already a -daemon.* entry in the - -/etc/syslog.conf file, add the following:

    -daemon.*        /var/log/daemon.log

    -This specifies that any logging information from system daemons will be stored in the -/var/log/daemon.log file. This is where the Samba information will be stored as well. From there, you can specify the following global option in your configuration file:

    -syslog = 2

    -This specifies that any logging messages with a level of 1 will be sent to both the -syslog and the Samba logging files. (The mappings to -syslog priorities are described in the upcoming section "syslog.") Let's assume that we set the regular -log -level option above to 4. Any logging messages with a level of 2, 3, or 4 will be sent to the Samba logging files, but not to the -syslog. Only level 1 logging messages will be sent to both. If the -syslog value exceeds the -log -level value, nothing will be written to the -syslog.

    -If you want to specify that messages be sent only to -syslog - and not to the standard Samba logging files - you can place this option in the configuration file:

    -syslog only = yes

    -If this is the case, any logging information above the number specified in the -syslog option will be discarded, just like the -log -level option.

    -

    - -4.8.2 Logging Configuration Options

    - -Table 4.7 lists each of the logging configuration options that Samba can use.


    - - - - - - - - - - -
    - -Table 4.7: Global Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -log file

    		 -

    -string (fully-qualified filename)

    		 -

    -Sets the name and location of the log file that Samba is to use. Uses standard variables.

    		 -

    -Specified in Samba makefile

    		 -

    -Global

    -

    - -log level

    - -(debug level)

    		 -

    -numerical (0-10)

    		 -

    -Sets the amount of log/debug messages that are sent to the log file. 0 is none, 3 is considerable.

    		 -

    - -1

    		 -

    -Global

    -

    - -max log size

    		 -

    -numerical (size in KB)

    		 -

    -Sets the maximum size of log file. After the log exceeds this size, the file will be renamed to -.bak and a new log file started.

    		 -

    - -5000

    		 -

    -Global

    -

    - -debug

    - -timestamp (timestamp logs)

    		 -

    -boolean

    		 -

    -If no, doesn't timestamp logs, making them easier to read during heavy debugging.

    		 -

    - -yes

    		 -

    -Global

    -

    - -syslog

    		 -

    -numerical (0-10)

    		 -

    -Sets level of messages sent to -syslog. Those levels below -syslog level will be sent to the system logger.

    		 -

    - -1

    		 -

    -Global

    -

    - -syslog only

    		 -

    -boolean

    		 -

    -If yes, uses -syslog entirely and sends no output to the standard Samba log files.

    		 -

    - -no

    		 -

    -Global

    -

    - -4.8.2.1 log file

    -On our server, Samba outputs log information to text files in the -var subdirectory of the Samba home directory, as set by the makefile during the build. The -log -file option can be used to reset the name of the log file to another location. For example, to reset the name and location of the Samba log file to -/usr/local/logs/samba.log, you could use the following:

    -[global]
-	log file = /usr/local/logs/samba.log

    -You may use variable substitution to create log files specifically for individual users or clients.

    -You can override the default log file location using the --l command-line switch when either daemon is started. However, this does not override the -log -file option. If you do specify this parameter, initial logging information will be sent to the file specified after --l (or the default specified in the Samba makefile) until the daemons have processed the -smb.conf file and know to redirect it to a new log file.

    -

    - -4.8.2.2 log level

    -The -log -level option sets the amount of data to be logged. Normally this is left at 0 or 1. However, if you have a specific problem you may want to set it at 3, which provides the most useful debugging information you would need to track down a problem. Levels above 3 provide information that's primarily for the developers to use for chasing internal bugs, and slows down the server considerably. Therefore, we recommend that you avoid setting this option to anything above 3. 

    -[global]
-log file = /usr/local/logs/samba.log.%m
-log level = 3
    -

    - -4.8.2.3 max log size

    -The -max -log -size option sets the maximum size, in kilobytes, of the debugging log file that Samba keeps. When the log file exceeds this size, the current log file is renamed to add an -.old extension (erasing any previous file with that name) and a new debugging log file is started with the original name. For example:

    -[global]
-log file = /usr/local/logs/samba.log.%m
-max log size = 1000

    -Here, if the size of any log file exceeds one megabyte in size, Samba renames the log file -samba.log. - -machine-name -.old and a new log file is generated. If there was a file there previously with the -.old extension, Samba deletes it. We highly recommend setting this option in your configuration files because debug logging (even at lower levels) can covertly eat away at your available disk space. Using this option protects unwary administrators from suddenly discovering that most of their disk space has been swallowed up by a single Samba log file.

    -

    - -4.8.2.4 debug timestamp or timestamp logs

    -If you happen to be debugging a network problem and you find that the date-stamp and timestamp information within the Samba log lines gets in the way, you can turn it off by giving either the -timestamp -logs or the -debug -timestamp option (they're synonymous) a value of -no. For example, a regular Samba log file presents its output in the following form:

    -12/31/98 12:03:34 hydra (192.168.220.101) connect to server network as user davecb

    -With a -no value for this option, the output would appear without the datestamp or the timestamp:

    -hydra (192.168.220.101) connect to server network as user davecb
    -

    - -4.8.2.5 syslog

    The -syslog option causes Samba log messages to be sent to the Unix system logger. The type of log information to be sent is specified as the parameter for this argument. Like the -log -level option, it can be a number from 0 to 10. Logging information with a level less than the number specified will be sent to the system logger. However, debug logs equal to or above the -syslog level, but less than log level, will still be sent to the standard Samba log files. To get around this, use the -syslog -only option. For example:

    -[global]
-	log level = 3
-	syslog = 1

    -With this, all logging information with a level of 0 would be sent to the standard Samba logs and the system logger, while information with levels 1, 2, and 3 would be sent only to the standard Samba logs. Levels above 3 are not logged at all. Note that all messages sent to the system logger are mapped to a priority level that the -syslog process understands, as shown in -Table 4.8. The default level is 1.


    - - - - - - - - - -
    - -Table 4.8: Syslog Priority Conversion
    -

    -Log Level

    		 -

    -Syslog Priority

    -

    -0

    		 -

    - -LOG_ERR

    -

    -1

    		 -

    - -LOG_WARNING

    -

    -2

    		 -

    - -LOG_NOTICE

    -

    -3

    		 -

    - -LOG_INFO

    -

    -4 and above

    		 -

    - -LOG_DEBUG

    -If you wish to use -syslog, you will have to run -configure ---with-syslog when compiling Samba, and you will need to configure your -/etc/syslog.conf to suit. (See the section -Section 4.8.1, Using syslog, earlier in this chapter.)

    -

    - -4.8.2.6 syslog only

    -The -syslog -only option tells Samba not to use the regular logging files - the system logger only. To enable this, specify the following option in the global ection of the Samba configuration file:

    -[global]
-	syslog only = yes
    -
    -
    -
    - - -
    - -Previous: 4.7 Virtual Servers - - - -Next: 5. Browsing and Advanced Disk Shares
    -4.7 Virtual Servers - -Book Index -5. Browsing and Advanced Disk Shares
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch05_01.html b/docs/htmldocs/using_samba/ch05_01.html deleted file mode 100644 index d45bd13f32..0000000000 --- a/docs/htmldocs/using_samba/ch05_01.html +++ /dev/null @@ -1,786 +0,0 @@ - - - -[Chapter 5] Browsing and Advanced Disk Shares - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 4.8 Logging Configuration Options - - -Chapter 5 - -Next: 5.2 Filesystem Differences
     
    - -
    -
    -

    - -5. Browsing and Advanced Disk Shares

    -

    - -Contents:
    - -Browsing
    - -Filesystem Differences
    - -File Permissions and Attributes on MS-DOS and Unix
    - -Name Mangling and Case
    - -Locks and Oplocks

    -

    This chapter continues our discussion of disk shares from the previous chapter. Here, we will discuss various differences between the Windows and Unix filesystems - and how Samba works to bridge the gap. There are a surprising number of inconsistencies between a DOS filesystem and a Unix filesystem. In addition, we will talk briefly about name mangling, file locking, and a relatively new feature for Samba: opportunistic locking, or oplocks. However, before we move into that territory, we should first discuss the somewhat arcane topic of browsing with Samba.

    -

    - - -5.1 Browsing

    -Browsing is the ability to examine the servers and shares that are currently available on your network. On a Windows NT 4.0 or 95/98 client, a user can browse network servers through the Network Neighborhood folder. By double-clicking the icon representing the server, the user should be able to see the printer and disk share resources available on that machine as well. (If you have Windows NT 3. -x, you can use the Disk-Connect Network Drive menu in the File Manager to display the available shares on a server.)

    -From the Windows command line, you can also use the -net -view option to see which servers are currently on the network. Here is an example of the -net -view command in action:

    C:\> net view
-Servers available in workgroup SIMPLE
-Server name            Remark
-----------------------------------------------------------
-\\CHIMAERA             Windows NT 4.0
-\\HYDRA                Samba 2.0.4 on (hydra)
-\\PHOENIX              Windows 98
    -

    - -5.1.1 Preventing Browsing

    You can restrict a share from being in a browse list by using the -browseable option. This boolean option prevents a share from being seen in the Network Neighborhood at all. For example, to prevent the -[data] share from the previous chapter from being visible, we could write:

    -[data]
-	path = /home/samba/data
-	browseable = no
-	guest ok = yes
-	comment = Data Drive
-	volume = Sample-Data-Drive
-	writeable = yes

    -Although you typically don't want to do this to an ordinary disk share, the browseable option is useful in the event that you need to create a share with contents that you do not want others to see, such as a -[netlogin] share for storing logon scripts for Windows domain control (see Chapter 6, Users, Security, and Domains for more information on logon scripts).

    -Another example is the -[homes] share. This share is often marked non-browsable so that a share named -[homes] won't appear when its machine's resources are browsed. However, if a user -alice logs on and looks at the machine's shares, an -[alice] share will appear under the machine. What if we wanted to make sure -alice's share appeared to everyone before she logs in? This could be done with the global -auto -services option. This option preloads shares into the browse list to ensure that they are always visible: 

    -[global]
-	...
-	auto services = alice
-	...
    -

    - -5.1.2 Default Services

    -In the event that a user cannot successfully connect to a share, you can specify a default share to which they can connect. Since you do not know who will default to this share at any time, you will probably want to set the -guest -ok option to -yes for this share. Specifying a -default -service can be useful when sending the utterly befuddled to a directory of help files. For example:

    -[global]
-	...
-	default service = helpshare
-	...
-	
-[helpshare]
-	path = /home/samba/helpshare/%S
-	browseable = yes
-	guest ok = yes
-	comment = Default Share for Unsuccessful Connections
-	volume = Sample-Data-Drive
-	writeable = no

    -Note that we used the -%S variable in the -path option. If you use the -%S variable, it will refer to the requested nonexistent share (the original share requested by the user), not the name of the resulting default share. This allows us to create different paths with the names of each server, which can provide more customized help files for users. In addition, any underscores (_) specified in the requested share will be converted to slashes (/) when the -%S variable is used.

    -

    - -5.1.3 Browsing Elections

    As mentioned in Chapter 1, Learning the Samba, one machine in each subnet always keeps a list of the currently active machines. This list is called the -browse list and the server that maintains it is called the local master browser. As machines come on and off the network, the local master browser continually updates the information in the browse list and provides it to any machine that requests it.

    -A computer becomes a local master browser by holding a browsing election on the local subnet. Browsing elections can be called at any time. Samba can rig a browsing election for a variety of outcomes, including always becoming the local master browser of the subnet or never becoming it. For example, the following options, which we've added to the configuration file from Chapter 4, Disk Shares, will ensure that Samba always wins the election for local master browser no matter which machines are also present:

    -[global]
-	netbios name = HYDRA
-	server string = Samba %v on (%L)
-	workgroup = SIMPLE
-
-	#  Browsing election options
-	os level = 34
-	local master = yes
-
-	#  Networking configuration options
-	hosts allow = 192.168.220. 134.213.233. localhost
-	hosts deny = 192.168.220.102
-	interfaces = 192.168.220.100/255.255.255.0 \
-					134.213.233.110/255.255.255.0
-
-	# Debug logging information
-	log level = 2
-	log file = /var/log/samba.log.%m
-	max log size = 50
-	debug timestamp = yes
-
-[data]
-	path = /home/samba/data
-	browseable = yes
-	guest ok = yes
-	comment = Data Drive
-	volume = Sample-Data-Drive
-	writable = yes

    -However, what if we didn't always want to win the election? What if we wanted to yield browsing to a Windows NT Server if present? In order to do that, we need to learn how browsing elections work. As you already know, each machine that takes place in the election must broadcast information about itself. This information includes the following:

      -
    • -

      - -The version of the election protocol used

    • -

      - -The operating system on the machine

    • -

      - -The amount of time the client has been on the network

    • -

      - -The hostname of the client

    -Here is how the election is decided. Operating systems are assigned a binary value according to their version, as shown in -Table 5.1.


    - - - - - - - - - - - -
    - -Table 5.1: Operating System Values in an Election
    -

    -Operating System

    		 -

    -Value

    -

    Windows NT Server 4.0

    		 -

    -33

    -

    -Windows NT Server 3.51

    		 -

    -32

    -

    -Windows NT Workstation 4.0

    		 -

    -17

    -

    -Windows NT Workstation 3.51

    		 -

    -16

    -

    -Windows 98

    		 -

    -2

    -

    -Windows 95

    		 -

    -1

    -

    -Windows 3.1 for Workgroups

    		 -

    -1

    -Following that, each computer on the network is assigned a separate value according to its role, as shown in -Table 5.2.


    - - - - - - - - - - -
    - -Table 5.2: Computer Role Settings in an Election
    -

    -Role

    		 -

    -Value

    -

    Primary Domain Controller

    		 -

    -128

    -

    -WINS Client

    		 -

    -32

    -

    -Preferred Master Browser

    		 -

    -8

    -

    -Active Master Browser

    		 -

    -4

    -

    -Standby Browser

    		 -

    -2

    -

    -Active Backup Browser

    		 -

    -1

    Elections are decided in the following order:

      -
    1. -

      - -The machine with the highest version of the election protocol will win. (So far, this is meaningless, as all Windows clients have version 1 of the election protocol.)

    2. -

      - -The machine with the highest operating system value wins the election.

    3. -

      - -If there is a tie, the machine with the setting of Preferred Master Browser (role 8) wins the election.

    4. -

      - -If there is still a tie, the client who has been online the longest wins the election.

    5. -

      - -And finally, if there is still a tie, the client name that comes first alphabetically wins.

    6. -

      - -The machine that is the "runner-up" can become a backup browser.

    -As a result, if you want Samba to take the role of a local master browser, but only if there isn't a Windows NT Server (4.0 or 3.51) on the network, you could change the -os -level parameter in the previous example to:

    -os level = 31

    -This will cause Samba to immediately lose the election to a Windows NT 4.0 or Windows NT 3.5 Server, both of which have a higher operating systems level. On the other hand, if you wanted to decide the local master browser on the basis of the network role, such as which machine is the primary domain controller, you could set the -os -level to match the highest type of operating system on the network and let the election protocol fall down to the next level.

    How can you can tell if a machine is a local master browser? By using the -nbtstat command. Place the NetBIOS name of the machine you wish to check after the --a option:

    C:\> nbtstat -a hydra
-
-       NetBIOS Remote Machine Name Table
-
- Name                            Type         Status
-----------------------------------------------------------
- HYDRA                     <00>  UNIQUE       Registered
- HYDRA                     <03>  UNIQUE       Registered
- HYDRA                     <20>  UNIQUE       Registered
- ..__MSBROWSE__.           <01>  GROUP        Registered
- SIMPLE                    <00>  GROUP        Registered
- SIMPLE                    <1D>  UNIQUE       Registered
- SIMPLE                    <1E>  GROUP        Registered
-
- MAC Address = 00-00-00-00-00-00

    -The resource entry that you're looking for is the -..__MSBROWSE__.<01>. This indicates that the server is currently acting as the local master browser for the current subnet. In addition, if the machine is a Samba server, you can check the Samba -nmbd log file for an entry such as:

    -nmbd/nmbd_become_lmb.c:become_local_master_stage2(406)
-*****
-Samba name server HYDRA is now a local master browser for
-workgroup SIMPLE on subnet 192.168.220.100
-****

    -Finally, Windows NT servers serving as primary domain controllers contain a sneak that allows them to assume the role of the local master browser in certain conditions; this is called the -preferred -master browser bit. Earlier, we mentioned that Samba could set this bit on itself as well. You can enable it with the -preferred -master option:

    -#  Browsing election options
-os level = 33
-local master = yes
-preferred master = yes

    -If the preferred master bit is set, the machine will force a browsing election at startup. Of course, this is needed only if you set the -os -level option to match the Windows NT machine. We recommend that you don't use this option if another machine also has the role of preferred master, such as an NT server.

    -

    - -5.1.4 Domain Master Browser

    In the opening chapter, we mentioned that in order for a Windows workgroup or domain to extend into multiple subnets, one machine would have to take the role of the -domain master browser. The domain master browser propagates browse lists across each of the subnets in the workgroup. This works because each local master browser periodically synchronizes its browse list with the domain master browser. During this synchronization, the local master browser passes on any server that the domain master browser does not have in its browse list, and vice versa. In a perfect world, each local master browser would eventually have the browse list for the entire domain.

    -Unlike the local master browser, there is no election to determine which machine assumes the role of the domain master browser. Instead, the administrator has to set it manually. By Microsoft design, however, the domain master browser and the primary domain controller (PDC) both register a resource type of <1B>, so the roles - and the machines - are inseparable.

    -If you have a Windows NT server on the network acting as a PDC, we recommend that you do not use Samba to become the domain master browser. The reverse is true as well: if Samba is taking on the responsibilities of a PDC, we recommend making it the domain master browser as well. Although it is possible to split the roles with Samba, this is not a good idea. Using two different machines to serve as the PDC and the domain master browser can cause random errors to occur on a Windows workgroup.

    -Samba can assume the role of a domain master browser for all subnets in the workgroup with the following option:

    -domain master = yes

    -You can verify that a Samba machine is in fact the domain master browser by checking the -nmbd log file:

    -nmbd/nmbd_become_dmb.c:become_domain_master_stage2(118)
-*****
-Samba name server HYDRA is now a domain master browser for
-workgroup SIMPLE on subnet 192.168.220.100
-*****

    -Or you can use the nmblookup command that comes with the Samba distribution to query for a unique <1B> resource type in the workgroup:

    # nmblookup SIMPLE#1B
-Sending queries to 192.168.220.255
-192.168.220.100 SIMPLE<1b>
    -

    - -5.1.4.1 Multiple subnets

    There are three rules that you must remember when creating a workgroup/domain that spans more than one subnet:

      -
    • -

      - -You must have either a Windows NT or Samba machine acting as a local master browser on each subnet in the workgroup/domain. (If you have a domain master browser in a subnet, a local master browser is not needed.)

    • -

      - -You must have a Windows NT Server or a Samba machine acting as a domain master browser somewhere in the workgroup.

    • -

      - -Each local master browser must be instructed to synchronize with the domain master browser.

    -Samba has a few other features in this arena in the event that you don't have or want a domain master browser on your network. Consider the subnets shown in -Figure 5.1.

    - -Figure 5.1: Multiple subnets with Samba servers

    Figure 5.1

    -First, a Samba server that is a local master browser can use the -remote -announce configuration option to make sure that computers in different subnets are sent broadcast announcements about the server. This has the effect of ensuring that the Samba server appears in the browse lists of foreign subnets. To achieve this, however, the directed broadcasts must reach the local master browser on the other subnet. Be aware that many routers do not allow directed broadcasts by default; you may have to change this setting on the router for the directed broadcasts to get through to its subnet.

    -With the -remote -announce option, list the subnets and the workgroup that should receive the broadcast. For example, to ensure that machines in the 192.168.221 and 192.168.222 subnets and SIMPLE workgroup are sent broadcast information from our Samba server, we could specify the following:

    -#  Browsing election options
-os level = 34
-local master = yes
-remote announce = 192.168.221.255/SIMPLE \
-	192.168.222.255/SIMPLE

    -In addition, you are allowed to specify the exact address to send broadcasts to if the local master browser on the foreign subnet is guaranteed to always have a fixed IP address.

    -A Samba local master browser can synchronize its browse list directly with another Samba server acting as a local master browser on a different subnet. For example, let's assume that Samba is configured as a local master browser, and Samba local master browsers exist at 192.168.221.130 and 192.168.222.120. We can use the -remote -browse -sync option to sync directly with the Samba servers, as follows:

    -#  Browsing election options
-os level = 34
-local master = yes
-remote browse sync = 192.168.221.130 192.168.222.120

    -In order for this to work, the other Samba machines must also be local master browsers. You can also use directed broadcasts with this option if you do not know specific IP addresses of local master browsers.

    -

    - -5.1.5 Browsing Options

    -Table 5.3 shows 14 options that define how Samba handles browsing tasks. We recommend the defaults for a site that prefers to be easy on its users with respect to locating shares and printers.


    - - - - - - - - - - - - - - - - - - -
    - -Table 5.3: Browsing Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -announce as

    		 -

    - -NT or -Win95 or -WfW

    		 -

    -Sets the operating system that Samba will announce itself as.

    		 -

    - -NT

    		 -

    -Global

    -

    - -announce version

    		 -

    -numerical

    		 -

    -Sets the version of the operating system that Samba will announce itself as.

    		 -

    - -4.2

    		 -

    -Global

    -

    - -browseable (browsable)

    		 -

    -boolean

    		 -

    -Allows share to be displayed in list of machine resources.

    		 -

    - -yes

    		 -

    -Share

    -

    - -browse list

    		 -

    -boolean

    		 -

    -If -yes, Samba will provide a browse list on this server.

    		 -

    - -yes

    		 -

    -Global

    -

    - -auto services (preload)

    		 -

    -string (share list)

    		 -

    -Sets a list of shares that will always appear in the browse list.

    		 -

    -None

    		 -

    -Global

    -

    - -default service (default)

    		 -

    -string (share name)

    		 -

    -Names a share (service) that will be provided if the client requests a share not listed in -smb.conf.

    		 -

    -None

    		 -

    -Global

    -

    - -local master

    		 -

    -boolean

    		 -

    -If -yes, Samba will try to become a master browser on the local subnet.

    		 -

    - -yes

    		 -

    -Global

    -

    - -lm announce

    		 -

    - -yes or -no or -auto

    		 -

    -Enables or disables LAN Manager style host announcements.

    		 -

    - -auto

    		 -

    -Global

    -

    - -lm interval

    		 -

    -numerical

    		 -

    -Specifies the frequency in seconds that LAN Manager announcements will be made if activated.

    		 -

    - -60

    		 -

    -Global

    -

    - -preferred master (prefered master)

    		 -

    -boolean

    		 -

    -If -yes, Samba will use the preferred master browser bit to attempt to become the local master browser.

    		 -

    - -no

    		 -

    -Global

    -

    - -domain master

    		 -

    -boolean

    		 -

    -If -yes, Samba will try to become the main browser master for the workgroup.

    		 -

    - -no

    		 -

    -Global

    -

    - -os level

    		 -

    -numerical

    		 -

    -Sets the operating system level of Samba in an election for local master browser.

    		 -

    - -0

    		 -

    -Global

    -

    - -remote browse sync

    		 -

    -string (list of IP addresses)

    		 -

    -Lists Samba servers to synchronize browse lists with.

    		 -

    -None

    		 -

    -Global

    -

    - -remote announce

    		 -

    -string (IP address/ workgroup pairs)

    		 -

    -Lists subnets and workgroups to send directed broadcast packets to, allowing Samba to appear to browse lists.

    		 -

    -None

    		 -

    -Global

    -

    - -5.1.5.1 announce as

    -This global configuration option specifies the type of operating system that Samba will announce to other machines on the network. The default value for this option is -NT, which represents a Windows NT operating system. Other possible values are -Win95, which represents a Windows 95 operating system, and -WfW for a Windows for Workgroup operating system. You can override the default value with the following:

    -[global]
-	announce as = Win95

    -We recommend against changing the default value of this configuration option.

    -

    - -5.1.5.2 announce version

    -This global option is frequently used with the -announce -as configuration option; it specifies the version of the operating system that Samba will announce to other machines on the network. The default value of this options is 4.2, which places itself above the current Windows NT version of 4.0. You can specify a new value with a global entry such as the following:

    -[global]
-	announce version = 4.3

    -We recommend against changing the default value of this configuration option.

    -

    - -5.1.5.3 browseable

    -The -browseable option (also spelled -browsable) indicates whether the share referenced should appear in the list of available resources of the machine on which it resides. This option is always set to -yes by default. If you wish to prevent the share from being seen in a client's browser, you can reset this option to -no.

    -Note that this does not prevent someone from accessing the share using other means, such as specifying a UNC location (//server/accounting) in Windows Explorer. It only prevents the share from being listed under the machine's resources when being browsed.

    -

    - -5.1.5.4 browse list

    You should never need to change this parameter from its default value of -yes. If your Samba server is acting as a local master browser (i.e., it has won the browsing election), you can use the global -browse -list option to instruct Samba to provide or withhold its browse list to all clients. By default, Samba always provides a browse list. You can withhold this information by specifying the following:

    -[global]
-	browse list = no

    -If you disable the browse list, clients cannot browse the names of other machines, their services, and other domains currently available on the network. Note that this won't make any particular machine inaccessible; if someone knows a valid machine name/address and a share on that machine, they can still connect to it explicitly using NET USE or by mapping a drive letter to it using Windows Explorer. It simply prevents information in the browse list from being retrieved by any client that requests it.

    -

    - -5.1.5.5 auto services

    -The global -auto -services option, which is also called -preload, ensures that the specified shares are always visible in the browse list. One common use for this option is to advertise specific user or printer shares that are created by the -[homes] or -[printers] shares, but are not otherwise browsable.

    -This option works best with disk shares. If you wish to force each of your system printers (i.e., those listed in the printer capabilities file) into the browse list using this option, we recommend using the -load -printers option instead. Any shares listed with the -auto -services option will not be displayed if the -browse -list option is set to -no.

    -

    - -5.1.5.6 default service

    -The global -default -service option (sometimes called -default) names a "last-ditch" share. If set to an existing share name, and a client requests a nonexistent disk or printer share, Samba will attempt to connect the user to the share specified by this option instead. The option is specified as follows:

    -default service = helpshare

    -Note that there are no braces surrounding the share name -helpshare, even though the definition of the share later in the Samba configuration file will have braces. Also, if you use the -%S variable in the share specified by this option, it will represent the requested, nonexistent share, not the default service. Any underscores (_) specified in the request share will be converted to slashes (/) when the variable is used.

    -

    - -5.1.5.7 local master

    This global option specifies whether Samba will attempt to become the local master browser for the subnet when it starts up. If this option is set to -yes, Samba will take place in elections. However, setting this option by itself does not guarantee victory. (Other parameters, such as -preferred -master and -os -level help Samba win browsing elections.) If this option is set to -no, Samba will lose all browsing elections, no matter which values are specified by the other configuration options. The default value is -yes.

    -

    - -5.1.5.8 lm announce

    -The global -lm -announce option tells Samba's -nmbd whether or not to send LAN Manager host announcements on behalf of the server. These host announcements may be required by older clients, such as IBM's OS/2 operating system. This announcement allows the server to be added to the browse lists of the client. If activated, Samba will announce itself repetitively at the number of seconds specified by the -lm -interval option.

    -This configuration option takes the standard boolean values, -yes and -no, which engage or disengage LAN Manager announcements, respectively. In addition, there is a third option, -auto, which causes -nmbd to passively listen for LAN Manager announcements, but not send any of its own initially. If LAN Manager announcements are detected for another machine on the network, -nmbd will start sending its own LAN Manager announcements to ensure that it is visible. You can specify the option as follows:

    -[global]
-	lm announce = yes

    -The default value is -auto. You probably won't need to change this value from its default.

    -

    - -5.1.5.9 lm interval

    -This option, which is used in conjunction with -lm -announce, indicates the number of seconds -nmbd will wait before repeatedly broadcasting LAN Manager-style announcements. Remember that LAN Manager announcements must be activated in order for this option to be used. The default value is 60 seconds. If you set this value to 0, Samba will not send any LAN Manager host announcements, no matter what the value of the -lm -announce option. You can reset the value of this option as follows:

    -[global]
-	lm interval = 90
    -

    - -5.1.5.10 preferred master

    -The -preferred -master option requests that Samba set the preferred master bit when participating in an election. This gives the server a higher preferred status in the workgroup than other machines at the same operating system level. If you are configuring your Samba machine to become the local master browser, it is wise to set the following value:

    -[global]
-	preferred master = yes

    -Otherwise, you should leave it set to its default, -no. If Samba is configured as a preferred master browser, it will force an election when it first comes online.

    -

    - -5.1.5.11 os level

    -The global -os -level option dictates the operating system level at which Samba will masquerade during a browser election. If you wish to have Samba win an election and become the master browser, you can set the level above that of the operating system on your network with the highest current value. The values are shown in Table 5-1. The default level is 0, which means that Samba will lose all elections. If you wish Samba to win all elections, you can reset its value as follows:

    -os level = 34

    -This means that the server will vote for itself 34 times each time an election is called, which ensures a victory.

    -

    - -5.1.5.12 domain master

    -If Samba is the primary domain controller for your workgroup or NT domain, it should also be the domain master browser. The domain master browser is a special machine that has the NetBIOS resource type <1B> and is used to propagate browse lists to and from each of the local master browsers in individual subnets across the domain. To force Samba to become the domain master browser, set the following in the -[global] section of the -smb.conf:

    -[global]
-	domain master = yes

    -If you have a Windows NT server on the network acting as a primary domain controller (PDC), we recommend that you do not use Samba to become the domain master browser. The reverse is true as well: if Samba is taking on the responsibilities of a PDC, we recommend making it the domain master browser. Splitting the PDC and the domain master browser will cause unpredictable errors to occur on the network.

    -

    - -5.1.5.13 remote browse sync

    -The global -remote -browse -sync option specifies that Samba should synchronize its browse lists with local master browsers in other subnets. However, the synchronization can occur only with other Samba servers, and not with Windows computers. For example, if your Samba server was a master browser on the subnet 192.168.235, and Samba local master browsers existed on other subnets at 192.168.234.92 and 192.168.236.2, you could specify the following:

    -remote browse sync = 192.168.234.92 192.168.236.2

    -The Samba server would then directly contact the other machines on the address list and synchronize browse lists. You can also say:

    -remote browse sync = 192.168.234.255 192.168.236.255

    -This forces Samba to broadcast queries to determine the IP addresses of the local master browser on each subnet, with which it will then synchronize browse lists. This only works, however, if your router doesn't block directed broadcast requests ending in 255.

    -

    - -5.1.5.14 remote announce

    -Samba servers are capable of providing browse lists to foreign subnets with the -remote -announce option. This is typically sent to the local master browser of the foreign subnet in question. However, if you do not know the address of the local master browser, you can do the following:

    -[global]
-    remote announce = 192.168.234.255/ACCOUNTING \       
-						192.168.236.255/ACCOUNTING

    -With this, Samba will broadcast host announcements to all machines on subnets 192.168.234 and 192.168.236, which will hopefully reach the local master browser of the subnet. You can also specify exact IP addresses, if they are known.

    -
    -
    -
    - - -
    - -Previous: 4.8 Logging Configuration Options - - - -Next: 5.2 Filesystem Differences
    -4.8 Logging Configuration Options - -Book Index -5.2 Filesystem Differences
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch05_02.html b/docs/htmldocs/using_samba/ch05_02.html deleted file mode 100644 index 462e23f3c0..0000000000 --- a/docs/htmldocs/using_samba/ch05_02.html +++ /dev/null @@ -1,429 +0,0 @@ - - - -[Chapter 5] 5.2 Filesystem Differences - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 5.1 Browsing - - - -Chapter 5
    -Browsing and Advanced Disk Shares     		- -Next: 5.3 File Permissions and Attributes on MS-DOS and Unix
     
    - -
    -
    -

    - -5.2 Filesystem Differences

    One of the biggest issues for which Samba has to correct is the difference between Unix and non-Unix filesystems. This includes items such as handling symbolic links, hidden files, and dot files. In addition, file permissions can also be a headache if not accounted for properly. This section describes how to use Samba to make up for some of those annoying differences, and even how to add some new functionality of its own.

    -

    - -5.2.1 Hiding and Vetoing Files

    There are some cases when we need to ensure that a user cannot see or access a file at all. Other times, we don't want to keep a user from accessing a file - we just want to hide it when they view the contents of the directory. On Windows systems, an attribute of files allows them to be hidden from a folder listing. With Unix, the traditional way of hiding files in a directory is to precede them with a dot (.). This prevents items such as configuration files or defaults from being seen when performing an ordinary -ls command. Keeping a user from accessing a file at all, however, involves working with permissions on files and or directories.

    -The first option we should discuss is the boolean -hide -dot -files. This option does exactly what it says. When set to -yes, the option treats files beginning with a period (.) as hidden. If set to -no, those files are always shown. The important thing to remember is that the files are only hidden. If the user has chosen to show all hidden files while browsing (e.g., using the Folder Options menu item under the View menu in Windows 98), they will still be able to see the files, as shown in -Figure 5.2.

    - -Figure 5.2: Hidden files in the [data] share

    Figure 5.2

    -Instead of simply hiding files beginning with a dot, you can also specify a string pattern to Samba for files to hide, using the -hide -files option. For example, let's assume that we specified the following in our example -[data] share:

    -[data]
-	path = /home/samba/data
-	browseable = yes
-	guest ok = yes
-	writeable = yes
-	case sensitive = no
-	hide files = /*.java/*README*/

    -Each entry for this option must begin, end, or be separated from another with a slash (/) character, even if there is only one pattern listed. This convention allows spaces to appear in filenames. In this example, the share directory would appear as shown in -Figure 5.3. Again, note that we have set the Windows 98 option to view hidden files for the window.

    - -Figure 5.3: Hiding files based on filename patterns

    Figure 5.3

    If we want to prevent users from seeing files at all, we can instead use the -veto -files option. This option, which takes the same syntax as the -hide -files option, specifies a list of files that should never be seen by the user. For example, let's change the -[data] share to the following:

    -[data]
-	path = /home/samba/data
-	browseable = yes
-	guest ok = yes
-	writeable = yes
-	case sensitive = no
-	veto files = /*.java/*README*/

    -The syntax of this option is identical to the -hide -files configuration option: each entry must begin, end, or be separated from another with a slash (/) character, even if there is only one pattern listed. By doing so, the files -hello.java and -README will simply disappear from the directory, and the user will not be able to access them through SMB.

    -There is one other question that we need to address. What happens if the user tries to delete a directory that contains vetoed files? This is where the -delete -veto -files option comes in. If this boolean option is set to -yes, the user is allowed to delete both the regular files and the vetoed files in the directory, and the directory itself will be removed. If the option is set to -no, the user will not be able to delete the vetoed files, and consequently the directory will not be deleted either. From the user's perspective, the directory will appear to be empty, but cannot be removed.

    -The -dont -descend directive specifies a list of directories whose contents Samba should not allow to be visible. Note that we say -contents, not the directory itself. Users will be able to enter a directory marked as such, but they are prohibited from descending the directory tree any farther - they will always see an empty folder. For example, let's use this option with a more basic form of the share that we defined earlier in the chapter:

    -[data]
-	path = /home/samba/data
-	browseable = yes
-	guest ok = yes
-	writeable = yes
-	case sensitive = no
-	dont descend = config defaults

    -In addition, let's assume that the -/home/samba/data directory has the following contents:

    -drwxr-xr-x   6 tom      users     1024 Jun 13 09:24 .
-drwxr-xr-x   8 root     root      1024 Jun 10 17:53 ..
--rw-r--r--   2 tom      users     1024 Jun  9 11:43 README
-drwxr-xr-x   3 tom      users     1024 Jun 13 09:28 config
-drwxr-xr-x   3 tom      users     1024 Jun 13 09:28 defaults
-drwxr-xr-x   3 tom      users     1024 Jun 13 09:28 market

    -If the user then connects to the share, he or she would see the directories shown in -Figure 5.4. However, the contents of the -/config and -/defaults directories would appear empty to the user, even if other folders or files existed in them. In addition, users cannot write any data to the folder (which prevents them from creating a file or folder with the same name as one that is already there but invisible). If a user attempts to do so, he or she will receive an "Access Denied" message. -dont -descend is an administrative option, not a security option, and is not a substitute for good file permissions.

    - -Figure 5.4: Contents of the [data] share with dont descend

    Figure 5.4
    -

    - -5.2.2 Links

    DOS and NT filesystems don't have symbolic links; Windows 95/98/NT systems approximate this with "shortcuts" instead. Therefore, when a client tries to open a symbolic link on a Samba server share, Samba attempts to follow the link to find the real file and let the client open it, as if he or she were on a Unix machine. If you don't want to allow this, set the -follow -symlinks option:

    -[data]
-	path = /home/samba/data
-	browseable = yes
-	guest ok = yes
-	writeable = yes
-	case sensitive = no
-	follow symlinks = no

    -You can test this by creating a directory on the Unix server inside the share as the user that you are logging in with. Enter the following commands:

    -% mkdir hello; cd hello
-% cat "This is a test" >hello.txt
-% ln -s hello.txt "Link to hello"

    -This results in the two files shown in the window in -Figure 5.5. Normally, if you click on either one, you will receive a file which has the text "This is a test" inside of it. However, with the -follow -symlinks option set to -no, you should receive an error similar to the dialog in -Figure 5.5 if you click on "Link to hello."

    - -Figure 5.5: An error dialog trying to follow symbolic links when forbidden by Samba

    Figure 5.5

    -Finally, let's discuss the -wide -links option. This option, if set to -yes, allows the client user to follow symbolic links that point outside the shared directory tree, including files or directories at the other end of the link. For example, let's assume that we modified the -[data] share as follows:

    -[data]
-	path = /home/samba/data
-	browseable = yes
-	guest ok = yes
-	writeable = yes
-	case sensitive = no
-	follow symlinks = yes
-	wide links = yes

    -As long as the -follow -symlinks option is enabled, this will cause Samba to follow all symbolic links outside the current share tree. If we create a file outside the share (for example, in someone's home directory) and then create a link to it in the share as follows:

    -ln -s ~tom/datafile ./datafile

    -then you will be able to open the file in Tom's directory as per the target file's permissions.

    -

    - -5.2.3 Filesystem Options

    -Table 5.4 shows a breakdown of the options we discussed earlier. We recommend the defaults for most, except those listed in the following descriptions.


    - - - - - - - - - - - - - -
    - -Table 5.4: Filesystem Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -unix realname

    		 -

    -boolean

    		 -

    -Provides Unix user's full name to client.

    		 -

    - -no

    		 -

    -Global

    -

    - -dont descend

    		 -

    -string (list of directories)

    		 -

    -Indicates a list of directories whose contents Samba should make invisible to clients.

    		 -

    -None

    		 -

    -Share

    -

    - -follow symlinks

    		 -

    -boolean

    		 -

    -If set to -no, Samba will not honor symbolic links.

    		 -

    - -yes

    		 -

    -Share

    -

    - -getwd cache

    		 -

    -boolean

    		 -

    -If set to -yes, Samba will use a cache for -getwd() calls.

    		 -

    - -yes

    		 -

    -Global

    -

    - -wide links

    		 -

    -boolean

    		 -

    -If set to -yes, Samba will follow symbolic links outside the share.

    		 -

    - -yes

    		 -

    -Share

    -

    - -hide dot files

    		 -

    -boolean

    		 -

    -If set to -yes, treats Unix hidden files as hidden files in Windows.

    		 -

    - -yes

    		 -

    -Share

    -

    - -hide files

    		 -

    -string (list of files)

    		 -

    -List of file patterns to treat as hidden.

    		 -

    -None

    		 -

    -Share

    -

    - -veto files

    		 -

    -string (list of files)

    		 -

    -List of file patterns to never show.

    		 -

    -None

    		 -

    -Share

    -

    - -delete veto files

    		 -

    -boolean

    		 -

    -If set to -yes, will delete files matched by -veto files when the directory they reside in is deleted.

    		 -

    - -no

    		 -

    -Share

    -

    - -5.2.3.1 unix realname

    -Some programs require a full username in order to operate. For example, a Windows email program often needs to associate a username with a given real name. If your system password file contains the real names of users in the GCOS field, the -unix -realname option instructs Samba to provide this information to clients. Without it, the name of the user will simply be his or her login ID. For example, if your Unix password file contains the following line:

    -rcollins:/KaBfco47Rer5:500:500:Robert Collins:
-/home/rcollins:/bin/ksh

    -And the option in the configuration file is:

    -[global]
-	unix realname = yes

    -then the name Robert Collins will be provided to any client that requests the real name of user -rcollins. You typically don't need to bother with this option.

    -

    - -5.2.3.2 dont descend

    -The -dont -descend option can be used to specify various directories that should appear empty to the client. Note that the directory itself will still appear. However, Samba will not show any of the contents of the directory to the client user. This is not a good option to use as a security feature (a user could probably find a way around it); it really is meant only as a convenience to keep client users from browsing into directories that might have sensitive files. See our example earlier in this section.

    -

    - -5.2.3.3 follow symlinks

    This option, which is discussed in greater detail earlier, controls whether Samba will follow a symbolic link in the Unix operating system to the target, or if it should return an error to the client user. If the option is set to -yes, the target of the link will be interpreted as the file.

    -

    - -5.2.3.4 getwd cache

    -This global option specifies whether Samba should use a local cache for the Unix -getwd() (get current working directory) system call. You can override the default value of -yes as follows:

    -[global]
-	getwd cache = no

    -Setting this option to -yes can significantly increase the time it takes to resolve the working directory, especially if the -wide -links option is set to -no. You should normally not need to alter this option.

    -

    - -5.2.3.5 wide links

    -This option specifies whether the client user can follow symbolic links that point outside the shared directory tree. This includes any files or directories at the other end of the link, as long as the permissions are correct for the user. The default value for this option is -yes. Note that this option will not be honored if the -follow -symlinks options is set to -no. Setting this option to -no slows -smbd considerably.

    -

    - -5.2.3.6 hide files

    The -hide -files option provides one or more directory or filename patterns to Samba. Any file matching this pattern will be treated as a hidden file from the perspective of the client. Note that this simply means that the DOS hidden attribute is set, which may or may not mean that the user can actually see it while browsing.

    -Each entry in the list must begin, end, or be separated from another entry with a slash (/) character, even if there is only one pattern listed. This allows spaces to appear in the list. Asterisks can be used as a wildcard to represent zero or more characters. Questions marks can be used to represent exactly one character. For example:

    -hide files = /.jav*/README.???/
    -

    - -5.2.3.7 hide dot files

    -The -hide -dot -files option hides any files on the server that begin with a dot (.) character, in order to mimic the functionality behind several shell commands that are present on Unix systems. Like -hide -files, those files that begin with a dot have the DOS hidden attribute set, which doesn't necessarily guarantee that a client cannot view them. The default value for this option is -yes.

    -

    - -5.2.3.8 veto files

    -More stringent than the hidden files state is the state provided by the -veto -files configuration option. Samba won't even admit these files exist. You cannot list or open them from the client. In reality, this isn't a trustworthy security option. It is actually a mechanism to keep PC programs from deleting special files, such as ones used to store the resource fork of a Macintosh file on a Unix filesystem. If both Windows and Macs are sharing the same files, this can prevent ill-advised power users from removing files the Mac users need.

    -The syntax of this option is identical to that of the -hide -files configuration option: each entry must begin, end, or be separated from another with a slash (/) character, even if only one pattern is listed. Asterisks can be used as a wildcard to represent zero or more characters. Questions marks can be used to represent exactly one character. For example:

    -veto files = /*config/*default?/

    -This option is primarily administrative - not a substitute for good file permissions.

    -

    - -5.2.3.9 delete veto files

    This option tells Samba to delete vetoed files when a user attempts to delete the directory in which they reside. The default value is -no. This means if a user tries to delete a directory that contains a vetoed file, the file (and the directory) will not be deleted. Instead, the directory will remain and appear to be empty from the perspective of the user. If set to -yes, the directory and the vetoed files will be deleted.

    -
    -
    -
    - - -
    - -Previous: 5.1 Browsing - - - -Next: 5.3 File Permissions and Attributes on MS-DOS and Unix
    -5.1 Browsing - -Book Index -5.3 File Permissions and Attributes on MS-DOS and Unix
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch05_03.html b/docs/htmldocs/using_samba/ch05_03.html deleted file mode 100644 index aaa5648c6c..0000000000 --- a/docs/htmldocs/using_samba/ch05_03.html +++ /dev/null @@ -1,426 +0,0 @@ - - - -[Chapter 5] 5.3 File Permissions and Attributes on MS-DOS and Unix - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 5.2 Filesystem Differences - - - -Chapter 5
    -Browsing and Advanced Disk Shares     		- -Next: 5.4 Name Mangling and Case
     
    - -
    -
    -

    - -5.3 File Permissions and Attributes on MS-DOS and Unix

    DOS was never intended to be a multiuser, networked operating system. Unix, on the other hand, was designed that way from the start. Consequently, there are inconsistencies and gaps in coverage between the two filesystems that Samba must not only be aware of, but also provide solutions for. One of the biggest gaps is how Unix and DOS handle permissions with files.

    -Let's take a look at how Unix assigns permissions. All Unix files have read, write, and execute bits for three classifications of users: owner, group, and world. These permissions can be seen at the extreme left-hand side when a -ls --al command is issued in a Unix directory. For example:

    --rwxr--r--   1 tom     users   2014 Apr 13 14:11 access.conf

    -Windows, on the other hand, has four principal bits that it uses with any file: read-only, system, hidden, and archive. You can view these bits by right-clicking on the file and choosing the Properties menu item. You should see a dialog similar to -Figure 5.6.[1]

    -
    -

    -[1] The system checkbox will probably be greyed for your file. Don't worry about that - you should still be able to see when the box is checked and when it isn't.

    - -Figure 5.6: DOS and Windows file properties

    Figure 5.6

    -The definition of each of those bits follows:

    -
    Read-only
    -

    -The file's contents can be read by a user but cannot be written to.

    System
    -

    -This file has a specific purpose required by the operating system.

    Hidden
    -

    -This file has been marked to be invisible to the user, unless the operating systems is explicitly set to show it.

    Archive
    -

    -This file has been touched since the last DOS backup was performed on it.

    -Note that there is no bit to specify that a file is executable. DOS and Windows NT filesystems identify executable files by giving them the extensions .EXE, .COM, .CMD, or .BAT.

    -Consequently, there is no use for any of the three Unix executable bits that are present on a file in a Samba disk share. DOS files, however, have their own attributes that need to be preserved when they are stored in a Unix environment: the archive, system, and hidden bits. Samba can preserve these bits by reusing the executable permission bits of the file on the Unix side - if it is instructed to do so. Mapping these bits, however, has an unfortunate side-effect: if a Windows user stores a file in a Samba share, and you view it on Unix with the -ls --al command, some of the executable bits won't mean what you'd expect them to.

    -Three Samba options decide whether the bits are mapped: -map -archive, -map -system, and -map -hidden. These options map the archive, system, and hidden attributes to the owner, group, and world execute bits of the file, respectively. You can add these options to the -[data] share, setting each of their values as follows:

    -[data]
-	path = /home/samba/data
-	browseable = yes
-	guest ok = yes
-	writeable = yes
-	map archive = yes
-	map system = yes
-	map hidden = yes

    -After that, try creating a file in the share under Unix - such as -hello.java - and change the permissions of the file to 755. With these Samba options set, you should be able to check the permissions on the Windows side and see that each of the three values has been checked in the Properties dialog box. What about the read-only attribute? By default, Samba 2.0 sets this whenever a file does not have the Unix owner write permission bit set. In other words, you can set this bit by changing the permissions of the file to 555.

    -We should warn you that the default value of the -map -archive option is -yes, while the other two options have a default value of -no. This is because many programs do not work properly if the archive bit is not stored correctly for DOS and Windows files. The system and hidden attributes, however, are not critical for a program's operation and are left to the discretion of the administrator.

    - -Figure 5.7 summarizes the Unix permission bits and illustrates how Samba maps those bits to DOS attributes. Note that the group read/write and world read/write bits do not directly translate to a DOS attribute, but they still retain their original Unix definitions on the Samba server.

    - -Figure 5.7: How Samba and Unix view the permissions of a file

    Figure 5.7
    -

    - -5.3.1 Creation masks

    -Samba has several options to help with file creation masks. File creation masks (or -umasks) help to define the permissions a file or directory will receive at the time it is created. In Unix, this means that you can control what permissions a file or directory does not have when it is created. For files accessed from Windows, this means you can disable the read-only, archive, system, and hidden attributes of a file as well.

    -For example, the -create -mask option will force the permissions of a file created by a Windows client to be at most 744:

    -[data]
-	path = /home/samba/data
-	browseable = yes
-	guest ok = yes
-	writeable = yes
-	create mask = 744

    -while the -directory -mask option shown here will force the permissions of a newly created directory to be at most 755:

    -[data]
-	path = /home/samba/data
-	browseable = yes
-	guest ok = yes
-	writeable = yes
-	directory mask = 755

    -Alternatively, you can also force various bits with the -force -create -mode and -force -directory -mode options. These options will perform a logical OR against the file and directory creation masks, ensuring that those bits that are specified will always be set. You would typically set these options globally in order to ensure that group and world read/write permissions have been set appropriately for new files or directories in each share.

    -In the same spirit, if you wish to explicitly set the Unix user and group attributes of a file that is created on the Windows side, you can use the -force -user and -force -group options. For example:

    -[data]
-	path = /home/samba/data
-	browseable = yes
-	guest ok = yes
-	writeable = yes
-
-	create mask = 744
-	directory mask = 755
-	force user = joe
-	force group = accounting

    -These options actually assign a static Unix user and group to each connection that is made to a share. However, this occurs -after the client authenticates; it does not allow free access to a share. These options are frequently used for their side effects of assigning a specific user and group to each new file or directory that is created in a share. Use these options with discretion.

    -Finally, one of the capabilities of Unix that DOS lacks is the ability to delete a read-only file from a writable directory. In Unix, if a directory is writable, a read-only file in that directory can still be removed. This could permit you to delete files in any of your directories, even if the file was left by someone else.

    -DOS filesystems are not designed for multiple users, and so its designers decided that read-only means "protected against accidental change, including deletion," rather than "protected against some other user on a single-user machine." So the designers of DOS prohibited removal of a read-only file. Even today, Windows file systems exhibit the same behavior.

    -Normally, this is harmless. Windows programs don't try to remove read-only files because they know it's a bad idea. However, a number of source-code control programs - which were first written for Unix - run on Windows and require the ability to delete read-only files. Samba permits this behavior with the -delete -readonly option. In order to enable this functionality, set the option to -yes:

    -[data]
-	path = /home/samba/data
-	browseable = yes
-	guest ok = yes
-	writeable = yes
-
-	create mask = 744
-	directory mask = 755
-	force user = joe
-	force group = accounting
-	delete readonly = yes
    -

    - -5.3.2 File and Directory Permission Options

    The options for file and directory permissions are summarized in -Table 5.5; each option is then described in detail.


    - - - - - - - - - - - - - - -
    - -Table 5.5: File and Directory Permission Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -map archive

    		 -

    -boolean

    		 -

    -Preserve DOS archive attribute in user execute bit (0100).

    		 -

    - -yes

    		 -

    -Share

    -

    - -map system

    		 -

    -boolean

    		 -

    -Preserve DOS system attribute in group execute bit (0010).

    		 -

    - -no

    		 -

    -Share

    -

    - -map hidden

    		 -

    -boolean

    		 -

    -Preserve DOS hidden attribute in world execute bit (0001).

    		 -

    - -no

    		 -

    -Share

    -

    - -create mask (create mode)

    		 -

    -numeric

    		 -

    -Sets the maximum permissions for files created by Samba.

    		 -

    - -0744

    		 -

    -Share

    -

    - -directory mask (directory mode)

    		 -

    -numeric

    		 -

    -Sets the maximum permissions for directories created by Samba.

    		 -

    - -0755

    		 -

    -Share

    -

    - -force create mode

    		 -

    -numeric

    		 -

    -Forces the specified permissions (bitwise or) for directories created by Samba.

    		 -

    - -0000

    		 -

    -Share

    -

    - -force directory mode

    		 -

    -numeric

    		 -

    -Forces the specified permissions (bitwise or) for directories created by Samba.

    		 -

    - -0000

    		 -

    -Share

    -

    - -force group (group)

    		 -

    -string (group name)

    		 -

    -Sets the effective group for a user accessing this share.

    		 -

    -None

    		 -

    -Share

    -

    - -force user

    		 -

    -string (username)

    		 -

    -Sets the effective username for a user accessing this share.

    		 -

    -None

    		 -

    -Share

    -

    - -delete readonly

    		 -

    -boolean

    		 -

    -Allows a user to delete a read-only file from a writable directory.

    		 -

    - -no

    		 -

    -Share

    -

    - -5.3.2.1 create mask

    -The argument for this option is an octal number indicating which permission flags may be set at file creation by a client in a share. The default is 0755, which means the Unix owner can at most read, write, and optionally execute his or her own files, while members of the user's group and others can only read or execute them. If you need to change it for non-executable files, we recommend 0644, or -rw-r--r--. Keep in mind that the execute bits may be used by the server to map certain DOS file attributes, as described earlier. If you're altering the create mask, those bits have to be part of the create mask as well.

    -

    - -5.3.2.2 directory mask

    -The argument for this option is an octal number indicating which permission flags may be set at directory creation by a client in a share. The default is 0755, which allows everyone on the Unix side to at most read and traverse the directories, but allows only you to modify them. We recommend the mask 0750, removing access by world users.

    -

    - -5.3.2.3 force create mode

    -This option sets the permission bits that Samba will force to be set when a file permission change is made. It's often used to force group permissions, mentioned previously. It can also be used to preset any of the DOS attributes we mentioned: archive (0100), system (0010), or hidden (0001). This option always takes effect after the -map -archive, -map -system , -map -hidden, and -create -mask options.

    -Many Windows applications rename their data files to -datafile.bak and create new ones, thus changing their ownership and permissions so that members of the same Unix group can't edit them. Setting -force create mask = 0660 will keep the new file editable by members of the group.

    -

    - -5.3.2.4 force directory mode

    -This option sets the permission bits which Samba will force when a directory permission change is made or a directory is created. It's often used to force group permissions, as mentioned previously. This option defaults to 0000, and can be used just like the -force -create -mode to add group or other permissions if needed. This option always takes effect after the -map -archive, -map -system, -map -hidden, and -directory -mask options.

    -

    - -5.3.2.5 force group

    -This option, sometimes called -group, assigns a static group ID that will be used on all connections to a service after the client has successfully authenticated. This assigns a specific group to each new file or directory created from an SMB client.

    -

    - -5.3.2.6 force user

    -The -force -user option assigns a static user ID that will be used on all connections to a service after the client has successfully authenticated. This assigns a specific user to each new file or directory created from an SMB client.

    -

    - -5.3.2.7 delete readonly

    This option allows a user to delete a directory containing a read-only file. By default, DOS and Windows will not allow such an operation. You probably will want to leave this option turned off unless a program needs this capability; many Windows users would be appalled to find that they'd accidentally deleted a file which they had set read-only. In fact, even the Unix -rm command will ask users if they really want to override the protection and delete read-only files. It's a good idea to have Samba be at least as cautious.

    -

    - -5.3.2.8 map archive

    -The DOS archive bit is used to flag a file that has been changed since it was last archived (e.g., backed up with the DOS archive program.) Setting the Samba option -map -archive -= -yes causes the DOS archive flag to be mapped to the Unix execute-by-owner (0100) bit. It's best to leave this option on if your Windows users are doing their own backups, or are using programs that require the archive bit. Unix lacks the notion of an archive bit entirely. Backup programs typically keep a file that lists what files were backed up on what date, so comparing file modification dates serves the same purpose.

    -Setting this option to -yes causes an occasional surprise on Unix when a user notices that a data file is marked as executable, but rarely causes harm. If a user tries to run it, he or she will normally get a string of error messages as the shell tries to execute the first few lines as commands. The reverse is also possible; an executable Unix program looks like it hasn't been backed up recently on Windows. But again, this is rare, and is usually harmless.

    -

    - -5.3.2.9 map system

    -The DOS system attribute is used to indicate files that are required by the operating system, and should not be deleted, renamed, or moved without special effort. Set this option only if you need to store Windows system files on the Unix file server. Executable Unix programs will appear to be non-removable special Windows files when viewed from Windows clients. This may prove mildly inconvenient if you want to move or remove one. For most sites, however, this is fairly harmless.

    -

    - -5.3.2.10 map hidden

    DOS uses the hidden attribute to indicate that a file should not ordinarily be visible in directory listings. Unix doesn't have such a facility; it's up to individual programs (notably the shell) to decide what to display and what not to display. Normally, you won't have any DOS files that need to be hidden, so the best thing to do is to leave this option turned off.

    -Setting this option to -yes causes the server to map the hidden flag onto the executable-by-others bit (0001). This feature can produce a rather startling effect. Any Unix program that is executable by world seems to vanish when you look for it from a Windows client. If this option is not set, however, and a Windows user attempts to mark a file hidden on a Samba share, it will not work - Samba has no place to store the hidden attribute!

    -
    -
    -
    - - -
    - -Previous: 5.2 Filesystem Differences - - - -Next: 5.4 Name Mangling and Case
    -5.2 Filesystem Differences - -Book Index -5.4 Name Mangling and Case
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch05_04.html b/docs/htmldocs/using_samba/ch05_04.html deleted file mode 100644 index e506445c10..0000000000 --- a/docs/htmldocs/using_samba/ch05_04.html +++ /dev/null @@ -1,433 +0,0 @@ - - - -[Chapter 5] 5.4 Name Mangling and Case - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 5.3 File Permissions and Attributes on MS-DOS and Unix - - - -Chapter 5
    -Browsing and Advanced Disk Shares     		- -Next: 5.5 Locks and Oplocks
     
    - -
    -
    -

    - -5.4 Name Mangling and Case

    Back in the days of DOS and Windows 3.1, every filename was limited to eight upper-case characters, followed by a dot, and three more uppercase characters. This was known as the -8.3 format, and was a huge nuisance. Windows 95/98, Windows NT, and Unix have since relaxed this problem by allowing many more case-sensitive characters to make up a filename. -Table 5.6 shows the current naming state of several popular operating systems.


    - - - - - - - - - -
    - -Table 5.6: Operating System Filename Limitations
    -

    -Operating System

    		 -

    -File Naming Rules

    -

    -DOS 6.22 or below

    		 -

    Eight characters followed by a dot followed by a three-letter extension (8.3 format); case insensitive

    -

    -Windows 3.1 for Workgroups

    		 -

    -Eight characters followed by a dot followed by a three-letter extension (8.3 format); case insensitive

    -

    -Windows 95/98

    		 -

    -127 characters; case sensitive

    -

    -Windows NT

    		 -

    -127 characters; case sensitive

    -

    -Unix

    		 -

    -255 characters; case sensitive

    Samba still has to remain backwards compatible with network clients who store files only in the 8.3 format, such as Windows for Workgroups. If a user creates a file on a share called -antidisestablishmentarianism.txt, a Windows for Workgroups client couldn't tell it apart from another file in the same directory called -antidisease.txt. Like Windows 95/98 and Windows NT, Samba has to employ a special methodology of translating a long filename to an 8.3 filename in such a way that similar filenames will not cause collisions. This is called -name mangling, and Samba deals with this in a manner that is similar, but not identical to, Windows 95 and its successors.

    -

    - -5.4.1 The Samba Mangling Operation

    Here is how Samba mangles a long filename into an 8.3 filename:

      -
    • -

      - -If the original filename does not begin with a dot, up to the first five alphanumeric characters that occur before the last dot (if there is one) are converted to uppercase. These characters are used as the first five characters of the 8.3 mangled filename.

    • -

      - -If the original filename begins with a dot, the dot is removed and up to the first five alphanumeric characters that occur before the last dot (if there is one) are converted to uppercase. These characters are used as the first five characters of the 8.3 mangled filename.

    • -

      - -These characters are immediately followed a special mangling character: by default, a tilde (~), although Samba allows you to change this character.

    • -

      - -The base of the long filename before the last period is hashed into a two-character code; parts of the name after the last dot may be used if necessary. This two character code is appended to the 8.3 filename after the mangling character.

    • -

      - -The first three characters after the last dot (if there is one) of the original filename are converted to uppercase and appended onto the mangled name as the extension. If the original filename began with a dot, three underscores (___) are used as the extension instead.

    -Here are some examples:

    -virtuosity.dat                       VIRTU~F1.DAT
-.htaccess                            HTACC~U0.___
-hello.java                           HELLO~1F.JAV
-team.config.txt                      TEAMC~04.TXT
-antidisestablishmentarianism.txt     ANTID~E3.TXT
-antidiseast.txt                      ANTID~9K.TXT

    -Using these rules will allow Windows for Workgroups to differentiate the two files on behalf of the poor individual who is forced to see the network through the eyes of that operating system. Note that the same long filename should always hash to the same mangled name with Samba; this doesn't always happen with Windows. The downside of this approach is that there can still be collisions; however, the chances are greatly reduced.

    -You generally want to use the mangling configuration options with only the oldest clients. We recommend doing this without disrupting other clients by adding an -include directive to the -smb.conf file:

    -[global]
-	include = /ucsr/local/samba/lib/smb.conf.%m

    -This resolves to -smb.conf.WfWg when a Window for Workgroups client attaches. Now you can create a file -/usr/local/samba/lib/smb.conf.WfWg which might contain these options:

    -[global]
-	case sensitive = no
-	default case = upper
-	preserve case = no
-	short preserve case = no
-	mangle case = yes
-	mangled names= yes

    -If you are not using Windows for Workgroups 3.1, then you probably do not need to change any of these options from their defaults.

    -

    - -5.4.1.1 Representing and resolving filenames with Samba

    Another item that we should point out is that there is a difference between how an operating system -represents a file and how it -resolves it. For example, if you've used Windows 95/98/NT, you have likely run across a file called -README.TXT. The file can be represented by the operating system entirely in uppercase letters. However, if you open an MS-DOS prompt and enter the command -edit -readme.txt, the all-caps file is loaded into the editing program, even though you typed the name in lowercase letters!

    -This is because the Windows 95/98/NT family of operating systems resolves files in a case-insensitive manner, even though the files are represented it in a case-sensitive manner. Unix-based operating systems, on the other hand, always resolve files in a case-sensitive manner; if you try to edit -README.TXT with the command -vi -readme.txt, you will likely be editing the empty buffer of a new file.

    -Here is how Samba handles case: if the -preserve -case is set to -yes, Samba will always use the case provided by the operating system for representing (not resolving) filenames. If it is set to -no, it will use the case specified by the -default -case option. The same is true for -short -preserve -case. If this option is set to -yes, Samba will use the default case of the operating system for representing 8.3 filenames; otherwise it will use the case specified by the -default -case option. Finally, Samba will always resolve filenames in its shares based on the value of the -case -sensitive option.

    -

    - -5.4.2 Mangling Options

    Samba allows you to give it more refined instructions on how it should perform name mangling, including those controlling the case sensitivity, the character inserted to form a mangled name, and the ability to manually map filenames from one format to another. These options are shown in -Table 5.7.


    - - - - - - - - - - - - - -
    - -Table 5.7: Name Mangling Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -case sensitive

    - -(casesignames)

    		 -

    -boolean

    		 -

    -If -yes, Samba will treat filenames as case-sensitive (Windows doesn't).

    		 -

    - -no

    		 -

    -Share

    -

    - -default case

    		 -

    -(upper or -lower)

    		 -

    -Case to assume as default (only used when preserve case is -no).

    		 -

    -Lower

    		 -

    -Share

    -

    - -preserve case

    		 -

    -boolean

    		 -

    -If -yes, keep the case the client supplied (i.e., do not convert to -default case).

    		 -

    - -yes

    		 -

    -Share

    -

    - -short preserve case

    		 -

    -boolean

    		 -

    -If -yes, preserve case of 8.3-format names that the client provides.

    		 -

    - -yes

    		 -

    -Share

    -

    - -mangle case

    		 -

    -boolean

    		 -

    -Mangle a name if it is mixed case.

    		 -

    - -no

    		 -

    -Share

    -

    - -mangled names

    		 -

    -boolean

    		 -

    -Mangles long names into 8.3 DOS format.

    		 -

    - -yes

    		 -

    -Share

    -

    - -mangling char

    		 -

    -string (single character)

    		 -

    -Gives mangling character.

    		 -

    - -~

    		 -

    -Share

    -

    - -mangled stack

    		 -

    -numerical

    		 -

    -Number of mangled names to keep on the local mangling stack.

    		 -

    - -50

    		 -

    -Global

    -

    - -mangled map

    		 -

    -string (list of patterns)

    		 -

    -Allows mapping of filenames from one format into another.

    		 -

    -None

    		 -

    -Share

    -

    - -5.4.2.1 case sensitive

    This share-level option, which has the obtuse synonym -casesignames, specifies whether Samba should preserve case when resolving filenames in a specific share. The default value for this option is -no, which is how Windows handles file resolution. If clients are using an operating system that takes advantage of case-sensitive filenames, you can set this configuration option to -yes as shown here:

    -[accounting]
-	case sensitive = yes

    -Otherwise, we recommend that you leave this option set to its default.

    -

    - -5.4.2.2 default case

    -The -default -case option is used with -preserve -case. This specifies the default case (upper or lower) that Samba will use when it creates a file on one of its shares on behalf of a client. The default case is -lower, which means that newly created files will use the mixed-case names given to them by the client. If you need to, you can override this global option by specifying the following:

    -[global]
-	default case = upper

    -If you specify this value, the names of newly created files will be translated into uppercase, and cannot be overridden in a program. We recommend that you use the default value unless you are dealing with a Windows for Workgroups or other 8.3 client, in which case it should be -upper.

    -

    - -5.4.2.3 preserve case

    -This option specifies whether a file created by Samba on behalf of the client is created with the case provided by the client operating system, or the case specified by the -default -case configuration option above. The default value is -yes, which uses the case provided by the client operating system. If it is set to -no, the value of the -default -case option is used.

    -Note that this option does not handle 8.3 file requests sent from the client - see the -short -preserve -case option below. You may want to set this option to -yes if applications that create files on the Samba server are sensitive to the case used when creating the file. If you want to force Samba, for example, to mimic the behavior of a Windows NT filesystem, you can leave this option to its default, -yes.

    -

    - -5.4.2.4 short preserve case

    -This option specifies whether an 8.3 filename created by Samba on behalf of the client is created with the default case of the client operating system, or the case specified by the -default -case configuration option. The default value is -yes, which uses the case provided by the client operating system. You can let Samba choose the case through the -default -case option by setting it as follows:

    -[global]
-	short preserve case = no

    -If you want to force Samba to mimic the behavior of a Windows NT filesystem, you can leave this option set to its default, -yes.

    -

    - -5.4.2.5 mangled names

    -This share-level option specifies whether Samba will mangle filenames for 8.3 clients in that share. If the option is set to -no, Samba will not mangle the names and (depending on the client), they will either be invisible or appear truncated to those using 8.3 operating systems. The default value is -yes. You can override it per share as follows:

    -[data]
-	mangled names = no
    -

    - -5.4.2.6 mangle case

    -This option tells Samba whether it should mangle filenames that are not composed entirely of the case specified using the -default -case configuration option. The default for this option is -no. If you set it to -yes, you should be sure that all clients will be able to handle the mangled filenames that result. You can override it per share as follows:

    -[data]
-	mangle case = yes

    -We recommend that you leave this option alone unless you have a well-justified need to change it.

    -

    - -5.4.2.7 mangling char

    -This share-level option specifies the mangling character used when Samba mangles filenames into the 8.3 format. The default character used is a tilde (~). You can reset it to whatever character you wish, for instance:

    -[data]
-	mangling char = #
    -

    - -5.4.2.8 mangled stack

    -Samba maintains a local stack of recently mangled 8.3 filenames; this stack can be used to reverse map mangled filenames back to their original state. This is often needed by applications that create and save a file, close it, and need to modify it later. The default number of long filename/mangled filename pairs stored on this stack is 50. However, if you want to cut down on the amount of processor time used to mangle filenames, you can increase the size of the stack to whatever you wish, at the expense of memory and slightly slower file access.

    -[global]
-	mangled stack = 100
    -

    - -5.4.2.9 mangled map

    -If the default behavior of name mangling is not sufficient, you can give Samba further instructions on how to behave using the -mangled -map option. This option allows you to specify mapping patterns that can be used before or even in place of name mangling performed by Samba. For example:

    -[data]
-	mangled map =(*.database *.db) (*.class *.cls)

    -Here, Samba is instructed to search each file it encounters for characters that match the first pattern specified in the parenthesis and convert them to the modified second pattern in the parenthesis for display on an 8.3 client. This is useful in the event that name mangling converts the filename incorrectly or to a format that the client cannot understand readily. Patterns are separated by whitespaces.

    -
    -
    -
    - - -
    - -Previous: 5.3 File Permissions and Attributes on MS-DOS and Unix - - - -Next: 5.5 Locks and Oplocks
    -5.3 File Permissions and Attributes on MS-DOS and Unix - -Book Index -5.5 Locks and Oplocks
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch05_05.html b/docs/htmldocs/using_samba/ch05_05.html deleted file mode 100644 index b0298624f8..0000000000 --- a/docs/htmldocs/using_samba/ch05_05.html +++ /dev/null @@ -1,399 +0,0 @@ - - - -[Chapter 5] 5.5 Locks and Oplocks - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 5.4 Name Mangling and Case - - - -Chapter 5
    -Browsing and Advanced Disk Shares     		- -Next: 6. Users, Security, and Domains
     
    - -
    -
    -

    - -5.5 Locks and Oplocks

    Concurrent writes to a single file are not desirable in any operating system. To prevent this, most operating systems use -locks to guarantee that only one process can write to a file at a time. Operating systems traditionally lock entire files, although newer ones allow a range of bytes within a file to be locked. If another process attempts to write to a file (or section of one) that is already locked, it will receive an error from the operating system and will wait until the lock is released.

    -Samba supports the standard DOS and NT filesystem (deny-mode) locking requests, which allow only one process to write to an entire file on a server at a give time, as well as byte-range locking. In addition, Samba supports a new locking mechanism known in the Windows NT world as -opportunistic locking - -oplock for short.

    -

    - -5.5.1 Opportunistic Locking

    -Opportunistic locking allows a client to notify the Samba server that it will not only be the exclusive writer of a file, but will also cache its changes to that file on its own machine (and not on the Samba server) in order to speed up file access for that client. When Samba knows that a file has been opportunistically locked by a client, it marks its version as having an opportunistic lock and waits for the client to complete work on the file, at which point it expects the client to send the final changes back to the Samba server for synchronization.

    -If a second client requests access to that file before the first client has finished working on it, Samba can send an -oplock break request to the first client. This tells the client to stop caching its changes and return the current state of the file to the server so that the interrupting client can use it as it sees fit. An opportunistic lock, however, is not a replacement for a standard deny-mode lock. It is not unheard of for the interrupting process to be granted an oplock break only to discover that the original process also has a deny-mode lock on a file as well. -Figure 5.8 illustrates this opportunistic locking process.

    - -Figure 5.8: Opportunistic locking

    Figure 5.8

    -In terms of locks, we highly recommend using the defaults provided by Samba: standard DOS/Windows deny-mode locks for compatibility and oplocks for the extra performance that local caching allows. If your operating system can take advantage of oplocks, it should provide significant performance improvements. Unless you have a specific reason for changing any of these options, it's best to leave them as they are.

    -

    - -5.5.2 Unix and Locking

    Windows systems cooperate well to avoid overwriting each other's changes. But if a file stored on a Samba system is accessed by a Unix process, this process won't know a thing about Windows oplocks and could easily ride roughshod over a lock. Some Unix systems have been enhanced to understand the Windows oplocks maintained by Samba. Currently the support exists only in SGI Irix 6.5.2f and later; Linux and FreeBSD should soon follow.

    -If you have a system that understands oplocks, set -kernel -oplocks -= -yes in the Samba configuration file. That should eliminate conflicts between Unix processes and Windows users.

    -If your system does not support kernel oplocks, you could end up with corrupted data when somebody runs a Unix process that reads or writes a file that Windows users also access. However, Samba provides a rough protection mechanism in the absence of kernel oplocks: the -veto -oplock -files option. If you can anticipate which Samba files are used by both Windows users and Unix users, set their names in a -veto -oplock -files option. This will suppress the use of oplocks on matching filenames, which will supress client caching, and let the Windows and Unix programs use system locking or update times to detect competition for the same file. A sample option is: 

    -veto oplock files = /*.dbm/

    -This option allows both Unix processes and Windows users to edit files ending in the suffix -.dbm. Note that the syntax of this option is similar to -veto -files.

    -Samba's options for locks and oplocks are given in -Table 5.8.


    - - - - - - - - - - - - - -
    - -Table 5.8: Locks and Oplocks Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -share modes

    		 -

    boolean

    		 -

    -If set to -yes, turns on support for DOS-style whole-file locks.

    		 -

    - -yes

    		 -

    -Share

    -

    - -locking

    		 -

    -boolean

    		 -

    -If -yes, turns on byte-range locks.

    		 -

    - -yes

    		 -

    -Share

    -

    - -strict locking

    		 -

    -boolean

    		 -

    -If -yes, denies access to an entire file if a byte-range lock exists in it.

    		 -

    - -no

    		 -

    -Share

    -

    - -oplocks

    		 -

    -boolean

    		 -

    -If -yes, turn on local caching of files on the client for this share.

    		 -

    - -yes

    		 -

    -Share

    -

    - -kernel oplocks

    		 -

    -boolean

    		 -

    -If -yes, indicates that the kernel supports oplocks.

    		 -

    - -yes

    		 -

    -Global

    -

    - -fake oplocks

    		 -

    -boolean

    		 -

    -If -yes, tells client the lock was obtained, but doesn't actually lock it.

    		 -

    - -no

    		 -

    -Share

    -

    - -blocking locks

    		-

    -boolean

    		 -

    -Allows lock requestor to wait for the lock to be granted.

    		 -

    - -yes

    		 -

    -Share

    -

    - -veto oplock files

    		 -

    -string (list of filenames)

    		 -

    -Does not oplock specified files.

    		 -

    -None

    		 -

    -Share

    -

    - -lock directory

    		 -

    -string (fully-qualified pathname)

    		 -

    -Sets the location where various Samba files, including locks, are stored.

    		 -

    -As specified in Samba makefile

    		 -

    -Global

    -

    - -5.5.2.1 share modes

    -The most primitive locks available to Samba are deny-mode locks, known as -share modes, which are employed by programs such as text editors to avoid accidental overwriting of files. For reference, the deny-mode locks are listed in -Table 5.9.


    - - - - - - - - - - -
    - -Table 5.9: SMB Deny-Mode Locks
    -

    -Lock

    		 -

    -Description

    -

    - -DENY_NONE

    		 -

    -Do not deny any other file requests.

    -

    - -DENY_ALL

    		 -

    -Deny all open requests on the current file.

    -

    - -DENY_READ

    		 -

    -Deny any read-only open requests on the current file.

    -

    - -DENY_WRITE

    		 -

    -Deny any write-only open requests on the current file.

    -

    - -DENY_DOS

    		 -

    -If opened for reading, others can read but cannot write to the file. If opened for writing, others cannot open the file at all.

    -

    - -DENY_FCB

    		 -

    -Obsolete.

    -The -share -modes parameter, which enforces the use of these locks, is enabled by default. To disable it, use the following command:

    -[accounting]
-	share modes = no

    -We highly recommend against disabling the default locking mechanism unless you have a justifiable reason for doing so. Most Windows and DOS applications rely on these locking mechanisms in order to work correctly, and will complain bitterly if this functionality is taken away.

    -

    - -5.5.2.2 locking

    -The -locking option can be used to tell Samba to engage or disengage server-side byte-range locks on behalf of the client. Samba implements byte-range locks on the server side with normal Unix advisory locks and will consequently prevent other properly-behaved Unix processes from overwriting a locked byte range.

    -This option can be specified per share as follows:

    -[accounting]
-	locking = yes

    -If the -locking option is set to -yes, the requestor will be delayed until the holder of either type of lock releases it (or crashes). If, however, the option is set to -no, no byte-range locks will be kept for the files, although requests to lock and unlock files will appear to succeed. The option is set to -yes by default; however, you can turn this option off if you have read-only media.

    -

    - -5.5.2.3 strict locking

    -This option checks every file access for a byte-range lock on the range of bytes being accessed. This is typically not needed if a client adheres to all the locking mechanisms in place. This option is set to -no by default; however, you can reset it per share as follows:

    -[accounting]
-	strict locking = yes

    -If this option is set to -yes, mandatory locks are enforced on any file with byte-range locks.

    -

    - -5.5.2.4 blocking locks

    -Samba also supports -blocking locks, a minor variant of range locks. Here, if the range of bytes is not available, the client specifies an amount of time that it's willing to wait. The server then caches the lock request, periodically checking to see if the file is available. If it is, it notifies the client; however, if time expires, Samba will tell the client that the request has failed. This strategy prevents the client from continually polling to see if the lock is available.

    -You can disable this option per share as follows:

    -[accounting]
-	blocking locks = no

    -When set to -yes, blocking locks will be enforced on the file. If this option is set to -no, Samba behaves as if normal locking mechanisms are in place on the file. The default is -yes.

    -

    - -5.5.2.5 oplocks

    -This option enables or disables support for oplocks on the client. The option is enabled by default. However, you can disable it with the following command:

    -[data]
-	oplocks = no

    -If you are in an extremely unstable network environment or have many clients that cannot take advantage of opportunistic locking, it may be better to shut this Samba feature off. Oplocks should be disabled if you are accessing the same files from both Unix applications (such as -vi) and SMB clients (unless you are lucky enough to have an operating system that supports kernel oplocks as discussed earlier).

    -

    - -5.5.2.6 fake oplocks

    -Before opportunistic locking was available on Samba, the Samba daemons pretended to allow oplocks via the -fake -oplocks option. If this option was enabled, all clients were told that the file is available for opportunistic locking, and never warned of simultaneous access. This option is deprecated now that real oplocks are available on Samba.

    -

    - -5.5.2.7 kernel oplocks

    -If a Unix application separate from Samba tries to update a file that Samba has oplocked to a Windows client, it will likely succeed (depending on the operating system) and both Samba and the client will never be aware of it. However, if the local Unix operating system supports it, Samba can warn it of oplocked files, which can suspend the Unix process, notify the client via Samba to write its copy back, and only then allow the open to complete. Essentially, this means that the operating system kernel on the Samba system has the ability to handle oplocks as well as Samba.

    -You can enable this behavior with the -kernel -oplocks option, as follows:

    -[global]
-	kernel oplocks = yes

    -Samba can automatically detect kernel oplocks and use them if present. At the time of this writing, this feature is supported only by SGI Irix 6.5.2f and later. However, Linux and FreeBSD support are expected in the near future. A system without kernel oplocks will allow the Unix process to update the file, but the client programs will notice the change only at a later time, if at all.

    -

    - -5.5.2.8 veto oplock files

    -You can provide a list of filenames that are never granted opportunistic locks with the -veto -oplock -files option. This option can be set either globally or on a per-share basis. For example:

    -veto oplock files = /*.bat/*.htm/

    -The value of this option is a series of patterns. Each pattern entry must begin, end, or be separated from another with a slash (/) character, even if there is only one pattern listed. Asterisks can be used as a wildcard to represent zero or more characters. Questions marks can be used to represent exactly one character.

    -We recommend that you disable oplocks on any files that are meant to be updated by Unix or are intended to be shared by several processes simultaneously.

    -

    - -5.5.2.9 lock directory

    -This option (sometimes called -lock -dir) specifies the location of a directory where Samba will store SMB deny-mode lock files. Samba stores other files in this directory as well, such as browse lists and its shared memory file. If WINS is enabled, the WINS database is written to this directory as well. The default for this option is specified in the Samba makefile; it is typically -/usr/local/samba/var/locks. You can override this location as follows:

    -[global]
-	lock directory = /usr/local/samba/locks

    -You typically would not need to override this option, unless you want to move the lock files to a more standardized location, such as -/var/spool/locks.

    -
    -
    -
    - - -
    - -Previous: 5.4 Name Mangling and Case - - - -Next: 6. Users, Security, and Domains
    -5.4 Name Mangling and Case - -Book Index -6. Users, Security, and Domains
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch06_01.html b/docs/htmldocs/using_samba/ch06_01.html deleted file mode 100644 index 439e66f394..0000000000 --- a/docs/htmldocs/using_samba/ch06_01.html +++ /dev/null @@ -1,221 +0,0 @@ - - - -[Chapter 6] Users, Security, and Domains - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 5.5 Locks and Oplocks - - -Chapter 6 - -Next: 6.2 Controlling Access to Shares
     
    - -
    -
    -

    - -6. Users, Security, and Domains

    -

    - -Contents:
    - -Users and Groups
    - -Controlling Access to Shares
    - -Authentication Security
    - -Passwords
    - -Windows Domains
    - -Logon Scripts

    -

    -This chapter discusses how to configure users with the Samba server. This topic may seem straightforward at first, but you'll soon discover that there are several ancillary problems that can crop up. One issue that Samba administrators have difficulty with is user authentication - password and security problems are by far the most common support questions on the Samba mailing lists. Learning why various authentication mechanisms work on certain architectures (and don't on others) can save you a tremendous amount of time testing and debugging Samba users in the future.

    -

    - - -6.1 Users and Groups

    Before we start, we need to warn you up front that if you are connecting to Samba with a Windows 98 or NT 4.0 Workstation SP3, you need to configure your server for encrypted passwords before you can make a connection; otherwise, the clients will refuse to connect to the Samba server. This is because each of those Windows clients sends encrypted passwords, and Samba needs to be configured to expect and decrypt them. We'll show you how to set up Samba for this task later in the chapter, assuming you haven't already tackled this problem in Chapter 2, Installing Samba on a Unix System.

    Let's start with a single user. The easiest way to set up a client user is to create a Unix account (and home directory) for that individual on the server, and notify Samba of the user's existence. You can do the latter by creating a disk share that maps to the user's home directory in the Samba configuration file, and restricting access to that user with the -valid -users option. For example:

    -[dave]
-		path = /home/dave
-		comment = Dave's home directory
-		writeable = yes
-		valid users = dave

    -The -valid -users option lists the users that will be allowed to access the share. In this case, only the user -dave is allowed to access the share. In the previous chapters, we specified that any user could access a disk share using the -guest -ok parameter. Because we don't wish to allow guest access, that option is absent here. We could grant both authenticated users and guest users access to a specific share if we wanted to. The difference between the two typically involves access rights for each of the files.

    -Remember that you can abbreviate the user's home directory by using the -%H variable. In addition, you can use the Unix username variable -%u and/or the client username variable -%U in your options as well. For example:

    -[dave]
-	comment = %U home directory
-	writeable = yes
-	valid users = dave
-	path = %H

    -Both of these examples work as long as the Unix user that Samba uses to represent the client has read/write access to the directory referenced by the -path option. In other words, a client must first pass Samba's security mechanisms (e.g., encrypted passwords, the -valid users option, etc.) as well as the normal Unix file and directory permissions of its Unix-side user -before it can gain read/write access to a share.

    -With a single user accessing a home directory, access permissions are taken care of when the operating system creates the user account. However, if you're creating a shared directory for group access, there are a few more steps you need to perform. Let's take a stab at a group share for the accounting department in the -smb.conf file:

    -[accounting]
-	comment = Accounting Department Directory
-	writeable = yes
-	valid users = @account
-	path = /home/samba/accounting
-	create mode = 0660
-	directory mode = 0770

    -The first thing that you might notice we did differently is to specify -@account as the valid user instead of one or more individual usernames. This is shorthand for saying that the valid users are represented by the Unix group -account. These users will need to be added to the group entry -account in the system group file (/etc/group or equivalent) to be recognized as part of the group. Once they are, Samba will recognize those users as valid users for the share.

    -In addition, you will need to create a shared directory that the members of the group can access, which is pointed to by the -path configuration option. Here are the Unix commands that create the shared directory for the accounting department (assuming -/home/samba already exists):

    # mkdir /home/samba/accounting
-# chgrp account /home/samba/accounting
-# chmod 770 /home/samba/accounting

    -There are two other options in this -smb.conf example, both of which we saw in the previous chapter. These options are -create -mode and -directory -mode. These options set the maximum file and directory permissions that a new file or directory can have. In this case, we have denied all world access to the contents of this share. (This is reinforced by the -chmod command, shown earlier.).

    -

    - -6.1.1 The [homes] Share

    -Let's return to user shares for a moment. If we have several users to set up home directory shares for, we probably want to use the special -[homes] share that we introduced in Chapter 5, Browsing and Advanced Disk Shares. With the -[homes] share, all we need to say is: 

    -[homes]
-
-	browsable = no
-	writable = yes

    -The -[homes] share is a special section of the Samba configuration file. If a user attempts to connect to an ordinary share that doesn't appear in the -smb.conf file (such as specifying it with a UNC in Windows Explorer), Samba will search for a -[homes] share. If one exists, the incoming share name is assumed to be a username and is queried as such in the password database (/etc/passwd or equivalent) file of the Samba server. If it appears, Samba assumes the client is a Unix user trying to connect to his or her home directory.

    -As an illustration, let's assume that -sofia is attempting to connect to a share called [sofia] on the Samba server. There is no share by that name in the configuration file, but a -[homes] share exists and user -sofia is present in the password database, so Samba takes the following steps:

      -
    1. -

      - -Samba creates a new disk share called -[sofia] with the -path specified in the -[homes] section. If there is no -path option specified in -[homes], Samba initializes it to her home directory.

    2. -

      - -Samba initializes the new share's options from the defaults in -[globals], and any overriding options in -[homes] with the exception of -browseable.

    3. -

      - -Samba connects -sofia's client to that share.

    -The -[homes] share is a fast, painless way to create shares for your user community without having to duplicate the information from the password database file in the -smb.conf file. It does have some peculiarities, however, that we need to point out:

      -
    • -

      - -The -[homes] section can represent any account on the machine, which isn't always desirable. For example, it can potentially create a share for -root, -bin, -sys, -uucp, and the like. (You can set a global -invalid -users option to protect against this.)

    • -

      - -The meaning of the -browseable configuration option is different from other shares; it indicates only that a -[homes] section won't show up in the local browse list, not that the -[alice] share won't. When the -[alice] section is created (after the initial connection), it will use the browsable value from the -[globals] section for that share, not the value from -[homes].

    -As we mentioned, there is no need for a path statement in -[homes] if the users have Unix home directories in the server's -/etc/passwd file. You should ensure that a valid home directory does exist, however, as Samba will not automatically create a home directory for a user, and will refuse a tree connect if the user's directory does not exist or is not accessible.

    -
    -
    -
    - - -
    - -Previous: 5.5 Locks and Oplocks - - - -Next: 6.2 Controlling Access to Shares
    -5.5 Locks and Oplocks - -Book Index -6.2 Controlling Access to Shares
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch06_02.html b/docs/htmldocs/using_samba/ch06_02.html deleted file mode 100644 index a5b7bf4d52..0000000000 --- a/docs/htmldocs/using_samba/ch06_02.html +++ /dev/null @@ -1,423 +0,0 @@ - - - -[Chapter 6] 6.2 Controlling Access to Shares - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 6.1 Users and Groups - - - -Chapter 6
    -Users, Security, and Domains     		- -Next: 6.3 Authentication Security
     
    - -
    -
    -

    - -6.2 Controlling Access to Shares

    Often you will need to restrict the users who can access a specific share for security reasons. This is very easy to do with Samba since it contains a wealth of options for creating practically any security configuration. Let's introduce a few configurations that you might want to use in your own Samba setup.

    -

    - -WARNING: Again, if you are connecting with Windows 98 or NT 4.0 with Service Pack 3 (or above), those clients will send encrypted passwords to the Samba server. If Samba is not configured for this, it will continually refuse the connection. This chapter describes how to set up Samba for encrypted passwords. See the -Section 6.4, Passwords section.

    -We've seen what happens when you specify valid users. However, you are also allowed to specify a list of invalid users - users who should never be allowed access to Samba or its shares. This is done with the -invalid -users option. We hinted at one frequent use of this option earlier: a global default with the -[homes] section to ensure that various system users and superusers cannot be forged for access. For example:

    -[global]
-	invalid users = root bin daemon adm sync shutdown \
-						halt mail news uucp operator gopher
-	auto services = dave peter bob
-
-[homes]
-	browsable = no
-	writeable = yes

    -The -invalid -users option, like -valid -users, can take group names as well as usernames. In the event that a user or group appears in both lists, the -invalid -users option takes precedence and the user or group will be denied access to the share.

    -At the other end of the spectrum, you can explicitly specify users who will be allowed superuser (root) access to a share with the -admin -users option. An example follows:

    -[sales]
-		path = /home/sales
-		comment = Fiction Corp Sales Data
-		writeable = yes
-		valid users = tom dick harry
-		admin users = mike

    -This option takes both group names and usernames. In addition, you can specify NIS netgroups by preceding them with an -@ as well; if the netgroup is not found, Samba will assume that you are referring to a standard Unix group.

    -Be careful if you assign an entire group administrative privileges to a share. The Samba team highly recommends you avoid using this option, as it essentially gives root access to the specified users or groups for that share.

    -If you wish to force read-only or read-write access to users who access a share, you can do so with the -read -list and -write -list options, respectively. These options can be used on a per-share basis to restrict a writable share or grant write access to specific users in a read-only share, respectively. For example:

    -[sales]
-		path = /home/sales
-		comment = Fiction Corp Sales Data
-		read only = yes
-		write list = tom dick

    -The -write -list option cannot override Unix permissions. If you've created the share without giving the write-list user write permission on the Unix system, he or she will be denied write access regardless of the setting of -write -list.

    -

    - -6.2.1 Guest Access

    As mentioned earlier, you can specify users who have guest access to a share. The options that control guest access are easy to work with. The first option, -guest -account, specifies the Unix account that guest users should be assigned when connecting to the Samba server. The default value for this is set during compilation, and is typically -nobody. However, you may want to reset the guest user to -ftp if you have trouble accessing various system services.

    -If you wish to restrict access in a share only to guests - in other words, all clients connect as the guest account when accessing the share - you can use the -guest -only option in conjunction with the -guest ok option, as shown in the following example:

    -[sales]
-		path = /home/sales
-		comment = Fiction Corp Sales Data
-		writeable = yes
-		guest ok = yes
-		guest account = ftp
-		guest only = yes

    -Make sure you specify -yes for both -guest only and -guest ok in this scenario; otherwise, Samba will not use the guest acount that you specify.

    -

    - -6.2.2 Access Control Options

    -Table 6.1 summarizes the options that you can use to control access to shares.


    - - - - - - - - - - - - -
    - -Table 6.1: Share-level Access Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -admin users

    		 -

    -string (list of usernames)

    		 -

    -Specifies a list of users who can perform operations as root.

    		 -

    -None

    		 -

    -Share

    -

    - -valid users

    		 -

    -string (list of usernames)

    		 -

    -Specifies a list of users that can connect to a share.

    		 -

    -None

    		 -

    -Share

    -

    - -invalid users

    		 -

    -string (list of usernames)

    		 -

    -Specifies a list of users that will be denied access to a share.

    		 -

    -None

    		 -

    -Share

    -

    - -read list

    		 -

    -string (list of usernames)

    		 -

    -Specifies a list of users that have read-only access to a writable share.

    		 -

    -None

    		 -

    -Share

    -

    - -write list

    		 -

    -string (list of usernames)

    		 -

    -Specifies a list of users that have read-write access to a read-only share.

    		 -

    -None

    		 -

    -Share

    -

    - -max connections

    		 -

    -numerical

    		 -

    -Indicates the maximum number of connections for a share at a given time.

    		 -

    - -0

    		 -

    -Share

    -

    - -guest only (only guest)

    		 -

    -boolean

    		 -

    -Specifies that this share allows only guest access.

    		 -

    - -no

    		 -

    -Share

    -

    - -guest account

    		 -

    -string (name of account)

    		 -

    -Names the Unix account that will be used for guest access.

    		 -

    - -nobody

    		 -

    -Share

    -

    - -6.2.2.1 admin users

    -This option specifies a list of users that perform file operations as if they were -root. This means that they can modify or destroy any other user's work, no matter what the permissions. Any files that they create will have root ownership and will use the default group of the admin user. The -admin -users option is used to allow PC users to act as administrators for particular shares. We urge you to avoid this option.

    -

    - -6.2.2.2 valid users and invalid users

    -These two options let you enumerate the users and groups who are granted or denied access to a particular share. You can enter a list of comma-delimited users, or indicate an NIS or Unix group name by prefixing the name with an at-sign (@).

    -The important rule to remember with these options is that any name or group in the -invalid -users list will -always be denied access, even if it is included (in any form) in the -valid -users list. By default, neither option has a value associated with it. If both options have no value, any user is allowed to access the share.

    -

    - -6.2.2.3 read list and write list

    -Like the -valid -users -and -invalid -users options, this pair of options specifies which users have read-only access to a writeable share and read-write access to a read-only share, respectively. The value of either options is a list of users. -read -list overrides any other Samba permissions granted - as well as Unix file permissions on the server system - to deny users write access. -write -list overrides other Samba permissions to grant write access, but cannot grant write access if the user lacks write permissions for the file on the Unix system. You can specify NIS or Unix group names by prefixing the name with an at sign (such as -@users). Neither configuration option has a default value associated with it.

    -

    - -6.2.2.4 max connections

    -This option specifies the maximum number of client connections that a share can have at any given time. Any connections that are attempted after the maximum is reached will be rejected. The default value is -0, which means that an unlimited number of connections are allowed. You can override it per share as follows:

    -[accounting]
-	max connections = 30

    -This option is useful in the event that you need to limit the number of users who are accessing a licensed program or piece of data concurrently.

    -

    - -6.2.2.5 guest only

    -This share-level option (sometimes called -only -guest) forces a connection to a share to be performed with the user specified by the -guest -account option. The share to which this is applied must explicitly specify -guest -ok -= -yes in order for this option to be recognized by Samba. The default value for this option is -no.

    -

    - -6.2.2.6 guest account

    -This option specifies the name of account to be used for guest access to shares in Samba. The default for this option varies from system to system, but it is often set to -nobody. Some default user accounts have trouble connecting as guest users. If that occurs on your system, the Samba team recommends using the ftp account as the guest user.

    -

    - -6.2.3 Username Options

    -Table 6.2 shows two additional options that Samba can use to correct for incompatibilities in usernames between Windows and Unix.


    - - - - - - -
    - -Table 6.2: Username Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -username map

    		 -

    -string (fully-qualified pathname)

    		 -

    -Sets the name of the username mapping file.

    		 -

    -None

    		 -

    -Global

    -

    - -username level

    		 -

    -numerical

    		 -

    -Indicates the number of capital letters to use when trying to match a username.

    		 -

    - -0

    		 -

    -Global

    -

    - -6.2.3.1 username map

    Client usernames on an SMB network can be relatively large (up to 255 characters), while usernames on a Unix network often cannot be larger than eight characters. This means that an individual user may have one username on a client and another (shorter) one on the Samba server. You can get past this issue by - mapping a free-form client username to a Unix username of eight or fewer characters. It is placed in a standard text file, using a format that we'll describe shortly. You can then specify the pathname to Samba with the global -username -map option. Be sure to restrict access to this file; make the root user the file's owner and deny write access to others. Otherwise, an untrusted user who can access the file can easily map their client username to the root user of the Samba server.

    -You can specify this option as follows:

    -[global]
-	username map = /etc/samba/usermap.txt

    -Each of the entries in the username map file should be listed as follows: the Unix username, followed by an equal sign (=), followed by one or more whitespace-separated SMB client usernames. Note that unless instructed otherwise, (i.e., a guest connection), Samba will expect both the client and the server user to have the same password. You can also map NT groups to one or more specific Unix groups using the -@ sign. Here are some examples:

    -jarwin = JosephArwin
-manderso = MarkAnderson
-users = @account

    -Also, you can use the asterisk to specify a wildcard that matches any free-form client username as an entry in the username map file:

    -nobody = *

    -Comments in the file can be specified as lines beginning with (#) and (;).

    -Note that you can also use this file to redirect one Unix user to another user. Be careful if you do so because Samba and your client may not notify the user that the mapping has been made and Samba may be expecting a different password.

    -

    - -6.2.3.2 username level

    SMB clients (such as Windows) will often send usernames in SMB connection requests entirely in capital letters; in other words, client usernames are not necessarily case sensitive. On a Unix server, however, usernames -are case sensitive: the user -ANDY is different from the user -andy. By default, Samba attacks this problem by doing the following:

      -
    1. -

      - -Checking for a user account with the exact name sent by the client

    2. -

      - -Testing the username in all lowercase letters

    3. -

      - -Testing the username in lowercase letters with only the first letter capitalized

    -If you wish to have Samba attempt more combinations of uppercase and lowercase letters, you can use the -username -level global configuration option. This option takes an integer value that specifies how many letters in the username should be capitalized when attempting to connect to a share. You can specify this options as follows:

    -[global]
-	username level = 3

    -In this case, Samba will then attempt all permutations of usernames it can compute having three capital letters. The larger the number, the more computations Samba will have to perform to match the username and the longer the authentication will take.

    -
    -
    -
    - - -
    - -Previous: 6.1 Users and Groups - - - -Next: 6.3 Authentication Security
    -6.1 Users and Groups - -Book Index -6.3 Authentication Security
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch06_03.html b/docs/htmldocs/using_samba/ch06_03.html deleted file mode 100644 index a9e1b7ace7..0000000000 --- a/docs/htmldocs/using_samba/ch06_03.html +++ /dev/null @@ -1,384 +0,0 @@ - - - -[Chapter 6] 6.3 Authentication Security - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 6.2 Controlling Access to Shares - - - -Chapter 6
    -Users, Security, and Domains     		- -Next: 6.4 Passwords
     
    - -
    -
    -

    - -6.3 Authentication Security

    At this point, we should discuss how Samba authenticates users. Each user who attempts to connect to a share that does not allow guest access must provide a password to make a successful connection. What Samba does with that password - and consequently the strategy Samba will use to handle user authentication - is the arena of the -security configuration option. There are currently four security levels that Samba supports on its network: -share, -user, -server, and -domain.

    -
    Share-level security
    -

    -Each share in the workgroup has one or more passwords associated with it. Anyone who knows a valid password for the share can access it.

    User-level security
    -

    -Each share in the workgroup is configured to allow access from certain users. With each initial tree connection, the Samba server verifies users and their passwords to allow them access to the share.

    -Server-level security
    -

    -This is the same as user-level security, except that the Samba server uses a separate SMB server to validate users and their passwords before granting access to the share.

    Domain-level security
    -

    -Samba becomes a member of a Windows domain and uses the domain's primary domain controller (PDC) to perform authentication. Once authenticated, the user is given a special token that allows him or her access to any share with appropriate access rights. With this token, the PDC will not have to revalidate the user's password each time he or she attempts to access another share within the domain.

    -Each of these security policies can be implemented with the global -security option, as shown in -Table 6.3.


    - - - - - -
    - -Table 6.3: Security Option
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -security

    		 -

    -domain, -server, -share, or -user

    		 -

    -Indicates the type of security that the Samba server will use.

    		 -

    - -user (Samba 2.0) or -share (Samba 1.9)

    		 -

    -Global

    -

    - -6.3.1 Share-level Security

    With share-level security, each share has one or more passwords associated with it. This differs from the other modes of security in that there are no restrictions as to whom can access a share, as long as that individual knows the correct password. Shares often have multiple passwords. For example, one password may grant read-only access, while another may grant read-write access, and so on. Security is maintained as long as unauthorized users do not discover the password for a share to which they shouldn't have access.

    OS/2 and Window 95/98 both support share-level security on their resources. You can set up share-level security with Windows 95/98 by first enabling share-level security using the Access Control tab of the Network Control Panel dialog. Then select the Share-level Access Control radio button (which deselects the user-level access control radio button), as shown in -Figure 6.1, and press the OK button.

    - -Figure 6.1: Selecting share-level security on a Windows machine

    Figure 6.1

    -Next, right click on a resource - such as a hard drive or a CD-ROM - and select the Properties menu item. This will bring up the Resource Properties dialog box. Select the Sharing tab at the top of the dialog box and enable the resource as Shared As. From here, you can configure how the shared resource will appear to individual users, as well as assigning whether the resource will appear as read-only, read-write, or a mix, depending on the password that is supplied.

    -You might be thinking that this security model is not a good fit for Samba - and you would be right. In fact, if you set the -security -= -share option in the Samba configuration file, Samba will still reuse the username/passwords combinations in the system password files to authenticate access. More precisely, Samba will take the following steps when a client requests a connection using share-level security:

      -
    1. -

      - -When a connection is requested, Samba will accept the password and (if sent) the username of the client.

    2. -

      - -If the share is -guest -only, the user is immediately granted access to the share with the rights of the user specified by the -guest -account parameter; no password checking is performed.

    3. -

      - -For other shares, Samba appends the username to a list of users who are allowed access to the share. It then attempts to validate the password given in association with that username. If successful, Samba grants the user access to the share with the rights assigned to that user. The user will not need to authenticate again unless a -revalidate -= -yes option has been set inside the share.

    4. -

      - -If the authentication is unsuccessful, Samba will attempt to validate the password against the list of users it has previously compiled throughout the attempted connections, as well as any specified under the share in the configuration file. If the password does not match any usernames (as specified in the system password file, typically -/etc/passwd), the user is not granted access to the share under that username.

    5. -

      - -However, if the share has a -guest -ok or -public option set, the user will default to access with the rights of the user specified by the -guest -account option.

    -You can indicate in the configuration file which users should be initially placed on the share-level security user list by using the -username configuration option, as shown below:

    -[global]
-	security = share
-[accounting1]
-	path = /home/samba/accounting1
-	guest ok = no
-	writable = yes
-	username = davecb, pkelly, andyo

    -Here, when a user attempts to connect to a share, Samba will verify the password that was sent against each of the users in its own list, in addition to the passwords of users -davecb, -pkelly, and -andyo. If any of the passwords match, the connection will be verified and the user will be allowed. Otherwise, connection to the specific share will fail.

    -

    - -6.3.1.1 Share Level Security Options

    - -Table 6.4 shows the options typically associated with share-level security.


    - - - - - - -
    - -Table 6.4: Share-Level Access Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -only user

    		 -

    -boolean

    		 -

    -Indicates whether usernames specified by -username will be the only ones allowed.

    		 -

    - -no

    		 -

    -Share

    -

    - -username (user or users)

    		 -

    -string (list of usernames)

    		 -

    -Specifies a list of users against which a client's password will be tested.

    		-

    -None

    		 -

    -Share

    -

    - -6.3.1.2 only user

    -This boolean option indicates whether Samba will allow connections to a share using share-level security based solely on the individuals specified in the -username option, instead of those users compiled on Samba's internal list. The default value for this option is -no. You can override it per share as follows:

    -[global]
-    security = share
-[data]
-    username = andy, peter, valerie
-    only user = yes
    -

    - -6.3.1.3 username

    -This option presents a list of users against which Samba will test a connection password to allow access. It is typically used with clients that have share-level security to allow connections to a particular service based solely on a qualifying password - in this case, one that matches a password set up for a specific user:

    -[global]
-    security = share
-[data]
-     username = andy, peter, terry

    -We recommend against using this option unless you are implementing a Samba server with share-level security.

    -

    - -6.3.2 User-level Security

    The preferred mode of security with Samba is -user-level security. With this method, each share is assigned specific users that can access it. When a user requests a connection to a share, Samba authenticates by validating the given username and password with the authorized users in the configuration file and the passwords in the password database of the Samba server. As mentioned earlier in the chapter, one way to isolate which users are allowed access to a specific share is by using the -valid -users option for each share:

    -[global]
-	security = user
-[accounting1]
-	writable = yes
-	valid users = bob, joe, sandy

    -Each of the users listed will be allowed to connect to the share if the password provided matches the password stored in the system password database on the server. Once the initial authentication succeeds, the user will not need to re-enter a password again to access that share unless the -revalidate -= -yes option has been set.

    Passwords can be sent to the Samba server in either an encrypted or a non-encrypted format. If you have both types of systems on your network, you should ensure that the passwords represented by each user are stored both in a traditional account database and Samba's encrypted password database. This way, authorized users can gain access to their shares from any type of client.[1] However, we recommend that you move your system to encrypted passwords and abandon non-encrypted passwords if security is an issue. The -Section 6.4 section of this chapter explains how to use encrypted as well as non-encrypted passwords.

    -
    -

    -[1] Having both encrypted and non-encrypted password clients on your network is another reason why Samba allows you to include (or not include) various options in the Samba configuration file based on the client operating system or machine name variables.

    -

    - -6.3.3 Server-level Security

    Server-level security is similar to user-level security. However, with server-level security, Samba delegates password authentication to another SMB password server, typically another Samba server or a Windows NT Server acting as a PDC on the network. Note that Samba still maintains its list of shares and their configuration in its -smb.conf file. When a client attempts to make a connection to a particular share, Samba validates that the user is indeed authorized to connect to the share. Samba will then attempt to validate the password by contacting the SMB password server through a known protocol and presenting the username and password to the SMB password server. If the password is accepted, a session will be established with the client. See -Figure 6.2 for an illustration of this setup.

    - -Figure 6.2: A typical system setup using server level security

    Figure 6.2

    -You can configure Samba to use a separate password server under server-level security with the use of the -password -server global configuration option, as follows:

    -[global]
-	security = server
-	password server = PHOENIX120 HYDRA134

    -Note that you can specify more than one machine as the target of the -password -server; Samba will move down the list of servers in the event that its first choice is unreachable. The servers identified by the -password -server option are given as NetBIOS names, not their DNS names or equivalent IP addresses. Also, if any of the servers reject the given password, the connection will automatically fail - Samba will not attempt another server.

    -One caveat: when using this option, you will still need an account representing that user on the regular Samba server. This is because the Unix operating system needs a username to perform various I/O operations. The preferable method of handling this is to give the user an account on the Samba server but disable the account's password by replacing it in the system password file (e.g., -/etc/passwd ) with an asterisk (*).

    -

    - -6.3.4 Domain-level Security

    Domain-level security is similar to server-level security. However, with domainlevel security, the Samba server is acting as a member of a Windows domain. Recall from Chapter 1 that each domain has a -domain controller, which is usually a Windows NT server offering password authentication. Including these controllers provides the workgroup with a definitive password server. The domain controllers keep track of users and passwords in their own security authentication module (SAM), and authenticates each user when he or she first logs on and wishes to access another machine's shares.

    -As mentioned earlier in this chapter, Samba has a similar ability to offer user-level security, but this option is Unix-centric and assumes that the authentication occurs via Unix password files. If the Unix machine is part of a NIS or NIS+ domain, Samba will authenticate the users transparently against a shared password file, in typical Unix fashion. Samba then provides access to the NIS or NIS+ domain from Windows. There is, of course, no relationship between the NIS concept of a domain and the Windows concept of a domain.

    With domain-level security, we now have the option of using the native NT mechanism. This has a number of advantages:

      -
    • -

      - -It provides far better integration with NT: there are fewer "kludges" in the -smb.conf options dealing with domains than with most Windows features. This allows more extensive use of NT management tools, such as the User Manager for Domains tool allowing PC support individuals to treat Samba servers as if they were large NT machines.

    • -

      - -With the better integration comes protocol and code cleanups, allowing the Samba team to track the evolving NT implementation. NT Service Pack 4 corrects several problems in the protocol, and Samba's better integration makes it easier to track and adapt to these changes.

    • -

      - -There is less overhead on the PDC because there is one less permanent network connection between it and the Samba server. Unlike the protocol used by the -security -= -server option, the Samba server can make a Remote Procedure Call (RPC) call only when it needs authentication information. It can not keep a connection permanently up just for that.

    • -

      - -Finally, the NT domain authentication scheme returns the full set of user attributes, not just success or failure. The attributes include a longer, more network-oriented version of the Unix uid, NT groups, and other information. This includes:

        -
      • -

        - -Username

      • -

        - -Full name

      • -

        - -Description

      • -

        - -Security identifier (a domain-wide extension of the Unix uid)

      • -

        - -NT group memberships

      • -

        - -Logon hours, and whether to force the user to log out immediately

      • -

        - -Workstations the user is allowed to use

      • -

        - -Account expiration date

      • -

        - -Home directory

      • -

        - -Login script

      • -

        - -Profile

      • -

        - -Account type

    • -

      - -The Samba developers used domain-level security in Samba version 2.0.4 to add and delete domain users on Samba servers semi-automatically. In addition, it adds room for other NT-like additions, such as supporting access control lists and changing permissions of files from the client.

    -The advantage to this approach is less administration; there is only one authentication database to keep synchronized. The only local administration required on the Samba server will be creating directories for users to work in and -/etc/passwd entries to keep their UIDs and groups in.

    -

    - -6.3.4.1 Adding a Samba server to a Windows NT Domain

    -If you already have an NT domain, you can easily add a Samba server to it. First, you will need to stop the Samba daemons. Then, add the Samba server to the NT domain on the PDC using the "Windows NT Server Manager for Domains" tool. When it asks for the computer type, choose "Windows NT Workstation or Server," and give it the NetBIOS name of the Samba server. This creates the machine account on the NT server.

    -Next, generate a Microsoft-format machine password using the -smbpasswd tool, which is explained in further detail in the next section. For example, if our domain is SIMPLE and the Windows NT PDC is -beowulf, we could use the following command on the Samba server to accomplish this:

    -
-smbpasswd -j SIMPLE -r beowulf

    -Finally, add the following options to the -[global] section of your -smb.conf and restart the Samba daemons.

    -[global]
-	security = domain
-	domain logins = yes
-	workgroup = SIMPLE
-	password server = beowulf

    -Samba should now be configured for domain-level security. The -domain -logins option is explained in more detail later in this chapter.

    -
    -
    -
    - - -
    - -Previous: 6.2 Controlling Access to Shares - - - -Next: 6.4 Passwords
    -6.2 Controlling Access to Shares - -Book Index -6.4 Passwords
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch06_04.html b/docs/htmldocs/using_samba/ch06_04.html deleted file mode 100644 index 646c6128f4..0000000000 --- a/docs/htmldocs/using_samba/ch06_04.html +++ /dev/null @@ -1,738 +0,0 @@ - - - -[Chapter 6] 6.4 Passwords - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 6.3 Authentication Security - - - -Chapter 6
    -Users, Security, and Domains     		- -Next: 6.5 Windows Domains
     
    - -
    -
    -

    - -6.4 Passwords

    Passwords are a thorny issue with Samba. So much so, in fact, that they are almost always the first major problem that users encounter when they install Samba, and generate by far the most questions sent to Samba support groups. In previous chapters, we've gotten around the need for passwords by placing the -guest -ok option in each of our configuration files, which allows connections without authenticating passwords. However, at this point, we need to delve deeper into Samba to discover what is happening on the network.

    Passwords sent from individual clients can be either encrypted or non-encrypted. Encrypted passwords are, of course, more secure. A non-encrypted password can be easily read with a packet sniffing program, such as the modified -tcpdump program for Samba that we used in Chapter 3, Configuring Windows Clients. Whether passwords are encrypted depends on the operating system that the client is using to connect to the Samba server. -Table 6.5 lists which Windows operating systems encrypt their passwords before sending them to the primary domain controller for authentication. If your client is not Windows, check the system documentation to see if SMB passwords are encrypted.


    - - - - - - - - - - -
    - -Table 6.5: Windows Operating Systems with Encrypted Passwords
    -

    -Operating System

    		 -

    -Encrypted or Non-encrypted

    -

    - -Windows 95

    		 -

    -Non-encrypted

    -

    -Windows 95 with SMB Update

    		 -

    -Encrypted

    -

    -Windows 98

    		 -

    -Encrypted

    -

    -Windows NT 3. -x

    		 -

    -Non-encrypted

    -

    -Windows NT 4.0 before SP - 3

    		 -

    -Non-encrypted

    -

    -Windows NT 4.0 after SP 3

    		 -

    -Encrypted

    -There are actually two different encryption methods used: one for Windows 95 and 98 clients that reuses Microsoft's LAN Manager encryption style, and a separate one for Windows NT clients and servers. Windows 95 and 98 use an older encryption system inherited from the LAN Manager network software, while Windows NT clients and servers use a newer encryption system.

    -If encrypted passwords are supported, Samba stores the encrypted passwords in a file called -smbpasswd. By default, this file is located in the -private directory of the Samba distribution (/usr/local/samba/private). At the same time, the client stores an encrypted version of a user's password on its own system. The plaintext password is never stored on either system. Each system encrypts the password automatically using a known algorithm when the password is set or changed.

    -When a client requests a connection to an SMB server that supports encrypted passwords (such as Samba or Windows NT), the two computers undergo the following negotiations:

      -
    1. -

      - -The client attempts to negotiate a protocol with the server.

    2. -

      - -The server responds with a protocol and indicates that it supports encrypted passwords. At this time, it sends back a randomly-generated 8-byte challenge string.

    3. -

      - -The client uses the challenge string as a key to encrypt its already encrypted password using an algorithm predefined by the negotiated protocol. It then sends the result to the server.

    4. -

      - -The server does the same thing with the encrypted password stored in its database. If the results match, the passwords are equivalent and the user is authenticated.

    -Note that even though the original passwords are not involved in the authentication process, you need to be very careful that the encrypted passwords located inside of the -smbpasswd file are guarded from unauthorized users. If they are compromised, an unauthorized user can break into the system by replaying the steps of the previous algorithm. The encrypted passwords are just as sensitive as the plaintext passwords - this is known as -plaintext-equivalent data in the cryptography world. Of course, you should also ensure that the clients safeguard their plaintext-equivalent passwords as well.

    -You can configure Samba to accept encrypted passwords with the following global additions to -smb.conf. Note that we explicitly name the location of the Samba password file:

    -[global]
-	security = user
-	encrypt passwords = yes
-	smb passwd file = /usr/local/samba/private/smbpasswd

    -Samba, however, will not accept any users until the -smbpasswd file has been initialized.

    -

    - -6.4.1 Disabling encrypted passwords on the client

    While Unix authentication has been in use for decades, including the use of -telnet and -rlogin access across the Internet, it embodies well-known security risks. Plaintext passwords are sent over the Internet and can be retrieved from TCP packets by malicious snoopers. However, if you feel that your network is secure and you wish to use standard Unix -/etc/passwd authentication for all clients, you can do so, but you must disable encrypted passwords on those Windows clients that default to using them.

    -In order to do this, you must modify the Windows registry by installing two files on each system. Depending on the platform involved, the files are either -NT4_PlainPassword.reg or -Win95_PlainPassword.reg. You can perform this installation by copying the appropriate -.reg files from the Samba distribution's -/docs directory to a DOS floppy, and running it from the Run menu item on the client's Start Menu button. Incidentally, the Windows 95 -.reg file works fine on Windows 98 as well.

    -After you reboot the machine, the client will not encrypt its hashed passwords before sending them to the server. This means that the plaintext-equivalent passwords can been seen in the TCP packets that are broadcast across the network. Again, we encourage you not to do this unless you are absolutely sure that your network is secure.

    -If passwords are not encrypted, you can indicate as much in your Samba configuration file:

    -[global]
-	security = user
-	encrypt passwords = no
    -

    - -6.4.2 The smbpasswd File

    - -Samba stores its encrypted passwords in a file called -smbpasswd, which by default resides in the -/usr/local/samba/private directory. The -smbpasswd file should be guarded as closely as the -passwd file; it should be placed in a directory to which only the root user has read/write access. All other users should not be able to read from the directory at all. In addition, the file should have all access closed off to all users except for root.

    -Before you can use encrypted passwords, you will need to create an entry for each Unix user in the -smbpasswd file. The structure of the file is somewhat similar to a Unix -passwd file, but has different fields. -Figure 6.3 illustrates the layout of the -smbpasswd file; the entry shown is actually one line in the file.

    - -Figure 6.3: Structure of the smbpasswd file entry (actually one line)

    Figure 6.3

    -Here is a breakdown of the individual fields:

    -
    -Username
    -

    -This is the username of the account. It is taken directly from the system password file.

    -UID
    -

    -This is the user ID of the account. Like the username, it is taken directly from the system password file and must match the user it represents there.

    -LAN Manager Password Hash
    -

    -This is a 32-bit hexadecimal sequence that represents the password Windows 95 and 98 clients will use. It is derived by encrypting the string -KGS!@#$% with a 56-bit DES algorithm using the user's password (forced to 14 bytes and converted to capital letters) twice repeated as the key. If there is currently no password for this user, the first 11 characters of the hash will consist of the sequence -NO -PASSWORD followed by -X characters for the remainder. Anyone can access the share with no password. On the other hand, if the password has been disabled, it will consist of 32 -X characters. Samba will not grant access to a user without a password unless the -null -passwords option has been set.

    -NT Password Hash
    -

    -This is a 32-bit hexadecimal sequence that represents the password Windows NT clients will use. It is derived by hashing the user's password (represented as a 16-bit little-endian Unicode sequence) with an MD4 hash. The password is not converted to uppercase letters first.

    -Account Flags
    -

    -This field consists of 11 characters between two braces ([]). Any of the following characters can appear in any order; the remaining characters should be spaces:

    -U

    -This account is a standard user account.

    -D

    -This account is currently disabled and Samba should not allow any logins.

    -N

    -This account has no password associated with it.

    -W

    -This is a workstation trust account that can be used to configure Samba as a primary domain controller (PDC) when allowing Windows NT machines to join its domain.

    -
    -Last Change Time
    -

    -This code consists of the characters -LCT- followed by a hexidecimal representation of the amount of seconds since the epoch (midnight on January 1, 1970) that the entry was last changed.

    -

    - -6.4.2.1 Adding entries to smbpasswd

    - -There are a few ways you can add a new entry to the -smbpasswd file:

      -
    • -

      - -You can use the -smbpasswd program with the --a option to automatically add any user that currently has a standard Unix system account on the server. This program resides in the -/usr/local/samba/bin directory.

    • -

      - -You can use the -addtosmbpass executable inside the -/usr/local/samba/bin directory. This is actually a simple -awk script that parses a system password file and extracts the username and UID of each entry you wish to add to the SMB password file. It then adds default fields for the remainder of the user's entry, which can be updated using the -smbpasswd program later. In order to use this program, you will probably need to edit the first line of the file to correctly point to -awk on your system.

    • -

      - -In the event that the neither of those options work for you, you can create a default entry by hand in the -smbpasswd file. The entry should be entirely on one line. Each field should be colon-separated and should look similar to the following:

    -dave:500:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[U          ]:LCT-00000000:

    -This consists of the username and the UID as specified in the system password file, followed by two sets of exactly 32 -X characters, followed by the account flags and last change time as it appears above. After you've added this entry, you must use the -smbpasswd program to change the password for the user.

    -

    - -6.4.2.2 Changing the encrypted password

    If you need to change the encrypted password in the -smbpasswd file, you can also use the -smbpasswd program. Note that this program shares the same name as the encrypted password file itself, so be sure not to accidentally confuse the password file with the password-changing program.

    -The -smbpasswd program is almost identical to the -passwd program that is used to change Unix account passwords. The program simply asks you to enter your old password (unless you're the root user), and duplicate entries of your new password. No password characters are shown on the screen. 

    # smbpasswd dave
-
    -Old SMB password:
-New SMB password:
-Retype new SMB password:
-Password changed for user dave

    -You can look at the -smbpasswd file after this command completes to verify that both the LAN Manager and the NT hashes of the passwords have been stored in their respective positions. Once users have encrypted password entries in the database, they should be able to connect to shares using encrypted passwords! -

    -

    - -6.4.3 Password Synchronization

    Having a regular password and an encrypted version of the same password can be troublesome when you need to change both of them. Luckily, Samba affords you a limited ability to keep your passwords synchronized. Samba has a pair of configuration options that can be used to automatically update a user's regular Unix password when the encrypted password is changed on the system. The feature can be activated by specifying the -unix -password -sync global configuration option:

    -[global]
-	encrypt passwords = yes
-	smb passwd file = /usr/local/samba/private/smbpasswd
-
-	unix password sync = yes

    -With this option enabled, Samba will attempt to change the user's regular password (as -root) when the encrypted version is changed with -smbpasswd. However, there are two other options that have to be set correctly in order for this to work.

    -The easier of the two is -passwd -program. This option simply specifies the Unix command used to change a user's standard system password. It is set to -/bin/passwd -%u by default. With some Unix systems, this is sufficient and you do not need to change anything. Others, such as Red Hat Linux, use -/usr/bin/passwd instead. In addition, you may want to change this to another program or script at some point in the future. For example, let's assume that you want to use a script called -changepass to change a user's password. Recall that you can use the variable -%u to represent the current Unix username. So the example becomes:

    -[global]
-	encrypt passwords = yes
-	smb passwd file = /usr/local/samba/private/smbpasswd
-
-	unix password sync = yes
-	passwd program = changepass %u

    -Note that this program will be called as the -root user when the -unix -password -sync option is set to -yes. This is because Samba does not necessarily have the plaintext old password of the user.

    -The harder option to configure is -passwd -chat. The -passwd -chat option works like a Unix chat script. It specifies a series of strings to send as well as responses to expect from the program specified by the -passwd -program option. For example, this is what the default -passwd -chat looks like. The delimiters are the spaces between each groupings of characters:

    -passwd chat = *old*password* %o\n *new*password* %n\n *new*password* %n\n *changed*

    -The first grouping represents a response expected from the password-changing program. Note that it can contain wildcards (*), which help to generalize the chat programs to be able to handle a variety of similar outputs. Here, -*old*password* indicates that Samba is expecting any line from the password program containing the letters -old followed by the letters -password, without regard for what comes on either side or between them. Once instructed to, Samba will wait indefinitely for such a match. Is Samba does not receive the expected response, the password will fail.

    -The second grouping indicates what Samba should send back once the data in the first grouping has been matched. In this case, you see -%o\n. This response is actually two items: the variable -%o represents the old password, while the -\n is a newline character. So, in effect, this will "type" the old password into the standard input of the password changing program, and then "press" Enter.

    -Following that is another response grouping, followed by data that will be sent back to the password changing program. (In fact, this response/send pattern continues indefinitely in any standard Unix -chat script.) The script continues until the final pattern is matched.[2]

    -
    -

    -[2] This may not work under Red Hat Linux, as the password program typically responds "All authentication tokens updated successfully," instead of "Password changed." We provide a fix for this later in this section.

    -You can help match the response strings sent from the password program with the characters listed in -Table 6.6. In addition, you can use the characters listed in -Table 6.7 to help formulate your response.


    - - - - - - -
    - -Table 6.6: Password Chat Response Characters
    -

    -Character

    		 -

    -Definition

    -

    - -*

    		 -

    Zero or more occurrences of any character.

    -

    - -" "

    		 -

    -Allows you to include matching strings that contain spaces. Asterisks are still considered wildcards even inside of quotes, and you can represent a null response with empty quotes.


    - - - - - - - - - - -
    - -Table 6.7: Password Chat Send Characters
    -

    -Character

    		 -

    -Definition

    -

    - -%o

    		 -

    -The user's old password

    -

    - -%n

    		 -

    -The user's new password

    -

    - -\n

    		 -

    -The linefeed character

    -

    - -\r

    		 -

    -The carriage-return character

    -

    - -\t

    		 -

    -The tab character

    -

    - -\s

    		 -

    -A space

    -For example, you may want to change your password chat to the following entry. This will handle scenarios in which you do not have to enter the old password. In addition, this will also handle the new -all -tokens -updated -successfully string that Red Hat Linux sends:

    -passwd chat = *new password* %n\n *new password* %n\n *success*

    -Again, the default chat should be sufficient for many Unix systems. If it isn't, you can use the -passwd -chat -debug global option to set up a new chat script for the password change program. The -passwd -chat -debug option logs everything during a password chat. This option is a simple boolean, as shown below:

    -[global]
-    encrypted passwords = yes
-    smb passwd file = /usr/local/samba/private/smbpasswd
-
-    unix password sync = yes
-    passwd chat debug = yes
-    log level = 100

    -After you activate the password chat debug feature, all I/O received by Samba through the password chat will be sent to the Samba logs with a debug level of 100, which is why we entered a new log level option as well. As this can often generate multitudes of error logs, it may be more efficient to use your own script, by setting the -passwd -program option, in place of -/bin/passwd to record what happens during the exchange. Also, make sure to protect your log files with strict file permissions and to delete them as soon as you've grabbed the information you need, because they contain the passwords in plaintext.

    -The operating system on which Samba is running may have strict requirements for valid passwords in order to make them more impervious to dictionary attacks and the like. Users should be made aware of these restrictions when changing their passwords.

    -Earlier we said that password synchronization is limited. This is because there is no reverse synchronization of the encrypted -smbpasswd file when a standard Unix password is updated by a user. There are various strategies to get around this, including NIS and freely available implementations of the pluggable authentication modules (PAM) standard, but none of them really solve all the problems yet. In the future, when Windows 2000 emerges, we will see more compliance with the Lightweight Directory Access Protocol (LDAP), which promises to make password synchronization a thing of the past.

    -

    - -6.4.4 Password Configuration Options

    -The options in -Table 6.8 will help you work with passwords in Samba.


    - - - - - - - - - - - - - - - -
    - -Table 6.8: Password Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -encrypt passwords

    		 -

    -boolean

    		 -

    Turns on encrypted passwords.

    		 -

    - -no

    		 -

    -Global

    -

    - -unix password sync

    		-

    -boolean

    		 -

    -If -yes, Samba updates the standard Unix password database when a user changes his or her encrypted password.

    		 -

    - -no

    		 -

    -Global

    -

    - -passwd chat

    		 -

    -string (chat commands)

    		 -

    -Sets a sequence of commands that will be sent to the password program.

    		 -

    -See earlier section on this option

    		 -

    -Global

    -

    - -passwd chat debug

    		 -

    -boolean

    		 -

    -Sends debug logs of the password-change process to the log files with a level of 100.

    		 -

    - -no

    		 -

    -Global

    -

    - -passwd program

    		 -

    -string (Unix command)

    		 -

    -Sets the program to be used to change passwords.

    		 -

    - -/bin/passwd %u

    		 -

    -Global

    -

    - -password level

    		 -

    -numeric

    		 -

    -Sets the number of capital letter permutations to attempt when matching a client's password.

    		 -

    -None

    		 -

    -Global

    -

    - -update encrypted

    		 -

    -boolean

    		 -

    -If -yes, Samba updates the encrypted password file when a client connects to a share with a plaintext password.

    		 -

    - -no

    		 -

    -Global

    -

    - -null passwords

    		 -

    -boolean

    		 -

    -If -yes, Samba allows access for users with null passwords.

    		 -

    - -no

    		 -

    -Global

    -

    - -smb passwd file

    		 -

    -string (fully-qualified pathname)

    		 -

    -Specifies the name of the encrypted password file.

    		 -

    - -/usr/local/samba/private/smbpasswd

    		 -

    -Global

    -

    - -hosts equiv

    		 -

    -string (fully-qualified pathname)

    		 -

    -Specifies the name of a file that contains hosts and users that can connect without using a password.

    		 -

    -None

    		 -

    -Global

    -

    - -use rhosts

    		 -

    -string (fully-qualified pathname)

    		 -

    -Specifies the name of an . -rhosts file that allows users to connect without using a password.

    		 -

    -None

    		 -

    -Global

    -

    - -6.4.4.1 unix password sync

    -The -unix -password -sync global option allows Samba to update the standard Unix password file when a user changes his or her encrypted password. The encrypted password is stored on a Samba server in the -smbpasswd file, which is located in -/usr/local/samba/private by default. You can activate this feature as follows:

    -[global]
-	unix password sync = yes

    -If this option is enabled, Samba changes the encrypted password and, in addition, attempts to change the standard Unix password by passing the username and new password to the program specified by the -passwd -program option (described earlier). Note that Samba does not necessarily have access to the plaintext password for this user, so the password changing program must be invoked as -root.[3] If the Unix password change does not succeed, for whatever reason, the SMB password will not be changed either.

    -
    -

    -[3] This is because the Unix -passwd program, which is the usual target for this operation, allows -root to change a user's password without the security restriction that requests the old password of that user.

    -

    - -6.4.4.2 encrypt passwords

    The -encrypt -passwords global option switches Samba from using plaintext passwords to encrypted passwords for authentication. Encrypted passwords will be expected from clients if the option is set to -yes:

    -encrypt passwords = yes

    -By default, Windows NT 4.0 with Service Pack 3 or above and Windows 98 transmit encrypted passwords over the network. If you are enabling encrypted passwords, you must have a valid -smbpasswd file in place and populated with usernames that will authenticate with encrypted passwords. (See the section -Section 6.4.2, The smbpasswd File, earlier in this chapter.) In addition, Samba must know the location of the -smbpasswd file; if it is not in the default location (typically -/usr/local/samba/private/smbpasswd), you can explicitly name it using the -smb -passwd -file option.

    -If you wish, you can use the -update -encrypted to force Samba to update the -smbpasswd file with encrypted passwords each time a client connects to a non-encrypted password.

    -A common strategy to ensure that hosts who need encrypted password authentication indeed receive it is with the -include option. With this, you can create individual configuration files that will be read in based on OS-type (%a) or client name (%m). These host-specific or OS-specific configuration files can contain an -encrypted -passwords -= -yes option that will activate only when those clients are connecting to the server.

    -

    - -6.4.4.3 passwd program

    -The -passwd -program is used to specify a program on the Unix Samba server that Samba can use to update the standard system password file when the encrypted password file is updated. This option defaults to the standard - passwd program, usually located in the -/bin directory. The -%u variable is typically used here as the requesting user when the command is executed. The actual handling of input and output to this program during execution is handled through the -passwd -chat option. The "Password Synchronization" section, earlier in this chapter, covers this option in detail.

    -

    - -6.4.4.4 passwd chat

    -This option specifies a series of send/response strings similar to a Unix chat script, which are used to interface with the password-changing program on the Samba server. The "Password Synchronization" section, earlier in this chapter, covers this option in detail.

    -

    - -6.4.4.5 passwd chat debug

    -If set to -yes, the -passwd -chat -debug global option logs everything sent or received by Samba during a password chat. All the I/O received by Samba through the password chat is sent to the Samba logs with a debug level of 100; you will need to specify -log -level -= -100 in order for the information to be recorded. The "Password Synchronization" section -, earlier in this chapter, describes this option in more detail. Be aware that if you do set this option, the plaintext passwords will be visible in the debugging logs, which could be a security hazard if they are not properly secured.

    -

    - -6.4.4.6 password level

    -With SMB, non-encrypted (or plaintext) passwords are sent with capital letters, just like the usernames mentioned previously. Many Unix users, however, choose passwords with both uppercase and lowercase letters. Samba, by default, only attempts to match the password entirely in lowercase letters, and not capitalizing the first letter.

    -Like -username -level, there is a -password -level option that can be used to attempt various permutations of the password with capital letters. This option takes an integer value that specifies how many letters in the password should be capitalized when attempting to connect to a share. You can specify this options as follows:

    -[global]
-	password level = 3

    -In this case, Samba will then attempt all permutations of the password it can compute having three capital letters. The larger the number, the more computations Samba will have to perform to match the password, and the longer a connection to a specific share may take.

    -

    - -6.4.4.7 update encrypted

    -For sites switching over to the encrypted password format, Samba provides an option that should help with the transition. The -update -encrypted option allows a site to ease into using encrypted passwords from plaintext passwords. You can activate this option as follows:

    -[global]
-    update encrypted = yes

    -This instructs Samba to create an encrypted version of each user's Unix password in the -smbpasswd file each time he or she connects to a share. When this option is enabled, you must have the -encrypt -passwords option set to -no so that the client will pass plaintext passwords to Samba to use to update the files. Once each user has connected at least once, you can set -encrypted -passwords -= -yes, allowing you to use only the encrypted passwords. The user must already have a valid entry in the -smbpasswd file for this option to work.

    -

    - -6.4.4.8 null passwords

    -This global option tells Samba whether or not to allow access from users that have null passwords (encrypted or non-encrypted) set in their accounts. The default value is -no. You can override it as follows:

    -null passwords = yes

    -We highly recommend against doing so unless you are familiar with the security risks this option can present to your system, including inadvertent access to system users (such as -bin) in the system password file who have null passwords set.

    -

    - -6.4.4.9 smb passwd file

    This global option identifies the location of the encrypted password database. By default, it is set to -/usr/local/samba/private/smbpasswd. You can override it as follows:

    -[global]
-	smb passwd file = /etc/smbpasswd

    -This location, for example, is common on many Red Hat distributions.

    -

    - -6.4.4.10 hosts equiv

    -This global option specifies the name of a standard Unix -hosts.equiv file that will allow hosts or users to access shares without specifying a password. You can specify the location of such a file as follows:

    -[global]
-	hosts equiv = /etc/hosts.equiv

    -The default value for this option does not specify any -hosts.equiv file. Because using such a file is essentially a huge security risk, we highly recommend that you do not use this option unless you are confident in the security of your network.

    -

    - -6.4.4.11 use rhosts

    -This global option specifies the name of a standard Unix user's -.rhosts file that will allow foreign hosts to access shares without specifying a password. You can specify the location of such a file as follows:

    -[global]
-	use rhosts = /home/dave/.rhosts

    -The default value for this option does not specify any -.rhosts file. Like the -hosts -equiv option above, using such a file is a security risk. We highly recommend that you do use this option unless you are confident in the security of your network.

    -
    -
    -
    - - -
    - -Previous: 6.3 Authentication Security - - - -Next: 6.5 Windows Domains
    -6.3 Authentication Security - -Book Index -6.5 Windows Domains
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch06_05.html b/docs/htmldocs/using_samba/ch06_05.html deleted file mode 100644 index fbf6d245a1..0000000000 --- a/docs/htmldocs/using_samba/ch06_05.html +++ /dev/null @@ -1,333 +0,0 @@ - - - -[Chapter 6] 6.5 Windows Domains - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 6.4 Passwords - - - -Chapter 6
    -Users, Security, and Domains     		- -Next: 6.6 Logon Scripts
     
    - -
    -
    -

    - -6.5 Windows Domains

    Now that you are comfortable with users and passwords on a Samba server, we can show you how to set up Samba to become a primary domain controller for Windows 95/98 and NT machines. Why use domains? The answer probably isn't obvious until you look behind the scenes, especially with Windows 95/98.

    -Recall that with traditional workgroups, Windows 95/98 simply accepts each username and password that you enter when logging on to the system. There are no unauthorized users with Windows 95/98; if a new user logs on, the operating system simply asks for a new password and authenticates the user against that password from then on. The only time that Windows 95/98 attempts to use the password you entered is when connecting to another share.

    Domain logons, on the other hand, are similar to Unix systems. In order to log on to the domain, a valid username and password must be presented at startup, which is then authenticated against the primary domain controller's password database. If the password is invalid, the user is immediately notified and they cannot log on to the domain.

    -There's more good news: once you have successfully logged on to the domain, you can access any of the shares in the domain to which you have rights without having to reauthenticate yourself. More precisely, the primary domain controller returns a token to the client machine that allows it to access any share without consulting the PDC again. Although you probably won't notice the shift, this can be beneficial in cutting down network traffic. (You can disable this behavior if you wish by using the -revalidate option.)

    -

    - -6.5.1 Configuring Samba for Windows Domain Logons

    -If you wish to allow Samba to act as a domain controller, use the following sections to configure Samba and your clients to allow domain access.

    -If you would like more information on how to set up domains, see the -DOMAINS.TXT file that comes with the Samba distribution.

    -

    - -6.5.1.1 Windows 95/98 clients

    Setting up Samba as a PDC for Windows 95/98 clients is somewhat anticlimactic. All you really need to do on the server side is ensure that:

      -
    • -

      - -Samba is the only primary domain controller for the current workgroup.

    • -

      - -There is a WINS server available on the network, either a Samba machine or a Windows NT server. (See Chapter 7, Printing and Name Resolution, for more information on WINS.)

    • -

      - -Samba is using user-level security (i.e., it doesn't hand off password authentication to anyone else). You do not want to use domain-level security if Samba itself is acting as the PDC.

    -At that point, you can insert the following options into your Samba configuration file:

    -[global]
-	workgroup = SIMPLE
-	domain logons = yes
-
-# Be sure to set user-level security!
-
-	security = user
-
-# Be sure to become the primary domain controller!
-
-	os level = 34
-	local master = yes
-	preferred master = yes
-	domain master = yes

    -The -domain -logons option enables Samba to perform domain authentication on behalf of other clients that request it. The name of the domain will be the same as the workgroup listed in the Samba configuration file, in this case: SIMPLE.

    -After that, you need to create a non-writable, non-public, non-browesable disk share called -[netlogon] (it does not matter where this share points to as long as each Windows client can connect to it): 

    -[netlogon]
-	comment = The domain logon service
-	path = /export/samba/logon
-	public = no
-	writeable = no
-	browsable = no
    -

    - -6.5.1.2 Windows NT clients

    If you have Window NT clients on your system, there are a few more steps that need to be taken in order for Samba to act as their primary domain controller.

    -

    - -WARNING: You will need to use at least Samba 2.1 to ensure that PDC functionality for Windows NT clients is present. Prior to Samba 2.1, only limited user authentication for NT clients was present. At the time this book went to press, Samba 2.0.5 was the latest version, but Samba 2.1 was available through CVS download. Instructions on downloading alpha versions of Samba are given in Appendix E, Downloading Samba with CVS.

    -As before, you need to ensure that Samba is a primary domain controller for the current workgroup and is using user-level security. However, you must also ensure that Samba is using encrypted passwords. In other words, alter the -[global] options the previous example to include the -encrypted -passwords -= -yes option, as shown here: 

    -[global]
-	workgroup = SIMPLE
-	encrypted passwords = yes
-	domain logons = yes
-
-	security = user
    -

    - -6.5.1.3 Creating trust accounts for NT clients

    -This step is exclusively for Windows NT clients. All NT clients that connect to a primary domain controller make use of -trust accounts. These accounts allow a machine to log in to the PDC itself (not one of its shares), which means that the PDC can trust any further connections from users on that client. For all intents and purposes, a trust account is identical to a user account. In fact, we will be using standard Unix user accounts to emulate trust accounts for the Samba server.

    -The login name of a machine's trust account is the name of the machine with a dollar sign appended to it. For example, if our Windows NT machine is named -chimaera, the login account would be -chimaera$. The initial password of the account is simply the name of the machine in lowercase letters. In order to forge the trust account on the Samba server, you need to create a Unix account with the appropriate machine name, as well as an encrypted password entry in the -smbpasswd database.

    -Let's tackle the first part. Here, we only need to modify the -/etc/passwd file to support the trust account; there is no need to create a home directory or assign a shell to the "user" because the only part we are interested in is whether a login is permitted. Therefore, we can create a "dummy" account with the following entry:

    -chimaera$:*:1000:900:Trust Account:/dev/null:/dev/null

    -Note that we have also disabled the password field by placing a -* in it. This is because Samba will use the -smbpasswd file to contain the password instead, and we don't want anyone to telnet into the machine using that account. In fact, the only value other than the account name that is used here is the UID of the account for the encrypted password database (1000). This number must map to a unique resource ID on the NT server and cannot conflict with any other resource IDs. Hence, no NT user or group should map to this number or a networking error will occur.

    -Next, add the encrypted password using the -smbpasswd command, as follows: 

    # smbpasswd -a -m chimaera
-Added user chimaera$
-Password changed for user chimaera$

    -The --m option specifies that a machine trust account is being generated. The -smbpasswd program will automatically set the initial encrypted password as the NetBIOS name of the machine in lowercase letters; you don't need to enter it. When specifying this option on the command line, do not put a dollar sign after the machine name - it will be appended automatically. Once the encrypted password has been added, Samba is ready to handle domain logins from a NT client.

    -

    - -6.5.2 Configuring Windows Clients for Domain Logons

    -Once you have Samba configured for domain logons, you need to set up your Windows clients to log on to the domain at startup.

    -

    - -6.5.2.1 Windows 95/98

    With Windows 95/98, this can be done by raising the Network configuration dialog in the Windows Control Panel and selecting the Properties for "Client for Microsoft Networks." At this point, you should see a dialog box similar to -Figure 6.4. Select the "Logon to Windows Domain" checkbox at the top of the dialog box, and enter the workgroup that is listed in the Samba configuration file as the Windows NT domain. Then click on OK and reboot the machine when asked.

    - -Figure 6.4: Configuring a Windows 95/98 client for domain logons

    Figure 6.4
    -

    - -WARNING: If Windows complains that you are already logged into the domain, you probably have an active connection to a share in the workgroup (such as a mapped network drive). Simply disconnect the resource temporarily by right-clicking on its icon and choosing the Disconnect pop-up menu item.

    -When Windows reboots, you should see the standard login dialog with an addition: a field for a domain. The domain name should already be filled in, so simply enter your password and click on the OK button. At this point, Windows should consult the primary domain controller (Samba) to see if the password is correct. (You can check the log files if you want to see this in action.) If it worked, congratulations! You have properly configured Samba to act as a domain controller for Windows 95/98 machines and your client is successfully connected.

    -

    - -6.5.2.2 Windows NT 4.0

    To configure Windows NT for domain logons, open the Network configuration dialog in the Windows NT Control Panel. The first tab that you see should list the identification of the machine.

    -Press the Change button and you should see the dialog box shown in -Figure 6.5. In this dialog box, you can choose to have the Windows NT client become a member of the domain by selecting the radio button marked Domain in the "Member of" box. Then, type in the domain that you wish the client to login to; it should be the same as the workgroup that you specified in the Samba configuration file. Do not check the box marked "Create a Computer Account in the Domain" - Samba does not currently support this functionality.

    - -Figure 6.5: Configuring a Windows NT client for domain logons

    Figure 6.5
    -

    - -WARNING: Like Windows 95/98, if NT complains that you are already logged in, you probably have an active connection to a share in the workgroup (such as a mapped network drive). Disconnect the resource temporarily by right-clicking on its icon and choosing the Disconnect pop-up menu item.

    -After you press the OK button, Windows should present you with a small dialog box welcoming you to the domain. At this point, you will need to reset the Windows NT machine. Once it comes up again, the machine will automatically present you with a log on screen similar to the one for Windows 95/98 clients. You can now log in using any account that you have already on the Samba server that is configured to accept logins.

    -

    - -WARNING: Be sure to select the correct domain in the Windows NT logon dialog box. Once selected, it may take a moment for Windows NT to build the list of available domains.

    -After you enter the password, Windows NT should consult the primary domain controller (Samba) to see if the password is correct. Again, you can check the log files if you want to see this in action. If it worked, you have successfully configured Samba to act as a domain controller for Windows NT machines.

    -

    - -6.5.3 Domain Options

    - -Table 6.9 shows the options that are commonly used in association with domain logons.


    - - - - - - - - - -
    - -Table 6.9: Windows 95/98 Domain Logon Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -domain logons

    		 -

    -boolean

    		 -

    -Indicates whether Windows domain logons are to be used.

    		 -

    - -no

    		 -

    -Global

    -

    - -domain group map

    		 -

    -string (fully-qualified pathname)

    		 -

    -Name of the file used to map Unix to Windows NT domain groups.

    		 -

    -None

    		 -

    -Global

    -

    - -domain user map

    		 -

    -string (fully-qualified pathname)

    		 -

    -Name of the file used to map Unix to Windows NT domain users.

    		 -

    -None

    		 -

    -Global

    -

    - -local group map

    		 -

    -string (fully-qualified pathname)

    		 -

    -Name of the file used to map Unix to Windows NT local groups.

    		 -

    -None

    		 -

    -Global

    -

    - -revalidate

    		 -

    -boolean

    		 -

    -If -yes, Samba forces users to authenticate themselves with each connection to a share.

    		 -

    - -no

    		 -

    -Share

    -

    - -6.5.3.1 domain logons

    -This option configures Samba to accept domain logons as a primary domain controller. When a client successfully logs on to the domain, Samba will return a special token to the client that allows the client to access domain shares without consulting the PDC again for authentication. Note that the Samba machine must be in user-level security (security -= -user) and must be the PDC in order for this option to function. In addition, Windows machines will expect a -[netlogon] share to exist on the Samba server (see the section -Section 6.5.1, Configuring Samba for Windows Domain Logons, earlier in this chapter).

    -

    - -6.5.3.2 domain group map

    -This option specifies the location of a mapping file designed to translate Windows NT domain group names to Unix group names. The file should reside on the Samba server. For example:

    -/usr/local/samba/private/groups.mapping

    -The file has a simple format:

    UnixGroup = NTGroup

    -An example is:

    -admin = Administrative

    -The specified Unix group should be a valid group in the -/etc/group file. The NT group should be the name to which you want the Unix group to map on an NT client. This option will work only with Windows NT clients.

    -

    - -6.5.3.3 domain user map

    -This option specifies the location of a mapping file designed to translate Unix usernames to Windows NT domain usernames. The file should reside on the Samba server. For example:

    /usr/local/samba/private/domainuser.mapping

    The file has a simple format:

    UnixUsername = [\\Domain\\]NTUserName

    -An example entry is:

    -joe = Joseph Miller

    -The Unix name specified should be a valid username in the -/etc/passwd file. The NT name should be the username to which you want to Unix username to map on an NT client. This option will work with Windows NT clients only.

    -If you would like more information on how Windows NT uses domain usernames and local groups, we recommend Eric Pearce's -Windows NT in a Nutshell, published by O'Reilly.

    -

    - -6.5.3.4 local group map

    -This option specifies the location of a mapping file designed to translate Windows NT local group names to Unix group names. Local group names include those such as Administrator and Users. The file should reside on the Samba server. For example:

    /usr/local/samba/private/localgroup.mapping

    The file has a simple format:

    UnixGroup = [BUILTIN\]NTGroup

    -An example entry is:

    -root = BUILTIN\Administrators

    -This option will work with Windows NT clients only. For more information, see Eric Pearce's -Windows NT in a Nutshell (O'Reilly).

    -

    - -6.5.3.5 revalidate

    -This share-level option tells Samba to force users to authenticate with passwords each time they connect to a different share on a machine, no matter what level of security is in place on the Samba server. The default value is -no, which allows users to be trusted once they successfully authenticate themselves. You can override it as:

    -revalidate = yes

    -You can use this option to increase security on your system. However, you should weigh it against the inconvenience of having users revalidate themselves to every share.

    -
    -
    -
    - - -
    - -Previous: 6.4 Passwords - - - -Next: 6.6 Logon Scripts
    -6.4 Passwords - -Book Index -6.6 Logon Scripts
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch06_06.html b/docs/htmldocs/using_samba/ch06_06.html deleted file mode 100644 index f80e4d3746..0000000000 --- a/docs/htmldocs/using_samba/ch06_06.html +++ /dev/null @@ -1,537 +0,0 @@ - - - -[Chapter 6] 6.6 Logon Scripts - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 6.5 Windows Domains - - - -Chapter 6
    -Users, Security, and Domains     		- -Next: 7. Printing and Name Resolution
     
    - -
    -
    -

    - -6.6 Logon Scripts

    Samba supports the execution of Windows logon scripts, which are scripts (.BAT or .CMD) that are executed on the client when a user logs on to a Windows domain. Note that these scripts are stored on the Unix side, but are transported across the network to the client side and executed once a user logs on. These scripts are invaluable for dynamically setting up network configurations for users when they log on. The downside is that because they run on Windows, they must use the Windows network configuration commands.

    -If you would like more information on NET commands, we recommend the following O'Reilly handbooks: -Windows NT in a Nutshell, -Windows 95 in a Nutshell, and -Windows 98 in a Nutshell.

    -You can instruct Samba to use a logon script with the -logon -script option, as follows:

    -[global]
-	domain logons = yes
-	security = user
-	workgroup = SIMPLE
-
-	os level = 34
-	local master = yes
-	preferred master = yes
-	domain master = yes
-	logon script = %U.bat
-
-[netlogon]
-	comment = The domain logon service
-	path = /export/samba/logon
-	public = no
-	writeable = no
-	browsable = no

    -Note that this example uses the -%U variable, which will individualize the script based on the user that is logging in. It is common to customize logon scripts based on the user or machine name that is logging onto the domain. These scripts can then be used to configure individual settings for users or clients.

    -Each logon script should be stored at the base of the -[netlogon] share. For example, if the base of the -[netlogon] share is -/export/samba/logon and the logon script is -jeff.bat, the file should be located at -/export/samba/logon/jeff.bat. When a user logs on to a domain that contains a startup script, he or she will see a small dialog that informs them that the script is executing, as well as any output the script generates in an MS-DOS-like box.

    -One warning: because these scripts are loaded by Windows and executed on the Windows side, they must consist of DOS formatted carriage-return/linefeed characters instead of Unix carriage returns. It's best to use a DOS- or Windows-based editor to create them.

    -Here is an example of a logon script that sets the current time to match that of the Samba server and maps two network drives, -h and -i, to individual shares on the server:

    -#  Reset the current time to that shown by the server.
-#  We must have the "time server = yes" option in the
-#  smb.conf for this to work.
-
-echo Setting Current Time...
-net time \\hydra /set /yes
-
-#  Here we map network drives to shares on the Samba
-#  server
-echo Mapping Network Drives to Samba Server Hydra...
-net use h: \\hydra\data
-net use i: \\hydra\network
    -

    - -6.6.1 Roaming profiles

    - -In Windows 95 and NT, each user can have his or her own -profile. A profile bundles information such as: the appearance of a user's desktop, the applications that appear on the start menus, the background, and other miscellaneous items. If the profile is stored on a local disk, it's called a -local profile, since it describes what a user's environment is like on one machine. If the profile is stored on a server, on the other hand, the user can download the same profile to any client machine that is connected to the server. The latter is called a -roaming profile because the user can roam around from machine to machine and still use the same profile. This makes it particularly convenient when someone might be logging in from his or her desk one day and from a portable in the field the next. -Figure 6.6 illustrates local and roaming profiles.

    - -Figure 6.6: Local profiles versus roaming profiles

    Figure 6.6

    - - - -

    Samba will provide roaming profiles if it is configured for domain logons -and you set logon path to the user's home -directory and logon home to a -subdirectory of the user's home directory used to store profiles. These -options are typically used with one of the user variables, as shown in this -example: -

    -[global]
-        domain logons = yes
-        security = user
-	workgroup = SIMPLE
-	os level = 34
-	local master = yes
-	preferred master = yes
-	domain master = yes
-
-	logon home = \\%N\%U
-	logon path = \\%N\%U\profile 
-
    -

    Samba versions previous to 2.0.6 allowed Win9X machines to store -profiles in separate shares, but that prevented the clients from setting -their logon path so they could get their home -directory mounted by saying "net use /home". This was corrected in -2.0.6.

    - - - - - -Once a user initially logs on, the Windows client will create a -user.dat or -ntuser.dat file - depending on which operating system the client is running. The client then uploads the contents of the desktop, the Start Menu, the Network Neighborhood, and the programs folders in individual folders in the directory. When the user subsequently logs on, those contents will be downloaded from the server and activated for the client machine with which the user is logging on. When he or she logs off, those contents will be uploaded back on the server until the next time the user connects. If you look at the directory listing of a profile folder, you'll see the following:

    -# ls -al 
-
-total 321
-drwxrwxr-x   9 root  simple    Jul 21 20:44 .
-drwxrwxr-x   4 root  simple    Jul 22 14:32 ..
-drwxrwx---   3 fred  develope  Jul 12 07:15 Application Data
-drwxrwx---   3 fred  develope  Jul 12 07:15 Start Menu
-drwxrwx---   2 fred  develope  Jul 12 07:15 cookies
-drwxrwx---   2 fred  develope  Jul 12 07:15 desktop
-drwxrwx---   7 fred  develope  Jul 12 07:15 history
-drwxrwx---   2 fred  develope  Jul 12 07:15 nethood
-drwxrwx---   2 fred  develope  Jul 19 21:05 recent
--rw-------   1 fred  develope  Jul 21 21:59 user.dat

    -The -user.dat files are binary configuration files, created automatically by Windows. They can be edited with the Profile Editor on a Windows client, but they can be somewhat tricky to get correct. Samba supports them correctly for all clients up to NT 5.0 beta, but they're still relatively new.

    -Hints and HOWTOs for handling logon scripts are available in the Samba documentation tree, in both -docs/textdocs/DOMAIN.txt and -docs/textdocs/PROFILES.txt. -

    -

    - -6.6.2 Mandatory profiles

    Users can also have -mandatory profiles, which are roaming profiles that they cannot change. For example, with a mandatory profile, if a user adds a command to the Start Menu on Tuesday, it will be gone when he or she logs in again on Wednesday. The mandatory profile is simply a -user.dat file that has been renamed to -user.man and made read-only on the Unix server. It normally contains settings that the administrator wishes to ensure the user always executes. For example, if an administrator wants to create a fixed user configuration, he or she can do the following:

      -
    1. -

      - -Create the read-write directory on the Samba server.

    2. -

      - -Set the -logon -path option in the -smb.conf file to point to this directory.

    3. -

      - -Logon as the user from Windows 95/98 to have the client populate the directory.

    4. -

      - -Rename the resulting -user.dat to -user.man.

    5. -

      - -Make the directory and its contents read only.

    -Mandatory profiles are fairly unusual. Roaming profiles, on the other hand, are one of the more desirable features of Windows that Samba can support.

    -

    - -6.6.3 Logon Script Options

    -Table 6.10 summarizes the options commonly used in association with Windows domain logon scripts.


    - - - - - - - - -
    - -Table 6.10: Logon Script Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -logon script

    		 -

    -string (DOS path)

    		 -

    -Name of DOS/NT batch file

    		 -

    -None

    		 -

    -Global

    -

    - -logon path

    		 -

    -string (UNC server and share name)

    		 -

    -Location of roaming profile for user

    		 -

    - -\\%N\%U\profile

    		 -

    -Global

    -

    - -logon drive

    		 -

    -string (drive letter)

    		 -

    -Specifies the logon drive for a home directory (NT only)

    		 -

    - -Z:

    		 -

    -Global

    -

    - -logon home

    		 -

    -string (UNC server and share name)

    		 -

    -Specifies a location for home directories for clients logging on to the domain

    		 -

    - -\\%N\%U

    		 -

    -Global

    -

    - -6.6.3.1 logon script

    -This option specifies a Windows .BAT or .CMD file with lines ending in carriage-return/line feed that will be executed on the client after a user has logged on to the domain. Each logon script should be stored at the base of a share entitled -[netlogin] (see the section -Section 6.5.1 for details.) This option frequently uses the -%U or -%m variables (user or NetBIOS name) to point to an individual script. For example:

    -logon script = %U.bat

    -will execute a script based on the username located at the base of the -[netlogin] share. If the user who is connecting is -fred and the path of the -[netlogin] share maps to the directory -/export/samba/netlogin, the script should be -/export/samba/netlogin/fred.bat. Because these scripts are downloaded to the client and executed on the Windows side, they must consist of DOS formatted carriage-return/linefeed characters instead of Unix carriage returns.

    -

    - -6.6.3.2 logon path

    -This option provides a location for roaming profiles. When the user logs on, a roaming profile will be downloaded from the server to the client and activated for the user who is logging on. When the user logs off, those contents will be uploaded back on the server until the next time the user connects.

    -It is often more secure to create a separate share exclusively for storing user profiles:

    -logon path = \\hydra\profile\%U

    -For more informaiton on this option, see the section -Section 6.6, Logon Scripts, earlier in this chapter.

    -

    - -6.6.3.3 logon drive

    -This option specifies the drive letter on an NT client to which the home directory specified with the -logon -home option will be mapped. Note that this option will work with Windows NT clients only. For example:

    -logon home = I:

    -You should always use drive letters that will not conflict with fixed drives on the client machine. The default is Z:, which is a good choice because it is as far away from A:, C:, and D: as possible.

    -

    - -6.6.3.4 logon home

    -This option specifies the location of a user's home directory for use by the DOS NET commands. For example, to specify a home directory as a share on a Samba server, use the following:

    -logon home = \\hydra\%U

    -Note that this works nicely with the -[homes] service, although you can specify any directory you wish. Home directories can be mapped with a logon script using the following command:

    -NET USE I: /HOME

    -In addition, you can use the User Environment Profile under User Properties in the Windows NT User Manager to verify that the home directory has automatically been set.

    -

    - -6.6.4 Other Connection Scripts

    After a user successfully makes a connection to any Samba share, you may want the Samba server to execute a program on its side to prepare the share for use. Samba allows scripts to be executed before and after someone connects to a share. You do not need to be using Windows domains to take advantage of the options. -Table 6.11 introduces some of the configuration options provided for setting up users.


    - - - - - - - - -
    - -Table 6.11: Connection Script Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -root preexec

    		 -

    -string (Unix command)

    		 -

    -Sets a command to run as -root, before connecting to the share.

    		 -

    -None

    		 -

    -Share

    -

    - -preexec (exec)

    		 -

    -string (Unix command)

    		 -

    -Sets a Unix command to run as the user before connecting to the share.

    		 -

    -None

    		 -

    -Share

    -

    - -postexec

    		 -

    -string (Unix command)

    		 -

    -Sets a Unix command to run as the user after disconnecting from the share.

    		 -

    -None

    		 -

    -Share

    -

    - -root postexec

    		 -

    -string (Unix command)

    		 -

    -Sets a Unix command to run as -root after disconnecting from the share.

    		 -

    -None

    		 -

    -Share

    -

    - -6.6.4.1 root preexec

    -The first form of the logon command is called -root -preexec. This option specifies a Unix command as its value that will be run -as the root user before any connection to a share is completed. You should use this option specifically for performing actions that require root privilege. For example, -root -preexec can be used to mount CD-ROMs for a share that makes them available to the clients, or to create necessary directories. If no -root -preexec option is specified, there is no default action. Here is an example of how you can use the command to mount a CD-ROM:

    -[homes]
-	browseable = no
-	writeable = yes
-	root preexec = /etc/mount /dev/cdrom2

    -Remember that these commands will be run as the root user. Therefore, in order to ensure security, users should never be able to modify the target of the -root -preexec command.

    -

    - -6.6.4.2 preexec

    -The next option run before logon is the -preexec option, sometimes just called -exec. This is an ordinary unprivileged command run by Samba as the user specified by the variable -%u. For example, a common use of this option is to perform logging, such as the following:

    -[homes]
-preexec = echo "%u connected to %S from %m (%I)\" >>/tmp/.log

    -Be warned that any information the command sends to standard output will not be seen by the user, but is instead thrown away. If you intend to use a -preexec script, you should ensure that it will run correctly before having Samba invoke it.

    -

    - -6.6.4.3 postexec

    -Once the user disconnects from the share, the command specified with -postexec is run as the user on the Samba server to do any necessary cleanup. This option is essentially the same as the -preexec option. Again, remember that the command is run as the user represented by -%u and any information sent to standard output will be ignored.

    -

    - -6.6.4.4 root postexec

    -Following the -postexec option, the -root -postexec command is run, if one has been specified. Again, this option specifies a Unix command as its value that will be run -as the root user before disconnecting from a share. You should use this option specifically for performing actions that require root privilege.

    -

    - -6.6.5 Working with NIS and NFS

    -Finally, Samba has the ability to work with NIS and NIS+. If there is more than one file server, and each runs Samba, it may be desirable to have the SMB client connect to the server whose disks actually house the user's home directory. It isn't normally a good idea to ship files across the network once via NFS to a Samba server, only to be sent across the network once again to the client via SMB. (For one thing, it's slow - about 30 percent of normal Samba speed). Therefore, there are a pair of options to tell Samba that NIS knows the name of the right server and indicate in which NIS map the information lives.

    - -Table 6.12 introduces some of the other configuration options specifically for setting up users.


    - - - - - - -
    - -Table 6.12: NIS Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -nis homedir

    		 -

    -boolean

    		 -

    -If -yes, use NIS instead of -/etc/passwd to look up the path of a user's home directory

    		 -

    - -no

    		 -

    -Global

    -

    - -homedir map

    		 -

    -string (NIS map name)

    		 -

    -Sets the NIS map to use to look up a user's home directory

    		 -

    -None

    		 -

    -Global

    -

    - -6.6.5.1 nis homedir and homedir map

    -The -nis -homedir and -homedir -map options are for Samba servers on network sites where Unix home directories are provided using NFS, the automounter, and NIS (Yellow Pages).

    -The -nis -homedir option indicates that the home directory server for the user needs to be looked up in NIS. The -homedir -map option tells Samba what NIS map to look in for the server that has the user's home directory. The server needs to be a Samba server, so the client can do an SMB connect to it, and the other Samba servers need to have NIS installed so they can do the lookup.

    -For example, if user -joe asks for a share called -[joe], and the -nis -homedir option is set to -yes, Samba will look in the file specified by -homedir -map for a home directory for -joe. If it finds one, Samba will return the associated machine name to the client. The client will then try to connect to -that machine and get the share from there. Enabling NIS lookups looks like the following:

    -[globals]
-	nis homedir = yes
-	homedir map = amd.map
    -
    -
    -
    - - -
    - -Previous: 6.5 Windows Domains - - - -Next: 7. Printing and Name Resolution
    -6.5 Windows Domains - -Book Index -7. Printing and Name Resolution
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch07_01.html b/docs/htmldocs/using_samba/ch07_01.html deleted file mode 100644 index a061c6a94e..0000000000 --- a/docs/htmldocs/using_samba/ch07_01.html +++ /dev/null @@ -1,565 +0,0 @@ - - - -[Chapter 7] Printing and Name Resolution - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 6.6 Logon Scripts - - -Chapter 7 - -Next: 7.2 Printing to Windows Client Printers
     
    - -
    -
    -

    - -7. Printing and Name Resolution

    -

    - -Contents:
    - -Sending Print Jobs to Samba
    - -Printing to Windows Client Printers
    - -Name Resolution with Samba

    -

    This chapter tackles two Samba topics: setting up printers for use with a Samba server and configuring Samba to use or become a Windows Internet Name Service (WINS) server. Samba allows client machines to send documents to printers connected to the Samba server. In addition, Samba can also assist you with printing Unix documents to a printer on a Windows machine. In the first part of this chapter, we will discuss how to get printers configured to work on either side.

    -In the second half of the chapter, we will introduce the Windows Internet Name Service, Microsoft's implementation of a NetBIOS Name Server (NBNS). As mentioned in Chapter 1, Learning the Samba, an NBNS allows machines to perform name resolution on a NetBIOS network without having to rely on broadcasts. Instead, each machine knows exactly where the WINS server is and can query it for the IP addresses of other machines on the network.

    -

    - - -7.1 Sending Print Jobs to Samba

    A printer attached to the Samba server shows up in the list of shares offered in the Network Neighborhood. If the printer is registered on the client machine and the client has the correct printer driver installed, the client can effortlessly send print jobs to a printer attached to a Samba server. -Figure 7.1 shows a Samba printer as it appears in the Network Neighborhood of a Windows client.

    To administer printers with Samba, you should understand the basic process by which printing takes place on a network. Sending a print job to a printer on a Samba server involves four steps:

      -
    1. -

      - -Opening and authenticating a connection to the printer share

    2. -

      - -Copying the file over the network

    3. -

      - -Closing the connection

    4. -

      - -Printing and deleting the copy of the file

      - -Figure 7.1: A Samba printer in the Network Neighborhood

      Figure 7.1

    -When a print job arrives at a Samba server, the print data is temporarily written to disk in the directory specified by the -path option of the printer share. Samba then executes a Unix print command to send that data file to the printer. The job is printed as the authenticated user of the share. Note that this may be the guest user, depending on how the share is configured.

    -

    - -7.1.1 Print Commands

    In order to print the document, you'll need to tell Samba what the command is to print and delete a file. On Linux, such a command is:

    -lpr -r -Pprinter file

    -This tells -lpr to copy the document to a spool area, usually -/var/spool, retrieve the name of the printer in the system configuration file (/etc/printcap), and interpret the rules it finds there to decide how to process the data and which physical device to send it to. Note that because the --r option has been listed, the file specified on the command line will be deleted after it has been printed. Of course, the file removed is just a copy stored on the Samba server; the original file on the client is unaffected.

    -Linux uses a Berkeley (BSD) style of printing. However, the process is similar on System V Unix. Here, printing and deleting becomes a compound command:

    lp -dprinter -s file; rm  file

    -With System V, the -/etc/printcap file is replaced with different set of configuration files hiding in -/usr/spool/lp, and there is no option to delete the file. You have to do it yourself, which is why we have added the -rm command afterward.

    -

    - -7.1.2 Printing Variables

    Samba provides four variables specifically for use with printing configuration options. They are shown in -Table 7.1.


    - - - - - - - - -
    - -Table 7.1: Printing Variables
    -

    -Variable

    		 -

    -Definition

    -

    - -%s

    		 -

    -The full pathname of the file on the Samba server to be printed

    -

    - -%f

    		 -

    -The name of the file itself (without the preceding path) on the Samba server to be printed

    -

    - -%p

    		 -

    -The name of the Unix printer to use

    -

    - -%j

    		 -

    -The number of the print job (for use with -lprm, -lppause, and -lpresume)

    -

    - -7.1.3 A Minimal Printing Setup

    Let's start with a simple but illustrative printing share. Assuming that you're on a Linux system and you have a printer called -lp listed in the printer capabilities file, the following addition to your -smb.conf file will make the printer accessible through the network:

    -[printer1]
-	printable = yes
-	print command = /usr/bin/lpr -r  %s
-	printer = lp
-	printing = BSD
-	read only = yes
-	guest ok = yes

    -This configuration allows anyone to send data to the printer, something we may want to change later. For the moment, what's important to understand is that the variable -%s in the -print -command option will be replaced with the name of the file to be printed when Samba executes the command. Changing the -print command to reflect a different style of Unix machine typically involves only replacing the right side of the -print -command option with whatever command you need for your system and changing the target of the -printing option.

    -Let's look at the commands for a System V Unix. With variable substitution, the System V Unix command becomes:

    -print command = lp -d%p -s %s; rm %s

    -As mentioned earlier, the -%p variable resolves to the name of the printer, while the -%s variable resolves to the name of the file. After that, you can change the -printing option to reflect that you're using a System V architecture:

    -printing = SYSV

    -If you are using share-level security, pay special attention to the guest account used by Samba. The typical setting, -nobody, may not be allowed to print by the operating system. If that's true for your operating system, you should place a -guest -account option under the printing share (or even perhaps the global share) specifying an account that can. A popular candidate with the Samba authors is the -ftp account, which is often preconfigured to be safe for untrusted guest users. You can set it with the following command:

    -guest account = ftp

    -Another common printing issue is that clients may need to request the status of a print job sent to the Samba server. Samba will not reject a document from being sent to an already busy printer share. Consequently, Samba needs the ability to communicate not only the status of the current printing job to the client, but also which documents are currently waiting to be printed on that printer. Samba also has to provide the client the ability to pause print jobs, resume print jobs, and remove print jobs from the printing queue. Samba provides options for each of these tasks. As you might expect, they borrow functionality from existing Unix commands. The options are:

      -
    • -

      - - -lpq command

    • -

      - - -lprm command

    • -

      - - -lppause command

    • -

      - - -lpresume command

    -We will cover these options in more detail below. For the most part, however, the value of the -printing configuration option will determine their values, and you should not need to alter the default values of these options.

    -Here are a few important items to remember about printing shares:

      -
    • -

      - -You must put -printable -= -yes in all printer shares (even -[printers]), so that Samba will know that they are printer shares. If you forget, the shares will not be usable for printing and will instead be treated as disk shares.

    • -

      - -If you set the -path configuration option in the printer section, any files sent to the printer(s) will be copied to the directory you specify instead of to the default location of -/tmp. As the amount of disk space allocated to -/tmp can be relatively small in some Unix operating systems, many administrators opt to use -/var/spool or some other directory instead.

    • -

      - -The -read only option is ignored for printer shares.

    • -

      - -If you set -guest -ok -= -yes in a printer share and Samba is configured for share-level security, it will allow anyone to send data to the printer as the -guest -account user.

    -Using one or more Samba machines as a print server gives you a great deal of flexibility on your LAN. You can easily partition your available printers, restricting some to members of one department, or you can maintain a bank of printers available to all. In addition, you can restrict a printer to a selected few by adding the trusty -valid -users option to its share definition:

    -[deskjet]
-	printable = yes
-	path = /var/spool/samba/print
-	valid users = gail sam

    -All of the other share accessibility options defined in the previous chapter should work for printing shares as well. Since the printers themselves are accessed through Samba by name, it's also simple to delegate print services among several servers using familiar Unix commands for tasks such as load balancing or maintenance.

    -

    - -7.1.4 The [printers] Share

    -Chapter 4, Disk Shares , briefly introduced -[printers], a special share for automatically creating printing services. Let's review how it works: if you create a share named -[printers] in the configuration file, Samba will automatically read in your printer capabilities file and create a printing share for each printer that appears in the file. For example, if the Samba server had -lp, -pcl and -ps printers in its printer capabilities file, Samba would provide three printer shares with those names, each configured with the options in the -[printers] share.

    Recall that Samba obeys following rules when a client requests a share that has not been created through the -smb.conf file:

      -
    • -

      - -If the share name matches a username in the system password file and a -[homes] share exists, a new share is created with the name of the user and is initialized using the values given in the -[homes] and -[global] sections.

    • -

      - -Otherwise, if the name matches a printer in the system printer capabilities file, and a -[printers] share exists, a new share is created with the name of the printer and initialized using the values given in the -[printers] section. (Variables in the -[global] section do not apply here.)

    • -

      - -If neither of those succeed, Samba looks for a -default -service share. If none is found, it returns an error.

    -This brings to light an important point: be careful that you do not give a printer the same name as a user. Otherwise, you will end up connecting to a disk share when you may have wanted a printer share instead.

    -Here is an example -[printers] share for a Linux (BSD) system. Some of these options are already defaults; however, we have listed them anyway for illustrative purposes:

    -[global] 
-	printing = BSD
-	print command = /usr/bin/lpr -P%p -r %s 
-	printcap file = /etc/printcap 
-	min print space = 2000
-
-[printers] 
-	path = /usr/spool/public 
-	printable = true  
-	guest ok = true 
-	guest account = pcguest

    -Here, we've given Samba global options that specify the printing type (BSD), a print command to send data to the printer and remove a temporary file, our default printer capabilities file, and a minimum printing space of 2 megabytes.

    -In addition, we've created a -[printers] share for each of the system printers. Our temporary spooling directory is specified by the -path option: -/usr/spool/public. Each of the shares is marked as printable - this is necessary, even in the -[printers] section. The two -guest options are useful in the event that Samba is using share-level security: we allow guest access to the printer and we specify the guest user that Samba should use to execute print commands.

    -

    - -7.1.5 Test Printing

    Here is how you can test printing from the Samba server. Let's assume the most complex case and use a guest account. First, run the Samba -testparm command on your configuration file that contains the print shares, as we did in Chapter 2, Installing Samba on a Unix System. This will tell you if there are any syntactical problems with the configuration file. For example, here is what you would see if you left out the -path configuration option in the previous example:

    -# testparm 
-Load smb config files from /usr/local/samba/lib/smb.conf 
-Processing configuration file "/usr/local/samba/lib/smb.conf" 
-Processing section "[global]" 
-Processing section "[homes]" 
-Processing section "[data]" 
-Processing section "[printers]" 
-No path in service printers - using /tmp 
-Loaded services file OK. 
-Press enter to see a dump of your service definitions
-Global parameters: 
-	load printers: Yes 
-	printcap name: /etc/printcap
-Default service parameters: 
-	guest account: ftp 
-	min print space: 0 
-	print command: lpr -r -P%p %s 
-	lpq command: lpq -P%p 
-	lprm command: lprm -P%p %j 
-lppause command: 
-	lpresume command: 
- Service parameters [printers]: 
-	path: /tmp 	
-	print ok: Yes 
-	read only: true 
-	public: true

    -Second, try the command -testprns - -printername. This is a simple program that verifies that the specified printer is available in your -printcap file. If your -printcap file is not in the usual place, you can specify its full pathname as the second argument to the -testprns command:

    -# testprns lp /etc/printcap
-Looking for printer lp in printcap file /etc/printcap
-Printer name lp is valid.

    -Next, log on as the guest user, go to the spooling directory, and ensure that you can print using the same command that -testparm says Samba will use. As mentioned before, this will tell you if you need to change the guest account, as the default account may not be allowed to print.

    -Finally, print something to the Samba server via -smbclient, and see if the following actions occur:

      -
    • -

      - -The job appears (briefly) in the Samba spool directory specified by the path.

    • -

      - -The job shows up in your print systems spool directory.

    • -

      - -The job disappears from the spool directory that Samba used.

    -If -smbclient cannot print, you can reset the -print -command option to collect debugging information:

    -print command = /bin/cat %s >>/tmp/printlog; rm %s

    -or:

    -print command = echo "printed %s on %p" >>/tmp/printlog

    -A common problem with Samba printer configuration is forgetting to use the full pathnames for commands; simple commands often don't work because the guest account's PATH doesn't include them. Another frequent problem is not having the correct permissions on the spooling directory.

    There is more information on debugging printers in the Samba documentation (Printing.txt). In addition, the Unix print systems are covered in detail in AEleen Frisch's -Essential Systems Administration (published by O'Reilly).

    -

    - -7.1.6 Setting Up and Testing a Windows Client

    Now that Samba is offering a workable printer, you need to set it up on a Windows client. Look at the Samba server in the Network Neighborhood. It should now show each of the printers that are available. For example, in -Figure 7.1, we saw a printer called -lp.

    -Next, you need to have the Windows client recognize the printer. Double-click on the printer icon to get started. If you try to select an uninstalled printer (as you just did), Windows will ask you if it should help configure it for the Windows system. Respond "Yes," which will open the Printer Wizard.

    -The first thing the wizard will ask is whether you need to print from DOS. Let's assume you don't, so choose No and press the Next button to get to the manufacturer/model window as shown in -Figure 7.2.

    - -Figure 7.2: A printer in the Network Neighborhood

    Figure 7.2

    -In this dialog box, you should see a large list of manufacturers and models for almost every printer imaginable. If you don't see your printer on the list, but you know it's a PostScript printer, select Apple as the manufacturer and Apple LaserWriter as the model. This will give you the most basic Postscript printer setup, and arguably one of the most reliable. If you already have any Postscript printers attached, you will be asked about replacing or reusing the existing driver. Be aware that if you replace it with a new one, you may make your other printers fail. Therefore, we recommend you keep using your existing printer drivers as long as they're working properly.

    -Following that, the Printer Wizard will ask you to name the printer. -Figure 7.3 shows this example, where the name has defaulted to our second laserwriter. Here, you rename it from Apple Laserwriter (Copy 2) to "ps on Samba server," so you know where to look for the printouts. In reality, you can name the printer anything you want.

    - -Figure 7.3: Printer manufacturers and models

    Figure 7.3

    -Finally, the Printing Wizard asks if it should print a test page. Click on Yes, and you should be presented with the dialog in -Figure 7.4.

    - -Figure 7.4: Printing successfully completed

    Figure 7.4

    -If the test printing was unsuccessful, press the No button in -Figure 7.4 and the Printing Wizard will walk you through some debugging steps for the client side of the process. If the test printing does work, congratulations! The remote printer will now be available to all your PC applications through the File and Print menu items.

    -

    - -7.1.7 Automatically Setting Up Printer Drivers

    The previous section described how to manually configure a printer driver for your Windows system. As a system administrator, however, you can't always guarantee that users can perform such a process without making mistakes. Luckily, however, you can ask Samba to automatically set up the printer drivers for a specific printer.

    -Samba has three options that can be used to automatically set up printer drivers for clients who are connecting for the first time. These options are -printer -driver, -printer -driver -file, and -printer -driver -location. This section explains how to use these options to allow users to skip over the Manufacturer dialog in the Add Printer Wizard above.

    -For more information on how to do this, see the -PRINTER_DRIVER.TXT file in the Samba distribution documentation.

    -There are four major steps:

      -
    1. -

      - -Install the drivers for the printer on a Windows client (the printer need not be attached).

    2. -

      - -Create a printer definition file from the information on a Windows machine.

    3. -

      - -Create a -PRINTER$ share where the resulting driver files can be placed.

    4. -

      - -Modify the Samba configuration file accordingly.

    -Let's go over each of the four steps in greater detail.

    -

    - -7.1.7.1 Install the drivers on a windows client

    -Use Windows 95/98 for this step. It doesn't matter which client you choose, as long as it has the ability to load the appropriate drivers for the printer. In fact, you don't even need to have the printer attached to the machine. All you're interested in here is getting the appropriate driver files into the Windows directory. First, go to the Printers window of My Computer and double-click on the Add Printer icon, as shown in -Figure 7.5.

    - -Figure 7.5: The Printers window

    Figure 7.5

    -At this point, you can follow the Add Printer Wizard dialogs through to select the manufacturer and model of the printer in question. If it asks you if you want to print from MS-DOS, answer No. Windows should load the appropriate driver resources from its CD-ROM and ask you if you want to print a test page. Again, respond No and close the Add Printer Wizard dialog.

    -

    - -7.1.7.2 Create a printer definition file

    -You can create a printer definition file by using the -make_ printerdef script in the -/usr/local/samba/bin directory. In order to use this script, you need to copy over the following four files from a Windows client:[1]

    -
    -

    -[1] Older Windows 95 clients may have only the first two files.

    - - - - -
    - -C:\WINDOWS\INF\MSPRINT.INF
    - -C:\WINDOWS\INF\MSPRINT2.INF
    - -C:\WINDOWS\INF\MSPRINT3.INF
    - -C:\WINDOWS\INF\MSPRINT4.INF

    -Once you have the four files, you can create a printer definition file using the appropriate printer driver and its .INF file. If the printer driver starts with the letters A-K, use either the -MSPRINT.INF file or the -MSPRINT3.INF file. If it begins with the letters L-Z, use the -MSPRINT2.INF file or the -MSPRINT4.INF file. You may need to -grep through each of the files to see where your specific driver is. For the following example, we have located our driver in -MSPRINT3.INF and created a printer definition file for a HP DeskJet 560C printer:

    -$grep "HP DeskJet 560C Printer" MSPRINT.INF MSPRINT3.INF
-MSPRINT3.INF: "HP DeskJet 560C Printer"=DESKJETC.DRV,HP_DeskJet_ ...
-
-$make_printerdef MSPRINT3.INF "HP DeskJet 560C Printer" >printers.def
-FOUND:DESKJETC.DRV
-End of section found
-CopyFiles: DESKJETC,COLOR_DESKJETC
-Datasection: (null)
-Datafile: DESKJETC.DRV
-Driverfile: DESKJETC.DRV
-Helpfile: HPVDJC.HLP
-LanguageMonitor: (null)
-
-Copy the following files to your printer$ share location:
-DESKJETC.DRV
-HPVCM.HPM
-HPVIOL.DLL
-HPVMON.DLL
-HPVRES.DLL
-HPCOLOR.DLL
-HPVUI.DLL
-HPVDJCC.HLP
-color\HPDESK.ICM

    -Note the files that the script asks you to copy. You'll need those for the next step.

    -

    - -7.1.7.3 Create a PRINTER$ share

    This part is relatively easy. Create a share called -[PRINTER$] in your -smb.conf that points to an empty directory on the Samba server. Once that is done, copy over the files that the -make_ printerdef script requested of you into the location of the -path configuration option for the -[PRINTER$] share. For example, you can put the following in your configuration file:

    -[PRINTER$]
-	path = /usr/local/samba/print
-	read only = yes
-	browsable = no
-	guest ok = yes

    -The files requested by the -make_ printerdef script are typically located in the -C:\WINDOWS\SYSTEM directory, although you can use the following commands to find out exactly where they are:

    -cd C:\WINDOWS
-dir 
-
-filename /s

    -In this case, each of the files needs to be copied to the -/usr/local/samba/print directory on the Samba server. In addition, copy the -printers.def file that you created over to that share as well. Once you've done that, you're almost ready to go.

    -

    - -7.1.7.4 Modify the Samba configuration file

    - -The last step is to modify the Samba configuration file by adding the following three options:

      -
    • -

      - - -printer -driver

    • -

      - - -printer -driver -file

    • -

      - - -printer -driver -location

    -The -printer -driver -file is a global option that points to the -printers.def file; place that option in your -[global] section. The other options should be set in the printer share for which you wish to automatically configure the drivers. The value for -printer -driver should match the string that shows up in the Printer Wizard on the Windows system. The value of the -printer -driver -location is the pathname of the PRINTER$ share you set up, not the Unix pathname on the server. Thus, you could use the following:

    -[global]
-	printer driver file = /usr/local/samba/print/printers.def
-[hpdeskjet]
-	path = /var/spool/samba/printers
-	printable = yes
-
-	printer driver = HP DeskJet 560C Printer
-	printer driver location = \\%L\PRINTER$

    -Now you're ready to test it out. At this point, remove the Windows printer that you "set up" in the first step from the list of printers in the Printers window of My Computer. If Samba asks you to delete unneeded files, do so. These files will be replaced shortly on the client, as they now exist on the Samba server.

    -

    - -7.1.7.5 Testing the configuration

    -Restart the Samba daemons and look for the -[hpdeskjet] share under the machine name in the Network Neighborhood. At this point, if you click on the printer icon, you should begin the printer setup process and come to the dialog shown in -Figure 7.6.

    -This is different from the dialog you saw earlier when setting up a printer. Essentially, the dialog is asking if you wish to accept the driver that is "already installed" - in other words, offered by Samba. Go ahead and keep the existing driver, and press the Next button. At this point, you can give the printer a name and print out a test page. If it works, the setup should be complete. You should be able to repeat the process now from any Windows client.

    - -Figure 7.6: Automatically configuring the printer driver

    Figure 7.6
    -
    -
    -
    - - -
    - -Previous: 6.6 Logon Scripts - - - -Next: 7.2 Printing to Windows Client Printers
    -6.6 Logon Scripts - -Book Index -7.2 Printing to Windows Client Printers
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch07_02.html b/docs/htmldocs/using_samba/ch07_02.html deleted file mode 100644 index c9a9010e97..0000000000 --- a/docs/htmldocs/using_samba/ch07_02.html +++ /dev/null @@ -1,757 +0,0 @@ - - - -[Chapter 7] 7.2 Printing to Windows Client Printers - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 7.1 Sending Print Jobs to Samba - - - -Chapter 7
    -Printing and Name Resolution    		 - -Next: 7.3 Name Resolution with Samba
     
    - -
    -
    -

    - -7.2 Printing to Windows Client Printers

    If you have printers connected to clients running Windows 95/98 or NT 4.0, those printers can also be accessed from Samba. Samba comes equipped with a tool called -smbprint that can be used to spool print jobs to Windows-based printers. In order to use this, however, you need to set up the printer as a shared resource on the client machine. If you haven't already done this, you can reset this from the Printers window, reached from the Start button, as shown in -Figure 7.7.

    - -Figure 7.7: The Printers window

    Figure 7.7

    -Select a printer that's locally connected (for example, ours is the Canon printer), press the right mouse button to bring up a menu, and select Sharing. This will give you the Sharing tab of the Printer Properties frame, as shown in -Figure 7.8. If you want it available to everybody on your LAN as the Windows guest user, enter a blank password.

    - -Figure 7.8: The Sharing tab of the printer

    Figure 7.8

    -Once you've got this working, you can add your printer to the list of standard printers and Samba can make it available to all the other PCs in the workgroup. To make installation on Unix easier, the Samba distribution provides two sample scripts: -smbprint and -smbprint.sysv. The first works with BSD-style printers; the second is designed for System V printers.

    -

    - -7.2.1 BSD printers

    There are two steps you need to have a BSD Unix recognize a remote printer:

      -
    1. -

      - -Place an entry for the printer in the -/etc/printcap file (or equivalent).

    2. -

      - -Place a configuration file in the -/var/spool directory for the printer.

    -First, edit your -/etc/printcap file and add an entry for the remote printer. Note that the input filter (if) entry needs to point to the -smbprint program if the machine is on Windows 95/98. The following set of lines will accomplish on a Linux machine, for example:

    -laserjet:\
-  :sd=/var/spool/lpd/laser:\         
-
-# spool directory
-  :mx#0:\                            
-
-# maximum file size (none)
-  :sh:\                              
-
-# surpress burst header (no)
-  :if=/usr/local/samba/bin/smbprint: 
-
-# text filter

    -After that, you need to create a configuration file in the spool directory that you specified with the -sd parameter above. (You may need to create that directory.) The file must have the name -.config and should contain the following information:

      -
    • -

      - -The NetBIOS name of the Windows machine with the printer

    • -

      - -The service name that represents the printer

    • -

      - -The password used to access that service

    -The last two parameters were set up in the Sharing dialog for the requested resource on the Windows machine. In this case, the -.config file would have three lines:

    -server = phoenix
-service = CANON
-password = ""

    -After you've done that, reset the Samba server machine and try printing to it using any standard Unix program.

    -

    - -7.2.2 System V printers

    Sending print jobs from a System V Unix system is a little easier. Here, you need to get obtain the -smbprint.sysv script in the -/usr/local/samba/examples/printing directory and do the following:

      -
    1. -

      - -Change the -server, -service, and -password parameters in the script to match the NetBIOS machine, its shared printer service, and its password, respectively. For example, the following entries would be correct for the service in the previous example:

    -server = phoenix
-service = CANON
-password = ""
      -
    1. -

      - -Run the following commands, which create a reference for the printer in the printer capabilities file. Note that the new Unix printer entry canon_printer is named:

    -# lpadmin -p canon_printer -v /dev/null -i ./smbprint.sysv
-# enable canon_printer
-# accept canon_printer

    -After you've done that, restart the Samba daemons and try printing to it using any standard Unix program. You should now be able to send data to a printer on a Windows client across the network.

    -

    - -7.2.3 Samba Printing Options

    -Table 7.2 summarizes the Samba printing options.


    - - - - - - - - - - - - - - - - - - - - - - -
    - -Table 7.2: Printing Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -printing

    		 -

    - -bsd, -sysv, -hpux, -aix, -qnx, -plp, -softq, or -lprng

    		 -

    -Sets the print system type for your Unix system.

    		 -

    -System dependent

    		 -

    -Share

    -

    - -printable (print ok)

    		 -

    -boolean

    		 -

    -Marks a share as a printing share.

    		 -

    - -no

    		 -

    -Share

    -

    - -printer (printer name)

    		 -

    -string (Unix printer name)

    		 -

    -Sets the name of the printer to be shown to clients.

    		 -

    -System dependent

    		 -

    -Share

    -

    - -printer driver

    		 -

    -string (printer driver name)

    		 -

    -Sets the driver name that should be used by the client to send data to the printer.

    		 -

    -None

    		 -

    -Share

    -

    - -printer driver file

    		 -

    -string (fully-qualified pathname)

    		 -

    -Sets the name of the printer driver file.

    		 -

    -None

    		 -

    -Global

    -

    - -printer driver location

    		 -

    -string (network pathname)

    		 -

    -Specifies the pathname of the share for the printer driver file.

    		 -

    -None

    		 -

    -Share

    -

    - -lpq cache time

    		 -

    -numeric (time in seconds)

    		 -

    -Sets the amount of time in seconds that Samba will cache the lpq status.

    		 -

    - -10

    		 -

    -Global

    -

    - -postscript

    		 -

    -boolean

    		 -

    -Treats all print jobs sent as postscript by prepending -%! at the beginning of each file.

    		 -

    - -no

    		 -

    -Share

    -

    - -load printers

    		 -

    -boolean

    		 -

    -Automatically loads each of the printers in the -printcap file as printing shares.

    		 -

    - -no

    		 -

    -Global

    -

    - -print command

    		 -

    -string (shell command)

    		 -

    -Sets the Unix command to perform printing.

    		 -

    -See below

    		 -

    -Share

    -

    - -lpq command

    		 -

    -string (shell command)

    		 -

    -Sets the Unix command to return the status of the printing queue.

    		 -

    -See below

    		 -

    -Share

    -

    - -lprm command

    		 -

    -string (shell command)

    		 -

    -Sets the Unix command to remove a job from the printing queue.

    		 -

    -See below

    		 -

    -Share

    -

    - -lppause command

    		 -

    -string (shell command)

    		 -

    -Sets the Unix command to pause a job on the printing queue.

    		 -

    -See below

    		 -

    -Share

    -

    - -lpresume command

    		 -

    -string (shell command)

    		 -

    -Sets the Unix command to resume a paused job on the printing queue.

    		 -

    -See below

    		 -

    -Share

    -

    - -printcap name

    - -(printcap)

    		 -

    -string (fully-qualified pathname)

    		 -

    -Specifies the location of the printer capabilities file.

    		 -

    -System dependent

    		 -

    -Global

    -

    - -min print space

    		 -

    -numeric (size in kilobytes)

    		 -

    -Sets the minimum amount of disk free space that must be present to print.

    		 -

    - -0

    		 -

    -Share

    -

    - -queuepause command

    		 -

    -string (shell command)

    		 -

    -Sets the Unix command to pause a queue.

    		 -

    -See below

    		 -

    -Share

    -

    - -queueresume command

    		 -

    -string (shell command)

    		 -

    -Sets the Unix command to resume a queue.

    		 -

    -See below

    		 -

    -Share

    -

    - -7.2.3.1 printing

    -The -printing configuration option tells Samba a little about your Unix printing system, in this case which printing parser to use. With Unix, there are several different families of commands to control printing and print statusing. Samba supports seven different types, as shown in -Table 7.3.


    - - - - - - - - - - - - -
    - -Table 7.3: Printing Types
    -

    -Variable

    		 -

    -Definition

    -

    -BSD

    		 -

    Berkeley Unix system

    -

    -SYSV

    		 -

    -System V

    -

    -AIX

    		 -

    -AIX Operating System (IBM)

    -

    -HPUX

    		 -

    -Hewlett-Packard Unix

    -

    -QNX

    		 -

    -QNX Realtime Operating System (QNX)

    -

    -LPRNG

    		 -

    -LPR Next Generation (Powell)

    -

    -SOFTQ

    		 -

    -SOFTQ system

    -

    -PLP

    		 -

    -Portable Line Printer (Powell)

    -The value for this optio.n will be one of these seven options. For example:

    -printing = SYSV

    -The default value of this option is system dependent and is configured when Samba is first compiled. For most systems, the -configure script will automatically detect the printing system to be used and configure it properly in the Samba makefile. However, if your system is a PLP, LPRNG, or QNX printing system, you will need to explicitly specify this in the makefile or the printing share.

    -The most common system types are BSD and SYSV. Each of the printers on a BSD Unix server are described in the printer capabilities file - normally -/etc/printcap.

    -Setting the -printing configuration option automatically sets at least three other printing options for the service in question: -print -command, -lpq -command, and -lprm -command. If you are running Samba on a system that doesn't support any of these printing styles, simply set the commands for each of these manually.

    -

    - -7.2.3.2 printable

    -The printable option must be set to -yes in order to flag a share as a printing service. If this option is not set, the share will be treated as a disk share instead. You can set the option as follows:

    -[printer1]
-	printable = yes
    -

    - -7.2.3.3 printer

    The option, sometimes called -printer -name, specifies the name of the printer on the server to which the share points. This option has no default and should be set explicitly in the configuration file, even though Unix systems themselves often recognize a default name such as -lp for a printer. For example:

    -[deskjet]
-	printer = hpdkjet1
    -

    - -7.2.3.4 printer driver

    -The -printer -driver option sets the string that Samba uses to tell Windows what the printer is. If this option is set correctly, the Windows Printer Wizard will already know what the printer is, making installation easier for end users by giving them one less dialog to worry about. The string given should match the string that shows up in the Printer Wizard, as shown in -Figure 7.9. For example, an Apple LaserWriter typically uses -Apple LaserWriter; a Hewlett Packard Deskjet 560C uses -HP -DeskJet -560C -Printer.

    - -Figure 7.9: The Add Printer Wizard dialog box in Windows 98

    Figure 7.9

    -Automatically configuring printer drivers with Samba is explained in greater detail in the section -Section 7.1.7, Automatically Setting Up Printer Drivers, earlier in this chapter.

    -

    - -7.2.3.5 printer driver file

    -This global option gives the location of the Windows 95/98 printer driver definition file, which is needed to give printer drivers to clients using a Samba printer. The default value of this option is -/usr/local/samba/lib/printers.def. You can override this default as shown below:

    -[deskjet]
-	printer driver file = /var/printers/printers.def

    -This option is explained in greater detail in the section -Section 7.1.7, earlier in this chapter.

    -

    - -7.2.3.6 printer driver location

    -This option specifies a specific share that contains Windows 95 and 98 printer driver and definition files. There is no default parameter for this value. You can specify the location as a network pathname. A frequent approach is to use a share on your own machine, as shown here:

    -[deskjet]
-	printer driver location = \\%L\PRINTER$

    -This option is also explained in greater detail in the section -Section 7.1.7, earlier in this chapter.

    -

    - -7.2.3.7 lpq cache time

    The global -lpq -cache -time option allows you to set the number of seconds that Samba will remember the current printer status. After this time elapses, Samba will issue an -lpq command (or whatever command you specify with the -lpq -command option) to get a more up-to-date status. This defaults to 10 seconds, but can be increased if your -lpq -command takes an unusually long time to run or you have lots of clients. The following example resets the time to 30 seconds:

    -[deskjet]
-	lpq cache time = 30
    -

    - -7.2.3.8 postscript

    -The -postscript option forces the printer to treat all data sent to it as Postscript. It does this by prepending the characters -%! at the beginning of the first line of each job. It is normally used with PCs that insert a -^D (control-D or end-of-file mark) in front of the first line of a PostScript file. It will not, obviously, turn a non-PostScript printer into a PostScript one. The default value of this options is -no. You can override it as follows:

    [deskjet]
-	postscript = yes
    -

    - -7.2.3.9 print command, lpq command, lprm command, lppause command, lpresume command

    These options tell Samba which Unix commands used to control and send data to the printer. The Unix commands involved are: -lpr (send to Line PRinter), -lpq (List Printer Queue), -lprm (Line printer ReMove), and optionally -lppause and -lpresume. Samba provides an option named after each of these commands, in case you need to override any of the system defaults. For example, consider:

    -lpq command = /usr/ucb/lpq %p

    -This would set the -lpq command to use -/usr/ucb/lpq. Similarly:

    -lprm command = /usr/local/lprm -P%p %j

    -would set the Samba printer remove command to -/usr/local/lprm, and provide it the print job number using the -%j variable.

    -The default values for each of these options are dependent on the value of the -printing option. -Table 7.4 shows the default commands for each of the printing options. The most popular printing system is BSD.


    - - - - - - - - - -
    - -Table 7.4: Default Commands for Various Printing Commands
    -

    -Option

    		 -

    -BSD, AIX, PLP, LPRNG

    		 -

    -SYSV, HPUX

    		 -

    -QNX

    		 -

    -SOFTQ

    -

    - -print command

    		 - -lpr -r -P%p %s -lp -c -d%p %s; rm %s - -lp -r -P%p %s - -lp -d%p -s %s; rm %s
    -

    - -lpq command

    		 - -lpq -P%p - -lpstat -o%p - -lpq -P%p - -lpstat -o%p
    - -lprm command - -lprm -P%p %j - -cancel %p-%j - -cancel %p-%j - -cancel %p-%j
    - -lppause command - -lp -i %p-%j -H hold (SYSV only) -None -None -None
    - -lpresume command - -lp -i %p-%j -H resume(SYSV only) -None -None - -qstat -s -j%j -r -

    -It is typically not necessary to reset these options in Samba, with the possible exception of -print -command. This option may need to be explicitly set if your printing system doesn't have a --r (remove after printing) option on the printing command. For example: 

    -/usr/local/lpr -P%p %s; /bin/rm %s

    -With a bit of judicious programming, these -smb.conf options can also used for debugging:

    -print command = cat %s >>/tmp/printlog; lpr -r -P%p %s

    -For example, this configuration can verify that files are actually being delivered to the Samba server. If they are, their contents will show up in the -/tmp/printlog file.

    -After BSD, the next most popular kind of printing system is SYSV (or System V) printing, plus some SYSV variants for IBM's AIX and Hewlett-Packard's HP-UX. These system do not have an -/etc/printcap file. Instead, the -printcap -file option can be set to an appropriate -lpstat command for the system. This tells Samba to get a list of printers from the -lpstat command. Alternatively, you can set the global configuration option -printcap -name to the name of a dummy -printcap file you provide. In the latter case, the file must contain a series of lines such as:

    -lp|print1|My Printer 1
-print2|My Printer 2
-print3|My Printer 3

    -Each line names a printer, and provides aliases for it. In this example, the first printer is called -lp, -print1, or -My -Printer -1, whichever the user prefers to use. The first name will be used in place of -%p in any command Samba executes for that printer.

    -Two additional printer types are also supported by Samba: LPRNG (LPR New Generation) and PLP (Public Line Printer). These are public domain and Open Source printing systems, and are used by many sites to overcome problems with vendor-supplied software. In addition, the SOFTQ and QNX realtime operating systems are supported by Samba.

    -

    - -7.2.3.10 load printers

    The -load -printers option tells Samba to create shares for all known printer names and load those shares into the browse list. Samba will create and list a printer share for each printer name in -/etc/printcap (or system equivalent). For example, if your -printcap file looks like this:[2]

    -
    -

    -[2] We have placed annotated comments off to the side in case you've never dealt with this file before.

    -lp:\
-  :sd=/var/spool/lpd/lp:\            
-
-# spool directory
-  :mx#0:\                            
-
-# maximum file size (none)
-  :sh:\                              
-
-# surpress burst header (no)
-  :lp=/dev/lp1:\                     
-
-# device name for output
-  :if=/var/spool/lpd/lp/filter:      
-
-# text filter
-
-laser:\
-  :sd=/var/spool/lpd/laser:\         
-
-# spool directory
-  :mx#0:\                            
-
-# maximum file size (none)
-  :sh:\                              
-
-# surpress burst header (no)
-  :lp=/dev/laser:\                   
-
-# device name for output
-  :if=/var/spool/lpd/lp/filter:      
-
-# text filter

    -and you specify:

    -load printers = yes

    -the shares -[lp] and -[laser] will automatically be created as valid print shares when Samba is started. Both shares will borrow the configuration options specified in the -[printers] section to configure themselves, and will be available in the browse list for the Samba server.

    -

    - -7.2.3.11 printcap name

    -If the -printcap -name option (also called -printcap) appears in a printing share, Samba will use the file specified as the system printer capabilities file. This is normally -/etc/printcap. However, you can reset it to a file consisting of only the printers you want to share over the network. The value must be a fully-qualified filename of a printer capabilities file on the server:

    -[deskjet]
-	printcap name = /usr/local/printcap
    -

    - -7.2.3.12 min print space

    -The -min -print -space option sets the amount of spool space that must be available on the disk before printing is allowed. Setting it to zero (the default) turns the check off; setting it to any other number sets the amount of free space in kilobytes required. This option helps avoid having print jobs fill up the remaining disk space on the server, which may cause other processes to fail:

    -[deskjet]
-	min print space = 4000
    -

    - -7.2.3.13 queuepause command

    -This configuration option specifies a command that tells Samba how to pause a print queue entirely, as opposed to a single job on the queue. The default value depends on the printing type chosen. You should not need to alter this option.

    -

    - -7.2.3.14 queueresume command

    -This configuration option specifies a command that tells Samba how to resume a paused print queue, as opposed to resuming a single job on the print queue. The default value depends on the printing type chosen. You should not need to alter this option.

    -
    -
    -
    - - -
    - -Previous: 7.1 Sending Print Jobs to Samba - - - -Next: 7.3 Name Resolution with Samba
    -7.1 Sending Print Jobs to Samba - -Book Index -7.3 Name Resolution with Samba
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch07_03.html b/docs/htmldocs/using_samba/ch07_03.html deleted file mode 100644 index 56a531681c..0000000000 --- a/docs/htmldocs/using_samba/ch07_03.html +++ /dev/null @@ -1,404 +0,0 @@ - - - -[Chapter 7] 7.3 Name Resolution with Samba - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 7.2 Printing to Windows Client Printers - - - -Chapter 7
    -Printing and Name Resolution    		 - -Next: 8. Additional Samba Information
     
    - -
    -
    -

    - -7.3 Name Resolution with Samba

    Before NetBIOS Name Servers (NBNS) came about, name resolution worked entirely by broadcast. If you needed a machine's address, you simply broadcast its name across the network and, in theory, the machine itself would reply. This approach is still possible: anyone looking for a machine named -fred can still broadcast a query and find out if it exists and what its IP address is. (We use this capability to troubleshoot Samba name services with the -nmblookup command in Chapter 9, Troubleshooting Samba.)

    -As you saw in the first chapter, however, broadcasting - whether it be browsing or name registration and resolution - does not pass easily across multiple subnets. In addition, many broadcasts tend to bog down networks. To solve this problem, Microsoft now provides the Windows Internet Naming Service (WINS), a cross-subnet NBNS, which Samba supports. With it, an administrator can designate a single machine to act as a WINS server, and can then provide each client that requires name resolution the address of the WINS server. Consequently, name registration and resolution requests can be directed to a single machine from any point on the network, instead of broadcast.

    -WINS and broadcasting are not the only means of name resolution, however. There are actually four mechanisms that can be used with Samba:

      -
    • -

      - -WINS

    • -

      - -Broadcasting

    • -

      - -Unix -/etc/hosts or NIS/NIS+ matches

    • -

      - - -LMHOSTS file

    -Samba can use any or all of these name resolution methods in the order that you specify in the Samba configuration file using the -name -resolve -order parameter. However, before delving into configuration options, let's discuss the one that you've probably not encountered before: the -LMHOSTS file.

    -

    - -7.3.1 The LMHOSTS File

    - -LMHOSTS is the standard LAN Manager -hosts file used to resolve names into IP addresses on the system. It is the NBT equivalent of the -/etc/hosts file that is standard on all Unix systems. By default, the file is usually stored as -/usr/local/samba/lib/LMHOSTS and shares a format similar to -/etc/hosts. For example:

    -192.168.220.100    hydra
-192.168.220.101    phoenix

    -The only difference is that the names on the right side of the entries are NetBIOS names instead of DNS names. Because they are NetBIOS names, you can assign resource types to them as well:

    -192.168.220.100    hydra#20
-192.168.220.100    simple#1b
-192.168.220.101    phoenix#20

    -Here, we've assigned the -hydra machine to be the primary domain controller of the -SIMPLE domain, as indicated by the resource type <1B> assigned to the name after -hydra's IP address in the second line. The other two are standard workstations.

    -If you wish to place an -LMHOSTS file somewhere other than the default location, you will need to notify the -nmbd process upon start up, as follows:

    -nmbd -H /etc/samba/lmhosts -D
    -

    - -7.3.2 Setting Up Samba to Use Another WINS Server

    You can set up Samba to use a WINS server somewhere else on the network by simply pointing it to the IP address of the WINS server. This is done with the global -wins -server configuration option, as shown here:

    -[global]
-	wins server = 192.168.200.122

    -With this option enabled, Samba will direct all WINS requests to the server at 192.168.200.122. Note that because the request is directed at a single machine, we don't have to worry about any of the problems inherent to broadcasting. However, though you have specified an IP address for a WINS server in the configuration file, Samba will not necessarily use the WINS server before other forms of name resolution. The order in which Samba attempts various name-resolution techniques is given with the -name -resolve -order configuration option, which we will discuss shortly.

    -If you have a Samba server on a subnet that still uses broadcasting and the Samba server knows the correct location of a WINS server on another subnet, you can configure the Samba server to forward any name resolution requests with the -wins -proxy option:

    -[global]
-	wins server = 192.168.200.12
-	wins proxy = yes

    -Use this only in situations where the WINS server resides on another subnet. Otherwise, the broadcast will reach the WINS server regardless of any proxying.

    -

    - -7.3.3 Setting Up Samba as a WINS Server

    You can set up Samba as a WINS server by setting two global options in the configuration file, as shown below:

    -[global]
-	wins support = yes
-	name resolve order = wins lmhosts hosts bcast

    -The -wins -support option turns Samba into a WINS server. Believe it or not, that's all you need to do! Samba handles the rest of the details behind the scenes, leaving you a relaxed administrator. The -wins -support=yes and the -wins -server option are mutually exclusive; you cannot simultaneously offer Samba as the WINS server and point to another system as the server.

    -If Samba is acting as a WINS server, you should probably get familiar with the -name -resolve -order option mentioned earlier. This option tells Samba the order of methods in which it tries to resolve a NetBIOS name. It can take up to four values:

    -
    -lmhosts
    -

    -Uses a LAN Manager -LMHOSTS file

    -hosts
    -

    -Uses the standard name resolution methods of the Unix system, -/etc/hosts, DNS, NIS, or a combination (as configured for the system)

    -wins
    -

    -Uses the WINS server

    -bcast
    -

    -Uses a broadcast method

    -The order in which you specify them in the value is the order in which Samba will attempt name resolution when acting as a WINS server. For example, let's look at the value specified previously:

    -name resolve order = wins lmhosts hosts bcast

    -This means that Samba will attempt to use its WINS entries first for name resolution, followed by the LAN Manager -LMHOSTS file on its system. Next, the hosts value causes it to use Unix name resolution methods. The word -hosts may be misleading; it covers not only the -/etc/hosts file, but also the use of DNS or NIS (as configured on the Unix host). Finally, if those three do not work, it will use a broadcast to try to locate the correct machine.

    -Finally, you can instruct a Samba server that is acting as a WINS server to check with the system's DNS server if a requested host cannot be found in its WINS database. With a typical Linux system, for example, you can find the IP address of the DNS server by searching the -/etc/resolv.conf file. In it, you might see an entry such as the following:

    -nameserver 127.0.0.1
-nameserver 192.168.200.192

    -This tells us that a DNS server is located at 192.168.220.192. (The 127.0.0.1 is the localhost address and is never a valid DNS server address.)

    -Use the global -dns -proxy option to alert Samba to use the configured DNS server:

    -[global]
-	wins support = yes
-	name resolve order = wins lmhosts hosts bcast
-	dns proxy = yes
    -

    - -7.3.4 Name Resolution Configuration Options

    Samba's WINS options are shown in -Table 7.5.


    - - - - - - - - - - - - -
    - -Table 7.5: WINS Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -wins support

    		 -

    -boolean

    		 -

    -If set to -yes, Samba will act as a WINS server.

    		 -

    - -no

    		 -

    -Global

    -

    - -wins server

    		 -

    -string (IP address or DNS name)

    		 -

    -Identifies a WINS server for Samba to use for name registration and resolution.

    		 -

    -None

    		 -

    -Global

    -

    - -wins proxy

    		 -

    -boolean

    		 -

    -Allows Samba to act as a proxy to a WINS server on another subnet.

    		 -

    - -no

    		 -

    -Global

    -

    - -dns proxy

    		 -

    -boolean

    		 -

    -If set to -yes, a Samba WINS server will search DNS if it cannot find a name in WINS.

    		 -

    - -no

    		 -

    -Global

    -

    - -name resolve order

    		 -

    - -lmhosts, -hosts, -wins, or -bcast

    		 -

    -Specifies an order of the methods used to resolve NetBIOS names.

    		 -

    - -lmhosts hosts wins bcast

    		 -

    -Global

    -

    - -max ttl

    		 -

    -numerical

    		 -

    -Specifies the maximum time-to-live in seconds for a requested NetBIOS names.

    		 -

    - -259200 (3 days)

    		 -

    -Global

    -

    - -max wins ttl

    		 -

    -numerical

    		 -

    -Specifies the maximum time-to-live in seconds for NetBIOS names given out by Samba as a WINS server.

    		 -

    - -518400 (6 days)

    		 -

    -Global

    -

    - -min wins ttl

    		 -

    -numerical

    		 -

    -Specifies the minimum time-to-live in seconds for NetBIOS names given out by Samba as a WINS server.

    		 -

    - -21600 (6 hours)

    		 -

    -Global

    -

    - -7.3.4.1 wins support

    -Samba will provide WINS name service to all machines in the network if you set the following in the -[global] section of the -smb.conf file:

    -[global]
-    wins support = yes

    -The default value is -no, which is typically used to allow another Windows NT server to become a WINS server. If you do enable this option, remember that a Samba WINS server currently cannot exchange data with any backup WINS servers. If activated, this option is mutually exclusive with the -wins -server parameter; you cannot set both to -yes at the same time or Samba will flag an error.

    -

    - -7.3.4.2 wins server

    -Samba will use an existing WINS server on the network if you specify the -wins -server global option in your configuration file. The value of this option is either the IP address or DNS name (not NetBIOS name) of the WINS server. For example:

    -[global]
-    wins server = 192.168.220.110

    -or:

    -[global]
-    wins server = wins.example.com

    -In order for this option to work, the -wins -support option must be set to -no (the default). Otherwise, Samba will report an error. You can specify only one WINS server using this option.

    -

    - -7.3.4.3 wins proxy

    -This option allows Samba to act as a proxy to another WINS server, and thus relay name registration and resolution requests from itself to the real WINS server, often outside the current subnet. The WINS server can be indicated through the -wins -server option. The proxy will then return the WINS response back to the client. You can enable this option by specifying the following in the -[global] section:

    -[global]
-    wins proxy = yes
    -

    - -7.3.4.4 dns proxy

    -If you want the domain name service (DNS) to be used if a name isn't found in WINS, you can set the following option:

    -[global]
-    dns proxy = yes

    -This will cause -nmbd to query for machine names using the server's standard domain name service. You may wish to deactivate this option if you do not have a permanent connection to your DNS server. Despite this option, we recommend using a WINS server. If you don't already have any WINS servers on your network, make one Samba machine a WINS server. Do not, however, make two Samba machines WINS servers (one primary and one backup) as they currently cannot exchange WINS databases.

    -

    - -7.3.4.5 name resolve order

    -The global -name -resolve -order option specifies the order of services that Samba will use in attempting name resolution. The default order is to use the -LMHOSTS file, followed by standard Unix name resolution methods (some combination of -/etc/hosts, DNS, and NIS), then query a WINS server, and finally use broadcasting to determine the address of a NetBIOS name. You can override this option by specifying something like the following:

    -[global]
-    name resolve order = lmhosts wins hosts bcast

    -This causes resolution to use the -LMHOSTS file first, followed by a query to a WINS server, the system password file, and finally broadcasting. You need not use all four options if you don't want to. This option is covered in more detail in the section -Section 7.3.3, Setting Up Samba as a WINS Server, earlier in this chapter.

    -

    - -7.3.4.6 max ttl

    -This option gives the maximum time to live (TTL) during which a NetBIOS name registered with the Samba server will remain active. You should never need to alter this value.

    -

    - -7.3.4.7 max wins ttl

    -This option give the maximum time to live (TTL) during which a NetBIOS name resolved from a WINS server will remain active. You should never need to change this value from its default.

    -

    - -7.3.4.8 min wins ttl

    -This option give the minimum time to live (TTL) during which a NetBIOS name resolved from a WINS server will remain active. You should never need to alter this value from its default.

    -
    -
    -
    - - -
    - -Previous: 7.2 Printing to Windows Client Printers - - - -Next: 8. Additional Samba Information
    -7.2 Printing to Windows Client Printers - -Book Index -8. Additional Samba Information
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch08_01.html b/docs/htmldocs/using_samba/ch08_01.html deleted file mode 100644 index a6767271b6..0000000000 --- a/docs/htmldocs/using_samba/ch08_01.html +++ /dev/null @@ -1,267 +0,0 @@ - - - -[Chapter 8] Additional Samba Information - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 7.3 Name Resolution with Samba - - -Chapter 8 - -Next: 8.2 Magic Scripts
     
    - -
    -
    -

    - -8. Additional Samba Information

    -

    - -Contents:
    - -Supporting Programmers
    - -Magic Scripts
    - -Internationalization
    - -WinPopup Messages
    - -Recently Added Options
    - -Miscellaneous Options
    - -Backups with smbtar

    -

    -This chapter wraps up our coverage of the -smb.conf configuration file with some miscellaneous options that can perform a variety of tasks. We will talk briefly about options for supporting programmers, internationalization, messages, and common Windows bugs. For the most part, you will use these options only in isolated circumstances. We also cover performing automated backups with the -smbtar command at the end of this chapter. So without further ado, let's jump into our first subject: options to help programmers.

    -

    - - -8.1 Supporting Programmers

    If you have programmers accessing your Samba server, you'll want to be aware of the special options listed in -Table 8.1.


    - - - - - - - - - -
    - -Table 8.1: Programming Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -time server

    		 -

    -boolean

    		 -

    -If -yes, -nmbd announces itself as a SMB time service to Windows clients.

    		 -

    - -no

    		 -

    -Global

    -

    - -time offset

    		 -

    -numerical (number of minutes)

    		 -

    -Adds a specified number of minutes to the reported time.

    		 -

    - -0

    		 -

    -Global

    -

    - -dos filetimes

    		 -

    -boolean

    		 -

    -Allows non-owners of a file to change its time if they can write to it.

    		 -

    - -no

    		 -

    -Share

    -

    - -dos filetime

    - -resolution

    		 -

    -boolean

    		 -

    -Causes file times to be rounded to the next even second.

    		 -

    - -no

    		 -

    -Share

    -

    - -fake directory create times

    		 -

    -boolean

    		 -

    -Sets directory times to avoid a MS -nmake bug.

    		 -

    - -no

    		 -

    -Share

    -

    - -8.1.1 Time Synchronization

    Time synchronization can be very important to programmers. Consider the following options:

    -time service = yes
-dos filetimes = yes
-fake directory create times = yes
-dos filetime resolution = yes
-delete readonly = yes

    -If you set these options, Samba shares will provide the kind of compatible file times that Visual C++, -nmake, and other Microsoft programming tools require. Otherwise, PC -make programs will tend to think that all the files in a directory need to be recompiled every time. Obviously, this is not the behavior you want.

    -

    - -8.1.1.1 time server

    -If your Samba server has an accurate clock, or if it's a client of one of the Unix network time servers, you can instruct it to advertise itself as an SMB time server by setting the -time -server option as follows:

    -[global]
-	time service = yes

    -The client will still have to request the correct time with the following DOS command, substituting the Samba server name in at the appropriate point:

    -C:\NET TIME \\server /YES /SET

    -This command can be placed in a Windows logon script (see Chapter 6, Users, Security, and Domains ).

    -By default, the -time -server option is normally set to -no. If you turn this service on, you can use the command above to keep the client clocks from drifting. Time synchronization is important to clients using programs such as -make, which compile based on the last time the file was changed. Incorrectly synchronized times can cause such programs to either remake all files in a directory, which wastes time, or not recompile a source file that was just modified because of a slight clock drift.

    -

    - -8.1.1.2 time offset

    -To deal with clients that don't process daylight savings time properly, Samba provides the -time -offset option. If set, it adds the specified number of minutes to the current time. This is handy if you're in Newfoundland and Windows doesn't know about the 30-minute time difference there:

    -[global]
-	time offset = 30
    -

    - -8.1.1.3 dos filetimes

    -Traditionally, only the root user and the owner of a file can change its last-modified date on a Unix system. The share-level -dos -filetimes option allows the Samba server to mimic the characteristics of a DOS/Windows machine: any user can change the last modified date on a file in that share if he or she has write permission to it. In order to do this, Samba uses its root privileges to modify the timestamp on the file.

    -By default, this option is disabled. Setting this option to -yes is often necessary to allow PC -make programs to work properly. Without it, they cannot change the last-modified date themselves. This often results in the program thinking -all files need recompiling when they really don't.

    -

    - -8.1.1.4 dos filetime resolution

    - -dos -filetime -resolution is share-level option. If set to -yes, Samba will arrange to have the file times rounded to the closest two-second boundary. This option exists primarily to satisfy a quirk in Windows that prevents Visual C++ from correctly recognizing that a file has not changed. You can enable it as follows:

    -[data]
-	dos filetime resolution = yes

    -We recommend using this option only if you are using Microsoft Visual C++ on a Samba share that supports opportunistic locking.

    -

    - -8.1.1.5 fake directory create times

    -The -fake -directory -create -times option exists to keep PC -make programs sane. VFAT and NTFS filesystems record the creation date of a specific directory while Unix does not. Without this option, Samba takes the earliest recorded date it has for the directory (often the last-modified date of a file) and returns it to the client. If this is not sufficient, set the following option under a share definition:

    -[data]
-	fake directory create times = yes

    -If set, Samba will adjust the directory create time it reports to the hardcoded value January 1st, 1980. This is primarily used to convince the Visual C++ -nmake program that any object files in its build directories are indeed younger than the creation date of the directory itself and need to be recompiled.

    -
    -
    -
    - - -
    - -Previous: 7.3 Name Resolution with Samba - - - -Next: 8.2 Magic Scripts
    7.3 Name Resolution with Samba - -Book Index -8.2 Magic Scripts
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch08_02.html b/docs/htmldocs/using_samba/ch08_02.html deleted file mode 100644 index 54b2480071..0000000000 --- a/docs/htmldocs/using_samba/ch08_02.html +++ /dev/null @@ -1,156 +0,0 @@ - - - -[Chapter 8] 8.2 Magic Scripts - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 8.1 Supporting Programmers - - - -Chapter 8
    -Additional Samba Information     		- -Next: 8.3 Internationalization
     
    - -
    -
    -

    - -8.2 Magic Scripts

    The following options deal with -magic scripts on the Samba server. Magic scripts are a method of running programs on Unix and redirecting the output back to the SMB client. These are essentially an experimental hack. However, some users and their programs still rely on these two options for their programs to function correctly. Magic scripts are not widely trusted and their use is highly discouraged by the Samba team. See -Table 8.2 for more information.


    - - - - - - -
    - -Table 8.2: Networking Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -magic script

    		 -

    string (fully-qualified filename)

    		 -

    -Sets the name of a file to be executed by Samba, as the logged-on user, when closed.

    		 -

    -None

    		 -

    -Share

    -

    - -magic output

    		 -

    -string (fully-qualified filename)

    		 -

    -Sets a file to log output from the magic file.

    		 -

    - -scriptname.out

    		 -

    -Share

    -

    - -8.2.1 magic script

    -If the -magic -script option is set to a filename and the client creates a file by that name in that share, Samba will run the file as soon as the user has opened and closed it. For example, let's assume that the following option was created in the share -[accounting]:

    -[accounting]
-	magic script = tally.sh

    -Samba continually monitors the files in that share. If one by the name of -tally.sh is closed (after being opened) by a user, Samba will execute the contents of that file locally. The file will be passed to the shell to execute; it must therefore be a legal Unix shell script. This means that it must have newline characters as line endings instead of Windows CR/LFs. In addition, it helps if you use the -#! directive at the beginning of the file to indicate under which shell the script should run.

    -

    - -8.2.2 magic output

    -This option specifies an output file that the script specified by the -magic -script option will send output to. You must specify a filename in a writable directory:

    -[accounting]
-	magic script = tally.sh
-	magic output = /var/log/magicoutput

    -If this option is omitted, the default output file is the name of the script (as stated in the -magic -script option) with the extension -.out appended onto it.

    -
    -
    -
    - - -
    - -Previous: 8.1 Supporting Programmers - - - -Next: 8.3 Internationalization
    -8.1 Supporting Programmers - -Book Index -8.3 Internationalization
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch08_03.html b/docs/htmldocs/using_samba/ch08_03.html deleted file mode 100644 index 9e2f60c432..0000000000 --- a/docs/htmldocs/using_samba/ch08_03.html +++ /dev/null @@ -1,472 +0,0 @@ - - - -[Chapter 8] 8.3 Internationalization - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 8.2 Magic Scripts - - - -Chapter 8
    -Additional Samba Information     		- -Next: 8.4 WinPopup Messages
     
    - -
    -
    -

    - -8.3 Internationalization

    Samba has a limited ability to speak foreign tongues: if you need to deal with characters that aren't in standard ASCII, some options that can help you are shown in -Table 8.3. Otherwise, you can skip over this section.


    - - - - - - - - -
    - -Table 8.3: Networking Configuration Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -client code page

    		 -

    -Described in this section

    		 -

    -Sets a code page to expect from clients

    		 -

    -850

    		 -

    -Global

    -

    - -character set

    		 -

    -Described in this section

    		 -

    -Translates code pages into alternate UNIX character sets

    		 -

    -None

    		 -

    -Global

    -

    - -coding system

    		 -

    -Described in this section

    		 -

    -Translates code page 932 into an Asian character set

    		 -

    -None

    		 -

    -Global

    -

    - -valid chars

    		 -

    -string (set of characters)

    		 -

    -Obsolete: formerly added individual characters to a code page, and had to be used after setting client code page

    		 -

    -None

    		 -

    -Global

    -

    - -8.3.1 client code page

    -The character sets on Windows platforms hark back to the original concept of a -code page. These code pages are used by DOS and Windows clients to determine rules for mapping lowercase letters to uppercase letters. Samba can be instructed to use a variety of code pages through the use of the global -client -code -page option in order to match the corresponding code page in use on the client. This option loads a code-page definition file, and can take the values specified in -Table 8.4.


    - - - - - - - - - - - - - - -
    - -Table 8.4: Valid Code Pages with Samba 2.0
    -

    -Code Page

    		 -

    -Definition

    -

    - -437

    		 -

    MS-DOS Latin (United States)

    -

    - -737

    		 -

    -Windows 95 Greek

    -

    - -850

    		 -

    -MS-DOS Latin 1 (Western European)

    -

    - -852

    		 -

    -MS-DOS Latin 2 (Eastern European)

    -

    - -861

    		 -

    -MS-DOS Icelandic

    -

    - -866

    		 -

    -MS-DOS Cyrillic (Russian)

    -

    - -932

    		 -

    -MS-DOS Japanese Shift-JIS

    -

    - -936

    		 -

    -MS-DOS Simplified Chinese

    -

    - -949

    		 -

    -MS-DOS Korean Hangul

    -

    - -950

    		 -

    -MS-DOS Traditional Chinese

    -You can set the client code page as follows:

    -[global]
-	client code page = 852

    -The default value of this option is 850. You can use the -make_smbcodepage tool that comes with Samba (by default in -/usr/local/samba/bin) to create your own SMB code pages, in the event that those listed earlier are not sufficient.

    -

    - -8.3.2 character set

    -The global -character -set option can be used to convert filenames offered through a DOS code page (see the previous section, -Section 8.3.1, client code page) to equivalents that can be represented by Unix character sets other than those in the United States. For example, if you want to convert the Western European MS-DOS character set on the client to a Western European Unix character set on the server, you can use the following in your configuration file:

    -[global]
-	client code page = 850
-	character set = ISO8859-1

    -Note that you must include a -client -code -page option to specify the character set from which you are converting. The valid character sets (and their matching code pages) that Samba 2.0 accepts are listed in -Table 8.5:


    - - - - - - - - -
    - -Table 8.5: Valid Character Sets with Samba 2.0
    -

    -Character Set

    		 -

    -Matching Code Page

    		 -

    -Definition

    -

    - -ISO8859-1

    		 -

    - -850

    		 -

    Western European Unix

    -

    - -ISO8859-2

    		 -

    - -852

    		 -

    -Eastern European Unix

    -

    - -ISO8859-5

    		 -

    - -866

    		 -

    -Russian Cyrillic Unix

    -

    - -KOI8-R

    		 -

    - -866

    		 -

    -Alternate Russian Cyrillic Unix

    -Normally, the -character -set option is disabled completely.

    -

    - -8.3.3 coding system

    -The -coding -system option is similar to the -character -set option. However, its purpose is to determine how to convert a Japanese Shift JIS code page into an appropriate Unix character set. In order to use this option, the -client -code -page option described previously must be set to page 932. The valid coding systems that Samba 2.0 accepts are listed in -Table 8.6.


    - - - - - - - - - - - - - - - - - - - - - - - - - - -
    - -Table 8.6: Valid Coding System Parameters with Samba 2.0
    -

    -Character Set

    		 -

    -Definition

    -

    - -SJIS

    		 -

    Standard Shift JIS

    -

    - -JIS8

    		 -

    -Eight-bit JIS codes

    -

    - -J8BB

    		 -

    -Eight-bit JIS codes

    -

    - -J8BH

    		 -

    -Eight-bit JIS codes

    -

    - -J8@B

    		 -

    -Eight-bit JIS codes

    -

    - -J8@J

    		 -

    -Eight-bit JIS codes

    -

    - -J8@H

    		 -

    -Eight-bit JIS codes

    -

    - -JIS7

    		 -

    -Seven-bit JIS codes

    -

    - -J7BB

    		 -

    -Seven-bit JIS codes

    -

    - -J7BH

    		 -

    -Seven-bit JIS codes

    -

    - -J7@B

    		 -

    -Seven-bit JIS codes

    -

    - -J7@J

    		 -

    -Seven-bit JIS codes

    -

    - -J7@H

    		 -

    -Seven-bit JIS codes

    -

    - -JUNET

    		 -

    -JUNET codes

    -

    - -JUBB

    		 -

    -JUNET codes

    -

    - -JUBH

    		 -

    -JUNET codes

    -

    - -JU@B

    		 -

    -JUNET codes

    -

    - -JU@J

    		 -

    -JUNET codes

    -

    - -JU@H

    		 -

    -JUNET codes

    -

    - -EUC

    		 -

    -EUC codes

    -

    - -HEX

    		 -

    -Three-byte hexidecimal code

    -

    - -CAP

    		 -

    -Three-byte hexidecimal code (Columbia Appletalk Program)

    -

    - -8.3.4 valid chars

    -The -valid -chars option is an older Samba feature that will add individual characters to a code page. However, this option is being phased out in favor of more modern coding systems. You can use this option as follows:

    -valid chars = Î
-valid chars = 0450:0420 0x0A20:0x0A00
-valid chars = A:a

    -Each of the characters in the list specified should be separated by spaces. If there is a colon between two characters or their numerical equivalents, the data to the left of the colon is considered an uppercase character, while the data to the right is considered the lowercase character. You can represent characters both by literals (if you can type them) and by octal, hexidecimal, or decimal Unicode equivalents.

    -We recommend against using this option. Instead, go with one of the standard code pages listed earlier in this section. If you do use this option, however, it must be listed after the -client -code -page to which you wish to add the character. Otherwise, the characters will not be added.

    -
    -
    -
    - - -
    - -Previous: 8.2 Magic Scripts - - - -Next: 8.4 WinPopup Messages
    8.2 Magic Scripts - -Book Index -8.4 WinPopup Messages
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch08_04.html b/docs/htmldocs/using_samba/ch08_04.html deleted file mode 100644 index d45ce31474..0000000000 --- a/docs/htmldocs/using_samba/ch08_04.html +++ /dev/null @@ -1,168 +0,0 @@ - - - -[Chapter 8] 8.4 WinPopup Messages - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 8.3 Internationalization - - - -Chapter 8
    -Additional Samba Information     		- -Next: 8.5 Recently Added Options
     
    - -
    -
    -

    - -8.4 WinPopup Messages

    You can use the WinPopup tool (WINPOPUP.EXE) in Windows to send messages to users, machines, or entire workgroups on the network. This tool is provided with Windows 95 OSR2 and comes standard with Windows 98. With either Windows 95 or 98, however, you need to be running WinPopup to receive and send WinPopup messages. With Windows NT, you can still receive messages without starting such a tool; they will automatically appear in a small dialog box on the screen when received. The WinPopup application is shown in -Figure 8.1.

    - -Figure 8.1: The WinPopup application

    Figure 8.1

    -Samba has a single WinPopup messaging option, -message -command, as shown in -Table 8.7.


    - - - - - -
    - -Table 8.7: WinPopup Configuration Option
    -

    -Option

    		 -

    -Parameter

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -message command

    		 -

    string (fully-qualified pathname)

    		 -

    -Sets a command to run on Unix when a WinPopup message is received.

    		 -

    -None

    		 -

    -Global

    -

    - -8.4.1 message command

    -Samba's -message -command option sets the path to a program that will run on the server when a Windows popup message arrives at the server. The command will be executed using the -guest -account user. What to do with one of these is questionable since it's probably for the Samba administrator, and Samba doesn't know his or her name. If you know there's a human using the console, the Samba team once suggested the following:

    -[global]
-	message command = /bin/csh -c 'xedit %s; rm %s' &

    -Note the use of variables here. The -%s variable will become the file that the message is in. This file should be deleted when the command is finished with it; otherwise, there will be a buildup of pop-up files collecting on the Samba server. In addition, the command must fork its own process (note the & after the command); otherwise the client may suspend and wait for notification that the command was sent successfully before continuing.

    -In addition to the standard variables, -Table 8.8 shows the three unique variables that you can use in a -message -command.


    - - - - - - - -
    - -Table 8.8: Message Command Variables
    -

    -Variable

    		 -

    -Definition

    -

    - -%s

    		 -

    -The name of the file in which the message resides

    -

    - -%f

    		 -

    -The name of the client that sent the message

    -

    - -%t

    		 -

    -The name of the machine that is the destination of the message

    -
    -
    -
    - - -
    - -Previous: 8.3 Internationalization - - - -Next: 8.5 Recently Added Options
    -8.3 Internationalization - -Book Index -8.5 Recently Added Options
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch08_05.html b/docs/htmldocs/using_samba/ch08_05.html deleted file mode 100644 index 90fa20a8cd..0000000000 --- a/docs/htmldocs/using_samba/ch08_05.html +++ /dev/null @@ -1,396 +0,0 @@ - - - -[Chapter 8] 8.5 Recently Added Options - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 8.4 WinPopup Messages - - - -Chapter 8
    -Additional Samba Information     		- -Next: 8.6 Miscellaneous Options
     
    - -
    -
    -

    - - - 8.5 Recently Added -Options

    Samba has several options that appeared -around the time of Samba 2.0, but either were not entirely supported or were -in the process of being developed. With Samba 2.0.7, several more were -introduced. We will give you a brief overview of their workings in this -section. These options are shown in - - -Table 8.9.


    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    - -Table 8.9: Recently Added Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -change notify timeout

    		 -

    -numerical (number of seconds)

    		 -

    -Sets the interval between checks when a client asks to wait for a change in a specified directory.

    		 -

    - -60

    		 -

    -Global

    -

    - -machine password timeout

    		 -

    -numerical (number of seconds)

    		 -

    -Sets the renewal interval for NT domain machine passwords.

    		 -

    - -604,800 (1 week)

    		 -

    -Global

    -

    - -stat cache

    		 -

    -boolean

    		 -

    -If -yes, Samba will cache recent name mappings.

    		 -

    - -yes

    		 -

    -Global

    -

    - -stat cache size

    		 -

    -numerical

    		 -

    -Sets the size of the stat cache.

    		 -

    - -50

    		 -

    -Global

    -

    - -utmp

    		 -

    -boolean

    		 -

    -Turns on logging of Samba users in the utmp file. Requires --with-utmp.

    		-

    - -no

    		 -

    -Share

    -

    - -utmp dir

    		 -

    -string (pathname)

    		 -

    -Sets the directory where Samba expects to find the utmp/utmpx file.

    		 -

    - -None

    		 -

    -Share

    -

    - -inherit permissions

    		 -

    -boolean

    		 -

    -Sets the permissions of newly created directories to the same as their parent.

    		 -

    - -no

    		 -

    -Share

    -

    - -write cache size

    		 -

    -numerical (bytes)

    		 -

    -Sets the size of a write cache (buffer) used for oplocked files.

    		 -

    - -0

    		 -

    -Share

    -

    - -source environment

    		 -

    -string (pathname)

    		 -

    -Sets a file to read environment variable from.

    		 -

    - -None

    		 -

    -Global

    -

    - -min password length

    		 -

    -numerical (number of characters)

    		 -

    -Sets the minimum length of a new password which Samba will try to update the password file with .

    		 -

    - -5

    		 -

    -Global

    -

    - -netbios scope

    		 -

    -string

    		 -

    -Sets the NetBIOS scope.

    		 -

    - -None

    		 -

    -Global

    - -
    -

    - -8.5.1 change notify timeout

    -The -change -notify -timeout global option emulates a Windows NT SMB feature called -change notification. This allows a client to request that a Windows NT server periodically monitor a specific directory on a share for any changes. If any changes occur, the server will notify the client.

    -As of version 2.0, Samba will perform this function for its clients. However, performing these checks too often can slow the server down considerably. This option sets the time period that Samba should wait between such checks. The default is one minute (60 seconds); however, you can use this option to specify an alternate time that Samba should wait between performing checks:

    -[global]
-	change notify timeout = 30
    -

    - -8.5.2 machine password timeout

    -The -machine -password -timeout global option sets a retention period for NT domain machine passwords. The default is currently set to the same time period that Windows NT 4.0 uses: 604,800 seconds (one week). Samba will periodically attempt to change the -machine account password, which is a password used specifically by another server to report changes to it. This option specifies the number of seconds that Samba should wait before attempting to change that password. The following example changes it to a single day, by specifying the following:

    -[global]
-	machine password timeout = 86400
    -

    - -8.5.3 stat cache

    -The -stat -cache global option turns on caching of recent case-insensitive name mappings. The default is -yes. The Samba team recommends that you never change this parameter.

    -

    - -8.5.4 stat cache size

    The -stat -cache -size global option sets the size of the cache entries to be used for the -stat -cache option. The default here is 50. Again, the Samba team recommends that you never change this parameter.

    - -=== - -

    -8.5.5 utmp

    -

    If you specified ---with-utmp when configuring, this option will turn on utmp logging -of users: they will appear in the utmp file and you will be able to see if -they are on with last(1). It defaults to no.

    - -

    -8.5.6 utmp dir

    -

    -If utmp is set, the utmp dir option will change the directory Samba -looks in for the utmp files. If it is not set, the default system -location will be used.

    - -

    -8.5.7 inherit permissions

    -

    -This option causes new files and directories to be created with -the same permissions as the directory they're in. For example, -subdirectories will inherit setgid bits from their parents. -This option will override the create -mask, directory mask, force create mode and -force directory mode options, but not the -map archive, map hidden and map system -options. It will never set the setuid bit. -This option defaults to off.

    - -

    -8.5.8 write cache size

    -

    The write cache size -share option sets the size of a cache used by Samba while -writing oplocked files. The files will be written in cachesize -blocks, so you can tune Samba's write size to the optimum size for -your filesystem or RAID disk array.

    - -

    The caching applies to the first 10 files opened with oplocks if set, -and defaults to zero (off) initially.

    - -

    As with all caching schemes, data that hasn't been written -will be lost if the system crashes.

    - -

    -8.5.9 source environment

    -

    -This options specifies a file of environment variables that Samba -will read on startup. The variables set in this -files can then be used in smb.conf files as $%name. For example, -HOME=/home/sofia in the environment file could be used in a smb.conf -file as "path = "$HOME"

    - -

    If the pathname begins with a "|" (pipe) symbol, Samba will attempt -to run it and read its standard output.

    - -

    -8.5.10 min password length

    -

    This option sets the minimum length, in characters, -of a plain text password that Samba will accept when performing UNIX -password changing. This is used to tell Samba about system-defined -minimums, so it can return an appropriate error to the client.

    - - -

    -8.5.11 netbios scope

    -

    -This sets the NetBIOS scope that Samba will operate under: Samba -will not communicate with any machine with a different scope. -This should not be set unless every machine on your LAN also sets -this value. It was a predecessor to workgroups, and the Samba -team recommends against using it.

    - - - -
    - -
    -
    - - -
    - -Previous: 8.4 WinPopup Messages - - - -Next: 8.6 Miscellaneous Options
    -8.4 WinPopup Messages - -Book Index -8.6 Miscellaneous Options
    - - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch08_06.html b/docs/htmldocs/using_samba/ch08_06.html deleted file mode 100644 index 97e4e3c976..0000000000 --- a/docs/htmldocs/using_samba/ch08_06.html +++ /dev/null @@ -1,509 +0,0 @@ - - - -[Chapter 8] 8.6 Miscellaneous Options - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 8.5 Recently Added Options - - - -Chapter 8
    -Additional Samba Information     		- -Next: 8.7 Backups with smbtar
     
    - -
    -
    -

    - -8.6 Miscellaneous Options

    Many Samba options are present to deal with operating system issues on either Unix or Windows. The options shown in -Table 8.10 deal specifically with some of these known problems. We usually don't change these and we recommend the same to you.


    - - - - - - - - - - - - - - - - - - - - - - -
    - -Table 8.10: Miscellaneous Options
    -

    -Option

    		 -

    -Parameters

    		 -

    -Function

    		 -

    -Default

    		 -

    -Scope

    -

    - -deadtime

    		 -

    numerical (number of minutes)

    		 -

    -Specifies the number of minutes of inactivity before a connection should be terminated.

    		 -

    - -0

    		 -

    -Global

    -

    - -dfree command

    		 -

    -string (command)

    		 -

    -Used to provide a command that returns disk free space in a format recognized by Samba.

    		 -

    -None

    		 -

    -Global

    -

    - -fstype

    		 -

    - -NTFS, -FAT, or -Samba

    		 -

    -Sets the filesystem type reported by the server to the client.

    		 -

    - -NTFS

    		 -

    -Global

    -

    - -keep alive

    		 -

    -seconds

    		 -

    -Sets the number of seconds between checks for an inoperative client.

    		 -

    -0 (none)

    		 -

    -Global

    -

    - -max disk size

    		 -

    -numerical (size in MB)

    		 -

    -Sets the largest disk size to return to a client, some of which have limits. Does not affect actual operations on the disk.

    		 -

    -0 (infinity)

    		 -

    -Global

    -

    - -max mux

    		 -

    -numerical

    		 -

    -Sets the maximum number of simultaneous SMB operations that clients may make.

    		 -

    - -50

    		 -

    -Global

    -

    - -max open files

    		 -

    -numerical

    		 -

    -Limits number of open files to be below Unix limits.

    		 -

    - -10,000

    		 -

    -Global

    -

    - -max xmit

    		 -

    -numerical

    		 -

    -Specifies the maximum packet size that Samba will send.

    		 -

    - -65,535

    		 -

    -Global

    -

    - -nt pipe support

    		 -

    -boolean

    		 -

    -Turns off an experimental NT feature, for benchmarking or in case of an error.

    		 -

    - -yes

    		 -

    -Global

    -

    - -nt smb support

    		 -

    -boolean

    		 -

    -Turns off an experimental NT feature, for benchmarking or in case of an error.

    		 -

    - -yes

    		 -

    -Global

    -

    - -ole locking compatib-ility

    		 -

    -boolean

    		 -

    -Remaps out-of-range lock requests used on Windows to fit in allowable range on Unix. Turning it off causes Unix lock errors.

    		 -

    - -yes

    		 -

    -Global

    -

    - -panic action

    		 -

    -command

    		 -

    -Program to run if Samba server fails; for debugging.

    		 -

    -None

    		 -

    -Global

    -

    - -set directory

    		 -

    -boolean

    		 -

    -If -yes, allows VMS clients to issue -set -dir commands.

    		 -

    - -no

    		 -

    -Global

    -

    - -smbrun

    		 -

    -string (fully-qualified command)

    		 -

    -Sets the command Samba uses as a wrapper for shell commands.

    		 -

    -None

    		 -

    -Global

    -

    - -status

    		 -

    -boolean

    		 -

    -If -yes, allows Samba to monitor status for -smbstatus command.

    		 -

    - -yes

    		 -

    -Global

    -

    - -strict sync

    		 -

    -boolean

    		 -

    -If -no, ignores Windows applications requests to perform a sync-to-disk.

    		 -

    - -no

    		 -

    -Global

    -

    - -sync always

    		 -

    -boolean

    		 -

    -If -yes, forces all client writes to be committed to disk before returning from the call.

    		 -

    - -no

    		 -

    -Global

    -

    - -strip dot

    		 -

    -boolean

    		 -

    -If -yes, strips trailing dots from Unix filenames.

    		-

    - -no

    		 -

    -Global

    -

    - -8.6.1 deadtime

    -This global option sets the number of minutes that Samba will wait for an inactive client before closing its session with the Samba server. A client is considered inactive when it has no open files and there is no data being sent from it. The default value for this option is 0, which means that Samba never closes any connections no matter how long they have been inactive. You can override it as follows:

    -[global]
-	deadtime = 10

    -This tells Samba to terminate any inactive client sessions after 10 minutes. For most networks, setting this option as such will work because reconnections from the client are generally performed transparently to the user.

    -

    - -8.6.2 dfree command

    This global option is used on systems that incorrectly determine the free space left on the disk. So far, the only confirmed system that needs this option set is Ultrix. There is no default value for this option, which means that Samba already knows how to compute the free disk space on its own and the results are considered reliable. You can override it as follows:

    -[global]
-	dfree command = /usr/local/bin/dfree

    -This option should point to a script that should return the total disk space in a block, and the number of available blocks. The Samba documentation recommends the following as a usable script:

    -#!/bin/sh
-df $1 | tail -1 | awk '{print $2" "$4}'

    -On System V machines, the following will work:

    -#!/bin/sh
-/usr/bin/df $1 | tail -1 | awk '{print $3" "$5}'
    -

    - -8.6.3 fstype

    -This share-level option sets the type of filesystem that Samba reports when queried by the client. There are three strings that can be used as a value to this configuration option, as listed in -Table 8.11.


    - - - - - - - -
    - -Table 8.11: Filesystem Types
    -

    -Variable

    		 -

    -Definition

    -

    -NTFS

    		 -

    Microsoft Windows NT filesystem

    -

    -FAT

    		 -

    -DOS FAT filesystem

    -

    -Samba

    		 -

    -Samba filesystem

    -The default value for this option is -NTFS, which represents a Windows NT filesystem. There probably isn't a need to specify any other type of filesystem. However, if you need to, you can override it per share as follows:

    -[data]
-	fstype = FAT
    -

    - -8.6.4 keep alive

    This global option specifies the number of seconds that Samba waits between sending NetBIOS -keep-alive packets. These packets are used to ping a client to detect whether it is still alive and on the network. The default value for this option is -0, which means that Samba will not send any such packets at all. You can override it as follows:

    -[global]
-	keep alive = 10
    -

    - -8.6.5 max disk size

    This global option specifies an illusory limit, in megabytes, for each of the shares that Samba is using. You would typically set this option to prevent clients with older operating systems from incorrectly processing large disk spaces, such as those over one gigabyte.

    -The default value for this option is -0, which means there is no upper limit at all. You can override it as follows:

    -[global]
-	max disk size = 1000
    -

    - -8.6.6 max mux

    This global option specifies the maximum number of concurrent SMB operations that Samba allows. The default value for this option is -50. You can override it as follows:

    -[global]
-	max mux = 100
    -

    - -8.6.7 max open files

    This global option specifies the maximum number of open files that Samba should allow at any given time for all processes. This value must be equal to or less than the amount allowed by the operating system, which varies from system to system. The default value for this option is -10,000. You can override it as follows:

    -[global]
-	max open files = 8000
    -

    - -8.6.8 max xmit

    This global option sets the maximum size of packets that Samba exchanges with a client. In some cases, setting a smaller maximum packet size can increase performance, especially with Windows for Workgroups. The default value for this option is -65535. You can override it as follows:

    -[global]
-	max xmit = 4096

    - -The section Section B.2.2.6, The TCP receive window in Appendix B, -Samba Performance Tuning, - -shows some uses for this option.

    -

    - -8.6.9 nt pipe support

    This global option is used by developers to allow or disallow Windows NT clients the ability to make connections to the NT SMB-specific IPC$ pipes. As a user, you should never need to override the default:

    -[global]
-	nt pipe support = yes
    -

    - -8.6.10 nt smb support

    This global option is used by developers to negotiate NT-specific SMB options with Windows NT clients. The Samba team has discovered that slightly better performance comes from setting this value to -no. However, as a user, you should probably not override the default:

    -[global]
-	nt smb support = yes
    -

    - -8.6.11 ole locking compatibility

    -This global option turns off Samba's internal byte-range locking manipulation in files, which gives compatibility with Object Linking and Embedding (OLE) applications that use high byte-range locks as a method of interprocess communication. The default value for this option is -yes. If you trust your Unix locking mechanisms, you can override it as follows:

    -[global]
-	ole locking compatibility = no
    -

    - -8.6.12 panic action

    This global option specifies a command to execute in the event that Samba itself encounters a fatal error when loading or running. There is no default value for this option. You can specify an action as follows:

    -[global]
-	panic action = /bin/csh -c
-          'xedit < "Samba has shutdown unexpectedly!'
    -

    - -8.6.13 set directory

    -This boolean share-level option allows Digital Pathworks clients to use the -setdir command to change directories on the server. If you are not using the Digital Pathworks client, you should not need to alter this option. The default value for this option is -no. You can override it per share as follows:

    -[data]
-	set directory = yes
    -

    - -8.6.14 smbrun

    -This option sets the location of the -smbrun executable, which Samba uses as a wrapper to run shell commands. The default value for this option is automatically configured by Samba when it is compiled. If you did not install Samba to the standard directory, you can specify where the binary is as follows:

    -[global]
-	smbrun = /usr/local/bin/smbrun
    -

    - -8.6.15 status

    -This global option indicates whether Samba should log all active connections to a status file. This file is used only by the -smbstatus command. If you have no intentions of using this command, you can set this option to -no, which can result in a small increase of speed on the server. The default value for this option is -yes. You can override it as follows:

    -[global]
-	status = no
    -

    - -8.6.16 strict sync

    -This share-level option determines whether Samba honors all requests to perform a disk sync when requested to do so by a client. Many clients request a disk sync when they are really just trying to flush data to their own open files. As a result, this can substantially slow a Samba server down. The default value for this option is -no. You can override it as follows:

    -[data]
-	strict sync = yes
    -

    - -8.6.17 sync always

    -This share-level option decides whether every write to disk should be followed by a disk synchronization before the write call returns control to the client. Even if the value of this option is -no, clients can request a disk synchronization; see the -strict -sync option above. The default value for this option is -no. You can override it per share as follows:

    -[data]
-	sync always = yes
    -

    - -8.6.18 strip dot

    -This global option determines whether to remove the trailing dot from Unix filenames that are formatted with a dot at the end. The default value for this option is -no. You can override it per share as follows:

    -[global]
-	strip dot = yes

    -This option is now considered obsolete; the user should use the -mangled -map option insead.

    -
    -
    -
    - - -
    - -Previous: 8.5 Recently Added Options - - - -Next: 8.7 Backups with smbtar
    -8.5 Recently Added Options - -Book Index -8.7 Backups with smbtar
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch08_07.html b/docs/htmldocs/using_samba/ch08_07.html deleted file mode 100644 index c0aa083702..0000000000 --- a/docs/htmldocs/using_samba/ch08_07.html +++ /dev/null @@ -1,143 +0,0 @@ - - - -[Chapter 8] 8.7 Backups with smbtar - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 8.6 Miscellaneous Options - - - -Chapter 8
    -Additional Samba Information     		- -Next: 9. Troubleshooting Samba
     
    - -
    -
    -

    - -8.7 Backups with smbtar

    Our final topic in this chapter is the -smbtar tool. One common problem with modem PCs is that floppies and even CD-ROMs are often too small to use for backups. However, buying one tape drive per machine would also be silly. Consequently, many sites don't back up their PCs at all. Instead, they reinstall them using floppy disks and CD-ROMs when they fail.

    -Thankfully, Samba provides us with another option: you can back up PCs' data using the -smbtar tool. This can be done on a regular basis if you keep user data on your Samba system, or only occasionally, to save the local applications and configuration files and thus make repairs and reinstallations quicker.

    -To back up PCs from a Unix server, you need to do three things:

      -
    1. -

      - -Ensure that File and Printer Sharing is installed on the PC and is bound to the TCP/IP protocol.

    2. -

      - -Explicitly share a disk on the PC so it can be read from the server.

    3. -

      - -Set up the backup scripts on the server.

    -We'll use Windows 95/98 to illustrate the first two steps. Go to the Networking icon in the Control Panel window, and check that File and Printer Sharing for Microsoft Networks is currently listed in the top window, as shown in -Figure 8.2.

    - -Figure 8.2: The Networking window

    Figure 8.2

    -If "File and printer sharing for Microsoft Networks" isn't installed, you can install it by clicking on the Add button on the Network panel. After pressing it, you will be asked what service to add. Select Service and move forward, and you will be asked for a vendor and a service to install. Finally, select "File and printer sharing for Microsoft Networks," and click on Done to install the service.

    -Once you've installed "File and printer sharing for Microsoft Networks," return to the Network panel and select the TCP/IP protocol that is tied to your Samba network adapter. Then, click on the Properties button and choose the Bindings tab at the top. You should see a dialog box similar to -Figure 8.3. Here, you'll need to verify that the "File and Printer Sharing" checkbox is checked, giving it access to TCP/IP. At this point you can share disks with other machines on the net.

    - -Figure 8.3: TCP/IP Bindings

    Figure 8.3

    -The next step is to share the disk you want to back up with the tape server. Go to My Computer and select, for example, the My Documents directory. Then right-click on the icon and select its Properties. This should yield the dialog box in -Figure 8.4.

    - -Figure 8.4: My Documents Properties

    Figure 8.4

    -Select the Sharing tab and turn file sharing on. You now have the choice to share the disk as read-only, read-write (Full), or either, each with separate password. This is the Windows 95/98 version, so it provides only share-level security. In this example, we made it read/write and set a password, as shown in -Figure 8.5. When you enter the password and click on OK, you'll be prompted to re-enter it. After that, you have finished the second step.

    - -Figure 8.5: MyFiles Properties as shared

    Figure 8.5

    -Finally, the last step is to set up a backup script on the tape server, using the -smbtar program. The simplest script might contain only a single line and would be something like the following:

    -smbtar -s client -t /dev/rst0 -x "My Documents" -p password

    -This unconditionally backs up the -//client/My Documents share to the device -/dev/rst0. Of course, this is excessively simple and quite insecure. What you will want to do will depend on your existing backup scheme.

    -However, to whet your appetite, here are some possibilities of what -smbtar can do:

      -
    • -

      - -Back up files incrementally using the DOS archive bit (the --i option). This requires the client share to be accessed read-write so the bit can be cleared by -smbtar

    • -

      - -Back up only files that have changed since a specified date (using the --N - -filename option)

    • -

      - -Back up entire PC drives, by sharing all of C: or D:, for example, and backing that up

    -Except for the first example, each of these can be done with the PC sharing set to read-only, reducing the security risk of having passwords in scripts and passing them on the command line.

    -
    -
    -
    - - -
    - -Previous: 8.6 Miscellaneous Options - - - -Next: 9. Troubleshooting Samba
    -8.6 Miscellaneous Options - -Book Index -9. Troubleshooting Samba
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch09_01.html b/docs/htmldocs/using_samba/ch09_01.html deleted file mode 100644 index 8dc0e80bc5..0000000000 --- a/docs/htmldocs/using_samba/ch09_01.html +++ /dev/null @@ -1,397 +0,0 @@ - - - -[Chapter 9] Troubleshooting Samba - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 8.7 Backups with smbtar - - -Chapter 9 - -Next: 9.2 The Fault Tree
     
    - -
    -
    -

    - -9. Troubleshooting Samba

    -

    - -Contents:
    - -The Tool Bag
    - -The Fault Tree
    - -Extra Resources

    -

    Samba is extremely robust. Once you've got everything set up the way you want, you'll probably forget that it is running. When trouble occurs, it's typically during installation or when you're trying to add something new to the server. Fortunately, there are a wide variety of resources that you can use to diagnose these troubles. While we can't describe in detail the solution to every problem that you might encounter, you should be able to get a good start at a resolution by following the advice given in this chapter.

    -The first section of the chapter lists the tool bag, a collection of tools available for troubleshooting Samba; the second section is a detailed how-to, and the last section lists extra resources you may need to track down particularly stubborn problems.

    -

    - - -9.1 The Tool Bag

    Sometimes Unix seems to be made up of a handful of applications and tools. There are tools to troubleshoot tools. And of course, there are several ways to accomplish the same task. When you are trying to solve a problem related to Samba, a good plan of attack is to check the following:

      -
    1. -

      - -Samba logs

    2. -

      - -Fault tree

    3. -

      - -Unix utilities

    4. -

      - -Samba test utilities

    5. -

      - -Documentation and FAQs

    6. -

      - -Searchable archives

    7. -

      - -Samba newsgroups

    -Let's go over each of these one by one in the following sections.

    -

    - -9.1.1 Samba Logs

    Your first line of attack should always be to check the log files. The Samba log files can help diagnose the vast majority of the problems that beginning to intermediate Samba administrators are likely to face. Samba is quite flexible when it comes to logging. You can set up the server to log as little or as much as you want. Substitution variables that allow you to isolate individual logs for each machine, share, or combination thereof.

    -By default, logs are placed in - -samba_directory -/var/smbd.log and - -samba_directory -/var/nmbd.log, where -samba_directory is the location where Samba was installed (typically, -/usr/local/samba). As we mentioned in Chapter 4, Disk Shares, you can override the location and name using the -log -file configuration option in -smb.conf. This option accepts all of the substitution variables mentioned in Chapter 2, Installing Samba on a Unix System, so you could easily have the server keep a separate log for each connecting client by specifying the following in the -[global] section of -smb.conf:

    -log file = %m.log

    -Alternatively, you can specify a log directory to use with the --l flag on the command line. For example:

    -smbd -l /usr/local/var/samba

    -Another useful trick is to have the server keep a log for each service (share) that is offered, especially if you suspect a particular share is causing trouble. Use the -%S variable to set this up in the -[global] section of the configuration file:

    -log file = %S.log
    -

    - -9.1.1.1 Log levels

    The level of logging that Samba uses can be set in the -smb.conf file using the global -log -level or -debug -level option; they are equivalent. The logging level is an integer which ranges from 0 (no logging), and increases the logging to voluminous by -log -level -= -3. For example, let's assume that we are going to use a Windows client to browse a directory on a Samba server. For a small amount of log information, you can use -log -level -= -1, which instructs Samba to show only cursory information, in this case only the connection itself: 

    -105/25/98 22:02:11 server (192.168.236.86) connect to service public as user pcguest (uid=503,gid=100) (pid 3377)

    -Higher debug levels produce more detailed information. Usually you won't need any more than level 3; this is more than adequate for most Samba administrators. Levels above 3 are for use by the developers and dump enormous amounts of cryptic information.

    -Here is example output at levels 2 and 3 for the same operation. Don't worry if you don't understand the intricacies of an SMB connection; the point is simply to show you what types of information are shown at the different logging levels: 

    - /* Level 2 */
-Got SIGHUP
-Processing section "[homes]"
-Processing section "[public]"
-Processing section "[temp]"
-Allowed connection from 192.168.236.86 (192.168.236.86) to IPC$
-Allowed connection from 192.168.236.86 (192.168.236.86) to IPC/
-
-
-/* Level 3 */
-05/25/98 22:15:09 Transaction 63 of length 67
-switch message SMBtconX (pid 3377)
-Allowed connection from 192.168.236.86 (192.168.236.86) to IPC$
-ACCEPTED: guest account and guest ok
-found free connection number 105
-Connect path is /tmp
-chdir to /tmp
-chdir to /
-05/25/98 22:15:09 server (192.168.236.86) connect to service IPC$ as user pcguest (uid=503,gid=100) (pid 3377)
-05/25/98 22:15:09 tconX service=ipc$ user=pcguest cnum=105
-05/25/98 22:15:09 Transaction 64 of length 99
-switch message SMBtrans (pid 3377)
-chdir to /tmp
-trans <\PIPE\LANMAN> data=0 params=19 setup=0
-Got API command 0 of form <WrLeh> <B13BWz> (tdscnt=0,tpscnt=19,mdrcnt=4096,mprcnt=8)
-Doing RNetShareEnum
-RNetShareEnum gave 4 entries of 4 (1 4096 126 4096)
-05/25/98 22:15:11 Transaction 65 of length 99
-switch message SMBtrans (pid 3377)
-chdir to /
-chdir to /tmp
-trans <\PIPE\LANMAN> data=0 params=19 setup=0
-Got API command 0 of form <WrLeh> <B13BWz> (tdscnt=0,tpscnt=19,mdrcnt=4096,mprcnt=8)
-Doing RNetShareEnum
-RNetShareEnum gave 4 entries of 4 (1 4096 126 4096)
-05/25/98 22:15:11 Transaction 66 of length 95
-switch message SMBtrans2 (pid 3377)
-chdir to /
-chdir to /pcdisk/public
-call_trans2findfirst: dirtype = 0, maxentries = 6, close_after_first=0, close_if_end = 0 requires_resume_key = 0 level = 260, max_data_bytes = 2432
-unix_clean_name [./DESKTOP.INI]
-unix_clean_name [desktop.ini]
-unix_clean_name [./]
-creating new dirptr 1 for path ./, expect_close = 1
-05/25/98 22:15:11 Transaction 67 of length 53
-switch message SMBgetatr (pid 3377)
-chdir to /
-
-[...]

    -We cut off this listing after the first packet because it runs on for many pages. However, you should be aware that log levels above 3 will quickly fill your disk with megabytes of excruciating detail concerning Samba internal operations. Log level 3 is extremely useful for following exactly what the server is doing, and most of the time it will be obvious where an error is occurring by glancing through the log file.

    -A word of warning: using a high log level (3 or above) will -seriously slow down the Samba server. Remember that every log message generated causes a write to disk (an inherently slow operation) and log levels greater than 2 produce massive amounts of data. Essentially, you should turn on logging level 3 only when you're actively tracking a problem in the Samba server.

    -

    -9.1.1.2 Activating and deactivating logging

    To turn logging on and off, set the appropriate level in the -[global] section of -smb.conf. Then, you can either restart Samba, or force the current daemon to reprocess the configuration file. You also can send the -smbd process a SIGUSR1 signal to increase its log level by one while it's running, and a SIGUSR2 signal to decrease it by one:

    -# Increase the logging level by 1
-kill -SIGUSR1 1234
-
-# Decrease the logging level by 1
-kill -SIGUSR2 1234
    -

    - -9.1.1.3 Logging by individual client machines or users

    An effective way to diagnose problems without hampering other users is to assign different log levels for different machines in -[global] section of the -smb.conf file. We can do this by building on the strategy we presented earlier:

    -[global]
-	log level = 0
-	log file = /usr/local/samba/lib/log.%m
-	include = /usr/local/samba/lib/smb.conf.%m

    -These options instruct Samba to use unique configuration and log files for each client that connects. Now all you have to do is create an -smb.conf file for a specific client machine with a -log -level -= -3 entry in it (the others will pick up the default log level of 0) and use that log file to track down the problem.

    -Similarly, if only particular users are experiencing a problem, and it travels from machine to machine with them, you can isolate logging to a specific user by adding the following to the -smb.conf file:

    -[global]
-	log level = 0
-	log file = /usr/local/samba/lib/log.%u
-	include = /usr/local/samba/lib/smb.conf.%u

    -Then you can create a unique -smb.conf file for each user (e.g., -/usr/local/samba/lib/smb.conf.tim) files containing the configuration option -log -level -= -3 and only those users will get more detailed logging.

    -

    -9.1.2 Samba Test Utilities

    A rigorous set of tests that exercise the major parts of Samba are described in various files in the -/docs/textdocs directory of the Samba distribution kit, starting with -DIAGNOSIS.TXT. The fault tree in this chapter is a more detailed version of the basic tests suggested by the Samba team, but covers only installation and reconfiguration diagnosis, like -DIAGNOSIS.TXT. The other files in the -/docs subdirectoryies address specific problems (such as Windows NT clients) and instruct you how to troubleshoot items not included in this book. If the fault tree doesn't suffice, be sure to look at -DIAGNOSIS.TXT and its friends.

    -

    - -9.1.3 Unix Utilities

    Sometimes it's useful to use a tool outside of the Samba suite to examine what's happening inside the server. Unix has always been a "kitchen-sink" operating system. Two diagnostic tools can be of particular help in debugging Samba troubles: -trace and -tcpdump.

    -

    - -9.1.3.1 Using trace

    -The -trace command masquerades under several different names, depending on the operating system that you are using. On Linux it will be -strace, on Solaris you'll use -truss, and SGI will have -padc and -par. All have essentially the same function, which is to display each operating system function call as it is executed. This allows you to follow the execution of a program, such as the Samba server, and will often pinpoint the exact call that is causing the difficulty.

    -One problem that -trace can highlight is the location of an incorrect version of a dynamically linked library. This can happen if you've downloaded prebuilt binaries of Samba. You'll typically see the offending call at the end of the -trace, just before the program terminates.

    -A sample -strace output for the Linux operating system follows. This is a small section of a larger file created during the opening of a directory on the Samba server. Each line is a system-call name, and includes its parameters and the return value. If there was an error, the error value (e.g., -ENOENT) and its explanation are also shown. You can look up the parameter types and the errors that can occur in the appropriate -trace manual page for the operating system that you are using.

    -chdir("/pcdisk/public")                 = 0
-stat("mini/desktop.ini", 0xbffff7ec)    = -1 ENOENT (No such file or directory)
-stat("mini", {st_mode=S_IFDIR|0755, st_size=1024, ...}) = 0
-stat("mini/desktop.ini", 0xbffff7ec)    = -1 ENOENT (No such file or directory)
-open("mini", O_RDONLY)                  = 5
-fcntl(5, F_SETFD, FD_CLOEXEC)           = 0
-fstat(5, {st_mode=S_IFDIR|0755, st_size=1024, ...}) = 0
-lseek(5, 0, SEEK_CUR)                   = 0
-SYS_141(0x5, 0xbfffdbbc, 0xedc, 0xbfffdbbc, 0x80ba708) = 196
-lseek(5, 0, SEEK_CUR)                   = 1024
-SYS_141(0x5, 0xbfffdbbc, 0xedc, 0xbfffdbbc, 0x80ba708) = 0
-close(5)                                = 0
-stat("mini/desktop.ini", 0xbffff86c)    = -1 ENOENT (No such file or directory)
-write(3, "\0\0\0#\377SMB\10\1\0\2\0\200\1\0"..., 39) = 39
-SYS_142(0xff, 0xbffffc3c, 0, 0, 0xbffffc08) = 1
-read(3, "\0\0\0?", 4)                   = 4
-read(3, "\377SMBu\0\0\0\0\0\0\0\0\0\0\0\0"..., 63) = 63
-time(NULL)                              = 896143871

    -This example shows several -stat calls failing to find the files they were expecting. You don't have to be a expert to see that the file -desktop.ini is missing from that directory. In fact, many difficult problems can be identified by looking for obvious, repeatable errors with -trace. Often, you need not look farther than the last message before a crash.

    -

    - -9.1.3.2 Using tcpdump

    -The -tcpdump program, written by Van Jacobson, Craig Leres, and Steven McCanne, and extended by Andrew Tridgell, allows you to monitor network traffic in real time. A variety of output formats are available and you can filter the output to look at only a particular type of traffic. The -tcpdump program lets you examine all conversations between client and server, including SMB and NMB broadcast messages. While its troubleshooting capabilities lie mainly at the OSI network layer, you can still use its output to get a general idea of what the server and client are attempting to accomplish.

    -A sample -tcpdump log follows. In this instance, the client has requested a directory listing and the server has responded appropriately, giving the directory names -homes, -public, -IPC$, and -temp (we've added a few explanations on the right):

    $ tcpdump -v -s 255 -i eth0 port not telnet
-SMB PACKET: SMBtrans (REQUEST)	                        
-
-Request packet
-SMB Command   =  0x25                                 
-
-Request was ls or dir.
-
-[000] 01 00 00 10                                     ....
-
-
->>> NBT Packet                                                                 
-
-Outer frame of SMB packet
-NBT Session Packet
-Flags=0x0
-Length=226
-[lines skipped]
-                         
-SMB PACKET: SMBtrans (REPLY)	                           
-
-Beginning of a reply to  request 
-SMB Command   =  0x25			                                  
-
-Command was an ls or dir
-Error class   =  0x0			 
-Error code    =  0                                                                    
-
-No errors
-Flags1        =  0x80
-Flags2        =  0x1
-Tree ID       =  105
-Proc ID       =  6075
-UID           =  100
-MID           =  30337
-Word Count    =  10
-TotParamCnt=8 
-TotDataCnt=163 
-Res1=0
-ParamCnt=8 
-ParamOff=55 
-Res2=0 
-DataCnt=163 
-DataOff=63 
-Res3=0
-Lsetup=0
-Param Data: (8 bytes)
-[000] 00 00 00 00 05 00 05 00                           ........ 
-
-Data Data: (135 bytes)                                                        
-
-			Actual directory contents:
-[000] 68 6F 6D 65 73 00 00 00  00 00 00 00 00 00 00 00  homes... ........
-[010] 64 00 00 00 70 75 62 6C  69 63 00 00 00 00 00 00  d...publ ic......
-[020] 00 00 00 00 75 00 00 00  74 65 6D 70 00 00 00 00  ....u... temp....
-[030] 00 00 00 00 00 00 00 00  76 00 00 00 49 50 43 24  ........ v...IPC$
-[040] 00 00 00 00 00 00 00 00  00 00 03 00 77 00 00 00  ........ ....w...
-[050] 64 6F 6E 68 61 6D 00 00  00 00 00 00 00 00 00 00  donham.. ........
-[060] 92 00 00 00 48 6F 6D 65  20 44 69 72 65 63 74 6F  ....Home  Directo
-[070] 72 69 65 73 00 00 00 49  50 43 20 53 65 72 76 69  ries...I PC Servi
-[080] 63 65 20 28 53 61 6D                              ce (Sam

    -This is more of the same debugging session as with the -trace command; the listing of a directory. The options we used were --v (verbose), --i -eth0 to tell -tcpdump the interface to listen on (an Ethernet port), and --s -255 to tell it to save the first 255 bytes of each packet instead of the default: the first 68. The option -port -not -telnet is used to avoid screens of telnet traffic, since we were logged in to the server remotely. The -tcpdump program actually has quite a number of options to filter just the traffic you want to look at. If you've used -snoop or -etherdump, they'll look vaguely familiar.

    -You can download the modified -tcpdump from the Samba FTP server at -ftp://samba.anu.edu.au/pub/samba/tcpdump-smb. Other versions don't include support for the SMB protocol; if you don't see output such as that shown in the example, you'll need to - use the SMB-enabled version.

    -
    -
    -
    - - -
    - -Previous: 8.7 Backups with smbtar - - - -Next: 9.2 The Fault Tree
    8.7 Backups with smbtar - -Book Index -9.2 The Fault Tree
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch09_02.html b/docs/htmldocs/using_samba/ch09_02.html deleted file mode 100644 index e4c740fe27..0000000000 --- a/docs/htmldocs/using_samba/ch09_02.html +++ /dev/null @@ -1,1772 +0,0 @@ - - - -[Chapter 9] 9.2 The Fault Tree - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 9.1 The Tool Bag - - - -Chapter 9
    -Troubleshooting Samba    		 - -Next: 9.3 Extra Resources
     
    - -
    -
    -

    - -9.2 The Fault Tree

    The fault tree is for diagnosing and fixing problems that occur when you're installing and reconfiguring Samba. It's an expanded form of a trouble and diagnostic document that is part of the Samba distribution.

    Before you set out to troubleshoot any part of the Samba suite, you should know the following information:

      -
    • -

      - - Your client IP address (we use 192.168.236.10)

    • -

      - - Your server IP address (we use 192.168.236.86)

    • -

      - - The netmask for your network (typically 255.255.255.0)

    • -

      - - Whether the machines are all on the same subnet (ours are)

    -For clarity, we've renamed the server in the following examples to -server.example.com, and the client machine to -client.example.com.

    -

    - -9.2.1 How to use the fault tree

    Start the tests here, without skipping forward; it won't take long (about five minutes) and may actually save you time backtracking. Whenever a test succeeds, you will be given a section name and page number to which you can safely skip.

    -

    - -9.2.2 Troubleshooting Low-level IP

    The first series of tests is that of the low-level services that Samba needs in order to run. The tests in this section will verify that:

      -
    • -

      - - The IP software works

    • -

      - - The Ethernet hardware works

    • -

      - - Basic name service is in place

    -Subsequent sections will add TCP software, the Samba daemons -smbd and -nmbd, host-based access control, authentication and per-user access control, file services, and browsing. The tests are described in considerable detail in order to make them understandable by both technically oriented end users and experienced systems and network administrators.

    -

    - -9.2.2.1 Testing the networking software with ping

    -The first command to enter on both the server and the client is -ping 127.0.0.1. This is the -loopback -address and testing it will indicate whether any networking support is functioning at all. On Unix, you can use -ping -127.0.0.1 with the statistics option and interrupt it after a few lines. On Sun workstations, the command is typically -/usr/etc/ping --s -127.0.0.1; on Linux, just -ping -127.0.0.1. On Windows clients, run -ping -127.0.0.1 in an MS-DOS window and it will stop by itself after four lines.

    -Here is an example on a Linux server:

    server% ping 127.0.0.1 
-
    -PING localhost: 56 data bytes 64 bytes from localhost (127.0.0.1): 
-icmp-seq=0. time=1. ms 64 bytes from localhost (127.0.0.1): 
-icmp-seq=1. time=0. ms 64 bytes from localhost (127.0.0.1): 
-icmp-seq=2. time=1. ms ^C 
-----127.0.0.1 PING Statistics---- 
-3 packets transmitted, 3 packets received, 0% packet loss round-trip (ms)  
-min/avg/max = 0/0/1

    -If you get "ping: no answer from..." or "100% packet loss," you have no IP networking at all installed on the machine. The address -127.0.0.1 is the internal loopback address and doesn't depend on the computer being physically connected to a network. If this test fails, you have a serious local problem. TCP/IP either isn't installed or is seriously misconfigured. See your operating system documentation if it is a Unix server. If it is a Windows client, follow the instructions in Chapter 3, Configuring Windows Clients, to install networking support.

    -If -you're the network manager, some good references are Craig Hunt's -TCP/IP Network Administration, Chapter 11, and Craig Hunt & Robert Bruce Thompson's new book, -Windows NT TCP/IP Network Administration, both published by O'Reilly.

    -

    - -9.2.2.2 Testing local name services with ping

    Next, try to ping -localhost on the Samba server. -localhost is the conventional hostname for the 127.0.0.1 loopback, and it should resolve to that address. After typing -ping -localhost, you should see output similar to the following:

    server% ping localhost  
-
    -PING localhost: 56 data bytes  64 bytes from localhost (127.0.0.1):
-icmp-seq=0. time=0. ms  64 bytes from localhost (127.0.0.1): 
-icmp-seq=1. time=0. ms  64 bytes from localhost (127.0.0.1): 
-icmp-seq=2. time=0. ms  ^C

    -If this succeeds, try the same test on the client. Otherwise:

      -
    • -

      - -If you get "unknown host: localhost," there is a problem resolving the host name localhost into a valid IP address. (This may be as simple as a missing entry in a local -hosts file.) From here, skip down to the section -Section 9.2.8, Troubleshooting Name Services.

    • -

      - -If you get "ping: no answer," or "100% packet loss," but pinging 127.0.0.1 worked, then name services is resolving to an address, but it isn't the correct one. Check the file or database (typically -/etc/hosts on a Unix system) that the name service is using to resolve addresses to ensure that the entry is corrected.

    -

    - -9.2.2.3 Testing the networking hardware with ping

    Next, ping the server's network IP address from itself. This should get you exactly the same results as pinging 127.0.0.1:

    server% ping 192.168.236.86 
-
    -PING 192.168.236.86: 56 data bytes 64 bytes from 192.168.236.86 (192.168.236.86): 
-icmp-seq=0. time=1. ms 64 bytes from 192.168.236.86 (192.168.236.86): 
-icmp-seq=1. time=0. ms 64 bytes from 192.168.236.86 (192.168.236.86): 
-icmp-seq=2. time=1. ms ^C 
-----192.168.236.86 PING Statistics---- 
-3 packets transmitted, 3 packets received, 0% packet loss round-trip (ms)  
-min/avg/max = 0/0/1

    -If this works on the server, repeat it for the client. Otherwise:

      -
    • -

      - -If -ping - -network_ip fails on either the server or client, but ping 127.0.0.1 works on that machine, you have a TCP/IP problem that is specific to the Ethernet network interface card on the computer. Check with the documentation for the network card or the host operating system to determine how to correctly configure it. However, be aware that on some operating systems, the -ping command appears to work even if the network is disconnected, so this test doesn't always diagnose all hardware problems.

    -

    - -9.2.2.4 Testing connections with ping

    Now, ping the server by name (instead of its IP address), once from the server and once from the client. This is the general test for working network hardware:

    server% ping server 
-
    -PING server.example.com: 56 data bytes 64 bytes from server.example.com (192.168.236.86): 
-icmp-seq=0. time=1. ms 64 bytes from server.example.com (192.168.236.86): 
-icmp-seq=1. time=0. ms 64 bytes from server.example.com (192.168.236.86): 
-icmp-seq=2. time=1. ms ^C 
-----server.example.com PING Statistics---- 
-3 packets transmitted, 3 packets received, 0% packet loss round-trip (ms)  
-min/avg/max = 0/0/1

    -On Microsoft Windows, a ping of the server would look like -Figure 9.1.

    - -Figure 9.1: Pinging the Samba server from a Windows client

    Figure 9.1

    -If successful, this test tells us five things:

      -
    1. -

      - -The hostname (e.g., "server") is being found by your local nameserver.

    2. -

      - -The hostname has been expanded to the full name (e.g., ).

    3. -

      - -Its address is being returned (192.168.236.86).

    4. -

      - -The client has sent the Samba server four 56-byte UDP/IP packets.

    5. -

      - -The Samba server has replied to all four packets.

    -If this test isn't successful, there can be one of several things wrong with the network:

      -
    • -

      - -First, if you get "ping: no answer," or "100% packet loss," you're not connecting to the network, the other machine isn't connecting, or one of the addresses is incorrect. Check the addresses that the -ping command reports on each machine, and ensure that they match the ones you set up initially.

      -If not, there is at least one mismatched address between the two machines. Try entering the command -arp --a, and see if there is an entry for the other machine. The -arp command stands for the Address Resolution Protocol. The -arp --a command lists all the addresses known on the local machine. Here are some things to try:

    • -

      - -If you receive a message like "192.168.236.86 at (incomplete)," the Ethernet address of 192.168.236.86 is unknown. This indicates a complete lack of connectivity, and you're likely having a problem at the very bottom of the TCP/IP Network Administration protocol stack, at the Ethernet-interface layer. This is discussed in Chapters 5 and 6 of -TCP/IP Network Administration (O'Reilly).

    • -

      - -If you receive a response similar to "server (192.168.236.86) at 8:0:20:12:7c:94," then the server has been reached at some time, or another machine is answering on its behalf. However, this means that -ping should have worked: you may have an intermittent networking or ARP problem.

    • -

      - -If the IP address from ARP doesn't match the addresses you expected, investigate and correct the addresses manually.

    • -

      - -If each machine can ping itself but not another, something is wrong on the network between them.

    • -

      - -If you get "ping: network unreachable" or "ICMP Host Unreachable," then you're not receiving an answer and there is likely more than one network involved.

      -In principle, you shouldn't try to troubleshoot SMB clients and servers on different networks. Try to test a server and client on the same network. The three tests that follow assume you might be testing between two networks:

    • -

      - -First, perform the tests for no answer described earlier in this section. If this doesn't identify the problem, the remaining possibilities are the following: an address is wrong, your netmask is wrong, a network is down, or just possibly you've been stopped by a firewall.

    • -

      - -Check both the address and the netmasks on source and destination machines to see if something is obviously wrong. Assuming both machines really are on the same network, they both should have the same netmasks and -ping should report the correct addresses. If the addresses are wrong, you'll need to correct them. If they're right, the programs may be confused by an incorrect netmask. See -Section 9.2.9.1, Netmasks, later in this chapter.

    • -

      - -If the commands are still reporting that the network is unreachable and neither of the previous two conditions is in error, one network really may be unreachable from the other. This, too, is a network manager issue.

    • -

      - -If you get "ICMP Administratively Prohibited," you've struck a firewall of some sort or a misconfigured router. You will need to speak to your network security officer.

    • -

      - -If you get "ICMP Host redirect," and -ping reports packets getting through, this is generally harmless: you're simply being rerouted over the network.

    • -

      - -If you get a host redirect and no -ping responses, you are being redirected, but no one is responding. Treat this just like the "Network unreachable" response and check your addresses and netmasks.

    • -

      - -If you get "ICMP Host Unreachable from gateway -gateway_name," ping packets are being routed to another network, but the other machine isn't responding and the router is reporting the problem on its behalf. Again, treat this like a "Network unreachable" response and start checking addresses and netmasks.

    • -

      - -If you get "ping: unknown host -hostname," your machine's name is not known. This tends to indicate a name-service problem, which didn't affect -localhost. Have a look at -Section 9.2.8, later in this chapter.

    • -

      - -If you get a partial success, with some pings failing but others succeeding, you either have an intermittent problem between the machines or an overloaded network. Ping for longer, and see if more than about 3 percent of the packets fail. If so, check it with your network manager: a problem may just be starting. However, if only a few fail, or if you happen to know some massive network program is running, don't worry unduly. Ping's ICMP (and UDP) are designed to drop occasional packets.

    • -

      - -If you get a response like "smtsvr.antares.net is alive" when you actually pinged -client.example.com, you're either using someone else's address or the machine has multiple names and addresses. If the address is wrong, name service is clearly the culprit; you'll need to change the address in the name service database to refer to the right machine. This is discussed in -Section 9.2.8, later in this chapter.

      -Server machines are often -multihomed : connected to more than one network, with different names on each net. If you are getting a response from an unexpected name on a multihomed server, look at the address and see if it's on your network (see the section -Section 9.2.9.1, later in this chapter). If so, you should use that address, rather than one on a different network, for both performance and reliability reasons.

      -Servers may also have multiple names for a single Ethernet address, especially if they are web servers. This is harmless, if otherwise startling. You probably will want to use the official (and permanent) name, rather than an alias which may change.

    • -

      - -If everything works, but the IP address reported is 127.0.0.1, you have a name service error. This typically occurs when a operating system installation program generates an -/etc/hosts line similar to -127.0.0.1 -localhost -hostnamedomainname. The localhost line should say -127.0.0.1 -localhost or -127.0.0.1 -localhost -loghost. Correct it, lest it cause failures to negotiate who is the master browse list holder and who is the master browser. It can, also cause (ambiguous) errors in later tests.

    -If this worked from the server, repeat it from the client.

    -

    -9.2.3 Troubleshooting TCP

    Now that you've tested IP, UDP, and a name service with -ping, it's time to test TCP. -ping and browsing use ICMP and UDP; file and print services (shares) use TCP. Both depend on IP as a lower layer and all four depend on name services. Testing TCP is most conveniently done using the FTP (file transfer protocol) program.

    -

    - -9.2.3.1 Testing TCP with FTP

    -Try connecting via FTP, once from the server to itself, and once from the client to the server: 

    -server% ftp server
-Connected to server.example.com. 
-220 server.example.com FTP server (Version 6.2/OpenBSD/Linux-0.10) ready.
- Name (server:davecb): 
-331 Password required for davecb. 
-Password: 
-230 User davecb logged in.
- ftp> quit 
-221 Goodbye.

    -If this worked, skip to the section -Section 9.2.4, Troubleshooting Server Daemons. Otherwise:

      -
    • -

      - -If you received the message "server: unknown host," then nameservice has failed. Go back to the corresponding -ping step, -Section 9.2.2.2, Testing local name services with ping , and rerun those tests to see why name lookup failed.

    • -

      - -If you received "ftp: connect: Connection refused," the machine isn't running an FTP daemon. This is mildly unusual on Unix servers. Optionally, you might try this test by connecting to the machine using telnet instead of FTP; the messages are very similar and telnet uses TCP as well.

    • -

      - -If there was a long pause, then "ftp: connect: Connection timed out," the machine isn't reachable. Return to the section -Section 9.2.2.4, Testing connections with ping.

    • -

      - -If you received "530 Logon Incorrect," you connected successfully, but you've just found a different problem. You likely provided an incorrect username or password. Try again, making sure you use your username from the Unix server and type your password correctly.

    -

    - -9.2.4 Troubleshooting Server Daemons

    Once you've confirmed that TCP networking is working properly, the next step is to make sure the daemons are running on the server. This takes three separate tests because no single one of the following will decisively prove that they're working correctly.

    -To be sure they're running, you need to find out if:

      -
    1. -

      - -The daemon has started

    2. -

      - -The daemons are registered or bound to a TCP/IP port by the operating system

    3. -

      - -They're actually paying attention

    -

    - -9.2.4.1 Before you start

    -First, check the logs. If you've started the daemons, the message "smbd version -some_number started" should appear. If it doesn't, you will need to restart the Samba daemons.

    -If the daemon reports that it has indeed started, look out for "bind failed on port 139 socket_addr=0 (Address already in use)". This means another daemon has been started on port 139 (smbd). Also, -nmbd will report a similar failure if it cannot bind to port 137. Either you've started them twice, or the -inetd server has tried to provide a daemon for you. If it's the latter, we'll diagnose that in a moment.

    -

    - -9.2.4.2 Looking for daemon processes with ps

    -Next, you need to see if the daemons have been started. Use the -ps command on the server with the -long option for your machine type (commonly -ps -ax or -ps --ef), and see if you have either -smbd and -nmbd already running. This often looks like the following:

    server% ps ax
-
    - PID TTY STAT TIME   COMMAND
- 1   ?   S    0:03   init [2] 
- 2   ?   SW   0:00   (kflushd)
-
-(...many lines of processes...) 
- 234 ?   S    0:14   nmbd -D3
- 237 ?   S    0:11   smbd -D3
-
-(...more lines, possibly including more smbd lines...)

    -This example illustrates that -smbd and -nmbd have already started as stand-alone daemons (the --D option) at log level 3.

    -

    - -9.2.4.3 Looking for daemons bound to ports

    -Next, the daemons have to be registered with the operating system so they can get access to TCP/IP ports. The -netstat command will tell you if this has been done. Run the command -netstat --a on the server, and look for lines mentioning -netbios, -137 or -139:

    server% netstat -a 
-
    -Active Internet connections (including servers) 
-Proto Recv-Q Send-Q  Local Address          Foreign Address      (state) 
-udp   0      0       *.netbios-             *.* 
-tcp   0      0       *.netbios-             *.*                  LISTEN 
-tcp   8370   8760    server.netbios-        client.1439               
-ESTABLISHED

    -or:

    server% netstat -a 
-
    -Active Internet connections (including servers) 
-Proto Recv-Q Send-Q  Local Address          Foreign Address        (state) 
-udp   0      0       *.137                  *.* 
-tcp   0      0       *.139                  *.*                    LISTEN 
-tcp   8370   8760    server.139             client.1439            ESTABLISHED

    -Among many similar lines, there should be at least one UDP line for -*.netbios- or -*.137. This indicates that the -nmbd server is registered and (we hope) is waiting to answer requests. There should also be at least one TCP line mentioning -*.netbios- or -*.139, and it will probably be in the LISTENING state. This means that -smbd is up and listening for connections.

    -There may be other TCP lines indicating connections from -smbd to clients, one for each client. These are usually in the ESTABLISHED state. If there are -smbd lines in the ESTABLISHED state, -smbd is definitely running. If there is only one line in the LISTENING state, we're not sure yet. If both of the lines is missing, a daemon has not succeeded in starting, so it's time to check the logs and then go back to Chapter 2.

    -If there is a line for each client, it may be coming either from a Samba daemon or from the master IP daemon, -inetd. It's quite possible that your -inetd startup file contains lines that start Samba daemons without your realizing it; for instance, the lines may have been placed there if you installed Samba as part of a Linux distribution. The daemons started by -inetd prevent ours from running. This problem typically produces log messages such as "bind failed on port 139 socket_addr=0 (Address already in use)."

    -Check your -/etc/inetd.conf ; unless you're intentionally starting the daemons from there, there -must not be any -netbios-ns (udp port 137) or -netbios-ssn (tcp port 139) servers mentioned there. -inetd is a daemon that provides numerous services, controlled by entries in -/etc/inetd.conf. If your system is providing an SMB daemon via -inetd, there will be lines like the following in the file:

    -netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd
-netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd
    -

    - -9.2.4.4 Checking smbd with telnet

    -Ironically, the easiest way to test that the -smbd server is actually working is to send it a meaningless message and see if it rejects it. Try something like the following:

    echo hello | telnet localhost 139

    -This sends an erroneous but harmless message to -smbd. The -hello message is important. Don't try telneting to the port and typing just anything; you'll probably just hang your process. -hello, however, is generally a harmless message.

    server% echo "hello" | telnet localhost 139 
-
    -Trying
-Trying 192.168.236.86 ... 
-Connected to localhost. Escape character is '^]'. 
-Connection closed by foreign host.

    -If you get a "Connected" message followed by a "Connection closed" message, the test was a success. You have an -smbd daemon listening on the port and rejecting improper connection messages. On the other hand, if you get "telnet: connect: Connection refused," there is probably no daemon present. Check the logs and go back to Chapter 2.

    -Regrettably, there isn't an easy test for -nmbd. If the -telnet test and the -netstat test both say that there is an -smbd running, there is a good chance that -netstat will also be correct about -nmbd running.

    -

    - -9.2.4.5 Testing daemons with testparm

    Once you know there's a daemon, you should always run -testparm, in hopes of getting:

    server% testparm 
-
    -Load smb config files from /opt/samba/lib/smb.conf
-Processing section "[homes]" 
-Processing section "[printers]" ... 
-Processing section "[tmp]" 
-Loaded services file OK. ...

    -The -testparm program normally reports processing a series of sections, and responds with "Loaded services file OK" if it succeeds. If not, it will report one or more of the following messages, which will also appear in the logs as noted:

    -
    - -"Allow/Deny connection from account (n) to service"
    -

    -A -testparm-only message produced if you have valid/invalid user options set in your -smb.conf. You will want to make sure that you are on the valid user list, and that root, bin, etc., are on the invalid user list. If you don't, you will not be able to connect, or folks who shouldn't -will be able to.

    - -"Warning: You have some share names that are longer than eight chars"
    -

    -For anyone using Windows for Workgroups and older clients. They will fail to connect to shares with long names, producing an overflow message that sounds confusingly like a memory overflow.

    -"Warning: [name] service MUST be printable!"
    -

    -A printer share lacks a -printable -= -yes option.

    -"No path in service name using [name]"
    -

    -A file share doesn't know which directory to provide to the user, or a print share doesn't know which directory to use for spooling. If no path is specified, the service will try to run with a path of -/tmp, which may not be what you want.

    -"Note: Servicename is flagged unavailable"
    -

    -Just a reminder that you have used the -available -= -no option in a share.

    -"Can't find include file [name]"
    -

    -A configuration file referred to by an -include option did not exist. If you were including the file unconditionally, this is an error and probably a serious one: the share will not have the configuration you intended. If you were including it based one of the -% variables, such as -%a (architecture), you will need to decide if, for example, a missing Windows for Workgroups configuration file is a problem. It often isn't.

    -"Can't copy service name, unable to copy to itself"
    -

    -You tried to copy a -smb.conf section into itself.

    -"Unable to copy service - source not found: [name]"
    -

    -Indicates a missing or misspelled section in a -copy -= option.

    -"Ignoring unknown parameter name"
    -

    -Typically indicates an obsolete, misspelled or unsupported option.

    -"Global parameter name found in service section"
    -

    -Indicates a global-only parameter has been used in an individual share. Samba will ignore the parameter.

    -After the -testparm test, repeat it with (exactly) three parameters: the name of your -smb.conf file, the name of your client, and its IP address:

    testparm samba_directory/lib/smb.conf client 192.168.236.10

    -This will run one more test that checks the host name and address against -host -allow and -host -deny options and may produce the "Allow/Deny connection from account account_name" to service message for the client machine. This message indicates you have valid/invalid host options in your -smb.conf, and they prohibit access from the client machine. Entering -testparm -/usr/local/lib/experimental.conf is also an effective way to test an experimental -smb.conf file before putting it into production.

    -

    -9.2.5 Troubleshooting SMB Connections

    Now that you know the servers are up, you need to make sure that they're running properly. We start with the -smb.conf file in the - -samba_directory -/lib directory.

    -

    - -9.2.5.1 A minimal smb.conf file

    -In the following tests, we assume you have a -[temp] share suitable for testing, plus at least one account. An -smb.conf file that includes just these is:

    -[global] 
-    workgroup = 
-
-EXAMPLE 
-    security = user
-    browsable = yes 
-    local master = yes 
-[homes] 
-    guest ok = no 
-    browseble = no
-[temp] 
-    path = /tmp 
-    public = yes

    -A word of warning: the -public -= -yes option in the -[temp] share is just for testing. You probably don't want people without accounts to be able to store things on your Samba server, so you should comment it out when you're done.

    -

    - -9.2.5.2 Testing locally with smbclient

    The first test is to ensure the server can list its own services (shares). Run the command -smbclient with a --L option of -localhost to connect to itself, and a --U option of just -% to specify the guest user. You should see the following: 

    server% smbclient -L localhost -U% 
-Server time is Wed May 27 17:57:40 1998 Timezone is UTC-4.0
-Server=[localhost] 
-User=[davecb] 
-Workgroup=[EXAMPLE] 
-Domain=[EXAMPLE]
-	Sharename      Type      Comment 
-	---------           -----       ----------
-	temp               Disk
-	IPC$               IPC       IPC Service (Samba 1.9.18) 
-	homes            Disk       Home directories
-This machine does not have a browse list

    -If you received this output, move on to the next test, -Section 9.2.5.3, Testing connections with smbclient. On the other hand, if you receive an error, check the following:

      -
    • -

      - -If you get "Get_hostbyname: unknown host localhost," either you've spelled its name wrong or there actually is a problem (which should have been seen back in -Section 9.2.2.2) In the latter case, move on to "Troubleshooting Name Services."

    • -

      - -If you get "Connect error: Connection refused," the server machine was found, but it wasn't running an -nmbd daemon. Skip back to -Section 9.2.4, and retest the daemons.

    • -

      - -If you get the message "Your server software is being unfriendly," the initial session request packet got a garbage response from the server. The server may have crashed or started improperly. The common causes of this can be discovered by scanning the logs for:

        -
      • -

        - -Invalid command-line parameters to -smbd; see the -smbd manual page.

      • -

        - -A fatal problem with the -smb.conf file that prevents the startup of -smbd. Always check your changes, as was done in the section -Section 9.2.4.5, Testing daemons with testparm.

      • -

        - -The directories where Samba keeps its log and lock files are missing.

      • -

        - -There is already a server on the port (139 for -smbd, 137 for -nmbd ), preventing it from starting.

    • -

      - -If you're using -inetd instead of stand-alone daemons, check your -/etc/inetd.conf and -/etc/services entries against their manual pages for errors as well.

    • -

      - -If you get a -Password: prompt, your guest account is not set up properly. The -%U option tells -smbclient to do a "null login," which requires that the guest account be present but does not require it to have any privileges.

    • -

      - -If you get the message "SMBtconX failed. ERRSRV - ERRaccess," you aren't permitted access to the server. This normally means you have a -valid -hosts option that doesn't include the server, or an -invalid -hosts option that does. Recheck with the command -testparm -smb.conf - -your_hostname - -your_ip_address (see the section -Section 9.2.4.5) and correct any unintended prohibitions.

    -

    - -9.2.5.3 Testing connections with smbclient

    Run the command smbclient\\server\temp, which connects to your server's -/tmp share, to see if you can connect to a file service. You should get the following response:

    server% smbclient '\\server\temp' 
-
    -Server time is Tue May  5 09:49:32 1998 Timezone is UTC-4.0 Password:
-
-smb:\> quit
      -
    • -

      - -If you get "Get_Hostbyname: Unknown host name," "Connect error: Connection refused," or "Your server software is being unfriendly," see the section -Section 9.2.5.2, Testing locally with smbclient for the diagnoses.

    • -

      - -If you get the message "servertemp: Not enough `\' characters in service," you likely didn't quote the address, so Unix stripped off backslashes. You can also write the command:

    smbclient \\\\server\\temp

    -or: 

    smbclient //server/temp

    -Now, provide your Unix account password to the -Password prompt. If you then get an -smb\> prompt, it worked. Enter -quit, and continue on to -Section 9.2.5.4, Testing connections with NET USE. If you then get "SMBtconX failed. ERRSRV - ERRinvnetname," the problem can be any of the following:

      -
    • -

      - -A wrong share name: you may have spelled it wrong, it may be too long, it may be in mixed case, or it may not be available. Check that it's what you expect with testparm (see the section -Section 9.2.4.5.)

    • -

      - - -security -= -share, in which you may have to add - --U your_account to the -smbclient command, or know the password of a Unix account named temp.

    • -

      - -An erroneous username.

    • -

      - -An erroneous password.

    • -

      - -An -invalid -users or -valid -users option in your -smb.conf file that doesn't allow your account to connect. Recheck with -testparm -smb.conf - -your_hostname your_ip_address (see -Section 9.2.4.5).

    • -

      - -A -valid -hosts option that doesn't include the server, or an -invalid -hosts option that does. Also test this with -testparm.

    • -

      - -A problem in authentication, such as if shadow passwords or the PAM (Password Authentication Module) is used on the server, but Samba is not compiled to use it. This is rare, but occasionally happens when a SunOS 4 Samba binary (no shadow passwords) is run without recompilation on a Solaris system (with shadow passwords).

    • -

      - -The -encrypted -passwords -= -yes option in the configuration file, but no password for your account in the -smbpasswd file.

    • -

      - -You have a null password entry, either in Unix -/etc/passwd or in the -smbpasswd file.

    • -

      - -You are connecting to -[temp], and you do not have the -guest -ok -= -yes option in the -[temp] section of the -smb.conf file.

    • -

      - -You are connecting to -[temp] before connecting to your home directory, and your guest account isn't set up correctly. If you can connect to your home directory and then connect to -[temp], that's the problem. See Chapter 2 for more information on creating a basic Samba configuration file.

      -A bad guest account will also prevent you from printing or browsing until after you've logged in to your home directory.

    -There is one more reason for this failure that has nothing at all to do with passwords: the -path -= line in your -smb.conf file may point somewhere that doesn't exist. This will not be diagnosed by -testparm, and most SMB clients can't tell it from other types of bad user accounts. You will have to check it manually.

    -Once you have connected to -[temp] successfully, repeat the test, this time logging in to your home directory (e.g., map network drive - -server -\davecb) looking for failures in doing that. If you have to change anything to get that to work, re-test -[temp] again afterwards.

    -

    - -9.2.5.4 Testing connections with NET USE

    Run the command -net use * \server\temp on the DOS or Windows client to see if it can connect to the server. You should be prompted for a password, then receive the response "The command was completed successfully," as shown in -Figure 9.2.

    - -Figure 9.2: Results of the NET USE command

    Figure 9.2

    -If that succeeded, continue with the steps in the section -Section 9.2.5.5, Testing connections with Windows Explorer. Otherwise:

      -
    • -

      - -If you get "The specified shared directory cannot be found," or "Cannot locate specified share name," the directory name is either misspelled or not in the -smb.conf file. This message can also warn of a name in mixed case, including spaces, or is longer than eight characters.

    • -

      - -If you get "The computer name specified in the network path cannot be located," or "Cannot locate specified computer," the directory name has been misspelled, the name service has failed, there is a networking problem, or the -hosts -deny -= option includes your host.

        -
      • -

        - -If it is not a spelling mistake, you need to double back to at least the section -Section 9.2.5.3, to investigate why it doesn't connect.

      • -

        - -If -smbclient does work, it's a name service problem with the client name service, and you need to go forward to the section -Section 9.2.6.2, Testing the server with nmblookup, and see if you can look up both client and server with -nmblookup.

    • -

      - -If you get "The password is invalid for \server\username," your locally cached copy on the client doesn't match the one on the server. You will be prompted for a replacement.

    -Windows 95 and 98 clients keep a local -password file, but it's really just a cached copy of the password it sends to Samba and NT servers to authenticate you. That's what is being prompted for here. You can still log on to a Windows machine without a password (but not to NT).

      -
    • -

      -If you provide your password, and it still fails, your password is not being matched on the server, you have a -valid -users or -invalid -users list denying you permission, NetBEUI is interfering, or the encrypted password problem described in the next paragraph exists.

    • -

      - -If your client is NT 4.0, NT 3.5 with Patch 3, Windows 95 with Patch 3, Windows 98 or any of these with Internet Explorer 4.0, these default to using Microsoft encryption for passwords (discussed in Chapter 6, Users, Security, and Domains's Section 6.4, Passwords in Chapter 6 section, along with the alternatives). In general, if you have installed a major Microsoft product recently, you may have applied an update and turned on encrypted passwords.

    -Because of Internet Explorer's willingness to honor URLs such as -file://somehost/somefile by making SMB connections, clients up to and including Windows 95 Patch Level 2 would happily send your password, in plaintext, to SMB servers anywhere on the Internet. This was considered a bad idea, and Microsoft quite promptly switched to using only encrypted passwords in the SMB protocol. All subsequent releases of their products have included this correction. Encrypted passwords aren't actually needed unless you're using Internet Explorer 4.0 without a firewall, so it's reasonable to keep using unencrypted passwords on your own networks.

      -
    • -

      - -If you have a mixed-case password on Unix, the client is probably sending it in all one case. If changing your password to all one case works, this was the problem. Regrettably, all but the oldest clients support uppercase passwords, so Samba will try once with it in uppercase and once in lower case. If you wish to use mixed-case passwords, see the -password -level option in Chapter 6 for a workaround.

    • -

      - -You may have a -valid -users problem, as tested with -smbclient (see -Section 9.2.5.3).

    • -

      - -You may have the NetBEUI protocol bound to the Microsoft client. This often produces long timeouts and erratic failures, and is known to have caused failures to accept passwords in the past.

    -The term "bind" is used to mean connecting a piece of software to another in this case. The Microsoft SMB client is "bound to" TCP/IP in the bindings section of the TCP/IP properties panel under the Windows 95/98 Network icon in the Control Panel. TCP/IP in turn is bound to an Ethernet card. This is not the same sense of the word as binding an SMB daemon to a TCP/IP port.

    -

    -9.2.5.5 Testing connections with Windows Explorer

    Start Windows Explorer or NT Explorer (not Internet Explorer), select Tools→Map Network Drive and specify \\ - -server\ -temp to see if you can make Explorer connect to the -/tmp directory. You should see a screen similar to the one in -Figure 9.3. If so, you've succeeded and can skip to -Section 9.2.6, Troubleshooting Browsing .

    - -Figure 9.3: Accessing the /tmp directory with Windows Explorer

    Figure 9.3

    -A word of caution: Windows Explorer and NT Explorer are rather poor as diagnostic tools: they do tell you that something's wrong, but rarely what it is. If you get a failure, you'll need to track it down with the NET USE command, which has far superior error reporting:

      -
    • -

      - -If you get "The password for this connection that is in your password file is no longer correct," you may have any of the following:

        -
      • -

        - -Your locally cached copy on the client doesn't match the one on the server.

      • -

        - -You didn't provide a username and password when logging on to the client. Most Explorers will continue to send a username and password of null, even if you provide a password.

      • -

        - -You have misspelled the password.

      • -

        - -You have an -invalid -users or -valid -users list denying permission.

      • -

        - -Your client is NT 4.0, NT 3.5 with Patch 3, Windows 95 with Patch 3, Windows 98, or any of these with Internet Explorer 4. They will all want encrypted passwords.

      • -

        - -You have a mixed-case password, which the client is supplying in all one case.

    • -

      - -If you get "The network name is either incorrect, or a network to which you do not have full access," or "Cannot locate specified computer," you may have any of the following:

        -
      • -

        - - Misspelled name

      • -

        - - Malfunctioning service

      • -

        - - Failed share

      • -

        - - Networking problem

      • -

        - - Bad -path line

      • -

        - - -hosts -deny line that excludes you

    • -

      - -If you get "You must supply a password to make this connection," the password on the client is out of synchronization with the server, or this is the first time you've tried from this client machine and the client hasn't cached it locally yet.

    • -

      - -If you get "Cannot locate specified share name," you have a wrong share name or a syntax error in specifying it, a share name longer than eight characters, or one containing spaces or in mixed case.

    -Once you can reliably connect to the -[temp] directory, try once again, this time using your home directory. If you have to change something to get home directories working, then retest with -[temp], and vice versa, as we showed in the section -Section 9.2.5.4. As always, if Explorer fails, drop back to that section and debug it there.

    -

    -9.2.6 Troubleshooting Browsing

    Finally, we come to browsing. This was left to last, not because it is hardest, but because it's both optional and partially dependent on a protocol that doesn't guarantee delivery of a packet. Browsing is hard to diagnose if you don't already know all the other services are running.

    -Browsing is purely optional: it's just a way to find the servers on your net and the shares that they provide. Unix has nothing of the sort and happily does without. Browsing also assumes all your machines are on a local area network (LAN) where broadcasts are allowable.

    -First, the browsing mechanism identifies a machine using the unreliable UDP protocol; then it makes a normal (reliable) TCP/IP connection to list the shares the machine provides.

    -

    - -9.2.6.1 Testing browsing with smbclient

    We'll start with testing the reliable connection first. From the server, try listing its own shares via -smbclient with a --L option of your server's name. You should get: 

    server% smbclient -L server 
-Added interface ip=192.168.236.86 bcast=192.168.236.255 nmask=255.255.255.0 Server time is Tue Apr 28 09:57:28 1998 Timezone is UTC-4.0 
-Password: 
-Domain=[EXAMPLE] 
-OS=[Unix] 
-Server=[Samba 1.9.18]
-Server=[server] 
-User=[davecb] 
-Workgroup=[EXAMPLE] 
-Domain=[EXAMPLE]
-   Sharename      Type      Comment    
-   ---------      ----      -------    
-    cdrom          Disk      CD-ROM    
-    cl             Printer   Color Printer 1    
-    davecb         Disk      Home Directories
-
- This machine has a browse list:
-   Server         Comment    
-   ---------      -------    
-   SERVER          Samba 1.9.18
-
- This machine has a workgroup list:
-   Workgroup      Master    
-    ---------      -------    
-    EXAMPLE        SERVER
      -
    • -

      - -If you didn't get a Sharename list, the server is not allowing you to browse any shares. This should not be the case if you've tested any of the shares with Windows Explorer or the NET USE command. If you haven't done the -smbclient --L -localhost --U% test yet (see -Section 9.2.5.2), do it now. An erroneous guest account can prevent the shares from being seen. Also, check the -smb.conf file to make sure you do not have the option -browsable -= -no anywhere in it: we suggest a minimal -smb.conf file (see -Section 9.2.5.1, A minimal smb.conf file) for you to steal from. You need to have -browseable enabled in order to be able to see at least the -[temp] share.

    • -

      - -If you didn't get a browse list, the server is not providing information about the machines on the network. At least one machine on the net must support browse lists. Make sure you have -local -master -= -yes in the -smb.conf file if you want Samba be the local master browser.

    • -

      - -If you got a browse list but didn't get -/tmp, you probably have a -smb.conf problem. Go back to -Section 9.2.4.5.

    • -

      - -If you didn't get a workgroup list with your workgroup name in it, it is possible that your workgroup is set incorrectly in the -smb.conf file.

    • -

      - -If you didn't get a workgroup list at all, ensure that -workgroup -=EXAMPLE is present in the -smb.conf file.

    • -

      - -If you get nothing, try once more with the options --I - -ip_address --n - -netbios_name --W - -workgroup --d3 with the NetBIOS and workgroup name in uppercase. (The --d -3 option sets the log /debugging level to 3.)

    -If you're still getting nothing, you shouldn't have gotten this far. Double back to at least -Section 9.2.3.1, Testing TCP with FTP , or perhaps -Section 9.2.2.4. On the other hand:

      -
    • -

      - -If you get "SMBtconX failed. ERRSRV - ERRaccess," you aren't permitted access to the server. This normally means you have a -valid -hosts option that doesn't include the server, or an invalid hosts option that does.

    • -

      - - If you get "Bad password," then you presumably have one of the following:

        -
      • -

        - - An incorrect -hosts -allow or -hosts -deny line

      • -

        - - An incorrect -invalid -users or -valid -users line

      • -

        - - A lowercase password and OS/2 or Windows for Workgroups clients

      • -

        - - A missing or invalid guest account

    • -

      -Check what your guest account is (see -Section 9.2.5.2) and verify your -smb.conf file with -testparm -smb.conf - -your_hostname your_ip_address (see -Section 9.2.4.5) and change or comment out any -hosts -allow, -hosts -deny, -valid -users or -invalid -users lines.

    • -

      - -If you get "Connection refused," the -smbd server is not running or has crashed. Check that it's up, running, and listening to the network with -netstat, see step -Section 9.2.4.5.

    • -

      - -If you get "Get_Hostbyname: Unknown host name," you've made a spelling error, there is a mismatch between Unix and NetBIOS hostname, or there is a name service problem. Start nameservice debugging with -Section 9.2.5.4. If this works, suspect a name mismatch and go to step -Section 9.2.10, Troubleshooting NetBIOS Names.

    • -

      - -If you get "Session request failed," the server refused the connection. This usually indicates an internal error, such as insufficient memory to fork a process.

    • -

      - -If you get "Your server software is being unfriendly," the initial session request packet received a garbage response from the server. The server may have crashed or started improperly. Go back to -Section 9.2.5.2, where the problem is first analyzed.

    • -

      - -If you suspect the server is not running, go back to -Section 9.2.4.2, Looking for daemon processes with ps to see why the server daemon isn't responding.

    -

    -9.2.6.2 Testing the server with nmblookup

    -This will test the "advertising" system used for Windows name services and browsing. Advertising works by broadcasting one's presence or willingness to provide services. It is the part of browsing that uses an unreliable protocol (UDP), and works only on broadcast networks like Ethernets. The -nmblookup program broadcasts name queries for the hostname you provide, and returns its IP address and the name of the machine, much like -nslookup does with DNS. Here, the --d (debug- or log-level) option, and the --B (broadcast address) options direct queries to specific machines.

    -First, we check the server from itself. Run -nmblookup with a --B option of your server's name to tell it to send the query to the Samba server, and a parameter of -__SAMBA__ as the symbolic name to look up. You should get: 

    server% nmblookup -B server __SAMBA__ 
-Added interface ip=192.168.236.86 bcast=192.168.236.255 nmask=255.255.255.0 
-Sending queries to 192.168.236.86 192.168.236.86 __SAMBA__

    -You should get the IP address of the server, followed by the name -__SAMBA__ , which means that the server has successfully advertised that it has a service called -__SAMBA__ , and therefore at least part of NetBIOS nameservice works.

      -
    • -

      - -If you get "Name_query failed to find name __SAMBA__" you may have specified the wrong address to the --B option, or -nmbd is not running. The --B option actually takes a broadcast address: we're using a machine-name to get a unicast address, and to ask server if it has claimed -__SAMBA__.

    • -

      - -Try again with --B - - ip_address, and if that fails too, -nmbd isn't claiming the name. Go back briefly to "Testing daemons with testparm" to see if -nmbd is running. If so, it may not claiming names; this means that Samba is not providing the browsing service - a configuratiuon problem. If that is the case, make sure that -smb.conf doesn't contain the option -browsing -= -no.

    -

    - -9.2.6.3 Testing the client with nmblookup

    -Next, check the IP address of the client from the server with -nmblookup using --B option for the client's name and a parameter of -'*' meaning "anything," as shown here: 

    server% nmblookup -B client '*' 
-Sending queries to 192.168.236.10 192.168.236.10 *
-Got a positive name query response from 192.168.236.10 (192.168.236.10)
      -
    • -

      - -If you receive "Name-query failed to find name *," you have made a spelling mistake, or the client software on the PC isn't installed, started, or bound to TCP/IP. Double back to Chapter 2 or Chapter 3 and ensure you have a client installed and listening to the network.

    -Repeat the command with the following options if you had any failures:

      -
    • -

      - -If -nmblookup --B - -client_IP_address succeeds but --B - -client_name fails, there is a name service problem with the client's name; go to -Section 9.2.8.

    • -

      - -If -nmblookup --B -127.0.0.1'*' succeeds, but --B - -client_IP_address fails, there is a hardware problem and ping should have failed. See your network manager.

    -

    - -9.2.6.4 Testing the network with nmblookup

    -Run the command -nmblookup again with a --d option (debug level) of 2 and a parameter of -'*' again. This time we are testing the ability of programs (such as -nmbd ) to use broadcast. It's essentially a connectivity test, done via a broadcast to the default broadcast address.

    -A number of NetBIOS/TCP-IP hosts on the network should respond with "got a positive name query response" messages. Samba may not catch all of the responses in the short time it listens, so you won't always see all the SMB clients on the network. However, you should see most of them:

    server% nmblookup -d 2 '*' 
-Added interface ip=192.168.236.86 bcast=192.168.236.255 nmask=255.255.255.0 Sending queries to 192.168.236.255 
-Got a positive name query response from 192.168.236.191 (192.168.236.191) 
-Got a positive name query response from 192.168.236.228 (192.168.236.228) 
-Got a positive name query response from 192.168.236.75 (192.168.236.75) 
-Got a positive name query response from 192.168.236.79 (192.168.236.79) 
-Got a positive name query response from 192.168.236.206 (192.168.236.206) 
-Got a positive name query response from 192.168.236.207 (192.168.236.207) 
-Got a positive name query response from 192.168.236.217 (192.168.236.217) 
-Got a positive name query response from 192.168.236.72 (192.168.236.72) 192.168.236.86 *

    -However:

      -
    • -

      - -If this doesn't give at least the client address you previously tested, the default broadcast address is wrong. Try -nmblookup --B -255.255.255.255 --d -2 -'*', which is a last-ditch variant (a broadcast address of all ones). If this draws responses, the broadcast address you've been using before is wrong. Troubleshooting these is discussed in the -Section 9.2.9.2, Broadcast addresses section, later in this chapter.

    • -

      - -If the address 255.255.255.255 fails too, check your notes to see if your PC and server are on different subnets, as discovered in -Section 9.2.2.4. You should try to diagnose this with a server and client on the same subnet, but if you can't, you can try specifying the remote subnet's broadcast address with --B. Finding that address is discussed in the same place as troubleshooting broadcast addresses, in the section -Section 9.2.9.2, later in this chapter. The --B option will work if your router supports directed broadcasts; if it doesn't, you may be forced to test with a client on the same network.

    -

    - -9.2.6.5 Testing client browsing with net view

    On the client, run the command net view \\server in a DOS window to see if you can connect to the client and ask what shares it provides. You should get back a list of available shares on the server, as shown in -Figure 9.4.

    - -Figure 9.4: Using the net view command

    Figure 9.4

    -If you received this, continue with the section -Section 9.2.7, Other Things that Fail.

      -
    • -

      - -If you get "Network name not found" for the name you just tested in the section -Section 9.2.6.3, Testing the client with nmblookup, there is a problem with the client software itself. Double-check this by running -nmblookup on the client; if it works and NET VIEW doesn't, the client is at fault.

    • -

      - -Of course, if -nmblookup fails, there is a NetBIOS nameservice problem, as discussed in the section -Section 9.2.10.

    • -

      - -If you get "You do not have the necessary access rights," or "This server is not configured to list shared resources," either your guest account is misconfigured (see -Section 9.2.5.2), or you have a -hosts -allow or -hosts -deny line that prohibits connections from your machine. These problems should have been detected by the -smbclient tests starting in the section -Section 9.2.6.1, Testing browsing with smbclient .

    • -

      - -If you get "The specified computer is not receiving requests," you have misspelled the name, the machine is unreachable by broadcast (tested in "Testing the network with nmblookup"), or it's not running -nmbd.

    • -

      - -If you get "Bad password error," you're probably encountering the Microsoft-encrypted password problem, as discussed in Chapter 6, with its corrections.

    -

    - -9.2.6.6 Browsing the server from the client

    From the Network Neighborhood (File Manager in older releases), try to browse the server. Your Samba server should appear in the browse list of your local workgroup. You should be able to double click on the name of the server and get a list of shares, as illustrated in -Figure 9.5.

    - -Figure 9.5: List of shares on a server

    Figure 9.5
      -
    • -

      - -If you get an "Invalid password" error with NT 4.0, NT 3.5 with Patch 3, Windows 95 with Patch 3, Windows 98 or any of these with Internet Explorer 4.0, it's most likely the encryption problem again. All of these clients default to using Microsoft encryption for passwords (see Chapter 6).

    • -

      - -If you receive an "Unable to browse the network" error, one of the following has ocurred:

        -
      • -

        - -You have looked too soon, before the broadcasts and updates have completed; try waiting 30 seconds before re-attempting.

      • -

        - -There is a network problem you've not yet diagnosed.

      • -

        - -There is no browse master. Add the configuration option -local -master -= -yes to your -smb.conf file.

      • -

        - -No shares are marked -browsable in the -smb.conf file.

    • -

      - -If you receive the message "\\server is not accessible," then:

        -
      • -

        - - You have the encrypted password problem

      • -

        - - The machine really isn't accessible

      • -

        - - The machine doesn't support browsing

    -

    -9.2.7 Other Things that Fail

    -If you've made it here, either the problem is solved or it's not one we've seen. The next sections cover troubleshooting tasks that are required to have the infrastructure to run Samba, not Samba itself.

    -

    - -9.2.7.1 Not logging on

    An occasional problem is forgetting to log in to the client or logging in as a wrong (account-less) person. The former is not diagnosed at all: Windows tries to be friendly and lets you on. Locally! The only warning of the latter is that Windows welcomes you and asks about your new account. Either of these leads to repeated refusals to connect and endless requests for passwords. If nothing else seems to work, try logging out or shutting down and logging in again.

    -

    - -9.2.8 Troubleshooting Name Services

    This section looks at simple troubleshooting of all the name services that you will encounter, but only for the common problems that affect Samba.

    -There are several good references for troubleshooting particular name services: Paul Albitz and Cricket Liu's -DNS and Bind covers the Domain Name Service (DNS), Hal Stern's -NFS and NIS (both from O'Reilly) covers NIS ("Yellow pages") while WINS (Windows Internet Name Service), -hosts/LMHOSTS files and NIS+ are best covered by their respective vendor's manuals.

    -The problems addressed in this section are:

      -
    • -

      - -Identifying name services

    • -

      - -A hostname can't be looked up

    • -

      - -The long (FQDN) form of a hostname works but the short form doesn't

    • -

      - -The short form of the name works, but the long form doesn't

    • -

      - -A long delay ocurrs before the expected result

    -

    - -9.2.8.1 Identifying what's in use

    First, see if both the server and the client are using DNS, WINS, NIS, or -hosts files to look up IP addresses when you give them a name. Each kind of machine will have a different preference:

      -
    • -

      - -Windows 95 and 98 machines will look in WINS and -LMHOSTS files first, then broadcast, and finally try DNS and -hosts files.

    • -

      - -NT will look in WINS, then broadcast, LMHOSTS files, and finally -hosts and DNS.

    • -

      - -Windows programs using the WINSOCK standard (like PC-NFSs) will use hosts files, DNS, WINS, and then broadcast. Don't assume that if a different program's name service works, the SMB client program's name service will!

    • -

      - -Samba daemons will use -LMHOSTS, WINS, the Unix host's preference, and then broadcast.

    • -

      - -Unix hosts can be configured to use any combination of DNS, -hosts files, and NIS and NIS+, generally in any order.

    -We recommend that the client machines be configured to use WINS and DNS, the Samba daemons to use WINS and DNS, and the Unix server to use DNS. You'll have to look at your notes and the actual machines to see which is in use.

    -On the clients, the name services are all set in the TCP/IP Properties panel of the Networking Control Panel, as discussed in Chapter 3. You may need to check there to see what you've actually turned on. On the server, see if an -/etc/resolv.conf file exists. If it does, you're using DNS. You may be using the others as well, though. You'll need to check for NIS and combinations of services.

    -Check for an -/etc/nsswitch.conf file on Solaris and other System V Unix operating systems. If you have one, look for a line that begins -host:, followed by one or more of -files, -bind, -nis or -nis+. These are the name services to use, in order, with optional extra material in square brackets. -files stands for using - hosts files, while -bind (the Berkeley Internet Name Daemon) stands for using DNS.

    -If the client and server differ, the first thing to do is to get them in sync. Clients can only use only DNS, WINS, -hosts files and -lmhosts files, not NIS or NIS+. Servers can use -hosts files, DNS, and NIS or NIS+, but not WINS - even if your Samba server provides WINS services. If you can't get all the systems to use the same services, you'll have to carefully check the server and the client for the same data.

    -Samba 2.0 (and late 1.9 versions) added a --R - (resolve order) option to -smbclient. If you want to troubleshoot WINS, for example, you'd say:

     smbclient -L server -R wins

    -The possible settings are -hosts (which means whatever the Unix machine is using, not just - /etc/hosts files), -lmhosts, -wins and -bcast (broadcast).

    -In the following sections, we use the term -long name for a fully-qualified domain name (FQDN), like -server.example.com, and the term -short name for the host part of a FQDN, like -server.

    -

    - -9.2.8.2 Cannot look up hostnames

    - Try the following:

      -
    • -

      - -In DNS:

      -Run -nslookup - -name. If this fails, look for a -resolv.conf error, a downed DNS server, or a short/long name problem (see the next section). Try the following:

    • -

      - -Your -/etc/resolv.conf should contain one or more name-server lines, each with an IP address. These are the addresses of your DNS servers.

    • -

      - -ping each of the server addresses you find. If this fails for one, suspect the machine. If it fails for each, suspect your network.

    • -

      - -Retry the lookup using the full domain name (e.g., -server.example.com) if you tried the short name first, or the short name if you tried the long name first. If results differ, skip to the next section.

      -
    • -

      - -In Broadcast/ WINS:

      -Broadcast/ WINS does only short names such as -server, (not long ones, such as -server.example.com). Run -nmblookup --S - -server. - - This reports everything broadcast has registered for the name. In our example, it looks like this:

    -Looking up status of 192.168.236.86
-received 10 names
-        SERVER           <00> -         M <ACTIVE> 
-        SERVER           <03> -         M <ACTIVE> 
-        SERVER           <1f> -         M <ACTIVE> 
-        SERVER           <20> -         M <ACTIVE> 
-        ..__MSBROWSE__.  <01> - <GROUP> M <ACTIVE> 
-        MYGROUP          <00> - <GROUP> M <ACTIVE> 
-        MYGROUP          <1b> -         M <ACTIVE> 
-        MYGROUP          <1c> - <GROUP> M <ACTIVE> 
-        MYGROUP          <1d> -         M <ACTIVE> 
-        MYGROUP          <1e> - <GROUP> M <ACTIVE>
      -
    • -

      -The required entry is -SERVER -<00>, which identifies - -server as being this machine's NetBIOS name. You should also see your workgroup mentioned one or more times. If these lines are missing, Broadcast/WINS cannot look up names and will need attention.

    -The numbers in angle brackets in the previous output identify NetBIOS names as being workgroups, workstations, and file users of the messenger service, master browsers, domain master browsers, domain controllers and a plethora of others. We primarily use -<00> to identify machine and workgroup names and -<20> to identify machines as servers. The complete list is available at -http://support.microsoft.com/support/kb/articles/q163/4/09.asp.

      -
    • -

      - -In NIS:

      -Try -ypmatch -name -hosts. If this fails, NIS is down. Find out the NIS server's name by running - ypwhich, and ping the machine it to see if it's accessible.

    • -

      - -In NIS+:

      -If you're running NIS+, try -nismatch -name -hosts. If this fails, NIS is down. Find out the NIS server's name by running -niswhich, and ping that machine to see if it's accessible.

    • -

      - -In -hosts files:

      -Inspect -/etc/hosts on the client (C:\WINDOWS\HOSTS). Each line should have an IP number and one or more names, the primary name first, then any optional aliases. An example follows:

    -        127.0.0.1         localhost
-        192.168.236.1     dns.svc.example.com 
-        192.168.236.10    client.example.com client 
-        192.168.236.11    backup.example.com loghost 
-        192.168.236.86    server.example.com server 
-        192.168.236.254   router.svc.example.com
      -
    • -

      -On Unix, -localhost should always be 127.0.0.1, although it may be just an alias for a hostname on the PC. On the client, check that there are no -#XXX directives at the ends of the lines; these are LAN Manager/NetBIOS directives, and should appear only in -LMHOSTS files (C:\WINDOWS\LMHOSTS).

    • -

      - -In -LMHOSTS files:

      -This file is a local source for LAN Manager (NetBIOS) names. It has a format very similar to -/etc/hosts files, but does not support long-form domain names (e.g., -server.example.com), and may have a number of optional -#XXX directives following the names. Note there usually is a -lmhosts.sam (for sample) file in -C:\WINDOWS, but it's not used unless renamed to -C:\WINDOWS\LMHOSTS.

    -

    - -9.2.8.3 Long and short hostnames

    Where the long (FQDN) form of a hostname works but the short name doesn't (for example, -client.example.com works but -client doesn't), consider the following:

      -
    • -

      - -DNS:

      -This usually indicates there is no default domain in which to look up the short names. Look for a -default line in -/etc/resolv.conf on the Samba server with your domain in it, or a -search line with one or more domains in it. One or the other may need to be present to make short names usable; which one depends on vendor and version of the DNS resolver. Try adding -domain - -your domain to -resolv.conf and ask your network or DNS administrator what should have been in the file.

    • -

      - -Broadcast/WINS:

      -Broadcast/WINS doesn't support long names; it won't suffer from this problem.

    • -

      - -NIS:

      -Try the command -ypmatch -hostname -hosts. If you don't get a match, your tables don't include short names. Speak to your network manager; short names may be missing by accident, or may be unsupported as a matter of policy. Some sites don't ever use (ambiguous) short names.

    • -

      - -NIS+ :

      -Try -nismatch - -hostname -hosts, and treat failure exactly as with NIS above.

    • -

      - - -hosts:

      -If the short name is not in -/etc/hosts, consider adding it as an alias. Avoid, if you can, short names as primary names (the first one on a line). Have them as aliases if your system permits.

    • -

      - - -LMHOSTS:

      -LAN Manager doesn't support long names, so it won't suffer from this problem.

    -On the other hand, if the short form of the name works and the long doesn't, consider the following:

      -
    • -

      - -DNS:

      -This is bizarre; see your network or DNS administrator, as this is probably a DNS setup bug.

    • -

      - -Broadcast/WINS:

      -This is a normal bug; Broadcast/WINS can't use the long form. Optionally, consider DNS. Microsoft has stated that they will switch to DNS, though it's not providing name types like <00>.

    • -

      - -NIS:

      -If you can use -ypmatch to look up the short form but not the long, consider adding the long form to the table as at least an alias.

    • -

      - -NIS+:

      -Same as NIS, except you use -nismatch instead of -ypmatch to look up names.

    • -

      - - -hosts:

      -Add the long name as at least an alias, and preferably as the primary form. Also consider using DNS if it's practical.

    • -

      - - -LMHOSTS:

      -This is a normal bug. LAN Manager can't use the long form; consider switching to DNS or -hosts.

    -

    - -9.2.8.4 Unusual delays

    When there is a long delay before the expected result:

      -
    • -

      - -DNS:

      -Test the same name with the -nslookup command on the machine (client or server) that is slow. If -nslookup is also slow, you have a DNS problem. If it's slower on a client, you have too many protocols bound to the Ethernet card. Eliminate NetBEUI, which is infamously slow, and optionally, Novel, assuming you don't need them. This is especially important on Windows 95, which is particularly sensitive to excess protocols.

    • -

      - -Broadcast/ WINS:

      -Test the client using -nmblookup, and if it's faster, you probably have the protocols problem as mentioned in the previous item.

    • -

      - -NIS:

      -Try -ypmatch, and if it's slow, report the problem to your network manager.

    • -

      - -NIS+:

      -Try -nismatch, similarly.

    • -

      - - -hosts:

      - -hosts files, if of reasonable size, are always fast. You probably have the protocols problem mentioned under DNS, above.

    • -

      - - -LMHOSTS:

      -This is not a name lookup problem; -LMHOSTS files are as fast as -hosts files.

    -

    - -9.2.8.5 Localhost issues

    When a localhost isn't 127.0.0.1, try the following:

      -
    • -

      - -DNS:

      -There is probably no record for -localhost. -A -127.0.0.1. Arrange to add one, and a reverse entry, -1.0.0.127.IN-ADDR.ARPA -PTR -127.0.0.1.

    • -

      - -Broadcast/WINS:

      -Not applicable.

    • -

      - -NIS:

      -If -localhost isn't in the table, add it.

    • -

      - -NIS+:

      -If -localhost isn't in the table, add it.

    • -

      - - -hosts:

      -Add a line is the -hosts file that says -127.0.0.1 -localhost

    • -

      - - -LMHOSTS:

      -Not applicable.

    -

    -9.2.9 Troubleshooting Network Addresses

    -A number of common problems are caused by incorrect Internet address routing or the incorrect assignment of addresses. This section helps you determine what your addresses are.

    -

    - -9.2.9.1 Netmasks

    The netmasks tell each machine which addresses can be reached directly (are on your local network) and which addresses require forwarding packets through a router. If the netmask is wrong, the machines will make one of two mistakes. One is to try to route local packets via a router, which is an expensive way to waste time - it may work reasonably fast, it may run slowly, or it may fail utterly. The second mistake is to fail to send packets for a remote machine to the router, which will prevent them from being forwarded to the remote machine.

    -The netmask is a number like an IP address, with one-bits for the network part of an address and zero-bits for the host portion. The netmask is literally used to mask off parts of the address inside the TCP/IP code. If the mask is 255.255.0.0, the first 2 bytes are the network part and the last 2 are the host part. More common is 255.255.255.0, in which the first 3 bytes are the network part and the last one is the host part.

    -For example, let's say your IP address is 192.168.0.10 and the Samba server is 192.168.236.86. If your netmask happens to be 255.255.255.0, the network part of the addresses is the first 3 bytes and the host part is the last byte. In this case, the network parts are different, and the machines are on different networks:

    - - - - - -
    -

    -Network Part

    		 -

    -Host Part

    -

    -192 168 000

    		 -

    -10

    -

    -192 168 235

    		 -

    -86

    -If your netmask happens to be 255.255.0.0, the network part is just the first two bytes. In this case, the network parts match and so the two machines are on the same network:

    - - - - - -
    -

    -Network Part

    		 -

    -Host Part

    -

    -192 168

    		 -

    -000 10

    -

    -192 168

    		 -

    -236 86

    -Of course, if your netmask says one thing and your network manager says another, the netmask is wrong.

    -

    - -9.2.9.2 Broadcast addresses

    -The broadcast address is a normal address, with the hosts part all one-bits. It means "all hosts on your network." You can compute it easily from your netmask and address: take the address and put one-bits in it for all the bits that are zero at the end of the netmask (the host part). The following table illustrates this:

    - - - - - - -
    -

    -

    		 -

    -Network Part

    		 -

    -Host Part

    -

    - -IP address

    		 -

    -192 168 236

    		 -

    -86

    -

    - -Netmask

    		 -

    -255 255 255

    		 -

    -000

    -

    - -Broadcast

    		 -

    -192 168 236

    		 -

    -255

    -In this example, the broadcast address on the 192.168.236 network is 192.168.236.255. There is also an old "universal" broadcast address, 255.255.255.255. Routers are prohibited from forwarding these, but most machines on your local network will respond to broadcasts to this address.

    -

    - -9.2.9.3 Network address ranges

    A number of address ranges have been reserved for testing and for non-connected networks; we use one of these for the book. If you don't have an address yet, feel free to use one of these to start with. They include one class A (large) network, 10.*.*.*, and 254 class C (smaller) networks, 192.168.1.* through to 192.168.254.*. In this book we use one of the latter, 192.168.236.*. The domain -example.com is also reserved for unconnected networks, explanatory examples, and books.

    -If you're actually connecting to the Internet, you'll need to get a real network and a domain name, probably through the same company that provides your connection.

    -

    - -9.2.9.4 Finding your network address

    If you haven't recorded your IP address, it will be displayed by the -ifconfig command on Unix or by the IPCONFIG command on Windows 95 and NT. (Check your manual pages for any options required by your brand of Unix: Sun wants -ifconfig --a). You should see output similar to the following:

    -server% ifconfig -a 
-le0: flags=63<UP,BROADCAST,NOTRAILERS,RUNNING > 
-      inet 192.168.236.11 netmask ffffff00 broadcast 192.168.236.255 
-lo0: flags=49<&lt>UP,LOOPBACK,RUNNING<&gt> 		
-      inet 127.0.0.1 netmask ff000000

    -One of the interfaces will be loopback (in our examples -lo0), and the other will be the regular IP interface. The flags should show that the interface is running, and Ethernet interfaces will also say they support broadcasts (PPP interfaces don't). The other places to look for IP addresses are -/etc/hosts files, Windows -HOSTS files, Windows -LMHOSTS files, NIS, NIS+ and DNS.

    -

    -9.2.10 Troubleshooting NetBIOS Names

    Historically, SMB protocols have depended on the NetBIOS name system, also called the LAN Manager name system. This was a simple scheme where each machine had a unique 20-character name and broadcast it on the LAN for everyone to know. With TCP/IP, we tend to use names like -client.example.com stored in -/etc/hosts files, through DNS or WINS.

    -The usual mapping to domain names such as -server.example.com simply uses the -server part as the NetBIOS name and converts it to uppercase. Alas, this doesn't always work, especially if you have a machine with a 21-character name; not everyone uses the same NetBIOS and DNS names. For example, -corpvm1 along with -vm1.corp.com is not unusual.

    -A machine with a different NetBIOS name and domain name is confusing when you're troubleshooting; we recommend that you try to avoid this wherever possible. NetBIOS names are discoverable with -smbclient :

      -
    • -

      - -If you can list shares on your Samba server with -smbclient and a --L option (list shares) of - -short_name_of_server, the short name is the NetBIOS name.

    • -

      - -If you get "Get_Hostbyname: Unknown host name," there is probably a mismatch. Check in the -smb.conf file to see if the NetBIOS name is explicitly set.

    • -

      - -Try again, specifying --I and the IP address of the Samba server (e.g., -smbclient --L -server --I -192.168.236.86). This overrides the name lookup and forces the packets to go to the IP address. If this works, there was a mismatch.

    • -

      - -Try with --I and the full domain name of the server (e.g., -smbclient --L -server --I -server.example.com). This tests the lookup of the domain name, using whatever scheme the Samba server uses (e.g., DNS). If it fails, you have a name service problem. You should reread the section -Section 9.2.8 after you finish troubleshooting the NetBIOS names.

    • -

      - -Try with --n (NetBIOS name) and the name you expect to work (e.g., -smbclient --n -server --L -server-12) but without overriding the IP address through --I. If this works, the name you specified with --n is the actual NetBIOS name of the server. If you receive "Get-Hostbyname: Unknown host MARY," it's not the right server yet.

    • -

      - -If nothing is working so far, repeat the tests specifying --U - -username and --W - -workgroup, with the username and workgroup in uppercase, to make sure you're not being derailed by a user or workgroup mismatch.

    • -

      - -If nothing works still and you had evidence of a name service problem, troubleshoot name service in the section -Section 9.2.8, and then return to NetBIOS name service.

    -
    -
    -
    - - -
    - -Previous: 9.1 The Tool Bag - - - -Next: 9.3 Extra Resources
    9.1 The Tool Bag - -Book Index -9.3 Extra Resources
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/ch09_03.html b/docs/htmldocs/using_samba/ch09_03.html deleted file mode 100644 index ecaa53ed36..0000000000 --- a/docs/htmldocs/using_samba/ch09_03.html +++ /dev/null @@ -1,136 +0,0 @@ - - - -[Chapter 9] 9.3 Extra Resources - - - - - - -
    - - -
    -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly -
    1st Edition November 1999 -
    1-56592-449-5, Order Number: 4495 -
    416 pages, $34.95 -     -

    Buy the hardcopy -

    Table of Contents -

    -
    - - -
    -
    - - -
    - -Previous: 9.2 The Fault Tree - - - -Chapter 9
    -Troubleshooting Samba    		 - -Next: A. Configuring Samba with SSL
     
    - -
    -
    -

    - -9.3 Extra Resources

    At some point during your Samba career, you will want to turn to online or printed resources for news, updates, and aid.

    -

    - -9.3.1 Documentation and FAQs

    It's okay to read the documentation. Really. Nobody can see you, and we won't tell. In fact, Samba ships with a large set of documentation files, and it is well worth the effort to at least browse through them, either in the distribution directory on your computer under -/docs, or online at the Samba web site: http://samba.anu.edu.au/samba/. The most current FAQ list, bug information, and distribution locations are located at the web site, with links to all of the Samba manual pages and HOW-TOs.

    -

    - -9.3.2 Samba Newsgroups

    Usenet newsgroups have always been a great place to get advice on just about any topic. In the past few years, though, this vast pool of knowledge has developed something that has made it into an invaluable resource: a memory. Archival and search sites such as DejaNews (http://www.dejanews.com) have made sifting through years of valuable solutions on a topic as simple as a few mouse clicks.

    -The primary newsgroup for Samba is -comp.protocols.smb. This should always be your first stop when there's a problem. More often than not, spending five minutes researching an error here will save hours of frustration while trying to debug something yourself.

    -When searching a newsgroup, try to be as specific as possible, but not too wordy. Searching on actual error messages is best. If you don't find an answer immediately in the newsgroup, resist the temptation to post a request for help until you've done a bit more work on the problem. You may find that the answer is in a FAQ or one of the many documentation files that ships with Samba, or a solution might become evident when you run one of Samba's diagnostic tools. If nothing works, post a request in -comp.protocols.smb, and be as specific as possible about what you have tried and what you are seeing. Include any error messages that appear. It may be several days before you receive help, so be patient and keep trying things while you wait.

    -Once you post a request for help, keep poking at the problem yourself. Most of us have had the experience of posting a Usenet article containing hundreds of lines of intricate detail, only to solve the problem an hour later after the article has blazed its way across several continents. The rule of thumb goes something like this: the more folks who have read your request, the simpler the solution. Usually this means that once everyone in the Unix community has seen your article, the solution will be something simple like, "Plug the computer into the wall socket."

    -

    - -9.3.3 Samba Mailing Lists

    The following are mailing lists for support with Samba. See the Samba homepage, http://www.samba.org/ for information on subscribing and unsubscribing to these mailing lists:

    -
    -samba-binaries@samba.org
    -

    -This mailing list has information on precompiled binaries for the Samba platform.

    -samba@samba.org
    -

    -This mailing list is the place to report suspected bugs in Samba.

    -samba-ntdom@samba.org
    -

    -This mailing list has information on support for domains (particularly Windows NT) with the Samba product.

    -samba-technical@samba.org
    -

    -This mailing list maintains debate about where the future of Samba is headed.

    -samba@samba.org
    -

    -This is the primary Samba mailing list that contains general questions and HOW-TO information on Samba.

    -

    - -9.3.4 Samba Discussion Archives

    There is a search service for the primary Samba mailing list. At the time this book was written, it was listed under "searchable" in the Sources paragraph on the first page of the Samba site and its mirrors, http://samba.anu.edu.au/listproc/ghindex.html.

    -

    - -9.3.5 Further Reading

      -
    1. -

      Craig Hunt; -TCP/IP Network Administration, 2nd Edition. Sebastopol, CA: O'Reilly and Associates, 1997 (ISBN 1-56592-322-7).

    2. -

      -Hunt, Craig, and Robert Bruce Thompson; -Windows NT TCP/IP Network Administration. Sebastopol, CA: O'Reilly and Associates, 1998 ( -ISBN 1-56592-377-4).

    3. -

      Albitz, Paul, and Cricket Liu; -DNS and Bind, 3rd Edition. Sebastopol, CA: O'Reilly & Associates, 1998 (ISBN 1-56592-512-2).

    4. -

      -Stern, Hal; -Managing NFS and NIS. Sebastopol, CA: O'Reilly & Associates, 1991 (ISBN 0-937175-75-7).

    -
    -
    -
    - - -
    - -Previous: 9.2 The Fault Tree - - - -Next: A. Configuring Samba with SSL
    9.2 The Fault Tree - -Book Index -A. Configuring Samba with SSL
    -
    - - -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/figs/sam.0101.gif b/docs/htmldocs/using_samba/figs/sam.0101.gif deleted file mode 100644 index ce022dd322..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0101.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0102.gif b/docs/htmldocs/using_samba/figs/sam.0102.gif deleted file mode 100644 index 2c26743160..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0102.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0103.gif b/docs/htmldocs/using_samba/figs/sam.0103.gif deleted file mode 100644 index 480b51bdb2..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0103.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0104.gif b/docs/htmldocs/using_samba/figs/sam.0104.gif deleted file mode 100644 index a580bfd9da..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0104.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0105.gif b/docs/htmldocs/using_samba/figs/sam.0105.gif deleted file mode 100644 index 45782f6a54..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0105.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0106.gif b/docs/htmldocs/using_samba/figs/sam.0106.gif deleted file mode 100644 index 7e43f6a829..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0106.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0107.gif b/docs/htmldocs/using_samba/figs/sam.0107.gif deleted file mode 100644 index 60f24ce060..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0107.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0108.gif b/docs/htmldocs/using_samba/figs/sam.0108.gif deleted file mode 100644 index 93b036c736..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0108.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0109.gif b/docs/htmldocs/using_samba/figs/sam.0109.gif deleted file mode 100644 index ec01228ef7..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0109.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0110.gif b/docs/htmldocs/using_samba/figs/sam.0110.gif deleted file mode 100644 index 9695cf7c61..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0110.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0111.gif b/docs/htmldocs/using_samba/figs/sam.0111.gif deleted file mode 100644 index 4dbc2dba41..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0111.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0112.gif b/docs/htmldocs/using_samba/figs/sam.0112.gif deleted file mode 100644 index 4f559e0d0f..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0112.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0113.gif b/docs/htmldocs/using_samba/figs/sam.0113.gif deleted file mode 100644 index 5d8cdaef6b..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0113.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0114.gif b/docs/htmldocs/using_samba/figs/sam.0114.gif deleted file mode 100644 index 291e6f0c82..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0114.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0201.gif b/docs/htmldocs/using_samba/figs/sam.0201.gif deleted file mode 100644 index e6f97f6301..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0201.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0202.gif b/docs/htmldocs/using_samba/figs/sam.0202.gif deleted file mode 100644 index 0490c08571..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0202.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0203.gif b/docs/htmldocs/using_samba/figs/sam.0203.gif deleted file mode 100644 index a24c481860..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0203.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0204.gif b/docs/htmldocs/using_samba/figs/sam.0204.gif deleted file mode 100644 index e446b1d4f1..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0204.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0301.gif b/docs/htmldocs/using_samba/figs/sam.0301.gif deleted file mode 100644 index 82306d6cc9..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0301.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0302.gif b/docs/htmldocs/using_samba/figs/sam.0302.gif deleted file mode 100644 index 0916db72ae..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0302.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0303.gif b/docs/htmldocs/using_samba/figs/sam.0303.gif deleted file mode 100644 index 18d63dbbb7..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0303.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0304.gif b/docs/htmldocs/using_samba/figs/sam.0304.gif deleted file mode 100644 index a0c5eee099..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0304.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0305.gif b/docs/htmldocs/using_samba/figs/sam.0305.gif deleted file mode 100644 index 43be04655a..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0305.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0306.gif b/docs/htmldocs/using_samba/figs/sam.0306.gif deleted file mode 100644 index be7609d943..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0306.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0307.gif b/docs/htmldocs/using_samba/figs/sam.0307.gif deleted file mode 100644 index 258d3390bc..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0307.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0308.gif b/docs/htmldocs/using_samba/figs/sam.0308.gif deleted file mode 100644 index 316643ccfb..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0308.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0309.gif b/docs/htmldocs/using_samba/figs/sam.0309.gif deleted file mode 100644 index 4a9d5d762b..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0309.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0310.gif b/docs/htmldocs/using_samba/figs/sam.0310.gif deleted file mode 100644 index 37262b91be..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0310.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0311.gif b/docs/htmldocs/using_samba/figs/sam.0311.gif deleted file mode 100644 index c25e96f936..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0311.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0312.gif b/docs/htmldocs/using_samba/figs/sam.0312.gif deleted file mode 100644 index 8823f38eb1..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0312.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0313.gif b/docs/htmldocs/using_samba/figs/sam.0313.gif deleted file mode 100644 index 981a684988..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0313.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0314.gif b/docs/htmldocs/using_samba/figs/sam.0314.gif deleted file mode 100644 index 9a7ed5858e..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0314.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0315.gif b/docs/htmldocs/using_samba/figs/sam.0315.gif deleted file mode 100644 index ed4bcc4220..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0315.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0316.gif b/docs/htmldocs/using_samba/figs/sam.0316.gif deleted file mode 100644 index 99908ac7d3..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0316.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0317.gif b/docs/htmldocs/using_samba/figs/sam.0317.gif deleted file mode 100644 index 1489901006..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0317.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0318.gif b/docs/htmldocs/using_samba/figs/sam.0318.gif deleted file mode 100644 index 263650a274..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0318.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0319.gif b/docs/htmldocs/using_samba/figs/sam.0319.gif deleted file mode 100644 index 0d1c934a56..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0319.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0320.gif b/docs/htmldocs/using_samba/figs/sam.0320.gif deleted file mode 100644 index 061ce27cb1..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0320.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0321.gif b/docs/htmldocs/using_samba/figs/sam.0321.gif deleted file mode 100644 index f40fbbedca..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0321.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0322.gif b/docs/htmldocs/using_samba/figs/sam.0322.gif deleted file mode 100644 index f421311dfc..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0322.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0323.gif b/docs/htmldocs/using_samba/figs/sam.0323.gif deleted file mode 100644 index 578ffda552..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0323.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0324.gif b/docs/htmldocs/using_samba/figs/sam.0324.gif deleted file mode 100644 index 4ab9ceb598..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0324.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0325.gif b/docs/htmldocs/using_samba/figs/sam.0325.gif deleted file mode 100644 index f6da1e7434..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0325.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0326.gif b/docs/htmldocs/using_samba/figs/sam.0326.gif deleted file mode 100644 index df6313794d..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0326.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0327.gif b/docs/htmldocs/using_samba/figs/sam.0327.gif deleted file mode 100644 index 1e77439215..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0327.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0328.gif b/docs/htmldocs/using_samba/figs/sam.0328.gif deleted file mode 100644 index 7baa0ef4e6..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0328.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0401.gif b/docs/htmldocs/using_samba/figs/sam.0401.gif deleted file mode 100644 index a62d0d5675..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0401.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0402.gif b/docs/htmldocs/using_samba/figs/sam.0402.gif deleted file mode 100644 index ecf03ca8c8..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0402.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0403.gif b/docs/htmldocs/using_samba/figs/sam.0403.gif deleted file mode 100644 index 755522854a..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0403.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0404.gif b/docs/htmldocs/using_samba/figs/sam.0404.gif deleted file mode 100644 index 0d28182e52..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0404.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0405.gif b/docs/htmldocs/using_samba/figs/sam.0405.gif deleted file mode 100644 index c7cc9d681b..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0405.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0406.gif b/docs/htmldocs/using_samba/figs/sam.0406.gif deleted file mode 100644 index a4f82804aa..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0406.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0407.gif b/docs/htmldocs/using_samba/figs/sam.0407.gif deleted file mode 100644 index 84ca4e87c7..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0407.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0501.gif b/docs/htmldocs/using_samba/figs/sam.0501.gif deleted file mode 100644 index dac53c673a..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0501.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0502.gif b/docs/htmldocs/using_samba/figs/sam.0502.gif deleted file mode 100644 index 46e282ce31..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0502.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0503.gif b/docs/htmldocs/using_samba/figs/sam.0503.gif deleted file mode 100644 index 786de36e69..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0503.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0504.gif b/docs/htmldocs/using_samba/figs/sam.0504.gif deleted file mode 100644 index bece7b9e0a..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0504.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0505.gif b/docs/htmldocs/using_samba/figs/sam.0505.gif deleted file mode 100644 index 6460e0436d..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0505.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0506.gif b/docs/htmldocs/using_samba/figs/sam.0506.gif deleted file mode 100644 index e7282b0286..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0506.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0507.gif b/docs/htmldocs/using_samba/figs/sam.0507.gif deleted file mode 100644 index bc7f2fda9a..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0507.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0508.gif b/docs/htmldocs/using_samba/figs/sam.0508.gif deleted file mode 100644 index 95b7ad98c4..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0508.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0601.gif b/docs/htmldocs/using_samba/figs/sam.0601.gif deleted file mode 100644 index e826dd5141..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0601.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0602.gif b/docs/htmldocs/using_samba/figs/sam.0602.gif deleted file mode 100644 index dce39b1c40..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0602.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0603.gif b/docs/htmldocs/using_samba/figs/sam.0603.gif deleted file mode 100644 index 15ad6f05d7..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0603.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0604.gif b/docs/htmldocs/using_samba/figs/sam.0604.gif deleted file mode 100644 index cd9820d00e..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0604.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0605.gif b/docs/htmldocs/using_samba/figs/sam.0605.gif deleted file mode 100644 index db8e9c5e9f..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0605.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0606.gif b/docs/htmldocs/using_samba/figs/sam.0606.gif deleted file mode 100644 index a4c5e577e5..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0606.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0701.gif b/docs/htmldocs/using_samba/figs/sam.0701.gif deleted file mode 100644 index 5933bdabbd..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0701.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0702.gif b/docs/htmldocs/using_samba/figs/sam.0702.gif deleted file mode 100644 index c1160e2838..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0702.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0703.gif b/docs/htmldocs/using_samba/figs/sam.0703.gif deleted file mode 100644 index 653e9b9761..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0703.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0704.gif b/docs/htmldocs/using_samba/figs/sam.0704.gif deleted file mode 100644 index 78d5a439ea..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0704.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0705.gif b/docs/htmldocs/using_samba/figs/sam.0705.gif deleted file mode 100644 index 39cee4c856..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0705.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0706.gif b/docs/htmldocs/using_samba/figs/sam.0706.gif deleted file mode 100644 index 8725542429..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0706.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0707.gif b/docs/htmldocs/using_samba/figs/sam.0707.gif deleted file mode 100644 index 09abcd5e78..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0707.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0708.gif b/docs/htmldocs/using_samba/figs/sam.0708.gif deleted file mode 100644 index bd5466b319..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0708.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0709.gif b/docs/htmldocs/using_samba/figs/sam.0709.gif deleted file mode 100644 index 28452fd232..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0709.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0801.gif b/docs/htmldocs/using_samba/figs/sam.0801.gif deleted file mode 100644 index 04e9210e54..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0801.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0802.gif b/docs/htmldocs/using_samba/figs/sam.0802.gif deleted file mode 100644 index bf1718c93b..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0802.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0803.gif b/docs/htmldocs/using_samba/figs/sam.0803.gif deleted file mode 100644 index bb5739154a..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0803.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0804.gif b/docs/htmldocs/using_samba/figs/sam.0804.gif deleted file mode 100644 index eceb287e62..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0804.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0805.gif b/docs/htmldocs/using_samba/figs/sam.0805.gif deleted file mode 100644 index 5a599e1345..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0805.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0901.gif b/docs/htmldocs/using_samba/figs/sam.0901.gif deleted file mode 100644 index 1965600ab9..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0901.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0902.gif b/docs/htmldocs/using_samba/figs/sam.0902.gif deleted file mode 100644 index f604d0ed09..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0902.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0903.gif b/docs/htmldocs/using_samba/figs/sam.0903.gif deleted file mode 100644 index 1013d45342..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0903.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0904.gif b/docs/htmldocs/using_samba/figs/sam.0904.gif deleted file mode 100644 index db13646f3d..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0904.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.0905.gif b/docs/htmldocs/using_samba/figs/sam.0905.gif deleted file mode 100644 index ef8c89bebb..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.0905.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.aa01.gif b/docs/htmldocs/using_samba/figs/sam.aa01.gif deleted file mode 100644 index 495b649cd0..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.aa01.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.ab01.gif b/docs/htmldocs/using_samba/figs/sam.ab01.gif deleted file mode 100644 index f737967505..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.ab01.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/figs/sam.ab02.gif b/docs/htmldocs/using_samba/figs/sam.ab02.gif deleted file mode 100644 index 6090cfd51d..0000000000 Binary files a/docs/htmldocs/using_samba/figs/sam.ab02.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/gifs/index.gif b/docs/htmldocs/using_samba/gifs/index.gif deleted file mode 100644 index b45dcd5851..0000000000 Binary files a/docs/htmldocs/using_samba/gifs/index.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/gifs/samba.s.gif b/docs/htmldocs/using_samba/gifs/samba.s.gif deleted file mode 100644 index 4984d0f8f3..0000000000 Binary files a/docs/htmldocs/using_samba/gifs/samba.s.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/gifs/txthome.gif b/docs/htmldocs/using_samba/gifs/txthome.gif deleted file mode 100644 index 5598a0ff93..0000000000 Binary files a/docs/htmldocs/using_samba/gifs/txthome.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/gifs/txtnexta.gif b/docs/htmldocs/using_samba/gifs/txtnexta.gif deleted file mode 100644 index b6d67311ad..0000000000 Binary files a/docs/htmldocs/using_samba/gifs/txtnexta.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/gifs/txtpreva.gif b/docs/htmldocs/using_samba/gifs/txtpreva.gif deleted file mode 100644 index 2b040b9b51..0000000000 Binary files a/docs/htmldocs/using_samba/gifs/txtpreva.gif and /dev/null differ diff --git a/docs/htmldocs/using_samba/index.html b/docs/htmldocs/using_samba/index.html deleted file mode 100644 index f1b4ccec6e..0000000000 --- a/docs/htmldocs/using_samba/index.html +++ /dev/null @@ -1,168 +0,0 @@ - - - - - -
    - - - - - -
    - - - - -

    Using Samba

    - -Robert Eckstein, David Collier-Brown, Peter Kelly
    -1st Edition November 1999
    -1-56592-449-5, Order Number: 4495
    -416 pages, $34.95 -     -

    -Buy the hardcopy version - -

    -
    - -
    - - -
    -
    -

    -Table of Contents

    -License Information

    -This Edition

    -Chapter 1: Learning the Samba
    -

    - Chapter 1.1: What is Samba?
    - Chapter 1.2: What Can Samba Do For Me?
    - Chapter 1.3: Getting Familiar with a SMB/CIFS Network
    - Chapter 1.4: Microsoft Implementations
    - Chapter 1.5: An Overview of the Samba Distribution
    - Chapter 1.6: How Can I Get Samba?
    - Chapter 1.7: What's New in Samba 2.0?
    - Chapter 1.8: And That's Not All...
    -
    -Chapter 2: Installing Samba on a Unix System
    -
    - Chapter 2.1: Downloading the Samba Distribution
    - Chapter 2.2: Configuring Samba
    - Chapter 2.3: Compiling and Installing Samba
    - Chapter 2.4: A Basic Samba Configuration File
    - Chapter 2.5: Starting the Samba Daemons
    - Chapter 2.6: Testing the Samba Daemons
    -
    -Chapter 3: Configuring Windows Clients
    -
    -Chapter 3.1: Setting Up Windows 95/98 Computers
    -Chapter 3.2: Setting Up Windows NT 4.0 Computers
    -Chapter 3.3: An Introduction to SMB/CIFS
    -
    -Chapter 4: Disk Shares
    -
    -Chapter 4.1: Learning the Samba Configuration File
    -Chapter 4.2: Special Sections
    -Chapter 4.3: Configuration File Options
    -Chapter 4.4: Server Configuration
    -Chapter 4.5: Disk Share Configuration
    -Chapter 4.6: Networking Options with Samba
    -Chapter 4.7: Virtual Servers
    -Chapter 4.8: Logging Configuration Options
    -
    -Chapter 5: Browsing and Advanced Disk Shares
    -
    -Chapter 5.1: Browsing
    -Chapter 5.2: Filesystem Differences
    -Chapter 5.3: File Permissions and Attributes on MS-DOS and Unix
    -Chapter 5.4: Name Mangling and Case
    -Chapter 5.5: Locks and Oplocks
    -
    -Chapter 6: Users, Security, and Domains
    -
    -Chapter 6.1: Users and Groups
    -Chapter 6.2: Controlling Access to Shares
    -Chapter 6.3: Authentication Security
    -Chapter 6.4: Passwords
    -Chapter 6.5: Windows Domains
    -Chapter 6.6: Logon Scripts
    -
    -Chapter 7: Printing and Name Resolution
    -
    -Chapter 7.1: Sending Print Jobs to Samba
    -Chapter 7.2: Printing to Windows Client Printers
    -Chapter 7.3: Name Resolution with Samba
    -
    -Chapter 8: Additional Samba Information
    -
    -Chapter 8.1: Supporting Programmers
    -Chapter 8.2: Magic Scripts
    -Chapter 8.3: Internationalization
    -Chapter 8.4: WinPopup Messages
    -Chapter 8.5: Recently Added Options
    -Chapter 8.6: Miscellaneous Options
    -Chapter 8.7: Backups with smbtar
    -
    -Chapter 9: Troubleshooting Samba
    -
    -Chapter 9.1: The Tool Bag
    -Chapter 9.2: The Fault Tree
    -Chapter 9.3: Extra Resources
    -
    - -Appendix A: Configuring Samba with SSL
    -
    -Appendix A.1: About Certificates
    -Appendix A.2: Requirements
    -Appendix A.3: Installing SSLeay
    -Appendix A.4: Setting Up SSL Proxy
    -Appendix A.5: SSL Configuration Options
    -
    -Appendix B: Samba Performance Tuning
    -
    -Appendix B.1: A Simple Benchmark
    -Appendix B.2: Samba Tuning
    -Appendix B.3: Sizing Samba Servers
    -
    -Appendix C: Samba Configuration Option Quick Reference
    -

    -Appendix D: Summary of Samba Daemons and Commands
    -

    -Appendix E: Downloading Samba with CVS
    -

    -Appendix F: Sample Configuration File
    -

    - -Index
    - -

    -
    - - - -
    -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - diff --git a/docs/htmldocs/using_samba/inx.html b/docs/htmldocs/using_samba/inx.html deleted file mode 100644 index 34207d7a74..0000000000 --- a/docs/htmldocs/using_samba/inx.html +++ /dev/null @@ -1,1344 +0,0 @@ - - -Using Samba - - - - - - - - - - - - - - -
    -

    Using Samba

    -

    Index

    - -
    -
    -[ A ], -[ B ], -[ C ], -[ D ], -[ E ], -[ F ], -[ G ], -[ H ], -[ I ], -[ J ], -[ K ], -[ L ], -[ M ], -[ N ], -[ O ], -[ P ], -[ Q ], -[ R ], -[ S ], -[ T ], -[ U ], -[ V ], -[ W ], -[ Y ], - - -
    <> (angled brackets), 14 -
    * (asterisk), 169 -
    \ (backslash) in smb.conf file, 85 -
    \\ (backslashes, two) in directories, 5 -
    : (colon), 6 -
    \ (continuation character), 85 -
    . (dot), 128, 134 -
    # (hash mark), 85 -
    % (percent sign), 86 -
    . (period), 128 -
    ? (question mark), 135 -
    ; (semicolon), 85 -
    / (slash character), 129, 134-135 -
    / (slash) in shares, 116 -
    _ (underscore) 116 -
    * wildcard, 177 - -

    A[ Top ] -
    access-control options (shares), 160-162 -
    accessing Samba server, 61 -
    accounts, 51-53 -
    active connections, option for, 244 -
    addresses, networking option for, 106 -
    addtosmbpass executable, 176 -
    admin users option, 161 -
    AFS files, support for, 35 -
    aliases -
          multiple, 29 -
          for NetBIOS names, 107 -
    alid users option, 161 -
    announce as option, 123 -
    announce version option, 123 -
    API (application programming interface), 9 -
    archive files, 137 -
    authentication, 19, 164-171 -
          mechanisms for, 35 -
          NT domain, 170 -
          share-level option for, 192 -
    auto services option, 124 -
    automounter, support for, 35 -
    awk script, 176 -

    B[ Top ] -
    backup browsers -
          local master browser, 22 -
          per local master browser, 23 -
          maximum number per workgroup, 22 -
    backup domain controllers (BDCs), 20 -
    backups, with smbtar program, 245-248 -
    backwards compatibility -
          elections and, 23 -
          for filenames, 143 -
          Windows domains and, 20 -
    base directory, 40 -
    .BAT scripts, 192 -
    BDCs (backup domain controllers), 20 -
    binary vs. source files, 32 -
    bind interfaces only option, 106 -
    bindings, 71 -
    Bindings tab, 60 -
    blocking locks option, 152 -
    b-node, 13 -
    boolean type, 90 -
    bottlenecks, 320-328 -
          reducing, 321-326 -
          types of, 320 -
    broadcast addresses, troubleshooting, 289 -
    broadcast registration, 13 -
    broadcast resolution, 13, 59 -
    broadcasting -
          troubleshooting with tcpdump utility, 255 -
          (see also browsing; name resolution) -
    browse lists, 21, 116 -
          options for, 124, 127 -
          propagation, 24 -
          restricting shares from, 115 -
    browsing, 21-23, 114-127 -
          client-side, testing with net view, 280 -
          configuration options for, 122-127 -
          elections, 23, 116-119 -
          machines, list of, 21 -
          options for, list of, 122 -
          preventing, 115 -
          resources of a specific machine, 21-23 -
          server from client, 281 -
          troubleshooting, 275-282 -
                with smbclient, 276-278 -
    bug avoidance options, 240-245 -
          list of, 240-241 -

    C[ Top ] -
    cache size, new option for (Samba version 2.0), 239 -
    cache time (printers), option for, 220 -
    capitalization, 84 -
    Carnegie Mellon University, 35 -
    carriage-returns for scripts, 193 -
    case sensitivity -
          hostnames and, 5 -
          options for, 146 -
          usernames and, 163 -
    CD-ROM with this book -
          Samba distribution, 28, 32 -
          testing tools, 28 -
    certificate authority, 300-303 -
    change notification, new option for (Samba version 2.0), 239 -
    change notify timeout option, 239 -
    Change Windows Password dialog box, 52 -
    changes at runtime, 85 -
    chat characters for passwords, 178 -
    CIFS (Common Internet File System), 3 -
          (see also SMB/CIFS protocol) -
    client code page option, 234 -
    client users (see users) -
    client variables, 86 -
    clients, testing with nmblookup program, 279 -
    .CMD scripts, 192 -
    code pages, 234 -
          multiple, 30 -
    coding system option, 235 -
    command string, SMB, 75 -
    commands for Samba, 366-377 -
    commas in values, 84 -
    comment option, 99 -
    comments in smb.conf (Samba configuration) file, 85 -
    compatibility, Samba with Windows NT, 30 -
    compilers, 33 -
    compiling Samba, 38-41 -
          in version 2.0, 29 -
    config file option, 91 -
    configuration files -
          for individual clients, 253 -
          machine-specific, 87 -
          sample of, 379-383 -
          smb.conf (Samba configuration) file (see smb.conf file) -
    configuration options -
          browsing, 122-127 -
          disk share, 97-100 -
          format of, 83 -
          list of, 329-356 -
          server, 94-96 -
    configuring disk shares, 96-100 -
    configuring DNS (Windows NT), 68 -
    configuring Samba, 34-38 -
          configuration file -
                creating, 41-45 -
                testing, 45 -
                (see also smb.conf (Samba configuration) file) -
          configure script -
                GNU, 34 -
                sample execution, 38 -
          options, 34-37 -
          performance tuning, 312-328 -
                benchmark for, 312, 314 -
                other options for, 319-328 -
          server, 93-96 -
          with SSL, 295-311 -
                requirements for, 296 -
    configuring TCP/IP networking protocol, 55, 66-71 -
    configuring Windows clients, 50-81 -
          Windows 95/98 computers, 50-63 -
          Windows NT 4.0 computers, 63-73 -
                basic configuration, 63-67 -
    configuring WINS address, 70 -
    connected systems, status of, 9 -
    connections -
          active, option for, 244 -
          current, list of, 370 -
          resources, connecting to, 81 -
          scripts for, 198 -
          SMB, 77 -
          testing, 259-263 -
          virtual, 78 -
    copy option, 92 -
    creation masks, 138 -
          option for, 140 -
    cryptography, private key, 35 -
    CVS (Concurrent Versions Systems), 378 -
    Cyclic Software, 378 -

    D[ Top ] -
    daemons, 82, 359-362 -
          killing, 48 -
          messages generated by, reading, 8 -
          stand-alone, 47 -
          starting, 46-48 -
          status report, 8 -
          testing, 49 -
                with testparm, 266 -
          troubleshooting, 264-268 -
          Unix, 2 -
          viewing, 8 -
          (see also smbd daemon; nmbd daemon) -
    data transfer protocol, 6 -
    datagram service, 10, 16-18 -
    deadtime option, 241 -
    debug files, 49 -
    debug level option, 251, 314 -
    debug timestamp option, 112 -
    default case option, 146 -
    default services, 115 -
          option for, 124 -
    defending hostnames, 12 -
    delays, troubleshooting, 287 -
    delete, 142 -
    delete readonly option, 139, 142 -
    delete veto files option, 135 -
    dfree command option, 241 -
    DFS, support for, 35 -
    DHCP (Dynamic Host Configuration Protocol), 57, 67 -
    dialup connection, 53 -
    Digital Pathworks clients, option for, 244 -
    directories -
          barring users from viewing contents, 130, 133 -
          installation, 40 -
          permissions, options for, 140 -
          for Samba startup file, 363 -
          target, 40 -
          working, option for, 134 -
    directory mask option, 138, 141 -
    disabling/enabling features, 34 -
    discussion archives for Samba, 293 -
    disk quotas, support for, 37 -
    disk shares, 4-7, 49, 82-113 -
          advanced, 114-154 -
          configuring, 96-100 -
          creating, 96 -
          maximum size of, option for, 242 -
          path option, 98 -
    disk sync, options for, 245 -
    DMB (domain master browser), 119-122 -
          option for, 126 -
          resource type, 24 -
    DNS Configuration tab, 57 -
    DNS (Domain Name System), 57 -
          configuring, 68 -
          as fallback for WINS address, 71 -
          names -
                NetBIOS names and, 14 -
                resource types and, 15 -
          option for, 228 -
          resources for further information, 293 -
          tab, 68 -
    dns proxy option, 228 -
    docs directory, 34 -
          test utilities, 254 -
    documentation for Samba, 291 -
          importance of reading, 34 -
    domain controllers, 20, 169 -
          for Windows 95/98, 18-20 -
    domain group map option, 191 -
    domain logons, 28, 184 -
          configuring Windows 95/98 for, 188 -
          configuring Windows NT 4.0 for, 189 -
          scripts for, 192-200 -
    domain logons option, 190 -
    domain master browser (see DMB) -
    domain master option, 126 -
    Domain Name System (see DNS) -
    domain user map option, 191 -
    domain-level security, 164, 169-171 -
    domains, 18-20 -
          adding Samba server to Windows NT domain, 171 -
          behavior vs. Windows workgroups, 20 -
          controllers (see domain controllers) -
          logons (see domain logons) -
          new option for password timeout (Samba version 2.0), 239 -
          roles in assumed by Samba, 26 -
          Windows, 18, 28, 184-192 -
                authentication, 170 -
                caution when selecting, 190 -
                support for, 28 -
    dont descend option, 133 -
    DOS file permissions and attributes, 135-143 -
    DOS-formatted carriage returns, 193 -
    downloads -
          Samba, 32 -
                obtained using CVS, 378 -
          tcpdump utility, 78, 257 -
    drive letters, mapping, 5 -
    dynamically linked libraries, 33 -

    E[ Top ] -
    elections, 23 -
          operating system values in, 117 -
          order of decisions in, 118 -
          role settings in, 117 -
          WINS servers and, 26 -
    enabling/disabling features, 34 -
    encrypt passwords option, 181 -
    encrypted passwords, 172 -
          Microsoft format, 183 -
          option for, 181 -
          vs. plaintext passwords, 173 -
    Entire Network icon, 4 -
    enumerated lists, 91 -
    errors -
          searching for, 38 -
          syntax, 45 -
    /etc/hosts file, 57, 60 -
    /etc/inetd.conf configuration files, 48 -
          adding SWAT tool to, 41 -
    /etc/resolv.conf file, 57 -
    /etc/services configuration file, adding SWAT tool to, 41, 48 -
    Ethernet adaptor cards, 53, 70 -
          linking to TCP/IP networking protocol, 55 -
    execute permissions, 47 -
    /export/samba/test directory, 42 -

    F[ Top ] -
    fake directory create times option, 232 -
    fake oplocks option, 153 -
    FAQ, Samba, 291 -
    fast locking, 36 -
    fatal error, option for, 244 -
    fault tree, 257-291 -
          how to use, 257 -
    "File and Printer Sharing for Microsoft Networks", 53, 60, 246 -
    file creation masks, 138 -
    filenames -
          8.3 format, 143 -
          limitations on, 143 -
          representing/resolving, 145 -
          Unix, option for, 245 -
    files -
          archive, 137 -
          attributes, 135-143 -
          deleting, option for, 129 -
          hidden, 128, 136 -
                options for, 134 -
          open, option for maximum number of, 243 -
          permissions, 135-143 -
                options for, 140 -
          read-only, 136 -
                deleting, 139, 142 -
          system, 136 -
          in use, status of, 9 -
          veto, 129-131 -
                option for deleting, 135 -
    filesystems -
          differences between, 127-131 -
          links and, 130 -
          options for, 132-135 -
          reporting on by Samba, option for, 242 -
          (see also files) -
    fixed user configuration, 196 -
    flat namespaces, 14, 25 -
    follow symlinks option, 133 -
    force create mode option, 141 -
    force directory mode option, 141 -
    force group option, 139, 141 -
    force user option, 139, 141 -
    foreign-language characters, 234-236 -
    free space on disk, option for, 241 -
    fstype option, 242 -
    FTP (File Transfer Protocol), 6 -
          sites for Samba downloads, 32 -

    G[ Top ] -
    gateway field, 68 -
    getwd cache option, 134, 320 -
    global options, 90 -
    [globals] section, 88 -
    GNU autoconf, 29 -
    GNU configure script, 34 -
    GNU General Public License (GPL), 3, 378 -
    groups, 155-158 -
          administrative privileges for, 159 -
          names and types of, 15 -
    guest, 162 -
    guest access, 159-162 -
    guest account option, 162 -
    guest ok option, 98 -
    guest only option, 162 -

    H[ Top ] -
    hangup (HUP) signal, 48 -
    header, SMB, 74 -
    Hexidecimal byte value -
          for NetBIOS group resource types, 16 -
          for NetBIOS unique resource types, 15 -
    hidden files, 128, 136 -
          options for, 134, 142, 319 -
    h-node, 13 -
    home directory, user's, 36, 155 -
          logon script option for location of, 198 -
    homedir map option, 200 -
    [homes] share, 89, 157 -
    hort preserve case option, 147 -
    hostnames -
          case sensitivity and, 5 -
          troubleshooting -
                long/short, 286 -
                lookup, 284 -
    hosts -
          files (Windows 95/98), 59 -
          files (Windows NT computers), 71 -
          networking option for connections, 101, 103, 105 -
          subnets and, caution with, 102 -
    hosts allow option, 103 -
    hosts deny option, 105 -
    hosts equiv option, 184 -
    how-tos, fault tree, 257-291 -
    http, 6 -
    HUP (hangup) signal, 48 -

    I[ Top ] -
    Identification Changes dialog box (Windows NT), 63 -
    Identification tab, 60 -
    implementations, Microsoft, 18-27 -
    include option, 92 -
    inetd daemon, starting other daemons from, 48 -
    installing Samba, 31-49 -
          common problems, 34 -
          installation directories, 40 -
          steps in, 31 -
                final, 41 -
          time required, 31 -
    installing TCP/IP protocol, 65 -
    installing Workstation service, 65 -
    interfaces, networking options for, 102 -
    interfaces option, 105 -
    internationalization, 234-236 -
    invalid users option, 161 -
    IP address, 288-290 -
          setting for Windows NT computers, 67 -
    IP Address tab -
          Windows 95/98, 57 -
          Windows NT, 67 -
    IP packet size, tuning, 316 -

    J[ Top ] -
    Jacobson, Van, 255 -

    K[ Top ] -
    keep-alive packets, option for, 242 -
    Kerberos, support for, 35 -
    kernel oplocks option, 153 -

    L[ Top ] -
    languages, non-European, 30 -
    LDAP (Lightweight Directory Access Protocol) -
          replacement for password synchronization, 179 -
          support for, 36 -
    ldd tool, 33 -
    legal agreements covering multi-user functionality, 6 -
    Leres, Craig, 255 -
    Lightweight Directory Access Protocol (see LDAP) -
    line continuation, 85 -
    links, 130 -
          option for, 133 -
    Linux -
          installing Samba on Linux system, 31 -
          submount and, 36 -
    lm announce option, 125 -
    lm interval option, 125 -
    LMHOSTS file, 224 -
    load printers option, 222 -
    local group map option, 192 -
    local master browser, 21, 116-122 -
          checking machines for, 118 -
          option for, 125 -
    local master option, 125 -
    local profiles, 194 -
    localhost -
          address, 69 -
          troubleshooting, 288 -
    localization, 234-236 -
    lock directory option, 154 -
    locking option, 152 -
    locks/locking files, 9, 149-154 -
          messaging option for, 237 -
          opportunistic locking, 29 -
                tuning of, 316 -
                (see also oplocks) -
          options for, 151-154 -
          Unix and, 150 -
    log files/logging -
          activating/deactivating, 253 -
          checking, 108-113 -
          configuration options, 108-113 -
          in for the first time (Samba), 52 -
          levels of -
                setting, 251-253 -
                tuning, 314 -
          options for, 199 -
          troubleshooting, 282 -
          troubleshooting from, 251-254 -
    log level option, 112, 251, 314 -
    login dialog box, domain logons -
          Windows 95/98, 188 -
          Windows NT, 190 -
    login parameters, setting, 79 -
    logon drive option, 197 -
    logon home option, 198 -
    logon path option, 197 -
    logon script option, 197 -
    logon scripts, 192-200 -
          options for, 196-198 -
    logons (see domain logons) -
    lppause command option, 221 -
    lpq cache time option, 220, 319 -
    lpq command option, 221 -
    lpresume command option, 221 -
    lprm command option, 221 -

    M[ Top ] -
    machine name, types, 15 -
    machine password timeout option, 239 -
    magic output option, 233 -
    magic script option, 233 -
    magic scripts, 233 -
    mailing lists -
          posting to, 39 -
          for Samba, 292 -
    main tree, 40 -
    makefiles, 33-34 -
    mandatory profiles, 196 -
    mangle case option, 148 -
    mangled map option, 148 -
    mangled names option, 147 -
    mangled stack option, 148 -
    mangling char option, 148 -
    map archive option, 142 -
    map hidden option, 142 -
    Map Network Drive option, 5, 62 -
    map system option, 142 -
    mapping -
          files, options for location of, 191 -
          network drives, 5 -
    masks -
          creation, 138 -
          netmasks, 57 -
          subnet, 57, 67 -
          umasks, 138 -
    master browsers (see local master browser; DMB; preferred master browser) -
    max connections option, 161 -
    max disk size option, 242 -
    max log size option, 112 -
    max mux option, 243 -
    max open files option, 243 -
    max ttl option, 229 -
    max wins ttl option, 229 -
    max xmit option, 243, 317 -
    Maximum Transport Unit (MTU), 316 -
    McCanne, Steven, 255 -
    measurement forms, 326 -
    memory, status of, 9 -
    message command option, 238 -
    messages -
          from daemons, reading, 8 -
          WinPopup, 237 -
    Microsoft, 3 -
          encryption, 30 -
          implementations, 18-27 -
    Microsoft Networking Client, 65 -
    min print space option, 223 -
    min wins ttl option, 229 -
    mirror sites for Samba distribution, 28 -
    MIT, 35 -
    mmap code, 36 -
    m-node, 13 -
    modem, linking to TCP/IP networking protocol, 55 -
    MTU (Maximum Transport Unit), 316 -
    multiple code pages, 30 -
    multiple subnets, 120 -
    multi-user functionality, legal agreements and, 6 -
    My Computer (Windows 95/98), 51 -

    N[ Top ] -
    name mangling, 143-149 -
          options for, 145-149 -
          steps in, 143 -
    name registration, 10 -
    name resolution, 11, 60, 224-229 -
          options for, 227-229 -
    name resolve order option, 229 -
    name services, 10 -
          identifying what is in use, 283 -
          nmblookup program, 372 -
          testing, 258 -
          troubleshooting, 282-288 -
    naming -
          machine name, types, 15 -
          machines on NetBIOS network, 10-13 -
          NT computers, 63 -
                caution with, 64 -
          TCP/IP networking protocol, setting machine name for, 60 -
    NBNS (see NetBIOS, name server) -
    NBT standard, 10 -
    NBTSTAT utility, 15 -
    Netatalk (Macintosh), support for interoperating with, 37 -
    NetBEUI (NetBIOS Extended User Interface), 10, 53 -
          Windows NT computers and, 65 -
    netbios aliases option, 107 -
    NetBIOS name, 14-16 -
          option for aliases, 107 -
          setting -
                Windows 95/98, 61 -
                Windows NT, 63 -
          troubleshooting, 290 -
    netbios name option, 95 -
    NetBIOS (Network Basic Input/Output System), 9 -
          compared with TCP/IP, 10 -
          Extended User Interface (see NetBEUI) -
          multiple servers (see virtual servers) -
          name (see NetBIOS name) -
          name server (NBNS), 11, 25, 58 -
          network, naming machines on, 10-13 -
          over TCP/IP, 10 -
          Unique Resource Types, 15 -
    netmasks, 57, 67 -
          troubleshooting, 288 -
    network addresses -
          finding, 290 -
          troubleshooting, 288-290 -
    Network Basic Input/Output System (see NetBIOS) -
    network configuration commands, 192 -
    Network dialog box (Windows NT), 63 -
    network drives, mapping, 5 -
    Network File System -
          resources for further information, 293 -
    Network File System (NFS), 30 -
    Network icon -
          Windows 95/98, 53 -
          Windows NT, 63 -
    network masks (see netmasks) -
    Network Neighborhood icon, 61, 93 -
          viewing Samba server, 72 -
    Network Neighborhood window, 21-22 -
          mapping network drives via, 5 -
    networking -
          hardware for, testing, 259 -
          network address ranges, 289 -
          nmblookup program, testing with, 279 -
          options, 101-106 -
                list of, 103 -
                magic script, 233 -
          printing on a network, steps in, 201 -
          setting up, 53-60 -
    newsgroups for Samba, 291 -
    NFS (Network File System), 30 -
          resources for further information, 293 -
    nis homedir option, 200 -
    NIS/NIS+ protocol, 36, 169 -
          how Samba works with, 199 -
          resources for further information, 293 -
    nmbd daemon, 2, 29, 82, 85, 361-362 -
          browsing options for, 125 -
          killing, 48 -
          starting, 46 -
    nmblookup program, 372 -
          networks, testing with, 279 -
    node types, 13 -
    non-encrypted passwords, 172 -
    non-European languages, 30 -
    Novell Networking, 53 -
    nt pipe support option, 243 -
    nt smb support option, 243 -
    null passwords, 183 -
    null TID, 74 -
    numerical type, 90 -

    O[ Top ] -
    .old files, 39 -
    ole locking compatibility option, 244 -
    Open Source Software (OSS), 3 -
    operating systems -
          encrypted/non-encrypted passwords, 172 -
          miscellaneous options for, 240 -
          values in elections, 117 -
    oplock files option, 316 -
    oplocks, 149-154 -
          break requests, 149 -
          messaging option for, 237 -
          options for, 151-154 -
    oplocks option, 153 -
    opportunistic locking, 29 -
          tuning, 316 -
          (see also oplocks) -
    option names, 84 -
    os filetime resolution option, 232 -
    os level option, 126 -
    OS/2, support for share-level security, 165 -
    OSF/1 (Digital Unix), 35 -

    P[ Top ] -
    packets -
          headers for, tcpdump utility and, 376 -
          maximum size of, option for, 243 -
    PAM (pluggable authentication modules), 179 -
          support for, 36 -
    panic action option, 244 -
    passwd chat debug option, 182 -
    passwd chat option, 182 -
    passwd program option, 182 -
    password file, security and, 53 -
    password level option, 182 -
    Password settings (Windows 95/98), 51 -
    passwords, 171-184 -
          chat characters for, 178 -
          encrypted -
                changing, 176 -
                disabling on Windows computers, 173 -
                vs. non-encrypted, 172, 173 -
          null, 183 -
          options for, 180-184 -
                share-level, 192 -
          passwd program, 182 -
          smbpasswd program, 374 -
          stored by Samba, 172 -
          synchronizing, 176-179 -
          user-level security and, 168 -
          Windows 95/98, 51-53 -
                changing, 52 -
    pathnames -
          option for, 98 -
          printer configuration and, 207 -
    paths, architecture-specific, 86 -
    pdate encrypted option, 183 -
    PDC (primary domain controller), 20 -
          domain master browser and, 119 -
          domain option for, 190 -
          domain-level security and, 164 -
    PDC (continued) -
          Samba 2.1 and, 186 -
          Samba, setting up as, 184 -
          sever-level security and, 168 -
          trust accounts and, 186 -
    performance, 29 -
    performance tuning, 312-328 -
          benchmark for, 312, 314 -
          other options for, 319-328 -
          recommended enhancements, 320 -
    permissions, 207 -
          options for, 140-143 -
          for printing, 207 -
    plaintext passwords, 173 -
    pluggable authentication modules (PAM), 36, 179 -
    p-node, 13 -
    point-to-point communication, 13 -
    point-to-point registration/resolution, 13 -
    port not telnet option, 257 -
    postexec option, 199 -
    postscript option, 221 -
    preexec option, 199 -
    preferred master browser, 119 -
    preferred master option, 126 -
    preserve case option, 147 -
    preventing browsing, 115 -
    primary domain controller (see PDC) -
    primary WINS server, 26 -
    print command option, 221 -
    print queue, options for, 223 -
    print shares, 7-9, 89-90, 204-205 -
          created by Samba, 205 -
          options for, 222 -
          path option, 98 -
          setting up on Windows client, 7 -
    printable option, 219 -
    printcap name option, 223 -
    printer capabilities file, 89 -
    printer driver file option, 219 -
    printer driver location option, 220 -
    printer driver option, 219 -
    printer option, 219 -
    PRINTER$ share, creating, 212 -
    printers -
          BSD, 215 -
          names -
                caution with, 205 -
                checking, 375 -
          option for, 219-221 -
          sharing (see print shares) -
          System V, 216 -
    printing, 201-224 -
          commands, 202 -
                default commands for, 221 -
          configuration, minimal, 203-205 -
          configuration options, 203-207 -
          drivers for, setting up, 210-213 -
          on a network, steps in, 201 -
          options for, 217-224 -
          pathnames used in commands for, 207 -
          permissions for, 207 -
          print jobs, 204 -
                spooling with smbprint tool, 213 -
          printer definition file, 211 -
          resources for information on debugging, 208 -
          through Samba, 201-213 -
          test for, 206 -
          types, 218 -
          variables for, 203 -
          Windows client printers -
                printing to, 213-224 -
                setting up and testing, 208 -
    printing configuration option, 218 -
    private directory (Samba distribution), 172 -
    private key cryptography, 35 -
    privileges, option for, 199 -
    processes (see daemons) -
    profiles, 194 -
          creating, 53 -
          local, 194 -
          mandatory, 196 -
          roaming, 194-196 -
                option for location of, 197 -
    programmers, support for, 230-233 -
    propagation, browse list, 24 -
    Properties button (Windows 95/98), 55 -
    protocols -
          routed through a hardware device, 53 -
          variant, negotiating, 78 -
    Protocols tab, 65-66 -

    Q[ Top ] -
    queuepause command option, 223 -
    queueresume command option, 223 -
    quotation marks in values, 84 -

    R[ Top ] -
    rc.local file, 47 -
    read list option, 161 -
    read only option, 100 -
    read prediction, testing, 318 -
    read raw, tuning, 315 -
    read size, tuning, 318 -
    reading documentation, importance of, 34 -
    read-only files, 136 -
          deleting, 139, 142 -
    read-only partitions, 40 -
    read-only/read-write access, 159 -
    remote announce option, 127 -
    remote browse sync option, 127 -
    remote procedure call (RPC), 376 -
    representing/resolving filenames, 145 -
    resource names, 14 -
    resource types, 14 -
          for primary domain controller vs. domain master browser, 24 -
    resources, connecting to, 81 -
    resources for further information, 291-293 -
          group attributes, 16 -
          NFS (Network File System), 293 -
          printers, debugging, 208 -
          Samba, 32 -
          Solaris servers, 321 -
          Windows network configuration commands, 192 -
    revalidation of users, 192 -
    roaming profiles, 194-196 -
          option for location of, 197 -
    role settings in elections, 117 -
    root postexec option, 199 -
    root preexec option, 198 -
    root user, 37, 199 -
          access, 159 -
    routers, TCP/IP configuring and, 68 -
    RPC (remote procedure call), 376 -
    rpcclient program, 376 -

    S[ Top ] -
    SAM (security account manager), 19, 169 -
    Samba, 1-9 -
          compatibility with Windows NT, 30 -
          compiling (see compiling Samba) -
          configuring (see configuring Samba) -
          daemons (see daemons) -
          distribution, xi, 28, 32 -
          documentation, importance of reading, 34 -
          downloading, 32-34 -
                with CVS, 378 -
          features/uses, x -
          installing (see installing Samba) -
          logging in for the first time, 52 -
          Microsoft encryption and, 30 -
          new features file, 34 -
          origin of name, 2 -
          performance tuning, 312-328 -
                benchmark for, 312, 314 -
                other options for, 319-328 -
          reasons for using, 3 -
          resources for further information, 291-293 -
          roles in Windows domains/workgroups, 26 -
          startup file, 363 -
          test utilities, 254-257 -
          version 2.0, 20, 28 -
                character sets, 235 -
                code pages for, 234 -
                coding system parameters, 235 -
                new options, 238 -
          version 2.0.5, xi, 28 -
          version 2.1, 20 -
                PDC functionality and, 186 -
          web site, 32, 291 -
          WINS server and, 225 -
    Samba server -
          accessing, 61 -
          connecting to, 71 -
          resources offered, 72 -
          sizing, 320-328 -
          viewing via Network Neighborhood icon, 72 -
    Samba Web Administration Tool (see SWAT tool) -
    scripts -
          connection, 198 -
          logon, 192-200 -
          magic, 233 -
          for Samba startup file, 363 -
    secondary WINS server, 26 -
    sections of smb.conf (Samba configuration) file, 83 -
    Secure Sockets Layer protocol (see SSL) -
    security, 35, 164-171 -
          domain-level, 169-171 -
          levels of, 164 -
    security (continued) -
          options for, 164 -
          restricting access to shares, 158-163 -
          server-level, 168 -
          share-level, 164-167 -
                options for, 167 -
          user-level, 167 -
    security account manager (SAM), 19, 169 -
    Select Network Protocol dialog box, 65 -
    server configuration options, 94-96 -
    Server Message Block (see SMB) -
    server string parameter, 95 -
    server-level security, 168 -
    servers -
          active, list of, 116 -
          testing with nmblookup program, 278 -
          virtual, 106-108 -
                options for, 107 -
    service bindings, 71 -
    services, 83 -
          list of enabled on machine, 45 -
          performed by Samba, 2 -
          testing low-level, 257-263 -
          Workstation, 65 -
          (see also shares) -
    Services tab, 65 -
    session layer, connection at, 78 -
    session parameters, setting, 79 -
    session service, 10, 16-18 -
    set directory option, 244 -
    share modes, 151 -
    share options, 90 -
    shared directory/resources (see shares) -
    shared resources (see shares) -
    share-level security, 164-167 -
          options for, 167 -
          printing and guest accounts, 204 -
          steps in taken by Samba, 165 -
    shares, 30, 83 -
          access to -
                controlling, 158-163 -
                creating for groups, 157 -
                by foreign hosts, option for, 184 -
          contents, restricting view of, 115 -
          default, 115 -
          file, path option for, 98 -
          [globals] section, 88 -
          option for identifying users allowed access to, 168 -
          viewing (see browsing) -
    sharing -
          disks (see disk shares) -
          printers (see print shares) -
    Sharpe, Richard, 74 -
    SIGHUP signal, 85 -
    sizing Samba servers, 320-328 -
    smb passwd file option, 183 -
    SMB (Server Message Block), 2, 74-81 -
          command string, 75 -
          commercial products for, 77 -
          deny-mode locks, 151 -
          format of, 74 -
          header, 75 -
          magic scripts, 233 -
          making a simple connection, 77 -
          maximum number of operations, option for, 243 -
          networks, 4 -
                usernames and, 162 -
          option for NT-specific options, 243 -
          password server, 168 -
          resources for further information, 74 -
          seamless operation across networks, 30 -
          troubleshooting connections, 268-275 -
                testing locally, 268 -
                testing with NET USE, 271-274 -
                testing with smbclient, 270 -
                testing with Windows Explorer, 274-275 -
          wrapper support, 34 -
    SMB/CIFS protocol, 3 -
          filesystems, 34 -
          network and, 9-18 -
    smbclient program, 49, 364-370 -
    smb.conf (Samba configuration) file, 8, 41, 63, 82-93 -
          configuring printers, 203 -
          creating, 93 -
                for each client, 253 -
          example of, 82 -
          modifying for printer drivers, 212 -
          options for, 90-93 -
                format of, 83 -
                supporting programmers, 230-232 -
          special sections of, 88-91 -
          structure of, 83-86 -
          testparm program for, 375 -
          variables for, 86-88 -
    smbd daemon, 2, 82, 359-360 -
          file, 47 -
          killing, 48 -
          starting, 46 -
    smbd server, checking with telnet, 266 -
    smbmount, support for, 36 -
    smbpasswd file, 172, 174-176 -
          adding entries to, 175 -
          caution with, 173-174 -
          option for location of, 183 -
    smbpasswd program, 171, 374 -
          changing passwords with, 176 -
    smbprint tool, spooling print jobs, 213 -
    smbrun option, 244 -
    smbsh program, 364 -
    smbstatus program, 8, 370 -
    smbtar program, 245-248 -
          tar operations and, 371 -
    smbwrapper client, 30 -
    smbwrapper package, 35 -
    socket address option, 106 -
    socket options configuration options, 314 -
    software distribution (see Samba, distribution) -
    source vs. binary files, 32 -
    spaces in values, 84 -
    special sections, smb.conf (Samba configuration) file, 88-91 -
    spelling, caution with, 61 -
    spool space, options for, 223 -
    square brackets, 83 -
    ssl CA certDir option, 308 -
    ssl CA certFile option, 308 -
    ssl ciphers option, 310 -
    ssl client cert option, 309 -
    ssl client key option, 309 -
    ssl compatibility option, 311 -
    ssl hosts option, 307 -
    ssl hosts resign option, 307 -
    ssl option, 307 -
    ssl require clientcert option, 309 -
    ssl require servercert option, 310 -
    SSL (Secure Sockets Layer) protocol, 30 -
          configuration options for, 306-311 -
          configuring Samba to use, 300 -
          configuring Samba with, 295-311 -
          SS Proxy, 296 -
                setting up, 304 -
          SSLeay, 296-304 -
          support for, 34, 36 -
    ssl server cert option, 308 -
    ssl server key option, 308 -
    ssl version option, 310 -
    stand-alone daemons, 47 -
    stat cache option, 239 -
    stat cache size option, 239 -
    status option, 244 -
    status report on Samba, 8 -
    strict locking option, 152, 319 -
    strict sync option, 245, 319 -
    string types, 90 -
    strip dot option, 245 -
    subnets, 12 -
          hosts and, caution with, 102 -
          mask, 57, 67 -
          multiple spanned by Windows workgroups, 24 -
          Windows NT workstations and, 24 -
    superuser (see root user) -
    SWAT tool, 29 -
          adding to configuration files, 41 -
          creating configuration file with, 42 -
    sync always option, 245, 319 -
    synchronizing -
          passwords, 176-179 -
          time, options for, 231 -
    syntax errors, 45 -
    syslog only option, 113 -
    syslog option, 113 -
    SYSLOG utility, 110 -
          support for, 36 -
    system administrator, WINS server and, 26 -
    system files, 136 -
    System V Unix, 47 -
          printer configuration for, 203 -

    T[ Top ] -
    tar operations, 371 -
    tcpdump utility, 78, 255-257, 376 -
          passwords, reading, 172 -
    TCP/IP networking protocol, 9 -
          adding/configuring, 54 -
          checking setup, 53 -
          compared with NetBIOS, 10 -
          configuring, 66-71 -
          installing, 65 -
          NetBIOS over, 10 -
          receive window, tuning, 317 -
          resources for further information, 293 -
          TCP, troubleshooting, 263 -
    TCP/IP Properties panel (Windows 95/98), 55 -
    test parser, 45 -
    test share, 42 -
    testing -
          configuration file, 45 -
          daemons, 49 -
          Samba, 41-46 -
          smbclient program, 364-370 -
          test utilities for Samba, 254-257 -
          tools for (CD-ROM with this book), 28 -
    testparm program, 375 -
    testparm test parser, 45 -
    testprns program, 375 -
    TID (tree identifier), 74, 78, 80 -
    time server option, 231 -
    time synchronization, options for, 231 -
    time to live (TTL), options for, 229 -
    timestamp logs option, 112 -
    trace utility, 254 -
    trailing dot, option for, 245 -
    tree identifier (TID), 74, 78, 80 -
    Tridgell, Andrew, 2, 255 -
    troubleshooting, 250-291 -
          information to have on hand, 257 -
          network addresses, 288-290 -
          where to start, 250 -
    trust accounts, creating, 186 -
    TTL (time to live), options for, 229 -
    tuning (see performance tuning) -

    U[ Top ] -
    umasks, 138 -
    uniform resource locators (URLs), 6 -
    Universal Naming Convention (UNC), 5 -
    Unix -
          carriage returns, 193 -
          daemons, 2 -
          file permissions and attributes, 135-143 -
          filenames, option for, 245 -
          locks and, 150 -
          networks, usernames and, 162 -
          options -
                for messaging, 237 -
                miscellaneous, 240 -
                for print commands, 221 -
                for system logger, 113 -
          password files, 169 -
          permissions, share write access and, 159 -
          servers, backing up computers from, 246 -
          System V, 47 -
                printer configuration for, 203 -
                printing and, 29 -
          troubleshooting utilities, 254 -
          user classifications, 135 -
    unix password sync option, 180 -
    unix realname option, 133 -
    URLs (uniform resource locators), 6 -
          distribution, 28 -
          Kerberos, 35 -
          Samba, 28, 32 -
                distribution, xi -
                web site, 291 -
          SMB (Server Message Block), 74 -
    use rhosts option, 184 -
    user profiles (Windows 95/98), 50 -
    user variables, 86 -
    user-level security, 164, 167 -
    username level option, 163 -
    username map option, 162 -
    username option, 167 -
    usernames -
          case sensitivity and, 163 -
          options for, 162-163 -
          SMB vs. Unix networks, 162 -
          Windows 95/98, 51-53 -
    users, 155-158 -
          allowing superuser (root) access to, 159 -
          creating, 89 -
          domain, semi-automatic deletion, 171 -
          home directory, 36 -
                logon script option for location of, 198 -
          invalid, specifying, 158 -
          read-only/read-write access, 159 -
          setting up, 155 -
          share-level option for authentication of, 192 -
          shares for, setting up, 157 -
    /usr/local/samba file, 40 -
    /usr/local/samba/var/log.smb file, 49 -

    V[ Top ] -
    valid chars option, 236 -
    variables, 86-88 -
    veto files, 129-131 -
          option for deleting, 135 -
    veto files option, 134 -
    veto oplock files option, 154 -
    viewing daemons, 8 -
    virtual connection, 78 -
    virtual hosts, 29 -
    virtual servers, 106-108 -
          options for, 107 -
    volume option, 100 -

    W[ Top ] -
    Whistle, 3 -
    whitespaces in values, 84 -
    wide links option, 134, 319 -
    Windows 95/98 -
          domain controllers for, 18-20 -
          domain logons, configuring, 185 -
          domains, 184-192 -
          miscellaneous options for, 240 -
          multiple users, support for, 50 -
          passwords, encrypted, 172 -
          printer drivers, installing, 210 -
          share-level security, support for, 165 -
          WinPopup tool, 237 -
    Windows clients -
          configuring, 50-81 -
                Windows NT 4.0 computers, 63-73 -
                Windows95/98 computers, 50-63 -
          individual configuration files for, 253 -
          printers for, setting up and testing, 208 -
          role settings in elections, 117 -
    Windows Explorer, Map Network Drive option, 5 -
    Windows Internet Name Service (see WINS) -
    Windows NT -
          client/server and, 77 -
          configuring domain logons, 186 -
          domains, 18, 28, 184-192 -
                caution when selecting, 190 -
          IP address, setting, 67 -
          naming, caution with, 63 -
          passwords -
                encrypted, 172 -
                new option for timeout (Samba version 2.0), 239 -
          pipes, option for, 243 -
          server, domain master browser and, 119 -
          SMB, option for, 243 -
          user authentication and, 186 -
          WINS address and, 70 -
    Windows NT Server 4.0, 65 -
    Windows NT Server Manager for Domains tool, 171 -
    Windows NT Workstation 4.0, 65 -
    Windows UNC format, 62 -
    Windows workgroups (see workgroups, Windows) -
    WINDOWSHOSTS directory, 71 -
    WinPopup tool, 237 -
    WINS Address tab (Windows NT panel), 70 -
    WINS Configuration tab, 58 -
    wins proxy option, 228 -
    wins server option, 228 -
    wins support option, 228 -
    WINS (Windows Internet Name Service), 2, 25, 58 -
          address, configuring, 70 -
          name resolution and, 224 -
          options for, 228 -
          server, 44 -
                configuring Windows domain logons and, 185 -
          servers, 25, 59 -
          Windows operating systems and, 26 -
          WINS server -
                primary/secondary, 26 -
    WINS (Windows Internet Name Service) server -
          setting up Samba as, 226 -
          setting up Sambato use, 225 -
    Wong, Brian, 321 -
    workgroup parameter, 96 -
    workgroups, 4 -
          roles in assumed by Samba, 26 -
          setting, 60 -
          Windows -
                behaviors vs. Windows domain, 20 -
                spanning multiple subnets, 24 -
    working directory, option for, 134 -
    Workstation service, installing, 65 -
    wrapper support for SMB (Server Message Block), 34 -
    write ahead, tuning, 318 -
    write list option, 161 -
    write privileges, 40 -
    write raw, tuning, 315 -
    write size, tuning, 317 -
    writeable/write ok option, 100 -

    Y[ Top ] - -

    -
    - -

    -

    -

    -Using Samba Table of Contents -

    -

    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    -
    - - diff --git a/docs/htmldocs/using_samba/licenseinfo.html b/docs/htmldocs/using_samba/licenseinfo.html deleted file mode 100644 index 7e8962a832..0000000000 --- a/docs/htmldocs/using_samba/licenseinfo.html +++ /dev/null @@ -1,181 +0,0 @@ - - -License Info - - - - - - - - -
    - - -
    -

    Using Samba

    - -By Robert Eckstein, David Collier-Brown & Peter Kelly -
    1st Edition October 1999 (est.) -
    1-56592-449-5, Order Number: 4495 -
    424 pages (est.), $34.95 (est.) -     -
    -
    - -

    License Info

    -

    "Using Samba" may be freely reproduced and distributed in any -form, in any medium physical or electronic, in whole or in -part, provided that the terms of this license are adhered to -and that the reproduction includes this license or a reference -to it. For a complete reproduction of the book, the reference -should read: -

    - Copyright (c) 1999 by O'Reilly & Associates. This book, - Using Samba, first edition, was written by Robert Eckstein, - David Collier-Brown, and Peter Kelly, and published by - O'Reilly & Associates. This material may be distributed only - subject to the terms and conditions set forth in the - license, which is presently available at - - http://www.oreilly.com/catalog/samba/licenseinfo.html. -
    -

    -For an excerpt, the reference should read: -

    - Copyright (c) 1999 by O'Reilly & Associates. This material - was taken from the book Using Samba, first edition, written - by Robert Eckstein, David Collier-Brown, and Peter Kelly, - and published by O'Reilly & Associates. This material may be - distributed only subject to the terms and conditions set - forth in the license, which is presently available at - - http://www.oreilly.com/catalog/samba/licenseinfo.html. -
    -

    -Translations must contain similar references in the target -language. A sample model for a reference in a translation is -the following: -

    - Copyright (c) 1999 by [whoever owns the translation]. This - is a translation of Using Samba, first edition, written by - Robert Eckstein, David Collier-Brown, and Peter Kelly, and - published by O'Reilly & Associates. This material may be - distributed only subject to the terms and conditions set - forth in the license, which is presently available at - - http://www.oreilly.com/catalog/samba/licenseinfo.html. -
    -

    -Both commercial and noncommercial redistribution of material -from this book is permitted, but the following restrictions -apply. -

      -
    1. All copies of any version, including derivative works, must - display a prominent notice indicating the original authors - of the book and that it was originally developed by - O'Reilly & Associates. Any publication as a physical - (paper) book shall show the names of the authors and - O'Reilly & Associates on the outer surface. - -
    2. Any changes made must be shared as described below. - -
    3. No translation can be distributed publicly in print form - without approval from O'Reilly & Associates. Any - translation, by O'Reilly & Associates or another party, - falls under the same conditions as the original version. -
    -

    -MODIFIED VERSIONS. Distribution of any modified version must -include a prominent notice describing the modifications that -have been made, and must provide a URL or other sufficient -information concerning how to obtain the original work. -O'Reilly & Associates and the Samba Team are not responsible -for the accuracy of any modifications not incorporated into -their originally distributed version. The names of the -original authors, O'Reilly & Associates, or the Samba team may -not be used to assert or imply endorsement of the resulting -document unless permission is obtained in advance. Anyone who -distributes a version of the book with changes to text, -figures, or any other element must provide the changed version -in a standard source format to both O'Reilly and the Samba -team, and must provide them under the same terms as the -original book. -

    -Mere aggregation of this work, or a portion of the work, with -other works or programs on the same media shall not cause this -license to apply to those other works. The aggregate work -shall contain this license and a notice specifying the -inclusion of this material. -

    -The copyright will stay in O'Reilly's hands, unless O'Reilly stops -printing the book. However, the book will be maintained by -the Samba team. Any changes made by O'Reilly will be given to -the team, and vice versa. -

    -TRANSLATIONS. In the case of translations, O'Reilly will -choose when to update and reprint printed versions. If -O'Reilly lets the translation go out of print for more than 6 -months, the copyright and all other rights go to the Samba -team. -

    -SEVERABILITY. If any part of this license is found to be -unenforceable in any jurisdiction, the remaining portions of -the license remain in force. -

    -NO WARRANTY. This work is licensed and provided "as is" -without warranty of any kind, express or implied, including, -but not limited to, the implied warranties of merchantability -and fitness for a particular purpose or a warranty of -non-infringement. -

    -GOOD-PRACTICE RECOMMENDATIONS. In addition to the requirements -of this license, it is requested from and strongly recommended -of redistributors that: -

      -
    1. If you are distributing the work on hardcopy or CD-ROM, - you provide email notification to the authors of your - intent to redistribute at least thirty days before your - manuscript or media freeze, to give the authors time to - provide updated documents. This notification should - describe modifications, if any, made to the document. - -
    2. All substantive modifications (including deletions) should - be either clearly marked in the document or else described - in an attachment to the document. - -
    3. While it is not mandatory under this license, it is - considered good form to offer a free copy of any hardcopy - and CD-ROM expression of this work to its authors and the - original software developers. - -
    4. Translations should contain this license in the target - language. -
    - - - -
    -
    - - -O'Reilly Home | - -O'Reilly Bookstores | - -How to Order | - -O'Reilly Contacts
     - -International | - -About O'Reilly | - -Affiliated Companies

    -© 1999, O'Reilly & Associates, Inc. - -

    - - - diff --git a/docs/htmldocs/using_samba/this_edition.html b/docs/htmldocs/using_samba/this_edition.html deleted file mode 100644 index 71522ac31e..0000000000 --- a/docs/htmldocs/using_samba/this_edition.html +++ /dev/null @@ -1,48 +0,0 @@ - - -This Edition - - - - - - - - -
    - - -
    -

    Using Samba

    - -By Robert Eckstein, David Collier-Brown & Peter Kelly -
    1st Edition October 1999 (est.) -
    1-56592-449-5, Order Number: 4495 -
    424 pages (est.), $34.95 (est.) -     -
    -
    - -
    - Copyright (c) 1999 by O'Reilly & Associates. This book, - Using Samba, first edition, was written by Robert Eckstein, - David Collier-Brown, and Peter Kelly, and published by - O'Reilly & Associates. This material may be distributed only - subject to the terms and conditions set forth in the - license, which is presently available at - - http://www.oreilly.com/catalog/samba/licenseinfo.html. -
    - -
    - -
    -This is a modified version of the O'Reilly first edition of
-Using Samba. Some of the modifications were made by Jay Ts - thanks Jay!
-
-
    - - - -- cgit From 99bde6889d3d8b7a9e950c86c30e82662e1dacdd Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 02:58:53 +0000 Subject: syncing files from 3.0 into HEAD again (This used to be commit bca0bba209255d0effbae6a3d3b6d298f0952c3a) --- docs/Samba-Developers-Guide.pdf | 11828 ++-- docs/Samba-HOWTO-Collection.pdf | 62575 ++++++++++--------- docs/docbook/Makefile.in | 181 +- docs/docbook/configure | 160 +- docs/docbook/configure.in | 34 +- docs/docbook/devdoc/dev-doc.xml | 15 +- docs/docbook/devdoc/modules.xml | 18 +- docs/docbook/global.ent | 76 +- docs/docbook/manpages/editreg.1.xml | 9 +- docs/docbook/manpages/findsmb.1.xml | 9 +- docs/docbook/manpages/lmhosts.5.xml | 9 +- docs/docbook/manpages/log2pcap.1.xml | 138 + docs/docbook/manpages/mount.cifs.8.xml | 302 + docs/docbook/manpages/net.8.xml | 73 +- docs/docbook/manpages/nmbd.8.xml | 30 +- docs/docbook/manpages/nmblookup.1.xml | 9 +- docs/docbook/manpages/ntlm_auth.1.xml | 9 +- docs/docbook/manpages/pdbedit.8.xml | 11 +- docs/docbook/manpages/profiles.1.xml | 9 +- docs/docbook/manpages/rpcclient.1.xml | 12 +- docs/docbook/manpages/samba.7.xml | 17 +- docs/docbook/manpages/smbcacls.1.xml | 13 +- docs/docbook/manpages/smbclient.1.xml | 26 +- docs/docbook/manpages/smbcontrol.1.xml | 9 +- docs/docbook/manpages/smbcquotas.1.xml | 11 +- docs/docbook/manpages/smbd.8.xml | 27 +- docs/docbook/manpages/smbmnt.8.xml | 9 +- docs/docbook/manpages/smbmount.8.xml | 9 +- docs/docbook/manpages/smbpasswd.5.xml | 17 +- docs/docbook/manpages/smbpasswd.8.xml | 16 +- docs/docbook/manpages/smbsh.1.xml | 11 +- docs/docbook/manpages/smbspool.8.xml | 9 +- docs/docbook/manpages/smbstatus.1.xml | 10 +- docs/docbook/manpages/smbtar.1.xml | 15 +- docs/docbook/manpages/smbtree.1.xml | 9 +- docs/docbook/manpages/smbumount.8.xml | 9 +- docs/docbook/manpages/swat.8.xml | 9 +- docs/docbook/manpages/tdbbackup.8.xml | 9 +- docs/docbook/manpages/testparm.1.xml | 11 +- docs/docbook/manpages/testprns.1.xml | 11 +- docs/docbook/manpages/vfstest.1.xml | 9 +- docs/docbook/manpages/wbinfo.1.xml | 246 +- docs/docbook/manpages/winbindd.8.xml | 53 +- docs/docbook/projdoc/AccessControls.xml | 579 +- docs/docbook/projdoc/Backup.xml | 2 - docs/docbook/projdoc/Bugs.xml | 36 +- docs/docbook/projdoc/CUPS-printing.xml | 2288 +- docs/docbook/projdoc/Compiling.xml | 127 +- docs/docbook/projdoc/DOMAIN_MEMBER.xml | 252 +- docs/docbook/projdoc/Diagnosis.xml | 87 +- docs/docbook/projdoc/Further-Resources.xml | 13 +- docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml | 137 +- docs/docbook/projdoc/Integrating-with-Windows.xml | 347 +- docs/docbook/projdoc/InterdomainTrusts.xml | 248 +- docs/docbook/projdoc/NT4Migration.xml | 372 +- docs/docbook/projdoc/NetworkBrowsing.xml | 430 +- docs/docbook/projdoc/Other-Clients.xml | 86 +- .../projdoc/PAM-Authentication-And-Samba.xml | 205 +- docs/docbook/projdoc/PolicyMgmt.xml | 59 +- docs/docbook/projdoc/Portability.xml | 10 +- docs/docbook/projdoc/Problems.xml | 97 +- docs/docbook/projdoc/ProfileMgmt.xml | 327 +- docs/docbook/projdoc/SWAT.xml | 21 +- docs/docbook/projdoc/Samba-BDC-HOWTO.xml | 94 +- docs/docbook/projdoc/Samba-PDC-HOWTO.xml | 557 +- docs/docbook/projdoc/ServerType.xml | 188 +- docs/docbook/projdoc/Speed.xml | 28 +- docs/docbook/projdoc/StandAloneServer.xml | 92 +- docs/docbook/projdoc/UNIX_INSTALL.xml | 158 +- docs/docbook/projdoc/VFS.xml | 110 +- docs/docbook/projdoc/locking.xml | 138 +- docs/docbook/projdoc/msdfs_setup.xml | 54 +- docs/docbook/projdoc/passdb.xml | 714 +- docs/docbook/projdoc/printer_driver2.xml | 964 +- docs/docbook/projdoc/samba-doc.xml | 20 +- docs/docbook/projdoc/securing-samba.xml | 75 +- docs/docbook/projdoc/unicode.xml | 64 +- docs/docbook/projdoc/upgrading-to-3.0.xml | 578 +- docs/docbook/projdoc/winbind.xml | 201 +- docs/docbook/sambadoc.dtd | 25 + docs/docbook/smbdotconf/base/netbiosaliases.xml | 2 +- .../smbdotconf/domain/machinepasswordtimeout.xml | 4 +- docs/docbook/smbdotconf/filename/mangleprefix.xml | 4 + docs/docbook/smbdotconf/filename/manglingchar.xml | 2 +- docs/docbook/smbdotconf/ldap/ldapgroupsuffix.xml | 14 + docs/docbook/smbdotconf/ldap/ldapidmapsuffix.xml | 15 + docs/docbook/smbdotconf/ldap/ldapusersuffix.xml | 3 +- docs/docbook/smbdotconf/locking/lockspincount.xml | 2 +- docs/docbook/smbdotconf/logon/adduserscript.xml | 2 +- docs/docbook/smbdotconf/logon/logonscript.xml | 4 +- docs/docbook/smbdotconf/logon/shutdownscript.xml | 2 +- .../docbook/smbdotconf/misc/kernelchangenotify.xml | 17 + docs/docbook/smbdotconf/misc/remoteannounce.xml | 3 +- docs/docbook/smbdotconf/printing/os2drivermap.xml | 5 +- .../smbdotconf/protocol/clientusespnego.xml | 3 + .../smbdotconf/protocol/nameresolveorder.xml | 2 +- docs/docbook/smbdotconf/protocol/profileacls.xml | 13 +- .../docbook/smbdotconf/protocol/unixextensions.xml | 2 +- .../smbdotconf/security/allowtrusteddomains.xml | 2 +- .../smbdotconf/security/clientntlmv2auth.xml | 6 + .../smbdotconf/security/clientplaintextauth.xml | 12 + .../docbook/smbdotconf/security/clientschannel.xml | 19 + docs/docbook/smbdotconf/security/clientsigning.xml | 19 + docs/docbook/smbdotconf/security/passdbbackend.xml | 13 +- docs/docbook/smbdotconf/security/passwdprogram.xml | 5 +- .../docbook/smbdotconf/security/preloadmodules.xml | 3 - docs/docbook/smbdotconf/security/serversigning.xml | 19 + docs/docbook/smbdotconf/tuning/deadtime.xml | 2 +- docs/docbook/smbdotconf/vfs/aclcompatibility.xml | 17 + docs/docbook/smbdotconf/vfs/getquotacommand.xml | 52 + docs/docbook/smbdotconf/vfs/hostmsdfs.xml | 10 +- docs/docbook/smbdotconf/vfs/msdfsroot.xml | 18 +- docs/docbook/smbdotconf/vfs/setquotacommand.xml | 42 + docs/docbook/smbdotconf/winbind/idmapbackend.xml | 18 + .../smbdotconf/winbind/winbindcachetime.xml | 2 +- docs/docbook/smbdotconf/wins/winsserver.xml | 2 +- docs/docbook/xslt/expand-sambadoc.xsl | 304 + docs/docbook/xslt/generate-attributions.xsl | 39 +- docs/docbook/xslt/html-common.xsl | 3 + docs/docbook/xslt/latex.xsl | 17 +- docs/docbook/xslt/latex/sambadoc.cls | 2 +- docs/faq/FAQ-ClientApp.html | 12 +- docs/faq/FAQ-Install.html | 6 +- docs/faq/FAQ-errors.html | 16 +- docs/faq/FAQ-features.html | 28 +- docs/faq/FAQ-general.html | 12 +- docs/faq/samba-faq.html | 4 +- docs/htmldocs/AccessControls.html | 531 +- docs/htmldocs/AdvancedNetworkManagement.html | 18 +- docs/htmldocs/Appendixes.html | 7 +- docs/htmldocs/Backup.html | 8 +- docs/htmldocs/CUPS-printing.html | 1984 +- docs/htmldocs/ClientConfig.html | 4 +- docs/htmldocs/DNSDHCP.html | 4 +- docs/htmldocs/FastStart.html | 4 +- docs/htmldocs/Further-Resources.html | 6 +- docs/htmldocs/InterdomainTrusts.html | 184 +- docs/htmldocs/IntroSMB.html | 16 +- docs/htmldocs/NT4Migration.html | 236 +- docs/htmldocs/NetworkBrowsing.html | 348 +- docs/htmldocs/Other-Clients.html | 72 +- docs/htmldocs/PolicyMgmt.html | 59 +- docs/htmldocs/Portability.html | 22 +- docs/htmldocs/ProfileMgmt.html | 246 +- docs/htmldocs/SWAT.html | 45 +- docs/htmldocs/Samba-Developers-Guide.html | 455 +- docs/htmldocs/Samba-HOWTO-Collection.html | 9373 ++- docs/htmldocs/SambaHA.html | 4 +- docs/htmldocs/ServerType.html | 187 +- docs/htmldocs/StandAloneServer.html | 69 +- docs/htmldocs/VFS.html | 73 +- docs/htmldocs/bugreport.html | 38 +- docs/htmldocs/compiling.html | 87 +- docs/htmldocs/diagnosis.html | 73 +- docs/htmldocs/domain-member.html | 254 +- docs/htmldocs/groupmapping.html | 134 +- docs/htmldocs/install.html | 124 +- docs/htmldocs/integrate-ms-networks.html | 356 +- docs/htmldocs/introduction.html | 7 +- docs/htmldocs/ix01.html | 40 +- docs/htmldocs/lmhosts.5.html | 8 +- docs/htmldocs/locking.html | 143 +- docs/htmldocs/log2pcap.1.html | 29 + docs/htmldocs/migration.html | 2 +- docs/htmldocs/mount.cifs.8.html | 103 + docs/htmldocs/msdfs.html | 51 +- docs/htmldocs/net.8.html | 29 +- docs/htmldocs/nmbd.8.html | 32 +- docs/htmldocs/nmblookup.1.html | 22 +- docs/htmldocs/ntlm_auth.1.html | 10 +- docs/htmldocs/optional.html | 59 +- docs/htmldocs/pam.html | 179 +- docs/htmldocs/passdb.html | 465 +- docs/htmldocs/pdbedit.8.html | 30 +- docs/htmldocs/pr01.html | 5 + docs/htmldocs/pr02.html | 1 + docs/htmldocs/printing.html | 766 +- docs/htmldocs/problems.html | 51 +- docs/htmldocs/rpcclient.1.html | 33 +- docs/htmldocs/samba-bdc.html | 105 +- docs/htmldocs/samba-doc.html | 72 + docs/htmldocs/samba-pdc.html | 382 +- docs/htmldocs/samba.7.html | 4 +- docs/htmldocs/samba.css | 80 + docs/htmldocs/securing-samba.html | 82 +- docs/htmldocs/smb.conf.5.html | 497 +- docs/htmldocs/smbcacls.1.html | 14 +- docs/htmldocs/smbclient.1.html | 23 +- docs/htmldocs/smbcontrol.1.html | 7 +- docs/htmldocs/smbcquotas.1.html | 8 +- docs/htmldocs/smbd.8.html | 23 +- docs/htmldocs/smbmount.8.html | 8 +- docs/htmldocs/smbpasswd.5.html | 15 +- docs/htmldocs/smbpasswd.8.html | 19 +- docs/htmldocs/smbsh.1.html | 24 +- docs/htmldocs/smbspool.8.html | 2 +- docs/htmldocs/smbstatus.1.html | 8 +- docs/htmldocs/smbtar.1.html | 2 +- docs/htmldocs/smbtree.1.html | 12 +- docs/htmldocs/speed.html | 52 +- docs/htmldocs/swat.8.html | 12 +- docs/htmldocs/testprns.1.html | 10 +- docs/htmldocs/troubleshooting.html | 2 +- docs/htmldocs/type.html | 8 +- docs/htmldocs/unicode.html | 55 +- docs/htmldocs/upgrading-to-3.0.html | 195 +- docs/htmldocs/vfstest.1.html | 10 +- docs/htmldocs/wbinfo.1.html | 89 +- docs/htmldocs/winbind.html | 163 +- docs/htmldocs/winbindd.8.html | 49 +- docs/manpages/Samba.7 | 5 +- docs/manpages/log2pcap.1 | 116 + docs/manpages/mount.cifs.8 | 186 + docs/manpages/net.8 | 11 +- docs/manpages/nmbd.8 | 14 +- docs/manpages/nmblookup.1 | 8 +- docs/manpages/ntlm_auth.1 | 4 +- docs/manpages/pdbedit.8 | 8 +- docs/manpages/rpcclient.1 | 8 +- docs/manpages/samba.7 | 5 + docs/manpages/smb.conf.5 | 499 +- docs/manpages/smbcacls.1 | 4 +- docs/manpages/smbclient.1 | 22 +- docs/manpages/smbcontrol.1 | 7 +- docs/manpages/smbcquotas.1 | 4 +- docs/manpages/smbd.8 | 12 +- docs/manpages/smbpasswd.8 | 2 +- docs/manpages/smbsh.1 | 10 +- docs/manpages/smbstatus.1 | 4 +- docs/manpages/smbtree.1 | 4 +- docs/manpages/swat.8 | 4 +- docs/manpages/vfstest.1 | 4 +- docs/manpages/wbinfo.1 | 96 +- docs/manpages/winbindd.8 | 22 +- 234 files changed, 56460 insertions(+), 50375 deletions(-) create mode 100644 docs/docbook/manpages/log2pcap.1.xml create mode 100644 docs/docbook/manpages/mount.cifs.8.xml create mode 100644 docs/docbook/sambadoc.dtd create mode 100644 docs/docbook/smbdotconf/ldap/ldapgroupsuffix.xml create mode 100644 docs/docbook/smbdotconf/ldap/ldapidmapsuffix.xml create mode 100644 docs/docbook/smbdotconf/misc/kernelchangenotify.xml create mode 100644 docs/docbook/smbdotconf/security/clientplaintextauth.xml create mode 100644 docs/docbook/smbdotconf/security/clientschannel.xml create mode 100644 docs/docbook/smbdotconf/security/clientsigning.xml create mode 100644 docs/docbook/smbdotconf/security/serversigning.xml create mode 100644 docs/docbook/smbdotconf/vfs/aclcompatibility.xml create mode 100644 docs/docbook/smbdotconf/vfs/getquotacommand.xml create mode 100644 docs/docbook/smbdotconf/vfs/setquotacommand.xml create mode 100644 docs/docbook/smbdotconf/winbind/idmapbackend.xml create mode 100644 docs/docbook/xslt/expand-sambadoc.xsl create mode 100644 docs/htmldocs/log2pcap.1.html create mode 100644 docs/htmldocs/mount.cifs.8.html create mode 100644 docs/htmldocs/pr01.html create mode 100644 docs/htmldocs/pr02.html create mode 100644 docs/htmldocs/samba-doc.html create mode 100644 docs/htmldocs/samba.css create mode 100644 docs/manpages/log2pcap.1 create mode 100644 docs/manpages/mount.cifs.8 diff --git a/docs/Samba-Developers-Guide.pdf b/docs/Samba-Developers-Guide.pdf index a2aa5f1b84..fd5ddf3fcf 100644 --- a/docs/Samba-Developers-Guide.pdf +++ b/docs/Samba-Developers-Guide.pdf @@ -927,7 +927,7 @@ endobj << /S /GoTo /D (section.10.5) >> endobj 624 0 obj -(10.5 \134\134MAILSLOT\134NET\134NTLOGON) +(10.5 \134\173\175\134\173\175MAILSLOT\134\173\175NET\134\173\175NTLOGON) endobj 625 0 obj << /S /GoTo /D (subsection.10.5.1) >> @@ -1389,11 +1389,12 @@ endobj << /S /GoTo /D [930 0 R /Fit ] >> endobj 932 0 obj << -/Length 250 +/Length 230 /Filter /FlateDecode >> stream -xÚ‘ÁJ1†ïûsÌ2f2™Ùì±E-<™›x»¡E±Vðí¸ÛE°‚äæÿ2ó%!¶²`ຬ(Lð¸oo†ö¾¬›«2Ï^Aƒ Ÿ½æø™¥(!'­RQõûš’)ô³T]Å¢ºÒf{hÉí«$ŒvÖ§síaèð>¢ëãîsÜÅ`|à?”Y01ÿûß¾U[gÛendstream +xÚ‘ÁNÃ0 †ï} +ÓCLÇNrìLBâDoˆ+‰iˆ­> endobj 961 0 obj << -/Length 3113 +/Length 1319 /Filter /FlateDecode >> stream -xÚµ[KsÛF¾ëWð¶äA³˜€AÕÖ–d;ÎÚ{µ–’²9@L1æC Rqœ_¿Ý3`0/0S>ˆvwOßôt7†t–Á?:“9Éx5+eArNgËíE6[Á7ß^P#‘Í.3Â+‰ßýï⧟³Ùȼ½Ð~†×¡U5Û^ˆœ“\pó~sq{ñŸ^‹þNÌzU®™KVpRÊ|vÉ3"¥°e|ÙRô\–yN -Q¢ð‹»‹¿¿ÎËYEª‚Ïî>ΘÌËÙ¬“¹{øiþ]³ª7‹K.ùüýþ¸¸¤óõ²Yü|÷öâ›»^}•“JÈYÉJBsr–Q"i/C ¡´$eQ‚sƒÏ9Ê8aŒöFйëgsåÔ±]€gøêþù¸Þﮋ4+ˆÌÁGÊ –j•‡ú£v5Ó/>Œ|e„S¾öŠ”«,³\52F=}Õ oÿͨحÁSt‚Z”óýGü[Ìßã÷ÍñÅ›ßê/nÚýq/é|¹ßh™z÷ ¿{_oýчæßÒù³ -ªî¿ÃÿœÍ”a/¼â„Ò@4|æä…fˆV9 È ”¢ª€AU*¬¨ˆ‚°²˜u2Hé!•Sø^Î,]¾A#ãÌ-ƒè9xeüîùÓ‚É9Fs ·"4Dmõˆ!xÞ°ßyVž8–¦(s:tù¶ÞÞ×íkt·]>* -)Â,Ï­·YàEÈg/’.OœˆnÉ Ï‹4ºFfÝAW]×`]Ëà«z§½…=6uÛ´Q<‹ŒˆLœÏASO#ƒNÞ=6z‡ê-¸y8|_áëoàÃøâ{xñ­ýr86[g^BVe¡µø1Í(ÉO„Y”ž†ÙÈLÂ<èJÀì Ál|ù¨²ý±ó5í±ÙDqæ‚ä;΃¦8ÎFFyiðz·Ò Þ>¯VÍÁ$郿i))yÈ_Ï‚ç´ËÈlL8yó<¥™„²×”@Ò±r°v{„P¨ükŸ”ÅüõBŠyÛì–øÙ£çYX‘U$¯ò‰ÅBñÕ™Éå§ öëw †`¼E2l1û!qíÛ¥Êí±¥çU åYzåƒLtáFdjÝ)kݲ]kU[Ö®¡Œc¬ù¬ñ~Q·Èƒ"Âñ]5Þ…œÜŠ¯ÛÈL.„‡)î3P¨õŸïÕã7ýæÇÇÒÊÜÑ~ð65ƒ¬ÇB ò"[qèaN3ˆ -ò®5| ¡ÝÉL¡m銣í  mtJœ»…äs…?~¼RAÞDá’“¬¨Î¿¥) -'£¶õ¢¯ë¥B}5êRë¾Å£\­`«É¥:7~Chåpâ–èNqzâ^%S™FßÈL¢?èJ ï ¡oüsèç%¡Å9M–¦8úFÝ~½Þ=ØÈ?šÏfô¸Þ}ÔÛÉP»±Y?Å4?›|©`©áspøÈ$ô-5 BEOkv…„ÑtùßÉL2cЕ`†k0Ä ËàÛf³5¿*…À^W°[¨&Kãõ/â‰XA¼x* ¢åØéDñ¤¥“î»*Ñî/è~{…)Š¼{¤Ù·+¯¢¹&W"„Œïƒ] 9ŠÂÕA_p(Š ‚ô2q~h‘Iz$¬õìp¬…È1X;9k8Ä€Ð0'†„Þ“ÜMðB §w¢Ñc‹»þaÕœ@ 8"3‘ -^'âù0¢ÅHM²F´"<;GiiŠ§S#£j©;ÕPw¯òæÚ¤Éðææåßü~²’DHrÚBB€’ê´‚Áót?ÙÉLЕ`¾k0D}ËàIeÆ$(r" ç}F8ËÇÞ&ˆ¯¥“~»*ÑîF¹½Ü\>¯Käþ#ÎuîuWc²ëZGo¶Å"Wɘv2¾oöŽp%%¯”ÚG©%¥L'3E™¤ÁŽ2žÁelƒjŠT?cé©Ys}ÐS$Œ.M<Î@½!Ê*Êl×ÄØÛ8e´pÒmG!}Ò_)j¬öä¡ãÆv¿#Ë=Áo?ù4¤àé8v2¾C#šŒ¥i"¢œ É §‰‘™¤IÊ`O×`ˆ&–ÁWÑݲ0x¬wj’gžÆwáï»×qÀ@—ñª (ÁÎÈñ8cŒtr ®J´«&N¸„ÃÕA=Ø«Y‹9V<®p"+š f'ã{2âÊXQò”åEEDuŽI”¥)zÊv2δö¦]ïŽýÓ¶7ˆ{z|ËXAhØ{/f²\ŠÓŽ[<Ä«;ÉMad&7Å +±)\ƒ¡Maü¶ië=»ÕúȳˆcÁI^c*eiŠcldŒ|óÞL¦Ôl€õQ¥%h(Bþú¨R]lž„*œÿ…H:™IT] T]ƒ!T-ƒ_‡*Dë,³¦AQS-2 ÿdî8mÕ¨}¥a¾EŸ¯ß™7áË/¦K%´ì´Ï)yzºÔÉLÂ<èJÀì ÁlüƒO ά¢¤”ç+Yš¢Hw2ª¶¯wï°ùéÆÈý%6ÓÝà\©Æ±âá3¾Tƒ£Ö}³[¶_žÔu9oˆTAyhaXg„f'‘X)‰äé!R'3EKWœžÁlƒo›¶Q}öSøn6뮦 vJ’dŒÇ;%¦zΑ«‰NIK'vU¢]{4p¥\Åäü¾&êÊC`V¸–ÉߗѬ`¤&YÅ0ì)å9î„Yšâ{ÄȨ'äæ®Ðó¦ñ‡@^ =]À;ŸSÎøüDžç ÄÓ^'3ÉóAW‚ç®ÁÏ-ƒõ°täôô°4徫ò+†¥©öÃRχÀ°Ôö!NuÿOžã´¥)Nu#ƒ.}¸yiÊuuoyµªï7¦x§Q…ôÜŒá•òÝ/ì Ó§ô´ÂŽ±’déëŽFdrôš»À±Úƒµëšg<ê¼49ÿ»õêYåÍu€ý€`b0r#GÌGÑ”Ã#eh®Þt~]!¸²¾ß’e¨K&ãe$<ë£ÕV’œe0ØY9qgΊÁÈL2!e°§‚k0ÄËà_žm§OHˆ ÷]•_“!¢ëC(!Z>Äb!bü qÐOˆF]úáõíø賺<ã×%'UÅBÞú1‚¾èÄûTVêaBŠùÌó-]qæ{Ì· ^ošßÔàî¡1ÜW7ä÷ŸôUB¼ÑÕ¿úãA(hœþp`fP#Ž<ÓßH'×àªT¹ñþª«ÒûÒw\`"X™ e'ã»1ÚcEÉIKì’' ZBq¦™I¦¤ öLq †˜bî”ìšN`Ë»æø»š²×æ!‘iƒ\as…’¢p‚•àŠ–N®ÂU‰vuš?þÞèëˆà½~H°þ¨Mà1b.«dH;ß›1Ž¢dΤ… Еœ!gZš¢9³“QÏVõO›ƒ.%Õå ƒ>ÕËO8=¨WMøE¦ž”¼ö®Bš=q\€Lå4]>v2“;bЕØ®ÁÐŽ° þ‘ª!ˆ2—„ç˜ûZšâ(ý šÝ±]ã:»¹àÒ´k¥é0áúÎú×J%¡Å‰7±)ËU#‘D×ÈL¢;èJ ë ¡kü«k‘ÓÓ5aÊ}WåWÔ„©ö5¡çC &´}ðò›ù‰7Îÿð¦øãìêÏýÂûÒعúÙQ!A3Re•zdÍ9Tz²sý宿9>—<àðÿño+ªendstream +xÚXMoã6½çWè(Ìå—DX,šÍ6Ån7ØxÑCÛƒb+¶QÙ +dyÓþûr(Ê¢%QR‹±%>óÍÌ gD¬ÿH c„™ +„LPÌH°Ú_á`£W>]‹à1C1çúûÀâ¢Y]$a.1–c!(G\rÀÜ,¯ÞÝSPŒ’„Ë—ÆD‚© –ëßÃëˆá°ªÊÝó©Ú‡côçò—«ËóÆÍO8C8áCÔ8XP°’°Xß,7AýåÛ€… ‰‘J’³…$F ++×B‹ ï²?0ᇈ„;°0Z0ÆÂâ¥þü5«n¢ ¿êõ§úÞc©¿U-¨ W°XäõJ +»¬í/Ó=,eõÕ· .ŽE®£¿¶4_êMÖ‘j@7q*[ÌdþŸ·IÿKºáìoéþCI¤þµš;8h¯X  ÑRôá«ÛM7iõÚºïfêÿ»¾÷´ME™¯{ƒ€vNèéÔ1 -Ê‘ rÖNâQ5qî4 )Íüv5t;Æ2’,4²®7Yî•“Bÿ=÷ÔqÐ~9-Æ<{ƆtejÏÆ7Üa”Õ÷µ¨¦H¥ùàÁDI\;ÞZ20áaÝm³yºjé°J&tµ I]ÛÍFtí0ëê0þ/]CjöÛ·ìUÕBÀž{£æºÕ”…§£Ñï^ªØ×jfù¥(÷©ó‚Î|Òðͼ‚'{]ÀáõÖ—YÔ‘o-ëT&uÿÁ$Š“‹Lðw1âÌóH1]1°äÅ€§¬kV \ºÍk÷éRþ –©ŸVendstream endobj 960 0 obj << /Type /Page @@ -1483,6266 +1481,6986 @@ endobj /Resources 959 0 R /MediaBox [0 0 595.276 841.89] /Parent 941 0 R -/Annots [ 966 0 R 970 0 R 971 0 R 972 0 R 973 0 R 977 0 R 978 0 R 979 0 R 980 0 R 981 0 R 982 0 R 983 0 R 984 0 R 985 0 R 986 0 R 987 0 R 988 0 R 989 0 R 990 0 R 991 0 R 992 0 R 993 0 R 994 0 R 995 0 R 996 0 R 997 0 R 998 0 R 999 0 R 1000 0 R 1001 0 R 1002 0 R 1003 0 R ] +/Annots [ 964 0 R 968 0 R 969 0 R 970 0 R 971 0 R 975 0 R 976 0 R 977 0 R 978 0 R 979 0 R ] >> endobj -966 0 obj << +964 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 711.214 394.107 720.125] +/Rect [84.043 614.97 378.006 624.538] /Subtype /Link /A << /S /GoTo /D (netbios) >> >> endobj -970 0 obj << +968 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 685.311 204.163 694.222] +/Rect [84.043 560.773 180.945 570.341] /Subtype /Link /A << /S /GoTo /D (architecture) >> >> endobj -971 0 obj << +969 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 657.471 238.808 668.319] +/Rect [84.043 504.455 218.566 516.144] /Subtype /Link /A << /S /GoTo /D (debug) >> >> endobj -972 0 obj << +970 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 631.568 202.726 642.416] +/Rect [84.043 450.258 179.187 461.947] /Subtype /Link /A << /S /GoTo /D (CodingSuggestions) >> >> endobj -973 0 obj << +971 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 559.782 187.013 568.693] +/Rect [84.043 289.789 163.399 299.357] /Subtype /Link /A << /S /GoTo /D (internals) >> >> endobj -977 0 obj << +975 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.002 544.893 383.28 555.741] +/Rect [198.134 260.569 360.309 272.259] /Subtype/Link/A<> >> endobj -978 0 obj << +976 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 533.879 192.838 542.79] +/Rect [84.043 235.592 167.914 245.16] /Subtype /Link /A << /S /GoTo /D (parsing) >> >> endobj -979 0 obj << +977 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 507.976 230.716 516.887] +/Rect [84.043 181.395 210.763 190.964] /Subtype /Link /A << /S /GoTo /D (unix-smb) >> >> endobj -980 0 obj << +978 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 480.136 237.502 490.984] +/Rect [84.043 125.077 216.308 136.767] /Subtype /Link /A << /S /GoTo /D (tracing) >> >> endobj -981 0 obj << +979 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 454.233 288.599 465.081] +/Rect [84.043 70.88 272.399 82.57] /Subtype /Link /A << /S /GoTo /D (windows-debug) >> >> endobj -982 0 obj << +962 0 obj << +/D [960 0 R /XYZ 85.039 786.531 null] +>> endobj +963 0 obj << +/D [960 0 R /XYZ 85.039 643.064 null] +>> endobj +959 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F42 967 0 R /F39 974 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +991 0 obj << +/Length 1985 +/Filter /FlateDecode +>> +stream +xÚ½ZÛrÛ6}×Wè­Òƒ p¦Ó±ã\¦™8ãÚjúæ¶Y %¹]Çùúâ*‚¸‘I§ÏØ´tf÷`÷p±XN3þ§Œ€ —SÊ +@0œÞn&ÙtÅ¿y=‘MO2€K&¾ûkòác6]rÌ›‰úð‘_g–åt3É $Çúÿfr=ùíhE}—O¦\7'q‚3ÀXÄh¶'”PäT`ž/&Ï^åh +3Pfåtñ‰_Agxj@‹å‡ÙŸ¤ó‹7“—‹£5˜€6µŒy Æó‰í"€!êy|S7›z~gûù ÆxvÔß÷s†gõ~»›Ÿ :Û­? ZÏ^ñUuöJ Š’rÂÐÏ.os—yŸ·øb¿Òˆ+k^kS8þÜ­ÎNÕfÎ ßT€ÿ·Û¯\V8Ë@A‹d4 ÆãÒ[½kIpùÅugt‹M™K‡IˆEƒÅ’p؉Åñ‹åñl»äQÝ×B#ùl!4"¢¾^®ê¦ („A€(Ž*$C £}®q(pš´cQxm÷kÎ<=‘y°¸</0Ódü Æ£Ò[ºk))‘]"ì¨/xÔÅUH'G°¿þ¾=áòÝBåê…XïFF`½Õ·ú%ÿìü§ƒ§!Z€¼È-V^Jþ "<d‘:iè4˜ ´¬ hHÖ–±¸¬]AYÛß>|¢¨UXÞÊb²^ÝÍQ9kwÛ€¬)Á˜¬a‰@ ²Q]ômǦpÜHÖ·ÍéáQ2æÙloEñ»“W…»Ú‹[lëÖ“:/ßv$‚R×\_ꎥ”Ôy¥ˆ¤·M “Œ J&á°“Œã1,Ëã¥qõÀCÛ(ÕœÉê"#ÖLÁ˜G%Ã0/EŸl\2=@Û±)ß+ʧ•¨Ú«XÖ²$pÂ\#·;ÀoO%o“`2ŒãñqTÒ·”T âÍ!i•t˜„J4hP% ‡Ja•X_ˆhoo+]p¯ÛJZ*…“Éùµ¬5Í2Ô\eqsÑæ +‚,s•h®:½צp¼4+8œn¥T¸L6¾HÀ'£h0G$}K)‘^v2BGn›:ºoŒðzm:•»KÙçlåý½Y\©ÏAÙÊ­âØ„n«æà÷:DÊâá /Z´Kj[Mw‹¤  $,­~R¿e,®~×cPý¶Ç×õ¾âÒ–a:—Ç„(’OÌ+ƦóŽgSAÉüã×w×:}*£ü ÃéÒ¹sŒ-n~€ 8,棚!Âo1Z 4C4˜µÎX"kŽÇpÖ,ß›µœå (ðÈ´YèhÞ F°YÜÕªýý^ö3·ª‡µïÀë³ }ñdŠk[û% +‰%R›®4Ì[vÄFe2'p±§3i@C™´ŒÅ3éz fÒöèœÖžWû¶©Û6–Gœñ®l5µÐñÙÄyE¡h;6…ããhæÔ=Æw²õãüœ•Œ¡BxTœƒ¸m%ÕP`~ðEc4D¸¼Ps´åCcš>«A„óìÌú“Ç d%bœ—R˜± ‰Ø2±ë1(bÛ£;x4G1§à±b‘™#-ã2.-iŸnBÆ +=@ܱùýóFÄSRrÒ© ŒÇÅÑqßRRÉHÌÁÆnÊ:®e^¯.ÏuÕnÄñ`µªn=<¹P¹ÏCSB?‚r›_ Ÿ¢²ZÙ…Q™ó˜ ìÂ4¤sËX\ç®Ç ÎmgªÃ¼›ËÚÌ/uÑ~»^=Ȳ·ÍM(²">7Ž… N:Mݵ)W ç(e}ú`J¶ùúf>2PäE2Žã‘qN}K)©£‚F‹´L:LB&4(“„ÃN&ŽÇ°L,ÿY9ìÑ.‡iâŽÍ/‡© Ë¡Ë%Xm.Qð­“R6²Zèh94áõý+}˜¼8&KŽMšÈ>O2¾Ï[N¼ð3ôØA +:ðÐÈ€•ÝK(ÛñV¶åñ¬©¿Vò(bëûùNN¯wâ×ßÇ«§Ð Œ$§ª§,=ê‰9˜~r“\„kS–›ñM+‘S´T0 Æãá)ܶ”R8ÆLjÅÂĵb@CZI9ÄÎUÓªž¢ß<´r +®'oê€:ØÖ~¡|üd9ôTÈHÆä2ÙЛ4 +3ønÄÑTâÕˆ¾»ð›»ÿá-‹ôˆ—hô‹ÿâšx»7húDÂ/ÐtD¢çY5…¾ö±y ãÇ_û²æÓ d‘i9Á@Ä Á7wùŠç„W,Ÿð?È..> endobj +993 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 441.282 316.308 452.13] +/Rect [213.498 752.53 301.672 764.219] /Subtype/Link/A<> >> endobj -983 0 obj << +994 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [237.686 429.326 317 440.175] +/Rect [201.074 725.431 287.733 737.121] /Subtype/Link/A<> >> endobj -984 0 obj << +995 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 418.312 199.48 427.223] +/Rect [84.043 700.454 177.46 710.022] /Subtype /Link /A << /S /GoTo /D (ntdomain) >> >> endobj -985 0 obj << +996 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [229.329 403.424 323.006 414.272] +/Rect [191.922 671.235 294.309 682.924] /Subtype/Link/A<> >> endobj -986 0 obj << +997 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [220.944 391.468 325.635 402.317] +/Rect [182.74 644.136 297.187 655.826] /Subtype/Link/A<> >> endobj -987 0 obj << +998 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [245.85 381.061 324.887 390.361] +/Rect [210.013 618.732 296.369 628.727] /Subtype/Link/A<> >> endobj -988 0 obj << +999 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 366.562 227.154 377.41] +/Rect [84.043 589.939 206.308 601.629] /Subtype /Link /A << /S /GoTo /D (printing) >> >> endobj -989 0 obj << +1000 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 342.596 218.312 351.507] +/Rect [84.043 537.864 196.43 547.432] /Subtype /Link /A << /S /GoTo /D (wins) >> >> endobj -990 0 obj << +1001 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 314.756 244.52 325.604] +/Rect [84.043 481.546 222.763 493.235] /Subtype /Link /A << /S /GoTo /D (sam) >> >> endobj -991 0 obj << +1002 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 288.853 287.409 299.701] +/Rect [84.043 427.349 271.824 439.039] /Subtype /Link /A << /S /GoTo /D (pwencrypt) >> >> endobj -992 0 obj << +1003 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [231.487 275.902 312.766 286.75] +/Rect [194.286 400.251 283.096 411.94] /Subtype/Link/A<> >> endobj -993 0 obj << +1004 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 264.888 151.853 273.799] +/Rect [84.043 375.273 126.096 384.842] /Subtype /Link /A << /S /GoTo /D (modules) >> >> endobj -994 0 obj << +1005 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 249.999 316.308 260.847] +/Rect [198.801 346.054 286.975 357.743] /Subtype/Link/A<> >> endobj -995 0 obj << +1006 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 237.048 224.719 247.896] +/Rect [84.043 318.955 203.521 330.645] /Subtype /Link /A << /S /GoTo /D (rpc-plugin) >> >> endobj -996 0 obj << +1007 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [238.904 224.096 327.876 234.944] +/Rect [202.407 291.857 299.642 303.547] /Subtype/Link/A<> >> endobj -997 0 obj << +1008 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 212.141 316.308 222.989] +/Rect [198.801 264.759 286.975 276.448] /Subtype/Link/A<> >> endobj -998 0 obj << +1009 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 201.127 174.989 210.038] +/Rect [84.043 239.781 151.096 249.35] /Subtype /Link /A << /S /GoTo /D (vfs) >> >> endobj -999 0 obj << +1010 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [251.081 186.238 315.423 197.086] +/Rect [215.74 210.562 286.006 222.251] /Subtype/Link/A<> >> endobj -1000 0 obj << +1011 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [250.666 175.831 340.385 185.131] +/Rect [215.286 185.158 313.339 195.153] /Subtype/Link/A<> >> endobj -1001 0 obj << +1012 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 161.331 201.218 172.18] +/Rect [84.043 156.365 175.581 168.055] /Subtype /Link /A << /S /GoTo /D (Packaging) >> >> endobj -1002 0 obj << +1013 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 135.429 195.473 146.277] +/Rect [84.043 102.168 172.733 113.858] /Subtype /Link /A << /S /GoTo /D (contributing) >> >> endobj -1003 0 obj << +1014 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 122.477 316.308 133.325] +/Rect [213.498 75.07 301.672 86.759] /Subtype/Link/A<> >> endobj -962 0 obj << -/D [960 0 R /XYZ 85.039 786.531 null] +992 0 obj << +/D [990 0 R /XYZ 85.039 786.531 null] >> endobj -959 0 obj << -/Font << /F57 965 0 R /F20 937 0 R /F14 969 0 R /F15 951 0 R /F11 976 0 R >> +989 0 obj << +/Font << /F42 967 0 R /F15 951 0 R /F39 974 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1025 0 obj << -/Length 2400 +1027 0 obj << +/Length 2355 /Filter /FlateDecode >> stream -xÚåœËr·†÷z -.É*w –º89JÙ²céd“dA‹Ô¥J"’Šã·0¸rÀ5N\>¤ÊekÈ™F7ÿ ô4G&lþA#fz ‰#ƒëÇ#<¸5g~<"þ -.œ›ã-'ÇáìXR„¹Úz÷1V”#Þp{ÍÉÕÑ~ x@1’’ ®n„PÄH­‘Pjp5ýuxº˜¯góõjôûÕOG¯¯âˆ~@)$’„m š!ÉÔ`l=ŠfkT„6H*i"g!ò°Fë°üE6,2k‡g³Ñ˜ ÄÏïGd¸¶¯ìÁb>3©†‹÷ób¶>±çÎ͹wöàÒ½ÿÞ¼^Ú׋õ¼ƒ‡×‹{F'sûöÔ½¸°Ç“Ç™{õa¶2W‘á“}w»{ë™Ú³B2…ùƒì³º3ËÛ;øIã/®+ÓÑ -£ ¯„t¼–ˆJD¦W˜:ÝHˆÈy’’˜ŸX:FÈP"˜ÒáÅë«“ówFsÎõ̇Ãà®õWû¾æÛÎmÁßý‚D…Öà<°Vã̬”¿;vu&”þ æþÒºÓÈÜ8ÇByæÔ3?ù0¢Ê$m†Çg§Ç—&M®Lv0ž’±J}4߈¬¢/ÙdV!›‰ ’-ýÃdkNY¡ ¸ñdYÈæ“ »|2fH¶K Ëm*ÄËHcŒ8&Q›çÂvVãÌlìͱ[Ý1@{KmÖP³ s¿ ëú&,¤2õƒ®oÂá"u›ðåäñãÄm€ÇËë»ûõìzý´œuÃ6Ú¶a'/½üÅõ˜:#¶jH­4ÐWîÝP¶gŒ­Åœ8q÷;ŸÛEp½´…‚I“f8}2‡×›Õn^âŽè§{+ZßD -F•4Š0àiÑu .˜>ÓH âñ‡ð­¥ý°¾_ßÙbs6™ÞÏÍÁ­Û 'öxêVS“Gv¢Ø\"Ó}ê…è‹4™U f"ÃXË`°5¯­Y"8¦mØ ¯îlR·›àdjŽîç·åʾåhºŒ7+%'/#™½R}Ù'³ -ûŒ̾ f_óÙ›­¯=ßÅ~¾É]5/d÷*õåžÌ*Ü3„BÜË`î5¯{[^`æ¹ Ï}îèÚôÇ¥û,L…Õý­ÙÍ¢_à6ôê923xä,À°%€ñŽ¶W5|G[*\dCc®"¾º›¹zxJci¦ˆ™¯Oþ÷£?cfÌ—Õzö”É™ëg”ÉÕ@;#¶2HÂ4X&MiKIµVæŠ"EùŽü’Qíš,õŠfŸ]iôÎÖMëOO®¯gß±=„/®˜žüe²Œ5‡šI^™¾™”Ì*™”©Oƒ2p-­z¬¹BŠ+ÏšÆ=tæÈÚõÓæÆoX`ó—¸Uõíäziî˜ξ¡oØËÑp2«Î¤&\®y€GDÀ ||v¶±nö§ÿð}q&³ -ÎLX" œe0Κ׈Ó~+Ä“C8ߌ!Ã_Þle*ð!dª¢/ÚdVA›‰ £-€ÑÖ¼F´X!¬µG+ºÛŸæ×ëû…íM¬ìúÛ¼¨2ÖëÓ—x2«Ï´'"^¯y%‚!%Õ€iÃYàm¥E8Ní]Ìízö×:¥¯RÍÿ¥oÙKÒ“q²‚gbƒ„Kï àšËÈ·ÁcÓ Àw¶;±LˆMº‹—ÁØËÒr2«PÎ$‡1—Àœk^#h)ÍMkÍ<è›Å24$&ën0”D”ŽÆÆÃG¿þŽSÍOG1Ý >›clÊ=x<2õ¹bþÕÃÑåÑÏ)Ú0Ö8¬ —¶÷Öt#ÜéìãSÛöîFgÛêšü;Ñù±vD'$j$߈nslð^$4íÓ‡ï5íkšuÇ®Oû2€Ö†aœ ­Y½ .²¡q׆9õã¸Ö¬TÃ˧ÛÛÙÊV6+ í’¹zFÛ¥XgÄV2I–úŠ¶K|ÒÊ(ÁÔ-‰B‚íhi…‹lÌ¢ø’×>D5_·íÎå|òЉ€šÉÙsÔ¬…Ö±Uz"è+¿ë톲µf˜!ݸNŠˆý«Ó»‰]Œ'îûÝÙÒÝýw2·ÛðC;Íuê@‹ç IßÅ'™UŸLo˜}¼çÖ¼ÊTï,P.:WóÐùÿì@ßØ]ÎÝ=­âNr¸5VP§'ïÌ æ+òÞÈ»ê5òV¦Gv]MoIözô¥›Ì*x3­a¾e0àš×@˜h„¦‘°ìæïe±`Ã6(Ñ“mf³ÍUÙn d[õÙ6öw Yd«ºÙÛ²5P?–û­ÿ‚XêCKá J_Ìɬ‚9Æ\c®y˜eƒ¸NeURØ>‚U_¨7«*Ýì5X/C_°É¬6“[ƒ­y`Gš'°:€ÝØ~·çï&Y¦åd®—£/àdVœIM¡‡Õ·®y€¹¹X‹ÔÑÀæF¶›¹—Ï…Ì)ßgº^‹¾t“Y…n¦3L· ¦[óéR….]âé¦ýwÔn´Ýû£M¬’è}ÆêEè‹5™U°fÃXË`¬5¯+áˆj•°R‡õÃåîU9<·C§œòjôå›Ì*|3¥a¾e0ßš×È×xW¹ Ïgd¿{m_¿?· -¶ÿkn«@O˜ÁFuAvýVkâHÊúfË1к`X#Üð¿Æ=Ö5H4lÆéºü¦jæendstream +xÚíœYs7€ßõ+øHV…XÜÇ£'«TlgMn^’<Ð"uTI”—¤Öñ¿08I-½[[›Q¹l9Óèv÷‡F£ ‰Œ°ýCFZ ÌÌHi‰#£«‡<º±w~8!á .œÛë#7§ñîTR„¹:úLÐ1U”#®¹{æl~ò·ï)QŒ¤d£ùu4DZC0Õ£ùò×ñùãz·Zﶓßç?ž¼™§㣜!,ù1•D"fïLB¡E0A3k8ÑHbYZE02Ø”V…gœUd25/V“)ÿ† _ßMÈxçÞ¹‹Çõdʤ?^û×w«Ý™»wiï½w3ÿùÏöýƽÜ=ÚOðøêñÞÝ‘ãÅÚ}¼ôoÞ¹ëÅÃÊ¿û°ÚÚ§ÈøÉ}º+Õ½õƒ,ÝUå1Amx5ÿWks3ò +×ħa׎ÙùWš™>ÔÜdƒôCDaLŒ¦Äöi¡¼1ȆŠ`JÇïÞÌÏ.ß[ÇsnÆh27_¸1_uï+þmCW´($Oά¢Ò ÆKM ±:P‡c?CMmAÅG|Ö† u„@Î>L¨²Ó“êñéÅùéÌN¬¹OŒçéÛá£Ô1ˆ.ë‰A!ÖÆ`/¤…Á Ú€zJ!#",扳w.;3fÃÞeXŸ5¨¯ â(Á‹}ÉÈbe„ÚdÔÔË Sˆè—Â-E`)àŸpVQ_Ì~>Ý\ÝÞíVW»§Íªµ' /Y€söÇë¼D›^ŠÃ|åÒ»oÆñ ÅŒ ñŽI ïåÚ¥ÔÝÆ*véñòÉ^^ùê¥+]°z]‰_0Ñ‚wûN´,L´"rBµ@ +†ô&b,ÀÓ@L\‰ß:@îww»[W¯Ë»µ½¸ñ‹ñÂ]/}†¶Óαå¦Á˜ƒà²¾d1ƒ"µÞ„¡H‹ˆA\‰ç·.gt‹ðbi¯îÖ7>ì[÷‘¼O(6 sòš.ö9 >íËI8)âpR[péœX/ f_='ü9NÖûŒ(ýº¤ì3ýÙ“‘B¬ÍH+ÂZŒ± Í¨71b %x`DFÖž—6¦iù¸Xmïnl¢‰y­< L‚Kûb’ÅLŠp˜Ô|S‰Ï¥Ý÷¸ßŸq–1_æÏo»ÖšïÃmcÍ/Çîã7gÿüÁo¶–³/ÛÝê¡Uÿê_²­=³s¤h:2ÕnãÚÚp3À…AD=³à\!Å}{‡å>Üê³/äÞ»*o÷éÉ7NÝ'®åòÅïØiÉôëÔ >ì;õ²0õŠøÄÔÒ›¸`¹ i_y +.&~.ý†¶‰ÏÕoW»}Ôœ †à¸¾0d1†"(D6a¨-`€ô&Ü·?\X †Ó‹‹ã<=ŒÐ7õ }B_„€¨fèk €ÐCzSè±BؘzÞ +ýOBÈø—ŸŽÆ_àae€à²¾d1ƒ"D71¨-0€ôF ˜±e‡ˆÃ*áû‰æã§õU×*$n믹~-ÓÁÙ“,ÕF£1-2jõm0 ¥ÄuŒŒUª1˜D0º’p>^ºmÜÍnõÇ.g¥ôÿm4ÿK0ïõ¥!‹8‘x¨-€€ô&"¤}™ºGÄ­ëýl26ˆW(ö¡ì E (‚@Q[@éMPj?¢ + ¸~ÜÄvÏbwh±ùÇ`™„­†üú;-­9?ž`ÄŒ}¶×ØV°fôpb÷)Š…w÷'³“M…0Ö´숹FÙ³Ù3w¹úøÔ}±q`µÿ5Fôĺ8l¥ Cö¬ÛÏ°‹¿ÖrÛš"ÙM½¦äÝñŸ™"µßÔëbT#Î9ØëŠÏ8˸ïu‡ÉÜ!³®©.Õxöts³Úºr¬y¬Ðø’öhàá˜][·yV¨ê+Ú[éÄ EŒ©g¼Ší¬×p1>ãlÕAwp½ë¾¶Ø¬÷mofM/ò&dØá˜7›]×b¨¯<4phÌÑ 5qÜ”ú„ç· —Àþ Àjã·}_¬Ý2ß}ÇcŸSƒ¯ú£÷z&¬B¬°ÊÈ´19bA{Mõ&"”DZ«@DÕ!\ǯû>{(®Ý*ê·ˆÛ´R½îyòc_6²ÀF#€Ú€ HobC2›u`#6 »vÐÖãÑ­VžŒîË„/»Õãf™Ù {uk·ŒF Œàľ`d1Œ"@”7Á¨-À€ôÆå)m"©_pþK×@<íˆ]Á}ýݧ‰…mü¸õµ­|¸{Â趾(d1…"$ +µ +Þ„“ˆòDBìüìH ‰„k‹B"Áÿ ‡£Ab1`¼çú¤rL*õ €Ò‚-åeN ±70ÛÏ î‡i*¾û÷DÈñâ>l Fü½ÃúÆ?IñÏ¡â_©â(MñÇN<ð¢L Ø€{…Ñu}QÈb EXhóäÁ  ½b†&DÀáòH‰`ÿùÔŒU‚¡^¢çzÒPˆµi(£Ò¦áˆm@½‰í~\•%äar˜86D‚ÏúrÅŠxÔ@zRw¯‘u˜fí*!HfÀ©!¸¯/Y @¢ €Dm€¤7!!82<#¡cjpGáÅb¿n4z ‡õ… ‹Á ¨- €ô&8ĉ\öÝ=0#•‚ãúÂÅŠ 0Ô0@z V¿æ2w—ðd*3Âì¥@pʇABðZ_²@B€„Ú€Ho"pDÊ$@B®&]apØlÜG@3 ‚»ú"ÅŠPÔ@z#ÅuF€z>Ìž_â5:ÄR1ø­/ Y `¡ˆ ÀBmÀ¤7² "¦@.ŸýÚÁH5@‚¿z"¥Ú‘ ÍŸ`¨Õ·ã)áW I^|éÄc&hìŽ/Ýw˜é°?õ {–j‡½ˆ@;ìµúvØ!¥1ì£ÜU&"½÷΀3=ˆYßù«÷ïBä¹_ ¢Ðü¡bàXGRÂUB:Ö$g®ÃaíûuÏø³_Í£~qœC•‚Ó¦ endstream endobj -1024 0 obj << +1026 0 obj << /Type /Page -/Contents 1025 0 R -/Resources 1023 0 R +/Contents 1027 0 R +/Resources 1025 0 R /MediaBox [0 0 595.276 841.89] /Parent 941 0 R -/Annots [ 1028 0 R 1029 0 R 1030 0 R 1031 0 R 1032 0 R 1033 0 R 1034 0 R 1035 0 R 1036 0 R 1037 0 R 1038 0 R 1039 0 R 1040 0 R 1041 0 R 1042 0 R 1043 0 R 1044 0 R 1045 0 R 1046 0 R 1047 0 R 1048 0 R 1049 0 R 1050 0 R 1051 0 R 1052 0 R 1053 0 R 1054 0 R 1055 0 R 1056 0 R 1057 0 R 1058 0 R 1059 0 R 1060 0 R 1061 0 R 1062 0 R 1063 0 R 1064 0 R 1065 0 R 1066 0 R 1067 0 R ] +/Annots [ 1030 0 R 1031 0 R 1032 0 R 1033 0 R 1034 0 R 1035 0 R 1036 0 R 1037 0 R 1038 0 R 1039 0 R 1040 0 R 1041 0 R 1042 0 R 1043 0 R 1044 0 R 1045 0 R 1046 0 R 1047 0 R 1048 0 R 1049 0 R 1050 0 R 1051 0 R 1052 0 R 1053 0 R 1054 0 R 1055 0 R 1056 0 R 1057 0 R 1058 0 R 1059 0 R 1060 0 R 1061 0 R 1062 0 R 1063 0 R 1064 0 R 1065 0 R 1066 0 R 1067 0 R 1068 0 R ] >> endobj -1028 0 obj << +1030 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [504.314 631.159 512.306 640.727] +/Rect [525.586 617.61 539.579 627.178] /Subtype /Link /A << /S /GoTo /D (chapter.1) >> >> endobj -1029 0 obj << +1031 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [504.859 617.61 512.306 626.632] +/Rect [526.677 604.06 539.579 613.083] /Subtype /Link /A << /S /GoTo /D (section.1.1) >> >> endobj -1030 0 obj << +1032 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [504.859 604.06 512.306 613.083] +/Rect [526.677 590.511 539.579 599.534] /Subtype /Link /A << /S /GoTo /D (section.1.2) >> >> endobj -1031 0 obj << +1033 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 590.511 512.306 599.534] +/Rect [526.677 576.962 539.579 585.985] /Subtype /Link /A << /S /GoTo /D (section.1.3) >> >> endobj -1032 0 obj << +1034 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 566.053 512.306 575.621] +/Rect [525.586 552.504 539.579 562.072] /Subtype /Link /A << /S /GoTo /D (chapter.2) >> >> endobj -1033 0 obj << +1035 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 552.504 512.306 561.527] +/Rect [526.677 538.955 539.579 547.977] /Subtype /Link /A << /S /GoTo /D (section.2.1) >> >> endobj -1034 0 obj << +1036 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 538.955 512.306 547.977] +/Rect [526.677 525.405 539.579 534.428] /Subtype /Link /A << /S /GoTo /D (section.2.2) >> >> endobj -1035 0 obj << +1037 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 525.405 512.306 534.428] +/Rect [526.677 511.856 539.579 520.879] /Subtype /Link /A << /S /GoTo /D (section.2.3) >> >> endobj -1036 0 obj << +1038 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 511.856 512.306 520.879] +/Rect [526.677 498.307 539.579 507.33] /Subtype /Link /A << /S /GoTo /D (section.2.4) >> >> endobj -1037 0 obj << +1039 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 498.307 512.306 507.33] +/Rect [526.677 484.758 539.579 493.781] /Subtype /Link /A << /S /GoTo /D (section.2.5) >> >> endobj -1038 0 obj << +1040 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 473.849 512.306 483.417] +/Rect [525.586 460.299 539.579 469.868] /Subtype /Link /A << /S /GoTo /D (chapter.3) >> >> endobj -1039 0 obj << +1041 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 460.299 512.306 469.322] +/Rect [526.677 446.75 539.579 455.773] /Subtype /Link /A << /S /GoTo /D (section.3.1) >> >> endobj -1040 0 obj << +1042 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 446.75 512.306 455.773] +/Rect [526.677 433.201 539.579 442.224] /Subtype /Link /A << /S /GoTo /D (section.3.2) >> >> endobj -1041 0 obj << +1043 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 433.201 512.306 442.224] +/Rect [526.677 419.652 539.579 428.675] /Subtype /Link /A << /S /GoTo /D (section.3.3) >> >> endobj -1042 0 obj << +1044 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 419.652 512.306 428.675] +/Rect [526.677 406.103 539.579 415.125] /Subtype /Link /A << /S /GoTo /D (section.3.4) >> >> endobj -1043 0 obj << +1045 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 406.103 512.306 415.125] +/Rect [526.677 392.553 539.579 401.576] /Subtype /Link /A << /S /GoTo /D (section.3.5) >> >> endobj -1044 0 obj << +1046 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 392.553 512.306 401.576] +/Rect [526.677 379.004 539.579 388.027] /Subtype /Link /A << /S /GoTo /D (subsection.3.5.1) >> >> endobj -1045 0 obj << +1047 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 379.004 512.306 388.027] +/Rect [526.677 365.455 539.579 374.478] /Subtype /Link /A << /S /GoTo /D (subsection.3.5.2) >> >> endobj -1046 0 obj << +1048 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 365.455 512.306 374.478] +/Rect [526.677 351.906 539.579 360.929] /Subtype /Link /A << /S /GoTo /D (subsection.3.5.3) >> >> endobj -1047 0 obj << +1049 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 340.997 512.306 350.565] +/Rect [525.586 327.448 539.579 337.016] /Subtype /Link /A << /S /GoTo /D (chapter.4) >> >> endobj -1048 0 obj << +1050 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 316.538 512.306 326.107] +/Rect [525.586 302.989 539.579 312.558] /Subtype /Link /A << /S /GoTo /D (chapter.5) >> >> endobj -1049 0 obj << +1051 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 302.989 512.306 312.012] +/Rect [526.677 289.44 539.579 298.463] /Subtype /Link /A << /S /GoTo /D (section.5.1) >> >> endobj -1050 0 obj << +1052 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 289.44 512.306 298.463] +/Rect [526.677 275.891 539.579 284.914] /Subtype /Link /A << /S /GoTo /D (section.5.2) >> >> endobj -1051 0 obj << +1053 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 275.891 512.306 284.914] +/Rect [526.677 262.342 539.579 271.364] /Subtype /Link /A << /S /GoTo /D (section.5.3) >> >> endobj -1052 0 obj << +1054 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 262.342 512.306 271.364] +/Rect [526.677 248.792 539.579 257.815] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.1) >> >> endobj -1053 0 obj << +1055 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 248.792 512.306 257.815] +/Rect [526.677 235.243 539.579 244.266] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.2) >> >> endobj -1054 0 obj << +1056 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 235.243 512.306 244.266] +/Rect [526.677 221.694 539.579 230.717] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.3) >> >> endobj -1055 0 obj << +1057 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 221.694 512.306 230.717] +/Rect [526.677 208.145 539.579 217.168] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.4) >> >> endobj -1056 0 obj << +1058 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 208.145 512.306 217.168] +/Rect [526.677 194.596 539.579 203.618] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.5) >> >> endobj -1057 0 obj << +1059 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 194.596 512.306 203.618] +/Rect [526.677 181.046 539.579 190.069] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.6) >> >> endobj -1058 0 obj << +1060 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 181.046 512.306 190.069] +/Rect [526.677 167.497 539.579 176.52] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.7) >> >> endobj -1059 0 obj << +1061 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 167.497 512.306 176.52] +/Rect [526.677 153.948 539.579 162.971] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.8) >> >> endobj -1060 0 obj << +1062 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 153.948 512.306 162.971] +/Rect [526.677 140.399 539.579 149.422] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.9) >> >> endobj -1061 0 obj << +1063 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 140.399 512.306 149.422] +/Rect [526.677 126.85 539.579 135.872] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.10) >> >> endobj -1062 0 obj << +1064 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 126.85 512.306 135.872] +/Rect [526.677 113.3 539.579 122.323] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.11) >> >> endobj -1063 0 obj << +1065 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 113.3 512.306 122.323] +/Rect [526.677 99.751 539.579 108.774] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.12) >> >> endobj -1064 0 obj << +1066 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 99.751 512.306 108.774] +/Rect [526.677 86.202 539.579 95.225] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.13) >> >> endobj -1065 0 obj << +1067 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 86.202 512.306 95.225] +/Rect [526.677 72.653 539.579 81.676] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.14) >> >> endobj -1066 0 obj << +1068 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 72.653 512.306 81.676] +/Rect [526.677 59.104 539.579 68.127] /Subtype /Link /A << /S /GoTo /D (subsection.5.3.15) >> >> endobj -1067 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 59.104 512.306 68.127] -/Subtype /Link -/A << /S /GoTo /D (section.5.4) >> ->> endobj -1026 0 obj << -/D [1024 0 R /XYZ 85.039 786.531 null] +1028 0 obj << +/D [1026 0 R /XYZ 85.039 786.531 null] >> endobj -1027 0 obj << -/D [1024 0 R /XYZ 85.039 656.613 null] +1029 0 obj << +/D [1026 0 R /XYZ 85.039 643.064 null] >> endobj -1023 0 obj << +1025 0 obj << /Font << /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1070 0 obj << -/Length 3095 +1071 0 obj << +/Length 3142 /Filter /FlateDecode >> stream -xÚíœ[s;€ßó+ü¶öÖZ;º4@` 1{çÁ±Mâű³¶³¿ºK¹EÈn.EÅ«Õ­þºuÜ«Ô?Ü“U´é Y#Nqor±WõÎÔ/ÿØîÄÐ&ežöþþªV¿V¨©šÞèS¨§©oêÞhúGÿÅj9 ²¿Ù?›ÁŸ£7{/G¡âD5¦TWûï½?þ¬zSe›½ -ÑFö¾¨ÏÂMÓ»Øcœ"Ψû¾Ø;Ùû-Ôec=+µ«œJÄ%Í›yÒ ¬êµè ÎQÍ„iG áÁcÆúïtSÆëî/Ô¥þl;Óô…Í`(8í£ÁWUþ‡5 øÛ-Š|ïoß)ÞB¥."Váà–ÌÁ볞ýð>u¹“&b¹ËÛuk—œY€1¢; ÈIÛ¢e­4#¨R!ãAú½áºU\¯ÖËÁRÚÿÏ€×ýñâJ]S?J,+dç’®£XrânB ȹ0ä’VL$ªEÝê/gƒÌÙŠÕ? †*›§3‹w2 ¢ns{bàÏÖö—íøta¡sºsQWèQ¬=q?¡ôÜ€ :•Õ”õ†„!Æw÷óžùPTLEFìçI:\aL”RÒó…´iõ`Øðª?:×Q‹þæâ)ì“Õò“½ð±Âl1kÛ¯œlìê -Žs…ËƵj4ncÛbE™+©úkqXo™²3ƒj=®3ç'3ê :œ}OÆ %¬ÿl©3gq½™oôÏUóî;L; o¼c:æM"çMêt0vv–E­~DT¸QÓ:L}^—SEx1לÏ,óÕ'ÛCþ®.Ï·³Íåx¢²§®Éƒêü|“»BŒbˆ‰;aˆ¹0Ä’Ö±¦ˆ©¹²‡Hnñp®®-gö¢Ÿ¼›kúÓÕØ|V—‡’‰û‡Ð5¸+Â(V@˜8F˜#,i YƒdÃBêvmL–‘î·ó•›°þ¦¿ÏןÝâ¤Â$]û¢Œb”‰S ‡PæÀ(KZÃèIkDw(‰=O®}nmÇ_•‡yƒãÿplunëQ¬ 8rà@(i 9MM„0¶>;UKÑ_]mmæ^&[ 41óxÖÞ ]¹F±×Ä䆸æüØZƒ7Q*Êk _H›&ìZãÈî2±K ;ÜšcûçÃR_ûj¿ü> U5 ¸¿^L…HbË-"EË[5Ÿ -À§IEß¹i›²³+å’!!í‚ ‘Ûê¤q‹z=ôÙU¼ŸµÐJ>ݮԻ­cÊ%bpÊ¥HàðÈ »Ò¢ÖBÍjiãÁ©6v?Ö¬E/Ìg5õ!xòƒ©÷W׈b…HXÀG@Ikˆ.P-}P¯æ‹8=>þ²œ­7çóKµ&âIávÎéŠ;Šp'Ž‡qçÀ¸KZnÆfŽ6s´íyÌFï8õ¿èÏ«õÔ.w8‘¿rÞº¬k ©BDDBi‡  2ð§úh»ð›ø‡v¼ŸhöŸçË3µÎµý¯.ëQ¬ 8rà(i A€ªqAP» Ø·GÌ×vñôÖMí0`:ÊÄŽç³®QÅ -Qð ¹p”´†(¨(b uQ \Œ’ö×ãK³”ž†¥ÀÊâ}8ØW‘P3ù¤Ø;OueÅ -ì -0ûܘ}I«gÏdƒæÙËt°Òë¿­ù©¡é_]è3]»·¢æÊW y‚€wYÇ HÄà Hq€A°Ã0ŠZCˆÑÆOfý¿u3‚ÕÂæý =¬..~<ø:7a¢bâZGDóX©;u¥Å -ÔÿÃÔs~l—qŒZ—wÙ|!mšt'úƒ«ab6×ÎÜáþøâÔì°ÕýÍõf;»°Ÿ'ãŬvï­%Übo­ho«Fm.…îzJ*÷Ö†a²ó>F•‹…*@À ºèb¢ÖVB~ÃÅ®¶¹±.~5_NÝÞ¥=WT¾¼ÚÌ>]-’}ÍO+½}¹¾ðGTªÌÊmv~Ñr¦ÐÔúˆÞ†@©9­ è¢2RÜâd„#Êëotn˜¢†8÷†-ΣÙv±:óG{ÓÙ©Þá<;3K}e¥¿o/¯ì(1~È]—ó@×®+Šº®Ä»0îÜ€뺨ÕØ7Î\m®”¿”‡ŽF6=öí6NŽÞ¿{¡¾üÊ“¨ðiR²îf}ÆkÐx¬æ;OZvìÌ*¸Bƒ›tzð_ßN)ﶎ)•ˆÁ)•"ƒ#7œµú³TZ«´$‚…š±þ‰é ׿ö—7nʾG¤î´sKWÐQ¬:q9…Íwƒ.i  ™D’КXÐ/Ö³é|«75{R„?ºŽb‰¯a¹0á’ÖЧS®F‡@˜Ø>ýhµmìj^ßµff9'zz³Ž}»Iu]ŠUõcí¹sºâŽb܉ãaܹ0î’ÖÐ#AXÀí{n\Jv¯9Ýfç”®˜£XsâpsnŒ¹¤5`®$‚GÌ®ß~éöæ“Sf=¸iß÷¨à:Wt…Å -p7Ãps`¸%­XÚ.›4 Õ¤Nàêg%T"+òý·º›Ö Óy¿ž§áQsNc·èõCTâþ±ò-ëÈ*ƒY¥^Yí0dUÔXIŒ*!Z¬È.VïtjŽÍ£PŸ5ª™ÛN÷û7CÎÉ}M2ßÌ®à¢X\âB -ÝV¸Ã\I«ïAI-' 8ê–8ú¹ÄõÕd{µN9ÝèÑ”Þ+]9G±çÄã0çܘsIkHPÅ»q[–sÒ™þSçáñÁ¾í@ÿª\%à–ÄÒµ¼+Ë(V`™xf™³,i ,™ÒNšK×ÙÚgLõ”g­#úFDÕù +Õ(V šø¦šS-i TId;A©…úatðö¥öx<ms»ò R|Ñ‘0½L; ¯ 2°ÃQŠ[ð˜…w4éáóà­ºô˜Þ<8z®Á]ñE±¿Ä™0Àܘ`I«Gˆ› ÙFÈ-Âýã·m;H]!™È}óÝ"ÔìZìz³ÈÐ×5L*Ë-%µ¾ƒ±¹a鉴?V¼27$™zÂ)ŽÞÏòE̬æüâÆ´NIªiãÍO 2 f’Æu‰™¢OÚucf‡`̵†˜‘5"”´b¦¶1s2zÑDßÏ—gÖã51ó}›»RŒbŠ‰?aŠ¹0Å’Ö@QTKÚ¢(ÜÈ{tðzÿ½]¡j:{ÌãRfsøÆm ºÈf»NŸ{>÷I6·Šê°Ð0vç°\ӺŠbX‰Û`X¹0¬’Ö‹7SÖ‚%SXä§Ò²KêÚ¯6ö‹¹-âc…©y;S(an ϲogkCãšÑL+€I\D¡g'vƒ)i `G\ò˜&€¹Ñ^i¯ÏáÞ“±)Âq}º<×´®°¢XVâ6Vn «¤5À¢U´ KßBô„õ™^lxVá¦FÃe{>4€¦óÉؾ˜Ì›‘Ûå™ëø*þS°¸FtÅÅ -XÁXr`,%­ –ˆÉº[,6‰H$3^ÌÏ–žŽ;½Ô}Ór>ÉäVß}æ¸uEÅ -ˆgÁˆr`D%­QÅPCE±ˆŽŸ¿ÉÖ œÛu‚ü¡u‚«k˜T¶c »k½NHL}¦\nNdV§ -_Ýÿ—¡‰{5Àx«òõTÛÙÆÅJuW;PäÄvŠœ’cÚu—#'7Žœ’V9*›íïèI„œwÇêËa;µZ„p/úc¡c«ƺv­0+Tq™šúú(Y`ž<‹³Ñ_-æ“ë8urïý™ùNÿì% *±E]"¥ä‡VÍÅ8ɵƒaRRé£D$i{k3%…m'÷Sv!b]ð&DbçÉÁ¾êþ•Ù&ÄÒ^ÖÇzBnmBÌþ¦Ç!¦ë8q¶«õlj?« -Tsõq1Lw{q;&» ¤½¢ 9ÎþΚò/éþPu”*½˜È”)Fs®½p/ºD’ï|b@ý§þM‹ßÿÂÝxK»D„¶(E˜ÈåˆQ»Í½Ý{y]™ÄàÿÄÏ–ßendstream +xÚíœ[wÓ:Çßû)ò6ά‰ÆºØ’ …¡,h94Ìy8œ7 m†4éä2Ðo?’u­emj +Z²X¬æâ­½³ÿ?ÝeãA.ÿá(PN«%*(L®òÁ…üæ_Ø\12—Œ‚kžŒþù¼àœ£*¯ã®œ*GEUÆÓ?²§«åˆl;Ó6Ã?Ç/ž]ÁkL©*ö¿ü™¦2„—9¢•|’¯s„«jpuÀ +Š +FÍûÅÁÙÁo®,ýh«®_QP +A㟋àgà#–Ó/ +T2ÞüŽ±áç„d¯O†#Jiöº^Ö³µ~sV_©x^ë·‡oŽå‹’fh8*ò<ù‡UÕW}wOóûÝ’° •œ¹tE‰__ ô‹·¡Æj˜ÅR´ËVR2ŠÀÈڀ䓱Júeå&ƒÂÌXöF‰]¯‡8“ºp6ÛÎÔõÁf(‹¦OÕï…I`_(¼E Eä×AAäÕ¬rPÅÛ†­d`·^êvàâÌêÅN~&¿˜ï0Éë „7€„!< Dä×uòS Ca:‰§«áH¶Ó™Æ`2$<»ÔíŤÄöÛú|¡á($)?—‚?™È¾`h +#I n{``”#,#Â+ªÎ…%aTª±ó ’Çã#{ŠªŽª"ÏÆ—M/¢Æ e¶¹:G’‰ÉjùA}À³÷9f‹Yœ´² ?p &L_ GØ.³I\•J\PTœ4;‡“í`:«WÉKTUDç«é‚›qØìó|R/T5bÙáRU­ÅÍf¾Q_çÕOÝ4þõ˦°gå +ÌÒ,”`%Ž Ýê‚~m7\–190X¸±Ù‹z9•4,抉 ÍÇêƒnn—]η³Íu=‘µ­,É#ífmrú +îÍÁƒÄ‚Ç‚C~à¬BBþµ‚“;þj.?[Îô‡v2Ú|¦^íêæµüx$Èr›Ôô•Û›ri§yRî8@nȯ“›–ˆ²ÂÉMܯÛ’j=U/°¯Ìèû7õ~¾þhfe9~tµÜ¤¨¯ìÞ =H? { ;ä×õö„ ^YÙ‰éíÏnlÝÖŸeªyùO90 î 7  Ä£8 M ä×µy…+-4n,px.ça<[í¶ºE¸Öl6hÒÀõ+ÎÂm¾ú2àÍ-(I2GO¼<ñ*C\pâe¯Q‘q=ñ:Ñk6OŽOÏô\K š—µþón9ÿ¬'f¿iž­†gëÅ45 ¹Ët Œ»]f“RšJiPÔWNÇÚÁt6ЗC/ªWY¸›ŽëÆYU/³ö¡:_½Ø¡;äœï[ç/×L›Ýž530K×ÌP9£8‚të úuÄÒ¿°ÄØ.ýÝF¯™/ý*º¥‘Šïûò»Ób2Û—oШÐGÐùu´0†03°PËóùÂúO?-gëÍåüZÎà9ß“ÑI†Îb_0œÀ…ׇ²$‘{€ +À©ƒ‚ª=el¨°{±zn£Öü²Oêõj=Õ“½B¾Ù7#w†Åd·/-Þ À%Pà%ŽòëˆÁåŒbìÆÌ+=8™(X>ΗÃ×Î~Ù “ܾÀx3˜@8˜8ȯ&§r.I 0¥æHŸ\¹1g>ÌØV÷EMKCÙ~\{bLvûãÍbåh‘$&Ž òk‰a¢B³ÄpCÌx(h¶®¯›•‡©›­ÌŽï»ã#IMÉÄž“.NlN{r˜¥9 õJsÒAšЯㄗˆVvH+ÂÁËJM˜·zX+š*Û]©³zÙJre¶*²oX `LrûãÍ`á`â` ¿˜’ aÖÞ9ª,0ÍâÊÖŒ`V »ru½°ýÑçyƒ“dçF‘Síé0™ìK‡7èT¢ÉógÜk¡“Ér©ààB§½FE&Ì “a…e¯41ë›z£T6©¯šC«êåÍf;»Ò¯'õbÑ̤«œAwYåƒn—Ùä3y|+(*¹Ê9"“Îs)XÖ¾R]@¥_Ê4¦¨"ð’²½FÅ\éL?Ÿ/§ÍÌBåq·™}Ø-‚¥å+µˆ¼¾²Û”òš•Yoþ¤di.š6}JgßGv§ìC?¤]f“ýä®~PÔWdß-43Œ‘ÈùZÁ/òæè]s_I=ov‹‰ÿ¾91ÞìzݯJ39faEõhLÁåsÐ .(uí²¿Wä×ÁÅ *mÁUj¸ÎÆo½†^§ùòB«SþÈ›“¾Š{3@ñ ó€âq€â_§xQ!LYKqnÆ +'Ç/ŽÞêé¿]ÕÊåÜîÜ:q­.Ùl×á“.må­Ý©lÅ‹†¥bì'Ö$¡¯°Þ 6H0Kšïˆòë„e…¼ºh +BaÉ7UVßÆ­÷±Ûè7Í ÷9¦Í-„îŠæ̵{ÒÇv¶ÖDœÜODóƒûŠè̓d"Æ"B~ˆ” œ¶E¬œˆ·šäRhîäæ!gz&Ѹ|XÍ®IB_a½ l`@Ø8@Xȯ ÄDÙ^–ɇj¥/;9TS4««;CÜh¸½5bNç“Z?Ûrª‡Pwª¿¦ñÍ‹¿XBósûJèÍ ƒTÆB~„9Cåm ±–PWNâU¬ó‹¥UÒl½«öq9ŸÄrŃ+VþL5Òüô¾rz3@Î ­€œq€œ_+g…Ì0Ñjž>yÍ«ˆhæBÆî^Ó*SÔÈ—Õ5«Âͬ*ˆóPÝÏ4ß ­Î¥xeö‹ÚÄ<`¥ÞÊ6à\õóÛÙÆ0•ó> Oæ3Ñ0(­’a¼b÷iº §.Α Ñ"<Õp½9•o^Å|U¨ÀÄšÞ/]ÔÈ—ÕÅA\ŽG‚P_œ“öWg‡~dzÕb>¹ñ£Aó ·™í_ð›í¥ž`ê~{¯‡˜k•Ü•¼)v<Úpj‰*"""Ši¢€e c÷MV|YéE  γã#r¯E ˜kÇGgÚ@_·Z·ºÕù2ì^;Enî~$ágf¿'ø¥“Ó*&'vÜß!(Ê®#éò?µÏKþúùûÛDªDjKò‰Ð1jžš<ʤ¯ þ?>.(endstream endobj -1069 0 obj << +1070 0 obj << /Type /Page -/Contents 1070 0 R -/Resources 1068 0 R +/Contents 1071 0 R +/Resources 1069 0 R /MediaBox [0 0 595.276 841.89] /Parent 941 0 R -/Annots [ 1075 0 R 1076 0 R 1077 0 R 1078 0 R 1079 0 R 1080 0 R 1081 0 R 1082 0 R 1083 0 R 1084 0 R 1085 0 R 1086 0 R 1087 0 R 1088 0 R 1089 0 R 1090 0 R 1091 0 R 1092 0 R 1093 0 R 1094 0 R 1095 0 R 1096 0 R 1097 0 R 1098 0 R 1099 0 R 1100 0 R 1101 0 R 1102 0 R 1103 0 R 1104 0 R 1105 0 R 1106 0 R 1107 0 R 1108 0 R 1109 0 R 1110 0 R 1111 0 R 1112 0 R 1113 0 R 1114 0 R 1115 0 R 1116 0 R 1117 0 R 1118 0 R 1119 0 R 1120 0 R 1121 0 R ] ->> endobj -1075 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 754.651 512.306 763.674] -/Subtype /Link -/A << /S /GoTo /D (subsection.5.4.1) >> +/Annots [ 1076 0 R 1077 0 R 1078 0 R 1079 0 R 1080 0 R 1081 0 R 1082 0 R 1083 0 R 1084 0 R 1085 0 R 1086 0 R 1087 0 R 1088 0 R 1089 0 R 1090 0 R 1091 0 R 1092 0 R 1093 0 R 1094 0 R 1095 0 R 1096 0 R 1097 0 R 1098 0 R 1099 0 R 1100 0 R 1101 0 R 1102 0 R 1103 0 R 1104 0 R 1105 0 R 1106 0 R 1107 0 R 1108 0 R 1109 0 R 1110 0 R 1111 0 R 1112 0 R 1113 0 R 1114 0 R 1115 0 R 1116 0 R 1117 0 R 1118 0 R 1119 0 R 1120 0 R 1121 0 R 1122 0 R 1123 0 R ] >> endobj 1076 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 741.102 512.306 750.125] +/Rect [526.677 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsection.5.4.2) >> +/A << /S /GoTo /D (section.5.4) >> >> endobj 1077 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 727.553 512.306 736.575] +/Rect [526.677 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (section.5.5) >> +/A << /S /GoTo /D (subsection.5.4.1) >> >> endobj 1078 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 703.094 512.306 712.663] +/Rect [526.677 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (chapter.6) >> +/A << /S /GoTo /D (subsection.5.4.2) >> >> endobj 1079 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 689.545 512.306 698.568] +/Rect [526.677 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (section.6.1) >> +/A << /S /GoTo /D (section.5.5) >> >> endobj 1080 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 675.996 512.306 685.019] +/Rect [525.586 689.545 539.579 699.113] /Subtype /Link -/A << /S /GoTo /D (subsection.6.1.1) >> +/A << /S /GoTo /D (chapter.6) >> >> endobj 1081 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 662.447 512.306 671.469] +/Rect [526.677 675.996 539.579 685.019] /Subtype /Link -/A << /S /GoTo /D (subsection.6.1.2) >> +/A << /S /GoTo /D (section.6.1) >> >> endobj 1082 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 648.897 512.306 657.92] +/Rect [526.677 662.447 539.579 671.469] /Subtype /Link -/A << /S /GoTo /D (subsection.6.1.3) >> +/A << /S /GoTo /D (subsection.6.1.1) >> >> endobj 1083 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 635.348 512.306 644.371] +/Rect [526.677 648.897 539.579 657.92] /Subtype /Link -/A << /S /GoTo /D (section.6.2) >> +/A << /S /GoTo /D (subsection.6.1.2) >> >> endobj 1084 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 621.799 512.306 630.822] +/Rect [526.677 635.348 539.579 644.371] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.1) >> +/A << /S /GoTo /D (subsection.6.1.3) >> >> endobj 1085 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 597.341 512.306 606.909] +/Rect [526.677 621.799 539.579 630.822] /Subtype /Link -/A << /S /GoTo /D (chapter.7) >> +/A << /S /GoTo /D (section.6.2) >> >> endobj 1086 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 583.792 512.306 592.814] +/Rect [526.677 608.25 539.579 617.273] /Subtype /Link -/A << /S /GoTo /D (section.7.1) >> +/A << /S /GoTo /D (subsection.6.2.1) >> >> endobj 1087 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 570.242 512.306 579.265] +/Rect [525.586 583.792 539.579 593.36] /Subtype /Link -/A << /S /GoTo /D (section.7.2) >> +/A << /S /GoTo /D (chapter.7) >> >> endobj 1088 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 556.693 512.306 565.716] +/Rect [526.677 570.242 539.579 579.265] /Subtype /Link -/A << /S /GoTo /D (section.7.3) >> +/A << /S /GoTo /D (section.7.1) >> >> endobj 1089 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 543.144 512.306 552.167] +/Rect [526.677 556.693 539.579 565.716] /Subtype /Link -/A << /S /GoTo /D (section.7.4) >> +/A << /S /GoTo /D (section.7.2) >> >> endobj 1090 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 529.595 512.306 538.618] +/Rect [526.677 543.144 539.579 552.167] /Subtype /Link -/A << /S /GoTo /D (section.7.5) >> +/A << /S /GoTo /D (section.7.3) >> >> endobj 1091 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 516.046 512.306 525.068] +/Rect [526.677 529.595 539.579 538.618] /Subtype /Link -/A << /S /GoTo /D (section.7.6) >> +/A << /S /GoTo /D (section.7.4) >> >> endobj 1092 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 502.496 512.306 511.519] +/Rect [526.677 516.046 539.579 525.068] /Subtype /Link -/A << /S /GoTo /D (section.7.7) >> +/A << /S /GoTo /D (section.7.5) >> >> endobj 1093 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 488.947 512.306 497.97] +/Rect [526.677 502.496 539.579 511.519] /Subtype /Link -/A << /S /GoTo /D (section.7.8) >> +/A << /S /GoTo /D (section.7.6) >> >> endobj 1094 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 475.398 512.306 484.421] +/Rect [526.677 488.947 539.579 497.97] /Subtype /Link -/A << /S /GoTo /D (section.7.9) >> +/A << /S /GoTo /D (section.7.7) >> >> endobj 1095 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 450.94 512.306 460.508] +/Rect [526.677 475.398 539.579 484.421] /Subtype /Link -/A << /S /GoTo /D (chapter.8) >> +/A << /S /GoTo /D (section.7.8) >> >> endobj 1096 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 426.481 512.306 436.05] +/Rect [526.677 461.849 539.579 470.872] /Subtype /Link -/A << /S /GoTo /D (chapter.9) >> +/A << /S /GoTo /D (section.7.9) >> >> endobj 1097 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 412.932 512.306 421.955] +/Rect [525.586 437.39 539.579 446.959] /Subtype /Link -/A << /S /GoTo /D (section.9.1) >> +/A << /S /GoTo /D (chapter.8) >> >> endobj 1098 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 388.474 512.306 398.042] +/Rect [525.586 412.932 539.579 422.5] /Subtype /Link -/A << /S /GoTo /D (chapter.10) >> +/A << /S /GoTo /D (chapter.9) >> >> endobj 1099 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 374.925 512.306 383.947] +/Rect [526.677 399.383 539.579 408.406] /Subtype /Link -/A << /S /GoTo /D (section.10.1) >> +/A << /S /GoTo /D (section.9.1) >> >> endobj 1100 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 361.375 512.306 370.398] +/Rect [525.586 374.925 539.579 384.493] /Subtype /Link -/A << /S /GoTo /D (subsection.10.1.1) >> +/A << /S /GoTo /D (chapter.10) >> >> endobj 1101 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 347.826 512.306 356.849] +/Rect [526.677 361.375 539.579 370.398] /Subtype /Link -/A << /S /GoTo /D (subsection.10.1.2) >> +/A << /S /GoTo /D (section.10.1) >> >> endobj 1102 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 334.277 512.306 343.3] +/Rect [526.677 347.826 539.579 356.849] /Subtype /Link -/A << /S /GoTo /D (section.10.2) >> +/A << /S /GoTo /D (subsection.10.1.1) >> >> endobj 1103 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 320.728 512.306 329.751] +/Rect [526.677 334.277 539.579 343.3] /Subtype /Link -/A << /S /GoTo /D (subsection.10.2.1) >> +/A << /S /GoTo /D (subsection.10.1.2) >> >> endobj 1104 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 307.179 512.306 316.201] +/Rect [526.677 320.728 539.579 329.751] /Subtype /Link -/A << /S /GoTo /D (subsection.10.2.2) >> +/A << /S /GoTo /D (section.10.2) >> >> endobj 1105 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 293.629 512.306 302.652] +/Rect [526.677 307.179 539.579 316.201] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.2.1) >> +/A << /S /GoTo /D (subsection.10.2.1) >> >> endobj 1106 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 280.08 512.306 289.103] +/Rect [526.677 293.629 539.579 302.652] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.2.2) >> +/A << /S /GoTo /D (subsection.10.2.2) >> >> endobj 1107 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 266.531 512.306 275.554] +/Rect [526.677 280.08 539.579 289.103] /Subtype /Link -/A << /S /GoTo /D (subsection.10.2.3) >> +/A << /S /GoTo /D (subsubsection.10.2.2.1) >> >> endobj 1108 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 252.982 512.306 262.005] +/Rect [526.677 266.531 539.579 275.554] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.3.1) >> +/A << /S /GoTo /D (subsubsection.10.2.2.2) >> >> endobj 1109 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 239.433 512.306 248.456] +/Rect [526.677 252.982 539.579 262.005] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.3.2) >> +/A << /S /GoTo /D (subsection.10.2.3) >> >> endobj 1110 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 225.883 512.306 234.906] +/Rect [526.677 239.433 539.579 248.456] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.3.3) >> +/A << /S /GoTo /D (subsubsection.10.2.3.1) >> >> endobj 1111 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 212.334 512.306 221.357] +/Rect [526.677 225.883 539.579 234.906] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.3.4) >> +/A << /S /GoTo /D (subsubsection.10.2.3.2) >> >> endobj 1112 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 198.785 512.306 207.808] +/Rect [526.677 212.334 539.579 221.357] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.3.5) >> +/A << /S /GoTo /D (subsubsection.10.2.3.3) >> >> endobj 1113 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 185.236 512.306 194.259] +/Rect [526.677 198.785 539.579 207.808] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.3.6) >> +/A << /S /GoTo /D (subsubsection.10.2.3.4) >> >> endobj 1114 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 171.687 512.306 180.71] +/Rect [526.677 185.236 539.579 194.259] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.3.7) >> +/A << /S /GoTo /D (subsubsection.10.2.3.5) >> >> endobj 1115 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 158.138 512.306 167.16] +/Rect [526.677 171.687 539.579 180.71] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.3.8) >> +/A << /S /GoTo /D (subsubsection.10.2.3.6) >> >> endobj 1116 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 144.588 512.306 153.611] +/Rect [526.677 158.138 539.579 167.16] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.3.9) >> +/A << /S /GoTo /D (subsubsection.10.2.3.7) >> >> endobj 1117 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 131.039 512.306 140.062] +/Rect [526.677 144.588 539.579 153.611] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.3.10) >> +/A << /S /GoTo /D (subsubsection.10.2.3.8) >> >> endobj 1118 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 117.49 512.306 126.513] +/Rect [526.677 131.039 539.579 140.062] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.3.11) >> +/A << /S /GoTo /D (subsubsection.10.2.3.9) >> >> endobj 1119 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 103.941 512.306 112.964] +/Rect [526.677 117.49 539.579 126.513] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.3.12) >> +/A << /S /GoTo /D (subsubsection.10.2.3.10) >> >> endobj 1120 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 90.392 512.306 99.414] +/Rect [526.677 103.941 539.579 112.964] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.2.3.13) >> +/A << /S /GoTo /D (subsubsection.10.2.3.11) >> >> endobj 1121 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 63.293 512.306 72.316] +/Rect [526.677 90.392 539.579 99.414] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.10.2.3.12) >> +>> endobj +1122 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [526.677 76.842 539.579 85.865] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.10.2.3.13) >> +>> endobj +1123 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [526.677 63.293 539.579 72.316] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.14) >> >> endobj -1071 0 obj << -/D [1069 0 R /XYZ 85.039 786.531 null] +1072 0 obj << +/D [1070 0 R /XYZ 85.039 786.531 null] >> endobj -1068 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> +1069 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1124 0 obj << -/Length 3444 +1126 0 obj << +/Length 3479 /Filter /FlateDecode >> stream -xÚå]KsÛF¾ëWðHÖ.'˜fptl%qʱI»{HràJ´ÃŠ$&$µ©üûÁ<9ƒnE:–åJ9ôcúûºçBtÒ˜ÿèDKÒðn¢tK$§“뻳fòÞ\ùöŒú;æþ–yvÏ×Wg_}Óš« éšnrõ.êé"»vruóÓôùú~Æôt·tÛÙ/Wߟ_EÅ™iʹUûÇÙO¿4“ãÂ÷g ážüiŽB»nrw&$'RpÿýöìòìǨË]'5Ô -É5‘š×Í 2kÕš´ª()I+Tßs•NftJålÎZ5}ñ懲1¬mˆÎ¶†¦†Û2ºæ™²ÚUÖ -BE·çêÅ˳9ç|ús#››õÝbuï¾Ç ÛÙœNwÓ˜‡ëÝÃfin¤³¹±6%³¹è:û!›¦þÀ®¹""æ$ Í#²ÊæýÄ\ä0y)¼í¥nÛv®*(%|КîVÜj$‡`¤1päh9^½ù¶"‡T¤c, -E¯kž)"5ÂbÏÕ—¯¿±‰ø&1¤'Ãró?{z¹ù§»°¸¾¶§×¦M.sý…þô­9»ZÚ#s­›îì%1Ýî6ööþŽ= -ÄbZ`ÄšÔºQ¬Á‚RêîY£!ÖÔÀ¬Á¬FÖ0S€L¾¬QŽ5Ï_½¾ªkŠ š&ÉãjŠÓ5Ï” ÑF“Fë=_//f”Òé¿3ÚôøÛâ˜Ó $¹]ùzï¾ß/î–[O’ýÒc>{IG®ø‡U ˆ/©Y£ø‚E£Ôó¥væ f5òÅœ-¸¢=W.Î_\&8®7ËóÕÂæ§÷?Ü-»ÕÝ2ÀÜ°¸³G¿ÏBðUKÇü¡k0¦cAq" >40ûFa K„†QáÐ}@Î:ÁÓ¤lÔ…dlr4Ôyf½ì† =Ó ªçL5Cõ|Oh’7¤º5dxhOݤkt:·ñ™Ì¹ ­–“9å1‘W M¯výŽdïÇ!«MgÝб ‰ÁInBaÀ0P«!!Z%—¬ÈÖΈ y’”È”Á9‘ûš?F9”Ò ~ìÙëõƒ'6öÚ½~Íj(ÇÑ^~8= ¨3Ʀ IŒ­Ë!ÔçL~;iøhò'1„üþ&œüµ0ù1«‘üB&EI~êÈo¦X%õEK¸uÄËE}¯kž) ¾èHkš‘{©_z§”a$;w^×ï´9”r?Ži ³ºqÇ+Ûs¼[çVÛíÃdÅvN»_Ý—ÛeÞºSÔ%RÛµÇQ9µj•±`”ºq*×ÀTƬF*sNTSQ™9*_>«8¤&<Š7ƒµšæ™ªáù«T|ÏM`þj³=úë÷ëû¯ì˜ÂüÜPî½Ã¤Úõlê6ùD~0!’ó£µ¹ÔÝ¢ƒQ;³ Á X²ê2îñm¾°ô~Ó/üî»`?£hºGÛ-ù†Ž….‰!ÐeA„¡«€¡Ã¬FèšÖý¶„N\¬ ‚'Y¬Ì”Á‹•¹«çßd‹•6oûiébÕ/<õW6ËwËMœLôƒ«e`Û;+áWumù2kÖ(º`Ñ(uãt©€é‚Y t‘',׶Ùáµí xºdÊ`ºä®æ#ø¦çŒñ:¬qÛù§§„Ÿ¨Þö´q‚Û­âîcaÉtㄤ?eYfÌX¢çSfnº¸‹½CO4€"YSÆP@©¥È€ EP«‘"ª#²)W¸™_áþ×å¹ùvQÓÄt3¦VáãhâtÍ3eC4Q¤azÏÝz”ðÖ+Ý0Á î‡ÊHÓ~¤þ "NjÜ(â`1)uãÄ©€‰ƒYÄi¥áWÄñ‹Ü—ßÕ3$; RÇÍúQe¦j€/Ò*s/áÙ‘™IIvß¼®ÞiFÌt?†•[º# §qËë:àVgPlÔž[o¯.l‰T}~ýn§ë•ßíÝlÝ¥ÝÚ}³2{Šºí¯‹M¨¶: ÐûK»Mÿý}Z„r(ù>*‡°&—ºm“EåPíœC˜Õ˜C’ëåFÓrÈK"‡’*$‡2/æÐ)|‹9„zr(!˜C§p+æêVÈ¡Ì­K›C¡ZºÈÖ?ì ¤¢ô3Z;>Îf²e¢Ì¹‰KNî5UTðÜ£ç6™D#>ÝΔK±£R i}¡¹O$ -%ReÎ#ÄdL#&ͽ´È#î7ü¬ Xàübhµ¹ëTÔqìj³Õ5Ï” õÔ¨ØsΩŽp;ßÀGÜoýû   m&C›„vÀZÔj„V Ò¶c±Mb¶Y”alk`l1«[ÆH£²Ué°}}õêòÙ1»s]+|¾±cáKb|Y …„à«€áìFøM$Ëó[_ï߉óçöËèëÛÕõ_3;À|:E×Ça,²I A6‹1ŒlíŒ,f5 ÑX'H§d†l¾MÑq¿#L¿žÄϼCãG™‰Ápæáp„µáÔ”VÂÉr8·þ¹ß{ûx}+ù€Ñ7z,ŒI 1 ¨h!k`1«¡ÞÚHØ_ÛDUQo|Gvßñ/7¿}™ÿT2”àðû«þžÏ²è†`Œ…7‰!ðf†á­€áŬÆ,•‚ð|=E}IE×7~,œI 3 , gí 'f5Â)¢”.à|êE×7z,ŒI 1 ( cí #f5]ûÀËÊuQtÏÛÕîbé]ìü6¬›¾<„ÙË.Ôg?kyá~ðèžS£â1è›;À$†˜…°v³óšñŽÊü’ʪoüX8“gXÎÚNÌj„ÓX§¼@ó©WU×æ± F)ÃMÂÊ:Œ b2Tjßت³Ü_5¸\ö#ÕÍÒ¦æZª q‰j&ÚÇÄuÀXÔjHMª8ix¶TÛ}A•64~,œI 3 , gí 'f5Â);"4/à|â¥64z,ŒI 1 ( cí #f5Ö[!IÇ3ic Ë îóÛµÅSùEì‘…€Œ…8‰!gÁÐ+¬€!ƬÆLåŒp-rˆ}åe_Båõ­‹gCðÌ" ãY;ã‰YxRM4—%ž,Çó –^ßê±8&1Ç,¢0Žµ0Ž˜ÕXzI˜Îl)-J﫵ûYÈo6;ý+Ø._Ú÷A·ê)”Z€±&1Ò,¸0¤µ0¤˜Õš%Š«Ñ/¨ÒúÆD3IÁ`fa±¬­ƒPb&ãËÀ5¡ºBò‰×Xß豯pRÈ[ÜS8Akëð»Ü“¡¼¶‚´<[`§ìªëkÿ8“ŸJ±Ï¸¶úÖ~‰mÂÞaã -BY[¯ Ì> ÚïQÖÈ¡¿ãcþñûcØŸ ŠÓHhÒih.Í-Aô„K"ü½ž‚ù¿*äïÉþ?z²endstream +xÚí[sÛ6Çßý)ô(ÏV(q#ÈÇ4qÛtZ'µ½»mT[I5µ­V–·Óo¿q;ˆÃ VÓ$öìt­H:žÿ‡@ItÖèÿÑY'IÃû™êZ"9]Þ5³·ú•¯Ž¨{ǽeÞóÅÅÑç_J5£ é›~vñ&øé"ûvvqõÃüùæö˜uóÝÊþ¹;þé⛣“‹à„¦œ·¿ýðS3»Ò)|sÔÞw³?ôã†Ð¾ŸÝ ɉÜýûúèüèûà˾&fÖjì($ïˆìx~T‚à-%¢á3%%i…ŽC¿Ê'ÇtNåñ‚µjþâÕwéÁ0ÎI '†¦Æeá}-€³˜ûËÝýv¥ßHÚÏœ/Dß›?²iò?Økïð–½×’ÚI¦H«¬Ý¾|Û·3ûà +ê¬ð*¥¾M•„Ì2ppŒd€€„Å F-}RkAúöÕW9HöÚÇd}-€³18éÛKõåé—fоŠ4 ଶÿ3O¯¶ŸÙ–——æéͽ>&;ÊÝ ÃÓ×úÙõÊ<Ò¯õóyIÌïv[óöá;óÈCȺîáhMëPEV¾Ô÷ayaXÜ@ÓïÖ"'„)KØóoO/rÄÔÐH½åó¾ÀÙb¢!m÷r=?;¦”ÎÿX1½ÉRæÿõ™çòzíN%Öävy³ºsLíw5ýw0¶\qÅÝÜJxÅTá…•.õ=àÕñÊ3@ðÂâ¼ô³ ZCëìäÅyTïr»ºrú¬—fè;mþeß²[߬ X˛ߎ½Bª¥òïþ–’zúHk•³&ˆj®zˆbûQµJ±‚Rþ›‰Õ¿C°†‡iÁÒb¢þ<Ã&N4éØO/c¦O;cxzþZV=ÒÃaVá‚'ñ<Má êÑi;¥Ÿ¢ ;¬™fÇ[à¬LÌõý^¦ì­ýIb¹ÙÝ@W p¬5¡%J}ãdP¦0R‚pÉRŒ¨ÅHOARˆhOÙ»Aä|-€³ˆ˜NJOþ`¦¢4;Ùè£ê“ó5‘žÅ¶Û¯cd{}eëI¿ÙŒvBO¥'ß»ûÅþãz¯«®íSÔ5À¾}O'YpüUØceK}Ø«"öyöXÜ€}«;“þ›`Ï,öçÏF (iX Ö<­¯p66ÇÓDZ—h¡u.o+›·›ÛÏMkÔ~l(·]qAÝ*óËîžÉ0UÂ'd>XmRßøä ø`q>B&EŠ·ø|—tÞn‡sØoN„}1ܵtÓ¿Ïké¿©K¸’ÔÊÍ™A¹EW”9Ï‘‹d木&“YL.)zÃ,)gå%E˜êÙÉ—`IÑôƒ›¡O¬‡k©á•íêÍjë®…ÜÓÊ“ùÆX¸† ú`‘  +-¬n©ï ´ò ´°¸-¦E—éÔM¯V{Ãà!hTóS\²v]í³ýk—k·ªÀÝõÍ­ëÒý{ëvÚø¿à°–-ŠB°¿HO<Æ*z°Ò¤¾'èÉ3@èÁâzšV ئô¸%꟟èåµD˜KUgü0‚¬¯p6FPO”>˜nNн_D´ÔØë—Û±nÔ´ÿø)±Y,CdXõRßd}²<2,®‡Lö\OÏÒ 5æV©Ï¿Îøbö²ÖÛ=ˆ/çkœM Í%2̳<1Ôé«þ0¹9_¹™­&= Ù«b––.µjéaÒr¾&ÒjÍ®ØKëõÅYúB•©ùfí6‚·®yï6å )˜Õþ¢ }¸Þ3Žáôð.â5Ý_ëéàk†Z™Ô·©ŒlJÃm$ƒòpCã†á¦z"›tÛ‘u“ÃÍÙf¸EgÅáòœn‡È- 747?Ü`‹Ãíi…ᆦå‡Hë·ƒŽ'.ß׶8誈Õ*õ=1ó ˆÅ PkÕËlö~>;;É€‚´­¦ÊùZgcKêŠô\í%[…ª% m“ó5‘®3ëºýRfiuRGV‡IËùšH«ë4Y{Y=7ƒP4âƒ^jÁ¯9Á!WA¬R©ïa ÒâÌ3@Æ 7ŒAÝìÍ¢ûþänWËÍk†{NÎÆÿ“ÁÇCÿ¯p6¾øß’AÖÅÁØ1ÒèÙôA²s¾&²3cCôIMÍeýa®6/ѽŠ~¬b©ï úó ú±¸´qôëwwaVÏu›wn ýÜ^l \n«Ô^\w|¾]Þúýñå¥ÛÙµFàhk0B‹”ú0%ŒF2(c„Æ uf¶ÉŒ˜Åè¥_ü{³¼\…»âÍSý|·þ±¡âr¹[+õ”Ä]—¢VÞh†È ʌțg€È‹Å ò*ªGªHäåÓ]ÂÙ¦KDgH—™¾Œ¼ÙYÞžÝÇ~r+qËSÅVÕÔ÷À]ñ“ # ÜaqwR=ÑO¸ÓÜ9»Ãp!ÜLφÆö»Îô ó`Xgu³¦À!oø§C^,PyX]Sßäå äaqyB ”ûäÉiòœÝaÈ‹Îò@¦Ï®®†û”ïÜÎ#×äZÆ>äbeªÃ +šúž@.ÏA‹Ó²‹V%ȵÓÈ9»Ã !ÈLm³»ûbµ8ÁÛO‡·X–*Þ°j¦¾'xË3@xÃâÞhKzšò¦¦ysv‡á-:Cx™Æ“ëéf{“\Ý©±³êGÇZ,IkX%SßkÅÏ…Œd€°†Å ¬5ZɶKXë¦Ysv‡a-:CX™ºÞæA½­ãê-Ö£ +4¬Œ©ï Ðò а¸~“w=éhAãvsØÖX®¯µtüù'¼Øé Y 0+ÃE*Ã1’A4n€CµºMD6„eÃm‚ð|ºöyáùgnéñ``KVKA°B ˆbÈâgmòðHÐ@@ˈb`3LZN/¾=ö о³Ê®,µ2G3DgPrDè<Di,nZô„* uk¥B¿ÛÃýáÌî+l®×—›ŽòÛ¾«Z- Ñ !("‹oÉ!‹ë/>9—¤e`«…{\a>vŠüÌõ±IïÊT+}4C¤ Òç ÒcqƒôÌÜÚÄé”þn¶’?*É]yj%fˆä ôˆäyˆäXÜÐ÷ýnöªTÒ÷¿¿÷{æóÊÚ%„—ðãÌþ4à?Ë8¼çSGÁ•­…h† $‘Åd€ €Åõ£Ÿõ‚ô +l©§Æ?"½/S¥ôÀ¬,=” ,ýHeéѸAúNÿe©ôOßËâÊS+y4C$¥G$Ï3@$ÇâúÆÏZ5|À8HÞ%ÿd¸×äþ&ôþåÎÝ`ç|÷~Ê·ó'7Õ{a?”lâãRÚU¥Véh†( *Ž(g€(Å ƒ[ +ÂáBN÷Ô×Ǥweª•>š!Ò éó 鱸AzÑ¥ºDú§¾îeqå©•<š!’ƒÒ#’ç ’cqC_×ñKúýôBÎùj¸pß®Ìà”ë÷¾jµ$D3„ H[üHåH XÜ0ø©žÀ+HÂSß“Þ•©Vúh†H$@¤Ï3@¤Çâ集Pž(ÿÔö½*¶:µ‚+DïXwDî,<¢6Ôw|j¾ ¿ƒYj´Â°å?¿Þ™9•OÛ¶{$øÒU¢ÌÊ,@YÊ0ŒdP¦ëÇ>Uœ4œA\ßgO}jïêT«}4C´ Úç Úcqƒö²'¢ã©ö jÿ˜;¿¯O­æÑ ÑÔÑ<ÏÑ‹Ú¿¤çPsš´ÿo7þûæWð]˜ç/ÍwÑ·êq yWªZù£"?‘?Ï‘‹†š!Ú íó í±¸A{Ú‘ŽËTû§vïuqõ©Õ<š!šƒÚ·Å¯©ÉÑ‹Ú}# ßSA({‡vº¼ñ_T {â»BÕŠÍñˆøyˆøX\?à{JWPû§^?"½+S¥òѪ,< ¬{¾,;4üPMGh—©þÔåý/ÀØòÔþ¶L°B~[&¾-~Mû-ÅrPÿ=D­ -[6Â~ÑéÉ…ùí;:uê¾CÜ +~ wd³»pÅÐ÷øaá_1ñ1~ÃU¦úKî½ö÷¡æe¡óð™Ðþg5¬'¬‘c?¬©ÿãïö+rØïw†é»Òj7½¢›qI„›™”ï(¶ï ÿE0CËendstream endobj -1123 0 obj << +1125 0 obj << /Type /Page -/Contents 1124 0 R -/Resources 1122 0 R +/Contents 1126 0 R +/Resources 1124 0 R /MediaBox [0 0 595.276 841.89] -/Parent 941 0 R -/Annots [ 1126 0 R 1127 0 R 1128 0 R 1129 0 R 1130 0 R 1131 0 R 1132 0 R 1133 0 R 1134 0 R 1135 0 R 1136 0 R 1137 0 R 1138 0 R 1139 0 R 1140 0 R 1141 0 R 1142 0 R 1143 0 R 1144 0 R 1145 0 R 1146 0 R 1147 0 R 1148 0 R 1149 0 R 1150 0 R 1151 0 R 1152 0 R 1153 0 R 1154 0 R 1155 0 R 1156 0 R 1157 0 R 1158 0 R 1159 0 R 1160 0 R 1161 0 R 1162 0 R 1163 0 R 1164 0 R 1165 0 R 1166 0 R 1167 0 R 1168 0 R 1169 0 R 1170 0 R 1171 0 R 1172 0 R 1173 0 R 1174 0 R ] +/Parent 1180 0 R +/Annots [ 1128 0 R 1129 0 R 1130 0 R 1131 0 R 1132 0 R 1133 0 R 1134 0 R 1135 0 R 1136 0 R 1137 0 R 1138 0 R 1139 0 R 1140 0 R 1141 0 R 1142 0 R 1143 0 R 1144 0 R 1145 0 R 1146 0 R 1147 0 R 1148 0 R 1149 0 R 1150 0 R 1151 0 R 1152 0 R 1153 0 R 1154 0 R 1155 0 R 1156 0 R 1157 0 R 1158 0 R 1159 0 R 1160 0 R 1161 0 R 1162 0 R 1163 0 R 1164 0 R 1165 0 R 1166 0 R 1167 0 R 1168 0 R 1169 0 R 1170 0 R 1171 0 R 1172 0 R 1173 0 R 1174 0 R 1175 0 R 1176 0 R 1177 0 R 1178 0 R 1179 0 R ] >> endobj -1126 0 obj << +1128 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 754.651 512.306 763.674] +/Rect [526.677 754.651 539.579 763.674] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.15) >> >> endobj -1127 0 obj << +1129 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 741.102 512.306 750.125] +/Rect [526.677 741.102 539.579 750.125] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.16) >> >> endobj -1128 0 obj << +1130 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 727.553 512.306 736.575] +/Rect [526.677 727.553 539.579 736.575] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.17) >> >> endobj -1129 0 obj << +1131 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 714.003 512.306 723.026] +/Rect [526.677 714.003 539.579 723.026] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.18) >> >> endobj -1130 0 obj << +1132 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 686.905 512.306 695.928] +/Rect [526.677 700.454 539.579 709.477] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.19) >> >> endobj -1131 0 obj << +1133 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 659.807 512.306 668.829] +/Rect [526.677 686.905 539.579 695.928] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.20) >> >> endobj -1132 0 obj << +1134 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 646.257 512.306 655.28] +/Rect [526.677 673.356 539.579 682.379] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.21) >> >> endobj -1133 0 obj << +1135 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 632.708 512.306 641.731] +/Rect [526.677 659.807 539.579 668.829] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.22) >> >> endobj -1134 0 obj << +1136 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 619.159 512.306 628.182] +/Rect [526.677 646.257 539.579 655.28] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.23) >> >> endobj -1135 0 obj << +1137 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 605.61 512.306 614.633] +/Rect [526.677 632.708 539.579 641.731] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.24) >> >> endobj -1136 0 obj << +1138 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 592.061 512.306 601.083] +/Rect [526.677 619.159 539.579 628.182] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.25) >> >> endobj -1137 0 obj << +1139 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 578.511 512.306 587.534] +/Rect [526.677 605.61 539.579 614.633] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.26) >> >> endobj -1138 0 obj << +1140 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 564.962 512.306 573.985] +/Rect [526.677 592.061 539.579 601.083] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.27) >> >> endobj -1139 0 obj << +1141 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 551.413 512.306 560.436] +/Rect [526.677 578.511 539.579 587.534] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.28) >> >> endobj -1140 0 obj << +1142 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 537.864 512.306 546.887] +/Rect [526.677 564.962 539.579 573.985] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.29) >> >> endobj -1141 0 obj << +1143 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 524.315 512.306 533.337] +/Rect [526.677 551.413 539.579 560.436] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.2.3.30) >> >> endobj -1142 0 obj << +1144 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 510.765 512.306 519.788] +/Rect [526.677 537.864 539.579 546.887] /Subtype /Link /A << /S /GoTo /D (section.10.3) >> >> endobj -1143 0 obj << +1145 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 497.216 512.306 506.239] +/Rect [526.677 524.315 539.579 533.337] /Subtype /Link /A << /S /GoTo /D (subsection.10.3.1) >> >> endobj -1144 0 obj << +1146 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 483.667 512.306 492.69] +/Rect [526.677 510.765 539.579 519.788] /Subtype /Link /A << /S /GoTo /D (subsection.10.3.2) >> >> endobj -1145 0 obj << +1147 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 456.569 512.306 465.591] +/Rect [526.677 497.216 539.579 506.239] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.2.1) >> >> endobj -1146 0 obj << +1148 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 443.019 512.306 452.042] +/Rect [526.677 483.667 539.579 492.69] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.2.2) >> >> endobj -1147 0 obj << +1149 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 429.47 512.306 438.493] +/Rect [526.677 470.118 539.579 479.141] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.2.3) >> >> endobj -1148 0 obj << +1150 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 415.921 512.306 424.944] +/Rect [526.677 456.569 539.579 465.591] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.2.4) >> >> endobj -1149 0 obj << +1151 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 402.372 512.306 411.395] +/Rect [526.677 443.019 539.579 452.042] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.2.5) >> >> endobj -1150 0 obj << +1152 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 388.823 512.306 397.845] +/Rect [526.677 429.47 539.579 438.493] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.2.6) >> >> endobj -1151 0 obj << +1153 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 375.273 512.306 384.296] +/Rect [526.677 415.921 539.579 424.944] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.2.7) >> >> endobj -1152 0 obj << +1154 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 361.724 512.306 370.747] +/Rect [526.677 402.372 539.579 411.395] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.2.8) >> >> endobj -1153 0 obj << +1155 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 348.175 512.306 357.198] +/Rect [526.677 388.823 539.579 397.845] /Subtype /Link /A << /S /GoTo /D (subsection.10.3.3) >> >> endobj -1154 0 obj << +1156 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 334.626 512.306 343.649] +/Rect [526.677 375.273 539.579 384.296] /Subtype /Link /A << /S /GoTo /D (subsection.10.3.4) >> >> endobj -1155 0 obj << +1157 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 321.077 512.306 330.099] +/Rect [526.677 361.724 539.579 370.747] /Subtype /Link /A << /S /GoTo /D (subsection.10.3.5) >> >> endobj -1156 0 obj << +1158 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 307.527 512.306 316.55] +/Rect [526.677 348.175 539.579 357.198] /Subtype /Link /A << /S /GoTo /D (subsection.10.3.6) >> >> endobj -1157 0 obj << +1159 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 293.978 512.306 303.001] +/Rect [526.677 334.626 539.579 343.649] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.6.1) >> >> endobj -1158 0 obj << +1160 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 280.429 512.306 289.452] +/Rect [526.677 321.077 539.579 330.099] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.6.2) >> >> endobj -1159 0 obj << +1161 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 266.88 512.306 275.903] +/Rect [526.677 307.527 539.579 316.55] /Subtype /Link /A << /S /GoTo /D (subsection.10.3.7) >> >> endobj -1160 0 obj << +1162 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 253.331 512.306 262.354] +/Rect [526.677 293.978 539.579 303.001] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.7.1) >> >> endobj -1161 0 obj << +1163 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 239.781 512.306 248.804] +/Rect [526.677 280.429 539.579 289.452] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.7.2) >> >> endobj -1162 0 obj << +1164 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 226.232 512.306 235.255] +/Rect [526.677 266.88 539.579 275.903] /Subtype /Link /A << /S /GoTo /D (subsection.10.3.8) >> >> endobj -1163 0 obj << +1165 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 212.683 512.306 221.706] +/Rect [526.677 253.331 539.579 262.354] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.8.1) >> >> endobj -1164 0 obj << +1166 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 199.134 512.306 208.157] +/Rect [526.677 239.781 539.579 248.804] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.8.2) >> >> endobj -1165 0 obj << +1167 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 185.585 512.306 194.608] +/Rect [526.677 226.232 539.579 235.255] /Subtype /Link /A << /S /GoTo /D (subsection.10.3.9) >> >> endobj -1166 0 obj << +1168 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 172.036 512.306 181.058] +/Rect [526.677 212.683 539.579 221.706] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.9.1) >> >> endobj -1167 0 obj << +1169 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 158.486 512.306 167.509] +/Rect [526.677 199.134 539.579 208.157] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.9.2) >> >> endobj -1168 0 obj << +1170 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 144.937 512.306 153.96] +/Rect [526.677 185.585 539.579 194.608] /Subtype /Link /A << /S /GoTo /D (subsection.10.3.10) >> >> endobj -1169 0 obj << +1171 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 131.388 512.306 140.411] +/Rect [526.677 172.036 539.579 181.058] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.10.1) >> >> endobj -1170 0 obj << +1172 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 117.839 512.306 126.862] +/Rect [526.677 158.486 539.579 167.509] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.10.2) >> >> endobj -1171 0 obj << +1173 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 104.29 512.306 113.312] +/Rect [526.677 144.937 539.579 153.96] /Subtype /Link /A << /S /GoTo /D (subsection.10.3.11) >> >> endobj -1172 0 obj << +1174 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 90.74 512.306 99.763] +/Rect [526.677 131.388 539.579 140.411] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.11.1) >> >> endobj -1173 0 obj << +1175 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 77.191 512.306 86.214] +/Rect [526.677 117.839 539.579 126.862] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.11.2) >> >> endobj -1174 0 obj << +1176 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 63.642 512.306 72.665] +/Rect [526.677 104.29 539.579 113.312] /Subtype /Link /A << /S /GoTo /D (subsection.10.3.12) >> >> endobj -1125 0 obj << -/D [1123 0 R /XYZ 85.039 786.531 null] ->> endobj -1122 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj 1177 0 obj << -/Length 2719 -/Filter /FlateDecode ->> -stream -xÚåœ[sÛ¶Çßý)ôv¤¡Ä;'“žÔicô¡ík˶¦¶”Hr3ùö ®´›âLâ8òx<"),wñÿ‹ )ÒQcþèHKÒðn¤tK$§£‹»£ftm¾yqD}‰©/2ÍÊ<›ýðïÖ|Û®éF³«xž®!²kG³ËßÆ'«å„éñvî>6“?f?=ŸÅg®)çö´ï~û£]š~YC¨Ì³ü)¥[_ùZœÉ Á™ ã,€qb^#Φ%æ硧[_éZŒÉ Á˜ -c,€1b^Cº•'T £Ø“nrÛ¯,ÕÕõji×ÔW&÷pTƒ•T33˜j®/HuO UÔkhœRuD6:£ú„rm¨|-Îd†àÌ„…q–À81¯g+I'wqx® •®Å˜ÌŒ™ ²0–À1¯1×Jf¼§Ut"ÿA®ý½¡ü!à= X/C-Ød†€Í$†Á–À`1¯±}rMt6’O)Ûºº×ÂŒVˤ*Œ²ð“D\FLš²t‡ä¡'Z_éZ„É a˜ -C,€)b^ÃíJ[Xµq™VZ¿¦¨ÈŠšÓ4=»-³\úŸœÌm¹?¿|e³ó«×³='“šPÍÂÉöœK!…ÿþìù¾S0N„–Ÿ9EøþÌÞwµ7]…`ßâúC¾ƒ®1O¤öKfÈ5–ц¯±2øü†Î\tš0š®±p?õ—û¸>e6>ºÕÿ+³¹ - U§'îö99¬n=R‰83ƒçbƒˆ÷"F½†Þ@hAÚ–gˆŸP¿*_‹3™!83a%…p–À81¯§¢„R±ƒóÀ;÷PéZŒÉ Á˜ -c,€1b^câ•Š˜éVÂèïÁžÇ™“[¡2åYßø¥Ñz!jÑ&3m&2Œ¶ F‹y-TÒÐ6Cû”®¯|-Îd†àÌ„…q–À81¯'7Þ[µƒóЮ¯t-Æd†`Ì…1–À1¯a6%hK:1¶nôzþfB)¿µ³¢·ö~ëIþÔ§9Ø/wžúìïì~|êÓüÔv´l¦ußWîõšÔRNfåLoÉ Êe0eÌkìVNxטÛ0Ÿ9›oX ú¦_»Ù=ð|xÈÉNw XÅÅát¬^ŠZ¸É ›É Ã-€áb^C&æº#švÜ'Ô±†ÊWâÌÌ`œ¹° Î=€8Q¯§j S;4¼_õu®…­†IMaá&ˆ¸ É–·Œ(FA¶'ÙÆE$÷œ“ÛúÎsߧ¾\+K“iÇÙwœpƒµp“B7“Æ[óżÆ*:BUø)%\_ùZœÉ Á™ ã,€qb^#N.IËØÎCϸ¾Òµ“‚1ÆXcļ†™ gŒ4*.è*7“9Y|gŸÚ_]¯{»q³ð?`Û,.Óhwuå§13·jï0£éK{ˆï·7é÷RÃÌîÅPf»°kRê¾:5_ÇZjÉ ¡–é'9D­ ¦†ye£‰dqÝV…™Ééü÷† -ûôŠîð3ÃNÓÃ^õ jÔòMfßLi˜oÌóø²NNÉÄ׆~¶cŸÕv5¬\¬nLfã›ñxxÔA˜JÔ™Œ:D½'5ê5¢Ö”–¡ö÷Ÿ¸LzßY`ºRþ4{Ej'3„q¦¶ã2˜1æ5t²¬UD«¸ˆ¯ýráËÓë@û¥_|3Rœ~û6ý.ˆ·W§–w2CxgÊüË`Þ˜×ئ¥ <­FèÐ=ÿ:ÑÂ…†_‘OíÖ_ËaºjÚø7HŠ=ׂlºÃiØ^–ZÐÉ Iƒ.€Ac^Ã$ˆ “±•Î@gsÚÿ.Ÿ®Tlú[G÷ÃľÛáövúøJwß”—¯]-¯d†ðÊ”ƒy•À¼0¯‘3C)Öíðò“Ö0ù‰ÙFj!9B΀†uêÑ63_ÉZlÉ Á– c+€±a^c>¥ÜàË°±Ú|j:Ös3ü²¨£o2CðfBK á-€ñb^c«4Þ)ÏèfI4G<ÙºûÍ|=Œ¨èãƒæªXË,Z!È’x0±Â; qxQûÞ2Mw€±z`×땽WúÎBëØã¡*X‰+3ƒyåâÀöC½FdŠ“†³d¼Y»è7óa`J0_½Z`É –I+(€qÍHË…ª!»½ï 3Æ)šÈlå¯8¤”§l - TMÂF£óþîÏÞ°2\íó$k ÑŽC—ÛÅòÚ9¸Òñv¾^ö·ÅëðCRˆ˜¾0ðÎ)[HÊt¢BÁìD›¦eø;"©hÊŸYý¦Ü”ë¨ÔNÓìÄüøÏÍv=<¤#¨xÜÓ쇛¥©j›X2CšX†¾.Êàœˆyð%",²R;¦´ð‡%ÖEºW14šá¾²{…h¸}Õ_øÛ v9Ö–xkóê×Öhu¿qß=ë/ì\ï/Wb¾¼tKòZµ(yzjÉ&3„l¦1L¶ &‹ydE:Ö²¼$ëx¤¦Ü§»Z³ÓgöÈ¿)NÕ·k¯U-ýd†ÐÏ8ÀôË`ú˜×@¿„+àûsžÜôá}vqegÝõävñé]Jصޛáºñy Üô:W5…îøgOÖwþÞ¦ ü«qóµ¬Ä–¬`j™~z\éd†¹ È´’²ˆL:d¿.,±K7õùôlöû0dÚOœX‚7Ӷ׾9Ÿ­¶ßÕG«§~> endobj -1179 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 754.651 512.306 763.674] +/Rect [526.677 90.74 539.579 99.763] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.12.1) >> >> endobj -1180 0 obj << +1178 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 741.102 512.306 750.125] +/Rect [526.677 77.191 539.579 86.214] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.3.12.2) >> >> endobj -1181 0 obj << +1179 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 727.553 512.306 736.575] +/Rect [526.677 63.642 539.579 72.665] /Subtype /Link /A << /S /GoTo /D (section.10.4) >> >> endobj +1127 0 obj << +/D [1125 0 R /XYZ 85.039 786.531 null] +>> endobj +1124 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1183 0 obj << +/Length 2745 +/Filter /FlateDecode +>> +stream +xÚíKsÛFÇïú¼-yàóeÉv)ëȉŵIˆDI¬P¤CR«ò·ßÌS “É–c*bÙ.âÕèfÿþÓ˜€0Uú)Ž*Z¤ˆS<ºº?ªF·zÏ»#쎘ºC¦É1¯gG¯Þr9ª«z4» ç©+Äk1š]ÿ4>Y¯&Dwsû±ü2ûîèÍ,œ8q)5§ýýè§_ªÑµợ +ÑZõr…p]3êÖ—GG?†sÙ}ld­ú¾§ +qEó¯yò50ˆÕl$9G‚Éö{è½ áÉT06~q<™RJÇç“)ÿ>Áã‡ùÖ,îìö“»f¹Ô[ÛÝ+½p«—¤¤c4™òª2¬®“µ§ußW7ï°ãD"!cž²ŒonGvácÊÀYM³œA÷܆ YŽgO{È/±JŸ‘TiEöHsÔBörgT|e>{‰Þ¥©}4Ð'DŸG ‡üôDÍêz’¢ß~žL‰¯W[½*8}QÈ]zJ‘G3y’zy€ò*½Þp“N•?~Øiþwî +¶¸jvs³ƒI(\¿ è:A¥À­ Û%ýÔ+yÈWhÓ•þLªye›¥RÐÁ +`óàÎÜħºPRoÂê‡Bî˜øôâN̆y§©lxOÃÄA¿¾k߈r‘ÓN1¿˜oþkêø|c×0+Ͷm÷fy½¹vGú¼.z¸ð£ï2UJ?šô +ý<€>ä74xQ!¥?#ýC™ïCïÒTŠ>šèú<=ä7 gÎ:èµÞcqé)EÍäIêäyrÈo¨õ”"Y%ÈY·ÖoÞ¯o׫‰ùZ/±µ»4•¢fú€>@ù ­Tó¤?Ï…¾½KS)úh Oèóô߀¾Hÿë ?zÅ¥§y4'©|y€òë =¯)ªx2Ï¡Bÿs…éßhéûLÒŎ駆é÷D0Lôë<—5âU2ϵ¾½KS)úh Oèóô߀^pTó.úC­÷X\zJ‘G3y’zy€ò‹+‡œýn¾´ž_½e$9”pTÕæôæ˜ÕÍ­þkzrBJ$ÒõýñÙ{3Ÿóþìç„\!¬Hê.M¥Ø£À=A€Ï#ÈC~zŒ‘¤ƒþÐÛðX\zJ‘G3y’zy€òëË>«"8Aîîýwg—ß‚Õ>ÊÀ§¬P‰Ù° RBÉ '‚a€~}ËgŠ!!h"ƒCÑïCïÒTŠ>šèú<=ä7 —aÌ:èEßcqé)EÍäIêäyrȯbêbŽôXÔ#¶ñq‚12ÃÄOæA€ÛÛŸMoóoÛú›+÷ïysoÖç×þA<^¥(3`ÐŽoOýë(Âe¯TÑ PDBF¨AE䊀ü†nc¨Âaø'üðï|¾³"0¢¸k6s‹úMû$ jH½û^ +\ÆJUÍ$4ä*€ü†K­2QÁ¡Їޥ©}4Ð'ôyzÈo@ªqý¡౸ô”"fò$õò<9ä7ÔüŠ"*TDNzj~˜ú³Ï Úµöðnîºg«v>p2­)ybp‰+C4Ä@õ ò1@~}û§ªF +׉¥¿½OS!úÄl}Š`}OÃèA¿½Ô´e‡ü¡ò{*6;¥ÀƒÀ;æÀ¹hNýÐ +sW0ÌîK;ô;Ù|ù¬¡ïÖ·›Æ,Ü-®ì%`»¸¶³²¾qã¾™]?5e¿6‹•ÙDÌ/…ÂÏ„ôÞ«vçnafk¹Gc8Ÿ†R¬Ñ àš¤›G…üúë9e5Â2¢õc¸ÓùÏffø¾0$t¯Uu˜Ìu°\ÒJ…Í!$@!äB€ü!PŽ!Q®c÷ƒéÇ­wëvŠæj½ÔùÒ Ï|’æ+ÉÂ¥°TÑ E‚GVƒ²È#dù ² U’FY¸_Ø~^P ¯õô ‡§zp¹+ÕC4ôp‘xPy€ ¿¡+Pé£I˜øWnøìtk/óÍÊMì~l7É'éì-Ào  —ÇRmD3@ #@y€6 ¿¾Vš¡Z†;Ê÷%.'ŠÙY€öõS³ôÛªþëÚñhßö~<Øê†Wõ ,>…¢H̆E‘ÂEOâýú"Qú“¤¢Hæþ³Z<%Ú6K«„lj;ΗËéEªú™°uy(eͶIŽ¶y[Èo`+$RRtغY?à{ tMã7@-MO²ÅHjùh¾.¥ˆ£€8Iµ|¡OObÈo¨éœ!'z”üùš®;zôÈ^ÔO[©¢ … …<@ +ßÐÚ™îÿK•H!©ä—æ~ÿp½Ö"° ÛùfÛ}xûÙÑu™(¥ͺI–ºy]Èo «ýRwè’2º·›µ¹¿ÿٮɳDëÒPŠ6šh“ËÁ×¹ôD …ü´˜jÿ]´´ m³\4ÛyÛ5ÇϬKB)Øh€M €Í#ÈÀ2*V¦É"Æû_ÆèGâS¬jÍ>Në‘*§¤?¦E¯K5Ó)ºhîm4T ß<}µ1´M7|µ[¬níö³I+<ÞÍ7«f¹Í“*Ú¯”„&Ó GÜ=g›ÌÁ_H'§Ê“è^h9%ø½œXé|Ã3XrÍMŒb3¦53Ç¿nw›ö¡6†Ù~Ï_ìãô‡OjakL̆[c + PÁp™ý¡£7ê…B¬PÚùóE¼»Õ61ó„-²¤ïÂã7Í•»kfæÛÍQŸLun6Æpý°µû^7Wfpü›=b¾ºÖÛ•äÏR.e¥2ˆf€ € ò@~ƒ ˜>ZÐ\\ü‘ÜC¼[:;}m¶üË>6K±< GÓeµT)Ñ PJB PJ ÈoP +ÕW!?—ŽÍ{xÚÛêw÷±™ãêL«Ÿ,ñ ÉQL'¶&ܵ"sÆßyo/òNzþýmîñ«Í½»ÏÎ0ÝÈ.!¥£9I¶ü­TOdÈo€Lô§ŸÇæòåÂ0¾¶ÝmW×Ïg¯È¿²¶â?Evb˜ÀÍêÖU‹óµyÅêâæ‹É«z–ÍÚe§”x4ˆ'™ˆçü_½òZ¢*yˆ²¯SîiA²>ù¥é|ŸØfƒÐmµÕ€ÖC³l¯ ñèùÏôÅ¡8;g4ªÁ{ÎñDƒñ +ìƒw"émEŠ"æŸ:%¾~yv~aÛÆ[3Ù,–m{zòЩ’òÐïky.£… /Z ·»„Õ°jr÷ÃÃ8}-­(ïÓþGýkªÿú€”¨ÕjhtA©îû©‘®ùŒÚ¾Âàc×î˜$àÿ ­Oendstream +endobj 1182 0 obj << +/Type /Page +/Contents 1183 0 R +/Resources 1181 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1180 0 R +/Annots [ 1185 0 R 1186 0 R 1187 0 R 1188 0 R 1189 0 R 1190 0 R 1191 0 R 1192 0 R 1193 0 R 1194 0 R 1195 0 R 1196 0 R 1197 0 R 1198 0 R 1199 0 R 1200 0 R 1201 0 R 1202 0 R 1203 0 R 1204 0 R 1205 0 R 1206 0 R 1207 0 R 1208 0 R 1209 0 R 1210 0 R 1211 0 R 1212 0 R 1213 0 R 1214 0 R 1215 0 R 1216 0 R 1217 0 R 1218 0 R 1219 0 R 1220 0 R 1221 0 R 1222 0 R 1223 0 R 1224 0 R 1225 0 R 1226 0 R 1227 0 R 1228 0 R 1229 0 R 1230 0 R 1231 0 R 1232 0 R 1233 0 R ] +>> endobj +1185 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 714.003 512.306 723.026] +/Rect [526.677 754.651 539.579 763.674] /Subtype /Link /A << /S /GoTo /D (subsection.10.4.1) >> >> endobj -1183 0 obj << +1186 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 700.454 512.306 709.477] +/Rect [526.677 741.102 539.579 750.125] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.4.1.1) >> >> endobj -1184 0 obj << +1187 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 686.905 512.306 695.928] +/Rect [526.677 727.553 539.579 736.575] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.4.1.2) >> >> endobj -1185 0 obj << +1188 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 673.356 512.306 682.379] +/Rect [526.677 714.003 539.579 723.026] /Subtype /Link /A << /S /GoTo /D (subsection.10.4.2) >> >> endobj -1186 0 obj << +1189 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 659.807 512.306 668.829] +/Rect [526.677 700.454 539.579 709.477] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.4.2.1) >> >> endobj -1187 0 obj << +1190 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 646.257 512.306 655.28] +/Rect [526.677 686.905 539.579 695.928] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.4.2.2) >> >> endobj -1188 0 obj << +1191 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 632.708 512.306 641.731] +/Rect [526.677 673.356 539.579 682.379] /Subtype /Link /A << /S /GoTo /D (subsection.10.4.3) >> >> endobj -1189 0 obj << +1192 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 619.159 512.306 628.182] +/Rect [526.677 659.807 539.579 668.829] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.4.3.1) >> >> endobj -1190 0 obj << +1193 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 605.61 512.306 614.633] +/Rect [526.677 646.257 539.579 655.28] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.4.3.2) >> >> endobj -1191 0 obj << +1194 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 592.061 512.306 601.083] +/Rect [526.677 632.708 539.579 641.731] /Subtype /Link /A << /S /GoTo /D (subsection.10.4.4) >> >> endobj -1192 0 obj << +1195 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 578.511 512.306 587.534] +/Rect [526.677 619.159 539.579 628.182] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.4.4.1) >> >> endobj -1193 0 obj << +1196 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 564.962 512.306 573.985] +/Rect [526.677 605.61 539.579 614.633] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.4.4.2) >> >> endobj -1194 0 obj << +1197 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 551.413 512.306 560.436] +/Rect [526.677 592.061 539.579 601.083] /Subtype /Link /A << /S /GoTo /D (subsection.10.4.5) >> >> endobj -1195 0 obj << +1198 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 537.864 512.306 546.887] +/Rect [526.677 578.511 539.579 587.534] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.4.5.1) >> >> endobj -1196 0 obj << +1199 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 524.315 512.306 533.337] +/Rect [526.677 564.962 539.579 573.985] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.4.5.2) >> >> endobj -1197 0 obj << +1200 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 510.765 512.306 519.788] +/Rect [526.677 551.413 539.579 560.436] /Subtype /Link /A << /S /GoTo /D (section.10.5) >> >> endobj -1198 0 obj << +1201 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 497.216 512.306 506.239] +/Rect [526.677 537.864 539.579 546.887] /Subtype /Link /A << /S /GoTo /D (subsection.10.5.1) >> >> endobj -1199 0 obj << +1202 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 483.667 512.306 492.69] +/Rect [526.677 524.315 539.579 533.337] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.5.1.1) >> >> endobj -1200 0 obj << +1203 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 470.118 512.306 479.141] +/Rect [526.677 510.765 539.579 519.788] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.5.1.2) >> >> endobj -1201 0 obj << +1204 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 456.569 512.306 465.591] +/Rect [526.677 497.216 539.579 506.239] /Subtype /Link /A << /S /GoTo /D (subsection.10.5.2) >> >> endobj -1202 0 obj << +1205 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 443.019 512.306 452.042] +/Rect [526.677 483.667 539.579 492.69] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.5.2.1) >> >> endobj -1203 0 obj << +1206 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 429.47 512.306 438.493] +/Rect [526.677 470.118 539.579 479.141] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.5.2.2) >> >> endobj -1204 0 obj << +1207 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 415.921 512.306 424.944] +/Rect [526.677 456.569 539.579 465.591] /Subtype /Link /A << /S /GoTo /D (section.10.6) >> >> endobj -1205 0 obj << +1208 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 402.372 512.306 411.395] +/Rect [526.677 443.019 539.579 452.042] /Subtype /Link /A << /S /GoTo /D (subsection.10.6.1) >> >> endobj -1206 0 obj << +1209 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 388.823 512.306 397.845] +/Rect [526.677 429.47 539.579 438.493] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.6.1.1) >> >> endobj -1207 0 obj << +1210 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 375.273 512.306 384.296] +/Rect [526.677 415.921 539.579 424.944] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.6.1.2) >> >> endobj -1208 0 obj << +1211 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 361.724 512.306 370.747] +/Rect [526.677 402.372 539.579 411.395] /Subtype /Link /A << /S /GoTo /D (subsection.10.6.2) >> >> endobj -1209 0 obj << +1212 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 348.175 512.306 357.198] +/Rect [526.677 388.823 539.579 397.845] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.6.2.1) >> >> endobj -1210 0 obj << +1213 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 334.626 512.306 343.649] +/Rect [526.677 375.273 539.579 384.296] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.6.2.2) >> >> endobj -1211 0 obj << +1214 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 321.077 512.306 330.099] +/Rect [526.677 361.724 539.579 370.747] /Subtype /Link /A << /S /GoTo /D (section.10.7) >> >> endobj -1212 0 obj << +1215 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 307.527 512.306 316.55] +/Rect [526.677 348.175 539.579 357.198] /Subtype /Link /A << /S /GoTo /D (subsection.10.7.1) >> >> endobj -1213 0 obj << +1216 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 293.978 512.306 303.001] +/Rect [526.677 334.626 539.579 343.649] /Subtype /Link /A << /S /GoTo /D (subsection.10.7.2) >> >> endobj -1214 0 obj << +1217 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 280.429 512.306 289.452] +/Rect [526.677 321.077 539.579 330.099] /Subtype /Link /A << /S /GoTo /D (subsection.10.7.3) >> >> endobj -1215 0 obj << +1218 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 266.88 512.306 275.903] +/Rect [526.677 307.527 539.579 316.55] /Subtype /Link /A << /S /GoTo /D (section.10.8) >> >> endobj -1216 0 obj << +1219 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 253.331 512.306 262.354] +/Rect [526.677 293.978 539.579 303.001] /Subtype /Link /A << /S /GoTo /D (subsection.10.8.1) >> >> endobj -1217 0 obj << +1220 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 239.781 512.306 248.804] +/Rect [526.677 280.429 539.579 289.452] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.8.1.1) >> >> endobj -1218 0 obj << +1221 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 226.232 512.306 235.255] +/Rect [526.677 266.88 539.579 275.903] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.8.1.2) >> >> endobj -1219 0 obj << +1222 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 212.683 512.306 221.706] +/Rect [526.677 253.331 539.579 262.354] /Subtype /Link /A << /S /GoTo /D (subsection.10.8.2) >> >> endobj -1220 0 obj << +1223 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 199.134 512.306 208.157] +/Rect [526.677 239.781 539.579 248.804] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.8.2.1) >> >> endobj -1221 0 obj << +1224 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 185.585 512.306 194.608] +/Rect [526.677 226.232 539.579 235.255] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.8.2.2) >> >> endobj -1222 0 obj << +1225 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 172.036 512.306 181.058] +/Rect [526.677 212.683 539.579 221.706] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.8.2.3) >> >> endobj -1223 0 obj << +1226 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 147.577 512.306 157.145] +/Rect [525.586 188.225 539.579 197.793] /Subtype /Link /A << /S /GoTo /D (chapter.11) >> >> endobj -1224 0 obj << +1227 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 134.028 512.306 143.051] +/Rect [526.677 174.676 539.579 183.698] /Subtype /Link /A << /S /GoTo /D (section.11.1) >> >> endobj -1225 0 obj << +1228 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 120.479 512.306 129.502] +/Rect [526.677 161.126 539.579 170.149] /Subtype /Link /A << /S /GoTo /D (section.11.2) >> >> endobj -1226 0 obj << +1229 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 106.93 512.306 115.952] +/Rect [526.677 147.577 539.579 156.6] /Subtype /Link /A << /S /GoTo /D (section.11.3) >> >> endobj -1227 0 obj << +1230 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 93.38 512.306 102.403] +/Rect [526.677 134.028 539.579 143.051] /Subtype /Link /A << /S /GoTo /D (section.11.4) >> >> endobj -1228 0 obj << +1231 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 79.831 512.306 88.854] +/Rect [526.677 120.479 539.579 129.502] /Subtype /Link /A << /S /GoTo /D (section.11.5) >> >> endobj -1178 0 obj << -/D [1176 0 R /XYZ 85.039 786.531 null] ->> endobj -1175 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F14 969 0 R /F20 937 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj 1232 0 obj << -/Length 3005 -/Filter /FlateDecode ->> -stream -xÚíœÝoÛ8ÀßóWøíìÌÅOÝË¡W´»Y4ÙnãvØÝÅV]cc;g;Íõþú~Ó–ÈD Ò¦IQ ¶,~Œæ73$‡Tð €x *H5’#Fð`º<*s¸óã¶%ƶÈ8*ó¯ÉÑ/9Ü-PUTƒÉ{ßNU VñÁdöûðùz5*åpטíèÏÉÏG/&¾á¨kLˆjö?G¿ÿY f ÂÏG"•\Ã÷áª,(#ˆQb¯/ŽÎŽ~õm™{t`ju=-*U Ƥ@RÒÎ2¸”ˆ ÊâTøG-ãGŸD—WH=+.GÐC1<«—çõhL¸þv<ÂÃÓÑÏÔ|x¼Ú5u½ª/àVK´ª ÝAÔ·¹³™Ì—7ñã˜ÂyIZT‚r|Ø-Ãø Û¶îJŽJ¡.³öq -f±Ò¬j-QˆŒÒYY‚®N•’¾I:¬ke3ÕRèM -1DP´ ðhÑÕþGîÞ×­ÞuïGQ Z`¯¨–Æ;ÍÁÕGÕÚÛÎD[€z"KÄ ŒKŠ(“78`7ø”)£­ƒ—š|hŒC½½„O<œ®—à=‹ÕÜüzöìÄ~ù´…ßwÊZšeÊ·¼·q­Œ¼ûíi=–)=úf’~5G(o¾˜!†«œ« € [õ9ç:k¦W›…ÖM)†ŸŒŸ©ë•ùºÓ -&tø7õ[sm.”^1ü4&þ’îpOÞd5Ó×›BµŒ7EZO[A[€k[4ß«cÍÕHK=ëÒ²Þ´z5Ó#ÌzeÁ¾‡‹ ¸¾x{züoøVȯòÓHOÆQµ4ãXÛœ$wdœíÕ3UUéÃø'à @/š­ª.µ#¿©§z°ÜZß÷où6TWaSVâÁ´Þf¨–©5 ³-@f®W“DaújaRóU­æ8Ÿ¢‰ŽæÇKòMLh¾Ü|È©¯¯A„jƒˆÐ¤ ¢-@Ú r½bX«.œVHVÔ„¯9¥Ãg——ʽÓz·€%Ô˜ãâ¡°¹'´V}цj´‘’ÓhÛ¤Ñæzõh G„²€¶4hÍdBñ1¬‰+X;—_OõÄb²äŽ¯ÕF_¾¡Z†o¤é4߶i¾¹^=ß²D¢Šø’¾jî¼!ªÏ®ÜX‹/Ô¿ Z«ˆ¾hCµ ÚHÉœ¦Ð¶H£Íõê‡é¢B%å-³óêX5¥zÈ#ê=¡·Šê‹>TË  ¤Ñ·H£Ïõ꼚U ñJxôn@>»àbØè½€¥U·%¨»ÿBmÝÊ@”²B…”¾“Ó°¦ÝÉαkk5Ö~¬²*áxï±.ëívv®b.¿º™% +z¨>†•ÕÅaÛYÃê iXÙ^½aÉa*ƒaÙé@—™aQù*w2ÛÖ8j¬ÃLàI(+÷„¬gj RàG¹I™]PR/³Ëéö°í¼ÙµH›]®W7”1.³°fÇÍPvÒ,×›<©Wõ¼YêÐeviTR?¶¡Ê)¢/ÚP-ƒ6Rrm[€4Ú\¯-c¨ ­0h'#I†zª9Üéï\Ï:å÷‚eeµÖ×BµŒDD8KÙA[€»í©0¢ö[q~SÅÒÆBͮʫzÎo6&M‘ ³[91ß_ÂlÌèzD -˜êÀ[ð…2®©ÞÌüt©Mm½Jl¹DÞbÏ%û<-jMó”¦CCwÙva è›¶4Õfi©Ûu96ñt³?KœzßT™ý$üSsF«¶¾Îªeœ1B’6‘¶é œëÕBA­ˆ3»%ó“Þʶ™÷™7‡½LýÎ|^« ºõæ/(ôÏÑXö¸WN_}- TËX@Ä"mmÒëÕY……YE½Ø ›‰Û`Ý.àsÀ«ÖaÊ®íÖÍf³ˆ$쑧{’zbª¥±Ç¸H`ïàn£0å QÉò£°+¤mƒ™Qød­54€-¨-Û&u*(êâÃhV ƒµªª”ªBCŸy*èP”n¿aUÄ&ݘBŸÍ>Ž˜šž˜• LGæ.j -ö„§±N[}(TË8PD"mm’q3Û«çO$"R8þvä|µ®gn£‚äRÁ_ë\ÜìJ{‹µ.ñÓoÕÔ|¨–!Hƒo ŸëÕeÆ(„WI¤ïS®ÚÝw‹©8—‡)w!ÝVŠSE_¸¡Zn¤æ4ܶi¸¹^=\(\Ê®Ûý àn;÷Y¶²èjZ\²Gت£/àP-8Rup[€4à\¯.l“J A*ØNwSGx7‹Ýb@C·ÔK +íÄ’UO"l;5õUKƒˆ"¾C€$øl¯Î³‰¤îQP§Ì>Ô7N[oß6~®«¾LÍ—ø¼Út½²Ë¡ù•¯ìU.ÉWq^ûÄ}úZ‚A—i€­Þï¶`!¬Èe~Áâ -iÊÜ,XÞ¼~nr†¯A½l™Ïës‹S¥o¿¤‰„¸Å’&+òA‹Z—©síQCùÌ`™]×&¿áü&¡aé4è—5çz -»¾Ú9‹òû9¿}G³:ëëi¡ZÆÕ"iûh –¹^½å™ÄY]Üüجš;Kð‹yÓeóqáâÝ5ØHõD†G«Ÿ¾ÄCµ ñH÷iâmî^õÆû ù WH›…0áõÝ˳(Šâýen"Š†¾nEs’´¨u–zŸ!jè3C‡¢túNYQÄK›.‚ú„ªšbÔ>©Z›ÿ(XW¯•K­u–uñ_¸†Ÿ±)ðîåȼ”žwÑ: S_ò-./œªzºQT-íF1†¤It œÙ^Ý,³”BxønšéñÏãºh©ÕÙtþ /ú2 Õ2L#í¦™¶H3Íõê™rX1µ9ë­Æ]ÞùEÓvÖõ¥Ù:ÛÔa µÓ‡M -¡b–«ÕB_®¡Z†k¤a‘:Ò!@šk®W¨o%¤ãZêÃóîµÝwÍ”¸Ù™­RõÕžI²o0ÙõÅ~ȯÍ]3hª¥åÕ¹!Áì—]³toIüÔ¿ñ¸£>o‘ùÌJxТÖ]j5t—“嘔ˆ1zÃHUbhȦ?¥K¾Ó¯yl¶`ãîx¥øÉï9eõõªP-ãUˆ´e´HÇÃ\¯!s Pé’*ë8fòœßw±×Z_;Õ2vIÛA[€»í'IXJDÇ:ƒ«-£M¥2±õùzµÛ,ίvþ¥Míæ|“©¡£[DÔœTûíim¥Öס™Ï§…:`ŠgÝ7Õ˶æu«ÏÿÓ’á$³DUr‡™ÀS”r@¢v»±½œ!1˜Ù2‘Àÿú¤Xendstream -endobj -1231 0 obj << -/Type /Page -/Contents 1232 0 R -/Resources 1230 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 1229 0 R -/Annots [ 1234 0 R 1235 0 R 1236 0 R 1237 0 R 1238 0 R 1239 0 R 1240 0 R 1241 0 R 1242 0 R 1243 0 R 1244 0 R 1245 0 R 1246 0 R 1247 0 R 1248 0 R 1249 0 R 1250 0 R 1251 0 R 1252 0 R 1253 0 R 1254 0 R 1255 0 R 1256 0 R 1257 0 R 1258 0 R 1259 0 R 1260 0 R 1261 0 R 1262 0 R 1263 0 R 1264 0 R 1265 0 R 1266 0 R 1267 0 R 1268 0 R 1269 0 R 1270 0 R 1271 0 R 1272 0 R 1273 0 R 1274 0 R 1275 0 R 1276 0 R 1277 0 R 1278 0 R ] ->> endobj -1234 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 754.651 512.306 764.219] +/Rect [525.586 96.02 539.579 105.589] /Subtype /Link /A << /S /GoTo /D (chapter.12) >> >> endobj -1235 0 obj << +1233 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 741.102 512.306 750.125] +/Rect [526.677 82.471 539.579 91.494] /Subtype /Link /A << /S /GoTo /D (section.12.1) >> >> endobj +1184 0 obj << +/D [1182 0 R /XYZ 85.039 786.531 null] +>> endobj +1181 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F42 967 0 R /F20 937 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj 1236 0 obj << +/Length 2945 +/Filter /FlateDecode +>> +stream +xÚí\ßsÛ6~÷_¡·£nF(A$p/7¾LÒ¦»®­än¦í-)²¦–è“丹¿þÄB"±6í»Žk2±$ +‹]î÷a±À‚¢ƒþÑ$ejPÈœF“åQ:˜Ã7ßQÛbd›Œ‚6ÿ}÷Nš•ªÁø³ïG¥D¨|0žþ’¼©VÃL&Û™yÙ ÿxôvì;TSÆt·ÿ>úå·t0~`z=àªå3\øxÀ_Ï6xý±çåd¦ãê&ŒÌÅ Ä ×ñXªâÔp#‚€mŽ½«9¦Ë¬_=ÆÜ`ü¡Ô¹ÃWý§†t=¬aÍ3ö"F÷³ä‰ñs_ªx)„- ‚’G ÓRpQJ!áŠrYÀ%êy£Ó‡œóäøæF‡Å¤Ü. å4}yþà\Ö“Xœ!qtXgª×Ó à„‰¬¡Afh`òmúïÍ*dHm Ñ9C9±ùº”ù+¦ƒu]_:4bX:´-@è€éõtÈa™“Š§Û£ƒ^(TÃPbzë’šþYÓʳ¤uY_4b 8´-@h€éu9¬`I&¸£°‹Œ:/<¤M¬KûÒ¤ChÀ…ФmBL¯Œ‘"mhârˆ‹ G‘ÌêibkÎnÖèoÿ¾‰MÙÚËÉrJ$¨uJîÝç‚ÅnѽË5r}‚ÎÚ·•å‚¤RîÜÖM¹ÙL/uŒ£Ù Š\16·ß‹„˜×öû¾‡„m bz= 3€\ˆ†„6ƒé •Z:÷"O¡”ëktÖa¤„ĺP;F–S½Ké72->V[Ö!Ñ&Ü#¹³ûÚ¦Kë²¾4hÄp 4h[€ÐÓëh #©p¥RŒ‡’%ulõ¶½®x@F-;4}9ãüÛ“3Xœ3!v2q¦Ã‚hA-ã„ ‰ÔDý*…Ô\›šUÜÔ>”+ˆ(¦žf¶wó"9Õ›÷gCËø.¥Ý Y +yüYÛ†o5 'kÝüëMÍÉj«´>¤Ò†ÞÐ~Ÿµ¯‹¨¯›®ðJ[†VÚDiDQÜ3r´vEî*mvkd½›×NÌHÖ{g,-ãöãÖz·ï¸mÄq ‡p©mA<Ö£z=c8%ÂñÅá~¨4_l eêY³SsÙš×;]»­Ö¿C£¿GE!\±xÖ~íË'„ðÄã…°d_7‘¸FÏЬu±Å¹±+Ðo–š—@½Õ¹³eº_SófýÌDz †к³/51„TRFéѶài“Ê`ËðÉ߶©I$ÌäRé™ pæV×ûg›èìݨxÐìY´ß§6I¥Qg5]Eg÷Œéd\*¢¸ó›¸§_†BgFõü /_…8äØfΡ=‡Y f!XqætXè^O’"'LqG;[¨Ê©[é°»Ô㩪76§fXÙy;—ô@’]’X‡ö%I#†$ !IÛ„$˜^·ÍÈóŒHwÎHâ÷ºë“UÛÅÄLÛËýºHQ¼âÚ˜sZ_"4b@"´-@ˆ€éõDàŠdö¨nMW1¿ÒDXϦá—;tšŸ‰WLë¼¾„hÄBÀ(%DÛ„˜^?}0A +w¢Y¸DþŸCÉ“õb»XøóÝà0Ô‰™R¨ÃÔ±Kë̾iÄ‚@!i[€Óë#F³…jÒ1uÐä;}¨òª\»Ä†‘MýÁ§»±ÏœT+»"œßziRg.:7aÏ="Xçô¼CÞ¶àIë6¦ +R0|ÓÖµ©)‘›uÛùÙ³c{¦á¾Õ0Îçå¥Å^o̺•Ý­çDteñ•jó~Ÿµ;£'[ƒ®žòS‚äôžÃîL—Wýêu«Û-ð¿È^92­s{ÌF*>.صÔÇÃ0¦Ôs¥HIΩ#‹]å}?[ÍÖî„ÊO_êÓë/ Gï€Jê0GïÃz²/31„J7Úà![ݲ9D™á!Û¶©ùS˜ýé&É… Ûut¦»›±èÜè{PtÆÌÛï³ö\ôüMÐÕ#÷Ýöél,#9³ûn…‹Ì~s[ç:¥ßà.ÍÅ_S‘ž 3•Tõv÷âø +®Qó-¸ÚxÆéuë醧ìtÖ£}]#† º-„:m ˆŒéu‰1£Š¤’{–¸ÄØódFgHx[ÿ<Ëçúq%&òW±rv¾ê‹#†àà€à߶ÁÓëñOL4øÛ­”3=²+SõÒSñåõ¬ªS=]—îˆB$6˜]%¾Xõå@#†p ÀBE¸tX€pÓëfŠLQ¢dî8íÍïÃA_Ë_“ä϶¦¤®ßÚÃsö™E»jÚlJóí§w–C›ÛKC +Œ±o¶³¥{.rè—áþ¹éÖûß@ëÜÐÚ@,mèb­nwX‡Õë†wVHÂY­ ïïWõãé‹òzñŸ²A4ô÷z6_4ô#ʶ‘èòêKÃÎ)}nÄ ‡#@·-@€Æôz sN¤, mß9ðÉ“p¥4ýÝ•yRÝp€+öi›éÙ=¯UÇ–Ø´ÞOƒA.xñ ¶né u#†@¸\E$tX€@éõáZP˜tPÛÍî7s=Ï–Óp·{kN8ícêž"÷Q}Ä ù’“w Ty¯=” Fjˆu1a·ï‘4ºËÙaBL±õ°À.¤òTpὓ ÁOM° 'uAßF|FÒ²~òøªY¶Š©\>'Píý÷µC@ }‹€Ú6SìÇwÆIæWdö×.ª¥¼ÕVã3uØA}CŒ3ûÄK!ü`J£Ùz[?ÂD«ñp)÷ÞÿdÀûåÍõ¬®wÏܳ+zDÏO/ÎtôøüíéØ\ü|»òg¤õï;U«Vý¼²6ëosç}‘ôR’O$[ú$­Iª`¹í6Ëæ±ÿ”?õ•Ÿ?¾uHÖ ÔÙ—9µóðËÉË Î#=!Äâïx;r‡ O*DÒ"#¹Äº6µiÒìjŸVf¼1ûÚÛÊToÊÉïõc#óÙºcg;5÷ÐèDÝgZã&î÷iÜMvƒ¾žRx¤hÍïÙߦBÊl–nûSý(×zCÂäœJŽ„Ö­}a#† Â2„Emâ¡Uì¹Â´Ž+v‡ë¤ë(©0›Ù‡:u/ÒXÿö%M#†&Ä!MÛ„'Õ#!FAœÊñÈmÛÔ¦)¹ßT«ízqy»õ¿›9±GFfрݨzPÀÆ,ÛïÓxME½Öôõˆ€BȆ6EÖý¥þ)óÖãÕÏ \+y ++ßL˜ ÜÕТÛç¦M`ð9”Ýendstream +endobj +1235 0 obj << +/Type /Page +/Contents 1236 0 R +/Resources 1234 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1180 0 R +/Annots [ 1238 0 R 1239 0 R 1240 0 R 1241 0 R 1242 0 R 1243 0 R 1244 0 R 1245 0 R 1246 0 R 1247 0 R 1248 0 R 1249 0 R 1250 0 R 1251 0 R 1252 0 R 1253 0 R 1254 0 R 1255 0 R 1256 0 R 1257 0 R 1258 0 R 1259 0 R 1260 0 R 1261 0 R 1262 0 R 1263 0 R 1264 0 R 1265 0 R 1266 0 R 1267 0 R 1268 0 R 1269 0 R 1270 0 R 1271 0 R 1272 0 R 1273 0 R 1274 0 R 1275 0 R 1276 0 R 1277 0 R 1278 0 R 1279 0 R 1280 0 R ] +>> endobj +1238 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 716.643 512.306 726.212] +/Rect [525.586 754.651 539.579 764.219] /Subtype /Link /A << /S /GoTo /D (chapter.13) >> >> endobj -1237 0 obj << +1239 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 703.094 512.306 712.117] +/Rect [526.677 741.102 539.579 750.125] /Subtype /Link /A << /S /GoTo /D (section.13.1) >> >> endobj -1238 0 obj << +1240 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 689.545 512.306 698.568] +/Rect [526.677 727.553 539.579 736.575] /Subtype /Link /A << /S /GoTo /D (section.13.2) >> >> endobj -1239 0 obj << +1241 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 675.996 512.306 685.019] +/Rect [526.677 714.003 539.579 723.026] /Subtype /Link /A << /S /GoTo /D (section.13.3) >> >> endobj -1240 0 obj << +1242 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 662.447 512.306 671.469] +/Rect [526.677 700.454 539.579 709.477] /Subtype /Link /A << /S /GoTo /D (section.13.4) >> >> endobj -1241 0 obj << +1243 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 648.897 512.306 657.92] +/Rect [526.677 686.905 539.579 695.928] /Subtype /Link /A << /S /GoTo /D (subsection.13.4.1) >> >> endobj -1242 0 obj << +1244 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 635.348 512.306 644.371] +/Rect [526.677 673.356 539.579 682.379] /Subtype /Link /A << /S /GoTo /D (subsection.13.4.2) >> >> endobj -1243 0 obj << +1245 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 621.799 512.306 630.822] +/Rect [526.677 659.807 539.579 668.829] /Subtype /Link /A << /S /GoTo /D (subsection.13.4.3) >> >> endobj -1244 0 obj << +1246 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 608.25 512.306 617.273] +/Rect [526.677 646.257 539.579 655.28] /Subtype /Link /A << /S /GoTo /D (section.13.5) >> >> endobj -1245 0 obj << +1247 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 594.701 512.306 603.724] +/Rect [526.677 632.708 539.579 641.731] /Subtype /Link /A << /S /GoTo /D (subsection.13.5.1) >> >> endobj -1246 0 obj << +1248 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 581.151 512.306 590.174] +/Rect [526.677 619.159 539.579 628.182] /Subtype /Link /A << /S /GoTo /D (subsection.13.5.2) >> >> endobj -1247 0 obj << +1249 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 567.602 512.306 576.625] +/Rect [526.677 605.61 539.579 614.633] /Subtype /Link /A << /S /GoTo /D (section.13.6) >> >> endobj -1248 0 obj << +1250 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 554.053 512.306 563.076] +/Rect [526.677 592.061 539.579 601.083] /Subtype /Link /A << /S /GoTo /D (section.13.7) >> >> endobj -1249 0 obj << +1251 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 529.595 512.306 539.163] +/Rect [525.586 567.602 539.579 577.171] /Subtype /Link /A << /S /GoTo /D (chapter.14) >> >> endobj -1250 0 obj << +1252 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 516.046 512.306 525.068] +/Rect [526.677 554.053 539.579 563.076] /Subtype /Link /A << /S /GoTo /D (section.14.1) >> >> endobj -1251 0 obj << +1253 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 502.496 512.306 511.519] +/Rect [526.677 540.504 539.579 549.527] /Subtype /Link /A << /S /GoTo /D (section.14.2) >> >> endobj -1252 0 obj << +1254 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 488.947 512.306 497.97] +/Rect [526.677 526.955 539.579 535.978] /Subtype /Link /A << /S /GoTo /D (section.14.3) >> >> endobj -1253 0 obj << +1255 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 464.489 512.306 474.057] +/Rect [525.586 502.496 539.579 512.065] /Subtype /Link /A << /S /GoTo /D (chapter.15) >> >> endobj -1254 0 obj << +1256 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 450.94 512.306 459.963] +/Rect [526.677 488.947 539.579 497.97] /Subtype /Link /A << /S /GoTo /D (section.15.1) >> >> endobj -1255 0 obj << +1257 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 437.39 512.306 446.413] +/Rect [526.677 475.398 539.579 484.421] /Subtype /Link /A << /S /GoTo /D (section.15.2) >> >> endobj -1256 0 obj << +1258 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 423.841 512.306 432.864] +/Rect [526.677 461.849 539.579 470.872] /Subtype /Link /A << /S /GoTo /D (subsection.15.2.1) >> >> endobj -1257 0 obj << +1259 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 410.292 512.306 419.315] +/Rect [526.677 448.3 539.579 457.322] /Subtype /Link /A << /S /GoTo /D (subsection.15.2.2) >> >> endobj -1258 0 obj << +1260 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 396.743 512.306 405.766] +/Rect [526.677 434.75 539.579 443.773] /Subtype /Link /A << /S /GoTo /D (section.15.3) >> >> endobj -1259 0 obj << +1261 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 383.194 512.306 392.217] +/Rect [526.677 421.201 539.579 430.224] /Subtype /Link /A << /S /GoTo /D (subsection.15.3.1) >> >> endobj -1260 0 obj << +1262 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 358.735 512.306 368.304] +/Rect [525.586 396.743 539.579 406.311] /Subtype /Link /A << /S /GoTo /D (chapter.16) >> >> endobj -1261 0 obj << +1263 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 345.186 512.306 354.209] +/Rect [526.677 383.194 539.579 392.217] /Subtype /Link /A << /S /GoTo /D (section.16.1) >> >> endobj -1262 0 obj << +1264 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 331.637 512.306 340.66] +/Rect [526.677 369.645 539.579 378.667] /Subtype /Link /A << /S /GoTo /D (section.16.2) >> >> endobj -1263 0 obj << +1265 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 307.179 512.306 316.747] +/Rect [525.586 345.186 539.579 354.754] /Subtype /Link /A << /S /GoTo /D (chapter.17) >> >> endobj -1264 0 obj << +1266 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 293.629 512.306 302.652] +/Rect [526.677 331.637 539.579 340.66] /Subtype /Link /A << /S /GoTo /D (section.17.1) >> >> endobj -1265 0 obj << +1267 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 280.08 512.306 289.103] +/Rect [526.677 318.088 539.579 327.111] /Subtype /Link /A << /S /GoTo /D (subsection.17.1.1) >> >> endobj -1266 0 obj << +1268 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 266.531 512.306 275.554] +/Rect [526.677 304.539 539.579 313.561] /Subtype /Link /A << /S /GoTo /D (subsection.17.1.2) >> >> endobj -1267 0 obj << +1269 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 252.982 512.306 262.005] +/Rect [526.677 290.989 539.579 300.012] /Subtype /Link /A << /S /GoTo /D (section.17.2) >> >> endobj -1268 0 obj << +1270 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 239.433 512.306 248.456] +/Rect [526.677 277.44 539.579 286.463] /Subtype /Link /A << /S /GoTo /D (subsection.17.2.1) >> >> endobj -1269 0 obj << +1271 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 225.883 512.306 234.906] +/Rect [526.677 263.891 539.579 272.914] /Subtype /Link /A << /S /GoTo /D (subsection.17.2.2) >> >> endobj -1270 0 obj << +1272 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 212.334 512.306 221.357] +/Rect [521.223 250.342 539.579 259.365] /Subtype /Link /A << /S /GoTo /D (section.17.3) >> >> endobj -1271 0 obj << +1273 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 198.785 512.306 207.808] +/Rect [521.223 236.793 539.579 245.815] /Subtype /Link /A << /S /GoTo /D (subsection.17.3.1) >> >> endobj -1272 0 obj << +1274 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 185.236 512.306 194.259] +/Rect [521.223 223.243 539.579 232.266] /Subtype /Link /A << /S /GoTo /D (section.17.4) >> >> endobj -1273 0 obj << +1275 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 171.687 512.306 180.71] +/Rect [521.223 209.694 539.579 218.717] /Subtype /Link /A << /S /GoTo /D (subsection.17.4.1) >> >> endobj -1274 0 obj << +1276 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 158.138 512.306 167.16] +/Rect [521.223 196.145 539.579 205.168] /Subtype /Link /A << /S /GoTo /D (subsection.17.4.2) >> >> endobj -1275 0 obj << +1277 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 133.679 512.306 143.247] +/Rect [519.586 171.687 539.579 181.255] /Subtype /Link /A << /S /GoTo /D (chapter.18) >> >> endobj -1276 0 obj << +1278 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 120.13 512.306 129.153] +/Rect [521.223 158.138 539.579 167.16] /Subtype /Link /A << /S /GoTo /D (section.18.1) >> >> endobj -1277 0 obj << +1279 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 106.581 512.306 115.604] +/Rect [521.223 144.588 539.579 153.611] /Subtype /Link /A << /S /GoTo /D (section.18.2) >> >> endobj -1278 0 obj << +1280 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 82.122 512.306 91.691] +/Rect [519.586 120.13 539.579 129.698] /Subtype /Link /A << /S /GoTo /D (chapter.19) >> >> endobj -1233 0 obj << -/D [1231 0 R /XYZ 85.039 786.531 null] +1237 0 obj << +/D [1235 0 R /XYZ 85.039 786.531 null] >> endobj -1230 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R >> +1234 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1281 0 obj << -/Length 2931 +1283 0 obj << +/Length 2235 /Filter /FlateDecode >> stream -xÚËrÛ8òž¯ðÍT•EàKÌœl'™òVÆñÆJ%U™9ÀeqC‘’šÄ¿ý½\S:l4€îF¿¥Î"ø©³YFqq–ϲ0ÕÙbó&:{‚•ßß(ÁHÒ8L“æG§vušé0Jò£8rÇ4×I˜ÌĹž¿¹ü £3…YŸÍWgJé0Vú,+Š0Íó³ùò{ &Ó4‚wådª‚?#•4ÕDCÕ6“iœåA»Â1 îp½®q¸ŒO¼~ßµC S,ÚšQM³œü5ÿ6jŠ(£‹î̦ä-ŸËhë­½% þà#–°;ß¼Ÿ;΄±,OÂ,?*<¼&ã<~U0YªB]Ì|Á¨$Œ“lG01”1½*ÑܽŸ_ß»'“-¯Þ=âÐÝ*=S¦Ø¹;*ÂHÅ,++h”rªÓ Û‚Äš?² è<øg¢gAÙ1dXÃr‰ó¾~íØ" -ÑFoxÁrñË‘ªA¦=,éé¡cæ± âÁ7€IÆb‡‘$¯(Ò‡Àº‹¡@örÔéÙÄ)ôt/Q\«ÙÍö z¡WØò‡éähÍOï<90 ™˜l'Q‘íDWäCŽ)‘ °Õ(Ç$`©&€é‡ –ƒÈ‘$0q¤v%iT»Ùˆ%Y{&¡¯‚™ÇPJ:%¢lÈP¥[Û‰“^Ç||P˜;ûÅ€g¶5…Œì ö’@Þ0_Û…½â2Øal-%/‚¾¿ðŒÕ“A<é­ë÷)·PAvãÆ4æ©|{Ôg³úJ‰Ûø覊”×$eB…âdÑ6øè;¶/$l¢ï“­Îëˆ*—½æÞvRP’ô31S-øl'±?£4ê· ¤r-Bé=QؼЃ[ 4ÆÌ•åfɪ:¾‡í'HÞEèÒ[ÙZþ2›çšÒ§¤ÐÿqÍ+(Šú´Bq RšCUʼnBâ _›Ž]°Ð«$q„Ñðp'¬ µ)ž6‘n¢½S¹`Q›jÃÓÁéJÈŒ™’w«SlD*N·Èƒü‡¯>lñ^zêß’‚âwØ… “ÔÉ ÏׂsÀšÅÿÌ:…@ëmA|.í¸Ë{È“` Ð†3Cx‹ÒZÅÀW‚â6VžbÁ’½ MëÐJÔñÃÛL[¬M½B@DzƒgáœÌTÏÔ^l…•†’l<€ž½8â=¢À_ö6ÜÊ‚ï_Ùów“ѽâ]û -6Tm]ÎøÄ嘞yz€É -^ÿìî§uë`÷q6«lRËÊŽÙqg—2[´¤ƒ›²á—úwîAÏ -‘=ž."|×¾²Š€vÅx*ä¬ õžh lóÒs-V£ ,0vN*£1q’:÷OÂs:³œ_${ŒÐ»Ë±vd©oªš.—œ Œþ”»V<µEwfÎYèL’IŠi4Êé¯í{‹¶”u gã ³BÆ<0*•[öšÌg'wv¥—Aqh*Iƒ^¤NÒ UÑ)‰@$²æ©¡Z ±m°Ýñ{:=Õ‰x$χŸëƒ ¨9{l^Bþ+òðô¥U8Dv®}áTvP -èbvǨKïŒ1ƒá‚ 7«OpŸ˜1`½<îÊçCKüߎƒF;êmA@Ÿ¨W­¿Î¬ã¬õ($€cÙ,}[›ßØÔX -¥øD ƒ«­I¿vžŸFÃ'-í*Mÿ/C{¶c»qŽ™ F Ky•q‰71.¿¡dàD2Œ†‡Ã@…*<‹F/H‡ñQnã¢,W»‰œŸa‡Ø™K%p¢— ²bêcæÙ^“È<1>s™}ž3w-Ë úm5Œ¥)˜ßŒù…u¬v©ß""Hà7 _3‹òQòNSó÷•SkA¸; î|Ug¯:ÔÞ¯¶VEµ¹êJc«a–(‡îåÇ©aWÒȉ#Õél§Le5fjc~¹»ýï—÷8WÒ{‹‚ß?ã}Ÿ¾ŒÍ9p?øhõ‹ 6ã™6ŒYýÏ3QÒ§SpB)ÓÉdŽYvÄŒìË“uøÉU; 3,¹fì¾*2¹ÔŽ²*ˆ.ÆN¼ øA©åÒv>8Æz¿½‡nŒŠ8ø–⟤o±’ƒë®¥Ð²²T®·æÇÜsóBœ„ÔC;áà<Ã]l ì©âõ¿<œÓtU¤¡Îé kî _þ4j¯ÞÝ\!QsîcÞù'Рê졯Qçáœî±«@0"u7u%µçŠzléÄåéoüö«m|#΀z°â ëôx çàÇ,Yn"õƒʦ…—^¯¶”9¿Ç\-’CÊ|$¢±ASÌΰÍ]bE…ÓÇ=Ý™V¢fT(ºN`‚ïjüî9å´bÁV³D2›g1eB¸÷©´Ù^æ5ñéÔ1ì÷|ˆ”r´°%Ê(…#l#8T®Ûâ÷xžKµ·[Š±-®uLcx­ðªE×öíj­ÚÍ%eiO—Ërì­Ô-5 .on?<\zp6¿ðTðë:-X ´Ö®òÄ9Wž—»…%.`aù*i†P•1‰Ô¿ìlëK1 -E‘uN®W ضP2üùñêN -¨ŽÇ¯¥T`¡•”W”Á؈ø!üã—íó°Z×nçøe+è¼$’Kp_æ{Ô 6Ë…ñs¨gCí‚Nîd‚°°ê°þ8‘/ù©²dJ*Î/xQÅ3[--¤xŃWdÍP_¬ÝßD×g#.0uáVz^œhúaJÅã튑ƞl]Û?Jìé” -ñ@FØ= ßöÓÛßNÃÛ]9Ö¶áNüÙá5æð"éGfbv-ÿ«å^½÷òðS_Žb`ؽ—P»Ã5÷¥2W™u‹ÝPÜ5Êú%šVLC<&z¤Hܥȼ¿Q†5Â&¹4w;¼g ô^*¾ã›hCNx:U‡o‚À#ýkÍI‹@Ç_ôVZ’X;»8rk™â‡÷2ˆÈ/Ã3*RÅŽ¦óÄ%µ§‡È8 “xçð“‘rD= ”1þ =Kìq(ÍbÿÆ4ž…é,~åÊÿ[&ü¦endstream +xÚ•X[oÛÆ~ϯЛ) bx¿œ>Õ©[è utj)Ðöa-ÑO(Ò%©8þ÷ofwIZ´ƒB€¸—ÙÙ™o.»þ£Ÿ¿Èb× óEš%nú‹Ýñ·¸§™_Þøš"ŠC7Ž"jÏL®Ìì* \/Jgi4UDn”E ¹Ü¾y÷sà-ÏM’p±½3‚$$ˆd‹íþÇ_®âØs~*–+ßùÓó£º\úN_6õr&©ÓÜá›8ט/úK|ÖDññFæ7mÓ7Ôô]S ©ª÷2w­ŽÅò¯íAঠG²å^Â|+:¢÷ÓÀêWêÊVû¢Ãº7W[{@#zâ»~Ì©À£ýC7LÃWõ“„©›FùX?~ä†Q2Ö—¸A’Š~\­¡ë«íåšNý‚\zÉ«¬fíÇ ß#…ä#Öq’¹¤Cf}mÔ ]iê´'ÒPÝ¡“‘¦‚ÌùŠ?6]+$ýH +´sçú¬*&|,ë{MѪúM§i{¢è°ú?ËUä'Îí÷}·Þü | ÅÕ§µtTMs{i¯A÷û»þ¸2vCmu\Òæ·JØ5uõ$­SÇ‚²ea, ÎgNÅs‡£Ñí{t´xË,rÀ5JœŸ—YH§¢}Ñ«²êdÐÂ`(d`û~ƒµ?«²jJ²ÇçB²ÞPh"N›ßVãûx#=Ñ=5¬¾ÿFŒ%ìeüñPÔÒôEá _LëÀÖÁT‡ª·š½Ö(‹ÔE Å¢ÔJÄaN¤Ôy欒3‚Vrî Ž11>?O´Ìš?„ž:Õ•9}×Éê'ÖíIæU«÷„ +îeìúÙ™ ÞÑ}‹áïçÎð£ÞH(ÌÂ<4.ø$3U¡xy]yâ#½>æœ×·Ã¥9šH£ñ°?¨^ZÃQ¨³×%EO7šfÀ)u.†4Äç'°#ƒ‚/æð÷Çç‘·Ò"ÃÄzi;ŸËZ$’xËêÃxC¾?¶Å€R´sÃï¥kã):“PƒÉ;$ÀÚdO“´õ¼˜7qJ ’S»µ¸?-V`ç¦Øw +ŽSÒÙ$-h§¦˜B`Ȳ\ü‚#g'Äæ; +´;ÅÕF‰á“´”vÒ( -Š0Î",G·‘¼ÓÂôbt4:¾Ðß}¡ Ÿ”rL­ç?—¢V_ þ¨%Ëcùž–á«-ìš–¹?qÐ…m(ä\^Øèò×k¹YKB'~àÓH¡pÚ2%a öŒ8'Nþ$ðs! 4®Åp^¢÷e´!!CN| Y”º) s\¹ŒXq1© ™î›ÍȃÆZBÔ *ùK³–¡ŠytŒ8ÚC˪–ê଀êJæïµØº–ÃWÉçYa’°Cë´KHK $[ͱ¬õzÜUªÓJ¿ëG7ûêÌ‘t•…€Ý…¦Ö9ù *dî.…9{ì¸ÈáDUèÖ®ao:õNƒø<«Lu‹.aš8€»Òàs|uéFËwþäXj×ë:EN,ñº: }%+.XIOR/ *ÖÛ¤¿§;¹ðýtÝA^ê-»òXVÂqʼnc.œy¿FBôz’RÇLÙ‡iäpÕJ_Åõx;)^Òx¨ZA"s±åθüI#¹!œÆ¥~ !2ÄëQ¹dGŠºÔÊý3N~´Ñ~¾³bÄXI–…tçpfD¥¡ kúÐtýŒÄçùn@.éHö¥„öÂ@ wòΚHâ'“ëÆ{6ì;ÙÉ'ŠcxÞÿ-¢DîüW™N/Vš«’ Ò´b¿q¬™øiî2äG¶§1¸cSE ìÈç.Æ~9Æuy +ØÈLäCMû=¿ÌÓq2ê$Pò&¬ ôl BG -¶RbR6+L°‚h´ó.Í“Q¼²¹5ðÝ ¸PFì “Áa5=^hpøÈÓÉÙÎ5oé×”9GkW6Ç©äëÿmUŒÍ 1/”«!fÚzævȵ?èù|зT¥ëõåÞ¬ìãÊHW_tõÞNvø\Ü.=Ëì߯ҼĨ Â…Ù”¨Ô.JŠí¨˜è^ûézý¿OWBÞè±_ˆô7ˆ‰kƧ Þ°\¡øȲ'!kêB¶4/)Diï˶CP’J˜Å™pÿ^jf¼kØŽýE«‡Q˜EÏ|†¢J¦Õë2ÐEvû·½qÍ;ÁÄ4ƒË»˜y“`> endobj -1282 0 obj << -/D [1280 0 R /XYZ 85.039 786.531 null] +1284 0 obj << +/D [1282 0 R /XYZ 85.039 786.531 null] >> endobj 6 0 obj << -/D [1280 0 R /XYZ 85.039 766.606 null] +/D [1282 0 R /XYZ 85.039 766.606 null] >> endobj -1004 0 obj << -/D [1280 0 R /XYZ 85.039 651.298 null] +980 0 obj << +/D [1282 0 R /XYZ 85.039 637.749 null] >> endobj 10 0 obj << -/D [1280 0 R /XYZ 85.039 651.298 null] ->> endobj -1283 0 obj << -/D [1280 0 R /XYZ 85.039 622.563 null] ->> endobj -14 0 obj << -/D [1280 0 R /XYZ 85.039 213.197 null] +/D [1282 0 R /XYZ 85.039 637.749 null] >> endobj -1284 0 obj << -/D [1280 0 R /XYZ 85.039 184.461 null] +1285 0 obj << +/D [1282 0 R /XYZ 85.039 595.464 null] >> endobj -1279 0 obj << +1281 0 obj << /Font << /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1287 0 obj << -/Length 3130 +1288 0 obj << +/Length 3386 /Filter /FlateDecode >> stream -xÚ­ZmoÛFþî_áû -ˆh’Ë×Þá€8u¯.9Wëzù@K´D„Òº$Ç÷ëož™Ý%eÑÉ-ŠF»³³³³3³óF‡çýžç‰¨â<ËS?Qáùjwœohåg¡Á˜”ùçryvñSJ«_ÅùòÞÑ) -?¢óåú7ïíÏo>,¯~Í•R^èÏæY–{?^ÍBï§ëÅõòúf¥Ø»D°WËËÙ<ô®onˆ¼¿Î¢Ü»YÞ¼½y'(o?ʶś÷´ñJ ¿^Ý‚Ì»-e;³OË_èóPùI\0Kï±ðãÕ-–ή–îŽN -tŸüýì·OÁùš„ñËYà«"?¤qà‡´¼;‹TfޜݞýÓ‘’µø<¡§å™¨ÜOru*Ð0 4 #_…Ñy–$~gÌþ¶| þfó(ó*\tOÓz¿ùa6ÃÔ+±yÀ)W3Âù áU½€Ë}Ù<ÑÒ±±jøX7 F©×¼¥u¯ šç^«Úlú÷I¶ðÁ_˜rû${{Þ FVϽ]½Ç $úŠ0d7mU¶ºGl.{ͤ» ½é{Qó!µº\¯J¦Ö ´oqãÿa -àê/Ÿü—ôE~ñ=+pX)­Æ¾ŠÓ#¥™ŸE)óúj6O’À[\.p>,7ͼEÕ‹)o7)Cë›L 8/[Jš+_e13ÕÞÓ±+½=’ÕWH+½µhbÕÖwƒ!u¯±¨¼r§÷›Ž1#OJie/jXÝƪ»úm%ëõî¡©vl`¬ù¾ìk˜Ô^–ËýZ°&P™“À®eA@¯ð„ùì~>a—â"ÂÄ[”;P!û¿¸% ­W<~EŽ'V¹·X^¼1;4™ŠªÚNf¯>ò…Ö ?vBêZدڽ¥Ùÿ§ Ö#ˉßàØ« a\ôÐÈsÝ*™ÐÚEDúIRh’,h–ÂÞQñ{8ô‚¶Å›ˆ’Œq¹`¯Ö—Ÿí»¤YB3¦ ‘@╬•«¾†¾°û±&…^/n¬è.ñ±¨n«ÖÄ;‰7?3 „bð|¹jÌ/\L1ØF&늞Oӑ݆ ¬ØÆG-áIã ?ò˜ãqÁ;bÊü2@ã×ÊQ·tãÜö†Ö^Ðî Σh -èž Ãyéö³û–ãëJð›Ø¹#½ñ•g@¦7_uº9˜€@zMcò³|h Î HVG³˜ÙW³Ê{Š$NsÄ“R$ ¶2 ú­!1JÌöš˜(ûj-ˆ•Ô]Û² §Φ"¢Pk®¦e ïX& B"ò~M=°åu‚H9°"všØÇEèaáN„¤W”>c, rª²?…1Këیي#¡²$Rñ” oïý¯0Nl&o²v˜€ßÖCÙÇ›J8«uµ,ö¯1R8³¼.aŽå]Ù™CºCÉ&ð$Øž0kYZÉ&‘PÈ.g’e§÷†´õI§ÎqWo¶6=IS“žìGf3µ™úÞ†îzœîª4ñ8&÷â‹Óô™Ÿ'ÀZïJÎÙc1áÉ6Ô,i&a€p´‰I´•J/Ž)¸ý{Çf*CGôUØÊhì4Tqq*Wm(Šü΃+›ƒ°[94kAºJNÚ¬  “zYÅÖ$ÚÀ²< þœIkŽhOW\ -ä’ž¶U#ÑbΩNbÁO\üÞfj0«­‰;=î.p¬kQqq‡Êƒ¡7nT©#g,TÊÖf›±xC»Q´Á&Ž¬ž™’¤zEÙËÓ,'ÂhbrC."“‚Yj9¥û2ؘY“À!´Yä½Ë(¹˜Q‰Iã0htov³Hùv£šÊù×bjR»²eÂ$ˆÎÈÆÙdj½w·ãB™èW!íy1~^¶®’õ×ÛãÈ [C"ÄÅÍR`¥ü'O£!‘-Õx5ÐÙtîeHo«3g»èÀU=Ææ,§dKóã8pº¸gHïé cìʽ¯"kâ^_ãŽ,‡Ì9Ž•÷F°œ¤Ì®Q­ò,LD¹ò³">§ÚÙ/Tñ‡Â„¥5; E¹ Í܉\TÕº{ÎIÏÏ©èú3X³´¾ÍšBx£Ð:f æ¢k.*8É:õÌVåÁJÝl½´æ)=Ôiô(ÈRõtÜ#±^C¼‚e‚2צ®\Ï€Ç-K97–hZŸH3Š?MIшÒPφÔ| 5¡æX‘ S{kY÷'\¥t2]öÏàÊú6W)å&I>æj¨ÿãqžI3Ó×Ü|šÙ*fƱdB#%½uº@B å”(BTDZ*ë ]' uH‰ãÄBê¥WP 1íJ]T*töW¯*sž6Çu‡•sC„ǾÑcàÅ:æh›^¿T§3é”]SÝÊðEŸíHRí7¯‡ª¤ìÝ )ø¹5JM‹.ôn 0JãqSÓû£½Û^p(pÒèùý‰ˆéù¹ªÝvX]œ;%|̧;’T£ÿ€Š¸0éØŒk¤@Ãœ}±íùV zw±†ú6ëQðh4‡ä‹·×?Ý^ŒX×ЩßÕ¿Â -cQÄíý¥Œ¥ƒtñÐJ]r7,tÛ²ýæ ’7€&åÖ¥tjHZ ,~Ý~v}1Âæ<@ÊmL¥É@¸œЯm2ÈŒ=TarrBß¹~-fÇ©,¡µú0$;f+%bíÚ4>¤r;½ÞikJ‘jJö|ŸÜ9m¡ääžE¾“‰k]`»kÝZÄPep£YD£Ü&63 Ñ„ª%¢Ê½ÏÐm9X¾’)6À0f|Ceø`Æ<}ÁP² Z¬ï'n6j}œüiŠ âÌ60½\!…×”í¦’!+ n{Ó¯A®"Ï4?ŠQùO“q‡$—þ^æ B€öà¾3T}ž„¶š¯s¦¶@Î -èÝ,*¦¾_ŒÛsE¯I’ÆèôQr.´‘µ ­B€Qzê"ó …~·¶”£‰‰”‘õ0Œ“x.-–GÚèÑWSÃS/ÂöŽŸE½«]‰õÉ$m_É—žNîáªJ¥¦¾Rš~Ù³/”/7Êä2Yxj`LߊX7ÃgµA†÷1¢„ñpàq‘ˆW@¹þõ½,ʾ,šj¼å8?z)™§ºfø¶–qsvgFZ~šEôÎت±€XÊ©qŽr¢W†æI›•`ÝXOö+¤ƒ_í˜b¹—ƒ‰9ƒf¾NåéVTãj ŽäÙÆa>Ôµâø㇠òn¤ÊDó<,lŸF«±²p-2nh‡ÅHûæˆqw äÖø ÇZêùé`ꉯMÇQJzÜÂAÉË›þ¨­?Vjê›6ý/’üCeᾌǹ_äÑt -˜D™Ÿf±e†¿j'Ý3óקÿÜÖoBendstream +xÚíZÝÛÆ¿¿B}2X<.¿ÙîÎçæ[wµT8EâžHID$ñBR¾¸}çk—K‰¶SÄ}(±öcv8»3;ó›ÙSþS“4r½ ›$iìFš¬öÞd3¿PB1’™Es½¼¸|%å¹™—M–kÃ'Ë\Ïó'ËâGç滫‡åí»é,G¹ÓY’¤Î«Û©r^ßÍï–w÷sœ +{aªùíòz:SÎÝý|çáÝÔOûåýÍý&¹š¿âeó«·°ð–GßÝ.Í›.y9´çÓËïa3¸Q˜‘HoqâÕí§.n—fæ`?nð—‹?x“ãû Ï ²tò mÏU0½¿#dHw±¸ø‡aÅsá$‚ÇÏSSÌTæf~ôå3c7öbsæ>̆nÆö™G‘‡ mP¹þtEžsýî~xÎÕ«›+<‘œK'μìø€áîiâsG!L¿(\OC©hÄ Tâ&(.Ä®*¨Ï®ÎB•8+” ?`'æÎäÊ«=Oò}‰ƒíKè)R*§à¹n mšmtc º)y¾þÉSŽ– ´eó±Z1?!‘·8v„Å$´šãEÚ}w ¼E$RQó´Å«¦(â¹)>¢Üu^¬rZßͪ¶Þå] Œ}ßï…zŒ–iò"¯=®¦~âl™&—'žÛê°ù3Qš +‘Ϩ{r÷Õª©Ûzݹ«zY4›ËBËýÅ+wõžÄåÍÝëÅå#6k.*Ô”ÛýÚýÅ>¥ˆ)?h·>˜©rÞ^cÅUᮼ|BÙ*¶'&"¹ðàó¦Â3By#/èå âÐYU(1 …nÍ_;Ø¿bÖtœuó3*í°á1T)rϹûæj.ã ¿Ÿ*¥õªåYÔþîóŸiûÜûDü²²©]Ù´#Ʊ®qsÏxðyÃF^.ßí¸qj<<ú”¯¿þ ¢{†ë¦Þs‹Üãͬ¾¼Ãæ»Ù'Ð%n|ª×„Ž +’—⺃”‡ôýãÁÌÕ‚û‰ë‡DÁ—Û +o«Ÿ†¤V1n£üh¤Â¯ ž–ŸÀY×7š’.a½ç[F, 4|?tîÖL$§ˆÏÙ’õkî~BŠBª]Þld„t†c¨3üEù ³—lvò]òï#{oÙ¸-¬&¸'ÇÄS’ n:U $UCëíñ$vŸ·dnbð=†­«Â$€ýíZœ §–7œJaRõ ÖºOÐÆ’¨÷·¡s°ì ž€ü‘»™¨3‹ÇÙzÈ«áÞ> L‰d5S»Lƒ k‘è‘òDýÙG¹×Ø¡|×^Ðúhb+ïu1_œƒ–G/±3Kø5°À>Ç`ˆÈøˆÐ¨â«„À<¯;¡¤;Bà(ëÃNP6~c[·BDòÍ…Ýð NYœ¨e4Á\xÁc3Ï Y_X? Î.ZöéÀ€¯OäԹ┤qà<êÛ€U[=WK9³Ç ¿ù¢q‹Ðjµ0çt ˜ÒM’lÄË‚ßP \?¯ˆÎ4¯™Åì‡Qà‚Ï7_ijZ–;,ñ\/ù6r1«¯ˆ•Ä®ïe±Njx˜ˆÖWÜVÜ@_bIME7 È S+8žû™rU2´4ÿ <(™ Ä‹"G7š?æd±×íŽí8t8àeâcKꚪ“B!NB¶ÈAçÀ^ ÷~öÕf«±t‹0´fj-àÊfÃN +Ò ¶,2æb£DRGÝ +ÉT;Y| +dpÌJ^( 7"#9ÅnX¤DŠjÿÔûìjFüiš†Î8ä£âM”,\7þXQ*ŽƒlÆäH£Ä²Æõ±¥œÄbbÐØÕ,#¼H< ¢¨9’ª %ݸF®˜§x8¢‘¶@øœFW8 ¨ÄJ’(…‘ëÆäËì‘alaCSèWcáù=>àx Åzø‘híÙËQC [夓 !¬¹ :6ÆKú·S\Dz©è×îŸv¥½MŠnÂô`˜ZìȈžæÓÎðÎ ²…Aì\ñš“#9ߺu>'¡@©Ô‚`âÇ1ØJô»bæ5³˜å+7õbóEÊêʲhÏD ägßD4áõÑ¢âÓP4ª_=²ñSÿ<J Œ`- òª”ó)Xw­¯±<Éìâ„UÅ«ÍBƒ8RXâ ز­oíµ''BŽÕ·Q²æõå“ “ÀMÓ%ƒ+?,ó\¾ýM^_,‹Ý8ò‚4™ýõ#H*Å›=Åž‰?Œ¹Ù?žgÿxžý­Ï³rJÿÛ÷Ùøÿê}6·%4Fn?±Áá)ëAI—LZž–·Zh-o¸ž`@ +`¡’×ÙX¿ÎFýõãé ¬1Kÿ‚*§`¬§M §Í‚ßcñð¿öf‹4Õú<}·P°bHÏM~ù \+ˆÐ㧠+ó>‹MÖY¨KÓJ“ØõšP +K”ƒ‡jøzˆøØ %'õü,Õl)¹Jqôɤ]I/pXâgMî-(X°¬:c¢Úý—êSŒá°õ¥Lù¸[ƒÓh¬D¡0‚Ph?˜·ñ”fÄ@GÓPŒOhF.³½¤'Ϥûê`ÞœªA¨ÈaÃ85ÛÝZùq$ Äc–>RöÂèhÁ‹Ñ,˜ëŽ2•†œ—`&K€§×B°KΞ›vÝ5 ´7«¸ÑdŽfôÇJ¾Nϳœt‹ï5_Òß¬Ï¯È êñQH¿ä:pÌ# ,½Ð*êK^¸°åÐ&INØ¡ƒ)LÇYOZƒàËœL­©Á¤b³¶ê…°JmTdJ{]ò=W{ÿ`0,©Az(eEëÝ3Š /)ô•D»ÛWê‚óê>QÖ’€ŽU©ÔkrYë¯ Ù™”ÏÆŸ›ƒÈ !Mym†ÿyÛ¿ëÏÍ›5€þ @ÿ(ŒàîÄI¨…¡ç)u*p`ÚŒHüç·endstream endobj -1286 0 obj << +1287 0 obj << /Type /Page -/Contents 1287 0 R -/Resources 1285 0 R +/Contents 1288 0 R +/Resources 1286 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1229 0 R +/Parent 1180 0 R >> endobj -1288 0 obj << -/D [1286 0 R /XYZ 85.039 786.531 null] +1289 0 obj << +/D [1287 0 R /XYZ 85.039 786.531 null] +>> endobj +14 0 obj << +/D [1287 0 R /XYZ 85.039 766.606 null] +>> endobj +1290 0 obj << +/D [1287 0 R /XYZ 85.039 744.844 null] >> endobj 18 0 obj << -/D [1286 0 R /XYZ 85.039 722.931 null] +/D [1287 0 R /XYZ 85.039 590.186 null] >> endobj -1289 0 obj << -/D [1286 0 R /XYZ 85.039 696.923 null] +1291 0 obj << +/D [1287 0 R /XYZ 85.039 550.628 null] >> endobj -1285 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R /F11 976 0 R >> +1286 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F39 974 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1292 0 obj << -/Length 3154 +1294 0 obj << +/Length 2237 /Filter /FlateDecode >> stream -xÚ­ËnãFòî¯Ð-0bÈn>÷$‹ÍÂda/æäЖh‰0%zøˆâ|ýÖ«›­9—Å#²»ºªºÞUt¼Šà_¼*Ò0Òå*/âPÅj{|ˆV{Øù÷C,IªÃ4IàùÎæÆîn2FI~Fhlò¸ u#ÌÏßþ¨¢•ŠÂ,Ó«ç×U«PÇj••I˜èdõ¼û-PëMšFÁ“9¾˜õFgYðýzÝöPÕv»jýÇóOÿzv´„”Er‡›hµQ:Ô¹Zd5Ëã0Ê”ÏjœóÙ«p÷X•Ìj3³ë88 òÙÏQ°·¾Õ°ÑžæT‹@Z9¨a0/ÈAS"¼@0q:4"?‚ðÂ?Ó5ñ`[Ü¡³$tƒú-‚¡gZîGÄ{bN°¼ |\aô¬M¶Žáî?îèÿég ø˜ŠNƒZëàŸxâñÇ'|SÁ{×¢Ìo*q#ßãÀçMÓ[W†·¡«­\{¦5¬eSÈôÙs:×·èuD¾¢Å>ðᵫ¾Œ)Ë u÷!ä ßá“}Á˜êöÔ j«$k…|ì×ƈ4- Pß~fãÝ 5* 3ˆ„Ň7ôtÆz™ƒ|…š.ôH/¨=âÝÓì2&Ð -›Õ3½Ÿèø„9¢†N5þ¿çÕVvÿ‹kõ_ßA Ä9þ×ÇßüðÞ0˜þÚvGý|0h)iöôu1ð)Tò­©vlíÀA/¸©÷•VÝ;ÍÒ¾›U¨Y%ÉW:-(T€8ŸÍ)t‰œUè"5«PÚ¯¨¶·~´co½ˆ)¾óÖQ2Í€äW™S+ -õÌ°®A¦«I/‚çÝtÃ-V²¦"x1³’ŽóP—_“ô´ i»ëYI/‘³’^¤f%íQû|HŽ7F‰µèÆOñ¤/ÀT 23H6F vSEAû½‹‰ÝcÂolžÅc‹žm3":ˆcŸöóã/X2ț؀&ßîl]çXËßÍ”QIY„ÅýºÏ•QÌ|i—:Œ”W:SÌh“+ZšÍã'4½,Îá«Ö>‹(TZ/ó9ÁÌ—{ DÅŒ«½_Iuí;Õ*ÃœC’ê£MX¸<ØE/§³[ LÎ¥lþ¡°Y£Vc.ˆ$AáÞžÀ–H°–VTq¹¢h*ÀF¨! ¶´NvˆÂV¶êÓ¨9,§5XGbòÖ–qÔRöjðìhÁó—±ä‘83ï\eqè5vïmºãç^2 Fê\¤(€IŽ¼6¡CaŠÓ !_Ø#I™a¨ºO˜*Ø2nïåDz f\Q<Å4qT®¡ÇF‚¤Ô— 3 Õº_Íò™­s8Õ%*èPâc|Uçs¥J‰ö¨£pâ”Ržõ…u wj†d7:Ϲ0»ÊÞ½?ñ -88gèsCñd¨]BÒS?2q}Å#^}ãß+éÁ¼É•eb´=¿€P€3¶¨RYÊn°Cõ"ˆT ¼õ{”F7…nAøôÁ¥2ôÙyIÒcÊ,z&gU>0+!†3•œC}Ú‘˜×©ß£X“~;ÞºŠþ´¹cj;›“(’:ÜIKs"¼Ü$™ƒmVrŽã[YN‹‹ÿøF¢{]/î“¡)8÷¡H8ê‰6”² Ä®ƒöªz -ÛKgÖïg‚Fí**þ•ŠÃ8.«©r¦G9r²YÒv/œ‹095rpa'¿Î]u3åÍ·©[{wY ¶7}&Bo¡ÊçFp¨Ä~üì¨l7‰¢€f®¹Wmšm×úÉY§RõHŽ>¶]5¢8 -é öáàhÞÏO;jïÐÎÏ/¶0Þ"ƒo÷º&ƒ˜ß›Ú–¶VTךö£Ýeü%Ó_Š`*K‚†JŽí»T¦m<ì¹]B çäÀÆ=š±NX«ÆçË8øÁ‹{©Þ­ãyˆØ½_«"A¸i‹,\<š7{I|½Š›}‘f#×}!}e ¼Ÿ¯òÉ­„Ëü"”ò¶ÃhÛzÂþÑ…G|›Šc‚vlº®{[´d,{rQåEÄÖ³ó5†=èÓ»õı?²°>«)OÄ‘pDFxà3nÒ÷ ~'.%: ží G°¾º²b`Ôl(n~%©±·\0Ôm+™æpìñK ÇX9"Æ[1@8UÛó/†Û´œ¦0á˜iäf¾™œ•†<{ö‹^bY·FXŒì‡3«*q Z,V¬Ì|e­ò4Ti.•µæÊúùn) î£whTò [¹ -“lyììÁÌÒ*Å%v¯ï¥¡ù¦íÐÛgOGÇØ.nk2h7{ÑÍ+Ýñ¢£âÆÁÎs®‹' ˜]5;¿QÐùé™»&ÔšoB-Ðâüf‘œ4¡ËÔ¤ õ©=ß ó\+<´'zà…D.Cº©TÄ*¶o»Ü$[¢1ÚWþ½ðC,lïXq…ëöƒ•É/.Ðõ6 _¦V.‡>w²/DTHìc0&êžWëWþªÌ2Åu7®ŠÔÚ•ü|Ôî§9+W95Ô‰ O¦óíØQj‰ã‡ ƒ5êÖðåŒW§›5‚ø‚ð¾i_¨8ÇäΚk”‡j&nLæ:-˜«-N§ÉYs]¤fÍÕ£V“az'­«ÀÍœø•2« -à -¸Âö7Í"rúÜ™{ 36—ô¸=ð 2—†§¹"$ˆwu…XÓ2øLß;x•“é‰ÕÇ£+°µm>æêb7V¡ÉL‹‰uì‡ÓÅ(§‡«yõÙEéËô³Ú‹(Œ¿«&˜yÝ Ìâ¸l‰–h~‘”(Þ#uäÜHõæPR*竺„î£çÖôÈ0[ð÷ž]©Pj¼y+@Jžo5v²|£* m'S*ø¥=m^oÔ†.EÂqþvPsti¼/{½cúÎÈaº”(–g¬dº©ráQ‹ßnQÝâF†TøPŒBÒ5”rÍt˜‹¡fèóÉÅt;F‡žÂÝ ¼ô [¤xœ§D¿S—&_ŸZ)È »º×õ8éc¸lì'’/¬iÌôëʨÛHŠÛÎ iÑšúòSM/pààÛÕÚè«`%d!f_{Ä(¦\1ДyW 6¢‹tn? þ‚Ÿ·T‘ã8 Üò!Iðˆ«w‹¸ÍŸÖ`…¦T½ìv²øjú'¶5 å28×"„©,ªñ}Æ\gƒX9±…¶oú - ôý ï~é¹£­\Ó¯Åñ ª‚kÎøMÔWFóÐB¨ ä&™5Käl°Y¤f£GÍÕ˜]·æôÍÀÝÈ_3ð™æI ¿î0³ëª»ø¤ûvRdÈYÊQVÙÁ‚«C(ß ŸÁºëj!|¬ÌIÏ^ur]+È'øµôÞKB­÷á\®wƒµýl÷í¾¶6pó‡*‰CÂÄi~ž¢”¿<üöG´ÚF~zˆB]«3ÿò…ŸNèëÞ±›H÷M{ ¤eœÔYàÜ 5¸·}îj ëMˆÚë ¼%‡¿5Q¿MÒ‚îJH„™Aœ /^†æ³gʆápgñÄï•øíxës3: –ÖÞ[tüazíï3Õ%OŠ¸NõÃê2¡¹­.uëR>h/¦à´Ê«‡Ò<ÍcqJ¥±V镼gxÃ4SÓÔ7¸“D#Yr‹Í€žß&Å‚Ò!Õu4œÑYÅÿ{¦ë;þý­³ßa÷GÈ•AÕlXî½ÿÉëzȸ—~8 +ÙWØ8Ç §b–gwUŽ¼^ö)í¥†"W»—èºMJ;_Í3î…â§eþнšY÷zîgsî}$-¸÷¡8ïÞ©¼_)SGŸXú©¤¬|ŸJä}´Jë,•‹¡1;ïY¼ÏM…h¿-ó"2ƒíÏÂäd· ÙìYR«ª0¤fL¬ëX•!ÄfÞÄBƒ¯¬çMü@ÚÅÄÄOä}=ø2 /ÜQaäõÁL[;9`Rj°˜qR”áŒkꥢrëB†\øÆ|mu´oÏÈ*ÚÓ~}þfµ<‰ó5µöÁ㠸ǞMuYúØAdÒé@l^K +üü¼Ä$”|ÅÃxó]ºÃ˜CÈDj#6!°z_I]Õñ•¼Ì‚Qs7NÎ^poà[Ó\ÄÃWL ÒW 'ý_@‡L 'Ö¡FGã.Èö yÕ-Ñù¤–­nŠ©ÌŽÃ%ÁŒþÜ^® Žä‡æ½µJg +¼Æ@µL -KHü@A\¦˜28ÅΉg„lKA¶ÆÉÝkãLéº^hȲçNÞÏ& é[+O.Ø™Ö5Cg¾†W,+3€Ãž¬˜‘×pæ5Ðã¾½×p!0¨æ˜­ê”œÓÅÞü¢ö;?üžäÉ-*ƒJ¬Zfyg¨g¾Ãke˜ŽiÞ:NZ\Q_‚Ó7ÀÙ\e@ˆâ½ ê÷Diò¥(å†F&;T—;ðblß “ŒžL³Ã€ '…F·Xä5L\å`0â4Ül0ǧ¡ÇÂ}æ €žî*è²ù—â31@gÅl¢)Dû|'A\zDªÿ•¡ˆÞÍœ}ÄŠ¢örùF…»ã×­mh–(s +PYZÇ¿0öµ¾Òá?¸ÙnÏTÛ«™)qH²< †™)/e"ŸÎgX+¡ ×Hi|Ö9ÿrË£c?ˆ T¡K%îH¨œå¼° +·^»PÁÛÆÐ,ûz;Qää!djŒJwaÚu¥(ÆoG3*Kº®¢¶ïöìÕݺ´ô`±®éA–\ðÒ¥¥øð…cnOõ½ö›7Mö.Á:Š¼JO]]°>š×€à趫ÀöM˜)‡ñhüMà‹|—1NCrlÔÛó@wäÓ!´¶ö=|^|a[ò«µažHÝ·TM‹Ív®@§õ4HæÇUOy*âIç…0£°L?ÊËuç•žøJÉN*endstream endobj -1291 0 obj << +1293 0 obj << /Type /Page -/Contents 1292 0 R -/Resources 1290 0 R +/Contents 1294 0 R +/Resources 1292 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1229 0 R +/Parent 1180 0 R >> endobj -1293 0 obj << -/D [1291 0 R /XYZ 85.039 781.388 null] +1295 0 obj << +/D [1293 0 R /XYZ 85.039 781.388 null] >> endobj 22 0 obj << -/D [1291 0 R /XYZ 85.039 761.463 null] +/D [1293 0 R /XYZ 85.039 761.463 null] >> endobj -1005 0 obj << -/D [1291 0 R /XYZ 85.039 671.062 null] +981 0 obj << +/D [1293 0 R /XYZ 85.039 659.738 null] >> endobj 26 0 obj << -/D [1291 0 R /XYZ 85.039 671.062 null] ->> endobj -1294 0 obj << -/D [1291 0 R /XYZ 85.039 642.326 null] ->> endobj -1295 0 obj << -/D [1291 0 R /XYZ 85.039 569.47 null] +/D [1293 0 R /XYZ 85.039 659.738 null] >> endobj 1296 0 obj << -/D [1291 0 R /XYZ 85.039 542.372 null] +/D [1293 0 R /XYZ 85.039 617.453 null] >> endobj 1297 0 obj << -/D [1291 0 R /XYZ 85.039 528.822 null] ->> endobj -30 0 obj << -/D [1291 0 R /XYZ 85.039 498.834 null] +/D [1293 0 R /XYZ 85.039 531.9 null] >> endobj 1298 0 obj << -/D [1291 0 R /XYZ 85.039 469.43 null] ->> endobj -34 0 obj << -/D [1291 0 R /XYZ 85.039 291.068 null] +/D [1293 0 R /XYZ 85.039 493.374 null] >> endobj 1299 0 obj << -/D [1291 0 R /XYZ 85.039 261.664 null] +/D [1293 0 R /XYZ 85.039 464.154 null] +>> endobj +30 0 obj << +/D [1293 0 R /XYZ 85.039 421.42 null] >> endobj 1300 0 obj << -/D [1291 0 R /XYZ 85.039 245.795 null] +/D [1293 0 R /XYZ 85.039 378.467 null] +>> endobj +34 0 obj << +/D [1293 0 R /XYZ 85.039 160.261 null] >> endobj 1301 0 obj << -/D [1291 0 R /XYZ 85.039 218.09 null] +/D [1293 0 R /XYZ 85.039 117.308 null] >> endobj 1302 0 obj << -/D [1291 0 R /XYZ 85.039 193.719 null] ->> endobj -1303 0 obj << -/D [1291 0 R /XYZ 85.039 123.852 null] ->> endobj -1304 0 obj << -/D [1291 0 R /XYZ 85.039 96.147 null] +/D [1293 0 R /XYZ 85.039 88.742 null] >> endobj -1290 0 obj << +1292 0 obj << /Font << /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1307 0 obj << -/Length 3219 +1305 0 obj << +/Length 3312 /Filter /FlateDecode >> stream -xÚ¥ÙrãÆñ]_ÁòËBU"‚ûÈ‹K^obm9ÞÅ-§ÊñÀHX8¸(­þ>}ÍA‘”R®5çèééé» -ü.ŠÔâr‘¡ÅbÓ]‹-ìüó*ˆ¥€,˜VWûG»_åbõ`ñ¤~’Æ‹Uõ»÷þ§ÛÏ«¿^/ã8ö"ÿz™ç…wz·ÿúáWïö×ë¨À»Õ‡÷«/z®ÿX}¼ú°2÷ÌpW‰—½úý`Q¡¯?.‹Å3Œ?„íî -n÷Ó$–y{uõoƒŠ÷’Ÿ:÷Ö$Êü(‡AøE‘œ… ÃÈÃ’~$†!aê0$ŒR?K²…BŽdþëÇ…qâ‡ñÂÁtzƒüÅmqé§EztÛ3ò¶F±·m¬ïß͸z‡Ivæ,Ëxz™æ…Ðá<òÚázåÞæþ÷Øô¸å ©Ú‰ª‰w\t—=ÒÆw}ƒõ™×‡þ}€%ºÀJonÿ¤ü y·‘«2x©–ôæýGñÚÂÛöiÂÿß°" Ã̪§xiÞL0¼ä_R¿°¥IÞ6 CŠ`7ñcP”hMD )¶ÈO®—ix«ÝXÃõ@DƒBB6e¹×wk^u¦¬,ý¼Œß¤É9£5BS–~‡DÓjGüÖ<£Ü† -¹â•5ɳf6U­Ú½5óxKÌœ ±qôdóÂã=áÆY!‚¦mfgs¬¿â¹f¬;ÄQ³ÊL$ ý}Jtßö(¾±~†ÓIàÍcSÕ ?/=È\T:œ)«‰ÂY@Io¡z7ëQ¡‚¼ð*æ0ò•©C1Wôe;%¸ÈÂB½> x+hNèÞfùž—À$–ô²¥û4Ñêiäh’¤ÃÁœuI’„êùÏnÏs¡>d@(`àŸD5îa€6%~ù ’ô¢@IöjÖF$ò¥À4|‚íûZªê‡cMŒ}ú@ë#x¬bˆÓ€Ä©ö( 5ŠŽ“šÀÖíÝØYWƒ6<~,Í»Fë€H1-2m¼°ß©Gqÿ戒“HòAßá˜`ki$1jS€3-^fLáô}M'xˆ ©Ñ¸ÐŸ.³<ñîáIøðw:à‹Í弈¡9‘ÇÀ{#X¼¾oÕÌæØ¡º…¡‰w¸{ì»p% põÉÓäl8dT²Üw³æ5÷¹ìjØàê2N ï¹Ñ#²ëÊ®3Ïŵ ÃÌÄ6éȤ·‘õii Â+C4(:2¦£5ñÁFcxn5gFal_{*ÉMˈÍhid“‰4æ1$ú±‘×STMAiî=9À[Efj|!)Ró"©é·¨»B33¾F?+&­…ò´/ÈÎ/Ði5ëÉ–ÄG,Lî›Î<ûAAæ3"%qaµßã„Ù›¥` -gæ¸5VSöÉäëQÐ9¼dæãœ1õžŸó9^CÈ®æðó@Îþ ! #¢¸Ö¹Kîý4ú„ÇÁ³×YÞ:KHëœ>ß Ä1·Ûø,ÿ,Ͻ[ID\§±7¬šoHÅQl ]·R‚ûkŽY§~e*Öy Q^éd7íA'oÓË5Ôƒ7Ì}Ž}. -ÔIì‰O[Ñǘ—"NˆF¬#Â^ë‚vÖïpþÊÀ¯jXéë'›õiG0>òæ ŽâKß|ÓEá+v 1wâH]?h|(9{ð‰Ÿîu¥©LšùRul!°0ôRd= £-cÝÊãû³VÊ" ž}dW¬9‹ÒJ.ÐÍÔ^G¯\+AsŒÇÄ'J34`Û®†345*>ЙàÒÌÞï©ìœ‰ðE‚òËŸy@¾Õ1 -]§!Rá奂IQ¾ÞXµ„²‘ ã'ÎO´¢ûT¨0¥ÎEI{Ðà:Ù“‹'Î>T«*n7“㘃 –´mÍ;º>F¤º‡+¡§Â'ÂCîi;ªŽç˜ôÈq<^´ï¦ôõZ#på1vÃAÜ¡‚¡®bÐçi÷Hd︩¬+7>WbUÓ38ûÍnßÖßœó\]lŒ&i“=röôôg#Ÿºí¢]–»EÝ9[üíºH´Ùé(ôÞͺ‘оhSâ_ÖsÖ]éD´Tò‚™t¼ ‰¬)1mÇCO]¹ùN7Œ:?z™tÄ;—ÚIIùQœ¾Ùºq`.·“â"ó“(‘vRÊí¤~Ý!YæýÈaõ}Û_ %.b?‹ßnm90—ÛHqùAÎm¤Od€Û¦ç.!ò»¥ðÇM˜:-’*Ÿ’è©!!%RéésË#W©¨‰“r' œ¹Y¾®Ü+lùÔŒ”ðvNQ£Ë±ƒFã©Âá‰ÖW8U}d ÏlqÔ>9÷b`ЩJNè^Ž¢¯åŠ«›¡G ÃDù=ž®jòÈÛ­Y™Ü¼nèÑÏePü|ŸyJûÏu¾ßK©GrÓŒc×0׌þR… 0æÅŠç_õAÑñZóå¸z8±n¼ÞOrlVæÆ^Êy57š2ýk ö¼8N36ª)CHJuÕƒû -S£IÝ(‘G”à™RÒ*>5ñ#[A‚8ÝœžÒ˜ ¥qÆVÌJ*QÓ°ÓèMU…Wµ­SÓ -“œ‘™}®y¦fã0GŸØ*,¶€û„ÍÜPQÔLÂb4 òþIaJdsgŸ ДУ`bKÆ4°\ª²%À©qk2A™‹­iThG'}ʨûÍ̵rÚÃ!\^ÛèÞ­ -ÑFRuЖr–H"¸)N%u$ΩÊ^0Ž “€>T .º(pD -“±† ±1ÞPI#FŠvhiNf¸¤‰£ -òÎ3]çÁ¶Q\9 kÓ3kä Š4£¹Çꮶ8Vs§ñƒhxG-HÌ×GßlYê­ŒCœø–éPÑzÝÐf¯†[o5YŒ›Öf’ºei„˨¿c;3G“-9ˆ˜ôá8÷5'&†AmF¬'iG>YÙŽ [~à¤sãbB³j6XO¡<Ù}‹3‹*j€AªƒØù:AêâRÒíÒiÅÁØiæ”%k):QÛì%…Ä=%§= ¢íù÷—Õ;¹ÈúÁ±·u%õI˜Z¥PerÿÆIÅÿ’Ðô(&"¨WÂä]HEÇ£¶œùç~2j$/SN—‰½ó³Që¥ wþ¥¦ÒjGédzklˆ±ç¡³Ï#E:\;nöRÇ:M DÂû§Á…×mnœKRœ‡ç> -áîÄß]aøÌ‘D•K¡™Kö›±ö/5“îø\Á¦äoPͦæ WɬÈ3ƒÙšS -„sÊ-ÄÔ™£ÖÄîBr¯ó…÷Æ°(=û -e°Âì2=2¹šŸ‰´Tµâó-Ï~Í­Ì7Š\=)[ŸT†î3ü$U3ÀwüÅŒy|F€¯á¨ü4ÌaYúIþõÄ~”Ÿÿƒ¥Æµt¦ÌäÓyQšíW¾ï¤oÜó/É¥³Z_O¨£;yñ¼q§D¡8—È#­Q¸éY5²è4w–aúIž1¼7ÝÔ…©®É2PÖ¥ít,QSy½;2J¨³SÓ ÌŽº“#nt?0ãÈ<4ßVa|˜ì·½L*ÎŒ,®¡k™2 n£Ør­´;>£NTã) "Ís/:¥‘n¢åè’z)õ~ÃÆç/÷¯¾jïÍ'¬K•^øQy®¶‚LÚÿõ'-¶ZŒý".Ïk[å~–'B ²"Œ^“›Æý] ½ÿùqÑ{endstream +xÚ­ÙnÇñ_±oâxîãÉ d)–aKŠI!?4w†»mÍAÏ¡ÿ>uuO÷H€‚°}TWW×]5 7ü 7Eêq¹É‹Ð‹b³m¯‚Ívþv +Ä€Ü80¯ï¯¾—æ›0ðË ÜÜ?.xR?IãÍ}õ»÷æ§ÛO÷o»¾‰ãØ‹üë›Ê½/Ä_Ô¡,(½¤7ˆeÔXÀqkÇèê¿fÔ’¯×iQ@}éMBˆ!ý¨-;žP".*3¯Öæ½ ‘¸”zxi?ñ¶B\|§n({L)‚æÞá 1D /¢É(D(sÒ>æB³•àÆÔóï<)Àœ$½;Y%µD:µ¹ÞðÇk¾ƒùp~‰#¨X‰±:Å4Ñ-¯Ñ51’ù›À“ŒZ$xy …I“ Ó2ñÞ·j§;À½GÆÔ›µqïâÐ/C/-~xw‡t9aÒ°Í¢*¶r¦«x›íVzWŠ¢œ Éæøjœ^s}…psÐôvXå"¡á|~â_C#¼™”9±æ Cq²c‘ýPïjºBГæÂï‡w{wÎádIä‡áE³€œu7‚lHÎz› WYgsé.ãkœËž‘9ýŒMÁ(»ï&hÔñ.#€i¥Aøq=cyqÖôrÎ.>qPÀ0ƒæ”Þ½5#¹ª­•‘µ¬,‘±š÷Ha#·âY²ó¯,YgÞxÐÙßþ„ÒÍHpõýN¡wGÜÏ2``¶É¢ÂO³ð?'3±å§S™ƒëÆAvBN9ÎK{#ÒY›—!=‘Xf~(þ/$ +®Ë$FAä—Q²"ñîW`åk¶©'Å‘Â=¡¨ðF“µð• cð–d|Ú c˜‚ôóˆù™:ùéË)@„~’Å—Mr9o“ƒoKÏå…Û«¼t5Kç>㟒,0®I"a’–°C ,œŽ ŠnYb!ÂUì¡·ƒÆS/ÇÝꉇ¶”A’'r”ØÁ&¡H"Ç”nXáá +Å2Jú`2ÎxÝÑ×£ÛŠ‰Ä0‹ˆ¯=¶Ir,ˆ½Å;VÏw³ãÝÏéBšAIܾ¤ ÌY]00H^vV.ÝfuáâuFÜû¬ëKàÉ$+ðŒß1[ã$âÔ7ɯּ¸ +Í°w:×cXNÆh¨äw2x^ä}t"`Þ×ß„ l>ny£ár#àd +!´¹…ž‡(T¼‘¨Æ<…¤{'r!“Z(dÉYÀª0Ê/«ÀC2‰`7ñã$sªä¤,a%•ª0ä +#מë2)N=Yîu-(m°rŸ )›¦—µÒ9Vƒ'‘°Ç¸ßëñ¿r­ºªUóÊl@õ%yÇ~zt-%_ ¨dï0fÔeÞºo²lR 5{×BQ’QîŽæ[rïCÙeÉÙ ëJ†»3©ûPÎä.pG û½IfNáŠóF#aƒžÍ#º>tŽK©xiÚ+Á2sº¥,oõ]#T7jª…Þ0è¶ïƉ’¤­å,£º[,R%+0—ÓŸäá8÷LÂÜ3õŽ›u ˆü³}BûÁ¢ Ê„ÏÝ#ÆiîœZ†èyÃÂû¶æÑÇ;ôý8ªŒ•aõ`zCš» ™4Ü0pŸ†Ó¦VƒÍ{R§J Ë/©†Ü´Gp|\ÁâNéΫbŒ¦'¢/ £Å¦AÈýòº|”t~#'úLlM3Çté1ë¨,]%?Ų•n7"rêØžjlT!ÖìƒrO|XT ÿ†¯¸1Ô‹–Žºï^q«ß„Û[t8X¤3ÃAIBàцpr'ª­š\’éŽÑ%¦QØã ñü”~¬âteúC8!Ž Ç‘˜®'§P«n í·j,Q.Óv£1ßþ†8Œ¢N"*M0&[þŽì³dŒ·ÿìê®ÐFpbcϨw`²EE”¾HU’ îÂŽÚNø„Ðqãë(ôÔ@ÑéQ8ÄÅ'ªr“Tº±æ˜ç¨éˆ-ÎË—üË‹Óü#Œ?pZ› ÜtÀUtBºàlyAm—¢ ždš—vèçÝž±q<Çm~Yà G[·Ÿ`òÞçɽ‰é8©$*æ,µwr‰£äœ¿\RCþŠ«‹2a7¿¶Ê€q¥&t ¥("‰v°Ýa8“ ºf\™Ji;9ì†BA·öTרÀfH9çÁÐjx'õtWÙ”iéN0âÌuûZê¿Â¬GZ“ÓÖg¥Èâ»5áÀ«ÄÔáLÂÄ!TŠŸE½hµ|éáKãóÌLÊÅÉŽ›ò—¹DD¹€£e¥pµ™md~Æ;B¾rUušúˆÝÞQ*ÃQþËRê%98HrRO† +\jžIyn¹mˆ<_Ô\·@Via¡ ô 7>#¼þ†ß©`†t¼‚uu¨y¦þãÐh]ljñdyñ’š…í8£8’†üQ­g[<Ñ°i Ô?9\)°HŒŽù‡‹qáW—FÐ<0G ŠEþÕõf`!“:žB«áÒN„œ ÀJ~)AÖÂœŸüÄ{ÇFÂKZEy¢^š˜Ôú…õ'zç+3=0Vž¾áŒÝï9Ý°ueÛz\¡`ëuqÇpÒ…¦újäçHaq®L¸¨s±TËó-øR¶ °Õ,è9vJ‰‚ u×m/u"~NR<“ úÈÀÈOf¹ëcmËà„)݃IAÚOÎ03î³}jêo¼¹*Y祵ˌÆÖÓRl‰–BÎTÌíÜ8±Œ±a +™äø½˜ü"Âo-w(ÁŠë\aç¬j°Q+ÑVZ}Â*‚JÞö„rH•`ý8~ú‘o:ö›–ýœÓr"c{(ûõ\ó(L ?¾Ü¨Y@ζŽÂ¨ðË¢”ÖQÊ­£î¡%fÞÌ;|Æ®;GH”Q·þ"% ÌÙ–QúAÁîç#™äNw\áO¢,ôn)™±Ì;ðêª5eÁQrÍ«·3´/*f.k^T Ã; }¤¼y™à!àRÂÕ%íShb6Ÿ'ÎX£6xt!—¯6Ñ–h#í7NëÈØÄ8ù‹CRšR¿¢saH7 –ÚiÂàö¶§.Í@b$ÛT˜%R¼§«Ÿn˜æ™÷UÏ6=ƒ¥ÕßäòeŽ|vž:½~~"iâÐ8¾šH ð ùuL9çÌδV1~Jó2VÁ(/jêÁ\âÍhñÊ7øŠgŠÆ¥ùÚœz<ú¼-d¢P´öÜÖuá2¤ oÛkU‡]Soᘾ,GQ" €ÛlÒÖ¤X–LÒ›#áB°¾äV#á ž´j´¹RQŸ¬)âÆBdJ&-Nøpy–ûjIuõg~tÒ•ÀæÜÿô[K;ö‹øŒ?J!ÊòDhAI…ñKrÓ¸ðÓ">¦÷ßÇ\Ðendstream endobj -1306 0 obj << +1304 0 obj << /Type /Page -/Contents 1307 0 R -/Resources 1305 0 R +/Contents 1305 0 R +/Resources 1303 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1229 0 R +/Parent 1314 0 R +>> endobj +1306 0 obj << +/D [1304 0 R /XYZ 85.039 781.388 null] +>> endobj +1307 0 obj << +/D [1304 0 R /XYZ 85.039 761.463 null] >> endobj 1308 0 obj << -/D [1306 0 R /XYZ 85.039 781.388 null] +/D [1304 0 R /XYZ 85.039 736.955 null] >> endobj 1309 0 obj << -/D [1306 0 R /XYZ 85.039 761.463 null] +/D [1304 0 R /XYZ 85.039 667.088 null] +>> endobj +1310 0 obj << +/D [1304 0 R /XYZ 85.039 625.834 null] +>> endobj +1311 0 obj << +/D [1304 0 R /XYZ 85.039 587.914 null] >> endobj 38 0 obj << -/D [1306 0 R /XYZ 85.039 718.394 null] +/D [1304 0 R /XYZ 85.039 530.827 null] >> endobj -1310 0 obj << -/D [1306 0 R /XYZ 85.039 688.99 null] +1312 0 obj << +/D [1304 0 R /XYZ 85.039 485.752 null] >> endobj 42 0 obj << -/D [1306 0 R /XYZ 85.039 402.235 null] +/D [1304 0 R /XYZ 85.039 158.35 null] >> endobj -1311 0 obj << -/D [1306 0 R /XYZ 85.039 372.831 null] +1313 0 obj << +/D [1304 0 R /XYZ 85.039 115.396 null] >> endobj -1305 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> +1303 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1314 0 obj << -/Length 2207 +1317 0 obj << +/Length 1141 /Filter /FlateDecode >> stream -xÚÍÛnãÆõÝ_¡7K€5;^¤@6ëÝ:Ø8(V) -8û@K´D”]’Šíý÷ž3ç 9´(íCìB3œ9sî·«™„j–„Bšt'J˜$™­« 9ÛÂΧ ÅAhD0ŸØ\ºÝe¤… âI¦±ŒU*L æýêâÝG-gZŠ(2³ÕãL)-ŒÒ³( D`‚Ùjs?7‹eÊùj—/–&ŠçmV-Ôüa±Tó W¢ùœßÀâ{œüú‰VÛ׶˫Å×ÕO7«žf#J¥Ô$§r¶ÔF˜Øœ#Šb5ðÅPĽ(’B‘ wù3 ò r{èž}yÝwVª—SL‡(œg«±\©p¦¤He:âJ'"ŽcËiÕ ­ýB'ónaéÛ¥úGcµ öräï&‡í¶Øø%Ц5Ï“*€Ï’-oìÙ'Øiò§9Ì7LÅ.^£èï>šhÄ·Âp¶4RÈ„ØþË&8l‹2ÿ”ªÃùõ÷ßÓäß4@Õnyÿ?ˆ×šÌ–¦‚Q,Ó#¡Ý¦áÓ—¿)ì/ýÍ.é¾!M<¤ttŒôòž¬n¾á¥+^ú|ó÷›Ï¼ö•×>Þ~v`×¼tÿñ×»W·¿Ü}u|‡âöîfXU—'&ÎÏh­,öù¤Ú| = Ëê櫱¬1GN¸”)¢‘1éúùJà<ÎzD×€Ëû--9Ÿ\/t<ß¡³6Ùº³®…p|>Yã -zåaSÀ¯;Þ9wß;g~.í>/¯Ñ%w„³Nx…ÙTˆ†øÏc~­™¸yoÓLËüwD–##æ»QÇ£•h­¨Ù6w!J”mÏd8R¶,§[„Q"5ö„C!| -%ÑF‚„¤s냃 å JQQxvYõ4¥rKÿäH©œ—,œ/0/`np‰áSA]ÑÆ3žBµlÙ#E½I?@Ä,¿m¯½gÔVƦÙæû¼ÉÈCŤHUœ°?êù~< “¬»¢f“<¢¶‰y ¸Ã3cÆù ÆÊ&±}VcfÕÌɼ½g×nº™tEð#7xg‹‘[[ÿA>*¤¥~ófÒF'Ýv¬ÃŠ™Ôé¼ó¨fÝ´ èNùDÆãñïO ùžÊB±ÎÊòu‘ó+ö—žb×Ï„½ÂâÍöƒ!‹öúmMuÕÐ@Ïbâh²ª:˜¥4QWu("Èiù¦˜Ñ3Pæ<9ù5“Š0 GÔ~;Û¶O—e½}xƒ»TÙ† §žÆîà;îDœÁ(Nj4HD¢ãoht:£QBõIž#ç4z–šÓ¨Gí&£RâË©~0»Œ'¹Û‘½nav@ÅJV¬¤ÚÃΡÌ6C°úí†æ}xéÄb 17lˆ ͘jÛ÷Xæ¼ÍqÞå-?½bW@¶~@Á_GEÁ¯–ýü´ýµ±N¾aÿèŒýˆúçSö?GÎÙÿ,5gšU³Žu¯fœcâ„ŠNo‹kˆ -ТÝuÚÄÕQ¥mgVœÁ…_¥U'u %-¡³¼ÅyÔ) @Ÿn©á©Û±Ñ9‹b¯ ãÔºoCžýϾ9éZt-ÍW®#îDú¼òk;¤`J[¿=i[Õœ÷²½•4™÷þ‚'Ë{>²‡‰Çq=Å•Îc«;Hi_Hew 2jËu]–5²òŒ‚«x,8ÀP²Ügcxá=aUì.ÕG -îe´duQ—½.¢„u{½¡9Rrµ'L~5aÊyVÌ˨¼J"K)²dA¸Ôâœr‚W»wäŸÜì Èq †×55Ÿ™í'h­sXKÛšó‡Å{u ß(ç8-õö¶¡À}ùQŠ: í´"9$©Èi·Baàê×\ѽه7jpœ¬ˆ[Uæ[$](óNÑöÊ°•3’¶/:šÛô)ß•Ç€Ur”ž(­€¹EšhÌ=ÿº¸ÿ*gÈS?]À=.TÏ0—BÁ­º0Âœ¿Ê‹/ëQ¨KòA±Th3¯ÇÏD. "{LÚã7j $µRBƒ0çÔ*J#«Ì:VS÷ÍåÛ‹ˆ»êìk.’6v ÊÙ ¥d †’ëfQ=•y5zå¸^Qà–Vtx1[œ©¢:"0æ|õ€NWQ„¢§ªèYr\EÏSsîîQ³U4Hâyå÷Ž¸@íFD”ÐÄvL8ãn7±âø•‰šW«ºá#|Û±D®ð "àæÊuq><T}´S4㮋fœg‰wŸ5?° v uÍ)Í^·–ÒVî'2ôn·f³C7ùð¥Gï$÷àôÉ; ÿ ½²(}†×:¼âO~ÚW±¾Æ …©õ3dÖ>£~¦½Ë»‡¢nù$Ê6o~Çf¿aÒÚ,jQ‹BnùÔäYù´Ëhî„ ¨oêÚöcýôÚÛ]G?ì7 ¾zÚG¢¦Øls¼ªYÄi,á'f}z<2ªoImXê²Î6OYS±äqd&%g¬·û¢+²²øÃ^•ðü¶¬2æ -ð€6:Œì‰,mgš»Ë`ÇÖ߆cEo4ñPù £âh÷Bd\'÷Ò×þ'÷„êu8Ÿèº`ÝÕ9r¹˜k=Â#hÍì”E;ÜÅcê8ð,]ýcåš]2 ì¹ËÈýá2’@|gósùÝ:;àeW » -Y¬êEƒÍAñ  €Fȯ»°gÙ†1ãñ àûtK ·¶µè_ -TJí—Qî1`þØk×u¯zl/8a×Ô*´®q¹ì¼×I›«¸aiºÑ«ÕÛj+Ô,‚K&Ýíÿ¯Å2Llí^ìLÔÊH‰p`ù\/`´2áŸC:•/MÕyéŒÑ"õesmFŒ8ñ'ˆyúEòä_bzÈ ÊÊF12û\dÞÒƒråÔœ&ø_†szendstream +xÚ¥VKoÜ6¾ï¯r ¨XQÔ³7'p[hÐÆ*zHsà®è•=¶å…ÿ}f8¤¼¶7É¡0և߼>Î %‚þDP¤<’e‚Ë¢öý& +°óÛF8Dè áæ]µùù×4DÄ˨ ªû';)ORTõ'öþ÷«?«ëÛPJÉb¾ ó¼`w[Á®þxw…Ò„]}ÜÆoªë÷Õßìzû¹ºÝ\W«ÿÕ2ø*Ñù›OŸ£ †@o7—eœà=â¶û xçi"ݺÛÜmþZMÑ^Ö¥\SY𴯓é…dÓˆ§Qb“Ýa"U‘2U×e;À¿J2¦¦Ã«^c†BÍül•S3AL£Iû‘ÃÞ´ã :´cVÓCÃÖÈ +u7·aœ“÷œQб¶£!½#ìMÚœ›êõŒZó㶠N'‹"v7¾0pBâ¤Ú;_pJ@Y(ÑÒRpjMÑ1SôhZd ÑS8NµžHx–ž#Oõ3ELª`#ªYÖ§3`@:â«ôðeµþ7É %¢º§GZï@«³jl¿ƾÀ’N`]5ÈòL&çi¬õÐ9Å^ÕúB²Æ* ¤&Gæb-7(‰ØÜöÇNO¿€ೃ +Ð…ŒJ¶ôÝÑáMÎÈxOªçÁÑæóq§« ¶³ÙhZô¸­\y Þ®QI´ºx²Y¾Ò½*)¨¹@”–Šµœ€¡4΀! çŒƒÔRÐÚÈ2¢B“õYõîÍVœíëÃ>HC9ÍÅ{‚UŠ cŸª·nÿË–ijFt‡9äÉY`k ¦Õ+ø»qa™H Û›çјfòÝe‰œ=k¹d;$Þá}œêBYÌP6KyÇi´çkówÍƽNœófêTÆVH»Õ•­kS”Múä ±â$f˜þYÕXÈB² +.i„‰›' ™Ää”Q¢&³òÁúݹz°¢Öó€.ß:ý“÷£ žZ±ÍœD4ÅPpjW2]t7+X9wki:{Ìqê•ùV¿Á˜Jmå%"sC[¥ÊWîðPhFz'?6üyØ´üFÈnqægÓâàíhõDŸ>ÎÎh㬷µVô†½kƒ G½gžzÀ™ÇÎPn¡iƒÃ·ŒìÕ¨ˆ{Cúø²7¯ûïÂñ¾¸:…ȸ ²$æBüøæ”<Î/ß›! +Ÿ,½¾…(yš¯Þl3˜ ƒ¤§k ÜIÍkk?ðÆ ãC˜Fͤ§ºŽ$¾QXk£ÚŽÞq²/Nk°ÓðHð‰FãeCèíB‘:¹ höõúüZHÝx%ªi†2á©Lž©½5¡óÛõš†ÜJîlj^_–ƒÃô¬G‡j^ëì6ƒ°ñ³VŠ7žU†–>“Îô…E=Eˆ $Hà„CŠ$jpÊÿìõ>Ü¡ ¦1Ø#}aŒ“áßø2“ËK_Sð#nþ×GÛúý™H^Èòrõ¥0O³> endobj -1315 0 obj << -/D [1313 0 R /XYZ 85.039 781.388 null] ->> endobj -46 0 obj << -/D [1313 0 R /XYZ 85.039 761.463 null] ->> endobj -1006 0 obj << -/D [1313 0 R /XYZ 85.039 667.044 null] ->> endobj -50 0 obj << -/D [1313 0 R /XYZ 85.039 667.044 null] ->> endobj -1316 0 obj << -/D [1313 0 R /XYZ 85.039 639.536 null] ->> endobj -1317 0 obj << -/D [1313 0 R /XYZ 85.039 373.804 null] +/Parent 1314 0 R >> endobj 1318 0 obj << -/D [1313 0 R /XYZ 85.039 360.254 null] ->> endobj -1319 0 obj << -/D [1313 0 R /XYZ 85.039 333.156 null] ->> endobj -1320 0 obj << -/D [1313 0 R /XYZ 85.039 251.255 null] +/D [1316 0 R /XYZ 85.039 781.388 null] >> endobj -1312 0 obj << -/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> +1315 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1324 0 obj << -/Length 2026 +1321 0 obj << +/Length 1631 /Filter /FlateDecode >> stream -xÚ­XYsÛ6~ׯÐx¦c*cÑ8HŠtŸœÆ¹÷ŠÒL'É,A2kŠTxÄñ¿ï EÉ’ÓÔEX,öüvA9ð'‡qè '±ôug«.aåÅ@:Š±#÷hžN§Ï#X~"’át±áúA¨‡Óù輪ç¿M/þµÖžöGãÉ$ö¦//xâíHzç—OÏqxÏ.`øôÝ áÚ_o§8w9ú4}=¸˜vâtÁÑ Êòyðá“ÎAî×áë$Þ»ð%,¯ ŒÚ³ÁÛÁï+^ †¼kŸê-ÅX&~¢Â‡ÍI?ˆtg«¯ƒÍ#¥òµTÃI(üPdí«Ñ8 …7½¶ w4+ ¤÷Q„bDÉ+—fV‡LD~"' ·¡!ádØó]'œŠ|*î]2bâ |†^} ¹¹gðŠ¢¢˜,c "oE2ÒkZñ³Â|6Rw›|içQ$YÕþ~8ÁÜŒTìÙŠ©qp‹?ŽéÚ”Èd…²µ-+b¥È|`Px,Ñ] )ðQÈé+$¯ÁŠaLbé0],¿¬,®VDc–n2³_HœÌ€Ã º Ül"j;+òù®W£1h R—ù¡qÍðpÑäÀyƲI/-r^ž™,cŠºØáúÌ^¡9—²³ZOét^°½kd'=Ÿœ›û¦™^›ú˜MƒÙFRÐÚOê¥8\ú{ìúÒ–d™“sJÓü×ÎGkxË,“Ü^§¤/E¯ ùŽ—]l±½×L`xé -ÍSƒ«ƒ ð^-xíŽÂ¢áÇH“ÍÝ°Ä£jŠ‰Óç:êú¸5†¾ˆ'¤ÏºLózA 7UèM¯Ñ¡øÚ> ?~pÕ­*ÿ£ÔA~tâ¶ÍÁ=Ë# w~äó·íþñäfšƒ*w:´É†(Ð)õš~y¦ÛSÏyñ¤Ýeóýö™0—ï6QL2v¹ÊÚ‰“NËÿÙfÿÉz*IzÖ猻¦ƒL¶Â½¶6Ò›·ñ‡ÑÖ,™ "Hf1òÀd瘗8‹‰¼ufJQ®LÆCŒz©‘’ÅàpË¢@@¢Ü0u.È—¼ÉV”„fMÈÁ D¹7Þ“¾ïåÍÁüþ¥¨© @¤@¦ã›Æ„¦'‹ K¦E)øiñçí×ì%6î…Ë4.S©~÷ȶ”ϯx‰=U;¾?9Ô¡wii¹"F™µÂ’µ~ãó2žü0¸JÁÏPãjÒ€Œuň42UŠè{7Š„ü@^ÚÕ>ëJÜ®¶$„Ý:½­}™S†G5@@_âöCθÍ.>y‡½ðˬÀ¥`ƒ¨ü2 -CÖ³±ýFÊyHzo.þĉ78q²-}8¡œwï5aUmjËÅ–ÅÛSúç\ãfNSb:¸ò5ÍRë4›7ª9@×]]qØ?ƒiÿ‰d{¨Z°×Ho®k¼7à ¼éõlBSÔ‡›ÐCƧbrªðÉèLˆ³P:@Ÿø¹H7fgPä©# -Hw5[B£;†9 ‘ÛºÇJ3Ëž°f†ºa¹]co&»M˜17¥×£Ÿ¥ 2 ¤y4·<î‚ÈtØY2‡'ÔÚ´ÑÿÄÊh ðÙàùë¦fâ5…ÐÄ›7m;dçLxÕ¶@Õ¦Â>( tv€TçªÈ)BJ㈠-hØ AÏ JÆpˆ!cQ°|Ÿðr¶ëÇ”)4Úûu+ú“áH8|ÅÂäÐEIÆkÃÀ$c)ŠDé>|P”E³Ä¨Pì\¥¼…+aP”ÚüPP 8HÛ’GÐÁuñC‚…”aS]“×`Ø~ôËÏÖ)¦ ždx"··YêB -§[n–\(H0öt{¡ð^áx±§OmaN%±G3*Cæ)qrÂfKZgËíê^íbgoq²™*‰v§ÏÎÅóËŠÈ+\EyúÉD{sÊ ç} H¹¹Æ×*Ý”c'’Ys—¬8@·Œrx}ßI¶fžL\Aª+v¶Å”aÇÁìßXY*·}'cïç ¹Ì—Ü%ìš×Žc¹îFÍÓ¬33³<{µiwf¦©Üì.*ɘoÕf(îÜq€ÛÜ)ZðšÞº8nÓLY§TIa5£âÀ åÛ½é¸|bð W ™„z­°Ó¸ÚÜÚaíÐ…HrÙ¹ÁÉtCVš÷ ºFf_¯öźÉnHþ¥»:¹ÒÙÔûŠšRßÓáQÍÆ”„šßJ[7eŽ¦6þ`¿#fÚ»f!³»ýÊc'߶decö;ÞÃÂf•ý>öÏ lù6ÿðî¾óí»Íx§ÓxO±z]p”½ËŠÚ¾FðòÀÞLÚ¢«î݃TûÉp‘nV:x§@Ýï -$9+GÎÕÖ˦Œ Uÿ"ÃŒK{qs0I³ôf´iÖ Ò«oÆë£1F7b‡£ý€ë%ÌÃ]!øÁ€~̱‘|èØÛa¾§ŽºÿQ'm¿aA;vŸ+Vèã¦k€¬á«‚û¨ã.{eÜuà^ÉÆÉ›¶ô0c×}µîJÂPÙÞO0IŠ«Œ«ºàÛ)h£’}_N០ò¨/ÌÝ÷×@û±Nö~ ÕÄ&“ jíˆêØc}_ÞøŸ­Tendstream +xÚÍXÝoÛ6÷_á·È@Í’¢>è °¬N‘"K1Ô¤yPl٦̖ëÃþ÷ÝñH‰r$ØÓ ¤Èã}þxw´søc2.gãX &•/‹o`çãHŠ ”, ˜÷lNíî4òâ^#c‹“@š«ÅèíµÏÇ>gQ$Ç‹µU$Rœ)Ž«{ON¦aȽÅ6Le{û¤˜ïq2^‚+‘÷çsX¼ÂÉ×´ºÙ×i1yX|ÍV@1õ*ÊÇS_2ûg­ˆÀâ`ºVˆìŠ\+üFAV0AvÜ¥G²ã3*{¨Ÿ5}y)kmÔóΠ–OŽV«¥Ñj‰p,8›ñ™£V¨þL«E^•x«œøÊ«A:|K¯ZӘа令Ý#L›MV¸¡£9L+3ÿÆEŸ¹ášíiÜÙãO0Ù¥{œ¦$0]Azñm{-#Gm!X†2É"Ø@µZ¥‡Í:ËÓwàU?ô.ß¿§Éß4A±ß˜ý¯mÌølæ0!Á!4 ÚÙ®væôÅ7!ƒòÂݬÓçú]‡©r˜ÒÑ.Ó‹{Ã`qóëÜ,½1K·óßç·fíÁ¬]ßÜZ²K³týõî—ÅÍ绫H°,nîæíª¸Ô4?ãµ<+ÓºÍ!j¸,æ,ºÓÁì`pÚM:‡ °x1¨Ó¨¨4]7W˜àÐp„ê¬4Ks^œ>“ÂïÈû¹‹µM“.ójszéZÐÉÊÄO=uAáâ¶çŽÁÈ*âAuÖ¡Í C- è:ôœ´Æ¡gÅY‡ºòæIs™#ßõE„àrsMdü‰äO8px¢Q;Æ„†m +;³T®hRÛ«ò\3¨žRØV·Ko…ì›>*Ñùv×”D#ªæ lÊ)»aѧH>¢]/Ns×S #+aôÕùȶ4Ñ54ÔFöŒ´6²çÄ5‘u䙎—šJ«6YÁNd³$Ü¢=-è„®©·´`2f¤+¥CM5O_¢Ðö{2jôº-ˆÌ­‹œ<÷µ‘×dWjpª}›ZCÓ€:ëê"úç´ i­™Üm›-»("Pn/L9×SL¼ÐÐ:eЬµ–•-›ÞÊc½ Ä:iq_Õ¬‡aûuuÞmu‡[ÝWt[Š*Ï+$9²ë <49±ÔæIуuhýŠ¬4ỹ20OhXV9™/¬ùÜv +ÀU84Aª9ºg€ƒŽ4Sœ`:,ÐaJW>-ûZ7`Þk#”ýˆVÀ¸TÁ¼2O< %Z°yÛ4À‡.î‡NÇ€©I)ïC +Gì–«¦+N˜ï€¬êa¼¬ +›°à¹¶CŸÍd‡¢ÛW)Ñi![éç€"AµÀ9¸þ‘”ÁAH1^EG r¸n:鬦OtŽ}Šmuì¥" IX6ƒô‚?ZHýöþktÿÀÇ+È[ŸFœIheŽ0çL@³YŒà‰I¾òÑ—Ño-'àÓo,ÿ•BR#¼°Zu^gF)&Z•; ð©uq/5ñ±.V€õëTy?t­+’¥r  Ì;ICMÐð5(*}³6aï,À|]BKŠðŒsÙ¹”Yñ”[,¹Msó yÓvÝðhÓõ¥yªõT_É™?s«á` n({\X•ad˜é^5<•Jð±’Ãÿ‰ µÑendstream endobj -1323 0 obj << +1320 0 obj << /Type /Page -/Contents 1324 0 R -/Resources 1322 0 R +/Contents 1321 0 R +/Resources 1319 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1321 0 R +/Parent 1314 0 R >> endobj -1325 0 obj << -/D [1323 0 R /XYZ 85.039 781.388 null] +1322 0 obj << +/D [1320 0 R /XYZ 85.039 781.388 null] >> endobj -54 0 obj << -/D [1323 0 R /XYZ 85.039 761.463 null] +46 0 obj << +/D [1320 0 R /XYZ 85.039 761.463 null] +>> endobj +982 0 obj << +/D [1320 0 R /XYZ 85.039 653.495 null] +>> endobj +50 0 obj << +/D [1320 0 R /XYZ 85.039 653.495 null] +>> endobj +1323 0 obj << +/D [1320 0 R /XYZ 85.039 612.438 null] +>> endobj +1324 0 obj << +/D [1320 0 R /XYZ 85.039 227.751 null] +>> endobj +1325 0 obj << +/D [1320 0 R /XYZ 85.039 200.653 null] >> endobj 1326 0 obj << -/D [1323 0 R /XYZ 85.039 736.114 null] +/D [1320 0 R /XYZ 85.039 160.005 null] >> endobj -1322 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R /F14 969 0 R >> +1319 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj 1329 0 obj << -/Length 1795 +/Length 1716 /Filter /FlateDecode >> stream -xÚµikÛHô»… ,È)FG -m“v[R¶»õ–¶Ù’Yr%¹IXö¿ï;FGlÙuI—kôæͼû’Ûð'ƲlŽý@X2ÆóÕÈ/açõHh S£˜=œÓÑÙ+vm+´ÃñtÑÝ£,WÉñ4þd¼üíùûéåŸSJiHkbú~`L»dÀ‡‰0ž¿{ñß\ãâ^_üõšßpïïS„½›|™¾]N[vZB@:D^¾Ž>}±Ç1ðývd[2 Æw°¶-Û«0c)Wê÷lôaôG{ï¹c>5$zƒaŠÐ -uX=ž°\O¶êq`×µ¤ë¡z„p,)œ±¯lKÙ.éGZrb*eÓ›äö|Щsq϶²á_à®g¼‹æe±O®g…Â?Ì`‡C -Õ³_Ë ãYB9Äà›|bº¾oD1"Ná§N «á­ÐKd·Ù—É¿WE¶A¼ƒ‡f%o'N`$(3¡zF–æ'œÀXò,fð›Ίƌ!ŒjŽ¿xQ:›˜ŽÏИoŠ]øùFdNQ‰ S uC’µ¾i.+Ñah¤?#~‰,‰r~EÙ´BÀ³=Wh+ÂY,ˆÖ›o¬ð -2"½æ EæªdèRk¡áQÍR>âç&‰â¤Ô´ßÔ}‘It—fH®@ëu§¼9F¸ß¹ã÷:¹¯õªà“d%ô(pY6‡räºf¼8™m–¼$!“ŠŽ–úxOÌœ!èM ML«ÞQ€ÀÊU¤ù@“o>ÛBj]4L{éj]㵓À5¬»’Uß1ˆ£`:4êèžaÅ‚Ÿuƒ4h:ǗƊ͆8D@-Û°®"›1¢>‰²—Vá*Í æì•ôzAê8´2¥mÙOòµ·@*q”aŸò!'Óä_›'ÇÅ"-«š—i‰õYH7?iÏŠnõë€R©é‡èVɼÈãmÂÔ7iÏèVV3!£õµõ¾ä £7ϵ³îªº=ÐÁOP=‚3Û?“Z`áÛö¹ZnûK£×,±æç‹M>ÇÔ€êPÂ!FQJ„r·ôh# º÷ñªþ±ãÛŠßSxˆd«Ã…§‡³¿2º¡´„£tet÷UÆ«‰p¤ññêøÒè¡¥äáÖ¦‡³¿4º^`ù>—Æßuî”n@‘ °ê¤ëkò²Y–¬š´ À»Ò­° -6¨[IAý$ N yGúžú3 -Ò8›a Ì“Š«“¼-‘±æ±ð‚eRsßqk6£RÏ ¼±È—Pg\×5^y•ÆTª$æ7D¬‘¨ÜcÂ#©×ºXãÖ‚Ê÷Š_Pq+ˆ+u¼m5ÃòBš3e9Žü~‡'-ȵƒýÙÜeö.Ûµ¯„ž,ôü–"ª¤êje”ã£Øäm¾€È¦ãø–3œœå)%Æ - ró(»^EU”×p9Ü éÓ–V™ÌÍgLóº·ƒ„Ìgø{MôÐ1÷¦f ˆà‘¾Ú¨RŠëu×d!Ð¥¾„ž­ç)N]øäMEMC™D·ŒšÖ )ž ñßé.77|‹ v$_2欷B P#Ì¥¸àQAF‚VWxä¢Á?ÅœdcÀ¢~M-r¯3[UYÇM5äOT+Ô¡b/{E—WÇyØêüÉòדÓÎɇ\ì§rv(8Nö;óOåáûA89G780NBí·*8Q{Q¥«4‹JtF‚¨‘®¹–FårÑ0õÀ€<7ý5í¯yÞ‚: ú†dp-¼o*ªÌaÛã&i*´[Úïf¨$ -*u;ñ¡5»Uƒ€†2A•sSæ:ôƒÐ˜NIh›„ñR¬Å/°3Ž 0ëÍ#™>X5[US´á;ø&aÀ½hMÜH¾bêˆôáºè¡'̺u¥—5Ì_z}…û/¯¸²~›àØ–m0Fð“á‘Y"]tþÇachr­}Íé?»ce<[âœø„œ3K»·þOiå8âOÎÇ‘yrr"óïsòÀ½58W/¯Äž­kyt–<ýR»w¿Î"ªšI¬»F«]Ö¬Ö­y-uWé/ mãÉbóA¯ŒbþÔ᫉S¼I=`7Uœ®¸éNηûʦ‹‡&Þõåà4Р˜ÎÀ4à(˃”«qP(±3õ,!ÒbŒÃ¤$L%ê“ÒFs)òW!ݨ÷ZñÞמRPigÐZ‘7¹Ÿ^æ{g;p'âþÙßžôùµ›¾¤ÈpX -šjÏw5/¤mµÍ.Ln '¹ËïÂØ…endstream +xÚÍXéoÓHÿž¿"BZ‘HÍtÆã³û©…RŠ({VZÜØM¬uìà8”ò×ï»|äjµbµZñoÞ¼ûý3ÔðÇ COi ƒÐ(†ÃÙr ‡sع¡˜ɤGs1œ¾ò‚¡Ñ*ÒÑpz×ññ”ëÙá4ù8zñúü×éåï㉵vdÕxáhúú’ÞÍèüæâgîèå%L/>\ñ ÷þ|?ŵ›ñçé›Áå´§½®ŽP–/ƒŸõ0¹ß ´²Q8¼‡±V¶—Fy®•y>x?ø­eÅ{îOR½¡˜X­ÂÐ}Ü<žVžv[ó¯gž(T6°Ã†Íãª]ÕŒöUè…ç½ÛšÇ¯3ÆQÖ8[÷M)[w™®Ç3ZÇsY¨Óo5;%[ IœÈÞ|°âÍòŽ¿ßS<^•²ZñwYVr$ÏàLÁ—œðfÏÆN0Zð¬N«eVÄ5«„—oÇN8zàqÌŸ"½Ï³¢¡#ƒ 'N °%~5ø u{VDñHEº¾\ŠLé·x¹ÊSyS¯€pSŸ!ÃÓWÖï™Îqh4q­òm@Ü?B脧þÚñÄs¼‘qÎ<ïÌñNdú™¿Åò6Q³³OÚÓ¾ÁÇÀÆ@Jxà:Œ¥ˆ8¾KëÛ¬\˱<’V_ÓŠç0Xge!¼U‘;YUiœ¯1/®ë¸ªÓ„í¡·8¿(WU6_ÔLy^$UzÏãi•%ó4Ï…q¹ø ب„|Jm+jçeœ¬âj)ª¾=¨ºGL¯‹¬Îâ<ûžs>>ÏËÛX„6` ˆ5{f+¨'ÖUÖwÅ5>²¬Ñ©ñ\cGÇkŠyÄ·ã DW‰!öäTµ;ºÃèÀ°›aÕä 9ä)J&‹+ŽL¥\MÑOÁâ¥rWšE +ùU5ôE +µÑw\Èи~¾>àT>à˜Å›5 ßceÜêáøîAeqýs0^ódNìÚܪÈzM::>KMÜä‹EùêšÇ×E³‡qh1ÃØ oõ¥ê™•KdŽ‰—å¨<.&e§Ùºx^óêz³âªƒJ `õ›È={%ÔUnè =ÏU¡ Ÿî–jÉ¡î`Uä0úP­Cåb5éÉs¨Zå÷„Fõ^}x÷bzýË»=G™Ðûß(ø +šÍS +†ViÇl)¸ŒgMÜ•êH“÷lx´57m·GC;° uÂõ{¨걊 W Pj§¥ú`f„ÕkLÃ;7ñ ÚÜÙ´UÖ>.ZK²o¡qýHiÃ¥ñ&¶«}j´®î×HH¥Ãí%IGCìÛH…ݺV ù\̱IL|_·k›Eÿ%õj-áU +á½¢2Söri¦VL\§= ?iãVmíëËåQåÛOa)¦t #yS‘¸rå‚ ¸v€¨SŠ«W²\›á˜ËfIu$yØ10îØbRâaacƒ¤Ë›_’X·Ø榳ã.›§hA(‘ /¨í:é䧣¤ùöá£ð&yiý[ë ,œ¹¨¿È¨…uÀk·Ë-CçÄ‹Ã45øØu¡Ö‹Åðl¹áÉ=Or±þ}…WÕé<¥·úõªÊŠúŽþ³é"Ô|ãü$SÀFˆTÕ'cÝâ™@gIz»™?ã ºáçxAo¸Æ?EÒ8· —=Q¯èW‚©9S'¼ÙcqØ(sùÇviÓ›UÒ'­jÿ²¡þ+“õ©P mža (¥øˆŠñ— ?Š5§É9—ðIY-cÉÉÙ³@£KµåÚ2lCâºæTè¿fÜ´êA Ir^õס”c` }dAT‰#¾[å·‚n#9ˆ˜¬Ÿ“|NÒtp¸õC†y*µO®]ó—Ý ²Ô%5Z°ãMŸ iˆ»ä GNwXrFZ(rF…TaÏÖôŒMwyPõ/b®WX+ºôÊ ²:0p:÷“~»ev$Â%Ζä]7~"fTíÃMXI¿lb9…¯È²¡æÍ“Ç_ÇžZn:y¤âW0z{ù.¼=92 (ï…µ¸ „`çeÊ–ÚnJdCîC³ž1z/¸­Nq$¹ºæÕ¦ÇNè…£ýç®ÛÖêqï¥=ihmï¡lX½~òÐk¦ÃO>˜ýþË18µR½Œ¦õ™g¤*iy9ÞÁK^wn˜ÐÆ {8­‚Tç¶ áàfµr¢C¸ þñE?ôŸJ-ú{„6:Œþ<ð·¸" *fü]qØz¡Ý—÷oy§Fendstream endobj 1328 0 obj << /Type /Page /Contents 1329 0 R /Resources 1327 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1321 0 R +/Parent 1314 0 R >> endobj 1330 0 obj << /D [1328 0 R /XYZ 85.039 781.388 null] >> endobj -58 0 obj << -/D [1328 0 R /XYZ 85.039 761.463 null] ->> endobj 1331 0 obj << -/D [1328 0 R /XYZ 85.039 736.114 null] +/D [1328 0 R /XYZ 85.039 761.463 null] >> endobj -62 0 obj << -/D [1328 0 R /XYZ 85.039 511.057 null] +54 0 obj << +/D [1328 0 R /XYZ 85.039 538.398 null] >> endobj 1332 0 obj << -/D [1328 0 R /XYZ 85.039 478.735 null] ->> endobj -1333 0 obj << -/D [1328 0 R /XYZ 85.039 79.901 null] +/D [1328 0 R /XYZ 85.039 492.527 null] >> endobj 1327 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> +/Font << /F57 1075 0 R /F15 951 0 R /F36 955 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1336 0 obj << -/Length 2029 +1335 0 obj << +/Length 1701 /Filter /FlateDecode >> stream -xÚ­XYã6~÷¯ð£ ÄZñÒñسәIÉŽ³‹ ɃڒŒmu$9þ÷[%úìvÐh‹G±X¿*RMøSÓÜʼn)¦Y®b“çÓå~’L×0óa¢„b.$ó€æÝbò¯S˜Mâ")¦‹ÕÈÇÅÖ™é¢ú5úçLJÿšÍ1‘‰gó,Ë£ÅÇGø4SÑÃ÷ï°g£÷Ð}÷óîáÜ/Ÿ8öýì÷Å·“ÇŠΰl] ,N~ý=™V ÷·“$6E>}v+˜ÞO@˜ØY#ýÝäÓä§ÏÙ)¯º¦ºÕi¬3h˜$Îs{•F)¥Á>.‰]bû(ØGi§6z"4ŽÏ•SÆÆÊLN—Û1É»™"v¹;Ùí—Yn¢æ8›[¥£eyÀ†‰Êy×Ìæ:‡Á¾æÑ¿fÎEe SÛò )`\EO6¿%ÊHsÅìú,ìúr9ÓYôÙ—=·^Á÷ÚÉÒv^yö‰öÇ®®¸õ²í7(ÃaÜ v+€ç -Ò‹CÙÿüá»x#ú÷w¿%.Åáô¨8ƒŸÏ—vfÚÄ6IßðóHtÇÏB„š›~¾·÷óÝݼŸƒÝ~D·‰¶ì¶Žlö^ƒAÒ$"«¢g°³íø;8;­÷ù®†XH#à'+zàn\UõÓqdÚûgè{ž\âjŒ2ì 3dˆ„4Ó0ÃCâ€þÆ™À߸êÌß[0$-’8-îbÞHBÆ×0icþEãK@¤`^nÅÕn6w.‰~¨_P§,úzf’èxXöÛæÐÝD8\‘uìIÌ}1S§¹:‘SÅš,À 3ƒœ1˜I±°ÕÓºG‹Ö÷ƒ)oHj³8³î¾0#Í•ˆõ¢Bô’0‹ Å`¡¢ÆÛ -’è¹¥¡X!U>4ÑÏÇ5/Ü×ä]¹®™ª]xŠ¢¿^x“ÀšÅдD‰g¢âégŠáFNÓ“?,ÁÝk·kÖÞzg0õ׶ªÄ2VšÄE«OÙžÎIÏstž^AÀr¦5ì#’'i´BQ*:E=Z‡lüp- ‡¶À’?|€[@r¯εëã¾N5Œì¶~½ ü[uáìç£4 -‚g½…“ªáœ®‚Z€^W`ZÀByÚA¹šWm|`¯ãoDI݆{åUÓñà±`t"Òí Ð{§J„¡¨¢¯`P%€g•w¢ Ã%D=—]Gs‚PF’êHÌ YÆP°®¹Y¡ 램þ†f ýu\v.¸¿ Ë#ÉíálgºS„RĆBº}#C@± è¯î‹2ÒÜÎjoe\˜!´a\ÐEa@Î)ã3¡¡6Rzbë¥ÝöA ‹«Kž -=:…›º¬„­Š>Rǯoe÷C#›<· ù~é8 ÜȨ¹n†`AXgt .¥%3Ú>ʇ]×ðÂQÓË:)°`»ò,YWâ:°Ì™ÏÖ¿F(HÜýs§ãu–[=ëTT2ݲ¤Ò]ž]`Gìk©rrÀ°Å’c[Ò‡TKUçBó•4èþ™~)]t5$Ak&á8€W•{J§õX0À •“ð½-"fbj웶ö‹È%tÞ|p†.üõÈ -ŽÇ<uƒ±Ý–%ÕY”ÛÔ¡%Ð:-v`@,•…õræ+éÝp «xõضõù°\ðÀL.W,ˆ%~ÆæXT~±4´ÃªšòèxÆ©=WŸ¡Ñ°`öáýû· -ïÚ…MïÂB@s¢¬ÕQ.„(õj°Ô¾šbsç.ÖþI¬€özŠ^ó€ÙióŠöSim®ä×nnꋈæyÝ ³°±Ù‰hýÛ•?>¸=¼áÀ‘æ6®[­×U€ëk:$.èðÓõe¿]r›«^9*61ü$ß³B>^Bü§ÎQüã<׳M>a嶃{+®’î¸7âÃùºó\‹é=™\»¹^$}‚mTD§QéQZªX¢myîÈpF¯'²ÊCöaÙ¹:‘¬ Ã×üeÇWmÊ'.úOPÀÒ&’Š`E ¤‡1‰ÐzS¶å²çì‘!è]&µ¡õ¡âjÙ¦…°´:Ì=Ð#—[y¢7¦¾¯<†¥2}ýÒ1Ec¯h;™á$J´"¬5tËà+£˜b’Upeâ"ADô<¿ç¥ZÁÛÃVnX-gúº.3~ðºAýt|]:Ê8ßZ`¾ªÎ/%)¿ÑT’½JI x"zžGÙ7B+)b½=èÉDî8Tm·æw¸ÜÞˆDVÉ¥š^ ëË@Õ¹’':.r*_h¸'{"QIU -¶$´$å  ÉVÈ~H‡HGŽÆFp ±»íø{$´ †(E¦žŸÌÑaÙK€Ä‹˜Ä6—fXîjy·â¼ µúñ™3)B7|©ë½À÷ÒžIb]\ב]ÿ¯ìyãÜ××Á…*ͬȂZªô\\gòØåæRÞÿcçœOendstream +xÚµXYoÛF~ׯòb*ˆ.oºONí$N4mTE’J\I¬)RåÛÿ¾s-EÙ’â (gwgfwçÚ™Rcþ©qØŽ—Œ£XÙ^›‘3^çÍH‰ÄTD¦™W³ÑË×A4VŽ8Éx¶ÜØ~àgÙgë×·fWN¦žçYž=™FQlÍÞ^1áãDYï_]àÊ·.¯`ùê¯7¼BÞßgH{?ù:{7ºšõêôÁÕ êòïèóWgœÞïFŽí%ñø掭€½2và{².FGôG1Ïó®C¦^l±÷Øv°=pìÀñÉö«t1qck ö¸¾µ˜L••¯ÚŠÇË+0ø‹8ð§‚5˜­iG«¤VÊCi8·,¾Öi¦kæ=ï€YF¢iðÿçrãZ³P…Bí–þgʦ5(Êf0í´;ã}s´áÞœÁGÓ¦ZËé,ÑO BñçMú6!g´t~(AFQ´²v¦#3Ë3œ€‘UËÒMÎXâ6ˆ“2á ïzùÚw±PAdÇ® àÍårÅ2{ñR¡í…¾9ƒ 9}7±~ßs^aT7Ö»qD~"Ýæè° |q”æ‹LξÁ)z8¥h4Æ·hC»Æ8WÝjߦeUoÒ¶Åý%鞌|[ÅážKç9Pyš3fê+ÈŠ5nƒÄ‹0ñ’7<‚dÐ5kñRÃÀj“l÷LmóÆ™‹º ¡Ô·(‚aÍK=<ѵt¹¨ºiu­3p`¯ûz)G‰»P’¼ôPUñò)Þ¤Õ¶ä|Î;2 +‰kãòr˜^¹b˜U˜RœYŠ+‰ÜƒÓAŽJ”õ‚k¿Ù{`ÀÈKT§keÕðHÁÌ7Û‚}‡¤t»…øEƒœEŸˆ®nd;P`PYÛ¶97PÅ쪴=óUdÕz§æ=“þ‘‡&["ª0üV #[iÌ^/±®…}‹ 6||¯?0òÇÐÚ)>sdÏwZ/Ò®êчŠ§¬ÍѲWL&^¯)f¨Ö¡NuÞê¥a›b¶yZ°‹¼Aƒfù¾õVïÅ3 BÊk0šI¨g†*lÐs“ž¥ïR#å[ÕGwôÊïŒE™ )Ä5)³b©ë³pÒâfÇEæT=¹´žs¹ñÂA¹q]šAŒìЋ$g¥ôO¦”OçHy6C½pÕ¿åY­Û®.ѧ¸zÖ «Ýì—ÎÍ—»+ð°]ûý¸I)hÙÁÞÎ^¿}ÍêN?;tíôÀºhôÿ:…-ß??8q„ýEy~yèŒ-`º”Žü”SÐ+óÜûŽч²LyE]™ÙëšTŸSÇ$Û~à +ê™6M·ÉKI êòÀ<3 ö ßâfŽ>I×áì„o'”EÆ©]pC¯nÌ£º‘zÏfåÍwÓ”=ò0SüÒ‰^z’E*© äõÑ<þ™kCuêZûP^z>a“a±ø„y˜›¶ÎˆP‹dÔƒÛõxø# ) ³µDž±…d¯T­k&Þ˜ŽbR•0Í–Ú®ítKðe^p׶ÀtÏwìP©“ßÂÖ.pÁ ~8ÀÖøÏå<ðlÐ9±+Œ¸ ——ò.ÌC +Cë}º€{D='²ÃÐ;­ÞNæ(ôw#ÐJÂz]r{L³,§ÞV {a2@Òõž¢C(²¢Ý³(„ª Þ}|?Ìç…›ΉhßFñ†øóølxkc›þ«#ÀL¬`R…ÙǨ«œ‹O×¢á"S|Mz«5UÁQrpÜlï¼Ð}= ¢ÃhšŒ¥e¹e‰´Ò¥®åÓ)$,‹TþT’K )…‚-1Hôi„Ç0Î\s˧µúNö¶¢ˆǭwÑÕõ³"Jé¾±4=<¬üIÂÆpõoRzu@¤=lUÉÔpÉÓX; ôò¢õè“ï#¸²z³PûèúÐWò~`')pjÂùéÓ%± $ Ð#»¸„;vyl÷&í“©Þ<ÀØMº‘YÚו‰i«þ>ÓÃ_áQì3Â~ZS;½P]\š±5j™×¦SÁëÒ‚4¾ ÅhErùÇ®mô¢*³‡÷žØEºÎž®çpщ&þDÐÑ&gíÿ !ålŸ ˆ'‡ê@žþˆÇöÛMuøã‹~êÇ©¾ÿ€3c/9Ü~ø´ #_tAÃTôP]óÖ#}ÿó?ÂYendstream endobj -1335 0 obj << +1334 0 obj << /Type /Page -/Contents 1336 0 R -/Resources 1334 0 R +/Contents 1335 0 R +/Resources 1333 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1321 0 R +/Parent 1314 0 R +>> endobj +1336 0 obj << +/D [1334 0 R /XYZ 85.039 781.388 null] +>> endobj +58 0 obj << +/D [1334 0 R /XYZ 85.039 340.611 null] >> endobj 1337 0 obj << -/D [1335 0 R /XYZ 85.039 781.388 null] +/D [1334 0 R /XYZ 85.039 296.86 null] >> endobj -1338 0 obj << -/D [1335 0 R /XYZ 85.039 761.463 null] +1333 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F42 967 0 R /F36 955 0 R /F20 937 0 R >> +/ProcSet [ /PDF /Text ] >> endobj +1340 0 obj << +/Length 1559 +/Filter /FlateDecode +>> +stream +xÚµX{oÛF ÿߟB0@¬›N§Ó£ +¤mÖ¢H±nñ +mȶl ÑÃÕ£i0ì»<žŽe'E6–tGÉ#$ï þ¸Hf‹ÐðÎDËlb ¼™pÍaikÀór>ùõ7éÜf¡óu/G2W +c¾úl¾z{þa~ñçÔB˜‚M-ßÌùÛ š¸šróüýËs¹æë ¾üë öéjŽsï§_çï&óÎœN¨Ñ–o“Ï_mcv¿›ØL„q ß6ã@Î&` “®Ðãtr5ù£E4× Uc[—"`2‡{Þ`̵…áK›IÛU›Ÿo“jjIGší»ÞÆíGR®è3Mò˜Û¡Ò¸<’žG™åÕeÂõ!ñ‚Þd•`.(–6˜ÆÏÇ+¯sórÊa~¼übK~Éžù>Z–Å=ŒµëŸ4pÀ£ [0ãIθp”¿çs0͵]³Xã[ãpb´²XÀ3Ñ䬢ùÛ¤Þ¶¬ýrµ³~7H΢%®+©ÐK§N`FZN½jbY›&°*[Ve»ŠWZ·¹‰µˆÆhoR£Á5GÈ…j¯ië7®+ÍWjT¡ØdE»@KU®¨m!Ž09âQ¶C e]}åne1µà¹º1Ç÷÷ÁÕÂWx~0msüñ¤±ZYÖ@ØalrB:FÜpÕ;-ÊñU4øT1‰ÙòZ}/µ,8,”a¹‚y@B9]tÄ ŸgUœ¯®Ób¥×YTÕqy âAö2Îâ¼~¦³în§óï—ô^%}äQÖ’t®B,Ô»j9†sHë–Ýåͦ,š]KÿÂ…›ŸÍT¨¥t(ÞRŸu“ 4ö5Ï:Ue¼´^ÊëõX/ðy­Ô!&ñ÷œüµçvH8æ;þž»ÚœBð(|)L4u‚»Tð¢|@úÒèMÈÆ1"¹Œ£šL«÷ª@àÝjYM•äú¤šŽ +)Z0Ò…dE +-#ÄóüõkbP97#J¤-Y+“SÒ„«1°p“ãP!W +íÒ~æqà9ë–ñþëù0§e¯vrRãO!ñlÖÃw =¦‹Í£,;û³ã8ýOmx8½F“⨠÷d$ê "uíÍ„ZT*z +óMM Q¹i¶Hïh1œ,ûJ ,Ø£ve º¥IÊ#Oç‘4›¶ÐÇzÆ[ý=Lš©êÊœïwe!;3öÕ͉Ú&§••qúʼ:„ë|³lúò¬ GÏej•28Úè¾C ø;n2Nu=йš¶Í«ªÚšéâPè~S~L÷ËËP)b|À¢s‰®ùxqISߧR"ÂÏtq+Y’u8MÖ Ã’ržåîaú›:þQ?¡ÈŒ”–C¡ÿSyþ¨=¹T+"Ý Û »Õ]rÉàaK™5äh›xÅÈñ±‚ÊäC¹Q5$~välÏ}‡IçôÙ~Àsxþ &àÙòà¦øÁM‡Û àpwJ[ËsZçÜÙÓ§CçªúJ©Öe®­–x§Pñ(ѧEIµN‡JÈ©Ôã`yô¦Æ]¸ä8§/ÏžãÎÒ> endobj +1341 0 obj << +/D [1339 0 R /XYZ 85.039 781.388 null] +>> endobj +62 0 obj << +/D [1339 0 R /XYZ 85.039 720.515 null] +>> endobj +1342 0 obj << +/D [1339 0 R /XYZ 85.039 674.644 null] +>> endobj +1343 0 obj << +/D [1339 0 R /XYZ 85.039 197.504 null] +>> endobj +1344 0 obj << +/D [1339 0 R /XYZ 85.039 170.405 null] +>> endobj +1345 0 obj << +/D [1339 0 R /XYZ 85.039 131.879 null] +>> endobj +1338 0 obj << +/Font << /F57 1075 0 R /F36 955 0 R /F20 937 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1348 0 obj << +/Length 1752 +/Filter /FlateDecode +>> +stream +xÚ­XYÛ6~÷¯ð£ Ĭ(’:7ÝÍ…¤h»n‹"Ƀl˶ZÛÚJò:ûï;—dúXoA,ÃáÇ™á7ÃÕÃþéaêTh²a’jeÒt8Û ÂáfÞ´HŒEdìɼž ~xã’¡UfÃÉâ Ç)ëÌp2ÿüøîæçÉݯ£±1&0j4N’4˜¼»ãû‘n>½¾Áž nï ûú··Üù?ï'8öiôuòap7éáôÁÖbùgðùk8œîƒP™,î¡* Ó›€QÎé¯÷ƒ_zUE¬ë¼~!C8`v­¯g+OæÙ á,„²K½a#¸õLrØ$+bã!Ú(â›÷„ötÏ9ˆ‚œÅôƒ]É—t‘YdUätö.é .¬|t¼+òyQwk„h*ÙùÚ5ÇÂÌKPȨû±Ì;¸…O}ŽN~ÌckÎx”05@iܬIcÅó¼7±©g˜)øÅr0°àt¢–OH’dvPÓŸi~óÐbà?R%ÚÄ‘9ašœãÅ¡­ÔÕ/Wóúˆbq†/Ùøsô/·i×ù¹è‰˜pðÛµhí]«P#TœEqNú³ŠÌÉŽ†Õ8S +ó½Ã%^´3‘SÚæ6i!÷ýr &UÝ ˆ™8€ß£í’¤ßÄ3) ¯q¼Ë°Ì06‰=ç uÈБJIbD÷¸µ1“D(¨àŽøDÊJ\¸ÏYÖ_›5ñTj0°ÓÄ Ë–‡òBVOÅð8y “wPè{®…Ñ.I¢ôíÝø‚gaÉÍííKìf¡tv•R<™gÙÍšž1>¹&·E…5zWŽù´sÊ¥¶[úÒ_bÓ_§j|ÐuŽT»L¹è*òÓY^Ö™Qú ÷]¸DÕu\sb}\í˯k <ž®§%OæÙ\`ÃH™£ç‚q&௥ÚºœmNuÚŒg83È5¡%”±©ÙѾ¢ðÇÚ4ä ']mU¢ž³µóØ…»ò°iJÿ²‘ƒ3‡ES~/Ðmœ?‰¢E'$äáìùÛ=¸ùËd¡3!RZ¹ænÙòWØNȳÚõ¥ %/cR.¡…‹ýš˜¬»@Mü!%nâ1iz$ŠýÙIœUçL*…€*e2åêù+ñõ]¨ÞK÷Tnµ­ä,SR­KrÃÆ!¯ã+Ü{Öa÷•åÜƈYÉøÙ£…uy|‹¸û€¿åùbΡ¨ºîlÚÐ/æ(g ijð:Ê`ÞÄTvÜ7¼|'SÝùòùñÆçaA.™ËË.—à×1e£=êD³X–Û-½ƒ–,J +ÓE.>¥Ñƒ³u*"±§-=©ga༆ƒŒÂƒZ_Á`¯UD›Ö]ÝÖã??LÊQÝ>Ðï%»Hš—R°‹$‹8ø-'â­äó¼=z[¶åF&06ö«’.“Xægœ[sNåüO5OͺZžÔ(×2žZvù¯Ar ïú™G¾*5ÙeîuP¿Ä@ùŒ ¨³S¸Î¤ÓÌ9ÞÜ7Ææendstream +endobj +1347 0 obj << +/Type /Page +/Contents 1348 0 R +/Resources 1346 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1354 0 R +>> endobj +1349 0 obj << +/D [1347 0 R /XYZ 85.039 781.388 null] >> endobj 66 0 obj << -/D [1335 0 R /XYZ 85.039 690.69 null] +/D [1347 0 R /XYZ 85.039 761.463 null] >> endobj -1340 0 obj << -/D [1335 0 R /XYZ 85.039 664.681 null] +1350 0 obj << +/D [1347 0 R /XYZ 85.039 739.701 null] >> endobj 70 0 obj << -/D [1335 0 R /XYZ 85.039 664.681 null] +/D [1347 0 R /XYZ 85.039 739.701 null] >> endobj -1341 0 obj << -/D [1335 0 R /XYZ 85.039 640.699 null] +1351 0 obj << +/D [1347 0 R /XYZ 85.039 702.17 null] >> endobj 74 0 obj << -/D [1335 0 R /XYZ 85.039 557.95 null] +/D [1347 0 R /XYZ 85.039 605.871 null] >> endobj -1342 0 obj << -/D [1335 0 R /XYZ 85.039 536.695 null] +1352 0 obj << +/D [1347 0 R /XYZ 85.039 571.067 null] >> endobj 78 0 obj << -/D [1335 0 R /XYZ 85.039 453.946 null] +/D [1347 0 R /XYZ 85.039 461.219 null] >> endobj -1343 0 obj << -/D [1335 0 R /XYZ 85.039 432.691 null] +1353 0 obj << +/D [1347 0 R /XYZ 85.039 426.415 null] >> endobj -1334 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> +1346 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1346 0 obj << -/Length 3714 +1357 0 obj << +/Length 2677 /Filter /FlateDecode >> stream -xÚ­kÛÆñûý -ýª°x|?ü-¾úRpú®AÚ4(x"%1¦H™èÜ_ßy-¹E^á†OäììÎìì¼—öÊ‚ö*òMËWad›n­¶Çkµ‡‘ïnlÁð|×ô=ž¯ nÔè&pLË ¯âMhǦëÙˆóæñæöÞ±VŽe»zÜ­lÛ1]ÛY±gz®·zL6¼õÆ÷-ã®Zo\ËHórAh5 Ù!d‹…‡ %å)ÔEm_N³lr?p¼ýÂ@Ô~D¢ÃÉøy¤u(T72qO8RÖ‹mwÌz«ð™hüBz~j™ -Ù³š2Í•-ê ZdIø³Sâ<ó;ñl±˜p¬jyRI¡}ê *…ÎÑö #;e+&-¦§ŒvjÑA³Æ¦ÂR«h“0ÒæG!ÚÅ9|~Г¶aöCì#@‰ãWµÉ-êqàÚ r\Mî ÝØs½eM瑤–i|^³8@ÏY‘I›N~·Èå!!¹È|Ú7iÓþ@2DíGÜ‘î¢ðJ(“æã:Û¤“¬ çÃàÀi:\‚¨iEÁ€¶ dñ5¥_®lLW8iG¥T˜È6ü[V -04ªO£œG¥½ü('¹ç·«,­úˤðð<Ïø¶hªžh6˜—zº89 è<ÊÉvɽ™éF)[ ”ìûÑó²Sí tC†ß¿¹½{‡c÷ðò€p±"×¼464gˆ/Ap%Z Ùu(Rñº}êzêË·WÜ>QÙ1bÓ#:ª"þžùY8ð8µÐ”³^ê1Å|${÷-¾8lL¤ûëÈÅŠsR$ÓŽ• ~$ÞwG`“Û¾ÿå€T} »38G'š%uÑ‹@Æß÷½‰ºj §c(¥²Y¹•ÓIF³ÜaLš†óyçO·NCÕ! -*•4W[Ÿ$£,ÇJF=Ø÷ðüFž¹ï’’%¥°I›ñµÕëÝÐî(¨…5תýkV_ª/{ƒ£€+]×yœÚÛ}C|Ú4•Þ4$K¦íW³*…³Ñ®eU¾À BBžmsBÏõLÛ]&Ç(/PscÓü5rˆ®uÁ„jà›N¬Sý|óó/Ö*êßßX¦G«3&¼¦Ç«ã 䇡+oÅÍÃÍß5îx©¸ "ÓÜw¤Ù`)ãq$/¥(JR†Q™ãa_+W½U….ozNóæTô%(Úì¹å'C%þœdh V—<"¤„Rºj3TÁà€ÛN:°ÈŒÃhÕHç)—(ì2ô.Ý@Wîqd¯Š¸¾ûÖÎêž™–½ {Ò‚î 2êÌêÞ9¥{‹Ô”îiÔX÷äæÛû·ÚÔWa ÿz”µ^à2¶A÷â—÷ß{oUhÕKRUKÛûhÙOÿž4UùšCn¥æÁÕ-Tœ$ü§]6¾¿"Ü…îÿ*1©O®j‡Ç/hÆ€´ ‚„Rpg5c‰œÒŒEjJ34j)Ùá7§ÜX•+…ùÿr&Q] 9å&ÅuŸ2kÂú×Û(µ“òØL×óô=|µ‚©µ–7ëÚ±Øáh³ÄÝ?îy+ª@ZâܳÑËü1œ«µ–9÷Çt¼yÎm(Á`…HòÃ-$Ê:f8#‡8q·` }úûÃÌßý4«àVhz/¨·BYPnB¡‹îYÕž'¤{ŽRëžÎ ÔXé —CüÞ´Ü*<É¥'Õ˜tB}ººÈ¤ðļo29ÙeSåvG›øší¾´YT~ÏrµÍþ™Ë>w9unñ~¸¸HéUrç_q˜¡¸Aßš,Už2Hwœ¾A~5“j9 ÌÈŽ¦7D˜v£ZD|øåuüï¸ 0£~vÒ³œeÔæUP!!“þœ.’5\¦&Š¨SÓUÑâð>k«Ó$åpl•¯Ö%µÖ2ËŽÃaXg¹¨TËbÄ2_OVê£ñPiK/z’2bŸéJˆž»Õ›S„ 0Cß}A¤E$Üg0«Kä”",RSŠ QËžOE_æhWô•ÄNìoÁäéØò0•ùI]U¯¯  »%ÿâ¡$õ_"~¡ÕWA°jþú¸Öðøù@%\¿/ò·)jþ©S©òe;©”Û='éÛ=ùdÈæ IG°øåÚÅÕèfG­DºõžúFA.Òj95ê·³ºðGJ¦jå.”ÈøBiÀ™?ÁAÙÄsÇ°DKŽa‘”ƒFJë8®|;E¾ ßæü¥¥ƒú½-:º$ÅwOn5áá%)}/é „m¯ÀŽ/ E ðŽ_Gc›ËE®Ì×ï[SW*ë+ŽÒé}OÚ¹o ¨[Ôwªª“¾í?úPö¬Vç¯Ìó¹îå÷œ×?ãv-ìÛjÇ6û1wyÅZéú,F-îð’žïFpÂî<Áÿõ-pendstream +xÚ­YYÛÈ~Ÿ_¡·P@Dñ>üfO<‰ØõÆš‹ì.‚–Ø’¸¦H™‡5“_Ÿºš‡.‹`€a³ºXU]ýu-wæÀŸ;KBÛñÓYœ¸¶Ÿ$³ÍáÁ™í`æï®p¡o‡Aã+“ 3»ˆ<Û â«<¢c»©í.ò¼{~X>yÎÌsì(ògÏ[cH”8v’„³çìW+˜/Âб«ùÂw¬,/w0ˆbkÕívºió¹kUe3ÿýù‡‡÷Ͻ:#(Žì$ºoЈ‡ rÙëØ©“Ž ò;p2h…–ø¾õ:÷«êøå„/ªÄÿ-SZb ,•…Ó6@ŽLóT‹¶ópCu˜{±µÆmÆ6. ,^x±í¤ ™ð±„ {VµÅ§kµû–©^ØšywLG…ª™/\ësÃ_mÕ†=³VxëjW³9Àxе̶­&ÂæÚþ#Z&Z…¦ªr§¯Ž"ßíi‡ñ\>ÄÌ1¦ ÅHe¸ˆÑ Œûc@àÖs)ÌÏìØ`Á‰'0¾¼.Y~ð,´ªËш{ÍûݵÌS­Í^m:ƒ ß9T4£É!nªks˜M…°7:ÐÞÈÙyÓã‡ö æ¾qdæ¢ï‰µV˦"Óyg—9sjZº*Ä +p@/%`h‡AxEÔ†ì[*–)[·6´¨ÖB/"§@÷=çüëCj&L¢TÁ$Zû–MëT-e•òZ&€{Qjq8)h™%`U¡Ú>™á ˆê´øÏ1.às”49ÁM’ nsÁX@m¸Køü:‰þ¯Läð¡ë†—„Rȵ8èO;2fló@ˆìâK-”•ÐÏbâ¼!®R_*ŸšWÜ0l ð/Q¾–ÜÈ[ŠçÏÅ/¼ózék‘Ü(ÄfNâÞÈûÀR }ÖJñ`5º\–M¿õ˜Jq"5ÚljY©B;”SòK£¹.êM¼ôr´$Ч·º®)iK~®¦6€Ó@øÇC§Ö‡-³ …g eæqÔd,?4 ûŽãêˆá‡•ˆ>Ë3lƒ Pcîd?èãvñ·±2p¿8}÷ÐÖH\›ÐøæF1€¼È“béõN>])ëGÜTÖûÑeYoxÐÄ}Ûß,—ÅKmyÙ½Øe%ágù· +3|Ù*<¶ËÇ +›U 97ÔO<; ƒ©¥gm‡—Æv=†‰$ß·?‰ìÐKï®ÆðŒVs:ìm³µ«z·<Öú¸¤"ZÕYóŸ¶ÚØûöP\¬Á í0ñf#k0<f]ë Þ³Ÿ¬z‡iÎOB &šGrat­bùþøÕ€¾X™<Á¯£6€ + +`Î:;Œ)xF!¸_{e2¥‚ß×'hÖ}(Ä9N»Z¸µˆ?íEæyȹ RÚ·uŽÇ»ƒ³y-¥<Í(ƒ‹‚ÕIz]Wê¢Èƒxpvß8ëµ8FÖ›ašÂHhöº¢Èø•ºd:í©+@YŸ{ðµÄ•• =k$ýÏêAQ€ë)¯M¥ÑŠØòJ8ØVýaZ)L¿Yb*n/§¡ZÚjN o®8ïçù¤F¢Ôn6Xò&>?( çUÓtrÑtp#ª8S#C.ω£kK=k_ ;ÆIl ›©ÞR›È‰õýç±Vê´”qÍø6]ôEv ]ÐÆ·êu¡œ{†‰PjMåëå @yü€jŸ€²ZâžþøévÅt3¸a„aF‚¦* B&ð÷yÆEEAÝ•Ë —s8TC£ÂJ†z¸&ùïJEçE&©× ¸Qñ ¨ø}ht˜NÞ¥»ÙF  â=¿ßH 5ð½’Ï”éˆ &´Õdžvg]+©»t‰ù²_|ž–S5… ùÐñWŸç¦ýæ xJaò’÷Çêf 8Ž†ÞèÜRÉïZo ö’g‚¯×—?4âô< 6`Á(>™2<ßñÀy£%‡ž!ZzFP´?~xZ!Q\CŽ3`2íÃØŒ³5´Ì/——!¸ +°îØwŠÐ8Ï©ƒóÝDœìÂN³2 +–n‚X¶}ÔeŽ¾PrCZÐOtNÞò¤, >{ÆK ®[ñã}Érvs|¢Ùm¥u¹Ñ,å7'tèÊãL´‰E®eâÇ^ å Â@µ½QySY) + ¤úŽª«‡Uùì—åGi#JžäÌxª>3­’¹þêG.1)~ÈX.ì Ü€¥ºÌ4¥0/h+­}AG |y-+þƒ±IE¢´n쇃«éÎÓípßÎBȺUUº¡o{Np÷ŠxÄsY椉íÇ~/ víse®Ae˜ÜÕfxî«s]φÈ9Ñ×ñŤ”Þ½~l»I4Öûåá×ßYúxpl|| +ÔvÓtvx6X ¿«‡ŽìYß°/pì L'öQý$ÝÉVºØ²ánAeL F8v$/Oxéúç(ê4ÇBõײt9/- Í5}3Ç L­Z!þá\P-(¢të¡VÁÐÖ TXš±‡b*læ¹”c`»A<E]í:µ3WûhÕ ÀÁ†atpÏmÀ ê÷np÷Ôõ€éãúQŽùÛ§÷Ú#ÇŽ¬ýÏÃNd}ÃÊÈ·“8šXùôé=˜÷^nvpJ~ˆ¡<Ïm­e!}å©šªDð@7 z×_d ?ÙÔêØðçY§§?öPÔÅ8ÖU}[~ëW*xarËM< .Ü¿ ‡;ªz4ÜÓeÀ0R–Ñyû ^`:é¤Ã÷õ5þôASÐ8q¨éº‡ wºöù7’qß>¡×>^´§€$/äOˈº»`ßñaÒ/xõL¦ýëñ™—Clßaz]÷ÿaºu×t°ÍŽ“à–é.4LdöAMê‹ÀuÎOG½4¶ƒØ‡=.°é?ÿÇÕ‡_nÜwìéMÂMœ÷œ×v"²}8ÙÌBQÏ9×ú‰&þm…ÿ%|rÂendstream endobj -1345 0 obj << +1356 0 obj << /Type /Page -/Contents 1346 0 R -/Resources 1344 0 R +/Contents 1357 0 R +/Resources 1355 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1321 0 R -/Annots [ 1348 0 R 1349 0 R ] +/Parent 1354 0 R +/Annots [ 1359 0 R 1360 0 R ] >> endobj -1348 0 obj << +1359 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 464.403 422.032 476.396] +/Rect [84.043 410.207 383.851 422.199] /Subtype/Link/A<> >> endobj -1349 0 obj << +1360 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 450.854 364.76 462.847] +/Rect [84.043 383.108 326.578 395.101] /Subtype/Link/A<> >> endobj -1347 0 obj << -/D [1345 0 R /XYZ 85.039 781.388 null] +1358 0 obj << +/D [1356 0 R /XYZ 85.039 781.388 null] >> endobj 82 0 obj << -/D [1345 0 R /XYZ 85.039 761.463 null] ->> endobj -1007 0 obj << -/D [1345 0 R /XYZ 85.039 667.044 null] +/D [1356 0 R /XYZ 85.039 761.463 null] >> endobj -1350 0 obj << -/D [1345 0 R /XYZ 85.039 286.574 null] ->> endobj -1351 0 obj << -/D [1345 0 R /XYZ 85.039 259.476 null] +983 0 obj << +/D [1356 0 R /XYZ 85.039 653.495 null] >> endobj -1352 0 obj << -/D [1345 0 R /XYZ 85.039 245.927 null] +1361 0 obj << +/D [1356 0 R /XYZ 85.039 178.181 null] >> endobj -1353 0 obj << -/D [1345 0 R /XYZ 85.039 220.95 null] +1362 0 obj << +/D [1356 0 R /XYZ 85.039 137.533 null] >> endobj -1354 0 obj << -/D [1345 0 R /XYZ 85.039 193.851 null] +1363 0 obj << +/D [1356 0 R /XYZ 85.039 110.435 null] >> endobj 1355 0 obj << -/D [1345 0 R /XYZ 85.039 178.181 null] ->> endobj -1356 0 obj << -/D [1345 0 R /XYZ 85.039 150.476 null] ->> endobj -1357 0 obj << -/D [1345 0 R /XYZ 85.039 110.435 null] ->> endobj -1358 0 obj << -/D [1345 0 R /XYZ 85.039 96.279 null] ->> endobj -1344 0 obj << /Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1361 0 obj << -/Length 3686 +1366 0 obj << +/Length 3387 /Filter /FlateDecode >> stream -xÚ­]sÛ6òÝ¿BÓ—ÒiDóûãÞ\'—K¯Izgwî¡í%Ñ2'©’T߯¿ýI$tÓv2ÀbØ/ì.áÁ?‘Å®æ‹4óÝ0ËëÝ•·ØÂÈ»+_ –²4`¾¸ºù{£ž›{ùâáqÄ»Q.6¿8wÿ¸ýéáí¿¯—a:‘{½LÓ̹ûôæýÇwÜwí;?¿{÷~îÞúxýÛÃWo4iÈäH÷÷«_~óXãWžæÙâÚžëÃðî -»qÊw}uõ/ŠÇ¢ÏšÚf$nB#ôÜ,‹&a|?pC?^Äž{‘æ…¼ð\¿P@È =ÝF®. Tçôä¹0wã,>"·iàê·Ãõ2Èr§üº¯+ø^_/}§ U¿Èö|…ŽZ´y<`{=T„©‡ÎÜs~õbox‚o‚EÇP{»¥ñFvÅPnxuäjâ7;,>_͇®}ׂo]Eëá¡EîS€% Çœ6¹GÂíк¸"Xšj9"[ômó·ëeE¼sµŸðRc(›õË™`DÊiº‘—\ЄÈ¢ DšàÏj‚žÒ+9¥ ¹C¼ˆýÈ)› ìº*ü ¾x”]±V²o{îz~*ì€<ÛásÕl¹-÷Ã÷ŒJAÌ,á -_´RµˆySv &š\ Ê ·+–nÙ-MùÆ´ò¦¨•˜\\z‹*â¬í‚n@ȹ”_D­xg/øÕ6%Ï<(ÄeÏïeõœ.$yâ†^j×h^éB0§ Vz¢ vr¢ &¹-J$7üsS­™Ÿé©v†(F³ÓÜiñ7…± užÈÞ™{Ï}b‘Ò|Tì#­ ö+JÔ¹Â!½{%X™ºGyÕg²‰½¶xÄ+û‚ƒŸ>– -—©±»Y|ÌÔW¤¹Ë0ÁããÈ?`q ]¬¿:“sºy˜,’,pÓ8ûS‹W¸–² ÈR7€¦âÅ“±ÈJCgÝ’”Žmg8]{‡©ý5kW¸ìkb`¸Ÿ­½º -õnË&üMòV¤Á£ƒ–±k˜rïG¥Äs&¤Åÿ­`Î!$9qÓîF ‹C rá¬C°ÑSÁJN9ƒÜ&·úÃN¼ä[ân]òÒxÛÔäIgï‘ÝL±ÓNÁÀG•šãf»É…“v„±ð’aˆ•Ñ,+-Ä'm´#GZ×YètÈ™8pöia Õ;o« Ì„œ%tVÍM{ K£Ï=¹ØbÇ>VÛaÏHѳ²²ÑPdV ü¡å3 â®aÌ‚(øã‡qNÅŽ{qéÐfiMÊÏ]5¨S“Ìo¯ /vLUÇ~½:°aM%«-št&vî0 !×SP¨‚xû¡XU¨k«R(ÁÈ»v…ç@I|égU)ÈÜ8ñ/èÒdQ&"mŠgµÉFO©“•œÒ'ƒÜ[í¼HzÈ/–(vO!tWmŸÈwáÅ=ÕºdÆlq<©#4ì_Àï9Áï÷d¬%Ð: V^¡Æp8ÿ­`nHÄ¡—hM×T8¢`Ñ€häyìþ„`4"Ð|+:$AÁtèˆñ@^ú‘9ˆ;àG@3©Á! “jrs`üø­Éwpïyìg8ã˜Ù0s´&­ä—££† {.¿VýÔ6Ÿ«Aœ§J›Èw–œ|ˆ[}<‡¸ã´«‚‡ÞýC?ÒôA}¼/wÎb8õsÿB:kÍ›ƒ"sHæÌÁJOÌÁNNÌÁ$w×6}) -¤Ô¨‘a.¼ƒ®7È­[ôÂäŠoÏ"–‚’ðhuð‚!G9¬}¬@aÔIÌñ4èåëã½r” éŸ(.¬7ü¹R.™%‡Û¹—»ÙI2ú¥’³„ÝÊfu&å4‡bC7õÿ\6­p- dúÂ2ÓDSÄenËÁu] qÇ°QŒÔêùØ[g¥±›£zýP¸ìbH¥ 57À‚€MÀOöa”T{•“NDÄýš^‚‘×ìSØO ÿ¯ƒ@óN² b²8"‘Ï:=å ¬ä”ƒ0È"©@•ôó™» -þÙkoÜ?ãhÛaÅ9Å©´Ç]T÷ÆIÛ¢Ò!¶àVƘÈôýf\@HEýŒ‚ dî¥g€±‚¨&—S+¡ìDYå’› Ýø‰©¬9öÙ«úSD5µa6ŽÂ <æ%Ý,Ê+@¤½³w8VzJ}­ä”þä´‰|Ÿ¼þJ囹N9˜²çJ6«,Û·?½—N#Qá2x½Hç'ÒêCU ˯(‡šUº(¤>•S·\Vç -0Á#…‹B_«3¶uâÕ4-ŠcVH4Îdî¨S¯Êší¡–Õ‡þ:ãÇA…ˤÀˆVo4¤ú_RãGÏ^±\Wè&hU-ߤŽÅWìžžoT -=ÂóOþPtŸ±±qO`òyÃ?¯^Éh˘Çú­¤|¬ªÂ…‹XñÞ§DÈw…ä ˆœ7‡=ÿ®Œºíªÿ}Ñ…ÄFüw S5F ¬»ÇšG}±Àf‘›¤Ò`hÞªYõìEŒ•žXµœXµI¸2ºoE#c¿ âRE_•ùA_Cî·#¾>c\ÿÃS%·µì‰‹Æü,>w³Go;ú.€tUÁJÖ YÖ¡o¨ L\]´“Ñ‹y÷|ÍÁh±>•fÎ0™)ÙcŒõgradÎÚ#ø¨ö„Ï“‚3šb±–¹B¢®ºVŒ–"TÞr€Êwˆj7VKui¸3ÓML© ó2”ô•ÕtW5ÕQô}´ôõáÕX¼ëÌ2o OnðÊWY×b%_ô›”JYûXE2/z°<%(ÏEg³“‹²AÈb'Dv2{Ëf¥§ìÄJNÙ‰AŽÂ· Œ'«k®n´ú±¦kÀ1<(ñ—•²5œð™B -Ùs]n¶%é›ËÃÀß”]vƒ~ A±¬8Á,{^ -±` ]õmMï¡Îõ ½ ä{œF!x*‰’‘mQ¨†é|h(=†‰ÇF„=…`™]?Àì«r-èhÝixòú«Ðù 3ÓPŸ4“ó.lndõxàdŸÅºk{uW§NÝR`gl$ÐñÄZ?Ñ¡%ÿoäKÎôèGÀt•†»b[飜$$“çü ( ÓˆÆçfH0p~ϲŒýÄyßH¦àâ|›²¯¶ ì)]Ãçló‰´äJWîg†9:ã1 -è¹K^k FЅݧ¶A*ÂCæA¸[þÕNm¯Ií$s9wü:2R·Ùx^¯‘@6ý£0+Z¤Ë [ò¼ŸÑoŠ™È™ªRåÆŒ%ÒVº¡P±"Üv ª’ ’¶š«v>ª+²aÖkiâÙ…œÁš÷š -ˆ¼æìm²•žxM;9ñš&9`2ò¢Î(Ë$ÂÓÛ'QÕò²#Â÷œÊ÷q^…]Ï*VÄÊè§[úšñjw€ã]Âé¤F¸P´+é1–u/-Jg¤Øl¸¡;š™zWT¦Á†¹º#FyÚ|Éu&1ß$C?ÝçÂï3CS}>Çúzı&¹4¢ÝJäé芗Là`‹ì §ÝJdFþ²ìÍÔ×J=ÌiZ åܧâ¤>p¸RõOÜ -w‰‡™¾” ÿ°ÝÊ¥3»ƒžû'^èp§&V£?xá¤`÷ûšï÷ ´’6ÊÀJ= -1²lW 3r')âÛ©$4_ê½ºË Í>=&ñÍAWnúU³z ¦^Á”_µ†ª%t„Ÿ%Ï™X,±¨ÌiS>óŒ£Sœ²8|!á£`ÝËN©ƒQsI5> Eéð‹ù2»ÏAßëÍã‡Îìh%’ÅãA]PžlËwôˬPrªH–Ïi(>©îucµD!AõTOztåðäU0urÑ öYnÜ™×ú¡ç“•Søcþ©‡üú¿#D¡›…3å×8H!µŠd-|­yöz4ÌèÅçÙzÿÑ.P*endstream +xÚ­ZY“Û6~Ÿ_¡Ê>DJV0ïcßÆc¯×©ÄÎîŒSµ•ä#r$V$Q!©L¼¿~û€«ì”kL +h î}á,€á¬HU—³¼U\³Õî&˜­¡çÍM(K!YZ4/n^ü3Íga Ê œ=¼þÏbÇñv‡? ‡pÞUq2_7cw/–R* b{)Ÿ (=×'– €*òìdÉ[ZòúïgK>,–ŒôÉnž û*sDìuûI[lFRsU3qÏȆ¡Ûî’„§Ìç]?V¢vÛŽ|4¯Ã!+"•§~ mÑ8á ip¯™>n^v6¿æÏÃ¥CBkQj[°DI^¢œÂyÍï+äȯtª«m ,Ñìî=Á³˜ª~Ç-¨>ÞCKJäæVŸè¸±Âp¤0$xÞ4}#S˜ÉÚÁŒç‡#ëùná© äaq´œC·CÍ󦜬ÄÞ 5ê¯XZp[m™šì‰É‚@L­ª½îGÐ(ÿ†Ck-Ҿ̑={^9½}$+èW©0ôc˸¡Å$(ŠÜ,7« X^W3ÐJ'Eõ ,NQœ°yêb×páÄ0+½ªÏ÷a2•wõQp)B{õÛ–” KDìÒŠe7UOf(ËÀHLˆî5î¯Ý¯¹µÛ7<œ’í»qc΋ˆO›˜ !?êMŒï?-Â0œßž *)ÐMúWJOåT˜ +£ÂÔÝûÿ‹Gl!\m ø,Âìä>\ ¼ô¹ùͳ‚íÆ>rb™’ÄTñtýŽÄ :Hã”^(­ À1*Tš}™`ô\Kk²KÉÄ¡Z4Ñ„!Ü ™- +fxsÚ=õÇ•PŒd™ðm‡¶á¨M4ƒ³Ð9jG´NðüÉ©F"¾„ 6ù”¡ +ÐïZêG9¶äY•RƘÝcèÿæ'þÑ>ñó#E`GþQ“þzTÕ¹*C°nÑ8M—¦ÁõNÛåãfŒ——¶^6¿ºÕ*XuG +8×bßMôщlè ö:² QØQíIXQ Å•V-inÔA?ÌG¨Ú?yŒ^t‰Cö”Gâ¨êŽ¦]yœHšAâ»õêb¢qëBhP6¥[n“.|ìŒ.,~SÀ»¸¯`O»_mQ2uƒ¿óù^˜gîß4UÝôü.~™ï Çóón"Ù6ϵä¶}óÌ¿7øHOi†M‡ì·5ÓšC‹}­ sd‰†ˆA€ïo‰›¼Œd&ﱚ9*cg» … j#!¯ Ê•IºØ?£ÓìW®ˆ7ÀJfþˆ×¢¹‚§ÎXaæÁA§Pv |ü  ,†v&ž ðp­´ÆíGÝ36=eàñI :e@„GwÜ42¤êu: +~‰Ôn-™o8…—'"5Oýh²ÿdþÕ®úM"Qüyè;äÖ}Å?ÐÇinBnú;µ±½¯€†Îyj}MíƒOß\«4òª{"qj[HHÙ¡SÙ^F×>fZÕ76Ö!Ã=†–œ\xZB¡~;<¸éÌ™“ä6)§!«üµ5÷ÝÿðR†RÒaŒx¨ùØt=X µÀy©‹=a¦5k@²§k`Ÿ³Î¤bÔgj½´kòoNóöã{íÊ4ñYoyÍÖ…†¸€Üüp˜hÜxD䄇݄? ‹á»O_ ÷þ]± K£¥ÞQ¸Ù®ªQ9P’¯‡ç +峩LŠØŒÜ¾©PõÖÀü‡ ‚Ôè¸9U®øomQùÕCIîöBI©,Ém }~è/sù%™ä©*Où /‘1 Îð`ð´9_o•”^üëÕsù×›Æ1å*§ ¦x8‰‚‹ô„7GSe@—úËšXVªá¥*Žâ/«‰É\Kk²+0űaˆ ÆÞ$Ôprє٥”ɾ+¶ú׊]o +)¾T„`Ê)þ;TQä*-§Ð4db§ð±3vÀËOۛ᫓:¨dñÇØÆ×$\Èá$rÒ&Ží¯óääMÅñŸ]\r3©þš²Eã¦Ð0Ý—>v“0}üŒ0-†‹¢KOšHÉ#ÁW®‹÷\JD3q´N6–)¿¿è¨Ê#db+.@¦B“zš¹JçÏ8’1t¤G +Ý ©¦ˆ«bÊç '”RQwgVÙôÏ=€:+ •YµÆKG{e¡ÆQ;JÌw:Ó¦£ZMN˜[9?+?SÏ¢“Çm³s]OÄq  úñCi¢qCIhJîû » J>~JÃ×Æt%±Ž³Òp¾$#­7-QÏžKJ—¯L<]•MVîw$…Æ"^Ù©Ò£ëç\½!‡%‚lÂïºùZ&ÞW;™™°n8Б¯uƒæØH Ujáx &@ßØ€½Î’pþ#Ž²°*/ð£æ;°Bâ;x¡!øZšü0 ‚ùiXCå²$LçvrQžÉ˜f¨dÚvä® +AƒÙŒþ“‹£ÐýÜŽî·™Ðk²îI5Wv}§¦}¬åo~„áß›üˆJqÕ¢ômz+Ÿe|ÒF„E¨ ÷Ú‹Æi#4 Ù÷e†±^~ÚFØ ­¬3Óõ¤†k‰ƒòCßš?Sü××V©•©qĺ’Ï[xÒéæ83ÓÀ(æ…s¶¥Iù„éN²³9Ìý{jöÛEA*ËTå¶Ð>¿ %sù…›d¥*OD‹{¥O+P\”…i¬f˜Æ-år:ÍUZ§W+MÿT­Åx½æÓä $ö‚@¾“”ŒnsÖë³;=~üÍ_CâF/“à²#÷ʼn‡×„]3݉۔⛫¦ø7~ ”¥J©ói +*þ{}aª3àƒ¹râAëAŠ1{‰Ÿ®$ÅÛ×)§Ÿƒ C 9²K õ¬ôç[ BCjp_iøØMzðñ3Š°~+õíwô¤™wüXu;®G°n}Á,Úf1ˆÒþ(:„çÝ·ßzg‘i(¾6‘!&»x©Ñ¢Ç1¿ÅÓ0²¯_oxÈdRh¥áüÛþ]&„+þøcg}1Šš$XÝUô3¤Ï*°™k0ÒˆûÀ'æšÔ{W–Ü2¥ûšFÔ¤”ÒÑ턾ÛÖÖW:8kCtÔIÓÓÊJT«¡â¶Ö I•#V¬ÌŽçå$ŽZ÷7¥JÊO\ã÷­+“hÝ×.^Ó«‡™¹r¸YåAùL7• ¶ž¿kà}!r´u_I¶#9•Â[,¼å÷ë7³Ð!™eAŽ«ñØSu(ÅBXÔZnåLB¾Õ—sÔ¯¯‚¤˜q­ +¨èªé…?Fù}5oÝ´©"vØï4ÊU–'²¶Rs Q^_®÷ÿMDö•endstream endobj -1360 0 obj << +1365 0 obj << /Type /Page -/Contents 1361 0 R -/Resources 1359 0 R +/Contents 1366 0 R +/Resources 1364 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1321 0 R ->> endobj -1362 0 obj << -/D [1360 0 R /XYZ 85.039 781.388 null] ->> endobj -1363 0 obj << -/D [1360 0 R /XYZ 85.039 761.463 null] ->> endobj -1364 0 obj << -/D [1360 0 R /XYZ 85.039 734.228 null] ->> endobj -1365 0 obj << -/D [1360 0 R /XYZ 85.039 707.129 null] ->> endobj -1366 0 obj << -/D [1360 0 R /XYZ 85.039 680.637 null] +/Parent 1354 0 R >> endobj 1367 0 obj << -/D [1360 0 R /XYZ 85.039 667.088 null] +/D [1365 0 R /XYZ 85.039 781.388 null] >> endobj 1368 0 obj << -/D [1360 0 R /XYZ 85.039 639.383 null] +/D [1365 0 R /XYZ 85.039 761.463 null] >> endobj 1369 0 obj << -/D [1360 0 R /XYZ 85.039 601.463 null] +/D [1365 0 R /XYZ 85.039 736.955 null] >> endobj 1370 0 obj << -/D [1360 0 R /XYZ 85.039 572.243 null] +/D [1365 0 R /XYZ 85.039 707.735 null] >> endobj 1371 0 obj << -/D [1360 0 R /XYZ 85.039 558.694 null] +/D [1365 0 R /XYZ 85.039 666.482 null] >> endobj 1372 0 obj << -/D [1360 0 R /XYZ 85.039 530.99 null] +/D [1365 0 R /XYZ 85.039 612.891 null] >> endobj 1373 0 obj << -/D [1360 0 R /XYZ 85.039 504.497 null] +/D [1365 0 R /XYZ 85.039 585.186 null] >> endobj 1374 0 obj << -/D [1360 0 R /XYZ 85.039 490.948 null] +/D [1365 0 R /XYZ 85.039 545.145 null] >> endobj 1375 0 obj << -/D [1360 0 R /XYZ 85.039 450.3 null] +/D [1365 0 R /XYZ 85.039 504.497 null] >> endobj 1376 0 obj << -/D [1360 0 R /XYZ 85.039 396.104 null] +/D [1365 0 R /XYZ 85.039 463.85 null] >> endobj 1377 0 obj << -/D [1360 0 R /XYZ 85.039 355.456 null] +/D [1365 0 R /XYZ 85.039 423.202 null] >> endobj 1378 0 obj << -/D [1360 0 R /XYZ 85.039 287.71 null] +/D [1365 0 R /XYZ 85.039 396.104 null] >> endobj -1359 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R >> -/ProcSet [ /PDF /Text ] +1379 0 obj << +/D [1365 0 R /XYZ 85.039 354.85 null] >> endobj -1381 0 obj << -/Length 3651 -/Filter /FlateDecode ->> -stream -xÚ­ËnãFòî¯r’CûÁ×Þ6“dw‚l‚ÝñI´D[ÄH¢#Rãñßo½ºÙ”(˜1 Xd³ºªººÞÝj‘ÀŸZiœ˜r‘*6E±Xïo’Å|ù盚8µž'>Fîk”é8±ù$ŒÐˆrUÆÆ*„ùþöæíO:Yè$Î2³¸½_(¥c£ô"+ml]Ün~_¦«(M“å‡jW­"“eË÷‡¾>®"µâ|B¾¯+],ûz"ÊQ!<#nªB=,i¹&Nζ<ð’ZÄöÿÕ4M„FsSšú)˜tÙoyÆdÄ2‰«¦gëàÁmE´¬Ã²yæ‘jm[`åH°#qö^ŽJdêÞ¡D!nD–1ˆË–ËëªwSd„p¿Å‘öô°mO+d—…kùøÅ)PflC¯Éòi`~€M(—§½nOC“*T;¶D}BÔ¬/2IÉ0-¡$Ó‡¼ÔcEC A#÷»êÈ4ºþÈö"4ûöí=1±ç÷~û ÌÈJæhB3«‡ºCA¶Þnqy ìï±½#•CŒI¾$[_SÕ/#ÁÀளpܤÖ ðï™I´÷üËGk<ÖÈ·J¸Ià‚Ï$_­ù›p*‚ÇÇmÚnbÝ~—QÏí‘‘Ä¡ù‚/¹lÖXŽ¤þôH*¨; Y&š¨,žÖM?‡æa‹›Þ“MWNj0B‰å¬~ˆfKò†Øu» ásBTO ìËÔ6#¹¾YŸXxàÖlÁuǶBQ“{þìMTM{ÒxàÕ¼@ì!¯øòÔ¨8)æ#Ms=Ò¤*u^H¤ÑiX!°ê'~¸?Ƚ“õî¦=\ ’é,wÌõHcKÒ™„šš%ì¥õIJ"I=³Â{dl¸+ÒÅO²/dŸÄO°SÚó÷óuxú¹Ërz!& -€&V¢Ó8‘; \‰ºØUel¬Ì<9yš)ã´HGÔЋ‚3håEÉÄáݹrvI/Û\vÛfi¤:Ö<á;6pø÷å;AIpdÄÞ°À}ëd†L5KÂI.¨o¢;rg}=…#4Át1dËÿœñË~Šlk ç'b›úDÙÃ(ÌX$þóÈBý*¿ˆ]Š 6µüŽÁÚGò ­0á˜é¼ôâu{¸Çß«ºfó¸(ËtmšÑ5Bq髺6GÎéÚ,5§kµ –ÕèM} ÁÇyäLtŒTo'P¸_‚Ý@°éT†¸­Ä—ûVFOˆ÷ÉÓðZôãNAÛp’iÕA‚è@Š”I’Ðúà©{æÒ©ÞeXhÄÉœœ Õ¢R›•‹z>é…ÑCª]¨°÷-ú©¥“OÎ)ž ¤£ ×W<—ÛUÄ*ˆéíe˜(šØ_ ¡p@äKþHRuA2-H¡æ(2È 33b zGÑÖKùx€uˉ|ŧ—¿~üåÙ ò—ñÔ24†_÷¤‡î5I&6.ró‚$ )I‚…èÜcÂ…ÝÍIrŽ¢“ä,A'É€à…$m®–¾³¹YæHCŸ4Ö—L ž;©œð e84ýtÎE-ÁæRÈ»–a¼ÛÆ—Ê‘8t=¢ð32[‚ÍšÈ:§ËœR/ü¾ÃÌÆ(ú•fXª)Sñô<1B¯ÜÃ0Ÿ¥ -®„¨厥¬·…û …Ü|^¥àdvµ[~ö‡Àç‰ÅM°–ÝÊÁ‡¡³ª¹ß_Óf“ÙXët^› )m.)ƒs@´3Ú¦~¹Î;nÑZ?¾CØÕÒÎq¡yG’ý°™ÐAc"Õ ’"¶ÏñÈ$ÂÆH»ÏØ •\þ,G0ìÒ‰‰]w5×E5‡šÏÇ ëù¸ââ•||–œäãóÔÄÀCjì&m¦7i3Ü8ÌOqmG1/ƇŠÇÏC:6,ÇvJû aHWŽ‚ׇûLKÆ)C¾‘¹PEý;l FÅÏ€€½Êªáåî„^Së²]×tuS xŽ4á0µ£ŠS”uäбg²ÎSj Nôj¯ëÊ`¯!kņã¾ZòW ›Ês@o šv@Ó’7vÄ5Ÿ0E;Iƒ(Ë&n$:M †oÂõ0¿E’¾æ ™0'@¸4{5ÌÍ‘san–šSá€Úp씀L´“´<°ç°GAÓ¾NkÃ絯V‡k~ ÚÀcZŒÖÀœã²»PY§q’¾“Œê ge9âñRaA¾CìæƒØo¤˜ðKiÛ†2lPZ>á/ÒN®í…d&Ëí«,Ûáš_·-L\žió`{”¹ƒOŠM¦ÆÙ='àé¬×AÔ+1 fßæuW ›0–"µ)<ÅÑb(P¨%d®Ð³Ó–q:äÎz8¨†3ŸDÜùsl°M‡â’/ÖÈ9) Ž»ELXìœø¨Œn‡hÁS«>@ÁÎ<œA  w¡ëñ´7²rˆ¿Î7X“P!òïïyü±¢D‹WÓ;ت¿œx^üD) ‹ ÃÜh>›Â…t<"ɯ.‡ÄŽ+T$üÉQ›Š_à¸ÓêAÎC±äªwrnI5å˸ËOþ(¼9‹euê[È`›5ÁÏ<´©¹*gž¸¢{‡YÆ9-%å@…îp -;>«©cºoã‚zxI/×€õmN Æš×w”b»d% ;f¬I^-p[ÃÂŽ‚åi9•š&K§9âæ #ì– ÐC6tqDuWuX_éÒRE£©Kˆš…O¼«t6¦–ÿ[†|'~Ù»s}]b§Â¹‘–¿b ì:Ù âw_|»rÝtÃ-O=uTû02Máö¿î6…P!XYŒå·¹[ÁÈ&ÜmZÄE‘yŠ(¿¿¾÷Û?Š³Å«]‰º(ÿ4^ߺ\Êmœe9¤ *æJùë]¬ Š\6Ï!\8rÈÜ?>¼{O*ôž™3ÆWùÐæÁO¤z:¥Ó0pÇ…tsvè-vÚ ;ª.i÷¨/woy[°¹SQ|~:V¾!Ê€#Å".(%=«JAÁ/Óf : \‹Î¾Qº‚+ -M‰7¹–žb)´ŽŸ'˜Ô 0ªP¯Â¤Ã5Ϥ†8‡Ü>d2¸â6É}ÇD ™j¢®U…&Á¦ }þ®yþ!ƒÉÙˆÿ·3y öjóòudT/ð‡ù–Ë÷2MÔÐí·"nì劸Ñ°b¥ÿMÕË°ô2%7•ÖlbãòóQØ:>œÜ=BiØÄÑÍ{tÌVУçÜ…Äà çÎñÍ_p“´f¾S ³$ eÙ·5 -ªhÀ5¡ÑY¾;uôhý|³Añ¾uísÅ@AáW`Ó¡šeÓ¨,. WØ<­;Í¢äöQ~­ž2à¸s]¾ -¯‚jžW¨§’Dψô’GH3c½Š<ªY­¡›tZžbq®1ÜHIã5C¶š> endobj -1382 0 obj << -/D [1380 0 R /XYZ 85.039 781.388 null] +/D [1365 0 R /XYZ 85.039 303.381 null] >> endobj -86 0 obj << -/D [1380 0 R /XYZ 85.039 761.463 null] ->> endobj -1008 0 obj << -/D [1380 0 R /XYZ 85.039 672.655 null] +1381 0 obj << +/D [1365 0 R /XYZ 85.039 274.161 null] >> endobj -90 0 obj << -/D [1380 0 R /XYZ 85.039 672.655 null] +1382 0 obj << +/D [1365 0 R /XYZ 85.039 247.063 null] >> endobj 1383 0 obj << -/D [1380 0 R /XYZ 85.039 641.13 null] ->> endobj -94 0 obj << -/D [1380 0 R /XYZ 85.039 531.089 null] +/D [1365 0 R /XYZ 85.039 205.809 null] >> endobj 1384 0 obj << -/D [1380 0 R /XYZ 85.039 504.475 null] +/D [1365 0 R /XYZ 85.039 165.767 null] >> endobj 1385 0 obj << -/D [1380 0 R /XYZ 85.039 486.426 null] +/D [1365 0 R /XYZ 85.039 138.669 null] >> endobj 1386 0 obj << -/D [1380 0 R /XYZ 85.039 459.327 null] +/D [1365 0 R /XYZ 85.039 86.593 null] >> endobj -1387 0 obj << -/D [1380 0 R /XYZ 85.039 429.85 null] ->> endobj -1388 0 obj << -/D [1380 0 R /XYZ 85.039 415.695 null] +1364 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 1389 0 obj << -/D [1380 0 R /XYZ 85.039 377.775 null] +/Length 1636 +/Filter /FlateDecode +>> +stream +xÚ¥XIsÛ6¾ëWè21Ü—c›¤®ÓiÒÖÊô扔Œ1•¤ìøß÷mk¹t2BoÃ÷>–>ü –yâùQ±ÌòÀ‹ò|¹mþr37‹@4V¢²šéü¼^¼ý%É–ï~±\ï&;‰'Ñr]~uÞýúÓ빫(ŠœØsWY–;ï>¿¿ýtò;7p¾ÜÜ|€ÏÝúöó§;÷ÛúãâÃÚº¶FÁM~ÿ]|ýæ/KˆñãÂ÷¢"_>ÁØ÷˜nàØKâH~׋»ÅŸÖÏÅK^u.Í$ʽ$Nó ’YžAzQ.³Ä÷?¦D·» +s§¬Þ`^¡3ÞCFŸÜ0s” ÓÏ(=òwpWƒŠÝ±.Y´3™YxtE§*ŬjA$ª0žL’Úoq¬UÍ3Û®-]ô©»–í¡¡®çÙ¾BåáXÃÔHF`“â8r~Wý«˜T@Í$¤AÆ1àvAíV–¶ R”ƽ©Íª™z„€·]ÓPNþÈB«°¤pÞòÄë×3…ŽÇã½ÍÈ8yãPlh;*þqÐ[ôõಈ+cŒó`ô¥–ðyßáïÏûª}ÃÁ¨¿š¬gàW‹ä?ˆÁJ]y—€ë^ž¤×»jÒ9E[zE[;Xá0:ñø)LçWÝëþ,ºg«*ÁWÅ=á qBZw˜0›:ˆ1Õ÷TÂ'ÂRᬹ\°¢!;Ê1uõ ñçžv¸'ívkà¼}t“ljµ¡JËÂaT#ì+­zº¯ÚêÑnoÏRŽ«ÈŠÞLÛô°»yLágˆ H¨}%8Ì|lÞ\ZM$ïžÇ”-'5Ô¶béÀ×ÕØDZ*¡ I9Hrj‹d€Ý“N# Iy”~Áõ/yTñ—Â¥&KÔS33ë¦êz + ÀylÜ©$ânw¦Õ÷Q +FÅýÌ{ýˆÔ1›ºbÚÞ1sÚþ5ºv`}æ•È‘=Ã9µ¡=Cf9ß"i’xéõ™T.6ˆ¨PÄûãŠ/Ûל™î˜yû‚´û±³Ãíì‚ 48 ­!UýÀªX´‡ÑŒ•ªƒHZšÅB±%RÄæ^|)>(ºãÈkÔvЄ#äZ’j³vËe1`€¾æÐb%4«‡®V€Xž×’G×VsÐ$”ö¡f8càð4Ém#Å~§fñjd»|(GžWÛ…x)Ò=O͹¹í‡QP|Ú@\†&>nŒ¯Æ^Páô®#§ð– 1L,?i¢ô -€Qª[„çÒä^KB‘¸3`2!žÖC7rÆôãtD =4—éÞF]Å\€ùõÕu¸L’I{Q_eÉ™ÎEš4:Ä“ÉEž¼æÎåU†)ç¡àX¼Xf\ÖúŠ0R×xÚd)³Zn[•žø²“ÚHt]³dº,ë÷H?ØÓ1“M5¾;6ÒÍT†Vè$DøáW•²U(ãf$q[²µYW¶,yvMÌýŒØ—]†bç}îø"­/DQ·€dº¿Â{Õ—¼ÀkèøÍ9ÁÁ[ÕƒŒ(PaàM‡Ç Ó­Y¥¤‰à”ˆTÛMj½2çKˆ4& ;à…<™"ßóóL¶CIc®/f¿gÎå¦Æv¯Ñ¨½Ô ¼§p7t# Çâu< á¹ö†ùåC&6tá2KÄ n™ÅL„²Æ>ÇàÇ}UD•y‡}U …Èõ šW^‘9=žÅ¨k~›êQÙ:zM©œ‹¢Cူ­žXðã‰L±4Š¤ 0Ï”Ág£½h$\4Sëad=á5’Úw~é`•í¥Í¾„`%a¾r;EÂÚÏò€Ôtk–О€.<ŠN+™ +‡ãÁúìÌ»RÁ2Q™+¹1rc!^é4aožÏ0.Ëù èAþÂâ_ÁŽïýñÀ’lyyTœç¼š!Íb‰…(6|®ùÃI¼ÿØ0endstream +endobj +1388 0 obj << +/Type /Page +/Contents 1389 0 R +/Resources 1387 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1354 0 R >> endobj 1390 0 obj << -/D [1380 0 R /XYZ 85.039 348.555 null] +/D [1388 0 R /XYZ 85.039 781.388 null] >> endobj 1391 0 obj << -/D [1380 0 R /XYZ 85.039 291.979 null] +/D [1388 0 R /XYZ 85.039 734.228 null] >> endobj 1392 0 obj << -/D [1380 0 R /XYZ 85.039 224.233 null] +/D [1388 0 R /XYZ 85.039 680.637 null] >> endobj -1379 0 obj << -/Font << /F20 937 0 R /F15 951 0 R >> +1393 0 obj << +/D [1388 0 R /XYZ 85.039 599.342 null] +>> endobj +1387 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj 1396 0 obj << -/Length 2305 +/Length 2327 /Filter /FlateDecode >> stream -xÚ½YK“Û6¾Ï¯Pù²T•…/¡U…Œ¾›Ç»ó™ £gí)è®ø³Þ`\éhç “„ÔâºvóÞS0éuÅÉÆFת+ëÊaÀ¤êY>yßø-Öæ<ÿ@Zfru’%LÆéíô*!=^O® /k»ÌTR&,º?mq@o Ù­U³è=Yá©:±Mh ÿKhk^Ýu÷´á-L3í0‚^È$è„ÏR 2t¡+T1 —’ yÌ÷ûWZnŸ)kš—ýŸé±zt´¦Üî0ßtTå* Dº ÎJ~œb¸û»â¤íŽ¿Ç\’X›)jôhS¸¬aé.õÈhƒø#¿_VW¹’$c"Φ«[À4^Ý<š1«n“ǹê6}š«nái¹ÍH©ŠöÏÇ&’iÂs¿Ô^Ö SØ ¨ -¼ŒÐTG¢aÒWÛY›ŠîãÊ&MÚ®±åqÛÚÐЮ¨ÃæC¾-W4|ó-°||xC[+:ßÒ¸v2Ÿó¦OK”jJHØähžÄ‚ÝÖj]P1ƒ‘Œó(êy&@D¸žëñˆúlÞαEZH˜m¹Fô“)Kä4Êž ‰¸­zMÑч•pl|1ÉÝغ:B"ÌæõÙ¢¬v‚^J÷®rýæ -¿ _P=qCãÜíËÝ›[Úr[ùcä‘2êÌX@F•ÓÆxÆ©2xÿò4t¦ gþòwœ©LÊŒ˜þÄðŒ;SAÁBÜô槹N ÓçܧïÚ™@ɹ¿ùä­w&½lå­oÉ|>¶ø N_NvpžooúMA€‰i· ,^SœÅ®ýp^séüá<íóôÄm8þ”識' ‹Å´–=Ë„ï §Ÿ‹¥*ýñ<½s=\NÑ3êµXÂeo yà÷›Ì8´"ô›r~ Üöx´…Š;cÒ&ø4˜žq?Iˆ±Ä½ÐÂS6 -ÈS*0š/°ÒƘ²j ¤6\l}ݬ±!B -^’'4~ÄPê(q¾/»n_,úú¸.óŠV¨-9 4KÏT‹z;; -½âêk¯ò¿žÀ]¯w_ ±žE”¡·žÓçšnWÝäeé_zîEW -GjŠMÑø„B0U®lÈèÍ~øøëÜÈhùf ¤:ß$ŽÚ€g¤ò²Ò!H5ô=€TD÷¨úk¯«¶{´¤Q¸ -ÅŒN¦õx&à -m¬Ðü®:¦V A€ãÔUÇP5€öƒ*‹¤ ÞG|õãÀ~m±¨´N«°Õ"TÂâUTÝ¢¤]f1\²Î^|IüT—Ë®g5ü±ƒH ƒnxÒØÏ8D¢˜2'•&9ÍXÿGÊ gÓ^Ï1î¡à¥ž© ÿ 3¤+Ÿ¦+¤Ð§8×Pã€jù „ág }ÆB)ö+»ËX¸ ]G_™}}!­$àÊ5Îý†œÇ"hFöIMf˜p Úa¾QAY† +bÄIׇ‹øóÎ ý ~S´õŽë]7<=Q xÙq' Ø3Ì( ;þ¢¤½]óF €ç÷–ãþÌ_´W×¼Y2öDºUeàÏH¶±h[k£  ÐeF2À¥kÀÁ0†ÔTZ”郋ÁÖp0oç¦ÞÙEŽò‘§^zÅ%Ô؃œâàCà(«–ËÃaòÙ—ochÙ8X¢{Ò@çI¶úpäÄL‚N‹\”P–t3[=Ò4:OmõP\=Ƚ±Xtõ+^®ef–”%ﻹºç.27ÂÌV4)Dš+[='ŽºCÖ´æ¸~gwÆ,pd0Šžþüû…§X¦›ßmÂÀ…Áù¥Œþ5#†. +¨Ð٢̣U {ÚãA1äƒAeVÊÊEjf™œ”Jh©nèAÅ\ܧY<$D-©VZE¢…9—a-Â/rTÂàçøyûÀ+ˆAÊO„‰r¦Md¸K}‡ê굥ȣ¶Y«*zêGt8·±"x °?ŸgÑÜøcÑïÙÕ¿&2õ>µãÕ˺0±|Óì„8¹ùÀý C¾Á¶§ý^¼ +§#$û2áZç¢PËl3ï}5¢æ½oÚè}Kä¼÷ôî*LªP©ÈÁÜûZ·okÞBƒ 3Q¯fÛw˜, “—Þ®Ž6BW„Î/MÒhã2v… #ùO¸É0¾_¾¥1ÖôQ®—Ùª¶ë]Ááj¦¯z÷è_/}ÛRÍ‚C¯¾Äô¶vA}ª§³–3€ª 5­¦{w@¦TRÈ\zL”H~M2ù@R'ä‹$-ÌWH‚ׄÌ#I +—«Ïì¬ TJ?Ø æ>p0a*úéË?Z=“Žß\)¯Oö8{ ª½>IÃfÀ@Óež‰ªÒ_Ñå4¥ËšÝÌcBÁ6‹º\"éu¹HÒé2 ù¨Ë4‰6¾JeTěƆ̶ýñšÙØ›.½6Ô(A*ÿÈ ±E‹¶7Cü.AðÛe0l;^¹©E¼D†J“‡˜„%2wŠ·Ü‡ ÅkCr¸¼úPÇ`ÿØfw¾2ànã{\æÉw€Æâ¢î”bµæÿúlþ\g9Ö^דâE`²(õœeº‡º\w /—1ë® +šª4ûŠ»Ž@Ó¡_ä…ÇD½è¢».‘ôîºHÒ¹k@òõ€ÊPpû~§>m`‹~sêÚdº‰ä.ÒöxÀÞ8]ͨ ¼Ûò´øàŽ//õ…ñ¹<ƒ ›‘"Ä…%H‰ºÛ×g†a_ï‚ÉÈÞe8×Lµú#?3V•e*òªX¶j4Ÿ„Õ¦%«.’tV]&i­’œLè7qj6í.ê¸YB5ò;ÄvhmoF±ÓÚBj\äOÆ/À¶{8çZ>¼ˆÝÝ‚dÀ[c^±ÏìeÌ´…iø²«Z¥D$%Kýi ·R¾/Câx3ÇS[c²ÌÊèËó§¸ä !O]Ô1?0Á@ñ#IO/Dpb©k†mvýÆt|ö>f>›\,üÙ¼%_RÃJ¯<€åËG<‚÷5uií¯Îc™f û{—7¿ë|E¯ ‰qA¡5½p~¿¯ÿç“V°nÙÛÇt{-ï*׋íu3Û^;”_϶×KÔ|{½HÎ'ƒ€gI]È1KêBݵ˜°K'gÉ‚oq°$Cœ6Ô ;xà›+¸„&¯Å±† „jš'c$#b[ÑlüÊKÜjwøL>VJ[9ÐC!Ìc±™WüЫéÍŒ>Îãïî °è_qò‚žz>;½íY@jóA)÷Çð‚ä×¾m¬øÏÏTYWEpÇ µ•Ã)ã1кš£ÇåÈ”/!ZóÌÉÔmûàUU®Jp9~|ùãé—ß’ÕÜò‡§Dèª\½Â8²ªVÇ'-ø8ÏÚ§ÏOÿ ÜÖ¢ŠG\^«’T”*wôwwËáåpÏ¡J¥Ðºø;8t¨–9LK¡²4äð…2Ñ–îü|‘ãûÓ‰ž4‹×ÞLþ-|;T‹|ëT‹Tgó|_Øœ#p +3«¿\­Ó=þƒ±i[gÄŠ €_èm‰ÓpCTúÆ)ìÜþ;jXO²ÄW~(W¶ÿ\–¢>„+=û¾…=4ÖZæ•ìùg$oŠ ÿÏãÞU.W…†¬™ýæ°¨âׄ9d!´£6cŒ[†¹g±²ÞÄ¿(û«‡W¦³‹öYyöý(ª + Îü+’ƒœ j“Îr‹Œžô=½L—"+õ<Á¿·ðöendstream endobj 1395 0 obj << /Type /Page /Contents 1396 0 R /Resources 1394 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1393 0 R +/Parent 1354 0 R >> endobj 1397 0 obj << /D [1395 0 R /XYZ 85.039 781.388 null] >> endobj -1398 0 obj << +86 0 obj << /D [1395 0 R /XYZ 85.039 761.463 null] >> endobj +984 0 obj << +/D [1395 0 R /XYZ 85.039 657.513 null] +>> endobj +90 0 obj << +/D [1395 0 R /XYZ 85.039 657.513 null] +>> endobj +1398 0 obj << +/D [1395 0 R /XYZ 85.039 612.438 null] +>> endobj +94 0 obj << +/D [1395 0 R /XYZ 85.039 476.846 null] +>> endobj 1399 0 obj << -/D [1395 0 R /XYZ 85.039 680.637 null] +/D [1395 0 R /XYZ 85.039 434.561 null] >> endobj 1400 0 obj << -/D [1395 0 R /XYZ 85.039 653.538 null] ->> endobj -98 0 obj << -/D [1395 0 R /XYZ 85.039 623.55 null] +/D [1395 0 R /XYZ 85.039 402.352 null] >> endobj 1401 0 obj << -/D [1395 0 R /XYZ 85.039 594.146 null] ->> endobj -102 0 obj << -/D [1395 0 R /XYZ 85.039 552.451 null] +/D [1395 0 R /XYZ 85.039 361.705 null] >> endobj 1402 0 obj << -/D [1395 0 R /XYZ 85.039 530.59 null] ->> endobj -106 0 obj << -/D [1395 0 R /XYZ 85.039 502.643 null] +/D [1395 0 R /XYZ 85.039 318.068 null] >> endobj 1403 0 obj << -/D [1395 0 R /XYZ 85.039 480.782 null] ->> endobj -110 0 obj << -/D [1395 0 R /XYZ 85.039 452.23 null] +/D [1395 0 R /XYZ 85.039 290.364 null] >> endobj 1404 0 obj << -/D [1395 0 R /XYZ 85.039 430.975 null] ->> endobj -114 0 obj << -/D [1395 0 R /XYZ 85.039 403.028 null] +/D [1395 0 R /XYZ 85.039 250.322 null] >> endobj 1405 0 obj << -/D [1395 0 R /XYZ 85.039 381.168 null] ->> endobj -118 0 obj << -/D [1395 0 R /XYZ 85.039 339.672 null] +/D [1395 0 R /XYZ 85.039 209.675 null] >> endobj 1406 0 obj << -/D [1395 0 R /XYZ 85.039 317.811 null] ->> endobj -122 0 obj << -/D [1395 0 R /XYZ 85.039 278.436 null] ->> endobj -1407 0 obj << -/D [1395 0 R /XYZ 85.039 254.454 null] ->> endobj -126 0 obj << -/D [1395 0 R /XYZ 85.039 215.08 null] ->> endobj -1408 0 obj << -/D [1395 0 R /XYZ 85.039 191.098 null] ->> endobj -130 0 obj << -/D [1395 0 R /XYZ 85.039 151.723 null] ->> endobj -1409 0 obj << -/D [1395 0 R /XYZ 85.039 127.741 null] +/D [1395 0 R /XYZ 85.039 138.94 null] >> endobj 1394 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> +/Font << /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1412 0 obj << -/Length 2149 +1409 0 obj << +/Length 2916 /Filter /FlateDecode >> stream -xÚµYß“Û¶~×_¡É层 @Ò}:gœæ2¶{Ô¾$™O¢î8•Ä+Åó%ÿ}ö@‚’Às'íd| `±ûáÛ#ç1ü'ç¹±*æY.…Êóùæ0‹ç0ò×™´K«²ôtÞ¯gß~o`4E\Ì×»a-R­æëíÏÑw?ÜÜ­?ü´X*¥"-Ë,Ë£ÕBF7ŸÞß 4n?¯?€tdôùæãjñëúÇÙ‡u¿w¿*ìSàÆÿ™ýük<ß‚‘?Îb¡Š|þíXH>Ì`g¡SeûûÙjö÷~)Kç<ëÚ9ÆR¢Hô´/Œ©Q½/•¢Ð}!e"”L晎…ŽSr†JÀI‹ÅRë8ZÝþsQ€#>‚è—XÇ÷Ï;tÁ[è>gdÔœ°ý¥Üè y%Í„–¯Ø9èÐbÖÛ™,;OÒÀŠ"ºÇŠÏ`ÍñT?«- -²H%î—…6Q¹®¥ÐÕÐ…Y"äôXŠ¸xÅéƒN&Ï„L32¶èXYt¬,6Þ:P€ÒÛ/dß.Lž -©‹I=0.Œ1BÛËìáÂ$E¡âö °ß´3È–†G1DuGÖÒi× ´P•=©tûê5†BQçA„˜Ù\p¨²[{pq.0HÈÁÅ wÜîš+éÏ -|5‚Kß aŨLdjšT= ¬$Jd…aE^2ÉŠoŽt,èìþ;F1I,ò8™6xЙ@N¬€‚ÍrBNÅ3  9ïQÜq{’V ¸ÝÕƒ jb’\%@ Üìø`w>'”^¸ã…!ãc ˆ’K:K!ŸN{ÛÓ ÃC›X¤j”gdÂðøÉQ‰ƒžëy‹ +¸˜Ç_•"RC¾š&-Og"îà™˜ÉâBErþÎjèÑÊ®žJàN%Ø›*KCr?\€$Ç•°ñU5Hâaƒj9øp¸ÎÜÆ”ckÓ«µÀ!ZLj;×hÉ ÞüòÄ¿ùÇꇿѣ+WÑú›Tˆ§©@{:a ª ž\fœ´âëôz½«L&T6M–žN’*-D–]<ƒŒ{™s8â«…^CCÙÙcIÛÇ’q%í¨ÇŒ]º ,­þeB©ÿ62ã·‘ ‘—’¾_§Ã#9Ëå´Ó˜ÔŒœ¥Þ|æƧ'–ÃûîØÝw<¸)÷È:1lò%Õ8{×´‡’§¤‡]éJ-èß¹±mV¥¹ïÊzT’‘˜ù;·Iþ[y ¥šjmrÚÆOBHP¾/Y¾A톜µµÉ”Êãöl Æå™3¼oîn¹±mè´Íó¡bn/­ÿ-Þº[úD0D{K§Ç¦sm=·eÓÀ…ßV=éÚ\‚7ºn«ýï,…V]âÅÜÓ8Ý­o¿WÆCXÙ3Ι†0fÿ*ŸjäÅúØaôàÚ·›c÷–Û½p{Mx¸ªz°ºè,™ Ï 6eËzožÊ¶<ØÙžx[vå¥ôMPÓâäï¿ðyG7jiD’©Ñ¡í…Ê -Jf”Û)XÞ"ºZt§²­€ãR}4ÊÅ6iê¾v -náÖÄ «ôñÎøSçs»EiWZ!ÐÞ³¬k˾æ(ݺ§nW÷Jþi«a»ãÇâÒzÁ‡+Äzâã“L5VÓüåé„s²„â°€_Kº”“™yï -/T`Ë´—ØدX ?ßy¥ þgDÎÖmÿnV(¢½÷б Œœ8 N#LÍÃåÛÕ;$Z’I¡%°%Ác#d$åª[5»jÒt:©nù£9)UmyyW6<¿äù²õO~QUÄF„(òÂÝç`?µ½‹Å< ß4ÁÂÕNyá2¾º·Cá ê÷‘ìVGWŸ0€C‹3جÉ"—~U\ãö p‘p½ bͯ7(ž6„>ƒð[È’a„š.ÁçÆÙä?—VSÜÄVÊà‘'Êm[ÇÔát0ÓÛ¾,{ÛªÚ*<´ó%ÉÌŽ|uýûQ2ÔF8Ïr«D‘Ù—%Ck!;‘ µ +†û××Ͼ}üÄ6EB‡ç n•–"sæU¸ ¸¦¹Up&›ç#nß]}øL¦ò™e·#`ògÒ°?›˜ËÈ£q‚le‡*¿a‡xËëƒí›d[Ý„’€!=ÌàMpPØØøÁCS¢³rX»§à/•gÿ£|®spªm¦}dÖˆT¼sG:{‘ux\óÙ©RI +¥UO±/•tž&ms‚IeR h¯Á£G5Í¢2™BÌâèò>èb®ã‰> æ¡(¥µ'çÐÊ 'óW9HÀ5}¸ºiÝè$o'êQ8‹(¬~=®g8Ì-ÜÆæpÒ~*ŠOå z¸»Co©éÿªìü4¦[(KÙKT–‹ÜŽœ¤lÖH†"ôŠë"ª*Dêlç€KÌLüâC¹×*)sÁ¨ç Ægj_²@ §¬Èrùrk–èq²Sæ¬AEO‘Nß’ W˜êÀ Nš«²pU0¯Ä©Çõ §NÁfÌéaÑ*(…\{¶8×pÿµ…}v®ivuV™É)Á³iàRlàöl\Ólâý ·æŒT#gkyY¿åa Dƒÿ¾§B<àÁ{•+„.ÔqÍMqÒ(* + JüjAvV6<]¿ð• +ÜãˆÎÌ3¤w#ŸqXoå.¹Õ„!o"¢& ØQ~èsØáI8G¯œÂ=2×/s +k!;á©“œz6åh¨»äë0ȨžáO;¸Ië'5ôÌ°ÛðÄS3Þ>Fz©w;ªÒ±‘€Ê\æÞI ™@Í3²ˆÝªWuó†íÁ_-én[û(§#4È:…B%³/ly\óÙ‰‚Ëëžà8â=åâMž©×áÎãz†;¨øT 1{wý…îÏ4KáOžéÒf9˜7 ›ê›F0gû¦‰ggû¦SÔú¾é$¹Ð7éQû#ÙMµ^sȇb +|{4ܾÃg³âúçD,äx¬Ç½b›]5è'å–'Q®‡=Êø‰—£{ÜoiûÝôĦNÉ$}DÞõwd Ï5w|‰ü¢f’Øó=­„„ꬮšß0I*]dql-¹ñµjð—å$E(vÆ2x>Ì Y¯0>êâê¾îxŠûíaçéø]Dm¡²ñû<âq‡î(·ÔÖæ³ûuɈø,Ý©t²­}óožg2ù†Éº[a;) Znù…U[îÛ°†\â¨?ŸIeèiÁ4ñ … G»j~z= ÉÏáñµá¤ ë:Þw‰ ë œ »¾ "z+×ÔÕGˆ“š®›eœ’­·a(ΗÜÃaË‘xÅoh—ܹ¡m;®6¶ÞH¾ÚÝm=tW¶ßÑ6œÆ ¾oRÀüêG‰@-¿Q…Ï —Bl¦VÌøçÐË l­Òæ¿u±{Fé¯ñ ›UÐDÙ¶áº@5–ö)Ÿ(¯ÎhA¥tªI- 0$«Fh“G?[ЕI_rBTɲ4ùBeOCÌS-göpˆÅžN±À¨ñÙ,WØœaR[+d>Íds¬»€'ÓpÁðe*Ûhž´>àñ'Á½ž¹ W¹áV·‡å‚0ØqmE]?Z+†Ï%ØöÃSÒ×=†7Œùó%E[>5k=SÀU@ÒBä—‹¦öpK‡6à_ý€â«­†<òÒÞO|”DK¼*¹ý_ƆÆíÀÊ9†k¿Pzú¶Áô¦$,5z­(—‹B»`:èJ¶Ÿÿ¾t2y÷+ævÔÅÙ¹}Ã_ 4Š~â2¥T ÓÜ gMFåJdŽm¦YuTÚ¾Ò©—ã¸ò‡‰Ò{hÍIVz;ëBÜ _)SWþnÄ‹7Â6º …ÉÛøNn0¹1¾­ÖÞäôøÐõÅÍ9M*üiB:ýÛ¥æ¼&¥VëX“Š5ùÛ‹4)sêúL²7ÀœÕ¥„gnݳº¼¿ÌÀѶ‡a¦ö‚ƒ”2œƒ5ò&¨Ò×ô½(ÛHÕ}& ñ5 OûÐzÁ1¨/Üq×ÏjNæ…È]1)šæ¬æ¤Q©"ÖœáWOY:ŒT‡ãûr;¡A©pzÚÀ"˜óL-}Сߠ°?ýÑ—øÿƒ/õ£ÛÐÙØ™ +åN‰þ8P¿è§zQéÎý°ì¢0ž©2G?7‚b'ñû?ßCJßendstream endobj -1411 0 obj << +1408 0 obj << /Type /Page -/Contents 1412 0 R -/Resources 1410 0 R +/Contents 1409 0 R +/Resources 1407 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1393 0 R +/Parent 1354 0 R >> endobj -1413 0 obj << -/D [1411 0 R /XYZ 85.039 781.388 null] +1410 0 obj << +/D [1408 0 R /XYZ 85.039 781.388 null] >> endobj -134 0 obj << -/D [1411 0 R /XYZ 85.039 761.463 null] +1411 0 obj << +/D [1408 0 R /XYZ 85.039 761.463 null] +>> endobj +1412 0 obj << +/D [1408 0 R /XYZ 85.039 585.186 null] +>> endobj +1413 0 obj << +/D [1408 0 R /XYZ 85.039 493.069 null] >> endobj 1414 0 obj << -/D [1411 0 R /XYZ 85.039 740.47 null] +/D [1408 0 R /XYZ 85.039 463.85 null] >> endobj -138 0 obj << -/D [1411 0 R /XYZ 85.039 701.095 null] +98 0 obj << +/D [1408 0 R /XYZ 85.039 420.312 null] >> endobj 1415 0 obj << -/D [1411 0 R /XYZ 85.039 677.113 null] +/D [1408 0 R /XYZ 85.039 377.359 null] >> endobj -142 0 obj << -/D [1411 0 R /XYZ 85.039 637.738 null] +102 0 obj << +/D [1408 0 R /XYZ 85.039 324.235 null] >> endobj 1416 0 obj << -/D [1411 0 R /XYZ 85.039 613.757 null] +/D [1408 0 R /XYZ 85.039 286.704 null] >> endobj -146 0 obj << -/D [1411 0 R /XYZ 85.039 574.382 null] +106 0 obj << +/D [1408 0 R /XYZ 85.039 245.208 null] >> endobj 1417 0 obj << -/D [1411 0 R /XYZ 85.039 550.4 null] +/D [1408 0 R /XYZ 85.039 209.799 null] >> endobj -150 0 obj << -/D [1411 0 R /XYZ 85.039 511.025 null] +110 0 obj << +/D [1408 0 R /XYZ 85.039 167.697 null] >> endobj 1418 0 obj << -/D [1411 0 R /XYZ 85.039 487.043 null] +/D [1408 0 R /XYZ 85.039 132.893 null] >> endobj -154 0 obj << -/D [1411 0 R /XYZ 85.039 447.669 null] ->> endobj -1419 0 obj << -/D [1411 0 R /XYZ 85.039 423.687 null] ->> endobj -158 0 obj << -/D [1411 0 R /XYZ 85.039 384.312 null] ->> endobj -1420 0 obj << -/D [1411 0 R /XYZ 85.039 360.33 null] ->> endobj -162 0 obj << -/D [1411 0 R /XYZ 85.039 319.781 null] +1407 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F20 937 0 R >> +/ProcSet [ /PDF /Text ] >> endobj 1421 0 obj << -/D [1411 0 R /XYZ 85.039 288.256 null] ->> endobj -166 0 obj << -/D [1411 0 R /XYZ 85.039 145.739 null] +/Length 1406 +/Filter /FlateDecode +>> +stream +xÚ­Xßsâ6~ç¯ðÜ“™ ª~ÚÖ#×I{¹I¯m }¹»h a†@ æ2÷ßwW’±d#‘L;™€´»–Ö»ß~ZÁ2 +,«¡Bgeň¨ªì¯çÍÖ ùyÄœÅÄ™L<›÷óÑ?©2c”hª³ùª[G©D6üœÿøaúÛüöa<B䊌'eYå³1˧¿¼Ÿ¢TæwŸæ· –šÞÏÆ_çG·óóÞçUaÿ3úü•fàäÇ%BWÙ Œ)a ~ÁÎDIáæÛÑlôûy)«“™}êÒ{¶¦‰æ*‹‚Yˆs,8hÑJù±P”(*M,^TŽ'JÑ|öçXCî¿PE—§ÕÍß šï0g±È’(vÅ©ÎÆ8Ãa‚XADa|:ÔÍéN펰½’yóTÛÁ·±Rùb ª““ìW­ L姌˜¹ Ö»úÑÚŸö‡Æñý@Ç +ûÄƛƼ¤QoñÁ¦ÙÖ\¥Þ=¢~±³JÔíƼʛµëú`å ·öþ eâhtNQä%DÑnö²1ÎnÜr¸÷ u ¸ ÃtkŠå Ô+€¨”2Ÿî,dáQ®ƒíAh"ßÍÓƾ>¸A?¿Ûýk+Ú8Õqÿl}Ü<×Nt¨WõÁD ×Ù[áâhçïþ˜}øõa\É|Ž½#<ð]‰2‰Ï& +Ò¢ dæƒTYÞHy>E/îAêc•a”(×B•D–<í^g…kÁ®¬âUx`²@öÔIºDÕvàáu½³v,wYÜ~/ "í[ƒVD§±ÄG-:—Ð rƒN„ B 5BAê!6ðŠ{ŸLH¡ø„[ÏÀvÕDH‘ŽrgªÑE僠™jöªRÈÖ¥NzåÙDsÅI*.¹—vÌ*B®’P°˜x a>›\È9ê`è + ñ‘«pl‘`¹ +ç[„B»B¸ÜÆÁaݦ… ·ò(íà€~{p0¼Š°"àp:ñtõy6Q\H-ÌIèᢼH-> endobj 1422 0 obj << -/D [1411 0 R /XYZ 85.039 126.867 null] +/D [1420 0 R /XYZ 85.039 781.388 null] +>> endobj +114 0 obj << +/D [1420 0 R /XYZ 85.039 761.463 null] >> endobj 1423 0 obj << -/D [1411 0 R /XYZ 85.039 108.208 null] +/D [1420 0 R /XYZ 85.039 740.47 null] +>> endobj +118 0 obj << +/D [1420 0 R /XYZ 85.039 685.837 null] >> endobj 1424 0 obj << -/D [1411 0 R /XYZ 85.039 94.658 null] +/D [1420 0 R /XYZ 85.039 650.427 null] +>> endobj +122 0 obj << +/D [1420 0 R /XYZ 85.039 609.343 null] >> endobj 1425 0 obj << -/D [1411 0 R /XYZ 85.039 81.109 null] +/D [1420 0 R /XYZ 85.039 573.934 null] +>> endobj +126 0 obj << +/D [1420 0 R /XYZ 85.039 521.422 null] >> endobj 1426 0 obj << -/D [1411 0 R /XYZ 85.039 67.56 null] +/D [1420 0 R /XYZ 85.039 483.891 null] >> endobj -1410 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> -/ProcSet [ /PDF /Text ] +130 0 obj << +/D [1420 0 R /XYZ 85.039 442.807 null] +>> endobj +1427 0 obj << +/D [1420 0 R /XYZ 85.039 407.397 null] +>> endobj +134 0 obj << +/D [1420 0 R /XYZ 85.039 365.708 null] +>> endobj +1428 0 obj << +/D [1420 0 R /XYZ 85.039 330.904 null] +>> endobj +138 0 obj << +/D [1420 0 R /XYZ 85.039 289.82 null] >> endobj 1429 0 obj << -/Length 3696 +/D [1420 0 R /XYZ 85.039 254.41 null] +>> endobj +142 0 obj << +/D [1420 0 R /XYZ 85.039 201.899 null] +>> endobj +1430 0 obj << +/D [1420 0 R /XYZ 85.039 164.367 null] +>> endobj +146 0 obj << +/D [1420 0 R /XYZ 85.039 123.284 null] +>> endobj +1431 0 obj << +/D [1420 0 R /XYZ 85.039 87.874 null] +>> endobj +1419 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1435 0 obj << +/Length 1705 /Filter /FlateDecode >> stream -xÚ­[[oëÆ~÷¯0üR -°X.ïÌ›¤­ƒ“ƒ4ÇhÑ&y DÚR"‰.IÅq~}çJ.)’JqŠCËÝÙåì\¾™å1·ü3·iäzAv›¤Æ Òôv{¼ñn_`ä¯7F(ÖB²¶h¾|ºùó_bõÜÌËnŸžûu"7Œ‚Û§âç«¿=|÷ôõ÷«uNä®ÖI’:ŸVÆyøöËì ÇO_CÐçãÇO«Ÿž¾¹ùú©ãÝ­ -|2düŸ›~òn Øä77ždéí´=×Àðñ8»QÈóáæÓÍß»¥x,¼åYSïú±ë'Ð<7MÃIc|70>#òÜÈ ;a˜È†ñ#7ã[%Bi€F/g‚Ð5Á­µÒ%;&¹Â-ÈÜ(Ü^óäšQ°_¬Öa:9Äëjí'Nµ?­üÔiËš{ÛŠ¤ÝÁ´’Û¯¸BK\(!©xʆÚ†ˆxÍË¡%AìfQtE°=Ñ‚`…_5žì;ì"7¬Å­È[ É4úƒ2… ;‘S“Û¼šYaɼ<ýÀ ½øŠ<{¢y -¾a2+Ï%v*ÏEn*O‹[­ZMB%¦þH¢¬“Æ©qÐ`ñ7ç¤Mv¥2³ißP¡÷Û¬¶“žýºü°¡¹%3mÊ–Ê`´‹óvWr£.Û3Û‰Ø(< HÄ•élÖB3rÙŸÜ2·->ç´7}Ô¢ê}>ŒÇObׄà#½ÌM£øº“ ÀÉM»Èµ®µ¶»òÊ$i[+#…Ë èÁJªª²!'©÷/_Ì:×&®8ˆžhÁAnÓÌ:ˆ%vê ¹©ƒ°¸= P2°/ ,ÍþåTÜabþÝ rµÜV?ðB‚‚Ž‡ï¹A¸éë¦?ššpÅ:6©ó¯Už™Çn¢: -««VíÏ•:ó_WQ !é,ç=oûvÇ„ˆó?­'œÀ?VÆÀ?¨=I4|KpyªÄ´~9H‚}¿qÇÛ®¬Ë!X5¤Çسø¾bŠyma1ž½U’½5¥X‚^1Ä>/¸’#XD :&D(VÇ–Ø©Ž-rS³¸¡Ž…&v>}õH¾ëñßØ‘8M[ïQì/ü8)'B[B ç€m;ñ([[öDYg¤ ¬Ð~äþg )Ïh÷•l1oF[ùÑ3!a®bBÅØ£X!+ˆ¹óÛü”³¡ÀC!Nû|,Ù†râI¶FF#VDüjv÷¾#8ßþåî™…å‘Š]<ØÛRý+’Á.·~‚…q¹$æù1¸\’åqß–ì*çûÔE¦%[:< Nº¡MÞô‘9!»x•â.òòHÊzžÉãlYôØ‘ËbÇ¥m­62/ù¡/?æl•mïGæÝN$FÁ’¬±4߶g B\-õW,7ŠB7 Òe˵ˆæ-W‰ðŃ9Ë]d'–»ÌM,×æö b~@/û¾roÀØß(<«Y'бN±XùüIôÚu©³çœ>Š!°šÂŒ>ú, fÀãÒ‘…ÆõÓkGÖ-™¡ÃÙ#[b§G¶ÈMÌâö@F -fÑØI"€ ³Aªüu€¥¸“³\jr -óØkŠÍâbi°´¼P.k%º0¬ÓjÝRâ3ö”—–ý-A9𜚕DI繃(eOš°ßæŒï6tªhüqàäό袴/@ûîSçïxýüTpã̸RgTÜì†I&Ûùèœ`Ä®íò5îÎJfr¸›©rÍ«!ÂõÐ\QÞhA …h±.¸ÈNÕp‘›ª¡ÅŒ¾Ðyî¼N&® õª°¡q|ðÎ ¨ï©¾Ooð%v~%—8³Yeq;=Í„3ÑíÄñeÙt) Ñ-Ôä}êÈÊL—eÞàJÂâtœ„ë¡‚‰ó»®üGø¿.ÆEÝÂb)p«q¨{Ù^y®g®@-‹h>(Ñb o‘Ä€enln|¯C¨¥v¢'€$ˆºðwƒ=l *z~”Ž®±„œUŧ™ïO Ó)LÂ6åôHjåôâ½àð0ã5Õ{"0hx‹Kßÿ?ƒî¸ób -\ç”Â÷Á ^Ñ‚RÑbÍm‘*Å"7U -‹áo £øß´vžÄCvÉ0W4C;?Vg{Vg¹þ$6÷//©eѽì¨Ã»Ð×_iÜ¡5 °ë8b cÐyç糪?°/d½"zK•ðq¤J¨ƒƒë2Fë€`.9&â9_æÍÞºV}ÇJ÷=83“æEÑ£sºVñåÊÃtòCPù6¯[îî‡K¦Gá‘{FááçØÚp¬™Ð‚g8¸#,¢)ôKÎ;~œyq¸h²~’òÉ´ÁDnƒ —¼O"y7 tnþÄ;ŠèÀ¬Ûf">†wØÓc׶η-3M©hQcm“8s¶IMaUÕ…uíßoF6àð¨ r‘µãût’W]n[˜(ÿA¢"B«.ë–C#`@#U±.e 4ë±ü(rM|åªÚ"š÷XJ´Xk\d'k™›x,›~©•‰4I_;¯“Iª›Yž úî`ˆV甇Òv~ Ï–ú-ª+`èSl‹ïL -’Eöéá=ìáQOæM†µüÐTZ"ƒj8joä“ŒîÊ)oÇ9 ½Hn'šYËvìªãÏ|le[š¨´BÒ\èè|rôOÛŠƒ,žÌjLâ»  RÎû¼›v]jݯ5¡jI H)Q~“÷ì°Õq±˜äŠ.Üø -P¥’dÉÈ6Ü©ð6ëý¶‡æ ¬&Š²|G -b²&ÒUPÓxîþ™¥n2J—F—”èᨴeí&A0Öœ-÷+ -ÓyX%J"JàpX>èH,5Á+ƒ§ý3_"± %‰\ðàê¹NoÎ[Z¿,øf)Áú^ï^¸rìé@¬¬©Ú¥q½»1Òë¾ûº§Ó¾cõµ?ˆ¬ÌÞ¥¼´­N¢é‹F9R„zç >$C$Š£T‡ÅïÆ ¢¶—¿÷¥fu‡¸Â÷9—†i",\:çÉãˆÖO±ÍAGnÑ羂°Q' ÷ü5 ŸH”ôÀŽzñV§cÁYÎóñü¦_G3¥åx¾ü½~7û0s9™J)#Í&Ó4Í¢«‰ˆfç¯fhUÑéÅü ÀGD³³«ÉçùûÑ›y»[âäøŸÑÇÏ|¼„$ß8“y6¾‡1g¦7#ˆÌ´’öy=ºýÞ-EsjLoۧ󘊜å±Æ"L%²Ã"†YÁr­},4gš+ƒ…f’ÁF…œLµæÑå韓<Žf¸ï3°âš_ïoNîÕ;2‰*eZ<‘`ïc„ác²DÂdbòkÊvß@Ô펈iWðPÒøËD'Q±Þ÷–ú†HmW% ö[˜ÜánªÛ-ù‰hIs2¦¿×L´´Àõ=§Æ ý—U±Å™8ª¶“8‹ÚòÖÌ5ôjÑÒßúÒ„)íBXœ"`æé¾2yW[Æ{|Å_Ëoà@7É3–§j]Ï'H’‚œ@j>ýÊÒuüC!œùÄsØÇ x})Öä')g χÓë}‚ä'2‡J%uî @-¢È³ž{;îí£!ž§.AîÁo·ªË:xâfEB3¤³O3Px¢"rPÎÜ–  »äEÀ *"#EÀ¼¯Œº7•å)ÂÝÆj„Ðœ +l¹Ç„¦Jé¨q»¾qƒæA À²$d+Ôg`|÷Ûå$“ÑüYPŠÀZò„;— u&™Pò@ˆÚ ñéFtòÅìu@’Ú³ÐÃyz>AIjU•ç%©cÛh`ÐcoØÐ’$©EïÔ#8™^>×UkÇe§Å‘Fî…}dG)’ÅkD”/;å°A€Nv¸¿ºÛžUZP…!­h8µ¸Ã$ô>Z“*ñHPqnÕbJÃhäòLÒèž(ø—JlWŬ×ƈ–„ÞøÆÓ@Î*S,•Ã½Ìó +G©œ%qjrž¯ªñ³h«Úž-Ër·0T”(ð[îœdXÂû-½dd„ÆmÙsÜó¦ø%b_,èÏÙì‚‘…ž/ˆ×46Y¯M QÑ-F26d…áoêfS˜TËaU@:±Vn#VÂÆT_·EåkŸüÀíŽuT~²°BðÈ7ž·4apÀ² ‚Fåd1I×FæKã” ìòº;Ðn@@ã¹ñ(ºB[Œ ˆ“ãŒÔaìËÚld±ß”Tz…%Ùý©½ìnõ~m{-¾R·î°Ÿ:†T´¨·»jjÑ6hÕÙ×ßh¢7 ZÅõº4 ½x W§^‰ž’,±×©E±^ÿUÜUØN«-$£cÝ5‹m{Bãθ¸{F{ ZöP¸m/ž9ˆÌ._Rö0Ê,¾b7Hä?Qú÷«Ê‹­,+8÷'Ýî÷ØÊÝñ³o¼»P€,™0Ňÿò|ÂdYO…Ɉ֓5®#Ë‹gîÿ?YxK Ñå§ýbxÎä?wx>ab¬²Ab¢õÄ …ëˆñâùr¶ÔXÄìWcw§OÎæð’âÓxô0VÝ'IG¿§Ie1‹Ÿøhì]‚àZÜkÄv TíP,‡¬̶j{bZÀô +¼…ZñÒDý éí‡.6ð«¡ä,>ªøŸ>[~è×ëþsX²,ô5¬ã”%©²¹˜Ó9y˜®–Ó™|œï¿°`n#endstream endobj -1428 0 obj << +1434 0 obj << /Type /Page -/Contents 1429 0 R -/Resources 1427 0 R +/Contents 1435 0 R +/Resources 1433 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1393 0 R +/Parent 1432 0 R >> endobj -1430 0 obj << -/D [1428 0 R /XYZ 85.039 781.388 null] +1436 0 obj << +/D [1434 0 R /XYZ 85.039 781.388 null] >> endobj -1431 0 obj << -/D [1428 0 R /XYZ 85.039 761.463 null] +150 0 obj << +/D [1434 0 R /XYZ 85.039 761.463 null] >> endobj -1432 0 obj << -/D [1428 0 R /XYZ 85.039 748.383 null] +1437 0 obj << +/D [1434 0 R /XYZ 85.039 740.47 null] >> endobj -1433 0 obj << -/D [1428 0 R /XYZ 85.039 734.834 null] +154 0 obj << +/D [1434 0 R /XYZ 85.039 698.974 null] >> endobj -1434 0 obj << -/D [1428 0 R /XYZ 85.039 707.129 null] +1438 0 obj << +/D [1434 0 R /XYZ 85.039 663.564 null] >> endobj -1435 0 obj << -/D [1428 0 R /XYZ 85.039 647.561 null] ->> endobj -1436 0 obj << -/D [1428 0 R /XYZ 85.039 619.856 null] ->> endobj -1437 0 obj << -/D [1428 0 R /XYZ 85.039 566.266 null] ->> endobj -1438 0 obj << -/D [1428 0 R /XYZ 85.039 552.716 null] +158 0 obj << +/D [1434 0 R /XYZ 85.039 610.64 null] >> endobj 1439 0 obj << -/D [1428 0 R /XYZ 85.039 512.069 null] +/D [1434 0 R /XYZ 85.039 573.109 null] +>> endobj +162 0 obj << +/D [1434 0 R /XYZ 85.039 519.011 null] >> endobj 1440 0 obj << -/D [1428 0 R /XYZ 85.039 470.815 null] +/D [1434 0 R /XYZ 85.039 473.936 null] >> endobj -170 0 obj << -/D [1428 0 R /XYZ 85.039 398.971 null] +166 0 obj << +/D [1434 0 R /XYZ 85.039 304.321 null] >> endobj 1441 0 obj << -/D [1428 0 R /XYZ 85.039 380.099 null] +/D [1434 0 R /XYZ 85.039 271.9 null] >> endobj 1442 0 obj << -/D [1428 0 R /XYZ 85.039 360.833 null] +/D [1434 0 R /XYZ 85.039 242.68 null] >> endobj 1443 0 obj << -/D [1428 0 R /XYZ 85.039 333.735 null] +/D [1434 0 R /XYZ 85.039 215.582 null] >> endobj 1444 0 obj << -/D [1428 0 R /XYZ 85.039 268.716 null] +/D [1434 0 R /XYZ 85.039 188.483 null] >> endobj -1427 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> -/ProcSet [ /PDF /Text ] +1445 0 obj << +/D [1434 0 R /XYZ 85.039 161.385 null] +>> endobj +1446 0 obj << +/D [1434 0 R /XYZ 85.039 134.286 null] >> endobj 1447 0 obj << -/Length 1215 +/D [1434 0 R /XYZ 85.039 107.188 null] +>> endobj +1433 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1450 0 obj << +/Length 3012 /Filter /FlateDecode >> stream -xÚ¥˜Moã6†ïþ:J±¢(꣗ÀIÓ6‹4h=ìîA¶iG€,¥²Üìî¯ï ?ôá˜4Úb±°D¾æËyf4¢C½þQ/ç$b…—å”°<÷6‡Eäíaæ§ÕŠPK‰ævµøîÇf#RD…·Úëp’pæ­¶ý»Ÿ—¿®îBƘÏIfYî?Ô_þr»ÄÑÄxZÝÃh¨ÿ´||>¯>,îWƒ÷°*øhü×âãçÈÛÂ&?,"ŠÜ{ƒëˆP˜>,À™ð„éûzñ¼ømXJÍ%žúÖ¥8"¤)bîf‘R’¤l`ÃlBX’" JcÂhìe<"ß=HýÃ75qì;Øõ÷Z¸i\AîúU³WKmZù­­DBŠÉ,dD› Îü ¡+7ýžŒÊ2Iõ"ä­Pu9Ä×ýËx-ƒB§LeOí‹Z¹“k|ž-C9-R¥— Ëh‰èB¾bNR(2#Âè(yçÇB™ÛNI®¸±‚ðœÏÜþTs©>z$ûø¼ª«Q•â^ª1M}_‹Pn°–ª²QÒÜ4ÇjßÈò€JeWì¡þmó˜pz ã(r`Ô" ,¶btÙŒN7ƒqâö4Á5Ôž ì|¼•ÏÌOkS¦ã㦊Q£ö «³Ò.¿µÃS×-r|³2LsR¤é†£ÈÁP‹0*feè²3 n†áÄí‡Cö©*°˜T v!¬@äžW`c£êR!ª~aÉá…G³+ G‘¤ah‰¤Ë΀tº·[ÝôfOïØô>E‹+LG‘ƒ©a”©•©ËÎ0uº¦·zöšÚYƒªjt3ñPÛ„#+9z2­Bèå¶x(²a„a–^Ã8Šµˬ]v£ÓÍ`œ¸­5ÆfR€xiòjÞ-þCs(±_h¨~G¯Õ "JâøJ#JƒPrk -^&.+“€ÑJ—Ù« »5¯¤nξSÝ@¶æìaîXü'ÌŸènnnl¸xž‘4£n^‘˜a…˜ÓN#s»ifS7ÝþÔë^–‘©Æª9ïúņ3W'Ôk8l'ø`Ü´`7Å ¶~­ê&¢Kñ7,V’ýÈŠÑåg0:í Ɖf&k#?às-+Q‰&àâáUuœŸaås¼k»CÙÙÁteþðO%žqkqƒK¾'ªŲˆÄ[üW¿óþ×ß†Ë #9³ôGc‰%z/ò';ß.g9pdï÷ûêoÓ•endstream +xÚµZYÛÈ~Ÿ_!ø%0bØlžû&/6É,¼†³$È”ÄqW'<<°}êêfS"é#XxÕlVWuWurÔ*€ÿÔ*‹ý@ç«4S¾Î²Õþ|¬žáÍßï”Pl„dãм}¼ûëßât¥?òÕãÓÀ'ö£X¯¿zßÿcûáñ‡Ÿ×­µûëMšfÞǵò¶?½Ýâlä=¼ü&€Fyï·ï>®üñî‡G+Ûr99 +þïݯ¿«lòÇ»À×y¶z…qà+x}¾É~iy>Ý}¼û§eÅš:§¡ØèÀϲhYqàÇAdu¡bGyæëT¯ ê"õ¯¦‚ÄÏâlåpº‘fh–Å)úZ…#yÍ ¨µhŠówk8Wè¨ïÔ{YoÂÔ««Ë:̼®lx¶«ù÷–("¼"L¼Wsµ_ÉQf«Ó‰Wîhe‰™×–ݘýXøø]‡\eaÃCåu=Œš‹y<°¸<¦¼>ž4ö%ª¸QxŸ9éc_œN|\íÕOü»ÇU0s3)Üš¬RøyvÚÓiÐm ¯ÃlâÓÈW°SC„;.^*8ÙoAÀ?Å;>£Öû¶ã§C ›ý*öEW²E‘"«–Τ¡sÝ|^g‘çÏYWÊ’e¼4óxÜ}6÷iÞ—ÄY¼;òšâ½+î±R„ä$!Äe€8xwqC/ zðK´7èÌ íëŸâ±äJÀ‡‰ *™SËàu¥\Ï™tGY¹„| ;¸¯€nŠ€N«Û· ·@Ÿy¤ü –䉯ƒôÛ@.¼6³‰k‹Kaj%þA¾ÚĹŸC¨ûe¾ÈO”âöqŽÕ{&"pŽ-Oß:½(VÞg„CÝ3I×õ|¿FLkþe,àEîa&.¡€9#¹nèœhøÄüaW•LèË_Œk%·Ž ÷Îa˜)­šÀÁõÁX³;£VÜöŸßÍ8‡$Œý8 ƒC3ë îGÍ:‡%iÖ9,Š3ÎÁ•·íè,ôú‹‰ÕóȶàJøwWu<01ò™ô•ioû–<ð˜Þá¥XwÃÝ ¢Ñ>óÐûÏ!È­5 ªû“HÜD† ¬xoÈýÓâXq‚‰¾ä™×ª;2áGL þµVàä¶ïŒáˆDÙºÂz—ZlêÏ QÀ^Ù„^eãší¬•™É³6b|¯C;¥#î›ÊÑÆ´1 ¬8‹ü<ŒåÐÌËÐà ÃY`-I³ÀZg€åÊ#`¥‘·ÅKùþÌéáž#utˆ‡êòÌS«Ú½ÁJµ«ð2„€ &\½¯¯è¶xð„`¹ì»ª¦-i¯ %ñ ó·@E˯¨„Ðòz·}?šŸÈ×Ï&†€³ƒ8Žþ,Þ CZA²9 ÓŠ£S˜k’Û 7LJësOÔÂðJÝ+Š5„ù€H·ÖÈ>­9àʦ4ùØ‚7$\õùlBvç Sv +‘Ä98_mÛ5öft Á&ø+R-ìõïïLºG]JÚº ?¡ ÙªBXN¢Âµ!¢®,o“(Þ¹`Û$WqÏsläî&$3â‡×qöŽŒÛ‰[/ö]IÆ9²ó{îöë–­R_¥ù²e4ó–-4¸!=oÙ ÒË^g-Û‘G– n-OìX7Ì_[·Ö_±nm,MGîXN½‰è˜ôÆ«N\ú*Ý ÖµÄt›‡ÂCSüœp7qQøÁr` ™½6!A-F³·¶ Ê^Ú’,sgŽ°-ÃgŽT$–£ +Qgñ5ü°xeV– »ÏæP]<g¿¡à Â;e®ü®²Iç …&¡ý_½£#°ˆ“ˆ˜¸ F¹i½ŒÄfŠBƒJ‹ç±¸ mã’8‹FGz0ÏܤõEpÀyL8Ã<§ˆRuKpÐýBa“SlùíKÓr1‹çzv¡Žü ZŽÍl04Ë=»%i6,Š3qÀ•‡q Ò)%—¶â¼ '0oÂßó8μ«?µìfÜWÀ™}-ir%i.·y Œ©£‚”nGEyÒ W‚Æ¡ÄD$N0 ¸C€^²ŸÊˆ0#8 )öDùVˆEÛO63¸Î + +;•kp§Ë6åÐÌÂÐ,÷Ú–¤Y@,Š3€påQbg¨åýÑ·Û|ÂWùuu#N§V†ä€ª8×½»j‡ãÏL4‘Àì̧!a\]Œ)êâ|œÝâKÎaqä&róqfo~"8üHl»ò@mÞÀ{´›l¹'|Ý/žh7;Y.¾oÊBºÐ¦³¬n%âÞrߧÂn³’Ü-b5_Ê¡áDLvENŒZÛ]ÛMg_ß4Ý,i n,ë¦Üh2n!Õ@ŽEÍ‘kŠÌö ‘õ &˜k’¯‰¯å°ÂØó°U>})"¥$Â!}K€_[Fãk7;@)GSö,×MœqÜ”©tp;;Ês n#qŸ7ôžšúÌt´›4”tÎ~uÂ!7–!ðìÀ3JŸ"âŽm·¡BÏ|¹@.¦v¾g¤öëI-ìÂdl©¶­°ÛCÛº”owÖµ«PÁòk84ó®Mh–›KÒ׶$κ6Gþ1Ld2ïÞÆ2ž%3ŠLÏ&¸çK!6ÝŒ)KNG­V-SÐÍ»¼ è.LÎâp¸*šJZž,dO\eçÇ‘äÇ(àÔÖ<’쩵­Ý©œñE7õ™·p’+bRKžVÙXk2d§°æѵêRÏM¡MÒ%IœùRÐ~-sTÞUUå|sþ÷ÈØñŽ§>ÅëÐÏU¶J•ÅßVV›×uk•‘7U +…Ó·ÝÊו0qò[¦ÿ}CË“hÿôkúMÈöªx&µÜ$Þ'ËW$X%ÍÔF +iZT=ñïø“%RWí”\n (mä?€ +!Ç'ädr‘ŽÏA<4ÁðaÀ<|á¾YÍO¸'8¨ƒ9þHÈåÓ¨í÷¥…H`dúG@3ä"TÒ”ë 8y"–x£7£€ŽÊs¿¾ÝÈ.ûÍlYøádÿXaßô÷xC#WS]> Õl)I#Ù ¥éõvcùq¦o÷û?ºrx€endstream endobj -1446 0 obj << +1449 0 obj << /Type /Page -/Contents 1447 0 R -/Resources 1445 0 R +/Contents 1450 0 R +/Resources 1448 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1393 0 R ->> endobj -1448 0 obj << -/D [1446 0 R /XYZ 85.039 781.388 null] ->> endobj -174 0 obj << -/D [1446 0 R /XYZ 85.039 761.463 null] ->> endobj -1449 0 obj << -/D [1446 0 R /XYZ 85.039 739.701 null] ->> endobj -1450 0 obj << -/D [1446 0 R /XYZ 85.039 709.614 null] +/Parent 1432 0 R >> endobj 1451 0 obj << -/D [1446 0 R /XYZ 85.039 693.943 null] +/D [1449 0 R /XYZ 85.039 781.388 null] >> endobj 1452 0 obj << -/D [1446 0 R /XYZ 85.039 682.515 null] +/D [1449 0 R /XYZ 85.039 761.463 null] >> endobj 1453 0 obj << -/D [1446 0 R /XYZ 85.039 666.845 null] +/D [1449 0 R /XYZ 85.039 734.228 null] >> endobj 1454 0 obj << -/D [1446 0 R /XYZ 85.039 652.69 null] +/D [1449 0 R /XYZ 85.039 650.55 null] >> endobj 1455 0 obj << -/D [1446 0 R /XYZ 85.039 639.747 null] +/D [1449 0 R /XYZ 85.039 612.023 null] >> endobj 1456 0 obj << -/D [1446 0 R /XYZ 85.039 626.197 null] +/D [1449 0 R /XYZ 85.039 542.156 null] >> endobj 1457 0 obj << -/D [1446 0 R /XYZ 85.039 612.042 null] +/D [1449 0 R /XYZ 85.039 515.058 null] >> endobj 1458 0 obj << -/D [1446 0 R /XYZ 85.039 599.099 null] +/D [1449 0 R /XYZ 85.039 474.41 null] >> endobj 1459 0 obj << -/D [1446 0 R /XYZ 85.039 585.55 null] +/D [1449 0 R /XYZ 85.039 419.607 null] >> endobj -1445 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R >> -/ProcSet [ /PDF /Text ] +170 0 obj << +/D [1449 0 R /XYZ 85.039 322.785 null] +>> endobj +1460 0 obj << +/D [1449 0 R /XYZ 85.039 288.243 null] +>> endobj +1461 0 obj << +/D [1449 0 R /XYZ 85.039 258.417 null] >> endobj 1462 0 obj << -/Length 2569 +/D [1449 0 R /XYZ 85.039 217.77 null] +>> endobj +1463 0 obj << +/D [1449 0 R /XYZ 85.039 139.202 null] +>> endobj +1448 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F20 937 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1466 0 obj << +/Length 1907 /Filter /FlateDecode >> stream -xÚ•ËŽÛÈñî¯ÃPÀªCvóé`k#›làÃ;€ë8GC˜"µ$å±ýõ©W7IØãÀÀ°Õ]¬ª®wmBømòD…¦Ødy¤Lžoö§7áæ'ÿz Dœ•Ä1¬oîìé.Õ*Œ³›0Bc—E…2q„0ïîßüýWnt¨ÒÔlî7Q¤•‰ô&-b›xsø3H·»$ ƒû§j»3i §mq÷·;tƒuÕ%9¤ýŠî& ò©›UíùÈYõy©YýͨýQíÇš%h‚§ª<؀мp߈oëÒ8]bÄág7 †´¥Y™]0Ôõ•EÁµÜoò3ZU5N!êîOÔš_+1¤Í¼¢• È£B9Å«Zñ‘³ZñR³Z™QûïM1¿$ÿªFN9 ˆx²bYqì|+vúÀ7Ž¤¬)VÁ©¨%&µHº€Ý8e6Þ! PmX0’íâ,!mÜãžM3€úP=–¨Êf´Œ¶Õ­Ìv•è”`wQªLÓ319½Á…”NmÊªgüÓñ[,ˆñö õ‡@U³o.Cý… ‹"6ÀºÌí}`=¥MÄŒ2„ÌùÝIë¸Äû=¢{b8TαízÒ!¬NJnÆJ'Y$³‹a†¦d?©øânÃÕ -Ÿf¦ñ3U:6‰v¬}Ù:g•J”~Íyâ -Ä(÷;Ï hÝy,7³{ɉóø©‰óÌ©IœúÃ^|àÚÉ£†Ud¡Ê^+mf@7'{ÉYx©Y̨‰~G»Æ¢Žä0ÚÐÞÊƺ’LéWòÚãÃx³š–½¾”½ýDÊù/Û|¹¹°¬E®1À³’ÄÕÞ¸¦Þ®â£]ô)ÎUœÚ(5âɹœšÄÁØY<N*»§`MWfÑ·0ÞÊö™8"3V{Î…»8Êoeþeà‘ ŒF`cF{XÊæ*ñ»ÌŒÄë/õáFHé±t¥pew(š'+ûy{bkBô@]l2ØÊïؾ…‹A^¹ûùn{£„–Æ2 •½ÒÁÏ`\+©£ðÔ|š"S…¶0&%i‡ÿ”WÞ@ïÞIÿñ‰ªÔŠKýÛ,š"QI‘xYœÁ¬÷Ç&ˤ1âñ#ÚP=²­žQë{±Ú8O¨Æç¡Âœ9Ï+ƒ’NQÙhÆ ¹’ï²wáÏÚµ~×jq“0 ׬¡S¢§s´*ÏépD¤¨ñ‡Š¯ó²€Ø_'?7ï3c7à0é+K~ä-É}°62E€M'šç©é‡í…4ˆ¿yy”H9ŠÌªâ™ª´U¦À2¹™@Ì•™¨ OÎm=ËT¹ìmõŒ´¦”‡4àà›5—…&Æ}Ä*aÃ$½Ö©Òi´b-eõäÎÒÃE4XPÖS]7eØŒ™f-Ãjup*Í_É®3 õäb¼†—œ¤?5É/sj‹¢®ûµ¶V< Y¤ZœY‘ü€ ?ˆžm-]‚]fHÇ+Q?°Ý»–k6Š­”ÿ‡NÀb_AL00Œ·ÜñѲúð‘²ê˜H¹V'šS.Îì¹’ü¹T/Ë@Ø1Á©äˆBÇ{7ç¬ÔoÑ–‹Š-*Ïž%ü3žë€G™9 ~i&èûe„£&;W&n¨åZìgÏóDÖ3ÞaÊÌšÊ ²±?H^ͼ?Xd ÂG '€~Õ`ta^|Ì€ÖMÆyKD/91?5±š9µßD¡=;*\?ÌE=âwa±PC˜‘ê|]cÑ®+,ù'iž\žG „¿úêöê“P厰ÄxÂ~Þ̓óþÔΰ¯k‰<=rU—G7&1 ô­`®ew^KfQš«Lg?˜Ìz›Ì~³mšeª˜·Êó²¯NòÇâ9¬^š¨"~e¶3òžyg;^rÖð¼Ô¬áͨ}¨ÊÃ<`—³”:öeÝ,fh/gÉs÷wEŠÏZ×Ze¾Œzפg}Ñn½ÖÖqf诵g0뵶6©Ê̼ÖÖ?Pkpåüx/õ¢”Ží…Þ´eä -ÿ µŠ3/ÿÌz!®¡_ŒLÊíˆÏ,–šË`ÃMT3Ûfeñ­ø‘%¶Ôø—KHø‚èá ãT´ -ùÛ´ªû¾,DÀÓ¸úì>“%׃Ý,±ã¯悹$N" º±]+î=”äÉŸ[¦ò׺'†\äÞZ 1I¡ -W.ß -1²bÉï²"™FÑÈûBS€=Pp¿”TÌRO PG€5}8ëzê]`ÿ±1*ó‡!ü%ÎÁýs5}ºl ÷öÓ‡”ÎE0.Æt“mn´ß¿‰EsÌë†E8ò7W”WKÝôŽºWg̾*IãÐÞÙ°öÓÀ°>Sy¢€¥|‘^Xjšnú»˜<à ê–Î?:ip§cnKñYâ#f+Â9¿ô+ ‚'H:ÕÁ4nÖÍLàõ¶ ]þ~‹{ϵ4³øù þàÙÉQ¾$[±á ”zûrìÚr¤ 3=y}驾’þèeµ65ŽôùâG¿Á~Ç‹¿nsã>;U_ËÓ¹©Þ²'@Œ™yB¦¢«ñP…9%§é„NHyˆ«Ÿùa'K=ÿüÂÕ .‡±§àŠëOÊ^:?ËÏY¸ik[Õ¨Žºƒ.33 ö>â‡ûîÒ¦¾%›>d—²]®ý·À¤ÝÛúøÄB¾ŒÙ&L•IRAFíI|M/1´r³NðÓøüendstream +xÚ­YKÛ6¾ûW9É@ÍŠ¢¨G/‹Mš¶lm³mI´-¯UÈÖV’ãl~}çA½Öƒ´EX9Ão†ßŒ9÷áœ'Zø*lj*IæëýÌŸ?ÀÌ3i5–Ve9Ðyy?ûöÏ¥/R?ßoû}´µšßoÞy¯~ºþåþõo‹¥RÊÓb±ŒãÄ{»ÞõÏ/¯Qz7w÷¯A:Ò»»¾}»øpÿföú¾³Ýí +vR4ü÷ìݾ'ßÌ|¡Òd~‚g_H˜ÞÏÀ²Ð¡²ãbövök·Ï…s^uéœZ%B'êü R_8¨ö…öC:èý.ƒãèЫñÙÿ-p® ‹áÑTfŸáD“U,Ý›E{O8PÞj± ÏnSeÆ®45þjïÂöÇBJïö½¯ýªÝó›†ò «ýÈ»ix]n×ʈW°(·*å{_*vØJN8Ø¡Ê=Û±gùaC"Óû5†ðZJ„3¥óŸv¶ÒÐk |X™šžÀ… ®¯²šW“¬Ü¶ê0eõª¬9V0æüÛXçÔvwé}\p,`¸†J®¨_·•Çbs cLa„ä>òŽ¾ ®â‰uYUÙºáÁ#-)ómØ:$.êö“Þ×WíÖ i“M´^±ðÓt©cŠÀó†«#aZñh]²&?ðæ* :|ðÙàN•A¥'^‚a$3­× úUÚ!õm Q±n*ÔX÷ºœ€r$cï®l¬ã e.68‘+xf ×òB ²ªÆ io)Ð!Õ°°CfófFÝ´î†*¼ˆ9*Ûp"… cŒâ-Z8¬›s +רá§çD¦T ´ŒæQˆX'_¦2%‚ø2‘-Û½–ƒÍÎyJ)-â$í,"4ö^#sœ9¨#Çñÿã Ýë F¾ðõÈ¿GÌÎ +ù IñÍ^~\yÆqk+1‡ aí/Æc[Vü@Éœ36𸔣Ìy¤”´ö…ëƱݰB;qtåQŠ‡9íQdTíQ¡½G(èÈ­7vSd04å(! ,ÙµkêrÏôNnxº)yvÃ|„§TÎ/Á™Ÿž`½ŠTO ðlÈ@I7€é‹ÄÄ Q@&øîƒð9I%F „²&Ü1è«â‰g¨¨°¹òvÒ3;«p6Î×`–à §gtÉqÀUØ2 g:âÃÎ’r[Ž]ËÔä6Å„,f,¥: ©gŠ‚à맮¸ §†÷ƒÈÝY t¦á´:x¼hN‡µN—¹νbT¡¶ŒðìSL‡eè!>åaÙCõìíßnGÍÑŠA ÒÈ]ç:Ó(Z> endobj -1463 0 obj << -/D [1461 0 R /XYZ 85.039 781.388 null] ->> endobj -178 0 obj << -/D [1461 0 R /XYZ 85.039 761.463 null] ->> endobj -1009 0 obj << -/D [1461 0 R /XYZ 85.039 671.062 null] ->> endobj -182 0 obj << -/D [1461 0 R /XYZ 85.039 671.062 null] ->> endobj -1464 0 obj << -/D [1461 0 R /XYZ 85.039 639.536 null] ->> endobj -1465 0 obj << -/D [1461 0 R /XYZ 85.039 609.512 null] ->> endobj -1466 0 obj << -/D [1461 0 R /XYZ 85.039 596.568 null] +/Parent 1432 0 R >> endobj 1467 0 obj << -/D [1461 0 R /XYZ 85.039 568.864 null] +/D [1465 0 R /XYZ 85.039 781.388 null] +>> endobj +174 0 obj << +/D [1465 0 R /XYZ 85.039 596.451 null] >> endobj 1468 0 obj << -/D [1461 0 R /XYZ 85.039 555.315 null] +/D [1465 0 R /XYZ 85.039 556.288 null] >> endobj 1469 0 obj << -/D [1461 0 R /XYZ 85.039 495.746 null] +/D [1465 0 R /XYZ 85.039 512.651 null] >> endobj 1470 0 obj << -/D [1461 0 R /XYZ 85.039 484.318 null] +/D [1465 0 R /XYZ 85.039 483.432 null] >> endobj 1471 0 obj << -/D [1461 0 R /XYZ 85.039 470.769 null] ->> endobj -186 0 obj << -/D [1461 0 R /XYZ 85.039 409.747 null] +/D [1465 0 R /XYZ 85.039 458.455 null] >> endobj 1472 0 obj << -/D [1461 0 R /XYZ 85.039 388.55 null] +/D [1465 0 R /XYZ 85.039 429.235 null] >> endobj 1473 0 obj << -/D [1461 0 R /XYZ 85.039 347.238 null] +/D [1465 0 R /XYZ 85.039 401.531 null] >> endobj 1474 0 obj << -/D [1461 0 R /XYZ 85.039 331.568 null] +/D [1465 0 R /XYZ 85.039 375.038 null] >> endobj 1475 0 obj << -/D [1461 0 R /XYZ 85.039 304.469 null] +/D [1465 0 R /XYZ 85.039 347.94 null] >> endobj 1476 0 obj << -/D [1461 0 R /XYZ 85.039 276.765 null] ->> endobj -190 0 obj << -/D [1461 0 R /XYZ 85.039 248.557 null] +/D [1465 0 R /XYZ 85.039 320.235 null] >> endobj 1477 0 obj << -/D [1461 0 R /XYZ 85.039 227.36 null] +/D [1465 0 R /XYZ 85.039 293.743 null] >> endobj -1460 0 obj << -/Font << /F20 937 0 R /F15 951 0 R /F14 969 0 R /F36 955 0 R >> +1478 0 obj << +/D [1465 0 R /XYZ 85.039 266.645 null] +>> endobj +1464 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1480 0 obj << -/Length 1463 +1481 0 obj << +/Length 2017 /Filter /FlateDecode >> stream -xÚµXYSÜF~ß_±oH”w¬™Ñ逫bÄv9vïK -ó X±¨Ð±‘´’ÊO£kÑb*vÊ…5ÓÓÓwÓ çü“óÐŽŽæA(…Ãùe>sæk8ùe& Ç°,<¯–³ç§>œ:"r¢ùòª—ã ×ÓóåêÌzýæçß–'¿Û ­µå {¡µ|s„϶´~}%^üpÊ„Ó·ïOìóå»ÙɲÓÝI=*þsvvîÌW`ä»™#tÎoaí Çù 4 ÏÕfŸÍ>Ï>u¢øÌó­)?= -/ÔÕþÀQ©=¡”œÚ‘瑧›¸Šs{á)Ï*â<áÕ1è,i’Š·_ãlkê¦J‹µ½P>lnÓæšÉYZ†Ë²hÒb7iY ÍóSé LYH5_¨HDðE3>” ÜtÀYÒŠ›Á¤Uñ‰qe_é~µUØÔ›ø’˜kÞ_Á2ËJd¹%{]Ç™†ýéeµbòúŠõÁ3 (ת’M•Ô(/)‚óõØ2\—à5¸N± ‰ùŠÈ1c“«¤uñ[2ÇV•±ž:ÖMvK«AWÁÚ¦ÇŪeà0º£ŒúB!ê*Š‰H›s™©ÑÙ9Ö5冉¹I¦a \em`ŸmkÃ7¸sUnmL ÝÛTí5NB²êâµs­ <Í „ -ƒQÔ¨¦$Ú‹ý…öâ—R‡ ÎÊ%þ_¢’“¦ 4Ý…ñœ?ìÐebýŒùÞâžãÞ…jÝŽ3ó”ž7¯ç!óÆ­Ýšçh¡o¤˜‘¶ãp=BB #‡’Âz‡Á¦ìS·íÃÉø „ ÇØý}O®¿HíR­y"Pc$莜ùG¼9Kz¤oåé -Û$£­×£ž¥5‘V6‡ÌnÕXϸŽ GÌ۾Ƞ0oëVCì¬É£W­ª ±‡8ZÅ ­ãÆÁ¾W‡ÃÃ(ÖWAü y#=ˆCÏb<„õ¬1à[O”ó+À þãÑ:N–È>§èHMv|×Æ{Ðí°! ”pŒóܼÆ}{0f'¾Pþ¿Za\ï?µ3‹æ›]ÓG3]|Z[pÄt;°˜øp¦0a1‘ˆ0Wîú¼3l~Û³‘YìÜGœ|¢€š5 -­š›‘é×I¼B»ð0£W*™ÁÓQ?ÀÀ E$+ënÀÚ–WLïùÍsÑq98ÇY†&¢Q«£œ²¨SÐGPÒ[ÕÏy‡Õq;›ìkù=“ijGµyØì¦Úq -ØåèàkØHhÎ#ÉÊ YËv,ÃÖ­Ÿöhœ™„·/¿ô‚a¥œógWñ:ùf½›j“k#„–ÇÃ{¬ò¹fÍ0ƒÓ -…LaVp"{JÿŸuþ´…þ¸Å“ýÑÙ;14àïp‘/<ÝLã -íúáAÊP8*43âqæó}ÑÄwûTKøõQ?þ‹ö€gÿ¼iáþ^ßä…¸ß1©+H ul9–ùPDÿ4>|8³‡å4»ê ½@“Ÿ “ß0£GWi–¼´aNtëÅñ±©¬¿9SG&ß/yûN>žN@ø€—^¼^ØѨj‚ŒÄVÏdb£u:§³¥¡¢©\Áõ]“è2îjêh:áž - Ó®±ƒ ¼]sÛ?]<°÷_6ÏZ©endstream +xÚYIÛ6¾Ï¯0ÐCd VDQk‹š¢+rP=$=hlyF¨,¹²¦“ä×÷m\챘 @L‘|ßÛ9j•À?µªò8Ñõª¬T¬«jµ;Þ%«XùõN E–ë8Ï2ßXܘÕM‘ÆIVÞ¤›RÕ±ÎÒ¼ÙÞ½þ%MVi…^mF¢JâªÊWÛýû¨Xoò<‰¶íz£‹2:×*º_oTÃ`7žÿ¨¬o×oÿ¸ûykÙ^xC°dµIÓ8KÒ ÔE^ÅY¥}©U÷(|©Ó2NÅRÇŠå~ B¶»]Ó£˜EôãÐôŸÎÌž—dM³8U_ÇÑ8*_©$®“Ú'¯ê˜…yÓœ/¢ÿ´®²èÛõ&˪hFL³47ØÁ¸ˆX4ž&ëMZE;< ¥cÎížwÿ6LÝãÎAN¹_§uôI`¾s *q˜êqS¦¤áIˆšI;ŒO@5ñǼNK8SE'©)Ç/ ™›YÄ›È*PÑ +Í´&L¦–®4> (Ýç?à^Zk”½BÙq³wxa/·3etÂyé:^ùAìž3ñ,/N=Sdrq)ct®E¨?’6 +{6šM1¦àŒ´°õr̾=4¨¾Þó}ÉDÄBR_Œ:£¬§ñ&­ãRqLæZ©.(¯O&Í΋ӠvK=yšÕ`ƒ_ÔÑ,ö¹©*éñ%ý Áíf¿aÈ +×ÓÂpßbR´5¶²EN)ýö=.2÷ls—rÕ<ÃÅF›86ª&ζA+¥üMD*§%ðâ.Ÿ[Ù&Ui_¤Ð?ᶠ+åüß~ävý„)¿¨({Ñ`æG”:²÷v¹¦oÞšvRµˆœ^ÿ’¥~@)r0œø#ãáðÀ4—A§ X#$¦âdŽÛ[ɧ»3ÿÊ•¨a¡¤:ã|m«³sÍ%÷æðƒÜÜ¡ ´r²Å¤‡ß¨ +‚dzáödÞ×Ï®r_rFU$ÐÚ-Ü‘,&! V65„x™Ìà1cÝàMÍ=?rɶ1¡‰ŸA`îÓÅ3ˆWAI˜„ð>{©õRŠnìMgskb£©¿¹òÞ ­é×(CkèÓTXŽfYB®VBÜœBBì¬F<~®¿Ì3ÊP48QZsþ +SX¸ ö­ŽI0ÉwöáEéä¥Áä¤Áä ~vz‚/r.ÊÁ] ¯æIýˆú·^¼× Ò+–ͼʅ*¶sVÃAöxrM«ÐJÆË 6þ¥YÝ +kKVR§q]… :G²h#B.第…„xñ˜ýÎÚl³Š´Ò8²š_È›à³$ø€êÚˆ`Å;LA±~¹r3Ö0ó$·†Ó}ƒªîŽÂùâù‰^œM1X™öÒĆI1»fÚÜzºÅ›QîÔÎOh ƒßrsÏ¿“BQÌ s½OÝHcøG‰D}›LûVl°—€h‾CH¯ºË©=Ž("ãµ_|ÌÕêp[éH–Ÿ2™$üî`å2¼ì;¦cö¶mö~°æ‡ñÚ©éú‹‡­Aã€hÍ:?âfìÌ{­?àû–)´¯Êø+Ö~ñ¾œ't§ï‚Ë¡| Šä ôÉa”*êk~¹®â¼ÒË ÿ8”Rœendstream endobj -1479 0 obj << +1480 0 obj << /Type /Page -/Contents 1480 0 R -/Resources 1478 0 R +/Contents 1481 0 R +/Resources 1479 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1484 0 R +/Parent 1432 0 R >> endobj -1481 0 obj << -/D [1479 0 R /XYZ 85.039 781.388 null] +1482 0 obj << +/D [1480 0 R /XYZ 85.039 781.388 null] >> endobj -194 0 obj << -/D [1479 0 R /XYZ 85.039 635.626 null] +178 0 obj << +/D [1480 0 R /XYZ 85.039 761.463 null] >> endobj -1482 0 obj << -/D [1479 0 R /XYZ 85.039 615.492 null] +985 0 obj << +/D [1480 0 R /XYZ 85.039 658.483 null] >> endobj -198 0 obj << -/D [1479 0 R /XYZ 85.039 135.961 null] +182 0 obj << +/D [1480 0 R /XYZ 85.039 658.483 null] >> endobj 1483 0 obj << -/D [1479 0 R /XYZ 85.039 104.435 null] +/D [1480 0 R /XYZ 85.039 613.409 null] >> endobj -1478 0 obj << -/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F14 969 0 R /F20 937 0 R >> -/ProcSet [ /PDF /Text ] +1484 0 obj << +/D [1480 0 R /XYZ 85.039 570.207 null] +>> endobj +1485 0 obj << +/D [1480 0 R /XYZ 85.039 543.714 null] +>> endobj +1486 0 obj << +/D [1480 0 R /XYZ 85.039 516.01 null] >> endobj 1487 0 obj << -/Length 1351 +/D [1480 0 R /XYZ 85.039 488.911 null] +>> endobj +1488 0 obj << +/D [1480 0 R /XYZ 85.039 416.537 null] +>> endobj +1489 0 obj << +/D [1480 0 R /XYZ 85.039 391.56 null] +>> endobj +1490 0 obj << +/D [1480 0 R /XYZ 85.039 364.462 null] +>> endobj +186 0 obj << +/D [1480 0 R /XYZ 85.039 277.063 null] +>> endobj +1491 0 obj << +/D [1480 0 R /XYZ 85.039 242.317 null] +>> endobj +1492 0 obj << +/D [1480 0 R /XYZ 85.039 187.828 null] +>> endobj +1493 0 obj << +/D [1480 0 R /XYZ 85.039 158.609 null] +>> endobj +1494 0 obj << +/D [1480 0 R /XYZ 85.039 117.961 null] +>> endobj +1495 0 obj << +/D [1480 0 R /XYZ 85.039 76.707 null] +>> endobj +1479 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F42 967 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1498 0 obj << +/Length 1536 /Filter /FlateDecode >> stream -xÚ¥WßsÛ6 ~÷_¡·È½™IýÜ-»szÎÚ^’n«×—4Œ¤ÄºÈR+ÉKÓ¿~AÊJ,+»^#’ßGæŽÿ¸Ì“‰ÅœÉ8vÒíÌsîAòÇŒ…QY tÎÖ³·ç!H=–x‰³¾ÛÛ ˜Hg]»ïÞ/ÿ\¯þž/¤”nÈæ‹(ŠÝõû-|žs÷òŒ½ûtuN ç.Vó›õÇÙjÝûî­‚ŸŸ]ßxNA~œyL&±ócqogà™¾4óröyöWoŠd¾C»ÆÎȘ±<<¨ åB²(Œœ(ðXàùú¤¿µyÚu5_"p7¹Êòæ÷ù‚{çþzzjF'×'¤pµ¼\Ñèäæ þÃKÈÜ7Õ¨mÞå i•E•šX95†¿,/þ1kWhøí9±/ d?tÒc^i_gª{n‘ª²|šÇ¾û ¡Ñm -¨Å‰ïnQ%WUkeª{‰ç‚I.œ0ËÑüZ•Å^G§÷Yˆ\,„†ÈÙ3é3.'}‘Æ´+™ÞÁЕ‚F‘ûÕã>œ¾Ìq»60Ü´¤³û†ßЭïhþ3ojÕ }·uctÛ¨)Òb~ãØUÍH<°˜o ©NïÉÈÉí\ÄîiÃN½¶útNƒ¯À†Ç¹ˆÜ|È¥@èmiK{ì`ÃHN-€¡dBòWÜ+M@h”0qÃ)wÄIoÅ·%œ5 ‡i§›è0²@¢24@†ænÖœOñoÛz›P•ÙQC’;˜×eY#Vø§G¬ö‚âOmZÓý6¤¡/L´Q ^$]>| _Š²èñm#*CHãkwr¯4¨QB×ò(¢Sî,¢“Þ,¢o€¨/½g  ˜Š/ùPpGÑ’jgy…(t…¹ßÔ³øàXUô­c…›«{£Ø¨uz„;»Ë˜¢;¬º Ý&A3-kzŒ;¼¯#î ’ú¾ï®79©èUäÎ Øèy'…©¨Vô©¡, ©1¹yä;kï0ÉÇ©å%P ýW¨µWš –QÂ<øG©5åÎRkÒ›¥ÖÀPKD¾kk®á.•ˆ'&.fÅ¿˜¹,Ïh^P6kš)ú\¡•å%(®Ìz•=Sø2ç4°\s—‘‡µa1Žß 2MÛ½!uÕwïTI+=Qî«&éÇŠGSï -œÀxàž£-Iz}C0¯ZSo_È_Ækë¡6QXë&¹œÞ:[粑ôÏ%ðQѧʱ¢IŠõnC$1›%”`5„æGOésbZ!È?aÒƒVQ»«Fš%ld+?G£eÓt¨TŸÄ÷'ûçŽf¦)g Vê»þF`‘ G/dP6¹Ë¡£ƒ~o‰Ç¼…Áôël‰˜ÃˆÛ" é±àlz“éàö:#×Æ'ã‚"´…gÊÔó‡ –u9剡 ,¤ueÞ]£³Ò°Rð¾8ÃPÑÖÛ¢£ÁNß±uƒ¼h¤0nžP£ÞÑD5Æçnÿb(5}K½ø;1!h§J5‹ÌÒ-ÞpíªFŽêUxg»”vXgu·Ayf`MU©ò©ÕÌ‘&e›ªÊTd’UËhð ÏÔ´¥/´G@®Aî.šm¡»ÂD_ð@û‘ ¼¦èR!àBBc¯Ê]nÂAã#ÍD½¯žÝýÔ)ªø á–î˜x°¿j’"°ŸÈ°}Ä8-áWˆ%%ü§¨þ×¾žÚ¾d±<Âì@D,Œ|‹îT×áÚß…ñþºŸvsendstream +xÚ½X[oÛ6~÷¯ð[¤ bE‘ÔeÀÖ"Y[¤Ýº†¶Š-_Yò$¹Nöëw.¤$'NPtÁÐ&ÏùÎU•ÓþÈijD¨²i’J¡Òt:ßNÂé +N~HËX–`Äój6yyi’© EfÓÙrc„6j:[|ö^¿ùå÷ÙÅ~ ”òbáI’z³7LøäKïý+ñú·—L¸|{uá½›\Ìú·{©ðN†ÿ=ùü5œ.@Éw“P¨,` + ÇÛ ¼,ŒVv_N>M>ö¢øLOùÖ);G 3‘Eæi,b)t¬z,"8•"3fŒ… … 5a )ÀàÈŒ ½7~ ½¼Z”@ÚT+°?N¼zÉ¿WD,xó6u…ìÝ–ÕžnÒÈ ¥S!“ìiýÒ_š¾”±P1©U“–™òZT ˜÷¡r*ÓÞÖ)·p«†o€¼ØÁAÞä[:슆/2EË»-‰ð£Ô»ãK×~›‚O‹Û®¨zùVl>çÇ@R®—÷ö%)¹+­€’@äÇ ÈŽ2~G{{_ZÛxOÞéݺ@˜½@bxd„Ç5< +âoÚ2§Kka"®ÁÆ9›¤/¡ ÏPÂËK0–!H“1ÈEyÕr™íÈ*I”X®3ah­½«MÅ8(¥½9x^î6ôƒ¦@ˆg@ƒMkWUÝŒ±ÚQ³š^—9Š¼á{ mªÉ'Û‚Ÿ`b‰ À‹’.ˆBj¡¦o—¬X×VI U7àRÕø`€ÔÆϦ#ÝÚ]>/ÐTkœ%^ˆ+Kˆ:àÛ­7Ö术¶Ä6°Xù‚=£{»ùL»;'¢ÔÌç gÏ~ì¤âM0C8 ñ!½à8Èý®ÏxWGq‘•;»íø°tnÆÓæ,™ŒY‘82BYÖ«ÍhQTß±!Oò}ëêF¦ÜåšÖ‡±Ë=ÇXDiÊ)Ž$ªßüÚ¨>åëÌÕ¶>S[ø é§ú‡žŸqXÐÉ áCïÑ,N*Œ'hêß{þ£/.ÈÛíÑ ÊÕÄ}¾aõûŸ#ÿTmEtò;þq"ü§ÿ²è Ø“ªG>Ö ´µ8ÑV4Y…÷Õ5*…®«êû/lah`endstream endobj -1486 0 obj << +1497 0 obj << /Type /Page -/Contents 1487 0 R -/Resources 1485 0 R +/Contents 1498 0 R +/Resources 1496 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1484 0 R +/Parent 1432 0 R >> endobj -1488 0 obj << -/D [1486 0 R /XYZ 85.039 781.388 null] +1499 0 obj << +/D [1497 0 R /XYZ 85.039 781.388 null] >> endobj -1489 0 obj << -/D [1486 0 R /XYZ 85.039 701.758 null] +190 0 obj << +/D [1497 0 R /XYZ 85.039 761.463 null] >> endobj -1490 0 obj << -/D [1486 0 R /XYZ 85.039 674.053 null] +1500 0 obj << +/D [1497 0 R /XYZ 85.039 741.134 null] >> endobj -1491 0 obj << -/D [1486 0 R /XYZ 85.039 649.682 null] +194 0 obj << +/D [1497 0 R /XYZ 85.039 375.387 null] >> endobj -1492 0 obj << -/D [1486 0 R /XYZ 85.039 620.462 null] +1501 0 obj << +/D [1497 0 R /XYZ 85.039 341.704 null] +>> endobj +1496 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F42 967 0 R /F36 955 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1504 0 obj << +/Length 1429 +/Filter /FlateDecode +>> +stream +xÚ¥XÝoÛ6÷_¡7ËÅÌ’¢(É]\ )œµEšl‹×—$Š-ÇB-9•ÕfÙ°ÿ}wŠùJ:óåûîýé¯óÙ”Ò Øh†‘;?£ë‘p?±wW—ç´qþáb6º›Ìæ•ìŠ+È™ à¯ƒ›;î,AÉÎä$rž`Ι€ãl’™ò¥Yo׃ß*Vtæ;t«ÍN%#¦"yl¨ † +î1ÏN¨8SÜ×–þ<+O¹‹m–%yI‹[!}4ÇQ,ôBg,PüD“?¥åšˆâ½‹ é_Ÿ Õ7ö<=û’2Ô÷çëtG>»½ÈM£±p·Y²Ãñ qÙSš›û¾ÿqF’ó8Kh6¥AŸ%eRÐò{¼ùfve‘æ 0€Å¡Åzó¿Øµ¯ÑUöïI!]mYU¦€“mNûk˜'¸/í¬ “ ¬Ó<ù W¡[B)|w±Ùî´ÞHvûE¼y¡ûe„ž+iÿ–+>¼ƒÃ!ÌíiÃHÎÍáP«…ú,“B _îi NËÒ<Ö[Zjn]”Fcá=ãÜp(×‰Æ +'œ(픂âYR¨·++Û¤ïnÒ¼^XL¤ù¶°îA?Aæù¾Ô´\D£Žá"B&"o/B7É¢L1B…MôÜÑð÷ñCòà 0àvÃDO§Mн,â"!³ ½Š_jVe͆»~•[“¦R¸¥vùÜgª·®VºØxpæ3éª*Cɸˆ´ó@(8ëú9/ã?;¤ÊC•šôÊmÐhÉ{¾¶|¤bBزcг{Î1yPú>4SM†ÈÇ|cuº[.üÍ!p}Œ™W˜ñ›Íeß‘ñ8BôG§¦éŽ¡AÊî(õH«#Õ'®ŠVCÞ)6–a«·qßzç==.zœRÌÁº Ò‡àù zç±a²}¤:·m›&Äê Oô‚/UÌšyf˜G–¹mÒðNÕ€¶3f-U¼zi“oW½&„J7p0ßPµ±°‡ö&¶¬“.°wáOù½p©I:ÑbHп,=¢*¬ôɲPiC¤Dª%]p×|ÐBÆ%ºã{ºlBž°”º%¢˜6é½Ä™®¶zBŸGBßNFû:txò +ãQØb]¾¢Ýä+•xC«ôêtMCv*àDA¥ö1>ÆØR«ºýâVcɥmFÛ¥=¯õ¦Ü«>öÏ5]‘Aõ “Ù!ûÔðFeãÚA¸¥Q‡H¶¦/¢¢Å<|‘  ÑžÒ0¤–Ä÷0€ÏußúúJ¾zhiZDÀdà[’¡N’î·LB;ÜÚ1Ã?)÷¿~€¨û}É"ÙÑv+/dAè]t͇êÚß)Žôý~R$åendstream +endobj +1503 0 obj << +/Type /Page +/Contents 1504 0 R +/Resources 1502 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1511 0 R +>> endobj +1505 0 obj << +/D [1503 0 R /XYZ 85.039 781.388 null] +>> endobj +198 0 obj << +/D [1503 0 R /XYZ 85.039 404.5 null] +>> endobj +1506 0 obj << +/D [1503 0 R /XYZ 85.039 359.426 null] +>> endobj +1507 0 obj << +/D [1503 0 R /XYZ 85.039 205.075 null] +>> endobj +1508 0 obj << +/D [1503 0 R /XYZ 85.039 177.371 null] +>> endobj +1509 0 obj << +/D [1503 0 R /XYZ 85.039 150.879 null] +>> endobj +1510 0 obj << +/D [1503 0 R /XYZ 85.039 112.352 null] +>> endobj +1502 0 obj << +/Font << /F57 1075 0 R /F36 955 0 R /F15 951 0 R /F20 937 0 R /F42 967 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1514 0 obj << +/Length 561 +/Filter /FlateDecode +>> +stream +xÚ¥SKsÚ0¾ûWè(ÍÔªdI¶t hšé;ž^’„1ÄSƒ)Æmù÷]=0LCré0Œöñi÷ÛOkŽü8ÒŠ2aP¡9Z£j0´‚Ì»„GD!éfR&ogª@œQà *—§:ŠJ%P¹¸Ç×7W_Êé7’ +!pNIZ—7Ó¸#œÐëÏŸf!0{ÿaJËÛdZŽ½ÇªÐǸÆ?“ûG†@ò6aT~ƒÍ(‡ô:ÎTIý6¹K¾Ž¥BN¢pëÒœGDÊ 5™z]‹œS™‹Q‹ ²œ¥ÎµPŒ*&½9Í( ÌIªÃW$åxc3Ü {8óo-wg×=àhõ’RS^˜×¹0žWÞ‰çTäžZùT“4Ó +o¡±ÝõÍfå|‰»e8÷Oˆ˜Ê1ï6x`\F 3Û:ØM€6¸ófŒaC2ƒ‡~°mÆê’iP!8vË }í:-"ƒ.œmýç X&Þ²žMCs åºG~1êËì+Ø> 7& s,ÕTÀdõRîžÞx=ìÂ|©,0<ÚSÌÇ*»q @'Á‹ +iàñl½õ"‚¿ +ýP>áZãz·„\·['t©¹›çp„¹wp‹ºMpÔÀ߉ӧêþ¼*Žlgu¬ô«±ÁðâØÖ¥ç TVà§a@Ñç“·P ÀíÚ^Þ@ÁhvqÿàJý×g:n±T‹–XeÍ ¹8ê"û—®š*-žóý f {endstream +endobj +1513 0 obj << +/Type /Page +/Contents 1514 0 R +/Resources 1512 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1511 0 R +>> endobj +1515 0 obj << +/D [1513 0 R /XYZ 85.039 781.388 null] >> endobj 202 0 obj << -/D [1486 0 R /XYZ 85.039 563.944 null] +/D [1513 0 R /XYZ 85.039 761.463 null] >> endobj -1493 0 obj << -/D [1486 0 R /XYZ 85.039 543.353 null] +1516 0 obj << +/D [1513 0 R /XYZ 85.039 741.134 null] >> endobj -1485 0 obj << -/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F14 969 0 R /F20 937 0 R >> +1512 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1496 0 obj << -/Length 3024 +1519 0 obj << +/Length 2495 /Filter /FlateDecode >> stream -xÚ…ZmÛ¸þž_a,Pœˆu¢Þ(mæ9ôšCwƒ|hûA¶äµY$y7ûï;o¤([ÚC€µ4’3Ãá3/ŠÚðOm²Ä¢ÝFgʲls8¿ 6O0ò÷wJ8â$ò“8†ç…Á­ݦ¡Äz‘GöØjµó£X!χÇw? -ƒMøim¥B?Rá&ÝÅ~Å›Çâßž¾ß&Iàý³¼ß*oüðùËÃý6JµWÝ+¯áÇœ¾6HûÁ/ßî#åµ÷Qàõ5P‹ûÿ>þúîã£Hä1;-ˆl¶aäG:|SŸT+?HCWƒ†éL0 -w¬¯X£Ï¨ÀØ£Z-ÈxÅå0âjÑ6kËRoÊ4ñL*Ù¨Àß»™Laæk­I¦ÇS5Üoã8¡½é1E«ÆqŒoÊ;¡HýÈ”Ä 3ïp9—Í=<Œ¸„àÊW#»ä¸,oÝ!!ö::„²íêÒU2!_NèRQäå}‰±‡*ó¹µß+Ôâ‰éhNd4ªÂRà0jæ0ÜO àÊ×¥2?Îß.¬ó£TÆÿúóÿ…å©ØµÊÞ˜°Ï÷*Ql•,ò|R|«ðš¦ñì?£3dx<07Ì‹qÅq×%ÚØòï©DÃâS‹¦é9ÿˆ­û¡•Yd_Y?“õwÞK_KOóÙ¹ã½lB iï‚GfŸÉ6`ÅØB®^‡¶iÊÃX=[3Äl†¨H’ÔÔÛPáð¬ÃW~d_!Ã×W¼œ%ÁWÎÞ9¬É!Óß”câY‡¬D%~–¤YèØ©½çôÜáᶣàS[3õ„烄5^¨4æ ‘xµ\ŠA–» ¥ñPKˆÖÐSÙxa£Ìû˜÷Î’V öŽ²ÿ‚$.tÉÓ0±˜ÊûåË¿>ÂS²¸A¬I&)ï÷|}€E oÑ žñOÉ“›–/;ËåÎ ÐâØ­:LÏÍo]£~aì}䥦Wò[ÐwFŠQx{ E¢>€'mVWÈø‚Ë`?\:¡`î( Ýñu$®ÙEB!²e4.²æýX.$bO“¡_p¶@ˆbÄúòzbaX“°LuÍ*FM‡qáøžïuUðBÍ“ °àë_øRœA &‡Æ†ïâ€`Jv´–9d_<÷Þ€ Vx2ŽMÌYðHÞÖ5òºì2?wù@T‚º¶f2uÕ¹Rïo¼‡‰"ÄÂñž¢¤+'[´–uº±«x®hÃ,jÑ…Xl´ÝØòoÁÁŽÌßSÀË`,´F$5—Æ[ô&øL8±à6g±+¶½¸(é‘Œ7`¾À«)oõ0 ÌÂ0–{´Ÿò&ŸÛaD_ÃH2 -ÇrÀûƒÕÈþU™ëå4ÙˆÆÅÙ|Œ¯É½@æj_™|gŽò œV—Ó,÷ά†„Ã¥w"õÍÙ20œ‹\(ŽBïÑìA»ï2ûKù >ؤÁ"¿Ô#’5[¤%g+„3¿žš×£xõtâH¿³÷’–šiuÇ´Õ˵²÷e¸€×çëHÉWvÑiw”¯F;Ég)ÁqrR"·N þƇ٘$ÍÈt}žÑ.âȲK “€ ÃÐ.q/>£”ôPæ­XÄÙþ„";§@ßx¿ òË©: @'Iìä®"ÚÆ `Šààʆ—§÷‡A÷RWc9¬^¯ÏèÆ1ºñ‰â5TÌ)1mÅÛÓyÇ‘9ï ÅŒÕdzŽCq¦8Z;*jè|YHq¢?‰× ¼uÎÔµ ct÷Ü]ù– ÆO8ÌÄñÒÑ\ƒÑëÄ˨8÷’êF €Tuä•0$¸LC6»Îd;!&'ò{à|âܬñ(úÁ`gƒÎ@©8™§Àq\Ë°NC£ dJo“—†/å8Ü&¤i µÉM÷`Ê°0V“éMÂŽìbëÀ»û²dFɸïøí:³C†IƉNè ºIÙ.çáus(1Ç´‰ªX\8 ¤ ¦' S%?;¨oä+ÉNÔY<ÏK’ ZPM"Uëþ‰I"©ì®z›(à0ù1Œ"xW@E6š5²ŒåqXBŠ[9§XÖÉ"‘2}HŎü2¡) ©”`%0?µæý©é{w4¶W•yŻنù:6mS‰7¥wúRdÓSdÞÛ\ˆÕ° ñ Nl¥¡§S,%Ë[â…J3¢ºgŒ QI‘J2¯žËf>Ÿ-,wuûôäΑóiïn7¤ºh˜†&ŠSsN:8g¹·J~£~DÁyžDŽ@€îß°ÂmûïO„`—Ž²sŸ[qRÊ\åüÜÕh’p—H:ôé€3lÝtÆ/2ú´ŠD´C½žq•27 ²éø"ÍÍUhçP -²Ì©à²™©q›K<•j‹Z&9ßÆÊ|oøQwl|â³9&™°·ú„ì¹-þϋ$ ’Ê“x/ôI¯^Š(=-:˜vŸ…zm¾_ô™Ü ÈÔNCC+\»æ'[l²GVN‘ÆY’`*<¿ô­ù8ª)˜©ØçN4zœ´›u(uå9¶9Å`ZV²丌չDЗo Zz€ùšúTêœj7cÄ"¬–Î>&'nž¨%>jílNx(óš™%ÒéÔäˆÚuùÞ­=³\Ï-Ζny–s;v´Lu”­1³Ù=w>DH‰V¯ýŸŒ(ðçÿÁa5(XÎÛ©%©,†& õõ~I”ùI­oølÔ›3endstream +xÚ…X[¯Û¸~ϯ0°€ ÄŠ$êBm&È)ºMÐœ`¶}à±åc5²dè’äüûÎeË) Xäp8œ?o"øÅ…‘*7…ŽC¥õf~mžaäo¯báH3fi +í•ÁÝåI¥Å*¬±+â2TiŒMÊ{qpBú‘)Ð6ÑÁ~:Wí#O‘ÉHçmŠ×°Çÿºõ Be®¡;c¯â^wdù$¨b%Dø›ªÁ®cD ŽŠƒcÏ.›µí?ÿöv6Œ»@£©x]ž`Æš½1Ù+@Ü%iLœU¯¡—§iL>u8û;vŠà³9cïÉpwß]–Æí{ †ÑÌñÄë‡Û]gàýê…YÎ…HçT5æ¿¿«îÒˆcRX÷Ôñ é+æo8,Ý×=òÌDr|'̵úZùæWˆþœi\„¹ÊÀv´ùO̱L˜0Õ©ŒïV$(˜_Èø_îÌ·ò?½#GïR¥Ã0À÷w-ñ“Ìé­{ó„hꑽ£xN•aTòô`ªR +"“Ì€4øÞãÔq$‰* ÆŽÇNv%të…'w“H1ü×÷C×Zév;Ü_­nŸ—BŒ— ½,$ÊL²`þhå¦Á'h¾ãæ¾k[«ê~¬¿9?¤ì‡Èâìÿâ–Çs·R @[ÜJ·¾ ¨ áV iíáŽvúÏÔðxîbUšVÅUà…;ÆÍmÜÓ}‡q/3*48¢‚…X&š¦þØ3ˆÈi¨,XaBœA†ZÕe„m›'iðÞôžÈÏ¿AǪCh4 +Lv¨ðï(‹†i s=þ¾CÉaÒ¿°ñ~‹uòü†5>ýã ú¤ÇÈ E¾áBC®ƒ–ó +›“ÔªGªqœ[ϵ{°‘ Æ~›±*I‚÷,¶ez-߆ߦ7R¼ˆXàêû¦Ð˜¯;ŽV˜]êzô}Àe@·ØD¸ À6:0JȵÓãþ©É +4³1tðc€"Å!ĔӧÎ(CÇ€x‡½‰ãÛ±-§½eÚ·m@ÜÔVKðW5Ì™ÕKJE²÷Šêž„6§ž ÷–H§És™•LgtoÑë¿O†å°«áÌè¦v+ÝòNN¼¹˜¨ßQ`× 3úÑÔý€ ¡òà¯"'Ö¢Òo+œf•TGC‰22§mE‰\fe¦iFÉÞÑ‹x ¤¬à +p»~oË<ìf›ó˜É«iŒ';{¹’RJ“ȳ,¾ƒ ÄÎŽ@öŠdã ôÜyFÌ (7ˆhö(ìÄŒË +£:ˆ0— +qðšIßOµ?¯–õkw> endobj -1497 0 obj << -/D [1495 0 R /XYZ 85.039 781.388 null] +1520 0 obj << +/D [1518 0 R /XYZ 85.039 781.388 null] >> endobj 206 0 obj << -/D [1495 0 R /XYZ 85.039 761.463 null] +/D [1518 0 R /XYZ 85.039 761.463 null] >> endobj -1010 0 obj << -/D [1495 0 R /XYZ 85.039 671.062 null] +986 0 obj << +/D [1518 0 R /XYZ 85.039 657.513 null] >> endobj 210 0 obj << -/D [1495 0 R /XYZ 85.039 671.062 null] +/D [1518 0 R /XYZ 85.039 657.513 null] >> endobj -1498 0 obj << -/D [1495 0 R /XYZ 85.039 642.326 null] +1521 0 obj << +/D [1518 0 R /XYZ 85.039 615.228 null] >> endobj 214 0 obj << -/D [1495 0 R /XYZ 85.039 556.019 null] ->> endobj -1499 0 obj << -/D [1495 0 R /XYZ 85.039 529.405 null] ->> endobj -218 0 obj << -/D [1495 0 R /XYZ 85.039 157.959 null] +/D [1518 0 R /XYZ 85.039 515.372 null] >> endobj -1500 0 obj << -/D [1495 0 R /XYZ 85.039 129.161 null] +1522 0 obj << +/D [1518 0 R /XYZ 85.039 475.208 null] >> endobj -1494 0 obj << -/Font << /F20 937 0 R /F15 951 0 R /F11 976 0 R >> +1517 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F39 974 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1503 0 obj << -/Length 3333 +1525 0 obj << +/Length 2920 /Filter /FlateDecode >> stream -xÚ¥ZÛrÛF}×W¨ô0e1Äsqv•r$¯¥¬7•ä"@0(ZŸî>=ƒ¡Hj·jËes.==3Ý=§/°9£?þeOgav™¤þ4LÓËÅæbv¹¢™\øJq­$×Íwßü8§ÙÙ4›e—Ë‘O<âðò¡øÍûþŸß~|xÿir†¡—L'×I’z·ï'¾÷ðÝäÚ÷nîî1ws‹ßoñóËí͸yŸ'AêÝ}úðÃ䇟.Þ?Ø3ÙÝhÿŒô×ÅoÌ. :üO³i˜¥—{jϦ>Mo.èDÓ8 -µ__Ü_ü˲Â\t‰U§î‡é4NÃcø±#ߦ¡\&ñlÏ"‘À¾«†2¬éÊ%ߘdÍ3ïÇIymGwŒ¯—™Å®#¢jà ¿`¢3«ò¾mzŒÝÓX¾™‰÷˜óˆïíäšÖ”J×5ÆŸùQ]b°ÝMfÌ5*Ë1×ßaí¸ý<‰câÄ*ò¡,Àq×[ïX$œkŸe—É]›v ÛùD€Q— ¯£Ð÷z^Øò4mDÃëíÝPQoóåï³xF}Ì,ù˜UÝ“ÄæIæ=0 Ÿ°ê1¿È4úaGW •QlqŠÞ¬È;¾ÏF Ï,å²&±˜ÍF²ª\ðøЊVd‘nLò:¾û–ÉÚU—ozn]=É0è+Ù$ÇÐ(öË·ÈŽ+ÙJ;¬B¦)±b¨6ÚZ´Âp+·«Ô:hAW­Ör‘©œQmSË9ÖeG<‚,d±p#RûƒH:R: ,DVa/R¬õ¼ª¬YÒlE óZ FM<ÈGìZ³ž¤MÎhžŠˆY -»‚Í YÙY×äÝ¢c>[Y´‚í]»—S-ä [jHÆÓv C^9ÄÓChòdïJ%¼Ù¸1÷ØåÒÊmÞ±ÙV²Š¯^çÃSͬÇ? Uó$™&Qò&À:4‚/ÍFÓ0š»ø2ŸûÓ,„>“i4¹Žã™÷q2Nôtý$œÑ[£º¢?wåñæaFšó`7F>ÌÏô$ƒŒÑ+ ŸûŸ¿CcQWú¼z 춪ƒn‘‹ÈJŒos˜Ûž‰[>¼ ?ŽØ•09ÝvËZ­‡È Ž‘­1Úú3ï¢$FÎg}™<Ø´øeE™ƒó~­(ð©×åˉÏ°úóÑÚîaêÝà²+ì±~Á²ÏËÏjž~ÔzÑ ¿A&³Mm–Õž/CrGyŠ†}µtN§K êNºÒ)ëŽÐ0‡ªYa*? sð}Ñ2xù©·ÕÆ|VÆgn}÷éýG"øðËý;ç -Ú Äê¹jw…lƃ0®U}ó•6ÿ´tƒÙ¨q!~-GG ®yÉÉwЂ -Õ¹^“H+3ôV‚¼-ûc-è üòýÒ°%}!ò8<2h=ŒæÔ¯­Ð+ÒX¬ØX< % h±@TM¿V0e×ëH¯;lª/âÃãÀ1+ž"‹Œ1ñ3ÐåbøÒbWqs«¢ àéÏŠèžã—Tâ— áȹÁÛ½h»ÕÉ1r Rö™¤"jq´R©ç¡áGó\i¢„Ô$ÆèÀd×_ ¬×%WGêu9J»¾© -âí„doƒ‘Km}V8‹|7¾`òe÷º ɈXÿòÍÃ,P{¦‘Q ëS”GCÇê*°ra €X `_ï ÌB¼Ÿá-f'ñœ­GYâ×ZêÑËQ9ÐñšÜ ~·±È?E±?Zªm&{óìÕi£Õ!†]a…£¦Ù¯Y-)Gº·ÜÝ÷ vÌOöm1\àEq³N…x(ÖUaâgØýs¥ÁEÞ6ŠÕqq NbP‡±„Ã\Dù[QH¨-ØÍŒLêÃ`|ûà„öâ&ÿ/ï+œ‘ÈŒ»m%„éÁÌhúøðhÙ,º—Q¬<´)‡5€ŸJ–™t@Ws›Ñ‰½?·ãUu5ÎVz·íPšcÏ=(cˇ𸟊•FArâF‘1ytŠcØJH'fC”bŒhþl# űǀyëCDØÇP?¬aºÌM¹)vF¿g­[,ÖÌ­Oz)Wâ¦f>Âxn\më\ï ’,¿(Eù×>Äät‡Š¸%D”TÆ<^.o\ƒ1;V„4uòëS–O8ùë×#Éf ¶Éòê2A&>YÓïºò ?¤cÔÃíÃì7Hç^ouk¤Z`Fòßq©¨³Å)òª±cÊARiÃPêžr óÓºÎÖÑE›úäcH$xñXë1!ŸQªBĘ@ËÛw<;ë*Š¼ûÒ&kÍ0µ -°Øm4ôq Š .·ß3ƒO\wøõãÃÍÝítø¢z|•êˆÞZ'ø)ʉøéT‚Òûi¿J84ç󚈥š×ÄÈk>h CïöI£Ó3Ç ´HÂðícŒ4ç3š0ͦ~$+Y0¾ÌS¨Àq4L‰ xÇ1™<¯‘®ÝÓCè±²Ó”´Æ'Xÿl(—˜¯[™O;‚ äJ¸Ãö&d*i”ð³Öy­3©£œsX}Â)Ff@âªÏEÄ'„@¡®5äÉ%¾ßYÕ¹ M¨ÒŽ8’Ñ°è¾»ÿæ³( °þ›§`ßÏ•@s³1`p1u f%È°3¡t‹~ÓÁHi)LÑi­¡Íqû°y¦’5´¡$Q_¸Ø§Fú4ˆ¨Q˜ñUyBÄP}Áê×9pÀ0–“xÄ…A­˜…ª†5T‚C[+ Åÿ+B¢Ñ74µâ“¹º&_Ï Q×c±Žg-8–JooÎ3ØIê‰ðŸ`Ò¨F>µú˜DýÍT¶ºU—‡å9fm£ j¿â¬Hk)k&³Ó÷®6Èd¡M“¿—ñ×£”cÏFYw&¤ËÈÕÑ2‰? Šf³ãº†Åaf3Ç…S§huôà6:¶P³¹&\’°EE楃9ºa€_œmÖ’h¢¯VMY¨ÂhMÇq:—VýȦ¬çžÄ'ö•SŽrŠdî=RÍé>»¼:¡S©%jët.ƒÊżdU=»‘[ÕDžY`ƒÐG×^—Ú& œ$'|1øµAÞd>”cyá(ä¸ûÀ^2Ðòª[±’ jJ²»¶…-*Ž•:kS*y­edDzBG ›¶äÂå[‡Ui«‘&¾FID|RìÃÊ·kTÅú7³îŽÏ¤dxx>¡—w­B±tmA+$üÂ3y”gÈýWŸbWmÄÞá¶ÆŒ7NÇ°†ÚbôkU§VeèU@—Vé}lÁ¶dVÚèédýw‹g'ÿV¢ðpî¼j÷å.µdž„‡„J”ìÑ!*óÆ ýiä¾Sî&‚¦&*ú:V”y­{Ý4ÎÁn)cgžÅÜâ{„oqv²£þ{’ÁX`äï®k.4²ËMŽÆ¥, %l˜EQ‡ö ½Úp_,¤Ê†ö*ÒÕNÕõŒ Þ°DRÎÈ{Þ$µI·~¾B~ö•R­Ëz‹Ö–ÔÙä¹õÔÛ¢sTÆ$úƹð•„÷°J­¨•—(rµÒžþ2Ãó-®B~¤ZjôCÝÊp]Ç0Wš±òaޱȑàáT¥Ö-PnOF<žëGd- l =ñPŸÔfú|ãð·Ÿ®ßq±p®Õœ¹[œòIe-¿œ.bqÅÿ¹AN'‰˜ÖZªS—D¬6Ê<û*ëÚÞ$B¬Ä3Š8Ï,<°csˆR)ËÀkÝËÇÅ9™Š€ÌM²nÈgEúµen'£;ÉÖCfR.9ðfKOι»-U1ÑëçÖó;û/°e>›k™Zýb×uGÅ@SƒvkÈÔE6E€Ôh9†šýn;±>¥èÚ`U¨õšp6 ²SÕú‹{ü_ÿ©Ç)=MÓ0;]ò‰ƒd:O"= Ë-H_×üߟ£óþ ·Ìendstream +xÚ¥YYsã6~÷¯Pù%T*fx™‰gש{vìÙÙ­$0IIL(QáaÙÿ~ûY”ó°•ÊFŸ_ÃþƒÿüE»^˜/ÒÌwÃ,[Û o±†•\øBq%$WÍ»‡‹?ÄéÂ÷ÜÜË«‰OìFq¸x(uÞÿó§Ï×_–Wa:©»¼JÓ̹½^úÎûå•ïÜÜÝóÚÍ-ÿþÄ?_ooþƒ£Èù¶ 2çîËÇŸ—¿?ürqý`d2§Áù9 +ô×ů¿{‹„ÿåÂsÃ<[`ì¹>,o/@"7ŽBùn.î/þeXñZ´à]s÷×W~îæAü¶Žß’Ðè(€ÕÈ £ÄÖQì¹±‘ŽR7\^űç|¨A/M÷NRçî€úÙU]¿Áéý¹ëG©›úÑÛM4$ÏÍÜÄc£=l@† œEh·Ûv×¼àLèŒ}…s%ÝzÇ„{°k‡¾2§h›ž§7 +÷„ÿÇ]Ë¿œƒÕÔÆíŠzÚòRïÖ<ù‚ßí(©ÝwK8R˜ +™$ªB¡œ#,ô8ã-f¡S¶;X~ YPØ•&ŽI-’vìŠj=ñ7ÏÈ@—àÇQƒž–ÄÙÇK ©}ßxª.+U 2…:ÀߢÝ´µ7ð¨\3gÉ4 Dΰǩ€î‹Kªi€ÐÕ—R×f3Öp÷0ËA'`P©|ŽäO4ÄÝ0ÈXKm‡’ Uî±(°7€Ã‡ª«ˆf²ng»?Š¤¾³íA5‰ï;–Yˆìˆ-=«íÞÐ&"/p›jÇŒŒažÝnOŽÀ3Š©P+ ë%D£K0ѸÃ@y¶Í変ïUOvIaھıGW"#ÃØ>>Iƒð{@W%õ4¸)ÉCW•zl„u0¼ÄÖ¢ðÕ"›õ‘ ïê˜Ãä« ¶LÚP–šŒ†1¡]+}”ì.Ú®«H“ÞçeF-£8^’¦‰#»ªZÇ-N²,–¨ƒ–ìÓ¥*°8äUô6©jùÅ`Lf¨ì`<âIbÔ[’þ7/ö–ôãób¡´`H¶+®)“õ3P@7/üÑ_D `„CM)O¢~pÆDaÎÎN¡ñ“§;yÄ&;ÉJà̃,UZè@8õYn<®{þ§k–&á‚Ó¡®ˆ™šÂóQèMA‡‡°¦ Á[Å÷´˜Ì¤owrÚ½Ú"Å£’ìhnB„ýŒÿ°e"ÿ(h¢C—öuj¨É[zžWò«ã§eœ£º¤nb%²sw‡šŒ0q¼Ôi/)•„ÔVxëX†±øñ@¿§+U7š=*/Éœ£`µH µ†‰9íä•~8±Þ[ËT:&‰4í~+žä:çãÕk UJ1µhœ*) ¨öäZëNme¢©ÿÔ +_—[ÅŸ—ü-ñŒå†Ò קpSc´Õ`G Ž¤ìïéN5{Γlë •ƒù‚SuÒë½åþ¢H&Í¡g“æúúQ ‘ˆ×¶ [®Ýé  8×'â;µL²N oइî¶+š±4E +NÌ‚´;µ•ƒÈ+^q_ã1kâ•fWò®™‚TÁ§ C±{®á”épXÔ’° VÛéù0¹¢â»YË(&XÕY¬Å·ÄYça`Á¯ç¿ -š³¸4öc7Ñ°4bXúyb¢èAŒÃÒL‹ÿteNfñ¦$†ä,RÀ¬!GÏ'EáB +gЉƒ¢©+Æ&±\A÷bˆŽkN_ñi™ý g‹ò—ÇÉp+Ny¾N¸±¯t/ɹּ j×–GàÜð Y ¶)›0ÉPý²¬³à‘î±ÔãiV©ÇÈg·íP1Ý°ÁË£I¾±—¸áIð»L”ÆÒ‹îe¯Q'MÕòû©.º¶oWîªwʽÿ4Õ –8ô•´šQšp4¥ÉÌ“B6VÙ =ºlàexPÎi”j¨ž‡G¨þkqAѾU%i6µç‘à·’ljfD‰¾OÕ‘~{þýþß×_°¯üï÷2¿ôÞ ŠàyºªïO.Лֳ’3°5ÓÇ0ð€í|¾ì♣,{¦±:êa¤J´Ü\®&ÄF@kª‘ù dºê‰’`[Ïs ƒp¥47ÃGËM’P‹šJã•ÛÍ,äRKUYx¯š0 ì2G «™ÓÉ© +®oß³>ã«ú†G·îð,ØÃôÛ–t÷è§éϵAœ¹^òv;aÑœm'‚ qã4—~"æ~â£@k>g¤B7ÍßÂœí$ü,s!8Óqƒ¨qEq?ÔKàGJÞ×MÞ\R¤§YyÁC\à {ª„½ý¨8^äk‡ÝãL¹’GÝ陹î5¶£S’ª Xºãpô†rîM˜ò‰7/ .à{[ÏCig0Ðs ¿vâÊxô%ô‹ ?ßÝÿøØquÄL)Üô»I 註·\íä Rÿhhœì,Ôd zS“`>Z‰÷¹zdæbʼ?dŒéI:”—EÄàø™¯^ˆ€â8âvz‰@=HõÌT³h„é°ÊV0/9ÀãæG«,è$O_½¼ÁËˈÈk2\fõ.À³ø½[Q–ƒM+]£Yõ ?¹ò ÙI¹|T½nF»+9ëÏW0MöÇ]T¦ÚN® J×zz×Ò9¹jüÇ]9eÖi/{»H* E¤ÃzöµêNàVèC³Ôà ðË0L…úO¦GÙò4ÙÞ¥`â¨WC>G² ¥é\B¨&#u-“Š À©AõÙ=FSJëµõ×óBôüG€õôœbóøÌ<æm„bqœãCî4HHœ( öôΚOç€ÄÄí'ô [UEæ¬ë'cµÈ~“Ç<ú6k^ê°'@ñ3Äç7zztÝAJÓûï>^<"­6æ±”K~Ïl¹‡ô_pÐîy›œxz[íSìB<ÇZ®ô†»O°žûJÎù¦ö‚èr»“ÚSŽú›w½ÐsƒÙ +ÿ³ðÿ×¾MB7 ÏÔÑ‚&I#‘…\#z-nfnœ…§òþúÈãAendstream endobj -1502 0 obj << +1524 0 obj << /Type /Page -/Contents 1503 0 R -/Resources 1501 0 R +/Contents 1525 0 R +/Resources 1523 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1484 0 R +/Parent 1511 0 R >> endobj -1504 0 obj << -/D [1502 0 R /XYZ 85.039 781.388 null] +1526 0 obj << +/D [1524 0 R /XYZ 85.039 781.388 null] +>> endobj +218 0 obj << +/D [1524 0 R /XYZ 85.039 761.463 null] +>> endobj +1527 0 obj << +/D [1524 0 R /XYZ 85.039 736.911 null] >> endobj 222 0 obj << -/D [1502 0 R /XYZ 85.039 677.747 null] +/D [1524 0 R /XYZ 85.039 545.001 null] >> endobj -1505 0 obj << -/D [1502 0 R /XYZ 85.039 651.132 null] +1528 0 obj << +/D [1524 0 R /XYZ 85.039 504.837 null] >> endobj 226 0 obj << -/D [1502 0 R /XYZ 85.039 431.455 null] +/D [1524 0 R /XYZ 85.039 258.061 null] >> endobj -1506 0 obj << -/D [1502 0 R /XYZ 85.039 399.93 null] +1529 0 obj << +/D [1524 0 R /XYZ 85.039 212.987 null] >> endobj -1501 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> +1523 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1509 0 obj << -/Length 3663 +1532 0 obj << +/Length 3082 /Filter /FlateDecode >> stream -xÚ­ZIoÛH¾ûW¾„"—b‘¼ Äé7'(ð zú@Y”E„"’òòïçmU,jqkç«·|o¡Âóþ…çYâq~žf¡gÙùíö,8¿ƒ™…²b.KæΚ·‹³ü¦a6ðó ?_¬Çs_%ñùbõ§÷îßo>/Þ™Íã8öR6OÓÌ»~? ½ÅÛÙ<ô®>}幫k~¾áÇ·ë«ÿ`Ky7³(ó>}ùp9ûkñûÙû…¥É¾ ÞŸ#A?Îþü+8_ñ¿Ÿ~œgçÐü¦·g@‘Ÿ¨XúõÙ׳?ìQ<§Îy×±û›ó0÷ó(y™G:ô•Ž-"˜U~¬4ò( #?£ó4 ü$PĤÔ׳y’ÞeÙ<íuê}láx«™ÔŸººJý4T/3®!bÂĘ%&Ò~˜DDÌÍ„C¯mfó(O½™÷õ#Œ¿ÅvîÝÖUÙ \žkïá™zeÓs_¶ü/Uͧᮠ-š²¡èñßgx7š[C³í&»ïa¨è†êvWS‹G/Vüæg&n‹ç¯`deè¾à©¡åKš-ÇCëâ—•+!¾Aö×æ!Ê8'. CwÄ×(AwHd[-‹zY²ÊÞlI‚KÔòëÿîË.MÒ™>O÷:ˆ®¸±¥ÇÕvnΚ;‡J9J´Ÿ'¹}#Þïúák&÷šïI£ÌÂô—jÎz™Ô8Ó™Rúåý›K"3ôNpT‘¯TòKÈ4g½L¦ -0ªlBçÍ—«Å{Kè*³Ø³ü×P)gý„ÊL…*ß|øðšÔ}§Êפõ Mžào¨KóužûAò÷(7gÍÃŽà’Êü(7‹¸ßÐêß!éÈ+ íWgv€–Åé/!Ùœõ2ÉQ ›§_‚o  -B&”0O›·¢Þ3O>\)`ª¶”„k÷›v‡&7_š³ˆ%uÝ"‹gŒv–?K—x(`gaO6–5 ©D‚¯Æ¸@ø¸AOÀ7t•E= `qf7“»•2ý´;‘béâåè0AP£­ÅÖlÆ·ªâ*ˆ °³†Y ü˜¬c œ@=Áå¡Gý[(%gÍÃŽ ”Ž! -í LñݪžŸ÷àgŒ°‚¤; ¼yÍý58@’C”„~ ó‰ʧbËúcwÄxTíÂ8Eê CiF¡PZn¶ŽÒöÈФ¦òRÖ-ã©m(ÐÍV¨“w¼ÄÑI\µ.P€µO7–¹÷øÖàü:SÅúÞc;ñ&‡Ë;\ô0KPë1á€CÁ[šV #J•€WÎb³»ÚÞ×åö`Ë°©XOñeh˜ÀOàÂ[¼q×—2]Vƒuño¯ÙÃßâ‰ßy½Ã+‰Ñই7^=†q”ˆ -¨QýaŒ£‹ž;UÓ’lV2Y4+Þ!q‹Õ'ªä°‚—ö¥‘xуì¯ù¸[¼éw^¾ª:sµÛ¡ížy”„Œ/änoѨ+åul“ou„[NÔÄþ9oζ…/PX )çÞÂ\‚¾=žÆ&d”ém9lLh)[…Ÿ»mÿÌmã pómÛô»­…( ÷:Ã$žnÕWÍOº[彇`Ç»HÇ;æÖ*1š ?à ·˜¿Ð?PÊ ²"…Ài¤7 På5XÄP˶{+«õ¨¡…w\boá3µÍÞJó²%û€Ã»®ÊuA¶<ˆ-Ó'}mGŒùÊϽàL?b̦œxÚ=ÃMÛÉD5ø'ò™–P§/æ3ΚÓÉU’ê'Z’«”“«Å "ÝŽ0ìž“+ÄC˜¬Ó®oW—§’­D§~¢õËÄkN'[‰Ò~ ^³Ý4¶¹ÄdbÇ=±‹¤kH… êÀ5vÒx4Ë@D´Œ…ô@A@àIƒ§«ž_ÐÊVV_˜¥H€^míÑOQÁ¥X­€'.Ûˆ2'bçÙ#Á©Å!>À"š†€<­Ù×”ç6‡…¸f°ÑŒ ¸f&k+Ò9ž'φ :›¡âÜ£Y°/eÓF`JÓÑ…€ýI£›”7mx’Œ¡2ÄJ¬Cï×vhX,ÓN¤üI2¸xIIr¤`¨¥I2Øð0Ò^™µìšüaÎz’$9&ÇQæÞ'Ù×·[cÍø¦Ü"g’QkMØ¥¦BÐ…¾ûDÑí‰ô™xOpÚÜ@_’EG¤£¢©²ê²hdï@¸¢"£h9ß"gq)RÙTON„Ê»xW¸5 <ÇPÅaMÏá-ë"‚8.!MŒÂ©*‘‚© wÕŠB‘!ÏuKî8I™Hèp¾ÃŽönɲüë¾åù»rpvÉ CW0ûV­À*ïc.xÕÖÁâ®äk³´Ë—fWr%Æ$d I{Ÿk™)ãšÄÑi‰Çx^A¢‚1¼ÁÛý±çGl‰…WTuÊ(ÀHýOà¬9í ¤e™Pœú{‚Ï3ö9BÖÚkv·Ì(¯Š)N¹sè‹ÔkN»hH 8[\€PHR’AÀ³à„5ÈÌ›ØqTÅÁƒÊÅ6°Eê[WÓˆY3«{S1K'@O«Âi.»ÈŽï6¼õb‡jrßU8Zƒf­.x™ëâa!½x·Åÿ¥úƼܳ!Äî„nÝ°NKKþ)ó.÷2_eJæà 8ÃŽ• —¡,kÆ(Ç4£¬JöÀ¸çIæÌ”…À]¹AXõ0Þ'·MŽÞs×,äh·’w˜gÙpZe¢y6°ÈO£tžªájÒ76jR^lÚf.ß<´ëmtH‹b„”W¦âí'}tÏœPž\sQµª¬³7ùÜðÓa -®?ª´°Ä=PÞæ0R@±žÄÓmœŸýù?1Å2nªp*s`¿çRºÐ;ômpù6xÞ¬oîdÄD×8J×¾^ˆ¾¥ˆÁ8òJ¨Y·õD}ÒtôƒD -Híd–ÈêÈ”²eÓ'çg×™A¦¥³1BºQTf‹¹W»ºjàa¦ÁÒܳæ1,)éÇa78*»„J™ÒLbÇœ^°ºç1× Æ©ÄÖ¯¹Â±äØ»+)1ÒXUø±³^›d¤%ÖmÍ´–9S?úvGöƒí{Ò/JJi×ü$Zæ xžÑá@ËjeŽ#^µKËgy™D³Ð2Îúðb(#¬#›ÈB¢:ð“ƒÆ8Ö¦À’‘n‰“0‰gWR˜[ÔõXXÝaô™ ÝœA׃½PáILùOBÈFŽ¡#…¡îñ÷…äÝÆ« ý¡’qÃõ]½Ž„åÆØ¡ËÆN…;*©X¤éœ°#*ûõ¤¢Š¦2!ÂnŒ[“ï+°lbÅ‘³!¶>Õ¨3UUÒ¢¯–¤âÔM4º-ù¡TÛÆÉ|%°1q“In)©2sk)½ñÃÊ;{ú «—R÷âP¸†ÔÀ\ÀhÃI$»W„‹ÞŽU61t"…ˆVŽÆ7Atê 85I&å(Â7œ•Ýø¥Íž6Ãn|#¨©S*Ág ø«Wæ¸dMåtÖÊä0 ûSÐxƒpsGßV” pž %Š=>6nH篰MfŒ©!QY^ó×Á,qp?V’,9¼,ö6tv²NÀ¬*¥O“©‰@€èˆ’a±/†M[,ØvÜ~ä`ZVõ2ííÕ pÈ…]ÜG:Óó9<ÂTâaÌj“ÌwÁÜ7t„…œrwß{>C¼·ÉÆÁ°má8“ª #ɦjÆôëIÆÔGSÏ >¼•$Glj±J‡“»B¸ùšë5Ë Œ¸Ú” S‘Ðë󫞧1õñ”g8YÑ}#A„½O{Ô‘¸´|Ñ\{fqBÒRÖ4(Òh1ØE(a¸#åDïd?uk†šÜCÇÄ£ïL&ïŲ. -½Œ|ÉQÄzóL.ØØF ç®ñøœìЛ.>žDPqtlCÇ—dÈšFvd©ýi4ïø¥fÛi:5(íq‘'åŽývV™`GÉåâV+Aê¸Ä'L†žæÒ!T·V@ÏÕ˜xMË°ý€•€ý‚¸. c?dä¿c—-¦YIá´Ã‹KØó£’.“Û¬D§ñ[‰ó• ž¨v÷¯/í²°ÕöXÉ<jð0ˆ¬LÄ C“.}x8ýƒ ºŽ£ÏR9’E‡Iæ‡?ù)³ætŽ*|Æ’ãç&Ç—ì¾ø§4·mÍyþ»kñO¬r0ñ|Š¾8÷“èå_×8kNgùøY5×á$ËRAhlÇwÆŒ³¬÷áÀ­æ©ÚqÛuÁ» ë= -ƾ~|˃x–S lkŸ?p] ¼PŠ8Ûž»RI€¥ÁuÎðüñÃ,/nÆpåPÖA·ò•®¨«Á\‘‚ÈHr-ôY+ -£VO$ÊCó*—ò<…àŽòÄ6Ç{ÇN¢Z%¬¸(Ÿ©q–™ßCM|Qp·Å}A¹ ˆ¬2òý04]¦*0¤\¬¥ÈßD1Š%7cÄiÞ¥%åÅDG/¤‹wbK"È㰚ѕˆ7Æ¢lÔƒ{žEˆÙkž\µ&Â^éD*<â|ó;vº“Ž‚ùŠ©bsuLš¦ì€íi‚! šÒV)r©úçùøû4\2ÉøŸxÌÔ °Í?…»+‰ÅvŒ_AkSÅ¡§VÇ‘-ü(?†kðÇ÷ÿ[¿¦tj ~çÇÁ1‰R_§JhA~Gù>¹IœùIÒûš…&úendstream +xÚ­ËrÛFò®¯`é°*„ ž—­²-yW)GJlº¼[I#$±%ëïÓ¯(ìR©0žžžž~ý™þ,\Oe³$õ]•¦³Õþ›maæß¾@,d1€y³¼xõ.Jf¾çf^6[nz<‘Fj¶\ÿá¼ýÏëß–×æ ¥”“¸óE’¤ÎíõÜw–oæ ß¹¹ûÈs7·ü}ÍŸO·7ÿÅVè|ž©s÷áýÕü¯å/×KK“Ý öÏ ¿/þøË›­ø_.¶æ>qh}5Žnõ•—äÿPaÕ>ç{ÀSðü=É ¯4¡ÅÑMþ(;î#bmÃ60q~B âÌh®OÌÂF#¦­ôF÷Èê (+<ßvƪ`¹áïŽo°Ð9Ž{ñoZž1ð¥•@Ömò¿yÛ ì†X³çκn_=K.¬x UY0'»©c¯tÅZò¥(K£8"9 d,¡wÃpš?=Àcq+c¼ø¢ì?z¢Ž,uÇB*ÔGá@º,éçó¼‹"“5I;ò4O‚Í`…¡ ®X!æJ$Ž’—­´:j¶pZ%¾ +‰¯NÅ#bé8öD±µÙ“ávѹgbÙ(ŠÜÇ—"ð  ̆® +ãA±†'n v)òœ«¼"áHœ_ñÆ=g[/2EK Ü8ú-=ÌÙ`8L!r¢åóHý“LPõ´Gž±±ÙÝò°¬è“Jb+îÐ~Ð 1¾ß£<’c©eærWF{ KbÇß:¿äU¤&ðµþšP•z•¯…P9“ÕV É#éRp(­˜†0áfiµ±bËÃz‘CW×·ÿ;½)?ÍÜ4 gaB +¤¾)7H¦3 …Áµ {~§~¦\r>„Ǹ½£|îg&÷ +š¤BôâúpîAªÁõ2©Aœ¹èHýpýúŠèm@šŸÓ Ñõ}ÿ‡Ðip½L§ +#H(ÕˆÎÏn–×/!$¤é!Ôàz™Ðb¡4Ñùúý{Kå‰SñCH\ß Ä3NüïP¯ß¾aéÔ¯¡..B/uc íö^û>œ6 +cŸÌêwé™àZ MèYà»Þ®qwh&Áøƒv`W62y¤Íë`@“§“¨• wG¥‡R²ÒÞ²Á¤C6§˜À‰™Dœ1,…˜ÊDàÊ|+raÉ9dj†4Yp(‰sD72ïÈÉÿCpŽyNŸé·&[à”NÖKÍÉVšò–Ó“¤ˆåûˆ,d'ë”ÈbÐÎHù¬ß3䚇 ¹ÃQ*³û9Cú,ËwF‚L¥0&/°lð°4Š*Â%/¼ƒ'†8HõÔ'UÌMµÎ’âNy¢×7Mufö4.ÇÖùF“êxnÃ"ƒÇ¯Ûœ±j3Ôí´€C¢uRŠ˜âÄÙ|K7‰ýSœäl¶¥¼ÈõƒT²­„³­å®½!otàl m'ʉ"S€yا›«sÙ—òW©ìeÒz˜³ÙW'n$­!ƒª6²–í…”Ã=Ñ-†ËÔ~,¨"í™ò—)Hí¶d|dk×’¥yR EcÒhG*kÐuX¥‡±Ü=žîï9¯dðq— qºß] +EƒÓæVb¦Š‡äÕB,Èv~à¡æQ]È3l€I2z ËŠ7ìsV˜'€œ©4+ß2…N&$ü€lXû‡UãÚ?Ä%ÔÊy —8¾ +}v—ámДս|-”›7h¶ýNdÆe;¾¼)=²C÷ |SÁôUõùjdEª$ô +UâÜÉRS7ãžÊÓÂ!Lw­™µÔÁ„nyß·p×GþêßÍ°c$šüZäÆH€¬ßc:NT-íŠ}®+iöÏ!| ¡¥rC{-½> gGe %Õ8É‚ˆxÕyÒƒÀˆ#%DIϦ +Õ·µ©ù÷G‰3‰Ó\ç‚944ë5÷¶¬‚ÜéËŽ™sÙ5šƒ¾um¬-±Ð\rg?pÚ<ØŸFá=Ø7¼ò—çoe?j$µ=WΫßÍ!ÁÃý>qQ6дE•N#˾È?a{}¬pŠyÖö`Îú_¥®ù?û…TŽ68auìTGòo@Ú=y |G9Cœ }‘¸æ¬cð=È]<[ˆB¤)‰%~5Œ 241æ1K²H±2fáK*¤÷ï\„2“ÉÀì'bö Do¿ÙœíŽ;—¤ct‰z+Jã;— 3(ºb—_ê(\ Fm o„{Ry Xýê1ÅVe²Ô ÒøŠ úCŒùè†i$óÀLMñnTdˆÝ$NÆUueÜ»)r@ž:yä8q¡ƒtœú— +äÑ +pzXöÔ4+šÞB£¿•ÔFy¡5 ÐÌ+Và•µP6 +QŸìÛ0ttköBéX4b(ºgÎùÌ ÞObÇÙ%W†ovÃüƒÄ‡Må°Ä^2Vó>G óúwRžÿ–¤àÒ²EÛŽþƼ:âýŸ1=7˜ŒãàŸÿ]?]±J*7= Fàâ$ZÝ*:%×üÂå½ÿØMgendstream endobj -1508 0 obj << +1531 0 obj << /Type /Page -/Contents 1509 0 R -/Resources 1507 0 R +/Contents 1532 0 R +/Resources 1530 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1484 0 R +/Parent 1511 0 R >> endobj -1510 0 obj << -/D [1508 0 R /XYZ 85.039 781.388 null] +1533 0 obj << +/D [1531 0 R /XYZ 85.039 781.388 null] >> endobj 230 0 obj << -/D [1508 0 R /XYZ 85.039 761.463 null] +/D [1531 0 R /XYZ 85.039 555.804 null] >> endobj -1511 0 obj << -/D [1508 0 R /XYZ 85.039 736.911 null] +1534 0 obj << +/D [1531 0 R /XYZ 85.039 512.851 null] >> endobj 234 0 obj << -/D [1508 0 R /XYZ 85.039 586.167 null] +/D [1531 0 R /XYZ 85.039 336.61 null] >> endobj -1512 0 obj << -/D [1508 0 R /XYZ 85.039 556.763 null] +1535 0 obj << +/D [1531 0 R /XYZ 85.039 291.536 null] >> endobj 238 0 obj << -/D [1508 0 R /XYZ 85.039 446.667 null] ->> endobj -1513 0 obj << -/D [1508 0 R /XYZ 85.039 420.052 null] +/D [1531 0 R /XYZ 85.039 169.493 null] >> endobj -242 0 obj << -/D [1508 0 R /XYZ 85.039 158.125 null] ->> endobj -1514 0 obj << -/D [1508 0 R /XYZ 85.039 128.721 null] +1536 0 obj << +/D [1531 0 R /XYZ 85.039 127.208 null] >> endobj -1507 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F11 976 0 R >> +1530 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F20 937 0 R /F39 974 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1517 0 obj << -/Length 1931 +1539 0 obj << +/Length 3359 /Filter /FlateDecode >> stream -xÚ¥ÙnÛFð]_!è¥1Ü2îꆿ¯øóçÍÕW\EΗy:>¿3ÿ±~7¹\[¬4¿B…þž|ûáMsPþÝÄsÃU:}€µçú€®& ‘G¡ìËÉíä“eŸhʧÎÝ?S7Nñüx`ßÜЦIì¹±‘t?_DÁÒÑ~ç'Þ§hšk0ÅwÏ_¢1²C »žéú†)*uO'º+*^m€ôpÇ4Û¶(жAä\ˆ«¬–á‘NnU56Š!ýN ®Cm¬Yˆë¢v[¶M…¾Ã,|´ÛŠîÙï…RÃÕÊÙ·(vSÕ 8çÇ ¢ äÕ"Iêt²ñÅ"´ëgäg¨âŽJxA“Õ7kÞå(¨þ­—ƒ‡=ì÷óplZ6&R}dêŸó8v´êuS3´Ùòwtf|çL•%CH«:ÇEBîF^—4NVŽB·VȨé±U{E—)ùð†/HfÍ %ì -•« Ú Ù6-/®Ã-/sccV½lÐÉñ¢†’ŸµÀ!Ȇ—é®-è~­rNR²|oz}ÁéŠ&éÌñ„+Õ²˜SÄKGi4Š‚qI–$Ñкë]Aç’XàbC7j=ï—1~#gÖã]RžØ`ÆàSSÃ;Æéš™˜ “åñN€ßSУՀcÖ” ýîÅ}}'ŒJô¦IWËeA\œ¹áE[°-= •5Ë~hu_€2;ŠÀÊMU0žíî»|JÁèš’%¦O.઄€#¤%#ä~Ý«Áb{°\zMé%txccŸ¤· -pã¼ØaäG1Z¿žSªã3´õñ"QXYÆ‚±|¤p^Û"§Þ4ÝGÊÚý'X¾ÊsfM‰ˆ‹›¢¿eÛt˜Ú¾sY+P*Še“Uì¼Â,FÆ`ˆg -™ Î…XƒmEÆ›ÿi­P%ãš=Iª7eTXº¤ªÍ†ªî -C)‹d¬8÷ˆ0TÓÞS|Î5° VÎã9%óæ)*ìô =¹+ç8çH#VÛH*E^èÌ(²¶T%È|J<„èü{4@É2|gÆ8²lN®ÊxYp„ „CÖZtãÍáÚ8¢ÈÕðwcrUm U¾ní! x÷Œ©¦ÎFq‰²½g/ÖhûŽK{ Ù¤V0–ÂHR’×R“ûÄ<3†m)3*CäÁ˜z7×eÑ áN§S`Fv ¯1T‹a-ÄÿÌHp‹ãÂ]Õÿ‹¤u/Ÿô¾ ßœ«eÑqoFÃŽ5 b˜YØÊòÙn0p -Ï-•2.h–(ŠžqÒƒI‰‚BöFv-*À÷×L3b0cÐiíÇ‚”„Î~3žàÝÆ/šºx¶ðïmnc^;@ †·zäõªt«˜w¶O F&!à .‰!ößhF¸×'1&d@Ì#Ù“&ŸD&ƒìäG4}h–©½Â Ð¥¦ŠFôÝl\A``ŒŠõƒ´|Øéá ‡)ÎA]P8Éèa¢‡ÚTó„#´Ö—|¦]äÃÕŃ T()e!¢ô›iñ¦È ³c§<ƒCRaæ;ÓߊroÚ'‡F/×E[vOª®ðHÉá.ak¦ÎÁ,EG´p>3x„cŸ‘hlmÖÒ†«íU5bE îøU%¾‘X‘Íñ ~Ð=FâIÔÈ\£ÁÜ•éL™z—ÆÉZ__~8úºvCV/žÍ-S#/2½%B~ƒÓ5w -·vú=’^,Õ”aæÑCMs•¢B6 ̵Â=Ùð2kÐ?OåW2p®#DWG“a™4èÞ(g“‚3ðÅ™à„Y‹¤ÁX -§–ÑIp „Šàò8ðFK¸W¥ît­d`A…‰s­³¶éšmÏôm‘‰ý¨èòK -Ûr†ÖP•íÑ'2¬Ãa=ªG㛼¾z‹gí×MÅo¨šaWbS?m£ïÿVK¸† âf*é‹Jz$€m5ú: ±õÔ KÝí -!ƒŠÃسµìàQczÉt>*”ô¢ RßZcî¨äéF0l'É3<Ö`‘EÈi¦ Lšov0…¦ãC&5p=|ÓV«®×8í 3êÿ#Ž2R¿ùÆþãG1<¥m“S<“±UÀHËÈÃ+µêã’V5Èà•n~iP0AÉKO^õòˆ¦õŽ‰Ì¤lPô2Ìl»ÅŸøˆÄòbøšNé·ñ]+H|+Jw)¿†È Èmµ‘”÷³ ëkm. ·íMÑ>óƒWè¹ÁêÜTðÏúü¯ßÂìO}Qè¦áêü]q¸Ë$]ðþ¡wª®ùÉl¤ï¿8ãendstream +xÚ¥ZYsÛF~ׯPé%P•Åà>mÇÙU*RiË©Jò‘ ‰5Èh…ùõÛ_wÏ`HPÎÖË çêééãëƒKŸþ—y²ð£â2˃E”ç—ËÝ…¹¡ž]:âF‡Ü8cÞ=^|û}’]þ¢ð‹ËÇõ´N²ˆ“èòqõ»÷þßo~üðëõME^¶¸¾É²Ü»ÿpxï®oïö§黽—ç[yüçþö7´bïãu˜{?ýúãw×>þpñáÑòdw£ý 0ôùâ÷?ýË1ÿÃ…¿ˆŠüò…Úþ" îÝq´HâHß›‹‡‹_ìRÒ_ʬsçO¢|‘äÑ\ArF‰¿Hü˜p× ãõMfÞÏïåùTŽ¾Âkê=ܽú²©«‡rï?ñ‡ý¤­ )µçãšøq£ÄVWúX·D¾Äâ47îѺöe»¦é°è‹Æm=(˜Ù1_ðGÙ©ywÈî¹!Ÿb¬šÃu{ \Éê&€( >ûã¶ÂúÞ®$Ön¢°ù{šÜ<÷ô·e¶¤9šIm5>aH§m¹ãEz˜ý…¼‘îNwØãÀÏB£ñÜõ£t40Ž#ïž×ÂÏûª?Hw_ÑËÀ‡Ò-— Xn}·;sÈ’VLRçu8Y¿¬@Êx÷œv'Ú(ƒºµ<…‘<ˆID8â ä™Ê’˜=Ÿ¬¨wÒû‚öÖ[!pS´=½$æ’@zb)Cµ²ñR[iÛ©Wgí:]ò?ˆ{³Í +›F%îˆ!a)ŒéiæmÑ]ÞË´(ÈùÈQyèèF¡•8’ÕÁ€o¿Ýȸº%¡×æí¹dõÿÄÚho†:ø¶éiWÁºîuó–ÔVv`í‰;­îð}A¢bº,"JV¶ª‘Da!•ÊûHí­h‰žÐµÛ¹z,K¶=ø4#bà ”RÇš³¦Ë½Øa/ãøÐôT‰!Pp£Ý<¥^©ìѽ>Úf’õ¹²¢>Ç)EQ(w_½@nrYÖ¼Ãlá“´æfÑ9E™Ý +=w]¯e=“ÒDÃ,ôZëS¬40 í˜Õ•Yc,ǽv9Å q¸Ô0ön¿ù¢Zƒ‘ì÷öì)i'{£èúHíõÇÍXk¬N´H¤¾u~§ÆÑ…öòCĆ° ÂÅv Ž sï9ö#± vzi šóaÂÙóI[©œ:ê!ç¢ÛÉòhîX§¡-£.Ç“­+)u®õ`¤ÛcÕ¥¨úÌâŠ#ã y·/®Õe¢Ìñ}2«}³‹IÕ`GQZ4­Ãã"‡}G¥Sì½bÅR×´VÇn&ï90ðD„D!¾WŠûÚ2‹Üç\NÜE²7¿áb}^q±5–m*éYw½4`¦ 1×b…¿„¶*í…á¹’[µ×@ð*Œ”È°dÔò3΢N×tÖbvv ßßPÉ©§™ûSÎ øF–;çøF¢²˜¹f¬@f­ á1L½bt%.b…Ó¢ ½¼KˆV®|òc¬P£7 ÄÞÓþZÏë ܠ禛‚NñCzecBã…5MtNg°ïÝ™/wöz$ PÛ¨âË µŽ€Z:p$Þ­„kÿÕ0RTÄă¬19¡@›NWm8£—¾Þle%^ÿ\tTH iWF[2Ñ'ë“0|pÕ)÷,*ÔtZP+]Â^oJ²}]?ŒNÀ“‰O“Q"DÕÇÑ/rñÚâ•ä I‹ED©È×Rg #úzãE§¢O¢‚’ŒÏ]ÝóÏ×ìHk <ÐE +Qšyï¯$W‰ ©ïð‡Cÿ8œÆ¼šs$~H90™£k\Ñq#×`Œ”+ Û£Ü6órãÄèf¸’eØËJ?‹48Î]¨}º¬6H½ÛQæˆn6dÆ‚é¥*añ5c6AXèn'ÊÖì{–cݵŒNêQŽ5W2•BR©½ª€+À¬€#<îjëØûˆF®EûÐß=ãÇrdŠ•xìa+æ8"A(ªº³mdÕmñÊ8Lý帿Q )Ýkã$™-œVÌ,TcÀÞÊ}[½Hƒ³*÷Nç2iª/N7 +,×Æ´&›|¸£ö;cŒ§šÂ£;齪þ«Ì•M-ïêÄT™?Œ]–ÏåDÝÔc] Ç°Òd컋í*òöÒ´œQûYY1) ØÉn¢[áåA¨W}­ºE\!$äd ÞF¬âdƒ†›(¢>˜~Pï—+ª¦ÎUgcQ'Fðs£ìÍéK½Bxø"‘sþ ˆ)1†‹:N t€µ(F1धÍy0j)Iz¸hSœiÊ~SGi±¹rgcü¹®3ç©Ö¡õDšäŽ(}MbH1s¹o\9̉¸5µû~Ø 2ç@¾‘6§ãrd†û¹¸ÕŒ`à…ÆaEƒ¾@”¥¦ƒŒŸBÖ­R'¦:IΆÝÎLÐc‡yb’tÄ- “À&0 +Æ; kyý´‚Sã¡Áå`8¹ûÇ3¢Y±1˜ˆÓ‰ég»P‡cçl D7Ó×âÀ8ŸŒ¥,q:AFLzÃÙ úYVÒ®u“-ƒ¶yâŽK]<¥êÇ’­£ÑŸØuXÅ £×8›*ì'ÕŠ*™%Иwód¥ì6`¾+øƒj,öÏ×Á KÄv£6×I}]jîÛ™µ´¹8Æž‚Ð:•ÑN¯ûÉk–R<£Ì¡d/W>5Õ+¹3ô7ñ} ÑÜÐ,…ó¢ðÒDèW#NŠqÝÍ•ôœ J<&ú4d£iN‹¶qëhÏ‚SQvÙnt-²¦ã®LXâçSæi kŸ¤¡¨RÂÆ[¦TÛ?±B¦©Í?RÔ…L löO…Lض ¹ê«Õ ÓÌtkO7dÐA8æÄÕÈâ“>ÑÉRÛ|Ë4¾©J›:Ñkú³MÎœÛÙ×øÔ7Rm<’iDït0ª¬-úÿåí +ziê¼hÜW&sxÐô‹VÿÀׂ×N¥Ç¡÷–M7Ô2\˜{UtŒ¥Ëƒ„—c7Pš%`JF€¡[ƒöh€˜Y© ¾e»©L~¢ ©/Ù¼3;Í3 À]ÿI“¢;'KÍX÷”—¬º¿«VsIaScûåÜn{źD¾eg|`’Îa¯ðSj–ôÊ1æ>Œý~9î{7[N#GX)Ð5“á§ÒиG!ö•Ìo«Î 7TJ1·”s¯¦»ˆ§¦†)[ ÊbÆ£¶x´línr0 ¿AÄg·çj"ÄŸ Eƒ)]6ZóÌåÁ7ÔKc—²—OÇpTá#¹á±·5öë8áx꯰DZ÷á(îj‰¯$x®Äù‰Ù¨E¯DU#‹E,ôsÞ¹³!‘¯´WÈþÇæ =goiÎ^É4†}t<ço8ˆ?Þá™zþ"¯„tìÙ%Kn’ÆSÙ¯žÒ®TSœ™õËʬV­«ÞªôJÆ?Ù\2›ª¦3û—¯SYjñ õ0dK¼÷|ªYYêàª,c”oë@ècØI£Ì*åýJüKé†äˆµ\ò•ŒB¯åíe[[F‹ NX]Öß=—ÝômXUäÝTW¢y¤4Ž2–¶¢ÁüX…•à¨{¶Â•1Ù8/Ê`ÆZ›Ã…u‚8ƒ)•vASŽ=×E§ÄÓ Ýz”Âv/â×Ê G)¦â#ÜJ^°D6GûLM„¨ïo¿Ipï»ÝN¿©3í´¨;}ñ’þïëÆ]i3[RÒÈHRƒá„Èì•üù™1éTiÞ:îE·¨†÷™B²ã›t?\µøº–’Y>-É ½È¦LˆÚ¬s¼ðÞ@êNIìvŠT‹ŠL£\Û 4@/÷»éÇXÞÚ‰,ÓŸgVQN,Œ5##J¶%W˜œšBÎ;È\9ÑÖUéâ:ÂoÇù± §àqì/x-3¡¤Ì@}àA(ÎgjûY> endobj -1518 0 obj << -/D [1516 0 R /XYZ 85.039 781.388 null] +1540 0 obj << +/D [1538 0 R /XYZ 85.039 781.388 null] >> endobj -1515 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R >> +242 0 obj << +/D [1538 0 R /XYZ 85.039 569.353 null] +>> endobj +1541 0 obj << +/D [1538 0 R /XYZ 85.039 526.4 null] +>> endobj +1537 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1521 0 obj << -/Length 3228 +1544 0 obj << +/Length 2590 /Filter /FlateDecode >> stream -xÚ½ZÛŽãÆ}߯˜ÌC–V4ÉæÕ@ÄqÖ˜ÀˆìØAç#q$z)Q )ÏÎߧNUu³uä)X`Õ]}«®®:uáÄwý‹ïÊ,ŒLuW”qhÊònµ{Ýmhä»w±ÎH3fiJí+ƒK;ºÌ“0J‹«sôŒeW¡IcÌùæñÝW“è.‰Â<7wÏwqœ„&Nîò* S“Þ=®ÿ”‹e–EÁ㢊ƒ¡^µ‹8ØoK“ÁXï¨÷Tkïu¤Þ´XÆA³)VuG¤n\üçñoïþúè¸Qfò* -Óøm~½9ÌoœÝÅQXEÕ ¿Yf±a~·í¸X¦Æ¿DqŠãé®›¼­\ái±LÊ Ñ™Û~A½éL=~“`ÝK¿–./~'Ü äúr?]7P»f²žØïeé'’íÿTëDš§{¿€ÞŸuþQÈ#[ì¦vb’d–1=uÆ]÷î-Ò(xè´8Ø„´"O鹈 la`\~i>Ÿ„öÜÔ0U0m¥Ô¼'¸Ò9ý³üb¯†¯ŒkN@MHŒqpÔ™X©“_ùZGÙ¼tóAÖ¯Áó*äiky$6ö§x—N+¾µìF29 =N¯ŸºW!¬-‡ãAw¨§&ä-Tcü}þ¼šŽu‡ç£åi’°Œ¹a%„v­´'âš±#L*ik£†Vô¶ôßo¸Òwõç…նİ tÿ±?â¸5‰3MÓàWˆsÔ1ܧ߿Ÿä`¾Ù"éåXÏt àšË+÷ìP·?’*7~…Seêx%yˆ|›i€ö¿^þeñ-qþðWÈä¬5A“ˆÁRL*©‚§ãÈ//ÏÄEúZ‰üµc³•ãU[%àÛlQ¯[dyP‹ŽÖ1áyÑqñ~‘ɾÍÆÁ(ÄVWLζ€×KŠ¡í›zpŠ’Î6OíU¿k¤õÒÒ~ü¼µFœ‹cwBž4Î-Ñk0)Î(]fK°ï%›½‹Åz—,*dÞ÷-¯:2ŒÜ€„ùM`e*‚׶½CRjÔ R`¡7¡ÀÔO û ›‚ >÷÷àá“Rù¹µ«b £gJúÓÞ9¿Af|úùºÇ(bFÄÝ3H¼Ô7‚ùˆ‹Ÿ –x\»HÃè}Çq@;²S`å²Ì¢íGÌ^V9GHšPË‚#û?´¯¶UUÌ­ß#z­ã>ÍlVÎ1µû½xÜKõ뇩~Ò'7婧Gß½<ô«,E©Y;á^p) #ðž:9#Óüç¡9'í$æx2d¶o¿È˜˜®Ö,Ø©‰¶`ÞÌAg½È -7/Âû±ßYØ$%ç0Üh¬ vmXG…úg¢OànhÞí¿7_Æg\ -œ`Íšà| = sÙMKv“WÎq -ulwθh¡:ÜV_¾\”±Ú^ÔPóU΄?€ç¯>f…—ë™$Ó2!!±tNùÉ(gè e‰YRV-ëèèË­ñ$aRħn÷ÌwvRÐMO°í¥G1 dåHJZ+J©åLye…Q–žœa£8xΤdü=‡îØ´œ£5tÚI憅FGÁúèŒ2©–ŸïáQ¥-y\|àÀI`¸,‚ݯե£æ­$–ú¡£‰"0lpª¨¨xÙñ6 -Ab”4—‰Fv´rÅá,ZóÅm§‘öªê ú±.É‚wf—Y£¡yj༛Øó'ÁÏxƒfPf€í4uº`[æ”k? -‘lãJ^JcÅi>§1gaÜ×i'w¦¾Þ#½üÎb/ Íö0Òq~Ê@¢éyQziY_(WqWƒ %ÄÝØE’´Ú+ˆtSåžÔòÓ!sFŒá÷ž%Ò ROÎÂïetœŽ­qÇW=ì“'e&·®×.™ðŽ·õ ‘Q*ï÷ĺ1´Â[4ÓJî‡Í¾®Ù“«•ÂY0¾w¢/£D­n6ýx§®òò»·òc‡{I…Ô H~@O‹/ ó6œ7Q¦ÔÙD#ò. k ¥s3I…êij†Q:´jÎðš+X—¤UhŠ0Šëx G½7A΄Q[`µ¸¢¹áøµ¬0ù Ðf&4iB ònh§"á’,¸§C»þ—ؤû{%åâO«4‹‚?(é -GVðÞîbXÆú•â€ÖD쳻ꋋr›iò_ú(Xà×Q†ãþÌ1Ï^š—IL™Ìk`eŠbÉR¹ºE¤gF7Ê“jDE®õ´$z‚‘¨óÁÈeÀË"y­3¡ÉùMù$ ©¦XŸO,Ø7.ˆ¦ùSïŸ)Óߪ6 l6{ÉÍà)4<ú'ÇGk!¯kÉ@Xéa•¡`ÜB|$‰{m.Zð ôÉ9ßiˆë™Yt*¢·Jד—÷2äÂ}tº~Óî¥ù̯·“É;ïø¶ûÓÒÖµÔéÇ¿`r¦§äÖ]^“;…ÕAœâðÁ:{©ž='¦»õ¢¼åz’žè:1ò²¥‘¶ßʨè&#øÊÕà0ðð­eØ…y°êÚ9¦~{íÊ>µÁi;Ji=®bIÐ$ÿc€Y(äÙyY¢Šx/+NÓ°2ñ Ä"_µ<ˆ3û‘nq‰ Eéá‹ UDǵåYÅ&Õ5Qqâj,»\&v„/Z8L¶ȜÚCéó E Ú.÷ÜZžÑu(†[ÈÍ „æ鬊²†«n9—Ù¢¤X– a –ï«p7êêÉ/ä©&S ¥åuJ1yöT4O5‡æ.­}|x¿“ê}Z(¨½òÒ¸õ`U ?š½!¿â}íí/!æJ\¾Ä5+ýš²Hd³<=õWid5áWN«Â"³‰Âïe+÷IKìJ4w©h„‡&ŒóÓê»–7½g¡Œò}FÚs…ÆÒ‡âO×Dý¿¤B§Té5ë %ª¥­¯í›§aZ”ÿ«´ã«-ã0£=N²Ö~âûYKûåó=Zô0Nžzë8®Î>†Ñ -ûk« Ü9« -¸âB"ÞÅ<Îr![¯ °«¼|;ñ£ñg =iö±ÄæÔߪ+Z7åó‡º( ~u¾@ .˜¡‰®„3 3Þ*jÓÔ«˜{iâ(x²¥bš9×7¨³÷,³n=ø8¥âWiÎ3¾\ºÚð25™¸po”ëol(þ÷˜·„6Њ%§qÖ•zÏ ß q#¿ ©ßÿ:÷m‡kõqlÖö×üñJ£3CéÈpò…s.Û2ñröÌ/´#Þçs››…•ö~ùOz°Ogà†Äœ kæûtv|æC#Ý·ÖªXò²‘]à —²/"_¤e[eíÄÇG‰Dj&˜Ägž×†nÅ€’&>u-Ö²§‚@½Ï€D­&º7à\{:Ú¼^äî#£-òV~õ¨™}x ˜lÔ‰2³ ´ôã?A¬U>ÿY€© - O¸9߃&©j:Ç*ùî$3VÅiñaüÓb™“½|×ì›Á¥s˜ö ÛJäW.JÁn4m;p¢°ÙÊ4‘MUèw­ƒ5窰fvë Æ4È;¢øyE&tðSŸ÷^Ä º{3ŒÖ¯à‰4Ä__ApE]Z.P4v2å¬ÈBH’ç¹W)ŒŠ·*…´d†`ž2^ïnüÅ %†Iåÿ½ÉÍ¿;q3/ÿê„ -4Y®›A˜&>?/3e˜•æöÿYPá$endstream +xÚYmܸ þž_±Í‡Æd|¶eù%@ ôzÍa‹Csh¦WM?hg¼3¾øe`Ë—Ý_¾I¶3Þ´X`-QEQäCRßEðß:ŒTy—q¨ŠâîؾŠîÎ0òã«Xf¤Z…:M¡½1¸w£û, £4ßœ#{ìó¸ Uãœï¯¾{ŸDwIf™º;<:A²" +‹BßNÿŠÝ^ë(8ìÊ8̱ÞÅAwÞíU–£i¡÷`¤÷FS(—ºˆ“À}qjo¹ýØØñ/•Pp»ºC eNÿÈS.•ì[lëàÄb-ƒÏ¸ Ÿx…XÏ*VÁàTnPƒ5‰Lû9qìÅÍè¾É* ®Cÿ€Ò=4Ï<óT‘ê¯|ƒƒ±•×@’‡QYþt´Ü¬IJ *äKÊ,èP H4Bx!W'·¥aØdÈJ~ÃBo队‰"ëkÙ€ä„3Á!Q ¨ÅH¿NÞzxÚ‰îñôH)Orºãbš—„8Úë´“!’Í”ã ;NN6ú祡°‹_ýEY‹sQÅJïöŸ"ohõÃgs›Ìç·†»ã,kγÏÎk'ܦ~â{èH®égÖ;ijRÖ…}+åNõÌ/¬ÒËÀ^­‚cO« ûRƒÍì“B#L$EFèðû‚ØœlÜk§pvþŽØU;r߻͔«.ÄòÈvj‹MÛ£°"€¥³ˆÈ͸µ®@úó`dz-s[ó¹þŸ({õÆ¢À'ë «­œãÎVáP ˆˆ< Gx6YÎù,€Á­Ÿ¤ÑŒ½’cÜ\çMÉ +×$Ã3‹/øÓóÈu¡×‹'£‹s`ÿmÙ?ÐP–¼êñÖF¹¸!º;˜ìÅtÜš!.*¶Üœ#UYð¯]¡ü4Ž+ÂÀ+°âþV,rç6GïgžýÅ©Þ^ü‰l:wbÇñ:ÇÆcmãGױȧ±ú«tÇ- > _§p”¥Eb5:°˜4#¿ñ œ%–•z]4»æ¯¢!_1ÐU.Šá²5ု–Ðæë%J…6ÜMÑœ€‹çýÄárz’eþt²Fí[—A7¬Ð¦ÌF‚Å4M‚t>UAãî)x|øȽ”×¹`¦T´àWì*Çç—¿§nSR.åFɆ _ÀÿˆTwl¦9„ÃJö‰†"t=R˜¡¾y\*v˜Æ‘DÓ ÚùÀ#­yRºô=R>Âœ°Ÿ®µ‹„Y©³ ÉøÈ.Çg´ñY%KË,gËTEêòÅa´Ü'€äƒ+În[HpÁá~ OL=õü%8Cedĺ=Zrb \)„!ÉCß¼‰ô:èÚ…oœ¼åë@>rtÂÜQñf0ÎBÊpßÍRÜ^Ωv쎇çš$΃EzÜp¤Ï?Ò¸îߦ¹cxZië9fÛ§†»l;sçuB£ÃÌxåÖË0iå0Ž`‡ñ©¬y;÷¬Ö +"³ZèddØ›¶j8³ÓáfÐÀ8_“ª¯©í ¡j™‹ ÍÓÀPÇÀÇ6hp~”†½‹{gJוZ„!Ü–rd}™¤-Y.±târ>c'’|¼ué¿UO˜ä§Ä«Õ¬‹`Ä™¸uaZ€‡ûvAåÕíUT™jFZCPçrÂ.ê=…=¼%-ºz2~)&Ï õwï³hQª$ •ÃY(ø®ÅÒ r®?¿*uêÒ-‚ oùÆi˜'ú%¶™„ÆJ°hDeîU‡±.—¹À¥BÏÄÛ¼!Ña™%²ßÇ^hË[q™”ÖåZʸšrÉ|™ÊåšËør.‡ùºéèRf4üùéÃhNô]Ò  ‡ã+Kgìó‰¿ËäpxNSsI²+Ùr8O­ÄØQä–,6—z‡‘-6š3…í‚yeV”µ®Ž-±X<Óu!<&¦¯®0îé³iµøÐÁ3¦†ó¯2øµN²à4NHl#\ j÷JÊ­º‘‰uÇ_#BH.rH¾ƒdªb©ñçÙÿÏa#Ü^$’•óxè4=a ´&ð;Y”gâÓ¥_ÛN‘ÜZ •¢Äi7RdWø¥bQì +xÀQQJ§aÖû¿¾B0l1~0X¿æé£8ÿòg»ø8#xs“]/¯éÍÉ—JyTô¬ÌàòŽ¦~ Ls¨}-Ê<*{”täþL~5sŽÿ2 ea Ãç¸í`Ú'Ù@þâ"pß÷B H—.xl!Ý ¾÷]#х̱srúJF@Í›Õk}.à2¦nÅ÷õ­Â2ÝF=L"*‡xÔx£ì` Þʶt;¡˜×IĬÇw¼Be‹{•¡ÆW¿T… QQ=Ô¶BõÇowuð1µÿ«´{-¤Œãi™ê(øƒ6$Š„qΑž,ÿ+«ÐénÿWôqˆ+kç O)J^…›îarªÄys¾ø®¢ßý+¤öoboÜk˜N‚GÓrdžÃ/ØZ—eÈÎxݪtÔ1û´–¾ËçI½|Óñü,B¥¥ŒÖþkYÆÑðEåB÷S·„·’µ‘—šªí»CøÁ]Q–`]]pšFO3qpÏ[he¿pfxe7j!ðÓ°ˆßUÊŸ¡ŸÉA€Ç#¹oËtB.ÙíŸä{'SÂòç?/YGî!k­SèŽÞ#×Ïro_F:yÊÐëë‹õR£…쎑«Ø”òû‰æeHAî SYÂÑ¿ÐáÊûx‚Ï-xlêj~Öò¬ ±ÝZ#\窜V÷o}l–CÙ`#½p»çVí-2¥ dWI¶ M”;¹ K+Ú£Wæeð3œçÒ2G%éæ ø\†úŽ.¡0)—!P¢ßè nEÇ€I]?´‚ÅÐfÅÀ þI—W\nv®ü[¿òâ$ª>È0U´ŒQÑ*«fÆN“ >éºÒ!xB¡¼Kc]Y.YÎàjl ™ALò.~$jª·wvøÈGÓîß´3h®J $ŠTG ጸ‹× +|ÀðnÃBÖhº¼ö\/“UÀWy"|âeäRa9³øãÆFe˜kW;üÞUæòÛoZ…üêo_øéKEaR.øzñ0?óöç/e¡Ò™0CaTþõ~ZAH-ÔËþSÜ·endstream endobj -1520 0 obj << +1543 0 obj << /Type /Page -/Contents 1521 0 R -/Resources 1519 0 R +/Contents 1544 0 R +/Resources 1542 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1526 0 R +/Parent 1552 0 R >> endobj -1522 0 obj << -/D [1520 0 R /XYZ 85.039 781.388 null] +1545 0 obj << +/D [1543 0 R /XYZ 85.039 781.388 null] >> endobj 246 0 obj << -/D [1520 0 R /XYZ 85.039 761.463 null] +/D [1543 0 R /XYZ 85.039 761.463 null] >> endobj -1011 0 obj << -/D [1520 0 R /XYZ 85.039 667.044 null] +987 0 obj << +/D [1543 0 R /XYZ 85.039 653.495 null] >> endobj -1519 0 obj << -/Font << /F20 937 0 R /F15 951 0 R /F57 965 0 R /F36 955 0 R /F64 1525 0 R >> +1542 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F60 1548 0 R /F36 955 0 R /F61 1551 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1529 0 obj << -/Length 1103 +1555 0 obj << +/Length 1676 /Filter /FlateDecode >> stream -xÚ¥VÛnÛ8}÷Wy¢JEÉ¢ØÇëv[¤—µE,XKŽ…•%¯$ÇÈßï\HÇNüÐE8¼ÌpfÎáÌˆÒ áOz: B•y©–ÒÚ[mG¡÷’w#i5|«âŸèÜä£ë·†Af^¾~¶“q¢¼¼¸³?§_òùbì+¥„Æ~šj‘/¦ãH‹Ùû±/ŧw,\Ž¥˜~¼™â*¦Õ·e>‡á#Ëg¨<½½]Žïó£y~ŒíèâÈ0°Gw÷¡Wˆ£0P™ö0 âí" ’XÙu=ZŽþ:šbYìñ©K<$J‰V¯‰É RF’‘—&a„11±1ˆù±DÍÃØe"†vÿ–u‰Ë‰8TÆ»±ºe·­úaWmz=«Áœ” /¿‡2>1òÞÚBgí¾IÁ;}iºÕ8J…õ±QÛ± üJa†­¿Æl­íÊz6%^0âK$,#€ýЙh*g°0ìè?îhaš'©¨[×þÃKcå‚=Ýï;XtíQŽ1ÔªiQ)L“P‹)*µRg áÙŠZUo%-[38"P¼ßñˆ¸ëKÀŠ²_¡Ãï$ ²AŠáýT)=¾+LcF­"qµnk@'W|ü€ªŽwÜؘݎ4ö4 ÓðØîž4l×Mê 5T5¨¬ibF‚Q·}Y„Óf,Më ¢ìi8yð ÝŽ³ÂÒ½…QaŽYÙxD•Òžµ(öL‹tûÎ ÆQ¢Ãj¨Ì€D;tÑq‹|¬†ýPz8 ÈXfª‚ -#böÖ,8lãîRáŸra/Þt˜ø‘Ñ¥-EùÀûk* (ç«ãIÅ¢²% z†‡â#µ•5Œ1áyâ…2׬,E$>+#Üy®TXôΨÞÉ@X®ßªÉI3R2 dAR#¦ë¢|¼nöuÍšgm+™ò€+k•Ë‹9R© ¢,=#‰;MWÛL9P• L¼ënR¼±Ò JÕ‡)iö=iØœGŽ:à8Ê ©ìORhm\fs¯Äë\[àï· ð¡–U„:¥hïv~%"ÒÑDßó¼Ý•Í÷0 ¯Žì\½aÉç¿|]€LBŒIšˆßyß—<Χ³Ù|És´ð…›66lÚ+ʦ* :ÿº±üÿ`¾.>ºýÆáàÎ/Eóò£e €ØÒ`:NƷ°âÛêYPÙqèž\Ÿ¦%ê—ÛSçê~à½Ö~Ýš —%'2Èäägr5†ï°ËÕ®4…™7Øp‡c=6ì³;ö‚§¾V?a7ÁÎMÄM‹É„z`(äîèGQÄòìÊòë‚[ªS½ú5ŒD*T?ƒJSK«¸1½k„«¶ëÊÕàJ‚º>^%Q| `k¼ü‚;Œ²Kø1˜_z'Ÿƒ± -´Ê.?‚`o’Æ6¨¢—áºçÔ«xÿeendstream +xÚ¥XmoÛ6þî_aøà µ"Y¢% ؆$KÛ}[b (Úb`,ÙÖ"‹š$×Ë¿ß½Q–caÀPˆÈãñ^Þ‘öÇüùãX¹^Œ£Øwƒ8¯v#o¼•W#_8fÂ2ëñ\-G/U4ö=7ñ’ñr}”£ÜPãeúŹ~}ùqys7AàÄîtE±³¼»œÎcçúv:ó÷¯xñ~ê;—ï®.qÒìóýò>ïxý™/ß¾½Ÿ~[¾Ý,;Û:­`G‚†ý=úòͧàÄ›‘çI<>ÀØs}XÞÀ2W…Ì‹ÑýèN¯…cÞ5Ä®Šƒó@øj Ês•R LÍnòvË#ÍŸýRÓb\žŠìdÉw2Œ~Fï/^.¼ž6o<›G®£¢¦­OãŽʉg¶ÆoèÌ*þq49~ON¸¡!1¿(ò7·¼¾ž*Ê\³oYöàEè†Qü‚7Rvý'ŸN:ó!Ü +d°§ q¾7-:¸ðv+ƒÉl=Á‘瘪ÍM æÔ2¶¬í˜¼æÆrë¶Ww¨Œ“”2™ ¡)BÄrš&®ƒ÷͹r¶|q²p0톇Çl“ $«)YË,Öl׬ Ý+Zþ§Á‹WäEiÝ¡¢X`YA¹·¼™Á«kø±åÕvK`ßoº¹Õ¡e¤Šþ³{¤“CÈøÞ4=kµ0ß2ßc)ÞŸçPÒæAŽ«êxtÍÄÃIï)™x,>ê1HiˉÀÒªG輜BG2¢…8þÁ-”Óª“Fõ*qò5óݲpm•p¹>ÖªéÞÚ‚Si³"kaVïr²¢á®Ð°0îEFQ`°/‡!U-’R‘t˜ÚÄ)Slbù 3mMÎÁ KŠ"X Œp^êÏ˻ЎùÕ¶Ò ùHÑèŒSpÙ7> endobj -1530 0 obj << -/D [1528 0 R /XYZ 85.039 781.388 null] +1556 0 obj << +/D [1554 0 R /XYZ 85.039 781.388 null] >> endobj -1527 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F36 955 0 R >> +1553 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F60 1548 0 R /F61 1551 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1533 0 obj << -/Length 850 +1559 0 obj << +/Length 835 /Filter /FlateDecode >> stream -xÚ­VMw›0¼ó+t„ª¾ÇÄqš¦Iš>û’——ƒk°ëW )à¤ù÷]²± ؇$ 4ìÌÎJ+QDàŸ¢@bÂC¤Šy ùÚ!h 3_Ú „äX -ãŽIßÎúŠa"t'¦áð5 1Ô`.§Î—kF#X)Ž¦ D)Ãœ2¤Bh=»¡çKIÜëU­<ê¦KÏçJ»›"^l3Vî*]d'n¾À¬ô|êh–ÖPûû!GÝwƒ(¼—é­3žn%6 -UH° Iä3Ž¹æƒ*¥ÁÑÎ -ÈYíe–QÖbZçø—I¶´r£ø×f¹\Ù„³Mùº)ûDK ]²˜Æ ûŒb©º…[MP¾k­·Ê©D”à„•r&±‚$,È(§øPåSŽZ‘ŽéjÈ 6bÈ=¶¢Ì^Á ÎÝtg<±©g[ÍcóN¸vîñjt$Ñ–€JÌXpÂ’hÀ’dD²^K†è¬%ƒlÖ’[§³µMÙ8°‚3K—๲¦LÌn¿pƒ¤™.³}31ÌEIb~²ÜÄ1›)éuP¬ô)÷v ÷ɇ÷º7DgÝd³îµØæ°žXà~Ô>Ì=¦ÝßqõóǼ£zâ­zÈ‹½¾ï³ÅÁj¤.ŽÝ->ªïJ[‹5gu¹L)V9Ð5³YþÑçµ ‚ªY zÝõ{mA&{Ñçõ ]ãõ0[ãu›­Þ¤Ð›cîÍ÷1dütÄx¾Çÿ×y~!(·t¸0@ï0&˜†!Z;¼jmõSâLœŸ-u¨:CX „ïé¼û1º¸;Æ8œ âS„5¡†…1αnÞ»¿0ËptóíaläÁ¢õ''4mí iç'O°:¾ï$`¡u"hæG›<· ;õXè–#3Ìêqž%“m ê ‚ä¤VçjŽó7³cªýá¸Æ¡>Søö¤í0€a Ýõ¼8¦&3ãÁl] +·gQÑ]%3:/ã«Ëëd¶4 ¸a ¸$€*ØpÓª„í0ä#ÕŸèíŠÂ-žè;Ð@ÿh@†_öö!:Û?Ùlÿh±å,/?áôo.L° ÷;\ïun‹<ÖɉÂ\ª&Xu~ñC>Éa•¼Ÿð?Òo‡2endstream +xÚ­VMs›0½ó+t„ƒ} !Ž‰c7M“4û’ÉäàÚØõãpÒüûîÂØâÎÄ> ØǾ·OÒ +Nü91Š2’Àp*!óÃÈ +"_^!|%©ò}·6:Ђ2?hÅTƒ€‡Tú1Sçl,Œj-Éti…hè1ŠLnè ”bîx,ÖwoÀÝ•7Z»»,Zîâr¼N–[O27Ýh–# +áÛÃA}}…4€ãî+"2ïiz팦µJËhjtkŒ „¤2½Ej0ÄU³HîCÙºY¤Ðpåe‘”—eÞEy¼]Yµ‹èçnµZ'«ªˆ]þ¼Ë»4ƒ,QúÚ¢Y*Êy¿fe å"¬5sE8£! Qsh fI,5sz¬„3°MÒÈôŽÍbúé@+• ·É—åÛgðAJ7Ù›wY„S™Âd¿¬ç>ó]»¿vØ¥4/Üïudév¤Â BÑíHÛÞ‘>ºÚ‘_%³­ XÃZ™Å•Ip_8“ǸÀ.º€A\…óí¡—U"6Å<¸â.󤤡ü`9í1ÝæU,Fv›×ö7¯®6¯Á7‡Õ$ŒûVÚ0÷DàþŠŠËo|-ÊÀKqcWXvÐW ¼]-IîÒűÇÙ[ñ^m¤(g Í^§@‡ Ëߺ¬Æ¥ßoõÓmu…ÁÒýn«{ØöV÷ÑÕV7øÊ +=Yá^}AÁïàº>TðÇy|bdJ®FehÈ+ŒåaH6t;(«¼‹‰ó£¡´ÊõR ùИ›ïÃó›ce‚IÊá0ø e6W¿2A8M›ÊnÏq¯¾ÞPßÙØð´1x8#4Y®JÈQµTj ™„mbótOê&Ô½]'0I«:J_pï»&ÊZ2Ê€†ÁéÒëöÅAñ©î±â:1ÛòòFÏh0œþòbÏ +,ø’PFÂ2Ç®òl´†ý¬øùíÄךr£{ÛIÓÙN,ÉUg;éc«ÛI/m'M¾,Ÿ¥ùç} HF¿U:©‘ïuJ¨F*]%+γð˜OISL\'á? +wŒQendstream endobj -1532 0 obj << +1558 0 obj << /Type /Page -/Contents 1533 0 R -/Resources 1531 0 R +/Contents 1559 0 R +/Resources 1557 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1526 0 R +/Parent 1552 0 R >> endobj -1534 0 obj << -/D [1532 0 R /XYZ 85.039 781.388 null] +1560 0 obj << +/D [1558 0 R /XYZ 85.039 781.388 null] >> endobj 250 0 obj << -/D [1532 0 R /XYZ 85.039 761.463 null] +/D [1558 0 R /XYZ 85.039 761.463 null] >> endobj -1012 0 obj << -/D [1532 0 R /XYZ 85.039 667.044 null] +988 0 obj << +/D [1558 0 R /XYZ 85.039 653.495 null] >> endobj 254 0 obj << -/D [1532 0 R /XYZ 85.039 667.044 null] +/D [1558 0 R /XYZ 85.039 653.495 null] >> endobj -1535 0 obj << -/D [1532 0 R /XYZ 85.039 639.536 null] +1561 0 obj << +/D [1558 0 R /XYZ 85.039 612.438 null] >> endobj -1536 0 obj << -/D [1532 0 R /XYZ 85.039 639.536 null] +1562 0 obj << +/D [1558 0 R /XYZ 85.039 612.438 null] >> endobj -1537 0 obj << -/D [1532 0 R /XYZ 85.039 626.656 null] +1563 0 obj << +/D [1558 0 R /XYZ 85.039 586.008 null] >> endobj -1538 0 obj << -/D [1532 0 R /XYZ 85.039 613.106 null] +1564 0 obj << +/D [1558 0 R /XYZ 85.039 558.91 null] >> endobj -1539 0 obj << -/D [1532 0 R /XYZ 85.039 599.557 null] +1565 0 obj << +/D [1558 0 R /XYZ 85.039 531.811 null] >> endobj -1540 0 obj << -/D [1532 0 R /XYZ 85.039 574.58 null] +1566 0 obj << +/D [1558 0 R /XYZ 85.039 493.285 null] >> endobj -1531 0 obj << -/Font << /F20 937 0 R /F15 951 0 R /F14 969 0 R >> +1557 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F42 967 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1543 0 obj << -/Length 3491 +1569 0 obj << +/Length 2669 /Filter /FlateDecode >> stream -xÚ•ÙrÛFò]_ÁÊK¨*08ãrm9¶ãUV±½·²Ù$ ‘(ã`P²^öÛ·¯†$Hy+sŽFOwOß#gfÃÎ,ò-[ų0r,E³´º²gØyå„ç+Ë÷<Ol.ôî"p-Û 'aäŒEèÄ–ò„ùquµüɵg®mš­îgŽãZÊqgAìYžòf«ì÷¹c_/|ßžX]/TÎß^/œyS];ó¤¨yéó'˜½ù¾»þsõóÕ»Õp¨œ©±MeÏ®²Tè^¤9Ë\“fÇ.‚šAŽ Í–ÃTßeußÍ@¬=Ïöi³6šúÅ‚ë"Q# åø386¶ã¢ÜÈ -ÈZm‹Hˆ Åæé¾Êëkô¼œ•°Ï{­õ=’ÚVI_4(𶑗ؙï`§mÅC‘Á8çåDÀèÊ`þˆMû¥ë Z -ý–*› Nkžu¸· ”^“ƒ*ÆÒ}(Òœ¶_¡;,¸>\?œÓ,ÇqØhÿd¼ÉÌðétý€èDàŽ [€x@Š‡™u½ðœx~#øQŒ|NÎ"fS•<ãoÛŽ8Å…æþøš›„þ,p|ËuÅâp£ÝÄgÓ¼za€Ó•«À¸òcœ(©mßï~X.«¤(·M×[$LÐÂÐR`p$SŸÓµc¥Mµüoù%-—iqßÕ}ÖÀwµÕíÉw#T/š¶GN:Œ…†Y@§zzŒ i[UJhcÛ”%^ ®¯Q¼O<¾ÝÃí|îJøsÄè ÞR¢V¬-eÆKkÔ"R]…“†Àºb €¥ìÎk y™}‚5á– Ô<‚íóDNE0ÁÁ,BÔE`aÓ6ÈÊŽ7þ°}[ãÑÊŒ$=©ÑžÂ/‹ÓdW,í{¦Á £ùê Ò‚Žryó —BQ÷¾'«ÛtpªÃ° Òž1PrßkjyES„ͺ„I±Iú¦}âíVƒ³\ÙÕ4=ܪï(ÞÞN‹q §tÿìµÜò¶NªüÅ„Ø%]'ÂC¯ƒ -8ÂN©G7«À¸Qؾ?Þ Œ58îö)Ý${”î/Ë'Þ—Ä°¤ý9Íùt‚<ÉŽœ!«J4és! Ö `÷9‡d¯“7¾L0H>Òñà#”ݾåYþuû¥‚FÈÌÀ‚r|ö‡ô]U!Ë;üDN)lÁ’ð„$•t©̳¼-Øà ‚{kÅ8Ðr“švÔ<јYòë„ÜÉÓÁ!}Ÿ·g­xO„PÒ‹Ñ¿h˜Àá¾+êØ,L?°1W hªXÀ×”6„/~»Žj+q·,qBdžg<Âcðw4AYßÊà0,vFCÛèßð÷CŽtèoÉ&” -ºª­¦—síÑ (LÂ(^Â@Â9]pº'öHÓÓuäÍ­AOz†&óÞðMÊÇ:ÓËàg‡Ç„$‚0týTV—€ØbÐòFßùt4‚C‚‘éètßÔvL¯Íbg” Fr1)zº6~8®xWAQåÌTè@Ýï>S°iè…~Z°ã4 -¶º_ï7à¤þ²ÚÔeK“åÝ›Ï7ŸVwË__[ïþýîo¯ÝWEÅ¡½¼}5€¿üøêõ˳†òé•+ÿ„5/ ºQù¡Æjº˜S–ç{²oåÞó,×óžá^€¦ÊÕ£ªl¸·¶=ÔÙG,(»3ã¼䄦IÙVÊäêÞÈÂHp‘Ý£aÞ j-xlLÄDéP—ñGR¿³€5¹?}YÄza€Ÿ²sŒÙ¹å*žCQI |¶>,-6'bsx,dy†,¨ùýà€*ò½±=:œìĵ…bÉ¥}$=!éŠ'k.ýHûÝÐ…kŽL¯0xQg~Þ¼mƒoVðü‚‚ ¡à]R­«i7ËtS, ’¹–Õ}·´%{È¥Çá2“ýfi«Ø™T|/p¬Àõé>¾Yžý/ˆZ÷rÏó¦¾Õx'zI)X~äÎŒóNY˜¢&­× Ë‹##éñÐønHŠƒ Xh`âr–ƒCånä†W(±¸'S!Jú¡ðÁ]é³ñØå7:;àJƒSQÚùqOQ'ãÙAÇÉ£B* äœ3?ê©¢Ç ¼¡äv=±åšc›f×%Åã rŠæ¾)ô6&t.&yøù;ØÃ:èã‹wWƒ…z‘ü†R;PBL‡õ1nê~Ž9Óè{IÓNûC³ êê¦,)™ÂšUçu¸ñ‰zÒ“´+R3׋Á‘–ÿuõûŸö,uúùʆÅhöˆšoaͪ+ЕPɬ¼º»ú§íÕÂÀ5ѹ´}˱Ç‘ü»ÿp -Ñæ›zÉ:ÆB@t·Ãþêüa;Jÿ?x¦#c[€WPûÛÿû?naPÇ3‰ridL=ˇ8îËþÝow«wSX”GíáËX<Ù³‡*°îß45viïò~a~Â,.M» <žoENøx °,›MSŸÃ}#ƒŸ’6©òÌSM-€@ƒ—¢{ÍuzíëÆŽrü‡ú‘.Xg1±ló$+z®ŸŽ -d×–dÚ¥o\´ËÅÄV6u½&Oî§OÜ>„=™‘#ÚJ•Æ¶æJõGÜkêaC&Ÿ êd3lÖ/Î×cˆ k."¤æÉpâYѧTõðRäGÒ*ÀV÷Bl8ˆ<0Eð5V¢8°±òô™7øê»Û"Y“·-ú§àç;\Á+Ò7¹%rKNÙú‘;Øa²=nZÛþ¼*t¯&CW' NNË+ÇÝI)­]Ãå…ÜøbèÒa—?>lÛÁ5~Ƌب¡AÓú5Ök>'‘ùk|¸á1eW 9[ëôR}Ýams9Æß‘Úis …Ü`<Ñûpk˜k>¶ ,6=tI‡÷íø®çÛ:€¹ñ\º_-‰—ZÈ„ŒªOö³¨WD:s‹wA€L©­³Ôó=qü4QˆfFÖ¹×_Êý -5¼5pH{<ˆôC¿ñBÇzhœö=p™·ã1zÊ[fÃË,ÝTÄ£/Pæ}΋üÐa ƒÞ¼Ú¢g>ofô¶ù‹„u|õª7æshJ†8œS Ï åžÊšóŽ€2‹žå•èn1!E>e5¼ >Œ‘vš§Ë³¶ãzäG“É¢†Y@SÉ¢o^0`¢W{ëä<…Žº|ƒê‚Ñ—Êø“R?®3;¹…©ùOضN - -L­àì9hâpË=5¾Î*ñ€’¥ +c¿ïTãsO•|žm¼ƒÖø ~ÅÔú­ëÄ¿ë¶c ì§TôG®«H²ë¡šßUåvÐÆ;°T“.ó^j÷Müš²­Ã¿B;û×häT2°6ü„ü›w|ž¯"°uþÀÿè‚·yendstream +xÚ•YÝsÛ6÷_¡éK©™ +"~&“¹I]7MÏçäbÍÜõÚ>P$EqB‘* 9ñKÿöî@Qíú¦Ó\,¿]ì`9sá?9‹áªdÅR¨8že»+wVÂÌ»+i8ü@‰À÷a<1¹°³‹Ð®Mò˜=‘L„ò%ò|¿ºZþè¹3Ïa¨f«Æ®ˆã`¶Êu¤;_ëÜ­æ FÎó…tÚÝ\:iÕ0éÓGøºþ¶Ÿÿ¾úùêf5ìy&m•;[xJ¨È{rD"j Yú D8†ì…ð+ d!ô{ÖèŽ V×É8΀¬qPÁ mžÂmD> íÈCÐd0ƒÝ7A âXH/!h«mÕϾTN€¼ØÉ»‘4s/AL¾ô Á”FK§g"7mÿîpAª x’¦[æÚ­kqõC•Ã¸`rjØðñû r´ÝgÆ8•öÅÚFo™P·eeæz‚‹0ªŒÆýw0£NV-Фxº“Uo¤^‚B˜ç:MA"ržÙ †ŽÇ 9aÈÀI8‹î‘˜/"×sÞkžd£¢h#·/ÉH5“Í¢¾jÐvs~æ* E†³ òE`Bé]i>Nß2/ŽÜtú*þ™D4ÁVëý«år—Võ¶íµÈÖRdínùgý9«—d3ð )"/:1]VmúFç-,l„þªÏÁË(aÌ‚P>é±–g1bºtÙsI¸;¯‚ãÍ(ŠØO»¶®ùéìpz6~äñí&?“Ñ‘C°f‰!XháEÂMX1Jdd¥ƒzð‘³ÑT?•0ßÖ=u+Æx^ä¨Eè™& Î÷P[¬@¨vû¡’žÞp–»Àùaèm|ç–{tÞCŸ\Y… +[+p?‚ ‡@ƒñ”«#ÙnßgCÆ]nv&c`yÜOõþº-;ªÉxhPp<:ß´ÓüA9 ~Ñ'¶龉5ì@7 +­ÊRSÍÐ}AU¾Pá‚çJsXΔîGó2GU§kcgÜlC^·c6nxw{A½D«GòÛºýƒ Êë ‡Ø§’k6Œ÷JÙ¬Ê=&*ÑX£k”S7ÇǠϪûìé}:@KMy‹1mC +i d¡PôvÜUÂt߸‘ º5ßhÞŽïûQÏRÙ^‘X[sñµ¶쯞¸z+,™„s ³—ð÷å5ìLâèÖèõ¡Ô]ú‡è2Ñ6"K—÷ןÞ\Ý/ÿóVÜü÷æo½7U“'‘¿¾}3°¿þðæíëo¼Dçð7q NñŸ?ÖxJÄÒÌø2=¸˜ùIü¬Ž–çﯚY÷¸×b«wõÅ=XúBzñl´ß…–çÔÔë‡ç'BÙ$8ò–Ef^eÀ?rã¸ô°I0IÏ<‚˜x7^»·¯XôŠÓ»ç™*^$…¯Ô€àyC[îňýR©s™¨Õ-×Ëñ›¾ã~È´—]yad?‰Ÿœ";7²áy‚É Nðp6UãKˆ}2mmÖÖã(õŸÌˆþ1Iç©`õݼ»¨CàÜA¬f2ðEÐÓûW¿þîÎr𕟯\Èñì :µ€˜™í®”ð"e¾ê«û«}ÉÊZŒ„]úRàPù‚aG4ñýÿøáÏ÷]¨xá‰ù»¢¬ í6ݱ]7ûHá~•¿¹RÙÿ‡4tÖ]ÿôÏÛ!yù£ï³#„:$G—xšMÉ,§ž¡P¡oXîÁÛÙêfJ¤ãÐ _.ëšÚ§nÔº_›gý®­ïmÞåNq,‚è;)‹_ÅÁ·l«6a‡H$ÑˡߺnKþ»È¹> endobj -1546 0 obj << +1572 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [418.678 611.807 512.306 623.8] +/Rect [365.77 571.16 539.579 583.152] /Subtype/Link/A<> >> endobj -1547 0 obj << +1573 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 598.561 285.125 610.25] +/Rect [84.043 557.913 177.671 569.603] /Subtype/Link/A<> >> endobj -1548 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 367.922 512.306 379.914] -/Subtype/Link/A<> ->> endobj -1549 0 obj << +1574 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 356.797 147.672 365.456] +/Rect [84.043 300.176 509.849 312.168] /Subtype/Link/A<> >> endobj -1550 0 obj << +1575 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 340.823 353.306 352.816] +/Rect [84.043 273.077 315.124 285.07] /Subtype/Link/A<> >> endobj -1551 0 obj << +1576 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [306.355 327.577 382.391 339.267] +/Rect [270.437 246.282 346.945 257.971] /Subtype/Link/A<> >> endobj -1552 0 obj << +1577 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 300.176 462.621 312.168] +/Rect [84.043 218.88 424.439 230.873] /Subtype/Link/A<> >> endobj -1553 0 obj << +1578 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 286.626 347.579 298.619] +/Rect [84.043 191.782 309.397 203.775] /Subtype/Link/A<> >> endobj -1544 0 obj << -/D [1542 0 R /XYZ 85.039 781.388 null] +1570 0 obj << +/D [1568 0 R /XYZ 85.039 781.388 null] >> endobj 258 0 obj << -/D [1542 0 R /XYZ 85.039 761.463 null] +/D [1568 0 R /XYZ 85.039 761.463 null] >> endobj -1013 0 obj << -/D [1542 0 R /XYZ 85.039 671.062 null] +1015 0 obj << +/D [1568 0 R /XYZ 85.039 657.513 null] >> endobj 262 0 obj << -/D [1542 0 R /XYZ 85.039 671.062 null] ->> endobj -1545 0 obj << -/D [1542 0 R /XYZ 85.039 642.326 null] +/D [1568 0 R /XYZ 85.039 657.513 null] >> endobj -1554 0 obj << -/D [1542 0 R /XYZ 85.039 138.017 null] ->> endobj -1555 0 obj << -/D [1542 0 R /XYZ 85.039 121.74 null] ->> endobj -1556 0 obj << -/D [1542 0 R /XYZ 85.039 108.797 null] ->> endobj -1557 0 obj << -/D [1542 0 R /XYZ 85.039 94.642 null] +1571 0 obj << +/D [1568 0 R /XYZ 85.039 615.228 null] >> endobj -1541 0 obj << -/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R /F14 969 0 R /F35 948 0 R >> +1567 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R /F42 967 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1560 0 obj << -/Length 3211 +1581 0 obj << +/Length 2435 /Filter /FlateDecode >> stream -xÚµËrÛFò®¯`ù°ÊÄbðÆîI±D)IöZJíÁñaD‚$Ö$À@ËÊק_3Eª²k­*s0Ó=ý˜~MjæÁŸš¥‘ëÙ,I•¤él¹¿ðfXùõB ÄB@=˜Ÿï/þñK «ž›yÙì~Ýí¹aÌîWŸœ7¿]~¸÷q¾‚ÀÈù"IRçöž'Þ¾¿¹¼ºåñÇo~º›¾ÿýâݽ¥kwýßŧÏÞl þ~á¹A–Îaì¹ -–÷@ÕÂ@žwwÿ¶[ñZ8c¬!C?výç¦i8£”ïÊEDžy¡U„ŠzŠP~äÆa<3@¨‰È}.œ -BW³ÞNçääjAæFitB­ÝΕ“ƒf“ÈYÖOxj«M­q°-–¸:M±ê ª5þ'˜·y[ßñ£rj|ûi÷ôŸtƒÍ#Ž«zeÁ[Þn‰ãj¿×åê5̤óˆôxËL0âqx+ÔbÃQe$ˆÞí*„xœ/ü ]ÿœÇBòKÓ궨JœŒAJþ‰³Õ%Ào¾h :¶Ø‰ƒm†Êwî·<HÝœ‘Ž÷.dõÈ€ ðªO<Še^ë6Ǫל]Unm^ïù±!½5 Éø¡óÅjûiž†2*çÓUËðÂ'@܇]ÎÈÈ .Õæ@þkËV ¶… /á€p…ÔEçäÇòðœ“ü`O¤‹H¸U¾Ö¨”]Ë>Ýi·;$œGµÊZàgwÄïãL¹iNF¤ ¹†«ÊÍ#p q×H²k€ã(¨ªù"Š<ç®:Ö¤•¼ãB¸ðˆàŸ>x^ Bw*…á”{DZçza6íÞe ëæCUßÏÁµj½d¹ÐYƒ”uµg€[:½v_•:œ -MÿéEÞ]^-‘Ø©ÉC¿HØæk0¥ØàŠcì£ÎœÑ~»? ƒ=¡AÅ@!/›-²Õ‹ë3}4æŒb]çņaQ+åO¢»Š#hég¬Ðy[íuQ¾âÙº{Â!Î>ðÁÕ÷‹ßáO(@€P¿Ü w(Óò¸'³(˜=W\°\ËbÝÄnû óĨ$*sCï$éð'$ ’„óœò´c>íù®§¢éÈÒÁŒG–(ƒp’f'‘ÅçÈò¦ÎW˜s†90ˆÿ¿¨Å Òì…¢Á!ÿìúÀY——”ÝÀ;2ô¤bþÁ¬¥WÆIÖük2±µ+Ò†9{üñö°6RÎõ{ÐǯïoyîF»fWµ ÚCöLŸ^A ¤L†aPìŒlÇl·ÝöÛQÆú©oý%V%Õg;~ðˆÿ€ÕßS+'ضŒJcKÆ@Ú­¤“­`³)ëzν®^Ò/`÷¢†×bš­Ý¥£‚ú}aÌp"H4iô‚át@†#@¨Ž`Ôp¦ÈÙ¤f §G/ÍØýS/®ÞâØ· ,’êRÕµÇ`nMmŠ½6ÝDÁ^œœþW)ùªrqڢ䕪4xrP }¤Sò]Stø¢R˜úMK©q ®âžÿÃB‚¡ -7¼tÎd,ÕJ,é~ÿ²Ñ¬â‰]^nÚ-H‘sµ>§2¸í™gÁŒ'¬ÌW åú’GE+¿d;48t‰zIÉȺµÛÖP¹‹ f{jÖ :u\“<¬½¿çÁá(yWÖYªjàè°ÃM\„Mný–üX™Mp z„½¨Í°V¡ž­øq¼"ßÒ Ä¡Àz¸Þã©øô©a>MÏÉ÷‡¢îŒ×¶lŠæ‚ÓÖŠ'¤qgÇ’$¿ß³òa¯œ ûlûÎõÝ% ‡]ÞðàºÚP¿4FÍ÷N®*Á9˜Þ¿I£TºÄàð|Ý$"±:¡õ€ºD›ãØÉò^ª; Î )•Ë$¶ç'¡Ä[¸çtïÙj^)JSHÏç65>Ž‰.·Ãê¶wá=¸­ÉÝõ.rVtº3tº¡9ï`ÆÄ\ŸÞav1÷\¤-u£{"—EtJ¸TmYZŽE×µ–̇ӕ¨ÚÆ&>¤óÌF‘£Û¸äpÁæ ýÀ-–¢w-ÇüÍVH— kû‡Ç¥Fg> ›cÞ˜v’¼7´…LâØÊw•V(*SnòRk 4^¡ Éwì“ä¤B™¦&JŸIf''r ÁßÎxè–C©!ò(i.%Ëë¢ìßjLòk8)^kdŠŠ°ÿVwoßÜl{´ý/dÚNaf–OmÇFÓÎØ„ÖSï­ƒHdæÚcnצjz}rQ -‡rgKïiEöòUα1bz—IÉ¢í]ÿøFΑ÷3ÔˆâáÑ4ËMb0-sæÍæsI+F5Ù•KA¨ºvÌ mAVË98`Qp†æIMw´agIð[v÷“žP¡/—Éòœ•µâž¢†P±fú$LÍœUqCù €œªÝJ§+D9ëj·£Ã FT½¸À§¬¢!v`–DT]| T|bŸ - `öªô”ŒÍˆ*’• ”ç |ùF<ŒÉY*ïpÒ“ršßØPɲþk ,é -l_2Q– œ#Î>ï䪴À,´[Êü+žl Û6(Lf632‚,ít3”Q€óÅËcŸQ(/u“tº[܃ïg¡›§Íbis¿+áJVS:ë òp?;q½púmlš@à=a¯ ÎÂ^º~¨NÙs¥›}s÷¿XzÃøߨSÉãvxÎ~Ö‚'2òìãOg r‡y‘ÐGaôý¿AÜsl~y¤›©tj¿$švMÂmêƒyQhÚ™úùg!a×.Ó«.rˀʲáãÓû¡ïïº÷ØÁÈ·.‘ŸÐ; æ…:UÑsv£ …Tœóû7È)|–endstream +xÚ­YKsÛF¾ëW°| Xe"x’`öd[¶W)KÖšLåàø0F$ÖÁÅÃŒþýökˆH@‡¤\e gzº{zúñMËŸyðÏŸ%±ë…ëÙ*ñÝ0IfiyåÍv°òñÊŠ…,4o·W?ˆW3ßs×Þz¶}ìùÄn‡³möÕy÷ï7÷Û÷_æ‹0  œ/V«Ä¹ÛòÄõçÛ77w<þrÿî§ÍüÛö׫÷[+×rkú¿«¯ß¼Y +þzå¹á:™`ì¹>,—W Õ£P~W›«ÿXV¼Íx×¥3ÆaâÆIx~H?¾pÈØsc/¢C¾Õó…ï¨âùN~ào‰“ùÜwO´{ÕòˆéÓy°rö©Eû*#‡Ü"-:kÎ×¢j/*³Ví…ë/ò2gsë´Õ/#ñ¼\.Ý ˜L4=Éy®7\…† ÊõÝç’|oé&q2%ÊLÊòýÀ ý`(ìVa´Ù¬d¾È©%‹Ý\Ë 9<Ì€ÃÕUj™þË=u ýÀK¢ËЋA„7 +¨ÎdŒ®]ÿ%ëõ4ãæ”G6–‘cËf,sÁRìR“;Ög‘­|ºéŠ‡,…TØá V9.fbÓ‹žU€Jâ•Qär„#"‘HCWž“ “Ž1µOÁHòEøNuk™ÝË  ¾[PzÒuyáX\ÅY(+>jžæZ å_oÐÞIÂêÀWâI`ëC!—™ðó)lÒý¯¤Â£%gh˜<å)íÆ:„]HÊÚ`ôòÆ^ŒÍVø>P]!¼_LÇ¿:Ò·± ›»Þ Oì EI«¾»FIöõE+!H¾ãÃ)cÏÙTðB»âQB6O*ÑÓ\È ¾ëù«Yä$Ž‰ ž®’ú¶˜Æk•šjƒ¹ë‘tÉwäwmYròzÉyXI0JóTjŠÿ—>Â9$T\Soe¬(ܳ+xÛfO¸Æ@¢!³OñWóIç;¦%pó“Aüœ”EëWÜÒˆœk*Š¯xvø +t/(óa#tsSªÒ®ì¡UK Ù¢¶… ²ü±YºíŸô.ûyrJ €s;â8a ¾\N:΀fÔ{A°=óÞ€½÷]­3lWŒ( 'èiF=7ô Öˆç²{a"´žÁ‰^¼Ãw~Áu¹Oey펄¼¸å)o÷<gû70}[1ú®êÉ‹zBºFl·dßçT*8áظ)×î¥{§ƒëkžš–¡›ð®õ£®õÁÄNŽÍƒñÛ·øâ‚Ô!Ζ +4 ã3ìcXžö9…êÞp–¬L,{´Hªj¤Ýå® ‚‘W”l~9†®Éœ©ù›VLQ“Žm/²áMJqöE¡û‡w1Hªxjòg{ì©l¾Ü¿ã_÷9›@7gáÍEáSnHÂèŽËÃèíD§#¥F W»4?ìXe…þš'mÿE“™Ôd‘öÓQðÎ6G†Ýé%+þNN˜±a„Í÷vu:D¤¶@²ÕŠêxÞÜÂkg¨[ŽÄqù®¿ö'ãx@cIQ»$’*Ð2 M"‘rWµÔmY®¸äã`ÓÖÜbDMÇÒ‹awA-´–ç&Þt¿ ðb÷…Êí¯VTTn*ˆ¤ûeõÌÖËê…‘ëGѤz°îázîšé®Ú€Ó8ÜŸgàþPÞ ¾ìâ> qLNxû–çRØø¦ž.1qˆ{7Ò¼ –Òí¤/²z…¼ÀøÍÃŽeDôJvdü3­óAâC5±Øcû;üÌ@ˆ}Òºâ¯Ýˆ2£÷w[Í‹ªÈwCÙ¥W‘(Š{\- š'÷ZAåÀÉ*¤®öÈk&ƒÒR·øÇ–ÄwÞÃ"¶‡0¡âÚ…wLô‚q˜ä 5ðœ³õÁT/T„p<|GûÃG‹ßӜӺIóßiÍË.¤fgHf-9&›x¯=׋¦#¶'!™n“Nˆ²ñ0%Ë„Ã@ECâñã+€‹üíúžg°DûΧÏpôŸïxk“Ê‹¦¨Zkˆöþ$xÙû¼ŸkG.UÊti<ÇüH(Ï ±oWZ@íú8«‘ÏâAP•ôhZ "›[C—R ðZê¸mËè\üHâb]B:^_ήâÂëýÛ*t“±´+w¹ŠDêoúÏÕ5§<Ó÷ÿ¿ñüYendstream endobj -1559 0 obj << +1580 0 obj << /Type /Page -/Contents 1560 0 R -/Resources 1558 0 R +/Contents 1581 0 R +/Resources 1579 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1526 0 R +/Parent 1552 0 R >> endobj -1561 0 obj << -/D [1559 0 R /XYZ 85.039 781.388 null] +1582 0 obj << +/D [1580 0 R /XYZ 85.039 781.388 null] >> endobj -1562 0 obj << -/D [1559 0 R /XYZ 85.039 761.463 null] +1583 0 obj << +/D [1580 0 R /XYZ 85.039 693.318 null] +>> endobj +1584 0 obj << +/D [1580 0 R /XYZ 85.039 663.493 null] +>> endobj +1585 0 obj << +/D [1580 0 R /XYZ 85.039 637 null] +>> endobj +1586 0 obj << +/D [1580 0 R /XYZ 85.039 609.296 null] +>> endobj +1587 0 obj << +/D [1580 0 R /XYZ 85.039 555.705 null] >> endobj 266 0 obj << -/D [1559 0 R /XYZ 85.039 691.864 null] +/D [1580 0 R /XYZ 85.039 472.088 null] >> endobj -1563 0 obj << -/D [1559 0 R /XYZ 85.039 673.598 null] +1588 0 obj << +/D [1580 0 R /XYZ 85.039 440.273 null] >> endobj 270 0 obj << -/D [1559 0 R /XYZ 85.039 602.015 null] +/D [1580 0 R /XYZ 85.039 356.266 null] >> endobj -1564 0 obj << -/D [1559 0 R /XYZ 85.039 583.143 null] +1589 0 obj << +/D [1580 0 R /XYZ 85.039 326.373 null] >> endobj 274 0 obj << -/D [1559 0 R /XYZ 85.039 483.287 null] +/D [1580 0 R /XYZ 85.039 241.191 null] >> endobj -1565 0 obj << -/D [1559 0 R /XYZ 85.039 456.673 null] +1590 0 obj << +/D [1580 0 R /XYZ 85.039 205.88 null] >> endobj 278 0 obj << -/D [1559 0 R /XYZ 85.039 456.673 null] +/D [1580 0 R /XYZ 85.039 205.88 null] >> endobj -1566 0 obj << -/D [1559 0 R /XYZ 85.039 435.68 null] +1591 0 obj << +/D [1580 0 R /XYZ 85.039 171.338 null] >> endobj -1567 0 obj << -/D [1559 0 R /XYZ 85.039 435.68 null] +1592 0 obj << +/D [1580 0 R /XYZ 85.039 171.338 null] >> endobj -1568 0 obj << -/D [1559 0 R /XYZ 85.039 392.911 null] +1593 0 obj << +/D [1580 0 R /XYZ 85.039 115.02 null] >> endobj -1569 0 obj << -/D [1559 0 R /XYZ 85.039 365.813 null] +1579 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F20 937 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1570 0 obj << -/D [1559 0 R /XYZ 85.039 340.835 null] +1596 0 obj << +/Length 2406 +/Filter /FlateDecode +>> +stream +xÚ¥ZKsã6¾ûWè¶TU„€ÜÆóØLjìÌÚÊ)É–h‰e‰tHjìɯO7à›ôafªLøÐot7h‹‡ÿbiÆe¼ +#Ád­vç+¾:ÀÊÿ®„El,dÓÁ\o¯þûI‡+ÁYÌãÕö±¥£™ÒrµÝÿá½ÿåÝ×íÇ»õFJér½ ÃÈ»ÝÒćßnÞ}¾¥ñÝ×÷ÿ¹_ÿµýõêã¶áÛP12ýûê¿øjþzÅ™Œ£Õ Œ9°|¾®L+ißOW÷WÿoHÑšZÑ®)b#9‹"µl͙檱ƒÐ;Ä“¡\9 ÚA²¡j‚,ÒѪCiÄÍa–Ù á3)ü¿Å9ÉòõF)éÝþ€åekáU4,éYa.¥ñcQž“šÆ÷0½Yo„WÒºð¾Á «p„dŠ|ómíG´T]X)r·/¹À¨>ŠMr©atôckœ6o±IÙaÀOlôFøÒŒ•6h60ÆF ob£[Å]ëk"¥ò4=vÅå“{ +°‡õ†Æ—„ÕåáMEÙ\Pòœ,‡I‹™‹AÕÔ|˜,pkÃd‰]&~IŽNü– „wÉ÷¨°1Óîr6Æ0ëµ3Íž€èÛ?¹8—–8é{Ïð½"£iYÑôy ³ µ%à\ˆ¼ šÒ² Éì‘õÑ¢ªºÌw ×IÐ_5 Ëô±¡¶4wˆf~ìÕp8ª‰ÐÚ¡´HI™ìê~pCœia ñŠC¯>õ¤ÖÞËÏŽ¾­áG‚‘wÁhÓjaQ†2€ÐÜÓÔƒ1œA†îˆâ5ÌŸðG&}É­ü•Ã?" ŸFUj;W–cAÏ}ALÐŽcuÁ¦@ß(ý¸8¢}ðÌL,d» 㘎—Ñ_ðDÛ<@ô„µ–Ùž¾fU]ÀŒÍYàíï_¾Ðêä–~ü¸ˆ+8xŽ8Õò´2Ö·‰G[EºÉŠQ@Y1RÞ?UNi~0ì@Ÿ˜sï³E™ØDÀ(qrx,³ŠžhŒŸhè6C7«ûX3Í"º)_ºïÐHj÷2åk°ËeW#™ÅšøÀ³É|­ÕÉ$°ˆaÀöýö·-”÷|¡ÓféPYèŸ\ó¢$T<5e"§©¢³ †¸CXv®ÁøþÆ×4Þ'uBÛ)42'gŒ²(ò¶G'bÖ;ÙÚhŸžÉvÓ%„ÑÉœZ3šSà-i{ZF‹”Åù'|Sæ “¾žœŸO©]iV¾`-{Gc;Þ ÑûR ™a£Aõl²¡É‚F¹”ω=˜(Sm½4ÁRZfJ|N{}ñ~Î5\´ÇÁ‡Sgƒg_pº ÅÔmAÑ©{Àæ/¸–ud·™¸µ“6pˆIJò6Ž jÓälÓ¯’¾÷¨¼ºÔ ãïJÛT¬bËÉÀinr#÷^2ÐÆ,'¹}¢3ÊÄÖBœÁÀDl›ªJš˜±%ݤoNŠ#©'—¿Ñ…ZSMà0"Ý_L6ƨ6ÂÉÃ%5F›¬Vfç°µ1ÖJšÀžk_t¨˜ –»Üf¶}qH϶/KÜšöe‘k_ºüŒþ?þƒã¿0d=r%žÐpФ%%#C¶ èL‡ˆVÈK³a"ðÀI@åˆp2l“¬Ž«κ°°é[LÄŽ^YàÙÓ¦1S˜/¥éï…½©?‰%W9f€C3H*¶½€“EaÖ•‡œ^ BS!6ëMS@9¸îóš¬qlj2¤êäglif ”örºß¸&­¨‚~™–p­ªÁ ›ö öm +kNس=ÝgI“XLfÅédšsàô2Ûß4æâqdÙM3Å#r{è £ÀlrHL¢ Ä@ã·=áÇw»''.ƒ3ÉmN…•]A<£GW2¸ŽmF'Ö$þ`YÚ±)’gÛ(ÑÁ…»^Bé±>¢J¥½ÖÙÙÞŒêÖNÙÞ(OIUÓlÓ¨M+‚—of\î³0˷Řèê`1v1Í÷†LqºÀA~ôñ^ · Eçc÷¶Ò”ájF +·{B +°`ȸZ¾ÒªCþí 8ü¤”dpáê ȉxs¯_߃5ƒÐû%Möæʧ$÷¾?c¬yéœôJ0¡–mØÁŒËˆ£—`!"*£…9wç$·AaŽÌÅÜ\íåÌFD–#Ãì­JŠ¶Í=Óõ°íÞhºÉ mu.‡z†1Ó‘^Ixr9­§…l:˜YW8 ê –³ ´0Ë.Ãåol’“ß×6ŽÒ²\ÂYÐᇂݥC—Sÿ<’-”@1X4†ÃŒ¸ö›‡0‚›€èqÅ{ôœõ5œ9é/[¿ÅÌ[ßbÞ¶~K쇭¿$WcýŽ`w)Þ@àèAÎH'|;üE‹XȈsßh’P÷8ƒü9øŠER-{ ÅÌ{ÀbÞö@Kì‡=°$WãŽ`×Y¾^9.ZÂaF,û¦ÓBôX‚é¯gL×.Ê`Ñô̬éæMÓwˆý¨éår¦ï +†¦·{š{Í i,ÃaF\ÏYßå +Ö?SàüÈg*\.p̼õµ†ëÙ°ûS5øëZb¹z‡)U}È©eÔ2X´ÅÌVbßÌ÷©o®¨¦Iî>÷â;ݤí㛯$°wsÕö`»¼Ì>Ms8÷=úÖéØñ|{áb¿ƒ™µ¾Ã RŸ²²ª?¡qKSûã`“PàYâî0#öý`“D†ìñ‡`sê +ú=¹¬n‹™W×bÝ—¤ÂFú6s夲àþ¾ÄÛaFÌʆd¶÷…’"dÀbµ\R:˜ye-ÙÝâGð)¹wR[Íàä/2w˜÷¾¶Š³Pû=ö ­šÓË£–³x3¯­ÅP§°ƒf¾‰H¼ÁNT-3E‹ìfÄ¿¯¯V §ì úF3úBJ U´¨n ™ÕÖBȵ7—S=ã7}TݱÀ×A†Œj‚óá:ÖáÌ_Å\c +à@Å‹Z¶Y--¤À&~ sd?Óç*ŸÌÁÓ}‰2° Šƒ e(Ž~•]aø«Ïgª„OßYí¥ÿ‡þ8 ½;Jh‘f$Ö~È‚PYY̯kG¹FCÖ‘Ëû/^"€Iendstream +endobj +1595 0 obj << +/Type /Page +/Contents 1596 0 R +/Resources 1594 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1552 0 R >> endobj -1571 0 obj << -/D [1559 0 R /XYZ 85.039 203.222 null] +1597 0 obj << +/D [1595 0 R /XYZ 85.039 781.388 null] +>> endobj +1598 0 obj << +/D [1595 0 R /XYZ 85.039 761.463 null] +>> endobj +1599 0 obj << +/D [1595 0 R /XYZ 85.039 736.955 null] +>> endobj +1600 0 obj << +/D [1595 0 R /XYZ 85.039 601.463 null] >> endobj 282 0 obj << -/D [1559 0 R /XYZ 85.039 108.783 null] +/D [1595 0 R /XYZ 85.039 502.781 null] >> endobj -1572 0 obj << -/D [1559 0 R /XYZ 85.039 87.79 null] +1601 0 obj << +/D [1595 0 R /XYZ 85.039 470.36 null] >> endobj 286 0 obj << -/D [1559 0 R /XYZ 85.039 87.79 null] +/D [1595 0 R /XYZ 85.039 470.36 null] >> endobj -1573 0 obj << -/D [1559 0 R /XYZ 85.039 65.074 null] +1602 0 obj << +/D [1595 0 R /XYZ 85.039 434.095 null] >> endobj -1558 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R >> +290 0 obj << +/D [1595 0 R /XYZ 85.039 282.471 null] +>> endobj +1603 0 obj << +/D [1595 0 R /XYZ 85.039 248.327 null] +>> endobj +1594 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1576 0 obj << -/Length 2312 +1606 0 obj << +/Length 1482 /Filter /FlateDecode >> stream -xÚ½ZMsÛ8½ëWè¶ÔÔ -ƒo’sKœdÇSkÇkkæâä H´Å[ÊHÔŽwýv ~t­«¶r°H>âu¿nÝ`ØœÂ?6Ï¡"Ÿ§#"Ëæ›ç?“¿Í˜C,déaÞ¯f?~Òð”’œæóÕC;Ž"R‰ùj{Ÿ\üüîfõñv±B$€\,Ó4K®WöƇÏWï.¯íïÛ›‹¿Ü-¾®~™}\5¼ÍˆÀ‘#é³û¯t¾™Q"òlþ'ü¦„Áãç°%…»~šÝÍþÑ eŸÉ¹}kÌG)I¹š/%Y&G1Œj’© „P”(*!¸/cœÆç5•¸º»½Y°ä¢ï"»„ÖsoÀ¸“‚èQ—õH¶)Mrm»-þ8§ê§¾mœ½Î}ÛŠÔ˜+S+§9‘]RúBé@ 'o*ÀH¥&BЂ"!p W… ðÍ!ˆÚV‡À³í¶8}‡‰@“ÃþTŒ|ÎET—3àî‚)’CrûÜ ŒDR=‰‰„½*í€oŽDÔ¶:žmïËýv–Áp<Ëá0ÊNXΉìªú¿ê'SSú· ˆþô*ýÛ߬Ô¶ZÏ6ÔÿÝæ÷‘9Â)U¤Æ X{s€ÁVÐUbpØ}t.‰ÊYt_ô0áhØ<)ð"<åBÀ _,•¢¸¼¹€E@§ÉÍB°d½ùÿ•½WÂóýÃbÉ’CÈRGµ´ÅŒ$gm©¦DÊÔXºÚ¸CËä¹XïË=ñh¯vç®àÖ®8¡aù…27×'{]º¿gô`»@–¡ÎGd_?ç>ˆÁ!¶Q~‡ðwåÕ9TO]~H<ôXàÞ:ápƒ‰øk1H÷÷õ „F‡irsVe$i”ÚAúÔ=WS’óÔ§Žm3šÁ_Æ&\mA_¯•‰© ïhh9QiœÝBä]oSF´frpWÝ¥‚pÍ'ÜmAwÈÖ(# ¼XIÀ$ÛÇRMR44f€Ã èº J¦º€ËYÈe•å$e"î² -»\ƒl„¯ÎOUùý W—wSB¡¤’;Ì€¼ç®&Œ©9}aÁ -VˆLO4(â®y mòù`¦ðåWL\zŸ1ð#…‹Į́=3°§W¸P’ª®=ô…‡€‰£Ù”-(¢€y -<Ì”~¿7vIߣù™7ÆaÆ ò§ºc }‘a÷eN¨žhamêÊ./¦yVÇ`sÍ8$±š«ÅDBÈä(ëÅ0u ãõåÏÐJmD<ïËýæm÷¶°1¶Áµ ‘d½-Ž±`›C9YîM|®ÈäßÄñà ֿP±×Ž®õz¼£¥žÇûTì«]7Ì×+ ÿÆ~ƒÃÞt»h>zEMú” Í`>ñùªÅD>äZÌ«å‰ñÖòôxGåñxŸ×/V“'×™ƒÛ¹ðn¹q:có+ø¡þL}æsØG>„¼ºcˆÖ"uIG5jIe§Ô0btÚãç¦/ž0àn7~¨éŽ;Þô¢Ú#"¨®D öŠ§D§ÒÙ‚~‰AžÁ†IT&†öþÔq%Jendstream +xÚ½XÛrÛ6}×Wð­d&Dp'·\œÖ™±“ÚJ^œ<(m³cK©D5i¿¾»x˜N;ÓÉdÌË!öàœ]`!–PøÇ£6) #˜dý¸ É¼ùyÁ"¼‡y¹\<{£Š„Qb©M–·Ý8ŠH%’åæ&}õË‹÷˳«,B¤€Ìò¢0éåÒ?xýîâÅù¥¿¾zÿê§ëìóòíâlÙÆmG„ƒþ¾¸ùL“ |» DX“|ƒkJ¼~\@T¢¤÷‹ëůíPþLüW§æ(•(&É%ÆÈ“˜ÂeüU”(*[8=¡CÀ —»:ËYz»ËK÷/ñz½:d,uŸçÍ$Pa<é…™Pi0.Lõ¸0%‰ÐÅ€ ý.é8b˜XÁ‘TÏϽÃÄç0~îŽ8Ë +¦»™N•k@ŠÙÈ fz8UÁˆQf›~74–TÔ&Ù|ºw˜vªŒX¥zSÕœZze '0M‘åJÑôºÞãÄëú¸/Í÷'xP`@¨Ô³u‰mͬZj¢† ó?f‚¦ïÎ_Cê"}#é˜¥Ñ ¦Æ4c0N„ò¾ª¿P™rwë«ÿcÆ ²xâo«þ•©àþþKUH„š² ‘÷±‡‰j¤´…òç#•¸Wi}¿r•ã¾åÐa¢)¡ˆ‘ö¤DëŒé=Zí‡"™V#xyÀo¢RqX"+[K³ÃD¥’*ÌŒ*$ý‡åùÜŸE84ßÎqèa¢RIe‰€ÒDò U A2‡¥_€ +$ÏSWmq ªÖ«ºÚÞùêê±l_º'‡Ò-Ï»íÆë)3ð˵3Ä£)û ½Ø2[à¶&¥H7»,‡4^Ë-æs]nÂÈ€ÜúËuuÛ¸¤ ö½ö/>QE¥‹PW»-ª‡õÏp×ò WÞ鯫»òiwJ…Â,æ¼ä™ßÙ[DÜu +®p;r]z×qKgéòž]D­ÌÒè0QëTéw¹„˜٧ܠ.´l +÷ÙP`”ôFÞÎ#¼|t¾ö=!v§¼M"ØäÄÙä +”Bù¨_1+î¢ñ¨yòc›¼â?XGz˜¨U6LËÙÈ*å­zýÎ 6Þˆ¡  +Ý~úÃfK}²ÑÊÃ@yo¤)Q¦aÁТ×Í&„ov(›s]cb…ׇþ®ŠjÆÄäè^í°C•@QB§ f»n`6ÆÎÊÝ`ÜZ„L/]1À4ivìõ:é z¢Ùñ˜IäI³Ã]ú†lÆLköÃ×À­ðu}¿Û»Š¨ÊP(Mªãz·sµàu‡u=9Ý)r͉¶óÒµ¸r2ÎLtcÖëÚ@ÆQ‡ª¶¬ÔçÌ}_þQÚ‚îi ëÄ·Z”û˜°i«HѶRt˜¸óŘ‰Û©1 +|JŽ^Üÿ;‰ ¿–vþ¨ÕÃÄ¥ ˜±t7zZÖ`ç"7˜IèQJèÕÄ ög¯ŠùgÝ(t»ÛO%j:Ñ¥bîáç›°#!æe² Ÿ¿8ÖØ‚µ 9íø‚z Ïëv~…ëa¢7˜‘ÀLßl' + M8·ýÐÿv# #Í3dÂÇ!]W ÒäÈÅ SlV–3‰:tV^FÕ jp¶®US × •÷Už¬!×VþløìèGÈ•„jí~ ¦èÿŽP>‡FFYÿëÁ=¶ª€´Ê]^ÁðÍqY(R .ªÐÑÂ%ô@Šù^µ.ñr㟗ˆ)¿ù‘÷™âikWÐ +%0×®ô0ñ삲ã#4Ñá½¼êÚäæ·7½»™íŸQÈVÌ“ë0Ñn³€2§¡CY^õº@ת;^÷)Ð4}%z¿Úß.äz'•ô¶š‡‡¼vmã¾éHÝWmG:è5Ëóê°n>¨†q1ü¡¢ÜGÐ`§ÛrøïÏÿ駷®¹ĈÈÖ¬àü¡ ¸ ÚRŒé*a`ÉS¾ïûxFendstream endobj -1575 0 obj << +1605 0 obj << /Type /Page -/Contents 1576 0 R -/Resources 1574 0 R +/Contents 1606 0 R +/Resources 1604 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1526 0 R +/Parent 1615 0 R >> endobj -1577 0 obj << -/D [1575 0 R /XYZ 85.039 781.388 null] ->> endobj -290 0 obj << -/D [1575 0 R /XYZ 85.039 694.591 null] ->> endobj -1578 0 obj << -/D [1575 0 R /XYZ 85.039 673.997 null] +1607 0 obj << +/D [1605 0 R /XYZ 85.039 781.388 null] >> endobj 294 0 obj << -/D [1575 0 R /XYZ 85.039 533.8 null] +/D [1605 0 R /XYZ 85.039 708.141 null] >> endobj -1579 0 obj << -/D [1575 0 R /XYZ 85.039 512.807 null] +1608 0 obj << +/D [1605 0 R /XYZ 85.039 673.598 null] >> endobj 298 0 obj << -/D [1575 0 R /XYZ 85.039 512.807 null] +/D [1605 0 R /XYZ 85.039 673.598 null] >> endobj -1580 0 obj << -/D [1575 0 R /XYZ 85.039 492.212 null] +1609 0 obj << +/D [1605 0 R /XYZ 85.039 639.454 null] >> endobj 302 0 obj << -/D [1575 0 R /XYZ 85.039 463.398 null] +/D [1605 0 R /XYZ 85.039 597.091 null] >> endobj -1581 0 obj << -/D [1575 0 R /XYZ 85.039 442.803 null] +1610 0 obj << +/D [1605 0 R /XYZ 85.039 562.947 null] >> endobj 306 0 obj << -/D [1575 0 R /XYZ 85.039 413.989 null] +/D [1605 0 R /XYZ 85.039 520.584 null] >> endobj -1582 0 obj << -/D [1575 0 R /XYZ 85.039 393.394 null] +1611 0 obj << +/D [1605 0 R /XYZ 85.039 486.44 null] >> endobj 310 0 obj << -/D [1575 0 R /XYZ 85.039 348.304 null] +/D [1605 0 R /XYZ 85.039 427.8 null] >> endobj -1583 0 obj << -/D [1575 0 R /XYZ 85.039 330.436 null] +1612 0 obj << +/D [1605 0 R /XYZ 85.039 396.383 null] >> endobj 314 0 obj << -/D [1575 0 R /XYZ 85.039 298.895 null] +/D [1605 0 R /XYZ 85.039 351.292 null] >> endobj -1584 0 obj << -/D [1575 0 R /XYZ 85.039 278.3 null] +1613 0 obj << +/D [1605 0 R /XYZ 85.039 317.149 null] >> endobj 318 0 obj << -/D [1575 0 R /XYZ 85.039 178.49 null] ->> endobj -1585 0 obj << -/D [1575 0 R /XYZ 85.039 155.168 null] +/D [1605 0 R /XYZ 85.039 136.043 null] >> endobj -322 0 obj << -/D [1575 0 R /XYZ 85.039 126.353 null] ->> endobj -1586 0 obj << -/D [1575 0 R /XYZ 85.039 105.759 null] +1614 0 obj << +/D [1605 0 R /XYZ 85.039 99.172 null] >> endobj -1574 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> +1604 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1589 0 obj << -/Length 2628 +1618 0 obj << +/Length 1454 /Filter /FlateDecode >> stream -xÚÍZ[sÛ6~÷¯ÐÛJ;+”^ºONœnœIí¬­íKêYb,µ2•JTÿûžƒà dG»3;Ôpˆøpn8 ŸðŸ$Š2Ä g2I&«ç‹`ò=ÿºàFbnDæŽÌ›ÅÅ?Eа4H'‹/Õ8Š…JNëÏÓ·ï/?-ÞÝÍæRÊ)HÎæqœLoÔpuûóåõ =ß}zû·ûÙÃâÃÅ»E‰[Ž)‚þqñù!˜¬a‚.&ÓdòÏãÐý|¨L…ÒüÞ]Ü_ü»Šú ½ÕµF+1ç)K…òóqF²äA¸•,™Í• -¦ÿ¹¹~5›óé´ -à Š§¿*8åÛ´ì¡…O×u‹Ã6ÂçhºÉð­å:;Pß׈Ÿ°íH§_.ËnøL÷Û¼ÀŽ¼æ0fqw-\p–pX·X¢¢NjxA_܈øãÜ!äÆ¡¢11®b–òdâ ÙÆ52-\®\Ü(f<º¸§˜Û®€j‘Õ2ÔTC³fÔr“i¦›ó2k¹d2æ|TB>ŒÎë—ìØíõÕß[°aDtø`L ¶N‡ŠˆVÓ±F6âé -·ã¿Ÿñ!ËgÀP‘­‰“Gì@Ó}jüªYÜkîHúУfQªXšøíË‘éç,JB¦TÜ°¯´´¯ûÅ]eWh$9Ng¸rÍ+Â=·=ù“Ç@"ð~‰<×>¢V‡k3BÚ>®ab78Ã>·m$bQÄ'ΰ6B2-ì†Æ¡ÅÅ~ ÝÕ[ŠÛ¾ÛÍ í€V9¶¨6ËR9ŽØV`ïÖÚÐþ ýÅ÷óº½IÐ4P·Í_Xj­Å9²¾ ¨÷«N%ã¡WÂRUÚPîÜ\âD~†¶w5ÚeùS±Á¾¹^ßZ»êe¡í`M¢à¿› -þš´ÔaXÇDÊB)ÎV² a*ŽX0B %“¢­cB;gÔ#™tKÇÐñ¸Ð–Ö¶® “8%£2ðÓñÒ¨wO}žY Dì'Éê'É -·D/¶µÄ&v§%ºØÿ_–¨bˆ§2ôZ¢#ã¡7Š˜€¿ Kä®5+\îP/žòÊê"Êz-oœwW‘daw\ú+–§Àÿ€¬Ú5”*éЩ€tªµC§£S èVÈ×:å@£N¥b7&”ë2ï¦bOŸ´ŠôÃg”©pŒRK‡s”zœ‰túZ‘%&«Û§\ïȼlµá§Á´ØdÔDj»<L­²nÿ=úå7ȬÖ(œ8ãv˜>É´À¦²Uߨn$b$L[¶ÑHLj–ÚMîúôP$! •zõБé'DÄ’)ѼŸ€ìIëáÕ-™›Ô¤ ª—ÏÐE3ÒܪKáH$듽¿¾rJnëý3’¦ÓHhºGO¤õ4qªk§Uq:dÿ¨‹h¦ –=Fƒ-’S.dëåºd€+ÆÀ£Ì"U=W•E˜²4(JZ¡Ñž×µßó6¡;=¯ ­jžvÅdæÚÃ’zg}aHÈTE Q yÈ0BãÉðA—d4 »Ép Ï/Ý85%á~TBJŒPýöºMH$‰°‘i× ëÔ„8À`—K{¶»6H=ÂñÅýsc e™ -õ^w‹ …¸5D`%ä!Ðñ¦¶¥LŠ %ü˜F¦…ÙP&ôÕ²†ÙÍ´·wÃU¯~’.Æ<äŒ a*Ò”¼ßìébðÇÙÿžï_è4¨ûžôªö§¯ô3+V eƒg½{z$þÖZðœ™.‹Çýsö²AE‡©öÝrðì}.Ñ&YŽL¿'ááZ«v’,5*ɲ/ÿ’,g¨þ$Ëì“G™ó{é• eº»¾*¿ýÒÉÕPvÄ!ûQQzn~”¦,æ,#3:!¨Æìϸ逃[O^0òSER«;>ýžëZt”š_:{f>H¤·çÆ÷ÛSj+¢šíÑÅÿÌDƒûMmøK|zûñØ÷‰å7‰Ä#ÿT2ý[`dFo×nA·s \uvB q5ô5¡•ñ}L¨eF“áõd4p;ÉppÝ„M·÷³Djè«+ãû(EËŒ¿Mõà–—©uÜî»Ô -·ž»ë×1m™‹éý©¨ƒ–t0Gåøf W×Ô³/Ù!ËWYmD‰ºjàí;Ýü£huÖÃÕ¥›dI_½ NÌ,ŠC3¤EÆÍéB>ÈT"Ûóý,ÝÑ¥endstream +xÚÍY]oÛ6}÷¯ðÛ¤âø)RI“­)ФKܽ¤yp,ÕÉàØ™£ í¿ß%©ŠÉ€¡(,‘G<äÑ=÷’ +™cøGæJ ÌŠ¹T1¥æ«‡ž¯¡çiYÉÌñböÛïBÎ F.拯ý8qÁæ‹ò:y÷þèÓâô2Íc ÓLJ•œ/lÃÉÅÇ£³s{}ùéÝ/WéÍâÃìtÑñv#G¡Iÿ™]ßày ü0Èjþ ®1"Ðý0V$8kî7³«ÙŸÝP¶ÏíSSkl)PAE\‡œ ž³NŠ't ÌÐIQJ†dš “ÏçgïOÒŒ$Z›‰JÀ/aˆI_`ƒÑ ü|3?×Ó[ÜŸ¡å<Ÿ;ƒŽˆ[̈™‡™0‚È€xSm×õ¡ÝWýKf³Ò³1©JJ¸Õz2nõ„Ûµ?Éfå¹Ê•,*Žƒ ŠÓb'F܉ã3Oˆã?,¿[e6&r̺‡b1 ZïWP•m|Òðz¯{¶A¥Dˆq¥zLX©ã)ÅhP©q¯”Ç<¥”CÌíº3$F“RK"m=Ãýƒ¾¨¶)ÈTW% +Ø/ç̰IJ‡ƒ «Br¤ñ²‡e’P›(~2ƒØ¾ÇMªmOpûüÖuÃNv÷ÛZ·$’vrÂVü•iGÀE.UT™câ¥Â†M 8#Žƒ¥ÁŒh½`É!X\Ö˜etæ1jCÓ]e”ž¶~ãjt°¢gõW +ïêâìäבPÐŒaÆâS…o—ñ›X!nu‡,Ó··F¾Ì¢÷Ø ˆ õ”ƒ ‹¥D¤ç©¢óÔÕâ²÷’6ÆVÏ×ÔÏR©ÉŽMçvñ…ÀqU¼è‹xå’µî +®®ÅŒ*Îõ8‘fçŒ:‘H-fDíyƒ#;.—ûƾ^óNõ{ßl²Ú¤}F´eÃb3,Né;m•B¼Ý-õKv9O¡|Ìü4;&¬.ä +I½Ð!ØÆÎù‘žÆGh;P»9!PXôêJ“ž—µ±Ai¡Ífe"ÀŒf/§6Çì•Æ +Øüªx®i1jgÐp¡ö™' +µKüÖû=(zAvâô˜°8 æp÷Ř;÷ùÔ“îs¹ÿ_îc\!^ȨûLX]Ê¡¹o?â¦n:°Þr£×¹Þ¾¥Õ…ÓoQ¼rCaƒÞ6¸ÞãE“š&fÅt"˜,fÄìUwe‚É¥n‚éq© U6>2MõÎÚk]ÕƒcDëAÙÄ‹k@s˳[š?´ê ^Õzk ,v¸o÷5´4>¯ïº±–ûz£ :¯_é |l¯ïÚ—e{µG@á  Šx‚t0á·Ö`N1â.AúÌ Ò%þOÏ|”Q$~î”ê1a¥ÌáJEˆ{¥<æ)¥bü³g¾(ø‹øVÞÁ„Ei0‡‹!îEñ˜§Dqˆßº¾©P<vˆ 0qxe svuuH:YU{Ö× ©®NBËCje ¸£8^*LX,8®R6*•Ô–Ê‹c=#å`` I¿}øÅO­ ¤™úÌšµ#eÎPã¹’pøôdÒ^«{ÛÝþ]­j{¿¬!ÐnŸëê)R  ƒ"~ía«(`c?k5ƒÚ6ªG;áS‡'j¾Œoû’©åƒ(µ§oSpë¶ ZÍCfdzÚ<—îîÏ­¨n6€ó;oÇØè'BåTR„_¸‡„¿.[ÈA_6"ŒÝ— râˆÃ8, {[vµ½5jí+kè6÷^ô‰¯±%t2\á¿þkÄ+ÿèÑŸpR,pŠp€Ì%oæb>†rº‚)xql<ߺü¦?endstream endobj -1588 0 obj << +1617 0 obj << /Type /Page -/Contents 1589 0 R -/Resources 1587 0 R +/Contents 1618 0 R +/Resources 1616 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1599 0 R +/Parent 1615 0 R >> endobj -1590 0 obj << -/D [1588 0 R /XYZ 85.039 781.388 null] +1619 0 obj << +/D [1617 0 R /XYZ 85.039 781.388 null] +>> endobj +322 0 obj << +/D [1617 0 R /XYZ 85.039 761.463 null] +>> endobj +1620 0 obj << +/D [1617 0 R /XYZ 85.039 740.731 null] >> endobj 326 0 obj << -/D [1588 0 R /XYZ 85.039 761.463 null] +/D [1617 0 R /XYZ 85.039 643.909 null] >> endobj -1591 0 obj << -/D [1588 0 R /XYZ 85.039 740.731 null] +1621 0 obj << +/D [1617 0 R /XYZ 85.039 607.038 null] >> endobj 330 0 obj << -/D [1588 0 R /XYZ 85.039 695.985 null] +/D [1617 0 R /XYZ 85.039 535.194 null] >> endobj -1592 0 obj << -/D [1588 0 R /XYZ 85.039 674.784 null] +1622 0 obj << +/D [1617 0 R /XYZ 85.039 500.444 null] >> endobj 334 0 obj << -/D [1588 0 R /XYZ 85.039 642.981 null] +/D [1617 0 R /XYZ 85.039 455.092 null] >> endobj -1593 0 obj << -/D [1588 0 R /XYZ 85.039 622.387 null] +1623 0 obj << +/D [1617 0 R /XYZ 85.039 420.948 null] >> endobj 338 0 obj << -/D [1588 0 R /XYZ 85.039 577.034 null] +/D [1617 0 R /XYZ 85.039 348.497 null] >> endobj -1594 0 obj << -/D [1588 0 R /XYZ 85.039 556.44 null] +1624 0 obj << +/D [1617 0 R /XYZ 85.039 314.353 null] >> endobj 342 0 obj << -/D [1588 0 R /XYZ 85.039 456.891 null] +/D [1617 0 R /XYZ 85.039 160.607 null] >> endobj -1595 0 obj << -/D [1588 0 R /XYZ 85.039 436.296 null] +1625 0 obj << +/D [1617 0 R /XYZ 85.039 126.464 null] +>> endobj +1616 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1628 0 obj << +/Length 2022 +/Filter /FlateDecode +>> +stream +xÚ­YM“Û6½ëWè°U¦¶"„øâÇîiÖÇ“rÆÞ‘v/ŽŠ3ÒF"Çi%ÿ>Ýh)’VÕl¹,’`³ðÐè~Àð¹ÿø<ÒÌ—ñ<Œ8“Q4O3þ o~žqk±´&KÇæ_ëÙït8ç>‹ýx¾~:ûÑLi9_o>{oßß|Zÿô°XJ)=°\,Ã0òî×Ôpûñ×›»{ºøôöÍjñeýËì§u‹ÛzŒA¿Î>ñçèà/3ŸÉ8šŸàÞg^f€Ê´’öy?[Íþݺ¢wjN_ QéP¢ùRú,ŠÔ M3i¸jŸi_µ<€kƒ<üw!}ïãÝíßû#äÆ1“>h— %3&,HZÀÈ +FNQ¡ ¹) Ø!Ò{V͘b]•;$îùœÍjKZÅSŽ±&`ë!ø4mg›qÞ¬%nµ~¸Œ¡Åa<‰ØØ\@öbô²”ÌW½ýñta !+³+ó#Z´÷Eebñ‹eà^µÍÊ…6ÞTÂÝ‘® ]R|Uä¿ù\›TØ,¼GóEuÊÌ5§FðDÕ¶·ø)þl220ù¸U­ù3Yo˜fìT‰m>T?’þÆÀõÛwÊÍð)W›Ø1chp0Û?ÙÙ‘A¢¢`² ¾aSK5å´E{Óm¸“:B3s­Qº -Ú¦eR5›@Ò|<“í~Aô@ת-ìßUàÃpc´<5˜{(¸æ[sò¥…gˆÙtÑí\á=ÍÛ‘vOÜ€}£oX3DF?Žúó®´-©„MÛpSAʶÎái—om‘€·#VO¥½'„+É&û#9¼ì3û' [#ü’ã?ñ1Ä勒Þ)kFɽåïyq¢}žùâÙŒ¤¨_¬Û*E®´¢YÜ¢»£í•½nL àv1¯,MΤ’N=‡ìÔD7©ØR€¾øŽ’rlF“‡ô¡êK)}”j¾}½”r“ÒC"Åvu.âá!sЯ‘š^‹ŽÍ蛫‡<ܹ<0d¸+À]LµÞdØCžºêžö$´ùÆðøf—0º(³§¬Ìò4ëxÄ8œûxe|²Œ86ãl*Î`gÑ/#•’A§³w÷ïÌ©é¹– [Yù2šÝz'iZÔyeŸR#èÀ·²µ¦·eŸ(7ò@¨õ4åg3ŠŽ8nüø!“2¾ÔH±·7*ã¹ÈIo™á”V¥%«ÂŽURVGº?íªF>ž¬XGã7$Í•p9ŒAùËú‹ÀùÓ|çЬ¬Éò•¥š”Fš¥•UÍ$ÏH¦Z‘Y¿ª+©™ôê‘ô¦Í@X¡xIB²Î|B»¦yÒ$R‰x2Xp­¶†—22ú°º±B„T)ü|­³£uñ†¼M¬¤Ìòg:Ü ›ÀX#B;dS\1û bôo”ÇLÁ4ÑûÂ*!ì’aK X7"î첆p“RìþÀøMÀÎF£‰¹Ò¦ÏÇá?uàUÔkW‰‚D*GÎØ5Fj‘ú‚Vºß]-1±ÉËþþÑ€Y¯endstream +endobj +1627 0 obj << +/Type /Page +/Contents 1628 0 R +/Resources 1626 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1615 0 R +>> endobj +1629 0 obj << +/D [1627 0 R /XYZ 85.039 781.388 null] >> endobj 346 0 obj << -/D [1588 0 R /XYZ 85.039 337.353 null] +/D [1627 0 R /XYZ 85.039 651.823 null] >> endobj -1596 0 obj << -/D [1588 0 R /XYZ 85.039 316.152 null] +1630 0 obj << +/D [1627 0 R /XYZ 85.039 617.073 null] >> endobj 350 0 obj << -/D [1588 0 R /XYZ 85.039 284.349 null] +/D [1627 0 R /XYZ 85.039 571.72 null] >> endobj -1597 0 obj << -/D [1588 0 R /XYZ 85.039 263.755 null] +1631 0 obj << +/D [1627 0 R /XYZ 85.039 537.577 null] >> endobj 354 0 obj << -/D [1588 0 R /XYZ 85.039 136.846 null] +/D [1627 0 R /XYZ 85.039 329.372 null] >> endobj -1598 0 obj << -/D [1588 0 R /XYZ 85.039 113.524 null] +1632 0 obj << +/D [1627 0 R /XYZ 85.039 292.501 null] >> endobj -1587 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> +358 0 obj << +/D [1627 0 R /XYZ 85.039 168.581 null] +>> endobj +1633 0 obj << +/D [1627 0 R /XYZ 85.039 131.71 null] +>> endobj +1626 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R /F42 967 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1602 0 obj << -/Length 2957 +1636 0 obj << +/Length 1957 /Filter /FlateDecode >> stream -xÚí[M“Û6½Ï¯Ða«,m,˜‚ÜKÊñG2){ì™Íh‰©,‰ŠDyÊÿ>Ýh€¿@9ãò²•rL‘x͇Fã¤ÃIÿ…“D²@¤•„L$Éd±½&wpåç‹Ð æ2w0?Ý^¡eÇÕzw7¨–L!éåˆZ5È£–£–´R«EÚ¯–C -SŠ.¶§*IHS£Aƒ•RV¦ò ÓjX¢H²˜ITƒ<–èH¯0à[˜×ÛÔ’ÓPôQL‡º)TÌi(:Ô”K‹©ŠYG.é˜yÀÁÝoL[#Á)˜s…j·˜AX6™Éü¹é& -ú„C`]b÷~¡ëtC†]»Ë7tŽ®ïu±ÉûU€4PïýýZƒ<ýj@社´Jýiê;¤N¡X r²›‘@:Çí8hTŒÜT].´¼Ý±`¬TF,N½f«†xô - ubÞ¶·Šìí³WÕÈ記B¢@¶ÙàoMKs§©>›2îðaÀ7׿ù­­õ8T~õ)}œmµkùj‹`®…Uá`†-®L8 Jõ·³¸}ƒ_Æ1 yêüh8™-è,o奵ުMÛë­\Úïæ­$Ì92­Âx4#ÌõÒÇhËe‹±·Z:ŒßÁUI‘¸ G„ªA¥ è¼ìòÑVÙÕ¢íÏ.‡öûe‡BðÕjG5:'Á|¤U†µHûSÌ!ý^² ¤þ¹ÁÁ +¥q578Srb¦äkøùâùM=ñ-ùÒLqø ÙæH3Ýô—.ØxAÏv¾Ë¶{Ï<¥‚¥½K(²$„'áäÀˆa‹”`A2²²³ m8WÙLèaNß%Ý¡.Œ¬ÓlÏÐ"L‡»™&QÂ"€.÷{kaMÒhiLÖ€(ïÀ Ù{ÐÔ¢Ô (¤Ííåë]-R]B¼”Ó¡l•™T——²\o«Y¦ËË~(Q@oPÓ›ôÆóÄ"€µv;çÓ³m¨¹ÿ¸Ðº¥aêDk÷Xy= Ñ 9Q»­ZÐlêdËû!8¬©²—tئoÀrÅÒTøû¡Æ ÓN…ƒÒŽ¯#5C“‘>Ìès·Þ[Ìu­Â[@#¤Ó/ʼnP[$ÒÛŽKö)o´¡=g±ÿB'qÏâþ nGHGöV¸¡1¬›Å EÏH }‰SøYm„u€²‹Gz0ž(ç1t{9b>Ó]ØßA8ýÐDd'´@x+Äù…Žî×v;~ÆæÄa3ÁMüûxúpÔa‚jø,ã¡:R˜õþŠ¢ùtd 'Áæ<–Ó==ÍñDÓˆa‡œ]›ÝgJSœgŽ™—¡¶–´†g¦ãñrfnËl•+Û")SÖ”²‘´÷üÄD§³¬ØMÐ%¥&Ý;fpƒÜÂÈÄ W1 ÒoÍ,ú(„móEëÆÚù“í?Ô…ƒó¬Àí¶‘]åãé-´¶“wÝ-À Yèå56oÇчpÆá5®ãÇ‘ÿoQö8\–Kr› /e -#N4Gô‡ŒÐ/¥™¨3]Åîv[kWRÒ9²Ûpß ^ÿDÇ«<[æ‡á!‹‘Ž¬šGd:kÕ䥵«¦6mïªÉ¥¥ÍÇb]-zhc² }Úy ónÛú–èû†Õ‚åF¬–G-ÒäúÄðc¸éõ*õ3L‡¹ëÿTƒ¸Vd®íp=e¬NK[ÓšNþà¸hšW÷L²£·ì71"€ÚûͤƒV‘§Š?ùU/íûQÔÔy¸Y0h.y1¿µ¬ÃÆ’+˜ -„ø¿±ì7–’ÜZX¹53¨ðBí⌕üloÓás¥z¼$=¼]‘¥”`)­«¥¬î×xÇ_â®®ñi¸éLÓ/»«nc?ËiZmþ¦V“ ÎTªü3…òÔ8B5_½é~~$býÑÓÖ_­d¦¥‘°ùB7¬ª’u|&Ìäô‹a0Ö–Ï”°¤¬Î~ßÐkèõNÛ©ÁN -¡*GcTƒ_úó a Ð?<6Û’?62FŸ–±á.ÖKú© åGûÊ%mSéZYmSe'½žø&í =ö!LSAüÐÝd¬ÉȾ©ÁœµÖ¨Û^j´8{Wç^¿ŒêæbcÑá{À§º%X*b²)toçãÔˆÁ´ýMb2Mùƒ‚¢¾ÉúXtLj±lSÞÀ8,'„PndáдJÁF¾¬ žÕó6ì=\w7¥è0£A´[ß)JЊqYl³µ™QÚÛ7ï¸ÌYfôÂÙ~•µ²u?«Öăï Ñ(9²oà€<:PkwFð¡´¼Ôö­6uïZ.õ>;¡ô^AAsß¡Ø *ÀcXiŽì8 ÔR ŽðQW -´¨ûp¨?uù|ð©!æXŽŽäyj:s„øx«1Òâí%ïéèîC6>X|Øð€å~Œì\Ö˜a‘ æ<|¤V¢i¯Bé=Ž‚âðéî ½õ¾#ÖÀ´ë8¤ø)GÔ©1ÃêLçrÏÇQ¢_û˜ ¤ÍÜò‘~¡ì0›Ýì°ˆèÙ_½¦3oP»ÿ‚&/éü[Ü_ÌôÇ{ü¡ÀŠ³IáyÇ\c<ÿ®…0_!’ÙŠÔbîÉaîˆdÿQ‰ô’~¼ÅÙQKd2oP™°hÌIÖÏg+„9ç«cõÑJ“±ÿ›•š±;O!ür¯Ý n­²þOÝàíÊ<èßeÕï˜KÄÀK!É‹UdbÁço<¤H˜LD7Þ?g ¯endstream +xÚåYM“Û6½ëWèfjcÁÄAî%•Øãd\ëI2£äâõ–è‘*£H”]þ÷ÛIˆ$U6ëËV*I<¢î×>Má?>Í5Ke159g2ϧËí$>ÂÈîs™{˜ï“¯µ™ò”i1]|ìæÑLi9]¬Þ%/üîçÅÍýl.¥L9›“'w zð꧷ßÝÞÑõýÏ/Ÿ=ÌÞ/ÞLn­ÝvF°Q Ñ?&ïÞ§Ó8øf’2YäÓÏp2ÃÛ XeZIwÿ4y˜üÒNEcjJo­Qé¬äÓ¹LYž«QŒ)˜Î5üê”éTµ<ˆt„‡A~›É4ùéöÕ?ú+ä¼`™Ê¦Þ„£ f`•kÏ*šñ £çÝŒ'«ýl.L²œÍyr†û-^T»™È“ºZ÷pàß)—vìHð^žì70äÐǾóŽ #$Si'¬Ã„ sôý׻ۇŽÐ%%+L5Ù`6/é’SR^}Ú?îw´úS…\añŸpñîÎ!Y»ÍroùYÁM…ÏUrBL¯lvª²"c25QªÛX®1þ¿Ð8½PâÎîª'zFã”-ªÐ–*Á8ïh o(A®‰ù°½.ä/ ŽG|gÑË Ë§K toSj¹Ä'ëÍ®K—‰¢r‰%–%š… +ÅŒPÑJìa‚„é¢`FÑ…AÁÀªdÜÌæZ§É˵gbÀc–3%²v‚+Â3 §›iîM5ô—Á™]8üpÿ0–(L:=«ƒ?UÇçø<Ãm˜ÙR†„Ò#{]nññ‰^ÆkûâyYŸLƬë€QÒ;ˆ]ƒÔ#œg(RR?w{kºúç ÄE!4Ó<¡0Ò9œ2\ ^›dGiŸÖå±>ÑõçM½¦«ú³Ë£~† xñZ ŸÁÄ‹ÌÁ]4¼ûøH˜ 9¤ïL9È3šk¹¶”gZ@×NðÄyPîVt±9þ|8à"ÈïÜ”§Š¾–ši—&És•–ŠmµTßꈖò~--¥S8/<Öa„9ÌÉ2f²Í–}›£éÒ7ú¿×R +{× &HUƒ¹*¶bFÛØê[‰-ßè׊-¥"^†=L˜0‡¹"¶b&ÛØêÛ-ßè׬ÅJf,—ñZìa¤qÎr=¨Å¹«Å÷p{óê¡«xËcµrµ ·¶|:Q‰û†~l¦Æ[7üBgËß!RçTZ0.G„»‚XAK¤£q" Ê]rƒ±Rs]Τ=ökwúj«/m„Uã<ДÓ1ØPbEΨLù߉T£ÂÀqpeÆW£J%VQ®«]E"SèÚª<ËiΊUÍ(+”NÿYÝw<ÑÃÍÎ ÒÃâsuªŸÓñû²?Ó0æ§3Z°6Ëß«‹—­¢Ü¾ÐÝþ#9T“³‚ìAÚ¯ç$?Ÿ–˜ÝŸÊÚÚ\!¥ÀÔ¦•ktÎi‘ôöf,Lrl×dg¬pã>Ñlà½JMò¡€lžQÔà«õºúBWŸ7ÐÃöÅEæÞ@Y…ØM¨H[ôéüáä8ºèb +c½u^”¼r“/×äíï'6 ºa×Eh‚ÓyÛ7°Kójj TKšÎdãÔ½§ßméOÊÍ®i Üï(>‰—fìPǺ „t²´ß\ÇSÛÇÖÄS¨àq!e4{˜`jj0öÛt$A«„éÛò¯&"7SÜ;.R›ˆ|÷°ÿ|5ÐÁEÉp¹Þ· Ãr®.Ìõ…u~z'éî4'¶«¡rÉsCqõàa‚[Õ`zŸïòwò)íß$b†ÌÀò læJ^˜vâáÛoÑ:þ‹¹óP®VV5Â?Ï©®~ÄäøQóö«XíjniKÁãnë)q-¾ÉÃÛïéåuU®ªcè$p]0#ã_=L˜^‡¹ªë‰m»ž¾Õ‘®Ç7z°ýÎ~Ó6-ô5q^HB (· YÔ’ŒwÓ&L–ÃØ´q¼BÆœI³¨Ý30> endobj -1603 0 obj << -/D [1601 0 R /XYZ 85.039 781.388 null] ->> endobj -358 0 obj << -/D [1601 0 R /XYZ 85.039 761.463 null] +/Parent 1615 0 R >> endobj -1604 0 obj << -/D [1601 0 R /XYZ 85.039 740.731 null] +1637 0 obj << +/D [1635 0 R /XYZ 85.039 781.388 null] >> endobj 362 0 obj << -/D [1601 0 R /XYZ 85.039 614.69 null] +/D [1635 0 R /XYZ 85.039 624.724 null] >> endobj -1605 0 obj << -/D [1601 0 R /XYZ 85.039 593.489 null] +1638 0 obj << +/D [1635 0 R /XYZ 85.039 589.974 null] >> endobj 366 0 obj << -/D [1601 0 R /XYZ 85.039 508.095 null] +/D [1635 0 R /XYZ 85.039 436.834 null] >> endobj -1606 0 obj << -/D [1601 0 R /XYZ 85.039 486.895 null] +1639 0 obj << +/D [1635 0 R /XYZ 85.039 402.085 null] >> endobj 370 0 obj << -/D [1601 0 R /XYZ 85.039 442.148 null] +/D [1635 0 R /XYZ 85.039 330.24 null] >> endobj -1607 0 obj << -/D [1601 0 R /XYZ 85.039 420.948 null] +1640 0 obj << +/D [1635 0 R /XYZ 85.039 295.49 null] >> endobj 374 0 obj << -/D [1601 0 R /XYZ 85.039 309.668 null] +/D [1635 0 R /XYZ 85.039 116.464 null] >> endobj -1608 0 obj << -/D [1601 0 R /XYZ 85.039 287.255 null] ->> endobj -378 0 obj << -/D [1601 0 R /XYZ 85.039 203.073 null] ->> endobj -1609 0 obj << -/D [1601 0 R /XYZ 85.039 180.66 null] +1641 0 obj << +/D [1635 0 R /XYZ 85.039 80.502 null] >> endobj -1600 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F35 948 0 R /F14 969 0 R /F15 951 0 R >> +1634 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R /F42 967 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1612 0 obj << -/Length 2719 +1644 0 obj << +/Length 2001 /Filter /FlateDecode >> stream -xÚµZÛrÛF}×Wð-`*cn¸d\N$'L­å¬¤ì‹ãRQ$$¡LZ”Vµ•O÷\€!.ÚÒ–Ë".sfº{ºC'!ü£“D’§“8¡„'Éd¹9 'wpç—j3™9˜Ÿ®NÞ¼ànHÒ0\Ý6íH"$Ÿ\­>?ÿúî÷«³‹éŒsr:‹ã$8¿ÒN?~x7?×Ç¿ÿüÝåôóÕo'gW5oÝ"p¤HúŸ“OŸÃÉ -:øÛIHxšLžà8$noN€•HÁÍùúäòä_uSúž˜è§úÆ(8%1““I’ˆ^ #’È„!‘¡¨…`®”2Â)›X*ñÇùüòꂵGH#J˜l ½¤Ó!¥Ò%ah0x—t¿Ë¶ZÞb±ÉðHûbJƒ|YNg, Væâ®Úæp¹¸ëôÏ 8æI¥¥yD1 cDñ‘Ö¢´HûEqHŸ¦0ðrûeW-ª¼,Œ>0úÅf:£A¦/ì d‰WŒTSsO«…Ü Ù+M‰ŒF<©Áx´ -BU݆»Œ)'ŒMgR†Áå»åRoÕŽº 'Q¯»ÌlK3§©žŽ¦œ¤vt~þ~ÊÃà#hÅÁŸ¡ ¡×;Ú Öå]Y¼Á¿†”ëkùÊü·¥~ -Þ/«ýV½h‚)B¬¡Ü¯tƒQà²Gé(‰!×=ºQf93¿*Ó¡=ŒzIJ¢ˆÐ.×9¼1ˆc•ŽoùÊœæà‡Â†:ˆˆhpśž‚ƒ{‹Y:¡R…>pÔ¡— -Ê`?ü/µy^ªa÷ÿ­4›Ÿ~ß}¥Ùé­ÁthU“ áÐ¥“fqPæZ;™¢Ïá<°ÕSxzñÖè³Üfµ¶Öå}NÀ1ÐŽÈUcêZƒu¿õî i1ôTË)8ܽÖãq*£`±Þgؘ¸#§™'Iœªd=LbÓJ^-áQ “3¦úüú[°9Dk.\.`žRÐÝÛ:SüŸºÄ˜ât›Ÿ^CÿxM!'Ô4W¬ìI}Æ&%’Ôï Æ#(\Š Ìjy…Ð^qú;ÞSE¡ 4¿¤ŠÒ-Íœ¦úª(p]~ØÙ‹³÷º(B¹Wåf‘›é«Ì&ÐÃ&<Ñ´y45 ãMÎG]›\‹ºßäjàSBÌ´@›Å­thŠü{£4²Š•·ú×– Û6‡IjH0ΆòG°äÌ€ŽÌG] Ö¢îÌ¡z½²ÇÒ”pžŒˆÕ€óÊwðîfTˆ‰˜ˆ8ö¾0‹éÐXC×凴Ÿµ­ã}_c}Jb³6°¨—S¶jmiÀYÊ Íõ›cƒ¶Fƒi¾ÖtƒœTb|„Ò&l…8¡>Õ8„]·=ü†åmH–8!Q:²|ä€<Âvt¨ŽTeÿN{߼ܬ[險Žp»v9?íIJb°ÝWèšii¤k9¸Ãç‰\ŠWè–mÉß-†‡_9Úýâ1¡Ük=Òá; ‚™È¾¯ðJw‹ ‚Lý_ŒÇºEJ’8j×Íò¨ºÙ>ü -u³ÓÔpÝìv¶ûõq¥>Né@b+åÛò}¦–\3µ Å6×Wõ2Hs>åTUÝx¢¿ŸáGJˆGªØÆâq°æƹ„Šô¥E7ca)ykÔÊL“OÝ + tâ´Úµ5¦CÝ)‘(\q©E¿}‹ìðG<¨ykåNiú3 -î²J_³ÌbŸqØôÅ:¿+Z–~ê)¯Ì2ñ®Zl«Ãšàò<ó“gæš@ÈXŒM› Èó* èè•u/µ-ÚÔ½E‚KíÍ|Õ‡© -Óˆ¼0Iî:+ßë6$ø-øîˆXhX, :Z,/µ«MÝ+–Ký ÂA$F–ˆG,:j ÄKk×@Ú´½k .íë¬4›Ž¾jnPáÞh:FGa:Nam­p‹¶_a‡ö›¾Ì1§60°7ã NCÒÊ„H1²vâ€<Òл¿¼¤v÷W›´w÷—K:XS`ªàß×7É× -Aê¦# &È£QW8í½´®ðwÍÔn× í[ÃÁÍ)^- ¦CØzqLm`q ;†~:pQ†‰O˜ƒñ¼ -©MÂÛ9p¤sà?.q“E·N…Úd~I¬[š9MõåÀ‰Úbäv¶wÞM —DTÀÔ×lÙãÙú©1J§+• Í1§=ëfD‰Þ+ëá56o+ŠõNÙ†×Ù™¢¶…™¹{p3‘áØž”ãÛʧ0GÜÇkÞâí¸ÃëìNUcß ZR’Ê‘A7˜áAÌуöñÚA·x{íð~É—˜X|Q»£íèEïèÃsˆ‰½u-ü×_^´c¿ùÐÏIÂÖ`%‹I Óõ)mwWr˜þ!4vúû7~Œendstream +xÚ­YÛrÛ6}×Wè­TÂÄ•dßÒ8g;µÕö!ÉthJ¶5¡L‡¢œÉßwqÁ `7ñx<¼àì,À +ÏøÃ󌣄æó4ÈfÙ¼ÜÎ’ù5|y=ÃHì`þXÎŽ^ñtŽ”'ù|yÕõÃãt¾\}Œ^¼yþaùò|SJ#@.â4Í¢Ó¥~q|öþùÉ©¾?ÿðâ—‹ÅçåÛÙËå÷Ð#pä’ôëìãçd¾ßÎDólþ î„áóv¬ˆ3jž«ÙÅìÏCWú›ëVS>rš!žÑ±“”O8ÉĦœ,›ÇÑzÁI´ZÄpwÛnŠj£Ý"fìg•ênŸîÕóêÙ"æ˜E—}D±ß­uÓöfý]ß}ÛT€M¢J?šê^¢57ËX${¿Õ·;¸Ý_îTÇ_÷`–Æ{ì…o$*oÔù­ü²ƒñʨVè–wºånoµrÈ@¿Kys¥Çæ¶U\XÙRƒ1”gÑf§¯m­¯ÛÂXŠ£¶ØPa¯’Auq#­Óª´†Q!i¢õl×Ëî䥾•ú)2+¬-FXšÃ˜óyš”‰é¸0ØÁ¨° ÉDXŒ”áÝÙë!N2”òÜ¥ G4Eb2šcÛSØ*Œ ¢¼oÖÉé«M¢³‘m4G‚’ 3bÅîÁ ÄÈÒkU_«@€™^”¥z¯†Ÿdrœå{ˆ]ÕžpME!ã!‹QÙéü%PKkF©‚À ¯ÅŒˆûr a{ÌeµYkßc%FQ•{™1dŒÇ:Æ©œ¨ë•ÁÝé—¿™oWÉ V-\!Û ÌÍéL*LÓœs¼ƒñ«HSÄÀsé |$ì ˆ`HQ£N”ªCA!c&;¶éOľé)vºšˆ}HøÂá Æ>d|AøSØfzzÀ6‘8|JF<‘FŸž€|›•~T9òJÍùBD»¶Ù—*3î›õ3ý®ØëT©ŸªõýºÒ·zþP  ‰Ô³ÂÎæ1 XÂÃS.ÑOi8X Fzù·Òÿäø×Ñ`H-LÌÇóÍ`F¬ƒùÆî‘Þµ b3bd0®Ô%|hÌ%lzÔuWØÅ jÚ³l³OŠ(ËŸÆ,Ó×vq!ÛWÌ“‹q +Òrþ4Æ™¾0.Í#iÏ8ìY"xJôŒWãW‹‘\ž¼Q Äùx½LT0†X-fDÛ÷‘ +X—uUoõ–²¹‰b«weêÅ^¾Ù”&'4Z© æ¿Y Š•½k|R1’T„¥ê0~© FI%Óþ©d]R2^N¹V+@l1#æZXªåßÑHªPÖz-lêÊç<ÎPž†7{Æï¼Á œÌë|€¸s~À<å¼Cìl¬NŽ=³£,ìoñºk ›ÊäpNÌ ‡9™ÅÖüSÌ&‚_XœãWÇ`)O€µÓg@;%ÃúM†}Ý|¹nÔÖún¤–ÜJlJ©T]”XëbµöÊ;‘Ñ°<Æ/Á¨ÍïM± rD@¡XŒg l¡r¤¶˜÷`'",ÕvÈ?›CHS2íþ»÷úÍ™”ïå•~þ Ÿ‹4rÒ¦ íÂœw§tVž±°NƯ“ÁüÔNîiò‘N¶h£uꋤT2ñçSˆf±,¼ä8¯Bc&ÚÅò|¼ØP +ù1RZ̈s0ËrÄ`gç’þØâ ûvµ©ºöÉ»0ú@’v0~y æ1ò(;yœÓò8¤ªv¥¢¶è¡|-Å‘ÙÉ+ÉɇãÇ`#N€²gÀ9-ŽCjsô®-ÚM=D6S/ptª—°½¡d½Äl ÁC¾ƒñªE2r2:ä}È¿xþ~¤ (Éé¡áO£MO±ÓÕÄ1ZÀÉÅáëñÝÓôNmáYÖXä†éHn›>%˜ês²>mÃõöªÖ@}ÌÞ«Ü»œ¢IÆÀþpÑÜÁxëÉ„Xȉrá´VÇùõ1Ü]·2N.«ïòÔ/w¸76d65fi°ª©RBº2/¬ZºÄ»ÓXU‰€*ãÞ銩Zæ#L”Vßu‹«ºÑMT%Xµ]7ªŠmß×ú +/dÜ^™vÚÄ¢4.»â­¬oÉ +°l¥Ê´ÕDAB[ ¾)vú ‰~iõ‹ËC-{m ªX\oµlõVö¬Kà+_õ—$9¬უƒñOƒQµÅw‡Á¸Ô!àL+\Ú&¦§°u˜$(qøÜiB¦ê$σšẌvPW%jÖ£íꞦæ{¨oÂdd6ã­þáàHÿ pc1¥“4ÃÕbœ”°48¢Æ;¢ó¨ÒUˆôPº²N”®\Ò;µNÖ­€=©é×F-µ­T©¹ªë¡pä‹|ÌÊYxau0~ Æ­ªOD½ VIcFœ•0b9ë‘6Nî³ÕñÆžýVN•<ïjé,ŠM,]ßÖ=°W.Ø(gá<ÑAübiÈ l0µÁ×%ë¡j0 (8¬NÍ ²nßËYûJ&8I`.“°çÆïºÁ<Þ÷qçü€yÊ{‡Žsæ÷À¶”»-Åý‚‹¨¨öJ0jáôÈQyâD‚ +ÓѦ•?˜rÂÕNC?ÿ{„ö p¾'“ñÿzÑû©_ºû°4£ž9Ä!DÊŒ-Ò–͵?ˆìý:ú6endstream endobj -1611 0 obj << +1643 0 obj << /Type /Page -/Contents 1612 0 R -/Resources 1610 0 R +/Contents 1644 0 R +/Resources 1642 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1599 0 R +/Parent 1615 0 R >> endobj -1613 0 obj << -/D [1611 0 R /XYZ 85.039 781.388 null] +1645 0 obj << +/D [1643 0 R /XYZ 85.039 781.388 null] +>> endobj +378 0 obj << +/D [1643 0 R /XYZ 85.039 663.595 null] +>> endobj +1646 0 obj << +/D [1643 0 R /XYZ 85.039 627.633 null] >> endobj 382 0 obj << -/D [1611 0 R /XYZ 85.039 719.568 null] +/D [1643 0 R /XYZ 85.039 311.903 null] >> endobj -1614 0 obj << -/D [1611 0 R /XYZ 85.039 698.368 null] +1647 0 obj << +/D [1643 0 R /XYZ 85.039 277.153 null] +>> endobj +1642 0 obj << +/Font << /F57 1075 0 R /F35 948 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1650 0 obj << +/Length 1708 +/Filter /FlateDecode +>> +stream +xÚµYÛrÛ6}×Wè­T¦Dq'Ø>d’(N”Û©­öÅÉxdK–5cS©$'Ítúï]\H‚@ŠíN&Eà,v—»bøG†J Ìòa¦bJ ¯ïx¸„'ïÄ!RI=Ìëéà—#‘ F9·ӛz¸`Ãéü"yóþÕÇéÛ³QÊK9J³L%'S{c|züjrb¯Ï>¾ùé|ôyúaðvZñV3G®Iÿ\|ÆÃ9øa€ËÕð\cDàñýX‘àÌ}¿œ~¯¦²ÏøÐŽê[£` + ź‹dÒ[$a)Xv&0˜›U^϶‹Q*¨Hȯz 0_J4]nÿcîQj¦ðLÆ—““£ÓK2J©„Ñ«ù媸Y_’ß̈Ô"̈ +I0sÝ;c–Eqwï$¨”s»*xHш$ Q«8y7ÃfÉ,ù„^nÖ_ì× æî쇧$d§ ˆÙ¯?x ¦Œ#ŽE/"Ëaƒ¬„H¤‰¯ÄaôJþ˜€àg$™2Ú¶ŒP$—CoÒq‰é0Ñp ‚HƒXkÔ_¬‹¯æmn· ¡r”]³‡ ®¹Ä¼æqµæ6sÏš}â‡íbc×;Ûí6«+0ãa·Øê[Ü8κ€[wß-æAGŽõøv5¢yòÝBË$ÁqÓóòŽ AY<jHXKž!æâÔ‹n#a|ª­>îè*Êd5voÂbHö&«ÔM”z3u-%2GL6,={ fÕA:_ßÏttöÖfq£í^lÅõ¢ŽÝBߌÆ-dN$)}bÜ +-$Éâº;Œ^ÍŸ#†“ÓÉøEGg’[ÿ­'ìú¯ÃtX›þ ^N¤Ú=çkHÉYr­…Ñ|od+FT%»Eé¬úÁ'L˜•ÔÞ„PÌÚªjЈz®Àµ‰Š*æa‚Š•˜ƒ£>F\E}›¹'ê}b³X§”Ž^ð´Ò˪èžÃãµQÒúäöeH!¦qa*HX 9È‘"Œ•µ({ÜÈc<Ø‹L„öZ™YUÑ$Oíbm÷*t¢Üq7€ ºU(§$®d Ké0‡»X„¸v±sŸ‹yÄÀf4H­6÷³¿KÕ´ëÝë¿WFžR¬õý42YÅ6+x´Â) {˜°Vs¸VâZ«sŸV1oHõ¬ÁÉ2ïÎx¢÷0AJŒÑédò~¬¹Ïº*1iˆÑ–˜oS%NA%Ÿ6{ÌFðÊÄ® ã¹ Ê-x‘~¶´¸ÛÅl Þ͒ʸX5&,–ôĺ(Àï;5E +7¨]„Ø™â)Í‹ß7Q×m³ ‡ƒh~³ÜL{ÌRr±j˜û½…K;U¥ðþ‡f.¶]%¦CÛp2ªV47ì³u”C¢î1®Jh 4^_x˜°ï9Œó½óéY7“e(Ïò(c‰éP¶2Cœ±çS£´_šÍ£êx˜ :%F[ê + ÏDîS>ÖõÝLqˆ@4M;ŸŒCÉ‚ õ¦¹™ö˜É{|‘d}³ÜL{Ì‚JVz|U²hç œ›ÃŸ˜ó”˜c3Oi2þpž€MÝ6šA[ƲhìaÂî-ÂR¶Û`qH\Ž}zìÍlƒ}K''G¦â¯a{BeDÔ^ó{³þÙ~»ƒo‹¯‹;}V!eÂì]{ìÂ}1(º]÷¼»uÛ™žØl™i£ÝG`s¸BŒå{»éxÝ@!ä,^Œ–˜V1ª.º)œ™3OoÒžn1æV+¤â¬Aí<ûåKÍ8çÉ—™vêyý>ãÉnd²¸¾\.vv Oõ˜+]Á~‡Ç;—Þgw«eÑj©ì€o«Ý­½Úîf›]³8‡!ǯí·å†C\/Õÿ² J"Åâ5¯‡ nG‰im‘¡Þ F\õmæžÞÀ'Ž¾O·úz§{ÊU᪌»E±,%}a?hH'‘£,u*jLX'‡9\§q­S‹¹O'øÿÔ‰Q$Y¼4ó0aæ 3ŽiuÈÑfí9åðIŸç˜C×j:/ì`-$.RhTÛ +–ÖBS6ÌX Û¤ìÓµf|”¬:·M4f\¦¿F³pµÿ ©_ÏL!ÎãgH5$¨§ƒÔMDO§ÏL‡á+!mÂV$禇𣡬˃ha\³ïu^þ|Cã{~½© ‘ƒo9 ¨'{j3«ì"<» Þì;ž¡yÓ „´ÙZ‡3Lâ>[Ç·ÇrŠA]Ú[LÁûcë“~9®êeÎà¨ç´·2ãÎs§Úæ–?0wìýíz»zendstream +endobj +1649 0 obj << +/Type /Page +/Contents 1650 0 R +/Resources 1648 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1615 0 R +>> endobj +1651 0 obj << +/D [1649 0 R /XYZ 85.039 781.388 null] >> endobj 386 0 obj << -/D [1611 0 R /XYZ 85.039 490.164 null] +/D [1649 0 R /XYZ 85.039 681.042 null] >> endobj -1615 0 obj << -/D [1611 0 R /XYZ 85.039 466.842 null] +1652 0 obj << +/D [1649 0 R /XYZ 85.039 644.171 null] >> endobj 390 0 obj << -/D [1611 0 R /XYZ 85.039 421.489 null] +/D [1649 0 R /XYZ 85.039 571.72 null] >> endobj -1616 0 obj << -/D [1611 0 R /XYZ 85.039 400.895 null] +1653 0 obj << +/D [1649 0 R /XYZ 85.039 537.577 null] >> endobj 394 0 obj << -/D [1611 0 R /XYZ 85.039 260.698 null] ->> endobj -1617 0 obj << -/D [1611 0 R /XYZ 85.039 240.104 null] +/D [1649 0 R /XYZ 85.039 275.437 null] >> endobj -398 0 obj << -/D [1611 0 R /XYZ 85.039 129.733 null] ->> endobj -1618 0 obj << -/D [1611 0 R /XYZ 85.039 106.411 null] +1654 0 obj << +/D [1649 0 R /XYZ 85.039 241.293 null] >> endobj -1610 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R /F36 955 0 R >> +1648 0 obj << +/Font << /F57 1075 0 R /F36 955 0 R /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1621 0 obj << -/Length 3050 +1657 0 obj << +/Length 1641 /Filter /FlateDecode >> stream -xÚµ\Ûr7}×Wð-äÖ;sÙ—TÖr¥âK,e_?ÐäXbY"µ$åËß—ÆLsh %m¥R"9‡8Ó@£ÑÍ'™þO*Å2YOÊŠ3YU“åÝY6¹ÖO~9〘dŽ0ÿ¹:û×Ï…~š±:«'WŸºvË•œ\­ÞO_üúÓÛ«—ïfs)åT#g󲬦¯¯Üço^ýtñÚ½~÷öÅ—³W¿½¼jyÛ5GmHÿwöþC6Yi;˘¬«ÉWý:c\?¾;Ó¬LåÞßž]žýÑ6åžå÷­PsÉY)Ôd.3VUyó‚UªÒB¨Œ©,o…XΓ\L<È(aú̧W¯f|ú²ßO®*&T÷… 5`Ô\aê¢dRK€©ïûý×™(§ÛÝʈ-¦·‹½±æà¤ß7èÍa}× Ìƒ^—²`µR e:¡ €Æ+CQ·Êô¨ÃÊ ê¡2KcËbã´XÎD5½Yl®›ÚÉò¬HhÓm4^ŠºÕ¦GÖQµ¹3ïö‡Vœrz33j9}r­~{g,ŽË”ÕúoJ¦DÈ c럯/~=7¼ï†•¬æ ^À xeú%æ}Ø7»Íâºÿ {¿Y/·³¹6+3n¢íô£õæÚ}tÓ,VÍ.¦PQLf%­Åò q -‘¼^¡>oP!Ìkúaïôù¤Ex¸½u"lÌȱb?xؘÑcç(8ƒgùtØ­Í®ÝÛ÷D7°ò¯ârV‚•ªJÈÙ94RNŠ·•³Ç–ñÞn¯·œöK×o=°îaJ>Ó,j&²:¡X"ÐHÅ(ÞV±oX1Ä{oz¾ý+ãù-r¿8Ü„ôBÃ- Ù)CN)V$B\‡!äs˜‘꤭xǤaí:Ò›­l¦Ïë]cGÜak„ùî'­yÒNÚF]oƈ£EËãZ˜C´ó\ï´étç;Ñyïu°ã˜ú»|=Ü';^æL©Žw ¢ãßqŠºíx:ÜqDmøƒÛO˜hx½Ûšw÷û¨…Þ¶óÄædÌøïLfÓ7çÿÐæ…ë=E ˜íqïUázhí‚°rKª]@Ú•›ù „‚æÎn¤}óãÞ®#[»z84<8l½˜0ª¸ËuXTÔ¼d"•Ë !*€Æ+ŠºV=êð°BÔf?â´Ð¢©Åu|8IÉJžØ†!ÑsúåÍb&mãÓ÷U%¯X­'I˜yoPå,çÕùÈÙŽb©{³ß¯ýjûò“®Ä´ãEbO…@„6—®‘¼>_ëó6Ì‹÷TßS}iUØý_÷ -Jÿ-xJÊDH  ‘RR¼­”=Þ°”ˆIiº¾µkáâÐéû…¨hy-YV$v¨̓F…z’Ö‡ú>m0ÔcÚÑ¡‹»½[¬áµQw‹ûäØËËš©DÖÜafßò,ß(fÞzÌÁ膘!¸iNhvZA–wVÈ™aJ¶š™yºÂó÷£Á}?4{6›ç¹ru«ƒqËFkóí~±ñ‹§‘{»ù1ªr¡X]&vfDè  ÑK(Ií—Ð>up ÅÔ ðÜIò´¾uÍjYb+èãÉD>¼™û¶hkE&mÝ[»=ÜDƒ°ÐûÍ2—Ïb¡o+a¡ÔzêO°…ûõj=ÚM¹HMÒDŒ umêz´áP‡h_ÿùûïGƒ§‹}n–¼X8s©¬›Þ¦•#‹ÏåÅù>šéæ²bU™ºBâË«wà Zp{*C’f@z,s™Ù“LJJÄ—˜*B1)…"TÐU(ÒV•iXDzÊID2I‰ÉÅ9+ËÄ.¹4F.Š´•«G– ‘žrÒpâ ÒQ• ‘Ø©#P\%¡IêUê“U¤?]0Ù¥Q•³¢Ll¼ˆÐ@c4¢H[z¤ai¤"n„Û}ꌓ%g\¤tê@„N£EÚêÔ# ë„HGè´²3ë„“ƒ˜jz‡§ÊDqÕ4:'%©}NÚ§椘úäj¡Ìs–‰Ä¾d«µçï7vwº¬Qæ9&NåšE$†–æi•$â3æUîm¹g˜«+&ò„,€ðörðŒ•Ù±,°7óN}ëæ“Máb’ÓÛ»„ƒ:á ™Øi;±{¤á‰HŸ£À”Z.¸ÎÉiZ‡!´r˜1RŒ­RÇŒa¡:Æç¨ÅôÑ;CY%6áD( cðùcÊ«á&Š³L -LúØ©-%LÓS­Ç¦]ŽŠ -©ã¥ µÌ€°ç;ÁŠBâ’Ô¥vEü¨JT5«dÂ÷…ðj奄 M_`Ó.ͪX4¤Ôg0 ZJ˜Vko!>W{0ðÁr ôF@¯”§2 <^ ôä®juD ‹Þ´û“˜áб1ïÇÈm`¡s¦JÖä=e„!†ŽSœè§‚inSá™Í•Ê¦—¿¦}Rí÷žâ0×Ò5°³’¬F|Æ΋×?ÛÚMÈcµªŸÁ6ßm›àŠ)Äg5Öׄ–óYŒ‚–Féí~UõöÊÜ>/Êé_™Ê ûÐËÇzshv{÷ÄžŠÅô¶ùÒܺ—Ü=Ù£rvãžè´e göÒ´Y˜Ý¥×Ÿ½=U<6tÍmÜÄÈm!¶R…nžu5µ­µ¡ù÷lž«Ú$ÊÙªªérmR¬ýÎ|´¸ìðíà8ÔÒÞ×ÝÚÒ¸ú§yRjy ö07öû“ÀÛ dì–¼ÐsOgñY8ÂËœqi<Ú~?°ÀÈš©Jµ$¨ìüië.oÖ|8Cs= -lÜãKÎÐVÂÒªb<¯,=Øóƒ{›¡@‚b³“Õz¹84P‚Z¸?ç&£±áîó,tïÕÖŒRªÇ«Ý}ŸP@n.Ÿ v×ø3¨MZêÕF–ž¢ö[—FÏDí~îOÿ0•À桉*Ïë‚•UñhåÑ÷ãÊ{é8AyÔøÓ•§-å±¥§Žs»ÛùÒÞò&4× Ÿåã5ï¾Oh ÓyŠæ]ãÏ 9i©×Y:NsH¦.Þ¾€¢äºýdxQ³"ü°q²wß'd éߪ,ƒ¸žµ¯ÌB}ØB•àã:ô#%Ÿ-j?é¾óŽšë]ŒÄzü¹´E÷NÔÚ¡yqÔ»ž« 1ðö‡¦‰œÞ¬ÍÎwÕlÐÝ}û›]=¹âÊÜeIì§(ž{Ш#B’ÖöiƒG„˜68óJk"óž4ó ­„ee¥£œ:²lÓz'E¹;ÆP¹ñA†±=¤‹yUšk5‰óH"¼ - Ñ%Z’Ú—hûÔÁ-¦ÇTî<Û5ö„˜ÊÁ³¤e:òZÏ"Ë1ΧO¶Ÿ|èYì¼;í=‘¼w1bĽžø”æ~PÊùˆp>€ÆMiŠ¶Ò=Úð”F´ä”î{†)MZæ§4²l×Ü-vŸ¼æ|½]‡îÍJøuÚö"‹lõx¦¢gi~¯‡0qê•ÅTÝ{EŠ*U¤€¯=C¢k)^¢@F¦*O6¬-PP†ùúV/VžxºE¾:AZÅ dÑ%®MÜšhˆÒ -W€Èܽ3ý©]aÚúƒ)z§*&{<šÒ™‚C6湬(R?év˜G]kñ£ƒcðè1†—Úæd]SOX[\S´YµdÜþÔ¸5Ëä íEœùiW`ýB£Û貇ýëjUj R·õ[ õ‹áKŠÑû²Çô%b¤|Ù5õt_’f/‘Yf±ð‡wŸ‡+ýˆŸÝz.ÝÉV{)µŽ¯"2‹Ô õÿæß³xâ?ŠÑ®D¹<*—i¡D©W©l1R /ö*YéÝÚû7/endstream +xÚµ™KsÛ6…÷úÚ…ìŒP€ ¢›N;‰2'u”n’,h‰¶4‘DW”êúß÷âA†˜¦ÓIÍÇΧ‹!2Åð™– a*¦¼$ˆ–åt¹›àéÜy3!F13’™¥ùm1ùù5ãS‚‘Àbº¸žÃPÎèt±ú’¼zûòãâò:QJP¦3ÎËäj¡/\|xÿr~¥¯?¾zñ)ý¶x7¹\ô¾ýÁCHÓ?'_¾áé +øn‚åôŽ1"p{7WÄrjη“O“ßûGé{ùTÊ—±S̈@"cqAyA{öp`1œ+p3C)I(ÊŠtÆN>º„ók71)8ʳ¢ÿð³™)*¼ygÝ“fÖ£ÎÛJ8AØò“_½N)N>ÀSðä+føÔB[냾°mîš½>ÜÀåýmúêrŽ8çq˜ƒF52LR Z¨æ]5ÇtÍù%…¯L$8£¬Lyõ-Ú®ô•›”Lód/oÊæ.û‹erlôßïûæA‰äa]™Ç×ÊDšæ‰GóÑœ´uÛÊg+,òyõ£>[}xÛ๘¸@¬dÓ¢,PÆ©“‘Ì,M°æ:â´ ó÷—gEFás\D];Í™-±¿B ”SúÄ·«èÔG `§A‚3gñàƒ&ÜhF¸Á[pËWÿŠ •ÙóäÑ7ñì4C˜ñìƒ&œÝhFf¸Ù[vË÷ûf™fPùò6„Í.˜çàUÆÓšpz£™>â:¤wlýé-ßûªm¥óƒŠXéêßBTêúQ_hkë$‚†qŽJ.¢h,MM§‡&æÚ£qm½hl_?šeeF¨ž¬%¨ý]ý<˜¥` 3hÂ`Œf$˜ˆëƱõƒ±|ý`vòìÔm:ÀŠ$šN´G± e|±4a:F#[ùùjþöB6óÚG§È‹¨k§9³=£Cž¸žÚú°¯v&²œÓ÷›%LÖÀfeªD÷+9§nöwúÒº®V0%ûá䢀¿yŽ¥ Âé4ãàÄ\{8®­Ží*á¼h5š[ÈÚnu~Y&Õ®[¶À…Ó^¯xàŠ—š{yÒUWút­ïÀVÝQd!P^Ƨ-K&i4#IF\’Ž­¤åj­TÚ¥Ž åto:ß)»<ƒ&‡5h°Œf$¬ˆë˱õÁ²\ïeh9µç[Ãâ¾’‹äsTV‘yhý‹B# ee|´4avF3’]Äu`çØúØY®ë¦ËdèÍ¡VÕvT¯]_•wú¾ÊMÅ9õ™jƒWsxŒÏ–&H¬ÓŒ#s퉹¶b¶ëb«ƒÝþ’f7Qh†vÕüdyŽâ¯õXdq~ƒ&ÌÏh¿9¸_©5¼Fº3¦FŒ;Í™³ƒH„–±5º-@“ XzrSŠ„ˆOŽ–&œÛhÆ玹g_nËø¦Rk©,´ôT,Ê0 \ RÄßH-M˜…Ñ8,hd1X8Î>¶qkFX}~ÈœÁ_.â³”¥ fî4£3ÇŒûÌ®³'³müFMT§ûç2³ ">»Xšpf£Ÿ9b> endobj -1622 0 obj << -/D [1620 0 R /XYZ 85.039 781.388 null] +1658 0 obj << +/D [1656 0 R /XYZ 85.039 781.388 null] +>> endobj +398 0 obj << +/D [1656 0 R /XYZ 85.039 761.463 null] +>> endobj +1659 0 obj << +/D [1656 0 R /XYZ 85.039 740.731 null] +>> endobj +1655 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F35 948 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1663 0 obj << +/Length 2129 +/Filter /FlateDecode +>> +stream +xÚ­ZMsÛ6½ëWèVªS¡ø$Á^2iܤ«½¤9¨msj‰®D§í¿ï‚H ÆÒd2’‰å¾ÅÛ°»™cøGæR Ìòy& bRÎo·3<¿‡‘w3b$–FdéÈ|¿š}ûVds‚QŽóùê®Ó#l¾Ú|LÞüøúzõÇŒ1–€äb™e2¹Zéïy}y¥¿¸~óÕÍâÓê§Ù«·Õ¹ý{öñžoÀÀŸf±\ÎÿïÞÎ ÎÌß³›Ù¯­*=Æçú-ß¹€"çK†‘”Ü+“åHHŸ#yËÅŒŒâá·ËI`¦$Y1:œ%¡¥<;JGÀVf„L„ƒLA¤Œ5»KõÁ“Ý‚ÊäLÙŽlHs„iæÚçš!šù™^Z]GlÍ(b=[«úL+Kû‘}y†$cç±ÏèŠÛG1p‰Óž…‡rsx54ÍÄDFâ  ›N&6FFáý¾`8yyñõˆ’뉀Z™jß X¤zõÛÏ?÷¢æynÙT‹%Í’[åçmÑDR]l´àŒÉ¤*AÎ h'6ƒ5<­´¦ž‡›Áܪkývóôæòâ€<§yŠ΢<;2Až­L³<¯.oVÆ “1”gyÒÊŒ0 3GBÎ}>"`Úëma¸V•·UCè¦Ðt”\­ËÝ}ˆXtçqZ:™0-Ff +-ÈŽ–¦Ÿԡ嫃&å¾??>j2T0®›ˆ1ì<ïTä4ih[˜1žê}©^²Æ)"$NZ+æL‹L¡,Œ×1ÖôÖ!>V÷•Y6‡[Ë\ùTr^OæFhœšN&Ì‘™BN²cg€é§Ç}Ró¬þÀ„?šé?­aò°ã„Í‚„ÌPNâi‚#$ÈÊL (Ù4Äôä‚>TvóQ ”û¢‰¢ºRÓÿÏ.15Ò.±ÌDÒñõ%RÈ¥À‚(IL˜$#3…¤dGÒÓO’:¤Í^íCŸÕùW8gñiÊTØ)3?ß™0eFfrúnÓÏ!²'ýt„³™üý¾R=B“Ç)J‰ŒO¾“ OÞÈ(Þ]^|Üé´e3ñŒº°Ç²Ê4SMqëó$G$•QGY™h?NdŽRXÙ.¨9 "/l)>ŠœfË{hÊ1‰Qh=Øv¡#Ž¡Î´Q0H@«æÍb)Nn~Ñ"Â9kß;ÁcFÓÒQåñ ¦ž²óòêmÓ™ñ¹,•é9l3šŽØ&Á¡^Ãá¸uDã³e41 +¢,Å}£®WªœfÉX`“rÀÉQîêbÐ#µê¥iòX|.õW¢GëkÎg}Ãä*•mus|›Ó Žõ €H(rU+8ÐÎi#·“ifÈ„'r)…øÑUøUÕQ|·€Ã6Wù…ÐÆ +™Ü–*±:ìÕ£õEõ¿µÐR·u©;d`¾øFdÀ’½7 +Tã¦2XÕÎvXù4ED·Ù{W™}x(‰ïôaXÎ)ø2?±jT-;]þìBHbñ”™µJ¹þ{jÒ“54)æ¼]×…éù¬õÇ…J3š}è/øÖЇ¢D"åÊ$xn¢þ ¦.)L“œiî²ÈäЗÎþz¡âŠ¨<©õ“_U+¬x.ÂLÐ/a"•Hòs1Ñ)‹0a„^M–þ¹möE8`_ÂjÑ3qÐ)‹p`„¦s`NåËë7¦ƒU¶oÄþWbl6Ü~S[p]™¢ïϲv+¢Ú–‚-o`ˈ:ÊáàÄ>!ÿäì$ꬮ¥£ÌsÃá,ÝÎ +y¨3[¾µßF,y(U9³)vN#T]I¬÷Eè¾X»"Þ’pd‚yŽ•™t¯mïu†¨ž{Ô»8¤˜¹x/_F×»x†d–ö,Ûõ «ÏõÝ“ïfi¯Ç[¥ÝLô6·)~gpßÑu"AW‘ɵjÛXÀzújª×•7ôwŠ^îI£*ndHÊ‘ŽYžÍli½5©îì³Þ["Èž8\Z¯u?Þ±·¡µK„„ò(~¿ãÈ„nd&­Ýh»v‡¨žµë‚ÆÖ®£êôµ·Ë¬]ײ}±]ïÿê9L»¹*ÝËt~Ÿºg´uˆ‰ºêožGuG&ì>9rF†%¦> endobj +1664 0 obj << +/D [1662 0 R /XYZ 85.039 781.388 null] >> endobj 402 0 obj << -/D [1620 0 R /XYZ 85.039 271.839 null] +/D [1662 0 R /XYZ 85.039 380.606 null] >> endobj -1623 0 obj << -/D [1620 0 R /XYZ 85.039 251.244 null] +1665 0 obj << +/D [1662 0 R /XYZ 85.039 346.462 null] >> endobj 406 0 obj << -/D [1620 0 R /XYZ 85.039 105.676 null] +/D [1662 0 R /XYZ 85.039 141.149 null] >> endobj -1624 0 obj << -/D [1620 0 R /XYZ 85.039 84.475 null] +1666 0 obj << +/D [1662 0 R /XYZ 85.039 106.399 null] >> endobj -1619 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> +1661 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1627 0 obj << -/Length 4279 +1669 0 obj << +/Length 2361 /Filter /FlateDecode >> stream -xÚ­\ÛrÇ}çW°ò Læ¶7?¤Š¤¨˜6IQ$Ù%û!1Ð(ÉùúÌu·g/=+-í² ,ºÏöžžKÏ`Ø1Uÿ²ãùÏsˆ‰ƒLætvô¯—©ú”’‚dz•„ÈDÏîÞÎ~<¹™ßŽ'Bˆ‘BŽ'Y–®gö‹WW'×öõíÍÙߧãßg?ÏJ¿¥Eå£ÐNÿ~8R^I"…{¿>š½.MÙÏä±ýVÛ=zÄ„¤à ‡”™Š2Æ1NãÇYBIB¥ „ú”“1 ‹ñ$IèhúãÉxÂF·êâyý¾9ÊOe!z炤­w=ñ–&ÀT“1§)IEÈøâúåXÐÑ«7!IªÂó Üœ¥7‘ü™h6HII -ù,¤œ¥)™+­„¤Îf·]ú­Lu+ªæŽ%mŠâ…½¤Üíï绥ͅÒv3æùè0_)Am–;ûÉý‰¾r¸·¨þ#GK Þ©OVKÙÿPçΔ&ò$?Θ "c­ä=f@H>8fÿæB¹¾Öžg‚7\'œ,âÚa®ÃÀ¥œPõº¦6‰s‰BEbµÜ›t\Îïº"‘É9Ç#@Ý‘ð Þ‘@]ûHÔ]·Fº#qúôe¨a§yOTæeª±Ÿ°”$"ÿ>Õ)CŠ ƒL(S’×ôµÁ;DÀ•Æ=À‘4¼¬3eØ?®NÕ¦iJ2™FžUBž•õV˜ëòYÕ\·?+àú[tª:2Vd‘{¯@Ƚ;Pÿ{Ç\—÷^sÝ~ïÀõF©Œ&ÿÓΗ»-ªÚÖ€ˆ‚¤2¤!q þÁ\—©¹npý-bà)¡vð„Ü{BîÝ4é <'"M¡¿ïì½¥+ÁHüaC–¨n3ŒÅ÷rs–"ÜR5’þZ‡,,SCÂìYH9KR™ y’º™Ý¾?ßéqh‹ŒxJIŠŠÈ"¾ sÕÑ$ |ÿnÓØø^9wýJ06ùËbÇue»²ªw¹®Æ,šWŠMdLóѼE4_™¬y”•×<`Õüpn¥æQn^ó€[·æ‡“*5’òš‡ÑiÞQ”ôÛt¯n:E…d ÿ5Ý'V÷Àÿ7èÞ`ì }ó©SíI¬uOb-{âRôhùû¦ Tž§¬ÛûødßÊÉÇ¿ôðÓ!ækmüÓfyg-}Yéé~µ?ÌwÎüö£ó}_™žª—W§öú½RÉrG:Ÿ‚©zD¦I„< ê=Æ@]û1FÝuëºþ†1F’©v‰F&F„Ü»õ¿wÌuyï5×í÷\‡£P íSü$‘$a):Å$Ršçµ¢‘ ®ht®ûé·:(çc]•©ÁòAYyùV}ä3œ^)”ž— ÚkMïR7JíBÒ5€D ÌcÞC!IF¨”÷RHÒ icçR-b²×vfV¶±ST×f­üb“ž>½¾´c„ýÒ}­ÔJ½ØG#óYB„è@!V¦ eå…Xõâpz¥Qz^ˆ€Þ Ó=šúF[–ž=Gð¼%œgª§ÌÂàÍn/› »(‹‰ÈcÃÔHÔCa<ÊÔÈ­¸oÌèúAij6wÛ‡ùjãVÈÜêØn»^Û1)&}.IY°ª0ˆð-&¢ûÒÐ`Ùc”¼ê+J}D?˜[©yŒ›—|Å­‡â‡R«P+õ^Q;5{E~Ö£ÖVågÜ*¿[CR÷ê>gV÷•g/{æj"§Fð ­ë?žõ5>@óŒÆ"E3BTï@ÙW¦ëeå…XõQþpz¥ôQz^ûÞÅU“W‘š"û3ðr–"¼ôÞ„, ÛÔ$å]ì:kî“’Ið…ößb®k-¾$ExöÊçNùÓeëÐÇ×­M=Æ×beß°ÜoŸv‹¥ùµ«Ï+u­#+D‘‘$dug…áYL Í -œ•Ë -ȪGV<=Ÿ8=—ÞÉË›­<')+ð§ä0 ‡aåY}˜±ÀŸ×œtš;y|T¡Y;ù¼\7fü±=ØåÅv –Œ–Ñ ŸÈ%¡,R± Db‘Xej°ÄPV^b€U‰ §WJ ¥ç%è]¿ÒÕò²¤yÙV:г9ì™yLÃ}ØÈqªf|"pï—;Å]oµtª©Z­’ ›.0CáEFýYDb‘˜E$V™,1”•—`ÕGbÃé•Céy‰zñípvåÈe燶ÝÕ¹[eíZÓJ‹à;í›P,¦á=Ô–ëN:wògÔÉÿÊ^-Æ<}P-lÈŠ$%“±W Dì{ej°ØQV^ì€U±§WŠ¥çÅèÝÜVëƯ›zgVïƒ zK8AΤÕ.|ªíu½$íë ¹SyÍgm}!3*.Ê9íÊ‚Í(~+…Yø6;mí>{åOuåiùÔ=t•‚ˆ4‰äABòÀ"yP™œ(+Ÿ€UŸ<N¯Ì”žÏ@ïÅÅɥ̈́Æ5!Ê“g ç-áäôN üa9 d{XLÃg-8I²0 . $í?Ÿ»[Íצ´]\«Kf÷û²s­WpÕ!±X"T $(’•©Á‰€²ò‰XõI„áôÊD@éùDô~9¿¾ø¥™Üvƒ‰yK81“*Y·Ž$E€l¯iøáNÍg­¦a‡;À¥ËÜçÀ/îgJÐ_[yºäÍTœcÕjBäí@yW¦Ëeåå Xõ‘÷pz¥¼Qz^Þ€Þõ¬Y¡àj2Èñ‡ä0 µ -·FàÏJH ˜ý„qÖ¨mÅ×ù„JšŒEö+¢Šè§25X?(+¯Àª~†Ó+õƒÒóúôÞ½|׬û&¶Ä…=%‡i8 › *M‰ ø³úá´»Þ˜¾ ~g¥w¦2ñÅíoÓûÊ:ÄÅó‚°4²›€ºÅåA¸¸€©¡âÂY9qAV=Äõ ô¼¸pzN\AÐ:6Ã0Bés0ó–pfz–ÒY³ÙÔ»&x&PùxLÃ_mg…º…Tþ¬ìóRömšöMé¦Üõ)F/ξeÿÏlVâÒ¯@ˆô("ýÊÔ`飬¼ô«>ÒN¯”>JÏKлy5ó%-[ŒPó±¦ä¸ù±ùpžÞΓ‹Ô,Cž§·¦ýnÚ’§… h¡5#¦á8ÈݨACàØd„G茠IÕX…›kæÇs]| éh1ßØzñ´½$Bu¥N}±Ì(æƯö!J–Ú­ºv \sË©\gJé#‘•’ -ƒ$”ÅDò©4480J>›*J}’i0·2—0n>•*n§'Z g?¿¹iv$ªa×MöPjÞJM¯yå-–<™$…(0ýxHÝkmO†$4pj‡Ó²+iÛ’ñ¡–ß0·ÓÇr±‘¼E4_™,z”•W=`ÕGöÃ镺GéyázW'ÓY÷ºKì(j0Ao '¨åŸÒ ªÿÄf "'i8nd€NÇ&d•Wóý¡ì8Ôû–® e}¼38#2vÒ!)à@‘¨L N”•OÀªO - §W¦Jϧ _»ή\»DÙùµKÈOPu;yH°eáÒb®k —‰®äAÏ&ò*‚…ËZ2œúL€¿©^Ãi¦hFóIŠ$DejpB ¬|BV}b8½2!Pz>!½ËWg- *m_0˜˜·„Ó¦´FL¯6Mg­sÁŸƒš³¡¦ç8"Ú«kû£Š‚~mfifœa÷˜†çZ–f„ó,ðL¿J·m|<‘¬p¿ª~z°é6?ØÉ‹äTMø×v¹~Ó<ŸË~½ÚnþG™´wö£¿™GNÜŒG¨ç#9œñ,æë¿u¥7Ë)ɲÈöêNoÂÓ˜šÞ8+—ÞUô~z>½qz.½!½x7œ]Ùß¡ì|Ù_¿¹j[µÕELDÓðX[µÕ¿[ -Ò¯y™?<£&rsD™BKû‰êMr˜Âñžè<’£™?Ì!c£Ç½9@jZíJ»>ce¾¹sĹY9†?ïU/îtšùnþ°„ÇÒ˜‚Ù;ôdß»ßv‹j/‘)÷½¹¼ì\@fR ñ&v±}°¿r§›vžhJ$±M=;ÏÔ`LR]_Lg·ÍtRÃ0žpÔ£ƒÔ=†‘È”¸¤€÷Ÿ[NàÑ¿ƒ‘œß-Po -åÅ)5Éxmtgž†;YÇlB°+CÁcf)öì’µäðziј٠}§j‘ò$2çª0ȉQÓãbý­yl} Àãþss÷S¼½ïšÎNJW‡U›HµhŒS¦¨ÏÁÊ›BYé2JÊV ;uxð'—›ªÛ%—îÚô&œÞD«Þì·ƒö„tx¥Æżu,©þýNgÄÎÛ/ÍÒ½è&z¯fz–‹v4ž\"r’ä¢É÷ÿ±ï9åendstream +xÚ­ZÙr·}çWð-êÁ6[R%)T¬Ä’‰qê–¯hr$±B‘ +Ioùútc™Á,ír™Äœé>hÙÂ_6ÌbBE>L3FD– çÏ:|„'¿ ˜AŒ dì`Χƒ.ãtÈ(Éi>œ>Tvb"c1œ.ÞE¯În§“»ÑXr4NÓ,º™ê†Ÿß\Ÿ]ÝèÏw·ßÝÞOL¦¥ßÒ"øÈÑé߃wïépP"òlø>SÂàñó¼’X +ó}5¸ü^šÒÏäP¿ÕÕG‹³œä<Ç!aD&¢Œ§qˆ)‰©Tq€‡œŒX$ÏGã8¦Ñý«³Ñ˜EwÐ8iv›¥1I“ÒÀÁ~ ’töyl Kmº,͉Hjt¯n.G‚FošÄ8M‰ˆù ˜YKaj?‚”j¡l‘b)IRq +RÆÒRœžÖI]Lï|Ú­LùÕÔpÇâ5±G ížfÛBÏš9jh³ñ,ÚÏ– ¥u±ÕO>ãlÙ?éŠÿɨÐà-gå°¸Þ:†Ä:;^…qÊÀw±Âø»i0Çw5à¸ênÃsW—ÇkЋÆÿ ëb» j²+R’Œ†—%ã…Á‹€ã* Ï]±pÿ ÀÞ”ÒðBä`üÝ6ô~ÿªÕWœ«¹p½}kêa,…I1*Iâø %LpKú)¸K¸ Ø>É“‚PzRÆÒR°F'´Nêvz÷n²Ö"êÖ‚žEd1-ÿ5 s‘‘4ã5ÿïõV +~fǨå_5æe4†–ÍRËÞÌsÈA<¢—9…Þ¦AÑ;¯è-&,zÇR_ÑIYÑ»¬‰þܬèÃÜŒè]n^ÑŸ€”}˜”}m+Ñw+ž+5‡d1-ç ŧJñ®óÿ x…ÑéöúÑ«óŽž4 ë¼Âøun0=-{×ÞÓ„:LJ[LËs#wËHgn×µ Ï ‹KÜîuÓ~£ãôXìuÃG|¸Ô©%¬ i´0‘ÜÁЖ/ÊHŽ?`d¿b’i³ÕòjY˜Lt‰Ùâ“úÆ~¯_Ù<2fîáóõ¹þüdÍ)æåòD|ÓE²ð¨•ÿ iÈÑyHÀk™†4Üvd!Ž×ã“Is"ØW— æø>Wnxîêµã¸~²bÅsÍ£ç,/rv°2ä`¼ÝIBr™5*C‚šÊЋBo1"ÜÏ[1Éu¬‘‹¯64v,u¬½ÀY$5ÊÞêƒNÄâ̬¥05ÎUª‡“ù¯2弆;ÑQˆ°kd¦ìs³Ù«SÌ£±ä4Ú£X-<Í£ùòÓ±8Àû/{L~,j¾_Â9H!a"êc Ø?p’Åj±ÓßÅn¾]~Ð.bŽKžAoU›’®nû¼\–X´Òo~@x¡áˆm³Ý_Ø©ÌÖs‡¹5H W0A6[Ý^|™=¿¬paü^Õ (&$–ú4«X‹v¿¯/Æ~Cür·W}^è&Ý|°ùŒ-¹ªìÌÛÖÌnöl>ÍÔ£4z¸/¶ŸŠít”ÂF }|¯Ÿ¨ÄÓrþ¤_pÌé Áw·’ì.êÿGæ[äy––„÷fãô£’—·í”É×Û7ç ÚR˜æ Ôñ‡¬¦ÿÃ0ÞvV¤E »…8=cé=‘êøCzŽƒEw¨ß€ã½Ú2F9ÎF9|ºzsÓZ¸TÉlh-¦Å§žòœ¤²F‡~¡úÓûÈÙje«aÆl0oøk·Ÿá4÷¥}<á„&áÊ•ƒñKË`H«²Ô[Z!R¥´VÇH«?½RZAzVZnÐ&wo'­¨!;“ƒiù¬'YF$èÆõYê‡7ô³Óyç'Ìw‹­W;B’< §bƯƒ9 ÊRoí„H•ÚqX£þôJíéYí¸Aûé½Æ©SEOûYp¼ ¤å»¾ÁG&dÍw©!i4´Ö‡¤êøSXé¶íGLÖú4Z™Ìy z‚Ñǯòð£ßUdñ./;pQä`üR4˜R¬,õ–bˆT)E‡Õ1RìO¯”bž•¢Cïgµ;ª;õÖR–©:Ë ØKØÁ)(¡õà]Lï^·wh}—’Å´<6v脤<­y,§G¦~«Ê0Ï*ãuJ4‹ÍóLeƒxÉe.¸¶ÌOWAݳŒ’4•AÝ;¯î-&¬{ÇR_ÝIYÝ»¬ŽÐý èY݇éÝ»ôëþì¬îÃìŒî]vçꇿaöÚ9d¬äR“Å´œ×§@LÕpÛ)ÀLµã\‰Žÿëã ¶qŸþWU Ì£ÿ¢•&aýW¿þ æ€þ+K½õ"UêßauŒþûÓ+õ¤gõïÒ»ºnóJr­üþ¼Œ¥¼R®•ï¦š—`ëbÒ®eµ:uo0-×¥F¬îÙÊžÙß·ò ÌÖ¦Ú§k¶ ¼ÇVµIèzès¦í¼¨%FŸÊ²uá›°!ÅiøîÊÁøg‡Á˜•¥Þ³#Dªœ«cfGzåìÒ³³Ã¡wvyÛžŒ™ÇÈbZë'»$!e5‡V|ÒˆïìåÅä( Ë¥óEe$¼qÎ7«®ÌÝwÌs"Ópñ ‚xåe auUvúŠ+ÄÈjË¡t„´ús³Ê +r3Âr¸Ý¼Á*xY§ýº«~ǺÀ8DÓs£v«sŸãÙ +,3»Ù RªƒZ£’Ð8Äù¯Ûa Y¸¤PAü¿{Õ°¢*;}bdåP:BQý¹YE¹E9Üç±ý©Ù46HÍd±µë‰¹&õ\JqÉÝWº“X iº®ïå2S¿At\µÃ€›_;éêuñŒÕÖêê¸;Yµ×6”ðÎIÿô%F¯Ÿ——WHRLx¦rÌñ÷ÅÒpÁ¾Å­ÛªXd0ÓD›ï¿C³ÿÊendstream endobj -1626 0 obj << +1668 0 obj << /Type /Page -/Contents 1627 0 R -/Resources 1625 0 R +/Contents 1669 0 R +/Resources 1667 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1599 0 R +/Parent 1660 0 R >> endobj -1628 0 obj << -/D [1626 0 R /XYZ 85.039 781.388 null] +1670 0 obj << +/D [1668 0 R /XYZ 85.039 781.388 null] >> endobj 410 0 obj << -/D [1626 0 R /XYZ 85.039 761.463 null] +/D [1668 0 R /XYZ 85.039 761.463 null] >> endobj -1629 0 obj << -/D [1626 0 R /XYZ 85.039 743.459 null] +1671 0 obj << +/D [1668 0 R /XYZ 85.039 743.459 null] >> endobj 414 0 obj << -/D [1626 0 R /XYZ 85.039 554.516 null] +/D [1668 0 R /XYZ 85.039 391.925 null] >> endobj -1630 0 obj << -/D [1626 0 R /XYZ 85.039 536.042 null] +1672 0 obj << +/D [1668 0 R /XYZ 85.039 359.903 null] >> endobj -1625 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F11 976 0 R /F35 948 0 R >> +1667 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F39 974 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1633 0 obj << -/Length 3204 +1675 0 obj << +/Length 2517 /Filter /FlateDecode >> stream -xÚÕ]sÛ6òÝ¿B×¹™“f"–ø¥ä)u“ÆÄñÙj'7Ih‘¶y¡H…¤bûßw?”H§7½—N&°»\ûEÄ̇?b–„ž¯V³8žJ’Ùf{âÏnóˉÐKM²th~ZŸüø:¬ï­üÕl}Óó ½ T³uöq~úæåÅúÕåb©”šåbÇÉü|Í€Ÿß¿{yvÎãË‹Ó]->¯=yµ¶ëZŽ°Æ -ýzòñ³?Ë`ƒ¿žøžZ%³{ûžôöVõÂ@éyyruòoËŠqÁŒ¿;c „Ëp¶T¾—$Á(ð#/ Dè{¡XAHWBHO 93D(‰ßÎbgóuòñðœ£HÌ®ÇKkš£¥Eè.Fžˆ»ôçÅR†Á|—f°…¬€ª[u5ÿÞ渱Ž'{$(6ˆJæøIŽðpÞvMQÁô–§Áòzé4EZ"óÛ*ϘÓ}ÑÝñ¨íÒF³¯oôÚw=ë+¾û‰áwyšå7e - $¥â§´§±º <DÝ”’$ ŸZ,ÃП¿ƒ\¡,.apq -¦Åóú[Þðh½XÉyƒø´j"ÝtŒ Ŧ[K´ËMè(¯ ˆ¸aŸÊò.-Ê'¬häŽ0#w¯‰‚³ÑÑÒ¶üà<Ý’yd<½’&ã9Ÿ1¸¥‰æ»)n€ªEHäuh"2ˆbÐÌJ=)‡ÆêSx«0È ’^ÅVŸ,*´R¯.Y•hUâÏóvj?‘ïÉïèÄ¡yB'l1fûZß¡\D;Y iXPŠ§ ,Zþ%™×èaÙ~Ó‘´F'û†ÿ€Q³BŽk(ŒÓÊHžÆ™BØ1q”2¿Št¬Dˆî ’CΡ”J¼B¢OÇ©˜BE†|ƒ¿8»x5ÂDJ x D‡0Ä ð;žXÿ W ×—‚«BYê¨q Bpö)=„ÿ»&uÙ6ßÚo›eE~¢©n(âÄàW¼ù‰ÒCÿ‹­BÌ7dº1ê -D’ë‰O0!?ºE•³­okë@h먥ğ³Ò˜d‹Û“вMóÈfV$e4d½×±.ÕA’×",ë6ŸŽ ®ÙÀÔ˜MOPW=zÄ ‘p¡&ç2¨ -sÍYPÞ¥hDNÛ 9œ ¯€ëeþuŸk°Àc×€ùµ56 à˜]-äŠÑ®¥U‡¾G.5˜¾ÛëÌßÎÎ×"²*úªv1<Þ¥MºÕ»úä‡>î¼®rV‡{>­Ž/D€ ߃È%Äí”÷ z‚ïÅ3œ¬@Ycq­„‡YÚ¥<¢EóÎÚT‹`í¼x|„ãMFëø3*‰€nS3”!L½HŽã˜Tpf•–ff„ >£ó ]–¶.‡ à* 6Žåq’pº@0Å1Gø!ž§¸y¤ión¿cœ¸æà„92^›Œ€lrÈyÃc¶ïK½Häø T fÅ&ÅuT$Øs"ÏôŒG£Ùù‚§(`Dž8³ÕŒ®òŽnÝôú Þ€4ËþC>lÃŽŒtÖE±…f#±v -ŠQ‹¬†8床:ö#ö~¤‚£€Pj߶I„QX™Ò¬»Ó4»‘ZªOY6pÐÐ^0, ŽÃ„> ÂâÏä8âÔÅÕ]A^ÈpÀW¬F¼¼8ãÁiMö´µ¡`XÂã¯ÿÀV‚côëKSÕ$â µ¡»…‚))ÃRÙž‰g-O/‰~y8ú}Ý©Pl`ó`È<Xdâ Ý*P¾dE”emã[ð•Íò0ždÒD;aÑ/ƒ(Ô‚Fû1O´Ùu Yý>Ë9`9å±Ð•º$¡“/Á…Îþ’pž1üÂqÀ £˜$S›(Òn É¥(P #? X0çô/¸­Õãæªò‘)¿-B×å>9–¾#è4zÓû‚Õ¨q¨ÁúänÎU“µ dFñ0D©0©ÿ¨I—p7D¶´–«µÚxJ kSŽF:]ð™,T“4vçGL˜Pç#U˜K5¦ÔŽu“6“Ù«°ŒW2Æ6ýb ›ŠÚ>›Ì¤ºÐ?(Zz)à¬w £ °F)8¨0Ò1ÈýVa*§Ê”3Ê3>þ¶{-$ÐX…q Õ”f8v‚N -GCdUn‚$±«o#t ¥3²ä<ÝêåÒ6ÏÓ²¸u‚î”TÑí0¾5õuŠ¡m?>e‡.…Ù*+r’Lø7q\°Ê(kg '®iŸ7Ú”Gþ‚6ãŠ1@HÔðk–IKckµFP ÉͽÄÖ)Ʀ‘†o~.ÛßV$§%6î†ÓÚD(œsó܈qëøM˨{rtä;¸ è.‚)Ú…& -À±»Pè&Úlòá¸VßSU¢»TÌ~, 6 .@ò‚=o‡± -Œõ)×$O:•Ò<ði´àDÜz]ôu Ú!giZ”7#kÃ&ûHűÐ[·REFTIS’ÅÙÅé?yÔÞ¥6ÂyìIkCÕ·+*íÐ(ú2«èÛ×Dïë§$<ØömAk¸7jqkãnwÜI°¥Ù’LîéjÕdîupÓguÇ,7Úõ‘ÃÒ)9Åü¡£„†áÖ½U ˇ‹¢Ð½ÝÇ=ÑFrî„ÀâGLŽ+-ÙÛ„·Ã‰öᣈ+Z™Û3ð‘ÎñrPC‘5Èórþ†;“î 4á»lÇuz¢Ük1åuÓ‚‰›æÌú76ç6¼ä½R±Aw¸c踛í†'¥ì½÷xÔN¡Sµµ -¢)¾Â/7ª^$iê›QG}jQ¡XN^ ŽêJ'Éœ­Y¸åC—€Ü¾°\o»}C…–i5õžXÿãÉÞØ•}y]é—Wå©IÝ=4àЉèóõ[,^òŒ›¬€?µ\"½}£_ÞŸ3¼êKœº9¿e:iÞš0Âœ{€ ƒ×…Q˜GŠlKé†*^"7ã´y÷|$[HŽk ÊãUDò2yé÷EqyX¤×æ¨{¤Ó@¾ÍÇ–ˆñ!Ð<‚pzì,žŒÕS«`“`”½ð¢À$ÄU¿dƒ° ®1 Íÿk² ×#M‹~¼ˆ{{üpXž¢ˆ[,3m¾>÷idá‹)aFaúO“žõþ¬(%îGþQÊ¿»(å¸(u|w;U¶Åî„kŽäÿGÉÚ—K_MHVÆÓgŽ@²O‹UŠ?!V»‰Ñ%¸'8~­0!I¡Ì$‹–›½ÀèuÑ´ý7&½e öeŠnicjÛ‘º2¶(ì­IT´ˆÅ°Ý ÙSgx¼¶ÒU®Æ*øËŒþÒײõQ ¼D­ÆË#P¥ÅÞ %`y¸Ýþë‚:ÞïKO>?endstream +xÚ­[ÛvÚH}÷W°úe`ÖPSW©ôè[fÜã[r[é<ƒ¦ ¸'îùú9u“ªªD"’•XHÛçlÚ»n¤‡á/éI0+z¹$ˆIÙ»_áÞ#\ù×±ˆ¡… =ÌÉøèŸoDÞ#¸èª8qÁzãé§þé¿oÇçwƒ!c¬ÈÁ0ÏeÿzlNœÝ\_\›ã»ÛÓ¿ŸÇ¿˼eDÈQ¨¤}úŒ{S øëF¬½ïpŒË‹#ÈŠgöóÓÑèè·2”¹Æ{æ·šî‘ YdoÈ0’’7bò )à§ÀH`^Öâ†:XŒªÃèÝî­Œ§YÏ‹”¾9†²ÆºHiRs„½|ŠÕøã`Hú·Ò?¯ÑcЈ„‚žÔB{ù½Û»  v­8Ž«”p?ø õ³‘ZÊe8¬ßèüîˆ{‡e$@6éÈaj9‰ðrR–#œ‘ '~ÅêÅØøf4[PÙŸ­Íç*×W¨Ûd=_ÂGuš÷ŸáP EkÎü g^f/³]úVâ9eˆä *LÜÓâ‚*Rg¤H•.ðXíã‚îôJ$é9xôÎ.Ž/vÉåe„‚œÔBNRD½| Ð,@6:Àbj9w>Éò §u9`ýÕZ.çêÿGsj:Ÿ<ÁGÐåõ[pê^£ˆ ²"C çIx˜¨ &í/RW$I9ø¬öpÁè9¤éYøô>œ__|¨;@èžûÄl¤bÊ'8¬[Ì4@6;À`j9CP‰vRZHg€3Õtª³Ÿ¿îÜØ"¢í¬@imW˜¸¶-¦EÛU¤ÎÚN‘*µí±ÚGÛÝé•ÚNÒsÚöèÁtx—•(“ɲZ¶@<$#ˆ0d3êbZõ˜É8ïo´ŠÖP$#ó)"N!i唸p ¤E7eœÎ²I0*USQÚG4¹•šIqs’©¸½ó¾Æ)“ˆñ,Õ4²›-”LÎÄÄÏfCq|ÀU}O0à¾×sÏéJÁ¾oŒÀVQ9Ì’zª0qAYL‹¢ªH%•"UjÊcµ¨ºÓ+U•¤çdå­q0#’¡œ„™Ô –ZŒ…Ìê}$…QJ8êz-O8´âqÁƒúw,ðèÔ§+9GyX€Ÿï¨l¬¾à_,dÀxüñö¼>i†>’ƒ0s±ÒÌ(¡H<`†l¹Ù.ŸÛ]õß1᳧)•Äô”?œÞ÷0q=YÌ^=l*iÙÃîfmèaý¤éVϸW 3Y0XA84OË‹‹&^‹Ñ»¾ïêÖb y‘Lé0µœ;Ö‚é¬ðü¤›o“úcþ Bý”?ï"«…ZVßzÔôx§í>4Í£ß0ïÒ™ÒÔ^ßlƒ×PWfW|g#°m¥$C§§&Þ¦³O›&RVmº“³¹M½¤›oõW} mxïçÔÆjá¥6tUwçñjRx“óÃð2¡Zhåj™´îWÚð û‚[õòòÉŽYÙ±FÙ5ô,±5‘°ÄlycÎÃDeè0;c·üT»™þºE*±ÃÔ2ïô·I΂ԟMž'SõŠƒ_/ÓëòþãlûcþæÃ/zJg܆Ëäiþ¨þ>ÊwßÔ[êU£lõbpë÷@Cl5§¸:1Ç_]8ͼ\¼¢È×GT¦î=õÅS6×oKyÍÆ ÂÒ1˜ Ü¿RqŠÂܪ×@2ƾiyÁÑXm…­5ÙåF­âî·æ‚nsXý LÍ™[õ \=6lxî(0‰hQ¤o¥ÂÔuàâÀŽH³x{3¼œÌOgÛÉüiãöÊÜS~SæÝv$3ÛËÍD‹ÃÊåz²ð›[íÍËY"éÿÃß·qïçnã CÛW-†æ0 ·×Tø§¾ãÓñ‹Bea¼“,RFAs”åÜrÑˤÚH" „du¾ÿÆ]+Ãendstream endobj -1632 0 obj << +1674 0 obj << /Type /Page -/Contents 1633 0 R -/Resources 1631 0 R +/Contents 1675 0 R +/Resources 1673 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1599 0 R +/Parent 1660 0 R >> endobj -1634 0 obj << -/D [1632 0 R /XYZ 85.039 781.388 null] +1676 0 obj << +/D [1674 0 R /XYZ 85.039 781.388 null] >> endobj 418 0 obj << -/D [1632 0 R /XYZ 85.039 731.337 null] +/D [1674 0 R /XYZ 85.039 169.843 null] >> endobj -1635 0 obj << -/D [1632 0 R /XYZ 85.039 702.539 null] +1677 0 obj << +/D [1674 0 R /XYZ 85.039 127.496 null] +>> endobj +1673 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1680 0 obj << +/Length 2779 +/Filter /FlateDecode +>> +stream +xÚ½koÜ6ò»Å^qÀi¯BŠÔ+ù”¤Nã"q|ñ¶H‘䃼+Ûºh¥­$Çñ¿ï¼¨‡WNP±Èáp8œ7gõBÁ?½HB_™t'Ú7I²ØìŽÔâV~9Ò‚±”ÕçÅúèÉ«0^hå§*]¬¯:¡oC³Xo?z/_??_Ÿ¼_®Œ1`.WqœxgküüîíóÓ3¿?ùŸ‹åçõ¯G'ëþÜž"œ‘â¡}ü¬[`ð×#å›4YÜÁXù–wGpªZ#óòèâè¿=)^³ Þ5wG‡±Ò©Ÿá÷åißF¦—C«ÚOÃp,‡Pù¡²$¸ºñ—ÚÓËU*ïí\îEÞy±‡òòö±ËÛÄ×qú}vbG‡3jÑ‘o"âf}“£Ð5ð<1+0+`Òòp³\i¯®°½Ýtù–¡õ2H¼¯ø'o’UøUÒyû‚aëeb¼f‰‹mF„:F¢«±'‡ßÝ /d Àã²nŒú +eòä• F×1†6àUª«kÆ™\™®jåüôŸÌ +"?ÐÁßS2‚æk­ñþÀ Ö·Ìûn 7ºeÉáMÄbeÒÔO’L M*¥ÍŸ”¶Í€· +ÒØ«/ÐeEÅÓŒ?:â/.‚‰»Ë%I&Hï&#ÝD{ÇhCv€nîyGK „VàßëÉo_Ô½6í¯ÜáMµƒøöçî‘%Ü—0$öªl—Ïi) +ý( +\¶£%óã”ÚækKFºaeØÀú‘²e\ÕhÀZ¤÷­7<¼_™£žM<Ò³¼ ™ºF±äƒD~ Ó`Ìd±÷³GÊZ§-y¬CFÙ!÷mçkš{>®¾íx0%L~UÖ¨dÖ²èt…c2Ò f|yg<9GÞºÚÐÈ‚ålØÆËYG:Uáx¿q&·…僧¯R¦>½láþ=áÿyëv¶,<ô^:«Ä‰3bà‹–šgŒpX¼#ÎÇ{:¤»gÈo§gkµÇh·©WÕLé·SÄÃÆBÝgM¶æ>©PU‰—ÔûÊBà]Å(óŠ*Òˆ¯g¤U¨â0".ðħ1É/ë2žì³f~]Þ´ &¹Üqäârá’RTœ®æ¯ Ù¸B…a/{cÒ)û0ô˜mÝY@ÓŒÌÀô(C ÏÀ08G¨CÊ!‡—}䌶"}·|AÑ BÞœ¡–ÀÞ2 œŸÝÍÀ8€Œ§¾)ÈA$ø^¯Ødìc7¢zã˜Qj9·+ý`;ê|‹I¼HåðÒyǹüL®±¥vá8Š½×#·ƒiÛ5¦µ’#´7u%$zÙÁš³O6o’`J +€—.Bã¤sÄQ9ßxz3åç +&u3lÝ3¤kî ñ( |,¡ã’L­ Ø+’q±0 ɨQP²¨@Œƒ+<‹‚À9X+‰­ð}~~Ê{_Ö;’xIaŠZSÕÅ ”!wf;œ½Ó :-¯B» s¡¬åéû|Ãd›¬·á1‡Vò:϶ysŒ%„ea—eÝÇ.'@è>‹ã˜”gƒÀs¾‹ãŸÙ c•² æ NÄŒºEˆdH„8È@"Ĉqwäñ@ùá×¹ŽQxh凷:{Üb501y,F&O% ©6ëœYú¸‚b¤ZCS0§ˆdOb§ÔŒuHExÅéR*Ÿ¯K\Yy;,³å‘²„Õjš‹‘\7›Ư ;ø<^ÞB¦ÆåDí5˜Øʹ`rŠÅA°jàí­0.Ñd¡œ5ëÜ$çMp+ÞŽðùªðd”>òåŽpÍß¡†|wPÉ鶕i°Âé%*÷¾s¨%JóºrôÐïö˜ëËìÒY8Àíd/º‘¯×7$º‡ÅÉ-É +ˆF˜Yš ‚ˆÅ+ðL —ƒÄI2#š•D«(QÌEêU_Sô¥à`dÁ/KHÐó‡ÍªáL! Ù‡²¡óŠëŠëlre¤+¬ÐKòÐî\L¶*qÙM¿CHÌqNŬÁqå¦Ø8WÝ·ã7“Èyðo¤™á# XßMœ±%Ka'X¢CÝ60õhiÄ ÑÓ¦Îŵۡï¼*†‚ +äTQ’ÕGX’äaÔÛ½d³ë)V«)ƒD‹O¨á °Óó—ÿfhÿ¦€ ‡†RX³CªQ¢rUµ8W=ìJjìnú¾8•Š.¯6Íý~%L*õmlùyÑl[ +|žãlÊø„)¢Î5O‡yž®è¥!ç2ŒÔ‹fP–`úÍ®¨2lÎ4Rî¼ü3­:ìÙø:™(—ºS¤¬þycÌ!û±±Ckkp3¬Ô_R^Ê&Á†îâ5ADÓWYó Rm7<ŒS‹«þaá)_ÇD£ëØÐOð6PTFÒ·-ª¢+PQarâÎx›äm÷˜ŽaJQáTçã=RNÔ7|áhO§3~ñÓ'm,þ¥œ¸qÙfÍ~óÓr•ÚP™(t#óÌ ã ©hm>; L³§Q'otZlzÂÑ@øÄÔpZø²_6Ïi¬ë4òã$únc}„óhŸ_G©$é¤ÏpŸÿ5Y‰KØs<ÈÞïò0à<ÚÜ×&ôµeQ~œ¼þÈÞë‰á±½7ù]Stå)²Ûñ“´¨®]¨¢Ì›`q'½°aM²âGœ_­TÈ£»TÜ2Å(Ú ½OiB‹Xm?ÏÕóœA Îq¦éØqD™®îr´tyÖ”q8´.qÒæãR +§DóeüÈFœ¾ý†“¦Ï!r¢¤°ÌU¡ «H,MÓ»ÀðFV íF¹˜–¨ð+yÑ®$®ºvbÄõânmîíä*é·4“f]¯%—‘¨±ÖL2ˆ÷[JkÿšëØRö…ÏC¬ŽqHµz€ñöy: +:t;pÌMÍ7XÞ> endobj +1681 0 obj << +/D [1679 0 R /XYZ 85.039 781.388 null] >> endobj 422 0 obj << -/D [1632 0 R /XYZ 85.039 674.393 null] +/D [1679 0 R /XYZ 85.039 761.463 null] >> endobj -1636 0 obj << -/D [1632 0 R /XYZ 85.039 653.197 null] +1682 0 obj << +/D [1679 0 R /XYZ 85.039 741.134 null] >> endobj 426 0 obj << -/D [1632 0 R /XYZ 85.039 217.242 null] +/D [1679 0 R /XYZ 85.039 196.786 null] >> endobj -1637 0 obj << -/D [1632 0 R /XYZ 85.039 196.249 null] +1683 0 obj << +/D [1679 0 R /XYZ 85.039 162.244 null] >> endobj -1631 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F14 969 0 R /F36 955 0 R /F35 948 0 R >> +1678 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F42 967 0 R /F36 955 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1640 0 obj << -/Length 3098 +1686 0 obj << +/Length 2276 /Filter /FlateDecode >> stream -xÚ½[[sÛÆ~ׯà¤;áfïX¤K‘[g&®k+탓ˆ„(6")-å×÷œ½àŽ…œxbϘÀâìîÙïÜ`¶ ð—-Œ"Td‹Ô0"ŒY¬÷gt±…'ÿ8cžbåIV-šó«³o_jxJIF³ÅÕM³Ž"R‰ÅÕæ}rñÏo®.ß.WBˆ(—«45Éë+7ðý¿~|ñêµ»~ûæâëwË_®~8»¼ª÷­W„=2ÜôÃÙû_èb þpF‰ÈÌâ\SÂàñþ v%J -wöîìßõRî™\¸YcgTÂeÄðBµÉ'‚ñEª(QTÚS¦L”Eµ\±ä;<÷/Y{ŽDK » 1•Ž¢»*ÔŠÿ,Sä§%Kvùõ]±\I*’êé~©XRŒ­Ÿ2b¸ñ³zõúJð‘=¤ \›Ø›Ü!ÝfsÎðÈ(¥ 8#Z_­ÜÏ}¾^r“üŠÿ¸ÞÇ9®ž; -ÜÖ>¹‡‹S±Âí+øSµX1Tf÷)-ÕWª€7`öx9íLš•† ÔÓŸÄŒIC•±)¤„f‰]üi‰'˜ -hZÚ -ÓcBá$MEl«MŽ{Uù„àÓ4å'æÛ=’34­4¹+ÛêÖ]£Œ„‘©Ü”»ß -wõ3Uôg>UAD%Œ± A˜NØÊî¹;Ý'Ëä¶È7ÅÉYs~ظ‹*ßÅùRSZ©½“ZJx ÆJxÌJŒËgIŒ›Ø6¨èÒÒ2¨uø¬vùÈ#¢Ë’j·Î+ÔvKå%8ddâœígA™Ý@y1eF(›<£ôY  rÖ+IPáèVë“& …£ÔÂXçww0…Ãì7€@!°¸.D p]&Ù»E­§º-JœÆÆÈ«RD€»kÃê`åu¼q‚Aå>¬v5k [Ípà Ü_8zoo_À À5©(%rÚyeÙ³dªš¥Ï‰(\ĶŠÊNZ{YÝq¹â):œÀZíO³-cW;4X¹ŸÆ‰ÁMiE#¿Yÿççüh5m¶wû<uù§yµ€ “±Hê?Ç«¥¿Û«ñQ¯v_ú²åÙZ~m}tb-+oO†;êùeýàÖ -Üc †ÀP%¾0Úëü°¶pÝp¼ÑŒ¡Ç]´üLßCƒŠ°t¼ï©cAF³X¸2Ï@NqÛb9ÈÛMp7;T@¥!ù¼¿ÃéNI¿ƒ48cVx†°ªH¬k)NmB»ù¦e¦Y!(采ZÙ«ò;ïaxFRµ”ï­<ìÔVNXnÂýeS úê#ŽF=Wñ¹’a£9¯ &›v¦Ñ„Ë0›‚‘–ŒqÍ91Lƶ™”%uvWVù©Âpá"1Ø’¯.ð -þƒ‰/?JOxpoŽ'wáCŽI|¦Õ«=¥1$W RIÈp¶úΦGjÏUXkÕZÌ––ÊŒβzG<é­Í0j3^ Š}ÚQ©©7RJ+pôbv¬ÈoÑX&9©¸_J™ÏCˆ@‘s ‘RŠy›úôX`¦ˆfê3Õãx†•V­¥FX…iÑeõÍR@Ò°þÐ\„NA#–fžÜÍ©øðP”Õ7x‡ÖfYZ¿˜’”…t½³ÙLÉÃŵV]ÿz8â6ŸœO†ul6´-öK[ aU7%%ðã¥>¨È -~¥æ£bdT£ ­QÔÉÌŒ=‘sºÀÙkd |¯=ÄÇâT‚m ÇùÿúÌr ->ƒ7KŒ1hÌt4Ÿ3f¼k~r.±Ì÷Þ9æ>1CA5×yQ4}úHÕ˜Xd&‰Ñ&]‹hº@4 Ýî0 -áQfÍ€™!tàwÚÌ|>tÒBc€¢‡½1–Í ×EÐóDãèUh’Ohtøì3±\¦YœO3`¦ƒƒ‡*íðr<N™BWÝúßû5È£ˆ¬ÍÎïŽa­8ÛjkFE‡ï+îCÜC†›îŠ{ï‚á”`u -…øŒ\kšˆX͸T!KQùvÈ”‚ïb,8Š>=YBA€bh8ø>„:Š¬C}ùwŽŸ%߸; Cš·.„‘—7VQkR*h6ƒzCÝõp·ý -ÕîmŒ+ÊâP¦;XXô",šK]åÚºü6KDø‡Å’¤D§3Ñ°EÑõ`„RÑe -§|Ûôâº=µï b¬š+=‡®sk±šƒUÓÍm»¨æùÆ6Ês´EtÝTÜõ  ¹õ3ÞÁõçMäƒ öç±›Ÿún~5)Ð Æç$ÐE$à‰&$€Ò ` -9DœA¤jÞ1ÄÙE¢t& Dv·ÎQíïv›±\X¢Ïk6râiœtÝ^! ÎÔæÄuBc Û •ÒÅ};F¶~mŽÉLe2js”Êå „ QBO„ŒÿÕÁ† ·­e®]²ýÓ»K÷äêc/ƒ¸1 -[ó({fÀ^×!Ϥè°×¶³SázÈ.ç-Â1‹¼ónSÜÛ–§Ó,Ù4-dW¯ö-õ«ªò~ÚW„ÝÑ"þ2·E3-‘2Âûeweêû¡rÝ‘›|]8! w&ÛÆEÅ[»7‹¾«;Á²Û)ÊqM2ba~“©®¼”¶ä,©jýw »>¯RI~*ÜE+_¯¨ëNÏÆY¢™‹_°ø“wv…WîçÖºaÿX Åûµ§r®¹8¸»ý1ìoyÎýðñ0w|âÛÕ®ÂôÓ°YÐíE·UÒR×QÝü®“9êgåéci°öÝÝíA °ã²­üº¬NùºÂ—)ʇoy.¸|ya¾qƒà[Ø÷‚é”Ö2U/RÃx=`Ì%Ó—ç/›)î¨;÷Öly(oÐþš]Í cÔ÷TÖK0v‘±‹ËóöšæÒdÍ&šB2MùyWi¦p-­ªÅT¶E3md\1BµîY™xN3%LýÍ”ÖRÓÍ”6«¯‚Ñëäí§0jìeûÝE4’`ê)ÍL0DãÅÇ5FŒ'ë‹÷®ùß4…rÛ,Z;DdG3`§‘9Úìüâ?Ñî×w슲û:1â{&Â0CÈÄx Q@ˆQ><Í€n¼…8«iÖá£í²ü@ˆ4.)]ÕOB?½ì4¡Œ,3DëxTlÑLƒ…ÖÀ|áݬ|ŽÁ†©_À`[KMl›Õ·Å‡óºm9i²¸~–Í ÔÐL‡b¾OõR'H¿““Õé}nÓ›:A­˜qðÆ]·©ÇÒ'¤Éoª0Õ¶h¤¹–&ß4¹®%Ùù•ÇR(ûàêÆs\çܱæ§z»4¯5]дQÚà‘¸ëÞ û®ÁèööÐí ÿn„'@?¹“í?¼ðÙ„G`B)f:9-¢ˆ’{¢‰RlŸ?V˜¨ã×Cƒj—«(/fÀKÏ+dñé/°ñno=å¾[´îNVe]ô¢Ç8 ¿ŒøåSíGBÃim60¬ÌLÿ¸EÁ×Mã .¿h6@³Œ¤©Žóâi¼ôð5Äè´Ã lìqvº.v!ƒµÝ®ñÏÌÄÈí¶ò,¬Ø3%y‹(«'šdy‰J{´¯sÖ[[¬ á5DrçÉÓ xêÁ›Bèëò„ ¬,˜Uïòªð6¿=Yp*÷N,†äé r5É4nŽdµÃþ¸k¿¹*‡•7')Xê43¢ÇL¯yI!M[Ì´s€ƒ·zø·“uJoËg£œe£ˆô–b1$ ~½G²&™FÒ‘L˜õúxÀï]†-!|ßËð(z< Þᇺ _î+œ–>¢MÇ€Ôšèl¦±ÝÐLCéiÆ3zPÊòéPåÅPñCž8¤ÏG¯ „/²6Ÿ­À£û‚ù±h)£-óý}~÷ )l·àɵÖ+¼ Øßr¦bè+Ð9÷v¸¦‰½ä·4}ôßöÅž‹fÑ}=Ißnâ¨4䪪½¯/œä*”L1ôÜÛþ¥Ò­žõfc_»n}Ö•o]®Y¶ºoí®÷hÚ8Ñ¥»uotÑ4•ÿS¨l)ˆ™Š* - -KJÏ ¢$EŸÝð¿üþC/0endstream +xÚÝZKsǾóW œƒ)a<ïuN$E&vEŠ"¹Ø>,%ˆXPÀRýëÓ==ûÂ>(‰’ªªD,fzfz¾~÷RL8ügWÉ$v‚)ç&‹í Ÿ¬`æï'"PÌɬAs6?ùáÒÄÁY“Éü¦ÞÇ0mÔd¾ü5:ÿÇé«ùÅëéL)åtÇ.z9§çÿzqúÓKz~ýêüû«éïóŸO.æÕ¹ÕŽpF‚‡¾=ùõw>Yƒ?Ÿp¦7yÏœ ˜ÞžÀ©Ìh¾oN®Nþ]mEszB«úîh”cÆ©î%•é¹¤áÌpí/¹û uÈŠéLD?â~¸Í% +N¶p²'æ‚(Z› + ¼™@ñŸil£t?Ñ:½ÞdqQñßï¦FDYß1gR»°Á/?½œ»žSTÌd¬ÆNY¦EÚ»½`VËò$°~h”}ßâõ×°_¾ÛÓÈ»©tQ¶?”»¼‡©™”È–œÌ +(ù DåŸQÙè>óÐÝMg2ðÍߥ öG Š¯«ú³ÃªZ°þÆ ¿D5$…,àérêåtEt×xD1ÃÉ÷ëìR—߯‹[zúgz(`¡Æ…°§x|óØëo‚½ê³-Y,Ýgƒ/Ê+|œWÁÓ&Y¨® +/i| ÁæD‹§fd¢´…,Ç%EZ¬œ‰Bîí§j½3%®Üõ#o1IÌùQØm¬° Û»Ñy8cvɸÃÊ\”®¶ °`µ¶ÑÆC™ÃìÊk2 ¡0tì÷¥§ÃúŒžÐX®qõCAÀ{M÷«Ö¸ÇŸ]t[Š(]–O{ä¡™hË!ͽ”%ˆo½a=ð'8«Ó>±=êF>Æ`âÜS ¦?¬¦÷è nƒ× ÒxO±Éra¯öcæ¥? Ƙ ^iÿyŒŽÅñ ÜÏðx\û%ñ¸ÓÑL'nìŒA -s¢ò"Ýl¦3XŸo,Kô]é'ä ‰Ñ6-Àŵ +h¡h:1%³~twÔÚHf@§Ž½´Èo¶ë|Ue³Á£Û_D×Uå¢ïwQbD ¥Œüæãúnf«cÆ„c'-S`‡TžëR™@Z;ŸÜxø@Å)IœI@ÿÖ§’ÁáÀ ?l"p¬J-ÿðþŽ[¾‹üS~ +;&Ñý!œ‘¥Ë¬rXT0þfK|›ÿ5<–èõXwU¼>„PH ¿µØ‘8³ ¬û ô ÆõÜöÿ«ìZ¤ùÂõ)Á½ÆòÅÒQ]9}÷ƒö8x-?x—èÇÁãR2žt¥lÖ¨ƒ‚Cy·Á大?‚sÇô”æYQgš{*_—ÃaG•m¹ ¼…{¢-Êvwä_¶´ÕŒèi¿,øiXÒÑYfhye?_ÚÕ¸¯®ûŒ1 ÆßÝ“¤büéê(Ò}ðŒ«ØJOèòWJ@`‡P¸¯sƒ1%q!Þ¸hQÍn“¶ŽY.'Fƒ¹Xûx¿I‘a÷t›få^³Æf¾™Ôº¡†+ºØT'âE[êÒã<¼¿KfdüèÑþ]ƒÆs#y·µe¸†r ¦P²’A5†CbßÎ9F³ØV+?8Û[ØhÖة˧0Ž)ÛâóÕRºtñ?Ð*”£›ÝT±Ò—}öŒµx†ß, +Ôß\QÂ7WÂÔõÚ}X’–×^"åèâM¾ÃcÞ“÷…}–+o¶[|΋!épˆ`Nôw)k‡ì‹~Š8aÆT«˜Åñ¨ø 9U`é%ò¾Õsÿ.Û@ó‘Õô¿)B.¦>¤ÃGIr̈h P‘‚`œ¿û@¶yH·¡½’kEñT60Æ?pÓ§õ­±¼–ã¨Õ4ðšGq[ç}¸YžŒ²RÒtxé"~»ÉÌÓ ãcÐa@‰Õ8t5Í0t¦º­ðíŒGY:m˜äv”•’¦ÃK:YÑbf—gíˆQ܆WýŽLjÁ)šü|v(÷ç[Âí$M¾çÞãßQ<#†Ë”ÚE(ì-¬ýbUÎ2 AeL¬ šA±–4ýb…Ĥ«CW |s<ÊDIÓáâH ¾&O´hfgèíEôŒfø$T]²×”ñ5ö1+e¦b;ŽM3Œ 9Â[Ñî||ËtzóÉ¡¤5n”¡’¦ÃQ[I9$­BµXútYPž†‚À1æš èÃrãÖ4Ú# ¡¤aŸ®êvZKØ´°£Œ”4NŽ|ºÃnqR„¦ÂŽ?rSõ<$¹¬ÊÍE]SW+|³ˆ®àùÅ=¾œ‘`#=õ]/ê¼C胸Å#àW$ÃØÉôé}q;= zŒ Á¡:…Bvu-§ÃŒæŒSÞ5ÈiI3`i‹}³^vÓ^ôÝbÒ8£Ëk é0ÒV ÑKÛ'ÔÌk”@Åu§&çÇØ*Œ • ˜DX™„˜™¸ñ A3Œ_ A®ÿJ˜aní«ÓûkÊ«¹º ™ù»£dýÔa2Ê\IÓá® j’{ºÅ^Ó´ö™£)¥÷Ù~Ø{^¹RšÑËÙêÝÊÒwƒWí´iœßUl˾($Öð‰-ç4ÃÂáP‰Šä¨œ“TΡ²çõ;nRì(¡ˆ¨yîïä{²¨uP2·ßã÷±Že¹¦éJ,‰XW!¿Câ_=ùâþ†q~*Ýš²ð^Èûl Fa!V¦ø¡%ÇÄ þã6Å êûä߇¹Ð½Éé›×˜Ý¾æ©¸MÃÔ.ïpZ™jƒa"¾?Tï=i©ÿl^"*ÑcÛ¨Ýý¹[SåZ§‡y~¥kxçŸüe¡+cÛý$ e¸¢`ž^Š}º€+iB˜ÖgJêËs÷ŒÁ£ˆçJؘW £S¨ie5àÜ…°g—õúQ¥:ºœ™nÐòêcÝ©sæ9×ÕBœ'âü⬹©»pI}ŠåÚ .ÏŽ•#ÝÅ™ìÕTøO >éÏ*}Pwñ _ /ˆÑÇì–•Ôá÷Ì´¡Aendstream endobj -1639 0 obj << +1685 0 obj << /Type /Page -/Contents 1640 0 R -/Resources 1638 0 R +/Contents 1686 0 R +/Resources 1684 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1646 0 R +/Parent 1660 0 R >> endobj -1641 0 obj << -/D [1639 0 R /XYZ 85.039 781.388 null] +1687 0 obj << +/D [1685 0 R /XYZ 85.039 781.388 null] >> endobj 430 0 obj << -/D [1639 0 R /XYZ 85.039 542.823 null] +/D [1685 0 R /XYZ 85.039 529.274 null] >> endobj -1642 0 obj << -/D [1639 0 R /XYZ 85.039 522.834 null] +1688 0 obj << +/D [1685 0 R /XYZ 85.039 495.736 null] >> endobj 434 0 obj << -/D [1639 0 R /XYZ 85.039 382.638 null] ->> endobj -1643 0 obj << -/D [1639 0 R /XYZ 85.039 364.164 null] ->> endobj -438 0 obj << -/D [1639 0 R /XYZ 85.039 264.615 null] ->> endobj -1644 0 obj << -/D [1639 0 R /XYZ 85.039 244.021 null] ->> endobj -442 0 obj << -/D [1639 0 R /XYZ 85.039 198.668 null] +/D [1685 0 R /XYZ 85.039 233.596 null] >> endobj -1645 0 obj << -/D [1639 0 R /XYZ 85.039 175.952 null] +1689 0 obj << +/D [1685 0 R /XYZ 85.039 201.574 null] >> endobj -1638 0 obj << -/Font << /F60 1074 0 R /F35 948 0 R /F15 951 0 R /F20 937 0 R /F36 955 0 R >> +1684 0 obj << +/Font << /F57 1075 0 R /F35 948 0 R /F15 951 0 R /F20 937 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1649 0 obj << -/Length 3214 +1692 0 obj << +/Length 2015 /Filter /FlateDecode >> stream -xÚÍ[[Û¸~Ÿ_alj5W¼è¶EQ$iv›Åî$M¼hl4¶fƈ-;–œËþúžCJ”hQƒtŠEƲô™çðãá¹QËgüÇgYÌ"™ÏÒŒ3™e³õþ*šÝÁ“Ÿ®8!–Y:˜g««ïLàiÄò(Ÿ­n»qb¦b9[mÞÍŸÿóéëÕ‹7‹¥”rÈÅ2M³ùõÊÜøÇ«_Ÿ¾¼6×o^?ÿÓÛÅûÕÏW/V­ÜvD‘£ÐWïÞG³ (øóUÄdžÍ>ÃuÄ8<Þ_T+IßwWo¯þÕež©™ùÕ¥9*ÉY*âÙRF,ËÔE –ÅG,ŽTK„p‰à\0ÉÅÌ‚‰?Ã4“t^ÜÔ >oK>?ëf[5x?™ÿöö…¼y ÏŸ‰"g)2щ S!Yr‘†¥)<!%“Ž<œÁËÛb]zŠÅ)*sóH³O$]‘I≬"›Ÿ=‰šÕ/Äü>(5‹5•Rj~¸5†´Õ?jÊÓ-ü®X#¦4¿^ﶥyHÈÚÜG5â¶pQÝ §h×<• ËãxÂ.:PÀ.äØEs*ªú¶<‘A¤Ö ܾ5¤,N…«Ñ7[ƒ)¬·€ÁÓ¾Þ#Ö6ãAª,Æ9°å‰|\khàÆa`ô±‡“àTwhzøzÌAñœÅÉ„ëì0ˈ2Æ×Ó…§’dÁâÅ2Ž£×À3ºŸ~»1Ø‘–ÎPT… %²¯êÓÍF³_Ö5í¿Ç˜ê†2%8Ë8%ÀQO¹ß$S,ŽÓ0™„þö¸»F%W<1;lWVwͽOgÊr©fŽ_ ÂxjôL˜ç)‹ ž¸jLmYÆDż¹'³«›y 2Ýõî¼`Ã|~g0íØí -L{¿­ŠìuÄo%)gQ”MÚ„Èñ[Gøˆ`ÁŸÓÐsá||w*" ¯"¨–Åxjõ}D”³<•=µ€Üvë-Ýœ4ƒÄiq³XŠô…?Ök›ÐŸ5 wtïŸmÊ¿˜¯†ùRß9ãtöz…ŠFÛ¸ñ!û‘m@6’t&°$JÀVV‡‘<ÄaØŸ>‚Ãp†w®ªoÊúÙV»ï³p†gi º¿-Kà[bÐh!à°pÉŽÆ(ªÚ††ƒYÃãcœ‰5¸žf)0¸ãÜ[S(6­Qô «/õˆfô•„@Té´56£›8‚ù&|bw €ÅhÄ+î‹/ ¦¨Û?ÊK;—£C èb1ž.ÞÎ<ééR{'µ ¿Ïf‘F©‰sX\.ÂÔ8 qj,hœšSÚ§6KÓ$¬ a<]Ôd,KÒž.ßNM -*‘Ôt 5P#•5uM韯ï£OQÆ”aãé4 (ÕÔ¸:ýa6Ýa” È'Ÿb¢˜ qîåúPmŒ ØœÂKÌv”«×·¦ð4RX{!¡(w䙬MÇ+µ ÕK–Ë mã î/VfÒ9W°ë ®fŽ:½®»DHç<z º¿)kÁë4 #9xL -·eq‚ên4‚h»j"©t@å'Ð`#dï<ÑLÀ·EÆÝbqÂ8ÜqE¿7ÓVK›¥›ºV¹«öšOHYrSì*ˆqœ¸†ÇòzWhžÉ‰è{oáû¯ÏamŒa™?Õ± -0L !ÃfSUç=ìy×ø6)ð¯AEâéÑ·X.fÞÓõX“îñ¯É&ÝxoëN«£þò{GÑ—ˆÃ'åÊž4I&øë@þôp ‰n-t ú²…:¢ÿÿ,ô<`¸&ÐHž`ÖÞO»ÁBµTƒ0žƒÂ\*øW ÊdueØô¬.2ßþF„jº.MÚ œ†lRå ,þchœ1 e¬¨•ÏXu «AOc‹ HpÕ@™¨Ä¡2e¸K—²tU]“èÔšZ}°ÕâÑÄ µmþqUn‚”B8ä|¢w@J t¡‰X­šâË’•°HpW©oMBh¤°êBåPÑòžê—ûˆ)X¸ ’EOà ùž@ו#aÖ»Ü*7 Q·5‘TПÔzì—sÏmƒ°)eU³T† ~XöX1 þô!¿ýé#üÎPã¿«ê›ò£Þò‡…Ć u€¶cµ¿Š¡®Ïd˜°3^û+ 1)ºTû뢪Ð-·M9ˆß.RWèUèN *n›òR3 ,Úánm¹tzÔ¶öWóöî[ÙM{ù€ÚNñ”ñt¢#à€&E ±Ún·ëj»{MWs©þ•bB)ÂxJyõ¯âyO)¯©§‹p§$nWMÓi‹ˆó¹»Ñ͹¢ß±YI=Êo4Þ¢ëøУ³ ‘àwÔÍS,mL0Â>ÓaÁ/TËb<µú <ÛK{jÛèV;yYÑlm¨ƒêÖ¤|±‡g:KÛbÐøNKáfŠ…2X”NÔähœa aøp„ªÁ7Ù¼mÖ‚0žƒì"g™ÈzZŽni€ö×RécÂ/!Zòxd/MX,&JZ`@ƒŽ†>¤Ö{È=Ÿ^}z.¼XÀ¿a)©±ªg1žz};•™xÒS7q’™R¡×6շۀȯ6Ýy/šAEi’v4̶](¼S{ºÂUлâpSÜØv-Üo}\·‡‹Kda¶ÔÖ‚ôã«&â`v£W‘N,íûHm*]´u%Lëtiý)øI¥Xž… -X}©OùDö|‚~ùéD7Òx6áèù¦¬¯Í‘Ó~â¡8xÚ8åƒ@›8(q,袨#o<Š•ºE]¥žP\ÄÎ~?jzgfgÓ_ÓÁ³À Z˜§[ª•&ƒ§ÐgŸeŽ§Õ‚%x†ÔjƒçP­‹ÁÓUëI׿ 2œÜNëôÅ|M¥æ †Z‡E¡Ô–N$Ðã¯Ôöþbô#\ØL1-° «Ò©é@!Ðåöܺ¨ÖåN¯ÆYOÌ_‹(gi&‚YŒ§Ñ Q—± â­«­…Våïlúr¦HÀçÇ7Db[ïIKr–‹|‚´ @—I«)OŸÊ G&œåJ†õ Œ§ÇÀpð‡ª§QEý¡%ù„ªó´ËÝB vCï#Œ‘'LNZ‹ Pf0š”tks’nƒÝŸ›ét{r©!°/ðp›_ì _< ¾½„ÌX>qþí`Z.¹yeÊáR@1E}/ä¥ ñ«ENEðnL úqP‹3^‰ Xþ˜òã•-ÓJû—åÇôØtrwßÒ¾(s½ú›ÀOý¤êúÅê—W?Á÷W׶YOÞ³…´I$Xu§ƒîá—ÏÛæþ‡1ãÆ‚ ’§hܼ-É`¸öÏP²ìã/J&Œ'¹¿ Š3¨ùz’‰ýÎ:m­<6ÈÅU65ÿ˜?ütÉ;¥,ç¢ ã‰î@º —®èSÙœ1˜Ú2×ô¨°"Ø”#û'œM¼ºÓAÆ÷$W)´ìžT6í~nܳö­Ôqtß›ûîL: -.oDMHþEvf|Ûr‘°„«Ñ,‹fÏdɼ |¯[ÿ×:%:轶îNxá6·Ìä3p— [H˜ì»n £¨Ìg+Ôݺæñ’éXÚ+×Uç05ð‹½:jîüð-õ˜ž¿~‰•Î‹Kã$L áa¬˜]]œL=© ‰ -?Ð -ÍØ”ŠRÂf„qÜZñ»±v´È¸ÓŽþÎÜÐÉaIM0‘‰±7Ç•`©H`5%ã"Hµ†V9Òå7c-Á.ICDÊ[‰]—_«I]M˜Øymö^i¹Âww»Y¢XŠ§‡Ú™­}G¯Ñú?$¦ÑÕUmméóŒÄ~¨Èá犙u”®ÚK.`viÖ[’ëƒN8Ê@³4Ãþ¢í;Æ@9^ûç*X£åI2ƒøA§*RÅ#2´l‡Ò|Ë~n'õ>5½K1¨hß°‹åü­>/…‹Õ"ÍÀ¢àqQÕź1wõÿ˜“Œšîëäá³.+ºCvK“ˆ}>˜/gªgá–.ÌôošóÑ°tÔòð¡í“P„\°~¼_èÄ ¹E›ÐïqCì_QGlR—F'Ô ¿è……O<²É_ñ5Tn2¼[ëÙ¬ñ~-ÇýE㎷£ë{ý29Àí ÐJÌ18Tz(ãæ+~ -3{;²«£7S-«ÿèyF=SêS3ª¦¢¥?#QõÑhkÞ3‡QØXO#b—køgÄýOÿ£Lwº"Y&Göx ù^’*Ò§§ÔPÝ2Sl­xúþnèr¢endstream +xÚ­ZËrÛ6Ýë+4ÙTêD(Þ W;MÛd&iê8ÓE’#Ó2§åtbçë{ñ’À`ÝÉX6ÁCàðàâ¾2ÇðÌ30Ëç*#ˆeÙ|½›áùîü1#±rU€9=Ÿýò»Ps‚QŽóùùåq¸`óó‹‹ž¼;y¶\1Æ€\®”ÊoÏíÀo½9yõÖþ}öîÅOï—ŸÏ_Ï^žÖ=Ìkäzѯ³Ÿñü¾žaÄòlþþƈÀíÝ VE‚3w½½Ÿý}˜ÊÞãsûÔÔ;zÄŠä(§"­ƒ$ˆKvÐâ Fs£ÜdhI±åJ ¯ W/†ïKGJž¼÷…’“/»r­‚™Æ<‰È“=ž¯.‹u "åâìŸØnçé£wd +Æ&*G"ð›0ÄI+è0šÙ‡W Ø +Yœgš Z|Y2¼¸ëÊDŽt”I"æÁ"#"3bcFR"¬zL>;k–ö÷—%Í4V_òÅþÒ×zø8ï–Ts]Ág©é7C²N™IDUZ´Íc¢1jUûV6mµ¯ÇŠqD¹L²ð˜b9R=Ý°(­<•Ñ¥+›K+Öšš»7òÅM¨V1@©Â8í¨L\)ÎìHï€òPÿäÓh0Sô€†<Ïʯ§U}a÷2zD%'HÝãÊÌxý<öRÊÁ.j&Ö˜w…&C¼e¯ì¡9ð»»2h¼¸†}†MÿW`gÅ%Ø…„“_ùùŠáÌ•›ùYgÎÜõñP=³Ó|×ãEk/Nõ °7²¸p×n1òÜ}nÉÂNµ¯[7|UeóÜ^èåÔâniaðÏ´ì æ +¼‚Föj³uK§°²/«/"'N‰i ÀÙš']@€‰¶Ç \€ñX`6»â¶ka´úQŽì[Q” šdâ1#*}7 Àv±ìq…+sÀ­_4ǾӶTÔíΈ›ý0.ʈwiîoÌíÒ:{£­~Þã€ø–H†á‚Ä$f9HDÒ1q‰&.1¸Yž–X`–dâ1#*‰ÊEÖã [ys.Öeõmé-‘'Äôê?JSBP~O¸0qM&¹ŠVí.à½6•9l#m "²±jù¼ ˜šÀâ̳=š"¾…iHJN¡‚x™”óˆ‰Ëé0‘³½Þ×]yÛUÖ'À1fI3"Ò·>]fÚcr}º­ù4ùRWtO ¼lnuÛyCt"VŸ0áa,=X§>Þ)EäÈL¥=bâŠ:Ìt"öÙÞÕ]q[Ž 3SˆÞCÄcFLú’æ)Þc’°KÕÓÊÛ&°4z¦»Ô³îºØÚÄä'n,˜¯t[E~Õ¢Û-HZ4†ƒ¥‚×ßa†úéM™©ïS {Ìhå¾Þ4C™v)ÁÒ®râ+_3yÑt2²©w]Û;×ZÚ Võæ¹}ºØ&—j}& cïáúÍ©}f2}œ–—“ç< ˜¨¼£ßñg¬¾´]S¬»ªîl9ýáýK—´OCå™v°Ü#+ ?Sš9ÅP×ë‹ÿ!1š£\¥µò˜Ñ’ýÐÀ €°ÞŠA‘l-ÁT6Œ.¾j…¦EËçÇÂ:^A®·U/©©Ü¼ñÖ¢s†z3ž#ÆiÚŽ˜¸18L` ` u{Y6Δ7©»^cKÀˆæyÈçÑ–`gJÓ¦p@³¼Ï;b +ePR§„ò˜Ñ’K`ˆJÖ[òÿ5…ÎeŠáîûXßj|’|½­a5RLCM +i¶LÓ&npär5l7ˆ´ü“Oo73EÛ !Ïp¾ZùR§¾É®`0óº‚Tæ5Ò:zL$=Û–õ"ûTGP’y°ÀtGP’1‹QGÀHHíÙKŽ]¾€X`bÖÆÛíz{c£šäǰݺ ÊfWÕE·…/ÊuJ“¥=bâ‚:Là±t)ƒáéÉÐg™—ÙŒ“_0>œ'Iÿՠô‚rVò­0U³¿±IË lŽµ×†õnUû^A½Ù–ý~íó°O«3íÑuXw³3ÛStæÊuÖ{ì"‡€R'ˆ$]E€‰ïxn– ¿:pþɧ»Š`¦¨«yž•í© °^­”·& 5 0Õ Ô‡‘Ž«ÌÉ®líÞnâõÖ~Ë¡ÃŒÞÐ.LöÃy"­HzFhMàêÎ-¢»žÊu=»È& œ‰HûÄ5y|Ç/ÅäÐñR™ìø…\Úb„^[%ùÞÔW tSº4>"W DZž#&.Ã<¾[—brèÖ ©LvëB.1y¾Þ£KÏH¼,Ùý ‰ƒ<½Ý– sè¶ øL6ÛB?ìaÛÇZŽÜtQ’Ç$Þp´ îéW.u#Eû0¨<›‡äë Hbë=:]·%™Sœž4¤æhCn\!JIJ.®ÚOØD%ÂUCÇgKtçtÛAÊãËv7~Q¶&Qo´E¹ ‹­eÑ@×DL4ý…üè/îŸøÿa‡C9kj(o¤âŽ‹–Aˆ!]Á20@6æûi@jendstream endobj -1648 0 obj << +1691 0 obj << /Type /Page -/Contents 1649 0 R -/Resources 1647 0 R +/Contents 1692 0 R +/Resources 1690 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1646 0 R +/Parent 1698 0 R >> endobj -1650 0 obj << -/D [1648 0 R /XYZ 85.039 781.388 null] +1693 0 obj << +/D [1691 0 R /XYZ 85.039 781.388 null] +>> endobj +438 0 obj << +/D [1691 0 R /XYZ 85.039 761.463 null] +>> endobj +1694 0 obj << +/D [1691 0 R /XYZ 85.039 743.459 null] +>> endobj +442 0 obj << +/D [1691 0 R /XYZ 85.039 671.008 null] +>> endobj +1695 0 obj << +/D [1691 0 R /XYZ 85.039 634.743 null] >> endobj 446 0 obj << -/D [1648 0 R /XYZ 85.039 719.568 null] +/D [1691 0 R /XYZ 85.039 331.956 null] >> endobj -1651 0 obj << -/D [1648 0 R /XYZ 85.039 701.095 null] +1696 0 obj << +/D [1691 0 R /XYZ 85.039 299.933 null] >> endobj 450 0 obj << -/D [1648 0 R /XYZ 85.039 653.622 null] +/D [1691 0 R /XYZ 85.039 225.361 null] >> endobj -1652 0 obj << -/D [1648 0 R /XYZ 85.039 635.148 null] +1697 0 obj << +/D [1691 0 R /XYZ 85.039 193.339 null] +>> endobj +1690 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1701 0 obj << +/Length 1872 +/Filter /FlateDecode +>> +stream +xÚÍY[7~ϯˆÄC“ªq}{*UPJA°ÐÝ >³Éì&"·M&Àòë{|›ñ\ì¢ÂC…Èܾñùæóñ¹xÉÃ?2Va–¥"ˆ)5^lGx| OžŽˆCÌd`ÍG?ÿ!ä˜`”ã|<¿iƈ 6ž/ßNÿùðõüÉåtÆ›r:“RM.æöÆï¯^>|vaÏ/_?þájú~þ|ôd^Û­G¹6z7zû—@ðù#–«ñ'8LjÀãí¬"Á™»ÞŒ®FÕCÙg|lßúF.XQãÃH)>ˆ‘9JÀQ`$0¯u x@‡Ñ:¼y6%øR2™«·Ý¯$”QƒA{†=¦g™ˆÀ2¡ +) 4ýÞêËg×Sª&÷U©¯ù¤Ø£õín[jV»)Í'•}r€År©ïn²o·ÅzwN\Ù{Wpýò‘}gçf béÏŽÝÏtÚIøŽ³´¼ &.¯ÃtåB™œìÎÛcy:oªSOm)Ïe’‡Çôˆ´ÕV傶˜TN -ÊN ~ÞêßëéŒJ¯‹QocG¯—%kî½ÃãϘÀ‘DTÌò 1,“*˜¨ŠóÕNš2\;i×ò “†¦ÿoNše9¢8OËÛ`âò:LG^’Y/µ.Ú“ZHD“,¢Ç -sFQ&D‹ØÓöÏ@dSµ| Û«_’ [‰´ÒUÊ9E„¤•ª!q¡,$ªSqÚïz:eIFR <¤K¡£”D¤ù+Ta”£ m©Ä½JÚ×ööN½Š Oóôt€5¯&¥‘r ÏßaÂËeJIZš–²Áĵtý!?Z«c±;Ý”ÇÓý®*>Û{o®žè“L§Þ.#J’\…”Ò©—¡l0íÎüHiæ”RÄ{šú³›<°KŒgˆBÕ‘ÒÊcz&[³N¸< M†Ñ[KæƒÉM/ìÜÞ›Øn¥„kýü¸ßºƒAŽåݹðU¤¼¹DÍ’…W€‰Î»°â¹]éð!°L‘œÎ„À0Épõ¸j8’YýæŸf7Ð,©Ï“@…ŲÏËòîb?exrÜ:gü;¦’„š†Ê´J ¦?á~¦ 6½ù>–[³€M +Y–4"aö?èŸ2È5ÅMå_«V¥=Y•E=ÖÍÞ”ëWuืÃî+8_Õ†«úôhwðô\ºÜ6@Vˆ• &îHӉƌÚÀQl6.òAŽXéжëç0˜c,Ò”<¦Ç©¡¸M*œ“¯_ô‰»94m§ê|mïêô_T…½X»xí+SD\®[’. LT\‰¤ºƒY åi1µÙf»üÜ—We(—,IÊcz¬ÚòæqªZ´MQ^Eµö¹m±·ñO3³".K{g­³\'ZÚä 7q"ùq ”¦ëˆ—×a"òîÐô (à3žäà1=RzHpÒÅþÿ…^䵎¶C€;Ð$È&¡VŽˆ”têš®L\:‡ ê†ÓÔD7ˆ<×6<»¢ANæ_Oaý‹úPö=4‡~[æIrÓc×ñÐèñ=½v…´]ÀBk×Æ"ƒîê¯]]ì×ý¼ifŽ6æºÑÖõLéË]±ugzÇýµ¶v½¹·*ÿÚÚŽ[‡sS¶Ìt½3f¦X:ƒ6"Z¶2$áƒfDoMäµ³ü‹g¸‘‡³$ËL8IfÉõ& rþÛ”ê+J ÷â·WÍ@ÑB" yYžtaVŽ-]K4c÷DÒ{W\[G„±ä’‚œ‚°L·×ó2i`.žI»œ3iHêËë/½Ìé*[qhWôÙs(uæ©ÔÉ°ÎDéÔ`âj:ÌwI)Ruêì²L!­Íö„k¶]b¬³',\gÙÉ A˜Ò‰ÔwŒA*0ãÙ¨¤7GNÞ3¬é‚ÂQ¥‹Ä Þ}[»E¹1óp6Ÿ40 Ôøb‚Œ‡tÙtöà$Ê!-tÜÚøÆ×,g¨›Î8¾¥O % {Ré¼`âR9Ì°Và&åñc¹ì%e2IÂAz$:«Â,-N"·é3s+×ÔÊ®{íŸKÓÝÆô¢e*4L\/‡ù®uHŠ\]‡tÙ Ö!!½C-ÿzÈe§jHŽåacÚ¿á$E¡á¡yºá 0µœå +9Í6u'—3›ÉçÓ\w¼z;0B¿œ"`¢]7á +Iiè|åеY u[h¦ [Ù;tÄ'ózO÷¡‹¾²ÈÅ“ù‹WOáúÕ…ß×ÑÒÄ`ÑayíêÂSÃÁìòè‹OëjõKÄ» Q(Kç°õmÑ2 =þ§ëµ¸tZìåo[mû,œòœ‡f;¢7Ýððgç‰<Hô³¤_õþÊk‹g)«Ò5ÛþnF ­Ëꬥo`M +6Uõ²Œ‰–Öøo öoúƒd½|8CŠEæO@Ï“Iî¸èY—®ÙÐR¬Ï÷i xÛendstream +endobj +1700 0 obj << +/Type /Page +/Contents 1701 0 R +/Resources 1699 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1698 0 R +>> endobj +1702 0 obj << +/D [1700 0 R /XYZ 85.039 781.388 null] >> endobj 454 0 obj << -/D [1648 0 R /XYZ 85.039 465.732 null] +/D [1700 0 R /XYZ 85.039 597.626 null] >> endobj -1653 0 obj << -/D [1648 0 R /XYZ 85.039 445.137 null] +1703 0 obj << +/D [1700 0 R /XYZ 85.039 563.482 null] >> endobj 458 0 obj << -/D [1648 0 R /XYZ 85.039 344.982 null] +/D [1700 0 R /XYZ 85.039 395.581 null] >> endobj -1654 0 obj << -/D [1648 0 R /XYZ 85.039 327.115 null] +1704 0 obj << +/D [1700 0 R /XYZ 85.039 364.164 null] >> endobj 462 0 obj << -/D [1648 0 R /XYZ 85.039 238.994 null] ->> endobj -1655 0 obj << -/D [1648 0 R /XYZ 85.039 220.122 null] ->> endobj -466 0 obj << -/D [1648 0 R /XYZ 85.039 161.22 null] +/D [1700 0 R /XYZ 85.039 208.297 null] >> endobj -1656 0 obj << -/D [1648 0 R /XYZ 85.039 137.238 null] +1705 0 obj << +/D [1700 0 R /XYZ 85.039 175.876 null] >> endobj -1647 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F14 969 0 R /F35 948 0 R >> +1699 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1659 0 obj << -/Length 3171 +1708 0 obj << +/Length 2271 /Filter /FlateDecode >> stream -xÚÍ[YoÜ8~÷¯h D=HsÅKGÞrxg$Žc÷.˜™¥[vkm«–Ûûë·ŠEêh]^ÇÀƒqSÒ§bñ«b‘UTø̇ÿø,ÒÌ—ñ,Œ8“Q4[]ø³ xòë·ˆ……,˜·Ëƒ¿ÿ#€§>‹ýx¶<¯åh¦´œ-×xï~{s²<bìôÛÁù³5(øáÀg2ŽfwÐö‡Ç×Ð+ÓJÚ뫃³ƒ/•(z¦fôVßµŒ˜ŽdwR7É…dBðY¨}¦}eFy¼-ç ç Å}o¹Iç øÞ)Þ=y·?*GL©¨19.ɤҽ£Z8Y‹†°®ÒÂç,ŒeKéÓ¹•‹·Y¾&m¯Óë¯æÞnνÂÞKîË"ûOú -.Ã/ÍC¸CÏ÷rR[|y….2wwgÒEéh)’kÛÊ@XŽô€‡ÅLE8 4Sl44/Hz$¥¸ÁŸm^Ø»IA¿†{%ÙغÙÕˆ,”úƒfT 0’”œy¡ X¬õÙÈŠZ4duM$¥b -î8Pm"üó ͳG©€ÜËh~‚ªw4W" êYTw²ÆuW0@Ù£¹u.cÚ¹Œ¹Á,†9Ö²·±s’çä‚y™ÜÃë:ò24 nÚZW¶ÆÇ9ý’Q¡’Dí1øR17ŽˆãX4*cbTÑ ˆqŇ'tÌÂœÅY¤ƒœÐ$kÑÖ7¡%ãBW=v9m{¦íyAÀ"­¦î6_'ëõŽ +dq‹cKdyAèrc¸¡‹œl-ƒ;§öÝ&)ÉαÏ".[f6¶”Ú»±úÝ‚B×FÔ[^¹¥ß¯6x˜{Û0vÜ}ÏVÕCmxììEýe†‰§Œké@HHrƒÈ ‚Ñ+Ù:ÍËìOŸ«¦~…Õï_ÜQ;C½^wÃÀ<Ñ,Á¨AÜ»ì8Ì¢2͵•sÁ$•$CdŽú–Yr:wöéíö§›—æ¿ã-Œœhªo·iQv” -VWX Æ”s˜Žr¼åZA€Ó-åN»ÓD„ó#Ñìpjšˆ°5_8YŠáJ®÷KM8°Óv;Š pÈÆ ³þ™ù?dÐ €]À„=+̈9 ƒz½À¾@Õ€@+ -ÆçyN€¶jâä?9ì‘#4‹Õ£å»ïÅ÷Èzѱ î#Ïáá;ÈþðÛvf¤‚©áã>r_í–œ½áŸ€Î½Ã‡^ =VP>/(‹ïø³2Žñbд`AÈ'¡x‚ýd®`t4Q¤ËAŒ:©q,¦ÃAÛ|Íx¤'9@ÐÏåâÑ‚®Š¤˜pÃr<jЈXÐÏåW¸º%sé{;Z`¢ÌêHŒ²á06ö"f1„þ)6~^‡~u8å5hÄ!,èçrˆ»Ë]âûªÇ Æa§7Æ€ÃtØ[$4j’€g]$&}€×ìmgH¸Þ:1ÖN^Áe{Uª¹º‚Öí:Ë/j¡86¿5ªŸà#©žé b2 -¬ò`e-Âz꟰$ƒNÓt ¬©ØÚX9ÁÖÚTrXÏìÁ‰ ‚¸=H“†}C>R³Àv“V±XÛMg Ùr%¸½¤Rï@˜Áñiðu‚ d²<¥aRÉyrë$ªYfKµJ'¸ô$+ü{‰Ròé!®„‚”ìédU¯°E˜)º*IÏÀטVŽ°†V•k½Å†™}6†(É`ъ̧u= ´¥³¾êŽåWÅÒ–§Üx˜aš ¸!ëÇ9WÌ’ÜTìóKF¦ˆùdÞê÷Gx³ )ÞjYÏÀÛ¨bŽ·¦bšTÿ˜ -‹‚ѳ¹Rí"9äë]¤Rl~(ˆ€J’Á<аîÀ‚köoËgo¨r¸œÇ‚ÿ$7Ùߪ¤gÊéšîœd˜â’= »‚™5q°ØÀôPæ´9MQ[¾U^åÍ|e¯piÆ¢¨›mMÅ.ʤöÆœnmío ãØPEZy7p‘Ѥ·â’]:<íÞ0zº÷V¯8/ap¼‡E™|ý®²wN@wB?«mž§f´tÕsó;§“l™:8Üx÷7ºaVש_[ÈŸ¾öÏ>½-AÜïÐæX%±w[˜ç¸oZí Òи¦Ç7IaD-z¶,wÈùv·.؃2R,ˆø“)l¼?Ì¡¡JŸ+ãZG€mJ^?“ÉO:Np—áÆÏxËÆž"Á]{ò­¾,öûÿ—ºÄŽ47ié s`¨¼3t…íÎjÛžl\Õ—›Kßë«tØb!æÅÓ-V¿?b1 Â!ý³0c"?¥†ÑÚ¶7˜àÿ•‹®¬ŸÐϙٙBãbÖÂ-¸<Á-üíès£'m@“Ò^Ò¡”òü{Á„ñ‡9Ò¡ùŽàÉÕïpdAÈÑ™síÌÅ¡ÑqxIkô­ž/yØ;¡œË¬Geå@Û]í%M²Â²••ò›3¾?ÌRõÕÓªßaÈ‚†¼hTõWÖ,qöè¯Aì—Š%dæØ8Bäù¶_þŽŽáŠ†ø´\ó$}—œ?§úýž,èYyê8⻫m1á°ÿŽeðôÁÖï Ö‚Ì·I¤¹´lk¡4ñd“T3ƒQ¾"d ZùÂûcR^Mz÷Ü„]Ggf7#7nq± ãÐ:¥3§ _yÈPÐEw²Õ3sgmQë6pRÎD$‡6Ž²¨1ÃõG‹ÁÑV{ÄÏî´Ùîçpž:­^÷ò€)ä û -uαZØPÈ¿«¡ -¬a›;q@WcFÆO˜Öø¿Ü¦;Bƒ¦¿™ûÓLˆ<SÍAöUk3!úAS5ÿޙЦ¨¨A#\XP‹ŒCL©o‘“Pê`VÏ*›¸uâT{H¤í=¶·æ+Œ,/ºlcŽªï0õÛ|Å’ù"j©„­ SÒl¿Æ «A#„YÐØì9KW»´ç+ ”†È5¦ŒÃt”Ù›8‚ñ0h)ãßCà’ƒˆ˜ÁÄéE4B€µø87_ áT¹ÄšŸùÇ~Êrô¾Ç|eÎÇÔr˜ŽZ{THs¾ØTË¿?7Átˆ ÷œ« .jÐôX. ·›?]j¸†E)ÕÒa:Z¶©Š©Æxkj†ç‰/˜¦¨©A#ÔXP‹šw¸Û€¥º»Ä!èÐcý[L§ÿöö ˆ¾Fÿü‚@h4˜ár %“Z´Ê1•cµÈé ”/ÂqýjLO‘ßé§ uØý&2¶õyôy!åôaæ†ÊFkwøbn®èãNz©ú´?ÇÌ`wdöpõ°½%¼âe7uc”àÍ_Tc¬1Ã>‡tǪ]×'+œÒ¦}HܘŠáúEŒs©`b áLJ=ñ១šÿÂ/1>½ÿ¥3#loa§ÜØíÖb:ݶg¬‘>4›Ý~Åý'®6ï¡í,ÕÈ3ÚÀÒç½}A"‚Ÿ‰½Gf &U9>:[žŠnLàfw8ÒEìu·|sÖ\wGÉËÎœù§vèuhA7nó*«ÞZÖ®FYîš›ú¢LvX“©’­F… ; Êa_ö•…DdR6÷¹Z·,Ô<Y Ù¢˜ÚÖ˜a«XŒ©°™ã•ÝsJ\{‚FSUö`è’ë%#׽ѩp̽åò´ë/°b” - ÙïrÏc" -Ùìrûcˆ÷ïteOœMÆV–˜³ef.•vA0ŽY8µý¬1Ãæ±3kð»ªôËîÜh‘a¬_ Ùïwï„C˜ØÑè—ÓèäÓë´Èv®—zVDE1i%ä|½á þ§Šóýã úrJ95æd¡²ºà¨”ÞW×ý¢Ž¾ÿÆp«¹endstream +xÚÍZÝoÛ8Ï_!äåd`ÅŠ_"µ÷”ôº½.ºi.õûû ÚJb$‘]KiÚýëo†CÊ’%+Á&@‹¢EŽ†óñ›!‡ RøÇ#«Y*óÈXΤµÑâî(®`äí÷‰'I:4§ó£W¿hñ”åiÍ/w|4SZFóåñëÿžœÏß\Ì)e ”³ÄŸÍ©ã?~;ywFí‹ó×ÿú8ûkþëÑ›y;oËæÈqÒÏGü•FKð×£”ÉÜFÐN‡á»#˜•i%ýûíÑÇ£ÿµ¬hLEôÕ˜Ž"á9Ë…ž¶CÆ™Êdk£œåZwí S¦SåìªK6㱚%Z§¨,heñé,áñ +ª%v˜ø=NW¡ãdqsÈ*Ê0Í‘sGãä„æÐ_ÅØRéÆö¼’3gmÙ‡œv,‘ Ì™©ëDüñ·SjÌgP·8 h+ õºŽ>ßC|òØõK—jj"©ËÊ?„$äls¾ý°&Š{—¢°§áYø¼¹ßPsãf‡)ŸÇwèp²3FA@0 )XÚ…ds™f Ú©÷gÊÕ¶Fq´me„fú5ME†œþ†ŽÔN¹þ¬MðÃÚ95JzAÖø~ëQt×~ÒvúÈ`âÊñöL?}0µ`} ;];ÅKg—ßi¼ab²DEY‘“MM;GnHðºtÀt©$»%2•‡ +Ð16Ê$äóL?¡Ä+é0C¨bRÈvÆ!BSE(¸û亷5ipW|mêÕßåOðʉÄYç+šˆ¬<ŠVàç+Fðwä;×ÀK]ÜùdGK˜Æ¾í &gª^^ÆÅKÉ”¾Ä1ÅÖ]«¡ûp¢ùG ØÀ2e‚à +–=ËQWÒa6t”€-MfM;ãÎQ.5 ³ 83“Èœìç(ü@v óå`ž—=ðš–]jÅ`'1"»Ùž;%ò¸ ™ð1ÇãoUãæ†WÇ:ç‹ ¼I¨·*‚|&ª¨‰ë»OÆ'‹IQÒ²Ôù~Pkžû ¶æpPÃR [Y ÉÒfö™AM¼’³± Î‡­} µÝO_!Õ4ØuªÖæh+u‚{Üb¹Üm§·)VUM½ªÐ¨ÈÀ7”Øóp]4ÔriF6øµèÞeJÛ´ÆpÆb¿6kŸÑCêж»ž`@Y-:ƒDxÝ®}˽ohÍŠV\ètð-ô·ùm³i™\„VK·üÒºÖ¨•ñ³Ô^ÚËb뿨Þ ¤.mu¤¥aBŠÑBÀ“$š¶`Ù/ kU¹ Áª¸¥Bök\îq½û*“­÷Í@2Á 3’OŠh²õöžBH€¥î w1’[¡Ðá°ÉíðúÇ{âÀëÁ ‹)•õsûß/°gÝRt@Ÿßô:ÄÓÒá’ÁÂ4\Êiîh{ÔÓ lÇ#Pé‰ïꟶêñ’‚aÛb +„?-¦4Ëaʧ03žªÞ~©¿,Ž‡à±ŒC…7e…@30Ã<QñˆðÀBˆÞcÖýéEå˜QXÁ‡«,ëãÀPPü¦RO£CsæGF©Ó%˜t`!m'Mh¶è£P®zÌß vwêPOƒB£…Í4(v4‡Aái~PPÜR1Û·-­Dc™r1ää)‹šIö2Lý¨E~xdˬ´ÓÈØÑF†§ùA‘ñpS#6Æ–p£ÆŸ0D Xb,2ó¨)¾óR¦xÊ2’rfÔ4,Z’è ’goæhƒ÷Àò6Þ~8_O´`Ô—6 $ûFÙÛZ–šÇŒòáFyÿá-šäìxìÈTØ(iˆ™²ÔšÁqÔ!¾º‘S¦&—‘4œeúù¦È+é0?0倎@ä¬V,nJwæ¦âK:»º-«+¬ã±jU°Â®\Õþ¼†>µ¥)Ënñ/ÃÕŒ3€N©fsE}]„Ñ@§âWßTë‡Î©#–ªWwX†3QÞ=½Ã“Èp"ºØ•ÛX,ï•¡Žho¡ËÍÝãÒN±¹íT¸m»,šâ§Þ¡HŒŒï—îâf¯î="RiÆtŒ§Ïs;qJ:¬†NWiάÚÍ×wº¯Û‚ÚUàKWß³‘øH¤PÌâytç– +¹ÏhºÞ¢Â׎BäqÍÕ¢œC~LA´kõ¼ûÏ+é0¹ jH€`È—b¿7øã4òhMEÆ{§#zˆœ3™ê—Ñ£Ãì°¨ïŠîe)Ý©Á„xË îh¡{ÕvE—iÿÀwÀ`þB:ï˜Mèì‰^Øw°r¾w¼&´ šýÃñl‘â +6y½#9xÏΡ|“™èݳkºgw+þüýÇ:±šÏrAUeQ¹b‚®Ë ѹš³ô×îçx-1½‹Î-‡çôKth^¾s•ƒ~”theÅ U> endobj -1660 0 obj << -/D [1658 0 R /XYZ 85.039 781.388 null] +1709 0 obj << +/D [1707 0 R /XYZ 85.039 781.388 null] +>> endobj +466 0 obj << +/D [1707 0 R /XYZ 85.039 761.463 null] +>> endobj +1710 0 obj << +/D [1707 0 R /XYZ 85.039 740.47 null] >> endobj 470 0 obj << -/D [1658 0 R /XYZ 85.039 462.86 null] +/D [1707 0 R /XYZ 85.039 206.21 null] >> endobj -1661 0 obj << -/D [1658 0 R /XYZ 85.039 439.542 null] +1711 0 obj << +/D [1707 0 R /XYZ 85.039 173.992 null] +>> endobj +1706 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F42 967 0 R /F35 948 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1714 0 obj << +/Length 1813 +/Filter /FlateDecode +>> +stream +xÚµYYoÛF~ׯ Š¡Šh³'¼9¶S+HlÅR‹Id‰¶ÙØ¢CRýï;³ñpŠ ˆóø¸3óíœkæQøǼH*b/ŒQämî'Ô»7¿O˜EÌ,dÖÀ¼YM^½U¡Ç(‰iì­®ëu‘Jx«í'ÿøìh±:½œÎ„> §³0Œüó•yprñáh~n®/Ç/–Ó/«w“ÓU%·ZdÄ(ôÛäÓêmAÁwJDyßᚯï' •()ìýÝd9ùX-eÞIÏ|Õg£Q‘èÉTÃȘÊB/TŒÄa¬<-ÊõÕ”ùwiqkŒYã/éo²Ýž'Óó7ešíÌÛ2³¿oÍK„ÎÇ¿š§¢ñÍ:·ï>SE—ðàÛrƒ/3\ô/xʈùd_X¤–„o5.‡‹§‡Òi°5à\Z )¾OyègÛ¹"f xRÚ®‹‡é vQø˜ûë]µ[Fâ>N+>ùž–·]ûvë{{õ +zõVò©,T eî®oàÇ@Z¼ NBZÔbŽrO{VâáLü§ÅîŠun,Ьý¤J)}d¼ÌÜ4mùL™¼«oo×Èøö.1Îx  “Ò¸ÈEº»q¬$æB/c¯a-zPòÒ¬Y$»mÕ„¿LJsq¾¾G-ûz‘Âg¨}äÔ9sê4Ü©\—IÓ÷¤O$¥­}·Ú.­ôz¿ß/ÌEÇ'@…)ÏTødçÎï¾íÝUQ:nË,¯ lrkK7v•3G ~ߧk³£‹¼´¼T±²=0ñc¥¯ Ÿˆ¼Îú×Ï“oû¤(‹Æò‰ ÕÿUãÎæßeE—(ÌöáÛJ##Éäp»ÛuµmÖ›¤¹š°(Ð+$è¹Ub+̧×p›jÍJ ›l\n°~ÞºMvhm™â'O).tÓu„ÚkrËI­ÚëÃ:ƹ•0I$ëMî1«!:µsÚ­_‚¦fƒP»½é;s»˜Â lfÚ§Ž6,$‚ú1¢ŽƒêÓÊR ”PÎ +ÑG¾0^E!ŒZßÀ šï0-û?î“ÜÅv@4èPx– ù-ÓÍa:ʵ¸àT‘0[ÚÑG‘P]Fɨ1ÃdXL‹ŒÓ©Î}ÌßߣGjbL‚…—«iÌ}ýh_`©J/Ðv¢«÷ýÙÚ]¶9ª¼Ãt´o³pÂX[}`k;Ä–WãlÕ˜a¶,f,t–É&OÊž˜Q$‚}SÅa:º´£º7å·© }„”%†¬§néF­¯1ÃÖ[LËú÷˜5ÙW¸Ü£<oXÎOŠBÐxT)‡éhuÀƒ ½©¡}¼Ö9´ŸF$fÑ( Ì ó£Dœëº¯ JO†gQDh,Gut˜Ž’m^bSŠ›Z^†ÂCB£'Ö2ÌŠ´H9Æ® êr×\I ¥bL´ƒÊn+q‹šÂ!Ð9KŠÚ5:60•©0 +a—Q›JcB•¡t¬ ¦3¥èUÔ!õÀ“C!ÆÕ«1Z=¡º;!B ;/µzçY©Ûé×ИªØ_éÖHEàšŠ¹¦‹ž +a&C7ÅÎX™Î n§1øè +oìëÝ´AºÑƒ»§loðÚ¯fTè1 Dññ¼t6èÝa—X{3{piÚÕ!%’Çý#28“D £Œ÷Y<ì3yÂaPÉ?§‚úó“ß:‘ÀbÈÀk,Ø ‹éHmÇW„µ„^a‰•Ávûv>Ɔ5KM“ +Õ½?)ð "b<)Ôa + Dçóåê’wì‡2† #òäP`Ûz Ñhf…ü44±Ö×súÌž-ìRwžé1s[÷èE™7Û÷¢\ç¥îmìxÓ8 +@æ¸Á°E0Ô0>Þ¡70Ã[d1:„æ Vw+Ñ $HF;LGòA(1L$ Á̘?3q°MŠ4w4kÍÏÆpQ ä\G$Rãi¿$ƒ…Œ„*>HûÜ¥ýÂœa¥ÝÉ.$SýdþgB’€7Ì£Oô.Þ÷E–ä×Xê'" W׊1NhCªu¦½é¤›”£´?+LGèAh Èy¬%´:ϱ¥¨>ªŽ‚ŠÑáö¡Úú|ûà0¨MžèiŸïº¥Yésò1©Ó{Pš)‰¤hÉ¥­˜Òuf›n`ζNú´mïjÓ3=MKÿÍ8ðS\htÇ$q¿‘ŠÃØJ« š¨¢CuÝß :úþ Ú—Xendstream +endobj +1713 0 obj << +/Type /Page +/Contents 1714 0 R +/Resources 1712 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1698 0 R +>> endobj +1715 0 obj << +/D [1713 0 R /XYZ 85.039 781.388 null] >> endobj 474 0 obj << -/D [1658 0 R /XYZ 85.039 187.299 null] +/D [1713 0 R /XYZ 85.039 436.555 null] >> endobj -1662 0 obj << -/D [1658 0 R /XYZ 85.039 163.982 null] +1716 0 obj << +/D [1713 0 R /XYZ 85.039 399.688 null] >> endobj 478 0 obj << -/D [1658 0 R /XYZ 85.039 135.371 null] +/D [1713 0 R /XYZ 85.039 357.528 null] >> endobj -1663 0 obj << -/D [1658 0 R /XYZ 85.039 114.776 null] +1717 0 obj << +/D [1713 0 R /XYZ 85.039 323.384 null] >> endobj -1657 0 obj << -/Font << /F60 1074 0 R /F35 948 0 R /F20 937 0 R /F15 951 0 R /F14 969 0 R >> +482 0 obj << +/D [1713 0 R /XYZ 85.039 198.858 null] +>> endobj +1718 0 obj << +/D [1713 0 R /XYZ 85.039 162.593 null] +>> endobj +1712 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F42 967 0 R /F20 937 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1666 0 obj << -/Length 1706 +1721 0 obj << +/Length 1340 /Filter /FlateDecode >> stream -xÚ¥Y[“Ó6}ϯÈðR§Ó¨º_xéPÊ2twaÓ¾Ó1‰)™Ér)0þ÷~ºØ–[d˜ÙÈÒ±Îç#} 2ÆðŒµ@˜™±Ò1­Çóõÿ†‘ßF$ ¦20¿ÎF??•0Š‘Áf<{_Ï#l<[¼Î?{t7{òj2eŒe€œL•ÒÙÍÌw\ÝþþèúÆ·_Ý=þá~òvö|ôdVñV3‡±¤ŸF¯ßâñ |>ˆ=þ mŒ ¯GÀŠgáy5º½¬¦òc|ìßêúÆ1%*Ò:H‚¸d•4ÖŠ¡c%0˜;!`”¡ É$¢“©8{Uìáñ#|<ɶ›}Ñ÷é\ƒà¬ËJ&` µ¦ÐNs –H öR ßDì kïÝ틶E„ $A×h®ôr0$;—bZÎ4`3ˆF|Ö¬g°[Hvubš h§sBJDLª8bMÎ÷ü…Å¢*Û®–ó¯¾ãC¾YÀ"®N¯Ô]†˜"kSƒk@Ö ]q°*w›^N‘”$Í0'¼MAJ4y±ÿê©ýáÙrŸ¾XÎóìd׳wVAïÜ6æ…ý»ß÷lli4 ’^a*e2BÄÊHͦáeÊû˜_9©²—GgÌÈæýÖ?ÜM¬®–Öî¯}ÆBØÓŒ§­1ÎX&:–QJˆ1Ò‡„›­[ÆâáBÉfÀF&tf-ÙØ‘÷ÐØú¾ù*ß[•…²º»®ÝDÀËûöÇ×»†wŽûƒxç ¾}(§ßçò}9š‡wÊé+¼ç±>Ùµ-öÔ§—ˆ¨t‰0ý›]2›¯¹¢ˆ”qóÓlè3Áæ¦úÒp)a›)¬  pÍui¸L›ÂelÖ@¸Œæë—mÒ®ps^.…QH•^›Ô¿6%Èô‡uw'ÄŒÈjA‘!ÔsBÝ”BR„¡S»é |¾‹Š+èÈ]  Aó 8·½®3@s?V)XÆÔZH{WÞIö LBzªGÒ/†Ìj;—FìØÁ:Ki³edÜ”ƒW5ž2Œ°öÖí?/ó°ç©pf,]aŸ\†.ý$€¨ § ¿æ¹MÏÅ&‡EcØgÀ;Þ€ƒÓ_×7Ooý[‹í:·iÛ¶­A?ùæªø§Xí¯ÿ±ØÕŸï¹Ëø¶aµ­Di1ÿWöQ…0$°PÚZ\c[$Ú9¦¥9U…èf>ÎçEoIÈ”‚¢;]eE˜þ’A•e”j„*Ý* ŸlŽëb¦ùÇÙÄ@}•“sI踲¢ÚýÒkm é°äuxº¸e0 (û‡òfãKÎ+…'ˆJ’¶¡Æt8gi¥H…ý¿ þU|9ìrß\䇼Ϭ 4mBé—«5kÉðm¹‡È0‚^ZRe+·s=¦Fí £õœýa´ÅÛF#ÞæYͧ›ãÚŸ‚lX<,·!η!»|9ô¥ -[Uó]*LB9_—o¥K“·[—š·K—ÃnYawE¾èU|6Ñ€ 5(¡C/DŠºR¢EÝ-EDÝÔâ°;–UèÁ„Œº+‹Ø4öDºéˆ¤øÿÔ „@tÞmG’·¼íhóvÞvļø‹Æ8H„1Éb=(a¬ZYÍÙCÎÖ+æ$t£ü˜Í€®È«ë’P­l]¹·p5}O#ñîŒS…ÓÓŸ)Æs›W&¦•o}@-6þñ¾˜Û…è6ŒÆX|w*$šíNrO8¤Ö¼0ç¥BEƒ&,mCéO…`$bü;2!áa•>…E˜„ -Ì.l©ðm™P8æ—fBÛ0Cž\‚ÎuѬý¡®MÝêbêf¨;=—­ëYOpƒ -„™sié$`ÎÖ#Å[ÊÑâíT#â½\ pEÍ -‚“¸Õö˜³ÅHñ–b´x;ňx/CJȨbàB±Â$î=æl1R¼¥-ÞN1"ÞËÅbÅĨ1‰›9[ŒouÑäí¾‰¨y¿_ŒêøÂv'Åp¢¾è4«Ä%î;8§KŃ-ö³øÉmŽ` ÍNíý&Çjþendstream +xÚ¥XÙnÜ6}Ÿ¯òR©¨X.âæ—ÂÆAj;ö´/IP(3r=À,‰¤Ilý÷^.-#Ê.‚Š<ä=:—w‘I„á‰G˜éH*‚˜RÑb3ÃÑß°òÛŒxDê!ióë|öó+.#‚‘Æ:šßµçp”qÍ—ïã—¯O¯çç7IÊ‹™¤Rªørî&ή~?½¸tã›ë—?Ü&çofçóƒÝÉ`C£_fï?âh ßÌ0bZEß`ŒåÍ ¬"ž1ÿ¼žÝÎÞŽrkYäv½cƒH‰FšòiA™`(¬¤9ïêÀ1â8³:À«3”X&)ç8~{{ +o-dün_$)‰ËG÷xíÝÎ=\'ŒÄ»õ +æ!e2…ˆÔÓ\[ŒåÊøˆÏˆ@LXª—»ÚP*NPDÇó{`ȸŠ ­Y¹ƒÁÎÍ-ÖyU™¡ŒW[7U&6WŸÍÏn[ùÍس¯j÷ðÉBܸnŽ¯rƒñyÕ¬æ~Osüïì˜ÿ¾ìÍƪF„VHËlR£æàÏ¡FB2¸…²ïODœGoŠ/{ࢠRrüJ™`KÇIÈ(BjÄ’L %ž é1†äõÕÛ!‚ʨˆ:GM‡Cb4œÒæ¤iV„P„;ö ­×—æQcªS¢Á%Ý;M2†2EzF]ÄAžùœ¤Tš°Z<º‰û| Ž\®‹!!/»ÀI!¦=ÓbžñÃæèV†9GBPŽD&& 7˜#Ë}!A¤gxeÞÕ&xó…!°† n$61Dzøæ87³vÒCs·vÏä$³<ÐÐE0‰CH ¸&HJ6ŽLPO.$Ê0„#m±‚G Ë| +pQE¾3.9ÈÊi²b¸þ™0_]œýxäw¨;ƧíqÇn÷¡É¾×án®Å½uÎÎúÎzÍ$ÌMòÛ„BN-–ΟÌÂL˜]+Û€QñÎ¥‹.‘Â1ƒBó„V-&,–Ç<;R¦ "ehy$Rº†Ÿ)P¶ +÷”ûÙglô¥ÔJ[7ÌZmc†Ä¶ŒA•zi&¦G|ìëtõmU/îáºSn™¬lã`žlUn"T€´ ¶»¹)ÉÅNºË|°ÊOF6ÿ32=Ü_—¯®Ü¶ån“›RmƆÐOn¸.¾ëÊÛu?ùvé-µ¯—Þº­òf`ä5o‚F,ÿÛÌQ‰°vseQïK°O Æ1vg¤ åj‘×…§Qí‹š—ñÄÀ ì•“Iªƒ ö€ ª$“º—¤Ô <ßî7E ÌÜã<ÑÐB³d£&ÎŒ¦æÆÉz##dA'›nf†¦žM÷Tfˆ2Þ‘ç5?TRDÈtÿÕÁgsN†ÁÏ.áo}|u™»á2¯óš!E§½ÙÁE Z"IÕ@„ÿWrˆ†|„å“%‡N¦Q"àÛBói¶3H£Œ†ÒhçÐpZI£]ÃØ9'u‰ÏÕ›ýÆ}ô˜´X¯v>.v¾¼<ÔúBôuZN ÓbÂÂxÌó…™0Ü +3°<&LÇð˜0u¹*|‰(›V*_†ÔÀðɦõ´-&¬†Ç<_ íËcjt ÷Õ¨Ë}ÓÖnÁÕ²i\àÞ˜¯Ðm@øa“Â4€ *à+Šm™Êíq¿ÆíßB‚Æ@ßÚ WÃHe¬5‡Æ^ ŒIÞÓåE“özù‹â{¸¥ÑÅidE³ nÍÔ<Ûڵ͈oQv¶É[Ú³BEÑ@‰ñ5ù»þ> endobj -1667 0 obj << -/D [1665 0 R /XYZ 85.039 781.388 null] ->> endobj -482 0 obj << -/D [1665 0 R /XYZ 85.039 761.463 null] ->> endobj -1668 0 obj << -/D [1665 0 R /XYZ 85.039 741.337 null] +1722 0 obj << +/D [1720 0 R /XYZ 85.039 781.388 null] >> endobj 486 0 obj << -/D [1665 0 R /XYZ 85.039 698.106 null] +/D [1720 0 R /XYZ 85.039 761.463 null] >> endobj -1669 0 obj << -/D [1665 0 R /XYZ 85.039 674.789 null] +1723 0 obj << +/D [1720 0 R /XYZ 85.039 741.134 null] >> endobj 490 0 obj << -/D [1665 0 R /XYZ 85.039 646.178 null] +/D [1720 0 R /XYZ 85.039 698.974 null] >> endobj -1670 0 obj << -/D [1665 0 R /XYZ 85.039 625.583 null] +1724 0 obj << +/D [1720 0 R /XYZ 85.039 664.83 null] >> endobj 494 0 obj << -/D [1665 0 R /XYZ 85.039 579.625 null] +/D [1720 0 R /XYZ 85.039 591.773 null] >> endobj -1671 0 obj << -/D [1665 0 R /XYZ 85.039 559.636 null] +1725 0 obj << +/D [1720 0 R /XYZ 85.039 558.236 null] >> endobj 498 0 obj << -/D [1665 0 R /XYZ 85.039 377.924 null] +/D [1720 0 R /XYZ 85.039 335.876 null] >> endobj -1672 0 obj << -/D [1665 0 R /XYZ 85.039 356.931 null] +1726 0 obj << +/D [1720 0 R /XYZ 85.039 301.334 null] >> endobj 502 0 obj << -/D [1665 0 R /XYZ 85.039 356.931 null] +/D [1720 0 R /XYZ 85.039 301.334 null] >> endobj -1673 0 obj << -/D [1665 0 R /XYZ 85.039 334.215 null] +1727 0 obj << +/D [1720 0 R /XYZ 85.039 265.069 null] >> endobj 506 0 obj << -/D [1665 0 R /XYZ 85.039 307.522 null] ->> endobj -1674 0 obj << -/D [1665 0 R /XYZ 85.039 284.806 null] ->> endobj -510 0 obj << -/D [1665 0 R /XYZ 85.039 214.477 null] ->> endobj -1675 0 obj << -/D [1665 0 R /XYZ 85.039 191.159 null] ->> endobj -514 0 obj << -/D [1665 0 R /XYZ 85.039 191.159 null] +/D [1720 0 R /XYZ 85.039 224.826 null] >> endobj -1676 0 obj << -/D [1665 0 R /XYZ 85.039 170.768 null] ->> endobj -518 0 obj << -/D [1665 0 R /XYZ 85.039 144.075 null] ->> endobj -1677 0 obj << -/D [1665 0 R /XYZ 85.039 121.359 null] +1728 0 obj << +/D [1720 0 R /XYZ 85.039 188.561 null] >> endobj -1664 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R /F36 955 0 R >> +1719 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F35 948 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1680 0 obj << -/Length 2354 +1731 0 obj << +/Length 1307 /Filter /FlateDecode >> stream -xÚÍZKs7¾óW°rÙa*Äâ Ì^¶ËIärd¯¥ä¢è@St¬ -²H&ñþúm­ǧ)¶n)øwücó™3îFçnà‹-wnh?›“âß—3ªŠ~peF—0çîûãri†V¾w(;ÓP]Üë˜æ˜@”•i›6»\ -O *…°Ë%1B§ŠDKb— Ê`„X£¸xuý HIU<_›µí£düd0Ð@˜‹4QÂå²E´±KEc$KÕ!Šˆ£úvõñ¸Ú"e  IuM€üå’Ò$X"-ôt.•B„°4Ï -dx¾yýªËˆ€Q$8q0WÚ÷’ƒ~?¯fÊÐb%ئlÑúîÊ8ÙEš-è .<¦'´½—G¬-ó\Z»õÃò“sô‹­qðõÊm†ƒß:ï,ÎÚÍà|Ïn”û˜}E‰UI' 0 ãqm—×q2Z9Ù¾ÃJ0ÚF·ƒä¥³ÞÆ2ÞF9RDd{PÎÛš¹Nö¶$­ÊÛZ9okæKx[Gè ·2ñÞ9Ð<ªë‹À÷fŒZ‡ÔÆ!m˜†ñÆ/aä~mƒ¯ä',ðb½vÿkçxÚía”˜5A~!ˆÈÒ°EjG‹Íƒuü‡åâ° -3Lšpö%E%¡I‡0ñð/”F¥m‡'ðÿÊg6øÿ—㣻¾œ£ÉXrJ"ÉÓkˆeÈÄ€‡ ¡saÿjw°aà_³9¥Q®Óئï[2>©~;Â뤨a¿÷SÍ›¹¸J…J*C®«íáéÁdv&XÜüÕÅÓL˜tÿhþØbG7°„#ä.ûå…¸Ï&Ú,Ì"7³zl±w·ÇÞª™¥Jϱêjªäª™]µ¹jóßGc-HÓ(æ2&ןi0ñ°(h‰„·W,ªgâÔð-°@¥¢ž” ßÁ\§†ï4-¾CZ™ðÌß]¡Cá;”é"ÅDÕÐåãõÎ!êqš±MŠÛ¦B?˜hgqÃhO´06#Úcz¢ÛªaøŠÞÎ M G9 'ÅB¹9ï ŠEüÃÏ•á§AP¨‡üV– Ûö1›@’ÑŠglÒ€6ñ #øÇÃÅëË‹/{b¡þ²öH‰õ˜žØöz…töÄmy°³Ž¹l2ÉKN«{çª÷»ÍâÁ×€¹tûÈW¹ð»Ÿ0a®šh9ûƒŸæ)ªNØVŒŠŒ:PB4N)±µ:;b‡Õˆý,ušß,ÈUV>]j§Ë²8x-Çô œR2£Ï”Чµôy»=ºÞ¯ª%þsƒ»Ÿ)CÒ[¼*_r6/wR\"Ó -ª0=Ù-ËS™2f({”å)¥µåÍg»‘.ÜçÊƶζ?pf¶%5¥Ìž) °>SšÁµ»\Ùýb~R‰0¢Ñûrñ¾}ßU/!|þ!kEƒ­Ÿ*­2^ÂqB´Uv}yq[­¶_ÿ ÈÞü< ýTi†‚S¤: ƒlpçNG38iS‚ áö|/2^ìû—Úí탙A8†Ew4¥R™Ý€;Úƒ íå‡ÅŒÙhMŠ["ûqÒ¥xZ¸Çô„wâ$Gœè–ð»ðzpó觜~íK£Ñ‘¨û  ±ñ“?„ÆJrê’:}`âšd¥@Z²nIþÇ®VìÅ驵9S|¿Ìö CBÂ| &N€V=!„û™2Ô88kS{û÷ÍPy^J2,Ï ¦'³Sžƒê…jÉ 7ðSå‰ï«õȶºÍðYº~°÷¥ÎÖ]ëŶ1‘Ê™²Æ$,é0£ ù”ܪŽïÈ,ã¹ù*¾™ðô">IÎ×ð¹°„¯o¼L„yØ»ãÇÂ%ÒAÿ:sšÕEØ ¹@D“Œ P†4ªTMŠ­JÕ®ØÁR5;:À¾3L5jŸu*Ò¦Z‰¤Œ»ÍÓZk@ ­yÐx×O‰®}¿#zØùÑ#¼¿™ò îŸäWùÀïÿ¸ˆFXçbXJ˜ÒƒÆ¤£f¾“ÓQ’Z•ŽjP¢ÒÛËIé_1rn~¦ ·²D,7â´Ã¨m¦LVaz²Û§¦`£È–ì»È¥ÀEàqïM‚ÜmÜ€»¤´î÷•/„S©¼CgŒÖÅ s$XÎPÂ=h|`I‰®KGôp` D,Í”g,I~U` ø'°Lçvj‹‰B½)‚ªº¿ÄLÔ”ºSöÓ ¦«ÅfåÙ™‹ô-&Þ\¢LCzן×]ª~|–öR0Y¼¿Òý LçXxÝaJ.¼j1\ø˜¥iœn˜x47_Ì_ -7ž=®ÇD±BT°Sϱ¦Ëc=&Óajf:µÁ”ääûK§L{©™-Þ]êHj.Oè-sæ™ÓLJŃF§Ï¤è*}vE¦ÏPt>}Sžž>Óü|ú ùè-È/²Ìœ•PÂ&4Þ&)ѵM:¢‡mˆa“fÊ3Ø$ɯ²IÀoŒMÌ¡™çbWJØăFú“b«SWìà©?û×÷ûœTE™iŸ „:=hœ:SbkuvÄ«3û7è÷s,ã9}6 „>=È–Ïì™ÜÜÆÆ;~Ê -ø쎟›)CSA È×ñL&UTaz²;?n^íEû#ðÖö±~wï{†-Ÿú¥=æûtQÃÂÉ‹—™ÆxJÖƒzmŸ~ý$mC')Úcz¢Û›…SÛô Eßu;;ºX7« Ûé_f|gF>VákÜÞÈ/ÖêÌ™q±Ý¯‡P±U_µ>&ZÜq gÌÕ¿cÍ õ×ðKߦ×ÇO|±¿i/1¤Y¤¾3/kI(£3®ú}Q÷þïÿÃ¥oBendstream +xÚ­XMsÛ6½ëWpr)u`ñÅÞ\;m’qmÇVOiŠÄ6žÊ’-J“´¿¾ €AŠ€”Øã“Ÿö=,» °ŒâËŒ$ŠLFÀ˜lþ0¢Ùßøæ·«“2 0¿LG¯•:c”´È¦µv$²éâc~þöìfúæv<€‘ã‰Ö&¿šú‹ëßÏÞ]ùûÛ›óŸîÆŸ¦ïGo¦{Þ½Eä(,éÓèã'š-Pàû%P˜ì+ÞSÂðõÃY‰P?/Gw£{SþÈü¯†æØ &¬ —i?(F„‚½8¾e¤2ôƒ¤DRáü€S2fy1žHIóË»3œµÒùõ#^Y^®üã]9ߔۘ„!LCº(*"TÑ,a :š¾STW2a^ômù´+«¨:&‡"­ Å8L*P†μ„ÕÚÇFùm»™ùÛÅl;‹(PJá`I&ê1uü¶Nà*|ô_m½ªÊ˜ÐDÔbWF ’ #tA¤‘¨–r¢yZ¬‡X­¼Ce¸šX>Þן$J¨¬5yÀÚ@ú´¯Äƒ(d¥þ»LìEä»jXàgã:Ÿ[);|~°7âÜäÛrÑWVOVjdçi˜¨CÌÉIï]ÒgðIHübNÁ%/9¤ÒbâN©1§;%AÜ:¥Ç<䔀øÅœÂ1÷FòóÞ)-&î”sºSÄ­SzÌCN ˆ_Ê)¢¸N:%ÀDÒ`NvJŠxï”>ó€SBâr +²(BÒ%{k «énƒð•·H¿ÑsJ½YJAtx^YžºâT Ï|Œ¬_êÁÒŽÚ +ýÊÿ¢ÚÍ ÒÁ+r#V­Éh V!®ŒB‹dµ +0Ñ.CØ`ÒºS­íµçK;µhµjlühg!°® Hçe0š Ïz:Oë-¯œ¯¦,þ€ý§éÚß`¬Ê›ë˃ §W®ÊS鎈ìF'¥´*Æ8¡Ÿ•õÖ­È‹i`:ÐÁõXcH»ëQ†uHÝê[/ïçÿú(ÿ2[Ùè^–~%lëuóÙáêA·|ä¹U²ˆ}^àÄ°tˆ˜øÇ£š0ýû¾Î ¨$Ø?3Ö¸¦DÓ´Üs$ÖSϵ¤ª&ÖBYGb-°µ>é`¬…¤´òá3 òérí“ïÂŽqŽÆ†£ËÐ8ÞD%>Ïì³+K—~­?©¤³åÒ£þs¦6ë +G™/=$x]:ô`é舺wÑ?ŸmË õUà +ÿªŠÇâ’Q`¢€õ²»gc¬W.ëÒ†ÿÿÙ=Ö›M[Þ/¬Æؾ›’HH兀“{:¦×”o¯Ö[— ~ㆻ°Þm +úAaÁ fÿãâ°N ¯€ÚÖ$0v¨– J.ðPn¹Únîm}©ñ«Û«É7ci‹þ£½¸TâFp;¬aî᳃øûª‰Ê‡ñ~lVùëjw0qpb‹™xc+=qp—§NÜþ{²ß +6‰…6cÀU:tZL4I2lM@ôr:;­m` ·í‘ÖôôTn„;H‰¬!Gykè¹y<%©Iã¦#Y¼µOâ=ÆÁ0ú¼ƒq¨op©¹ŒÆô‘S€’8pï8ˆ²GÚÁ€=«Û˜ §5ɉR" < \C$jSiiR’t(®Þ6¹åk‚42{Hú̳ØvãØ°EÎ%×DáæÇk±ºíË•ŸÒÀ¡Þÿ‚È¡endstream endobj -1679 0 obj << +1730 0 obj << /Type /Page -/Contents 1680 0 R -/Resources 1678 0 R +/Contents 1731 0 R +/Resources 1729 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1646 0 R +/Parent 1698 0 R >> endobj -1681 0 obj << -/D [1679 0 R /XYZ 85.039 781.388 null] +1732 0 obj << +/D [1730 0 R /XYZ 85.039 781.388 null] +>> endobj +510 0 obj << +/D [1730 0 R /XYZ 85.039 761.463 null] +>> endobj +1733 0 obj << +/D [1730 0 R /XYZ 85.039 741.134 null] +>> endobj +514 0 obj << +/D [1730 0 R /XYZ 85.039 741.134 null] +>> endobj +1734 0 obj << +/D [1730 0 R /XYZ 85.039 707.194 null] +>> endobj +518 0 obj << +/D [1730 0 R /XYZ 85.039 666.951 null] +>> endobj +1735 0 obj << +/D [1730 0 R /XYZ 85.039 630.686 null] >> endobj 522 0 obj << -/D [1679 0 R /XYZ 85.039 735.239 null] +/D [1730 0 R /XYZ 85.039 448.974 null] >> endobj -1682 0 obj << -/D [1679 0 R /XYZ 85.039 714.246 null] +1736 0 obj << +/D [1730 0 R /XYZ 85.039 414.432 null] >> endobj 526 0 obj << -/D [1679 0 R /XYZ 85.039 714.246 null] +/D [1730 0 R /XYZ 85.039 414.432 null] >> endobj -1683 0 obj << -/D [1679 0 R /XYZ 85.039 691.53 null] +1737 0 obj << +/D [1730 0 R /XYZ 85.039 378.167 null] >> endobj 530 0 obj << -/D [1679 0 R /XYZ 85.039 659.727 null] +/D [1730 0 R /XYZ 85.039 332.815 null] >> endobj -1684 0 obj << -/D [1679 0 R /XYZ 85.039 639.132 null] +1738 0 obj << +/D [1730 0 R /XYZ 85.039 298.671 null] >> endobj 534 0 obj << -/D [1679 0 R /XYZ 85.039 592.912 null] +/D [1730 0 R /XYZ 85.039 225.353 null] >> endobj -1685 0 obj << -/D [1679 0 R /XYZ 85.039 569.595 null] +1739 0 obj << +/D [1730 0 R /XYZ 85.039 188.486 null] >> endobj 538 0 obj << -/D [1679 0 R /XYZ 85.039 540.984 null] +/D [1730 0 R /XYZ 85.039 146.326 null] >> endobj -1686 0 obj << -/D [1679 0 R /XYZ 85.039 520.389 null] +1740 0 obj << +/D [1730 0 R /XYZ 85.039 112.182 null] +>> endobj +1729 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1743 0 obj << +/Length 1870 +/Filter /FlateDecode +>> +stream +xÚÍZKsÛ6¾ëWèVªS¡x`/7NZg;µÕ^dYi<Ññ¤vòï» €$øÄÆî´“IÄÇÇý»‹Å.6¦ð‡"TcmÆŒëÿo~1˜zÈ4Àü4}ÿJé1£¤ Åxö¡–£ˆTb<»»Î^ürònöòr2Bd€œLµ6ÙùÌ=8½x{rvî®/ß½øæjr3{=z9«x+‰ÀQ éçÑõ ß‚¯G”ˆÂŒÿ‚kJ¼^€•()üýjt5úµåÞɱûªoŒR`1ã© ÄÙ‹ÑQFÁ¯¢DQYÙÓ;x Úá÷‰ ÙÅÙé·í2V\æã@`‡´ÄtX™ +XW„5H› Ë)×Ùb2eÙî×x±ÜL¸ÉöË;gû»íz~¿q×W€9CÌ©»¿…ûÃ{ÊÄ>º‡VæöÞ‰„Ùœ·–æ‚Hš§ Zcâõ˜aMÖm±ö4 ý*ƒâ7sÂ2°h`Mã¬Y€Œ”)ó"'‚ê¤)LÔ”%¦aÊë͹דJE m§ç¡ y’Ò:2Y€ÉUCÉåfÿˆÊÝc°í:N”H›§Ät¸›N7SMH=ÈëœóÊëxm§Ñ©».ý üÎÅ,Û!@dû­ÞZŽ¥{¸ÚºÏ>á'%R?@•Tg7î’hÛRsÿ‰Ã¸îO›ÓRVÚlR+¢eÓeWg§×å RÌü™t,e¥uTœ‘B¶ÃÊ:äñ~¹»A a¼rƒ/¸^Õɧ;7•Ñq.I¢«–î¦ã8|xx€ïHlV+Eòt~¬!ñ9í ¨ðâã|"l¶fÙ5Ë;Ó,‘,Å[BÚÄ­ © ƒ<0߸áÚy²]ã W6Ú÷ËÕo Œ‰!IôöùÒâ—=Ìúi ËÁ *èdñ`âF·óÂ^ +Ê1FødªÍ.A †óŒ»Ýì–1eà ¦U¯2XI¨1ÉXÒåJç„åé£Ä º§h ·ÝQ­jè²·—”ÖŒ1M„jªvùòUG-s¶¡ZÝ ô˜a3 +¥„(Ô ÂpÆ>–õɇºPñ˜ÙÁÒ\½Øùœ½qIŸöO]H„æ*íÈw¤Ç ò¿ë9²ÎïÎ]ek—q‰é07í& JÄ.UOúJÅaêÈõ«³u)ëˆvS +¡úÙÚùë=UtúÞï\Žñ™cîÒ-¢ÿœ¸ÌÌÌb^Ä¥!O—U&îET¡¦H« +µÍÚS¡†¤ƒ+Ô[|E¨}×*DëB%V‡ÊB“›¤ÁLÔ`%fpاˆ«°o3÷„}H|<ìOû´v>ìCýþµ°—¹&:õ5$îC°Õžº¥Ô* @/(E9t7]ÿæ–có ŠyAiÅ ”¦5Ûñ¶†S˜ß¦Hù©„´‰AÅá2—"$¾‰tþ§Aˆ}Àåp»v.—Ÿ®ÛçëÜTj}±²WJjËödüÕ˜xzÌð$’ ®“H‹¹/‰Ä’H-ð’HR»2‰ú=OÇPbü&5.?=.÷‡G»fX ÔÉŸº»ûÍ’,æ®ëݹ§»rm²‹Ô½ÚEÊiQ("X‘¬íL'°,*ĉ€ð7œ7k{_Ù¿¹:Ír½Á˜wþ§Ãƒ{v>_/£ÊåPÑé]Óc•ªÄ`ð•ë7Ï·{»,ÿ¾*Ю,ZÐÑjª„–€¸?´¼¬i ¬«-Â&T“˜ +¥3›M”RZaJ{ÀÛ*Ù§kÜûÚíÝÍ­…¸kì«æn÷©z6߹ߞÄ-¬²Å³ ¼”•¸°WCŽÿ|>ج¾õ¬‚åÐkòtèÔ˜hþãƒØW­¸&¬ìY1qï#:pS€MäÑV5¥¹‚ÌÑÒcPËwo:¡Laåù8õµk±—”ÖŠ…hÀ‡jýrî6¾{ZUÚT­·U¥}¤­VUiXƒÔežzS}u¿ð;%続_ÅzOÎ5äàôAE€‰{Æc¯Ÿ)âjýl3÷¬Ÿ!ññõ3øôõ3­_?CýÂõ³ß@G +“ÞÆ 0Qw”˜ÁîHWîh3÷¸#$>îŽ@àÓÝ‘Öλ#Ôo€; Ú6&Ýݘ¸;8·‘õÞ¬\å_Ý ²wõ¡ÅC¬…òK驆D½é!ã›n¡TØ“™k iÓ6 Å”=¼ x½¡êùa²ÅaÝÞ9Ä;wSµyÒî­ÏWn«¼<éÙcS8ßìV¾÷³8nÆM ÐA.ŒÕÉJà¾Â_wH÷¤ÿRÕÚPœQÄ5”ýÒë‚ÆÊ;»j +j@eDWß¿œŒendstream +endobj +1742 0 obj << +/Type /Page +/Contents 1743 0 R +/Resources 1741 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1748 0 R +>> endobj +1744 0 obj << +/D [1742 0 R /XYZ 85.039 781.388 null] >> endobj 542 0 obj << -/D [1679 0 R /XYZ 85.039 406.685 null] +/D [1742 0 R /XYZ 85.039 637.667 null] >> endobj -1687 0 obj << -/D [1679 0 R /XYZ 85.039 386.696 null] +1745 0 obj << +/D [1742 0 R /XYZ 85.039 604.129 null] >> endobj 546 0 obj << -/D [1679 0 R /XYZ 85.039 272.73 null] +/D [1742 0 R /XYZ 85.039 395.319 null] >> endobj -1688 0 obj << -/D [1679 0 R /XYZ 85.039 249.413 null] +1746 0 obj << +/D [1742 0 R /XYZ 85.039 358.452 null] >> endobj 550 0 obj << -/D [1679 0 R /XYZ 85.039 220.802 null] +/D [1742 0 R /XYZ 85.039 316.292 null] >> endobj -1689 0 obj << -/D [1679 0 R /XYZ 85.039 200.207 null] +1747 0 obj << +/D [1742 0 R /XYZ 85.039 282.148 null] >> endobj -1678 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R /F35 948 0 R >> +1741 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1692 0 obj << -/Length 2925 +1751 0 obj << +/Length 2025 /Filter /FlateDecode >> stream -xÚ½ZmsÛFþî_¡éu¦ÔM½å¾ñå¾¹IÚºMŸíëÝLšŠ$[š“EG¤êæß°À’KQ$}NÚé4&µÀ,XRNbøON2+bOÒL -e“ùýI<¹ƒ‘O$#Nr`¾¿9ùî‡Fc‘Çùäæ¶™Ç -cõäfñ.zñÓÙåÍ««é©Ö:äô4M³èâ†~xùöÍÙù]_]¾øæzúþæç“W7µÜzF‘£Ð'ïÞÇ“(øóI,tžMá:†ïO@ª°FóýæäúäŸõT4f&ôÔ1=âTæ"Wv˜‡D -“èšò ¥ZªIjcac㈀Q-¦2‚!5=µ6Ž®–%Ü?€õ2*¶å²Ïv“ãú˜6JŠL‚2 -uQGõ•q"2›Â*£äˆÂ B…_¾žÊèÍ¡VÒHP«ŽúD‹ä¨?NýL#ª#ÝVíê÷CG³ÄŠB7³Ö€XcГÀ h¿E]¡èñLùù `X?^¡~âH•H•qep%ƒž°/ó}î¾4¬ïK¡jWe/Q½wÛ}×Ýy,R-¿„†<Óˆ†¹:Gήv¨®Dð÷†J¥®rœÇtd·Mi\.IKö{Š£p#½5Î_qw‹ûeqO?\-?î—„ß~0,SK IÑ“6°½ÄdˆI==½ ‰®ÓËèãé%ý„ôÒLùÒË ~>½ú}™ô‚a5@Mœ°:sSï–Õ~ç¶7CLóŸÒÝz»@!óYEåýZú­Ëías*{*ïÊ?™§ƒ}@€©C–†Jœ •Xߪÿ/^ݼ~û£ËfØ%i´£f`Nw7Ó\E»Ù–Ô—Ñl^ÑÀÅìÞ±——뺅èë’º±t¸› 0G¼ÊVXˆ\R9p³âú¶Ä5ºó]qËÎœWkWéâM5ûoíOvUÁ+Ð~µæÀx@Q•ÌÓÍvËt¢Úk“¤PÙ޶(ƒË£+M!!ƒç˜¬sa3[ A“+ˆPmÖå -‹™<šÁŸ<ŽæÅvëk|g5VÿE¢w~ ¨ˆúšFʘGc¸$`ôúÍ÷L÷J`´/ï>!CÎ Æf.¦ËGL€.‡E)zIƒ7;ÞÙ>´æùÒÄ«Ÿ<ɯ˜­mtyào=®«†¯-Ä: ~…FHÓJˆ±Pq -JºT¸eHK+º"Ä¥ó«#3Á2V@ÐÈD’´taª·_§ŒI¢ëªØ±ÎµòP›ÍTzóV3Œ”SÊg -s$2àVX“S¹ñ‘ÔïAP4Uéó=ØvA·—<ðÓÌ%s/«¬\Rwœûÿ0:ŽûY’eš=ŸµæùÖäâ¾ÖðÅfÍ[ iêRò8Ûl–Û»¥ à„IÒÑk¤ç¬SñÓ«Ù†™ ³†;šóC†×ááD³¥îFfê¡Ð@3˜¨çS<ßO¡!…›ù~3«š€»&"ʵß<~Y~šf:´½¶Å×[Oé]œíÝŽC7ŠäñJÏ°t¨Vª¡pŠ£Ê£8ÍŸOaóü… " -¿û)ZîÖxRõ)ˆ@W±â*§ð.vKÜ="/w¿óBýwSÅÓzæG_ÌŽIHÞGtV?Ÿ»úñêó'2wö†/î|{ÊpB·"]eZK‡nYúõrGœ5|QÖ””fû©³™È3ù|îšçÈcÐ_Äž?aú3#Î@Q¬Õóikž AH[Q¶ £²®dúš·>([5‚kˆtbZÑË%îÎuYÊõ5ÒRì|}µæêüÁoµß -#nÁ;1ÙW|Ü×䲇Y·£­w:1È«MZïHk@ý­·¡­”Û¡ºòÚà–é:¥ä Cßu» ¥µË–CºyLG·ö‰‡Q°û·T‹ÿˆMÐ{‹,!#õ“áA-20W¸<=âTc—‚Ž¡¿†›Ý£*$¦Ë -Øb³lPIé(Ùf:™¸ •Z’^Z #U6¡¥ Р6-.…ÀÅk\ ƒ»¦Ci´TÄc:Š´Ma…C*¦«^ÓS)Ò81½ ˜Î AÓ1±^¶f8n=a:º´­ÇsŽX·tëu¯õ°}H›X߀¬gPËz(üVt¥º' -)8(Q1οŒ{9ªFßögÈrÄæ3`2aZû§»ŶÚ›®Ãai’!M<äP“¶»aGT: 5ÃûŽ¤´J…RzðH*ÀÔ†K‘[Û2\Z¡ó´>Xs/Øét­Ù–õ†1«å`HâðãÊ Cöá3Cšc~j} ’že£oÉgIìÓÐÔr¿D'.üYLš›©mÌÆf”nȪ{.ñÒ$ZWåÊ-»£ûâѹF½»Ý!½+Å­Ô~zC<Íã͈¡øwÓ|p1ƒÿÐ l#ÇŠÅKgµò,úSjsíówz‘ìýL‡Ž—®Øa78´’Xì8Eá&&/­<é8ê€ùŠ|Œ´ã=ÌÈ#TÊ›Y…á^H#²òv_:·ÞÑTà¿’;f üì)ù‡OÅžåŒðÍ’ÓtöÉ=ÛèÅÒ Àá°MŠð+¢ä\’ÖqzÀ`ßµ`Ï»‡}XÜK8îÿFƒî˜~wËdÅ &’Ѥ¯5/m´¥x¬? -Àd„èÉÂXDʼn̦‹Ät%k{§Ò‰E[Äqdž©†ÚgúKoä2…­ÑŽ”nô¤/=‚û¿ô8{ôKPì_ô¥G:‘ 8 )ùÐk r¯b/ίo®ºU6@”UÃBÓzðqX,´Ñ-¡›æ<§ì?n@¾¶ë¹{3äŽmüy6mc€[C -écˤb¬yn0\æ)T H¬™jKéßqbíyg-±ù\. ð T’¿k“Ý—Ywù)‘C¾”͘Žì6C&Ff-Ùü•Ä¼ÿ°lŽ¬9zîÉ^–¸Ì3h€ (¶îMw;ƒþß²Ê fû¹ß²fšŒ‘¯¿ótw6“ö{ó@ðQg‚߇/ÁÚ‡·s|]¼â—‚DñØGš>r0_â#Cc{ÌjøŸêŒÏú꺎1£E¦{Rª…^/I ë‚V›Ž›€a3ÝÕ÷/÷>^endstream +xÚ½Y[sÛ¶~ׯÐt:êL„àJ€ysm§u›Ø®­æœ™4ªD[š#‹E5Í¿? ,À‹(Âî$=“‹Aòãî·,vi6¦ð‡"TdcmÆŒ#:¾‡'?Ž˜GL=dÚÂü0½z£ô˜Q’Ñl<»kä("•Ï–’ÓŸN®gç7“©"ädªµI.gxãìêÝÉÅ%®o®O_ÜN>Î~Ïj½µDБY¥ŸF>Òñþ<¢DdfüÖ”0xü0­DIá¯7£Ûѯµ(|&ÇøÖ1bÊ2’q÷CʈLEíNøAQ¢¨t~€‡‚LXÂ8á“©R4¹ÉwpýƳ¤Øîò!Ó¥‡‹£d¬›®$ãG:#Ê(øÉšÅézŒ¥{v5™²äÝ!'­è“$=ŒigƘ&Bu©Ýœ¿éц¤™hÓêy"`z +™j+”’0©; +—ÅÃ|½Å$-!d¹uÍ]XÔw¶°XØEn¡²y°ƒs1†;ð÷QJMJ¸Ñ@¶0ƒ Kþ· ÐziµÎïù+’Ê4ª8`zš»~Œ°ŽâílÞƒò‡žVÅIšÊ¶Ö§’ÈÂŽ§‘—õ;¥H&t‡_îV嶡‹×ïTÑ ð]»Uù#>ÿ¢§“¢ÿ´ÿ¹˜˜ EQe„ibƒŽ¢ÇX²ï'‚&WgÿêoÈ #Q0=­]AœYGéÞ&ì²pæ»ÄÆhÚFßýaüN™pÏJ¼é“~=a‰G—CœPÆÖ`†æ1ÏOûˆâ&í4Kû–âg¤}#ð¤}”]Hû¿.í©$™6ñ(6˜á(zÌ3N¡–¸¯=…¢ÌÂ)Ô¦vcìÌÒû°Ý÷c +8šÍ·`è%=Á0Õ„¶ôa¤«Òò³;‚}ÀSPg²hئ§»“eœÚ":º?bµOÎ[ qqÖJº;{@xã&ÿ´Ï1_">š“Úç¤ÍG2JkbtMÈf0!æÙe%¦¸.+‡š”•¶â§ËJKà×—•8;_VÚü¾MYÀPb€ïTPBv¢Ë¼Ú—îq(ÊŸâÕz»´Jó +[-¼» §•;¶øh7Ð`+p¶P"Úí·0užH" MžÈ,w°ÐíKìò/Ïgo¯~tuÌÎ9©NJlùx5›d<)ç[dÏ’ù¢Â—óç4X^¯ëAahJâF´0ý 90Ödè÷ÙÊ7²;»7· UÜùH.ª5Œ-xQÍÿ[ÓÇ©ð?+à¾Zû¬x´Ázt)àÅÍËüµ ½rÅcÊSYèT,,Ù¬w+¯ßXÛmh­¯§ð?W“º¿¸>ý¾•ö èkÔÖ¤w?T.K\{þ,(î•ýÎ#»Ý½MÅ/U`° ݈vJvŸmy*,l¹sµ ¢ÓL–õVAs¶õÜ‹‹ë®g>¯«Uߤ-¤®¾³²_½‘¼sPç>ŠEãîþ"¬lè4×u}q âÏHƒXpö÷„aºƒ¼«ËïÀRÊä¶*ÐçÖÚùLÚØúK·“7Ωè¶)‡Xf:Þ[Û@Üãkm¿Jœ»æu“¿lÅ?ߺhñI·!ˆ‚.oë˜^÷’õ§†¤Û•+;ŽŠÏ>ú—pj {=ݬ}¹ÄwNëÜÜlòí}üæéŠä­%zÒ;(ýÛ«ù¦vœsŽw! +Áÿ-ƒmv6å·|BRߘÍb¿™W÷o‘Ò®Þ¿ä_&F´YÔR—Ýô{{‚‹“½+xÁ½«œ[ì›Ï¶ñÄÖýjÅ›6mí1›^½·œórm‡û/­à¸ƒÌ‹àzÈ•¹Ýá‘`Ùeù§Ï¦7}&õt~Ló“ÁBå-3Ô?iÅÉ;¿¸!ô­@—8®<ÖÚáÆ×~›—È¿áŽÛÌù?F£mG˜X¿q¼E8>|ÑÉ…}Í<” ~¬æõG"_òZ§ Áí,·¥­>ñüAjùe¨ªk ?†rõQ6K_kФ¡òùi_[é]í©ï­¹fõÖ-Ì`o0ÖP,Ðî`‰smPŠØVÅ×ý FCu”KÀôÈt'ÆOY‡ ý‹Ê!㥄a+þ™®…6Þc:ÆÛ½âö‰íû&ÂvÐQ +-3\”Ë€ªl¬ú>aŠ–F)Lc×'œ­;Á%éKXJ2ÿæÕ »Äcº.q›omÒCýé™Í´ Ì0B#`z<º³6$eªCìævÃtLŒÒQ»[˜A»&j·­WGL‡É(é90<#2“&`¸2<…®OÅ¿ö´0Æ{LÇpèV¸â}{¥!”Ë(€é18c‘ºK,¾²XÀäÿHÙ@†íEHÇÜÖxuZl«²Øô 7ÆKã ‡Dºfg”nÚLÀ꡹’1C¸–ѹ²…©íf¸{j»3îæú0»ß„á€|¬ì릅Ê?@ ìP:>¶7GLx•àã¯è. WTᤙJ•%›b¢à¬tqQ¦`_˜•C˜½[ÍËj‡k?°Áªúì&J¿86§e†dÂ4£b:¡‰TzÈ ”µX¹n«œ(Ž_ +Ü÷vì +@ïܵ=°p à÷Öäm CSö@ÉÉ€K%üèw+ø‡ÍWý¶ù!ˆ_—×$…lB.Öö´W}•0°ãDŸïÿþmÊ(endstream endobj -1691 0 obj << +1750 0 obj << /Type /Page -/Contents 1692 0 R -/Resources 1690 0 R +/Contents 1751 0 R +/Resources 1749 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1646 0 R +/Parent 1748 0 R >> endobj -1693 0 obj << -/D [1691 0 R /XYZ 85.039 781.388 null] +1752 0 obj << +/D [1750 0 R /XYZ 85.039 781.388 null] >> endobj 554 0 obj << -/D [1691 0 R /XYZ 85.039 761.463 null] +/D [1750 0 R /XYZ 85.039 761.463 null] >> endobj -1694 0 obj << -/D [1691 0 R /XYZ 85.039 741.337 null] +1753 0 obj << +/D [1750 0 R /XYZ 85.039 741.337 null] >> endobj 558 0 obj << -/D [1691 0 R /XYZ 85.039 626.197 null] +/D [1750 0 R /XYZ 85.039 531.353 null] >> endobj -1695 0 obj << -/D [1691 0 R /XYZ 85.039 594.672 null] +1754 0 obj << +/D [1750 0 R /XYZ 85.039 486.278 null] >> endobj 562 0 obj << -/D [1691 0 R /XYZ 85.039 327.223 null] ->> endobj -1696 0 obj << -/D [1691 0 R /XYZ 85.039 306.027 null] +/D [1750 0 R /XYZ 85.039 118.274 null] >> endobj -566 0 obj << -/D [1691 0 R /XYZ 85.039 209.064 null] ->> endobj -1697 0 obj << -/D [1691 0 R /XYZ 85.039 189.075 null] ->> endobj -570 0 obj << -/D [1691 0 R /XYZ 85.039 116.019 null] ->> endobj -1698 0 obj << -/D [1691 0 R /XYZ 85.039 96.03 null] +1755 0 obj << +/D [1750 0 R /XYZ 85.039 83.528 null] >> endobj -1690 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F14 969 0 R /F35 948 0 R >> +1749 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F42 967 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1701 0 obj << -/Length 2490 +1758 0 obj << +/Length 2022 /Filter /FlateDecode >> stream -xÚíZK“ÛÈ ¾Ï¯Ð-T%ìe¿Éääµ½oùÏääõ–8#–5â¬(ÍìüûM²)>4^;©JUìr©ÉF_£4š/øË©f‰Ì6åL¦ébu{‘,n`æç î)bO4?^]üð“Ù„eI¶¸ºîøh¦´\\­?FÏÿùìýÕËËXJå2¶6Þ^Ñ‹ïÞ<{õ–ÆÞ?ÿËåòÓÕ//¯Z¹-G‘¡Ðß.>~JkøËEÂd–.`œ0Ó· •i%ýóöâòâ_-+šS Z5¶Ç†"æË„ž×ƒáLÙêAÀ,g™Ö¨Î“\,¬N˜N”Sì]±%Ä2Ö:‰^_>ƒm=;–16ÅîP®òCAoÅ”"<ÇYhƒ&upD-4‘Ñ+€ö¶rŠ¿/cc“¨Ü-ceTôy©ET¸©‡b©ÀOìݾùíXÔ|)£|·gë;œ¯v¸º†mƒÙ,‰Vø:ß›Õq붋‹€V8[‚>ˆßª·.¿C 9Ž²FÎiðÍÚóظ«/¨GPOÌñhi»‡Mq»Œ……%7y¹Ã àƒ?z0ð(F´„@£ìÁñ´{§ðPæÛš&~MtrØ”þéÎí£r°Ü‚ÚOëÂø;by­Ž5Ê|¤™NÖÊ©¥¼÷P†û\mq¹ÛƒÔéLÈ™[é $\X…ÒY´£™7§¶É-ú›\˜4cˆón*™TzÔIã†W0±b 8eÚJD¼¿&\ç75mw¾£ak[R[¯¾Æ8뢣®jÿ®Îoý(o§r¯ÊrwB|â¤ÓüPr;¥TmtôXA»<‰nÎ8wþ¥ QN?ÎXª»G"¬®=ÙÆS§/ÚÓ D÷¥ ãð&íu—¯Â‚‡ ^)0/´7TñgÔÌ£Kÿ€:ß–7Þ²J¼ÀpTò½7I¼ð÷X¼ù‘xl–.†‚e®›Ñ~,ܵš6€MÏhº#šÑ´':Ñ´CMƒ¹ñ3¢=Í@t_ÓF°†¡è]1’™d,6x.ˆ +§2âu½ìÁêò8°˜Î - Và­sôh0m<ÖÇ|K÷KmÀ Žt¨¸º¬é7ù=?D•pà!¡ºJq=Ÿ¸_4ä{\˜Ù;. ™9rº;­l˜hî8¼gï˜O²&ÀÈ”ñTž½ìäå†Yq.Ñ|EÐl™ÎÄ̾àñÙ ö v Ùþýª.Šî¯mÝ×_B\!`Nûq"·üŒ’:¢-y¢§ûñœèÖODûq zÎ;^ßÁg‘°ÆüŠ„¦¸€§ÜOŽl@XðŽï´†×üd6zz¥¿^öEX±à¡A•‰Ù“«¯pÙ¾8÷¾œÂ@C{6h­¾qAETcãÇ&SZÑ”{É vP*Âd)/·Ç}Ôš0çoÀãî ʬÐvS9»²œI3ß± -h¦;5J[¦D/œÉ“FÍ%8­sX¿Ç´4Ç(W?à°jC -tc€Ø5*¦`“´YÔ-ÉtGAb -3¨Ö-ïšÒH_º?àƒòQ]?Tû¦È‚·M ÃúHå±+WMýè)%q®ˆ”:D4ÎéçÅKœ¿$Zj׬ð”ï|M4ÇÚ—ç” -5L¸U“S®'´t*ªönŠ©ÔH Kô/Åã°Õ¡E9§þ—L'ú_81èÉÔ÷¿ºÙ±þ—íáâ®G‘öú_Èï)ý/ö¿^ÿ+iïü¿ öµ]0-¤7'8Ǻ‰i°u×dqÂJwÄ5Ñæû¦¿Ä}»84WÿqÕª×\“žné©ÛžHܼØæ½µcãñLYYïi·ÌUÂ^q‡òvÙ6iþJ?Üwf–aãˆö¶~Š³}¯ØÓ¬ô¿ÓýjÌî­ý%áRLÔ|iÐLg‘"˘ñµO{—>­ý%2¸ô2û­°ØpRg`z"÷‘êu›ì É ä`Ï?ÛóœÎÀS–‰@ÞlÌ*¦­± •âiRO²]Àj ¥~]ì0Ä¥ûŒE4«Æ)×äÑõdsL@  R}æL;¢™3õDƒ:o¬¹‰5ܬhO3}Rè Wè…¢?5eÀ¥¶w†\ú Ù¢°Qµ÷ÉMWH sïÖÞn¤W|Aµ)´XO9®P -œFÎ:n@3£= Fàk…Îq¿®¦’c ÿÆþµñIz¦ëÔ9þðн ÔsàÁË ¦ ˜ŽÔôD3|ÒÞƒÊÑö×ÔgëWóûAŸQÓÓU?ÚånÝýn‘+ó»bÒ×P‡üöÎwïHý¸,ßûK{%^Fh7MwèÝ­ê@øÚNj–ªÿ`i÷Ïä÷ç]S*1¹åìÛñ£¨Qø-4• ü짌ŠCTâfÞšé*Ť´= W§eÞ³74À;¡º6 -;|¾ˆ h¦«8¼¬¯=Ã/ñ"‰îóm¹~ü°ÌÊvÙ7}l%VqÀkì[+\úV÷pB^v«¤u½H%S¸8­ö¾I©dæNœZ’øDÉÐáÊû´ŠOôŸ`¾©ñ`у+0›â©6y½ñôM&¤7¼®ö4håìÃüL§ÌÙËÏ\æYëê6oËÒ©X‹g–&óßšéàÅΤí#TOK’ ½Ú~kˆµpòÙ™ëÔÓ FôŠÁš2iÌ¢ãô§¿£yL -¼¹“6ÿu4®c7òqHNEž|\" Eb¿ïT䬩_¡†éΤg5‹J€åðD‡¨ÊuóhßFæÃlD• $™cšä#ßô_­º.–„ eãÑÂBº¡<܇ÊNáâ'Ê!Þ?õ8³}endstream +xÚ¥YM“Û6 ½ûWx¦‡ÊŠER½%mÒn'Ù¤Y·—$ÅÖ®5±¥%g»ÿ¾J²d);“tR‹$H€øÀÈeÿÉebD ÒeœH¡’d¹9,‚åŒü±,᳈ߓy¾^üòÒÄKˆ4H—ëÛn#´QËõö½÷ÛŸÏÞ®_¼[ùJ)$W~'Þõš:~óúÙÕ5}¿{ûÛ7«ë¿/Ö­ÞvEБ¢Ò/‹÷ƒå ük•&Ëø„„áô +£·÷‹›ÅßíR4¦—4ëÒJ„IÔx“Ê\ؤ „ ´ÝäuÕ¬|éå¿®|mRo_­Œôîª6fo³/V0X6Ô,júmv9}²Í®(óŸ±{e…K5™¬PçGø€±~‹v1Pnˆ§¤Ò+Ê¢)²=6ïZ”•(øzå¾²»üHÃ÷v¸®°»:®Lèmi•¬wh]šÂ” 7c§× ‰<ìŠÍŽ>[åšÚMàíóòÎUó/î§>å¨wËkÛ¾Á:‡Ìw[–p|ÆîØÂ…ã’¸U4u¾‡Un©ù!0Á¾z MFÞ†6™C·?4±눽<ÿ¡@ƒ¥·§æ'‚ÿm‘ uñŽjVX× Ž·]±U +}¯PøæõÝ€é}%Cbï-"]ÛI‘wcO°AËØìØ!"mܳ­‡‡NŒV¶„S-–ˆ«wÌôpÍгG›ßžÐ좼sSòšgFNt÷z*kší×Þcu¢ë‚}3N’6‘=vËls·<Ê=8Cíä]o¡[ƒVÚÕ+:#èk]µzu\J´(äpzõú +2c·ô=ŒCj”äT¯äïøéœ ƒúÌ™.g­(Ò"Ž¢Ù|Ú“±©& Æ©&Ò˜³È÷aP °H +ð®ø.ÿrÊ!'L€”Æêrºƒ$­—°HyQ"N!02P"ŒÂy#Yüw¥ïÍÕï? ­’2‘Ž–½GJÌH«ìga!Ï”žJ€e 'Æp:p¾˜36°ÊU¹4ßÒEó >RÙ±#uÞüī谭ôqh<£yCÈHÏÖ“™ÌÉ íÿ\_ݬ߅#¸”iœÎªt2#çp©Th¥Î”î+º¢`÷þÒ³I +7Ï-;„`•Å¦²øl]j iˆÜ#ç‘ ¨t*‚ÈÌCÕÉLCÅ2OjFeÕ@çe¨zJ{PÁmÎþÄø ÛÎà{[Ps´Þ4 N(EÅóàt2Óà° _+eNzï“qô¥rV³“©DäˆÑ¾îŒËþ…õ"€*%¨4 l»l¿'/ÂA IùDê2ž–žÍž=™I|4€ yb=C—=ñŽàÔª²ž²EDZÐIøiTëPèXÎ[Ë2O?ÍÞªÓ§9T}ñ4ûºù4kÊ‘”Žî„ÁËwx5ï‰ÙáEë+H,A ¿b¦Ç¼9ùö„yyO­¢ÜÚÀrÒ +Ö‡)Ǻц†ê‰SZ$¤œ¯Wz2-æà³È$[ÌUÊ3aÿxe)\{ÏNÌLʆmÆÞpÊ2^qÖ²Nf²È*'2æùñÃ$µy°Ô*çÎcË\¿ ˜¹¥êП•Û¾@mÉúýÏLÛ™ŸÁ×iO»L 3$øØP\—¼ÚÆ©±Õ‚-q +;¹æå¨Ì°*5—Vzó¹]øÀ†A]Q‹9çú-;sU”½vü>!·Æ¢;6¬€TµÛt8lɸš.6-Åæ‚ìÞJWÌ÷žnìTç<µ#¨Ð¸§‹9õ×¢²¬zÿHCÇ~ñ_…­Zãâ.ZÊÙëø1˜ÝÒÌéâ+ϲ…øn|A†6A…©‰úv)­„Òæb!í»¥ün­±Kp]ÀÁéCcs™ì®Ñê†=£‡[ç™ô°n®[ŠžµC™+²Ëp‡¬¥Ë„%ÜBAr˜BT+«[ä„Ú;œlÁW“}ÆuCƒ>ˆöŒ«ûGjU·,Ön E\ðøe Meì¡™ñZdÞ«@`ǤW±õŸ¼XÆÒ{[IͶSØšyd'8rt[ÒÚý·›sï$TÙÙ¼ÿ9oꩪ*„›&N竪žÌäMÂ=Èô<ë?­ª +HÝSH=:ÎÒk%óF:[½¾ùcÔA"bÓ‰=!ª£‰˜æ•æ­’2„ >7ëêú¥-÷Æ @Ra߶ ŒœdFZÏù‰0’øLë†[ne´#YÓ:˜¥·ØšàãRÇð›ÌY'3}d,ót7§¹epCÕ\_÷÷m”a +‚üãØ8—Ç›cÞb‰yg­B&«™ÆŠDl]wv\£ëäý©PÙÙ­Nd¨v€S"­úz¦û é趰% u5üž¥ýOˆÆcÓ¿Ù¾¸c§z(šs×&;²7Ú ~o`Êëç4gçpζî ɱ˜8…í¤óõD'2 0‹ Vãò94öÑeF«ªÏàˆ}­e>f":±”¼[ç[9 _°.g-^jÞ& N8سªc"pH>XZÇ·ÏDg2HOõ‰ž.•÷ue"p‚S翈ÿð‡ I¯Lqâٗ݉Z!áE—†¿ôtù]ÿìÑÞ‰Z›ˆ (‚:šlA„"54×ýëÈÈÞÿ”¶ëuendstream endobj -1700 0 obj << +1757 0 obj << /Type /Page -/Contents 1701 0 R -/Resources 1699 0 R +/Contents 1758 0 R +/Resources 1756 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1711 0 R +/Parent 1748 0 R >> endobj -1702 0 obj << -/D [1700 0 R /XYZ 85.039 781.388 null] +1759 0 obj << +/D [1757 0 R /XYZ 85.039 781.388 null] +>> endobj +566 0 obj << +/D [1757 0 R /XYZ 85.039 664.766 null] +>> endobj +1760 0 obj << +/D [1757 0 R /XYZ 85.039 631.228 null] +>> endobj +570 0 obj << +/D [1757 0 R /XYZ 85.039 503.974 null] +>> endobj +1761 0 obj << +/D [1757 0 R /XYZ 85.039 470.437 null] >> endobj 574 0 obj << -/D [1700 0 R /XYZ 85.039 761.463 null] +/D [1757 0 R /XYZ 85.039 397.118 null] >> endobj -1703 0 obj << -/D [1700 0 R /XYZ 85.039 743.459 null] +1762 0 obj << +/D [1757 0 R /XYZ 85.039 362.576 null] >> endobj 578 0 obj << -/D [1700 0 R /XYZ 85.039 644.777 null] +/D [1757 0 R /XYZ 85.039 236.796 null] >> endobj -1704 0 obj << -/D [1700 0 R /XYZ 85.039 624.182 null] +1763 0 obj << +/D [1757 0 R /XYZ 85.039 202.652 null] +>> endobj +1756 0 obj << +/Font << /F57 1075 0 R /F35 948 0 R /F20 937 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1766 0 obj << +/Length 1900 +/Filter /FlateDecode +>> +stream +xÚµY[wÛ6 ~÷¯ðÛ¤³™åU—í)kÓ­=mÚ%ÞS›ÅVØ–kÉIóï¤,[–Ò®ÛéiE‰ ðñ#®sø#Ɖa\¥ã8L%Éx¶ññfþ '1q"“–ÌïÓÑ‹×& ÎRžŽ§·{=†i£ÆÓù§àåŸg§ç—áD)€d8‰ã$¸˜Ò‡WÞŸ½¹ ñåÇ—?]…×Ó·£óic·Ñ6R4úeôéšçðíˆ3•&ãGs&`z5«ÌhåÞ—£«Ñ_*šÓcZuj^b"R–J3ÌC$˜ŽTÃä'x0œ®-0©Y(Éd81†—y¯Ø»Êu•÷í\'À·:‰Y´ +$…<)§Ì$žB1‹a´NÑÎî²pmÉ>%ÇЄ0,JŸ¥µcÙËtL Ó2-¤`BG¶¯É*´oB™Àƒ¾ÍðÛhËq0÷ƒu(Ó .²eÅŽ¡:¢$b2Vƒµdz9ò2ˆóï7`ÿíO•ìP$aû°±!Ã^¦cù"^ç‹Ž9ð!’¶¹á@QVìT˜L¼®g`Èé!°Ï\˜lQÑYMð¡ƒ*[Ùƒ¤·ÌMžØ‚Ô ð?Ú‚×5¼©53C[(ÖôÜæ_vÞתÚúÐdÀoŒ„ðãŒ'±]½Í뺧[ÇiÓ¯ ¶˜e5)j¹9j·¾=£)ûR¥Ö:¸…¹¬XîœÛ£Â‡ÐDA¶Üå¤b·¾G›%FÊãšõ$’HÃÆ¥Lj-™&Ki‡„ª–‡IMQJ{wuˆ¢8¸‚¸Í)Vá= +>†ŠãÙÃÖqX6ÉeNWÖGê>èÎä ô½Œ…®L7z „ºL,ò‹²¶&’MÔwÈ¥‘à˜8P˜ ð^^+·!ÌÍi¦éðàKµ«¬\ŽÿÌjû˜Ó”U_Òø†dì8#%¯Î¯è=_ÛsÇÓ}ÚÔE¹¦yôˆªX/œ²;CðR.‰"Â;ix‘¯s;‡>‡^ËÁoñŽK- n×IpŸ?1?/cÆÓô˜$#\8$Æm§~´ÛÍÝÇmÃÅJUÓ÷l=o _xßýŸSt{„·ÄØ-mh 0!ƒÁ gŠ|í´Í¼{hÓ>råÔekïU‰†[ŒhéÙ}£xå€-²b]ÕC´Ì–xÖtBõdÒñ‰À¡ÅÀ¬G¼G_]EŸ¹áVú®q $ØXéÒºñ³ŸÛU¹[JËrzÙP\¡ë<å,Ÿhjoš”¡¡‡=¸£ ¹O¤ÊãÅ”ØXzʼnÐI=[QPaÐcÀÓÇd-gŽ¸ÂqioðªÞÚ$X·¹ÄÔG­huc 6j'çñk£Oq@¬ÙùI½§|¢X9Ð?o‚•§ÛodþL i­‚'€Qî@ÔÁjg#Fuv&¤±9>ØÝ•›'z+oX“ P懧b†,¶©fàˆIÉ°Û€Y$-g¼oÚk\XØœå€9—uØ‹%¤c_Ýâ.Ë»*omBù9ÞÝTa“\(ÀçlÇF®\„>‘4»+ÝbJ’6ÇÞçuÕw;j1ÍåàÓ’é-5‡¶Z‡ƒÛ‘ _òüªï–Siʾ҃U¬Š4“é0H/cû³wMÛ-óa¿2·T>W‘E=%¥Ó4ŒNH¨¤ZöÞ›‹×X0|è¼1ȤmlÝúÚÉt¬²’Å@nÛªMXNÕ®t›»×êC틵¬&G{‘¡ç[g´2PáÑ=N%¤nËž¶D©èÒú—é?P'ÓiÝ:´ñÔveC†½LÇò!mÐßaçÖ6}í‹ûGªS7˜el- e”Œ±Œ¢œ²o9[Cöòf>PÓ@„æó¾¨UШK>\Ó¶dzù“©f‰: +ÚïëÓÁuXÌÓìÓ¥‰ûx¬“±Ñ{yà^!YWÝEã–Î-(Ét uéÐFâÀrEõýa{¾íïËm/sÐÓûþÖx‹íûD×ÕÙjC¯Ù†Ž—eÛŠ\§.iò¾Ç¾5*påˆëÖ4$aù?6k¿9%__rÎݘG™å¼py#w[ð½Ö9½Žç Ÿi~Z2½}›HÀÇuràäú¸o;{O¼Ê$±Ó˜D"™ySK¦·!†ƒûéã)ŠÓà![ónÖLÀ ì×}ä´éû™ƒtMZʺ@…ÖLëø)T)à·h**zNêoìÇíW¸$*,q`×X_ƒ_9Á¦YA ßÍTÓsºÉ˜*°¬ºsëö-­E²ÂFÓméà5¥"¾œjÐö2®›Û +vBcR¨u’ƒêl S_&Æò’tØ!‘ÞÔi8vWpã¢ßV웕FÏF ´ŒQ¬ÜG¤á•€³ª.ÞvíÃKendstream +endobj +1765 0 obj << +/Type /Page +/Contents 1766 0 R +/Resources 1764 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1748 0 R +>> endobj +1767 0 obj << +/D [1765 0 R /XYZ 85.039 781.388 null] >> endobj 582 0 obj << -/D [1700 0 R /XYZ 85.039 551.126 null] +/D [1765 0 R /XYZ 85.039 761.463 null] >> endobj -1705 0 obj << -/D [1700 0 R /XYZ 85.039 531.137 null] +1768 0 obj << +/D [1765 0 R /XYZ 85.039 741.337 null] >> endobj 586 0 obj << -/D [1700 0 R /XYZ 85.039 471.368 null] +/D [1765 0 R /XYZ 85.039 640.921 null] >> endobj -1706 0 obj << -/D [1700 0 R /XYZ 85.039 450.375 null] +1769 0 obj << +/D [1765 0 R /XYZ 85.039 606.378 null] >> endobj 590 0 obj << -/D [1700 0 R /XYZ 85.039 311.046 null] +/D [1765 0 R /XYZ 85.039 426.402 null] >> endobj -1707 0 obj << -/D [1700 0 R /XYZ 85.039 290.451 null] +1770 0 obj << +/D [1765 0 R /XYZ 85.039 392.258 null] >> endobj 594 0 obj << -/D [1700 0 R /XYZ 85.039 244.493 null] +/D [1765 0 R /XYZ 85.039 319.201 null] >> endobj -1708 0 obj << -/D [1700 0 R /XYZ 85.039 224.504 null] +1771 0 obj << +/D [1765 0 R /XYZ 85.039 285.663 null] >> endobj 598 0 obj << -/D [1700 0 R /XYZ 85.039 176.163 null] +/D [1765 0 R /XYZ 85.039 210.224 null] >> endobj -1709 0 obj << -/D [1700 0 R /XYZ 85.039 154.967 null] +1772 0 obj << +/D [1765 0 R /XYZ 85.039 175.478 null] >> endobj 602 0 obj << -/D [1700 0 R /XYZ 85.039 112.807 null] +/D [1765 0 R /XYZ 85.039 121.89 null] >> endobj -1710 0 obj << -/D [1700 0 R /XYZ 85.039 92.212 null] +1773 0 obj << +/D [1765 0 R /XYZ 85.039 85.625 null] >> endobj -1699 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F35 948 0 R /F15 951 0 R >> +1764 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1714 0 obj << -/Length 1986 +1776 0 obj << +/Length 1424 /Filter /FlateDecode >> stream -xÚÕYmoãÆþ®_¡o¥Šr³¯\² 8>_âÀ–ï,9_ÒÀÐI´MT"‘òåZä¿wfg)Q")9½"A|ði_fgfgžY 9üÃØ0®’¡Sq<œ¯|ø;ß„§=IØ ùf:øâm»œ%<Nv| ÓF §‹ƒóïÎÞM/nG¡R*ÊQhmŒ§´ðææúìrLãÛw癌~š~?¸˜nån9‚Œ…þ<øñ'>\€‚ß8SI<ücÎl¯ •­ü|9˜ ÞoYÑžÒ©®;Ö¡HX"Íq;D‚éHmí ›vB2%äÐÎ ×ΰ«ÙHšÉQh nÓ¦Ïpyy™ö]]Ç`pÕ¥Œ, ‹DUd§º‚G,61è+#¸“8¡¯'B})Ü\¾ùë¡^B‘ˆ‡ Žm±ž¦%V˜¦X1æØMFY£PÚ`> -E°ù -i>’qP¥ ‚ËÜø'Êí­i¬ 4E[žzÝRß[Ä -Å”'¬¶#:b5Oäà~{²ß N“¶áV69.ÙÓ´$.aÜî ü€Ìõ Þº¶Æ|í ‘€I’ ÊfËž¡Öùî,ª€:#ƒÓB‰ãj¶z¦éì™P‹ÇfëuPÞ)Îo)-fèËb§C‹|ñVE«„€‹¦Vœñغ»dðB¤ïþ2[f‹û h -3 ÀP¡À‡š8âÿ¸5a™ˆåÞÆÝåx*"|^ðØq é£ü˜Uó'ƒ€MJÃ,_dóY•å4¿›\ÜÞ_ŽßÞøSÕz3¯6ëÔÝch˜•vOâ2â¼ÈçëbOîs‘åI7©ŠãRšw5t£}J4 -–Åc‘×wx(Ö+¸,xÒ2¯¶‰‚ø#çØÓílS=묂£/Þë´|ÆÈô%Mùý.ˆg¾î³Ná¹³ÌÛbÝv3Ÿ§eéx„R:T4nük‡ÃÓe™þ/8èP¦…x@×Eí¦ZqšåÅ¡žÁZ›Uºx 8ø/~¼U·£n åÅkÀXÛ?ùãÜüËyãN‘Þç2½ŸLϦw“ûñÍýäîü»{¼k»Ýëמd¨!p˜XÍÌ šmÌ,ADíb¶J")»—™ åå«ÉÈ“³k\a{,\²éÖK%Ú±=¦WƒÆé¥LG.QR¢–N¯qQ¹0üwÒëy=22@Í>,A£Oƒ . ö>5Wê-‚ëC¥¶ ’DÍùd 9E›Î -*ô¬Â¯öU¤Œ›hï*€Û‘Œ‚R° ú;øŽŒË3šË +i#>Ö3—wR¤Xø«ÎòÑÌèÄ|ƒÌˆQ^-?³M5,Í7!L¨˜YWÛíP¶‚Äßå–PÌÎÌÅš¦sÜvœ˜ÕŒõ’øt”èPã:ààj{Öc‡(Kâ“å.µ±>DiÍŽW [ŠþÊR2‹l²r&êúóçMZV}ò•€ l?·ìT –'§ÔôD¨&>ºÃº \§¢hØàu -ÁQ7~kN'ÔÒ.òjc=ÜÒ-J˜TqS·¶1»Äpru3í`f±’T5³^Ð’Øz|ÑÅr­¯f1E“£B78øÖý?ˆ™ã…iƒ¦¿0QÌâ8:,L5÷+rw¹,ªaœqCÊKZ¢B*wgN às¬äðÃ׶ÏD…oWWŽrY"{’ … ‚ò΋†°'$ÄV¹ -¬Í•°îž!n–OÅ/húÁ—¢È²„Âuô˜TÚÅ1ÉŸ9öi…kI0N«o.o'DãäÍVþêWÒð7.Þß]Lp0=ôœâà ð0†)e?«`¯y… fm+ŽeQ²•è|ì› ÐÔV4O(¦=¿ò_ê4ÆLÇõó’¼ã<¾c@Qü£‡C-}žïç”|z`I—Z–„ê”ý_,Yó:nIA(†ÕgI‚‚ÜøUGÒ2èrŒŠÃÖb,\4òo‰² ôšO³ŠÉg}ÏVtõ_<R3ÍÇãM«ŸÆšm<Æ’Í· ï]Iן¨Ï~(FŠÒ&LÞ¹œÞ§p:ñ ýŽ¤?ª% mÜŠiQ ñÔ=M¼¤ëMLá¡©àêzŒ{…þ•æÛeÉ+œÓ4sŸÒœJS×bå€!7gu Œò Jr=î×Úmõ±Çì%Í;"”“yàm|. 㨷Ø*é2'ü÷ÏúÛËîË%~Ò]„ U«Õ^¼á‡êB}à 4 -}ÿ ÃB }endstream +xÚÕXÛnÛF}×Wð­TQnö¾dûP¨¶Ó8°åÔ’ó’†BÑ6‹tHÊIZôß;{!EŠí4hƈ¹—Ù™3ggwfM< ?Ä Â,òTH C/ÞL°w 3¿Nˆ“œHÐ’ùe9yñR(`áÈ[ÞìôÄó–ëwþÑ«Ù›åÉå4`Œù 9 ” +ýùÒ_œÏNç¶}ùæè»ÅôýòõädÙØm4‚Hý8y÷{køz‚‹Bï´1"0½™€U$8sýûÉbò[£ÊÎqÏ®ò±–H„"*ÆyqÉ(àA`$07<À$GSâsD§Ø¿LJè>€ïÄϳ29ä9o6ˆE³ hH:(¡"$B_ÂSd­“ÑhßNö/N¿ßGE€É¥×RØ3ZËô¬ѲJ¨@¤ct›!ë|PåÇÓ€ø[èot#ɦ4ô«dm#僞øfæ +;L‚LžÂ”“.öÁ;6d(Ul”°–ÌAÂjæ—'`øXêÅ0¡),GíÖ2=Ã{œ…ˆHÒ± ‘F‹GísÍE\˜Á5@2 $ò«tu_Âùãœû¥eÎ.2ëí +V¤–r;`«ÕæÁvW6fõ²UQêAîW¹Û³s‰Loõnæ; HÓòâ%“-Îxn¾f´?é œ*`~\ݧëëm™Ð#Z°@Èadÿ4CD!R;Î#3qu:_©Ïœ4föS~J«øζAÿ6±Í4[§ñªJ³[Û¿Zœ\^ŸÎ_^¸UU±«m‘7<U‹oÍi ¨á,Ï‚?’"ïØ}ÈÓLǤéTù¸•¶«µK]QMŠmÝç·yV;q“𜪎v¤0¸}(ÁØ'p³mu—iK!ER>è{é'ÛÅù9x¨×üÜ13EdÎLw™#n>ëî6Ž“²4:8:*Ú.ÿ5@Cr_&ÿ ÀôΠkGE½O5pÛËòý=x¶¶›dýœèÀŸ1üs¬6­a†²ü9ÑØåÿ_ßæh`›?µ|’¼«ey½XΖW‹ëùÅõâêèÕµvoû@*dÒ2S£i¹%ÓÜÛE:Lš{›qŠx7+ ›“Ï3¸3¤ò³sÛ8Ó—Ømn’ÍTŠ 2^,´d *&úÙ„áÑÈÞó¼2wðp[ ¸p‹)ü†Óùpõáþ ||ôNß·²ÎL¯8ßIáLD¬QþdÙ˜‹Áò)pª‚–®¾3”ÈL¢ã Äí”JÿÂÕ± øãªÎðÖ9;™–ö«/~] ¬LúI´ÄÚxÌýU¦«Ný•Õy"Þ¢¬~ÌÌÖ”©)`&6ôÁ¼Mo‚BZ +Ìzbå“FI^Øà$ ò,ä¥vtÆFÀ Ò E¨—P?Ùù“Y¼vR§3&”Û(8kÖ»°²b¥ûÖ˜‹í2vT)Ä$ »–ÌÁ"† +jêËÎi@¤®Q?n“²:Ê[¸Ñž,MÉh¥E‰@T<ÒÉhúhöŠR×óZªžŠr9㵦qT„p$[öê ×5s‡ëGÊ6¶~ñçdzV»ÅWˆÓŽÑrµéÙ“Þ._Å…®$‡ÙpºžÀ¥ôbÙ–ºJ½>ìæ›ÃqèæQÊÑxnÉ ¢( +CµÏ_÷æÒ))¿1° È(!ÆÑ:™g½¹Z +¿¹ö­¼¹ÚFÿ«7| …'l's˜0'óÜ7טÝæ͵oxðÍÕ¶ü¿zsí^Y #쎆©Þl®Ñj°UØ¡“-x‰_¶`5§9¶SfÐ9hòísbéf•êä¦ß9{öàár(áx í#ü·Ùù›þ:Ô\2@VÈ¢áXPÿJÅÍ£ûp !œYïßp>`Bendstream endobj -1713 0 obj << +1775 0 obj << /Type /Page -/Contents 1714 0 R -/Resources 1712 0 R +/Contents 1776 0 R +/Resources 1774 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1711 0 R +/Parent 1748 0 R >> endobj -1715 0 obj << -/D [1713 0 R /XYZ 85.039 781.388 null] +1777 0 obj << +/D [1775 0 R /XYZ 85.039 781.388 null] >> endobj 606 0 obj << -/D [1713 0 R /XYZ 85.039 761.463 null] +/D [1775 0 R /XYZ 85.039 761.463 null] >> endobj -1716 0 obj << -/D [1713 0 R /XYZ 85.039 741.337 null] +1778 0 obj << +/D [1775 0 R /XYZ 85.039 741.337 null] >> endobj 610 0 obj << -/D [1713 0 R /XYZ 85.039 410.584 null] +/D [1775 0 R /XYZ 85.039 369.937 null] >> endobj -1717 0 obj << -/D [1713 0 R /XYZ 85.039 387.267 null] +1779 0 obj << +/D [1775 0 R /XYZ 85.039 333.07 null] >> endobj 614 0 obj << -/D [1713 0 R /XYZ 85.039 344.5 null] +/D [1775 0 R /XYZ 85.039 277.361 null] >> endobj -1718 0 obj << -/D [1713 0 R /XYZ 85.039 324.512 null] +1780 0 obj << +/D [1775 0 R /XYZ 85.039 243.217 null] >> endobj 618 0 obj << -/D [1713 0 R /XYZ 85.039 294.83 null] ->> endobj -1719 0 obj << -/D [1713 0 R /XYZ 85.039 272.114 null] ->> endobj -622 0 obj << -/D [1713 0 R /XYZ 85.039 211.171 null] ->> endobj -1720 0 obj << -/D [1713 0 R /XYZ 85.039 178.849 null] +/D [1775 0 R /XYZ 85.039 199.986 null] >> endobj -626 0 obj << -/D [1713 0 R /XYZ 85.039 124.401 null] ->> endobj -1721 0 obj << -/D [1713 0 R /XYZ 85.039 103.205 null] +1781 0 obj << +/D [1775 0 R /XYZ 85.039 163.721 null] >> endobj -1712 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R /F35 948 0 R /F14 969 0 R /F11 976 0 R >> +1774 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1724 0 obj << -/Length 2341 +1784 0 obj << +/Length 1726 /Filter /FlateDecode >> stream -xÚÅZËrÛ8Ýë+´ UÕÂ/>zÓåIzfÒ{[½JgÁHŠ­Š-:¢”túëûâE‚xA;‹®T$š<â¹÷¼8Hç)ü£óB’”—ó¼ „Å|ý0Kç·på¿3jK Yz˜¯fÿúOWSR¦å|õ©»$Bòùjó>yù¿‹·«_¯KÎyÈÅ2Ï‹äjeN¼úÿåÅë+s|ýö勛ŇÕo³_W-o{Gà(é—Ùûé|þ6K /‹ù78N …Ë3`%Rpû÷ýìfö®½•¹&ææW¡bIKR2‰ëQ"2ÞêÀ|(e„S6ÏeJd*´pU’M(¡‹¥”ir½ýrÚ6DZŒE:óP Œ’‚BLEÀ‚QÒ4#…, L–A*4¦©0 1B‹ÐdE³alT2RÒbîÝõœÚbΨ©ô©3FR8ô©Ó?Ó4ÍMgXª/‘¼;A4[;›kŸêƒ9xû -N¾< ÒæžSNxN#út D RAÞ¬®Ï¹ ™ÈpB‹9#ì«"8ÉyÖ#|¨Ö –'w;Èu¿5²ìá¸zP²lDzÏÊ’,Ò;<ÐxöÉ%tÙ ƒÙû„‡m£Ò|\,AƒzßXªÝ}s_G³/2Ârɾ!Ù[ÐàÙ(ÞŸ?)É2ŠS[Ìu_™ -g|ê¦Ç?Va³SàÖHq„ÃÚ²åÇ+’ïÇ­AW÷»Û½9ü¶;Þ™£æXŽæ°þd¾šdTÎœ‘œ‰ˆœ‘Ó‚´œW¯CýIJÂ$Ã9-æŒsPcá0øœÏ}šdIh.#t D ô'ÎÆj-Jíjí:Xk}ê«ÕWÕUÚÒªŸ²]½@H’±˜À‚&6(u+À€:,€Gýæòju¬?kƳæðÃ<‹dݬ-hzÖu›õ€:œµGýæ’¥£Y[ç‘QHŒRÔýx$ç”–±ûaÎý4 ]×95u}$˜ü’ ?jƒd^’,/ñxhrywo£!u°|jmƒ.z6èº7 -6¦TiÀÑ–þwîi{8sHpúÕ¨C’ 4¬ŒH×é,(âPB熄AàÆjºVâT¦;;žNLS×U£DGÅ‚•ED«ƒHe0“ýÆëìÄ€7è&<ÞÖLH^£ñå‘Ò‚âfåtfbÈ4>ç3Í„d0=.b«!XÐ0ÎV€gXsSCkÛNaOšRRòˆ#÷@HÒ4ÙA¡Ôm™P‡Ë´G=ê ÚrãN*Utߨó}p“ÚµþÜ™mÌ/ž-è‹.íúNG¬@‰rtÅ SØ+ì@“B”Ú)<¤*ìS÷-Z+kHSË -ºëZÅ ªžNú2IÉB‚G¦;QÒ‚¦+‰Q·J¨ÃJzÔ}Û×)Ù!ÛÞ¹]ë³#Ý$t=³ ªh›€º µ‘¦Õž0){JåÚiÏFZys¡Â¸„Ȳ,ySßÖcžV­ì±2ǃé0:.C ÊÍrSê£êçü¶T£ÁÝN²Hö¦ƒÂ‘¾ É’mó¸Ô-d¨«Jt™'u~«>ÖíÑÆ|äÇïyü¦HkóÇ •/tá… -¥œð¥:ȽAô’Q«³Ò^an´¾ÓO•²Z›¼tUÓÃ8˜l‘~ l‘ò,}ÊÕ’.M¾n ÔÀŸÀ[\?ÀpRÃêÏÛî´îª'²LºçSö5Ò]Ìô5uÑgÿ8Þé‘4Zhu¤ú¯¹T7öÔíî«™æ¨çVg¯ãÆ7º–Ñ÷êšH‘ë•Y“zà‡ƒ†?5ÛƒQqoJ“‰Ùo|Ÿ.š©ÔÍÉ›ÎÛÎPèΠt8=Tïíº§“Æv®<©ŒF¦c˜&. ²Gé@“ëµw×ñz=¤ÖkŸZM)ëMo ˜‹Ks*Xé\¢œDðˆ»ô@ˆ4] Œºc@ãî8Fu}Ú/X™Œ.s*tÄUè@ˆ -÷Ø(§óØCΠÇö9Ÿ9Éà)%<æa<"€Mãlp†ð8myUS d~ÁŠœäEdÒçë@‘µ ”Эe ƒk>á3÷;X.ã±ì;’½Mž]¡Ôî¡RzŸºº¿¯•ýüÖºùê#sï\ÿZ{Ôú¤G9VŒ–¥$+"K¸QÆ‚¦+ƒQ·Ê ¨ÃÊxÔþœ[ -¯_IšÝ_ã¸7ÊóˆÁ‚T$ë»jÁÕädx¯¬Äns.%¼wo|Ÿ“,¸y¿twŠ„)É=>f£*ç_áb™C+Hëc1gÄý–ÊaÀJ‹±]f;o°Ÿú+ffåàL;–K¨ò)Ú©Ý zî^x ’ÈI@·òæˆnI° šÆ¶»qðÊEd­Ô!ÝÍ‚&¯–¢Ôn¹tH\/õ©mKþò‹bWŸBÈD-"Wµ„ºÛßú«ñ<Âô·PŽZí”ãvE¬·¢ -î¼þp¬Æœ+¤é),ÑC> neIX;°T;h¼:Ò4½öaÔmíP‡kŸGýÔ]Kߢˆ Ð,h²F©[Ôa<êI»–´„ÛGœ_‡ÏÙb&§ŒñºŒ¼Á„=Þ)û•4ÏI–ãoky$_0Ÿ”eƒ9êÓö+MòG÷+©Hõ{lx¼ô„ù™ûÞBi"ZOV9²_ÙºXWo&Md)_{è„b(>ƒA9Ý fÈœÁøœÏœÂQ:ºðá Ð,h‚g+À€3,€Ç9˜ÂilWÑ¿>|nŽÕ±Ý=9ªâ~jìÎb¥½¾™ò#N_½5VF¦@f\,‹‰k…:©„A¥<Â'l¨ü82¯é0ãéZÌä‘ãu5dÀ,!ïS‡uõ>W™Ç^|uì½WyÂk¯ã¼Ý[¯=Þ‘—^[ÞIº, XòÈÖi‹AvN fúû-o»oÚç o›v¼Stž’ð;"ðß,ÂÿÐ{à݆'Řû”LacQ‘ŸotI^À ŸÇû7üQendstream +xÚÅY]oÛ6}÷¯ðÛ$ bùMi¤mÚ¥h&qŸº>¸‰’KìÆr’õßïòK¢d‘6ºC[›ïá=÷òòJ%S È´³jªJ‚XYN/ï'xz3ï&Ä! +)Ì«ùäå[¡¦£ +WÓùugG .Øt~õ%{ýÇѧùñy^0Æ2@æ…Re6›ÛoN?ÌìøüÓë_.ò¯ó÷“ãyËÛZŽJ“>L¾|ÅÓ+Xàû F¬*§Ï0ƈÀôýX‘àÌ]ßM.&g­);ǧöWc>zDA*TQ‘ÖAÄ%ku 0Ëã2ÔA`$07:€ëB;÷ò-§’ TÁÌêúþZTÏg`¯t(PìCN²‹§óƒJ"ÉXgpÄ%HP‡˜aºß©¼'ÉôªNõàùœÅbÉ%ªˆJ«ÛaŒºLŒd¡Hb›e³õVSÖ¿Bz1•Ý/–w°˜æn½mò‚W*{†…ÀÙ½¼ÌÉÖ«íb¹²7ök“ šÕÍw;ÝÔön`îXa$Û®Ù[M»„ÉË[{g{[·¦`A LYkè,ʬ¹]?Þ]Ùñ7´?jêÕ¶H©¬!t)¤¥0~nÆìM½Õ{4®·¯NNu6ØëÕâ¾Ö#œ-û}®yÏ>_èÁ|*$R%ŸÊªBX°ý;ŒAˆÑýUx[E`l7zTÂYKh¢w¤×öÜ8¶™Ñí~À€²ò™ö›ôòñR¸yŠG,Hç6ãßcá…ÖMdÏzI·õÆÇHy¬ïÁ2?Q/vÔä)ŒÅ¢¦·•V“‰˜ Q9MVø\0¹ÙO“õµ›²îšŒÓĵ‰Ç+cô~qy»\é_‰ -¶v¤Öß3;P_øä×¹ÞÆ>ŠT)KDHúÜ 0m½%¨Òû¢­’S¤ ùz‹€šÀ†…}¦ùëÍXŸTÙõ:6öâÓ=ù:¶8Žß·¸-W—H@ø‡å +¤›Ù­I²§zÓèbb‹…®5œg>ÎæÛõ_µ½pM±¹Ö­4ÅÇ £%G`¨p>•õ…É=hL&è/?µö?¹Y>° +“Ëq +‡pÇB-”BÒ›Q5Lê¡šB@ñ/e?ÔÈû¼6kˆ-AŸÊ’.A÷-PÀàTÆ„Œ"T…ÔŠBEyÏ"F/òóIN\ ‰®ŒP$œ«ÑbÙa&a²}t÷ˆñßce[¬BñìÌìI½– ~عëõÆ`;Œìç7/¡V +‘”&ÀD¥ñ½Â‹ùùŽ X!¦X’Îcvøú‚@—PRÕ#„Z–S•Ýš¤®­&+/îm ‹¸2íz‡‰»î0û\OÐu®øÆ]7P +] +Àv8Ú{Ýáèö&æ:㈊2íz‡‰»î0ƒ Q~ÙÝÌPRÄïæ1ßb×ÿ£ƒí2rƶw˜¸Ãs¸Ã âÎáó˜Ã±k¸Æö ÕMˆ}CíkLÔaZBK…É ¯¡¾¯±½X²µ{|-Ô¼¢ÙÛßÐdt(<3™.çspt£ñè ™G¢›þæ¨×ßœ÷¹Æ?—õ]?ŧ^ë·ßÄZJ*DUZ´×ÌBöþ ®öìýÛ¾ªmø ¼t§Üã÷ÜkhëÜå¢1‘ˆF¤¢ˆ¨t‘0Q•<æàF!EÜ6 +CæÑF!¤þ_"A •>4L\K‡Ùß+¤ÛfaH9Ú-„œ?×.¦ùÒ&î½Ãà}‚±ó~@9î}Àyµ¾_øu€×`¬Téî0ÀĽv˜ƒ›¤q[™‡Ì#•9$Ž6I 5¥ÆÜqy¡¿7þéôÒ|.­•+«¡×²=˜Rn,m• ÎU¥ÒO0$ª«ƒ|à%X[U´#¢¬ýæ«­ÙcB‚FNÅe¯¢}cA^¾> endobj -1725 0 obj << -/D [1723 0 R /XYZ 85.039 781.388 null] +1785 0 obj << +/D [1783 0 R /XYZ 85.039 781.388 null] +>> endobj +622 0 obj << +/D [1783 0 R /XYZ 85.039 761.463 null] +>> endobj +1786 0 obj << +/D [1783 0 R /XYZ 85.039 736.114 null] +>> endobj +626 0 obj << +/D [1783 0 R /XYZ 85.039 668.118 null] +>> endobj +1787 0 obj << +/D [1783 0 R /XYZ 85.039 633.372 null] >> endobj 630 0 obj << -/D [1723 0 R /XYZ 85.039 761.463 null] +/D [1783 0 R /XYZ 85.039 577.663 null] >> endobj -1726 0 obj << -/D [1723 0 R /XYZ 85.039 741.337 null] +1788 0 obj << +/D [1783 0 R /XYZ 85.039 543.519 null] >> endobj 634 0 obj << -/D [1723 0 R /XYZ 85.039 616.811 null] +/D [1783 0 R /XYZ 85.039 310.599 null] >> endobj -1727 0 obj << -/D [1723 0 R /XYZ 85.039 594.095 null] +1789 0 obj << +/D [1783 0 R /XYZ 85.039 274.334 null] +>> endobj +1782 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F42 967 0 R /F35 948 0 R /F39 974 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1792 0 obj << +/Length 1611 +/Filter /FlateDecode +>> +stream +xÚ¥Y]s›8}÷¯à­0STô…`_:Ù~ì¦Óx»‰÷)“b»‰§¶i I·ýõ{õ,)Îv:±Á8÷]]éReðGG-#Q`D‹"ZîfYtWþ˜aƒH $µ0¿/f¯Þsá •Y->Ïáˆq-V×ñ›?Ï>-Þ]&)¥4d’ +QÄó…þáí_gçs}|ùéÍ‹«äfñaönÑóöOŽR’~›]ßdÑ +ü0Ë-‹è;gÃåÝ XgÔœogW³¿ûGék,Òw¹4vˆ—¨$<ìCŽËiï«•œÛ>ð ñŒ)@:G ŽI’ržÅWgIŠã PžçñÇú®Þû”³aQ†c0*Êc‚sDsʼn%ùú·—ñ®ZÞoök…ñ¾Ú™£Í^Nâuó5á8®÷Mwµ‘ß"þz¿¯åDz?ZéO¼ý¡‘íwIZë“Rí«÷ŒXNPQÀØ© ÷Ÿï4f$F‰`òB?ky/\©8«¥–v§$¥$/aÊ`ä'ˆq.OpÏãúÐl&Ž÷/a¬‹?^Ìmýe­Ï9œ“LÃiVÞj3øAÛ¥ž"-ã™PJƒÔI{oe¸¼¹jºKuwËÝæÑÁ"ï•Ê2HT™°¥’Ô ‰¿=¬›u¥ºt üC>) ÷ÊÁ]¢Â³_…i²À­LÞ®“¡PÉ såaWÝnúcòÆ$x!ï7)Ôêñk ³Ö©î“¿ß›;†<“ò¤®"ϬÉ)F„„+™…égðtÖäYŽÇ㌰žÃ—kå´/„Œ!LÜW–G(3;¢D¼à€„äÅ8d‡‘AþsêtÆù42L8ÊYY="î0GÌx4Á;<"ÎþÍ2Lt%O勯 ”³ ý“³Ä‘œ”‘° =Äœn‚Ÿuð`Lë²``=@:è©Ýj –õÃ>!eÜú¤c+Í)0`üâ F©ŸŸ_-.e TŠ2ÈØaŽ('Â)b”Ž8a IˆˆïÕì]kíûDÕYp<êY!PAhP½…ñªï0O«1ö꧔Nõ6§)¤½f¯Þ©?ëo5Ã#ÐgdÐó<Ã9"ÜÍXÚ=+,ö^ˆND@BiëT¨·r‚ýhuQB¾DƒÖ‚Òð2kaü‰f0“‰V\»RLvÉ!âsÄ<FR :Z›Ú ãë×’]~2èR¾V«•Lw¹Ýé©×ÖÈ„ÇÄ@SyŸ6Nn¤»²µÝÜ©¤ ±jÕd’ʽyŸmuÐûn;UÔ_IìVä(.„†W| ãƒ9¹â…ˆûŠ7evT<›x¾xìÕp*×¼Û\RB—NYP»…ñjï0'ïtCĽö)³C»Mlzb¥ß+X`8¼æ[¿`ƒ9]p€xdÒu’®ëÔ]xJÍûO,–fŽ±ýÄ%F<œŽròà ôÍ„Ö14«ê<é¨ó¼tïQ»zxuJWŠs†{žã÷Ç`žnNBŒ}s2¥t6'6çÿkÍ0…þ€… µ…ñ«7˜ÔõJ·z‹ó¸5S'&OÔ¾>|iÚª•…[%E+kùCcÖ¹JíåuïßÉcˆ‚°pm·0~» 滌ƒ]J·]§½3|:I +Š0 ×÷âÕl '/åÖ¾€LhÄb}æ:Îs”±â‰·v$ðÒNAžñÎÎËj½²Ñ:ßØõ¬Á¼ÛfAf8{øÓožédúE‘QTPO À!™sÁL,2ò\LÃå´ãéq¼ÿîs¾:endstream +endobj +1791 0 obj << +/Type /Page +/Contents 1792 0 R +/Resources 1790 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1797 0 R +>> endobj +1793 0 obj << +/D [1791 0 R /XYZ 85.039 781.388 null] >> endobj 638 0 obj << -/D [1723 0 R /XYZ 85.039 466.842 null] +/D [1791 0 R /XYZ 85.039 761.463 null] >> endobj -1728 0 obj << -/D [1723 0 R /XYZ 85.039 446.251 null] +1794 0 obj << +/D [1791 0 R /XYZ 85.039 741.134 null] >> endobj 642 0 obj << -/D [1723 0 R /XYZ 85.039 376.993 null] +/D [1791 0 R /XYZ 85.039 631.228 null] >> endobj -1729 0 obj << -/D [1723 0 R /XYZ 85.039 356.398 null] +1795 0 obj << +/D [1791 0 R /XYZ 85.039 597.084 null] >> endobj 646 0 obj << -/D [1723 0 R /XYZ 85.039 177.675 null] +/D [1791 0 R /XYZ 85.039 255.771 null] >> endobj -1730 0 obj << -/D [1723 0 R /XYZ 85.039 154.959 null] +1796 0 obj << +/D [1791 0 R /XYZ 85.039 219.506 null] >> endobj -1722 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R /F14 969 0 R >> +1790 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F35 948 0 R /F42 967 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1733 0 obj << -/Length 2317 +1800 0 obj << +/Length 1841 /Filter /FlateDecode >> stream -xÚ½ZMsÛ8½ûWè¶ÔÖ - €ø 粕I<OÕ8YY›K’#Ñ–ªdÉiÇ™_?/ P‰U[©”)ò±û¡Ñh<$ ÿÈ$ã§ùDf¥Y6YÞ_àÉ<ùý‚XÄÌBfæ×ÅÅ¿ð£ç“Åmk‡#ÆÓÉbõ1yýöÕûÅå|:KÓ4ät&e–\/Ì7ïþ|uum®çï_ÿãfúyñÇÅå¢ñÛX¹rúõâãgbÉ-üÞLÕëMe®6@ʤü—A)Ê«r7¥YRoÔ+ß7ÊÐyZ¯QuýõÑ98|7¶Šƒ»óËqs (ãÙDâ‰@{fæšþé7Ø‚Tƒ¯µÓÚtɺ^Sˆú¡4q¹{¼ï1Ê!Ñegd1=F. ˜!.;„ð3¾ …@äaÁã!ð@á8ÐpÊÃSy0íÿ½´Éyµ»Ýó¢„ ™Ê(/‡éñê‚b”Ѭà ?È}…!^°D‚rÎ;1*b´¦R˜±z­£`[~c3Bß3QÊ -GÍZ’k1š^:4,ˆBrè.Ú×Úû/S¨V,©Ö0^8Õl˜L¶åS¹U—")v+s¯ú¶©—ksýTlí€S¿Ô0Ý™Kmt]šWÁ"`ªõg¿«,ºãèÁbÀÂã}ñeûݼY¯íóª¸oý•u²ÞWº†A fD•Ú\·i£Hð̾ ÖxøúXV5Òïظø/v‚‘'ËÍm¥_-(ªŸkcìæ¸ÒÆ–õfo]q¸KÌ¥"Z(3ª \&_tË̳ý­¹·U¡ºßÔÚÌÊ<+ªJÝ­jýònÙ¼&“µ:º(”˜ "D<;ZLxó&4ƺɋlúÎKÁžeˆÒtˆ%(#¹´0ËÑxáÄ0ŽÐ´ ESO~ï®Þü³WÞ Ós’M<‹}·ÓsÛÒ8”¸ôÝšIj¿1Si§1•õÞ\W¶æ)€{¾ƒ¹XÝþN™@=æ (‹S ŠÄÉ‚áÿ]_Ý,æ´ç¤å4îÔbzN»Q’*wÒŽÓÊLÇý„šžÂ”%Ò‘¦· HÓ-H7ý -ÒXßEö±çd•€Nº¶˜žë^š¸ã»þ mΕ悺°Zé"ygné4¿wÍ< ?TAÝ)ÔRÝÄme‹_N¡>ñh6S¨/Sš'ßk )¶ð|s·Ó’0P°U½Î±­ˆ91‰YëS×%ÿùÍŸ`âW]'¡ëho]'Íô¹.‹Uy@Á„ðs1"§‡2Së¶ÀœÔ¢EaA'Uû¨[WíÝV{ßípµ7•žº%ÉÛWóËže`!£>§øŠ -§^oÎœ­8wÊ2$a¤úܯ®S¬ßõØIè„”‡µ5ÂÔ3t}‡]o¤TÂÏCËÚ£•Ch³­×‹y0±%h~"G»EÛ‚”Û·j˜ $áôõÝŽÅC GÃY!Çi—œJ!5îzÜ2Šåçàf-pSýéùL ’C©cg!e-‚Å%g]RéCIŽ2XºÇÒÇazVµÊeÇŸ7Kmvz_ÅT&;û§4Áæ†ÝH9lÚ½˜Pšó ¥"IóIs :}"‹¹n&²#×Ùçú¡Ù ºmö‰¦jKfew¯îÏzu¦&ºG}¡£¶-wwõº•øøž}Â$U¯˜¿æ‘Gêå" ,—ƒD”ñmA‰.ÍA›¥GK6ê–lU³ã§Wß2T"–Ò—®Ýæ*1ãt æô\hlFR¡ëw8Z¿?*é@V#FI¼í(Üx:¹õQ×®ùÇ®Ûï»þYI—Ê ÊÓX ZP$t’¤‹ºu’îØí ¤óݾLÒyî^.é¢Ü¤ó¹Iº³°s’.ÎÎJ:Ÿ]PÒ…–“t#´Œ¤óiE$]*8JéHuó@‘Ķ “$gñ¥’.NÎJ:ŸÜ˜¤;7'éâܬ¤ó¹%ÝH9I'e%O*"ébéÓHºc‡C’Î÷’tJìÕ&ÐÖr­VNϬŒÖÛÜz;ê€ÌZ2‡iêÄÅœ´© ÀÖ½=“S†÷»Ù_fïrïŒI–Û!£¨eýx°ûþ`ÃJÌ™#­hm–EÝžùYJnƒkiUY/ Nò¨Fò0á3™:»êd5:“éQyçWCÇTŽ¤µ%ÙbÂ'34W9 ‡#ÜQ —¦£üóöt~<éé[ <é@d ]4#ˆÇcßB‘J‡¢{FO;Q "C˜‘—ªR -Ë1štÂN¹g/¼S~ìtp§Üwú£;åòl”·˜Hà ædEóëé‘ßA=êù ÈQHz õpJ"‘ñU”‡‰„3â(MlE14-g/ÍW’J¤#:ÃNî7Ïj¸ãŽ]öœïúgºÎ5”‰p6’Â( :i5uëVÇnW¾ÛñÕÄå|JI>\Âu_I€ŽSŸy~^![[ñFPЄ™ºã5"¸¬%—AbŸ…µ5ÂT!:잘õ­U:rêä"©dAZ¿_Î?\ö× \jÉí™ûiñn,0f¸ùÌÂâ=Ó’û ܬ¥n ¦©ç/ÐMÞ ]Z:Ù`z»yB*…2í;š9õ)©Ó¹F1·rYPf7ý©Ü축kÈÖC#˜§Íwl;-ÇõYì_ͬ¾:ÊùÿW2C¥ ü7ߺ¼è³Çvk2EY7œJ$$³\T«yoZ‚x »Ç÷oøLùëendstream +xÚ­YÛrÛ6}×Wè­T§BâF䥓kãL㤖š—$ŠE[šÊ’#Ò‰Ó¯ïâF‚ÀníÉdË=‹Åâ$S ÿÈ´àS5•A´(¦çW<½„‘ß'ÄYÌÉ<°y¶œüúŠË)ÁHa5]^´~8bœN—ëÙó×Oß/_žÍæ”Ò ,gs)‹ìti;^¼{ûôäÔ¶ÏÞ?ÿi1û¼|3y¹lp€¡4è×ÉÇÏxº‚o&QUL¿C#ÃW@EœQ÷÷n²˜üÙ¸²cljŸ›#ã Ó9Ũ(بTˆ~9F³&9‰ƒ³ÑqøëdF2˜)É–DôgIrŽÓÀéØÛ  %ˆt€ÿx›ãúð÷,/²r /e ž^øÖ¦™0CÆ9DÇ.¨±´èyM²km ;:²'9”^®ìjƒýd»gÕö +7\˜¤Ù®üVît3ÏV{m·¶ýÕ÷m}¾±ío+=°ƒ Þ¸§`cšßzc:LçYY]kχ}åÌ:H×öJïÝ«Õ—ÝŽ @„âå«üÆ=xoº>ì-œ~q™}Ù™:4`òõ¦¬jäMr‰°ƒq•o/*C}u£úV//²O˜cgçõö°·z‰m^]|¸Ì¾¸Yê±Ã…íÛi¶WÛÚ¸YÛ±UUéÞª6ïÏ›Çd¶±{ÇDErƒIƒÉÔhM¢Û—1‰¸TݼE.sÏJ¹¦õÈø™¯G`§R°$y²Æ0@e,]c¼&iŽ¼w'/~”¢ÌI8–g3@í–ФjO¦ÃÖžF¥;»tbÔÛ®\µ3‚ÀïM +“ì7“+ãe˜Nû"¢À&"ocDÑéÉby–D)RR%!½Í³'‡b”v@+{™7(g*=ïÖ&>ogÓƒÅÇ¡¤Fa§€½Í¹—*@ ‡ÐŸ†Y­µji… +T­ƒ)—怎=¸=7µÌ¤ÕÚɘª>† +‡Í¿èXþ€žÚY¬vÛËFL­­;(Ìгñjªñµ::ÖG_ic³3Ó¶¹»‹ÍT8æ4=÷Ö&>wgsÿ¹'€Û¹÷ÇæWß5¨>~êóY.}þ|›qYfõôxrÉàLI çÀ&os¯šžmjzu¤¦‡ ã5Ý×óÅë§g/ûtrx5ã’†tÒ/Îårüµyî}¥içDB­â'§¯4åwvp«œ=;çëv v“’vƒƒ.çQ,‡–óu-^MÒz¾<‹%4( ‚§_„›xB;¶x­·×HéFr‚Þ 1 +ï)̀إ¢ÃM§Þnj:¶< jÎÓÔôµP€7š> endobj -1734 0 obj << -/D [1732 0 R /XYZ 85.039 781.388 null] +1801 0 obj << +/D [1799 0 R /XYZ 85.039 781.388 null] >> endobj 650 0 obj << -/D [1732 0 R /XYZ 85.039 761.463 null] +/D [1799 0 R /XYZ 85.039 734.065 null] >> endobj -1735 0 obj << -/D [1732 0 R /XYZ 85.039 736.911 null] +1802 0 obj << +/D [1799 0 R /XYZ 85.039 688.99 null] >> endobj 654 0 obj << -/D [1732 0 R /XYZ 85.039 680.8 null] +/D [1799 0 R /XYZ 85.039 592.231 null] >> endobj -1736 0 obj << -/D [1732 0 R /XYZ 85.039 659.806 null] +1803 0 obj << +/D [1799 0 R /XYZ 85.039 557.688 null] >> endobj 658 0 obj << -/D [1732 0 R /XYZ 85.039 601.166 null] +/D [1799 0 R /XYZ 85.039 471.95 null] >> endobj -1737 0 obj << -/D [1732 0 R /XYZ 85.039 581.178 null] +1804 0 obj << +/D [1799 0 R /XYZ 85.039 438.412 null] >> endobj 662 0 obj << -/D [1732 0 R /XYZ 85.039 440.375 null] +/D [1799 0 R /XYZ 85.039 202.765 null] >> endobj -1738 0 obj << -/D [1732 0 R /XYZ 85.039 420.387 null] +1805 0 obj << +/D [1799 0 R /XYZ 85.039 169.227 null] +>> endobj +1798 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1808 0 obj << +/Length 1978 +/Filter /FlateDecode +>> +stream +xÚ½YKsÛ6¾ëWèЙR %^Ù™ÛmݸNj«é!õ•h[‰THÊ÷×wER$àNÚéd>ðûí »€è4„tKòdªbJxO—ÛI8}€‘'Ô"æ2ï`Þ,&ßþ Õ”†$ “éâ¾G!ùt±úœýtú~qq3›sÎ@ÎæJÅÁõ¼8÷Ëéåµ¹¿yöõíìnñóäbq{˜d$(ôóäã]8]ÁŸ'!áI<}†ûPÞN@*‘‚ÛçÍävòëa*3&¦æ«1%‰ŒùPI*G””!‘¡ÐJ–Y½/g4È&!^D07Oë|CëeZg³9 *ó¶Âû= ,ñfi†*—ú\Θß1-Fsf0JI"e—s¨H̤æ +Eä³Ù\Ê0¸FY ä"ÜfåSVšû55=—ù}áâhçörl1š#±k¤8‰bª9^µ¦õÝl.dl²§lD¤ +ÖhFõcfnªt Ê؇§t³Ï 0µÀu~ôA9“ ð’Ÿ÷YU‡Z‘ŒWÊ«Vs0ý@-N‰èžPcú›L3p` a*XH31sA&F*ˆ–€LáRz)6$ùÛõåíâ†s¢œ“DµÐ1‘ f ³—E”'DpÞZéP+Ÿf,tøAžäé6;fa•’‘"L*¿Þ-Æ­·Åh½/Á3:|¨=“$‘WpƒH>ÒžÚ\=£Ð5H¯—3¦‚G£>„¼¶n"%#¡Þí`Üv`G*: +RÖi;`Eƒ"¯2ÆH쌭"V$áÔ˶Áüc¯u&u{íXòˆ×º‚¿ÄkVI…$†ðڡŸí`1HçÃŒ‡Á»Ëóo6 ‰±GhƒHíÛ,E{B!&@óXP¹nò¶.Ìõj?¥4øpFº9æÅÄÌÓé/ðÖÂñò>oæòóg V§0êipyýr7`'¡€ö]õåìì\¯°“V„¸ÇŽ†ÔB°Ò*þJ*µwY J}¸¸æPB`eèLöš!¢q3؉ü´°‚ð¨G ]„±= A§&ÙÁÌÎô +µV¯Ž<‡ƒhÌz°Ñ|³˜À~¾Å1¡ê «“~4¸·I÷G(Ã"ß¼˜§ûÏU¶²À{Û€šI`¨]«ÆæÚÕ³v 2m^ bŽŸü••ˆÓBô\ áž@¿žü/Í1‡õ˜+ÿ®¥ƒ9øúXíÚ,€.„ÄÉ¡ü)S÷ÎŒö4xÙÕÅC™î×KÓc=\¯2óPÜ›«ÞØÀõ¼Ø¦ºå„¦ùTkg^7Õô]ƒ  +ÁF…†£íEˆ&&qÈýÚ +Fx(¼[N‘m±ØÛ~ô\÷Ü„TäëÙB½wQµ³øʽ"¡Þ5ŠÁîNJ¹o0È÷tµBŠåÀN›—ž4w¬‰Æ^> +IÑÎ2š3 ÓÏGXÇØ¿ËçÒ–¾‰Þ?ñé½(uö•Mþ¥+ñÚÿúEarY”¥ÙÂ@°cQf+Žf6Ñm‡•òŒÝ‡estݦ\Z–©þÀ¦×)5TOoß1G‘a¸™÷:°Å¸h1h° 뺷'ç£Þb”(¨Ñ>Ñ f û¨[QöžðsìDnÖgoŒ)²|Y¾ìР¿ÄC¯ò`•Ö©=Â0—}µÎÌ­ ƒOz‘µ+ò[—­YäÜVlÝbܶ¶Twƒûâ‹çó=š}Üàv^ñ2dn ½}WþUjí¹mnÓêÑa¨ËÐÿD^t0N4$ׯjË%4]>á f }n1e=ñæ¨KÀÖ€êÃ8•WŒPû•o1nå-¥¿ÿ} m(z¨Qm-f ®¯m[øDôämWͼMívVº|°W¤ +¦ã.…/î«›¹^¡ª þG´Gu—V•]6qEÖ‘1—Tßo®[ti•6UºÚowf諾‚$5ÊpŽ¦ýó +{=ÝÎH +õÎz}×ËþWíÒë¹i­"p.V'Š§˜¦³ª×é›óæÊÕÉÖç¾-4|yoìõäËBšUÖõš.ø†6®ˆ… ±£šöqÇ«èÊ~s¦ ¿År~õ þ;9?¹2UʺhK°cŠ™J9ærÔgCÄUŸ í %Û²ë©hk[DSš±M–?`mO®lÉ}^×öM§8(ý›àÐ]@óØÆáH]A™ß'-Æí‹AC<}Üb{Hrt zf3ê °\{Vƒ3 pt΢ôñ{—ÃÝÑÎàÏêp.Ý1Ö“¹`Œ—ÅÖس×+¶v°9¦ÈOìDz»ÞM7hxët¹éÛ2“WÿZ§þ¥›æÒ¤SVõg×Ðœ 9‡+õ·Y-Äé6 Ñ¿¼@Ëiri¼Éâ1wøä6cÁ}g Þåßkï>*BŒº;i_†„Dw:µË‹i€Ñ„Ž¯¦1P(3­6.|ŽCá0êï Zˆû(Ô@P™Åz›¹;¬IÔ'´KªéƒåV¬k"—z#]Z#؃¶õÖuËaºd|i«È¿úAí°ß„ˆy2®š„–(RÂrAÍ¢ä˜nó»Û€ïß°Ê,Íendstream +endobj +1807 0 obj << +/Type /Page +/Contents 1808 0 R +/Resources 1806 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1797 0 R +>> endobj +1809 0 obj << +/D [1807 0 R /XYZ 85.039 781.388 null] >> endobj 666 0 obj << -/D [1732 0 R /XYZ 85.039 333.519 null] +/D [1807 0 R /XYZ 85.039 735.322 null] >> endobj -1739 0 obj << -/D [1732 0 R /XYZ 85.039 312.526 null] +1810 0 obj << +/D [1807 0 R /XYZ 85.039 700.779 null] >> endobj 670 0 obj << -/D [1732 0 R /XYZ 85.039 281.59 null] +/D [1807 0 R /XYZ 85.039 656.377 null] >> endobj -1740 0 obj << -/D [1732 0 R /XYZ 85.039 260.996 null] +1811 0 obj << +/D [1807 0 R /XYZ 85.039 622.233 null] >> endobj 674 0 obj << -/D [1732 0 R /XYZ 85.039 217.765 null] +/D [1807 0 R /XYZ 85.039 552.074 null] >> endobj -1741 0 obj << -/D [1732 0 R /XYZ 85.039 195.049 null] +1812 0 obj << +/D [1807 0 R /XYZ 85.039 515.809 null] +>> endobj +678 0 obj << +/D [1807 0 R /XYZ 85.039 387.378 null] +>> endobj +1813 0 obj << +/D [1807 0 R /XYZ 85.039 342.304 null] +>> endobj +682 0 obj << +/D [1807 0 R /XYZ 85.039 342.304 null] +>> endobj +1814 0 obj << +/D [1807 0 R /XYZ 85.039 310.551 null] >> endobj -1731 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> +1806 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F20 937 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1744 0 obj << -/Length 2243 +1817 0 obj << +/Length 1244 /Filter /FlateDecode >> stream -xÚµYYoã8~÷¯ðÃ`[ÆØ\‘ºè2NæJ¶'ë¸1™„Ñ"Ú^ųä‚0-ÅIÂt=¡Û®&Võ^ÓP…é1³¥d„úJù†(!œ.Tºð(„0>}¢¯–%“a|‚C©7¾QÒ7öP èØY6TÑ=êo÷ŠÄoí­(Ç oõM}T1Ò1ÄoGr\§h!ƒ‡|³wbˆ>† •ÓQ:â‰q(|Ö¬j‹¨€>䱶åTfÁ^ÿ\Э5R¦î‰hâàj"•«6kû3ÿÝ ü·¼^Þ-T~ÕÆê*Á¨‚¦ðÔ4=<ÝÓ±¸qÏð öÖȳ퓙PÊàå;´^uY•Fì@韒t®éCs¾‘%ù®ÚSû.¦¹·´¡Ô¡ -T¸m¯Œ¬>*ˆ÷Q‡ÅLX¼sX@{#¦s ž›6]‹hÜt5òûúx@G`9ÚÍ— gž€ ÓÆ izÎ2Í ët0<ŽLËÇ?dRaÛ&½™ÂøJSÏXšÓI»Ö¨¤ÑQBQß|‰_0@]0hÏ£ÙWªø’˜ºÚŽÐúOS’Ÿ%z÷zÛæ`{ÔR®Ë\Ï¿`©Ñ„¥4‘º–ILN6\¹p„ÛÈ$sMÓcÞ5‘q7°;Ì›bðÑcÌÃsâ=-Oƒ&cî“rû&©¨FÅómp¬”.!¿†ô‰@ž„ -v ‹cº„û%Á]žˆ&t©‰PœmzH4øá*¢¸kO3×4=ægu†«bX›¹=T{FGºbBˆ¢”£z|î\:b Í„VˆF°íº–}mÀªé°2ˆäœeWP˜Y®ßféã]Êi©{êР·¦:bª¢)u†lüôkyËz9&ç0ë†Ü:T ÅF%ýåF~\¬lî -·uyÃ^”¥1ˆ5å3Å]ÝÊKb]³-“:…·`ÃÉ»¯CÝ 5ÒôóA‹füùÀ[®×y>ô|p_*r¸E6†C/ŸÄq¢Q8,wà(Ùž !]?a­¾ƒë›#@ÙÉ_k°Ær©œgv²ÝÃê»5‘ѱÃi¸ »I£çþA½añäˆVÂŽL¤Ti;/xwÃÆ­¤ï'ú¨8uÿÛcÀwtØ‚® -ZË«XEU8üky^A5p\‚óQ‹u¶o³!ÛK[‚žôqEÏOiVÉr3¨”še£.i*㤬p¦Á5ìœsf„‚þ±ÇGŽó‘m>ç€Z<™é“…Å -ÌçÆŸUÈê~}Ð6„ׯwíAŠiËÕ(fÍ[ý®—eD;PÀhXUISØW4¦o¹Å&ú0æ>›èÛíeG}€Ÿ”÷hs°÷CRÁºËm´ ˈn;Cˆ·äEàÂF%Ø”^Uccv1 (¨ßŽ­è»f#õ„Ø--må¨'#Ó¸nå à~¤UþÝh3!Ò‰ÛEÈĸéß -P_t¥ÛÀuâ ýŽ / ®£bÔo½4z_“ɽªz]¯v_Ίý áPÌ! -Ðh‚L6Ê™Òø,ÞÁ]5Ó‹èÒêêÊ䨖¨'5ÊÑh¥a¿È*<½ªÖ¥ŽzD­ñ kR›ñ)º:ª÷vTçÌO?'Õ]±+ò‡ð ¾µ›~tTî.óJûê½BÁÝv2^Ò¸w{ÉH=J¾2À)þúI®©É 0ñ­‘k‡#<¸ºÙ ê˱Îá:–¯~ êáý/löšendstream +xÚµWßs£6~÷_ÁSƒç°*dàfz3©“¶¹ëå|6™>¤y ˜84üÈ!¹žü÷Ý•Æ6$™éu2Äjµûiµß‡Ì, +Ì +8¡nhù#nXI1¢Öf~1ã11.“ŽÏÏÑèÇ_¸o1JBZÑý>'w­h}kÏ;_D—ËñÄu]<ÇßìëH.¾|>¿ºÖãåb~¶ßEG—Q›·9BLúmt{G­5ü8¢Ä kcJL#ÈJ¸çš÷|´}mCé9ÏÒ«úöèñ²ÖÄ¥$¼^?$<àðä”pêµu˜Òž:U‡Ä3{.Ž7ȘKfß¾œÏIRÆ;I ½ƒ¬.í_ãi`?Ëß<;ɳ´D‹Ô³q¹Ö‘Öÿ ü˜]k[‚†‡8Ͻ²—0ب‘Ðá–‰³ïÇÏã}ù08çÙ>@75X›ì8Ù ¨;Këfåú0FŒs1Ô2®K{¥™÷>í!2rÞ=Dêß›ªrB±}Y§ã çÔ^Ô•¬(³“*‚a–¿cï£`¸³Ó^šÍ(¡^¨{iòa¦Ü^¦ßæp8Î<Áôu°ɵÛjòa®ÝtÛá4÷ f:ŠžûA?LÀ¤*ž¶xpø"R!²ªÔ/é³|úù“~\þI9]üqÂøÓ¼RBfwÎùzïÐüsÖüÀáÎ{³¥ä ü¼NUˆO6Ù]ŠåGå8ßʇ´”YËÔYöÖ¤É"³( Ž¶Ç8!q¦…5„ëÛÉ!,EÏt³ëN"1œHtÑâz(¾ŠûNmRûï +YRfŠµhb6”HNU|Š•S3­Y†ãæbà]’ FÕ“Ä&A.æÏÚK©O`–&nÕÄT‚RnLŒ.Ž§6ºÇJÄݪzm–fÐ ¾ì)lRi´uµ—.•P©UJ¢´¡V³÷ඨYÁT¡ÅçŒO1P ci¦3©Ÿ­"¡¿ÈuSptBé4›LmN¢¢=ëI¡ÖH –¬Üø>rØf„‡€Îè²C,V z^¥ %ÉÖl ª(TÈÇ\%9­L|/Û‚¨*Ç5nC!#º±¨i¬ÙAÃF‡4²"Å.ípg™œ ql™¼‹^%ó +¾i½fì V©„egN”8qx:ªŒï0š¼¨v÷h¬¡U@Ã̪Ò9_×…ôÝ ¹OÙÛnú…]wŠ‰Á2¾¨^Ã¥/î¨Ôò­ŠôžöéúÏs@p1æ°†éV»Ñܨ1‚ïÚ7Ðâa°g•2Š†¢aî0·0k2ñ"›ÂP3lHj“•ú­±6ꇞ‡&ßÆ]+j+e̺ˆç:È:–±‰­–;ýFÛ…Œ•töpT_É@`ªB'‡ËPUd «ë½þ÷ÒÔÿŸizr¹NåïÕ¦*Wq¡ž Moz‰ÊfN) W +›u?¸ýKZzw—|_B/l$ÄômËäAåC%Ì )3—£ÕùçW½è»YçêÖùü÷Ê’*|·ê¬¼¯p:ÇC0¸¤Îž¤ssuᬮ.„“Êä%|Û=Ä P Ü€áÇÔ4ì»ÿ¿ðŸ~Öµ·hèþÀ ûñ©Of¾g°à†}z —»ü´sOñþ 9ѧ‘endstream endobj -1743 0 obj << +1816 0 obj << /Type /Page -/Contents 1744 0 R -/Resources 1742 0 R +/Contents 1817 0 R +/Resources 1815 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1711 0 R ->> endobj -1745 0 obj << -/D [1743 0 R /XYZ 85.039 781.388 null] ->> endobj -678 0 obj << -/D [1743 0 R /XYZ 85.039 761.463 null] ->> endobj -1746 0 obj << -/D [1743 0 R /XYZ 85.039 736.911 null] ->> endobj -682 0 obj << -/D [1743 0 R /XYZ 85.039 736.911 null] +/Parent 1797 0 R >> endobj -1747 0 obj << -/D [1743 0 R /XYZ 85.039 718.708 null] +1818 0 obj << +/D [1816 0 R /XYZ 85.039 781.388 null] >> endobj 686 0 obj << -/D [1743 0 R /XYZ 85.039 522.193 null] +/D [1816 0 R /XYZ 85.039 733.118 null] >> endobj -1748 0 obj << -/D [1743 0 R /XYZ 85.039 503.321 null] +1819 0 obj << +/D [1816 0 R /XYZ 85.039 700.697 null] >> endobj -1742 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> +1815 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1751 0 obj << -/Length 2622 +1822 0 obj << +/Length 2070 /Filter /FlateDecode >> stream -xÚ¥Z[sÛ6~÷¯Ð[¨6¯éÎxí^Ü&vÖR&mŠŽ¸–H‡¢ìúßï¹¼“j§ÉÄœïÜèÈ… å"ô„­¢EJ¡Âp‘.ìÅXùéBjŠ•&Yµhþ³¹ø×>¬Ú"²£Åæ¡9Ç®§›íoÖÕÏ—6?Ü/WJ) (—« ­Û O\ß½¿¼¹åñý‡«7ëå›_.~ØÔ|ëG„L¿^üö‡½ØÀ_.l¡¢pñc[HX>\Wá¹J¿ï/Öÿ­â5wÁ»ÆdôT(¼P …T~KH)¡¤³<[x¶KR®¿[®<dzâã1-«ßmϾOÞðÔ÷ßóóªL·¸ðëñí}òí&±ÄýO0|)Êí‘q•ìxXíŠcÊÃ,ççúò=ZV%Œ:ˆ6úb“RäÒÞå*á«€w­þ}5€ÛGþ­4Øßžu–?¸¼/¾Ö1)³§êíÇ›ë·ë›ëãÛ´J&`^ wœÔ›öPÌ{Ÿt¤—dÂç@'µýÙhhÑ£8°*EäymGñá0p£@,¥¥g[WÅáo)èMZÕq -‰>`ICCH¤7â²¾íˆÐçÀ¼žNà[¿ÛÒ-¾ÖÿL‘åà^ÒúÂSÕ.åÁ¶8Ä™ÞTO¢CJëxÄŸY¡W—NhÑÂ+O$8.Npè~Ëû>ãÃÒ‡ðòá *Ú·å}Ÿñ W&Šs~£½¡µ‡aFì+ž”®f¹†ˆ‡î@•cƒ¼G9¼+ås€Å ñ)™.>2M›þ'KaGÌR¦ÃØÅ#ôî-Ï"‰9!æ©Üšî÷üöˆ¼ fKøWJFÖóÒƒ¸@ùN)¤M×µ­¤ƒ*Ûá÷à eF%)p¹2EÝ<²@Që[¹‘•ULó’4¡IH¤”߉%%kã“áq• ÿªI ~¦yR¾>¡iùr?ìŽQê-Ͻ{ÏŠ\ó!ÅÚü8ñ€zÀä,UF> q#òRÅSÐLjƒevY‚§îð [¦<øb–¦ÞDéWTAÆðÁÚ¿œƒ†h(]—¹A -;0'fdWCvÔ²%›HÙéCQjCÚ’C g-ºC§‚ìc‚Iƒƒ)O[9 +‡hå-“ƼÌ&MŠ|Ëï”&`ÓãÜŽÔÿ¬c׌¿ ’iž´kƒÞµá¤Úø¤ôÏ'†Ç@¶ Gß—Ö]ÇI™§M)·qxçé  D˜%¿…'Á©Ô+qÅÏj—iŸA®¤™$;þ*ðÄ­nÛF·äюÒÓÈàø`¥:砶ʭ„4MÔ•ppéé)ŽÌäT–ƒ†cO­14Ÿ* µÁ!Gc:#/‚q½ç9«&¥P¼¸™F‚OyomL1羕nu -«ºaÒ;Ùé`ðˆÙ™“n®—4É}º«Ì”mœÁ|2UÑèÛ ³Oåc'ð…º³I¯E3ýÕšsakCb>FHNÊŸ– -.¦˜­ö+øñ²Áɉy­E§Ï-6§‚ià^(lv€²µãBºð£.p¡¡ÌÑJÏXxÑN?pê—¥’Mnä’Í7’í\Ñ1ܧ‚ ¥‹NXHÚ¾½h@zg$ÕDtÑ;ÕعPbªì'Ï>Dmëð!M3@Ðvßíw¬Wresœk±;Ðâ½!š]!ãOh%rÁÚ»>k<âg–µ¦°îÊ Ag»Î(²œYFJa0/r‹hZdC„ŒßÑW+ïíóU¡`ž¯¦ðíÊëbQ -;|Q`çŒÀ¡-ž¸!šXÑõ2…›#Ù˜#ñŽÃ2Õ¯—=HŽí' -f!š¤Ž.É¿iCB]¨3ºð}á‡çtÑÍèBê⧲8=i=Œ(Á6¤ö9,†f€¥«;šö6–F rR ž‚ö!:£„†hF šè¯8Ä:-Ÿkç*.?’³Ø Í[W)®ÑÑÅÖ(Å™T -¶KçtRǪ́„iιŚ Þó|¸(O¸g°’>¶žJ\hYÚÐ…¨I…8>dWyF# ÑŒJ4‘é˜n‹|uʳ¯§´-;–ð±_¾a(H —<†f€g.†K *Âè$Ü’mwþ·l-šiDp¿×ÿ8ÜÿÐ…Û›n¨Ðšú®‡Ó§ŸëoÔ¼%%|WÍË¡i¨»Ñ°/é[íØÍ3ú¥Œ^^DÂüEÃfE“ô¡tk`ŠÀÚPЄޔûG£3­]C3-º¦A~×Y¼‡0´5cŽ;ËP“ôöšEí^‹! 8žÒ͇(‚Ñx¯o+ÿè?J4ßàþ?•w=²sàj,ˆÛ–ùÿ¼ÿsÑendstream +xÚ¥XKsÛF¾ëWð01° ž©ÚƒVN6ÎÚ’—dʇ$ˆ„$¬H€@3þ÷Û¯$H×ÖÚUâܾ»çñâãÝwËùŸ«_o~ZY¹–#ÈÈPèç›ßÿôgøëïé,aì{ +¶w7 Õ‹B-óíÍòæß–ï…3>5¥c¤S/Jõ¹’:žP2ò½ÈYÉçnDÎbÍ¿矻¦ØüáGþ¿Ú7‹õ«õ +fê’Šòâìºí- ¡ +`SyY PÅYª³érâÍ•£Mä;wõn³¢š»ÊéÚ 0 ƒk84DEçæ‰cßóÃŒ€<€ÈÐWξ +›¶ÃIàü§.MUVð÷™—º—‚›z——•YDÐ8ÖN[ ö¶-kÙ|©S|åÉ7ëo7¼ò8wƒÄ)†Û»=tÄhð‘‰ðÈ+žÀŸºêokK†+F ÊZTDÀ°`/Wa¸±ª¢CŽÇ9 ©8ý +!’·üKŠã`‡"ò5¿”"_±³‡aNò۞ɆϼÈÒå¼t$³ ùv‹+¡óZÕ„ b‚/óˆ·– HË0TÎo¤}WÊ¡o«à°1¬Øæ5üv…€,;A¼Õ„è\­2jÙúcã®õ8‘aÍC¢ChäfDóu2• É« /¼ÿÀ¿u%"ɦ¹„î<,+”Ò[¦¬Ÿ˜`Ÿ·ä²tÝlzÄGôG¹FŽ/L›7"‰û6C Dd€âó¡¿ì‡Ý¢}çV‚Ò 2Ÿí„ÒìøRó`[?·8R’¸bƒ_9Oh'DûäUìrAIgÈ}¸ü’ £ƒBx6\Œ{9Ÿbx뺒å½I$ü!¶¼E‘‹¾p¼ž…I~@H +OžV‰ä3†ó‰ q[‚ã/ØÝ3æVÒŸzÏÃóéKHCáèûŽ+ƒæÈ|G,xmädbZ¶×QQ.Pûè÷Ƕ;7ŽÔ*²„oªA#¡ χF‡”÷éaQü†©¤6.4EGêVèFÜéã geõÄ9†´íÁ„5na˜à*DU?X"Ϭ›ËU÷› ¦ÒÕÔXú1ñEê>ï —Jä.ß½†ßç{k¤"o¾çÕ®fºG^?ÏŸ=&}Í•}Í…Æ^¡…¼2“‚+¤¸ûÈ.…™ãµ=즌¾â“`•¢ùb ²‘1Ì +\àæ’ïö­`ÝïûôËÍ©Ú(%[Ⱦ|®j[}9¦/‰¥ R;“ŠÉY¢céoEejY¬©À™Ea +á¡Á¸=ô6´%±Í¥³–1—"d€ëÀ2ß½çˆÁYS|¶M¨íx툓q^ïøsDñKhQq‡©`>˜†-bŸÈFÞyØüRÛÖ\œ¹ íÔµlç®Ü‹‹6ƒÉc†Î(Kg¬›­ƒ™z”w§jkŽ–œ2Ô\ömMÔF†ÎÎ>ýÜ2MûboH8½€ÉŠÇ&³˜nÀ§î+uÃ+l7e±OŽ031mÕHÁiæþ†û· ܺ åš¾ÛЈCJ%`À+;]Ûéô±ÄÂ¥ÃÄ(Ÿ9­Uo>@½Æëfg« ¬XÏlùNfXg·¾ð€Ä;qX¢–šû¹ Ìý®˜,M5Äæ3ùƒwá· ¹þÐØIèé0¼4<¥’L™IÊo‘å;þ–’Ó3–»Yœ8‹ÁÎ42Ãñ²ÍÅŠµ—²¹¸÷p‹t\ÈRˆÅ×&#— ºTͦ¦P#‡l¢s°™´æ[¸-FÇQD7ýýû<­o™`“Zdðˆ/ÍzYXMÙ ªˆ9ˆÍÒE xuŸÚ6HªìL« |û¥ÍžŸzg»†—;`vî… ‰¼Xk+Qü Ý°kk.dJ@y¦DPð†%½ÖH¥ëyßµC¹ùî~$ûº* ½XÅdFlf¨Q%=/”ã"Ëû{w‰‚oé¡ø¢ÆÓ`<ÕžçMäß)Sÿ¯ûÁ¿ÿQ€í[näeIÊèÅbëCÓŒ{9Æ]ßœ÷k_‹oYÚQ'ö¥#Æ•–_C„Ù»ÃD~¼Vt€¤8V㮸(¶yWš +Éá)[ŸœnGOç~ !¯ýë¹? ¹ø™$ðc/Ó}UB+.MŸæðâ*è•êb'ƒ‡3,:Pž¨R\À&<'°Ap@^‡ÑUÜI^šÆ#ܧ5KAj%i2Æí òß*tÍìÎèè-[}œkÕ¢^-ŠĪö­Êk¤O~;óÂ(„”O<¥ƒIŠ$ó¢4Â4Ä¢ëz + =^9÷Š%Îì N¤Ð~ôl â †¡9Ã1ªNJkȱddé*×çt>,º)?…ke|]ýžæ²úBƒR?¡Ÿ(¾îŒ†~'ñUÁ†æLòXáj¹IF}ÕU}¡Ë†QzUݞ䢶B‚"ßãÇwÖùö\SÀ®Š4$§2Çz*ÈD$õ ®êÁ­æºW-ÅE-™‚¾7EÞ±G9ó8 ™N‡6´K?¸ÅPœ`kŸú^˜ Á òzZysOò½ ›®jÒñþ¯Ïòým®c:›ÆÁ½(NBÁ‚¸“³ïèæëýÞÿÙ¹¾òendstream endobj -1750 0 obj << +1821 0 obj << /Type /Page -/Contents 1751 0 R -/Resources 1749 0 R +/Contents 1822 0 R +/Resources 1820 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1711 0 R +/Parent 1797 0 R >> endobj -1752 0 obj << -/D [1750 0 R /XYZ 85.039 781.388 null] +1823 0 obj << +/D [1821 0 R /XYZ 85.039 781.388 null] >> endobj 690 0 obj << -/D [1750 0 R /XYZ 85.039 637.406 null] +/D [1821 0 R /XYZ 85.039 721.69 null] >> endobj -1753 0 obj << -/D [1750 0 R /XYZ 85.039 616.413 null] +1824 0 obj << +/D [1821 0 R /XYZ 85.039 687.147 null] >> endobj 694 0 obj << -/D [1750 0 R /XYZ 85.039 408.163 null] +/D [1821 0 R /XYZ 85.039 413.273 null] >> endobj -1754 0 obj << -/D [1750 0 R /XYZ 85.039 381.549 null] +1825 0 obj << +/D [1821 0 R /XYZ 85.039 370.988 null] >> endobj 698 0 obj << -/D [1750 0 R /XYZ 85.039 276.284 null] +/D [1821 0 R /XYZ 85.039 231.701 null] >> endobj -1755 0 obj << -/D [1750 0 R /XYZ 85.039 258.018 null] +1826 0 obj << +/D [1821 0 R /XYZ 85.039 199.886 null] >> endobj 702 0 obj << -/D [1750 0 R /XYZ 85.039 258.018 null] ->> endobj -1756 0 obj << -/D [1750 0 R /XYZ 85.039 237.423 null] ->> endobj -706 0 obj << -/D [1750 0 R /XYZ 85.039 108.048 null] +/D [1821 0 R /XYZ 85.039 199.886 null] >> endobj -1757 0 obj << -/D [1750 0 R /XYZ 85.039 90.181 null] +1827 0 obj << +/D [1821 0 R /XYZ 85.039 165.742 null] >> endobj -1749 0 obj << -/Font << /F60 1074 0 R /F36 955 0 R /F20 937 0 R /F15 951 0 R >> +1820 0 obj << +/Font << /F57 1075 0 R /F36 955 0 R /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1760 0 obj << -/Length 2454 +1830 0 obj << +/Length 1824 /Filter /FlateDecode >> stream -xÚÍ[ÛrÛ8}÷Wèm¥ª‹;À}ÙrìÄëYßÖVjvjv´Ž&QÅ–2ºäò÷ÛM€$(’ §­TbŠlvŸnœ4Dš(üe#«ùÈXF„µ£ûÇ#:úWÎŽ˜·È¼Iؼžýõ­†«”ä4M¯ý("•Mßÿ:>ùÇñÍôÍí$BŒÁr’cÇWSwâôúòøüÊßÞœüånòÛô§£7Ó*nåbäô£_££÷ð§#JDnG_ᘗ *QRøÏGwGÿª\¹kräîêÊQ -F W£LPb­ì´aT«,BQ¢¨¬ -ÁÃB0Ɖ`|Ta%®æ“Œ·ÁÆ_'‚ŽWøßúÓ~Æ `æBŽÿmÞ¦‚©„„rÙq—±Le„·ûÌŒÐ$Wj ûÚ(’½7ÂÀ¯g[Œz?aã­È’Á­"ÙÛ´"7SVÈÙˆ\§,zSæ‚HªR®"){# |¾ÜÎ׳ûíâ˼X+"Œˆö6­ÀÍŒ$RËFà:cÙ›1ÍáçPƵQ$coTž¯¿,îÛÙJCŒ6ñ Þ¦to|›ð›Ùê¾lu®‰ &žm`ÔŸmi„—«%†ýþ¤^í6««å¨¢³O(òLkZ—»‡wô€×ñÐŒ7pÇ|³Yàx ÛG.˜!6WQä¥M y£d‚ƒ¬n ¯KfzKf91Ê”¬6Š”Ìaà›õ -Kóí{›"”hÀ ëmZa›‘91 „0l¯íÍWç„Ó| ßÚ(’¯7*QLûë êŽ0ÈøÐČ߯gHOûÕr»FÛÕœ|˜¯ÝéÙý}Á5¼²ÜvGHbòx>¥M+Ÿ&q¤€U0oæó„B*EôÀÄRÛDÊèl0*Ö«®ÖáütÓ•<3œä0eÆ0x“} Mw(Lª†:s•ý;û¥7{É cÙW6‘ìM™}Ñ/AÞ0ãd»åâÝ[fÿçÙÚq?¬~wÆóÅö#Ξxp|Ùæ&l°øÐüqª†w<TܽßÉJ_Yà¬c”€éGÉ!ø3¼Ù®q$î‹ ­±èB §4‡¢Xhúîvy­ÅH>T’lJ_ñl„€ÅJØF6çWo‘=×-tf7fÒ ó¾Ð´Í蘯´ÛB…w÷ÛÝÚñ„‹js_í&.ÇÇîüÝqÁ$˜ÖNëÆQѸðË&l±×ó ÒX¿„{¹IŸü¡IàST`Ó?g+Ή•¬9EVMR€ág©¬˜¡psœù6H£ºÜtµÛÌ×›>¤>@imS å„K·ÞŸ­'ŠC§õy9{œÿ #ï%l®¡0>½¾Ä±8¿j-ĸ+c¶òü#+}e³®%[³F. M€×R'W†PÉÓ€ó¾Àip -gBp8ÄûÀ,ƒH‰€y_À¬„™» ìøôÒ è[ *¢F‡?]ì”ÈÜx#úŸWÆJ—VPˆ.OØ‚YVzboe‡ŸLÀ~:Æ -”–ÁÒZà•IÃàÀY?ƒK£'08 ¸’ÁqpžÁ!¸ƒ“+æ;{‡U»›v‘˜#ŸDbŒÄ¼&±ê™Ê¥aPÞøTØô/:Rå°y{‹ÿs‹ÎlóúV©ð +‡ZÛô¯:[k¡Yï9fkg͆¹Ü]×»›<è• —iày_ð ~-lðºT›ãþ*0ïk´è°Én+Ö».ÍZûÿóÂSi–wúÉWÄäò Fy"×Î"$öFO#q -x‰£ðJðb$N¬"qXIâ˜_°»h TÀ˜çéŸ8e4fø-ÔAi ³=KÅâÊW„ÄÎæiN€­¢p [Éà[ŒÀ PUü¡*éTÌ7N³°!–Šg£/ïiG@R€KFÛ‘À¦¿shmô^ç$þ\ç4C‹Ål3ïëžÊ(Q¸µM÷$4'Ʋ(¶ôœD²³~͆¹_œßµK‰ª&æ} @ƒ’Ù°ÎÝŽ$F%‚å} À‚]ˆ°Q°—Ù6ñY¢rsÀõFHü"”'boí,Â^o4ÌÞÐ*öF¡9öÀbìM«bo–go€ëÅöKœõ}ߤÕAù+Ñ°OÃßÚY„¿Þh˜¿) UüBsü €Åø›VÅß(,Ïß×Ëí˜8©Öás’ÄüåÐMŠTü­Eøë†ù›ZÅß(4ÇßXŒ¿)`UüÂòü pÝ\ãégÓ®§˜pg"€¥¯8@|A‡7¾ÜBtêK)ØPt ÐB¹—t¬v˜7X -h•À¢ÐœÀ`1¥€U , -Ë ,,êëä7‹øâû«iKfö}2ÍÀ–¾â0n xs`¯o&þ•˜=JsXì¨~6•u?öSš0}@‘áw#T¨4" œõ‹¬4Yh¥ÈâÐ -‘…À""K«Y–Yˆëî|'dúæ²ë­PT÷Ç–0ç+ŽNC”n‹kË<ÓÓHÎU§¶` -‘ø ‡—eDÚD/…Î"âòFÃâJ­WšW,&®°*qEayq¸nnÏ;-.¡EË“ +}Å‘ `¯d¼í¥.ZºSX°mä}WFä"Ñ»*³ˆ°¼Ñ°°R@«„…æ„‹ +¬JXQX^X®×КñÉ?Û¨Žë$輫88|{T‰&º—ª-Ó½h¾+t¨¯5¸’#•´jgiy£ai¥€VI+ -ÍI+“V -X•´¢°¼´B\o½çžëxbåxz}ÛA£‰…y..Û¾§„:Í®g„ðÏ-?ôÁõ{Z0ž}o7ˆ6ÒcAÀªõöš¸m¼ÿUzkendstream +xÚµYÛrÛ6}×Wð­ÒLˆâJ€}é(±ãºã8©¥LÛIóÀ*L¢‰-9ºÄÎßw—EP ÌDµ'#Ê8Äž=X,v–Qøe™Q„Š2Ó†aL¶¸ÑìŒ\Œ˜Cä’{˜§óÑÏÏ•Î%%-³ùûnE¤ÙüÝ›ñ³ß¦¯æç7“\1ä$×ÚŒ¯çög/_L/¯íóÍ«g?Í&oç¿Î织ÁF‰F?Þ¼¥Ù; øûˆQšìž)a0|7«DIá¾ßŽf£?SÙ1™Ù·†|”Ê€“å‚cä F—DŸŠEåANtp˜F‡M]íÖAÇp·Ðã‹Ízo/ÏŽÝfšmxæY ˜´˜€ +S¦ áB÷¸Ìr–‹|’³1;6ìÜÓ\I‹´&®€Ã *ðò)¬j÷uVo¾´Ï¡"æ–¬L2k1µž"œ)b´èqëáEŠ² ‚ê¤"&ªH‹ùVLÌP +6î™°q( +5„é"I®ÅìŽD¤¬G¯EÄD)JÂi™¥ÃÄEq´úUôz½Ê÷«åç}í;D¶0ʆ6‹bÓb:Áf°Y|>¨‚Œ¤¥B1ÂY‘L˜&î?/ˆ‘ª±ƒ†€¿ðÖ$WŠÚ\ "<` Ô··0–ZAØ°±Ý@8\Œg—V¡Ugbˆ*fk YO&xr1•)‰f"éL‹AgZîS¤¶ß}´Á¾vøô5XJÅaOŠÌ³.¥ÃdúK©41ÊôØàRªH(«‚“‚¥s¾‡‰{ï0hïlYÝÂ~>ö‘iÂOZl1ɾNÈ`¾ÍÆÇdnWBÅÒ¹ÝÃÄ=u˜fk´¸³1 k×ùSà:aQ°$…pè».8aLõHt®Ç’¸‚\(™I»Þaâ®; Z}ZíÐäbúc¸Ô²jÒ¬ƒfšêñï{ËÎK5–ÎÎ&êm‹A«—«]½©»å—:pVÀA“4j;«ª4¥zF;WeÌU% ç,íj‡‰»ê0U¨G–‹ÐMX YʤÉØhÒûæ +ùƒ Œøꈿ[ßU.4ëÕ®)b×X³Ü¶•lµÀ\¹n*‚Õn(d %Š§½i1;=ƒAÓwçÛ"JhxºÔ÷0q¦­j;ùl‹3\ÌÂK:IÁ"GÕ#L©…Îq•ÿ•ÿs㎧ wÞa%½«]¦É'¸ú^…Q£d„B­—bÕbZ}E y@ßãÕ)B±â¶ÏX|‘‡ƒ±B$Õé Qq¤Õæé~yÛ”ÄN˜åê°Ÿp‹-WÃ]Ì‘âcÇtŽúM¨R>Ÿ­­AúÈi¤™à»ÅôE‘‡9èÀH Ö<¤!¦0½¾Çu=ÚnJÒ4ƒ‡'î MÈÀgcº¶c ÄVÛº?1Þ1æÞ~»A l>GéãmÓQmA2(܈²æ/襁ŒSÈ>Z}ûºNˆ’Á˺ÜΔ{S 5’(ÝÙC‚Íâ…IÓ‘À±µ_ìöKÛê£^‚ƒ?ΙרîùMP½h +˯OâR;WÚ)®eÏ¡ËëçF/ÃC’C5Tž„Y;Wš™ ŠhJ}vÌEŽ‹-zÁs5›Ú?¢îÓöùÊ𸩛9!L¹†Êr[ÛÔ<¼Ù™D›2¹Ù=L4/3 ñ~>"ì‘XâþÅfÈMûm½‰Ý´’D;LCT d%Æ¡kt‰ób3QªöûUuWÿ‚†Ö­€zÞ^IÀž½/¯Ã“¶ PYfþ¡½ëæʽɆNä²if}_^ÏÎ^¸ yItQž„\;Wš‚P(Ò}r7·ÒJž†Þ¿¥ ) ¯÷ MÏ^Ø…< +É­¥ô+ü E…ÀU;}¤ð30•À˘ Íí˜0¬‰=—ó@Š)¡Ô`ö,‘åÿ¹P^0Vž(r»É‘ë@ß¹' ×EnŠÜ!r=r±È=©&r“„ÚÈõ]¼Fµfó¡àeDËoñÁË»àU‘Ì ‡ûøg#ú‡þsòý¥ FD”T@¶€òÀrAÂ:¸éTÂ@"B¾ÿx(Qàendstream endobj -1759 0 obj << +1829 0 obj << /Type /Page -/Contents 1760 0 R -/Resources 1758 0 R +/Contents 1830 0 R +/Resources 1828 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1766 0 R +/Parent 1797 0 R >> endobj -1761 0 obj << -/D [1759 0 R /XYZ 85.039 781.388 null] +1831 0 obj << +/D [1829 0 R /XYZ 85.039 781.388 null] +>> endobj +706 0 obj << +/D [1829 0 R /XYZ 85.039 651.216 null] +>> endobj +1832 0 obj << +/D [1829 0 R /XYZ 85.039 619.8 null] >> endobj 710 0 obj << -/D [1759 0 R /XYZ 85.039 610.569 null] +/D [1829 0 R /XYZ 85.039 273.638 null] >> endobj -1762 0 obj << -/D [1759 0 R /XYZ 85.039 592.303 null] +1833 0 obj << +/D [1829 0 R /XYZ 85.039 241.823 null] >> endobj 714 0 obj << -/D [1759 0 R /XYZ 85.039 534.269 null] +/D [1829 0 R /XYZ 85.039 183.789 null] >> endobj -1763 0 obj << -/D [1759 0 R /XYZ 85.039 515.796 null] +1834 0 obj << +/D [1829 0 R /XYZ 85.039 151.766 null] +>> endobj +1828 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1837 0 obj << +/Length 1313 +/Filter /FlateDecode +>> +stream +xÚÍšMoÛF†ïú¼•:p³»³_Ì%Pl%UÛª$#(‚ŒÆ ŠÚN› H~~‡÷ƒÖjäÀ«Z6 PâpöáÎûrgA‹Šã¯¨œfÚÊ:ÁÀ¹ê÷Û¯>á™×#ÑG4}H“ļ\ž½Ò¶œµ¼­VÄ<š) ÕêãûúäçÉ|5]Œ¨1rÜXëêóÕæ‹Ó‹³Éì|s¼˜Ÿü´X½MWaÜÇh»Aÿ½ÿÀ«øfÄ´®ú†Çœ <};ÂQ™Vо-G¿†T›sªÚ\•»Gш–µRÓó`SÂÿû÷×]ó¢VhÒ³&!†Yƒ¾þ2Ö²Æ1ï®n¯Ÿwã>{%ÒK 0À^cý¿+á=>Ñ&”ö‰÷˜´ù²5>Us­ïc…×1%ÜàFcéê‹Ëù}6©8ÊS”`ó©H6©€Y©R¶®º÷©ŒbÆÉ"T}*šÊXÖêÕäôlv¾Ü”| ’NA úš¿ÀŸœ.§¢5}ÿÎñ'“ + 3ÆöQ8 ¹LÒ¢`¥Ï$³yšÙ¶3kgÚöÚå’9! +‰7&#ÔÛ=L¾ð¢~)¼ àRp ° aÌk8»\N±¬‹œŒ¡E„ÉØ“±ˆ2Y£ýœ>¤Œk™4²ŒŒ“d»eìƒ$ãxAÆ$ž—qŠGȸ˜—1 ÖËx0o—Œ—«ìãØ2ÇáÉt,w4#Æ +æ,Ý6%1;Û&£Ð8Çö ~¬mºê"þ¼úz½«uò£´1fgëd„dV«C·Ï\Ƹ1aÜä^&og“­v\ŽÕ)µšÏE£IT¨–v€–3­¶L¹2sæsí3OÁŽ´’ùJ8¦ñ q¸•G£¬$×eœ$Û-`´WÀ%Ђ€I4/àp0/`¬p +v´Í“Ì7O¼eFTÂø”7ºÐ6IFH¸Ú/áhQÂZp‚FI¸X0 æ%œ€[ã”<†å®Ç07Õ°•Lp[HÃ1¡á>h¿†  E ShAà ¥á`AÃ$˜×p6¿è6Mï°¬ÓÅ}Bà€[Š2„>MÜàödHx¼ dM¦5î²j2Ý”v…L“&ëƒö›¬Z4…L– Q&+LF‚y“¥sÖyìä¤Û<^`m/Ï»£Õ–Ý„eÖ–aõ¹hV‚q5¬ïż[Ó2Ê–¸ðqódfSy³¡ŒÍÆkúVS¸ó楬“Vëƒö[­Z´…¬– QV+¬F‚y«%`Ëß–XÒÕôl{1³Œ'ü¸Ål“‹Æ<”­àýoî2?Ö/ꬻ\aû襬{Üíö¦t[Èc1á±>h¿Ç + EQhÁc å±`Ác$˜÷X6_ÌηV/‰%p(»"h}. 8^ ííXW/“õh”†8d«ˆm@[èµbÌE8k³ßX犾"¸‚­"åªTÁT•÷T¤z‰-¢­O~Ù~yֹܱp> B2iR¶£òT²fÙüš…Qé)®˜R¦ŠÉWõAûmU-úŠB ÆJÐ(g• Ö"Á¼·R°i§à·³õl2v +÷^ýVl‘ÑÅÅG´OöÅíx‹]7™{‡ˆ­?êÖ›HÌÁŽ%KÎŒU=Klá>®ÜL:ØæýbuAendstream +endobj +1836 0 obj << +/Type /Page +/Contents 1837 0 R +/Resources 1835 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1841 0 R +>> endobj +1838 0 obj << +/D [1836 0 R /XYZ 85.039 781.388 null] >> endobj 718 0 obj << -/D [1759 0 R /XYZ 85.039 471.311 null] +/D [1836 0 R /XYZ 85.039 761.463 null] >> endobj -1764 0 obj << -/D [1759 0 R /XYZ 85.039 450.716 null] +1839 0 obj << +/D [1836 0 R /XYZ 85.039 741.337 null] >> endobj 722 0 obj << -/D [1759 0 R /XYZ 85.039 394.804 null] +/D [1836 0 R /XYZ 85.039 671.875 null] >> endobj -1765 0 obj << -/D [1759 0 R /XYZ 85.039 376.33 null] +1840 0 obj << +/D [1836 0 R /XYZ 85.039 639.853 null] >> endobj -1758 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F35 948 0 R >> +1835 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F35 948 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1769 0 obj << -/Length 3124 +1844 0 obj << +/Length 1792 /Filter /FlateDecode >> stream -xÚ­Zm£Fþ>¿ÂÊ—ÅQÌÍëݧlr·‘²ÙÜLî"%Ñ c<&‹pfGùóWo Æ8—ŒF#ÓÝÕ]ÕOWUW¸ þÜEØŽJQìÚ*ŽÙþÆY<ÀÈ?n\¡ðe¾Ïƒ+=º -=Ûñ£I᱊ÜÄV¾‹4·÷7¯¿öœ…çØa¨÷Û…ëz¶r½E˜ø¶¯üÅýæ'Ëu—« p¬»t¿N—+†Ö‡º8´Åá[‘õnéZ‡6¯—+øMKh5Ë_ùê¾ã.ÌÃı}wR>g±ò”­"5+|F°AßÞõa;á@x@ÃõÞñ߬›¶N³ö’h2i–{OCÜÝ`á:vâ$î^lGQDÜïw9@ä8Ö@9ÕÇåÊ‹¬ª‘ÎjË¿- hT@[ây‚æ>'d—Ð×ÂH’Xš¸­¸}¬+ý­ê¬ÞT{œ&­â@ÇHó°“Åhh©¯¸ã:ÒýD]ãÓ+av¬¡U0%-÷Àý[ܶIà⋧é¢Jò!´E…ãiY´8ûy¹ò•²ÒÃ<è'Á*înåw“SoVk‚-ÇnßjwKW?7Ì>™²†»W\!£a”ºMA`êÛòl¦Ehë|4ç?´³ Áù$cYY䂾±·€¶6|°/(Xƒò¸ñ¬‚4—Õ;PN¨ÕÛcõþ€»Ñç;6Nìݦ öÒQÃï¿— - X*Ǫ‹êÔ°uß>LüÈTùasÉ¢ƒÐ·wÞã4—Í&ð=; ØãÜ¡öÅy×# ]ÀÃR.h÷£Ý¤ë2çYüÕ‘Tú]ëHFUõڞײ\Ë&‡“™Ío8.FGs·(Â!ÃÅ•"ÓF~3Ôæç‘É×U[±Êµ‹sYHZãj¤õ?;®È7ÜDµÅ_Ñz˜øúkðŨ -VceD·¼e²ʾ²#/2ðƒ§LÔ—÷ÉélY ’ô¼Ïù¹ŽgQ8`:¿›àD¶yByfݹÃoN+¦YD¬A¾)8ÜDÒDÈ@ŒÎ8*ßvÕÊpWøœU¢xâΫmx„tW±bÃéT¸çñ”ŸòKú ÜèLs žn³Ipzfç6%úó+^yëÉ;†õkÂý1ÄüBd÷ -d=Ñ fBt ´9†µ1¿IØ ~†á•íÐ5£Õi‹«û`b¤x¦ÚÿŸ:§\¸a½+öD3 -Ñ5çjÇü&4ø5§õ¾B×CÁçP8q] Eh«Ð§ß@ñmñå©–øE_¥åswkè°&­{ÕSMƒÉÍ2«Î²Ëm`%@RdBaØyÝb,õ±î iRŠG1ÝÅ H%±í'áü™D—Ï\]9óY†rægü¦ÎÜä—b„íYF]þUd8¤$ak™ƒüå€=“$±aÊmUó(ŸRý‘“+é+@uè©i1‹„3ª7ÜñÃûw?òÓÔ‘’ §µö‰Ïú¡Í÷]d>y>±o'þ•‹À š9!ºv>s õùŒùMžÁ/•¬™®ƒä½¾õå˜@Þ’±PbS s–ƒ“ŒtˆÄΟÀiwEßQÈ/•Ï¼t§˜¸m¸¯ØŽSûåaJ\r]“-ç §áO]Ʀ©RŠ(ikI©8—Œ‹#3¥Õ±Á5Ø‹{)WÄÊÍx šËy¼R‘íxÎãÕdÏ ø÷tk ?¤æý[lß¾š©´)@Î}EÊžær^ÿ ¸ê,/WÎYÕ‰N^©Nu:ëç£Øˆ#@ŠLJ нëý­+‰£Cè8µT;k¹+Ñœk\®õYÉeq>Ü=»†Ï¸“ -Im‡®§ª§JV0™j%N —LÚèÜ?€Ü_Ô‡»­D– zÛb/O…IG¶€Æô@é7A?…bømòžt£Y~·&¨ ÍSCwã L0§$ê¼;ßW&’â<ßåšUW'ô Xá¹ä3m¸UmÛ%ôö¬ -r²ÔýT”%?u;œÈøQ2RÔúV) -À/õ}Â㌔²ê(åBæϤˆ×r›0´þÉÕºÎpþ]ôÞÒ¬+¯ÖiÆ—yŠ‚Z]Œ†¯ä÷›Bß4¸T™ò¶´¼›aXÔ—e¶à -C=®R´aE®¢hv:0MõÄŽE‰¨‘GÓ&n8O*eùºÚ¦å'ºÕ× ëZd’(Šˆ S:‹‡±1RŸA†÷Ø~{‹%flféú’/4¶ÕI".\™UN†Xo¸^Ý!þÄ7Œ`eîZT€w«"¾UÔéúìJaîÂóá"õè¶}¼ùég±ÇúÍcC´x‚gÇv“d±¿Q¶î’[åÍÝÍ÷ÆÍM+­Œ¥&ün·;, ‰ÆEæ3éâX¹/#Ÿ¬uEÂĵ}ÇM 7kFK‹]5´+°«(¤ð@hÈÝä ý@OF[SNb‡÷"[ÓkÍo /»®äÑÖÆry9/¹^ëŠ\=&#¥Øå醥‹#ò'"^;c”9žYab½aÚG‰&`ðþí-?X­<ȳÂÐË%[ÇpäÔÈÛ†¸ÏwCtÈrÿ§ÇA@@sÌ’¨ÍòV”µýí!?W ?¶D0bÙ*ŠÿÚÈZ+c±‰üBˆ†4Ñ5«8íP½Œ€¼Ôù"PG ä›P\°Ü0z!Üd­+r% °;‹"™çCç´1Úv´†ú±¼Y•0u„3†XT ½x~hNìdtôB1þ…(E%øn.™‚rT2£â¸B‡9ûª6£¢Tº¿}óã°:mئÙ1¿ þóÀÊZ+c±)…ŒlßWG„âÿ޽¿??s¼ç½—MÖº"ZÂ`0íííÝX0ßì¼ fz­yÁ|ϳãÈöæ[_½ç“-ä„é¤AUÈaA´®ªš_ý®¬„Þðí6Æm1†<ƒ‡R‡¹* ãeZc€Ž=£Z}¬_e£GéרyÞ{)퉀g×—vûŠ2íԌ)gB+-ÊË¥€)ˆN= Ù¿kGÉڪƴ#HëÝ–eÑ7’룗ü­€éã}‰Ø}ˆÀõÝqàf÷Z‚Ztû¸Ö+©øÊÊ?ñ‹û|Ó0 e9øð-MèDC\âØüùÈ_°=^jÕ¯5ez -âWó»lyqbÑ‹ˆÅ+ÍK•€rƒC0¤š4:¸LÜä%„ÒKÍJå»±'¬:‹Ã-9Lû&t‰Õ -µÃsB€`èú·¬ëÍ…R-çSÝK¡}ÕHñ[už_Õ¥ááKµ´|¨èšow{y¥ÄuX/•»?dDzËúÚan9 ¦¨ë“ óMvzÏ5múXF?´’ôFüáŒTJSìxÖE8%÷ðø®à‚‹,4øz$ì¡r½ßÕjÜè³/ Éõ‡]槺ˆ¨â–^~˜BÏY:> ¹˜«<6—)c4 -…R™¬)sÅb¢T壎®œ‰\ø•—å"Ù¥’ʒϧ‡?ç_æ—@DóD… ©ýpO!þ—d9ônÝ`|^àW#Þ@\’Ú§.çùuÞ}aBÅŸÀ[]½"ð-ì5Ñ–'«ðÓ+äÇX»«ÄÖxᆉõw1ðHñß&òmŽ ÞßÀ*¸§óÏ¥:¼>ÒBbf§£®oH½ß´|Ê»êƒ|Î4*Ë Ê~R«¨ö{QWî3{â ‰íÄœE½þ.:‹oYyÚ <ØbeÀ'ã jþzâøøƒc'¶~g‹ŽàV Çbó_=£ØüŸ´0h©;½\•åX‚ÃF™žÙN I:Œ·Iኃðiž ±êQz ‚Ï—G ÉG §ý¿óì™M•ž{øåå´¦œ¸ÎÀß« ”ÅpA8æ¨Øbu™áÿÆÝçlendstream +xÚ•XÛ²›6}?_áÉKðLMâæÇ&½¥M:Çi;ÓôAl“`ðœôü}÷EœŒgŒ–´ÄÚ{K[ ~b‘„®'׋8®L’Ez|ð{hùåAhDJ7 (ßh\™ÖUä»^ßÄhŽU,Ö® b^m¾ÿÙ÷¾çF‘\lvf"Qâ¹I.6Ù?ŽËUzΣ:nÕr%£Èy×UWT{|‹7KáT]Þ,WðT%¼µË7¿=ü´éÉÍ°qä&ÑÍéy‹•/]û³sà;ƒuhÏ]ð5‘=w?‚§Ðswõìض]£ÒnjfºÓ,ù€!r.„箽µE&‰+ü5‘oùrå'¾s:7 Ê _œº¥JéÔ;| +§;¤Uf5ç&oy8Óá/úªŒfÿE7§eÑ«Ž°ÍL뀟¼w') ÁIÄzÖ‘,̤‡àlQ¸6^쳿C{sŽCë! w*͹‹Ï?—ÒsÔR¢-ësË1üŠTI¡ã'FåU6·!„fÝù¨3DGÆôQèn‰CKŠ9ç67öôbGñm¦¶eÎod3€ÚÎG' +šº×…Ì”7z,RžLðóêj¤Ö]®:Øk°×5YS“wè/Ï}\çfæî˜å<TÆÿn…„qÒÎðç]xµŸR wØvN;ZN4>ËÉçqÕ%jd‚¿ü†ë¦œ7BX½æWA Cv|ËÎÂnàÉ~ üJ!ó 6‚0™%4˜+Æ ÏÂw¥ð/›¼k +#<\¯<–Ði­ý„¶­¥¿vºÑÚ ®䚧s~Χ$‰ëùr^Â3#¡Ý•p†ppÄx[B‹ñ¤Îfç¯Äýž°f=ç ÝrZ¹*?˜•ÄÂLKb@÷$™#ì%3Þ”Äf¤½CoËZ +5(¢ô–i§ùf‘"X>ýh^¤3#’Ýi†piÄx[$‹1Ë˼³Õ‘ÎÇz;ìÅM}¼ŧ³ V.L($#7öçs[ 3£ÝUh†pPhÄx[!‹ñ:²´}Ä]EKuog0ëÐWéæ­ÝÈŸß¼-ÌŒntW·ÂA·ãmÝ,F+üÊîr¾ˆ=L‰‡,`䂽®8|“÷Abë†wfZEº§âa¯â˜ñ¦Š6c{Þ‹Kùzq(Qú +§Ó‹°Ç®K´¥ëÁ©ÇM¹Icmªås¿4fa°ò—ºÂÔÅ`(G²Ú콃)9yá^Û%宀þÄ@Mد¿ÅñT³­Ù(Êõ£3´<›J‡| ç×d 3cs ºkóÂÁæ#ÆÛ6·µ÷½FyÖJÍáŠÒË˳ÔåOçF»ºáV¶RóÉœ +¹NgààAVÖªÈ.dtm÷¿¿ùû:™(Ì8à¤ísË™ÙqêL"Ö¡ë‡É¬q,Ì´q èžqæ{ãŒoÇf¤•µex! D‰óúý»G.‘|Ìá|¿@×íЀ±G[ë¹âwÁvsíƒzý%‚­"™–"€y¥0®Ê~-âBO…³? s* D7ª)rÍô’£ÞJºZpRÕM€TgÛëã©Ðô” GˆÏPL§ˆ`U 毋,ÌäA[HéÆIlÚòæA›OÈÐ&˽n~Ä÷W/g.¼„ôi‰œä€™<8ƒÃ$I4>7û2âÒW@ÃmŠi#‡é£ ’ì'¾ŒÁ8´ˆh‘ßs/º˜‚“°ÙWãZÐèŸQ;“9l6Û)6¼(ù@üÄ£hÓ]²¼ÐqÁV}vnÐë@©&lú{›–Îæ×¾³9äÄÚçñCÞÓcA΃%¾/ëAäî9û3¹îVï¬8$83àÞ „aâ¼…—- ]÷)œÙ¼Ó—uµÇÛP®,±uÍ0Í>!‰M¶-·Ô¨9¥^ËÐò¥Ycæ÷¥(K,™jÖ×^RJxŠ&ÏDÛ>Ÿ‘…óŸ¥\©ø‘Ö'}Á‡o´>AÏ’ì ¯Nßùµî·oëäÝ|ÇX’´M)Qàò3ÇÃ&ƒfPårèW£tç§ÍEz~´¶X|“Æl5¥âO2ÓÍ.³ á +Po}ZVhdÕW˜Å±_*Šöë‘”éØS”è.îdžî^&Í3Ùº;•9K؈pßg~tŒùB™¸a"§ ÿ¦ ™endstream endobj -1768 0 obj << +1843 0 obj << /Type /Page -/Contents 1769 0 R -/Resources 1767 0 R +/Contents 1844 0 R +/Resources 1842 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1766 0 R +/Parent 1841 0 R >> endobj -1770 0 obj << -/D [1768 0 R /XYZ 85.039 781.388 null] +1845 0 obj << +/D [1843 0 R /XYZ 85.039 781.388 null] >> endobj 726 0 obj << -/D [1768 0 R /XYZ 85.039 761.463 null] +/D [1843 0 R /XYZ 85.039 761.463 null] >> endobj -1014 0 obj << -/D [1768 0 R /XYZ 85.039 667.044 null] +1016 0 obj << +/D [1843 0 R /XYZ 85.039 653.495 null] >> endobj 730 0 obj << -/D [1768 0 R /XYZ 85.039 667.044 null] +/D [1843 0 R /XYZ 85.039 653.495 null] >> endobj -1771 0 obj << -/D [1768 0 R /XYZ 85.039 642.326 null] +1846 0 obj << +/D [1843 0 R /XYZ 85.039 615.228 null] >> endobj 734 0 obj << -/D [1768 0 R /XYZ 85.039 583.118 null] +/D [1843 0 R /XYZ 85.039 556.019 null] >> endobj -1772 0 obj << -/D [1768 0 R /XYZ 85.039 553.714 null] +1847 0 obj << +/D [1843 0 R /XYZ 85.039 513.066 null] >> endobj 738 0 obj << -/D [1768 0 R /XYZ 85.039 352.231 null] +/D [1843 0 R /XYZ 85.039 162.542 null] >> endobj -1773 0 obj << -/D [1768 0 R /XYZ 85.039 324.708 null] +1848 0 obj << +/D [1843 0 R /XYZ 85.039 121.47 null] >> endobj -1767 0 obj << -/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R /F14 969 0 R >> +1842 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F42 967 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1776 0 obj << -/Length 2945 +1851 0 obj << +/Length 3382 /Filter /FlateDecode >> stream -xÚ­ioÛFö»…/¥‚ˆ!9ëYìÂW»ÎæÚXÛh‹€–(‹‰D*"e7-úß÷3CR<œ"sŽ7óÞ¼y÷È8ðçN"ßvD< #×Q4YlOœÉ-Ìüxâ*ˆ™™5`Îæ'O`Ö±c'žÌWõ>¾-}1™/±Îÿ}úf~ùv:BX®kOgaY×S×:}yvŠÃÒz½·W¯æÓ™k]½ú‘a¡ùöÕé‹ëéoóç'—sCŠAhc¤ãÓÉ/¿9“%ÐüüıEMî¡íØ.LoO€Û—Bõ7'×'ÿ5[ñœœðª¾cû"²ýHtÏ-‚ƹ]/¶e,'¡ïؾ#éàY^Mg¾ç[«å3n<}¬²MÊ­eZ.öÙ®*öÜ/Vê»Kócج3÷ø)²蜹xŒ˜ÐVÙ6}¯0—U²¯pàˆ€ûµÞ¢Z«Ý?75éRuvE±ÉòÛ|昰°:”G˜Ìþ<Û>eµÎÊ#ìm>a(³?êA{Ì#蜮PlMö_r¦]r›¾_‡¼¤®¶°*æ‡íMzt¸®ü;Ï^¿~Ñ`yz,2ëDm—)ÊnR¿L5µUqÌÚKáýœVÿú2 -¶7À¯#Ê´j‹a—·ú2þ\¿<½\…wUV{#a(íy²¼b=ϽC©åTŸœܳfX¸ZèÒ1ìæ 5 ·ÙQ¥BS¥nèóÑòÅ&3Wõ0+àpû!BpNkrÑ£¶]ŠÆ÷éúx¨î²E:"ë°G¥WÚ’=¨ÛŠ†Wó÷—?]_¾|}q©àòêý2½ÛK WÌÜÐv#¯µî/šzúƒë7Í0·fh]†›#+„îöàeö)ú˜|êÅVÅãÛ$Ï`b…úêZ`¥°Wäì˜ðŒø­ô.;Ü#ƒõ‘U}@ÀàÅ8yXT„I£Å‰‚&Y^òh«~u\™n–ÜYáv{žÇ4Êÿ½ºúY±A¯Áb®tb+[òW¡bHM®»jz…óÅ:®Ã§ÂÆ£Ín:óBë1Í[àÌò@K5xÁ;Ø%ƒ1CVÜã‚’§4Wú -Ç/¸ý«ã;›ݠÃþ aÓº¬IìŠÇ nŠ$#×zC!ÂQ0à>øuoâ pÏqøp8 l/ìfz¯Yc3òõm! "[¾Áˆd¾<ý¹CX 1ß„0µ×„Å‘úA‹°ç¯Ï®.€õw!ß‘Û’‘G7  ½SRˆ'ÌBçð^#1*X°Oó¢X®`yS® »@ÁsQã`1ˆ uØ"°V³†ùÉ ¤µ[£z×-\Z¨)Ú-©ˆzÍC ž.LÚïŠ| (Ãu· Ã:@Y΄/åý?ôÁLã;Ř_œ=Qˆø 7¨Š*Ã?h_](h%íSøw‡ä¦}‘“ÁfÍm\¬BxPÿè±{ ‘Tóï¦~|XÐæ_È')óïH?¶>â¥kÝE°ûu¢¦îq´Ø/¹§%@¶ñ²¬yéXkÍ$#û ]ÛŠÀönᳯ ¢¾U¶Zc`ÓŒþ -gÀA;A²Tt‘Tyª“ÛôôÚŽ¶”“¾7‘±c‡2þ:%U{Í›õ(©”vèIƒQ)i׬Ëþ&„©½ ,tl¶èºžO#i¾‚úÏ•#,89Ó*ƒcÙ’Çö)k{ÁéK¶¶6ß mO¶Ùè£{èá:1¤À¢Äï–4=DMÇnÂt)Jù°ûŽ„`É’]â˜P -‰Tz1ûâÈlªvqvLØÞ ñÉÑHQ·éñyD+8¶3”<0 ÂqØÒlð†LÖrÐkCü†´‘žâW’)Â/™´t[ì?cŸ 7ˆ`ßW\ {GÃêp/ ¶Ji;½*á…!‡‰ÄcœÇSî(6‡TÇ›2T¬Yr{CFœ-pÞcÌ(Ø%¦[øÒ{XñÎX4Æ^`XL– m‡nÂs¾áH½F íÃulQZØð.ø>Ãlô^Æ.âÁ!rÝò„q@=³ay2†€Ø­¤»’»ÝpËÂUmé`pdøZ…ƒ–t°¢xÚ^|Oߎ]ˆBª¬HOØŽ#¾Ä.H@ØoÔ^³Æf=¥ 0QŒH"å -Ǥyà¦<÷Û¦÷'̓É@¶I;ì@rR¼Œzz\„ÜÀ×Îa¾ïðØõlá‚SpÀn -Ù[Ò0³PMõ| 00;!J×îà½ã(:y›ˆm?ò[ØÎ×)Í`¢0â/ø[’`¦ÜÁŒ¿ ÇVk4 -ÔV -ù»Ð -·ß+-ß •Ç<$W˜´ƒp]ÖZ㇔º]ÃÕÁ º¯Q ½×¬±YW- öù#RH‹®2xµø˜"HÁIÛŠ^O “rnqÒGͼ¨t´6"8òqêN)”O[i4E˜ºÖ™q}(H¢p\@è2oHGÑ) Ǧ4°‰í…|’;à°ˆMvmrƇ*ý»‘ö„(ÕèH>ó(%*ðåÄ -Ì¿3îpr Zn‡½jçRëw®` B÷ó¦N„L[ÔȽ¨ -߭Ǥÿ©ÊÿL"È‘PÙצLëÂF‚#èÐ7× Ìz|¨/»¹l„ÄŠÁËC§/{›¾ì¶ëŠÂ%#îu\›8c]^ªd»ãÁW€ÚvžÞsc‘4Žl²²ªóž^¶S"?ÀÖh„­ -*Ù:†N³u›fkÛÛԔײTåÏmƒÂ.‚Y‚fÜÔ㨾‰wYÂFQ»b€?d#|½‡¸h`F˜È0x*‡#¸4 Û¨Ú®Éì0'Öƒ¤Ë¥^Êd±>®Ø¿Õž–J®­üùϾ‡’/}  ä[CåþÆ$C$Ú»èJ(-§®Ú!CÛ¸£xDY¿M£DÊéöÐ]`F÷6~5ÐÈm( äQ8xcèô}ŒbÓÒÀ6ì©ôaŠ<-‡",ý0tè¹.óNÃ×5Ä<,²ð`^ 4Â<„lj™7†N3o›f^Ûhùíg’Ï?8BÅÑäÚŽpaz}ŒßSº¿:¹<ù‡EÅsÞ„WmÛW‘ð#µ¿o×Ù·ïßñhßWË|6—2œ®ŠºáV¹àßtWU°ã·»™ÉxÚ¬î5Ä~C3£A2œ ¦Ûª˜|4Õø>ï ˆnH˜»z}öMÍÍ4Ù0àµÁŠE¹CÔÙÞT4Í¿$ë'‹Í O7Ëó +é×H®·Ÿ`Úd×Ã3òb_D R#‘OI ŽŸÑÜàšwíÇ {G°­h+,±ƒ¾TÂâ'aÐà:Π/ánClÑs…'ådî¢>Æ4W7Õ.mvVSj4 ú»ã;Ü¢£ÈsìG÷ê‚z†2˜„*±ï?j¯×¼ƒl¯nmÆ–b»×._ÒqEúO—Áuœ/逡zQ¯ežd,P¹£®¥‘9܈”¥ ÂGæùÎô”×ìÙ ‚ r£Ð‡Fv öµÉ5©1%ÆσÍR¯¿«’- wœAÅ %ëMqpÎÊãJG8°¿®ò4E‰¶ï6ãN¿ÅfÎÖ<Ô—Ð +A¯='xœ¾h\ó²} •ˆAÿ ÐCÖëÆ¡ˆ½§aQçµKºªÇ߈>ÃÄÑÓÈÍàz€/72èËí%v'¬é|ÑcÅu!@à˜që~4ЩVqlªvWyÍK(*$ü§×H”cIÆÃYÙjoÍC›R/é‡9¢¶.«¼‹|£u[I!¥bÝf{}{úëž:¸R8>˜µ‹È¤>h\ó²…u}¡”%ˆ|ýLÌ3»‡™ÁSp¦q=À™ï‰Ð•=Ö^Ÿ]îÛx(¼è‰D¦q=Àäk!Æ¿cï1ó;Î “ý5úÕò»ãª²jx¤)bKúˆÓ·3ò¬:/B˜„AVI…ÎB]ž/® +-¡*×Ü!Ü_`d™XgÝXo<®V†à¸ùþ4Á-¬´[Ž1PöCzr½Òvy¸-o¥Û™ ò){{ð|Û¦¬ a4]0˜ lcÒ©63ƒå´±]ÇMÌ@ÀR/°1ˆ»ŸwùN/7)#4ó/©É*\âJShÂÆ[LÜ÷ Ѓ,YÞ$ˆ¡œðqéžÆ5ï I÷ c +Th)´@”3ô‚§aMãz€5¸)8nÜcmÄ}G‰0öŸ„1ƒë8c¾ +'èËÌX §¡|ŸŒz:»*ÖEó4ÝQW‘«ƒé"Aµ^¡ªÄp£HÒ¨àŸ<‡öŠ£ ÿ¬Kº A«ÊYÓØ(éà»Ú^y —¬nÈŠf¹æUh¢e¥q%Æ¢!^c›jÈVao,€l!nІ»d‚dà@è)èõ%®"¼˜Fƒ4ïð¿’îp»äîk±ž &—…VYâˆÏÞ)0?Ö3Å왂é§òšSö‚¾¶&¯–?aä…€O9NAû¾‘œÕ~£9IÝZj‚è§E­ùjAµ1™Hi›*\ƒÒð'µÐà}A£u³Ê!&aì:=ÈP¶5O¥«¢uësg—ŠG R>î›Ú +¦a,ÆObûjϵe]Z'œòà:¼B+fƒhï ,±Q¶;êH@Û KN† MÆ3‡&ÌÂÒܺCÈv8ñFÀÒZRÈ÷\FVý¥Ž-|ü4ƒI·û'‹ðfƒØÞ¢˜"°Cµuß™›E SEnÛxGtgcÝê³Ïg^Ç{[¯“ JïYÑËïUÐñ;:uðÖó_>ŸÁ•5]í2¼aoA-¸°l€øXrÿùËió帳€´ {ÿ!hÈ‹ÝHvUt[dÍ‚"ûŽ[†°Òti°•i^×ÜY%»Mº4<’*cÃå ¸áÙú¾È)‹f›\ïSôÕ“ôÍn}éÉÃÄÃ=-Š•¦”åuZq>A}ô‚ô»E؇-öæFÉ6Å:7⬛¤jp`O¨žàh‘k½-Ë•œ¾B¦MÒìêƒ2¥Ùþ.›eQ=6Öºøw»#h$sC{»+µX“¯:ºmr“LËݦ¢®ö¨nöÁÆuõÿCñìýû7‘çC•Y&]¡9»Î ý:7Ü6åP"„Kӽϛ¿}ëë}ã¨ó¦¯†û²5‡™ðÏåÛ³¯±É8 «a¨í›d}ðˆÍ<÷ %Éú;§ ¬ùZúÀê1ò­ñ[nŠ[kK¥aKÑý`9…Íæ°¢÷XÍU‡øÀ9cÉåˆÙ~¥;ìÑ£[ÇÈæÔm‘æGt¼\Oö mkÞ]}|}þ¯‹Wçoß¿>×p›æc–ß®Ë xáZC'fèuÿýŽÃY/6á,ìÔùC5¬êë˜,!_žS=R‹EŽŠ+,0CÙhعÊA»[®ûÄ¡\R´³š¾ùMX`V)pÍ£ ÿèÄZeŒÉæÏ=²ÞôŸï.~eK´ÐKª¼ÙULj‘Æ}cøÆòi6:yvÓ’±&IdÏx0Ñ9µñ'ÄL0£´ˆ²l.á´Im°}ñša1l*9G¨kº&ð4ßKÔ† „5¹ð{.¹/p¶`* +Ü—»/j\ó²‘ûbˆn]è@‘Ë‹•ˆáòù$Œi\0‡BÂE¶ËØOïÏ.^s5‘¯Œ®«é©Ã/ËÖ €€ä‹ˆ<`áˆÍÇ¡M¥rø%uC8*•Ã€98ÄÄ— ì(vI(6ËDÓÉlžꚥžem([^òP¢9·I±¾EÒnF˜ß´üíÛÇ¡û–òñÖð‚[ ¿= Ôg,!h£æ#XÂw²{=à'¢À9xÜ­¾á‰1p†ýeÄ­E‹|=ÿüvæÃr“j´Y+=® £yûblîXèÀ"]‹Ë*ãžy YõÞ»‡Õ—*>ºT®¤æì¯#œ£ +Âå‚ôõtîy(oïnòM^%mزʥàÐQM²vV¡WD¶~Ý/ôƒ°À dVç<òáJãšwú¥+BéYŠÚ÷ó< > c׌y¡ðÂ_—W³È›ž~˜E +PÌtuVªs÷(¾àX•³)—œYàP÷TŒ¡kãRxÊÕU>× ´>Œ§•­£V'BõçÇáÔx8þº%â+B›£Ló5ãÐö¿º0Ühmˈ³ìíMÑ“ê¥Ýô ë(·ßUpÛzÙ«¿Ã°©ûCóÍûWÙµkçàÈ•ôD)—ëù¤ 1ƒkÞA¶¯JFô¶m€PxÇçEpŽ ½»ò…‰¹ÞN¦C‚Í›A CœïËŒŠâÌ +òúÇͪ…9lV÷"›Õj­Y#gͪCï §ÅºÎ‡˜çŽ`JV³³.è j½¤@-Û‡¢îBÞø¤¤/Ç8XFŸI(s½­x¶ H„Œ*Ü3~5ödÏø‰þxƒ;dˆ‚­2¤ìàöü‚Éå+NGFêIüê}èœÃ’÷ðø'¥äà)k¤§òRöŒÑ2GÜ!vÙÊ| Ú­‡2Y+–Ày®n’õ–&ê®ÝäwÜH“®ÂüZT{ qyâ׃2>*Ïä <5nÑ;(Ï#¤¬<Ñ2òìûE®Š¼½¸zæÛ7û]É¢ó|k¢@Ü 7ºEÕ+<; <åˆñ ÁGˆG}NlOÀS"R‡2ÈqƒÐÓ¼ PB?Ÿâ¯Ž÷øý“V–6endstream endobj -1775 0 obj << +1850 0 obj << /Type /Page -/Contents 1776 0 R -/Resources 1774 0 R +/Contents 1851 0 R +/Resources 1849 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1766 0 R ->> endobj -1777 0 obj << -/D [1775 0 R /XYZ 85.039 781.388 null] ->> endobj -1778 0 obj << -/D [1775 0 R /XYZ 85.039 417.956 null] ->> endobj -1779 0 obj << -/D [1775 0 R /XYZ 85.039 377.915 null] ->> endobj -1780 0 obj << -/D [1775 0 R /XYZ 85.039 350.816 null] +/Parent 1841 0 R >> endobj -1781 0 obj << -/D [1775 0 R /XYZ 85.039 337.267 null] +1852 0 obj << +/D [1850 0 R /XYZ 85.039 781.388 null] >> endobj -1782 0 obj << -/D [1775 0 R /XYZ 85.039 323.718 null] +1853 0 obj << +/D [1850 0 R /XYZ 85.039 183.293 null] >> endobj -1783 0 obj << -/D [1775 0 R /XYZ 85.039 146.47 null] +1854 0 obj << +/D [1850 0 R /XYZ 85.039 142.646 null] >> endobj -1784 0 obj << -/D [1775 0 R /XYZ 85.039 131.709 null] +1855 0 obj << +/D [1850 0 R /XYZ 85.039 104.725 null] >> endobj -1785 0 obj << -/D [1775 0 R /XYZ 85.039 118.16 null] +1856 0 obj << +/D [1850 0 R /XYZ 85.039 75.506 null] >> endobj -1774 0 obj << -/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F11 976 0 R >> +1849 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F36 955 0 R /F39 974 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1788 0 obj << -/Length 2961 +1859 0 obj << +/Length 2356 /Filter /FlateDecode >> stream -xÚ¥ZmÛÈ þ¾¿Âß"_kEï–½‰“M7MvÝ]A‘ ²5^ëN–IÞMúëË—i$KvŠC°Ðh†’Ï’Ž=±àŸ= }Ór£É<´M7 '›ý•5y„•wW¶¤˜I’™Fózuõò:€UËŒ¬h²Ú¶ûø¦ç»“UòÙXüãÕrõö~:s]×°ms:›ÏCãaj¯>¾~…Óž±„·û›ÛÕtf7·ï˜ÞßÞß¾úð0ý²zõvÕˆÒ0¶Êñõêók’€Ìï¯,ÓÂÉ3Œ-Ó†åýbúž+ß³«‡«5[ñš7ᯆÔöÝÐôC÷ToÛ×ô¶mÇtmg2÷-Ó·ì]3¹ÕLÛëÔw<×3ŠÁLÄÓ^Â1m0úÕ²=‘%åŠÎ`æ:¶y6…OßþûÃ!lŒ0hN¾ü, -&É*…IKpè€û¢bê]ª91—-· óHä‡qUµ“D›Æµ"<§ÀƒFx²ÒVÖS'"‡€qãÊ[”똡S˜¤¤ÄJ·¶;4²Œ\ÉR!%Û˜"JÍÓC¦Ó5¡á5.i®Z% “Ïä’;~ÑñàöËŠ_ÒœŸô…PŸ°ù¶Ÿ|=*õŽÊÉlcõæ5k8RQ‰MÖüLx6!lÙ‹¶e/p•²©ò=šöz~…3r ë:&oU¡7BôËbÏJwÍ‚‰Ñ”|ßø]Ïš'IÒ]9hR¡ƒ;m²T´¾×‹#)Q—4?>Þ‰ú}Ý=O¸ ‘eLöË/ütT(pÃ/eQ·i7—c9g¯~†ÜØUÏt½@¿pç(š“.pÝ{e,Øœ0ü>ŠxyÂsxUQ?ŒÇÛ\bISñf—æL\lyrY¦9NÞäÛbê¢Ìð:áÐÏ–7ˆ²®ŠÌÏ+ÛÒŒß÷L‡Ï«)\ÀƒÞ\ùxh¸²æÒIÚ(ó0ƒ(Q~‘Õl3pÏçdÍøÁøóÀô\WŒÏó‰äHBðúŠ!½]½tþÉÃÔ‹žž¤)êtû}Læ¹c†^p^æ–f_ßwL+´IæO—²ð3€¸@¯üCåž=— >Ñ4èN‚ºyvºý…/ø -Ê;ÇŒ„öJ+~ò½[UéZž%®PZ‚ûÅ’²,q¦e릒¸.xíØÄ3=°=Ý/uä1>+A×YÄ·$Rœh€`»’¬½Û¹‘‹ó¡ç…¸ž¢k¢NÑ7qR¾IõYB B—m­ägb¸"J - ´òÁ`F2CÇ÷z9?ež‡ã˜’Á’@>Ö¸L>»ÕNoLJóÃдÙ5¼«æ -=fÌî$ã$çØð‹é="©xˆàóq~– *Ã$yåwŠÁó€êœrørP¾ák%Ç;œŠÊ~#ôñ©nUC?Ê!ŸÏ÷¼?¦êéõ€—˜‚¸¹DiI}Xï(G¦‘Ü4¡ƒé+®÷y]{….Ìôz\[À<ùb~¬1Ðü—RéR¶òqšË€b†;¸<‰gèÌ}é3$j‡ áã/½l)0[Gz¡·FÝ—ÊÏQ]Õ ÀBnîHôdiÃx²csÈðàûR<¦œ'‹²ù1ÇãÒ–¹òNëo¸ŸpTNdDAÂTòŒås[dYSÑWæiç…Äw`õÅâTÉ z`”G?ÂéNóÀ¡n&ÿcU¸Ó>´OÀ%¬#»F8ÑÉŸ¯ÔÏ‚X<—¥¢%¬ >`ydr»¼زp¦_yãK–î â¸Ö -oPþåµhža¡¡›‘¬m?C!êøÆ÷Êi 'ØÿÂ1>ªQˆ/EÙ]¤ B§¢RvnÚa×™Ð=ÔOiÜû¸ªo\&R þ FÛ½Õ~üÂ¥ Ä7õ»Â)“©Ñ½¨E.wã¦!Ž$ק8K“qu‹5”æMû²o+Š:x=µµÜK9LpÌ-ùºÏZƒI<¥Å±ÂsCðE2†›.a»€‘BŠ[„*!™£âs›Å•ªÓÛÈv/íõ$òºè|(@öEžÖfº ÛuËVB±¼§ßö»½[Ý\ÿç·»åêæîöAryÜÔÇR ðÚ9â@¿tð"éx˜æ ÿ^ÆýĤ€àb6Å>ÎxåIñ<¤˜G‘)©§EªåêTÖBäê|Èr“.G -êŒÒïØd#Õß~’ˆA°nqŸVU£üsQ&?ý]ò_¨:Sà¤Kuäðq”AŠdu+n½;V­­¦%²1>J&çÖ·«ºÌÖ’×âæZ6ù»’\>ŸE–i&£Ü»ßC§¤ÜK nkcB7"tnDùñˆ±èŸŽŽVÉa¤‰#¸Ø‰$Ôåp•wÃiMi4T*`4ãÇ›}›n4ëßéǢúqËÓcp  ¦BªV7QU#„·±Ÿ](8{ðÇ -þ©ÿÓÓüÂä¹fèŽ4N|ÙÁÜ“² ~ØWýןyÿe æBendstream +xÚ¥Y[oܸ~÷¯ìËjÐŒVÔ](ö!±ÓÔiâ¸ÉlS ̓<Òx´ÑH¶¤‰×Xô¿÷ÜHQsÛ¢E` uxxîüxȨ™ÿÔ,\/ÈfIªÜ Mg«í…7»‡™7J8²°x^-/~úK”Ì”çf^6[®G9‘FÁlY|q.ÿúòvùúã|£”;_$Iê|š+çåûW/‘:·ðõñúf9_(çúæ óÂ÷ë7/ß}š]¾½x½4¦% 6C;/¾|õfØüöÂsƒ,=ÁØsLo/À7 +ù®/>]ü݈â¹pÆ«Ž¹­9ç¦ix>4‘çF^hB£"+4YêI0Ó<šÈÝwMy±›FéÌ’t Mó¨ bKò37ÌÂYÄnE¤oÝve¾ÚÌ‘9¿¶w<¨þ6%wå®DËf*qUŠ*1Éø&<¦±Øj½'`ÝóoÎ?¿Ü\ÿÓp¼àÑ +LÊ [S>ñ l†îù϶B1â´ÆM>Uù¹jŠöIhwy_fAU¼0Rš#J~CàO&Þµí·ÝÞ]¹j;~÷|h^UüWŽÔ–ìu^Õ呶AÿC(—ßüLàÙŽÅÇʺ/O9½{(LžÃÞù°mS?³Š tƒ8œˆù·¥\ÎÙæQ”¸©ŸÝxÏɧyPW|rãÓf6ÞYuJùn ü‰¾«².ÛÀ¹’!/oæ~ê<3Ôa•Óó îG$›‘{yõŠDÄl#GÞÉtÄv°—ûœ$"À¤)´hPe`Á#ÏÔ6ÿý©l &þùÂâ9 áÁè$§³qFÛ˜sêL6,}Ÿ0 ­Žæ‡ÆeFBÌXHCŽÔù‘Tic¥êDì¼Àƒó¡3,§#Ç,èHz:p§Uq;£Ë„mT†¨ä'NAõgb'±YalòÕ¬pÕVF€Û)Úû¼b$q®áÑ꥜››–d«dS™«˜@ )xšðŒ¨P©³j9[%ÿG»æ•ÃF¯á 4+SÙš»®aÉ +Üd-ó|¦M¾·èã“,%·q/U´lÈĆ7¸Ó´Ã¾é † õb9åõ‘³¡®ú¡B!÷Ã5 »v+¡µ*S#[y…<ÊÙædï® Ñö2Žò’–¦¾-×~ù¡›(èŒßM³èÛ«€rx¬¹ZhY KØ‘ZÃ2è¬4æk0ý×èÇ%ß +X¬1ªíìD¼ œ‡göŽÊ õǨ#FQ¶ø¯˜Ï;æé‡31椓U"y§²,Dj«W¶š7×:0mÅõ@fvf U~è»YMÒ kCÈAy³(ÊuŽëÉ>œ (å{¥M,ß·ß{†+s²®gúªÊ\ÿTAh¤ƒK¦x‡ 6é¡eb±’Ø}ŸXt]óèŽü– xA’É áxÂu»c]—1/öe{U¥10FkW5J,0 HÈ™÷ªü^­dÝ^l€‚@ÌXHøÀ9*›[«Êkí·y‘Š—0´‘¨­µýîÎÄãnôå "<³f£ ‰¹tRšht#L¸£ +Ã{uØ9Òp€œmÿ¦#À>'U%mƒêó™FÎõÚZBí¡›‚Ù,HR7æßÿŒnZÖÂvˆn~ñíètQ~ßNKT¡›*ÔÕ|t Ò—!ÇÍ/ïÞÁÈˤ +½LêØ4”ᘠ+¢ç±ax˜öG™.´F Y¤Cáš“dmÇÌÒINÁ×€£K|ÄäaÜÁ~´’ŽêÎê{G”;vJ}À‚¨‘5!8¯‹£ñDÌw‘È¡Ë0H½2ÄYî•“áº`¢X—øn“¥óKìž<‘F/±zr Ù' Ï>âæà~1¡FÐeú‡Á@fáI‡ŠÑãÅ!5‘7ºf{À†³"‡dïW“¶äuRßL¦oiÓ’`]è"*'’±˜þ„×OÛ`,=E?ÖZõäݸIyEÎ?oÊá-Ù‹››ïFßqqYóüÏ0õó¸ð°v:€Ý’»÷DÃígÊMÒóWG‹‡6¯³pm cë9Ëa§Š,PÊ 1Džs‰¡¤Ã¡¹/¯áã + ‹lü$øqì\rtn1™”¯6UsÏÌÔ¢ñ*‰“ÄëfÝÎÀº­@;—KÛœò3ö\?TçýyAJËñ#Wùé/Ë9t2­Þ³ÒØn"PÕµ]dÀa]2k@€îë)S½ÈÍþàdñœL‰Jàîà¥:%§DÚt +õèÌ›åOþßx8 òåó&<íP­ŸO˜¬¸ùþY“-ž“ÑUAæ^B&¶z (ø0»«î›iøáÄt +££×`¸Yþ‰ã!Þ¿í7ðL%¬Ò’ò¦¬pçÕ%Ϭé2ÌãœÕí]ƒa¢/;ÞŸº—.êáw׋¤·—<Ð3ŒoMqd#çýs³B‰›Ž€½ÝQ›9L¤Æ…²$lCÀ¬»U>TØøi蔣EãÅ+»`þäå x¨»ÂV¼Ž`“VTŸtîáxK(ãM8‡“»Ý`ÀÏ=Äø%ßM#ÀXD ŒÛ > ¬ë]ͨ-è)ëdPÇ䩦,õI)J(*ðû­á*Jñb‰t!-¹^+3Ô‹â=ªN dH£EEaC1í¡©ã“ò´ ¸ËUÔK„*rî1pv^z<'H׋Ù¤Œ`DÎw “¢.du{‰4'4MMT´ï6N›§‘Îù8åñWŒM9Uõ<ªúÑ´¶9ÙÆUWÖÒ#µ kïÛ&¯å¹I`y%/.ÒéÀ_yŸÂoÒ>]¤qÓ¯†4ýÄdFÄë+þâ-¢¹ƒI‡TÊu ±Ý-œ~m@s$¦|œ­äiˆÂ*Í!‡ð Pò£ø0½w[ÞWÛ‡ºÜJRÆ»IfìçÑJ:l¾Ð r¢š‡ÔãàÀ©™ƒ~øã¬ý_ÿÿd¸K¤Avüüˆ –qŠ-ôb¥Á¡½ÿB[˜åendstream endobj -1787 0 obj << +1858 0 obj << /Type /Page -/Contents 1788 0 R -/Resources 1786 0 R +/Contents 1859 0 R +/Resources 1857 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1766 0 R +/Parent 1841 0 R >> endobj -1789 0 obj << -/D [1787 0 R /XYZ 85.039 781.388 null] +1860 0 obj << +/D [1858 0 R /XYZ 85.039 781.388 null] +>> endobj +1861 0 obj << +/D [1858 0 R /XYZ 85.039 761.463 null] +>> endobj +1862 0 obj << +/D [1858 0 R /XYZ 85.039 584.016 null] +>> endobj +1863 0 obj << +/D [1858 0 R /XYZ 85.039 555.705 null] +>> endobj +1864 0 obj << +/D [1858 0 R /XYZ 85.039 528.607 null] >> endobj 742 0 obj << -/D [1787 0 R /XYZ 85.039 650.202 null] +/D [1858 0 R /XYZ 85.039 291.786 null] >> endobj -1790 0 obj << -/D [1787 0 R /XYZ 85.039 621.404 null] +1865 0 obj << +/D [1858 0 R /XYZ 85.039 249.438 null] >> endobj 746 0 obj << -/D [1787 0 R /XYZ 85.039 591.638 null] +/D [1858 0 R /XYZ 85.039 205.963 null] >> endobj -1791 0 obj << -/D [1787 0 R /XYZ 85.039 562.043 null] +1866 0 obj << +/D [1858 0 R /XYZ 85.039 162.819 null] >> endobj -1786 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R /F14 969 0 R /F36 955 0 R >> +1857 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F36 955 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1794 0 obj << -/Length 3869 +1869 0 obj << +/Length 1971 /Filter /FlateDecode >> stream -xÚ­ksã6î{~…¿3S«zP¯~Ëî6ívö’\Ö37¶³£ØJ¢V±\INšûõ‡%êa©Ýxv6¢H€AÚYØðÏYD¾e{ñ"ŒË‹¢ÅæéÌ^<ÀÈgŽ@¬deÀ¼[Ÿ}{À¨mÅv¼Xß·x|KùÞb½ýeùþÇ‹›õ÷·ç+Ïó–Žc¯Â0Z~>w–ÿ~wÝjyo·¯Öç+gùñꆅ÷ïo¯.>}>ÿmýÓÙ÷놕†‘?Ï~ùÍ^lçŸÎlË‹£Å ´mËá§3`Äò•'ïùÙç³ÿ4¨xL-xÖØgû^dù‘7ün/0¾Ûq\ËsÜEèÛ–o+þðïÎW¾ë/×)7^²Ý¶x©ø¥ÚEž–ür_äy3RkøÛËË›÷WznýÈ­D^á ˆfá„–¹‹•ƒßí2ýóVµ ,„JZo{46‡²Lwøœä0‹ÛŽËsn<»¬.ÊtK4í¹¤®ËìîP§•E£+“%Ÿ@>÷¥Q¥å³þþ2Ý癦l|êNže™¼róóÍõõ§/W×ë—?ùxuyýåÃÅú☪ºÛ$uVmÜæ2š «©!œ½‰’DPÛ"íËWC‰Üî%ðVΰ3”&é¬ú;ö«åÞZɞ׉_ž¿w$ço/ß#«ÀrCˆ5nlžK¤IØn“§†0™bŒÜ»Ñ²Æþh™gUͨYìA 8ËìWÛQZÀØM3ŸqfÊó+žVö¾‡—ø«5-ϺCÐWnNžÎݺ´+b*Ùi0œ.¬ÞÙ` Ìáü'l­ÄÖX¦ÄÁ-Ã'ì8€€@\a®1ó`Wˆ&çNä:¹ËцæUås?ypý²†pბyŽšOÆú'©—:V¹§áVpÍp*Èúý·+w‡?é„?kš?"³ëtù{"á=4Eʺy¡€ ™Ö6à?Š,e`{ÿ‚k†ÿµË·ÏžçÚ–ëžFý×4{žëY -ƒ³i¬ÇW“§ Ÿ?ƒ‚k†A9WÁž£g׌‚™ëÜÞ’··¾OŽm²Š·¬¾â-<_SÞ·S§f”ì9ã¢/Â$ÜuKãd‹¯×,Ïtw#&Ñ,JTÖ‘•G€‡›ûM}Ð%]ÛÈ×Vc…m„¤ýüȲ}÷¨Ûn8âá~º±5WÁfsÆÔ˜ Kc˜9C› ¦í¬GlÔÌZbà«ñ†ÐÍ5ü¹þ4´±ØŠQã ê7˜£šdÓµ4 6ù†È ¨¡À}÷ŒiTÓŒA^»ÊdìãÕ%ôµDªy7ÙÞ{‘¸Ïµ¸:8#fl'1µ= _9nh…¶×)Ø_ð™vïj”Áª´ù -^¯¨3Àeîñ™‡—9±) 1®OÁµ2\× -€w˜¬&4j»è XTÓœ¹v`¹QÐጮ! / ¸x _ÛO+p§yÌE8±ZMû踓Ð@3^b’ ¸‰½1?aÒ3ͶͻË&Ñ£ìêØ[]‰rüä¡j^TšËHR¦ÜØCOq¨Ÿþ¶ÅpÑ#ñâ·½TÂF›ä“ë6BåÑüÀ AÙ?£hB!4§)‚Z!}z£ -1èI"ïm^©Eñ!¥årb»:wyÂÁ8ï w´w¶Û<"`I7i '»-¦a7G¡¿5kùN`JáëK§‚kZ\Êv¬0Š;â÷7JÁú÷œ“ð¦qÍð¦bº²jòÖ‘>wƒ—aOÂàšá.²Áiv íòvÇUkü÷?aL×l:ªtc*Á5ø*A+à„ÒˆYk¾HÙ÷î¥\2jáqM:…@ÂySÔ\+ÙHÔ•í7'¢AùÁIxÓ¸¦ys¼àvxÓq«›!Ù–Š¢Óp&¸f8SåH&gúÎðXD Dé’‰—A_Þ ±Ç£«ç€G˜ñå Ì„+g˜9O>AM;ò±Q?Þkðškrúj ô6ç4âÏwZ<Í Á¢ìEÅZé(Ë9Ë”Ø|¯g':*uÀ)Ií²üŽú0†`NK-ЄšhNOSµ¢úôF5eÐkTÕ‰­mN¢åm¦JœÉø¶w¡”ŽB›™§KdÐn ŽIÖV¢Íl@   É -Ðœd§jÉöéJÖ gJ¬9»NÛÉÁ›®S!®Vñ:UwXÝRa]Ö%]’úkcØ¥/:扨|?Üâï<äîÀ—ƒŽØpÞ´ ´0Ç-@`f `Ššè¿OlLý1®tyx*<¼ó -‰ˆ zmQ¾áZ£šf ?tLöØ1ï›Ó`´·kÁš•gKy -oeÿ“U®Ú![tʃ>Ÿ¤“åRÉc— ·=IžkC´¿ÂÙžþƒ@1¯ÏH sÜ@fÆ@¦¨‰ô‰H‡˜o'|ÇoµëëQØÎèÖ{8rb‡æ-ùhióƒ++ÜNlôà+Çâ&vë þ3³u¡] Ÿy.}Ëþ¹a÷·?äøy“†tC|²µå&›4è—aÿЌ뮡|TH'aø:vz€³%ÌS›~Ý%7Pî2¹É„>Í£Bl* u=`Ÿ’škÄú.võƒqtü—7è7Ãoj˜Á@õlÓ¿úP5冠ÝÐ:Æ‘”¾þÐz4\›TpàC§š»éð±Ç.Rcÿ‹^×ú¢-±Ó;/ÿ¦g㎑uÿY oúqfó“SÈà#/>r5À Á(áàǃ òοÿ¯ïyøendstream +xÚ­Ym£6þž_‘o›­.¯œªJÛtÓnÕ&i6RU]«gCK`‹É涿¾3 ¶U«Ó3ãgžyìpÖØ„?Ö8ð Ó™ýÀ2œ G§‘9~‚™oG–´˜J“©fóõnô~éùcË4ææ|¼;Ô~<Ãõœñ.þ8Y|w·ÙÝoo§ŽãL,˸ú~0y¼µ&w?~}‡ÝÉÝíÔš<¬¾%[¸¿ß®î~x¼ým÷ýè~W¥R°sÌãÏÑÇßÌq 9?2 gŒ/06 ¦O#HÄð\GÞ§£ÇÑO•+šsÇôVײ•ÅÔ1 p‡¡ñLÃ3Ý +×Ö ±LËpMg¬Œ›_MËo¯Î2gFàcÍÙU@esÑòôˆ–m8–݈¸eˆñ)/Ù2Éõx™páø´Ä2ðØžOJa‡S afOl•—ÉƯ÷Ÿ©H¿šžI£ír¹Qæ«jÒê+ží³a8k›8¥Ñ›p¬álEì†S‹xçŠ}.7ÂŒÅââÌ“°Düàæðzÿ¶ t•€pE·ðÍæ3Ã1ýAø4›~ø”Ñ[ð ¬àkGì„O(A[¤9ðü ÖÄ["Ð õú?o67ls> ^m3ž4z¼€5x­ˆÝài‰{Ï°æôu}‹£)Á² +DA¿> \Û°¬a*“ÈæMú£Õëo†ë^~N_ýz–oÁ®¿¶@½‰À@À‚VÄn ´ˆÛü\2B›¢`\õʦ@éÕ ÑBW +Ž³Û>Omß°}Gì„f@ ¼F·àÕöíIǨ{e’ãÃ0¥§ÊŽ.-1­—[o6 “4Üc ¥2Ç+¼M·¼|¥º{‡Tw'ø湤7”iA·gµ¹±˜ìö8ûJãòXgÿs’aú9N_ðN6œhãI.,OÉ·ò[¼ Ò‘è¡›ç¹Fà Ÿ«4›~º)£·è6°¢[;b'Ýôˆݨñt©!(á^Êêã yÚÉtþ¬hz>ßyAƒ0MièŠ!ŽDqùvMÖª3> 9«”)à Ðd¬®²r)2©²_PÁ£6¼ŽïŠ%x¶køÞÛGOG,¼ëà9U®¦µ¯ë"8¾o83KÅCä8ɼ⢢77Žì9ÔͶêæœÐþ™¶Yâ6¢x>±òHÙÅd ÊW*œè²${¢gÏšL‘{ÌJ–L'’"ìYRý’+d_ŽÒ„Ñsn8L ;žßçëS°· $#áŒsš¹úsPÒ§„×GÊž‡d–)¦\èqt l©5V˜ÐIש€%Ũwx›È¸¡¼DESM…à÷’8ºBØœÜ,nh¨ª˜²k0• +‚ÂLtè¬ê¿ü!v#ÛA6nª •Æ‘¦B2®ëNîTgVÊ>ʳÓÂszt”rO…Ã{Ñ]Œø =¥É)ÉÂ’Å¢pï—ÎLëX…ë3‡6ÅÀÄö&ë}b+ãp âÙ€W W†' q“ÍI€n…hY¾av2‹W>^’°õ2/!nXÄ2¡g8}‘»ûÏ(ƒBÅTjF”œvy”+Ú2þœgÒÛ%ýIŒdÔ—0MâþåæûßYTU]k…×#S®¥CüɆçeìÏ3ãe;´{Iò3O_U4µÉ”ž`íÁH‰ø„5@œÉØØ‚x=¤á—CU¼èˆ¿¤¯–•¼ƒä +Sž%e^¼kÖÃîë°‰ÍV|mø´Zï–¿|ZovëÕ£ªqqŽÊ3ì*×±€îƒÐ‡\";&ä’ L&MeAR¤N„Wç—®¥;èøAðä™*Êž±L•G7nFÚÝ@ámNVi}ù…„ ¤­ªâ)á¼Zý%/â/¾’ @/ðÆ»H‹ª9¼ÜF¥‚P(YYç[ϼæjR`Ønò‰“CÕÛº7ÞŒµ—¡KUlÑî*qy½°4Õ(£ºˆC?uUIu{†fµ$4¡Ño=kï/΢]¬‚T„÷ÈHCBr XaÖˆSS©W)0ùq<$‘Æþ=|bü_0O×àPM˜\?Gã¼Äy3ò؃¥ê? +¡·lÏi5Óç +mü¦“=˜u²àÀʨ-¿Ñ¹(*Pa#8+”\Vœ—ª"•¹Å̲,’=âÿôµµÊÚÂA0”Rô¸Y¯Pzú°Z®?}s·»ëiØJbyÝîRZïÔFö¸oiu‡¶u숇6ÌÚsM]½Y^q½Â&eaÕ'û×ÚuOñõž­Žò²\´©û®}ôÐÊBJÔ Šø.ÒVŸkV4H¸£?þ ’»‰v®ïòK CØ¡oy…sÒLª>ûpw%¿E~›T¬/ÕN§¸MÛ(V­fWg˜ ®‹­‰ØEm`%›,,øZNU;Ê¡=£²Ú‡_»‹u7o¢öœ°ˆ51‹Ã2l¥q)òìÉèùÖ¿²íÎOð—âþ§ÿ1©¾WÀWzÐk3ß•¹à:ý«OžðËæ:ß¿e†¡endstream endobj -1793 0 obj << +1868 0 obj << /Type /Page -/Contents 1794 0 R -/Resources 1792 0 R +/Contents 1869 0 R +/Resources 1867 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1766 0 R +/Parent 1841 0 R >> endobj -1795 0 obj << -/D [1793 0 R /XYZ 85.039 781.388 null] +1870 0 obj << +/D [1868 0 R /XYZ 85.039 781.388 null] >> endobj -1792 0 obj << -/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F14 969 0 R >> +1867 0 obj << +/Font << /F57 1075 0 R /F42 967 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1798 0 obj << -/Length 724 +1873 0 obj << +/Length 3172 /Filter /FlateDecode >> stream -xÚ¥UMs›0½ó+8Š™ JñqtR7M¦uÒ˜žÒ0`ÃÔ†p2ɯﮈ'vséxlVoWoß®VXÚ>ÒŽ4*¶ÃHrEv¶³„½Ï¥%‡wqbÎëÓ—¼‚Ç"¶“õæ¾Vv’ß³‹¯³Ûd~ç¸J)&%wÜ0ŒØÒ‘löý|†°ÏnauwµHW²«Å%ÅÂz~·˜}[:ɵ5O&)SH£Ž?Öýƒ°sÐ|m ®âÈ~[p îB¸öÕ°ÞZKëÇDE>ߦ]§ÊÖ*â:RÇuK}P·T1Di;Ô‚ká›ÂS(#Ùc[AuµãE¬'¤Ã2‹ö ¡í–ðâÒ:‡ßmHÄÖ`7-Ù5Ú}õKH¬ ÷¥=R75ô4P[¦;Ç Ù -ihO¶oaÑ”}ûByö]Ñ‘¿/‡D‰ØCðŽ€fM±í‡^¸[›Ò‘¶"ÖõòM+Ø}‰Â0Ià±ç²Ê0²$_–Öd¬ÄÔŸþ&7­Gr"Á¶êzB›ÁÛ m“ì©ÊŒÝ‘£Lcå¸Ø]ã3ùV €‡,Ûhü9ùͱTõØÜSuOª`fëÆt‰28ˆ¦¦©-SdÈÍ ÂòOĈ‚-SÁ›¡=ÛWäüý„Kéq%=;1tpr0Ç÷ ˆÓ?L/âALLXH2*ŸKõqB -9Îwò"äKÌ”‰€uÕë`U=‹jl)Ý¡A)üHZN-Çý¦c4{ro‹zÓ—dÓ=3æÏÅÕßôyNغ2t}kŽycøΔ¤]}É_i.¨“ìxDV8ê/ýXÔpòfpa/‡¢!¦+Zõfå…ɘµÕ#¸ú¦=#Üè‡'JÍ©À#î@øIû”OŽÖ,Ý´'bþªÜ‹O=|©Àÿz×Nÿ ¾â‘ŠOÏöB˜WЂ Ä{¹ã+ùHï_ÌŒŽendstream +xÚ­[moã6þž_áoµ3W$õºß²Ûn»Å^²—8mqPl9qëX®$'—ûõ7/$EɲŒnŒ¢±DŽfÎ g†#­œ🜤‘t6IR)tšNOÁäf~¼†bnHæ͇»‹wŸ¢d"‘ÙänÕò‰DéÉÝò×éÇŸ.¿Þýp3›k­§RŠÙT¥”A|¨–Õ(T¥"¡“̇Ê:äEÃ+Ö±Z†W†¤†ÊWP EhLj÷ºL Ä"ÒQ–æ@b×$R -UGâ®b'ÄåÂNíË1ö+_ö·{áuc˜ŠD…ŒÖäêõ^’ÕUÍ·Ã3¼NÀƒ<um{Ðmhsþúû1o 2ø ǽ¥¥ñCtÒ[F¶ÞÒ“8ì-žDˆÝU"RxÐãõí60¼NÓRiÚvÜE¢LÄJžžáu^¬Dš…x+r(C`¹,W° Nyÿ~lóÜ\E1å™äá§/žæ`ºXØ$VÕ<ÎI¯å~³d.Oá8å ’rPSVÅò˜ý CšKˆ2™.™²6xätIÜ“inXÐD]çc€놟Á¿2ë`–å¾± ŽÊÃUcI" U* !ÛÛ”ÒCB2Sò¶·œÆ‡CÂ4Òé0HcÌÎÌpéPeÊwÊ6ú@ƒ“…:4ÃiQ´^Ø¢_4ýŒ~$gí0PÔ¡Ù3ºt© ¬Ð6ui_Ä{±®é4ªtÂ~_ >šÓ ù¥³<^4–ÇÖ#…â3D~)1èÄKðpc‚’ ³Ú¤gäTn·Pã2PÐÞ¥P”`‚\RÁ›•à€K‡„²¯JLœZ‡Ž³/k^Ÿ`sª\š=j7¯<Ø-8ðpk#0^ã¸9å›®…œ +8A‡ÛŠX¸ ¹rgsd. ›³NÊZ¥"ËrF¼1è^sÙ@ØÑ°GZ+rÙ5 σ•Y€g"SÕ?,Æ÷Uëì^evµUzè–×8öPÅ¢«åãy'ŒÊQgAgx@C†e_/µY=¸ :s€›)Õ‰=Øùw“–åø›NgÕõú~Sðm + i-G×ÆrD“3‰W„ÛÚ‡1–!•lû íÿ݆ÙáËjéµEýˆÍ6×ú@‰8ÆÈ¥õ8Yâ‘»É! -™äŸÊ´aÀÝI¯×;뜇¾vDÚ}x4åë–¼0Yo{ه̡ÃKd0,)©ã/ïÓ¢Z±¶9[±Ÿ,™bo·¢Spu©®o@»WL[í¹¦ñ]ÍGÁ7w¨B–­H 9yßn×4ÌŠ‡ùáîBEÏò“iné01÷_ö¿<šãý/Ktªÿ5&Ðõ¿úû_¾D[å  z!ž ìv +Ûpú°®Æ:â‹ÝÍcϳilÖÝWß±•‘aÍJÛ¾­ üò†œeP1½#¤ÅÞ鹘íbIÞ›–å1cÊTDj¼™éÑŒÓ4æˆÀÖ˜=‰ÃÆô$òN•QO} q"bïÉ75 ¯X“@¤iÔÁº)Ñ^ïó ûi›½Í®1X}ÑY[†@ +×y͸†KF›FìÌ.¯8Ÿà çðÐ&×hºÉk3uó È®8˜ÀíA0±u»žøƱhGœIeà *u&æ¸3Y¢SÎ4&Ð9S_â 3ùïìé_†½†?×__W(zoæ1Ãë +æuiÑK8éÕõÝçO¿¾s èØ9°Y^ãØÔìqÔÕâç«Oè+×^4,Ùm1›÷²nBÚ@Ü ‹Ì§¶*„¬•Â6Ô¾û%“ßbF¼0E{RÅRh¾Ít†×Üc6ô–#º«!:n:™*q&dÄé.Ø” 0ðqš­~lçk)T$Çw~K3²ó ÑÉ?"°Ýù=‰Ã;ß“è;a{Ĩ\if3²í¡óÑMFùCínÂbcfè-¹Å²À©­÷¢Ï‡$<Ò›v”ZG¶8Osþ±Ô®8|Fãoµ=š›¢“6ØÚ¤'qØ&žDåÞ¥=¸5ÇD÷nÊ(lmÏ5ž))ˆì©âvïÃ:…ÖŠM´¡bÐlÝÉÇ«índð×Þ"¿½…cxkL'øiFÒÑØph •â¬pl–×86ÈœJK›2Ä7ãßuz4ÇC´%:¢ÇºÝ—8¢}‰Îõn•¹~º&&do­’ÜË +ÂU/ã5®‰Ñ¶®ü—Ím´×¦õˆ{Õf\ïvO@nÎü^3’'þÀä{ÌT´sÂRŽdÄPLsÒNÇ¥µfꊶR+Îéo$N®mÌü²÷Õ&5Ûí{þNz<¬ß‡ušfP<-ÉqšS:‘ætÚ7¨SO\§ÈpŸ }¶¤µ'ÿm_-«qœ±‚ËØǹ¤Ogãc!´u¥l7P OÅ‹-ˆ]«bmM«ÃÃ[ÞpuO/‹cÑÁ‘7=ñÅ¥#ù„ŽiN~Aw\Zû]WÜð÷s­8·ŠíâÐâRÈÐ_ä,άÆáEÐðøGâhèAêΦ §õú#Vå·DhØý¢ÙWí„‹¼OyU?æzËb#}\ï ö[3Uœ>Ò „ʆÌÿsÿMÿªÀ¹ä®TgÃÊŒ ïÇIh° .“´×þーÿ(ÆSendstream endobj -1797 0 obj << +1872 0 obj << /Type /Page -/Contents 1798 0 R -/Resources 1796 0 R +/Contents 1873 0 R +/Resources 1871 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1766 0 R +/Parent 1841 0 R >> endobj -1799 0 obj << -/D [1797 0 R /XYZ 85.039 781.388 null] +1874 0 obj << +/D [1872 0 R /XYZ 85.039 781.388 null] >> endobj -1796 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F14 969 0 R >> +1871 0 obj << +/Font << /F57 1075 0 R /F36 955 0 R /F15 951 0 R /F42 967 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1802 0 obj << -/Length 2123 +1877 0 obj << +/Length 940 /Filter /FlateDecode >> stream -xÚµXßÛÈ ~Ï_aìKåö¬hôÛôaƒK‚-ÚM±ö]’C0kɶP[r$9›î?~äŒ,Ùò¦-XÏ’Ã!¿áHM<úS“4r½`>IRåi:Yí_y“ qÞ¿RF"Œ7 -C0g–;‹}× “Qcc–¨¹„ -2o–¯^¿ó½‰ï¹qL–ë‰R¾(ÏC7 ÂÉ2ûä(:‹"ÏYèý£žÎ‚8v>ÞÝ/0Jœ»²ÍëRïšéï˼z»ììsVшGÞdænø/º'Êõb¿ï® -iñÀ]Ú¿òçÆ]W‰Ãï¦Ê¹ŸÎ”³·ßMÏÑQwÕ·¼¾æ²Qö¢W'öJEå¹so>ðÊOÝ$IØ«å6'¼ØYÁŸ#¹P×y9õS§ú‚Hz?õ磞p5‘XFÔSf7â'NŤ†Ea7à'd@9b=qVú ¡ Ø! --Ì=ƒ9m%ÚŽÝÔ$Qôß(ªÖ"ò‘H’4‹õ7l%¯9 p² - )Ònáq /§Ùê:—¡ÆÝã~_•B.9²ƒ^áuU‹ø=sÚ7wB(Y2u¾)š¶Ö-öVA¬ ™ŒëœƒSípmQ•îtúPÏ÷ˆ]‡Uåì±@ïh¿Aà º6Rî •u>OaGª¿ ¹àx¼~ÄýôH\•úŠžë¥’¨§/‹·¿½}øòïÛ‡Û‘¯Êóœ¿S"“o‘ñ'K‚ÜòÃC_âË?ïK!ü>r?°róT” ›¼¦ú¸Ña] 3 oùåáÓÏËÛ÷cFÁD„OvŠÃeµLþŸõ׬¼ ?©Z¢Ó-Êͨ[]8u¦V”Wz`è³ -ÂæoW7f"ø¿þ(Ìb×O‚Á©ßör§Ø#±v¨½ ”Bÿ.ˆ@£>‹‹Viùù6(¿wE&S:BS¯$:,Íž±¼mYnóB–ÎÌ°ïð§Í®zÔ;9f›Æ½ž'ŒMÕœ€9N]åúç„àGñJYý•3?J.ÞŸl¯ƒÒОnE¦¬äw9MŠ8I½©ÂŠ†YþÙSai6“…1·šÔ2Ö²`M9¡”r~{K㣲sPT¶#Hú‰†””wÀµ±¡ª‹MyòFsx»ø÷â›åk ØÚLcÞSˆ=%Ø“Gœø½ùë Ú•¤3gÁ}&#\àlj€>MMmyfZSZ¦Àõ^üÀ¹ÏÛ7˜ -R¡ìZ0˜¡t%7ÙȵQmr:é Sç×_ƒ¸%8·[]·ˆÅÁ DùY|I쉣‹íDL#9ZvshEˆ¯>âÉýaö,{Aìté EÕœìšM ÁTäÑLŸ -Rr¹»ªÌû9,RÎ#úes!bm…ÒêÍ&7µ.¥WÊñ2]n¡†îEA}B˜$¥sò°•~ƒà 1„JÖ™LÀÐ4|¸Àþv+ä¬dVj³­ õ$3bçt– ï«Ö¸a{ƒ‹ŒN­DÓÄ4&©iCR®OÔ|^¯{yÄÃD…#šÆ…KË5¿îžEôÚÍXz²7ïU‚˜ç^Ãh×ef\kNŽT­a«ù -Yº«XQWq™uþ™]Ô¹ìA ¹# íý_àùg:Kï£G¨¾ÈªÿîºûUR.T¦®$Llp•Þpo¬Ñ™Ñ€Š›^#Å…OˆKuÜIsŠnۜ˚Tø ¤¬»n9¦#Æx˜Ï1>õ±ëJnš¾3H¤ÄiKUƒ$õÒ(† - I‰ßa™cy¯÷ü)ßaor_öi›ÔßDâÝœ)cc[¼x•Ô&žÆÓaeÿt­•ç‹mn6¶ª8çÃäÈÂôì„@9•Mä4s™›Óå›po-ä–öfdÉî¢é·û¥ð>{‘'—urÙêsŠEÊh¡*Ë›V&”+/ì–2©YÛ¸·?†îîуŧ`VaßÉ«cûŽ.Ò`>Þ9!µªÝN‰qä²w.» 02Û“—%±LÓYìt-„Cïf¬ù!Úu#¿’íbˆJù‡¡ó±wV×Ú—¾—ßlê'sy ¦g ž‚æiG¨[È%…1??!w¿„ÀZÖ¼ÇF;ˆ™ƒÊÖ¼T)_ ^Û9ÔŸ”„¶âSÖu\lßÒ^¾VoÂÀùŠCÈëgÌ|è±±H¹Á ’`d®`Xȧž{ÿƒd®g ÝË³Ø %·öäZÆZ-ÓG5E[XkàvEÕtV‡2—¥ÁØOÜ=%;E¤|èÅÔgh[*˜VåŠÓ'åN”#ߦâ¯Ç¥ êyI…,®«½Lò^„žeM“þG ælµq³¶ '))³S§z¹µ2ßhªD:¢0íá_j’£¯rÚ9|uK [`7]ùwë|µ…|<¨– ,²g ï«cmßé8 žL@ò¹{Ê‘¼1Ñ,²’¾صºò=¯„d<q÷Ò«¥å§KŽ/­SHó½®ÿÃôLèÚÐ3ŸR¨\"4GÕùy+%2knÚíi²ô„š—F»ý°ÃÛ|ô4¿sˆƒkEV15± z'Ú¦÷TjrkGÌUe>õ¬Ú<ÃA'ó³Ü~8 V7ò›å:Ã%Œ®´pg02M㾜áÉ*“˜ªïa˜°7r/«Þ“Vuy¬z£ ø×µdsïe½Èú‚ûk(´Ú´ü˜ü« ûñräd>d(O~÷BÂÓc+%ë^ùHK}åðíÕOµäå‡ÚÀ‹Ý Š28«s{QºQ\7ø'ÙÁÔdendstream +xÚ¥VKwÓ:ÞûWxiŸCt%KŽíe)ÊÐÛ殀…;©!±ƒãPʯ¿óe“¤eÁéi$Íë›ùf¤Dùþ”ŸÆBêÌOR%tšúË­'ý5hÞxÊZL¬Éddórîýó:N|%E&3¾âÄÂÄÚŸŸ‚Ë·7ó«Ûp¢µ”á$IÒà.TÁŇ—(6Á œn¯góp¢‚ëÙ¶…óÕíìâý]øeþλš»TÀf˜ÇwïÓéó;O +¥þì¥P Þzˆˆ¶çwçýëB±Îøìu®ìÞb¢¥HSó<5±±4Ž¨QR #µß!7Ÿ¥JŽ«Sr*Ò8õGÁN{›DU$´ŠŽc™Ã‡Ž“$èîKÞT¯Û0JƒÃ¾ÃS,ÂI”%$[¬ WMËûœ5;µUFYЕØC«.`4’°’Í›×韼ïAž×|nH “ƒV°áóE$Álöè×±ð·Z: n÷_›ö˜(ìuFDa,#+÷yÍ뙺PÜXuÎË®W¬ àJ±`£©Š%à2P×çddlѵ­do\ h26ßæÝ-ï+Õk¶&dd‚8_â—Ò]1ÑÇ “{ŸðNjÐåOäÍ —D»F5­¹&h q¿#ô¦Þ[ñ.§|¿ukX7v¿}=»¹œ±þ#Y¦IB—D_9zå¬7€%œnËíkYv?ÌúÚ~Š©öºé0ÜX³Ì»ª©aÑÁ]NWf˜: +–‡¶R$dˆýÈʱ=?q®TØïGý"öGkeÇÜ +eî6¾£öÛÐtà©°©áøbÀE[æßXV0Nû½©è!p¹Œ„D–C%X´¸8g@®ë€lqß¼è9ì9*lܪ^–iàÄ é]õžt¶¶/Ãf0|À:ûÚr]ñÍ/Û²O|}L§™ˆdöìƒ>²yúAïþô ?èôcijúqNÓ‘F@á/»Ãâq-+h+ÎFª~{÷A…Sé»–.öš›²^“šéRÃúßìú9ýªWW,[56º A´¿aÆOÜ¢‡TC_’n¬Ë×B,p²Ce¿l0z§“9žIšÆ}•t‡f¡èm¿ä§pw]ƒë ;Ú-¯G/2Š$/«Þƒå]ΰ?¾Â6ðÔ Á‡èl×áŸ+ú«Ÿ0nX©~brâ(ÓÄØ\Á$;N7Ö©ˆS}šïÿæVendstream endobj -1801 0 obj << +1876 0 obj << /Type /Page -/Contents 1802 0 R -/Resources 1800 0 R +/Contents 1877 0 R +/Resources 1875 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1805 0 R +/Parent 1879 0 R >> endobj -1803 0 obj << -/D [1801 0 R /XYZ 85.039 781.388 null] +1878 0 obj << +/D [1876 0 R /XYZ 85.039 781.388 null] +>> endobj +1875 0 obj << +/Font << /F57 1075 0 R /F42 967 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1882 0 obj << +/Length 1670 +/Filter /FlateDecode +>> +stream +xÚ½ÉnÛFôî¯|)ÙFÌ wèÁAì@Ek–RìÀK4E€"e’²c ß·Ìp‘䤇¢0à¾÷æíËŒäDÀŸœÄ#¼dÅÒñâx²ÜœˆI˜Ï'RSøç¾û#È©ÁNC×~t”F˘F2q<_"ÍÇÅÉû WL\á„¡7Y<EÂX8qL«[Kºö4„5W›eO½0´nf—sÜEÖ¬lÓºTEc]üvr¾èÄí1:¢˜LAn,ýïj†ÂÑH[éƒþáP[7v‚8ÑÚ:’õ½™ÙÒº´§Òš³Ö¶',•´¨žÓú-5³ï*ÕÓR2˜Há$"($àTˆ%*µX§ ‚XKTgÔuZÚnlµ ßâùÉ*{ +Ÿ«ôA5t2´¶‰¬ªAƒÿza| Lךv©¶ê¾ó"o‘í+sm+^Q>ñÑJeuµÛÚ§ê‘Á7â8ÃÓ×ÏÈ.­Íp­´þÍZÕ):£*19`ïI6»Úlh)V{µa¶j™"Ôµ«šÑ—iûq³+›HGˆÉê4Ë›¶VmnØ)ä·â}’ºU ‘H˱§‘—@$l²[ËÚ¨‚lUMú™-'‡±…Ë y倩o`²çY9¥üû /Ä^FŽŒ]¨G× ƒÎa­ÜÏϯÿ:¿¾ÿóìúì¤Âú²#OÞßÒ-®®‡÷¿Ïæ |=âèH9}Ɉ· D1­O 4šøPésgŸ>]ß~Xœ}>&‘@îöbòí½Z­jþø›—ǧUyä0ð‹‚pæev„ràO¬%ä“Iº“žßür”ÃÀƒÿ…ó÷*~: +{ÄÎá,¡DÌ7Û‚ÓÎó|‹Rþ[—mXy…FQéÁ)Å˳„–*òB u•)¿)È°´m‰.ûNšŠ‘ª·YQ=¨‚ClL¸o?wx¯](h¸aìHÇÝx?tWÈ JØM°°“Ü$d'±q¦O2‰Ò;4±bÚ…{ào úÌ8°™ÖUz'¤_2Wê„%q>·(^æç@xmK)-JŠžv¬Zç8W€Ã¡kGÖµfÍ]5òLÇ +O(£Î£ÂÞ[hŒÞ‘ÑÂP•§?Ÿ:X(‚2ÊwÇÖ"­Åu×+ñ«eÿà–û;lå‘6xÊ:X/ÔË5ìÂ3<£»0ÂʾQ6&ÕÒÌ]e¤ ¤Z«ÿeK3 ûu§IK]·¥éóîHá–<©È»èÅB×JÛ’´ 2i¹8hÒŽÇW +Cº1 T]b´4,«¦kû Ëp×—ðK Aüª²‡Ž«Ë¯ä5úT«²,Õat€ÇÖ1ö»‘#¾7œápócÝ2ÔÆô +ßO ÜØ.i‹F)$É ¨øœŽendstream +endobj +1881 0 obj << +/Type /Page +/Contents 1882 0 R +/Resources 1880 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1879 0 R +>> endobj +1883 0 obj << +/D [1881 0 R /XYZ 85.039 781.388 null] >> endobj 750 0 obj << -/D [1801 0 R /XYZ 85.039 761.463 null] +/D [1881 0 R /XYZ 85.039 761.463 null] >> endobj -1015 0 obj << -/D [1801 0 R /XYZ 85.039 671.062 null] +1017 0 obj << +/D [1881 0 R /XYZ 85.039 660.071 null] >> endobj 754 0 obj << -/D [1801 0 R /XYZ 85.039 671.062 null] +/D [1881 0 R /XYZ 85.039 660.071 null] >> endobj -1804 0 obj << -/D [1801 0 R /XYZ 85.039 642.326 null] +1884 0 obj << +/D [1881 0 R /XYZ 85.039 617.786 null] >> endobj -1800 0 obj << +1880 0 obj << /Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1808 0 obj << -/Length 3445 +1887 0 obj << +/Length 779 /Filter /FlateDecode >> stream -xÚ­]sÛ¸ñÝ¿Bo¢3Cü|t“\›kÎikgÚ™»$ÑŠÔ‘Pýûî@J¢}éè$°X,ö{ -güÂYžø*fYú*Ïg«ÝU0ÛÀÌ_¯Bˆå'q ï“ ;»H#?ˆ³IÙc‘……¯âaþòpõö§(˜EŸ¦jöð4 ÃÈWa4K‹ØU<{Xÿê…êz‘$÷°-¯*ͼ/{x†ÞªÝ]‡^Õlxôþö|I½ûcoÊÝõï?_}xpûËöiøq8Ia0[DÊW™z•ü4Íàˆñ˜ü0†¥'ä?¨òýp_®]e®ö#Ó\5L²Ù^/B¯äyS>Û#áð/ó—Î’°ñëÔ:"6LfaàAqBl”ûY–±Ÿ›k¦# -½ö ŸçÆ–ÕfSö†?ö0޵˚§Co×óøs…çÁ¥¡{œë×Kª`Hà*3ïep·¯Adȃæ:Ê=£ µ O[Jæ=í\DÁ„<ÎýëEÞíjEëy7ä -4D½d9¬ZFݵ5¬PÀüŸ9í«ÔÓü9×?Ž¸¤=ð‚®½^D™×žÓ†‡-pl׎O1g€¥î«þÞSåéf-»Ëê­îù¥iùIÇhQ| ½"ðy÷0>\Bg»ÅíÞ}¢³?b°– -qlÃ*öêê+ •òêµÞ³@>;Ûê5¿˜–Ÿz-s¥céMµšË˜î—c~‹àÓØ -'·%<2ïkïå¢cÙüû:‘¶$,<ƒ‚g,_q$§‘-J ?¾Ñ1º#~e|‚²«`9jã‘AŸ· {ÆýKíîL¹M´(刻$A@ð!³f+k«âÏGw°2øÖ `Åš·˜8ãºì«MCØH\¬>t:F‡€Ï o4Å¡÷„¢f%AÈÜ(lÓµK/|"%{+ïƒ&¦Ë&+]× ƒÒ¥ç ¹N#eÄ=a@¬xc?.΢l–¤!¸ré\ýú{0[ƒGúù -\O‘Ïžá=ðâ˜í®”{å¯úêþꟃDz¸#d>KÏrû!UŸÿþŽrúVÄl^ªPÞoATOüÞ•uùí:IP¶0æB Îs}ê=hÖ•kt0i” AÉ„}– òãwö…¨›ßªµÕ¡E ¼P½%)ü¢í˜ÇÞ•†Ö¢ÈoØvÛŽ©²vˆ›ÕÕª2õ‘gúí몓]’o{¶þQ-1yÿ-Yu-ð‚Í#¤-( ¢ýÌŠÆ{6´õ¥³ú ØÒI+¾kðé–7<Áyá4H9ïÛŸT:’µ3"øAž‰Þ?Ü>|¹‡S€Hz½{Ü”æ¤v`—ÇLj²oa -¡@»ß}¾{øðŸx“¦ünnø“A§ôýñËý‡=¢†ÝÉJØ©ìûGÓ~-Y~¨£"~—iÑœüüº…à˜ÖíNW€c2PMÀãÁn†ݾ{÷ù Pø·Û»÷Ÿ>Ìa)81ôÔx.ùI9U$.:[dm#bÒ -8z÷åÓ'F&[_‰3×ñõÐ[íG@t8ø!“}< ünÏÑ´3oËï{vø¨ô²ÿMõÈïŒÏ«ˆ4žžÑ¥ÃMNâ=k#"îGªhI§wKYeU5RgÛŒ¤¥Ì-®Ú¡{E[íâÃ(áÍ -b*æ1ëÁé:ßÓK@hm¨†ÓâPî½ÙáÈ¡7oø{ À÷ûÁ~WÕoA£. -Uxwm·ƒ£y•KT`‘È>?ÛWölF^žøITR°[¼ä:É|."øí|]¤~9çE -Áµ!›Š‰¯ÒÐíˆÔÁ¡»ëm" -2¦“éÆjƒa{æTócƒ@í`9ê=;T› -»ü‡“¹(æ¾_øùa|©´Íjð»ø½æÈTIª!ªq(BxyŽTAœ±ó8+i¢°àÉúë½î{§ú6û3vQ_ž5Ð4åOø/>D4’‹ƒýßZmý³µ€p /•57u‡º›Bò…QýÛØTùу?Ûd¶ˆ8W¦H¨âšÂð9„¼¯%•0¢í†]Ì`råžçuÜ%lQæˆ98ùÈ4Áb¡€–è(+˜ŒfÎþ'7¥Dä(˼9eu :]‹IÏyjd¸F{¡Gîwqä¢@ãaÝ;z2 Jt®esÓ‹c‚$Ö”ûï{ttšÝ+(Ó:K §Íds9[UA…Æ–õ .©°K¡ìGhËr„²Ï–ªË?%²âæVq Dï’öbø¼×äK—ú† Z’ƒÀŒ0“í´áCæ -–^Ò ÈFÞrªdlAtà°UžDŸZS…™QEõgì´°qHQâs+0aà%±’ ,ö^.ê,º(»‡H 3ÛF‰ ö(Ç -*H\0c1ãþ\8Dœ–ry¼¦˜XJ)Z@ïhqÂ×=ݸ9Ý•Œ -ì /1{®%(íâ6OÂ!íM#Nk‡léxÒ+;ÙË‚–ŸÓ&3š̨\¤ÆYÉg*©ý}LÊ2ï£LØÔGhj9*‘àÞèT‰—Ì ¤·ö\–šÃ”™ö‡e 0kïqF+ñ9}0œqžÞ“2›‡°<ªÖ¶5SS‰=ç©'ÊÙ6xŽ(Î]ñ秥¿ã¬à$dDUóF!.±)\[:Ád"¨Ëw×fý.ÃŽ¶vÃVO-"®r\+ÉÖ&f%M’Ì*® Ö'!PIkqOR‚g«R•1¶¾‘ØYõ%ýùZéƒöº+•Â©¸ÆÇHFXSï2<§¢žÂü¡¨K]û NVÿ`˜Ü¿8^—^$£22±ÜHO¸5²$ìi¹,»¬ŸxU%‘W0QF¤/6L*Ê ÙJ—Y.T CÕDnH”6U+®ê‚“/¤{匘“/¸œxTÇÂhI5,V]*‘Bpݾ¿¿áù¡ˆ±ÃÒ4­l7D€dº•‚º.­'Œ¹©:÷ajÖ}’T³¸Gû‰‡ ºqEÇJgwû™»¸~©Åü(¯“"k"†ˆtr{’4!'œ»ª¦¬ŒÇœ§<jÜq·³¿tF ìۦν໣š"+T­dS0Q—§y[” ™΋{­«Õ‘¨ÛůŒÃê( 츃(±hè‹F`R–€#¯y®( iÚPs™‹&œÞžQ5aoLÀ¥”çn«ZòòNÊ‚}çšœ×ìm6߈ÚHÇ™#컚@v…ëÙ"§‰Ø¶ÙÎֽͥôþåf,æ‘d‡Ž‹‡Ž£{7îædÔHäÍÒ˜ò¨)mS¤m0LW˜˜•Xµ ¸„¤íÝ%ˆfñ”‡~Ëú»\ZS ¼”6<]õ. è^MçÅ%‹B·F¿´—%ºÖ°u!ߘ;©¸ßNÅÌþ¬Ò@ĽŒpÉW¯Ä$ÜQ çú ¥ \WÝàêãkj çÔ–c‚IUb,2€³‰_’î&`ŠzAQváú,€qb~’fFùI!ºƒÀ8´D!AÚ ¼óó–c´´©qR Û&â†R$}xÚòëùK ‘Kb¯‰pϹ„Oê˘Ê9‰JFÂÐTUxX©püV£àÏÚQùQ2 ãÜO²ì‡º‚j1ÂuÙÔˆŠÄO"å6Äc¿§ö÷G¤ßÞË‘m®EǤ ”á:ˆCðVKð…—U465ÐKÉ -Æ ³ ‹"‡s…áY#Èt•å*ÛJ'O¼§Ëo|csÎÓißm€‹›²ä©³ÏÁ%Ë„ J@›]þ’KlgÏ“h&=­žøšè„ŒË ÐR?Ocj&QþC¶¸#d—Ž“ı .@gW@%„z⺊#?NûGå(ƒ ÷zRËr–@Þ»k×ýDVfá 8àâçÃ}áV‹Œ¯v¥Õ1Üvâñ< F92 •ôµ²~æ×. ±]n'ʉ@Ÿ¨±› -±7è˦¢{›—ú?ºµ$ÝòÂÇ\²·9’ëK”»9œ-ÓeðÐ:Ã.Ì™&)Ø?ˆ¢Yû*ÿ±›2‹j1àºÔ#¦>x »5pØ(0™ò‚Ào£þ/ô1¦×ÉKA¢Æä‰$ÉS³Bñ=2Ôu®á]êë’›‰5º+7£+éßƳËU>ÙKÃîqx16Øó ~86cu—§8ç2Ý`—.*‚Q_>(L⋨¼U-\»Ók»¤•§Ds|¿¸ŽÃ%çè$Ŧ9(‡½ÙÐÝRTä^/Hí’Éê©K¼¨p‘R$¯øœg^°w4~®ríñ¸À¦!Æd˜ß#s¤htþ5„* ’ö&¥EÍaK7¤µ»Æ·–feLKæXY"‰MßÚ•;²ðêÖ¡ÃJ1½-½veH2ôùOGš“:ÀÈñHÇ>žý®‚nÝŽŽµOµ°X»uÇ- Z}ÉûúÏZ€ËF7DNéÑúPeï¬KGþédÌ`èÀñÉmL°í¸Rî‚Y,a€;6¬3š/Kü,'#нb¥½Ûk^P»ÄÐÍ1ÍhôX¬ªn»ÖÇmÖ…ÿ=±k׺¸£ ©‡mðá)¶8» £Æ©ª­[â’Þ»ô璘ÃU÷?†ûδñσäqRœûI‡Jþ_/Çð¦2V²8ÿ,dI_æ©Ç‚Å*ñnÿÀœàý dPËœendstream endobj -1807 0 obj << +1886 0 obj << /Type /Page -/Contents 1808 0 R -/Resources 1806 0 R +/Contents 1887 0 R +/Resources 1885 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1805 0 R +/Parent 1879 0 R >> endobj -1809 0 obj << -/D [1807 0 R /XYZ 85.039 781.388 null] +1888 0 obj << +/D [1886 0 R /XYZ 85.039 781.388 null] +>> endobj +1885 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1891 0 obj << +/Length 2449 +/Filter /FlateDecode +>> +stream +xÚ¥Ërã¸ñî¯ÐMÔ”Å!øæÑ™ñ$»ñz*‘\IÕî– a‰1EjHj<þûí@Ú–ç’ÒA`£ÑÝèwCÍø©YžøAT̲\ùQžÏ¶‡‹`¶ƒ¿_(Áˆ“ÈOâÖg6—vw™†~ggq„Ç2S…Å +qþ¶¾øø% faà§i4[?XAÒ<ðó<™­Ëß=-–Ixë½Y,£4óîŽð¯¼m{X(¯jv ]]ý†‹Ô[=÷ƒ9,þ\ÿzq½vì-á,õóô¬€ÁlF~”…?•>…›ÆE2•^ÅpŸt*}˜Â¿é}Åò¯ÌöÔUÃDf‘«†%ö‹¥ò Ìódo„àßæï]¤ YïK;â´*™©À/‚b"m’ç¾ + ’ök³ AÂLyíþ(ƒmPã»AÁú÷ÛMm=#=Ux!Ú‚Ýr¹PZx• U°5Ì'DÃ5Q?˜fæÞ ‡ªmø¨hÞh¥íyî/–qyW[Ú2Ì”©o[&ErÖLÊ[ ]´½Bf-hÐœxsÝ¡MâìçÛƒ‰ œÈÀ=0šÕ®-]Hn1gÄî«þ×¹§›’•PÙ£¦pÑ´üOWiÑ"´2GAD=àÿíšY]!‹O7teTCŽ±Rá¹]Ïuõˆ8†ÏÕ¥F=¾>œ¹ÿ^£hQè (I{ð­<‚EÞü w 4™4˜£¦`gª)AÞ.ÂÌÛú{´BøV†0óƒ‚eøÏ"Yà˜Äüö?#VsÕóÇw¹˜"nÏ ì jO}-Ð'1ò0îâÐ{rJ‰Á›u7˜Òm;<ÿx)&ndk´qì5–ÞïÑeÈÍN¤ WìC‘¸´‡új׌ —{ËðßZ3F¬ï@æ-/Ñé ïÖú[¬”×;²À eƒÂ;¡ÙÁCÒ,ñ®õo¿gz[]×¼B]ÓÿÞð‚ò*.öÌHX3<ðUnŠŠÄU4K ¥Gy„‰çÛÅï³’Ô¯,òÙ¬_¥Ÿ²H¾ê‹ÕÅ¿Æ$fi-'ÄÞf1 è§yê8¢šÖ_ÿy ÒÞ²”d;\ü$*ù?;S›ï‹»-°­ì Ò=T™ÈO¡œMM0×[G›b0í”üUuÖ¸heÌI™J Å_ã0vÿ¦œ;vLäHfD«|¯Ê‘íi9¦U#'Í)fpÞŽþáÞ +Áêp¬‘õÖy†î´'€)ãVFØl(™òš=x¶,`Þÿ¬HÛáŒgn(DiŸSdŽí–8šò\¨ÁPG™1AöÍ’ÓÇ%o<íMë9†<h~ü¥¯1Ø`Èáv½Z_­ïVp0ñz}¸ß™ádƒØî7Ï÷>ô(XÖ üþþÓ×Ûõõ× ø›ƒù1\ò'£¾UÄíúþnuýï{ôÁ[9‰Zèûû¡}4?UÍ…¼–mp¢ª3å ú¼Üƒ¹™RÙt4Þò=»/tõéÓ×;ðW·Ÿo®çƒ(‚üŸTù"À¬*3-êÂÀ`¶:ay³¦ú1Èžnxá¼"Ê¡^ÝÝÜ0U­©)9þŸzëóÉ\} +¦¨xdé¨$tÈû#3A‚ú™×ì}Ãà\™ù?™å.`a*ÑEF‰ãLw`Å™ú9ºaÏ˶á⹑ʷgGíAnø>Õƒvu£=ÙˆÞþl àâ#Ÿ¨å*`ą̀>ð±ÑðÑI,ãrŠ1.— ´E·mw€›< mË؉iºùû|é6Ÿ `ܤuÒ½®qøq^Ì"¥|•æÿWµ°´–bo«EœE~–*Çõ ^סÅótÒZÀ¶® @‡œ…á+/è¥9ÕQ~Fcïê[e]3tnõÇ£ÉØ;Mœî\fdËseË‹ÙzCºµ!>Wɾ–ÿ㘕%¿b¼XªÒ8J‚}°)ø¨ûžÇªH‚0’j€‡z£¥Ç¶y Ã )òßsßXT¹+Ö:OcŸ†yŠ±¨•ÄtdMI½%zgZÞ57{ ï»Jžs¿&ÇÚ¦æF?¨g¡Š*ÎÊV J¦¶n{´±ƒéÉS3F'LÓŸ\?× ‘Ñ<Jqý%ZŒùù þa¸?äã¦ù†Í¢®+ŒÇ]#½Ñg€ˆ“éØÎ »q(›:Dä4…0UºzžÙˆÊùíDÞ[qrà€~A&Ÿ-7ÌW?ëÝÃ$ôœ¶$Ùá(³°Æ?Eq±g+׆F8•áì £’ÿö¨I&ß4$c³‹ëŽcb`4,tÅ}ÜšòGIXKªzÉb,hEYDO$·®ÅŠ{#¤:N•KðýåùÂ¥$I­MECŽF29™üL:ì_P¯P±k$|·Z¼ž›&ÑØT¼ŒÒ°H=nùeú²å ‘Ið_RlàÊݳHF- ä‹Â<Ü•'²šR 3<ú“折æÜ)¯¦å…FèÓ4)¥s ܹDhW’6;}ø¦fªi~9¢¨ x¦‰ H±RcûK¹& Ä¿¹3ƒ«n–Æ¢²³<Q0Ëý"ûâMB YÕô6P𣠦GêMð«"Û"µVD´S’8Q,Âáþ´yU9ìuˆä˜Œâ@¹lƒ[a½ugÜÏ0(C)*Áñë>&hõhöÝÑ’”õ—¤ÖCí€y‡kœ¤K‘?Ô¼3y§ê’:¬4„9ÖŒ­™J'L]e?ø÷Ì°•‡ŽD…h<7êÓРžØæöøa!íÏæJØ]5 vÌS¢›ù±ÐÉÐeÛ¾Ó@¯ Íû•/_„BœÚÑ*ßtt;§e.E)¿"ÄiB^ŒæÁ”Ç›²žŽŒéd–ç^°cGo-hàêR?L¹ÄÙ†9’×Me/±:DfÚÛ½ +¿Éw°ŽÆÓ½êaI + +~ÿ +r~Ôî¡*@—œ~Q¥$“âÈñÈHúÃÍÃã":™Š¸!¼«Ï«K^$Ð…6Ïj?{WšQ3 ;"ñÞ’7ÚiSÁÍÕˆNäšåo[aú¼á‡Þñy¯1£³gCnù +Šîs£%ÖƆcˆ_‰Z쌘ûÍnÃØQÕZu†Š(L™ÓÇÉž7—|ÀujŒk.SIð_›7\ƾ>$]ÖÕöù§ë(ðÃbúpýî¶Ã<óð¤>Ä·Cíæák~I”ûI½Ïð/£•Hendstream +endobj +1890 0 obj << +/Type /Page +/Contents 1891 0 R +/Resources 1889 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1879 0 R +>> endobj +1892 0 obj << +/D [1890 0 R /XYZ 85.039 781.388 null] >> endobj 758 0 obj << -/D [1807 0 R /XYZ 85.039 761.463 null] +/D [1890 0 R /XYZ 85.039 761.463 null] >> endobj -1016 0 obj << -/D [1807 0 R /XYZ 85.039 667.044 null] +1018 0 obj << +/D [1890 0 R /XYZ 85.039 653.495 null] >> endobj 762 0 obj << -/D [1807 0 R /XYZ 85.039 667.044 null] +/D [1890 0 R /XYZ 85.039 653.495 null] >> endobj -1810 0 obj << -/D [1807 0 R /XYZ 85.039 639.536 null] +1893 0 obj << +/D [1890 0 R /XYZ 85.039 612.438 null] >> endobj -1806 0 obj << +1889 0 obj << /Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1813 0 obj << -/Length 3543 +1896 0 obj << +/Length 3316 /Filter /FlateDecode >> stream -xÚ­ZKsã6¾ûWø&jjÄøÚ›3™$Ne’ìØ©ìV’-RשT<ʯß~„,ÉNU¦R@£Ñº¿~Àáuÿ…×Yì*¿N³ÐWYv½Ü^×kùæ*Š…,š/ﯾø:ÑÀσüú~5ñ‰}«ëûòWïÝ·7?Ý¿ÿ8_(¥¼PùóEšfÞý·ï¹ççŸæ¡÷n¾½¡ñáö‡o¸ÿîæƒ4 û¿w÷ï?Ì¿ÿîêý½•È®«ç(ÎW¿þ\— úwW¯òìú ÚÂðö -äñc­ä»¹º»ú·eÅcúšgÛ}¬2?ÎÔéöÃØÙ~)?ŠÂë4ü8дÿ¯ëvP4Íažiïí|%¹÷4R¯‚v¬½ ã÷Ÿó(3몭úzi>Æç›âÈ“Ì®ôêöA°ôüæ†×Âavº·(ŽýLïm¨ðâ–'Â¥¯óäó'¼^.U~ê -WVÃÅû-ˆø?ijT^Ñ–Ü`ÙOV©Ü×ég]X½,¹Ò‘Ÿ‚ZþcUq -Ë&Ù„×+Â%Ÿ¤ãTûnZ<Öm5°ÊŽÿ ô7jö÷ÐÞ>!5µzhµ@{…ËÖ™¯bÐÄí1§opî»ï ´·-Ú&ìöȶë®<ÑZ{÷\9DîeÇ¿ Š‘yÝ#Š·¸ó¡`Ò’?»všÛ¯üK0‚h¹~':ËFµ¯tBØF¾ -£ë4ˆIpo°Íh¾ˆãÀ»A1‹¦kqIê­ún‹­Äûùö„ûÏ%Ñ„ã‹¢M4g`KDKÒÌTH¢ýˆ¨%Ât+eÜHÇÆúz[ô¨Ú¢Å{‡g3€ÐLš Ç5âgܪeÚHX8JçÈOȸ£/y¤í„¤Y‰¶;é@µÃß²• -X—bÚÓS ,¢\{³§ .屇šÑÖŸ¸¿.¹s]Ïmj†š¦"Ð4øDqŒpœt¿‘™ðÃО'^cvŒüd=² ÃVèf¨{ðŸ¢uÝÕ¼cüþPà‘ï°§]s×Ý>H‘Çj;#St6,ƃ{Ð:eÝFÚ¯ð;ñVE¿W¤Ó˜ièR»‡âwsྡྷ„-N$/V“ÑR£dvÖÓ?Õ¤$(ÎEwŸ%Þ/óLá ¤ÙHbœÖ{@‘bÙµÃØï—c-§›*k³óå~ _ì 3†«7¿ÈÔà©|ƒåׄ^¢w|÷sÄ#Ö'\v{ØEn•¹AŠG‘—XõÄ›eVFKIEY „D)ððÊf:µ•j>};_ø“ÕÐ?žÙþhqYz±&¢`‰±w³äˆU Û 4vö«Op§5êö×ÂÌÚ„pvíÔn>K{¾-!Øïø÷Ïšb’Ô¨Æ\t©$¤5(änð~C» ï2ÄSâï7ÝŽÜLÇ!Õž¢ñDÃÔã³fú-ÊÛ¤ÞÕªêûJF«¶\¬‹-wjõ‡õ”Äà0ÁFè£s'JY‡ ~×û4wƒ C"BÁ™ŠOˆ/¶]Ëm5µÕ¹sÇw|Ò£8¼Znx#ªÏ BÙFɻŀü*_t!Íeï'KZï¦Ø»} jÞTƒ«|ê},–¦€˜@[‰ÙÞÝ ø—‚³Ü‹rO4—]Æ÷QøÜõåâÈ2‹ÖØ7n‡óiVf6ÜÈ&rJft2×Ry”æfØ_l%ŽŒ58ˆÚÂ%‹b“•ªC‡³ˆªÛî FBÜ«ÑzA7HMO!Å8ÆÌÁüb.Ĺ¬Ð¾‚ÄÚŽø“{˦î¦^·ÆqT A<ÂÎ/wœŸ9œüQ µÀSïl™LT¡›Dk'¨K;…ÇÑãÝ|øx?ñ4ãÌA±˜v¢b¾µ]_ÙÉÐLA î­Ïí¶ÖΘÀðef ã0ŠöýIìÂÀ²Ø2©F…‹S›!bæ,åكžA^žÕñ4úéé¸Ö¸¼F´!!-ÖJÖБ·<’¾0÷DǪ4ì{CX ­†º™¾]kªOxGiàÝ4C'<¶¬¼;a¸ä-6dnÐ{Wt?û8½Â¢çCTû%ÄFz,œþ„1¨3…3Dé” Š{B¬á"€nª·è¢[…¼ã¸‘‹ë¶Å«¤Iìðc)Yfü™žP"J#VÇ‚éËŠ®ônÔ3ì w¡'‚ïͪ°SmlSíâ_ak#¤µ0z´¦!ÇݺgÚÁ?õ\²Ó/ï‘àQbåxXôE„ U?`.îL2¬ÕTÓ!KçTÎ8ÍãˆB‹.U#ƒx‘…¸3°‰Ëƒî5m…¿![cDz=ŒÜê'LYà¿ø:sA½ -:fqÂÊMdpÀÂdæ•Êà×b´'ÔÂMÕå’ ò 娖K1ʉ˛jë_Š(~ÁÒ’œÞ³°ãŠIHÓíQJÌPìx‰‚툕à_Ï=®ñ”“Ö4?ër ÍÂ!bŸ«ªd™Ÿ¤‰å„;€ãHOVTÚÕË 2ÉézG>^åûÆGëÍ~èÈ%E˜pà] ¾.©Hsg—G0ÞWûŠ Ù³E¢$ytb‡õývÝsW·›|@oî¨ÈÕÌ«ºiŽ'´üYçÁrxûb¾„÷ܸv‡ðfà•…Uá™\c]I¾ÁÁLx3éYè½±Œ¶BJ¥Á '5¬œ^H݆¹Ùh„ Ül×øb!L÷Ïlõk4LzU˜D‰ò‚XŠj=Yè‡ÛÙä^i?(. r¯ç9-ɺU–øaþ³’œðZ8ÌΔä‚ØO£Ä®8Õ %ë¿ uR:;I²Ï#§ðzEÎ8õµå,¶¬QÏ¥ËB¾ÓÏ#ðzEºLû 2®p{2üÆ_J*xË7/iEzߜޅMÐÂÐF{RÈÔ°T|\‹áÚ^àIeÇÁÝ -q¡w⢷nšGÆXŒ&‘ŠÆ™a²œTÚí¨ ²¤'¨K‚ƉŸ¿ò˜îÐ\®ME*óÓ0sp³<ók3Y·2ä ’B“K:p^-/Ù¨­è 7€VW8?sª…5‰Ü*"G–K~1Ö“{S¾Ëo"Ð>†lÔ>¶¤‘'äÔFJ®\”3†z4x¬cïþèä]joßñMªm¤šãùï  Q³ÀöW²›·l¶jYšz\jÞ¡R)žàË€„Ù$=£ # aå§å”½±nzz4sk§X`*ÿrDömÕúI¾ƒKVæ‰Ü‹ZéÐ\6‘0ƒp5HŽLÄÀ"-±¡H•¤âøïÏÞR7§3Ît `±Øû.¬&ü§&Yìz>I3åë,›,ÖgÁd 3?)Y1“%³ÑšïÎ~x§øó`>¹{ðÄ~ëÉ]þ»÷æç‹wWÏgZkOiÿ|–¦™w÷óC~ûp®¼7ç3彇ÁÍõ»Ÿ~{q#ÿïöîêæüÏ»_ήîEî,8}Žäü}öûŸÁ$Ò9 |=Ï&0|Óë3 Ç#-ßÕÙíÙ*ž‹&¼ëØícùq¦¯¯â#×?"ºþv×H•×7øzýªàÁaæå[¸_U :àMœÞ~¬LÐ'Þÿˆã×V¼¿6=|m[S!ð‰+s8¿à?rŒYàÆÐ!L{¸±áᆫ¢"ÔÏk§|à¦mHû "³e,‚¸Îyá’/"×a-üjÖ›ár(>àåL!«çÄâ ˆx º)s­íu;Ë ³þŽ0õƒ9ãø#ˆƒ·çYœèÏZ†¦µ ×ç³(ʼ®YÃg&Þ=â\œÃ ? »”W,ïp>†ý0õÄc³è·ŽÏ }x\Cô ÅûàïfÛ­"$᫦¾.ðÐ7¿ò²’°tÛ=<¤+8h ¾M_ábÇWf¡·¯…¥tÏð'òLG§l-oJ\²ä%Un6õ0Óƒ%­Y%‹¦Î‘Mè%d*7¸ŒQ@dï»EžÛ ºZ"K>b ÀE9ëZSö†"ëXš:H‡<)`—L°="aêKI¹8°zÉC¨žøƒs#Š5†q¸ô?Úâï-§=DT!Tð$úN:ÝÆ!¤`áb<*‚Ø^̱ü¯oZñ`È® +YhSÚDì×K„^|à/ÎBlÚˆ9æªÞ–¬Ýà! Â$Z%“a{B–.•æ@€ô,p +“¢þÀ'…Ÿf“Xk?UéË\£špñHaäPšÚEC½8 j¾<Ãw¡Mp}ƒ¸Hùól‡¶¼èHP´¬¶Èc«¶8–pqàIm–Æß…z‹ëy굊|eÿ„µ:„߇8Áõ âtè#vœæ­MÈÑaÛ<áT•!ïw²Tëâë( +à¶~Ü‹`>ç‚ËÌÄ¿G`_:Ù1âÛP/€²$ QYfщçR,WRnÆê#ùƽéœ÷ƒOò)Ò;¹¾ôOtNbˆxI>Ûí­!ž†0ù:JFíŽ( ý0â<®b< ¼Ûò;S5ÈC¤6ãNï·wHê5Ðöß”YŒÏQ6Zs²i¤•CÆ{ñH:ñ>Ào<|n@¾XÚÊØHòŠà¾¨Íà¯p¸WQUW¼àöâfÊKJÙ2Djø({ž$'JF•3„‹XbúÞÕYNÁ æò‚"ŒKª,ø)xt­’þH˜ Y~Å„ˆÈù—ê/`ÁÅéê,…`äZP%uCÔµ¸Ã¥ÎQz•¥söž·p#°] àªã þ3eÚ~Zjn 666“Å%·O¶`î‹õTŒ4亷Ü^_ÊMŒkúP«‡T‡l ² ¹7÷6ˇŒÅäk:³”ƒZJôaâK)ª•Gn%ÜÓÊø”èÀû„Q±à{½7ؾ2‚2›®o·1Á9W£…‰—»N×bË]š’Lx±)#.ëpðc +ö^.¦ü±%ßñõ0I:ÌbQAhUéòøš¶ÜD§BõQ˜ì+'µËfÃNDójHº8ûƒÜdn½T÷Ÿí—ð?Xßà€Ö7ígÉŠA€Üži¶;Ä#"2o¨)ÉÙ—«Ôxª¬Ÿ³tŽ{wÔz·ì\;µ²÷H»ìKi—¶v¼ðã¦VÜñÓŠÒHú~Õl$ó¥0òŠ¡ÓöÈWeùª¨/Éy'ηc»s·ŽX›³¥áüù«3T^M·Uñ¾ò"e<Áv%0b™@^ ~—ò+ZòÐŒ6±¸ëå±¾ÖHI"R~3+ËQ“Úè:t…{É~‡Ô†eã@éí¶ NÅ> ¹âB#°²fgæIjcG +± ?õÔa{ŽêÑš“a1Œ±vÏvÃbqhÛ+EÆ9ú¤8H +AS—ê?2]:ÇÀÀz’V¬?H‡º”î\.¸ÞòÀ!@J9õ^¼Ój¯¸£ŠŒL®‚`8ÔcN‘ìq.–ˆ§8TÈ…Ô”ö¨b-=*z£ rIÕÐøoe¶*—µ?Rßñ õù¨—^ðÒƒñXÈä®K]Àl]Ó›——¤g‘«#†¥! Ž³’Nq ¥ÅØ™¶©—ròànvñ¾áêÖŒ_ˆ*PñšG•íé„Ö‘òóÖW¶b×mä1fÍÊÒKr¾{¢Ö¬Èm/'d…"\C¯P÷’…à#Žu¬0¦9N*ø]‚ÏšÔ¡qä•Ü2ûÙ^6=²U³šJë“E'…Ä~‡öXp»Æµpÿ¡3Å‚¥s,2ëB"QòÇ€åC'|”ÁDo¤-/§È6ÒMø•(’Š×uÇñ²¨‹–Òføp6Ô¡žY:°ýJi|RVÑ,[‘>Š5SÞ”’LI >‘eäEÛõü8Å=#”üH²d¶$EOǶë$Ь7UѶ!B5ì2oÔG<| +ž„ONF °‘V ·á”7㙫¶˜[˜â°ásÀ#ó¹’Áq2¼”P7>²`$¿ÜIƒ‰7°Á¶…±'L€MÛPŽÎ=3|FùvÂ7(q‰øGüÖHeP·]’`ß7,j㺫¬ÿ:ÃÑó1ZCñ7 +ÇcØc´CÄØ*=x® ?‹³g´kNÜ}ŠS¡¯U¸sâôåÏJ[‰ÐÛ&¶61f«pvH^‹¾D:õ.·oæÜoxùÄd“´rHññ·]/[7ã¿2ö?²›\qÊ…±ÂLšœÍážš©33#zÍYf^v›j|2»¬cZ±\(+»<Áµ}Yˆ?Ÿ¿â×”!?~eûª®H·N²‡?JBE÷J1}÷ÒƒÉlÞÔÓ!åçn:yY82èB ôÇ,œþî^P³p¨ª¤o;¼O‹‹‡ÑõÔ¥ùø`ᬟ4à˜º‘?ýØïˆfŸ&Ñ$yᣣ ™%'#°¦Ï9ü ‡:í÷uèƒv¿.Ár’,­c?CG—Sí1ñÜ×S#hN““„~(Kζ§DØ_ ¯œ˜C¢,m–IuH¦† óy¤CMN$@ˆšoNÕR-Jà6»ýqÖÐñÓ~¦OT61˜E’FB ²#ÓûäÚ¿á: ÷ÿGj$endstream endobj -1812 0 obj << +1895 0 obj << +/Type /Page +/Contents 1896 0 R +/Resources 1894 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1879 0 R +>> endobj +1897 0 obj << +/D [1895 0 R /XYZ 85.039 781.388 null] +>> endobj +766 0 obj << +/D [1895 0 R /XYZ 85.039 501.607 null] +>> endobj +1898 0 obj << +/D [1895 0 R /XYZ 85.039 461.443 null] +>> endobj +770 0 obj << +/D [1895 0 R /XYZ 85.039 320.94 null] +>> endobj +1899 0 obj << +/D [1895 0 R /XYZ 85.039 280.776 null] +>> endobj +1894 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F20 937 0 R /F42 967 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1902 0 obj << +/Length 2573 +/Filter /FlateDecode +>> +stream +xÚ¥Ùrä¶ñ]_1oâ¸vh’xäMÞÝØrí&›hR©”íjHIˆ8ä˜ä¬Vùúô£9\•”ª$Ýht7úV¼ˆà'^ä&ŒT±Èò8Ty¾Øl¯¢Å#@~¼Šc%(+ç‡õÕ÷6Ù"ŽÂ"*뇙Ž µQ‹uõKðþ§›/ë_®”RA¬Âå*Ëò`ýÓGÞùÇ—e¼_®â௰ø|û—yÿîæ³,`û_w럗¿­¾ú¸ž8šî‚Û dç÷«_~‹°þóUª"_¼À: +co¯€ŸÐh%ßÍÕÝÕß&R Ó >uJz£òÐäêXüØxâÇqª8Yd& +M¤Iþ‡=ÐOð»F1{X¼[®tœe ë +Ä,Š Û-WI6£”#,u]ËŽî]Ãò©l+øÓÔ×^ŽÇ˜_—îiöîöQ^–xW/H½ƒ–ÄL<ôÝ*ÕI°Fbv`Äá©CJð¼åC-¾ ¨i£ ’šx †”ÆÛr¼×ÊܼòÛîY芄E舂YDyd‡Åd¢ˆ|ȩໞyhˆêw¼¹A,Boë*qB½0€>\‰Ïà‹tÈ0¿¤ó,çÜ!MS°­â¢;x8dœ @u¨têÅþTé0W1|êåʘ(øDΫ¢àu FP÷Ã9.TF:;ÅÊ…98ÜE“8L ”û,ÆaaŒÇ¢)ÒÐx,†À\Ì|Þ šv»†¼©mמaÔ:LÀ/ñâáû²£“‚Kœ*×OhªI‘vIæ…Ëäè {Ô cÙâÛÞOÖ‰EEš\ ^~dƒ³MÅ‹—§Ù.Ù6zˆc€!­öƒ\G€¾&”djõ–~sÌŠ1- Óù¦qó¡J³cÜÏù?í(RÙqgÑ +SOýzÂ≵£T"ñDS½àjËLÖýÃÌý;‘6pA¾ÈG‘^'Ùæ±ÕáÇõÀ|³¯áãpTÁsËŽÖÔÕ#ebäëa/~”Å¥'y#nêDØr¬8cr +òÉ.›ÜŒsÞü!×Dyr`þ ›ÿÙ?j/MƒÛ5Wnêsü‹üÌ8g]@gÀ¡Ê=Ð*§8ìì³á­kÖV;`VW 5¯¹Ðé-(ïq P5RÁÎàd¿ßŒû©î° KÍÁÇzüžãñÈ·÷ÝžSk-ä±2CeÀŽqåš±G66S"ëÝ4»c“Þõ.bµ”½T”ŠEÃb‡îIð*âð0™6>g­ ×k5£•˜wu¬@<£ÄÃdòÒWpk+[ôA)ÇŽ–j+û!%ÿÁʃ™ø6¢éG†’&‚&G6¼*@Üý—k·ZïBŸçÄpÒ +†ð(¤ uèܦß Ù5’8î‘=^9"r S V¶µôÆec¨¡øà$&â}“jè¾Ø¦aŒY\Øö;”¸±Xz‚dÁÚ…p*“ET?ÅX¤%ˆFA* €†à©ÅVJ¢ÞwôÛråœ ¤¬èE)¼%*ØvSÄÝ7‚ËÕÃÙÊpÁOôŒZIÌÜ› ¨·d”pTòÅ+žÊ~Æj)t"z'õôÜÞ.e&öªÒióúEw¡ÔåŽÁ×®hyc·˜1LÎ>M.¸ÇÆ·þÒ/V—8—¤OS°à¸˜¢ÀïxÊNŸB«¼_J©7ö“Ra@à‘ÓSœ©S ç®ÚKUÉ)€b.Sð'»M25)îí{ú|ŠœBMÌ­$~ÏPò;Jj:VVÓ•÷“*“,Œ +Žºÿ\æšbÔÄ›Ž¼ƒŠÙ<à­¸¢¾—„«a¯¬*^Ü ÔÁâ©ý"&Å&én992í©sÀ?ùm²‰¥Ͻª¢³rwe‡ w€dÚ *ŠÁ!’Îárëpšƒòeªð}Ì9÷rç’²Òy˜d—ËfçlRVIfo’²:‘”?£ÁóÐ#ÕçÊhGí"W3ÎÙÔœäi˜ªBRsírœÒsݤç넳L·\¼õR“ÆQ»¶.¤)¹ÇJ—3¢Ð¯Ë\Q ×Æ+à½K^pj¨Ç‘8 60œföÇ´âÕgâ‰}¯ñJ‚ãÐKA…Ú~%3£k´HæqË80 '*¼rî‹kë'qLàYz¨f}ÊPö‚µW§¤ ÏQN¹9 FÃJv¬‰ŽCÈ¥Û-ú”W)AN˜'QÑvw=ÒgÍK +Gå¾»ã“8. vØù±ËGBBøô7_øËËeÓ¥4htöˆMvL|?7Ãëo®¬]Äל©Ž¥¿~n箚²ĦTb˜XAå Œ> endobj +1903 0 obj << +/D [1901 0 R /XYZ 85.039 781.388 null] +>> endobj +774 0 obj << +/D [1901 0 R /XYZ 85.039 666.319 null] >> endobj -1814 0 obj << -/D [1812 0 R /XYZ 85.039 781.388 null] +1904 0 obj << +/D [1901 0 R /XYZ 85.039 621.244 null] >> endobj -766 0 obj << -/D [1812 0 R /XYZ 85.039 718.394 null] +778 0 obj << +/D [1901 0 R /XYZ 85.039 621.244 null] >> endobj -1815 0 obj << -/D [1812 0 R /XYZ 85.039 691.78 null] +1905 0 obj << +/D [1901 0 R /XYZ 85.039 587.167 null] >> endobj -770 0 obj << -/D [1812 0 R /XYZ 85.039 578.375 null] +782 0 obj << +/D [1901 0 R /XYZ 85.039 531.457 null] >> endobj -1816 0 obj << -/D [1812 0 R /XYZ 85.039 551.76 null] +1906 0 obj << +/D [1901 0 R /XYZ 85.039 499.036 null] >> endobj -774 0 obj << -/D [1812 0 R /XYZ 85.039 299.875 null] +786 0 obj << +/D [1901 0 R /XYZ 85.039 348.279 null] >> endobj -1817 0 obj << -/D [1812 0 R /XYZ 85.039 270.47 null] +1907 0 obj << +/D [1901 0 R /XYZ 85.039 313.737 null] >> endobj -778 0 obj << -/D [1812 0 R /XYZ 85.039 270.47 null] +790 0 obj << +/D [1901 0 R /XYZ 85.039 213.881 null] >> endobj -1818 0 obj << -/D [1812 0 R /XYZ 85.039 249.942 null] +1908 0 obj << +/D [1901 0 R /XYZ 85.039 173.718 null] >> endobj -782 0 obj << -/D [1812 0 R /XYZ 85.039 196.354 null] +794 0 obj << +/D [1901 0 R /XYZ 85.039 173.718 null] >> endobj -1819 0 obj << -/D [1812 0 R /XYZ 85.039 175.361 null] +1909 0 obj << +/D [1901 0 R /XYZ 85.039 136.851 null] >> endobj -1811 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R /F14 969 0 R >> +1900 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F42 967 0 R /F20 937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1822 0 obj << -/Length 3225 +1912 0 obj << +/Length 2448 /Filter /FlateDecode >> stream -xÚ¥ZYsã6~÷¯ð›¨©Cà•7gì$NÆ3ÙX©d+I¹(‰¶¹ÃCá1ï¯ß¾RålUÊU"ÐhúënÀþ¹þyºžJÏãÄwU’œo«3ïüZ¾;ó…c%,« Ï7볯¾ ÕsS/=_ßã„®Õùz÷»óîû‹ŸÖW?/WJ)ÇWîrlj³þþŠ)¿ü´ôwË•ï|„ÂÍõ‡ï˜~{q# ÿûv}u³üsýÃÙÕÚJdç‚ÙS篳ßÿôÎw úgž«Òäü ÊžëCsuò¸¡VR/ÏnÏþe‡â6}νæVo8V~ê¦Aøº†"ßÕ‘² - ÕwÓ0D ù~à*?8CÏ =M*­h–©–«0ô`é¨\~97 |=g‡¤¡¦¼;¥ñUÑFÍ'›gE R&hëG˜¦Î—« L@ ßi°;uÓsa‹íMU-ƒØ ½.¶Y/üOEÿˆ¥Èé…”íg_ðK=³¾hjæÙí’¦‚¦¾|^&Êy -qà‡ï…&Ü,ƒÄ‘2 ×÷2<ð Ÿ—0VVf¬ŽY‹š¿( h³òqSy¡Ž°+m'šÄ%2”#íŒÒÑ/.ásQ㬑rÚü¯uÕ/yÎ(tî¡Ø6wU°"¡ ÂÀ"ú¼½Ï¶9Ø„|g­ÂY‘zQg7”Ó5AcÖæ/Dëö@HXa‘rS -ÊÓ´3ËïÛÌöÀI`Wpa*Õ‰‹SqêÜã\¸&¬Ð¶båÎj<%ɱàÑ°ÉÝc‚Çé…_Ððx¡Gsg´·Põ¹¤¢ïûKl¸ø‰kSx¾ž&N:•E×»3‹]“ÐiìT ) ¥J¡ó/{š@Žc¾crÏ€Åŧš*0Â/Èo3hOÆ¡“þ ™ÌýBš¸kÍÝvM•R¾½¾|{L­³*;³T;`)‹-+ lM‹ÅÔézV;³¾Ï¶h©öœI_Ú‰(µ‡TÅAïÅË X)ª}ɃNöÀê¯cÆjÜGæä)K®mpþ4ÂÓÉ´]S1ÌL–²aæåd#Zv -t¶z¢»'@1ÒÊ<õ*(Nx,^kWéh -ŠQ»qê¼ TLÇ€Ö|,|4Ò“m™‘×ì¹É߉êGn:q¾³®Öâzz]‹/òîIÆ|[då¡©¿J`+Ð’«—+¢ÄÇmÿ[«ÜT‡³ÞveÆZM;^à¾ê`9û¬ëv›SÚõ<7ö£×8òœv€a¸·f¼ãgŽ¨ {‹‡k÷ Ä?„`¤áQÆï†lBˆÛmt‰Ôw‚¹èÁìu‚u VÜ ¿OmaýÜdlbƒ`¯FWåǬg†6ÏvÝ nä_æáˆj©¼Á#@0a€ Ü:®½¢R¾õŠÈ|à:h:fé-ÂTÌ7A|e, -Ösa\PìBÑ#jEná¢ì¤ËžVXà$;rUÙÌâF/•Hð…lËÑʲø0‘á¥)‹í3.¿áoÞ7z#(ò|çWŒIÌX,” -mT“Ì*˜EÜ:Ó?G®'Ï‘‰T;f uÊŽ°±Í?ÛýiÍä ‘+ühç¡`–Ž«¬‰i|ñ·ŸÝïl˜4Æ(|pìS8ÚÕ`:¯ÙÞ„ç4x…ð “輯î•üX»)„Ú¦×?A%3Öj2ØŒœqp‘È)æ5§–q¨Ójy1Ý,$é$÷³~¤Å÷5¨ÈA'í-1"²Ç“—:Í={ÃÄ(‡ø!#“™ú¹^¬˜H¿è92|Óa{kÏBXñ‡ÂŽá'ãrh0L.4^ÏØsç;œ4H9hÀïv ›v‡Ê¨9󀶧%Q)ö‚ÙG&T$eÿ_œÔók õÉá2G6U6­™¼jŒZ±†j Ò‚:A †$㾄g¤eØ^q?‹‹î‡.ç½½Í(¹"T^È~SX¹Á“GÕí'Ò‰GaXm)Òü\Lš)°†I.H‰}a€Û.1ÔkyszÒá37L¢p<€Ö èüÐ醢Ï6fÀœn0nñÊЫ¢à -3þTf¾ä‹V/âLéxùÎå.¿’®K!=SÉ@ ¾PúVĤí›1ž´Î¸Í¡ú12Ùh»ê®g¶_)¼>qkÇàËêkç¶çÁÚKÈiƒîpW2:HÝxRwÈB©±’M!£œaãn›úž›ÑÊËœS%êÖË·ã/ f’ÞË\f PY>OÜ;º°ÃtÚnl¦mBi3®ãJÄY²èņ¹mN=jÍw’ÓàE¦zrœ<“ÊM’)Eèp5í¹Ç)f³7Ñ•" ‡Iku`íJVr‹(ºè„“*/Ð(µëÛaËWØÄpI)ÕñâÈ1“a?yqÉ_<“È,è=ía–AˆBq†8Øš %\“„iÌàñ\¢pܘñg"V7øJ¡¯ô¦CT{Nˆ9ÿrIÓž+/‘ÉÇÛåi:ñ5óXhCÁõ­¦ dƒ. 'B#ÐÄöÈfOgh=¹~øúã„çt†¦têAh"‡ˆƒ†›1 -E‘0à|S¶¬ÎèØa+ iû„œ:ráD¾.çÈsÚ•+ƒ’XMn"Tuþ„%-I÷‚ÉV{le³¯˸=çøÔWM+‰J#59EºµõAʯزՕ÷LbœB\{`ïØó]†ŒÍ¾¨© kº0c¯æÀÀ LBgYnüTê±™¥¾pT íMŠÑlLÎWÜp?r®{îð„ÄŒîQ‚QKÛb7]# ÔS„%‚Ù|Ò»Jaƒœ”¢}Ï L&6Ð}Å#·fs?ƒ‰¹I0zghe“Ø2m“uÖËÑm:²6â#OxÎÂÆã5bOFΘóK¿à¾¤oà®Æ+"¨5´ç?㥫I¾Â$†³i³¨{{ìÆMŠ§5L Y&ï+dδ¯øͨÏÌÄôÉF ;-’\Šâ°½è姰×eÂz¨ d© ¤3…`‚‡6Å¡zŒ§wu"^ÛCÄé¸Q¹´Ò…Ý‹ßA®F]Ëšá[[¤×ÌkÝTDבs3 Óu£˜3f[¢T»ãðY‰ÿ33ÙHsoQÞ@ˆœ¾ã•“TÉ4HÙ!¾£@aê`FN÷)྽لÚK~a¢ L%cNWj¢Rîs$€ÁöB73 Ø·3°†Û®8zxhÍ×öm$¤TÞšp&à|w°—¼EuÜÁbHOš’,dXmkŸL€LqQ`^M‚#¡æü^´€Bè]V&îµ@}ù<×1Ô@iT )¶\¤ È\eB7p Ì¾ØJT£5ÛÊ}3ÞOߺàølóšÝ£¢­ãÐFæÔ¦ .Y^Å.H3¼jíØ'«lîñòÍ›“pú-&^¼ñyË&Ñê×Øï«o!dAÁ‚—ò\/Ih˜ëÛõÅú—[°Ã Ä‹È»²i> û»®ÀÄÖ£’o/nîÞ}ü°¾úmÍ„7Ð(‘V'¬Öw¿Ü^ý|·þøãÕ‡¹ueÛmÞuw}ó)¯¥ûúâýûïîÞ­“Ñ«¼ºÛö_ŽG¿üxsw{})l ¨ay%2ñÍ©'Å¡¨{Wÿ¼çkÒÕ!€NUsJƒWäÙ§é¥s6Í -­ d";w5‰ŽÕø^ŽåEͯRh ãßráé±8ÜйìÍsƒtþÝM–ýþÄf€Z¹‰:ám v£X‹,¨«H¿7T‰&êXÞÿÚŠ­endstream +xÚ¥YYsÛF~ׯà›H•ã>òÆ•äXYÞ®$•¤X ‰Xƒ#”ö×o_3€HÈëò–Ë°»§§§¯{ kbÂ?kz†éD“ ´ ' 'ëí‰9yÎ'–HÌEd>ùG|òá£L,ÓˆÌh?öz<ÃõœIœþ>½ø´ø_ý<›;Ž3µc6‚pºbÊ—Ï3kz1›[Ó{x¹½¾û‘é‹[yòoñÕíìÏø§“«X[¤÷‚Ý#4篓ßÿ4')˜þÓ‰i8Q8ÙûiXÀÞž€=†ç:ò»8y8ù—VÅØ8ÉKÜóµß&œf´AÒñ±ô²k–)3ÙM”¦èrðäsÄÈ7hƒ)KIi…V¤´[‚ö:‘7ÝψñÌÂ{}ž ÈÀ¬ýHÿazæ~#š“¤@w¥á +ݲèn¤’:XhAMû°YŒ‹0n(´e˴ב–ä[áª3t° éA|•œ6#G.ò-ÅÕö›“‹§[tw‡Î¨fÒ¿ÑžTØI‰Ogº Õmþ7î—ñ’˼渴tìW¦Þ\¢Èâó`Ó5RdÊ™MÛsäùIƒCXDeϼV× pö9æb1’4‰˜J…&Kþv×ð…K¬TiK0×­Û¼AÂx&eߥ±„1¯,r ½¸dæ qíÀ0¡YQâÊ‘l?š&E£jÚÑô{V¦ü»ú¡Q˜Ö`”¨` $üÓ6ìŽa×owI‹±*dstRšìXæ·¬é9,*‚’et5«ÂA"`T’2•®'3Þ霾iŽ}µsdt£vâ:§@h#OM>· +S¶ˆŽ9%dóâ`äðTr³’:n¦˜Fh~}èȼÛà=ǃÙÑOeíNOKeæž ˜J‹ÛSþ¡;!—CQ!jpï’â$1Ë!c¢ +’ªâ7€‹µF©’ºPóV£rñȤ=Ñ6üã)k[ê©O¢MRŠéùvWdÛR$¸škÄ¥±ä¸òX|KMƤµ&Ô¹Ÿ˜5h/Xüüטâ´t„Lü‘rÇʳ)Ôp W`š¾ ]1Q¯oøqLé¦BÆ,_ãˆ3ÓŸŽ€ã/-m)9í×,¾Ò0Ÿ¥TJþ ~Ø»#ø„.„kÂi®!˜ãGŽ*˜©¶¢Âv‚ÃÌÀñÒž²H%z”—û*œÉôß}ß'‹Àã^hBv ‚\Þ`̾RÜu–¢ºG~*ÃÕ‘Û!K*ÚKrœÚŽ½Ã1¸sÁŒQ¡ñ{Î šJÖ%9' rÎÀ'°làV„U×½Âî³#eå2¬²`×è>‰C ÍH2T²u5h«5% ¸¦^©ö#§"E¼£Âº¦Lwm¦N’CŒŠñˆÍ…à ƒ_… õ©1pPVú4 Œ:Yˆ¸âR.óÇþXªÂ¦©¶jÈ„ö{ìeéÙœ“gË+5àʵ +#»´%ÄÄ®/Ý>áDZ•r3ÓÆI¢OÀ±)à6,´í1,T lŒ¶m³·ýÖUÝ&Wfo4Xð ÒÃî:¡tFª*i|_|¾nd›’ŸCî›&…ÌêP¶ Ǭ˜RVbæpÖ§µ3¶”§ÀÕaõ MZV0q]h nô-—{;ÿŒ1WºæeÇÝ؃Œn¬di‡° ”ŸR  ÷„†ãYoRŒ*?”Á’–œò–-ܨ<@—Bb†5ëp¼ÊBÌxB„à¸Qd…[|ƒ ñ2¼ç—0mDõE½ãÊ®Uï=U +kQÓùÓ†¯>3mEŠI¤††LÝÎåžZ¦#èÃÖõ*Dp)‰€KšdÓ튜J&èi;/-3ú±–2º—Í©bfÌÃòZ5t7d(œ½Éjµ$S¤"ë9í÷vBA×ù.5ûƒ=:=XÕó±Ž,½.íE]É—nOà³:k»Zõ¬©¨®;øtÀ}#r93FAZôÎùAÕE›Sû,˜J.,Óá‡$#âuêkE?ä4ÐѧóËZÒºëèB ˜tIÃ%õ»Ã ¦xå&çž°Ï›ðêI7*¾$4Ìê£<º»Ã˜­®NkT»IDÉÙÙt~Ä ”Ú‡s+t¼pɇŽ?(}PàÂýÀ HÁ]ü/â/Д›d»,ªê¹Û-›¯©&@7z™€wË‹û»øêט gÀ”¡Dïâå—‡«Ÿ—ñý?¯îF|v–¬×YÓ,Ûê9+ey¼¸¹¹¿X^Ä¿Šöm¶]®Û—cí—÷·Ë‡ëKC•9‹ˆge²ÍÎGvîò²ul‘j_wú³Á@¾õRce}­£¤™ó`­Þü±* +õ¥sÏ7©ïI˜¬ì¶*cšïÍ•‘ŽiØ£_6à?úÿú“þð‡ ÷&p«¸b ž?ôŽæ/'4¼Ð9¶÷¿Õâ˜kendstream endobj -1821 0 obj << +1911 0 obj << /Type /Page -/Contents 1822 0 R -/Resources 1820 0 R +/Contents 1912 0 R +/Resources 1910 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1805 0 R ->> endobj -1823 0 obj << -/D [1821 0 R /XYZ 85.039 781.388 null] ->> endobj -786 0 obj << -/D [1821 0 R /XYZ 85.039 761.463 null] ->> endobj -1824 0 obj << -/D [1821 0 R /XYZ 85.039 743.459 null] ->> endobj -790 0 obj << -/D [1821 0 R /XYZ 85.039 643.603 null] ->> endobj -1825 0 obj << -/D [1821 0 R /XYZ 85.039 616.988 null] ->> endobj -794 0 obj << -/D [1821 0 R /XYZ 85.039 616.988 null] +/Parent 1916 0 R >> endobj -1826 0 obj << -/D [1821 0 R /XYZ 85.039 593.671 null] +1913 0 obj << +/D [1911 0 R /XYZ 85.039 781.388 null] >> endobj 798 0 obj << -/D [1821 0 R /XYZ 85.039 524.412 null] +/D [1911 0 R /XYZ 85.039 761.463 null] >> endobj -1827 0 obj << -/D [1821 0 R /XYZ 85.039 505.54 null] +1914 0 obj << +/D [1911 0 R /XYZ 85.039 743.459 null] >> endobj 802 0 obj << -/D [1821 0 R /XYZ 85.039 367.158 null] +/D [1911 0 R /XYZ 85.039 602.349 null] >> endobj -1828 0 obj << -/D [1821 0 R /XYZ 85.039 335.633 null] +1915 0 obj << +/D [1911 0 R /XYZ 85.039 560.002 null] >> endobj -1820 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> +1910 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1831 0 obj << -/Length 1819 +1919 0 obj << +/Length 1554 /Filter /FlateDecode >> stream -xÚ½XmoÛ6þî_á"±¢wKý0ÀMÜ6]“tµlh ƒ–äX¨,yÕÔÿ~÷BÊr¢ E-’w¼7Þ=<Æ[ðχ¾i¹ÑxÚ¦†ãd7²Æ@y;²ÇT±L{<¯ãÑÅ›¨–YÑ8Þåø¦ç»ã8ýl\¾›ŒŸ&S×u Û5'ÓÙ,4âw ^¹ÿ8±ËÉÔ6î`ps}û–×—ó5€å¿–ñâfò5~?ZÄE.С9>µÆ)˜þ~d™nŽal™6w#°Çô=WÍ‹ÑrôG'ŠiÞ˜w yﻡé‡îs÷Ý ç¾m;¦k;㙘‘ï“ÿ·ñ2žÇ÷ËÉÔw|£»ÕC&W"Iª¶”«õaÕäéË·’ªl$3ï«Ë»ÛxñgÌ ¿Qf?ä9O™Â¶Mm4=RªV÷ËŧU|÷ûâVíEYÓ¬dõ-+Õö6/¥ëðX‘Ó¬Éë,=‘Oë»›Õòúª¯ŒÝúUyÖŸ­ž_^Þ݃ïæ·WÊÍ -^Ú(èâí÷ƒÆ£©k™V8#áó¢¨&Sgf$˜Bf æ‚gN‰­(!)Ò"S«4cR#«ZsËmÆ‹‚Å…F"d^•¼NN` ÃÊ š ·BžêŸ 1b~­7åÈûí©ˆÎ†MU œj^=ïÃ+ÆIM¢ñ<ƒ²²ÝéjþßäÈ æM«ÈËc:`–ÙA—er•Èº8žH½dÔ‰²¢ß´ZÜÞß¼d€š®ãýÜ€#pZÚ”Y`“ñ$t ÌqÛ9ähŸz¶oä ¿çVE¡VKüR‘@¶xq 9¥t’ñJµáoSm$2>â¨38Ï…,S³;Ìà5j8U›¼štçeq`þ²bjöƒé¨k® ±zÀlD@z(¹N°€`×nxRf< 0´@Y7‡F’ŠÝ9“Ȫ>ÇØ’½0ÿÞ-‚DñMÍÐX² jM¬ø›•M[3  ¸dŠ¶%dDŽå}P›ÕñhàHa ¬ÊËT¯NüÞì)“`cÆ ¥j£¾-®–}]I8ÜX¡%Í°4¤kŽR¨ê‹Ù2ŠÏ™ú>+v|° -1Š™••Z™Ä0µ‰TS¸Îˆ‚9ƒH‹ãFž Áh¼Åp:à{KI]äRå+®!Ä5´=ã@ytº­³‹ fB @œZ쉉úDÉNÇ @Nä­÷ÇË')ruÇ uË)@ÂÎg"嵪w„¨F(«Èéiÿ,”ëxïx–Ë ŽåhyÜýx–sšß¬h‡µã{\;’÷&uÖé¡ÁrÎ`g¢EðþjwÆ,JÇÉMˆåîXêþBÚN`¹x²Öž¡èT•#§y^&C—Ê#Pí`Gà„qW Q[ ºÀ†òô€®VSæî¬ÏRæ[k0 ,¾b‘«;ÔFI#P ìÅ$æp<6D /rÂs"J•HYƒP[;5Fû¹»É/–í= ½À’s]*tq ¤ÙKE9&O¸ƒ–…§t4(Oá.@Í4Âør!îv‚°«Ós F2M%‹j•ÉÎHÉI¬ò©`ðT,Ô ºž×¥;òC¤U„8Ýž"*ê,º3)ÁáKI¿¯¹:îgÌß cEÁ3¼¿ðÛƒT¸o¡¼ÙŒš/O¡Ö‰Mè ÂUHÃç=%`L¾rc™¶Êe׃ۭE±Ûªn˜ï‘ð”xpºÉD›”콨é:KÚ‚FW¯Ëâ!€ë'íä@pè‹89ÄÛcˆ0Ô@žjû…9üY#2Ýž:D_çå4”HN ¹¾Ô±Lg檾4¤Í¿u!7ÑÔé¥Í«"ûWvä˜vš¶m¿uÒã"Âw7¼÷$5Ë g?ÝLdæ#Ïõ äDÊ| µßƒ<ÝEà •=²èùÕ;2v|…v™HÁm c!¸C!ß‹‹²á= g§Àøy:è+]Cžs¥#öêAC^s•ÔÇ'ÔÓCïÅRKQUßÚýª$CU¿>¿V­½X‹Z™üWSg’ð£lÔ{Ší䇫ýb¿æS´œ®ÃÅKï!¸bθ…ƒÞCšPSßÛ˜¿sôûòOÖ¢9i§W‰¬•ÐÓÂÅúƉàO-§®q«„¦(esPËç8Ƙ-jì„sYSý8òP@q”Äim§ýP$±"×6 +8þ÷‹”dËA°¹;3;Ç7Ç®í©?ö4òM˧ad›nMÓrbMï€ónb‹ÄBD{2¯“Éé[?œÚ–[ñ4¹ÝéñMÏw§IöÙ8{¿ü˜¬>Í®ë¶kÎaÉûS®?Îmãl¾°+X\œ_¾cúzy! ÿ³NVó¯É‡É*=mõÝù>ùüÕšfàú‡‰eºq4}€µeÚÀ.'àé{®ì‹Ézò÷¨ŠyÞ”O‹Þw#ÓÜçá»Á‘ð}Ëô-¿Ln®×«O7ÉÕŸ«ËùÂw|ãw•¦ºmoºú›®N˜–ÖUÛñòÍÕÅÍúüÈfu©òªÍ3ìóª³^ƒžî&íšâ±G6Æ“asÁº¯@ÿŠ"øfyvvu ®.¯/Dtm¿X¾ýäV`ÆAðë2ÙÉNp=Óõ‚=œ‚Ê$bœÀó\ð-#™ÇŽ¡Û.¯î^°„ŽÄþ/íïÉ}Ûž§À )©h?™G.XÅBìr(90¾ð<ßÈ[üÆ$vªjÅ_UÍÈxäÍ$r¢ +͇ê[üz©… h@ù‡¹ªÑ /tAIÆbkU"grêÐzªQCC.äU_±YÕü%þO ³ùm—×ì°Û"Ë8w3ÝæwUŽœ»#%ÓÝchÒ J?ð‚œï³i]¢ç‹D+ˆÝ+ÜüØ£tê›ìN$Aµ0kþêªíA,KñB+2™¬ “éŒ\p +&ÓÛùM’ö`ö¢4à·ï ‘ô‘È·m>Á©´.Ȉ9:¡iÅñ®LjžLÝ=:ÜâÆŒ‚/'Ìý ‹R²F{ÄV‰0%‰ÄÑ õ>íHX^ÉaÛc²Î +?ˆã+ÀÀÍZ=Û§ÞÚlè–~ÌC]Θ'FølÍa蟉é#w”¨.Õ0`³¡ø5Ûɨ›`Ž¥"Š ©KÞt÷š™¾UèB!R?æ~`¨¢n÷cõ)Ô¾ÕR&1Îõ¨¹¼Æ$á•‚l€= —ÃE°J\HÅ**_^0@ MQ+";hI;Î;…Ù’¢®«/–íál¡2Q4ƒHÒ‹Á©c¼¹Pæd©Š‚·„;â c‘°m˜G!…C+•¥¢ÖÇþ +}ƒ¦ÌÈE M#ňƒ99©•( +ÆADh¶¸d³ç„ò]+“·‡ÓŽl#ì*ã‚AÞ:zQ×ßúíM¥ðr”çîò\^ÆjÕVèî?¡ÞèŽ:»’jVâZž¡?ǦÌk‚%U=Î/׎X̪¡wn;ÄvšñŠà‘Ë„¿KŒùì/ÞläR‡Ã44 u6¢UúËæÙÅ“ÈŠiû“‹øü@~»np6¿}d. cü6h4ïÕ<{ž.qó„±î^趖IÅ“)¢˜Ahèú] +²³áá7€„×äÓÛgw™/<Û]ËtâcvøeÇÿ×?qãÓê$rãã/Ê!=ñŠ‚§îÿë=ó÷_ g±¡endstream endobj -1830 0 obj << +1918 0 obj << /Type /Page -/Contents 1831 0 R -/Resources 1829 0 R +/Contents 1919 0 R +/Resources 1917 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1805 0 R +/Parent 1916 0 R >> endobj -1832 0 obj << -/D [1830 0 R /XYZ 85.039 781.388 null] +1920 0 obj << +/D [1918 0 R /XYZ 85.039 781.388 null] >> endobj 806 0 obj << -/D [1830 0 R /XYZ 85.039 579.046 null] +/D [1918 0 R /XYZ 85.039 706.966 null] >> endobj -1833 0 obj << -/D [1830 0 R /XYZ 85.039 547.521 null] +1921 0 obj << +/D [1918 0 R /XYZ 85.039 661.892 null] >> endobj -1829 0 obj << -/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F20 937 0 R /F57 965 0 R >> +1917 0 obj << +/Font << /F57 1075 0 R /F36 955 0 R /F20 937 0 R /F15 951 0 R /F60 1548 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1836 0 obj << -/Length 3169 +1924 0 obj << +/Length 2614 /Filter /FlateDecode >> stream -xÚ…ZK“Û6¾ûWLùbªjÄðMê´µÞ8YoÙNj=)gk³ŽÄq-‘ -Iy<ÿ>ýu7@íš! Ñhýøº1áM@áM‘úA¼¹É‹Ð‹âf{|Ü<ÒÈÏ/B¥HÒØO“„ÚW×ftE~äWitunü8 AóúîÅ?EÁMøYßÜ=Ü„aäÇat“m?‰“›»Ý½0Y­Ó4ðÞ•ÍûUè•Íjg9}wÒøp'ß_Wqà•=‘ôOh¶«8ô:%zÓl»çÓP·ÍêwÿzñæÎ -¦re›ÀO«¢7ë(öã<þæ¾²,§½'î¾Â„všMöEFÝ—ÊÎÞ’ÌÍЭÖ! ½&Ñwçí€_5 ,K¬¼¾)ÔHÃB…éMø›`3**ü<ÏY¨Oõ@kîIŠMá û -·£¾ -}YE…WÚuÑQ5脾}¯½©ò±ê¤Kn‹Ÿ°§ ÛU”{O½¬À—HÃ[>„#ø—C}¨¤ûTö=Fž°ZÛ)¯ªYãlpA!PÎMÓù®×qZxX¬“öG0>bå{´n¡‰W2Z÷òm¬xò»1ËB?†V¾_Vi敇zWr]pÛ69½-ËÄ ­Y¾Ü«¾–¼íá@cϺÈ^WëK9gw£)ï“Ï¢„”˜ÇÐ}ú&ÔÇ?ç·@]­~?ÕcׂÓÎâ oÏ¢v+sÙæ—Ϩö¸ç}·çc cOnuM³¶ç#O$íØ°vè(wö[ó¾gêJçïÝc#=À­½-mV >b2s¢mÁh'tÍPÔ¨{¦ÖIõ€FKœïcÛÕÃ^ÔìFŸU -¨*¶º¾²×§=]ö: bVá Ù“ ¬]%ÍÒ4pÁ Ýb½=œ¶7¶Ý< -áÓÞœÍ`[Ì}f?˶4&‡(#8œ{³æà¯ÈìSï?«"¶yE–à|ØIWW•Ú"í¿bE¼‹çŒƒ;<ƒá­(PÅ O´\U».F}i\nŽ´‰o«TAïyB{Ößb(|W°ºìÌhs£÷ê²{ù+uþT¿|4dJó_>@M^-“ƒó\hšDþwÂÕH²ìÕÓ(ó³ÔzõH¼ú?[D¡'‰?;qì¬éô—?HÓĪÀë>Sïß–DÕ5¾)ëH³ìíÓ€¾xû™‹H’lnB¸R2!‰CLÅÇ·OÍôjè­õ¡T^¬œôýíÃÛߥ?®åKÒo­GŠœ“ÊÝí¯8?õR⢰\:¾·—ŽR>aç6¹c¶ž’=`Í8Rî­o±f1énÔÙŸ• "ºuÞytš¯xíhæ¦8ha?qNûÁÊ*b­ä[2ÇA¼4Æ{cˆ ågã:œ@1‰<¯4À@†v -'ÌÌ¿j »t¢ðÎ S2ýë'Ŷ¾6ëÔƒÆJ18ê©ê‰³ba:HÑl)tãxE 0 È-mm°±‹¨È8XÎÝÎ\º˜} ñU•Î|‚TÔÊ<¾è3y%C¶/B7‘’6jäºÂLx™K×ðž)@ :½p—¥ö²û’ó”Ž4»¶ccüAîýøn,ȼÏ6Ö>÷2Äû òë"C¥|^ËÇzûÊ!Ç -{ƒÌ‚ɾèí+•hx®n%6>´ÝÑÞ™aMW–¹ó!w%³£¡ž§}½Õ^fÐI]n½Ú®R}ïøzëßûªsQÇE ØjEœ>ÜG⽓¨iبe•c±²ÜZøb Ž¶ôÓL±“Qi6û²ßq/(…šKH”*ˆžÂ+ -x•$ñ÷ük¬þ5f×BóxK{qϱ÷'Nœ ÓDJô‰–ÃçÃlr¤«Mrvy}Ý[‹Sv_ID"º½e³ˆ{Þÿ˜àüH:´R–=¥üü­©·oçEE¦²ëkCŒ…AmŽD3Ç…áëWNüÄjAVúV't]íÎæp+C&è2¾Ö.õSv‡ëžé7kF©jf4Œ³„fÝUS lÑe/‹ ù“uPÀ ƒ‹EpXf=ÅÏ„ìþÒ€Þ•FƒÞóeSè6+³-Þ'v—šbÁ!©_%6¢¥>1@däû3ßùÔƒC°¹Ìhê&•ivúåKÚóáŽd‘³‘ýÔÓøÚK7{;úÛó˜Qr\Æg–µ¡3b=ëjsö à ±x L9MáÝëÏN€lËðsËATXNJZ¸‚~0³þ<ËÄ¡7Ü/ -¿J2¾u‚ìq¦zl‡ºäˆ•„êüÍlº'A•Dø SD÷“xô„3öjJ#2¢¾'£’‡ƒÌOÙByo›‘ÿ¥]tÕIÁ}%ë"ξŠzp öB¥Ò+FÛ9uü¼žb2ÏGë-â"]ÊD—''áþ‘ˆ -ù9÷‚E;aÕ¯lØ ´ÀŸL7ŒŽZ³xjŠ°YL@´œÜóu!Dê*_”MoÊ<ê/4ÐÚ— îâY×0"L}…äˆ*ÉDÖÏNÐÃBÚ}ýÒ_Ú´•R»ªy¬^úÙïœ9§‘^³$5w5YOL¹±5kò ¦áºÎçyˆ×ßlØOcr:Íëœ -SN›“[7Ò1Mh†ÕYjÛàO„×ÊOãW0aD˜ø5 ¢¾Ô½TÉGå!Î&QÆrã ÏRH;­/½­ø¹Ið‚|ôƒ"´Tp«Àä9Ð#)oµ&b@龫ï¥Öˮ੹íÀYsÆ·N‰¦t‘"W !à€äujï\DŒ²Ÿ)ñ]ÑÚá»ÊY¸øs¨l¼Ÿ@âØÄÊ•µ(¹d‘\ ŸÇ:âf¢Èj`¦uýIêCÕË—‹Z‡¥£kˆÒÜ–ÉпE=†[‘â¿fþ´ÇÄe öô»Ð©:?MÂ3¯’Ž .ÿ:¸µ`™,ãÛ3+´§`¬–gwP®v‚0Ò*Wm,:«ל!Ÿ©ÁÀ=>6ÞKÄ{yÚW,}8V¿¸¦…ñCåH-IªôÑUéIM¢,7bG¬˜3jz§—KÚÞTâòïªo ëègò ýŽ¾ X¬Ç»_%‚§ø»WÚ …ÎåZ/y™ÄûiÈÞ íªÄr,&(|Ð0À F³Çän¤”ìlâïxƒåa{>”æÙf -°|ݵñÚ‰dQA¤é^« c®S8ÿ bÇß'ó4×n¬i9kìågçEaaý¤O/™ ¯Íw˜ÑrqfÖ*´ûXq“©>\}°n*™%ïnjÜ'ˆ^>˜ 3¿Ä˜)ÛA#-B(€Øi.–p¹JO\^U.nóu§[.;óå#êÅxE6k%êzPÖÚ°„¨4Œå´k.Ä-éåZÒËEعÆõܵgü2°í+5>€û±†ÏevbüÀÖqÄ«ý$Û?Å™S¦²_DR -.˜ï¹dºÊIA7Í|BîJÈ5N=Zb¿9v•Â NG¥¢BøÏOÃpr"diU§©ZŽ 2ß%µÒ`cjNð2Ss®†¶ÐMÍœÆN{(òÞ3.bS$K& À€“%©“›¡PN ïçÞÛa*:ä•wƒÆ"Š<iNJù´xÉjÜЃôëóT †.pÎd5΄θµJ:–ÃTŒ~²@8[ÀXòÕ5&N†™´W\§Ááöôg¥¯«eˆe,‚)€E*›r¹ãfä7?dòVäòô9àe)ᬌ!8܈r¢¥šH‘ Â’'é°›( ]7>½Êøâë!Ùò.¾ä8¸(Z$îuéÂÛA\L±¥Ð®…–öY "&£ÅQ`iVqr…ƒ—j²…)ÎZ£’B[dgÌ5³Ck…+%—•¶R‘°‡*ù&×ÛÕr×pû%‰UOUi’Ï%œÕZT–5Ù+úHW©àK˱K÷è> J¡ŽBÕÔ¦Ž[nm<⇀•þЕã>Êaf‘—©0¼¬^ÓŒfŠ~´×É ÔÖ[™—ú¹ÿ¥Kü]v6Mû::Tɦ6£¤ów!ZÃàšÅÒÉs)°®åçÿ–Ó0{zbƒ ï˜ã—M å%¬ ðc‰“ 3è–ÓÙÉÌvñGý/ ”úÓ(ðþÎÕ^t×%‰5®¶mù@ ±àV{xÌ'XÖ9lÜA‹ÞË€3Ï@ÊZÐWµÇ²j×`¹d‘°YO+%!rXj¹yÞ³þÉG)·žä=)KûZDOR'kõýR—í·–å-îÝ‹¬š®¬wX&ùï b¹˜¦í¤;üÚÖÄ°Í*Hã¨mòÍ6»Y­#ÏsþµJE‘:ݾl• Æ–éÌô‹U?ч³D{l:§Jô11Î;”¯ü™úb[fUõ"§ñ^—R92>\` ´Ósä噜Þj+ÅI^Èj5àÙ½Ód°‚¾ýæÿ„H~½³`úl4ÿÛ¯_îneªhÙß«ö.ø΀|ž›W}çæª[Âd“zƺu_ÜúßD¡g‰?¹xvØ>K•@•—Xå:¬Ž½F«Þñ*­#ÌU?øÞÆõ$yi‘ 9N‚º’ (rÅ+F¾Ó5bÔÏ{6 Úaõ+e•µ²ÀºIX~ÿòé›Ìæn0³H_CÚ¼·oŒk§3uA|ôÔ NƒPg *÷‡ë4|ÒÛm#(cd‡·ÃŽuÄÀ†Îl œcdzþT –õÜÄÕ¿ídé8 ² C3‰Á€,娦¾:­"ë‹\`é/2ï³'¦[I昬äœF) ÷WÂ%3\üÙ/ää1<¶êÀšþ‘ BšåÌJ+ðÉö ++AœVŠrâód©5§Ág½%ž7‘Ì~¤|öö=±Õ(žcâòñþˆYod*B _Ñ^™wŸ‡Ì…@X'¨Cµ Œsx© _ÊŸ/3Æ›P‹/R „p«+l"4ê³°?r%0<§ðêFŠÖºšøx'§ž­ éõ$-õT&Ã[‰lô½+·o´Üímø}•…w Âydí=Øì“ã”+) 觜LD +Y°F£Öì"²•óä$ Š–»¾i¡òX{°^ߤ=€å/Ð*\M­XY§‰ÀÀDÎ/E/H¡½õ’¼!ÁÇÓ4ï“+;KÚ,ÆImr»Ïº}¡ñç̼nçIS²˜un É¯9÷½X*;3öxÓ‰ÕQLþ~›µ±`ün”q)ìàê²;À€}±+»ž3€JÂn$…LŽˆÊjÁÿùC wO\¥­„Æ®ó;0•[ItòBõ%;á.Jår¥ÄˆÙÁ³?Åüª?MB£¹'ÀX‰;­€ìØ6ü¨ùi[0 [ v ¶82S[,àdnÚØëm.ˆr)ù«9ÇXK^5ðhk—åÜùë~Ô\ +f[V^Qk†øà ]lÎx(`[ÿ&6—é|Ùˆ1å”°}ú™ÖÚæt´Rããþâñ4”£# +D…|f$l}¹'ò<™?—󀺘0s:¤šÊùàÀªh;†¡L“ÏœsD›WDÂÄÑî,¶8çÂ:@Vž]ÒÜ®áÄ“¥^€HÃÕ‚ h-b]k‹ï§¢ë;A¥´]«ô”ñZ†ë¾x×0@ÖÿÏ’ÂÄ1›BÛôZb5•T,é¤J‰†äó­­ÐËY}.UŽ–8ײ,T?ÖëWzÑ(Z¤kdOŸ¬âôHg¤¥¨å –°Ïä QuûÎF6H–Q)žéÃVI´l ¸”Õ®¨‹våÚ|a”'Ç£øø:¶0'‘OÍ( ®}Ê1ÛL4ü @Ó4>×r¦g÷ƒ›ËÑTXiÚi"I°emÏh^Ì4 +•½L͘øо£Te¡H‚œ•ÖhNáX#¹áõT‹ × +¢Ëò4¹£GUõ®¸åÈ’çU`_Y Eø®ðl_›¦fI†d„Éeƒƒ¢ùÔ}¾èU9§à5XЬ¶; ²BczÝRhdQËlTïnØ’ÉÜi¾Žd~ˆs¢tÈKà>Œ:faˆšÎû ¹Î¤3" +uJçšl…[Úž‘Œ3‚p)>q¬öì§Þ<÷†Ú§)³†½~?èo!+HVåWè<ÿð‘>îd.ùê‹E$Ý›ó€K§Ô¦‚X¶–“N«©\@ÙÕ¥ÞrsGAöJß¹¢ÊjrÎ*¾þŸ¬WZh>ø|Î +lL|>QÅO¬ ´½6ke´âûäM)+c^o—’…O@ãÄø†ãÚç÷².å–Ô9¼`»fžºyé`iï‘WzˆüøMÀ¡¾Ïb¾ÖŤ…!‘Ô;:Í1µ5ÖŽÍ_n߶aªÑfUÙ=GÓBÔ´—Üm³Ê²Â|öc|ý¶Xõ[‚@»¬4Aÿ4í\@Käc“sËÀŠ¡Òˆ^äÖ£±Pãhúø“ i˜1õ6C€@@Î~€åwiëI=Ú$W¦ãSçˆo®°à•–·´$—ÿöç'4ýíGÎRC›ónÓxÄÁyvB«3™ë‰á‰É3펮NÖéé·§*ó§T;P4æM=vUí¦âè.ut–Ò+.=|ûœwt°tÍåcÏÆTÌ'å…a3º±%Œ#mÑŸæÏìËÿBÓx#Ç&Ý )ÈB6?¤„¸¶bi‘$¢~<êã%ûÓ¸t­»_Hƒ}–Œ™‹\EÚõÓj&æ,¥þÈOCŠÝÍÚûÁD âQ hJ`MºÀïŽÜœj˜Óyƒ +Ê^Q~—>†.ClΛ6}” +á˽WãnütÚy½Ú /û¯” mL)2ˆ8‰Ïï M² sýÂÿ-4¸endstream endobj -1835 0 obj << +1923 0 obj << /Type /Page -/Contents 1836 0 R -/Resources 1834 0 R +/Contents 1924 0 R +/Resources 1922 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1805 0 R +/Parent 1916 0 R >> endobj -1837 0 obj << -/D [1835 0 R /XYZ 85.039 781.388 null] +1925 0 obj << +/D [1923 0 R /XYZ 85.039 781.388 null] >> endobj 810 0 obj << -/D [1835 0 R /XYZ 85.039 761.463 null] +/D [1923 0 R /XYZ 85.039 761.463 null] >> endobj -1017 0 obj << -/D [1835 0 R /XYZ 85.039 667.044 null] +1019 0 obj << +/D [1923 0 R /XYZ 85.039 653.495 null] >> endobj 814 0 obj << -/D [1835 0 R /XYZ 85.039 667.044 null] +/D [1923 0 R /XYZ 85.039 653.495 null] >> endobj -1838 0 obj << -/D [1835 0 R /XYZ 85.039 642.326 null] +1926 0 obj << +/D [1923 0 R /XYZ 85.039 615.228 null] >> endobj 818 0 obj << -/D [1835 0 R /XYZ 85.039 542.47 null] +/D [1923 0 R /XYZ 85.039 488.273 null] >> endobj -1839 0 obj << -/D [1835 0 R /XYZ 85.039 515.856 null] +1927 0 obj << +/D [1923 0 R /XYZ 85.039 448.11 null] >> endobj -1834 0 obj << -/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> +1922 0 obj << +/Font << /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1842 0 obj << -/Length 3278 +1930 0 obj << +/Length 2597 /Filter /FlateDecode >> stream -xÚ­koÛFò»…Q -°hr—OãPÀI›« Ÿ“‹ÝKŠ6(‰–ˆP¤JRq ôÇß¼–\JTÒÞ]‚„û˜Ý÷ÌÊ?÷௞„®§Óó8ñ]$çËí™w¾†™œù1¹óòáìòu³ž›zéùÃã°Oè¡>Xýâ¼úáúíÃ÷ïfs­µãîlljs{}÷Ï™ï\ßáxßïàî¿og‰v®ïäþýL%ΛwðýÝ«w8÷ó[˜{¸ys7ûøðãÙ÷=¢= -€TŠXþvöËGï|7úñÌsušœ?AÛs}˜Þžšnhé—g÷gÿê·â¹àœWM%Ô‰&ú˜*~hQÅ÷•«}u‡žz‘e—µíÓLÅNݬfó@)hð×ð«ÞûnÙå<°ÉÚM.ÀŸgaèdå¦aÖwZÉÀv•ÆhZ¶îš¬š°ïl‹®3»Õx ½1;™S:yÂÿêæͤÛàè¾Eniæ>R.¥›¸|ÉûÊ>Y[Tkæ'á’/÷M1£ýc¸r8î)¶ú 0#ø²„0Ä ³«ƒhÄ OçCœÍÃÐsðÊ:Šv è,ˆI+ùÕóƒ2?V”¦nœê/¢eÁœ‘(N\¥}Bë¦Â“‘Ö€Ë*o¸÷X7ŒÐ}¶Er-`2ã©®æïŽÄ +–Å.ër+d³fø’©“-fs”@›û8¾˜¦ÆÝ`–8W—²KÇgÓÉû¶ãQÞfØÔwJéŒJÃíà2Ÿxd¿³E%¤ ƒ‘€h?%-Ð~,Z@·ð“^pFT–ìó–­Qˆ9®0ãµ{#ùDI@¹âX¥@§ÎOÕ#"Út[íÊg´5¯p )–ÑæƒRk`¡Ò¢ZÅÚ)!lf%-®±§a¬Eï°M»fl)Á­GBvÙO¿z¡Wà•’HÇp°“ŠíŽùÐÒ‰ˆÃ¢”C:9¿É»¦è­ÍlTH ÊhúÁå–@aì22ilÂ’°Nê$f¹…AKn“¸ç¼ÈwB”ˆ%±¥AÐùDWßuÀÁÈÓΊ`Í»n‹ -ÏÚÖñ­xk­Ñ>Œž -`´B$£½À²æ—;( Út¡ÝiTŠÀwÖy×9çÔûŽ¡‘ø%àgQYÂú°ÄM8ùòµŽ,[¨üÔóí—y·¼;L #³EnìЬDEäŽwÀËëPÀÛíâä¾aè* ’<×uA¤ú)×S‰m½@ÐT:ûS++™: ŒmL´ë'æ€í'p7Z±¿ÅO+”û«T»"¼‰éõFD¥‘³kÈÊ¢1/Vh%²âð]çUβ=Á•\±èõÖF 챩·£u'ĈÜ(‰GrôUF°Ç¡]&4p"VãB(ÐnëZÐ#Ɇ}1[Íá¼_¢‡ûô#¯JòL -šÚL\‚D7ùÓ²éõܲ®†‡ì-Ý!þX—ì+*®èN°Þ²Ícc²lQþ}çj -knÙЛ’z"5#¼Ì:Íñ’xö¥MÈoð‡ÌÊ°„#–,ÅHóq¾„è:2Äüv!Š|åjïÛæ²´‚’¬¼l­è’ä¿`SÛ‘ ]NâDôS´ à²ø摯c$€:Y“s£Ù#7ªÞÖirРÔjŸ[>vËÃ݆i¨Ñïµ swsÑMpÊûKLzÞYÔ³&ä]ƒmùƒÏßN²É5â8ɦ(ÿ›úxO8ýKÂé¿gæ”I8¶›|¶ªÀõ¿l[76wdCºn08 ÀVPì„ʉÃ{ô2A¢(¢ÆÙ>ÀŠÉÁèd<ÕÖûf)S¨ E“=: -éÉ9`˜æöå³ÜRk7ÖÉè–«ü1CƒQvF°$ŽÐ'-(¨±rØ.D[8=—ùB$øO QÁ%kÞ9X|Ö]~É—ŽB|N°ÀY‘Ÿzª(BÑ KzrŒMê:6ÇXL‰fƒÏ4.…Þò€tl»!‹_®›‰®`ÚJêK3”ÐÀ·‘l¦“x@àÈ ±©EñˆRð(H–9ôΛmÁl*jIÇ•bk‚@±ã× »}ˆˆ°=N8C.¾ö{Ü `J1(jhȸDµØlñBŠ¼"¨!ïyÒu¶”´@„Þ¤LLóYÙ郭é•ç¹aÜû¿Ðø¾›øzDªÛ‚ƒÞ'&LŽ‚îGC²ê+gÒ2ÀŒ?Ä¥ ˆ<®Zˆ€xV²5XÖpvˆYc'c«¢¯I,A žyÔ–èÁ¹¯z¹íç8%Ãv3$¹hó± -I*ÕÔG¶á#¡hÇþ¥×\ /­-¼ŒÈÅ”Â׋pyÊÆ`Z*tàÂ'¤BƒéŠh´g”{h®ŒÌÈàƒ™ò`Uíùô1‰’#+NUN¾·™È&D‘PŠ‹2S" ½(¢làº>D‹ä×Ø`ÂpYTÒ2)$¶Eãû²ìùÔdhQEgå MÞ`f¡sÓñPk¨÷åê˜ï’ì„ÍY#1ƒð´®Ä<Ëј_ÃDÞœ-÷Ê¢,¿±ÝvÀ:”ÔN¿Æ-Ƹ”+O†!Ús=åyUš*ÛæWûbuõá+¾@4òcH€ÔH~¹^.Á½YC–öy—¼º}õ0ÿ{™µÝ|¹Éªu>ïŠmþíÕmÉ7‚!^8\ëÑ-®ËŽ¹´Þ°•$ã[>‹Aëj•)h{ÎvUPÜ^¬¤óµ‹^œ4xS2¬Tº!žc6—šh/uy˜4˜´¡Jîš#¢  òÄ1p1ˆk0È1,Îëªæs`‡§t8‚U3–<Ñ,)û²ÑœtIíM~\ͳb!”¹%o´ÊÙLPå†JU!*0KäÈ›„n’˜óß7³8v®oogqäü<%öÚx:®ya¡S¸Úe†èx±>ë;y“ssÑ—ÛBG+þ¾øð‚KœÜdM¶ìò†jk‘1ÈÄDª«ôö„vg†vé…÷½zÁÒ’BN¤ÆzÁüFé4s‰–YäJ,†1>”ê: èýȵ ÄÜ,’Ó¦AŒT`Ûb)v—ÀÊ•ìóT@þJ“h̳B:¢$ʪÙ+tÂÇe'æ RÝó{›Ö˜Bž’´ -§W5«Z6™]ÊF`⛧zv!RLæšgVöûu©üÛ"sæaâ 'vÁ2]²ÃýD¿šVB4Ür|W[Yç*µŠ9’kÈcŒJ §æ6« ÓçöqÙYx•òkÕˆ¼a­%u5€-éiFT±ý¾ ²Ç=òÔ„ãøR‡_ëÙHâÙ“ -þ~3ó‡Ê¼Öv 4}œ³Ã;t{â8^”:“Òd(€`ÕûeÉX<è܃"§Fž“ .¬—µþ¸º=닯¤Vü˜HÍS£ÔˆÈ~è^”¦” ÒaNH ”ÿ•3ÎAŸ5ÈøœÒ´œd•#™ì• ·ÉØçpõÖ´[¢»ÆÃMøÓ{Hê¨Mi2yÓ‰¿®¢€šú>3y qš<:´‰W­e%…¼ðE…G¬]mòß³U¾,¶RŠ AJÇ×E×rƒEož ->×s}=ó­ÐÕ;ŒYûRúP% -âÞ± ,2R‘^–Êc«?Åû©=&hm?&èáÛÖ“Ò €ÊT¤,x!9ÅîàÉ㤲öÏAd%?§Á˜%Ðcò SFZƒ•LžÔò "ÇŽ¤èõ–_çÈå¿2K.˜Éùªµ€ÝûªHù´{" Ïø }Ù£«S‘Z“ïÊÞÚ£EŒc1§1ŸÒ+-&ãàÙ}ŸçFÌó¾1“ Áï2¸¦ßÐ’'øßéŠÏ$*…¦)0s÷†â·×÷÷ïß¼û¨(ŽÝ †¬ÌÛ$„B"'Cèü¶¯;–UyR“$N¥ì£m»öíÍË4èÛvWRKÉò¤þÝð «;°Á0Åy ÏŽ_m£H25zç’úç·(ùZŠ8¤éV$QÛt'QZÏؘ‘¡}²<ÊÕW³©E½¸ò=ïêaÿïlê'ÚÞs8‰òäÏÕËz¶O~Ü£¯4YÔÕ%`¶©¥&&§í—QéÔoà#ð?ýì¦ÿÅD ÝD§Ó?˜UìF ËŒ ^8ŠÑ5¿Î9Â÷?/Eendstream +xÚµÛŽÛÆõ}¿BBErxEÇuÚ Üc+h +×4Å•Ø¥H…¤¼^ ßs›!)Q±Û 1 ϜۜûÌú þù ¹žJ‰ö]¥õ"?Üx‹ìüõÆŒ• ¬F8ßmnÖßGÉÂ÷ÜÔK›ûO䆑Zl¶ï—{ñfóêír¥”rüÐ]®’D;¯_Üý}é;/îÂï_ánÿo–Z9/ÞÊ»,íüøV^ݽ|‹{ÿ|{›Ûï–6?ܼÚXE­ + TŠZþzóþƒ·Ø‰~¸ñ\•êÅ#¬=ׇíà ¨éF¡’ïêæÝÍO–ï… ¦š3J¤´iui?š±J乑’U>â¡žz8Cç +Cgˬ[®|Z¸ØâN೎àHÒ´ý—ym‘Ñ—rî¦müÑï¶Ýa$ ÍØX~XL±âŸmAy[~\®€¬îUÖZë3ƒ¬Ný^Øä(‹RUE½è§eäT §Àl+­š’HUྠ+Cí”°¦eâ<àYIàÑõpHÄ ¡­j»µ,³^6Ž„Þ7píäMÅtmq¬ž–:t0uìÜö–_Í«eï :ÌCǼsÃËŽ„Œ[Þê¥À´„  æ`&ìg¬‘gUŽÌOÀ lŽÞÀä8 Œ\À6pëgX£PLA(BЯ-úS Ÿ5ùÐ>ø +Ñï=‡îì…&¯J° ðí]£t¸^ÊJß‚ Tà#z'–QAp&Úw:²^¢„ˆŠÏYÞ³?ž!$?C¦äóÆC]<òŽµb¡”ÏÖ´ì™ô(¦ Où1FFèlf^:oä`¥|J)ø±Ñ2|ää°7 +á Œá†8’{UƒH!9§<É9X”S‚ ­,H=!4 ŒddœAGq1 ;ê¦fÊ!kÞ’0ð§nPh8ÅÖÒóâ¡éWrÝ„ÔÈY¤šDߌ³š¡}d]Jðo5A Ís½ Ù;¶µ‡Ñ†Å‡W¢9Øv2.œï²çPßO¶2aôx +2é BõµØsld§ë›¶ØXb^YÛŸE™æþR)ñ1|·ßt¼=c-‹9àÿðO=Ý\õåx&ñ®®u¢k9­WP\Öª¡7Tf$ø ùW]ÃÐ!þe|2IoÅSI`,³ü,Èsy°ámjÕQ'µ%ö²¶àp;÷=VM4BVwT´©£õÖ°MQÁDíY™µ¬—üÅc<0ÒJ*þ5Å„MP@Ã@‡(‘ÅŽwæj ŒMî•q)Jc˜ØüßüF84ã°º*ŒG3Ncšù^°¹\E‘çlèŒq‚ã”Wt!‘1äŠV1°ð¾ Õ€suòŠ‚Ôõµô+¬k¡æê³%/àlAù&¾æÄÇÆßð/te^ÒŠ(LÙþ‚i§®Ôɸ†œÍðË‘)©õ‚hª8œ²•6`BôS*æÓ<0ùéÈ¿2ŽiŽyâ$1Ùû¬ÛSí ¼ùìöœÝ(£ñ¨>hÃ;§Î>|ÕT4 Û\<çga1jOõ0CŽú½¢ôCriÂ@uwû ¯æ2ú\Ml×¥°È¤žx¬ ””z@"&çÁ¼À˜÷'J©¾bà¤PÕñdPEÐc¸‡’ƒ$6ƒŸ`räˆN,×űêT§Íu!áüØ©/«i{y†,×ßÇÞ¨ûAàê A(áð2pÊ%ÝP5ÂŽ¨&•;Un—n&±¥Œ¹1 Š-×’Š¸èH…6wE]´\£áK”¥ãpm§þcš²œÍÔׯ@èöƒ¡F#­?vUMÂC*•Bc“ç¦ÇçóQT ZM®`;;ÏÚTÏÌMN¦59Æ8À̈1ºØÙ0{é“'_0Û‰ê&¦Ö3Lã8ž˜øÃèåUôžïÊ<­n1&¬Q*ׂÃï3¾ó|fFÿÓ1ë¿ZW4Àorm~˜{üpæt0ŒBU§0áDuß΄¥¸~à ÂúԵ늋 t­Ö]fåfë£ ÅXºx\ϾÉp”y¾%ñ$BøŠf¼w’{Ž™@ÛS=©¤8bÖ‚#ƒàSÇríµÞ˜SZJ'/o·ïž ðËH‡ŒÌÞ¨ÃìÚŒœÙ +Ëû†&‘íhП”‚É5W ìùs›œ_ÔÛ"‡»§yùÂwªïžä&]ÜgôâÄO#ƒVb?u#íO›ä¸˜NK)ÞêVO=p|²çRgU@ÿ_2Ì»ðê*ˆRÔk¼ Ð'_‘ Mhb +Š[Ëì”ɨµV“533ÖÎÿÄÝž<\mYØGb( +uRéX†­µ½ÖIh:k+ÄG3±®ö&*ÃiSw3³Ž©æµ«†g«õeÑCÆdÏD@äÍÍ*¢âÆ‘Ÿc®ì4°;2-2hˆàv4%YY·c†Ÿ#øÓ2Éï—™xÊU‘©'8Çr%µ›ªpi¯KeGþðHjïÊ[z˜hÛrÃ$åKxgl¾(?W'rE+¶åè! “”˜Ž<€Hv¬Å¡«Ö£„Bªò¬ˆëÖD Òã!.fG¿Ù¨éìA0jÈÏ6PL© +û‚òU!š×tŠšøKQ“Âõ|u=jb5©­øaIC¼ç\´‘Ð ño>ák7I’é„Æ×逞|ûO º(…æWæçp:c†ƒõB>øÆ>(§¢š( ÷t?cMz‡ÏÇ6C!G†ŠŒýxt´÷UœoEßQÉ¡¿àŒXd­ÀD^SÏ݈ä¸}’Æ?Ž‚ Ê›–^ëÊ_¥¤{Ø‹‘Kß<(Ä#ÿN¡rc•N0®´uv(žŸÊíó_¾ðß—èÔ>4iLŽþþEž7§,PžŽÅ‡ç¯_nV®²®_åû¬Þ«¾<ß>Ýàœ‹h¨×•·-å¹A:÷²ÿ³Ô?ô·Kû>–Ò*‹ Îã$]ð”ZŸ«kþÄy¡ï½ûcCendstream endobj -1841 0 obj << +1929 0 obj << /Type /Page -/Contents 1842 0 R -/Resources 1840 0 R +/Contents 1930 0 R +/Resources 1928 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1846 0 R +/Parent 1916 0 R >> endobj -1843 0 obj << -/D [1841 0 R /XYZ 85.039 781.388 null] +1931 0 obj << +/D [1929 0 R /XYZ 85.039 781.388 null] >> endobj 822 0 obj << -/D [1841 0 R /XYZ 85.039 718.394 null] +/D [1929 0 R /XYZ 85.039 596.451 null] >> endobj -1844 0 obj << -/D [1841 0 R /XYZ 85.039 688.99 null] +1932 0 obj << +/D [1929 0 R /XYZ 85.039 553.498 null] >> endobj -1845 0 obj << -/D [1841 0 R /XYZ 85.039 688.99 null] +1933 0 obj << +/D [1929 0 R /XYZ 85.039 553.498 null] >> endobj -1840 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F20 937 0 R /F36 955 0 R /F57 965 0 R /F11 976 0 R /F35 948 0 R >> +1928 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F20 937 0 R /F60 1548 0 R /F39 974 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1849 0 obj << -/Length 1308 +1936 0 obj << +/Length 2380 /Filter /FlateDecode >> stream -xÚ¥WKoÛF¾ëWðHåšËå³@Nâ´ Ùµ…ãER2Q‰tI*Šÿ}çµ%+½†½»³³³óøæãZ;>üh'”o2'Iµ2iê»™ïl`ç×™ OT¼‰Î»åìêc »¾ÊüÌY®v"FÆY–îûß®ï–7÷sÏãêPͽ$IÝ߯_æÚ½^ <„ñ+,–<ÞÍSã^?€Êßó uoïEáfñþ÷þºƒ½å§ÛÅüiùyv³]§2ôòŸÙã“ï”Ñ癯L–:˜ûJÃönnª(4²ÞÎfŒ¦x/tøÔ¥¤D&UQjÞfEG“¬èÀ¨ ÐNù*òCJ˧5Ä“†î+F×îqaܼ«p¹ùv áµó quÓ kï{PÐn’ž5‡VvX¤ÝŠ×óLH¸Ã[V/yO«CÉ׸hw;r¼¥”³b“/¬Á9×n=GHØ¢Ý -6i¯ð°,Ž'9ð4&2£ÀpWö?Á O }—]AÉ+ -4kƒoðw` 9ã¦þ†RŒR“ð»ž÷·<¾AÌîQóïc4M=àY—kû–Í }®DXÊÍM+®`Fr¬ÑÑòC÷O‚®8)žÄ „!u_:›ÖoèB»ïEnk%éâC”ê± t|i6,h3Eã±rrwSþë–¯~äS¨2úWRª¦´"œ€²VÓ#Æ7"4dT´;–¬1L™‹ ªlB@ck¡…’á¹ćŒl¸îêc”L{,Ö*3)8·÷»¹ ðxðNNš2UG¢OUh7]¾ã;¨_öýÀ«d"¡ú¢w+ôNì²í$Ì}S¶i8$êƒ ˆUâ›LHY.„’ª$=‹Ìî¥0L ²$å2¯vmÃD™÷L­tM>ðbÒ&¬u¨aŸfMËã ª“N@`µ˜šh;„xo0Ä|Eáƒ.Ô¥çÙÊö,Þ\–ÔT«$ÚÛº‘ÙÏ¢öB_¥Qz’¢cßÙX« d¯z&_,•ÂFÕ_HÒi3RÑ2_š›ç›m»" -xBc™d‰kIÙ°b»æ}ÛT(›P¬*ÚF4¾ú:´P%lª#ŽAPËxx¶¹CŸ&fsÄ]Ê;2 ^Wp昃º=µ†‚Öýûv•%}aÈbUr{aºøYíªuÕA•aúŠì‰Lm¤Ç–:LäCÅbÛÃÜà 8ãbC\‡ÃÈHùí¼ƒ¥´á7ÈÄ\$9­ °š]J‘§ß0Ï‘Si%}F û’š sOòj¤™á̘ ô¡RKGq‡ö"é$ù2³ÁN1 -ÍÉ3àm9è<Žm[œ@7ÈT<ÒÔ’}“PÀ¹~¦Ç¶dÑ„±¸£»v°Ä4r7iŠ¿¯¼*ದÂl©òŠžiðùÊ$ÞF¬ -s„&2\Õ¾Ÿry0enÃN[Ò£†’ð$EN¹Í¨[,7¥ÇŠ´ûˆþnÆÒ¶*7£î4©åœLˆÝÞ˜¸¶¥~VÞäÄ[¼È n3¦B–1B²sÈg.>/¾¼ã¹@‚ÆðRåÖBÀª” éÞËj×v²ßWM/•Ìòw_ˆ×2y·Ë·<ßcšêï‚Æx -, ÈÊAÖU5WÔ…¿•±Šá°î´vÕžßÆWAvéÉ ¿ÿÿz™ÿ„F¥&»ü쎂DÅ0ö]Óswíþ¿ÿhH"qendstream +xÚ¥YKsÛ8¾ëW¨æbªÊ¢ù_ªÚƒ“w3åq¼±v“©Œ”DK¬¡HIYñ¿Ÿ~$%Æ9¬S)ÐèÇ× È:ðÏÆíøÉ4Š]Ûãéz?q¦[ù×ÄŽ¹°Ì{<ï–“«› šºŽ8ÉtùÔ­Ø*ð§ËÍ7ëý¿¯ï—>Ïæ¾ï[®²gó(Š­Ûë»ßf®u}‡tß2ÃÝ’¿÷³Ø·®€åáËÌ‹­OŸ…áÃÝûÏ8öû=Œ-?~º›=.|XA T‚Rþ5ùöèL7p¢_'Ží'ñômÇvax?1í@ùÒ/&“ÿ˜¥xLMyÖ˜R?¶ƒØ?׊Œh%pìÀQ¤•ë¢ÝÁªÃv7›{žgU%t‹WîÐX†mß:4Ðp­(eº§ö%Œ(e€”o £âØú:ò‡¼ýþ%¯þ ¿ÆÁuu(Q»-*N4wñÀ IØâÀë3L‰,Úõ‘ ¢ ›Ù< #«€fÚà`;_Ï€åNËm6'Z½=¶2žJœÙÚŒUeÃæOë>G¾Å-ò?WÁ—ØSs µy¦²ŠŠ$­þDF’WsȬ¼ä¯Ö-NBÿJ÷(ø*åÑ5.[›ÌÖ*ñ"ÛIX%i©ØʼºñûFö<;NÀˆó—³(²®oogQhýÎìŸ<\¹ó=«¹ªÛÞAc55ŒÏ[+2 ·}¿_/¸ÑÙ¡N×­ñÒtS=ÉÀG£®¬ìmš1wÇR1áÆ°‘ +ÔO6buG(6ir);ñý‹‘‹zqd5Ú)( +&Îùƒ 0 +žÓ†å¸Á‘B={b‹ç“r÷˜s?¥è„…lS1ñeÀ‚E¾½s Bp¡UÔ8rfl"àË”]Š ‹ËðŽ?P)Žû'l p›7mŽŠÛ2©zâ-Ñé°á8Bì¸Ê.ÅeRŽNP’=b w¯ˆØSŠ)©h¹ßîÄI R<ä$pŠ:)æ@n>Y*]ÓŽYÓg•Hñ¹tÚ³9vœ¡¡hzœLО‡ËÚQÔ¹AŠžÑRŽ…Át+œ"ª:WÇëúÖ K"É#äÁ!Š|ºÖ¾˜3e—}O7™¡îE4FŠÝæmÃÝ?œÀq(û&—H ­ëù ]›Ç!ΛŒ÷ãÔé’êec +ò\v­µ"ÑÙØiñ­T€¸À…ÞŽY7äïŠ ´ê0îûùZøЭ€^J™œ?½ø¸À? @ĵó ^báˆÚN4¢!Î%­ ´ LãÃÄ‘RFÎC©h…²’Åk¬=—B„Fr`9]ô.·GË[Ù]Ü Û&Ù‰˜è å–‰/8QV¢|È[?éZ¦éL<4á½^PJ%וbˆœõxè¨÷Sñ¶ïEH§c}ŸÉâÊúåî“)ñ¡ðÀœ­Kü_xÕ·ÏÉÕÍ`yeý쇪eh`Çî:¦CÝàÒ:°éþ¹ÐŠ¿”5+}̹k™Á´>¯G¬ ýtcœ’zœž«•l¤‹RØhç6ùà hÚúU+·?2¡Ð5V½LÉuù‹+,¤J {e'èIùvèG¤§UµZ¸Ž³@“^`݃9¾€Æ.__òGûMÝÈvcoàcßþKË;ÖãâöýrîÈßâ]µÂÆŸ˜þ°…—œÅH¶«¤Ñì2> endobj -1850 0 obj << -/D [1848 0 R /XYZ 85.039 781.388 null] +1937 0 obj << +/D [1935 0 R /XYZ 85.039 781.388 null] >> endobj -1847 0 obj << -/Font << /F60 1074 0 R /F15 951 0 R /F57 965 0 R /F35 948 0 R /F36 955 0 R >> +1934 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F35 948 0 R /F36 955 0 R /F60 1548 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1853 0 obj << -/Length 2521 +1940 0 obj << +/Length 1616 /Filter /FlateDecode >> stream -xÚ­YmÛ6þ¾¿ÂhˆÔZñEowŸRÜå¢W ·{ŸÚ" -y-T¶¶’œí¢¸ÿÞy!)i-9wI ¢Éáp8œyæ!W¬"ø'VYF*_¥™U–­vÇ›hõ#ÿ¼VBÇ*Œµ†öÌàÆnF:•±klR‘‡J ”ùöþæö­ŒV2 -“D­î÷+!d¨„\%¹µÒ«ûâ§@ÄëMGÁ¿šõFEAq®ËnýËýw7ÿ¸÷Ú­r7mfýhµ‘*T©¼j\’Š0JäØ8¡ÁÜdbìVÈÜ -6ïMñÁœzóP®7"X40ŽÂyû¼Y ╈Â<Ê'È,LÓ”,¸?ÀŠJéà´-þ„¿UpÉ üýµµŠ:l?w}yä‰cz§jSšºnÖ0ÿ©:=ð°)>¬ã$0'ìîAÄmö¯/wë턯„MÍìWŠ0ÙB< ¥C¡ÀÃüg¨<Œ³Ø/BÎXg*h º‚vùˆV¶¥µx£$¸¢1E…¸+)ƒfÏý]oújÇ}¤ °ý¨çÀz -vž…N -Fêü9Š#œÖðO¥Õ³oZnèÎ[g¥; èíô%F«À”â]ýÊzeêŽÖlÁ€4hν=jÔÒP¤‡[¹“ÄÒÑ€çB¡?ùd†éËcepwut'RÛ0ëÈLoﮯšoˆ÷G½=!þÇî<‚xt,è•“mø£»Æ—÷Û`¬ wÍéçHhŒ‹s[Ú|¨Žå¢ÿ)â\|º‡ùW?¹,ž›ÖnÉà0ƒwUOÏØ4 ´bsšÁätbs6oçpÛÒƒXÆ¡’ÉU1’Y&11"¤p$F2‰ùž‘…O8I!·¹ ‰«´+†3Bï_5jYæ5¤Ó„‹Þ]à»ÑÊÖHD–m÷ÜqI°™{ìPB2~YasÄ„Øþyv5Öê*P”Óúf€cËé®7©J‘jumǧ‚WBsvæä4Ú2†?H_…¶Êv\åcÚ/-S×€O:RAM$e°¤ÀnØꉇ(Ð×íwMÄ{¦ñë’>†¤Ç솼/íÚi7Áå>:všÄ:xc•8ŠkUÁÙÝ¡!¸/X–j1šòÁšÌ6\²™ý™°Ä¥h'á40Žs*åD•TºTÃQ¢oX¤-\!³VR±Ê¨§çS«±¤Áuœo‘(rAƒúÝŒ¸É7V3“áŒ9$iè6hÂ$"{Å™±&j|ûV%£h!…QÆüý‡û»û7÷ÿ¹[cÞÝqûöRÖöý£é`I‚ßSÏãʶÇ}ÿ€´tv`w0-·^ŸÌ±´Åö}uªú÷û³ó8vc‚Ìßغi.rklâý¡Â‰âgO#hùXWQìÐ%¦ölÁBfëê/ȳA–â®êñcêª3ƒr<¯óx5âê ÇÏ2qîë-fAÓ3&v(ÑÆmpH½ª˜è>\9'P®¯_G2yE˜ã2È)-C‘ÅyCXÕÞ!ïzÌãÝÿƒÀNçUã™e† -0Îáb©!.®;Ø9 -нk|&U^Öð§²;R:NüB8K?vóñ³+,‰µ›1Õk ÈYà‹Óÿ±í›™ôœÜ´´öÈ„ûÜ3@5ê¹,Aå‹‚Ôpå´‘Êjq_ßKši'z¢%_B†p¨zt¡n”ÜÚ[Ûþ:N•0ÐwmsœGŸ‘*"uå- ɾz3€‹0Q1ÌCyD9LÛX)†Œdo_3ÚÜÙë˜Cn9Dê,jÝÎœÐ×E¹¯—4’†³GDbìücÀ¹ãs÷[ýÞB[ÄðæëÂ<.æ"Ò>K}±…2»4úp.»~:øßÿW>!"ôˆvŒ'òbRiAn`0†Œ¡ @éÅÜnÜç‡óe‹fVv¥sWHÒŒC,ÂAÕn(c¦‹]bª=»¢9 ׌§ƒ»·;{覵LìXÀ5Q[Eá)¥ôî^Š Övö>îláÁ’?š"ËÃL©« 9’YFtL>Š’ ¢[B}w0küFpî1ýËǤ;¥W­d–!]ÄigKֽÚ)"V™œ…58•Þ}x™vSvLœ{CWEèØ2P¾ ÌH¢ò˜Ì/dC¨pŠÑüÛ3i©ööÛ³-ü>‰V×ô ZöÌÝ£Ç"Š2|ô…ø+ü^Š£d“ÂÌwø뀶Eëôâf€—I­æ¼Ûô«ž{mfXg¦Ö²=-­ØTiŠç5¸a?ÕòËôG  'Œkfǽ$¼|ÂP@ D_¸ßŠÏ»ô:]›‘²¹÷ ¸›æ¯ˆÆÑÃV3“‰‰‰ -#­®˜˜$0˜MLœ¾¥#Îsø"ç–y¼^<*§ªà*äãÝϹ¼?bñùÉœå&œ;ú¶™§t ‘š^I†®™ α&ÇîiÛÒVHTqyÅBˆÎeàxý0ü €¯ÝØ÷hhEþþùË÷ï¾ýû»ß^ÁøÛK„]c}ÈˆÑ -ôùš‘+Ç¢ç/Ã|äc³s9¾Q’Ê}_ͤ2d.ÆTñkX¶sm<|áY::xÄù)%¡`äPßE(âÏŠW§k3Rv¯2‡ÁÄ/øÑŒR¦ -ýE,tº®[΄›G:1ñ2£èÕ‹üߣù•¥Çž†„[>&`té}Y¦%ÁàL¨ÛYï}c.b¶]SŸû¡"ú`ß»‡³«0ó¨,©yµž{ zEÄc5ÃÞì}`|¦W#J¤2Œ‡R¸[ŠäóÐªÚ ºfð/ -“%n½Æ“Œd˜kñ%ìsª®Ú'£¢Hí»üS'”TtpêK5¶_hôù;Ã!jè='ÀtÏRûÜ^)È4xðü52•žØ@—y@ÖDÑ9›GbÊJö— ùåÆèϵn'J_P˜N¯G m‘Ó/¼D¡œüyvùõÀIΤ7ˆŠ« ·’ä/׋UÆ™Z^ðO´ ˜endstream +xÚ­WKÛF ¾ûWÉE.âYFÏö´šA[ X÷”‹‘¥] ÑÑälEÿ{É!G’r{(XKCÎð#‡üHIǃ?é$¡ðTêĉ*Iœ]½òœgü¼’¬„J„AÏW„+ÝD¾ð‚øªÛØÄ2*¨óãvu÷Þ÷ßQ¤œí“%žH’ÐÙæ]®7a蹿¶ëòÜüXýúóöÃê§íxøÙ¶+æ=gã+¡bÿ&¶(ŒE(Õ› m4ÇæGð+›„î>ÿ¦›A?ëtñŸ\_†0é2t¤'R/A“DH?5¶{0©Tà6kéë/ø®ÜŸ!f~ 1YÅÐŒ°Çç×~(jÚ¼×,ìqO°¥­ªví'îKÙ<“XçßÖaäê—P±.;¡Hã" R„¶ëD¹FpÆæ÷tï7gV­ÎKX¶6Ú§ÆA£•rG t“ãƒO²=…¼<úœÀŠtMª˜Ÿ¼ÐC íY¬Šœlo;ö‘túcfAÏ5´¤ô¥¡Èð–ÌØl1Î)Ö§0€4!‚D”X,t{èxmSqì{ƒ­² wCÙ6d(3÷iV²ÿÈ“f5Ž ;ÇQD“B©.Ce­qÄ4ßήm>y2éó±+8Iʺ¸âÌ›CgÁÓàZ¯dâdç jÑóÉÃùM”Í®+´ñhž ƒºèHµÖÍÎæ¬ÝŽflÈÜÅB)\ºð_o£{ßW:àmnQs,{SÃV”³ÙR·ÝItˆÆî«Ê^!ÜÍn X¾Œ—‡ù˜sêŽÏÖ(¦r+«4ß‘É™ãsÙPöÏR’2ÞmW}9Ä!;ç(&¢z±€>€üóuõñ³çäÀUVžPiâ¼À³'dš:õ +h*VüV­V¿O\ÆGmfg]r™Š¤ˆõ­©B¤úp–¶KˆàÆÿ d{ÖmÌŸŠÈOO0ˆ9³õ}…õƒ$»·›âLg±ñÐ\ã(µÇ§Æó U]oC®ËÉ›2S‘&·!*‹}(ð‘D 1Y œ°ñÃkÄiÞü š~Pט®™¦¥cÏÛM/ ¢‚„ŸZ*eX8ÉEáˆõ& ¶Bs0t^hM¾f »3ÍHª()Êao‹½c´†6uU½Ò{U¢Ù D~…H¨&=îžÛ£·1aÂKrÞy™m@r™{vƒ­v,jô8Pî=Ž(زþ•º¦õ ¦­ýÞ´¦*'}ÓÈ,ù`¬‘ìéˆÎíì)ÌËàÈž:ÀA&ª,×pÃQžö½K´ ´+žKÂZX¶¦¾÷d Ü÷8>XV/þÔõaìïìÀ2ñâA÷=]ˆÄKÛ¡ Í0ÅDáÈc†–»÷*š¥6€ ”ˆ`ÍôƒíÃö~ûÇÔšº}=Ü€ù噡Ùf ù·¢ë!`ïè :gÏ‚Ý^wôô]£ë‚yöX6åð1ç˸„tò¡;)¼StÛ}ÉMãú­)˜Ü¦¶ÃIŽ¢ô¯ÆVÈãS6¶¼Ù hò­ðGWe¯g­úhúË´`'7„`·Û|8Î曓l©™ÀY€Š¸Âö.øËO•·éIedT)RÌ‘¿üh\…#£ +°ÈóüàM0K +«aÖÿ±ÞÄ5é,«¯ ^R9 øAà/Q$œÓ-2î­¥ñM“n⢣¼° ÀáÀ¾œ]0.Ï.˜Í˜ EƒEe§tZ;½r†`MÐDËû+¼ Íc*T&›æ”‹v>¥„É œÈšb™/Šw–^ø—˜±¼<© „ÝÙ¾ƒ!{&*¤¦®­Çñ”f+sÌÝlR{ÓÃBy‹abãðÝwTõ<›[ 'Ë =³ÇÝ•½Í‹§RCQæ¢àZükâ›úµÿZ=2ÅxD3£°ÊõaI܇Œ÷’/) yMnIú|,úáTø÷à·±¡+hÍ—$ד`üæi¦Å™æoé.ú…Þ]œ $j°ÎÈYð|åÓVK¶vì Ûd ë`„\ûÍ5,"þM¬'yÛðÓËÞ|¸ÁVÔE·<)‡Óü5CH‰5;Vµýà³€éØYO8ýö½È—ÈUyf܇-rÙ¨ye¼÷p Žø0ô%õÎí…*a¢– þ¢-ƒaendstream endobj -1852 0 obj << +1939 0 obj << /Type /Page -/Contents 1853 0 R -/Resources 1851 0 R +/Contents 1940 0 R +/Resources 1938 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1846 0 R +/Parent 1916 0 R >> endobj -1854 0 obj << -/D [1852 0 R /XYZ 85.039 781.388 null] +1941 0 obj << +/D [1939 0 R /XYZ 85.039 781.388 null] >> endobj 826 0 obj << -/D [1852 0 R /XYZ 85.039 761.463 null] +/D [1939 0 R /XYZ 85.039 761.463 null] >> endobj -1018 0 obj << -/D [1852 0 R /XYZ 85.039 671.062 null] +1020 0 obj << +/D [1939 0 R /XYZ 85.039 657.513 null] >> endobj 830 0 obj << -/D [1852 0 R /XYZ 85.039 671.062 null] +/D [1939 0 R /XYZ 85.039 657.513 null] >> endobj -1855 0 obj << -/D [1852 0 R /XYZ 85.039 639.536 null] +1942 0 obj << +/D [1939 0 R /XYZ 85.039 612.438 null] >> endobj 834 0 obj << -/D [1852 0 R /XYZ 85.039 525.326 null] +/D [1939 0 R /XYZ 85.039 487.277 null] >> endobj -1856 0 obj << -/D [1852 0 R /XYZ 85.039 496.528 null] +1943 0 obj << +/D [1939 0 R /XYZ 85.039 449.177 null] >> endobj 838 0 obj << -/D [1852 0 R /XYZ 85.039 356.132 null] ->> endobj -1857 0 obj << -/D [1852 0 R /XYZ 85.039 335.139 null] ->> endobj -842 0 obj << -/D [1852 0 R /XYZ 85.039 189.833 null] +/D [1939 0 R /XYZ 85.039 293.11 null] >> endobj -1858 0 obj << -/D [1852 0 R /XYZ 85.039 170.961 null] +1944 0 obj << +/D [1939 0 R /XYZ 85.039 260.689 null] >> endobj -1851 0 obj << +1938 0 obj << /Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1861 0 obj << -/Length 2882 +1947 0 obj << +/Length 2805 /Filter /FlateDecode >> stream -xÚ­ÛrÛÆõ]_ÁI Îkì —æ%²#·NbË5©v2I†ȘT€´­éôß{ÎÙ @‚”ÒH£‘ì.ÎýñQ?|”jÉl”¤œÉ4-6gÑèvþvÆí‰Ð {g^MÏ^¾‰a7bY”¦7Í”–£iñKðú聯ǡ”2àšÃ$Iƒwc\}ýÓådüÛô‡³Ë©GäAÐ ±üûì—ߢQýp1™¥£/p1Û›3@ô’öy}69û‡eöÔȼuŒ)w"äË„~˜ñ˜3Kϸ€]ŤŠ‘qΓ\Œ1)☕ãPë(ø×Xò YmWÀu5yp âˆã`SÕÅn e{J*a W×!â¸îiÅ'bƵ â.óÅX¤ÁrªD!ðT»uiÖ–yknòÊ\Wl9R»j‘œXªí|½ZlW5žM§q¼§2¨›cx,üí2ßZLMÙCµ@ ëÜeaÖ¿¬¶K”0rT]FÌ´ùf,’`ž£•!@K >Tù¦4ÆçV^´»9 îÛm¹9”»Ð` Š[ÉÇP2‘7ÁÐÁ -{À†1€õ¹CÈÔÜhèþ)‘V”IqH«Œ@·Z= ­ÖôÊH³XÄ{´ZÓx:WJ¡ÎéÅ]~Ý–MFO<Ø '}+@ËÇ5«œ_#ƒÀ§/«µ}¯*?{A4dà³ÌZKÐFf8ÁC2s@ø«õ.!¾FDžÃ^–s4+D’Æ`¾HĽyÈÑ>5Ü­p9Ÿ¯K»Ó°¹yÜ7e ››õíreŒ Ï"ÆœX¶@ÈØú "Ê‘§{»öÂJñPÅJÅä¾q–±H?MÅVØ6T±RÓ©öQ´Ž_ܺDMƒòI]°ðÖØ'©EÊ„ð÷”<’D ‚EÞz@d¸Á«èì"q(œQÀ¡^8@qS8À—¾ZQ“KsÐ;iZÖŴ¨«_#®`ëv×صöžhÁ@ÏÖÞt^X¹Ùù ž+œ±Z@Uy,íæ-†<7-’H&ãQœÀUë'éÒÁ -{ÀŽÿX3·îÐ-"Âô–= ­ÖôŠ(ÐÂ÷hµN†f CyEZnɸPÏC±…õÅü)Kö(Þ÷G8þÚð8E‘;*¸k0‰në-Eƒ;Ã`ëÆDQé=|ÂmíeÛÖ,®Ú¿¢P^¾»è¨ ¹R,‡†ׄÈ|?L/¦×(Q„F‰ng›º0±,ú\¯ -¤ø[mߢÌ]ÖtIMd–*ç®D¬§A»¬I…9¶ÈÉÑ`£®J³DœÂ‚‰O4ŽóÛU»mrŒçìU#-ÉYUô ¢¶¢2Ô8 Ô»ua³‰åªK&M¹Ý5¦b“Jƒ¼†Î,ÀëÓ‘ÎR&$¢3XaØqgNÁAÜ!$s2Ål{ejsàÄ)Ëž…BéaúÔôé»ú姨JD9¶»)«l]„‡Å¼*Ì©¡”¥ðäYxp°æBBœdÿ‡eœ±4~Cp°!1è¤ö áúýäúõkè¨x0ysý“•zcl.›º19+q¦”í¥®][ÞìÖ&àTcpœ­‰*eÓ¸8´èʇH¯°s“£÷­wÞ]!êû•EÓ+¥9ú5ßÜùJðÜl˜8Ẋ I"S# !—Ë'VçVØv̪á6N{¸X·5ú4;&õ»±– j—êñÝ_;Û‚›Ì‰+6ú²…‚ëŪ·´2©õÀ†ª"b¿F7Ê?•(VfJ¡V áÏÀ ÍQf‚ôw( ÀHò̳ˆÅZŽ„VîcÕŸŸ[XaØ‘9p&a3ö;á·¯Q2ß9Óå,ÞÇÛq*TL]YÁ¶)ïÖù‚‚2<Ñ7:”›…5ì掆ÃíëÔàwSa…»V÷>ø7⮀û?9ÐYªgAUújž([À~WtèˆCo4&f0Ú=ì=È# Þ£¸ð[XöˆzÁ€™)ØPùC¿…ö€ ý -º_o/ðO¾ƒÄ¸«ùQ‘ -8ñŠÄ«H+3:OÊÄ=§•šHÑš[TPoÛ$haEºõh@QÈÏ6Mö–®ª,NÎ~¦ºh‡ßV£€>ì|QìûBb‘î…ÄŠ‘¯Í[˜«íºïœ÷ŠaxXÔ6HcäD$ö`øN^™›ÎÆpÕ$L8VÝ’‘Ñ[<#I/W8[Zö{å†9Ÿ7–/Ì짱½ú(^U=í;/¿Ùš-¸}Æ!+§ÐÓ&ÙÓÌÖ -{ÀŽ˜-Ö ©ò‘ç…ÑKŽÒ~a˜êx›7·%¶9J&Ájñº±1ÝáT[(°œBqÝûœ‡­e‡¤u–²v:³=Tî‰èÁA˜r¨ùÈÙͤ´ž»l¡“þV(›)(°PBhBÄ,“#žH‹?¤ˆ$V'a@…=X¤‡=’$až¹Cfö´2n6ø2‰1VÏCœ…õu³"}êÚ®èÚû²ÃQn匱ÛjË»ð~!{Y N:—i<؉!ÈNÀ¯t£?ÿ¯/Ý E²Tžp$ ‘?N”¥™N¢Cr5T¤:•Czÿ&™`ƒendstream +xÚ­ZmoÛFþî_!´X*B†»Ëå’×ONâôÜ&q/’ïpèÆZ¤-¡飨¤Æáþ{çeIQ"%÷`Á°IîËÌìì¼<³k1 +àGŒbí*™Xø*ŽGóÕY0z€ž΄á¹!^gÌ›ÙÙë÷ÚŒDà'A2šÝoéh?Ôj4K¿ýÛÅϳËÏO)5ÚŸxÆÄã1¾~wóár:ùuöãÙå¬eÔ’¢ rùÏÙ/¿£$úñ,ðU¾Â{à è^_‡Ê}çgÓ³¿·¤¸/ñ¬¡E5#<‘ø‰ÔÇ ?ŒT»p ½ÂO´î.\¾BZ8¬Uú°L9ñ´ÆÓ…¨`\e)¨"2ãU Ï`œn&žç0.[R…#zT¸íNè]‘¯"’íê÷ÃŒ->âñzs¬Q’§u­¸µÈ2lI¹ [Üð9µWÐ^ÛeÁ”îì|"ãñoø‡º èN_ñ„e̓ˆÃ:ÊMžrÍZdð00™š–N¸fÖÂ6ìsäIÔ-JõÄÍw&gŽ+M©²‡%,¤³]X_¨M»üz‘¡ÎA•ž@CHH9ÃKA& o×MãyÍ­{H£H@]°ŒÌ¦O“8ƒ~dÌr¡îF4/´Ô¹«=$5·yî:W¨Á»} +aÏC¥G&~,Äóþ¤|i†½Ékhyb}c Á•L·Q£¨‚µ„Ý14`–ê4":ZψÎu”‚"¢;‚tàŽà´[ÿtd™ [±Â¿ƒòÈfÀ‰µ¯“hÇtÖOÍ–áΆ‘›Fƒd8þ7Ø:sGuh—ÀK mñx¶X®yè=ÊRÌëe‰6%Õ¸®–™ë«K~æ¥M]'Ù4Í˪B1¸g…ï%™hºÉÙ¥Ôã{x­Êϲn2[lB. n{ÄzÁÄP+ùpõ‡yÎóîêókÒ +·~r>°z=ìUþºlÖ'ì—a ka)U˜CV­/p? [ÙyãaÐ £àîó¾ŽÏ¹gébеÜBds»^`¨ÒŽÍ +gõ} @ËŒŒöP/3TGËë0Ô(ô•”-Çç})ŒdÌiDt´ž14×QÊQ_­fç ‚l9š&q7q’Â=Û8‚¶q|C³D3ÇÞ† 4mr×ÖZ4 nFÚ6¦–9ŠT»öÖ®q4õ?r'çY¢áu"·R’ ³aÇMŸû_Hã p\ÞÅ}ÝCkÕòPÄ +TÅ#P~émaCËëëo¡P‘‡-ÃgL€U¶ŸFBGë #㛎NúF†FÖªUm–Æw—›QñYÁšÏ~§Ïù¦Î¡èÈ ?˜©sQ»”é´Á=ë˜ ´­Ùñ#@Ï6¬Áˆ=!§ˆ¥od²NöáeÄ]£¶¸âa¹•ð¥GFî®Ñ1-È…F© È—èä*Æ·ÿœ(0íeíÖ R!ÎçŠ&ó¸Ú~—­3æ ÆÕ`!QÂaè’3Î1ŸèÅ l#íâ‹-øIÂól¾\[ν€ PÉØ]XÉ$füq\Yí2á]%ânÛmí8UŽ÷²¥GA)źۿ.ë³\[Ž–?ký„[ØšTŒ7àólx›x{Þkb?‰ÍHKé‹0|™÷:Z^‡Ø€÷‚]˨exbï‰*%”šÀõ¢6´Ž‹ +pnjܑ•6jYCT÷"¡p¿í·ÀB²ÿ¾ìoîÁ¹½Á8U/ÐðëëÂ/*_H+·¶á‹>6hzyí-‹Wˆ!,lj–¤,ò'Ž"B%€nÕŽ‘X$ùeÎ.s{ç@ B܇‚®³üØÚETB—¨7Ö™¼5-6ÿŠ,Ú« ›Hü'(s½¿· +”F`ALÁä%{ÛÐò:Äú{«@C„ÔO"¸ÅaÈhå +ƒ¬”.1Àç\ö¹¯òž»‡°µ[¾tqœô•ðjeÁ[&eì›ÝB¢ñ}ÌOq#†QL®,L‰ðéVÔŽ;>OCÁºr~£j9uïüø6Í€3:š¾°¿cQ >añ^´cŽ–×!6°cFøPN¶ÿ|ä@x©urYZÇe aób%wdu‘£ƒMŒj{ë„ ÎI$v´ž‘8RÐ)v$U®BÓ‘Ïš3Yd€ ] Ïر.kÜ¢§Ç6~!>§¸©T‹„ÀÞ:Ð}ãŠÝ¶X®ÿŠl^¿WQGpÈ¡‚Ç"šMg³›)È5-D›úvU¦¼‚/å2Eé¿g2;ëß%Ãe·ƒI<­’ýslâs]:Ò7puØËA¡Úv !µŠ@3i¹îAŒ5h]QÒenX÷L:YWY½,Ô Úi©‡áŽT@Ê{!p´¼±€¡IÓrD¹¦3„O˜Sq÷e !LÑidt´ž‘,]™dGÆëŸ&X +&P¸mæ´IÙ^¢=RxÅξ¢e”øPŸb ŽÔñ%H#}€ÿ‡š ø0–'±¡u\F% áive¼ù4½yûör +ºœ¾‡?7X£„­áiù±* AÃÛ¦ñ¥Œ¼"çÖÃNÍïYE±¨rYªa#vìæ.à¹(TºÒêžÎ¿rήCå|‹úq4£@»zlÀ+îàà—ök|ØG-@áa@ñ² +šiybv FabÝrÄ5äˆ +ìcO¸$¤|pá­g„KŒ±#\?wª-ø‘ Ý< fO(7L⢻HéÝmžÚÇ[ÌÝ41P^ýw m½º»uçûÕí£]¯Ó;¤òóÅtúîÍíÕ§Ùåç÷o/oÿqùyzuýésýY®ûæÕV +JW®½ÍS'åv[lì!ŽØ·å*Œ/b¹ÃÚešüivË:¼½þé{WitfpšùßòLÐÑÑê~;äàí1˜A{ð€·kÂݮն͛ó×ûwm댧Âã7r1O+„‚œ³®§%UQÀðÁΫrÍßtꨓCÐoµ‚ÁY‘U¶v¤Ú§H¸ò¯Z–.nb¿+2÷i‹”YuNðë5OoO1h`å´E+_¬i¢­Üå `È$‡ïÚ¶&Xç>ó…'•“eõá•F˨ÆB<Ðã ªnâh[ƒ5uk· £Û5;îÝ aÓ¶¾ŽñȦSM^óÔ;°üž6d)9l:£®¼æ’¤»Œê\…‘Mâ ­âC×Í~ÑñusÂ}¾/EÝÏ-Ò’¼G@¶/Ì-LËë:Õ~™–c¿ ½suþÉÔÉ—ÀŠnÆ!Z¹FwzO6\¤Ï¤Yrà‚ÉITÑÐ:® +(ÕýHÊU4i¶³‚°k X•MYÔ¬6_³Áþç‚x¥† ÙE"×tK'Û»¼¤c³+ëšo÷$Wàs0„øtš$ak{}|Ó°Z¦ ø)?I^v§Ôò¶´¬Žü( +~¸È× þ»Èàr°øÉÝå<|¶Þ†: ¥Ú¼½‚¢1‚ãά;¾§¯ýÓal£hˆ/ÃjÑ°‰N¡–†ÔQµhH·hµLoÞ lÿšÎ.?ö¯ØdË+¶¶üÞ®®¾]y`fN€*ðe2”þà—#Ø‹þq§M¢!ª$ôN€µË‚ëKDo Á¢Ãôäý …w·endstream endobj -1860 0 obj << +1946 0 obj << /Type /Page -/Contents 1861 0 R -/Resources 1859 0 R +/Contents 1947 0 R +/Resources 1945 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1846 0 R +/Parent 1952 0 R >> endobj -1862 0 obj << -/D [1860 0 R /XYZ 85.039 781.388 null] +1948 0 obj << +/D [1946 0 R /XYZ 85.039 781.388 null] +>> endobj +842 0 obj << +/D [1946 0 R /XYZ 85.039 761.463 null] +>> endobj +1949 0 obj << +/D [1946 0 R /XYZ 85.039 743.459 null] >> endobj 846 0 obj << -/D [1860 0 R /XYZ 85.039 761.463 null] +/D [1946 0 R /XYZ 85.039 602.955 null] >> endobj -1863 0 obj << -/D [1860 0 R /XYZ 85.039 736.911 null] +1950 0 obj << +/D [1946 0 R /XYZ 85.039 560.002 null] >> endobj 850 0 obj << -/D [1860 0 R /XYZ 85.039 444.486 null] +/D [1946 0 R /XYZ 85.039 199.83 null] >> endobj -1864 0 obj << -/D [1860 0 R /XYZ 85.039 420.504 null] +1951 0 obj << +/D [1946 0 R /XYZ 85.039 162.299 null] >> endobj -1859 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R /F57 965 0 R >> +1945 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1867 0 obj << -/Length 2512 +1956 0 obj << +/Length 1454 /Filter /FlateDecode >> stream -xÚ­YmÛ6þ¾¿ÂßN."†¯zéHM‘â’îíºí‡¶d[»"[®$onûëo†CÉ”-kÛf¦ÈáÌÃy'WÌ8ü³Ä0®ÒYœ¦’d¶Ú^ñÙ¬|w%…6Š­a<²v«a$×ñ(“Æ"eJ ¤ùfqõú­ä3ÉY©Ùâ~&„dJÈY”j¦•ž-Ö¿"š‡Æðàöæzª( -nʹÙ²Ìq&ÞÃDC¬eÞÌ[|õí¢—íDG)gZŒ¢ã³P*¦b5 =Šb8žö¡ ‡‰ÐAB¦:þÍÒ«í%pnÛ¤ü#•/ÌLp–òt _&,Žc+±)šy(“4X“†d¬æ!h>·8Èws˜kD9Î6«ºÀ2vŸ´¼©ö3}´ýn³O8›ÓסÁAʃvC¼pr—¦ÉÛ˜¼¦É›1tFÄ™÷••¸ÆùÒ—{Ÿgí¡î±¡Ñ`}Žô\Ý£vyp—mÌ2ÃO(ÆÙ<Ô* -¸!¡>p)«WH¹)ÚÜ*¤E—ªsZüŒK™¥”A†ZYçk’ÐVDRì`Öî¬ó¬É‰´;4XífL†3»#[%εs8é±€ƒ%’ùg4öˆYY’ú-ŸØ’ÆÁ- -qJÅï›bOVCìiBhSäél‰“ötUMf[AµÃß5'ØguÖvú.Ÿhé¾®¶DÜnrlñPvtýÓ]' 4’‘r@äô)Ž˜˜íöæ=ì’rÂRÁ‰ËÒ‘•MEs½6èÓ*¾¨ÑR!îߣë)žhë£sR4˜³ª·³r¬×kÜ£ûíVmQí2Ì3Å‘Ë‘ú’©Ü¹,œº:á‡Ð 2“@뿱ù2?ìx…3ë‡T*…ö´ŽÈbk²¦w’Ÿ1§S¨4¶+4›¬ïÖd&% 3RF!E6fû®ïP ül*Û‹ 2î²HN¥×Lk¥£´U1é› ó‘bIÜA.Ôšl»ÌêªjG8ç0ÏÄZ·þŽúÚYzR—P-’“¤Ú(wgËÚÖy‹Å­uk+R³Œp/1P3…¨TêظØQ;tš#ÃR)g:,2éŸñ= Íûxt¼BÙH‰ŠRØlz‰yKFî;Rìõ8!¡=i7Ôæà”m)–µ{ÂðG·…æïz“Û†é“ãâ* -Ž©‘Âû«5Îu‡©5¡?H’¡ßS–Q°¡KÅî³_½Íð,¶!éÔáï|·£|Ú÷¶öìq‹s£Å¾\pqc&_f4Ç+ô˜-6L¦Q/qÌhþþÐgTÔ,œó*O»L®‡å{¦«6þ¹r±NuF5uÚ#YS²X&/¢„Ž×´Tý %ìÑD{—°Nj±Ô¼ ÂŽ×4Bpp&Õa? ¥ú ¡†{óK!t¼žA¨S(^C„«Ê¶q[ª«Ö!~å†Ã1w<˜HÅLˆÔ/ütéV§¹'ZwYn¨@‘÷!auv»ƒe[‘[×$»nÂùz¼·Tœñ„êæ‡ÅÝâÍâG¸–iÀ[W±cûèÔ^„ÓáÉúß_­¶ëÆIéÑ5Å9jÿŸg‰¼0+­!Œßž:šÐ#ê¯Og•Ž!;¥œ·éàúé¨PGs&t˜ÅŒ†ö[ „þ„µÁ %\9­ýéÙFzzŒXöé¬OáÀ>—áÀ5¢yù>£¶«O‚ísôªŒûW _¹ÐèÀÝEfРÃÉtÜ5ñwï¿9‹aÛi lò\ +ldFcØñ:Sã’– 4Uj F¸K†x™<g ±ÂýâEÀ9^Ï€ÃK»Úø݇¨÷[Dxûv.¸„ÜüÚNž 6p¿€¦ýEw¼¦ ©0‰†^I`ïÞýða¤‡„zel%í -zí$ÎѪ»ÜÑ«R÷ÞwQw\A7ûœîŽDºsDöBR?ž ”d<-ÐÑœ êLA°‹d Ð×Â]^Óc^ý—u&ñÕbZa2…árZaÑe…uDÖÙ š{YÌ)¦%:š3‰'^FUÆ—˜‘*Ê¢i}åH\ ÷Ñâ8(äOÏßnº«iØ’&´À¦ oæörMÛ}ïé£"ăÙg_z]/Ñ1¡¼§¿¼îXV®áÂf¿3£G•KNGÐÜ©gœâH4áŽÈž{ô?ú—ÂÓ ¤A¹“‚Í™à“hJ¡¡ÕÁƒø°mE¯ªcOJé*÷¨Ê1€üûãxMFB…Oãh¨Eßc »ôþØâ'KwC·¦¶]ýÚ]–xa ):ÀSуù]no…ÉÅK\(@÷$‚ü¿è¦ëx…³±ç ÁbôíÑÉV.¾ÉÊR Hñ"8;^Ó8%”~þæá„;[‘Bñ.ƒø¢fÑ´Ê;ç!v¼žA§,’â/jV+òH½ÎŽ×4N¥S*:Õì0(&z×ìx= îΉJÀ( =ºàC ½59'  ¿Ï¸Ðóÿ²í¾ì™RJ>@æ½É'ÇF(Œ[ ¯Óq/^Î8“&ñ¾Ì™€ëÍ Ä0­¤;W³Å쯑Ý)^2JË„éD[%ô «4gš+kÕâ ¨çaâ÷é??¡ çÏe4yý@IÎ’_]\_Y{?rÍ»ÝMw×õÅæú&Í>u~6t¨ýææï"ë ¾-«¢sømµ[•5Áuº)zds|Ó§}™]§Y_6õ€[§m‘;h!PiTS€“ô¨åâíÅâýbyyuOѳ¼Ø¢FûÝ7v¹.æ2‡G¹Pà©Êan›î§tÎ/ü(ú-Ä«Q;@¡l„{€-݆•}û5](úrúuÚ· ¦ÞÏ„ÿú2­J¬(p€Mí´x‡D– úèîY‚ì&žTÆú€"°—}Gùƒv•UO'´¿›f@&å(¢Ž¯ØÀ3Œ7ÄóéÞ^à5B6J‡Õ#"ÁbgÄ ä¬úvýHƧ«'xfÇÅ!"¨Ž0%¢¦W¯@?[ÝOÁÂ($Ká{•~Æš)0\UÁôײªº±ž(ð ý¶ØViVätúZBÀ-‘ ¢0é‚^CLsKß!7†òT£éëÜ 6Ì@ÉOÃæ⃑¸Ä^¿Ÿ' bײ1Œmžº$%¤3O!ThëRTc"T0Ê($Ó¶£+—·Úåmã:Li›¥È‡bpO랦5Сñ O†ìÖ)ºme™äàïfçƒh’±BÛÁ†öT²·ÅÄo#_i+ ¾á¾R~bãÕXµò«YtâA&‡bòJkÅ™<*“^Á„Ùq&‡`R2ÊCÃ2ÒÍ:ì ©? 0TnŸ¶£/{mŠû¯Ñ_Øf3ˆøÝné0ìoÓif/¨c#Ô«²£\oÝö1!Â{st³«úr‹$ GKmGF½ê@-¥BÿnŽ ª[7VXN¤uÓ°ï(ðw“‘¥]lç¡ñÛæÆ.À+¹ ¨h>wŽcUóÎm±8¶Ë.ÝÂÓ-IK+ðª¬Oì´¯A³ u?ÉûüPFCÕEÞ¤•üÿ¾„­OpCãï¿GµJs)sêw$ü‘µú¹ºo¤°‡HszI5ú“ò$g!yׄ‡^~ÕÍDßÙŨ¶endstream endobj -1866 0 obj << +1955 0 obj << /Type /Page -/Contents 1867 0 R -/Resources 1865 0 R +/Contents 1956 0 R +/Resources 1954 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1846 0 R +/Parent 1952 0 R >> endobj -1868 0 obj << -/D [1866 0 R /XYZ 85.039 781.388 null] +1953 0 obj << +/Type /XObject +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/note.pdf) +/PTEX.PageNumber 1 +/PTEX.InfoDict 1964 0 R +/Matrix [1 0 0 1 0 0] +/BBox [0 0 27 27] +/Resources << +/ProcSet [ /PDF ] +/ExtGState << +/R4 1965 0 R +>>>> +/Length 1966 0 R +/Filter /FlateDecode +>> +stream +xœeU9²,GôûeË@@Q ‡!é¡%bd(dèúʤ—÷ÿ(žÑ¯ +’$¡T¬)ÿ®ïë¯ãïãÇ_¢ýþÏaíÏc‹®½Ú¿G—=ûÌöÓ1ÄF¬lÖ]töö×ãqu‰Ý¦‹÷5š”<8Ç—ý:\;âúãñ‰üéÆ&ÞЇ h—õ:ÀÀX=&02²oÒCó eD3PMtð1CrZûbœ7³}t€mA£d«·íä'ÐWŠ!è®»½KO(°ƒÔ¤‡tÙKb•^¦Ìì »å*’ÎÕBêFåmY¸™`Uõ´™Õ -¿nÜž í½³`*TûÞ£jg“¾=Ås–A½R?Ô =}³Ú§l +¤Ï’ÃigÙ¥—ÇáC6uéíÛ&”\Ê GTœ„Méêö–KòlÜ’Fyu|?é%åiÈ¥K”êNÊq{vˆ*êèJE¢]8hÍò¤p0R±ˆ$Á(+Á nÖN¬ +qª„Ñ«ò^ÿï>‹«>÷— .13×…Óƒ!¶3¢SËAÕ”ih¥Å¨Š^…(€<Îm䦽ªšÛÆlLÊâ³ò7ÙaÆ´Ëdô 6(WðÚºK +г2"ïE9~  +n*Œ1½÷¨¾x¥Æˆpîâ‹&XîÃœ§³±è\íD¤ßä0}#XŒûž˜‹¸À>#^V°¡|2Îi‰9ÊÎr)`˜¢Xh¡Ò& „hb—H°Œe"Ãêʱ„£~Ï“a³tŒºìZDß!#Z¶ÚÂk! e'jÝ=§ _tsÙ¬ûÍ&­Nå@‚i¬ˆ3t%kÐE„\H–YZxÿ/U¥Ç™åë—Φ@±¯iW H +þrÓGçX5¾ûû8‡´ÕªOª«t–Ô³$Ây°‰—BÒ›ÀÄ5©/¨vp÷o`kA“ôr ±ñœÓ4N.4Žæ&F°ÑTÆG%V½ Î'ÌØR5¬BÔ‹`qUžv-UÍ=ëÆåQv2ë_ ”¿­qq‚~èr¯Ú5ÌJ¼ð˜°h»P¡õ‹kÜàéÚýªå>Ò¸D °o»Îi¸CrT]¿MJ¥ ÆÖ¹’°;¿ö‹ûóZ¼¬ å[Ç-œÁ¤ŸBx¿ýpü|üÈÂendstream +endobj +1964 0 obj +<< +/Producer (AFPL Ghostscript 6.50) +>> +endobj +1965 0 obj +<< +/Type /ExtGState +/Name /R4 +/TR /Identity +/OPM 1 +/SM 0.02 +/SA true +>> +endobj +1966 0 obj +1049 +endobj +1957 0 obj << +/D [1955 0 R /XYZ 85.039 781.388 null] +>> endobj +1954 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F36 955 0 R /F60 1548 0 R /F64 1960 0 R /F18 1963 0 R >> +/XObject << /Im1 1953 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +1969 0 obj << +/Length 2485 +/Filter /FlateDecode +>> +stream +xÚ­ÛnÛFöÝ_¡·¥Šh27Þº‹R£)RlR¯í¦mÐm¡D•”ìM¿~Ïe†Š’¼Û†ÁáÌá¹_Gj"áOM²XH“OÒL “e“ùêBNàä‡ å llDl-¬Îüé,ÑBÚô(Œ£1KU.ŒUóÝíÅë·ZN´Ib&·÷ž‘$“"ËâÉíâ×H%ÓYËèúêr:3I]ÕS튻ºÄ4zßÀSF‹]]vÓßo¼øþ¶§ë1¦‰È’£œÉÉLaR}–íD´y²­,’„lëžÊ±-3þæ¸SQ³ÛžâÍ}v–ü†È«x¢¤Èe³L(ùÛeÕY“G ÐèGgÑ|:ÅÁë +åz +{Û=P‰»µðZÛ:u» µlð“'~Ù6ü\Ÿq·ä·]‡ +£í’Qâzí±»O¯¯`ã’×W5rÔ[vК@¬Ù3Å÷e±Ýµ›Í=>³è¦XMá«;8.PÏhV…^Éú0BŠ)ø©ì5GE;ÇOÑjK8ç[d¦%Fàä*:~)½Žü9+ Ž*¯WAC±]– D*/*`µôUqWÕ¸·Å½/ü G7xÈÄ\ Njoà>ð „Ú­6¡õÆú æã$êŒ/OH­A)¼IYØ8Žš5?;rM@+­þÂG÷¸×¬ ‹JJç—üñ†_P¦¶XÏ‘Î,+–qß\_½g¨¡…HÇ{ !ÃU];Ⱥsµ×Ï© S‹–œ!² JÑîµo¢Ç^p´Ï¢i;Þgc[pƒ©sÝ#+ëù¶jÈ–u"âÌÐ/ùdÙ6äóK~ßp>›UëNœÈ±ÎD®Ïgˆæd‚²y.âÄç'Íùé‡r]¶äž5'ØŸùý½«|:Á“ÃuŽ¥=ÈÉœe%’˜­óËÒÇxL¬MT¸ç5kÍ 4;®Ã—à™îKcRÃC4>;gÊ*¯`/UÃ=¦²m«²~Y7…;,ªeÑiOêŠ}¹ýÂïwÎ œ Sãz]¬Üª®fG|óo\¢>P¹’©Ð¨- žLüÇů¿ËÉtÿã…&Ï&O°–Båùdua„N{«/n.þ½·G5Ûã"ãÀÖÞ8 +–±Òž²÷äéІÂB‘–t¾©zöK•ÀXm,Ò8sðÿ|ŸÀx¶– ŸèÅà ,Ý‚ýWÈÄý~¹åå¢ ’áúo´«£ÏkŸG=ú}â‰O{²%‚=M6?‘å ©ùƒŠ{Ùr2€¬˜Ùˆ"Zª¹ßâ1äZh\°„tÛ¢/#å+lTô/,o¢§Å…OBž£$GžÃ°¡û8GÖÃŒèÃZ‚?Úx@¸o€AtƒU÷£†¿kÀ#úVŽ¯ð‚vgÿþâh^Ðס‚ÒqvV‡ÌIzêfÛÇCj€ñyjdDí@sV$rH.ÔÜMÙòÍZ*d¨«=ô@]z¢gt•dÀb~^W{˜Óºr0äoPÈÆÕCRœ£çaF‡êR D¨P,ü˜ÑmCÍh,²#NR@ƒs@ä¯7ï×3§Vh3ä˜+ßÑp0½ÀôC/ûÛ~¼ðXðìån)r Šval=Êf|ÏÊÓôóÝ)g°0&ê¼3ìaN;ƒƒ!A±)ÿ“o"Ž$}–(CŒh„O&’8µý8¿ï#h¦tDÓæØU (¤Ðªôÿº«8\Ï“gp˜5º +4“Áo a¤WÞÀÔ¿sbLA=Ó^. ™qŸ|S¢jòüÜD§`¢×Çmž~åˆëpÍdÇúB+bè<‰Î¶réïõ‘$¬R-ò®gøLaúKòŸ0bˆ9ë”/q¼4Ô`]Fy ¦=®óLkk…•êÿT®ÎµÈ¬}>®gøÌ þP¹£v[)høÒaÌã:ϘQP¤ÕÐꉂo[ÐöÜýá ~t«þ_Ëÿ« ]±Á exî†ÊÚ€hçgo¼åVVþ÷hÆ0!éïØŽÿòi@ªïÉ zÈcWÐ õx ‚¤ssH/6ðgNü/'LØendstream +endobj +1968 0 obj << +/Type /Page +/Contents 1969 0 R +/Resources 1967 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 1952 0 R +>> endobj +1970 0 obj << +/D [1968 0 R /XYZ 85.039 781.388 null] >> endobj 854 0 obj << -/D [1866 0 R /XYZ 85.039 761.463 null] +/D [1968 0 R /XYZ 85.039 761.463 null] >> endobj -1019 0 obj << -/D [1866 0 R /XYZ 85.039 667.044 null] +1021 0 obj << +/D [1968 0 R /XYZ 85.039 653.495 null] >> endobj 858 0 obj << -/D [1866 0 R /XYZ 85.039 667.044 null] +/D [1968 0 R /XYZ 85.039 653.495 null] >> endobj -1869 0 obj << -/D [1866 0 R /XYZ 85.039 642.326 null] +1971 0 obj << +/D [1968 0 R /XYZ 85.039 615.228 null] >> endobj 862 0 obj << -/D [1866 0 R /XYZ 85.039 556.019 null] +/D [1968 0 R /XYZ 85.039 528.921 null] >> endobj -1870 0 obj << -/D [1866 0 R /XYZ 85.039 529.405 null] +1972 0 obj << +/D [1968 0 R /XYZ 85.039 488.757 null] >> endobj -1865 0 obj << -/Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R /F11 976 0 R /F35 948 0 R >> +1967 0 obj << +/Font << /F20 937 0 R /F15 951 0 R /F39 974 0 R /F36 955 0 R /F35 948 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1873 0 obj << -/Length 1221 +1975 0 obj << +/Length 1105 /Filter /FlateDecode >> stream -xÚÅWÝ“›6÷_Á#Ü:} $&Ó‡¤±;I/w×Ø“>¤5pf‚ÁœôÚéÿÞ ¾K¦édîÁÒj?~¿ÝÕê †?bIŽ0 ,! bRZ›Ý [÷pòÓŒ 3Ä=Ö‡n{êúaOL꘮ bQ:/V³«ÅÅÈ÷™µJ,B(b„Z~à!yÖ*zoḜcûÝbé¸Ìö›~±9.±™Cì¸r>¬^Ïæ«.š Öº™Àƒ-—2Ä}¬/Â>íƒ%À÷`=¡‹ˆ†»ÚÆî2Üýª¥oÿ†9¾s± …½èéŸ #úôj’¾…JïÁ¢qyŽž@Úéz#‰Ùãô˜D}zœèQ y’=°[Ž -±æéÛ÷±ÚåqfZæu\&Jnâs¨0÷GyÔiPn·”X !uÇÌÃC¥½ÒºÀK½.öŽK…Ý -AÖi‘룭ÚVzêŸOɨ±(‡Œõ¦?fï?`+ü¯g±@ZŸa k7cˆ -fvÙl9ûåȯõåöœ R*"ù€ Ð8Å%å ÊïA Éò·¾Üž³¦üCž„#EQ„–Å4U#I¤!‚š'eÌÖ¥ð^PIga)ô]xØÇQ SšSnÇùa§WkȺدձ–üÝÔM=’ʶ|ób oóúön}s{{§µÐ?.¹lÌÔk+ úA ¤ÚÏÕ…¶Y¤™ YìMcUzq5á¬þön~ÓÅ›Føãõír>Ðá§*oçÏ_>áå×·¯Vó't®—óùÏOè,ç7/¯®ç—é8MÒˆíõóåÊŒ¸qQþÑëUñÙDÛ˜U¿VÛ´Ò÷¯¹Êµ#‡̳7…ž³ajîºvóÖ‰š¥ùƼªê·“ -Ö[½ÉŒnoêÝèî¼&EiµHòõ¾hþ§[’å7íoˆ¨OÕ8½“\]oµ9¨^Ç,^÷ÅZvù%¡¸yÜ”nèBɧúäUkº K£äáâ5›z’…÷•îŠ(^×ǵbólÜÇ|‚ü&+ªøbŸ@Uª¡uRíGD¢3p[UúWÇ®Á\Æaô!ɧ"ŒZÖ¡‘öç_Kîs™Öñwg7æ½ÎüÒŸ'0iÐÿ89û‘ÒiŽÿ•cØGŒûÆ™(èi<_b\²óÿƒõÌþendstream +xÚ­Vß›F~÷_Á#œŽõþ`PÔ‡¤±«¤—ó%¶Ò‡4²¨ g Wƒ¯=Uýß3³»pØÆg©©üÀî0;ó}ßÌŽa…s"I¨ˆ0bDD‘³ÚŽ¨so~1ëHAdÀzà¥ß¾õ'4}l?d1CŸ7‹ÑxÊ©Ã)QJ8‹¬¢"J¢H:‹õ—…ž/%u?Oçž/Tè~¨àIݵç3w_xÌMkïëâýh²è’…€CŸ "Bþ"V%C"™èce W}¬\Á“Y¬„´‹MjÐΓí .•û;•ôÎèU ¨ó¿aÏÌ›ÏÈÅðSn‘x‚¹Oè˜îÎ1㜠ø03´©x™cDV,±”=f2 +IØcFuKŠÊ½OqW¦»¤0†¼l9زd•ža áPõ"ÈžɤÔb÷AbëE¡9IVÜç40 PáVžÏCW£Ü‡¤É«Òølp[ãZº‰1=‚);é(.@ptéÒŸ£/_©³øïG”ˆ8rþ‚5%,ŽíH +»+FóÑÇgzm,¿ì”’¨8< LŽq!‰Tøÿಱ.à’Œ°àVƒª?õT¾)9kÍö i¹jU.zFn•£6¶4úeR®í–()Áo]¤fk²T¹=¸3ÖÜFn6֭ƈ V{¿jP4¸JF'Ãakäxœ;Ž …1( +-ý¦6”ß‹u*)£œź„¦Ô5^&fôÀ…f£•Ò÷Ž»Ûdµ«j³n*ã´M¾¡0Ö#oŒUŸJêåÒ¡¬÷JÛ‹ÂZ7^{ðÎÔn?DÇA¶ð"(Q?Yb¢•©î7 ßBȱŠ:_í°NÇYM6¶4!œTÆÐÀ¡\ûuK}<|=™Œá²@WÂ0¢ø‡JÖÆò{Áju1^<넘¡ ­^•n@‚Š=çðx*T/‚†$æÐ JØ›ôô®Ó e–nZî·fµ­–ÕÃ_Ë?Z8œÊÑ¡nóo–0ù–³»åílvg¼2Ÿ]ëcøç›N#„XMœñ•93Í ›²z€ ¯ÛÀì¯ÆÁzégw“Û.ß0Ÿofóɽ[L.øÜÌ'“_/øÌ'·o§ïn&×r‹tÂöæõ|Ñ5óqQþ5ŠõªøÊ4ÄAKуVXlr¼ÛBÍ20îª2ó/Ñת6ÆîþŠ£™‹AÌ5ëÞHEßÞH»YÜEͪ ç„8÷Ê N2ÐéH >ñC¬nvšÇ³"õ…ž>>‘•Ë‡Jdœ=)_¨ÚlmHhÞâø»‚#%^lÜã}AÜeß|el×Ï@Yhßj[¦ºr‡Ð>ÔÁ`¯Û£›dg½³2ÙB:½égEr_[ã¶Z§Ëæyd^ùX”ð¸ÿ©vö“­ó<˜‚*"¤²Áyç“"‚¯ +q>áw¨§û×endstream endobj -1872 0 obj << +1974 0 obj << /Type /Page -/Contents 1873 0 R -/Resources 1871 0 R +/Contents 1975 0 R +/Resources 1973 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1846 0 R +/Parent 1952 0 R >> endobj -1874 0 obj << -/D [1872 0 R /XYZ 85.039 781.388 null] +1976 0 obj << +/D [1974 0 R /XYZ 85.039 781.388 null] >> endobj 866 0 obj << -/D [1872 0 R /XYZ 85.039 761.463 null] +/D [1974 0 R /XYZ 85.039 761.463 null] >> endobj -1020 0 obj << -/D [1872 0 R /XYZ 85.039 671.062 null] +1022 0 obj << +/D [1974 0 R /XYZ 85.039 657.513 null] >> endobj 870 0 obj << -/D [1872 0 R /XYZ 85.039 671.062 null] +/D [1974 0 R /XYZ 85.039 657.513 null] >> endobj -1875 0 obj << -/D [1872 0 R /XYZ 85.039 638.739 null] +1977 0 obj << +/D [1974 0 R /XYZ 85.039 611.641 null] >> endobj 874 0 obj << -/D [1872 0 R /XYZ 85.039 638.739 null] +/D [1974 0 R /XYZ 85.039 611.641 null] >> endobj -1876 0 obj << -/D [1872 0 R /XYZ 85.039 619.008 null] +1978 0 obj << +/D [1974 0 R /XYZ 85.039 578.361 null] >> endobj -1871 0 obj << +1973 0 obj << /Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1879 0 obj << -/Length 1005 +1981 0 obj << +/Length 971 /Filter /FlateDecode >> stream -xÚÍW[o›H~çWí ŽÂ„a.ŠTɉñ¶]7îÚ}èV Cc­ )DÝUÿûÎ <`²uœ}XY–ç6çû8sf€ºEP÷1°P {>È÷õt«YújùYƒÒÔ.¦âskçs—Z-Xç»<8éqöɸz=}‡7!d@LLÏóó 4"¡|·œ}X„üùsüV ãnÑ.] `+~Õ>}¶ôŒV÷V³ -|ý‘Ê€Ô¼Õè’;H>o´HûµK%lŽ.¢Æbäì£}„ÈUBÇ®‡u[[‡½»\-çóU<1±ß-lnjBþ¤dOuSݧ°>äõê6)² Y©êS¡;cè”&èÛº YÍ_CõÍ×R÷£óúîLˆë¢õÊD2«—gPk™ç5i†¡·¤H «þ‚§0Õ‚°¨§^ÿEV‚¸&EÆ*ûAw5%CóðU¹' -‹Z:ͦñtu¹X^¶Õ$#•LõoD©ØÓò¾hF¨²=`ÑNcKTiü.³ßÕm­Jà8…õꮤ@IU Ëß;ú`j»n›ThÏOE؜ٮNª¤YSb$ç×Ò4Qq1Âù!±é¦¬É±Á}s½X|pècµnŽ^—ïòcƒÛ 3öæG[Fæ–=#›áÉú[Îç«ãKHêRñíš¾wdzŒm’V¥”£×Ë‹•ÝÀøcBý " ÷Ô$¦¦Ú4Ùl„&)&¶o|ê:Õs™±¼kÓ@ƒ¶µÐŽ£Ç‘1[Šàëe,œ§,ÉÕUEž¬»¿‘ SB„ -DÛ–˦:sz5ÂKûCNëàˆ­¯©pÊÎ&ÇÈX™I™š•¼ù&ά““‘¹w8˜È¡å¹½í6Ü„þ³7¡‚ù§Œäë‚ì&ÔÇy´Z¾¯ÙÀe„´C²H¶¤•7É—ZÊÛ2ãóYŽmˆœ§F/KØ&eæ+ÚÆ”#ö'ŸUv$÷8ë’càÙžÚ˜jàÙîá5u¬ö®ÅÐþEƒØö^ƒŒ’uµXF!OÝyö„6‹§EöÎ~ø5Š‚¨Šã›æ·›7qørúë#~ ˆáGÿï\DaøËönV»›ç‹yloàG6"ÿÁ;€Gn Ü¡<ŽÎ(¼žÍß,xKªWã¹òú+. -굶Çvww}1ÙÊå¿ã{äKYÀƾ¾è_¬õ¢¼î#ÕAÀGA÷×;þ1=†]Ï‘µ0l–Û~ îÕû°WñÀendstream +xÚÅWáo›8ÿž¿‚꾪¸6ÆiRÚ$·›ºe×°íÃ6E\0ktÄô€¶Ú¦ûßï„ni®Ò¡ØÏ~Ï¿ßM ?bx aê®Gõ z†¥§X9Áà|Î\ƒ`äcßâ]†F úh^¾œ¼ f×C‹Rj -×õÌ÷ó!1—Êøz1}w5+ûŸƒWƒYP/Z‡ƒ|¹â?ƒŸ±ºWŒ¨ïÐƈÀðvK"æPÝOËÁŸu(5æÊ« £bÝgHG †„øÈÁÔpF ;%Å(†³™ù 3|ºNÒœC‹È^^dwk=zç«›PD _5ͧÊv&É ñ ‘hý2zsn¼IxÞöŽóÛ3Õ¬aÄ‘\~\´ú"æ›o|ÕÄœñ0zÈìhÄÚrŸn"=- +‹P[›xÅS¹=d›âWçCí8ëTäÅ3±^¾¾X-æóUÐàäœÿý«“ºO»5ãœ]ׇ.Öü©™Î¹ˆ$´gLv¨Hë=z û,Ýþ4ñÓI0Y]\-.*4ðòL‡ú‘RMîëôN=ZÙ.¾Z!Ô³[pþÕáoóq¶ôôöÒ¾Ó0_ݦÀ”g¹ù¾Ó¯¼Z·àœŸ*·9(Y­Î³°Ø€2Z‰óƒ±´3ĸGôC|ËÊÝrfûÊ +zìºe…:Ö¹|Íu®Þ˜qO’Ø3z3ŒŸWÏ k|Ba£‘£’Ül çÎÛ¡EÌp¥e߇ã1_.Þ]MÕð_CËöL®:w9—³#Õ+Rõ¿“DµB1„É_Uç>†H:hz«ÂÈÝÖTÀ„}ºPsß,Õ˜ m×¼¼œ-õAE†—K¦ ÂR¼àp²ãå`Q*Ï’׋ær<¦Ç+PÄD€©jBãT©éydÔ’3’3^â(’¯êøtrÆgÔÑ™¢ØžçMlù-âñFð]z?_®ogodÙ…ú&ªR)Â-¯ÚIø%×ím•UZoBÇ +ˆ X•Ö ØË ˜|¸èÕÛ²œqVgȵݽؕçÙî;R‚îÚ$øŽ­"Q=*o¶]êÿSµ.¯ËYºþv¨sÛ4a-IÀQq–vºTçO\‡À{¬{\+ÑJ÷&s5µi‰öY÷d®—õõl2í’ÖÆÉGÔ©ƒôîÝ<¬ë½'Mà IuLâø=óáú`v”|=·*Š‘í÷Ý„àQ8þ×…«¾0B ò¨_ߦZ‘A)¹ŽÆ"yû¬ ·º—íáýfÚ‰endstream endobj -1878 0 obj << +1980 0 obj << /Type /Page -/Contents 1879 0 R -/Resources 1877 0 R +/Contents 1981 0 R +/Resources 1979 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1881 0 R +/Parent 1952 0 R >> endobj -1880 0 obj << -/D [1878 0 R /XYZ 85.039 781.388 null] +1982 0 obj << +/D [1980 0 R /XYZ 85.039 781.388 null] >> endobj -1877 0 obj << -/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F11 976 0 R >> +1979 0 obj << +/Font << /F57 1075 0 R /F36 955 0 R /F15 951 0 R /F39 974 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1884 0 obj << -/Length 2351 +1985 0 obj << +/Length 1966 /Filter /FlateDecode >> stream -xÚ¥YëoÛFÿî¿B÷©T`1|?P\'ur.Ûµ”ÚBX‰”D„"U.%Ww¸ÿ½óØ¥H‰rt(ŠZËÝÙÙyüfvfc,øÏD¾i¹ñ ŒlÓ¢Á|}e –°òéÊV#E2jѼŸ\½ýÀªeÆV<˜,||ÓóÝÁ$ùÕøð›§Éíóp亮a‡æp†‘ñÏCÛóäçÇŸ¾ÜßÒ÷o“Ÿ¯n'Í¡ ;8 Æ¿úõ7k€t?_Y¦Gƒ[¦ Ëë+8Òô=W}çWã«_V¼æ xWŸ‚¾™~äžjè- m'6½Ø„¾eú–G*~µ|k!7ðcÞÍË¢½Û-¤¹E’§Ò”i‘,²<½þj»ª8ðÍÐ #EŠu¹HÇõpä;~›k{¦*×'d«T$iu4Y.2­&ç嶠9ý?É3rÒo䄦³D¦ižqGö±<çU”´hȆ¬ÚfìûdCÛ1]ÛÇ6dØ&`ÀY}Ëxº¶QJ™ÁÔ,O(A ó ÜÀ¯m¤•¨³²à¹(ÅеŒý–ä9éÏ Ã×…oHHvÛoû_Ëî¦O’OV©ŽàÈ!˜Ï7vC?0D¾ÅI'„a5Tk±…!Ó&L<:1Lãz¥8šNè1)î™É=ëtÍ$/øµbƶQ0ù I³<Á¿ÅR3=œŽÈ„¯´²[Z¹àx°o‘FïE[ïÖ}µ¾[°¤²TÚ¼rºoÆAÔý…çù‚ÈŒ¼`¸Zßþ~ZpM'ìO -#ÍkÔbÖãsÈ ¶5'¢låFüÒmѶ±oȺBëÏÉKÊ:0½(+x€LúQ"¯Í»8ý’Ÿ`äë¡’Ëó:ÛàâϘ ØZÂ82ÐÑÛ\³“Y=×1î -ÄTMs½Bäù~yd×r ÉBœÐ13¡‚ß7#+`Ï0¤ »¯–íV«XFF‰AíY‘Q¢À>¶)pM#—ꊾ¼¨ŽÐ¼x9ø±Ç?¼ê¡HêU&y´ÁUÖœÌÌQ‡jA`<ÖM8Tj'óƃqD µ­·Co#rPÞªD&»Œ ‚1… 3æWש¢L2±D5K’¨Mºó,Ïê¬å$<[A«-ÀçRÖ¼g­¼»Uî'“àÂK–ç=¢1o×õÀÚhâBnZfFrNàq¶tEPñ<ã·=l?&ãÍ™ìØÅ9 0ðS2êĔ͑ӊÖ£o¶Þ4{×*‹!noàb^oEŽcqèQÀ<äAFöš¿çnÉC¼Ýr4ô7'œüé=f‚Ü‹3\xàÍg2ûÃÈ5(LáƒxÿÁ¢ ÷6ꉳ’Øæ5oyzD†wÿêßWh•¶E:Vm3 -v5[4¿ä=²3º¦´ä$šÔ<„ÚUvÝÙœ¾n§‹ôóG©½jŠcªPaȆ/—Ë´Â:Ãv ¹!?Ô‡¤(í‰C -¬(Í@BŒ^:y åÉ$m‚jY IŒ’{â€öd˜»š¼uƒIº¬Re­rÁÆêÄÐ|¯-¬“ºä»QbyÊxÐŒ"'Õq"XúIª³ÙáVÌ‘n…)Ìí@Ïò8-"j˜ãì|]UˆìFǀÅŽß%³j)Ín±V'×™©, ¢íó ¹Œ6je"ïÏz¥,R•¶Nn‡Nè@ÊÆÙD§ÄƬŠ.í€+*mÃäâ£SÜCøº–iE! Rï7i’.¸xN‹íšGS¨í§åfš‹=†Ný—ý%lä´cjüùýÀ0½¿ù÷íóôáññ‰éÿÎ?#¬Ìm*§·oÔ ÿ|,ã­¤J‡˜ð—À…ƒu ÎOyŒÁDI6uªeNxP*%DU‰=ß¼%™ƒZ‘ c”…„һʲšäoÉy•m¸|iñõ0ëZàñéæ—/·XhÈ '&È -Ä#ót—檇IÊTIQ”5ðPê{(´Áfé¾ÔÈj™æ‹Ž´Ö+rNžoÆO7Ï·uî‘teµÖâ5æ¹>È£dÜЖåûF¤dÄ¢Öà \±ÁVh–+ßÍ¡³\6L7BÒíFæµ8ï“>PÞ?~útûŒµ¡}ê„ûr)Œ/ÔO‘á•Ð,¬5ì¯] 48ÒŽÅz&ŽÐ1æÆO÷w“ ©èØÖ‰Šc¸¬jùW<9…Ûaª¼¨ˆPußþúbe!±ª½ór=Ë - ó*•Tjü:¸yx 7—§~X¥óoò/B‡JjY‘麟¨’$Ciì_ ¾|¨ÍÐñìÀ(Ê‚Ù·´):“á6uè4+$\$ÊÆò0@[Qìÿc‚vÊþñÌÀE¦ûgMó¬áÁLÐ~pBËô¬X?k¨ÉJ½bÜ ©cÇn¾óÃÆ û3h+ð ãÿ¤©Z©õV·‰e²›áëãu“ßB3vùŽ+˜6/¬Mà¼CÎ=•8¾cB¹Õg‹®îÈr_7—g›Aè¾þ -ä8!¡G› _l¶Ù]A…¤®¯Õ•ÿ¡Êƒz*mºF»Š -€%®AGÎWýÝ ëõ,ûuñ4ç‚ ®}—n$×xÝÒ£ÓqŸ­ řڑ«vž“ºj,·¹ª{VºiÓ…Õ«ýµM+<&ãÉÍäËøéZ²tŠ%ý®Ìè™ñÇžGš.¯ªQh$»\zªr:«P6‘5¸cž«Š:ÏŠV«¦ª8‡¢ŸˆOš¨ˆúu -LßztB=¦\#]¢ÎÍeê(wÉô IŸWÏõYzÐp£öRÕOžŒüCcàF!õ~©@§ fú(4ìa¿ ¢Yy »“mÑ«X¶ñ 'Êæ{<‘7«LÌZç -yÔ/6ºÈeyÔpñ·s§M »0*Ý[.3Ù<ÐÐ LŽ-Tª×)\ÛeʧÊ8§pk”¤gò>ÐÉõlZ¥|4ö ˆ¼¬P×÷º©VqõtÝÔsº, ¥ºîÜYõv£/Ð7í)ù -š[Ïøm4«¦§'B×ãÄýy^ùâ/ýãK“Q=׌ܸ?¡ú uzJ”=ôŽÅÕÿFs"nendstream -endobj -1883 0 obj << +xÚ­XëoÛ6ÿî¿ÂÀ¾HC­êiYV m®[šd±7l؃¶h›¨,ª’œÌö¿ï”,?’fë8¢ŽÇ{þîHÊë»ðçõG‘ãI?yN0õ›žÛ_ÁÌ»žg8†eÐáy=í½¼Œâ¾ç:‰›ô§Ë½œÈ £ ?M³Þ|wq;ßÙƒ ,/vìA¬Ÿ/mÏš0ñÃÍÛŸ®ÆôþÇôûÞxÚ*mÅ‚5~êýö‡ÛOÁºï{®$£þŒ]ǃéMT:Q˜÷¬7éýØŠâ¹°Ï«Î9#'§ÃŽ‡žë;¾ïõãÈu"7$w#˪€‡7xµÐy>xu¿¬]TÎC©jI<^¢‹ oà¡9I»üÌÒµÈÓLšå/Úµ‘ûñcë_؃Ș’RQ‹#RŽïͤ|Ÿ<%ù‰ÿ*•K•K^5ùðzöóådv50ŠÀejz¹¬dm^Ö2_H’Ïj? +ÞÈ?qä‰8f•”ÿ{iùÿGvwóñp5gã9_¿½|5FYµnCÙ‰n©7-y-E*Ësá^èm^&ÚÑs‚]É<]ªì pÛHø\ÈÑÝ㘟fÜ?"rž“ž6,ç³ãÇŽ ]-rç‘.E p%O6ǵf='Á·Í1 +žt| üÀ `; /^1á³N8jæï—öޗܘþ„ð!ìqüáÑ¡ð£œE. $Ú`vó @åù­oÐÈt„fv3' ‡éÕ…øÖm%×Kè%ÀwÛHU—ÛE±ü-uÉÁ"Jø‚AëVð'¾íÇ&2«UÉtF2hxŽ4`KƈƒƒDè¹Öû܆‰ºÑR¢>‘e;{ZÐüŽ‚äÏíÖ.BËï®tKÉ2”¨%9â[Åd;æÖh’ød‚pØ ¡ï[5B\äU!qLϾìðÈH +ýÀ5? ÷Ê d`od9[á±É󭛦FPë%ñÐÀæäH¸)9ïKW Üti´Á¸Ô(â^ap–2ÍÉY×ÒèI•XaP4Ù£p¸:¥X¨ŒR«¤1Ü0uzì]¡ëÞ™¼"ñAe'×\»GãRÉ ˜í’cÝD£ 9¬ê†¼l°2Œ#ë¦E3‰9àc’2Ùñ –Q\cãÖÓpSîhâš©jS´Œ› +@qÙˆE½àeÇÄ0cG8w{¾/Îq+£è~4xBâÛ×\Aðæ^œ²\¬„y[ q^bQ [8+ÿ„²n¶J%%”²A"¶hUÍkoax3yÿË^4 ÖhNã?R”±íÙ*ªé38Q9Ÿý©mSŒ4B M>¨W$š´àP˜…ûÎDäî}‚ÜÒTé6k<:ÄÃr +¢äHªÑ˜‘¢š@C†.çB¯Vt †C«*P—Â’i(TÁk%çs +K|@‰ÐvXPóJ­rÊ*Õü,šê¦´³@t/æO媔†O/¬’L l Îäâ Œ^Lhpeo¾y÷ÇŸÎÍ÷/³×£óÙÎèNˆÑâï£O_Âñн…„ÇÑø®CBay=“D +FW£_vªìšÛ§úôS“˜Éá (J„â» 0X„ U‚ ‰ … øÍ&S)Ã`v›‚×J—àðf2¥A•ɼÊò½aVøÿ€ÿÒÔ­TþÑ«d}“ØËWö¢uw¨î¯Ë*]Û…d³Ø?ñsIb:L1·9ZçÆèân•–‡rÀ‘šöE%]!‰B>2F‰VQ#d”ÄRÖB¦bAñ!#à +µq»Üdð¥Bñ"Yáÿ?ñkRá¥ßÎÝ"Åů¸VVEbÜ‡Ðƒèk2=•]Ö+Äc‘AV"·E&ó ÓÁ­eú"_ã “?¸ƒ‘gDVV©}Æ-ÙÔÖd0Ã^¦¼ÍÍ# +r‹ŠQïý$S{3AŸ]pUƒ +¹â! #‹òíìjv6ûv$“Áý²¼NÿHÖÛUzm²ês(Ãû<[À'}nu5Üöº´ÑµD<Od0Ÿ-ñ“YõÄ£¬ óÕ£]_exâ7˜ +^åNØÊxfîäÅ€CºÇ!tâz#­Oî‹KRy›é¢/—Äl6ÐË4 ¡¡ÞÙm† ÙÈŸ¸é]Þ`­Âlºë|cÂ"ƒEø(Úå&PXÌ6e¶Ø?nK\´±M…ŽƒWø%¿IVöÙû‰TARdÉÍÊj€Ó‹6Y•¸˜7±;w)VQë®GJƒïÁˆ\0—»üæ1€qÈï<Ç êkÕ­p‰©\>–ø4ÊØ3±ðaí>sÙr‘íe‘àDñ>•ë›ë"µF¯a •²MåöLZ”`ë©ý6Ï7¥[˜1ìÕ÷›d>Ýo±|{]ÝmÑQ³Z¿UÐÓàSzÒ€´ËšŽ‰Œ$ÔyA”î/ÊNdZ“ÙåvYó2hÙ¹Û¶HáÈTbТéXl¸I˜ŒEÃ$rùèX°ß)ðåsHÅjGV'ñUµrûæE,3粪£n+8œIýMÅÔëv‹Ag¡u3’XÝÛÀ´$:Ö§æt<u×å[hÖ 9£48ÃÒüò¼ ö<Ø= J§j$Útuè¿Çä^¾{{ˆüPh¤ÃäßË&¿“A£¸»Ì‡¾€Fƒö¼LÇ`“ûÐðpp¯nÑÔ«ÌU1ÿYÁ=_:7¶¡˜R¿#|ƒTÕûŽy²éÙ=+,iµ“ÙŽÔJW%U=&,Ä €S¦,Oă”*üjTÍ«²§|)F(4OöÁmRìQï +¹?öïlÙÞ9TÙ#WwæìŽ +¿ïÀ0$B«aìesÀÉx¯[Ö☈ˆÖ­Ûª78EØhÈ¡M¡ Pù¶KKhò;(¯é*¨î²fÏלhd"&ÎÙ¡äx™ŽÍæ†z ã–; cÉÏ µ),i®ÿÌ—öó~i(×9% Séí?Dpà”°º†ýa0>0­d–iFŒo'ÁåtÁ…G [¹…˜AzŸ”ØJB‡húk¸×Ýb•åI{]À9WDócä"‚ôip9]GpI(ƒQo[Œ]ìúïy‘m±š7ê´ãó"­’låÁÊ®ƒt•#ÃlY¤˜jZï)Sj0mŒ9“ÈLUF«±Ð˜V!fF§žm9®>}s隇 ÿ«ÚyåŠ;ºR„÷»)ݮܛ”~rµÃ³ÕS<öžO¶µïåœàpâB[Æ4¤1Š¿)·^×´¦¬›[Á%¡Ðây¡~Î he¸ˆOƒËé:‚ TÅh—'«ŽxûÂÇ9é¦\I8/YcJª·é"]º!©*îænô¹îN9B‡CQImDÄ™ü{+“oŸ÷Ì^³bx5 ¸JS7x™K+:í1ýww${~ “À¹$æt°“¨Éì$¼L?;bÀ¨è 1'Ò1Ö<CF• k»w +8*·ßnØ}žgv»5;²Ú^+]=0}^†³—óñïÒ8"gƒAÜ‹Œ¡1NáëÑÇ­}aÚi4B=Í€M+Ð6ÙêÉ ¥lج²§¤0ÑD1­ÙýßÜ«F'…¹º†°§„ÎÒtPNÕ0(U"TÍTa}ÙȼÎ[6^ÊôSÓ“ÐŒîqó†Çð¯1ù³ÃO^£­™> endobj +1991 0 obj << +/D [1989 0 R /XYZ 85.039 781.388 null] >> endobj 882 0 obj << -/D [1883 0 R /XYZ 85.039 288.342 null] +/D [1989 0 R /XYZ 85.039 761.463 null] >> endobj -1887 0 obj << -/D [1883 0 R /XYZ 85.039 241.673 null] +1992 0 obj << +/D [1989 0 R /XYZ 85.039 721.768 null] >> endobj 886 0 obj << -/D [1883 0 R /XYZ 85.039 241.673 null] +/D [1989 0 R /XYZ 85.039 721.768 null] >> endobj -1888 0 obj << -/D [1883 0 R /XYZ 85.039 218.355 null] +1993 0 obj << +/D [1989 0 R /XYZ 85.039 684.901 null] >> endobj -1882 0 obj << -/Font << /F60 1074 0 R /F36 955 0 R /F20 937 0 R /F15 951 0 R /F11 976 0 R >> +1988 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R /F60 1548 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1891 0 obj << -/Length 2334 +1997 0 obj << +/Length 2332 /Filter /FlateDecode >> stream -xÚ­ZmoÛ8þž_aôKå fÅ7QÚb?¸]綋ÆÉ&nC¯0´¶Rë`[^Ii,úßo†¤dÊ–¥ÝK$¢ÈáÌ|æ -øðC¡$>*¤„‡á`±9ó_aä_gÔRŒ,ÉÈ¡y;;{}À¨O"?Ìîö|$’fËÏÞ»_Ç׳ÉÍpÄ9÷¨"ÑR¡÷ébH½[ÓyyõËÇýþeöÛÙdV ­Ù€%þyöù‹?X‚v¿ù„GáàÚ>¡0¼9‘D -nß×g·g¿×¬Ì˜˜Ym œÅä`Ä}†¢•†ú e» }"}QïswRF8eƒŠ·á[’i¶=\!‰ÒV¡–æH(•®Pßç ¡Å*»_ÃÆ.ÍFÿ1±ÐKÌË|*ÖëÄ=¤åÊ´nþòí¡ž N]€›Ú-¢âÔ£xvîÈCµ²Ý±Kæ B>‡V–SVàÞ•#O£÷~·NŽ÷Kà8»ÏÇIlÚ ¸Ví\‰µ½ðÐ>•±|æ‡C0…GÓ“Ýá3h;UtïþÉþu† -äÕ½ aÄzΕEŠø}½,¯n½¸L¹88YØI8Ü—dB‚b–þ7è;ÞH.QüYôµ¬zÔߣ3ˆÎmä -@­Øó¨eyõè…˜²u»L´C\äéÆË_–©©ÅòÒ„Sôƒ•¿„Ø wYû~ Ê0@<8,jèi@x ôSòPÓ_ Cáeà¤9cfZ\Åì­¬ùis*1„!ªƒˆ¦Ñž>ÓtK¹é~HÏX#ü- CŠQŸ;ä•¡i"ŠÒ¥å”–æ‰f†KlU3|òG#<ÝZ†«Jk3k„à<Ù PQAô¤s¯xfÇç.?$äQ;Eȵû|½,¯½B4~ÕЫ£W‘l ©áC(Ä8œ}]|ø¡2<wÉ2G+™ôŠ2¿_”¦=‡ã™g»¹Ž¦ë/-Ê+²†ØoYº<74Ùî¦ò ¬Â²f² ¶t#C¸Ž1AJÝ|cÍáXòCåêúæTÊ!EˆÖ×™qìiN'–æD`gö8ïfI…5Ã'‡E2á -«m‡ ï¡°]X놊ÊØ}–³ÃÝÃ^m¿ø\Ùy…ã)–gUqær¤ÞɼMr ›@{vqOÔ±–H/mÈ}ïtƒGKÏIÖÔ)ÚÒ‰>Èá!Р)ºÚUŒt¶Û’Q¨mÖÿ·ñW¼zô£çJ5ôlZDÁÔóèeyõèA™Róèp5¬p1oãB5¶¶ XÌÌS#2ôLµ‚Á²% šªIéè¯UtËc‡LYUB }ð5¥r«Èvy62^DJ¸hº´ØÅiäû!a€Ûnäï‰:o‰Pô:r -ΚÓ*h¡ô•¬[¼¥9€~A @lˆw}J[ñ¤”¾pø>ú†W’¡¯ËWÉ6è3ˆÚôyô²¼zôŠ$¤ÿâðìûø§r¸©uÇ«}½ï8`t³{|b*UùïFâ—M8Bî -:¢{s2Á±™¨sÑt³Óå¶9H=ó{]Ô›¡ŸZR‘mº AQ‚q-ŽÃªéI¾Çx©{‹Ï_ÌÀÏ=)Â_·—oçŸ.nçW×XŒT|Ùv›,JLy_{ºù»«étòn¦Ô#ÆÿžÜÌg7ãéíõøf2ýxÕ’Jœ¸L‹N™¿¼¿ýçbäjQØ%6Oð*ÈŠl°™Àl|9Á©ä¼«ëñï'¢Ì -_Û”k¶ÂÊ[év™.â2±¯túÔ¶K›ÝŒ@Â?šæùëþ]œ~üðÁ."€ÂÓ]Äôêêº}ËpäÇé îMËÒ¦³ÛÙxöñ¶ZVZÎ7+‰.d!Û¬k¤uOÁ/OÊû|k³ÜÍp_ñž-Ç,yV›;Öñ»Éo1ß_M-B^؃|ñê„ B]ijûG&@*Øõ-Ä¡©C -5WûÂ8›'‚|FÀæ¨ -‡ñ«)÷ À<€{tX6÷y<¼K Ãt_êÛ>XÅÛ¥v(0Ã&f¹yCûÑû Ý˸ŒO-S€Gh÷2÷4-Þ·Z&c€“xLê—ºxk¯&°‰vTÅ)«'æÐ¥yGçú²–šìgÆÕ`ZG¶Ü·ú’ŸhNبKëP_46YµßÁÉT„ÕêžT]Z^#‡YKu ©^ܺû Ž_qÖGù·€Àísõ<êY^=êAÀiC;Sš¶Õ³> -«¬Åf =w»O:Žž¹ÚÝo“ï¥u ç»<ùÖVÚ‚Õ–Ïbç5¢®¥b>›íŠý ŠkáN²A¬ ±Îsìo­¼Á©Z4änô˜çwyáhÑõU~Ù²8¯úÿVåÞØÓ“å{ àt{¾˜îiNgß–Æ|úÀºN ízÞW" šă¯¥ŒPpiŽÄúó´êY—0ÐÞ¸ÞÃö{'ø,œœ<Ôæ÷-0JÀn¸Bç㑾 hÿx‹‚J±ýã‘MW”“—.¢ò/£…ðî2»‚—¶ÞÖ‹DÉRÖŸ­ö?b“ÔÆu¢K½ŸêÛ×¢|ioAjupæ–Ž™þå|œVU½ó¢4¹å r"nCaQÛñïAò“þ] Ž}€¥Ÿ¸”JX]p'•sÆzòòêÇÛ‹¡zÿ4ùùh8)„ì@@ˆÿôñíÍA»Ÿ(qà÷Æ”0XÞHâ ×¼¯ÆG¿¬ôšèé]mzn@¼ÀmZȼ =J<*”…§ÚŒ¬?`Îj³[ƒ%1N |0ç+¼Gí`´Ž¿C+ßž»²Â•öÂ%æa–GùjÖxÜsÙ4ÙMóûÝ:Ö3ñׄÄÅlöñ“^ø^?þDþ=ð4 xoÀÀlOqýs|ùnúá|<½ºþzÔ²™%Ûm<ËaŠ½Ñ JºéÙÕh4<›Àƒ-ÅÊÅéoÛéäæt4¾>½Ž&ßÞ(¡TËa—Àù*ë”ùãûñ?Ë}Bá\;Ħñ6ÚÄFd-Èf§—C\ð|oOÞÕõé/·Ã=QÚ·ÇZûÉr•éÑj;_Í¢<6¯ùÒÚv®Ébo%JÓèQß>íÅÑíÅ…1Bº´fÄèêêºÝe¸òMñTãÂHøvÒâÅÑd<9ÜŽ­Y«|ºIæ÷kô }HVsT¢ª® ²Fð!iœß§[Í-Û|†ã¸[eyœN!À‘¥UøýÀâüôl8ý0¼¿¿™yeÎñÕ›Y€úœ¶ñ´x”‘‰NÄ«Ð(<à° +3hqÂD0_Éñœ@ªsÐŽâ'Lý¤ï2ç  ‚ôáèq!BJç2'sг™žYFÛù:Ö¤;xP'Nõ¦Ú:ËWÀ?Ùêéy”GÌ>‡åæUh”p_ú0šõyà,5êÁ™éÁ4ºß‚fJ-˜X"îeíówÊL§Y®ß£òÍÊ•°3Ò0ä$hê%æŠÊÐäèÍ$_–ˆ»IÔ¦ù½‚Z¤Ï4=„Ù¾w œ·Æ=Y_\EÖV]–נ¬éMÁ%q%«¹Žt몱¯¡%Ée/£¡áõ„†’‘€º5 ³<½Ÿå¤¥l \__ŠZõÊwñ<60§÷–¥L÷´:}¨^=±UÁÜñ6þšD8Þ¥ñÃI ‚BÚd†Ïl¥–ã®|_n²ËÊ”÷Ô&SÝ jvã|Û^DSC‚©|ÒDÕ’¡òx‘ÆPF1Ïâ±áplç»°°Ý§'ûáç‡Ðy=îy„I¿D É BS`ä>ˆXÔaõØàöe2æ?ô;…Zš†ÔZ(3Î÷xM¬‚Š•#ûD(Yîá‚Ù:î©LÃSCYÎÿ”¨Yžé5³$'Løf#qÑ]Æ ч΃€p€€jAÉôÞBg‘^? h/ hÏÑÊ ¼\ø^ë^Šn¬ßõ™Áä,m ý¤‡_úÜw…ÃÆ) ¦ŒS_© ¼"‡ÂŽ‚ÍOD]Ar8è4‰õòž¨0$"`QOÁ«lWçS!F±D°ªFˆ&à‚HÁºÌ·$ûâêáïR8{Y§ÛTA玥é &CHï¸ã`µ±¬ºUô]Â\¿ª¢[Ô! ”4ÁS¾'ºÀ¨_m ­m U&n1¬“téf÷ª˜/˜Dk,·«ížS½82R硦6ºiÀ…Ö¬dŸìt§š7Ó·>“v’’€{5¬½Íp£¨èã1 /ß5¼ïpËu{,ð‰àìyî7¼f-þ8ápH–Æ~nO1NáxÅ,¯nÅ8õ¡ôÉšb£á¯“†f.D™ï¿Œf†×šA£Ãê;ÆC…ˆ‰Th¥I¦ßóD?gljé‡ 2ܲWlp.1eLõø†]„H!¤3O¶¯û:'pZ iÎLɇÌÜ ‡µ.h¦› +¶¹P'=[’~h)=€œW”,ü-B*cf>6„ ¯A…Y;†ðR EU¼–c]mÐÅ«š²õã”& •õEg½©Ð,8–ÆtžÛ†‹h@$ë–gië¦3A¨_¨^u öæuè.ez€Ïx›ó?L¿’ؾ%Ö‹¹°Í4ææ¹g•K¡%«{ñ_¼åÕm½KCB½ f¾m·«¦|±ýY® ]Ö3å"›qÙ¦@®“í]v¨7a,$Ò÷ºƒ¥¤9,†•o»Æ3BÊE§> endobj -1892 0 obj << -/D [1890 0 R /XYZ 85.039 781.388 null] +1998 0 obj << +/D [1996 0 R /XYZ 85.039 781.388 null] >> endobj 890 0 obj << -/D [1890 0 R /XYZ 85.039 256.633 null] +/D [1996 0 R /XYZ 85.039 501.914 null] >> endobj -1893 0 obj << -/D [1890 0 R /XYZ 85.039 233.316 null] +1999 0 obj << +/D [1996 0 R /XYZ 85.039 465.047 null] >> endobj -1889 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F57 965 0 R /F36 955 0 R >> +1995 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F36 955 0 R /F20 937 0 R /F60 1548 0 R /F39 974 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1896 0 obj << -/Length 2385 +2002 0 obj << +/Length 1283 /Filter /FlateDecode >> stream -xÚÅZ{oã6ÿ?ŸÂÛÃmEÄ%,¶€“uv[ä±Mœ¢E[:[NŒÊVj9Ù×ûî7ÇL=,§‰‹"HD‘Ãyqø›!Úóá‡ö¢€ø<îɈE½ñ|ÏïÝÀÈÇ=j(í_êÎÓóW'Cõþë軽á¨Z²1Jü}ïç_ýÞ´ûnÏ'<Žz_ í -Ãó=IÁÍ{¶w¹÷}ÉJ‰žžÕf à”Hô<î“(­4ÔIDà…À'/J/0× ”2Â)ëY"tÃô¨[GYH$xÉáÕm'a«mžå´E-0Œ;òP­EúǪ¡W@IL…«WÓ†¦!‘®ÄÐ'¾Ã %ŽngžÇkuI, ý<Â$ßàͪ[AæSÂj.ÉïŒ~ð ýÕó~¼Â.Þç‹}õWÉlÝ…î\ݦº1ƒ¾Åþä8'ᑬ 5ƒ™Šë4_êÆ8É2ÅæƲ¶á¤–EQ)ÀÉþä>[Säw:¯ç…”„!ØI1¾ceAºLV(j`Ë ØfWê¦sŸj¹Ï`ÏÑþéa}˜ˆH@Á/<$q¼h!,/ÏaÖ²P2 -K‰hÇÇ D)$‚…Ú‰b†×Ť$¾”ÅΆ?Žêšq?VÂw¡™åÕ­@ %­höF/¯Ž»ñ2/Ìrçú9VýY¦ßýÐÁ¦¦a Eh™ üNŸS*î(xχs/YLÒY’/¾RdË(2NQpQè÷ÛùL²T…0XE+à þŽÑÈñCáÚfüaj5ªFILKƉðÃF‰æå9ÌZ¢$b +%Zl%ˆwy£-Ÿ ,Sµ ˆ -Ùã«š#!¢ Ü’†ÖDiÈ¡N`‹†D@ÂÛ"ÑÐ4$Vñ^˸"Qã=æù™YþD¿Þ©XËh*PM—zà?Éx"î7ý¦B—”ņržŠÄ…q$²ÈfqØa,\³ž¿! ¯nó9IÊŠùÅj©²‡kÊÔ•^)Co­Ý+;ÄxD¹*ÍòÅMA6L‡„û²;`¢Íc‰PÿI²Jš#‹e·DCÓØßáäL选c0ðÚ fÕ J»¦}›c¢œØäŠ,,²a2W^…¾;xYÎöƒRtª§¢¹/C÷Ú ÍÞëþ1,ˆjxêl<ÖL”ÔÈ—¬ ‚FùŽU€·]:Vêq*û¨ßlšê—ÕlnZv¸  -Æ@qU#2í·bfõ6OÃLT¦ ‘~¸ x…Ÿ+eæM'!ƒ&!à¡ ¢—m:ÃËs˜µl: ‡AK‰ÊÂÕÚ‘#\ÃÁÉÉùQ]Q{•Bå· E-¯nE…€ÁŠ¢G£‰Öôð~¥Úv*’ “HÐj,©PTH²Â‡ø6OÉJÌBåËG;+Ó*ˆWËS6â—¶xL³éfÄ ¨=·NIÓ7š›.Ó´ 7xÖ Ž¸ç“ £n¥ Óki10DÄa§ I]\íˆ$Z8â4 -ªPP€øŠw VI{jHiùlI±>í|¬ë†Ô¸—•×mÚÂv½(Tâ–( 3PЩb•Áy‹IªõòWGþ ÿíæŠ2ÂôË*ÁhÌÊpB” -Û‘¨&MõiÜÅ–2Æðѱé!1aÐ a+¿hÏVÞšWË–‡xd噯­| -®‡\¾Ö=.0´DD¶1Ûï!V7dp¦ _æAËËs˜µì„w+Kdàý ‚VNahÁ±HWÚÒsÃrËQØA±SZ8eÛÙÕÉ Ñ±‡ÕÈdzTÅ¡öèe>7ˆ{_b§Úp™¹å ®GØ­ssûU.Ю•}õ¸Ç>] ¨Å㡻ʦ鱘ÀU*ýk’Ng ˜° yzx êëOƒ³'ÃëÃÑõ‡Áhð‹ø dh:pgÚ«Ç;Û½LW@JõËõã(ò”?àÈF£jÅ3›àÿj-yüù'¾ã¯’õ[(IOxƒ$Õ Þ7Hˆ­÷ïq E—2ÔÅ¡ÃëÈÒ?À¿_ý»0 -Ód–¥cr®Ÿ7?Øx˜×Z­Æ+´øêàøêìhôíùÙõéàèâܪô®¦Œ_q -8±Nà¹ê²ÿµÒ°aÏð¸o]ï˧¬7¦€ëéâo]ý§-œáóœ•+ìÊý3«–fEúÔÀtÝTyµ6îŸìø..þëMÛêÝ“®ËGmœõ„÷kòÙÄÙä*òÞý%¶¥9Þ&l;)xæÎÚŽ¤ÇÃamk={¯´±xýz=þœ©8`—ññLЪ'øfÞú”c‚ü ™ñ ÔX<ðƒ¢ ”Á‹Ë8º9¬ÚŠ8Ò˵¼ —Ó4IÓݨexmQ,Ž¡ÅNXÿþ„Ô.£<"L„;ÑÐòêÖ -盨¢áèbpvùy?ýÁÅðl„ëÌÜÃI¡{ÊzŽ1÷æ‡Êo%¿÷E ô.,µ¼º-pÜ£’m !c±½4«-jáÍtÈŸ"óI$‚(hyuk0§#YÑð\‡âÀ÷WCs­F±ê\8sO´å×.…|UðÝšúkhyüÐ÷U¬]Ž=:9¿* Ey\šlqŸ£¾™©] ®jêNgy‘¶yq½›XO*&Û\iظ^›ÔýÓòo8Ü',n»é„_-àEÿ¡Sþ‡‘áñ¦\!!G£ $ÃFCpŒxSßÿº‘y¾endstream -endobj -1895 0 obj << +xÚ½XkoÚHýίp»ÚÈDñdž~¨ÊJ$1ÉVRp*­Ú +YØ$H`Sì$ª¶ýï;ãc „„®"âñÌsÏ=sÇsm¤Aþ‡4›HͲ ¶­f ¨Ýó‘«R†21J6ç^ã´Í, Aà@GóÆK(#š|Ñ/®[·žÛo„Y iX–­n7‘>7½Ë»Ž›Ýó>6\¯pZÀqŽðø½ñåÔÎîcâØÚ3oC€øð¬Á]F‰ºŸ6O”£šœU #6`6Y±R„a@Ö,ƒ4 qüÈÉG£tG2¢yÓÀ–O¢&¶õ4\ÈÞ4–×î]§D¨·Øâ.±(²3°A< …ÕjÒ4f¦J­–½ý}Ñê)ÇÜ$VžüˆßÓPÑYLøíS“1ÝOU_à§~Fâ´MÌR|P3(Ž)Éü„ãIħ0ÌôÁÍùðs{0¼nu/;îðÊõ†—-¯õ2Èro'ÒN@ÏU;ý1Ï»aÊM‘¼ùW^¾"B3%xb k«äd¾'ceÃñß-ŒŸ?Žøe¾ÎDKx’Ž…Éêã/a(ZggB~eñr2—îùÝ•À„'âÿû?Å@AŒýÉ4 Ṯ¼Þ‡©l<“¡ä"y¼ž¢÷'í»î…÷w¯;¼i]ô{9§6p…W±j`”ù²Ìê×6…ô+GçIÝë=xÉza8G¿uõ_†Ã^½nI¾nÿך ’Ù„Ó$|•LÕ”ÏÖ"Ïû-ˆhq +<Ú´­êãCÛrnu+€å„³e„Oñ$(íñ,ñ>ì[D³‚­²vEÚcg9;wV»ïº•­õê½Rqt´M‚àß– {hË–ÒVŽäüȲ2‹ëXœŠÏü”ƒŽºZSppMªñaàX»‹ +’Ðu%…‘CK¬š‚X€+÷'(ò¥_cÅ@xŒ‡`¥ ¶³210±]fÕi5m¢ÿ# +±~•†@tv +i+9 )À¼+‘óú­îà¶iS½Õw»ž\]Qò<ªº++•‚úÈäèÈŸNe+}àÃáÆŒ ˜×{ÎA´Ï¡¶†G1¦¹+#(5i›a¥ ¶³¢|Œ½8#¨mr]¤¶“s0ÑJFôd6ˆÍþéÎ•Ï +MÀ,ºòP)窞5ÏgïAUÝ¡ŸÙLdÊð©,˜Ÿ›¼¤÷…»«å| ®éÃ$‘-y¥…Åc¢°‹DäíÁ o¯å"B;¾áL¾‰1~“°9–Q[—–@³‘7¤#ÁŒç> 1…µƒ¶yB²b닾ÂÑËÂÚÁÑr€Íð +Çc¹è3‘<þh'u¯Yü›gtùè”KyâËS±=™ªê!ž‡ _äs¢j¡ÓšÂ§¶Þèݶ¸lüâvÅ9=Š£¼RGþ,/ÕÇSÿ>QíY” +‰]eA*~ñÚÏýï!ˆç ÿ…Qf´¹R«+« 9ÿ¤˜Ì€…­'Ë‚'‹¬Ú'"¬ôå‘oòg+öRe/:½›yHŠ7¢`‡~lE>>Q* BYÓp4“p‡ˆ›r%3”]R*˜²jÁ›õ黭˪<¥·HÕŒö˸í’-B?¨SŒí!˜Àx­^¥Ž¼.uEUIk>°S÷ÉŠÿ$‡7}+¾ìQlâÔ?è?*M‹*."fÇ©ÒÍ? ­ñýñìÚ'endstream +endobj +2001 0 obj << /Type /Page -/Contents 1896 0 R -/Resources 1894 0 R +/Contents 2002 0 R +/Resources 2000 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1881 0 R +/Parent 1994 0 R >> endobj -1897 0 obj << -/D [1895 0 R /XYZ 85.039 781.388 null] +2003 0 obj << +/D [2001 0 R /XYZ 85.039 781.388 null] >> endobj -1894 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F11 976 0 R /F36 955 0 R >> +2000 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1900 0 obj << -/Length 1115 +2006 0 obj << +/Length 1094 /Filter /FlateDecode >> stream -xÚÕX[“›6~÷¯`¦/°´’¼dÆÉâæâõnl’¶“dv±§6l ®Û_]cÀ—Ýn;;^tãÓw¾#éè€4ÈÿæP±«1ì8ÚtÙƒÚ7Þós#ÌbˆYóÊï]lÞ ]Í·8Š5?ü¬¿~Ó¿÷½±abŒuÄ€a2æèŸÒ'ªñöîæãГõ¯þ»žçW“Vp|WÌø½÷ù+ÔBÎî]ì:Ú†—!@¼{ÙãSJpQ_ô&½”ê#šz«Ë@Š@ܶÛ5 ²F–Æ(iâOaÏ“È0©EõÉí«‡OƒÉÃÝ}ÿÃGïaìõo¾@ -ãìñ…‡E! ò (&|RÅ/¡ƒÆµBŽ¥™HwåD¨/˜/§i’˜/ÿˆ³‡ô1ø¾Ž@ú˜U„rd‰[ ûfA."ò¢B €YL¡Ð&Ha‚l  ÂÄF“4µüIpÓ²¤ºu’‡$ýeüÖ÷þeM7«y-ªDéTµ sYYéQU‡Ï{¿GÕ4Ž³(/*›Y”L£KŠ»È¢è÷³Å•(WÛhÜ}ÖÒx£›ÁÛ¡\½yZé[“|•.«æ߃ѪËÓtäG\@Ÿà,JÂx¾8…—@Çü Œo:¢í)F£Q‰rŠÏ*‘Žº ú®ˆÖzU21Ðarà›Ô°}c˜„Ù·̀…Ðf…ØøxÄÂÀbÝñÊ,¡Ì-–ŒF»˜”Ó †|±µH¹.ÀÔ¹©ê ) Z¼ÕY û†ƒõßD7éYˆð%è•P‡é,‡Öéùãþhro8Dｑ¯Üs²ë„ÿ›&Òóy*Ê™ê“MA"*´¨,ª–Ï"5&‰þÌUi™&_6¡ä›D-C„p¹!µ½¯ùˆdº -é@mkØZ²¾˜c¢GA6ÄÐ,Wשa1=ëô/Õ§êÏ|6ÏTI=I5b ùŒ(Ê“[^n­t,nKœ>·PîìsÜVb™5°¶ß0w®CìjÆ=«Û86¹ ±ë1›Ÿº˜íy¿ú-f|ó¾y.¬À:ÌŒðÈxgÙ•rõR.Úé*ÍŠ£oç–kZ.í~Å)Ùˆ ×WêÄðS¿ˆTÑ*‹8Sõ«ëŽ×:£¤P‡Jo$zRª€—$eˆL‚eÙ/‚oYQ^¦áo%jÑD,;V†CnAÒ -·!µóÕ2Š×@aP3Ü ÃšmÂÀF[ièÝD¤Æ¯‡w¯%rýæw!%§‹4;v«8¨¥øÁDä Ê´m¯>gç{%;!};¨ØÞÌís ©i•·=ƒ¨§äoU}¾ÔíèZ­2·cº>=£§©{JwPÝÿtî&E®gn;:ÿÓiÜ©+üP -wbÜú_'oß ùÝÅr»¾õñŸzÿ¬OŠÕ'QÂo‰Øí¾‚Q‹›‘‚‹àËX“nùå±Å÷oîn¬endstream +xÚÕX[o›H~÷¯@ÚˆÊd†a¸¼Tr¼½8NjÓî®Ú*B\jkmH½ÞþûÎ B¸7F]­";ãaøæ;ß9œ3¤@ú‡‡ˆ]ÅvÀŽ£„›T¾Ò+¿\¡Ë%zeÍ•?ºœ[A¸ÐUü䇓`Å>©¯^ï|o®écÙ@ÓmÛQ?N4¤.ÄäÍíõ‡©Çñߎ<¿Ü´„£¸lÇo£O_ QvoG`×Qt ¢—7#º% &–¿×£Åè} %®™Š¸«Í@‚@Ü´[-4¹…¿Eq²JcM'Q7W÷'‹ûÛ»ñûÞýó7¾÷˜ä/ÄŠ$’ƒ(Ør˜Ò%H ?#l2ªr EGŒ¸Ëwb@ŒÝ ¿ ³4Õ_þ“ä÷ÙCðmƒì!‡íjó¥l t#,ƒ4ZÇåE A€m؆ÔQ¤|&ªM0#kSÜØâÃÁuÃàúVYSuºð¼wªfI’Ç;ùã°ŒÓ0RÜuÇŸ-.Gi· sL]almòÑèn‘I¯Æ ov=y3åÁ»ËJy+Šo³M9½Œƒ(Þ¶¹ ÌöénHäq%«õù^õùY_wDÓ5\Ú¤P埕*õ>vír‚H%-QûM ,ló5¯3ÍpÔK¯&ͪH½¹ª§Vj2ÀX¡)¶ÝŸ[1]ÖžYu ¥W°xÞ|BaXðqCF“F[ƒqe axI¬b–×|Bl:Ö¬þÅjÒ¼ÎЀˆ®³aX`gh@“{¿ÊПg‹;Í1ÕñÜ›ù¢&{J8 w«,Í…ïà —Â`½£Ý2ƒ4þw'FMGj¦é4f"Š°_Ó¯˜ÍI”„M¦ô+d“ ^ã× +D˜"äÂ챤Ös‚bS¾rUbÊMša«‹Óï’X&þGYAt•‹ÑJò(Vìs‰½[ +Tæ7tÜs ™Ch<±tc»gy«ÀÒ+`MoaHŸCË,wìtl`Ñü71‰ÕCÌp€K•ØÌûÓo0³d€ÁÌ*ü(3Kx…ÙE%4ƒp›å2ë=9ŒÑ€WÉ}2?Ö*Âå…ȵšïe‘zˆ·|TØï‹Ë–ÛZ $VIoÆS> endobj -1901 0 obj << -/D [1899 0 R /XYZ 85.039 781.388 null] +2007 0 obj << +/D [2005 0 R /XYZ 85.039 781.388 null] >> endobj -1898 0 obj << -/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R >> +2004 0 obj << +/Font << /F57 1075 0 R /F36 955 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1904 0 obj << -/Length 2544 +2010 0 obj << +/Length 2505 /Filter /FlateDecode >> stream -xÚÅZëoÛÈÿî¿Bð'Jˆ6û~ hK.i{Hœ»³SÈ+Q¶½JÉvŒþóÙ]J¤Å‡( Xärgæ7³óÚ%Ù€ÂXE¨pcÖ&Ë :¸…'½`qÆ8N—æ¼¹¹xý^ÃSJuƒ›Ù"R‰ÁÍôKòöo?ýzóî÷áX‘0C†cclò÷C–\‡ÁŸ~þüá¿ÿzóËÅ»›½Ð=;àPâ.¾|¥ƒ) ûå‚áìà®)aðxy"‰’"Þ/.®/~Û³ -Ïä PÕ)XÌ3GWíFÐŒH-öFàðT!51Nã£(QTz+€âb8VŠ&Ÿ7·y:¯nAy­“ÝpÌ’u¼¾Ã›,Ü\ùëG¼1`®ëpñ÷Õ.Ëgø( qnƒÅ¤!†É:((H‰¥¢]A¡‰c¬¢ #N©Š‚\—$€ˆ•µDœs Êšd–¯—áŠã\NFA×t…3§áFšnwi¸[¢màÙý"Û6)Ë‘ÜÕéà áF€Æ~k.tªSn¯1S%¿f ©†Õ-&yÉsð¬Zñ I ?Ø£œïŽl' ”Ó‹í -VíØ (U†V¸¯w =Np^å䥑¨(¨ldj¬ZÕPÒÔèá£FhAœæ•¨¡“¼ -dŒ 9„\ë#ïj±ƒä(èžWÜØ9hhóTkwQšÔÜ]“P-ÞÔ]´Š‹ÝE»´Ø]”¥ýžíÓ@ŠæÁt9Íf)a±«+åÐO•ÄœUɹ逌…û2äú6ˆ E”cý@‹¼:° K¬–lëÍ–\†Ð{œcWW—Û%:Ø¿Rì$l¨ú€\ðj‡, Y‡Ì Ì)ƒ­‚ë[äÕ ŒN-¯`[eß\P(]‰™³E^Èì ™« »„NLR“d¡AcÉ­°ÉÔwÀ0ˆfMï±%µT¿• *dìÑgg¶Hãý  –)endstream -endobj -1903 0 obj << +xÚ­Zi¹ý>¿B˜O­ÁŠæM6‚ØõÚI>6ëqÀk©å¬k%äÏo[êc4Ó`ÔYõªXÅzd“(ü±‘U„Š|d,#ÂÚÑtuEGŸàÍ߯Xh1 M&I›Ÿn¯ž½TfÄ(Éi>ºå("•ÝÎ>dÏÿñ㯷/~O„3d<1Æfÿ~9fÙ;ÿðõÛŸß¿záî?Þþrõâ¶RZ‰9jüãêÃG:šº_®(¹}…kJ¼^]J¢¤÷Ë«wWÿªDùwrä{5[LXNr®º ‘ZTNàðV!uêE‰¢Ò9ìã‰R4{¿ý´+f‹õ'°]ëì0ž°l®ïð¦ô7oÜõW¼1à­wþâŸëC¹›ã«b:ƶ-“†&›L `%–Šnû„&9c5ûÉ•JícœðÄ>€Xj$Â\ÀCo«Éæ»ÍÊ_qlËÉ¿+Ö3o³ ´Ø.ï +ÿx5öžaÙì~YîÛL¥9±&o1U0bYÞiª6–P]YÊTι%ˆQhâ %§8ÕÄ*;:Ê9S›têbàNÁxªìÇ:&WÙõ—98ãÌLi"…ITwç‡ Ü4gÇ$Šê†¨rþN!Þk@6[6#Ë™š!àQÝðrE˜ªypØÝOèDÝÜHŒ5–-KŒÍÆÉXví_{ÿû;erç¼ MB×-öÜ«Ò?sIʲœÃ&X.ýÅh0Ò6Ûñ„Û¬ÜL…ÍÚ?Æá¼GÏMÄÅf5Âü¨EP@>¹hƒXåÄâÄ„Tî +¿+l²õÖœ'cRK¢|?!2¼¬I"¬)4¢Rˆ§›õºœFýNu7ÎÔø"øä>‡éK ÞKê†Îaž6¦Ž=Æ ôÏnб ®ev4"F6šŽa”ïŠÞA¨¹WåîË"qyIïû}ˆ/ç6öxlt6A7={ sV‚ì³XÕê¿ù'Ó +aƆ1j&>¬Dnˆ´¢XÛæTæP §4ø*×üidMa % 3N¡Ñ1¢J_æ糡•Äb 1ÈêÁh-a‰Wú&DÎ)¨Æ‹QV7BÎýȦ«Ø†¹ë&ÂÅøTd!Ö]üMݼtbƒ9Ñ4Ć(«Ûµ¼Ý†dZ9Z±o!µLH-l»Ç¤œÆé_P~ž‘.5¸òfj™á%¹Jàyëyž6S ¶ˆf6vd!Ç6í4$´A0¼‡th;‘.uIôýVVÕ¦@÷I +¬d#ËYq18'œäƤ°žÀ¼¬ø¹&@ßSôÍô‰C žÛA EYÝÐ8†“a5l›íž\£Ceöu•òÎß\ïWpÿ;C `9jÔAVjp¨äöÐBâ7¶(«›™×°­Ëoga(ð&†Adõ –(«kÈ®‘Ý)udwînV΋{̬3Ô@OÁóàŽ²ºQKXÆê\?`¬!"ÀórlAV6L”™³ì©×,G4á ²{¸«):’†‹U›Ú±$`92»… Üî…S}÷‚Ń²ÔA½8aœ…mÙLŒ +aš­ž–ÍAÖ$ÖÍPt.+ó#P #Å0Ø‚¬l\«¶¦læRÁ<šƒ,ÈêA&-TN^C–ÐÑ +sŒ;®¸À$ J7Ò¦“4$mZIClƒ€E+ièÒV‘†Nu‘4¤úÞoqõk •¦Å>îm‰¸R†‹ÖGaLr“ÂzBVxYÝð9…ñ55ômI„Ùa Y=Ð`½ÄrVÃÖœ†%‡Adõ SŒP^÷Ú͵Z¿Ã1=ÙÚ*ÙÚpwîÍ +׿gQ ”%t ƒ¢¬nƒ„fDð‡„0ÀŒ[ÕƒÍX¢¥í I‰&‰ø¤ºdu#“Xw¬¬!ë˜u¬¯¸O–κqnD–Š{¼V±› +² Zè¾z ö»× ä§¦3…ÎSsÌ>yãL9ç…5oœ«*ˆ ·ûOã6ídõ³ÜÀ¿S`o^üçö|%@¹Y”ÕŒ3`0¦ìùÛ7o^<¿ÜÏïÖ!«•ájÙeø”çµ”až#éþ‚´i/á ‚•íe¸CÛ± w©«Êp¢Ï}FàÀ…¯ÓÝà=¸õ 5Èm}ã¯Ûúv'p³-Ðk~¿°<Ä oƒÞœ (ã¸hñ­ß½>Ë%”¿Æ%x?EYÝÆ .ˆEú˜ßKŸr`AV0™»ÂXS. ËÜJ{dAV2+‰©áºÁ$”ð;-päÝHWEœ¥ó®š'Ri$‘JbI”Õm‰„YÍð¼oðeË?i†duSP)ï{…» +’ ,Êê&€Q0YCÖ4‘º",… +Z/Âar=­ã kœÖE´áDÓ'm˜“€€‡™"ò©ŒÜ‹še5¯RRQ_K q©Ýg¥!PQݨ%TêUc¹¶P °z+ˆê†URËUbá‹ì2îÞ„ð Û7gËèGÔoi±þòÎú´i­ß±  Zëw—¶ª~wª‹õ;Õ‡žz‹©¸üŽk¦<›ovxa3NÜ! +|¶Ú¸ͳûêóöÞOâøò9ÐoxùÿU=øw‡»Ò_l–3WªOÓþQË"H["5OÍ~|¹ +²ºÝ# #F¨š{6Û½é,ûV‘–æO㸉(¨s”ÕYÂdœÄF 2R)ü-¢›Ï·YsÈ®†Ádõà…·ù)à³rÅ`y í ¸¢¬n\Ê°ªÁ:`œný ãj•C¡µ¾D© ŽI Á°œsL"ÖzL"¶iv-ÓxhaPNR$ã?¤˜¢_Ýû®?úÕ”[ì +œF¾­pdPJO}m׉ä‰Â”vyâVæé‡[ÅFû]&à Žh<>ø«ÿù¿Ü^{J>žÝø?/öŸýÕfëŽÙlÖAÂÍ3×—žœA=aƒÂË€¶QZxÜ$@ÕúÏûÇ70Þ¼õê÷ž¦ƒ%ó]Y†Î }–ï@Éf÷ýó›ôBÇõl±»°×®,f-½Tk§ÕçG(Z]ÞgºÜìËîn±éËŲÀ—ùÁá{„Ã! <¼Ï×Ýâp©žå¾,?_Øg4¯ùP/ìʵ;Sw‘ªùþûzú€ßŠƒûH˜ð¬Ë…±ï> endobj -1905 0 obj << -/D [1903 0 R /XYZ 85.039 781.388 null] +2011 0 obj << +/D [2009 0 R /XYZ 85.039 781.388 null] >> endobj 894 0 obj << -/D [1903 0 R /XYZ 85.039 761.463 null] +/D [2009 0 R /XYZ 85.039 761.463 null] >> endobj -1906 0 obj << -/D [1903 0 R /XYZ 85.039 736.911 null] +2012 0 obj << +/D [2009 0 R /XYZ 85.039 736.911 null] >> endobj 898 0 obj << -/D [1903 0 R /XYZ 85.039 736.911 null] +/D [2009 0 R /XYZ 85.039 736.911 null] >> endobj -1907 0 obj << -/D [1903 0 R /XYZ 85.039 716.383 null] +2013 0 obj << +/D [2009 0 R /XYZ 85.039 702.834 null] >> endobj -1908 0 obj << -/D [1903 0 R /XYZ 85.039 716.383 null] +2014 0 obj << +/D [2009 0 R /XYZ 85.039 702.834 null] >> endobj -1909 0 obj << -/D [1903 0 R /XYZ 85.039 661.784 null] +2015 0 obj << +/D [2009 0 R /XYZ 85.039 634.685 null] >> endobj -1910 0 obj << -/D [1903 0 R /XYZ 85.039 634.685 null] +2016 0 obj << +/D [2009 0 R /XYZ 85.039 594.038 null] >> endobj -1911 0 obj << -/D [1903 0 R /XYZ 85.039 607.587 null] +2017 0 obj << +/D [2009 0 R /XYZ 85.039 553.39 null] >> endobj -1912 0 obj << -/D [1903 0 R /XYZ 85.039 566.939 null] +2018 0 obj << +/D [2009 0 R /XYZ 85.039 512.743 null] >> endobj -1902 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F11 976 0 R /F36 955 0 R >> +2008 0 obj << +/Font << /F57 1075 0 R /F20 937 0 R /F15 951 0 R /F39 974 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1915 0 obj << -/Length 1023 +2021 0 obj << +/Length 719 /Filter /FlateDecode >> stream -xÚ­X[o›H~÷¯àWe2†‹V[ÉMí^äØÙ˜TZ¥B\T\gUùï{°=¶ÆPEI`ÎåûÎ…Ã DÁðC‹#ÌlÅ´b–¥ø‹V@ò±GJ ­TÑ$÷Nïbd€#ÛŠíýp¤s¦8Ázùipí oúcL%&êk¦i©_G}¢ÎŠÅ«é‡Ûñ0¿¿w¾ô†Îtçlø£ww•Ø}éaÄlKù®1" ^ôq•÷óÞ¬÷ÏÎU!ӕª*@Î,Ä-v!3¤ 7i˜ŠÉ1âXÏCœÜŽÇoû§«oò u'ß‹«7",ÀЈ `ך,¾'ip¦Í*ôæK/{¬2ãµVÑC˜¹IæzþüL¼Ö†Ñº­e½!5¶ë ýÇE´¡Zk˜ZõLŸ×ÂÊI -“lõ|n¤’}æ=¸Ùó2<¯°²‡e¸Z@î:pø±ñæq‡«>¢xv1ZûóÐ[9héÁ ‚ܾ]²ÔÍŸm³'q[SFBvê¿õoúï•.Û‡¿ÊE·~ü CzwÝ¥wƒpB ƒ0ª¥ðúÐ’C´ -Ã.œÛÿ~ö‚Ø4yµuuÿh°‡ =ðôò—]Œ—ÞÔ‡/­Ô ’C¼Ûq.WÈÞõZ¡ 1Œ°eæjëÌËb¿ ô­Ýtéf›å¶FáOo7»ÕõÝ}!ø»ø÷+ "€_³«÷î×ÑÌ^Ãoýøi’„~K¤È³º×s/§“ÉðÒ“d<øwxã:7ƒÉìzp3œ8/o+r_ÄëFÌŸgçÃJU¨DZKDÂÍÈÑÌ8GL:Å(aQ‚±ŒUBý¹|Ο˜´÷8ÏQ‰a°Ã€&Óéuu@Bòrú@qéy’wâ„PÄUlƒW*Ú^'ß><”„rdèÆÖ3Ð )kÄ*4š¡˜ ûy.C]¥}j©OâO(κ -;g²½.‹v̆Bæ)¸Üc5ŸB¢fõDÛºjäMaÜè•y§ËR:E§„T骙”ΑMu™T¶Ô‰!ý¥ŠA'ÎrÞ -WžÈðs±’¥e¦Að¸ÍtÂ4*•$á7Lt¸3•¨¨®áHh£¹÷:õXꈀ̺FlÂ*±ªlD jä  ÐeÔ1„,6}Ç l1™Aë2—ž™R ­€™Ìtåƒb›¼$b܈QSpŽ`m“À_”*!¤IÙY·ªkºèU½– †0±ÏŽ˜¦·³bœŠí³ g¸MÁø)ƒœuõçxÞ¨]U]ø-&|§/»/':C³«3Ï!ÃÔK.y7ÚÇt·(Nøþ¿`Xêendstream +xÚ­W]O£@}çWðHLgF ›Ý¤j»»¦V· ÉÆ5„À D ¦~Äøß ¥¨  ˜¦)pï¹çÜÃ…Î òu 6DMGëºèF¯x䧀Öò:E®äì[ÂpB4A`@C´ümT‚EË»~N­ñ| cŒ%¤¬iºt> É,.ŸžMÇùù¥u$Œ­’´,Ç ŒŒñV¸¸„¢ÇÕ `Cïù1ˆ‡#S¢âõy(˜ÂŸ²TSÅU× Á: :~ß!Þ«tˆ¨†*jÕ¼ÅÙÙtº;‰B 4Üɤ+Êî½âpg˜õÅId”i01+D´%ÆgÉ*vV‹#°páÞ´dJ£0ˆÛ¢êx` ÑM¼ðÚ¹ÀÅ…K‡]·õœß\;f¶ã†-‘~ÚÙ T4f {-¼.R9¡þÁ€¥ÊÎL¢1K[èÏœ+›=.[>Õ +KšDÜ»nWNøMzÔðƒö{ÁnH¤ð ›…ŽçåðŽüla3úÐÕý ºB]þN`´×ü¥½ç/ý‚éI{Ïðàõ`ï1»iãì~nžGCÊï Gý¾OOùõJûLpŽÿüÝËÚFêÑõ$ó%Ò•ª™Ïß²Èp‚HeùT öøÚ'K‘‹ ¾ÛfdQçeñëxu¥$ Õ2)sXàzîüÔ^,m¶Znî}p"~R^M/.‹À÷âç)oà½þ'óxß>Ÿ˜öÉé?Hঌ»ˆcê2~ .KÛ<ûàd6X<€8¤ŒLGÇsÛšfæéh>žYÏ»5Î7zAú!çáo³=må?³ÖÏ\]3"¢½¢œ˜ÖÈz£¤W.AXåZS}ŸáMÿ¿±š †@1ê6ü[Èêµ×(÷J|ôul”‰WQ  –Ì•·z7{’w‚_Æyžendstream endobj -1914 0 obj << +2020 0 obj << /Type /Page -/Contents 1915 0 R -/Resources 1913 0 R +/Contents 2021 0 R +/Resources 2019 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1919 0 R +/Parent 1994 0 R >> endobj -1916 0 obj << -/D [1914 0 R /XYZ 85.039 781.388 null] ->> endobj -1917 0 obj << -/D [1914 0 R /XYZ 85.039 107.714 null] ->> endobj -1918 0 obj << -/D [1914 0 R /XYZ 85.039 91.438 null] +2022 0 obj << +/D [2020 0 R /XYZ 85.039 781.388 null] >> endobj -1913 0 obj << -/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F11 976 0 R >> +2019 0 obj << +/Font << /F57 1075 0 R /F36 955 0 R /F15 951 0 R /F39 974 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1922 0 obj << -/Length 2719 +2025 0 obj << +/Length 2558 /Filter /FlateDecode >> stream -xÚ½isÛ¸õ»…ê/¥=!B\<šifr8Ûìähc'ÓÝ -Q»:\‘r’íô¿÷=<€EŠvm·“‰ï>@òQÿø(Õ,’Ù(I9“i:š,¢Ñ¬üpÄ-DhABæåÅÑÓ71¬F,‹²ÑÅl‡G3¥åèbúsðê//þzqöé$”R/ŽÎþÖ ¢55¢]} j™2Ê.‡2ö8ä2(=JtÄt¤ ‹ÿBºGÀOÅ(äxPf6E½Ý¬NB-tP-/Ǜ⪬êb3¾™U¿D::ÿrüåÍùøíЛ¯ÎÆ_Î>¿ýøáÉqñ-_^/Šã'v0^_ë- p#fN {Žü÷¾ 9Lr1Š³˜É(éeÝÁ„akŸu¡Y¬â—²ÎyR1.‡#[N³‚öO{5/&'" ~; …ŽƒrF¿ßOD¬·zÙîÓ$xÊ’MÆ$™HúÍ(´¨†iB°(-ÚËXxY£ÚQƒDël‹³““u £õ -ç“`Šc¦AQÑÌaÖ˜/p" jÎ ÿxØV5=\Ãæ¸Î7=×s·+éŽÒ`EžZ"‡kX<*Ž˜âYK<ëkËhUo¶L*²s)"–JÕ2t…‰›bY ìà’df—êyÕÆIkÕ é²c) ˜&OGq*X¢Ó‡™ŠÅzÈzl%I)oNDÞnf@m׊3Î ‚= -i„êÊ2ÅŒeó vº0µGŸ1KSñ(:\ÃJ ›µnQˆºžÔ=aɆ“8c"Êúâx¶V†½1K§³vû{bV,[‡ =ogdp>^ÐÀF+z0& 2%S&?[^#Ì þ±lMYö9°¯P‚û¬Ý_î×0Ÿ’Ç,ÎT‹ÏN|Cjgèv«I]®W‡5¢!­Ä÷WH³}@ãÔ¡4~:;§ÁÔ }RÚ¡Ò¤\m”…_1d€²D†QÁê5­Ptö•fVç;„ -çÓ¢½Ñè'(Í÷¹•&xšyrºx¶¨…¦â˜©˜ûB›¬W«b²Ó-åH°4‰)(kÄɄĉƜ£â?%M¸VÊ2®äN6J˜ùVeÝÅ‹S°2% Ž>0ªp‡«'ÞAÉtâÎC†–VkhÆ‹ÂñojX¼XM-OsgC+š€œÔ5Õë¼JA$)>“Õ “ o–@ -õ˜Üó\Ë]Á®ÌH9é[@YÌãvž—(š+`/‚`¶È+仢Gªv7Î"Tóõm|JWkú-É¥vOHN'Ê%"dfQ!~˜¤®ÐCÖåÍ’æ¼®9 «(´óÉúÜE$¬gãÌb±6nA±ÞÕy$SŽZÐíÂÆ& SÆ•7'P&æµMSãT¹­j@šHÈ”àQš¦ê±¿†¾ƒQEBôM04rè± É?HœWè!맒,‚$í€z ;ؼD`Ú±¼¥yÙ 4/OÏ6/Cǹæeð4—Û¼ÓÉhÛ‹ï`Š3Œ‰8¹ä T÷Ðj{ùù„žàßã=:wfy¹(¦¿@éµ:¢ÁÿH)l}YÄ»_PT‰¯ï¬žêÿBOºQSøÜ‹ -Yaeº½îªâD\ßYÀ­s†¤m÷Žšÿ±À{>‡ƒ°#z?`€ÿ´ûA_Ê5_ú)ÉRyà F'ÊÒb¾‹öÉuÔuèý“8èendstream -endobj -1921 0 obj << +xÚ½ZmoÛ8þž_aì—s‚˜)R7¸Ònº×E›t·¸¢[²-Ûº³-Ÿ$'-ýï7Ù²d¹Û‡¢1MQهÙgHÓžÿh/Äóe/Œ(ñ£¨7Yy½9<ùõŒš3dàŒy><{öR„=êéÉÞp¶“#~o8ýÔñÏë·Ã›wçß÷û4$çƒ0Œú^žÓþ½î|s÷Ëû×7êûçáog7ÃjÒJL qÆÿž}úìõ¦ ÝogñeÔ{„¶G(<^Á”Dpß|_žÝŸý^‰ÒÏxO¿Õf ð#""¿i¡8R& —¼ú‘B(ÿ¼ó|ôáåýèîížðnß¿~ Ÿôò|øž×ß=ÝÞݽ…n +£ªî××oÞ©'ßÐþÞ@¢ƒOÔXª¾]€&% àsÅœ1Ê*{dDüЯäàdÙŸŒz‰DÔ9›Ó=¥Œø”Õæ{“³¨ÿ€ôÞ/à ¦|‰W€X]ˤ¡™”DÂ9“vûˆOXØî!+«ÛæOÖ,È6ûz1*Wy½¬¬#zш¢Žl¹Ð6ˤ@?Aû³Æ4ΡLjøW½ËÌ|.,ìë©îÉfæ ¼bþáQ®—ä’C®) Âî`âŒ9ìšf vÍŽÙv®Ù5]åšÎ|×S…Ûá’‚Ýë´l¨2âÕÕøq?4²Ž¨‚WÔÑYÁ"Â’N·ÕÚ`8:WT«?ƒoÛ5ü™àã­ÉÖzãÒl>g¡›^àìÌ=/p/¹Z¢½¨ xLâ> ˜Ži·Ãûáõð=$ÁD?PG«lº]&¨ôC–N•Ö½Z,üSõµÉ<)·ùZ‹+VãQžÌÓ¢LòÑì@™6ྺ…|ôòúÅÍèÃÍ»ûWw·—?a}òÓ¥iŒ²Í¨ÜâÎA%®šqYþo\_0{uº¾3æ ëÛ18WtÐõ»f«\¿s:ëúî|/É䜅ýÿ€O…²ŸÎðãxX¶Íuï¬ÿ¬he~Í\Åž”µ¬#H ¨¢›§%®¼öTXûÿ¤LÑëÑž©Þ3"YäÁÊ=vüZ·þï¥þ²É“ +Ÿ‰~Ánl? ôÜgDò$hXYÝhp_ˆ×—3ÛÚ• pçÛIi¬Îr F®¶ò*Q w ½Þgàî~m£qt_Í›a¡(Q²îW“­ÐeÆ éQ@”Æü§eH#kàkËÜšA5#šÒ¾d˜K‘ÜD7#ëˆnŒÁð¦Û"Fž6I4O£ž‘uD=B–©i§—™˜ÐèK Ì CpS_™„q{7Ô 8ô•}b“xÌn¢˜¿D0ÑcšQ†¡,èñâ²|" +FÖÀÖ‚B…¼lµFÔv†XG ”¤¸ÛÈBôñæ^“Œi¢pI§»Í”ÎZÐ{Ä/€ü-ëôMmÜN:=1!q_ü+Œ›{ŒpHá<„TՓ™‘5p„µ„3OÐcÕŒˆÝ$[¯“Éì@ÃU,ÏcßU_¾£¯-¶šåÛ7R‚/:‰‘VV·‘< +Ïš‘u>gm5LëÚR3kxÜÑýÔ²BZCì<…©VV·©!dXÓš©{ÛȲIÍ,i®:D?ÖN­…cLÍs'¦,ã¢Ð¦V( Dp¨®JK[¶]çf"LVÛâÛ—Ò#!DëS`feuc&%ÿ×0ÕJÍÄ/—ú­‰»?L€ÁÍž§ç"€BÀ‡i\ÆG³¡Gaý†t–뾡ó4ÀYYÝÀQÚœ·EK„vN×Îæ9GÝÍæ1Ù¼ƒȃl¾k¶ŠÍwNgÙ¼;Úx‡~±4ÿÌF(Ìâ%àòÆÚU¬{áö2Ç»0ëTjÇ쥨Š¶ß‰¶áèÿÃëoeuƒás ,a ‹i¶¶±á»êã*´2Ý›éÌ«à`¢M%1™&fƒT™ÖP¤x9R@Bþ¿IDfOŠ‘¤°’dý8âæhéÄäibE CHçðk²s‹qã|L4<2ìvªàO;÷³²Ž° ;2ƒÞ©ªjŒtú.º¤’£Éºw;F‘?¦EÒ’OÝÚϤˆ{xþæù>TÁià0¢ºÑ…À¯¡qó¯WÆ^" g§QÌÈ:¢™€ zjš}ÀkÛ¡Fø1à•/w”Í!²@'QÜÊêV<ä •5ÅÍÑšö‚} Á!£SihdÑ0’„îi˜|iÒ¶Cèù'ÑÌÊêÖ,ÂfX_ôĆŒq˜HœxeOVUÏ/jP1Ñ0Cls^¦]­Î§÷I*äGÅNAý(Ÿ÷tãC-ìèn{öe¶Ÿ:iLjÍ ÎB2t&m!=fP·j Y†ö˜`÷ƒåRÛéð+ +Äó4^ ;b…èÇyTó­iÕ”Jê$^ÅóŠÌò$I×ó=â¯<Ë%þ‰?’Asž·P¤®÷ÛD¨ôØljSN$£§ÁÉ +;‚§@R°Xú éðñ÷#P±ûnu7¤e³ß£‘•‚ŠÀ³C´¿c®ŠõwMfI¿3›ËÓ%Õl>wlHêš.®¹½dæhé«1_fcí àºK;KŽ¨ÆcUà[ËdV‚Ç4‚À¥¹Ö¡F¦žÝó%ã5ƒj‡à’üÍô5'Ñ/™xWîø†¤ÕI<7Ú;,Ÿ/Ò½62ÔuéêÊkÇÔ5átªÂªBÇEZh&* ˜wŸrê7(ººS[™:¼¨ŸCQ{ ç‰Ù²è™Ã5>-,EÕØ+Ô\Žº·N;¾]ŠÙÈ°Qƒ`¼è+œlHƸõçfJ}¸J¸™kpòMìŠñré„`k’lsÎ`Î[TRÌœÒw +U‰`0úxñöZik·»1C¹ÉzªòÓÀÜNJ·d‰ Ú¬A+þ¡GÔó8á‘0ÏkždõÜ(OÍÒ¶CY¥ŠVÆ,j®§oc0›;ëœÌΰi\¶ÔƒØÎOQ«Âºš‡¸áy$ŠBUzÒÈ°*=´VI‹† Û ~[^hüÜr÷ëÕn}íí^ÒÚËVð¾È=…î=x¿;YĹrQd«d¢ ›]µ8bº63LÇ#sR 0]ùyÍÞš½}C$(Ï-¬¥{ kúµžRÑÓ²*Ѧå÷ 5ØÄÞ„ïÁãœuC…?Z€+/•õºïò rõ×°ÿR·¡Y˜nç$H'F°·/Ó}áB7·ðFÚ n®®øN¿¸ÐÇ‘Øü»þÀZUË…Ÿ'õï žeðÀÓ€ªn¬±ad÷¨$^<;Ä<Âd[Z†ÿÚª'ý,mw€è“È—îðrZ]4‘ðWæçk …ÿ ø5endstream +endobj +2024 0 obj << /Type /Page -/Contents 1922 0 R -/Resources 1920 0 R +/Contents 2025 0 R +/Resources 2023 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1919 0 R -/Annots [ 1926 0 R ] +/Parent 2033 0 R +/Annots [ 2031 0 R ] >> endobj -1926 0 obj << +2031 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [248.685 529.993 326.185 542.895] +/Rect [936.585 401.484 1014.154 417.026] /Subtype /Link /A << /S /GoTo /D (modules) >> >> endobj -1923 0 obj << -/D [1921 0 R /XYZ 85.039 781.388 null] +2026 0 obj << +/D [2024 0 R /XYZ 85.039 781.388 null] >> endobj -1924 0 obj << -/D [1921 0 R /XYZ 85.039 709.856 null] +2027 0 obj << +/D [2024 0 R /XYZ 85.039 706.875 null] >> endobj -1925 0 obj << -/D [1921 0 R /XYZ 85.039 612.285 null] +2028 0 obj << +/D [2024 0 R /XYZ 85.039 677.049 null] >> endobj -1927 0 obj << -/D [1921 0 R /XYZ 85.039 517.44 null] +2029 0 obj << +/D [2024 0 R /XYZ 85.039 551.871 null] >> endobj -1920 0 obj << -/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R /F11 976 0 R >> +2030 0 obj << +/D [2024 0 R /XYZ 85.039 469.579 null] +>> endobj +2032 0 obj << +/D [2024 0 R /XYZ 85.039 402.481 null] +>> endobj +2023 0 obj << +/Font << /F57 1075 0 R /F36 955 0 R /F15 951 0 R /F39 974 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1930 0 obj << -/Length 961 +2036 0 obj << +/Length 982 /Filter /FlateDecode >> stream -xÚµWmOÛ0þž_‘!Mk«Æ›ºIAL*‚P) h (K©Mº$-°iÿ}vì¼6…"˜ª6Ží»{îî¹³ E™| ¨! +QÕ P4M´‚,>•Sòß"öBgÔ'«2ÈÑps=ô"ÎmãøløÍЯš’¢( ¨‚¦¤ªZãfÔ„)›¼¸<¹ëÉû½q.èFf4SG ¨Å_Âí½,:ݹ e ‰d,H–1 POáïsa*|ÏT±µžÈ¤êDŠ¦lz¨ô BÔj_U¥%.:VlI_Ÿ¦ø>¶c/ð›ê¢Æ!{Kì›|ùNF2ùÂê+1,uU ´TO§Åö[¾Ã~ðÈQ„˜ ã,ComÅü…BàÓçÇ8d/2#*ç˜`¤Û¨aÔ®*J…ç¶S…ÿ%æ(0æxâ€ÃYbÛsŸ9ZöpCŒMwåÜŸáôOl[«§>o7K7•Ý¬ÆÔŽÇ—ÇÙZŒŸb°]/ wˆãUÈ¥%ÈãrO‚ŽgžÿÀ°¼9vMPÎN2)‚Çp3ššgÃÉÉX7§ºaž !5Ì¢ÞÎ3ć“ëñ¸&6\Ù<ÎøÉZ,çØä‰ø–2üMîh „â®éÅ‘I!Mô†y|9™èÇFh;ÂáÚ³q›<ÌuJ¤@¡Ö-yý·†©QlÅžr¬‚ßž¦öÖnd2›fÑÏV)..‰xT^w£e»¢Ûu¶ääO2Wû¥Èr;yÑ扩 nZ˜8®a±ÚÒòVᶭÔ*rõÍ<Ý¢|%%çéé<ý0r¦ñs‚ZohŸpìr14'úÑõ)Å(·éd!²ûLøst•ž¿×f]¸°¢y{¹Œ/§úFPrF2"¾R-D…3ƒ˜Vd k*#&᤭ËaÇßc³«‘&J~žéD¯¸ôÙ%Ñ"í6ج“ñ>Ó^:‘*Ú •¹<§Ðœ«)LJ4ÛÒJÊaY-3ôñUFíî G‘0Lu œGº9ºÒ“\Õ¦þ ¦<6¤¶ʼnÝzcÒG¶OvàíÒ@·$%?2ËbIãÏNΈOÛ3‹·«Vz(ÔD®"ÐÊŽë0cL÷›ÄAÿ­;[óy`¿Ú™òN‹ï!ê"1žx¿qà¾&ºÑ› -8ÒžOu|JIʦ -á„/µÉN.ËÎ Ö,Kæknܤ¡tu·dòe@ßuÏþLô )ƒì¦]Ꚉ¤¸¯ö8ꥫpÓ;ûÞò‰eAendstream -endobj -1929 0 obj << +xÚ­Wmo›:þίàVšn×æ¥Àª;)mI§)K·…VWê&ÄÀ´H ÎÀi»]Ýÿ>;6á5}»WQàãsžóœçØR!û Õ±4\Õv0GV +ToØȹ‚¤…&M´šÍ‰¯N-[E¸ÐUý¤òcÓ2T?¾œ¾Ÿ|ò½/CÍ0Œ²ÁP³mgp5¢ÁB¼üxqv9ó¶ÏßüŠçï‚îܱ.øC¹þÕ˜¡û @`¸ŽzÏî!@lx¥°À2 ù¼TÊç+1fªbV_‚–áË1ºGµ ‘îÓ5UÛ‚À‚æ6Å8¤áP³tkð—øù +-XÐ|QñŒÂÕz‰ƒužÞ…â툙!.—$ +~áœðYÉ2íÝ +¯‚ˆ>Œ…]‘þÂ$yÊ'wÆ¿ÇœD–‘†xÂî`šT¸þàh¹¡xõÏÖœÕ9¨1çÌ;¹<çà˜_Z@+I˜.qüfvÐ ÂÚúË1Ý䙘¢I­'î¿åTÝ•Š¿;‰yi–ÊìÉFÞÈôÅCUˆÑa |X{W“ivÓ(šLÄ›u·Œcz°'¹Á0¯g»ó¾¥Ë×^g*þppDS’5¸"kœr¸DwüHáÂ,7¹—¢¦$—U£·øÑZ®IšQœ—¿·Ìå3ŒÜŒ¶€­ÛÄdìûÒ!Éþ”¢É0–x(‘pÖ8J“Ÿ­$:Ç8H6Y-ý[\‚þŽ£pSàÞ[a¹Q3Í6§þd6»8ÝQü@Á~¿œîfi%1R‚\wôv'n¡°•OG¶²K´.wWÓEð~2?›yÁÂ󃳉?áëãªBòv~9›•«Õ#k”4iÂߧºÕâãIÀ!ͽ¿ýàôb>÷NýÎè¸Àù]á1#<¯| +ÅëO*¾ !M£Rc-üÑ’˜Ç»KŠ@Ä êyŽ¼$Œñ¢9žëqËw·k"ÑÕÖˆ&ìgì(ˆæ¸'ݲ1o0m7a½ÛÊö ›|_‹>Ú{/jŸî÷Š´T…êù3„ú?¨³I`Lz³á  wj¯õµâ­˜ý¦Ëû¸w+yyÃÌ.^‡•J“BŠOôËáYµs màÈ°…4™"_¼bq¤»ê[FÙå'aH"bvÌcc×1À6t4x+4Ze€£N{Þ‘4®­Ð=!X™Œ¶=±~v¯Y¯nµú¦¾.&S/˜~ñ¶åê­~ßVß™µO""pÿ +Ñsð6 ÐݾÃ2ûŠèÿéL¾ûOÁ +íîîÀÝš¥ë@G%ž‚foyvïþ æ&eendstream +endobj +2035 0 obj << /Type /Page -/Contents 1930 0 R -/Resources 1928 0 R +/Contents 2036 0 R +/Resources 2034 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1919 0 R +/Parent 2033 0 R >> endobj -1931 0 obj << -/D [1929 0 R /XYZ 85.039 781.388 null] +2037 0 obj << +/D [2035 0 R /XYZ 85.039 781.388 null] >> endobj -1928 0 obj << -/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R >> +2034 0 obj << +/Font << /F57 1075 0 R /F36 955 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1934 0 obj << -/Length 1709 +2040 0 obj << +/Length 1048 /Filter /FlateDecode >> stream -xÚ­XénÛFþ¯§P´  qÍåòlŽ-' l§­• @´´²ˆP¤JR>PôÝ;³³¼,JIœ"H¸ÇßÜñ¡ø0p™%¡p&‚`8[ ¬á ܼpMaj³Eój28:óàÖb¡'‹FŽËW 'óÆÉ›ãß'ã?L!„Á}v`ú~`|8;àÆ^¼;}>VûÏ“·ƒñ¤VZ‹!jü{ðñ³5œº·‹‰0ÞÁÚb®WPÉ\Gè}2¸üQ‹¢;gH\}º"`n ¶-^ËBî :ÁÐw-æZŽ21—å&OL×v “?G+†&˜ÊËQo¨èþU7Öд}f…tvtH|q—´Ê6z±ÎãÛ¨”´™GeD«Ã£JLK4^›/‹l%§E™Çé Ѿ Í7ëO–kͲ45_®äj:+ïGÏJY”Ïà\ƒîÊŒÄ|?m)@.ºÿGñöØ{:~õþ5r[#ü÷Y£a^Dq"矸pRd˜¯úØíqqÐòÍüzŠÆËYgiÇ;ÙZ¦S}]{Þ#§ -U”Îi‘fw•³\Ç©\ʽÑ[gqZʼ -:}— 2‘€ÉP±Ë|ÛoÛ¥Ußiy©”C™ik9‹¡öm.åt±I[&_ËY´)dWhi«(I²Y7Bµ¹Ý𱞠6 Ó—6W'fQ¹¬“”R€)=2)ÝÍ–KôÍÕū釳«é›ãËÓóñôj<™žOŽQ;9tÔ8_//ߟŸjk63]iò>Z­9Õ1+4I׆í´ØÎÌ -Òåø¯ÉôäÝååødÒƒ6*d~Ï伞72)—í=ý‚’°(£2žUéóÿ,É -‰únÅ”tNÛvvü²·ÝûE±=’½˜ïL«ì»°÷yVëiêáE˜ç{Úã,×W»ª*È6ù®ê{TVÝŒýîlý‘D}ý ‰ú¿egåÀyÖkÍRæ’1Ö;S¶ÚwÓü%îŸ jÜ£Þé°«î.˜ówWã-¯49I©ØS/­Þß~>pn3Áí¡í†Ì‡Ùß7õ+³E¤¦>wÛSßÆ7¯%¡:N-°£P8Œ‹ýúˆä+êDO·£nr‚èx´é/v`HÚáÿ°åFT<ÐKÂqCãzÃÓ*™Ó©Èa£×kXFy‰’4Ï -x`7‡‹M‚ÅêxÜ@v­áîÀö¡Æ*y(]1h j°pc¡Ø"(5ä5*ÎP×m<—=Ù½ñ“Å”9 £‘wújžÌPr†‡-*LM£è $*£²b 7Có hoå8’ƒ„jÃ`…ÓéîâR³Â—#±ÜÚ7Êz ÏX7 2Ø«ØÔ¢‘:ê±0! ÙzöF%}k%Â!`÷ˆs…«µÆ‡W€D>~BÚ½–R EqEĬòÕ™ˆ¶·PI! ñißÂ:Á6+ Úýžk°`H¡îð ^—DÍÔ™\—EZá3OLýlÑê:2 hÜ3ÙƒY•gPÆdB59šŠ!•Âsî.Ë -ú:Rq´=Í@sèxdµí„,ð;,À‚ ~ £ÉöBAYDG%¼¨(]LǶßT¾Ñ•Ê:,Óµ/ú\áBû²‚Ú2®á8—·2÷hÞç -Ëc–íh–»%¼À¤%)K$xœ .5VŠÜj'2 Yî hAÝ™}ßVÙ ¹ö€k¨sØ؆ÊÄ,o’TuRUu7¹d;ã)‹  Äó -C¤ÈYæ¿*8o4»Y¥´©K£T«”úò(qoÂAf{¼Ê8è0‹2X5—mÿú6ó®i±il˳y“¿Ñ‰/¨~ažÇB^ÅJ -Ú¬ ch -Çbžçtܵ/«–PyC¦ºÍ§vwß°ãð4.ß?ìZD»‡]E¤†½kØíÕ§‡Ý~uzصÕduÿ‹ô¾WпÐG5\凢„×voÖP †¶X½9ü—ßqaÙ‹Þ }Ã߃Š©­DõÖ#=Ì°8 ßz2ÉuÕëå;Ëß·½ª}ï1×v˜íÚO7·áßc®&B,õkd `÷-ñt@ ÿ@š¨~*åz¼fôÕñ¸§Foºék”êâÍŠò”°Øe_­Üužl^þÛ:Mó-Þó,÷ÉhöÝh4MíjIï.rÓ¨]¡úBM‰Q_éâE¤¿†õ/€Âbv؇þRÿü¡ë7Áö[ïÂa<ßÑXÐøÀ~ ·ú q ïX`2cendstream +xÚ½W}o›Fÿߟ‚Eª„#s¹ã86)/NªÊu¶™T•š +sÄh\Àɺªß}÷†Ó´‹¦Èá¸{^~Ïû4Èþ汫ÙØq´Åjµvr=@ŠÂP$FƒæÜœ\[C¸ÐÕ¼¨–C€E°æ…õ‹7g¿{“?‡ÆXG6¶íè﯆HŸËÍw7—·Ó‰xÿä½L¼­Ò­8¦Àå?>~‚ZÈн@€]G{bk;^ ˜J@,¬Þ“Á|ðÇV”<³4ÉÕe Á Þ·"Ó–ki6—abNËMžžrôšÁLDŽÉž\Ÿ+¦  +÷Š2(ãÅÐ &Ñã´” úw°Z'Ô_diJå$ð1*üe†l·(óÍBQ˽‘Ü¡RIˆ³´ÍÆ÷GrÍ–…Ú^,ƒ\4ŒJ0Ü•Ùd8–Ë ã`@ÑAë¿îa$Ê5®Êðu?%-˜0(¹üU>f·ÓéiË›Žu¢ÀI’)§fe’’)_j‰Ç'&î)ä!xPP.âh}•óðßiŽ8ªÕÿÂA ‹­†;QÓ—“óÛkNGüÿQ §æ‚8¡áÂVzÔ§^&´ä1P3±QOb·C§qYE¢ü¹H¿ÙJä}œ>´Â¶ÂÍZØÉxþÅÍl6¹ðÅD©¦F5 ^r&YAŸ3 ¥wXŠöyT¬G;²£p7Pg•å¾à°r[Eø@ËÝ‚kVVU=ƒ¬·Î~8{»Šá¹™{ýŒÌ}ìl;0Ì:­YÒœ:ÇÊ^C¯ÇÁkÉýª­|Ô9/~¼`¦7óÉžW꜔©øz鸓1 pÜ{S¯IÄ5‘Æ5Ö5‹œJ +W„d7lªBp âôéªHz•!dŒÌ¦6oè`…Ï‚6kØ MG§òßø“¬°þ…¿E1ðÝû ûNˆ“Pîâ\-ÖA^rŠzÅ9‡iëá&a”omOœ!Ç¡.81a±ãM’´Q¬ó!—ψ9œP±°Vx‘õÀ1²d£é£ñØn—KÙOFÿ?}îl“ÀÂÀÁnw\ˆiUXD@²‹·ú,Úü/z‘®úendstream endobj -1933 0 obj << +2039 0 obj << /Type /Page -/Contents 1934 0 R -/Resources 1932 0 R +/Contents 2040 0 R +/Resources 2038 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1919 0 R ->> endobj -1935 0 obj << -/D [1933 0 R /XYZ 85.039 781.388 null] +/Parent 2033 0 R >> endobj -1936 0 obj << -/D [1933 0 R /XYZ 85.039 273.293 null] +2041 0 obj << +/D [2039 0 R /XYZ 85.039 781.388 null] >> endobj -1937 0 obj << -/D [1933 0 R /XYZ 85.039 162.779 null] +2042 0 obj << +/D [2039 0 R /XYZ 85.039 83.605 null] >> endobj -1932 0 obj << -/Font << /F60 1074 0 R /F36 955 0 R /F15 951 0 R >> +2038 0 obj << +/Font << /F57 1075 0 R /F36 955 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1940 0 obj << -/Length 1349 +2045 0 obj << +/Length 1830 /Filter /FlateDecode >> stream -xÚ¥WmoÛ6þî_áôKä!fIQÔˆ}H[§kÑ$mìš"Pl*QkK®$' †ý÷Ýñ¨'r2`(jŠwÇ»ç^Ɉ!‡b*Æe4 BÁdç«^çí@X‰±wd^Í/|àrñh8KZ=ŠyJg‹/Îë??Î&g£±”Òƒ t>„3%âñé›ó³ÿ:{?˜Ì£:0¡Åƒ/_ùpèÞ8“Q8¼ƒoΰW0É”'í~9˜>5ªˆç éTŸƒµÄXD,rÕÓAðó|ÙÁ®Ç¤çc„p™î0Pœ)î™(€ãÞh¬w¦ù -\Õàº8'£±pòJ—»<·*z°pÊYÈåÓ@eÄ.¶€ -)µÔU,°éB  -BûÁ®åQ¯tVòÙÙ¡?ý8Š\ç?Ï@br2#~‚”M6¯R æîv:éJæ¹ÑÓ~´2Æ¡:U×øÁ*2~ÞŽÜÐÉÓÕØ]8ª4»¦}²-¢hˆ ˆž³L¿ã!M"ÕMZþŠ_I¿c ïŒGd§¬â*C°\å¤üÐ?ãÕz©/ç˼Ô\ñÛ¤¼¼‰³ÐʪØÌ­Ü/D; ]’.u¹ÍOÊõÁÝÉ -ÄeJk–ümh?º[ŒBW›"£ÓÓãW—Ÿ¦—'“?g—¯?œN'oFc“LýfôŽ{ÿCÑÙÊÅvtNMt±Ìc›ïå}bý(%QîMú6´)t¼¬ÏdZc1YuV×ÞŽÂR‘ üô8ëÈìn3O@uÄ}¦AN¡14†Î'dŸO¦W8Ô»šB! ‚àiì­Ìî¦P>ŽÀ`— †¨\?tîpgø[»Êiý7¥%¦PÑ4¸„³2¿p$ªÄ´\ û$SUº P@+Jì5CȓΡÐYè$Þ n««Äãñ -]Y½ùØñœ‡ù‚ã~æÆê~ÜXÛš]Ãã…n·½=߇e*RcñûÃLˆ0€‘•çCA„Ïß?’¹Aÿí3®u;Êzrq滢±ˆ>$Eu3ILóäa@€vÍ ú°®¯Ö”¥4^’ÀÌš{#QéU«4­öKúÊ¿ÓjŠÎ|£J@Fq»±_ÝÄM -¨J þ˜D(’ˆ"¬Qn0§¡Û“Há0še˜nF±‚]_´Œ›;,°¦‚‘‚ qÅ¢Õ+¼.;ÆÅ5¹«ø*.5Æ…¨VvÙ€ªÕ¶ŠZ‹Úóœã¸½³<§ÜÍíW=“´“»n;›u‡a§í-$özÌ×mw&t”¬½½½]é:…^S¤öž D¨¾s4¥c™S©XQ<•WÄ5±ÂSk¼¢fÜäf~,hÛ !T°ÃaÝÈÇøªšüšäß`ZmšQêï<+A/„Þ¼ÙÁ9¢Æ„hÆÍuFW^¨øžŒ™F|Ú ÁL›ÒeýɃç!…ÎâÕ…Ìó,Ó&aÛBH?0Î*>ªnÏoâŠåËš«•µŒLßYôxwÕ<÷„y3yuþ]ü—I3ùPyë"M2¤e¹EO‡üó›úÄ-5~ìÛ0í_ée/ð|ûèÙ¾MtQd9ú–ÉÉéô¯iŸl÷Í5î{B©öÕsûCnûÄðŸŒü¯?†š„'Y(w¼ª¼ãüÀ³Xm(ÂU2d*”ñþ Ín endstream -endobj -1939 0 obj << +xÚ¥Ûr›Fô]_!ç¡A³fYÐ>å"§ÉÄv+™Î$dQ#PYödúï=gÏ. ÉvôÀî¹ï¹íYñ±?>ö]f‰`ìùœ ßG«‘5¾Ì›W¦"1;4/磓S×s‹V0ž/Z9.s\1žÇ_W¼ø0Ÿ}š˜Bƒ{lbzžo|9pã’€g¯?¿ŸÉý÷ù»ÑlÞ(mÄ‚5þ}ýnc°îÝÈb"ðÇ[X[Œz5•Ìu„Úg£ËÑÇFáœ1q Ð>s}±{BîvNȹÍ·Çžk1×rä¿Y®ù7‹;pŠ›M™„OLǶŒ4X51¹Q‡Yk&7KÀZ¶æ1-ÎÂÛ‰í +É\¼MkEY/\c…ìÅÄ´=#Þ€¼,Aøuê +iÊ|â;†‡,°!NÔŽŒ¾QÜ$¬é J¸&NîÃÕ:k÷` +„|drta ŒD¨v- ':ùrz‰ÇókÛcV@s´_8žIûÑ+xÖ{ʸK²ØI¿ê<×Q¯³ÄŒŸHòŽ†~q­t„wQ`¤0Ê ‹X÷ªú°·e„iJ$ÓY¥ ¬ŸúÿÁjŠ5 8&©=ú¡Ð¾EÙÚº` ß\‡3Û &\‡F& X‡A‡ëÜÖ.Ÿ2Ï¥Œó˜31]×2.!¨“L=ã\º©Nª}–„CÐ1ó-qØJ RÈñzVr¸nÇJÇóa¦à™èN¶¾ES×h£ ã*Ék²{þéBÏ/?LÛëO@1;Ÿ#Þ7›<ªÓ"ßw.ǃ”¶§mïÐì–™–ã€Ï-OÚþB&|‘Æ*Ñd‚¢ý{ YEs¦A–Þ6ÝZÈÞøZ|r*¦eàkG°© =UÖpI˜®íB׫iAw{reE…CŠu·¨®–Ð=VÕå&Rt¿ì˜v‹®ø>~Q­É^ÄÝ›¿S?% bÆ}»‡(“zSæÄ}yöò +ˆ«óÙŸó«Wï/.gh^ߌF'©ú]Ê5ÿMÞé…¢ï j;eV„*Òß™îËd'Azwe)k–:ŠbÍ SRñn+Žö¤—.^…ß[¶²^IØO”Ä”‡RÜøˆèÏ3„O©ôHµ¿"lfãÃFkŠ½Õ`‹€9>UòÛ¨wƒŽWa³ÅI f¸“¥ÕurÀüµi†i¤˜Î+u¯àÜ@àØ®éN©ë¦µNE¾Â +“€bÑcjÆ/œÂM¦Dv@dZ‡?¿Iˆ©[¶Ù›0¸%!aiònkèÃnPïS}¶ÛÝ[ßa¾ãŽmú¤àO¿„ƒÜ|™Z–Ù60X>Ì~£ \4£—l²Úwz +u†ô‘c7œ=Ò fíͬžMd“nZ|Z?o[!¾\ºwû_›JMѺ÷®ýJùÚÑÕ­&Ñ![Іˆ„cÄ7¹žëU¦ Ä´³¼ 7üÊä…Ç@›¼°¡É¡IF|C¨·ÄP®â ‡>˜va^‡•z³HßhW*ëÕ~ELÒÏúáTl¤Y6CBÉ)Hª +ši»µ^«ŽA¾AYQ¥÷V±zÐAšÌÎÂîE%)õÀÞ¼N(àuzr¢ ªµÂe¥¨U ËPÅèèèhàÉyŠë¦{™:v«W6Šž­ðµ˜¦ü¤"p^Ô´¨6kj¦ÈWÒÓTÂéoÍ,&×$ð/ 8ZúûÛCGÔPüÙÞþ¸£Ûß„¾oPñ¸hž.HÄ¥L¸wÁ sÏ<1}zž(á»ú÷<òD†¥O„ðczRp°Ýí!Z†¥¢+²õii-"O¶ÊDÌ®÷ð4òzöòó<·ŽñóLO‡$»="u&„ÉÁE˜eÅ‹Í!ÓÏ•›žãÂÉŸ!3¿ ܱÂbv0> endobj -1941 0 obj << -/D [1939 0 R /XYZ 85.039 781.388 null] +2046 0 obj << +/D [2044 0 R /XYZ 85.039 781.388 null] +>> endobj +2047 0 obj << +/D [2044 0 R /XYZ 85.039 667.088 null] >> endobj 902 0 obj << -/D [1939 0 R /XYZ 85.039 761.463 null] +/D [2044 0 R /XYZ 85.039 541.259 null] >> endobj -1942 0 obj << -/D [1939 0 R /XYZ 85.039 739.701 null] +2048 0 obj << +/D [2044 0 R /XYZ 85.039 505.947 null] >> endobj 906 0 obj << -/D [1939 0 R /XYZ 85.039 739.701 null] +/D [2044 0 R /XYZ 85.039 505.947 null] >> endobj -1943 0 obj << -/D [1939 0 R /XYZ 85.039 716.383 null] +2049 0 obj << +/D [2044 0 R /XYZ 85.039 469.08 null] >> endobj 910 0 obj << -/D [1939 0 R /XYZ 85.039 592.928 null] +/D [2044 0 R /XYZ 85.039 299 null] >> endobj -1944 0 obj << -/D [1939 0 R /XYZ 85.039 571.731 null] +2050 0 obj << +/D [2044 0 R /XYZ 85.039 264.254 null] >> endobj -1938 0 obj << -/Font << /F60 1074 0 R /F20 937 0 R /F15 951 0 R /F36 955 0 R >> +2043 0 obj << +/Font << /F57 1075 0 R /F15 951 0 R /F20 937 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1947 0 obj << -/Length 1066 +2053 0 obj << +/Length 287 /Filter /FlateDecode >> stream -xÚ…VËnëF Ýç+´¡Ñxž’|»)Ú(Т@»i»[²-Ä–t5RÒü}Éáȱ;Eσò<¤"2)-z™¥äº,“ÍñA$;üò £†±š[c`C˜ÍÒ,W\˜â¦Nô‘rɵ‘¨óãêañ¤D¢Ïs¬¶‰”Šk©’|i¸Ñ&YU1Y¦™µ‚ýÞi&YíÓLç9;\ Ö»Ísª%s»zðé?«_~^¼F§ùRp#oâI¦4×…þtž˜9- „‘_€†,HµŒ ¹$Øß\ÈždM×6íîN+ÀèçHN*ˆ´‰|)–@TÉ‹¢@þ8¤Ñ½óay„´ HÛ彊MpÓ§™*Y;7ÆëqOš¸IA -y†(ðB²/ðá1U[Ãë"‹rÁšC]<éü §’À3]B`ˆÐwÓ°©M»9LU½x!ó|O/4‚§‡€|H¶A§DRÕø2É´2y’I$'•å‹µ1* ƃ†v(2¬ÛÒú†*NÀ4Ó¹?\, •JÎÃEÑpù ÂC:AÓ¡¾7þæ·Ÿ‚x×¹?X h9ëOäOÉÖPek;<½âA2ì2çiï§þ4Wºa$í-âh¿ž¬w…¿Ø€x×»aô´Å^Ä5”÷Òçì¢}¿kÚ™À4#ulMÔ8kM<6FDå‰:ðz}¨?¶×Ø 0(” #QûÀP¼îÑûˆÃß\Oj³zýœ|ÇPIõ=1%U›–VGKxSÌz#¯CwØ]9vWÀƒ%ÅÌã<ö䢞“l7z.úŽ|³Ž_ ¼sJ¶whsî5”8´ÝptÚ_U¯®FÀüf¤MU÷ï‹6Ì™0 ÉCèbu–N<`:q sëm®õwÔÁ‚ÅVa´‰Ó´û3ògJ€;ÍcKk5óÇEøhý!2Iñ}<žè'£ ƒùÿQÛ®Ý6»i¨i˜dÙk3î3¿wC]eÇ.´õסß<¾lý£›Æýc_­7 ÷õx§ßÁürÖíw»þ¤ù±çµÈ¹¶y4†`KsíÏê’ÛRßwø2ÙzØendstream +xÚ¥Q;OÃ0Þý+<&ƒ;_ÛB > endobj -1948 0 obj << -/D [1946 0 R /XYZ 85.039 781.388 null] +2054 0 obj << +/D [2052 0 R /XYZ 85.039 781.388 null] +>> endobj +2051 0 obj << +/Font << /F57 1075 0 R /F36 955 0 R /F15 951 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2057 0 obj << +/Length 1055 +/Filter /FlateDecode +>> +stream +xÚ}VKoã6¾çWèH¡C‘Ô«@/E›Z¨±—íhI¶„Ø’VMóï;ÊQ³vàÉápæãð›OŽ¿8È©Ldy,MžååA'Øùí!ö612±æ76£u7JµT6»éãsDY\Hccôùyÿðø¤U •LSì+4W2Ï“`_}qFI¢ÄŸýF±¨§02i*æÇL ®|M,Ü©§ðËþ÷‡_÷פk¸,•yz– +"m¤Éô‡˜S¸Ÿ-’-æØÂ-Ò-fÂ{Ì2fÔŸ[À],Ú¾k»Ó=˜€Dseî#yó!$qÄJªØ IrH¯ Bò×9ôùÝDÃÊf¡l`>×n¢’¢) ˜†0Ò¹¨`æfožšXñ-„-¾ +ìÓI¸ïu¡.Är u&"õȧ[põ>t¢Ç,cIaÛ%NåRÕœcäà`ë;Ùðizo7g0Tµ¢„yãçk*6Ø©ÞøÒ1²”ëÒ‘>Z¼¢/ƒbÆ•x‘ç0I‘V˜KÂk%öM;±ÛÅ=_ËáMíÌ£¯v[ûˆÌTMUméf3Uå´\ xÇÔ×tvˆ¹rXäŠONŽ+ëxyÀbaˆsåSÇþ³r™fœÇ"b·suãöۀƈ!9Wü¬ÆXñJÔ/biÉkÆ'¿ºõǹî8ÆàfzÛ¬–K´-ãqc¨¥…‡| +s#ú‘}ëÝe8×;^9Ž~ê‰=ªâ­»$4Z¼`rz˳÷ö\D¯± O&Ýô Å™šŒŠò‰)/­¡eQ?©¤;Óq”ðÆ!ãä—úÐÂSÝne›gÒªôÃVÞøÜ›$²ÐvÍ¢òvܲœë{ª·žýÛÏ]9±XiCþFâäLœÌˆ®ÇÕ /T“A£/ÃUJz|¦™íG„=²ó†r(ˆdˆó³B +Ö-Wa¹&![NÔI¶gš`{zn‚ÃûSû†e fôD ©=òÎÜ# ›î¦{øƒ„\Åc,¡àlãT ‹]À>7ðŒn #íuúzæ%e%¹õ0F²íxtޯ柣骷ªì ha’3b´µñÐènHJG/͹ðš6åknã?;ïÕí~ÜñLU3¦º{£˜ù;“ " U\šG^WIøŠßÔ™HA:ÃÇ7ÊÉbŒr¹ª$¤ãì÷‰Œ0®d¤ªü/­š ôY;ÑGÈKÛ¸àâ#1Jé¨|,ûîØž–±f¹‰¢—vn¢©qc]E—ž:ÿ§q(wߎÓÎ-s³ªÃ®„ý©žïH‚Qþlá®0\=¿—£¦^ƒ‘2©ü}ÂÄä2ÉÍýŒÿ5#|ƒendstream +endobj +2056 0 obj << +/Type /Page +/Contents 2057 0 R +/Resources 2055 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 2033 0 R +>> endobj +2058 0 obj << +/D [2056 0 R /XYZ 85.039 781.388 null] >> endobj 914 0 obj << -/D [1946 0 R /XYZ 85.039 761.463 null] +/D [2056 0 R /XYZ 85.039 761.463 null] >> endobj -1021 0 obj << -/D [1946 0 R /XYZ 85.039 667.044 null] +1023 0 obj << +/D [2056 0 R /XYZ 85.039 653.495 null] >> endobj 918 0 obj << -/D [1946 0 R /XYZ 85.039 667.044 null] +/D [2056 0 R /XYZ 85.039 653.495 null] >> endobj -1949 0 obj << -/D [1946 0 R /XYZ 85.039 639.536 null] +2059 0 obj << +/D [2056 0 R /XYZ 85.039 612.438 null] >> endobj 922 0 obj << -/D [1946 0 R /XYZ 85.039 528.054 null] +/D [2056 0 R /XYZ 85.039 487.406 null] >> endobj -1950 0 obj << -/D [1946 0 R /XYZ 85.039 499.318 null] +2060 0 obj << +/D [2056 0 R /XYZ 85.039 445.121 null] >> endobj -1945 0 obj << +2055 0 obj << /Font << /F20 937 0 R /F15 951 0 R /F36 955 0 R >> /ProcSet [ /PDF /Text ] >> endobj -1953 0 obj << -/Length 3214 +2063 0 obj << +/Length 2974 /Filter /FlateDecode >> stream -xÚÛ®Û¸ñ=_á·#±*ŠÔíu³Ýn -)6»(Ú>èز-DC’sröë;7RËNøAäpH‡s§Õ&€ŸÚ¤‘èl“¤Ê×iºÙ×ï‚Í FþöN †‰´í•ÁÝÅ¡˜dGöØ%*óµQˆóÓó»¿ü›0ðãXož¥B_«pgÆ7ÚlžÿöT¶ÝEQà}h›¡+_®CÙœ¶;ÇÞ¾…¯òÅö¿Ï÷×g·™ìgoÔcr&8DŽŠ6*ð³ ›‘%~¤4‘ókÑ°my¹kðç¸U@”÷Êý¡À¥œæ€ ã5l“¡á  |àN]žÎÛ0õÆ~Ùî #û\·4v9b³bhydÔ7œÖ^¹ãh+›m˜y¼_g ì¹/ -}ë–6; ÙÇ· =!ga;Ñùû¼Þ†‰÷‚‡ÖÚëÛk·Ç½´¡ûÀ -â#CãT ƒ,GxåÀp¡­e¨]™ñÔ3¬Î‰8ÀEp—7{<äÙ_^¸ -b?ÒM&¾ £Õ·8» ’•À•+$<òo^ñÕÉÝ€Ì;Ü, -U -‘=$ÈâÜ4“Á0LýôeJÐGdJ -·Ýì•v !fÂw°–ù JXW¼sfî–x&BxR6»÷Û B¯Æuò/[BX™ů“Ù£ÜÁè9ÇÞWÆGÙÙ¥©G1KÉ'ÇÙ&ôª|(hI” #òÝÒú{:˜„Ä)Ü!¡—ÔüŠ-º˜5œe¹é÷=bˆ -8c×Ö¼ÒÄûý3wJV8Ä8ðœýµ.ÒÏâ0Õ 9™•VwBáü‚f€õ¸Á=ËoŒÔ-²(Ìç9ñùõîõÇó'^êC[UöÂ÷CÙ6w!Jc?IÒÇŠ0Aº¯ ÷sÙﯽ0%N¼Š(Õ× -†ÔhÝØ*—ÿ ”ÙçdAÅÞƼ–ÀŠ¼fX]Ô/4­èúå™tþ! žÉâÜœi¦K:KÔìLÿtÍ{ø„¡&Á(Iá´=ê¥è$SSiÙ6=K<êu–ÎE~T’,ã SË MÒAøÖ£²eʲ -áDbcèÑúžGI”p•³¬LÔ猞Ë1›*V‘÷¯¥¶Zã—¼V–{èL,–†H"Ão’¹ HÛX]ƒvÇߺíòDB ¼6ÎœõO¼üŽQ–ç‘CawWØ^˜)ÄÀ=·Œõjù\ڗުñT}—çCF2Å·±D9`³à89äõíâÏg”-£ Ð3r<øô(%8º‡m¨1r³-ŒØÏì Ê"Úéä @ºgjd¤VÓÉ7¶²aß²´Üêxžs.¨e¿r²¦ÅÑ A¹F†œ¸‡¢ß¹/1AJöU¦”Ì>A%9ç0{ °½à(4ÑCPlÃ&º»| ›&KÈ­`"5EÕKë—Ê׎HWÖv_\8±qï“šHY2©2ëfS:þNTyŸ_{™,÷(8îÑTlÄ‘ÕA¬€ìbÓ,©aîºÑwܪuÛw½‰IRH Ìco2AºïM,YޭƸw/ÎàØ’'©óᆠ˜†ác2熌y@Ÿ&0/È@-8²,z (È|“PEÝÄ0ÚvìLzWxÀÝ+Ed2ïŠ@^±´ƒ4w-žþ=ÏâàçDá!'ã•ø“øi fây*š¢Ë‡â`ƒf8Ó›=ë«4Û° ãÖLÔG´ÿfÚ™T¼@ë‰E,1éys¢ £9Xä.Ž€”ŠÉæþc±GÇ‘¶³ë;qV(é~G×õþfvÆENú‡'®ÞVÎgÙ$朙µ`q¼¸‰Ô¬!Á.[ò'—ÐMÙíyÜ4ÖâMìmø*IÎÁŠ Ï¯eUCãƒGG¤º(HN!$F£ƒRæ%;E#–&z.šÛ€’F6Ô, ˜å5Ýó˜'Ñ$JÜQü‰—Ëp2eÌƹR'û‘^ )¹Šî,‚Ï£;ðcŠucƒÄ¤ÑÆ"QL㉜–öœ”öùGöNô¹çcì:q6u·Öİ׆œëRå{”3µ¡N›çç +žse‡PrY`ÑÎcõkŠþaž±7…h“MNÎõ¤!QUäÍ"ÇGãÔžJö¸Õ–ó6y?cêyA€Œ +¡Õ˜‹iÞ •Mê£-ÕËXHyŽÞ[}ÑÝžNõÃ"2™_D,ÅwÛâ+›Ó°ë£?7à.äk0T!&%qä}D#*evî0L†üY‘§UÁ¹Ÿc+>‘Á£ó *3~¯=T[Ëöö‹€ò9©BÞŠË…nÏZ:‰$–â6•uàûZV·FâuC>ZÊŽänœ -Î,„EŒ‹õ̲¶=9­Ò0ð{“b Û€l­x…ÖZydâu–œ›±xöµœÖùÈ @ûm_Y=q¼z_"á›úÇ%rœÿ@"in´´1Þ底j‹‘°ø2I(Ù+"Úä®9*Š<1ï8LÂ… HŒOÒœzPÀFêBV4ÀxN~yLt¥Æ"uAøž)×>wW/«+òÕ¨$®:Pê§(Ôf£”™±1©1aÏuY´ÔÆHú*0çêfVÅ«¾å‰+|ᡆµÊíÂUÏ“Ì»#o(¸bá^à 9Ôe Y×ÖÏ cáVŒr²–å Ž‘‘–2^ùm4˜6E¥¯T0ÐiF;<–¥¡Cm;­w5@¾½»’f™FñKúdþ}I·HÈÒŒGe‹Re, …Êf†Baittä% }(•dK`—Ô"ÔXSuažE( -ÈWËeÕþz:NbÝ­ÀFd -'Òyk¢(¿¥S…†3rQgäŒ5¹Ÿ®$ĉ$`ÐÅàÔ3—|€¿*ò|[1{Íõ”€$—RÁØ^í+Kâµì©Ò)ʬ8Ãhç Yz™*ã›PÑÃ[ªïhœÅÞMÐWkï­ÎDõ¡}^1uu^VlÛ«²¿©‰ƒ”é9•ËgyÁyL›‰?MÂmR'Nfí˼r.¨ÀÁ•Bz>»+zHdÝLõ£¼ø¤_|¸š6ÆžŒòz–’ Ù¸ë1Qà“T¤'ŸÚ0òŒÃî>(¤zœ·•7ÜÔÜ<‰N£'@­óC±âï=IöJ °ñþØÂröE¼³ Ê 0{¹öoùq×^lÑ©—tdRCëööâ¢Fpþ2ytœË,{fVp>0*îÎ.†ËG9Ü´,K*öp 6˜Q!¿q<áAuÂECÅT´|­Â $R…)~ºÀ¡U)• °feoÌ"aEµQnäŒL%ú¢ø‚^BA¦Ù½1œ“0¶nÐ+W -Þ˜§‰‹¸ºç›²bÈ$z¦ÿ/L|Î$”gËiaPž“) §c½ Óïú~’|ç? ¤ûÈ"áiÁâzQ^òý)ñ‰z£ÒßÕj Œ\ØìÏ7~Hƒç£‡$Zœç¾|PÍIüdßb4‹Q¨ø!H§b8°µx MùÑG^ËJê_Й9x-ªqètñL€…[AT.»±S -B?Žç†®€0ÓSc´Mj*¸½X‹åMHÏ?8r*¿ºâŽvÉžè2%“¢“´õDÀ´.ÑÈbÛ<ÉK æWˆ4îr—$†þ6‚Û¯k|•CvÙII#¿“Jj)²CMÞ·¹¶°`šWM«„NsvýÄ”RJ°Ù}]¼·zÙOÿhѵããóÁ¿óÏ0øá,™¸ûÿ0‡¹âÔA5$žŒ‚,L£å~‘§šêûþ¦áL#endstream -endobj -1952 0 obj << +xÚ•Z[Û¸~ϯ˜·±XEÝüºI·›EŠÍ`‹¢íƒÆ–e!²dHrf§¿¾çFŠ”d·E€X¤ŽÈÃsýÎᨧþ©§< B½Êrè<:\>„O¼ùÓ%q¢ƒ$ŽáyååμݥQÆÙ*ì±ËÔ>бBšŸ^>üáç(|ŠÂ MõÓËÉ0’æaçÉÓËñµßî’$Ü|êÚ±¯_ocÝVÛNÓÍ¡ƒ_µ9–Û½üùÃ_ì^f•, òô17 q£’'ûpïr£Ã V1qóKÙ—Û]¬ö›Â>ðÏ©|ㇱ¾nÕf€AnŠžø"ß´ÝXÊô³çbä.uuÞFùfd²×í²ø—R›ò„ ÏÖ'&}ÇϺ,CuK«§ôåXeheËŽ69ÂL}zÇÿQ¨øf(.Û(& ä +âÚ)ÔîžÎ?t·þûh“üqš£j­7U9Šž`Pò |x:&w7zxîR Ñât_´<É9˜+8Û ˜G’§A–­ÚëNHv1·…‚ ð׬¬üalDžKÈégܨ½ +¢,}ÈŽ¡YðãœÚÃK­<†¾ Ê’tÓõ(Þ²çJ+<^ßÆR¦‘kTOFêq¿ ›@Ùƒ¥a.O7šû¾»3Thq½LL¦ƒs£ýx–‡¦ÅìÈzvy ¾³_µ!µ àð`+sØÄícXžK~ö8–)Xè˜B5;2N¦»ðà¾ÿíÀžD`+>˜“,Jq¡£·üK§ÄïŠë•v*Û#zÕï<Û&2Çu8Ž}›N€þËWýíå+?uMScÝ¡îÚ¼ŽàW=¶ù‰æ¾Í ²ö¹·#N3ˆ2èü:ÜôUÉ3–FÛúŸ¡ŠňçNwòUºy«AiD=–pVš»”—Wú¬ì‡ùt¤É4ÈÐ,Žä¹Žò ÏbïLmØ€à$ü$pš#ÓhyÆqžŽKGÅÑű#:«±3sdùÊ:Dq2 sT$iäÙ{ÕËŽuÎ~¨A¤“¿Áìî€ë£ é5ñ.!’L­˜­ )Œ‹àÜÌEè5)|,¿üÖ]„öZ [Œÿßjó€Tg²˜8°L][²uCì¢_–mÏ;aÀîðÛ·–§6ÏL¶ãŸ8u,MÐQ¤¶îÊɲ—òvCÅç¾KwßAòÉ›ÝD6ñU´’È(#QnVLrªÇÀœ6Ê‚pϧ}9cTÑIÊ©Pˆ|ç k+ÚÄæ¢åÁ$À®>òÛ /”‹¦ez¦kÔ¨Nò)ó ‰ÌVwýÈ3]ë¬Û±]þ0V‰D#¡|2‡´Â“ùa·¢èÉ–u¸ç|f‡ :ÂÜRHžš¹ŽÃÜOýfŠ¤´‡â6”<ëˆb¦¬^6ƒ<½áÅà ºþ»A;¸D'l°)„ÖôKó}Ŷ{T¬ý8šB{1iaÃŽ-¦ po©ÄŒYöd¢“M¬óô’)ÄœÛò^²ˆ£8Pyö0Y84w“…¡¡ÀºÕ ëO%ŠK1.`QËÄû‡Lš>,JÒ õŒ TíÈVRR:OÈÖèw˘ Ÿ=@Ëo{“ ɹ#p}ä4nUŠï8õÇ”4Z“èãã!p^3ý Šã#šPĤA%HG¾g RÑ 5ËöÅ8Ûá•# å—8†x£<ßÆŠ›_Ó#‡q‰Y§áVŸ~ûöqe‘GLÐKAûÕþ…‘¹QÕ£‰+¾;“*¥™üÌIƒu= 延*ÅG_$€´'ëhmd‰ßB·®žg%¬³\Í84wÕÐXg…ø= +F£³×ãÈ0WÂÂ7.tÚ%à;½KåÈæ€uPq!MO%}t· ×)Ôó™zxDC³8£õ²(Ð +t¬ƒœKòÏûŸG4Ô—«1˜âÀyuôåU®ìŒc)(]‚öµ)F×ðëf¯¼%  ¶é½1™gÀ('öçx£-Ë£ìÅõ±“Xl쟭d ·ânºª> ío>ß(ÕÀ̸V¬s4ß8®ë€*:Á²žyÙæzcJ=úÌOzWòBë9rô/Bëô<È×&â±kÇ-DË1Ö¸«™â·79Zck»î»Ñ£Ï)¦RaÖr +ÃHÅ\‰‚Лf熬°’äjð$¬.d²—9mÙþW9ÒŒ t ›©:º0Þ<˜«©”ÇÈkbð›ãï¦ÊiŒ T€Ñ‚•àé»Ûõfü®t`koÍÎåÞxÃèÈhdG‰¨*W¦ÅŠbµ ²E˜å…£sa;&$†Î•BÎ÷Q ¦eºÁ cëœ³ÇYí°næßæ1§®¥­Í  +¥CÚõû¤Y†~±´Ð$ONQ‰Is¦^µ$Žw—K=ŽF ¸ÅŹü˜úŠ¾GLB¥¾Æô=ãSáMJ}W‡„T +zóÍ`I,¾5‹ú‹ãHÚï<9XúŽ³b0‡h_Û|pôJ=i¢¢+hP1f +ëƒó5rQUb åÑö5ï€õ)YÐú;úîVU6m?A0h°@{-Œ¹‡¢  ]˜>Ä +Í]¬`h¨AU¢Ù³â¹û™™–1>¾Þ*B¯;4‹E3Gå*HÃýCÆ Í‚3ìçð2=Ö~’½E"ræZ”~©õYÉ$öyŸ“_¹8?Éœo@,¾}%¿9ò"fo±çÅéãT‘ž©_ô•PüêÞ–õc9Ì×D9¼’ýý{ÊDæ`ïÃ(ý¢g‰N aGõbhó3_ ùù(E ¶(ö|º|èÇ m¢ØѺëÁ˜z}µ-Å•&Fû»ë : ë?ö†‰æ¾7Íÿà §² }ëûbP:/ý"Ry¯²hh÷ÆÊë×óÍ ÞrÝœzu9ÏpÙΑ~Š6F®lÀ~êTd馬]o )¨lñ"Ðû,È÷‰gžN¥^õ”eÜ؇ߪ6£Cwá¶=wÑñ`YŽWNÒXÊl®¥yÚ¤}–ª ^⥱„eá%Ò.ɺàljÑù¸¡ƒöh™¹6„`²þ̽Q‚Æ¿ßyEWžK' W›º7’y7ؾêqÖê’>ÌÕÖÆliÓo¢úæJýÞéêðÜù  Æè%Ì»Çc)W²f¨ƒ42‹ÑŸ…û%NÎÁõýÿBÖQendstream +endobj +2062 0 obj << /Type /Page -/Contents 1953 0 R -/Resources 1951 0 R +/Contents 2063 0 R +/Resources 2061 0 R /MediaBox [0 0 595.276 841.89] -/Parent 1957 0 R -/Annots [ 1955 0 R 1956 0 R ] +/Parent 2067 0 R +/Annots [ 2065 0 R 2066 0 R ] >> endobj -1955 0 obj << +2065 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 252.502 213.733 264.192] +/Rect [462.239 273.889 536.549 285.578] /Subtype/Link/A<> >> endobj -1956 0 obj << +2066 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [313.424 225.404 447.309 237.093] +/Rect [218.709 219.692 351.61 231.381] /Subtype/Link/A<> >> endobj -1954 0 obj << -/D [1952 0 R /XYZ 85.039 781.388 null] +2064 0 obj << +/D [2062 0 R /XYZ 85.039 781.388 null] >> endobj 926 0 obj << -/D [1952 0 R /XYZ 85.039 761.463 null] +/D [2062 0 R /XYZ 85.039 761.463 null] >> endobj -1022 0 obj << -/D [1952 0 R /XYZ 85.039 667.044 null] +1024 0 obj << +/D [2062 0 R /XYZ 85.039 653.495 null] >> endobj -1951 0 obj << +2061 0 obj << /Font << /F20 937 0 R /F15 951 0 R >> /ProcSet [ /PDF /Text ] >> endobj +2068 0 obj << +/Type /Encoding +/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] +>> endobj +1962 0 obj << +/Length1 1319 +/Length2 4957 +/Length3 532 +/Length 5759 +/Filter /FlateDecode +>> +stream +xÚí”g8œm·† F‰-F„èŒ2-:Ñ{O0ØaÌ(ÑKtQ¢G ’ˆ½× ºèDHô¢F‹–=Éû}¯ì÷û¹÷¯}ìgþ<çµÖ½Öu¬{=ÃÆ¢­Ç+kƒ²†)¡^”×ÐÓ A|66y4Ì +G!¬00$.Êb퀂¸¸(DH"$ `Ê£œ=Ñp;{ CžóW’(PÖ ††C­@ +Œ=Ì Wj…ê¡ pÆ“(‹@upêÂ\ah7˜ ÚÀ¡ 5ÌŽðÿr¤Š´EEÿ’m°Îÿ¹ÁЮ8S@œIN ΢ +‰ðÚÀlüš(\/ÎÉÿ†©WÂ"šVN¿ÊÿžÒÄ­œàÏe œœ±¨²¡‘ÿL5‚ýeNfÇ:ý3ªŠ±BÀ¡²H; (ð—wU‚{Àl´á¨=ÐÖ +á +û­Ã6ÿ4Üo üòÊ +ÆÜÿºÑßAm+8£ïéüwÙ_Ù¿tÁ¸ù á@3>.÷û÷›Å?š)"¡(8·"` må ÀíŽD€^ ióÂ(m¸Ä¦Œ/»Y.§=ªe0ÞMÓð\r¾}´~µ¾jtÖðto~‚É‹öŒíŽõlmý¢Ï,x-fn-Ï‚Á¢ÆJiƒÐÇeìB,º”).ùa¡_Ü)â ¿ ù:„×pOí °TǹÄÏŸž›ÒÄ\ƒ6ö¯…EUˆO®Vt¥¼ÃT.ìÅaùÜmËN—§õ’Kå)Wã8ŒÇÓç‘yˆÐN苲s°à-ýRÁ¨8ƒš ¨ÕcSZV¡¢ÜA¹š‰ô(Š4¡¥ %”WMk׋ õÉŸ§NÒË€Ýþæ–BÒ6þ¨>àˆ7¤nUûÆ[ëÓ};b>Ó…!ùtn“ƒØ%ïçÓ*ô„WRA¥:’ê4VÎ÷ÒÔj”F©†&"Fˆnïð6d÷uT4´F_)ŽSýòM—,¦ŽÚ1p~Îó*^Ù þÛ[äÊÕNoB‘ Ö¨ëûN9ò×üšÅc’×M܉6 ž¾u Jkt¥“Ù.å7>h_µ°é=YüÑÛ¶ì ,ç#©A&—’ãiÀæO Z{· áé5~ÐåÖ›¡>2G7QËc°Þ•ŒE½†n™ƒCÝJŸ_å¼rÞ$Ÿ(_鳞عÿŠæ}4úyèw’Ø®6uößÇZh©„í¦d³xQöÆ}Î- ºïÝ]’ÔµFÛ?,\–}˜ú­ûdcyÖ0¼æÞM‡xþ¬V“âØV½í!‡ì@DØÝC⨉Ԉ‡÷N¤Î!Ï;áN‹sCÑïÆWÕ@ØS±Ÿï¹ÒÉê©ó‰“£Rš—.i…©\¬.;»sÐK^¢X@@@¸°ïâÔqÏ +ô8ËÄ{Þý¬EpOüví|d5½@a( TѪŒ—úýñ9€ê½"ü¶ãm<±·Ñ“©Mž·zSkU)á‘J¬šk±T¡+ŒTIïAbš‡7ÃøaMàxÄÕñãÉÏ^jàÚká¬!ËoóÑ-ÂñÇS„&Šø=dãL—Rfàúnü!ó¦Ý:qCëZÖ\’ô®=öã“¥˜³¾ÝäC6œ‡!ÉëÐÿ¾ð‰8awFu q\©ÚHÌaÅ1?ä +MœsÒ-¼f9ÅÔLUÿÄæÝصpÍHù}äǹ0˜tsíFRGbÛK´ò’—j›Jh¨VÖ¾Gl‡¯2}Í“`Ò·þÒ»Qš}ùk¼iNùVnG?Ø(ãÒn!ÊÿܾóHùÅnpO/IF[™±ªä +žçfKÛÙç9p<ôÀ¡î¡K©ðW¦‹{'”P/Y.~MÇž{Ó·êý£»ö«|»ä˜M&m’ÛQê²j²µ Íàt‘oê,ôÎëâz݉qòB²«!JæZ=žgã\·™…œleÜ{T"cɹW1æ­óS2–ÅÅ:E…“4’žBÎ!0§­ +©èe¦Ú<ñ:ÑÝ/f˾S1ñKsª’¢x?Ì4ÇT]\®Z§ä~Xk¾ä ~5m¦èíÞµ%OáÞÍ(ÝîBÛ/Ç]Úéòú»áM‡˜Ü5u$EPð'Ê»šÚWúæŠRgMß8J½÷›õ{6õ=ªæÚ)îžnÙšÈÁœû:ùP$3eàù«ýå­ÍòŸ?ØÆàs¤Pã„<òF•å”d§À½Ø]5/þ¨óÔ—ÙeI0íwAÙBjš¯ÅAvÜb%+êe}ùžMÝÕñôçec5ÛôCOc-ž š¥ÖSîˆþ[µŠqÒAâ÷SŽxZ*u̹D<ÙŸ> +Ÿ&·• ¤@Þ]&·‘Ï +üÔõÏ·å«°Lúþéd}Žå@‰€Rgtì(Ú¦Ä%ÎtÖ!xò¨™ƒ§Ô;$”1‚Ë›—¿^ÂÛYV2Ì·³,Ýà,¢=,'MdÒ’Çô@jh$Ó ë‘¨eá`•¼ •ÌívnáCÄÎ鯢K©i†0{̃‹”W…<îš9WÕÒÕ\Mß°Õ4Yþ¤H¾î4Û5á7_ÕEšÀùìNÅð¾Îؘ%Fo’&í—MøˆñÄNøl‚*m6ikòVëÌ¢äĸ1Që¤:N˜b«ç0a^7 â.9­‰„ò7éìI‰Ôt†â_‘ÂPkÞ=¯ïËrÉ|ßuÎM¸Ÿ§w +O•íxËÙ^ÀÑÏ^I/Å5òâ°ß3OÔ¹…ýöJhXè +°çÙÔ#,Â’…~Ió‘Å|ô‡’&Y‰üÅ)1¼ ½ÛÓ†R¼Q¶ÌŒ¨1I¤Ñ\­Ã«D­sùÚã(‚ µF»ËiñocõÜX¼£"\öõ¾Û^؉ê!ï]»V„‰7¢Z.ã³VÆå£Ä˜ZBPN"ÅôÀ÷"m»ä”xvxWvyOî›pn.é2Ëî?L-Òϳ›©Êm2º&¯bÛðÅUºÏ⺰Åï!äëúY뀤ƒ3ÒB#¢Þ+g=Å£²êÝÐ¥˜æ…+r' koøë‹×ò` itü3`/YP nt˜öþŽ²Æp2ÏÚfË·{Mäã(’}æ|Ä“ïWåÕÿH@ßœi”WWý–WÞºD´á ¥ò¶iÕ9²º¼Ø÷uáz¾ˆÿf›;õBÙ©œ#E_L%ŠNr˜ä¸çTŽújèìÁE_@4)\cb¼ f¨*ðý™K© +"y@ãŦV8¢-Ð+èƒÝ +Ó”êWM£oi{7HÍ­íªû>,äƦÌÀSš¾$ +I÷Tm?¡rÚ{“×:~ÒzbôA¯”¦ý*Ÿïº6»7L OKÉÍ3+’¢ËZe¡–“¼Ó}Í„—h>[ Ð6SuqßbÚ:¦‹‘®ë^— µXm*ÑÔ°=Zõ°‰ñ%d¨¶ðO¢p"¥Z;Æ$…K¼Uœ*1ø&_·ü¼;î€<îˆa»ëy`”G_òØhaa‡Š—{®¨ñ0úÉz²Íwk‡}{A¢¦¢Ú…×buOÔNÖ8ny¬m…’e¤­µµM‰HÆ$¾d ã Œ5täm(‡[Ó¦~UÿFƒWPð °)®½`ôíÊuÏôÔ6úÈXx—¤§C–š‹ê£òÄ…´úþì/_åîÔuß„æÈ£»£Döå’Þ³“Ø;?çôõ}Ê/ +÷ëR4¬ýdù@†?øª_OÈÏ Ü©4e¶uÍ#ÁG{GA“ßì¹{ÙMÍnßò÷^ö[f³Õ V¶þyŠq¡¸ÿ24ñòq,Bˆzïn‘·ÉªŸOÿMöÄ–Ña½îWê[ÊÞ-^èY\WD9ø…@8fht)N k¸¹ ´ÞúÐÝ­áÔ¨q”ï¸Ëp·<+2²Ì½õ!ÝK¢ÛÖÁ+_—‘³qã“SöÀ|„Ú­‡ñÇxe‡_ù‹Ê°2,QB‡»á];ÍÃÏ-¦b|“¥!…ÍW–?Æ­Óˆ&î/ oQ86›žK¸Ž£9á[Wúü÷›¢ož Úxµ™¥™jÑy<\Ó&—ôAÖċÓEéÍ^šß])|I3#Jç•š Ý¼¨{¾É«û32²^ [͇”C<•øœ³È›°ž<A7ÛÀ¾ ÍÀÛ4Sшú„ß÷rÛ5íÐ RJȶ.è +R-a¿ÏHü1ôóUtj“g{!¼tS#Þ_YùŠÏÖÄÛ5x}çL&Ò|N­È +¨L)n“ÊU¾¯ü¿þ®ñùÛžÀ@—VÈ‹,9¹Ñ5­^õȳZ.¡×A:xpYÝ õ+\‡e”ÙøsµÒ$x%M§<É¢ñ{ú1Ï.ï?¢á+x9dFáQãÞ˜û¹íP_^àh£ç>âúb¤£Ü”þ®UëØNŠØ~‚Á·r® Ùª·ô•š·Æö‘T§´”ø „U¾§Ó•t·«|?>veÏVhÈÝ{¥+HFõ™Z‰nÙØo«–‰ü:—Ä3¼¬©z Õý0Of:ËVëQý)ï•‚l¯”Ìv—.¿m:aâ$ö®lJç2•ó² ))Ô\B¢îõ¯'ü'Ì¥Ï8e=IVÈž^¬ã»;„z&H™ÎL¤îæw(MI.óÖu@as›e:MÔcæ4gŒƒÏ +ÆyÇŒZ°E¢¶±óõÂÖë`„TN~úkVa|$^hªL,âææªÚtŒ„ÈÉ\uõµ­»…ŸQ'&]"ŠëzøÁsñkìN"%Œ‹-/™ÿxFøZ©é«·ÏX£’ÎåA>‰fÎÙžœé\©ÀÁ0Ñ·»…‰ûØMòKݼ©Ío‡¸˜âèR°šôr^‡÷¬5fvÅW +“ÿ4§¸8sÛºÄ8Ù ÎÜq×aesž‘Eí2ž§äÂû7uݨÔVéZÐ7ŸzVGÌk)|ö¤?`Smçk¨¿ÙlGæ_ѳb®“~¨`­xØäÑ*ÏvZºìê0æÔ"Æ)¹u:§Búm3Ǩx„Œndá=—3] Î]H+i& Žó×~0x•,Ž¥ZgN¹êz' –]Lâçë<=Ìâ8GM›%ûöIV¸nšÌ„»’=ÊÛ„ïâ°g)/jœxe®°ú|Ñ !82ù0@¦|°ð“ý°C ›çÈgÛœ{ì‰Ôþ5ãJ5ÞÚÒ„ÊÔ•nC® áEÌÓõ½^½ËšôÈiõ@Øãi.?ík‚ÖO6XҚ׬–«>-”=Ð;ýOç÷ÀÃj‰šýw4Yµý +De€dtãÍÎÓÎ*G Ï–RÍ8‰ÍwÙô6Ïs‰4ßU~òß‘½ c¸¿Àìû£fY~ñ@·¡iÁÒQÆÁúš’Jµ¿Ö)‘w~*ãÃ৊E“3m}¶¹Ù-.‹\{6wm€ÿ/ð¢³BcPNVhGÀ¬d \endstream +endobj +1963 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 2068 0 R +/FirstChar 12 +/LastChar 121 +/Widths 2069 0 R +/BaseFont /CGUDUX+CMSS10 +/FontDescriptor 1961 0 R +>> endobj +1961 0 obj << +/Ascent 694 +/CapHeight 694 +/Descent -194 +/FontName /CGUDUX+CMSS10 +/ItalicAngle 0 +/StemV 78 +/XHeight 444 +/FontBBox [-61 -250 999 759] +/Flags 4 +/CharSet (/fi/parenleft/parenright/period/B/D/E/I/L/M/O/P/R/S/T/U/V/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/r/s/t/u/w/y) +/FontFile 1962 0 R +>> endobj +2069 0 obj +[536 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 389 389 0 0 0 0 278 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 667 0 722 597 0 0 0 278 0 0 542 875 0 736 639 0 646 556 681 688 667 0 0 0 0 0 0 0 0 0 0 481 517 444 517 444 306 500 517 239 0 489 239 794 517 500 517 0 342 383 361 517 0 683 0 461 ] +endobj +2070 0 obj << +/Type /Encoding +/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] +>> endobj +1959 0 obj << +/Length1 808 +/Length2 1461 +/Length3 532 +/Length 2047 +/Filter /FlateDecode +>> +stream +xÚíR}‰B(dRìó¶ñá1´Ù “H(cÝb•% +!¾hqÉÐ0?ã‚$ Û݉°¨ñaYe‰÷:Ÿm½¤di}!¾éNBI6•0ÜCÕjÞlñŒÆ54Ã`©Fæˆë";„üL¯Œ¶§.†ALèÒ¬S_iyæ3ÊZVŸW+ÿŠ—›<ÐmÜ'¸¹fôÑ7S½Qw”®º ”½‘ÊvÎMì ß×ü¬[õ$û›W™ØÀ¼ +·ï`oZãÌ›MÈY¤»°^'àÔÔ×óÝzò§máOÔ³íRòÜ:²¿U!YJBž7cIÃQË2(i+Z®Û©VÕä;ã·š‡Ÿ‰éKªËùûLmçw.ñ÷~zTÙ´«ûó*o… /—D˜ÓŽ¶ç„º¤Øžñ8ÔØ<æ$1È‚ ¯VâƒüW½œ—ŽrUnï®1ÄYh‘us×v|“Ÿ™’o›)ìãJ/¹JÎìxm-ðK–Ú¼u‚êo}àÕš¶7+׉M‹4³<=7è9®Ð\f‘I¤wœ—Üu¤7I·k¥Îs*W,ܯ&§çùm¸ß$wí­MI×ÔØ&-çYÕî¤!ò»–vîp9¯Frèo4“ík¾¢˜Td[°ôû>}i›®Þþ zc˜_ë<µ»VºG}[Wv£¨zK×xifÛV1ÑN5fÉt‰VCíˆeæû¼ûÁwç^`>®³8PCïuzpïãò–0T¤¯nà)Þ@/Çp:õ jmÕSnÜ}²pîð…œ¡ “ÄÄñÜ Ý8_^GÒ-ÿ‘¾AMåk76HCûŸÇw'ë—w‡ý:ȉôÔÑ«’ÁОÐ]Õ7Ú̾¢H€G~“²€y¶—ÊÄØ-õÒ™–‡­;^¤m9qåʼnõeUâSNõÒ›6_Ÿdérõ6‚ÊA{òºŽNW¼y™Av¬g¨,]+©˜?å¿“W]0ÕºÜã'¹Ý Œ²o*ußJÔ NO¹užTö~ç]w ՞ъ¥ã1³ÌéÄ|¼`^8ĺû£îI•‚âækÆ®^:OÅ«%ì\–žF[ý¼hE±Kª3Ãد/U' +þyÊ:EËw´P'&E*ßM>8¹jíñ±Ž¡È+aÕâúë“ ³_ÎòŽ3H£z¥YÙŽ^÷TìJ´úåù]¹5ÃŽàž0?Ó¦7g§³úíË·R‹nZî†VÌm£e)šöB³ÛK•Œt˜ÎÏÃã&E±kKz_úž{Ql¸ÉÁø­Êòܪgé»’?ú7&tb(·{/Ã5;;ßm~èF­#9©Oô–áÃ1íºTss¹õ˜›ƒôzbïÚçº+‹|Öc[‚-ùîÌÙ¦‹]m}Æ·‡\•Êb½}8¸·8>ŸùºSF+)• Ç ÷5—% j™“ñ¬-ï«œFB¯Kc*uv++áY}¼ã—MÆ„ÄKÁº‡>Ì^S YñÖË+d(|S³x=Ôñ}"ÜŽpžj§z¶½š<‡5Ü·ûâ(Ó«>¾ôuîŒgEÒ¦P|‘ö¼ä˜‚’lüÕF\ÓÓÇ&Yþ?”ÆÆ9Q‡Îi +Xjo3ƒr1ƒ8ãÔQÓËËÞpÝT6£±"ÎÐsv*`"çþŒ)ù;y–Râš¼¼1»*oý‰ ¿<ú¾½•Zä§ÙQ™pxtúf‹ße|geOyuÎ@YõLUqt’1˜®,-/Æ`Rü'•‹Ñ"œ¾íØVY'#µÆ+_*>Â\Ù¯¼U!?BÍ:ÛóØ£ ® &·Mû|£’ÙµÔToµÞÓ3\Yra¿öåªå]F=Ûö©ŠxaÓ]ðê<õGÞüãÚ‡òé& ×U(ǪjMTÜê;߉“‹iåË]àFÅÉ€[K|ô¤¦9åóÑE[Òç­ÒŽ%ðöË4\̵Òs}¤«´Ê,V»Le“þÇû—ÀŸB€Å…˜BÂc +ñ¿Öý> endobj 1958 0 obj << +/Ascent 514 +/CapHeight 683 +/Descent 0 +/FontName /DJSYEA+CMCSC10 +/ItalicAngle 0 +/StemV 72 +/XHeight 431 +/FontBBox [14 -250 1077 750] +/Flags 4 +/CharSet (/N/e/o/t) +/FontFile 1959 0 R +>> endobj +2071 0 obj +[814 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 558 0 0 0 0 0 0 0 0 0 636 0 0 0 0 591 ] +endobj +2072 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/alpha/beta/gamma/delta/epsilon1/zeta/eta/theta/iota/kappa/lambda/mu/nu/xi/pi/rho/sigma/tau/upsilon/phi/chi/psi/omega/epsilon/theta1/pi1/rho1/sigma1/phi1/arrowlefttophalf/arrowleftbothalf/arrowrighttophalf/arrowrightbothalf/arrowhookleft/arrowhookright/triangleright/triangleleft/zerooldstyle/oneoldstyle/twooldstyle/threeoldstyle/fouroldstyle/fiveoldstyle/sixoldstyle/sevenoldstyle/eightoldstyle/nineoldstyle/period/comma/less/slash/greater/star/partialdiff/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/flat/natural/sharp/slurbelow/slurabove/lscript/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/dotlessi/dotlessj/weierstrass/vector/tie/psi 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/alpha/beta/gamma/delta/epsilon1/zeta/eta/theta/iota/kappa/lambda/mu/nu/xi/pi/rho/sigma/tau/upsilon/phi/chi/psi/tie 197/.notdef] >> endobj -1524 0 obj << +1550 0 obj << /Length1 777 /Length2 1024 /Length3 532 -/Length 1589 +/Length 1588 /Filter /FlateDecode >> stream -xÚíRiTWŽ¢9‚(ˆZ|1JH€°„¢²¡€ŠÄy!“™8™@@)"ØÒ"›[P P,Å`Ý -Š²ƒ(¸@i‹%‚PJ9V,R·X§ú³ýÕÓ™?s¿ï¾ûݹï³4 ³õ@ˆXèKà”-—Í寠 O.ЀÃaXZz‘P@¡î-  p]]@€ö€ãÌç9ò§HÀ‹&“hœ˜V^¬)’3ð@ -p$ ÄPBk#„(¤’ÙÀÃ@èÔ …2H&B„Íàr‚ -) ãPœa7eÊÀùe‘K_µ!)£M«i›,@›DK1ìÖô4H{ù7l½)î+Ç°µÉ”ü˨Þ"$(–ü…Hå$A@“º¾tçI`oÍñ§*ôÀã0l¹ŽlŽãË:*óE A)¡ˆ˜ N×!Ž¼éƒŽoÚ…·¯×ºõ6¯®vº"@q*·QÔ?9+Qu²v¹oBR~Q·æc~õ‡~ßì>ºxÇÃ6.p04ÉÏh2 ôV/-˜[ÄœwãøÊ«cÑ«†|Ï,ܱgCþç+Ví>{çZ}"ú¼Ì†|,&»ºå‹ÇX}ìâÜBb^³C¬ßŽä˸&L˜×ÕïŸCΪô™á­%ÊûD -"F&¬ÖìïËd¬j96¬¥^ã„L&¦Xòkš8cïc1f¨¤RWÕ,–ö¥G˜ à¢¢º~ù£¨9î‹Úû—Ä\X¿û«OfŽÖOÞ¸t)w¥0霵8+ùæÄìÉòŽàõMšCÌx±Ñ KÒ¦ÍÒ·6º1j¸¢¨"B·u¸SWeÞïû ÃèDsKmId¥Û’mI>êÚÈ9…é!óóê,Ê?j‹O±Ö.(wÈg™õÜJªc¶]wfÏlh[Äz~Cd«» æؼˆ”à²Håâ47 U|v1œ¹X¿á€j)M(ç(5Yü1W>ë3^KóÐp[„ˆ…¾NÙrÙ\>ð +ö÷är 8†¥¥ JàÞ +ò×ÕÕ È1`ï8Î|ž#Š¼i2‰Æ‰)`åÅš"9 $Q¡ÁJ %´†P€pBˆB*™ <0 „M0(ƒd"DØ . ¨±0ÅvS¦üqœ_•¹ôu+’2Ú°š¶É´I„À±d€@ÃnAOƒ´—ÃÖ›â¾r [%LÉ¿Šê-‚@‚bÉR‰TNA$ñ7©kà+wžöÖJ€¡B<ƒÀ–ëÈæ8¾ª£2_T‘P”ŠH€ÉàtâÈ›>èø¦]Ø­÷_ççdóúj§»¡§"’¥pþ¢Ocî_˜‰D ’Ãæp¸4‘~_E¿1ÍŠÇ{ž¤ ™A/x`3 8*hËvlœ è#€f $cê^ì]ÜÔªÑYÑ ÆÛ¿âéI(6ÛryÀÖžG+Ûs€3³åïÄOpt“ú{ÇÅÙÁÕ~º*”“$Ä©é¢czE(,„ +(dôÜ „nÛã‹O}Z™æSv­jK¶¤äÈvu}–ªÄ=ò“ÛüïÉÓÐì¡A–A¨®êËÿî÷û~DÑSÞjµï±á‹ÓÆ;n땸æ*ƒµ3%ŽCy–¿]•íðmíØgÓБqX¢Èfx•†o¾üM’Ñ#ëöÂ]ëwÆŸYÌžŸÛ( ƨ:^»Ô7!)¿¨[ó’1¿úã5¿mt]´íÑdžë8˜äg4éSº+—¼SÄœwýèŠï:Æ¢>ò=w¼pÛ®5ù_,[9¶óìÍ«õ‰è‹Rò‰˜ìê–,<{`å‘‹ï t›bý¶%_Æ5á¼®~ÿrv¥ÏLo-QÞgR°vdÂ*h_&ãÖiÃZê 'd21Å‚”_ÕÄ{‰1C%•:ªf±´w(=2ÀÕõKGÍu_ØÞ¿8æÂ’ø'>›5Z?yýҥܤsÖâ¬äï'æL–w„¬nÒ|É\¦º$m؈ íq«¢£†+Š*Öê´wê¨Ìû}dkn©ÝYé¶xK’º6rnazèü¼:‹òõmñ)Ö3 +ÊòYf=?$Õ1Û®9³g5´-d½¸.²ÕYó{lÞÚ”ÒHå¢47 U|~1‚¹H¯á€j<齌ëU=Ú‰/ëUGMXõZoê–„× R%xÞŒ‰±âZËÃ;È'Õ~a_‰î(kÀH¦EêÙ:¡Ymçh¯–ô  ÒÆÇV<ÈÈúå— 3Ì”¼oë£u7f +±êÁÇ>YS¡=¬iœ™p{ïÞÏuî^•Ý.ŽÚRµAW9#qaÈ3×:i¶[ƒc¼Þ»š=¶¥Ž{öÁ«H÷¹šÒÝW楧„4¥ª<µÍ[NŽäæè{×=Õfj)çm´êz˜å3øAqŒA‚úTêÚrïãÒ„rŽR“Åså3°>ãECWB4Ä33³bŠ¿Jmy™­Ú3èßÜ*5mt<©:ß—ï8N´5„™hìÍùC/Õ)rÔëÕ²[úØ=ÃÊò0›fNšy·×èГ¬eù†•ëÔ-6¡ÖêJ~‰ó˜¸iù¯Ì¥òô'~ƒÆÝž/·©3¾‹KšFgo=v¯´³&å²1«tÿû·OÖÅlxšQõ£gߨÌÜ™BüîU‰w½8;'ÂûÌðŽ3'íù]µ~súê­×Ü·v»4yH—Èæ>ÿ²f›$t/æucRÅÔ}jZé0¾ÉÃ÷»?%tºgŸàüÇñ¿ÀB@ˆAI™ÀønZÀendstream endobj -1525 0 obj << +1551 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1958 0 R +/Encoding 2072 0 R /FirstChar 62 /LastChar 62 -/Widths 1959 0 R -/BaseFont /DFCUVK+CMMIB10 -/FontDescriptor 1523 0 R +/Widths 2073 0 R +/BaseFont /ZIYGEL+CMMIB10 +/FontDescriptor 1549 0 R >> endobj -1523 0 obj << +1549 0 obj << /Ascent 694 /CapHeight 686 /Descent -194 -/FontName /DFCUVK+CMMIB10 +/FontName /ZIYGEL+CMMIB10 /ItalicAngle -14 /StemV 113 /XHeight 444 /FontBBox [-15 -250 1216 750] /Flags 4 /CharSet (/greater) -/FontFile 1524 0 R +/FontFile 1550 0 R >> endobj -1959 0 obj +2073 0 obj [894 ] endobj -1960 0 obj << -/Type /Encoding -/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] +1547 0 obj << +/Length1 1373 +/Length2 7756 +/Length3 532 +/Length 8610 +/Filter /FlateDecode +>> +stream +xÚí”U\\Ûòç!8ÁƒmÜwB‚îNC7[€à,¸»Üà®Á‚wÁ 0sÿ÷œÌ½3Oó™Þý°¿µjUýªV­MG¥¬Æ&†š@¤¡vÎlœ@N!€„‚¸6'€ÈÁ!ŽNG'á9[Bí$AÎ!§  @b{ý…xy„8øÐéP{GKs g£Óo'~€˜-ÄÑÒdP9[@la1LA65¨©%ÄÙ³±¨þÞáP…8A]!` :''liê 0˜[Ú¡³ÿÖ$kgðÿË v±ÿ÷’+ÄÑ & +Àø—L&L$jgãCÌÐÙ¡°l˜–ÿ²þ3¸´‹"Èöwø¿:õ_ë [Kÿñ€ÚÚ»8C +P0ÄÑî?]µ ÿ'µù¯4²Î KS1;s€ã_&K'iKwXÙÒÙÔ`²q‚üe‡ØÿS¬q `×WPQfùŸ3ýkQdiç¬îaÿwØßÞ1ç? 뎣¥;@Ö^N˜#ìù÷›Á$“²3…‚-íÌ\¼|£#È6=0â¼çXÚ!îˆ;L1;Ðê Û€µÄ`uDÿ} Üv­=ìV!¨M,ËgÐ6¼»<ÔìOFp·¦ÈN$¡óÎÏ1—ŽI_û{7¯Õñ³ òöofî–g5”Ô+°&íÚÖ]gù%-áîÖ|¥O³ÙRGq·)¹2TF*2ÒòYx5 y;×ñ8BÌVµ™’tžEmGB +°|â‡?¦Öì&òËÇbŸTå*MªTú°Z&£ëÆ4¦7-¯öøYu‘¿o¼^}7<íØïeÓ)ÑÝj2÷®<ɉ ÿˆòX}GZjáYa»¼Åå è‘~'»“ÃøÁˆDÛæ+v¶£8þF­7 ýÈ2Õ¥‰˜•ào[{%Áä‹ ÅH¤r0+ +"ÚÆF†¬V‰ìŒ®)5¨¤`cO9£Q¹½²p[ƒ Z«±Ìëò,4C|ÙŽõ³ïU.gDN0z­"cKÿÛ2™Ä6@hh-Î -(ÞuݎпøÜ$c߃V/** ¡™Z9%]#ÏGQç3s&_OVnWZõå…„¨âé€áëdŽCTCh½Y¹®`$Û9#2óDÖ°¦¦ :A€—\Êÿ›§‰S m„äð éOEþ: +“–, +”„½cG…q½X’׈8¸ÄmjZzç œ»×<º_„ ø<‡ÞH /`M]iÒW+rO,ÙÕøôJÞ™ ôºüœžˆ‘Ú Ëã^bZÏ< ÞîMÒêI¿‚dŸ±ÒŸ0Ḹ&~9ã”\8Дõ³ª•È~)¢)«JAútŽÎ;fíƒ]¤2¾E ŠSøb%-‡“SýŽûî1ÈÑoCÚ§ ±EYŽÄÔ±ÃÉܨ.­ó¸¾ËSõ¨¨³(¤í Ÿcè¼<^7׉"p§¨O°ÜœœSˆº[ÿy¼aâáfÕBÀC!¾Ãg÷ÌÏÞ¿º^%.›ˆ{k¾úäH$šjÄ\sÅ*î£÷ ‹LQceø㶠+™Š§è M“*][¦k+ØoÑto s!%–¢o ê[—ž'ùîŒI©³Lk­|h’LúBEáKe1vI£ÝÇø¥¡ÝXBp“Í ±B8\w5”ù¼_*ÙZ˜wþéì£@(A©8©WÕ“^Ñ×çf5ô1Ït'!Yù¹ü¥á2wÕÔ±be+ø&^bûãm•ëN–=‘NwGÞªD}ßw—*8½óX + £sÎ1÷¾£‡ÍÏ31?¯º^äÚ¶dñÚ[}Vñ$·Ö}Šâ~Ÿ1z©öBmJ‚Â4×°‚sâ».nbÕPV³=]ÙÕðK”×3›d[ïQ”O'1d”QV.‡z…5g'3I ½ÂÄ1’¾‰ø×à+}(0­;dN­ Ÿãfó±Ÿ> ÖÅ®,ö‹Ç}6$­èL¬`->„_Ýy9 [¬y÷šÅ®1½ä릘> gØdïê^¿ß"¼£ ŸHHóÃÕ:Uì§|—˜Î|ÒÿL!Fâð`p×qγ·ð'Ç`éŘ„t†çj†ñÚ–èÔ©BÏvŒC6;òå³Î(ù¶ƒ,áÎÎr%K­çÉrÒ&o˱Ñ}`üë.ùOã;'ŠÃ[¦··®ÒØ;WËEÒúoïÌ,ͬ€/•ƒõâ¹?–¾ﱞmw.¦d h¿S5!ÏN—D²DÚå YÚñP¼—wl4<“kÙ½•ùÄÙ k\™Â#êS3Þw‘¬_^&ù‹]Ç7røÛ:£ÜáOI{¹a%VßÿâHЫ"ÝZçV5µÞç!ïIŽZâ¸T‘r3q†H~%™+1JÜÛg¢nHþNæ2¸‹©‘¶±on+Ùýcé×E+àñ }Ìgu¨²™¶G-N>UQQ¨ŽXõ'IÒ•!4x+9½¦Ýw±ás«,‰Ø´buñ5ʲZí#ϱהŠÏ D8æÕo꬟f´93!-Ž¦²©”1ùÜsi²}Nµã"Ì©ÆΌהó íO¥Ô?X¦(W±ôrPú#dožwQp¡¾¼ÅT¹l$^ÄéWvEŠ+[¼©œK´7 +ž¹µjÀFL6½à-¯ÙPvt¾XN]ìi¹¾CwY+÷Æo`ô~é€ìjÆw)þ.²†=²$Ý^ÈÕ¥?í9+qëüUÛìRƒCßW­&Žôd›nËÐei¦3øÓs¬I±±/þ–YÛ”¸¤ŒËL n³žÙx7”ÌŸ‚r· +{,&L}TîÕì »äͪšÙÔ›SnÝ—/Ô1ˆ +˜Ë‰–‚¾;| ,o+T$*žõc¹t¾gW@D–ß»ðö“ŸŸ—‰h×ã¾Úpd]îý’G!ï¥^ß]ÙÝ­M3(Ä=‚eC‰ö‹ä›í‹­Üû3=0ÎåȬ©„]¹±¡]éL¶bb‚¾Y …9<–§å¼nO…*ïö5Š.­ó”oM$Ÿê¿ŽQgjù |Í•ÌöK+†«mkÿ’½öd2t­¥Ò–ꀓèF !µ£¬lå$š§|õ¾¿±ç mKÖìšµ¥U»"ÂIíݺD¬‘GËó W™u‡ÏKÃO¥ÏÏÒ´ulñ-ò%‹ ºDÜ·þWÝ<”v³ô5·Â(yJœ!›>Zo^… ôŠìWù~­ó¯ê£TÛDÜKRò¹Lˆ/Õ¨ï¢"Øʯ¼»Ñ’:¿Ü|Ù¨îÃ`Gt_ôaÉÎï;âÙ˜RWîÖñ2 š.o§òþâûƒïu_ÌϦGáµßzOK¤\4v(PúxÜ„Pî2ª)"r t“O¢Upvˆ²@*N%yÇ[ãêœ]¨\ïÂçøá_£ÞÍÇUOõ-˜ÏG·þ\´ ªñ“¯í)êzFP\µ«ùŒcfŠ!Ì×~=ž¡ÿu¯[d…‚—ï¶}¦d-SÒ(¦õ»³†½|]7¤¬àÏt¥ëˆ½ѧѸ’æÜrb$x~·g¸Jjw;ªC¯ÖyªøƒLü¨ïŽãÂh0̸ǸZ¯j´Iq¦CI+.ú÷Ù¦zÅnNŒ[š{,lPß ÝF¢kéûúÄHyô÷Dß1Êy˜K•B#RÐûÔ?¾¿™Oôìœ1AK2Ç—ÜnÍ)qóP²·G†b|îR@V+ùY€î.U45Þ(rˆù͉¼ð]¼©…’UX\’ÀÐnw¤žÖ+´Lkteö’Ù%2íòÑ\Úðm4axBÊ}wÁÞ©Üãê˜ýöU_ÊÅIbGvC˜ƒ}Æ&Ɉwî)\ñp£×¯|~‹êXÃkN'Íž’КvÅBÇs>¨]Œ‰×š û¶Y„ºû€@›\ 1tù¢ˆ€#íÐal Ýýúž ½c)äIR†™>4K¸Ñ°=ù +Á]eÐ_àugõõˆóµÄõSb~œ3"hÂBÁÔFÐN=ù ›˜úãd‘•Ž|óƒ,•Ý„.£M—ä»ù¥øç\Ã3ÊÈOÓ!9Ò> ‰¯ô¿ +PtbU(G‡¤ó‡bM•Ä¡™FpI.PR*ãöu Öš¹ªuI±+Ï‘qw>T2E®o‡¶’è‹U zÇŽ«ƒI{Ãd7¬líŠ1B åøi¢dÀÛ¨‘jS ¦}KNÛÐP]‡úyXž§\³Œ4ïB\Œ™¼ÄÄ Èž¬‘÷c|ˆÂ¢Šè;±“S„±@Â׊t“æ§à;f¹öÄOWíúÅÑÜìö“<9¹cÄ +{ »YË:‘p±>±ú®Ò}kHG ¦)MErmÓM6þ¾ýALcPéÎ'‘F’›JVä6¤d‰I‚Þ’ÜðåÚ¨çã(K“›Ã¤rÎ_í ™¸/еÅ{Üu””ß-âͺO Î9 R‘}­¹58ø#¡Weüe^ëê'[ù_Px€y6/·íši^%5y?E…óÖ‡Wèó˜ÂÔëÂiK¦œ‘%9«uãD äUB=æ–U©ñÝÆpž£É±)©gÏrƒI™ªøŸþZbuC7㮳¦«Í“¶h +I6Ì4s¯«Ìóg¢ CZ3æl) ¼¬ÞWš‹+Ùã:£ÊÉìà8²Ú0øù¶¦Ÿ4š•*2?eçW¾ržVÉ=tJŃ›(F(ué Ë›ºþÐõFós]dOMî¦3`!“´™šãEµ™Îªvœ;®/HƲ¾«A)òFÅYñ]¢ÚºW'žÞ <ƒ³½Þ>Œ)Ô _¢'T&Ëæ©T2GÆ)ýxyž(µu—Ñ4‚`Ýy™à¼ÁÁˆ+˜ä#Ef®¢Wü}h£á¿y5´O6ç{È'¾˜V"Z¨ÖÃαá%S˜CŽ·rp=˜€$>‚EÔ\dTt-ø…·›“¤ëQܽqìÜ‹­pðm˜ùœÒæaÔ@‰½hÙˆ,ÕäÓiÞùZDƒ¹â¦8¿KÄXëRo¢bôõ» àÀZžØþ78ż+\\ãzº>R£CJÐF©ú'eÊ…Åí ©B^ƒщZh‚Þ”4߈ú™°.¾­É­fÊú[‚Ç¢Isú¦¾f·°ØÄ+>Ü´øùí1Crˆ"Ãfùï[ÖœÂGݹ߼xŸM}.ê +Ü£“_ëA_Þw—ÀÁèÝÓá”{Ùà+F”wº¨¸KæJÈ»Ÿ|*h9{/ð‘з3(/ +‡àyÚ§©¤$¦WåÜmUò \d‹Ç¥à\÷Ö$¥«/.þ‘ÔF]8Ϥ¿Ó±M^<Ë.¬åŸÜœ±eŠ¶˜&2ÎÓJ„ðv8Éœ$úbU Šÿ´MÄíÛÔÔ=§%¥òÛu@4R».Û ¿ŽCpkIˆîbQh ù*™tŠl{ÜÐiÉ3ÎSP8hêªJ“õn÷® #å@©ÎSlÜ “E\êàµ>Qeóê5aæ…4îóîWÇû72V_kSÞëE‹±p9¾ÌrJi WËÆÚ\4~ü%(Q éØþX°µkÌÉ~ Žç^Ó'Ù½1»¼Ujγfú„ïGó›Ññš +ïŠå÷*;È¿ò²êé–ô(=I™ÝåËÇçoH“'Òñ÷Æ0/@ÞYÄNBLŽ˜£˜dzjãôq©EÁÈ-¥Ôx€Ä–®Ñ(Í©ÿhÀ”Vo¾7¦Œ°¼ZÅ ¿‡‰âü…ïI ‡DL7ë°`‰À6k$%6á­:kmqœµÌeHÆ°Ùœ—žÖæÕ6ÇP:['lHÎv£=v‹ÞßÕDœNô|É ù¶/Y¤xÀP~Ï];+Ç\§²°Wðº- &O*égÌ»r]|SD+<waŸ‰‚È?ËÈ4{{= +¶ÚfYUÖØcÔ©ƒñ}ŸÀÂ\¢Ù>“s,+­›Ùgá´’Uj½—&á/@Ë¥(ÇÍö'¨?ùe¬nOñšB–«m4E—Kû Ý1|ïK¨­ë¿ú kÊò[± +E*]pèêõdzóH %ºÝ8—•”&â¬=³Q +7M7Ý0Fl–µ䯥ÎI£¿Çí"NÚ0(Uc3ûj¯Gðç[ßL:)ÓÀÝàßમõ` ®c:l™Œ‹Ðˆ‰nÞDö^ÍšdRJ˜ã÷ ¯Ö‹¨¤+#þdý1~bï bµøyË÷øk€Š-âü-©à%ß2-üª|¯¶jgM1Ð+ªs1—§yËðó&. +ÅÕ™•gÛš.^úYÐ'W4‡0·÷KšMÇv|˜ðH‡æ˜Ývf•‡ö;žÿÖˆ“ÚH¶ýÚ ›ég”ŠT èèh†áúzׯkwænSàH0tˆµ¿_(t䣃±ÉÇ}䧅 à÷dŒß²h„(ü>¢(#-"oú±q)Yìà.Ø ¤¤¼ïçŒ3 XbßÕÆž£ê-ö=d«Ü줺¾._®H.ÿÑÌý¬|ßAê"LÊL“6Öó©ãF]Í«7× ¤‚2ç™ö<)V<ý"x2“~æ-º/¡Mb¼¼eÆL,ùd72&èUȨѪjG*=îñºNÜ°g6ò¦eµïå/õÞÐFèÔ±Ú&ïò +ØñÞ;´ +Íut*ëæÓ’|»9ú@ÃñøCÿÿþŸ`j9:CmAŽÖèÿ 07?endstream +endobj +1548 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 2068 0 R +/FirstChar 38 +/LastChar 121 +/Widths 2074 0 R +/BaseFont /BZBMQP+CMBX10 +/FontDescriptor 1546 0 R >> endobj -1073 0 obj << +1546 0 obj << +/Ascent 694 +/CapHeight 686 +/Descent -194 +/FontName /BZBMQP+CMBX10 +/ItalicAngle 0 +/StemV 114 +/XHeight 444 +/FontBBox [-301 -250 1164 946] +/Flags 4 +/CharSet (/ampersand/hyphen/period/slash/zero/one/two/three/five/six/seven/eight/semicolon/equal/D/I/P/a/b/c/d/e/f/h/i/j/k/l/m/n/o/p/r/s/t/u/v/w/y) +/FontFile 1547 0 R +>> endobj +2074 0 obj +[894 0 0 0 0 0 0 383 319 575 575 575 575 575 0 575 575 575 575 0 0 319 0 894 0 0 0 0 0 0 882 0 0 0 0 436 0 0 0 0 0 0 786 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 559 639 511 639 527 351 0 639 319 351 607 319 958 639 575 639 0 474 454 447 639 607 831 0 607 ] +endobj +1074 0 obj << /Length1 1348 /Length2 8057 /Length3 532 @@ -7750,63 +8468,64 @@ endobj /Filter /FlateDecode >> stream -xÚí”e\[ݶîq V¬@ -”-ŠSÜJ¡¸»ÁÝŠµ„âR\Jq-îîmñRÜíä}÷Ù›}öùxï§û»Y_òcÌù ¸13±¾7[í{˜™ØÕ f0Ü(nk Týk…P솹€ÍÙœœ@sˆh -¶„Ø8þr$goòý#lîìðÏ” æ„4|4ÉDZ4‡ÚÛºÍÁE(R ŒtòÃÔn.ãlk«hb÷×öwéåMì ¶îÿ]µsp†ƒaÀ÷Ps0Ìþ?KµÀÿ0÷lq¶ûϬÜÄb&noi ¾`çæýGâ$q›+CàfV@ ['ðßq°½ùA6ïoïdåÄ¥dØþûTÿN*›@ìáêî` è¡úoæ|`d`7 ˆâD"Ÿþ3ø1i{3¨9Ä9<¼@ÌÄ€œ$ñ=9{s°ì†tÌÁn…#—‘ñZ@a€¿õ5/Ãjkkû+þÃÑŠìÞßMúgÙd jþârx€aЇr)Ôü/æ9à®yN$[ÁÀÿVÁä°€:?¨ó¼F .ÿVÁ äpB6ã_̃d° Øþ!‚tþ^y‘5â„ÌK<Cò¯ õ@HÿÒÿ">¤{™Bz—} ¤ï·„4-÷@H=…Bê½ ¤žâ!õ”þEüH=åB*¨>RAí=Q äÛj<R]óêZ„T×~ ¤ºÎ¿ˆ9_mçD,‡ý¿!2 ý7üëþ ‘¢ÿhÿÿ¾ -P7ÏW¼\ÀW\Èyàääz äãyÿÏB {ˆ£3XN -92 ŸÿßQ3g lÿû „¼fÿd òb‚Án`3ÀÜ4ÔL(ÈúSMH¡tÎh&‹ "?h°%¸ -!ľ»,D2 «Q?="&¶†?ú¸'_ÊanÁ³JU#îÕã©Æ…¾Á±¸Y¬ 8?ÛÐÍi'²ÔOâ2.b&0ÍM¢K_~*L·ýniɳ;d¥['3×Yõ䆃†ñ¨ù„ÖÔý…âJÍ'—~ò¦nn/ÛÕò/D-"<"¬?ÕGB«µ]­Ÿõ¸ôdVë¯]Šï·ÏõwÀ[Å<,éý‚ ]H‰*yßmH65GÖÿìr>üÖXÅrS'©c³¼Ï -×¢d{º<"uôë×Ο«ì}vÑb;J+YÙï ÝS¯v6W=½ýt H™X§b=5p¡ôãtooÃW>Å3Õ1|"‘ÍGR°¾è -ÖòWÒùxçXd²?žþìheXhû¦'1¤ú©¥Å¦OÉ+­{ãi·’%LónK~âWõǯã^¹ëEé´~~óÕœØÄ.¼Ä‚3 -y¾&1–š}5» -üÔ|/ÅÅ|·â]éÝa~Mc(ii’¢VÞ#ž½bè⥧fÓóØ#€ÏÕ¬•õ~#Å›À?¥zÌñ!BÙá˜%°Î÷S±b˜p(  àFëmg°×·µwJÝ&©Ž.f&Ê ºœ¯ ×î_íyÉV—ŽDË¢œzU%ü|Ú©Ä'LJe–)ër.·4SŸãR—°•ßÿaÞ²éOØÇTûý‰/Ëþ“ìšàK7•ìMÜë©:7åwR±šy «°ñë®èts«µâàèU±Ÿœ=%¤Ó]Þl5Ü-ÛÐÌ5¢ 6âüðsÖ×ÂÓKÔí\Ì»Xëxb rü·<)VÉCåÄ”¿lî#QNKšXÛM‹Ã£$êÙqð-Ç¿¡,eeÛ,¾³FQÆ¢¼êoœ•Ê#_»ª´[Üÿñˆ©±Õú2!jpåê±­9}ÕÛ§ýïäsw³S·Ÿ œšÂåÒ<ŒéL;g@åÏجS½vÍEàüýˆ‰¬g“™h*­Jjõ@~G»dö«ñËqUa@û¥}¾ë´¤·dÉ}ØÅ—±ðg¸ýQ./OÆY<Òjgš»OÖóÍ«2(‹ô’ù+:¿02æ>Ù{ý›â|<°D ­Ø… -?¸ÇjVUӌ漀J PŽº¸ mGÞ~·¹BÇAeÍV—¢þIµé4G:-ƒúGÌ¢éq×hþ«ä~÷<¡ˆ.)yƆûMGW¦Eì‹Ï¥[ºFŸ£¿ˆ B•Š|ØxäzÉÞñ¤·Ïd5Ÿ !Õ£Œß†—Ž;¯rµyç¦"Z(YÕWõÑI"_±èqS3ä#s4ðYkç37é°’³2ÈÐWQ$ç§Ö¸'´V1ªËñídŽ¸?Õ;kºm²ð‹ÐÅbññ¥Ûq3î¸á£Wa¶j¸œoLð1ÃM:ÃDI -ìæl—i Wž¶FT$~€Lß™ýìmAðrVݘÿ& 3íŒÌÔf§¾Ô¸!MBœpÄ©,?B^3±øQ¯º.Fè„`öíPâ=Š—ˆªÏµEÎé>§T“^IRZãR]ˆ¿rGnÖÒ_‹«Êeæ’P€6­c»Ë8Õy&˜›I(ß —91êæ꘲[Ú8'°?ÊÛ)–q–ìCw0â=ºŠÔ÷Þ± šŒœ’œ`ZÁ•z L@¡Ø^7vj¸Úi†H¶ã)ØJ¿Îˆ„ã<±°v9â‚îd )©WÜéB•~Ö©yç(³Ž¢–5ŧì"’¢ØS­·è«\g_7‹1¿ªŸ’¯ïG²ÅPáÙ§GØ.ÊÙyýP¾B?YW”Ä«Õ ¥’SS£Ò>¡ÓÕ×ëXO€}”¤ÎUÅŠUÜë÷Ih]³ÉD©ŠS h'zÄPŠ¾H&þ2$ ý:}Z¿æ/„´÷ÆõªVÑüÑv¼ùIAWXSc]Ê›Cc›"8ù¶—¤ç˜’Qºï!5DànbÅ°î•ÄÚ³ FB”?7ÿÝñå3Ѹ¦D+ÎBmŽ*½V5>\ÿ²5r2|“=l‘æ7tWVÇz"h#WÁbå„+p‰cgäMNƒx&Êvþý°a)έb×ÓæJÛ9œC½>‚µZ‹³6‹]_ÙŽ¥Ù ƒ“Q -%={u„¢l{ð¹ïxeƒÄ¶Ú§Î'ÉÐÂ'í–°‹4Xa?¦2o(Ýž*×%ÛktÚµ½"Ñ<»˜4'iri]^€‹ÓŠ¢àa÷èe­*ìeùÛêum¿ç¹ ÷ŸZöu”Ëw§×'mõ÷·¥~² >£±s&dòV§SMVzúv+ºèµÈ«Ù6Y{R·òPü§¡XpåÎÂE/U@;MÙÐÙ½õâ4‡M&É,¥)x“u]:¦É–¢.æ«^.Ó곃À3í}zýx쌾5…±t êAŸÕ| ž2%«oî$÷ïñíŠV²¥lPº.%ÜŠÔÏÚg3ëRìõ0šNtîHUÓÏÁÓ$ñiúg«=„sÀ'yêƒ_~¦ïT‘g Z™1UñåšóúNâNrzöMcÞ1|¼pj Ìf6Q†‚¢¹Ô® -nç9š#[è(dG{)KOß©%²n;0J[ôÖO&¥j96Ìo'¢Ïüºéß9¾½Âà|…¶Ó»PzÞ(Öl\ôKÛ»;ž}>Ÿ¹L¶¿ÛùñtzèÆøWñŠ5è)^Ã+º¸GÏ$ÖÁvÑûZ]j|ìE„σ½Ë^ž M}ßê)…ïK4ŠÑöbôîdÞ7P ¸è®Ð‘0Ò(uÚŽN‰´¥c¶E‹ ¥ÂBwÜ=ZTX('`ýÓÌcmõ -¹ÊÐÅÚÆÚlÿ¹ÍjÃÁyk–Mbƒs%&É%ª•«†D‰’‰ûÅ}Ì”áø&Õ«áñ:|ÃYàó]ÌötF—á…jáj`Œ9IÊKŽmF:Mx8M„ý4%Fz37öeÎïŽqp6¯«R2Ðá4«µNJ1²ÌµÔ"`1|¼½ÐJìÊ’ ó²ÃŒÃiüf¾:Ô>À•u,yüäL¯ûâóû&ýJ4‘¶Žˆ -RÙ×öwƒ§#Ͻ±Ö™S—Ïë…ßZe¤î¢i‚/Cuª4qÕ'sh5ù‰ ¨8ËöS“g¹µ9vH¸—7Ù^¢N´=%nÍ0ñ¥l¢;åC$÷  Ðý$¦ú}­­0†á™cRw€"¼uêþ[å`‰Úˆñ‰…©‹‹‡³§.v(^aíûN"ï_”C˜ `Ÿ´>×íš×$çs˜ï¸ò¾noàûÑrg¼Ýڂ܈aCâN»µÜ›u5C5<ÞcøμÏ@ˆï˜µnÖÞá[;lvPUºß1h-p2~ ®z2¯¾ŸÓca78î)&uµ ºŒ‘v9ÞÅåƒÇ&Çá‡ï éÄjæ'kV2ÙæSä¥Y½DJE*uÕ0<Ïã÷iÝ78{²åN1¥¾ÝûðFØx“A_JEÏ‹#T˜7Gc¼‚šñË`1»)þT’ÿX.M6¸˜Çx6÷ê³\…/€¤jHéãÜTt»àr[~Q”ƒ¬¯´È…%[âÑŸ-_O!«+ ï§Ç“ET}[½‚žÒñþ:b˜´3®q!Ùìƒs}Í,IÄ@{/3j’Än& •\ôË{™-o^QýÃå¶=™Ÿ"}fê—÷}áº_íßâ;žàñévôeàbƒ§µHG¢¦úzç‡~ ŠÏÛó(.ÉUÞÛ”© ®ÐP«–jânª™§Wp’í3åìÏÜ[n*÷9;¾&øøUhšŸäG诶ϫc<¾ÂXij6™rµþ«¾#ú„‹3Õ=QK—ÌÁ¸ö±Òj4@Ô÷¦·Ãx6UxƼôÀþˆÝGôküDM`üÃðI1TYhKˆLk¿NTŠBÚ—úÏÙA°³¯õ2ï‹í¤i•W*!¶¾õùtg»"Šß¾Ë6ԉͩá)¸[k¥˜,ÙDéƒêÒi]]4ðpòahú ± Ô)†@¾ŠYç—šs/è´ª¢ÒXŸߣ‡L™œ™Á>8#mGÀŸ0WuTfY§•.CÏ8Þɪr%‹X‡Ðl.™CïÑià×xbî І‡tÐûu1ÙIØŸÀ}½µL@ 7å˜á¶#vž§4»diëW‡^3¶3»lO¯æ;„3,:_El':{² w‡N‹þÛó}~U†C$Ó¤ -¥SÝ\lYbŒ ®ó¯9‚¾{:25Å÷óÄ ž (¤Ø;†În N©EÝÕ+øë‘Êã¡JÜn_ /æ€Ì·üIh¶òÙ-Þá®Ï7´ùd¡7š­¥ýõ ‹E¶v¨äâ`ݪM{­£«¡TÐ ºš%[X 8Œ¹$F‘ÊmX[ÏE½JŠ:ÔTÝ Ò—9%ç3=«§B¯þϯÌ9*íª2ïëZ=´©†›%š¨Pì'>†6Ê\„Ú¾YÓ‹n žãb_|0d^§Í :Õbc¡Yõç;§.Ù%ÀîWrŠL›.Dï³ §Ô¶}³bgµøKõùìEwïÒ„iÒêÛTB_žCq"îï‘xb™øÅyÍD"œ°%-®O=ÞŒ”¬\–dFg¦¬WÙB °}•:V©ÈÚï±V°—˺Ä.Ë_"ä‚ýdðÅö¿é·Ò„Aôûàþ³×»qJìþÒ¡×?C2xøv;Zz_Þ¡g˜ê²E‰ãÕ|¥î4™¯kÇø~?ñ§tòégF7¾½i’oá¶#­Ö öa¼ßwÀD'úK"®õ_2TÄ©Y ª%›Ÿ¼Ÿ0¯½ûaÿ¶Œ.|}Ä’BÖ“ËÇî¡Rzùã~c¶ à*à•ÃÌÙ°pfÌŠËàËòµŠ—va>ëðVN¡lß<,¥è8‚Dùö~Lv•[ùÀµ‰1·›/)Þê/ñ™+üž&9ävx<’Hb_QêÁtFë\v9è}Õˆ|÷‡ØfòÅäîU°O§³|ž>Ç8Æ÷=Zl¹8?A{¦)¡µ‘Qÿ:ƒL þûæþÙäˆI—Ê™œ“ªÍÔüðc<……¾YÇ3¨`æã‹p\ðgôª 1! '•¥e;°‹­Š[Â'šMx%#¼üìXd‘ckµôè…#z¹‘“YÄ¥*uFH[â éçÞéâgJæB¬AX¤Ô{]ž™.pw²¼ö<¿s°I^‹„íÛh|ª=l[ήNÊPÅÒÉçÛÌ"ÔÛ\)^gê më# `#¦BB™¬iv®)ž/ݹ‰¸픯`4ˆ98O8ùQ'°Z•&5¢õ]P‘Fö>â|j} %¶óp&R^ˆ¯X“+`5 '`Î?âÄÚ›Ú(f[5Œ!Ê£g¾à\°QB#®ƒeC®ò[O'ñ6[Ç繃‡A }¶ŸåHÅ%±d3çÑUç RZ ü5”Œ~é·r?Íy¤ôHУÚÃXÅ›ýd¢\ã;½ø±¥Y× çž²Kè€i,|è’2{2'u΢4Õ)Æ÷î×ß÷jf¤gtÑŸ|è)ý™•Ô}1¸db_–õjÔçë{Q_’}Ž•l£%°–‘—ëx-“”ã]Æ…ŸäocÌ“’j¦¼1ñFðTÍq.84}íF„„f”ÿ"UŠGÍ*ª³Pz’Êß0W11ÔÞÛÕÅkŸï‘‚ž/[§>¢'‘ÁïŽn:Lö*/ò³‹`g!å\þ¾Õ¡X€Q¹mQQnhûóÒ‹‘uo¿è…h9Q3к¨ ‹u^4M8•Ñ³j+|‡ö×€~¹¡Œ¿N¢6¸z¯Æ!Ý­RÒ0‹ÊçX<%ædN›fGÿ×ô™JÇñÛ¤Ùº~K}cv¸Ý±ø»˜¯+ƒÐ$BŸeI}¥éþ1I›„Ë,¾ý[§õö4ž4 ãC»€Bú5Mö[ñÜrré(F‘(z(@æºàÛ{ù -I³Ò¬x=Y3ÍFF[¦¶ ')ÔN†ïÏ€™áaO ^-)íålÁ«°¥ÛÌ)$WÆ|ש°ßôâ pñZK1‰¤ÿÑæØÛ’´²(è2°j¢ÞîoÔL6™ï3ŽMn,™fŠ±[Ë~êW¹ WPÇ„\H6$]§ú“‚;EÕ^¡?5±EtñÜ,V´½<غ ¥+©´ 7œÍœ¡“r¥ae¶ƒ ‡Ÿc÷jPa¶Qý$ÑôQÝi -®Õiܱ*¶ŽÝ.‰ÞJ)¡býN$õ=¶Or—ÐâýA÷–¾sµ9 ï˜<÷H4p -Á¹íÍ3ø(å›Òp¾+yKžãè'-žÆôœ¶Iÿ»ìc@qÒñ³PFòõBá]©ý”™Gž!~ºùÚö¥ÁQaDwÚ íS^ù6nQÑRÉ+‹Ú1ÅÌ#ÃÕKºNYò‡ˆ‚0áX)Eâ`¡iTŒZB?äÃý¶s7Ǫ͛‘ØÒæ¬ÒêÇÛè îk¸÷l(‘žIã¹C9¥|ËäŸé”¶†­Iz» I»‹s|4„5ï;¿²å„C.quê·ÔTŽö6Y›±;q4µÚ,€wÞý_ì5$“»?Êïë®ô4vúa‰â&sÙqöteÿžë¥›ŸÒ+â¼t¤Ð-§Ø WÑ€PUó—Vì0p¯ÌzQ*}ÍÛTð¥r9… ‰= ®¢úšsó\¶ÐÇ`³=QX¸[Ž™ßö…£€Pg%„n®’"* ±2ÆäÀšB:›áÂö=ŽkîµTN9Ás5·¨>â0¶k­ñb÷ Ú KÃ_Ž§¯#!GV«5±ËÚäÒ·!ûØøuVµ4wš,ó›Ý€G—ò;—ùØS¥1ÑUÀVÿNûi%‡røR­™LÚËÈŠ{Š -‹-M:imªs;( -a¸}-b<æMŠ -ÿY+šAÉlÁz`Íš|Ñpý»áË4sô:|è×r);ú. -C•ÇÚøþŽ¹Ÿ½*8—⪲²8±‹p\zM,]p ²!ÁOj"dµòd>܇͒Ê´M¹Ì/û© Aú†1(Ì=ÇF2_2Ši_z‹Üúç Ã_Åuáßr»M}²Éëä¢Dü|iÒßRzÞ´7¤[»UÔ'Þ|©Á*\t诳i—¸E~‚Ÿí}C™°ïŽˆéòRÀK“lêOªMð~ ý$~™ÈeAG·¸˜_kü¾™´_tµ;¦d ¦íwýÂ@ÛcXRF•î¸—N€ó;ôZ![aÈJØ+·:¼sïDŒ¼*O ±ÞٽȻ¸äí öÎt ã1iÐ ïFÜ]¤>koIÜ0Ë:Æ+Ôϸßjž2bt×Ö>ïî -µ6i•*0œ_ÖsïyB„*(#FåY ×z¬ùüC÷å…Ê+ -rfPž“L_Ê"^éÚݧãæ7zr -”MEï;2çZ<ËR7ú+ôUM'ådÐ¥ì1š2%l † -w”ròu²ÕW,¥NHiżÐHþ“•~s:…Cå´½HïÙñ:аòn5mhœÙì¬C’w] %»#ªúÄÿvï,– +@Öî÷Ké²ñ°Ê7JχÓèxo#jåt÷W¾vQb¥¤Q~;7¤C?ÙsCWª]Á±ç!ãtVkgÆŠ¼Ð“‘ÂÜŸ™¼¦±™²äŽdt8£tAåÇìÈ/ù‹/¶é2.\E7…ä˜}j­Û¢•ÔWq »6[bý|/˜ƼʨS­ƒ®&â©2„ “ä^º·…Tù*¦‘KùÛÈ ùû©3&9šµw0½D}ºwìϬŸì/²IôÃC4~Ÿ­tiߣòaÐU)P«*”ž.('3øæSÍYò(ú¹@ šEîäÛwÖÇ?î);-ît8oãº÷ý’\•¬‘j;ŒËººµ @¤@=þMdæ`_s:‡ù8«stÑÉ%"ª …Ù»K¦û1rðl”hB7P÷j¼¹Nd´y×°°‰}R'!·=‡sZä«.!æhêå8F1ºjZTMFšÎ!í”RF|e`¯òÉÊÂMX£±Ï¯/ÕHÐÍlUâO¢fƒhiBã4h¥º»}Cs?&9dÍBüƒHô-³­+å…¦íy|6Má§7ž”ñò#ìÊÓg÷ çº ¸îÒÖî0‹Îáá\ËÐ}¡€ µw´½Fø0;±b߇œçö:n‰M»äšÜ"/ˆË”®;MuIžHFŽå½£^®ïE¼O$•À%„¡$P³UÔ£»ŠçÂ(ç°žR·Ä¢$Üi½Áµ©4xÄürá«j85}oç ‰!!µGìm-L>úù´GºŠ¶Joœô2˜˜·½û=ÉRã— nÑ)Ï®¼-Uþ‹á¦ú‹ž |tòóúÂÇ œú(²ÃG ´Ž.V—UÓdŒ„G#<½¿ÐC@ßpç N²B÷ÃEÕã?ªcë3ü©.i~ïÔM"\f<][+m= Œ¥.‘NbG'ú/í2Ú›X0^6üÜ~ô,ÊãíË„¶ÏÞ9ŽDÙ…á*'ÏÐ.¯Üž®|6ßa—µ¤ âÔÐb/ž°Í½¢ñýíÞÕÓBÂë?a®fZ”i|±Tx©}É×CnuWxXÒ=„ý¥Š'±ëø:ˆÂûSÂøÁ»¶'º¬=ný`lˆ& foÞ¤XWùë`©Mœ¥f SÊNýäAžç#—¬Ú£Ø5×î}Kx´ØÚ\`€tÐ#F]YåwLÔBLÕ„¡VˆYŒØñ¯³æÇ+Õ£rFõZ& ÿÃàÿoðÿÄf¶`jg³üÄ!ÕÐendstream +xÚí”e\[ݶîq V¬@’(Z§¸Š»[€`ÜÝ¡XK(.Å¥×âîîÐ/ÅÝNÞwŸ½ÙgŸ÷~º¿›õ%ÿ1ƜϳÆs1>SV{-f5KCíá¯9Ø8€ïÕ8@@6€‘Q6C ö’&p°ƒŸŸ(æl äDæy¸@œÈ" ÔÁ±´‚_J0ÿUÄ ³à f&öÀ÷&p+°r3[ Ô †»³Ålmª­pª‚À0°9€ƒh1ƒMÁ–{û_Žäì- @Þ„Íþ™rÃœ¦€/‘&™H‹æP{[w 9ØÀ®Ej‘Nþo˜úÏÍ¥mmMìþÚþï.ý¯¼‰ÄÖý¿+ vÎp0 øj†Ùÿg©øæÞƒÍ!Îvÿ™•ƒ›ØBÌÄì-mÁÀ×ül\<ÿCœ¤!n`seÜÌ +habëþ;¶7ÿO#Èæýmƒ]QBRV^–õ¿Oõ爐 Ä®îÿfŽFöqêØ@ d!òùç?ƒÿ“²7ƒšCì‘cÁÍ4ÁLÜÈù@7Г±7»ÁnHÇìlöP8r Ùo øëPßðÙÍ¡¶¶&°¿âÿñÙ¡Èîýݤ†‘m`w@Æ æ!> »} —BíÁÿbnîúçæ@² üoœ@v ¨óƒ:÷dâòo\@v'd3þÅÜH»€í"Hgàÿá•Y#ö@ȼøñÙ%ù +’„ô/õ/âEº—~ ¤w™Bú–} ¤i¹Bê)<Rïý!õ©§ô/âCê)?RAõ +j„ì‰ú!ßVãêš„T×z ¤ºö!ÕuþEÈùbh;r`Ùíÿ ‘Yè¿á_§ðoˆýGûÿ÷U‡ºy¾æá¾æDÎç /7ÈûjØCÁr’È‘xùùþŽš9Ã``{øß_ ä5û'[@ v›榡f‚AÖŸjB +}¤rF‹0™hùAƒ-ÁUA¶ÝeA’IXíˆ:øéq0±5¤øÑÇ=ùRvs îUª1¯O5öàYâ2æ¬5ì}³]}C´ÞŒîv"»´ðÍ9º_µ¬ûóô§+.-˜å +Û¼ÙT{…3Ó·Ç>6¾C«sxÉæôë +I`Í­•W¿e 9й¼^ +ý”SÒ»9ªö¥q›EdÆ{ô)„Ð .ˆÙÍbmÀñÙ†nN;‘¹~—a3qnr]òøòSaºíwKKîÝ!+Ý’8qœù»žÈª'7ì4ÏšOhMÝ_*ž¡Ô|ré'oŠàâò¹½U-ÿBÔ"Ì-ÌòS}$´ZÛÕúyKOfu±þÚ¥Ø~û\,±UÔÃ’îÑ/¸à…8™ˆ’÷݆Dƒ`sdýÏ£wM#¾€•È<S|tá²(Å£¶åC.çÃo5P\!A7u’:VËûÌÐr-JÖç Ë#RG¿~íü¹ÊÞç÷-¶£´•ýÚ=õjgsÕÓÛOŠô—‰u*ÖSJ?N÷ö6|åUí'Ÿ»›ºýáÔ.—æaLgÚù8*>À:`êµk. çëGLd=ŸÌDSiUR ¬ò9Ú%³}Xçþy“Äé¯;P¼Ü¾|–$èçvNã"æÍ¢1%¿óÚÌ(ç)ÅÇsnQÿßÂ<º5Ò‘º7ö4< ³ª¹,¡8¤ ÏÚ@1Á=þŲ€«•üÒ—­øç«Š›]Ý3;ÛÒ]þi˜d¢+ÅÀW,ÄAÏ ­uK¥ƒu:?0ºU×Óž”îUK”Bì„(ƒ­c-QåØÕ£’l­òPå>ô¤„:ûe‘Û9Ùd}¾²êïáð¶Þt42$#¢BœrGí^úÈQ9ÓÃI +cO$ùÞ.Ò:éåÇb³)³g.‡eÛê37P´_Úç»NKxK”܇]| Ž;Ðåòê÷dŒ¡‘Å#­v&¡¹ûd=ï¼*½²p/™¿¢óK#c®“½7¿)ÎÇKÔЊ]¨ðƒ{¬fU5ÍhÎ ¨Ô娋 Úv”áíàwÛ˜+tìTÖ¬u)êŸT›Ns¤Ò2¨±Ç,šwöç¿Nîwό蒔gh¸ïÐtte\tÁ¾ø\ºå¡¡;`ô9ú‹˜T©È‡•[®—ìwJáqûLVñùÀ‚ðW=Êømxé¸ó*g›wÞij ¢…’E}U$òñ³×75QC^2GŸµv^s“+9+ó,~}EpNpj{BkƒºïNæˆûS½ó°¶¡Û& ¿ý×Ì_¹7ãŽ>JpUb­¦ËùÆÓߤSÑO”¤ÀnÎÖyÈyõï¯+”qb"f¾‚0'žZ [uß7E£C'+“ΖPW0EMœw:ñøë¾:gs¾¬áþ¾Î¡ï¾åŠ ô4¢Z£ÎšŽá1íûú^øIëÏ)¬Š^´áj´•‘û¾úÉü-ÓUżÉñ€6!% îæÂG噜ŷnÁ„!ºÎ盧³ÂpžMê4¶·¿}ýÔ6LT}7ŒŠšN74‘ ô@3\czÒ_x ¸­5¯òäqÉßèýt+öùD§þXRêÒûDá8*%­rN½‡Ëðx~NÇ`<ç³ 8“9VåË“½üT&K«›W»ÁÀ¨ÞjÙûµ¤ÁZ;ºR=ò†óºa0å•ræikDEâH÷Y<›½-^Ϊ³¢ñ_¢Ç¤a¢‘žÚì”×7¤IˆŠø!™åGÈÍc&º? +ãQ×ÅȾJ¼GñVõ¹¶È9ÝçlÒ+IJk\ªË±àïWîÈÍZúk±ccU¹Ì\ÊЦuLbw¦:Ïr3éà›áÒ'FÝœSvKçöGy;ÅÒνsèF€2ëè jYSlÊþñ("I!€=Õz‹~à±Êyöu³ó«*ñ)ùzð~$k žÝyz„í¢œ×åkô“u•áA ¼Zm~áðP*955*í:]}½ŽõØÑG ê\U¬XŽ~Ÿ„Ö5›,@”ú¡eñ¿v¢wA ¥ÈËT!â/CRСӧõ‹`¾BH{o\¯Š@ÍmÇ›Ÿt…5e1Ö¥<94¶)’€“o{IzŽ)¥û’Cî&Vôë^I,= ¢$Dùsóß_=‰kJT°â(ÔfÏQ¡"ЫaQãÅõ/[#'Ãw1ÙÃaº!pCweqÜ©'‚f1p,VN¸—ØwFÞè4ˆe¢lçß–âÜ*v=m®´Ã)1Ôë#X«µ8›aµØõ•AàXš½4¸1Ù9¡PÒƒ±QG(:Á¶_øŽW6ˆo«}ê|-|Òné»Hƒöc*ó„Òí©r^²¾A§]Û+ɳ‹Is’"—Òå¸8­( +v^ÖªÂ^Å‘ËÎPÿ¨kû=Ï ¹ÿìÔ²¯£\¾;u¸>i«¿¸-ù“uð93!£·:j²ÒSÙ­è¢7¯gÛdìIÝÊ@ñŸ†bÁm”; ½Tí4ewN@g÷Ö׈ÓVé$³”¦àM–u©˜&[Šº˜¯z¹Œ«?ÌÏ´÷ŸéÇcgô­™(Œ¥Uú¬æKð”)Y|s'¹~o‡T´’-eƒÒu)áV¤~Ö>›Y—¢o†Ñt¢sÿ@z¬š~~œ&‰'HÓ?[í¡ œ®x<ÉSüò3}§Š<ÕÊŒ±ú‹7Ð(Öœ×ww’Ó³oóˆáã…Sc`F0³‰2Í©vUp;ÏÞÙBG!3ÚKYzúN-ye»ØAÊ¢?°~2)U˱ax;}æ×ýì£ìÇk´Ý˜Þ…ÒóFÑfã¢_ÚÞÝñ\èóùL5`²ýÝΧÓC7Æ¿ŠWü«AOñ^ÓÅ=z.¾¶‹Þ×êRãe+r |ì]öêmêûVO)„|_¼Q”¶£w'ó&¸jÀEßp…Ž„¶@©ÓþstJ¤-“-Z)ºãîÑ¢ÂB9ËŸfnk« ‰§>ŠFé(¦˜"Ž Ã=^:l +½ô~5á5dSß.'ˬ¤Èv·©¾â2Ó¤?Òc~AÊ¿¾vQk˜ᑺ§cm'RwÍæ2ÙßFø#ÝÀp©§~…bRÖ?“*é ™~Ð(«ÞãÛ•é÷• »ÉIø§96§f‚O/‹ªúR–ô‰Ëž¯ÒíȆ€e}u…o:„,Ûk`[¿2¸³œ¹E¿dð›Ïº@> +ºJÓÅÚÆÚlÿ¹ÍjÃÁyk–I¢…s&&É%ª•«†D‰‰ùÅ}Ìfÿ&Õ«áñ&|ÃYàó]ÌötF—á…jáj`Œ9;IÊ+öm:Mx8M˜ý4%Fj37öeÎïŽqp6«R2Ðá4«µNR1²ÌµÔ"`1|¼½ÐJôÊ’ó²ÃŒÝqüf¾:Ô>À•q,yüäL¯ûâóû&ýJ4á¶öˆ +R™7öwƒ§#/¼±Ö™R—Ïë…d­2Rw ‰GÑ4Á¡:Uš¸ê“9 ´š|DTeû©É³\Úì;$\Ë›¬¯P'Úž·f˜¿üR6Ñò!’kЃ€è~Uý¾ÖVCÿÜ1)‰+@Þ:uÿ­r°DmÄðÄÂÔÅÅCŽÉS; ¯°ö}'‘÷/Ê!Ì°OZŸk‰vÍ’ó9LwœyßN·7ðý¿h¹3ÜnmAnD±!q§ÝZîͺš¡€nï±@v|gžç Ä÷?LZ7kïð­6;¨*Ýïèµ8¾W=™WßÏé±°÷•¼ZYÆH»ïâôÁ΀c“ãðÁw†tbµó“5+™¬ó)òR,^"?%‰"•ºjè_ä‰òy„´î›œ=Ys§Se·D?¼2ޤחTÑó"dUZÑ­ÿ~ÛÉIhÕyÈb¦ö¡Ø´Áùö¼=~dŸc“˪Bq^(½Xo€ÌþÙœ ÍN(ó –Ýø` :‚K9k^;8(ËíF|„4Qi´ãJŒ4# +LT,bÜø•ÿdöxr|ÒÏë¢ ±Ýþ¸ z‹\ƒªFë½VH|š•€ {Á]½þ䧂+i‹ØÅyƒ€› ² ‘˜‡_Œâ&pÎ /º©kß¾§…Ï yNþþ©ëýˆD  +šæ}¶Qh±¨”&T@.<û9èPäGQ;ŸêùÿC,ïF´—Ì’ûÇéáJÉÌâZOlvzøK5ß ¹¶bÃÜ÷Œ'›ÌæJÂÉ¿6{4¼j‹–Ô•‰È¿\6PkzæïñƆòd®%ÄhV}$ßRä1®ÞÝfë!x­ÄÅ‘µH™tm8ý‹êO¶Ä%ôo?-o„{.JVhîvÆ–Ì»•i¤jO¯ujWŸ8ô^ëÜ^ïÌ“ÀÍÙD=4¶(Fs‰*š´õ/Lô¾¥­d=«Y%ïJâýÍ$ü9ÄŽM_—ÑÅý$cEç$RÛÛG§©Ë骅CÊdÛ´ú,˜'Gc¼‚šñË`1»)þT‚ïX.M6¸˜Ûx6÷ú³\…/€ž¤jHéãÜTt»Àr[~Q”ƒ ¬¯´È…9[üÑŸ-_OA«+ ï§Ç“ET}[½žRñþ:¢˜´3®q!Ùlƒs}ÍÌIÄ@{/3j’ÄnF •\ôË{é-oýÃå¶=éŸÂ}fê—÷}áº_íe ñOðxu;ú2p±ÁÓ‹Z¤#ÑFSý½óC?Åçíy—ä*o‹mÊÔVh¨UK5q7ÕÌÓ+8ÈöŒsvgî-7•ûœß|ü*8ÍGò#ôWÛçÕ1n_!¬ +âY›L¹ZÿU߃‘}Âřꞈ¨¥Ë¦`Ü +û‹X)5 ê{ÓÛa<›À*¨…´/Ï>gÁBξÖK¿/¶“\¤iT^©„ØúÔçÓí ++~û.ÓP':§†§àn­•b²d¥ªK§uuÑäÇÃɇ¡éƒÆ&P#$éy+f_iνBd ÓªRˆHaã~>2etndûàŒ´Â\ÕQ™düVºØ =ãx&«Ê•,bB³9¥½G§_C≹&@RUÜ@ï7Åd'ar÷õÖÒ-\”c†ÛŽØyžRl¥],_zÍXÏì²=½šïPΰè|ÑèìÉ2Ü:-|øoÏ÷ùU ‘Œ“v(”Nus±e‰ý1.¸Î¿æúî¥éÈÔ[\ÜÏ7ü¹7 bï:»8¥uW¯à¯G*‡*q»}龘Òßò'¡uÚÊg·x‡»>ßÐæ“ùßNh¶–ö×7,ÙÚ¡’‹u«6íéµFŒ®†PA3èj–¬a>bì0¦’E*·am=Wõ*IêPStƒHG\¦”œÏÏX<zõ/¸eÎQiW•y_×ê¡M5Ü,ÑD…b?ñ1´ÁPöà$|ÔöÍjü™È–À9.öÅC¦uÚœ S-VfšUÞsê’m~ì~5A§´éBô>‹g”Ú¶oW쬩¾˜½Èâê]Ú¢7MZ•M%ôå>„'âþ‰'–‰MPœ—ÑL$ [ÒâúÔãÍHÉÊeHftfÊz•-ÔÛW©c•Š,ýk{¹,Kl2|%‚.ØŸÑA_lðgÿð™Îq)MD¿î?{³§Äæ/zý3$ƒ›·£¥÷ÍÐéz†©.k”^ÍWê¾A“ùºvŒï÷J'Ÿ~fÐq£çïÛ›&ùön8Òj`Æó}Lt¢¿$ìZÿ%CEŒšÅ Z¢ù‰¬Ø„yíÝ{Ù2ºTðõs +YO./›‡NHéå_øÙ«€×Zô3gÃBU˜1(.ƒ/Ë×*\Ú…x­ÃwZ9³}󰔢ãåÛû1=ÚUnå×&ÆÜn¾¤x«³¿Â?dªð{šä —ÛáöH"‰}M©ÓM¬sÙeæ¨F仟8ìÀ:“/*w¯‚}:¥˜åóôÆ1¾ïÑbËÕpÀù ÚsMq­Œú7djðߟ0÷Ï&GLºTÎäœTm¦æ‡ßã),ôíÌr;žAuˆ ´0_„ã‚?ƒW i8© -ë]¼HUÜ>ÑlÂki¡åà÷`ßÀ"‹[«¥G/ÑË”Í".-P©3BÚªoI?÷N?7P2d Â: ¥þØëòÜt«“ùçùƒMòZ lßFã‹`íá`³ÈÜrvuR†*–ÎH>ïf¡ÞæJñ:coph[÷èi+1¥ úÊd L³sM±|ùèÎÕHÄíh§|ƒAÌÁyÂÉ:‰€Õª4É­ïŠ42÷çSëK¨(±‡3‘ò‚¼Åšœ«I8sþ'ÖÞÔF1Ûªa„‰Pn=óç‚1,r•ßz:‰·Ù:>/,è= bžõaûYŽáP\âK4s]u*5 Ê_SAÉž-½äRî§9” úaT{«x³ŸL”k|§?¶4ëôÂSfi°1…]RfKÆã £ÎY”¢:ÅøÞýæû^MŒԌNc"šÀ“=¥?³’ú±/—LìàË2^ú¼}/ëK²Ï±’m´øײ òr¯e’r¼Ë¸ð“ümŒyRRÍ”·FÂÞîª9Ž‡¦¯ÝˆPƒÐŒò_¤*‚ñ¨AEÕÃaJOrCù¦ó*&†Ú{»ºxìó=RÐSàeëbÔGÏH¤ñ»£›“½Ê‹|çì"ؘI9–¿ou(`TnÛDT”Úþ¼ôbe`FÝÛ/ziZNÔ ´.*Ãb™IJeð¬Ú +ß¡ý5 ¤@nè㫯 ®^à­qˆEw«”0LÀ¢ò9‹D‰9™Ó¦ÙÑÿµ}®Òq,û4[×o©oÌ·;÷Óu%Cšxèó,ɯ4Ý?&i“p™Ä¶ë´ÞžÆ“ô±hç·SH¿¦É–µËí '— +€bD‰ ‡¤© ¾½—¯0+͊ד1Óld°el r’Dí¤ÿþX‘fñ´à%Ñ2‘2Ñ^μ +[ªÍœBbeÌw*ûm/>?'µ$ýqpúm>þ½- +‹þ.«&ªááíàðFÍd“ ñ>ÃØäÆ’i¦(›µÌ§~• ruLÈ…DCÒuª?Y!¸SDíÍ—g§&¶ˆ.î›ÅŠ²W[·¡t%•¶á†³™3t’®4,LváðsìQâ^ *Ì6Â!ªŸ$š>ª;MAÀµ:;ÅÖ±Û%‘[‰#%T¬ß‰¤¾ÇöIîâZôº*jU…RÓåäcß|ê¢9JE¿àD³È¼ `ãÊúxâÇ5e§Å•çi\÷¾_’«’1RÍcƒqZW·¨ç¿ ÏìËaNç0gUb.º"9…BD´0{wÉt?FžMèæJã^­“7× 6ï6±Mê$ä¶çpL ¿uÕe'ÄM½Ç(FWM‹‚j  IKÑ9¤RJ‹­ ìU>Y9@˜£ i4öùõ¥ ¸™­ŠÿIÔl)Mhœ­Tw·ohîÇ$‡¬Yˆ}þ±e²u¥¼Ð´=Ϧ)üôÖSƒ2^~„Myúì~!â\—×]ªÑÚf1À1<œkº!äw¡öŽ6°×f#VìûóÂ^Ç-±i—£@“Kø%q™Òu§©±.ɉÈÑ¢¼wÔËõ½ˆ÷‰¤â¸„0”jÖªƒztW±\åÖSê–X”„;­·¸– •˜_.œ`U ¡Ã§¦ïíì$1$¤öˆ½­…ÉÇ‚?ŸöHUÑVé“^óTâ¡w¿'Yjü2Á%2å™Ã™·¥Êw1ÜÃXÑ“N~^_ø8AƒCEfø(ÖÑÅê²jºƒŒðh„»÷zèî¼ÁIVè~¸ˆzüGrl}ú?Õ%Íïú¯I„ŠÃŒ§kë¢`Å ­§± Ô%ÒIìèDÿE ]F{3¦Ñ«†Ÿ;B>EyȾJø`ûüãH”]Ž€rò máòÊýèéÊgó6‰QKÊ ]~-¶B¡ ÛÜ+ßßî]=-$<þæj¦E™Æ@…WÚ—¼=äVQw…‡%ÝCØß™«Øq»Ž¯ƒ(¼?%Œ¼k p¢ËÚãçÒƆh’`öæMŠv•¿ –ÜÄYj¶ 1¥ìÔOä~1rÉ¢=Š]síØ·„Ða‡G‹ž¡ÍH=bЕQ~ÇH-ÈXMj…˜Åˆÿ:k~¼R=*gT¯eú?üþÿÿOl`f 6Á¡v&0ÀZLÕÛendstream endobj -1074 0 obj << +1075 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1960 0 R +/Encoding 2068 0 R /FirstChar 36 /LastChar 116 -/Widths 1961 0 R -/BaseFont /JGIADF+CMSL10 -/FontDescriptor 1072 0 R +/Widths 2075 0 R +/BaseFont /NCDHKH+CMSL10 +/FontDescriptor 1073 0 R >> endobj -1072 0 obj << +1073 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /JGIADF+CMSL10 +/FontName /NCDHKH+CMSL10 /ItalicAngle -9 /StemV 79 /XHeight 431 /FontBBox [-62 -250 1123 750] /Flags 4 /CharSet (/dollar/quoteright/period/zero/one/two/three/four/five/six/seven/eight/A/B/C/D/E/F/G/H/I/L/M/N/O/P/R/S/T/U/V/W/X/Y/e/n/o/s/t) -/FontFile 1073 0 R +/FontFile 1074 0 R >> endobj -1961 0 obj +2075 0 obj [500 0 0 278 0 0 0 0 0 0 278 0 500 500 500 500 500 500 500 500 500 0 0 0 0 0 0 0 0 750 708 722 764 681 653 785 750 361 0 0 625 917 750 778 681 0 736 556 722 750 750 1028 750 750 0 0 0 0 0 0 0 0 0 0 0 444 0 0 0 0 0 0 0 0 556 500 0 0 0 394 389 ] endobj -975 0 obj << +973 0 obj << /Length1 793 /Length2 1151 /Length3 532 @@ -7814,380 +8533,288 @@ endobj /Filter /FlateDecode >> stream -xÚíRiTSבª¡¬2©¤j=,ŒiF !¡€ˆ‹2soÈ-7÷âå’2ˆ8PIU–E,ºd¥Âª"P”ZbZÀ‰´Šð€åó!U«"àô.XWWéÏ÷~½õÎùsö·¿³÷w¾³.¡a, „o€e8F²xlž(rPg.—Æ`°’Dp,PIÂbÀ‰<Á* -ø€+ <Ä!ðT$kHàÀœ$ D ˆJ‰…’ÔÀZª†J‰‚0\…À¤ $( -ÖMÞHëà4˜H‡!6Ç¢"Á8ÁhœIMrLá[Ò¥¾K¥ÃD% -¸MÉdJ$„c¨@°šÆYƒSÝ`JËCÖôâ2Š®Qj'ËO9õ·¼R‹ †?¸6UGÂPàL`Ó©Qð[q -BtÚéY9©D•KFaÀâ­`sW¼Å‘4¢‡¡P„Ti€Z‰¦ÁS8ŒAÓ•PþMéàHýc$±2÷?¾v*ªD02Ü -îŸì©˜÷gL™D zÇes¹<ŠHíw§„iͤ˜ -‡,ðž@IJ"*€L@0ÖXO)æ°1œ¤®Ê™l Æ Úä¿zr…ÓÒ&Ñ·p’'groûûÓüýq}&˃X|ÕŠ»Â Üì¿#0d£–×Kèá%˜BU:‚€1rj¨(ÛÞÅj„r†õ°Šf¾‰«¼·~¶ïôöšiUç1kfÚÂ’#[ÛÏo;UâÍîõv¸N4þô»ý6ûÏãvÅ#!ßp µ ~Z’eÊ ãlë±7Ù:1+ö‡Íz¨ŽOœq¹¬­õíÁ÷Ì‹SÝþâúìnúyëºÕ÷yÂJúHÁÌš[7_=ÉIÙÔÑg¶ùr*¦%”Y½ŽüçÝ«‚ð*Ü\}y~üþgŽ¯ÍôÖ;Ý)·mKDÆ2…ÕŸ—s¸L½º¿ƒÆ;²Ø]*Z&ž½Ðózdy °øÐÇ¥$Ú·¹)DñÛì.¦hÀ¥äýny^vqp”E¼ÔƽŒuI㯿/Ù9ói‹½Ïßé-U™.Î'fD¹{ðKwsf¶séÖ×¾0¹Ä(5_Ý#%~Á½6+mÚŸüú³šÇ Zt#×éæÑ/\Í|Ú}ñ¸v_ùÇŠX÷o›L{â¥z QÌ%ì“þÊGÿºÔb<ÀO”Äõ& ¿å~¹¶áBU cmþÌS“LVµ¤i6Þ3à?ßÅ×q¡÷\;Iü`8Ðì2_ìÖ>ÐœËrLŒ/:.ö<ØýÒ{èçâSãÈÏE9ÖC[¤ìb?_žéõ›ÕùÚ$C§WíIÓó–íƒÂ³Xk÷¥¯ ©Ù®5<ÍÙ{LTÿˆgUžuéuQêÜB6=[Îlc¬¿Rû˜´+ }Q™Ä&büζ´b6xb<3öÓõïøä×ݾGÖªÎܽéáã[+íXOÛô÷ ˆè©ÒÏ‹sÞlí ÒÙØK›ÚãÌؽc%w~ìCD[β׹úD³Ô·…^wác+ײøöêðL.ã^`Ù?Á€š+µµN Èið²¿2ÙÍìlR8~/ꌙšSÛe$ãð«“UÅ‘œœÁž•§<]ÈÕc•b,l©ü4ºÜbÆ™cOŠŸ›^ 6”ï‚ünW„ÆŽVLøÜíšÐå:^)èøõŒ‡B­x¶7i¾:àÑÔUºÀ®\ÀrÛzæÓÌ/ù_66n¶˜G¬‘‡BßYjÚ·_w¼i«åm‰éùÏFwäY½Ÿ]°ŠN߈—Öé÷×—öÝy)#âÃ|Ó]·HçRiñk˘Ⱥ¡v˲øÃ|±C£ª±Þ¸çbe‘í'‘hQž§j»¸eÕ°¢®áÄn›¼Cš¬¢®¹ùͳîÜü‹Óãeéa_Çúžæ¥Gž“ úüæ|ﺸPCB‰Ù'‡ -¥Õ“ïI{‚³žûýðôžuàè’'QgK -ò_ jzÏx•ɇ¯tJnµîaÔv¡MÕ¥ù{skÖ¿dw¸ýŠøšÏîö¢vÁƶqú2òåë¸S˾5$ò»‚ZVg@Ø‘<ÐvMo£C›;7WRêßuc׈&±¡ãzYî¯XDX}¢­jÿ^D.Ç·m±Xd5ëþGWc>ÿ.©Z80vAÚ’p­çËѵ;…/Í fB!KI®ìÌ3oxšz8¯Š^ÛÏýíÿþ' -¨PXI¸VI¤Ðþ 憒±endstream +xÚíRkPSבª¡Ly©¤jÝ F‰4O !¡€DŒEÃSsNÈ)É9x8¤D|PIUÆ"6:ò¥ÂT¨”ZbZÀi¡ÀX‹T­Š€¯°N§ô罿îܽÿìõ­o¯õío/š[„Œ!‚°õp† “#AR©„Ãä™Í¦ÐhA8,' –°po°B«\/Àæ y^BŸBAXšGRTð¢Oø@¤qD!GTN¨` YC!W¦@`BÏ"µ¬™¸‘ÖÀé0žCL +‡ DA€õp +‚RXš$¨ü70¤M{›Ê€ñtRð˜”I¤HCÕzÁJ +kFvƒI-ÿ YS‹‡hÕêUrÍDùI§þ•—kµþ/¦IÓ0¤ãèTj üFœ†­fjVBÈÕˆB„¦¨aÀà,c²—½Á‘ôDC¡P¥\Oâ0 +MUBú7©ƒ( Šñüëk'“r%"õi0`ÿÍžŒ9ǤI8¢ñl&›Í!‰ä~{JœÒLŒ*0AS—ç ä8.×SÈ!"#0p‚B°À:R1‹‰byÎd%†S&þÕ› Xj8=}}p+eböH÷&°?-0Ó^\ÀàòÈVìe>€Ïcgÿ“…"´°$ðØ>|/Þ$ªÐâ8Œ“CEÚö6V"¤Ó0¬ƒË Lá»å“½§¶Uçˆ+;ŽÚÒÓç›oi;·õ¤É—9Ôãët oø1þàÇ­ŽŸ ÇŠ‡Ã¿bAJ^/õ”(Ël±¶v;ší]èåûd3(†’¦]*mmyOs`û]Ë´Ï?¹?½“qζvå=¿‚:\0½úæ—sR7¶÷Z쾄Ü‹)‰¥§WSxeü~(V‰Yª.ÍMØ÷Ôù•…Úr»+õ–½I`,•Ú\7ù½˜Å¦ë”}íÎþÔ…–ØÁ +™pæ|ïkÑe&`õ¾Ÿ›)Ö¿©1\úûÌþNº ßÍôn—$/»8,F52ïh¹“¢zžÚ/´Šj ×µ¬mÖø£òêVç9¥ÖupýŠ8i {hk’Ç^ÒþX´cú“ÄçÏ{ž½6R›( nV®Ç§ÅxúìÈð𢷱©¶W?3»ÅÉU_Ü%Da=vË­šú²šF¥ Vp=×åÆ‘ÏÜ-\Ê=á˜foÙ‡Òµž_7šw'ˆuV‚¸‹èG}»ØlÜÏM + ŠïI>yÓóRMýùÊ`çšüé‰æÆÊE3±îþÀ¹nþÎó}g;ˆ"j§åB—®ð¾êl–o|lÁ1¡÷®¾ƒ?G™†{/ȱÜ5'ÌßÏY²ŠÌb¬Þ›z¬:¼z›FÿH0kÏQAÝCŽMYÖÙ'¢Æx!¨õßøt)½•¶îrÍ#¡0âyE2 8ÓÜ‚âèÀñ1C÷ÌÇëx¾ )¯ºü¯9XeصñÁ£›Ël_GÚõu÷ ¨iâO‹s^oéÕÚ9ŠÛâ-èÝ£¦Ûß÷"‚þÍg:jÝýb¿ZìßL­=ÿËèòÕ ®£2ÒÀVÇyX÷Ó ¦ +M r¸(Oñ°¸š¥ÎßJž¸¢æ¦4㶂vèå‰ÊâhVÎ@÷ò“ÞnÄÊÑ +!*[,9¥^j5íöôÑÇÅ®OñM®†ñëËvB·Ê#ÖŽ”ûÝé×æ:_.hÿù´—T)}/Û“> endobj -974 0 obj << +972 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /EBYAZF+CMMI10 +/FontName /BMYDCW+CMMI10 /ItalicAngle -14 /StemV 72 /XHeight 431 /FontBBox [-32 -250 1048 750] /Flags 4 /CharSet (/less/greater) -/FontFile 975 0 R +/FontFile 973 0 R >> endobj -1962 0 obj +2076 0 obj [778 0 778 ] endobj -1963 0 obj << +2077 0 obj << /Type /Encoding /Differences [ 0 /minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/arrowright/arrowup/arrowdown/arrowboth/arrownortheast/arrowsoutheast/similarequal/arrowdblleft/arrowdblright/arrowdblup/arrowdbldown/arrowdblboth/arrownorthwest/arrowsouthwest/proportional/prime/infinity/element/owner/triangle/triangleinv/negationslash/mapsto/universal/existential/logicalnot/emptyset/Rfractur/Ifractur/latticetop/perpendicular/aleph/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/union/intersection/unionmulti/logicaland/logicalor/turnstileleft/turnstileright/floorleft/floorright/ceilingleft/ceilingright/braceleft/braceright/angbracketleft/angbracketright/bar/bardbl/arrowbothv/arrowdblbothv/backslash/wreathproduct/radical/coproduct/nabla/integral/unionsq/intersectionsq/subsetsqequal/supersetsqequal/section/dagger/daggerdbl/paragraph/club/diamond/heart/spade/arrowleft 129/.notdef 161/minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus 171/.notdef 173/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/spade 197/.notdef] >> endobj -968 0 obj << -/Length1 795 -/Length2 667 +966 0 obj << +/Length1 842 +/Length2 1048 /Length3 532 -/Length 1237 +/Length 1656 /Filter /FlateDecode >> stream -xÚSU ÖuLÉOJuËÏ+Ñ5Ô3´Rpö Ž44P0Ô3àRUu.JM,ÉÌÏsI,IµR0´´4Tp,MW04U00·22°25çRUpÎ/¨,ÊLÏ(QÐpÖ)2WpÌM-ÊLNÌSðM,ÉHÍš‘œ˜£œŸœ™ZR©§à˜“£ÒQ¬”ZœZT–š¢Çeh¨’™\¢”šž™Ç¥r‘g^Z¾‚9D8¥´&U–ZT t”‚Бš -@'¦äçåT*¤¤¦qéûåíJº„ŽB7Ü­4'Ç/1d<8”0äs3s*¡*òs JKR‹|óSR‹òЕ†§B盚’Yš‹.ëY’˜“™ì˜—ž“ª kh¢g`l -‘È,vˬHM È,IÎPHKÌ)N‹§æ¥ ;|`‡è»„…¹kCã,˜™WRYª`€P æ"øÀP*ʬPˆ6Ð300*B+Í2×¼äü”̼t#S3…Ä¢¢ÄJ.` -òLª 2óRR+R+€.Ö×ËË/jQM­BZ~(ZÉI? ´©% qˆЩúI‰ÉÙÅ9‰Å`aLÿ99åWTëY*èZší344S077­EUš—YXšêé¢`j```añpriQQj^ 8aÃÆOˆwjjEj2×ÍkùÉÖ-YÓ·µ­¬s]|a«>çÏk_Þd?±£nvfJm°é¼@Åô’%¯>ÚÚwX<û¢„W²õTá¢-’½~=q_ ¯ÙÚµ`YÄ„Óýz7‚Å+›»¦ñþÓVåy¸0lÆœÖGÒVû‹ÏêTÖ¹ùE¹þϼ”NQ‹÷}¿w[H+h’–’”ùÍìwÅÄ+ï>¿,ÿiGýôã¶ÉïÎÞòñ /vëR¿˜fÇô%ñۮش²‹µŸ9¼òâQ¹DÊÿžýÑod;”ÚU? ^Vñµ«Nºúú©vñK¯{~­ñçäÚ/ëtôî…Ã-Çé÷7¸ï“õ‘9ñØ8ã·Ô m¿i"é÷Œ™6=Û!y:ëIèÆõ†íÿ_°K-­û±,1{Îö)².oª -—ï¶ý*Þ[«ç½mFäû%»s_Û-j(lå¦sÿÏùœ~gغŒ|K·~›¶#£ïµ¾øÓ·&g®]p_ò¸!—GrnM`ìv®^ÿD·l½ŸÞë>Z`æ,ø&Á¦ûüãÈÝ7ƒ×ÆÛÎìÉ{Ø·úìeYÓã/ï-àpìòçpý3ËLXcµ:säɘ٧OËÍÛýyÍ1÷#ýu¬Óä”,™™ÿ¦U)MùÊPÅãPQÆÆSÝÚüµÂó—ÊÖi’Þ‰÷_µ]7`tçžlx~FóqéFÉDZIî8´>÷ö±ßùîÌéè»Æy§éjå&/Ÿž“ÿEí…Zþ [%ÿI¾óZÒ¼«×ÎÙØ/Ÿçy-¶ÇÉ—#ߘU)Ð)õÜïçãw¿px»Çkû>WÏõ÷§ë-˜Tµ2~U]Ùg¯«‡ßÍX­÷³òZà‰jEO-Z˜_ØȬ¼±ÊèÆ?ÖŒ›J -vMOýÜ7J§]8áîf°øþí’»vÁ_¸¹‹üÖ„7xÄh›t*ÉÌ€BÀ5jÀ°0 9'5±¨$?7±(› eì«Äendstream +xÚíRkXgµ¶Šºf5BeŠY$™‰†•* #1²–’IHfp2¤–O *+Ð Ô šDxDÄ¥rYŠÆ»\¤e»²‚(¶ŠÅÊ Û-ýÙýµÏÎü™÷¼ç;ß™ó¾Lg‰ÔÓOÇ"B#=!äB¤Q@,Æd +&Qó‡IÄ€¼½!ÀO§ .ò|8 —Gc<Ñ@ ª8X'p›%ñ? B rB`2ÑPrX Hq9Šà§Vá³'´@8¢Eˆ$DÁ¢A @å$‹¨PŒÆžu$”8À›‡ºÄW­$„ÐR¦€u”I7€²¨À1µP J[ŒSw!”“ÿ†©…âBZ-†5³òs)ý¢kPµá%×$êH„BpB` ©ȼ¹Dê4 »"V£r?L¥FOh# ÜÀo Z!ªG””ÇJX­EæpS,´BÅ7g„Íß"æ{¼œë\S£¹ÃˆàOì¹ú©¦R"P= ²@¢ˆÔûêk÷‚Ë09®@1Àáz0AÀµATÅöBŠ)=€è)Çl†“Ô€Š&Pâmv¬Ô:±c©hrŸ‡@…°Q#Êÿ„7¼„çgûoœú3v,,OЪamÜüË8ø|\¿×“ã xz{Qö È àñ¸)?'Ê0tù\7qæó‘ëÁȹ=¤¢~U+Qj<¢Gä´žn\þNF|A]æ)cÀÉÛåKØÖS–ʇ=VÍ‘õÆ"T‘"å sV‘æáâþÚœVFBûªíòwщsÙâƒïŸ WÔf/‰ü(ÛÄúJÊ0|˜•ÿ›®Ã¢Ö=; ?3õ¿åÓDÜ?|Àe}ϸKªÅö¨bˆ¿ëdã³Þn›åî៸¿íÈë)³ºûÚJ†áîƒÎ5ëS .ûÊÇnü=X$ah…Y®íÊwmbÇá‰oh»•Iííaƒ~-]CýÉ«Ïß =Ø­uÚÿö>æ÷_HKôO³Œoíýòj¢£cÿHvñÓB­iMNü¶»·[3.÷³sÓ‚W[îoˆ›v´xˆó§{7,®¬w¸ÿììhßÌ•ã_Œ“%pÂgçóœüGßßSÚàûLÆÈNaÕF=27´Út7¬€è[ºz¹SǬÅ×—fqBtµùõq9#lÆÀ·¯wß4ßOÓ,²u8òAØîó´ìPXøbivË@ïŸÛÁŠ÷iЕ¢o«ÃŽVê™>5΋}W̤ÊNÞL þ½1i­íšu×¾¯“V·2ŸÞÙŸhã¶MÔýÑ÷Yü µUSÆ0OÙöEäè…éQvzé_¯K:Ê}:PÐUü[ۜӃÏo¾»æЭNóZác©l“S`{{ØY2Ó6jü7«Fᶘ+® ïe-™âXXÀ)î¼Ò{·[䜞wxýÆÂ+£îé-ã3…‡…;îëžZw„ätœÊ³?#h¨Î¼gŠjžìQÑÜ‚¼:Kžõ~e±srY¶|¢~Ó^F^nDZï$ýåm#=ñ?.3HÅì ú•ôâ†dê…ñOÓ}Ó£w¯6ô9Ú_«s½1€N$WßY›œÜ°$çjsQüõ®¢rÓãªj‹KFèC5Û¦«+¦FVÙc®wRM¯ï±½Ç;¹}òl°2ÂÂì7Ÿ+E"ÏŸÚßüž`·œ\ŠËþ¸ãÌÙN¶¦o1·¼Ù÷¤ö¦ymÒðåòio;NxõÊ#7Æ0ŽÉê¢ÝZívSù ù½Ž‰ ¾?‘²ÏM¦Ï]'kì2ιœÞœî¦ãFñÊ$Ž“»6Ûy}ì8aö¯ŒOyÃÙ®é7}ùiÕrçgtÿ‹‘ßJZ¤³ÝÖºo£ÇeÌ< 6VlÑUõ“®6e¹—¶:4 +|×{œ°MÓ Uô‚¤ðäÊ®i—uŽ^/lÊ+Û¸³Nrü“kÑ·—ýz¤Öç@iie¡¢þ¨‘93(*dÇò^—N‰ì¹ß??”æërÈîR£ØôñáÒ'êÌZNÀ¥-¿­¡ç~¤Ï|¹9Æ=Óõ¡ú¤Ù¶<üVû’b³SªCÌ£¶ÿ¨Þ ëª'~}ª†×Á]«wÅLìµ”­³¿à|ü•íÿÿr5$®‰Ú¿istendstream endobj -969 0 obj << +967 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1963 0 R +/Encoding 2077 0 R /FirstChar 15 /LastChar 110 -/Widths 1964 0 R -/BaseFont /EPVVDS+CMSY10 -/FontDescriptor 967 0 R +/Widths 2078 0 R +/BaseFont /BVEMNB+CMSY10 +/FontDescriptor 965 0 R >> endobj -967 0 obj << +965 0 obj << /Ascent 750 /CapHeight 683 /Descent -194 -/FontName /EPVVDS+CMSY10 +/FontName /BVEMNB+CMSY10 /ItalicAngle -14 /StemV 85 /XHeight 431 /FontBBox [-29 -960 1116 775] /Flags 4 -/CharSet (/bullet/backslash) -/FontFile 968 0 R ->> endobj -1964 0 obj -[500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 ] -endobj -964 0 obj << -/Length1 1430 -/Length2 8484 -/Length3 532 -/Length 9360 -/Filter /FlateDecode ->> -stream -xÚí—eX[ÛÖ¨¡w‡bâNq)wŠ{¡Ipw‡âî.ÅŠ;¥8Å¡Hq·w-Üì}¾³Û{ÎÏ{Ýç&ù±Þ1ÇócΕ'¡£VÕ`7ƒš€d '6.v.!€¤²„.'€‹“SŽNÒtC!R@'€KPð@d»€}„xy„8ùÐè’P;w°…¥€Q’é¯$~€¸-Èl -„”N– [X S  @j -9¹³ÄmlêÝáP9‚\@fìh\\3°©Àd† qüå$1‡øÿ6s¶û÷ ÈÁ&`ü[“ “4ƒBlÜf s4(l6Ìåÿ†Ö—q¶±QÚþUþïNý×8Ðlãþ?P[;g'@jr€ügªè_rP›ÿšFÞ h6‡XØ€œÿ -eÀn 3U°“©%Àhãú;‚˜ý§¬q p¼•ÕÔPÔdùŸ=ý{P†8iºÛýSö¯ì¿™ë7úãvpÂÚËK„½ÿ}õî?&“†˜BÍÀ À+^>ÐÁèŽ;=0âxrÀ3ä3æ`‡@`·`-ñ˜CÐþÚPnÐÖ¶Ÿ@Ø:`CGyx–îv– È†þ‘Åàp´:ZþŽÀªy€ ¿‚(ôór8œ\órÁØÒôG7€ÃìòG€6 ¬ÿ0ÌÍäò‡láÿÚÊ"‚åØ‚M¡6Ðßy|°É@öΰ÷OVKü7Áì¥þ!~˜ˆüo‚Í¡ô›`™*ÿlQªÿì”s,Óä7Á¼Lÿ!.NØfà_~à+X'þ@˜Åk‹å[ ø„éZý0'ë?&eó¬l#ì¤r@þ@˜ô„YÙý0 ‡?ð¯ÍùaN LÃù„i¸ü0 ×ßø -6¯ûßøßO—„ÔÍ“Ö0¶W°#›‡ ÈÃçý¿gjAÀöÎ y)Ø©ãää‡íî_QSgÄéïo4Ø£ûo6ÃtÈ dŠ6? 5²Ji )õ‘.˜(Cd†—°hŠU©ëœúŒ8oS<¤hϼR«{WžŽµƒ¸Cåú@æÑî¥6*sìo›:ó¸ãò~'Ý£…L÷,]Ù}ÛŽæ:p»­qúâ€þí·•áÒD½Â¾¬“þý~]™t­ÐàZznjuœTûÒ0žÐeWœÄøçËã>V¡(Í,‹§Ðvg¼»”Ü„Gc¸[S¤_„}wBÇ\8$ ðnY­çgäíÙÌÞ­Èi,mSæøDÖ¹­¿Æò #éæÚreør³µžònSjy°œLd¸;÷z@ûv¦ãq˜„­z3-åÌlå32T„å“8ø5*(½öq¼€¨b4îI]¡ÒÁ¤A­«u"¦~TëÛ&øjï+«Òúö€ØŠXÁÐ7‡~/›/’Эf 画¼ø0‰(äÇš 8²2KJÛÅ­Wö*î™wòsyyŒçìiÛýÄOwTÆÞhôæ €Ó›àØs’lë®$¹c‚ýpᢹ#ÂcÉÔ.ãæÅìBÇÏmã¾F†®T‹ìŒ¬¾mTKÃÆ -™tB=¥v}méº -¼Z .èô(6Núë¼ïu>ׇ¼´:ÆÖþ=¶ErÉm€Ðàj¼+j »Dçõg„þyt“¬®œ´ÑÑá-4ª©È™Z>*zŸ˜³ùyrò;3j./$EUŽŒÄR9÷QŒ| ôæú‚‘lgŒHÌã9CÚÚ‚h„^ -iüoæÇÙi?H áË$”è)O€Y”¿PõŽÇ÷bIýê¸~ŽƒKÒ®¡cpÆÀµ{mïÎSi¯ß#üŽÏ½)hðÌΨÚÖä•6} -÷ø¤6à]¯Ô *РÓßñ‰ñóÃ"î%¦õtà¯ÁÛ½ Z™× ÜSVú¯˜pœ]’{N¹¤æ~jËû[UKå{J^–7§!&œ¡ñŽZû`çV«mQã•{¬dpòj”¸ï°söÛõiƒl‘ç…#1õ 8Ù5eõî×wêî•õ–Å´ô3 _.×,ô¢É>¸Q6$7'f”£ïÖÎ7LÜ]­Z y(%vø Ïüí: kÕò…A¸·Æ+OÄ¢éÆ̵W¬>KðX$f”±VF'·íÔ(HÔ<%§¨ÚÔ™º²sX!¦xó¦kx«˜siq”}s¨P¿úÌ)¥S¦·_ÊuV+'Èe.Ô”{:¨>b—6AV9OwãˆÌšmî^(GÀuÕ@™Ïú¥S­…y¿?F „™>¦”áª{Ыøùܬ„=ñ™î$¥ª¢+^-rWOªTµ™Ý$JnGÝV»ìäØëuu¬HÖÓ÷­;WëÁœÅQZŸqºõüÚü4{~Õ‰ŸoÛšÃkgõI̓ÂZÿ)šÛ3käR_cR’Ò4ߨ’k|]7¹z0§ÅŽ®üjˆÔYlJr“|+ËYõxCVyùr°WX‹qz"›ÌÈ+\#eIbÀÿ¬–à­o‘iý>ð(xleô,ˆ7—ã8€R¿¿<ß/ÿɈ¬òKr%pþWÄõཱ—£°åª»p¯9qÜ*)¿xå·Ó†MŽÎ®µû-¢;JŠñ¤ \ceÁ~*¥äLæ£~13Jq: §;ƒ›žS¥d…Ø‹1ñÏÅCÌ–øرÒÀvÀ ‡|z¸çù-ÎŶ½<ÑÎÎbKÇÑâÄMÞÖCã bú ÄA—]Šó÷wŽ”û·Lr·.2Ø;W‹%M2_ åͭØ1HUC ¹£Ê÷IÍöXO·¿Ì‘¥e!üÔUR7¡ÈÍ”þŠÈÎ ÉCCx(åÆšŒNZwoe¸õßW¥ñˆºÄÖŽõ]¤V”„K=pèìF-ýBcTØ?—²SØh•~Ëê×G |]¢_çÔ¦¡Ñ‹êùâ 5þ•:b~vqKëa„üò+×¾jL•Rx²Ð‹óµ¤z—ó†ivÞbêîEg·¤|vùÍc;\÷Y¬ÕhKrì…ÇC);̯׋/>‘ -éR"ÛâíÉP0ôˆ5 ÝgHNÎK¾DÔô'ž'ƒöcKÉ߀Ńüî×qéè*åâ]ÓŠøŠó÷_3òèÁ^®UÈBý?¹]@ª‚™Db+úŒøÛÅùÕƒ³ZÈAwSX¡AÕ¡¸“UÒ—¦þR…øçsÅ~?3â$fP騚Jƒàª¼¦n¯AkÕƒæÕî¹×­g)EK<Šb)¼ÎQºñAüéPêïÄ_&X¢ 9”N[)&".aÍ—ë ³Qdí·‡$ÍùÀÐ+{F,™©¯H¹ü˜€ê≀MòB» elýéóÇìÁŸÍ>ß69(ŒmT?Eb3i­S†‚‰ŸW¤ÐO*£: x«ÜÑ[g7O£”¹H£Þã¢ÈñÔâ¥+Ÿ¤(÷y³9–Ô¾K,8u;í,ùb(|Ÿ'h2"ЈÚõ¬™I76'|p´¥BV^Ng11; ÆFçßs•Ž¼ãúvHe…b‘r Ú?so<á ðÈïߪ½n¬£ãêe&HÙ) „ -¿ø y’Üï@C|—ûŒdP¤lH;ßG‚›ù¾^l¸¯Âî çœeΓœ«ZÑŠÝ·v”• ïVàåÓƒÉÒBÞ7mÕßTð´&¬túúYìJÕµVï¾(‘І¯–v0’@´\k䋛ܧ? UgR¸Ò.šÌéi;Ï„òdàF]hj+wÕéî£Õ”ÜæÆ݈bS‹áQ¡º$Ï‹‰P¯ äû 0í#(w'„ï0.q`o\¯«‚ü|ÔêB «AGªL)›˜‹¿TpO½AÂ2mê“ -L¸kq±¬Ý{k3I;€]­÷ߦ+BÅÙº¹$øqcZßM¹æ ­oŠKÃݧ™E5‹¼ê: ìŒUí¡Ë7ùAÿŽ¯ØžÛ!șZöSü6„¼H耿­7¬#0?«Å…ÕîµûÑ®+ÿ¼NïÏ[l• Ô£UΗȡÝ*™BÞ$©X´ïl,ZŸIoöŽxüDG†ogÙBŸFëô9£ø‚:9š˜/c(hP9àê)—ò)íñ`}ïG i•À¬ÅBôÊ¢Ë\˜øÓp¾„Sp"“WByàœ8˜Ä)·`±:Ið3íþ¡ÛgIU%ب,±:<‰ú§!A©»KrIpe ¹=£'M¬¬„lg¸‹>G« Ï%AEúazzó}DÉì!rž3*äslòXgäAÄöÊ@“«gy=BÓ@Rj«m¼zEè 3Pu*%Ž½‘Ÿ°êØBœªÅ7û«¹\ÀòöFõËp3Ù¶G1œA%´/ù†¶Ÿ¦ünP@™î̼«ùgšoæéšž±öö$[¯/¤^’ý”óFú?¤ÖÌŒŒ $“_ÏxÏP<,õég/†qŠ]ž³ˆ¯g®XÙÔd–\ Á³3Ÿ«Íë™lD\‚kˆXG»‘6¦ÚT¨Çz)æÂ]9A»³uÝ hxQã£ÙOÏÿÒÜH1>ØjH>1TõKå/Qòy¸ýñ]DaÔé÷Ø—ž<%SÒ&þœÖ-f€«[ìÂîømuÑ(v[0›Æç©j¹aöàÜœ÷`í¸lñèFRGèOi¢@šZkqý¹|gÚèhwY£*zZgüoÖÑEäÐVV Ñ$ûwªá-)<2rè=lñ.wç+<šF³Ï°º~aQn·ûÅè¨ÁÖáÞžñ¹Åý¨ßõžž$sPa¢~ÎØz‘SÜGù+ÈáÒ0fNnëBÖ·gP&£—vo)TB?Zà¡b-¾C²cnK¦“¶EÛ=hð F²>É k=u}}ò_tï]³JkIAó•a;Óã¸u#`*ô³vvbžÜZNMnGîgñ]¥àõ/î1¢4 ÛF@3ü*4”ª¬dRØ_z/mÛ¸TÒm\ç›2¦9);¸æÿÐåKÛg4—Så™Y-uˆN}o—JÌý2ÓMÚ¸ëT•‡z-ßdžÀÿú½» cXÆ7)„jËô×O.Eûbî4&ˆüÜü͵ÅÊØ×›OÊÑfåÝQOT<„®ùÜû ‡eJ‹ —çÓ'½D¾tgÃå„ãLO†ŸÒvÃôP}$—´1ÛÇøŒF7š*H#[ˆ_@[vTr‚ûJ§{Þb®sÆLÅZRé_T*ê°òƒvq5-*κî ÒwŠ¦lih¯†ÃC‚ÛËó ¡¼Š›¦fnJRÒ¡e³mfåg¾6¢+Ù«žæ¡ð@禧·_»/ù3¹‘/ž¨¤F“s|ì–Èú­ºŸÙ¼ -™]‘á‘ýËɵWo³î_¥t'>”þ2œ#±n€dzsFKKDNû…Xçâ7bÀŸG!Õ³P{ª7»QLGáEšÝfÒ;EÉõ&cœÙ—¾‡e_Íg;.~56QMÜ!ÿ¢J}öýÐF[Œ?uâá©7—GðrË<ºÇ:B@z¦á4¾˜U~Ç=´î_ –ÁË_§Ú× ñzä=]G1õ¸Ôotvð颶Ñì©…WÄ'tØ*K×ð(o¢_MN‹ŠŠ¨1bÈ^£Íò‰Ù4+>c×BlÚ^3ÈÅpg=­©Yp¡¶ûF¹mÓÁÿ|Im蕪Ȗ‡³ðñ9ÍÃûðüÞöâjÅ*ìÞ¦RL//¦íÑÚþ -­Y÷8žÚalE•ï nU>F—øio¦Xˆ¢Œ(©–h…XÝ”OËÆ¥ -—OÎÏO?™ßÛë¼LNAíþÀ­ŠN 2Aux×7òÑfHÊŽ†.·§÷¨$`ßñ.®Jã{'ú…9ž¿IÂÓÜCôdɪðwor˧ƒ‘¦þã[ ’›ð gÕ™ìÏ.hGíYû·G®“Ýái¨É6%ƒvƒbsÞñG‡›k2gH’UÁ!sÞ/_•5má¬ÁˆR‹ýÀ¡í3(£ïá³>EÂ$önËFµ×ªl ¹ \í…Ëýàây¤—5¼Ý¦I¦Ö8ÃjÌáú±Ï”÷)2k -”ûùvI<9Ìq‰ñÞ²åðΩTŸ­¼NwÕÓ*تzŒµ&UlÅ¢z»"&£1½æ2Ò}¥5(Å7i‹¯)ŒýÅh_(6Émw§ÂÖ¨íªýIñ9fLT¢/R3GÇZ×ÏËõ· -q¿MµÀ|L >c…;,q[á–|—ç¹uC‚|ÙÌÓàö¶ËÚzBja7˺[ˆB¥õ¦bÈðJ‚yîyN/t”Ñ”Öë–_szo¼í­jâëš&Ÿ£‹Oï8_. øÅ -ƒ[ Ö…òš‘­ÊžãLˆ®g͉‡XJ‰áÞ©²õD r -u i*ª Û ±Ó•`èš16ÐJÞsµ•¨œE§Àc»dváM>ç •6#éÄé4U¹ƒ\Ý>~¯ ø’V U|+P§nõçŠè+²ÿñLRõ̦ۢ$"F}‚!£ñزîâûÜ…W±Î„¤¹ýÀý¨Í©Š-]š 2û/½¿öxO¨5,Î#R`Lí¢(£ÏÒª¹c¾¥¥çÀ —ËÖu -0W‘ üñ4¨N$Œ(sÀšŽ:‡þ¬SÖê¸F¾ažILW5×psdéì,tQÓŽB÷êÛËër»øNåWÙÛ‰±ê¹=ÏeÛák>b‚åíh8 èÖ—oʪŒª¾Ô˜g¼¦46ý"Þß4Ñ >Lõuà(”ÞJP~ŒLÔb|ÍÌWŽêí¨–ä÷Ð :a­¯†Ci—¥Ñ([ÜwcÊÇ©«1ÌNqEÊÐcÀŠª= -¸2u¯1œyfïrv:®"ŠN’ú -`ø>ÀU.éÓE ^Ö¶VN¸â¡ú"ˆÎU6\aaÆÉ×6Ë­ZWBé~O¢„!bk_C74òô˜×f7£7’@¿¶SX™"R^ õS-‰ŸçŠêX\…¨S"º€Æ½ˆÅr¶2I­ŽªnƒÜ†£`µ+!V ¬öAlÒû n¢*>[ eÕ¶ó§Zx.¾–WƒBZÓD©Rõ}‹ªXæ ”‰XÏ¡¿»Ê5âÍ0AÄJôíð°ß‚™Ô5r÷ômÕ.k–xß—þ÷:~ àŸóøÞY>$ï9¾fMàôx+íò½âà?óÖ©|°Pâ‘òŒk,jzt<–WâRmüžñ‹Â|”ñA2Žèa¬4½3Ä#ö]η&éÜøöª -Wö¼G›P*ÿ¡†ÿ¼X6¢Ù‰}µD#²é ›éáGÏ`§Õ‹O8¾£wdã7RešEoæw6¶]ËGØ7≪žR áÇ3æ‹…lÆS+¾§‰hã5Ø;ÛÎL"Ô·Rlj•“Ìä6ùa„¶uðÊËR7NQ~Á驤 ¹7v‘ck`ì—+¹èðKKÊyxóHCÑìÝòl=—Nd¯·•d ê–ýS’K8”¤1fØÅùA?2ðen(ø‚ËÄž‘O)u¦gGêMSéÆåx.ŸS’°ÄdÑ©3»}ŸK~­fó¯'¾IÌ•‡ïNø6´ ɬQ]žuÎœò(“ù\Ô:@à]4î±ýóõÍ‚4!v¥\U Sþ]þx|2¯sý»Ãâ&¬ö÷´"ñBTÁkä *¤›¦ñ9Ð4³k¹=Ú¤³å˦\sÓö”R -ŒßX€É’ßeiZæãOY³>4_r7è;«}}3éá~°(±¢ÜVS”ÿ£â`«îi¯à’¥¤«¼.úzFÑ~ÃO/µý°^bšÐÁt>Ð,7:ȶ44¢/ã[²'¹Wçd¥C˜!¢<É&n6gIU”ÿ'TÏ4“ñ gZåèüpƒAé\Ci*äí’EµîÞÌNÊ%ú_RæÐè$#èÈŠ‹“‚3ø°gÑݶà ¢k !u~C©3½´ƒF¶ùÚ_ÀDÈ¡[³O`€ï«åÎ<6$YÐD¿îóéÚ&r¬qõc0’ììœõ0íko½­«îqÍÇ_27û8Ç)…K½j¼<õY¨é•m+èt5Û”4¢pÚ„ú4$cõr¡ŸØG™Ï“QR_ŠÖ]° -øé3¥jÎ1T`X­«·þ`:ùqø¾qÅ#JIH“›©÷–ß¿TQÃ=bõ²â×+ýôî׆ûîè¥Ó9Ü’¹†ozýà¦J®Y–¥§Õ„–Þûkû¨º¢!Sš9Yy¨­Óã€åäþÌG²žqÉÑŽƒê®¯³ù·§!·é‚ÃÐý³Lb£Ïw[dHÄ¥¾gÀ¦ÞŽ«ƒô•^™îNÄR¯P`ƒZµ»¤Mn_eúªeô «´ô‚ê -Âi_BÙZc7S¦S2^?™ w·˜™>, ›7<ËQÉW­A{¸3ÕZã8ÿ¤>I —Ò'Ü -Ê3 ¤¢ú! G©Õ9´®é6é:sBº¡)w°«x—‰îÏ¿Åœ¡¹Ba~ü3Œµ^—b«¾j­`,uµwªH,cØzÑØë€v::¹«ç©bÐ&„mæûÔµú.q -uÉÇuðVdQe -u7}™˜·€-H¨ýnuY>;‰ídŸÐžuþUÌðöZ€cû¯ƒ‹“(Ð…R"±87zÚ@î{cCTsòúP•WNìô}¸Â·ùp³w™®MÜ'r“VŸ­/”àØ3ä:ìž´e+e:5<.ðÔ[Bó¸Þ¼¦Ehž|ãL’£hV Bôf'[¯8± ‹V1*‚ˆÕ‹w3´òbg¨]^´.šñI`䉹†ÜØt²z¼ûœ“v„® Kôõ¦kp_ðbN™ ~ãDhõà;h ÈáÊ=Àú_¾ù^;N£îÅUxí”Ô -Øfm |…Y*ÇÌ6¸ ÄøÂU:ãí7rà­©ÿ¡Aîؽþ{OfÛžæ‚5®ÍŽçZoò{;.{ ¸cà#×å8lçíÇM4;?ëyÐè½®òÑp﹚0w•5º–÷;»æ ¹'$ï ‡B¾#8a»g}àØyQßÈø¸+±Çþ¬‚HÝ_³yµLâµÁiL/ Zé-OšÕ‹ð+Q¯òŽÇàë-åN) Ýô¢¾bì5`¡ªN¸Kܽ±b8X! D-¯›b!¸DoËv½XÜ$ý€Ò§¡q -AJ]BÕL°•âÓ(ŠÊž¥ô¡ŸÔ=œs[å“K[l>Sz-yæˆ$–;ô~2\’eÉçzkÂ)üb ›úNŒ»s¥Ý)+!iðsgæ[Ú¸Õo%IyÎ%ÝÄ,ðœHcNx$ú•r¸XCx†¼sãÓ©mçÖÞB[Xb²ŒÓ9ç-œüËQª¡”¢¨ß•¤_ª¸ñ}n F á‰éóó,²î2+ÓÖ˜Ö’¤[• ÅF°á÷ßÔRZñ ìÊå#D¼W<ÃîìÏì¿¥÷øê¦àzyÕúN¾ anâoêDƒÒt‹KºèG`*|V¹.s,žÅÉØ·ÏBŠ÷B¬Ö“A)²™ÙûU·É{+6Ž¯Ž1%1ÏÎT1ûp§§NÎ)šÔEI¡¦0){êJÖ‹eHQðŽIXæ3tH¹Ú0¿Vï|àòyvy0†ºwxwœZæœZ -C%óp©ÔѵˆÜyFMY‰%ñ ±IOŒ°5R]¿“ËRƒ€¢}¢ÃàöΗì"’—`¶8VÔqÍÓ±ÖuOž²NÏóÜìf$çPÛœÉj5ÙÃK\ª°Õ•–CêŒç:B&Ö.~×u§†fDF!û­Òt?fÚ·"I:úÈsosû|uE€Ô˜ÄO9bzX ¡å`Ö`rMćTò2S)½Ñ`U¬¼VÔ“¤"ÚzÌêTà6×Ø·dªFÈÇÜá‚ÑÍ{)D…‰œDÝIKLïSZ]Á‚G]Óžó¤ïv‰b]ï>¸ñ¡€Š¢‰¡MÂðÓ=s÷;•ÀµdÂVx»Áw¸"÷ë–Ù‘Íæ™Ùký!vJhz{¥äð(gƒ‘¤ê’™Eš‹þùÆ¡Û*×~ùå4öhsk^Ђ"ÈãùŠ‡ÎÌïÆ^Ó®Q}ÜBÃBFÌ.äÁ¸) -BŽL™(/÷ÅH²•ÁÔ—,“æo÷Ü7̾è%7‹X:u ‚iÇQµ,>”Œ|ߌ³Î…sU],X¶>¿€Î‹ÛÙësáéñ!ɵ: ˆÛ”Ôª¥Œ)"ìa\2UúbÈ«Ö2,T‘oZë±L/ ->XŠ0¶X¤ðÌÇTÃ}›h"OõÁþJ1ZZž†I¸–kšÔóŠÏæZˆND÷=Îö¼ŸœQ#¥“Îï‹ÈÍà7° Z€£¸:>S˜L&F½Ïѹì›ä©ž®·ÈL;:nÿYªÍþe9£™œøéSz¥ƒõ7¨Í¾ü sÕ! -¼¿•&>[‹ÿ²rå¼Z&€í&ïÙ@îê×=c{¯ªï -O…¿²[üŠh¸ÔU¾õ÷Á%†_k5#½»ëìÀs¨Î‹_œ|ñhý<Š¯ï º¯Æ=3ðžÍ#¢}ÿþ«Œø¢FÛV}ù){@ek©žÕ×s -©…d^¢1êgûl²öpûVøcO²Ÿêß”½?;n)t"mC^>jôûAE=\»ïWVa0i»ðÎ#Šˆö}PŸçͽ˜©|‡'U“LNu¾_ÐêK¹“9¥÷hïž²Äûš‚9x²5ÝÔW 1)o\úÍýî-Û2‡Ù¨§âvÚNŽLð?6ŠÝù]ufɉÐæ.Þ>žkk² ÷Éóîkg|ƒ,è+„wè}êߥ¹¹|“¡@%Òš÷‹ #'QXumdI9üXŽÊ­»ïYSvQM¼cÔMžÉ¹€M™I̦9ºÄð¡Ò9O»6ÀêµÉþˆëŽ­•'QýcdõOñ½ÐzV4x¬èX¨õÎûbL^ÉV¦O9ÁŠ«x5øaþ#|ŸÌu&r ‡îõhS—NÞªž®,| ùpl˜wÊÀúÝÜÄË^Y„תIË?óîX®¸çMOªX[ÿª|—ÙC…mÌöÏ£ >¦®¥fV²ÒÛ¡òÃ%šj5êñ„‰"eý#˜§;Ñó8fëßQÖ W~Ÿ0*úB1uoúÃý¿hÉ¢€}¸‚á¯MÉk4#÷dÐc“¹ŸÿÒ˜Ãø„:’˼@›ÏW³>û’:.]m·Œ“ºíÖvÁm´ŒÐÀ2SåÁÂ[–#OH#ÒÖËŸ‰àû/syŽPç0^È\ÿ†_ ó!NÎN1y‡E˜róɪFÔ¨ -VŒ¤#©æ¤[Qtè{a† -’³ÓâåÚ*§4”(Zî;ÀÐÿ™ ½!qÌÕ{ñ‚Ò1útœNó›”vID©8Ÿp^¹V—èÉ1?ÚÚƒ­–,ÊßV#U-ƒ=GëÛN¬AŸ}оJÕ‰‰Åî3UF"œ$1OáÔL”IÏFYªkøt$?ÒÍ.½%üÌò!ƒ…rI;ÚlÂà~=Ž×‹Ù©w¼,(ûÕNÄN?¢[†Ê\“c‹Mé×Ù¯g&àïï²iµ‡{¶Yîµ¾ŽDLàï°2W¾N—Vàè²¢ -GE >Uíq 'ÊÝ¥ª›?:–V·kÈiÚ¥5Eké_£î±¨]‡ªX ¬+ØU|u‘”“tpÀÅ»u.Ì ¼uÏÁ³Q,ßhœL*‹d` Íoj´²N/º ^Í8~x ÷g”¬¯–±b1aóÿð…öÿ ü?QÀÔtp‚Ú¬ÑþéL¶öendstream -endobj -965 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 1960 0 R -/FirstChar 38 -/LastChar 121 -/Widths 1965 0 R -/BaseFont /OGTSKT+CMBX10 -/FontDescriptor 963 0 R ->> endobj -963 0 obj << -/Ascent 694 -/CapHeight 686 -/Descent -194 -/FontName /OGTSKT+CMBX10 -/ItalicAngle 0 -/StemV 114 -/XHeight 444 -/FontBBox [-301 -250 1164 946] -/Flags 4 -/CharSet (/ampersand/hyphen/period/slash/zero/one/two/three/five/six/seven/eight/semicolon/equal/A/D/I/L/N/P/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/r/s/t/u/v/w/y) -/FontFile 964 0 R +/CharSet (/bullet/braceleft/braceright/backslash) +/FontFile 966 0 R >> endobj -1965 0 obj -[894 0 0 0 0 0 0 383 319 575 575 575 575 575 0 575 575 575 575 0 0 319 0 894 0 0 0 869 0 0 882 0 0 0 0 436 0 0 692 0 900 0 786 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 559 639 511 639 527 351 575 639 319 351 607 319 958 639 575 639 0 474 454 447 639 607 831 0 607 ] +2078 0 obj +[500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 500 0 0 0 0 0 0 500 ] endobj -1966 0 obj << +2079 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/dieresis/visiblespace 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/dieresis 197/.notdef] >> endobj 954 0 obj << -/Length1 2243 -/Length2 14621 +/Length1 2224 +/Length2 14366 /Length3 532 -/Length 15858 +/Length 15584 /Filter /FlateDecode >> stream -xÚí¹UT\ݶp‹»»SÁÝÝÝ-¸{áZ¸Cpw÷ Á=¸;‡à ÁÝ }ûœ³“}þÇ{Ÿn»ÀCõ±æš£Ï1æš«Zƒúš³¸¥³9PÆÙÉ™…] ©¬©ÉÎ`gac“@¢¦–ÍÜm¤ÌÜv~~€¸ ÀÁ`gàâÿ!Q$]|@¶Ö6î:IúñÄ [ 3'€²™» Ð<‡…™@ÃÙÂèîÃwp¨ÿs‡@èy-YØÙ–¶îs µ­ë?NòNVÎÞÿ -[z¸üÏ%O È , û—&=,iéìäà°Z!±ª8ƒ³Á.ÿohýïÉe<TÌÿ™þ_•ú¿®›9Ú:øü÷gGw  ìl 9ýï¡:Àÿ’SZÚz8þï«òîf¶âNÖ@Û…lÝdl½–j¶î6wð_a “åÿvWî_¬ÊâòújŒÿÝÔ]T3³ur×ôqù÷¬ÿŒþ³ÿapy@¶Þ6p}ÙÁÁ¿ÿóÉè%“v²p¶´u²ppóÌ@ 3$ðö7À`ëd ô½Á¬,NÎîà[àš¬œAHÿt”“À -¾ì`æøOü¿B\VWgw ¥¹ÃŸ 7€ÕÉÃÑüŸÎ[;ý óX-Ì@B¼V Èèäþ'Æ`5sGÝÌÀÕúw”ÿ¿ý×.ùŸ0x3ÐÉhõW”ý¿£ÿk0xf·¦p³ÿ/ÊÅÁÃíO¼$ gGG³?ðzl|\l€ÖÂÅó/q[ç?†\൸9˜¹Ùü‰€Wâ 9ÿ €áìü7sƒíݽþ\ç{»Û€€+[9{ü©7X×ÊÖó¯`]7pÿÿÍ`Y7 ç_®à^³ÿ£Ü`U'Û¿EøþY³ƒó_7ñÿ3£íFyÀÂ@·?Åâ]=Ìþ4ŸllýÏIü#ÍÃùOó€nÿœN‚`Qñ?–”øC`AÉ?¶“úC`3é/ØHæudÿXEî%äÿ8»âgWúCàìÊœ]峫þ›øÀÙÕþ8ûû?ήþ‡ÀÙ5þ¸išì¢õ‡À.Úì¢ó‡À.ºì¢÷oâg7™YØÝÿãa¿XÍÁáÿÜ›üœÿýŸ ?XÆ|€Ü,œAvø@fýóDðƒ=ÌÿØÃâßÄÎ.Šå_øÏù ÿÙÑ!ØÃú/Ææ/ËØþ…àÒØý…`'û¿,åð‚­þTìà3•Õé/[9ÿ…`+—¿ðŸ û‚­@á?Ø_¶rÿ ÁV!ØÊó/[yýA°•÷_¶òù ÁV¾á÷ øýeçàú§Áùqpÿ÷¸ÿì,;ø›øü³°µu·u°ü¯–üß/# go?f.3øçådïq¶€ÿ¦åd ~šå¥Àç'Ç¿¢ ðëþ¯×?ø5÷?le ~'Þ@ ¤µeg Á0»ÌÖˆÊ@é’¹*XH ë¶$•æþÅäÐÕdH‡òIEW†í&ݧêl´°?Ƚ^ˆÝbºýßOËœ‡¸&e}ýýÃÓôGŽo±îUŽ²Ï Å}è1zWëÒÍ 7¤êÂö—Ê4½Ò‘ü‹Ñãb5:)ÍŸð›ï  <[rÃxxuer´"Ûh8ß©cd¹VFqEnya¤¥Àl͆ÚE"´3n\:w{`=• ¥þ6x´€‹ýÀ!Q°Ú6k'™ÃLÈ·e(eý¸gD€h.ïc¥6Ï­È®‹]êtZëº_ï›û¦ÑÙ8à±ô²‡hÎ0MøsL‰~ŽßMç¾ZUæX@º­FÃÞ º6T.œã“ô ~šh®ê)1T¿4“¶¢Ó÷Tq&”ì3Fk8~Æ\¯í‡6+À¡ÝA¦š-éÔ+©•4}…aÊ”Èn ßXõœ7}GÉo˜³™8ÊË'.‡ö¯éŠ©÷¹©ŸÉðú馸óïÈ%ìÄìP¶,h5ÒË «~!|gæ+œgxwh›íSDU™&ËRŒVç…hØ‹ŠYµ À¶æ„[F -BzÄXØ­‰((‚Œ!V¾W:g{wòºp­ # H&ø ©>¾Pú|Á,$3è­$ÚCç²ô’1ÎYØüL!Ÿ¡~u´ºpl¢â“¦£ørt!ò먂?‘Ö©!¨Ã{ÀvƒU!à¹Ìy¹>Âå˜Gr;qò¹`3TÄŽ•¬Ã3S][Ö_CMjk$ßM^}~h›ƒôý4¼%æ E®9gö„ðÏ5n7…õu_óÌ%…¯"%:sŸ_åû /_Ñp;ÙT+|øYv»û¿•“¹7¿ãC¬PIU¡Žº“—ývŽë3¥Fš¢•VìCÈœTLÊ -³¥GªŸ*û|‹0õTÅ5Ž¸(x*ô ¿º… -×÷RlFØn«(ë`ýœã”#ÒøèÂøI“ÉîtÛ,ÝjǨ VFe #çÏ5Š4>WÎÐEË…KÓ’†ñkÞÜR^ƽŸGòUug#[ßVûlä„„ßÑbWwjN…ds°Tƒ¾Q#y"¯ƒ,aÏ÷AÈrLp")=»–à Lêq1¦|X´3½R¨ý\ëk…MÍÙ=u{ =R Ÿ®¿g±r3sÌu¹¬ÐpÿòÐî†<\Üq\îüÈ´œÚz1òX€y¥Ö÷+ÒÍ=ˆa P rÝÄâ¥ï¯Tž÷ê¿ŽQùܯºO+Ãß-ˆÎ!+Ú®/Ôöd¨ÌUŸ;¸µ®/¢1©™}w:àùV6Ÿ4Gw…t‡p»õ¸µCæµÆ{Ò|’ÚÌ »#¥¼1¿iß+–µó1çîIà»”)*RµFóÔ•“Vˆ’v’÷õLŸJr¾Éé#Í{0ß%j}fTþ$ÎðéÀ¥ù«ƒJ-_®Ûsÿ'ns J68üØû¤vÜÏY1?<½úòÃ3b•Ü"òÕýÌe}§99 ò›Ïžo™3ºé„°ýðž¡Çƒ/>Õ=òͧäA‰þäQ²b³½çá¨ÀÍy-.£ù0z,sîîMNÒ^¸Xü§óh¯wùYÞn üÁ „DD¯Zt2ÔÂcݳŸQüÝȬd² )6û{){l’@DçDköù;=©ä=-¬Çè›s(Ëå‡Ú¹*œáU«üþB *¸úâôGåM~¯‚$¯ƒ¤w¸)Ëg„Úü†pƒ—ÀãÏå³m^@TÌôPXïy[-šÈ×ûŸú(ÜrXéYÈpc¸õ[Zã;¹§HÞ¡òlŸ™ŒTôÒY\W¯ÎÍ=΂Kæ >G‚0N0TUžvû+— ›j» ÷ØÏÌPù{v„q…‹•Ý°™9aGÐMp½#Qìv1Ï!Q{±ÖFo â4<¬šf™ísÙ Ëôó—Õª§ü§vâx]š`œ´Š‚XXMšúk'iy㊘µ.6AÝ N!Èõ—S6 h¤ëΆ ëSšïå©‹ëC]©§hN÷ôˆKzU©STœäkð0WrΆXnÙ#P÷úgE´4Kó ¯zòº±@Ñ…n¾°¦‘Î?ÒTRŽj9u*ÇØ»žDJLù2”í”\= tCYw['ÝŸs`lC$”½_'ÛóžÌ)U»•m?ê.Œ -—8[»u$—¶uEüFGHƒÆW:X|ba’«ƒaåC®GŒÀ‚ô=8"ú:ÅÖ­¹ûä¦ -Tçð¤Ý8°ßÅ(ñà9J$œÿ`i”X Éô"σîUäï›qEÈwlòûšG»)±šz÷Uú´üH%Bì{ÍD H¶3÷³˜O4÷YZIw—+óÞnŸÜ6-²=¿§Æ%|Ä%•Õ‹A ¨¿éýZW{¬ËµwƒL®»-l¯G¼ÖòlJµ7'§Èù‰´”†V°äÖtw©U;Ë>‡æµ¦—ç¤ñv­–û…X&Î-T]7>c0C(TB€#9 -€:¶Ò[…<~)îï»h[š+G$h/hÜ;zÙ7M•L˳¬•¸²+½³$ŸÔ%X¥þÅÆ%Ð!GD n/ƒ+=}­6÷/A]½ß `íšçúa:Rß"z{‘½ e~Ò³¯…´¹µñ†tÕbª?÷ñCzô*BÚŒp¯`ÍQùPdšw·BÅXts”x#E-}Õ³©wâ490"/æÖ¢†N ¯j›_¤°<ô9Uœ·v‹µÁ±B› -«ÑÄ -üPÐÎ#_ŸF+Ú( ªË÷­ßCÐ~IMXEÿ -ú`ÍÏ5˜õ¬¢HÛÍ zøöq¨l¦–ÒG¾ÃgC((ðŸY=Š_å$$vÔLö!Jt÷Ìض²ÂYóÒ©°£„ñaÙÓyý«ßˆûû0‘p–¨/k_óõŽ€s ¿¯^Žqð™¾t½AÖÚxaF9$ѹÎséÈA³§Ÿc0ÅõJ{ðZùÍãv{öŠâæ 05º9:ܹ§¤§e£Pði¹<ï’íФîýåÅyÉ©îüöZ´ÁômrhÿSh6G -cO¬bÆ€s!ëÏž– -¾öÇæ¼²7ÃÎrÎ(tlFè-šõc³E›ÜÌU3&ÙÎLd?ý/ -Y¯"måÌ)E4?êÔeÖè9]1ÙÔ.ª¬q ñXÌŸÃEº3–®LU)`G8½ZáÈÞAÌù>TÛp¶Ý˜k¹Çìp8úOÖ#&‰ãe'­‡ÉTúc)žÜ®ø›ç¨|Ý(ç¸'LÃÈاÌň*q+e#€,r”mu›Œµ€fߨèG?4¤¶ëN,Í|»Ö±AoÝã뚃CèË¥›&s¦"ëõ6r±¬S@å÷ߚƧÜXŽÒO9j6e‡…Lƒ¸½ÆeL-ÙðMÑa6ég8jF{yfÖ–¤f -ˆM}GpE9ê:<Ð-׳$¶@$2&Fîò¯¨¥nm2³¬z2r°V•Ø ÅêAÕ#2we4Ñ™¤XÙ³§Æ)²‘ÃN¬Èó7ŒS› 0èÌäÓ}ÃîܲáçÒÑïQËUªEƒ«FÎLœEö­&;LuC×I#÷DG—o;òœOËB{]eà-×=!hUwê½dù‘î•æD6&Þô—1œ¿O#­…¤Rz;·åÁœævñ”rZ÷à¯õb)ÿ!‰»’'¡§9§„r–¢GKt¶$Eèi°FH—V;ûU¤ø”ÝU!’Í}Š X€²‚~’\2§\zš4tšÚ”zî¼. Û&žør[eE³TK²¶Rè>õ›{^‚®ç›þ½ÃŽùÙ(·²’án? ^‹:Æ°j2˜cp5$K¿BÐ!ÁdέݭJнͣbì¦ÐHàù¬¨ðiÔÆŽœžpqÃ6©’»D´?ZmB…bâø#›ÀÖˆõ2t#:úøaÓ%Æ©Sé¸V#dÃœBÅ~:ÊÅüÈ\28ÍPÊ‹ˆVˆ…Ù._d…GjîKŘ ßœÌcâíp™Î‘™?Œ¢0–è$Ì`Ȳ¬·ç, >Ï@Nª´ •Zcì×lå;¬! iXØÄQ.o"¦¦ûiówìÎyd›¨»­¤tžÎò”QÂ]ì´åâU_DŠÄüäc¦.ÐåM£&}\ù¤VaDl1²çb O #Z'j]{M~jø®¼’±~{•à;„^ Kü¥D(²—Ÿ/éÁ×=¹Ê¶ÅL:VOkÒrïKÿ}xÒňÇ%鵧òKRer¹ÇâŒUu­Â *F}•v -3nŸVô$Ó]Ã*ÃÎNö:Q$«:Ûõt€³×Ìê\T9ä÷L­è×J -Íß3ì†lǃˆ—/=äØGáYñª´:ÌøŠw‹Ìû%¬ƒÙË7êÁÚ4«xÚúš «a‚P¹YבSæÅè¦æR%Q¶¶óHÊé&ÖU«1 ^Gêó܇ŠnÉ_ÏLçGÍ” ë+®‰•ºì¿"’ËÄjüyL8Å*jn6¥ÍïÅrò€gãJ$~®¶¶=î†y …˜‚»¤{wå¨O’ýŒf:²GÅû?ñPb*Êx5|Î)j…–õñº!pª¦ùMä¼lÈ/J+#oížÃ¹q -`[;ñÛÍ8£ÙØÞ%Q–¯g/F{$†d*Ê—ò~b0…&‡h9uä•17´â¤Yø½M³4³ÏψP}‹9¸ª›nדŴiÕ×eç£t - €Ê´" Ý M›*Mla‡˜9dIÞDÙ óÂrnÖÜÄÄÇìþ²Ý­µ´°]·œQ´6,2ý£)qr3Hp O÷E¦uHNwvxÉÇï7‰Âó¥¯I^ð¶~ȱ*Ú.Mz|ú•^E6Œ]XǾ¨ZÃѬAÈ,fŠxO$®uó¤]2Nþh´À3Ãp±RÛK<ºÜ“9Vœ|w²)T‡Øp¿ÙvdQ9ó­r¯™×N)}Ö¾SJ’£• g°.PP`Ÿ5h¼»À,ý¾K! ¸Å3ÿTÉÉ´‰î–îÎEúáqØ UŒa•S¬ké\Èøþë‹$¥¼è,DrŸGÈ<úª‰­ -Cð}A֚⇡çáƒvó —nç -åhËÖ3°˜xP -?„áÎW ©Hª¦_*¶Ò`ç$6KÞ4î“Üåß×|לC· Fù1<@¼ÉòhÒ&‚@Ì< ²¢ê…pα€~ÿNqñPÖßW.[NÛÂU1òX1s= >ËŽh¾ -«¢Ig.7xþî4úS‚¹÷ò†$ßÝ}g°°• ${Í@½IÉA&lœ’FÇÜ>¤y¹î{bÑÂE (hò1™­#ŒÎ®TÜæzQë<,¤Æ↊®jDõ&¶(V ?PûËCàQM;DÃc&½N7 -³,6<’/ÃqG»WëŽÁr5Ñ›2Do˜jÉYE®óÞÃxŽb‹Ö~)à®o~œÀ®ZJLÛÒIâð¤Ö;†/Âni‡‡d¹§³§;Æ…Z<¨º—¦]UÒþÿ·ý¼AMåEÚ Ô<ç2Šp¥E"äq õ²•ÂøJ4‹ûIŒ©b†êNåÚ×v Â#åÃ"T›j”} œƒ1öÛ>%ïŒÐ,Z2Ü4V\$ÆÅ·@×ÒJC>~'/˜œÏÝ~–̼ÆÎ5’\É -ž"$÷~KÚ7Â2†âœ.© -¸Á@Îüþ’“3$;ÈdtiC‡·]I,YTr5r”ÞغR–†wà ž(Z©nÌ -c!†©3 d0Ž²d°ÙÉTrW‚±˜ Ch ¼€Œ‰ºóI§IµÙ‡…0ƒÉ=4Žf‚Ô™ò™vh.Ò¬%Ÿ^Èý·-™èQroý1ýŒFAª>¬BR½U\}Û›Îë2Ús.ü… -‰…‰Óq'×ãrçgÜ~½Fߨ{¿ìæＪ_#¡$µZµß#DC·Ü -¦ø={%r¢à^Õ¼7“SË ^÷; #÷ â‘NsSRí!&*Æ~ìdEqvþºOú¤Ó@”R>0ª~="s\·7Ç'©Ô·:¼€Ú#£vkêï89ÐÂkƒP¶è Í+NR×±ïoŸÅDóFBŸ4dÅæÌzÈÌ!?9ú©£,\b,9d ‹ì•6ã«ù„Ÿž²³L]qù)®ç:}¶÷ ó™ö´ðÐg|¿ôN ”l=Tû7«Ä²:ý›_VŠ8¶­tH¥»K%,O¼ÂîEV<‹¸–x7¢pø¯ÔþßØžZÝö• ·p€2:‹¢ð¾åUPt$Œ,:“8n j~:þ¥öîahV~2­ö×¹Œ{E…rBøa¿Ìc ½jºnØ«hÑvR©×ákãÂx2°ŽfýP‡Xûå!— iÄHSŠFÝU™)nUkgˆ\©$.ˆ2êºü™ÐþeŒpäCmø$o¤·HŸüZó‹,‚äûNn~o -.»4DëÃ*FƒC±nÐû¦,™¾'8á"Rºõ³ «™}Çwv$Ï!–ô¿ -Ý®’â%{t)sY~/å¼®àƒJ? –û«Êº\oÀö« ÎÁ>´.šóÉlå(åìh«­Ãßš³«Ÿ‹|HN<£¿—Ÿó)”’†Ð z=•}‡Žå[¶”°¢Q×Ù.Çl„Hh0<<º–²Q[8 ë°¿Z²üœÏ¸ùn¡¯âj!F`Àö™×<…ç1ñ Îz¬]œQ¡Zëtï.ßY¡?ADN±3'ŸøQUý®¶G&g85¶v¾ÙEMâäFæ—¡ž¹ÎðêùõíÉ瘣÷ÅŠYq9 ´Ä“)Sû1稈Ïvx%úDõ°æ,­Âœ–)eÇÖ‡—ñœkÂóŒN²xIñéMT6¿í;‹K ïàRÏDïZ;Ü~U‡©Ö]T^\áÝšUDÄÍß±Å'ˆâIð8·#¤œ•µG5éw@1,ȱEÅÃÄŠ,nËPA0¦œByï7Ë‘;½¡)¯Ýý“ ©.™ C˜4øuØ*Îzß}‰Â5ö>ÍL0ý†Q=Dé0OÑVKŸÈõÁ©Ñlëø¾…såѪŽ#œ ‚üɯ4…ÍzðÔÇ~²­ÄSþÀ°¨sìòiˆ—ZjêÖéeeH"!25Èà!•p,Iu´[xíA~ÐR;-ãYxk< vÏÊÑŽ†òç2'B,œÉ‡5vßâ;¶Ašô '\'eÕì-_WUø„õ¨¿ó[£m%•¢ m˜±¹¨îxH-ÄìD~ýpE—~#}z 9ûœ>œ”¬¾FvÿÎÕ;!unŽþý¿{i3#fÖyƒ§ñ"{íÞ¿r[é:>@ìÙ¾)Wó [f ‚¸ÅùMx°¨—ʧŵ5èâ³­:V¿Æö2›dVHŸóømň4½Wº‘º®÷Ôæ^ˆM9µ±=•J†%6šu -G¢²–n"G‰±Ño7á^Pþs‚SìZ©ojlU5‰ÿ°ö R þGs#z›î+ fÉPÞ~ Ëq~1ÜþÃþ"Ô’Hí8ãr'@Í\=*N=jânyåì´„UÂü·Ù¬…Äx">ƒ‹Ì§Kš)úÂƒï® 0E*3è´Ï´zÖÖt-yZUfvÖwfá™BÙŒsO‚'2ÍÁÉsîÇ\_FÏŽÜó -ÏÉNòo Ÿ3ž Õ7»¨o.ˆÞ érÚfß"©’ˆûL³éyfŸ¹%¿ÂzVwÝ[6[ùE= ¹¥Ðó¿Í¶L(i6 „ ?êÙBŽ¦žðÄŽ<)™Ü›k¡IÐ'Ù5´_ɶEäààVPæÙd'BJ"´Y8PÊÄbz§BRæÂ;ûèJbÊÂH­¼áܧÌ;Êu5ûà˜e/"ˆÐÀ2'èÓ„ûÈ ?÷v¥.P¯­ #ÄÔÒé%vÔNÆïîöx¼£­qgÛ3߯WCÒBÕnÝ)»ÜÇ[kž€ÖF.—Íe‘)-ËûDkg¯gu`iŒÉßÅ®Ižs”Ò·_y “·Ú0V[¥å¹Ou®ûÝ,d“Â,®"Ž7¤ÔzÄx«Å,GÕR@aáÜZ]Šy×Ïä`ypÒxn6$DÊ›[rS1Œ½}üŒn¯CYÓÀÍñÆ%w¬foy¿cl±O‚{仂„(Ú[¤™A˜…‘Í›SÂ6*³&¬× §©ò›Ç¢8ÁG¸•]qåæ+SL}^pôc·Hõ^Ä -&Ãý3U#Æé÷iV5¤±ÁG‚7ß\Ê÷kè=Ù vù¯o9B´ÖTOw°u®‹Ù½z)õ¾ˆF v$ Áª.*(~X¹—dë ü¯é6FÔ˜@€Qyäï{e¨°•çÔæù ýí,2Þ¢h¶úÅÁíሡ ¸ŸýrCƒ²’Êù6xjq3ö¯·˜'Á1±©ò;òýn”¬hâv@Ž9aÖ˜¹;³ïÖËH³'ÉÀc²œÒ£!sžV%¬ ©ÆÊÖãÉ]í$G•@6 -?tpï–öx¶š™’ÀÎ܇¸Á¨Þ’vAèœnºîáÜùŘÎÙçQæ:Ö;ja¥„¯ÕýädöPÝ}'°sìr"ò¤œƒò.1x² -lžp› KË\’¶îýYbøôIÈfMaÃm>p'ÛL2!\Yn!í9öÉ_Ôóú§0vs‡¾BWÙê@’¶OÍIý¦i`P`žµúØ× -){pBwcZˆð‹Í[”Ο›¯ÎB<5¯Ø£ÊÚ ãýɵôÌkƒ&;å‹œ¾‹(7×*÷ôè©é&´vvš"·Àá­_¬H5×s‘˜eîǶ»Õõ¶Tj",Ñ\cvIáƒõCFD sêv‚±ßøîè.÷¤A×Tt;mWd;éUª´5Q”˜FÊËߎ2½v›œ+o(Az¯ùvE žÉY'z|bÀ¼+lýк"23|±k­©WÆ‹0–½ðX퇙2Ôv>ï¥`ÉÍâË…œ2ªÐ.Œœª†Ïálóºu=Ñßæ²2±Œ~f°éF¥móƪP_ÔÏúÝ <µY™öîoýFGå^)‚ˇ~ÑH¦8Jõ[fm1_?…½îµ¹V³†Ûש¹ÿÔíAYU-„š¼ÏÈ:q>1ŽJø Ñ ‘é3ò¤õõh•KãñýØji]íoiq/àÒÌbKî»Bܼ=Áfùýùbø|Lz *ž»Ï°¥C³†[áêÙ5]6D4˜‘°7ÒÇšFËPcÓè=ŠQ#1ºB”âŒìà³­ ¿èàºÁºå"[ ÇŽÙ5Áa+D%±Êq€ þ†q!žŽù´vØ‡­–øĸA@;ú§0G\ƒ,«7+zFÝDdf?ÏuJe¥Õ$ôzLIOÆsÖ_[ÚXŠòÞ®z¦îAFÑtÆ®£'üN¯~‹2:)#ïq‡œ>–ˆÄiª)@H9èWA -õMCûÀÈåZjk¶Žw³2ºº…‹mX6»g,œ¡Ë‹›S:™?v˜ákùT¯ÁéÃzžÿDxÔ‚t]?¤ ŽÑ ×QaaÝd‡×ëbîãT -;bZ; ÐI­ö``¦ l^ú8>ObaHoÉ{ËdôHrzzô¾ªcF¤È>-2"O@x;½tF@çz­ƒ?°o–<„ö’²@0òæ`#ß!u;ÆCg’d°’ðó ÿw•Gé“0Ž;÷•NêLÃÏ*W }³|dOx²­»ÙÍ-7¼ÐQΗ'V¢xHó;&‡ÔÕTÓü…×$ã¼9G?œã[ª&ÙÕö5·ÂÐøƒâóù¨f:ö+†»ýA€ÒOþÁ­¡åÃw†ä4–ëIºl/}4/\ÞžíÇ’^Ú„‰î.‡Tð¡ ØœßàNïx¥“¿;Á}vúÖж!r’ÛµœNÌ2q×ÚïüBG>z²°ð~ϤÎe'²«„’Øgð3¢É鎨Ao¿iJð˜˜× åGœ_®ßþnøNOz_†ç¿W4Q›§³”ž’0`¾=úç­×W[bæÐ5~Õ×ö:dBº œÞª=ú%82 -°É­ñÅr=/+/™•OÓRœÍL¶š"¬™”a²·¨âqÔÂŒñœLÙô¯IÄ¡bþüѶÛlYÖïdûe`5>¿9¥”—~(½ÏýááçP ö¥KûÜ.+ú©‚þ:šaî]ÅÖβrßà§Î¸{N9$#ƒBVáCÅòUÉ]F§€M¦Â®—4•;~€·¯k9´Ö™ Ï/ªu6¾F -ûq;¦¿œ"ý,fbdÖÊDX~º½·F'mZ|ïë­XÓWO7ÿþ8»{øðqá([$ÃÅ0YTòíkÌÞ jqêÀ:kP²ßëƒÐzŠJE³i0Bõ/´ðŠÄÀ—~Ûà ™pAbÎçyE5Êœ”oå—až)”Ý%[i âJÚ¿/3%"ÐJM¡ÃœÆ-J)?Ë9—óIMq†»{ÐN~ů,ˆ3K=—_O<ŒÓŽ<0±âDnÞ^ø°´<6¯É':Öku&žž”™õHZª7/ -ÎÁB“föòÓ¶¡¥àô¿v–í•×8½IIPt;×~뤣Óòœæo œ$©Œé*^Tß×X2Ä3S‹WE8o@Ñ°·Qu‰9F-np# -þ½‹YJÝ ê¡ gMtõ|â¾KÍ/ä(!¦]O›óãZGÆÍÆãrQPÕJƒ[.°ªÎábv»úøõáz'ûA6ì‹ö·Ü -6:âåÑE˜>’°áRŸtkË#@ê@iŒ8«d`hpÁ©Dëòxë¢wÿËÓ¸E…io[~¼Å*üZ‰..”ƒó¯6´ÖM -y«OV@ZÙRÝÎÏaŽÆü{Uzsjœ2ÂÏ>ö¼ Äà»K±èak!tb‰¤¬ï‡O,øŠ?–ëáó p7—êVm­2ÙIf¯kvÔg¹‹£ÛŒ3Íè¹DZ0XûÎMï²i¤­ä¥pÄ—.fo3Έñ~a)è Žûø$W|ä1ᮨ£"¶‘H·¯ d€Q Jl¢lvEú€[AÍ`*¨»›Òá‰úfp¾¶ÎÔ±ýÂc͹)íð&öY¼Ô[ˆ¥o{™£ „5«M‹fyM5u´ (?Œq»Â‹’Ëü˜ÁN«‡ÙbêY;e¨Òì‡Ú7ܧ*ä¤ÿr*h¾6Ë<ª!s„÷ul7Pà"D”6ýLOØæaFjǴ­ä§×8åj!‡<ÏE]4'ªç¯¾É•”_éØ®ºüqS‹EuªÁ(‡5Æ“§q_J‡9×>ð(BlÜ•KXBLÚëZ¶“¶¿ÏU§p›fJdt+‡}Þ`V¸{ÅžïJ>/Cè0(Ï,œ}RèCÕÓ1vp—ïºÎ…@ºNå>­_ë…Ø¢2j5+¨{x”@¿RF$ -c u]°qÄ<¢C÷®Ý:Ýx#6fà ù¿Åb¶3dn‚™åS†Ãri·oøcPö¯5½|úH¹ŽÓ'#ñ1rŒ¸ýˆù7kÙÈ÷G uÊA·*yæ7t#‘Ï!ÆkF.lÌ~ùÔt½ùR™û¤è3ñe¯$¢®âS!aõÆ"† -ã>핾}âÔ#èÓX“¾„ó¼@£²6þšôg\‚Z¢yµ{[×ê(ÙÝÃàóØ :ˆ¿ùqè'§§g4’Õ‚F8¶Â°»««7P”äLºÜK> ÉìáËCTLÛ„¥¢Ç ;¾·¦¯\ƒœ2(á2Îfˆ«sÀöYaÔË(‘/Ç òd&Jä€`ê8ä~Ç2G Ý®P|¾„¹w"HxÚg(ð¥5ŠÆ¾E‘j´§šݹ -ƒH²v$±tʤÉ{·ÏÞüŸ2-’ORçBx\õ™7mÌZ¼ÓÚ„™åö1õ¤>ÙϧÂB¥\/XUík“YŽSÈ·Á‹ö85œ†z–ùNSÎZó;]ŽVì¡«¼Îøóëb:V Bößd”vNI!£#¦ìêËGŠÔËÓúvÞ¾e6²ÏŒènú»ÛÙ¦DnÉ÷ߪØùÉ/ ÷î™? q¯Èû@·HaWHaoM²üîÓ -B&`ÑÜpœŠOGTngV%ÁÔº»èxPkàe„õü@ï(Î[Õð‰Éh,Ü•µ¬µÀ€È*zËÞ0H©Ç£¿Òuä³–4ËT.;T¥ó)„u$m“¸ßÁ«"è÷>ÝïŒYµjŽªYäÄ +ÊôÂ&vF@1;[gzffÀgYf&3“<9ùgG ¡³…íCg €™›› lï`á03ñ°±€~àÉŸíì=-ÌÌTŸ©ÿéÄ ¶:ZÚd Í6 1Œ ­ÊvÆ@g€°µ5@éŸO8”€N@GW  <33ÀÄÂØ`4³°…güÇIÒÖÔÀù_aûÿir::¤TÿÒ¤€$Mìl­=&@SxF9;P6 Èåÿ ­ÿ=¸˜‹µµœ¡Í?Ãÿk¥þ¯vC kÿîagcïâ tÈÚ™mÿwWuàÉÉM,\lþw«¤³¡µ…±°­™5Àô_! '1 w ‰‚…³±9ÀÙÑø¯0ÐÖä;€Vî_ŒârŸe¤•hÿ»¨ÿjT0´°uVñ°ÿ÷¨ÿôþ3ÿaÐò8Z¸´™@ëË êúþŸßtÿW2Q[c; [3 ;ÀÐÑÑд}@ÄðbXØšÝ@w0#ƒ­3è#К|˜Ú9ÂÿSQVV#¨ÙÚÐæŸø…ØŒ.vÎ@#ë?Av£­‹Ñ?•7³ýæ0Ú¶Îb\FCPÔÉ´4ÿŽrÿ÷¨ÿµ%þ'ÌÆÀÐhk 4ý+ÊüßÑÿÕ™4²Ó?C8Yý ‚f`oíâô'ò7¶³±1üÉ›{Ø›ÿˆ³qüKÜÂî!h.NÖ†Næ" ™xíþ@“°³þ›ÙAöÎnÚÙAÞÎæŽÀ¿z€”Mí\ÿ@º¦®õé:ŠýoÉ:]ÿr–ø ÁRµµø[„ëŸ9[Ûýõ!±øÏ(HØèôg±8@Æ@Ã?•æ›ýsíÿHs°þS< Ó?WÑŸ HTø$EþHðóÙ}ùC 3Ñ'ÈHìtÄÿHEâ$$ÿ(»ôe—ùC ì²”]î²Ëÿ›¸@Ùþ(»âeWúC ìÊT4•?rQýC µ?rQÿC ?rÑü7qƒ²9[ÿã0€î|F#Pø?÷&7ë¿{ÿç!áɸ€Ž½£“±ãŸº}ÿœn‡Ñyÿ›˜™@‹bòþ³EþÂvô_ò0û A cþ‚d,þBÐÒXþ… '«¿$eý‚¬þÜJÌ  ”Ñö/YÙý… +û¿ðŸ û‚¬ÿÂŽØ_²rþ AV.!ÈÊõ/Y¹ýA•û_²òø AVžá× øõefaû§Àù±°ÿw¿ÿ¬,3èÙÝÆÎÖ&ÿU’ÿûå±s÷¢gг€îlNVfÐgúúŸÝTm-@§Yò èþbbâbeùWÔØÅtá:ÿë­½iÿæ tÃ/ÎÙóZ&Ö}/öÍ(¦1«–«é˜nEXˆ·.’v Y«Öx*MAC܃Þ#r{ÁsúÑâ­8*vîç4û¶çj°—âÙˆ§q•"ë±kOrpŒÔ\7ssÂ.?µ6\§™×›~Ñwœ­@õEef…¬SÛµ¶35ƒSC,ÅZ58¨š‚•X 9É¡8„-xÕ 9.ju<ÀÇ2¶vùÒ®Åõ)6ëç›>Ø£ñ‡0‘Œ…úqKþàz®U/f«áº¸°š‚vFr£ÔŠÎ䊰™&ÛÅæû¥ö‰M妪N°™—-8#šQœý~*˜ n'õS˜R±OJPÇ<¢õe²ÈVNåAL,…¢7Xq‚©ò§@Ú­¼DÊ¢ZÏwé±ÂßÈuAX mþõ¦€a¾.º²UÑŸW_:åNµ¼¥zHcðÁ[DÔßP+YoÚb`ßQÆÑeçNìsz:w®©²ÉwØÉŸ 1;|¨FØÓïˆD¬¾ +Y~ \5¦TŽÏ‡,9„Ý çÊœ¤!>°HöÈøFV'ÎXág×ö ¥dJŠiÑ#ŸÀþ™yj£,¢3 }à¨6¿]l—ìÞ‚Ãi϶ÈûñsÌ®G·üã ©Ç0J&¡v[1îŸ  vÂØ +êeáìS׬é…M5—(ÉðÑ…ÀáQw¥mÇ"Í·F÷NwèeF©¯Ïùvs•ßí9äÁ×¢†ž+_Í»³˜QcÔ9ÆJKÂò;ÊÈ©,t%[C‰JÏ,Rà·Oƒj “d`±&òï/²;I--y¢u¢ÌHÍ +äj«ïNü~AÀì°,G¾ÌN#b<61Éyp3l´tl:×d¿ððcA`Ï“‰úö—|êÓÅq&ʳ o7 ‡¡•n‡M’ŽN È7uŒV:•ÖóØünà*¡÷ý"ã)Ó5èêÂg@ËM)¸`±&'«Žº?Á*«œcO[¨BçðØ 2šiœj¡±W5¡¸––u‘$NŠË5`Úä‡Ô¥Aî¯kÎÔ~bJTßÒF•¿_†RÇMrxW„•w(šöžk埱I:25d¿À©õ; üÂ~±ë¯È£n§&IPˆB+oO9\ðGtMÒÄæMØ^1—Ð\ÂÃáœÅæwð³‹3SaNX9÷?6o纑jCõ§6/›Žáã +‡.ÕÅ\½|¬´YšHŽµs¤Ž6Ç¡@>ãß]ö¾ã°’™—þ¸2Úô%õ©<7‰R]Î@ŽyX‘{Û—ÆP±«¥îP½ßþ$/\óY/Ü•lÖŠå¡åuÀ¹dîHgð—ù÷‹ðþ5°[Z Á™¦+k µ!ÊjÍwþu4¢õÝ0ô®(€SÁop<×y¬Cœ]¤s5^ÝãÞ1 ÒòzÒØÁÈÑÄÁ.˜|Ú˜-³ýÓ°Ze°¦N´%sW½-Á|ˆ‡ñFBù•ÜÔ¥ãogÝa(°cR˜Jõöœêd +®F˜TÑ?%tV›÷BÕˆìÞ¹•'ç¬r pÆ®òØsy]ÄÐ)v£2߆êXû> |ï&f2UB¾‘G¾Î¹9bVù„Й·D¿&^Ѧ”{ð‹Ó˜–TWnŒ¯>1¿˜µG‡Š2àÎå˜Ðû–™¥Ï"¤Gävƒé—s¦éZÙžì©Cˆw æEfß;K´óÁÍw,’·»žk¨XÙlxËÃÏ^xˆ!m…(F»d¾†?f«Ÿ¢Dhú¥Ÿ Ús›zÊxX`ƒgàrÏí¦6Wuí—“²ðl˜•&‘hùcÕíÞ"²nÜñœ%?›'’a +ýúû¼?’J4QD<6Ž”,3èYˆr,z[P©þ‘dŸï}X´¾.¨Ä ž×a•Ð«Àü…aó–Õ©è3 X<™Â¦˜WÖ=š¶3_Ï@ ÂÖ[!x½ Abì³á‡çÐN¶zÁæò +|À£Å³"}zß'4»th +†Ò:ÚpÔ)½ ¾¡ž;7Ró™A‡ÿmY2öu%Ò°V­Û†Ó{^ºiÖEj]—‰ôøv[ã;LX¼²m¹P6Kä#V–:S¥›xmÅ Û—WÁ ¹·A»âÒááDÍŸ{ÔÙNô‘jÊ=¬Šðø <ñ†åt‚©‰œ}IÏ03t°™ŽˆÕÉ^Ø[M3I"¢ÜÌ&®Ê ¼NpFw|a-}ú¹Ãa<ñ° Â/¥|#D{9íE–‘¾¦ÁÍ£Á¯Âbü$fÝj‚ðÉ1•_ÅI3x>¥ryd ³¢>HžµS?Cßô&àä§|¦Œ BOÞsö:73.Þ©ÿkVjà€ÜóÝÁ>Ÿeu`“7ßr ,‰¹/¼M Ü—-j¼^št@ì?Æ@Û8E¡¨ôü´j4÷—˜§HOB*»AØU©ú0‚•þÇ> è-öªZê#ƒFLU*£ÏÁ%cLb¢M¤Kǹé2´9à÷!$ ²ú)SÎå“N`ˆÆïî!3p­¾ ˜PîÕ¨9Ö¦1ÿ8AÞö´@ ?ûú í3O‚ž(–}‡|ˆ«wu×[d¤ûsÔ(ÚO?~­M=}f…VúŽ}ìÇÔ߯u1Þn6ˆxbÁ¤Òl¿œªæŠõ£˜ÒÏ”ñünò-›JÒÛYù|—ŒkO]”?òúI©#Ÿ.E]2|úîØ3áö~³‹A7,aâá)AÜOn.îwæÞ}ÀgƒR`SDfÈ‹›dتM/Ëo¢•ÑÈÜt¦0ÙX((•…Ñ ~‚ò®\EY¸hõö0âùo—ì\OëÖ!ÈS©)å¥2"ÔX‰»­÷¥åBÍ&n]p°k麚y]ì:ËkÜe%"]ó7»0 gY §i‰7àú +²ÅcvŸ +mýZWª*UñV&Y³÷n/¦çné¡Cãå¢w‰#R¶!Ó±Æã.¯Et‘Á}åD1Ùüýù`@vÌPÿ×½ðÃ×Ð¥+Îæi<¥#Ä“”s餥ž ÀêCƒä±Ÿ%RŒÍžV–ÀŠËU°2Ú­°„zÁý¦<çk‰‰y7~7B[סÏÈMîÒÑ2¬çþ²z)`×ëêÄËæw7\%PàŠªë*Éa®á‘fÐálžëÛ7°dñMÿ[×..ä2¥ß-Ž17á‰Æ‚mæ3AG?ƒxBj4N:s¥²Ýšâ›K²!¢s<ÔX´^`d’âÞNY÷ÜLB>hFò@CÌ#rÉòTlÎ[HÉDpv{³­Þ×Q…‡©˜ÜX +üò¬ÈC4Í “ï8b·o)y¥hj†Ãä~}î圧šKës¸T[Øï¬Ò{­òä–`‹ø*ý•ÉÒSb ‡ôÎ{Aàö¥¦"âduÙòwmvõ\2’ÖòÄÒJ˜ÍÍjLu¦Îå:N*øn$çŒj…á~SMtƶʆa(‚„tfÙ}‹è¼¨åPw“…ÀŠÈ•}B’áM¥æF!HdË '{9°=Ôciø꯰õípR#>C)Щ8Ð\ŽÄEÀf~£XpKJ+Æ|w‡ò‚qâíßÖ±ºB;!©9Ò3™@ ²ÃÈüi ç*—¹X}ÄFg-1¡_o±Ïˆ8”aÜƱŠp0û.Q½VFëµsÒÇØ.ƒ-(ð X2ã¯fOo%ýyà÷4A¢?QËÂzSR+úË$·ç +­) ±8`¹Ý ("Ðúë²±â$J´C‡ 1ö»×ÝSR…Ÿ.ÜC‰1$RéÜþ¤1’ûeùع9H¨¥_œ M„ùàýšM<ñÍ¿úºÎ¯B˜e(j^•|F\£º¿ò@}·Ã™Åê•×ÆðΞ½ÑßÖXN-ACê,zs~FY‹ªk{h!Û½O-ò‡Sñc¬|O#vRRÙµ¡×Ý Âe¿äól~ɤ¯ŸòЖL³¡‡Mâšé‘‘>-òd„¿×&©«ï›pAèf/*Ë=n(¿=ŒJð|™Å”¯´®´6“Ú aDw’M]NJL¦óÂý²L^FB—%ÿm•ä©V¹“s™¼à ãKÅ#>pEð8ª 4©Ý¦+Ó…xG!Ž`¨rêe†‹—xB+ÁÕYæDlšÄkûÑFšw˜5ÐEƒQËרÔh­oÂ~šû\ƒ1ë*9? Vx8UÜ{õéŸòVÔ/,Éb‘ŒÄEzÌ=+À£`ªêÔIÈú<ˆÎͪ¿mñÔ·V^v4Q/kçw 1æÉÐ÷!-ü]f”ø…Þvaö˜;´ñÛw¢ÐËŽÍ6ßÝdBª—™1Pí§XXØÉñ¸xM?QèÐK&Uäû¨kìX£K(Æ$‰¯p ¶~‚Gr×аn²² +Þœc’ ȈŒæ[Kô¿ÉæÔ µ<‹ÝàOeDÈ*$Q‡§i¼sÌüBEÓQ <>ãJÁù>Ó€ ;O˜f®Xýaó"¤qüè1Ìüƒ÷ѳz‰ÍÓÄ×-Êþ#™+»b6Á'øÕ²wŸN6%3鵇À- ÈÉ~»",½päÜïêñP,—´fDYiçêÇÒU·‹}»þ›Œï'ï×üßã~¢ÔýÊIãÎnyÏâÞãiô yü„À¼w-<Ç&âЯ=Xc´šýä¬bÔz/ŸSf3H­{óÿµVÚò¦TÉ~IwÞe‡U7ÄŽÞS8ôÚJŽ&†C—•iKubÌ'®®~~%«ÄÄìãËqëÐ,!äªOïׂ ú»‹‘éS?Ççû8ì$wl½Î D7”P,;ñ›Ý!“\uŸ³rý«if­ËÉÑ©Aë‚ ¯ á¢>‚â/«×»úxå*ú‘ä;ð[éÉÔYƒš”þ”¹óøâW‰ÞÒÝ©W€„[ÃØõ*Óý&sõ‹’›Q/­Âk‰§,æ@ë\g2h²ä½Õå©ð¹Îµæ1D9`ŸÄöìsé‡j.±ŽF H=.GqÙXƒñxÅìºçD«ÍC|‚Ò¾hMË{C©_6šonï¯Är^o•ûæï˜I>VÒÖý¢éפuöt­ij)å««/‰tÝæƒ)³~·î©P5OÐP5Ò÷Vo¦TÔ†àå*ÏJŽv‘R·°!kÖ]c+ +l­)]TÎxÓÑ@qÌ,±ÇÁë‡[¡‰µßûïNãÒ£å¸nõ캴ZúÉÃþM΋ñ‚t=Soapb#†½EÁ$ÔzØ3¦­”)_×NsL-Ë+¨ókwÕ÷ç76µ4üfȨؕ3Sü0çÓ mòݱix(*§Ô2¤„¿™£—–§%!刕¿éSk§Ú!;tÚNµà•Æ?Ï*rFÂÔ+·A4?öl{r±H•gÆLJ-EÜ cpB~x0ΖdÑÇøÞPqöãõI)N­q ºãÑ•Mا|§™àÓ0]pgH÷ÊaÃ%ùq¼Œ—û†@ÅÖrNY&kû¹_¶y‰îËÊrGÿ¡r·ô[ä38'æX[1,®²Ç9L5j1«Cð-*ÇR3ºb"+¿Ù¢h58Åyg}ÒÁgc¦„hÙ²n—œ<Ì3ž‚™2ðä J×$2X:ÞQŠè ôÎ{_*¾¾ùGÕ¦'BF„ÞŠ£ËHÎßH“³ò.Ám@µ™rLç­’+½‚‘å(µºñTËØp¯ñç‰"jÛìÃÐ,*߶› -ÀE†º;J/w‰JÜUÚ‚šÝ5uÇSY]É.—_Ž-uÅiÅ ,ŠÛ#Ò-%k*@GÝÃÜg/„„6Ùš¾Z*,¢eì{Ón·@‘†öpX+ÙÙ_±(ýN†ð³qÑanb¡àCý0‹.F÷í—7伧þ—Ö3#öCÎØWûå´¡¶\.[äÕuzlDj¯zBŒ y¶ÅxqRˆ .¨£6žH¶n7:}72oÏ•ñ2r|cu£ø²¼‡4ÉÉ8ÑÊ íòêTp¡þIIôˆ”=ì‘ ~ê¹:ÙH†S±<-þ§Ñ}À˲cí4ÑÁX¼éŽZŠohP¬­]c7pÒÊ¿¼ŒõlGc~¯íöaúÓ4nCV;ŠâU ¾=štÓI¯Eáe˜tšÝ¤G ®ûjNèÁtÙçô’lMÖF+ƒ„!Â>QFm“ªUbÿ†­ÅËŠá' + oÆI†ü *Aþ]e‡ûW1ŒyíÐŽ£y¶Góa¥¹2þ5[xÞÂ`]š9SÝ­5^Mú]=Þð³sƒ/ 8ë¡ûEž“r÷¿ŸŒ¢3|‘ø2©¥è(¨îKÃÔCáÆxš4)ÂàqÛ(-ìáx +{`JnrÁ룛IÔ9&ÿ(¤KŽ“~¯>ªxßQÆèu•†Õ4¯ {(,æe‚9§ ¤MIä¶0Ϩw¨9®ë¢ õÖg¦¤ÐúÚf¬ª’±§^}“iÜ™›§_ n6P`Ã-4pv¸‰—-àéƒišTRNŽ`&;žË˲ÆšðÙÓ®Hj´£VŠ›ô…¦­QŒqb÷߬¢ Çν؛—ŒlU&ø. Ø­V⬋¦ÅëÊðC§$3ÙŸ+ 0ãeð³ÆYÉÇç*™Æê¬ë[^Œ^4ú3Ãè|†…S,ðÿ®¹²ú•â`–™%nh8& ×Á…ˆÅ„ž#É©ÿ@¹¨u·º(ý§^¢2ž“–íKMç!¥8„áoX:&zDJåI«Ë\>©Pª|”E×=¨SKfD+÷3va/‰ª_l ™ÏVu~ƒ¬óxFn"]¤¡éª–‚•ÔJ üeD{ˆ ˆâß ú"·Cæ8awœÈûanÑ0ÔU§{êͨšº•—Ô.]ô™ìËAäodwdï$dH×<2çáp.×yÎé\8´©^é'¹Òe:.„,š/ħ¬+¹$Ž1ÝŠÎÕ5‰i÷¥´§¬¨Ž,ø™>ä8Ž“ž@õÝøÖj@|¢HâÎ'¥‘ÈÈ‹kjÚÈ*ÂÃY;[â<˜\Êà JÈÅV³»ÊbÍ|‡>Þg3äÎhÔƒÐá»Ðƒ½ÓTþ´gÎß:ýÊ…þæ.HTMzIóÁ3—1Ú}Z«% ¾ ›ìez‚ýËJoÌk—¹²iÒ¹¡qÉ—ôoµ´`èâ|uÇPÏBv‡~󞬳0¬Ú1":¬ãÏW†5»²’…ýÓ»(Ó yÛ'‰­<ŸÉ8V`æ|ô“‰Ô¾}E¯ùégÝ4”­å?År'_QÞ“³˜¨@õ>ËßnÍQ~0W÷DÓÛ +5ÀDªý`Å:ÉÔ‚'…ó°í{Q`õyœcýÍõE^Á /ê–3]ëÉá–H›eñ8³u!}¬i/åÔ¾!—ψ4~ÝAqéĬü©†-ƒ¼ Œ÷í->°Ìý8pÈ|]ô»KõúôMqEØÙŠHD'ð½É‡½Š!A4)"‹‡K•4³ÏGj¸&T¿ÿAªr^¹Ú³XŸgæ7Ífýã´¥ú!l`)§œ*¬ ]¾w#±G~¹sÏ4Ã&Âúe'(YG‚3Û±¨‹×í;.¦Ñ[ïÝî]Üœëêlª{é—ÖMÎ^B9Ãî©)?{¬ov¯ÇépZ3çLrª`ÏmÉä–P>“_ù9_™è7^ý0´]ž”ØÖ òÏqûshµíšYö—ïÕ&8Ôò×TÓ¶ ÚQŒVeÑóýôI¼µ„Ü?¢P¿>m&>7ANvUŸ¬Î Öº¾²SË—*,/W›š°´‚ œ9k‡<û´êlLCƒ³íàפßhÄSëžB•f›Úö%Œ?õ#Ê0yc´d` ''DÝ=4ûø¨ÿä¥vT6t¿.¯b¾o‘ãÀ0sžÑ2Õ7«¦Zµ:rüÏ'ó©y‡˜~MÈ3 )Xܘ+»å4ŠöSÅ©Úo®4ZF‡wðÍÚdzJ›Û^O/­\fZ†ùÄbtÄ×[yEô¿ß&ÇUÑ ê¾Mç«ÆEç¡„8ÄÄ%Þ +…µh}¿/l–˜²˜wÎ7ùœá§„6µsv"ŸbÍ £ àôlF…÷>7‹9âxÏç 4*ç¤XªfØǪ~ŠÝÍg©“®`TÈKeiŒ¯'tr1ctýF ’=?£×™çÒä5ÆÚ5,¶ú¦R-ŽLPåÀEjÛD¡'*(°±&DÌφÍEåãü96ÖܨÔkKiˆÛrF¦2¿n_H§Ì[›ï x~dZÇ»í—>Cô²q +ƒÅâsÝ’1fSƒbæ +'ÏgYftf< VØiÙ¯ÇF6¯¹N§Î1…¾7ÔÎí~E‡pÂÆ1¼!]rÝòÕJUCõؘÍ^¦*¬‡ó[=‰â|¥¦Â¢“á·äd¼QÖC¥Ñ_]à}vªéD¿Lh)ŸÜP( ® £& +Ý¿DcHÑC‘tCÿÀ·Gwü.ruÒ:yü4J¶G¹ˆb tòìÒ.WKm„üL¼½‘=;øíZ%ª,Z"Rn2ýrÙÿ­­ý‚¡þúé~Ñ6ãË`iôMÐþ!{ ÚĈÈ8t_Oñw%†[þye][Ñôb™êáÍ<— ¸Ä‘£Ó5§å®ØÛ`|q!‚Ù¨"ͱFÊí,)Íp0Fÿݵ .!õVi4´ó„ßþìÐÙŽ–í“‚WN õ¢ù‚HNxz$÷çûå¶NÄ48×ë{ˆ9;ë•É7Ie:ÔÏž(ŠY%0 L+Gü$|ip¹@k¯ÇxHg/ÊÔh>¾Ðç/'2ÍuŸaŸú£òÃ5"¹ÆyË¿ ýÌò‹À¬¼hWÉÉ¥&ì_þŒDÇ£(.ѧ´<)JE~]dhRoŽJŽ#HÄx†™½Î_Á-æPÎ…7Îùî{MøÍõš„I^Ñl¤H®ä ?ÔàPëGYåR÷üŒz„ÍÎz¿–@æZÍ<.CrZ}ËsfêCiý‘Ç_ëÒGÿA´d]g <Ä#Äm'¿h&äVby}•g¥™öÁ„Lœß4¦©YÆr¹‡—@úVÑ‹ÞRJ†ÚøŽ€â¬™žmþ.—ˆO£Yô¬ž!Ó~T‹V¦†h YºôиƒZø8óÛª€€$¡öC½ +ÌO™ûÆC$[šïþývÍO2…„“þ~“V `9»?ü ÚŽSɬF•=õái†0ØWâ ºM¡¢ªJå&kÛ‡ö¨²Vq™ª~è·ð«|ÁÌ™xÇ¯í²­,WÜY׆šƒ,øcæ k¨6ÑØ:`,cH£ ðÖŽm0Ë8ên*vQ¹Ù,‡¤—k¿Ó/M,¨(†×ß9LF³å¬ÙÞ$ä’%ü;•¾ ÷À\ÃÍü"z쬖Äf3e#¾î·Gï¢Ä¯QÙptB¬¤KF°]_ùZGq20J—_Õžn•€JØpºâ¯ï«ôH¦ A‹»x·ÎDµT ˧8Âüˆ~}þ*^ñÔêhÙÛŠ,úÒƒïÎ9! Í™o4ý×}ºþ$¼ˆuú“¸D@x÷9Dá·çYÁ‡½Ô—CoJªáþüýÅp¿*£ÆÚ-ÝC–RçÃrž"‰Õñ)4¿êò¾×… ÔGÒ i£¸b)òøÕ ŠË+þ‘ø³'iŽMïÈ3IJËÆó|tÑkÖ6¿Û÷ @ZAD"¶tžÅk«ðéuNÎæþŠJ‡_Ú%E±Î*D8™e]ý÷{U¶Ö¼1Ê—oçõ;Q +îáH)7Z:íÌ®²Ï+,¸5oÐPœ0ØKBŸíÐl1/£Q­^æ(nÉ>ºÚÆ.yýȦÐz°Ë¿•ÿs/RJ?Î/;ÌŒÒ{ŽŠÏ}z‚Ÿƒ+>1³ß‚)E¡ýPl®·Ÿƒl­znVꢺƒ¼wÇ€XÏ’å¹î`–ÒwŠ.†h Ð&)(hù²?µÑÍoŠ"†ƒ½Êš¦¤¡¤aëäÄOQ*úbTÖHƒAâ¤Ü·YY¿õPõBäµg¨´-ܨùlÖ!_ÝU¶îÓ»ÜIXÎÈòü³ w=ÝÔŠø‚-ÛèÓª¿˜Œè`ÿu†Î`÷@Ãko© +º\²úsÅöJÒ§…¾7ô(¹|Öa[NðÇ`V°6ËÇ$v-M<¡öd!ÂÞ…v±™±)È´ `±Oöyõ=K$+‡×‹¼[ K'£²ºoO¥qxÄ:/õ“»–ï7Ë®`j1µÞsUëÚc +­ü*¦@×*'³h/zUŠÖh„Sù3\461˜/Ù”[¾¿å„ÑH¹§C4(í ´ÌžV@ɯ}U\VØþæ_ +7)–b󰃞 í>W*c0Cn$ ŽÉâ¤ÊMœ€m‚ç¯VÒ¸'•L¤ #ºÛcN’ñè>ìCª¤sÞà5P䶦–ö©Kì‡Ù3yfŸLù¯ÉÕ韙dÙº*¡u$xèæ?aô?g\¡vØT±QÖ’É!€!^¹hĦ˜§ïùÙw2±®œJªz߉lm'Ûhß“Ìp [f¥Š×ÖÊ^«H¶˜—纠q‡¨ +*oÍ]íYLQÚ‘}_Ð5°¿PØyG…ñøu9R,~—;Ggïš{Çõ³ª-¸ë̲;[çŽ( ìûB¥8 ‹ç¢x„äa€Í0KíÃÞìî¡L¸R» fv/ÅjÜhJfY|¨ÂšUÆ š¶.ß »¶ÌÓˆƒ8}èÙ dÄtöBúËvù—cºRMVÇS¹}R¾‡Ñà $RÉ⻤Œeª­o7fCûi‹ +Ó®ƒ}Z)doǯs+O#mÈÔ2°C.”µÚ½_…r0r‡ø.à£è}Y SJ È´Âw\Î_çíD†vLtÐFÏ~ÈÜ F'0hÐZµK©ÖŠ¨²I~¢wüýFGevø섹ܿ·¼i^Ò¤E«ð‚~*ÖñBæË]Ó7©Ã‘´Îèà†J,<(/ñO\¨$åIý÷ˆª•†Âמ‚MóŸÁv_”ýaß®M¼› >ç®-%^Ji"8Q±ÿŽ"6"_+*+ã‘£öZܦüÖ®]r¼æÊ„•B_KzçËø†qfÞÇ‚fž{ÍLJ8Íåëëvµ×ß_U]È_ÕÔxÖÐCÔ—Þ`OÖj ×—ýs»Š¹ï;‰ÇõdÙ8-ÿáëÍLz5©з¡Â8Q„¤Lø½…¨Üå³#++-¯QÀñ@mc1yŽ‰Ô.P–%ù ½³ø!Gé<ÕdØõM2<û‘ø6]–+8Ý6¢†¯†èì|bY;µbÔûµúqç{ñ–¿§ž¸Ky¹;Åñ˜Œ<4¾aðýHSWxåˆgËïØ‹¸œÈ¸uÖ̵DîKåuBñ +Ø¡Jjåõb=O®Â}"O Ô§§›AóLÔ±ùˆ{^y*õmÞQjÔHê⢦«Ýøæ›sí±ˆ¾GÔn§†‘GÎ G7‰ç€±LW™1«J‚&Û\-žÆVÅÔ;B3ÙfÈ­B„ßÒ…‘mX¸dgŽd£Ü ÚÖÚZ«jê¬nËðâ¸\5þµ'/}‰p–(+ ÇOñeú†õq2…o¶Âü\Äf)'ñSêoù…FLMÙÔItæÜØ–î,së_föX™üÂÀ1MÌ×dÁß9™gÅñŸÝ˯zñG­¼‡¨$ˆmÂ*± rëkÅ•)ݦ:eÜšåéZ¹ŒŠ8j¡!–à^-(;—‰^µe¾3Aü`‹[+/ØÕ±µ£AÌh^¼¿þ8£a¦~UŠd1˜´y§l0NŒØr渳›¾Ðí€lwÊüÛ–AA¬‚~<}VN¨æ-¦«=!&…‚Ò‡±ÀfÔMjèsË4¹!ó´*œÖ·ñ¸ÒþÉói+o\ü—6¿žuŒ3e Í<µzÒ™þÀ-þÝТ-eD†þEÕLhZžQ¦èqžimdâÔQWí)7õ%Âg¨:V¥„Sˆ,V+!Ó:~ãàuÛŽG ý—ׄYPºT4íÊbj:KB“”â%´úŠx<,1íÄI¡ç<4¦6àŽ{/Ö±¢±¡. â1§•È~%1ãÑ´)kØç¼Ïa‹‚´‡:f¯¸¨´vã#ê)ðgQy^aÍŸßv²”ÉöÔ6tÜfT±¦Åw.†šÓ‘µŠG -‡ÀgGh£)Ìj'ELdØ2ý¦!ëäæÒÈ~ãÉÝÓ†½£=ºÚÊAÁüMJ¶tX–†_ÃÏÕep$4jŸ&`µ7z˾ÎMm‰yúJps½e)ß#ì›@aNÊ)Ìð$vpê4ÈJû,ez[_šl1hNdºlÛÐ*Ä{È$KSžÆé”?4†}I³E¦âg¿¦Nr Lä¼ÝžøÏ;ÆM I^„ÀÌýslÏaå@¿ü}ÀT’X.qYC¢í!1GÐmò~O®™{c¨zb›¼2K>&¦âƒn•öÃd¾žø^À6éOl†Ç¬Ù ÷™õå¼f!Õb¬aémè$!)Ì#•2ømu®t¼ãzJÂ{G.çˆ"ÿR˜V’™ß¢^çü‡!4ôr_9~0ŽJu}˜òÝ Óå|¨ÎÍÒ|TqÿÜ™^<à'q<ÚÀöÙ7i° ô6Êt‚#6ó¿"Ó„ 8›E^Wïdê†L›}ƒeÍå› +ñ¾ó¶NNá_4žØì.¯lݲ +WÕ¦:¹†à`û±€÷-=ãÈË3øÆ„/:‚¡3|Âs«®QùE‘P‰KÇ}{:B1}ÎÏ@´è˜´T–¹Î;‹µï,x·¼×Ø™Ú{;pEÖøŽï‰—ÃÂpŒ‘ɺtqƒ&šCyá§KÚ…s|õ•²â¬§B /ÈTK¡»v9Õ­ ¹Ñyë­ö-;ÄP¼®fò=­O„›RQ1sù\wõj" +5ýÍ’¸™IB±T†Ÿº÷kînmŠóNïí I”–—+?DÁx‹ÔMÜXgÉÜ­X$t¬0l+‚“=vJlè~A/5œƒÂeßôhµ‘n8%ß”ÂÜù,*ÓE­ &œs“é>©òÕ¯Š/“¥g#«±'ãT#ñù0•Uýœá~+†Ú:Ù jXÉCð³’"Y;aȼÕ¶+»Õow¸æÛ +Ëšx“ÂÙÂïAZý’a-P#8Y—˜$0’º™Hàt†ýÄ™ÂÆc}¯.½T“1‰.ðüÖ®bZ"²â‘oNR§Ò&Óa¬µÄwçPkÑqÁ&ImĶ0DáI‡ô¢ýýË«Ýàžö°–›ñ°Ž<àa¤if–´ÜŸ´pÖ·²\!<Ùwî‰]ø”UPýüND–À/wë}Žœœø¦o+òcl~›ÄÐØ”\?Kǯoz²®ÉÓ¸4ùÏ…joÛT™­ÁWPý¸ (1­)ÞÍ8š«ÙÏU9k°ìøŠ9ŠÔ·Àø©©¾ï/츢ҭã6@s#צs$'Þ8rf]pâ÷¼?&æÑÛt‘LªMÑ> ½.sTIÀ”Yžs5Ö¼¢?^£V”8ÍHêSY¡àˆ—c)Í!šgRÜÑ/‰(È +pÚŒÁ¯þ6” #úîidÛ´z·ÆC šíù¤ÉŽ¦ƒÎfý˜Ýˆ¤®¼n÷.,ØSŒâ³ú4¶æO¾kÈz‚í]â™´j™ß¦}‘èÉdOŠú„PñËxZÅrÎbo̪eʯLO¾&@>ìI·ã9*û»j`™íê ®ùEE·s—V¼ìÛÞBA‹q¸|7³¿8åÓXwNg—n÷Ô q)˜;‹óêcŽê´hƒg\ÊWÍ.¡[ÙLi+«w!,óI3~fÿÄftÁ[ëlváôH‡ÆÇ0Ž¹t?lN•¦Õ¢"ÑJA”±ÏØYãq[Ž\­bs5$×NÎþ,A§Ð]d=©ø¦ò£ #y²TÀ +Ì×åúQ¡p&Æ]å£òÔ$Y"óK4©—ßMßÖˆ`Èõ +ï‹¿~·¡—*zˆÿôÚº¢¦ÐIWcâ“-Ö«a$T\‰ØBœÐàâ¸è«ÕŒ«¨ò!Æá¥a4ÝUÂs[Ù -Åx¯z~溙_Ua€Þí#ú6³f´â˜ À ø‚51P©^©<´òN½‹ö o™_^‹®ϽÕ)àN%¤O¯±pÒs&ÑígU§tó©—;ãÏ—n +ÒgÇõ}ÙJÆf…Ö>œåF3-»£‹€¿–o½lÇȇœC>®FBURò™\ª‡¸Õ6¼ùÅhe•/¹ qKÏãƒ}¯ƒ Ú˜^òøèœL¶Ÿö?_Aã(~†¬7ÃK¸ø(Ðó -¡óŠ^ûØB笒ô|‰¶š»Ç,¹gÃrø1¯¨o¤Ää^«-]ä.RSN`2}¢ žÂĬ_?:¥)yð#±/šÙ¯k­ôÈâ3g¤=U"Q¿Ãì•^Róƒ&Öê$¢`¬×Œüè¢G“aÚõÔ6\[ +Ú¹jpv‡¢78TòKOÆ=Ë7…5Χó’ù(b‘Ú¢Y;ªÕŒÂ†™"·)è¿ðÒq—ÇGÑVrdŸÔíGÆjªB´UˆÓ‰‘µ¹ë»úê¥ÕŒËhÏT·p&!¯4ß3Ø SÄK®6û*žÂ7ÍЈRJÒ[¢ +ûö¦ÙÊuŽ41ÛehE>ý§’@çâ7‡‚8®IW´èvÈwŽ=ó1MSŠ N§xèIf˜‰tõtÊ À6CKžØŽ©OPÔ^%g'ŽŸ<³âDk:šã•‚ÖWÂ`\µ ô‡š$Ààž›ÂOÑYµD|/$ù(•ç×<%]ÂzÃœ†ü0L&KÕïùwAÞ˜¯3­Ð‚“À÷ìçåš´¶4Ìè”…YhaAÄGäobÖ mLuüñ&,OwôzIwHÉájÕþú¿2$5£çâç¬MÚÙ+ÃGõ4~+¡±wDG=¯ä»ÓFI6sfºÆÔè¥gÛédp-¡ë¿ Kcó¡!=]=¶r¨¡¹ˆNQAß]#X›Ë± É.ó•)›MÞVàoZçë×-ÒæÅ ÷`žü×áG;%1¾^ 3¬cmùP–ië5nEèÅYR!}®ßRª—lšÐ³#‹ÝÞ­{L9'WYCÉÇëB-ÙAõ—! !bß´3x^ÛÄŒ°Ï}6iö[dóë1DVèÂûùÙ|¸¸ú«XðÜU'Q¤¯<Ò›æÙöÛ9ø…mL¥™^™£ÌǽV ã0¡4å‡è~ZæÆoÀpdÑí^ÚÑ/½¦½òYå‡Xûý¿ì6&ËUöhW›áÞEø˜sŒ•Â WJ·uÉWˆ ‰,ÂvTz~ð ç|Æ­Œ˜UúÊÄë“ݬ’ýlÙ6Q–J¼:ϾÝÜlRr+)Vj¾Ÿ6Eð:“}gù¢Ðû²CƒP¨nLjHHX½ AÜWð±SZ|IÏMÚE)¦þéŠ"*¿ËYù®u^“‹VZ +ÍûwÚšÔä ‰ñgŸßŒý2B7rH§õJŸejèeæÏÓ›/ÓOZA³ðr'XYçLaf®¾²Ð¶úæZ¼SND³ÁgWFÄ{ÞjåfÒf’5”›$’6^Aͽ1øúõ@ñ—„Ë >óOÆAt9ðª÷i<—çê¦` ÚÏ«×HÓtõaásZz_ b¥c+×6(%›¾6$ÂŽåªV‰©sš ìÈÖ;ŠÇû²Ínß„…kI°MµÛ6¡=‘Íõ³ñ¹!¢òÇzwÉÖõ_!:bÆä[}åÿ±+öõÁ4Tâ|jXž8æR{ê ¾MÑùI5’é‹åQf‚ƒB +Ëñ§HŒÓ&V4ãðÑPS‡ë¤O6–€JcßžáìóÉ%ÝéRW9ÕCS½übJÄN®AîÁcþs:^ïÀO6©œÖæb•Kc`5ržXŸë¹[zÛlÑÙ@%”5znT:±`¸s‡åcMqQÀ÷iyK¿ +Bðm‹_`ÜDl/ŒœÁW‰Ñþ]pÌ9Ž‘ eûÍÇ¥²R]¥KÁcÔ´%ö.…+j6u¾_ƒqkú\åëÒ¨€Œe4Ô, "¤ù)‰MŽ´tSá®ÌNOÝVuôhc4Ì¥'–ö|Ö8Â(’@udKÎü:}¡Ù½ä_›WÖ¦g0“ÛѶD¨S^‚.uše4”fx«@ XÏOäJE(SÄ®ø˜‰Ì²ŽD{¹?NM¡C\tÇé£8çÁj}‹7÷öb×KáùXV= §h³³¹T/ó–nt BûÿDÖÖÙë þf GÅ‹‘­.ˆý¹g¡7?VÍ3æÇpîÏbeü5ã)©'eª‹ùb\ò^ÿüü‘{Ô(@ýˆc¯(¹72m.5×n$¾RÇãÛÁQÂ<× ¨Ä’´ú¤f&_Äæ&xî@IH²¤Æ¸ÃÉüݯ#ƒ›êìµ´£ +òwdšäe +„˜~"Áe®ûW=uŒŽˆ*mÖCsxÍç-úºQÇf³—âü ö%Ú¤‡¯»ly.vGW;h€rq^2¨é"ª]>Ö]ëÝM¬È^Öl9‰å$¯5¹K1Ÿœ*$õËn|³N?”ºjØNí Åã +ìºåÉü®¸!­)|W‚9ñààڇݨ#]sÞ»(_ç«Fv<­=¬ÿ6NÙPˆÙM÷¨Ùó` M~x>I@UÙ`‹MÒçÕ°k.‰*‚ólo4‡¼Û”X.}ÍæjŠ§§À[†å/ý Bîs³hèÒÀæâú}±£ ™xÞdñ`ý#4á—®¶‘§©=!­-kÔ™ŒÍ@—Uf-Iø!ã[(ölW3ý,ð÷#¬öò½Ú¦RŸ–8{¯×ûø‡Àã +¶'ºB×þ¯&¼j’KÕ«þ:mŸ$©Åfï>c¯'ÌÍÒÍÑ$9õ”Ãw9—,må7CÝ Ó«ãÝdªÀÍú›Ac"ù*} ý}FËã +Û<âåÏ.÷ oEôt¾›tj&EUõuò¹ìö ÀsÜ2Ãœ|W­TRÎyÏfbúøÿÿðÿ‰Œ­†ŽÎv6†ŽVðÿMÂ$¤endstream endobj 955 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1966 0 R +/Encoding 2079 0 R /FirstChar 33 /LastChar 126 -/Widths 1967 0 R -/BaseFont /MASIZP+CMTT10 +/Widths 2080 0 R +/BaseFont /GNCLKR+CMTT10 /FontDescriptor 953 0 R >> endobj 953 0 obj << /Ascent 611 /CapHeight 611 /Descent -222 -/FontName /MASIZP+CMTT10 +/FontName /GNCLKR+CMTT10 /ItalicAngle 0 /StemV 69 /XHeight 431 /FontBBox [-4 -235 731 800] /Flags 4 -/CharSet (/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/bracketleft/backslash/bracketright/underscore/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde) +/CharSet (/exclam/quotedbl/numbersign/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/bracketleft/backslash/bracketright/underscore/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde) /FontFile 954 0 R >> endobj -1967 0 obj -[525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 0 525 525 525 525 525 525 525 525 525 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 0 525 525 525 0 525 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 ] +2080 0 obj +[525 525 525 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 0 525 525 525 525 525 525 525 525 525 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 0 525 525 525 0 525 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 ] endobj 950 0 obj << -/Length1 2203 -/Length2 16804 +/Length1 2223 +/Length2 16852 /Length3 532 -/Length 18067 +/Length 18118 /Filter /FlateDecode >> stream -xÚ¬¶eT\Ͷp{€àkÜÝÝ!¸»Kãî\BpwwwMpw‡àÜ%8_?çÜ{’sß¿ß £çªÚUsUÕ^ÕäÄŠ*ô¦öÆ@ {;zff€¨œ23€™‰Iœ\Ô häbio'fää0ss³$€Æ / ;; 9@ÔÞÁÓÉÒÜÂ@%JýO'N€°-ÐÉÒÄÈ gäb´abdP±7±ºx2„mlÊÿ<á P:Ü€¦ ÌÌSK€1ÐÜÒñ%);3{ç¿Ã¦®ÿÛätrI¨þ¥I IšÚÛÙxLfŒòö Ù€ —ÿ?´þïà®66òF¶ÿ ÿÏBý?ÍF¶–6žÿÓÁÞÖÁÕè³7:Ùýß®À»ÉM-]mÿo«”‹‘¥‰°¹ Àô拾„¥ÐTÑÒÅÄ`fdã üWhgú%@+÷/Fy I9EeÚïé¿Ú,í\T=þ3ê?ÿÅÌ´:N–&Ðò2ƒ:‚þþ÷›Þÿ™KÜÎÄÞÔÒÎÀÂÎ0rr2òD±¼™–v¦@Ð$ÌÈ`gïzZ_€™½Â? -ÚsF³Åþ, ´üƒ¬ ´ùƒlÿtþÓÌ -jmcdû'êâèjï45¶ù÷Þÿ§…ÀhçjküÏÑ1·ûæ0šÚÛØ9ý q€N&@»¿žæ0Ù‚¢ÎF åþO”ûfûï©Ø˜@9íl€fE™ÿ'ú:ƒR6rþggë?APf6®Î ¼LìmmþD@ùXx:XÿäÂÆñ/qKû?†l \œmŒœ-þD@™xìÿ@IØÛÿÃì {÷?íì o 'à_=þÙ%{×?+ÆþÏ>YºýÕ¤ë :Aÿa¬3Ðí/WÐiaþ×B°ƒTí,ÿáú'gû¿âþg[ËÿŽr€Ž®F -ë?ûtþ§rý ‚œŒþLÇRþC ‘?RýC ±?rÿq‚KâL$ÿh™>ÿ!“ÔÉHÿ!‹Ì¹Èþ!‹Ü¹Èÿ!‹Âˆ ä¢ø‡@.Jä¢ü‡@.*ä¢ú‡@.jä¢þ‡@.ä¢ù‡@.Zÿ!n‹ö¹;™X]þë•àfýOü¿_ -P©füsÔ¹Aÿ!ÐD&jh&Ó¿ðŸÃðþsTÿBЄæ!(s‹¿”ú_Ň ”»Õ_r²þ AR•&&ÕŸ2Ä *·Œv!ÈÊþ/Y9ü…ÿ׿dåôþóîü… +—¿dåú‚¬ÜþB•û_Õdåñ‚¬<ÿB•×_ÒÚšþoíø¯{ozP}ýcúg'¸ÜܾÿÝSÍÎô*J‰ê -'hÇÿ‰š¸: -¡Ë¿îuÐýõ¿lf ºí€@  ÂÊ¢½ o°UJsh™ŸxÁt94 ¸ˆyK¬|C÷ÜwÄ å8p›âQGšzͧŠttä_пˆÜ_ðœ¿vú(MH\8Ʀ.¼ýr3ü•îÕ†§y.ç¹ï@ò;襣yþö”\avc¬,Q«p ërð$O‘JLõv¬GÇ­±'#˜ƒSS"ÝF-,¤ž‚•X5Õ±,œ-lÝ51j}*ÈÏ* ®•võʾÓí©.7áM÷7fÌG“N"Vå åÁÓÒÂ0T”º÷þá¡ €¹ŠàôO8åQ© lôК,¯Oâ3—Ø“âárntmšÄ¯äzÅ{¬´…ÒËEL—ñö•Q”p^oÇ€äîüN™„/d[þ>( .yQêºÔÚÐÄÚ¬H±µÒ3¦1¼˜‘o3Õ> û!8&¾{» -¥ë û;#Xî¢>Y‰P¿ø)#¢ôò)ecg7ÊÊô+c;1F ]m‹D{2Ôléj+Î}Sþ(÷2+§ -áÓEŽ¶þÑÊdCH¹¤J¥Y8ß/`/ Ñ#x’Ý O -S0/&ÉÛH-Ô‘‰ÿW5L)²¼826Œ›Û¯ŽFšt²ÊNÚQo/Þ·R…3îñg[UúÎþl}¬SØŠ¬D5›ùK8² °æ5žš`DÁÁ@*'Žh^—u˜QŽš‰<Ñ!§q2F^b:™%ð(ǼÙôÄ3°„¢g Æí–+ªdÍ õ´¼µÚâ#J*gò~À †”Ò¦Ž+K>ÓkA“«6WÓA -ME)L—œ,ÇÖÕÛ$ÅöãÌ«6Ÿ®¡ñd©èñ„ÈOبÍ@ß#Òb­Õ0 o „Ï0ÎT»}¾8áõÁ±¢àâH[˜çÇ`{ß&LÂo^x/–WúÁÀu€(Œ*¶êuï–K,CyA¶&ºLÝÖg¢”ÎÔûíšLm‡_…ÈúX¬fo$›$¹ÃÉ«ÌÒ~Ï`ËJŸŠ uÙ–ƒ¥m¼²³'뚘zF^[ž{Ñ⫲ñhÞ7ª…MùA;4ÊÒ¨"äz/…w¤5sÏ.!àhž­üEAÜÞ]†æáífy—12í Ź]¬a -³]’°`(oƒ_ ‘Hzràša%+f¶³Œü{(Ôº -fŠmvö%päd~9–aÁ »¯ºrÌgŒ9 ƽܶe‹Q)6&ÙÒýû·(Ø×ï·Óšbò¾¾qQÇi>? ÅcÌqe¼ &oU_ŠÓÖM³ M,„ÛQ³¹uú*­»[¨æ ȳëtmµ¶Ì$%œ¢*ÐóôGƒÍñÖ¯b›¨3b'gïˆ2ø³ôΞÊÆoÇoÌÃ%ĽóV¹H¨xe)௎J\¨ ô„´Ú©Ã+ø$ÚËŸ#\ ¹4¡% Ô(‡ÝÓÉåj£ÆíÛÚ±IàŸwC¼n“J®d†“ -Ò™!×ìX fÓ{P—-nƒÇ<„¼#³Dî9 Ì_eCâ÷ÊÜÛpTgD'>e¯Í¸ùôÆgõËòc+"Så ZzëéF¨ÏÈ,@m9 -®¡Ý É»œâCÔ€õç}I -s8“†PÐáÛx6ºÖˆVçG”÷)¨"×']7áH'ñ;G†ø\g÷U½ô¡è ->³ -ëTMÆTîærŠÝZ;àªÑT9«1;.'ü@ÕìG¿›>sÇÎ72.D£íLƒ<Ž…7ÍÐ Åø6&6©pTSGŒWÉ_PÜ$c?\d©o•XÃB¾hR ÿ:\ ~–´U8IFy¶æ²k; rA¸ärˆ-ý™ü5Øjˆ‡ñptU¶àQõ o²lU#)JoÊDßI®lJ·~¦ÑHDqg¶ÝåM1¯äð)Èxä&Êœi{Úà1;ŸW‰ûŸ ë 3UâôÃ0Dš)\oà9{kîw…xÅŽm˜ç=ìuv”ŠåÄ]m½ÑzHâÁÓjJk“l ó‰Ñ˜ªdxüJW ‰ÍLQÓúÒ )ÙM·ZͽN"#{›{ÆfÓ¼Š’êÖ)óÌs𺑵è(Œ„nÞ Žä}¥O¸Ø4ÛV¥/J6³“ˆX:v×Ì(rßUß0`?‚ŸHÞÖ7¥xÔûnólJp À®îÀÑ‘…%J;N®Ë/Í-»»d‘ƒ™Øp'Èo•8Ü7«­µ#”’ÚÝÜã0àG¤p+º¯¬b¶Mço¦ ŠŒÈÛIÑ%ëˇˆTJßÕãÂ4JïÔâáîF>e- t=l‹Oç¸ñZ£K“çÃøØöL;…Bé!–YhEí2¬Ø8’GãC|k[ÑË•ÞÕ«šŒ…/¡µë&ôÖ} ÝœmĺÛT’ÐZ‘©¿U>U`N:–ÿŽƒÉ•ˆr› ªš—ómrC(¤^Ä'è=BJ”èIÒÈ›apÄjþPfÈ3;¼l†òwÂdáè]%b€&³pžÄɆ|¢þ”L(½mRú»vë«ù†lƒ¡ÝèG¹éµ#O·8#¾<Á~!a°ÐÂ<ç1‚LÖtøç#”Îdÿ‘W9õMzÙ Rðß“ÆÖ²6XØ­WšrWIŒƒ\Š']äÂL~ò²è8˜Ï±T=8·-ñý̬fXç!¯Âeç’Þ]+Kº­ h"ï_é“ßœbyaS¨~\ :TÂGÐo¦bæGŽG‹eèyöк4[„3ßÅù(Ú|‚“¾=Ån”} _{e¹Gøõš¬…RB=⻚¾>  ðñ¤%=›kBË`¡^5ÂöÌ$ʶéDŽ«w­3ì{§ï,UvÈÏcQ}@‹×KRÛ]‘3gÀclhÐ|U ‘S«Ìɧó¬îžü r<çœò\ÙŸ‘ê|‹*ðfþ–¶z°®ç=]çî+,’ÉΰÓË$ºË²ï¬Ç$MQ–î9½(±Ømót‘‹ÜžÁ¦ƒÎ—öIöv¯˜QÁTMbÒ!ÕVØ{[0·åîi5yK"Ý]>TzT,cñ[.KÍ‘ðåϤY[SU^ÖÁ¬yT£cÁ÷ýzE§_êo2²d”ƒtŒ_.d=Ö+†¥¿%x|Ø$3*Ä°бZBÒ!*k”oúP„j™:Ö=`´xÃîWt†so£mÈÕ3…ÆŽ Á²K_Ê·ó›{—Œã ™¨öȦg~ë³ ‹¢¥Kò4€ØÊ«à#sé¡Ääå“3ŠËeÏ-â—£JÜ 'Éå_®Ö -Eu&~[Ž;ÚL'eÈDwèÀùŒ–-v\¥>h„K!t€ù—ß­k¹àzómê>ÑúSZJª;¬è´yPâï6lLÐ:ü0$*±H <áý p7ªàoؽyôóüÛâ½éè—!ä€Úc¤‘ŸÕ®Ò w³‡¨4­oØ+«rn&Ì…$¶{QI—ë’/‘¥¯Ü¾·Ýl]§eÁÛ÷í+á™ü…$$$ã‡fOþì ù–r&l*z_‹…3î½fÓ.xËqt7Zé_g>¸¸•ˆ§Å*œ."ÖûbRà¤ÄÕ£³¢‡®Õ"ŒyÓwiÀOf" . Ì@sÒ…œ³~€~uJñoέúZŽ -Ãc-xZŸ ×<#“pÍ£ _ßÜØklþl&P)N-C^ZÐÛ‚<VöVŽ”¤ÝqõÍV¦7i­ðò«\¬žû¢TÜÃ9­Yþ¯ßNÁÍký«ú3DV"+7U|×ç!?¹„‰·¨ï»_^ó«¿ 9ñbÖã]÷qULE™Mß.å`jìõVI^»_aî ZþŠ€Í,›œÓ]‚B‚…"7æDÌÈ8®hM ‘æØFµˆ¢ÐбäßéÛö×0z{òX#ìRâî`„}|ËCŒ}†52  emêˆVsê²hV áÓç`·ÏYGÞÌÍ4ÎïDz‰µ#ö à”„ä‚Öž¤îÇ̈¬ðžŒÐ-„ãÔ–75/þ<ú•zÜ",u“[”žs›ÿ-ñ•Ã¯­xS(EÞB^ÔäaãÛ¨6_ÍÊÐ>l˜š¥ó×Uiö„¸õj–üLgpò©/V [R¿™o€=)|óÛÃ9s•P´üW’”;,€}½9 Ú׺¾BuºY}t -µ©ï⃯9M«í0Óçúª8$_<Z×ô)¡…ËE=LC¬Ï¡(üº¬™¨¨Ä)XèXÐ£Ñ -ß¾'G=Lˆ„!Nçoç;UY(Sôu.Ê­¢ŸU½âñP˜näÇi-žš -Hv™³«°+N7ˆ¶ºv›Jm.GJvDËU—kž†sŽõ ½Yr0eÐm1éÖÒÔ¦è„7’íÂ\FÔÎ{ºòjN B ®ú#ûLjì•þNßõÅ(™"³˜9 š¾(¹­<ƒKÈkýv;M Ò¹ÐHŽº}„^ïX‡q@Ñó)‡Äq¾!sÐ)R†"TxpÐÚJ“y¶øŽw–.¿n³ˆ" Ä,_kçëéá®N߀v•k;ï…z“X;%¹hf)Ì Z.Û6èáYÖnÌR퉱crø›| *¢•sp…Íç›ñÎ×usà÷°iiys÷±Á‹É" ©¾5H¯û’Œ…îs9òkmŽ`l™ÛU—þØÏ4¾%€Ì˜kMdLî–‰¤™Ô­k$žxOœÅ{Š˜ÁËÊAqÞDzmÛߊð@ÉkK$In¨ O„œ¨Ç½:ùê[jáÀ<öPç‘>­6f”rUXgØõé¥à6›Ï8{3ô˜A¨“w¨:|Š~õóŠWÄs¬oh‡L¨A¶1Gü\¸|Ô;?Ÿ"QȆ<[/Üs8ùî·h}®fmͼLb‘V­y•é=¤ÀÒ€K#„ǨâÏœ#Wø²Gæû6|Ü}ÿÜ32¢5•ªU=š0óNS7&¸÷õÜäñ›ÌÕ -±-/§¾T¿‡ç£/jL$B¨ø;&gz­¶íŠ6WÍ/«q¶ 6Ñ¿ØWùY}÷,̆‘KF@ÎA æ}MþÍtAp²HeÔ:×לOCôù¾K™,qá`Ù© …r—©g÷$Ï ‡ÞE­ù¬'_LýŠG–¥BÆÉŸ‘1yƒk®°– -À$:­66,j£ŒÜ®Å!¦!î¨÷››6ºU©w›fxHwEÁ…‚†I²^ñÄF¨¶Q%²“ÆKÜßX0÷mÖ maKßsÛ2ñb¦³r2éKÚs¤”:UàëøM•ìÞ7VüËNj1(jUA›¤ä]ûøh’iÆ×:§vJ¬ -ã ibÚE6pÆ•ÇÌktÀirë̃ê€îÔ»Qi>»ýä6’ì¤hê9£¿+²—„TúM§!íÐ;>ÌJ[¤åpB‹8Ù¬hÇÂÏ°J\@¬>jà“8òvT±.‰åm©M‘ŽIFÎàj=½¾xž¯æcŸ>bïwgCf…!–ô>«,R-!°³ÖÆ·CÓ´Î$d ó?ý ÑFªBk-¨ø:E''ŽTGÉá.ôkÇh‹‹bñÉ»buf†÷–(öKrvÝ9ÆÂ<")ÏXgrÃŒ« -Á—ÕÔüm—PqžWIÛoË…êÊ4fET$¬MçAN Í‹kŠÖH&Ù¼?žï5žn[Ðz¸ýHŒÝ„=¥û²?š\8œùtaâkÇF¸Ð pšÖÇ ëö‘.|´1-'óXº[8û¾ÐK;šâD¶Á¿ôÖ”Ï:ÈX¬iMO:læ}!@z8†lÀ°[¥ØªÀKx”ƒzXjI|ÅX·F¿ÂÁã†R‡¦,~7]w1.ý½}¯Æ[ñ›>y´EÕ+ ‡ j$ÎäJ˜ÝáÃLæïgA6–o°;…½ª+ƒ(YUnp–|”ÉÓötE¦SÎ58¸ê·PF´Lˆê¸ÌâßÏ¢ðÚpÚM!]ÈFÙo;1Ê–ÑWJ§+f›Œ‹æ;#J¤Ý#È6õØ*a6BSC­/M›ø\Ô5ÌäS»S6æë0«'Níå)9“;'$ G¾"\0~~«ØGC®#‚j ŽyS†*“ÇDc÷#:JÃÝ›T¼X>òŠØ´_2'–Ì°,ÀåËÁÉNŠ}ÈŽ<øe|Å_ð2c½ÿî½1oM[½8Ä ¥ŒæÜlG^há§øåQ=º`'@¹\\5;ݬƒoL¡KˆËÅ«ª'õ4ÛÅŠL[õ*K•ùƒa>Ldb6Ðþ>eNnEQ8EÆð$ôhe½¨¨|¼ -6¶é³or©|@Œð×pU±…Ýi5ÊÊÏÔ‘D@àï»P_u©;¬tUE¦`ÿAhõÌsÈùå#÷ú|ÚÄ›LTÛ'dC˜'] Šy)'»®o,׿/{;PÅCÔ†Gùo-ÑÆð¯Nóã‰Y.ØÂ=ÏÓÙÌHÀ¦:zý 3º–§vÑï’‚]¸-&M7C¹·‘IHàG+—úÜñGj?4éå}ãopO‰0YN%ïºHïàiÑÌÑý‚·„³ã¯I…8dÛTE[P…À6‚§bäÕ÷cXÈI,æïÏ©¿:‘âu´fmÄï•(5œðæÜâ¥ìrlŸ@¡CÚm„¾$¦e‰J °ê<ì~°¬ÅÛÖ»@ -7` ê)ë(6ü¼ëÿŽ´Q± u>Q…ßž1·<Ò1ýv¿O±,äÊóJÐ\Bõ>ï±4ÊÁâÏë(´÷.2RîöNÁ`³˜ÚƒSdäp«n²WUX5íñ€•gùC faP6³à%#å7-@¥}à–Èøés‚®€×ºV³ÂÄökïJCJã¨CÍ2 ôÃ9Üÿ¸ÕÂǃÜ‘A.;²K»Þw»ä2ÐÇ*5ààM ìK‹#bÀØ»Éԡꢉa™v ?Dþïfé"TC+ê{ì$ã£øU4,Ggõ2®J‰¼„Ž‡+ ¸0»E¦Çñ¦ÔS}´¥±ÅîH$¥¿ F™F¼œÑ©Ý°;ˆo;n<DŒøÕBÏUøZeØ WÂ¥r¿‘­Íéh Ö—ÙÅ_KÅÊs%2û ™¹·cäEr²âT[@€nf˜øÍ¿|U1øZ KÈüŒì&ûS>Ìéó¦m. -ñÈk„ˆ8”ðenðeAMºå‡2»V㥈/z"TÒÒTJî[\o6ÖÜÅ ÖxÂ)L†ÅÌ-J Ãk`HGÅκG+zÏŠIò.Öúó¼ $£^ž)ÆÚ{-U -Áà®Ê3öÝžOo!ÊêS6YÔüRf¨“\Üê”°ìÉ lÑRi(Ρ–ÄÒdEüï…®ƒnÂTñ -ä°‡éxu/š•Å×FK ]ó G²NѲӯ€9…B2”Ÿ}W¤øË”Å*wíØÔfAî éÛHäëÙiârá×øî£.öU˜•œw·8¾€& -x¾2øèÔ¥=*wæÊm½¶©[{Ê8EØRk4}¨KŒw ÝNñìj§ÑUÇ×àLÄÞÍ]±Ðö’¹}?:™l?ÚèÎ}û -œù5¬²ƒá fôËĽ$ãKX˜=?QIÏ0Nñ çÆç«)0ܘ­ýÆ;AÍÂ’Ä‘$‚ÍØËαqç6ûƒ–HÎ7ótøÅm?~ùKÂÛQÎø9kû•$¨ -á£ñ‡Õš\{¶¯”XÈ50´ú;Ù×{Ì?x¯Ž»‹8J<åõ}4¾¹OJ$67 ¨ì<9CâŒjvÎU_©Èê°·¸yNi»èc–G|õRp«®OEf˜©Ìn5Ø9&Ú#kgÐ0­ùRþáSyd¡Ó‹8Á0¦ˆ# 3un™ËÑý%ÆJ¤ÐÂ<úªUô¿ê|?ª’F²eUAÅ?N3ÈrAÎû\%¸_—Œ™RŸ¹·›’‚ÇYòI§ƒõdÉÒ”UŠ¼Å¨‡Ø7Ù Ãíç©Eë1ÁPŠ9øbïmÔ¼V½”äÞ‚r(ÂD·Îø©Š£Î€€òðØÏ[OÅûU?cÍŸ£–[´RÄ÷ »‚ø}UÄð -ö§|*|k -´Á=æögÄâî1Z2{¿/G(+)»§Õ™ÆPÜ=SUúeZý-.ÆŽŽë›Œ†Ð¿1É{Bc~~#UF7ž¦³]º•ky[u5NàS€Œ4Ða4Hп)¼@3šÂV XbzËÃ.`ÌaȦ(ú"»ÌÝ“ù}ÔZK0ØF >νÿ¹ÚÜz€âŸ2®£ýó ÂdfdI±d ØY\-B<ö’T}í࣯tïÞʘ÷Z”ô¨¾EK¬ë2’q·7Þ1…|ïÂi‹BóTÕp‚Û~>­Þ8‚¹þWäsdá³#o ¨@öµ²/;Á4«#ðZ]*zÊàwç‡;¢Žº03ÒÑåt'N'¡[åsù6¾Õ±v >:`ÎIßƹC…Ï»FoFóBMòhÆÝ,8Ò:TŸZ…ãzεÒf¯«à^œn^U¶®ÞX¿K!×#9‘óÑõ;EHÞÖ Ò’xÙÊ£«$l˜Ï¿-I2EO´žméÔ|=$Gàåò™ú‰-ð¸|W÷ÅÓv9ÇIJ3œº™’Z çÖxÔô·í¥x°.öû ¢](¤™¥g‹9$6˜p%£Ô\Ö÷“ ‡M|\rÆð-Û¥~šŸïa:IKî“bJ‚‹Ø ‡Å"ð‚€ËD̦êÁÝDÉ>3¢]eÙ^‚3ÌtìšöîÖÙñûo°ÐŒž;¢INÃöÐWÛyy¦ïb ->°$´X„ÍÜT4õ±DæÆà¿Ðp¡„ïHÃR£Ê‚_)ÌÌG½8ñ!B8†ÚèªPç°ºuÇTÝ»©2 kÓ\+ÓÙ±c:åÛšRT¾ÁÿÄdª˜Â"U"Å‹Æþ ,Ý@(æÊcõi,OHš»?ÒÓ²¥¨ ªËßFä,±ÒèáªZ°¢bnGôdqÕ‡'Î[TÑ2½åå÷ÎÌEö ÔÁWìÃ~Þ_@LÅÊW(ÝV(&†žSÚù¾ä³ù£N»‹ÓWGb3„P>ׂ#ì¤`²Ë¿VÔBKÁÐÔ“­Í¶ßÝlÍ£B«Jg²—+0〲§›kQ¨’šR{HõTPÒ‡"ᱶ˜jéH/>PMÿnmâqÊÚ-Gš½§§ýø³°¶öØ ä@585,C•ìv™ÓëªÞ]Ús↴àN=¡³À…_µr9Id¨*ó AÓgH”7ãÝv|o¬5¢âPËïüþ1Bý·AZ -0—~ºª -í[¸–Æö?‚pé¡—p~”ë´x B4¶aSÆ⳿@èÀpÊA/+£&xÅtLºŠç)³vç{SÇXç\ ’œV·»>amÑ$¤'?G±JÍnÕ"©ôªûö‘N±=Lhµ}V袔ÎI¨&…I52I{Ö§êìà9×re-–ìñ5ß?ˆŠ(ÑEˆv5SŸ­ä§mˆ€Ç¼"Œ“bÏ2jyÂ{ õ«<7|ü¾÷b-¹L;Y¡fh©(.õúÛz"1›2eÎ;+F¦úd B%¦Þ¦p{ÚÎ÷å ƒ| Y\6å£tìL7¡9¢ú;†\K!7—:Í#Œß+]ñóaO¼¿– îêu#É×¥èoª°Ä”n}‹kO¹¹UnÇ÷Ì/ìQd>9,{Ýý|CUáT¯¥<î›Gh?´ÎL6LÑÛ÷ƒ?˜ã{+3€!à3Ø-ÂÎ>¢Â0Žìø¢¼ON‘!Ò' -|dñ'ZP= ÎíÆbödÁÿ1F2`3]RtBÅçÌ'ÉTP4J'(mí€jÏæ‘ŒHœ|X x1a¹ÜÈS£Tø ¡Ÿ/½ §ÿ‰ºˆ1ÈÞY‡O”ý³Êqš~WÒ§öÝ—M™ž6Žoñâ:¤ã>«Ð®lg $÷ šiÄN¹É’å±Í´ÖCùï'…Ž¨4>ª¼:øIX É‚ûŠá DÓ}ÓúÈʬŠZfÈraDï›/’˜!îp{ÏôLI3™w°¿…i{ôø’ ˆ Œ¼íùîP»„CPíû)‹Nü"5”‰ïξûÚÛÙÕA3daç`{Ùcô=¥ïa¶´ÛfÌ©¤eOpF ùÉlDT:#g§E.«SxOÅPÌŒ•Oó³bß® ”§G*ù üI<*àùPS“Í-SRJôÖ2Ó¬ÇNÈárVÌÑfn&Æ -›¿³¡îšHù’o¢Öés.#®²o›`r§‘øòÖä5DËpäWèï;OXž¢w] -ËIwd!Ø6~ã¤&1¬Œ•J•¹:|‹‡_Ø-ð?; --ôU4ö?|ï*1£×®ûzrѯÃsd„ašI0Mdø!çïñ˜7 -}z™ŠqQêSLºédª$$F{¡¢ÚËgT± ÷¡bÔc1ç,&íÆÒ½mAê§æCú±®Ö…W)sw†½Hgû’p‘ÝKâ°Ä<¨ŸŽjn°Ù”Â:ûñ6ãrtç.WƒŒG­?C”êYIeTjŠcÖ ¿Ò%K¥isuBnæY¡.2uÕÆñ¿f'òêÙÜ cÖâd§;Ó†îÉPïRj¦@æøþ@Ž]î{âl­¸k&?(ñÝú­#2ÊêmáªÞ›Ü³Û…Ê/îZ[0!â|ÒGé;þ,ɵµ4bkò&ýr’éý™—g72Ý-M‹—bOA¦&×*³%%¿ìŒuP-¬5¾Av— -yЮW÷Êù$ñ3E%ü±Üž)±Þ/JS¡!kŒó2RìSj>,‡XuZjÞbµšóñm>û`>zÛÞñÇõZœÅÃàÁ”ñ¾HóîÀ‚b‰ë@ÍN{¹jÂ%šL!aêƨ÷|Û{úA?ÎOÐC¾Ë.èIü¢³j‚o`føÄÁyñ#€I»éÓÇ ´¼ƒ‘/µB¿ -›\dÞ‚)œtÁã*ÇáP\ñ{+fhXï#n~•|aÇ&Œ÷|ÃFXpasqVû,í]Óu‹‚ye8_ÓxŸÇó?D •d~>KÇñ2Ï-‡/á áŠ• -ù–#‘]O¼é×HÐO59¨¹VËøA½¼9s1ÑцéwѴĹ>âú1×d£èÅd0·Å¡ÖÁþËâ/\uÌv]ê\]ž>o=“HTç8Æ€ÒæÏ¥ï“Ê”"|æ†TÆ3Èöœ}J:¢?ÈNݬ{¦NHu¤ÜÇ‘k›11¿5mìj^ºÑ‘ -ò»ý~Ãm -ü‚0pžË"r3vƒ tF”Vr‚e¦’×úkÚF$ä’ùÎ/h¿ö2Ð$HÇø©Â[Ÿø|E„Œ´HïÑœ&RAdº*eèÌB‘æU›=åäÃZ±¾¸›2¶Vg;î°ÓSX0RÁ5û™‚~«ˆm3þÕJÛç5•·ÿ[9CGêÊ¢3.âÿ}4ROÂ4‘o˽ݭ‘D¦æ—t?„Öw+›²q¨úKÃ<PÙ]G»‹CÕéÇ·‡h³¸.nº-\‘ÂaʳTz‘ˆ¸YübYŠÏêÒ«YÌCYQ¡¢Û°§ìu•Ë¶*yeó‘=O•öóbI„HüT˜^R… Õå ÷>‘™ì§òPˆ -hjˆ^Ôqjë[‰Á=ÄDGkŠºÃÀIÓ˜ÿX\ G[ôí¾«´rîâ"ÿ‡JžOŠ„ñ“åtev4ñ!.:Wsó1LgK¤cǼ·T ³’õj=@ âwxÚE¾ÅÚŠŽÙ¡Øu2R¸|%S Vb^· ~ -ùÅDjìš ÔAãÙYºÉáò[‚Mò‡¿âA?øÁÔã/»8ˆ¬²/¡qYë„"É’‰ñz6Úñî^â HK"i ßeÅ#é µp˜~Õ!Ú­w ZŠøh¼:*Ñ­pÉä°gÞ݇Á%¢lHót^¹Ä²Ä¶³±™ˆ{xѹ‰î¦€‰#ÜÁKK 7 ÷ɉ¸Ÿ•ÅîË`ãJ±ïìáOm t¨¾˜X±‹’ð”ó/¶”glyc%þ2‡P†Vå(zúZÿŒ2‹ãóÔ:J\Óݱ*ÍÉòêdfdX‡(Í:¤£3Tal°vŸü½$ÑFªJ[Mõt¿ïNÖêÕ¬ÜÔƒ ±­Ð -ŽQcQêtp‰=Ä‚0soŸK­?È-pÅÙò@ó£‘#IuÌÛ†#%[`Ѐï‡|Í먞”w/O_øf*»öí×’ì£/T÷‘'æD Û$¬©Çä #û”ê:£F¿UVqœr÷>s§A„µó$KB>áQAqɘcZáÅŶ½_6Ú>ïˆA’Zaë¦&È©¢NËÞ -R­,0ê‹i<ÁÓLÂS”îkÔÃÅJ²œ,êvö®èÝ/¹µ#3Û@ÚÄ8-Ü–”Û’%ºÛ“jýºQZ͉\ù¡‰ãâ?~•ºp» w–„¢ ”*¥€1íú8)(.·ýŽiL}‚KTèó&éï!3Rȹb½Ågz|‚É:–éáNvXéºÁ׌šä‡¥ƒËK|Ù’ça¶²s‘T;>x(Ø3Ññå&ÙùˆÂ–ó tÊ7âó×_2æFWûÈÀ‡5)¥~J„ãìÌû2KOè†_£™@7gøí7‰8n ýÊ2q1¥RZ~ÚñU E"ë™f°– v¿Ha[>Ææ‚#~^{PjÁ/æuCt=}ÛøôÁ*®l8+:©0Ÿ8©Çt_ln~ÕÔ+L¢ñ©¬è‹æÒÎÕ•žÓÍÓ…+L%½3n±‚Õ47àÕª»X¾XúÐœaÞ÷"ø•¶8†ùòø‹¿³¢˜;¦÷éûs¡iÍq› ›}Mó ŒŸÃ\jÉz…¸*:v:Ð9ûuÕ].$4YoÒdjúêÿ:H}‚6•|¯€•Ü%ðáYCÄsž&vnͬɲ(ŸaÑí&Š3Î~+ËB7ª Ñª,·s©ÛÒ×q¢ð*ŒŸÈdGTA¹¦ÈsÆ g!åoG,ªQþ-ÖÆH¾²ên‰˜çNÏ ³“Góü¾í ñ5Ìç¦>J¤Éòƒ¬ö‡eþao÷æu<ÁAa-Ô|!Æû:²¤¯Ú?÷°uøu‘¡À~n¼/PZg°T=ÝV,+äDœ¡:¹n¬¡ì+!¥°kSGWkÑØÈ:pÕJärPn¢÷#£ØÌŠ)¹l;mmÑ>LË)#¾ƒ*M¦/†üœºF«ösh2ôóξ·ï>^îÆÌ}ûÜ -šÇ’»;Sõ+@xkAÝ4ß’’&3öJÏÒ<<®Q‡bMçD -›¦­2)3`!~ܸ\äK\¼áÌEŽ‚lÜizŽŒXm5¢£Q8–"#ý4.Á|rib€:‹3Ív=ÖX_ù°ºo÷½‡s’ß糫ÝOKì –ªÐ&Çá[%Ê“ p|SéÄmbôåöYzËüÊÀ±¸ÊEWöÁ²±(§ÁÅÐÚþìesœR¶X§rØr)†–ºZÓÁÒIN t"%œLŒÄå…Ÿ¶¯úî“é~hµVân>^2„Elê68§Åɲ]£ŠÓ'fó˜2ÀsUÆ0n3¯ø¡})êÁÒJë1ÿ‰"×Dò¶H½e•M,“"î#<ÄÓ&4³ ­s-y5Þ®nSÌVßWʌǗ0DtÍ5dà”ßb§Yí‡B®w[šµÀÆêPKzoØÌ‚ŸñöœzÎõ‰*›½Ÿ­µ½Q¾öþþdð±ú•[úÉIýáåûÙý²µ i½×'°õ„¾Ç¯’’"‰þù$BÒc•jÚ@:þu@öòÄþ»"7¶’tQX8§'°Û„wíì Ý¢5üÈc€‚ܨ’}ÏÜyý Y>Sp%*OÏ|N9ã§êŽ~Ã÷Ûw9LlBcÂ/ëùhlwǘ~NYÁ-ëAÅíµÓwäRþÔEÕ¬éó¸u:=Ù*Žól®vÁ¶¬QLE¦ iU—G˜"uÝÇX±˜Ï¥ªC,Ôñ¯Oýz%¯•Ô©> »Ù˜>SÜ v;qR=”ø;»rq8Ž S acvp¯Y¨´p}¤/·<ɥЮyÚ?xúªŒãý±TqOÙ®YKãÛ7K¯ÌV/£Üæ×õKn^ìg%‚CëåíÔÅ]×dšþ–ƒ‘´ýð³”@YNv*‚ éÑÅÔqgžúšñ2Oï ÏRÆJ+$û^z|ö¾Ùé"°h—¶OOk…U,™ --î´Di‡üé'‚–#ÉÁq!§åÉ(…bñæ/ñËèRÜ¢ ¯‡©c«‡÷n4++Hž³³áîH½im¿œj!Ý©r‡C:¸·ö+/ay²bòäk8²ƒ;ã]•=s„~?:­©–ó[¨ x•Â6\™.Ÿ¡•¼Òs‰qü?ZV‡,¯®NÆ•»I2w“2žú €2 ä,$é„GfÃùî­Þú]3Å‹¤9]¾‘ó8w:ò§¦ê¾;;¯´½ïm¥ÔÔSðŠöâ~wO?mxws0¶Ã{ö+¶ãµ”…ãÅ¡ú¯­Ï¬=¯¡½ÄêM¨‹³DÇQ…l[{cªàZ›4}À7ƒøÑCqvêFo¢ „ãv|Þ ‹ÝL9³YRf¯2V2bj¡\6˜Hdýý§²yö,ëÆT|ér2/ÅÒÅòÓŸ©"¶Oé3þ€:É­ã­ûØUÿ¶NŒQsë@Ë‹oO(ã:ƒg«¦ƒÎ™Ã®ÃmÜgÞ%òhº$ûKïÛôÑI“ÀÓµ±Ÿ^Á†ÖP JØrZÍ~ÊÈÅÑ$‡&«uC¤ud̼ü\9‚F?O‰œÓÊHÑ»ñ¾‹Çùõ'IÚ‚7Š†Î£ŠyÕÃdxLH[Á#LÐ&;¶Z[9š¡rNÔEúÝ’0·°."y¾Û«\]`‡*ñ÷yÂÀsø-û©µ<5ÓšáîFê´ f6ÖY]•]Ít†©œ©#r4ŒÈ2ݦ¥•T·ÜÎa …wÿô;çöŽìR¤ÇµXp·é:‰*ï¡L¿ŸßÔ[◡Ûù„3{¢ðùZógæÒ ‰²û‡Xì!¬ë{Ú9{–Ý‚ôo:vej46µ0Ö“J:¾”3•Ÿò<Ï¢6k«’ÔS½&}ºlqêì:im&U U~J*ñ -R ž®_ã„M™„‰OæJ>˜¬ÍÍ5X· Ý1¾Ãèί‘~è„âI­áì(Ú¡wÅÿz!8²ù‘ã`.–dð¼Nü~ù>ã›ZÃ|Ö½igѽ˜ƒôÎ|î·[|‚ûÆp|OhŽàw¢Y¯±hïwÈpúKjyʳÛ/ã…€ÂCDï½ök@ˆäôñ¥àëðï5pûß&niÈ)Èñ+m¾RyÞ‹ÌVv^‡TšåûÄ6˜©uòž·Ó4-Ä~1'¨¹é7eŒÛr»&LKðTÂ<ªü\ˆêSÌßÒ Z8*°z`»Qí/fãóæÓUÛ AËV¬(‘pqHÓ(ÀÊEÏDÊŸ`H#g`E%I«acÅ·ã¶xпóÔ £´±îê£9‚ œ©õ{æk¨ }2‰¶o±bTº°Ë–â9“Ç|‘©µó…v-; Ù½áò¹s'çóÀ>í¯¥ ’æSÀÎÚ0ûkb 0Ñ -=Ö%˜OVZ>p= bõ“.^è%¨CyiÞ\63+?í™®P^©ü€hB“d(xÆ ZßõÓ²aÏü $1%ZÛ¤vª¸Úþ3Vß~ñiľ `ß…ò½–ãQ‚‚¢,£± nëÄÎýaoM¾Kì(7ÛÖ¢à¦}ÿx Þ{–YÁPg ž„Í#LJl"’ƒ0’O'õvx­7Aìa¤œ-ûyóºn×ëàFHë£òñÝŠò§6MÑ(ý˜¡âøVSyV'È&17ÿÃQÞòu„&‹´%ÕÈ&u[ -`$]ÑÕ¢P‚çSäðR¡óÜ,XRj¬ôHjdµÊ9N¡íÈ%0ÃÁÆÙ‚„%–g¿Ž4¡«OË–%ÕX¦DPW -Ék›‰ëÊzTÍ}q;éúU?#ï=wZãÒùx™©X¥g~~*°Î)šY‡øò±!ù#Ê° -ýGĘjà.´»8çÌè*ƒ¥3×Þå³C ˜bºDb2/ßä–P3é'u¿íœ?;5³ƒ7ss]28ä‹QŒ£ƒìþþJ‡«‡Ï2d命ÚÞ/qƒêÎx?c¼Š<ÕÝ(`XJx½ ¼½’ǮѢÑ>xl&Y9íUjcâŸ÷ó2M¶}Â…vÓÍ¿yþˆì9PGÄ®`¬¤&AÉÞˆ]?À-nåS%{8;™„ß±¨‹ýôe¦ÕÕ9 ÿØšÄËä -àØÕ…mw\ã—¹4°cüßD0]9®êÅà·‡˜¢J{›T>™ê«¢1^õÌìÕT ­ýCbä]™}uxeãó^ýä„Çäo“mw©ñßU‚ÝÔóˆíâ.] -„Ì­g¤6‚¦SOýWê¬ vÑKàüâ${–PJ aYˆZ““_¿lªs2øÏJ.X‹Q†0Õ¥%©I¤o6ƒÔ>,> ÖþàJi»†Ûù<¼-Èô!IZÇJ-+üh¡æþ1Žþzñx†2Õ÷㪟’swÕÉ/Ç|hòoÕ/ߊ,ðõ¦Ëc -^6Î#­¤—#A’í _Ç\‘‹ÈÒúW_¡5-‚7D#¾hÌd€¡¨«˜Ì•S\mPA,:^`onäw?"÷挲¼y÷R/]v:¸å»¸Ë\ºIÀ.â#.¼»¼¼f¨X¤éÎÚœCWTo'( -çÝõJ´f0¦ÉfT‘ bR=¿¥)ÜEW£2‚ɲ4ä0Whts„¡^ÁZî}ö<°tƒ%ÐÈ,Ãgoo¦‚ß|÷ZaÔKû<Íh±ãiÜw#Áün Ä¢[Ûá LÃa@¶~ ãÎ ñ×4ýT—ÆKaCŽÓ]øì‚…)¬3èÞ”>Ÿ+×þ©ösòÆìdÞáÑÔgB ë§þX\ÌpƒM¿rë‰ëý”sK¬Z³Ñ{k2‰ý$³R&»ÛÀê€ûsÛŨˆ&Ñ5ôÑ[WæÓ²G+Ûð|†%X&ã$¡ßy5¤·sÊœ¶5Þ¢\H"ñ-W©%]ž¤SRŽ¨|ë‹Ðº4?µ,öñK „…µŒÎÞ$ÙH3ÝÕÆüAª+ÏHöˆÐ{…|?MÓ’ôÌj?Jö1\ë‘„‡â“™¬Èd³‡w­*£L¼*?ÿ!ñеAØ=©òtY§'moÄP"¾¯V?Ý!„¹X È Îe¬õ}Ž}“Ð iY®s[ØÒ]Ì…"gcÒ¸$ýOª h±ZèRß­ÂJjáߘâªùZ¿µä °MûzÜî -s/1+(T¢žWQ<ÆÊÿ¿vëþ à8ã¥bN³e&$!±)¤y9ÛmÉ榎4;lcõÄw"?RìÍpšE½¹ÑA _Qˆ.7ÛksyÂiÊå[Óç®1÷)cÅòúw¿âSm“®07 ´ê -¼ož’í¢BVÅUo­É~u¼§³‹ØøÄBK -ŸZ[{ÎQmèefA¶×Ô?Äp,I°Å‰é«ÜG׎·+›ƒÁ‘µ ì.[Èûü,jv¦ÓVÐè}cè\gµ‰Ôñ^ö:|èiäaìo/AV¶;Ä6¹R= ¦7R~kv–g‹Â^³ÎŒ›Æ>#ÂļENƒ9†[ |å»ðó…Ò¬êe‘Âö¡¡AǹíkWf}‹L£Ù+ĈC†"h!µô%>Ôƒp~(\Þ<%ªmÛžŽELÅûñ¦t-GõÚ(NÅRÿ÷„ku´™]tyS7Áre³}^Wb¼A=¾‰VMOùeÃed±™095c‹Z~rîÈñádºPÉ ÷s–Œ‚ှù^þ°×YxwŨ„?ø>„u·zrz±Õ^Í<ôLzlõeàÕƒ ?õvÓ¤šöÜ8Ž#“ØdØ$/§åÓœJƒ¥½[Çz÷ðc'†em–.;ñ(òSN´ØÑv‹©¿Éæ€è‹v‡‡¸§•±5©˜¤‰N/WxeX;z)´èYöW–û[Ó*.A"‚ÖŸ -AJ®bsè\÷÷%ÔºèrdüMÿ’„ ß¹íÉ‹ "©¬^?2c4Gº¦Åå|£Èg΂Vð*ŽÝ²w–mó yQ¥s^«”^"©o¹jÚI ˆý*On¶ÕÓcñgÉh}]gbÑ™IZæíÇäŦ€eø¶äñP7(øºc¼€ÂÃk·  'ëšüåùK€Z¤¾¶^ØÑ-ØX5Ž9;žâŽ”Ž):YyôEyœucns‚W~¥ª9¢»_eÄ„¨àÌ«˜–rÔ`™ó¬Cò|–Û.9<ó@ Ë|¦/ǪMN5ˆOK´€Á×½±þV>Ì^|«kb iÚw¢älõ ÀM¾°³OˆÎÍâ/xA±&^ÅÅAuË«¡—fn¥`4—6Êb‰ïŒ¤M@ß›\€µŠˆ%ƒ­«Ïm³¿n,ÚúLcbºˆÕq-€ê -lŽûi˜Hç‘nÚ1ªt Âöœ}¾pÙæÿÿ@NI 1˜gé$Fòæ¿Ÿ‹dendstream +xÚ¬·stݺ¸Û¶mÛ¶msÅvÒ°±m£±ÝØN46›“~ëÝûœÝîóû÷+cuÝs>s^÷ÄýŒP’ª¨3ŠZ8™YJ99º3²2±ò‘ˆ+ª±²°2±°ˆÁQRŠ»ZšºÛ:9J˜º[ò‘°òò²‘HYšÿø89ø8Ùà(IÄœ}\m­mÜIhÄiÿéÄM"ê`éjknêH¢hêncéÃÜ@¢îdnkéîÃD" +¨ý󄉚¥›¥«§¥++‰…­¹;‰™¥µ­#ó?J²ŽVN$Üÿ[x8ÿo“§¥«PŠ„æ_š´$@I 'G€‰…¥³’p6K ËÿZÿwp)@ÉÔáŸáÿY¨ÿ§ÙÔÁàó?œœ=Ü-]I,,]ÿoWmË»)ZZØz8üßVYwS€­¹¨£5À’„åß![7)[oK [ws+S€›å¿â–ŽÿW¸rÿR`VÓÓ“¤ÿ÷žþ«MÅÔÖÑ]ÃÇù?£þÓù_Ìú‡«ãjëM¢Ï\^V`GàçþŸ¹$Í,l­IØ8¹HL]]M}à€§Hœ$~¬$¶Ž–Þ$–Þ@af&G'wà#$À5 ±rr…ûgC{Îlõ¯Ø¿‘ ˆ¶ˆ€?ÈñOç?ÍìÀfàØS‡?!`'wK 3À¿÷þ?-œ$ÌŽfÿkÇ?a.f 'ÀÔõOˆ›„ÙÙÒÕÜÒñ¯§yH˜M€Q7Sàrÿ'Êû?³ý÷T,ÀL]-–VEYÿ'ú:S6uûg7û?A`fη?`^æN¦"À|l|œm,ÿäÂÁõ/q[§?†À\ܦn6"ÀL|-]þ€I89Zþ‡9öî^Ú9Þî6®–õøg—œ<þ¬ç?ûdëùW ®ðý‡²n–ž¹O ³å-'PÕÑöožr8ýõï?Ã8Øþw” (héâaúç p±ÿ³/–nÿT®?A “éŸé¸€J¢¨#ö‡€*âè!ñ‡€’ÿ!nàbIý! ‰ô.“Ì:Éþ! ŒÜºÈÿ! ‹Âº(þ! ‹Òº(ÿ‡x€.*è¢ú‡€.jè¢þ‡€.è¢ù‡€.Zè¢ý‡€.:è¢ûâºèý! ‹™«©¹½¥û] ^öÿÄÿûRK5óŸ£Î œÈì'2ÿSX€3Yü…ÿ†¿ðŸ£ú'´þ ™Ûü…ÀÔÿ*>,ÀÜíþB “ý_”ú«4±­þ”!V`¹evü VN!ÐÊù/üç¸þ…@+׿ðŸ»ó­ÜÿB •Ç_´òü V^UW •÷_´òù V¾á?ÕÕÑâïÚÁÊT³tøOìÿ}툉9yû1²kð‹åŸÝá%áåâ øïžšŽ¶Àë)+¬5,,ÜÀSðOÔÜÃXÝÿõ®Îû¿le |ZZz[šÃ­s2ç³Ëh‹¨ +”,™¯†¤³nOTjþºÔ º– +(Ÿ”w¡ÛnÒy©ÉFG:†<&özÃw‹îñW‘ºqIÌ\ù8ö49ÎöíÄ×¹ÍVô9r&{ ½@în[¾¿äU^ÜžªJÕ-Éû9zQ¤B#¡q½I +2 ïÙ2ÆÅ­#• ÐŒ o¢b'UCÉt©ŠâˆÜòBIM†Øš ´‹„é ÿ~ãÔãöRS˜òaðˆ™€jÞCÌ®¶O‡¡v"|YY‰‚Üø{x¼^$‡ÄZÝ•ärFmR64=¢>ÏOÒxá'ö¬d”¢ç5Cgé;%—ávù¡1;½±M©ÜZËÏä§/qÔÏ0¾ç$éO¼Å=ò)A»Á×þÈ)îEqZ´z¤ˆväØz#Ù9ó¾¬H÷¹šx¢pdΩ¿ý¤Ÿbnm/Ç}é bkÞmG¦ Ð}ôc“l-ê"²øgº œRB.ÖùjAÊ’N^òtOwk£üÌ1YÈn]Ís˜åèÒD%cE3Þ‚B-Är³G$9v +VûkHcöµPG;‹£ÐoŸ&.–×™á<±‡ê¾LùÏ‚°æAyU;´ïR«&&¤ÛzõÆÆA¿÷ÞÏëH($yÇgù÷AJ&2YãÊû•ÌÀßk¼•Ãg“Ù·R-®´²íÅ-6©÷tì¢X7#-n1t68°’Up‹«C.3ž¶a$Û¿Kì ,H€]\ý†Ç'ÈYdtóQ3û8ÿ`¯ \¶+D@±Á¯Ê@„½9W®p§3Ñí¢úÂ$è*ÕUýúÙ݉GR +B“zÜ+›R±!nÚ©³ › öõ Ü÷>­â¶Y~<­$›å|Ó‘ l1{eÍæÞ%lÊ[Ä/&OìÛØú]þSxòa•Wç ŽÆ‚ø ^þ悧ÿ`r>4q—‚ ¶ +M±°­Ÿ¡Áhœ±Öù‚ü +Ä®Ë'áM´_"Jî—`õ åEAi‘ÎWr`Êú\Û¯¦·ÚñZ ‚ðJþ%µ”Fä[æ\ÙÉ„b?`ãCd£µÐ+ŸÊn`ó1k±.5å-ï ~Îqº@ê…Ü´X¨åµä'Dè Xõ {±vïÇRè÷û›"v±Œò¹”ÞµA¦”·Ì™04sg%\Ì=`7éAÈ^p҉ψ×yZ»öÐào:4¢Ç§ëa¯ÒÊéȯö<Ž£S¡ÎòpÂ#å+¨2Wú‘*.6ÝÉž]å›*`qv ~ÄË#Kßñ–Y±WãôBú¾©5ûñ<`oGŠWúû> EdªœËì–ÒêÒš—{%ˆ9€7½DiwªÂù¡­\s³3 ®’Üñàs¯Š×úwÌÎùâla± %GY†t#¥p±/r¿šp¡ÚNåö`Pb^ÎòÖ„úŸö$ç <ùíÑå(‹¦¡üæ]# Îà«ltãBL˜Ö®¥añ¤`±Í놅rÛ +†µ³‰°ôŽ_‰ü žFèw[°~í… +«Jé®Ë7Ý«]*3YκT?&AJÅy.†Ö.+´z•Ò~# »Ú—¾XK¶’vIÍV›·{·lŽ©ä$¸ñà?Êÿ¨-<ç=Ù…•‰·ñÞ‘;`(?~Ù´Ì;%Ÿ®G&m +}oIoRˆþäûÆäaŽsÄ|8wÀqÚöBc&ÔocÖË®Ÿ) nýðjªs‘ºgJÁnÆ=ײ¡š›##m/:-¬Q`÷vxUGØèb&ì‘|ëÇë/Í÷–êé±h°3(÷_V¬Ýº½Ò ÖUÀý1ß'Úpþb-6÷.IÓhÖU\Ô?O»g9fÆÏ0L¬j™é pò P\Ó‹Î@ô©­ûf!œóQé)=ÞÒBÊ[±æ#9@eyŽönå9,™F\ðkÄð`©Õlz¨©Ó‹~ðë¬m§bûv1[T—"çZÎ]U‚ÝNÙL3z§€¸¨-ýÀò¸ÝœÆ´{˜Žg:b—:>}ì¬Éúáû¶<6\ù7ÚۭЯ€ˆŽ]Gú»Y"sëuqñ$µ¸¾Œô7îÙ +DEñæ}³ÝŒ‡_š…¤ÐWÉ'VèÔR².}3÷Ÿ®˜]wÔ‚zQ”¦ñÌH…ZŒö4 ˆ6ûåŽËám•â?É‘ } »«5XÎóÑ*DÛLh±”ΠèY4zÜ,Iï ]û"}]©±=Ö~ß°âCZšòÓ Ú§°gÉñ(i­=ÒÒêWuvXdàÞ䌅ºäÉaÚúÁÊîyïk©WßfAf$}íð§BØé°ŒÚûðtæº&ÑoI1õ:Œžº£?«¹Ã4£$M×_}ˆ½¤ EË0+8鄵A$aê=jÐe¬_Õ†X>œ•#åƒV¾Chä½÷ß8þô4rP·´ü>ä9÷ÑãëÀ“òuÀLT<ÂÅ°ÿH‚òÍý³ ¸£_Çñm?<~éP[Õ%Ñ mrLŠIc¨0ïFÅÏÏL— ö›oš£·nâb?fòc^ó‰b$è(ô©:vѧ# \Ú{$úK½nWÂG’†nç¦^•c$¾‡aÙà@˜J|6ô¹ÇûlJrÀsÌo%M1?îWív ºØ(â "T"CÁ›Imœß~87>ሔIcB&™GK3Ï´†Íº H~¶ØÂ÷™Kè:úà‚7‹¥b è·W¦ñl¶R6ˆòÝÕ6]gÇdçPB_Z}d ægÕàÃ]DãÎ*ÚeJ<‘ÆXíM?Po9”›£F8XÀj< ñLx$¨¥!ìù–^„&kà>T~Ouñ™*×K@{»´T–u†þi¸¤{Î$ò5§¦¶ƒÃÅ‘†#FýèÛ¥®½Zš-‚@Ç…W&gž*Î{à6~}ä—ÛØ+(l"S^sI¥žN†ôÊé3%"… Ý%ÚÙÝ@[¼‘ªÂ*í;ó¯J/Áb–̬,ƒ&#íòµA¶Ç“dÛ4ìwO#ç¥ÙóÒa„ä`mM\&á¶lQ)\š²*®1Ððù¹HÒ’DYéKMA½ˆÈŠ?ùÕH“T,h[faðw³Ms^Sܺէ(i'7Ký ”`xx+ÍûžÊ^u}^ˆÌ+ qWø–ä»â€bÏÕ~‚_—€SÈYÎCpè5ÇíRŠbê7:BRù\ºä!2q +1¿T±\ƒoDDf¿ Ü,8’¶IÑLùиU¹Ývãè$Ÿ¯f.7/¶ PSa¤ŠHB©–7ûUö‹‹HÅtn¿XÃC%JË^*48CQM¤!Ã2£+C>Mû¤RÁ›±Ôk1¥9‘@¢éÈè}y®k`!<ñË‘4Ìrâ,!SÙút9×é$ÜѧùÏÎp¥«~þ!NÛA¿#Ž êí¬wI*ˆÈÿýòóêv"-üDqïÎÛ—!§EwzÛõÐ$ñ胅9:D]ïöG7 {׿–pxØ6#û^×b†T õ’uÑ<îœBcºN;8qýʘ>oœÉM£:ͱ›P5¨•¦àõ‹U91¤&^Ù”ßëe¡Jk^ð#{U’|É´;N¹×ÛI‰÷Z°S ¨ sÊNûå÷©x+×#‹Çf×±Æ=å€VÇÂSfŠ94ô£Ñà×BÛG6¡Œ¯l"tu'²j†ÕvpgÛl«ýçËŒ£ßÆd·B‰²Uè+<åàýÄr¼È£ƒ•œ~Áæd—ë¯e]}Óû13¦C‚Û‘µ)Ê`‚€‰7S ¼I»x²¡„ôÜ[;i÷!ÄlŸ†ÐÈ_UÒa[Ú€(v6¥ŒLð& ž˜R'˜_.΃R;Si f±ÏØÙøçU€2•‹p¦»1Vª‰søä=™U}rÌ Éú}ß›u$„@º'R‡Ói/5A¨õÈ +`Äé$¬cú}Ü—V“›²£•a«ð€vÀaÀû;GÕYäÚ]œû# †á0Þlm1¶Rxë5ÏÜÂP{‡·r&»·ÞZ‘ϱíI·4«N¾‡¢’ˆ7˜î¥83ðM~cäÚ¹¨Î26곜ÀKïÆ—)©ÚF)óË$ 2:`žØ&Í«<²>?¹…£±2N¼4—K›bb¿à†‘ +I‰ÄDç¨é†¨…š¨ &uâS¥ünEHX•ŸêOóÞÝi¤Ö2D¹¨Œéº+´HoF:wûä_¹¦ç~ÔÝìW'×á^û•Ü‘r/»óMÜÉ<Ûðò3:xôü’÷*á‹í—žÍ£~î7fùņKµê\«ßÑïò‘ká=U£Ð1t™a´_,¹ViÕãï'+†¿‹}µ­GÉf+(8ÜT|݉ÒÒýP âgy†Ç“Ä¿ù$Ü\ +Ѫº1 ixgh=]îhm<ŸtF*ÕÊ1ÍOÌçyfnÁ} Rª2½ï¾HäÂÀ‘¡DÙ„rv2ØÛâßϾÂs[ÏGá<¼ý4ß¿BZeÏ}€íü ¦ûà[aêŽ]ÍŠ 8…ÔíÎ$Ò1(Ï·öFG&¦œLT-¾iEš-„V$³Ï\î#UE5˹¹Öö‚iRÓöŒ„€³ä»Ág‰{¥õ&®½ƒe–©yȽߓÙËÌ~v“Ë'GJL»q”û]ÖîjlMoH6æÎX +uä-Òc%B"“Oê"F&Ýðä²É‡¹5¿"Ó{ îp]B|!i›|8L±’uÔ«¶Üˆz8 àý¡Qò) !‡Ñ»w æy(ÔýXU†f²†òZ)¡!~IBOy‰!ØÉÇÖ|£¢Æð»àú²ítûYˆx³åcÞö‹g«îq ôìɹ+ˆB™iš2¤?±«Û”¹NؼÇ(¨ÔŒšDbA»§ØÀÑðÎ~§‚^‚€½g»,Ÿ&aí-„}Á­zLhªð•R+JS!³`œ›mœTææ´Þ4¼Í;´•‡ ~­vyM}‹ ëi{m-ÝCÎïr…|5m˜i¬|ëµ¼ø‚œï8ým’U¥ö¹¾¹yß(qÒ¾?#ýŽ¦9䋵ç&üµðoÖåšÀÜã¾a K}'F˜mq ¥Œ}Òæ3¯=\ew/$åp ¸˜f)‚Ç(o°S¾-4}¦þ×én¿„†ÓkѲèi#ñ²bBÚ›!YÕ¯cƒs–ה΅uT +.-W‡(8½ßpàÝ¥ÝìÛ9ŸDB7‡kgãæ:v|S6?­uèä—š†XÌMˆºäC5?ÅF~QVvç-ö>ƒ`1ân‘!‡<¼píSºŸ¸ê˜ê„$Õ?‰χŠ¯îî3G Ë<ú¹grÃæV«(ãе÷ñY¿‡ò€‰k¿/*`Š~#ú…ϬqVÿ„”§Ð/ÅŽëÀ‰˜‚dEsŠ±5B8¸ ù^@d¯Ñ—.¦¬[Æ~KSóñ馻Ȥ¾½× +ÜËËŠ&pçò°Éê¼+¸¢£tOoh âðòë™ÏSë*7’ Ù)ªsü°‡ßøé3o??ƒËIp>GNz?k*ßÊP Òã4;|Þ;5³´$á¢ëº/% è•N }#H®‚±Óam¿oS—Ò…‰Œæ&çñ‡‰OÞØÌDsý. Þ€n#ÿ°ÇIªÑæ™±w‡fl0<„©¼"rFƾº—¸˘uO¢R7ÝD%I*8ôlFÔüÀ-%ÀùpüÌçd`üUÌ\lÏ·žpà~6ò0•-ÕÀM€šikP ¿CÎÞX!¹é¢qæÁ7o¦€$KÍ\‘ê­Ü–$9õ“Xã‰óBeÀƒ°Åùª¹ 7ï™b°ÏxQ}!•–‚ý€ª’xz ÜØ‹Ë×òëÇaxãý®æP¯Õ¬!Ͼ†ÉiýùÈwª¤Âø÷óøC~*Àe]ÒMà,8>òSF1ÓqµÑƒ8Sib;ô›;¼¥9\¿–úCb~N0À“–*ú‡¿#ttcw\PŽ•M›c+¹„óÜu4áBŠk)|´¬ÓðÁŒ¨ö|õÍÌ:”Õ¯]fh½ào×(qjßw:S=àîµ¢s¥±Œ¾œÛZQjìI~üJI­ 5ö"jPÙéµ>J¡òY_GÍ̃êøQ»e8à¡»n%•+ñõTáy|°TÝ÷< ô[V ¦‡œT"ªˆ1n¹!fØ7ùÈÒÌ‘¡(]¦e¶ ÄÉ—¹Em•BºÇ‰ÁcZZMK j<}Å!€û²C-Ú'\Ì—Ú‰˜Bâ2£A¼§PÆ÷‹ð•G+IC0*%ËEßfÉ£ŸW +AeµF ,—X¨3mÓžÚ^Wõ´¹Ø§Šñ#vô§6É{R½°­ðܬPq+Ë×JêzÅ 4dÐuqäF–^°ˆ—;0ú9mó0™î2?qMƒPÖ cŸJÉêþMšC‘uöcüB9yBĄ̊¡`•õÖi[Œ‹P-ëV¡h HRî%f³t¥døè; +Å‚]‡äÚÒAÚ×iðˆyzÕ\‡;'M OË}ý£’LáYhã!x~ãTÃP¶éÄÜ‹B…}nùÐ)ˆÛçvX`ê$Ý/óódð·› •ŒÏ?æ’Y µµ—÷W±5atW¾\yTF“ü2è£dTäýŸoË/)Ú ÑÝ‹˜’H +A‰\Žàó2½É»³Ñ–L€'dƒJHý†×RÓ"ÃîmÏÜØ9ð[™,ÓTv[Ü—ª9Tßžu+yƒZv]|~.ôAÀ,1O¶Øi|ì J=b¶¾µˆ”Ôõúý÷í,r:„µ½h‹YP” {Wu’¾bƒ¦6_ƈ¹òú0¡€ +ø ÜgÁ“|åàU­sõFŒµÐ»øeAã7*¡Á¼gñÙ(qe‹É¤Ør,P¹ß•çkµ…S‚¯•5ÞªaË‘âoѤ ð²²Ô×ɨé â~scWIŒáþȸGãVºˆê€ˆ°SMÔ0 +¥üaúvÛW]ÔJØÓíP‰/S¾V‰ˆÝ«”Š6¼.ïr‚ÃÙÌaŒ­jk › _†ø=˜ý‹\–Rq&<ÇOhÎÑÅìVl1gq7.ylUÄýáZC}X¸7Å™u® ÇEƒ•–GÏ,ej½™ÑÔE°34G‘ÖÃ2#¸$õÇì eléuAÿÞuÁƒæ¸$a ½efŒj—'¼S85Å„iQO«ÕLºo2~¾›D%œ aAhZ]CãÚ“Ç%è­{Îç ÅØP¡ÆÓSX `R!DÇ.ëåÃîî€BO'¨Úê{ŒÎæt6‚dSR}3I{JÜë%® ¾îXuÁ\pY·DÚ.Sn"þ$;ÍŒ$»TÞ ô¬c< ØåK¬}©€H¿þZÏö‹FÔ ITý±¦Š|¬Ž(¨c·*Cì ,©|•±ƒLŠ?ÑöÁn¥».M_$(z°6 G¥¾EüNiU¥nyænžý@¥\®j|Ÿ,ÃùfÈÛ†n5• /ÇZ°P\¨ž2%$&YèÞ뇧Ñ@ 2æyýlå©M«.é“ZPÌK§)®©ÇWpñ¡¨íF=oSÙ8õ!øÛÔ€`æðk¹'"è 3tdBÃÆqÒã¿\fêh¯8bÔ‘ŠÙÊm}Š³Ï8ÇÒ¨Sßh_të[uY¾Ø9‚8O—J×nIëÓקSYðT¢ÁˆŒ£ +aYŽÛ~×Ö:å–ræ‚7WF«ñœm)T㽫Z”s±è@a¤ Ó~³o™Ìi*Ù +“eÛ'õŒ·+}a¡­R¼¦πߕoSºìÈÖ0í¬ ›îzƒœ5™Ú‚÷BÏ™Nc¦ðž`àªÜ¸[Yþ”,é0'wœNwŵÂòÇ}êN‰½)¿¿äÀɲ™‘KÅÑwd•_K¢z«·«g°?ZNÃ]µ~mdyúm¡§(¡›z动çª z2ÂY?¼,koÊ&+íâÁi„1À,œ'dV7wˆ%Êw¹ð|s¸´]dÞ–[6`qçóý´ötg¸v°õ U´8—šÐ$Í4z¥KpëüÅÈŒ¨›W³}úÍb +Æú#¤U™Ù¥ +ƒÁ _ý —öy›|ÐßñÑ23»:Þ¨ºê„ +ýe¿+ÏùJGÚæ_Gãâ>i6¶‘?tËiókQ}Í2CDV¥2K©Xq‡7¤cά¶Wz8tR”³ÙúWx´#~aôcc o_ô¼qa7hˆ&lꈽuöTtžµ8ÂmÄî£ÕïZ³Êê ô 0±IÞ°{‚ûk.å<áýòŠB憷_Yíj¨>çãf¤d¤I¬~ô‘áaÇ“"Úm˧Ç%T–šSà²Ó‡QU'c.¤Ã®™$Ä0¼áäÙlü&†—Ö•€¡j‚§+4’²páµ o!ÍvèuŠ‘˜œs੤À( ¹3lIBÒÔíÖ :e&Ðúý†d­nÝœ¾i2¶ÇÍös©3Øšœ¨1Ó“`é W°ÅWè;,³XÛâÇrZgWRÏ\ž©N9ã¬Ug]‘1×Ú²ò"n¹.ÉýÜV¿9´Ä ê«‹3Î'‡!÷`Çt²:¯5uÅ>¶ù#Q˜P¶ÔßÏÃI‘»?Å"²=Ò×Õ_ì¯ÏëÓÕý6žÄøºu™Ôç8Ú˜O¤K$^é•k¾q¤ƒ|Òô˜ç|ÃxÕ#¡Y˜»Ã°çYœ_·wãŸð7µ 4JŒ'Ýyr¥¹­~` D"<¢–‘¯ŠÕÃœ–¶–àåJ,2«!ÊF'x—X2u똙;„áwÏ_ÑïÐO ÏÙT* +íA-‹b+Ò ó¶Üå*ßß,Î · VF{®0‡±‡ñ Qc‰˜‚Y×–ØXìðmé õ¦XåÝ\o_éÅãÆK—ú^y þšÄL†¹•,¡'ëš²ëoª…¨k犀þú±t‡öôÛ#åVã¶C´ò"ÇÕ,½šjÒaa®h it`´­ø8SÉÄhü[Ö”y‡'VØêßæÁ—?,"_k Ÿ·§ÍFcÙkktã(Ñ#&{zÓ¤Hz¡‰ARX½ kT>0Bh_ª.,Ä0eeMåJ·ÒŽÃÑÈöUìÓogÆç’R!ç ®x8û­äX¿1¤­­ÃðÊ‘._Wh(œð݉×kRTU· ꎵ†>Y]à âYqT_UŽë óùRÞÞùD%_ǧßÅߨ(1oµÑmš”4á‚/–ódzèg¨u?¹T—+‚}ÒË3i鬻Sñv¥=ã¨þ<«÷EbaÊQíº-BQþçøä×SÂþ]§^à䢸K{´^d³]oMD›{ÉлFßíš0×èåÞ¯¥ˆÂ#n«¥~Ê Tç˜A‚±ä¹ƒ¢Q#{©°ŸVF5‰âë‰TCDÇG4«F ì#®1\n@ ÏK›ït\!Ö§Óx*)â°UŒmš +b–ÄÿΈÿ“ï1Óéµ±›éÒ€ +¦´0=}ìñ`®hgÞÿ–™A\þs«’žž<ýj¿d%±Ëã\FaƒW1#I[]÷èa0²ÔÍý—qÈýñ±GJc½9ãÊesvëèŸy°ÜF$¾˜ÌX¤/ûø¬§–æŽ|òî†xŒ_úH$ý¢Š`cauX¡…LT©¤}—„Úªî”ØGHjŸwÛb•Ø» ¨`LžjLVuæ +[ÿ2•=YÛØg¥¸š0Fœ™±Ï«²û')d2®4ËdrÜ;׿VYô‚²ÛeïÚìú‰‘×ËÈ«QÊ•”`*Ö¯ƒwxe]Û5å±"ÆîÓ}Z½Æ?+“d*ŠKR¼8FA7 .?Bk‰ÀÀªÃÆ<~{Žjña— ÷}Ÿgïà.ªL5UhÖº½dߪîµ6ÀÄ‚³/€Ùië×w”ððp‚}â!€3Œözñ‘À÷fyz*zûúûØïDì÷€¿4¸?©ïGºL sˆ8ªð›¨²¶f˜@‚žù~Tªœ¥Fx­¼J¢æ+žn‰u«ñ÷Î*¡ÙŽŒŒ$J?z{v>«ÃÈmtJ‰! µT¤ánª=!´ã¡´ÅÛ¡§¬Å’AUíU’Á.]9BW®zÝ㔟ñÏÔÝ$÷€¬’‡e0ÙDT ç¦;\2W +ó@úeã±ämõŸ–æ\ª•"¶¨k„©)†K#zbåÏW”˜ˆå>§‡ƒ"t+ª‡¶ý<ŸKsý´·($8¹EŽB+6>£Þ¶ +AK@ñ”ô1ªÀ›ñ«× ±›ÇøÄf¢æx¿d“`e)Ì“sIžkJŒ¥#/¿:¼uöN‹>•¼#ÁQwa,þZË¥úôû,U^œ„û[ÑTª¡ˆ^æê€<:"àzw<©®œñóv(à*¿™—Ø]²¦-1òH§ò¢eÑõÀj_Ü]+jÆŽnL8_ÒÁʆ¶7¼\„%é3/Qòñ×s[ºË§•D$£‹Áê¢q¦¾‰mXÒÁPÍ&¬™Óßü.’Î`)“}•žÌ¿A¬ÈWmA÷/÷™T·„L‰Êmnß\ãÁ9Âß@ Ø›jsw*ü7UÇÈ幎ßqºZM}×8(‡+ÚƒKæ‹Í{lù.Š +#že;¥HpÚ£¿ÉRˆ€ÀäFþ +óŠ¤ïæ5?°ó,ws|5æ>½óÐÇRg̹)[“âö±ÉÙä7;àÈUÓ”N\÷¼ƒŒ9„oúŒéÎzÝšýΕ®æø |J~Wm&¢®·¦¡eUuÕ= +ŸÓ±ÓSêóEb•uƤä§ûM¤ÜVïI1!H® +J—~®$óÊØ'±Ì½m&L2¥@ß]ÕXÕ™œG /¹G8Ô–Ö>Œˆe¯Ab +Uâç~«{?Ê,#Ÿ.«dµ\¾xÔx—) ýÐQÈŠÆKmÇÛì>ë÷m…¿Pm"›ÝÇÃÇa¼¢âð ¡H†r«Ú2ÅyFF¾le ‰`ìªAH>ì…'âä}–ä.øÚJ(Þ¡~nFW¡ùÙ…ë•¡ ¥Zéx±²“ãAgyÃYW¤©çBe<]µ>ÂWó3ƒ½îKDaæ¶yÏçwxZ™Ì¦ŒBÓÊBýøÆNfÔÜoò(™]¨cPZXKþ)²¹Ä+ïyÌ%ÔÅ®Õ1…VƒjΪágŠÎGÖÞÌu´*Ñ¡ŠááoRÅ}ø™ø4ñÚOë;ª$Üxtôš{ø&I…½ª‹ä-¶´RÖ`93Ã!t_9ÒS­ýò;ˆ6v\ÒzÞ’ï9õ~nEÜÕ·Þ +ŸûKÉ°çŸ/äÖàÞ ½m§„ž¾«”õ ¼ëOeÑ›ƒt¾Ÿ€>55¨}ÐÃç|î«+êÍ0á©ý}Õ ®˜‚ü]óq°Òb&D¹…M$‹ñIß4¹x¶ñùÑ>|QIcAd)bæ™®·¢Eâñð#À–ï÷+%ÛöÞ>ÆÚ†ç`¹rUrº4«k;úîËE«O‘ÍfýdµO„ˆ(W/Â:£ ]7Œ¶Ø6˜‰ß~˜Ó¢:™UÜpÏs|™2¹ÒkkÇ>ƒ¬î£¬S’çQINœ: ÌåÑekž“ ³¢Îyÿ›:&L7V1Žp2ÌN6$†‚5hßØêDø€-½áž³þ°ÊãùGï×)adën&^á:"*±X4ÆoÛºy›ô[,20€ÝÕünðŽ°¹¨ç¤Is6e†ºØ§ 1þZ¨úÕˆ¶ÊŠ/jš¿.U¨ÙÉ­ElóƒâÆs7:.ñb7ÜsDzì¡ç4㇒M]gAÎ÷” 噂vÞÃ+à,î{ââFÈšüÞ˜¶O©O +Z‹0:çýXûDêþ9‚¡h§º2h Òˆ¯6&_ ù:–HmŠCoP,u.¼afmâQÉ„faX_…*ˆfÅúò؃Á¥1?Z™ÖšµDÍ„BU‘#a0w‰¼„‰>·¶ŒÁ2î—`5ZUÝ>G^õüˆ‚˜ÑJ#^>ÈÊ2Ô5Õ^x°Ë»md·.Ë;é ÿ’þü#E +‰'). OµOmwýѧØöRm°[º“:°ç¶—c®(ä2½ì‹XøìªÝGÏÓ58`À6µ0£?Lªµr£J²½I>Å]¥ò *'¨Ž@¢ µï(%©ˆ½ˆJ† I%vöµF8q—ÜOY§¼MnÐ%_3S] &Iî^àdoíŒýYvÆÎkʱÛ=ûŽ[⻒·}ÝO>åyN븶á‹6é[¾¿XxàKJ9-iJÜ…¢ ª3+KÈ]#‰dåªSí‹õ»jH¡É0Tü¹ó½¥G<öIªAÏ* 8xÔ•ÎñŸÐ²½Æ›#lÂ`éÓçòÃÛ&È™%¯PÐìðy&#wOüjíÃtÝQí²ïYE²Ï‹UhÝصq½UOÃ_ï y¤ã(“WèŠÜ¥Bâ±Lôlº03à>q‘P÷”^o'L³ßò‘|u_ +¤ù$¶;áôŶIQ‘}‰%Q×fkš5g~(&zÃüm’}fÐeƒ•™Ñ©[.ð¡ÔT`„Pª³mB¡‡¶š’9DDÝ5+8“Vrµ#ï;¢¤×³2û!Úi‰H":Ú€ŸA Š>sï±R,Wü‡ÖŠ¶1_Â(L„’uL± Pèkä|O®`WjXͺtɽšâíG ÿ +Œm‰_e`T€“+¸ü­›¯â_Aöààˆ8ùò¡j‚½:v"~\Ý0ÚhžvRöʦÌXD‡ÄÁ…¹)ŸÕ]8¯? Ñäg=¯ž“ÐöG0-};w%~ïk²Ç"ßPµõà§èàÀ–xV”aû&ƒÂ;øIPS>؃å›wæ^—òÁÆKÈl|jN{;)=ù½Æ\¹õn…ù|î+ãJ:ö‹+ÝÙ”qÜÌ“ƒ‡Øëé~ÂÓLÔ.÷•zÆ¡ í£GN`¥‚ŸÞ7&¤¼&J“]RŒÔH2RvGó2Q‘ê&„æ¥(Jìi¿™Þß©ÃïƒéL„&ƒ¼ïúÄôÈ&X ‡SI\ Sðg™wC·ÈS–¤ ÒŘÖÍüãnÞ?#°ÀÁ‚ahwOHÙ¿üˆ78ÍhF´¼(Ö»¡ˆŽVì;ó·Š,DYAnÅAq^²vîò‘ô÷WïqÞ[1­Î•FGÖôÁ³9fAmD‡^Ÿ¦½¨Å‹"¦.D¥É1:o údµ‘5ÑËÒkü5QCƒ¼®¾ Ÿ”ºkpŠ +’ …aF³ŠÎdÚ¨Þ2!ÄøëÅ£A° åBL‹‡ C.+4†šµˆh]§+N±€ gÇ6† +WÝø'ÕayKúàÝ»”(SŒÀt*vHæWòÊ[,ƇÊ`@÷67šÖƒëüæñ[Q¤r zV1hÕ*Xά™?€ËDÉ™¸7œÍQêÒ…ÀÇ÷¥x‚Nz^ãDž|+[衽:ÝþH ¬o’‘Xª’®~œ»¡gIw†N>0ÁŽî<<™7 ÓŸ{a €_'¬;•£y¾8ÄnI®¹šÂÏM›Èð¢W]ècÝáÉÄГ»Ÿ>µàkð}WÿK³¬nH¾—ÍôFpÅiCÝÑ°ÞhÝÖˆÁ@|1x½£XSÆúvî>dŸ×nC´Ü)v%è¬NAëΗ:ôÈwFëàáŠ÷ÚT’J_–%^û:”x^'¯Âê=A¿g+r€ì¼",Ñmpë%:ìd[¥Þîx_¶Æ3foˆ§1³6L¸xÉA[ùÂèT“FITOµ]»L°¿B0½iÞ#XåÀQìtåu3Õ¨}dIN|0z^]¤ãBˆÙ­pë\q˜Ýß>ŽØøVÎð ,užX¡à +²:Ž^m Ê :–Ÿÿ†?7¢iÑN³ÎVõT?†uÜÛUáú^³Pr­ýå60Ó*‹~LA2ßKõ"œèV=^‘‹ÉßEˆdË7p=T´^á7ÌùZüeB—JÉPtϮݖI¼}‚ã¯REÈÌ&òý^¬µ¹ý”}²Ñêƒ Tª¿›ÃN#l Çü|–.Bå°”ü#¤||ì gmõÌöAcLg‚Š;Õ]O¾ÍC.Û¨ÂÄò@¾zñ“g î0d‘v‰T‰ä +÷›e……—òÖˆ7ÀÙ-‡3MF 9nœµ`v=`‹(u®¥¤ÐHÜ•…qiEs¡Ü²ÿ2'Ѽ¯nš \ ªs>â·*8”9!Øxî`ÉÉq,`Ü~<ÿ¸ +ˆèWS0ô.§-K8€œÕÑÇ ÒÂÓ6óícñhòX5–B-Ô:;¼*=éÆe,è<5 +#î 3‚âxh˜6mº›;àsGÃeùš¬ ­!!P¿¢€RÕ1ãß-²p—oEZ~H—ù$Íe¼yšg°ÿÕÌD^a;cÖ¶©À´PK÷´Çš+V }ˆda²yÿ·X¦[Vi°Ÿà{GÕõÝbü‚DW{Ÿ6g݉ãä}'‹ø]¨1è55Æúĵ²«¬{oGâT|ìÊî}w–@Ê|"EøïNÆc#2–ý%ÞòÀ߈Fp_Yò—ki„ +KDºvÊ«ÏŒ¯ Dñ”™MèKÖÔŸ_ì ו"ì~(чDîÖ&r¼Òõ‡ý©”Mc¢ö4Åƹϳ8äA»7TˆÄÑ 6Q’P\8 Ú[ëF% ‹Ù±î.«úª×Ê)æx%Zk/Ý…:":Eî‰à|å®/ˆù{3Êæ{®oÊ9Û¤©W#¿oÈç¡=K˜”ÑFž®ôæ>]õ¹ò"ÐXš«™Œ“ˆ¦†+ñ´BöHê¬LYRSìr„€.œ£ª¸SЛ³£õöEº†ª1úº™ÎQ.§_ùä5·!2÷€'©›.·Û`,ÕMGænž7œx_—¨¶ŸÚpñ1Ä)u~+µ± fJ~–iÑ[‘Ü&?à£e}IJOú„b)ãÅ3iE(üv7¢Ñ‘ãÕŠhlå>\V:`»ÊÂí窇]ª©©þ—$‹6¿bÜA º8™Ïò.´c?ÒoË@¾þØ®çqÃË E—qüfµ3aõ«„ùL3am}åðÂǸn±nÕ°6‹ÐîW{.ÎüÁÖjÒŠ& XÐÙgjš)P$Mv¡FòÃ…3å›-ÿJO©bšwªŠ‰»û‡ HÖ‰a#uããQ<_“Lôdå˜meÿkë"ÚÀ'‡åz”èY5Œnlö‡ô-ÂÅÍ6JøÚ¯Rç;ÐHËÃäk:-›Þ”ø$'¬ôxTœä+ºTštBVB†ŽÚjöTοŸý$¦i—16~zMâ"¥&! ø-ôIëcîÛÑWÊ5Ɖ HIîÃ$æí\ÁÏ\š:¸ûƒ`Í¢7ÕMV’ÒÌÌ3ÒÉR£>ònv¶Ú,ŠoÚ8uðaþêG´Ë #FžE—+ÕÄ6¨4º®Nbà¼be5ßœ¹(¬Ê`Mz„A©ú@^°á~Æ=þþdd0¯`52û¦˜Æ¹ƒ%Pb憲–å—ìÂìéZB¸œeÙ-?3Í΃?ÓTqh;ÅÆ0ß²{èÞC"§Ä…Ùý)ÜÈÆ6k‡°¶±™ž§)w ^p,Év&ÕÔtPDDnwíà3MÌ’rSŽó<ºÏS‹‚¼ÞÊÃgS¼šòʘX‚ãÞn±s„“š-‡@s Ø† ÿèΟW埀ß‚€Ñ†Zfsù¤vè£I"”!qìI~§]<ÈIo{ŽôåÃ.iŽaUMëa X¶¥¨áS2n;ïz6²éìáä¹qIÀ1:n½‹¬…£×+,z>§ew;öäƒKƒ{¿ÀìÖ‰ïÀ7û'§‚ +æYÔ†ßÏË_ËóÖ T…x¼ôÚ­E9à¯_®å ì +»ÆŒa¿¼ìgŸ“ž“?‘Tµ`„;Š€ñ@`óçÅ牨ÕJ¹fŒ Q¼œ¢š>Zm}õ?ÆJ§°sí]î‰\"¨æú¼¾y8Ùýå¿mîG ±èú³W ’ï7¢ð*ß‹¼’ ézrw©7F®´e‹IJŽ0=£Ñ(/”òýÉ)É>žÍ<Þqt«Í4u¸˜ï.¤ ]j%á…~:¡ÆeŸG†æ*¢¾Ï¨‹´Fûõ…Wo^’݆_ˆ5×Å:¼>Àc#•Ö#Y)»Ϲöï<ö{ T)›ZúÎ4±gµ¤ŠÁõÕO˜ÏJóV¼ù¯“ g*!ºÔ3N‘ •AKrCvÕÏVâkÁçÍÆ?=•mêK!Yl¿o¬—ª^Úƒgq¾&v{S»RE#Cj Ð ¢ÇÜùæ* °yëpfcûÀ(¶àŠŸdáÌÐÜ'EkD]àyÏ.‚žllœø4I—Õz™^(¦¡—Û—ýº5  +Zøà\2öCB*lDl1ø~ßÚMW 8³W1¡ªà”äð­ Üô~ø‹Yÿh&‘Ï +< ?€]mPÑ1MdŒ£7Ãõ»sYáF«Ã˜Ä´$Çñžé2~§}¶-ûn—ÕH¥ÁŽŠS^šÏ.±²hÒ<¸5å…aWû͈VÊueGÿƒÍýlçÅ'%ÔubÇWr*ô›r§Æ­æÓÈаDzOúÂï˜c rРÈ/‹¨V;¹fgw]WcLò\ Á‚^WšÛ’øˆ}%:‚Z-òÝ«¾® ²ê<4„ïè Ýr’§·X¶Kéïý"¤^?iùe™þVš9QŸ¿Vðˆ½ìÃ*æ¡"G÷äûÉw€Ø½ç"ŠÙþÆ0»cÁûhþhdgÉh=”R×¹c”+´Ôé+„˜¾n +ŠÅœ ¼UVš/SVQ®nµñíÇ~9ªhèiJ»º0}”쫹1Ä­\¾–„F·–‚'FEûO¼>S“Ò5g“›: ¼Áea×ÐXm‘Ñõ+H>¼ŸWU’ ^%¯Ê¬Ï·\\gC2ý…óËÉbcM„!¤‰-te?B娢PÐÀÁëôÞ¥ÞXDxCýâÖ¬ty±ª8q +…É> ½jŽ]†¡X+ô‰éHLL.±fêAªûÜasu­$˜3«ÄèXs'®f.8k?~À’Ý!©‰“|âFh@B6ÒV_sÀfæ-qÁúF_¦3w= “%-¤ÏRFìË3Ëzä Í°¨Ìü µ/·Ɇs§*DZÛa›v„ d醫•Þ ß]øzÜ ü+OnŽ”ò=òÏæõïÅÀñ¾Ô~­ÂÒÜ»à_ +•újL(pÊ›UöÈ€?ª‘vóÄþKÖÎo±þeRlÔˆðÜÆ,ûWÊûç£tœñOÇånuäT ù—Õ«..Ü\¯WÞqÕ{ä!‘-N—§ÙrPqÕ8l’ÆZNî\rR„yߺ“½· :¢ûKf©364½ÞÓI;ŠËfN…Û&åó~ùyš€C±šNG¥ì4Ϋ½ò&ºÚ°êè5{…u½/ΚF]’õ™Ú÷Ég +IÉœaS(–(D¾s–ÿÿÚ¯Ó&€ãDŽåÈ¡f‘æØBËBŒ¦É1WåÊ£Ì9DW*ËæjH1G4m&^0¿o#Ï„_ä +CH}™„±õ± +ZS{µ®§ï£¾‚T b'Ì>UÁŽ*SvØA¢eNMòlØƆF=µ®µµbÙd¾|9Ý'ñ±68Râƒ*>¶àÙRD·¾^¥ržDê´{ »nw?˜³`äÓ.B³{2‘½k30³–ÇY¤¯êsBJ3 +¹F,[] ¶o¢áV’Çæ*ge±mÙH,qRȧqvá[¥a•Lì•ÜX]¹(GlEÿ>ˆöÚP\PK+¼bL¤†©¯ÁûA£A[šÈ’-Õ@ÍåLÌÖ¦=r!ø}‰CóÙA-|.xxí_ügÊÊ®¦2O&¸¸ÇðÏ•~p6È@åUù3 Å6ÖË`òçq›•–9.Œ:öíĶ%) ïN=,ui\‚§;¼¼Šbë²]¦ŽäUKvÐc=<ýzwÁ¢(ÄÍx«´Í\Æ1–e¬<ðÃ0àŽre6^ã`Ÿ®Í¡äÅD&#övà‰”Oµ%kIO pÓú&þ4br±>e®qrr-Ú­ µC9eŸ´:šÓpO¢j|y>îpF•>¾ˆÉ< ®á>“YZɧڻ”ZX—W>gÉÉp~)ªRC´«þɯï%aŸ @šw1dq~˜6£°§Ð»IOK£H :Ó¼J)ˆmvÕ¦Œ.pyïI]–»-ÿIî,ϱ_—æöûcÐ-¬ H¾U% ÀWcDîCûu¡ +êÕ +æô´H…MyåÖ¢VcCØM +ïi7?Š‚Í.^tž8sU •EœžÝ 1ÿ>5ïSLjEt$TËgí:¸Ïì±P‚É4ed +/–³¿¤‘^ÆÓP­?DkÝH‘-{æÑ&8|çôZx¨ÚÂSrH¿–} ²næ]éIamZºsò÷™ò«2æ1’žxå|Dæ¥]%l0ÊCò®é,Üî¿X*¾Zè¹^<{ŒËîZh: n9 :íý&€9Á7oÔj„ë:‚seï|‘Å©XVD·N âñø&ˆhTUÒ̺{EW—~:2¿GÃñ…¡ïe7ïD„n÷`q´]\Ää5<¿ºãtE@/| º1þbÅE—H"Ø…?¦jOBxF‰k^&®s¸ÜÌ\së‡;Ê„ +òõ­åÞo¾g:ɳAj% —Ä¿¾íÝxÇûmƒèNsäñNZ‹F•c:YèiU uw«EvY7WÞÜÔ¸¥½[ˆ<‡¡Òüć,óýOéÏ+iÛÐéŠ^ Ѧ|ã;ÒÞógË “ ³EãÏmÙ=»nC‡gœ±®«@÷:U ®Óu¸ܼ—!6_ª#Œ;Gøë–=ʘ(W[P³"ídCÝøv:ö˜²ÙŒËTê1¤ ¯˜ô +nij­«ÿ1rýºEˆ!kÈFú/üü'€à\ !>:2€ü ó¡îendstream endobj 951 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1960 0 R +/Encoding 2068 0 R /FirstChar 11 /LastChar 124 -/Widths 1968 0 R -/BaseFont /NFGMPR+CMR10 +/Widths 2081 0 R +/BaseFont /LBYBZE+CMR10 /FontDescriptor 949 0 R >> endobj 949 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /NFGMPR+CMR10 +/FontName /LBYBZE+CMR10 /ItalicAngle 0 /StemV 69 /XHeight 431 /FontBBox [-251 -250 1009 969] /Flags 4 -/CharSet (/ff/fi/fl/ffi/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash) +/CharSet (/ff/fi/fl/ffi/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash) /FontFile 950 0 R >> endobj -1968 0 obj -[583 556 556 833 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 500 833 500 833 778 278 389 389 500 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 778 750 708 722 764 681 653 785 750 361 514 778 625 917 750 778 681 778 736 556 722 750 750 1028 750 750 611 278 0 278 0 0 0 500 556 444 556 444 306 500 556 278 306 528 278 833 556 500 556 528 392 394 389 556 528 722 528 528 444 0 1000 ] +2081 0 obj +[583 556 556 833 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 500 833 500 833 778 278 389 389 500 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 778 750 708 722 764 681 653 785 750 361 514 778 625 917 750 778 681 778 736 556 722 750 750 1028 750 750 611 278 0 278 0 0 0 500 556 444 556 444 306 500 556 278 306 528 278 833 556 500 556 528 392 394 389 556 528 722 528 528 444 500 1000 ] endobj -1969 0 obj << +2082 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/sterling/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] >> endobj @@ -8199,7 +8826,7 @@ endobj /Filter /FlateDecode >> stream -xÚí·S|ä߶öÛIǨضmÛéض;VGÛ¶mÛFÇV'éXoþkｺ÷z/Ϲ:ŸSUõsÌù7Ñ'±¼¶Æ&î÷OÇôt¶vΟ]Ÿ•ñ˜Ú9Âü³®ŸKOoú¯Ø!Ó'ZüAæO´þ72³è\ìœMŒ ­ÿk}ÿÝ +xÚí·S|ä߶öÛIǨضmÛéض;VGÛ¶mÛFÇV'éXoþkｺ÷z/Ϲ:ŸSUõsÌù7Ñ'±¼¶Æ&î÷OÇôt¶vΟ]Ÿ•ñ˜Ú9Âü³®ŸKOoú¯Ø!Ó'ZüAæO´þ72³è\ìœMŒ ­ÿk}ÿÝ  ·u±1üg{˜Ùþ sþw‡ÿÍ ·7p4±µ61ý+ÊøßÑÿHþô`oíâô'ðéÂÈÎÆÆàOäSÝÜÃÞÜä2 Ûg¯OY;ã?!v½“µ“ùŸ€ÞÓÄÑîOàÓ¯­É¿™õÓ¨³ÛŸvÖÊcçâø'ðO,\ÿêñiÎéséþÍÿ˜µ¶ûãŒõSÃÉÄÆâGÙ˜ÿ©”‰Ó?GþOðs^‚èsJBès6ÂèSFä}Jˆþ›Ø?'!ö‡>«,þ‡>e%ÿЧ‚ÌúTýCŸ rèSAþßÄñ© ð‡>ÿÐgÉ”þЧžòú,–Êúœ­êúô¢ö‡>Õ5þЧºæ¿éóv¡ÿ³8?3 ÿÐg¦ÑŸíÌðiÔø/ütjòþ³ºá§W³¿ðÓ¬ù_øéö¯ƒÂðiÂê/ütaý~Ú°ùƒŸw½í_øiÃî/ü´aÿþ³3þÂOŽ᧠§¿ð³jÎá§+—¿ðÓ•ë_øéÊí¯£ÿéÊý/ütåñ~ºòüþß—»-ãç¦eú<2ŸÙœlœ>ÿ;SÕÖâs‡KŠ|ž*&ŽE\?O¼ó¿~g>oÒÿaS‹ÏË×ÄÄÝÄfuÉΈ;È2¹)¤ÔW4¦ œÒ 7µ8h¢+¸!•›îì'7Ê‚có´Š þ r0²¥E9RÒ…t%½±)ë6V“ ÷°—2}ð ò0<enš2ä•Ñ™ŽÈHöP¢MføÑ*Á¾}3õÕñÝ–kxµÌ #{ÖEXéòÒÛ­¯Õ·ÉíUØcâƒ$Ýìv™Dµã­Øñçsq»|»Õ ´;Ô÷U¬¾Í9« øTÎïÙ² ‹©¼¯Ð ”î¦;“0ŒéV«Yœ5 Gˆ„t£®K @@ -8258,23 +8885,23 @@ v\ 0 h Ah¶ŸÕ‡ EÕ|Âöµ|ç?g­)Î.U‡ëQŽa—ÕG}åÕK=¾°ifïìî>z¯&éãD¶ssÊö9 XÁ§YßàUC§S¯A¬ Ã^ vý/C7b<.´z~Uœ´<˜‰…¤¤€“îÇ»!›ö“R& Nº^‘×Ôö‡2]°»ü°]òa1Ë3Þˆ™Eq$œÎZŽî®[%)ˆ Ý ® ·ŒvºË»¶üä ÛYêŽ![DEâS‘qê´ŠÒ†o¿]×r{Þ’œ{/¹»c®•ÒË­ÏX†ÿ‡/˜ÿ€ÿO `dmbàèlgcàhóY0u˜endstream +¥‰L‹MÎ`ñj=FS$‘•‘k…ͦè“f¦‡@˽ßßRªw¯ ¤îxqÝO[MJ;o@@ƒ,¥I;5l-y$hˆ É…k=žö”DJ(ÐïñÖüdØðbšW@i}Ù†QT³‚œ†Ý<1È`wÍM" úe¬8nùêän™ð.^¬çQª /@YäèsOéêC‚Hè†vÄÙ(UFÆ}ô#X0‚¯’ÓéaäLöéʉ†¸«)XØÃ颞Ý»%Ø—¹|'›kø[¸€Ä.¡z¤RmYúÚ5áãäÓxÊ•wXÝ?…“Rº—=ýR¿(lt~€ùš©ä&"TYÿ¶‹û„Q²ª-§ŸöÌârÇÙ½(,z z‚ß½Ÿ=âå…ÍmnéB³¯bªš¹ævŽãTß½¾>“R& Nº^‘×Ôö‡2]°»ü°]òa1Ë3Þˆ™Eq$œÎZŽî®[%)ˆ Ý ® ·ŒvºË»¶üä ÛYêŽ![DEâS‘qê´ŠÒ†o¿]×r{Þ’œ{/¹»c®•ÒË­ÏX†ÿ‡/˜ÿ€ÿO `dmbàèlgcàhó `uendstream endobj 948 0 obj << /Type /Font /Subtype /Type1 -/Encoding 1969 0 R +/Encoding 2082 0 R /FirstChar 11 /LastChar 122 -/Widths 1970 0 R -/BaseFont /KRNLRF+CMTI10 +/Widths 2083 0 R +/BaseFont /QRFOKQ+CMTI10 /FontDescriptor 946 0 R >> endobj 946 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /KRNLRF+CMTI10 +/FontName /QRFOKQ+CMTI10 /ItalicAngle -14 /StemV 68 /XHeight 431 @@ -8283,58 +8910,55 @@ endobj /CharSet (/ff/fi/fl/quotedblright/numbersign/quoteright/parenleft/parenright/plus/comma/hyphen/period/slash/zero/one/two/four/five/six/colon/semicolon/question/A/B/C/D/E/F/G/I/L/M/N/O/P/Q/R/S/T/U/V/X/Y/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) /FontFile 947 0 R >> endobj -1970 0 obj +2083 0 obj [613 562 588 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 514 818 0 0 0 307 409 409 0 767 307 358 307 511 511 511 511 0 511 511 511 0 0 0 307 307 0 0 0 511 0 743 704 716 755 678 653 774 0 386 0 0 627 897 743 767 678 767 729 562 716 743 743 0 743 743 0 0 0 0 0 0 0 511 460 460 511 460 307 460 511 307 0 460 256 818 562 511 511 460 422 409 332 537 460 664 464 486 409 ] endobj 939 0 obj << -/Length1 1013 -/Length2 3827 +/Length1 916 +/Length2 2862 /Length3 532 -/Length 4518 +/Length 3503 /Filter /FlateDecode >> stream -xÚí“y<”mÛÇ£„±Y*É:cì²ïû–˜˜a3Œ±3E(R„‘%)„%K²…ìŒ%kDÈ’%"‰gê~Ÿºßûùó}ÿz?ïuýs}ãwçï<Îãà3µSsÅ^Ehc1x1¨8TÐ02‡JPqH@@‡€ãQXŒ&P òòP@ÍÏ „P˜œD$h`½ƒp(7w< ¤qñ§HPóBàP.p `Ç»#¼È5\àhÀë‚BàƒÄ540ÿ¹Â0Gø"pþWq -¸¢\ðÀU„ -’øiHƒÄ²…]ý¼ÿòGà|ɦ!²É‹Ù¢+ƒ\H„1–¼‚ìäÃÔ?‹kû¡ÑÆp¯Ÿå6é?Òp/:è¿X/o?<a]8Ì?¥Öˆ¿¼!\Q~^ÿÌêááh”‹Æ …P¾Ú¨@„«) -ïâ áh_į8ãúOä¾ý² addbgª-ò×}þÊ™ÂQüå ïßUŠ1ô“»ƒCöqJ’ß9þc/-Œ Ö…!„´ ÇáàA òdI(Œ+"@’ Kˆc°xò€Ü“0‰Å~^§” ŒÀaFÿ -ÈX â7KC |ÀŸ¼4”Ìî8Ä…Œ4 ¡ö‡d õß$+Hèÿ!YrG~“ °øCdååßD øo‚’.ø’M£ÿ†dË^Jöãû7$Âÿ É•ýþ $¹rÐ/üÏ+TWdžˆÁ¤1Iò©ååäYiHØ×YbP>~=MrŸ Yy©_Q?ÁÿúgÈÓñoF¢È³„@"\@c#XÅ(U7 Z¹ý…TÂênÕ‰Æ/I¯è"ßÝ¥@?é4ðž.·Ù–ÎƸ@µÀpÀã[jÖ£½ᓘ:|¸àï¼\Ãc³•nôÑ›7r…©®jh{UšÂdpº«à¾íã77ÚVrL…4//ROòk²÷¯h"FÉÈÚh§£-£o” ÂøÌ™S} -b¤¢§˜ï'˜ê‹$xDÓ¼™ØÄÖû±îçÒdß;tØþ4¨jÏ‘1,ãˆéuñB»ÃãâuE¤xãsïkjö‹3$TúaU‚‰©˜!¥Œ{p­—à¤áÎYîЊ‡ñë“C7º² $ÅËž>ôä2¶m×wÅE·¬¦0•Æ«µ6ÏÆ`•¡K¹ÙžBf£z&¾´^;Š“Ⱥ½”Êè÷)Ð0'8ýMBª+<5Ù-˜J£rˆcÉ(ÉHcm5í9E®%­TtÓ -RÇÏ^ÕÉÙ‘$Ç L'?•3„á–s¹íoùc\œ´ZÝ‹ Knò Ç#JCkŒ.цÙ¥Á’ tçÞ…B¯ŸKJÎó⋶WKMæȱñ6miç1Ö°¬“ݲ)—íMÙºì¶Ë”“Ét#Ði;Ñý~FwÐÖ^‰õð.±æMß•5ÇTëš”0bJOŸïðˆÓ®Ý~ÒW•³öƒ«-èÈð ô׿GÙX±Âxñt|tÂ3õçGSe\%1o}ë>ó§@RÉg'¥Ýó ß‚}žÞ¢äfVà–ò6ýñdu7QÅmí,}¨Ž~¢ÅMLFÌ”dmôS™›Ë¥÷ní±§Ò¶¦ž †¬Ý/g)ex½Sßlðo¡UËu¥Œ´u²aø#ºs5Ñ)/ «õ¨ûZËùÈ–;”ïmwÖHjX c tcá‘lvä;ŽsùCFÉ*qwéb¯7v®ìªçX}íK¯‚3–¢õ»{Ø5Q5Ûkþ1ž*UAGӕĪ7v»4!ãü>K¼À—»Õ¹S”Ù©V ¿}îÙ.÷1eΘűñ¹êû,‚>½¥»Û)ÅÁw3s·›,6Ô>|ÞB‘)j-æq*Y•}Ñø„=aÐ`yV)”ݠIJØ?nêlº°IÃr}²C0Ð5ý$ÈS¸Ý³R[äYÍUáãŽ]´¯Ÿt#~P¿qͲéæœ+ìFQÌ}”õŠÀ¼u‡¶Z.ý4¼S6P׉ú„à‘ÇêÏh4Xg÷lLí½VQ¯Ö+|€mJ9bÛ"¨ÙapÎC yÝ%HÙ¡ÉPG‹#ý2í›ñ¹“óá©iôϽ«ü¡žU÷'Ÿkð7ÏÔ¹½‹<*oˆÜÙ†¥ÉÌjß8ÚE‡ÁF«_"˜5f×®Ü.àî­z.kÕ™ éJ(À"œªç¯gk°p¿‚^ጋo£j=îužÛNþ´¦¯âØë4½›³—ß¡¤­'!^?/,·nX?uVP¹ìÙvàèaxRþ‰N8‹W¤q3q8¾ª»yi.”ùÕP}tãHPQIâ„\àc¹ß¿Ø † #–Êž$ghÊš"‰‰¾¸6^c9ÆÑëjþ±æm‚}á=&÷m]:,rò’š ÝA V£LS;.Äì²þ-†þbY4½m€Ì¹ÉXZ(lë¾nÓ¾ˆÎÙ¨õuÖ2œlžG->ݱØmÂTÑR°ë<<òšB ##´6X³ò„÷Í@ñ’~¾ÃüwŽnœOXZòb_(/ûªÿfZ®ë1•Òªîázê—šÎ6©×98 Þ¹TÆu4“W[yÎî+v” .4;ñWP/Ö„Žz0ÖD¼Wíò×C^“.Lˆ5±®xâ=- «}W¼}κlœwÑ{oðL”yêwÙÁ)™ã6Žô'½BIüŠ}@ªZÍoòR§E'Ú‘y7ËYà Õø.¼ ¡ ™ä›EZË[™ô1ÙÊ…k,a×ì†o¿Ä½§Œnæ½q\Ú¬u­‘ÿû‚<¯ÖŽÝÁmÁ-ÁmÖ¡2øÔ¥¸é,¯ {¹×™y«u›¡A%ŒÂ"6ÞÞù~NøV–ŒÅýi·Í²J˜@¶^ªy´½BkWèJ‚òcé -ÃC¤¼¼ÌÊŸL÷ikÊX—‚s`Eð%“]‡ åŽn‰\¶~Óê8gþt«¹ãÝÌŠ†Ø–¬ñ˜”†ûõë±rO®P é„vh-v…\+å»5•Vºƒªå7ÿf.R³ª„¾ÏŠÎL)t&|”㈅ýq¿áÜ–,­J]8jýV a0òùšŶÂÛZUÆw‚ù` äÐPǼPããÞØ‘ˆ7æ&¬ªðÛž^eþL–Á›J“é%x¾bSóýc蘳µnŠr­þ7eÒÇý1‹÷¸JpÜÄãùÎCߣs< Ï6Ì{̨yÛsØ"iOL?ém&Ù)Õ-R{f [}V9çèw(¾\_nFh,ý:»»µ0m†¹.¶bÓÀÀu'®6fl -©Ì~r7.éTÍ#(I-â\ÿ°÷â¶nqŠ_ð˜U{„hpÓÊ…eŠåÔqaD!øÊx¥¢1-g£Ýqí{¼¶Í·Òƒ*Vˆ´Ï˽MáE7dæôh5w¯"ÛòóDGþ÷ÕwÂU·öäÚÑ‡í ¾Ø >Š“ÉÒ-7ƒ«ÕHZ/ ¢g涸ŽI-r–íxÆ´¼iˆÉ]»Ûi¬©ÞZÚ!©K•.jº /…àÖUÈí¼½#gñ؇¥æ)À [ȦëÙ#Ô‰Y -ñ0¥wv9éÅÙùðÌÇôè=¨J¬_ãà•5£Ô„}oàl -ïaN;£0—ÃD<õ©ã’ÅMæKbý·[Ö6¸·yIs%¥Lœ*õ:VëFrrV\Ô¶GM< Oz»>ÑŸI á˜ŠØ.§1^M?5ëj4=sRÓòS ¸kDñìÀ¼GÈ¿áÅiEa{¨P\¥“ÿ„/„–kKšžP«`¬P¾šdca!U}z¨øCú$'½YóÀ”c煵ݲk! ÊV;0ÊŒÏ?¢̼ÑûÁc¹;ÒžÆàÙÀ$“㨮Q{ò£~Ãkÿ3Ú\‚_¨Ûu5ªëä/²¯>$Î/kŸvr»Xw1D32únÒlþØ¢%ÍPŸã -1ú(±)L Óo4i8Œ™Â4èÑv˜øfŒJx¶åÛëÑ„åã,µ0jÞ2OßÏ-c -îºíÇ+bž˪:á’w$˃#ôœ¥{ü°ÕaØá²­ÐéØ>œ^ê/—tåÜÍøm_ŽÖvðí´õIu[ÑŒ‹j¶Ifð³@Å*L®OXQO0°åi›ßdm†ÄëSãb÷Q„ÖN©–8­Žÿg\M+B|Ù-a’0íÎ;Hå"&ä?½æà^ÿèlˆ]⵸ýÅ’ÅÕ&­Ñ÷‚tdgC—yô¸õóÁuö;eˆ°nÖÏÅL†=Ý.ëhÿÍ”¯’ÁfÅ”_Y`W#¾Ô¤½*ùŒÿ¤*ö.:á°Í0½»µ2}|¡_z~`~ÛÆ:ãÃ’‹²°Ý—ŽúV¯Cò7eÅÚZ\Òç‘Y$â‹S ܸ{¥fQ绣UÑaW‘t—Aì)•“Ž§va éÔ²3$5䧉àäçÉ<ýoéûmîT–^ÒÄßèÞ?»0HY_ *z·{ð–-© Óý‹³ùåÔ¶‚<ìh`vè®06¨A<¬´ßüÒÏþô‘Aºvˆa€m;ÞR_wM,wè‹ä“l !´Ïðû‹T›ÏÖÞ({Úƒ£zýÒ`þ-qÝ o5YN¹]vŠé;ïÅߺI•jâyxF?s“öÈÞ³:'|fÌ3¯¤—½ :¹—Ä´øµ N½¥HƒßKWØ 3¤¢c?$™4楲èúÓÙ<‰Ò,f)†ÐöƒÙN§_M|3¹ž{!o§{‚e¦>½xò»Ë˜#˜¥í åä17ÞaŒLâdò{Fų,’Õ ¿éUzêmÏl.¿¤ÄíÒ©¤,Û!K…¸Ýª® ïÏlá—s¹]tX5Û5Ez¹©|¸­‹Â‡Æè]äk^*>2QÁщ)}b¬¾·ñbœå ‘6Õ½,ì¸JÇÛäYêH:Í#È—Ï DÙ¯ç‰ŧ»CäÇ8Šy é>õ/i~3ÎñÚO’_8¬<gîQG=Ö/ºrþBè{k…–ÒÑuü “w25>$½KÜ8cù#FØÛú™wÓU=pÈíkU1—÷U/í܇KZIÙ o+Ù}Ñ\xa‰élæ"ÄuŒ_º¦pdK$Ùpž‚‚µ -…J^ª­$EöœaËD5ªhÙøÕY>‘\ËIÝ,³ÉðW÷¬uª|$aHˆ?Ëa#÷môˆ€<6j;Ò„üÐÿø?QÀ€ãðX/8Îô/»4 endstream +xÚíRg\û¶¥JDQéƒÒKŠtTB/GzGŠ2‘IRDéR%€HSŠb@é .`DzAQ‘#E¥"âzO¹žï}z¿7óeÖÚë¿þköÞÒ’ÖvÊzX’'hL"R”Qp”6``a‹: àHnii2ˆ¡@$¢!†j(-- GõŽ ”º¶Š¦6R[0 ù‘!3ÿ.Òô ò X^<`Gò‚@JÐÃãÛï'[0$Ó@,œ…°ð} "7â{ 3¢7 ÐøIc©~”h 9€ +c…”X±$">À‚ÞÜKë.•ä#Ô¯æÆT<ÞCønÿ½Iÿ(c>è?ÁJÉ€ ’‰¿JÀŸÙ,@,D%üZ5£`ð—ÑÈŸ` ÑA¬5DñÂÞ|øƒ‰Ø_C°úö#⤹©©âÏyþ¨Yc "Å>ÈïO×ïâõfu‡ ÑW$‰D±„¬÷/÷_î2"z‘°‘µjê†LÆq³6ƒ…Ô€`± é¬À8‘DaX= ¼IdîïãTÕgA2é;û“Ð$"ø'VCJà_u5 ãÈàß*¢ýE¨«½? +ɪûü ªÜ_Åü ª³ìÿ5õüg‡õõIô`eU@ù+”–¦& ¡† ýoò§‚f†¬ß@"5´T°^T2$R~¬4kx`oˆ5j¤ƒ^ÜcÃ$¯£‘g.×E3ÃŒ +{K8Øõ}î¤XV· Ü㉽Ď¿ÑyÂ_a²Êy£4kïÀM‘€‹M!6OŒßŸ÷OÉÚš¡žÉ:[/â¼”eôÆïÐZÄcÝàʼ»Uÿd3Í¥¨#÷ù|k9Cû·»&$ÙZ]i5­Ù‘êÎÆYx‡˜¨*I[X¦?3V5æy ,-uÇó§agb8ï*>ûHj¢ +lr^cl¹­üÞ¯ëº?gHÝØ34‚&àq˜øSEU‰„¤ìú†ÍÛ9t¯JLJ&qðx£nt÷pêPçKášÜ0ø…‰Á¨®kæGàU3ŹB–.­@Áxcö\iÉñ9±Ör¾Áù<{é˜JmÈláµ>_9›3«.ÂêÑ ïÆõŒÚ˜© Tè) ïgr¦™éðóȵªÀçW8Üâ÷ä”å\¼ØþÒúɦ’÷Bê\M7—BÉ®„—ž&ù*'ŽŒ3­û·§kš«|#¿+v£½Nµ·àn‡Íúh%o?_Ro!ÿ+ÔåÛL_:ÓôÕhê‚xjúu‚dŒ«^fòÙýùÎ~ÖmE, 5–†«4z2–ì}Öøóóø£è§VRpi9ÝAKëeNCkÙõO=Ü3ê3B³3ž< >µvr£Ñ;@÷`Ã4Ö… <ºÚ$Cû±­—^3·[þ@BLò0l×bÁóJ¡²ØŽ°§ïOø¿ÞÇ­š.6¡†»iþø°qÜ6a˜¶°ªŸõ×ók)hŸþ½b¼!&¿¥ØEsbg< # 1ÅêÑï*Øqë‚™\í™âg‘ iðª=|Í«M•iZ›J6ªî]cÝ`÷®FP$¦€G¼>&ãîé°ù&(ÍèÝMﶤmS.« t¤ö.•úÝtµ–’eÅkV‚Þ£ûÅoæ öYÆŸ\Š÷ßëœÈüð½0°îuEàŠ-ZXd:õ ßMÂÐeK¾4™Ç4[²¡óC{æË æ -EÁ(—Ãlß9GW›%O‰ÔT“.¿–MÜ¡M%Úé,òj­Õõ¬œqYS­£þ8YÅÝlaòŽqÞ5Ƀy _Ks<>µç·Š5WÄñ–õ‰Jå>Zv ÿø _³¥]¾~-€éV‹ikëk4E wˆ÷†Ç è)Ô‡?zwepzâä*oB!…œ¬P¾Kl»·¾ùƒåêùÍû¶·AÝ™™­p5;Xܳg¿üŽv FÎH Cnß½YƒðJŸÅþÍÄÔ·ázË!iæûÜ/nö6½Y÷Ög¿¨ê™´0ÔŽ÷»¾aª’á5IaóWIžö-÷Äö»ëf¯ž»˜Õ hÙěėªÑÎmÌñ?‚iKE·ŽœŒV8 Cˆ1¢ úlÑ‚zZdeŒÞZä¿öµÓ2#ÉܸË/Ó¡ÝÊy:7{hæ¿Û Oœè Õd3Ö8wûd§bkºùØü·ûVQç‚'»ò¸KÇy‹ãdbh/Ô<«KwûO%*Fw×UÞwˆ<±ô³]WŒ;þ8…wª5`±4‰Ïqà’ϯTc“çd¡íîø;ıwY›iVvå¾ È0-êÎ[òh ós_©íŸ•ˆ¥»e4”o|Y&ÂáüN‘„£á×í?Þú’ܼɼTËÀí8Á÷¹ÅŸð1ñ(oIU¯U’eE/¶\KT}Ó‘ö1IJý‘ÓÃüs/©u”@»²sI3Mò+»çÊóL4?ÏÈoMÂÆÖQs +LÒýx²(Z°Bª>|ç}1­CCk¼!ÓøǾ­]%²«V؆$Ø}›|¦'wkóði;q¬Ì¿àø àКX>bÈ4Bs9(5‘.Ö—¥úú/ä‘À=bùFôè@à!fÓû½;•\ݶ-ÚgëG„wÃJNÝì_ ¨{#P‚ÛçLÊ}Ѳo̵[z?< +Â<Ëg–WÍÄq”qÝ|\zÅ!Ñ™úÊôÑøDxŸ¬8áÜôœ¬ªº0S²àíNdL¬kø°ÇåÖ»¼6jÅtj®óâ%ŽÑyè¡E³Õ•GywVPMj¬‹Ì²KŽ Ý­¥/É”œ#ö6KÕÙ(óF,Ö›¾³Vó@(·‘ÔwR÷ÁŽž¸pú5`Ý *OY +ãMvù27üÌd Y±–5a‹ãþºˆ ©v—øJq¾ÛÎ~/jògÎ|ô¾¦3Åu¹Ð‚;*’e.HÛœnÊfˆEs&>+KSƹ¦CÏ‹w”ID‹o͎ѪìÜ·ÛE'EI™»xŠì>öD#¼ͱvôq}Q6ñéwZ³žíZêF¾çÑc|Â<§>Ҁ܇\ïæƒq¤KBŒÛËZM¶3ùeû×Tb»«5`!ÓJ‹øëb,q½ šd—Êõ´èòr¶n·<éElŸ­|ìrݤ‘dMÑ-QA}k‡ z¤[ðÔf&¡ÖoÕ¸™šYzô7;©&lï-ð½æ+aÖiñg…wŠê‘¸^ÏñÞp³\‘–îöq»cô›‰ßˆŠp-#u˜÷u•3.œ»íŽá¿Lí±êYacîÙêžÙ¹OÊ⹤,ö.÷,ºðÚ_zõâÌïW_‹,Rîv^îËè¬Ó† Ž´ƒÎæ1²áÔ#œ_u{­ä„£¾ÜˆÈhÖ‘ÍÏØ3rYçÎŒžàÀƒ½ËI­DÛX7Úã—‘œ€Ú¶î‹cJp¨×ŽÝ_€ƒÕë¸XÄ#ÈxyÀþ¦øÛöÇú£Ÿ‘« +d 9õ2sv©r£®“ö +w%m-l5Ð’­Z7lC‘é½`"J÷Û¸ Œ˜NlGx2D´@(cã>ñD„ì(ø¤CëL0W<ó%êÙÔ‹/V}£3¹ÝNе"…&ƒm >˜;Œû‚ÂË3+©œXŽÓ¢‹pãN;­­”¢à|]¼hWááwm¹*GKâD¥ä^d›Ý|÷5lÍξ*ä{ÿ4p±Ì˜« CXjëöu„+æ?-w(QwU +×c3þvèÊ®dÅc*´$Û­†éìjÉýû 0%Éü¯Nôv G2&ª˜Í“r¸qþX]¿ûR1Æ|ók½oL”oJ·|ÈxÑœó\N#½> endobj 938 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /MMOZPF+CMR12 +/FontName /ZLSHQH+CMR12 /ItalicAngle 0 /StemV 65 /XHeight 431 /FontBBox [-34 -251 988 750] /Flags 4 -/CharSet (/zero/one/two/three/A/B/J/M/S/T/a/e/l/m/s/t/u/y) +/CharSet (/zero/one/two/three/five/A/g/h/s/t/u) /FontFile 939 0 R >> endobj -1971 0 obj -[490 490 490 490 0 0 0 0 0 0 0 0 0 0 0 0 0 734 693 0 0 0 0 0 0 0 503 0 0 897 0 0 0 0 0 544 707 0 0 0 0 0 0 0 0 0 0 0 0 490 0 0 0 435 0 0 0 0 0 0 272 816 0 0 0 0 0 386 381 544 0 0 0 517 ] +2084 0 obj +[490 490 490 490 0 490 0 0 0 0 0 0 0 0 0 0 0 734 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 490 544 0 0 0 0 0 0 0 0 0 0 386 381 544 ] endobj 936 0 obj << /Length1 1972 @@ -8347,73 +8971,79 @@ stream xÚíµUX\]—h»;Á \‚w—`Á ‡ÂÝÝ݃»Hp <¸;ww‡Sï×ÝéîËÿ¿:Ï¡ns­=÷˜sɦ&WRe6%@¶NL¬Xy¢òªª"š¬,Ö,HÔÔ¢@C' ­˜¡Àúñ#+@ØÙ Àçâå`çeáB¢ˆ‚ìÜ,ÌÌ´¢tÿLâÛ,Œ mò†Næ@pcCk€*ÈØèäþ lm Pùç G€ Ðèà4ù€ÄÊ -0±0vÍ,l‘˜ÿq’¶5¸ÿ#lâl÷_C.@G°€,I+š€l­Ý&@S$fø]@°ÉÿRÿ3¹„³µµ‚¡Í?éÿ³Oÿk†¡…µûÎÙØ9;ò  ƒíÿœúøz" ëÿõ"i'Ck ca[3k €å?BŽn@% 'cs€©¡µ#ð_q ­ÉÿT7î_Ìò2¢ -Š ÿ^Ó +ZØ:©¹Ûý;ñ?óÿŬo @‡å +x"ø÷_ÿ}ù¯·5™XØ‚7'ÀÐÁÁÐ ¼;ÀÄ ðdXØšÝ@7°3ó[ø¸)ÞSÒ?K -^ufÓÅþÙÀhñ†ì`´þ7²s˜íAN@#ëÿXÜ|üÏ‘ÿæ`0Û:m­¦EYÿ3ú?&ƒßmèøO -G«· ØÀÎÚÙñ-v0ÙؾE8Ìæîvæ@Û·ø)p"É[ˆÀìhmèhþá0{@op [à¿™lïäú6Î öv2wþ5ãŸvœÞÿ4ÌÂå¯`]GðRþ›Á²Ž@—¿\ÁËÆ üoà«ÚZü-ÂóOÍÖ ·‡¸Øÿé7ÐñŸËá-Î-üFà¼"oÎ)úFà„bo®[üßÄ ®ZâÀ5K¾¸^©7KH¿¸R™7»È¾ØEîÀ.òovQx#°‹â¿‰ì¢ôF`å7»¨¼ØEõÀ.jovQ#°‹Æ]>¿ØEóÀ.Zÿ&ðÝËlä`hltúo»|³1¿mÆà FoÎ`üvšXÀå˜ü…àŒÀ¿ðŸÍô‚+2û Á%™ÿ…àšþ:§,à¢,ÿB°“Õ_–²þ ÁV6o¾™˜mÿB°è/[Ùý…ÿl¼¿låðþ³»ÿB°•Ó_¶rþ ÁV.!ØÊõ¯‹låö‚­ÜÿB°•Ç¿ð_¾"" 7O&ðÆebŸ`pµÁ{ŒÅû¿OT·µŸi1ð!gaá·ïŸ¨±³øVrú×÷|±ÿ›Z€?@ ÐiadÌd™ÚRæ#^0^KçHœ^4Ü\—Î÷áðÖ´Cã˜ô3ÓÒ¢#åX¶’ÙÄ”s°AØ«ßS•9x³‡./CþÔøPWêwN_ºMVøîÙ–]#Ãé"åõªK;lµÜ>+w>áqLÙÜìó¥•ïÈÚrš åv -Ò—œV¹d ÆÞjÜÐÑ$¨´Pô_7ãûe°keÒj5ýcdŽ<ôLºÀ"ë²y–çd´_Tž›ûâuÙ -Õ¶e98€OÊIWó³b±ëgq{È×ý3ÉÁUãÔÅ^3EÙCè«Co©Ë‚8ÃÙcƒûðm}m*lN-ºËéL©¦èK¦C6Ì©•ª1ÿ ùºäG»Æé|¸rñ*Ä¥5¶-Îö«Í›b1h>£FH9¥b½R…§j2þ‚Ò'‘j¦µýá{6°¥$϶A=«í=4S[\qŠ2!ÆDéÃî.qP‚y±Ì–Þ¾âwY>ânÕ÷-bmÞ?Ÿ¡qð )UDºÕY†Š=¥ÌœÃ%bšØZËÙª •—Ùg™Ç±õ -òóœ°ì§ë€o¹B½áUÒ&ÑV’F˜_¨5èY.-ÕSM'†qËè:õØ\<¿céo L>fëxô…SV“ýpÙŽ#:ÙúT“ä[ŽÃÑÀ -ûýkUÈæÕ"Ïþý»OjRd•|‘<ïz™wœF)»6nºÄMÊÝRѼžCµ[ò²0¦^ë'«v…ó]ëq¼ü¡‰~¸/8½?-t]ö6¶âÊìò«¾ç9݃¼Åg!pKÖSƒ=tB*)㎷RGöÃeŽ'¡ª­<]´V[ãùŸoI©÷ -ÿ1|Ç…ÄÒ:CÑùa°Œ"ƒœfªm‹=ôÀ9ùWnÝõÎ#ÎR¹Û”·ÙÚñ©¯e|ï/ÃîMäG nH:¹QÔ`Dˆ.ª$NþÓ¶Oˆ“G Å’0âUQË(®ël×Ð$µoŸÐ6ò‰eÍ¥¶JÕä)\Ù?N^Í©Ñ,6£¹÷.³z"3ð¤6|*¼oKoo±S¢&–‚žì ^ÖoP}ì{ràl3ÑïKí¼º õ|MÙÏåÌk&@~acËWñßvÆWç‘û-4~¶¦éU˜óÏÏø¨n¢c54%øïÄP êrwŇ²SRýt0hˆ¹?ÊžwE*Ø Üä —ƒ<¬­’.é?Xè@M>¡ïéd@ Ås#'zrˆp–¡ÈOJ?ÞóòÀ|Ï4Tœ×çÜáN«ÅüíàK¨²˜éPøKëùÄ|¼`7ž¨`Ï™¶RK(ÖÇ͸6Ó·SÊeÛÀêêNQP›¨çÈ5­…øâðò¯˜ã.krŒI*Á„÷¼~/*(^åÌþ¡ÒÞ&^f6ÿªÂ÷&rf1èy±2 ü¾SãÀ£_†pS‚Cç#• O°ÒåRQ¸…Ù¢}•‰¡b=d÷r°¼õÚJ:ÜfyòUº ”_,búÑ]I;-gªHQJŽpðn6ÿ‰2 -»SàèHáçOß©&ü¼‰ª}ã|ô5ž&Y“âG)#CÐE`eY)›RëÕïCâéTøÏdåpû©Ëÿœ†Q–õKî/–˜ò´¥%ˆ_EQàÃvSçTìJb¬­µgb„.¡CN¨\èê£v17Ü>‰…þ -ß kÿƒ¥…ðõBßÁÆö}ä°&ÕqbÊó |TÈ·-+ˆ Ñ²ã”!2Ã'­£(\áwŒƒHxV?¥iÉÝj³Wd¤ƒ>ûÂg/£mJÆ3gÔ ]Ë"àf7@Ȳ$ÌŸ(üÞÿñ¬_|¬œ{å,ÒC¡°þë'ŠÆÁÄât -¶hú­&nf€+Îm¯ÑÇ„vò3Úª¡¥R©Œ?h7V0û‹;t–´µÓª$Àç'J@äôªÌ%§b¦ÇûÚq$)©Â°ÖÑõë6MÆ"§9=LCä¯ò5œt £]Ô›ì¿u9P¶$Ó©}¡Ð6Š¢0d!"›Gn,,¢Ã:XzC¨²¹Ó4”†L ²¦Dš³­AÃÛ‰xzŸ°‹í¿+IìÑ-Á–ç0aÙË+ŸÓAz‘ódÍèmRs훫e®·ScÎ2´Br2ëZ,mÄJÒ~2û¹vzêh×jOë (fK'àÎç›Äêó?ëoe¤Œ…û£™‰Œ+[¹áW"r±¼ô’lƆò#[ŽJé¸í›Ýžš@{hNBŸf€g‹7õd¡K™} =dAÜ”(’ecôl“8°{%—'äú_ƒ3jHP9ÂàÑm?œO¶ìmŠx£ (¤÷¨2àÍ›} Ù ðÌ*c¯%„ŒÌ”$˜¦cîø“XY_Ñ®<$ª–•…œ×Ü$c£ï ±„ö$û¾Ð¨’þoÚrr¬h¢Ë2/Ô2eLZßXnkD‹ü¤BGE5ïÜÉÄ6!ÖüÔ2"$×-%vý…æI -âíp/ O#j±QQ>á:?æ|K4ü|{"c©Ü|h3KWÆra3û×åA·ˆxÀ—8Ì -šŠD«-b‰˜|Ì0ãE¤]Wjí¶B¨8C+F}rVÞpa!¿ô¨V SC–!Gòe1Ia_1ÃzÓÈy:é(¿+‘ü^@Ls×»Ö3-‚ãÁ²~±X—/^‘F¸Ûìd‹Q¾ê£c™½©,Ž€“©J8-Ö¸ŽRÌ㊥y¼Ö)ka`ÎKNi`àuQ!#¡:!äÇzä˜'µ¹ØèòxÞÃ¥Ò2„ûy*!»²m.˜ÿwB‹ÌŒ>‰5Ùµ¬j¼Í—àÉ.¿ )‚‘0´†ÏÍG’Asxz .ˆÐÒc;ã–ä«ù-­#j£`†TXØý[»t«in†ËPü‚ùÓ9ˆM ÀZOCµÕ£ÌÞ9HÈ0³êe2†É¯xAVëýÐa°‡ïQ„&mTó4œô>×Sµ•Ÿ³ÛQ,6’gP·û.l À.Ý ­ P7í@ØÃcœ#~Y{2…°òpt´¯›ØÓ ‚×(\Èt-[ʽñR3X,Hù¤` ™¯¨H*Œ×ÁFŽ“pêË‘‚ -™4ܨVœóò…%šéºJfõwSuCŒ[r¹}ӵΠ‹¿ÐÇ÷k1×õ‚Öj¹;¢rÈ®ú]QÑ/gÆ÷7$I@“ÔøÓ¦ª¾‘œ R X_YšM2c>ëR~h;ö¡–c¼ƒbE¡ âø9*EþtÃùÇeã%×´5aVåêªJd5Q… ‚…:_;2hñ:¶í\ê`PX°½|‰ÄJXtVþ[Éxf™Åª©]sl…ž¤¬¼!iµKÅ -˜AÏý² sjûý·†+geUgãöêO²ä3—Uyuß…Vr$‰ÊßO¸g“di…y¿DÞ+|†Ÿò:ˆú„½²Y“YïIæcZ<>Ü©à˜›J»‹s—;üY¼æÄ#B¹?9–-T·Ì/Ê<­È èq™<ÙÉ—bbc¾ÒØ\Ö]­~L­\Ãu -£ „æ¸Ä-/ÄSïˆû-"'¯ L ;^ðŽ›ó§ûÞosb<êòŠÞ"ñ|0Oh"jênA €rõþ–‚ÌPþ`ª_ôt…EÛÒÞ‰â[A6ų»c1.‘Y^i(e.810LVI±¥Å‚êÛ0î:çÊ”d5ؽ%¤8®òcÊE×]™}wè\M¡XRF?\ -aŸþc…/­Œ´ÿ²ÀKÖ¼µv΀iÄc?¿ÍíõÐ}™üj¡“DŽmy_Ó¦0xŽFÝõ³]•—¥z ³¶õáô8µè†eôüb]ÜgÈ`WI©~ûsj;Ý ê,Eòñ¤øÈá[°Ó»ã(¥DKòçA•ÔBÆ{‚ÊþÖ”óñ +;M -¯ÉnGaVxqS½_ƒ’Û›õÄ•±GA6|Âpƒ¤#$3Ò“ìšË~ Ÿ~ïö☜93hÅ6»7€¥ŠéS½Eâ{þùÜÙuÚ´R@ õqQF E˜£M(vÝÌ3¡·‚®t -ac¹ïœIR;5šë†a¼qAâpK¶ov&cHÈ.W:ð¶Õ8¢GÞ{*„EÔ"OkéPð6‡i:ºkŠ¬ƒŽ¿ù6 -R|»"h|q¾8¦$º¬ÿî5fƒ÷fç´ÂÞ3‘ßßÙ[>ä]\ôfÊdµŸ)n‚ì}ÕžÞàÃü”“¶¦¸!_#$›{fú+Ö’âïÔÏ¿è£yol‰"Wfu)Û¹oêƆ~KÖp ] øä„_ ÔPï­ËôIˆâ]½_¡Û™‘«¶¾ˆn_Tëç{¾¼‡ƒ¿7r™Îur­‡×Œ<,PÁ“Ü+¹8®\èe‰!ñºÖ$ÜÝpàÎÅcÓ>•5~Ê(*ǼÉíÊ÷½Êþ¥¬ôwj®ìZ¢¦N¿EÍ Þ™ …䓉æü8-I%IÉ®<ØŒ7QŒC„5OŸGé˜A73yçN}&¹ÓÌâN—D>:Ñý–^Œ*ŸYe_få‹"w*‹pÍ‹âÛ¨ž[¿8MTcò"˽Ólû•|‘8«*¥Ö‰,•½£îp±Î&‡Sž·Ž3Õl]÷Ü<£–¶‘ŸPè»Å_„t3Ê*¸µÄ›!¢’géœ5Ì% ¦y,zå׋-9SLˆX9Äî»K±Å¯ô¼<áÏöúªú|í—«iôòÉ|äC-Æi0L«úbZ›×Åüúó”ûäYbým­ÝM&·c´ë/Œ[ܼÌÎo͉œyb¨¾5 ’e¨'|÷>¹k$ü¨Äåp ÞÁ‚¡ò[/ÙäÙ!ó#ŠÌ‡ð_dš–U&´©°ûÎŽ` ;B5u!õŠ8ï©!ýdÉîD‰_­WÞ:jÓh`"¤Puņ“%¹ WôT°Fðz¢íįuŽNäcÔøbÜÆVäð+B-ÞjÉf¦Î ÜðL_îtÐðKÊ 94L“T7PY4 |é´`¯…Êæµð&ºÓ<§l‰ØŒu©%e;ØbgÊàK)©E;á,5×gþ]áÜ [·+¡ÿ¤èÒp®iÏéËc„ÑåKÄC†y…Àsž.P[œµˆ* -{Ä<®Œ‘ˆTm*áå2mO:!žŒ¤ ÿ!U¨™Ù/°>Û†³.Ï;ùå’·Õ«]Jžœ;Z색$Ÿ¬Tè•j2qñlãom‹Q"õž’”IüaAÏ_½=ÄŸ¼>²«áÛ3<4xæ.7$ëb³|£tPa”)®Pô‹NBƒ²$ÈÈ'žú”M|{ -»…â‚(Øaq¥—H6‹˜ »Û’AñM7|F×i!ÑÂÝHãx¶ù&cbgv5 KÓ9Àw6™jTŠ€öhÎor¥k'éÑî¿måÙç<—ä#´ 4(¹¦¤Ž8BËmpè©XU·% —¯|g‹=@zˆhx'‘LåJ¬ÒŽ×L¶÷ qü«6ÿZwÀ“Ô÷èÇdø­ÍyU@9FìÄÞNë;âg¹X-z¼¾¶³ $Ýð/ŸËäcBDù¶v É"rWàï–é>}ô9Ó&ËV×Ü*²ê¸k3#¯øjûôDÀzÚ…H±šwCú‹*­Eå½t¬óÊ/U(XfâòãÌX>‡]`dKlYÓˆÎY1<þéU†ãÍ|˜òªrxcÇØ߆®É¹¾ =Ì,à%LU 4e=[ЪïòQÞŸamld"Æ;†ÍΨ¯tʾ?®ª@ÛɽŒë“òµ+ÚõœŽ2d:dpœ»;¾hÔl®»ô[¶ôq˶Qç=UFñcô‰u«4E¨Ü -ai‘‡Â¡(K.¥¨‘)¹MþIžª” ÷:Åœ9„̓ôèQ“}}C‚’xÓþi üØZ.”=ë÷œ£ÃNèTg —]¸Xî²óM¾„þ»F³,5аn£”9ß,Tn*âUÓõ(ØÃÕªã¿IÑZCC±Q “Ä{´]ísÜ×·¿Ž{„c…Žšjìp¬ñvÿØįZ̉¼Zwu§.N–6‰íK>©³Tâh7⮢}=šŸîü4neŠtà’ÝnKÙþÏ‹.+æ]¼±¿î‰‘S9¯€Y Sêf=r+¬ž)‘ñ¹= Å/3¯¤^·Bô~NÐ{™ }ÇÕ['øóÒ.O…ÄËm>íi‹-&¯šTU­îž„&¾ ­q¢Õ®€ÇðU’Ìœ:&¬^?»i¥"5Ö -€SÆSå¶<(å{e£éï¶ÁÊ;<´ª¶ÍŸ|”3û.¤ÆU¹g層ø|ÛKlŽÙŸ˜xõû>ˆ} tNÖúú˸T:ËÒ7ò4IÖF8(—;µiÎؽ¯ƒÍé’¯mý¬YaB| ÛõmWcræzà2Ö/´ †3“sÆ/.ÚÐcÈ×Î|À¸ï'³~Q±‘ÆGïec³iÞ=‹¥¬•yk£ çÉû§;®ÍÜa…9!B¸ÛË)êWB.|»h~¹…u#g’Ñ­%raÏ}¿#‡…ñ'=/IAÞ‘ä$ÚˆKÿ¶¢užþŠ÷4|Z¹A¾Ù:=.Tæ[AÑvÅǯÓ&ôÝw×lþ^ë˱KoîòY×Írhó ¢/ˆ Þæ×axã4åŒ'NCYQ‘¿ôì¾…}6Û‡EÙQ«Å¤Ô\±Ý·#§êrûÀn?ûN ¤BÔ긨SÏ}˜ù ;æeï8d17ð'©˜U0ÔbÀ‰_ÁÔ“Õ¾JvÁ€z¬_çåP¼p?àú×MšÚ¾%rGU·@õ˜1–·G¡ÇNŒM® 5]¼Å”ìÌk² ´xRÜÕÌ~=¢¤øãûÞ {ìäôÀϲÞ&–Ç -H©vÁ´û—êE¨ ¬¸óÍQt©Yn]\³Ÿ«‡#´yÉ´$ãŸa#êµN‰ž±Þ+]”«¨Nܵ­‰fÜ›û 6}þÍ=/í o´µ?øå„f ;¬5gj*ô°»ù¾²eÍÄÛCÔÕYð©ø‹tPŠÿ~x9ð¯btäa:ö,ò¥m~QSŠ‹iÖù\ÛV¹=»gBЦš[µY-VCÙ~›ÐJQ|—£%q¡ú|Žœ¦ÀçKrà ˆxú÷CHßO ¥9¶÷\Ÿç¢·á¦ÓEU¿'õtgv†yö[΢ï'&+¢îŸ ò¯…9çc»YšWÛSûä´Ú‡ç¸¯³‹Z>š DL~`?ÈaXÏ}$êð2î0ØÜ^-VµöNÒ÷/p(ŽBEàp÷—`TŽ|Z žŽ ™_!Ýøô£q,@…‹Ÿ»Æ“¦í…¬¯¡¤éè¦Æ9ûj6Ì̦òQôIR¼’tmG…»©®œ9ç˜Qì0¸éhË“< A€Ï¡ÞxI:nî÷EˆU;Iú-r>Yyí!Àòwï¿ò||øZ¹LÙQ¢n+¿‘/ÉÞÌZ.§¨Fù'ÍàDvyy•¤­Á».Ü÷@¯¡ãš¾%Çoäú+ï n蜊œo–ÌñÝ©ŒÎ:óƒ×ûMLÌj)%¾Ú“ìGY£ãÙ 6Ú7Ñnž¯-v?é¹¢i·ϊ°¹•‰uÏa.Š\ž¾øÍ&Ô ÷’x‚8¼Ô™íÛéfÉПÜÌGQ™~ÌON´8»1%Ô¦Éó[Ëš4jH!:ÍêBûqx@wùaí•k|ýd@¡OE~ù }*¹KîÔ"ˆˆÔ˜§»Ç@×õ‹‡aA¨…éîc[âÂBÑÁ#·¡²Ìôª`ªÏg6mŒŠ™ó°˜œdx¥Û0ÄÅÀÂdÚ¾ ðìöV¢¡éPLâÚIæJRË8¡YÒ.9 ÀŒ—c"ðpóx„{ÕàÞ’”iíƒ0Uªe µ|¡û2ʮԌ)щC yì;”ÑWù!Uû3c‡9Qî}S×oHµ-xtûÑXh> K3pX+Hpd³‚ß­Ê@RãJn\§Ð‘Ûf$˜dú}W4”"1¿ªÏ*|Oÿ$I/™Álê¿ÑÙö•d³à¹GØï\ld1zxÒ¶âò}ÝTùjë‡-'úŽ}×ØKfÑÐöûÒ’(ë<Â{ÄïpX‘g!Ln(¾ý-Ç£ävm®š -ÄGÌKôp3%ʉSV€ºKv×ÖÂõ柶W ¦-òvE±Ý+J{Õ?(CÄÍ'3Ÿ`–¨“jã‘ F8+™p0TYÑY€/ä·ºRn„ë…ΧH1~½!®MLw ‹zÈê.ÉÎ4=îg?™ÿp [ºñ¡+@l¡‡#$¹‰©¡Ñ´ûÁÃÿÝAâósͱÃÁè׫á–Ñâ! c­ŸÛõBý> -îR -•mØˤ¨H[ì»]Xc+98öÃŒaaÕ^ÑRv%‹÷{Kù6Ñ“à'òûj„ØÐØ×A'~d¹¾’ŸÕ\Yùßc)1ã5ñ ‹®·>Q1>³¬íQ¹ù}^ór`Ö|­4vd£¨¥]R@œº:}ŒÑeøóÁûÊÎ^Ï É/ pZ&‰¼R@'ŠÓS kjÿ`týðªÀ–"Týn#ËI&†¢ÉÞ<:¢9I‰Kë~\1¦F+7þS‰DT±Šv¡[aezûÅbÉÊÃ+`sÅ©:¥¾¥ˆô;rî#¦¢ûMu2“ Ȭø‡À¼?îªd=5n<ú/ÕÁæ^†(ÖŒXhëõ–2ŸpÌ‚' -¼ áÜU™X3 #²¤=@ôØÏÂÜø‘6 ŽÝ„îëÑϬ¡–M'Ñ[®Ý&ÄêþáÚï,hz/,ñ•dpˆù™×N‡¹q}ÝÁË?Ç´ #wYÜÈÍÎ\.º*ï˨¦…™}+ïvcïå½ñ.¯ªÒîÄ/~T ð÷ìlŠžSƒžÂ›Xº¯¬2hNOé‹eÈjCOöWˆ¸€T}O·0<§&¼Åžui%Y~:¼£n|a&»ý‚ˆ!úõNc™^]òÏe(i!RÓw)œƒÐœ3ìõÒ"øl£ýNv©ê&U ³¤~£¼/úB½] ®,Mâκ–êv{¥Ù ˆmìWªpÏ•ˆF/IY¸fÝÕ-J“¾&1”/òè‘Íem[Ñ6W>ÑéÇzSLC‚ΕúÍ+}l”¹aéú ¡yðõ¥T¡¡êB ÒT¼]PU!tô~±Œ9Çà!ŒXaVŽŸlÂÖ°Õmê‘Ø,3«ìc“ylÞ5¨Ñ[tC•™¬ôhêue±%àoÞI.•.xK+òÑ`Dç4†JÒ´â*õ¬V5V­¤`æ=„ Ò`*ùðCì¹åo•Œ_4ÒùÚ8ÇI®°®tø«_V0δ…`ÑJG$ˆÍV©o~ÚQ®5Ê/ª‹»Œ&ßWû@47šçÈÿƒ£Ñ~25Í­Ìs½oQ mr¦Ìµ±ð2?®u…Qó¢‰^^À¬œb´R:d~Šº¶°“~=ݼv¾LmuS)BÚš{€³Rßy)³æÃk+Õ5|øÜÄ?zRb¨2£x M;KK/_Å)©ÅyKª‚ÈÃÈ*‚,½éË™ƒë{dͤ>tÍêåµï–´–kh' 07i¾ÞrN5Þϥ؞Ó)0ªl^Ë| F(ê:¿„\x…Fx’\])™{@ÍÅYMj–´zTxg®½†ò ±Ïз ©¦±m–ݘ÷îC¾…ÙŠÜè/ò)zþ²~j_~H3“oÙåcU'ˆdv+ÈãŒ%hu´UgðÔª >ôT\ãgrz)•IH]_…‹¥K›4? Ñ1UàPÖ¶D3%üìá‹àúÙˆ&ðÛÜ»»çØb$ܶC¶ÉŽW¹1L²ß)Ù&i±ˆ÷0“ÒÌ+íéúC¶Ÿ?»!Üq#¾,¢cvÒ³QíVϯơ6)uZvd˜Úïc3 -‰q +”Éd–¼ÚúºÓÎøöÝÙFBªcË5v|¶ƒš}l‡ ßjJ5Á~§J‚þ¸6«Q­f!0'EÜð'+IÈuÇ ƒêøÇÞÈë"øà}ÿôôLŸŒtp - }Mß„gÀ²žyèì·ÄõËëôQ¨cï»Loe壣Ðbt<&!¿4—‘ܽ ™ƒŒ1i=ß5:ÓÒ[R™ò¬ÅÑXmIéݶ/ÁÍøíºñºxâå¤a ‘GãÅP@² ~b ¡j“ÔUýÌWû”u–HØ ÒŸAñ#Y‹²– hÊÞ^¥wßhʯ<¯“Ëî ¨£åà1“ -rÙ¼ž† ŒÌ¡nJ²ƒvØäȆ:S1Ý(-KŸˆ#‹vÒSÆt¨‹f¼ôá-¡ -}3ÐÝ<íú;b?£ùŽ=ý)¨ß!›aJSA -b½ˆ ¹%ÈÀWq¾ìl ôA"æ±—È>åDkâ[¯HÙ÷ôòÄ_D6ŸQpL_¤ºp³B#?nKÀ¡L%ŸÜ| nÿ\•þ4×gBÂQŽMŠ™=n³'úu,̈ùšÖnêÕNLŠØ).­C+Ü1 BŠÅ E‡†¸Íe8½O&ù“sI‘ÜoÂð^´×Rn3eÂeŒ½ŽÕ8¾??:i5ÎøèÙÍãc¬a'Zoï×QU«Ë‘ËŠi"îŠr¤RàGèQòÏ{0§ÒøÉšS@î ÔO§*ÙáPPcÚ˜8êÑÏ(?Ô]«3 ¾·~¨Ÿw%lgHn -Cvf¾úîë› ðáË·J0ö‘3®ñÚ.(‚7/Rù…©“44Š¤"öˆ¢¢Mam£ã'B|ÿ¢‡cjå$ ñ<šËÿàˆm·†›s¡’´ì%ì¼Æ)WØ2úíH»ëÙß—|•ÞãGâª4¾Ég^a)£/T£æîoA•‰äPCÁˆW£sæÛ]±’™¶^'Ôýö¨Í¢ý‡=R[œÙ›ãÌ.-ó‹0K?Á¬„.ÿ‰â®ŒÖ˜7pEÆ¿ßCùýêo«ÐÎ=6’(cŽrîÿ÷>,UËòÓ@ñçNé(ÚDöeNmnœîelrÞëV& ‰¥>)>e°6a»./ø»n åCŒÑc89m©ÉÖÑï¯ð]81§Q\˜²Ô~ö0Ô2qC^&en¯}Z®Fé­—.Ú—U(KŽ$gEý0/¬V˜Å~„v;ð׳äòÛ8_h~7¥e-AfrŠî‰cÀÌ-ÝI±ê±¡zøö`#§=-i fÛÕ£iCå¹ >C­½%FcÜ—¯è_žÄDŸ=C¬´ üÅvÒvN)¿"é“®Pxq+¾>!¢ T i–%hf6ô‰ð¥*Øáð´å棙j;q„|ãØEž9å(ŵoö»´…äÀ«ÀbJpí/·9@ŒÐ„×ô¶ðãåDlßVaB=Ýy” -…Ìé~·Xù/»ufÙ}ð#ÀkÉ*â‡?¦Aà­ÍÏùƒDÙ¯¢Ç‰Í€róÍ";2“j2±d @Ñü÷nS‰–ff/§béŒ -Yr%9Åy[sÊCb¾p“”¦zµ5+ãmdª”T”¢£ÝIèï7Úc…ß…3zídt‡¯€a…TÒE„*/f®1î{¢p8âú‘â&E™\¦X=yñ¥Ô¦_!R«– Êf•ñ/”£F(°ÛæÐýR‰”Ó‰'V™u#OóèwL®M «ÖNºñ°h5º9_Ö^%¢Ç"kYK ²´gs~é7^%ŠãØl‘›s.#Í # ×j-¤.¹§)àì`ëÛ!nйÐе4‰Òi;@±qäc\`º?M€œY§¶o’µ_·@[øü‚Áð–sBbÖãÙž±Ve,ÿÿþ_‚ÿ+[ œ@6†VHÿã¾zendstream +0±0vÍ,l‘˜ÿq’¶5¸ÿ#lâl÷_C.@G°€,I+š€l­Ý&@S$fø]@°ÉÿRÿ3¹„³µµ‚¡Í?éÿ³Oÿk†¡…µûÎÙØ9;ò  ƒíÿœúøz" ëÿõ"i'Ck ca[3k €å?BŽn@% 'cs€©¡µ#ð_q ­ÉÿT7î_Ì"r¢ŸÅ¥þ½¦ÿV2´°uRs·ûwâæÿ‹YßÜ! 7€ËVðDðï¿þûò?^'nk 2±°o +N.€¡ƒƒ¡;xw€‰àÉ +°°5º€n`gæ¶ 'ð#pS¼¦ ¤–¼ê̦ÿŠý²Ñâ ÙÁhýodç0Û;ƒœ€&FÖÿ±¸ÿùøŸ#ÿ=ÌÁ`¶3tÚZMÿŠ²þgôL¿ÛÐñŸŽVoA°µ³ã[ì` ²±1|‹p˜ÍÝí̶o!.ðSàD “·7€ÙÑÚÐÑü-Â`ö:€Þà"@¶À3'ØÞÉõmœìídîükÆ?í9;¼þi˜…Ë_3ÀºŽà¥ü7ƒe.¹‚—øßÁ Vµµø[„矚­Aoq±ÿÓo ã?—Ã[œ[øÀyEÞœSôÀ ÅÞ\·ø¿‰\µÄk–|#p½Ro–~#p¥2ov‘}#°‹Ü]äßì¢ðF`ÅØEéÀ.ÊovQy#°‹ê]ÔÞì¢þF`7»|~#°‹æ]´þMà»—ÙÈÁÐØ +èôßv3øfc~ÛŒÁŒÞœÁøí4±€Ë1ù Áá?›é/Wdö‚K2ÿ Á5ýuNYÀEYþ…`'«¿,eý‚­lÞ|31Ûþ…`+Ð_¶²û ÿÙx!ØÊá/ügwÿ…`+§¿låü‚­\þB°•ë_ØÊí/[¹ÿ…`+áÿ¾|ED@nžLàËÄ>Áàj?‚÷‹÷Ÿ¨nk>?ÒbàCÎÂÂnß?Qcgð­äô¯ïøbÿ/6µ€@7 1ÒÂ,Ș/È2µ!¤ÌG¼`¼–Α8½$h¸=¸.ïÃá>¬i‡Æ15 éf0¦¥EFʱl%³‰)çaƒ°W¿§*sðM‡l˜S+UcþòuÉvÓùpåâUˆKkl[œíW›7ÅbÐ|FrJÅz¥ +O3Ô:dü¥O"ÕLkûÃ÷l`#&JIžmƒzVÛ{h¦¶¸ây«È.h8Äf‡E\MÀÀƒY^¾Õ×{ú í;JÑ «a5æp´É(äÒØPÝ}dBŒ‰Ò‡ Ü]â ób™-½}Åï²|Äݪï[ÄÚ¼>Cãà@R6ª$ˆxÒ2e’ÏKû0zë +¤ L¢­$0¿PkÐ=²\Zª§š6N ã–Ñuê±¹x~ÇÒß@˜|ÌÖñè §¬ &ûá²ÿFt²õ©&É·,4‡ ¢öûת͇+EžýûwŸÔ¤È*ù" xÞõ2ï8RvmÜ„u‰š”9º¥¢y4<‡j·äe=`L½ÖOVí +ç»ÖãxùCýp_pzZèºìmlÅ•ÙåW}Ïsºy‹ÏBà–¬§{è„Ü)UR*Æo¥Žì‡ËOBU[yº8h­¶:Æó?ß’Rï8þcøŽ 3ˆ¥u†¢óÃ`E9ÍTÛ>zèsò¯ÜºëGœ¥r·)o³µãS_ËøÞ_†Ý›È@Ýtr£¨Áˆ ]T=Hœü§mŸ('2Š%a4Ä«&¢–Q\×Ù®¡Ijß>¡mäËšKm/”ªÉS¸²=4~œ¼šS£YlF+rï]f3ôDfàImøTxß–ÞÞb§DM, =Ù¼8¬?Þ úØ÷äÀÙf¢ß—4ÚyuAê5øš²ŸË™×L€üÂÆ–®â¿íŒ¯Î#÷+ZhülMÓ«0矟ñQÝDÇjhJ(ð߉¡ÔåîŠ e§¤úé`Ðs~”=ïŠ:T°A¹É.xX[/$]4Ò,°Ðš|BßÓÉ€@‹çFNôäá,C‘Ÿ:•~¼çåùži¨8¯Ï¹ÃœV‹øÛÁ—Pd19Ò9 ð–Öó‰!øxÁna?ÚV’Ø£Z‚-Ïa²—W>§ƒô>"çÉšÑÛ¤æÚ7WË\o%¦Æœ5dh…ädÖµXÚˆ•¤ýdösíôÔѮ՞ÖAPÌ–NÀÏ7‰9Ôç~8×ßÊH ÷G3W¶rïDäbyé%ÙŒ åG¶•ÒqÛ7»=5öÐœ„">ÍÏoêÉB—&2û z6È‚¸)Qþ$ËÆèÙ&q`÷J.OÈõ¿:gÔ‘ r„Á£Û~8ŸlÙÛñ&FAQHïQeÀ›7/ú@²à™UÆþ^K™)I0MÇÜñ'±²¾¢]yHT-+; +9¯9¸IÆFßb /ìIö}¡Q%ý%Þ´åäXÑD—e^¨e˘´¾±ÜÖˆùI…ŽŠ&jÞ¹“‰mB¬ ø©eDH®[J.ìú 9Ì“ÄÛá^ž,FÔb£¢|Âu~Ìù–6hùùöDÆR¹ùÐf–®ŒåÂf<÷¯ ʃn?ð€/q˜:5‰V[Ä1ù˜aÆ‹H»®ÔÚm…Pq†:WŒúä¬,8¼àÂ:C~èQ­þ¦†,CŽäËb’¾b†õ¦‘ótÒQ~W"ù½€˜þæ®w­gZǃeýb±._¼"%Œ82p·ÙÉ£|ÕGÇ2{SY1'S%”pZ¬q¥˜ÇKóx­SÖ(ÂÀœ—œÒÀÀë¢BFBuBÈõÈ1Ojs±Ñåñ¼‡K%¤%>;e÷óTBveÛ\0ÿï„™1}k²kYÕx›/1À“]~R#ah Ÿ›$#‚æðôþ\¡¥Çv8Æ-ÉWó[ZGÔFÁ ¨°°û·véVÓÜ —¡øó§-r›@µž†j«G˜½safÕËd “_ñ‚¬/Öû¡Ã`ߣMÚ¨æi8é}®§6j+?g·£Xl$Ï n÷]Ø€]ºAZA nÚ°‡Ç8Gü²öx°ôÐÞPÔ`¢‡3Çúä*á6k¹±A»i¢+þp3ðG "›¬ªÙI‰Ý©£ÚÜnƒ†¦U¨´Òþ åá¦èkžÒ3‚b®ë­ÕrwDå]õ»¢¢_ÎŒïoH’€&?¨ñ§MU}#9A,¤°¾²4›dÆ| Ö¥üÐvìC-ÆxÅŠBÄñsTŠüé†óËÆK®i-jÂ6¬ÊÕU”Èj¢ +A u¾vdÐâul Ú¹ÔÁ  °2„a{ù3ˆ•°:é8¬ü·’ñÌ2‹USºæØ +5\"/²¼ÒPÊ\pb`˜¬’bK‹Õ·5`ÜuΕ)Éj°ÿý Æ +#^Ziÿe—¬ykíœÓˆÇ~~?šÛë¡û2ùÕB'ˆÛò¾¦Maðº?êg»$*/KõfmëÃéqjÑ Êèùź¸ÏÁ®’Rýö3æÔvºÔY6‹äãIñ‘ ·`§w!ÆQJ‰–äσ*©…Œ÷•ý­)çãVwš^“ÝŽÂ:¬ðâ¦z¿%·7ê‰+c‚mø„áIG:Hf¤!&Ù5—3ü@?ýÞíÅ19sfЊmvoKÓ§z‹Ä÷üó¹2²ë´i¥€@ê㢌Š0G!šP캙gBn]éÂÆrß9“¤vj4× Ãxã‚Äà–lßìLÆ]®tàmªqD¼÷T‹¨EžÖÒ¡àlÓtt×Y1óm¤øvEÐøâ|qLItYÿÝkÌ*îÍÎi…½g:…#¿¿‡3·|È»¸èÍ”Éj?S ÜÙûª=!¼Á‡ù('mMqC¾FH6÷ÌôV¬%Åß©ŸÑGóÞ*ØE®:Ì.êR¶sßÔ ý–¬á"@»@ðÉ-¿¨¡ Þ[—é“Å;»z¿B·3#Wm}3„ݾ©ÖÏ÷|-xoä2ë6äZ;¯yX ‚'¹Wrq\¹ÐËCâu­I¸»áÀ‹Ç¦}*kü$”QTŽyyÄŒéÒ…½C’RV–ùtxì“oXïPGsP†«Òí +º”eP(f-RWÔ‹\^·y4&ˆƒS®Þ@Ý­ÀNkSÝ(rÁR8$Ò³Ý:àkï`êÓ²@ÎíâÝ%ÚÈGzƒ +û•3ðûLä7ŠÖxdËd&Qæ +ooFhª>.‰#x¬Tê ®¸áœ‘^Ýœ7t¸[,3äYyŒùïÝ'i–¢Uz‡›B=5ê2¼fjÕ¿Æ”O\6,¨ *·‹Î\•E¯Ä{8KPÈ‹&¿ÚÓùœY±£!Ô Š´‘yÿ¦ÿÜÌ“XjJ¤F­ ñýcÞ~Ç[bk°‚b­y#5WÇK¾;i@wQ*Qô\ñ}M‡ŠåðÃRÏæSÔz”RÕŽ»Ù­–oJ6Ž^×ÂÙ·e q—¶‹L.eªåĚɮ` ƒX‹žÝÿÑ\HÞZ˜ýV¡(…äªþ‡Dî& +Á „™½ù< +Rÿ…»ºXί[è!ù~v'/Ñ8R²“ šÝ©¶Ö={¸ž]y2|‰¨ ¿BÕ*)Ñ(«™JéŠí•-Ò"P¶£—°Õ³ÁæU†Éß©œvðÙfÂÓßîúD]2ž­eSRlø)nã-ÊŽ˜4fZã¨,ü7g,9ÙnbwL†râërîec.6…£[±€:!}’Û•ï{•ýKYéïÔ\ÙµDM~‹š¼3 +É&ÍùqZ’J’’]y°o¢‡kž>†S1ƒn>fòÎúLr§™Å.;9ˆ|t¢û-½U>³Ê¾ÌÊEîT àšÅ·Q=·,~;pš¨ÆäE–/z§Ùö+ù"qVUJ­Y*{GÝábM§Y©Ð+ÕdââÙÆß>:Û£Dê=$)“øž¿&z{ˆ?y}dW÷gxhðÌ]nH>ÖÅfùFé Â(S\¡(è„eI/O<õ(›øö w# +ÅQ°ÃâJ/‘l1þv·%ƒâ›nøŒ®ÓB¢…»‘Æñlò!LÆÄ0Îìj@–¦s€îl2Õ¨íÑœßäJ×NÒ£ÝÛ Ê³)Î x.ÈGhhP*rLIq„–ÛàÐS±ªnJ2._ùÎ{(€ôÑðO"™Ê1”X¥¯™lïâøWlÿµî€'©ïÑÉð1Z/šóª€rŒØ‰½ÖwÄÏr±Zôx}mgHºá_>—ÉÇ„ˆòmí@“Eä®Àßÿ,Ó}úè;s¦M—­®¹UdÕq×fF^ñÕö鉀õ´; +‘b5ï†ôUZ‹Ê{éXç•_ªP:°ÌÄ äÇ™16*°$>|»ÀÈ–Ù²¦³bxüÓ« Ç›ù0å)TåðÆŽ±?¾ ]“s}z,˜;YÀK˜.ªhÊz¶ Uß壼?ÃÚ2ØÈDŒw ›œQ_é”}\U¶'’{×'äkW´ë9eÈtÈà8ww|ѨÙ\vé·léã–m£Î{ªŒâ "ÆèëViŠP¹ÂÒ"…y´ ëJ%¦¢åA¯kHï>‰Z5n€ÜMóþè©L^üú¤™3+õ“=ÞcÄù¨ÓÛ,æÉøQN*ùðrþìt*Ò©˜ÑuþÓòõåM¶êr)ÁŸ"þ£›IÉËf G#£©n,7­ ËjToN™Ú„™–Œ†™ú# BÉñÙdßni€q[Z?”âQÒ>BBˆÏ¼Î꒤儼’T»,~¯àñœtcZ™Üçèç?Œ½zÆ°îfõ.øb„»³èDŒÕ¢øš™gbÈH4¤¿ë;úãî‘é¸ äd R^ìB| CQ"–\JQ#Sr›ü“<T)îuŠÝwu9s›èÑ£&ûú†%ñ¦ýÓø±µ\({ Öï9G‡Ð©Î.»p±Üeç›| ýwf7Xj aÝF)s¾Yþ0¨ÜTÄ«¦-4êQ°‡«UÇ“¢µ††b£.&‰?öh»Ú縯o÷Ç +5ÕØá4Xãíþ±‰;<^µ˜'yµîêN]œ„-mÛ—|Rg©ÄÑnÄ]D!ûz4?ÝùiÜÊéÀ%»Ý–²ý ž]VÌ»xcÝ#§&þ$r^³¦ÔÍzåVX=S"ãs{Š9^f^I½n…4èýœ ÷2-úŽ«·Nð'æ¥]ž +‰—Û|ÚÓ[L^59¨ªZ Ü= M|ZãD«]á«$™9uLX½vÓJEj¬§Œ§ÊmyPÊ÷ÊFÓÞlƒ•wxhU;l›?ù(gö]H ªrÏÊcIñù¶—س?1ñ2ê÷}„ûè(œ¬õõ—q©t–¥oäi’¬ŒpP.wjÓœ±{_›Ó#$_ÛúY³Â„ø@¶ëÛ®ÆäÌõÀe¬_h g&çŒ_\´¡Ç¯ù€qßOfý¢bÿ"=ŽÞËÆfÓ¼{5JY+óÖFAÏ“÷ Nw\ š%&¸Ã +sB„$p·—SÔ¯„\øvÑüxÎhÔÜÔB§+â¿#º(ÉNÂ挌Iõ“ òF*>´Þ°'úõ|s²¤„Àú)õÚiGJë`"Tix€¸:÷$?²x} cn®¦ï¯A™úÑ N¿Øŵøå'^·Zq\I_«JPuˆî=tÚLa˜£)PÄ+;‘ö3C‹*å FñÏ)Wkâh7ú¼Ù!ó  ÔðɕׇNu¼O©<‡â+ƒc ÷$?Nä'zk…®‘J ×›ÛëàÈFj“õ­fÆ{Ý>œ,'œ%•¶C§rð%¥䪬_‰Y-Hð½õŠk»©†áíÖ€µ +J¾»ŒÄ°AýPZnAýýƒyÈdë«“Ÿ©ñ`›Šù¾hA×ÉàËàkíÍ™„nKôEžh G<+»¶Ìñóæ2™q?J˜~)Ú¢@¤¤ %7¢¨Uïò6‡ßXÙðYUr®¬KCÛðñ¤Vc‹i|0r +ëFÎ$£[KäŸû~G ãOz^’‚¼#ÉI´—þm)Dë<ýïiø´rƒ|³uz\¨Ì3¶‚¢íŠ!Ž_§Mèºï®Ùü½Ö—c—ÞÜå?²†/›åÐæE_¼Í¯ÃðÆiÊOœ†²¢ #éÙ} ûl¶‹"²£V‹I©¹b»oGN/.ÔåöÝ~ö@H…¨ÕqQ§žû0óvÌËÞqÈb>nà9NR1«`¨Å€¿‚©'«}•ì‚õX¿ÎË¡xá Àõ¯›4µ}K䎪nê1c,oB›\A4jºx‹)Ù™×d hñ¤¸«™)ü"zDIñÇ#ö½A÷Ø;ÉéŸe/¼M,#Rí‚i÷5..Õ‹PXq監.èR³Ü4º¸f?WGhó’iHÆ?ÃFÔkÿÏEoÃM§‹ª~OêéÎì óì·œE7ÞOLVDÝ?ä_ sÎÇv³4¯¶§öÉ7"hµ ,Ïq_g;µ|4ˆ˜üÀ~Ã$° Ÿ;ûHÔáeÜa°¹½Z¬jí¤ï_àP…ŠÀáî/Á¨ù´> <A2¿ þBº9ðéGãX€8 +yüÞñ<é‘wÞí1éß–!,Ÿ™MB¼ð³K«]…¼¶ï¦¡•\†UoÝ_gq„¿ËŠ´¾¼èÖ­²~äv¬Qòÿ!˜ï7Í–,`EÌý n´iÁá9«½4txSšgâ¨ÅòÃûº¨ST) –w¦gÁ~´HŠvZ½úÐC‰w­ü‚A6WþºµxúË©ðê42v–ÀÁxÓ,«.)ö±Š•V1ño[϶q†&wWÔzÉ]w™‡Ÿ?ŸŽŸ>â-‰6‹5‹Øõêçý³Ç¨”ª/wtŒÌfö׃ĥI“ƒÑQ+#+7A +Kã{{%<°¦ŠxQ¨eϬLÕ%æ*.=&Rê‰qMû“Òm®¤Ĥ%G"/L Íï½¾§;&%¦:Fn¡ÇHfé´$¨¯Aá༞`|­×n·|?w'MÛ Y_CI1ÒÑ;Ms ÷Õl˜™Må£è“¤x=$éÚŽ +=vS]9sÎ1£Øa pÓÑ–'y‚ŸC½ñ’>t;ÜÜï‹«v’ô[ä|²òÚC€åïÞåùøðµ0r™²£DÝV~#_’½™µ\&NQòOš1À‰ìòò*I[%‚5vÿ\¸ï^CÇ5}KŽßÈõWÞ!ÜÐ9+>9ß,™ã»Suæÿ®÷›˜˜ÕRJ|µ' زFdzl´'n¢+Ü<_[ì~ÒsEÓ„oŸas+ëžÂ<\¹<}ñ›M¨î%ñ px©3Û·ÓÌ’¡/>¹™¢ +2ý˜Ÿœ,hqvcJ¨M5’ç·–5iÔBtšÕ „öãð€î +òÃÚ+×øúÉ€BŸŠ8üòúTr—6Ü!¨E©0O%v?€®ëÂP% +ÓÝǶÄ1„…¢ƒGnCe™éUÁTŸÏlÚ3ça19ÉðJ·aˆŠ…É"´}AáÙí­DCÓ¡˜Äµ“Ì•¤–pB³¤]r@'þ€/ÇDàáæñ%öªÁ½$)ÓÚaª:*T;ÊjùB÷ d”]©S¢‡òØw(£¯òCªögÆ%6r¢Üyð.DÄ­ŸŒÏ6ãÙ¾ŠOw¡ÕÇ-‰Ô×2«¯¦KÅØ\1ðröèL{Ry0´w‚1ú©cÌÞÌ7¦¬\ǾNz<œ-Höø5—˜/ _çÝ?}-û@&ºuG‘KÏñ,1ÍWÜt"òºGEV E§òPãÂq›iêù†ßùõU–Ak—XU€†ÜÌGÿ i9b®‹ÅBãÄ…Ýa„9oßT7— ¯^Ú·•Æ²«VCØ:mܾqÀá›O£‡ï‘Ù;Øw“<¶úÛ ‡&ʨÊô³—™ô÷_ `;¤è>±6)ú«Æ8ÛÙ}ú¦®;Þj[ðèö£!±Ð|–fà°VàÈf'¿[•¤Æ•Ü&¸N¡#·Íº©óÕÖ[Nôû®±—Ì¢¡í÷¥%Q6Öy„÷ˆßá°"ÏB˜ÜP|û[ŽGÿÈíÚ\4ˆ˜—èáxòHJ¸vŒ”¶n¶(·r/³1‰[ÐâEõ;_xŸ–ÚÃHC?ãÓ3¯–) 0Ï*ó“hTIf‘b'† +ßh`´7Âѹäe:Ó^~ÌÇŸÛ-GÅãÞ%÷2nx~-4 y¢‹[¾{ƒ²½³ír‰Ëudß(“!©Yà^;¹n„ h€†sežY'"T Ɇjµ“¢ôz˼»ëȨ*왹3ÄwÎwïÎ[®*ÙQûJã=!ò2¿¹î÷(e÷5iji-mÄc¢w9SW­ûÆ!(º«ÝºÇm¿›ÓUÏÈâáeJ/Vͼ¥êK-Ôd3Š0&:U­0QI½R©‰¼ÂCsl(Fm’Æ oúçé7š§Ø. 9™ f[,8´äuÒ†oÙ9+¨·Ù(‚Iì9P«¡V·„ŒÓ¦lÌ;¯w!Ã1¡ +ç]¸Û¬Å%Ã}ÑÝãb"@ƒÇSŽìžá²øÊ%xvPhQÈ·ë"P#qû®_\íöI:¸bæ‘:ÕXÌå'tóJHy¯ vAaɬ֬T Q 2ïæOÃV{‰MWü#4NH‚· oÓÇz·Ÿ¡„•®YqÜœüçð{¯÷ðíbÛ}Ía!= Qc¬Á6æE4„ãë£Y;A°¤»Ï·Qýnz##_.ûmà +#1¾ñ4–Z²¬«3zãRu$Š$<ýÏò—}÷öQü^! +·n#B|fJ”§¬u—ì®-¬)„ëÍ?m¯L[äíŠb+ºW”öª P†ˆ›Of>/À,Q'+ÔÆ#ŒpV2á`¨²¢³_Èou¥Ü2× O‘büzC\›˜îõÕ]’izÜÏ ~2ÿá4¶tÿâCW€Ø„CGHrSC£i÷ƒ‡ÿ»ƒÄççšc‡ƒÑ¯W!Ã-£ÅCÆZ?·ë…ú}Ü¥*Û°—IQ‘¶Øw3º°ÆVrpì‡ê½¢¥ìJï!÷—òm¢;'ÁNä÷Õ±¡±¯ƒNüÈ6r}%?«¹²ò¿ÇRbÆkâA]o}¢ b|fYÛ%¢r%òû¼æåÀ¬:ùZ3hìÈFQ/J»¤€9uuú£Ëðçƒ÷•½:ž’_@á´*Ly¥€N§§ÖÔþÁ<.èúáU-E¨ûÝF–“L E“½ytDs’—Öý¸bLŒV4>nü§ˆ¨bíC)·ÂÊôö‹Å’•‡WÀæŠSuJ}K5éw>äÜGLEÿö#šêd&Y!ñyÜUÉzjÜx< ô_ª5‚ͽ Q¬±ÐÖë-e>á˜Ox(¹«2±fFdI=z€è±Ÿ…¹ñ#m» Ý×£ŸYC-›N*¢·2\»MˆÕ9ýõßXÐ ô^Xâ+Éàó3¯sãúºƒ'–ŽiF‘ÿš!¸\tTÞ—QM 3ûVÞíƆ_Ë{ã]^U¥Ý‰_ü¨@áïÙÙ=§=…7±t_YeÐœžÒËÕ†žì¯q©úž naxNMx‹=ëÒJ²,ütxGÝøÂLvû)BôëÆ2½ºäŸËPÒB¤¦ïR8¡9gØë¥EðÙFûìRÕMª@gI=üFy_ô…z»\ XšÄu-!Ôíö"J³ÛدTáž+^’²pͺ«[”& |Mb(_äÑ#"›ËÚ¶¢m®|¢Óõ¦˜†+õ›WúØ(sÃÒô BóàëK©B7BÕ…¤©x» *ªBèèýb/sŽÁC±Â¬?Ø„­a?*ª%ÚÔ#±Yf:VÙÇ&óؼkP£·<è†*%2YéÑÔëÊbKÀß6¼“\*]ð +–V*ä£ÁˆÎi •¤iÅUêY­j¬ZIÁÌÿz¤ÀTòá‡Ør Êß*¿h¤óµqŽ“\a]7èðW¿þ¬`œi 'À¢•ŽH›­Rßü´%>¢\k”_TwM¾¯öh2n4Ï‘ÿG£ýdjš[™çzߢ@ÚäL™kcàe~\ë +£æE½¼€Y9Åh¥tÈüuma'ýzºyí|™Úê¦R„´5÷g¥< ¾óRf͇×Vª5jøð¹‰ô¤ÄPeFñ@›v––^¾ŠSR‹ó:—T‘‡‘UYzÒ'–3×÷ÈšI}èš=ÔËkß;,i-+ÖÐN`n5Ò|=0¼3äœj¼ŸK±=§S`TÙ½–ù@ŒPÔu~ ¹ð +ð:$¹ºR2÷€š!‹³šÔ,iõ¨ðÎ\{ åAbŸ¡o=RMcÛ,»1ï݇<| ³¹Ñ_äSôüe7üÔ¾üf&ß²ËÆ8 +ªNÉìVÇKÐêh«Îà©U9 |詸ÆÏä +ôR*“º¾ +K—6i~@£cªÀ¡¬m‰fJ8*øÙÃÁõ³3Mà·¹wwϱÅ8H¸m‡l“®rc2˜d¿S²MÒbïa&¥™WÚÒõ†l?~vC>¸ãF|XDÇì¤g¢Ú­ž_CmRê´ìÈ0µßÇfþ ã@W(“É -yµõu§ñí»³„TÇ–!jìøl5ûØA/¾Õ”j‚ýN•ýq5lV£4ZÍB`4NŠ6¸á'NV’ëŽÕ1ð½ÿ×EðÁûþéé™>é:á@ûš¾ Ï€e=óÐÙo‰ë—×é£PÇÞw™ÞÊÊGF¡ÅèxLB~i.#¹{2'bÒz¾kt¦¥·¤2åY9Š£±Ú’Ò»m_:ƒ›'ðÛuãuñÄÊIÃ"Æ‹¡€düÄ@BÕ&©«ú™¯ö)'ê,‘°¤?ƒâF,²e!,Д¼½Jï¾Ñ”_y^'—ÝPGËÁc&ä2²y= ™CÝ”dí°É‘ u¦bº)PZ–>Fí¤§Œ)èPÍx3èÃ[Búf »yÚõwÄ~FózúSP¿C"$:7Ô.¦‚Äz1rK¯â|ÙÙ@èƒDÌc/‘}ʈÖÄ·^/²ïé ä‰+¾ˆl>£à˜¾Huáf7:„F~Ü–€B™J>¹+ø@:Üþ¹*ýi®Ï„„£›3;{ÜfOôëX :˜ó5­ÝÔ«˜±S\Z‡V0¸c@„‹Š& q›Ë6pzŸ:Mò &ç’"¹Þ„á;ÿ¼h¯¥ÜfÊ„Ë{«q|~tÒj&œñѳ›ÇÇþXÃN´ÞÞ¯£ªV—#—ÓDÜåH¥ÀУäŸ÷`N¥ñ“5§€Ü¨ŸNU +²Ã¡ Æ´1qÔ)¢ŸQ~¨ºV3f|oýP?ïJØÎ(܆ íÌ|õÝ×7à/—o•`ì#g\ãµ]Po^¤ò S'ih'HEìEE›ÂÚFÇO„øþE Ç.ÔÊI@ây4—ÿÁÛn 7çB%3hÙKØyS®°eôÛ‘v׳¿/ù*½ÇÄUi|“ϼÂRF1^¨FÍÝ5Þ‚*É¡†‚¯FçÌ·»b?$2m½N¨ûíQ›Eû{¤¶89²…7Ç™]Zæa>–~‚Y ]þÅ]­1oàþŠŒ¿‡òûÕßV¡{l$PÆ5äÜ#þ1î}Xª–姀âÏÒQ´‰ìËœÚÜ8ÝËØä¼×­LK}R|Ê8`mÂv]^ðwÝʇ3¢ÇprÚ>R“­+¢ß9^á»pbN£&¸0e©ýìa¨e↼LÊÜ^û´\ŒÒ[/]´/«4P–IΊúa_X­0‹ý +;ívà¯gÉ+ä·q¾Ðü:oJ'ÊZ‚ÌäÝÇ€™[º’bÕcCõðíÁ:F,N{Z$Ò@Ͷ«GÓ†Ês|†Z{?JÆ*¸/_Ñ¿<‰?ˆ>{†XhAù‹í¤íœR~EÒ']¡3ðâV|}BD¨Ò,KÐÌlèá'JU°ÃáiËÍ+F3ÕvâùƱ‹Š1jßìwi ÉWÅ”àÚ_n1r€¡ ¯émàÇ?ʉØx¬ô™•dšJ\0r¯ªUXHÒU +{{Sò:ØGSÚ ’m(Åä=³ŒÔͶ'¡Þ'+‘ãXc äÀxí/œ‘`Gó•£ÙÓŲhÕÚ’I4¹Ù—Ù.ó÷z©ð²° ŽED/ˆdÜ{9Àq1²@'> ![©-²)á¦c•± +Q¬\…Ø&ä3`ü ÞÂø> endobj 935 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 -/FontName /MJCNOV+CMSSBX10 +/FontName /BLCWEH+CMSSBX10 /ItalicAngle 0 /StemV 136 /XHeight 458 @@ -8422,123 +9052,153 @@ endobj /CharSet (/ff/fi/fl/quotedblright/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/question/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/bracketleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) /FontFile 936 0 R >> endobj -1972 0 obj +2085 0 obj [642 586 586 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 558 0 0 0 0 306 428 428 550 856 306 367 306 550 550 550 550 550 550 550 550 550 550 550 306 0 0 0 0 519 0 733 733 703 794 642 611 733 794 331 519 764 581 978 794 794 703 794 703 611 733 764 733 1039 733 733 0 343 0 0 0 0 0 525 561 489 561 511 336 550 561 256 286 531 256 867 561 550 561 561 372 422 404 561 500 744 500 500 476 ] endobj 941 0 obj << /Type /Pages /Count 6 -/Parent 1973 0 R -/Kids [930 0 R 943 0 R 960 0 R 1024 0 R 1069 0 R 1123 0 R] +/Parent 2086 0 R +/Kids [930 0 R 943 0 R 960 0 R 990 0 R 1026 0 R 1070 0 R] >> endobj -1229 0 obj << +1180 0 obj << /Type /Pages /Count 6 -/Parent 1973 0 R -/Kids [1176 0 R 1231 0 R 1280 0 R 1286 0 R 1291 0 R 1306 0 R] +/Parent 2086 0 R +/Kids [1125 0 R 1182 0 R 1235 0 R 1282 0 R 1287 0 R 1293 0 R] >> endobj -1321 0 obj << +1314 0 obj << /Type /Pages /Count 6 -/Parent 1973 0 R -/Kids [1313 0 R 1323 0 R 1328 0 R 1335 0 R 1345 0 R 1360 0 R] +/Parent 2086 0 R +/Kids [1304 0 R 1316 0 R 1320 0 R 1328 0 R 1334 0 R 1339 0 R] >> endobj -1393 0 obj << +1354 0 obj << /Type /Pages /Count 6 -/Parent 1973 0 R -/Kids [1380 0 R 1395 0 R 1411 0 R 1428 0 R 1446 0 R 1461 0 R] +/Parent 2086 0 R +/Kids [1347 0 R 1356 0 R 1365 0 R 1388 0 R 1395 0 R 1408 0 R] >> endobj -1484 0 obj << +1432 0 obj << /Type /Pages /Count 6 -/Parent 1973 0 R -/Kids [1479 0 R 1486 0 R 1495 0 R 1502 0 R 1508 0 R 1516 0 R] +/Parent 2086 0 R +/Kids [1420 0 R 1434 0 R 1449 0 R 1465 0 R 1480 0 R 1497 0 R] >> endobj -1526 0 obj << +1511 0 obj << /Type /Pages /Count 6 -/Parent 1973 0 R -/Kids [1520 0 R 1528 0 R 1532 0 R 1542 0 R 1559 0 R 1575 0 R] +/Parent 2086 0 R +/Kids [1503 0 R 1513 0 R 1518 0 R 1524 0 R 1531 0 R 1538 0 R] >> endobj -1599 0 obj << +1552 0 obj << /Type /Pages /Count 6 -/Parent 1974 0 R -/Kids [1588 0 R 1601 0 R 1611 0 R 1620 0 R 1626 0 R 1632 0 R] +/Parent 2087 0 R +/Kids [1543 0 R 1554 0 R 1558 0 R 1568 0 R 1580 0 R 1595 0 R] >> endobj -1646 0 obj << +1615 0 obj << /Type /Pages /Count 6 -/Parent 1974 0 R -/Kids [1639 0 R 1648 0 R 1658 0 R 1665 0 R 1679 0 R 1691 0 R] +/Parent 2087 0 R +/Kids [1605 0 R 1617 0 R 1627 0 R 1635 0 R 1643 0 R 1649 0 R] >> endobj -1711 0 obj << +1660 0 obj << /Type /Pages /Count 6 -/Parent 1974 0 R -/Kids [1700 0 R 1713 0 R 1723 0 R 1732 0 R 1743 0 R 1750 0 R] +/Parent 2087 0 R +/Kids [1656 0 R 1662 0 R 1668 0 R 1674 0 R 1679 0 R 1685 0 R] >> endobj -1766 0 obj << +1698 0 obj << /Type /Pages /Count 6 -/Parent 1974 0 R -/Kids [1759 0 R 1768 0 R 1775 0 R 1787 0 R 1793 0 R 1797 0 R] +/Parent 2087 0 R +/Kids [1691 0 R 1700 0 R 1707 0 R 1713 0 R 1720 0 R 1730 0 R] >> endobj -1805 0 obj << +1748 0 obj << /Type /Pages /Count 6 -/Parent 1974 0 R -/Kids [1801 0 R 1807 0 R 1812 0 R 1821 0 R 1830 0 R 1835 0 R] +/Parent 2087 0 R +/Kids [1742 0 R 1750 0 R 1757 0 R 1765 0 R 1775 0 R 1783 0 R] >> endobj -1846 0 obj << +1797 0 obj << /Type /Pages /Count 6 -/Parent 1974 0 R -/Kids [1841 0 R 1848 0 R 1852 0 R 1860 0 R 1866 0 R 1872 0 R] +/Parent 2087 0 R +/Kids [1791 0 R 1799 0 R 1807 0 R 1816 0 R 1821 0 R 1829 0 R] >> endobj -1881 0 obj << +1841 0 obj << /Type /Pages /Count 6 -/Parent 1975 0 R -/Kids [1878 0 R 1883 0 R 1890 0 R 1895 0 R 1899 0 R 1903 0 R] +/Parent 2088 0 R +/Kids [1836 0 R 1843 0 R 1850 0 R 1858 0 R 1868 0 R 1872 0 R] >> endobj -1919 0 obj << +1879 0 obj << /Type /Pages /Count 6 -/Parent 1975 0 R -/Kids [1914 0 R 1921 0 R 1929 0 R 1933 0 R 1939 0 R 1946 0 R] +/Parent 2088 0 R +/Kids [1876 0 R 1881 0 R 1886 0 R 1890 0 R 1895 0 R 1901 0 R] >> endobj -1957 0 obj << +1916 0 obj << +/Type /Pages +/Count 6 +/Parent 2088 0 R +/Kids [1911 0 R 1918 0 R 1923 0 R 1929 0 R 1935 0 R 1939 0 R] +>> endobj +1952 0 obj << +/Type /Pages +/Count 6 +/Parent 2088 0 R +/Kids [1946 0 R 1955 0 R 1968 0 R 1974 0 R 1980 0 R 1984 0 R] +>> endobj +1994 0 obj << +/Type /Pages +/Count 6 +/Parent 2088 0 R +/Kids [1989 0 R 1996 0 R 2001 0 R 2005 0 R 2009 0 R 2020 0 R] +>> endobj +2033 0 obj << +/Type /Pages +/Count 6 +/Parent 2088 0 R +/Kids [2024 0 R 2035 0 R 2039 0 R 2044 0 R 2052 0 R 2056 0 R] +>> endobj +2067 0 obj << /Type /Pages /Count 1 -/Parent 1975 0 R -/Kids [1952 0 R] +/Parent 2089 0 R +/Kids [2062 0 R] >> endobj -1973 0 obj << +2086 0 obj << /Type /Pages /Count 36 -/Parent 1976 0 R -/Kids [941 0 R 1229 0 R 1321 0 R 1393 0 R 1484 0 R 1526 0 R] +/Parent 2090 0 R +/Kids [941 0 R 1180 0 R 1314 0 R 1354 0 R 1432 0 R 1511 0 R] >> endobj -1974 0 obj << +2087 0 obj << /Type /Pages /Count 36 -/Parent 1976 0 R -/Kids [1599 0 R 1646 0 R 1711 0 R 1766 0 R 1805 0 R 1846 0 R] +/Parent 2090 0 R +/Kids [1552 0 R 1615 0 R 1660 0 R 1698 0 R 1748 0 R 1797 0 R] >> endobj -1975 0 obj << +2088 0 obj << /Type /Pages -/Count 13 -/Parent 1976 0 R -/Kids [1881 0 R 1919 0 R 1957 0 R] +/Count 36 +/Parent 2090 0 R +/Kids [1841 0 R 1879 0 R 1916 0 R 1952 0 R 1994 0 R 2033 0 R] >> endobj -1976 0 obj << +2089 0 obj << +/Type /Pages +/Count 1 +/Parent 2090 0 R +/Kids [2067 0 R] +>> endobj +2090 0 obj << /Type /Pages -/Count 85 -/Kids [1973 0 R 1974 0 R 1975 0 R] +/Count 109 +/Kids [2086 0 R 2087 0 R 2088 0 R 2089 0 R] >> endobj -1977 0 obj << +2091 0 obj << /Type /Outlines /First 7 0 R /Last 927 0 R @@ -8547,7 +9207,7 @@ endobj 927 0 obj << /Title 928 0 R /A 925 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 915 0 R >> endobj 923 0 obj << @@ -8565,7 +9225,7 @@ endobj 915 0 obj << /Title 916 0 R /A 913 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 867 0 R /Next 927 0 R /First 919 0 R @@ -8654,7 +9314,7 @@ endobj 867 0 obj << /Title 868 0 R /A 865 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 855 0 R /Next 915 0 R /First 871 0 R @@ -8676,7 +9336,7 @@ endobj 855 0 obj << /Title 856 0 R /A 853 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 827 0 R /Next 867 0 R /First 859 0 R @@ -8728,7 +9388,7 @@ endobj 827 0 obj << /Title 828 0 R /A 825 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 811 0 R /Next 855 0 R /First 831 0 R @@ -8757,7 +9417,7 @@ endobj 811 0 obj << /Title 812 0 R /A 809 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 759 0 R /Next 827 0 R /First 815 0 R @@ -8851,7 +9511,7 @@ endobj 759 0 obj << /Title 760 0 R /A 757 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 751 0 R /Next 811 0 R /First 763 0 R @@ -8866,7 +9526,7 @@ endobj 751 0 obj << /Title 752 0 R /A 749 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 727 0 R /Next 759 0 R /First 755 0 R @@ -8909,7 +9569,7 @@ endobj 727 0 obj << /Title 728 0 R /A 725 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 259 0 R /Next 751 0 R /First 731 0 R @@ -9758,7 +10418,7 @@ endobj 259 0 obj << /Title 260 0 R /A 257 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 251 0 R /Next 727 0 R /First 263 0 R @@ -9773,7 +10433,7 @@ endobj 251 0 obj << /Title 252 0 R /A 249 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 247 0 R /Next 259 0 R /First 255 0 R @@ -9783,7 +10443,7 @@ endobj 247 0 obj << /Title 248 0 R /A 245 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 207 0 R /Next 251 0 R >> endobj @@ -9851,7 +10511,7 @@ endobj 207 0 obj << /Title 208 0 R /A 205 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 179 0 R /Next 247 0 R /First 211 0 R @@ -9903,7 +10563,7 @@ endobj 179 0 obj << /Title 180 0 R /A 177 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 87 0 R /Next 207 0 R /First 183 0 R @@ -10067,7 +10727,7 @@ endobj 87 0 obj << /Title 88 0 R /A 85 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 83 0 R /Next 179 0 R /First 91 0 R @@ -10077,7 +10737,7 @@ endobj 83 0 obj << /Title 84 0 R /A 81 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 47 0 R /Next 87 0 R >> endobj @@ -10139,7 +10799,7 @@ endobj 47 0 obj << /Title 48 0 R /A 45 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 23 0 R /Next 83 0 R /First 51 0 R @@ -10182,7 +10842,7 @@ endobj 23 0 obj << /Title 24 0 R /A 21 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Prev 7 0 R /Next 47 0 R /First 27 0 R @@ -10211,2026 +10871,2140 @@ endobj 7 0 obj << /Title 8 0 R /A 5 0 R -/Parent 1977 0 R +/Parent 2091 0 R /Next 23 0 R /First 11 0 R /Last 19 0 R /Count -3 >> endobj -1978 0 obj << -/Names [(CodingSuggestions) 1007 0 R (Doc-Start) 934 0 R (Item.1) 1295 0 R (Item.10) 1317 0 R (Item.100) 1554 0 R (Item.101) 1555 0 R (Item.102) 1556 0 R (Item.103) 1557 0 R (Item.104) 1562 0 R (Item.105) 1567 0 R (Item.106) 1568 0 R (Item.107) 1569 0 R (Item.108) 1570 0 R (Item.109) 1571 0 R (Item.11) 1318 0 R (Item.110) 1778 0 R (Item.111) 1779 0 R (Item.112) 1780 0 R (Item.113) 1781 0 R (Item.114) 1782 0 R (Item.115) 1783 0 R (Item.116) 1784 0 R (Item.117) 1785 0 R (Item.118) 1908 0 R (Item.119) 1909 0 R (Item.12) 1319 0 R (Item.120) 1910 0 R (Item.121) 1911 0 R (Item.122) 1912 0 R (Item.123) 1917 0 R (Item.124) 1918 0 R (Item.125) 1924 0 R (Item.126) 1925 0 R (Item.127) 1927 0 R (Item.128) 1936 0 R (Item.129) 1937 0 R (Item.13) 1320 0 R (Item.14) 1333 0 R (Item.15) 1338 0 R (Item.16) 1339 0 R (Item.17) 1350 0 R (Item.18) 1351 0 R (Item.19) 1352 0 R (Item.2) 1296 0 R (Item.20) 1353 0 R (Item.21) 1354 0 R (Item.22) 1355 0 R (Item.23) 1356 0 R (Item.24) 1357 0 R (Item.25) 1358 0 R (Item.26) 1363 0 R (Item.27) 1364 0 R (Item.28) 1365 0 R (Item.29) 1366 0 R (Item.3) 1297 0 R (Item.30) 1367 0 R (Item.31) 1368 0 R (Item.32) 1369 0 R (Item.33) 1370 0 R (Item.34) 1371 0 R (Item.35) 1372 0 R (Item.36) 1373 0 R (Item.37) 1374 0 R (Item.38) 1375 0 R (Item.39) 1376 0 R (Item.4) 1300 0 R (Item.40) 1377 0 R (Item.41) 1378 0 R (Item.42) 1385 0 R (Item.43) 1386 0 R (Item.44) 1387 0 R (Item.45) 1388 0 R (Item.46) 1389 0 R (Item.47) 1390 0 R (Item.48) 1391 0 R (Item.49) 1392 0 R (Item.5) 1301 0 R (Item.50) 1398 0 R (Item.51) 1399 0 R (Item.52) 1400 0 R (Item.53) 1423 0 R (Item.54) 1424 0 R (Item.55) 1425 0 R (Item.56) 1426 0 R (Item.57) 1431 0 R (Item.58) 1432 0 R (Item.59) 1433 0 R (Item.6) 1302 0 R (Item.60) 1434 0 R (Item.61) 1435 0 R (Item.62) 1436 0 R (Item.63) 1437 0 R (Item.64) 1438 0 R (Item.65) 1439 0 R (Item.66) 1440 0 R (Item.67) 1442 0 R (Item.68) 1443 0 R (Item.69) 1444 0 R (Item.7) 1303 0 R (Item.70) 1450 0 R (Item.71) 1451 0 R (Item.72) 1452 0 R (Item.73) 1453 0 R (Item.74) 1454 0 R (Item.75) 1455 0 R (Item.76) 1456 0 R (Item.77) 1457 0 R (Item.78) 1458 0 R (Item.79) 1459 0 R (Item.8) 1304 0 R (Item.80) 1465 0 R (Item.81) 1466 0 R (Item.82) 1467 0 R (Item.83) 1468 0 R (Item.84) 1469 0 R (Item.85) 1470 0 R (Item.86) 1471 0 R (Item.87) 1473 0 R (Item.88) 1474 0 R (Item.89) 1475 0 R (Item.9) 1309 0 R (Item.90) 1476 0 R (Item.91) 1489 0 R (Item.92) 1490 0 R (Item.93) 1491 0 R (Item.94) 1492 0 R (Item.95) 1536 0 R (Item.96) 1537 0 R (Item.97) 1538 0 R (Item.98) 1539 0 R (Item.99) 1540 0 R (Packaging) 1021 0 R (SMBPASSWDFILEFORMAT) 1845 0 R (architecture) 1005 0 R (chapter*.1) 1027 0 R (chapter.1) 6 0 R (chapter.10) 258 0 R (chapter.11) 726 0 R (chapter.12) 750 0 R (chapter.13) 758 0 R (chapter.14) 810 0 R (chapter.15) 826 0 R (chapter.16) 854 0 R (chapter.17) 866 0 R (chapter.18) 914 0 R (chapter.19) 926 0 R (chapter.2) 22 0 R (chapter.3) 46 0 R (chapter.4) 82 0 R (chapter.5) 86 0 R (chapter.6) 178 0 R (chapter.7) 206 0 R (chapter.8) 246 0 R (chapter.9) 250 0 R (contributing) 1022 0 R (debug) 1006 0 R (id2735718) 1316 0 R (id2735855) 1326 0 R (id2735907) 1294 0 R (id2736117) 1298 0 R (id2736155) 1299 0 R (id2736230) 1310 0 R (id2736297) 1311 0 R (id2739476) 1283 0 R (id2739563) 1284 0 R (id2739594) 1289 0 R (id2805869) 1383 0 R (id2805895) 1384 0 R (id2806295) 1331 0 R (id2806340) 1332 0 R (id2806446) 1340 0 R (id2806453) 1341 0 R (id2806472) 1342 0 R (id2806496) 1343 0 R (id2807146) 1401 0 R (id2807899) 1464 0 R (id2807992) 1472 0 R (id2808047) 1477 0 R (id2808071) 1402 0 R (id2808085) 1403 0 R (id2808098) 1404 0 R (id2808112) 1405 0 R (id2808128) 1406 0 R (id2808142) 1407 0 R (id2808156) 1408 0 R (id2808171) 1409 0 R (id2808185) 1414 0 R (id2808200) 1415 0 R (id2808214) 1416 0 R (id2808228) 1417 0 R (id2808243) 1418 0 R (id2808257) 1419 0 R (id2808272) 1420 0 R (id2808288) 1421 0 R (id2808324) 1422 0 R (id2808474) 1441 0 R (id2808560) 1449 0 R (id2809324) 1498 0 R (id2809349) 1499 0 R (id2809577) 1500 0 R (id2809614) 1505 0 R (id2809651) 1506 0 R (id2809707) 1482 0 R (id2809805) 1483 0 R (id2809876) 1493 0 R (id2810346) 1535 0 R (id2810590) 1511 0 R (id2810621) 1512 0 R (id2810646) 1513 0 R (id2810691) 1514 0 R (id2811313) 1545 0 R (id2812244) 1563 0 R (id2812278) 1564 0 R (id2812316) 1565 0 R (id2812324) 1566 0 R (id2812400) 1572 0 R (id2812408) 1573 0 R (id2812482) 1578 0 R (id2812613) 1579 0 R (id2812620) 1580 0 R (id2812632) 1581 0 R (id2812643) 1582 0 R (id2812656) 1583 0 R (id2812668) 1584 0 R (id2812763) 1585 0 R (id2812776) 1586 0 R (id2812833) 1591 0 R (id2812874) 1592 0 R (id2812902) 1593 0 R (id2812944) 1594 0 R (id2813030) 1595 0 R (id2813123) 1596 0 R (id2813150) 1597 0 R (id2813237) 1598 0 R (id2813306) 1604 0 R (id2813406) 1605 0 R (id2813484) 1606 0 R (id2813525) 1607 0 R (id2813607) 1608 0 R (id2813660) 1609 0 R (id2813830) 1614 0 R (id2813933) 1615 0 R (id2813972) 1616 0 R (id2814115) 1617 0 R (id2814228) 1618 0 R (id2814792) 1623 0 R (id2814886) 1624 0 R (id2814928) 1629 0 R (id2815097) 1630 0 R (id2815564) 1635 0 R (id2815576) 1636 0 R (id2815677) 1637 0 R (id2815868) 1642 0 R (id2816001) 1643 0 R (id2816028) 1644 0 R (id2816066) 1645 0 R (id2816207) 1651 0 R (id2816247) 1652 0 R (id2816397) 1653 0 R (id2816469) 1654 0 R (id2816549) 1655 0 R (id2816595) 1656 0 R (id2816775) 1661 0 R (id2816940) 1662 0 R (id2816953) 1663 0 R (id2817023) 1668 0 R (id2817066) 1669 0 R (id2817080) 1670 0 R (id2817119) 1671 0 R (id2817172) 1672 0 R (id2817180) 1673 0 R (id2817192) 1674 0 R (id2817263) 1675 0 R (id2817271) 1676 0 R (id2817283) 1677 0 R (id2817374) 1682 0 R (id2817381) 1683 0 R (id2817408) 1684 0 R (id2817439) 1685 0 R (id2817453) 1686 0 R (id2817552) 1687 0 R (id2817649) 1688 0 R (id2817663) 1689 0 R (id2817777) 1694 0 R (id2817874) 1695 0 R (id2818036) 1696 0 R (id2818068) 1697 0 R (id2818138) 1698 0 R (id2818170) 1703 0 R (id2818201) 1704 0 R (id2818270) 1705 0 R (id2818317) 1706 0 R (id2818357) 1707 0 R (id2818399) 1708 0 R (id2818433) 1709 0 R (id2818447) 1710 0 R (id2818474) 1716 0 R (id2818546) 1717 0 R (id2818561) 1718 0 R (id2818588) 1719 0 R (id2818637) 1720 0 R (id2818650) 1721 0 R (id2818670) 1726 0 R (id2818796) 1727 0 R (id2818917) 1728 0 R (id2818945) 1729 0 R (id2819129) 1730 0 R (id2819243) 1735 0 R (id2819288) 1736 0 R (id2819308) 1737 0 R (id2819434) 1738 0 R (id2819507) 1739 0 R (id2819521) 1740 0 R (id2819562) 1741 0 R (id2819623) 1746 0 R (id2819631) 1747 0 R (id2819794) 1748 0 R (id2819891) 1753 0 R (id2819940) 1754 0 R (id2819979) 1755 0 R (id2819987) 1756 0 R (id2820114) 1757 0 R (id2820295) 1762 0 R (id2820309) 1763 0 R (id2820357) 1764 0 R (id2820417) 1765 0 R (id2828738) 1810 0 R (id2828936) 1804 0 R (id2828976) 1771 0 R (id2828992) 1772 0 R (id2829247) 1773 0 R (id2829456) 1790 0 R (id2829469) 1791 0 R (id2830146) 1844 0 R (id2830264) 1815 0 R (id2830298) 1816 0 R (id2830366) 1817 0 R (id2830374) 1818 0 R (id2830390) 1819 0 R (id2830417) 1824 0 R (id2830439) 1825 0 R (id2830446) 1826 0 R (id2830464) 1827 0 R (id2830503) 1828 0 R (id2830593) 1833 0 R (id2831185) 1855 0 R (id2831234) 1838 0 R (id2831259) 1839 0 R (id2831852) 1869 0 R (id2831871) 1870 0 R (id2832085) 1856 0 R (id2832118) 1857 0 R (id2833060) 1858 0 R (id2833088) 1863 0 R (id2833149) 1864 0 R (id2833957) 1949 0 R (id2833990) 1950 0 R (id2834164) 1875 0 R (id2834172) 1876 0 R (id2834287) 1886 0 R (id2834358) 1887 0 R (id2834366) 1888 0 R (id2834558) 1893 0 R (id2834801) 1906 0 R (id2834809) 1907 0 R (id2835349) 1942 0 R (id2835356) 1943 0 R (id2835380) 1944 0 R (internals) 1008 0 R (modules) 1018 0 R (netbios) 1004 0 R (ntdomain) 1013 0 R (page.1) 933 0 R (page.10) 1288 0 R (page.11) 1293 0 R (page.12) 1308 0 R (page.13) 1315 0 R (page.14) 1325 0 R (page.15) 1330 0 R (page.16) 1337 0 R (page.17) 1347 0 R (page.18) 1362 0 R (page.19) 1382 0 R (page.2) 945 0 R (page.20) 1397 0 R (page.21) 1413 0 R (page.22) 1430 0 R (page.23) 1448 0 R (page.24) 1463 0 R (page.25) 1481 0 R (page.26) 1488 0 R (page.27) 1497 0 R (page.28) 1504 0 R (page.29) 1510 0 R (page.3) 962 0 R (page.30) 1518 0 R (page.31) 1522 0 R (page.32) 1530 0 R (page.33) 1534 0 R (page.34) 1544 0 R (page.35) 1561 0 R (page.36) 1577 0 R (page.37) 1590 0 R (page.38) 1603 0 R (page.39) 1613 0 R (page.4) 1026 0 R (page.40) 1622 0 R (page.41) 1628 0 R (page.42) 1634 0 R (page.43) 1641 0 R (page.44) 1650 0 R (page.45) 1660 0 R (page.46) 1667 0 R (page.47) 1681 0 R (page.48) 1693 0 R (page.49) 1702 0 R (page.5) 1071 0 R (page.50) 1715 0 R (page.51) 1725 0 R (page.52) 1734 0 R (page.53) 1745 0 R (page.54) 1752 0 R (page.55) 1761 0 R (page.56) 1770 0 R (page.57) 1777 0 R (page.58) 1789 0 R (page.59) 1795 0 R (page.6) 1125 0 R (page.60) 1799 0 R (page.61) 1803 0 R (page.62) 1809 0 R (page.63) 1814 0 R (page.64) 1823 0 R (page.65) 1832 0 R (page.66) 1837 0 R (page.67) 1843 0 R (page.68) 1850 0 R (page.69) 1854 0 R (page.7) 1178 0 R (page.70) 1862 0 R (page.71) 1868 0 R (page.72) 1874 0 R (page.73) 1880 0 R (page.74) 1885 0 R (page.75) 1892 0 R (page.76) 1897 0 R (page.77) 1901 0 R (page.78) 1905 0 R (page.79) 1916 0 R (page.8) 1233 0 R (page.80) 1923 0 R (page.81) 1931 0 R (page.82) 1935 0 R (page.83) 1941 0 R (page.84) 1948 0 R (page.85) 1954 0 R (page.9) 1282 0 R (parsing) 1009 0 R (printing) 1014 0 R (pwencrypt) 1017 0 R (rpc-plugin) 1019 0 R (sam) 1016 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.10.1) 262 0 R (section.10.2) 274 0 R (section.10.3) 418 0 R (section.10.4) 558 0 R (section.10.5) 622 0 R (section.10.6) 650 0 R (section.10.7) 678 0 R (section.10.8) 694 0 R (section.11.1) 730 0 R (section.11.2) 734 0 R (section.11.3) 738 0 R (section.11.4) 742 0 R (section.11.5) 746 0 R (section.12.1) 754 0 R (section.13.1) 762 0 R (section.13.2) 766 0 R (section.13.3) 770 0 R (section.13.4) 774 0 R (section.13.5) 790 0 R (section.13.6) 802 0 R (section.13.7) 806 0 R (section.14.1) 814 0 R (section.14.2) 818 0 R (section.14.3) 822 0 R (section.15.1) 830 0 R (section.15.2) 834 0 R (section.15.3) 846 0 R (section.16.1) 858 0 R (section.16.2) 862 0 R (section.17.1) 870 0 R (section.17.2) 882 0 R (section.17.3) 894 0 R (section.17.4) 902 0 R (section.18.1) 918 0 R (section.18.2) 922 0 R (section.2.1) 26 0 R (section.2.2) 30 0 R (section.2.3) 34 0 R (section.2.4) 38 0 R (section.2.5) 42 0 R (section.3.1) 50 0 R (section.3.2) 54 0 R (section.3.3) 58 0 R (section.3.4) 62 0 R (section.3.5) 66 0 R (section.5.1) 90 0 R (section.5.2) 94 0 R (section.5.3) 98 0 R (section.5.4) 162 0 R (section.5.5) 174 0 R (section.6.1) 182 0 R (section.6.2) 198 0 R (section.7.1) 210 0 R (section.7.2) 214 0 R (section.7.3) 218 0 R (section.7.4) 222 0 R (section.7.5) 226 0 R (section.7.6) 230 0 R (section.7.7) 234 0 R (section.7.8) 238 0 R (section.7.9) 242 0 R (section.9.1) 254 0 R (subsection.10.1.1) 266 0 R (subsection.10.1.2) 270 0 R (subsection.10.2.1) 278 0 R (subsection.10.2.2) 282 0 R (subsection.10.2.3) 294 0 R (subsection.10.3.1) 422 0 R (subsection.10.3.10) 522 0 R (subsection.10.3.11) 534 0 R (subsection.10.3.12) 546 0 R (subsection.10.3.2) 426 0 R (subsection.10.3.3) 462 0 R (subsection.10.3.4) 466 0 R (subsection.10.3.5) 470 0 R (subsection.10.3.6) 474 0 R (subsection.10.3.7) 486 0 R (subsection.10.3.8) 498 0 R (subsection.10.3.9) 510 0 R (subsection.10.4.1) 562 0 R (subsection.10.4.2) 574 0 R (subsection.10.4.3) 586 0 R (subsection.10.4.4) 598 0 R (subsection.10.4.5) 610 0 R (subsection.10.5.1) 626 0 R (subsection.10.5.2) 638 0 R (subsection.10.6.1) 654 0 R (subsection.10.6.2) 666 0 R (subsection.10.7.1) 682 0 R (subsection.10.7.2) 686 0 R (subsection.10.7.3) 690 0 R (subsection.10.8.1) 698 0 R (subsection.10.8.2) 710 0 R (subsection.13.4.1) 778 0 R (subsection.13.4.2) 782 0 R (subsection.13.4.3) 786 0 R (subsection.13.5.1) 794 0 R (subsection.13.5.2) 798 0 R (subsection.15.2.1) 838 0 R (subsection.15.2.2) 842 0 R (subsection.15.3.1) 850 0 R (subsection.17.1.1) 874 0 R (subsection.17.1.2) 878 0 R (subsection.17.2.1) 886 0 R (subsection.17.2.2) 890 0 R (subsection.17.3.1) 898 0 R (subsection.17.4.1) 906 0 R (subsection.17.4.2) 910 0 R (subsection.3.5.1) 70 0 R (subsection.3.5.2) 74 0 R (subsection.3.5.3) 78 0 R (subsection.5.3.1) 102 0 R (subsection.5.3.10) 138 0 R (subsection.5.3.11) 142 0 R (subsection.5.3.12) 146 0 R (subsection.5.3.13) 150 0 R (subsection.5.3.14) 154 0 R (subsection.5.3.15) 158 0 R (subsection.5.3.2) 106 0 R (subsection.5.3.3) 110 0 R (subsection.5.3.4) 114 0 R (subsection.5.3.5) 118 0 R (subsection.5.3.6) 122 0 R (subsection.5.3.7) 126 0 R (subsection.5.3.8) 130 0 R (subsection.5.3.9) 134 0 R (subsection.5.4.1) 166 0 R (subsection.5.4.2) 170 0 R (subsection.6.1.1) 186 0 R (subsection.6.1.2) 190 0 R (subsection.6.1.3) 194 0 R (subsection.6.2.1) 202 0 R (subsubsection.10.2.2.1) 286 0 R (subsubsection.10.2.2.2) 290 0 R (subsubsection.10.2.3.1) 298 0 R (subsubsection.10.2.3.10) 334 0 R (subsubsection.10.2.3.11) 338 0 R (subsubsection.10.2.3.12) 342 0 R (subsubsection.10.2.3.13) 346 0 R (subsubsection.10.2.3.14) 350 0 R (subsubsection.10.2.3.15) 354 0 R (subsubsection.10.2.3.16) 358 0 R (subsubsection.10.2.3.17) 362 0 R (subsubsection.10.2.3.18) 366 0 R (subsubsection.10.2.3.19) 370 0 R (subsubsection.10.2.3.2) 302 0 R (subsubsection.10.2.3.20) 374 0 R (subsubsection.10.2.3.21) 378 0 R (subsubsection.10.2.3.22) 382 0 R (subsubsection.10.2.3.23) 386 0 R (subsubsection.10.2.3.24) 390 0 R (subsubsection.10.2.3.25) 394 0 R (subsubsection.10.2.3.26) 398 0 R (subsubsection.10.2.3.27) 402 0 R (subsubsection.10.2.3.28) 406 0 R (subsubsection.10.2.3.29) 410 0 R (subsubsection.10.2.3.3) 306 0 R (subsubsection.10.2.3.30) 414 0 R (subsubsection.10.2.3.4) 310 0 R (subsubsection.10.2.3.5) 314 0 R (subsubsection.10.2.3.6) 318 0 R (subsubsection.10.2.3.7) 322 0 R (subsubsection.10.2.3.8) 326 0 R (subsubsection.10.2.3.9) 330 0 R (subsubsection.10.3.10.1) 526 0 R (subsubsection.10.3.10.2) 530 0 R (subsubsection.10.3.11.1) 538 0 R (subsubsection.10.3.11.2) 542 0 R (subsubsection.10.3.12.1) 550 0 R (subsubsection.10.3.12.2) 554 0 R (subsubsection.10.3.2.1) 430 0 R (subsubsection.10.3.2.2) 434 0 R (subsubsection.10.3.2.3) 438 0 R (subsubsection.10.3.2.4) 442 0 R (subsubsection.10.3.2.5) 446 0 R (subsubsection.10.3.2.6) 450 0 R (subsubsection.10.3.2.7) 454 0 R (subsubsection.10.3.2.8) 458 0 R (subsubsection.10.3.6.1) 478 0 R (subsubsection.10.3.6.2) 482 0 R (subsubsection.10.3.7.1) 490 0 R (subsubsection.10.3.7.2) 494 0 R (subsubsection.10.3.8.1) 502 0 R (subsubsection.10.3.8.2) 506 0 R (subsubsection.10.3.9.1) 514 0 R (subsubsection.10.3.9.2) 518 0 R (subsubsection.10.4.1.1) 566 0 R (subsubsection.10.4.1.2) 570 0 R (subsubsection.10.4.2.1) 578 0 R (subsubsection.10.4.2.2) 582 0 R (subsubsection.10.4.3.1) 590 0 R (subsubsection.10.4.3.2) 594 0 R (subsubsection.10.4.4.1) 602 0 R (subsubsection.10.4.4.2) 606 0 R (subsubsection.10.4.5.1) 614 0 R (subsubsection.10.4.5.2) 618 0 R (subsubsection.10.5.1.1) 630 0 R (subsubsection.10.5.1.2) 634 0 R (subsubsection.10.5.2.1) 642 0 R (subsubsection.10.5.2.2) 646 0 R (subsubsection.10.6.1.1) 658 0 R (subsubsection.10.6.1.2) 662 0 R (subsubsection.10.6.2.1) 670 0 R (subsubsection.10.6.2.2) 674 0 R (subsubsection.10.8.1.1) 702 0 R (subsubsection.10.8.1.2) 706 0 R (subsubsection.10.8.2.1) 714 0 R (subsubsection.10.8.2.2) 718 0 R (subsubsection.10.8.2.3) 722 0 R (tracing) 1011 0 R (unix-smb) 1010 0 R (vfs) 1020 0 R (windows-debug) 1012 0 R (wins) 1015 0 R] +2092 0 obj << +/Names [(CodingSuggestions) 983 0 R (Doc-Start) 934 0 R (Item.1) 1297 0 R (Item.10) 1324 0 R (Item.100) 1583 0 R (Item.101) 1584 0 R (Item.102) 1585 0 R (Item.103) 1586 0 R (Item.104) 1587 0 R (Item.105) 1592 0 R (Item.106) 1593 0 R (Item.107) 1598 0 R (Item.108) 1599 0 R (Item.109) 1600 0 R (Item.11) 1325 0 R (Item.110) 1853 0 R (Item.111) 1854 0 R (Item.112) 1855 0 R (Item.113) 1856 0 R (Item.114) 1861 0 R (Item.115) 1862 0 R (Item.116) 1863 0 R (Item.117) 1864 0 R (Item.118) 2014 0 R (Item.119) 2015 0 R (Item.12) 1326 0 R (Item.120) 2016 0 R (Item.121) 2017 0 R (Item.122) 2018 0 R (Item.123) 2027 0 R (Item.124) 2028 0 R (Item.125) 2029 0 R (Item.126) 2030 0 R (Item.127) 2032 0 R (Item.128) 2042 0 R (Item.129) 2047 0 R (Item.13) 1331 0 R (Item.14) 1343 0 R (Item.15) 1344 0 R (Item.16) 1345 0 R (Item.17) 1361 0 R (Item.18) 1362 0 R (Item.19) 1363 0 R (Item.2) 1298 0 R (Item.20) 1368 0 R (Item.21) 1369 0 R (Item.22) 1370 0 R (Item.23) 1371 0 R (Item.24) 1372 0 R (Item.25) 1373 0 R (Item.26) 1374 0 R (Item.27) 1375 0 R (Item.28) 1376 0 R (Item.29) 1377 0 R (Item.3) 1299 0 R (Item.30) 1378 0 R (Item.31) 1379 0 R (Item.32) 1380 0 R (Item.33) 1381 0 R (Item.34) 1382 0 R (Item.35) 1383 0 R (Item.36) 1384 0 R (Item.37) 1385 0 R (Item.38) 1386 0 R (Item.39) 1391 0 R (Item.4) 1302 0 R (Item.40) 1392 0 R (Item.41) 1393 0 R (Item.42) 1400 0 R (Item.43) 1401 0 R (Item.44) 1402 0 R (Item.45) 1403 0 R (Item.46) 1404 0 R (Item.47) 1405 0 R (Item.48) 1406 0 R (Item.49) 1411 0 R (Item.5) 1307 0 R (Item.50) 1412 0 R (Item.51) 1413 0 R (Item.52) 1414 0 R (Item.53) 1442 0 R (Item.54) 1443 0 R (Item.55) 1444 0 R (Item.56) 1445 0 R (Item.57) 1446 0 R (Item.58) 1447 0 R (Item.59) 1452 0 R (Item.6) 1308 0 R (Item.60) 1453 0 R (Item.61) 1454 0 R (Item.62) 1455 0 R (Item.63) 1456 0 R (Item.64) 1457 0 R (Item.65) 1458 0 R (Item.66) 1459 0 R (Item.67) 1461 0 R (Item.68) 1462 0 R (Item.69) 1463 0 R (Item.7) 1309 0 R (Item.70) 1469 0 R (Item.71) 1470 0 R (Item.72) 1471 0 R (Item.73) 1472 0 R (Item.74) 1473 0 R (Item.75) 1474 0 R (Item.76) 1475 0 R (Item.77) 1476 0 R (Item.78) 1477 0 R (Item.79) 1478 0 R (Item.8) 1310 0 R (Item.80) 1484 0 R (Item.81) 1485 0 R (Item.82) 1486 0 R (Item.83) 1487 0 R (Item.84) 1488 0 R (Item.85) 1489 0 R (Item.86) 1490 0 R (Item.87) 1492 0 R (Item.88) 1493 0 R (Item.89) 1494 0 R (Item.9) 1311 0 R (Item.90) 1495 0 R (Item.91) 1507 0 R (Item.92) 1508 0 R (Item.93) 1509 0 R (Item.94) 1510 0 R (Item.95) 1562 0 R (Item.96) 1563 0 R (Item.97) 1564 0 R (Item.98) 1565 0 R (Item.99) 1566 0 R (Packaging) 1023 0 R (SMBPASSWDFILEFORMAT) 1933 0 R (architecture) 981 0 R (chapter*.1) 963 0 R (chapter*.2) 1029 0 R (chapter.1) 6 0 R (chapter.10) 258 0 R (chapter.11) 726 0 R (chapter.12) 750 0 R (chapter.13) 758 0 R (chapter.14) 810 0 R (chapter.15) 826 0 R (chapter.16) 854 0 R (chapter.17) 866 0 R (chapter.18) 914 0 R (chapter.19) 926 0 R (chapter.2) 22 0 R (chapter.3) 46 0 R (chapter.4) 82 0 R (chapter.5) 86 0 R (chapter.6) 178 0 R (chapter.7) 206 0 R (chapter.8) 246 0 R (chapter.9) 250 0 R (contributing) 1024 0 R (debug) 982 0 R (id2722648) 1285 0 R (id2722732) 1290 0 R (id2722763) 1291 0 R (id2722878) 1296 0 R (id2722932) 1300 0 R (id2722970) 1301 0 R (id2723044) 1312 0 R (id2723106) 1313 0 R (id2723191) 1323 0 R (id2725185) 1332 0 R (id2725315) 1337 0 R (id2725362) 1342 0 R (id2725474) 1350 0 R (id2725480) 1351 0 R (id2725500) 1352 0 R (id2725523) 1353 0 R (id2725986) 1398 0 R (id2726011) 1399 0 R (id2726171) 1415 0 R (id2726185) 1416 0 R (id2726199) 1417 0 R (id2726212) 1418 0 R (id2726225) 1423 0 R (id2726244) 1424 0 R (id2726258) 1425 0 R (id2726273) 1426 0 R (id2726287) 1427 0 R (id2726302) 1428 0 R (id2726316) 1429 0 R (id2726330) 1430 0 R (id2791658) 1431 0 R (id2791671) 1437 0 R (id2791685) 1438 0 R (id2791702) 1439 0 R (id2791718) 1440 0 R (id2791755) 1441 0 R (id2791906) 1460 0 R (id2792005) 1468 0 R (id2792126) 1483 0 R (id2792216) 1491 0 R (id2792273) 1500 0 R (id2792338) 1501 0 R (id2792434) 1506 0 R (id2792506) 1516 0 R (id2792555) 1521 0 R (id2792580) 1522 0 R (id2792665) 1527 0 R (id2792716) 1528 0 R (id2792777) 1529 0 R (id2792846) 1534 0 R (id2792888) 1535 0 R (id2792916) 1536 0 R (id2792961) 1541 0 R (id2793387) 1561 0 R (id2793528) 1571 0 R (id2793730) 1588 0 R (id2793766) 1589 0 R (id2793803) 1590 0 R (id2793811) 1591 0 R (id2793894) 1601 0 R (id2793901) 1602 0 R (id2793976) 1603 0 R (id2794107) 1608 0 R (id2794114) 1609 0 R (id2794126) 1610 0 R (id2794137) 1611 0 R (id2794150) 1612 0 R (id2794162) 1613 0 R (id2794256) 1614 0 R (id2794269) 1620 0 R (id2794326) 1621 0 R (id2794368) 1622 0 R (id2794395) 1623 0 R (id2794438) 1624 0 R (id2794523) 1625 0 R (id2794617) 1630 0 R (id2794644) 1631 0 R (id2794730) 1632 0 R (id2794800) 1633 0 R (id2794900) 1638 0 R (id2794977) 1639 0 R (id2795018) 1640 0 R (id2795100) 1641 0 R (id2795153) 1646 0 R (id2795323) 1647 0 R (id2795428) 1652 0 R (id2795465) 1653 0 R (id2795609) 1654 0 R (id2795721) 1659 0 R (id2796285) 1665 0 R (id2796380) 1666 0 R (id2796422) 1671 0 R (id2796591) 1672 0 R (id2797058) 1677 0 R (id2797071) 1682 0 R (id2797176) 1683 0 R (id2797365) 1688 0 R (id2797500) 1689 0 R (id2797527) 1694 0 R (id2797565) 1695 0 R (id2797708) 1696 0 R (id2797748) 1697 0 R (id2797898) 1703 0 R (id2797970) 1704 0 R (id2798050) 1705 0 R (id2798096) 1710 0 R (id2798284) 1711 0 R (id2798451) 1716 0 R (id2798465) 1717 0 R (id2798535) 1718 0 R (id2798577) 1723 0 R (id2798591) 1724 0 R (id2798630) 1725 0 R (id2798685) 1726 0 R (id2798693) 1727 0 R (id2798705) 1728 0 R (id2798776) 1733 0 R (id2798783) 1734 0 R (id2798796) 1735 0 R (id2798888) 1736 0 R (id2798895) 1737 0 R (id2798921) 1738 0 R (id2798953) 1739 0 R (id2798966) 1740 0 R (id2799065) 1745 0 R (id2799163) 1746 0 R (id2799177) 1747 0 R (id2799290) 1753 0 R (id2799388) 1754 0 R (id2799551) 1755 0 R (id2799583) 1760 0 R (id2799653) 1761 0 R (id2799686) 1762 0 R (id2799716) 1763 0 R (id2799785) 1768 0 R (id2799833) 1769 0 R (id2799872) 1770 0 R (id2799914) 1771 0 R (id2799948) 1772 0 R (id2799962) 1773 0 R (id2799990) 1778 0 R (id2800051) 1779 0 R (id2800066) 1780 0 R (id2800094) 1781 0 R (id2800144) 1786 0 R (id2800156) 1787 0 R (id2800176) 1788 0 R (id2800302) 1789 0 R (id2800423) 1794 0 R (id2800451) 1795 0 R (id2800634) 1796 0 R (id2800748) 1802 0 R (id2800794) 1803 0 R (id2800814) 1804 0 R (id2800940) 1805 0 R (id2801013) 1810 0 R (id2801026) 1811 0 R (id2801068) 1812 0 R (id2801129) 1813 0 R (id2801137) 1814 0 R (id2801299) 1819 0 R (id2801398) 1824 0 R (id2801445) 1825 0 R (id2801485) 1826 0 R (id2801492) 1827 0 R (id2801619) 1832 0 R (id2801800) 1833 0 R (id2801815) 1834 0 R (id2801863) 1839 0 R (id2801922) 1840 0 R (id2802085) 1846 0 R (id2802101) 1847 0 R (id2802197) 1848 0 R (id2802419) 1865 0 R (id2802432) 1866 0 R (id2802814) 1884 0 R (id2802970) 1893 0 R (id2803100) 1898 0 R (id2803127) 1899 0 R (id2803196) 1904 0 R (id2803203) 1905 0 R (id2803219) 1906 0 R (id2803247) 1907 0 R (id2803269) 1908 0 R (id2803276) 1909 0 R (id2803294) 1914 0 R (id2803323) 1915 0 R (id2803423) 1921 0 R (id2803560) 1926 0 R (id2803580) 1927 0 R (id2803709) 1932 0 R (id2804076) 1942 0 R (id2804124) 1943 0 R (id2804158) 1944 0 R (id2804199) 1949 0 R (id2804227) 1950 0 R (id2804291) 1951 0 R (id2804486) 1971 0 R (id2804504) 1972 0 R (id2804713) 1977 0 R (id2804721) 1978 0 R (id2804836) 1987 0 R (id2804907) 1992 0 R (id2804915) 1993 0 R (id2805108) 1999 0 R (id2805352) 2012 0 R (id2805360) 2013 0 R (id2805888) 2048 0 R (id2805896) 2049 0 R (id2805919) 2050 0 R (id2805989) 2059 0 R (id2806022) 2060 0 R (internals) 984 0 R (modules) 1020 0 R (netbios) 980 0 R (ntdomain) 1015 0 R (page.1) 933 0 R (page.10) 1284 0 R (page.100) 2007 0 R (page.101) 2011 0 R (page.102) 2022 0 R (page.103) 2026 0 R (page.104) 2037 0 R (page.105) 2041 0 R (page.106) 2046 0 R (page.107) 2054 0 R (page.108) 2058 0 R (page.109) 2064 0 R (page.11) 1289 0 R (page.12) 1295 0 R (page.13) 1306 0 R (page.14) 1318 0 R (page.15) 1322 0 R (page.16) 1330 0 R (page.17) 1336 0 R (page.18) 1341 0 R (page.19) 1349 0 R (page.2) 945 0 R (page.20) 1358 0 R (page.21) 1367 0 R (page.22) 1390 0 R (page.23) 1397 0 R (page.24) 1410 0 R (page.25) 1422 0 R (page.26) 1436 0 R (page.27) 1451 0 R (page.28) 1467 0 R (page.29) 1482 0 R (page.3) 962 0 R (page.30) 1499 0 R (page.31) 1505 0 R (page.32) 1515 0 R (page.33) 1520 0 R (page.34) 1526 0 R (page.35) 1533 0 R (page.36) 1540 0 R (page.37) 1545 0 R (page.38) 1556 0 R (page.39) 1560 0 R (page.4) 992 0 R (page.40) 1570 0 R (page.41) 1582 0 R (page.42) 1597 0 R (page.43) 1607 0 R (page.44) 1619 0 R (page.45) 1629 0 R (page.46) 1637 0 R (page.47) 1645 0 R (page.48) 1651 0 R (page.49) 1658 0 R (page.5) 1028 0 R (page.50) 1664 0 R (page.51) 1670 0 R (page.52) 1676 0 R (page.53) 1681 0 R (page.54) 1687 0 R (page.55) 1693 0 R (page.56) 1702 0 R (page.57) 1709 0 R (page.58) 1715 0 R (page.59) 1722 0 R (page.6) 1072 0 R (page.60) 1732 0 R (page.61) 1744 0 R (page.62) 1752 0 R (page.63) 1759 0 R (page.64) 1767 0 R (page.65) 1777 0 R (page.66) 1785 0 R (page.67) 1793 0 R (page.68) 1801 0 R (page.69) 1809 0 R (page.7) 1127 0 R (page.70) 1818 0 R (page.71) 1823 0 R (page.72) 1831 0 R (page.73) 1838 0 R (page.74) 1845 0 R (page.75) 1852 0 R (page.76) 1860 0 R (page.77) 1870 0 R (page.78) 1874 0 R (page.79) 1878 0 R (page.8) 1184 0 R (page.80) 1883 0 R (page.81) 1888 0 R (page.82) 1892 0 R (page.83) 1897 0 R (page.84) 1903 0 R (page.85) 1913 0 R (page.86) 1920 0 R (page.87) 1925 0 R (page.88) 1931 0 R (page.89) 1937 0 R (page.9) 1237 0 R (page.90) 1941 0 R (page.91) 1948 0 R (page.92) 1957 0 R (page.93) 1970 0 R (page.94) 1976 0 R (page.95) 1982 0 R (page.96) 1986 0 R (page.97) 1991 0 R (page.98) 1998 0 R (page.99) 2003 0 R (parsing) 985 0 R (printing) 1016 0 R (pwencrypt) 1019 0 R (rpc-plugin) 1021 0 R (sam) 1018 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.10.1) 262 0 R (section.10.2) 274 0 R (section.10.3) 418 0 R (section.10.4) 558 0 R (section.10.5) 622 0 R (section.10.6) 650 0 R (section.10.7) 678 0 R (section.10.8) 694 0 R (section.11.1) 730 0 R (section.11.2) 734 0 R (section.11.3) 738 0 R (section.11.4) 742 0 R (section.11.5) 746 0 R (section.12.1) 754 0 R (section.13.1) 762 0 R (section.13.2) 766 0 R (section.13.3) 770 0 R (section.13.4) 774 0 R (section.13.5) 790 0 R (section.13.6) 802 0 R (section.13.7) 806 0 R (section.14.1) 814 0 R (section.14.2) 818 0 R (section.14.3) 822 0 R (section.15.1) 830 0 R (section.15.2) 834 0 R (section.15.3) 846 0 R (section.16.1) 858 0 R (section.16.2) 862 0 R (section.17.1) 870 0 R (section.17.2) 882 0 R (section.17.3) 894 0 R (section.17.4) 902 0 R (section.18.1) 918 0 R (section.18.2) 922 0 R (section.2.1) 26 0 R (section.2.2) 30 0 R (section.2.3) 34 0 R (section.2.4) 38 0 R (section.2.5) 42 0 R (section.3.1) 50 0 R (section.3.2) 54 0 R (section.3.3) 58 0 R (section.3.4) 62 0 R (section.3.5) 66 0 R (section.5.1) 90 0 R (section.5.2) 94 0 R (section.5.3) 98 0 R (section.5.4) 162 0 R (section.5.5) 174 0 R (section.6.1) 182 0 R (section.6.2) 198 0 R (section.7.1) 210 0 R (section.7.2) 214 0 R (section.7.3) 218 0 R (section.7.4) 222 0 R (section.7.5) 226 0 R (section.7.6) 230 0 R (section.7.7) 234 0 R (section.7.8) 238 0 R (section.7.9) 242 0 R (section.9.1) 254 0 R (subsection.10.1.1) 266 0 R (subsection.10.1.2) 270 0 R (subsection.10.2.1) 278 0 R (subsection.10.2.2) 282 0 R (subsection.10.2.3) 294 0 R (subsection.10.3.1) 422 0 R (subsection.10.3.10) 522 0 R (subsection.10.3.11) 534 0 R (subsection.10.3.12) 546 0 R (subsection.10.3.2) 426 0 R (subsection.10.3.3) 462 0 R (subsection.10.3.4) 466 0 R (subsection.10.3.5) 470 0 R (subsection.10.3.6) 474 0 R (subsection.10.3.7) 486 0 R (subsection.10.3.8) 498 0 R (subsection.10.3.9) 510 0 R (subsection.10.4.1) 562 0 R (subsection.10.4.2) 574 0 R (subsection.10.4.3) 586 0 R (subsection.10.4.4) 598 0 R (subsection.10.4.5) 610 0 R (subsection.10.5.1) 626 0 R (subsection.10.5.2) 638 0 R (subsection.10.6.1) 654 0 R (subsection.10.6.2) 666 0 R (subsection.10.7.1) 682 0 R (subsection.10.7.2) 686 0 R (subsection.10.7.3) 690 0 R (subsection.10.8.1) 698 0 R (subsection.10.8.2) 710 0 R (subsection.13.4.1) 778 0 R (subsection.13.4.2) 782 0 R (subsection.13.4.3) 786 0 R (subsection.13.5.1) 794 0 R (subsection.13.5.2) 798 0 R (subsection.15.2.1) 838 0 R (subsection.15.2.2) 842 0 R (subsection.15.3.1) 850 0 R (subsection.17.1.1) 874 0 R (subsection.17.1.2) 878 0 R (subsection.17.2.1) 886 0 R (subsection.17.2.2) 890 0 R (subsection.17.3.1) 898 0 R (subsection.17.4.1) 906 0 R (subsection.17.4.2) 910 0 R (subsection.3.5.1) 70 0 R (subsection.3.5.2) 74 0 R (subsection.3.5.3) 78 0 R (subsection.5.3.1) 102 0 R (subsection.5.3.10) 138 0 R (subsection.5.3.11) 142 0 R (subsection.5.3.12) 146 0 R (subsection.5.3.13) 150 0 R (subsection.5.3.14) 154 0 R (subsection.5.3.15) 158 0 R (subsection.5.3.2) 106 0 R (subsection.5.3.3) 110 0 R (subsection.5.3.4) 114 0 R (subsection.5.3.5) 118 0 R (subsection.5.3.6) 122 0 R (subsection.5.3.7) 126 0 R (subsection.5.3.8) 130 0 R (subsection.5.3.9) 134 0 R (subsection.5.4.1) 166 0 R (subsection.5.4.2) 170 0 R (subsection.6.1.1) 186 0 R (subsection.6.1.2) 190 0 R (subsection.6.1.3) 194 0 R (subsection.6.2.1) 202 0 R (subsubsection.10.2.2.1) 286 0 R (subsubsection.10.2.2.2) 290 0 R (subsubsection.10.2.3.1) 298 0 R (subsubsection.10.2.3.10) 334 0 R (subsubsection.10.2.3.11) 338 0 R (subsubsection.10.2.3.12) 342 0 R (subsubsection.10.2.3.13) 346 0 R (subsubsection.10.2.3.14) 350 0 R (subsubsection.10.2.3.15) 354 0 R (subsubsection.10.2.3.16) 358 0 R (subsubsection.10.2.3.17) 362 0 R (subsubsection.10.2.3.18) 366 0 R (subsubsection.10.2.3.19) 370 0 R (subsubsection.10.2.3.2) 302 0 R (subsubsection.10.2.3.20) 374 0 R (subsubsection.10.2.3.21) 378 0 R (subsubsection.10.2.3.22) 382 0 R (subsubsection.10.2.3.23) 386 0 R (subsubsection.10.2.3.24) 390 0 R (subsubsection.10.2.3.25) 394 0 R (subsubsection.10.2.3.26) 398 0 R (subsubsection.10.2.3.27) 402 0 R (subsubsection.10.2.3.28) 406 0 R (subsubsection.10.2.3.29) 410 0 R (subsubsection.10.2.3.3) 306 0 R (subsubsection.10.2.3.30) 414 0 R (subsubsection.10.2.3.4) 310 0 R (subsubsection.10.2.3.5) 314 0 R (subsubsection.10.2.3.6) 318 0 R (subsubsection.10.2.3.7) 322 0 R (subsubsection.10.2.3.8) 326 0 R (subsubsection.10.2.3.9) 330 0 R (subsubsection.10.3.10.1) 526 0 R (subsubsection.10.3.10.2) 530 0 R (subsubsection.10.3.11.1) 538 0 R (subsubsection.10.3.11.2) 542 0 R (subsubsection.10.3.12.1) 550 0 R (subsubsection.10.3.12.2) 554 0 R (subsubsection.10.3.2.1) 430 0 R (subsubsection.10.3.2.2) 434 0 R (subsubsection.10.3.2.3) 438 0 R (subsubsection.10.3.2.4) 442 0 R (subsubsection.10.3.2.5) 446 0 R (subsubsection.10.3.2.6) 450 0 R (subsubsection.10.3.2.7) 454 0 R (subsubsection.10.3.2.8) 458 0 R (subsubsection.10.3.6.1) 478 0 R (subsubsection.10.3.6.2) 482 0 R (subsubsection.10.3.7.1) 490 0 R (subsubsection.10.3.7.2) 494 0 R (subsubsection.10.3.8.1) 502 0 R (subsubsection.10.3.8.2) 506 0 R (subsubsection.10.3.9.1) 514 0 R (subsubsection.10.3.9.2) 518 0 R (subsubsection.10.4.1.1) 566 0 R (subsubsection.10.4.1.2) 570 0 R (subsubsection.10.4.2.1) 578 0 R (subsubsection.10.4.2.2) 582 0 R (subsubsection.10.4.3.1) 590 0 R (subsubsection.10.4.3.2) 594 0 R (subsubsection.10.4.4.1) 602 0 R (subsubsection.10.4.4.2) 606 0 R (subsubsection.10.4.5.1) 614 0 R (subsubsection.10.4.5.2) 618 0 R (subsubsection.10.5.1.1) 630 0 R (subsubsection.10.5.1.2) 634 0 R (subsubsection.10.5.2.1) 642 0 R (subsubsection.10.5.2.2) 646 0 R (subsubsection.10.6.1.1) 658 0 R (subsubsection.10.6.1.2) 662 0 R (subsubsection.10.6.2.1) 670 0 R (subsubsection.10.6.2.2) 674 0 R (subsubsection.10.8.1.1) 702 0 R (subsubsection.10.8.1.2) 706 0 R (subsubsection.10.8.2.1) 714 0 R (subsubsection.10.8.2.2) 718 0 R (subsubsection.10.8.2.3) 722 0 R (tracing) 987 0 R (unix-smb) 986 0 R (vfs) 1022 0 R (windows-debug) 988 0 R (wins) 1017 0 R] /Limits [(CodingSuggestions) (wins)] >> endobj -1979 0 obj << -/Kids [1978 0 R] +2093 0 obj << +/Kids [2092 0 R] >> endobj -1980 0 obj << -/Dests 1979 0 R +2094 0 obj << +/Dests 2093 0 R >> endobj -1981 0 obj << +2095 0 obj << /Type /Catalog -/Pages 1976 0 R -/Outlines 1977 0 R -/Names 1980 0 R +/Pages 2090 0 R +/Outlines 2091 0 R +/Names 2094 0 R /PageMode /UseOutlines /URI<> /ViewerPreferences<<>> /OpenAction 929 0 R /PTEX.Fullbanner (This is pdfTeX, Version 3.14159-1.10b) >> endobj -1982 0 obj << +2096 0 obj << /Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfTeX-1.10b)/Keywords() -/CreationDate (D:20030701232600) +/CreationDate (D:20030815195700) >> endobj xref -0 1983 +0 2097 0000000001 65535 f 0000000002 00000 f 0000000003 00000 f 0000000004 00000 f 0000000000 00000 f 0000000009 00000 n -0000093861 00000 n -0000481071 00000 n +0000093786 00000 n +0000506737 00000 n 0000000054 00000 n 0000000130 00000 n -0000093984 00000 n -0000480999 00000 n +0000093908 00000 n +0000506665 00000 n 0000000177 00000 n 0000000207 00000 n -0000094108 00000 n -0000480913 00000 n +0000097771 00000 n +0000506579 00000 n 0000000255 00000 n 0000000295 00000 n -0000097715 00000 n -0000480840 00000 n +0000097895 00000 n +0000506506 00000 n 0000000343 00000 n 0000000378 00000 n -0000101373 00000 n -0000480715 00000 n +0000100636 00000 n +0000506381 00000 n 0000000424 00000 n 0000000463 00000 n -0000101497 00000 n -0000480641 00000 n +0000100759 00000 n +0000506307 00000 n 0000000511 00000 n 0000000546 00000 n -0000101809 00000 n -0000480554 00000 n +0000101070 00000 n +0000506220 00000 n 0000000594 00000 n 0000000641 00000 n -0000101932 00000 n -0000480467 00000 n +0000101193 00000 n +0000506133 00000 n 0000000689 00000 n 0000000726 00000 n -0000106004 00000 n -0000480380 00000 n +0000105359 00000 n +0000506046 00000 n 0000000774 00000 n 0000000811 00000 n -0000106127 00000 n -0000480306 00000 n +0000105483 00000 n +0000505972 00000 n 0000000859 00000 n 0000000893 00000 n -0000108825 00000 n -0000480180 00000 n +0000109099 00000 n +0000505846 00000 n 0000000939 00000 n 0000000982 00000 n -0000108949 00000 n -0000480106 00000 n +0000109222 00000 n +0000505772 00000 n 0000001030 00000 n 0000001070 00000 n -0000111717 00000 n -0000480019 00000 n +0000111680 00000 n +0000505685 00000 n 0000001118 00000 n 0000001160 00000 n -0000114029 00000 n -0000479932 00000 n +0000113885 00000 n +0000505598 00000 n 0000001208 00000 n 0000001253 00000 n -0000114153 00000 n -0000479845 00000 n +0000115960 00000 n +0000505511 00000 n 0000001301 00000 n 0000001346 00000 n -0000116874 00000 n -0000479734 00000 n +0000118405 00000 n +0000505400 00000 n 0000001394 00000 n 0000001430 00000 n -0000116997 00000 n -0000479660 00000 n +0000118529 00000 n +0000505326 00000 n 0000001483 00000 n 0000001519 00000 n -0000117121 00000 n -0000479573 00000 n +0000118652 00000 n +0000505239 00000 n 0000001572 00000 n 0000001607 00000 n -0000117244 00000 n -0000479499 00000 n +0000118776 00000 n +0000505165 00000 n 0000001660 00000 n 0000001712 00000 n -0000121870 00000 n -0000479410 00000 n +0000122364 00000 n +0000505076 00000 n 0000001758 00000 n 0000001797 00000 n -0000131620 00000 n -0000479282 00000 n +0000132483 00000 n +0000504948 00000 n 0000001843 00000 n 0000001879 00000 n -0000131744 00000 n -0000479208 00000 n +0000132606 00000 n +0000504874 00000 n 0000001927 00000 n 0000001968 00000 n -0000131867 00000 n -0000479121 00000 n +0000132730 00000 n +0000504787 00000 n 0000002016 00000 n 0000002056 00000 n -0000135341 00000 n -0000478992 00000 n +0000136814 00000 n +0000504658 00000 n 0000002104 00000 n 0000002149 00000 n -0000135464 00000 n -0000478914 00000 n +0000136938 00000 n +0000504580 00000 n 0000002203 00000 n 0000002244 00000 n -0000135588 00000 n -0000478822 00000 n +0000137063 00000 n +0000504488 00000 n 0000002298 00000 n 0000002339 00000 n -0000135713 00000 n -0000478730 00000 n +0000137188 00000 n +0000504396 00000 n 0000002393 00000 n 0000002439 00000 n -0000135837 00000 n -0000478638 00000 n +0000139086 00000 n +0000504304 00000 n 0000002493 00000 n 0000002534 00000 n -0000135962 00000 n -0000478546 00000 n +0000139210 00000 n +0000504212 00000 n 0000002588 00000 n 0000002629 00000 n -0000136087 00000 n -0000478454 00000 n +0000139335 00000 n +0000504120 00000 n 0000002683 00000 n 0000002725 00000 n -0000136212 00000 n -0000478362 00000 n +0000139460 00000 n +0000504028 00000 n 0000002779 00000 n 0000002821 00000 n -0000136336 00000 n -0000478270 00000 n +0000139585 00000 n +0000503936 00000 n 0000002875 00000 n 0000002921 00000 n -0000138977 00000 n -0000478178 00000 n +0000139710 00000 n +0000503844 00000 n 0000002975 00000 n 0000003021 00000 n -0000139101 00000 n -0000478086 00000 n +0000139835 00000 n +0000503752 00000 n 0000003076 00000 n 0000003124 00000 n -0000139226 00000 n -0000477994 00000 n +0000139958 00000 n +0000503660 00000 n 0000003179 00000 n 0000003227 00000 n -0000139351 00000 n -0000477902 00000 n +0000140083 00000 n +0000503568 00000 n 0000003282 00000 n 0000003325 00000 n -0000139474 00000 n -0000477810 00000 n +0000142279 00000 n +0000503476 00000 n 0000003380 00000 n 0000003423 00000 n -0000139599 00000 n -0000477718 00000 n +0000142403 00000 n +0000503384 00000 n 0000003478 00000 n 0000003526 00000 n -0000139724 00000 n -0000477640 00000 n +0000142528 00000 n +0000503306 00000 n 0000003581 00000 n 0000003629 00000 n -0000139848 00000 n -0000477510 00000 n +0000142652 00000 n +0000503176 00000 n 0000003678 00000 n 0000003723 00000 n -0000139973 00000 n -0000477431 00000 n +0000142777 00000 n +0000503097 00000 n 0000003777 00000 n 0000003813 00000 n -0000145052 00000 n -0000477352 00000 n +0000147171 00000 n +0000503018 00000 n 0000003867 00000 n 0000003905 00000 n -0000146948 00000 n -0000477274 00000 n +0000149758 00000 n +0000502940 00000 n 0000003954 00000 n 0000003998 00000 n -0000150637 00000 n -0000477142 00000 n +0000152896 00000 n +0000502808 00000 n 0000004045 00000 n 0000004084 00000 n -0000150762 00000 n -0000477024 00000 n +0000153020 00000 n +0000502690 00000 n 0000004133 00000 n 0000004173 00000 n -0000151328 00000 n -0000476945 00000 n +0000153584 00000 n +0000502611 00000 n 0000004227 00000 n 0000004275 00000 n -0000151704 00000 n -0000476852 00000 n +0000155862 00000 n +0000502518 00000 n 0000004329 00000 n 0000004384 00000 n -0000153670 00000 n -0000476773 00000 n +0000155987 00000 n +0000502439 00000 n 0000004438 00000 n 0000004488 00000 n -0000153795 00000 n -0000476655 00000 n +0000157934 00000 n +0000502321 00000 n 0000004537 00000 n 0000004567 00000 n -0000155916 00000 n -0000476590 00000 n +0000159263 00000 n +0000502256 00000 n 0000004621 00000 n 0000004661 00000 n -0000159458 00000 n -0000476457 00000 n +0000162250 00000 n +0000502123 00000 n 0000004708 00000 n 0000004753 00000 n -0000159583 00000 n -0000476378 00000 n +0000162374 00000 n +0000502044 00000 n 0000004802 00000 n 0000004838 00000 n -0000159708 00000 n -0000476285 00000 n +0000162499 00000 n +0000501951 00000 n 0000004887 00000 n 0000004920 00000 n -0000159833 00000 n -0000476192 00000 n +0000165910 00000 n +0000501858 00000 n 0000004969 00000 n 0000005007 00000 n -0000163657 00000 n -0000476099 00000 n +0000166035 00000 n +0000501765 00000 n 0000005056 00000 n 0000005089 00000 n -0000163782 00000 n -0000476006 00000 n +0000166160 00000 n +0000501672 00000 n 0000005138 00000 n 0000005169 00000 n -0000167936 00000 n -0000475913 00000 n +0000169734 00000 n +0000501579 00000 n 0000005218 00000 n 0000005252 00000 n -0000168061 00000 n -0000475820 00000 n +0000169859 00000 n +0000501486 00000 n 0000005301 00000 n 0000005338 00000 n -0000168186 00000 n -0000475727 00000 n +0000169983 00000 n +0000501393 00000 n 0000005387 00000 n 0000005423 00000 n -0000168311 00000 n -0000475648 00000 n +0000173847 00000 n +0000501314 00000 n 0000005472 00000 n 0000005515 00000 n -0000174329 00000 n -0000475554 00000 n +0000176927 00000 n +0000501220 00000 n 0000005562 00000 n 0000005610 00000 n -0000177167 00000 n -0000475421 00000 n +0000180351 00000 n +0000501087 00000 n 0000005657 00000 n 0000005716 00000 n -0000177292 00000 n -0000475356 00000 n +0000180475 00000 n +0000501022 00000 n 0000005765 00000 n 0000005814 00000 n -0000183266 00000 n -0000475223 00000 n +0000185389 00000 n +0000500889 00000 n 0000005862 00000 n 0000005900 00000 n -0000183391 00000 n -0000475105 00000 n +0000185514 00000 n +0000500771 00000 n 0000005950 00000 n 0000005987 00000 n -0000187432 00000 n -0000475026 00000 n +0000188777 00000 n +0000500692 00000 n 0000006042 00000 n 0000006076 00000 n -0000187557 00000 n -0000474947 00000 n +0000188902 00000 n +0000500613 00000 n 0000006131 00000 n 0000006165 00000 n -0000187682 00000 n -0000474815 00000 n +0000189027 00000 n +0000500481 00000 n 0000006215 00000 n 0000006260 00000 n -0000187807 00000 n -0000474736 00000 n +0000189151 00000 n +0000500402 00000 n 0000006315 00000 n 0000006347 00000 n -0000188245 00000 n -0000474604 00000 n +0000192362 00000 n +0000500270 00000 n 0000006402 00000 n 0000006441 00000 n -0000188368 00000 n -0000474525 00000 n +0000192486 00000 n +0000500191 00000 n 0000006501 00000 n 0000006547 00000 n -0000191169 00000 n -0000474446 00000 n +0000192610 00000 n +0000500112 00000 n 0000006607 00000 n 0000006653 00000 n -0000191294 00000 n -0000474327 00000 n +0000194584 00000 n +0000499993 00000 n 0000006708 00000 n 0000006745 00000 n -0000191417 00000 n -0000474248 00000 n +0000194709 00000 n +0000499914 00000 n 0000006805 00000 n 0000006840 00000 n -0000191542 00000 n -0000474155 00000 n +0000194834 00000 n +0000499821 00000 n 0000006900 00000 n 0000006933 00000 n -0000191667 00000 n -0000474062 00000 n +0000194959 00000 n +0000499728 00000 n 0000006993 00000 n 0000007027 00000 n -0000191792 00000 n -0000473969 00000 n +0000195083 00000 n +0000499635 00000 n 0000007087 00000 n 0000007122 00000 n -0000191917 00000 n -0000473876 00000 n +0000195206 00000 n +0000499542 00000 n 0000007182 00000 n 0000007246 00000 n -0000192040 00000 n -0000473783 00000 n +0000195331 00000 n +0000499449 00000 n 0000007306 00000 n 0000007349 00000 n -0000192164 00000 n -0000473690 00000 n +0000197289 00000 n +0000499356 00000 n 0000007409 00000 n 0000007470 00000 n -0000195297 00000 n -0000473597 00000 n +0000197414 00000 n +0000499263 00000 n 0000007530 00000 n 0000007612 00000 n -0000195422 00000 n -0000473504 00000 n +0000197539 00000 n +0000499170 00000 n 0000007672 00000 n 0000007726 00000 n -0000195547 00000 n -0000473411 00000 n +0000197664 00000 n +0000499077 00000 n 0000007787 00000 n 0000007857 00000 n -0000195672 00000 n -0000473318 00000 n +0000197789 00000 n +0000498984 00000 n 0000007918 00000 n 0000007982 00000 n -0000195796 00000 n -0000473225 00000 n +0000197914 00000 n +0000498891 00000 n 0000008043 00000 n 0000008106 00000 n -0000195921 00000 n -0000473132 00000 n +0000200428 00000 n +0000498798 00000 n 0000008167 00000 n 0000008229 00000 n -0000196046 00000 n -0000473039 00000 n +0000200553 00000 n +0000498705 00000 n 0000008290 00000 n 0000008380 00000 n -0000196171 00000 n -0000472946 00000 n +0000200677 00000 n +0000498612 00000 n 0000008441 00000 n 0000008506 00000 n -0000199633 00000 n -0000472853 00000 n +0000200802 00000 n +0000498519 00000 n 0000008567 00000 n 0000008646 00000 n -0000199758 00000 n -0000472760 00000 n +0000203276 00000 n +0000498426 00000 n 0000008707 00000 n 0000008783 00000 n -0000199882 00000 n -0000472667 00000 n +0000203401 00000 n +0000498333 00000 n 0000008844 00000 n 0000008908 00000 n -0000200007 00000 n -0000472574 00000 n +0000203526 00000 n +0000498240 00000 n 0000008969 00000 n 0000009061 00000 n -0000200132 00000 n -0000472481 00000 n +0000203649 00000 n +0000498147 00000 n 0000009122 00000 n 0000009222 00000 n -0000200257 00000 n -0000472388 00000 n +0000206167 00000 n +0000498054 00000 n 0000009283 00000 n 0000009364 00000 n -0000203493 00000 n -0000472295 00000 n +0000206292 00000 n +0000497961 00000 n 0000009425 00000 n 0000009505 00000 n -0000203618 00000 n -0000472202 00000 n +0000208518 00000 n +0000497868 00000 n 0000009566 00000 n 0000009617 00000 n -0000203743 00000 n -0000472109 00000 n +0000208643 00000 n +0000497775 00000 n 0000009678 00000 n 0000009744 00000 n -0000203868 00000 n -0000472016 00000 n +0000208767 00000 n +0000497682 00000 n 0000009805 00000 n 0000009893 00000 n -0000203993 00000 n -0000471923 00000 n +0000210913 00000 n +0000497589 00000 n 0000009954 00000 n 0000010016 00000 n -0000207561 00000 n -0000471830 00000 n +0000213547 00000 n +0000497496 00000 n 0000010077 00000 n 0000010172 00000 n -0000207686 00000 n -0000471737 00000 n +0000213672 00000 n +0000497403 00000 n 0000010233 00000 n 0000010316 00000 n -0000212469 00000 n -0000471644 00000 n +0000216538 00000 n +0000497310 00000 n 0000010377 00000 n 0000010432 00000 n -0000212594 00000 n -0000471565 00000 n +0000216663 00000 n +0000497231 00000 n 0000010493 00000 n 0000010544 00000 n -0000216316 00000 n -0000471432 00000 n +0000219698 00000 n +0000497098 00000 n 0000010594 00000 n 0000010649 00000 n -0000216441 00000 n -0000471353 00000 n +0000222969 00000 n +0000497019 00000 n 0000010704 00000 n 0000010742 00000 n -0000216566 00000 n -0000471221 00000 n +0000223094 00000 n +0000496887 00000 n 0000010797 00000 n 0000010830 00000 n -0000220195 00000 n -0000471142 00000 n +0000225901 00000 n +0000496808 00000 n 0000010890 00000 n 0000010985 00000 n -0000220320 00000 n -0000471049 00000 n +0000226026 00000 n +0000496715 00000 n 0000011045 00000 n 0000011098 00000 n -0000220445 00000 n -0000470956 00000 n +0000228559 00000 n +0000496622 00000 n 0000011158 00000 n 0000011202 00000 n -0000220570 00000 n -0000470863 00000 n +0000228684 00000 n +0000496529 00000 n 0000011262 00000 n 0000011308 00000 n -0000224302 00000 n -0000470770 00000 n +0000228809 00000 n +0000496436 00000 n 0000011368 00000 n 0000011414 00000 n -0000224427 00000 n -0000470677 00000 n +0000228934 00000 n +0000496343 00000 n 0000011474 00000 n 0000011520 00000 n -0000224552 00000 n -0000470584 00000 n +0000231298 00000 n +0000496250 00000 n 0000011580 00000 n 0000011626 00000 n -0000224677 00000 n -0000470505 00000 n +0000231423 00000 n +0000496171 00000 n 0000011686 00000 n 0000011732 00000 n -0000224802 00000 n -0000470412 00000 n +0000231548 00000 n +0000496078 00000 n 0000011787 00000 n 0000011818 00000 n -0000224927 00000 n -0000470319 00000 n +0000234311 00000 n +0000495985 00000 n 0000011873 00000 n 0000011919 00000 n -0000228615 00000 n -0000470226 00000 n +0000234435 00000 n +0000495892 00000 n 0000011974 00000 n 0000012026 00000 n -0000228739 00000 n -0000470094 00000 n +0000236765 00000 n +0000495760 00000 n 0000012081 00000 n 0000012123 00000 n -0000228864 00000 n -0000470015 00000 n +0000236890 00000 n +0000495681 00000 n 0000012183 00000 n 0000012219 00000 n -0000231088 00000 n -0000469936 00000 n +0000237015 00000 n +0000495602 00000 n 0000012279 00000 n 0000012316 00000 n -0000231213 00000 n -0000469804 00000 n +0000238873 00000 n +0000495470 00000 n 0000012371 00000 n 0000012419 00000 n -0000231338 00000 n -0000469725 00000 n +0000238998 00000 n +0000495391 00000 n 0000012479 00000 n 0000012515 00000 n -0000231463 00000 n -0000469646 00000 n +0000239122 00000 n +0000495312 00000 n 0000012575 00000 n 0000012612 00000 n -0000231588 00000 n -0000469514 00000 n +0000239247 00000 n +0000495180 00000 n 0000012667 00000 n 0000012723 00000 n -0000231713 00000 n -0000469435 00000 n +0000239372 00000 n +0000495101 00000 n 0000012783 00000 n 0000012819 00000 n -0000231838 00000 n -0000469356 00000 n +0000239497 00000 n +0000495022 00000 n 0000012879 00000 n 0000012916 00000 n -0000231963 00000 n -0000469224 00000 n +0000241322 00000 n +0000494890 00000 n 0000012971 00000 n 0000013013 00000 n -0000232088 00000 n -0000469145 00000 n +0000241447 00000 n +0000494811 00000 n 0000013073 00000 n 0000013109 00000 n -0000232213 00000 n -0000469066 00000 n +0000241572 00000 n +0000494732 00000 n 0000013169 00000 n 0000013206 00000 n -0000235085 00000 n -0000468934 00000 n +0000241697 00000 n +0000494600 00000 n 0000013262 00000 n 0000013299 00000 n -0000235210 00000 n -0000468855 00000 n +0000241822 00000 n +0000494521 00000 n 0000013360 00000 n 0000013397 00000 n -0000235334 00000 n -0000468776 00000 n +0000241947 00000 n +0000494442 00000 n 0000013458 00000 n 0000013496 00000 n -0000235459 00000 n -0000468644 00000 n +0000242072 00000 n +0000494310 00000 n 0000013552 00000 n 0000013595 00000 n -0000235584 00000 n -0000468565 00000 n +0000242197 00000 n +0000494231 00000 n 0000013656 00000 n 0000013693 00000 n -0000235709 00000 n -0000468486 00000 n +0000244572 00000 n +0000494152 00000 n 0000013754 00000 n 0000013792 00000 n -0000235834 00000 n -0000468368 00000 n +0000244697 00000 n +0000494034 00000 n 0000013848 00000 n 0000013892 00000 n -0000235958 00000 n -0000468289 00000 n +0000244822 00000 n +0000493955 00000 n 0000013953 00000 n 0000013990 00000 n -0000239388 00000 n -0000468210 00000 n +0000247352 00000 n +0000493876 00000 n 0000014051 00000 n 0000014089 00000 n -0000239513 00000 n -0000468078 00000 n +0000247477 00000 n +0000493744 00000 n 0000014139 00000 n 0000014196 00000 n -0000239638 00000 n -0000467960 00000 n +0000247602 00000 n +0000493626 00000 n 0000014251 00000 n 0000014299 00000 n -0000239763 00000 n -0000467881 00000 n +0000250141 00000 n +0000493547 00000 n 0000014359 00000 n 0000014395 00000 n -0000239888 00000 n -0000467802 00000 n +0000250266 00000 n +0000493468 00000 n 0000014455 00000 n 0000014492 00000 n -0000242894 00000 n -0000467670 00000 n +0000250391 00000 n +0000493336 00000 n 0000014547 00000 n 0000014592 00000 n -0000243019 00000 n -0000467591 00000 n +0000250516 00000 n +0000493257 00000 n 0000014652 00000 n 0000014688 00000 n -0000243144 00000 n -0000467512 00000 n +0000252921 00000 n +0000493178 00000 n 0000014748 00000 n 0000014785 00000 n -0000243269 00000 n -0000467380 00000 n +0000253046 00000 n +0000493046 00000 n 0000014840 00000 n 0000014890 00000 n -0000243394 00000 n -0000467301 00000 n +0000253171 00000 n +0000492967 00000 n 0000014950 00000 n 0000014986 00000 n -0000243519 00000 n -0000467222 00000 n +0000253296 00000 n +0000492888 00000 n 0000015046 00000 n 0000015083 00000 n -0000243644 00000 n -0000467090 00000 n +0000253421 00000 n +0000492756 00000 n 0000015138 00000 n 0000015178 00000 n -0000243769 00000 n -0000467011 00000 n +0000253546 00000 n +0000492677 00000 n 0000015238 00000 n 0000015274 00000 n -0000246259 00000 n -0000466932 00000 n +0000255473 00000 n +0000492598 00000 n 0000015334 00000 n 0000015371 00000 n -0000246384 00000 n -0000466814 00000 n +0000255598 00000 n +0000492480 00000 n 0000015426 00000 n 0000015467 00000 n -0000246509 00000 n -0000466735 00000 n +0000255722 00000 n +0000492401 00000 n 0000015527 00000 n 0000015563 00000 n -0000246632 00000 n -0000466656 00000 n +0000255847 00000 n +0000492322 00000 n 0000015623 00000 n 0000015660 00000 n -0000246756 00000 n -0000466524 00000 n +0000258091 00000 n +0000492190 00000 n 0000015710 00000 n -0000015769 00000 n -0000246881 00000 n -0000466406 00000 n -0000015824 00000 n -0000015864 00000 n -0000249766 00000 n -0000466327 00000 n -0000015924 00000 n -0000015960 00000 n -0000249891 00000 n -0000466248 00000 n -0000016020 00000 n -0000016057 00000 n -0000250016 00000 n -0000466130 00000 n -0000016112 00000 n -0000016148 00000 n -0000250141 00000 n -0000466051 00000 n -0000016208 00000 n -0000016244 00000 n -0000250266 00000 n -0000465972 00000 n -0000016304 00000 n -0000016341 00000 n -0000253101 00000 n -0000465840 00000 n -0000016391 00000 n -0000016442 00000 n -0000253226 00000 n -0000465722 00000 n -0000016497 00000 n -0000016538 00000 n -0000253349 00000 n -0000465643 00000 n -0000016598 00000 n -0000016634 00000 n -0000253474 00000 n -0000465564 00000 n -0000016694 00000 n -0000016731 00000 n -0000253599 00000 n -0000465446 00000 n -0000016786 00000 n -0000016832 00000 n -0000253724 00000 n -0000465367 00000 n -0000016892 00000 n -0000016928 00000 n -0000253848 00000 n -0000465288 00000 n -0000016988 00000 n -0000017025 00000 n -0000256596 00000 n -0000465156 00000 n -0000017075 00000 n -0000017146 00000 n -0000256721 00000 n -0000465077 00000 n -0000017201 00000 n -0000017239 00000 n -0000256846 00000 n -0000464984 00000 n -0000017294 00000 n -0000017329 00000 n -0000259973 00000 n -0000464905 00000 n -0000017384 00000 n -0000017419 00000 n -0000260098 00000 n -0000464787 00000 n -0000017469 00000 n -0000017507 00000 n -0000260223 00000 n -0000464669 00000 n -0000017562 00000 n -0000017604 00000 n -0000260348 00000 n -0000464590 00000 n -0000017664 00000 n -0000017718 00000 n -0000260473 00000 n -0000464511 00000 n -0000017778 00000 n -0000017825 00000 n -0000263431 00000 n -0000464393 00000 n -0000017880 00000 n -0000017922 00000 n -0000263556 00000 n -0000464314 00000 n -0000017982 00000 n -0000018031 00000 n -0000263681 00000 n -0000464221 00000 n -0000018091 00000 n -0000018141 00000 n -0000263806 00000 n -0000464142 00000 n -0000018201 00000 n -0000018252 00000 n -0000267434 00000 n -0000464009 00000 n -0000018300 00000 n -0000018347 00000 n -0000267559 00000 n -0000463930 00000 n -0000018397 00000 n -0000018430 00000 n -0000267684 00000 n -0000463837 00000 n -0000018480 00000 n -0000018544 00000 n -0000267809 00000 n -0000463744 00000 n -0000018594 00000 n -0000018636 00000 n -0000275101 00000 n -0000463651 00000 n -0000018686 00000 n -0000018761 00000 n -0000275226 00000 n -0000463572 00000 n -0000018811 00000 n -0000018871 00000 n -0000283207 00000 n -0000463439 00000 n -0000018919 00000 n -0000018962 00000 n -0000283332 00000 n -0000463374 00000 n -0000019012 00000 n -0000019050 00000 n -0000287268 00000 n -0000463241 00000 n -0000019098 00000 n -0000019144 00000 n -0000287393 00000 n -0000463162 00000 n -0000019194 00000 n -0000019244 00000 n -0000291427 00000 n -0000463069 00000 n -0000019294 00000 n -0000019339 00000 n -0000291551 00000 n -0000462976 00000 n -0000019389 00000 n -0000019446 00000 n -0000291675 00000 n -0000462844 00000 n -0000019496 00000 n -0000019527 00000 n -0000291799 00000 n -0000462765 00000 n -0000019582 00000 n -0000019620 00000 n -0000291923 00000 n -0000462672 00000 n -0000019675 00000 n -0000019715 00000 n -0000295653 00000 n -0000462593 00000 n -0000019770 00000 n -0000019808 00000 n -0000295778 00000 n -0000462461 00000 n -0000019858 00000 n -0000019894 00000 n -0000295903 00000 n -0000462382 00000 n -0000019949 00000 n -0000020005 00000 n -0000296028 00000 n -0000462303 00000 n -0000020060 00000 n -0000020097 00000 n -0000296152 00000 n -0000462210 00000 n -0000020147 00000 n -0000020189 00000 n -0000298476 00000 n -0000462131 00000 n -0000020239 00000 n +0000015801 00000 n +0000258216 00000 n +0000492072 00000 n +0000015856 00000 n +0000015896 00000 n +0000258341 00000 n +0000491993 00000 n +0000015956 00000 n +0000015992 00000 n +0000258466 00000 n +0000491914 00000 n +0000016052 00000 n +0000016089 00000 n +0000260608 00000 n +0000491796 00000 n +0000016144 00000 n +0000016180 00000 n +0000260733 00000 n +0000491717 00000 n +0000016240 00000 n +0000016276 00000 n +0000260858 00000 n +0000491638 00000 n +0000016336 00000 n +0000016373 00000 n +0000263217 00000 n +0000491506 00000 n +0000016423 00000 n +0000016474 00000 n +0000263341 00000 n +0000491388 00000 n +0000016529 00000 n +0000016570 00000 n +0000263466 00000 n +0000491309 00000 n +0000016630 00000 n +0000016666 00000 n +0000263590 00000 n +0000491230 00000 n +0000016726 00000 n +0000016763 00000 n +0000266073 00000 n +0000491112 00000 n +0000016818 00000 n +0000016864 00000 n +0000266198 00000 n +0000491033 00000 n +0000016924 00000 n +0000016960 00000 n +0000266323 00000 n +0000490954 00000 n +0000017020 00000 n +0000017057 00000 n +0000266448 00000 n +0000490822 00000 n +0000017107 00000 n +0000017178 00000 n +0000266573 00000 n +0000490743 00000 n +0000017233 00000 n +0000017271 00000 n +0000268322 00000 n +0000490650 00000 n +0000017326 00000 n +0000017361 00000 n +0000270897 00000 n +0000490571 00000 n +0000017416 00000 n +0000017451 00000 n +0000271021 00000 n +0000490453 00000 n +0000017501 00000 n +0000017539 00000 n +0000271146 00000 n +0000490335 00000 n +0000017594 00000 n +0000017636 00000 n +0000271271 00000 n +0000490256 00000 n +0000017696 00000 n +0000017750 00000 n +0000273600 00000 n +0000490177 00000 n +0000017810 00000 n +0000017857 00000 n +0000273723 00000 n +0000490059 00000 n +0000017912 00000 n +0000017954 00000 n +0000273848 00000 n +0000489980 00000 n +0000018014 00000 n +0000018063 00000 n +0000275666 00000 n +0000489887 00000 n +0000018123 00000 n +0000018173 00000 n +0000275791 00000 n +0000489808 00000 n +0000018233 00000 n +0000018284 00000 n +0000278088 00000 n +0000489675 00000 n +0000018332 00000 n +0000018379 00000 n +0000278213 00000 n +0000489596 00000 n +0000018429 00000 n +0000018462 00000 n +0000278338 00000 n +0000489503 00000 n +0000018512 00000 n +0000018576 00000 n +0000278463 00000 n +0000489410 00000 n +0000018626 00000 n +0000018668 00000 n +0000285574 00000 n +0000489317 00000 n +0000018718 00000 n +0000018793 00000 n +0000285699 00000 n +0000489238 00000 n +0000018843 00000 n +0000018903 00000 n +0000295084 00000 n +0000489105 00000 n +0000018951 00000 n +0000018994 00000 n +0000295209 00000 n +0000489040 00000 n +0000019044 00000 n +0000019082 00000 n +0000299282 00000 n +0000488907 00000 n +0000019130 00000 n +0000019176 00000 n +0000299407 00000 n +0000488828 00000 n +0000019226 00000 n +0000019276 00000 n +0000303214 00000 n +0000488735 00000 n +0000019326 00000 n +0000019371 00000 n +0000303339 00000 n +0000488642 00000 n +0000019421 00000 n +0000019478 00000 n +0000306416 00000 n +0000488510 00000 n +0000019528 00000 n +0000019559 00000 n +0000306541 00000 n +0000488431 00000 n +0000019614 00000 n +0000019652 00000 n +0000306666 00000 n +0000488338 00000 n +0000019707 00000 n +0000019747 00000 n +0000306791 00000 n +0000488259 00000 n +0000019802 00000 n +0000019840 00000 n +0000306916 00000 n +0000488127 00000 n +0000019890 00000 n +0000019926 00000 n +0000307041 00000 n +0000488048 00000 n +0000019981 00000 n +0000020037 00000 n +0000309994 00000 n +0000487969 00000 n +0000020092 00000 n +0000020129 00000 n +0000310119 00000 n +0000487876 00000 n +0000020179 00000 n +0000020221 00000 n +0000312178 00000 n +0000487797 00000 n 0000020271 00000 n -0000302163 00000 n -0000461998 00000 n -0000020319 00000 n -0000020375 00000 n -0000302288 00000 n -0000461919 00000 n -0000020425 00000 n -0000020462 00000 n -0000302413 00000 n -0000461826 00000 n -0000020512 00000 n -0000020554 00000 n -0000306181 00000 n -0000461747 00000 n -0000020604 00000 n -0000020647 00000 n -0000311008 00000 n -0000461614 00000 n -0000020695 00000 n -0000020725 00000 n -0000311133 00000 n -0000461535 00000 n -0000020775 00000 n -0000020810 00000 n -0000311258 00000 n -0000461403 00000 n -0000020860 00000 n -0000020900 00000 n -0000311383 00000 n -0000461324 00000 n -0000020955 00000 n -0000020996 00000 n -0000311508 00000 n -0000461245 00000 n -0000021051 00000 n -0000021092 00000 n -0000314881 00000 n -0000461127 00000 n -0000021142 00000 n -0000021182 00000 n -0000315006 00000 n -0000461062 00000 n -0000021237 00000 n -0000021303 00000 n -0000318036 00000 n -0000460929 00000 n -0000021351 00000 n -0000021395 00000 n -0000318161 00000 n -0000460850 00000 n -0000021445 00000 n -0000021475 00000 n -0000318286 00000 n -0000460771 00000 n -0000021525 00000 n -0000021566 00000 n -0000320024 00000 n -0000460638 00000 n -0000021614 00000 n -0000021648 00000 n -0000320149 00000 n -0000460520 00000 n -0000021698 00000 n -0000021752 00000 n -0000320274 00000 n -0000460441 00000 n -0000021807 00000 n -0000021855 00000 n -0000324501 00000 n -0000460362 00000 n -0000021910 00000 n -0000021966 00000 n -0000324626 00000 n -0000460230 00000 n -0000022016 00000 n -0000022104 00000 n -0000324751 00000 n -0000460151 00000 n -0000022159 00000 n -0000022217 00000 n -0000327603 00000 n -0000460072 00000 n -0000022272 00000 n -0000022341 00000 n -0000334925 00000 n -0000459940 00000 n -0000022391 00000 n -0000022450 00000 n -0000335050 00000 n -0000459875 00000 n -0000022505 00000 n -0000022573 00000 n -0000345749 00000 n -0000459757 00000 n -0000022623 00000 n -0000022658 00000 n -0000345874 00000 n -0000459678 00000 n -0000022713 00000 n -0000022771 00000 n -0000345999 00000 n -0000459599 00000 n -0000022826 00000 n -0000022879 00000 n -0000347570 00000 n -0000459466 00000 n -0000022927 00000 n -0000022968 00000 n -0000347695 00000 n -0000459387 00000 n -0000023018 00000 n -0000023053 00000 n -0000347820 00000 n -0000459308 00000 n -0000023103 00000 n +0000020303 00000 n +0000315311 00000 n +0000487664 00000 n +0000020351 00000 n +0000020407 00000 n +0000315436 00000 n +0000487585 00000 n +0000020457 00000 n +0000020494 00000 n +0000315561 00000 n +0000487492 00000 n +0000020544 00000 n +0000020586 00000 n +0000318635 00000 n +0000487413 00000 n +0000020636 00000 n +0000020679 00000 n +0000323620 00000 n +0000487280 00000 n +0000020727 00000 n +0000020757 00000 n +0000323745 00000 n +0000487201 00000 n +0000020807 00000 n +0000020842 00000 n +0000323870 00000 n +0000487069 00000 n +0000020892 00000 n +0000020932 00000 n +0000323995 00000 n +0000486990 00000 n +0000020987 00000 n +0000021028 00000 n +0000327290 00000 n +0000486911 00000 n +0000021083 00000 n +0000021124 00000 n +0000327415 00000 n +0000486793 00000 n +0000021174 00000 n +0000021214 00000 n +0000327540 00000 n +0000486728 00000 n +0000021269 00000 n +0000021335 00000 n +0000333951 00000 n +0000486595 00000 n +0000021383 00000 n +0000021427 00000 n +0000334076 00000 n +0000486516 00000 n +0000021477 00000 n +0000021507 00000 n +0000334201 00000 n +0000486437 00000 n +0000021557 00000 n +0000021598 00000 n +0000335823 00000 n +0000486304 00000 n +0000021646 00000 n +0000021680 00000 n +0000335948 00000 n +0000486186 00000 n +0000021730 00000 n +0000021784 00000 n +0000336073 00000 n +0000486107 00000 n +0000021839 00000 n +0000021887 00000 n +0000339881 00000 n +0000486028 00000 n +0000021942 00000 n +0000021998 00000 n +0000342351 00000 n +0000485896 00000 n +0000022048 00000 n +0000022136 00000 n +0000342476 00000 n +0000485817 00000 n +0000022191 00000 n +0000022249 00000 n +0000345327 00000 n +0000485738 00000 n +0000022304 00000 n +0000022373 00000 n +0000351475 00000 n +0000485606 00000 n +0000022423 00000 n +0000022482 00000 n +0000351600 00000 n +0000485541 00000 n +0000022537 00000 n +0000022605 00000 n +0000361676 00000 n +0000485423 00000 n +0000022655 00000 n +0000022690 00000 n +0000361801 00000 n +0000485344 00000 n +0000022745 00000 n +0000022803 00000 n +0000361925 00000 n +0000485265 00000 n +0000022858 00000 n +0000022911 00000 n +0000364135 00000 n +0000485132 00000 n +0000022959 00000 n +0000023000 00000 n +0000364260 00000 n +0000485053 00000 n +0000023050 00000 n +0000023085 00000 n +0000364385 00000 n +0000484974 00000 n 0000023135 00000 n -0000351912 00000 n -0000459228 00000 n -0000023183 00000 n -0000023223 00000 n -0000023605 00000 n -0000023846 00000 n -0000023275 00000 n -0000023724 00000 n -0000023785 00000 n -0000456020 00000 n -0000442781 00000 n -0000455854 00000 n -0000442335 00000 n -0000437533 00000 n -0000442172 00000 n -0000456893 00000 n -0000025979 00000 n -0000025061 00000 n -0000023931 00000 n -0000025918 00000 n -0000436712 00000 n -0000420508 00000 n -0000436548 00000 n -0000418572 00000 n -0000400220 00000 n -0000418409 00000 n -0000025224 00000 n -0000399239 00000 n -0000383095 00000 n -0000399075 00000 n -0000025395 00000 n -0000025565 00000 n -0000025736 00000 n -0000034833 00000 n -0000029270 00000 n -0000026077 00000 n -0000034772 00000 n -0000381459 00000 n -0000371814 00000 n -0000381295 00000 n -0000029661 00000 n -0000371382 00000 n -0000369862 00000 n -0000371218 00000 n -0000029811 00000 n -0000029966 00000 n -0000030114 00000 n -0000030274 00000 n -0000367962 00000 n -0000365952 00000 n -0000367799 00000 n -0000030426 00000 n -0000030612 00000 n -0000030761 00000 n -0000030912 00000 n -0000031062 00000 n -0000031218 00000 n -0000031388 00000 n -0000031555 00000 n -0000031705 00000 n -0000031880 00000 n -0000032056 00000 n -0000032225 00000 n -0000032375 00000 n -0000032522 00000 n -0000032667 00000 n -0000032819 00000 n -0000032988 00000 n -0000033138 00000 n -0000033309 00000 n -0000033462 00000 n -0000033635 00000 n -0000033806 00000 n -0000033952 00000 n -0000034119 00000 n -0000034292 00000 n -0000034444 00000 n -0000034600 00000 n -0000093921 00000 n -0000101434 00000 n -0000108886 00000 n -0000121931 00000 n -0000131681 00000 n -0000150699 00000 n -0000159520 00000 n -0000174391 00000 n -0000177229 00000 n -0000183328 00000 n -0000267496 00000 n -0000283269 00000 n -0000287330 00000 n -0000302225 00000 n -0000311070 00000 n -0000318098 00000 n -0000320086 00000 n -0000347632 00000 n -0000351974 00000 n -0000044328 00000 n -0000037438 00000 n -0000034957 00000 n -0000044202 00000 n -0000044265 00000 n -0000037932 00000 n -0000038085 00000 n -0000038239 00000 n -0000038393 00000 n -0000038548 00000 n -0000038701 00000 n -0000038856 00000 n -0000039011 00000 n -0000039166 00000 n -0000039321 00000 n -0000039475 00000 n -0000039628 00000 n -0000039783 00000 n -0000039937 00000 n -0000040092 00000 n -0000040247 00000 n -0000040402 00000 n -0000040562 00000 n -0000040722 00000 n -0000040882 00000 n -0000041035 00000 n -0000041188 00000 n -0000041343 00000 n -0000041497 00000 n -0000041652 00000 n -0000041812 00000 n -0000041972 00000 n -0000042132 00000 n -0000042292 00000 n -0000042452 00000 n -0000042612 00000 n -0000042772 00000 n -0000042931 00000 n -0000043091 00000 n -0000043252 00000 n -0000043412 00000 n -0000043571 00000 n -0000043731 00000 n -0000043890 00000 n -0000044049 00000 n -0000055715 00000 n -0000047590 00000 n -0000044414 00000 n -0000055652 00000 n -0000365367 00000 n -0000356177 00000 n -0000365201 00000 n -0000048147 00000 n -0000048307 00000 n -0000048467 00000 n -0000048622 00000 n -0000048775 00000 n +0000023167 00000 n +0000368236 00000 n +0000484894 00000 n +0000023215 00000 n +0000023255 00000 n +0000023617 00000 n +0000023858 00000 n +0000023307 00000 n +0000023736 00000 n +0000023797 00000 n +0000481070 00000 n +0000467831 00000 n +0000480904 00000 n +0000467418 00000 n +0000463632 00000 n +0000467255 00000 n +0000481943 00000 n +0000025991 00000 n +0000025073 00000 n +0000023943 00000 n +0000025930 00000 n +0000462811 00000 n +0000446607 00000 n +0000462647 00000 n +0000444662 00000 n +0000426259 00000 n +0000444499 00000 n +0000025236 00000 n +0000425287 00000 n +0000409417 00000 n +0000425123 00000 n +0000025407 00000 n +0000025577 00000 n +0000025748 00000 n +0000029365 00000 n +0000027488 00000 n +0000026089 00000 n +0000029243 00000 n +0000029304 00000 n +0000027699 00000 n +0000407941 00000 n +0000406001 00000 n +0000407777 00000 n +0000027847 00000 n +0000028001 00000 n +0000028148 00000 n +0000028307 00000 n +0000404101 00000 n +0000402091 00000 n +0000403938 00000 n +0000028458 00000 n +0000028645 00000 n +0000028793 00000 n +0000028943 00000 n +0000029092 00000 n +0000093846 00000 n +0000100697 00000 n +0000109160 00000 n +0000122425 00000 n +0000132544 00000 n +0000152958 00000 n +0000162312 00000 n +0000176989 00000 n +0000180413 00000 n +0000035480 00000 n +0000031541 00000 n +0000029476 00000 n +0000035419 00000 n +0000031863 00000 n +0000032033 00000 n +0000032204 00000 n +0000032353 00000 n +0000032528 00000 n +0000032703 00000 n +0000032873 00000 n +0000033023 00000 n +0000033169 00000 n +0000033315 00000 n +0000033467 00000 n +0000033637 00000 n +0000033787 00000 n +0000033959 00000 n +0000034112 00000 n +0000034286 00000 n +0000034458 00000 n +0000034603 00000 n +0000034770 00000 n +0000034943 00000 n +0000035095 00000 n +0000035250 00000 n +0000185451 00000 n +0000278150 00000 n +0000295146 00000 n +0000299344 00000 n +0000315373 00000 n +0000323682 00000 n +0000334013 00000 n +0000335885 00000 n +0000364197 00000 n +0000368298 00000 n +0000044740 00000 n +0000038014 00000 n +0000035578 00000 n +0000044614 00000 n +0000044677 00000 n +0000038499 00000 n +0000038651 00000 n +0000038805 00000 n +0000038960 00000 n +0000039115 00000 n +0000039268 00000 n +0000039423 00000 n +0000039578 00000 n +0000039733 00000 n +0000039887 00000 n +0000040042 00000 n +0000040195 00000 n +0000040349 00000 n +0000040504 00000 n +0000040659 00000 n +0000040814 00000 n +0000040969 00000 n +0000041129 00000 n +0000041289 00000 n +0000041449 00000 n +0000041602 00000 n +0000041755 00000 n +0000041909 00000 n +0000042064 00000 n +0000042219 00000 n +0000042379 00000 n +0000042539 00000 n +0000042699 00000 n +0000042859 00000 n +0000043019 00000 n +0000043179 00000 n +0000043338 00000 n +0000043498 00000 n +0000043658 00000 n +0000043818 00000 n +0000043977 00000 n +0000044137 00000 n +0000044296 00000 n +0000044455 00000 n +0000056333 00000 n +0000048049 00000 n +0000044826 00000 n +0000056270 00000 n +0000401506 00000 n +0000392316 00000 n +0000401340 00000 n +0000048615 00000 n +0000048770 00000 n 0000048930 00000 n 0000049090 00000 n -0000049250 00000 n -0000049409 00000 n -0000049564 00000 n -0000049724 00000 n -0000049877 00000 n +0000049245 00000 n +0000049398 00000 n +0000049553 00000 n +0000049713 00000 n +0000049872 00000 n 0000050032 00000 n 0000050187 00000 n -0000050342 00000 n -0000050497 00000 n -0000050652 00000 n -0000050807 00000 n -0000050962 00000 n -0000051116 00000 n -0000051271 00000 n -0000051423 00000 n -0000051575 00000 n -0000051730 00000 n -0000051884 00000 n -0000052040 00000 n -0000052201 00000 n -0000052362 00000 n -0000052516 00000 n -0000052677 00000 n -0000052838 00000 n -0000053004 00000 n -0000053169 00000 n -0000053330 00000 n -0000053496 00000 n -0000053662 00000 n -0000053828 00000 n -0000053994 00000 n -0000054160 00000 n -0000054326 00000 n -0000054491 00000 n -0000054656 00000 n -0000054822 00000 n -0000054989 00000 n -0000055155 00000 n -0000055322 00000 n -0000055487 00000 n -0000068050 00000 n -0000059340 00000 n -0000055815 00000 n -0000067987 00000 n -0000059915 00000 n -0000060082 00000 n -0000060249 00000 n -0000060416 00000 n -0000060583 00000 n -0000060750 00000 n -0000060917 00000 n -0000061083 00000 n -0000061250 00000 n -0000061417 00000 n -0000061583 00000 n -0000061750 00000 n -0000061917 00000 n -0000062084 00000 n -0000062251 00000 n -0000062418 00000 n -0000062585 00000 n -0000062741 00000 n -0000062902 00000 n -0000063062 00000 n -0000063228 00000 n -0000063394 00000 n -0000063559 00000 n -0000063725 00000 n -0000063891 00000 n -0000064057 00000 n -0000064223 00000 n -0000064389 00000 n -0000064550 00000 n -0000064711 00000 n -0000064872 00000 n -0000065032 00000 n -0000065198 00000 n -0000065364 00000 n -0000065524 00000 n -0000065690 00000 n -0000065856 00000 n -0000066017 00000 n -0000066183 00000 n -0000066349 00000 n -0000066510 00000 n -0000066676 00000 n -0000066842 00000 n -0000067003 00000 n -0000067170 00000 n -0000067337 00000 n -0000067498 00000 n -0000067662 00000 n -0000067827 00000 n -0000079694 00000 n -0000070937 00000 n -0000068137 00000 n -0000079631 00000 n -0000071522 00000 n -0000071689 00000 n -0000071856 00000 n -0000072012 00000 n -0000072173 00000 n -0000072339 00000 n -0000072505 00000 n -0000072666 00000 n -0000072832 00000 n -0000072997 00000 n -0000073158 00000 n -0000073324 00000 n -0000073489 00000 n -0000073650 00000 n -0000073816 00000 n -0000073982 00000 n -0000074143 00000 n -0000074309 00000 n -0000074475 00000 n -0000074631 00000 n -0000074792 00000 n -0000074957 00000 n -0000075123 00000 n -0000075284 00000 n -0000075450 00000 n -0000075615 00000 n -0000075771 00000 n -0000075932 00000 n -0000076098 00000 n -0000076264 00000 n -0000076425 00000 n -0000076591 00000 n -0000076757 00000 n -0000076913 00000 n -0000077073 00000 n -0000077234 00000 n -0000077395 00000 n -0000077550 00000 n -0000077711 00000 n -0000077877 00000 n -0000078043 00000 n -0000078204 00000 n -0000078370 00000 n -0000078536 00000 n -0000078702 00000 n -0000078856 00000 n -0000079012 00000 n -0000079168 00000 n -0000079323 00000 n -0000079477 00000 n -0000457014 00000 n -0000090563 00000 n -0000082893 00000 n -0000079807 00000 n -0000090500 00000 n -0000083433 00000 n -0000083587 00000 n -0000083743 00000 n -0000083897 00000 n -0000084053 00000 n -0000084209 00000 n -0000084365 00000 n -0000084521 00000 n -0000084681 00000 n -0000084842 00000 n -0000085003 00000 n -0000085158 00000 n -0000085319 00000 n -0000085480 00000 n -0000085636 00000 n -0000085792 00000 n -0000085946 00000 n -0000086102 00000 n -0000086258 00000 n -0000086413 00000 n -0000086567 00000 n -0000086722 00000 n +0000050346 00000 n +0000050498 00000 n +0000050653 00000 n +0000050808 00000 n +0000050963 00000 n +0000051118 00000 n +0000051273 00000 n +0000051428 00000 n +0000051582 00000 n +0000051737 00000 n +0000051892 00000 n +0000052044 00000 n +0000052195 00000 n +0000052350 00000 n +0000052504 00000 n +0000052660 00000 n +0000052821 00000 n +0000052980 00000 n +0000053136 00000 n +0000053297 00000 n +0000053458 00000 n +0000053623 00000 n +0000053789 00000 n +0000053950 00000 n +0000054116 00000 n +0000054282 00000 n +0000054448 00000 n +0000054614 00000 n +0000054780 00000 n +0000054945 00000 n +0000055110 00000 n +0000055276 00000 n +0000055442 00000 n +0000055608 00000 n +0000055775 00000 n +0000055940 00000 n +0000056105 00000 n +0000069221 00000 n +0000059993 00000 n +0000056433 00000 n +0000069158 00000 n +0000060596 00000 n +0000060763 00000 n +0000060930 00000 n +0000061097 00000 n +0000061264 00000 n +0000061431 00000 n +0000061598 00000 n +0000061765 00000 n +0000061932 00000 n +0000062098 00000 n +0000062265 00000 n +0000062432 00000 n +0000062598 00000 n +0000062765 00000 n +0000062932 00000 n +0000063099 00000 n +0000063266 00000 n +0000063422 00000 n +0000063583 00000 n +0000063744 00000 n +0000063910 00000 n +0000064075 00000 n +0000064241 00000 n +0000064407 00000 n +0000064573 00000 n +0000064738 00000 n +0000064904 00000 n +0000065070 00000 n +0000065231 00000 n +0000065392 00000 n +0000065553 00000 n +0000065714 00000 n +0000065880 00000 n +0000066046 00000 n +0000066206 00000 n +0000066372 00000 n +0000066538 00000 n +0000066698 00000 n +0000066864 00000 n +0000067030 00000 n +0000067191 00000 n +0000067357 00000 n +0000067523 00000 n +0000067685 00000 n +0000067852 00000 n +0000068019 00000 n +0000068180 00000 n +0000068347 00000 n +0000068514 00000 n +0000068675 00000 n +0000068839 00000 n +0000069004 00000 n +0000482063 00000 n +0000080701 00000 n +0000072134 00000 n +0000069308 00000 n +0000080638 00000 n +0000072710 00000 n +0000072871 00000 n +0000073037 00000 n +0000073203 00000 n +0000073364 00000 n +0000073530 00000 n +0000073696 00000 n +0000073857 00000 n +0000074023 00000 n +0000074188 00000 n +0000074349 00000 n +0000074515 00000 n +0000074680 00000 n +0000074841 00000 n +0000075007 00000 n +0000075173 00000 n +0000075329 00000 n +0000075490 00000 n +0000075656 00000 n +0000075822 00000 n +0000075983 00000 n +0000076148 00000 n +0000076314 00000 n +0000076470 00000 n +0000076631 00000 n +0000076796 00000 n +0000076962 00000 n +0000077123 00000 n +0000077289 00000 n +0000077455 00000 n +0000077611 00000 n +0000077772 00000 n +0000077933 00000 n +0000078094 00000 n +0000078249 00000 n +0000078410 00000 n +0000078576 00000 n +0000078741 00000 n +0000078902 00000 n +0000079068 00000 n +0000079234 00000 n +0000079400 00000 n +0000079554 00000 n +0000079710 00000 n +0000079866 00000 n +0000080020 00000 n +0000080176 00000 n +0000080332 00000 n +0000080484 00000 n +0000091184 00000 n +0000083840 00000 n +0000080814 00000 n +0000091121 00000 n +0000084362 00000 n +0000084516 00000 n +0000084672 00000 n +0000084828 00000 n +0000084984 00000 n +0000085140 00000 n +0000085301 00000 n +0000085462 00000 n +0000085623 00000 n +0000085778 00000 n +0000085939 00000 n +0000086100 00000 n +0000086255 00000 n +0000086411 00000 n +0000086565 00000 n +0000086721 00000 n 0000086877 00000 n -0000087038 00000 n -0000087199 00000 n -0000087355 00000 n -0000087516 00000 n -0000087670 00000 n -0000087826 00000 n -0000087981 00000 n -0000088135 00000 n -0000088291 00000 n -0000088451 00000 n -0000088612 00000 n -0000088768 00000 n -0000088929 00000 n -0000089090 00000 n -0000089246 00000 n -0000089407 00000 n -0000089563 00000 n -0000089723 00000 n -0000089883 00000 n -0000090037 00000 n -0000090192 00000 n -0000090348 00000 n -0000094232 00000 n -0000093675 00000 n -0000090663 00000 n -0000093798 00000 n -0000094045 00000 n -0000094169 00000 n -0000097839 00000 n -0000097529 00000 n -0000094318 00000 n -0000097652 00000 n -0000097776 00000 n -0000102369 00000 n -0000101187 00000 n -0000097952 00000 n -0000101310 00000 n -0000101558 00000 n -0000101621 00000 n -0000101683 00000 n -0000101746 00000 n -0000101870 00000 n -0000101993 00000 n -0000102056 00000 n -0000102119 00000 n -0000102181 00000 n -0000102244 00000 n -0000102307 00000 n -0000106251 00000 n -0000105755 00000 n -0000102455 00000 n -0000105878 00000 n -0000105941 00000 n -0000106065 00000 n -0000106188 00000 n -0000109325 00000 n -0000108639 00000 n -0000106351 00000 n -0000108762 00000 n -0000109010 00000 n -0000109073 00000 n -0000109136 00000 n -0000109199 00000 n -0000109262 00000 n -0000457139 00000 n -0000111841 00000 n -0000111531 00000 n -0000109424 00000 n -0000111654 00000 n -0000111778 00000 n -0000114339 00000 n -0000113843 00000 n -0000111967 00000 n -0000113966 00000 n -0000114090 00000 n -0000114214 00000 n -0000114277 00000 n -0000117368 00000 n -0000116562 00000 n -0000114452 00000 n -0000116685 00000 n -0000116748 00000 n -0000116811 00000 n -0000116934 00000 n -0000117058 00000 n -0000117181 00000 n -0000117305 00000 n -0000122559 00000 n -0000121263 00000 n -0000117468 00000 n -0000121807 00000 n -0000121416 00000 n -0000121617 00000 n -0000121994 00000 n -0000122057 00000 n -0000122120 00000 n -0000122183 00000 n -0000122245 00000 n -0000122308 00000 n -0000122371 00000 n -0000122434 00000 n -0000122497 00000 n -0000127615 00000 n -0000126425 00000 n -0000122658 00000 n -0000126548 00000 n -0000126611 00000 n -0000126674 00000 n -0000126737 00000 n -0000126800 00000 n -0000126863 00000 n -0000126926 00000 n -0000126989 00000 n -0000127052 00000 n -0000127115 00000 n -0000127178 00000 n -0000127240 00000 n -0000127303 00000 n -0000127366 00000 n -0000127427 00000 n -0000127490 00000 n -0000127553 00000 n -0000132494 00000 n -0000131434 00000 n -0000127702 00000 n -0000131557 00000 n -0000131805 00000 n -0000131928 00000 n -0000131991 00000 n -0000132054 00000 n -0000132117 00000 n -0000132179 00000 n -0000132242 00000 n -0000132305 00000 n -0000132368 00000 n -0000132431 00000 n -0000457264 00000 n -0000136461 00000 n -0000134966 00000 n -0000132580 00000 n -0000135089 00000 n -0000135152 00000 n -0000135215 00000 n -0000135278 00000 n -0000135401 00000 n -0000135526 00000 n -0000135650 00000 n -0000135774 00000 n -0000135899 00000 n -0000136024 00000 n -0000136149 00000 n -0000136273 00000 n -0000136398 00000 n -0000140346 00000 n -0000138791 00000 n -0000136561 00000 n -0000138914 00000 n -0000139039 00000 n -0000139163 00000 n -0000139288 00000 n -0000139413 00000 n -0000139536 00000 n -0000139661 00000 n -0000139786 00000 n -0000139910 00000 n -0000140035 00000 n -0000140098 00000 n -0000140161 00000 n -0000140223 00000 n -0000140285 00000 n -0000145366 00000 n -0000144236 00000 n -0000140459 00000 n -0000144359 00000 n -0000144422 00000 n -0000144485 00000 n -0000144548 00000 n -0000144611 00000 n -0000144674 00000 n -0000144737 00000 n -0000144800 00000 n -0000144863 00000 n -0000144926 00000 n -0000144989 00000 n -0000145114 00000 n -0000145177 00000 n -0000145240 00000 n -0000145303 00000 n -0000147701 00000 n -0000146762 00000 n -0000145466 00000 n -0000146885 00000 n -0000147010 00000 n -0000147073 00000 n -0000147136 00000 n -0000147199 00000 n -0000147262 00000 n -0000147325 00000 n -0000147387 00000 n -0000147450 00000 n -0000147513 00000 n -0000147576 00000 n -0000147639 00000 n -0000151828 00000 n -0000150451 00000 n -0000147801 00000 n -0000150574 00000 n -0000150824 00000 n -0000150887 00000 n -0000150950 00000 n -0000151013 00000 n -0000151076 00000 n -0000151139 00000 n -0000151202 00000 n -0000151265 00000 n -0000151390 00000 n -0000151452 00000 n -0000151515 00000 n -0000151578 00000 n -0000151641 00000 n -0000151766 00000 n -0000153920 00000 n -0000153484 00000 n -0000151940 00000 n -0000153607 00000 n -0000153732 00000 n -0000153857 00000 n -0000457389 00000 n -0000156041 00000 n -0000155478 00000 n -0000154046 00000 n -0000155601 00000 n -0000155664 00000 n -0000155727 00000 n -0000155790 00000 n -0000155853 00000 n -0000155978 00000 n -0000159958 00000 n -0000159272 00000 n -0000156167 00000 n -0000159395 00000 n -0000159645 00000 n -0000159770 00000 n -0000159895 00000 n -0000163906 00000 n -0000163471 00000 n -0000160057 00000 n -0000163594 00000 n -0000163719 00000 n -0000163844 00000 n -0000168436 00000 n -0000167750 00000 n -0000164006 00000 n -0000167873 00000 n -0000167998 00000 n -0000168123 00000 n -0000168248 00000 n -0000168373 00000 n -0000170747 00000 n -0000170561 00000 n -0000168549 00000 n -0000170684 00000 n -0000174454 00000 n -0000174143 00000 n -0000170834 00000 n -0000174266 00000 n -0000354995 00000 n -0000353119 00000 n -0000354829 00000 n -0000457514 00000 n -0000175950 00000 n -0000175764 00000 n -0000174580 00000 n -0000175887 00000 n -0000177731 00000 n -0000176981 00000 n -0000176050 00000 n -0000177104 00000 n -0000177354 00000 n -0000177417 00000 n -0000177480 00000 n -0000177543 00000 n -0000177606 00000 n -0000177669 00000 n -0000183766 00000 n -0000181402 00000 n -0000177830 00000 n -0000183203 00000 n -0000183453 00000 n -0000181609 00000 n -0000181802 00000 n -0000181996 00000 n -0000182219 00000 n -0000182442 00000 n -0000182631 00000 n -0000182807 00000 n -0000183015 00000 n -0000183516 00000 n -0000183579 00000 n -0000183641 00000 n -0000183704 00000 n -0000188490 00000 n -0000187183 00000 n -0000183891 00000 n -0000187306 00000 n -0000187369 00000 n -0000187494 00000 n -0000187619 00000 n -0000187744 00000 n -0000187869 00000 n -0000187931 00000 n -0000187993 00000 n -0000188056 00000 n -0000188119 00000 n -0000188182 00000 n -0000188307 00000 n -0000188428 00000 n -0000192289 00000 n -0000190983 00000 n -0000188590 00000 n -0000191106 00000 n -0000191231 00000 n -0000191354 00000 n -0000191479 00000 n -0000191604 00000 n -0000191729 00000 n -0000191854 00000 n -0000191979 00000 n -0000192101 00000 n -0000192226 00000 n -0000196296 00000 n -0000195111 00000 n -0000192402 00000 n -0000195234 00000 n -0000195359 00000 n -0000195484 00000 n -0000195609 00000 n -0000195734 00000 n -0000195858 00000 n -0000195983 00000 n -0000196108 00000 n -0000196233 00000 n -0000457639 00000 n -0000200381 00000 n -0000199447 00000 n -0000196409 00000 n -0000199570 00000 n -0000199695 00000 n -0000199819 00000 n -0000199944 00000 n -0000200069 00000 n -0000200194 00000 n -0000200319 00000 n -0000204118 00000 n -0000203307 00000 n -0000200507 00000 n -0000203430 00000 n -0000203555 00000 n -0000203680 00000 n -0000203805 00000 n -0000203930 00000 n -0000204055 00000 n -0000207810 00000 n -0000207375 00000 n -0000204244 00000 n -0000207498 00000 n -0000207623 00000 n -0000207748 00000 n -0000212719 00000 n -0000212283 00000 n -0000207923 00000 n -0000212406 00000 n -0000212531 00000 n -0000212656 00000 n -0000216691 00000 n -0000216130 00000 n -0000212845 00000 n -0000216253 00000 n -0000216378 00000 n -0000216503 00000 n -0000216628 00000 n -0000220695 00000 n -0000220009 00000 n -0000216830 00000 n -0000220132 00000 n -0000220257 00000 n -0000220382 00000 n -0000220507 00000 n -0000220632 00000 n -0000457764 00000 n -0000225051 00000 n -0000224116 00000 n -0000220821 00000 n -0000224239 00000 n -0000224364 00000 n -0000224489 00000 n -0000224614 00000 n -0000224739 00000 n -0000224864 00000 n -0000224988 00000 n -0000228989 00000 n -0000228429 00000 n -0000225177 00000 n -0000228552 00000 n -0000228676 00000 n -0000228801 00000 n -0000228926 00000 n -0000232338 00000 n -0000230902 00000 n -0000229115 00000 n -0000231025 00000 n -0000231150 00000 n -0000231275 00000 n -0000231400 00000 n -0000231525 00000 n -0000231650 00000 n -0000231775 00000 n -0000231900 00000 n -0000232025 00000 n -0000232150 00000 n -0000232275 00000 n -0000236083 00000 n -0000234899 00000 n -0000232464 00000 n -0000235022 00000 n -0000235147 00000 n -0000235272 00000 n -0000235396 00000 n -0000235521 00000 n -0000235646 00000 n -0000235771 00000 n -0000235895 00000 n -0000236020 00000 n -0000240011 00000 n -0000239202 00000 n -0000236196 00000 n -0000239325 00000 n -0000239450 00000 n -0000239575 00000 n -0000239700 00000 n -0000239825 00000 n -0000239950 00000 n -0000243893 00000 n -0000242708 00000 n -0000240137 00000 n -0000242831 00000 n -0000242956 00000 n -0000243081 00000 n -0000243206 00000 n -0000243331 00000 n -0000243456 00000 n -0000243581 00000 n -0000243706 00000 n -0000243831 00000 n -0000457889 00000 n -0000247006 00000 n -0000246073 00000 n -0000244006 00000 n -0000246196 00000 n -0000246321 00000 n -0000246446 00000 n -0000246569 00000 n -0000246693 00000 n -0000246818 00000 n -0000246943 00000 n -0000250391 00000 n -0000249580 00000 n -0000247158 00000 n -0000249703 00000 n -0000249828 00000 n -0000249953 00000 n +0000087033 00000 n +0000087187 00000 n +0000087342 00000 n +0000087498 00000 n +0000087659 00000 n +0000087818 00000 n +0000087973 00000 n +0000088134 00000 n +0000088288 00000 n +0000088444 00000 n +0000088600 00000 n +0000088754 00000 n +0000088909 00000 n +0000089070 00000 n +0000089231 00000 n +0000089387 00000 n +0000089547 00000 n +0000089708 00000 n +0000089864 00000 n +0000090025 00000 n +0000090181 00000 n +0000090342 00000 n +0000090503 00000 n +0000090657 00000 n +0000090812 00000 n +0000090968 00000 n +0000094032 00000 n +0000093600 00000 n +0000091284 00000 n +0000093723 00000 n +0000093969 00000 n +0000098019 00000 n +0000097585 00000 n +0000094118 00000 n +0000097708 00000 n +0000097832 00000 n +0000097956 00000 n +0000101379 00000 n +0000100450 00000 n +0000098132 00000 n +0000100573 00000 n +0000100820 00000 n +0000100883 00000 n +0000100944 00000 n +0000101007 00000 n +0000101130 00000 n +0000101254 00000 n +0000101317 00000 n +0000105606 00000 n +0000104858 00000 n +0000101465 00000 n +0000104981 00000 n +0000105044 00000 n +0000105107 00000 n +0000105170 00000 n +0000105233 00000 n +0000105296 00000 n +0000105420 00000 n +0000105543 00000 n +0000482188 00000 n +0000107114 00000 n +0000106928 00000 n +0000105706 00000 n +0000107051 00000 n +0000109535 00000 n +0000108913 00000 n +0000107201 00000 n +0000109036 00000 n +0000109283 00000 n +0000109346 00000 n +0000109409 00000 n +0000109472 00000 n +0000111804 00000 n +0000111431 00000 n +0000109634 00000 n +0000111554 00000 n +0000111617 00000 n +0000111741 00000 n +0000114008 00000 n +0000113699 00000 n +0000111917 00000 n +0000113822 00000 n +0000113946 00000 n +0000116273 00000 n +0000115774 00000 n +0000114134 00000 n +0000115897 00000 n +0000116021 00000 n +0000116084 00000 n +0000116147 00000 n +0000116210 00000 n +0000118900 00000 n +0000118219 00000 n +0000116386 00000 n +0000118342 00000 n +0000118466 00000 n +0000118590 00000 n +0000118713 00000 n +0000118837 00000 n +0000482313 00000 n +0000122676 00000 n +0000121758 00000 n +0000119000 00000 n +0000122301 00000 n +0000121911 00000 n +0000122111 00000 n +0000122487 00000 n +0000122550 00000 n +0000122613 00000 n +0000127623 00000 n +0000126243 00000 n +0000122775 00000 n +0000126366 00000 n +0000126429 00000 n +0000126492 00000 n +0000126555 00000 n +0000126618 00000 n +0000126681 00000 n +0000126744 00000 n +0000126807 00000 n +0000126870 00000 n +0000126933 00000 n +0000126995 00000 n +0000127058 00000 n +0000127121 00000 n +0000127183 00000 n +0000127246 00000 n +0000127309 00000 n +0000127372 00000 n +0000127435 00000 n +0000127498 00000 n +0000127561 00000 n +0000129802 00000 n +0000129427 00000 n +0000127710 00000 n +0000129550 00000 n +0000129613 00000 n +0000129676 00000 n +0000129739 00000 n +0000133294 00000 n +0000132297 00000 n +0000129889 00000 n +0000132420 00000 n +0000132667 00000 n +0000132791 00000 n +0000132854 00000 n +0000132917 00000 n +0000132980 00000 n +0000133043 00000 n +0000133106 00000 n +0000133169 00000 n +0000133232 00000 n +0000137313 00000 n +0000136377 00000 n +0000133380 00000 n +0000136500 00000 n +0000136563 00000 n +0000136626 00000 n +0000136689 00000 n +0000136752 00000 n +0000136875 00000 n +0000137000 00000 n +0000137125 00000 n +0000137250 00000 n +0000140207 00000 n +0000138900 00000 n +0000137413 00000 n +0000139023 00000 n +0000139148 00000 n +0000139272 00000 n +0000139397 00000 n +0000139522 00000 n +0000139647 00000 n +0000139772 00000 n +0000139896 00000 n +0000140020 00000 n +0000140145 00000 n +0000482438 00000 n +0000143277 00000 n +0000142093 00000 n +0000140307 00000 n +0000142216 00000 n +0000142341 00000 n +0000142465 00000 n +0000142589 00000 n +0000142714 00000 n +0000142839 00000 n +0000142900 00000 n +0000142962 00000 n +0000143025 00000 n +0000143088 00000 n +0000143151 00000 n +0000143214 00000 n +0000147484 00000 n +0000146483 00000 n +0000143390 00000 n +0000146606 00000 n +0000146669 00000 n +0000146732 00000 n +0000146795 00000 n +0000146857 00000 n +0000146920 00000 n +0000146983 00000 n +0000147046 00000 n +0000147108 00000 n +0000147233 00000 n +0000147296 00000 n +0000147359 00000 n +0000147421 00000 n +0000150512 00000 n +0000149572 00000 n +0000147584 00000 n +0000149695 00000 n +0000149820 00000 n +0000149883 00000 n +0000149946 00000 n +0000150009 00000 n +0000150072 00000 n +0000150135 00000 n +0000150198 00000 n +0000150261 00000 n +0000150323 00000 n +0000150386 00000 n +0000150449 00000 n +0000153960 00000 n +0000152710 00000 n +0000150612 00000 n +0000152833 00000 n +0000153082 00000 n +0000153145 00000 n +0000153208 00000 n +0000153271 00000 n +0000153333 00000 n +0000153396 00000 n +0000153459 00000 n +0000153521 00000 n +0000153646 00000 n +0000153709 00000 n +0000153772 00000 n +0000153835 00000 n +0000153898 00000 n +0000156112 00000 n +0000155676 00000 n +0000154059 00000 n +0000155799 00000 n +0000155924 00000 n +0000156049 00000 n +0000158309 00000 n +0000157748 00000 n +0000156238 00000 n +0000157871 00000 n +0000157994 00000 n +0000158057 00000 n +0000158120 00000 n +0000158183 00000 n +0000158246 00000 n +0000482563 00000 n +0000159388 00000 n +0000159077 00000 n +0000158435 00000 n +0000159200 00000 n +0000159325 00000 n +0000162624 00000 n +0000162064 00000 n +0000159488 00000 n +0000162187 00000 n +0000162436 00000 n +0000162561 00000 n +0000166285 00000 n +0000165724 00000 n +0000162723 00000 n +0000165847 00000 n +0000165972 00000 n +0000166097 00000 n +0000166222 00000 n +0000170108 00000 n +0000169548 00000 n +0000166385 00000 n +0000169671 00000 n +0000169796 00000 n +0000169920 00000 n +0000170045 00000 n +0000173970 00000 n +0000173661 00000 n +0000170221 00000 n +0000173784 00000 n +0000173909 00000 n +0000177051 00000 n +0000176741 00000 n +0000174070 00000 n +0000176864 00000 n +0000391713 00000 n +0000382815 00000 n +0000391547 00000 n +0000382580 00000 n +0000380705 00000 n +0000382414 00000 n +0000482688 00000 n +0000179121 00000 n +0000178935 00000 n +0000177178 00000 n +0000179058 00000 n +0000180914 00000 n +0000180165 00000 n +0000179249 00000 n +0000180288 00000 n +0000180537 00000 n +0000180600 00000 n +0000180663 00000 n +0000180726 00000 n +0000180788 00000 n +0000180851 00000 n +0000185639 00000 n +0000183763 00000 n +0000181013 00000 n +0000185326 00000 n +0000185576 00000 n +0000183961 00000 n +0000184154 00000 n +0000184348 00000 n +0000184570 00000 n +0000184757 00000 n +0000184933 00000 n +0000185139 00000 n +0000189400 00000 n +0000188280 00000 n +0000185764 00000 n +0000188403 00000 n +0000188466 00000 n +0000188529 00000 n +0000188592 00000 n +0000188651 00000 n +0000188714 00000 n +0000188839 00000 n +0000188964 00000 n +0000189089 00000 n +0000189212 00000 n +0000189275 00000 n +0000189338 00000 n +0000192735 00000 n +0000191987 00000 n +0000189500 00000 n +0000192110 00000 n +0000192173 00000 n +0000192236 00000 n +0000192299 00000 n +0000192424 00000 n +0000192547 00000 n +0000192672 00000 n +0000195455 00000 n +0000194398 00000 n +0000192835 00000 n +0000194521 00000 n +0000194646 00000 n +0000194771 00000 n +0000194896 00000 n +0000195021 00000 n +0000195143 00000 n +0000195268 00000 n +0000195393 00000 n +0000482813 00000 n +0000198039 00000 n +0000197103 00000 n +0000195568 00000 n +0000197226 00000 n +0000197351 00000 n +0000197476 00000 n +0000197601 00000 n +0000197726 00000 n +0000197851 00000 n +0000197976 00000 n +0000200926 00000 n +0000200242 00000 n +0000198139 00000 n +0000200365 00000 n +0000200490 00000 n +0000200614 00000 n +0000200739 00000 n +0000200864 00000 n +0000203773 00000 n +0000203090 00000 n +0000201052 00000 n +0000203213 00000 n +0000203338 00000 n +0000203463 00000 n +0000203587 00000 n +0000203711 00000 n +0000206417 00000 n +0000205981 00000 n +0000203899 00000 n +0000206104 00000 n +0000206229 00000 n +0000206354 00000 n +0000208892 00000 n +0000208332 00000 n +0000206543 00000 n +0000208455 00000 n +0000208580 00000 n +0000208704 00000 n +0000208829 00000 n +0000211038 00000 n +0000210727 00000 n +0000209005 00000 n +0000210850 00000 n +0000210975 00000 n +0000482938 00000 n +0000213797 00000 n +0000213361 00000 n +0000211151 00000 n +0000213484 00000 n +0000213609 00000 n +0000213734 00000 n +0000216788 00000 n +0000216352 00000 n +0000213910 00000 n +0000216475 00000 n +0000216600 00000 n +0000216725 00000 n +0000219823 00000 n +0000219512 00000 n +0000216914 00000 n +0000219635 00000 n +0000219760 00000 n +0000223219 00000 n +0000222783 00000 n +0000219923 00000 n +0000222906 00000 n +0000223031 00000 n +0000223156 00000 n +0000226151 00000 n +0000225715 00000 n +0000223358 00000 n +0000225838 00000 n +0000225963 00000 n +0000226088 00000 n +0000229059 00000 n +0000228373 00000 n +0000226277 00000 n +0000228496 00000 n +0000228621 00000 n +0000228746 00000 n +0000228871 00000 n +0000228996 00000 n +0000483063 00000 n +0000231673 00000 n +0000231112 00000 n +0000229159 00000 n +0000231235 00000 n +0000231360 00000 n +0000231485 00000 n +0000231610 00000 n +0000234559 00000 n +0000234125 00000 n +0000231773 00000 n +0000234248 00000 n +0000234373 00000 n +0000234496 00000 n +0000237140 00000 n +0000236579 00000 n +0000234685 00000 n +0000236702 00000 n +0000236827 00000 n +0000236952 00000 n +0000237077 00000 n +0000239622 00000 n +0000238687 00000 n +0000237266 00000 n +0000238810 00000 n +0000238935 00000 n +0000239060 00000 n +0000239184 00000 n +0000239309 00000 n +0000239434 00000 n +0000239559 00000 n +0000242322 00000 n +0000241136 00000 n +0000239748 00000 n +0000241259 00000 n +0000241384 00000 n +0000241509 00000 n +0000241634 00000 n +0000241759 00000 n +0000241884 00000 n +0000242009 00000 n +0000242134 00000 n +0000242259 00000 n +0000244947 00000 n +0000244386 00000 n +0000242435 00000 n +0000244509 00000 n +0000244634 00000 n +0000244759 00000 n +0000244884 00000 n +0000483188 00000 n +0000247726 00000 n +0000247166 00000 n +0000245060 00000 n +0000247289 00000 n +0000247414 00000 n +0000247539 00000 n +0000247664 00000 n +0000250641 00000 n +0000249955 00000 n +0000247852 00000 n 0000250078 00000 n 0000250203 00000 n 0000250328 00000 n -0000253973 00000 n -0000252915 00000 n -0000250517 00000 n -0000253038 00000 n -0000253163 00000 n -0000253286 00000 n -0000253411 00000 n -0000253536 00000 n -0000253661 00000 n -0000253785 00000 n -0000253910 00000 n -0000256971 00000 n -0000256410 00000 n -0000254086 00000 n -0000256533 00000 n -0000256658 00000 n -0000256783 00000 n -0000256908 00000 n -0000260597 00000 n -0000259787 00000 n -0000257084 00000 n -0000259910 00000 n -0000260035 00000 n -0000260160 00000 n -0000260285 00000 n -0000260410 00000 n -0000260535 00000 n -0000263930 00000 n -0000263245 00000 n -0000260710 00000 n -0000263368 00000 n -0000263493 00000 n -0000263618 00000 n -0000263743 00000 n -0000263868 00000 n -0000458014 00000 n -0000267934 00000 n -0000267248 00000 n -0000264043 00000 n -0000267371 00000 n -0000267621 00000 n -0000267746 00000 n -0000267871 00000 n -0000271760 00000 n -0000271072 00000 n -0000268046 00000 n -0000271195 00000 n -0000271258 00000 n -0000271321 00000 n -0000271384 00000 n -0000271447 00000 n -0000271510 00000 n -0000271573 00000 n -0000271635 00000 n -0000271698 00000 n -0000275351 00000 n -0000274915 00000 n -0000271873 00000 n -0000275038 00000 n -0000275163 00000 n -0000275288 00000 n -0000279613 00000 n -0000279427 00000 n -0000275477 00000 n -0000279550 00000 n -0000280717 00000 n -0000280531 00000 n -0000279726 00000 n -0000280654 00000 n -0000283457 00000 n -0000283021 00000 n -0000280817 00000 n -0000283144 00000 n -0000283394 00000 n -0000458139 00000 n -0000287518 00000 n -0000287082 00000 n -0000283556 00000 n -0000287205 00000 n -0000287455 00000 n -0000292048 00000 n -0000291241 00000 n -0000287617 00000 n -0000291364 00000 n -0000291489 00000 n -0000291613 00000 n -0000291737 00000 n -0000291860 00000 n -0000291985 00000 n -0000296277 00000 n -0000295467 00000 n -0000292161 00000 n -0000295590 00000 n -0000295715 00000 n -0000295840 00000 n -0000295965 00000 n -0000296090 00000 n -0000296214 00000 n -0000298601 00000 n -0000298290 00000 n -0000296390 00000 n -0000298413 00000 n -0000298538 00000 n -0000302537 00000 n -0000301977 00000 n -0000298727 00000 n -0000302100 00000 n -0000302350 00000 n -0000302474 00000 n -0000306367 00000 n -0000305995 00000 n -0000302636 00000 n -0000306118 00000 n -0000306243 00000 n -0000306305 00000 n -0000458264 00000 n -0000308094 00000 n -0000307908 00000 n -0000306519 00000 n -0000308031 00000 n -0000311633 00000 n -0000310822 00000 n -0000308220 00000 n -0000310945 00000 n -0000311195 00000 n -0000311320 00000 n -0000311445 00000 n -0000311570 00000 n -0000315131 00000 n -0000314695 00000 n -0000311732 00000 n -0000314818 00000 n -0000314943 00000 n -0000315068 00000 n -0000318411 00000 n -0000317850 00000 n -0000315257 00000 n -0000317973 00000 n -0000318223 00000 n -0000318348 00000 n -0000320399 00000 n -0000319838 00000 n -0000318536 00000 n -0000319961 00000 n -0000320211 00000 n -0000320336 00000 n -0000321770 00000 n -0000321584 00000 n -0000320498 00000 n -0000321707 00000 n -0000458389 00000 n -0000324876 00000 n -0000324315 00000 n -0000321883 00000 n -0000324438 00000 n -0000324563 00000 n -0000324688 00000 n -0000324813 00000 n -0000327728 00000 n -0000327417 00000 n -0000325002 00000 n -0000327540 00000 n -0000327665 00000 n -0000330506 00000 n -0000330320 00000 n -0000327854 00000 n -0000330443 00000 n -0000332014 00000 n -0000331828 00000 n -0000330632 00000 n -0000331951 00000 n -0000335490 00000 n -0000334739 00000 n -0000332114 00000 n -0000334862 00000 n -0000334987 00000 n -0000335112 00000 n -0000335175 00000 n -0000335238 00000 n -0000335301 00000 n -0000335364 00000 n -0000335427 00000 n -0000337031 00000 n -0000336720 00000 n -0000335616 00000 n -0000336843 00000 n -0000336906 00000 n -0000336969 00000 n -0000458514 00000 n -0000340490 00000 n -0000339944 00000 n -0000337144 00000 n -0000340239 00000 n -0000340302 00000 n -0000340365 00000 n -0000340088 00000 n -0000340428 00000 n -0000341831 00000 n -0000341645 00000 n -0000340603 00000 n -0000341768 00000 n -0000344033 00000 n -0000343721 00000 n -0000341931 00000 n -0000343844 00000 n -0000343907 00000 n -0000343970 00000 n -0000346124 00000 n -0000345563 00000 n -0000344133 00000 n -0000345686 00000 n -0000345811 00000 n -0000345936 00000 n -0000346061 00000 n -0000347945 00000 n -0000347384 00000 n -0000346237 00000 n -0000347507 00000 n -0000347757 00000 n -0000347882 00000 n -0000352037 00000 n -0000351339 00000 n -0000348044 00000 n -0000351849 00000 n -0000351492 00000 n -0000351668 00000 n -0000458639 00000 n -0000352123 00000 n -0000355205 00000 n -0000355230 00000 n -0000365690 00000 n +0000250453 00000 n +0000250578 00000 n +0000253669 00000 n +0000252735 00000 n +0000250754 00000 n +0000252858 00000 n +0000252983 00000 n +0000253108 00000 n +0000253233 00000 n +0000253358 00000 n +0000253483 00000 n +0000253607 00000 n +0000255972 00000 n +0000255287 00000 n +0000253782 00000 n +0000255410 00000 n +0000255535 00000 n +0000255660 00000 n +0000255784 00000 n +0000255909 00000 n +0000258591 00000 n +0000257905 00000 n +0000256098 00000 n +0000258028 00000 n +0000258153 00000 n +0000258278 00000 n +0000258403 00000 n +0000258528 00000 n +0000260983 00000 n +0000260422 00000 n +0000258730 00000 n +0000260545 00000 n +0000260670 00000 n +0000260795 00000 n +0000260920 00000 n +0000483313 00000 n +0000263715 00000 n +0000263031 00000 n +0000261109 00000 n +0000263154 00000 n +0000263279 00000 n +0000263403 00000 n +0000263527 00000 n +0000263652 00000 n +0000266698 00000 n +0000265887 00000 n +0000263828 00000 n +0000266010 00000 n +0000266135 00000 n +0000266260 00000 n +0000266385 00000 n +0000266510 00000 n +0000266635 00000 n +0000268447 00000 n +0000268136 00000 n +0000266811 00000 n +0000268259 00000 n +0000268384 00000 n +0000271396 00000 n +0000270711 00000 n +0000268560 00000 n +0000270834 00000 n +0000270958 00000 n +0000271083 00000 n +0000271208 00000 n +0000271333 00000 n +0000273973 00000 n +0000273414 00000 n +0000271509 00000 n +0000273537 00000 n +0000273662 00000 n +0000273785 00000 n +0000273910 00000 n +0000275916 00000 n +0000275480 00000 n +0000274086 00000 n +0000275603 00000 n +0000275728 00000 n +0000275853 00000 n +0000483438 00000 n +0000278587 00000 n +0000277902 00000 n +0000276029 00000 n +0000278025 00000 n +0000278275 00000 n +0000278400 00000 n +0000278525 00000 n +0000282586 00000 n +0000282149 00000 n +0000278686 00000 n +0000282272 00000 n +0000282335 00000 n +0000282398 00000 n +0000282461 00000 n +0000282524 00000 n +0000285824 00000 n +0000285136 00000 n +0000282699 00000 n +0000285259 00000 n +0000285322 00000 n +0000285385 00000 n +0000285448 00000 n +0000285511 00000 n +0000285636 00000 n +0000285761 00000 n +0000288175 00000 n +0000287989 00000 n +0000285937 00000 n +0000288112 00000 n +0000291727 00000 n +0000291541 00000 n +0000288288 00000 n +0000291664 00000 n +0000293047 00000 n +0000292861 00000 n +0000291840 00000 n +0000292984 00000 n +0000483563 00000 n +0000295334 00000 n +0000294898 00000 n +0000293147 00000 n +0000295021 00000 n +0000295271 00000 n +0000296479 00000 n +0000296293 00000 n +0000295433 00000 n +0000296416 00000 n +0000299532 00000 n +0000299096 00000 n +0000296566 00000 n +0000299219 00000 n +0000299469 00000 n +0000303463 00000 n +0000303028 00000 n +0000299631 00000 n +0000303151 00000 n +0000303276 00000 n +0000303400 00000 n +0000307166 00000 n +0000306230 00000 n +0000303576 00000 n +0000306353 00000 n +0000306478 00000 n +0000306603 00000 n +0000306728 00000 n +0000306853 00000 n +0000306978 00000 n +0000307103 00000 n +0000310244 00000 n +0000309808 00000 n +0000307279 00000 n +0000309931 00000 n +0000310056 00000 n +0000310181 00000 n +0000483688 00000 n +0000312303 00000 n +0000311992 00000 n +0000310357 00000 n +0000312115 00000 n +0000312240 00000 n +0000315685 00000 n +0000315125 00000 n +0000312430 00000 n +0000315248 00000 n +0000315498 00000 n +0000315623 00000 n +0000318823 00000 n +0000318449 00000 n +0000315771 00000 n +0000318572 00000 n +0000318697 00000 n +0000318760 00000 n +0000321610 00000 n +0000321424 00000 n +0000318963 00000 n +0000321547 00000 n +0000324119 00000 n +0000323434 00000 n +0000321737 00000 n +0000323557 00000 n +0000323807 00000 n +0000323932 00000 n +0000324056 00000 n +0000327664 00000 n +0000327104 00000 n +0000324218 00000 n +0000327227 00000 n +0000327352 00000 n +0000327477 00000 n +0000327601 00000 n +0000483813 00000 n +0000329435 00000 n +0000331028 00000 n +0000329312 00000 n +0000327777 00000 n +0000330965 00000 n +0000379399 00000 n +0000377064 00000 n +0000379232 00000 n +0000375441 00000 n +0000369394 00000 n +0000375275 00000 n +0000330794 00000 n +0000330852 00000 n +0000330942 00000 n +0000334326 00000 n +0000333765 00000 n +0000331199 00000 n +0000333888 00000 n +0000334138 00000 n +0000334263 00000 n +0000336198 00000 n +0000335637 00000 n +0000334451 00000 n +0000335760 00000 n +0000336010 00000 n +0000336135 00000 n +0000337535 00000 n +0000337349 00000 n +0000336297 00000 n +0000337472 00000 n +0000340006 00000 n +0000339695 00000 n +0000337648 00000 n +0000339818 00000 n +0000339943 00000 n +0000342601 00000 n +0000342165 00000 n +0000340132 00000 n +0000342288 00000 n +0000342413 00000 n +0000342538 00000 n +0000483938 00000 n +0000345452 00000 n +0000345141 00000 n +0000342728 00000 n +0000345264 00000 n +0000345389 00000 n +0000347142 00000 n +0000346956 00000 n +0000345592 00000 n +0000347079 00000 n +0000348603 00000 n +0000348417 00000 n +0000347242 00000 n +0000348540 00000 n +0000352039 00000 n +0000351289 00000 n +0000348703 00000 n +0000351412 00000 n +0000351537 00000 n +0000351662 00000 n +0000351725 00000 n +0000351788 00000 n +0000351851 00000 n +0000351914 00000 n +0000351976 00000 n +0000353151 00000 n +0000352965 00000 n +0000352165 00000 n +0000353088 00000 n +0000356577 00000 n +0000355903 00000 n +0000353264 00000 n +0000356199 00000 n +0000356262 00000 n +0000356325 00000 n +0000356388 00000 n +0000356451 00000 n +0000356047 00000 n +0000356514 00000 n +0000484063 00000 n +0000357939 00000 n +0000357753 00000 n +0000356690 00000 n +0000357876 00000 n +0000359416 00000 n +0000359168 00000 n +0000358039 00000 n +0000359291 00000 n +0000359354 00000 n +0000362046 00000 n +0000361427 00000 n +0000359516 00000 n +0000361550 00000 n +0000361613 00000 n +0000361738 00000 n +0000361863 00000 n +0000361983 00000 n +0000362713 00000 n +0000362527 00000 n +0000362159 00000 n +0000362650 00000 n +0000364510 00000 n +0000363949 00000 n +0000362813 00000 n +0000364072 00000 n +0000364322 00000 n +0000364447 00000 n +0000368361 00000 n +0000367664 00000 n +0000364609 00000 n 0000368173 00000 n -0000368204 00000 n -0000371597 00000 n -0000381801 00000 n -0000382076 00000 n -0000399833 00000 n -0000419130 00000 n -0000419559 00000 n -0000437152 00000 n -0000442576 00000 n -0000456493 00000 n -0000458719 00000 n -0000458844 00000 n -0000458970 00000 n -0000459069 00000 n -0000459151 00000 n -0000481181 00000 n -0000496580 00000 n -0000496621 00000 n -0000496661 00000 n -0000496892 00000 n +0000367817 00000 n +0000367993 00000 n +0000484188 00000 n +0000368447 00000 n +0000375737 00000 n +0000376054 00000 n +0000379602 00000 n +0000379709 00000 n +0000382790 00000 n +0000392049 00000 n +0000401829 00000 n +0000404312 00000 n +0000404343 00000 n +0000408177 00000 n +0000408398 00000 n +0000425874 00000 n +0000445227 00000 n +0000445658 00000 n +0000463251 00000 n +0000467648 00000 n +0000481543 00000 n +0000484268 00000 n +0000484393 00000 n +0000484519 00000 n +0000484645 00000 n +0000484725 00000 n +0000484817 00000 n +0000506847 00000 n +0000522723 00000 n +0000522764 00000 n +0000522804 00000 n +0000523035 00000 n trailer << -/Size 1983 -/Root 1981 0 R -/Info 1982 0 R +/Size 2097 +/Root 2095 0 R +/Info 2096 0 R >> startxref -497048 +523191 %%EOF diff --git a/docs/Samba-HOWTO-Collection.pdf b/docs/Samba-HOWTO-Collection.pdf index 5c604b7003..a33f75fa06 100644 --- a/docs/Samba-HOWTO-Collection.pdf +++ b/docs/Samba-HOWTO-Collection.pdf @@ -99,7 +99,7 @@ endobj << /S /GoTo /D (section.2.5) >> endobj 72 0 obj -(2.5 Try connecting from a DOS, WfWg, Win9x, WinNT, Win2k, OS/2, etc... client) +(2.5 Try connecting from another SMB client) endobj 73 0 obj << /S /GoTo /D (section.2.6) >> @@ -117,25041 +117,26857 @@ endobj << /S /GoTo /D (subsection.2.7.1) >> endobj 84 0 obj -(2.7.1 Why are so many smbd processes eating memory?) +(2.7.1 Large number of smbd processes) endobj 85 0 obj << /S /GoTo /D (subsection.2.7.2) >> endobj 88 0 obj -(2.7.2 I'm getting "open\137oplock\137ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs) +(2.7.2 "open\137oplock\137ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested") endobj 89 0 obj -<< /S /GoTo /D (chapter.3) >> +<< /S /GoTo /D (subsection.2.7.3) >> endobj 92 0 obj -(3 Fast Start for the Impatient) +(2.7.3 "The network name cannot be found") endobj 93 0 obj -<< /S /GoTo /D (section.3.1) >> +<< /S /GoTo /D (chapter.3) >> endobj 96 0 obj -(3.1 Note) +(3 Fast Start for the Impatient) endobj 97 0 obj -<< /S /GoTo /D (part.2) >> +<< /S /GoTo /D (section.3.1) >> endobj 100 0 obj -(II Server Configuration Basics) +(3.1 Note) endobj 101 0 obj -<< /S /GoTo /D (chapter.4) >> +<< /S /GoTo /D (part.2) >> endobj 104 0 obj -(4 Server Types and Security Modes) +(II Server Configuration Basics) endobj 105 0 obj -<< /S /GoTo /D (section.4.1) >> +<< /S /GoTo /D (chapter.4) >> endobj 108 0 obj -(4.1 Features and Benefits) +(4 Server Types and Security Modes) endobj 109 0 obj -<< /S /GoTo /D (section.4.2) >> +<< /S /GoTo /D (section.4.1) >> endobj 112 0 obj -(4.2 Server Types) +(4.1 Features and Benefits) endobj 113 0 obj -<< /S /GoTo /D (section.4.3) >> +<< /S /GoTo /D (section.4.2) >> endobj 116 0 obj -(4.3 Samba Security Modes) +(4.2 Server Types) endobj 117 0 obj -<< /S /GoTo /D (subsection.4.3.1) >> +<< /S /GoTo /D (section.4.3) >> endobj 120 0 obj -(4.3.1 User Level Security) +(4.3 Samba Security Modes) endobj 121 0 obj -<< /S /GoTo /D (subsubsection.4.3.1.1) >> +<< /S /GoTo /D (subsection.4.3.1) >> endobj 124 0 obj -(4.3.1.1 Example Configuration) +(4.3.1 User Level Security) endobj 125 0 obj -<< /S /GoTo /D (subsection.4.3.2) >> +<< /S /GoTo /D (subsubsection.4.3.1.1) >> endobj 128 0 obj -(4.3.2 Share Level Security) +(4.3.1.1 Example Configuration) endobj 129 0 obj -<< /S /GoTo /D (subsubsection.4.3.2.1) >> +<< /S /GoTo /D (subsection.4.3.2) >> endobj 132 0 obj -(4.3.2.1 Example Configuration) +(4.3.2 Share Level Security) endobj 133 0 obj -<< /S /GoTo /D (subsection.4.3.3) >> +<< /S /GoTo /D (subsubsection.4.3.2.1) >> endobj 136 0 obj -(4.3.3 Domain Security Mode \(User Level Security\)) +(4.3.2.1 Example Configuration) endobj 137 0 obj -<< /S /GoTo /D (subsubsection.4.3.3.1) >> +<< /S /GoTo /D (subsection.4.3.3) >> endobj 140 0 obj -(4.3.3.1 Example Configuration) +(4.3.3 Domain Security Mode \(User Level Security\)) endobj 141 0 obj -<< /S /GoTo /D (subsection.4.3.4) >> +<< /S /GoTo /D (subsubsection.4.3.3.1) >> endobj 144 0 obj -(4.3.4 ADS Security Mode \(User Level Security\)) +(4.3.3.1 Example Configuration) endobj 145 0 obj -<< /S /GoTo /D (subsubsection.4.3.4.1) >> +<< /S /GoTo /D (subsection.4.3.4) >> endobj 148 0 obj -(4.3.4.1 Example Configuration) +(4.3.4 ADS Security Mode \(User Level Security\)) endobj 149 0 obj -<< /S /GoTo /D (subsection.4.3.5) >> +<< /S /GoTo /D (subsubsection.4.3.4.1) >> endobj 152 0 obj -(4.3.5 Server Security \(User Level Security\)) +(4.3.4.1 Example Configuration) endobj 153 0 obj -<< /S /GoTo /D (subsubsection.4.3.5.1) >> +<< /S /GoTo /D (subsection.4.3.5) >> endobj 156 0 obj -(4.3.5.1 Example Configuration) +(4.3.5 Server Security \(User Level Security\)) endobj 157 0 obj -<< /S /GoTo /D (section.4.4) >> +<< /S /GoTo /D (subsubsection.4.3.5.1) >> endobj 160 0 obj -(4.4 Seamless Windows Network Integration) +(4.3.5.1 Example Configuration) endobj 161 0 obj -<< /S /GoTo /D (section.4.5) >> +<< /S /GoTo /D (section.4.4) >> endobj 164 0 obj -(4.5 Common Errors) +(4.4 Password checking) endobj 165 0 obj -<< /S /GoTo /D (subsection.4.5.1) >> +<< /S /GoTo /D (section.4.5) >> endobj 168 0 obj -(4.5.1 What makes Samba a SERVER?) +(4.5 Common Errors) endobj 169 0 obj -<< /S /GoTo /D (subsection.4.5.2) >> +<< /S /GoTo /D (subsection.4.5.1) >> endobj 172 0 obj -(4.5.2 What makes Samba a Domain Controller?) +(4.5.1 What makes Samba a SERVER?) endobj 173 0 obj -<< /S /GoTo /D (subsection.4.5.3) >> +<< /S /GoTo /D (subsection.4.5.2) >> endobj 176 0 obj -(4.5.3 What makes Samba a Domain Member?) +(4.5.2 What makes Samba a Domain Controller?) endobj 177 0 obj -<< /S /GoTo /D (subsection.4.5.4) >> +<< /S /GoTo /D (subsection.4.5.3) >> endobj 180 0 obj -(4.5.4 Constantly Losing Connections to Password Server) +(4.5.3 What makes Samba a Domain Member?) endobj 181 0 obj -<< /S /GoTo /D (chapter.5) >> +<< /S /GoTo /D (subsection.4.5.4) >> endobj 184 0 obj -(5 Domain Control) +(4.5.4 Constantly Losing Connections to Password Server) endobj 185 0 obj -<< /S /GoTo /D (section.5.1) >> +<< /S /GoTo /D (chapter.5) >> endobj 188 0 obj -(5.1 Features and Benefits) +(5 Domain Control) endobj 189 0 obj -<< /S /GoTo /D (section.5.2) >> +<< /S /GoTo /D (section.5.1) >> endobj 192 0 obj -(5.2 Basics of Domain Control) +(5.1 Features and Benefits) endobj 193 0 obj -<< /S /GoTo /D (subsection.5.2.1) >> +<< /S /GoTo /D (section.5.2) >> endobj 196 0 obj -(5.2.1 Domain Controller Types) +(5.2 Basics of Domain Control) endobj 197 0 obj -<< /S /GoTo /D (subsection.5.2.2) >> +<< /S /GoTo /D (subsection.5.2.1) >> endobj 200 0 obj -(5.2.2 Preparing for Domain Control) +(5.2.1 Domain Controller Types) endobj 201 0 obj -<< /S /GoTo /D (section.5.3) >> +<< /S /GoTo /D (subsection.5.2.2) >> endobj 204 0 obj -(5.3 Domain Control - Example Configuration) +(5.2.2 Preparing for Domain Control) endobj 205 0 obj -<< /S /GoTo /D (section.5.4) >> +<< /S /GoTo /D (section.5.3) >> endobj 208 0 obj -(5.4 Samba ADS Domain Control) +(5.3 Domain Control - Example Configuration) endobj 209 0 obj -<< /S /GoTo /D (section.5.5) >> +<< /S /GoTo /D (section.5.4) >> endobj 212 0 obj -(5.5 Domain and Network Logon Configuration) +(5.4 Samba ADS Domain Control) endobj 213 0 obj -<< /S /GoTo /D (subsection.5.5.1) >> +<< /S /GoTo /D (section.5.5) >> endobj 216 0 obj -(5.5.1 Domain Network Logon Service) +(5.5 Domain and Network Logon Configuration) endobj 217 0 obj -<< /S /GoTo /D (subsubsection.5.5.1.1) >> +<< /S /GoTo /D (subsection.5.5.1) >> endobj 220 0 obj -(5.5.1.1 Example Configuration) +(5.5.1 Domain Network Logon Service) endobj 221 0 obj -<< /S /GoTo /D (subsubsection.5.5.1.2) >> +<< /S /GoTo /D (subsubsection.5.5.1.1) >> endobj 224 0 obj -(5.5.1.2 The Special Case of MS Windows XP Home Edition) +(5.5.1.1 Example Configuration) endobj 225 0 obj -<< /S /GoTo /D (subsubsection.5.5.1.3) >> +<< /S /GoTo /D (subsubsection.5.5.1.2) >> endobj 228 0 obj -(5.5.1.3 The Special Case of Windows 9x / Me) +(5.5.1.2 The Special Case of MS Windows XP Home Edition) endobj 229 0 obj -<< /S /GoTo /D (subsection.5.5.2) >> +<< /S /GoTo /D (subsubsection.5.5.1.3) >> endobj 232 0 obj -(5.5.2 Security Mode and Master Browsers) +(5.5.1.3 The Special Case of Windows 9x / Me) endobj 233 0 obj -<< /S /GoTo /D (section.5.6) >> +<< /S /GoTo /D (subsection.5.5.2) >> endobj 236 0 obj -(5.6 Common Problems and Errors) +(5.5.2 Security Mode and Master Browsers) endobj 237 0 obj -<< /S /GoTo /D (subsection.5.6.1) >> +<< /S /GoTo /D (section.5.6) >> endobj 240 0 obj -(5.6.1 I cannot include a '\044' in a machine name) +(5.6 Common Errors) endobj 241 0 obj -<< /S /GoTo /D (subsection.5.6.2) >> +<< /S /GoTo /D (subsection.5.6.1) >> endobj 244 0 obj -(5.6.2 I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an existing set.." when creating a machine trust account.) +(5.6.1 '\044' cannot be included in machine name) endobj 245 0 obj -<< /S /GoTo /D (subsection.5.6.3) >> +<< /S /GoTo /D (subsection.5.6.2) >> endobj 248 0 obj -(5.6.3 The system can not log you on \(C000019B\)....) +(5.6.2 Joining domain fails because of existing machine account) endobj 249 0 obj -<< /S /GoTo /D (subsection.5.6.4) >> +<< /S /GoTo /D (subsection.5.6.3) >> endobj 252 0 obj -(5.6.4 The machine trust account for this computer either does not exist or is not accessible.) +(5.6.3 The system can not log you on \(C000019B\)....) endobj 253 0 obj -<< /S /GoTo /D (subsection.5.6.5) >> +<< /S /GoTo /D (subsection.5.6.4) >> endobj 256 0 obj -(5.6.5 When I attempt to login to a Samba Domain from a NT4/W2K workstation, I get a message about my account being disabled.) +(5.6.4 The machine trust account not accessible) endobj 257 0 obj -<< /S /GoTo /D (subsection.5.6.6) >> +<< /S /GoTo /D (subsection.5.6.5) >> endobj 260 0 obj -(5.6.6 Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable") +(5.6.5 Account disabled) endobj 261 0 obj -<< /S /GoTo /D (chapter.6) >> +<< /S /GoTo /D (subsection.5.6.6) >> endobj 264 0 obj -(6 Backup Domain Control) +(5.6.6 Domain Controller Unavailable) endobj 265 0 obj -<< /S /GoTo /D (section.6.1) >> +<< /S /GoTo /D (subsection.5.6.7) >> endobj 268 0 obj -(6.1 Features And Benefits) +(5.6.7 Can not log onto domain member workstation after joining domain) endobj 269 0 obj -<< /S /GoTo /D (section.6.2) >> +<< /S /GoTo /D (chapter.6) >> endobj 272 0 obj -(6.2 Essential Background Information) +(6 Backup Domain Control) endobj 273 0 obj -<< /S /GoTo /D (subsection.6.2.1) >> +<< /S /GoTo /D (section.6.1) >> endobj 276 0 obj -(6.2.1 MS Windows NT4 Style Domain Control) +(6.1 Features And Benefits) endobj 277 0 obj -<< /S /GoTo /D (subsubsection.6.2.1.1) >> +<< /S /GoTo /D (section.6.2) >> endobj 280 0 obj -(6.2.1.1 Example PDC Configuration) +(6.2 Essential Background Information) endobj 281 0 obj -<< /S /GoTo /D (subsection.6.2.2) >> +<< /S /GoTo /D (subsection.6.2.1) >> endobj 284 0 obj -(6.2.2 Active Directory Domain Control) +(6.2.1 MS Windows NT4 Style Domain Control) endobj 285 0 obj -<< /S /GoTo /D (subsection.6.2.3) >> +<< /S /GoTo /D (subsubsection.6.2.1.1) >> endobj 288 0 obj -(6.2.3 What qualifies a Domain Controller on the network?) +(6.2.1.1 Example PDC Configuration) endobj 289 0 obj -<< /S /GoTo /D (subsection.6.2.4) >> +<< /S /GoTo /D (subsection.6.2.2) >> endobj 292 0 obj -(6.2.4 How does a Workstation find its domain controller?) +(6.2.2 Active Directory Domain Control) endobj 293 0 obj -<< /S /GoTo /D (section.6.3) >> +<< /S /GoTo /D (subsection.6.2.3) >> endobj 296 0 obj -(6.3 Backup Domain Controller Configuration) +(6.2.3 What qualifies a Domain Controller on the network?) endobj 297 0 obj -<< /S /GoTo /D (subsection.6.3.1) >> +<< /S /GoTo /D (subsection.6.2.4) >> endobj 300 0 obj -(6.3.1 Example Configuration) +(6.2.4 How does a Workstation find its domain controller?) endobj 301 0 obj -<< /S /GoTo /D (section.6.4) >> +<< /S /GoTo /D (section.6.3) >> endobj 304 0 obj -(6.4 Common Errors) +(6.3 Backup Domain Controller Configuration) endobj 305 0 obj -<< /S /GoTo /D (subsection.6.4.1) >> +<< /S /GoTo /D (subsection.6.3.1) >> endobj 308 0 obj -(6.4.1 Machine Accounts keep expiring, what can I do?) +(6.3.1 Example Configuration) endobj 309 0 obj -<< /S /GoTo /D (subsection.6.4.2) >> +<< /S /GoTo /D (section.6.4) >> endobj 312 0 obj -(6.4.2 Can Samba be a Backup Domain Controller to an NT4 PDC?) +(6.4 Common Errors) endobj 313 0 obj -<< /S /GoTo /D (subsection.6.4.3) >> +<< /S /GoTo /D (subsection.6.4.1) >> endobj 316 0 obj -(6.4.3 How do I replicate the smbpasswd file?) +(6.4.1 Machine Accounts keep expiring, what can I do?) endobj 317 0 obj -<< /S /GoTo /D (subsection.6.4.4) >> +<< /S /GoTo /D (subsection.6.4.2) >> endobj 320 0 obj -(6.4.4 Can I do this all with LDAP?) +(6.4.2 Can Samba be a Backup Domain Controller to an NT4 PDC?) endobj 321 0 obj -<< /S /GoTo /D (chapter.7) >> +<< /S /GoTo /D (subsection.6.4.3) >> endobj 324 0 obj -(7 Domain Membership) +(6.4.3 How do I replicate the smbpasswd file?) endobj 325 0 obj -<< /S /GoTo /D (section.7.1) >> +<< /S /GoTo /D (subsection.6.4.4) >> endobj 328 0 obj -(7.1 Features and Benefits) +(6.4.4 Can I do this all with LDAP?) endobj 329 0 obj -<< /S /GoTo /D (section.7.2) >> +<< /S /GoTo /D (chapter.7) >> endobj 332 0 obj -(7.2 MS Windows Workstation/Server Machine Trust Accounts) +(7 Domain Membership) endobj 333 0 obj -<< /S /GoTo /D (subsection.7.2.1) >> +<< /S /GoTo /D (section.7.1) >> endobj 336 0 obj -(7.2.1 Manual Creation of Machine Trust Accounts) +(7.1 Features and Benefits) endobj 337 0 obj -<< /S /GoTo /D (subsection.7.2.2) >> +<< /S /GoTo /D (section.7.2) >> endobj 340 0 obj -(7.2.2 Using NT4 Server Manager to Add Machine Accounts to the Domain) +(7.2 MS Windows Workstation/Server Machine Trust Accounts) endobj 341 0 obj -<< /S /GoTo /D (subsection.7.2.3) >> +<< /S /GoTo /D (subsection.7.2.1) >> endobj 344 0 obj -(7.2.3 "On-the-Fly" Creation of Machine Trust Accounts) +(7.2.1 Manual Creation of Machine Trust Accounts) endobj 345 0 obj -<< /S /GoTo /D (subsection.7.2.4) >> +<< /S /GoTo /D (subsection.7.2.2) >> endobj 348 0 obj -(7.2.4 Making an MS Windows Workstation or Server a Domain Member) +(7.2.2 Using NT4 Server Manager to Add Machine Accounts to the Domain) endobj 349 0 obj -<< /S /GoTo /D (subsubsection.7.2.4.1) >> +<< /S /GoTo /D (subsection.7.2.3) >> endobj 352 0 obj -(7.2.4.1 Windows 200x XP Professional) +(7.2.3 "On-the-Fly" Creation of Machine Trust Accounts) endobj 353 0 obj -<< /S /GoTo /D (subsubsection.7.2.4.2) >> +<< /S /GoTo /D (subsection.7.2.4) >> endobj 356 0 obj -(7.2.4.2 Windows NT4) +(7.2.4 Making an MS Windows Workstation or Server a Domain Member) endobj 357 0 obj -<< /S /GoTo /D (subsubsection.7.2.4.3) >> +<< /S /GoTo /D (subsubsection.7.2.4.1) >> endobj 360 0 obj -(7.2.4.3 Samba) +(7.2.4.1 Windows 200x XP Professional) endobj 361 0 obj -<< /S /GoTo /D (section.7.3) >> +<< /S /GoTo /D (subsubsection.7.2.4.2) >> endobj 364 0 obj -(7.3 Domain Member Server) +(7.2.4.2 Windows NT4) endobj 365 0 obj -<< /S /GoTo /D (subsection.7.3.1) >> +<< /S /GoTo /D (subsubsection.7.2.4.3) >> endobj 368 0 obj -(7.3.1 Joining an NT4 type Domain with Samba-3) +(7.2.4.3 Samba) endobj 369 0 obj -<< /S /GoTo /D (subsection.7.3.2) >> +<< /S /GoTo /D (section.7.3) >> endobj 372 0 obj -(7.3.2 Why is this better than security = server?) +(7.3 Domain Member Server) endobj 373 0 obj -<< /S /GoTo /D (section.7.4) >> +<< /S /GoTo /D (subsection.7.3.1) >> endobj 376 0 obj -(7.4 Samba ADS Domain Membership) +(7.3.1 Joining an NT4 type Domain with Samba-3) endobj 377 0 obj -<< /S /GoTo /D (subsection.7.4.1) >> +<< /S /GoTo /D (subsection.7.3.2) >> endobj 380 0 obj -(7.4.1 Setup your smb.conf) +(7.3.2 Why is this better than security = server?) endobj 381 0 obj -<< /S /GoTo /D (subsection.7.4.2) >> +<< /S /GoTo /D (section.7.4) >> endobj 384 0 obj -(7.4.2 Setup your /etc/krb5.conf) +(7.4 Samba ADS Domain Membership) endobj 385 0 obj -<< /S /GoTo /D (subsection.7.4.3) >> +<< /S /GoTo /D (subsection.7.4.1) >> endobj 388 0 obj -(7.4.3 Create the computer account) +(7.4.1 Setup your smb.conf) endobj 389 0 obj -<< /S /GoTo /D (subsubsection.7.4.3.1) >> +<< /S /GoTo /D (subsection.7.4.2) >> endobj 392 0 obj -(7.4.3.1 Possible errors) +(7.4.2 Setup your /etc/krb5.conf) endobj 393 0 obj -<< /S /GoTo /D (subsection.7.4.4) >> +<< /S /GoTo /D (subsection.7.4.3) >> endobj 396 0 obj -(7.4.4 Test your server setup) +(7.4.3 Create the computer account) endobj 397 0 obj -<< /S /GoTo /D (subsection.7.4.5) >> +<< /S /GoTo /D (subsubsection.7.4.3.1) >> endobj 400 0 obj -(7.4.5 Testing with smbclient) +(7.4.3.1 Possible errors) endobj 401 0 obj -<< /S /GoTo /D (subsection.7.4.6) >> +<< /S /GoTo /D (subsection.7.4.4) >> endobj 404 0 obj -(7.4.6 Notes) +(7.4.4 Test your server setup) endobj 405 0 obj -<< /S /GoTo /D (section.7.5) >> +<< /S /GoTo /D (subsection.7.4.5) >> endobj 408 0 obj -(7.5 Common Errors) +(7.4.5 Testing with smbclient) endobj 409 0 obj -<< /S /GoTo /D (subsection.7.5.1) >> +<< /S /GoTo /D (subsection.7.4.6) >> endobj 412 0 obj -(7.5.1 Can Not Add Machine Back to Domain) +(7.4.6 Notes) endobj 413 0 obj -<< /S /GoTo /D (subsection.7.5.2) >> +<< /S /GoTo /D (section.7.5) >> endobj 416 0 obj -(7.5.2 Adding Machine to Domain Fails) +(7.5 Common Errors) endobj 417 0 obj -<< /S /GoTo /D (chapter.8) >> +<< /S /GoTo /D (subsection.7.5.1) >> endobj 420 0 obj -(8 Stand-Alone Servers) +(7.5.1 Can Not Add Machine Back to Domain) endobj 421 0 obj -<< /S /GoTo /D (section.8.1) >> +<< /S /GoTo /D (subsection.7.5.2) >> endobj 424 0 obj -(8.1 Features and Benefits) +(7.5.2 Adding Machine to Domain Fails) endobj 425 0 obj -<< /S /GoTo /D (section.8.2) >> +<< /S /GoTo /D (chapter.8) >> endobj 428 0 obj -(8.2 Background) +(8 Stand-Alone Servers) endobj 429 0 obj -<< /S /GoTo /D (section.8.3) >> +<< /S /GoTo /D (section.8.1) >> endobj 432 0 obj -(8.3 Example Configuration) +(8.1 Features and Benefits) endobj 433 0 obj -<< /S /GoTo /D (subsection.8.3.1) >> +<< /S /GoTo /D (section.8.2) >> endobj 436 0 obj -(8.3.1 Reference Documentation Server) +(8.2 Background) endobj 437 0 obj -<< /S /GoTo /D (subsection.8.3.2) >> +<< /S /GoTo /D (section.8.3) >> endobj 440 0 obj -(8.3.2 Central Print Serving) +(8.3 Example Configuration) endobj 441 0 obj -<< /S /GoTo /D (section.8.4) >> +<< /S /GoTo /D (subsection.8.3.1) >> endobj 444 0 obj -(8.4 Common Errors) +(8.3.1 Reference Documentation Server) endobj 445 0 obj -<< /S /GoTo /D (chapter.9) >> +<< /S /GoTo /D (subsection.8.3.2) >> endobj 448 0 obj -(9 MS Windows Network Configuration Guide) +(8.3.2 Central Print Serving) endobj 449 0 obj -<< /S /GoTo /D (section.9.1) >> +<< /S /GoTo /D (section.8.4) >> endobj 452 0 obj -(9.1 Note) +(8.4 Common Errors) endobj 453 0 obj -<< /S /GoTo /D (part.3) >> +<< /S /GoTo /D (chapter.9) >> endobj 456 0 obj -(III Advanced Configuration) +(9 MS Windows Network Configuration Guide) endobj 457 0 obj -<< /S /GoTo /D (chapter.10) >> +<< /S /GoTo /D (section.9.1) >> endobj 460 0 obj -(10 Samba / MS Windows Network Browsing Guide) +(9.1 Note) endobj 461 0 obj -<< /S /GoTo /D (section.10.1) >> +<< /S /GoTo /D (part.3) >> endobj 464 0 obj -(10.1 Features and Benefits) +(III Advanced Configuration) endobj 465 0 obj -<< /S /GoTo /D (section.10.2) >> +<< /S /GoTo /D (chapter.10) >> endobj 468 0 obj -(10.2 What is Browsing?) +(10 Samba / MS Windows Network Browsing Guide) endobj 469 0 obj -<< /S /GoTo /D (section.10.3) >> +<< /S /GoTo /D (section.10.1) >> endobj 472 0 obj -(10.3 Discussion) +(10.1 Features and Benefits) endobj 473 0 obj -<< /S /GoTo /D (subsection.10.3.1) >> +<< /S /GoTo /D (section.10.2) >> endobj 476 0 obj -(10.3.1 NetBIOS over TCP/IP) +(10.2 What is Browsing?) endobj 477 0 obj -<< /S /GoTo /D (subsection.10.3.2) >> +<< /S /GoTo /D (section.10.3) >> endobj 480 0 obj -(10.3.2 TCP/IP - without NetBIOS) +(10.3 Discussion) endobj 481 0 obj -<< /S /GoTo /D (subsection.10.3.3) >> +<< /S /GoTo /D (subsection.10.3.1) >> endobj 484 0 obj -(10.3.3 DNS and Active Directory) +(10.3.1 NetBIOS over TCP/IP) endobj 485 0 obj -<< /S /GoTo /D (section.10.4) >> +<< /S /GoTo /D (subsection.10.3.2) >> endobj 488 0 obj -(10.4 How Browsing Functions) +(10.3.2 TCP/IP - without NetBIOS) endobj 489 0 obj -<< /S /GoTo /D (subsection.10.4.1) >> +<< /S /GoTo /D (subsection.10.3.3) >> endobj 492 0 obj -(10.4.1 Setting up WORKGROUP Browsing) +(10.3.3 DNS and Active Directory) endobj 493 0 obj -<< /S /GoTo /D (subsection.10.4.2) >> +<< /S /GoTo /D (section.10.4) >> endobj 496 0 obj -(10.4.2 Setting up DOMAIN Browsing) +(10.4 How Browsing Functions) endobj 497 0 obj -<< /S /GoTo /D (subsection.10.4.3) >> +<< /S /GoTo /D (subsection.10.4.1) >> endobj 500 0 obj -(10.4.3 Forcing Samba to be the master) +(10.4.1 Setting up WORKGROUP Browsing) endobj 501 0 obj -<< /S /GoTo /D (subsection.10.4.4) >> +<< /S /GoTo /D (subsection.10.4.2) >> endobj 504 0 obj -(10.4.4 Making Samba the domain master) +(10.4.2 Setting up DOMAIN Browsing) endobj 505 0 obj -<< /S /GoTo /D (subsection.10.4.5) >> +<< /S /GoTo /D (subsection.10.4.3) >> endobj 508 0 obj -(10.4.5 Note about broadcast addresses) +(10.4.3 Forcing Samba to be the master) endobj 509 0 obj -<< /S /GoTo /D (subsection.10.4.6) >> +<< /S /GoTo /D (subsection.10.4.4) >> endobj 512 0 obj -(10.4.6 Multiple interfaces) +(10.4.4 Making Samba the domain master) endobj 513 0 obj -<< /S /GoTo /D (subsection.10.4.7) >> +<< /S /GoTo /D (subsection.10.4.5) >> endobj 516 0 obj -(10.4.7 Use of the Remote Announce parameter) +(10.4.5 Note about broadcast addresses) endobj 517 0 obj -<< /S /GoTo /D (subsection.10.4.8) >> +<< /S /GoTo /D (subsection.10.4.6) >> endobj 520 0 obj -(10.4.8 Use of the Remote Browse Sync parameter) +(10.4.6 Multiple interfaces) endobj 521 0 obj -<< /S /GoTo /D (section.10.5) >> +<< /S /GoTo /D (subsection.10.4.7) >> endobj 524 0 obj -(10.5 WINS - The Windows Internetworking Name Server) +(10.4.7 Use of the Remote Announce parameter) endobj 525 0 obj -<< /S /GoTo /D (subsection.10.5.1) >> +<< /S /GoTo /D (subsection.10.4.8) >> endobj 528 0 obj -(10.5.1 Setting up a WINS server) +(10.4.8 Use of the Remote Browse Sync parameter) endobj 529 0 obj -<< /S /GoTo /D (subsection.10.5.2) >> +<< /S /GoTo /D (section.10.5) >> endobj 532 0 obj -(10.5.2 WINS Replication) +(10.5 WINS - The Windows Internetworking Name Server) endobj 533 0 obj -<< /S /GoTo /D (subsection.10.5.3) >> +<< /S /GoTo /D (subsection.10.5.1) >> endobj 536 0 obj -(10.5.3 Static WINS Entries) +(10.5.1 Setting up a WINS server) endobj 537 0 obj -<< /S /GoTo /D (section.10.6) >> +<< /S /GoTo /D (subsection.10.5.2) >> endobj 540 0 obj -(10.6 Helpful Hints) +(10.5.2 WINS Replication) endobj 541 0 obj -<< /S /GoTo /D (subsection.10.6.1) >> +<< /S /GoTo /D (subsection.10.5.3) >> endobj 544 0 obj -(10.6.1 Windows Networking Protocols) +(10.5.3 Static WINS Entries) endobj 545 0 obj -<< /S /GoTo /D (subsection.10.6.2) >> +<< /S /GoTo /D (section.10.6) >> endobj 548 0 obj -(10.6.2 Name Resolution Order) +(10.6 Helpful Hints) endobj 549 0 obj -<< /S /GoTo /D (section.10.7) >> +<< /S /GoTo /D (subsection.10.6.1) >> endobj 552 0 obj -(10.7 Technical Overview of browsing) +(10.6.1 Windows Networking Protocols) endobj 553 0 obj -<< /S /GoTo /D (subsection.10.7.1) >> +<< /S /GoTo /D (subsection.10.6.2) >> endobj 556 0 obj -(10.7.1 Browsing support in Samba) +(10.6.2 Name Resolution Order) endobj 557 0 obj -<< /S /GoTo /D (subsection.10.7.2) >> +<< /S /GoTo /D (section.10.7) >> endobj 560 0 obj -(10.7.2 Problem resolution) +(10.7 Technical Overview of browsing) endobj 561 0 obj -<< /S /GoTo /D (subsection.10.7.3) >> +<< /S /GoTo /D (subsection.10.7.1) >> endobj 564 0 obj -(10.7.3 Browsing across subnets) +(10.7.1 Browsing support in Samba) endobj 565 0 obj -<< /S /GoTo /D (subsubsection.10.7.3.1) >> +<< /S /GoTo /D (subsection.10.7.2) >> endobj 568 0 obj -(10.7.3.1 How does cross subnet browsing work ?) +(10.7.2 Problem resolution) endobj 569 0 obj -<< /S /GoTo /D (section.10.8) >> +<< /S /GoTo /D (subsection.10.7.3) >> endobj 572 0 obj -(10.8 Common Errors) +(10.7.3 Browsing across subnets) endobj 573 0 obj -<< /S /GoTo /D (subsection.10.8.1) >> +<< /S /GoTo /D (subsubsection.10.7.3.1) >> endobj 576 0 obj -(10.8.1 How can one flush the Samba NetBIOS name cache without restarting Samba?) +(10.7.3.1 How does cross subnet browsing work ?) endobj 577 0 obj -<< /S /GoTo /D (subsection.10.8.2) >> +<< /S /GoTo /D (section.10.8) >> endobj 580 0 obj -(10.8.2 My client reports "This server is not configured to list shared resources") +(10.8 Common Errors) endobj 581 0 obj -<< /S /GoTo /D (chapter.11) >> +<< /S /GoTo /D (subsection.10.8.1) >> endobj 584 0 obj -(11 Account Information Databases) +(10.8.1 How can one flush the Samba NetBIOS name cache without restarting Samba?) endobj 585 0 obj -<< /S /GoTo /D (section.11.1) >> +<< /S /GoTo /D (subsection.10.8.2) >> endobj 588 0 obj -(11.1 Features and Benefits) +(10.8.2 My client reports "This server is not configured to list shared resources") endobj 589 0 obj -<< /S /GoTo /D (section.11.2) >> +<< /S /GoTo /D (subsection.10.8.3) >> endobj 592 0 obj -(11.2 Technical Information) +(10.8.3 I get an Unable to browse the network error) endobj 593 0 obj -<< /S /GoTo /D (subsection.11.2.1) >> +<< /S /GoTo /D (chapter.11) >> endobj 596 0 obj -(11.2.1 Important Notes About Security) +(11 Account Information Databases) endobj 597 0 obj -<< /S /GoTo /D (subsubsection.11.2.1.1) >> +<< /S /GoTo /D (section.11.1) >> endobj 600 0 obj -(11.2.1.1 Advantages of Encrypted Passwords) +(11.1 Features and Benefits) endobj 601 0 obj -<< /S /GoTo /D (subsubsection.11.2.1.2) >> +<< /S /GoTo /D (subsection.11.1.1) >> endobj 604 0 obj -(11.2.1.2 Advantages of non-encrypted passwords) +(11.1.1 Backwards Compatibility Backends) endobj 605 0 obj -<< /S /GoTo /D (subsection.11.2.2) >> +<< /S /GoTo /D (subsection.11.1.2) >> endobj 608 0 obj -(11.2.2 Mapping User Identifiers between MS Windows and Unix) +(11.1.2 New Backends) endobj 609 0 obj -<< /S /GoTo /D (section.11.3) >> +<< /S /GoTo /D (section.11.2) >> endobj 612 0 obj -(11.3 Account Management Tools) +(11.2 Technical Information) endobj 613 0 obj -<< /S /GoTo /D (subsection.11.3.1) >> +<< /S /GoTo /D (subsection.11.2.1) >> endobj 616 0 obj -(11.3.1 The smbpasswd Command) +(11.2.1 Important Notes About Security) endobj 617 0 obj -<< /S /GoTo /D (subsection.11.3.2) >> +<< /S /GoTo /D (subsubsection.11.2.1.1) >> endobj 620 0 obj -(11.3.2 The pdbedit Command) +(11.2.1.1 Advantages of Encrypted Passwords) endobj 621 0 obj -<< /S /GoTo /D (section.11.4) >> +<< /S /GoTo /D (subsubsection.11.2.1.2) >> endobj 624 0 obj -(11.4 Password Backends) +(11.2.1.2 Advantages of non-encrypted passwords) endobj 625 0 obj -<< /S /GoTo /D (subsection.11.4.1) >> +<< /S /GoTo /D (subsection.11.2.2) >> endobj 628 0 obj -(11.4.1 Plain Text) +(11.2.2 Mapping User Identifiers between MS Windows and UNIX) endobj 629 0 obj -<< /S /GoTo /D (subsection.11.4.2) >> +<< /S /GoTo /D (subsection.11.2.3) >> endobj 632 0 obj -(11.4.2 smbpasswd - Encrypted Password Database) +(11.2.3 Mapping Common UIDs/GIDs on Distributed Machines) endobj 633 0 obj -<< /S /GoTo /D (subsection.11.4.3) >> +<< /S /GoTo /D (section.11.3) >> endobj 636 0 obj -(11.4.3 tdbsam) +(11.3 Account Management Tools) endobj 637 0 obj -<< /S /GoTo /D (subsection.11.4.4) >> +<< /S /GoTo /D (subsection.11.3.1) >> endobj 640 0 obj -(11.4.4 ldapsam) +(11.3.1 The smbpasswd Command) endobj 641 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.1) >> +<< /S /GoTo /D (subsection.11.3.2) >> endobj 644 0 obj -(11.4.4.1 Supported LDAP Servers) +(11.3.2 The pdbedit Command) endobj 645 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.2) >> +<< /S /GoTo /D (section.11.4) >> endobj 648 0 obj -(11.4.4.2 Schema and Relationship to the RFC 2307 posixAccount) +(11.4 Password Backends) endobj 649 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.3) >> +<< /S /GoTo /D (subsection.11.4.1) >> endobj 652 0 obj -(11.4.4.3 OpenLDAP configuration) +(11.4.1 Plain Text) endobj 653 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.4) >> +<< /S /GoTo /D (subsection.11.4.2) >> endobj 656 0 obj -(11.4.4.4 Initialise the LDAP database) +(11.4.2 smbpasswd - Encrypted Password Database) endobj 657 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.5) >> +<< /S /GoTo /D (subsection.11.4.3) >> endobj 660 0 obj -(11.4.4.5 Configuring Samba) +(11.4.3 tdbsam) endobj 661 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.6) >> +<< /S /GoTo /D (subsection.11.4.4) >> endobj 664 0 obj -(11.4.4.6 Accounts and Groups management) +(11.4.4 ldapsam) endobj 665 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.7) >> +<< /S /GoTo /D (subsubsection.11.4.4.1) >> endobj 668 0 obj -(11.4.4.7 Security and sambaSamAccount) +(11.4.4.1 Supported LDAP Servers) endobj 669 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.8) >> +<< /S /GoTo /D (subsubsection.11.4.4.2) >> endobj 672 0 obj -(11.4.4.8 LDAP special attributes for sambaSamAccounts) +(11.4.4.2 Schema and Relationship to the RFC 2307 posixAccount) endobj 673 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.9) >> +<< /S /GoTo /D (subsubsection.11.4.4.3) >> endobj 676 0 obj -(11.4.4.9 Example LDIF Entries for a sambaSamAccount) +(11.4.4.3 OpenLDAP configuration) endobj 677 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.10) >> +<< /S /GoTo /D (subsubsection.11.4.4.4) >> endobj 680 0 obj -(11.4.4.10 Password synchronisation) +(11.4.4.4 Initialise the LDAP database) endobj 681 0 obj -<< /S /GoTo /D (subsection.11.4.5) >> +<< /S /GoTo /D (subsubsection.11.4.4.5) >> endobj 684 0 obj -(11.4.5 MySQL) +(11.4.4.5 Configuring Samba) endobj 685 0 obj -<< /S /GoTo /D (subsubsection.11.4.5.1) >> +<< /S /GoTo /D (subsubsection.11.4.4.6) >> endobj 688 0 obj -(11.4.5.1 Creating the database) +(11.4.4.6 Accounts and Groups management) endobj 689 0 obj -<< /S /GoTo /D (subsubsection.11.4.5.2) >> +<< /S /GoTo /D (subsubsection.11.4.4.7) >> endobj 692 0 obj -(11.4.5.2 Configuring) +(11.4.4.7 Security and sambaSamAccount) endobj 693 0 obj -<< /S /GoTo /D (subsubsection.11.4.5.3) >> +<< /S /GoTo /D (subsubsection.11.4.4.8) >> endobj 696 0 obj -(11.4.5.3 Using plaintext passwords or encrypted password) +(11.4.4.8 LDAP special attributes for sambaSamAccounts) endobj 697 0 obj -<< /S /GoTo /D (subsubsection.11.4.5.4) >> +<< /S /GoTo /D (subsubsection.11.4.4.9) >> endobj 700 0 obj -(11.4.5.4 Getting non-column data from the table) +(11.4.4.9 Example LDIF Entries for a sambaSamAccount) endobj 701 0 obj -<< /S /GoTo /D (subsection.11.4.6) >> +<< /S /GoTo /D (subsubsection.11.4.4.10) >> endobj 704 0 obj -(11.4.6 XML) +(11.4.4.10 Password synchronisation) endobj 705 0 obj -<< /S /GoTo /D (section.11.5) >> +<< /S /GoTo /D (subsection.11.4.5) >> endobj 708 0 obj -(11.5 Common Errors) +(11.4.5 MySQL) endobj 709 0 obj -<< /S /GoTo /D (subsection.11.5.1) >> +<< /S /GoTo /D (subsubsection.11.4.5.1) >> endobj 712 0 obj -(11.5.1 Users can not logon - Users not in Samba SAM) +(11.4.5.1 Creating the database) endobj 713 0 obj -<< /S /GoTo /D (subsection.11.5.2) >> +<< /S /GoTo /D (subsubsection.11.4.5.2) >> endobj 716 0 obj -(11.5.2 Users are being added to the wrong backend database) +(11.4.5.2 Configuring) endobj 717 0 obj -<< /S /GoTo /D (subsection.11.5.3) >> +<< /S /GoTo /D (subsubsection.11.4.5.3) >> endobj 720 0 obj -(11.5.3 auth methods does not work) +(11.4.5.3 Using plaintext passwords or encrypted password) endobj 721 0 obj -<< /S /GoTo /D (chapter.12) >> +<< /S /GoTo /D (subsubsection.11.4.5.4) >> endobj 724 0 obj -(12 Mapping MS Windows and Unix Groups) +(11.4.5.4 Getting non-column data from the table) endobj 725 0 obj -<< /S /GoTo /D (section.12.1) >> +<< /S /GoTo /D (subsection.11.4.6) >> endobj 728 0 obj -(12.1 Features and Benefits) +(11.4.6 XML) endobj 729 0 obj -<< /S /GoTo /D (section.12.2) >> +<< /S /GoTo /D (section.11.5) >> endobj 732 0 obj -(12.2 Discussion) +(11.5 Common Errors) endobj 733 0 obj -<< /S /GoTo /D (subsection.12.2.1) >> +<< /S /GoTo /D (subsection.11.5.1) >> endobj 736 0 obj -(12.2.1 Example Configuration) +(11.5.1 Users can not logon) endobj 737 0 obj -<< /S /GoTo /D (section.12.3) >> +<< /S /GoTo /D (subsection.11.5.2) >> endobj 740 0 obj -(12.3 Configuration Scripts) +(11.5.2 Users being added to wrong backend database) endobj 741 0 obj -<< /S /GoTo /D (subsection.12.3.1) >> +<< /S /GoTo /D (subsection.11.5.3) >> endobj 744 0 obj -(12.3.1 Sample smb.conf add group script) +(11.5.3 auth methods does not work) endobj 745 0 obj -<< /S /GoTo /D (subsection.12.3.2) >> +<< /S /GoTo /D (chapter.12) >> endobj 748 0 obj -(12.3.2 Script to configure Group Mapping) +(12 Mapping MS Windows and UNIX Groups) endobj 749 0 obj -<< /S /GoTo /D (section.12.4) >> +<< /S /GoTo /D (section.12.1) >> endobj 752 0 obj -(12.4 Common Errors) +(12.1 Features and Benefits) endobj 753 0 obj -<< /S /GoTo /D (subsection.12.4.1) >> +<< /S /GoTo /D (section.12.2) >> endobj 756 0 obj -(12.4.1 Adding Groups Fails) +(12.2 Discussion) endobj 757 0 obj -<< /S /GoTo /D (subsection.12.4.2) >> +<< /S /GoTo /D (subsection.12.2.1) >> endobj 760 0 obj -(12.4.2 Adding MS Windows Groups to MS Windows Groups Fails) +(12.2.1 Example Configuration) endobj 761 0 obj -<< /S /GoTo /D (chapter.13) >> +<< /S /GoTo /D (section.12.3) >> endobj 764 0 obj -(13 File, Directory and Share Access Controls) +(12.3 Configuration Scripts) endobj 765 0 obj -<< /S /GoTo /D (section.13.1) >> +<< /S /GoTo /D (subsection.12.3.1) >> endobj 768 0 obj -(13.1 Features and Benefits) +(12.3.1 Sample smb.conf add group script) endobj 769 0 obj -<< /S /GoTo /D (section.13.2) >> +<< /S /GoTo /D (subsection.12.3.2) >> endobj 772 0 obj -(13.2 File System Access Controls) +(12.3.2 Script to configure Group Mapping) endobj 773 0 obj -<< /S /GoTo /D (subsection.13.2.1) >> +<< /S /GoTo /D (section.12.4) >> endobj 776 0 obj -(13.2.1 MS Windows NTFS Comparison with Unix File Systems) +(12.4 Common Errors) endobj 777 0 obj -<< /S /GoTo /D (subsection.13.2.2) >> +<< /S /GoTo /D (subsection.12.4.1) >> endobj 780 0 obj -(13.2.2 Managing Directories) +(12.4.1 Adding Groups Fails) endobj 781 0 obj -<< /S /GoTo /D (subsection.13.2.3) >> +<< /S /GoTo /D (subsection.12.4.2) >> endobj 784 0 obj -(13.2.3 File and Directory Access Control) +(12.4.2 Adding MS Windows Groups to MS Windows Groups Fails) endobj 785 0 obj -<< /S /GoTo /D (section.13.3) >> +<< /S /GoTo /D (subsection.12.4.3) >> endobj 788 0 obj -(13.3 Share Definition Access Controls) +(12.4.3 Adding Domain Users to the Power Users group) endobj 789 0 obj -<< /S /GoTo /D (subsection.13.3.1) >> +<< /S /GoTo /D (chapter.13) >> endobj 792 0 obj -(13.3.1 User and Group Based Controls) +(13 File, Directory and Share Access Controls) endobj 793 0 obj -<< /S /GoTo /D (subsection.13.3.2) >> +<< /S /GoTo /D (section.13.1) >> endobj 796 0 obj -(13.3.2 File and Directory Permissions Based Controls) +(13.1 Features and Benefits) endobj 797 0 obj -<< /S /GoTo /D (subsection.13.3.3) >> +<< /S /GoTo /D (section.13.2) >> endobj 800 0 obj -(13.3.3 Miscellaneous Controls) +(13.2 File System Access Controls) endobj 801 0 obj -<< /S /GoTo /D (section.13.4) >> +<< /S /GoTo /D (subsection.13.2.1) >> endobj 804 0 obj -(13.4 Access Controls on Shares) +(13.2.1 MS Windows NTFS Comparison with UNIX File Systems) endobj 805 0 obj -<< /S /GoTo /D (subsection.13.4.1) >> +<< /S /GoTo /D (subsection.13.2.2) >> endobj 808 0 obj -(13.4.1 Share Permissions Management) +(13.2.2 Managing Directories) endobj 809 0 obj -<< /S /GoTo /D (subsubsection.13.4.1.1) >> +<< /S /GoTo /D (subsection.13.2.3) >> endobj 812 0 obj -(13.4.1.1 Windows NT4 Workstation/Server) +(13.2.3 File and Directory Access Control) endobj 813 0 obj -<< /S /GoTo /D (subsubsection.13.4.1.2) >> +<< /S /GoTo /D (section.13.3) >> endobj 816 0 obj -(13.4.1.2 Windows 200x/XP) +(13.3 Share Definition Access Controls) endobj 817 0 obj -<< /S /GoTo /D (section.13.5) >> +<< /S /GoTo /D (subsection.13.3.1) >> endobj 820 0 obj -(13.5 MS Windows Access Control Lists and Unix Interoperability) +(13.3.1 User and Group Based Controls) endobj 821 0 obj -<< /S /GoTo /D (subsection.13.5.1) >> +<< /S /GoTo /D (subsection.13.3.2) >> endobj 824 0 obj -(13.5.1 Managing UNIX permissions Using NT Security Dialogs) +(13.3.2 File and Directory Permissions Based Controls) endobj 825 0 obj -<< /S /GoTo /D (subsection.13.5.2) >> +<< /S /GoTo /D (subsection.13.3.3) >> endobj 828 0 obj -(13.5.2 Viewing File Security on a Samba Share) +(13.3.3 Miscellaneous Controls) endobj 829 0 obj -<< /S /GoTo /D (subsection.13.5.3) >> +<< /S /GoTo /D (section.13.4) >> endobj 832 0 obj -(13.5.3 Viewing file ownership) +(13.4 Access Controls on Shares) endobj 833 0 obj -<< /S /GoTo /D (subsection.13.5.4) >> +<< /S /GoTo /D (subsection.13.4.1) >> endobj 836 0 obj -(13.5.4 Viewing File or Directory Permissions) +(13.4.1 Share Permissions Management) endobj 837 0 obj -<< /S /GoTo /D (subsubsection.13.5.4.1) >> +<< /S /GoTo /D (subsubsection.13.4.1.1) >> endobj 840 0 obj -(13.5.4.1 File Permissions) +(13.4.1.1 Windows NT4 Workstation/Server) endobj 841 0 obj -<< /S /GoTo /D (subsubsection.13.5.4.2) >> +<< /S /GoTo /D (subsubsection.13.4.1.2) >> endobj 844 0 obj -(13.5.4.2 Directory Permissions) +(13.4.1.2 Windows 200x/XP) endobj 845 0 obj -<< /S /GoTo /D (subsection.13.5.5) >> +<< /S /GoTo /D (section.13.5) >> endobj 848 0 obj -(13.5.5 Modifying file or directory permissions) +(13.5 MS Windows Access Control Lists and UNIX Interoperability) endobj 849 0 obj -<< /S /GoTo /D (subsection.13.5.6) >> +<< /S /GoTo /D (subsection.13.5.1) >> endobj 852 0 obj -(13.5.6 Interaction with the standard Samba create mask parameters) +(13.5.1 Managing UNIX permissions Using NT Security Dialogs) endobj 853 0 obj -<< /S /GoTo /D (subsection.13.5.7) >> +<< /S /GoTo /D (subsection.13.5.2) >> endobj 856 0 obj -(13.5.7 Interaction with the standard Samba file attribute mapping) +(13.5.2 Viewing File Security on a Samba Share) endobj 857 0 obj -<< /S /GoTo /D (section.13.6) >> +<< /S /GoTo /D (subsection.13.5.3) >> endobj 860 0 obj -(13.6 Common Errors) +(13.5.3 Viewing file ownership) endobj 861 0 obj -<< /S /GoTo /D (subsection.13.6.1) >> +<< /S /GoTo /D (subsection.13.5.4) >> endobj 864 0 obj -(13.6.1 Users can not write to a public share) +(13.5.4 Viewing File or Directory Permissions) endobj 865 0 obj -<< /S /GoTo /D (subsection.13.6.2) >> +<< /S /GoTo /D (subsubsection.13.5.4.1) >> endobj 868 0 obj -(13.6.2 I have set force user and Samba still makes root the owner of all the files I touch!) +(13.5.4.1 File Permissions) endobj 869 0 obj -<< /S /GoTo /D (chapter.14) >> +<< /S /GoTo /D (subsubsection.13.5.4.2) >> endobj 872 0 obj -(14 File and Record Locking) +(13.5.4.2 Directory Permissions) endobj 873 0 obj -<< /S /GoTo /D (section.14.1) >> +<< /S /GoTo /D (subsection.13.5.5) >> endobj 876 0 obj -(14.1 Features and Benefits) +(13.5.5 Modifying file or directory permissions) endobj 877 0 obj -<< /S /GoTo /D (section.14.2) >> +<< /S /GoTo /D (subsection.13.5.6) >> endobj 880 0 obj -(14.2 Discussion) +(13.5.6 Interaction with the standard Samba create mask parameters) endobj 881 0 obj -<< /S /GoTo /D (subsection.14.2.1) >> +<< /S /GoTo /D (subsection.13.5.7) >> endobj 884 0 obj -(14.2.1 Opportunistic Locking Overview) +(13.5.7 Interaction with the standard Samba file attribute mapping) endobj 885 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.1) >> +<< /S /GoTo /D (section.13.6) >> endobj 888 0 obj -(14.2.1.1 Exclusively Accessed Shares) +(13.6 Common Errors) endobj 889 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.2) >> +<< /S /GoTo /D (subsection.13.6.1) >> endobj 892 0 obj -(14.2.1.2 Multiple-Accessed Shares or Files) +(13.6.1 Users can not write to a public share) endobj 893 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.3) >> +<< /S /GoTo /D (subsection.13.6.2) >> endobj 896 0 obj -(14.2.1.3 Unix or NFS Client Accessed Files) +(13.6.2 I have set force user but Samba still makes root the owner of all the files I touch!) endobj 897 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.4) >> +<< /S /GoTo /D (subsection.13.6.3) >> endobj 900 0 obj -(14.2.1.4 Slow and/or Unreliable Networks) +(13.6.3 MS Word with Samba changes owner of file) endobj 901 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.5) >> +<< /S /GoTo /D (chapter.14) >> endobj 904 0 obj -(14.2.1.5 Multi-User Databases) +(14 File and Record Locking) endobj 905 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.6) >> +<< /S /GoTo /D (section.14.1) >> endobj 908 0 obj -(14.2.1.6 PDM Data Shares) +(14.1 Features and Benefits) endobj 909 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.7) >> +<< /S /GoTo /D (section.14.2) >> endobj 912 0 obj -(14.2.1.7 Beware of Force User) +(14.2 Discussion) endobj 913 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.8) >> +<< /S /GoTo /D (subsection.14.2.1) >> endobj 916 0 obj -(14.2.1.8 Advanced Samba Opportunistic Locking Parameters) +(14.2.1 Opportunistic Locking Overview) endobj 917 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.9) >> +<< /S /GoTo /D (subsubsection.14.2.1.1) >> endobj 920 0 obj -(14.2.1.9 Mission Critical High Availability) +(14.2.1.1 Exclusively Accessed Shares) endobj 921 0 obj -<< /S /GoTo /D (section.14.3) >> +<< /S /GoTo /D (subsubsection.14.2.1.2) >> endobj 924 0 obj -(14.3 Samba Opportunistic Locking Control) +(14.2.1.2 Multiple-Accessed Shares or Files) endobj 925 0 obj -<< /S /GoTo /D (subsection.14.3.1) >> +<< /S /GoTo /D (subsubsection.14.2.1.3) >> endobj 928 0 obj -(14.3.1 Example Configuration) +(14.2.1.3 UNIX or NFS Client Accessed Files) endobj 929 0 obj -<< /S /GoTo /D (subsubsection.14.3.1.1) >> +<< /S /GoTo /D (subsubsection.14.2.1.4) >> endobj 932 0 obj -(14.3.1.1 Disabling Oplocks) +(14.2.1.4 Slow and/or Unreliable Networks) endobj 933 0 obj -<< /S /GoTo /D (subsubsection.14.3.1.2) >> +<< /S /GoTo /D (subsubsection.14.2.1.5) >> endobj 936 0 obj -(14.3.1.2 Disabling Kernel OpLocks) +(14.2.1.5 Multi-User Databases) endobj 937 0 obj -<< /S /GoTo /D (section.14.4) >> +<< /S /GoTo /D (subsubsection.14.2.1.6) >> endobj 940 0 obj -(14.4 MS Windows Opportunistic Locking and Caching Controls) +(14.2.1.6 PDM Data Shares) endobj 941 0 obj -<< /S /GoTo /D (subsection.14.4.1) >> +<< /S /GoTo /D (subsubsection.14.2.1.7) >> endobj 944 0 obj -(14.4.1 Workstation Service Entries) +(14.2.1.7 Beware of Force User) endobj 945 0 obj -<< /S /GoTo /D (subsection.14.4.2) >> +<< /S /GoTo /D (subsubsection.14.2.1.8) >> endobj 948 0 obj -(14.4.2 Server Service Entries) +(14.2.1.8 Advanced Samba Opportunistic Locking Parameters) endobj 949 0 obj -<< /S /GoTo /D (section.14.5) >> +<< /S /GoTo /D (subsubsection.14.2.1.9) >> endobj 952 0 obj -(14.5 Persistent Data Corruption) +(14.2.1.9 Mission Critical High Availability) endobj 953 0 obj -<< /S /GoTo /D (section.14.6) >> +<< /S /GoTo /D (section.14.3) >> endobj 956 0 obj -(14.6 Common Errors) +(14.3 Samba Opportunistic Locking Control) endobj 957 0 obj -<< /S /GoTo /D (subsection.14.6.1) >> +<< /S /GoTo /D (subsection.14.3.1) >> endobj 960 0 obj -(14.6.1 locking.tdb error messages) +(14.3.1 Example Configuration) endobj 961 0 obj -<< /S /GoTo /D (section.14.7) >> +<< /S /GoTo /D (subsubsection.14.3.1.1) >> endobj 964 0 obj -(14.7 Additional Reading) +(14.3.1.1 Disabling Oplocks) endobj 965 0 obj -<< /S /GoTo /D (chapter.15) >> +<< /S /GoTo /D (subsubsection.14.3.1.2) >> endobj 968 0 obj -(15 Securing Samba) +(14.3.1.2 Disabling Kernel OpLocks) endobj 969 0 obj -<< /S /GoTo /D (section.15.1) >> +<< /S /GoTo /D (section.14.4) >> endobj 972 0 obj -(15.1 Introduction) +(14.4 MS Windows Opportunistic Locking and Caching Controls) endobj 973 0 obj -<< /S /GoTo /D (section.15.2) >> +<< /S /GoTo /D (subsection.14.4.1) >> endobj 976 0 obj -(15.2 Features and Benefits) +(14.4.1 Workstation Service Entries) endobj 977 0 obj -<< /S /GoTo /D (section.15.3) >> +<< /S /GoTo /D (subsection.14.4.2) >> endobj 980 0 obj -(15.3 Technical Discussion of Protective Measures and Issues) +(14.4.2 Server Service Entries) endobj 981 0 obj -<< /S /GoTo /D (subsection.15.3.1) >> +<< /S /GoTo /D (section.14.5) >> endobj 984 0 obj -(15.3.1 Using host based protection) +(14.5 Persistent Data Corruption) endobj 985 0 obj -<< /S /GoTo /D (subsection.15.3.2) >> +<< /S /GoTo /D (section.14.6) >> endobj 988 0 obj -(15.3.2 User based protection) +(14.6 Common Errors) endobj 989 0 obj -<< /S /GoTo /D (subsection.15.3.3) >> +<< /S /GoTo /D (subsection.14.6.1) >> endobj 992 0 obj -(15.3.3 Using interface protection) +(14.6.1 locking.tdb error messages) endobj 993 0 obj -<< /S /GoTo /D (subsection.15.3.4) >> +<< /S /GoTo /D (subsection.14.6.2) >> endobj 996 0 obj -(15.3.4 Using a firewall) +(14.6.2 Problems saving files in MS Office on Windows XP) endobj 997 0 obj -<< /S /GoTo /D (subsection.15.3.5) >> +<< /S /GoTo /D (subsection.14.6.3) >> endobj 1000 0 obj -(15.3.5 Using a IPC\044 share deny) +(14.6.3 Long delays deleting files over network with XP SP1) endobj 1001 0 obj -<< /S /GoTo /D (subsection.15.3.6) >> +<< /S /GoTo /D (section.14.7) >> endobj 1004 0 obj -(15.3.6 NTLMv2 Security) +(14.7 Additional Reading) endobj 1005 0 obj -<< /S /GoTo /D (section.15.4) >> +<< /S /GoTo /D (chapter.15) >> endobj 1008 0 obj -(15.4 Upgrading Samba) +(15 Securing Samba) endobj 1009 0 obj -<< /S /GoTo /D (section.15.5) >> +<< /S /GoTo /D (section.15.1) >> endobj 1012 0 obj -(15.5 Common Errors) +(15.1 Introduction) endobj 1013 0 obj -<< /S /GoTo /D (subsection.15.5.1) >> +<< /S /GoTo /D (section.15.2) >> endobj 1016 0 obj -(15.5.1 Smbclient works on localhost, but the network is dead) +(15.2 Features and Benefits) endobj 1017 0 obj -<< /S /GoTo /D (subsection.15.5.2) >> +<< /S /GoTo /D (section.15.3) >> endobj 1020 0 obj -(15.5.2 Why can users access home directories of other users?) +(15.3 Technical Discussion of Protective Measures and Issues) endobj 1021 0 obj -<< /S /GoTo /D (chapter.16) >> +<< /S /GoTo /D (subsection.15.3.1) >> endobj 1024 0 obj -(16 Interdomain Trust Relationships) +(15.3.1 Using host based protection) endobj 1025 0 obj -<< /S /GoTo /D (section.16.1) >> +<< /S /GoTo /D (subsection.15.3.2) >> endobj 1028 0 obj -(16.1 Features and Benefits) +(15.3.2 User based protection) endobj 1029 0 obj -<< /S /GoTo /D (section.16.2) >> +<< /S /GoTo /D (subsection.15.3.3) >> endobj 1032 0 obj -(16.2 Trust Relationship Background) +(15.3.3 Using interface protection) endobj 1033 0 obj -<< /S /GoTo /D (section.16.3) >> +<< /S /GoTo /D (subsection.15.3.4) >> endobj 1036 0 obj -(16.3 Native MS Windows NT4 Trusts Configuration) +(15.3.4 Using a firewall) endobj 1037 0 obj -<< /S /GoTo /D (subsection.16.3.1) >> +<< /S /GoTo /D (subsection.15.3.5) >> endobj 1040 0 obj -(16.3.1 NT4 as the Trusting Domain \(ie. creating the trusted account\)) +(15.3.5 Using a IPC\044 share deny) endobj 1041 0 obj -<< /S /GoTo /D (subsection.16.3.2) >> +<< /S /GoTo /D (subsection.15.3.6) >> endobj 1044 0 obj -(16.3.2 NT4 as the Trusted Domain \(ie. creating trusted account's password\)) +(15.3.6 NTLMv2 Security) endobj 1045 0 obj -<< /S /GoTo /D (section.16.4) >> +<< /S /GoTo /D (section.15.4) >> endobj 1048 0 obj -(16.4 Configuring Samba NT-style Domain Trusts) +(15.4 Upgrading Samba) endobj 1049 0 obj -<< /S /GoTo /D (subsection.16.4.1) >> +<< /S /GoTo /D (section.15.5) >> endobj 1052 0 obj -(16.4.1 Samba-3 as the Trusting Domain) +(15.5 Common Errors) endobj 1053 0 obj -<< /S /GoTo /D (subsection.16.4.2) >> +<< /S /GoTo /D (subsection.15.5.1) >> endobj 1056 0 obj -(16.4.2 Samba-3 as the Trusted Domain) +(15.5.1 Smbclient works on localhost, but the network is dead) endobj 1057 0 obj -<< /S /GoTo /D (section.16.5) >> +<< /S /GoTo /D (subsection.15.5.2) >> endobj 1060 0 obj -(16.5 Common Errors) +(15.5.2 Why can users access home directories of other users?) endobj 1061 0 obj -<< /S /GoTo /D (subsection.16.5.1) >> +<< /S /GoTo /D (chapter.16) >> endobj 1064 0 obj -(16.5.1 Tell me about Trust Relationships using Samba) +(16 Interdomain Trust Relationships) endobj 1065 0 obj -<< /S /GoTo /D (chapter.17) >> +<< /S /GoTo /D (section.16.1) >> endobj 1068 0 obj -(17 Hosting a Microsoft Distributed File System tree on Samba) +(16.1 Features and Benefits) endobj 1069 0 obj -<< /S /GoTo /D (section.17.1) >> +<< /S /GoTo /D (section.16.2) >> endobj 1072 0 obj -(17.1 Features and Benefits) +(16.2 Trust Relationship Background) endobj 1073 0 obj -<< /S /GoTo /D (section.17.2) >> +<< /S /GoTo /D (section.16.3) >> endobj 1076 0 obj -(17.2 Common Errors) +(16.3 Native MS Windows NT4 Trusts Configuration) endobj 1077 0 obj -<< /S /GoTo /D (chapter.18) >> +<< /S /GoTo /D (subsection.16.3.1) >> endobj 1080 0 obj -(18 Classical Printing Support) +(16.3.1 Creating an NT4 Domain Trust) endobj 1081 0 obj -<< /S /GoTo /D (section.18.1) >> +<< /S /GoTo /D (subsection.16.3.2) >> endobj 1084 0 obj -(18.1 Features and Benefits) +(16.3.2 Completing an NT4 Domain Trust) endobj 1085 0 obj -<< /S /GoTo /D (section.18.2) >> +<< /S /GoTo /D (subsection.16.3.3) >> endobj 1088 0 obj -(18.2 Technical Introduction) +(16.3.3 Inter-Domain Trust Facilities) endobj 1089 0 obj -<< /S /GoTo /D (subsection.18.2.1) >> +<< /S /GoTo /D (section.16.4) >> endobj 1092 0 obj -(18.2.1 What happens if you send a Job from a Client) +(16.4 Configuring Samba NT-style Domain Trusts) endobj 1093 0 obj -<< /S /GoTo /D (subsection.18.2.2) >> +<< /S /GoTo /D (subsection.16.4.1) >> endobj 1096 0 obj -(18.2.2 Printing Related Configuration Parameters) +(16.4.1 Samba as the Trusted Domain) endobj 1097 0 obj -<< /S /GoTo /D (subsection.18.2.3) >> +<< /S /GoTo /D (subsection.16.4.2) >> endobj 1100 0 obj -(18.2.3 Parameters Recommended for Use) +(16.4.2 Samba as the Trusting Domain) endobj 1101 0 obj -<< /S /GoTo /D (subsection.18.2.4) >> +<< /S /GoTo /D (section.16.5) >> endobj 1104 0 obj -(18.2.4 Parameters for Backwards Compatibility) +(16.5 NT4-style Domain Trusts with Windows 2000) endobj 1105 0 obj -<< /S /GoTo /D (subsection.18.2.5) >> +<< /S /GoTo /D (section.16.6) >> endobj 1108 0 obj -(18.2.5 Parameters no longer in use) +(16.6 Common Errors) endobj 1109 0 obj -<< /S /GoTo /D (section.18.3) >> +<< /S /GoTo /D (chapter.17) >> endobj 1112 0 obj -(18.3 A simple Configuration to Print with Samba-3) +(17 Hosting a Microsoft Distributed File System tree on Samba) endobj 1113 0 obj -<< /S /GoTo /D (subsection.18.3.1) >> +<< /S /GoTo /D (section.17.1) >> endobj 1116 0 obj -(18.3.1 Verification of "Settings in Use" with testparm) +(17.1 Features and Benefits) endobj 1117 0 obj -<< /S /GoTo /D (subsection.18.3.2) >> +<< /S /GoTo /D (section.17.2) >> endobj 1120 0 obj -(18.3.2 A little Experiment to warn you) +(17.2 Common Errors) endobj 1121 0 obj -<< /S /GoTo /D (section.18.4) >> +<< /S /GoTo /D (chapter.18) >> endobj 1124 0 obj -(18.4 Extended Sample Configuration to Print with Samba-3) +(18 Classical Printing Support) endobj 1125 0 obj -<< /S /GoTo /D (section.18.5) >> +<< /S /GoTo /D (section.18.1) >> endobj 1128 0 obj -(18.5 Detailed Explanation of the Example's Settings) +(18.1 Features and Benefits) endobj 1129 0 obj -<< /S /GoTo /D (subsection.18.5.1) >> +<< /S /GoTo /D (section.18.2) >> endobj 1132 0 obj -(18.5.1 The [global] Section) +(18.2 Technical Introduction) endobj 1133 0 obj -<< /S /GoTo /D (subsection.18.5.2) >> +<< /S /GoTo /D (subsection.18.2.1) >> endobj 1136 0 obj -(18.5.2 The [printers] Section) +(18.2.1 What happens if you send a Job from a Client) endobj 1137 0 obj -<< /S /GoTo /D (subsection.18.5.3) >> +<< /S /GoTo /D (subsection.18.2.2) >> endobj 1140 0 obj -(18.5.3 Any [my\137printer\137name] Section) +(18.2.2 Printing Related Configuration Parameters) endobj 1141 0 obj -<< /S /GoTo /D (subsection.18.5.4) >> +<< /S /GoTo /D (subsection.18.2.3) >> endobj 1144 0 obj -(18.5.4 Print Commands) +(18.2.3 Parameters Recommended for Use) endobj 1145 0 obj -<< /S /GoTo /D (subsection.18.5.5) >> +<< /S /GoTo /D (section.18.3) >> endobj 1148 0 obj -(18.5.5 Default Print Commands for various Unix Print Subsystems) +(18.3 A simple Configuration to Print) endobj 1149 0 obj -<< /S /GoTo /D (subsection.18.5.6) >> +<< /S /GoTo /D (subsection.18.3.1) >> endobj 1152 0 obj -(18.5.6 Setting up your own Print Commands) +(18.3.1 Verification of "Settings in Use" with testparm) endobj 1153 0 obj -<< /S /GoTo /D (section.18.6) >> +<< /S /GoTo /D (subsection.18.3.2) >> endobj 1156 0 obj -(18.6 Innovations in Samba Printing since 2.2) +(18.3.2 A little Experiment to warn you) endobj 1157 0 obj -<< /S /GoTo /D (subsection.18.6.1) >> +<< /S /GoTo /D (section.18.4) >> endobj 1160 0 obj -(18.6.1 Client Drivers on Samba Server for Point'n'Print) +(18.4 Extended Sample Configuration to Print) endobj 1161 0 obj -<< /S /GoTo /D (subsection.18.6.2) >> +<< /S /GoTo /D (section.18.5) >> endobj 1164 0 obj -(18.6.2 The [printer\044] Section is removed from Samba-3) +(18.5 Detailed Explanation of the Example's Settings) endobj 1165 0 obj -<< /S /GoTo /D (subsection.18.6.3) >> +<< /S /GoTo /D (subsection.18.5.1) >> endobj 1168 0 obj -(18.6.3 Creating the [print\044] Share) +(18.5.1 The [global] Section) endobj 1169 0 obj -<< /S /GoTo /D (subsection.18.6.4) >> +<< /S /GoTo /D (subsection.18.5.2) >> endobj 1172 0 obj -(18.6.4 Parameters in the [print\044] Section) +(18.5.2 The [printers] Section) endobj 1173 0 obj -<< /S /GoTo /D (subsection.18.6.5) >> +<< /S /GoTo /D (subsection.18.5.3) >> endobj 1176 0 obj -(18.6.5 Subdirectory Structure in [print\044]) +(18.5.3 Any [my\137printer\137name] Section) endobj 1177 0 obj -<< /S /GoTo /D (section.18.7) >> +<< /S /GoTo /D (subsection.18.5.4) >> endobj 1180 0 obj -(18.7 Installing Drivers into [print\044]) +(18.5.4 Print Commands) endobj 1181 0 obj -<< /S /GoTo /D (subsection.18.7.1) >> +<< /S /GoTo /D (subsection.18.5.5) >> endobj 1184 0 obj -(18.7.1 Setting Drivers for existing Printers with a Client GUI) +(18.5.5 Default Print Commands for various UNIX Print Subsystems) endobj 1185 0 obj -<< /S /GoTo /D (subsection.18.7.2) >> +<< /S /GoTo /D (subsection.18.5.6) >> endobj 1188 0 obj -(18.7.2 Setting Drivers for existing Printers with rpcclient) +(18.5.6 Setting up your own Print Commands) endobj 1189 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.1) >> +<< /S /GoTo /D (section.18.6) >> endobj 1192 0 obj -(18.7.2.1 Identifying the Driver Files) +(18.6 Innovations in Samba Printing since 2.2) endobj 1193 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.2) >> +<< /S /GoTo /D (subsection.18.6.1) >> endobj 1196 0 obj -(18.7.2.2 Collecting the Driver Files from a Windows Host's [print\044] Share) +(18.6.1 Client Drivers on Samba Server for Point'n'Print) endobj 1197 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.3) >> +<< /S /GoTo /D (subsection.18.6.2) >> endobj 1200 0 obj -(18.7.2.3 Depositing the Driver Files into [print\044]) +(18.6.2 The [printer\044] Section is removed from Samba 3) endobj 1201 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.4) >> +<< /S /GoTo /D (subsection.18.6.3) >> endobj 1204 0 obj -(18.7.2.4 Check if the Driver Files are there \(with smbclient\)) +(18.6.3 Creating the [print\044] Share) endobj 1205 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.5) >> +<< /S /GoTo /D (subsection.18.6.4) >> endobj 1208 0 obj -(18.7.2.5 Running rpcclient with adddriver) +(18.6.4 Parameters in the [print\044] Section) endobj 1209 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.6) >> +<< /S /GoTo /D (subsection.18.6.5) >> endobj 1212 0 obj -(18.7.2.6 Check how Driver Files have been moved after adddriver finished) +(18.6.5 Subdirectory Structure in [print\044]) endobj 1213 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.7) >> +<< /S /GoTo /D (section.18.7) >> endobj 1216 0 obj -(18.7.2.7 Check if the Driver is recognized by Samba) +(18.7 Installing Drivers into [print\044]) endobj 1217 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.8) >> +<< /S /GoTo /D (subsection.18.7.1) >> endobj 1220 0 obj -(18.7.2.8 A side note: you are not bound to specific driver names) +(18.7.1 Setting Drivers for existing Printers with a Client GUI) endobj 1221 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.9) >> +<< /S /GoTo /D (subsection.18.7.2) >> endobj 1224 0 obj -(18.7.2.9 La Grande Finale: Running rpcclient with setdriver) +(18.7.2 Setting Drivers for existing Printers with rpcclient) endobj 1225 0 obj -<< /S /GoTo /D (section.18.8) >> +<< /S /GoTo /D (subsubsection.18.7.2.1) >> endobj 1228 0 obj -(18.8 "The Proof of the Pudding lies in the Eating" \(Client Driver Install Procedure\)) +(18.7.2.1 Identifying the Driver Files) endobj 1229 0 obj -<< /S /GoTo /D (subsection.18.8.1) >> +<< /S /GoTo /D (subsubsection.18.7.2.2) >> endobj 1232 0 obj -(18.8.1 The first Client Driver Installation) +(18.7.2.2 Collecting the Driver Files from a Windows Host's [print\044] Share) endobj 1233 0 obj -<< /S /GoTo /D (subsection.18.8.2) >> +<< /S /GoTo /D (subsubsection.18.7.2.3) >> endobj 1236 0 obj -(18.8.2 IMPORTANT! Setting Device Modes on new Printers) +(18.7.2.3 Depositing the Driver Files into [print\044]) endobj 1237 0 obj -<< /S /GoTo /D (subsection.18.8.3) >> +<< /S /GoTo /D (subsubsection.18.7.2.4) >> endobj 1240 0 obj -(18.8.3 Further Client Driver Install Procedures) +(18.7.2.4 Check if the Driver Files are there \(with smbclient\)) endobj 1241 0 obj -<< /S /GoTo /D (subsection.18.8.4) >> +<< /S /GoTo /D (subsubsection.18.7.2.5) >> endobj 1244 0 obj -(18.8.4 Always make first Client Connection as root or "printer admin") +(18.7.2.5 Running rpcclient with adddriver) endobj 1245 0 obj -<< /S /GoTo /D (section.18.9) >> +<< /S /GoTo /D (subsubsection.18.7.2.6) >> endobj 1248 0 obj -(18.9 Other Gotchas) +(18.7.2.6 Check how Driver Files have been moved after adddriver finished) endobj 1249 0 obj -<< /S /GoTo /D (subsection.18.9.1) >> +<< /S /GoTo /D (subsubsection.18.7.2.7) >> endobj 1252 0 obj -(18.9.1 Setting Default Print Options for the Client Drivers) +(18.7.2.7 Check if the Driver is recognized by Samba) endobj 1253 0 obj -<< /S /GoTo /D (subsection.18.9.2) >> +<< /S /GoTo /D (subsubsection.18.7.2.8) >> endobj 1256 0 obj -(18.9.2 Supporting large Numbers of Printers) +(18.7.2.8 A side note: you are not bound to specific driver names) endobj 1257 0 obj -<< /S /GoTo /D (subsection.18.9.3) >> +<< /S /GoTo /D (subsubsection.18.7.2.9) >> endobj 1260 0 obj -(18.9.3 Adding new Printers with the Windows NT APW) +(18.7.2.9 Running rpcclient with setdriver) endobj 1261 0 obj -<< /S /GoTo /D (subsection.18.9.4) >> +<< /S /GoTo /D (section.18.8) >> endobj 1264 0 obj -(18.9.4 Weird Error Message Cannot connect under a different Name) +(18.8 Client Driver Install Procedure) endobj 1265 0 obj -<< /S /GoTo /D (subsection.18.9.5) >> +<< /S /GoTo /D (subsection.18.8.1) >> endobj 1268 0 obj -(18.9.5 Be careful when assembling Driver Files) +(18.8.1 The first Client Driver Installation) endobj 1269 0 obj -<< /S /GoTo /D (subsection.18.9.6) >> +<< /S /GoTo /D (subsection.18.8.2) >> endobj 1272 0 obj -(18.9.6 Samba and Printer Ports) +(18.8.2 IMPORTANT! Setting Device Modes on new Printers) endobj 1273 0 obj -<< /S /GoTo /D (subsection.18.9.7) >> +<< /S /GoTo /D (subsection.18.8.3) >> endobj 1276 0 obj -(18.9.7 Avoiding the most common Misconfigurations of the Client Driver) +(18.8.3 Further Client Driver Install Procedures) endobj 1277 0 obj -<< /S /GoTo /D (section.18.10) >> +<< /S /GoTo /D (subsection.18.8.4) >> endobj 1280 0 obj -(18.10 The Imprints Toolset) +(18.8.4 Always make first Client Connection as root or "printer admin") endobj 1281 0 obj -<< /S /GoTo /D (subsection.18.10.1) >> +<< /S /GoTo /D (section.18.9) >> endobj 1284 0 obj -(18.10.1 What is Imprints?) +(18.9 Other Gotchas) endobj 1285 0 obj -<< /S /GoTo /D (subsection.18.10.2) >> +<< /S /GoTo /D (subsection.18.9.1) >> endobj 1288 0 obj -(18.10.2 Creating Printer Driver Packages) +(18.9.1 Setting Default Print Options for the Client Drivers) endobj 1289 0 obj -<< /S /GoTo /D (subsection.18.10.3) >> +<< /S /GoTo /D (subsection.18.9.2) >> endobj 1292 0 obj -(18.10.3 The Imprints Server) +(18.9.2 Supporting large Numbers of Printers) endobj 1293 0 obj -<< /S /GoTo /D (subsection.18.10.4) >> +<< /S /GoTo /D (subsection.18.9.3) >> endobj 1296 0 obj -(18.10.4 The Installation Client) +(18.9.3 Adding new Printers with the Windows NT APW) endobj 1297 0 obj -<< /S /GoTo /D (section.18.11) >> +<< /S /GoTo /D (subsection.18.9.4) >> endobj 1300 0 obj -(18.11 Add Network Printers at Logon without User Interaction) +(18.9.4 Weird Error Message Cannot connect under a different Name) endobj 1301 0 obj -<< /S /GoTo /D (section.18.12) >> +<< /S /GoTo /D (subsection.18.9.5) >> endobj 1304 0 obj -(18.12 The addprinter command) +(18.9.5 Be careful when assembling Driver Files) endobj 1305 0 obj -<< /S /GoTo /D (section.18.13) >> +<< /S /GoTo /D (subsection.18.9.6) >> endobj 1308 0 obj -(18.13 Migration of "Classical" printing to Samba-3) +(18.9.6 Samba and Printer Ports) endobj 1309 0 obj -<< /S /GoTo /D (section.18.14) >> +<< /S /GoTo /D (subsection.18.9.7) >> endobj 1312 0 obj -(18.14 Publishing Printer Information in Active Directory or LDAP) +(18.9.7 Avoiding the most common Misconfigurations of the Client Driver) endobj 1313 0 obj -<< /S /GoTo /D (section.18.15) >> +<< /S /GoTo /D (section.18.10) >> endobj 1316 0 obj -(18.15 Common Errors and Problems) +(18.10 The Imprints Toolset) endobj 1317 0 obj -<< /S /GoTo /D (subsection.18.15.1) >> +<< /S /GoTo /D (subsection.18.10.1) >> endobj 1320 0 obj -(18.15.1 I give my root password but I don't get access) +(18.10.1 What is Imprints?) endobj 1321 0 obj -<< /S /GoTo /D (subsection.18.15.2) >> +<< /S /GoTo /D (subsection.18.10.2) >> endobj 1324 0 obj -(18.15.2 My printjobs get spooled into the spooling directory, but then get lost) +(18.10.2 Creating Printer Driver Packages) endobj 1325 0 obj -<< /S /GoTo /D (chapter.19) >> +<< /S /GoTo /D (subsection.18.10.3) >> endobj 1328 0 obj -(19 CUPS Printing Support in Samba 3.0) +(18.10.3 The Imprints Server) endobj 1329 0 obj -<< /S /GoTo /D (section.19.1) >> +<< /S /GoTo /D (subsection.18.10.4) >> endobj 1332 0 obj -(19.1 Introduction) +(18.10.4 The Installation Client) endobj 1333 0 obj -<< /S /GoTo /D (subsection.19.1.1) >> +<< /S /GoTo /D (section.18.11) >> endobj 1336 0 obj -(19.1.1 Features and Benefits) +(18.11 Add Network Printers at Logon without User Interaction) endobj 1337 0 obj -<< /S /GoTo /D (subsection.19.1.2) >> +<< /S /GoTo /D (section.18.12) >> endobj 1340 0 obj -(19.1.2 Overview) +(18.12 The addprinter command) endobj 1341 0 obj -<< /S /GoTo /D (section.19.2) >> +<< /S /GoTo /D (section.18.13) >> endobj 1344 0 obj -(19.2 Basic Configuration of CUPS support) +(18.13 Migration of "Classical" printing to Samba) endobj 1345 0 obj -<< /S /GoTo /D (subsection.19.2.1) >> +<< /S /GoTo /D (section.18.14) >> endobj 1348 0 obj -(19.2.1 Linking of smbd with libcups.so) +(18.14 Publishing Printer Information in Active Directory or LDAP) endobj 1349 0 obj -<< /S /GoTo /D (subsection.19.2.2) >> +<< /S /GoTo /D (section.18.15) >> endobj 1352 0 obj -(19.2.2 Simple smb.conf Settings for CUPS) +(18.15 Common Errors) endobj 1353 0 obj -<< /S /GoTo /D (subsection.19.2.3) >> +<< /S /GoTo /D (subsection.18.15.1) >> endobj 1356 0 obj -(19.2.3 More complex smb.conf Settings for CUPS) +(18.15.1 I give my root password but I don't get access) endobj 1357 0 obj -<< /S /GoTo /D (section.19.3) >> +<< /S /GoTo /D (subsection.18.15.2) >> endobj 1360 0 obj -(19.3 Advanced Configuration) +(18.15.2 My printjobs get spooled into the spooling directory, but then get lost) endobj 1361 0 obj -<< /S /GoTo /D (subsection.19.3.1) >> +<< /S /GoTo /D (chapter.19) >> endobj 1364 0 obj -(19.3.1 Central spooling vs. "Peer-to-Peer" printing) +(19 CUPS Printing Support in Samba 3.0) endobj 1365 0 obj -<< /S /GoTo /D (subsection.19.3.2) >> +<< /S /GoTo /D (section.19.1) >> endobj 1368 0 obj -(19.3.2 CUPS/Samba as a "spooling-only" Print Server; "raw" printing with Vendor Drivers on Windows Clients) +(19.1 Introduction) endobj 1369 0 obj -<< /S /GoTo /D (subsection.19.3.3) >> +<< /S /GoTo /D (subsection.19.1.1) >> endobj 1372 0 obj -(19.3.3 Driver Installation Methods on Windows Clients) +(19.1.1 Features and Benefits) endobj 1373 0 obj -<< /S /GoTo /D (subsection.19.3.4) >> +<< /S /GoTo /D (subsection.19.1.2) >> endobj 1376 0 obj -(19.3.4 Explicitly enable "raw" printing for application/octet-stream!) +(19.1.2 Overview) endobj 1377 0 obj -<< /S /GoTo /D (subsection.19.3.5) >> +<< /S /GoTo /D (section.19.2) >> endobj 1380 0 obj -(19.3.5 Three familiar Methods for driver upload plus a new one) +(19.2 Basic Configuration of CUPS support) endobj 1381 0 obj -<< /S /GoTo /D (section.19.4) >> +<< /S /GoTo /D (subsection.19.2.1) >> endobj 1384 0 obj -(19.4 Using CUPS/Samba in an advanced Way -- intelligent printing with PostScript Driver Download) +(19.2.1 Linking of smbd with libcups.so) endobj 1385 0 obj -<< /S /GoTo /D (subsection.19.4.1) >> +<< /S /GoTo /D (subsection.19.2.2) >> endobj 1388 0 obj -(19.4.1 GDI on Windows -- PostScript on Unix) +(19.2.2 Simple smb.conf Settings for CUPS) endobj 1389 0 obj -<< /S /GoTo /D (subsection.19.4.2) >> +<< /S /GoTo /D (subsection.19.2.3) >> endobj 1392 0 obj -(19.4.2 Windows Drivers, GDI and EMF) +(19.2.3 More complex smb.conf Settings for CUPS) endobj 1393 0 obj -<< /S /GoTo /D (subsection.19.4.3) >> +<< /S /GoTo /D (section.19.3) >> endobj 1396 0 obj -(19.4.3 Unix Printfile Conversion and GUI Basics) +(19.3 Advanced Configuration) endobj 1397 0 obj -<< /S /GoTo /D (subsection.19.4.4) >> +<< /S /GoTo /D (subsection.19.3.1) >> endobj 1400 0 obj -(19.4.4 PostScript and Ghostscript) +(19.3.1 Central spooling vs. "Peer-to-Peer" printing) endobj 1401 0 obj -<< /S /GoTo /D (subsection.19.4.5) >> +<< /S /GoTo /D (subsection.19.3.2) >> endobj 1404 0 obj -(19.4.5 Ghostscript -- the Software RIP for non-PostScript Printers) +(19.3.2 CUPS/Samba as a "spooling-only" Print Server; "raw" printing with Vendor Drivers on Windows Clients) endobj 1405 0 obj -<< /S /GoTo /D (subsection.19.4.6) >> +<< /S /GoTo /D (subsection.19.3.3) >> endobj 1408 0 obj -(19.4.6 PostScript Printer Description \(PPD\) Specification) +(19.3.3 Driver Installation Methods on Windows Clients) endobj 1409 0 obj -<< /S /GoTo /D (subsection.19.4.7) >> +<< /S /GoTo /D (subsection.19.3.4) >> endobj 1412 0 obj -(19.4.7 CUPS can use all Windows-formatted Vendor PPDs) +(19.3.4 Explicitly enable "raw" printing for application/octet-stream!) endobj 1413 0 obj -<< /S /GoTo /D (subsection.19.4.8) >> +<< /S /GoTo /D (subsection.19.3.5) >> endobj 1416 0 obj -(19.4.8 CUPS also uses PPDs for non-PostScript Printers) +(19.3.5 Three familiar Methods for driver upload plus a new one) endobj 1417 0 obj -<< /S /GoTo /D (section.19.5) >> +<< /S /GoTo /D (section.19.4) >> endobj 1420 0 obj -(19.5 The CUPS Filtering Architecture) +(19.4 Using CUPS/Samba in an advanced Way -- intelligent printing with PostScript Driver Download) endobj 1421 0 obj -<< /S /GoTo /D (subsection.19.5.1) >> +<< /S /GoTo /D (subsection.19.4.1) >> endobj 1424 0 obj -(19.5.1 MIME types and CUPS Filters) +(19.4.1 GDI on Windows -- PostScript on UNIX) endobj 1425 0 obj -<< /S /GoTo /D (subsection.19.5.2) >> +<< /S /GoTo /D (subsection.19.4.2) >> endobj 1428 0 obj -(19.5.2 MIME type Conversion Rules) +(19.4.2 Windows Drivers, GDI and EMF) endobj 1429 0 obj -<< /S /GoTo /D (subsection.19.5.3) >> +<< /S /GoTo /D (subsection.19.4.3) >> endobj 1432 0 obj -(19.5.3 Filter Requirements) +(19.4.3 UNIX Printfile Conversion and GUI Basics) endobj 1433 0 obj -<< /S /GoTo /D (subsection.19.5.4) >> +<< /S /GoTo /D (subsection.19.4.4) >> endobj 1436 0 obj -(19.5.4 Prefilters) +(19.4.4 PostScript and Ghostscript) endobj 1437 0 obj -<< /S /GoTo /D (subsection.19.5.5) >> +<< /S /GoTo /D (subsection.19.4.5) >> endobj 1440 0 obj -(19.5.5 pstops) +(19.4.5 Ghostscript -- the Software RIP for non-PostScript Printers) endobj 1441 0 obj -<< /S /GoTo /D (subsection.19.5.6) >> +<< /S /GoTo /D (subsection.19.4.6) >> endobj 1444 0 obj -(19.5.6 pstoraster) +(19.4.6 PostScript Printer Description \(PPD\) Specification) endobj 1445 0 obj -<< /S /GoTo /D (subsection.19.5.7) >> +<< /S /GoTo /D (subsection.19.4.7) >> endobj 1448 0 obj -(19.5.7 imagetops and imagetoraster) +(19.4.7 CUPS can use all Windows-formatted Vendor PPDs) endobj 1449 0 obj -<< /S /GoTo /D (subsection.19.5.8) >> +<< /S /GoTo /D (subsection.19.4.8) >> endobj 1452 0 obj -(19.5.8 rasterto [printers specific]) +(19.4.8 CUPS also uses PPDs for non-PostScript Printers) endobj 1453 0 obj -<< /S /GoTo /D (subsection.19.5.9) >> +<< /S /GoTo /D (section.19.5) >> endobj 1456 0 obj -(19.5.9 CUPS Backends) +(19.5 The CUPS Filtering Architecture) endobj 1457 0 obj -<< /S /GoTo /D (subsection.19.5.10) >> +<< /S /GoTo /D (subsection.19.5.1) >> endobj 1460 0 obj -(19.5.10 cupsomatic/Foomatic -- how do they fit into the Picture?) +(19.5.1 MIME types and CUPS Filters) endobj 1461 0 obj -<< /S /GoTo /D (subsection.19.5.11) >> +<< /S /GoTo /D (subsection.19.5.2) >> endobj 1464 0 obj -(19.5.11 The Complete Picture) +(19.5.2 MIME type Conversion Rules) endobj 1465 0 obj -<< /S /GoTo /D (subsection.19.5.12) >> +<< /S /GoTo /D (subsection.19.5.3) >> endobj 1468 0 obj -(19.5.12 mime.convs) +(19.5.3 Filter Requirements) endobj 1469 0 obj -<< /S /GoTo /D (subsection.19.5.13) >> +<< /S /GoTo /D (subsection.19.5.4) >> endobj 1472 0 obj -(19.5.13 "Raw" printing) +(19.5.4 Prefilters) endobj 1473 0 obj -<< /S /GoTo /D (subsection.19.5.14) >> +<< /S /GoTo /D (subsection.19.5.5) >> endobj 1476 0 obj -(19.5.14 "application/octet-stream" printing) +(19.5.5 pstops) endobj 1477 0 obj -<< /S /GoTo /D (subsection.19.5.15) >> +<< /S /GoTo /D (subsection.19.5.6) >> endobj 1480 0 obj -(19.5.15 PostScript Printer Descriptions \(PPDs\) for non-PS Printers) +(19.5.6 pstoraster) endobj 1481 0 obj -<< /S /GoTo /D (subsection.19.5.16) >> +<< /S /GoTo /D (subsection.19.5.7) >> endobj 1484 0 obj -(19.5.16 Difference between cupsomatic/foomatic-rip and native CUPS printing) +(19.5.7 imagetops and imagetoraster) endobj 1485 0 obj -<< /S /GoTo /D (subsection.19.5.17) >> +<< /S /GoTo /D (subsection.19.5.8) >> endobj 1488 0 obj -(19.5.17 Examples for filtering Chains) +(19.5.8 rasterto [printers specific]) endobj 1489 0 obj -<< /S /GoTo /D (subsection.19.5.18) >> +<< /S /GoTo /D (subsection.19.5.9) >> endobj 1492 0 obj -(19.5.18 Sources of CUPS drivers / PPDs) +(19.5.9 CUPS Backends) endobj 1493 0 obj -<< /S /GoTo /D (subsection.19.5.19) >> +<< /S /GoTo /D (subsection.19.5.10) >> endobj 1496 0 obj -(19.5.19 Printing with Interface Scripts) +(19.5.10 cupsomatic/Foomatic -- how do they fit into the Picture?) endobj 1497 0 obj -<< /S /GoTo /D (section.19.6) >> +<< /S /GoTo /D (subsection.19.5.11) >> endobj 1500 0 obj -(19.6 Network printing \(purely Windows\)) +(19.5.11 The Complete Picture) endobj 1501 0 obj -<< /S /GoTo /D (subsection.19.6.1) >> +<< /S /GoTo /D (subsection.19.5.12) >> endobj 1504 0 obj -(19.6.1 From Windows Clients to an NT Print Server) +(19.5.12 mime.convs) endobj 1505 0 obj -<< /S /GoTo /D (subsection.19.6.2) >> +<< /S /GoTo /D (subsection.19.5.13) >> endobj 1508 0 obj -(19.6.2 Driver Execution on the Client) +(19.5.13 "Raw" printing) endobj 1509 0 obj -<< /S /GoTo /D (subsection.19.6.3) >> +<< /S /GoTo /D (subsection.19.5.14) >> endobj 1512 0 obj -(19.6.3 Driver Execution on the Server) +(19.5.14 "application/octet-stream" printing) endobj 1513 0 obj -<< /S /GoTo /D (section.19.7) >> +<< /S /GoTo /D (subsection.19.5.15) >> endobj 1516 0 obj -(19.7 Network Printing \(Windows clients -- UNIX/Samba Print Servers\)) +(19.5.15 PostScript Printer Descriptions \(PPDs\) for non-PS Printers) endobj 1517 0 obj -<< /S /GoTo /D (subsection.19.7.1) >> +<< /S /GoTo /D (subsection.19.5.16) >> endobj 1520 0 obj -(19.7.1 From Windows Clients to a CUPS/Samba Print Server) +(19.5.16 Difference between cupsomatic/foomatic-rip and native CUPS printing) endobj 1521 0 obj -<< /S /GoTo /D (subsection.19.7.2) >> +<< /S /GoTo /D (subsection.19.5.17) >> endobj 1524 0 obj -(19.7.2 Samba receiving Jobfiles and passing them to CUPS) +(19.5.17 Examples for filtering Chains) endobj 1525 0 obj -<< /S /GoTo /D (section.19.8) >> +<< /S /GoTo /D (subsection.19.5.18) >> endobj 1528 0 obj -(19.8 Network PostScript RIP: CUPS Filters on Server -- clients use PostScript Driver with CUPS-PPDs) +(19.5.18 Sources of CUPS drivers / PPDs) endobj 1529 0 obj -<< /S /GoTo /D (subsection.19.8.1) >> +<< /S /GoTo /D (subsection.19.5.19) >> endobj 1532 0 obj -(19.8.1 PPDs for non-PS Printers on UNIX) +(19.5.19 Printing with Interface Scripts) endobj 1533 0 obj -<< /S /GoTo /D (subsection.19.8.2) >> +<< /S /GoTo /D (section.19.6) >> endobj 1536 0 obj -(19.8.2 PPDs for non-PS Printers on Windows) +(19.6 Network printing \(purely Windows\)) endobj 1537 0 obj -<< /S /GoTo /D (section.19.9) >> +<< /S /GoTo /D (subsection.19.6.1) >> endobj 1540 0 obj -(19.9 Windows Terminal Servers \(WTS\) as CUPS Clients) +(19.6.1 From Windows Clients to an NT Print Server) endobj 1541 0 obj -<< /S /GoTo /D (subsection.19.9.1) >> +<< /S /GoTo /D (subsection.19.6.2) >> endobj 1544 0 obj -(19.9.1 Printer Drivers running in "Kernel Mode" cause many Problems) +(19.6.2 Driver Execution on the Client) endobj 1545 0 obj -<< /S /GoTo /D (subsection.19.9.2) >> +<< /S /GoTo /D (subsection.19.6.3) >> endobj 1548 0 obj -(19.9.2 Workarounds impose Heavy Limitations) +(19.6.3 Driver Execution on the Server) endobj 1549 0 obj -<< /S /GoTo /D (subsection.19.9.3) >> +<< /S /GoTo /D (section.19.7) >> endobj 1552 0 obj -(19.9.3 CUPS: a "Magical Stone"?) +(19.7 Network Printing \(Windows clients -- UNIX/Samba Print Servers\)) endobj 1553 0 obj -<< /S /GoTo /D (subsection.19.9.4) >> +<< /S /GoTo /D (subsection.19.7.1) >> endobj 1556 0 obj -(19.9.4 PostScript Drivers with no major problems -- even in Kernel Mode) +(19.7.1 From Windows Clients to a CUPS/Samba Print Server) endobj 1557 0 obj -<< /S /GoTo /D (section.19.10) >> +<< /S /GoTo /D (subsection.19.7.2) >> endobj 1560 0 obj -(19.10 Setting up CUPS for driver Download) +(19.7.2 Samba receiving Jobfiles and passing them to CUPS) endobj 1561 0 obj -<< /S /GoTo /D (subsection.19.10.1) >> +<< /S /GoTo /D (section.19.8) >> endobj 1564 0 obj -(19.10.1 cupsaddsmb: the unknown Utility) +(19.8 Network PostScript RIP: CUPS Filters on Server -- clients use PostScript Driver with CUPS-PPDs) endobj 1565 0 obj -<< /S /GoTo /D (subsection.19.10.2) >> +<< /S /GoTo /D (subsection.19.8.1) >> endobj 1568 0 obj -(19.10.2 Prepare your smb.conf for cupsaddsmb) +(19.8.1 PPDs for non-PS Printers on UNIX) endobj 1569 0 obj -<< /S /GoTo /D (subsection.19.10.3) >> +<< /S /GoTo /D (subsection.19.8.2) >> endobj 1572 0 obj -(19.10.3 CUPS Package of "PostScript Driver for WinNT/2k/XP") +(19.8.2 PPDs for non-PS Printers on Windows) endobj 1573 0 obj -<< /S /GoTo /D (subsection.19.10.4) >> +<< /S /GoTo /D (section.19.9) >> endobj 1576 0 obj -(19.10.4 Recognize the different Driver Files) +(19.9 Windows Terminal Servers \(WTS\) as CUPS Clients) endobj 1577 0 obj -<< /S /GoTo /D (subsection.19.10.5) >> +<< /S /GoTo /D (subsection.19.9.1) >> endobj 1580 0 obj -(19.10.5 Acquiring the Adobe Driver Files) +(19.9.1 Printer Drivers running in "Kernel Mode" cause many Problems) endobj 1581 0 obj -<< /S /GoTo /D (subsection.19.10.6) >> +<< /S /GoTo /D (subsection.19.9.2) >> endobj 1584 0 obj -(19.10.6 ESP Print Pro Package of "PostScript Driver for WinNT/2k/XP") +(19.9.2 Workarounds impose Heavy Limitations) endobj 1585 0 obj -<< /S /GoTo /D (subsection.19.10.7) >> +<< /S /GoTo /D (subsection.19.9.3) >> endobj 1588 0 obj -(19.10.7 Caveats to be considered) +(19.9.3 CUPS: a "Magical Stone"?) endobj 1589 0 obj -<< /S /GoTo /D (subsection.19.10.8) >> +<< /S /GoTo /D (subsection.19.9.4) >> endobj 1592 0 obj -(19.10.8 What are the Benefits of using the "CUPS PostScript Driver for Windows NT/2k/XP" as compared to the Adobe Driver?) +(19.9.4 PostScript Drivers with no major problems -- even in Kernel Mode) endobj 1593 0 obj -<< /S /GoTo /D (subsection.19.10.9) >> +<< /S /GoTo /D (section.19.10) >> endobj 1596 0 obj -(19.10.9 Run "cupsaddsmb" \(quiet Mode\)) +(19.10 Setting up CUPS for driver Download) endobj 1597 0 obj -<< /S /GoTo /D (subsection.19.10.10) >> +<< /S /GoTo /D (subsection.19.10.1) >> endobj 1600 0 obj -(19.10.10 Run "cupsaddsmb" with verbose Output) +(19.10.1 cupsaddsmb: the unknown Utility) endobj 1601 0 obj -<< /S /GoTo /D (subsection.19.10.11) >> +<< /S /GoTo /D (subsection.19.10.2) >> endobj 1604 0 obj -(19.10.11 Understanding cupsaddsmb) +(19.10.2 Prepare your smb.conf for cupsaddsmb) endobj 1605 0 obj -<< /S /GoTo /D (subsection.19.10.12) >> +<< /S /GoTo /D (subsection.19.10.3) >> endobj 1608 0 obj -(19.10.12 How to recognize if cupsaddsm completed successfully) +(19.10.3 CUPS Package of "PostScript Driver for WinNT/2k/XP") endobj 1609 0 obj -<< /S /GoTo /D (subsection.19.10.13) >> +<< /S /GoTo /D (subsection.19.10.4) >> endobj 1612 0 obj -(19.10.13 cupsaddsmb with a Samba PDC) +(19.10.4 Recognize the different Driver Files) endobj 1613 0 obj -<< /S /GoTo /D (subsection.19.10.14) >> +<< /S /GoTo /D (subsection.19.10.5) >> endobj 1616 0 obj -(19.10.14 cupsaddsmb Flowchart) +(19.10.5 Acquiring the Adobe Driver Files) endobj 1617 0 obj -<< /S /GoTo /D (subsection.19.10.15) >> +<< /S /GoTo /D (subsection.19.10.6) >> endobj 1620 0 obj -(19.10.15 Installing the PostScript Driver on a Client) +(19.10.6 ESP Print Pro Package of "PostScript Driver for WinNT/2k/XP") endobj 1621 0 obj -<< /S /GoTo /D (subsection.19.10.16) >> +<< /S /GoTo /D (subsection.19.10.7) >> endobj 1624 0 obj -(19.10.16 Avoiding critical PostScript Driver Settings on the Client) +(19.10.7 Caveats to be considered) endobj 1625 0 obj -<< /S /GoTo /D (section.19.11) >> +<< /S /GoTo /D (subsection.19.10.8) >> endobj 1628 0 obj -(19.11 Installing PostScript Driver Files manually \(using rpcclient\)) +(19.10.8 Benefits of using "CUPS PostScript Driver for Windows NT/2k/XP" instead of Adobe Driver) endobj 1629 0 obj -<< /S /GoTo /D (subsection.19.11.1) >> +<< /S /GoTo /D (subsection.19.10.9) >> endobj 1632 0 obj -(19.11.1 A Check of the rpcclient man Page) +(19.10.9 Run "cupsaddsmb" \(quiet Mode\)) endobj 1633 0 obj -<< /S /GoTo /D (subsection.19.11.2) >> +<< /S /GoTo /D (subsection.19.10.10) >> endobj 1636 0 obj -(19.11.2 Understanding the rpcclient man Page) +(19.10.10 Run "cupsaddsmb" with verbose Output) endobj 1637 0 obj -<< /S /GoTo /D (subsection.19.11.3) >> +<< /S /GoTo /D (subsection.19.10.11) >> endobj 1640 0 obj -(19.11.3 Producing an Example by querying a Windows Box) +(19.10.11 Understanding cupsaddsmb) endobj 1641 0 obj -<< /S /GoTo /D (subsection.19.11.4) >> +<< /S /GoTo /D (subsection.19.10.12) >> endobj 1644 0 obj -(19.11.4 What is required for adddriver and setdriver to succeed) +(19.10.12 How to recognize if cupsaddsmb completed successfully) endobj 1645 0 obj -<< /S /GoTo /D (subsection.19.11.5) >> +<< /S /GoTo /D (subsection.19.10.13) >> endobj 1648 0 obj -(19.11.5 Manual Commandline Driver Installation in 15 little Steps) +(19.10.13 cupsaddsmb with a Samba PDC) endobj 1649 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.1) >> +<< /S /GoTo /D (subsection.19.10.14) >> endobj 1652 0 obj -(19.11.5.1 First Step: Install the Printer on CUPS) +(19.10.14 cupsaddsmb Flowchart) endobj 1653 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.2) >> +<< /S /GoTo /D (subsection.19.10.15) >> endobj 1656 0 obj -(19.11.5.2 Second Step \(optional\): Check if the Printer is recognized by Samba) +(19.10.15 Installing the PostScript Driver on a Client) endobj 1657 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.3) >> +<< /S /GoTo /D (subsection.19.10.16) >> endobj 1660 0 obj -(19.11.5.3 Third Step \(optional\): Check if Samba knows a Driver for the Printer) +(19.10.16 Avoiding critical PostScript Driver Settings on the Client) endobj 1661 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.4) >> +<< /S /GoTo /D (section.19.11) >> endobj 1664 0 obj -(19.11.5.4 Fourth Step: Put all required Driver Files into Samba's [print\044]) +(19.11 Installing PostScript Driver Files manually \(using rpcclient\)) endobj 1665 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.5) >> +<< /S /GoTo /D (subsection.19.11.1) >> endobj 1668 0 obj -(19.11.5.5 Fifth Step: Verify where the Driver Files are now) +(19.11.1 A Check of the rpcclient man Page) endobj 1669 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.6) >> +<< /S /GoTo /D (subsection.19.11.2) >> endobj 1672 0 obj -(19.11.5.6 Sixth Step: Tell Samba that these are Driver Files \(adddriver\)) +(19.11.2 Understanding the rpcclient man page) endobj 1673 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.7) >> +<< /S /GoTo /D (subsection.19.11.3) >> endobj 1676 0 obj -(19.11.5.7 Seventh Step: Verify where the Driver Files are now) +(19.11.3 Producing an Example by querying a Windows Box) endobj 1677 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.8) >> +<< /S /GoTo /D (subsection.19.11.4) >> endobj 1680 0 obj -(19.11.5.8 Eighth Step \(optional\): Verify if Samba now recognizes the Driver) +(19.11.4 What is required for adddriver and setdriver to succeed) endobj 1681 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.9) >> +<< /S /GoTo /D (subsection.19.11.5) >> endobj 1684 0 obj -(19.11.5.9 Ninth Step: Tell Samba which Printer should use these Driver Files \(setdriver\)) +(19.11.5 Manual Driver Installation in 15 Steps) endobj 1685 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.10) >> +<< /S /GoTo /D (subsection.19.11.6) >> endobj 1688 0 obj -(19.11.5.10 Tenth Step \(optional\): Verify if Samba has this Association recognized) +(19.11.6 Troubleshooting revisited) endobj 1689 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.11) >> +<< /S /GoTo /D (section.19.12) >> endobj 1692 0 obj -(19.11.5.11 Eleventh Step \(optional\): Tickle the Driver into a correct Device Mode) +(19.12 The printing *.tdb Files) endobj 1693 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.12) >> +<< /S /GoTo /D (subsection.19.12.1) >> endobj 1696 0 obj -(19.11.5.12 Twelfth Step: Install the Printer on a Client \("Point'n'Print"\)) +(19.12.1 Trivial DataBase Files) endobj 1697 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.13) >> +<< /S /GoTo /D (subsection.19.12.2) >> endobj 1700 0 obj -(19.11.5.13 Thirteenth Step \(optional\): Print a Test Page) +(19.12.2 Binary Format) endobj 1701 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.14) >> +<< /S /GoTo /D (subsection.19.12.3) >> endobj 1704 0 obj -(19.11.5.14 Fourteenth Step \(recommended\): Study the Test Page) +(19.12.3 Losing *.tdb Files) endobj 1705 0 obj -<< /S /GoTo /D (subsubsection.19.11.5.15) >> +<< /S /GoTo /D (subsection.19.12.4) >> endobj 1708 0 obj -(19.11.5.15 Fifteenth Step \(obligatory\): Enjoy. Jump. Celebrate your Success) +(19.12.4 Using tdbbackup) endobj 1709 0 obj -<< /S /GoTo /D (subsection.19.11.6) >> +<< /S /GoTo /D (section.19.13) >> endobj 1712 0 obj -(19.11.6 Troubleshooting revisited) +(19.13 CUPS Print Drivers from Linuxprinting.org) endobj 1713 0 obj -<< /S /GoTo /D (section.19.12) >> +<< /S /GoTo /D (subsection.19.13.1) >> endobj 1716 0 obj -(19.12 The printing *.tdb Files) +(19.13.1 foomatic-rip and Foomatic explained) endobj 1717 0 obj -<< /S /GoTo /D (subsection.19.12.1) >> +<< /S /GoTo /D (subsubsection.19.13.1.1) >> endobj 1720 0 obj -(19.12.1 Trivial DataBase Files) +(19.13.1.1 690 "perfect" Printers) endobj 1721 0 obj -<< /S /GoTo /D (subsection.19.12.2) >> +<< /S /GoTo /D (subsubsection.19.13.1.2) >> endobj 1724 0 obj -(19.12.2 Binary Format) +(19.13.1.2 How the "Printing HOWTO" started it all) endobj 1725 0 obj -<< /S /GoTo /D (subsection.19.12.3) >> +<< /S /GoTo /D (subsubsection.19.13.1.3) >> endobj 1728 0 obj -(19.12.3 Losing *.tdb Files) +(19.13.1.3 Foomatic's strange Name) endobj 1729 0 obj -<< /S /GoTo /D (subsection.19.12.4) >> +<< /S /GoTo /D (subsubsection.19.13.1.4) >> endobj 1732 0 obj -(19.12.4 Using tdbbackup) +(19.13.1.4 cupsomatic, pdqomatic, lpdomatic, directomatic) endobj 1733 0 obj -<< /S /GoTo /D (section.19.13) >> +<< /S /GoTo /D (subsubsection.19.13.1.5) >> endobj 1736 0 obj -(19.13 CUPS Print Drivers from Linuxprinting.org) +(19.13.1.5 The Grand Unification achieved...) endobj 1737 0 obj -<< /S /GoTo /D (subsection.19.13.1) >> +<< /S /GoTo /D (subsubsection.19.13.1.6) >> endobj 1740 0 obj -(19.13.1 foomatic-rip and Foomatic explained) +(19.13.1.6 Driver Development outside) endobj 1741 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.1) >> +<< /S /GoTo /D (subsubsection.19.13.1.7) >> endobj 1744 0 obj -(19.13.1.1 690 "perfect" Printers) +(19.13.1.7 Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and commercial UNIX) endobj 1745 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.2) >> +<< /S /GoTo /D (subsubsection.19.13.1.8) >> endobj 1748 0 obj -(19.13.1.2 How the "Printing HOWTO" started it all) +(19.13.1.8 Foomatic Database generated PPDs) endobj 1749 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.3) >> +<< /S /GoTo /D (subsection.19.13.2) >> endobj 1752 0 obj -(19.13.1.3 Foomatic's strange Name) +(19.13.2 foomatic-rip and Foomatic-PPD Download and Installation) endobj 1753 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.4) >> +<< /S /GoTo /D (section.19.14) >> endobj 1756 0 obj -(19.13.1.4 cupsomatic, pdqomatic, lpdomatic, directomatic) +(19.14 Page Accounting with CUPS) endobj 1757 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.5) >> +<< /S /GoTo /D (subsection.19.14.1) >> endobj 1760 0 obj -(19.13.1.5 7.13.1.5.The Grand Unification achieved...) +(19.14.1 Setting up Quotas) endobj 1761 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.6) >> +<< /S /GoTo /D (subsection.19.14.2) >> endobj 1764 0 obj -(19.13.1.6 Driver Development outside) +(19.14.2 Correct and incorrect Accounting) endobj 1765 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.7) >> +<< /S /GoTo /D (subsection.19.14.3) >> endobj 1768 0 obj -(19.13.1.7 Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and commercial Unix) +(19.14.3 Adobe and CUPS PostScript Drivers for Windows Clients) endobj 1769 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.8) >> +<< /S /GoTo /D (subsection.19.14.4) >> endobj 1772 0 obj -(19.13.1.8 Foomatic Database generated PPDs) +(19.14.4 The page\137log File Syntax) endobj 1773 0 obj -<< /S /GoTo /D (subsection.19.13.2) >> +<< /S /GoTo /D (subsection.19.14.5) >> endobj 1776 0 obj -(19.13.2 foomatic-rip and Foomatic-PPD Download and Installation) +(19.14.5 Possible Shortcomings) endobj 1777 0 obj -<< /S /GoTo /D (section.19.14) >> +<< /S /GoTo /D (subsection.19.14.6) >> endobj 1780 0 obj -(19.14 Page Accounting with CUPS) +(19.14.6 Future Developments) endobj 1781 0 obj -<< /S /GoTo /D (subsection.19.14.1) >> +<< /S /GoTo /D (subsection.19.14.7) >> endobj 1784 0 obj -(19.14.1 Setting up Quotas) +(19.14.7 Other Accounting Tools) endobj 1785 0 obj -<< /S /GoTo /D (subsection.19.14.2) >> +<< /S /GoTo /D (section.19.15) >> endobj 1788 0 obj -(19.14.2 Correct and incorrect Accounting) +(19.15 Additional Material) endobj 1789 0 obj -<< /S /GoTo /D (subsection.19.14.3) >> +<< /S /GoTo /D (section.19.16) >> endobj 1792 0 obj -(19.14.3 Adobe and CUPS PostScript Drivers for Windows Clients) +(19.16 Auto-Deletion or Preservation of CUPS Spool Files) endobj 1793 0 obj -<< /S /GoTo /D (subsection.19.14.4) >> +<< /S /GoTo /D (subsection.19.16.1) >> endobj 1796 0 obj -(19.14.4 The page\137log File Syntax) +(19.16.1 CUPS Configuration Settings explained) endobj 1797 0 obj -<< /S /GoTo /D (subsection.19.14.5) >> +<< /S /GoTo /D (subsection.19.16.2) >> endobj 1800 0 obj -(19.14.5 Possible Shortcomings) +(19.16.2 Pre-conditions) endobj 1801 0 obj -<< /S /GoTo /D (subsection.19.14.6) >> +<< /S /GoTo /D (subsection.19.16.3) >> endobj 1804 0 obj -(19.14.6 Future Developments) +(19.16.3 Manual Configuration) endobj 1805 0 obj -<< /S /GoTo /D (subsection.19.14.7) >> +<< /S /GoTo /D (section.19.17) >> endobj 1808 0 obj -(19.14.7 Other Accounting Tools) +(19.17 In Case of Trouble.....) endobj 1809 0 obj -<< /S /GoTo /D (section.19.15) >> +<< /S /GoTo /D (section.19.18) >> endobj 1812 0 obj -(19.15 Additional Material) +(19.18 Printing from CUPS to Windows attached Printers) endobj 1813 0 obj -<< /S /GoTo /D (section.19.16) >> +<< /S /GoTo /D (section.19.19) >> endobj 1816 0 obj -(19.16 Auto-Deletion or Preservation of CUPS Spool Files) +(19.19 More CUPS filtering Chains) endobj 1817 0 obj -<< /S /GoTo /D (subsection.19.16.1) >> +<< /S /GoTo /D (section.19.20) >> endobj 1820 0 obj -(19.16.1 CUPS Configuration Settings explained) +(19.20 Common Errors) endobj 1821 0 obj -<< /S /GoTo /D (subsection.19.16.2) >> +<< /S /GoTo /D (subsection.19.20.1) >> endobj 1824 0 obj -(19.16.2 Pre-conditions) +(19.20.1 Win9x client can't install driver) endobj 1825 0 obj -<< /S /GoTo /D (subsection.19.16.3) >> +<< /S /GoTo /D (subsection.19.20.2) >> endobj 1828 0 obj -(19.16.3 Manual Configuration) +(19.20.2 "cupsaddsmb" keeps asking for root password in neverending loop) endobj 1829 0 obj -<< /S /GoTo /D (section.19.17) >> +<< /S /GoTo /D (subsection.19.20.3) >> endobj 1832 0 obj -(19.17 When not to use Samba to print to CUPS) +(19.20.3 "cupsaddsmb" gives "No PPD file for printer..." message while PPD file is present) endobj 1833 0 obj -<< /S /GoTo /D (section.19.18) >> +<< /S /GoTo /D (subsection.19.20.4) >> endobj 1836 0 obj -(19.18 In Case of Trouble.....) +(19.20.4 Client can't connect to Samba printer) endobj 1837 0 obj -<< /S /GoTo /D (subsection.19.18.1) >> +<< /S /GoTo /D (subsection.19.20.5) >> endobj 1840 0 obj -(19.18.1 Where to find Documentation) +(19.20.5 Can't reconnect to Samba under new account from Win2K/XP) endobj 1841 0 obj -<< /S /GoTo /D (subsection.19.18.2) >> +<< /S /GoTo /D (subsection.19.20.6) >> endobj 1844 0 obj -(19.18.2 How to ask for Help) +(19.20.6 Avoid being connected to the Samba server as the "wrong" user) endobj 1845 0 obj -<< /S /GoTo /D (subsection.19.18.3) >> +<< /S /GoTo /D (subsection.19.20.7) >> endobj 1848 0 obj -(19.18.3 Where to find Help) +(19.20.7 Upgrading to CUPS drivers from Adobe drivers on NT/2K/XP clients gives problems) endobj 1849 0 obj -<< /S /GoTo /D (section.19.19) >> +<< /S /GoTo /D (subsection.19.20.8) >> endobj 1852 0 obj -(19.19 Appendix) +(19.20.8 Can't use "cupsaddsmb" on Samba server which is a PDC) endobj 1853 0 obj -<< /S /GoTo /D (subsection.19.19.1) >> +<< /S /GoTo /D (subsection.19.20.9) >> endobj 1856 0 obj -(19.19.1 Printing from CUPS to Windows attached Printers) +(19.20.9 Deleted Win2K printer driver is still shown) endobj 1857 0 obj -<< /S /GoTo /D (subsection.19.19.2) >> +<< /S /GoTo /D (subsection.19.20.10) >> endobj 1860 0 obj -(19.19.2 More CUPS filtering Chains) +(19.20.10 Win2K/XP "Local Security Policies") endobj 1861 0 obj -<< /S /GoTo /D (subsection.19.19.3) >> +<< /S /GoTo /D (subsection.19.20.11) >> endobj 1864 0 obj -(19.19.3 Trouble Shooting Guidelines to fix typical Samba printing Problems) +(19.20.11 WinXP clients: "Administrator can not install printers for all local users") endobj 1865 0 obj -<< /S /GoTo /D (subsection.19.19.4) >> +<< /S /GoTo /D (subsection.19.20.12) >> endobj 1868 0 obj -(19.19.4 An Overview of the CUPS Printing Processes) +(19.20.12 "Print Change Notify" functions on NT-clients) endobj 1869 0 obj -<< /S /GoTo /D (chapter.20) >> +<< /S /GoTo /D (subsection.19.20.13) >> endobj 1872 0 obj -(20 Stackable VFS modules) +(19.20.13 WinXP-SP1) endobj 1873 0 obj -<< /S /GoTo /D (section.20.1) >> +<< /S /GoTo /D (subsection.19.20.14) >> endobj 1876 0 obj -(20.1 Features and Benefits) +(19.20.14 Print options for all users can't be set on Win2K/XP) endobj 1877 0 obj -<< /S /GoTo /D (section.20.2) >> +<< /S /GoTo /D (subsection.19.20.15) >> endobj 1880 0 obj -(20.2 Discussion) +(19.20.15 Most common blunders in driver settings on Windows clients) endobj 1881 0 obj -<< /S /GoTo /D (section.20.3) >> +<< /S /GoTo /D (subsection.19.20.16) >> endobj 1884 0 obj -(20.3 Included modules) +(19.20.16 cupsaddsmb does not work with newly installed printer) endobj 1885 0 obj -<< /S /GoTo /D (subsection.20.3.1) >> +<< /S /GoTo /D (subsection.19.20.17) >> endobj 1888 0 obj -(20.3.1 audit) +(19.20.17 Permissions on /var/spool/samba/ get reset after each reboot) endobj 1889 0 obj -<< /S /GoTo /D (subsection.20.3.2) >> +<< /S /GoTo /D (subsection.19.20.18) >> endobj 1892 0 obj -(20.3.2 extd\137audit) +(19.20.18 Printer named "lp" intermittently swallows jobs and spits out completely different ones) endobj 1893 0 obj -<< /S /GoTo /D (subsection.20.3.3) >> +<< /S /GoTo /D (subsection.19.20.19) >> endobj 1896 0 obj -(20.3.3 fake\137perms) +(19.20.19 Location of Adobe PostScript driver files necessary for "cupsaddsmb") endobj 1897 0 obj -<< /S /GoTo /D (subsection.20.3.4) >> +<< /S /GoTo /D (section.19.21) >> endobj 1900 0 obj -(20.3.4 recycle) +(19.21 An Overview of the CUPS Printing Processes) endobj 1901 0 obj -<< /S /GoTo /D (subsection.20.3.5) >> +<< /S /GoTo /D (chapter.20) >> endobj 1904 0 obj -(20.3.5 netatalk) +(20 Stackable VFS modules) endobj 1905 0 obj -<< /S /GoTo /D (section.20.4) >> +<< /S /GoTo /D (section.20.1) >> endobj 1908 0 obj -(20.4 VFS modules available elsewhere) +(20.1 Features and Benefits) endobj 1909 0 obj -<< /S /GoTo /D (subsection.20.4.1) >> +<< /S /GoTo /D (section.20.2) >> endobj 1912 0 obj -(20.4.1 DatabaseFS) +(20.2 Discussion) endobj 1913 0 obj -<< /S /GoTo /D (subsection.20.4.2) >> +<< /S /GoTo /D (section.20.3) >> endobj 1916 0 obj -(20.4.2 vscan) +(20.3 Included modules) endobj 1917 0 obj -<< /S /GoTo /D (section.20.5) >> +<< /S /GoTo /D (subsection.20.3.1) >> endobj 1920 0 obj -(20.5 Common Errors) +(20.3.1 audit) endobj 1921 0 obj -<< /S /GoTo /D (chapter.21) >> +<< /S /GoTo /D (subsection.20.3.2) >> endobj 1924 0 obj -(21 Integrated Logon Support using Winbind) +(20.3.2 extd\137audit) endobj 1925 0 obj -<< /S /GoTo /D (section.21.1) >> +<< /S /GoTo /D (subsection.20.3.3) >> endobj 1928 0 obj -(21.1 Features and Benefits) +(20.3.3 fake\137perms) endobj 1929 0 obj -<< /S /GoTo /D (section.21.2) >> +<< /S /GoTo /D (subsection.20.3.4) >> endobj 1932 0 obj -(21.2 Introduction) +(20.3.4 recycle) endobj 1933 0 obj -<< /S /GoTo /D (section.21.3) >> +<< /S /GoTo /D (subsection.20.3.5) >> endobj 1936 0 obj -(21.3 What Winbind Provides) +(20.3.5 netatalk) endobj 1937 0 obj -<< /S /GoTo /D (subsection.21.3.1) >> +<< /S /GoTo /D (section.20.4) >> endobj 1940 0 obj -(21.3.1 Target Uses) +(20.4 VFS modules available elsewhere) endobj 1941 0 obj -<< /S /GoTo /D (section.21.4) >> +<< /S /GoTo /D (subsection.20.4.1) >> endobj 1944 0 obj -(21.4 How Winbind Works) +(20.4.1 DatabaseFS) endobj 1945 0 obj -<< /S /GoTo /D (subsection.21.4.1) >> +<< /S /GoTo /D (subsection.20.4.2) >> endobj 1948 0 obj -(21.4.1 Microsoft Remote Procedure Calls) +(20.4.2 vscan) endobj 1949 0 obj -<< /S /GoTo /D (subsection.21.4.2) >> +<< /S /GoTo /D (chapter.21) >> endobj 1952 0 obj -(21.4.2 Microsoft Active Directory Services) +(21 Winbind: Use of Domain Accounts) endobj 1953 0 obj -<< /S /GoTo /D (subsection.21.4.3) >> +<< /S /GoTo /D (section.21.1) >> endobj 1956 0 obj -(21.4.3 Name Service Switch) +(21.1 Features and Benefits) endobj 1957 0 obj -<< /S /GoTo /D (subsection.21.4.4) >> +<< /S /GoTo /D (section.21.2) >> endobj 1960 0 obj -(21.4.4 Pluggable Authentication Modules) +(21.2 Introduction) endobj 1961 0 obj -<< /S /GoTo /D (subsection.21.4.5) >> +<< /S /GoTo /D (section.21.3) >> endobj 1964 0 obj -(21.4.5 User and Group ID Allocation) +(21.3 What Winbind Provides) endobj 1965 0 obj -<< /S /GoTo /D (subsection.21.4.6) >> +<< /S /GoTo /D (subsection.21.3.1) >> endobj 1968 0 obj -(21.4.6 Result Caching) +(21.3.1 Target Uses) endobj 1969 0 obj -<< /S /GoTo /D (section.21.5) >> +<< /S /GoTo /D (section.21.4) >> endobj 1972 0 obj -(21.5 Installation and Configuration) +(21.4 How Winbind Works) endobj 1973 0 obj -<< /S /GoTo /D (subsection.21.5.1) >> +<< /S /GoTo /D (subsection.21.4.1) >> endobj 1976 0 obj -(21.5.1 Introduction) +(21.4.1 Microsoft Remote Procedure Calls) endobj 1977 0 obj -<< /S /GoTo /D (subsection.21.5.2) >> +<< /S /GoTo /D (subsection.21.4.2) >> endobj 1980 0 obj -(21.5.2 Requirements) +(21.4.2 Microsoft Active Directory Services) endobj 1981 0 obj -<< /S /GoTo /D (subsection.21.5.3) >> +<< /S /GoTo /D (subsection.21.4.3) >> endobj 1984 0 obj -(21.5.3 Testing Things Out) +(21.4.3 Name Service Switch) endobj 1985 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.1) >> +<< /S /GoTo /D (subsection.21.4.4) >> endobj 1988 0 obj -(21.5.3.1 Configure and compile SAMBA) +(21.4.4 Pluggable Authentication Modules) endobj 1989 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.2) >> +<< /S /GoTo /D (subsection.21.4.5) >> endobj 1992 0 obj -(21.5.3.2 Configure nsswitch.conf and the winbind libraries on Linux and Solaris) +(21.4.5 User and Group ID Allocation) endobj 1993 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.3) >> +<< /S /GoTo /D (subsection.21.4.6) >> endobj 1996 0 obj -(21.5.3.3 NSS Winbind on AIX) +(21.4.6 Result Caching) endobj 1997 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.4) >> +<< /S /GoTo /D (section.21.5) >> endobj 2000 0 obj -(21.5.3.4 Configure smb.conf) +(21.5 Installation and Configuration) endobj 2001 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.5) >> +<< /S /GoTo /D (subsection.21.5.1) >> endobj 2004 0 obj -(21.5.3.5 Join the SAMBA server to the PDC domain) +(21.5.1 Introduction) endobj 2005 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.6) >> +<< /S /GoTo /D (subsection.21.5.2) >> endobj 2008 0 obj -(21.5.3.6 Start up the winbindd daemon and test it!) +(21.5.2 Requirements) endobj 2009 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.7) >> +<< /S /GoTo /D (subsection.21.5.3) >> endobj 2012 0 obj -(21.5.3.7 Fix the init.d startup scripts) +(21.5.3 Testing Things Out) endobj 2013 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.8) >> +<< /S /GoTo /D (subsubsection.21.5.3.1) >> endobj 2016 0 obj -(21.5.3.8 Configure Winbind and PAM) +(21.5.3.1 Configure nsswitch.conf and the winbind libraries on Linux and Solaris) endobj 2017 0 obj -<< /S /GoTo /D (section.21.6) >> +<< /S /GoTo /D (subsubsection.21.5.3.2) >> endobj 2020 0 obj -(21.6 Conclusion) +(21.5.3.2 NSS Winbind on AIX) endobj 2021 0 obj -<< /S /GoTo /D (section.21.7) >> +<< /S /GoTo /D (subsubsection.21.5.3.3) >> endobj 2024 0 obj -(21.7 Common Errors) +(21.5.3.3 Configure smb.conf) endobj 2025 0 obj -<< /S /GoTo /D (chapter.22) >> +<< /S /GoTo /D (subsubsection.21.5.3.4) >> endobj 2028 0 obj -(22 Advanced Network Management) +(21.5.3.4 Join the SAMBA server to the PDC domain) endobj 2029 0 obj -<< /S /GoTo /D (section.22.1) >> +<< /S /GoTo /D (subsubsection.21.5.3.5) >> endobj 2032 0 obj -(22.1 Features and Benefits) +(21.5.3.5 Start up the winbindd daemon and test it!) endobj 2033 0 obj -<< /S /GoTo /D (section.22.2) >> +<< /S /GoTo /D (subsubsection.21.5.3.6) >> endobj 2036 0 obj -(22.2 Remote Server Administration) +(21.5.3.6 Fix the init.d startup scripts) endobj 2037 0 obj -<< /S /GoTo /D (section.22.3) >> +<< /S /GoTo /D (subsubsection.21.5.3.7) >> endobj 2040 0 obj -(22.3 Remote Desktop Management) +(21.5.3.7 Configure Winbind and PAM) endobj 2041 0 obj -<< /S /GoTo /D (subsection.22.3.1) >> +<< /S /GoTo /D (section.21.6) >> endobj 2044 0 obj -(22.3.1 Remote Management from NoMachines.Com) +(21.6 Conclusion) endobj 2045 0 obj -<< /S /GoTo /D (section.22.4) >> +<< /S /GoTo /D (section.21.7) >> endobj 2048 0 obj -(22.4 Network Logon Script Magic) +(21.7 Common Errors) endobj 2049 0 obj -<< /S /GoTo /D (subsection.22.4.1) >> +<< /S /GoTo /D (subsection.21.7.1) >> endobj 2052 0 obj -(22.4.1 Adding printers without user intervention) +(21.7.1 NSCD Problem Warning) endobj 2053 0 obj -<< /S /GoTo /D (section.22.5) >> +<< /S /GoTo /D (chapter.22) >> endobj 2056 0 obj -(22.5 Common Errors) +(22 Advanced Network Management) endobj 2057 0 obj -<< /S /GoTo /D (chapter.23) >> +<< /S /GoTo /D (section.22.1) >> endobj 2060 0 obj -(23 System and Account Policies) +(22.1 Features and Benefits) endobj 2061 0 obj -<< /S /GoTo /D (section.23.1) >> +<< /S /GoTo /D (section.22.2) >> endobj 2064 0 obj -(23.1 Features and Benefits) +(22.2 Remote Server Administration) endobj 2065 0 obj -<< /S /GoTo /D (section.23.2) >> +<< /S /GoTo /D (section.22.3) >> endobj 2068 0 obj -(23.2 Creating and Managing System Policies) +(22.3 Remote Desktop Management) endobj 2069 0 obj -<< /S /GoTo /D (subsection.23.2.1) >> +<< /S /GoTo /D (subsection.22.3.1) >> endobj 2072 0 obj -(23.2.1 Windows 9x/Me Policies) +(22.3.1 Remote Management from NoMachines.Com) endobj 2073 0 obj -<< /S /GoTo /D (subsection.23.2.2) >> +<< /S /GoTo /D (section.22.4) >> endobj 2076 0 obj -(23.2.2 Windows NT4 Style Policy Files) +(22.4 Network Logon Script Magic) endobj 2077 0 obj -<< /S /GoTo /D (subsubsection.23.2.2.1) >> +<< /S /GoTo /D (subsection.22.4.1) >> endobj 2080 0 obj -(23.2.2.1 Registry Spoiling) +(22.4.1 Adding printers without user intervention) endobj 2081 0 obj -<< /S /GoTo /D (subsection.23.2.3) >> +<< /S /GoTo /D (section.22.5) >> endobj 2084 0 obj -(23.2.3 MS Windows 200x / XP Professional Policies) +(22.5 Common Errors) endobj 2085 0 obj -<< /S /GoTo /D (subsubsection.23.2.3.1) >> +<< /S /GoTo /D (chapter.23) >> endobj 2088 0 obj -(23.2.3.1 Administration of Win2K / XP Policies) +(23 System and Account Policies) endobj 2089 0 obj -<< /S /GoTo /D (section.23.3) >> +<< /S /GoTo /D (section.23.1) >> endobj 2092 0 obj -(23.3 Managing Account/User Policies) +(23.1 Features and Benefits) endobj 2093 0 obj -<< /S /GoTo /D (subsection.23.3.1) >> +<< /S /GoTo /D (section.23.2) >> endobj 2096 0 obj -(23.3.1 Samba Editreg Toolset) +(23.2 Creating and Managing System Policies) endobj 2097 0 obj -<< /S /GoTo /D (subsection.23.3.2) >> +<< /S /GoTo /D (subsection.23.2.1) >> endobj 2100 0 obj -(23.3.2 Windows NT4/200x) +(23.2.1 Windows 9x/Me Policies) endobj 2101 0 obj -<< /S /GoTo /D (subsection.23.3.3) >> +<< /S /GoTo /D (subsection.23.2.2) >> endobj 2104 0 obj -(23.3.3 Samba PDC) +(23.2.2 Windows NT4 Style Policy Files) endobj 2105 0 obj -<< /S /GoTo /D (section.23.4) >> +<< /S /GoTo /D (subsubsection.23.2.2.1) >> endobj 2108 0 obj -(23.4 System Startup and Logon Processing Overview) +(23.2.2.1 Registry Spoiling) endobj 2109 0 obj -<< /S /GoTo /D (section.23.5) >> +<< /S /GoTo /D (subsection.23.2.3) >> endobj 2112 0 obj -(23.5 Common Errors) +(23.2.3 MS Windows 200x / XP Professional Policies) endobj 2113 0 obj -<< /S /GoTo /D (subsection.23.5.1) >> +<< /S /GoTo /D (subsubsection.23.2.3.1) >> endobj 2116 0 obj -(23.5.1 Policy Does Not Work) +(23.2.3.1 Administration of Win2K / XP Policies) endobj 2117 0 obj -<< /S /GoTo /D (chapter.24) >> +<< /S /GoTo /D (section.23.3) >> endobj 2120 0 obj -(24 Desktop Profile Management) +(23.3 Managing Account/User Policies) endobj 2121 0 obj -<< /S /GoTo /D (section.24.1) >> +<< /S /GoTo /D (subsection.23.3.1) >> endobj 2124 0 obj -(24.1 Features and Benefits) +(23.3.1 Samba Editreg Toolset) endobj 2125 0 obj -<< /S /GoTo /D (section.24.2) >> +<< /S /GoTo /D (subsection.23.3.2) >> endobj 2128 0 obj -(24.2 Roaming Profiles) +(23.3.2 Windows NT4/200x) endobj 2129 0 obj -<< /S /GoTo /D (subsection.24.2.1) >> +<< /S /GoTo /D (subsection.23.3.3) >> endobj 2132 0 obj -(24.2.1 Samba Configuration for Profile Handling) +(23.3.3 Samba PDC) endobj 2133 0 obj -<< /S /GoTo /D (subsubsection.24.2.1.1) >> +<< /S /GoTo /D (section.23.4) >> endobj 2136 0 obj -(24.2.1.1 NT4/200x User Profiles) +(23.4 System Startup and Logon Processing Overview) endobj 2137 0 obj -<< /S /GoTo /D (subsubsection.24.2.1.2) >> +<< /S /GoTo /D (section.23.5) >> endobj 2140 0 obj -(24.2.1.2 Windows 9x / Me User Profiles) +(23.5 Common Errors) endobj 2141 0 obj -<< /S /GoTo /D (subsubsection.24.2.1.3) >> +<< /S /GoTo /D (subsection.23.5.1) >> endobj 2144 0 obj -(24.2.1.3 Mixed Windows 9x / Me and Windows NT4/200x User Profiles) +(23.5.1 Policy Does Not Work) endobj 2145 0 obj -<< /S /GoTo /D (subsubsection.24.2.1.4) >> +<< /S /GoTo /D (chapter.24) >> endobj 2148 0 obj -(24.2.1.4 Disabling Roaming Profile Support) +(24 Desktop Profile Management) endobj 2149 0 obj -<< /S /GoTo /D (subsection.24.2.2) >> +<< /S /GoTo /D (section.24.1) >> endobj 2152 0 obj -(24.2.2 Windows Client Profile Configuration Information) +(24.1 Features and Benefits) endobj 2153 0 obj -<< /S /GoTo /D (subsubsection.24.2.2.1) >> +<< /S /GoTo /D (section.24.2) >> endobj 2156 0 obj -(24.2.2.1 Windows 9x / Me Profile Setup) +(24.2 Roaming Profiles) endobj 2157 0 obj -<< /S /GoTo /D (subsubsection.24.2.2.2) >> +<< /S /GoTo /D (subsection.24.2.1) >> endobj 2160 0 obj -(24.2.2.2 Windows NT4 Workstation) +(24.2.1 Samba Configuration for Profile Handling) endobj 2161 0 obj -<< /S /GoTo /D (subsubsection.24.2.2.3) >> +<< /S /GoTo /D (subsubsection.24.2.1.1) >> endobj 2164 0 obj -(24.2.2.3 Windows 2000/XP Professional) +(24.2.1.1 NT4/200x User Profiles) endobj 2165 0 obj -<< /S /GoTo /D (subsection.24.2.3) >> +<< /S /GoTo /D (subsubsection.24.2.1.2) >> endobj 2168 0 obj -(24.2.3 Sharing Profiles between W9x/Me and NT4/200x/XP workstations) +(24.2.1.2 Windows 9x / Me User Profiles) endobj 2169 0 obj -<< /S /GoTo /D (subsection.24.2.4) >> +<< /S /GoTo /D (subsubsection.24.2.1.3) >> endobj 2172 0 obj -(24.2.4 Profile Migration from Windows NT4/200x Server to Samba) +(24.2.1.3 Mixed Windows 9x / Me and Windows NT4/200x User Profiles) endobj 2173 0 obj -<< /S /GoTo /D (subsubsection.24.2.4.1) >> +<< /S /GoTo /D (subsubsection.24.2.1.4) >> endobj 2176 0 obj -(24.2.4.1 Windows NT4 Profile Management Tools) +(24.2.1.4 Disabling Roaming Profile Support) endobj 2177 0 obj -<< /S /GoTo /D (subsubsection.24.2.4.2) >> +<< /S /GoTo /D (subsection.24.2.2) >> endobj 2180 0 obj -(24.2.4.2 Side bar Notes) +(24.2.2 Windows Client Profile Configuration Information) endobj 2181 0 obj -<< /S /GoTo /D (subsubsection.24.2.4.3) >> +<< /S /GoTo /D (subsubsection.24.2.2.1) >> endobj 2184 0 obj -(24.2.4.3 moveuser.exe) +(24.2.2.1 Windows 9x / Me Profile Setup) endobj 2185 0 obj -<< /S /GoTo /D (subsubsection.24.2.4.4) >> +<< /S /GoTo /D (subsubsection.24.2.2.2) >> endobj 2188 0 obj -(24.2.4.4 Get SID) +(24.2.2.2 Windows NT4 Workstation) endobj 2189 0 obj -<< /S /GoTo /D (section.24.3) >> +<< /S /GoTo /D (subsubsection.24.2.2.3) >> endobj 2192 0 obj -(24.3 Mandatory profiles) +(24.2.2.3 Windows 2000/XP Professional) endobj 2193 0 obj -<< /S /GoTo /D (section.24.4) >> +<< /S /GoTo /D (subsection.24.2.3) >> endobj 2196 0 obj -(24.4 Creating/Managing Group Profiles) +(24.2.3 Sharing Profiles between W9x/Me and NT4/200x/XP workstations) endobj 2197 0 obj -<< /S /GoTo /D (section.24.5) >> +<< /S /GoTo /D (subsection.24.2.4) >> endobj 2200 0 obj -(24.5 Default Profile for Windows Users) +(24.2.4 Profile Migration from Windows NT4/200x Server to Samba) endobj 2201 0 obj -<< /S /GoTo /D (subsection.24.5.1) >> +<< /S /GoTo /D (subsubsection.24.2.4.1) >> endobj 2204 0 obj -(24.5.1 MS Windows 9x/Me) +(24.2.4.1 Windows NT4 Profile Management Tools) endobj 2205 0 obj -<< /S /GoTo /D (subsubsection.24.5.1.1) >> +<< /S /GoTo /D (subsubsection.24.2.4.2) >> endobj 2208 0 obj -(24.5.1.1 How User Profiles Are Handled in Windows 9x / Me?) +(24.2.4.2 Side bar Notes) endobj 2209 0 obj -<< /S /GoTo /D (subsection.24.5.2) >> +<< /S /GoTo /D (subsubsection.24.2.4.3) >> endobj 2212 0 obj -(24.5.2 MS Windows NT4 Workstation) +(24.2.4.3 moveuser.exe) endobj 2213 0 obj -<< /S /GoTo /D (subsection.24.5.3) >> +<< /S /GoTo /D (subsubsection.24.2.4.4) >> endobj 2216 0 obj -(24.5.3 MS Windows 200x/XP) +(24.2.4.4 Get SID) endobj 2217 0 obj -<< /S /GoTo /D (section.24.6) >> +<< /S /GoTo /D (section.24.3) >> endobj 2220 0 obj -(24.6 Common Errors) +(24.3 Mandatory profiles) endobj 2221 0 obj -<< /S /GoTo /D (subsection.24.6.1) >> +<< /S /GoTo /D (section.24.4) >> endobj 2224 0 obj -(24.6.1 How does one set up roaming profiles for just one \(or a few\) user/s or group/s?) +(24.4 Creating/Managing Group Profiles) endobj 2225 0 obj -<< /S /GoTo /D (subsection.24.6.2) >> +<< /S /GoTo /D (section.24.5) >> endobj 2228 0 obj -(24.6.2 Can NOT use Roaming Profiles) +(24.5 Default Profile for Windows Users) endobj 2229 0 obj -<< /S /GoTo /D (subsection.24.6.3) >> +<< /S /GoTo /D (subsection.24.5.1) >> endobj 2232 0 obj -(24.6.3 Changing the default profile) +(24.5.1 MS Windows 9x/Me) endobj 2233 0 obj -<< /S /GoTo /D (chapter.25) >> +<< /S /GoTo /D (subsubsection.24.5.1.1) >> endobj 2236 0 obj -(25 PAM based Distributed Authentication) +(24.5.1.1 How User Profiles Are Handled in Windows 9x / Me?) endobj 2237 0 obj -<< /S /GoTo /D (section.25.1) >> +<< /S /GoTo /D (subsection.24.5.2) >> endobj 2240 0 obj -(25.1 Features and Benefits) +(24.5.2 MS Windows NT4 Workstation) endobj 2241 0 obj -<< /S /GoTo /D (section.25.2) >> +<< /S /GoTo /D (subsection.24.5.3) >> endobj 2244 0 obj -(25.2 Technical Discussion) +(24.5.3 MS Windows 200x/XP) endobj 2245 0 obj -<< /S /GoTo /D (subsection.25.2.1) >> +<< /S /GoTo /D (section.24.6) >> endobj 2248 0 obj -(25.2.1 PAM Configuration Syntax) +(24.6 Common Errors) endobj 2249 0 obj -<< /S /GoTo /D (subsubsection.25.2.1.1) >> +<< /S /GoTo /D (subsection.24.6.1) >> endobj 2252 0 obj -(25.2.1.1 Anatomy of /etc/pam.d Entries) +(24.6.1 Setting up roaming profiles for just a few user's or group's?) endobj 2253 0 obj -<< /S /GoTo /D (subsection.25.2.2) >> +<< /S /GoTo /D (subsection.24.6.2) >> endobj 2256 0 obj -(25.2.2 Example System Configurations) +(24.6.2 Can NOT use Roaming Profiles) endobj 2257 0 obj -<< /S /GoTo /D (subsubsection.25.2.2.1) >> +<< /S /GoTo /D (subsection.24.6.3) >> endobj 2260 0 obj -(25.2.2.1 PAM: original login config) +(24.6.3 Changing the default profile) endobj 2261 0 obj -<< /S /GoTo /D (subsubsection.25.2.2.2) >> +<< /S /GoTo /D (chapter.25) >> endobj 2264 0 obj -(25.2.2.2 PAM: login using pam\137smbpass) +(25 PAM based Distributed Authentication) endobj 2265 0 obj -<< /S /GoTo /D (subsection.25.2.3) >> +<< /S /GoTo /D (section.25.1) >> endobj 2268 0 obj -(25.2.3 smb.conf PAM Configuration) +(25.1 Features and Benefits) endobj 2269 0 obj -<< /S /GoTo /D (subsection.25.2.4) >> +<< /S /GoTo /D (section.25.2) >> endobj 2272 0 obj -(25.2.4 Remote CIFS Authentication using winbindd.so) +(25.2 Technical Discussion) endobj 2273 0 obj -<< /S /GoTo /D (subsection.25.2.5) >> +<< /S /GoTo /D (subsection.25.2.1) >> endobj 2276 0 obj -(25.2.5 Password Synchronization using pam\137smbpass.so) +(25.2.1 PAM Configuration Syntax) endobj 2277 0 obj -<< /S /GoTo /D (subsubsection.25.2.5.1) >> +<< /S /GoTo /D (subsubsection.25.2.1.1) >> endobj 2280 0 obj -(25.2.5.1 Password Synchronisation Configuration) +(25.2.1.1 Anatomy of /etc/pam.d Entries) endobj 2281 0 obj -<< /S /GoTo /D (subsubsection.25.2.5.2) >> +<< /S /GoTo /D (subsection.25.2.2) >> endobj 2284 0 obj -(25.2.5.2 Password Migration Configuration) +(25.2.2 Example System Configurations) endobj 2285 0 obj -<< /S /GoTo /D (subsubsection.25.2.5.3) >> +<< /S /GoTo /D (subsubsection.25.2.2.1) >> endobj 2288 0 obj -(25.2.5.3 Mature Password Configuration) +(25.2.2.1 PAM: original login config) endobj 2289 0 obj -<< /S /GoTo /D (subsubsection.25.2.5.4) >> +<< /S /GoTo /D (subsubsection.25.2.2.2) >> endobj 2292 0 obj -(25.2.5.4 Kerberos Password Integration Configuration) +(25.2.2.2 PAM: login using pam\137smbpass) endobj 2293 0 obj -<< /S /GoTo /D (section.25.3) >> +<< /S /GoTo /D (subsection.25.2.3) >> endobj 2296 0 obj -(25.3 Common Errors) +(25.2.3 smb.conf PAM Configuration) endobj 2297 0 obj -<< /S /GoTo /D (subsection.25.3.1) >> +<< /S /GoTo /D (subsection.25.2.4) >> endobj 2300 0 obj -(25.3.1 pam\137winbind problem) +(25.2.4 Remote CIFS Authentication using winbindd.so) endobj 2301 0 obj -<< /S /GoTo /D (chapter.26) >> +<< /S /GoTo /D (subsection.25.2.5) >> endobj 2304 0 obj -(26 Integrating MS Windows networks with Samba) +(25.2.5 Password Synchronization using pam\137smbpass.so) endobj 2305 0 obj -<< /S /GoTo /D (section.26.1) >> +<< /S /GoTo /D (subsubsection.25.2.5.1) >> endobj 2308 0 obj -(26.1 Features and Benefits) +(25.2.5.1 Password Synchronisation Configuration) endobj 2309 0 obj -<< /S /GoTo /D (section.26.2) >> +<< /S /GoTo /D (subsubsection.25.2.5.2) >> endobj 2312 0 obj -(26.2 Background Information) +(25.2.5.2 Password Migration Configuration) endobj 2313 0 obj -<< /S /GoTo /D (section.26.3) >> +<< /S /GoTo /D (subsubsection.25.2.5.3) >> endobj 2316 0 obj -(26.3 Name Resolution in a pure Unix/Linux world) +(25.2.5.3 Mature Password Configuration) endobj 2317 0 obj -<< /S /GoTo /D (subsection.26.3.1) >> +<< /S /GoTo /D (subsubsection.25.2.5.4) >> endobj 2320 0 obj -(26.3.1 /etc/hosts) +(25.2.5.4 Kerberos Password Integration Configuration) endobj 2321 0 obj -<< /S /GoTo /D (subsection.26.3.2) >> +<< /S /GoTo /D (section.25.3) >> endobj 2324 0 obj -(26.3.2 /etc/resolv.conf) +(25.3 Common Errors) endobj 2325 0 obj -<< /S /GoTo /D (subsection.26.3.3) >> +<< /S /GoTo /D (subsection.25.3.1) >> endobj 2328 0 obj -(26.3.3 /etc/host.conf) +(25.3.1 pam\137winbind problem) endobj 2329 0 obj -<< /S /GoTo /D (subsection.26.3.4) >> +<< /S /GoTo /D (subsection.25.3.2) >> endobj 2332 0 obj -(26.3.4 /etc/nsswitch.conf) +(25.3.2 Winbind is not resolving users and groups) endobj 2333 0 obj -<< /S /GoTo /D (section.26.4) >> +<< /S /GoTo /D (chapter.26) >> endobj 2336 0 obj -(26.4 Name resolution as used within MS Windows networking) +(26 Integrating MS Windows networks with Samba) endobj 2337 0 obj -<< /S /GoTo /D (subsection.26.4.1) >> +<< /S /GoTo /D (section.26.1) >> endobj 2340 0 obj -(26.4.1 The NetBIOS Name Cache) +(26.1 Features and Benefits) endobj 2341 0 obj -<< /S /GoTo /D (subsection.26.4.2) >> +<< /S /GoTo /D (section.26.2) >> endobj 2344 0 obj -(26.4.2 The LMHOSTS file) +(26.2 Background Information) endobj 2345 0 obj -<< /S /GoTo /D (subsection.26.4.3) >> +<< /S /GoTo /D (section.26.3) >> endobj 2348 0 obj -(26.4.3 HOSTS file) +(26.3 Name Resolution in a pure UNIX/Linux world) endobj 2349 0 obj -<< /S /GoTo /D (subsection.26.4.4) >> +<< /S /GoTo /D (subsection.26.3.1) >> endobj 2352 0 obj -(26.4.4 DNS Lookup) +(26.3.1 /etc/hosts) endobj 2353 0 obj -<< /S /GoTo /D (subsection.26.4.5) >> +<< /S /GoTo /D (subsection.26.3.2) >> endobj 2356 0 obj -(26.4.5 WINS Lookup) +(26.3.2 /etc/resolv.conf) endobj 2357 0 obj -<< /S /GoTo /D (section.26.5) >> +<< /S /GoTo /D (subsection.26.3.3) >> endobj 2360 0 obj -(26.5 Common Errors) +(26.3.3 /etc/host.conf) endobj 2361 0 obj -<< /S /GoTo /D (subsection.26.5.1) >> +<< /S /GoTo /D (subsection.26.3.4) >> endobj 2364 0 obj -(26.5.1 My Boomerang Won't Come Back) +(26.3.4 /etc/nsswitch.conf) endobj 2365 0 obj -<< /S /GoTo /D (subsection.26.5.2) >> +<< /S /GoTo /D (section.26.4) >> endobj 2368 0 obj -(26.5.2 Very Slow Network Connections) +(26.4 Name resolution as used within MS Windows networking) endobj 2369 0 obj -<< /S /GoTo /D (subsection.26.5.3) >> +<< /S /GoTo /D (subsection.26.4.1) >> endobj 2372 0 obj -(26.5.3 Samba server name change problem) +(26.4.1 The NetBIOS Name Cache) endobj 2373 0 obj -<< /S /GoTo /D (chapter.27) >> +<< /S /GoTo /D (subsection.26.4.2) >> endobj 2376 0 obj -(27 Unicode/Charsets) +(26.4.2 The LMHOSTS file) endobj 2377 0 obj -<< /S /GoTo /D (section.27.1) >> +<< /S /GoTo /D (subsection.26.4.3) >> endobj 2380 0 obj -(27.1 Features and Benefits) +(26.4.3 HOSTS file) endobj 2381 0 obj -<< /S /GoTo /D (section.27.2) >> +<< /S /GoTo /D (subsection.26.4.4) >> endobj 2384 0 obj -(27.2 What are charsets and unicode?) +(26.4.4 DNS Lookup) endobj 2385 0 obj -<< /S /GoTo /D (section.27.3) >> +<< /S /GoTo /D (subsection.26.4.5) >> endobj 2388 0 obj -(27.3 Samba and charsets) +(26.4.5 WINS Lookup) endobj 2389 0 obj -<< /S /GoTo /D (section.27.4) >> +<< /S /GoTo /D (section.26.5) >> endobj 2392 0 obj -(27.4 Conversion from old names) +(26.5 Common Errors) endobj 2393 0 obj -<< /S /GoTo /D (section.27.5) >> +<< /S /GoTo /D (subsection.26.5.1) >> endobj 2396 0 obj -(27.5 Japanese charsets) +(26.5.1 Pinging works only in one way) endobj 2397 0 obj -<< /S /GoTo /D (chapter.28) >> +<< /S /GoTo /D (subsection.26.5.2) >> endobj 2400 0 obj -(28 Samba Backup Techniques) +(26.5.2 Very Slow Network Connections) endobj 2401 0 obj -<< /S /GoTo /D (section.28.1) >> +<< /S /GoTo /D (subsection.26.5.3) >> endobj 2404 0 obj -(28.1 Note) +(26.5.3 Samba server name change problem) endobj 2405 0 obj -<< /S /GoTo /D (section.28.2) >> +<< /S /GoTo /D (chapter.27) >> endobj 2408 0 obj -(28.2 Features and Benefits) +(27 Unicode/Charsets) endobj 2409 0 obj -<< /S /GoTo /D (chapter.29) >> +<< /S /GoTo /D (section.27.1) >> endobj 2412 0 obj -(29 High Availability Options) +(27.1 Features and Benefits) endobj 2413 0 obj -<< /S /GoTo /D (section.29.1) >> +<< /S /GoTo /D (section.27.2) >> endobj 2416 0 obj -(29.1 Note) +(27.2 What are charsets and unicode?) endobj 2417 0 obj -<< /S /GoTo /D (part.4) >> +<< /S /GoTo /D (section.27.3) >> endobj 2420 0 obj -(IV Migration and Updating) +(27.3 Samba and charsets) endobj 2421 0 obj -<< /S /GoTo /D (chapter.30) >> +<< /S /GoTo /D (section.27.4) >> endobj 2424 0 obj -(30 Upgrading from Samba-2.x to Samba-3.0.0) +(27.4 Conversion from old names) endobj 2425 0 obj -<< /S /GoTo /D (section.30.1) >> +<< /S /GoTo /D (section.27.5) >> endobj 2428 0 obj -(30.1 Charsets) +(27.5 Japanese charsets) endobj 2429 0 obj -<< /S /GoTo /D (section.30.2) >> +<< /S /GoTo /D (section.27.6) >> endobj 2432 0 obj -(30.2 Obsolete configuration options) +(27.6 Common errors) endobj 2433 0 obj -<< /S /GoTo /D (section.30.3) >> +<< /S /GoTo /D (subsection.27.6.1) >> endobj 2436 0 obj -(30.3 Password Backend) +(27.6.1 CP850.so can't be found) endobj 2437 0 obj -<< /S /GoTo /D (chapter.31) >> +<< /S /GoTo /D (chapter.28) >> endobj 2440 0 obj -(31 Migration from NT4 PDC to Samba-3 PDC) +(28 Samba Backup Techniques) endobj 2441 0 obj -<< /S /GoTo /D (section.31.1) >> +<< /S /GoTo /D (section.28.1) >> endobj 2444 0 obj -(31.1 Planning and Getting Started) +(28.1 Note) endobj 2445 0 obj -<< /S /GoTo /D (subsection.31.1.1) >> +<< /S /GoTo /D (section.28.2) >> endobj 2448 0 obj -(31.1.1 Objectives) +(28.2 Features and Benefits) endobj 2449 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.1) >> +<< /S /GoTo /D (chapter.29) >> endobj 2452 0 obj -(31.1.1.1 Domain Layout) +(29 High Availability Options) endobj 2453 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.2) >> +<< /S /GoTo /D (section.29.1) >> endobj 2456 0 obj -(31.1.1.2 Server Share and Directory Layout) +(29.1 Note) endobj 2457 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.3) >> +<< /S /GoTo /D (part.4) >> endobj 2460 0 obj -(31.1.1.3 Logon Scripts) +(IV Migration and Updating) endobj 2461 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.4) >> +<< /S /GoTo /D (chapter.30) >> endobj 2464 0 obj -(31.1.1.4 Profile Migration/Creation) +(30 Upgrading from Samba-2.x to Samba-3.0.0) endobj 2465 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.5) >> +<< /S /GoTo /D (section.30.1) >> endobj 2468 0 obj -(31.1.1.5 User and Group Accounts) +(30.1 New Features in Samba-3) endobj 2469 0 obj -<< /S /GoTo /D (subsection.31.1.2) >> +<< /S /GoTo /D (section.30.2) >> endobj 2472 0 obj -(31.1.2 Steps In Migration Process) +(30.2 Configuration Parameter Changes) endobj 2473 0 obj -<< /S /GoTo /D (section.31.2) >> +<< /S /GoTo /D (subsection.30.2.1) >> endobj 2476 0 obj -(31.2 Migration Options) +(30.2.1 Removed Parameters) endobj 2477 0 obj -<< /S /GoTo /D (subsection.31.2.1) >> +<< /S /GoTo /D (subsection.30.2.2) >> endobj 2480 0 obj -(31.2.1 Planning for Success) +(30.2.2 New Parameters) endobj 2481 0 obj -<< /S /GoTo /D (subsection.31.2.2) >> +<< /S /GoTo /D (subsection.30.2.3) >> endobj 2484 0 obj -(31.2.2 Samba Implementation Choices) +(30.2.3 Modified Parameters \(changes in behavior\):) endobj 2485 0 obj -<< /S /GoTo /D (chapter.32) >> +<< /S /GoTo /D (section.30.3) >> endobj 2488 0 obj -(32 SWAT - The Samba Web Administration Tool) +(30.3 New Functionality) endobj 2489 0 obj -<< /S /GoTo /D (section.32.1) >> +<< /S /GoTo /D (subsection.30.3.1) >> endobj 2492 0 obj -(32.1 Features and Benefits) +(30.3.1 Databases) endobj 2493 0 obj -<< /S /GoTo /D (subsection.32.1.1) >> +<< /S /GoTo /D (subsection.30.3.2) >> endobj 2496 0 obj -(32.1.1 Enabling SWAT for use) +(30.3.2 Changes in Behavior) endobj 2497 0 obj -<< /S /GoTo /D (subsection.32.1.2) >> +<< /S /GoTo /D (subsection.30.3.3) >> endobj 2500 0 obj -(32.1.2 Securing SWAT through SSL) +(30.3.3 Charsets) endobj 2501 0 obj -<< /S /GoTo /D (subsection.32.1.3) >> +<< /S /GoTo /D (subsection.30.3.4) >> endobj 2504 0 obj -(32.1.3 The SWAT Home Page) +(30.3.4 Passdb Backends and Authentication) endobj 2505 0 obj -<< /S /GoTo /D (subsection.32.1.4) >> +<< /S /GoTo /D (subsection.30.3.5) >> endobj 2508 0 obj -(32.1.4 Global Settings) +(30.3.5 Charsets) endobj 2509 0 obj -<< /S /GoTo /D (subsection.32.1.5) >> +<< /S /GoTo /D (subsection.30.3.6) >> endobj 2512 0 obj -(32.1.5 Share Settings) +(30.3.6 LDAP) endobj 2513 0 obj -<< /S /GoTo /D (subsection.32.1.6) >> +<< /S /GoTo /D (subsubsection.30.3.6.1) >> endobj 2516 0 obj -(32.1.6 Printers Settings) +(30.3.6.1 New Schema) endobj 2517 0 obj -<< /S /GoTo /D (subsection.32.1.7) >> +<< /S /GoTo /D (subsubsection.30.3.6.2) >> endobj 2520 0 obj -(32.1.7 The SWAT Wizard) +(30.3.6.2 New Suffix for Searching) endobj 2521 0 obj -<< /S /GoTo /D (subsection.32.1.8) >> +<< /S /GoTo /D (subsubsection.30.3.6.3) >> endobj 2524 0 obj -(32.1.8 The Status Page) +(30.3.6.3 IdMap LDAP support) endobj 2525 0 obj -<< /S /GoTo /D (subsection.32.1.9) >> +<< /S /GoTo /D (chapter.31) >> endobj 2528 0 obj -(32.1.9 The View Page) +(31 Migration from NT4 PDC to Samba-3 PDC) endobj 2529 0 obj -<< /S /GoTo /D (subsection.32.1.10) >> +<< /S /GoTo /D (section.31.1) >> endobj 2532 0 obj -(32.1.10 The Password Change Page) +(31.1 Planning and Getting Started) endobj 2533 0 obj -<< /S /GoTo /D (part.5) >> +<< /S /GoTo /D (subsection.31.1.1) >> endobj 2536 0 obj -(V Troubleshooting) +(31.1.1 Objectives) endobj 2537 0 obj -<< /S /GoTo /D (chapter.33) >> +<< /S /GoTo /D (subsubsection.31.1.1.1) >> endobj 2540 0 obj -(33 The Samba checklist) +(31.1.1.1 Domain Layout) endobj 2541 0 obj -<< /S /GoTo /D (section.33.1) >> +<< /S /GoTo /D (subsubsection.31.1.1.2) >> endobj 2544 0 obj -(33.1 Introduction) +(31.1.1.2 Server Share and Directory Layout) endobj 2545 0 obj -<< /S /GoTo /D (section.33.2) >> +<< /S /GoTo /D (subsubsection.31.1.1.3) >> endobj 2548 0 obj -(33.2 Assumptions) +(31.1.1.3 Logon Scripts) endobj 2549 0 obj -<< /S /GoTo /D (section.33.3) >> +<< /S /GoTo /D (subsubsection.31.1.1.4) >> endobj 2552 0 obj -(33.3 The tests) +(31.1.1.4 Profile Migration/Creation) endobj 2553 0 obj -<< /S /GoTo /D (section.33.4) >> +<< /S /GoTo /D (subsubsection.31.1.1.5) >> endobj 2556 0 obj -(33.4 Still having troubles?) +(31.1.1.5 User and Group Accounts) endobj 2557 0 obj -<< /S /GoTo /D (chapter.34) >> +<< /S /GoTo /D (subsection.31.1.2) >> endobj 2560 0 obj -(34 Analysing and solving samba problems) +(31.1.2 Steps In Migration Process) endobj 2561 0 obj -<< /S /GoTo /D (section.34.1) >> +<< /S /GoTo /D (section.31.2) >> endobj 2564 0 obj -(34.1 Diagnostics tools) +(31.2 Migration Options) endobj 2565 0 obj -<< /S /GoTo /D (section.34.2) >> +<< /S /GoTo /D (subsection.31.2.1) >> endobj 2568 0 obj -(34.2 Installing 'Network Monitor' on an NT Workstation or a Windows 9x box) +(31.2.1 Planning for Success) endobj 2569 0 obj -<< /S /GoTo /D (section.34.3) >> +<< /S /GoTo /D (subsection.31.2.2) >> endobj 2572 0 obj -(34.3 Useful URLs) +(31.2.2 Samba-3 Implementation Choices) endobj 2573 0 obj -<< /S /GoTo /D (section.34.4) >> +<< /S /GoTo /D (chapter.32) >> endobj 2576 0 obj -(34.4 Getting help from the mailing lists) +(32 SWAT - The Samba Web Administration Tool) endobj 2577 0 obj -<< /S /GoTo /D (section.34.5) >> +<< /S /GoTo /D (section.32.1) >> endobj 2580 0 obj -(34.5 How to get off the mailing lists) +(32.1 Features and Benefits) endobj 2581 0 obj -<< /S /GoTo /D (chapter.35) >> +<< /S /GoTo /D (subsection.32.1.1) >> endobj 2584 0 obj -(35 Reporting Bugs) +(32.1.1 Enabling SWAT for use) endobj 2585 0 obj -<< /S /GoTo /D (section.35.1) >> +<< /S /GoTo /D (subsection.32.1.2) >> endobj 2588 0 obj -(35.1 Introduction) +(32.1.2 Securing SWAT through SSL) endobj 2589 0 obj -<< /S /GoTo /D (section.35.2) >> +<< /S /GoTo /D (subsection.32.1.3) >> endobj 2592 0 obj -(35.2 General info) +(32.1.3 The SWAT Home Page) endobj 2593 0 obj -<< /S /GoTo /D (section.35.3) >> +<< /S /GoTo /D (subsection.32.1.4) >> endobj 2596 0 obj -(35.3 Debug levels) +(32.1.4 Global Settings) endobj 2597 0 obj -<< /S /GoTo /D (section.35.4) >> +<< /S /GoTo /D (subsection.32.1.5) >> endobj 2600 0 obj -(35.4 Internal errors) +(32.1.5 Share Settings) endobj 2601 0 obj -<< /S /GoTo /D (section.35.5) >> +<< /S /GoTo /D (subsection.32.1.6) >> endobj 2604 0 obj -(35.5 Attaching to a running process) +(32.1.6 Printers Settings) endobj 2605 0 obj -<< /S /GoTo /D (section.35.6) >> +<< /S /GoTo /D (subsection.32.1.7) >> endobj 2608 0 obj -(35.6 Patches) +(32.1.7 The SWAT Wizard) endobj 2609 0 obj -<< /S /GoTo /D (part.6) >> +<< /S /GoTo /D (subsection.32.1.8) >> endobj 2612 0 obj -(VI Appendixes) +(32.1.8 The Status Page) endobj 2613 0 obj -<< /S /GoTo /D (chapter.36) >> +<< /S /GoTo /D (subsection.32.1.9) >> endobj 2616 0 obj -(36 How to compile SAMBA) +(32.1.9 The View Page) endobj 2617 0 obj -<< /S /GoTo /D (section.36.1) >> +<< /S /GoTo /D (subsection.32.1.10) >> endobj 2620 0 obj -(36.1 Access Samba source code via CVS) +(32.1.10 The Password Change Page) endobj 2621 0 obj -<< /S /GoTo /D (subsection.36.1.1) >> +<< /S /GoTo /D (part.5) >> endobj 2624 0 obj -(36.1.1 Introduction) +(V Troubleshooting) endobj 2625 0 obj -<< /S /GoTo /D (subsection.36.1.2) >> +<< /S /GoTo /D (chapter.33) >> endobj 2628 0 obj -(36.1.2 CVS Access to samba.org) +(33 The Samba checklist) endobj 2629 0 obj -<< /S /GoTo /D (subsubsection.36.1.2.1) >> +<< /S /GoTo /D (section.33.1) >> endobj 2632 0 obj -(36.1.2.1 Access via CVSweb) +(33.1 Introduction) endobj 2633 0 obj -<< /S /GoTo /D (subsubsection.36.1.2.2) >> +<< /S /GoTo /D (section.33.2) >> endobj 2636 0 obj -(36.1.2.2 Access via cvs) +(33.2 Assumptions) endobj 2637 0 obj -<< /S /GoTo /D (section.36.2) >> +<< /S /GoTo /D (section.33.3) >> endobj 2640 0 obj -(36.2 Accessing the samba sources via rsync and ftp) +(33.3 The tests) endobj 2641 0 obj -<< /S /GoTo /D (section.36.3) >> +<< /S /GoTo /D (chapter.34) >> endobj 2644 0 obj -(36.3 Verifying Samba's PGP signature) +(34 Analysing and solving samba problems) endobj 2645 0 obj -<< /S /GoTo /D (section.36.4) >> +<< /S /GoTo /D (section.34.1) >> endobj 2648 0 obj -(36.4 Building the Binaries) +(34.1 Diagnostics tools) endobj 2649 0 obj -<< /S /GoTo /D (subsection.36.4.1) >> +<< /S /GoTo /D (subsection.34.1.1) >> endobj 2652 0 obj -(36.4.1 Compiling samba with Active Directory support) +(34.1.1 Debugging with Samba itself) endobj 2653 0 obj -<< /S /GoTo /D (subsubsection.36.4.1.1) >> +<< /S /GoTo /D (subsection.34.1.2) >> endobj 2656 0 obj -(36.4.1.1 Installing the required packages for Debian) +(34.1.2 Tcpdump) endobj 2657 0 obj -<< /S /GoTo /D (subsubsection.36.4.1.2) >> +<< /S /GoTo /D (subsection.34.1.3) >> endobj 2660 0 obj -(36.4.1.2 Installing the required packages for RedHat) +(34.1.3 Ethereal) endobj 2661 0 obj -<< /S /GoTo /D (section.36.5) >> +<< /S /GoTo /D (subsection.34.1.4) >> endobj 2664 0 obj -(36.5 Starting the smbd and nmbd) +(34.1.4 The Windows Network Monitor) endobj 2665 0 obj -<< /S /GoTo /D (subsection.36.5.1) >> +<< /S /GoTo /D (subsubsection.34.1.4.1) >> endobj 2668 0 obj -(36.5.1 Starting from inetd.conf) +(34.1.4.1 Installing 'Network Monitor' on an NT Workstation) endobj 2669 0 obj -<< /S /GoTo /D (subsection.36.5.2) >> +<< /S /GoTo /D (subsubsection.34.1.4.2) >> endobj 2672 0 obj -(36.5.2 Alternative: starting it as a daemon) +(34.1.4.2 Installing 'Network Monitor' on an 9x Workstation) endobj 2673 0 obj -<< /S /GoTo /D (section.36.6) >> +<< /S /GoTo /D (section.34.2) >> endobj 2676 0 obj -(36.6 Common Errors) +(34.2 Useful URLs) endobj 2677 0 obj -<< /S /GoTo /D (chapter.37) >> +<< /S /GoTo /D (section.34.3) >> endobj 2680 0 obj -(37 Portability) +(34.3 Getting help from the mailing lists) endobj 2681 0 obj -<< /S /GoTo /D (section.37.1) >> +<< /S /GoTo /D (section.34.4) >> endobj 2684 0 obj -(37.1 HPUX) +(34.4 How to get off the mailing lists) endobj 2685 0 obj -<< /S /GoTo /D (section.37.2) >> +<< /S /GoTo /D (chapter.35) >> endobj 2688 0 obj -(37.2 SCO Unix) +(35 Reporting Bugs) endobj 2689 0 obj -<< /S /GoTo /D (section.37.3) >> +<< /S /GoTo /D (section.35.1) >> endobj 2692 0 obj -(37.3 DNIX) +(35.1 Introduction) endobj 2693 0 obj -<< /S /GoTo /D (section.37.4) >> +<< /S /GoTo /D (section.35.2) >> endobj 2696 0 obj -(37.4 RedHat Linux Rembrandt-II) +(35.2 General info) endobj 2697 0 obj -<< /S /GoTo /D (section.37.5) >> +<< /S /GoTo /D (section.35.3) >> endobj 2700 0 obj -(37.5 AIX) +(35.3 Debug levels) endobj 2701 0 obj -<< /S /GoTo /D (subsection.37.5.1) >> +<< /S /GoTo /D (section.35.4) >> endobj 2704 0 obj -(37.5.1 Sequential Read Ahead) +(35.4 Internal errors) endobj 2705 0 obj -<< /S /GoTo /D (section.37.6) >> +<< /S /GoTo /D (section.35.5) >> endobj 2708 0 obj -(37.6 Solaris) +(35.5 Attaching to a running process) endobj 2709 0 obj -<< /S /GoTo /D (subsection.37.6.1) >> +<< /S /GoTo /D (section.35.6) >> endobj 2712 0 obj -(37.6.1 Locking improvements) +(35.6 Patches) endobj 2713 0 obj -<< /S /GoTo /D (subsection.37.6.2) >> +<< /S /GoTo /D (part.6) >> endobj 2716 0 obj -(37.6.2 Winbind on Solaris 9) +(VI Appendixes) endobj 2717 0 obj -<< /S /GoTo /D (chapter.38) >> +<< /S /GoTo /D (chapter.36) >> endobj 2720 0 obj -(38 Samba and other CIFS clients) +(36 How to compile Samba) endobj 2721 0 obj -<< /S /GoTo /D (section.38.1) >> +<< /S /GoTo /D (section.36.1) >> endobj 2724 0 obj -(38.1 Macintosh clients?) +(36.1 Access Samba source code via CVS) endobj 2725 0 obj -<< /S /GoTo /D (section.38.2) >> +<< /S /GoTo /D (subsection.36.1.1) >> endobj 2728 0 obj -(38.2 OS2 Client) +(36.1.1 Introduction) endobj 2729 0 obj -<< /S /GoTo /D (subsection.38.2.1) >> +<< /S /GoTo /D (subsection.36.1.2) >> endobj 2732 0 obj -(38.2.1 How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?) +(36.1.2 CVS Access to samba.org) endobj 2733 0 obj -<< /S /GoTo /D (subsection.38.2.2) >> +<< /S /GoTo /D (subsubsection.36.1.2.1) >> endobj 2736 0 obj -(38.2.2 How can I configure OS/2 Warp 3 \(not Connect\), OS/2 1.2, 1.3 or 2.x for Samba?) +(36.1.2.1 Access via CVSweb) endobj 2737 0 obj -<< /S /GoTo /D (subsection.38.2.3) >> +<< /S /GoTo /D (subsubsection.36.1.2.2) >> endobj 2740 0 obj -(38.2.3 How do I get printer driver download working for OS/2 clients?) +(36.1.2.2 Access via cvs) endobj 2741 0 obj -<< /S /GoTo /D (section.38.3) >> +<< /S /GoTo /D (section.36.2) >> endobj 2744 0 obj -(38.3 Windows for Workgroups) +(36.2 Accessing the samba sources via rsync and ftp) endobj 2745 0 obj -<< /S /GoTo /D (subsection.38.3.1) >> +<< /S /GoTo /D (section.36.3) >> endobj 2748 0 obj -(38.3.1 Use latest TCP/IP stack from Microsoft) +(36.3 Verifying Samba's PGP signature) endobj 2749 0 obj -<< /S /GoTo /D (subsection.38.3.2) >> +<< /S /GoTo /D (section.36.4) >> endobj 2752 0 obj -(38.3.2 Delete .pwl files after password change) +(36.4 Building the Binaries) endobj 2753 0 obj -<< /S /GoTo /D (subsection.38.3.3) >> +<< /S /GoTo /D (subsection.36.4.1) >> endobj 2756 0 obj -(38.3.3 Configure WfW password handling) +(36.4.1 Compiling samba with Active Directory support) endobj 2757 0 obj -<< /S /GoTo /D (subsection.38.3.4) >> +<< /S /GoTo /D (subsubsection.36.4.1.1) >> endobj 2760 0 obj -(38.3.4 Case handling of passwords) +(36.4.1.1 Installing the required packages for Debian) endobj 2761 0 obj -<< /S /GoTo /D (subsection.38.3.5) >> +<< /S /GoTo /D (subsubsection.36.4.1.2) >> endobj 2764 0 obj -(38.3.5 Use TCP/IP as default protocol) +(36.4.1.2 Installing the required packages for RedHat) endobj 2765 0 obj -<< /S /GoTo /D (subsection.38.3.6) >> +<< /S /GoTo /D (section.36.5) >> endobj 2768 0 obj -(38.3.6 Speed improvement) +(36.5 Starting the smbd and nmbd) endobj 2769 0 obj -<< /S /GoTo /D (section.38.4) >> +<< /S /GoTo /D (subsection.36.5.1) >> endobj 2772 0 obj -(38.4 Windows '95/'98) +(36.5.1 Starting from inetd.conf) endobj 2773 0 obj -<< /S /GoTo /D (subsection.38.4.1) >> +<< /S /GoTo /D (subsection.36.5.2) >> endobj 2776 0 obj -(38.4.1 Speed improvement) +(36.5.2 Alternative: starting it as a daemon) endobj 2777 0 obj -<< /S /GoTo /D (section.38.5) >> +<< /S /GoTo /D (chapter.37) >> endobj 2780 0 obj -(38.5 Windows 2000 Service Pack 2) +(37 Portability) endobj 2781 0 obj -<< /S /GoTo /D (section.38.6) >> +<< /S /GoTo /D (section.37.1) >> endobj 2784 0 obj -(38.6 Windows NT 3.1) +(37.1 HPUX) endobj 2785 0 obj -<< /S /GoTo /D (chapter.39) >> +<< /S /GoTo /D (section.37.2) >> endobj 2788 0 obj -(39 Samba Performance Tuning) +(37.2 SCO UNIX) endobj 2789 0 obj -<< /S /GoTo /D (section.39.1) >> +<< /S /GoTo /D (section.37.3) >> endobj 2792 0 obj -(39.1 Comparisons) +(37.3 DNIX) endobj 2793 0 obj -<< /S /GoTo /D (section.39.2) >> +<< /S /GoTo /D (section.37.4) >> endobj 2796 0 obj -(39.2 Socket options) +(37.4 RedHat Linux Rembrandt-II) endobj 2797 0 obj -<< /S /GoTo /D (section.39.3) >> +<< /S /GoTo /D (section.37.5) >> endobj 2800 0 obj -(39.3 Read size) +(37.5 AIX) endobj 2801 0 obj -<< /S /GoTo /D (section.39.4) >> +<< /S /GoTo /D (subsection.37.5.1) >> endobj 2804 0 obj -(39.4 Max xmit) +(37.5.1 Sequential Read Ahead) endobj 2805 0 obj -<< /S /GoTo /D (section.39.5) >> +<< /S /GoTo /D (section.37.6) >> endobj 2808 0 obj -(39.5 Log level) +(37.6 Solaris) endobj 2809 0 obj -<< /S /GoTo /D (section.39.6) >> +<< /S /GoTo /D (subsection.37.6.1) >> endobj 2812 0 obj -(39.6 Read raw) +(37.6.1 Locking improvements) endobj 2813 0 obj -<< /S /GoTo /D (section.39.7) >> +<< /S /GoTo /D (subsection.37.6.2) >> endobj 2816 0 obj -(39.7 Write raw) +(37.6.2 Winbind on Solaris 9) endobj 2817 0 obj -<< /S /GoTo /D (section.39.8) >> +<< /S /GoTo /D (chapter.38) >> endobj 2820 0 obj -(39.8 Slow Logins) +(38 Samba and other CIFS clients) endobj 2821 0 obj -<< /S /GoTo /D (section.39.9) >> +<< /S /GoTo /D (section.38.1) >> endobj 2824 0 obj -(39.9 Client tuning) +(38.1 Macintosh clients?) endobj 2825 0 obj -<< /S /GoTo /D (section.39.10) >> +<< /S /GoTo /D (section.38.2) >> endobj 2828 0 obj -(39.10 Samba performance problem due changing kernel) +(38.2 OS2 Client) endobj 2829 0 obj -<< /S /GoTo /D (section.39.11) >> +<< /S /GoTo /D (subsection.38.2.1) >> endobj 2832 0 obj -(39.11 Corrupt tdb Files) +(38.2.1 Configuring OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba) endobj 2833 0 obj -<< /S /GoTo /D (chapter.40) >> +<< /S /GoTo /D (subsection.38.2.2) >> endobj 2836 0 obj -(40 DNS and DHCP Configuration Guide) +(38.2.2 Configuring OS/2 Warp 3 \(not Connect\), OS/2 1.2, 1.3 or 2.x for Samba) endobj 2837 0 obj -<< /S /GoTo /D (section.40.1) >> +<< /S /GoTo /D (subsection.38.2.3) >> endobj 2840 0 obj -(40.1 Note) +(38.2.3 Printer driver download for for OS/2 clients?) endobj 2841 0 obj -<< /S /GoTo /D (chapter.41) >> +<< /S /GoTo /D (section.38.3) >> endobj 2844 0 obj -(41 Further Resources) +(38.3 Windows for Workgroups) endobj 2845 0 obj -<< /S /GoTo /D (section.41.1) >> +<< /S /GoTo /D (subsection.38.3.1) >> endobj 2848 0 obj -(41.1 Websites) +(38.3.1 Latest TCP/IP stack from Microsoft) endobj 2849 0 obj -<< /S /GoTo /D (section.41.2) >> +<< /S /GoTo /D (subsection.38.3.2) >> endobj 2852 0 obj -(41.2 Related updates from Microsoft) +(38.3.2 Delete .pwl files after password change) endobj 2853 0 obj -<< /S /GoTo /D (section.41.3) >> +<< /S /GoTo /D (subsection.38.3.3) >> endobj 2856 0 obj -(41.3 Books) +(38.3.3 Configuring WfW password handling) endobj 2857 0 obj -<< /S /GoTo /D [2858 0 R /Fit ] >> +<< /S /GoTo /D (subsection.38.3.4) >> endobj -2860 0 obj << -/Length 233 -/Filter /FlateDecode ->> -stream -xÚ‘OK1 Åïó)r쓦M;Ç]ü ‚`oâAfWQÜÐÙƒßÞ–™]G^^ú~4¯ •Ã’t“b†~ß¼ç¦á™ðA0x_ô‚iO®eIC\‚4¢h[ô'ñë9=)X¥…S…×¹¹¸vŽPU ?‡ˆIáÄä탹_Ý®[ËfÕZQ5wÃ[-wý8]\Öj(šLÜïãÓø:ÚǼi®ò¹ÿ< ¥€²øÝ°gb -ÇÀÅk ç"a¾‹èjÚ’?k§fs|ÿš”£– Éý% ù÷2¾‘_endstream +2860 0 obj +(38.3.4 Case handling of passwords) endobj -2858 0 obj << -/Type /Page -/Contents 2860 0 R -/Resources 2859 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2869 0 R ->> endobj -2861 0 obj << -/D [2858 0 R /XYZ 85.039 786.531 null] ->> endobj -2862 0 obj << -/D [2858 0 R /XYZ 85.039 766.606 null] ->> endobj -2859 0 obj << -/Font << /F20 2865 0 R /F21 2868 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -2872 0 obj << -/Length 1451 -/Filter /FlateDecode ->> -stream -xÚWKÛ6¾ï¯0öRˆµ¢H½zë3A.)§=4=Ð×VV IŽ³ýõ)Ërâ Xäp83ü8/ŠE?±È“0’Å"ËÓ0‘bQîï¢ÅV^ß Ç¡&JÁø+‹«Dæa’ËÅj"áçõÝÃï"Yˆ(,¢b±~ôZ’4óL,ÖÕ?ÁzW÷Ë•Ì’`³\ÅY`á?ìÒTà×4OËåJ¶YŠ 18,‡Ú¶¼dùûæÝöÿ½~×ó\W•©x8Xþ¾×û%hÚ€Íâ+²âò¸'Éí2.‚AOä£ØÏøG빃†…<‹ºj£p¹JÒìRã¿ë·€ÙJ œa@§6';!§FYÏŽ|j[±"Öœ¦Á8g›{ ¦EÊðÊ¿­xCoùë•ÕCÿƒe y÷8“ÂðA”ô·Û;¯¿ñÝ^¢«¹#8@{YÇ5,9ŒZz+ÀÏàªBâõ©"öa>Ùç‘FÐa᯷e^扃†!Æ?‹ LÖN2Ý‚iš)5vþ7Z1±©€ŠX@LG{KÚäΔÓ3ï®ëëѺG>Á€8_#r Et_ÉKºå G”Á‰ -„#ÞeÅ«z@ w¿­Ç(Ž…U$I‡q¬8Ðq¡Û:Ž?'!ï¹Wv -y9 ù¹L<Æn?><œN§°×ûm·}˜#¥ÓL]3Ë:žçÊ„‹¬#¥ -³4¹0Á:ˆ¼"B÷¿~;ˆàž™0ÌôÖ¸àV€ïÑtцEòÂïo«"Ì┯1!ÝÇÝ F°Ø»!H$%¨B¡Tñ"‰r:èíñÜ« û5s™hÒ[Ó°/av‘2øk 1];æE[ºö€5J/m›]ç¹mÑ\ZôêJ],B™Éï„Âs¿ x&“ °è-ãð&äïšðàô+‚C?túÊ_#ªTÝ„ÃóܶJFY(.l‚¤5×G×Ú¾‰†ç~AïL&j~m:ÝT ÂÇ(‰àôoGºg ^üEwƒ¹2SÅ*Ùmñ<·›KBãB1 -d—ž…Q‘»¶“pTï1ÊÎÕw…¶óm•8N\ð”*ʃ«Å“«å¸Žm~Í—I9ê™6–—¶QñÛvÃç©¿”‚uÃÛ¶×-!R| @3öÐœ…œP莣ç;ê à0ŸGsfB# ™ÝeV;N5å:{ÄJ‘$c惭RTðÔR“sjL… ™¦ÏVo¨VbGE2ìDÖÚÊ0rðY\†Ã<)Š±4"O_ÿç3&l§- 8K{ë°bIÄ5*‰ÄN×`¹ä›Ò‡ -6UòÆGÉkø -;=íåd&¨PÂÄe} Eî¶oxÓ8æ ܾs@23nQký1 -¾¾syF¦ÒRšÝ#‰jq=8 U6¸IW£¿î]°ýJòà'æs'£qÝö¥å…6sŸ@þïPuÝ«@h'èpqª«s?Tκˆ‚¦±-›£on©kA*&´ó‘§-Ú†ƒéy&•ÅÖƒ—cؘ‘ÁkäæNýÄlãôÙÍ ëÖÛY1Íì^œhÞ{ ä,þ@ˆ€)9` 8Ñ'‰k7‚T"Uį -ø]¢’¦CH ÇéL)ìm禼cƒ˜my|¿vé‚Ô¹-½çeêºá«›Þ©Ck¥éÜŒ¤ò¢A6NdÄu`å‡#9óØSè¶[^tŠZ¤ô°\Ã0}pÅ8p€8Åôgžy¤ÑH0Cò³&Ñ=¤9:ó¡î(k°sá.ß²âø€íWS—“õ'̾œ¸.ž#ÊÖɧü¤žÔìw8ƒ%ïë¶Ææb°“'䬦ºG´LB%åw¿Ôÿ…à¿Îendstream +2861 0 obj +<< /S /GoTo /D (subsection.38.3.5) >> endobj -2871 0 obj << -/Type /Page -/Contents 2872 0 R -/Resources 2870 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2869 0 R -/Annots [ 2877 0 R 2881 0 R 2882 0 R 2883 0 R ] ->> endobj -2877 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [210.406 518.803 332.67 530.796] -/Subtype/Link/A<> ->> endobj -2881 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.346 504.951 215.702 517.852] -/Subtype/Link/A<> ->> endobj -2882 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [220.377 504.951 304.46 517.852] -/Subtype/Link/A<> ->> endobj -2883 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [319.468 504.951 425.172 517.852] -/Subtype/Link/A<> ->> endobj -2873 0 obj << -/D [2871 0 R /XYZ 85.039 786.531 null] ->> endobj -2870 0 obj << -/Font << /F15 2876 0 R /F35 2880 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -2886 0 obj << -/Length 3961 -/Filter /FlateDecode ->> -stream -xÚµ\msÛÆþ®_ÁäLy>¼NÇrì¨ve7µ•´3I>P$,1¦@$­øßw÷îîeaÄé4&ÁG»ÏÞí½à¢ ‡ÿE“2c<©&E™³,‰&ˇ >¹ƒ_®."…à“9gIUâoÿ»øùW>YæÝ…¼øŸ9‹ªjòp‘f ËÒD}ß\|ºøwoEþ–NzS¦›yœ'¬(³É<á¬,Scc‹”`g^dËÓÁ¯n.^|Ÿå“ŠUy2¹ù<‰KÎâ,žt˜›ÕÏÓëún±™Í“2™~Øîgóhº^Ö³_oÞ]¼¹éÍW«ÒrRÄs‡$ŽXUðÑuQT°"/€[ÿ÷‚Z” Ô¢8aqu.ÙÍýzÄâtºšEÓíl—Óåá¡FŽÍ,®¦ûÅ~½m’L{è°;„ì[ø´¾=À÷âoV‰šUÝÊoûûZþáՇ啫º©[¸ú€·ðŸÍz)¯\Cxšø£lú Ï8üxõÃ5|ŠäßOá°í¨ Kˆ(D‚³ŠWVe™¸Ë˜ÍæiœO/áþ -¸Áí#þý7ùmûÿ-€%˜ªñsLàóÍJxMÝ´øØt?oûJþ¡¸{´ô´[Âö`³œ~Z<ÌâbŠ7ºWvÛC»T¿®Ö»}‹.nû™¸Á9ë9£}w!¯,ùåÿéØÆGy@Ž+®‚‘‹`l›¹¸½㛤ÓÅÞTb”,‚¬)xySI½áíB|Ô•§Ðs .¤—èÒ3L"‘ûýþñ¯/^<==±Ï»ÏlÛÞ½Ø`^µ]½{q÷¸aûß-rI -ùÅó19#:ŒEIOÔ.ò*b)PCJ—³$žîeã'x ð4vVxÎʬœäEÎr°ëà‘±4Ke¾ÊK?ùa¿(†lŒ'sÍ’ s¬u$û¶Ù·± <æÃrT$jRÞÊAr· “xACS%.âV ‹Šå%rŒ¡áËÝ O’+úÐ’–û(Õا9‹‹|¢ Hþ¶î"h:ËÉ`Éö¦ –·‘ÖrV`¬o¯˜8_×Ø<Á¾ÙºÄtÄmDVµH,Eƒ¥¼´¹°ñ7+IÄŠ¤ÑõfI¦ˆÑéJ´Àó+ÊqõrÓ55Kä|/™Ãµ–-·VªÀ“æ`šˆg±hiQ0Ì ­¿{³žÏÓçȆÁ’?)ýc;KøôiœoEc²_l°«Ésh.Wò‡›YOëÝ^åÉåûW—ÖãÍ¡¿­R×-Ù²Œ3–•ñ‘‰’”,ÎK:S&˜*ƒ-"WL‡®dÑ^6(»¶~’ÄÍ êÑâå;!?¨•-PÅqìÏ–Ú’d̘H‰&¹›&ѯìDWwõËÖßbçbgGÎ8OÉv›Æ(?Æ†Ü ¢ž~ã¿I@!ȯ… *„rØ+ÄtèRˆæð]½yPåH$™þ4+SU5}¹]ÿæI uѤBŸÄ‹1iB$MÒ7M¢ßß~{„B²à3ë06£MŒú¥,ÉÊ€B_! -Tå°WˆéÐ¥Íá»­ìY…#Òኾiò„*„ýŠÅÁ±â£sðÜI†C—ø -nÍ’·àî0bá|¿hVóËͶ©»r\I·×ÂyBåbjÅŠ œâ=ªÀNR”#=(í0AÙ¶Ù›]²×ž§ÀQ ØgÃà)6·¾À¶88 -l„_ëÐŧÏñZÂ`ȯt A>ï?I}ÿ;µf%7e«Ý!Ä 5bSÈ^?¶_ú/]zwh»7ŽÀÊÕa½ªíú£¯•ãm9 ôÇæ4%y`3@‡ æÈ`‹ÈÓ¡+G4‡gÊj8GΆÁ“r„ˆÛ#&WŽh$ü9#’2¯ž#IKþ,Qш7s„ð_¨ýQ§&Î+¹L,œãà ÜɯðÊAÔm†•K0>,’Ê [·0ŽKã#“)®p-®Ä;L(™4[þd²:’IwxždQ &ÅÙ0xJ2Qqë“ÉâàH&„7™âß–zŽ»š%o2u1¨Z.·‡FmÏ}Û¨ º}?’O_‹1ø~q»Ø9ö‚:ò*rÝ€cÿ!gIQ™ ˜´¤wæv˜` ¶ˆ0ºr@sxî±Æˆtx¬AÑ7Mž0Ö BØ5,Ž±†ÎÁ;³˜e¡¥" äWˆÂB9ìb:t)Dsx–‰¬ÓðDÅÙ4yÒD¹~"Ëbá˜ÈÒYø…‘r–Q@È/ … -ƒrØ Ãtè†æð<3ß#ªá™oŠ´iò„™o*pýÌ·ÅÁ1ó­sð뤜G¡cùu¡0A]P{]˜]ºÐž©¬Ò©†Ë*‚³a𤲊ˆÛPV™\e•FÂ/‹:¾*zŒ_Ôá­—„áÍ¥ˆÁÛ¿D»ðu]«óØ@Ó¢Pçyˆ½â‚ØÊÓ:¶T+K¿Hr¨ ÓtDÞ/¦nÃ0(NÍÎ/ß¾~syý_†¥‘£7H'9ùÀ:ˆå[ïKÆfè’›ãùÏñ"fÉ_r+Œ˜æY<>ª}W¸#Mn$èF°â‡ñvÑt§ÃÀ—›õïÚð´Ýw®6˜g…ëʬXmñ1EyTáëüô†þÊÍ–?],‡Ž|Ѿ«ªùü¾[Z4¿ð„ÏÒ4.·âž$¾Çq¾<ÛÙÔ‹ƒ¯ ‰ -hô¢À»0È… †rØÆtè -Œæð,µèˆi¸¥8›&OªE©Èõµ¨ÅÂQ‹ê,¼K”, -­¶k ¿0&( Êa/ Ó¡KšÃóÔ#ªÁšƒâl<¥æ âÖ×GÍ¡“ðö+Q¹“?Ç+0š%o¿ÒaÄË×kqÂÍ_´iQˆÉËå^Îì¨7J‡—Mïå Úµü«K±ƒqYïäxDì ª÷²·ÙˆëVþž»nÝjŽ'(¥Gö7iIJœÞ&ßa‚Ù3Ø"²ÇtèÊÍᙲG§Î‚³að¤ì!â6dÉÁ•= £ -„ó(ðZòËBa‚² ö²0ºd¡9<ÏD5<À§H›&OàSëøÇ_çàoU#|·ÿ9–d5KþVUa´VÕh6?ÖKÙžªï×rÊ®,¿¨5$×{Iìºç{G¾§ñ´C§‚„3¡·D$‚áÍ•ƒ·3¥Æóˆ,ð36 ž’þ )`peÀ@ÀÛ0V1 r2Z Æ« iòÖiÁôæЂæíÜË%:ãðj ÁÝ0xÂZ ¼~©Ä$àX)ÑxUQrfÃ{ˆW’áªS„áÊ!ˆÁÕy*'d°nò³;¥fòǪ¯˜ ïŽzipï?ת„ñH`jbÀøOµ’à¡V„·þL+ÛëH«ÁÛ›VÍÃàœÌÇíNHàÁ1‡™¬"öðBךàY†AâñK0EÕ0ˆNëv½dmOñåý#¾3å:8”ƒ™4¡¢ÕA, -£©ˆ‘úÔh0²ç؉3òŸ¹ !ò@#<§Hî–çåâ Ì ×‰ …8xÆ$é8¸‹³<Ç>ܺ×áÿx*yõçŽ6Ÿ«3Ôñˆ‡ªUêlÔ\’°(Ư,Mä;1o.Ã÷ëp«·Äh„ÿ?šÒ’endstream -endobj -2885 0 obj << -/Type /Page -/Contents 2886 0 R -/Resources 2884 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2869 0 R -/Annots [ 2891 0 R 2892 0 R 2899 0 R 2900 0 R 2901 0 R 2902 0 R 2903 0 R 2904 0 R 2905 0 R 2906 0 R 2907 0 R 2908 0 R 2909 0 R 2910 0 R 2911 0 R 2912 0 R 2913 0 R 2914 0 R 2915 0 R 2916 0 R 2917 0 R 2918 0 R 2919 0 R 2920 0 R 2921 0 R 2922 0 R 2923 0 R 2924 0 R 2925 0 R 2926 0 R 2927 0 R 2928 0 R 2929 0 R 2930 0 R 2931 0 R 2932 0 R 2933 0 R 2934 0 R 2935 0 R 2936 0 R 2937 0 R 2938 0 R 2939 0 R 2940 0 R 2941 0 R 2942 0 R 2943 0 R 2944 0 R 2945 0 R 2946 0 R ] ->> endobj -2891 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [156.148 700.189 341.202 711.314] -/Subtype/Link/A<> ->> endobj -2892 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 675.66 216.99 684.571] -/Subtype /Link -/A << /S /GoTo /D (IntroSMB) >> ->> endobj -2899 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [230.74 660.927 316.059 671.775] -/Subtype/Link/A<> ->> endobj -2900 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 650.068 262.89 658.979] -/Subtype /Link -/A << /S /GoTo /D (install) >> ->> endobj -2901 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [237.686 635.335 317 646.183] -/Subtype/Link/A<> ->> endobj -2902 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 623.38 316.308 634.228] -/Subtype/Link/A<> ->> endobj -2903 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 611.424 294.197 622.273] -/Subtype/Link/A<> +2864 0 obj +(38.3.5 Use TCP/IP as default protocol) +endobj +2865 0 obj +<< /S /GoTo /D (subsection.38.3.6) >> +endobj +2868 0 obj +(38.3.6 Speed improvement) +endobj +2869 0 obj +<< /S /GoTo /D (section.38.4) >> +endobj +2872 0 obj +(38.4 Windows '95/'98) +endobj +2873 0 obj +<< /S /GoTo /D (subsection.38.4.1) >> +endobj +2876 0 obj +(38.4.1 Speed improvement) +endobj +2877 0 obj +<< /S /GoTo /D (section.38.5) >> +endobj +2880 0 obj +(38.5 Windows 2000 Service Pack 2) +endobj +2881 0 obj +<< /S /GoTo /D (section.38.6) >> +endobj +2884 0 obj +(38.6 Windows NT 3.1) +endobj +2885 0 obj +<< /S /GoTo /D (chapter.39) >> +endobj +2888 0 obj +(39 Samba Performance Tuning) +endobj +2889 0 obj +<< /S /GoTo /D (section.39.1) >> +endobj +2892 0 obj +(39.1 Comparisons) +endobj +2893 0 obj +<< /S /GoTo /D (section.39.2) >> +endobj +2896 0 obj +(39.2 Socket options) +endobj +2897 0 obj +<< /S /GoTo /D (section.39.3) >> +endobj +2900 0 obj +(39.3 Read size) +endobj +2901 0 obj +<< /S /GoTo /D (section.39.4) >> +endobj +2904 0 obj +(39.4 Max xmit) +endobj +2905 0 obj +<< /S /GoTo /D (section.39.5) >> +endobj +2908 0 obj +(39.5 Log level) +endobj +2909 0 obj +<< /S /GoTo /D (section.39.6) >> +endobj +2912 0 obj +(39.6 Read raw) +endobj +2913 0 obj +<< /S /GoTo /D (section.39.7) >> +endobj +2916 0 obj +(39.7 Write raw) +endobj +2917 0 obj +<< /S /GoTo /D (section.39.8) >> +endobj +2920 0 obj +(39.8 Slow Logins) +endobj +2921 0 obj +<< /S /GoTo /D (section.39.9) >> +endobj +2924 0 obj +(39.9 Client tuning) +endobj +2925 0 obj +<< /S /GoTo /D (section.39.10) >> +endobj +2928 0 obj +(39.10 Samba performance problem due changing kernel) +endobj +2929 0 obj +<< /S /GoTo /D (section.39.11) >> +endobj +2932 0 obj +(39.11 Corrupt tdb Files) +endobj +2933 0 obj +<< /S /GoTo /D (chapter.40) >> +endobj +2936 0 obj +(40 DNS and DHCP Configuration Guide) +endobj +2937 0 obj +<< /S /GoTo /D (section.40.1) >> +endobj +2940 0 obj +(40.1 Note) +endobj +2941 0 obj +<< /S /GoTo /D (chapter.41) >> +endobj +2944 0 obj +(41 Further Resources) +endobj +2945 0 obj +<< /S /GoTo /D (section.41.1) >> +endobj +2948 0 obj +(41.1 Websites) +endobj +2949 0 obj +<< /S /GoTo /D (section.41.2) >> +endobj +2952 0 obj +(41.2 Related updates from Microsoft) +endobj +2953 0 obj +<< /S /GoTo /D [2954 0 R /Fit ] >> +endobj +2956 0 obj << +/Length 236 +/Filter /FlateDecode +>> +stream +xÚ‘ÁJÄ0†ï}Š9¦‡Œ3™dÒ»¬ +‚ ˜›xº®.ì´}Ú]+H.3ù?2_Ê‹¡ HÒBlƒ0ôÇŠ`Ÿ“ÛŠÂÁà}®WB{N-Kƒ1Ä5H#ŠF°™ðA¿ŽãàГ‚UjQ¸)ð&UW7ŽÀª +¤7à±Q83éõÉ> endobj -2904 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 586.673 240.908 597.522] -/Subtype /Link -/A << /S /GoTo /D (FastStart) >> +2957 0 obj << +/D [2954 0 R /XYZ 85.039 786.531 null] >> endobj -2905 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 573.878 294.197 584.726] -/Subtype/Link/A<> +2958 0 obj << +/D [2954 0 R /XYZ 85.039 766.606 null] >> endobj -2906 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 561.082 266.57 571.93] -/Subtype /Link -/A << /S /GoTo /D (ServerType) >> +2955 0 obj << +/Font << /F20 2961 0 R /F21 2964 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2907 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [237.686 548.286 317 559.134] -/Subtype/Link/A<> +2968 0 obj << +/Length 1451 +/Filter /FlateDecode +>> +stream +xÚWKÛ6¾ï¯0öRˆµ¢H½zë3A.)§=4=Ð×VV IŽ³ýõ)Ërâ Xäp83ü8/ŠE?±È“0’Å"ËÓ0‘bQîï¢ÅV^ß Ç¡&JÁø+‹«Dæa’ËÅj"áçõÝÃï"Yˆ(,¢b±~ôZ’4óL,ÖÕ?ÁzW÷Ë•Ì’`³\ÅY`á?ìÒTà×4OËåJ¶YŠ 18,‡Ú¶¼dùûæÝöÿ½~×ó\W•©x8Xþ¾×û%hÚ€Íâ+²âò¸'Éí2.‚AOä£ØÏøG빃†…<‹ºj£p¹JÒìRã¿ë·€ÙJ œa@§6';!§FYÏŽ|j[±"Öœ¦Á8g›{ ¦EÊðÊ¿­xCoùë•ÕCÿƒe y÷8“ÂðA”ô·Û;¯¿ñÝ^¢«¹#8@{YÇ5,9ŒZz+ÀÏàªBâõ©"öa>Ùç‘FÐa᯷e^扃†!Æ?‹ LÖN2Ý‚iš)5vþ7Z1±©€ŠX@LG{KÚäΔÓ3ï®ëëѺG>Á€8_#r Et_ÉKºå G”Á‰ +„#ÞeÅ«z@ w¿­Ç(Ž…U$I‡q¬8Ðq¡Û:Ž?'!ï¹Wv +y9 ù¹L<Æn?><œN§°×ûm·}˜#¥ÓL]3Ë:žçÊ„‹¬#¥ +³4¹0Á:ˆ¼"B÷¿~;ˆàž™0ÌôÖ¸àV€ïÑtцEòÂïo«"Ì┯1!ÝÇÝ F°Ø»!H$%¨B¡Tñ"‰r:èíñÜ« û5s™hÒ[Ó°/av‘2øk 1];æE[ºö€5J/m›]ç¹mÑ\ZôêJ],B™Éï„Âs¿ x&“ °è-ãð&äïšðàô+‚C?túÊ_#ªTÝ„ÃóܶJFY(.l‚¤5×G×Ú¾‰†ç~AïL&j~m:ÝT ÂÇ(‰àôoGºg ^üEwƒ¹2SÅ*Ùmñ<·›KBãB1 -d—ž…Q‘»¶“pTï1ÊÎÕw…¶óm•8N\ð”*ʃ«Å“«å¸Žm~Í—I9ê™6–—¶QñÛvÃç©¿”‚uÃÛ¶×-!R| @3öÐœ…œP莣ç;ê à0ŸGsfB# ™ÝeV;N5å:{ÄJ‘$c惭RTðÔR“sjL… ™¦ÏVo¨VbGE2ìDÖÚÊ0rðY\†Ã<)Š±4"O_ÿç3&l§- 8K{ë°bIÄ5*‰ÄN×`¹ä›Ò‡ +6UòÆGÉkø +;=íåd&¨PÂÄe} Eî¶oxÓ8æ ܾs@23nQký1 +¾¾syF¦ÒRšÝ#‰jq=8 U6¸IW£¿î]°ýJòà'æs'£qÝö¥å…6sŸ@þïPuÝ«@h'èpqª«s?Tκˆ‚¦±-›£on©kA*&´ó‘§-Ú†ƒéy&•ÅÖƒ—cؘ‘ÁkäæNýÄlãôÙÍ ëÖÛY1Íì^œhÞ{ ä,þ@ˆ€)9` 8Ñ'‰k7‚T"Uį +ø]¢’¦CH ÇéL)ìm禼cƒ˜my|¿vé‚Ô¹-½çeêºá«›Þ©Ck¥éÜŒ¤ò¢A6NdÄu`å‡#9óØSè¶[^tŠZ¤ô°\Ã0}pÅ8p€8Åôgžy¤ÑH0Cò³&Ñ=¤9:ó¡î(k°sá.ß²âø€íWS—“õ'̾œ¸.ž#ÊÖɧü¤žÔìw8ƒ%ïë¶Ææb°“'䬦ºG´LB%åw¿Ôÿ…à¿Îendstream +endobj +2967 0 obj << +/Type /Page +/Contents 2968 0 R +/Resources 2966 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 2965 0 R +/Annots [ 2973 0 R 2977 0 R 2978 0 R 2979 0 R ] >> endobj -2908 0 obj << +2973 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 536.331 316.308 547.179] -/Subtype/Link/A<> +/Rect [210.406 518.803 332.67 530.796] +/Subtype/Link/A<> >> endobj -2909 0 obj << +2977 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 524.376 294.197 535.224] -/Subtype/Link/A<> ->> endobj -2910 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 513.517 186.188 522.428] -/Subtype /Link -/A << /S /GoTo /D (samba-pdc) >> +/Rect [138.346 504.951 215.702 517.852] +/Subtype/Link/A<> >> endobj -2911 0 obj << +2978 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 498.784 294.197 509.632] +/Rect [220.377 504.951 304.46 517.852] /Subtype/Link/A<> >> endobj -2912 0 obj << +2979 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.821 486.829 302.181 497.677] +/Rect [319.468 504.951 425.172 517.852] /Subtype/Link/A<> >> endobj -2913 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [229.606 474.874 321.068 485.722] -/Subtype/Link/A<> +2969 0 obj << +/D [2967 0 R /XYZ 85.039 786.531 null] >> endobj -2914 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 462.078 223.714 472.926] -/Subtype /Link -/A << /S /GoTo /D (samba-bdc) >> +2966 0 obj << +/Font << /F15 2972 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2915 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 449.282 294.197 460.13] -/Subtype/Link/A<> +2982 0 obj << +/Length 523 +/Filter /FlateDecode +>> +stream +xÚ}SM›0½çWøh8þÆôÖJm¤*Z­ZzÚöIˆÀiÚß²4ÍVH¶™yž÷f<#‡OgW9ÉœeF RžœìÁ³Zˆ¡bFk8?p¦“7µ’q=ÄŒi&5ÓN#æC±X~’œHάU¤ØMB,áÒ‘¢z¡ëz¿9&©²–>u¾)ëäGñyñ±¸Ežî¨¸í¹g˜À- œå<Ÿs Ãrkwqh Ö­º$•Ž–—SÝ&pðßtmô5‰ æhÕ ¾Çÿí_'© UD¡¡­` Æ>ý!ðîêé[4®ê¶îCÎðóŒ÷¶GXš2âÖXÑFÚñ~F¿sÃWÏkØD4üD¡u?Ü„J–¤ÚYúK•I>[R-»3ÂR(Úíp— ¯Ž†ã#R°‡úàŽŽ(õRÕU pE2 À[ÆBÓ¯pÜœ™Ñ-ž" Dï0ë¾IbUsñ«k1•A"ÁxQ>é–M5lá鲉s‡÷/¨¶SÅs:)oÚz^j³ñ÷=—;¦2EŒsÌÙ±ßÑÞïGÀ—Y÷àt†ݧæÝwiÞŸß-—×ë•í†ëúýŸ¡êa¹?™ÿõ. aœ4 » ‰Á¤ƒ˜Z­ôôæä(Põxp‡©‚‰1(]Ý 3Ê1ãysOùò endstream +endobj +2981 0 obj << +/Type /Page +/Contents 2982 0 R +/Resources 2980 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 2965 0 R +/Annots [ 2985 0 R ] >> endobj -2916 0 obj << +2985 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [237.52 438.874 364.24 448.175] -/Subtype/Link/A<> +/Rect [97.376 585.447 299.821 597.439] +/Subtype/Link/A<> +>> endobj +2983 0 obj << +/D [2981 0 R /XYZ 85.039 786.531 null] +>> endobj +2984 0 obj << +/D [2981 0 R /XYZ 85.039 639.047 null] +>> endobj +2980 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +2988 0 obj << +/Length 1726 +/Filter /FlateDecode +>> +stream +xÚ½ZËnÜ6Ýû+´Ô,†åK|Ea»yÕMºˆnš.&Å™d<Èr +ÿ}IŠ’(Š¼ˆa žXÇ÷^žû eR`óE +U!Ìt!•@#ŧ»3\Üš'¯ÏˆGðŠ¡Šsó9ñpÝ?] Š0—IŒ÷±–”#®¸Å\ÞœýòŠâ‚b$+n>÷D„!‚©*n¶ÿ”+†Ë¶mvÚÝñp¿ú÷æêìåÍ`¸ÿÎ<åk*ÖÊ>ì~ØÜ݇÷ †‚TH 10$UA0ÒX‡ =Æ2üã°¢ªl›)«µù¸}0?­Ö¤´ŒWkÆhÙíw^^›G›»•åGû)^ Ñ&’UUf‘$X¡Š¿* F»R +)!‡µp¬…`‚8fE²‹ù€‰œ‘©J±©3ó8‰!1B'_llø~ì¶6@¬|[²Ñùb¢ãâúØX:¿¼b*°#™QŒ4ž­_çA43Z˜ðµš[·½G/0lZÇ[ÏÜPÝžïÍ¿µÝó}R"'†ã]L”šm’X€í13z“€Ä–,½ß2©R ‚¤Ð'fC€ÎfC±^ßí²ÿëÔÞ©ž™¹o7û}÷ŸÍaÛåÄÍJ±.f÷m÷èúâÝåÅ,Jœ"ªhÈ{.¿J"ÊY˜éùœ` Irƒsb4äDä1Ç "R6µ£ ”Òn{[›0ÎBD%Ë%Ŧ.Ë)×l>x0L:²h½šmá¶>¿·[j‹œ*?n-‹Íí\úI&Áøõ˜•HúSK ô±D•¤°Ú­sGÏú¾K‹aƾ®ÝÙÃfq³k݉¤ûÅwþ¬Ú§÷ý|ì®ÜQtä7×¢ÀÁIt!A8GZ-ŒU=h1AFc@‚DÓ xü9S÷„ëâÔ ’Ž,>}ê†â7LÝ1•äÔrɦ‘H)ËcÄòð EyGyDÓò<þü©{Â{yêWÛ|úÔ Es˜ºc.É©;ä’ ÕIQ&/–´$Èá –ØcR,¡Ççj¶öËÍ\Gló©ÍŠèÐlc&Éf2É +F˜ÜR§ÎŸ:Ûn{Œ»<Þmv~?ú›Þã~&&A1£b`~¶t)©èI׶”™PjAà´(ðÑ ðÈcZàÇgxÈþCëˆm>Yà@DGGLÒ˜dŽµ©ä°^ —³¨–¼·Q,Swi­Œî^×Ífï¯÷?à +›à^ "i͈O°MÓÖ©û~‚%bÆZN+T!ÂÅ„{^* ®"²Ø5ÏÆò}ú¦=^¢dß4dÉsˆºæÄ$¢LÐ5|¯`ò"éAK*2‰=&uzŒ^]n¶Ä˜ª›xD§<ÿˆ!JÉ”&ð¨C/Žlº7@NKóxXÕÄ5 (x=fÆeZ>"K 6ª +QÍNì:Û{Œõz¹q﻾=tGP»m¦eºZºûÐ9©Uc!͹¢ˆ0Ëä'3‰Í\½0ö E™Æ™GÓ2<>W뜰_nà:b›OmPD‡Ö3I¶ÎIVûf¿±°`F Z àpLä1-˜À£;aíæoîî'8„¾­Ûî¹”¼¥ÀšäÅBÌ™,bˆ¥CÃkˆmf×`ÅòÖ}´%t²óëºù«nÑ‹—³þÊ”{źÇÌxN;ld ’’dHŸü'$#8[D=$>c¼«}±w uãRËV‹Ý÷™äw‡êÑ×, +Z#ánrªÄ$çò÷0•«ÆIæÌ "XñÂc,u³ª¬/sÄíÄ.ÿ¡À®endstream +endobj +2987 0 obj << +/Type /Page +/Contents 2988 0 R +/Resources 2986 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 2965 0 R +/Annots [ 2991 0 R 2998 0 R 2999 0 R 3000 0 R 3001 0 R 3002 0 R 3003 0 R 3004 0 R 3005 0 R 3006 0 R 3007 0 R 3008 0 R 3009 0 R 3010 0 R 3011 0 R 3012 0 R 3013 0 R 3014 0 R 3015 0 R 3016 0 R ] >> endobj -2917 0 obj << +2991 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 424.531 208.447 435.379] +/Rect [84.043 614.97 194.551 624.538] /Subtype /Link -/A << /S /GoTo /D (domain-member) >> +/A << /S /GoTo /D (IntroSMB) >> >> endobj -2918 0 obj << +2998 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 411.735 294.197 422.583] -/Subtype/Link/A<> +/Rect [193.467 585.75 286.703 597.439] +/Subtype/Link/A<> >> endobj -2919 0 obj << +2999 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [231.487 399.78 297.241 410.628] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 560.773 243.278 570.341] +/Subtype /Link +/A << /S /GoTo /D (install) >> >> endobj -2920 0 obj << +3000 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.821 387.825 302.181 398.673] -/Subtype/Link/A<> +/Rect [201.074 531.553 287.733 543.243] +/Subtype/Link/A<> >> endobj -2921 0 obj << +3001 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [237.686 375.87 317 386.718] -/Subtype/Link/A<> +/Rect [213.498 504.455 301.672 516.144] +/Subtype/Link/A<> >> endobj -2922 0 obj << +3002 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 363.914 316.308 374.763] -/Subtype/Link/A<> +/Rect [205.528 477.356 277.612 489.046] +/Subtype/Link/A<> >> endobj -2923 0 obj << +3003 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 353.056 206.025 361.967] +/Rect [84.043 423.16 219.945 434.849] /Subtype /Link -/A << /S /GoTo /D (StandAloneServer) >> +/A << /S /GoTo /D (FastStart) >> >> endobj -2924 0 obj << +3004 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 338.323 294.197 349.171] +/Rect [205.528 396.061 277.612 407.751] /Subtype/Link/A<> >> endobj -2925 0 obj << +3005 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 325.527 310.315 336.375] +/Rect [84.043 368.963 246.551 380.652] /Subtype /Link -/A << /S /GoTo /D (ClientConfig) >> +/A << /S /GoTo /D (ServerType) >> >> endobj -2926 0 obj << +3006 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 312.731 294.197 323.579] -/Subtype/Link/A<> +/Rect [201.074 341.864 287.733 353.554] +/Subtype/Link/A<> >> endobj -2927 0 obj << +3007 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 299.382 333.736 311.337] -/Subtype /Link -/A << /S /GoTo /D (NetworkBrowsing) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [213.498 314.766 301.672 326.456] +/Subtype/Link/A<> >> endobj -2928 0 obj << +3008 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 287.139 294.197 297.988] +/Rect [205.528 287.668 277.612 299.357] /Subtype/Link/A<> >> endobj -2929 0 obj << +3009 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 276.281 257.687 285.192] +/Rect [84.043 262.69 163.187 272.259] /Subtype /Link -/A << /S /GoTo /D (passdb) >> +/A << /S /GoTo /D (samba-pdc) >> >> endobj -2930 0 obj << +3010 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 261.548 316.308 272.396] -/Subtype/Link/A<> +/Rect [205.528 233.471 277.612 245.16] +/Subtype/Link/A<> >> endobj -2931 0 obj << +3011 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.821 249.592 302.181 260.441] +/Rect [227.149 205.766 308.384 218.668] /Subtype/Link/A<> >> endobj -2932 0 obj << +3012 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [231.487 237.637 297.241 248.486] -/Subtype/Link/A<> +/Rect [192.225 179.274 292.187 190.964] +/Subtype/Link/A<> >> endobj -2933 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 225.682 294.197 236.53] -/Subtype/Link/A<> ->> endobj -2934 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [261.348 213.173 347.359 225.129] -/Subtype/Link/A<> ->> endobj -2935 0 obj << +3013 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 200.931 297.054 211.779] +/Rect [84.043 152.176 202.43 163.865] /Subtype /Link -/A << /S /GoTo /D (groupmapping) >> +/A << /S /GoTo /D (samba-bdc) >> >> endobj -2936 0 obj << +3014 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.821 176.18 302.181 187.028] -/Subtype/Link/A<> +/Rect [205.528 125.077 277.612 136.767] +/Subtype/Link/A<> >> endobj -2937 0 obj << +3015 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 164.225 294.197 175.073] -/Subtype/Link/A<> +/Rect [200.892 99.674 339.46 109.668] +/Subtype/Link/A<> >> endobj -2938 0 obj << +3016 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 151.429 303.302 162.277] +/Rect [84.043 70.88 185.672 82.57] /Subtype /Link -/A << /S /GoTo /D (AccessControls) >> +/A << /S /GoTo /D (domain-member) >> >> endobj -2939 0 obj << +2989 0 obj << +/D [2987 0 R /XYZ 85.039 786.531 null] +>> endobj +2990 0 obj << +/D [2987 0 R /XYZ 85.039 643.064 null] +>> endobj +2986 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F38 2997 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3026 0 obj << +/Length 2055 +/Filter /FlateDecode +>> +stream +xÚ½[Ñn9}ÏWä1‘¶f<öŒ=Ò + e©€ÕÒî.ð04CÉnÚ°ÓÄ߯íñŒ=wìëU#ÍÑ=Ç7çØ·ž@ç™úCç² «æB–¤`t~y=ËæWêç3jÙü$#¬’ú½gï>dó•ÂœÍº~S¯3B«j~=ã#göß›Ùùì÷¡J÷Ÿ¥ ÍI8a‘’1Ví‰( +Rr¡1O.fN9ÓŒTY5¿ø¤^QÂ36ïA«w‹÷Ëg³gC5š•Drî›ö˜ #-|FšFóãÙöó’.n–'Œ±Å¯¤ûûb)Ù¢YžÐE«Þür«_íÔ«¶Öâœ2éUU‹¹P:t¹Ÿ¡ú\)+r>V¯ßh¯,â·Ž¯ÖÔÄ^æÕb÷Èh­¯—¹\|¬‰Ò¼m¯&šDIJUëh™(­VÒJBºÞ»¹TÆ©pÃ8 b J!t†ŒaÃxŒgMÛ¨öŠÅ÷Î+7›µj³éûö&àÁ —EÌ´*H.ó±Ø¨?ztB6¨iü¡\?º­ö¸5Ê‚P´sb"`l‹QÔú3-pO Ä&éˆ8›3Ę.ìG÷¼iëͪ³Âû¬ÈT[φ£ý®~D»7©Û]ÓüA3A˜jSlQ]¤¼iT4îhZ­÷ûàmðÓb%ÚÉ5Œ ê`)U€X‘£ñ0q“ô ”K0ÂÁ&1èŸññÍJ;¢ù¦íÀ»#F÷|½ºj6›Ð¹BI.Xü\ÉI&ÆZ‘cÅ€qÑ ¢fݵzkS÷;VÔp"˜@û×c&RÆû¨„Úƒ ’øâa{XPÒ¡³` ÛÃc÷ŠÅ}ƒ>÷5oÔ§çmt°æ¡ó6ÖÑaÞ†J‚ó¶¯$æõB aU!÷ôº‡Žz½ÇhÖWçÝG÷—>ÂÌѶÕyÿvÛyþu³Ó-ù¦¶Õê?v +²c2ÕÖãWwæCÞ­·ÖÏÕ¿ïÖ+“ØDµdN¥¿¬i3I˜¨öË +“D–‰¨t˜dR†RHPÆtáœ8º£ÅÄ“¾GJE€Šg$ÞK‘±ŒpBœŒh@(%¢Ì÷ ˆCÇb1æ0èÜ}vº¿†Ø¬uV[’`fl`ž´FM{âÊFåÎÌf“œ0Zª™Iú«›v’Qe¸>'ø¯ä\rR– JJ%Å+ +d fÅgG×k:Ÿcæs¨$8ŸûJb†É+N*Ïç&n˜”2 F82 ã3þf6¯ë¦uGÎÆxåÚ5/»Ô붿. +9T=zäEz†œ9_ ¬©‰·›Æ ¢”ÌOŸ=~ù–˜étzêÐj*;3‘1>w@%Ô2¥ R”{Né::¥÷sMXÑé6·WÝ€þJ½DnAê3gä‹?^¿Ðm{k¯;t˶w_–¡¹]K• O\àj0#’ñ½®sž!s{J&ÄCà ñÏšÚýƒÄúæ}Ʋ%ç|q¹]Ûn¾ÒAr¿(u!ªïb^ j¤ø/5iŽ%›ƒºæÆps<Æ£M«#ùéq]¬yÐÀŠõs˜X¡ŒàÈêˈmTMâ3«‡‰Û¥¥ì‚vŒA»øŒÇOFêÓã ºXóÐñëè0ž@%ÁñÄW5LQ©iŸíyÖxèèYÓc4ëézÓ=t¥‹Ÿìm ÔO.wÛÖþNR›C§{}®?úºµOjíRsÛ]žX™&õùo7Áó‡qæ//xþ°ŒïuoD™2©L|]¡%3ãŠ!™ŒáÌxŒGËŒ¯~Ì`ë€5Î ÒQ— $œOI43™þuµÄ ã0ˆa,(i„Ð0† ã1ÞÓÅÀHlúb— jþðÅÖ9{1.|úè×&Õ¬ ñ EA¾6Ùa’_›Œ³¹¯MŽéÂ_›tt÷ïì‹N_;còAÅÃ/‘>wÎ@HðÊÙò°ëϸÝ9¡9µýÑóïªÛƒÍ³åá)²™‚#×Nጅÿ“eý×~ÿOÞ³eRÉÈ#õ‚1µ Ù‹Ñk) ^ý¿PîTðåãe(endstream +endobj +3025 0 obj << +/Type /Page +/Contents 3026 0 R +/Resources 3024 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 2965 0 R +/Annots [ 3028 0 R 3029 0 R 3030 0 R 3031 0 R 3032 0 R 3033 0 R 3034 0 R 3035 0 R 3036 0 R 3037 0 R 3038 0 R 3039 0 R 3040 0 R 3041 0 R 3042 0 R 3043 0 R 3044 0 R 3045 0 R 3046 0 R 3047 0 R 3048 0 R 3049 0 R 3050 0 R 3051 0 R 3052 0 R ] +>> endobj +3028 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 138.633 294.197 149.481] +/Rect [205.528 752.53 277.612 764.219] /Subtype/Link/A<> >> endobj -2940 0 obj << +3029 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [231.487 126.678 297.241 137.526] +/Rect [194.286 725.431 266.096 737.121] /Subtype/Link/A<> >> endobj -2941 0 obj << +3030 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 113.882 223.728 124.73] -/Subtype /Link -/A << /S /GoTo /D (locking) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [227.149 697.727 308.384 710.629] +/Subtype/Link/A<> >> endobj -2942 0 obj << +3031 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [231.487 101.086 297.241 111.935] -/Subtype/Link/A<> +/Rect [201.074 671.235 287.733 682.924] +/Subtype/Link/A<> >> endobj -2943 0 obj << +3032 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 89.131 316.308 99.979] +/Rect [213.498 644.136 301.672 655.826] /Subtype/Link/A<> >> endobj -2944 0 obj << +3033 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 77.176 294.197 88.024] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 619.159 182.824 628.727] +/Subtype /Link +/A << /S /GoTo /D (StandAloneServer) >> >> endobj -2945 0 obj << +3034 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [221.386 65.221 310.94 76.069] -/Subtype/Link/A<> +/Rect [205.528 589.939 277.612 601.629] +/Subtype/Link/A<> >> endobj -2946 0 obj << +3035 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 52.425 186.7 63.273] +/Rect [84.043 562.841 294.415 574.53] /Subtype /Link -/A << /S /GoTo /D (securing-samba) >> ->> endobj -2887 0 obj << -/D [2885 0 R /XYZ 85.039 786.531 null] ->> endobj -2884 0 obj << -/Font << /F56 2890 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R /F11 2898 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -2964 0 obj << -/Length 4158 -/Filter /FlateDecode ->> -stream -xÚµ\Ysã6~÷¯Ð£ü`„$xVmmÙ™É5ÉÌÎŽä!É-Ñ2cIt$zŽüúm\$ˆ£¡U¤JÕÄ–ÚÝïk4"žEð_<+3ÑjV”9Éh<[l.¢Ù -¾ùî"–Ñì*"´*Ùw]üöG4[‚Í› ñá'ø9"qUÍ6iFI–Rùûúâö⿃ñ]:\™a®Ò(!I?Ј”eê´‰iNhœÌ®Š,#yZ0£¯ï.¾ú6Ng©r:»{˜ÅiŽò™²¹[þ6ÿ=Š‹Ë?îÞ\|s7x‹³˜$Y9Ó|Ù¥0Óf9)•ðf»¼Œç»æÓå¥éüó|Ò²WÍåU<_¯"p®Š”$I±™™ˆZ’¼¤SÄì‹ÝJZ|а+k»é’Åíw-€\®šë}½¹LŠù=üZ“n·2Ñ8'Q”¢M¨llÚs›ŽŒ[&{¿H)É«$ÀÑÈÏidp`ˆÐÅ-à›îšuËøA?8+Iž÷ý®¶É‘§¤ ^n$Èn -ÕO aŒb6² >^&Õ¼Ò"©(I¢m7eccОØtä¦E”“’õ$Ž"uæ°Œ¤äö•øZEü ·J'’;£')‰´®”FʆAúaÛ7»e·©[Ù£y=ZAg¾ì{ñëø¦Y×}Ûm÷ðãcû¼·Z-+Hå~›uI :ÉÙð7!)Ä)Ê -—‚´ Jaô…HÁ è’‚ðLRС†¥€`6%¤ÝF)˜\RÐ@ø3d”‘’†ÆÐÑÈO i¤p …ÐE -à‡ú¡^ RÜBûþÍ8±àÿ6ûm[?9†Oz^ø‡O0L °Èð)¬QئKwÓnÚI 6êÛ£gAʈ¢§ll“ÑsêM“G¡¾¢'H“š'ošT6 Ò÷ݾo·+‘kö¿|þ–¥ÌÅŽujÇc÷ æë”ßÞ¿ôÍR|ð-³\7â—Û/̸ç\ØOý®‘_v2ßÖ›ûÚjt¨x“*s5ƒ-Ì´$« ɲyOcTNÊ&$'Í—_NV@‡œô€·,ɶ¼¶Û³†{Òú‘1t-*R6H9’-…d‹dÛ’c:ÅŒ¤[a¢7]²¸JO5`¼æøÙ%|@mµiToJibcѵ5uƒK+ω{vóÿ*kpä–0ax^±~«÷{.%ž1AïwíV©-Ÿß¾<³&ƒh4ï.áŸ]o§Çˆdu<…ÕpLSÒø@]d)‰’×…´ êbô…è èÒ…ðÇ6Së…Þ?p @[±Ö,™CðÇy™zCµfS°~AHk¶é’Å}z€MË1^³ie½}ºÌrn–JÇÓJ:$ËÑ6T66˜I%2u„V"yš¨ ŠŒF~ŠH› E°€EÌ€.Šh¿kvõšC4™¿â¹‡ 转R]Õ)k $a–q1EŠ&Lfb6]ò -µÙ1_“ø(&q™¡-§ll“T9u„çJVS'É)’åèÉŸ-¥ O—?¿‡¦¸5‚H“böÁJ4•-Y¦Œ‡LÉMµÉ¨,¸-%‘ÕÁ% ˜,‘ÚhS2…áåàTç$ƽ¤IP%ƒ'D$F4—FÆhgË¢Ò’¨³áð¥PëÔ@âJ #þŒ`¨…ÇÀy1ù‰!m‚ÌÀÔ0º¸¡|Õ>óÅÏZÎñiÿn¹ê^ÉjnêOž”ZS˜ÈNX£€M—°@È8}½ºgH¼“¸ˆTŽR66ŒÉ$nêh …Ѽ1äVÙ:¿GYÄ—™kV ‚jož”›UÐ}yz‚”«yò¦\eç}½xº„„Zß‹\>ÿ…e‡oeÞ°žgÜå˺±WÆ’ˆÏ`µ5äÞ²L˧YQò0Ý(›n4_~ÝXºÑ¾iÖYdÝ\–©\ÛŠ&ƒ~ïÚ?+! $;DE9ÉFЈŠ„5 -ßt)J€¿;`!ŒAšPÙØ&š:B3k–³,\2ù"m‚ Á 1º¢<ÏÒéjpéÃl84pxh3 ë¡µ€·lœÞð¥ÄqÕ¸Û-ø*¡ø„˜Ý®]ñZ^-.|àKb&ýr“IÛàÛß0à”•sóûJùB)É)“'Ú?±]®Íq¬¾¹y hß~ãèUwÒˆ¤¡ RÍÈßÒ&ØXÀ¡;Í€®îÔÞ¬›Ï5æ–þ¾æ}ËÛ¤cÿ|~ú2é^V§µ¡î­ -Ñ\‡~|÷J_è#Ò("Q’MqÛôu_³å»'!×å0ª/ø'ÚËqI2ˆŠ÷òhäïeiìe,àÐËf@W/ko{5U|àó/Ñgo›žoôlê#•ÍnìgøèçgÞT|âÖ7¢¸æ…_X ¿îÛgµ{6›nø;^núZÕÍQF²2;EÝ7õ¶Ù¶6-JJ²Â?%OK¨!Š)L?-¤5 -ØtÉ⮚~[¯®‡¬Á˜ÌÖ?)‡Î0­Y&±H’2õh+*”NÃNÖäy(ŒF~’H› I°€IÌ€.’hϽŠ3^ÅÁà›.XÅÁšpXű08Vqt ~†¤))ãPü ‘6A†`†˜] Ñžgg5¸Šƒa6³ŠƒµÛ°Šcap¬âè ¼»‹)I™Ÿâ,¨æÉ[²+^3,?ÖÛ…*Øßñµ‡ž-}º -õ'yö©†TÜlš­}#¡$Ï]á8 -šÓKs˜yUø%iÔÁà ‘Í¥‚1Ú™D á kÀxêî(ø[l€ÀÅÿŸþ0¥«²êô=ùé/møtþ˾W'òê­TÁÍbѽlåôô=CÇç2‹Ö±×òNãÂõ6Ñ¢’ÄQvØf…ö‹"|ùRلȯùò³ß -è ¿ð<üŸ@ -Ãl80+G-ùrP¹c4vfeìz›}qD’¼:PyúÁj”MP£/Df@—$´€g’„5, ³áð(I í6JÂÄà’„Â/‰,%qvŠÃßš'¿$¤ ƒôþ²Jæ7oåï뽨òùkuJÈ8î}Ã×7ûG¨ŽÚEÍ‹t[»#@M]å !ØzÒŠ¦1oTTÒ&¨ŒÑ¢ 3 KZÀ3)C‡V‚Ùpx”2v•abp)CáHR ‰6@‹ÑÈO i¤p …ÐE -ปÂö;@<‚ ?ÕÛHŽ}îxk¦„Iõ¯W²çªè/²0%¬Qä¦KWìåíÖ\ç×[õ}óù™¯Áò]š=Ù6½½4µ@Š÷ ²±aM–¦¦ŽðLçü=’dÒÑ“?“J}ShØây;gýu8ʺìø¤s/>gÍ3ÏO—á֧½È¿ŸÚþq8Ô -|Ï×­6N -’Χ¶ÉËOiøn"(vÇ%m‚Š}!Š2º¥Á·¿¥IPƒ'DF4—Æhg’€†3¬?à©»£øïo±‘þûG~òG)’S¼]®yò“_Úðºù¦›Ëaºù°ëä®öþgñ]ßMæ’ǫ̃ÙבýÒiÅ*eÇCÙÔƒr²ªÊÃÄèZø.² ÉAóå׃Ð!=๫ê èpUÁ7]QUcM8TÕGU­cðJ$.X¡qŠ5Í“W"ʆAâט¬vbíD^L"—¬'š)æïîR¹ôú•¼¸D½±0(ŠÊ+øÚø+»mÙeX…ëiÚ i™¨jóßR6A팾í˜]ÚÑžg4™@ 'fÃá1 -ÖnÈbap ):¿`Ø7'y _ó䌴áÓŠ_ù~›>Ü =\ Òßñ«iMre“ÕYͽ,–›v+7øjÃl$‘Ë;ÝÚ^¤lâxd› lj:âÐŒT¾Ž£l‚ª}!ª1ºT£<“jt¨aÕ ˜ ‡G©i·Q5&—j4~Õ“¢“ˆfpä׌0á«-qûD1gë™|Öͧåk¡ «™ØFQånµV“¨*›€³³Q`æ¡l‚Ì}!Ì7º˜¯<ëùý âðù} »éò¸óûXç÷-Žóû: ï -fU’8tîv´ñòCš„èESì0£9È¡E;w®#—ávÃáE8ÒxC np”àoj,3ç§H£#oj”&Bèõú ¿ÿl¸^P=ä— -®?šWüìõÍNþÉ3ßíî×ü(–½z5A”%Ž't0’]àzàݬ IðÚAX/àT~ë7§¡\—o¡Îrᕆ1|Ý•íÔÝQW]ù[k¸èʈï¸æjŒÜÞM¼¼GÙ w÷p“ðÕ=þhãÍ=Óh΋{†hçN’:âp’D°H’Hã IÒàH’‹ò®}(1SJÝWíÇì–üêŸ]µ%ã\ñÛK'KÿìŠ!¨Ù›­”’8)†75ñfP–d%uþyÎ^9endstream -endobj -2963 0 obj << -/Type /Page -/Contents 2964 0 R -/Resources 2962 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2869 0 R -/Annots [ 2966 0 R 2967 0 R 2968 0 R 2969 0 R 2970 0 R 2971 0 R 2972 0 R 2973 0 R 2974 0 R 2975 0 R 2976 0 R 2977 0 R 2978 0 R 2979 0 R 2980 0 R 2981 0 R 2982 0 R 2983 0 R 2984 0 R 2985 0 R 2986 0 R 2987 0 R 2988 0 R 2989 0 R 2990 0 R 2991 0 R 2992 0 R 2993 0 R 2994 0 R 2995 0 R 2996 0 R 2997 0 R 2998 0 R 2999 0 R 3000 0 R 3001 0 R 3002 0 R 3003 0 R 3004 0 R 3005 0 R 3006 0 R 3007 0 R 3008 0 R 3009 0 R 3010 0 R 3011 0 R 3012 0 R 3013 0 R 3014 0 R 3015 0 R 3016 0 R 3017 0 R ] ->> endobj -2966 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [237.686 752.714 317 763.562] -/Subtype/Link/A<> +/A << /S /GoTo /D (ClientConfig) >> >> endobj -2967 0 obj << +3036 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 740.759 294.197 751.607] +/Rect [205.528 535.743 277.612 547.432] /Subtype/Link/A<> >> endobj -2968 0 obj << +3037 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 727.807 258.955 738.655] +/Rect [84.043 508.038 317.354 520.94] /Subtype /Link -/A << /S /GoTo /D (InterdomainTrusts) >> +/A << /S /GoTo /D (NetworkBrowsing) >> >> endobj -2969 0 obj << +3038 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 714.856 294.197 725.704] +/Rect [205.528 481.546 277.612 493.235] /Subtype/Link/A<> >> endobj -2970 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [238.932 702.901 318.799 713.749] -/Subtype/Link/A<> ->> endobj -2971 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 689.949 386.292 700.797] -/Subtype /Link -/A << /S /GoTo /D (msdfs) >> ->> endobj -2972 0 obj << +3039 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.198 676.998 308.477 687.846] -/Subtype/Link/A<> +/Rect [213.498 454.447 301.672 466.137] +/Subtype/Link/A<> >> endobj -2973 0 obj << +3040 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 664.046 231.549 674.894] +/Rect [84.043 429.47 237.551 439.039] /Subtype /Link -/A << /S /GoTo /D (printing) >> +/A << /S /GoTo /D (passdb) >> >> endobj -2974 0 obj << +3041 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [218.149 651.095 297.352 661.943] -/Subtype/Link/A<> +/Rect [213.498 400.251 301.672 411.94] +/Subtype/Link/A<> >> endobj -2975 0 obj << +3042 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.821 639.14 302.181 649.988] +/Rect [227.149 372.546 308.384 385.448] /Subtype/Link/A<> >> endobj -2976 0 obj << +3043 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 626.188 284.75 637.036] -/Subtype /Link -/A << /S /GoTo /D (CUPS-printing) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [194.286 346.054 266.096 357.743] +/Subtype/Link/A<> >> endobj -2977 0 obj << +3044 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [218.149 613.237 297.352 624.085] -/Subtype/Link/A<> +/Rect [205.528 318.955 277.612 330.645] +/Subtype/Link/A<> >> endobj -2978 0 obj << +3045 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [232.401 600.728 311.908 612.683] -/Subtype/Link/A<> +/Rect [226.983 291.251 320.975 304.153] +/Subtype/Link/A<> >> endobj -2979 0 obj << +3046 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 590.267 221.19 599.178] +/Rect [84.043 264.759 286.869 276.448] /Subtype /Link -/A << /S /GoTo /D (VFS) >> +/A << /S /GoTo /D (groupmapping) >> >> endobj -2980 0 obj << +3047 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 575.379 316.308 586.227] -/Subtype/Link/A<> +/Rect [227.149 209.956 308.384 222.857] +/Subtype/Link/A<> >> endobj -2981 0 obj << +3048 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 563.424 294.197 574.272] +/Rect [205.528 183.464 277.612 195.153] /Subtype/Link/A<> >> endobj -2982 0 obj << +3049 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 502.652 300.145 513.5] +/Rect [84.043 156.365 286.339 168.055] /Subtype /Link -/A << /S /GoTo /D (winbind) >> ->> endobj -2983 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [215.935 489.7 317.305 500.548] -/Subtype/Link/A<> +/A << /S /GoTo /D (AccessControls) >> >> endobj -2984 0 obj << +3050 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [237.686 477.745 317 488.593] -/Subtype/Link/A<> +/Rect [205.528 129.267 277.612 140.956] +/Subtype/Link/A<> >> endobj -2985 0 obj << +3051 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [247.04 465.79 347.303 476.638] -/Subtype/Link/A<> +/Rect [194.286 102.168 266.096 113.858] +/Subtype/Link/A<> >> endobj -2986 0 obj << +3052 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 453.835 316.308 464.683] +/Rect [213.498 74.464 301.672 87.365] /Subtype/Link/A<> >> endobj -2987 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 441.879 294.197 452.728] -/Subtype/Link/A<> +3027 0 obj << +/D [3025 0 R /XYZ 85.039 786.531 null] >> endobj -2988 0 obj << +3024 0 obj << +/Font << /F41 2994 0 R /F15 2972 0 R /F38 2997 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3061 0 obj << +/Length 2240 +/Filter /FlateDecode +>> +stream +xÚ½ZÛrÛ6}×WèQz0JAÎt2NÓ¦­›Î¤±›—6ŒLËltq)ºiòõÅ•@`¡q'™Ìزx²{°<»X\ð2ãÿð²¢(#õ’U%¢/7ûE¶Üò'?.°FdË‹ ‘ºÏþ^üñ.[ÞrÌÕB}ù‘ήëå~QP‚hAôß»Åõâ·ÑŠzV,GS¾› ƒ¸ ªªB`Ô³~»TÞXhÍû‚QŠÊ‚ ôw7‹o^bºÄª³zys7NcnnÿX½ìvk¼jׄ«æp+>Õ›v³¾À«cÏŸé¯^×yµÚ¬s¶úÀ¿îÛõ»›«Å7#‰<ËQQK‹ÃlT3TPº¼ÈÊ"#Ç’W<õ8–[cÁFEF–$óg†™O +g%ªhµ´ŒÍIiÌÌ£=ŒsDpîx¼jûv/BòIEéùn×ñàœdô‚Ë7/Iea**ÊÝŠÿýíŒlMQ^å.Yñ ßj„ýÎ :AÛ³)ÿ%^lsyj$÷÷ Z‹—=¡%EŒœBÌ8Cv­÷Ï|GF˜âRX#„Â$÷6 ÂuÖÃäîªÝí[ñî{GHý~»®Èªí"‡ØêØýPFMPY³˜2r\¨Ü²HG…aÀ }Ï¢”ÅD¯’ê Y†JVBq4Ÿˆ3pÏ$’§¡9¨ —ˆ¥49Eâ{ ªÄöxu¼ç!=(mü¤5r#5b¢ÿ KÈÀ?õM@,|°,‹…3£yᲫE£áqø6¥^î×y½.%W¡– +¨%¬D%·EÔ`fLÜzâYS0”ÓÌ„£AIÁ'Áx±<þ $ÑmÔ,ýæx’2á©:FIPÁßRl~© +”çØeŸ_4:Á׳)·}·AýÄ“ÿ¼ä#¸à?j-ö3T¼Oã§36®8+ 4rŽ¤ô̾ÊBGû*ƒ^¯ÛÍcßøx·*½¯u5ïìµ”ab3šk>«ñYmå3IF¬gJéÙ2׳ï1¨gÛãsÞhòÊÖ~TŠ–¥OJüvÛîv¡z‡QÎH¼Þå(c.W ÜI0LÚ³(¼½èì8ÁóÊ_@0ÂÀøÌŒŠ§hפiÊ[­š&ä1ayhPR€ÃIžÇ°<,_k~tاçGp¾Í§ÎPDÇùÑgœm&QÁ +Uå™5pGK †—?Äx‡¶¿=î›î0¾ÄbÕ?ž³Î‘Ù5ƒH­ãátß=ÈÕ“›"“K˜‰À\l|Í™óµöYcÄÊD‡h@É ˜Œày g€åñ«e€ÍþŒ €ÆáÛ|r2Àc΋I, +Þ¾”%caâ‚1 ”` ‡£`|AÁØß4wÍNw<¼ŸE¼7òg+c/:‘®ùJŽJ…7”„¸¬¡(4Ìß·)﻽ )ê@?®…Ï%¸Qasy¦¢äF=G8Ç:Jf4»UEš¿Fä‡-€cJ#*J+mÂJÓ ¤Ò‡“Ò¬iÉ{ÚÛ6tÔ&vQ¡ÌŒÊì¸Í¶‰?¯ T3¸¥µ0q‰PJ"ÃQ"¾Ç Dl?¶}³Ó“è·x¨¯Æ±ÿ$;-ùðEÓmP Οc£’Éó +á¢téÇ»†âÛTm/(J®€ˆà[Áñ4˜ ¯©u-r)O¬s·‹,t´VŒ¬•¿¿¾ÖY.^[§J¤¾j ºQ +ÔÅ”„.Ò:È¢JPÊ4)Ù‰Þ\Š8ßæÓ÷™ hŽûL>—à>“Íå I—ù¢"gNè::¡̸ÿÓ胢h¿ßéåþÛ—ü‰žì徯íHçÚ[™¦‚2‘\.T{ÙjÚ†k2&\²UâÖ‡%3h2dç1œA–ǯA6ï32oódÍ)ƒ<.á ²¸Ä&pœ‰û‘%,– ˆEƒ’bNbñ<†ÅbyüZ'†ûô‰!8ßæSO ¡ˆŽ'†>“à‰¡Í$zK•¯Û*xs~‚·T&yK5îmº¥êº ßRÜÝtzÿõµõq´B"dTî8oÂcb®ý>ý&¼uÊŠê*r¶L ás]eȈQ”>_q;€ò™aNø?Ø»&endstream +endobj +3060 0 obj << +/Type /Page +/Contents 3061 0 R +/Resources 3059 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 2965 0 R +/Annots [ 3063 0 R 3064 0 R 3065 0 R 3066 0 R 3067 0 R 3068 0 R 3069 0 R 3070 0 R 3071 0 R 3072 0 R 3073 0 R 3074 0 R 3075 0 R 3076 0 R 3077 0 R 3078 0 R 3079 0 R 3080 0 R 3081 0 R 3082 0 R 3083 0 R 3084 0 R 3085 0 R 3086 0 R 3087 0 R ] +>> endobj +3063 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 428.928 262.583 439.776] +/Rect [84.043 752.53 203.49 764.219] /Subtype /Link -/A << /S /GoTo /D (AdvancedNetworkManagement) >> +/A << /S /GoTo /D (locking) >> >> endobj -2989 0 obj << +3064 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 415.977 294.197 426.825] -/Subtype/Link/A<> +/Rect [194.286 725.431 266.096 737.121] +/Subtype/Link/A<> >> endobj -2990 0 obj << +3065 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 403.025 245.414 413.873] -/Subtype /Link -/A << /S /GoTo /D (PolicyMgmt) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [213.498 698.333 301.672 710.022] +/Subtype/Link/A<> >> endobj -2991 0 obj << +3066 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 390.074 294.197 400.922] +/Rect [205.528 671.235 277.612 682.924] /Subtype/Link/A<> >> endobj -2992 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 377.122 247.578 387.97] -/Subtype /Link -/A << /S /GoTo /D (ProfileMgmt) >> ->> endobj -2993 0 obj << +3067 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 364.171 294.197 375.019] -/Subtype/Link/A<> +/Rect [183.225 644.136 281.096 655.826] +/Subtype/Link/A<> >> endobj -2994 0 obj << +3068 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 353.157 291.45 362.068] +/Rect [84.043 617.038 162.127 628.727] /Subtype /Link -/A << /S /GoTo /D (pam) >> +/A << /S /GoTo /D (securing-samba) >> >> endobj -2995 0 obj << +3069 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 338.268 294.197 349.116] -/Subtype/Link/A<> +/Rect [201.074 589.939 287.733 601.629] +/Subtype/Link/A<> >> endobj -2996 0 obj << +3070 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [245.297 326.313 344.038 337.161] -/Subtype/Link/A<> +/Rect [205.528 562.841 277.612 574.53] +/Subtype/Link/A<> >> endobj -2997 0 obj << +3071 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 313.361 328.574 324.21] +/Rect [84.043 535.743 241.278 547.432] /Subtype /Link -/A << /S /GoTo /D (integrate-ms-networks) >> +/A << /S /GoTo /D (InterdomainTrusts) >> >> endobj -2998 0 obj << +3072 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 300.41 294.197 311.258] +/Rect [205.528 508.644 277.612 520.334] /Subtype/Link/A<> >> endobj -2999 0 obj << +3073 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 286.905 194.618 298.86] -/Subtype /Link -/A << /S /GoTo /D (unicode) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [202.437 481.546 289.703 493.235] +/Subtype/Link/A<> >> endobj -3000 0 obj << +3074 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 274.507 316.308 285.355] +/Rect [213.498 453.841 301.672 466.743] /Subtype/Link/A<> >> endobj -3001 0 obj << +3075 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [275.268 262.552 388.51 273.4] -/Subtype/Link/A<> +/Rect [209.407 427.349 317.339 439.039] +/Subtype/Link/A<> >> endobj -3002 0 obj << +3076 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 249.6 235.816 260.449] +/Rect [84.043 400.251 370.612 411.94] /Subtype /Link -/A << /S /GoTo /D (Backup) >> +/A << /S /GoTo /D (msdfs) >> >> endobj -3003 0 obj << +3077 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 236.649 294.197 247.497] -/Subtype/Link/A<> +/Rect [189.589 373.152 278.4 384.842] +/Subtype/Link/A<> >> endobj -3004 0 obj << +3078 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 223.698 227.265 234.546] +/Rect [84.043 346.054 212.43 357.743] /Subtype /Link -/A << /S /GoTo /D (SambaHA) >> +/A << /S /GoTo /D (printing) >> >> endobj -3005 0 obj << +3079 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 210.746 294.197 221.594] -/Subtype/Link/A<> +/Rect [179.68 318.955 266.218 330.645] +/Subtype/Link/A<> >> endobj -3006 0 obj << +3080 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [227.149 291.251 308.384 304.153] +/Subtype/Link/A<> +>> endobj +3081 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 197.795 310.307 208.643] +/Rect [84.043 264.759 266.399 276.448] /Subtype /Link -/A << /S /GoTo /D (upgrading-to-3.0) >> +/A << /S /GoTo /D (CUPS-printing) >> >> endobj -3007 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 184.843 316.308 195.692] -/Subtype/Link/A<> ->> endobj -3008 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 171.892 314.693 182.74] -/Subtype /Link -/A << /S /GoTo /D (NT4Migration) >> ->> endobj -3009 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 158.94 294.197 169.789] -/Subtype/Link/A<> ->> endobj -3010 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 147.926 324.816 156.837] -/Subtype /Link -/A << /S /GoTo /D (SWAT) >> ->> endobj -3011 0 obj << +3082 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 133.038 294.197 143.886] -/Subtype/Link/A<> ->> endobj -3012 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 122.023 208.405 130.934] -/Subtype /Link -/A << /S /GoTo /D (diagnosis) >> +/Rect [179.68 237.66 266.218 249.35] +/Subtype/Link/A<> >> endobj -3013 0 obj << +3083 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [237.686 107.135 317 117.983] -/Subtype/Link/A<> +/Rect [195.286 209.956 282.157 222.857] +/Subtype/Link/A<> >> endobj -3014 0 obj << +3084 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 95.18 316.308 106.028] +/Rect [213.498 182.857 301.672 195.759] /Subtype/Link/A<> >> endobj -3015 0 obj << +3085 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 82.228 288.048 93.076] +/Rect [84.043 158.486 198.672 168.055] /Subtype /Link -/A << /S /GoTo /D (problems) >> +/A << /S /GoTo /D (VFS) >> >> endobj -3016 0 obj << +3086 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.821 69.277 302.181 80.125] -/Subtype/Link/A<> +/Rect [213.498 129.267 301.672 140.956] +/Subtype/Link/A<> >> endobj -3017 0 obj << +3087 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 57.322 316.308 68.17] -/Subtype/Link/A<> +/Rect [205.528 102.168 277.612 113.858] +/Subtype/Link/A<> >> endobj -2965 0 obj << -/D [2963 0 R /XYZ 85.039 786.531 null] +3062 0 obj << +/D [3060 0 R /XYZ 85.039 786.531 null] >> endobj -2962 0 obj << -/Font << /F14 2895 0 R /F15 2876 0 R /F11 2898 0 R /F20 2865 0 R >> +3059 0 obj << +/Font << /F15 2972 0 R /F41 2994 0 R /F38 2997 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3039 0 obj << -/Length 1737 +3097 0 obj << +/Length 2128 /Filter /FlateDecode >> stream -xÚµZÛrÛ6}×Wð‘zŠ AÓNë\š´nÓqcO_Ò<Èc)µDW—dò÷] áFkO&¶Ií.Î.(‘ Ã?’IŽ0S™%âŒd‹ÍgwðÊÛ 1œÍ0bJê×þ|øˆ³%`.'íɯð7FD©l3)8C¼`æø~r=ù³Ò¾Vd}(7ͬÀQ0Œ¤,‚ÂJÄÍf‚sTBƒ^ÞL¾{CŠL!U²ìæSFŠ•Y‡¹Y~ÈÿÆDL?Þ\N~¾é£Nå2³bù ÆOÈ­„¼DXÙ _ϧTæ_ÖËéŒ1š¿œÎH>ßNI¾­·šD C„²D¤ÐIõ[p‰R¨H‰é)QýÂîÎ Þ[”;t’²Rç]ÞN5GM²Þ^ÀÏ}Cz£/ävŽêœºs¹1Š4YÄã3²JàÒŒ~ô– —Hê%+(*UÊÆQÁAfú¥ö©ýÃ.!ÔiˆÔP¢ØZWê0šÒûêV*4…»Ãz{‡¥È_ïö[Éæeˆ­¯~´Ç R*NGÄOUNŠß`FÅ?ÄJˆßM¿•ð²ºßTZ<;­~–ÿ5•EÞžhÔ5¤êõg¿…F(ãP‚jÅ)éD#´è$}7¤ÎûYÓß]ìµôEÞt¨ß—>á­<%ì0>[úN °ôÍê "jD!(®ƒUH*a¯7aH!VÂëzSÕÛêûV7SÉòx%L¥Oym¤óÛ\ÛÎ}{ðâX™Ó„ªÝJ/ÎÃþ§¨QàI&ŸÂ(†Hq£0}…¿€Càük뇺ý½¨7@øa}?«öÔõ ÝïàDsxáižr$TèB¼Õ -Bžç!¥"p—-“ -é0c -±bÅâ% (ÄNøÜrBzÜCRôÝðT {ñ8<ÄæõRÀûÂÓž¥WˆÁŒ*$•°Wˆ›0¤+ᩇ\±ÀÿoƒGˆ¼?½š?t3MÔ.JÄÔS¸Å(j¢¯äjÚN&Šùmãëƒ>÷Í/¨BX’Q¯®”"Qª3Ý€S™^kƒ]ë!Vb­Ý„¡µ¶>»ؤÏpƒ}7äcÜ QÂÁ \!7°8D‡é² 0y‹§Pý).{ƒi:x¾¹ëÛ`©÷F°˜Ëö >¬ôQs³‡ÃW¿¾¹6÷O= ¬«íÁ›µi¡+Tèb|˜Ë™8³5¨D„òtkÌhk ±­á& µ†•ðr½i{âÝâu½­zˆZú€#ΣmPÀæ Ð'ãm`ÐIªnȦ 6‹åűsa¤mîvƒôPä5‚DLÉ‚uŸÅI#œJß lÃňzL\ -dT ‰l½œl!) ÙžÝ$-Ægxdœ»ð1/Þ`?âöˆ¢D=…=‘âöh0Ž=^éá Ú}j‡„Mó fav7SEòãv­.éžó×O"AƒWâKSTò)À^„«rD!(®ƒUH*a¯7aH!VB盿7âh7O‹ßvÁý‡¦žØ&N'÷äî†l¾ ¡©~ÑÏj–æs«†¿ÌW-yýÈ=ü‡# ±SUí0>3G4v  hÌYX"cáï±ýõÿ¾Ç23yf…DJžŒä#…•&̃“ìÈh¾ÜåËaSÎ% þ}X}3endstream +xÚ½ZËrÛ6Ýë+´”Bˆ r¦Ó±š¤MܺMc·]´]Ð#+–D—¦ã¸_ß‹I@ŽfêÉ4UÈ3÷yÎÏ#øƒçiŒ"šÍyš ˜âùÍaÍ·pç‡Öˆh¾ŠÍRqïŸÙŸGó `ÎgêâüŽβùaÆbŠbFõ¿÷³ËÙ¯­uÍ[S¶›UƒXÑ¥)sbt´+Ç(a\`¾»š½úžá9ŽPeó«Oð #ÑyºÚü¹ø+Â|ù÷ÕùìíUk G Jãtn8l086=b‚(&=—»%^–+¼(—+JéⲬàʸR¨+EqTV»íî7ò½ºøåÓƒ(! b›†Aáî6¬[á„ÉP’±^BwK’ŠÐñB‡úñíúÍ„þÁvÐ ±H +]ÍÂÝì0njÐh7»nZÝÝ4<®÷Å×ü¸YbU€Jà»RÖ¤}i=‹›Lvð“œÄ(K¸ûé Ö¶Â9’$C„õR<u^çû;¥Hˆ éÜ<ˆŒC-ŠÃn!+ÌhýÞºööݹ»Û¹»¬›¾~}:ª +\õ¿âÚ!¿Y¾¸µz/ÚûÛ=Tˆ/6y­ý©Ôw‚ûZ û}¡qP¥}ÜceM8C4&" u§ÚÎÕŽ +èaΖEIèÍ—eœˆd›™´Q‘ÿ,“¬EüO’Ò•fÄ…Äæ[yÿPÅÍzÀd!ãÅgØ&*8%@UŽ"ÏbЦÅ8"1 3§QÇ0æçŽíÑIÓãy)¨¡Ió©ÿ_-SÚÐð j +ÿÊEp¯¾§i¿=œpˆC˜ûfPRˆ,­ö¢7ª­F˜|hÐáÓk·‡ZHâYÝÿE´TD¸N«#Hºi¸w(€ ž¦Ó€aEå#oxШ:cXÝ +0<¾˜Ìè'( ”‡mód*Ú)ÀŠÄ­#Ÿ°øÖ$Å` ½ +h0r‹|¿½Ê7æó¤x¯[•ýhh<®úª®Ö¥‚ZŽ+QF*ê¡hP¿4‹Ÿâ°|CQ„'hã8C,Ù(5 1•Æü*±=:UbzüÿwÕ½¸ÇwÕÁ l›§ïªCÕlwÕv,Î]µ‹W!*?ò ” EƒFÉpØ‘Åòè&‹áñ¥Fj/úñ‘ÌöyêH U´©v$ΑjFâ%L#âyéҦãA£„ 8ìcytÆðøCQåûM÷} ”ø¼¥Jõ,?–‘7_çU]T®'2ظÀs«—1$E˜%ýðýŒÑèp"¶M5d*òs;_ÄR‚œóâMÃõl0ƒ0¬ùÒ·¢ ‡ˆÓ©'TØ»þjˆpy!ö™ò8·ÔÂ7Ö^¶øùŠé/'Þ¼6×]kU–‹nó‰^Önd«ÆÚà†*ƒ0i"ŽaŸêþFþ£Ó>¸ }Új¼rCYêy¿SŠ0Içâ¦júÄ%ÞxÆ°4hŒð1*= +endstream endobj -3038 0 obj << +3096 0 obj << /Type /Page -/Contents 3039 0 R -/Resources 3037 0 R +/Contents 3097 0 R +/Resources 3095 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2869 0 R -/Annots [ 3041 0 R 3042 0 R 3043 0 R 3044 0 R 3045 0 R 3046 0 R 3047 0 R 3048 0 R 3049 0 R 3050 0 R 3051 0 R 3052 0 R 3053 0 R 3054 0 R 3055 0 R 3056 0 R 3057 0 R 3058 0 R 3059 0 R ] ->> endobj -3041 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [229.606 752.714 321.068 763.562] -/Subtype/Link/A<> +/Parent 3122 0 R +/Annots [ 3099 0 R 3100 0 R 3101 0 R 3102 0 R 3103 0 R 3104 0 R 3105 0 R 3106 0 R 3107 0 R 3108 0 R 3109 0 R 3110 0 R 3111 0 R 3112 0 R 3113 0 R 3114 0 R 3115 0 R 3116 0 R 3117 0 R 3118 0 R 3119 0 R 3120 0 R 3121 0 R ] >> endobj -3042 0 obj << +3099 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 739.762 184.052 750.611] +/Rect [84.043 671.235 241.218 682.924] /Subtype /Link -/A << /S /GoTo /D (bugreport) >> +/A << /S /GoTo /D (AdvancedNetworkManagement) >> >> endobj -3043 0 obj << +3100 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 726.811 316.308 737.659] -/Subtype/Link/A<> +/Rect [205.528 644.136 277.612 655.826] +/Subtype/Link/A<> >> endobj -3044 0 obj << +3101 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 701.904 226.786 712.753] +/Rect [84.043 617.038 223.884 628.727] /Subtype /Link -/A << /S /GoTo /D (compiling) >> +/A << /S /GoTo /D (PolicyMgmt) >> >> endobj -3045 0 obj << +3102 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 688.953 316.308 699.801] -/Subtype/Link/A<> +/Rect [205.528 589.939 277.612 601.629] +/Subtype/Link/A<> >> endobj -3046 0 obj << +3103 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 664.046 160.078 674.894] +/Rect [84.043 562.841 224.612 574.53] /Subtype /Link -/A << /S /GoTo /D (Portability) >> +/A << /S /GoTo /D (ProfileMgmt) >> >> endobj -3047 0 obj << +3104 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 651.095 316.308 661.943] -/Subtype/Link/A<> +/Rect [205.528 535.743 277.612 547.432] +/Subtype/Link/A<> >> endobj -3048 0 obj << +3105 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 640.081 250.345 648.992] +/Rect [84.043 510.765 274.369 520.334] /Subtype /Link -/A << /S /GoTo /D (Other-Clients) >> +/A << /S /GoTo /D (pam) >> >> endobj -3049 0 obj << +3106 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [239.015 625.192 319.38 636.04] -/Subtype/Link/A<> +/Rect [205.528 481.546 277.612 493.235] +/Subtype/Link/A<> >> endobj -3050 0 obj << +3107 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 613.237 316.308 624.085] -/Subtype/Link/A<> +/Rect [209.407 454.447 317.339 466.137] +/Subtype/Link/A<> >> endobj -3051 0 obj << +3108 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 600.285 239.724 611.134] +/Rect [84.043 427.349 311.975 439.039] /Subtype /Link -/A << /S /GoTo /D (speed) >> +/A << /S /GoTo /D (integrate-ms-networks) >> >> endobj -3052 0 obj << +3109 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [230.879 587.334 330.118 598.182] -/Subtype/Link/A<> +/Rect [205.528 400.251 277.612 411.94] +/Subtype/Link/A<> >> endobj -3053 0 obj << +3110 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 372.546 171.642 385.448] +/Subtype /Link +/A << /S /GoTo /D (unicode) >> +>> endobj +3111 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 575.379 316.308 586.227] +/Rect [213.498 346.054 301.672 357.743] /Subtype/Link/A<> >> endobj -3054 0 obj << +3112 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [242.225 318.955 366.036 330.645] +/Subtype/Link/A<> +>> endobj +3113 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 291.857 213.218 303.547] +/Subtype /Link +/A << /S /GoTo /D (Backup) >> +>> endobj +3114 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 563.424 294.197 574.272] +/Rect [205.528 264.759 277.612 276.448] /Subtype/Link/A<> >> endobj -3055 0 obj << +3115 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 550.472 283.767 561.32] +/Rect [84.043 237.66 208.824 249.35] /Subtype /Link -/A << /S /GoTo /D (DNSDHCP) >> +/A << /S /GoTo /D (SambaHA) >> >> endobj -3056 0 obj << +3116 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.194 537.521 294.197 548.369] +/Rect [205.528 210.562 277.612 222.251] /Subtype/Link/A<> >> endobj -3057 0 obj << +3117 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 526.507 195.697 535.418] +/Rect [84.043 183.464 290.036 195.153] /Subtype /Link -/A << /S /GoTo /D (Further-Resources) >> +/A << /S /GoTo /D (upgrading-to-3.0) >> >> endobj -3058 0 obj << +3118 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [235.611 511.618 316.308 522.466] +/Rect [213.498 156.365 301.672 168.055] /Subtype/Link/A<> >> endobj -3059 0 obj << +3119 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [230.74 499.663 316.059 510.511] -/Subtype/Link/A<> +/Rect [205.528 129.267 277.612 140.956] +/Subtype/Link/A<> >> endobj -3040 0 obj << -/D [3038 0 R /XYZ 85.039 786.531 null] +3120 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [227.149 101.562 308.384 114.464] +/Subtype/Link/A<> >> endobj -3037 0 obj << -/Font << /F14 2895 0 R /F15 2876 0 R /F11 2898 0 R /F20 2865 0 R >> +3121 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 75.07 296.399 86.759] +/Subtype /Link +/A << /S /GoTo /D (NT4Migration) >> +>> endobj +3098 0 obj << +/D [3096 0 R /XYZ 85.039 786.531 null] +>> endobj +3095 0 obj << +/Font << /F41 2994 0 R /F15 2972 0 R /F38 2997 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3069 0 obj << -/Length 2716 +3135 0 obj << +/Length 2036 /Filter /FlateDecode >> stream -xÚå›KsÛF€ïú¬\V™ 扽lY~dZ%ÙH.’`‰’¹¦@…¤lëßo÷<0C‚3&´Q"YqULóhô7ÝèžÓQ èH R²z¤´$‚ÑÑÙÕA9º„'ßPׂ Fçð{ÇÉ:‘)¹ÚÙÆÍ1Q'\slsxrðÝëªU%‘’N.F”V„Ñj$뚥F'ç¿/ízÚ®WãßO~8xuÒè”BIÙN¡kRÖ05Ó„×;[L(ã:O$Õæ„¢”ÔBleÛ LoÈxB©ÖÅ÷SøQ´Óe3O˜”Å›vµ†ß´˜7ë٢ݚ×0†¨Ga>ûdy9²?~‰Õêg¥Û¥«ªíi´°aœ>ÂJ’JÑÝ€9#’©ÑÑ ½[‘•&RÉÑDÔÐXn -[’º¬cUúF(-]JÎAsëå”H‹ó›3£;£Ð5Þ“ª8n®Þ5}uÖø^ÑœYušÆy ·F4êd uF Ógg Û¢P+Ë©Tè’PX¤VY¨.ê:lÎÆ•*>\.a±-nÚóñD(ZÀSQ–ý¿à½îôìïí¾ëÙ6‹²$¼¤–zêÞ¹|¯IÔ­O`{ìüjè Ðãîšægí¸KpÇÒs¯÷“±fÅty5kèf—·`L>aðNMCÁ‡nð‚4ø¾ið¹Y;ðð9-)wà™ÿ‹ùÔ ófm~ž#xVü wÐq -Qüwz†à[9ÑŒ> úNWCé‡nú‡Š§è÷HÓÏÍÚÑg5áR8úÜÑ?>̇HœGÓõ{4ýñ¤ÒÅùbn|€Ôâ+'íô2”tè–!é¼)Ò}Ò¤s³v¤+Aj*iáH¿º¶3€zƒ¡s¦6ÿp 8… ]¡[f D0ÒK /@z äfí–ÄR¹% Ý8šúºò3ëô×o§‹›Fyú)¢wŠŠ>tË  T2…¾/@=Ó$JÜ%Ju>QâZ :Ÿ(ùFF4—(ýk1feñɦE>=z+¤Åµ²‚ºt´Á¼ŸŸŒkð&«µ½}Œ-Ÿ>O$T‘l{$TÙ7ÙѼˆJè8èŽ Õ¶(;Ž+Nà±Jõ ÕOïŒæf-_{iƒ+«?ø1k½I®ÑçssãÒ~WÍæb8@³m ß´¼:šVÔ-mZªNbï ôªÙY;À²$š:¾>qz±hƒà ©Ý,cƆ*ÔÅ»ÆÞú­¥¹mïhm"ëB¿€ñ46¡ØøQzS§ ¡Ä»^à‘ꓼ{³§qg¦¤M+ðÈœ+RÉ€ Zƒ“{õyl¸7 ©æSk¬ëÀdSf¯©†´ú~ÜB÷ÖC†nˆ±F“û¤1æf¥ÚY-ž~ Ór¤fw°ÖµÛöpØØè-šæš«³@ÕbvWžú§äLð«*lò¼Z_7Hÿ -ìû·7÷jCa…nX±Ú’°ú¤aåf팮* •VåŒîøt ±Kñq<ühóžp;å źepÇŠ×)Ü}Ò¸s³v_ÔÒVY,nïE.o­bŽ2³]×ï®Þƒ³Öç¢+Œš>ŽÄ©3“â¼óæjvÿÁX7|e:/?âÍ)Üúoú|–‰šÓø†n¾±¦“|û¤ùæfõ|YÍH)ÝVW·é´Á›¶ˆ wMxxäµ1oÔ-ÍwCÓ)¾;HòÍÎÚñU5Ômpu[M¯â)¾J@À‹;ÌWö¢±­_þt wŸÙ‹Ó‹SlWZ§ÆüëÏæš¡~+^¡¯Y.–v·…A(ù„69½Š†BÝ2Ðcõ×)è}ÒÐs³ú4KgTwÐ}n& ÜE>.4Q¢Ùf±÷¯š6jíÇØ—¯±ö a¤ùLØqǘæwÅ+¬0+njþoÚ­qA÷¾C †n‚±.“û¤ æfíBcPNGÐ'zo¾Å€@ŠâÒhx‚~¸÷ÍâÚ@±§£¶E­'ZÑnh˜ÿƒ_/Gç ë%aµ}‚ߘÔõèꀑJ1w5?8>øOx?Ö$¬ÿ2•Ò„r¾ñ2‹ëyWDµGi¶åde ŠçŠœ~¬¼œàïÀWn*}vÖ÷?pù©â5ÆmÍÌmoØ“’»Z@GÄ^Ä/‰–0·mß¾üÙ>_mh«µ‰Å&´â¤,7£± °Hë¢9‡aÏC>·Âm”² %ü§.зƒi¾Zš³I®Ë'œ¡q _4híb톳v;»líõrúÇM7¶?í@‹olg³ÒŒ¥•ÎƵ¦(îÜÈ|ââat÷óù¨4'ÿ¡WÚõ¸6¨eV&8²ñ»ž®~/q¿—}¡­ ‚ÔÁÊh ÿÇïQMÉ—*ÆT…]uÞ¹½×¸àŒG–S·ÛÐ 8t®‹U\Ñ `Öuõµ¹9¯¤n.ê–vs1€ô‚Pû—5²³vØEØlçÝI4,_b0[M¹ÞŽ±ŒŒ¡2.-äüÎQq§ºGÔ-³"é ö¯{dgí»ñ¼«kož1¾s¶Žö"ŽÂñ[\ \}}¨ùJ Q· êHé,u®z‡iÔ¹YýF­B Qû­¨·«î# -dÿ=µ¦oÏÚGøÍgÓøvÔã/xu ºeGªNî œ›ÕŸ¡+ €Ãù‘a‡”ª)÷^CI…nR‘ÎXêÔóÒ¤r³v¦X†’ê˜BÏÒ±ñ¦8·—Ç]qÒêü±¤õc6ÃòNuž¨[n¤æ4Ürÿ:OvVo†:Ôۯ -õJ3zÊL¤°$%½]FïQ–Q¡’€Œ˜³¿—‹«fæ -q±¹m|ü¶ÂŸp`ö­ÙÄvR³ ,Ø|HñžÉ¤œùÚS´J²{ã¦îTQ{Ôc"%&¹©ý«1¹)½mÉPpܾ -Û’]Id#™)¤lœeÔŸ=³Û cygé·˜ œ%Ò¬•š\¯ÿïN˜&B³Qg{ÊÿŽÌ9Dendstream +xÚ½ZMoÛ8½ûWøhÌŠ¤$RÀb‘´Ý¶`w»‰±=´=8¶k»µ­¬ì´È¿_õEQäPð"EQD_f‡o†"GêË„D< ™’„Óñò0ŠÆÕòvD+D4žE„gÚþ}üW +s3*_þPÏ¡Y6>Œâ„“$æÕïûÑÝèïÆJÙS¶›Y˜ñˆH;1Û™H’Æ0/ç£ob:¦É¢l<ÿ¢ž(‰#>®AóÕÇɧˆŠéçùÍè·ycF)‘‰ÆzkLÏ#ML”NYÇãM¾ÒÉq:ãœOÞ‘òç|*ùd=ÑI¡NðtVOÅȽxÃ¥aUuV0¡x€¹_löL1KXÜe ŦBÜý¨Ñx?l›àøëvʲÉùJs]¦LNîDq΋M“HIª,b­1=&¾Û–€É¯¶»Z»L*ád`¨lQ(n]ÒiÑýXÁë݇©ÞÉ5ŒÜ¼Åüˆ'óíº|¸›–‘“{x*_~˜Ê¸êûò¯®Wªñ°;îNçbƒ¾Ë†*òéL…6ßÛä‘ ,af/û1eŒ0Ê!¸$Ê2½«¡‚â +i1ˆD*PP#ˆÃV$–G·J ÏS;\ƒå%mY¼¼bñkÊ¡MÅYM.^y0 =tah ½å°Æ€×÷ÐãÆ鼸ßéç3¼zꉇ§$æܤÓë|B ¸d™Z7ŠÀb°…mó Úöè´éñùë^‡w¸ð¡=°m^^ú°h6µÏæâ,~&Ÿ¼Y*ˆé@yh¯¼kŒþ8Ù=lÎsø<¶]W#û +bôû›;ø•‹ :vG0p>¹Î¼2*Mþ}íÅ\µeÃ"ŽˆsÄLˆÖ’–GwBBB˜¼$ÖÛæÿH$šmBX\Ü apñ&U¡ø¡³AÄR‚bA¶b±<ºÅbx¼ÙJuü±|óÇÍÖµ`úœÝ»àúËq‡ ²(Ñ8UÛ¦VÅa¹ºz¬?µÈüûYæ‡þ #<æhÄjL†µèZjaG–Êh 8»ÿ ¶%/˜>³wë‡ÂM%ITí-¨5ÆQPõòa]|Ñ+ýÁEêº6.'<ÂÛݱ¿¤¢‚pµš0hô5È•ºø°eœXÅ’ã‰QƒB‰aó'†íÑ™¦G²ÈmoÌ>eíÔŸý·…>­\»ŽSÕ|B¥ÿ85ÖW:¼‘ãÔèe?”ì—W«3\F!§rû|&0ÈÛÖoýbJ ECZ"zt¬BjZÁʨVMà–œAÔR‚jA¶j±<ºÕbx|þ9·Ã;<ç¢=°m^>çbÑlæ\›‹sÎ5¹xÅ%„>ÝD,((Äa+Ë£[,†ÇŸu9¬Ã>|; í‡móÒûaXD› b6ç 1“‰÷J¥$T½Ñ‚ý*Kˆþºöç]½Y³‰òùõ»WïÍÙš”¾âÍ£ÉsuU’MÞ>îVzçb‡)MHjÐvÜyˆH’Â5cµ&s_>Rÿy}Åòò‹ÎÆ7,’IÏW¼„sµð‘cžèCˆ‹´»\5 Tƒð™#§endstream endobj -3068 0 obj << +3134 0 obj << /Type /Page -/Contents 3069 0 R -/Resources 3067 0 R +/Contents 3135 0 R +/Resources 3133 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2869 0 R -/Annots [ 3072 0 R 3073 0 R 3074 0 R 3075 0 R 3076 0 R 3077 0 R 3078 0 R 3079 0 R 3080 0 R 3081 0 R 3082 0 R 3083 0 R 3084 0 R 3085 0 R 3086 0 R 3087 0 R 3088 0 R 3089 0 R 3090 0 R 3091 0 R 3092 0 R 3093 0 R 3094 0 R 3095 0 R 3096 0 R 3097 0 R 3098 0 R 3099 0 R 3100 0 R 3101 0 R 3102 0 R 3103 0 R 3104 0 R 3105 0 R ] +/Parent 3122 0 R +/Annots [ 3137 0 R 3138 0 R 3139 0 R 3140 0 R 3141 0 R 3142 0 R 3143 0 R 3144 0 R 3145 0 R 3146 0 R 3147 0 R 3148 0 R 3149 0 R 3150 0 R 3151 0 R 3152 0 R 3153 0 R 3154 0 R 3155 0 R 3156 0 R 3157 0 R 3158 0 R 3159 0 R 3160 0 R 3161 0 R 3162 0 R ] >> endobj -3072 0 obj << +3137 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [497.163 617.124 512.306 627.419] -/Subtype /Link -/A << /S /GoTo /D (part.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [205.528 752.53 277.612 764.219] +/Subtype/Link/A<> >> endobj -3073 0 obj << +3138 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 592.666 512.306 602.234] +/Rect [84.043 727.553 308.248 737.121] /Subtype /Link -/A << /S /GoTo /D (chapter.1) >> +/A << /S /GoTo /D (SWAT) >> >> endobj -3074 0 obj << +3139 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 579.116 512.306 588.139] -/Subtype /Link -/A << /S /GoTo /D (section.1.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [205.528 698.333 277.612 710.022] +/Subtype/Link/A<> >> endobj -3075 0 obj << +3140 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 565.567 512.306 574.59] +/Rect [84.043 673.356 184.278 682.924] /Subtype /Link -/A << /S /GoTo /D (section.1.2) >> +/A << /S /GoTo /D (diagnosis) >> >> endobj -3076 0 obj << +3141 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 552.018 512.306 561.041] -/Subtype /Link -/A << /S /GoTo /D (section.1.3) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [201.074 644.136 287.733 655.826] +/Subtype/Link/A<> >> endobj -3077 0 obj << +3142 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 538.469 512.306 547.492] -/Subtype /Link -/A << /S /GoTo /D (section.1.4) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [213.498 617.038 301.672 628.727] +/Subtype/Link/A<> >> endobj -3078 0 obj << +3143 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 524.92 512.306 533.942] +/Rect [84.043 589.939 271.763 601.629] /Subtype /Link -/A << /S /GoTo /D (section.1.5) >> +/A << /S /GoTo /D (problems) >> >> endobj -3079 0 obj << +3144 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 511.37 512.306 520.393] -/Subtype /Link -/A << /S /GoTo /D (section.1.6) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [227.149 562.235 308.384 575.137] +/Subtype/Link/A<> >> endobj -3080 0 obj << +3145 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 486.912 512.306 496.48] -/Subtype /Link -/A << /S /GoTo /D (chapter.2) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [213.498 535.743 301.672 547.432] +/Subtype/Link/A<> >> endobj -3081 0 obj << +3146 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 473.363 512.306 482.386] -/Subtype /Link -/A << /S /GoTo /D (section.2.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [192.225 508.644 292.187 520.334] +/Subtype/Link/A<> >> endobj -3082 0 obj << +3147 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 459.814 512.306 468.837] +/Rect [84.043 481.546 160.975 493.114] /Subtype /Link -/A << /S /GoTo /D (section.2.2) >> +/A << /S /GoTo /D (bugreport) >> >> endobj -3083 0 obj << +3148 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 446.265 512.306 455.287] -/Subtype /Link -/A << /S /GoTo /D (subsection.2.2.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [213.498 454.447 301.672 466.137] +/Subtype/Link/A<> >> endobj -3084 0 obj << +3149 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 432.715 512.306 441.738] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.2.2.1.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [201.074 427.349 287.733 439.039] +/Subtype/Link/A<> >> endobj -3085 0 obj << +3150 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 419.166 512.306 428.189] +/Rect [84.043 400.251 196.036 411.94] /Subtype /Link -/A << /S /GoTo /D (subsection.2.2.2) >> +/A << /S /GoTo /D (compiling) >> >> endobj -3086 0 obj << +3151 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 405.617 512.306 414.64] -/Subtype /Link -/A << /S /GoTo /D (section.2.3) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [213.498 373.152 301.672 384.842] +/Subtype/Link/A<> >> endobj -3087 0 obj << +3152 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 392.068 512.306 401.091] -/Subtype /Link -/A << /S /GoTo /D (section.2.4) >> ->> endobj -3088 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 364.969 512.306 373.992] -/Subtype /Link -/A << /S /GoTo /D (section.2.5) >> ->> endobj -3089 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 351.42 512.306 360.443] -/Subtype /Link -/A << /S /GoTo /D (section.2.6) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [201.074 346.054 287.733 357.743] +/Subtype/Link/A<> >> endobj -3090 0 obj << +3153 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 337.871 512.306 346.894] +/Rect [84.043 318.955 137.43 330.645] /Subtype /Link -/A << /S /GoTo /D (section.2.7) >> +/A << /S /GoTo /D (Portability) >> >> endobj -3091 0 obj << +3154 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 324.322 512.306 333.345] -/Subtype /Link -/A << /S /GoTo /D (subsection.2.7.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [213.498 291.857 301.672 303.547] +/Subtype/Link/A<> >> endobj -3092 0 obj << +3155 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 283.674 512.306 292.697] +/Rect [84.043 266.88 229.915 276.448] /Subtype /Link -/A << /S /GoTo /D (subsection.2.7.2) >> +/A << /S /GoTo /D (Other-Clients) >> >> endobj -3093 0 obj << +3156 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 259.216 512.306 268.784] -/Subtype /Link -/A << /S /GoTo /D (chapter.3) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [213.498 237.66 301.672 249.35] +/Subtype/Link/A<> >> endobj -3094 0 obj << +3157 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 245.667 512.306 254.689] -/Subtype /Link -/A << /S /GoTo /D (section.3.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [202.528 209.956 290.339 222.857] +/Subtype/Link/A<> >> endobj -3095 0 obj << +3158 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [497.163 207.173 512.306 217.468] +/Rect [84.043 183.464 218.369 195.153] /Subtype /Link -/A << /S /GoTo /D (part.2) >> +/A << /S /GoTo /D (speed) >> >> endobj -3096 0 obj << +3159 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 182.715 512.306 192.283] -/Subtype /Link -/A << /S /GoTo /D (chapter.4) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [193.619 156.365 302.097 168.055] +/Subtype/Link/A<> >> endobj -3097 0 obj << +3160 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 169.166 512.306 178.189] -/Subtype /Link -/A << /S /GoTo /D (section.4.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [213.498 129.267 301.672 140.956] +/Subtype/Link/A<> >> endobj -3098 0 obj << +3161 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 155.617 512.306 164.64] -/Subtype /Link -/A << /S /GoTo /D (section.4.2) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [205.528 102.168 277.612 113.858] +/Subtype/Link/A<> >> endobj -3099 0 obj << +3162 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 142.068 512.306 151.09] +/Rect [84.043 75.07 266.596 86.759] /Subtype /Link -/A << /S /GoTo /D (section.4.3) >> +/A << /S /GoTo /D (DNSDHCP) >> >> endobj -3100 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 128.518 512.306 137.541] -/Subtype /Link -/A << /S /GoTo /D (subsection.4.3.1) >> +3136 0 obj << +/D [3134 0 R /XYZ 85.039 786.531 null] >> endobj -3101 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 114.969 512.306 123.992] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.4.3.1.1) >> +3133 0 obj << +/Font << /F41 2994 0 R /F15 2972 0 R /F38 2997 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -3102 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 101.42 512.306 110.443] -/Subtype /Link -/A << /S /GoTo /D (subsection.4.3.2) >> +3174 0 obj << +/Length 502 +/Filter /FlateDecode +>> +stream +xÚ”ÍnÛ0„ïz +©ƒ6\.)’@Qâ¾ÅzIsp×IG©ì ¯R¶(Y +D{³³ËB&üƒÌj䘱9hBv¿KÛúÊ·[…`™r6Ôþ&·w‚=xÍ2iþüçÏÐ9¶K”&ЊÚß/Éä¦wijŠõVq›¬Sd$ÀZ5©iÓfFkÈ• š«"¹X(d(À ÇŠ?þ„ ±NT<Üò_MzW,“ë¢wC‘ƒÕ–˜všQGÔ§Q¡t\–)ò×4#"þšw‘Zâ›4C^ùâÛ>œþT­C¸‹ÙW?¬‘Æçv_âôÒ'ÓR Ó‡Bµm«“9:õü±ghüü˜JÇ—uÖõ.•–ÿ^ƒÏ\VÛQ&“Cîç6ÚiFI³ÇN!É׸]Ç®´ŒšŠß@sXM¡sT9†®‹Ô*þ^Âm¶7W_åjSo¤|×w_Wö# 6S{Ž‘ö+7yØ çæ©`ëO o4Ÿ2ß[Í ?l7Mü±Ýró²,¨eþgÍ|õZ¦~F^>=O îrwuT œ„>Oz+ž9Öœã#¿ÜÒÍyÒIÈýµÍ챓ÄAƒG>s˜“E4ý…Fêøúÿ/t™²à¬œ^œ&”¶ òº8¯&O»¥‰À&VÍendstream +endobj +3173 0 obj << +/Type /Page +/Contents 3174 0 R +/Resources 3172 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3122 0 R +/Annots [ 3176 0 R 3177 0 R 3178 0 R ] >> endobj -3103 0 obj << +3176 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 87.871 512.306 96.894] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.4.3.2.1) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [205.528 752.53 277.612 764.219] +/Subtype/Link/A<> >> endobj -3104 0 obj << +3177 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 74.322 512.306 83.344] +/Rect [84.043 727.553 172.611 737.121] /Subtype /Link -/A << /S /GoTo /D (subsection.4.3.3) >> +/A << /S /GoTo /D (Further-Resources) >> >> endobj -3105 0 obj << +3178 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 60.772 512.306 69.795] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.4.3.3.1) >> ->> endobj -3070 0 obj << -/D [3068 0 R /XYZ 85.039 786.531 null] +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [213.498 698.333 301.672 710.022] +/Subtype/Link/A<> >> endobj -3071 0 obj << -/D [3068 0 R /XYZ 85.039 656.613 null] +3175 0 obj << +/D [3173 0 R /XYZ 85.039 786.531 null] >> endobj -3067 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R >> +3172 0 obj << +/Font << /F41 2994 0 R /F15 2972 0 R /F38 2997 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3108 0 obj << -/Length 3504 +3182 0 obj << +/Length 2685 /Filter /FlateDecode >> stream -xÚíœësÛ6À¿û¯Ðdn¦ÒL…O’Ÿ:±ã^Ók:¹Ú½ÜMÛŒ¤Ø¼èáJtü÷‡Çâ!Q‹”“¸™k¦#âÀþ°Àb±4úU’¼••"’ÓÑluRŒ®ô/?¡pÇn™&÷œ^ž|õ#Zº¨G—¯Âsê‚ÈZ.ç?Ï6ë «ÆÝÂ}ì&¿^~wr~œTM97ýíäç_‹Ñ\7ồ‚ðºÝéï¡u=Zɉ®—''ÿ Ïr¿‰‘“:Ö É+"+Þï•I7¨~N©ÊQ)%Q¢´ý„A&ÓJ©ñã'“)ç||1¡ãÅdJdzÛm«¿w¦oÍobüL_o&S]0_¸»)dñÓÎܾغ’ï­ðïFj±„G.f¦ìVKo[÷<-G'S©ª±®_ú!êzÐo(t! Ýî)p{5r_~LU -RÓD¬¯ÒÃg•rÕk¥„m@Ÿ¤»5_+­*¢J5*#… H:¦ZuUÏßè‹fe´~£¿-ŽŸ¸¿Tè’«Û­¹£kõPž–%û3ªþ@¤ _CIE± ©Dg¼ÄHõ€“ÊÕLŽiu %Áä.[g&[ÔLR#³vŒÌIš¢eßnõ×=;ãR~R¤ €¡H£Xi¢\i¿8Ò\­Áøti‚óó0<ݧ¡„œH†è‰W™ýJq*XM”‘‚ᡘE­B[T³ZZ£ØíˆfI[Ï7Æ8î ì‡…µ•» +ÇCçµ+ª—÷Z¯òFþ*¡V=(j®ßCÁ© »¨Q_¯vœ`¦JQU¥.¢@Qųµ§•Ñ½™éÎ͹µ¤ AÊÞC«ï åžÄðö*<ɧêç5‚üHPæÙZýò¨J=‹J SX_\[“s¶¸j^ÛLöBO±úòeãFD¥ZàüÇ ¥tü/3H~üz2UºüÁ«ïêPxQ,/Q#¯ß^®ÖO¤*x€Çþ4¼'foa ½i­¡³ñ™¹Ú¸Yx»Y.[ ”+þ±hA߆ҊbZ©Þ -ŒV¿8­\­–( “"Ðâ÷Ië™](ÝÍzX:oÔ Œ}d;ƒ~%Å2äR¢äú ÀÉåj ä¸þ,"9¿m׎å®k\b Û…ï7»v}å¾ëß×ac`Ý·hj„ÝÆÝòÜ7v¿‹>ÐÜïIâEd,oèÊP8Q,'U -§ß€^1¢—ŽÑ”ioR¼x¯eªŠš0¡BÓX‘¤LWÊFþ&Ó4ãÙ(íÙ<Ù¬œù¨ROvf®ë¬Íl–‡M×úµM5et7çÛuðD«1Ši,>¨§Áa¥¹Ì…Ø›rÔý“µ$ª.AEÜ¿o&•p¸éìÞØÏLÍé©ý5ŒsØiuú¶ºfŸ›è•4Ð|1Ü|Rè`8ÒtnËÖ°k[£¢ì °Ÿº)©íÍ+;ØŒ›ÝìÌg&,m3ZŽ~€ACG± àDÕ‚c€û Àçjõ‹—T‘u{ÿ(JÍÑÅMB°ëÒF²n¢O¡GD)ù}ãø@4¡ïCiF± ÍD¯8Í~pš¹ZM©çtiz—ÿùÖOÀ&òÕl[3!_9ã}e t›1`c½´ êáñƒÞåÅ2üM -ñë7ç—«5L·‚ ô8L¶(S0…°Ë›fu³tŒ{1ͦk­ÿbbšåCÀf;9šÊ ÊØIO¯j^_€ÅJRK -¸B\sOÎîrkcÅÕ_r5 EÅ20å -,Äy¤8Ð\­)Õ[Š‚RyÄ›uÜ€ý`gT ®ô,úÚïò®6õ1Kdá»CF± ÀD•8À~p€¹Zèk¯$¹3öL¡Ä‘…Ó:cž¿·33§Vâá­~ÐÕ¡ð¢X^¢F^¿8¼\­þäNT%áżÏâôÎ÷k ©D '•ê %u¤(©l­T©Í mR—׋ó¿±))‹YÛ€ÇbÇÍn±¿s4Ù+°P¾°Îéþ1à¿Ÿ»ß¾Ý¬@ð|nÒ-l®rʇ¦U~Ë(?QƒÀâúG€+?WkP¾*+ä¾òù{(ÿ…QåznˆÌÄJ¯ß¸Ÿ¿DfN,XuŸ†=Ê&ŠeØ$ZÂÙô€³ÉÕê×!QR6,ä“Ä”­Ò玦l‰=ïâY³ë|úÉ©_ŽPXž4*UÑO:¹A‡2Œb†©6±ñ‘à sµz'PpNháC -9é~n›—Kï,¬ö#Ÿl|¾µÀ¶&Ô)ÕòÌ?SÐÀP¦Q,Ã4Õ.Ç<Òœi®Ö`—´&RF¦Þ/|ê`Úä.k|ëMçŠÚõliBÚÁ4]ñûÂÿžºññª™Ó¼¶9, ²‹›:Ë…:;_ËàK‰âë7Ç—«5à+)Š*àc ¾’¯`#f/:»©ž»‹Gÿ1'›[wÕ,·‹fnf_í^7ÆÃð¹z¼tˆõ]³Þ¹œ½ßžÉ™çÛ¶´;zwÈj³òÈhdÄ…íÀ”òÿf#lT7è,fúú¿¦µv,é‹ùÞÉ-iŠK]#Dv¨϶‹9ä6ëU}çäv>7ñƺÆíbîÊgÖ9–fyŸy éâ»ÖèèÚ6µØkeƒzñ¦Ýuá Ò-7íâ#7´ï®½†@B·«‰Þ(lWf¦µ×í:†§ºí­[»\“ŒÀÌ6pcÊ]ïŒ?Ãèò¼¬H=8¥ð÷dÇ{¿vt¸çªô£+I¸¢a´ûT€àÛíÞî:8Ñß›¾ì…ѳŸÄ–ò¾µ›Ý[·2ù%Ì䮞ú?Z›œš„TÇÆ+ùp”ïàP\Q,Ã+U -¬ßœX®Ö€Lk®¢™ØCVÅõÁºÚ¶Œ3ØuîkcÎ6·.£ÆɄȼ¹÷ºÝ¹oÎPV7ÆTºp£X´Ýu ]Ø¢yð0ýáŒy.Œd¦²¶p?Û˜™ÖGhñÂ%'´ÑÒ=çEõ0Ït±ñÈ+ÂÔà8X"–p“ ýàã1WkL’ò0ešMäçmÆ ³‚š¦ƒ å¦sfµ3Ÿzi×i5“»¹LÝæro5tE¯¶¦,ùáR|õ‚ýy>"·ëH‡ù²}Ý‹Ë|²Ä„b]Ë•÷Õ\’“]M|æT’³Ÿ[埗äEÙ.ÀJ6owMÛÆžðQ¤Q58ÒˆeFÜ”Eýà£(W«E¬.‰¢2Œ"£è'p@&ö ¡]”Æ}¼ZÜ™/ÕxÕÚ[ܵseÍ«.™žÌíÎAÖz9¡þ×ÍÎ}qþA³ óÜÜÁ+7 ,- f3kB=W‹Î=Àxj‡CÍufas”-àGøÁÌÒo¿Zƒ¯¨÷qM»l^†cpãò“LZ¬¤Pƒƒ'‰>ÜüMÙáv¤ï—«ÅdMT²“;š«åo2MS«uÚÌ^ßÞ¸\-‹ÓÍA6uk³Ö4§öœíxÞVRëÈÛʶñà‰V{ØÙò 4okÊeù÷#™,‰¨ÞÑ`BoŸd:{gòÖãw'o•â³KÞòJjOQ,cO |Dô€NßÙZvΈ,jÀî“·Îw;?gÂî£Ã§~»VŽ_›•­Y!C<òéÚù£+8b©UñЉBÿ‡b¢‰n%–r¤8Ñ\­aA¦z÷¨PÅzv‘ äk· N6Ý‹‡I¢š\RÕ+•ú4RÊ0ŠÚÂõjÇ eªôg3¬DÐÐ;O0M ùÉYö4S}*Ãõf(š •Aõ$%†¦W;Ž&S¥·Zë-ºŠl| ññ¬kCИD»Ñ¿Íöí»Ówøû%<Þ/3ßÍÐ1œZªBÛ‘ Ü²µpee=?îè›1¿éï·Í²ó áŽäµ˜#íNôó}`Ì…xM,mïõS³(~}„ ?C E± ¡DW8¡~pB¹Z!%ô'„|ôë[wˆïô$á¼°aú¸õ‡ø¤eé½Ñ|Oû°æìpÓ¦Õ¢|?FУ¡Œ¢X†Q¢-‰e*iÎ(W«w©¤„QŒxÈäwîÞ­Ë€™. äxË4Âx˜ß–¼‡]ɇ0BŸ‡RŒbŠ‰>qŠýàsµKã%Q*Rôà°ì¨ºâ©óhßë¡£X†c¢Qœc¿8Ç\­Á™ "k*äÿÿmú:¨h(ô(–ž¨_b™äHpè¹Zƒñê"©T€¶oGŽHûÑÚ4¥îí_x‘NjoZûGiì_ºÂ;sCôŽ!š>ßèu²¤â>‘A‡"‹bd‰òpdýàÈrµzduI -Zb~ÏpæuyíÿÒû7‰ks#*·7ïÚLWÔ½,´°‡þäìkLÿÐÚêR¸ö= Êï׎ê>W¥W}ʼnPUP=Ïø”ÉÑvq³4áF|çL¾ƒ?<7;7º›ïù›.²¯ƒÉê“,wÐó£Ž1Ñ)Š±_;Š1Wex;¾&5Å¡== ÉýQ·üËIøZwþd®»†Œý'f <~nþîD]>T׺?ô…ú •yŸ>*Vb‰ßýÚñ³®áTòØaƒþŸû¿»õçÿZb8²©+lk’ùX5â’î¶Hýq -TîIü?›ºfendstream +xÚí[KsÛF¾ëW°rYðÀỸÁ^¶,ÇÎ:e³]>$9À%qC + ÙÑ¿ßîyC‚hʦ"[Š€y4ûûº§{z†ORøÇ'&c©,&¹Ñ,“|r±>I'×ðå›î[¨L²L)x>ðq¾Î´`©Ê¶ñsÌr¡˜2 +ÛœÎOþþZ¤‘2­åd~Ñ H*Ìd~ùSò²®šEÕl§¿Ì¿=y5o M•d©V‡¦œ3JÃT! +ÅSÍLf@ðT±,ç±Tœ³"Ëb©|”ê ›Î87&ùfIµØ”«éLj¼©¶ <ódU6˺Ú;SRL¢ ݧÍõÄ=üÉZÓòí‰ +Ý›ôÏ<äA˜¹f4=CAg‡õÉ™J%nRƹܑ7eEZDú mP\úÔJöšM ŠäÉåÝ…ÕŸUjƒïtžœ—ë÷e_¥Úþ°hNR¥®5-âþ˜V¥ùJ£¡Æ©´µŠ}ax ´šiJ…¡ÊrPÙiy1yòëõHW#ïࡺœÎåeiÚÿŸ*Š}ûk»ÿ±¡{¼É™ÎU«Ö>üq½fQ·>dûc‚?} zL méy[ªëR®eüW=•iòÑ%ˆ!Q|ƒ)’j ûä¼Ä´¿Ï§¸¨mã^ŸcËg§/†RËH¶cRKò§ìiµÌµÜ õÀÔr_˜ÃªSÓë5d–ÿ~o•·¬ÐP«k :Âò +æÛ Ý®Vöŵ‹¶å“R Ü7æ/Ê ÞÆZaÛ‹0‚½é‡=55iK•3¡BÚø²®~†|ѽÛÄ\°è#Ò&y_ºW?§Yj_»· ZÛt¡Fr\Áx›plü¥{h¯Ë±Üèºäˆp"ØÑ—€ 5/Ÿ¥ +˜WJ–sÑò=…úê÷©%1àjá¼ÀqlNiwô +#ÿrÐþ$̽~ÆbÞu#0tO`Þ—€Àœš—kïDʸÞÁœÛýÚÂ~GɯÖÜ£Ý×·ýë¢c€£„ÿ+0äã²¹Á'‘¸í†ms["SÖ˜=<&cöJ l×6R°ƒÀö% €¥æm9ÕL‡½mæÜ=óù»)ç"yÐο¤PúO¢†WãXjtÝjDÔèK@Pƒš7IJpU5G ooîec²¶t†‡Í·ìí5dgÕ>tÄðÃ4ƒ8|is½÷Á Ø:8ç²B óYÀ+k,ºn" ô% @ÍÛ öÛ ½w76Æwè½¹rˆÎñ岺޺×_#ÞÕß|°ønjÀùo~ý'  ù—åA×àA„Áƒ¾¨y[@kã7”ËÛý› ®Ýª.“Whñ›zãö‹$Ä–Ï[º‡â•9– ]7‚ PAú¡æ 9†“~+ 6 ¾+7×> +°îýÎmMg>ÆCÚÔWQü×~ÏCIúvãJŽv{É¥ Ûmæ¦øS‰ ­± èº ˆj} Pó¶ àœåºh²Ì¯ê[ Ÿ_â÷äáEÊD×føíä§_ÒÉ%ˆóíIÊda&áÒÜ¢˜¬O$¹ô­NÎOþÜP³h¬ÒBœq±#m}»r'ª€yîˆÕ¾”B(–üÿ1ÃX´œB–*½#çò¶³ƒ÷¥N^c(æ’¬pŠCå…­Ž(Èž®{ˆ nå®\»·_ÿà¬U3³@ûô¯À£ÛVå% s¹ñ6è>òþË1Ö³lŸÌ4¤ +~Çš…üÕƆ‚ÞÜ?âØ¥^–UUû ¡ÜÚ1˼ö+ÊfñÛßuZ\~„âòó°pQ&Fo#u½†íÛ·¡Í»?ý°uS“ãF±hù—Á¶ç7­s÷ l] 1„{Ī\ûVeåò÷Á/]ºPßág:çÅcGØ©d,Âm/áNÙ½éé¢ì'Îñ + Î3Ú!>T” m¬`¾(ûk²¥-¾ú“»M‰¯6þÏ«z*Ým‘ –1x~z}[6ËEÕ Õb#‘Ž©Å’¿`Lû²AÝvC Œ NdE>¼øD%N(íÅ[¥†Šì÷5n“g¦øœ‚åÇkõŽ5Ó®a§1tÃdêKpÀRa•ÙqWDjÏÉ ¾‰½ÀÖ–Úk ÖõsŒ¹yòaá-ò¥ÍÒm­ff‹we8‹Ÿ'§å—â‹íÐÕ†Ncn6Pbïh:x¯¡ˆ2NˆYÉ» `¾RÑ>‘¬šqÒ'†6(²ò>q_Éói!’û[{Ûƒ™*ç‹‹»M{t÷îÙ Ùð†Äb;ä##ñ‘ä/ÚÓ¢0x”=êøHn8ûÔ™žwu3ÕºÈ׸¥dCŽ²±E„ +D8¼rêÓøª$ži. +ñtÝbPéH·uv‹1\òeNrÞ–&YWCSí™–ó¨ d·)1½¹Ÿâù|âéöL?¯¡Y²>£nY"Ðäà­ˆdÉŽ(|rÕU×T[ø<ß=ãtîn@Xï²´‰/zœµé4úfÈŸ2;Ôƒj Q7‚J;Ôˆ(9oHw¹èêmÈŽ°›ùÖm¢ÒHMŒUw1î3VÝÖ Ç੉jãÞÈ4žýé‰ Í¤¤=uØ ’¸8µÉÆÉôÄ·±× ÓáÓ/a ý9ÿ4477endstream endobj -3107 0 obj << +3181 0 obj << /Type /Page -/Contents 3108 0 R -/Resources 3106 0 R +/Contents 3182 0 R +/Resources 3180 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3158 0 R -/Annots [ 3113 0 R 3114 0 R 3115 0 R 3116 0 R 3117 0 R 3118 0 R 3119 0 R 3120 0 R 3121 0 R 3122 0 R 3123 0 R 3124 0 R 3125 0 R 3126 0 R 3127 0 R 3128 0 R 3129 0 R 3130 0 R 3131 0 R 3132 0 R 3133 0 R 3134 0 R 3135 0 R 3136 0 R 3137 0 R 3138 0 R 3139 0 R 3140 0 R 3141 0 R 3142 0 R 3143 0 R 3144 0 R 3145 0 R 3146 0 R 3147 0 R 3148 0 R 3149 0 R 3150 0 R 3151 0 R 3152 0 R 3153 0 R 3154 0 R 3155 0 R 3156 0 R 3157 0 R ] +/Parent 3122 0 R +/Annots [ 3185 0 R 3186 0 R 3187 0 R 3188 0 R 3189 0 R 3190 0 R 3191 0 R 3192 0 R 3193 0 R 3194 0 R 3195 0 R 3196 0 R 3197 0 R 3198 0 R 3199 0 R 3200 0 R 3201 0 R 3202 0 R 3203 0 R 3204 0 R 3205 0 R 3206 0 R 3207 0 R 3208 0 R 3209 0 R 3210 0 R 3211 0 R 3212 0 R 3213 0 R 3214 0 R 3215 0 R 3216 0 R 3217 0 R 3218 0 R 3219 0 R ] >> endobj -3113 0 obj << +3185 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 754.651 512.306 763.674] +/Rect [524.436 603.575 539.579 613.869] /Subtype /Link -/A << /S /GoTo /D (subsection.4.3.4) >> +/A << /S /GoTo /D (part.1) >> >> endobj -3114 0 obj << +3186 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 741.102 512.306 750.125] +/Rect [525.586 579.116 539.579 588.685] /Subtype /Link -/A << /S /GoTo /D (subsubsection.4.3.4.1) >> +/A << /S /GoTo /D (chapter.1) >> >> endobj -3115 0 obj << +3187 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 727.553 512.306 736.575] +/Rect [526.677 565.567 539.579 574.59] /Subtype /Link -/A << /S /GoTo /D (subsection.4.3.5) >> +/A << /S /GoTo /D (section.1.1) >> >> endobj -3116 0 obj << +3188 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 714.003 512.306 723.026] +/Rect [526.677 552.018 539.579 561.041] /Subtype /Link -/A << /S /GoTo /D (subsubsection.4.3.5.1) >> +/A << /S /GoTo /D (section.1.2) >> >> endobj -3117 0 obj << +3189 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 700.454 512.306 709.477] +/Rect [526.677 538.469 539.579 547.492] /Subtype /Link -/A << /S /GoTo /D (section.4.4) >> +/A << /S /GoTo /D (section.1.3) >> >> endobj -3118 0 obj << +3190 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 686.905 512.306 695.928] +/Rect [526.677 524.92 539.579 533.942] /Subtype /Link -/A << /S /GoTo /D (section.4.5) >> +/A << /S /GoTo /D (section.1.4) >> >> endobj -3119 0 obj << +3191 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 673.356 512.306 682.379] +/Rect [526.677 511.37 539.579 520.393] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.1) >> +/A << /S /GoTo /D (section.1.5) >> >> endobj -3120 0 obj << +3192 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 659.807 512.306 668.829] +/Rect [526.677 497.821 539.579 506.844] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.2) >> +/A << /S /GoTo /D (section.1.6) >> >> endobj -3121 0 obj << +3193 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 646.257 512.306 655.28] +/Rect [525.586 473.363 539.579 482.931] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.3) >> +/A << /S /GoTo /D (chapter.2) >> >> endobj -3122 0 obj << +3194 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 632.708 512.306 641.731] +/Rect [526.677 459.814 539.579 468.837] /Subtype /Link -/A << /S /GoTo /D (subsection.4.5.4) >> +/A << /S /GoTo /D (section.2.1) >> >> endobj -3123 0 obj << +3195 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 608.25 512.306 617.818] +/Rect [526.677 446.265 539.579 455.287] /Subtype /Link -/A << /S /GoTo /D (chapter.5) >> +/A << /S /GoTo /D (section.2.2) >> >> endobj -3124 0 obj << +3196 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 594.701 512.306 603.724] +/Rect [526.677 432.715 539.579 441.738] /Subtype /Link -/A << /S /GoTo /D (section.5.1) >> +/A << /S /GoTo /D (subsection.2.2.1) >> >> endobj -3125 0 obj << +3197 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 581.151 512.306 590.174] +/Rect [526.677 419.166 539.579 428.189] /Subtype /Link -/A << /S /GoTo /D (section.5.2) >> +/A << /S /GoTo /D (subsubsection.2.2.1.1) >> >> endobj -3126 0 obj << +3198 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 567.602 512.306 576.625] +/Rect [526.677 405.617 539.579 414.64] /Subtype /Link -/A << /S /GoTo /D (subsection.5.2.1) >> +/A << /S /GoTo /D (subsection.2.2.2) >> >> endobj -3127 0 obj << +3199 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 554.053 512.306 563.076] +/Rect [526.677 392.068 539.579 401.091] /Subtype /Link -/A << /S /GoTo /D (subsection.5.2.2) >> +/A << /S /GoTo /D (section.2.3) >> >> endobj -3128 0 obj << +3200 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 540.504 512.306 549.527] +/Rect [526.677 378.519 539.579 387.541] /Subtype /Link -/A << /S /GoTo /D (section.5.3) >> +/A << /S /GoTo /D (section.2.4) >> >> endobj -3129 0 obj << +3201 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 526.955 512.306 535.978] +/Rect [526.677 364.969 539.579 373.992] /Subtype /Link -/A << /S /GoTo /D (section.5.4) >> +/A << /S /GoTo /D (section.2.5) >> >> endobj -3130 0 obj << +3202 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 513.406 512.306 522.428] +/Rect [526.677 351.42 539.579 360.443] /Subtype /Link -/A << /S /GoTo /D (section.5.5) >> +/A << /S /GoTo /D (section.2.6) >> >> endobj -3131 0 obj << +3203 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 499.856 512.306 508.879] +/Rect [526.677 337.871 539.579 346.894] /Subtype /Link -/A << /S /GoTo /D (subsection.5.5.1) >> +/A << /S /GoTo /D (section.2.7) >> >> endobj -3132 0 obj << +3204 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 486.307 512.306 495.33] +/Rect [526.677 324.322 539.579 333.345] /Subtype /Link -/A << /S /GoTo /D (subsubsection.5.5.1.1) >> +/A << /S /GoTo /D (subsection.2.7.1) >> >> endobj -3133 0 obj << +3205 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 472.758 512.306 481.781] +/Rect [526.677 297.223 539.579 306.246] /Subtype /Link -/A << /S /GoTo /D (subsubsection.5.5.1.2) >> +/A << /S /GoTo /D (subsection.2.7.2) >> >> endobj -3134 0 obj << +3206 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 459.209 512.306 468.232] +/Rect [526.677 283.674 539.579 292.697] /Subtype /Link -/A << /S /GoTo /D (subsubsection.5.5.1.3) >> +/A << /S /GoTo /D (subsection.2.7.3) >> >> endobj -3135 0 obj << +3207 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 445.66 512.306 454.682] +/Rect [525.586 259.216 539.579 268.784] /Subtype /Link -/A << /S /GoTo /D (subsection.5.5.2) >> +/A << /S /GoTo /D (chapter.3) >> >> endobj -3136 0 obj << +3208 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 432.11 512.306 441.133] +/Rect [526.677 245.667 539.579 254.689] /Subtype /Link -/A << /S /GoTo /D (section.5.6) >> +/A << /S /GoTo /D (section.3.1) >> >> endobj -3137 0 obj << +3209 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 418.561 512.306 427.584] +/Rect [524.436 207.173 539.579 217.468] /Subtype /Link -/A << /S /GoTo /D (subsection.5.6.1) >> +/A << /S /GoTo /D (part.2) >> >> endobj -3138 0 obj << +3210 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 377.914 512.306 386.936] +/Rect [525.586 182.715 539.579 192.283] /Subtype /Link -/A << /S /GoTo /D (subsection.5.6.2) >> +/A << /S /GoTo /D (chapter.4) >> >> endobj -3139 0 obj << +3211 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 364.364 512.306 373.387] +/Rect [526.677 169.166 539.579 178.189] /Subtype /Link -/A << /S /GoTo /D (subsection.5.6.3) >> +/A << /S /GoTo /D (section.4.1) >> >> endobj -3140 0 obj << +3212 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 337.266 512.306 346.289] +/Rect [526.677 155.617 539.579 164.64] /Subtype /Link -/A << /S /GoTo /D (subsection.5.6.4) >> +/A << /S /GoTo /D (section.4.2) >> >> endobj -3141 0 obj << +3213 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 310.168 512.306 319.19] +/Rect [526.677 142.068 539.579 151.09] /Subtype /Link -/A << /S /GoTo /D (subsection.5.6.5) >> +/A << /S /GoTo /D (section.4.3) >> >> endobj -3142 0 obj << +3214 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 283.069 512.306 292.092] +/Rect [526.677 128.518 539.579 137.541] /Subtype /Link -/A << /S /GoTo /D (subsection.5.6.6) >> +/A << /S /GoTo /D (subsection.4.3.1) >> >> endobj -3143 0 obj << +3215 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 258.611 512.306 268.179] +/Rect [526.677 114.969 539.579 123.992] /Subtype /Link -/A << /S /GoTo /D (chapter.6) >> +/A << /S /GoTo /D (subsubsection.4.3.1.1) >> >> endobj -3144 0 obj << +3216 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 245.062 512.306 254.084] +/Rect [526.677 101.42 539.579 110.443] /Subtype /Link -/A << /S /GoTo /D (section.6.1) >> +/A << /S /GoTo /D (subsection.4.3.2) >> >> endobj -3145 0 obj << +3217 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 231.512 512.306 240.535] +/Rect [526.677 87.871 539.579 96.894] /Subtype /Link -/A << /S /GoTo /D (section.6.2) >> +/A << /S /GoTo /D (subsubsection.4.3.2.1) >> >> endobj -3146 0 obj << +3218 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 217.963 512.306 226.986] +/Rect [526.677 74.322 539.579 83.344] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.1) >> +/A << /S /GoTo /D (subsection.4.3.3) >> >> endobj -3147 0 obj << +3219 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 204.414 512.306 213.437] +/Rect [526.677 60.772 539.579 69.795] /Subtype /Link -/A << /S /GoTo /D (subsubsection.6.2.1.1) >> +/A << /S /GoTo /D (subsubsection.4.3.3.1) >> >> endobj -3148 0 obj << +3183 0 obj << +/D [3181 0 R /XYZ 85.039 786.531 null] +>> endobj +3184 0 obj << +/D [3181 0 R /XYZ 85.039 643.064 null] +>> endobj +3180 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3222 0 obj << +/Length 3145 +/Filter /FlateDecode +>> +stream +xÚíœYs7€ßõ+ø°U!«–È`pÌÌ“Ë:²±+vi-%NU’‡1E[\óPHÊÇ¿_ƒœA+°bK²S[Yó˜fcúënÑA¡þGµ kU-‰`t0Yƒ7ê›ÿP¸b —Œ£kϾÿAÈ-HS4ƒó×þwš‚ˆFÎ/~­–£²n§öŸÍèó§'çþ‡#Õ”1ý³üöG1¸PCxzPÖÔƒ÷êuAhÓ \0"8ƒ÷󃳃ÿúß²ßñ•ê» Áj"jÖ½ *¢Û ¥$¼áƒJ"yeîƒF8k)‡ÏFcÆØðlD‡Óј'×ë™z½Õ÷øQLJÏÔûÕh¬>¸˜Ú«/DñóF_>]ÛO~2Âï´Ôt?9èÏ®•ôzfOÉÑÑXÈz¨ô‹¢HþÛ擾»ù’=h¢¬ˆ¬‚:¦^¿Ø/bãƒÔ8ëÿ·ñig²gtL/•”ðBý"/I¡Ü'‚N‡TY¢©›áÉõ¦]hBWêÕ|jY+'ÿ½ \}òæz­¯ØΔ۫ªü¼X>U°@.Õ †P­›¦ÚBÓëC¹TWóÆSÊgÓµ ¿u2üâà5ñêƒ×JêæÝ| ^îÄ/âàSåâbþC™Äß‚ÓëƒZ}¡ÿÖZÝ}.M+‚teIŠ»Z‚)]´zú_POÂçÃS[íÆ̧ïõëÕúÂFáD¿»T\V÷³¥†¨Djv?™Ý;Xsæz„—Bœ"•ö‹ŽzÄ5¥Î;d]©(¸‡÷8Z™ ^è°ÕNq¢3úz¥ƒY¹ £åÝý¾áŒ™é‘XÚ;v@ñ”{ôŒ í¨^7÷+Ý„‰Ò;…¹ÿå¥Éì6ã/Ú·f6ßØ·gjNPo_µÖ{ZøT œ¼QJ‡¿h‡zñh4–êó8'8£ä‚bèØà" º;4¦×ƒ–©UFp ËO}¬7o&´3“@Êá‘~§7³Íp»^ÍçÓµ‚Ï$»dÁ +¹dƒB6¶pšlwYL¯'Ë+R +îɲ¿“ì3³d·› »AËËòÞÆ.X#—pCÇ–NîŽ!Œéõ„#U»Z‹Z‰o¶­-Ía/öÓj3[¾±¯Õ÷K¿ë2«t;Á+ÔÛ•½VŠúŠÍ{½(4«€ ·á @.Ù 7 2ˆ! cƒ¦AvGÐÉYEh=—jñ-úëjn-6–ECJ.ýÐÊ¢[t×è‘éåšT˵ã•A–²R WçÛ­Ùq¯æ]J{A!j: ¾ˆoÿ7édÒt᧺&s•H´–º?˜Þå­h‘MÖ¢°¼ýaTsëôíÖ+Ìë ¤º%8÷¡ùÔÇli·ê²¦)¿ÝE®3ifØEbé°‹qñ*å;=#HçOT¯w“º$”×à&%¸É¡M{³ ¤ÄÕkëÇ«LÌWèuRTq¦äè7å `¸\gbˆ3DPxt†îgÀôºÉTHuuÓxgp;ž^승-|ùÊæ¹)[^©µP5ty¥ìîÐ}&ò`¥\òA !@ÈwG€ÇôzòBÍ-uÓ*ÎÏÎd¹.Ĉq¤ ;Ä 0½Þ TF­ip™wÐü³èVûn$„šµõÊIì,+yýqƒirq1wlö4îîܘ^[]]ÊÒã®\“žŸœ÷ff6ø«î:m1]èyàUh3¯p¥îÍJž&ÝëeÝ6¾ìz2H,iK î,—VChEV“ÉóážܪQFê¨I°¯Ï]cFx‡íäíõ•mÁ3al2¹íÈ[-·k“Þ“íx‘Ö¿ÒŽ‡rÿ7Í(“G°ÑO%ÛñÆ%¡%þ|3£”ÈšáÕ V¤ìö—zòßÜ“Wño¸'Ï™47ƒ€1®´uG€¤KL¯s“²V)²à&®'ïd³ЉQ‡—­5›Ð3ϬéÍçZ¯|}ÁòÉÒ6é, #6²øjÈ;+e’ÄÒäw$ŸHëAš<ª×M”eż«N=;CÏžŸs8Ôµµì¨I'ÙØS7÷ïwû¹Hƒ‚46miwRL¯;C*EC$:éG¸§êõñzœ+ qϲîÆsa1flÔäARϘ˜^Ÿ\’BÔfé·¯Û™{ªßDÝl.Y­?ÞÜqÅn×'{gÁ ¹ƒ96vrwdL¯‡ÌJ"ŠÆCî}hìO}ÐÎg›;Q¤3ïÈ<“2wgˆn“²½„zÖrêz²*Ó´C‡¾(M¸ó\šA ¡[5M³;„&¦×Ó¤5iÂŒêÊŠ?Ú‰Pe²§¾=_êåùþ¶°»Åù –âæÇ"î“(·Ï~6¼úR8í­çÒôRÌȨi–õJD©_‚p +$™RÅ®}¯m¤Yûœ&ì@wW>óÐ÷Öms ók]‹‡µ¶ÆÉeí¥Ö‘Ù“µuÕ#¬¥.jiCI-l·ÎëykvþxÇ×TvöÉ䉥ïØ>I¼giä¨^ß´ª £Pïòíëÿôn|šƒ€1s$ˆ!ƒJ6÷ôŒqL¯O +’“J2ï ~wÜsÌþx÷æfû ?<Ïdð?\ÍÌí2G÷ÿv•duA¼Ú›¸BõW0VyEùÝ 3ä¢ bÚØÄi´Ý h1½­ ¤¤Ü£-÷OöžbyåVkÑB-*ƒ]_Ý´ãòkp{ÄÀ}Ÿ€¯¥œ=2}˜åíhÁåÒ +b­ØjiZÝ ´0½žSúe ÅEµ~ Q³ž^Íg®‰ªÝB¤êM‘ïà€£žîOt]ì,¸í1 âRŠú¾OÑ`¤\ðA HöhôŒéõàK•u©ðàù~˜>é°7xg[s”%Y³qº„‡SŽµ÷<>Õ§©¾‚5+ׂâ1ˆ´tG>ãªk"ë²ïKýÇÜßJüô¿²ëʸÚêÕ7}ª-³Ó¥éƒjsQ4âÿòQýõendstream +endobj +3221 0 obj << +/Type /Page +/Contents 3222 0 R +/Resources 3220 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3122 0 R +/Annots [ 3227 0 R 3228 0 R 3229 0 R 3230 0 R 3231 0 R 3232 0 R 3233 0 R 3234 0 R 3235 0 R 3236 0 R 3237 0 R 3238 0 R 3239 0 R 3240 0 R 3241 0 R 3242 0 R 3243 0 R 3244 0 R 3245 0 R 3246 0 R 3247 0 R 3248 0 R 3249 0 R 3250 0 R 3251 0 R 3252 0 R 3253 0 R 3254 0 R 3255 0 R 3256 0 R 3257 0 R 3258 0 R 3259 0 R 3260 0 R 3261 0 R 3262 0 R 3263 0 R 3264 0 R 3265 0 R 3266 0 R 3267 0 R 3268 0 R 3269 0 R 3270 0 R 3271 0 R 3272 0 R ] +>> endobj +3227 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 190.865 512.306 199.888] +/Rect [526.677 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.2) >> +/A << /S /GoTo /D (subsection.4.3.4) >> >> endobj -3149 0 obj << +3228 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 177.316 512.306 186.338] +/Rect [526.677 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.3) >> +/A << /S /GoTo /D (subsubsection.4.3.4.1) >> >> endobj -3150 0 obj << +3229 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 163.766 512.306 172.789] +/Rect [526.677 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (subsection.6.2.4) >> +/A << /S /GoTo /D (subsection.4.3.5) >> >> endobj -3151 0 obj << +3230 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 150.217 512.306 159.24] +/Rect [526.677 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (section.6.3) >> +/A << /S /GoTo /D (subsubsection.4.3.5.1) >> >> endobj -3152 0 obj << +3231 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 136.668 512.306 145.691] +/Rect [526.677 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsection.6.3.1) >> +/A << /S /GoTo /D (section.4.4) >> >> endobj -3153 0 obj << +3232 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 123.119 512.306 132.142] +/Rect [526.677 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (section.6.4) >> +/A << /S /GoTo /D (section.4.5) >> >> endobj -3154 0 obj << +3233 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 109.57 512.306 118.593] +/Rect [526.677 673.356 539.579 682.379] /Subtype /Link -/A << /S /GoTo /D (subsection.6.4.1) >> +/A << /S /GoTo /D (subsection.4.5.1) >> >> endobj -3155 0 obj << +3234 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 96.02 512.306 105.043] +/Rect [526.677 659.807 539.579 668.829] /Subtype /Link -/A << /S /GoTo /D (subsection.6.4.2) >> +/A << /S /GoTo /D (subsection.4.5.2) >> >> endobj -3156 0 obj << +3235 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 82.471 512.306 91.494] +/Rect [526.677 646.257 539.579 655.28] /Subtype /Link -/A << /S /GoTo /D (subsection.6.4.3) >> +/A << /S /GoTo /D (subsection.4.5.3) >> >> endobj -3157 0 obj << +3236 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 68.922 512.306 77.945] +/Rect [526.677 632.708 539.579 641.731] /Subtype /Link -/A << /S /GoTo /D (subsection.6.4.4) >> ->> endobj -3109 0 obj << -/D [3107 0 R /XYZ 85.039 786.531 null] ->> endobj -3106 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3161 0 obj << -/Length 3197 -/Filter /FlateDecode ->> -stream -xÚíœÝS9Àßù+\ûd,F#i®¶HrÉU.°ÅUííƒcp6g›Íæ¿¿n}Û3 »$M¥‚Ç}öOÝ’Z=Cü£]“Š7¥%©9L®vªÁÜyµC]Š‘K2JÒ¤}°‰ËÍÛ*[W7ÛÕÖ”nUÛ“„)¸`„²[FJŸÉÐZ§ârBU‚‘ -àXqQ˜½ÜÕb8ÝÑáx}ZNW 0.†ãù)^ðásswŽÂÄ‹ÿVTÀ5 §QÓ°!SW~@¿“o¥$˜½ëÞ6ª"¢¢AH-iwŽŸk”dkØ.»<"Ú hawI˵ìðY‹ÆagûÛ# ÷P΀4.ÐH|FÂnœàÈX,/vÍ/@|¼F ZÌ÷Ž¦Ëß1õti y;žà×ó™$˜ûxWóáò&d¶)ŸM&øm¿{«4¢ÕŸ…æºØZÌV€–ˆ/­Ý€<´R­YI5P𫆚ª¥)ƒÄšáÍøÒÊréÔ.æöÇŧ¿Ió*}ëKÊf)Prò’UŽÐf¥y:¹š™Šá0ç—Õl~UtøîXØ‹ 5ï8çã3ÿ}½°ŸÏPýN]šmnŠuJ XŸO±Û.LkG”‡!ëçCUé2¤ß6{fŒI­@´ï8K²åÇšOdÆÍŒ·ŽdÇ\±V?×, <îÞOïq¤ŒŒBŸû9zôòò \ÿdõ ˜îM ÁìHSÃs3Lí=g!VÁ4`a“ÅuÖpH)þB®?} ÅlB‰¬$Ëj7 O¨Tk $aa[ñ@H»}ad æ¡æ -,~J3ãç NªóS;ý®lšä°X gªÑ΄x©1EÛŸAçÍÄ` -Ά·Ó+Ä«cøk -¨ùßÊB`T‹Þã/f+Œ?—¨<þÚ È¿R­TÛ…žä0+‘Ž?:ÄÅC£eh&â(C»Àªê«èÿ9´Ÿ‡8䟦fЭp¼Á0Âå†_‘ŽëK_:1[N"§ŽqCé÷c]§ûbŒÙ -æ1¶ÇXªÕï‚놓ªö¾"îvÁÁ[„;¦í  3,DøMSùݸ:¼HzBN²å!§â–<¹£YÈÅZý -¬V ©+ ûó›…±¯v‡TǹݩÁÅÉ1îÁ‘¥¿n®£ÌOÆ?‚ßa­mˆ·#ÂâÁ¡¹.ö…³ %âËCk7 ­Tk€&kÒÔšßQŸœ£`¿X1Ïvƒ[j}>[Ù?ZXëµ×Öõ¹'»2 -;¹ÁõÌlôwo‡Õóϸ©¿’mõýíK0f+Ld)EŽ`»y‚¥Zƒm­aZ¬¼‡Q8ÛšÌf/yp´*Ú\¿aµI-OôÔ_ãýǶÉuÝï 4f+MD+ëÐvò@Kµ•äšhxz3z45'×–ÝD¶¸qª·²“'.Ž¬³ - î§]X9îÐZAô%rÀF繶jÏc-T¨²ÒÒ€•ÝëÞtmpî] %ýX“ÉbT…”O ës_‚1[a"Ï<ÃvòKµŠXI(z? qòMýþV¯®ñÚ/cÍ"h{#e×µ¡ëp_„1[a"L)sÛ È#,Õê·”¢Ñ„Ñ „ÑQshôoe(³pãÒœ.sf‰.ئ~RÛIßáž“ly„©0³;EX¬Õk¡Ð‚HÉBïë5ôiz¼¶5M: ¤Ãme¼…žÞ›kŒe OqÂôréK:f+Ndž'Ýn@žt©Ö@ZQB©¤ëÒfƒx–Ù!®¶Ö·“ËÙÔ›]QÕO’²“I_Ê1[r"o©r”Û ÈS.Õ(׊À^'P–Žò»Åk-µ‡ç0;¡ôų0'Ïcn7 ¹T«ß© -!HEýΦv;Õ}ëç¹ò'¤/0 jiŽßÐÓ@Ù“=ûºt'¢¾Ðc¶ôDüyèíä¡—j ºÍ¡v©t¿ÝnÀ…?ï>=ÍGÏ<·çåÎÕ´Øôf(ƾ²rº^õå³8%Ësj7 Ï©TkàD%ihää÷§H·ðçÌ¢04ÆÁ×¢´Í¯Mˆãxv¹B×Ⱦº÷E³&ÂÌ#l7 …kF$ƒƒUn­Ëa»¼a¨)‡íúDØ4íÂvÖ&ÜYèð^\šPéäÅc»V^eâw“šï¿[lçV‰F‚¹À¿¤ lünU ÝÝnJç¼Å•PNb?"w;µÉɨ§2Å\y]J¤Ÿ­Ú³Æ°Te.kÂ¥'îƒvýtf<7ˆ¹Vô;‰Ó¹r'¥¾Ìc¶ô„@žz»yì¥Z÷šM=wLýâœðÌ"õ:ñí/æN¥ÏÌA—‹cøî@;±ô³@'"W¹ðáŽäA—jõ‹ÎA­çQ'GÕŒ¥þäMöÒ_ÌýÁJ8›¶Îü ¿ίàãô·B–èægùãEÐjÌV€šˆ7µÝ€<ÔR­*¬‘åª_Áî;„¬®—>|ßÄÚͼ'È“ò®¤†±§è2ðèË4f+0M¤›gÚn@ži©Ö`‘!1•Â1?\ЈúBÙ -Ðñ«\°}GþÜ>†iITRÖ¹ñ‰°iÛǘǪ`ºye:á·wÓµùŠà ˜ {cßXk3•Ì\î£õÁt¼2~fAëß½ýI|‡íO±{[%ÁçÂô’‚Ê/²âˆiAj-ÊŠÈÌ’µ·ß¡ƒ†§nž’n}=ÕôBë©šI¶¼j¦@ò#¤Ý€¶j*E¨F%¢áÝšÉK=b|óÈG.% F'ŠÉãAÑkP£Êÿ%6rá™Q¥ßÇóÉôÔjÙ~‡úµ vÞ°OOZPÔ4›ºÜàí2$swII%]ã¬îJ"8X? ˜Ö»`ý€5«ê[¬ŸK„m†KX±˜/î6mÏ -vËšX4}y›ˆI.læçKg?]¦õÿmŬAŒ}¸‹A,õx«D)[—T‚¤˜*ÄJ¡n »£$ÒéÜE‹È~¸…¶- —RO ˜dË[À”@vHt4 »"-Ö¸k0©UàÎ÷“sã°¬“xYÔ¢ðd·õ¢ÿœ™1¿+îNJ}¹Çlî •‹üêh@ž{©ÖÀ]6¤v1õp—;î³UðÄç¶FBÈ¿ýêÇK¬ïˆÙ -c ¡¡rÑ( ÈR­ÞÃK)R¹}3Ðêã”és„ÿúý‘}¼wžâ·4ïc‚C&{¯ãKOÆ·àûÞ—fÌV ™È5O³Ý€<ÍR­¦ˆGL†&s4÷ #Ä6²füóÌDu.nœ³h8՞ȔÝONǶË.Ãk7 ¯Tk€Ç©aÇ»ƒwGá)#ûZ‡ð$½ñËúÀ?„z0[N'ëÅNy2jÈîsÎs8F‰ªÜ‘u»ö–d+àJd§tŽWu÷ó±b­ž˜Žç7»ØÁ{ -zöú]Ai¥–Κê{é;%T¹ók}÷0}‡ó/h 4?%¾´o›l[ЭGmì–ð`·Ÿe¹Ûxk\Ñ6B=Šê^§^ê‡^‰HuöÝVw?ò*UÞcO\ Eá(&ï±é‚wîN¦O“È»ÔûÞlp¯£*y‡“ªDl:ûV¨ÛÏ©¢—°&ªû… ðŸûWÈÝÿÁÙ(`™¤sƄÓ鯉àn¶úÆ5©5÷i’ÿ'sÂendstream -endobj -3160 0 obj << -/Type /Page -/Contents 3161 0 R -/Resources 3159 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3158 0 R -/Annots [ 3163 0 R 3164 0 R 3165 0 R 3166 0 R 3167 0 R 3168 0 R 3169 0 R 3170 0 R 3171 0 R 3172 0 R 3173 0 R 3174 0 R 3175 0 R 3176 0 R 3177 0 R 3178 0 R 3179 0 R 3180 0 R 3181 0 R 3182 0 R 3183 0 R 3184 0 R 3185 0 R 3186 0 R 3187 0 R 3188 0 R 3189 0 R 3190 0 R 3191 0 R 3192 0 R 3193 0 R 3194 0 R 3195 0 R 3196 0 R 3197 0 R 3198 0 R 3199 0 R 3200 0 R 3201 0 R 3202 0 R 3203 0 R 3204 0 R 3205 0 R 3206 0 R 3207 0 R 3208 0 R ] +/A << /S /GoTo /D (subsection.4.5.4) >> >> endobj -3163 0 obj << +3237 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 754.651 512.306 764.219] +/Rect [525.586 608.25 539.579 617.818] /Subtype /Link -/A << /S /GoTo /D (chapter.7) >> +/A << /S /GoTo /D (chapter.5) >> >> endobj -3164 0 obj << +3238 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 741.102 512.306 750.125] +/Rect [526.677 594.701 539.579 603.724] /Subtype /Link -/A << /S /GoTo /D (section.7.1) >> +/A << /S /GoTo /D (section.5.1) >> >> endobj -3165 0 obj << +3239 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 727.553 512.306 736.575] +/Rect [526.677 581.151 539.579 590.174] /Subtype /Link -/A << /S /GoTo /D (section.7.2) >> +/A << /S /GoTo /D (section.5.2) >> >> endobj -3166 0 obj << +3240 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 714.003 512.306 723.026] +/Rect [526.677 567.602 539.579 576.625] /Subtype /Link -/A << /S /GoTo /D (subsection.7.2.1) >> +/A << /S /GoTo /D (subsection.5.2.1) >> >> endobj -3167 0 obj << +3241 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 686.905 512.306 695.928] +/Rect [526.677 554.053 539.579 563.076] /Subtype /Link -/A << /S /GoTo /D (subsection.7.2.2) >> +/A << /S /GoTo /D (subsection.5.2.2) >> >> endobj -3168 0 obj << +3242 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 673.356 512.306 682.379] +/Rect [526.677 540.504 539.579 549.527] /Subtype /Link -/A << /S /GoTo /D (subsection.7.2.3) >> +/A << /S /GoTo /D (section.5.3) >> >> endobj -3169 0 obj << +3243 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 646.257 512.306 655.28] +/Rect [526.677 526.955 539.579 535.978] /Subtype /Link -/A << /S /GoTo /D (subsection.7.2.4) >> +/A << /S /GoTo /D (section.5.4) >> >> endobj -3170 0 obj << +3244 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 632.708 512.306 641.731] +/Rect [526.677 513.406 539.579 522.428] /Subtype /Link -/A << /S /GoTo /D (subsubsection.7.2.4.1) >> +/A << /S /GoTo /D (section.5.5) >> >> endobj -3171 0 obj << +3245 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 619.159 512.306 628.182] +/Rect [526.677 499.856 539.579 508.879] /Subtype /Link -/A << /S /GoTo /D (subsubsection.7.2.4.2) >> +/A << /S /GoTo /D (subsection.5.5.1) >> >> endobj -3172 0 obj << +3246 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 605.61 512.306 614.633] +/Rect [526.677 486.307 539.579 495.33] /Subtype /Link -/A << /S /GoTo /D (subsubsection.7.2.4.3) >> +/A << /S /GoTo /D (subsubsection.5.5.1.1) >> >> endobj -3173 0 obj << +3247 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 592.061 512.306 601.083] +/Rect [526.677 472.758 539.579 481.781] /Subtype /Link -/A << /S /GoTo /D (section.7.3) >> +/A << /S /GoTo /D (subsubsection.5.5.1.2) >> >> endobj -3174 0 obj << +3248 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 578.511 512.306 587.534] +/Rect [526.677 459.209 539.579 468.232] /Subtype /Link -/A << /S /GoTo /D (subsection.7.3.1) >> +/A << /S /GoTo /D (subsubsection.5.5.1.3) >> >> endobj -3175 0 obj << +3249 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 564.962 512.306 573.985] +/Rect [526.677 445.66 539.579 454.682] /Subtype /Link -/A << /S /GoTo /D (subsection.7.3.2) >> +/A << /S /GoTo /D (subsection.5.5.2) >> >> endobj -3176 0 obj << +3250 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 551.413 512.306 560.436] +/Rect [526.677 432.11 539.579 441.133] /Subtype /Link -/A << /S /GoTo /D (section.7.4) >> +/A << /S /GoTo /D (section.5.6) >> >> endobj -3177 0 obj << +3251 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 537.864 512.306 546.887] +/Rect [526.677 418.561 539.579 427.584] /Subtype /Link -/A << /S /GoTo /D (subsection.7.4.1) >> +/A << /S /GoTo /D (subsection.5.6.1) >> >> endobj -3178 0 obj << +3252 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 524.315 512.306 533.337] +/Rect [526.677 405.012 539.579 414.035] /Subtype /Link -/A << /S /GoTo /D (subsection.7.4.2) >> +/A << /S /GoTo /D (subsection.5.6.2) >> >> endobj -3179 0 obj << +3253 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 510.765 512.306 519.788] +/Rect [526.677 391.463 539.579 400.486] /Subtype /Link -/A << /S /GoTo /D (subsection.7.4.3) >> +/A << /S /GoTo /D (subsection.5.6.3) >> >> endobj -3180 0 obj << +3254 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 497.216 512.306 506.239] +/Rect [526.677 377.914 539.579 386.936] /Subtype /Link -/A << /S /GoTo /D (subsubsection.7.4.3.1) >> +/A << /S /GoTo /D (subsection.5.6.4) >> >> endobj -3181 0 obj << +3255 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 483.667 512.306 492.69] +/Rect [526.677 364.364 539.579 373.387] /Subtype /Link -/A << /S /GoTo /D (subsection.7.4.4) >> +/A << /S /GoTo /D (subsection.5.6.5) >> >> endobj -3182 0 obj << +3256 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 470.118 512.306 479.141] +/Rect [526.677 350.815 539.579 359.838] /Subtype /Link -/A << /S /GoTo /D (subsection.7.4.5) >> +/A << /S /GoTo /D (subsection.5.6.6) >> >> endobj -3183 0 obj << +3257 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 456.569 512.306 465.591] +/Rect [526.677 337.266 539.579 346.289] /Subtype /Link -/A << /S /GoTo /D (subsection.7.4.6) >> +/A << /S /GoTo /D (subsection.5.6.7) >> >> endobj -3184 0 obj << +3258 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 443.019 512.306 452.042] +/Rect [525.586 312.808 539.579 322.376] /Subtype /Link -/A << /S /GoTo /D (section.7.5) >> +/A << /S /GoTo /D (chapter.6) >> >> endobj -3185 0 obj << +3259 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 429.47 512.306 438.493] +/Rect [526.677 299.258 539.579 308.281] /Subtype /Link -/A << /S /GoTo /D (subsection.7.5.1) >> +/A << /S /GoTo /D (section.6.1) >> >> endobj -3186 0 obj << +3260 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 415.921 512.306 424.944] +/Rect [526.677 285.709 539.579 294.732] /Subtype /Link -/A << /S /GoTo /D (subsection.7.5.2) >> +/A << /S /GoTo /D (section.6.2) >> >> endobj -3187 0 obj << +3261 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 391.463 512.306 401.031] +/Rect [526.677 272.16 539.579 281.183] /Subtype /Link -/A << /S /GoTo /D (chapter.8) >> +/A << /S /GoTo /D (subsection.6.2.1) >> >> endobj -3188 0 obj << +3262 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 377.914 512.306 386.936] +/Rect [526.677 258.611 539.579 267.634] /Subtype /Link -/A << /S /GoTo /D (section.8.1) >> +/A << /S /GoTo /D (subsubsection.6.2.1.1) >> >> endobj -3189 0 obj << +3263 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 364.364 512.306 373.387] +/Rect [526.677 245.062 539.579 254.084] /Subtype /Link -/A << /S /GoTo /D (section.8.2) >> +/A << /S /GoTo /D (subsection.6.2.2) >> >> endobj -3190 0 obj << +3264 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 350.815 512.306 359.838] +/Rect [526.677 231.512 539.579 240.535] /Subtype /Link -/A << /S /GoTo /D (section.8.3) >> +/A << /S /GoTo /D (subsection.6.2.3) >> >> endobj -3191 0 obj << +3265 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 337.266 512.306 346.289] +/Rect [526.677 217.963 539.579 226.986] /Subtype /Link -/A << /S /GoTo /D (subsection.8.3.1) >> +/A << /S /GoTo /D (subsection.6.2.4) >> >> endobj -3192 0 obj << +3266 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 323.717 512.306 332.74] +/Rect [526.677 204.414 539.579 213.437] /Subtype /Link -/A << /S /GoTo /D (subsection.8.3.2) >> +/A << /S /GoTo /D (section.6.3) >> >> endobj -3193 0 obj << +3267 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 310.168 512.306 319.19] +/Rect [526.677 190.865 539.579 199.888] /Subtype /Link -/A << /S /GoTo /D (section.8.4) >> +/A << /S /GoTo /D (subsection.6.3.1) >> >> endobj -3194 0 obj << +3268 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 285.709 512.306 295.278] +/Rect [526.677 177.316 539.579 186.338] /Subtype /Link -/A << /S /GoTo /D (chapter.9) >> +/A << /S /GoTo /D (section.6.4) >> >> endobj -3195 0 obj << +3269 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 272.16 512.306 281.183] +/Rect [526.677 163.766 539.579 172.789] /Subtype /Link -/A << /S /GoTo /D (section.9.1) >> +/A << /S /GoTo /D (subsection.6.4.1) >> >> endobj -3196 0 obj << +3270 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [497.163 233.667 512.306 243.962] +/Rect [526.677 150.217 539.579 159.24] /Subtype /Link -/A << /S /GoTo /D (part.3) >> +/A << /S /GoTo /D (subsection.6.4.2) >> >> endobj -3197 0 obj << +3271 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 209.209 512.306 218.777] +/Rect [526.677 136.668 539.579 145.691] /Subtype /Link -/A << /S /GoTo /D (chapter.10) >> +/A << /S /GoTo /D (subsection.6.4.3) >> >> endobj -3198 0 obj << +3272 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 195.659 512.306 204.682] +/Rect [526.677 123.119 539.579 132.142] /Subtype /Link -/A << /S /GoTo /D (section.10.1) >> +/A << /S /GoTo /D (subsection.6.4.4) >> >> endobj -3199 0 obj << +3223 0 obj << +/D [3221 0 R /XYZ 85.039 786.531 null] +>> endobj +3220 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3275 0 obj << +/Length 3278 +/Filter /FlateDecode +>> +stream +xÚí\YsÛ8~÷¯PÍ“ô ˜8I>lM%v’M¶âxcOy«fçA‘e[åƒ^IžLþýàj‰¶él©”£ƒlv«¿  ÑúT’¼”•"’ÓÁôr«œê+o¶¨¿cìo'÷¼<ÜÚ~-Õ€¤.êÁáIxN]Y«ÁáñïÃæjĪájæ^–£?ßm½: NTSÎÍcÿ·õûÅàX›ðn« ¼®Ÿõû‚к\n ɉܾØ:Øúwx–»&NªëW^Z Ƽ U%:o¡%¢àú—JI”(Ã/eEÇ/õ÷˜_Z’ÑX 1ÜmFc:¼Ñád~5sUßë³ËOúƒ~],Ïæúóõ¦'$Óž­ø Ñë.-NîÍÇÄL¸7só™ÆNU·4ójSsÛsÞ·cF(»…"æV¦‚ET&{KÁH¡Qrž£Úw¥öÝëQ%†3ã¿ÉêF;iaß/µã8N®ŽÝ›—öÛ+ãTóæ¿ú½æÖ¸®ÙP?J…yu|ê|Ánù†â_÷èqJ¢J\ÚÂ&C '5NÄÚpm>ûµ-h±îÅõš0}·¨=M˜§ÉûG„# û\³‚›+‡Ÿ-Q„þZ³¨Yœ,u43&+Óâš«íƒÙâO‡f ÷€÷“©<³Ïq|28U|¸¸ òîæÓ©ùÔ˜ï!šépñýðõ¾è‹oCðMý\dñm[€à‹é¥:0‰ZëÕ߶&TJiP´wëáÍäÂù}gá#‚A©¹r_6' ‚ÕðìžðÕ£åj/ôEÕ‰ ˆ‚giÍu­’9]EÓZ#ÌùÛr~uꜿw(6µúk‹î“GÓÀ89M¿[Ùæm…_˜¦~ÜÑtg±‘›67ß‘ï:ÄpÕøgyŠì6—¶w®éÐq¿®/@A +Á(ñËÂÔR …(°TUê¯h@‹{´~ù`|?¶-æ P¿¾ø¢ßÿ⼦[¢¥ëMu a› ÐMp¹B€QJ|ßf¿¼'’‰XÊ5¯ò–äÁDõ4KA¸dM‚è¹ÅãÆN¾Õôï9ÜLíDCš´Ñ‰{Ve5….ÍÍzìë»]QU}aó?±/lQ -u_¶¶l˜^ªÜ¸F)=ѯ lth:Àºª‡G¶3;nŒãV9Çþgß½î›ÚœÌ,PK “í/%ûá#ߌþ'÷…1Š!0¦îÌÃضÓ`<)ÖadŒ¶Ô#£>‡øF{ôÅ8Š!§¾ÎcܶÁÓ0朔ÅÆÜc|0qámbf”>èiã7‚Ü»§/äQ ié³ÃÜ7óËkC…ÕZžks˜ãÒ ï9ÔÎ-}‘RЉë,Î-ṏR˜¬K& §4…9æÕöms^Ú‘×ü“¾páŸ-l.ma’Òµ|ªaÜ»¦/ÔQ Á:u{ì¶Ú˜ÞШ)%¥bnÈ~ÛÀYºú·Ñ¥ç— Ü%³Dqsm +:èïܽû²"Š!¬HÑÉ tX€°Ó ¬uE¬¬°SïÓÌÜ{¹1ÈŸ^ÌgõE!Ÿ6#À{=‘ˆå±†L–äê Œ¨QŠF(ψ½feøPUâ‰ää¾%¼ûúR"Š!”H¡ÉS¢mB L/¤DI ¥Ö—> °ã2s—°ÆýÊ¡-š…/% ì1 øâÙ— Q !H +Tž m ‚`zCÌšJ‚@ª`'$y¨n8>Î#½tÕç>?ØÄ´ô:WfEðÁ.Û‚úBÅhSç¡m[€@‹é Ð +A +ª´0û7@&Ùü.8S!/h«V'ó‹¥ñ¯|”Þ;¤/ÈQ 9qv•--ì° [½Íô@_Öxõ¶ 5‘¯Þ†{¬e¾zû`eËŒM!¾0o.léèÌUr˜D¿ž5ÌË\ýv¢ù.õÛ¨¡›Ï´–f ú’Geë· ´t{ӘP¤ð¹Ûêgéöÿ¥ýy—ömQ i)\yî´-@‚,¦hÂkf›©£ ”nCwxºpezšmº@MYÒÇ7`þþT·ö¤J"–§ÊdYªtX§ +ª7P¥¬HM=S ÜâÕ_¦Øǯ“\ÝNså£Æ©][õŠ¬ϘÎ})¤F$Èd+”Ûê> JaxÆ•$\E>ÀÈû£í3NÒ +òÐØ”=w»Ðb7`,|vƒlí,LF_<ÆÑø«/þQ !@ŠEžm  +`z$%€!úŽGœÕÃÕvˆØRØ9dèUHñÕŒ=íô øª/þQ Á?Å!ÛLoèôÝÌ玫P¥ñ3=s?‚xgö%HC’•-Ëí°ŸÞUøôŽSNª¤Œ³kz÷Ëj?½³ûô<îȇãfÄ W›­¿Û›­ìG󟾠™uî.ìØîÂŽ:ÆvØ»"tÓº^f]õ5»z9¥DU·$UyQæë3ë054YvÍЪ~L ñA¶cïÞ¾í8Š!í8!SÛ‚ŽvLIɤ֫wÍ3 Y‘JšÆ®Öô Ñ)©!¡!Ã=Æ´·ºÙð?qÕ7/lÓûsr5»V¹ÓÑ\[>•Dp6H @}éîÆíÝ|¦õe¶´1yÖ09“]·P¥QæÝtù-G0Yy²—¥+ZÂ=Æf}Q›lQ¤-ˆÔ1pÛ9v#~Ú:*ó1ÔÜrî„_.|¼uÖõ虜‰ñw‰œèoÝ|¦([„”< +¨d%9D–·œ‡À'¥ßÝ¢¯šÐÉ~fÕ¾.\‚O{†ËD,.S¼µ-È‹Q½'ú+VHà ó<9:³©7ÿÇÏ/a¢ìv¡¹­‚†(§¿fzägJïÖ¾T‰bUȪlqT‡U0½@Z+¢¤ªpO•Ýù2¤EÂÞQ³ÅDý‰Ý™/àÛž|IÄò|Iq«²«¢äù‚ê…” ­8¡EÂÓ ™^Zwê6Ž¼ýà7EØ`²vÊᎹa_Sjûí~Ü ù“-ॾÈG1ùù¶ò˜Þ€¼ŠË‹yæ‘?ÜÙ·xˆÇ®Gù<·§C47>Ó¶NZ= Uf5õ ²„ºùl;Oή‰wX€é @˸hæèݽƒ°ƒ1±âNí°Ùr(“µéõùb6]5 ³Ÿí ¶oy¯¥ØD =q?»ì±‹ê #×õôUáGÿ„A¡).ÂAþ0¬ÓPÝÂÝ"íÔÌ£ÍÀRòçØå‹{-¼&b1€êìÂk‡10½!°°¼gy=þÁlµŠÃdOÔ‘aɇÿ2/o>Ú¿ùbBP`]òGÒðÙ}Q£‚nôr]Bi«G°e·/¢RjVÙ"´ìvhw?˜®/ÞîuE§ªÔcîÎ)}1RÆÑÝuv¤­ÁQ0.â✺ó×î§éZCLH«Qc»àbµãåÄí–0ÃüZ”òâ^‹£‰zâÿ:{ZA‡ì˜^À½ŠKnváaß8ôkmØÞxœÔ®¦—”?*h«{­jVwXÔL\g×BªÛ—4¬˜ÒpŠ¢ ˆª„éwT'®¡†¹—Ùøh&ÇÓIºÕmbOI\ÌÜFÇ™Ï>Þ íýÒûX[ÂNµ ÏÃÜVi›WÎ’¡„*aVÐxMO|±š§ÅnsWèÊN&SXP²zVÇL9¯õ=s&H!GÎD<êìZ][=²"$IÙ}Šºþãp&îý9ÕÚzXÝVžaV$}PAÊwìM‰Å¡JÚ\endstream +endobj +3274 0 obj << +/Type /Page +/Contents 3275 0 R +/Resources 3273 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3122 0 R +/Annots [ 3277 0 R 3278 0 R 3279 0 R 3280 0 R 3281 0 R 3282 0 R 3283 0 R 3284 0 R 3285 0 R 3286 0 R 3287 0 R 3288 0 R 3289 0 R 3290 0 R 3291 0 R 3292 0 R 3293 0 R 3294 0 R 3295 0 R 3296 0 R 3297 0 R 3298 0 R 3299 0 R 3300 0 R 3301 0 R 3302 0 R 3303 0 R 3304 0 R 3305 0 R 3306 0 R 3307 0 R 3308 0 R 3309 0 R 3310 0 R 3311 0 R 3312 0 R 3313 0 R 3314 0 R 3315 0 R 3316 0 R 3317 0 R 3318 0 R 3319 0 R 3320 0 R 3321 0 R 3322 0 R 3323 0 R 3324 0 R ] +>> endobj +3277 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 182.11 512.306 191.133] +/Rect [525.586 754.651 539.579 764.219] /Subtype /Link -/A << /S /GoTo /D (section.10.2) >> +/A << /S /GoTo /D (chapter.7) >> >> endobj -3200 0 obj << +3278 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 168.561 512.306 177.584] +/Rect [526.677 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (section.10.3) >> +/A << /S /GoTo /D (section.7.1) >> >> endobj -3201 0 obj << +3279 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 155.012 512.306 164.035] +/Rect [526.677 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (subsection.10.3.1) >> +/A << /S /GoTo /D (section.7.2) >> >> endobj -3202 0 obj << +3280 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 141.463 512.306 150.485] +/Rect [526.677 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (subsection.10.3.2) >> +/A << /S /GoTo /D (subsection.7.2.1) >> >> endobj -3203 0 obj << +3281 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 127.913 512.306 136.936] +/Rect [526.677 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsection.10.3.3) >> +/A << /S /GoTo /D (subsection.7.2.2) >> >> endobj -3204 0 obj << +3282 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 114.364 512.306 123.387] +/Rect [526.677 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (section.10.4) >> +/A << /S /GoTo /D (subsection.7.2.3) >> >> endobj -3205 0 obj << +3283 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 100.815 512.306 109.838] +/Rect [526.677 673.356 539.579 682.379] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.1) >> +/A << /S /GoTo /D (subsection.7.2.4) >> >> endobj -3206 0 obj << +3284 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 87.266 512.306 96.289] +/Rect [526.677 659.807 539.579 668.829] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.2) >> +/A << /S /GoTo /D (subsubsection.7.2.4.1) >> >> endobj -3207 0 obj << +3285 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 73.717 512.306 82.739] +/Rect [526.677 646.257 539.579 655.28] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.3) >> +/A << /S /GoTo /D (subsubsection.7.2.4.2) >> >> endobj -3208 0 obj << +3286 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 60.167 512.306 69.19] +/Rect [526.677 632.708 539.579 641.731] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.4) >> ->> endobj -3162 0 obj << -/D [3160 0 R /XYZ 85.039 786.531 null] +/A << /S /GoTo /D (subsubsection.7.2.4.3) >> >> endobj -3159 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R >> -/ProcSet [ /PDF /Text ] +3287 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [526.677 619.159 539.579 628.182] +/Subtype /Link +/A << /S /GoTo /D (section.7.3) >> >> endobj -3211 0 obj << -/Length 3455 -/Filter /FlateDecode ->> -stream -xÚåœIs·€ïú¬œ†"ƒu€Ó+¯‰RñK®òr‘´Å -Eò ©Øþ÷;@Î4âIE±d—Ë"gééFX ñ¤ÖÿðDrTS5i¤@œâÉü欞¼×W~8ÃþŽ™¿e–Ýóøòìûç‚MpT­&—ïâsT¸“ËÅoÕ“ífJduXºýô÷˟Ξ]Ægª1¥æ±ÿ;ûí÷z²Ð&ütV#ªääƒþ^#¬ÔäæŒqŠ8£þx}vqöK|–»Æ&Nj¨œJÄ%íó¬X?§ͤá ÖØrè« q4Q!ª—ÛÃR£¬j¯¦3ÒTÛÛƒ9¦ÕÕWݶ]ÌÛýt†+¶]èÓ‹n¹·'—{'«ÆëÚ|0¥²£ãÒµ¿)~‚@ŸD¬Æ±¸=Çuï'î˛ܕ^j–‰õ]yúlãJ‰{`Œè }‚îÖ²ÖTëª -ðÅ­²>¬væã\éª*V#Ôçßµsû]Ó\þÓ ¾^x“XoæhoßoIkÄKtkf*ám<Þ·{ÏtûÎ5ÀÃõÒ}ycàMl¿6z{kþÎí5wß®íÚ›e¨ ºßø·aù¢…•Ä -°2·Á°úÀ°JZ#,}6‚’£A=î¶fù°Xu¡¡}Ú̉I%.ÑX>N¤ÀÆ{IˆË±R˜ ¤ kX¢“¦ÆˆE$fd#ŒU¿ž¿¼pþœ¹KãÏëiôù¯+ÓT†9wî‡ønãî3ãž¹lþl»?¬Ä{wëKÍ(Á‹}íŸæÖ€®¡òRÅ¥ -ä’?ax=í0¿‚ÊФ„lô)œb߬.–‡Cò:­nw>q ²kMs¿v½x(ƒY(úH™L2w«¤Ê@–E­fÃå$Á$f¢õf¹[¯æía¥cê™Ä_AL -=c+`Ì*„±oŒ±¤5b5’5Mih“Ý5»¹ïG#Õgú¼ë@»Uèu»ä?d°Þ cÁ&±ØÌÅ0ؾ0Ø’Ö0^êÉ"œ°Â˜?.×»wÛíÚÑüq&º:,"_ÏVˆ¼÷ÓXòI¬@>c“ï“/iMšêÏ:#†Ù¡XèåRÇ>MŒ}ôõÕƯM¤³=luÅ‘Õ|»Ö¬¹‡M×w,À$V˜¹Rr`ß`IkHj„9OÃК¢Ñ7®ÛÝ®oM7mXƒìU·Haê¬áäau¾ÜcI&±Ȩ́0ɾ0É’ÖØ ×éÿdã;áË©¤ÕrnÞµi’:HòÝñ«|f¡ç«å‡ã §Kع銩!lf¢yX¬½gƲNbÖ™×¥€X÷ €Y—´†VËE5oëÐí¥òÉåþÖäóv¶ÝÜ>ýºò­ù¢½1‚WzÄ9¹ç@CñGÍÄ` ¹kA €@‹Z#ÐF!^Ë4tÃn`¼Z/oÇ.†Á¦?6A±éyMþ„'ø`,Õ$V šùW6Õ¾0Õ’ÖHUp¤xF•þU3mçÝv¿Mö*K¹‰}X=opÀX¤I¬€4s.Œ´oŒ´¤K7ÊêÎQkWGHqeº_&Uõc- ?¹€6Ì[MGk3éGÍwyp‡Ùëꆹècäf 7q³=úv½ÿ$+_²±¬’XUæ5)!V}`V%­!"2+š2DÒDO¶7Ƴ7!Ž59†®³c¢a‚É·4#õ.Ë>7÷½Òîœé©Û¿cÕ´.æö‡V‡ëí­»´/&”Yãg˜Æå¦n¹=}ÛòAáÂ=[?Ít­nù’ר^BuO£mÄèg&V¨}þ¦rõë׿’ÖP™’ˆ`’*`ˆâ^|ÒŸÌ/£®c*Ó¥ÃܥΞٹ-ï)£Õw—׫t´^2OXù[쪭}*©æÛ®ÙÌÕ%\™ -Ø-îšÉ¶¹õjïïÞ‡­ÖÜT®§¶2w~Àw<÷,&¹›ZË$CBŒÎÞfbp­ 7k퀽ZK%A‚²‰ðãÃû}Â(©§ó5"uÊ.:¯Ú˜h¥dn²UÛô«ŠUæóííÆÔÑTç›wÛ)µ•Q®6Ÿ;Òê[žºSíU»ŸÚ­>'Ôl“=Ïú›ËÖŸ<ÑúZ€ÌÔó#‘Æ–öš2”0¦ç÷\Gb•<ŸJæZs{p­Ôˆífáâ”ǾËð}‡oÖ&™®ùÚâ’ॱ­,‰ZYF® }À±¡¨5r§ẠÜÉ_¦çÎîw66½qu#´'IÅWÇÜ{h,ó$V`žy_AëÖÀÌKZc<€â.CTW¦Ú¿ãâ²­­mwZG#îÙJÄÜ{h,ó$V`žyfÞ7f^Ò™S‰ˆÏ‰Yæäó™[à‹+ówi¿®ä)GB5y®{†ûœöê÷ÚØzÄ -õ #׃¾p=(i½Wšeb}Ç>Ûí¡©!^} `^%µ‘WMPsÚk3ë|³²¯¾´ëUx)ÿ½÷}LoaBá^›ˆXŠ/CÉi,¤(U`”9«†ö©ôÕÄ -: ,"ŸâžÐ“´Ïé¶Ë7Íf[÷tm’÷­  ¥ +ƒiy®†6< Xò*ªÀ®?É 0äš‚[Î9^Š!Õ]mØùó7n¥áhÓ9z én¨ø"Œ¥’Ä -Tr÷ÔЖ„ `*%µ‘Š zB¥ aÏr· Æ}ö×6i®oûµÐ¬.â¾×¡U¢†°«ùrE•Ä -¨rŸÕІƒ `T%µ“ˆ7§¨¤Gu<èìÓæQ‡p¶µ‡ƒ¥i†¤ÛCX÷6{Šœ`¶±X÷•. -gÍRPñÙ ¼Ác$±ƒÜ0ƒ¾0ƒ’ÚÈ€rTvÂ@yÏ>ÆÚŸÿZÖÏOÏŸû]ÎÝ*úÝ̺ìGX‰€mCRÈÏà­ ‰䞨¡é `%µÑ^oøétºÖqaÉbo~ûÈÌàìës›Õ>ÆÏâ>Œö¾Pc9%±§Üa0§¾0§’ÚÜÂuƒÉ’[6²Ýº]Åhۮغ_û;ý¹vœìq4Ýó.&¢w½ÑTå'ÀûÞÞ‘ÞOR°÷sOÔ øCU§êÁ8f#É_òÐÿiø©Æ¿ÿ;»ée‰”„ö˜ÍãDšý2Œú]½²ùŸãõ÷dÿxUöúendstream -endobj -3210 0 obj << -/Type /Page -/Contents 3211 0 R -/Resources 3209 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3158 0 R -/Annots [ 3213 0 R 3214 0 R 3215 0 R 3216 0 R 3217 0 R 3218 0 R 3219 0 R 3220 0 R 3221 0 R 3222 0 R 3223 0 R 3224 0 R 3225 0 R 3226 0 R 3227 0 R 3228 0 R 3229 0 R 3230 0 R 3231 0 R 3232 0 R 3233 0 R 3234 0 R 3235 0 R 3236 0 R 3237 0 R 3238 0 R 3239 0 R 3243 0 R 3244 0 R 3245 0 R 3246 0 R 3247 0 R 3248 0 R 3249 0 R 3250 0 R 3251 0 R 3252 0 R 3253 0 R 3254 0 R 3255 0 R 3256 0 R 3257 0 R 3258 0 R 3259 0 R 3260 0 R 3261 0 R 3262 0 R 3263 0 R ] +3288 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [526.677 605.61 539.579 614.633] +/Subtype /Link +/A << /S /GoTo /D (subsection.7.3.1) >> >> endobj -3213 0 obj << +3289 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 754.651 512.306 763.674] +/Rect [526.677 592.061 539.579 601.083] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.5) >> +/A << /S /GoTo /D (subsection.7.3.2) >> >> endobj -3214 0 obj << +3290 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 741.102 512.306 750.125] +/Rect [526.677 578.511 539.579 587.534] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.6) >> +/A << /S /GoTo /D (section.7.4) >> >> endobj -3215 0 obj << +3291 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 727.553 512.306 736.575] +/Rect [526.677 564.962 539.579 573.985] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.7) >> +/A << /S /GoTo /D (subsection.7.4.1) >> >> endobj -3216 0 obj << +3292 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 714.003 512.306 723.026] +/Rect [526.677 551.413 539.579 560.436] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.8) >> +/A << /S /GoTo /D (subsection.7.4.2) >> >> endobj -3217 0 obj << +3293 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 700.454 512.306 709.477] +/Rect [526.677 537.864 539.579 546.887] /Subtype /Link -/A << /S /GoTo /D (section.10.5) >> +/A << /S /GoTo /D (subsection.7.4.3) >> >> endobj -3218 0 obj << +3294 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 686.905 512.306 695.928] +/Rect [526.677 524.315 539.579 533.337] /Subtype /Link -/A << /S /GoTo /D (subsection.10.5.1) >> +/A << /S /GoTo /D (subsubsection.7.4.3.1) >> >> endobj -3219 0 obj << +3295 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 673.356 512.306 682.379] +/Rect [526.677 510.765 539.579 519.788] /Subtype /Link -/A << /S /GoTo /D (subsection.10.5.2) >> +/A << /S /GoTo /D (subsection.7.4.4) >> >> endobj -3220 0 obj << +3296 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 659.807 512.306 668.829] +/Rect [526.677 497.216 539.579 506.239] /Subtype /Link -/A << /S /GoTo /D (subsection.10.5.3) >> +/A << /S /GoTo /D (subsection.7.4.5) >> >> endobj -3221 0 obj << +3297 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 646.257 512.306 655.28] +/Rect [526.677 483.667 539.579 492.69] /Subtype /Link -/A << /S /GoTo /D (section.10.6) >> +/A << /S /GoTo /D (subsection.7.4.6) >> >> endobj -3222 0 obj << +3298 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 632.708 512.306 641.731] +/Rect [526.677 470.118 539.579 479.141] /Subtype /Link -/A << /S /GoTo /D (subsection.10.6.1) >> +/A << /S /GoTo /D (section.7.5) >> >> endobj -3223 0 obj << +3299 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 619.159 512.306 628.182] +/Rect [526.677 456.569 539.579 465.591] /Subtype /Link -/A << /S /GoTo /D (subsection.10.6.2) >> +/A << /S /GoTo /D (subsection.7.5.1) >> >> endobj -3224 0 obj << +3300 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 605.61 512.306 614.633] +/Rect [526.677 443.019 539.579 452.042] /Subtype /Link -/A << /S /GoTo /D (section.10.7) >> +/A << /S /GoTo /D (subsection.7.5.2) >> >> endobj -3225 0 obj << +3301 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 592.061 512.306 601.083] +/Rect [525.586 418.561 539.579 428.129] /Subtype /Link -/A << /S /GoTo /D (subsection.10.7.1) >> +/A << /S /GoTo /D (chapter.8) >> >> endobj -3226 0 obj << +3302 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 578.511 512.306 587.534] +/Rect [526.677 405.012 539.579 414.035] /Subtype /Link -/A << /S /GoTo /D (subsection.10.7.2) >> +/A << /S /GoTo /D (section.8.1) >> >> endobj -3227 0 obj << +3303 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 564.962 512.306 573.985] +/Rect [526.677 391.463 539.579 400.486] /Subtype /Link -/A << /S /GoTo /D (subsection.10.7.3) >> +/A << /S /GoTo /D (section.8.2) >> >> endobj -3228 0 obj << +3304 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 551.413 512.306 560.436] +/Rect [526.677 377.914 539.579 386.936] /Subtype /Link -/A << /S /GoTo /D (subsubsection.10.7.3.1) >> +/A << /S /GoTo /D (section.8.3) >> >> endobj -3229 0 obj << +3305 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 537.864 512.306 546.887] +/Rect [526.677 364.364 539.579 373.387] /Subtype /Link -/A << /S /GoTo /D (section.10.8) >> +/A << /S /GoTo /D (subsection.8.3.1) >> >> endobj -3230 0 obj << +3306 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 510.765 512.306 519.788] +/Rect [526.677 350.815 539.579 359.838] /Subtype /Link -/A << /S /GoTo /D (subsection.10.8.1) >> +/A << /S /GoTo /D (subsection.8.3.2) >> >> endobj -3231 0 obj << +3307 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 483.667 512.306 492.69] +/Rect [526.677 337.266 539.579 346.289] /Subtype /Link -/A << /S /GoTo /D (subsection.10.8.2) >> +/A << /S /GoTo /D (section.8.4) >> >> endobj -3232 0 obj << +3308 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [498.314 459.209 512.306 468.777] +/Rect [525.586 312.808 539.579 322.376] /Subtype /Link -/A << /S /GoTo /D (chapter.11) >> +/A << /S /GoTo /D (chapter.9) >> >> endobj -3233 0 obj << +3309 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 445.66 512.306 454.682] +/Rect [526.677 299.258 539.579 308.281] /Subtype /Link -/A << /S /GoTo /D (section.11.1) >> +/A << /S /GoTo /D (section.9.1) >> >> endobj -3234 0 obj << +3310 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 432.11 512.306 441.133] +/Rect [524.436 260.765 539.579 271.06] /Subtype /Link -/A << /S /GoTo /D (section.11.2) >> +/A << /S /GoTo /D (part.3) >> >> endobj -3235 0 obj << +3311 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 418.561 512.306 427.584] +/Rect [525.586 236.307 539.579 245.875] /Subtype /Link -/A << /S /GoTo /D (subsection.11.2.1) >> +/A << /S /GoTo /D (chapter.10) >> >> endobj -3236 0 obj << +3312 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 405.012 512.306 414.035] +/Rect [526.677 222.758 539.579 231.781] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.2.1.1) >> +/A << /S /GoTo /D (section.10.1) >> >> endobj -3237 0 obj << +3313 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 391.463 512.306 400.486] +/Rect [526.677 209.209 539.579 218.231] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.2.1.2) >> +/A << /S /GoTo /D (section.10.2) >> >> endobj -3238 0 obj << +3314 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 377.914 512.306 386.936] +/Rect [526.677 195.659 539.579 204.682] /Subtype /Link -/A << /S /GoTo /D (subsection.11.2.2) >> +/A << /S /GoTo /D (section.10.3) >> >> endobj -3239 0 obj << +3315 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 364.364 512.306 373.387] +/Rect [526.677 182.11 539.579 191.133] /Subtype /Link -/A << /S /GoTo /D (section.11.3) >> +/A << /S /GoTo /D (subsection.10.3.1) >> >> endobj -3243 0 obj << +3316 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 350.815 512.306 359.838] +/Rect [526.677 168.561 539.579 177.584] /Subtype /Link -/A << /S /GoTo /D (subsection.11.3.1) >> +/A << /S /GoTo /D (subsection.10.3.2) >> >> endobj -3244 0 obj << +3317 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 337.266 512.306 346.289] +/Rect [526.677 155.012 539.579 164.035] /Subtype /Link -/A << /S /GoTo /D (subsection.11.3.2) >> +/A << /S /GoTo /D (subsection.10.3.3) >> >> endobj -3245 0 obj << +3318 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 323.717 512.306 332.74] +/Rect [526.677 141.463 539.579 150.485] /Subtype /Link -/A << /S /GoTo /D (section.11.4) >> +/A << /S /GoTo /D (section.10.4) >> >> endobj -3246 0 obj << +3319 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 310.168 512.306 319.19] +/Rect [526.677 127.913 539.579 136.936] /Subtype /Link -/A << /S /GoTo /D (subsection.11.4.1) >> +/A << /S /GoTo /D (subsection.10.4.1) >> >> endobj -3247 0 obj << +3320 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 296.618 512.306 305.641] +/Rect [526.677 114.364 539.579 123.387] /Subtype /Link -/A << /S /GoTo /D (subsection.11.4.2) >> +/A << /S /GoTo /D (subsection.10.4.2) >> >> endobj -3248 0 obj << +3321 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 283.069 512.306 292.092] +/Rect [526.677 100.815 539.579 109.838] /Subtype /Link -/A << /S /GoTo /D (subsection.11.4.3) >> +/A << /S /GoTo /D (subsection.10.4.3) >> >> endobj -3249 0 obj << +3322 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 269.52 512.306 278.543] +/Rect [526.677 87.266 539.579 96.289] /Subtype /Link -/A << /S /GoTo /D (subsection.11.4.4) >> +/A << /S /GoTo /D (subsection.10.4.4) >> >> endobj -3250 0 obj << +3323 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 255.971 512.306 264.994] +/Rect [526.677 73.717 539.579 82.739] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.4.1) >> +/A << /S /GoTo /D (subsection.10.4.5) >> >> endobj -3251 0 obj << +3324 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [499.405 228.872 512.306 237.895] +/Rect [526.677 60.167 539.579 69.19] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.4.2) >> +/A << /S /GoTo /D (subsection.10.4.6) >> >> endobj -3252 0 obj << +3276 0 obj << +/D [3274 0 R /XYZ 85.039 786.531 null] +>> endobj +3273 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3327 0 obj << +/Length 3552 +/Filter /FlateDecode +>> +stream +xÚí[sÛ6Çßý)4}’Œwâ©“8IëN›¦±3Ý™nhY±5Õm)¹i¾ýâP$NÊÍfbÇ™N¬x~²xRéÿð¤æ¨¢j"k8Å“ùú¤šÜè_¾?ÁþˆSÈivÌÓË“o_p1ÁR•š\¾çQâJL.¯Ÿžm73RO ÷²ŸýqùãÉóËxâÌ5¦Ôœö?'¿ÿQM®u~<©Uõä~_!¬Ôd}Â8EœQÿyurqòk<—ûMœÕÐUpZ#^Óþe`ž]&1Å&’s$˜´×¡eH¢Ù)búf¿Ðo(›nßšW:=Ü.ܛ׳S<]¬·À“Íf†§Û;ównsÇ횶Y/ÌQxÚÎt¹ª©>7Sʼðª*¾@‡|œùN$2¡ÎöfâÞ¼Îì­N3³~€Ïm¬D¯Ö@ °ß–Ti‰D°õh°OÛ­ô»}„ʦòûÍ|p­Ä=bê¯,Ód0Íb 0í—` +ùÅF¬Òg$úh¦S®c@›þvþòÂ9u.ogØoKS/¯#Ióݹo¯Ú;OögógÛþi-nÜ¡/5àDÞ“ÆÓ¿Ì¡»¤õ}îƒ3x2€gW²¼_8ä7Vbým„}¾X9¢;ývçø7î% ÂUÝÖáÒ¨ÄÇÁ¹—·ŽÑXæÎàíã®ê"ë®W€sÉWdl*w†™xÌ âëÅnµœ7‡¥Î3Nk\*÷’®‹ÎXÀÑ +`œâ®TsÏ=@p`‹Zê¯p¢MC¥>èZ¬Ï}«á?×ß»æº]†X×j.ð£à6R™YY9Œ²JPÖè7tãÚ7¢œßÿ°XíÞjÄw+Gþ‡eOè΂< ”ŸA%>¢cU’Ì•d´•ôK¨ò› +Q¡Z«%ª$ôÿCÝË…ÎàdÌàôïËÍ“Ñ+“¯m[-²z:ß®´“³I ˆ`óOa;«ÓÌlv÷Ü.èU‘v¿mÈq¤Í$"œ%Ú! H øk×öoWw¦¯°É€áûK{2s=6$_\OàÑøÅžÌìè—±÷‹`‡Ç®€R$«ˆ]ú®àrVÓébnªô­©ì:û[9ür4øÒŸ–‹wÝý•þÖÝ­bÂ` ùŵÿžŸãXm$3@D¸¨~m@Žc“@*„9OÚ@g^& îïvn,h{™Ö[A,}SqѬá•&rN¾œ–Áj,ýdÐï@(Óï 9Žô+ô¿D?t®?¿Z-ÖzG¦g0cÓ3ðŠ<Ža¢Çä£5VÉ @‡)J _@ã ®(ª¸L jšy»ÝïCcp•Mï¹A#•_(ÿª‘ü3³2ÿ.Zâ?P„2Ð1.9àR!^ÕþxjzV«é¡‡7°M +è2ü0A`Ú{»ÓQ„™LXÜÇ,MpB2?úAÃ;“z˜„ýôŽ~->Xƒ±`“¶ß2Ø~°ãõqÁ‘âlí³¾³íÚpX‡ÌÞLý´­íÈ AL¾þ%â£9V"É H‡Tq©g €D DZíçDKE%‰„ä/V{ÆÈtÞlÌÛåÛ¦Þ|ùï +s3´¿u¿nÓoYh~z¹8<5’;7Ê ÷ÝÆ8Í;Û|4n’NñniO¸Õ£P{TÊ?M{ðˆŽÓ„2{Q§˜Æµ“èþ;3R}ð‚üDzÖB©G§2É +P³;æCbîù´ xR&QŒ“”C&ûó{ßM­–~ë„ûÜ.ò!Œï¼¾¹¼]ìǶÙú“Ì·]˜ÉîÚŵ_êÞº×ÕrÈÎeôÜ´VÄö@2m}F}×ÆM öÈo4ЊìüµŽ…—Ìz8–ñõ‹ðƒG€#)HòÐsßcº%Hßy½Ù4&ÁXùÉ«ù+;zIsáçlÅÚ$(n5Z: üé¾_´ÖÖgøUW±È“€¼ù2ò~zÈ•×h ÆÕàΡžèôRçšÙŒ%©ú Â1¶h¦sRlúd>ßÞmŒ„œžoÞngÔNJêœÆ®n…,Ó&8úgî«æªÙÏl ë…¸²×—• ­;.þñ9]h‹ë¼Ù¹ú! {±ÀÝdǥ̙¤H† Hl;{“¾˜ÕÌu®ÍÁ,ó·yvßl|«öÔ~{¾Ù3 §Räñæ…!¦#+ffV®˜^€zúE(·Å ãÐ3Q!Rñ$”8)èµ?íPÓ^{‘œEl×;·º|ejßjiÛWßù> I^­ÛÙ0~´ LvÌñ°R§±È“€<<€¼_9ä8"g .ò¸4&þû?EøãÍ£CÜÆŠ!™bÈ™TÅUá"b€ÇŽ‚R„+Ä@>¸`tn>¾µyÔÚu$¡®©xăãXq$3@FÅÕÄ"â€Ç–+Äy&ŽÐ9œ¯ÃˆÊn3Ê[/·‡”TèîJ¨óî»°z”müœÛÑPì=$U²YðAK>™ä;ÊäûEÈCŽÃT1«ªÂT¦'Ÿ¦ŠŸ\ÿ5ã"ponûÝc6oß›,á†ÁtújFÔ´±#ß}™žE9îKÙcY&3€e'¤ÅeŸ",!Ç%UÄѺ,É?diïÅØœÆ4`ö ¼ßÂ4ˆÍ‡¨2þyfùÃ%䘙•9vÃYä8P„2GÐqh©¬‘ cœöjì*}¾n÷fæ±Î]íÃ!Óõï°4#ºE»»;ì2Oš#YøCí¯?»‰\» |`ŸX3¾yyþ/3fWÿOŠî‚ÇBŒVÃ<”e„=ÿAÀk(8¢"#HË϶ë¸nóæü™­\ß~oߘ¯ÂOÏ–ûC»4cw±6þìF_·ËM¶¿—ÕäÓÕ6]cA%3€T'fÅ5µ"¬ Ç!1¦£GXÔ'ÆO涴ùLJ{˜­'ÍF7Ÿ6)îL?Û\Ú-¦nW~ᜋG‘‡ ŽUF2”ÑTVF¿€2 DZë£I˜D5ÊYñåí”âÛ¼ÎË+‘VvdŽß¯¯v3nzËý»kwp÷â¢RøƒÃúmcÛ]íCŠ;¤* ÄÇr¬@’ §²@úE9Ž! IL“@È?ˆUÇõ•ù»°oõð¨/Ê‘P² ®Ûœ´†RïXÑ$3@4v¬(š~Ñ@Žcc¦âDœ±g¾¿ye§_÷¶ÿ÷»ñÃ,}>I·¹v‹>Ó×mž¤èX•$3@%XÅu´"*‡¦…(‰æI%¡ïye2‹&lÌuÓwë„(òu;DG!„#u‘™•uÑÅSÔÅ@ʺG]Ô U"ÓEèrökÓH\å#ôëνÝcçjü¸£9˜UV³…Gò{ÄÖ‡a,Ûd°í„¸Ì¶_€-ä8²•âX$¶aØx0þÕ¾q ⧪3…öµÆ'r>€cU‘ÌUtàoå(  +ÈqTH ™TÁ¼*VFÍnßhIpB¿JbP>zc%‘ÌItÈ”%Ñ/ Èq˜è%Œ"†ëŽ$Ò¤ý…}®ÃÎ-Ç´q¶è§g&|òÊßÑ·Á™Y +ÅTýc¡&3j'¶ÅÕú"P!Ç*Q¨êj˜½¿pS}nÖ©éìã!þù;«°B»¿]îºÛó]r¯_˜3¹„V2LíÛy«ýòo·ËÏkIÊÇÂñ×1N2àtbT†Ó/rá`(>†C=œ_\e‹K'ݪææÍ÷f:þÆnÇòÏä`Š>¬ŠçÃ0–m2ØvB\Ü1P€-ä8²­’ò-óhÏ7K{Ót³Zm9í’¾6ÉrLÀMÎ\‹ûNÔ]üX Ñ +à™…•W´ûþš€×× +‚hrOó,ßÛ߶”ÝÞ€«ª~øyOˆÃH°™Y™l'Ƥxkë@ÊlAÇ®äHHrW„nÛк¾KÅíÿ±“ü¾µk9;ÿýÚ-â„ÕRÛÙ‘Î} ¿Ø±“@0$@°_€ ä8aBÊä,,BÛCvöšÆ…‘pãE¨®f‹Qcs¢¡õ:IØý«˜>c±&3k]R\î(€r±2}´<ÆZ{¬ÝNÒòó “E¶lüs‹šÃÁ’÷«Ü¾¢¾Ýúf k¦¸ rÝ^÷«» âðò—6–W2xåa#Å…«"¼ Ç‘å¨"숗ò¼žÿkÕ.»ç§gç/ü¶/òv…ûk£DËÖÍZÔŸ–¿®±°’+). €9Ž°ˆ~•üx´_é¿X6Ú›§­š1£½ùi³ÜÇ1‡xX™Œ¿ü±L“À4-áE¦ý"L!ÇaRW)’Mõòtk#ž^üú“y‹¯Szƒ‚ð±+ˆd"ç¢_@ãPÉ•Ù";zH3zgíBWÞ0VÉÇŸý§ä­ÂH²Éª 6/)®éôý—±B^ÕºB59¦JÀÁ¨P¢ûÈŒ$¬Ê¤ó˜—I÷ý—IC^i!‘õé0?ø¦÷˜”ݪYÆŠ]¿wEïväa¨Ï¬Ž¶f›ž"ÛšÝKÔÿ6¹XzP’»À±ÏIŠVÀc’²ÐY~Næ±ÿâmµ§£zèٿ毨ÄGý¿²[t‘ª?ðPâ1ês|`ó¢=(+ñäHßðendstream +endobj +3326 0 obj << +/Type /Page +/Contents 3327 0 R +/Resources 3325 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3382 0 R +/Annots [ 3329 0 R 3330 0 R 3331 0 R 3332 0 R 3333 0 R 3334 0 R 3335 0 R 3336 0 R 3337 0 R 3338 0 R 3339 0 R 3340 0 R 3341 0 R 3342 0 R 3343 0 R 3344 0 R 3345 0 R 3346 0 R 3347 0 R 3348 0 R 3349 0 R 3350 0 R 3351 0 R 3352 0 R 3353 0 R 3354 0 R 3355 0 R 3356 0 R 3357 0 R 3361 0 R 3362 0 R 3363 0 R 3364 0 R 3365 0 R 3366 0 R 3367 0 R 3368 0 R 3369 0 R 3370 0 R 3371 0 R 3372 0 R 3373 0 R 3374 0 R 3375 0 R 3376 0 R 3377 0 R 3378 0 R 3379 0 R 3380 0 R 3381 0 R ] +>> endobj +3329 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 215.323 512.306 224.346] +/Rect [526.677 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.4.3) >> +/A << /S /GoTo /D (subsection.10.4.7) >> >> endobj -3253 0 obj << +3330 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 201.774 512.306 210.797] +/Rect [526.677 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.4.4) >> +/A << /S /GoTo /D (subsection.10.4.8) >> >> endobj -3254 0 obj << +3331 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 188.225 512.306 197.248] +/Rect [526.677 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.4.5) >> +/A << /S /GoTo /D (section.10.5) >> >> endobj -3255 0 obj << +3332 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 174.676 512.306 183.698] +/Rect [526.677 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.4.6) >> +/A << /S /GoTo /D (subsection.10.5.1) >> >> endobj -3256 0 obj << +3333 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 161.126 512.306 170.149] +/Rect [526.677 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.4.7) >> +/A << /S /GoTo /D (subsection.10.5.2) >> >> endobj -3257 0 obj << +3334 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 147.577 512.306 156.6] +/Rect [526.677 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.4.8) >> +/A << /S /GoTo /D (subsection.10.5.3) >> >> endobj -3258 0 obj << +3335 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 134.028 512.306 143.051] +/Rect [526.677 673.356 539.579 682.379] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.4.9) >> +/A << /S /GoTo /D (section.10.6) >> >> endobj -3259 0 obj << +3336 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 120.479 512.306 129.502] +/Rect [521.223 659.807 539.579 668.829] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.4.10) >> +/A << /S /GoTo /D (subsection.10.6.1) >> >> endobj -3260 0 obj << +3337 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 106.93 512.306 115.952] +/Rect [521.223 646.257 539.579 655.28] /Subtype /Link -/A << /S /GoTo /D (subsection.11.4.5) >> +/A << /S /GoTo /D (subsection.10.6.2) >> >> endobj -3261 0 obj << +3338 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 93.38 512.306 102.403] +/Rect [521.223 632.708 539.579 641.731] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.5.1) >> +/A << /S /GoTo /D (section.10.7) >> >> endobj -3262 0 obj << +3339 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 79.831 512.306 88.854] +/Rect [521.223 619.159 539.579 628.182] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.5.2) >> +/A << /S /GoTo /D (subsection.10.7.1) >> >> endobj -3263 0 obj << +3340 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 66.282 512.306 75.305] +/Rect [521.223 605.61 539.579 614.633] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.5.3) >> +/A << /S /GoTo /D (subsection.10.7.2) >> >> endobj -3212 0 obj << -/D [3210 0 R /XYZ 85.039 786.531 null] +3341 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 592.061 539.579 601.083] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.7.3) >> >> endobj -3209 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3266 0 obj << -/Length 3477 -/Filter /FlateDecode ->> -stream -xÚíœ[sÛ¶€ßý+tÞ¤™#„¸ñò˜›3éÄmNíœd¦§´¬ØœÈ’ŽDÅÉ¿/n @"6“&±;™NcŠâjý°ÀbŽ2õ•’d¼eN$§£ÙõQ6ºTß¼8¢î‰©{d=óäìèÑq.F4#UVÎÞûß©2"«|tvñÇøéj9aå¸Û?ÛÉŸg¿=?ó?©¦œëŸýÿÑf£ U„_Ž2«rt£®3B«jt}$$'Rp÷yqtzôÿ[ö;1²R}µ¼$²äÝjPUƒ–%É‹|THIrQ˜zPJ‘dBÇ‚L¦¢¬Æ/æmÛ,ÕËÉ”s1Ö—«åt6™ª¿ õaw½ÔßðñEÝÖöêýF?tmÚ+õaî®ëó…ýÄÊl¬5T•þ#³¬û§ï»³ŠJJ„*tŒ±¹Ù‹ß#ó€Ô4ëšçð·y²â°R™LY¸§],öÑ´Zªèy1*#™âë©äÊ<ÏÇïN^)óUtÝîòÝWŠƒŸÆh;Ó ¥Ä´c³ã´»%Ài§ÔRæ|Pý•¢ÚʧLÕ­\k?»^9{®œg³Yi÷Úª;”ýxìß Õ`؆bb ì±ýqìÝàØSj½“«»9uþf;×Ð7[ËÜô´µk¦÷mmgª{ÒÕ%4©½ ®…èÛ>ÏÇ{òT}W_OX1>×Wö)}óñ‰âQ°o@NUs(5+’ ¦ÃiíkÅIaª<¥Lõ¿(ÖªÞ¸Qî\9o16ß5ʬËK÷ýÅ…ûèøÂÞiWîo4DÞlV p^Ït4ñAÿcÄ4ý‹0Ø|[ý…ú6¯Š/„ck7”—J Šì†Sê¨ÇA%t«¼,Ô-`q«ÞµÊ\WÖz¦W·W+CêÂyŠÆ£ï8k;¬Þn´Ë˜¾÷ÃdZÉò¾`‚D#1éžy³aÚS‚T^2’s1R㜂ÚÇÂè8ÍsN„à¾l,‹ÑS¦”²tµ -0ˆ%Æ–ÄvK€L©…îVæ%‘UÅÏÔ^vg£¡ØƒX{l*1ìÝàØSj½ßJ5·vèz›4P¼¤âýÒçìÔœJu¼Ú½êŽdôgëÁCÙ±ÛØÈ8Ûn p¶)µž­ D² %{¢.O­¿m–6¿¤â§›(½ôb³Ò¨µ#ݸÉUpvW13 ¯ÝZòLÞÎÄT`(Jð†ÁiêþºÔ¤…ÆÒ©!xÈ”ŒÛÔÐqc–"ÿm3<ÏšÍ|ÖštÉõ|>H^™ ‡ù~no=žÍæ[—6RÁs»ñK¢X–(*ë²DÉšü¢5yŽ™<üÒ×d‰$U”½e¸Ë8Q…SÿÌõ; ³ÒP b 'Œ àm¢[¼SL©𢬔z²DÎÍÜ*Ógȵs·=@y‘IÆo}ç&ün -ÝNVºOô!€`™°#1öžÕ)¶ÈÒSvR-Œ€¢È ‡L$²A'0Ü™‘Ð ]ÅøÆ‘ýõìØ lOMoy½®Ír a𠬚µn©æͲùd¯Žõƒ0cÕë•ŸmK‚ãZw¢¸3W…¡T‚X‚JlœJ·8•”ZO%g¤„Ô ¦‘ÉI­ûÕú²¥E5ÜÙÔ¨·iŒûeîåj=dK€Œ-J±õ®žà Sj=HQ涖°Š¹×›ú¡óYcFTÓ‘¶f -ùÙw®v)ó cU½ªNÙä÷ž«êPzA,A/6#N¯[œ^J­ ¹$ìã>ÁzªWùý&gβi]¾•)lÆ1Qtf ,Šüø§3ÇPÂA,A865Ë0ÂÝà„Sj½25âUáý;.umØ€ › vM$¼»/Ÿº¤+« `ÓÓû„ÐÕw( –@ÛGØ-Ž0¥Ö#Ì”³B6GyÕ]ìk Íï¹29½f«WBß>©·ñ–ïÆ:2Ò UY¾/W¹¡¼‚X‚Wl8œW·8¯”ZàÅ+5 …4žæCâIs -Ûa.4¾z9_í{N09ì!Æ9`P#1êžuE ö”…šT #%/)‘>^…Ôø¦„úæ*ÚÑxUûˆV§L9øIg¡¼½TwdwœvG=;¡Ó;p^’ ¶Žñ(!¾õ÷§0+ôÝê‰qòúrn·ò¹Æ¡»’ûç·®âC9±Èب Û ÒSeJ-áRgf÷YÒ1uGFÞšø…ÍYû‰¿°ou"pµùàAukÁ>:o>š­®:z’ì›cquŠ%ˆ%°ÄöaØÎŽžàXRj=¡o±,,…eÙ§Gï^ë%ù}þ\å†ò -b ^±áp^Ýà¼RjýðÇ -Â¥O™Â©ÞZ¼üsËÄ^˾j¶­Ï°‡YHȦ½ôã©ílWk»k}SŸ›uǦÕßÖ;åsµ -,ˆ%€Å–cØZ~O p`)µ~ S”ÊL`K°½ùõå;{µ¶;Ê7×0Œ™Í5[8®á%~= ™M›˜3{7<; ©«K—|( Wô¡4‚X‚FlœF·8”ZO#Ë ác8˜ñßf~ãízìrÆ*Lœûýª›=³BéŽ/žêÓ1åø>úøD”ô;÷y®†C¡±´Øz [­í)-¥ ±2'E–h¼šNŠEÓp»†à×7<\™ígʈ´zˆ3:°Å@¼‘ŽwÏÎ(Þž x“j=Þ‚*#¼"í“«_pÉ=Ümœc¾ž@×é÷—ÛÜgVý`®vC±°Ør8°n p`)µ32Y‘<+ö€…P~/†Ò âžM¶1|®®Cñ±¾ØŽ [uï)Ž/¥Öã9Édy€Bþƒe¾ŽWí$²¸‡È\ý†" b d±ípdÝàÈRj}É‘YI"ÝqÄæ½N/ÇûÈÜ,~C§y%¥!–︪òÇ`tuŠ1ˆ%0ÆöÄ1vK€cL©õiIªh ƒ÷3¸‰•šHÍZ‚â¦ý ñYßm[›é]½¹èù\¤ºî¾‡~­5³Ž…½s]‡`˜ÕŽó<*9‘\UUy3‘:[*Mã2ÏîÕRo (K÷¬rH°.箘«÷ZX‚”JtªÇwΠ^,ºcH4FøÜÞK8˜µ3¯ñ¸ú—β?¤î kõ’Fg#±D«wÙæ‡m.è)Á-‡ªô!6’"Ê\õ"€‡LÙÄÞ!{ Àø}>³' ÜçWºKËƳ.6è?⧒E>øEkMl7ú¥¯9@•¡µÁÓ!‚ÞÍY)ñótâaÎJC=,ˆ%<,&€·‰n ðq%¥ÀWÉeܾBâÖ6à 6° )¼Ä(ÐÐUòOé„°B¿÷2+~[Û=‘j|4‘C»[šã6 -°¡„î^Ù÷2Ít´ðÁ,‹ºLòonËÀǺ†›É´ÀWǾÿpéª>dÂAÆFåØÞ®zdJ§Y(#Rîƒ Ùbó*ãÐ ïÑšËGÀ-\ -r‹lƒ +mF¸*Øy¿¤­ãà÷ ‚Tê5ƒÁz\ o> endobj -3268 0 obj << +3342 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 754.651 512.306 763.674] +/Rect [521.223 578.511 539.579 587.534] /Subtype /Link -/A << /S /GoTo /D (subsubsection.11.4.5.4) >> +/A << /S /GoTo /D (subsubsection.10.7.3.1) >> >> endobj -3269 0 obj << +3343 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] +/Rect [521.223 564.962 539.579 573.985] /Subtype /Link -/A << /S /GoTo /D (subsection.11.4.6) >> +/A << /S /GoTo /D (section.10.8) >> >> endobj -3270 0 obj << +3344 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 727.553 512.306 736.575] +/Rect [521.223 537.864 539.579 546.887] /Subtype /Link -/A << /S /GoTo /D (section.11.5) >> +/A << /S /GoTo /D (subsection.10.8.1) >> >> endobj -3271 0 obj << +3345 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] +/Rect [521.223 524.315 539.579 533.337] /Subtype /Link -/A << /S /GoTo /D (subsection.11.5.1) >> +/A << /S /GoTo /D (subsection.10.8.2) >> >> endobj -3272 0 obj << +3346 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 700.454 512.306 709.477] +/Rect [521.223 510.765 539.579 519.788] /Subtype /Link -/A << /S /GoTo /D (subsection.11.5.2) >> +/A << /S /GoTo /D (subsection.10.8.3) >> >> endobj -3273 0 obj << +3347 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 686.905 512.306 695.928] +/Rect [519.586 486.307 539.579 495.875] /Subtype /Link -/A << /S /GoTo /D (subsection.11.5.3) >> +/A << /S /GoTo /D (chapter.11) >> >> endobj -3274 0 obj << +3348 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 662.447 512.306 672.015] +/Rect [521.223 472.758 539.579 481.781] /Subtype /Link -/A << /S /GoTo /D (chapter.12) >> +/A << /S /GoTo /D (section.11.1) >> >> endobj -3275 0 obj << +3349 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 648.897 512.306 657.92] +/Rect [521.223 459.209 539.579 468.232] /Subtype /Link -/A << /S /GoTo /D (section.12.1) >> +/A << /S /GoTo /D (subsection.11.1.1) >> >> endobj -3276 0 obj << +3350 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 635.348 512.306 644.371] +/Rect [521.223 445.66 539.579 454.682] /Subtype /Link -/A << /S /GoTo /D (section.12.2) >> +/A << /S /GoTo /D (subsection.11.1.2) >> >> endobj -3277 0 obj << +3351 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 621.799 512.306 630.822] +/Rect [521.223 432.11 539.579 441.133] /Subtype /Link -/A << /S /GoTo /D (subsection.12.2.1) >> +/A << /S /GoTo /D (section.11.2) >> >> endobj -3278 0 obj << +3352 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 608.25 512.306 617.273] +/Rect [521.223 418.561 539.579 427.584] /Subtype /Link -/A << /S /GoTo /D (section.12.3) >> +/A << /S /GoTo /D (subsection.11.2.1) >> >> endobj -3279 0 obj << +3353 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 594.701 512.306 603.724] +/Rect [521.223 405.012 539.579 414.035] /Subtype /Link -/A << /S /GoTo /D (subsection.12.3.1) >> +/A << /S /GoTo /D (subsubsection.11.2.1.1) >> >> endobj -3280 0 obj << +3354 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 581.151 512.306 590.174] +/Rect [521.223 391.463 539.579 400.486] /Subtype /Link -/A << /S /GoTo /D (subsection.12.3.2) >> +/A << /S /GoTo /D (subsubsection.11.2.1.2) >> >> endobj -3281 0 obj << +3355 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 567.602 512.306 576.625] +/Rect [521.223 377.914 539.579 386.936] /Subtype /Link -/A << /S /GoTo /D (section.12.4) >> +/A << /S /GoTo /D (subsection.11.2.2) >> >> endobj -3282 0 obj << +3356 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 554.053 512.306 563.076] +/Rect [521.223 364.364 539.579 373.387] /Subtype /Link -/A << /S /GoTo /D (subsection.12.4.1) >> +/A << /S /GoTo /D (subsection.11.2.3) >> >> endobj -3283 0 obj << +3357 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 540.504 512.306 549.527] +/Rect [521.223 350.815 539.579 359.838] /Subtype /Link -/A << /S /GoTo /D (subsection.12.4.2) >> +/A << /S /GoTo /D (section.11.3) >> >> endobj -3284 0 obj << +3361 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 516.046 512.306 525.614] +/Rect [521.223 337.266 539.579 346.289] /Subtype /Link -/A << /S /GoTo /D (chapter.13) >> +/A << /S /GoTo /D (subsection.11.3.1) >> >> endobj -3285 0 obj << +3362 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 502.496 512.306 511.519] +/Rect [521.223 323.717 539.579 332.74] /Subtype /Link -/A << /S /GoTo /D (section.13.1) >> +/A << /S /GoTo /D (subsection.11.3.2) >> >> endobj -3286 0 obj << +3363 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 488.947 512.306 497.97] +/Rect [521.223 310.168 539.579 319.19] /Subtype /Link -/A << /S /GoTo /D (section.13.2) >> +/A << /S /GoTo /D (section.11.4) >> >> endobj -3287 0 obj << +3364 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 475.398 512.306 484.421] +/Rect [521.223 296.618 539.579 305.641] /Subtype /Link -/A << /S /GoTo /D (subsection.13.2.1) >> +/A << /S /GoTo /D (subsection.11.4.1) >> >> endobj -3288 0 obj << +3365 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 461.849 512.306 470.872] +/Rect [521.223 283.069 539.579 292.092] /Subtype /Link -/A << /S /GoTo /D (subsection.13.2.2) >> +/A << /S /GoTo /D (subsection.11.4.2) >> >> endobj -3289 0 obj << +3366 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 448.3 512.306 457.322] +/Rect [521.223 269.52 539.579 278.543] /Subtype /Link -/A << /S /GoTo /D (subsection.13.2.3) >> +/A << /S /GoTo /D (subsection.11.4.3) >> >> endobj -3290 0 obj << +3367 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 434.75 512.306 443.773] +/Rect [521.223 255.971 539.579 264.994] /Subtype /Link -/A << /S /GoTo /D (section.13.3) >> +/A << /S /GoTo /D (subsection.11.4.4) >> >> endobj -3291 0 obj << +3368 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 421.201 512.306 430.224] +/Rect [521.223 242.422 539.579 251.444] /Subtype /Link -/A << /S /GoTo /D (subsection.13.3.1) >> +/A << /S /GoTo /D (subsubsection.11.4.4.1) >> >> endobj -3292 0 obj << +3369 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 407.652 512.306 416.675] +/Rect [521.223 228.872 539.579 237.895] /Subtype /Link -/A << /S /GoTo /D (subsection.13.3.2) >> +/A << /S /GoTo /D (subsubsection.11.4.4.2) >> >> endobj -3293 0 obj << +3370 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 394.103 512.306 403.126] +/Rect [521.223 215.323 539.579 224.346] /Subtype /Link -/A << /S /GoTo /D (subsection.13.3.3) >> +/A << /S /GoTo /D (subsubsection.11.4.4.3) >> >> endobj -3294 0 obj << +3371 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 380.554 512.306 389.576] +/Rect [521.223 201.774 539.579 210.797] /Subtype /Link -/A << /S /GoTo /D (section.13.4) >> +/A << /S /GoTo /D (subsubsection.11.4.4.4) >> >> endobj -3295 0 obj << +3372 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 367.004 512.306 376.027] +/Rect [521.223 188.225 539.579 197.248] /Subtype /Link -/A << /S /GoTo /D (subsection.13.4.1) >> +/A << /S /GoTo /D (subsubsection.11.4.4.5) >> >> endobj -3296 0 obj << +3373 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 353.455 512.306 362.478] +/Rect [521.223 174.676 539.579 183.698] /Subtype /Link -/A << /S /GoTo /D (subsubsection.13.4.1.1) >> +/A << /S /GoTo /D (subsubsection.11.4.4.6) >> >> endobj -3297 0 obj << +3374 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 339.906 512.306 348.929] +/Rect [521.223 161.126 539.579 170.149] /Subtype /Link -/A << /S /GoTo /D (subsubsection.13.4.1.2) >> +/A << /S /GoTo /D (subsubsection.11.4.4.7) >> >> endobj -3298 0 obj << +3375 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 326.357 512.306 335.38] +/Rect [521.223 147.577 539.579 156.6] /Subtype /Link -/A << /S /GoTo /D (section.13.5) >> +/A << /S /GoTo /D (subsubsection.11.4.4.8) >> >> endobj -3299 0 obj << +3376 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 312.808 512.306 321.83] +/Rect [521.223 134.028 539.579 143.051] /Subtype /Link -/A << /S /GoTo /D (subsection.13.5.1) >> +/A << /S /GoTo /D (subsubsection.11.4.4.9) >> >> endobj -3300 0 obj << +3377 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 299.258 512.306 308.281] +/Rect [521.223 120.479 539.579 129.502] /Subtype /Link -/A << /S /GoTo /D (subsection.13.5.2) >> +/A << /S /GoTo /D (subsubsection.11.4.4.10) >> >> endobj -3301 0 obj << +3378 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 285.709 512.306 294.732] +/Rect [521.223 106.93 539.579 115.952] /Subtype /Link -/A << /S /GoTo /D (subsection.13.5.3) >> +/A << /S /GoTo /D (subsection.11.4.5) >> >> endobj -3302 0 obj << +3379 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 272.16 512.306 281.183] +/Rect [521.223 93.38 539.579 102.403] /Subtype /Link -/A << /S /GoTo /D (subsection.13.5.4) >> +/A << /S /GoTo /D (subsubsection.11.4.5.1) >> >> endobj -3303 0 obj << +3380 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 258.611 512.306 267.634] +/Rect [521.223 79.831 539.579 88.854] /Subtype /Link -/A << /S /GoTo /D (subsubsection.13.5.4.1) >> +/A << /S /GoTo /D (subsubsection.11.4.5.2) >> >> endobj -3304 0 obj << +3381 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 245.062 512.306 254.084] +/Rect [521.223 66.282 539.579 75.305] /Subtype /Link -/A << /S /GoTo /D (subsubsection.13.5.4.2) >> +/A << /S /GoTo /D (subsubsection.11.4.5.3) >> >> endobj -3305 0 obj << +3328 0 obj << +/D [3326 0 R /XYZ 85.039 786.531 null] +>> endobj +3325 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3385 0 obj << +/Length 3279 +/Filter /FlateDecode +>> +stream +xÚíœYsÛ8€ßý+´oRÕ +!.¹œÊÔ8•];›TÍÎmÑ2+–ä¥èñäß/n€Ñ3ÌQ±ÔTÆ:ØB³¿F£Ñˆg™øÏJŽ2ZÍŠ2GœâÙÅæ(›­Å7¯Ž°¹bi.Y×<;;zrÌóÎP•U³³K÷;U†x•ÏÎV¿ÍŸï¶ RÎûFÿÙ/~?ûåèå™ûá iL©üÙÿýö{6[ ~9Ê­ÊÙx!\U³ÍãqFÍûë£Ó£¹ßÒß±™–» NKÄKßæÁmà#–ÑYÁ9ÊY¡î‹G uîMàx·o¤ƒt{í*Ú×ÆYÔÐë€.£ùn-ݨ¢?H˜æšÊ_‹ì-€û°Y€yª1Ç[††9G~.ÇèyÓn×ú}½¨WÍJ¿ëwšÿéí5çõÅ‚ó2j¶æR)'2ƒóZþ~U”ßž¾÷©üœ€0°*@1j ´jYæe!>Â&50ëÛ^˜ýJP±¾é¯3Agµ×è$—†,¿7Ø·ºgÓù$©F„/~ϵƚH?K〠UŠÿˆ +‘0Z \ÎÄ8-ðç÷vt_æ9EŒQ§ÉâiŠ½F«&ŒT±ùI}s£{¶ð•“Sù·˜¿oì­ô…ÕnA±ðãÒŸTo½{óúƒ~õªÛÝÞèK"ƒgún½v ¡õÕðÍþ¦ºš% í+6°™?- žæbŠD s¬œU¨Ñ›ëxQ2ݵêþVæWa7«mt|¦>ÝêIžÿ7ÃL¼ÈeU‘7Ó²6ÚW½ÐWC^€ Å*¤ƒ5Ø°sš#ê 5ðJGyÑîU~u«³oñ¿V&TŒå÷”ø½tcÛ©ãŇ ¹Qœt˜XÀa †Ýð.(ªÀalzþòO™T©qýF¼º6å•ç»­ ëÛN¥]Ê“ª’>ÒdÜh*u/POI’z¬@jØ…‰¬B„å–:usö® «o=ˆœ^tí6()cÁ©náÅ·éPšt‹XÀ- †m0àGyUx·°Áà´Þ„A@ !9;—u\]¨• ƥșÔc­æn2‡“ïô$?joÄ |`‘ÀZg"ò@,|`ù4òÒÈÁ†òR„|Vzäv®.;¼ uÓgãñßx„ÌÔåÕúb‘ûË7®¦_ЇÚØd*h/€í €ŽU@C ÛÏsque‹ˆý,Ó~‘‹kNu/¸HHŠ²¤‹Ä*.5ìbsR¸ˆ ÿOW²’ãêt¯lT7sM5Q_Æ‹kñ 'ø‡¨ÓZ{Mu/8AÈp‚XÀ  †0Œ¸w2CÉü}»ÕE>‘ ÜÅ;ÿУÇd1Uߨ[éSyÆ¿&9u“S¹Y!€š7Àì°q€XºIÇ‹¨âØ£1¡Ç“c^ÂETÈfJêÅnS·2üóRV軽´V`TÜXšýU3òÛTÖ¼ˆ¹ôíNám:ùóÅübÝèÑ%n%gHŒTZrí2 +^òoÛÙSNb,;ÕM¼à(!5ÀUb¾¨˜Ë3*œ.æÚk´jº˜{ܪ=ÿÔeÙm×\ôª€ÛI ŸlWvMúx¥Ê’êšF‹=½¸hö¦Ø+fš}çöw$Ë»¾§¼ ÞÞáoêûË“¦÷¿—w XÞåÂô´ÀpnÆÊ +U®âü³¼û5B¼µéÄÞˆ¥{ïWÒ…FTH‡z°aç(E®·q[Þ5ÝSš§Ÿö}c6F‰.§ÂïÞ9sûȤCíäÐÊ0þ1<ÂoªGx1À#`Š¤GÄ*5l‡–TºÂqP¿Õ©¿WI€É¶Šùñ‚7gÇ&{®Âðæ¦V…™½ªq[fô½Yâ5Ër*-ßØZЩxóIùWoCÐF:+¾As³S z1€àÀi‚± +A¨aGUˆT¹'hSî“Zõzí’n1îZ‹á·kU·Î2ú¸gYÖ>S¡{1úÀöÉ5õèPÃ:娰û8%t›µB¹ã_´jøWÁ¼WÅ™O.Àë¤à ¸‹È. ¬ùÃ"mŒ2•´H ž&«†vC¶P»Ê®[j9•[–ë΀~ÑÈ´Mv÷V¯§ÉÀüTáNóU#zQänœ6›ê^ pƒK®³Ž¨¸Ô°ëðY‰rW÷ –V잸AVO +êÏÔ$@_¹ +‡má •ò5à‡ài¦òöbïÐìïX€7Ô°åM+1tEÜ`]eb€+7vÝLÕê۽ܽa³Ð+¨2ß“NQäÅ÷dkÍ0‘m –f;0qšíˆ +i¶`ÃŽm‰ç­»OZ»½FíkIºÞ6»ÛÃèméPFwòfL5¿“èøQû{ U;šÓ¼D™Ý„IÝ*4Ïö°Å‡n;…Ü:[»t^.šPú#•g¬!§z†\#„Ä’ÛjFTœjØ.k°w¸ýƒl/ˆé›v¿·mÓOTب×ÞUmÊ5rÜyÈ‘ÀØf*p/íÎ’‹ê#*À¡†í¹FÊäGdϱ9×ø^m€XéU.WwaúÅ{YÜÝuíÑÛýVON›îu¼A-š{„ÐÜíT„^ @Z@« „vI(§ €dÙŸO>¼•§óÇ3P3LeëŶ¡‰¶± +[¨a7Z  eæÊåöhâ_”FÁšŠ”ûµÝ÷{›À/\îí ¤¯]…]GùÝ:Ótõ¹Ú#Ñöò{‘á3ο9Xcƒ©`½6´/K®bŽ¨€…vm–!âSp¨0ª™Z(TN¥UPuC®Ú±h8¾Û;‰7g¾°­k­j£›c¦§kõõn-ËÜœ~;ræ&§’ób¹Ð€¹X€Ô°%GÊYîÉÙyñÚæÎ186Ë "QnÜÁ…n€ÀfÒæy§µÞjߺ„‹•ø¾Æ\k‹‰€±4àÓ€GTHv€ Š0Ó1À²Üiëàë°;›]©Â†¸zÜ“dk²©~àÅ?q0žôƒXÀ †ð +åYáý€Á}×¹E.S“ãrgzûÛ…Ýöô’¬mýí Ñw#kŒ0•¬ȆÈÆ*d¡†mÆLXŽ2^ÈúIÏ ¾c3«˜?ºNl¬2µP‡gÉý&#*¨¡†jJϪÔvrt°uÕašÅ‹×Xb*^/à ­ àUðB »KTC5·Y´9Æß^Ê…ˆÁ œ²{•Z»°³ž¨û3Æï;nm™©´;°9À:j@ ´êHg¢ïbOÚ>½ÉÌTÅÌôÂ.<Óù]k÷ü„ÖÚ÷µš+×Ýj4åv‡»ÌŽÅ&x2D½ÿh&aªæ]›ÇE„ùçô«€Ó7:œ“À&dÉýAqû8 U W•y@®øúäT2,Jö½:úu~Ûû5F}¬K>ÃA„ÎðWìqöF'’ ÄÒèFdÉG§Œ¨†6l P¸(Å®>œÿ> endobj +3387 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 231.512 512.306 240.535] +/Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsection.13.5.5) >> +/A << /S /GoTo /D (subsubsection.11.4.5.4) >> >> endobj -3306 0 obj << +3388 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 217.963 512.306 226.986] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (subsection.13.5.6) >> +/A << /S /GoTo /D (subsection.11.4.6) >> >> endobj -3307 0 obj << +3389 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 204.414 512.306 213.437] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (subsection.13.5.7) >> +/A << /S /GoTo /D (section.11.5) >> >> endobj -3308 0 obj << +3390 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 190.865 512.306 199.888] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (section.13.6) >> +/A << /S /GoTo /D (subsection.11.5.1) >> >> endobj -3309 0 obj << +3391 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 177.316 512.306 186.338] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsection.13.6.1) >> +/A << /S /GoTo /D (subsection.11.5.2) >> >> endobj -3310 0 obj << +3392 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 150.217 512.306 159.24] +/Rect [521.223 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (subsection.13.6.2) >> +/A << /S /GoTo /D (subsection.11.5.3) >> >> endobj -3311 0 obj << +3393 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 125.759 512.306 135.327] +/Rect [519.586 662.447 539.579 672.015] /Subtype /Link -/A << /S /GoTo /D (chapter.14) >> +/A << /S /GoTo /D (chapter.12) >> >> endobj -3312 0 obj << +3394 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 112.21 512.306 121.233] +/Rect [521.223 648.897 539.579 657.92] /Subtype /Link -/A << /S /GoTo /D (section.14.1) >> +/A << /S /GoTo /D (section.12.1) >> >> endobj -3313 0 obj << +3395 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 98.661 512.306 107.683] +/Rect [521.223 635.348 539.579 644.371] /Subtype /Link -/A << /S /GoTo /D (section.14.2) >> +/A << /S /GoTo /D (section.12.2) >> >> endobj -3314 0 obj << +3396 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 85.111 512.306 94.134] +/Rect [521.223 621.799 539.579 630.822] /Subtype /Link -/A << /S /GoTo /D (subsection.14.2.1) >> +/A << /S /GoTo /D (subsection.12.2.1) >> >> endobj -3315 0 obj << +3397 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 71.562 512.306 80.585] +/Rect [521.223 608.25 539.579 617.273] /Subtype /Link -/A << /S /GoTo /D (subsubsection.14.2.1.1) >> +/A << /S /GoTo /D (section.12.3) >> >> endobj -3316 0 obj << +3398 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 58.013 512.306 67.036] +/Rect [521.223 594.701 539.579 603.724] /Subtype /Link -/A << /S /GoTo /D (subsubsection.14.2.1.2) >> ->> endobj -3267 0 obj << -/D [3265 0 R /XYZ 85.039 786.531 null] ->> endobj -3264 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3319 0 obj << -/Length 3246 -/Filter /FlateDecode ->> -stream -xÚíœÝsÛ6ÀßýWèáfNš9¡Ä7ùt“ÆÉ5mäbgòÐë-)6'²å#©¤ùï߀D-\&qb÷2&Ååû‹Å2xR¨ÿð¤ä¨ ÕD–qŠ'‹«£br¡~ù×vwÌÝ-óäžÏŽ~x*ب*ªÉÙÛðœª@¼“³åoÓÇ›ë)§ýÊþÕÍ~?ûùèÉYxp¢Sªûߣß~/&KÕ„Ÿ -D«ròA}.®ªÉÕãqFÝ÷õÑéѿóìolb¥õ‚Óñ’»yÒ \–HH1‘œ#Á¤éfˆ ŒfxJÑlÎÊjúúºQßþ˜Í)eÓM«ÿ¦ÓçOÕµSûùñºq½¶ß-fs<]¬ôŸ]§ÿ\-í/O›µ³?¨‡åTéàE1ü‹UÕ¨ßö¬Í*†*{6°Q{1±^%VóRóDlhµýg«Q¶ßŽ1R†?Ђ!-{k^m€Å*ö]XÌÁ:ÕÞ̈œ~°&¯¯—êÊžÛëëvµnêsum½²HŸ¯z ïƒR·áé;ͬ üÎḞŒ…Å2pR+Áp†-€áäÔ8DÍ;VíÁáÎÉV›½oæ¯í¬pLŽëÞ©íUõ§`ü3Ì}G´\×ÆÒŠbZ©Ù`ZÃÀ´rj-uu—”p¤^Ÿ86šK_Û™rª¾\Ömâ¸$_Ìîw„Mõq,2+’ÁåíF9„jW+Œ R±}JÒQúÑ`ø ½WÝ:o¶yë–šY©W«…»üº3÷ªWÒ{Éör,§ •A•Ø¦5PËèôÌD)Õ%¼­tÐ-ßϸPë’º¶HƒƒÓúJ“<¯í×77³¹Y’zuçÖ!ÆAöÍÂÞñëFÝPª‡¨»Þ韯/ì/툨¯V½£nDi‰a¾Ñ#$b0„ƒ€´ÄU8H†('{*¿5]ר Õ†pmÓ7H½¶j..]Dg‘™è­>oÖúÖ^›ý£šO\ÞõôðË&ŠeؤF‚Ù [³É©Åı* êÙèX›06œÊÐ7f”›È¬ßêYÓ¸i`yiï¶3ô~&ø]I»QLeAîçóv‹6ŠeЦ6¦B;lŒ6§«]™r¢"xD8‹hÕ´›S!¦OþÐÓçJûIâoÅè?fêÊŶ5ᆙ–UI¿­¯HÒu{,É(–!™š”Jˆä°0ÉœÚà@©"Zì’ÄSìèqÓÕçëtÝyqcw_q.êX¾,î;9×ͱä¢X†\jB˜Ü°0¹œÚ@Žs¾GŽ€ä~Yµ×«µ§hÜ©Œ«J~S>®3cùD± ŸÔP0Ÿa `>9µaù+Rÿ{>Ì-'.£ôƬaK›ÊЩ »ÛÒÞò…^Cd¨7Ô×MçBB·zr^,/bÄ®ˆµùñZ%¢Š‘Ï#æº7–XËKMGKˆØ°0±œZ¿ªñŠ¢‚ËH̯joìFë]×»…ËÄò~ܾ׆¶q¾ý鉳µ¾®sLÈ{î}×GÒLÄ`š»f-šZÒ̪ 4e…xQFšÄÑ<])bŠÏMéïacà–'zÒYˆM’ ‘’9‚_‘®3ÅXºQ,CwÇÌ Ýa `º9µÞ»rÁQÅ]î¼ëK ¶sû.MÝ»\—ö‰m«½ëÙgèy]â{ƒòS0;›ŒÅÅ2˜wì!ÌÃÀ˜sjfN+B²Y8Ì7f‹qå}±ž®m»ñIL¾=·¯ˆÝÙh,ö(–Á¾cû°0öœÚà»i‰J©û…x6¥}P¿<·ƒ`ÕjþþèÊ4¨!Q_èTðâ®mïÇò Rœ©] Ds †™Ñ¦0áêÞ*•n -?ZêØ·1ñTÌǽ2îº^†Ð•“¿øäuÖ ;ŠehïXÄ=lÁ€7- ”M9ÄøáóxÏ[÷•iÐF"R} ’-¼`U‰$X±àìÈJ‰h,„ݼy÷Ö.·>vµaŒwæ´÷mZ|½Yåm7rV%bð¬Ú᎔-½hVmR->?ÈÍfFsh¦É´+—DÙ€]ìBa—‡íM·üåÀ;+Å2àS0øa `ð9µ¼()¸ïQÎf¥ -yl¢Çœ˜,üzl7?‹­-Lò{ý“?9~i܇=9\ôÝÛqsâJÝmÓ2;¦Ô7¬žÙÐjkÆ–w€Òõ{,Ê(–A™ÚF9lŒ2§Ö‡µŒ $¸ˆ(}\ûº ‰ºËMç6ªçµ=Ðw×ç)­b–¸úkë½ï©wßé±£X†cjP˜ã°0ÇœÚÀ‘*t…ŒIàèK0 ÀXðä*€~N-l*±Äâ!¦”¼ ÆRbª©yT*u 0ÕœÚ@Wˆó„*ÎÎÆUÀ¶o5Û4c¸;=µCÖtŃáé:?–gËðL ó¶æ™Sx>3©y²!O— ÔAQ»2塵>Yëœ=ûvÑÍ1vË8Še§Æ†[3ΩõŒiEÔ†´ŠŒ9Èø™ž˜/Üdz3¶ uŽúÛÒÖwÔuÁ¨ïýH ‰ tDz *:ÐhVm*KTáÈS8žÏÏ~=yOüq²f»ÓôŽZ)ñß¡®÷cy© ÎÄ®0ÍzfF§ß¹P¡ŠÓŸ€¿¾¹05@ËôðÚT…I2é´þ¿ÈSx Å2ÄSë3¨4ì@ `æ9µ:ǨÄ:ÿ~bs»³ÑXìQ,ƒ=µ?Œ}Ø{NmðÛ´DDˆÝomOmµ§«YQC`Ý:•5îºÄ•¸»a’›Ù²]lvÈÿp;¬­©Ò5"ýe\̯ïû¸ðÝ=~’jcÆËò1º>ÅÅ2S{‡-€1æÔŒ„!‰iÄèw¶o.Ý:«Í¸¨žm·S|®SD‹Erðf¯i0›+g5mÜovª+Òw6gØMo}qüªíþ9›KÂ?‘šëâXjQ,C-5LmØ‚Ï;q¡EHRvðÄÅßdÚ&ì‰Ë³kµ•]n®êæÚb>›UÊà[“‚rújeÊáû˜Gì.››8•Išñ'Ne²Þ{¢µ'Tº—<)*“–T%Âô–l,)’¾4M„S™ïiø9æ­4rŽ%bðÛ!Ž‰-=cVm/)Â<€'i¾ ¾©÷ÇØëÚl›Ë¦óÆ [ùî¢Ý˜ÒN5>‘ ¯³ÅX¼Q,ƒ7µ3ŒwØoNmÀË+$|ÎQ„S–çuz:Bcõ®Ù»,mé®›êÏϘýp¦v¢]öí^±¯»»ô}‹-Še°¥öcPÉîÀØrj}¼B˜@…/KɉJ€Qw–X¹ -t¨‰X ¸eÓc¿ š| /Bd¢¬†Â¢uþ=-«vOU4oŸæ·‰áÅf«"ÜjÚ«§a‰ëÀX&Q,Ã$5ÌdؘINm`B â¾fL$§#† c¥aÂXBvý9Å⽓‹–3XVêi²t‚KÖ¥¾±O<òjé”ÚÈÔ:]³óø» d&”™Ì1 /hßÔ]ç6z«`ι­˜¿GY¤;r¸DÕxç¤2ÒÞsËx¨‡‡cFgpìG ûÁÈB:"qÉé[2{o'>?ÓcfÞÙ,£-ué¸ÕóoÊÎöv,» •a—Øf7P³ËèôžW•"’ -žÒœ:Ûù$À*ŲïâÍFÔ¸ Û°ë~Ì:ßבè1˜ÝŽAxZÒ˪ ødivžÏ/©~Ê)¥÷ˆ™ëàXfQ,Ã,5« fÃÀÌrj½»Ä‚)vÔ3ûž¾=„ÝÙh,ö(–ÁžÚŸC¯ÓhŒ=§6LUŽÁ,b÷žÖ–™­×iQ½›³çö¥ý$6>i1·Þ ‡ÔQLn»Ô3ŸÚ×Æã •å€s½ .ŠeÀ¥„Á [pKê¯Ê§þ0HÞ–úó7™¶I›úûi£×FWk][Ø'Í¢Ýt¾ˆømo¯ûì_×·þãù6éú–§þº‰´‡×>êGÙû®ìå¾]­¬FãHn©òNúö'ò‰YKì=ÑB‚^gIžô9ùD¬ø‰Ûò‰Xí:ˆÏfÉïùD`â:+¸Q,3qSð˜¶ö¸9µ|U!ák¢dH'~_gêÎD#¡G)˜yj|½3T{µÆ¹õ?õÿLÛ§ÿs˜ñÕµã-NígÔÐbªvVÔ…ÃñìþÙLwSÒâÿ8&'endstream -endobj -3318 0 obj << -/Type /Page -/Contents 3319 0 R -/Resources 3317 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3158 0 R -/Annots [ 3321 0 R 3322 0 R 3323 0 R 3324 0 R 3325 0 R 3326 0 R 3327 0 R 3328 0 R 3329 0 R 3330 0 R 3331 0 R 3332 0 R 3333 0 R 3334 0 R 3335 0 R 3336 0 R 3337 0 R 3338 0 R 3339 0 R 3340 0 R 3341 0 R 3342 0 R 3343 0 R 3344 0 R 3345 0 R 3346 0 R 3347 0 R 3348 0 R 3349 0 R 3350 0 R 3351 0 R 3352 0 R 3353 0 R 3354 0 R 3355 0 R 3356 0 R 3357 0 R 3358 0 R 3359 0 R 3360 0 R 3361 0 R 3362 0 R 3363 0 R 3364 0 R 3365 0 R 3366 0 R ] +/A << /S /GoTo /D (subsection.12.3.1) >> >> endobj -3321 0 obj << +3399 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 754.651 512.306 763.674] +/Rect [521.223 581.151 539.579 590.174] /Subtype /Link -/A << /S /GoTo /D (subsubsection.14.2.1.3) >> +/A << /S /GoTo /D (subsection.12.3.2) >> >> endobj -3322 0 obj << +3400 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] +/Rect [521.223 567.602 539.579 576.625] /Subtype /Link -/A << /S /GoTo /D (subsubsection.14.2.1.4) >> +/A << /S /GoTo /D (section.12.4) >> >> endobj -3323 0 obj << +3401 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 727.553 512.306 736.575] +/Rect [521.223 554.053 539.579 563.076] /Subtype /Link -/A << /S /GoTo /D (subsubsection.14.2.1.5) >> +/A << /S /GoTo /D (subsection.12.4.1) >> >> endobj -3324 0 obj << +3402 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] +/Rect [521.223 540.504 539.579 549.527] /Subtype /Link -/A << /S /GoTo /D (subsubsection.14.2.1.6) >> +/A << /S /GoTo /D (subsection.12.4.2) >> >> endobj -3325 0 obj << +3403 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 700.454 512.306 709.477] +/Rect [521.223 526.955 539.579 535.978] /Subtype /Link -/A << /S /GoTo /D (subsubsection.14.2.1.7) >> +/A << /S /GoTo /D (subsection.12.4.3) >> >> endobj -3326 0 obj << +3404 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 686.905 512.306 695.928] +/Rect [519.586 502.496 539.579 512.065] /Subtype /Link -/A << /S /GoTo /D (subsubsection.14.2.1.8) >> +/A << /S /GoTo /D (chapter.13) >> >> endobj -3327 0 obj << +3405 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 673.356 512.306 682.379] +/Rect [521.223 488.947 539.579 497.97] /Subtype /Link -/A << /S /GoTo /D (subsubsection.14.2.1.9) >> +/A << /S /GoTo /D (section.13.1) >> >> endobj -3328 0 obj << +3406 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 659.807 512.306 668.829] +/Rect [521.223 475.398 539.579 484.421] /Subtype /Link -/A << /S /GoTo /D (section.14.3) >> +/A << /S /GoTo /D (section.13.2) >> >> endobj -3329 0 obj << +3407 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 646.257 512.306 655.28] +/Rect [521.223 461.849 539.579 470.872] /Subtype /Link -/A << /S /GoTo /D (subsection.14.3.1) >> +/A << /S /GoTo /D (subsection.13.2.1) >> >> endobj -3330 0 obj << +3408 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 632.708 512.306 641.731] +/Rect [521.223 448.3 539.579 457.322] /Subtype /Link -/A << /S /GoTo /D (subsubsection.14.3.1.1) >> +/A << /S /GoTo /D (subsection.13.2.2) >> >> endobj -3331 0 obj << +3409 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 619.159 512.306 628.182] +/Rect [521.223 434.75 539.579 443.773] /Subtype /Link -/A << /S /GoTo /D (subsubsection.14.3.1.2) >> +/A << /S /GoTo /D (subsection.13.2.3) >> >> endobj -3332 0 obj << +3410 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 605.61 512.306 614.633] +/Rect [521.223 421.201 539.579 430.224] /Subtype /Link -/A << /S /GoTo /D (section.14.4) >> +/A << /S /GoTo /D (section.13.3) >> >> endobj -3333 0 obj << +3411 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 592.061 512.306 601.083] +/Rect [521.223 407.652 539.579 416.675] /Subtype /Link -/A << /S /GoTo /D (subsection.14.4.1) >> +/A << /S /GoTo /D (subsection.13.3.1) >> >> endobj -3334 0 obj << +3412 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 578.511 512.306 587.534] +/Rect [521.223 394.103 539.579 403.126] /Subtype /Link -/A << /S /GoTo /D (subsection.14.4.2) >> +/A << /S /GoTo /D (subsection.13.3.2) >> >> endobj -3335 0 obj << +3413 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 564.962 512.306 573.985] +/Rect [521.223 380.554 539.579 389.576] /Subtype /Link -/A << /S /GoTo /D (section.14.5) >> +/A << /S /GoTo /D (subsection.13.3.3) >> >> endobj -3336 0 obj << +3414 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 551.413 512.306 560.436] +/Rect [521.223 367.004 539.579 376.027] /Subtype /Link -/A << /S /GoTo /D (section.14.6) >> +/A << /S /GoTo /D (section.13.4) >> >> endobj -3337 0 obj << +3415 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 537.864 512.306 546.887] +/Rect [521.223 353.455 539.579 362.478] /Subtype /Link -/A << /S /GoTo /D (subsection.14.6.1) >> +/A << /S /GoTo /D (subsection.13.4.1) >> >> endobj -3338 0 obj << +3416 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 524.315 512.306 533.337] +/Rect [521.223 339.906 539.579 348.929] /Subtype /Link -/A << /S /GoTo /D (section.14.7) >> +/A << /S /GoTo /D (subsubsection.13.4.1.1) >> >> endobj -3339 0 obj << +3417 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 499.856 512.306 509.425] +/Rect [521.223 326.357 539.579 335.38] /Subtype /Link -/A << /S /GoTo /D (chapter.15) >> +/A << /S /GoTo /D (subsubsection.13.4.1.2) >> >> endobj -3340 0 obj << +3418 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 486.307 512.306 495.33] +/Rect [521.223 312.808 539.579 321.83] /Subtype /Link -/A << /S /GoTo /D (section.15.1) >> +/A << /S /GoTo /D (section.13.5) >> >> endobj -3341 0 obj << +3419 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 472.758 512.306 481.781] +/Rect [521.223 299.258 539.579 308.281] /Subtype /Link -/A << /S /GoTo /D (section.15.2) >> +/A << /S /GoTo /D (subsection.13.5.1) >> >> endobj -3342 0 obj << +3420 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 459.209 512.306 468.232] +/Rect [521.223 285.709 539.579 294.732] /Subtype /Link -/A << /S /GoTo /D (section.15.3) >> +/A << /S /GoTo /D (subsection.13.5.2) >> >> endobj -3343 0 obj << +3421 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 445.66 512.306 454.682] +/Rect [521.223 272.16 539.579 281.183] /Subtype /Link -/A << /S /GoTo /D (subsection.15.3.1) >> +/A << /S /GoTo /D (subsection.13.5.3) >> >> endobj -3344 0 obj << +3422 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 432.11 512.306 441.133] +/Rect [521.223 258.611 539.579 267.634] /Subtype /Link -/A << /S /GoTo /D (subsection.15.3.2) >> +/A << /S /GoTo /D (subsection.13.5.4) >> >> endobj -3345 0 obj << +3423 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 418.561 512.306 427.584] +/Rect [521.223 245.062 539.579 254.084] /Subtype /Link -/A << /S /GoTo /D (subsection.15.3.3) >> +/A << /S /GoTo /D (subsubsection.13.5.4.1) >> >> endobj -3346 0 obj << +3424 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 405.012 512.306 414.035] +/Rect [521.223 231.512 539.579 240.535] /Subtype /Link -/A << /S /GoTo /D (subsection.15.3.4) >> +/A << /S /GoTo /D (subsubsection.13.5.4.2) >> >> endobj -3347 0 obj << +3425 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 391.463 512.306 400.486] +/Rect [521.223 217.963 539.579 226.986] /Subtype /Link -/A << /S /GoTo /D (subsection.15.3.5) >> +/A << /S /GoTo /D (subsection.13.5.5) >> >> endobj -3348 0 obj << +3426 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 377.914 512.306 386.936] +/Rect [521.223 204.414 539.579 213.437] /Subtype /Link -/A << /S /GoTo /D (subsection.15.3.6) >> +/A << /S /GoTo /D (subsection.13.5.6) >> >> endobj -3349 0 obj << +3427 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 364.364 512.306 373.387] +/Rect [521.223 190.865 539.579 199.888] /Subtype /Link -/A << /S /GoTo /D (section.15.4) >> +/A << /S /GoTo /D (subsection.13.5.7) >> >> endobj -3350 0 obj << +3428 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 350.815 512.306 359.838] +/Rect [521.223 177.316 539.579 186.338] /Subtype /Link -/A << /S /GoTo /D (section.15.5) >> +/A << /S /GoTo /D (section.13.6) >> >> endobj -3351 0 obj << +3429 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 337.266 512.306 346.289] +/Rect [521.223 163.766 539.579 172.789] /Subtype /Link -/A << /S /GoTo /D (subsection.15.5.1) >> +/A << /S /GoTo /D (subsection.13.6.1) >> >> endobj -3352 0 obj << +3430 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 323.717 512.306 332.74] +/Rect [521.223 136.668 539.579 145.691] /Subtype /Link -/A << /S /GoTo /D (subsection.15.5.2) >> +/A << /S /GoTo /D (subsection.13.6.2) >> >> endobj -3353 0 obj << +3431 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 299.258 512.306 308.827] +/Rect [521.223 123.119 539.579 132.142] /Subtype /Link -/A << /S /GoTo /D (chapter.16) >> +/A << /S /GoTo /D (subsection.13.6.3) >> >> endobj -3354 0 obj << +3386 0 obj << +/D [3384 0 R /XYZ 85.039 786.531 null] +>> endobj +3383 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3434 0 obj << +/Length 3495 +/Filter /FlateDecode +>> +stream +xÚíYSI€ßùzØ)bUÓÕut÷Ó† ö®g f „'bvI†b[ÿýÖ‘uH­J»±!&f$¤ÊÎT~YWÖ1t©è $cÕ (%Œ&—;ÙàL}óÏ +%ÆPd•yy¼óËk!4#UV Ž?úçT•Oî.®Fy9\ÍìËrôÇñ¯;¯Žýƒ#Õ”1ýØÿíüþG6˜*~ÝÉ«ÊÁ'õ>#´ª—;\0"8ƒ¿ç;G;ÿñϲßñ•Úö+8+-c–‘²ä[‹ÐŒž1õK… ’þ—æÙ–_ +eô/¥œŒÆ¾næ#:œÆLÃújjß¼ŸM#F‡-üýv¡^³áä¢Q…¯Î6Ý"råÂ’ "#ìWíÙÀ¾yÙìJã6o>Ó-òŽjVnªîú<=Î Í¿0ºh.½ITD&9g<'™b~¤Ê“9W®•\{’ëÕòSkÞ/•çת7/ͧWÖétøߌrõ^…Ú¸ªò¡z”È2ý«*úkë VäÅïöèNèä$§•÷iN"„¬Ô8ëòÚ|ö—B¨kB'N\Y\±”\•æ• ”e¯YN4{$K#jwÆœËJüA ø¶oÀ1$`bnHÀtM@SLsIxÅ…úÔ‹nW˜”Ãw×*N®Uè”ÃE«ÛŠÝz4&rVºAžè–…›FZ•™Œòbx¡K¨†Ú49ïnuo6ko×ê|é–îAGT +»òP_äVÁí¼.XõºZsJ•Ð&è¶a2jÔ¼¬†¯þ´8épî Í4Ÿ¶L_LL±™m?fй«Âµïxª"è8­7úõRÔÈÏB$¹vô#h­Ž®, õÝÀ›Þ} u¾jt…žHã Žú¿†e®XÖ­«¯0ˆPÕßÔô׺vϵLEùÃé~|Oš‘XçšcÓ<·˜Š*öD N˜È7ˆ2 zrðæ7ËIJaà çȾß70“p•VÃœX¤†¸«¸~nXËR>œðËûâ bÎØ«ή NL±Ç)ÕdJ½®ãä€óHSXèôS¶Óá/îÉU;›7õ)Ô_Íý`¶Ò„?i!Ó=_h°Y.P½„ßÜdC@Æþ2 ²kSìAò‚ä‚o€-íøÄV3à·W¯ ¼zé]ÉÅc_§È‚ú’ bÙØÁÙ® YL±'Ë)²M²ÈîíKÍqUÛZx¤þXï/ÅÚØç‘L£R˜Á#}11sìms×3¦ØcÎ3¢šþ Ì`~ óÕ´šñ¬éb?Bg©-‹vŸØa“ªâ%{Ô”Á!})1„rìl„rׄ2¦ØSÎ$QÿnP.ò‹éíHHÕ˺iŸÈÔ—ýi 3Øk=ÿÕìJ•¼¹jÜähÕLl‰µÉ/d)͇6„êËÙ +ÂħKú]˜ÁÏëË,ˆ!Ìb׉"ɬk S옉Š‘LÌ*×µ6K›¯2#ܶq)ÕÏí‡ÿjÎÎaÀkñ6sÓë6s]t¥©Yl)Š‡S÷ÜOîÉ1Ks\sgšãÒQÅ.ý(ŠŠˆÌ穤;uëŽé%·hÒ.ÿ"ËqRÑy¬o1$ b¢L†A×$ 0Å.©(¤ •ˆÂÀ%M¶IÃXó3ÅV%ÎnZ3È2Õ½*ÙOÇvOÔÁA}©1„zì|Q%©wM@¨cŠ}#.rõZ­Q‰Æ½fYŸÎã~òݵû†:nÙÓ¡ éK9ˆ!”cg#”»& ”1Åž²*]Ê Èyò¿gíÕl½´«ªx$(í¯îKÒK! #";úŒˆVßQç‚0ê³Æ:ê}H#~0½íÔ§¦–¶~§ûm?.Ö «f bè®ÜFwégö 3؆aönm¾?Ouçvç?Š+ø¡/Ø †},³$Ú® [L±ï~)%…Ì\×ý~°ÓØ‹å +zX3ñq)ŒöVC±“"ûÕ+à¢?ש+.‹§Ó8ƒ“ú’bù€L®æn1!)väyU*"ò9?šµ°$ Ðam6ÐæÃWº>[àM”Ö* +ñPÆÐ÷ Îi=#!KG™\ìÝbB:PÅ®ç%'RúU ü¡ ‚%L¶ÖÖŠö ·©ä¶Õ­ûµ™é†¢¤Õ_b‡s[ßXbH,ÄHX蚀ĦØÇBA ¥>½-!vf"vé:]ÿÛváÒU4Þ´5DÀ›}C$ˆ!!“’<"]ÁûŽCDMòBˆ¸!ÃÜÏÏJ7¨#«é©˜Y«ƒÅ-U^FÛ +ê3ý†Iñä: pT_úA ¡C@èwM@ècŠ=}ÎIFe ï† ‡†ïé|v 3C·ÖÁpÏòtöÆìÑehOöö„wª€ŒG–®ÍùàgzA;ì;ùíPÀ~0[pC_¶A a»X&·l1a‹)ölYFÔ¸=°eÀöíÂÑ›Îæég8u£?¿Cd•„mÈ…ÍbÐøÍÆn§‚Îô^Øï>5«ó2Ì@éHç~ipJ_ÒA !;!Ý5!)öÝ<•¤¢žtÝü‹©æÙ˜ _X1yo·Oý<\äÏ<?ö Ž †GÌ Ž® ɳ¹šç‰?«Áª\ªÐ³®ŒÍDÙ³G³ÉM분š0‘…^Í9­S2"M_s 5ló™ÖiÉ¥äèYw9ÁªŒ0ö…}ö¬( ç+wãMÈ—ØaÓôÆͱ!ß’Ï;í¿\Á»=+`J׿˜Iýé¦Óê£E +¤—üùøÎwˆðiß bH”ļ0éš€Ä ¦ØŠ ¤¤>PÜúùñ¨T“-›87KåÛs³%Íær&7K¿yß®Ýö%;Œ·»Q&«Æ ×ôö]\ÕË›õÍßëyû7v^wcÆ}´ø©äÁI}É1„| !ß5!)vÃtÕãÜ¥ŒE´d~²ôë$ç‹%¤êNëhã>3ké­â;ñcusºë -¥:÷ôeÄæ±ëer·Ìæ˜bÏ\ Ý +ÊóÜ3'S¶­(»J:±CŠ’ʧžw^ê‹>ˆ!ècú® zL±GO)¡’ô¬[Ý8Þ~Ôó¶x¥f½¾ë.@G‚|‚ìÁM}Ù1„}Œaß5a)vìóª ÒTäy—=l2‡Á^;3‡=j™ëeXþn÷Î{=C"K‡Ä™Ü0·Å„tH Š}H”œd2 + ‘ ‰7‡*vÿéXÁäíìrÞg}è ‚õÄð±ÿð]ð˜b¾Èˆpia ^øƒã·û·¹[¬÷‡÷ÛfˆË‚þ¥ª=8ª/ý †Ð!Èä¬-& ô1Ånº— I*—*~ÖÉõ™Ù;7QÙ³ª0ÇÉtz‰>§ÖcÜÙ7F‚#1*$Fº& 1‚)ö1ÂÕºí¼~#Çóâý·…x³oˆ1$DbRHˆtM@BSì;‘¼"¥¬Bˆ¸ÜÁ‘=vÛ2õ‚Þúép·0çÖò –âmÙö 5¹‡¿Ã|ôÆœ©1"«ó0ü¸êœK†yÌæ²b­f³¢,ï5¸¥/ë †°Ž]Ž°îš€°Æ{ÖTF#Ö.gðáÚå“PÞ,׎ é¤ÞÚõö3 qqéF‘MR ‹¶ñ+½L\8æ>Aá/™µËŒÆE.î-x¡/Ú † =\$·ín1áNKt´¢Š>E—è\uv‰îÍÕjÖN—µÙv¡áxT)27&Uh.V››5!7¼Ûy¨Á+}Q1uìqu×5¦Ø£V )j·æöÆ-´¿®» aìšœ¹G­Y™yR‘ÉÇŸju~ê ?ˆ!ðcEò Ìø˜b×{WÉü¾KŸi]ëtã=Î7V›«—6ùî®-Øs³.&úªÓ£ó{¸%ñ^`ƒ_z²RiԱNjäa†®þ4hL««ä%#\–³O…­­—ÝüÕfMw›.æjm§Åc«Õà˜ž ƒTtìò4è®þ4hL«-+RÑtþí ãŠï`‹ïr÷ÈO»ØË:§ïQ^ +¹"*r{‘¾E³£¹ +Ñê¯+Pݵ϶ú55›ÍF³l²™¶¿²7Ûq?ÙrgPòä¤<Ë2åyV=ôûƒ¬gz_$㤰{d‚ÏÓ¤»ú‘ÜÒÁä¶äú—¹»Ê¿ýÿoáS€¼$U™L)©YAÁLÎÜÞ»ô>OS(²øÿ1&&endstream +endobj +3433 0 obj << +/Type /Page +/Contents 3434 0 R +/Resources 3432 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3382 0 R +/Annots [ 3436 0 R 3437 0 R 3438 0 R 3439 0 R 3440 0 R 3441 0 R 3442 0 R 3443 0 R 3444 0 R 3445 0 R 3446 0 R 3447 0 R 3448 0 R 3449 0 R 3450 0 R 3451 0 R 3452 0 R 3453 0 R 3454 0 R 3455 0 R 3456 0 R 3457 0 R 3458 0 R 3459 0 R 3460 0 R 3461 0 R 3462 0 R 3463 0 R 3464 0 R 3465 0 R 3466 0 R 3467 0 R 3468 0 R 3469 0 R 3470 0 R 3471 0 R 3472 0 R 3473 0 R 3474 0 R 3475 0 R 3476 0 R 3477 0 R 3478 0 R 3479 0 R 3480 0 R 3481 0 R 3482 0 R 3483 0 R 3484 0 R 3485 0 R 3486 0 R ] +>> endobj +3436 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 285.709 512.306 294.732] +/Rect [519.586 754.651 539.579 764.219] /Subtype /Link -/A << /S /GoTo /D (section.16.1) >> +/A << /S /GoTo /D (chapter.14) >> >> endobj -3355 0 obj << +3437 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 272.16 512.306 281.183] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (section.16.2) >> +/A << /S /GoTo /D (section.14.1) >> >> endobj -3356 0 obj << +3438 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 258.611 512.306 267.634] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (section.16.3) >> +/A << /S /GoTo /D (section.14.2) >> >> endobj -3357 0 obj << +3439 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 245.062 512.306 254.084] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (subsection.16.3.1) >> +/A << /S /GoTo /D (subsection.14.2.1) >> >> endobj -3358 0 obj << +3440 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 217.963 512.306 226.986] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsection.16.3.2) >> +/A << /S /GoTo /D (subsubsection.14.2.1.1) >> >> endobj -3359 0 obj << +3441 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 204.414 512.306 213.437] +/Rect [521.223 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (section.16.4) >> +/A << /S /GoTo /D (subsubsection.14.2.1.2) >> >> endobj -3360 0 obj << +3442 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 190.865 512.306 199.888] +/Rect [521.223 673.356 539.579 682.379] /Subtype /Link -/A << /S /GoTo /D (subsection.16.4.1) >> +/A << /S /GoTo /D (subsubsection.14.2.1.3) >> >> endobj -3361 0 obj << +3443 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 177.316 512.306 186.338] +/Rect [521.223 659.807 539.579 668.829] /Subtype /Link -/A << /S /GoTo /D (subsection.16.4.2) >> +/A << /S /GoTo /D (subsubsection.14.2.1.4) >> >> endobj -3362 0 obj << +3444 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 163.766 512.306 172.789] +/Rect [521.223 646.257 539.579 655.28] /Subtype /Link -/A << /S /GoTo /D (section.16.5) >> +/A << /S /GoTo /D (subsubsection.14.2.1.5) >> >> endobj -3363 0 obj << +3445 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 150.217 512.306 159.24] +/Rect [521.223 632.708 539.579 641.731] /Subtype /Link -/A << /S /GoTo /D (subsection.16.5.1) >> +/A << /S /GoTo /D (subsubsection.14.2.1.6) >> >> endobj -3364 0 obj << +3446 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 125.759 512.306 135.327] +/Rect [521.223 619.159 539.579 628.182] /Subtype /Link -/A << /S /GoTo /D (chapter.17) >> +/A << /S /GoTo /D (subsubsection.14.2.1.7) >> >> endobj -3365 0 obj << +3447 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 112.21 512.306 121.233] +/Rect [521.223 605.61 539.579 614.633] /Subtype /Link -/A << /S /GoTo /D (section.17.1) >> +/A << /S /GoTo /D (subsubsection.14.2.1.8) >> >> endobj -3366 0 obj << +3448 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 98.661 512.306 107.683] +/Rect [521.223 592.061 539.579 601.083] /Subtype /Link -/A << /S /GoTo /D (section.17.2) >> ->> endobj -3320 0 obj << -/D [3318 0 R /XYZ 85.039 786.531 null] ->> endobj -3317 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3369 0 obj << -/Length 3934 -/Filter /FlateDecode ->> -stream -xÚÝœÝsÛ6ÀßýWè2©ô ”ñAÞ[â|\:×4»—‡´ŒÅØœJ¢’êäþúÃ7@‘‹„Iì87ÔIpûËH<ËäxV0”ååL±Ï.6'ÙìR^yv‚íK{Ë2ºçÑùÉOO9á •Y9;çŸSfˆ•|v¾z3?m· RÌ÷µù³[üqþóÉ“sÿàH4ÎsõØÿœ¼ù#›­¤ -?Ÿd(/‹Ù<Î.ËÙ愲1šÛß듳“ùg™ktfJÕ‚f¥ÔUÌ–y†Š‚ŽÞƒI¸à²ªŒ!N…¯*É¢ªbLPŽÉÌÝ¤êŠ ´X–t~º^àyµÛ5òÏEµ^,sÎç/»f»o¶—ê—˜Ÿ®¯åž· ù¿nlZæòñ³Hs¥»œ™ƒWq­ÌÍi…ž¨õeù±\†ñ‘Ü¡ GDÈ‚0ùHcQ@÷ -a[ÐÚYP‚2ÉËZKJçO׋¥´äþ ÙÕ;i°œÎ«íJäóGúêV^Ó¿g˜ÊcÙÄ–eIæò1,ËÔZ–ѯÑ?©[n±øصAC ¨¤ÁJs-”ZFņŽŸý‘61Ô`ÞÞšëÁË¿Œ–<±àÏE>¯/D̯ÜƸþÜð&å|ßµòæb¾’×ûFv2K–gÿwЭ…¦BÅÐcëÃЇÀÐSb¥$¸˜ yÖW¾®úÆ×WªÃÜÿÖǪw” À{¸õýæi Ô`ÒÔ¢®É.Àõ -•ùósûÖ¼S}G»±}‡9wºnìx´Xß8YË©ÐL‘0g9F!X}©0(H”‡”aD#N¹1Lù£±œÜôh&íùJXWûÚB£¾íŽ/+K)U—^ªÒUWm꽦ÛºE–ߺ7™ZMåâK%ÐDö‚é ÄÀ2#^y -H¹ƒd ¬¼h£¹ô쬼à•>qÑn6Îsìº -.Óvæø7ã]‹¥È³»ì-†®Ö!FÅ`Š=‹‚G49&Åz‚¢œ‘’~2ÈwŽÒ£J—ÊK7ê êVá®Óvs]í›·Ê ×Í^=õƒì]»ct¶žSÑ…b t± ƒÐ 5€Ñ¥Äzt\N#²< cŸŒnÛrëV o—ö²>Õl͸vØɳTNîIqµF˜Ê5Kp sjsM‰u‘©œú ¨ãšÛÈô¡á£{Äfs-¹­kçb½ñNn¼Û[Ðrþ·ÐÑ«Ž:Ô™ý5e¹2'Îdc‘—ßVË\ÎaX~Çm¥§r Åcƒ2qjsL‰õþ™Ë¿YÄÑœÿÖsŒ®±Ð.Ì43SZi>8«÷rڮȺtëFFí´,ÌÆQÜ׺¨§]Wt.È-вU›J+KЊÍÓjÓJ‰õ´H†¤“Z.ì´~'Ç®ýÚ„*ŠÃ“÷vŽÐ5›:Ì ÍEçu7¦#ÞM -^Þ£ÔÖ{*ÊP,2¶)Ê¡0Ê”XßfÉ%µè“÷ª·ó“º•›.ÈŽï:"k{ÓKöëM©`å¥&&î˜nTÌU¼£{R"Š[€fk8Z(–€[•´¡0´”X•9ʘOe2 íq½¯šµC¥¼NŽ{ÕVÏØÝåþ*vPÿ¸±Ï !P¯geYy·^çj;`T س$ÇÀ @€I±®e¢D,+@7Ü_Y$o”µ×íÛjý‡õ<7õ³I´‚ßMÂë–˜ZLeŠ%˜ÆÆ…™5€™¦Äz¦œ¡’ELÉÓë(¸Œgxqâ»l­1p(–[šðPpJ¬ÌäŒ?+`—Çy¸µ3uÅïÍÆü8RŠä"Ô?㣫g2¦ãkgKû¨eô¬¡ÒDÆq “žÒ×QR°îr9ò0òuT´ÏúˆŽ¼D%a=·Õ¦vžPëh߸/¿ášÔÆCå&µñ”MŽŸmÚ8”ôÑnã)±¾ç*xhât$ŸìÇ:^ØT[›Àb²‡»ûõ˜[꽌¦‚õ¥\#ÃXâaª ™*‘}ƪK~=®ßU*t_ï}æ#Ô%b…wgsÍ.…ùׂq9SkÚCˆÛªaí=”@9;¼uÃÜw°¯7;•ÜÌ?NÃê?G(–àÛ†C©ä `")±‰¼Ypp‹$„ÚÆr‡ëÞ„Ø"hÕ¯¿NcgX±ojçÔ±¿âÇ1ý6~d«9•\(– ›CÇ `r)±nîEËìÉq;÷z¾U¶Ö\¤°¹› ÷RQýïÐYx:ß5Û 7DKQä÷§tF˜È5*sí˜C9­ @®I±Î#iAçyàê¦dñ´ö¸kþR?ëβmA¶gugnÖ ì’¬ÕOO9£!9óÇ‘ª+^¶Ívï¦á²Yddþ£Þ˜dJöª èŒp[ð3C­E¦BÅckÇÀSb=dÆ4@þô9ÚÇQi”ëjlKèêM«š€¾ÙÖpf-ª™èŒÎ0þš~ië7Y(–@ÛŽC Ê `d)±HNÏ27ë:íêÊnÓ;Jg½‰':?Dóꫪ“·EvÏÃOWç©C±ÆØž0Æ¡0Æ”X‘R”a0~úÚ¹[Æé#Žƒçt=)i~xÚÊOåŠ%xƆåÄs¨Ì3%ÖóÌ3D¹<ÝœâLÍ -ÞêõžUÓmg$gûÎì0k“²™êæuz½‹[pûW˜)©:x©Òï«•OøÈS2æÙ™è,»,µwO|bö†k|Ì)ƒžêįƒf¢%ù ±éˆ|ÚóèÕoó6Mµ^ëA•0”•8Tõ>2S… û"+žºÚ„²%+¾‡oÜÒ-­ÄÅä|XT,Ñ¢íM¦EC‹ #À-:%Ö%3I–!œ‡=Øånßêêvnã’î1†O„£sáç¡áUký¾ƒÝ/š“ûÀÔ`*R_*A42- t æ™épbõE¡ž.7ýüÕ5ýúJ½«§? -òðÅùßÜv‰}/½ñ¸þ«qûš~ñ}Áªîí¥É÷bn†oÅëÃ"ãŸGÆÕe"š¨̦o'hé`DNR¬Ç#r”å$àq;%ôz]œrp‹1_âi×£¯]4Kc˜Þ­»9 L…Š% ö¬ ¥§G4€¡¦Äz¨¬D´ˆúP·oâáÚ¼1©§"Ö{6ÕŸ–šë\»0,®¿éW¿Ø¾µ‰îøÕÚÊíkjMœmƒ7·Êôàzè•6‹"/l\neûäe+7•W(–àÕ3Èk¨Ì+%Öq˜2TæžWiƒ¸_Î÷LOcÌÇ“”ËL|ûhçîÖئ¢Åè{  ÷ƒF4€Ñ§ÄzWÍ Ê Ѓk캨¥¡ê¶Þ¿`ñ«ò.Ìï¿sÉÍ©¢_ÆÈVh*£P,Á¨g,ÑP˜QJ¬g¤úÐœF$Þ¶d¿eÕv½óuÕ]Zs¿8èŽÍ§åÃàw#{ñÃï\’þîPWß©C±ž-¡Åš `„)±aÆ ï(•á5<±ƒÍ~y´õáh—aôYˆÈ¿^ëÇ­LfÚÞùâÜü}¨`¿V;󋯂ÊÖk*ªP,ªg3(ý?¢Œ*%Ö¡*1¹¤\ìòÚ1Rït/¬w:”´½Ü/æã»ÊùÞiµu©?õó¢ÝnÃîBû²ŒÉUuÑ–#ª3 *˜â½îò…Nü1šXA³u˜H%”‚¡ô¬1Š‘¤dúïÅÉIxq»6Y#›ï«ø ^QûMÇ›«: - %™Út„:ÁmüøB(¿ë^ÐÖzê÷ä|©Ä÷äb{BKCñð÷ä2ý×W(âyúWÇÂJ„¦ä¾³øˆÒ_ª3r¬SÁ'+¿$™­ûä/¹R©EV¿ä1Ÿøè® .26öÕ]ù/wßßüüo(ûo÷RÙ -`ɈÓ:Ë¢."[y˜œØØ›"ÿéøÏõendstream -endobj -3368 0 obj << -/Type /Page -/Contents 3369 0 R -/Resources 3367 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3158 0 R -/Annots [ 3371 0 R 3372 0 R 3373 0 R 3374 0 R 3375 0 R 3376 0 R 3377 0 R 3378 0 R 3379 0 R 3380 0 R 3381 0 R 3382 0 R 3383 0 R 3384 0 R 3385 0 R 3386 0 R 3387 0 R 3388 0 R 3389 0 R 3390 0 R 3391 0 R 3392 0 R 3393 0 R 3394 0 R 3395 0 R 3396 0 R 3397 0 R 3398 0 R 3399 0 R 3400 0 R 3401 0 R 3402 0 R 3403 0 R 3404 0 R 3405 0 R 3406 0 R 3407 0 R 3408 0 R 3409 0 R 3410 0 R 3411 0 R 3412 0 R 3413 0 R 3414 0 R 3415 0 R 3416 0 R 3417 0 R 3418 0 R 3419 0 R ] +/A << /S /GoTo /D (subsubsection.14.2.1.9) >> >> endobj -3371 0 obj << +3449 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 754.651 512.306 764.219] +/Rect [521.223 578.511 539.579 587.534] /Subtype /Link -/A << /S /GoTo /D (chapter.18) >> +/A << /S /GoTo /D (section.14.3) >> >> endobj -3372 0 obj << +3450 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] +/Rect [521.223 564.962 539.579 573.985] /Subtype /Link -/A << /S /GoTo /D (section.18.1) >> +/A << /S /GoTo /D (subsection.14.3.1) >> >> endobj -3373 0 obj << +3451 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 727.553 512.306 736.575] +/Rect [521.223 551.413 539.579 560.436] /Subtype /Link -/A << /S /GoTo /D (section.18.2) >> +/A << /S /GoTo /D (subsubsection.14.3.1.1) >> >> endobj -3374 0 obj << +3452 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] +/Rect [521.223 537.864 539.579 546.887] /Subtype /Link -/A << /S /GoTo /D (subsection.18.2.1) >> +/A << /S /GoTo /D (subsubsection.14.3.1.2) >> >> endobj -3375 0 obj << +3453 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 700.454 512.306 709.477] +/Rect [521.223 524.315 539.579 533.337] /Subtype /Link -/A << /S /GoTo /D (subsection.18.2.2) >> +/A << /S /GoTo /D (section.14.4) >> >> endobj -3376 0 obj << +3454 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 686.905 512.306 695.928] +/Rect [521.223 510.765 539.579 519.788] /Subtype /Link -/A << /S /GoTo /D (subsection.18.2.3) >> +/A << /S /GoTo /D (subsection.14.4.1) >> >> endobj -3377 0 obj << +3455 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 673.356 512.306 682.379] +/Rect [521.223 497.216 539.579 506.239] /Subtype /Link -/A << /S /GoTo /D (subsection.18.2.4) >> +/A << /S /GoTo /D (subsection.14.4.2) >> >> endobj -3378 0 obj << +3456 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 659.807 512.306 668.829] +/Rect [521.223 483.667 539.579 492.69] /Subtype /Link -/A << /S /GoTo /D (subsection.18.2.5) >> +/A << /S /GoTo /D (section.14.5) >> >> endobj -3379 0 obj << +3457 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 646.257 512.306 655.28] +/Rect [521.223 470.118 539.579 479.141] /Subtype /Link -/A << /S /GoTo /D (section.18.3) >> +/A << /S /GoTo /D (section.14.6) >> >> endobj -3380 0 obj << +3458 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 632.708 512.306 641.731] +/Rect [521.223 456.569 539.579 465.591] /Subtype /Link -/A << /S /GoTo /D (subsection.18.3.1) >> +/A << /S /GoTo /D (subsection.14.6.1) >> >> endobj -3381 0 obj << +3459 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 619.159 512.306 628.182] +/Rect [521.223 443.019 539.579 452.042] /Subtype /Link -/A << /S /GoTo /D (subsection.18.3.2) >> +/A << /S /GoTo /D (subsection.14.6.2) >> >> endobj -3382 0 obj << +3460 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 605.61 512.306 614.633] +/Rect [521.223 429.47 539.579 438.493] /Subtype /Link -/A << /S /GoTo /D (section.18.4) >> +/A << /S /GoTo /D (subsection.14.6.3) >> >> endobj -3383 0 obj << +3461 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 592.061 512.306 601.083] +/Rect [521.223 415.921 539.579 424.944] /Subtype /Link -/A << /S /GoTo /D (section.18.5) >> +/A << /S /GoTo /D (section.14.7) >> >> endobj -3384 0 obj << +3462 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 578.511 512.306 587.534] +/Rect [519.586 391.463 539.579 401.031] /Subtype /Link -/A << /S /GoTo /D (subsection.18.5.1) >> +/A << /S /GoTo /D (chapter.15) >> >> endobj -3385 0 obj << +3463 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 564.962 512.306 573.985] +/Rect [521.223 377.914 539.579 386.936] /Subtype /Link -/A << /S /GoTo /D (subsection.18.5.2) >> +/A << /S /GoTo /D (section.15.1) >> >> endobj -3386 0 obj << +3464 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 551.413 512.306 560.436] +/Rect [521.223 364.364 539.579 373.387] /Subtype /Link -/A << /S /GoTo /D (subsection.18.5.3) >> +/A << /S /GoTo /D (section.15.2) >> >> endobj -3387 0 obj << +3465 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 537.864 512.306 546.887] +/Rect [521.223 350.815 539.579 359.838] /Subtype /Link -/A << /S /GoTo /D (subsection.18.5.4) >> +/A << /S /GoTo /D (section.15.3) >> >> endobj -3388 0 obj << +3466 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 524.315 512.306 533.337] +/Rect [521.223 337.266 539.579 346.289] /Subtype /Link -/A << /S /GoTo /D (subsection.18.5.5) >> +/A << /S /GoTo /D (subsection.15.3.1) >> >> endobj -3389 0 obj << +3467 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 510.765 512.306 519.788] +/Rect [521.223 323.717 539.579 332.74] /Subtype /Link -/A << /S /GoTo /D (subsection.18.5.6) >> +/A << /S /GoTo /D (subsection.15.3.2) >> >> endobj -3390 0 obj << +3468 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 497.216 512.306 506.239] +/Rect [521.223 310.168 539.579 319.19] /Subtype /Link -/A << /S /GoTo /D (section.18.6) >> +/A << /S /GoTo /D (subsection.15.3.3) >> >> endobj -3391 0 obj << +3469 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 483.667 512.306 492.69] +/Rect [521.223 296.618 539.579 305.641] /Subtype /Link -/A << /S /GoTo /D (subsection.18.6.1) >> +/A << /S /GoTo /D (subsection.15.3.4) >> >> endobj -3392 0 obj << +3470 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 470.118 512.306 479.141] +/Rect [521.223 283.069 539.579 292.092] /Subtype /Link -/A << /S /GoTo /D (subsection.18.6.2) >> +/A << /S /GoTo /D (subsection.15.3.5) >> >> endobj -3393 0 obj << +3471 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 456.569 512.306 465.591] +/Rect [521.223 269.52 539.579 278.543] /Subtype /Link -/A << /S /GoTo /D (subsection.18.6.3) >> +/A << /S /GoTo /D (subsection.15.3.6) >> >> endobj -3394 0 obj << +3472 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 443.019 512.306 452.042] +/Rect [521.223 255.971 539.579 264.994] /Subtype /Link -/A << /S /GoTo /D (subsection.18.6.4) >> +/A << /S /GoTo /D (section.15.4) >> >> endobj -3395 0 obj << +3473 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 429.47 512.306 438.493] +/Rect [521.223 242.422 539.579 251.444] /Subtype /Link -/A << /S /GoTo /D (subsection.18.6.5) >> +/A << /S /GoTo /D (section.15.5) >> >> endobj -3396 0 obj << +3474 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 415.921 512.306 424.944] +/Rect [521.223 228.872 539.579 237.895] /Subtype /Link -/A << /S /GoTo /D (section.18.7) >> +/A << /S /GoTo /D (subsection.15.5.1) >> >> endobj -3397 0 obj << +3475 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 402.372 512.306 411.395] +/Rect [521.223 215.323 539.579 224.346] /Subtype /Link -/A << /S /GoTo /D (subsection.18.7.1) >> +/A << /S /GoTo /D (subsection.15.5.2) >> >> endobj -3398 0 obj << +3476 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 388.823 512.306 397.845] +/Rect [519.586 190.865 539.579 200.433] /Subtype /Link -/A << /S /GoTo /D (subsection.18.7.2) >> +/A << /S /GoTo /D (chapter.16) >> >> endobj -3399 0 obj << +3477 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 375.273 512.306 384.296] +/Rect [521.223 177.316 539.579 186.338] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.1) >> +/A << /S /GoTo /D (section.16.1) >> >> endobj -3400 0 obj << +3478 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 348.175 512.306 357.198] +/Rect [521.223 163.766 539.579 172.789] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.2) >> +/A << /S /GoTo /D (section.16.2) >> >> endobj -3401 0 obj << +3479 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 334.626 512.306 343.649] +/Rect [521.223 150.217 539.579 159.24] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.3) >> +/A << /S /GoTo /D (section.16.3) >> >> endobj -3402 0 obj << +3480 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 321.077 512.306 330.099] +/Rect [521.223 136.668 539.579 145.691] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.4) >> +/A << /S /GoTo /D (subsection.16.3.1) >> >> endobj -3403 0 obj << +3481 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 307.527 512.306 316.55] +/Rect [521.223 123.119 539.579 132.142] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.5) >> +/A << /S /GoTo /D (subsection.16.3.2) >> >> endobj -3404 0 obj << +3482 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 280.429 512.306 289.452] +/Rect [521.223 109.57 539.579 118.593] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.6) >> +/A << /S /GoTo /D (subsection.16.3.3) >> >> endobj -3405 0 obj << +3483 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 266.88 512.306 275.903] +/Rect [521.223 96.02 539.579 105.043] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.7) >> +/A << /S /GoTo /D (section.16.4) >> >> endobj -3406 0 obj << +3484 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 253.331 512.306 262.354] +/Rect [521.223 82.471 539.579 91.494] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.8) >> +/A << /S /GoTo /D (subsection.16.4.1) >> >> endobj -3407 0 obj << +3485 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 239.781 512.306 248.804] +/Rect [521.223 68.922 539.579 77.945] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.9) >> +/A << /S /GoTo /D (subsection.16.4.2) >> >> endobj -3408 0 obj << +3486 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 212.683 512.306 221.706] +/Rect [521.223 55.373 539.579 64.396] /Subtype /Link -/A << /S /GoTo /D (section.18.8) >> +/A << /S /GoTo /D (section.16.5) >> >> endobj -3409 0 obj << +3435 0 obj << +/D [3433 0 R /XYZ 85.039 786.531 null] +>> endobj +3432 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3489 0 obj << +/Length 3853 +/Filter /FlateDecode +>> +stream +xÚíYsÜ6€ßõ+f]©Ễâ Hì›#Ù‰]eÇk)ë­rò@k(‰•9´Nï¯_܇DÛŒÉN*•h†C°›ýuÈàY&ÿÁ³2G³¢ä(§xv±>ÊfWò—Ž°=ãØžróýùÑws>Ù˜_úëˆ å‚ÏΗ¯ç'ÛÍ‚”ó®6v‹_ÏŸ=:÷ŽDcJÕeÿ{ôú×l¶”*<=ÊåìV~Îb¶>b9E9£öûêèìè_þZæ763­Æî"§%ÊK:¼ œG·3ŒXFgEž#Î +}˜#ŽÇ„1yKëÅ1ž¯åSJçxÞ¶ÛVþÙÉ#˜Ìå‰y–©?Lˆè[ÿôÛÝ6ÿ°KÎ A oÍ—öjf>¼ŒIÙVÇQ³!©ÃkkR¨`±¨0pF „Ë™$X>îEÎ?Ž Šå¹ÂëF²‘`°çÕ¤‘›ÿ¸U´“Ó5›+é3¼˜WêŸ?k.Úín{Ù™¯§êÄFyV׺oöúX/Í)ÝñUmœ©oõÕkí¨æp×Öµ¥Wþ=«Öoª!®ÌØ*܈)³™âðšÆES¸Öñc‚0yGWEÊxùŽ—L8st° ñÇ‹’͵ñªn¯Â»6Àt¼W›¥ùð½>º‘¿ë¿d˜)£ËÓ„ á@7&ç¾æ1¬´û äã Õ»HÆP&°óò÷0ðAÞa­9Õ=B3À?z¤Ê¤ƒ U€‡¼ˆSî­Zi†“•ô•j·S÷Eµ2Ýô‹¶Ù„Qáls£œi¾]Èÿ´]ª·ŽTxŸÞÔøðšÆš"eÍèZÒ[ó¢@9~GFÆ9G™”i­øwwýÒÙtb@FÍÒÙã¸ÐP…t— +öŽ’™ß3ç(®Ï>_”t^_,H1¿VŽÐ˜°£lþDÎO„Ì‘df&ç)KùÛþ¢kTßžÓ¿poíì8Õ9B3À9bF€s UœŒ GL°—g‹2ΡúÕ÷¾ºVrg¤Œ¨vP°wƒ‚Ë®!J†së§õeµW3žnl:cæ@kåvÑóÒU1_ä\Î}›í>¤À??òŸÑ +˜ê(öo܈ûÖ}èêµv3üQ¸Ù[œÊ-4¸ÅæÉ’ôˆ +7H°çÆ *Y¸qË-Ì6Œé…›^ÂrÚªo·~iÁÒƒ^G½ž)Èü½«•w Ö&SA‡fèØÞ"YuQ v“UÆ"¯=¸-¡O6Š‹f(.÷õÆ^Y‘¨²…ZzVV 0ö“]³¹°i±¼ãÅqQÒ/±`áÌ5ÕB3Àb"YŸQðH°vš£‚ÁÜL6^ÎUpOÛæwõµn­l“~pV·æT3牣ä}}÷8/ÒQ\©»RáŶÙt®È!](#óoõ&"Ó²w \ ŒpÛð“ºGÊ!¬í¦:Dh8DÌpˆ¡ +€C@‚½CH°ˆâý§¶ßæçQé²±^ÓÖë­rã Ë‘íg¦ä¥\Êú]¨íiøn‚Þšc*ãÐ `›Z$ Ô#*Œ!Ážq&Á²20v3Ö“¶®ì~½ƒJäëxŽøMT¿¸®Ôµ²Ì¾ždÜZg*òÐ @[^°$ò¡ +rH°CNEŽ2!röÞû Ü:bßâ¬Î…>T´ä$á‹bïÌ4‘}Ô,;‡ Í~D…4{P°g_b”ç½›‡©þ^r\6m}Ñm[[¬:ëZ³ipßæÎ{aºÂÙ—çÖ,SQûVéÈà"Y–Ê8R]:Oy‰²Ì/J>ßuÕj¥Çë«D.ó­c|ÐÝ3Ì¿îÍ¡ÎzSÝ!4ü!&#’Ot¨x$ØG~®vüG.SùSÒ}§ˆ÷é>ýÆQboz‘XæP×»MFv‰ªï?üüD~(Ä'Çk-1ohà­,’òŒ¨à…{¼L"/¹3¼­©É“.tò¯Ê{MoKÁØgŽhk©ÈC3ylyùP9$sÛÉ“Ñœöã¹ +kVŠù“¥ ®FÑ}»@œ½êÎ}0G¬Ž®Üã&yž!ã¸5ÉTΡÀ96·H.*Ž¨p†{Θ¢2cœ‰å|²]­¢Iv˜°Õ#ñnáJ².òþƒÝû¯´¯,MåÖž÷ãÖoüv7’÷Lµ¥ÙÛ™Ê(4ŦÉŽF`Ï(Ë ‰µeD-£ÓÚô‡Û]Óë‹•9¯ß+Ãü«—™ g^¬(ï&ò¬¦R ͪ‘qI–\þQ  + vTIÉQ‘ñªÌEÞµyâê7[ÖÙ´uªÌ!ÔÆïàróµu¿o6c«=øK–ga|ÝÙ"«š¬°òt¼8. ù` &‚š¥ÁÆö%Yr¹cD…4XP°[P„óC°¹ûr¯btGjœÓ¤­·î=>½]ªìå½à÷h¨t&˜Ê54¸Fæ%Y²b=¢Àì¹æñ¬8àÊÇöÚŒp‡óàÁ©˜ …jóûí µ:}hm×Éñ¥Y©.;wѤg¨ÕN_ýìæîº^&©ÙœJ-4¨EÆ#Y²=¢@ ì©1Ž²¼< V|p7ÛØε5ùÑöj£NûŸɈƶeéÕ«R/5Hý?WÚ{Ÿ +44€Fv%Y²Ê8¢ìR‚òL--ÐÞ³MË@q³íÜØ÷Oy¦œ#F¡ú!’êó¢Ô;@ÜÓ©.5Ú™ÎÚ€WÔUt]9ËaF¬v”í”vÅŸ¤hox*ÅÐ  “dÉ∠+EH°§(щÃ1R|œ1Ò<ƒØ-‡IoÎó{7­´–˜J×·àClò´€TW–¢ó¥ÀÒ½ø%¹Ìo¾Ûê±+é!š¶íð|ßêÇJÅWZ¶f›ê¾àÉ’Eá¡|À ©®fˆF%ü`ðè‚}ְݹÍxzíÀM5"O»>Ùø*bµÒϹØ}º”|Q«CÎNÁGÍÒäcúÒìAÁ~Q"ŠI€ï +ÆOž©mz?½T›ê÷Š<|~þ·›ã –\ÿÞ¸í\Ï|°¬{Û‚äèZßwwÆõc9_ûä ííNeš #S’,YQ` ö 9C§¡Û¼¡_´oãb‚[rùø(»~waU/ÆìÞƲ5ÙT?Í?ˆp,Y}QðH°÷ƒKXð·£ãáÊ<#¬g96*×Õo~kzxÿ,R7¾0w¢gO:ß³•æø}!•ÛεÕ©­*ÜzÒƒ›aÐÛÉðB¿ÃÑ$†›jgÉÿ$Uk€©TC3€jd\ˆêP€*$Øei˜ˆsOUØ4í§ATÿ ºÞμýIÑYñ÷;úFÝÄZtª›„f€›D´N©GTÜ샟0„qÜZØ×n£«ýª‹2ùÞ¦üŸn摪Ç.âš ¸)¸ÅçBjï~*ÒÐ @YB:T@ + öHå¡œó€”ÄÛ´ì»»¶moÁoUµWÍó½îYý"Aا}9|CÿØ_+¸—ã¶5ÉTΡÀ927ÁÉrõˆ +gH°ã, +”á"`öO‹ê:±ß|ë_íx;eF¬cKºÏÏÍ߇Ê^©G1ÊÏ‹ÔÞýD¢¡UhdW‚“…ì¡ü4NHª£YRÄxhº$ì•‹g£@¹W?´m´ëæ™yÏ®r1|R™Gol6u±ÝlÂ~ZÓfo^ÒF›ªLqS½"ˆÇèuÑÏ+õ.™œ}”uA{·é…Viz‘eŽ”¢7”Ÿ¦Iõo_HàˆžÛû½bÞ·ÔÆcèÞÖÂn¯ë(–kÓù®â ~¯¥`~ß¾fì3õåk¾ðîµ`y‚“5С|àÍk€Tÿ¨>G”‹ÀÛ?ÙVzoÙ}‘˜Æ¼PGäX¬òî\|uoi0VšúLºo<’ìOpú ùÀ»˜¥ ÊÇ^Æ,ÿUçˆûßpøW:3õŠÎdMH¦ì…Ún‹µ•™ô._sR¤ñÿe¨endstream +endobj +3488 0 obj << +/Type /Page +/Contents 3489 0 R +/Resources 3487 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3382 0 R +/Annots [ 3491 0 R 3492 0 R 3493 0 R 3494 0 R 3495 0 R 3496 0 R 3497 0 R 3498 0 R 3499 0 R 3500 0 R 3501 0 R 3502 0 R 3503 0 R 3504 0 R 3505 0 R 3506 0 R 3507 0 R 3508 0 R 3509 0 R 3510 0 R 3511 0 R 3512 0 R 3513 0 R 3514 0 R 3515 0 R 3516 0 R 3517 0 R 3518 0 R 3519 0 R 3520 0 R 3521 0 R 3522 0 R 3523 0 R 3524 0 R 3525 0 R 3526 0 R 3527 0 R 3528 0 R 3529 0 R 3530 0 R 3531 0 R 3532 0 R 3533 0 R 3534 0 R 3535 0 R 3536 0 R 3537 0 R 3538 0 R 3539 0 R 3540 0 R 3541 0 R ] +>> endobj +3491 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 199.134 512.306 208.157] +/Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsection.18.8.1) >> +/A << /S /GoTo /D (section.16.6) >> >> endobj -3410 0 obj << +3492 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 185.585 512.306 194.608] +/Rect [519.586 730.193 539.579 739.761] /Subtype /Link -/A << /S /GoTo /D (subsection.18.8.2) >> +/A << /S /GoTo /D (chapter.17) >> >> endobj -3411 0 obj << +3493 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 172.036 512.306 181.058] +/Rect [521.223 716.643 539.579 725.666] /Subtype /Link -/A << /S /GoTo /D (subsection.18.8.3) >> +/A << /S /GoTo /D (section.17.1) >> >> endobj -3412 0 obj << +3494 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 158.486 512.306 167.509] +/Rect [521.223 703.094 539.579 712.117] /Subtype /Link -/A << /S /GoTo /D (subsection.18.8.4) >> +/A << /S /GoTo /D (section.17.2) >> >> endobj -3413 0 obj << +3495 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 144.937 512.306 153.96] +/Rect [519.586 678.636 539.579 688.204] /Subtype /Link -/A << /S /GoTo /D (section.18.9) >> +/A << /S /GoTo /D (chapter.18) >> >> endobj -3414 0 obj << +3496 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 131.388 512.306 140.411] +/Rect [521.223 665.087 539.579 674.11] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.1) >> +/A << /S /GoTo /D (section.18.1) >> >> endobj -3415 0 obj << +3497 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 117.839 512.306 126.862] +/Rect [521.223 651.538 539.579 660.56] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.2) >> +/A << /S /GoTo /D (section.18.2) >> >> endobj -3416 0 obj << +3498 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 104.29 512.306 113.312] +/Rect [521.223 637.988 539.579 647.011] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.3) >> +/A << /S /GoTo /D (subsection.18.2.1) >> >> endobj -3417 0 obj << +3499 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 90.74 512.306 99.763] +/Rect [521.223 624.439 539.579 633.462] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.4) >> +/A << /S /GoTo /D (subsection.18.2.2) >> >> endobj -3418 0 obj << +3500 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 77.191 512.306 86.214] +/Rect [521.223 610.89 539.579 619.913] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.5) >> +/A << /S /GoTo /D (subsection.18.2.3) >> >> endobj -3419 0 obj << +3501 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 63.642 512.306 72.665] +/Rect [521.223 597.341 539.579 606.364] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.6) >> ->> endobj -3370 0 obj << -/D [3368 0 R /XYZ 85.039 786.531 null] ->> endobj -3367 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3422 0 obj << -/Length 3747 -/Filter /FlateDecode ->> -stream -xÚåœYs7€ßõ+¸zÙaU㜣ö!eK¶K©(«äõC’‡1IK\SfHù¨üùEãÎö8v"%å²HÑÓþp4’ –ÿȤ³jR”9ŒLæ·Gxr-¿y~DL‰™)2 Ê<¹:zô,ç‚Q…«ÉÕkwŸ -#Qå“«ÅOÙI³™Ò2Û/õËnúËÕwGO¯ÜÕ„1¸í¯G?ý‚' iÂwG±ªœ¼“ï1"U5¹=â‚!Á™ù¼>º<ú»—þŽO´ÔP-+‘(Y¿DÕ ò>E^L -!PÎ UR¢ -h:cyž=~ •iV‹)ÉV›ë錗"ÛË7Kýþv:#Y³ÛëOóF}¾•®PŸÏAl7We6òýϘðë»V¾«÷«f³Ó¥š×ðʳ½½éÉze¼Nœ0®ì¨t¥Œ)8Ex¨ ´×ýæÇ UX©Y Öo‡÷Ö­¢:4A‚dð ßuÑ´ZBK”R­|µœec”¦TäÙ´Æxvv»mUs4ýL]¼šÊÔLgÐZ×;Õ&d›dåƒ`û9Ü“Ær÷b îQî} âÜSjÝ $¯zæM‰äúòF 2ôùm€x+/´Ð*ÕHöítV ÷vTˆá•¾‹V‹$°:ÿF‘vµÆqÆT9”˜ Ò¤šæI»”?Ì#Œ±ì"èÆËV_ØUQ¸PÏáY}½„É£÷™®óXjN*.ðf…cìzêãø:-Á¼,ä% daz¾”W ·Š¸?ZwŒ¤ˆÅñv\å;`ApR­#\pÄ óCÂ=ÞÊ©´^Ë·k´é„h3&ădj0–©K0 gÚ· Î4¥Ö†NyŽQ‰™cJtèôx±j4ûÁF’Û;Ø·oìP îŠMgÖÓ.˾o®-öw«=LÈÍùê…jvð>³7¨çZ@²¢ü‹3µ Ì‹%€…ž«H Xß‚8°”ZŒˆ -î€ÑƒX·†…×Â…9¥òi81ÚW½‘ˆKÌ~dk]2–²KPÝ]Ñå¾qÊ)µŽ2“C.ö”™¦|}îº FUX Ãëñɺީ®ETgª×Çú»°1¨Nk¢©}£_/ëÛ)-²W7Ï@’ɆQKSñ±,½X‚eèÔ8˾q–)µŽ%•kác[®Y^ÜI¿Z«|8ýÆ&LbîÙæ5 ¤ím€e^Ï÷+<Á(p -âíRª Üìƒi/æfߟòÇ@š|&*S¯±¨¼XU賊ÅPõ-ˆ£J©u¨pŽä‡JhT'A’ -œ÷:T«Üj'¾ÍÂ.;äW t¥µtoeJÞâA…9Æ cÁz±ØÐÃq°} â`Sjmè**†°(°&[p¦±]wzM‡È&Kd"˜­hMƒÝ 5Ôû;5˜FvO–ºM˜Õ4lL°8f1›e}1¯Kàíø9Š·oAoJ­Ã‹1*óx©ÁûoÞµoW–ß;¹òaäžuįÚxe,h/–Ýñxtß‚8è”Z;¬ó²@Ì%ßfÖŸÔ:27)çƒcЯ{¹ª‹¹ÉV~¡n¥·&äƒÙµÂâÞ‘µnI6‹“íº8FvÀ‚(Ù¤ZÛ…y!_]ÂM’µ#ô÷+ùFý½Öc³M~íLþ -X-‚´³z·†.ÿJMòó»­ÝŸ@ö Ìô˜Þ£]A뀱L½X‚iǹ"Æ´oAœiJ­cšcD±ðLí°| lܾüÚ,¿w.‰üA ƒúr¹ßë&`æç×6£åÂeZ÷£©óXŒ^,±ãÏ(ƾqŒ)µ#ÏQ.r‘ŒçjÉkèid·[—{ßí¤ŸIµâä«#3õ‹Ì‹%u|—Çõ-ˆ#K©uó$cˆ`›ªQÀ`ž|¼x;¹Œmí¢gi†Í“fÓ™*Uk:Ë ÿˬj¬KÆRöb Êw1Ê} â”Sj]Ç”h…(Û9óĬY #ÖÖë ºéæ²Â]¡·;ð'ÙñÈ-õvílߨ­¡ðšÝ^ -ö*ììLKöÕ9šJåèÅ;rì[ç˜Rë8âa›áŽvž”£ œ“y¤vêJÒaEV«Ñ²ÌÌÇãƒÔ¦†1sƒíúñ.xîË+r"–K£àì Éþ׫츭ÕÖ¿ QÏb'mÃ͆a4û/$DÝzѸÓ[pÇ®n3Ø0ý¥j‹Fb¾ó‡Iä…’Ò¯ÖÊXE£OMbñVf ¥[Ù€ÑV–Tk[+JTßÈì,9H×9Ó³¶±õwçËýM£ÃîChª¡¨˜önvî'ìà¨Wñ%™é -ŽEæ¤ÄBו1`=õq^ W.Ë^ÜðzúV¨k·ß¿Ú¯í>/Ï–›úUR«ôŠDbÔ†ëyÉz=z–ç1—¨(Ki=˜Qo¥ÚùTЬ>Ș>j¦Bš³_îg»} ï—ðG[êžÝ -BF‡SsÏÈVóTㆱT½XkÇÅQ®} â`SjYAPI²Â½ºim/1ü`翾µÇ;Ö«ºu@}F@»è ®ê²Êl¬›zᇬlý² 2e*[²OÓOzc‰y±±Žëb§“,ˆK©µá´œlÍ]ú˜›púÅNïÌTØ®W:3uYémùu½ÑŸÕ)­·ê\r7—e^B*ZM»ô…ßôKpÞn½^]ûÔò»ƒó^Î9ÿ†£šª©@¸"©Z’nvûËy»ÚšMJ}¤ÚäKÍg=÷ÚÉ[7Ϋœe”£‚ŒÎœb‰Æi -}¤qö-ˆ7ΔZ7œÈÂ$ç¾qÚUÀóÓ3Û…mD¥c°0¢ú-86Ø"ü´þWïáL ùƒ™ÚæÅÀÏQ;{;`AXJ­F«åDx`6ÜâÓÎLTö&ã » +8¥tþL:¹ÈïO¿³u‰1‹c ýÇ8`AcR­ÃXr„ó£ ¨_lÙûþyiH±èÈÌïQÈeõ\i«i€}þ ~¢ö+w«¹,+ÿ£šúŽEèÅ_&ö-ˆ#L©u ŒÉ=BcG&H×Çžßu 3_´¨îûY[ñ±,½X‚eàTŠcÇm,ˆ³L©u,EŽª¼ð,mT²ÒO«ðxk˜š pc:æeóZQ„5“z–¬5±øgf©„Ú•añ)2£çÒwUÝÓ½²d^äGeê5•K  -|FqìXÔ€qT)µ—«YRzTyºÛuž9 4§v©ÒÁj“×Pâg,ðDæ§òñOžé„™’¯`XžÛìFžHÿ25 Í‹% Þ£8¶A;`AZJ­ƒF+T敇V„IJýˆImÜ~·³O¥¬×džÏ ©.ã¶ïíF„Nn\žØ]œBWáü÷1æ%âÅD×PÛ—° N$¥Ö!¹,){DÔÓxv¿Û‘qK~ç]›Òcšê@3Óíw°2¸zÒEÑâ‹t S·±¸¼XWà·®¾q\)µ6‰ çBT¸ùI˜‚{€ë$<‰òlµ–3D¸=ó¸CÇQO‹ì͉c}` "ý²ú6. ÕI%˜zç&öÔlj&tÚþGÊ -QJ?ƒŸ3yj •ÑÙª½¸ÐGõ½SH’=t³pA J~ïXÚÚ„ˆÅi†ž¥8¶k>`A”gR­ZÙS©J? -4µ˜Û¹UÜwîTü(ïkµ Õ‹% Þ¥8¶í5`AjJ­ƒšÃ‘ræ¡Úez·ŸiNË_ïVfP%Ùm°Õ(òAP낱T½X‚jà^Šc{(Ä©¦Ô:ª¼D¢¨º•{{pR{­—Z/ÿ‡~­cƲöb ÖÓ¬ûÄY§Ô:ÖL L¹gmWöÛݾ1';åMîõ¡¤¯Ûxf,l/–€xâØnÆ€qØ)µ6%ˆÂÃÎØm½SE‹¼ø{ð5ÎË׋%øŽ¦$–r° Î7¥ÖñŪhîùÚ4Â궶ÏkÊXj;)ûêÜ©>ó¯ÚCù©É?¡©ïX„^,0ð%%±Lë€q„)µ¡ÔÎÂ…¬M;èÞi]â§ía¶Sñ6q³Éºý2Eù0:£©öH^*Î1phc_}”bJ§…XbTÒbÕË=©UÆáZШÔ„Q„þeFWã‚‘@½Thà\Jbiõ¾ú(ДNÿ+]ˆeŒÀú)ùùÝv×Ào‡¨œÑ£gÁÏ_š«Á1€— 5'‰·;òÁfÔ ß»!1Ù¿FßÄ=9ùAw>ͤ©¾…G©ÊOÿÉ-U›Ñ¿¸e¥R?¸åüD þÞÖ¡úøËŒ ’>Õ,ÿ3ûk–Ÿÿ¾îÁg+Wedµ OÁæŸÈ‹3³,ê7<óS¿¦P`ñÿ–ÇIoendstream -endobj -3421 0 obj << -/Type /Page -/Contents 3422 0 R -/Resources 3420 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3471 0 R -/Annots [ 3424 0 R 3425 0 R 3426 0 R 3427 0 R 3428 0 R 3429 0 R 3430 0 R 3431 0 R 3432 0 R 3433 0 R 3434 0 R 3435 0 R 3436 0 R 3437 0 R 3438 0 R 3439 0 R 3440 0 R 3441 0 R 3442 0 R 3443 0 R 3444 0 R 3445 0 R 3446 0 R 3447 0 R 3448 0 R 3449 0 R 3450 0 R 3451 0 R 3452 0 R 3453 0 R 3454 0 R 3455 0 R 3456 0 R 3457 0 R 3458 0 R 3459 0 R 3460 0 R 3461 0 R 3462 0 R 3463 0 R 3464 0 R 3465 0 R 3466 0 R 3467 0 R 3468 0 R 3469 0 R 3470 0 R ] +/A << /S /GoTo /D (section.18.3) >> >> endobj -3424 0 obj << +3502 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] +/Rect [521.223 583.792 539.579 592.814] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.7) >> +/A << /S /GoTo /D (subsection.18.3.1) >> >> endobj -3425 0 obj << +3503 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 727.553 512.306 736.575] +/Rect [521.223 570.242 539.579 579.265] /Subtype /Link -/A << /S /GoTo /D (section.18.10) >> +/A << /S /GoTo /D (subsection.18.3.2) >> >> endobj -3426 0 obj << +3504 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] +/Rect [521.223 556.693 539.579 565.716] /Subtype /Link -/A << /S /GoTo /D (subsection.18.10.1) >> +/A << /S /GoTo /D (section.18.4) >> >> endobj -3427 0 obj << +3505 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 700.454 512.306 709.477] +/Rect [521.223 543.144 539.579 552.167] /Subtype /Link -/A << /S /GoTo /D (subsection.18.10.2) >> +/A << /S /GoTo /D (section.18.5) >> >> endobj -3428 0 obj << +3506 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 686.905 512.306 695.928] +/Rect [521.223 529.595 539.579 538.618] /Subtype /Link -/A << /S /GoTo /D (subsection.18.10.3) >> +/A << /S /GoTo /D (subsection.18.5.1) >> >> endobj -3429 0 obj << +3507 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 673.356 512.306 682.379] +/Rect [521.223 516.046 539.579 525.068] /Subtype /Link -/A << /S /GoTo /D (subsection.18.10.4) >> +/A << /S /GoTo /D (subsection.18.5.2) >> >> endobj -3430 0 obj << +3508 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 659.807 512.306 668.829] +/Rect [521.223 502.496 539.579 511.519] /Subtype /Link -/A << /S /GoTo /D (section.18.11) >> +/A << /S /GoTo /D (subsection.18.5.3) >> >> endobj -3431 0 obj << +3509 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 646.257 512.306 655.28] +/Rect [521.223 488.947 539.579 497.97] /Subtype /Link -/A << /S /GoTo /D (section.18.12) >> +/A << /S /GoTo /D (subsection.18.5.4) >> >> endobj -3432 0 obj << +3510 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 632.708 512.306 641.731] +/Rect [521.223 475.398 539.579 484.421] /Subtype /Link -/A << /S /GoTo /D (section.18.13) >> +/A << /S /GoTo /D (subsection.18.5.5) >> >> endobj -3433 0 obj << +3511 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 619.159 512.306 628.182] +/Rect [521.223 461.849 539.579 470.872] /Subtype /Link -/A << /S /GoTo /D (section.18.14) >> +/A << /S /GoTo /D (subsection.18.5.6) >> >> endobj -3434 0 obj << +3512 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 605.61 512.306 614.633] +/Rect [521.223 448.3 539.579 457.322] /Subtype /Link -/A << /S /GoTo /D (section.18.15) >> +/A << /S /GoTo /D (section.18.6) >> >> endobj -3435 0 obj << +3513 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 592.061 512.306 601.083] +/Rect [521.223 434.75 539.579 443.773] /Subtype /Link -/A << /S /GoTo /D (subsection.18.15.1) >> +/A << /S /GoTo /D (subsection.18.6.1) >> >> endobj -3436 0 obj << +3514 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 564.962 512.306 573.985] +/Rect [521.223 421.201 539.579 430.224] /Subtype /Link -/A << /S /GoTo /D (subsection.18.15.2) >> +/A << /S /GoTo /D (subsection.18.6.2) >> >> endobj -3437 0 obj << +3515 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 540.504 512.306 550.072] +/Rect [521.223 407.652 539.579 416.675] /Subtype /Link -/A << /S /GoTo /D (chapter.19) >> +/A << /S /GoTo /D (subsection.18.6.3) >> >> endobj -3438 0 obj << +3516 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 526.955 512.306 535.978] +/Rect [521.223 394.103 539.579 403.126] /Subtype /Link -/A << /S /GoTo /D (section.19.1) >> +/A << /S /GoTo /D (subsection.18.6.4) >> >> endobj -3439 0 obj << +3517 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 513.406 512.306 522.428] +/Rect [521.223 380.554 539.579 389.576] /Subtype /Link -/A << /S /GoTo /D (subsection.19.1.1) >> +/A << /S /GoTo /D (subsection.18.6.5) >> >> endobj -3440 0 obj << +3518 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 499.856 512.306 508.879] +/Rect [521.223 367.004 539.579 376.027] /Subtype /Link -/A << /S /GoTo /D (subsection.19.1.2) >> +/A << /S /GoTo /D (section.18.7) >> >> endobj -3441 0 obj << +3519 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 486.307 512.306 495.33] +/Rect [521.223 353.455 539.579 362.478] /Subtype /Link -/A << /S /GoTo /D (section.19.2) >> +/A << /S /GoTo /D (subsection.18.7.1) >> >> endobj -3442 0 obj << +3520 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 472.758 512.306 481.781] +/Rect [521.223 339.906 539.579 348.929] /Subtype /Link -/A << /S /GoTo /D (subsection.19.2.1) >> +/A << /S /GoTo /D (subsection.18.7.2) >> >> endobj -3443 0 obj << +3521 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 459.209 512.306 468.232] +/Rect [521.223 326.357 539.579 335.38] /Subtype /Link -/A << /S /GoTo /D (subsection.19.2.2) >> +/A << /S /GoTo /D (subsubsection.18.7.2.1) >> >> endobj -3444 0 obj << +3522 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 445.66 512.306 454.682] +/Rect [521.223 312.808 539.579 321.83] /Subtype /Link -/A << /S /GoTo /D (subsection.19.2.3) >> +/A << /S /GoTo /D (subsubsection.18.7.2.2) >> >> endobj -3445 0 obj << +3523 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 432.11 512.306 441.133] +/Rect [521.223 299.258 539.579 308.281] /Subtype /Link -/A << /S /GoTo /D (section.19.3) >> +/A << /S /GoTo /D (subsubsection.18.7.2.3) >> >> endobj -3446 0 obj << +3524 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 418.561 512.306 427.584] +/Rect [521.223 285.709 539.579 294.732] /Subtype /Link -/A << /S /GoTo /D (subsection.19.3.1) >> +/A << /S /GoTo /D (subsubsection.18.7.2.4) >> >> endobj -3447 0 obj << +3525 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 391.463 512.306 400.486] +/Rect [521.223 272.16 539.579 281.183] /Subtype /Link -/A << /S /GoTo /D (subsection.19.3.2) >> +/A << /S /GoTo /D (subsubsection.18.7.2.5) >> >> endobj -3448 0 obj << +3526 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 377.914 512.306 386.936] +/Rect [521.223 258.611 539.579 267.634] /Subtype /Link -/A << /S /GoTo /D (subsection.19.3.3) >> +/A << /S /GoTo /D (subsubsection.18.7.2.6) >> >> endobj -3449 0 obj << +3527 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 364.364 512.306 373.387] +/Rect [521.223 245.062 539.579 254.084] /Subtype /Link -/A << /S /GoTo /D (subsection.19.3.4) >> +/A << /S /GoTo /D (subsubsection.18.7.2.7) >> >> endobj -3450 0 obj << +3528 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 350.815 512.306 359.838] +/Rect [521.223 231.512 539.579 240.535] /Subtype /Link -/A << /S /GoTo /D (subsection.19.3.5) >> +/A << /S /GoTo /D (subsubsection.18.7.2.8) >> >> endobj -3451 0 obj << +3529 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 323.717 512.306 332.74] +/Rect [521.223 217.963 539.579 226.986] /Subtype /Link -/A << /S /GoTo /D (section.19.4) >> +/A << /S /GoTo /D (subsubsection.18.7.2.9) >> >> endobj -3452 0 obj << +3530 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 310.168 512.306 319.19] +/Rect [521.223 204.414 539.579 213.437] /Subtype /Link -/A << /S /GoTo /D (subsection.19.4.1) >> +/A << /S /GoTo /D (section.18.8) >> >> endobj -3453 0 obj << +3531 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 296.618 512.306 305.641] +/Rect [521.223 190.865 539.579 199.888] /Subtype /Link -/A << /S /GoTo /D (subsection.19.4.2) >> +/A << /S /GoTo /D (subsection.18.8.1) >> >> endobj -3454 0 obj << +3532 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 283.069 512.306 292.092] +/Rect [521.223 177.316 539.579 186.338] /Subtype /Link -/A << /S /GoTo /D (subsection.19.4.3) >> +/A << /S /GoTo /D (subsection.18.8.2) >> >> endobj -3455 0 obj << +3533 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 269.52 512.306 278.543] +/Rect [521.223 163.766 539.579 172.789] /Subtype /Link -/A << /S /GoTo /D (subsection.19.4.4) >> +/A << /S /GoTo /D (subsection.18.8.3) >> >> endobj -3456 0 obj << +3534 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 255.971 512.306 264.994] +/Rect [521.223 150.217 539.579 159.24] /Subtype /Link -/A << /S /GoTo /D (subsection.19.4.5) >> +/A << /S /GoTo /D (subsection.18.8.4) >> >> endobj -3457 0 obj << +3535 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 242.422 512.306 251.444] +/Rect [521.223 136.668 539.579 145.691] /Subtype /Link -/A << /S /GoTo /D (subsection.19.4.6) >> +/A << /S /GoTo /D (section.18.9) >> >> endobj -3458 0 obj << +3536 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 228.872 512.306 237.895] +/Rect [521.223 123.119 539.579 132.142] /Subtype /Link -/A << /S /GoTo /D (subsection.19.4.7) >> +/A << /S /GoTo /D (subsection.18.9.1) >> >> endobj -3459 0 obj << +3537 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 215.323 512.306 224.346] +/Rect [521.223 109.57 539.579 118.593] /Subtype /Link -/A << /S /GoTo /D (subsection.19.4.8) >> +/A << /S /GoTo /D (subsection.18.9.2) >> >> endobj -3460 0 obj << +3538 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 201.774 512.306 210.797] +/Rect [521.223 96.02 539.579 105.043] /Subtype /Link -/A << /S /GoTo /D (section.19.5) >> +/A << /S /GoTo /D (subsection.18.9.3) >> >> endobj -3461 0 obj << +3539 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 188.225 512.306 197.248] +/Rect [521.223 82.471 539.579 91.494] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.1) >> +/A << /S /GoTo /D (subsection.18.9.4) >> >> endobj -3462 0 obj << +3540 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 174.676 512.306 183.698] +/Rect [521.223 68.922 539.579 77.945] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.2) >> +/A << /S /GoTo /D (subsection.18.9.5) >> >> endobj -3463 0 obj << +3541 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 161.126 512.306 170.149] +/Rect [521.223 55.373 539.579 64.396] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.3) >> +/A << /S /GoTo /D (subsection.18.9.6) >> >> endobj -3464 0 obj << +3490 0 obj << +/D [3488 0 R /XYZ 85.039 786.531 null] +>> endobj +3487 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3544 0 obj << +/Length 3834 +/Filter /FlateDecode +>> +stream +xÚí[sÛ6Çßý)´~Yif…7^fv;ɸSw½µ³Ý™¶Œ¤ØÚÈ’*Êq3ýò‹\$Š§e·Ic'Ó©-Sx~ ÙùJÍ2Y Š2gZòÁäö(\›o^qÜŽÆ|¸j¶î¯‰ýëöÖøÁþ}>oÜ¡¥)üCÆÕõù°©·s{¤³ÔpõÆ_Ô›¹c'‹9zÑ}wº™ÛzÌ6£q!Ë¡©œÎ²Ö¯=‡k!˜àU¸¹–›6×÷áÛÔqXjœk;nÿÚà8ÁËVÂ*Ä(Ã<ãLeæŠJ°Ì°Gbæ„‘Ðùðê]xv»ÞXf(F{ðjT‡Æ€tÑÌx¸l»r¬ªªËÍ¿å”Xüÿ»t—FÐ}5‹IPQiWÐe8´jaÎVU¢ÎFÜèà;hkõÖ‰bÛâ™mÐkh¥ œÊ +‡ÿaZ]Å?MžHè¹¾rˆÅ9$T(9´«@È2ä`ŽF)'…“ÍÌtȾg¿Hú èl±ó5]ÿ jÀÃp žÀÏ·#­‡õõ¬WëÉÛ¸¦/kW„àŒî6Ÿ;ïš%øv laXHñJ‡—.Ý L÷R Ýù­/ûPŠÀ‰P +hÙ'D@Xõ:ÈËÂâ‰Ô¾0ö2C½0.³mz'îÒúq£÷®êÉ>)Ö ?Å@Ð?P…nü¤aæ…bR‹ÀŸ»°ðét +„Åð ú ãû‘(†+hùo}ç½ïü±‹¨1ÿzuíUr?·±ú +®=žñÊŠÊgþ:õÄY4}\ ê#cFôÅ‹˜o ‘ubnWÀL˜óŒ•æ·Ç,ö¢ÿækÓÈ•Öÿéè=YÙPï¶^a”™úœb}ï¼¾ŠˆÅE$`„ŠhWPe8(BLh!"ΡI_o’>ÞÏ·Ouc›,œbi½8vߥ±}‚Ÿø¯bÜPßBÿñ>™Vm¾|ìÑM}ÙÇbûž]‚=e8°—’Yd¯û èœ_Ã?·œoÒΡHÿlùúõÍm"—9þ~:ÙÎ}„8…â›™ëÜí(òõ…ûúôñôÂt/ÿàXÑ}±ÆbÖÄ»BÈN¬í*X)ë0vƒzí°ž`×í =‡Æº±`Ìæâ!ÄdBËGoö•H,FH$!EI¤]B"”áîg93ÿ'Á Ï™ÓÆõN›µ=66Ó‹à ˆñÛ‡ƒ{›ñÝLÝQèàïðŒ3wˆ-VË¿âÁëæ‘êÉÄFp•Jé?•5º¥/ëXŒ`¸œbÝ®Áš2ìYëJ²L kL᜿oÚÿF¯ÈgzÍKñ!øÇL° §¡Ë‡ÔŽõ9ú°²Y»®ô" &ÓƒA)‡kKh{3[¨ÔÂ."èò×Ñz/ôD›ëF›z˜@{  +-´JŒ—ƒ±PfÊ~x…Æwóc›ëV1y'²öB“?ǯ´°áÉ«‹K·JcfnKLâåÅðòn½†Àp2?6[wÔäæÜKéÝBhP»oÌÝ´½¹[U#½ìΦïdÿšÎ˪ÓËñZmïâò×X˜© WñtnZOñ+‹)Z›³Uð®éC 8åç°±«œÞùP¤¬xxéß{÷öm³±Ñft”šÚUèîŽIá;Vœé¨Ž ¦/`‰ÍvmõÖ.wº1Ñusv¶ žÙ£KßñÂâ($R`äÌäãN»9¿õ•‚/D!ð d°oœA·É Q°Jó("ø'®V¿›ÏîÍüGòÛ¢?Ðq}U‹:H PJhWÐe8 "fÞ­2áÕ pyV»$ËSì;"’ìŒp§½º0ß^&aœ½ÆØ Æõ*ÓyX@‡õUA,F¨ A© ]B”áÐ'd+µŒ*ðÃ×s€þ6ÄÌ>×`  N“»‹‹!ûöÚÆ“»µ_¸aþ¤à3ñ W\½ŸúÂÅø !t'üvø”a_•“Yß—À1l®XøéTH¡²¸Q +eq9Ûn­b®q!æO¬ønAŃBî½ÓyR¬yêy!ò.äªÐœ4’>ïÈ%"?·ó`$[ãÖaªýónãÿ +¨ÿ„ð¢'ú⿉—)¼í*x)Ã~PWyÆDâ|‰ƒúÓ黑ÎM<ïçƒ3ìºOVËqݦÊF㜫ÏpÞç×W±¡ˆŒE§"ÚU A ^å,×yT„àOpN¹³M½è̶¥ jïp¬ÒÃã (7s+èãíj ŸÒc~e.Y£w\U~BÌÑ=}™ÇbóÄõóvæ”áÀ\ÌY™ûqݦàøðÉåÎj¨0ß@Ô/òÂÿyÜì‰À²‡>ñþØx‘l¾tG.Í<2ٚ҇k”ÃãMí¶q˜ÃX8ݹiM8h¢IHáº?þ yÙÙr ¾HeotÌ%ÃÅ‹©bNí•pëwjãå;+A» +7}ß„MÛ~t ›Ìª²zˆÁ©2uÿ$sRŒ1žäDܹýó@S†ƒˆ³œeYEì#•Ž žgËf[/v§p˜ŸžÏ¶7.ý?ÝW…]OþuU¸¹K!‹?‡,:¡/ÙXŒ ›8˜"Û®A–2ìÉÊJ0¥«HV!Ùç?CÂ`1ŸÌ· ¿B¯Ló¯_'³ãíµ€YdâÞ?ÈÀq@ÍM=y¡Ë¤"+YQ–¦â`¿^ƒ½‘Ðóq·}Äî[>Y´‰–¶³í¸Ùnàó ~˜žÓ^s÷Î`ª­^ó/F/y¿mcø½§zâOŠuãO)øT¡?i8à/JVñH_#ý«›ozˆúÛ·ƒ{~ózÓÕªÝF\ݳrhõ6µXÕÓ¸ú¸¸‹ÏÔîWÈqßcÚc e™øãÛ6ú¡/ÛPŠ@=,Dçnζ},aÕÏ=d®™ÌX…sWË!U¹Ÿºð£t zæ° íÇÚþÖÃúà„Åœð¬WØ@â½;ð ^ÃEÝ&<¿Ž[ƒ«üð±*÷¹+cÒ> °j¶—“Í|m·‰BÌ!4Ë*žÆÃÏéÊF7Ë…ï@@h¹‘õ—TúŽè5g%ï¯úXŒ=ždu/;··¨!|ÊpèÑÌÙ"Qù~ŽõòôÌw#>EOV°çù%y@eÕøÝÇQ†;aË«oÎþcü®ù' }Ñp,FNüLnWL€…b—°ŸPâÙî 0ýûK‚(Âò*l‰;a¼]ä²M£wú"Åä‰ç…äÈÛU S†rÎÏUDânÔÚb¶»`fŽ@˜˜Ø‘ ñ¿|…‚xfÇf>i`V|B„Ñ} ÇbáÄÑáv”aOXT˹Ž„ý4¤ ì6×—öq×S7ñœ¢ÊÍ0í}ÓxR¬xêw!;÷¨B7pÒp^*–å p?óØêì|àÙ{Àåê"©Öœ¬|{vÓÎd.²´Ù²˜E#—>¬Ý±³»ÇÝœ™»ñàbŠ·ß—i,F0M\+dçVÄU ˜R†Ó"cšç‘iN7â‡ÆÒðÝÏûvøûõ8ã‡Lg095Ÿx|°Ä%JmÙÉF‚‰Ï?Uò#7ZôE_À±8ñ³TL€uΪ¼ˆ€‹4—í«Ñ]ãŸ'[,:r¿¶)†ÇF¶q±À\³ßèRË€üâZ£R $Þs_±2ñ§› TI •dŠ—dÙY/šUB2äfŸÕs}«mœãCó¦mD×z Òü¢øÈ-ï½/ÐXŒšø•Ú®”2ìó=BT¬ÌCWc¾'<Ôy’î{1_˜1-]K|º™@“´Oymq/¾ßªŠG·¸ì½ÕW±!„„Û Te8´iž3É øÄÇùÙ¹Aù'÷*ÍŒÈg\“)Pkÿ Ñ ÚéìI—ê!GÔ誾üc1‚‚âß®ÁŸ2øg‚EÄ/~ ~jžÜ„ ò·w¸æcÙ+]>‚I•óV_„R„"!;7´íø «ž>/+&ø}Šd·ñ:œ³Ÿîæáù‚ÛðÒ¹q©?Ä·wVOúI±nü)!;—òT¡[¤á €B³¼Q!…²Ù{Vdáf´•*¿,ˆìê]ØW±¡‹ ª@è‚2t‘Ón2êÂgZÖÍvµ†±¼d/áR:°¯*b1B Jí*ª  U(sv‘¨"OT±©ûb_´°«t[_-Äb„$Bu®¨¨¡ÊpЂÔ,*jÁ§uæ·5>j½Z'»3’¹Br†Ý +ä¦þ ²o†æ“Äžé‹;#p'^ªs­å@Ü”á€[p¦ +qûäkö[Lû|¿ÞO'ñÏ0½úãh\å£kå衾Øc1{â} +{» +vÊpÀž¬yÄ^µr~Ïj›zkç€6S a¢{+ÌçÖÑ£·úJ #$ $Ю!Ê°—@¥˜LSðægx ÈänݬàÍM6ó÷äEòªg<šì¹ |Üâ· +Krïýê WÛø>—ðõ¯I^Õ}Þ†ÉÆÀc©åï»'ËXªeâQ¡:WbÚö»ARV=Ç2c¥H9ò½užÀób³í,¦ìç“íÌ÷s!wÃEßôdKu³N¼N°nÛïfMY ¯i*˜(Ê„5¾¹çv~k/6qÿvÀ;X“òK î_¯iÝÖû;õâÎD(ÝýÞÎ}ûÝo¢‘œ•‡^$ ?a¯«{Èïÿ mÌd *;óË 50¤’8/,º·mÚ“’ÿØ*qendstream +endobj +3543 0 obj << +/Type /Page +/Contents 3544 0 R +/Resources 3542 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3382 0 R +/Annots [ 3546 0 R 3547 0 R 3548 0 R 3549 0 R 3550 0 R 3551 0 R 3552 0 R 3553 0 R 3554 0 R 3555 0 R 3556 0 R 3557 0 R 3558 0 R 3559 0 R 3560 0 R 3561 0 R 3562 0 R 3563 0 R 3564 0 R 3565 0 R 3566 0 R 3567 0 R 3568 0 R 3569 0 R 3570 0 R 3571 0 R 3572 0 R 3573 0 R 3574 0 R 3575 0 R 3576 0 R 3577 0 R 3578 0 R 3579 0 R 3580 0 R 3581 0 R 3582 0 R 3583 0 R 3584 0 R 3585 0 R 3586 0 R 3587 0 R 3588 0 R 3589 0 R 3590 0 R 3591 0 R 3592 0 R 3593 0 R 3594 0 R ] +>> endobj +3546 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 147.577 512.306 156.6] +/Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.4) >> +/A << /S /GoTo /D (subsection.18.9.7) >> >> endobj -3465 0 obj << +3547 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 134.028 512.306 143.051] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.5) >> +/A << /S /GoTo /D (section.18.10) >> >> endobj -3466 0 obj << +3548 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 120.479 512.306 129.502] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.6) >> +/A << /S /GoTo /D (subsection.18.10.1) >> >> endobj -3467 0 obj << +3549 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 106.93 512.306 115.952] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.7) >> +/A << /S /GoTo /D (subsection.18.10.2) >> >> endobj -3468 0 obj << +3550 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 93.38 512.306 102.403] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.8) >> +/A << /S /GoTo /D (subsection.18.10.3) >> >> endobj -3469 0 obj << +3551 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 79.831 512.306 88.854] +/Rect [521.223 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.9) >> +/A << /S /GoTo /D (subsection.18.10.4) >> >> endobj -3470 0 obj << +3552 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 66.282 512.306 75.305] +/Rect [521.223 673.356 539.579 682.379] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.10) >> ->> endobj -3423 0 obj << -/D [3421 0 R /XYZ 85.039 786.531 null] ->> endobj -3420 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3474 0 obj << -/Length 3914 -/Filter /FlateDecode ->> -stream -xÚÝœYs7€ßõ+Xz" Ž¹ò’r${ãìÆ«µärª’<ŒHJš5É‘É¡äÏ/g“3€=Žf+åN³þ€F£Ñ:JätT¤$áå(/2’r:š­N’Ñüä'ÔÜ15·LÑ=?\Ÿœ=ÉĈ&¤LÊÑõ­ûž2!i™®ç¿ŽÏ›õ„ãv¡_¶“߯:y|í¾©¦œÃ×¾>ùõ÷d4—Møé$!¼,Foåû„в­NDÊI*¸ù{yruò÷]ú31ÒR}½HyAÒ‚w»ASÔ *¿'ÏòQž¦$¹ê-IJ(%ÊÅøú~1™rùæ¼Y=,'t,ÿ¤²ú⥼PÏÚÝFþ16&“iš$èE”e÷â_üìÅhˆRRd®çnîFúÍsdU+5Eb]«~7X•Ñô° ©4²ÓÓ‚.M}k\­ƒ)Iä°ð0™†¹ªW -™é¡úf+±qþ5)|ÀÆC{±`déàn €cj`&ç¶(`®Ÿ>¯€ë[€| -S”äÝÔÚ%ÕòýúnÊþï(“ ¥ìÅ"”‘¹#”»-SŽ©u”åUOXÂÕ]Ö³ª­å,¦ã³f2•pgÚ/·Ó­z³±®ºZÙ°Qøõ@A9ÊŒ~Sh²‡Ci‘,cµ¨}­aH!UPB‰ÀŒRÍèlÜlÛ«Ù¦X­p‰(4}ý¢ÚÎôU¹¦>¨¹Ú¬·zý-IXk//¶ò-Õr·ù‚µÓË+£ÍøÅF~ƒ(>…îËPN*Ä[‰Ñ<Ĥ£>Œ%¢Ó’ÉŠ\^¢M¦Ñ\Ô¿%”/6ÊÞ`5erˆf6¾‘)/Ú‰üÿ[0ßÂÜ&Û,ÿ +b9¬-³ÝöYÉ 9;»l“TþOþ ÒÀq6Uèôí·X6/“ašþ¢j=ïQÆRÈ ú–µÿÚ7ÐnVŽÏåûpQŽ€®†)ãœ$Y1šRîÜ؃eû«B–‰ãtù_Æùd¹ Ë´ÌøЉdz1Œ‹€AŠ€é¶ &¦Öá)2ÏÅ.vÖÜ,t~«~ƒgÐOÍÝïã-$$Ÿ\°Z©Á¿uY¹1YJüU‰.PN3Zü5w§»4’“Š0òÆŠ ꨊètžŽ¥ò^—,BžŽ1ùârÜè¼ýávNßñüéåwú¶µìÆøI½l-Èò§°ÆÁ+^Úàï?õ‹úâem¥Ì,S€1>ÞmúK`6Fšn$;–”t/›XŠßÖvßz®3S—j`N5ümŽž`XäÙàD"‹ ]s“»,4v»-Þ˜Zë^DYF™½Öï;€*{.ÀŸALQÖiï¬ccî·¬ÈrIMÓoIÍvq 5$¦†Í¦ÖÓ‚ µ¨ZG­$˸§Æ>'5³È+·. üUBó¯LÍtq(5/¡†Ì¡ÖmA˜ZL­])DN ¥.+Xš•¢/Ľž\úôU½®–&8r+À¾Þ¢XùúÊŸV[¼d+×Ü¿”Iöå š…èÅ"‘5åR‚ØmAbL­›ziNdDí!:‡‰r•J[¼×WT£š›åb¥Ã¿'Ó©¡œ¼X„2X„S·aN1µŽ“$¡™çd]äKØÐ@D–fãjÓ(s3Y`‚˜³38 n¶&õþ£.°P•T&yû¯zU·Ì¡ZÞg ÿÊÒtp(3/a†ŒaÖmA˜YL­cÆ"²Ü3³ ³…üθ6 åôçꮶq+v“m³^œ~/ãŽ<=ò€Òvx(C/aˆŒaØmA˜aL­cH3RRÄPXÿØ­•Ò6rGa60P¿’PØKÈOïõ§ëF¿®$s9_ÿ á ü­NYš·±]á?õÇ ïr×úŠwÔÛ}× -.T/ðFG9Û|<—÷–:ô9ÚÍÊš '<œãBb‘¡inúÀÐì¶ <4cjmüÅ *S—ã’7L˜TW‹Ö•É Ù= ¼•®¿Bt÷”]—véðm §M5ŸLs‘Ýé5À@¦H,Ì—1`ÚÓ‚ Ó¨Zënxž–#¤”ôÔU™ îk¸ªù|»ºé©¡J3’p[%×¹nùs„Ýúx ƒÚlqÛz)=–¼A’ƒ¹¢­M3¶“Š°öF î¨“Žèt 3FrFi†J*¶à©Ú˜í½ZnÔ»µÕ)MÈ™BUümwj«@$Ôø°ÇZDÞAËoâˆmLJrôbȨ’Ý„QÆÔ:–BÌ1KSÕî]®Ê”V3È?èHýÎpµåO§Ú[OÔÎê¬Æ³ë3öêì—ËSˆØóf`<”‹0@Æ`,TÊÜÓ‚0ƒ˜ZÇ€§$c 10uçÏõ‘js·ƒýa«fá Àœ À{˜ªÂV}¾Yàsœ@’øI½w‘¤GåX+ ëÅ"`‘…ËB`»-ƒ©u`#IÎXS¬þhözWï|b æ©ŠÖ_ôÇ9Oમ*ͳã‰Vm§‡rôbŽÈ Œ…J|{ZæSë8&I™@MeûcØã^Ú%tŽ®4è8Q8ö' -'KÖ‰ª)È{_ -·á1`Η”;…7ûîté¨øù£ëÇÇ¢QBS$ÕGf`eozÈè{ãz-##OS}}®SDnÒT¶B¡îÍ2ˆlë¹ôŸs•cs0Ûÿ³ ‰…g¶-c¡ìžg[T­CZP"FjJ°_‚„_bð<1Ñ¥|£·òÍjý[/à˜]Á–×Tˆ"_w6„t»K,yj‚¬ãYèObõ¯ƒôÍjžÛ™ÈYøPG9ys€c~$¸õ‰tŒ&íÞaRܬ*S›B4~‡-tü½Ü GS–“"œÇDb‘ÁdnÒƒ)TþÝÓ‚ð`Š©uƒ)„ïíJMù÷óÙ5žÊM¨Õ\e ]ÙÒ©ÿ%Øk8$¨&®:<Ї=BQ-¿íùP˜^,Y•ñPYbO Â0cjL!Ý{^àCB&Ù@š¶B‚á¸øfÿ”áßà0Ú‡] %àük3ÝJÌ‹Eˆ!Ó1ªÇéiA˜XL­#Ær"g;&F5±ë9>FÕ·R'@8¸Ÿ°,û랎ka6= -Ó‹E`"«2:4ïiAfL­ƒ)¸,߃É4Ìíâ¦V¥f¯Nî^a%úÃ̬Ú$ úæéÞÂçv¨í¬|ÛÝLWÖé2¹[KøGVÒO„dz4’‹@BÖb<”YïiARL­ƒ”$#F\32¹ÖN.m¯fÌ”0Ö‡^œCéÐ1Í.ÝË¡ÜœT›·_„ZG}ZD§eFái1NÂÁ“>íÉÒL:õéïU¨ÊÐ Sk…P‘X˜*¶pkO ‚\£jØœ“„ãÌ<®À>]oÛj¹ÄÂí½{ÀO_iªÛƒpÊÙª±ÊU¹d`ž°/ÎÏtv(?/ᇠÉx(;ÞÓ‚0¿˜ZÇ/-‰(ö¼i¦ù=RÆoê9NâÍ6u[ÏlýCoV\ìMµ={Þm‡ý*ï©å ¡1ýŠÆ‹EÐ EÐt[FSkO©HIÉ=ªO{æU8±v¸OvÙq÷[ýU¥&ÐN~¥¼í½/ðÛù*ý®Pšõz›a‘þµ©e:;”Ÿ‹ðC†d¦‹ÀDVeˆ)¦Ó=À¬ ´À”Ì™ðϺZ|gÃÇóF-^«JyÎ¥š .·ß{ªob»¶Qdm^iª_—uÛ¢yÕâ’ø‘XþÑQ¥éÉÐÇ—9©Èã˼> >> endobj -3476 0 obj << +3553 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 754.651 512.306 763.674] +/Rect [521.223 659.807 539.579 668.829] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.11) >> +/A << /S /GoTo /D (section.18.12) >> >> endobj -3477 0 obj << +3554 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] +/Rect [521.223 646.257 539.579 655.28] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.12) >> +/A << /S /GoTo /D (section.18.13) >> >> endobj -3478 0 obj << +3555 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 727.553 512.306 736.575] +/Rect [521.223 632.708 539.579 641.731] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.13) >> +/A << /S /GoTo /D (section.18.14) >> >> endobj -3479 0 obj << +3556 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] +/Rect [521.223 619.159 539.579 628.182] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.14) >> +/A << /S /GoTo /D (section.18.15) >> >> endobj -3480 0 obj << +3557 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 700.454 512.306 709.477] +/Rect [521.223 605.61 539.579 614.633] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.15) >> +/A << /S /GoTo /D (subsection.18.15.1) >> >> endobj -3481 0 obj << +3558 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 673.356 512.306 682.379] +/Rect [521.223 592.061 539.579 601.083] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.16) >> +/A << /S /GoTo /D (subsection.18.15.2) >> >> endobj -3482 0 obj << +3559 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 659.807 512.306 668.829] +/Rect [519.586 567.602 539.579 577.171] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.17) >> +/A << /S /GoTo /D (chapter.19) >> >> endobj -3483 0 obj << +3560 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 646.257 512.306 655.28] +/Rect [521.223 554.053 539.579 563.076] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.18) >> +/A << /S /GoTo /D (section.19.1) >> >> endobj -3484 0 obj << +3561 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 632.708 512.306 641.731] +/Rect [521.223 540.504 539.579 549.527] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.19) >> +/A << /S /GoTo /D (subsection.19.1.1) >> >> endobj -3485 0 obj << +3562 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 619.159 512.306 628.182] +/Rect [521.223 526.955 539.579 535.978] /Subtype /Link -/A << /S /GoTo /D (section.19.6) >> +/A << /S /GoTo /D (subsection.19.1.2) >> >> endobj -3486 0 obj << +3563 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 605.61 512.306 614.633] +/Rect [521.223 513.406 539.579 522.428] /Subtype /Link -/A << /S /GoTo /D (subsection.19.6.1) >> +/A << /S /GoTo /D (section.19.2) >> >> endobj -3487 0 obj << +3564 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 592.061 512.306 601.083] +/Rect [521.223 499.856 539.579 508.879] /Subtype /Link -/A << /S /GoTo /D (subsection.19.6.2) >> +/A << /S /GoTo /D (subsection.19.2.1) >> >> endobj -3488 0 obj << +3565 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 578.511 512.306 587.534] +/Rect [521.223 486.307 539.579 495.33] /Subtype /Link -/A << /S /GoTo /D (subsection.19.6.3) >> +/A << /S /GoTo /D (subsection.19.2.2) >> >> endobj -3489 0 obj << +3566 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 564.962 512.306 573.985] +/Rect [521.223 472.758 539.579 481.781] /Subtype /Link -/A << /S /GoTo /D (section.19.7) >> +/A << /S /GoTo /D (subsection.19.2.3) >> >> endobj -3490 0 obj << +3567 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 551.413 512.306 560.436] +/Rect [521.223 459.209 539.579 468.232] /Subtype /Link -/A << /S /GoTo /D (subsection.19.7.1) >> +/A << /S /GoTo /D (section.19.3) >> >> endobj -3491 0 obj << +3568 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 537.864 512.306 546.887] +/Rect [521.223 445.66 539.579 454.682] /Subtype /Link -/A << /S /GoTo /D (subsection.19.7.2) >> +/A << /S /GoTo /D (subsection.19.3.1) >> >> endobj -3492 0 obj << +3569 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 510.765 512.306 519.788] +/Rect [521.223 418.561 539.579 427.584] /Subtype /Link -/A << /S /GoTo /D (section.19.8) >> +/A << /S /GoTo /D (subsection.19.3.2) >> >> endobj -3493 0 obj << +3570 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 497.216 512.306 506.239] +/Rect [521.223 405.012 539.579 414.035] /Subtype /Link -/A << /S /GoTo /D (subsection.19.8.1) >> +/A << /S /GoTo /D (subsection.19.3.3) >> >> endobj -3494 0 obj << +3571 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 483.667 512.306 492.69] +/Rect [521.223 391.463 539.579 400.486] /Subtype /Link -/A << /S /GoTo /D (subsection.19.8.2) >> +/A << /S /GoTo /D (subsection.19.3.4) >> >> endobj -3495 0 obj << +3572 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 470.118 512.306 479.141] +/Rect [521.223 377.914 539.579 386.936] /Subtype /Link -/A << /S /GoTo /D (section.19.9) >> +/A << /S /GoTo /D (subsection.19.3.5) >> >> endobj -3496 0 obj << +3573 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 456.569 512.306 465.591] +/Rect [521.223 350.815 539.579 359.838] /Subtype /Link -/A << /S /GoTo /D (subsection.19.9.1) >> +/A << /S /GoTo /D (section.19.4) >> >> endobj -3497 0 obj << +3574 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 443.019 512.306 452.042] +/Rect [521.223 337.266 539.579 346.289] /Subtype /Link -/A << /S /GoTo /D (subsection.19.9.2) >> +/A << /S /GoTo /D (subsection.19.4.1) >> >> endobj -3498 0 obj << +3575 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 429.47 512.306 438.493] +/Rect [521.223 323.717 539.579 332.74] /Subtype /Link -/A << /S /GoTo /D (subsection.19.9.3) >> +/A << /S /GoTo /D (subsection.19.4.2) >> >> endobj -3499 0 obj << +3576 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 402.372 512.306 411.395] +/Rect [521.223 310.168 539.579 319.19] /Subtype /Link -/A << /S /GoTo /D (subsection.19.9.4) >> +/A << /S /GoTo /D (subsection.19.4.3) >> >> endobj -3500 0 obj << +3577 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 388.823 512.306 397.845] +/Rect [521.223 296.618 539.579 305.641] /Subtype /Link -/A << /S /GoTo /D (section.19.10) >> +/A << /S /GoTo /D (subsection.19.4.4) >> >> endobj -3501 0 obj << +3578 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 375.273 512.306 384.296] +/Rect [521.223 283.069 539.579 292.092] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.1) >> +/A << /S /GoTo /D (subsection.19.4.5) >> >> endobj -3502 0 obj << +3579 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 361.724 512.306 370.747] +/Rect [521.223 269.52 539.579 278.543] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.2) >> +/A << /S /GoTo /D (subsection.19.4.6) >> >> endobj -3503 0 obj << +3580 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 348.175 512.306 357.198] +/Rect [521.223 255.971 539.579 264.994] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.3) >> +/A << /S /GoTo /D (subsection.19.4.7) >> >> endobj -3504 0 obj << +3581 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 334.626 512.306 343.649] +/Rect [521.223 242.422 539.579 251.444] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.4) >> +/A << /S /GoTo /D (subsection.19.4.8) >> >> endobj -3505 0 obj << +3582 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 321.077 512.306 330.099] +/Rect [521.223 228.872 539.579 237.895] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.5) >> +/A << /S /GoTo /D (section.19.5) >> >> endobj -3506 0 obj << +3583 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [495.133 307.527 513.49 316.55] +/Rect [521.223 215.323 539.579 224.346] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.6) >> +/A << /S /GoTo /D (subsection.19.5.1) >> >> endobj -3507 0 obj << +3584 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 293.978 512.306 303.001] +/Rect [521.223 201.774 539.579 210.797] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.7) >> +/A << /S /GoTo /D (subsection.19.5.2) >> >> endobj -3508 0 obj << +3585 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 266.88 512.306 275.903] +/Rect [521.223 188.225 539.579 197.248] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.8) >> +/A << /S /GoTo /D (subsection.19.5.3) >> >> endobj -3509 0 obj << +3586 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 253.331 512.306 262.354] +/Rect [521.223 174.676 539.579 183.698] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.9) >> +/A << /S /GoTo /D (subsection.19.5.4) >> >> endobj -3510 0 obj << +3587 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 239.781 512.306 248.804] +/Rect [521.223 161.126 539.579 170.149] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.10) >> +/A << /S /GoTo /D (subsection.19.5.5) >> >> endobj -3511 0 obj << +3588 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 226.232 512.306 235.255] +/Rect [521.223 147.577 539.579 156.6] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.11) >> +/A << /S /GoTo /D (subsection.19.5.6) >> >> endobj -3512 0 obj << +3589 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 212.683 512.306 221.706] +/Rect [521.223 134.028 539.579 143.051] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.12) >> +/A << /S /GoTo /D (subsection.19.5.7) >> >> endobj -3513 0 obj << +3590 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 199.134 512.306 208.157] +/Rect [521.223 120.479 539.579 129.502] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.13) >> +/A << /S /GoTo /D (subsection.19.5.8) >> >> endobj -3514 0 obj << +3591 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 185.585 512.306 194.608] +/Rect [521.223 106.93 539.579 115.952] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.14) >> +/A << /S /GoTo /D (subsection.19.5.9) >> >> endobj -3515 0 obj << +3592 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 172.036 512.306 181.058] +/Rect [521.223 93.38 539.579 102.403] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.15) >> +/A << /S /GoTo /D (subsection.19.5.10) >> >> endobj -3516 0 obj << +3593 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 158.486 512.306 167.509] +/Rect [521.223 79.831 539.579 88.854] /Subtype /Link -/A << /S /GoTo /D (subsection.19.10.16) >> +/A << /S /GoTo /D (subsection.19.5.11) >> >> endobj -3517 0 obj << +3594 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 144.937 512.306 153.96] +/Rect [521.223 66.282 539.579 75.305] /Subtype /Link -/A << /S /GoTo /D (section.19.11) >> +/A << /S /GoTo /D (subsection.19.5.12) >> >> endobj -3518 0 obj << +3545 0 obj << +/D [3543 0 R /XYZ 85.039 786.531 null] +>> endobj +3542 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3597 0 obj << +/Length 3906 +/Filter /FlateDecode +>> +stream +xÚåÝsÛ6ÀßýWhü$ÝŒ`²/7‰“\Óks¾Ø™t¦í-)¯¶äè#½þð±V"¹9fâž›N#‰"¸Ðþ‹ÅbIóQfþã£R±,¯Fº,˜Êùhvs”®Ì7;âpÆN™¢s_@j&”L†Àò¢?›”r¼^ÝøQýÚO`í±Óë&æ,ýíÊQ/ýç!üOîÄ9_¬ýla#ˆJÞ¸ ‡¡pS3.Ò1·Ý.%8ÂÍsÜ"¸à>qÎOØËSsð£;0ÛÁ2Ì^·oa àB€k‹bQY¶ÅÃöô ®¡6š6€P%zm ÝÂ(ÁÑÌʉ+•l ÿZ6€qñ £ú £¡àS3<Ò?¾Ý<%8NñYÁÌÿ¼¦¦ø3bŠ?œÓ­‡Ÿí»~9þ·?ÿÕ‹ç?Ÿœ›õ¢‘piWŽíüÏí åBÊ\}M¶ †¡lS3‚-R±Py/Ûv¶”à0¨U•³LéÄökÌÚàÙmš„¿„â´*ò;£á'䈚õsÄê$8vt¡Ÿ#)8rÔfÙ••‰c˜ öËñ%¨~½ð ¸æ=?¬.Cêçelz,îµX›˜1+7ȹ‚l]&Λ†E?-xù'¹Ýðë‡"MͤH³&NêEÚî”Ü®*«TDZö»]ÒånßÃfSö³æ/ŸŸ}ÇdJ¶<³Q×µÏoãyù<€]·§uô¬+nÏ° nx&Hæ¬è!wr>k«Þ‘P,«Œ¾x3Ùš)·2=;³Y ¡ËÿaœpC¥„1ŸÁ{ ¨1à¤Ï…vˆ±@ ŽîÍœ]i(„Y*f­Ù¹­€´Ÿ3E¦¾·o´YÈeŠ5L° Ôìu1”olEàMZªw°-Ÿ€KHlÍpÏ9OpÅׄ ‘‹››¬Û´~)ãúÞÂe ¥›šx‘¢)¾í.€)Áq&ãœé"¦‡+˜ÉºÖ“27ÓÀM³¬¯éÙhƒçiK·ÞàÄÍ×M¸Äœnzª²â>Ý žšÀ‘Þ…*z·»@§‡!-«Òm¡FàÑ_£Þ"ìݯÃäH×;kK¼_ÐÀh>þûb½\€eüäË>æ.TyÌêݶÜvcíb“OÁW¬.]˜{q®å— ¿q 8Ô¬Ö®£ ýàHÁ\)YQä \ðůírІ›ª×ë•#4‡‘fGlìšxÌz ýï}õeûÔÿcsÓlëT˜Qdù}õÄACù¦f_¤fŠo» _Jpä«9ã\&¾!‡Qõw{+øãŸê«&ÄìØoWËÅñ_M̤Õ77Õ åš¼‘Ú)Þí.¼)Á‘·Ò̬#oqw}Õ/–qÝ%LÐåOñ>Õ(Sÿ2·±·º¼Žýdž;毻Ü÷çÖ‡FØ«ëñ|a½ƒ +~ïPˆ©é’‚Øî‘Â')%Ëx\ý˜&Fþø|±E{ê~Õ}‹ÖȾ´…Ííâ +ÏÜ`KKoUÏÍ”(õÞ\ Új©aˆ„P½ÕT] L€Çqž1YhdœuT®åÒ½KErõ|¾¹¹ì(VSËòÎ4^ßô"íÇì–¿Û ìÉÛæºq•zv*Ïô}ñæßõ™hq¨i¤f„i B”i´»@˜%8š/XűiT{³wõ¢²OÎó»j Ovãs¸6IÌf«å›¶ãpó¿s/Ö BrÏ71gðê¾Oí ¢¡ÜS3‚;R?ŽÝ‚;%8rÏr–%âwL$çï&ùzfÿõûÕ×ß™ï³aÀA¦Ï¦¼¸8¿Ÿü|vl§h}¼à§ å•š¼Ú„*{yµ»@ð¢^yY±’WˆÜÏðÒ®–V¹ļ¹Œ[,ö½v®–Ú}¿^àݳž øgÍÞ†N¦T<ô5ÐP³~#À,„ê­‘íèB¿‚£è‚ ì«áv‡G³w»f¯Þ³4_]º >?éäü~βÖÅC\‚v†­àIï¢è-ŒmË'pR#íB0-8 wE<µ‹è³¾š6wvRÏlîʺp}7.|âÒfºÌ‡¢‚Ÿ6”UjFÀBjEo•[G\”àÈKHó‚›N}+¸:ìtnWéN–8È;p‚Ž†‚OÍðHÿ¢è­ÿêèžÀ‹Ê |­p‚(c“b ù”íEÁååþ®Î?vvÿôÖü;­ªüÞÑ ŠH5맋•LÐíèB?]Rp¤[r&Å]îé¾ZÎñþ¸¯«ÝîÞ?ÝÏàîÝzÔŸ Ÿšà‘þEÑ[9ÑÑ<%8‚/4+5NýsáÁ¿‚Çbà0ª;WW}óŒØfüÞñï¿]Üœ» †Ãf7óµ£¾ô5§k{¿V%ùÝQ ¥ššT‘rEÑ»¡ÓÑ‚*%8RU’å{iû´Krö­«½e2V@ÂîìAeïÙ“S[Äö0Ç.(d(åÔŒ Œ”MQnw L Ž”¥Y?jœ µO0ù åg×0®ÝóLÌè|[¯a0ôA%Î@_C 5#Œ± Œ ÝÂ(ÁÑ„fBଯ}‰5‚çËͶ¾¾Æeø°Y(çNEÓþ¡&í¢i” Uu¬|‹‰b‰{ÄÔ2”ujF°F*7u» kJpdm¼x¡÷Xžõ#jÕÌq†7AÝ6³P]ә͓îù6 =¿ýµv_¥VêhÂJ35#h"¥Š¢w¿¦£ MJp¨º™–#Lî‹.:F-uï…<¸»öe|’Þ(ÖnxîÌ%ÍiŸRIë.Ýh³öeu>ø:,e…•x©þ¬ëµ2”tlE€NúEï–L[>™Æ,·§+9ÂÌaG £x§l¥îåÑ¢Ó^ûú;qÏßM5SËh/•ÏãKQ>¨:(k }Ô¬?AðïèB¿‚£èœe¹@õÿåÒº“·ó #>ÝSg­@Iuß¹ƒŠ†rOÍîHýB÷nÍutàN ŽÜUÅd‰|Žêf á¹ ÁvøàÓõMX.[´—¡:Ê|÷n‡mç®Ó«»Ÿpb¿zì²ü{î\¾¶ †¡lS3‚-R1ŶÝ‚-%8²•ŠU9f µ¯­+¯·©n¿^¼Û5î41á!Ò–©_«õ”Oz€J©Ûy;Z ÷FÛ$Škm7u¥ïŽ+¨`(×ÔŒàŠÔ+tï&]G®”àÈ5,/%â +õ?ù›Üý†°­¶Z³:(Bæ +"êíâÖ>ê±Ò÷݃†²MͶHÅB÷n]ut`K ŽlyÉŒÛCl¡XÂݶv‹—&p~ë]ójïñëÅûfÓlÃè-yñ­eG‚z†2OÍæHõB÷fG:º@0§‡5Ïé¾^›Û¶‹¬‹RņUöñqÀú/Ì9Ø˸˜ŠÏ~µIŽâ~V$ß­m€‡ÚFjFØB$to6¥£ „mP‚ƒ?¨8Ó¹F¦Á±;pMt÷õ¶~\ãGÀ[©âÛNš‚–’O­úÁ#ý Ý›wiËïÇNI-/1uXŒ=n–.þÉ;†gþvD÷È_­Åÿñ£ß½¾†>F6¶"#›HüÛò©?Ð/5=Ey‰øâìÇÕ¦°#½ó9îß.wÐÓà‡ †VÔ3#‚{[~‹{øSQ1‘©®?aþÏÃſüoQÄ?˜!KV•½ùÍ +-G¹b2¬ {œ„zü-*endstream +endobj +3596 0 obj << +/Type /Page +/Contents 3597 0 R +/Resources 3595 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3382 0 R +/Annots [ 3599 0 R 3600 0 R 3601 0 R 3602 0 R 3603 0 R 3604 0 R 3605 0 R 3606 0 R 3607 0 R 3608 0 R 3609 0 R 3610 0 R 3611 0 R 3612 0 R 3613 0 R 3614 0 R 3615 0 R 3616 0 R 3617 0 R 3618 0 R 3619 0 R 3620 0 R 3621 0 R 3622 0 R 3623 0 R 3624 0 R 3625 0 R 3626 0 R 3627 0 R 3628 0 R 3629 0 R 3630 0 R 3631 0 R 3632 0 R 3633 0 R 3634 0 R 3635 0 R 3636 0 R 3637 0 R 3638 0 R 3639 0 R 3640 0 R 3641 0 R 3642 0 R 3643 0 R 3644 0 R 3645 0 R 3646 0 R 3647 0 R 3648 0 R ] +>> endobj +3599 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 131.388 512.306 140.411] +/Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsection.19.11.1) >> +/A << /S /GoTo /D (subsection.19.5.13) >> >> endobj -3519 0 obj << +3600 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 117.839 512.306 126.862] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (subsection.19.11.2) >> +/A << /S /GoTo /D (subsection.19.5.14) >> >> endobj -3520 0 obj << +3601 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 104.29 512.306 113.312] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (subsection.19.11.3) >> +/A << /S /GoTo /D (subsection.19.5.15) >> >> endobj -3521 0 obj << +3602 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 90.74 512.306 99.763] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (subsection.19.11.4) >> +/A << /S /GoTo /D (subsection.19.5.16) >> >> endobj -3522 0 obj << +3603 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 77.191 512.306 86.214] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsection.19.11.5) >> +/A << /S /GoTo /D (subsection.19.5.17) >> >> endobj -3523 0 obj << +3604 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 63.642 512.306 72.665] +/Rect [521.223 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.1) >> ->> endobj -3475 0 obj << -/D [3473 0 R /XYZ 85.039 786.531 null] +/A << /S /GoTo /D (subsection.19.5.18) >> >> endobj -3472 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R >> -/ProcSet [ /PDF /Text ] +3605 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 673.356 539.579 682.379] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.19) >> >> endobj -3526 0 obj << -/Length 3701 -/Filter /FlateDecode ->> -stream -xÚÕ\msÛ6þî_¡ÉÜL¨›Žx#Èû–:ɵ¶qÏN{3m?Ð-ó*›.Eå¥÷ç‹w‹¦õÙžNjŠÄr—ûøW€²•Zbc”÷ï N#´Ü7KØ%QX0f—nšVëÈEJ‡U@.ªÈuvÙöšW„Ã+8Šò -˜ð -Ú¶ð‡@Ãé_¯;øù~ ?ifξuí;¸bÈ¡ÕE×kþ8®R–Èþ5\•×‹’Þ?î‰^¡©ÔÒ" ZɳwPê¶Ö8bª•rŒßgSLz=/YÖíz —fƒä’á  ¶4þõf£z*Î~ƒ«­û¹ŠñDÝõu»i ¡€U6tú×)ô -XyGÏ·1^ýtpè/¿Ì‚>Aî‡_E)$fx*DZ8Ïl#͵*µDù–Tk9W†('û¤ãšt2ö`ˆz¤,‰cI>ÆxöðÒPH2êÂŒJï/›Þº4Çh­_ÃYÅ™œ1„ -”\šf¼TšwM¯[Þ2›rÄ°0 e0±„ÑáBFädìVÀ€¡°^Á ¹‘ÃU,Q§ô)G &ál2-½X‚–¦‘¢%Ëc´[§eJ­£%¥HälŸ–Ą̂=†zqD1”1† 5o>6‚y‰¡Ü(lÀÙ!˜:³:„Vá8æI¦‚ãÅà^J€3¶ NJ­‡È¤Šæ¥çøl}©†g€¥*Ul0Oy{fZoL„ŒG°ƒÁ¾j†joLôÉkÁá‡Ivºu4Ý ’­%B£Á•,Ðð—Òš§ÑùóÉ“ùåÅü2îà×Ø‚8¿Rj-¿xEQÎGét¥øõ™ú]j¿hns!*3<ÁÐÄsæ6‡’h8¿½ìv`Ôn®"ĽlT‘í|lq¬ÒA%µT èîÆC|”*øÃPŒ‹ -ñ|rRˆÅ)fiŠáÅX¥XR­£XÁQÅË}ŠÉ†siµ"#üÑÔ‰xéFJý nЫéíGÝ^1¸‘O³á'ð¥"ˆBêj5àÇ‹m²l³…Ä©ÌT¸k5¯±š -ƒ5Šh.‚uíï6;+0}¬±Œs‚˜j*ѼX‚h¦ÑD['ZJ­#-QYŒx†5Ï^¹P û»c+*?lÂÍ6ƒ¯£šÌø³³VsÌ­˜ðåA8>±¢ÌLíôÝëË–]oh4˜1²y×.MdûVSpeæQüñòŠp‰Øä´:KðÊ4Ò¼"1^-ˆó*¥ÖñJ6Å(­ÆÄ°÷À‰fs¡’c_T2ûêz;¸JŽšÿÀÁ‰¢Š¯ÎÁ9&ªî£ÿ«œš³o_r|v¹ÇsRŸ»šŸlùL dû."r¸gî‰> $#´¤ÆÎÚ»s "ZÉ~|ЀëºmZ¯‰U%"x 5 éâ­U‚цҽцڂîþP™NˆšIRôŸ¤oÍ…N½–ç*Æ'ö!û,ûP ïC¡Ÿâ}è€Ñ>”Tëà)*ŠQí3 «ˆ6‡3M}À¸âç²»‚?WÍõªY)8w+3PEqC5H ¨KP cñT¼X„À„Ñc â ¤Ô:–žeú˜t…p¯‹ŠÝî"pBu˜âoÚu=týGŸ[2³WÐsþÓé•­RewLv¬¯aNesò¸Ù4ç}=D§ùUœÛõ¾·î–K›Tª)œ`â)Ö’HNŽ'3Ì‹%fÝÁ°±q†¥ÔbNeˆ>†rÎÁ ºiû^ßÎ}Nv©g5Ý 2µK¿k·í`çÐ%.þdÿG8ͳO…Ó‹%à üš€slAΔZLLÀ 9b…¯Èá…LMD½ æ­Åï¯h€è{~(yñ8»èçàmœ3o/–À;pýT0½XÍÀ³ 8ÇÄñL©ušIE¨™L]@Ö#2]¿¨Uö­)tÔv«›Yfò$#Ð-5´Í‡›M­²'ØOÊ8Шlžx*ˆ^,bàMŠˆc â ¦ÔÚ’ ¥É®±b†ÕúhQå£g7 -Ÿ¦¿pÕ©áÙÞ6ÌÊ­vªNÊJöøFUó°Sñób üG&ð[Ç/¥ÖáGÊÝÇOoÿÒmgØÛ£ò,,ô¶×:BÐ_¾S?ž½1èn‡ºìNîÖÖ„¡Ú/(ÿcXçbáÅXNI`1¶ ŽEJ­Ã"/'l 쉽æ\`|nv©\shêëµê»úªùüÑëOî?æ§bæŘÎ#LÄ0[Ç,¥ÖbF@½àû˜é}ÌËÝͶ“Ic«Pú›éF n«ßÌüã¦ÉƴѲæäÊïk^ö®EñÉη–Nt~ w~è…¸óXu~R­s~‰##çëý¼"ø ¹q†€óqfgýÿìçœÈŽÁŠ—Ù[µÎÒþœc¶T™ƒZïg2uŒ˜{ÔjùûR­Iúi'ä˜!è»lRߊ!i{*’^,dàRÂbo° ŽdJ­C²¨Å>’zëodGäËÀÅPCín®ìâ˜[~Tõak7¦¬ A./?Dô³Ï86/–€-ð_¶±qØRjlœ!$å6ŒXýîjkB¤k/픫m«›Nm‡ö-„.¥*Ø:…{½ å¿Ô]‡ÞÜ eö_ýG6êôÌ0áu8þVöÇÈ¢Ù“4þÛ&fŽ²ì®TPnú¥+ä¾Uû4?èýŸ8|–#!&—é±L#M Ø–ÿÄ ”RëD"¤Ú'PyÇ”G%÷õPŸ› knbºn®X+5hž@vñJî´º?XÌ3L…Å‹%` ü“€elA–”Z›š D!BXÈŸ›šK å¢BØ/Iö•½¶µ{ e¡ÇäEÁèÝ ™'š -’K€x+ÒØ‚8H)µ¶ Fò\"ã0bºæ÷Õ@x±\v»qšöÞˆv‰®¢•Å“\˜2Ž˜ -­“J ë]LxlŸæX}ׄNÛ÷0¼å]âWS;m†[ îLûËn€8X&œýdà´˜ˆg 4t.á±Ý],ˆBšTë0唘šxz¬ö´šru:ÛkØîê>}öÅRïì²]Úî -á >ó¬Sáób ø?&à[‡/¥ÖÁÇ+ÄÊ0ÔšÅÄ«î\ ˆÍÁpaÀípºTÚ›aÿS¾q¯©ÿ¨ºùʽó·>Þ´îs V~r²hmŸ -‡KÀø%ÇØ‚8)µÆQEC8ÌRà­}7¶.*AÝ îüp‡œ÷ˆÃŸíXØ{-‚›M&´@%x*0yÓ­÷¶þ€É§u ¼þ/|l‹AŒ\þÙ'‘+å²ý{ßA®±qr¥Ô:rQ‚hÉrqM.Ó‹]-á|c‘ƒmíj™pÐ/¹\éQZ¶,({’#°ñÁTX½XÖÀ¿„Çvê° kJ­ƒ—¨¤<€Õl¼T9Ên€9”}ŸöVaI½V– ðPTOy~e\1]/–@7psݱqtSjº9G$xµ‰!¡Ñ}ãßìíJwÒ{ÇÒÏ©Õ>>—±nTÆO [㈩Øz±¶“ íû9`AÛ”Z›æV êKŒ\§¹/VP7lÝK(Üoë¡éUÝç9y -ŸQø ŒC&Bì¥â®Žþ §„Nx 9ŽÒ2@ÏÔ*¼ÇU…e´õN­L{xN-‚ƒÉd·~Ï´lÕžqoßåŠ~ÂD=Óä/˜X©ÔLœ·âÕb¶Ë©URDr~è«òŸ^ìøC't_Pd%ªÊè›Böd¦¾‡c³²ñÙšFÅÿ4LöÊendstream -endobj -3525 0 obj << -/Type /Page -/Contents 3526 0 R -/Resources 3524 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3471 0 R -/Annots [ 3528 0 R 3529 0 R 3530 0 R 3531 0 R 3532 0 R 3533 0 R 3534 0 R 3535 0 R 3536 0 R 3537 0 R 3538 0 R 3539 0 R 3540 0 R 3541 0 R 3542 0 R 3543 0 R 3544 0 R 3545 0 R 3546 0 R 3547 0 R 3548 0 R 3549 0 R 3550 0 R 3551 0 R 3552 0 R 3553 0 R 3554 0 R 3555 0 R 3556 0 R 3557 0 R 3558 0 R 3559 0 R 3560 0 R 3561 0 R 3562 0 R 3563 0 R 3564 0 R 3565 0 R 3566 0 R 3567 0 R 3568 0 R 3569 0 R ] +3606 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 659.807 539.579 668.829] +/Subtype /Link +/A << /S /GoTo /D (section.19.6) >> >> endobj -3528 0 obj << +3607 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] +/Rect [521.223 646.257 539.579 655.28] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.2) >> +/A << /S /GoTo /D (subsection.19.6.1) >> >> endobj -3529 0 obj << +3608 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] +/Rect [521.223 632.708 539.579 641.731] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.3) >> +/A << /S /GoTo /D (subsection.19.6.2) >> >> endobj -3530 0 obj << +3609 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 686.905 512.306 695.928] +/Rect [521.223 619.159 539.579 628.182] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.4) >> +/A << /S /GoTo /D (subsection.19.6.3) >> >> endobj -3531 0 obj << +3610 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 673.356 512.306 682.379] +/Rect [521.223 605.61 539.579 614.633] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.5) >> +/A << /S /GoTo /D (section.19.7) >> >> endobj -3532 0 obj << +3611 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 646.257 512.306 655.28] +/Rect [521.223 592.061 539.579 601.083] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.6) >> +/A << /S /GoTo /D (subsection.19.7.1) >> >> endobj -3533 0 obj << +3612 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 632.708 512.306 641.731] +/Rect [521.223 578.511 539.579 587.534] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.7) >> +/A << /S /GoTo /D (subsection.19.7.2) >> >> endobj -3534 0 obj << +3613 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 605.61 512.306 614.633] +/Rect [521.223 551.413 539.579 560.436] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.8) >> +/A << /S /GoTo /D (section.19.8) >> >> endobj -3535 0 obj << +3614 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 578.511 512.306 587.534] +/Rect [521.223 537.864 539.579 546.887] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.9) >> +/A << /S /GoTo /D (subsection.19.8.1) >> >> endobj -3536 0 obj << +3615 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 551.413 512.306 560.436] +/Rect [521.223 524.315 539.579 533.337] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.10) >> +/A << /S /GoTo /D (subsection.19.8.2) >> >> endobj -3537 0 obj << +3616 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 524.315 512.306 533.337] +/Rect [521.223 510.765 539.579 519.788] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.11) >> +/A << /S /GoTo /D (section.19.9) >> >> endobj -3538 0 obj << +3617 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.044 510.765 540.4 519.788] +/Rect [521.223 497.216 539.579 506.239] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.12) >> +/A << /S /GoTo /D (subsection.19.9.1) >> >> endobj -3539 0 obj << +3618 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 497.216 512.306 506.239] +/Rect [521.223 483.667 539.579 492.69] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.13) >> +/A << /S /GoTo /D (subsection.19.9.2) >> >> endobj -3540 0 obj << +3619 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 483.667 512.306 492.69] +/Rect [521.223 470.118 539.579 479.141] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.14) >> +/A << /S /GoTo /D (subsection.19.9.3) >> >> endobj -3541 0 obj << +3620 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 456.569 512.306 465.591] +/Rect [521.223 456.569 539.579 465.591] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.11.5.15) >> +/A << /S /GoTo /D (subsection.19.9.4) >> >> endobj -3542 0 obj << +3621 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 443.019 512.306 452.042] +/Rect [521.223 443.019 539.579 452.042] /Subtype /Link -/A << /S /GoTo /D (subsection.19.11.6) >> +/A << /S /GoTo /D (section.19.10) >> >> endobj -3543 0 obj << +3622 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 429.47 512.306 438.493] +/Rect [521.223 429.47 539.579 438.493] /Subtype /Link -/A << /S /GoTo /D (section.19.12) >> +/A << /S /GoTo /D (subsection.19.10.1) >> >> endobj -3544 0 obj << +3623 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 415.921 512.306 424.944] +/Rect [521.223 415.921 539.579 424.944] /Subtype /Link -/A << /S /GoTo /D (subsection.19.12.1) >> +/A << /S /GoTo /D (subsection.19.10.2) >> >> endobj -3545 0 obj << +3624 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 402.372 512.306 411.395] +/Rect [521.223 402.372 539.579 411.395] /Subtype /Link -/A << /S /GoTo /D (subsection.19.12.2) >> +/A << /S /GoTo /D (subsection.19.10.3) >> >> endobj -3546 0 obj << +3625 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 388.823 512.306 397.845] +/Rect [521.223 388.823 539.579 397.845] /Subtype /Link -/A << /S /GoTo /D (subsection.19.12.3) >> +/A << /S /GoTo /D (subsection.19.10.4) >> >> endobj -3547 0 obj << +3626 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 375.273 512.306 384.296] +/Rect [521.223 375.273 539.579 384.296] /Subtype /Link -/A << /S /GoTo /D (subsection.19.12.4) >> +/A << /S /GoTo /D (subsection.19.10.5) >> >> endobj -3548 0 obj << +3627 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 361.724 512.306 370.747] +/Rect [521.223 361.724 539.579 370.747] /Subtype /Link -/A << /S /GoTo /D (section.19.13) >> +/A << /S /GoTo /D (subsection.19.10.6) >> >> endobj -3549 0 obj << +3628 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 348.175 512.306 357.198] +/Rect [521.223 348.175 539.579 357.198] /Subtype /Link -/A << /S /GoTo /D (subsection.19.13.1) >> +/A << /S /GoTo /D (subsection.19.10.7) >> >> endobj -3550 0 obj << +3629 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 334.626 512.306 343.649] +/Rect [521.223 321.077 539.579 330.099] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.1) >> +/A << /S /GoTo /D (subsection.19.10.8) >> >> endobj -3551 0 obj << +3630 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 321.077 512.306 330.099] +/Rect [521.223 307.527 539.579 316.55] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.2) >> +/A << /S /GoTo /D (subsection.19.10.9) >> >> endobj -3552 0 obj << +3631 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 307.527 512.306 316.55] +/Rect [521.223 293.978 539.579 303.001] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.3) >> +/A << /S /GoTo /D (subsection.19.10.10) >> >> endobj -3553 0 obj << +3632 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 293.978 512.306 303.001] +/Rect [521.223 280.429 539.579 289.452] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.4) >> +/A << /S /GoTo /D (subsection.19.10.11) >> >> endobj -3554 0 obj << +3633 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 280.429 512.306 289.452] +/Rect [521.223 266.88 539.579 275.903] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.5) >> +/A << /S /GoTo /D (subsection.19.10.12) >> >> endobj -3555 0 obj << +3634 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 266.88 512.306 275.903] +/Rect [521.223 253.331 539.579 262.354] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.6) >> +/A << /S /GoTo /D (subsection.19.10.13) >> >> endobj -3556 0 obj << +3635 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 239.781 512.306 248.804] +/Rect [521.223 239.781 539.579 248.804] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.7) >> +/A << /S /GoTo /D (subsection.19.10.14) >> >> endobj -3557 0 obj << +3636 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 226.232 512.306 235.255] +/Rect [521.223 226.232 539.579 235.255] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.8) >> +/A << /S /GoTo /D (subsection.19.10.15) >> >> endobj -3558 0 obj << +3637 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 212.683 512.306 221.706] +/Rect [521.223 212.683 539.579 221.706] /Subtype /Link -/A << /S /GoTo /D (subsection.19.13.2) >> +/A << /S /GoTo /D (subsection.19.10.16) >> >> endobj -3559 0 obj << +3638 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 199.134 512.306 208.157] +/Rect [521.223 199.134 539.579 208.157] /Subtype /Link -/A << /S /GoTo /D (section.19.14) >> +/A << /S /GoTo /D (section.19.11) >> >> endobj -3560 0 obj << +3639 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 185.585 512.306 194.608] +/Rect [521.223 185.585 539.579 194.608] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.1) >> +/A << /S /GoTo /D (subsection.19.11.1) >> >> endobj -3561 0 obj << +3640 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 172.036 512.306 181.058] +/Rect [521.223 172.036 539.579 181.058] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.2) >> +/A << /S /GoTo /D (subsection.19.11.2) >> >> endobj -3562 0 obj << +3641 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 158.486 512.306 167.509] +/Rect [521.223 158.486 539.579 167.509] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.3) >> +/A << /S /GoTo /D (subsection.19.11.3) >> >> endobj -3563 0 obj << +3642 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 144.937 512.306 153.96] +/Rect [521.223 144.937 539.579 153.96] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.4) >> +/A << /S /GoTo /D (subsection.19.11.4) >> >> endobj -3564 0 obj << +3643 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 131.388 512.306 140.411] +/Rect [521.223 131.388 539.579 140.411] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.5) >> +/A << /S /GoTo /D (subsection.19.11.5) >> >> endobj -3565 0 obj << +3644 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 117.839 512.306 126.862] +/Rect [521.223 117.839 539.579 126.862] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.6) >> +/A << /S /GoTo /D (subsection.19.11.6) >> >> endobj -3566 0 obj << +3645 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 104.29 512.306 113.312] +/Rect [521.223 104.29 539.579 113.312] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.7) >> +/A << /S /GoTo /D (section.19.12) >> >> endobj -3567 0 obj << +3646 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 90.74 512.306 99.763] +/Rect [521.223 90.74 539.579 99.763] /Subtype /Link -/A << /S /GoTo /D (section.19.15) >> +/A << /S /GoTo /D (subsection.19.12.1) >> >> endobj -3568 0 obj << +3647 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 77.191 512.306 86.214] +/Rect [521.223 77.191 539.579 86.214] /Subtype /Link -/A << /S /GoTo /D (section.19.16) >> +/A << /S /GoTo /D (subsection.19.12.2) >> >> endobj -3569 0 obj << +3648 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 63.642 512.306 72.665] +/Rect [521.223 63.642 539.579 72.665] /Subtype /Link -/A << /S /GoTo /D (subsection.19.16.1) >> +/A << /S /GoTo /D (subsection.19.12.3) >> >> endobj -3527 0 obj << -/D [3525 0 R /XYZ 85.039 786.531 null] +3598 0 obj << +/D [3596 0 R /XYZ 85.039 786.531 null] >> endobj -3524 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R >> +3595 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3572 0 obj << -/Length 3396 -/Filter /FlateDecode ->> -stream -xÚíœKsÛF€ïúÜyà,æ ;NœŠ³^KYmU6ˆ„$”)B!AËù÷;ïìñÂ.;zlR‰HpÝè¯çÕ3<)Ô¿xRrTÐj"K8Å“ÅíI1¹V¿üp‚]‰¹+2OÊ|w~ò÷W‚Mpª¢šœ_…ûT╘œ/›¾èÖ3RNûÆþÙÎ~?ÿéäûópãD5¦Tßö“ß~/&KeÂO'¢U9¹WŸ „«jr{Â8EœQ÷}urvòÏp/û›X©cOÁi‰xI‡yòXÝG -9‘œ#Á¤y\!,A3LÙôíf†§ÍlŽ§óE·^¶ê[ßvëíl^ñbŠfs^˜?¬ª’oGÿäŠ|îoŸ)~@†U UL/ ü¹¹žØï{©y"6ôðá½µ‡ ç‡&pŒ‘‚tÄ‚!Y[4¯6€e*D"XjÁ¾©U˜VÓ]½šÍ)¥:zÿS`v½S„7u¯A«xžK&%I÷ØcIF± ÉÄ¥„ ˆäИdN-&%R©U9«I‰fJûôâÆWе¶D5S"æÂ|*ŒÔºëm‘ýû—¨’®DßÙ`ØmýMÏê[ݘ]ÖöºÿýN· -­mçÒ_ØôůoÕOg -!ß2* 8pNQ, L -€ã §6ĺêc ´1ðzíêp½ÕÐØoÝ•ý{>+étÓí.˜UƒÔ?êƒr\…Ù·iÀ¿B«áV¾‹ÚŠd0;gïk…ñBªBc]`ÄRºØ¶Õ±Ž»ÞX×4_u«½^ÚÏ/u«=›«j¹Ð¥u[~k"ÂVÕجSÆlÓm0cÊŒîÍÀ¨‡yftz¤¢”êN˜ºÕFr¿Ï²Þ¾·®4§½ø£!¿RWîT,ªG<ÀòÞ 7ƒé¦ž†ñ±ä›UK†(' `:²ÒþجXÊåã@{gŒåÅ2|Ggø-€ùæÔúîVˆ• |+ÛåžÞ)fDª–u©‡Bgz8þ@;Ðo×ÿzgåÅ2ü„KˆÿИNm¨ßL"ÂYÂ'3c7ÖÝêúúÈø[JTâÒ®¯63N¦Ýí‘A8áˆìÊ©1ôÙþxûBéÁÓ¥í2¶¶)©û¾^è 7kHR‹š.ÆÇÁ…¨:Œ¥Å2T÷f¨-€©æÔªTý-Rª®[~Ó%­u¡Ûk=|îCƒÞ*ÞvÐ}Sü‹xè ´{î±(£XeâSÂKåÐeNm@I -„9OPºØÏ{œË•…JžÝ„Ar×›zumøA}ܵKßk¯ äfkÔ5‘¨)­„öc¯+ÚŸzXÖ.tE_KæËúk:OŽªˆª©žÍµ&”™Gšc¦“«Æ Û•nå‚Ç0øJÑZ¤þ­Q,­®‰VÁ hZGkN­V^QTp™D+³Ñzêæðÿø £¥Ù|h} ÞïOçû›æ ÕrØöûHÓ…t‘›š»m· -&ðW#çs$¹D &—º¨Ë8bÁ€- ”Mæ„©‰Üñ<ºι(¯br†)^L”R2ñ…Œm…N²°é™ê§ßÏ(žÖ—+NÈé¿^Ù·ºƒ/¦ËݪÙ}I̓D½YšÂy+îhŒ”ÐH:¹ÓÀ)ŒD¤þš[@9´åèøšsUš©Á•¢Á¦¯f%³á_÷&%ÝøaŸ6}ç’ž®–¸º×+yjk辰õ)ŠeêSJ‡¡`K˜UÀ3Œ¸ÇNö—í6d®L.sÛêtcâÙÏ­¬¿Æ€Êà`ø‡ºaô°ÂžHTqìÑS‡þõz±ÒØ—~:c†@¶ëÒƒ²ÝÊWuÝw1þ< ;_ÅÅ2àSìG‡Àðsjëζ ¿nò©ÓzgR)zA©àÙWBîü3yË O}#Z#Ï© È‹•œFäÄ!o>öËC#ˆ’',È|r›„º›<¾Ibîn5Oî54’èy—º%F&¡(È£ °1 ¥‰‹FE]γ‡÷þDÔ -€£.§ÖG+%¢EuÔEÝUýÞ̱‘W”ˆ¿(ôܽæÉÍŽÅF¢b{¦º¼²Ï3ùD@EåÓžì'ŽYÿÞ;G,#0«6D T}rSG s¸iÌ(W'Ì3/,Å3ìí¼‹ÆRbê©ûaêC `ê9µºP½NÁ#u›¾îëÕû™ž =+ÈÎ#c!G± äÔÛÊ:±†œSë'1jFŠ2s“›ØÑ“—târºÛù0ãj¬Û®jŸ”Ö¿„Œ³ÝÀsÓlÔ%!é#ì¼1pËN= ZΩ µ˜ª™I!#`?My©ê°NÞ»½V8£å¯ÀÎcùF± ßÔÑ0ß¡0ßœÚÀWˆó„¯Ÿ“|°¨z­Ç\åsì’gÆÂŽbØ©×aØC `Ø9µ¡µ.*ŠÒÃ段~Ñ™ÑõmçÖ^¾×‰æYÖ-6&Ï)¿è}4{Ë`OýcZðeK6´Ä*6ò+6®Œ± Û›×ë¾¹ÞÔv­i[…Ÿ»k%BNÏvzïÕ¹Iõ¿Mo¯î¶vG€*{Ñ®/ÛõXωFýË9¹'Ø¿Ÿum¸6Þ\Ë™„IþD ••šÔ~"¯OE©(bïÑÿ/è­mÞK#k["׶=pH -Ù¬Úžë*I´&žSë‡Ô”HD}ž'+;f'V½¹nÜa¡_íÔIÅìi¦½OÆbŽbÌ©¿ËÂ<´ÆœS*6¦¨ôûüpH}ìh¸0ÕyP±/ô  Û¼×ä ªm¹óÏXäQ,ƒ<õ=Œ|hŒ<§6Ôì¢@$Ž’c2äMëûòM·í®\ý~g·/v}ã7§ufQÃl–vøç6±Õ«•ŠI‹‡PYÝcŽ%Å2äRÂä†Àärj=9R -$ý6Gœ¤9Ž“;]ô­Ý€hñ¼l+U¶ï6ÚRgéÉ–íÂ÷ÏD<„&×?òHŠ‰LqÏ%(±¤˜U(JÕ™ò„¢_Êü¥¾õ'uÝ–ÑE8Ê §û¶_ÌTÝ»Ñ+Lü÷¤Þc±F± ÖÔ¿0Ö¡0֜ڀ•WHøÔ§Æê×ßꥀÝõumÏìZš§»>9ëM*5}ZÔ}ë“Wol»ÜÛ'%ðƒ@çžs,º(–A—úF7´F—SÐ1 -^Ft~‘ï×­kíNsnÇ~þÁžE¸³ß^¿tT5®•Û¡ípVeæbèx,Ã(–a˜:³$á0ÃœÚÀÄ‹*2Žá;[}LMêý8Åžµò{ëyEžÚTÅ»c,á(–!œº&<´&œSë§*D¿Ü"t›øæ3¤!õk|löñz·1¹ -[¦ q2â<0–iÊ M| ¨‡ft†[pÄpäé§!Ù£iQ+ñD Î%c© àÄÙ0àzpF§Œ+ŒJ‘&{Mòæˆ^x%Õm2Ò)…â©BönI9ƒ1ï¹¼¤ç#€ ³jiYšõ·@š¦ÉÂfÖü9Ûs}åÆž¼Ýº³r;Õ;Weù˜É:7Œ%Å2dSÃd‡Àdsjqi;],˜"L÷Èâ©nªYYù÷ŒéQÔnÓô½ » §)¯’Iìé›ïNi!¾÷c©D± •Ô=0•¡0•œÚ@…cD0; B *j²ÞšJxßö¦/Õ9ä{U3Fº²å,=ŒÝÉTuåÞ­é˜Êê~\µ—æÍr›¶q{+:ó² SÆi?ÛôØÏV\wáDC·R7Ñ«Âç”FT"!Fg‚±L¹B6Œ óËG,€Ã(§6„ac~FÔ…Ñ/gg>ÑöBè3Ìn°}úúßz -Å1÷xc‰E± ±Ôu0±¡0±œÚ@L]âBc™æØT{û´èÖªšWòÁ¾.Ì?ÞXbQ,C,u] ½³óˆ0±œZO¬’¨ÀòwÀ~êÚµÀl/Ók;Iým“ó.—Rþ2©ðÛ—/ìÅew[ë»K)?†³|$‹(£H}’ªAätz%EL”„ãpÖן¢ÓÝÝЭ½`È.k·<¶æ{7ðµßÚþo³yIùU÷#™D)˜IêÉP=È$§Ó3ªð!阼j?1˜Œ]Û#çá­âÖ'yX»Ûw£gwz) ÿkÞublì«N‚TæM'‰ËJð½iõð{N2:=&.Õ¦2Óç\-¤ã­Þ9púF/bÑ¿æX®}¢±ç#ƒTæxd⫲ßÆq¨>³‘S© âØNNõõo˜ýü—‡ý ¬DU ÌõYp!Ù„rĨ{}Þ0øÜKÊ]¡ÄâÿMÄÊendstream +3651 0 obj << +/Length 4038 +/Filter /FlateDecode +>> +stream +xÚí[sÛ6Çßý)4~©4³BHàeß²NïÍ¥kgÚ™¶´DÛÜR¢JÒu2ûåÀÁåHO†IÜØÍÎN×…C€ç÷Çí`ÂY ÿÎ2Á‚(Ÿ¥YÂDÎV›“`v-ùú$4)–&É¥ù×ÅÉ“¯D2 –ùìâÊÝ'˜È“ÙÅú—ùY³]ðlÞ—ð§[üvñÝÉ—îÆ(ë0ŠÔmÿ8ùå·`¶–Eøî$`QžÍîä瀅y>ÛœÄ"b"ŽÌ÷úäüäGw/ø-žÕ±§QÆD #è1Bž°8g©,‰SýaÎBÎb¶£xþº«¶×êIäógÈ0L¤‰ÌJYôëËË…çÅê÷Û$ÞËE$òSj³ÅRúçùðâþöiÌ€ ÎsçܦözþÁ«%2‚;¼·ò,O³AŒ +ŽP •q„,äcΩ=«˜ˆ-¸Hæg¯_/–QÍ_-Ây[A]€+ÏZy©úS])Kù«üÚ©Ÿâù•úÜlàËÊ*Ÿß¾Ù¡[Tòóöš5*áõb™pþÑ©˜"Æà?M…ïÍøˆOóQøÃ"ð©Œ]sÁeê8GðCh.®šÅ’§š¤l4´•ú¸l«ˆ ØÊkkøüÕ"‹çÊ"sJ!+AùfW{)ÓÇB<°&` ¸ñÍTàÞŒŽüγ`ø°p*ã01µ]^݇=WÿΓ<–§;ͱl¯äoºz¯úSéZ‚\vŽ¨âÇ’þ#hêÇ8K—Le &_ãfŠí~¶×±ÌSÕ’°rõ›F5ºwÀ¯¿¤êóé+݈›6y ±âÿÍKu駋—z×m_šŠ^™ ¨ëÅ2Ä_…žp*%gE€ò¾£X ò'p¹ZbI–ÊKá!²H#“i4i~¿èÀÿúÒ+‚ÅöÚ}QlÊ÷ïO?Uí³®˜È™ÃÅnæY8F÷HÆñ’;¾iÌ"ÁùÆš¯y+¿îºf#Ùêïÿ®;}ý‡Dí±7Ij“lÍÅuÕúÖÚÞ5Iy´©¼¼Á ¹â5,Á‹ÊØñJ–É¿¼„æuqS›7¥,”·…©Ð×íBpYU+)²ùkÅa[ý„ñJO§úJN)‡Ó©,gr”fîQ¬«j¡«Ò­×ò;cJº×ÇþUãä1M7#D€XðŒŠ`XBTÆNqʸˆEh(2ŠýJ=R„q dÆ6*Òœ‰ÀÇBcˆ…¾Rn/ì<ëéJ“ÑÝúpú|g›c9ÙÖ š%Ƀik壟[×MÕƒ7#ô€°ð,Õð„¨Œ]OËÖƒ ž—=¢Ãtxÿ¨>7½j›3ÂÃyÍdLÆ[S%àÍ ”†E $@eì$ ¸lr$ÓÆŸ5m[® ™4éÕv%öSr¸úT'_5·x%DM'n㙩¸½yÂ=,›ÊØá–©³ÑŽ€öÓus©ûtÓ `Øx©Lõá]¾ÒÓÅ[/3‹e­]%SM„™Bþ¤Û‘5tíæ÷³ºr‹ÏË8 î<çTvΊ@ç=ȳt”Ü ‘«ãÆ‹Â3ëÞ*z£}ªÖ U~P .z‘3çZ¾â¥ÇWò—p§%ºÕ°¸<½Ní·nÌÐ᫪öñùó·°ÎR¼‘ýHš<èåò÷XJG^š$@ʹ‡÷~—‡E 4HeìD†,M8¡švÁÅ€.kKY~¹Ñ!„•UÈ”Iÿ͇ Æ[S%àÍ <ÝMq¤„¨Œ­â<“ÀH@z’wÛ«ÁakàïÕ>áà¡”OòÏbàh6Q Èl\ ¡„#EW™±SB&Ù'RB +Jxi—a]™šQÆ*Ðèµn¿«ŒË¦êÀ›:@8x6ºÅæHPÛ˜Bœ†, }ÌY@LáéZ-íT:4cc·ÑüyÑ—m¥¾…Á±îãêû?\ÆwSáÍA .” †E Aeì!R&§žN‰Ä­ +×5KÕ<+ë‚vzÉ4¯Ü„²sÑÿ?Ò´@i¯ç$çšP­%k7Ú,Õt#ˆ·qÍTÞÞŒàÜÎóÑ­GŠ@ð¦2vA³ LoDòŒÎš­Z,Vmþ­ÞÔáž[潉t~SJYéMui=ØFÝ<þT¦ÞŒ`Š\K1`Jeì˜F‹“15Q!_G—«f»Ö`ÉRBËÅ£h‰ïIÆ_SEàÍ <Ý5r¤„¨Œ$ö<Ä"0Á¢çì{¶½º©Þ×zðËAªz§qú7§n4•º7#¨#çSÔ‡E ¨S»î;ˆX”ø5ºïoM{}†eõn8¿‚µ9½a mnÕÊm]2µ«Gäó0þŒGxÆ›S%â͉ R”D†E $Bel%e9ËB¿f™eD¼ãbÿGö•ef?Ø•ÞSÖlŽìã‚ št~Ñ7ãå¢ïÕ³l~ã6 ÒèÀteŸ@y#º°.œ¨ d6® Œ‡ç£ÛŽa\dÆN©'øþ"YƒhîÞÓóf2¥§®ƒmnÒöî¦rwR™è`XRëUt)tý|xwrÕyé´%Ì„l‹”&ñ£íw +¤xøäð62#4nÆŨƇE 4Nel5.+ËS4nvbøM-¨ãÒûh¾ÀWôzÈvog•ØœP/ +sXjo#–òÜúf"pd6û~¤ãÀÉŒðLi9nv=œùáG[®š­„jzTõ0uîÉ2ÕK ëÒôIÛÒœ\-+¤¦÷¯€qÿþÉϯ$œ4ý0T橦¢òf*ä1 +Õ°**c‡*IY–&•ÙðTw/Me:x·Õ ¶«Ø}X?m0ÁíoÊ£Uz‚ÖŒü`N%›Ó;;Óm¶×fsk—º–y˜¼'IóÐSIz3‚$r(ErX‚$•±#)bùX‚$iv¼Þ]뤵ÝB À£þž½Vc…sø²Ö¿1Q]sõI}Á{c5PÕXðù‹‹'¶âÉoGç$ÝØ áÚÜÓŽt.ëRÂÊâìóðXbM'G‘¡\“è]ÊP.•±S.Oç9Rn6è.ní8ؾ¬@í¥BÉpÝA¯!?š×àõÒÂýX˜w õòƒœw7pÖFŸ½…Ù,ù—^<;S»´Å=6ΘJØ›„‘£y>º‡úHÂTÆŽ°¬ÛIŠ ç@Xmk°!sºÙ¬U—¿?>¬ƒ8ÅᇕñÄ6ô”¥F}ΞÕJ¸wjÁ-HPå6^šŠÞ›è +ý°z*c‡>Xˆç·2É"9›éÎþˆ¬ì"éyé^ŒÐV½"ýoª¯Ý‘¸ªìTÃGÒˆƒK¦bvVeïl +ò ‚1‘«Eª×Ðe{aÉ3¶€WöL|eǹ9ÿÏ…Úd1?}ªZrïÖ†U×·EoÃQ«Â™ša³P÷­Q¨áÈK‰ô9 {7lP»@Ì@ëÃ>§•úi~"Md6Ž;–ày¤ã@ÉŒÑ4bA„Ë!¢{/ rkOz`i_:Óô•Š2½=õ'[n·ö¼«ÙêÐíwÑ/.–câHrñ)ëªõÄT¼ÞŒÀ‹¼LáÀKeìðŠœÅÙ^£íWØå¹ä„@çÿ±9Àe¼6U +ÞŒ"BIaXB +TÆN +±`y´'…¤0¬èÍn¿öâ3knýè¶;lrÑšÓÞ9hZí½·x§‚äqxïPÍóO…êͨȷ<=ut¤T*c5â,Êb UÔçM·YÝlLGïGº¬!Øæ#tû«;xÌÝâ0Ž:ú|Ý#¹¿çd´‘ÑGiž{*LoFÀD>åùè©‘#E `R;˜aƲSÕþpóè +‘!ÕøxñýVB·¯$PÛ¾ÛßÍ· +ÞLÀ!º* ½õ“©m'ÇVµêÎIJ,¹¿ªi|*MoFÐDN¥h‹@Ф2v4Áx†ã­j»`bO–í¦‚õU8r0Nz›ûÛ'Ýþþý'1Ö'øºD &mÙá¯Å•›H—u´%´ÑhÝ7û8uÓ<øTšÞŒ ‰œJÑ Ieliæ!K#rUû;Oíè0›o‹®Fòãi½3qª0‡Z)mϹq¯ éQC©«¥´îtõU=®dtp§ÿè0i©à 0*ù®2¯SiàÝcðyÕlvuÙ—òƇX¨z·ú¯AÁ,ho±®Ù–ƒ£gŸçÀ0Í$÷éïwVÄ»H!Í;t=ÌŸzeüx®VÕIÌ’(êÎAÕ.@3<]¤gîzq ³;ÍgÝêœÛùŸ®ö-{Ë~c]¢. ^—a¶"èVNÝâíÁV•ÑÝBŽ¾ØN?ïä÷ÚY+êµvΓ¿aþ~öXrDûgä‘}ÛóûÿëîŸHˆ3–g£Ø”%i<‹‹ÝÜat?$B%þîËGendstream endobj -3571 0 obj << +3650 0 obj << /Type /Page -/Contents 3572 0 R -/Resources 3570 0 R +/Contents 3651 0 R +/Resources 3649 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3471 0 R -/Annots [ 3574 0 R 3575 0 R 3576 0 R 3577 0 R 3578 0 R 3579 0 R 3580 0 R 3581 0 R 3582 0 R 3583 0 R 3584 0 R 3585 0 R 3586 0 R 3587 0 R 3588 0 R 3589 0 R 3590 0 R 3591 0 R 3592 0 R 3593 0 R 3594 0 R 3595 0 R 3596 0 R 3597 0 R 3598 0 R 3599 0 R 3600 0 R 3601 0 R 3602 0 R 3603 0 R 3604 0 R 3605 0 R 3606 0 R 3607 0 R 3608 0 R 3609 0 R 3610 0 R 3611 0 R 3612 0 R 3613 0 R 3614 0 R 3615 0 R 3616 0 R 3617 0 R 3618 0 R 3619 0 R 3620 0 R 3621 0 R 3622 0 R ] +/Parent 3701 0 R +/Annots [ 3653 0 R 3654 0 R 3655 0 R 3656 0 R 3657 0 R 3658 0 R 3659 0 R 3660 0 R 3661 0 R 3662 0 R 3663 0 R 3664 0 R 3665 0 R 3666 0 R 3667 0 R 3668 0 R 3669 0 R 3670 0 R 3671 0 R 3672 0 R 3673 0 R 3674 0 R 3675 0 R 3676 0 R 3677 0 R 3678 0 R 3679 0 R 3680 0 R 3681 0 R 3682 0 R 3683 0 R 3684 0 R 3685 0 R 3686 0 R 3687 0 R 3688 0 R 3689 0 R 3690 0 R 3691 0 R 3692 0 R 3693 0 R 3694 0 R 3695 0 R 3696 0 R 3697 0 R 3698 0 R 3699 0 R 3700 0 R ] >> endobj -3574 0 obj << +3653 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 754.651 512.306 763.674] +/Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsection.19.16.2) >> +/A << /S /GoTo /D (subsection.19.12.4) >> >> endobj -3575 0 obj << +3654 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (subsection.19.16.3) >> +/A << /S /GoTo /D (section.19.13) >> >> endobj -3576 0 obj << +3655 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 727.553 512.306 736.575] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (section.19.17) >> +/A << /S /GoTo /D (subsection.19.13.1) >> >> endobj -3577 0 obj << +3656 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (section.19.18) >> +/A << /S /GoTo /D (subsubsection.19.13.1.1) >> >> endobj -3578 0 obj << +3657 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 700.454 512.306 709.477] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsection.19.18.1) >> +/A << /S /GoTo /D (subsubsection.19.13.1.2) >> >> endobj -3579 0 obj << +3658 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 686.905 512.306 695.928] +/Rect [521.223 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (subsection.19.18.2) >> +/A << /S /GoTo /D (subsubsection.19.13.1.3) >> >> endobj -3580 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 673.356 512.306 682.379] -/Subtype /Link -/A << /S /GoTo /D (subsection.19.18.3) >> ->> endobj -3581 0 obj << +3659 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 659.807 512.306 668.829] +/Rect [521.223 673.356 539.579 682.379] /Subtype /Link -/A << /S /GoTo /D (section.19.19) >> +/A << /S /GoTo /D (subsubsection.19.13.1.4) >> >> endobj -3582 0 obj << +3660 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 646.257 512.306 655.28] +/Rect [521.223 659.807 539.579 668.829] /Subtype /Link -/A << /S /GoTo /D (subsection.19.19.1) >> +/A << /S /GoTo /D (subsubsection.19.13.1.5) >> >> endobj -3583 0 obj << +3661 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 632.708 512.306 641.731] +/Rect [521.223 646.257 539.579 655.28] /Subtype /Link -/A << /S /GoTo /D (subsection.19.19.2) >> +/A << /S /GoTo /D (subsubsection.19.13.1.6) >> >> endobj -3584 0 obj << +3662 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 605.61 512.306 614.633] +/Rect [521.223 619.159 539.579 628.182] /Subtype /Link -/A << /S /GoTo /D (subsection.19.19.3) >> +/A << /S /GoTo /D (subsubsection.19.13.1.7) >> >> endobj -3585 0 obj << +3663 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 592.061 512.306 601.083] +/Rect [521.223 605.61 539.579 614.633] /Subtype /Link -/A << /S /GoTo /D (subsection.19.19.4) >> +/A << /S /GoTo /D (subsubsection.19.13.1.8) >> >> endobj -3586 0 obj << +3664 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 567.602 512.306 577.171] +/Rect [521.223 592.061 539.579 601.083] /Subtype /Link -/A << /S /GoTo /D (chapter.20) >> +/A << /S /GoTo /D (subsection.19.13.2) >> >> endobj -3587 0 obj << +3665 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 554.053 512.306 563.076] +/Rect [521.223 578.511 539.579 587.534] /Subtype /Link -/A << /S /GoTo /D (section.20.1) >> +/A << /S /GoTo /D (section.19.14) >> >> endobj -3588 0 obj << +3666 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 540.504 512.306 549.527] +/Rect [521.223 564.962 539.579 573.985] /Subtype /Link -/A << /S /GoTo /D (section.20.2) >> +/A << /S /GoTo /D (subsection.19.14.1) >> >> endobj -3589 0 obj << +3667 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 526.955 512.306 535.978] +/Rect [521.223 551.413 539.579 560.436] /Subtype /Link -/A << /S /GoTo /D (section.20.3) >> +/A << /S /GoTo /D (subsection.19.14.2) >> >> endobj -3590 0 obj << +3668 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 513.406 512.306 522.428] +/Rect [521.223 537.864 539.579 546.887] /Subtype /Link -/A << /S /GoTo /D (subsection.20.3.1) >> +/A << /S /GoTo /D (subsection.19.14.3) >> >> endobj -3591 0 obj << +3669 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 499.856 512.306 508.879] +/Rect [521.223 524.315 539.579 533.337] /Subtype /Link -/A << /S /GoTo /D (subsection.20.3.2) >> +/A << /S /GoTo /D (subsection.19.14.4) >> >> endobj -3592 0 obj << +3670 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 486.307 512.306 495.33] +/Rect [521.223 510.765 539.579 519.788] /Subtype /Link -/A << /S /GoTo /D (subsection.20.3.3) >> +/A << /S /GoTo /D (subsection.19.14.5) >> >> endobj -3593 0 obj << +3671 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 472.758 512.306 481.781] +/Rect [521.223 497.216 539.579 506.239] /Subtype /Link -/A << /S /GoTo /D (subsection.20.3.4) >> +/A << /S /GoTo /D (subsection.19.14.6) >> >> endobj -3594 0 obj << +3672 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 459.209 512.306 468.232] +/Rect [521.223 483.667 539.579 492.69] /Subtype /Link -/A << /S /GoTo /D (subsection.20.3.5) >> +/A << /S /GoTo /D (subsection.19.14.7) >> >> endobj -3595 0 obj << +3673 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 445.66 512.306 454.682] +/Rect [521.223 470.118 539.579 479.141] /Subtype /Link -/A << /S /GoTo /D (section.20.4) >> +/A << /S /GoTo /D (section.19.15) >> >> endobj -3596 0 obj << +3674 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 432.11 512.306 441.133] +/Rect [521.223 456.569 539.579 465.591] /Subtype /Link -/A << /S /GoTo /D (subsection.20.4.1) >> +/A << /S /GoTo /D (section.19.16) >> >> endobj -3597 0 obj << +3675 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 418.561 512.306 427.584] +/Rect [521.223 443.019 539.579 452.042] /Subtype /Link -/A << /S /GoTo /D (subsection.20.4.2) >> +/A << /S /GoTo /D (subsection.19.16.1) >> >> endobj -3598 0 obj << +3676 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 405.012 512.306 414.035] +/Rect [521.223 429.47 539.579 438.493] /Subtype /Link -/A << /S /GoTo /D (section.20.5) >> +/A << /S /GoTo /D (subsection.19.16.2) >> >> endobj -3599 0 obj << +3677 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 380.554 512.306 390.122] +/Rect [521.223 415.921 539.579 424.944] /Subtype /Link -/A << /S /GoTo /D (chapter.21) >> +/A << /S /GoTo /D (subsection.19.16.3) >> >> endobj -3600 0 obj << +3678 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 367.004 512.306 376.027] +/Rect [521.223 402.372 539.579 411.395] /Subtype /Link -/A << /S /GoTo /D (section.21.1) >> +/A << /S /GoTo /D (section.19.17) >> >> endobj -3601 0 obj << +3679 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 353.455 512.306 362.478] +/Rect [521.223 388.823 539.579 397.845] /Subtype /Link -/A << /S /GoTo /D (section.21.2) >> +/A << /S /GoTo /D (section.19.18) >> >> endobj -3602 0 obj << +3680 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 339.906 512.306 348.929] +/Rect [521.223 375.273 539.579 384.296] /Subtype /Link -/A << /S /GoTo /D (section.21.3) >> +/A << /S /GoTo /D (section.19.19) >> >> endobj -3603 0 obj << +3681 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 326.357 512.306 335.38] +/Rect [521.223 361.724 539.579 370.747] /Subtype /Link -/A << /S /GoTo /D (subsection.21.3.1) >> +/A << /S /GoTo /D (section.19.20) >> >> endobj -3604 0 obj << +3682 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 312.808 512.306 321.83] +/Rect [521.223 348.175 539.579 357.198] /Subtype /Link -/A << /S /GoTo /D (section.21.4) >> +/A << /S /GoTo /D (subsection.19.20.1) >> >> endobj -3605 0 obj << +3683 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 299.258 512.306 308.281] +/Rect [521.223 334.626 539.579 343.649] /Subtype /Link -/A << /S /GoTo /D (subsection.21.4.1) >> +/A << /S /GoTo /D (subsection.19.20.2) >> >> endobj -3606 0 obj << +3684 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 285.709 512.306 294.732] +/Rect [521.223 307.527 539.579 316.55] /Subtype /Link -/A << /S /GoTo /D (subsection.21.4.2) >> +/A << /S /GoTo /D (subsection.19.20.3) >> >> endobj -3607 0 obj << +3685 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 272.16 512.306 281.183] +/Rect [521.223 293.978 539.579 303.001] /Subtype /Link -/A << /S /GoTo /D (subsection.21.4.3) >> +/A << /S /GoTo /D (subsection.19.20.4) >> >> endobj -3608 0 obj << +3686 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 258.611 512.306 267.634] +/Rect [521.223 280.429 539.579 289.452] /Subtype /Link -/A << /S /GoTo /D (subsection.21.4.4) >> +/A << /S /GoTo /D (subsection.19.20.5) >> >> endobj -3609 0 obj << +3687 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 245.062 512.306 254.084] +/Rect [521.223 266.88 539.579 275.903] /Subtype /Link -/A << /S /GoTo /D (subsection.21.4.5) >> +/A << /S /GoTo /D (subsection.19.20.6) >> >> endobj -3610 0 obj << +3688 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 231.512 512.306 240.535] +/Rect [521.223 239.781 539.579 248.804] /Subtype /Link -/A << /S /GoTo /D (subsection.21.4.6) >> +/A << /S /GoTo /D (subsection.19.20.7) >> >> endobj -3611 0 obj << +3689 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 217.963 512.306 226.986] +/Rect [521.223 226.232 539.579 235.255] /Subtype /Link -/A << /S /GoTo /D (section.21.5) >> +/A << /S /GoTo /D (subsection.19.20.8) >> >> endobj -3612 0 obj << +3690 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 204.414 512.306 213.437] +/Rect [521.223 212.683 539.579 221.706] /Subtype /Link -/A << /S /GoTo /D (subsection.21.5.1) >> +/A << /S /GoTo /D (subsection.19.20.9) >> >> endobj -3613 0 obj << +3691 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 190.865 512.306 199.888] +/Rect [521.223 199.134 539.579 208.157] /Subtype /Link -/A << /S /GoTo /D (subsection.21.5.2) >> +/A << /S /GoTo /D (subsection.19.20.10) >> >> endobj -3614 0 obj << +3692 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 177.316 512.306 186.338] +/Rect [521.223 185.585 539.579 194.608] /Subtype /Link -/A << /S /GoTo /D (subsection.21.5.3) >> +/A << /S /GoTo /D (subsection.19.20.11) >> >> endobj -3615 0 obj << +3693 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 163.766 512.306 172.789] +/Rect [521.223 172.036 539.579 181.058] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.1) >> +/A << /S /GoTo /D (subsection.19.20.12) >> >> endobj -3616 0 obj << +3694 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 136.668 512.306 145.691] +/Rect [521.223 158.486 539.579 167.509] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.2) >> +/A << /S /GoTo /D (subsection.19.20.13) >> >> endobj -3617 0 obj << +3695 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 123.119 512.306 132.142] +/Rect [521.223 144.937 539.579 153.96] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.3) >> +/A << /S /GoTo /D (subsection.19.20.14) >> >> endobj -3618 0 obj << +3696 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 109.57 512.306 118.593] +/Rect [521.223 131.388 539.579 140.411] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.4) >> +/A << /S /GoTo /D (subsection.19.20.15) >> >> endobj -3619 0 obj << +3697 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 96.02 512.306 105.043] +/Rect [521.223 117.839 539.579 126.862] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.5) >> +/A << /S /GoTo /D (subsection.19.20.16) >> >> endobj -3620 0 obj << +3698 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 82.471 512.306 91.494] +/Rect [521.223 104.29 539.579 113.312] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.6) >> +/A << /S /GoTo /D (subsection.19.20.17) >> >> endobj -3621 0 obj << +3699 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 68.922 512.306 77.945] +/Rect [521.223 77.191 539.579 86.214] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.7) >> +/A << /S /GoTo /D (subsection.19.20.18) >> >> endobj -3622 0 obj << +3700 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 55.373 512.306 64.396] +/Rect [521.223 63.642 539.579 72.665] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.8) >> +/A << /S /GoTo /D (subsection.19.20.19) >> >> endobj -3573 0 obj << -/D [3571 0 R /XYZ 85.039 786.531 null] +3652 0 obj << +/D [3650 0 R /XYZ 85.039 786.531 null] >> endobj -3570 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R >> +3649 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3625 0 obj << -/Length 3151 +3704 0 obj << +/Length 3215 /Filter /FlateDecode >> stream -xÚíœ_S9Àßù~´ÒHš=]±a“ݽƒå¶rU{ûààÁqÅ`ÎBòíOÿ%[£&ÚÙT*eã™v·ú§–Z-ÉËdÔr„©5m8%£‹«=<šË+¯öˆ½cßÞ²ÝóÃùÞÁËšF‹Ñù¥ÿõè|öÇøÅêzRµã¾3/›ÉŸç¿ìýxî¿8RM(U_û¿½?þÄ£™4á—=Œ¨hGwò=FDˆÑÕãqFíß˽³½ûï2×ØÈH µ‚Óñ–¦Í tm‡ ü“xz=™7¿E¾wRû‘XêûÝïÖ¾Õ® œ$ñ X27·Âj=rV!,;EÞxäW“}2¾RÈ)¥ã'd¼^¯Öòe#?!Õß -»õQ)ö `ýŸÇžZ`§m…jÊF’b|x8pÔ÷ÒȾáM«pÜ5H%uV#{¶¬’>l|8{?½V㢛ÉnP×ãõW×O(ßM(¯Ô»õ;sñxz=wWÝuŸº–êvy3@‡RÓŸ›·¿Ï8“æœé¿'ñ«jT5òM…Huϼ@8âDÜ]˜InÄùØèz9iÙ¸Sž›ö·*²:T”§×3o?è«×òš~ó_L˜|/g9Wß\|Y/•ÆWâ+&ï©ùaRëÀ×*#`|eÁÿÖ™Qµï ï3X ¬ïUÂ`ÿÒàp&?ÕãðB¾¹^lúõ´WoõDÌŸdç‘BÈ‘Xò–·³,ÈBÕzÈMd8:È4ùÈAÞ¼ëW7­å§rpÔ·Ú\Q šäaá<[ëˆR¶A `;9Ï6µ ÏRKdJÝÔͨ®)b2íölÕØ­æ´]ºÇŠ£žæôLèIJÈ—*ªU"¥î;YO/ÔÅ· ?¬oγZ*mG)š  ‰}”G“ZG©õaÇj…OL˜ »™…TÌB¤W:‘þµš»Vµn¬]Üô.ç sApñ'OçRÀA {ZðàÔ‚<`H­=Z#Êxìbïp¦fD?sU7*{ZØ÷zc˜Þ¹)³»RéUoî½5‹{v~õrfæ5éUnMøc ¶­¥ø‚€/ö£hrøR òø µ>>%³Fx|üû’r»õQ)ö `ýŸÇžZðyKJ.ZDi¯)ÝMÚ6j•g7½š=U„›Õ¥][ê•æ…šDoõrHgHÍøT/4—j(¸PaÞm2ËËȤOX_‚ ØùFãÛ6ãÛè›>g‰É…¼•Ôp´ñ–¡¦mG¿/1ãÍy©0Þ"±|¼mÈ÷‰Ô‚ì0 ªõà‚*ÙM,x·Ä|±îä"ñzn [Ú•)Åèe¤½â£Nö‰S3-.CZ¨ÎÒÈôdV®±¥ü‚À/vdž_jAž¤Öe9œ7¨n#~.Ëy­œÙJA¹³Q+>›Hy]hP‹gµZt /eÄ–±S…ȱL-ȳ„Ôz–L&©, ¬”'ç,zuåã2pšëG£/K¸­è¢gšZ -ÏKì"'æÑ%êó䤵ƒ(U;wd‹«Hd­°k}=lê…C¯’ÕÞr›ñj±tK’J°'6Wæ(Úv—b bÇȧãÈÔ‚3ÑôZ¯Õ -r¥ 6+Œ?˜ÌËNÍë©J›V—F¯w?e2µt×ü¬¯NTo{8Z¶i¥´‚@+r@+µ O RëS$sê-Z!ðgW:¤&숩Y™+ç¯.c Õ?3ôrÖ|Q,¶ ¥X‚€%ò€%µ Rë’Jé|©Þcq%mW®öyåá…vª.¯˜ºÉÁï[µ•'”Rþ²Î …d#±<ÙØÅ“ Ù ²dAµnxdM¨`¬K7ϦWŠÕ›©-Ëè[¿î,éóI+#Nv…sÓ™xÔ‚Ïp£Â9¡”k¸F¦8·“?`Až+¤Ös­+Ôº"ŸâzOîy`滆±G °âh]Ê1ˆ#‡S ò!µž#¨²gÈ4G:Ÿ§j;ñ…J<Û§2ˆ>cëRÆA `9`œZg ©õ³+å¨a¾úév®Î>ú†«Èèµát­Kw7[¥œ­=-“¢êÁùÂ$¢?Eÿjv5ÖïÝÝd_´ø±¸ÙF–r b·È·Ô‚<7H­ç¦ÎîÏíûŽÆvë£RìA ÀùŸâÜFó€yìZ?$c‰Ÿµ»K™v“[[®92‘è*í'«Þ­ST -¥ºÅ;µNlžåhl}QŠ7ˆx#?xS >oʶ Eø÷«ì=º0³]udWü’¦9Σv¤Ö+µ²´%ZùɽGƒöOØš‚LÝþ>ãC–ñaøžÏÙ—R^Æõ=Giƒ%.â\÷}_j0¬œ— -Ã*ˇULè©ÙQTëÁóaw`‹…£«é•ÏMNõÉ(2ŠM›¿Åé\SJ;ˆ´#·´S ò´!µnŽ¤L=‚ÑΔ^¬®m$Ïo£S¬ú˜Üjg³ñ@*Ç…Ÿ¦ºdëKì5c4幦•Ò -b­Èm­Ô‚<-H­«ºÒJ ᪮–V¨º†ê€¢±SÏ3` ±ü«Dl”mU)¨ €Š<€J-ȃ‚ÔzP¤FŒ±P•5¼C¼U?¶áóû&>QžD˜^©Tœ>20ÛºR`A yŽâܙŠòÀ µ®Pë]y`Ô;^|pþ–Yã°=÷6˜>éi6Ó…ªV ÊŠ«C‘X¾ ¹›à.4`A¶ j]ªŽWô]ˆÙ.t´ØLß,ã<*£ò‡ÌÓa:T’noìfuk–¡½ªÕÇÆ6¤”MØDNؤäÙ@j]šSÕª\åŽÝsÂãÅr±õ@qö½™¬>™ßîlnþ¬®È”èÊ~ÖböE˜Ø”2 b“È9×9&©y&Z/L¾ºG'ÙîÙ‚9r0ï<ëz6û?VºéšSJ(ˆ„"W„R ò„ µžåˆ0±CÊbüá¨×ªN ãp•ñ°f`µøª3mT)§ pŠFqî(â€yNZÏI=ì¿C‰”d²î;&#y,"ÚüRN áÝ°ØÕ'‘WègÜ"å~ ð­òéÚ-јeçz“ Ê+oô¡´èa¨ÎÔäÕvüZ¨Lô@ç–òf“[ÊÏ]©±ªÜsTû:«¤LÛg•›^ÏP*…¤OôêÃt7"_9.®ÙEbù.çnÒŽäŽý Xív Z×ñH+?âQ‡¹ŽÔENš‹¹LWÔ_¿‰s„Oèƒçîy+»éW!QU5£Fö`ùN „¬Å¥‚!ò%¹:ä!@jÝ(Lê1L· ÀùŒŸ-“Ñ@?™šyÆ89Ô#û»ø"I¦kA)” @‰¼@I-ÈCÔz(2BZÎv ¸æLå$3ëoÝmm§>ÑÏë1¹&ìy o¶Å¥ƒ1ò&1µ Rë!2Œ(Þ…è2œ+}ØŒI·ÿs ¨ûЩB'y–s”mq)Ä @Œ¼IIîÆ€yˆZ±ªQÃùDWyÕÙ¡íìç#u¿þvÒ ÛîR”A @ù@™ZG ©u[„D¦‘ö+ŽíSƳi¿Šž³¸LtkÌ¿í­Bç¢RêA  ¹ žZ§©uÔ…@5÷%4¶ó¼âû!øñþWþíy†qgª&O=tm‹ ©<ÂÈ—y‚©ú,@H§ã§~±ûr›;wÔ]NU sÙç*Зjy`ó¢¡-Œx³Q=í&š'ŽÕ:¢kÊc\LIî Tª>‹ÒéÖ~M…8°’O{l*Ô8ÎÇŒmóK{ÌK?=›‡™ªÏÿð Ó?V%Æb fXBþäÂîS7†Õ}‡ëô,F7ó? â¢úþZû?²Q›KŸ¢òRÀCTÁy©zàlE¼©‡ÇÉÿ¦4öY?èêر‰6S/àU#Y³åˆQ³ &é¯|Ø~µ7Eÿ¥¢fendstream +xÚíœ[sÛ6Çßý)´oÔƒ°¸’ľ9qÓM¦N³‘³Ù™nI–5ÖÅ•(;ýö‹;`‘<7IDZ5T²DGçÿpp’ °ú J0“ƒ¢Ì‘`d0YàÁ\}óó qWŒÜ%£äš'%òÁHb9¸¸ õHŒ„ÌÓß²—›õ–Y=³/»áïoN~º'MÆtµœüö;L• oN0b²Ü©÷)«.œ¹¿—'ã“…ºìw|`Kµý +ÁJ$JÖüD$?ƒ`‚8fƒB”óÂü"%hHEž®‡#ÆXöë­þI³ííbH²ÙpD²;ûÅæÒ¾ÖW3ý†g/?¼S—Œí§ï¶êýºC½ln/Ò—l7Ñú|bjÛíìËp$ÎzÁé —²ùáW~÷ð%ò J•_dpUÃéÛùÀ¾yŸÊàJ’bMëÖ2P)&8M[LhèÏYH9QŽ¸hGÄ‹?*Q×Ê`Å-¤»kŒiX9Iòl\W“ë!#Yõi©õÏ‹ì߯ÆöÍJéËp6Ý/g»¦+±ý±]Ð…Ø‘ ™yX§¶“aÚéÂXWÓu¾sÁÃÃ5íýŠJ)ï4Õ«”<{5,¹íFU½×}ÁÓ¯;MµžÚ7/̧kßãþ‹ WïÕ¸2’’~3Ê¿gñïÓÿ¬Kûv¿P +è}Q,ˆœFûÀØ ´ÁaI<#Ô1r¶ØM´ìšÁc¡æ—çù#ûQ²â|Û–X  %Ñ Â¥iÀ Ô°&×1À0Ìëõd©a™šÑÂŒ!4[é÷v¦ªïöK?šì4JâˆË=\¼g{â’ëÆ%UaÖ…K‹ ݸ€ š#.ù /r¤&Œˆ‹ž…XžgÕ^#±¨õ<-ž–¾ß çɾxÄb‰JM< †9C\­2Ôá1û\OÍ %E2/B¡×0ªº¢}3òu’ÊZÌT«zßÊ„Ûœ>×y¯ ÑèË^ˆBÖý¢MDAí=¢\¢Ròˆ(sˆ^V×f]ÚÄT…æ\†‚_‡©­k”TÖ†©ZfQrÏÔ5ív¶Õëà•›v%+Žª#*º´­‡u?DkÓ€VO+Ëã"ÒÊ­Û™ èÿT,˜7fÉ\æÇ)"Ä9³/!±@H"ü“¦ !PÃe@!B„#d=««ºZ^ë4˜8®èZp¾ë D,‘èÑ4j8¬è°TANîànEgsiŒ™\ZXÁÍv6‰Zé©ïv(T ¿XVŸÜÊNc¦œ¥ÏÌî®f:Á”ìÉÁàüÖ†X €!ÑD­:ahšÀ5ìG!Êeaðëµ356|RªVVV gåq¦°zy·õd!)ÖÍB* ÀB‹ Ý,€ Ô‰ð2²àg·69X­uMàý ï×Q üýA‡Øýš‹õ'½ƒ§wHöåͲÌ>ìf–)³——ٙɮôH³XÛN'“Í~]wnä$}ÉFhÿaÖ·y§oc]ÿçFΡ5­S´ªFIè½yÜÈùÓº´o¿ ¥€nÅ‚Èi´ŒÖ@«¦ÏÏ yy³ÿ­S.ŒÛû`m¶t.Ž{9_€‹so_^b1˜D:%G'1Md †3¤@˜SÏŒßËùx¥GßÚ†óÃ!Š0x›Ãö…^,¦É¶ŽÈ‹çH‡sd_:b1€ŽD$ˆŽ¦ PÃ!üÃL½²H‡_ +\ K5¿lç³Ú²ðÁ. ´ú„?'›ó^_$b1‰D†ËN$š&H@ ûƒ—Ið©‚šàÎ f˜°†Ž:Ü€ñQ+›íµ¦„Šg?ŸxOöÄ#)ÖGª€G‹ Ýx€ ûƒ9b’G<üˆq¾ðAÇv³Û\ºqãý̨gþÀÞÆlZ˜ gSÒšƒ}Õr©È)þ¡ï¾*Çb€Ê‰³!•›&*C •sŠJ¿Å@’´@»Ê§“zapZ)Ïa©2©7Û?íUcCèHõv1ññͬaß;§¯â± xâxHñ¦ €âPÃAq.uçŒâ~ ômµrªŽÝñ\ÛwÝgêï»E=ª>}¥w›Ä³˜ù½·ú"‹$J0ÜyD·Å¨á€¨ðgƒ5~_ñNõïçó{{§ûúÊwh +HµÖœTn½©:û¹ç§÷„åä“Ùy¤¯Ì± sâmHæ¦ €ÌPÃAfe‘‰Ì~sðÃÎÎir‰f?o7zš¾±¿>sòk]—Ó]ú#÷iç—¾bÇb€Ø‰ÏÁb7MĆbãå>¿¯ÅÎØïmŸ4ݳö˜ÆM6ÀÜK!þªôá£Âù®/±D¢ DÓ¨a¿¼cR ,CÖ^„â®Vñ·êÈ:‹¸>È/ëlZy¾ßšÄ‘Ë+Ò§½‚óÎêI@R¬›€T€€º öC+•ì"àp¦‘¥ÌŸ}ÊÇ9¯/¡ÀC”¡Ñ>@Ðj€!/Æ$Ò@ïÍèÀo±õ!Ü*‰öt’ðìKD, ‘ˆÃéd¢iÔp Bè=â„ +–¦…g;;&èàÜNú8ÌÝæä¯{VȲ|8‡õ¥ (HÄ€(hšP5Lr*pý½GÉôtÁK©c·Ï¬b½&ä,[ï 6!PfWh²Y_Ú¯*Ÿ'æþ^^uÜ-ÌX“ÈêËåBAÚVÛE²pÔ›ˆC]ðKH>ï?ß«[9F­ŠQAËÁˆè}y;¹Ž7:ÆUõéT“`Ïà K¤´@LôÎG'ÅHÝEÒÎ{ÕZL …*¥KÌ ¥Ò·ã±ßš[œæ l}¤{úú?z±Ãä!È9¢¯º± nâdHݦ €ºPÃA]ŒMƒU£.ë‚”’fZ¡Ýè# þ&爾êÆb€º‰“•*ê6MÔ…öêÒ2GÎÔåNÝ7›ÅÚ?ûax/á|zþâÔþµ‹û nû!ä¯êͽG°ìÝÙKûfºY™sgEQ|oÙü/ì)[R¬[¶Ô{€l-&tË6d+"âP6ád×ÕÖç”X¶¿iJxw ÛÇÓÊm†ôCü®vA§ýkQÿm8*™ø‹:ŸÿÁ}UŒÅg2ÒyK@‹ €ŠPÃAE!QŽ‹s§â«Åç¦p&L[ÔÈi²SJ×IjØž6qÛ^T<òQÕû ¯°± lâ_F:O 5„å9¢<¶æÌ-‘QÚùÞés§çz{=vEÝï«h,(š8–‘νÙE¡†}Ζ2Š9ÛÜål•”“å~çrsòxÄó ðpžì‹G,à‘¨Ähç:½Å¨á€)Qܹ/f2]ùÙô'½ªÞn¶ö®-Fè‘VB¬3ûJ|D™ <ít­úTÅqáðÙþ·ã—gÉ3Ô6Ÿ–:ø²§Õh_m×6›§wñéÍÚ9ßôÕ:”´Ž^g´s½Ülÿ«²FJe‡ àM;þõ7휚›un«õd6up˜>õáìNÿo£Á¶½vGÀªu5Ÿ­fëºëfÄ/¹Y´û°NëÒÎÕNRWçÍ:#Š…ŸÌHŠ•=Òä…yu¾<Þ²ó º¤÷iÏ>™ë^BMº‡`°áŠ¯܃âïÛ±[l+w6–œ<ÌgœNý#>Lþ{±«·q·^Š' „ó]_ b1ˆDˆ¦ PÃŽÃÖÄÙlw]oÜêúܬÈÔÈk7bíf½‘Éœ¯ú‹$:0Ú™|i1jØGeúµðymšÜwsˆÀ¹ÖÜÌ·fJª+ .MÜ悶·›óÊî¹-Âœ²Cf P2ùdt¿¸¯Œ± câMHƦ €ŒPᆨO`Óp¯Ì[:ÑB…NJ ›”\¿læ~)6gèuŒ}Sû>w§«¥O¼O;¿õ…!`H4a´3ïÖbÔ°ïÓR¢\‘ߥO§S¿”Ò2ßèÐ=²z¶uaáŸ×ë+sØÖÈ f¹ ”³á{ðµæ*'âÑ­¯œGzªKu‹œøšÑÎû%›íwK µê»»~®:.½Ââ˜hù8œ3{ÂKuÑÈÄhgš¶Ù~÷‚Q`”¢mŨþÙ“&_õ°ý°îä%’eçÍÂ…²BÎBœùÇivŸ2%ÿ ÿ3¾endstream endobj -3624 0 obj << +3703 0 obj << /Type /Page -/Contents 3625 0 R -/Resources 3623 0 R +/Contents 3704 0 R +/Resources 3702 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3471 0 R -/Annots [ 3627 0 R 3628 0 R 3629 0 R 3630 0 R 3631 0 R 3632 0 R 3633 0 R 3634 0 R 3635 0 R 3636 0 R 3637 0 R 3638 0 R 3639 0 R 3640 0 R 3641 0 R 3642 0 R 3643 0 R 3644 0 R 3645 0 R 3646 0 R 3647 0 R 3648 0 R 3649 0 R 3650 0 R 3651 0 R 3652 0 R 3653 0 R 3654 0 R 3655 0 R 3656 0 R 3657 0 R 3658 0 R 3659 0 R 3660 0 R 3661 0 R 3662 0 R 3663 0 R 3664 0 R 3665 0 R 3666 0 R 3667 0 R 3668 0 R 3669 0 R 3670 0 R 3671 0 R 3672 0 R 3673 0 R 3674 0 R ] +/Parent 3701 0 R +/Annots [ 3706 0 R 3707 0 R 3708 0 R 3709 0 R 3710 0 R 3711 0 R 3712 0 R 3713 0 R 3714 0 R 3715 0 R 3716 0 R 3717 0 R 3718 0 R 3719 0 R 3720 0 R 3721 0 R 3722 0 R 3723 0 R 3724 0 R 3725 0 R 3726 0 R 3727 0 R 3728 0 R 3729 0 R 3730 0 R 3731 0 R 3732 0 R 3733 0 R 3734 0 R 3735 0 R 3736 0 R 3737 0 R 3738 0 R 3739 0 R 3740 0 R 3741 0 R 3742 0 R 3743 0 R 3744 0 R 3745 0 R 3746 0 R 3747 0 R 3748 0 R 3749 0 R 3750 0 R 3751 0 R 3752 0 R ] >> endobj -3627 0 obj << +3706 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 754.651 512.306 763.674] +/Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (section.21.6) >> +/A << /S /GoTo /D (section.19.21) >> >> endobj -3628 0 obj << +3707 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] +/Rect [519.586 730.193 539.579 739.761] /Subtype /Link -/A << /S /GoTo /D (section.21.7) >> +/A << /S /GoTo /D (chapter.20) >> >> endobj -3629 0 obj << +3708 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 716.643 512.306 726.212] +/Rect [521.223 716.643 539.579 725.666] /Subtype /Link -/A << /S /GoTo /D (chapter.22) >> +/A << /S /GoTo /D (section.20.1) >> >> endobj -3630 0 obj << +3709 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 703.094 512.306 712.117] +/Rect [521.223 703.094 539.579 712.117] /Subtype /Link -/A << /S /GoTo /D (section.22.1) >> +/A << /S /GoTo /D (section.20.2) >> >> endobj -3631 0 obj << +3710 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 689.545 512.306 698.568] +/Rect [521.223 689.545 539.579 698.568] /Subtype /Link -/A << /S /GoTo /D (section.22.2) >> +/A << /S /GoTo /D (section.20.3) >> >> endobj -3632 0 obj << +3711 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 675.996 512.306 685.019] +/Rect [521.223 675.996 539.579 685.019] /Subtype /Link -/A << /S /GoTo /D (section.22.3) >> +/A << /S /GoTo /D (subsection.20.3.1) >> >> endobj -3633 0 obj << +3712 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 662.447 512.306 671.469] +/Rect [521.223 662.447 539.579 671.469] /Subtype /Link -/A << /S /GoTo /D (subsection.22.3.1) >> +/A << /S /GoTo /D (subsection.20.3.2) >> >> endobj -3634 0 obj << +3713 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 648.897 512.306 657.92] +/Rect [521.223 648.897 539.579 657.92] /Subtype /Link -/A << /S /GoTo /D (section.22.4) >> +/A << /S /GoTo /D (subsection.20.3.3) >> >> endobj -3635 0 obj << +3714 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 635.348 512.306 644.371] +/Rect [521.223 635.348 539.579 644.371] /Subtype /Link -/A << /S /GoTo /D (subsection.22.4.1) >> +/A << /S /GoTo /D (subsection.20.3.4) >> >> endobj -3636 0 obj << +3715 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 621.799 512.306 630.822] +/Rect [521.223 621.799 539.579 630.822] /Subtype /Link -/A << /S /GoTo /D (section.22.5) >> +/A << /S /GoTo /D (subsection.20.3.5) >> >> endobj -3637 0 obj << +3716 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 597.341 512.306 606.909] +/Rect [521.223 608.25 539.579 617.273] /Subtype /Link -/A << /S /GoTo /D (chapter.23) >> +/A << /S /GoTo /D (section.20.4) >> >> endobj -3638 0 obj << +3717 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 583.792 512.306 592.814] +/Rect [521.223 594.701 539.579 603.724] /Subtype /Link -/A << /S /GoTo /D (section.23.1) >> +/A << /S /GoTo /D (subsection.20.4.1) >> >> endobj -3639 0 obj << +3718 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 570.242 512.306 579.265] +/Rect [521.223 581.151 539.579 590.174] /Subtype /Link -/A << /S /GoTo /D (section.23.2) >> +/A << /S /GoTo /D (subsection.20.4.2) >> >> endobj -3640 0 obj << +3719 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 556.693 512.306 565.716] +/Rect [519.586 556.693 539.579 566.261] /Subtype /Link -/A << /S /GoTo /D (subsection.23.2.1) >> +/A << /S /GoTo /D (chapter.21) >> >> endobj -3641 0 obj << +3720 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 543.144 512.306 552.167] +/Rect [521.223 543.144 539.579 552.167] /Subtype /Link -/A << /S /GoTo /D (subsection.23.2.2) >> +/A << /S /GoTo /D (section.21.1) >> >> endobj -3642 0 obj << +3721 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 529.595 512.306 538.618] +/Rect [521.223 529.595 539.579 538.618] /Subtype /Link -/A << /S /GoTo /D (subsubsection.23.2.2.1) >> +/A << /S /GoTo /D (section.21.2) >> >> endobj -3643 0 obj << +3722 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 516.046 512.306 525.068] +/Rect [521.223 516.046 539.579 525.068] /Subtype /Link -/A << /S /GoTo /D (subsection.23.2.3) >> +/A << /S /GoTo /D (section.21.3) >> >> endobj -3644 0 obj << +3723 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 502.496 512.306 511.519] +/Rect [521.223 502.496 539.579 511.519] /Subtype /Link -/A << /S /GoTo /D (subsubsection.23.2.3.1) >> +/A << /S /GoTo /D (subsection.21.3.1) >> >> endobj -3645 0 obj << +3724 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 488.947 512.306 497.97] +/Rect [521.223 488.947 539.579 497.97] /Subtype /Link -/A << /S /GoTo /D (section.23.3) >> +/A << /S /GoTo /D (section.21.4) >> >> endobj -3646 0 obj << +3725 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 475.398 512.306 484.421] +/Rect [521.223 475.398 539.579 484.421] /Subtype /Link -/A << /S /GoTo /D (subsection.23.3.1) >> +/A << /S /GoTo /D (subsection.21.4.1) >> >> endobj -3647 0 obj << +3726 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 461.849 512.306 470.872] +/Rect [521.223 461.849 539.579 470.872] /Subtype /Link -/A << /S /GoTo /D (subsection.23.3.2) >> +/A << /S /GoTo /D (subsection.21.4.2) >> >> endobj -3648 0 obj << +3727 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 448.3 512.306 457.322] +/Rect [521.223 448.3 539.579 457.322] /Subtype /Link -/A << /S /GoTo /D (subsection.23.3.3) >> +/A << /S /GoTo /D (subsection.21.4.3) >> >> endobj -3649 0 obj << +3728 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 434.75 512.306 443.773] +/Rect [521.223 434.75 539.579 443.773] /Subtype /Link -/A << /S /GoTo /D (section.23.4) >> +/A << /S /GoTo /D (subsection.21.4.4) >> >> endobj -3650 0 obj << +3729 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 421.201 512.306 430.224] +/Rect [521.223 421.201 539.579 430.224] /Subtype /Link -/A << /S /GoTo /D (section.23.5) >> +/A << /S /GoTo /D (subsection.21.4.5) >> >> endobj -3651 0 obj << +3730 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 407.652 512.306 416.675] +/Rect [521.223 407.652 539.579 416.675] /Subtype /Link -/A << /S /GoTo /D (subsection.23.5.1) >> +/A << /S /GoTo /D (subsection.21.4.6) >> >> endobj -3652 0 obj << +3731 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 383.194 512.306 392.762] +/Rect [521.223 394.103 539.579 403.126] /Subtype /Link -/A << /S /GoTo /D (chapter.24) >> ->> endobj -3653 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 369.645 512.306 378.667] -/Subtype /Link -/A << /S /GoTo /D (section.24.1) >> +/A << /S /GoTo /D (section.21.5) >> >> endobj -3654 0 obj << +3732 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 356.095 512.306 365.118] +/Rect [521.223 380.554 539.579 389.576] /Subtype /Link -/A << /S /GoTo /D (section.24.2) >> +/A << /S /GoTo /D (subsection.21.5.1) >> >> endobj -3655 0 obj << +3733 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 342.546 512.306 351.569] +/Rect [521.223 367.004 539.579 376.027] /Subtype /Link -/A << /S /GoTo /D (subsection.24.2.1) >> +/A << /S /GoTo /D (subsection.21.5.2) >> >> endobj -3656 0 obj << +3734 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 328.997 512.306 338.02] +/Rect [521.223 353.455 539.579 362.478] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.1.1) >> +/A << /S /GoTo /D (subsection.21.5.3) >> >> endobj -3657 0 obj << +3735 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 315.448 512.306 324.471] +/Rect [521.223 326.357 539.579 335.38] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.1.2) >> +/A << /S /GoTo /D (subsubsection.21.5.3.1) >> >> endobj -3658 0 obj << +3736 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 288.349 512.306 297.372] +/Rect [521.223 312.808 539.579 321.83] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.1.3) >> +/A << /S /GoTo /D (subsubsection.21.5.3.2) >> >> endobj -3659 0 obj << +3737 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 274.8 512.306 283.823] +/Rect [521.223 299.258 539.579 308.281] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.1.4) >> +/A << /S /GoTo /D (subsubsection.21.5.3.3) >> >> endobj -3660 0 obj << +3738 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 261.251 512.306 270.274] +/Rect [521.223 285.709 539.579 294.732] /Subtype /Link -/A << /S /GoTo /D (subsection.24.2.2) >> +/A << /S /GoTo /D (subsubsection.21.5.3.4) >> >> endobj -3661 0 obj << +3739 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 247.702 512.306 256.725] +/Rect [521.223 272.16 539.579 281.183] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.2.1) >> +/A << /S /GoTo /D (subsubsection.21.5.3.5) >> >> endobj -3662 0 obj << +3740 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 234.153 512.306 243.175] +/Rect [521.223 258.611 539.579 267.634] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.2.2) >> +/A << /S /GoTo /D (subsubsection.21.5.3.6) >> >> endobj -3663 0 obj << +3741 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 220.603 512.306 229.626] +/Rect [521.223 245.062 539.579 254.084] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.2.3) >> +/A << /S /GoTo /D (subsubsection.21.5.3.7) >> >> endobj -3664 0 obj << +3742 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 193.505 512.306 202.528] +/Rect [521.223 231.512 539.579 240.535] /Subtype /Link -/A << /S /GoTo /D (subsection.24.2.3) >> +/A << /S /GoTo /D (section.21.6) >> >> endobj -3665 0 obj << +3743 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 179.956 512.306 188.979] +/Rect [521.223 217.963 539.579 226.986] /Subtype /Link -/A << /S /GoTo /D (subsection.24.2.4) >> +/A << /S /GoTo /D (section.21.7) >> >> endobj -3666 0 obj << +3744 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 166.407 512.306 175.429] +/Rect [521.223 204.414 539.579 213.437] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.4.1) >> +/A << /S /GoTo /D (subsection.21.7.1) >> >> endobj -3667 0 obj << +3745 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 152.857 512.306 161.88] +/Rect [519.586 179.956 539.579 189.524] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.4.2) >> +/A << /S /GoTo /D (chapter.22) >> >> endobj -3668 0 obj << +3746 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 139.308 512.306 148.331] +/Rect [521.223 166.407 539.579 175.429] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.4.3) >> +/A << /S /GoTo /D (section.22.1) >> >> endobj -3669 0 obj << +3747 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 125.759 512.306 134.782] +/Rect [521.223 152.857 539.579 161.88] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.4.4) >> +/A << /S /GoTo /D (section.22.2) >> >> endobj -3670 0 obj << +3748 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 112.21 512.306 121.233] +/Rect [521.223 139.308 539.579 148.331] /Subtype /Link -/A << /S /GoTo /D (section.24.3) >> +/A << /S /GoTo /D (section.22.3) >> >> endobj -3671 0 obj << +3749 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 98.661 512.306 107.683] +/Rect [521.223 125.759 539.579 134.782] /Subtype /Link -/A << /S /GoTo /D (section.24.4) >> +/A << /S /GoTo /D (subsection.22.3.1) >> >> endobj -3672 0 obj << +3750 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 85.111 512.306 94.134] +/Rect [521.223 112.21 539.579 121.233] /Subtype /Link -/A << /S /GoTo /D (section.24.5) >> +/A << /S /GoTo /D (section.22.4) >> >> endobj -3673 0 obj << +3751 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 71.562 512.306 80.585] +/Rect [521.223 98.661 539.579 107.683] /Subtype /Link -/A << /S /GoTo /D (subsection.24.5.1) >> +/A << /S /GoTo /D (subsection.22.4.1) >> >> endobj -3674 0 obj << +3752 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 58.013 512.306 67.036] +/Rect [521.223 85.111 539.579 94.134] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.5.1.1) >> +/A << /S /GoTo /D (section.22.5) >> >> endobj -3626 0 obj << -/D [3624 0 R /XYZ 85.039 786.531 null] +3705 0 obj << +/D [3703 0 R /XYZ 85.039 786.531 null] >> endobj -3623 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> +3702 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3677 0 obj << -/Length 3303 -/Filter /FlateDecode ->> -stream -xÚíœ[w·€ßõ+øÖå!\w}ɱ§qê[-¥î9I(‰’XK¤ËKd÷×wp‡¸‹‘×WYõɉIí.0ƒùf€ÁeÉFþc£V*ô¨ik¢\íÑÑ9ÜùÛóOLü#“왇G{û?ÕrÄ(ÑTŽÎb=š¥ëÑÑéoÕÁr1æmµ™¹õø£_öÅŠ3ÑLSíö~ûƒŽNA…_ö(º]ÃwJ˜Ö£«=©QRø¿/÷÷þër÷äÈ•êk…-Q­è6ƒ©¬ êiêfÔ(EjÙØvpIád<u]==„O!ªWcVͧðïrÌ›êzm.ËêÙ‘ ÷[Q-Wpÿõz3ÝÌÁ)hÕ(j?¤ÖÙ_7?°{X|ÇøRK¢eÚ1Ùê|侼̌JM²b]#îÖmŒ(˜ØUA1F€C]xîQ\ld'9¡à‘x?vœÒ·pmÿ_/Æ®Ú7ùW é›>”f*†ÐÌÌ*˜*ÑìjP¦‰‰e¼%ubáSIhÖ`.%t.Wã «®L\¦€ÜjeÎàdüë±ùŒ^SÂîm4{*†`Ïì/XSÂÞÕ Œƒ®FäÌðÏK3’\í®\üNàÂlí®,3ó¥5ÀªÙÆý±}ã>k,§Ökæðuqî.¿±×§L^†zÎÌ••»ýï­ó(VùêÀá n÷àïTÑðàÔ}œ¹»¬º†›ÌXk$¤mÜ„Áåµ]ÏVû¾×±åÁÏWK#êÍþú‡ñ¤ÖÍ7ä±%¯¤ŒH5Ø)c)Ä'Ý3·¸dG|Ù#™Á!ë¶K,9eȦ¾ zöüÈ}Ù:ÿs¼ >güæÜ]{±²œÏÉöÎÁ ÍH/+VÆ—›R°¶À¯Gƒ"@Tl$ØH"OC^pp1µpæ ÏgsááÎΦ&*/7îï78ïõÁÐä¡S1„bfN„bWƒEÑrR 9‚°?}éÀ¤–š´ZFÝ8ÍQ3Bù(Ü~°oXØKæî‰Ëå;ö¶±I7ÔÌÂ9-Ö’­‘9-9ÕÔ1œäÐU5æOln·«Ko*V ˆßï‚U™OÅ~·ÒyÓ –ÕÌmÓÅ© ›‡öî" >„`F8Ñšß·d,XihÌ¥bHÌewèjPî91±<ç¤Ñ<÷àÌwvbæPîüdz逛˜Ð'Ûõ:„•IÔëZßÓ ÷gnºñk¾ì¿1 mKNÜGŽ­™9ÍíÃåmÓ|!R¡YIeÅʤr“ Î ¤z4(’BņXS1Ù&Rarñèm4þ›uÂÈzßß¹YéìÊ]:°S‹Œ‹E7w¥”Ý@ mŠ/Cðev¼´FÕ£A&6ZÝ¥õ |)Ð|ùWe«ù¹]cåå&.®l¼%Ž&=’_•o×PT©‚*³‚ª«A&6¢RñÊ]T¼U$Sú° -—ŽÌlsGm!ôËQÊ­{róþ‰¯j’ÕÕm–’(&n4k}e2²cÛm¯}ïÌ•üL+Ø%×IZr¬±»ußâ:] Ê®ƒ‰4Érà°zàÍMÂxiãץΟÌÕ”.Å^:˘j­ïj^äZ=c(„@ŒÖ¼´„ב]Xññ†hÅ@龜¹„\ÿä7ŠFvúoÒùIÌo ÂõÜ>yl¯šj²^šñ—5Ÿ’ˆoÈP&©B%3Â¥«A™ &6²a’HÊç`Ï©›E^›ïË•_S°)ÐâÄ\»XÙ¨šÿ·—O\w••Ïdwû캆 MF%>ªÓöuM²ÊzzíZ½Óìn¯m}§͇„vÉu’Vƒ\kÌnÝÎuJë=”]tJI«Ä ×És¯þ³ÎüÇÏkïl¡—6·Í-ý‰BØ+=”C*†pÈ "¸.qèjP怉 dÛAw9ð[9<5¦=Ï—nfÁù8©ÿÜã]hÇ@4Y±2šÜFe4=Ñ b#šzY%wÐæiXµu}$Ò¡º6]’ÝS÷°4m­¾PFš3”P*†ÊL%DiµGƒ2!Ll$TS©Ú!$=¡¿ÏVÇÂ7nõÜîW¯#¬BX=ög¯ldùå×[Jö¡@¼öC¤bÌ2®e ˜Ø°â-%Œã*.~Šï§Nz°{ ÅžŠ!Ø3û#Ø»”±cbC*… Œ6 {Xóî™ês -IœHe>&m uM²ÊºZrUÀ×\Ë0åðGÚܺ„ñÊå±_/wOÙÞë{¤äbɃ\ ³ânÝ·¸XWƒ[ö¯5¾-)|É{÷¯ÃCÖk·ýxá{s;Û¬wœ|ó€_Ž…Üb¹¸˜mÆ‚Â%øÇÞ´ûÛ¯}G¥¯ç› ÷í|›UÇÓ¦v¦ð{lj£ÍÛ©ÑY¾´ÈžÕTÜÔžpÂ8~jYÒšÀïî…†§Ãný}g»?ƒ•FcV¬9²OôhPìðQ±|Ë¡<^Çí‡S»©ýúÜæZÛEÊ©XufGû+ç!³‚™êý¡ìL2r,…0NÆFwÄ— #2#àº%4Û«c"÷lzåç;nõo½¼ÜÆI¾aþ§~HͧH¿ÚÕ‚·ûOÌØ««í[¿úgð¢_‚Ó¨{¢_nÍ64z(ÃT ˜Z]¢ØÕ Œ23¡ÌØšq ™Ùþl㶩/ü¼Èu¿Ðíß±pûL¨½]†¢NÅÔ™ÍÔ] ʨ1±µ4—xBÍwQ¯Âx aû'9Y.Ìv‹â÷Ž­7ÄP¶©Â632ôi%¶] Êl1±‘-oˆ«µ†­@ÂØ“…Dﾯ·ÆPÀ©8³4¸«A0&6†9jKe,w‡C)Õ¦ îð Ù(»±wÚˆöÐõ¦J7CèffFèv5(ÓÅÄÆlŠRÂS¾,;Ù”!ÇKà¸M»)Óux3ÂvÛ§a»tsa×-üNÀ¡[ÿßÍkÓ”î›)­y]Ï­s¾¶%Íùihù¦ ¥•Š!´2³ Q:°Ð£A™&6Ä"okÒÐ:Ñ -9ÓÑ…Çõl¶yøø¹ßíNÜüÇ<Õ²»f¡•ÁeÅÊàr -QÀõhP‡ŠàÈoUŽï‚{b¶Í~~~xäÙeo¥0Êä7Ük†¶Å™Š!83»"8»”qbb#N¥IV• Îô@€vdú8ß÷¹÷aäü~Ï[‚M†bNÅÌ™½…(DèÑ Œ1ËšPÕ&Ì!õùñ™Ò'î}Õ¥»Ìk©MÓÜW¼ÞCñ¦bÞÌÎÞ®e¼˜ØˆWp¢¨NxÃ¥WK|µ¸`½†‚MÅ°™…°] Ê`1±!©å¬%:¶êûVoug¢¡Ðc)„y2¾¥1]ñeâˆÌÉTÉð?õ/Â<ôa|Ï[Là O÷³.f–ú—M~ "dÎaçÀì¸Öw!\]S‡‚‹¥pɈ¸Žø28DfÇ4#m‘ yñ?훈«wéhßeü©;Íqo4Ù+~öNùŽ»“ôÂŒ®ùÝéqC£2ÌŠ•!æ-SìÑ ˆ96­ÝæŽCBl¶¢Íi¿ëâV Všk3ÿ;‹8Kug7!4gñå|wæ:nMÅWeæ8”Y*†0ËŒ‡0ëjðqïÝv­ºå½ûðÛ¸s ¿.æ'î§Z«NgûSs(aµžuÌÈd½Ç‘T³­Ñdé ̬&ìÈAÃ[ôÈSŒ0^ãY“”MõýÈA y+ ¤T ¤Œâ] Ê&6‚GjÂjϼº°/mzØ~‡Ëwsn‰|ºrýá&zD:˜»uïß»Äåtö|ÖÍ75±fJ:CHg&GHw5(“ÆÄFÒö¼^H‡³;ƒœlîAOWadÖéû4“ Ö -<C€g–G€w5(ÇÄàZ“Z5·Œ3I{DÓg17~Ãð?[-¯ü«Á—>šñ¥ï™}³¾ý†1{› ¤œJ•!gÖ²tœ¨+¾ˆ“›ß*¥m Ö -~™Ú׶³ôÃ_1= ¶_7Ðÿ ÞN©§Reê2õ®ør>§(U} ü/Â/~øOÓ¦“¨-Ñm!¹7oIÖ ˜ ·ißó“Zþ'lýC™Æÿ¢þ¿Vendstream +3755 0 obj << +/Length 3333 +/Filter /FlateDecode +>> +stream +xÚí[wÛ6€ßý+ôVéA0@\HìË×NÒvëÔ»'{N·ŠL;ÚX¦W’kûß/@\Ecc“Ô—æô´’%Žf8ß .%#¬þ!£Š#L娬┌æË<:Wß¼Ù!öŠ©½d]óýÉÎîk.F#‰åèäÌÿŽÄˆK1:9ým¼ß\NŠj¼©ÍËzòûÉO;¯NüGª ¥úgÿ»óÛïxtªLøi#*«Ñz‘r´Üaœ"ΨýûbçxçŸþ·Ìwld¤†î‚Ñ‘j4¥U¼„`‚¦êN9G‚•þN šP2n.&d¼˜/Ôk}AÏC¼PÞ¬è(²Ç|µ:™7ï"óÝÕ°ùÝßÔöÓBöTÓª«ºïRëôiHqOìèK áM"<2Éù½d +Ÿu)QN-¿žTÌ8h¶¹V¾ZYgM)¥ÊͧæÍ÷í§—Î—ÿÆ„©÷*ê¦RcõScý¤Œþ|.ùŠâŸ÷Ó½Ð)PA¤÷iN"„ŒÔ4ëóêþö}!Ô7¡'îZX±”B]ͤ ”ÂÊþªžm—ç[‘QŒg—³sÝÈÜ7¾™R¦¢ê›š Õ +k*¥Š´çÙú#r G¾† ÷M CŠI!“lTªO=`ÝèŽôýB·ðÓFS»Y„òv÷Ð4û>PŠå£CûJÌ•{ry€µu9¥8Éy[-À8¥ÌóÕ9B\ˆßž0óæX÷éú›»‹À[¶¼ïLã~½¸Ðà«‚>KªÆ)¹`½À6¸ÂÛÓ´azjQ•ê#²E™Œukf•¿kÕmß¼Öï6+õî.¾Rýz9nmH¨Þ»ü¥µcç¡Lä‘Xšyì}JI +ú€ iê b׶EÉåEÀNmã><6­ô½Î|ÕZ%Á…صóã[sÁ®yùבy=Òy_sV·a²^4:f`áC•”>²Ö ¹dƒ@6r0D¶o@Rì´Pã'õ“ zïtÙ6Õ…iΚÊÈ­bsÃ/þ‘ mžßêš¹þ‘ö1ÎÊGBhï6aFžTijaß!¤ØeÏj8‡ +ÎBj³g•&ëFuîè½y  Ñc.3„ßýµåZ¯TH¡Ÿ[zí–A ˆ‚†òi2 +ú&Q)ö]4¥¨ÄQ¸ûx¶Ô\?Ì äWº“^lVµŠ“I¥Z² +~]›vÞ +>ˆ_)¬»rc ˆ1¡€b obF„ó÷äà»æù\=^_"sëž\æA `¹^y7ɼoÀRì™cÔ¿9n÷Gû:û.Ÿ_/þ•‚Áú-7‚ (ú&Á)v©—aî‹Ø̦Çw~DæêdíÀ{¶j °WÒëÏ͹KñLžÞ>æ&_û|â—?t|Õ«?õÍd*+òäôΙŒ#±4ãØÕãÒŒAÅžq)ǾªÎ]±´Yj>KGî•&·jV†<%Åsh«"Ö›¹!Ä€‰HQÊ“!Ò7H±{&pÁ‘äQˆ¸\°›áÛÛiáµË šØéÜP‡Ð'=/_öÁy-7‚ +(ú&$'> †¯à‰OÎâà´§¹¢ f&=lÕEAß4WvzsÕè ¸¶F««>z¦^Ö—›Ô §WüùMÀÊíß3ÞIï¹ßùœ™MN%¢¥¼§.Jʼn8¿}›ÙüÍÏú4·ù1 ùE¼ ê›ôÄb(DµR\¸@q3›ïšÙÒçQGºƒµíK å·gôvdX'æFF"#EFß 2 Åþ1ª8 ‘‘¨×ì7—¶‡8¿ÖÅW+6Å;kVq–ÞFP˜8ýaÖÖãý\‹FùFÖ:!—lÈF†ÈöMÈBŠ]IU%¢x›l(©‡²‹&×)Àˆššî øï PÝýgBÄÒPcßRZ¦ ˜† +*öPKŠJWd÷P uxÃÖ|È¡m–¿škªå¶éBÁé“…ký 7ˆp#Cpû&p!Å®À¨À¼—Z¸‡‹[Çæœí$%~pv¨;ˆƒk{. ‰üBi•Ò7)ö@˜@‚‹f,Ö³ñ +0Oµ3VÑgqgj^×WvBe¶]¹O¡aÙ[ÎåÄŽ‘;!Ž}Žb—ä0JÁeàMHì_,ìÒâ~øÛ+Úuú“óëÎ\ôú•-ígf2?{«¹ü‚À/r#¥É5{&ü ž‰8ßæR™Œ§Þ`†z\oTsœJüôSwã¹4ƒ@3r*D³o@Rìib°«{šPã×é½×•fõÉÏ#„‘ò™ä¥öös™1€iäZÊ’ëwL˜BŠS* ĸì0¥S•màÝûÖaIIž?w«™ü"±4¿Ø¿Òü@Åî IË +IðùÙÛšÄÊ Þ·ûP›ÓøÒâS¾oÒÞ茴¶%Æv½ü{½ º›‹º¼ÓGÂM;5°ú´Þ˜'¨ièÓã1w’KÇKp‚(K.§èëÐZ=Áæ&Q:y‰zÊ-ÎU.¢¾4Ó^cçZïÏûë•L5oš±êrP©«wª]òEš’½·\XA  ù ÂÕ7à)ö]!'¨"ÛÀàdÅ?ÞzMKèеmi¹•šn/šRΖr¶éî5`F~¤,9³=`R쪫 QtºüäX'§–MÛlcyÛl\g({¡““Î7¹Àƒ<ò;¼oRì+Ê%¡à.yY¶ÅÓ/^»ª™êþêÛZ×FÉËžv¾ÉÄà‘ß!à}àbœDëwu7µí^<Ð{CÄ_pYšóP.ö `¼OYr€ vH±›-d‰ñõÕí꧳MíºÌræßfC EçÌ̉ÄÒƒ"dÀ„t„€Š}„T aá#„uv·BÛm¿ÑxèM)×Wf”Ó™;¿âÖ9¹Äƒ@™½½\fA `¹bÖ7`)öM¶¨20+ÖdmÉekm±+9N}ÖmÓº$—s8Gî¦,¹4bÀ€3¤Øs&QqÎÙù­:g]^.xõÂ{eë¤\òA  ,9w?`@Rì4\ Ò?“Å·m&Ÿ!Æ™¹⥀ø˜(ON\õõÑhuÝ©$* +¢Ã¯^­7›xí/[µ‹žÃWWÉù,¿°õ?×~ÂÙÎ_Ù ê›ðó6ÑÿÎ +;ÙóvlHÆß­Õ3\ð/IÓÝ}&ÎH,Í3ö,tÀ„4QP±GZr$Ê" uOôý™mëo9éz½³üÊÓí­eU]×3îàor1xäwxß8¤Øz7 ÀÝ£}ÿc[˜ 'Gl>ZЧ[£s:¾Úš-¤{®Ä­sr‰1€xäxÊ“'… ˜o“ðf0¢®Q©vh;˜»¦ n6„MdaN¼<4ñña¶nÇR¢ÔK1Í"JÕ•ëù¹×f—±ýzïZ…N{pf»\hnòüÄž±È¾‡ìo§û›ÆÕÉ™Žè·’{Ç0¸m¬kÍ`JEô^1Wç߶}‘†j}šÛPƒÐP#^PôôMºfH±õŠÛ6Ö.;¨çzœõ±=–iîÎÌ:ð‡4ͯ×k·Z'éâÉ-Ï{„±îÌ‘ ÄH„Šòd}À F Åîñ-K„IB$ìñV½ÉÞ¡Ý=Öžø”X5]ŒïìªÕõèƒ`(}1pëžLäA*MRÃIA'jx×RÓjtõgC(T eùê_ê¸þÿÿŸ~¬À*$«dU@#J6¢1jÇæéåèæ¢Èâÿ©»¸Þendstream endobj -3676 0 obj << +3754 0 obj << /Type /Page -/Contents 3677 0 R -/Resources 3675 0 R +/Contents 3755 0 R +/Resources 3753 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3471 0 R -/Annots [ 3679 0 R 3680 0 R 3681 0 R 3682 0 R 3683 0 R 3684 0 R 3685 0 R 3686 0 R 3687 0 R 3688 0 R 3689 0 R 3690 0 R 3691 0 R 3692 0 R 3693 0 R 3694 0 R 3695 0 R 3696 0 R 3697 0 R 3698 0 R 3699 0 R 3700 0 R 3701 0 R 3702 0 R 3703 0 R 3704 0 R 3705 0 R 3706 0 R 3707 0 R 3708 0 R 3709 0 R 3710 0 R 3711 0 R 3712 0 R 3713 0 R 3714 0 R 3715 0 R 3716 0 R 3717 0 R 3718 0 R 3719 0 R 3720 0 R 3721 0 R 3722 0 R 3723 0 R 3724 0 R 3725 0 R ] +/Parent 3701 0 R +/Annots [ 3757 0 R 3758 0 R 3759 0 R 3760 0 R 3761 0 R 3762 0 R 3763 0 R 3764 0 R 3765 0 R 3766 0 R 3767 0 R 3768 0 R 3769 0 R 3770 0 R 3771 0 R 3772 0 R 3773 0 R 3774 0 R 3775 0 R 3776 0 R 3777 0 R 3778 0 R 3779 0 R 3780 0 R 3781 0 R 3782 0 R 3783 0 R 3784 0 R 3785 0 R 3786 0 R 3787 0 R 3788 0 R 3789 0 R 3790 0 R 3791 0 R 3792 0 R 3793 0 R 3794 0 R 3795 0 R 3796 0 R 3797 0 R 3798 0 R 3799 0 R 3800 0 R 3801 0 R 3802 0 R 3803 0 R 3804 0 R 3805 0 R 3806 0 R 3807 0 R ] >> endobj -3679 0 obj << +3757 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 754.651 512.306 763.674] +/Rect [519.586 754.651 539.579 764.219] /Subtype /Link -/A << /S /GoTo /D (subsection.24.5.2) >> +/A << /S /GoTo /D (chapter.23) >> >> endobj -3680 0 obj << +3758 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (subsection.24.5.3) >> +/A << /S /GoTo /D (section.23.1) >> >> endobj -3681 0 obj << +3759 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 727.553 512.306 736.575] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (section.24.6) >> +/A << /S /GoTo /D (section.23.2) >> >> endobj -3682 0 obj << +3760 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 700.454 512.306 709.477] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (subsection.24.6.1) >> +/A << /S /GoTo /D (subsection.23.2.1) >> >> endobj -3683 0 obj << +3761 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 686.905 512.306 695.928] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsection.24.6.2) >> +/A << /S /GoTo /D (subsection.23.2.2) >> >> endobj -3684 0 obj << +3762 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 673.356 512.306 682.379] +/Rect [521.223 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (subsection.24.6.3) >> +/A << /S /GoTo /D (subsubsection.23.2.2.1) >> >> endobj -3685 0 obj << +3763 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 648.897 512.306 658.466] +/Rect [521.223 673.356 539.579 682.379] /Subtype /Link -/A << /S /GoTo /D (chapter.25) >> +/A << /S /GoTo /D (subsection.23.2.3) >> >> endobj -3686 0 obj << +3764 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 635.348 512.306 644.371] +/Rect [521.223 659.807 539.579 668.829] /Subtype /Link -/A << /S /GoTo /D (section.25.1) >> +/A << /S /GoTo /D (subsubsection.23.2.3.1) >> >> endobj -3687 0 obj << +3765 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 621.799 512.306 630.822] +/Rect [521.223 646.257 539.579 655.28] /Subtype /Link -/A << /S /GoTo /D (section.25.2) >> +/A << /S /GoTo /D (section.23.3) >> >> endobj -3688 0 obj << +3766 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 608.25 512.306 617.273] +/Rect [521.223 632.708 539.579 641.731] /Subtype /Link -/A << /S /GoTo /D (subsection.25.2.1) >> +/A << /S /GoTo /D (subsection.23.3.1) >> >> endobj -3689 0 obj << +3767 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 594.701 512.306 603.724] +/Rect [521.223 619.159 539.579 628.182] /Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.1.1) >> +/A << /S /GoTo /D (subsection.23.3.2) >> >> endobj -3690 0 obj << +3768 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 581.151 512.306 590.174] +/Rect [521.223 605.61 539.579 614.633] /Subtype /Link -/A << /S /GoTo /D (subsection.25.2.2) >> +/A << /S /GoTo /D (subsection.23.3.3) >> >> endobj -3691 0 obj << +3769 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 567.602 512.306 576.625] +/Rect [521.223 592.061 539.579 601.083] /Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.2.1) >> +/A << /S /GoTo /D (section.23.4) >> >> endobj -3692 0 obj << +3770 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 554.053 512.306 563.076] +/Rect [521.223 578.511 539.579 587.534] /Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.2.2) >> +/A << /S /GoTo /D (section.23.5) >> >> endobj -3693 0 obj << +3771 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 540.504 512.306 549.527] +/Rect [521.223 564.962 539.579 573.985] /Subtype /Link -/A << /S /GoTo /D (subsection.25.2.3) >> +/A << /S /GoTo /D (subsection.23.5.1) >> >> endobj -3694 0 obj << +3772 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 526.955 512.306 535.978] +/Rect [519.586 540.504 539.579 550.072] /Subtype /Link -/A << /S /GoTo /D (subsection.25.2.4) >> +/A << /S /GoTo /D (chapter.24) >> >> endobj -3695 0 obj << +3773 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 513.406 512.306 522.428] +/Rect [521.223 526.955 539.579 535.978] /Subtype /Link -/A << /S /GoTo /D (subsection.25.2.5) >> +/A << /S /GoTo /D (section.24.1) >> >> endobj -3696 0 obj << +3774 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 499.856 512.306 508.879] +/Rect [521.223 513.406 539.579 522.428] /Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.5.1) >> +/A << /S /GoTo /D (section.24.2) >> >> endobj -3697 0 obj << +3775 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 486.307 512.306 495.33] +/Rect [521.223 499.856 539.579 508.879] /Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.5.2) >> +/A << /S /GoTo /D (subsection.24.2.1) >> >> endobj -3698 0 obj << +3776 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 472.758 512.306 481.781] +/Rect [521.223 486.307 539.579 495.33] /Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.5.3) >> +/A << /S /GoTo /D (subsubsection.24.2.1.1) >> >> endobj -3699 0 obj << +3777 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 459.209 512.306 468.232] +/Rect [521.223 472.758 539.579 481.781] /Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.5.4) >> +/A << /S /GoTo /D (subsubsection.24.2.1.2) >> >> endobj -3700 0 obj << +3778 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 445.66 512.306 454.682] +/Rect [521.223 459.209 539.579 468.232] /Subtype /Link -/A << /S /GoTo /D (section.25.3) >> +/A << /S /GoTo /D (subsubsection.24.2.1.3) >> >> endobj -3701 0 obj << +3779 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 432.11 512.306 441.133] +/Rect [521.223 445.66 539.579 454.682] /Subtype /Link -/A << /S /GoTo /D (subsection.25.3.1) >> +/A << /S /GoTo /D (subsubsection.24.2.1.4) >> >> endobj -3702 0 obj << +3780 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 407.652 512.306 417.22] +/Rect [521.223 432.11 539.579 441.133] /Subtype /Link -/A << /S /GoTo /D (chapter.26) >> +/A << /S /GoTo /D (subsection.24.2.2) >> >> endobj -3703 0 obj << +3781 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 394.103 512.306 403.126] +/Rect [521.223 418.561 539.579 427.584] /Subtype /Link -/A << /S /GoTo /D (section.26.1) >> +/A << /S /GoTo /D (subsubsection.24.2.2.1) >> >> endobj -3704 0 obj << +3782 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 380.554 512.306 389.576] +/Rect [521.223 405.012 539.579 414.035] /Subtype /Link -/A << /S /GoTo /D (section.26.2) >> +/A << /S /GoTo /D (subsubsection.24.2.2.2) >> >> endobj -3705 0 obj << +3783 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 367.004 512.306 376.027] +/Rect [521.223 391.463 539.579 400.486] /Subtype /Link -/A << /S /GoTo /D (section.26.3) >> +/A << /S /GoTo /D (subsubsection.24.2.2.3) >> >> endobj -3706 0 obj << +3784 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 353.455 512.306 362.478] +/Rect [521.223 377.914 539.579 386.936] /Subtype /Link -/A << /S /GoTo /D (subsection.26.3.1) >> +/A << /S /GoTo /D (subsection.24.2.3) >> >> endobj -3707 0 obj << +3785 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 339.906 512.306 348.929] +/Rect [521.223 364.364 539.579 373.387] /Subtype /Link -/A << /S /GoTo /D (subsection.26.3.2) >> +/A << /S /GoTo /D (subsection.24.2.4) >> >> endobj -3708 0 obj << +3786 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 326.357 512.306 335.38] +/Rect [521.223 350.815 539.579 359.838] /Subtype /Link -/A << /S /GoTo /D (subsection.26.3.3) >> +/A << /S /GoTo /D (subsubsection.24.2.4.1) >> >> endobj -3709 0 obj << +3787 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 312.808 512.306 321.83] +/Rect [521.223 337.266 539.579 346.289] /Subtype /Link -/A << /S /GoTo /D (subsection.26.3.4) >> +/A << /S /GoTo /D (subsubsection.24.2.4.2) >> >> endobj -3710 0 obj << +3788 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 299.258 512.306 308.281] +/Rect [521.223 323.717 539.579 332.74] /Subtype /Link -/A << /S /GoTo /D (section.26.4) >> +/A << /S /GoTo /D (subsubsection.24.2.4.3) >> >> endobj -3711 0 obj << +3789 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 285.709 512.306 294.732] +/Rect [521.223 310.168 539.579 319.19] /Subtype /Link -/A << /S /GoTo /D (subsection.26.4.1) >> +/A << /S /GoTo /D (subsubsection.24.2.4.4) >> >> endobj -3712 0 obj << +3790 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 272.16 512.306 281.183] +/Rect [521.223 296.618 539.579 305.641] /Subtype /Link -/A << /S /GoTo /D (subsection.26.4.2) >> +/A << /S /GoTo /D (section.24.3) >> >> endobj -3713 0 obj << +3791 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 258.611 512.306 267.634] +/Rect [521.223 283.069 539.579 292.092] /Subtype /Link -/A << /S /GoTo /D (subsection.26.4.3) >> +/A << /S /GoTo /D (section.24.4) >> >> endobj -3714 0 obj << +3792 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 245.062 512.306 254.084] +/Rect [521.223 269.52 539.579 278.543] /Subtype /Link -/A << /S /GoTo /D (subsection.26.4.4) >> +/A << /S /GoTo /D (section.24.5) >> >> endobj -3715 0 obj << +3793 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 231.512 512.306 240.535] +/Rect [521.223 255.971 539.579 264.994] /Subtype /Link -/A << /S /GoTo /D (subsection.26.4.5) >> +/A << /S /GoTo /D (subsection.24.5.1) >> >> endobj -3716 0 obj << +3794 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 217.963 512.306 226.986] +/Rect [521.223 242.422 539.579 251.444] /Subtype /Link -/A << /S /GoTo /D (section.26.5) >> +/A << /S /GoTo /D (subsubsection.24.5.1.1) >> >> endobj -3717 0 obj << +3795 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 204.414 512.306 213.437] +/Rect [521.223 228.872 539.579 237.895] /Subtype /Link -/A << /S /GoTo /D (subsection.26.5.1) >> +/A << /S /GoTo /D (subsection.24.5.2) >> >> endobj -3718 0 obj << +3796 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 190.865 512.306 199.888] +/Rect [521.223 215.323 539.579 224.346] /Subtype /Link -/A << /S /GoTo /D (subsection.26.5.2) >> +/A << /S /GoTo /D (subsection.24.5.3) >> >> endobj -3719 0 obj << +3797 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 177.316 512.306 186.338] +/Rect [521.223 201.774 539.579 210.797] /Subtype /Link -/A << /S /GoTo /D (subsection.26.5.3) >> +/A << /S /GoTo /D (section.24.6) >> >> endobj -3720 0 obj << +3798 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 152.857 512.306 162.426] +/Rect [521.223 188.225 539.579 197.248] /Subtype /Link -/A << /S /GoTo /D (chapter.27) >> +/A << /S /GoTo /D (subsection.24.6.1) >> >> endobj -3721 0 obj << +3799 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 139.308 512.306 148.331] +/Rect [521.223 174.676 539.579 183.698] /Subtype /Link -/A << /S /GoTo /D (section.27.1) >> +/A << /S /GoTo /D (subsection.24.6.2) >> >> endobj -3722 0 obj << +3800 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 125.759 512.306 134.782] +/Rect [521.223 161.126 539.579 170.149] /Subtype /Link -/A << /S /GoTo /D (section.27.2) >> +/A << /S /GoTo /D (subsection.24.6.3) >> >> endobj -3723 0 obj << +3801 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 112.21 512.306 121.233] +/Rect [519.586 136.668 539.579 146.236] /Subtype /Link -/A << /S /GoTo /D (section.27.3) >> +/A << /S /GoTo /D (chapter.25) >> >> endobj -3724 0 obj << +3802 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 98.661 512.306 107.683] +/Rect [521.223 123.119 539.579 132.142] /Subtype /Link -/A << /S /GoTo /D (section.27.4) >> +/A << /S /GoTo /D (section.25.1) >> >> endobj -3725 0 obj << +3803 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 85.111 512.306 94.134] +/Rect [521.223 109.57 539.579 118.593] /Subtype /Link -/A << /S /GoTo /D (section.27.5) >> ->> endobj -3678 0 obj << -/D [3676 0 R /XYZ 85.039 786.531 null] ->> endobj -3675 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3728 0 obj << -/Length 2687 -/Filter /FlateDecode ->> -stream -xÚíœÍsÛ6Àïþ+t¤B‰/8í8N›¦“6ÞµÒº=Ð2#«•D—¢“fÿúÅ7 ‘€Åf2UÔL&#Jðßxxx '¹ø'Œ‚óIÉ -@1œ,6ùd)€¦ÄÌ™ežÍ/¾ù® ˜žóÉük‡ç€òb2¿û%»j¶SIJ®Ö»é¯ó.¾»†ÑcÙì¿üšOî„ -?\äs6ù ®s9Ÿl.Å€l¾¯/n.þíÚÒ÷ÈD×z -’s¡k9™á0FË@Ä@QâQ))Ý£¢…Ùãt³ùS‘ͧfõâ~»úã±îÙƒp,Ú²õv9Ñÿ GNkzТT|(—Bx ·o ß× 3 -L„“ €Pö„‡Í‰èð k -©ÞÁµ‡ý~µ¼×öò}µZ èÕíj½’ð§8Ï>jOûZyÝnÕl£nÖ+pŒ›M©{Т¶$‰YÒ·”v³(ífsxÁÓ£«³1qöûêfmÖj#G[P->ÚB"ñ>2 A´•%€LŽ: úßð`ÃDDVB3*<1a{WôJñf IÍ^þ,-Fiö£WËV;by-B:5ö´odh³;q{»ì[*b­@¤%ué´¾‡mjKÒ˜%}S©Ñ†*B°ph"dDÈF¨q‡V RD¾ifÊ(•síÎÞ<,ÛêNÚN™ó]Ûl´»QFß›ßVBÃ?õ¯]£Ë©8s†¸ƒ<ââ¼JGx¸”þûíi‹1‹»v>%Š,äI÷…+µƒ)wîíê¾j…]vÒ€µŒ.¿ú6ãŒÉÆú6_-áÛBñþÑ× B&ź^çº^`CÈ×·¶4ëZÎw2|\4[).ÛªŸ+åÑD@Ù<7*„<ªÆc©új ª¡yãTûÄ©¦ÄZª”B<²T±¡z-S ÕNqý ¯›Ö.ªÅ•ÙïòÇZÎN%/Î{,[¤T‹Sß3”ú€Ÿ¶* D'g⳨-¤tƒz*vB-³Ÿæò.ÑóèõsùåjhR•±þ~ýü*2³z1µ&Ÿê Emð2fpßҧ̮´#ªÀOŒ@ÂÇÔšÙή×jɵ•+oµˆ±çVå/ìz¼Sìý›NÍȺ%Š¿Èg,2vÀùj‰Z;ο¯AÔÍ&ÅBŠAY”Š)À¬ð%fµ€¾Æ Ùoè¢[½W®U~‘Éq}ZÐ>sc ±Ì}µóÐøqæ} âÌSb!3AÀð>s˜Ið„ñìy³©V&&zUIäÕ<ûØ ò9ÌOlÞŒa3Ï8›¯–ÀÚ°¶¾ql)±[Îbå6d°ÝÔ­Ÿ­q¹÷ÒM·µM›N•ã•wž¯ÚzÑ5íÇaÆ8GŸŽy’±p|µœÐJq8} âpRb-)¾Äì6p^5K»Ì¸Y´rf|ëR1œNtagŸr$¸ ZÜž €Ð -.)Öc‚ãàˆw-ÖF.×µæ÷ãjéŽß\µuÕ©d ÿ^0æ)Æ‚ñÕ`B ÅÁô5ˆƒI‰u`Šä€ 5\ÞìTÒî…Ÿ({Ñ6r·èAÿ|¹PKó¨÷Ÿ§&n§0ôÃÅåj%hf‹ÃꉳJÈ´A$¡rKãB&†¼élôø`Œ/¦¢—[?¦jµf]£lb•Á²…3EFñ©;EýôcYºZ –]icÙg™iW}„ÐeÓÌú: õZ2U_Z–ãóζXÃŒåLŽØÚ3zœ4yzWÈ¡N‰uã€säYÛÅßÐÿ]c#Ky¨e¡|k½3«AÊð¼Æ³v‹ÖWK  mGÛ× Ž6%Ö¡…‚=Zç“«œ Õ!%óåæa]oK=KÙ3qûJÞ‘+‰fµ°+‚ùé4;– ¯– š’ÂÁ¾O¤By:ŠEÄŸJ…ÚBJ7dŽ ½r”]Ê£fsÇœÙÓgfírrkQ%Lõí·òøD}«¿\ªLÝF%ñV»Î9~{ˆ­Q»¾Í:’ ”?"?š|Ôƒ5…Ø1• ¥h~4O¦Fuœ$qI±É:äR£_O-í Jk¥‘ƒ2¨”{âÝ¡¯AÔ­&ÅZ·Š ˜ÍØ¡ ]úíVDZ‡3¦ˆbœŠ¡$&ǹîï¤+5óè£\Ô¢Ç|IS¥5ÀX¦¾Z‚ihÜ8Ó¾q¦)±Ž)aãÒ3uSe½xl÷¶1$P( ´““£Xuª3ibzsóJ@J¡?ó°cùùj ~¡!iìlÓ€q~)±Ž& dÌóÆßüÞd?eÄÚG÷}³1÷õ¦òR|ã~Q 9ûìcqúj œ¡]iì€Õ€qœ)±'#8‰ÁùbÝÈ#ÕÚ ÆºëVÒë.åúç¶ñdí0­¯–@Ú8Ž¶¯AmJ¬C›— °™D‰–ZO»·Yqã6‘U†a+ó‚œ`c±€}µàÐÒqÀ} â€Sb-`$ÄCâù6ŸÐª¸H¿ Ôî1w:j¿: -> ¾Æ#ñúZqº¡™iìlN_|”mJ¦CËä‹]г-›eß®þW©#Z´<¤Æc™új ¨¡ãTûı¦Ä:®E r{ÐKreC\;½ ÝÆK%åç3^%ÆÂõÕpC+Çáö5ˆÃM‰upÅ'á\~÷ç•õÂÌ&ŒcK˳;Ìcí1±¯–@Ú:Ž¸¯AqJ¬CŒ¹ƒŒD¦PuˆQžU:SÿA‘mZÄ%x«í²îõHN¨yú±@}µÐвq } >åU”‹M¿©cÊH½ä{:%39Ù¶y¼]×»{™›Í³&õBŽsÌû8)¥ZÔÆŠeó }æ—q`¹¿G2˜<·…”ÎX'ÏçA~ܾȽ¸¯Õ›ÜëÕN½e8œòD‘òN*xТ¶iì(SÐÒ_Lyê2˜ò†E° ‚]Êû¥êýÎýŒÔæ ÞHÒùn¹|øç¾tcm7ÒKÕâ^jK¼“OïNÙi')ÖuÂã®;Øc—úÍ Ù6ö܇~ W¬àá?½±ÓXô¾Z}È Ž¾¯A}J¬C € ±èí›9.Þp‡~vj_ }éÎZll'ðÕ ¤Ac¾4ˆw‚”X× Ä,\rj;1@øZ­MŠö^-~n¡t2H‘s©>:ò/™`çŠÝØh,v_-=´bØûÄ/VÑÒP¤ þcû×þúŸèqñ†|/…E ŠJÑ¿ÈËÍXíÚ`¿S‹@š2l ÿ37Žmendstream -endobj -3727 0 obj << -/Type /Page -/Contents 3728 0 R -/Resources 3726 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3770 0 R -/Annots [ 3730 0 R 3731 0 R 3732 0 R 3733 0 R 3734 0 R 3735 0 R 3736 0 R 3737 0 R 3738 0 R 3739 0 R 3740 0 R 3741 0 R 3742 0 R 3743 0 R 3744 0 R 3745 0 R 3746 0 R 3747 0 R 3748 0 R 3749 0 R 3750 0 R 3751 0 R 3752 0 R 3753 0 R 3754 0 R 3755 0 R 3756 0 R 3757 0 R 3758 0 R 3759 0 R 3760 0 R 3761 0 R 3762 0 R 3763 0 R 3764 0 R 3765 0 R 3766 0 R 3767 0 R 3768 0 R 3769 0 R ] +/A << /S /GoTo /D (section.25.2) >> >> endobj -3730 0 obj << +3804 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 754.651 512.306 764.219] +/Rect [521.223 96.02 539.579 105.043] /Subtype /Link -/A << /S /GoTo /D (chapter.28) >> +/A << /S /GoTo /D (subsection.25.2.1) >> >> endobj -3731 0 obj << +3805 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] +/Rect [521.223 82.471 539.579 91.494] /Subtype /Link -/A << /S /GoTo /D (section.28.1) >> +/A << /S /GoTo /D (subsubsection.25.2.1.1) >> >> endobj -3732 0 obj << +3806 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 727.553 512.306 736.575] +/Rect [521.223 68.922 539.579 77.945] /Subtype /Link -/A << /S /GoTo /D (section.28.2) >> +/A << /S /GoTo /D (subsection.25.2.2) >> >> endobj -3733 0 obj << +3807 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 703.094 512.306 712.663] +/Rect [521.223 55.373 539.579 64.396] /Subtype /Link -/A << /S /GoTo /D (chapter.29) >> +/A << /S /GoTo /D (subsubsection.25.2.2.1) >> >> endobj -3734 0 obj << +3756 0 obj << +/D [3754 0 R /XYZ 85.039 786.531 null] +>> endobj +3753 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3810 0 obj << +/Length 2978 +/Filter /FlateDecode +>> +stream +xÚí\[w9~ϯðÛ:º«µ/{ ;ì„%%a˜sfæÁqŒãCb3¶C–ýõ«»dw« É0CHN±éVIÕõ}*U•Ô!l~È 3=PD‚‘ÁäjfæοöHh1 +MFE›'§{ž +9 i¬§oS?#¡åàôü—áÁr±O›áfê?Öû¿>Ûûá4u\ M³Ýþ¾÷ËoxpnTx¶‡ÓÍàÆ|Ljh=¸Úã‚!ÁYøÿåÞÉÞR_þx©®§¬A¢aíÇ ¢x " ☠”Hr垃 +DÍÏ>š_#ÞèáËý†ý}Ä^.gó…ÿzm­÷Gd87_3ñýøj÷ÑaHK•†ùä³3DU÷“b_£¢³öƒ1¢å[ϵ¾Ú§jxöÞ¨:vJ›_Tð¡}H­í‡À¸ýñ¥÷>[|ÇV‚ë]ÚjÜÕl࿼*áR°Uvû¶fa·TÜéPà40¡qmðàaƒuâ3f`RFp,ë&3—Èð­'”¡3ôóÿ9pw~Å„Ï,ûVãÍÜ\É.3uè¾T¼y°N_ȳyay&iò¶ +äÐÀ rjZs!çòWS ôÕr3µÈòáÁáÓñc‹ìæ"8Òù$`\õ87é‚8sßÎÏÍo´^š[˜¨¿Îðä}áÌbœ…U!8Û*pB'8ÍÕ¥P¾´v¯07öûruî¡91(|\L쵋•›ºóÿuÂioÍ<œ‡n¯!L#N‰SàVëGèg:êX; ­eñ¨í…ÃñJ2õuÝJV^ï^”ª=jÙ§§«Ri{X€FµÁR°Íç6‹È¤X£•Ö•ÌÂ`WK£k³*ØÛö–þÓg½º¾%)¤l7&y§ÖøTÀ¨-Ù(s‰ìÀE? בE`¶JÑáAZØ[Ë·0·¿™e8>qO ±:†¥5;T¨£œ`T1Aw`dÆ£ñÆÁ–bƒªŽ¾îÆ:¿åÊÜ À06R|sAU|ð¾hf1ͨLŠ*šm4¡š£Æ|n£Éšÿž®ÎLn£†.²Ð-× ØÊt= ÉëçÎXN¾>rá!û"—Åä +BȵUƒ&8 ÇMb*xDÎN@ÊMð»¼òÑpXÍ~°¦^¹ig¡#ô.¤5ÁäÖìK‘,P¤@ +¢H[€"ÐÀ1Ä–Œ!… ŠfwTVHcbU™enǾFEgZ6i¦¶´¼™ûÌË.ù‹àPl¸¼ZÚK—>ÑÛ7ùbóÓ1®!{ïöý):¶UèéH [„Èt¤Žo,êÚäÛ‹ÌÃBc/-7þ»ubŽëåå‡2o¿^§*ˆ#{fnÕº~o®sɾ½ "ؤ/ÐY º°·1sè¶ +- 9Sˆ4³Â˜0¿»N×¥‘ÐÂd½¹~Gq»ÜÛ8*Hc$ÍMà‚‡ªTã“Dóå>#¾<³öñ¿ÌðÐ5XÙkï L7óÍ…ÿvb<žÛ8`g„BiÐþ¾5üŒ»}zû75û}µíÊó#Š…w„6M•„ƒa<3áM´; AÃS[—wÍá{˜J,O¥'îê"NÂ$oÖ67¦÷7tˆ6í9… ±ú.ñ‚(ÔV¡î«ÁQ¤i­u$ + Dy2žØ,î÷ª–×®FšB2|ëbÍ+O&ë¤]ZNø}dF0b_fd1€@3Ú*Ì€NÌÆáðÄŒ˜w¯BÎÿ*.Ñשvæôð9Q]Y&x}|øó£ç> +¸þo¬ÅÇrÁ¥¡W#Ä7‹r0H_”³€ral&uå¶ +ÊÐÀ1Vœ ‘1Ž‰Ã£éÆíª=ºµïÿ9–wvî~%R8ûõ¥D‘pè°;8@†ú‰ +T!-H&Ý%Ãjjr4Y.ìF« ÷ö`«¾Àg1ú¦ª{í*ðC'õcš ÀoX@yðÁn}ÉÅ2˜@dh«8‘cÔ–ÉÀwÉ°ˆ[±ë´¾qQ£e Ú:”¡Xs¯l×—Y D S¤Jˆ¶ +! c<È…N„à­xЬóKw#ŃãõVí&¤.c')X< +9Þ„‚ M:h“ æÖbº±ä +›ï\Ù-(üÉàF;ô·«ƒ[Ú˜©ê!êà‚ÇÙÎC*n2Xpc xzÐ=žnž¾0eÐ|¢h[5äû™ÁÑ}AÎbÈ…­™ªŸèP8,1¢Xdé.ÈÏíü/NNΡôãêñاöß½óŽVê } /€ o«@ œ çI!3ô1´3`€O­Ÿmc®(}ÈórÁ€}Y‘ÅVà0UݨéP`4pb3?V™1Æûçq Ãó¥YåÍzk—Ûë÷†J=P!X­/²@…ˆ +m*@'*„(¨Oj¾9¬qA³ûL‚`¯¾$Èb +, ´UH œB|,Æi×H<5¹E‚5ûR$‹)bªºåÛ¡@hàè'˜¦ˆ )…—~Ÿ¾<–SµÀ-—Ë-j®L‹–cûË´h˜¾ÃŽ!¨'ê…XõÒøê*ÔQN¨«i’A‰ÃOöE›é*Àzréóv›¤û41ìÝ»L>¤íñèuÚ^ž¸Rs%ZÒ; ¹·N_Ä“x¶;„wk|n`Ô„¶ˆÉî˜,ØÃöÔVØÚsåžéꃽ6]…*Mª øs÷ãÅl6ãÙ.³˜hÌî´Á}±Íb¸…™!tÛ*ÀÇv4|l‡q« íÄ6ŽÊÛy½˜OLh‚¾ó飃‹±=Œ³ZOÛ¯­Æc1Å@ŸsÔÔk·Oo³ênxÑtÔFQµa¦;¢41c  åêá¨Í2í‚MûN»,L»/ˆBm¯ + œˆBjâ)]•ŽÚ¼±uðq8ù8Gƒõ{)ã•/oÒ™Ç||òÚ½Ö4ñ©ÙùôæSªï•Á€}Y‘ÅVà@¬h«°8±cDãaY•ŽÙì,µÉa„Uu÷Þ¦m_qO]F°c_rd1€FLUct¨8’ƒ6),#9xJÈÝéùx¥·›c~þvev—r]Ú,ü²–0¦y£š{Á‰h¾žœ(Äêœ(¡8Ñ¡BàÀ‰Š!"'b‘æÙؽnìK¯·cð¸~„‚~¨Ôìð$˜´/O²À“.ˆ'mž@'žd,î+$+żi®ä‰­·mø‘1 ¦ìË,𣀉5Õ>*ü€ŽY>åaÑd~ÄJÞÁËF`÷ |ÀaS»~üm㯜¹X3x˜·î­›jõ–û£±ú2 ‹ (€€ÐVáV¯ïPJ«¾…ãGãk&*u©I1žŒ'n#ÈÒã}8F°¯M|1¹XÌ¿žVËiÜÏ) +Jn÷çW=•úß¼¡`9À€…¸úÄ 7(ž±hR5àØýÑÑè»äK¿IWìÍÛw&)`fà "µÆÜ00j¤ щøÇ2šTx¨Ý‚#Ѧ=IRˆÕYRâФC…[9k¢0Âœî:¶qTÒÞaÿ8Ÿ…#ÏíþÌøl~éŽêÚúíGï¸_8'n÷aª^»Pàsü6¨ïnŸÞ–ÕÓŽE_·yo’H…4¥Ÿ˜ŽÂGÁ†îûžšÁ¾}§f¦fD§¶ +S“ EÅ`dd¸f•¹)Qcæíˆãæ ¿a¹N¶õ¢<7C«ÛáOÖtB ì<œ­¶ß ´sÕ;xó嵬Lhí_–Þ} Óg#Ô ²eh «»Û§·eõ bÑ45]M°™œÑî©mþ±øÇå¾üÏž¦ÙϤ›ê»&ýQ|Àâ,øÏ*}B£Bãÿ#X:žendstream +endobj +3809 0 obj << +/Type /Page +/Contents 3810 0 R +/Resources 3808 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3701 0 R +/Annots [ 3812 0 R 3813 0 R 3814 0 R 3815 0 R 3816 0 R 3817 0 R 3818 0 R 3819 0 R 3820 0 R 3821 0 R 3822 0 R 3823 0 R 3824 0 R 3825 0 R 3826 0 R 3827 0 R 3828 0 R 3829 0 R 3830 0 R 3831 0 R 3832 0 R 3833 0 R 3834 0 R 3835 0 R 3836 0 R 3837 0 R 3838 0 R 3839 0 R 3840 0 R 3841 0 R 3842 0 R 3843 0 R 3844 0 R 3845 0 R 3846 0 R 3847 0 R 3848 0 R 3849 0 R 3850 0 R 3851 0 R 3852 0 R 3853 0 R 3854 0 R ] +>> endobj +3812 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 689.545 512.306 698.568] +/Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (section.29.1) >> +/A << /S /GoTo /D (subsubsection.25.2.2.2) >> >> endobj -3735 0 obj << +3813 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [490.587 651.052 512.306 661.347] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (part.4) >> +/A << /S /GoTo /D (subsection.25.2.3) >> >> endobj -3736 0 obj << +3814 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 626.594 512.306 636.162] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (chapter.30) >> +/A << /S /GoTo /D (subsection.25.2.4) >> >> endobj -3737 0 obj << +3815 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 613.044 512.306 622.067] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (section.30.1) >> +/A << /S /GoTo /D (subsection.25.2.5) >> >> endobj -3738 0 obj << +3816 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 599.495 512.306 608.518] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (section.30.2) >> +/A << /S /GoTo /D (subsubsection.25.2.5.1) >> >> endobj -3739 0 obj << +3817 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 585.946 512.306 594.969] +/Rect [521.223 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (section.30.3) >> +/A << /S /GoTo /D (subsubsection.25.2.5.2) >> >> endobj -3740 0 obj << +3818 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 561.488 512.306 571.056] +/Rect [521.223 673.356 539.579 682.379] /Subtype /Link -/A << /S /GoTo /D (chapter.31) >> +/A << /S /GoTo /D (subsubsection.25.2.5.3) >> >> endobj -3741 0 obj << +3819 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 547.938 512.306 556.961] +/Rect [521.223 659.807 539.579 668.829] /Subtype /Link -/A << /S /GoTo /D (section.31.1) >> +/A << /S /GoTo /D (subsubsection.25.2.5.4) >> >> endobj -3742 0 obj << +3820 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 534.389 512.306 543.412] +/Rect [521.223 646.257 539.579 655.28] /Subtype /Link -/A << /S /GoTo /D (subsection.31.1.1) >> +/A << /S /GoTo /D (section.25.3) >> >> endobj -3743 0 obj << +3821 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 520.84 512.306 529.863] +/Rect [521.223 632.708 539.579 641.731] /Subtype /Link -/A << /S /GoTo /D (subsubsection.31.1.1.1) >> +/A << /S /GoTo /D (subsection.25.3.1) >> >> endobj -3744 0 obj << +3822 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 507.291 512.306 516.314] +/Rect [521.223 619.159 539.579 628.182] /Subtype /Link -/A << /S /GoTo /D (subsubsection.31.1.1.2) >> +/A << /S /GoTo /D (subsection.25.3.2) >> >> endobj -3745 0 obj << +3823 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 493.742 512.306 502.764] +/Rect [519.586 594.701 539.579 604.269] /Subtype /Link -/A << /S /GoTo /D (subsubsection.31.1.1.3) >> +/A << /S /GoTo /D (chapter.26) >> >> endobj -3746 0 obj << +3824 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 480.192 512.306 489.215] +/Rect [521.223 581.151 539.579 590.174] /Subtype /Link -/A << /S /GoTo /D (subsubsection.31.1.1.4) >> +/A << /S /GoTo /D (section.26.1) >> >> endobj -3747 0 obj << +3825 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 466.643 512.306 475.666] +/Rect [521.223 567.602 539.579 576.625] /Subtype /Link -/A << /S /GoTo /D (subsubsection.31.1.1.5) >> +/A << /S /GoTo /D (section.26.2) >> >> endobj -3748 0 obj << +3826 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 453.094 512.306 462.117] +/Rect [521.223 554.053 539.579 563.076] /Subtype /Link -/A << /S /GoTo /D (subsection.31.1.2) >> +/A << /S /GoTo /D (section.26.3) >> >> endobj -3749 0 obj << +3827 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 439.545 512.306 448.568] +/Rect [521.223 540.504 539.579 549.527] /Subtype /Link -/A << /S /GoTo /D (section.31.2) >> +/A << /S /GoTo /D (subsection.26.3.1) >> >> endobj -3750 0 obj << +3828 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 425.996 512.306 435.018] +/Rect [521.223 526.955 539.579 535.978] /Subtype /Link -/A << /S /GoTo /D (subsection.31.2.1) >> +/A << /S /GoTo /D (subsection.26.3.2) >> >> endobj -3751 0 obj << +3829 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 412.446 512.306 421.469] +/Rect [521.223 513.406 539.579 522.428] /Subtype /Link -/A << /S /GoTo /D (subsection.31.2.2) >> +/A << /S /GoTo /D (subsection.26.3.3) >> >> endobj -3752 0 obj << +3830 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 387.988 512.306 397.556] +/Rect [521.223 499.856 539.579 508.879] /Subtype /Link -/A << /S /GoTo /D (chapter.32) >> +/A << /S /GoTo /D (subsection.26.3.4) >> >> endobj -3753 0 obj << +3831 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 374.439 512.306 383.462] +/Rect [521.223 486.307 539.579 495.33] /Subtype /Link -/A << /S /GoTo /D (section.32.1) >> +/A << /S /GoTo /D (section.26.4) >> >> endobj -3754 0 obj << +3832 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 360.89 512.306 369.913] +/Rect [521.223 472.758 539.579 481.781] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.1) >> +/A << /S /GoTo /D (subsection.26.4.1) >> >> endobj -3755 0 obj << +3833 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 347.341 512.306 356.363] +/Rect [521.223 459.209 539.579 468.232] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.2) >> +/A << /S /GoTo /D (subsection.26.4.2) >> >> endobj -3756 0 obj << +3834 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 333.791 512.306 342.814] +/Rect [521.223 445.66 539.579 454.682] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.3) >> +/A << /S /GoTo /D (subsection.26.4.3) >> >> endobj -3757 0 obj << +3835 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 320.242 512.306 329.265] +/Rect [521.223 432.11 539.579 441.133] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.4) >> +/A << /S /GoTo /D (subsection.26.4.4) >> >> endobj -3758 0 obj << +3836 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 306.693 512.306 315.716] +/Rect [521.223 418.561 539.579 427.584] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.5) >> +/A << /S /GoTo /D (subsection.26.4.5) >> >> endobj -3759 0 obj << +3837 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 293.144 512.306 302.167] +/Rect [521.223 405.012 539.579 414.035] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.6) >> +/A << /S /GoTo /D (section.26.5) >> >> endobj -3760 0 obj << +3838 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 279.595 512.306 288.617] +/Rect [521.223 391.463 539.579 400.486] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.7) >> +/A << /S /GoTo /D (subsection.26.5.1) >> >> endobj -3761 0 obj << +3839 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 266.045 512.306 275.068] +/Rect [521.223 377.914 539.579 386.936] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.8) >> +/A << /S /GoTo /D (subsection.26.5.2) >> >> endobj -3762 0 obj << +3840 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 252.496 512.306 261.519] +/Rect [521.223 364.364 539.579 373.387] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.9) >> +/A << /S /GoTo /D (subsection.26.5.3) >> >> endobj -3763 0 obj << +3841 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 238.947 512.306 247.97] +/Rect [519.586 339.906 539.579 349.474] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.10) >> +/A << /S /GoTo /D (chapter.27) >> >> endobj -3764 0 obj << +3842 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [490.587 200.454 512.306 210.749] +/Rect [521.223 326.357 539.579 335.38] /Subtype /Link -/A << /S /GoTo /D (part.5) >> +/A << /S /GoTo /D (section.27.1) >> >> endobj -3765 0 obj << +3843 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 175.995 512.306 185.564] +/Rect [521.223 312.808 539.579 321.83] /Subtype /Link -/A << /S /GoTo /D (chapter.33) >> +/A << /S /GoTo /D (section.27.2) >> >> endobj -3766 0 obj << +3844 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 162.446 512.306 171.469] +/Rect [521.223 299.258 539.579 308.281] /Subtype /Link -/A << /S /GoTo /D (section.33.1) >> +/A << /S /GoTo /D (section.27.3) >> >> endobj -3767 0 obj << +3845 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 148.897 512.306 157.92] +/Rect [521.223 285.709 539.579 294.732] /Subtype /Link -/A << /S /GoTo /D (section.33.2) >> +/A << /S /GoTo /D (section.27.4) >> >> endobj -3768 0 obj << +3846 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 135.348 512.306 144.371] +/Rect [521.223 272.16 539.579 281.183] /Subtype /Link -/A << /S /GoTo /D (section.33.3) >> +/A << /S /GoTo /D (section.27.5) >> >> endobj -3769 0 obj << +3847 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 121.799 512.306 130.822] +/Rect [521.223 258.611 539.579 267.634] /Subtype /Link -/A << /S /GoTo /D (section.33.4) >> ->> endobj -3729 0 obj << -/D [3727 0 R /XYZ 85.039 786.531 null] ->> endobj -3726 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3773 0 obj << -/Length 3090 -/Filter /FlateDecode ->> -stream -xÚíœ[sÛ¶€ßý+ôêÁ(q#‰óÒq’6q'Isb'íLÛZ¦mM,É¡è\þ}±¸S`3i]+ÉdQ–Xî· x’ËxRq”S1)«qŠ'³Å^>9—¿<Ùæľ)²”yx¼÷ÃÏ›à‰\LŽÏÜuDŽ¸(&ǧdVË)©²®Ñëé_Ç¿ìýtì.T)…˾Ûûã¯|r*Uøe/GTT“ò8GXˆÉbqŠ8£æûåÞÑÞÿݵôol¢¥¶ÝË…ÔµœìÓUÛZ“ -e!o•sT°ÒÝ*Ƀ[Ř ŠÉÄ‚{¥ M÷Ë–õå§õ|Š³åùtŸeV/OõÁzu)O¿ŸÛÖò[½8©õ·«)ÅY;ÝÇÙêÊ5‹½˜ ²ÞI ›þ¥=ŸèƒWáíêÂé;Ù¸¢º‘‚nÖË1Þ¨wh\R RÊ‚0¹Á‹€)œB˜‡¦5JFP.AÓbi\ÂXöx^Ÿ/¥qVk0TfžÁ‘üJ)˺•,Vf«Kù½U&¥˜ðÁó|ø‘úíEþEñm¿ œ!Á¼¥&x…–ÚĆ6¯}ƒ_ 5À7EÓÕ:øò“3aáÿp¹îêËK׶¤U¼hº©$þ:˜UûVŸ}²œw«V<ÐçdW¤>kóùâXþ6­¨’TN$}ªV^e‹ËKh1Sz.³üªû`OžÁ6"]\@7Bþ'Ú#Aɲ,οoü—œYúÃXGÖ" '–gopà~­qçUå7Ljqë·Ôøíëu®r&çú:*š½~õLzŽüÞ0¾ÃKi,f'• ˜¿`1؃êã¼uZäEUÊSØ2g†ù“¦ëæ0Rë‘éFtðÚ¯´œµ«…>ê.}°€"õ -é0Až»œ¯;ÏÊûÖšb$Ù@,Ž¶gæ(Û-Dá&«utKÙŒ9±t¹¡ûÔ6èNçr(R'Væ˜öÀ²l!¡ºËC-ß©þÙÚc,b/–@Úºà1ÄC ˆiEPA™ FeƒäU:Ò/˜@•`éHßRºqé¿j C0{çÂú‡×ç±È=¨ë‘{R³+j£1£ù+}Iä.ƒT–ô†&C Dm/Ì]ä~¨ç€­Šžöåáéµ ÞuÀG*è*ïÛØv‡=¨±ÝØæåÅÍ+ä÷”¡ñ4U­sBP)œ;7>.›¶6Ñ(Ϥ0L¾aøÆRcá{±üBþPƒ8üTµ~.a……oâÇÍɵ.›÷Ð540i'â[vc­±àÅ’ˆ;ÀPƒ¸¤ªµÀG…(­°þ`дÐðu/À²¦UƒC nP”ß k¬‘ü±8ÿˆ¢ŒðߢA”²ZÇ_Fb˜U–¿Ÿþ®žAZä"œìØ`ºÖ>q N² 'SWò°ÕQĬY›4LÙó™ mL3–¶KÐͧ=Ô N;U­£]Tˆ ai†öK ]w3ø¸^UYÜïF{‡^`L6Ö ¼X Bq/j0œP•%ÂL¬‹L#0dé©ÔŒæç¼7iÁHpN§l!ÐìÍ!XŒóìà -Z2Ì©ò¬5Ù-Ȇþ±Ù2›ÂˆWlÔ•4š.VmóšÚhUÌhþR© %[Ũœž–²€lSô†…(žßb!ÊÒJëééS9/ÍUŽBvŒª[•Ÿ³ÕB矴m/!;QÙœ8xþð 2o ”¸Å¼5©òƵÆ"fæüYqâù-Vœ˜×:ܼõ`¦æ¨n˜ñçH-ÜÁØuGúäzuÝÚ­IúÌÌLwêμŸ×z|{ôFÚœåäžç{¬QFvOX¼{ê<æ[4ˆRÉj1§HÆV‹KÀHC#Hf(`=Hˆâ+]v±6‹Ù‹%0÷ìÅ<Ô Ž9U­Ã\ÈêE€™̪åAœ/k}ç®aòê+͹X „ˆÅ¡÷¬…¾Eƒ(ôdµ6Ú¥•üÌ™‡n'5V U‘d{¶tÏlZ@úE!w «—h´«<ž·v7ˬ[µŸÌ¯¯®ô^·¶“C7çÿ$1s{c‰y±±Ðt%Žj'–ªÖ†GÒ9æ¼G̵›[í$Îøï 9îY˜ÁPëÄúÛ)/²ú<iÏÔ~Fyð¸9™ÃVÈ¢7ª~scÉx±™ÐDq2C âdRÕ:2¼@E^l!wEæ•ÁÙÓ6 öe€ÌÝŒäÅ€BKÅ 5ˆJUëF8FQÎ]¶Ó.*AGU·]l„[›ú(CDoÍ— Òÿ¹¢»9¶ÛŒÅíŸC»—$†{¨AwªZ7¶xà¶cÛ6àgjip¡¿¨FÚt§h¶ZžIÕåNeåìeéÅ,C£ÆY5ˆ³LUëXbŽ¯ÔàËöÇ’²”¾Ó ¶ÖM/@¾œêͱyÖvõ‰ÞÓÞÁ×O‘UÆ ¦[¬2&õÚ¸¢V+¶k<¸Ò—¬2’’£ê†É9)¤Ås›ðq‹ŒO_¾þ]z;Ñî®9YslNX¼9õQD}c¨A´MVë<€ç¨r)?—P=zô«y2ÁùG0 ÿÎßk,/–àßå?Ô Î?U­ã/¡S—ô[b_þ ü{Ð÷c®±àÅÐCõ€¡qHUë<€ÈX˜Û„“KÐnÎûe_ðl®¶$\´™—ƒokõj·¨v*ÈÿE%vqç5ÆX¾^,Á·gèØE[4ˆóMUëøÊSÄî +ýžWÕÀ1Þ¥†z‡íÜm¬x±„ô€Äö¾oÑ î©jí\ 9Iâ…÷—·hÞ]ÛÔ Þs¤¾ÍÃ0¯ÔÂjmSîÁQ8#ènµnk‚‘T±8Õ¾ycT·h¥š¬Ö¶n\Q„]ÎÓÍ‚Ô»=êv.缜Óï­»ïÆhcýÀ‹%ü $êC â~ªÖµîB î’¡¨p­û™y0ö[·3b¾¸Ò å®ó[‹~û¿¡l‡pk‰±p½XnÏÊQ¸C âpSÕ:¸¼@y^y¸6MùDd";™»Slâ+ì ))` ìð®Pk…±`½XlÏÂQ°C ¾,™…)Fœ§sY¦ŒÒ¬Ò©¬#ÿš&÷6§UwÑ´úðÑ¡ÿó‘Ùb¯Ö›e{Üëp‹,WJáþõ´%cOyøëDS\y2»µ¡Èö±WÖl6³õ¼žéIL·Z›]Ò@î…`²ü¦½åW>þáñ­ßÔ‚¬±ãÌñí²ÿѪך¶lmÎêWØFÌ.[íõÁ¶/ÊoøI~k²±Ô½X‚|ˆ#N¨AÜRÕÚAQÀâÀ<þe(¼ÔK¨wlñÒêÜjùgŽÙ¹Ýç”ïü@ôõ.µûìJŸ€Âҭ٤Ωýò¢iI¦?jÕùN(S7¾Ë,ª+}VíÄP[þ͘l{ü1²'îÞºmìýK%¢ãw¿y©Äû—t™´_«/º0ŒÙ6,É?jŸùüwFºÁUHT‘Ä-'2,Ù_§úæÈp_Ÿl¼¢¶P ñßo³¦endstream -endobj -3772 0 obj << -/Type /Page -/Contents 3773 0 R -/Resources 3771 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3770 0 R -/Annots [ 3775 0 R 3776 0 R 3777 0 R 3778 0 R 3779 0 R 3780 0 R 3781 0 R 3782 0 R 3783 0 R 3784 0 R 3785 0 R 3786 0 R 3787 0 R 3788 0 R 3789 0 R 3790 0 R 3791 0 R 3792 0 R 3793 0 R 3794 0 R 3795 0 R 3796 0 R 3797 0 R 3798 0 R 3799 0 R 3800 0 R 3801 0 R 3802 0 R 3803 0 R 3804 0 R 3805 0 R 3806 0 R 3807 0 R 3808 0 R 3809 0 R 3810 0 R 3811 0 R 3812 0 R 3813 0 R 3814 0 R 3815 0 R 3816 0 R 3817 0 R 3818 0 R ] +/A << /S /GoTo /D (section.27.6) >> >> endobj -3775 0 obj << +3848 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 754.651 512.306 764.219] +/Rect [521.223 245.062 539.579 254.084] /Subtype /Link -/A << /S /GoTo /D (chapter.34) >> +/A << /S /GoTo /D (subsection.27.6.1) >> >> endobj -3776 0 obj << +3849 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] +/Rect [519.586 220.603 539.579 230.172] /Subtype /Link -/A << /S /GoTo /D (section.34.1) >> +/A << /S /GoTo /D (chapter.28) >> >> endobj -3777 0 obj << +3850 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] +/Rect [521.223 207.054 539.579 216.077] /Subtype /Link -/A << /S /GoTo /D (section.34.2) >> +/A << /S /GoTo /D (section.28.1) >> >> endobj -3778 0 obj << +3851 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 700.454 512.306 709.477] +/Rect [521.223 193.505 539.579 202.528] /Subtype /Link -/A << /S /GoTo /D (section.34.3) >> +/A << /S /GoTo /D (section.28.2) >> >> endobj -3779 0 obj << +3852 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 686.905 512.306 695.928] +/Rect [519.586 169.047 539.579 178.615] /Subtype /Link -/A << /S /GoTo /D (section.34.4) >> +/A << /S /GoTo /D (chapter.29) >> >> endobj -3780 0 obj << +3853 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 673.356 512.306 682.379] +/Rect [521.223 155.497 539.579 164.52] /Subtype /Link -/A << /S /GoTo /D (section.34.5) >> +/A << /S /GoTo /D (section.29.1) >> >> endobj -3781 0 obj << +3854 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 648.897 512.306 658.466] +/Rect [517.86 117.004 539.579 127.299] /Subtype /Link -/A << /S /GoTo /D (chapter.35) >> +/A << /S /GoTo /D (part.4) >> >> endobj -3782 0 obj << +3811 0 obj << +/D [3809 0 R /XYZ 85.039 786.531 null] +>> endobj +3808 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3857 0 obj << +/Length 2989 +/Filter /FlateDecode +>> +stream +xÚí\ËvÛFÝë+¸ìô@ÏΖsìÄ*ñ"É¢hŠQÔ€`œÌ×O¿»I Ë†}<‘¨‹$ÐÕU¨{ûUU$™`õLj0““ª.‘`d²ØœáÉJÝyqF\‹™k2KÚ<¿<ûêQNFËÉå»ÐÄHÈrryýsq¾½›Òºè–öe7ýõòÛ³¯/Cljj˜îö?g?ÿŠ'×Ê„oÏ0b²ž¼Wï1"RN6g\0$8sŸoÏægÿ +}Ù{|b¥†ž‚³ +‘z2cÕ5lB0A3õ¤B ’WáI)xR×F?©ês:“¼øñ~Õ6×ë»ÕtÆʪx×n7ú]Y̧3R4›))®šEØ«ÝÖ¶›7u™!u#|ì&A•Kk6IŒ²·ÚÕľù!yß~†ã>ÍCÔ¼§šÕǪû~užWE褛Ò2˜DDb’w~Å) +CçW¢E Yèû&ÐCŠ -—|R©«v=è©óƒßf«Aþ]ÿ1Ÿ¯ôÒB¯/vËVÏ”>0 ¿”·ÆÂoEè=ì‡jÈsÊÜzÄ'ˆS‡xXúÛ äšUzÈ~!¸­·Æ"¤Ðê2‹{O?= Õ£_Ö•ºD"üÌÁÿZí•hU\¯Ý|4Þ5#¦f‹¥./ÝWdù ¼Ð·¦}}O¯n±¸R«9ä¦1óÉz«ûR¢äÊýUõpàöî‰w"–üÀõuC|À„<ä b¿¶—GLP9ÜñíïÝz«1ln׆éO5æ}˜£õ/`†sâXfD1€)@µÌ2£oÀ Hq˜ JuXS ÌðËÿEÓ5Wš ;3ÞÕ_^•Ò/Äç¼±Œˆb#R`FôM)Œà¢‚GFøíÁ9<Á?7<ñó»>&¨ó€P7žœÓÆ2!ŠLH˜Ð7`¤801Tá„ ,2Ám õN@S×}ÒÿB¼p.Ë‹(ð"…àE߀âÀ Š"ò‚;^Ø]âng7ŽDïùÂÌИ=âoá ©§’k7‹˜yÅí4Ÿí;õáÆE4׋ÆìIÔÞ±~$ˆ;çŒE<Šˆ§Ž—8‹xßqHq@—Hýˆ‹¿g‚±¼p.Ë‹(ð"…àE߀bÏ !¢Š¼(/^]èáûìrJ)OäXðexá]8’‰Xžðäy1`Bž bRÚó¦¨$¸>à)ôÑ‚×R;õtñÞålì`i +ÍtV ‹O +pç›±€G1ðÔïà}À!ÅðR )Ž§ƒ€ïM䇔úÚöÚ;w\0÷—M«8Q7êâÚœ8¦3IéãÙùc,ÈQ 9õµ$Yû& CŠÈ‚ªWy2s ¿¼~­Ã÷ŸèOf q¿¿71ÆmÛ)¡ƒ³á£ÆÎcŽb©£%Í"Ü7!›“§qQÃ9yA+Eæä}c±9ù×ú´¿jmÂ8$“ì|U|w©ïrwL¸Ð·2ôšOöó›‹ó\š>±ócÒôàc÷i]β.}}Nš^PjÇlQaê=í³ôonõ(»»3“ãʯæΞ^ø°}gpð÷çÙ¥w>¢ÏkrÚ¡Zï»±ƒ3Šƒ3Å`Jß`ú…‡Í6ƨ,‡j¿Wçl!Š{ðÝ:&lMb¶~Ð3ì_Àçʱüˆb?R˜~ôMø)öË3¯+Äð!?â¦ûb»i|íΫÆfwÔŸí¾Ó„œÚ6Û{c$ĉXâOËlÆ~À„<Ä âqÅPåCÁb¿Íž/[;îýNZï ]½ud»X·ËE·mÿæÃôéžy,Q 2õ'dßHHq²Äˆbq¤ßJ¿Ú®|Õ|Ñê•ü¾3…T¤:ÑC±÷ÇX£rêk™­³0R@æ%*Ey2w ¿Ñ[²­®µ¸]Z¬_¯Wm££ßëíÝWçíÒ…¾+òX@tÏ;Ä(€˜ú±o"¤8€È"¸:Q8´‘ïö`N‹íÖœv]JcaveÛ½ÍiLݦŒ<®êü0Ü(€›ú·o.¤Øo©9‘Hˆ\Ÿëžw~3}? Éî—wqœNÍY7Tš±l*œv×­Ëå;ùÙ9j,úQ @?@¿o€>¤ØŸ°9.öÑR*ž]8#÷{MW¥ÅìÃιp,/¢À‹YeyÑ7à¤ØÏ +LRÄ…Œ¼ðm{Ic+ïBÜZ]Ü/¾ZÊ0Eé|I,ﱑ4HÄò48@#Oƒò4T5’$² ¬ é7_4ò/M¡¼ž#nmͼ+^Hfs}Û®;XÍ%ÎÖ%caRʉ³e¶2¶¯ÿ³ÞLèF xû6Æ2jÞó·SI‹gSIŠK­žYj˜(÷Í2D´m ŒÉkêÛo§ Ë+{ûÙõÆÌ#ë]ÖÓ…4[ ¦þÞæ"à‰áŸó¸Oý gs‡I_Ù8ƒßÇÖ ®ÍŒëKÁí>ú ~5-„ÁŸ‡ +#óÆÕ³ë#´”ôé.ÖÞ§c‡oÆo‚Äž¾ À, )³4­óáVšDÅ¿6•ìW·‰·SBôÈUëò¥ÝÔ§©çýNñ¥²Só)®ÒÎUcñbþ þ}ü!ÅÂPí« iz„[.ö­¯à >÷àwzYVgõÕ=·Ïç¯t +=¬[ÆbŬ—sœ-@0ÀR°ÆQ_ÿ¨±öÉ—7.È­7áf7ÆYñÏíf™~³M—°KFNu˜;/…>ŠÐ'pœ­L0€R졧u‰*_⨡÷5Ç/n·æk*·¾z¨ëì ×ǯƒ¯¥?±ÂBﱑ4HÄò4HÑh0`Bž â@ƒŠ!"øBäÃ\×<ÖAØ: ½õ+ù&ƒóÛX2D1€ &jëž%C߀ â@!QéÃÆš ¾úØ„c×î§Qü÷T‡8QÚãÀ;x¿%CÈ`‘¡o@Hq /öU‘š ÕÇí Þ®ÿÛ´úÜ(ª'5!8wå@8@q oÀHqà€^øºIÍzˆ]Óíwé×Úõv°ò). ÎacYÅ$`pœý!›@Š Hd²EÇ$øií—‚÷Ç4Õþ*ŠsÜX2)€ ˆ +=ý­X N’ÈFS¢ðD°¿bc“5罹.=ÖH›X®Iø¬–=ž~:°[7…=H°G Ø{ú‚új=§Bk…,ËDõKT«bFÊIrø³ljЧÖÕ÷m´i?!ôs‘÷v»¿º]întÛN×XÛ­¨W‹j’èæZÃf÷i]–-HKú‚ÊÐCMH‰X©Pÿ«€ù ᇙ²¡‰oc³)’Ë“ê +³«Æf=7ËÅo:S¶Þé¥8—àHÔ~L‚´ò¸OëÛlAÒ×'&8Ž­Lp^,ä7^ÚCK,'¹ÖY“6t)"\=¾‰çÿ?§9ӢT~NKpƒHD?˜¨ K¤5°…5f=[|¥Ê³]øbÕÆ×*iš˜hù› A¬CÇ$H‰PAééh Q¯5 ó‰ÿ…§°Õ õl;“eìÉçÛ±d‰b[Ü8ÎV· ˜_øÕæ€Uƒ¥ê?ó?ùé¿:®&®:›®PYñ S›;fó‚”å‹ +L£ÄâÿÞ ªlendstream +endobj +3856 0 obj << +/Type /Page +/Contents 3857 0 R +/Resources 3855 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3701 0 R +/Annots [ 3859 0 R 3860 0 R 3861 0 R 3862 0 R 3863 0 R 3864 0 R 3865 0 R 3866 0 R 3867 0 R 3868 0 R 3869 0 R 3870 0 R 3871 0 R 3872 0 R 3873 0 R 3874 0 R 3875 0 R 3876 0 R 3877 0 R 3878 0 R 3879 0 R 3880 0 R 3881 0 R 3882 0 R 3883 0 R 3884 0 R 3885 0 R 3886 0 R 3887 0 R 3888 0 R 3889 0 R 3890 0 R 3891 0 R 3892 0 R 3893 0 R 3894 0 R 3895 0 R 3896 0 R 3897 0 R 3898 0 R 3899 0 R 3900 0 R 3901 0 R 3902 0 R 3903 0 R ] +>> endobj +3859 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 635.348 512.306 644.371] +/Rect [519.586 754.651 539.579 764.219] /Subtype /Link -/A << /S /GoTo /D (section.35.1) >> +/A << /S /GoTo /D (chapter.30) >> >> endobj -3783 0 obj << +3860 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 621.799 512.306 630.822] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (section.35.2) >> +/A << /S /GoTo /D (section.30.1) >> >> endobj -3784 0 obj << +3861 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 608.25 512.306 617.273] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (section.35.3) >> +/A << /S /GoTo /D (section.30.2) >> >> endobj -3785 0 obj << +3862 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 594.701 512.306 603.724] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (section.35.4) >> +/A << /S /GoTo /D (subsection.30.2.1) >> >> endobj -3786 0 obj << +3863 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 581.151 512.306 590.174] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (section.35.5) >> +/A << /S /GoTo /D (subsection.30.2.2) >> >> endobj -3787 0 obj << +3864 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 567.602 512.306 576.625] +/Rect [521.223 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (section.35.6) >> +/A << /S /GoTo /D (subsection.30.2.3) >> >> endobj -3788 0 obj << +3865 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [490.587 529.109 512.306 539.404] +/Rect [521.223 673.356 539.579 682.379] /Subtype /Link -/A << /S /GoTo /D (part.6) >> +/A << /S /GoTo /D (section.30.3) >> >> endobj -3789 0 obj << +3866 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 504.651 512.306 514.219] +/Rect [521.223 659.807 539.579 668.829] /Subtype /Link -/A << /S /GoTo /D (chapter.36) >> +/A << /S /GoTo /D (subsection.30.3.1) >> >> endobj -3790 0 obj << +3867 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 491.102 512.306 500.124] +/Rect [521.223 646.257 539.579 655.28] /Subtype /Link -/A << /S /GoTo /D (section.36.1) >> +/A << /S /GoTo /D (subsection.30.3.2) >> >> endobj -3791 0 obj << +3868 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 477.552 512.306 486.575] +/Rect [521.223 632.708 539.579 641.731] /Subtype /Link -/A << /S /GoTo /D (subsection.36.1.1) >> +/A << /S /GoTo /D (subsection.30.3.3) >> >> endobj -3792 0 obj << +3869 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 464.003 512.306 473.026] +/Rect [521.223 619.159 539.579 628.182] /Subtype /Link -/A << /S /GoTo /D (subsection.36.1.2) >> +/A << /S /GoTo /D (subsection.30.3.4) >> >> endobj -3793 0 obj << +3870 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 450.454 512.306 459.477] +/Rect [521.223 605.61 539.579 614.633] /Subtype /Link -/A << /S /GoTo /D (subsubsection.36.1.2.1) >> +/A << /S /GoTo /D (subsection.30.3.5) >> >> endobj -3794 0 obj << +3871 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 436.905 512.306 445.928] +/Rect [521.223 592.061 539.579 601.083] /Subtype /Link -/A << /S /GoTo /D (subsubsection.36.1.2.2) >> +/A << /S /GoTo /D (subsection.30.3.6) >> >> endobj -3795 0 obj << +3872 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 423.356 512.306 432.378] +/Rect [521.223 578.511 539.579 587.534] /Subtype /Link -/A << /S /GoTo /D (section.36.2) >> +/A << /S /GoTo /D (subsubsection.30.3.6.1) >> >> endobj -3796 0 obj << +3873 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 409.806 512.306 418.829] +/Rect [521.223 564.962 539.579 573.985] /Subtype /Link -/A << /S /GoTo /D (section.36.3) >> +/A << /S /GoTo /D (subsubsection.30.3.6.2) >> >> endobj -3797 0 obj << +3874 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 396.257 512.306 405.28] +/Rect [521.223 551.413 539.579 560.436] /Subtype /Link -/A << /S /GoTo /D (section.36.4) >> +/A << /S /GoTo /D (subsubsection.30.3.6.3) >> >> endobj -3798 0 obj << +3875 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 382.708 512.306 391.731] +/Rect [519.586 526.955 539.579 536.523] /Subtype /Link -/A << /S /GoTo /D (subsection.36.4.1) >> +/A << /S /GoTo /D (chapter.31) >> >> endobj -3799 0 obj << +3876 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 369.159 512.306 378.182] +/Rect [521.223 513.406 539.579 522.428] /Subtype /Link -/A << /S /GoTo /D (subsubsection.36.4.1.1) >> +/A << /S /GoTo /D (section.31.1) >> >> endobj -3800 0 obj << +3877 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 355.61 512.306 364.632] +/Rect [521.223 499.856 539.579 508.879] /Subtype /Link -/A << /S /GoTo /D (subsubsection.36.4.1.2) >> +/A << /S /GoTo /D (subsection.31.1.1) >> >> endobj -3801 0 obj << +3878 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 342.06 512.306 351.083] +/Rect [521.223 486.307 539.579 495.33] /Subtype /Link -/A << /S /GoTo /D (section.36.5) >> +/A << /S /GoTo /D (subsubsection.31.1.1.1) >> >> endobj -3802 0 obj << +3879 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 328.511 512.306 337.534] +/Rect [521.223 472.758 539.579 481.781] /Subtype /Link -/A << /S /GoTo /D (subsection.36.5.1) >> +/A << /S /GoTo /D (subsubsection.31.1.1.2) >> >> endobj -3803 0 obj << +3880 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 314.962 512.306 323.985] +/Rect [521.223 459.209 539.579 468.232] /Subtype /Link -/A << /S /GoTo /D (subsection.36.5.2) >> +/A << /S /GoTo /D (subsubsection.31.1.1.3) >> >> endobj -3804 0 obj << +3881 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 301.413 512.306 310.436] +/Rect [521.223 445.66 539.579 454.682] /Subtype /Link -/A << /S /GoTo /D (section.36.6) >> +/A << /S /GoTo /D (subsubsection.31.1.1.4) >> >> endobj -3805 0 obj << +3882 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 276.955 512.306 286.523] +/Rect [521.223 432.11 539.579 441.133] /Subtype /Link -/A << /S /GoTo /D (chapter.37) >> +/A << /S /GoTo /D (subsubsection.31.1.1.5) >> >> endobj -3806 0 obj << +3883 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 263.405 512.306 272.428] +/Rect [521.223 418.561 539.579 427.584] /Subtype /Link -/A << /S /GoTo /D (section.37.1) >> +/A << /S /GoTo /D (subsection.31.1.2) >> >> endobj -3807 0 obj << +3884 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 249.856 512.306 258.879] +/Rect [521.223 405.012 539.579 414.035] /Subtype /Link -/A << /S /GoTo /D (section.37.2) >> +/A << /S /GoTo /D (section.31.2) >> >> endobj -3808 0 obj << +3885 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 236.307 512.306 245.33] +/Rect [521.223 391.463 539.579 400.486] /Subtype /Link -/A << /S /GoTo /D (section.37.3) >> +/A << /S /GoTo /D (subsection.31.2.1) >> >> endobj -3809 0 obj << +3886 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 222.758 512.306 231.781] +/Rect [521.223 377.914 539.579 386.936] /Subtype /Link -/A << /S /GoTo /D (section.37.4) >> +/A << /S /GoTo /D (subsection.31.2.2) >> >> endobj -3810 0 obj << +3887 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 209.209 512.306 218.231] +/Rect [519.586 353.455 539.579 363.024] /Subtype /Link -/A << /S /GoTo /D (section.37.5) >> +/A << /S /GoTo /D (chapter.32) >> >> endobj -3811 0 obj << +3888 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 195.659 512.306 204.682] +/Rect [521.223 339.906 539.579 348.929] /Subtype /Link -/A << /S /GoTo /D (subsection.37.5.1) >> +/A << /S /GoTo /D (section.32.1) >> >> endobj -3812 0 obj << +3889 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 182.11 512.306 191.133] +/Rect [521.223 326.357 539.579 335.38] /Subtype /Link -/A << /S /GoTo /D (section.37.6) >> +/A << /S /GoTo /D (subsection.32.1.1) >> >> endobj -3813 0 obj << +3890 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 168.561 512.306 177.584] +/Rect [521.223 312.808 539.579 321.83] /Subtype /Link -/A << /S /GoTo /D (subsection.37.6.1) >> +/A << /S /GoTo /D (subsection.32.1.2) >> >> endobj -3814 0 obj << +3891 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 155.012 512.306 164.035] +/Rect [521.223 299.258 539.579 308.281] /Subtype /Link -/A << /S /GoTo /D (subsection.37.6.2) >> +/A << /S /GoTo /D (subsection.32.1.3) >> >> endobj -3815 0 obj << +3892 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 130.553 512.306 140.122] +/Rect [521.223 285.709 539.579 294.732] /Subtype /Link -/A << /S /GoTo /D (chapter.38) >> +/A << /S /GoTo /D (subsection.32.1.4) >> >> endobj -3816 0 obj << +3893 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 117.004 512.306 126.027] +/Rect [521.223 272.16 539.579 281.183] /Subtype /Link -/A << /S /GoTo /D (section.38.1) >> +/A << /S /GoTo /D (subsection.32.1.5) >> >> endobj -3817 0 obj << +3894 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 103.455 512.306 112.478] +/Rect [521.223 258.611 539.579 267.634] /Subtype /Link -/A << /S /GoTo /D (section.38.2) >> +/A << /S /GoTo /D (subsection.32.1.6) >> >> endobj -3818 0 obj << +3895 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 76.357 512.306 85.379] +/Rect [521.223 245.062 539.579 254.084] /Subtype /Link -/A << /S /GoTo /D (subsection.38.2.1) >> ->> endobj -3774 0 obj << -/D [3772 0 R /XYZ 85.039 786.531 null] ->> endobj -3771 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3821 0 obj << -/Length 2228 -/Filter /FlateDecode ->> -stream -xÚí›[“ÛÄ€ßý+ô†\…'s—æ‰*6BAÙ¥òØ;f?~ÁÃKÛvoïÁ…[+OÊ›=|K>‡/(.¸„Ǿ(‚èçÚ¹ã¦3¢¡ŒñAÑŒ±²íì'EØ‹[ÿDÕl¦´*¯õÕÓ™’U õë®Ttwö#÷Ê? ~H\A½¹,*N>‡¿[öâM^j‰ â´lU}j‚ àhr΂a ÚWójCÒ: 4qÈNã1^Î[k/_Z¦K2{{ó¾îV.ô¹ŽËÕïúYxd‹Ü®ÛfnŸÜém÷~¥cry6!µÚ›õʧùI<®.cñôb<±ŸÒx†¤ñäÔøRV ž:4 å¼|»Òë|¹³Þ¹Õ|:{mò| -–]{Ðlà­º,ÇþJþ7Ƶ"°ÞÃi¨ÇZÓ@SªB®a‚xÄ“¸Tûi·°èÖÍ~±‹òêêBß¼Öiðòµ}來fôF7¨ï]Îèdk7¶”ïW7]»kouñò°-¤­âXHA*Ã)r^Õ@}šVF§&ë -‘ž˜ï¤Ÿ/Ö ±CLB®-Ý5¯.;ž{#Ðõ fcPîî4ÆVósm¢áúN¿°Õ,—ü_éë|ÝG¢ŒÄÒ,üš„yÆ‚$ͬڀ³âˆ Úãô}Œ‚40Ýbº…Åðööíý¬Þ5¦-^›&ú/.Ä#¦øzŽE׋eÐÅ>¬T -ÝЂ4ºœÚ€NbTcÖ£ãE³<ôP%ðÐÙ×ޞ㨇s¸“R=òA§¯úXš½X†fìÖ4Í¡iš9µ&¯¼§)N{Â3=_ãZÓùâ¶9hÈ~ðiú¾= OªA#¬ØcBèê;a/–Aû2phAaNm@ÈàG¥Cx Nh%¦»sͤÞoô½™(˜‘«ègó?Œí•ö(U=Èóí¼2t/–{< zhAtN­ŸHŠaÔÊ3³Ï”xö™ª§0µ¡ÿâ„âáæ#Þ7cq÷bܱßÓ¸‡¤qçÔ†¼ÆÁ_›<åµ ^ ºË€>ò8NZSëóZ(†° "“×cìVòÝï«×G¿Öïèihí§¡ÜÈÔÇØ{c$àH, øØÓ)Àg,HΪ €+…®=`™üêÊ~Â|ˆ”ÅJ|í·wÑXê½X†ú‘û“Ô‡ ¨³š"Éxøêì惇>B ­*R‡¡ ”þ%c›/)^^6›ëF7õ$6ƒUwÛNaÝmš­Éx讦Š”‡íj»z”™êôÚ³Žd6Œs¶ž”hÝHRnìK¸†S‰hšß€‚"Eë{òŠ$¼ëˆËª‹6ôƒM·ÚµÛž‚ÈG“˜SÆ=c3Ê eò©w{: Nu§[дÂÀ™VH âISGú²5ã ·úª;{·Î áïW=ÁŸt竱Ø{± ø˜CýЂ4üœÚ€Ÿ@k‹©Çïw_Þ˜Q­Ý¿¢v5~õ¿ÅcÞ_yÀ(p.½X& -bé(ZŽ‚œÚ£Z0~öû}ãö¸ÿجöz¼¤žà;O…ß‹eàÇjš‚?´ ?§ÖÃçu…ðýé»ÖíTÛ= ;ãÕû>T×è—Ò °;&×køvÓ´<,âƒ@æ„ÉråOGÚ%‡n«œ‚?Ôò¸¯ðX†½X†aìÌ4ái†9µ!–ûõY`H,˶ëôé‚>}5‘k{ýbet©úÓH\硱Ð{± ôØûièC îY¯ó«ã¬&(Ú=»8îÞÑ–ql×ÆŸ¿Ò)ziWÇõ#sñüýôbªÏ©˜îÙòÐ5zÐ>üú°š/Ëå½9bµ> >> endobj -3823 0 obj << +3896 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 741.102 512.306 750.125] +/Rect [521.223 231.512 539.579 240.535] /Subtype /Link -/A << /S /GoTo /D (subsection.38.2.2) >> +/A << /S /GoTo /D (subsection.32.1.8) >> >> endobj -3824 0 obj << +3897 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 727.553 512.306 736.575] +/Rect [521.223 217.963 539.579 226.986] /Subtype /Link -/A << /S /GoTo /D (subsection.38.2.3) >> +/A << /S /GoTo /D (subsection.32.1.9) >> >> endobj -3825 0 obj << +3898 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 714.003 512.306 723.026] +/Rect [521.223 204.414 539.579 213.437] /Subtype /Link -/A << /S /GoTo /D (section.38.3) >> +/A << /S /GoTo /D (subsection.32.1.10) >> >> endobj -3826 0 obj << +3899 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 700.454 512.306 709.477] +/Rect [517.86 165.921 539.579 176.216] /Subtype /Link -/A << /S /GoTo /D (subsection.38.3.1) >> +/A << /S /GoTo /D (part.5) >> >> endobj -3827 0 obj << +3900 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 686.905 512.306 695.928] +/Rect [519.586 141.463 539.579 151.031] /Subtype /Link -/A << /S /GoTo /D (subsection.38.3.2) >> +/A << /S /GoTo /D (chapter.33) >> >> endobj -3828 0 obj << +3901 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 673.356 512.306 682.379] +/Rect [521.223 127.913 539.579 136.936] /Subtype /Link -/A << /S /GoTo /D (subsection.38.3.3) >> +/A << /S /GoTo /D (section.33.1) >> >> endobj -3829 0 obj << +3902 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 659.807 512.306 668.829] +/Rect [521.223 114.364 539.579 123.387] /Subtype /Link -/A << /S /GoTo /D (subsection.38.3.4) >> +/A << /S /GoTo /D (section.33.2) >> >> endobj -3830 0 obj << +3903 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 646.257 512.306 655.28] +/Rect [521.223 100.815 539.579 109.838] /Subtype /Link -/A << /S /GoTo /D (subsection.38.3.5) >> +/A << /S /GoTo /D (section.33.3) >> >> endobj -3831 0 obj << +3858 0 obj << +/D [3856 0 R /XYZ 85.039 786.531 null] +>> endobj +3855 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3906 0 obj << +/Length 2999 +/Filter /FlateDecode +>> +stream +xÚíœKsÛ8ÇïþºE:ˆKBy&r1:½ð×yÆžÿ9~²ZNp9îjó±žüuúÛѯ§þÂQÓˆuÙGþ•Îe~;Ê3"ÊÑ'ù=Ï£Åe$c”ØãùÑÉÑüµÌotdjíº JŠ •£)ɳ²¤;‹ e4'òNË8-üâ|ÇÚ2êN Í&SAÇÇËÉ«ù¿¬ùïòr2%¼WËsóe½R?~lÜkyT-Î*st=!hܪk¬ÎT¹zÑ3ÃÒÀ%E]4?µ—#óåMtG®4|GÛ×T·Dî5MÊí¦ûV¶:Lq†ð-8©¢˜û.!uÉIQPœåRQke$íŒ)?mªË¥4Ðj­ŒÕ)SÏÔ7yHw+Y¬¯æò˜‹r,kQ!ÔËóþôÛE¾aõ¯»tœa$¼M{â djM£j}½¶¯}Bý.ô8qeá†ætT`YšŠŠB…p>~ZŸÝH<.—þ™$dü©é®Ì·“j¡<”~ +åaÓ­kUZ=“iÉÅÃÃÝ5·æIÕ;¿0úøærpí3jkŸµO°kÛ×4fãCf‹®õ5kŸLÈ¢Å-kŸ¬”¢¥3—[û|a–Ó[ÁLåW½Ê13 ¡zJ”÷/>ýþ¡3oâCU~cé šú]öË`Þ.K á˜Á~t^Öme'oz˜¾ìP„@ÙkÓTPB5”H/”~P †=(Lº"êAqÓ¸°Z®æyýQù?“ƒ2ÌìÃŒ5o*3¡ÀL$ÄL¿ 3PÞŠ2戡›ÃQÝ*¯RR´›©[=Dµ +^<ÐÑ¢ ›ÊŠ«â£¨äd»q€’á&=#¸ÈCŽf)9ÖtÕL­¯^ÅŸ‹*ãr37 +¥eM^˯­™íÌêµÝé-6¨:(¬S‰Õ&"(*©èwàjØ“d‘cG·d¼VdTÝL}\)mË‚ÿØ.à‡$Æ7•˜P &"¦ß…%Ê +ÌFSY‡ +2Rò¬”áæ”Lw%ŽÛäŒE!¥+£úöîEfvúŽ¯í–/Éǵʼ‘îF:Ïu?¢D¥l«EMAf³¥ážm_Ó˜M ™-ºQÌvA<#\±¹%«‰²ý³]º-¢Qnôç22Ïõ’Žt·ÚYËÏÙja–õŒeçµ9­)Ê£ÜCö‰Û¡þn]QÛçƒ6f»w9Ó‚vJ…”á–9’Z3ñÜíÇ3 û±K j':÷K ˆgfê¤N®W7­ çíòØ̆ùæccSUž¼;‘Èçø`ü˜3_¢‹ª û±X’°I 6ì6¥)Ž6)y”›tëRŽü§OQpÖKEï±-+!¶EÁ†=(ÚåQú’~¢Õ£}¬1˜éØ{½Þ\Q_[·Qe:Â’“ä"'§;ºÓkT Ð=2?¤;JØbvÛáD¨-¶MÝC¾‚Ó<%>ª`É +drTê39SÎÙý—ÙY$Qæ¨Ú°Ì±µ™wtaXf°a/sm’z™ñž2Ï>ª0—êÐqR/÷Ø )^&lˆ‚ »y)¢ QîÞ7ç}aÑã*LæôO›ÈúÔJÍZ;˜ó~Þ×®¿,g¦z¥–IÎí{§ó^Ñ>És¶J Øcû3Öb4@qûögjØÀxÆsîp êï&¥Z +mTöÌ—xIkköÿÈú×òàÙë_].«NÓ a ¸8´Å gºTB5€‡HŠs’wtàjØó@I–³Âñà–Ëßè„—ó…Ø®.ëhy¡ãASði}Ö¨ÌXž:¸»öžS… Õ!#{BBö» 5ì…̱ü[Bâï(ä[ ŸW*‹NÐ不½õT=C5@ÏȬf.îè 'Ô°—qYf¥Ÿ¦¹ýÉå1«¶–×v¦¦ß*sYçöËR¿dÿ\’­Áµ†¹ˆä°è·?LÔª‹qÁ2‚P ÂÅ»¸¸Ð›Ñ s Ÿüº;Ïf«å…z¤8Шݙ(UóP =2?¤z¿ €ìPÃ^wéä éî–aç.£¥kBÔ/ÒpÒYH—ßv±Ëolrse½·œWµžÉ©•ü‚ß­IRuÕ#sS<˜¹´£ _•›ŒeY­ÌîÚùte4 …Ùú|=1‰Éù¸íª3ó¢B§¿ mpF-í³Ã vlûšÆhƒi<ѵ¾f“«Lãß2†b’îE¡Âor>ýöI×ÆViIŸ5lêê_$ÄQ¿ €“…ö´ÈS8gŽ·4zòäßöe²W/$6EIÙƒkÌTBB5€H(ˆ~B †!HðŒ3îñÉÈŒ³rGZœai‰ª Ó‹в£ ô€ {ZJ’¡ÜÓâVV·ÃdéY^6:Áâæ³ ¤ýz{[é?ÐM_è¼ ù¯(ų`Í–ÊB¨°IBñ`®ÛŽ.,@ {¸È˜[e/Bº±vÝ'ðC2cÍ›ÊL¨0I1ÓïÀ Ô° úãYž—ì×nÜ"ÉÌRAž{mêÞÈ­ì¢Ï±ÁYäP³¯œ±R Õ"! ú]€ö^ƒb5 +G€KE?Ñœ¯jÆ3F¼Æ]™±æMe&T˜‰¤ƒ˜éw`jØ{ \fdœÓxi_KQþâ½Oðh×­ûCfýh¹ó*#ô°37­ÉR1ðµ +‚½ö€V=ˆe„Übáïjš)ÆgM”Šãþ6MìSÔÒ P;úø§HܵæJ•ß×äBP2˜äÕoxa¬™À;_ë—ÿ÷§ïþ÷iÃK³r0+YRUБz»’˜?`gÌŠzü?%©vŸendstream +endobj +3905 0 obj << +/Type /Page +/Contents 3906 0 R +/Resources 3904 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3701 0 R +/Annots [ 3908 0 R 3909 0 R 3910 0 R 3911 0 R 3912 0 R 3913 0 R 3914 0 R 3915 0 R 3916 0 R 3917 0 R 3918 0 R 3919 0 R 3920 0 R 3921 0 R 3922 0 R 3923 0 R 3924 0 R 3925 0 R 3926 0 R 3927 0 R 3928 0 R 3929 0 R 3930 0 R 3931 0 R 3932 0 R 3933 0 R 3934 0 R 3935 0 R 3936 0 R 3937 0 R 3938 0 R 3939 0 R 3940 0 R 3941 0 R 3942 0 R 3943 0 R 3944 0 R 3945 0 R 3946 0 R 3947 0 R 3948 0 R 3949 0 R 3950 0 R 3951 0 R ] +>> endobj +3908 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 632.708 512.306 641.731] +/Rect [519.586 754.651 539.579 764.219] /Subtype /Link -/A << /S /GoTo /D (subsection.38.3.6) >> +/A << /S /GoTo /D (chapter.34) >> >> endobj -3832 0 obj << +3909 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 619.159 512.306 628.182] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (section.38.4) >> +/A << /S /GoTo /D (section.34.1) >> >> endobj -3833 0 obj << +3910 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 605.61 512.306 614.633] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (subsection.38.4.1) >> +/A << /S /GoTo /D (subsection.34.1.1) >> >> endobj -3834 0 obj << +3911 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 592.061 512.306 601.083] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (section.38.5) >> +/A << /S /GoTo /D (subsection.34.1.2) >> >> endobj -3835 0 obj << +3912 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 578.511 512.306 587.534] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (section.38.6) >> +/A << /S /GoTo /D (subsection.34.1.3) >> >> endobj -3836 0 obj << +3913 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 554.053 512.306 563.621] +/Rect [521.223 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (chapter.39) >> +/A << /S /GoTo /D (subsection.34.1.4) >> >> endobj -3837 0 obj << +3914 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 540.504 512.306 549.527] +/Rect [521.223 673.356 539.579 682.379] /Subtype /Link -/A << /S /GoTo /D (section.39.1) >> +/A << /S /GoTo /D (subsubsection.34.1.4.1) >> >> endobj -3838 0 obj << +3915 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 526.955 512.306 535.978] +/Rect [521.223 659.807 539.579 668.829] /Subtype /Link -/A << /S /GoTo /D (section.39.2) >> +/A << /S /GoTo /D (subsubsection.34.1.4.2) >> >> endobj -3839 0 obj << +3916 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 513.406 512.306 522.428] +/Rect [521.223 646.257 539.579 655.28] /Subtype /Link -/A << /S /GoTo /D (section.39.3) >> +/A << /S /GoTo /D (section.34.2) >> >> endobj -3840 0 obj << +3917 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 499.856 512.306 508.879] +/Rect [521.223 632.708 539.579 641.731] /Subtype /Link -/A << /S /GoTo /D (section.39.4) >> +/A << /S /GoTo /D (section.34.3) >> >> endobj -3841 0 obj << +3918 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 486.307 512.306 495.33] +/Rect [521.223 619.159 539.579 628.182] /Subtype /Link -/A << /S /GoTo /D (section.39.5) >> +/A << /S /GoTo /D (section.34.4) >> >> endobj -3842 0 obj << +3919 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 472.758 512.306 481.781] +/Rect [519.586 594.701 539.579 604.269] /Subtype /Link -/A << /S /GoTo /D (section.39.6) >> +/A << /S /GoTo /D (chapter.35) >> >> endobj -3843 0 obj << +3920 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 459.209 512.306 468.232] +/Rect [521.223 581.151 539.579 590.174] /Subtype /Link -/A << /S /GoTo /D (section.39.7) >> +/A << /S /GoTo /D (section.35.1) >> >> endobj -3844 0 obj << +3921 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 445.66 512.306 454.682] +/Rect [521.223 567.602 539.579 576.625] /Subtype /Link -/A << /S /GoTo /D (section.39.8) >> +/A << /S /GoTo /D (section.35.2) >> >> endobj -3845 0 obj << +3922 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 432.11 512.306 441.133] +/Rect [521.223 554.053 539.579 563.076] /Subtype /Link -/A << /S /GoTo /D (section.39.9) >> +/A << /S /GoTo /D (section.35.3) >> >> endobj -3846 0 obj << +3923 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 418.561 512.306 427.584] +/Rect [521.223 540.504 539.579 549.527] /Subtype /Link -/A << /S /GoTo /D (section.39.10) >> +/A << /S /GoTo /D (section.35.4) >> >> endobj -3847 0 obj << +3924 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 405.012 512.306 414.035] +/Rect [521.223 526.955 539.579 535.978] /Subtype /Link -/A << /S /GoTo /D (section.39.11) >> +/A << /S /GoTo /D (section.35.5) >> >> endobj -3848 0 obj << +3925 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 380.554 512.306 390.122] +/Rect [521.223 513.406 539.579 522.428] /Subtype /Link -/A << /S /GoTo /D (chapter.40) >> +/A << /S /GoTo /D (section.35.6) >> >> endobj -3849 0 obj << +3926 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 367.004 512.306 376.027] +/Rect [517.86 474.912 539.579 485.207] /Subtype /Link -/A << /S /GoTo /D (section.40.1) >> +/A << /S /GoTo /D (part.6) >> >> endobj -3850 0 obj << +3927 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [492.314 342.546 512.306 352.114] +/Rect [519.586 450.454 539.579 460.022] /Subtype /Link -/A << /S /GoTo /D (chapter.41) >> +/A << /S /GoTo /D (chapter.36) >> >> endobj -3851 0 obj << +3928 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 328.997 512.306 338.02] +/Rect [521.223 436.905 539.579 445.928] /Subtype /Link -/A << /S /GoTo /D (section.41.1) >> +/A << /S /GoTo /D (section.36.1) >> >> endobj -3852 0 obj << +3929 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 315.448 512.306 324.471] +/Rect [521.223 423.356 539.579 432.378] /Subtype /Link -/A << /S /GoTo /D (section.41.2) >> +/A << /S /GoTo /D (subsection.36.1.1) >> >> endobj -3853 0 obj << +3930 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [493.95 301.899 512.306 310.921] +/Rect [521.223 409.806 539.579 418.829] /Subtype /Link -/A << /S /GoTo /D (section.41.3) >> ->> endobj -3822 0 obj << -/D [3820 0 R /XYZ 85.039 786.531 null] ->> endobj -3819 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3856 0 obj << -/Length 241 -/Filter /FlateDecode ->> -stream -xÚuP±N1 Ýï+<&CLÇN²"•ªL Ùà Z„T®R¹ÿ U‡28ò{ÏïÙ¾=‚,è¹@ÊŠÂÏ׆lZQ%Æö_Ýêg,1¯’'1¡dîœÛ:ÜÜÁ£*C=@È„œHPL‘ ¾<šËdFËÞœgëX“ÙY2hŸêý·:bÊ©«]*¨Í"ÌÄ_âí~²ŽÌþ<»VÍnúhê¹7[‹ÌqœßZ9õÆÔg›úzÉ5aÑ°¶–onPBù‹þ»< F¾ìNä±øÒÓ³WdQX8=}׉¤]¸_ï2èÚó7ö`œendstream -endobj -3855 0 obj << -/Type /Page -/Contents 3856 0 R -/Resources 3854 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3770 0 R ->> endobj -3857 0 obj << -/D [3855 0 R /XYZ 85.039 786.531 null] ->> endobj -6 0 obj << -/D [3855 0 R /XYZ 85.039 547.583 null] ->> endobj -3854 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3860 0 obj << -/Length 3458 -/Filter /FlateDecode ->> -stream -xÚ…ZëoãÈ ÿ¾EXù+z?®Š<6w.6Ù`íb¯è¨l+¶[rGãÍùîŸ/_3’c%‡b‰Ãáp8òGjý3þùgYìza~–f‰‡þÙbûÁ;[ÁÈO|áˆâУžÇftœ®¥ƒ<²Æ8 "7Ê"乞}¸¼ ¼³Às“$<›=ù~à†~p–乧éÙlù/ÇwGã8öœÉÈwj­FcßiFãÐs–û…®šž“ÔÑHKgŠãÅxçÅèß³¿ø4³:ˆ -Fø{ZöxHK?>ó=7÷ò#-a»Iœ–ÿ9Ÿ<ÆA:‡Q9Í_"gJ/KÕê¢^òø˺Ðo€©"*HÎ-êìY3£ý²ìÙ Rp9ydRÑò¯^—´çqÓ1íyOz”jƒ¬È¦1,¤ŠºÝ¡ùœF¡áwØ Ï΋f.ù9¸(iGÓž€¥ ÅõÛ¾Ò½£cýRóÌ07‡ a²=êh"XtŽ‚VüL¦ÕʬG6Öka¬äW“K£,ëüH^5?Ø3*ež–y#¾Ë¸æ¦Ä Ò“¡ømKg Œ¿1£Ñ¼fIÓÑk§Ø.]º¬û¹"›ìQLØÂÉu=·)YéfU‚“(~{©4r5{Í‚±þHûJ7Á‚ùy›»Ç -]2q@W¢?Ì.ÏóðO8 ýÔÞð¯Üóû—2Ês)£ V‡Pȼà¼@‰áÑ7KÒß—%“§4ìså’ÍÑ6~Ù+ô¦f^løU#DÀc@±¯CQLóPè‰$«ÓÀÞvh f¥Ší–cš$Œº8B¤ÄÉ… 4ªZQ¨+6¸E_¥dçfW&r‹ÙJ Ø·´®ü³QB´BY«Ò\£ûFîˆ!ägïfËa²›¹a”ôóF%nžå’Ý(¿E¹sMæ]ÀêÏ+ÕìÁcÞP!Š\?ÏßW¢ãy;}Ť¯0éâÂÂ\Ñ0'+4äÛ!œÁªFxÓùÄŽÈû‚w‰Ï‰ÓLÁ²ÿýw64:ˆZò€*ŸJ¥zñ ‰”½ÃÌ -¹½ùtùÃ7Åq—gk“…€ƒãÇOEgx¸­LภV8<'ϵÊısÓlw{mï6P>QHþŽ$ÕÔÛ’SÛåWšµmèšÇ å%9A‚Œ¡€vSƒµLáK,ššç`jÑ{prø=0SwpÆÀNV¯Œ€8¡²·£ÀìÄ΄PCO\bÚA#¬ªšÕ:0‹ |¥2 -H7× Ÿ¯$om6Íåϼ¨‘úpsÅL¾ëñï^ì=”š# ¥;ttƒ›ïõÐI™ÔŽK\©.të’,¡*a _Ô ‚ÏMm÷“ÓRæÅ>S'éÜ>Ž²]y¾­»ÄGÃ'þÿÊ 1ú?Á´ÒægœÖtëïëxSƒ`NÑ668yRÞ¼œ„á/ßµý†÷”¹‰‰8gÑYºÐÕ\ðŽPžƒ pi>ÝØ”(RC×»@J×)$•!A•Ë²5©zU—Kšùp«Ø$®íMÃ¥À,½ý1›­ñ²ø¡óe„Š’÷!Œðç'ÊûÆ"ßÜH€E»¨$9³ì›ÁÖVd>ל†SçEdÒµ‚‘[l>!hüúxãòø}µPMÛ×Ïs‰°d#\ß®?ÓúÏâ$˜dL ÷€ò®gÛÒ% -’]Íðù†{œc9äÑ áyàìw=C=\»j9Úaý²P-³ìŠ–#-e?Àô /H5Ö¥$rЂŠ‹M;E%co±Ïy)a[ŠÂ˜?©"¸ÃID.¸7†Ã|1Xm˜b÷BŠå÷!Ñ^Ð ‡û{[)ÁY㟛¶—ÀS@)çüô‡û>–¾1ðYPîI¨t—»ž¸zäá’Öö!¢·GïõvðrŒT³‚Jjbê¹j™¥Éë·t3¥ÜíŽbm×Ô¥»3ÂKÐPtaA¢ZDM-‰ŸEuÜ·zÞ(íÐÕY¨ ­AŒÚ=×õÔ909”ïMµU}{Ì3EpÍ´B 3]åÆúu/|Ÿ“7É>¨|S&J[öÍ@ßÏT‚•Þ¼Æf`2çä]ãÇ¥ÙÒmÄ÷Iͱ *¯ÒU)F¿Ã“-ðº!Ût¡ö¤‡ùQ‘Ë»$éå-Øò;À˜*Æq˜pµñmUÌšÖIÅ[`ˆ‚ã V·Ä´ ’¨Ò.ØKc°ëê{‰¨)„Â…¥×KŒ1!µ¦¡¤Ú‘þ–Êp~Ew#ˆU7­(M%ÇÃÄl΃¡Þ2pËâH³ ±ö´¦ÅvNKòk«÷˜û„KˆOå ?ÜOù`ÈãI5¦“…¿ËU9fAm)§oÚ4Šl¿ðDñ¼ò7ÍæXh'+|6áNtv<Çñip¨ U±a!‚µmnätñLw0ÂïÉð"áÛºø.m”¹µ<@Y‚×mM°PÒ¸dÅ%î¢ÿòK¯ºÃÓ<0Ò¹¶ÔÕiE¥ÔÙU#ã[$«u]Šf㘿­+¾ÚC0^“¡ñ£Û²¢6&bpAƒè^)vûÊwzx)üÀ®Å«ƒ„¡UY—r8-"p1ÚÕƱýÚñb‹eFþDlìþ8Öð¬Zv,.èõ¹< ábØÀÚÖ£(€6^ÊZëò`žªúdüí6§Ÿ.”fï¶9{Ÿß4 ç÷€{¸5-~ÃÇï$è:êœK3çJ5ümœ'dKu¡RÓ­;ô¡þÚŽdJªjðFø•kQ-©[MÝúÒOÆ«ƒ(é:³½O¨½Ö²tý<— ÛŠ¼.õ9óJ1ô±7 ¹“Ћ&$PCJznE½*—C ï#¸NøŠðã7=3‹Ü8ŒßwÌŽçm¿ž?qË÷V¯|½ØSö»­l«cA•¦Ô6à§qå7&û0°^Ûï‘ ‰¤·Be›8€‘¢ûË£ÿ›àw`ìÇz—ÿ´P-ìÄÜ9¶ÿ‰W5õÝI˜¢îR/v¦À2-Ow@¼}˜Ê­3WŽ¾óo-` åÃsÛl( W¦©lÛJ—Åò¸„ü6y˜šºn ¥…±…GíÍDÛ±žeè%n'Fn=_/‡œwøΚÿµÍ‘endstream -endobj -3859 0 obj << -/Type /Page -/Contents 3860 0 R -/Resources 3858 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3770 0 R ->> endobj -3861 0 obj << -/D [3859 0 R /XYZ 85.039 786.531 null] ->> endobj -3862 0 obj << -/D [3859 0 R /XYZ 85.039 766.606 null] ->> endobj -10 0 obj << -/D [3859 0 R /XYZ 85.039 766.606 null] ->> endobj -2947 0 obj << -/D [3859 0 R /XYZ 85.039 676.205 null] ->> endobj -14 0 obj << -/D [3859 0 R /XYZ 85.039 562.8 null] ->> endobj -3863 0 obj << -/D [3859 0 R /XYZ 85.039 533.396 null] ->> endobj -18 0 obj << -/D [3859 0 R /XYZ 85.039 192.444 null] ->> endobj -3864 0 obj << -/D [3859 0 R /XYZ 85.039 163.04 null] ->> endobj -3858 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R >> -/ProcSet [ /PDF /Text ] +/A << /S /GoTo /D (subsection.36.1.2) >> >> endobj -3867 0 obj << -/Length 4019 -/Filter /FlateDecode ->> -stream -xÚ¥ÛRÛHö¯pñ²¢*I­kòHØef l0“‡™y¶l+È‘d;?¿çÖ-É–MÕnQ”ûrÔçtŸûév'ü¹“8°•L¢8´åNfë#g²„™¹q* §=˜óéÑÙeèO\ÇNœd2]˜uÇ’p2ÿa]üëãíôóדS¥”åÚ'§Q[W7Ó¯'^l}ùt1½:9u­/'®uƒ@¾5ýÂÀw¯aðg?žü5ýåèóÔÓ#ØU -‰ùqôÇ_Îd„ÿräØ*‰'/Ðvl7I&ë#?Pvà+éGwGÿ6kñœ?á¯Æöî{¡íEÐPŽÇþ(Œëz¶r=8  °C?2äöÈõb;ŒÂ‰ÂúÓq£íý¹Ê‡Mzkí"d]|AŸJì ø®n/ÞŸœz!묮JäÃ+ôǾ›¬%Ÿtõåvû%KJ -ÁF *òcMæøfLpæmP‚ϾÐwx=DùÚ0_×dfÁO5 ò†¡D´±YV-/šŽ¨ÍÜ -Ç«â6Bú¼eëž“•W,¬Þ¶%wIWqb¯%ï4³Rp7^°äh'?.¶¦x[䑲h\PW\Ðù -—ËÅí²iÓ’ô¦F¢}8üPK®°›0/ةȨ-óÄÏšGçÚ -<#lVTOZãH½pQã7¡MÍù5wØÁRû-sï‘GÈÀ¯›Ä -7æ†ÀÎX‘«…a>žt¹<²5Òp¬c»’F -„WKDÄ5{ÈÛwH/°¢å fNÉ!ÁÝ>Éb•^¹W>2±ÚŒâq‰JÉã"OtÒySÉð+I:Šp½·ÈâÍ®Å;GÝ¿á[ãO@tcwÆÚÕÖUÑð -nÛ›sqîG.£àYd‰&›jdòk°¾[sdQT±Ú´L1O­ÈöÍYtjÁÿ÷‡^VbRÆ°g:àã; ¶¶„#ÄKlìßÎ.°r†ñ–V÷6‚“ƒSÇ={!|äÁŒ†ä7F6ñœ£Çp”æø{Ü" -0x‹Ë”ÐÐ)×é?Ô¿)ÿ<œ°Pb›hwØ4àoFr¯í*–<ñ  "®×ò˜qCÕ¦˜óÐJÓ(¢àD X¥[HMçùMwìu+æ‹–­NxÖ7”·´eÚ (k¾f{PÕ`j˜Q4Š„¿ %e,µý•Ä5°àÓÒÂÓ˜½µÀ×¼T‡M~"öߥpØÅw&ŸX[÷%GÏ-iˆlµ¬Õ³€%¯ÖBÜÄà)•9 ¯<Žl­sü¾È»!ôÆnVH -†hÊhs"çhQwwFG‘NBDر`ü)yŒA†g)O ÷€ûfgÝp³ÈiCÃO?ß_ñÀKNlªHW"æ s8ÛÅsY—a—+¢ñîaëTAáÚEÁ!Õ,Ý4½•õƒúY§½¾†›“’?´-ã©.Z•dò½ûªÜ™*¶ãðp`ÖÁìËæ°ì6‰Ê¶‘e=dÚ°~†mÞ_aLæû½ìvÍ&óµ%ƒÁã~)Q™Ò9_1p»ê‘Óÿ!$4ù<³G¶v_Î;HwpÖaÒå[¶Øb¢¡!)WÏßë<gÉ™d³ü‰‚“]â,&×çøˆÕµwîÙîZÐ ÖUV<Ä`„v-î&7V™¸‘†v§ÔÉõoÿ¼/‚ʸAG“®3V«Tà†ö%@Û9ß3d€‹å -PñlTKõ"6B0«j™àÈtÄ‘P€ÏM0ñ¡#a+x&u ÓÀSdY˜cAÂÅ#"¾ ™S¦€r÷Ê u¶Èêš,ôˆzøÕ9¶¯sLƒªE+ÈrÇ7ç—ÇïÆ4‡ööŤyršßˆïsæ±>ËéðL™tøúýxWæÊ4s‡ÑÎÉ{‹°p’ I©æ®6•1$ “Ù”ŒÑ¨œ‘-ˆ£kv|ºiW8OéÔöWä|åØ~v[= ý~K½á¸"ϵƒoÌuõñÝœc±$ qßX!ÁÖ™ôÚÇÛy„G £Ñ ›^Ü0&ì ãx,YfJîRê‹'œW¢þ‘rà -¥þ¥áEÛ± -•ÎaØHl4#I…‹c›ÀáÈ~wÒ Ûö 4¨U>²~¢®õÉrØ2vnøìê%Þæñ /˜òOÍ™Z`j¬›¨]i-Áp5\zàŒÏs¤ ¦ÌÛ ÀN¿47¯©ZîZæûë©QLÂSô½Ö‹‘ôBæF­Îc' -ݵ!Ú¥=û±É¹ŠZdÆGbŸbgëÜhŠ«í˜fˆKCƒˆR5(6Á·úW;ê`US‡÷Ð¥ Óªd4õ­O6œLsuk±qØ&u’ÁXüôT)=ƒƒ‡ëp¡Õw"JÙròÑšB>I˜J‚³$>»þ,U%™Vzå•Ú:%WŽ)¨±ö]gºEñ ‚®jýqÆ3ú ñûF4=HÜ·‚BØ?°ý†½%,p×1žó™ c^@Çù@!К@$€ïŸ©bÀíûO·Üè2Hêº*zÇ‹¡˜Û8¡àSÚ¦æ~dHȳ©óØ„aˆM*ôË:]3u^âwõvhu^â ΋§\S¼éšÈÀKÔPwpÀÖôR™Êj>2\npd¹ÌâB¥><ü -ƒ„]æ€YEÙŒÇ]´í'§¡“Ù¤¡ràoa@ OUlDšp8â2#ÈË! -4¾]ÝÜItïd R0ˆ¬²•é|Ƶ䶋%Øð€º¹CÙî±ùÎÐ‰àˆ¶ ôÒ‰ƒs 6k«ê„H–'ÕÀ¯—¸Öw\Çq¹…¸Ø.Z8ÐüÝ%œQŒ õç¦ËxÙº@ࣻfÇñ8@tŸ²6¥‚Dw%¢º+Åœî©ÄDëî 9@~ì$ -‡= ý!‡z#ä8ˆPBŽ|c!Gß7ï×÷|Û7Àx\‹J®ƒ†“Cœ÷Ça€[ -Yw&é -@éE†v«ç°÷pìÚ¾÷Ö w@NX€Þ:áCõ oã=á¾oêÿ+×T~©C%6¬§b‡\”r,®©¶­NNq“Àw\Å^§ºt‚fCÁ†’ÐF‰Å¤¢ScbÕ¼ËÆ{”÷aã.¥‹¡‡”»×¬‰¹Fþ[Þ´²/>Ô-7’²UÂð%/L–Å•ÜS#ߎ0”8 -ä©NÔKøÚç¯@ŸöÀG¼µ&Òµ¢†êèïÏÎ^^^ô…·ä¸¼_›ÜØr›H¤íćDn‰ž†9LÚöJrd»LÌxʳ÷> >> endobj -3869 0 obj << +3932 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [173.74 248.031 284.915 260.933] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 382.708 539.579 391.731] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.36.1.2.2) >> >> endobj -3868 0 obj << -/D [3866 0 R /XYZ 85.039 786.531 null] +3933 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 369.159 539.579 378.182] +/Subtype /Link +/A << /S /GoTo /D (section.36.2) >> >> endobj -22 0 obj << -/D [3866 0 R /XYZ 85.039 232.98 null] +3934 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 355.61 539.579 364.632] +/Subtype /Link +/A << /S /GoTo /D (section.36.3) >> >> endobj -3870 0 obj << -/D [3866 0 R /XYZ 85.039 204.182 null] +3935 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 342.06 539.579 351.083] +/Subtype /Link +/A << /S /GoTo /D (section.36.4) >> >> endobj -3865 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F20 2865 0 R >> -/ProcSet [ /PDF /Text ] +3936 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 328.511 539.579 337.534] +/Subtype /Link +/A << /S /GoTo /D (subsection.36.4.1) >> >> endobj -3873 0 obj << -/Length 3971 -/Filter /FlateDecode ->> -stream -xÚ¥ZëoÛ8ÿž¿Âˆ Ôª$êÙý”f»wY4i¯É¢8ì.°Š­ØjdÉ+ÉMr÷Ïß¼HѶœÜA`>†äp8œùÍPþă?’F®§²I’Æn¤üÉ|}âM–Ðó×_(fB2³hÞßž¼ý)'¾çf^6¹½7ódžeñävñ«sñ·óÏ·¾LgJ)Çw§³$IËëÛ/Ó u>ýøËÅíåtæ;Ÿ¦¾sD¡sû‰‰oί ñ=öžO¿ýùäíaÇbØW -™ùóä×ß½ÉÿùÄsU–N¡ì¹~–MÖ'a¤Ü(TR¯NnNþnæâ¾p£Æö©ÔRu¸y?²6ï« ¨¢IEn&´ûß3Þ­ªTû´ö„÷ì+¯zGÒZp›H«îHäeOâZ¡¸˜@sºl5›.-:ócWMÀ_¸6´ôù2'ÝÙ Å}œu(…Û MiÚ>ç)±=pú†ë¦/˜’„•ëî«ŠôåíÔ”aƪX“TyB-7YÕo NC„÷³Ôô3 èæBGÅ*úÜõTX‹lgríI‘%à vVùp,Ø’Ò­‚ÃÖXÁ~qø»_ñŠK9ØZ¨òN~y‹'¬æ8ß‚)6-ŸH[:sù4+¤fØ¥E€åcdß^\þtÃóªÔºÄÇjoWêvUÐeOÐœH6Iw;aƒÎö©¨¹åWݶú^È 2ÿ?M±Ÿ†µ¹Ži­­Pµ£èZõH@»"/ËȪ*œuü |í»0 Ü,‰'qâƒÆ*6üØÑ.…â‹å4õÌ"?tûs¢œ¾‘XIiTâ¹1]ŽAŒtp `¢¾ik0ï÷™õÃ&Î&q”¸©Žz)M3³ˆF¼T˜¹1´h"äáqUj¡áÝ–@¾£R-ðª¡c}cÇ ­Wï¹Í>-ìã{ë4Õ•ÆG­‰eßµ1 ôû³ÜØîqó1xÖ -_Ä% m:€ÞÐUaL›öWùÁ$”†mÚwC@#p pp3`µ¯Š~…÷nUS5ËçcìpŒQð2;ÍÈ;Q–¹žÜ¦)Øœ6'‡fìsõIø@}XÉ×9ÁeHI|Ã/šb!h¶Úãb½¹:|X(&[ÈË¢.jèÉî cù›Á•²BcÏÚˆ:43+üçH°­*F¶kw>¦0t.Ål1?Õ±ˆr7Ñ"î«ñFæ½$R3A—à+ÖÌY -þ"®Ä¢’¼`·ýõFÏÍZïtÇÄ+—Á;Ç} -‚™/ÅŸÛ¢ëO¹†ç¢“3J|  px€øôÜ¥¹ë@vs оÃ0E¼Ê=:„øçÀ¾¯%r¤ûW`¢¼ÌÙñdÐirå{ J·B§M2vøq/F×Ä¢y ØÞOèñž<ï$O„;˜C;ÒÂvà@‹€ò¡J G` Žlã!ì¨@Ø¡ˆ‰cú¾uôžï˜*†1à8ãUÑ":®ŠšèU|qAQŃõÆTÑ^ïÔê0™.›¾Ì{R‹ØùÜ6ýT‡ë|éQ¡N™xÆD‹¤µ6~C†Šn&${˜¦!C çਛy%D†5ü;äEÐDàqNÌÞIÄ—¬ª‘÷ünʦJ—ïY»ÅL÷ÝÈòãÏÐ|Á×埧dÍ ýgùLqDük®û®Ç4“M[h0È­3þ“JŽŠU1„¢•ô꼇 äÕ7¸¨BI)¶ˆ'óüºäÔ¹*çmÓ5÷/—Uv@H¨ãaÀ¯âÒÀ0Ö>ãlÛŽ9džÿÏœkJÎð&*!Ùu <X™0ö#ATR**±Xæòãù5W®¨/_û‘ІDÜ [MøB¬]˜-TUQ/‹·_¸W2‡ÂL~¾P¥Du&CøBv à.ld׋{À­%Ö rE.v€Ü§±¸¾pŸ²²ÀÏp:n¸X±]7`ŽûÌ$¹Ü7äÿûÐ^ß²±üx%Ñõƒ!vØ‹ tN,¤=@»uPûoNÈ7`¢Š\€Ç1­’ ~×M´EtÜDk¢WLô‹ Š‰>XoÌDÛë …”h8¸²À¹éó¶GUè‘vÆ áœ$+ùÒ/xgxC¡¨çí3ÚhŽ#2>WBcP®›^Î*ùœÍ7Íc€ÌAF8HÃÂý˜^iƒ›eXÐp³ÁBìLùÚD.ö¢ƒ%¡s½­*¦ÑÉ؆«æ*Ìu\ü¼±0)^F%7ßÜr÷Œ=žúaÖš—ýÏgÝ?°f&³ŒÄG’ e·À®n©ö=8ªÅ -t0Ž_Ñâè-¢×´ø¥µï¯7ªÅÖz&YÇ’Ú) -®]4u=äùÞ±¯8 h8âlüæ<¶[™D7Ô$s˜"A*è©K)ê=¡!œW€#´X ÉÎ>¸äY‰ Cíg¡Ã¹#冠 2õÈÌ‘ÕOp@4*HS”ÇL²£ Rj79 -ÒèYoèÚFåüs˜r2rÀ&þÇ&Ž‹R¡‘—t|ç/Ü`íM‚ïM9ä®É"}Ø@pÚ锄xhÓ&g)BÙüOùºdಙÀÐ1ƒG†Ÿ 1¥JCPbC Še·;kß>sG³=ȇ^äfÜ,/u£${-Ñ-Ô3‹|$ѽ7'é|(HC Lé£Ú£(,‡3áùæ+Ý j)7öGâ„2÷/l×?Q“ Ã$ëø…’Ù@3rawçÁE1œÄÎ%j[’âÓØŽÅ³s[¬zOdæbä‘6±¿]®t]PÊëfŽ¹@~Ý´` -Q^Oø½'{›I’GS’aè¹Þž åµjÃú|‡I¶gÉNõÅæXš=ˆ8ÔÓÚÉñ${&®/—ïF’dÿ°¡La³ÜÇ–a*?{yýæxZ=7‰Øÿñ•Ÿ IùàÔî6Ô‹áÎËKÌg¦ylíð¡VÊÈ~EL(‘×ä˜K|6 Œ+:h™”_p9¯µ9Ò>7OÝŸë㊞F°oU'>d8Þ¤ÞÁWÆê0(Pø -‰¯*¡à]£>ûAvtk ÷¶4ÇH)/Šä -a•Â^,luŠÞS´÷ÃgL7䳉p7 ùú(vø%Ÿé9 J“ifk}R‡r(û³©¼‰Dô–¶íè!„ò½øÈn½1¨ˆŸ–CgmLÌóŠçúÙº%j­¹f%—›¼ÆâŠÃ…¶ £ú=¿¤„•añ{@sÏßo§õ‚ŸŸW2i¿ÅÑ¡î{… ->›§îaÔ>…ßýMFiÇTæÑ3ÜßHl8bA×àLjµ¶‡X[Ù•RH¬Œ,^r‚çøèQ ?ò}ç+–›¶ÓÏ:È@½{·ŽœöBC!¶ÎqfåÙê¥Ä³rgfQèôðÊÆøÚÔ+“A3ýÊþĵ;¼K!¹$8ÏIëÍ*gB2¼?ã蜣…ô— zµ'@›¹@sÈP‚ƒ‘§hâ3ÃÒ‘JþÀ-9ÿ¬«-iu»óØ ð@m¥˜5±T˜òÒÏøBNQ˜Š´AÄE‰;¼9D°šŽu½ÝQò‘[ÛÕg‘$ƒáÌ=i)ãèÏ÷ŸÈ2þ$âÉä}3þŒeKç•ñÔ³vˆÈöµR¯§e¼p|&Ï×`ág6x*J**§¹9è÷>á—tAIw6t|–çò•€ÝÞv ï¨H®œ²ÙÚé ³mŸ™šLf>|·“Ê—A™³,úÝ1 -âo:>±ÏÀþ]on5™¯ ñª!±_´À®³Éa\»ÿmª’¸¤=•®*óä`'´êâqx¾dÃD©›VU¢#;¤gYsöej"»¹q¸¥IhY)K@áØ–×d~z|Î^ûŽ¾1RI¦¿É"ŸKdPJ(0´XáµÒW®µ?Ãü®v;ñC²o’ÌŠ¡Â:¶5t\°a[=|ßøæ¨3”ˆÔq… ¢hËQè0N.Ú®ÏkÉ¥!}‰ßbƒ+|eVÛ´á¬_>œüˆ>ÿL¨}m!ÓoË‘'_”áXy}$tP‘ªÑˆþY$ÿ×'Â&þS7K|Õ‰'¡fÏ ˆöÖŸrüo+œÚ!endstream -endobj -3872 0 obj << -/Type /Page -/Contents 3873 0 R -/Resources 3871 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3881 0 R -/Annots [ 3875 0 R 3876 0 R 3878 0 R 3879 0 R ] +3937 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 314.962 539.579 323.985] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.36.4.1.1) >> >> endobj -3875 0 obj << +3938 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [481.98 668.246 512.306 679.935] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 301.413 539.579 310.436] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.36.4.1.2) >> >> endobj -3876 0 obj << +3939 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 654.697 146.975 666.386] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 287.864 539.579 296.886] +/Subtype /Link +/A << /S /GoTo /D (section.36.5) >> >> endobj -3878 0 obj << +3940 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [404.926 305.462 512.306 317.151] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 274.314 539.579 283.337] +/Subtype /Link +/A << /S /GoTo /D (subsection.36.5.1) >> >> endobj -3879 0 obj << +3941 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 291.306 153.369 304.208] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 260.765 539.579 269.788] +/Subtype /Link +/A << /S /GoTo /D (subsection.36.5.2) >> >> endobj -3874 0 obj << -/D [3872 0 R /XYZ 85.039 786.531 null] +3942 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [519.586 236.307 539.579 245.875] +/Subtype /Link +/A << /S /GoTo /D (chapter.37) >> >> endobj -26 0 obj << -/D [3872 0 R /XYZ 85.039 639.254 null] +3943 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 222.758 539.579 231.781] +/Subtype /Link +/A << /S /GoTo /D (section.37.1) >> >> endobj -3877 0 obj << -/D [3872 0 R /XYZ 85.039 609.849 null] +3944 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 209.209 539.579 218.231] +/Subtype /Link +/A << /S /GoTo /D (section.37.2) >> >> endobj -30 0 obj << -/D [3872 0 R /XYZ 85.039 262.92 null] +3945 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 195.659 539.579 204.682] +/Subtype /Link +/A << /S /GoTo /D (section.37.3) >> >> endobj -3880 0 obj << -/D [3872 0 R /XYZ 85.039 233.516 null] +3946 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 182.11 539.579 191.133] +/Subtype /Link +/A << /S /GoTo /D (section.37.4) >> >> endobj -3871 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R >> -/ProcSet [ /PDF /Text ] +3947 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 168.561 539.579 177.584] +/Subtype /Link +/A << /S /GoTo /D (section.37.5) >> >> endobj -3884 0 obj << -/Length 1474 -/Filter /FlateDecode ->> -stream -xÚ¥WYsÛ6~ׯÐäÅÐLD“Ͼtr7™ÄNc¥N’™R"-!¡…€¬¨ýóÝ d[ÎKÇc Ø]ìña(‡ð‹4e9΋,He4^¬Gáx œW£ÈILÈôHæéltþ2KÆQ”a9ž]zÊ0HËl<«?‰g¿=y?{ña2•RŠ(˜Ló¼¯/f&q!.Ÿ|6{=™Fâr‰ JÄì’…¯ž¼âSä>™|™½½˜ î9I‰Î|}úŽkpüÍ( dYŒw°ƒ¨,ÇëQ’Ê M¤Û·£«Ñïƒ.æ%c>u*öTAZÈûÁGéQðQ2ŠÇyšY’Sô»UÓM¦q »‚` f‹³¾arßTm»çµžOâRÜ(½5ŸÃ4z Ô,ƉMWã"‚cUmÕZ>­Ì}k3ûI!`ŸD‰økR$BoY`Qug–UÚµ‘¼×è8sø*D³@V55x'€Ï4BøJ -wÛ·nz8PFbÑô¶R -:­€Ý/¶k¶R¡4ÑÑMò.秌ƒý‰ XíP8à'k•ˆ-^­ólÉD4å–•“‡ -ð8)w]úØÂß3,T0æ°À{LD”®:¾/Vc›þF5;”¢âC4ž/qzϘû®ZVÿRÍ‘î+¿ß¸v’0‰‹»ð$i„ùmtî c™Ç0ûÊÙÏ+Y\Y)Øbà&L²ãyÁwQÄ[dÔ…Kh k¼i±«Žœ‡ÁóÀCÄëø©3™‡iQÅœ<³•2ÜhA«ŠÀó}éžÿŒ¼Ûà€Ü÷j¹¢I‰¬XÄa(Yèy…Wy£jÞ¾mXkǧ˜¾-Gõ”`cbyìTîH­€kbøtÁ§ ¬÷‡¦§Öþ@I7=Q-FÑ°IX"–}å°fÕ|/Ž"ÆĦY‘ÓDP0Uv¾­mX¦ã9.xB‘‡ñ¡®ý¤Ý+o¶fx©4lžÉ‡ç ‹“ú”ú)G¹6LÂýèüh–¡¯.>â"/Ñù¾!r,žìr‹$ÛxŒ ˆ¼UÃèéÌPba!þÀa7€M»C¤u̧ …0òM”‰me)&XòèÍprƒdÞ*³¢‘9cþp|q,]X"ÆâJ_SõCÑS¦êƒ¤5=jêÉ`S(ÌáåO·®›(øÃoº\´j1Œfsd•ÞÅàgõ$ÍD¥ZžŒÎYÌp”¤7ƒµXe¿œŸïv;ßÚ—ÜKêžËóû–èóüš^ŒðØ6x SÈ4HøËÝFÿ æÿú53´›¤ʇºMçA–'Þ¼½8»ë°ÿÕsßãÿ~-gªendstream -endobj -3883 0 obj << -/Type /Page -/Contents 3884 0 R -/Resources 3882 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3881 0 R -/Annots [ 3886 0 R ] +3948 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 155.012 539.579 164.035] +/Subtype /Link +/A << /S /GoTo /D (subsection.37.5.1) >> >> endobj -3886 0 obj << +3949 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [131.316 644.136 458.066 655.826] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 141.463 539.579 150.485] +/Subtype /Link +/A << /S /GoTo /D (section.37.6) >> >> endobj -3885 0 obj << -/D [3883 0 R /XYZ 85.039 786.531 null] +3950 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 127.913 539.579 136.936] +/Subtype /Link +/A << /S /GoTo /D (subsection.37.6.1) >> >> endobj -34 0 obj << -/D [3883 0 R /XYZ 85.039 628.693 null] +3951 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 114.364 539.579 123.387] +/Subtype /Link +/A << /S /GoTo /D (subsection.37.6.2) >> >> endobj -3887 0 obj << -/D [3883 0 R /XYZ 85.039 602.079 null] +3907 0 obj << +/D [3905 0 R /XYZ 85.039 786.531 null] >> endobj -3882 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> +3904 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3890 0 obj << -/Length 2666 +3954 0 obj << +/Length 2359 /Filter /FlateDecode >> stream -xÚ•YYÛF~÷¯Ðæ%0â°^ ìƒÄYoÖë 3y?P¥!†’ÊdþýÖÕMR— 0lv—ª«»ª¾:¨fü©Y‡‘Égi–„±Q³ÕîM4ÛÂÊOo”PØØ„±µ0¾°¸p«‹D‡‘M/ÒÈ‹TÛÐfiÞ=¾¹¯£™ŽÂ$1³ÇÍL)¥gIž‡qšÎןÎqÿnæF/ó…IÒ Ÿ/TÐà8 >컾¨ç*¨y­Ø¯yáqž« ìzž~xûñÝÛù—Çÿ¼ùñÑ‹%R¹ý.ÍÚ„&Õ7O•¤I¨£x|*eCc“É©â,ÔÀˆO¥ð\6>áQ–}QÁ ö8¦Ávr–4ð« à¸õ˜ª+vð¶,®.ŽáÊÍí 4tÏTæQ>9€1aÎò¿«öE ›¾ÎV›àÃb5×ið<“ Ø–,+,ê Ùð³Ã9Ug(+MmÉ ª=pX!A}„Ѻ\3Ì3a½kP“H[ì‘Å+/ü(tÿ’½Z~þ¶¯df ì*Úº‡Q[-‘_5¸aˆ7†*VhÀ9ìñ©D¡Œ±Ðë®áQ×ìÍÃɧÇî„%ü“檺XÖ#>ý©– ZJjf øIÅýp¡Ý -ů#…9êňü\c§<ñ`ýÓ Å‰*ð OÍ®< âNijÀJ*LÄ;¡¹-Ô)'Š5°Ð9P©‰>€Õh‹z!›#¾¤Á¾$ÃZó*´Áa¬šÝ¡’kÆwt P )7¨zÔ¾Ðá4ƒ–,®¼ƒù$H‘rIhŒ°ï³lôtv-&É,ᆣ$Ì4¡/Öx0ÑšP/Fä´v¯¡8Hvú_}ÉáôÄ%QÑ”×hïxE|Šé{ZmOE#À¡l,ù™B…䶸'|Fê4+qÎúŒ½:©_žÄOà&øqQ·e±~å劽vYó¬Wíÿ]ž¨§;Èl3º't碯6µØÁk×—;fô‚l‹Ž_è¾Ë2Þ/#Ç‘†Ž*×1¶Ü— -\ LZ{Qq_”6ŠÐ”ö¼86„)‚”Bp WqϦ—ñ`õ@Ú7<»„G†4*Èâ¹akòvÄ=|¹`~ õGþMɃ¦÷n Œñƒ‘ -î.`æ T’;Í Ž°{^î~¢žeæ©êx4‘³å9Aû§/<·id‘To»‚æ TÈÅγ8d;X£þám+88RPx%|Æ6 eo†ÏÍõø¹U˜E.þk‰ÿ?4û?"e·h°ÓàïÃ:½ýÅQGáªÙƒ­§ ΩkRkpNß–z ¹ôã( -ûðƒ‹ß³Chm8fS0åS Ûˆ2´ ²®oZŒéZb:>ÅÈ@þû÷f²5dS8Œh×n''&ÂiDù­:ÜßcBºµ°EÑófGçÃ8PyåéÖý «Ö¥È -ò] ²À4Ëd¯û²_݃~–Å=Š'¨âäfŠW×I˜èD˜5í¥ýLháÚe»c×Þ×ͪ¨eÓºZÞ߸•$a”¹ DG‡tø÷yfØImÄj+öüR:Ëë HŒ…;YWâ>§+¾=c5]³€ ®y´•ë-ë 3åSAh‡ð ’q(X€`÷üt©ñ%÷ýXxQùœ­L Õ ¼\¡r×8ÍÔ Pb[ãëÙjBZqž­Qh1Jò/Ý3.S€)Vò6°¸« -Ùbž+_Xòk©vž‡‘¶"\ ”¼œÌ¦Qh=¹·MU——“Ùاªh ãNӺ܆'é+kIÚž¥²Ã슻Þy‡Š+OoåÇ—òbQÖ‹ª\ÿ)3a–f“Ó¾ŸgVš 9×çïF¾òœ»ÚÝgÔÆ8©Aµ(´\[8–ÔÇ8[öئÃÆm7Ä£(øŒcçª_FÌÈsZiœ@*:á½-7¥cÖ|2P#¾ýUúò¬i¤À  ƒÒ@Ý|­ßå¨#ò iÛ Or{º"WƒöF%ú©PÚ&”÷v9K ÍmQN9ùfÖ…tU#§övº:¢ñùôYºªLÏtšO»ïÓ¯¯øñƒ›ZðæòV×()ù›Ç‹/åØBh²/ý—ƒ÷™€Y»»v<[~»\Ñ\ÏÆÄÿTNRûï)º*íì-}Ép¡—F¡c„´R:Ø·Qæ¢J.•\]I±*_".ÇL¤ z‚!î?SßÐgˆ#ltž·UÑ’œÍúƒ’P¾tÄ›œ2¦±/R†Û@e»£Î\Ê-S…­°®?àOé­¥„¢ã—O? ‰ýøc',HÊ3uÕõŽ¸äAÝ“ê¨ÎC~'‘~(‚ÜKX¹&Rƒåñ†»TÒØ= í.//ÛÖa½À['_ŽÂoÝÆœ„n,š%d —“ØáüÙ5}ÏQLí4ûï|ôÏjåJ:\¨‡óï`v>q,–.ƒ—”°Ü}"jšZ¹jIq·ß^*çÞÖÜ k–½ù8"¹TwΞø«Ò¶¨¤ýùâBƒ7cÆ Zß ¦üòRN UFÉ·$41¸ó‹\¨Û­™||¼Š*é…o#tœ8v™éÙ— pè837öü?Ýüe)endstream +xÚíœ[oÛ6Çßý)ô6˜Y^%òiÀÒulmÖdèC»ÅV\£¶•Éö:ìÓ/b,ó$j1ÌéŒ"°,óGçÿã*É°þG2)f*+dŽ#Ùl=ÂÙBÿòýˆ¸S—d¥ùözôì…È3‚‘Â*»¾ ù(Œ„ʳëùÛñE½™P9ÞUöc;ùýú§Ñw×!ã¨h˜ÉöÑÛßq6×.ü4ˆ)™}Ô×¥²õˆ †gîûjt5ú5äe㙵:öœˆÈlÊ0’’MB0A3ý¤B œáI)>ò¤.yR&Ñdªøøª\ß”“)Ë‹q¹™Û‹z÷¾jìåÅ2~qe¿ÌVKý­Úì&S2îÅFPGɲÈûS³ÈìÅëÈqŸvü0Oã9g¤W´~šƒ¢ûÁôá†9ð†ˆÈì‚S„µf.ŽDG’r>þ¥œ--7õö½Žc&b%³o&SI‹±N/0îp¥’¿="É¿hþyY÷@¡ˆÂØÓ#ŒµšFf}‰ó~˜¾ =4|Z¸àÀÕ©¹òlPÇÆ«+]s¨‚/ºÅ©i}’¨¸¨E¥3P‰ƒPé» LhŽ¸âY¡ïLL#ÂòÜô@ï0ᚖž1Íífa›’WWϨ½z3‘|\6wö›6ؘVÙ´/³½W7–´Wú‡ØŒi3}ËYr›¨ÜÚ¯¥ý:‹è4·omfll.×Ý~ݘ«É´À PL?ÜPµ¬  ” ¤Òýb…R…uL…Ž¢Ÿ*³ï°À›zwL4ýùú0‚è×þŠÅ²²1E9mtAžX›”(ö™†ê¬iºhqF“êôÊJõå²Ð·H's"]Ì]g\¹ÍÛ{š{mÜýmCsó£¹iTYÕå¼ßPÚ¦ü=¬-[ݹ„Ÿ@cé£2PæÈ,­sq@è#.¤• öýj^pÄõR3ׯ¾YÅæVÀ­Õ$(ÕÖúù`êjSïï&fÔ:•…ø?u>pCièÌ"Q8cIú.4@‡ŠŸë)‘¦"Ðà»ÏŸË]Õµ]C{}a¾\šû㥽å~ÖÍäÌ4˜\õ6­C½¶ý²œ5õ¶¾Õ™ðœØè+¥³ ÉP;3@ç(ÜÎ}¡‚ƒÎ¼@TðNgß ?¯V•×±²¢¡»¶Xùî–ðUåZ„Ò4仸Õ7mAÙ’°ýh(¨ü®Õo±xol•!€Ÿºô.JC¥ïÌé# éû.ÒCéCŽ¤g ÀÞܾyXÜ÷eÛa¬‚!çO¤~»x ¹3DŽb ‰Üw*8ˆL1"Bt"s/²Õ¯ +¢™aÚªíì¶N×·ÇÄ–Zì¹þ–çêéÍ«SÊ» U¾3”€”ï»(”Ç9ÒòÂ)ÿÛÖµçGºîÒµçóê¶Ü \/×vÞ»Z ¥n¾µY­»Åž¦Ü.2Cåî̹£¨Cr÷]ä† +ör ÅE'wîä¾Ò³dÝDWmçìÚèåÚTê¦Ôwóµue'hTµ gª8±ñ÷¿CƒÜ@"³4 ±(œñ G\HÓì's¢PHà°€ÎÉÜWJ<ûJI=·¦ô¼(z Å¡htf‘B}4 ‚CC‘ ¤D„97£Án( @C$ +DC߀¨àÐPª?ÃnŠ +Š1v+¡UóçræF—&™éK?Ó§:L}áMƒ‹ÛP:3†H†¾ PÁZ†c°ðòÚ~ê)#=PâÜwÜÄÆr(Á +À£S‰3‘¤£W~òôåˆ Ÿ~D'Â<ýàÓ´ü¨Þé‡Ë ÓóÍ涞èiC³.7m ¢;žë‰"ãýf¹Y¤N£rÕ¨DfiTbÅTŽ¸F,8 R0Tøu}vó^·#w»ûJíFÍòïê”·ìN’Ü¡Ätf1‘pºƒNÓw *8“cD±ðÄðpæÎ…øk½Ü™ž:ƒòxP\L‡‚Ò™ DzA ô]@ + ðå"÷ ø)ãϵÛ%²û†vµÀìRqÚÊŸ$8.ÆCÁéÌp"ý pú.à@pCœühŸÔ”î¨ø Ìãq± +LgéÓw*8Ctó"0…_0§ŽšåÎ-@5í<=öÕÐäLž¡y<4.¾C¡éÌh"í8“Ihú.Ð@hpŽ°ßúPHúIÒÊCl11ݔfb$žâFöÀŠ ëPV:3€•H2ˆ•¾ +PÁž¦(âByV”_p98¡½ÛoÚÓ®z€SqÆÀÄGt &‘Y“X-“#.¤1 ˜)–å0šP‘ÛóàrÜ.o¶ÇdÚݳöœ=Öì—8uewÑnVþHº;iÎÜì«øP\{xj±ô'®ìrN³1i!NPn™¡j+@ì.æÖ½ò©RƒÒ¹@,ï¤&VꋺiÌq˜;ß ánìõ‹¥=©ä¹)¸Ï†‹åP8:3€ŽH'¾ ð.ˆ‚wA7žÀ» >M붻 Ï_šJuðèóÌÝ‹‰9ƒeßµ/û¦4«¶öæ÷ûå¼JmŒD=fcôÿ0Ïö8NƶËës6F˜Î®xhc„Ñ1¿âŽÃÆÈËÚÌ„TO©®dUuñZU;3 ªÆÚ8õ]ø¬ K†)’JÀUÕ¥i]#¶ª¾0»“û¦{Aûuµ­÷ͬJ¾Ž•ô¨:9v˜§ Zòe¼(¯O|ûЛ£ÕJ…Ï}œH<o‡37öÅ=Fn_a’ŸëàÐ:èƒ<°Ffé:xOÀ4NG\H§À‚9…@… +äÐ{K~f4\îâãf{ûî¬óÎíoþ…³Ô»CD}©4¸À ¥¡3hˆEáÉW ¸tôº[f9;ÖÖè?æßÕþôÿÌ#´X\âeòµ¹åϘ@œÙ.‡&OȸD‘Çÿ™³ßendstream endobj -3889 0 obj << +3953 0 obj << /Type /Page -/Contents 3890 0 R -/Resources 3888 0 R +/Contents 3954 0 R +/Resources 3952 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3881 0 R -/Annots [ 3893 0 R 3894 0 R 3897 0 R ] ->> endobj -3893 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [313.377 617.253 415.127 628.943] -/Subtype/Link/A<> +/Parent 3990 0 R +/Annots [ 3956 0 R 3957 0 R 3958 0 R 3959 0 R 3960 0 R 3961 0 R 3962 0 R 3963 0 R 3964 0 R 3965 0 R 3966 0 R 3967 0 R 3968 0 R 3969 0 R 3970 0 R 3971 0 R 3972 0 R 3973 0 R 3974 0 R 3975 0 R 3976 0 R 3977 0 R 3978 0 R 3979 0 R 3980 0 R 3981 0 R 3982 0 R 3983 0 R 3984 0 R 3985 0 R 3986 0 R 3987 0 R 3988 0 R 3989 0 R ] >> endobj -3894 0 obj << +3956 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [367.537 603.704 509.276 615.394] +/Rect [519.586 754.651 539.579 764.219] /Subtype /Link -/A << /S /GoTo /D (compiling) >> +/A << /S /GoTo /D (chapter.38) >> >> endobj -3897 0 obj << +3957 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [169.225 164.014 247.309 175.704] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (securing-samba) >> ->> endobj -3891 0 obj << -/D [3889 0 R /XYZ 85.039 786.531 null] ->> endobj -38 0 obj << -/D [3889 0 R /XYZ 85.039 766.606 null] +/A << /S /GoTo /D (section.38.1) >> >> endobj -2948 0 obj << -/D [3889 0 R /XYZ 85.039 676.205 null] +3958 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 727.553 539.579 736.575] +/Subtype /Link +/A << /S /GoTo /D (section.38.2) >> >> endobj -42 0 obj << -/D [3889 0 R /XYZ 85.039 676.205 null] +3959 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 714.003 539.579 723.026] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.2.1) >> >> endobj -3892 0 obj << -/D [3889 0 R /XYZ 85.039 644.68 null] +3960 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 700.454 539.579 709.477] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.2.2) >> >> endobj -46 0 obj << -/D [3889 0 R /XYZ 85.039 547.614 null] +3961 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 686.905 539.579 695.928] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.2.3) >> >> endobj -3895 0 obj << -/D [3889 0 R /XYZ 85.039 517.412 null] +3962 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 673.356 539.579 682.379] +/Subtype /Link +/A << /S /GoTo /D (section.38.3) >> >> endobj -50 0 obj << -/D [3889 0 R /XYZ 85.039 449.416 null] +3963 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 659.807 539.579 668.829] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.3.1) >> >> endobj -3896 0 obj << -/D [3889 0 R /XYZ 85.039 428.219 null] +3964 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 646.257 539.579 655.28] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.3.2) >> >> endobj -54 0 obj << -/D [3889 0 R /XYZ 85.039 149.745 null] +3965 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 632.708 539.579 641.731] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.3.3) >> >> endobj -3898 0 obj << -/D [3889 0 R /XYZ 85.039 129.151 null] +3966 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 619.159 539.579 628.182] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.3.4) >> >> endobj -3888 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> -/ProcSet [ /PDF /Text ] +3967 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 605.61 539.579 614.633] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.3.5) >> >> endobj -3901 0 obj << -/Length 3087 -/Filter /FlateDecode ->> -stream -xÚÝ]“Û¶ñý~…Ú 5cñü@Úqê¤qƱÜun:Ix%±¦H…¤|ö¿ï~‘%ê’™æ¡íd‹Åb±»Ø/œZðŸZ¤‘h»HÒØ´Z¬7Áb3¿Q‚±”•ƒóÕýÍí7±Y¨À·]Üo:6ð#/î7?yûöåûû¯\®´Ö^è/WI’zß¾[†©÷ÀÀûwüûúíÝý2ÕÞË7oðòí+ÁX®”÷õRy€@€»—ßÃ×W~¹üåþ»›¯ïN³(­‘Ï_o~ú%XlàLßݾ¶éâ Ư¬]nL¤ýÈhù.oîn~hñœYðª9±ô+e}FÏ‹.Žý8ˆÑ…0«|E(:¥B_«p‘D‘›„dú 0ER‹¢À»{XÚlHäÊ©eõ³lŒ8ĆŠ lhÀŽ4±û6NIašz°ÕâÐzþ$ÞÓ2L¼üqõ3Y‹šÉ7#n…úîòf›­s†vû¬ã•û¼<Žä>#f}â©u]ý(³»S# Ûì€[Ñ> Ú9ÅnO{2¡ª–Á#þx9Š¤²R ½ˆ™!öÇe{YQf%‡ µ ¼¢B£³Àñ£"#©÷˜ñô1[ãç"±¼ZÖÊ©ABeÖmá§n/Uy'øì¡ßRH³8Y"X÷‹p?EzïË\¤ïÑX:c“g¾@ÃY´aêOH+ëxö@§«åÈ',>‰•ŽJ§¨v/TT¬>`?Ù¦x†hÈ–kD¨€*ÝáiZ¹6È‚z¶ -ç S ¹5œO$¦ê‹¼F çO4ˆõ„4×HkÏ ;øFQƒ ô_=µ~7ƒu4Ñ °Ç€­˜‚›B4€«Ää í±©é Úæ²:«6<8‚å%^]Tb–+äN}vŸM¢üPÙEloñ+8ÑìãG× öÊA§»­Ý»}Ne·ïºã—··$Ú•ŽRÀM&Â-ëuVîë¶ûÒêöœMeCßX½ˆÓÀO£xÖïô8+iÆñœQ½ѦÁ~Ì%û kºÁÈZ›N‰àÑÛ€u.êj/ëªì £zËè]?µ®ÉàñVž:ÔÎŽ~0²†µŽã† ¬Ó%¹Ë*U±õ^*csîoO±åߺÖ!P—;Ö ÕU_.Ft½Ýô" -åMÁ7JÓ¥oòÞ¼Æ+w8’gÉñ£‘ë‚ɪ)/2k\SfWÒ\^=¶ž·5’ cÕ»s‚‹PSÅЬëØ_í¿æßÉå4ä½Á‹m‰ƒƒ,¥#}f‚¯‘¡÷B¼®ª|ÍÛ0ˆ=oDöO¬¼,%Ûq9ã\Gš„bü49íS‹/ Ä›L\ê.g4pŃç &[†OŽ<“ÏÕ¨áÐÄ^}ä`%Ÿ$2À>f-ûʺÙðL[`1Ú ~fí€H»>±ëÚ´3!á©(K6ƒGòO}L ^\[*ªËȱ. -«ªÇÓöv¶Ïy0\͆VøWÒ—†Ïf/#ÊC_›ØM^"ð%ì%‡Ò˜> ¶‰Sv¤cÐ *ªí(7Ù1ˆ™…A»Ï–š”'m2ý˜QÔƒÌ@°èƨMÀåÐŽkóæ#œ~þxQjÁÇ=Ÿ98—|8`œøVóünvæL#?  KžHj—,¾,z[sõ»zÃ:uŒÓq°hžÙaÌ+"pxáÄþIA®½ B Q(7ü¹ËÅKã¹2º,áf¶Zý4Cò~²eÜ>YƒÌ§ \ªÏ×pƒëÆœ‹¨°ÿó“ˆ#å½ÞNPùcSW_,…‹ÑÞQZ>‚5ÐrüÈ»ý`N˜Ãµò‹°uÝ4âoÓÏ’×±\PTGÊßñ¨œnr.„JDƒi߶á¸áÙuÖ'‹e/Àšζëä!\óBöí2ý4¹›ñp#Höh ­H É1WcQ A¸Râ ÞdÕ÷” f;7­ËB"–Pÿ9ˆ‚þ''‘£ çÃÃÃPÕÕœ5F‰¢Ôã¸ÀÒ«Qø<µ=Cˆ_棻.ÄrZ÷a -(ñ("§Q1g§ÂÁ€“zRÂ`"ÈK(TÂènܵéí×S?jQ48'(GƆ‰1 -\ ^ƒ(‹ ÊaBÊ;Cð†ìýq4¹}èíÑÏn âÄ -Ò\™änŽÃJ´¡htEÀ -þš'¹Vêæ|XDnW(°}A‚{òºÉ;°ÁVØBrÒ7Ån)Þ¶†Z‚%†©afêˆ E£æ[bŒ - M e ™F<¢8‰h}’eÿ`ðê- -à}k!ÄÍfHMBa¯ÏÉÂWÿø3ÙQQÒÙVenY ™J ÐïïWkL¨bæÐMœ~¯¢“ÛˆtêjuçVÁZ.Kïfé ïé•€ˆÝšg¢ƒs=âú‰J%⛹ˆ/Ù" "ú¨$V"y,þTáô'YN†Wݵ£èØ´ÏeĹÛ ž.ŽÿÈØ~{ëFu¨å°ºÍz]K¹"×bû=™ç±€¢«üÌA²¿"û@ëdJ -.œg7å&}†#¬Ti8õÑßÝY’X¦»3öE+BŠƒkÒà†Úl!\Ô@¼Aá¬å‹âylÇr?fDH𱾃ý¤ @Z›^K}h ØKã'¶‡:±’0Õ~šÆƒþ}°ë팙맃ûÄmJçÞÓ11ak$žÜª„»Zû‰]ïqjûxΊB—1SÒ:ÝÄ 9¦ŒøÓ¾>°ëüÅu RIá1#†0¸¢‡"?UýuñÅíÇ¡¯¢i½þ VŸNLyù§ìpì3JøÆ#šÐ¸%|Q±^|âI3h.¸ö‘3g´²‚gú¦Ø%ŲޡàÐM¸'ô¶CŠ0%Áì¬Oåu‹çäå8&_ΈwfÝæŠ&QÞí¶É7W|ª†ýmð|xpp®‡‡Ð¦~l­„‡è÷„‡-%…ÔÄò‘^½CèÝ >lvý°¨ì§qüöþÅz±Rã>úwÂBøF‚Î$oCùÌ)­aÞ÷1B§éo†ž0I|•<zœëMÿ0Š}?cS•„ƒ áúJ´^7ô¥6C¾ø¡•D‚t½ûæô7ÁSf‡oÀÓ°AÍ]ûæÌ?¼~ûêÝÃÝ øUS2J]!ó—»N}“läb¹T' çÚ̱¥H”ôfˆÊHnˤ=«®ÏIëK©¨kRƒÅ81š°p -×™O4|”v¼(¹Wé¬:ƒÿMÒ»S§æƒ ô>¹(5ëPáKbr)×UÀÿ75tl¨òqÂÅ$q9ëŒ'TÏ?ÂŽ(×Ã…ŠHž" ±„‹nÈ@Àæújz—Þ^}'½ÂWuõ…`>Psp Eiƒ.ÿ¯×øŽñµõ7q®{pe4½¢Ðý¦Ö„Ž›yµ$aø”7AIÿÓ¸B×qä íìØ]¶6Ck ò²ÃÎÀO5»܇ª{å _žæœ&žæU‘íª!ÉâèsÆŠc„%.+ÒìqžgÊh_!Äa€òt¬G9}#ï Ü|±eè©Ä¹cK»€zÎTe#¤;I+”3S­ü4˜6$ÜäÊÄp5$i§1>{B½@ͲìßijqKÂ0ß/Th}kÌoéJ°WúŒ®Îh"Ë/+*¾>ªÂ¬yâÇPÜ¿û÷_½oêGªØÒIA Û^vt°ÎJa¨Ü3]þ‘†à<Â×zz§»ììåPäRÃæÒÖÊúAh&}áÓzÝ¿!À‰¶TcZ,kZ(QKú# kèÝÁwÎÛá~Ó2¿ZJ}Ô¿Bó“’•§èº¡û©ÊKÌ)@ª‹_Ǩ:ƒç¦ñ!¯+Hû³6 Üg²=r͵‰Ý¿r”BtJ ©þoäzaRÇxúPÖôåt=T™Ýµ7# FÏ^vøǼýG4voRߦá¼íDPƉ陡À‘ž3éÔR=Ãñ¿ëÛendstream -endobj -3900 0 obj << -/Type /Page -/Contents 3901 0 R -/Resources 3899 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3881 0 R -/Annots [ 3904 0 R 3905 0 R 3910 0 R 3911 0 R ] +3968 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 592.061 539.579 601.083] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.3.6) >> >> endobj -3904 0 obj << +3969 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [470.223 690.985 512.306 702.977] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 578.511 539.579 587.534] +/Subtype /Link +/A << /S /GoTo /D (section.38.4) >> >> endobj -3905 0 obj << +3970 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 677.738 193.489 689.428] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 564.962 539.579 573.985] +/Subtype /Link +/A << /S /GoTo /D (subsection.38.4.1) >> >> endobj -3910 0 obj << +3971 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [293.723 140.375 341.14 152.065] +/Rect [521.223 551.413 539.579 560.436] /Subtype /Link -/A << /S /GoTo /D (diagnosis) >> +/A << /S /GoTo /D (section.38.5) >> >> endobj -3911 0 obj << +3972 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [225.07 126.826 427.223 138.516] +/Rect [521.223 537.864 539.579 546.887] /Subtype /Link -/A << /S /GoTo /D (problems) >> +/A << /S /GoTo /D (section.38.6) >> >> endobj -3902 0 obj << -/D [3900 0 R /XYZ 85.039 786.531 null] +3973 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [519.586 513.406 539.579 522.974] +/Subtype /Link +/A << /S /GoTo /D (chapter.39) >> >> endobj -58 0 obj << -/D [3900 0 R /XYZ 85.039 766.606 null] +3974 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 499.856 539.579 508.879] +/Subtype /Link +/A << /S /GoTo /D (section.39.1) >> >> endobj -3903 0 obj << -/D [3900 0 R /XYZ 85.039 748.602 null] +3975 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 486.307 539.579 495.33] +/Subtype /Link +/A << /S /GoTo /D (section.39.2) >> >> endobj -62 0 obj << -/D [3900 0 R /XYZ 85.039 610.22 null] +3976 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 472.758 539.579 481.781] +/Subtype /Link +/A << /S /GoTo /D (section.39.3) >> >> endobj -3906 0 obj << -/D [3900 0 R /XYZ 85.039 578.694 null] +3977 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 459.209 539.579 468.232] +/Subtype /Link +/A << /S /GoTo /D (section.39.4) >> >> endobj -66 0 obj << -/D [3900 0 R /XYZ 85.039 453.924 null] +3978 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 445.66 539.579 454.682] +/Subtype /Link +/A << /S /GoTo /D (section.39.5) >> >> endobj -3907 0 obj << -/D [3900 0 R /XYZ 85.039 425.126 null] +3979 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 432.11 539.579 441.133] +/Subtype /Link +/A << /S /GoTo /D (section.39.6) >> >> endobj -70 0 obj << -/D [3900 0 R /XYZ 85.039 313.904 null] +3980 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 418.561 539.579 427.584] +/Subtype /Link +/A << /S /GoTo /D (section.39.7) >> >> endobj -3908 0 obj << -/D [3900 0 R /XYZ 85.039 266.376 null] +3981 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 405.012 539.579 414.035] +/Subtype /Link +/A << /S /GoTo /D (section.39.8) >> >> endobj -74 0 obj << -/D [3900 0 R /XYZ 85.039 183.05 null] +3982 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 391.463 539.579 400.486] +/Subtype /Link +/A << /S /GoTo /D (section.39.9) >> >> endobj -3909 0 obj << -/D [3900 0 R /XYZ 85.039 154.252 null] +3983 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 377.914 539.579 386.936] +/Subtype /Link +/A << /S /GoTo /D (section.39.10) >> >> endobj -3899 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F56 2890 0 R /F14 2895 0 R /F11 2898 0 R >> -/ProcSet [ /PDF /Text ] +3984 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 364.364 539.579 373.387] +/Subtype /Link +/A << /S /GoTo /D (section.39.11) >> >> endobj -3914 0 obj << -/Length 2306 -/Filter /FlateDecode ->> -stream -xÚµkoã6ò{~…Ñ/•k•EŠ,pX¤Ûí5E›Í]ŒÛÚUl®-œ-¥’Ü4ÿ¾ó d9–Íb±9çMÎXNü“«c¡Ü$³&ÖJNÛ 1YÁÊ¿.dÀ˜”Ùç›ùÅWß™t"Eì„›Ì?õtœˆµ3“ùòçèÝ÷—7ó÷ÿ™Î”RQOgYf£ï?L}dàü¯®oçS«¢ËdÀåõ·c:“Ñû©Œ·—?Áì_Nÿpñ~Þs:E*…|þ~ñó¯b²™~¸±rvòcKç&Û‹T«X§*Ì7·ÿîiñZ:á]cjé0fÒÅ.ÑçUgLl„éU—Àj«Ô ê¤Lb%“I¦ulÒŒt—Ä(L§.zWm· qU‚ü&‹Þ×u5U"ª›SÒ*gÙÙã;R,Ù³£dœ8MìÌ×~:Kl}BV6› -øP”0[ñÂï;{4KÓ.4¼—K$QÑÐê·…•oyPrΫžpI‹ßvÍT­É·Ó$‹îr^ÚæÅfÏ€Š6Eèsà_óZàA.þ@-3‰ft$f¾Ê‰d|J·ÜÁœWmÒZÆNë¡fµHjohI´¶ÑÇõ#ÚÙD9ٳћŠÛ¼| س½ƒ±Œ– ¹ŸÂ¸®´ð " ¦qÉçmQ® ¿­Õýøö„ B(ö¬¤œÓNdL;eIÔßn§¢™RmÀ´y‹#MŽ]¨, ü»bîfÇÑ9p_^òüòê ¸C#³ÿ}Z)Ñq+¯Ù•R Ú[Ó¬àctTí+9jÉdŒ–÷&e_ÏƼæO|lûM[íV: › À˜âX2eMô€„ò†'¤‡¦Í7Œ -¢ÈQ…Œ³ßml‹¶%&–ãzØÔ…’¼#¡YvfÝÎ9ÈÇ~@ÐÓòvDÚ],AKž'þÏ{Ò½¯ _.zö`%縬ðèGÝOÑ_ï6¸‚ó‡X…ï€å‚%íÎ55 -‚¤SuÉ®u‰É©;8ÿê;m>©[k@”£ùcK9Õ‰h†¤nv¼åÀM»nCP$jô¤b Ù{¨ W´UïWxYÝã¬ZÕ9Š¨ …­9q6<%ŠˆËvÄe–xÉ`B øl™¾òÍð Ú² uN³>ì©>‘Ï:òõmU²Å¾þ’¤ âeûíŠÈež ;4$›¿j<ÉI”áS[r¸6¬ @E ù¬óZ@^¿©|,›¸nOÎìù6R³'7{áßb¸¦Ñ‡)¥9¤°ì±}8ºh™*€yæJÏ—_Uú³&bG>à9Hut¹¡Ì fè‡Áà%ù -…EgKº]k38IpjîCáùÿ»L‰è`úô›2¯»þ]ó27ŒÅ·_²Û«¡ÛCÄ+ Ëo‘«r‡vÕ‰ŽþÁŸT8ãò'ßV»²å1z~ñ¦©y|ç)&p´–!ÜÝ×]]hˆÄÆ.R8Ž/›"ìÄ7Ýéi©4ð§$ÜŸ7¾ àܬP‰üoQ·;Ô±Ô™ŽL:»Cå&öþÔ®ëe0¼ŒÁkÜ>N >²ÙÞááP - -§H'L8ZZ€ZÈ,ðvÝ™”Ý*IyHÜ(@tR¤Ç´u*ÅH.Œ8&!Òó쥙;Ç^G\»ì˜?k²óÄ¥xñT'éñôâúÄ¥Ó¬Õ6yÆjêVY2F;{†¶P/ÑŠülÄ­KÍq“#ž: õØSd£ÄÍkËØÏE\fFŒ×‡xpiñê´;­—~6âÒY›¾qgIvp€s2y=ú³ãmŨzÒgNÐ/I¾^v§z«Ý(ñäâ/K‰‹ÓDž'ŽiéN#åˆÊSq^-%'N—?ŸW-^áO_øœø:Üó6•o@wo¬JºF뛑gý *×L‘€»†ž¨È.<ƒ%x.^ÒùÊ3p™‡ç"þ›âèA˜@ò}¹©»J²î[1tÆ F ghzžç\qV%ž¡ÔÂXèN©]ÐhÙ^ÓtžñDdšª;zw%ÖšëâÍ°PWhë-ÉC¥P±È©Eº’TEßV[l Ñø]E,µ5÷Â|Ýħê¦+x 'Î@…ƒÕÑ®æYóØ´¡¾†yÖ‰ƒÃës ñamÆмa -9O?^]ß’£Veƒ‰´· -Ü¿ÇEr½Ê7Æâ2Çó„Ê DûbMÂŽî µÚøS5TQv½‹–ŒÀ¥*6—¨ÖFå¯P}¨Â.yi¯R„îUŠý)IóˆFe Â74™ú*@yXÊùÃJŽGþkÝ&Gš#{µ†šñ@§èuJ¾‰Sקbê6aÝRˆ  r±÷V…Í -ªë»¢´ Å!5 -([lü ½ÆA(¬øý°UK"žtߧqnŸš]ièÜ[JœeG~"Éò©žŽ;ìOaxú’·6÷9uGÊ@3çOOîç#å6/|¢Ò™YÀäy_ŸÌˆ‹Má9Ž¹7¶è“\éiÜ1¯C¾ìø žŠæœW°S×tí;X]cã‚úpYç£Ahr €r¬úà†»»ö PŽŠa¤n1˜ ¦·ˆØ;þb3jÃdã½íyÁÆåsŽàãK S X¥À|ºá G)¬„ ìŠÐÙ€ÛýÐé…3¤Ã J!|mêç -¥ã”{Úćÿ,òßú¬ÿ) µ±³Éø/ÞpPÖwÌÐ#Ô=eX+k«F8þ ­Á§endstream -endobj -3913 0 obj << -/Type /Page -/Contents 3914 0 R -/Resources 3912 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3881 0 R +3985 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [519.586 339.906 539.579 349.474] +/Subtype /Link +/A << /S /GoTo /D (chapter.40) >> >> endobj -3915 0 obj << -/D [3913 0 R /XYZ 85.039 786.531 null] +3986 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 326.357 539.579 335.38] +/Subtype /Link +/A << /S /GoTo /D (section.40.1) >> >> endobj -78 0 obj << -/D [3913 0 R /XYZ 85.039 766.606 null] +3987 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [519.586 301.899 539.579 311.467] +/Subtype /Link +/A << /S /GoTo /D (chapter.41) >> >> endobj -3916 0 obj << -/D [3913 0 R /XYZ 85.039 744.844 null] +3988 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 288.349 539.579 297.372] +/Subtype /Link +/A << /S /GoTo /D (section.41.1) >> >> endobj -82 0 obj << -/D [3913 0 R /XYZ 85.039 700.36 null] +3989 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 274.8 539.579 283.823] +/Subtype /Link +/A << /S /GoTo /D (section.41.2) >> >> endobj -3917 0 obj << -/D [3913 0 R /XYZ 85.039 679.163 null] +3955 0 obj << +/D [3953 0 R /XYZ 85.039 786.531 null] >> endobj -3912 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R >> +3952 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3920 0 obj << -/Length 647 +3993 0 obj << +/Length 241 /Filter /FlateDecode >> stream -xÚ­”MSÛ0†ïþ.ÈoõaYRoBá«ÅN‡áàÆ&õ$Äà2ý÷ݵ7@(‡Ö¥Õjõî#­DÈñ¡ÕÀ• MA+NîNqäS z¸w‰7|ö²àÃaš„‚ƒã.Ìn‡8Žƒvi˜×lÿht™¿D±RŠIˆbc,;ºˆ¤eß¼1»ðÿãó«,²ŠNO½at~Ð{D±`ãH0tè W£3ìí‘yÝd'Á8”nä"”"Áõ  Ìé$à œ WØæ œ ï‚D+Љêûóà*ø<ÄòcIègmòöˆ…'õßÑ¥)¤<ÐIà´&tBHPB†FkHÓ±“`ó$jZsvŒíÝ;$¦lZ¶”}[¡m1%›a;õ=6+/™ÈÄ¢ºtþ..Ñ[‘ÄëXñF°×éH-Áñ,ú~^£@Î&³W­!ÍÿØÇzG SÀz&°º÷ò>Fqb;Œf^ÍqYxÄmíÿ~j¬3Êç~_¾ж\úÎrH—v¥Ÿq[GhkˆžËÁ¤(ZPB^E^MIQ–}Ý$Áñ1·@Â,7M¤\Q;_ú5÷óÅ¢î—Ê—¢š.|·)Ëe[;¾_õöögÙ'ƒÞõtùVE)ʼsÄÿøtÈ…Þ¸†#.®»d¿SÅ׸pãK›€âÝ€GY°ù$’†ÍüHAû@\žèÐO¨EºUÂ* -+*¤õî+šZ7h™U]… mR7MÙÍl)×_´81Mv–ÏèN*½c­Sµ^¢Ýíw; ,h1Œ oàRÿ¼¤…]îßî¦9Õ£•Û‘ki 5ÉZ Wü¥`­,h«¶(þ çqTÂendstream +xÚuP±N1 Ýï+<&CLÇN²"•ªL Ùà Z„T®R¹ÿ U‡28ò{ÏïÙ¾=‚,è¹@ÊŠÂÏ׆lZQ%Æö_Ýêg,1¯’'1¡dîœÛ:ÜÜÁ£*C=@È„œHPL‘ ¾<šËdFËÞœgëX“ÙY2hŸêý·:bÊ©«]*¨Í"ÌÄ_âí~²ŽÌþ<»VÍnúhê¹7[‹ÌqœßZ9õÆÔg›úzÉ5aÑ°¶–onPBù‹þ»< F¾ìNä±øÒÓ³WdQX8=}ÐëDÒ.ܯwtíù 8Â` endstream endobj -3919 0 obj << +3992 0 obj << /Type /Page -/Contents 3920 0 R -/Resources 3918 0 R +/Contents 3993 0 R +/Resources 3991 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3881 0 R ->> endobj -3921 0 obj << -/D [3919 0 R /XYZ 85.039 786.531 null] +/Parent 3990 0 R >> endobj -86 0 obj << -/D [3919 0 R /XYZ 85.039 766.606 null] +3994 0 obj << +/D [3992 0 R /XYZ 85.039 786.531 null] >> endobj -3922 0 obj << -/D [3919 0 R /XYZ 85.039 732.329 null] +6 0 obj << +/D [3992 0 R /XYZ 85.039 547.583 null] >> endobj -3918 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R >> +3991 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3925 0 obj << -/Length 407 +3997 0 obj << +/Length 2820 /Filter /FlateDecode >> stream -xÚ}R=sÛ0 Ýý+8’ƒP‚àçÚ»$—]ª-—AåHW[òÙÌÿ/IÑqÜÚ> "ˆ¼÷ “éCæ H -Ìy †½íV’½§ÌÓ -+B£u:_I6§lcHí®b*Gã”íuÆ|oWß•dJ‚µÄÚ CT@¨˜ Œs¬]¿pÑ#ù£ äÝ1Š†¬ã¿b—ãC 7³ ÉK‡~9< ä»}Ç~Šâµý±zh?U=60öšbÉE@ŽîÚ±Nz÷Õj m/ìÊ©j³!øOÑ ŸcKY-ºË~Æv4 %.؉ ,äí0E£‚ãoBy>tû˜ž¨ÏBùÞòõ¸^“Èâð®û“áýõvœ„ -<ÎK‡Tpê~è·¥iw,¿dX“âÏqi}Bí·]f™úJ¹™«ˆ2À‚HéßÛÚùpR[+2OW2åóÌ0¯b(nçMZ¢³4"*“¯TíÓ¤º¼"¥Á”-F¸1 2 ébnå ý&$-PÚ·Š) ÿRò`<Ýáü ¯MÐ×endstream +xÚkoÛ8ò{EP,PyQ+’(ùq÷áиÍnm4>t·-Ó².’è•èf½÷çw^”•Ø),r8œΛL|Á_|1ËÂHÍ/¦³I˜©ø"¯_E¬üô*Œ4Sa–¦0>³8ö«ãIFéô,ŽðO“4Lg)â\-_]^'ÑE…“‰ºXn¼ $JfËõ¿‚8³, +nFqиv4Ž;«(XïsWÚÆ“ià6™÷¸®kÀ]éÑ¿—õaÙ‹ðŒø÷„àqvGá<š…TY˜eSò?À]©àõ͆‡Q2 ìž'ûÄY›¶sºY3èq íp’öÈqð¦5¼¾¶%n*Þ¾ˆÑXǃÊè¶)Q9tƒØ‡,ʦáóšÉüÞ5 µdjR&’íá ª 41N¦a4gý߃6¨sœ¦³ ìø+Ó_£8­€€ÁéyÃQyiö$aC:ƒ [€C¨Ì`illË8_Iêõ­ 8ˆÓWºÃÒyU&,Òì;ÖÏ–ˆ»¸À%ŽnîXH [#‰U/Wu:¢‡ýzNzp-ŽäØ@CmÑ™ +v­u$ðDÊI©¨tÜhÜ4ŒµÑ¹C{fó ”„«e(£1vÏÈ‹Aq’‚ƒÇÁ§«Ëìgc’eÓ« +5„hG ‘Yð¹1¼b7Lµ·ë›ŽV¨ùs'ï\kšÂmQ}Ñœ= ŽXèÃì'9 {´8⢺ã6ËCäXŒ‰! ö {âÎßyŽ’ã÷+ÙhÍþ!ÂôŽëÙéöÇDIçÝÒfR™œÇÙ‚¦ìíPÿ±¤X²{8A2I‚Öü¶/[Ž.†hþ°îtKÁm¨N¤EØíò2‰¢Cî‡^8Œr£4‰‡qˆ¼J!NU2~uà•ym÷Aˆ½Ÿ ¶ÝñÖg¬¾§K!»b°OfAQÙ•®äŒdZZ!Ó âŠb€¬èxIEü= +ÊóžÍ­®É:üh=Ž‰YdТ#e£+ +S†~ÿLDåxŒ$>´Dë7=ž9õr4SñZ¦ªÂjH–$aœ%ß­!_èâ4TédPCÒyNç‰:*u ®Ä]ãà¡h-¦¨óR¤ó(Œ¢ïK1Ày±’¥YÎøüŸQE”–ÈLP^,:9Žta!}¥ó, pèý“S4×LÌ¥ØaT°Úÿñ™Ñ¶dŒi[Êã°îsîè˜ÌûÅÌÛ_:fðEÈëËm)´;¬œoùWÈs¤÷¥ÏÕŽ"uEù¢³/lÍy2°óÅ4çÁJ%ßÔÚ¦–œzù…(Õ)¦ID’¶’ÿ… PòÚ„…®ªŽ‡}ªò\,Ž:ß9”p¼~ŒÜÈ°âù¹Fk4èj©àÆ=Ý}zÞA8a–Ö¼ÖÇŒßIª*{ùóÃXHHmT™Þñ$#üeÑ­q\ÑÉйy6ØZtïË8²isÄ¥>†M—“zZÉXX{…ÂØ6|žÓ#·TgUÂ}´eÈ?Þßf)&Zœ}ÝÁtP {CP‡Å°¾PÑE|Ëßv/¤ì ×éS®Ëû8LÄU­g«eSézî˜T«5#s’•F0ÕiWr-•î Ö©Þcd-|³ 5´–*ŒÞJ{GÉ šañj:_Œ‹Æ¬¹ïXVué{JFZÀ]Kê±`ðyĈÜ0ÊO-UˆÐá”p íä$÷œ$ .Îuí3}hž4‰Íiá&{Mæ˜S.¿Üù㙡|B·Ê}³l€l‚MŒg†Øšó òJ «O^®I'j: ¸öoÉÈ€¶lx´Ó¾‹ƒÉIÄ\$È›-ðfTeÞ·xÝ@&‡)ñL£j8lH=•-èÛoQƒ)‘L¦‘„*¹Ï{•áóú†=™ÆO‡s8!q#_=iU:FÑôMH½÷O”Ž|¯©¼b²erh:ɧúÊ‚rÛä5·,×±µ{1—— GÛ¾Õ@Q¨yD½¯òM415Ý›všið‰Ý½Ó…¸â”HÆ"í>ÈÍÌʧP* ^Ëíî5§(\ÆûIqŠ )ñêæóýQs9’øóýüõô¼7 §ÎËÏTãvÒ{%jÜ:ÇCýfD“z=«yðzËA$ââr.)YòJYq"¡Œ€¦×<'µa‘Ž“àŸh^¼ô|P:LÔ4¸G#Z†&©Î^­ŽÒÓ­!³Ëû²÷ºÜæ¢E…—}CÁï=é„Þ{ÒK}*spA»q¼Tëöé8?!¶¡l ¸X É>å„ß rÝwkˆ}´¾G§G&W¶t3E¨nÎåë–”Ôøû´Š¦Çü/p*‚ðrRy6<×x)>ˆ îŃá +à¥iÆphÒê¥ɱ"¾¾";…d³õmoÁ1üÅqíL¶â~HLˆ0Cªáð͵“föŒy›ðÉ»Cï8^‰òŽ^9âãËU{oî|GA·¯Á žÐ•ß[Äú¸‡<¸,Jɶ4¯rzLiåÙ†â×r—Dí<å4ž´àÅóùÔoue^ Ø•®âfaÁ¯UyùöÅ‘•û¦éLî³a[ºÒÈûä5ÚNS(Ú}N®#=Á(_^g³Á÷ÙS¦ù 0ÃÎßD"ˆXœzup†ÞSX¸t‹ü—ø¼ÖRN·¹ÒMhQ¶å7ÓQï=B49þš:@{ÜÂÍeG,é×´ûËõ2ÀÂOI•¸cïÜ )št¼‰ø?G¼×õŠŸÎí±LÑc#]¾°šG@ã{Ï߇Ædæ÷ÛŒž<ÆL“Švæ-7ñ`X”W¥s|„h혴ùݱZsÇtxó†4bkž­à²I·Îž†èŠ—YIùÌ×hÚz×ñl«¿™³oT^=x³H&oëÞì+|ý øi,å‹‚^{!D¸[–t_l=•Áó^æužyß%5Ö”éÇõû=vç m옺edæ´-º#mÙÿ²aô¾TT…]Ë#lÍõ<§‚;*-·ã?â%DQß2¦k½‚Fº.»®Ï®°ºóêaþĪ Ãã‹õ×m)oúˆÅ‚.ÄÓ4ó–ü?¹ñÐueŠÿˆ`ב)·ß°éQ²¥ 9UÏ̆Â4|f»ïäA‚HRÈ9~d dç›~ºòR¹·r¨C–7‘2d¤]ðv¡:_éÝŽ•+[VÝZºË_¬ý(î–Ï(«ÜÏšp'N€Korò sx+Wx¾Ôã+‚œ„û™ƒ44ë½ì¡{á PeaªÔððÅ—À#êéC Ô°ºPO5šLŸ³ÌÔ,Ìfê;<ÿÚßö endstream endobj -3924 0 obj << +3996 0 obj << /Type /Page -/Contents 3925 0 R -/Resources 3923 0 R +/Contents 3997 0 R +/Resources 3995 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3928 0 R +/Parent 3990 0 R >> endobj -3926 0 obj << -/D [3924 0 R /XYZ 85.039 786.531 null] +3998 0 obj << +/D [3996 0 R /XYZ 85.039 786.531 null] >> endobj -90 0 obj << -/D [3924 0 R /XYZ 85.039 766.606 null] +3999 0 obj << +/D [3996 0 R /XYZ 85.039 766.606 null] >> endobj -2949 0 obj << -/D [3924 0 R /XYZ 85.039 672.187 null] +10 0 obj << +/D [3996 0 R /XYZ 85.039 766.606 null] >> endobj -94 0 obj << -/D [3924 0 R /XYZ 85.039 672.187 null] +3017 0 obj << +/D [3996 0 R /XYZ 85.039 662.656 null] >> endobj -3927 0 obj << -/D [3924 0 R /XYZ 85.039 647.469 null] +14 0 obj << +/D [3996 0 R /XYZ 85.039 522.152 null] >> endobj -3923 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R >> +4000 0 obj << +/D [3996 0 R /XYZ 85.039 479.199 null] +>> endobj +3995 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3931 0 obj << -/Length 252 +4003 0 obj << +/Length 3410 /Filter /FlateDecode >> stream -xÚuP»N1ìï+\úŠ[v½Ûm ¨¸(N!D)H¤Kàû±“ƒ è%ÛÚÍì 9,‡\R@Î.&erËݺ w M Q)ÿ°ûA»À ²¤YÒdÒ©DÐÄ•³è›«Û€. ˜±ëß]ˆLÌi0ˆB®{ö-“ZF?ÚŽ-úûò`¹ÉCûÚ?œ4bŠU££@DË^ñQäi5~­ÚŽüX%Ì_ï¶/H²þ<ΆÃf·=‹:öE{³ÜWõæ¦ÿ 1e‹-ÌÅÄâÊ4ä¿è¿e°‚ð¹ RGsÍÁhÀjnâÔ.7ÒÒxmó,téù ÀdÍendstream +xÚ¥ZKsÛ8¾ûW¨|YºjD“Ÿ™“í$;ž­8Ù±R9ÌÌ–h‰‰ÔTïüùí@H¢äÃTªh A‡“þ…“<ñUL²<õN曋`²„™_„B1’©Cs;»¸~Ÿ¤“0ð‹ ˜Ìží>Eà'E:™-~÷î~¹ù4{÷ÛÕT)å…þÕ4ËrïþaöÛU”{ß~¾›Ý_MCïãUè= QìÍ>2ñãͼÅÙ›«?g¿^¼›YqC¥P˜¿.~ÿ3˜,@ð_/_ùä;ô?,ŠÉæ"N”ŸÄJ~¯//þk÷â¹x«ÆÎn(¦aáQr^?iê§AjõÁlì«8uõ“$~g¤ŸÐ@)I\x³«"ôÊvSÁ©kÍ2?8a¬ævšÓ·kˆ^»Ýs íír½]—ãÝýûG¼WÁ½¶Î…*s¡Ð¹¼k6¨º ÌÓÀ½è¶E-’†{žx_­y„Ðã¥ëKZˆWDZwCÊÝáª/,Hbr´³j°-º¬æùJöVžÞB«[Ã’e@~/#÷¸(çÕ¢\ðÒ~¥e“G ÿpË(g…/B‘ý;šdÓA•wy¿gOÀ¾ì/yA ¤ªz9L×ð\¿2L^xbŽ»¬t½4,+‘¬o¸½#0~ËOÚžJý89$š3¶'D¯ÚÞ†ƒíp·=‡ãÛÊÞ弟þÂ7Þ— °ÇTwúcoÃöµ²hz šÍ£U´ jõ[µ@ª—L€è°.¯É¡+c°¼¦[éÖ%%ÎZÕ¼Dh 7´ F|¦d=/‰ãäº'kÝŠ<õ‘)&tÌ]'`CñöáqÏ»”WëMÉsV]³Þõ#,I ®¤ÅbèäÐ~¹8i"I‘øy ÎšˆCsÚD Ñk&rŽ¡5‘CŽ£&âr¼ÿt‡Ö©Ñ¨G±‡šDšË{Á…ÂñÓ)v>±‘¦³†;^ȶAW'Lªæº¯šÑ* É‘dSö+kyÈ=[’ˆÖç°¯‹F4òÆ…› x…æ8*20† ñæ›}â…=îLHT +âÑ,[ü²Õ›îäõCz&çÓ$‡æÌõ ѫ׆ápýǯßáøÜtÛë5»ÚD’àÕ*UP@C‘¦< +gwɽΚD¥×ÕÿØùaü *¿ô¹ã@ÈþÚ9aÌ –ÈnÊvðiæÑF!oùí*I1ÉÐO&=ª…î5÷ºK¯Ÿ`êØ žÙœi«ksüMÅ)™N~«4w°Q†#k-Mû•çØBkŠVÔ· ‚K ÆÝÆ""ÎILî0p’­ÐCK´©Z¼BÜÚµÆ J^Ƨ¶Âhÿ‰nhìøm9eW/Á‘ñB—’H|%el(ÝФ[òðLØEÇÀ:˱{¡:6ºÝ³*<íò¤3`¤IqÞ™š3Î$D¯:Ó†ƒ3pw&‡ãCÙSÞ}ÿ“ Lú¢Ã¤ žbÿòAr;6¬œ KERèÓ5$Ü…XˆnÓ_¤f»ë™ú0 ¼ÙŠ’úH’{hë¦çŽæ†AnÈÃÆá³¥£K[$9­L2“0Àú¶qœpÚ¹|¼t|žÑX_˜Íd¬üQu=[ü:” +ëÆ05Ç‚Y:# +Ô&Úd“0þ}Uq"(?QÝxCC¥Ì²ªÁJ)½˜Fiä- 8q†²nœH³@’ÐÞ#’ßß~àÁ'ºiî?¾ôåWî–Q¹Â ‚+›]åŠ`4N?ðË¥ÅPŠr¸9¥ÌØ!°Òk¬–i™æá'ºŸPÀ”’]œ³X€?lŠ¼ÞŽh€òâ$â °ªÑ“P.ÓŒ’Ò•MÄa|ÎË–‹½®‘á²b¼ùöˆné!U–0|k_Dyàon(YOB ¬˜TRN²îŒ<%wl–gc:!°ø™,oŽv7zåp´8÷eÅÊñ°f׳Ì<ÅEí‚œT·%þÍÍw¤Ã!ÇÔO‹ß",À€?[œ'ìR%÷Ëã£áfhu°n´‘åp®ãÃÊ![®éù\×`€n³4€3¥ŒŠ—pŒcÖÇUÂÿ˜[Á 0ȧ Ð?¶Ð3ÜçšÑ«'G¤Y¿\qÉ&ðÕ¼M_Ò ÒJ}½~áq̾ZJÖ•fK¾\6[“¢¥X5€Ìã'…ç¼*µ–#–ò<ý`£@ˆß+P0õ`ݦcâuõ•Ž0ºôt>ßó­ÆW“žkÞŠÝoHðÂ-l¹"1!h&»\vÀ~¤‘cÎõ®“J´–LjÒvIž0Wæg6Y¢±|êMþ;T¨ó¦&°ãlÀàT’Àèáù÷4‡æt’eˆ^K²Î1´IÖ!ÇÑ$Ëåh¼‡oð [¬$Y'Y0Àµ?ÄC©8x9xžÄ x÷ƒl2´±?w¥¬+xŸ5—¸˜k%™o¢üÖ˜²±TñÑÔÌM½ýöÙ$lcpG `¸1bl")#ÃmLˆ!ÉZáÝ÷Û®;A,»EËáK&ÙIŠ‘¨€¥6­ ]W‰ñáú!¢™òƒ™gãX%è1ÞTjêrþAqŽj8úI ­dò*`ß4ùUæ `_ŽX0Ô@¯å®•“k,8ççš N¨R¢¥dj|#ð£Ë$$§NM1ä<›r̳”aÁ¹,çyµÝË8ýÊá[ÀÏ<ÀÅv”qyà sË󕀑®c.=×çØ•QYhÊf'y³u6©d‡š¬MvA±ßéžêT:½Ü°g0ƒŠ„”n(µïŠÆsâð ÄçRXÓ–²¼–í(o§äÒQ åÐÞWœb®&ÃE"…)èdÿËŠÓjŠi0dó·g÷†Z‡é3ä2&õW§Ø)<ÅÜ [óô|I!9W‚853zŽSï ÅÁ…½zYþ0“VJ9RBðnù•–ÖPL´ X-ÆCebÆÀ€“ûÖ8ÆÍÁÆ8¬˜šÓɽ˜Î1´éãh`r9>ÜÎÌ7¼(ÿ†íPýçn]hS2¤_k"þ^[g$"Ús6¼DÞÍzÍ”ïÈY†ÔÔì†xl㜶„R⇠,5ü8 +8¸e×þQѳ >ø§ü¸u‡/Ç×÷Ÿ°öyü¦ãV3ÏáÑ~·î%ŒFÁÒ„‰<óó“®nEæ^”"hÃí=¿XŸS/ÈK\4ÇÝ‚œko  Dk:%vÈA¡]HàÞmJç‹øBuÍD¿½Ç©;þAÈ=Ôøݾ°öUœgNì·~Ð_tb°…³ˆŽqÙ½-{]ÙÇ祂kçJàDrtöUbw*ƒÚóÖãМΠÑkùÀ9†68ä8š¸¿DÿyÃ:>pê‹I‘ý8ý…@u?׃ù(&à/«Ï“Øsø[Yì™Mö‘ÉV +í ç ¸:Ÿp $§õ+4¯©÷ 7«Ýv£ÊuØ}QÿP·êPoÆ%O½ø±Rã…&Þþþ<Ϫ=Îý"?adI”ùiaPQ~(p¢r?ÉÕˆÄÿAz½¸endstream endobj -3930 0 obj << +4002 0 obj << /Type /Page -/Contents 3931 0 R -/Resources 3929 0 R +/Contents 4003 0 R +/Resources 4001 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3928 0 R +/Parent 3990 0 R >> endobj -3932 0 obj << -/D [3930 0 R /XYZ 85.039 786.531 null] +4004 0 obj << +/D [4002 0 R /XYZ 85.039 786.531 null] >> endobj -98 0 obj << -/D [3930 0 R /XYZ 85.039 547.583 null] +18 0 obj << +/D [4002 0 R /XYZ 85.039 766.606 null] >> endobj -3929 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R >> +4005 0 obj << +/D [4002 0 R /XYZ 85.039 742.055 null] +>> endobj +4001 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F41 2994 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3935 0 obj << -/Length 3140 +4008 0 obj << +/Length 3177 /Filter /FlateDecode >> stream -xÚZÝ“£¸ß¿brO¸jM‰ßËÕîe7Ù«ì¥*ãÔ>$y` ¶É`ã^ïü÷é/ ±šªAH-u«ÕÝúuãð)€¿ð)‹ý@­žÒ,ñc>mŒüù](:V~¬5´g—ft™D~ ÓYá±L#íëL#ÍÇõ»?~Ž‚§(ð“D=­·Oaù*Œž’ÕÊÓôi]üÓÓþbÇ÷\¶ßËv±TIê­«Ð{;ÁKà•÷åÇ‚ÏåæÜV‹Ðë0üÆ_á½fè0áßëßÞ}Z[áD¶dûqrWú„„ã§0ðWÁj$AU¹j™Šc³¯£†ùÚZöµå¼´Ö«nǬ°9Õöþîκa(L† à¹ç9Õ–ŸÄ€Ù¹ÌP€†ùzÞX7Z¹3BHªŒèØØç.Ç5 ôÕa´²Y c2'Ÿ²bóÍz#Sa°Æ“q~¼BŠã&ZCÚØÔ¤Ø5¿UÇéð‹!ýMí&ë1]ÞöF˜û`QÔ/b¦'?Ћ!ÿYƉ÷ ¨…ÔF?Z´9[+Á)ëǦUî–ü°lãlù "›"•Ñ8¶!Y¿§‰òW>týÀ6h¸®Ä¿e®'4qÍùñJõeF7ds<§ÉE·8ÒìåJÃw²K ©Xƈ#ï|â§p¨™ÙaìäfÅ"LÀçT—×8©íh»G.s¡ß# ¹¤£8DËeAðå:{ê-¡C y™’ÝtÕÇÀã´‡Ê-ÿœMh¶Îw}ªHûŘkI - ?w×U«Ë(ôã$~ ËèŽ.…è‘.ï14ºœò›Õ¥Ão„SÄdÊÚêtÊ0l¨N;€»9µÀÖÄ5&­ìyáCÓ–L»ËúºäÁœJ {qúj#Ÿóˆ^†¹¼Tsn(åG),¼8‡ìxš Ó”z\…6 ±­Uü*ßš L‹È¼Ã¡`=g)áJû:Iï[ŠCtÛR ÑK¹ËP,åŠßœ¥¸üþ¯sJ×#LDŸí¨ÞW'QÆ g,ôYÉÔ‹1Œå}þ’w÷€Ma”v,núd˜ÁÂ즢;š¢Gš¾ÇÐhzÊoVÓ?ªƒ¨D¡~š³UL$qà”θœAå ™†”gid¥k -ÄM\œ“„NÒ #…|í¬8ã&¬˜D¦¢JÁƒNµœ©wž;SQ:õÈ‚Î5aÏYv–¦±‹xÔRC^[L -Ô»¡æ‚¯c«ÄñvÀ¾ôÕO'6ÌŒ3Jé)ž`‹Â<9,,g‚Ë€è":pA‡Cº¥Cóý›þ -òÆo9Z€²@ìíªÝQjOz#_M¨ô¬o5†ò%vû ÌÑ¡$ÞÂÓ -ø~æ6FÎæ<ÓXÍb&‚àÇ­¯a¤ülþ2ö³Csû«FÄ~¶Êä«F$_5žñp!w~åñ¯\HÅ7d -”Ù}™šÛŸ22¸A5ÿjåÃägÝ8ö}­6ö‡ˆK§‰òjS·~R²†¼•°—€)W³$p §„9¬ÆŸ•)‚¾Ü/ -FÎÙ‡qÄŸoÜ”<ˆ·Ííp+4¢í=nl§Ìæb­Ãlörç/áçS11¥Zò¢›f5^ ¦‚ÄWqb–CÁ”š²ŒUÒ«;<ÿœ<8dendstream +xÚ¥ZIsÛƾëW°t XeBX›s’”ø=¹´ø‰trHr€H„ +ZV~}z›ÀM‡W.fé™éîéåë¡Ü‘ÿÜQØŽŸŒ¢8´ßÍ7gÎh3ÿ9s…b"$“ÍÕììâSŽ\ÇNœd4[š}Ç’p4[üa]ÿ÷òËì×ÇñÄ÷}˵Ǔ(Š­›ûÙãØ‹­‡_¾^ÏnÆ×z»Ö=)köÀÄÓË;¼ÂÙËñ_³Ïg¿Î ;=†]ßGfþ>ûã/g´Æ?Ÿ9¶ŸÄ£Wh;¶›$£Í™ +|;P¾ô‹³éÙÿÌ^<§F¼êìÛAìï ï„;T ³O”Zo(lµåÎ HU¤%w*ù®²¶ÍK˜Yq/ zÖ&}ÆåNDV³­J:mÅÔ *i ãOÍ›H’?'^´KÙ®3nLÓ îú”r÷.Í \TÊù·yÓrëO'pR$ý>+͉û§B¶IÛcW£<ÛÑúÄñz%‡¬ª£>®X¡AÅ®‘¡¶EU~¼¸x}}E©mè‘&´hvU“Fw8te{ž;dqçÊ5ÍiÎvwBÖ@_`æG”âyvòžƒu4t ³ÊöUØSEçºÛ˜kûàUJ¬Ç¬HÛlÞFÖ—ºú–ÍÛæ'aëâè$'=š£—¡íEq2[g5˜…ïùVªs2Wì¹V9ö«-ÞpƳZ¼£×1˜hŤ%ÛµkfÀeêg&þÓqU‘5ot½m¶‘Í‹<+ɸæPÃn`§ ;‘6<³„0jߢ Ó²íae¶Ü2|/ÐjÙ=ãÇk£c\W¡vAiCHBZ0Žõp_[›j«-¸•MEœmÖÚZÌF( ~ì¼àlÕ +UqÀ„ÉbÈ%|—ÄÌçuEBVèH4áX¿S¾Z0Û §4Äó¨¾ 'n1áùàÿwi šª™dkŒŒûÈRw2`¤EBJv Øï¥6îÜš»n*öÞ½á +}=é!Ñˬ—p«ç†ïÉO’Nº$¶Ò9ÅvÓ†Ç@Ǧü„[Ì 8\ä:Ë&ÀÄO“. ùµÌÅ+¡³ÈÍÎÛª~Ç +ÒÛ,BC.Çñ7éiq‰ÍBf—ü5V„ÍWOpŽÝnSL1lT ÀÚ8ps·ÙΑH¢Ïn\n˜è5o×d¤²×i<#tÁA‹^çx=£æ;«Å@kvœø'ãNæxÜÑDïÅSš¸³{âÁ¸Ó?‘c¿xû¥žz]m(> 4ı1 iB‚JŠÄÕ°ýoxè7´¦ºÝ‚•kb^Nô»AКpN§ l\I¶>ïE;L¦¸Šâ|§wWŸ‹|Š}Ul°‚ 2EÀɘ‡Óy›óÍF€°¹È¤_½°-x|ÉÁ]ú1¾á.Èî‹· [Pô£€x *uŒÓÕR6һ쀘ÚK”à*¦TÍKzqHüh_t8)™ÔáàaÄ.BŽm!‰ZÏi/ä¨Qé;®\h`°€Ô(¼ä»PAA,êC( íEQܸéÙ NSè(᪒ÒQNqðM¸)çÎ/ÌuáÛ£j +•ÂÊ’@W’pˆÛhäë<«)ÆS–\çÚÆÒ‚iðœt£SCuÏK:ÏÐZ±*ru¤x™ñ1z²mL°‡áFl6§›†Ømú„ºÈ›õFCÓ˜¬¨¿{º›ã¹6›–‹+Šn¢ôý{ž§\h‚^ä“ØÕ gzÁ±õ,"yq`Ñ$^À˜õ€‹p($òµ<Üä«’÷¦µÊúÊR`ªkʘRç,/òt¶Ááž±ÖeÚ²/¤~ÿ!Ù‰Z•oW’éä€Ô;º$u}ؼ»BâØïŒJŸ¨]èÌ8È#‡H(œv$3¼%öWu*ÛQºÏP‘@±î;¶st¹JÉrñv1! ?ÁÆÊcM¡½0°®[“c|ú–„š2^cQtX]é‚6&½1jÙHHЬÊÙäÊÛ'í÷UHû ÑñÚFdÑ÷‹¤ÄǺ¦ð¦¢PÙ¹±’ã#£/æn¹³yÛ'L›^òÞ‰'J_°7d¼`˜ÔyŒÃ\tµPWØ5¶–®ÕI’~¡©•¤º!¶Í¾É¬äî”H=§ G²®"¤zŒ®Wžò¸»"ë›sŠzƒ»#µcfܲƒóNiÃË0}ì@å'vŒ ,ï<‡ñ¤G½%vvD…|ë„’D1¬ð­ƒ»\°Ø÷â![»¯^Bsš›Àumljì¼®s‰äÊ ì$Œ†¨ó„Hf¶!± ˜»»â±A/°NñÌIŠmÖ »Dyò.£ä]fJ²„P1f‹¡‰USQ­ÞŽq£<Û Þᦣ9ú6ã;à2Š=f H¥NéUÃß‚Ê + ÐåÎCeI +m¸÷õ—/Ü0’»®qCõ}Ö^ÝgØ4`&è=DQF¶8ÍC$ì0³¬ê,®œ]÷TÕç8ŽnHb»ç:¥5½r’ÑÊ;Š;X¼ +Ç”¡y¯RØŧw8þ²d\‡ì•Ç@q«gó­Îp0¯KÆÌ5OîWÊLüJOGkÙÇV›Žà\š"dCщp-O7eÆÏä´W}zQð@÷º­´±¥ÿd Ãø‘W 4H€Z¼`ðŽâƒ/<‡o[§px8gâU¦Á•±œ´5x;Æ'9ÊÐî*Ft¦Ò!p¦Ó)Ìz¦)(U(—ÆJªjŒP²ß”<¸ÊÊîøâÃR=qæWž”AÂÖ‡ À.ÎÇŸ —UQèúãµÃ€æêEV<Ç<ϳ£ <Çz4ÇËtMô^™~ê@S¦ïžx°LïŸxÎ^ Ðæº*Ë.§²ŽÏyj¾Pj!õË/%®åOÈSRSU \+)S×¼ux.`BòÍ'k(ì „óŽ„sÑÎÚÒ{XÍ_ÀfB`óës“pF|òúz4ǯO½w}§4×·{âÁëëŸx>̱§Yç$4ðH×ö7z®xÞj¤èVácØŒéGªó(à÷ˆB^pùͶ=¿–ŠLÞKb¤ýÎ?‚{¼!À¦Ê®†±Ô’:~³?5\zGÒ`'ÃÀK!²ø‘~쀆ä‡y†mi П:L:?`…ãüÌG8 † ^Ç¥Ÿdç#ŒÈq'˜8PIkÙ™)]Úƒ{8?<ç˜é*°¼ðôïl=š¦+Dïšî‰;ÓÝ9ñ°éöN<7á=AÀ°ªÚœv¿PMÞöì¥*Ðj‡¬>‹¬{ßë•åÆz¡½÷‹/ÏÓ"›·BΛÝk3–BŽâÔ¼f„Â%‘'ÄûÉ0wzànqgj/¡Ô3üq„Ÿ=ðÇ5OY_®‘ÊGƒ¾xá «ˆö¡Pῲ֙<~ÂÈ„ë~wÀ^‘uÖ]0]Ø +JóB†›Þ« t«Àµk¡Ó8‘ü„¢ïbðKÊA'ˆ"¿â(dßÇVÇ?£˜…¹ý«ˤ2©}™”yI; —Ê¥úrá#ÒmZnÒ’Õ*lÝ^ÞsçŽpqºê~1óPbo_h2Y¯g[ \¯9|Åû]> endobj -3936 0 obj << -/D [3934 0 R /XYZ 85.039 786.531 null] +/Parent 3990 0 R +/Annots [ 4010 0 R 4012 0 R ] >> endobj -3937 0 obj << -/D [3934 0 R /XYZ 85.039 766.606 null] +4010 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 738.375 195.218 751.276] +/Subtype/Link/A<> >> endobj -102 0 obj << -/D [3934 0 R /XYZ 85.039 766.606 null] +4012 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [438.653 403.295 507.324 414.984] +/Subtype/Link/A<> >> endobj -2950 0 obj << -/D [3934 0 R /XYZ 85.039 672.187 null] +4009 0 obj << +/D [4007 0 R /XYZ 85.039 786.531 null] >> endobj -106 0 obj << -/D [3934 0 R /XYZ 85.039 508.603 null] +22 0 obj << +/D [4007 0 R /XYZ 85.039 722.931 null] >> endobj -3938 0 obj << -/D [3934 0 R /XYZ 85.039 481.989 null] +4011 0 obj << +/D [4007 0 R /XYZ 85.039 680.584 null] >> endobj -110 0 obj << -/D [3934 0 R /XYZ 85.039 123.831 null] +26 0 obj << +/D [4007 0 R /XYZ 85.039 374.302 null] >> endobj -3939 0 obj << -/D [3934 0 R /XYZ 85.039 92.305 null] +4013 0 obj << +/D [4007 0 R /XYZ 85.039 331.349 null] >> endobj -3933 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R >> +4006 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3942 0 obj << -/Length 3740 -/Filter /FlateDecode ->> -stream -xÚZ[sÛ¶~÷¯Ð[å™&ðÖ7çÒÓtš´'vÛé´}`$Úf#‘*IÅÍ¿?{J”’“ÉÄ¢€°»ØýöBéEÿô"OTdŠE–§*1z±Ú^D‹˜ùÏ…Š+!¹ -hžß]\—Ú…ŽT‹»{¿O©¤Hwë?–/¾¿ùùîÕ»Ë+cÌҪ˫,Ë—·—z cZëå¯¯à™¦íòî÷ŸñÛ-ß¼}É·8øâòJ/y÷úîw|óÓK¦ýëWwžÑ@m ²ùÏÅE‹5ˆôÃE¤L‘/žà9Rº(Û ›•X#ß7·ÿõ{ñœ]ðª9­À¸*`îÊD*ÏíÎaçÖë$6A«I¢R›y­ê$ЪNmœ`h‡[”k¼''é)Q¸üK„›LÓD™<=o·Ñi»uDŸ±Û³ŠÝ7g·áy·(¡lÖ]6àµÚÙÂTpHª D6üL ãÖÝ#Ð&Q¼$øzĽvCÕõn”Ûâ²O»?ð¤ó˜$’8†€QÆ=ƒQk–Ïé¶V¸ôÃ~Ç”gVñ¶%±–#&wÎ2°6@a*IH„Ûî‘©w8bŽÁ_YˆzÍʉ3»Ü1={3[ÝT x¼Š$½o»m9ÔÀ"ŒÅËŽ¨J¤_;U ñm),£W†÷_µ Ø‚E¢=.ðû˜å=ŠÅÓ¾•ÓÞJ±|Ïí=%ñrxtöÞ£ ‰¡Of?„&"fØfjÈO¬Îø®q™Gˆr=#ZUÃ÷^ö†+i0Z}â9¢C¡Ù*0ÒuåCµæZþ/dšm%Û²f!²ÕF¶»/·õÏ+»™Ÿj–LÚI}x)8O×[Ñ­ËVku"Jòr³™àHBþäUƦä‚ -IfT³Á¤Bk/ÐÞ—ÀSšã­ö]=\RŽ¼õ˜íØìO±—iøÌÏó7ÒÌ„cÐ  ^£ž -´kp‹ºç/¬.º$ge"‘S6<ßïýeOhœƒâ3*ß±+µ=-,È^M‘±W.—߸S9,j<ºóĶ%«YW=ïPvŽbéM´_9c¯ß¾‹ÓjÆ€n[mÀ­h[ë€{jKßš5`ŀȩ—ΗqŽ¸‡…ä¤pÌ÷Òðך`iG©è60¾žw©œ;±Ïò‚ÃÄ–¥Y o¥ìðä=šò]?ˆÊø÷HØ\Ú(%7ÄÏ•@«Æ€d*œS¼ÅÏdùI½æÕ=Ï­Üyµx;B³Ìßñ \ÑÈHýTC¦K¬ôõT##«’µ„ €s‰ðö+Y»ï«9LXµ£ÎËzT7€€€„hDFÒÕ€båÐJNàñ“ìk*6Ÿ0°Èä:6ð -ôrL:(°]¿xýÝ-4nã¯þ´Ý´òæ)žð¨ݬ!:šh«N6õöÏm#˜K'³â~~Œ'ˆ]½¬B«µYèØdòbmߢˆPÖ¦XHÒl^€’QÖ_nq ”¯eMZPujãÇK`ºúXmx¯ ð@"Y·^Æñq±Vvd’Ûïñ´›w¯€ëÜœÝ:MUŲ¡66Ëß.sKúJ#Àþ{Êù’‚Œ‡¦GØÆÂÑ'Íhˆ¸”ë€e y–Î29öJЉY­¸.Çí€ë~ŽíD:›²Mö‡ÕÛ¯¯Dá6…°c& -ß:dð®É–PÌG wòUlìkF†B«DŸâþŒ…ÊMâ.-@@8w×9„üˆÜ1xƒ®ÁÏ'Ý¿5æDç‡Ú, Q¢úN. ½¨uƒ¼o’Bæ‡Ì•ïáâ$‰ÕÊ$6D@I ÅAç¬W]Kúiï)ÌÐÄ!ØK±“×üGÑ¿ü$y•$½”?™‚jIôJ¦û€>Ù“£G¶”ÔÏWf0õg”D üÑLA^]’wÊZŠÐ¥0\n®f pã°>N´~˜ /8W;‰"˜Ú¥$âÔº\iÑ(«“ "ì•c2`\XrV€vTnxù}¹ž!,å¡ÈÆÞï¶>JÎà\lìñhD$žü?Éäñhö“¼##xÍ k)‰–¾l*tx3—NÏ0(YJî÷SSÔ35%óûŽ'.µÐly!ê É9f€2·Ê¦É!.C -ÊXYð‹©È^2¨#=Q_¨ €S¸b¨Ä—/‚Uˆ’¢£j0Rk)KŠôZ³AâpXñÈ‘øÁ£âš9K«Q©ö±B@‹­H¤!Ÿ†Áu5ZY¬ò\ЋbÝMB‚ÅÄ°«æ¢"$ -‹©¥MŒñà4“©,rVûlfGœ×3QöÐb¡îøÂ]^þ„8wƒ[½†‡·3»A8É£/Ýû3 =e¹ß ?Ú UX]¯¯w—ê÷_g%µ9„$wv˜úÎdðíÎÕðtcxå`M'l̯òyNˆ[X‘"¯”~±ùÇp§‚E3(G rêÊióãd>xƒ€¦)¼yÎϧ*pÌBªÍ¦g*Aj°âM=v€¦d›¡ìéã÷'bfÏ8(›pb -ï´a-×rrG¥Né(¡x„}€NøAµUDÚ0¯€Ú5^¶;Šâ•t[sþ(”Œ)Ó#d¶ +\ËŒTž:G£6Í%}™±2 W €…{þ.ÝWf‘À3ÈF±wL«hä@|_Dfr87ö\é¯ÀfÏ“%$fZp÷¢õ¬P„©‰Úå˜j_:¾t7Ôç89±%š«y"KqÙÒâ2X[£E-E¡Å8AÖÅØÜ“Â àËÞkö·J¶s™Z,õyÝU+ªé–Ä•øÁ#˜ù îxª)?Íä6]EÉ‘ -ó_ägšHöd$÷Á‡‰Š&3aºj’ƒœŽÇF$ñ©)RÎ×P$m‚$2cÒå6<½÷½1®Hì£QÇäŽxƃïéf”@þ[—?¤p+XF3œìâÛ,ŒÆp} -’ -°Ä7C}ñŽƒÔ^„íÆÊVñÄkÖ==»I<« -÷x]¥‹ÛòàgÃII€Œ#âÖÓîÅjæÍj.%9½Æ©—Ÿ¹IáMÜ[Ç3ߟŠ1À¾ÓàöqŸ²a*I‘ž±ts°zâîðý‰Ót ¡#³õ -ÏL¥výÍÇ -ë×½ÏÕØÖt¡©¤¢µõ`tº¹g©Ê²ôl÷0 ñíM­ -¼‹±{†OÚ›z©±‚Ãÿ¥G­wÜÓü‘Óå-»Œ Q }:Åe©$:߃ hN÷8c«Øðk#ßÈSi<™r|+Wo\'QâQæ÷c~Û”\÷_σ-ÓÆܸÓÝfñ4úÁÁ땽ý2ìòøéS âuìJÏÔÏèû±¼â’À§šñ‰BKLõ‘·=ž¸:Öô£„Aêk)²mÊà€.çqçŒ0{¦M¦•É]¥.•U¬©¾h÷.¶S¡Fj ŸømñHGNÂAÂF\FÈfÕ¡nYy…QQjŽË` -$Y"I°<‹}àqø½«ÝkJüÎHŽ¿ÀðWEËdÚÇxþ¼)¹X»õ»à— µ¼X­d²nøsL¶Ž`ܪ4K”Ld)QšÍ’´‚šÙ÷08‡Ã,99xQ‰êͤ!}õ-?1Ó-ß Éu ÌÐë\<—üýøÕ/Û*J%›É,Ö> +stream +xÚ¥ZYoÜF~ׯ ˆ<É&9dü°°e;Q É^k²Æ" °ÔšaÄ!gIŽŽÍŸßººÙœCyXä˜>ª«««ëøº(âÁ?þ$‰\O¥“Y»‘ò'‹õ‰7YÂÌ'¾PL…djÑ|˜ŸœŽâ‰ï¹©—Næ÷†Oê¹QOæù¯ÎÅOï¿Î?};›*¥ß=›Îf‰sy3ÿv$Η¿\Ì/Ϧ¾óåÌwn(tæ_˜øöý5 ~ÀÙ÷g¿Ï>ù47âXûJ¡0ÿ9ùõwo’ƒà?Ÿx®J“É´=×OÓÉú$Œ”…JúÕÉíÉ? /ž '¼êÐÙ5ÅTyn’„¯ë'ŠÜ8œý„¾¥ßóÝÐSM„ +úÍóg»Çó½ØM¢db1ÛÛPÓìíèGöŽ~à*?íx+zU©çÜB³@wþ¿„nSÃT’ÒTŸµý~7pq±ï;_ñÖ2"ížÎ‚™Ó´0›w¼"k æZÔ‹ö—õEÎS¿y‘´Ô®q“F|Y¶X æÍa¢¬—<Ú#³kj–’Ú÷88ýª`ºû¦ªˆ¤yš¢&A?So,¥ã–¸™¦‘³¦³ö+æ gÉ»ΦQ¾Û`ÀãíÛï°1ß pæg‰"E’jÑ"Ÿï„.ª.HÓ=Üq¨碩kM»è™¸oø7c†Ý*vØCêlm±ÆÛ¤åîÒ…¹·xìaâF3<% +[ß/á_&Lî,˜ UG<ÛGô®¢µwÝç±(Œ¢ýÞ~ìªXiÞp¢BìJ¡ÅŽ•€Ö3U‘ïú~<2"R „ጣrW´å¢àN‚‚GLÁçdˆ4ZyË«.¿^ü[uÆN‡V¬gSšelî,A0sƒ™¢ë%¦ÞÂxnCôâ®8æ9z2‚HX .ž³u©£Å =½ì¸…îÛ2“… x8QÖÌ"×J!G_ñ ^­ù£{·²g³íw­HÜ(ˆ&q4s_N´K¡øf9€¦žZäû°Ë“\ Xl[ =*#ígíeÎz9É1Šÿ`ë`Ù‚qí¾«¼ÁwüUÓ¼.î.'’GÅÎ¥X[¨b7ˆÇÖ–UUƒr?ulN/Øi¶lBÚŸ(ûT2ºÂó6ÛåJ÷åÞ•DÚ®Ïî04—”¯pv-Øô¼ˆÒ‰¶reb‹ïœ_\~¾åÁîP‚ÄqŠ-ņ{wÚq¦7–ä Ãq¿Gð†ŽÃ ):€ÙÐUala-ÀY0ÂzCAU‡©óiSRR\n‹#ûG)(?zËX4û­ùD‰†íÿo4³Àù;¯²ž-0pî1³ÖùÔXÿ¥í¦yj¥¡WÊʸp‹’ñy/‡ƒ\39Ÿ’‘¯²œYmD@Ž›É…É–«¢ÖÛh×á•y),Êõ{šEi²vCŒÀtÐ÷Óï +7RšE:1: + ñ/Ü[£ûn8¶â‘’•Óèyyà`ŽZ%9Šv´´hï³…ÐTðš¦X6Fƒ Å; Ö^ +rúζßáBY¨ªDÒ’¯xþÄ]ÏŒg¿­7õŽ¬-?½†€âÞã.¨ì0±¯•Îœ Z4›ª`’§Uà +’Qÿž°%,¹.mÓ5÷=gY<ƒûÁôn +Ü 2Šð]«(¢ûI¾Ð¶Xk?‚øÆêÅàI‹8l‘X lug§Q¼ÕH9yf°SÇ.Ð"Iõ²Ð²ßȹ±<íç…)È·ÛB$$ãæ Ãg& [v¶RËÝ :]dÛ®`Œ ƦÄÀ·¤c’‹3¦Z\‰S¸P>owD^£0d k–„É»JH¨PžŒ[hÛ"{íºÂ1­¥÷ ÌnÐMˆé%~A+/Ä–aÕ¾e`B àa΀;Üd‰~»j?Á Ëı[võ)"îi÷-$Øåf~CñQ'½v,m [w؉?-Ù8HžÒÁy––ñ–Ú"%÷Žw†§Wö /±‘dц¡3_’IÁiät˜ÖI?#çUæH#ûÛ$Ì ¹¿è +÷‰kgP )ó9”’Ü¿—úŽùe)ôi$x¡3›3Ž°£Ý¢yv"x~D°–žj%îÅ /Ù¯ú+š#7(†>.ëN‹Â~¯$$"àç+G”Ðø¶2þ¹“˜‡m-};ˆÃ 6ÑZVÖDï3f¨ý´'ÌQ1í¢a³àxµ•S4„’ËÆd/^{A>£EÈ2M­sÿJð -dC:4yRR£FúpNÒë²èGIpFñÜuWê]Idkg˜Õ!ËS;âÕ]÷)•耮ˆX‡@‹¾rµÇ1!Hw=SùC®6Í®hûŒó±X”íb»Æ‹”Á¡Z¢¤Ù?ÌmÊ@Çï=ºPyߘ*‹ì^˜º-ì»ozIµbr_eUÏC”s \$¼¦ÌWÒEë'™~oõ+;¹³ ™)5n+dPŸjè¡src9Z„î¡rcÓ®å:õM(©Ñ ÐUPY-·b€¹±¡Z#5ƒ¨y ”ëɸ‹i«Úê(Pt(Tü€†><¯Zp*§býúDÁ=uÆ„\_#íL)QìÒèl_d9:½'K½#ÏV˜¥gVPŠŽÊàŒP쇠ڞ§®KS6fìGá~µ&1<õ嵂±õÀKE„i¹Å1±Ý©«ëf“Cáq¤^Î 4`Ym‹Ê õÔ:z¸"‰ Ñ€wwÙÈ€4¦øÒ „Â^5Ù·UÐæŽ Áøév\ã9o¾k =úê3õ%ÿä%¥·zù÷7PŠ˜­Òpkɾ4 Ö|@Ÿ¡¡—Á# ¢¶nfR–wz)"Ñ\Yl˜«‡Âý¨N„eË…Ã1@ÕÀc±û†{‡öþs·ž”†®¯&A»‰ïÿEÅ“i§ñ~]iÌ·¼âGÍVG’ËþMûxÅpº\”ÔžïÉ~Ö6@·ê¥FQT`’*~_ð䜧®³eößÒDpa|;*3¥Ÿ¦É®JB?q“$+e§ÆüÜÜg +´Qüú7× HÜ zµ 觸e*eÀXÊ€×oÁë 2€¬–lÔ) j¯‰bÑ- ú1Œ$l.s*À1U‚e›ÞJÅA¬=!Oôvx•ãTàyŠ[3ƒCr¹*LÉ‚ßÂqQ.Ô9QÞƒ_Q,ÏhM.ŽÅ¥’B—QÒW«ëR*Áôj·Àïë1|詯?$,ð¤ë–æ¦TMÙ¶¤W¸®VrV9§ìÈ•ÂíFËû3S¼äØ"ÔœÓÎB—Qì,“ïãÙð¾Ó•Sž[ ÎÖèÚ¦úñæüŒ®-døãáý}¦ÅˆDYTzU.LÎêLu ¸ÿõe^e t?ÃÜ&åà=›Â/ V™mp8mWŒ…½ÙxƒBî|40_¯b«È+y4Ârd 7`&iÊïølRÅx âxdôUñß8ŒÓ‹1’ѧ +ÞBOejEÝéòE§¿g€Ú9>Ò«<»£ªI1XKAë7?œŸ?==¹Kcݦ]žWo0oPÔù=Š\¹ýs죆ŠÜÿc7€À|Õÿןj˜0&a‚c_ fn< µ0¨Håí}ðRvu@âÿƪh…endstream endobj -3941 0 obj << +4015 0 obj << /Type /Page -/Contents 3942 0 R -/Resources 3940 0 R +/Contents 4016 0 R +/Resources 4014 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3928 0 R +/Parent 3990 0 R +/Annots [ 4018 0 R 4020 0 R ] >> endobj -3943 0 obj << -/D [3941 0 R /XYZ 85.039 786.531 null] +4018 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [370.528 654.697 522.302 666.386] +/Subtype/Link/A<> >> endobj -114 0 obj << -/D [3941 0 R /XYZ 85.039 589.64 null] +4020 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [93.134 243.693 419.884 255.383] +/Subtype/Link/A<> >> endobj -3944 0 obj << -/D [3941 0 R /XYZ 85.039 560.235 null] +4017 0 obj << +/D [4015 0 R /XYZ 85.039 786.531 null] >> endobj -118 0 obj << -/D [3941 0 R /XYZ 85.039 276.776 null] +30 0 obj << +/D [4015 0 R /XYZ 85.039 625.098 null] >> endobj -3945 0 obj << -/D [3941 0 R /XYZ 85.039 253.458 null] +4019 0 obj << +/D [4015 0 R /XYZ 85.039 582.751 null] >> endobj -3946 0 obj << -/D [3941 0 R /XYZ 85.039 169.378 null] +34 0 obj << +/D [4015 0 R /XYZ 85.039 228.25 null] >> endobj -3947 0 obj << -/D [3941 0 R /XYZ 85.039 155.222 null] +4021 0 obj << +/D [4015 0 R /XYZ 85.039 188.086 null] >> endobj -3940 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R /F66 3242 0 R >> +4014 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3950 0 obj << -/Length 2940 +4024 0 obj << +/Length 2134 /Filter /FlateDecode >> stream -xÚÍË’Û6ò>_¡#UaH€à#U>$¶³ëT&ñFãu¹’8Çb™"'$åñü}ú>$r¼[›ÃVÊ€n4ýFs‚•ÿ«Ä*ߤ«8‰”5Ájw¼òWò«@06‚²á|{uýC®_¥~ºº½ï餾²i´ºÝÿæ½üçwoo_ÿºÞc¼P­7qœxÛuàÁZÞ¿_ØÀ¡wûá-ζŒüÝϯx°ÅÅ—ëMà½ûõÍí^¼ùåãþqûãÕëÛžÑÑUcÍ?¯~ûÃ_íáJ?^ùʤÉêƾ -Òtu¼ -­Q642/¯¶Wÿêi1,\ñ®9©X“(›˜K±v$– ÐÊz[«¢0&¹œÚ¼©²c~ýµxµöq­¯nö(¢Äx·‡|½ ÃØÛ•E^!¬Ãyäí;«pb½#M -€§^‡¿„r\ëØ;tÊ®xÀ!•áZwrÅ.ëŠZ¶ìj^Ì¿t-#1-\s Râº;…¢euÇžõÄ:ùÝ·þû0ªW¢:‡Šü£½ùý’JÀÊVß3.ãÀ/²üPöìá›u<Ù×ë œœ 힧`¢–ŒB‡*ð£çí{À!EjN‘ „$’Pg*Íœ¼×ãûE±÷²®~÷ƒðã©Á «ª«% ™çYp–m-JµŠÖÚwýƒcj­B ÆM(íñN Ü3Þ„b˜ªÐ:¼‡¬AMÝå]Þ8õ8Ý´ h™N褱 -¬:ïZÚk淋…Ÿó§±·Íq¾;5(¦îi†Ÿ4R0`2EûíÌÍ6:ŒUj’ÕÆøÊOØáÚ‰ÅÕÖ{Á?è…3Gl"¥c3Ù~{`[lšìNlxŸßgìp1tàD÷‘qZšûÊ®6#O½C‰np]£%iõeÉ€£Àª@'ÏZǧ7à@¥ÖN¬Ã7ÊøzlÀÍ×úÞö­Mà5ŽÏ(ò~õD¨’"b<-1éƒãøy&œe¶‰V±ÏâÿåÓ7àô©öP†5J타öîqÞð˜¤N‘¢Éy¥¤€óÞ€hÉBžÖoáö!P}S ÖaDƒ÷ã¶sy¢3 Kãè;/C0‘jZtL¹¼Ÿ‰½ z ëÁ¶ƒn:Çy¶CÑpðà^Qzo:Æx,ÊR DŹgPÆëHŽ.ñjVÖΔ‰J'g<5S/}Þè†.xt ù:ÿoè ƒaÅÆfµ·; ‘çŽéŽƒiGô…‰ëXŸDâœ(¡Z’‚){Äž;.UµäVNO”2‹]Ñ¡ˆq™½¹Úó,ãM' šæq^|tÜ£|p¡ON8©8qúø†ÂšÄç3}MÇb€_072Š$˜­˜ñÏŒò–DÃb\'€Ì©tçØs¤}g·éYpÚ¦’;ؽÑGñmŸ { .1®NŸ’=²tÈy0£š‚„ÝØxÇ<«d(é&ÖÞ#hâÝe<=d£æ_‘Ã'×'Ùö( UI¬Þ¦›;fÝwìýpÉé•ô€¼×w†qrJwnÆÚkÇײì5 X.±ÇˆÂj!:­œ9þ4 Ì ,\>S]T…‚Xko9ñHس·•ã·õQÐv5Žy³+²’ilo¾“o„'aµ=Ià¹Ô ©’ÈÏ·ü›íºSV:YEÖ“úwÎÿ¤é -Ù“ЮsÔ$4Áhœ dÈç †œyBZ ò¨á; -ä3÷›¤ï{tÕGNF$Z^ÍËŒ„˨–â‹l/×ušòØsVoy<ôÞD+â¾ ,ä´l‚X¯)»ôä}yŇ ©^Ô~}±™ãöß0 -EZ*òGu’(âz&x -±T4$L"*'‚ôDO ! Õì³Ë(¹BLGšbâ`XDyáÚ ¿;qù=DZ¹xl\åd"”œ\–y)øqiÈkƒ8òjqj„ô—¯O%‹y3¾Ÿ½¸ªO\žÐ ~»^ÍG—Ç4W„Þlù÷ü&!­CÇõMÎ; c³!R• †ç&Ü5œ:‡˜R6Ôñ™GQÁå{–‡Î=†0¤é^s3–Õpy—xŸ‹½{àõ^ží7$¿RÞ›µ˜à=•Þ¥Xq¼c÷"¶Äö$2À+ÔíãüFfÀ©a0Ì™¨³h7¥ƒ'tM_2E1J~”6:AÑÍ<’"x”¹7YÞ¶R Qºnóîô0SE¡Š´‘M£8Vñ¡H➇gFš>±ž0YÈ>WÃð¼ŒFèrm|HÛîþObØ1¾AôDnUÝðüä¬2õ¹¸ŸÏk éƒD+€Åì 0 Ð4®0ßúñ…V‰[; Ù‰×ä;€µ<:~úìy”[ü˜µzfÖeÑbýtÑK¥ë”zUò¦’4'=~§’F)V·3V$*íŸóôšPvÌP‚QÎ|,Ô3¢ÈM£½D±¤¯–quÎlƒ0P6Jfë|äßÕùü¸§1ýþ½ -X‡ÚqB)ªq¤£È‡Ž!c›©®*v½ ñy¢Á†–5LKƒ‰ì44RsÎhc¼˜i©a¨âØþGÝ"Û+±,ú-2ŽûÀ€Ïä{äO -<@`KÄE)u¨ÈüÔ¸=ߤ¤oÒTpÒP™0™ -‹ê¹-j,Æ. :Ÿ±j¬:–üÒø ñvMÁ`É'SåO\ž¡÷|n†?Ö;f{²ã*™-,“•œ$â×*•Lœ½ÂxÉ‘äˆ-ô\Éa2&º¬Ù]‹Ë•w®^\jN.ø|ßg„³Ü]5°äKߧoNý-ÝUˆÏ*Ižop–[S¾U˜ÿ×îꂘD߯¶Xû$}~UßW:L¾ÒhµZùà"_m´rXýJ§5¡ýo˾Þk©­b¸é×ɤ7Ê0¤„Æ}íIÈ õâ5;ê†?ih$Ž†‡ãÄkDÅ3ü¾§º{ïêÑǾ_¤ç}®åÃ%g\ó–²°uQæ»/+X¢„ɸc3®YÃóad%œž÷.¨b‘HÜQ(t¯VBú,C…ظ`ˆÁ)I¼ô–:ñ‰rìnþ•BŠ²UË9Ê>ñŠ~*â¼¹Ï.ò`šékrÆEû>«3“¿¼S.~æ ÈUàSÏyùg¹KÄjªI 2Ò%Ué\ mq(»TÀO ¸q­7xýð -–ï8mðBß]Ð3é]wR£:`áºQªRø}öºÎrPƒø™€ƒÚ´r4ñ¸FÆ)å“LZšîEl¸F´¹ -!¼`øÅ(¸½=Ã2¶'•ö§84º&LG¬zxÈ!ê"PpöbŽü¥ô¢7÷’&À¥›Ó¤XHÜÛ²o0Ó"*4ãG×GsÏy-Û ŽÂÛ¤¦CXŸáSìÌK•“]FÙV'Ò@’åìäê€iG(ÆG žò'š4Ó¾ã8Ê€Wݹª~üÖÍ÷.ߟ>d^>º^¢8\wߎ›º”͓Ȳ`µ˜fÃç?ep–«~1O\ôo©R,þž÷ª…ÿ"šýæ¯m]gð3oÆY™Š,›¸)D6kæ«âÕ›œ÷ð×R 4ÍçÙO–s±þ“¥ñ.iבÖÈsê’È5ðÐcöE×7Œé¿Òó³¨D-KNŽãïœÒ ãŽbÇOö——Å„Ö“8ý/K&Th_0|»T÷YšÙêðö?ý¡Ho!<Â=f­Žá}:fycÏvPrÉñ_Z ,endstream +xÚ…XYÛ6~÷¯0úRˆ¹â¡«@’4m6h4ë-6ym­-D–\I®wÿ}ç dZ²],°&9ÃápŽ3’Sþä4„¯“i‡"ÐrºÚMüé(¿M¤å010¾@œwÔy¨„o¢‹<öŒy¤Œ0±Až7‹Éݯʟ*_„¡ž.ž:EBPÄWñt±~ô”˜ÍƒÀ÷ÞW3-½ãl®ÃØk+ü ½û²iÓb&½ç‘—–k&,f‰ô²¦åå‡×ß¼ž}[|˜¼[ô κ ³?+-¤ n^(„KDZv/$Ð&t/¤¥0¾´’x%“xŸgsé-Û4‡ ”8¦Áæì*‘×SÀm —«Iw0[¦×.§bJy[ÿé/ƒ©ôEâ'ŽþA¢…IÒÿM^¦5ú$¾·‡aºš©Èû> B/Ýd ª'øPt5UŒzÒRZgÌ“—°{… èÄÃþe8[3™©;$TäRØ™–3•@ÿAüᙧUÍ¿~ºÿ‹Gë¼ik´ÛòÐâOU‚ B©¼Å–Ϋù` º1Ñù£š/ †œ6^Sí2íñÚ1^;è® «)®ýK¦È‹t‰±iùÓvè%¥#= ¢D$6Êp½ÞX†/Ž¿:æù‰{ì¯DT½ÝÚË¡ò_hímá>{P¨›IòL³Aü0ÃMmÎd .‚L;WàDˆwŠ„ŸpžßC¸˜XƒKA¹ê€å•Y¶æeÌxü]U»}^ðF( öÐÎ)s<¡3«%W‡º ±ì¤ò= +ÖmjÖ‡£Û" Ð4^Ià|93sÏöKÖ8—é:u%M¶é¾íT«ÙDs¶ 俵åÂs//(‰6L8˜ìÔìa-ï‹H)ŽmöICÂê´%;‘iÆ2Å£i ¡}u1:ž¹Ã46ÁP’Zƒbñ($t`N!“­M0ø‡A¹‡áP“ÅÒµ&`Ìém(0€pêÊ+OŸq9çåq¡Ú“å30NºÍ¢—¦Ív¬À§ ÷u6}ÌÁÍ”ÃLÛ‡%"ŸŽ«ëÄÛ¥¸ù…)eÕòjÙm¡ã`Gà°as’Yóú±{jH+Ü€yÃC«í±ÐÒ„Òû\Ú °´Íx ò³š‡(ž-´®ñ]ÕcoòÜ óqœl·çj÷ž¼bžÜmŸÆ1¬¶_pµBò‘—Ÿ*K'/âÌ>'ôyUÚÝ牆KŒ€È[; Y&®¼½& E¨nCÏÕÚÁˆª0´µƒ²µÃÛªüêK³x}I@³¯~à7´ VU …¸&¯) iÆ·uîY®– :ô^:;ýØ )-Wµ|9AE>¹WEÊkڪƈÆ-¹¥µtDìÓÈÞ +¹P=·¯Ð†£Aíµl2ÖMÖ[OL`u!Â)eh˜søãÃv²o .VqhüÔ|©jÚÙ|DðK¼MMÉJ*Z‹ «yT¯àÓ·Ý¢ãȵ",u…>jµyâÌküvZÆNF‡RAÂ-çdú¦GK py0”ÕOéÊò cTkééÛeÉËUáV®Ž8,ü#n8þ¿P½Afn¦ ÃÓÆ„+psPB_££lHOÚVꌟÓÝž +SÀˆ·T£öR8¯è‹¤¾­ß‰ç*F¨XŠ8ѤTáäeXwÃmíû:€Ú¯<ƒ «6’úÜoxNƒ6Œ¸=»ò,y¥1ð£ó:£Øl«®ÇAi3û ÎÓ@WÑ¥G‹Ìù’Žœš cbïÞ)º‘´Ù0Ò´RåôZrÕ]4¥Ôi¼Ö1Ø ô„Š⅙©1‰Í¹‚ ¢riÀ“m…La ¸`-e|m{&û¥Ñø†›Î¢ÃS\È)³¢Ià Kû…ŠØíç*t[™ñ×(Áš~WŒP‡¾&áõÊÒ UqkÓwf]#Ì3(U â Ø%HÂ-X."„Ûí¹Õ&/Ç¥J™îl…Mu!ü#å^Nm•ÞµŠ´«T¾²ke øRe¨!ùTµ™³Ÿktu*ïÇá=â}`ÁXM¥\±ÓäÐX:°ÃQÛ'ñ7º èrn&v_êô¬>øø¡ÐA؉CëÑ‘ŽEëgþRGŽ]endstream endobj -3949 0 obj << +4023 0 obj << /Type /Page -/Contents 3950 0 R -/Resources 3948 0 R +/Contents 4024 0 R +/Resources 4022 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3928 0 R +/Parent 4034 0 R +/Annots [ 4027 0 R 4028 0 R 4029 0 R ] >> endobj -3951 0 obj << -/D [3949 0 R /XYZ 85.039 786.531 null] +4027 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [236.346 576.833 338.096 588.522] +/Subtype/Link/A<> >> endobj -122 0 obj << -/D [3949 0 R /XYZ 85.039 724.106 null] +4028 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [334.765 549.734 539.579 561.424] +/Subtype /Link +/A << /S /GoTo /D (compiling) >> >> endobj -3952 0 obj << -/D [3949 0 R /XYZ 85.039 704.117 null] +4029 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 538.306 119.763 547.875] +/Subtype /Link +/A << /S /GoTo /D (compiling) >> >> endobj -126 0 obj << -/D [3949 0 R /XYZ 85.039 615.128 null] +4025 0 obj << +/D [4023 0 R /XYZ 85.039 786.531 null] >> endobj -3953 0 obj << -/D [3949 0 R /XYZ 85.039 593.932 null] +38 0 obj << +/D [4023 0 R /XYZ 85.039 766.606 null] >> endobj -130 0 obj << -/D [3949 0 R /XYZ 85.039 323.557 null] +3018 0 obj << +/D [4023 0 R /XYZ 85.039 662.883 null] >> endobj -3954 0 obj << -/D [3949 0 R /XYZ 85.039 300.841 null] +42 0 obj << +/D [4023 0 R /XYZ 85.039 662.883 null] >> endobj -134 0 obj << -/D [3949 0 R /XYZ 85.039 184.754 null] +4026 0 obj << +/D [4023 0 R /XYZ 85.039 617.808 null] >> endobj -3955 0 obj << -/D [3949 0 R /XYZ 85.039 162.893 null] +46 0 obj << +/D [4023 0 R /XYZ 85.039 466.627 null] >> endobj -138 0 obj << -/D [3949 0 R /XYZ 85.039 107.848 null] +4030 0 obj << +/D [4023 0 R /XYZ 85.039 422.877 null] >> endobj -3956 0 obj << -/D [3949 0 R /XYZ 85.039 87.253 null] +50 0 obj << +/D [4023 0 R /XYZ 85.039 343.534 null] >> endobj -3948 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R >> -/ProcSet [ /PDF /Text ] +4031 0 obj << +/D [4023 0 R /XYZ 85.039 306.667 null] >> endobj -3960 0 obj << -/Length 3060 -/Filter /FlateDecode ->> -stream -xÚ¥koÛ8ò{~…±‡d bE‘z-p8¤u÷6»›¤×8W»‹B±åD­m¥’Ü$ÿþæAÊ”%§{W…)r8Î{†‘“þÉI‰@e“$E¤äd±9 &·°ò¯i |â;0¯æ'/ŠõD" ²É|ÕáÉeñd¾üÝ{ýóéÛù›wS_)åi1õ“$õ®¦Òƒ9)¥÷Ÿ70¦eíÍ?¼Å¯+>½˜ñà -'_O}é]¿;›àÉóËÃþ9ÿåäͼ#Ô¹ŠT -ÉüròûŸÁd Wúå$*K'0„̲ÉæDGJDZ™ïõÉÕÉ¿;\¼¦'¼kŒ+‘JE”ª![Tä°EF)3It(@„liŠÅ®.Û§©…‘÷þYV›¼Üâ»/ñðŒ ªúóm]íî{à?lóMñ±Z}¼˜ä­?àÞ—?I÷p_iú*Aš¾³íÔÓÄ«j`ᲨùkUÑ öÚ»æüH½Mœoï`¦Âoi€*Þõ0 ¢Ï/`&Ãí/]å›)l¸Éù³!Lù§Í!ÛôµÜkÑÂsË­%Ì`>¿â‰÷åvI„¾ÄÐ÷|s}âaDW¾˜³Žãn»€ÿ¸ï‰Ê0_z £ZGÞo\6¼ËþÒaÛ‚wäfrU­×Lp£ùñP#¥ …’á$N¤P±Õ# ã;@¤G=QÊ0±Ž;Lx/)çÀAÛž=ŽA¾qšÊ@·£Þi— ¥Ap_”…Ò c²šÄ -Åâhx™k†¿4^T[ië -·îôâ.gÞ®)··æ ”‚9誨Yqj^;Ïñ´ü¶·= -¼¥´d˜|Äš6ùEEJβÔ^¾ µ¨P/˜6–1Ù:BØÑk\2zmhG寵ãèòß=#„— Êÿ¹ã¬üŸ=ÍÊß9í¢xlÑÊ#0y´I•›„Áõ¶|½ü­$îyºyjZbІ¿iüÈÌ”Þb×?²×ê»Ì,i¹xl]UíßF|[˜ŠXŨ٠ToîQ'òK>ÒÿÄ¿³ËóÓ³‹C~éîªá0ãù¡D˜Œ ßâzž³:ID†}Ξž¿aߥT"2•ôTÖG?Kï-\nöz q8 4ŸÈø».`Pù®Íú³``G?ÐxQÐä, ”…²Š–䈰3%‚(ù_d½-ZfÈ><ÀÉtÒ5/ؔ۲iëÝUUÿý>oH1P?«zéЋÓÖª}Cb˜RºADÙ ŒÙw”…É_H9T”Qz4&ðT¡–BÃÂ1<´+<<²à‡‚´<§©v’£’Rdx#¤LDœíIÉ>þ¢nµÈbxU×Q(4(0àœ|™HŠaœ1]`1šxy¶‘“Y”NzÄ2^ßAÌj—öÒ¨Xd:™D¤—1g2§˜.¨È«Vü{•OÉÓH£{¡„¼dÕ†'ð‘‡ÆŸ—ÖG™#(@äè;ßY>Uþ§ªtøs ‡Aèb®Mô ôŠ‘µ‰/3*aùÓŽs"i#Ò“³°/Ýg4D Qr;æTt.àV•ch”I6›´ ô—ø‰þÙ_~dÓ¦…šßÎ^»³×ü{ºììÍÛ›rz”ŽÓ†/ƒ"¤t/ùŠ™BâëÖÁ˜IW8Ì%ŸS̃¬M?Ï¿ò8ãb‘Æá!ãÈáà9¡ÿ›{äg$æÌ38·•™ÛvQ“õ²Éñ.õ¯>”£À(bL©ñ·2œ3c*WO¼‰t§Kr2>NœŸÂÌHÌ”àÂt8Qø ~_Ì4¸|ÙÐøÁ+ˆ‚êÇLˆ¢ÀÁ~Ì$ÛÃì-1¶¯’5÷ð.!~^¥àŸñ»å.—ï Þ%”~¥º;q?‘V*+€Ô’ ‡RßîjÇ!ñ¥JZíö°+¬lª ˜¬u$¿JbiH—:ÝÈÉW#Ú©3ºÃ!ë°s¦W›ª5$Vµ87£~”`Jæû~ L~Õ%:6ái{@8‚£‡^³Ä‰·Ÿ©Š<è±`MSû®‰‹z]ÝVÛýñû›™S×¥ÃØeà*.áë‘Ô„xHÄFwZ"ÌfPO&DFN5iÐíƒOBbn D³ë&b%À_Ò…Ý‚2¤=¯´êøuŠ³kÒÜsW¬×dkÏ:âÜ”ŠÀ¯¦Æi½,ÚÅK“ÞŒµÇ °Ëc–YSí‘#›Œ˜Å)æaD¶] b †ì4¸T¨9ì†Ø.Bõ·wÆ™ë³YÃ# 3h Àœ53óYÙSùÓíEÀç¦0…Wg5ƒ3Ï -—ÍQ“¿ßÇš¬ aîTî“-cA½Jê÷$ˆ'aÞ;"gÏKõ­)Þ¹ýí;à#þ÷'Ò‰ Ên˜oLÎ¥¹äײxû4RI—®AwÄÂãc""ž9Cg…üÖZqȯ14Õ¦ESïŒ}(A G¤3t~»ÀÊgǹ¹¥ -"À‡è¶Ü±âåS¶'¼@w× cC…S·îîÛ£VHЪ ŒH"£ÇÁÑ8›gï³%X¤ϱ|‰R[0Žœ,*ÔšâZá‘k3ûkQ¨IÕ]ÌÚ^Pl;¡× þád>âNs~zE¯êv¤­BÆ0Y¾¯Ÿ8Ó´%Ñ®¹uQRéj‘û\oî]Ãʳ…;K ¨™Ñæh'ÿ]¹÷O. ´Ójô þ³Œ¿ëDº E§"KÃñ% -'ÚCïHñ!ÁöI†ÿìYÿendstream -endobj -3959 0 obj << -/Type /Page -/Contents 3960 0 R -/Resources 3958 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3928 0 R -/Annots [ 3970 0 R 3971 0 R ] +4032 0 obj << +/D [4023 0 R /XYZ 276.614 216.978 null] >> endobj -3957 0 obj << -/Type /XObject -/Subtype /Form -/FormType 1 -/PTEX.FileName (./xslt/figures/note.pdf) -/PTEX.PageNumber 1 -/PTEX.InfoDict 3973 0 R -/Matrix [1 0 0 1 0 0] -/BBox [0 0 27 27] -/Resources << -/ProcSet [ /PDF ] -/ExtGState << -/R4 3974 0 R ->>>> -/Length 3975 0 R +4033 0 obj << +/D [4023 0 R /XYZ 85.039 94.508 null] +>> endobj +4022 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4037 0 obj << +/Length 2445 /Filter /FlateDecode >> stream -xœeU9²,GôûeË@@Q ‡!é¡%bd(dèúʤ—÷ÿ(žÑ¯ -’$¡T¬)ÿ®ïë¯ãïãÇ_¢ýþÏaíÏc‹®½Ú¿G—=ûÌöÓ1ÄF¬lÖ]töö×ãqu‰Ý¦‹÷5š”<8Ç—ý:\;âúãñ‰üéÆ&ÞЇ h—õ:ÀÀX=&02²oÒCó eD3PMtð1CrZûbœ7³}t€mA£d«·íä'ÐWŠ!è®»½KO(°ƒÔ¤‡tÙKb•^¦Ìì »å*’ÎÕBêFåmY¸™`Uõ´™Õ -¿nÜž í½³`*TûÞ£jg“¾=Ås–A½R?Ô =}³Ú§l -¤Ï’ÃigÙ¥—ÇáC6uéíÛ&”\Ê GTœ„Méêö–KòlÜ’Fyu|?é%åiÈ¥K”êNÊq{vˆ*êèJE¢]8hÍò¤p0R±ˆ$Á(+Á nÖN¬ -qª„Ñ«ò^ÿï>‹«>÷— .13×…Óƒ!¶3¢SËAÕ”ih¥Å¨Š^…(€<Îm䦽ªšÛÆlLÊâ³ò7ÙaÆ´Ëdô 6(WðÚºK -г2"ïE9~  -n*Œ1½÷¨¾x¥Æˆpîâ‹&XîÃœ§³±è\íD¤ßä0}#XŒûž˜‹¸À>#^V°¡|2Îi‰9ÊÎr)`˜¢Xh¡Ò& „hb—H°Œe"Ãêʱ„£~Ï“a³tŒºìZDß!#Z¶ÚÂk! e'jÝ=§ _tsÙ¬ûÍ&­Nå@‚i¬ˆ3t%kÐE„\H–YZxÿ/U¥Ç™åë—Φ@±¯iW H -þrÓGçX5¾ûû8‡´ÕªOª«t–Ô³$Ây°‰—BÒ›ÀÄ5©/¨vp÷o`kA“ôr ±ñœÓ4N.4Žæ&F°ÑTÆG%V½ Î'ÌØR5¬BÔ‹`qUžv-UÍ=ëÆåQv2ë_ ”¿­qq‚~èr¯Ú5ÌJ¼ð˜°h»P¡õ‹kÜàéÚýªå>Ò¸D °o»Îi¸CrT]¿MJ¥ ÆÖ¹’°;¿ö‹ûóZ¼¬ å[Ç-œÁ¤ŸBx¿ýpü|üÈÂendstream -endobj -3973 0 obj -<< -/Producer (AFPL Ghostscript 6.50) ->> +xÚYëã¶ÿ¾…´ˆ ÄZIÔ3ß6í¥¹ä^½u±(.÷¶e[==IÞÅþ÷%ÊZo€"¸˜ŽÈ™áÌof¸þƒÿüE¹žÊI»‘òÛêÆ[`åŸ7¾p¬„eeñü´¾¹ý9Š¾çf^¶Xï‡}2ϲx±Þ}qþþËݧõ›ÏË•RÊ Üå*IRç—Ë u˜¸þÈ¿o?ܯ—©rîÞ½cÂ݇Çrå;o–¾ D¸¿{³Ÿ|·üºþõæÍzÔÒÅW +åüãæËWo±~½ñ\•¥‹'{®Ÿe‹ê&Œ”…JæåÍýÍ¿†½x-\ðW/™%R©¥jn?zÁ.QäÆaBvy¯¿¡ rV¨CUÎ-(E„ÐyÆÅæÌ«' Ÿ{÷Gû“ +Ù6÷LýÝóCà.e›¢–¯€vÚ¶iÛ|Ûó·.õV–~÷"ïÜu‰ÔgþÔlq›ã¸Ñ·†Ãg ßù.^e$®ÖB%^¦¡Ó´ËU‚¬M›ãȃ-÷ðUÓVº/ššiz³„/Aåžç¤^¾=·ÅO…¥gYäè‹úÐñÞ¼3…pðåØTÄÜ}µö<¢À,‰Ïêçšc’\ïI³oséja¸ðo‘àa†wÏKíaÁƒÏ–«î•Å>w•Ë=ÑŒßÝCÔ²ò*ôœs±òÕÀu¯Ùôw—rúAà*ö„“^rb³¾†¹Töx–{%êâ,s½Š xóH‰“À#HàløŽï‚‹­@Y€ƒ n¦CŽÑ-Ü=ÄÍ 0<Ã!…B;Ox•ìLäDìÙ?z‘ÆÍÚêšv àšÿ'Ú¡†š|OÎfuDrjzïú 9߯GƒÁòÑ$-nqrÔ(õÁhm9±ÉT¤Öþ/Wb:‚@óZH,^ùnEVDG x–†6^a­Ežsÿ°Ì(S³Ö×d¯_b乊+a¦Ü4ô9<,}ÏM©~ +’È‘ø@ü·Æ¼šoVÝa|¦ Øçíž +¤2þà'ǼA†B\;@1ùÌœý[÷ù¸ÏåÁX{|²jܨ¥E½ãÙDº: +|X!¥@8á†sm$~¶Med*Ê‚"çSæu½.K)2¦ 3¹[›ƒdå0ÀÚ·Me­±·Wa +~@¦`]B² ¦ç0¹tbäúï™?Œ0 Ó‹ëžp‡pºá ÅÓÀ®ž…glÕ€ôd“>'[îx,¹à¨`šÔÄÚÏÊB?rƒ~U径5.´ᘔ…½²Ø)ÂÕ¤,¼ØwìûÓ··e³Õå±éú3Ï¿½&RÄC0fÖÄ0ÏL„ È\î4Ôð]„EÏ´ý8¤öiâ“%DTã¶íKÁõ¡ÁýÂ(«œ º…är<ºï5'TžC·CÜsÀÆÕ=šïYt-õ%®¼ý$©·Î·¦c“š*-‘Ž—#rn¤Ñ¥ šÚú’îo~ò P×æé­Rv†J=l÷8‹ tL³¬ 3<Ù»åU%P9ŸÈy©®žë(žt7"aÓ㺎†[ÍäÀŸèŽ%¤tÀÕ¢ùZd’ÂFC +Ä ß÷à@©w‘úLU}‹I2bi4ÒâCÍ3§ËMÑÛæ×=ú„ ¯•,ÏP8…® +c«dQ€/aHá¤ì¯}æ&%/º~È;@b,€AwäŽ yîéô£] Ýà¬UìòöàãŠ~Ð`C›öº~#Ï°…)ˆR7KX¿¿‚r¬»j³-‹¼îyºzÇ¿Ï ¢"!u¾¢3Ç[ý‡ò&Æ°µÀ‘2_¹ãé!ïy°1uÍ4ÿLº$$ ¾ò.›øœâ%Ž$O®³ôF”p…žk¼xšpésÆ!v¨¾XQKesÓ{†¦þ^ŽïíŸ6’G›þ8„=P‹î''f ATh%béå*-óþŒ1†Ž{‰* ¬ÆÉLŠŽ'väfgÇDÂIÜT—\ØðlÃÀê[áús¸1<Ž9sá`z½*¡œòB}7šQù®ßSþ€‚°µ2 E“Ø+în|ùëÎCí…9«ã߇ýÃß÷–/WpÔ5Cƒ3fÌ ï÷a6CA \ç±ÊÊØ©|Á ’x}K½ðøn‘S?™Xiy!Ä ÖªTºf¾y8ѽՌðmþÇÙ< p{œ)³6Åå„lÇk›wGQ®èç xà_‡&¬-(úÏx#À¼5±‰¶ƒ>?n c™n0‰±ÇQï°ù+?…ØK'nOµ£ÏƘrµäãk—,›á-ÌÃÆ +èCbI2–š=0›Ü¿ú÷ß$ë7cö7¼RVÜ/wÉõb–LG¹yÊêæ’ÜxëFd%ýf +Pnê5U« w¦ŸÖNçr?ºWr\ä†ü’Ëÿ”y¢þÿÿz2$Êr`\é*Kâ$4 †*˜71üW–¹Äÿübaendstream endobj -3974 0 obj -<< -/Type /ExtGState -/Name /R4 -/TR /Identity -/OPM 1 -/SM 0.02 -/SA true ->> -endobj -3975 0 obj -1049 -endobj -3970 0 obj << +4036 0 obj << +/Type /Page +/Contents 4037 0 R +/Resources 4035 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4034 0 R +/Annots [ 4039 0 R 4040 0 R 4043 0 R ] +>> endobj +4039 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [191.71 248.336 283.127 260.026] +/Rect [491.495 724.825 539.579 737.727] /Subtype /Link -/A << /S /GoTo /D (winbind) >> +/A << /S /GoTo /D (securing-samba) >> >> endobj -3971 0 obj << +4040 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [394.643 234.787 476.35 246.477] +/Rect [84.043 714.003 123.308 723.572] /Subtype /Link -/A << /S /GoTo /D (domain-member) >> +/A << /S /GoTo /D (securing-samba) >> >> endobj -3961 0 obj << -/D [3959 0 R /XYZ 85.039 786.531 null] +4043 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [414.285 436.223 536.549 448.216] +/Subtype/Link/A<> >> endobj -3962 0 obj << -/D [3959 0 R /XYZ 85.039 682.791 null] +4038 0 obj << +/D [4036 0 R /XYZ 85.039 786.531 null] >> endobj -3963 0 obj << -/D [3959 0 R /XYZ 85.039 657.814 null] +54 0 obj << +/D [4036 0 R /XYZ 85.039 699.735 null] >> endobj -142 0 obj << -/D [3959 0 R /XYZ 85.039 209.09 null] +4041 0 obj << +/D [4036 0 R /XYZ 85.039 663.47 null] >> endobj -3972 0 obj << -/D [3959 0 R /XYZ 85.039 185.108 null] +58 0 obj << +/D [4036 0 R /XYZ 85.039 553.36 null] >> endobj -3958 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R >> -/XObject << /Im1 3957 0 R >> +4042 0 obj << +/D [4036 0 R /XYZ 85.039 520.939 null] +>> endobj +62 0 obj << +/D [4036 0 R /XYZ 85.039 341.909 null] +>> endobj +4044 0 obj << +/D [4036 0 R /XYZ 85.039 296.835 null] +>> endobj +4035 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3978 0 obj << -/Length 2895 +4050 0 obj << +/Length 1571 /Filter /FlateDecode >> stream -xÚ¥ZYÛ8~ï_áG7°V$‘Ô1Àgõì2™“ív8#?·üþ¯¼Æ‰ñšªA-Uƒ-oI9Àu}ÇÎ ús…‘—€–Q í)vÖ^F6:]¿ü–Ï%t!ûQ¼~Qþðýp©³¹+ÏÓ‹¡öbØáI;bQ t¦žNõ*JC/JRb±Î³òÌ…fý3?«Kí}õåuÕx^>ý‚}6Úžç5ùîRíã`êóò½‘©7‘ÆàÊ÷ü„-½=ˆýîQಬÐÐ_‹Óï ½Y±´Îôø–!å#w8ãJuþצu¾ÿ‰™È>å!Û7Ìu“×_pEÁw$KhÕ÷b]à´G¨cr>ê¹·¢u[Éó@#«‡°O˜ª•I/‰)Öx¨~XqãCÏ,õ¦G>ºñšÈñMuÌ0ò“7–ÃAä5‡â<æNù‰— -½í&NiižæIEဧ촟l¨/ ÿWuXêïl=Z·~¾k‹/(½Xïc²Î ]Ú -mù(ºÊAIñz„22hÏ©Êtê'Ufižæ[ÇÚ ƒtÀwC,óÕ©¡x€éüx¶÷•ÃÑ:çVq¢ ¬Îå¾:Èê=JaC’|´hu-l¡j`£ÑUgZeh‰½T«'Q¬Gã€d1¦´FC: ¢>ЄYã¯o%¢bo¨È8Èe{­|BøÃ7>týÖXÊ×ù—¼ÄfD“j È< ȃ%‘´ò‚0yZ¤Žf9ôx& I$”áZŸökß :YÑ - -âÁbE^ˆY»ÐNÚ,éµÌï[nΖ½§Ôxdz"n£è´¶,úÕz61rÂNÐtÆH‘Yà"køåTÉ®»ìœÝ]#¼tu?“P2p]t6„¼BÂüÃc/…íãLÔÁ€žÓ8B’úëWµL@JIçáäHÆ5%º«ãQD @“{{ûnË k|^lçÒ(š¾8†ã,ÏZŠŽœ‹ŽÖšJ»ÀÎϲè¡+›fƒ-Àòo€\ûÎÃåàCóꢓxþÔê¬âãµÂÅMÂ&LÃ5I—¥bRl:㨠í8¦L—I¢Æ3 5Ë}wÎ13Ê8Ø•í% ðíë!·ë[ÓA›Ó*û-¾Ï˜8m8sˆ½ì÷]Hɦˆ`œri%ÙJ`ªC¨XÁÙ:üaKôæ/›Â!ï Rp觬 -x… òZš–èí;|&“âƒÍ -Ù\…~º¤ñÉ°Ò^ -H0!a[£¬ÑsF¼¦óÔ~özašCz5_I¹ãÁ&•Š \lõ³L¯B&'OJAä©HÓÓ(>N½B9R3uÚ4š/Åq`¤ù4î8Ñ>'n•q©@›Öˆ,äÉh”†éIÊ´g°ü®,rg˜Ø²ÊªÚ›²@!"] †xXžÊ¼c†ê©oz\i`¥M4Õ´&²79#VJN -r—6•ßâ»”(êûxœz‘°ý›Æ+£ÞÛËyæ&20IˤL–w1Ýìê¢ç5²‘À åÚ‚N -Ú˜QiœLŒôjçî§5†#AÆ9¢‘WF­oM~’Ë­g !mÝÕ_egSu!¸¦k¡ag=IÚ´èŒfm›Ï­åªâgY=cÄx½1‰îL'ä)Ìêh"Ðwö€YG'Fº*EÌð Ž}¥Ðõwj2wô„‘ï+αuZ×BžP¨Mes‡ß0‰XÁØè<}ž¯îqÀF¶Æ"c†N§»´ÄtLÓ› ¬’‰f!¬ÁpNF¦Þå\3 8w¨YB‚.µMEŽg·RÚ"74:¥È–Xvª´PYI €`/Š€(³W»ã如N¦X Œ‘›ÂXÿØM+céA=­±nñó9X, ,y¦gôpQ%¡E8¹WÀÝú¸)úüt(L–‡J›¥ ¼²‘;|;IÕ¢úñ­Æq®ì5Íc/´[B-™@G7Z½´3‹ëÕ$ÝÕÔ¶0SÝêKzÁuÜa lºY“„!‚pßÀÖœ‚LèÇ0MÂ@/ðµúB`Ëà$”‰Ü0h±âV›—Ä™±Ú2˨ˆë¢¢Làj.g®³«ºí¶ÌO»ú‘\_|9Mùúh– -©¢{%õAËÒÑ–”ošá‘Û ñàôˆ?ø`¾¯äaÙå\óˆþ‡l«Tr2ƒ”àÇ2ð˜a—Af.èÐÏÂT/ NÄ~ðìÔiSo˜R…v$&ƒ>!=hèšozeƒ±Â¾°YÂœçb$ ÷¤‹lì²y7ß»0Ù…o§Álº¯SÚf¾Ciß‚ÿ´(¢ÁŸû4õ ¶°Ÿ—"C6¼'Ü¥ÎD]ñsǼŒÍz¾+þ¨Ù,FnM¥ýÉÝòC*/N3•™ÑžÙëÂ×åôGò}ƒw¥3…™ ½(NdÒ½i‹lR£ËQð¨Gî´……¤k¼¿PÜ̬Ÿb›Ö9Ø¿ýb+¸s$}ähle5Ê!¸5@o§’‚–"/Öá@M"q@÷±‹âž&®xž1¨ˆp&× 1}°äoKÔ)MJ€=•JòY%“ŠáLŽØv5ÅÜ©·+-&ÈÎ…0‘ ´ÂîÄMDŽAˆ.¦îümüjÌ­‘IìÍ¡X_ºÅß=lãöÖe\úõËxm9à”fexǛɠ+þ‰ÕÙ’aZ…f¦ÀƒDTÕô¶hM:´ë,VcÊ–ê<#ÁÞ¢“a®ÃZ{ nü³o»Ó¾ŸŒHâS^ou$íÐyP9uE‚ÂüÅÃ¬Í b~B6¯¼XºuCúÚê÷t»+ ,!¤ö×EŠ‚CñÁóÑè8\¤”é¤ÕjÄTYo¬ËxM1mËZ£ª½s!ÿ û¯2“{¤¬žÑ/*áR{Ö`‘ÛÙÏýfwAŽ"»UƒÈÿàn¹ë8xÌU4êò®®ËßçìïÀMsº(3Mm§S*P1‹ƒó×@g´* *!S¡©ŠÛ<í(µ_¯)ùu'•ëÁѦ%ñ˺úÍhÞzÒËo¾‚ÚŸcŽ’©óíÎAe´xœ0)bºëÙ—jL:²ÕåußœNæ\ì…õaEGhœr|Íd@=j÷:‹š[[ú:YÙŒ0/L[›OŸ¢Û>,|²ÚZ¯du• Z®²5˺4¯[^t#íÒðõci«ávýRÚ6˜kbÑ Ö}sÕ±±ìþ¢ó-Í@g”¼9H$ yG†¼_ÔÛ-¾ôñòeÓ+·cÞ+g½9èŒVPß÷<²”|h,벤®¢oN¾íí­¶º§îÚè¾{i÷™YÛdæã ×í´ ¾Ül±½yOè˜ :KÕ€‰“¥Nå ©èÚv`úɽšÞÚþ¸Æ&ÕL1véB¹ŠS(Ã}ƒü§ÿr8t’1KâàôU)xîÃHZgð®„8vX‰˜©Xœðø_Œ–+ßendstream endobj -3977 0 obj << +4049 0 obj << /Type /Page -/Contents 3978 0 R -/Resources 3976 0 R +/Contents 4050 0 R +/Resources 4048 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3984 0 R -/Annots [ 3981 0 R 3982 0 R ] +/Parent 4034 0 R +/Annots [ 4055 0 R 4056 0 R ] >> endobj -3981 0 obj << +4055 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [209.297 585.761 309.974 597.45] +/Rect [263.502 186.32 308.646 198.01] /Subtype /Link -/A << /S /GoTo /D (domain-member) >> +/A << /S /GoTo /D (diagnosis) >> >> endobj -3982 0 obj << +4056 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [330.926 585.761 472.531 597.45] +/Rect [84.043 172.771 249.377 184.461] /Subtype /Link -/A << /S /GoTo /D (ads-member) >> +/A << /S /GoTo /D (problems) >> >> endobj -3979 0 obj << -/D [3977 0 R /XYZ 85.039 786.531 null] +4051 0 obj << +/D [4049 0 R /XYZ 85.039 786.531 null] >> endobj -146 0 obj << -/D [3977 0 R /XYZ 85.039 738.261 null] +66 0 obj << +/D [4049 0 R /XYZ 85.039 766.606 null] >> endobj -3980 0 obj << -/D [3977 0 R /XYZ 85.039 717.666 null] +4052 0 obj << +/D [4049 0 R /XYZ 85.039 742.055 null] >> endobj -150 0 obj << -/D [3977 0 R /XYZ 85.039 557.943 null] +70 0 obj << +/D [4049 0 R /XYZ 85.039 532.739 null] >> endobj -3983 0 obj << -/D [3977 0 R /XYZ 85.039 536.082 null] +4053 0 obj << +/D [4049 0 R /XYZ 85.039 487.664 null] >> endobj -3976 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R >> +74 0 obj << +/D [4049 0 R /XYZ 85.039 258.821 null] +>> endobj +4054 0 obj << +/D [4049 0 R /XYZ 85.039 213.747 null] +>> endobj +78 0 obj << +/D [4049 0 R /XYZ 85.039 143.779 null] +>> endobj +4057 0 obj << +/D [4049 0 R /XYZ 85.039 103.615 null] +>> endobj +4048 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F35 2976 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3988 0 obj << -/Length 3214 +4060 0 obj << +/Length 2124 /Filter /FlateDecode >> stream -xÚ¥kÛ6òûþ -#Ÿd VDQ¥÷!¯Þm‘lz]ç‚ -Å–m5²äHr6Û_ó"%ÛÚíáŠ`Cr8‡ó¤¬füS³4öÍLšø±V³Õþ*˜maæŸWJ0‚²á¼X^=û1‰f*ð³ ›-7ŽNøq–Ì–ë_½—ÿzþóòõ/ó…ÖÚ‹üù˜Ի+`J)ï?¯¡OÓ‘·üø3ŽnùùÍ+îÜ"ðå|¡¼÷¿\/?2ðí»WŒûûò§«×KÇèè(JkdóëÕ¯¿³5駫À×Y:»ƒ~à«,›í¯¢Xûq¤e\]Ý^ýÛÑâ¹hÆ«¦¤…‰è„€þÛé8#ÑLmÌ*Žü04Ò¡UÐážE?¥³P*ôµ -g‹D)?K‡Ë2á !qŒ—¥”ñ“,œ8eº­›dÚ£¨‹sÁZôÄ€P š³¯3åQ–iÆõéÃÁðìz¯f¯àtvÂ,Ó]Œ³*i–Š?‹ÌÌ„©¯EÌ~ØÈi=_DiB:•ï?ç<*;l×\×e Í–AЇ£0ô˜¾Ö¾2XBÊnaÍ7’EËD;¬ŽmÙÏÃÔ»gzûf¾€Ñº`²§lÊ7J YXÆaá6êx¿º/s˜©h”Žü4MA@¨„èw9ßÖÐìæxMÔ?äÈPK" Z=ð|yÊ” –¹9äÌüw‡«›yhˆÄirÚö›¥tr0ù‘I칺ñŠž¤EôwwÄf±Â¹²à /{qýî–®’TéääûœÖà‘ËÖE±ñj:këlÞ=È#óÚ-Ë‚Ññ¸GÀ1¯ò¾ljîÚõÀM¥ -T -—ìø%Ëø«œô‡¬uàïæ¢-ÅÄ  -=“Ú3¯9#4ÆÛ©¶Ùóঠ1½žžPk{‹ˆP±r5_PBâ3ÀDuVùÑÞ¢ÝÉÊ©³—«]S®W+–¶|?ØÁI+;¼H•MÉ Q/åF`ÒhY!Qneß:í¼HÖkFDyR§nú Áº³ê5SyV½é^Ð’j‚ µ8ó6¸ JW'Þ6k)Ú·¬ZÆׇڻ–™‚¢¨W4û¡ ƒ F:!Kgqy -g¸„9Òa“Ž(2~–<æ‡`!ƒÑQÏ=OìÅæ2鎲lDܲÑHÅŠ.׺Iärή0î¬Jå=Ž•9Žú†[{UlÃx}jÄ_êá®æžwÜÞá h¦ý²¥û;xæä<þyDŠŒòc8Ø(Êý ‰‘Yef¶pÑþÿäÀ0¤šÒ>šOÅ+¥‰vQ/ ÆáCyœ†~˜qÔ‹|탌b_¡ÚF™÷ú{¾?T ã½lêßmmÞ[iêò¤8þÍã:Nø’)Aœ3¾÷]YoÑ4Rïí-·ÈîÖ ²s×1ìf‰­a-€1¹lÉב#ç«yÌzçBXÝ80Å'—zcµ[’ïÕwî‹~'ÑF”Æß(VÔ‚Í^:9zuÙ32K¾H¸0 °MSU¬âÖ’z@Ëi‡À,È è(z|…”\Š/ØöWM½™83H²—ÓTU ²îò‡ êQ째F~rö¯½?ôè cHºî®i×ÿÁÍGÎEXé8'º?ÁnèÌZÂ'hã•On8ø„þS³ù”zõòÉä¹#¾ìÑ–»¢…3‡eÎçÇ>%l’æ `§Cqé¾c¼Ð"_¹.H%èº7÷ö&y‘‹­”WÀyÇ©FZŒbÔɹÂsËù -Íað )Rdœƒ¤Bn•ærd ³Û‰o½ÔñosHòªD½Žbâ[àÆÇD3ðÞa˜ÔQ2b¨c«9tZ{0䪺g -e KÓîmèØœ4rô {]È®¹P<ä{À¤³€¡ÛÍYSfÂÛ\jÍ^2eÂÙ’Ýn9HZŽ+{(@{ÊS’wF^ãîJá«ã¹?0¿éz‰I›8ðÒ9eÑê"øšØjuÆ9ëQy Ú²\[o‘‰A?#OCø ÞŠ;ª#ùv=݈‘¬ Pg©P¾êíyoTË—BP‚&Õ ®rJwèêÒ·Û|‹( -BðwUÅ=)e¤ŒßA ÔuZ%µ¹ß–a9/㬢يÞ"è8äElS$›rëÂa]÷×Û»µåf2y¡*=ˆgßôšà`h3yYu< [·øÛ¡B ·EèNçTÜ7·UŠ(ERrg­ƒ–-÷8~bSk8F‚~$´¾dv§ Í•³‹0Ñì“"¥sŒ¢†#ƒ%‹k.M£’b{d‰­Ñ3…”ñV­ì™3^Wö á—çG¨TJ+~Þ솈æfîªâ³ç#/Ú>§À¬CöLGÖsI‘“ Ú yèÊÕè?hË]1éÕ£ww±?ôuT¥K†%Ó!ƒ@Ë. éVâ¤ÊúÄ WÕœÉÀ€ P:ÄNÇEι˒ã¿G*a˜J”„„. €V$”ŽÐÎŽjkÃ0L¼5/*„F[|EÜ’î—6àë„i‘±±›äŒÙõhšÊ× xvP~Vì”6‹ë/ýûeò{adØ…5âòSÔ PÍq»C„t$À†š£lA³TµbG4C• Eö04µ†ÛC[ˆåqèË,ÁªÙRj‰»}Fø=ÃëÆ|ázû⽄^ÿx;¡É«ª”ë®|"é³Ê™èѬ„ãê(=¢dœö‡ÆøQbë’H -’Û"ßWp÷쯡"ù@á”áËå5˜;Í5i±BÃÅZûñùrÛºŒ`ê$&òóø‹õ‡ßã‰&Ä :`)RÕ’†–m›ëç©>2ö¹”จl¡œL;[_óôtB¹´Cþ”Š³I9¬ACªµ#‡^¹PËï\Ï\|鸤'ÕéÜkî¹Û;rRtf¿ø"çb@Åãß‚8Èý/Xwæ赣ʷ7o1ûSüéâ¾çáTk9ƒ‚¬·"†Ü£ÊhŠì¸*röÅ÷~ô¤ØS–Ro'JNh€ŸÎúͽË`%Ù|0ðCRúÙ͹vҫѦÑ×=£u;ò:•£c_©Æy4ÝRùç˜|oŸQppWÂÁt¼œÍ|ªp¢t´ßT(ÃHÙüýábBëŒDÄ‘ØY\²xܲ\=Ô9®vj¿0ÁK˵„ LSÆâÏíHn3²×]Ú*ÄÄÛßѾvk®«´{ejHr£X8¼†‹.pê£âÅV{DŠOl:ýƒòèfˆqrŒ5C.RNZ (?E<3.×xزiíCµ`’I½]ÞqGOayj©!Z[TÎï™’Drd¥“|h*Ã/¥<¢Câãs_¬ÏD.zaø™_ó©ÅÊ!¸üŒÄWűšdÒs»ïW#$vÝã*LÁ¯'Ž’¼z˜‹uä+ýø†Œr¹ßI¨Ð™§ñÉ~ÏEÅß¾Š¸׳ËڰΦxïo®_âwËalp;*ðƒ}Ë5/ú!Hg—®f„IkÜ'ï«™”ãüõåÂqÒó\ïÎmº›Od îºð»›1q]Ò#×%Hu]mh¯ë|¿Éëí·tß¡.K¨0sß±8«¤ìlHÖÚ“PŽ‰›|Ü:⽆O2-OsÞߣ—™á`„äIpà'Æb= -‹ˆ×ë¡„°kÎö‡Rlê³ š¼[ÒùüD¿tѨ*f½²O•AàÀ63 A~vÀÚ± -“wxRfýM_1*|óþ͆P‘¶£,‡¿ëÉ«(n枀9zÖ.§> qIyò8ŃS‡€8á–?Cqÿ•ý‰ô9E¿§2=¶µN¸swâÿx*çæÉ>ß–«'.ÂÔûÄÄÕGþ¾ýp¿Z¤Ò»{÷Ž w^ŽÅRxoÂ"Üß½‡Ù÷H¾[ü½úyöfå4Ø"¤D=?Ïþü;˜ç`ÓϳÀ—Y:?Á8ðE–Í÷³HI_EÒÌw³ûÙ¯N¯EsÞ5‹åXŠÌÏBuº8öã vÐ…°*üL©!tJùq”t¡Ÿø`¦Ð” +¼w0Ö xͦâÄ«Žû^H4HŒ½ú‘[³–óô@;k"­‹¶-Ú)àÀ"ÊÛ–ô#Rº£‘ 6Ì [óåã‡."ˆV{Ð*f<)ÀÚ©DÜèp£-¸ÿ„\ó*â~מ8ŽÞ°Œ¼%(R +w5ûß–¸ó]ÁSŠ\ÿÔ·(ƒœ¡!å?#ŸÓŽ¹g{žqB¸¼­¢ç1W@@¢¬,*ë®Ä«Bþ¦ø Gt†7ù A$´Í‰¬§ üq’OÌ}ÀêJ9`܆GŒÕ†Ç…^£þ[Þ³Þ•‡§™ã.B±*hLJdHàUQ¤¼•M)ªq)ž¶(÷™Q·ÎIݘ+àœXX—#’¹5Ê:ºˆ ºHhíÞ¿4+•¹ÛaøÁôÀ¾ÖðŒÌÁh, Äl5-]]Óefb«mò¥01ÉW†â";¡9V<  †½câ¸áµ3ïGB®‹½ÃŸî ¥—ºÙÂ:Bî c٬ŶÀã‰=¤ª;”ök4zè%…q"0¬æû¢=nݘ#Ô\øŠ|x ³+ö\£™ÛÁèÖFhŸfû°åTÌNCâ= V˪½ÈþD[¤"hpÂÛ½ñ€g²ÁSúR%† ^h¼5\Ù¢ºÔA¨Ø¡é¶›¿ÚÔJ?‹ÔhK»´²–a×ÚŠ6'É™ºõagúǧ+³Ø Ûþ_4²n+ 4IÏ,¬´ˆQšy?,L]R5]0%uønŠŽÖ"½ãîù÷×è¿ð¤uæâ­˜5uÒ<ÑyÞØy!»à¿ä±ïKà±ä #:|qúÓ4½èÇpLQÒ^éŠã-¦Ú A\n*ækÈK)íù‹ …ØO“ì¦x&[÷(½ùùö¾ÈlW È2 Çl}ÀDÆåàÉ&š/åšÒ”²©œÎ7ï>Qož\—4èô›>{îžiäQmÞ{ýdš]d$i¤Š!”Ý7­•QýˆóÐÑ ËY)~?Ød~&µ5’vÖ$`}Дrž®*k½ÌëEÓë…Íåšà2R…N…k˜Ô¾ CÓ5È5†^VY› Þ6<îTboŒT›õH‰ÓÀ [´qM„”\‚ŒÞ;Âû­Ð9oè{cœ}¼ÉÌù 8ÒCiI© MÔÜ‹`×óX›ú˜ÇZëz)îŸjÓƒPñ­yñì¾.;«i£b}֘ǽêDl„`Zrû>à™ÌßÈ(i ò·´ùZÓ‘ãÍšk•‚ƒœ£þÉ,Òcã|=ˆy÷˜ç¶.â$öƒ¶«2L®ÿ2ojáÙ:¾/Û¾oD·ØPkÓI™WÿRkœÞ¡ç!"1AÂé! + CrUá‚ØOUzó@ËsuâìB„¾áÙ‰6Ͳ3ºµu‰€PùÂÎ× _Ñã¹ø§l;zÇQ·ª Yž¸¨´Ù‚zcHݶm 9iñ¡ýO>DçãÞhbrnÇrmæù*ØÓ§õXŸ7u§|(ÇÖýj–Út¹ŽŒðuͳ«V©yÂW¯ÏßI´fe_ F?qÁ¤×b°ó h'æ<ûS“yä‰éìþé…ë§ilºv5¸…Pj×ÉþÊj™9Pq| 7ÚMçÚ‚­TV#þa¶fvû.ÖyÿÆÂèîŸYô~¥Á•ÌþOÏ뀭;—lì/)Ò‚Póoaå=ª§*BC#†7}yÀ3íÌ–ékÞ|ë@çΗ'ŽúóðÄÕvpý}Œ½˜%9³{-÷åØ!o®>çòk¡tc^è”t¦ •Š:÷áö¶ÿô{|_©S?K'@RÐøÄId•AŒdt©°’©¯R9¢ñ¿ï­×^endstream endobj -3987 0 obj << +4059 0 obj << /Type /Page -/Contents 3988 0 R -/Resources 3986 0 R +/Contents 4060 0 R +/Resources 4058 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3984 0 R +/Parent 4034 0 R >> endobj -3989 0 obj << -/D [3987 0 R /XYZ 85.039 786.531 null] +4061 0 obj << +/D [4059 0 R /XYZ 85.039 786.531 null] >> endobj -154 0 obj << -/D [3987 0 R /XYZ 85.039 590.863 null] +82 0 obj << +/D [4059 0 R /XYZ 85.039 766.606 null] >> endobj -3993 0 obj << -/D [3987 0 R /XYZ 85.039 573.124 null] +4062 0 obj << +/D [4059 0 R /XYZ 85.039 746.277 null] >> endobj -158 0 obj << -/D [3987 0 R /XYZ 85.039 295.394 null] +86 0 obj << +/D [4059 0 R /XYZ 85.039 540.921 null] >> endobj -3994 0 obj << -/D [3987 0 R /XYZ 85.039 263.868 null] +4063 0 obj << +/D [4059 0 R /XYZ 85.039 492.833 null] >> endobj -3986 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R /F20 2865 0 R /F66 3242 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R >> -/XObject << /Im1 3957 0 R >> +90 0 obj << +/D [4059 0 R /XYZ 85.039 423.575 null] +>> endobj +4064 0 obj << +/D [4059 0 R /XYZ 85.039 391.154 null] +>> endobj +4058 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3997 0 obj << -/Length 3339 +4067 0 obj << +/Length 396 /Filter /FlateDecode >> stream -xÚ¥Ù’Û6ò}¾BT•ÅχԖÉÆ©²µ'ñ¦’<`$ŽÄ5Y’š±þ~ûJ”ý°årênFߘpÀ¿p•'~ ŠU–§~¢ÂÕ¶¹ V{Àüó&ŠlšWw7?ü”Æ«0ð‹ XÝ=ØuŠÀOŠtu·ûÓ{ýóË_ïn?®7J)/ö×›,˽OëÐX†Þï·0&tìÝýñ+þúÄÄ/ß¿áÁ'¾^oBï·oïþ`à»o˜öï»_nnï,£ÎQB¥ÍÿÞüùw°ÚÁ‘~¹ |Uä«g~X«æ&N”ŸÄJ~×7Ÿnþe×b\¼âYKRITî'¹ºK˜8b ÃÈWa´Ê’ÄOãŒäòO™ÞçªÝÁ9ºu”{ÏxÆá¡7ôÈ£D×µ¡PyH€•D]2ä ±e?T]+ ´ë®â=Q÷ Žz\o`N×ÃpäEZëªeÎFšòU¸@œhËçu”ñ¼ÝÀï×Qáð*@,›¥VÐ)wåƒ>⪣OX‘‰KB‚H3®ÈÇÄuÓÜÛâ~ueÛ"nŠ@#'|tjw_¼r÷ÀP”sßÑÑi¯=ƒÛrdÑšS}ax£‘¶j÷²£\ ¬xÐ8ÃÝøž„Y -›xÔÍÂY+d¡¢8μØŒa€ßÔkp2p²<Žå€@ºBήÍ(½Ï‡²å%FÀdÝã`îçé‘ï±Á³Œ²èØ1’H -…c8·ÕŽrÇk’è*9°sÍ kÛµm¹A÷@EÌܬàÇAG I)³Ròv(ñîñ‘1ˆÀ½^À¶AaÙ¹ۺ*YxÝÞhņ aÔ÷(Üj8”²Û4;fM"§86Ü*õsѳR½^Pæ­Þ¢ŽP(肶 KÀω‘–ÁwÄ{@o6·¼ÉÝU#ø|˜t|'‘÷®ÚöÝÐ!ä œ‘Çûãºíž®&QÓÕ%±cnŒ[6ZÆ5Ýð®DYç -_B×Ëlâ§ÓÒ“ñLšDäú«od†6Ü’lÅá;ÝOî=ÖÈ*¹Ä”äv`ô¨âßH¨@ùS•zw‡j`²›R·ƒYVËäg²ó­úr_ c2 L4¯1–ý½Ó>é¥ôU‘%!®/7r}èyê’¡Vµä7{¢È=-®19ZÄ]žXög¦<×>u/Hf$rÝ\¬Êïþ(¨ž]=Cr}iÍK -@¬éŸª-iw:·y@¢·´— ¿/üN"&Ùêi€"÷¾Ó£¬[ ³0|®êšéH\ò£z௽S íKºÀn,îOÙ=²÷¨¶Z¸†ãã‘Ä‹stL)‘h&i;¹˜Å¨ p{ï[^$ôN£Ñ'0€'*0 - D®§ݵ¬^™ï°^ÿ -Â÷®Æ²GÄ Ã@ógÏçsg"b\ˆøfH‰™–½©ãÊ$1@Z¶N]è*A'A‰3¡e2ÑIZdMìI­o®ºÈ;ŠoA6χ*Ô·8HÑŽuSŽ¥¹ƒ‰éNtË4÷F¥ã wlsÇX -Š0E󅡺ï²5D†‹ÊLŽAãF’óDqÅ×ër:; -â·cÞ½b¨Ø¸Ò)Äcpj“6ÂdÝ®Å^ÓÅÛIM¦òÐõÆ|À=ö4¨›jm$T™“k6 tu†SŠsúw¯”Tx• •/\<3ŒŽæT¨¬‘B3š}¶QhÏì˜ô凟”›oljŸ‡ùj£?ÈsbeñL2H¢ôú©¬yø#ªv,÷‹Þdݳ¿;ó,íߨ˜o›øà´ÿiVxÖþȵ1`+)Œ –Þk†ˆ„‘©\w•åF7J^×ÞŒ/´÷“[çÐ-pô×ä‡È_[À%;»?ù‘/GÖO„¡9\Slh“íÇ‘¤FwOþE›àˆ@² ’}¶ºf8ÑœŒz—Ötðmw´Žc“…©÷ŠŽ¶ÕœÚÂýüöþí¿yÆdñ};Åü‘&A´y}»YPŠ0µFg£kÍÈY`Ô ¾xm–\3“:C¨Z8áô´ì1/KB#´ÜQDZVB(.[3ˆbM/þ`dáçÆQá.´<Ç^L@N—±¿-Ë]y=Mý¹³•RéÆMNØÃ«É &}”‰¥r8Z¸W¡NAÆR&4ú‹©³ -)n¦$ÐÕWŠµ0ÜZu¢__æ"•è²Y /!õfù‡¨(Ŧh 8¹Wòé¬%ÂMQA‡(ÍGßdJ;Ã_T¼° -ÂͪDòL„CÚe¶ÝžádÙOâ@¨>þ¾;Ž°ÜŒÁG˜€Ö‚˜RSüµè€á棸`5ÅÙ×j\ v´¦fñj%%Y'… 2ÂÁ³Ò×l×è¯Uƒ‹›…縺ˆÄú¾Þ-ÚàªLº+pÇ©BúS—ã8E®Š•~šº}ž4…ÀØ× ݱ¦ã_F‡(óóBHµÙÞÄ>ÒE›ììR¦RÅqì½ïFásJÝ:ô,Çe(b? "×ô?`&K­E²Ô )0&sÚU#B×êšç¼1m;ÏýÖDÌh’8|·=dÉÿ+Høb±’§t`À^S"Ä)‘»hÎ3“©I0HˆÅx½XÚ×¥ e;À!ÍF\vmQÊŒ"/~ =PÁÜð¥.Â,ŽLY€H>Žtmè:œ+J - -²ˆªIØ˹LÝí¹è„Ô­"«0÷œr¥_ò9' Ôë2í¯Ž訮;Ž¥i‰Ž¤¹M]Ù*G-º"«p œÍg\&ª@!ON·N·»¥¸ÜŸŒÖϲU°ðVÌ@z”4îZ“·rV ­žÕM$=ŠµÏ̲æ82Ù×hZB¨ÍØ°®kÓ'²¹j]qÀJRÙ¢|»òQ2©»ñ”ê8]#ë -¤Œƒ¯&m{"bÛbãYu?/ë5 å`ƒ²ESÅ]èºäa%Hë{Y´4æ"಻™iY"=ªlvXÇPLtÃÈÈ©—0šnˆôàËÝ*~ÓD¼€­…ìm¥FÎëÄhI¸Ú½›¢gšVÎ$$€:%0nƒ%ð¥R•19h¹cÓÇPnÒ$Álˆ“ID׶(ßÍ«rN¥m`ã«%Å´ucì”~0¡¥¬4°­³ 1øWžL¢\ùEž~óõÇ¡¡gŽ°±¯âÔ}æˆÒܳ˜$û ]gá½îšÆÄ°îÛ¾ïÖ¿ûá;²Ê7Ù™h®¿ºD±òó(â>ë:9–EbŸYèf˜nªa´²ŸäÞÛ‘‰IQáûá ¹:úÞ"/äáEˆ¥™/|ÈŠ º'i.ÊÄ?뉿SþÉä Ø#Åþ`2G0DP•­í19PöBÀ&p°¬fs ÑI%ÞKFÌ·s§Ô#ZJÏ  ©Ù ‘§Þ:ÐÝÑtÎ0Üb#ËôÔ®’™CYïºæ²\»ºìÑûJ*ôÒñÜ“ÙOŒ‚•4Vœ*¶M)ñø»Yf´qlUצýEÇ0NbʯNãt;Úë5¹Ì(RRWñØÛüSSúóoЊ~®gBÝî˜|.ö”}yÀ䦓ú&Šœ¼'Ï߶â¤Í¥ìkÂ,ÎŽ÷h"ÞœºäZ•E5~Ì©†­ér¦Ço—ˆîZþNÏRÑYk± NÓrÆß5ƒÚ&¼Ó­Ä{Zïa¾¿›âªdjˆšNÝU;ëù‘äÞYh×I.riy'š{DïVx‡Ž5gê%R'žù M—€›.N·%à8˜…Gøií—ÊR†iéIŸŠIL]cê`\ÐlÆvƒ¾4Ùp€’¹JÑÛô‰{’¸1æÀ.Ú,=&S NïUy·ê —òÐ&[KÞp&;Ç%!¸›ªÂJR IEŸç8Báp4~-OÃÜâè›Ù¡±yBèÈè˜Ã õ£0™ò„Ð I‹¡^²Oí˜3€‡S¦NÉÐ48käj!·¿ýøküÊ6ßäw¢¹žHq…œ’¯såIr6­Ûú»´Ò%],Ï^‡å¡žþ®ÅÚøR+Aù*—ö¨@n•Ö«ÆÓB3!ü¨…ܾìºj ÌŸˆ˜çjrkOUgýï FÜS]Çm‘y¦Zõöé¹ï&?¸‰å§Y8tãì*3n'÷m3‰$3 •íORzŽ}qÌìSn&Å`iF?¥ €üQ6°~jþ¦—ÍŸˆ3×â³y½›e\ž#S¦ï®·B¨e¶¾¢h*ñcþ“£s=ƒÿ,™ÿëÏ‘¬¶Æ9$áѲ²&Qwfð*Tqΰù³¥KŽÿ“àt‡endstream +xÚ}R=OÃ0Ýû+<ÚCÛ篬HÁÀB6ÄZ—D´i•˜ÿ' ­*¥w¾w÷ÞóY‚8 Kb‚l+NÞcå~%&„ÒZ©Ÿ)sµ0¸²g1Ga¥åTÂÜV«›µäDr0Iµ›…˜(„KGªí E`…Öœ® +Zh,}uÊû)ÝrÚç$4>LÐé­ï{­WwÕ·žo¦¨XœµÌI!ÐâU;F;0è–v„Tfi«&;"R%}b… Çà/)›š®’ÿ`Fr¡‰àPòrA®KiåH^5íÀ +Å Ý0iiSŸâ ßç³m»ÍAÇ’°’ÊúƒIG}>i§JÛ¥ÃpÌYhÚØ5N·´÷{_©ÓG³q·ô!äÊtÚǸî:?±îk?Oó(~¾ÅϾš¹ŸQÇ]ú×IÄ®3íN¤'YŽ¶·Qc´»IŸéMŒ­Y>\¸~Ô ð×ê/náú È  6ó¸ñè¿”h‡W8¿îÁÍ¿endstream endobj -3996 0 obj << +4066 0 obj << /Type /Page -/Contents 3997 0 R -/Resources 3995 0 R +/Contents 4067 0 R +/Resources 4065 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3984 0 R +/Parent 4034 0 R >> endobj -3998 0 obj << -/D [3996 0 R /XYZ 85.039 786.531 null] +4068 0 obj << +/D [4066 0 R /XYZ 85.039 786.531 null] >> endobj -162 0 obj << -/D [3996 0 R /XYZ 85.039 283.986 null] +94 0 obj << +/D [4066 0 R /XYZ 85.039 766.606 null] >> endobj -3999 0 obj << -/D [3996 0 R /XYZ 85.039 257.371 null] +3019 0 obj << +/D [4066 0 R /XYZ 85.039 658.638 null] >> endobj -166 0 obj << -/D [3996 0 R /XYZ 85.039 118.042 null] +98 0 obj << +/D [4066 0 R /XYZ 85.039 658.638 null] >> endobj -4000 0 obj << -/D [3996 0 R /XYZ 85.039 99.17 null] +4069 0 obj << +/D [4066 0 R /XYZ 85.039 620.371 null] >> endobj -3995 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F20 2865 0 R >> +4065 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4003 0 obj << -/Length 1937 +4072 0 obj << +/Length 252 /Filter /FlateDecode >> stream -xÚ­XYoÛF~ׯ`ŸJі܃ÇCäjÔI« ‚$´D[„%Ò!©¸ù÷k)Ê–”- ™ËÝÙÙ9¾9–qÁ_dNE&Ò,QÎÄÁb3‰‚+Xy1‰…b&$³Í“ùä·ßÄ‘Ê£<˜_|òH¹< æËOáÓ—ßÍŸ¿ŸÎŒ1¡UÓYšfáù4a.Žãðïç0¦eÎ?¾Ã·s&~üæÎqòét‡½5ÿÈ“goŸ1í—ùëÉóù èH•ØóëäÓ—(X‚J¯'‘2yÜÂ8Rqž›‰uF9kä}=9Ÿü9ðâ5ð®CVq&S.3÷Í»‘YâX+ë uN%6%»t%*Ô~›ê,,[° ,|Óô ]f›_x­EÔ%.Ú°¸˜Ît6SøÇûy~Æ~UÁ†_œÓÃD_ÕWL°)‹ºó´…œx^lßP¼v[­×h]ðq2RÆıJШEß~g’}}S•ÂHHf·e¡vZÔM¿òšµÈ%˜ƒ¡e1>§ýçg@ô„"Fƒ ¯7¾ŠŽIª^”Gr²"Ü.Jžj.™|Û•~ãv'F\{4ß_‹¾jj¤Òa±nêR›NTÆ`;7;ˆ†ÕXåÎížYæHo«œA4BÃEáöT’†tÑõÔ€ÌÏ€ï.ÐiIB¾ƒ™g¤9QV5O=…ÔÐ6àYØÞ>:¦ÈqR¡ÍqÄ'¹V:I¡ùªd¬˜1¥Ö*M­`¥Û\¨ES_À”ÍUyº›1ˆE8õäÉÄ ºÈsäs€¸ó;/>äDzوE`ŒP ulÁ7oazÎã¶,Öka°›K¬Á -…K²Ù]ÈIlVA»Ð$`§Z¹4c\³{¯:1è0|<¹t¢Ã§ ãܼÖæ!X ²­*Ù+Áˆ§àÆ9 nÞŠ¼:±<.˜/Ÿ²ðH‘Š+Þ&#ùÈV^DÚËâ~ÖjL»’³ñmR}ÖRv˜8Y,zÞP•Ì3()Scή…+¥Cø¤îC‡ïËbɤ`@æ$†E£]ÂiÛ– »¿R¬(6:âÅi1n¨²²3q|‹²-å, Aö¢†ÂK[ÿ¹Aëµ¥÷»… çåÀª¼ C í„uD1T•1ÆKíUÀƒ÷#DzêÙˆü>$ïòD톴‚ž°é± 7=ë^xxšÓ˜âZȱ0‚4.Ê(s|Zë%õE·”Ì`í²iy°A×P2Ö.QIfÇÙtŒ‘tÃ%¡r8ð]jT¤O·È#šã©Ì¹\E©§2+© òÇÑ‹xé±|çõGÓù\¿_ÒërAm ¿I%£Î ÈÞa.,:Üz;5$ø×.%7–í·²=¦-X*µ§Ó܈æxšÃ>Ù¦1V¾,GŽ2‡Š Éçp“wGÀ8‡ravŒØç¥ÓÃ]þÌóš˜P%·*‰Üž*ߦJʺZîìçÈEð‹Y=Šgt %% òµ(~U ­;è¼½áÙ¶÷Ä4ÅɶfºÖ/ÎØb}ir]u+BðSU½˜z©ÚïมȰ)3{iŒ°µÃ㛂ëõ ÆeÒeù‹Ë#€,õ$Ôf_­xç+~`ƒ†O”n60þÅn;ê·óP¨ÊÉFêÞÙ¥å"ÈWnڨѣé7a7Ü·´d°›Î+TÈÚ‹õ¶ë½•u¦ïhÅÃêÏâìÜÉ¢§”´S¬)ü®$#Iö!Oà€ Iµ§8.QuhÚk?ê‹!”9¹í -I7ê$ êpWC¥¢TœïrâØæ©‚)êçýèÌU±À·kÑ@õÆ;`1|:}{ŸRàýX >sßiÄÑ’r¦žØZw -ý}E ×4®ßKñéŽUÖ,âÛ5jËêñך]õ+ÊA[ª ôU ¾’@®?êËŒSöðø±öÿéSàÐîXèK3}ÓN§*žN„¡Ö.º+°ÿdx_â¹+Éendstream +xÚuP»N1ìï+\úŠ[v½Ûm ¨¸(N!D)H¤Kàû±“ƒ è%ÛÚÍì 9,‡\R@Î.&erËݺ w M Q)ÿ°ûA»À ²¤YÒdÒ©DÐÄ•³è›«Û€. ˜±ëß]ˆLÌi0ˆB®{ö-“ZF?ÚŽ-úûò`¹ÉCûÚ?œ4bŠU££@DË^ñQäi5~­ÚŽüX%Ì_ï¶/H²þ<ΆÃf·=‹:öE{³ÜWõæ¦ÿ 1e‹-ÌÅÄâÊ4ä¿è¿e°‚ð¹ RGsÍÁhÀjnâÔl—ii¼¶yºôüŒdÑendstream endobj -4002 0 obj << +4071 0 obj << /Type /Page -/Contents 4003 0 R -/Resources 4001 0 R +/Contents 4072 0 R +/Resources 4070 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3984 0 R -/Annots [ 4007 0 R ] ->> endobj -4007 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [285.267 598.718 366.899 610.408] -/Subtype /Link -/A << /S /GoTo /D (domain-member) >> ->> endobj -4004 0 obj << -/D [4002 0 R /XYZ 85.039 786.531 null] ->> endobj -170 0 obj << -/D [4002 0 R /XYZ 85.039 726.833 null] ->> endobj -4005 0 obj << -/D [4002 0 R /XYZ 85.039 705.84 null] ->> endobj -174 0 obj << -/D [4002 0 R /XYZ 85.039 661.355 null] ->> endobj -4006 0 obj << -/D [4002 0 R /XYZ 85.039 642.483 null] +/Parent 4034 0 R >> endobj -178 0 obj << -/D [4002 0 R /XYZ 85.039 573.021 null] +4073 0 obj << +/D [4071 0 R /XYZ 85.039 786.531 null] >> endobj -4008 0 obj << -/D [4002 0 R /XYZ 85.039 549.704 null] +102 0 obj << +/D [4071 0 R /XYZ 85.039 547.583 null] >> endobj -4001 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F35 2880 0 R >> +4070 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4011 0 obj << -/Length 3253 -/Filter /FlateDecode ->> -stream -xÚ¥Û’Û¶õÝ_±y -5ã¥I€×ô!SÛqê$õzf7ㇶX‰’Ð¥H•¤Ö޿﹤$Jí$³3".À98÷ƒo"ø‹oŠ4Œty“Y˜êøf¹{Ýl`æçW±@$©Ó$öÌä­›½ÍT%ù,Œœq›«$LŠaÞ>¼zóAE7* -³Lß<¬oâX…:V7YY†ižß<¬þ¤áâ6M£à}»3vÍâVgyð®m†®­ÿzøåÕOþ9Æmp “ a’f7q–Qy„ ”Á bò°­·*‹‚Ÿ¾‡è#Bq°ÄΦeЮê·Êtm6? Žo>Äét{]„ -¯Söíp­Êã;Ó,T¼pïë¶ÅF˜ý¾ƒãZ³\¨<ØòàßïùûÅ"*«~íq,'äËFñ§ížè7ˆ×Í­ _àaI}µl­uXO\ç6ZAÃ>ÖÜÕPÅQܱÇƲm–·‡‘Á¶MüK€[3|ßó’;˜ûõ5ñˆAµ4‡^6´Ïlì3âK»õ<4lÆ£Ó 0Þ:~r_Wt‰ƒÜ$R1½)‘Ûî÷€C3À¢Cƒ´ x¿¸&M‚¡å¯`Š9MOdÛ~0@8ÊjT­È¤^„Á‰ƒßU¦®eã¯xˆid[ÕûÉ\{@*Vãñ¹ß§«º$cžm/LšP)\%2´öÞî~: Ö°ØxNÖÖt ìDAÓx³nñâ Îàeyvî -\Ï_S©«é Ï‹$ÜÖÆIO„„§èÅÙf4ÈÁ™•[Ññ°È›Ö -æž¾íOº{à _Ö˜'/· -P–eØák[BPÌ„÷±cp : ”‡FÿÅIçD_ ‘g͈o( ÚÑïJ”îœbÓî%¨>ïFAF¨ßîï$ -MoI%I³2Mú` ÿx,ë¿SXpÁàð†!첸½7iðòPS‹„ÆQRÚuÓÝ «•P´³Î"à5áiÜÈà%“QƒßûÊD!X¯²‚‰‚ï,QY4•£ F‚`–ì(6jûD6„°‡>É|EúÉJÛðYv<ßPR^fŒâé`ï´Ñc?1‚Cå•@»Ùx‰ïyLôZ;ãLM¤':%™Ä•›†mrOÞ66rÌ,›y®íøÛ¿ôÁì¸OrÔâJdÑE·#þ,œn³ôaQh”ä$Am€ -6 æ°]pŽ G&·Ô²EæE[fiÎhÒ<Ûúî5Ê4³7øBR¶òà=¯¿êÖì1™sYðÕñÍÙ{Ú™ñ)8'„—8 ¡F}d‚4Û¶zIà"Ÿh+LìÌÆ.M-Ö” ¾wGÎX&AõmrSËAl8C´TßÖÎ#b×Ôõhšëº¿hL?, -p‘ìxÏÍÓ˜Á®¸˜E3Ôµc²#”~8M$\deXæÅ\&¡â°ˆ‹ 9Q¬“0Öë)Ë8I )Rý–Ý?ºx$ð;ï>¶o>~æ¡S£íêEÒ,LTùÇi×_¡A€†OÕð‘üxwÏáUcœ=ìXJÚú ùÁE¤âÞýò+(3 bü׫Œ˜«¥|h+ñ‹wŽ '­³X«2Ôó9ôÿ‡ö¸þ -Þ„ˆûŠãlÒnÿÜQú°ŸšÑÓ_¢$Nüø”Œë¯P"@3‚ÿÁÖ•#J(zo}Ú·ÚN|ègvâ„o*x'«’Ü·¸JaêïxöÛ›ß,q¯ãÛÅ›ˆT¨´úã71®¿rD<¤Þí2k]ˆ£UÌæPÅÓ`Šú:«èÜ6*,k+2.¸à@ÕµÓ ÖH(L@ ïh¸{1Ò„Ãy÷gKV¶¹K ÄR€Ì= u–Ð7Õ¬ï%N÷ ´Çàò4ã”›ÇlA¤5núŒ!2ñÜ…óÜåè£;Ês]µ§\¾aåIÞq|yg9Ç“ð„Ê; ÐÛÝDùRì2zX5 ž¡³n¹,Qsw)Ñ5t" -pÜoA¨ÓÈ"O ò£éDqÝó—":?“#GóA°^h#ûÊùpÅ—º÷¸jº³øfnçÂpî«‘…±«;— ÌªúÏÁ Oäñlã•¡ˆGËWpV×UÀº†ƒ o WW\‘‚榒±öÐñ¹g©=áâ/…âGáë1MT¢³ÍÒúŒt¦•sQ\ºQ)ÅZÄ© ³£z¤Êô”‚áGÜGÌNøîJWݺZ¤ áƒ‹f_xöîWþÿ¨¾ðTñÈ«VOUÿÝ\…²HÃ$Ï݉Í9ÆDåf+‰.Îr6-ÚEò®áZ¢,Ÿ©lÍsIòX´4?ݦ,‹×ÌÆ÷¨&˜c¤)†*Wã^eôgZœ#•Ï‘5¦kX‰©QÒÅâŒígX ã¼®’y®Èÿ”*Ø–Û™ Lu˜%Z 9ÕÈ)mç‹ÉrˆøÒó]šKþåèô##ñHxZ¸Ì»â) Öb÷<ÁUÊDRtûàîbàŽ¯¦¹p`°ØòŒÌ‚Ô› ¸”‡æ‚L„y¬KÔ˜†ÓÈÉ¥£ž˜zFMÉ ¯¦é8fu×GînLcûãºÄŒ%ý²zÍJT¶ç¯“\lw$e¥Ój[™$.Àw7r{'¢÷#ZÜ5®2–—R+ÌŧÀwk|µô{©pÁV“"Àw¸‹â4àÇ45çÖ%Ÿ±i}F£X±µ:“Uœaz„t夰Ò*XÞËÒ•l:léUÁœ!Ôyb,¿«Kiûkž4¾ÒãkŠÓi.JHÆÒÖÉq(g® ßú1?¦ê2¥Ç'à¸$„®òÍZHQ ÈjŠò¿ƬÐØl‡íY†5×$áø@„e~O,ʉ4K-§ ÅzÆ÷…ž³”ŽÁ˜¨«ÏY÷°†+ɦÏY -âíBË»ZLU’2ø°ÐQP™á@¹•H©2¼­šŠŠ·TÒ¸„oz9B¸esOmqƒÇ)D•Ù´±CãB^m+¶è©“õHžq”lò -*Øe‡mß®ÅëòµÒ1†@èlI™´^~œó‡çZøQ -¯†?#W¯gÜG -©‚{ñ»áì&‚ö¦áÖ]3sn…9ìÃëPŸ¢ÒWsï±|wÇíµ/ñn Œ bÅ6¡H4JÆÊ ÉV¢Þ‘”"ÈJho[WÌ€M‡5A.'KB=yC„[‰½ÙY ’ö _e’b Ö ý8æ¬L“¹kÅ@¤¯(àð’«¡GgXظ§óg,=#‘5®*_Éß4•CãõQHq1´AÏ‹k:ÊBfn;D%‰OLuB,åÌÿ<åendstream +4076 0 obj << +/Length 2702 +/Filter /FlateDecode +>> +stream +xÚ…Y[Û¸~ϯ˜î“ ¬UI¤,©/‹ÍnÒ¦h¶@gŠhûÀ±d›YòJr&ù÷=7Rôu0Àˆ—ÃsÈsýH§ ü¥e'ªz(ÊUœ«ôa½—<ÕÿŽt¼Xæy=6Ã×fX,ÕªˆžU}?@'‰š‘ÇLWsã±Y»H£iÓßyð3ô{h¦Q þûô×wžüÞ¼TØ}šÞÝ}@C»Oó‡4‰«¤ +w¯ò8Ï ÚýÓÎâþÔ*Z/²2Ú™Ã;iË4³¨<: ´µ¬ˆ¾BÃÖÐÛnƒÃÞL¶ï˜vh¶f¨ñlÝ–©Û®qm€Z^$A8õ^=âhÉ‘>íÌÄTÀÉìqÏØâÁ½!žÜyvœù8À ö•FÿIR½=Bc ¡5j”¶LÑ'*Ò„ª×š8€l°¨.Šègül×C?ö›‰»]CçxÅô¨›7õÞvxt:Æ„3fêž|űØØõ=ñΩ¢sRZÏͽÝFLBSÂÀ1výã(¨£2z6"ȶ­ æÃÿÓ è NÓ9s¿òÀ+XàGhjÌ&ܪíxÆð'0ŒŒ¬{Ó|s+§fØ8™E&Çó·ÈÌ ¼Èmàó#~“è‹…€¡­”¬®Q¤¢žqṞqrOj48_9¤x»Î€ÐtÒ¤3‘—A‡ã’›4ï,ÃÎÉ粦å)ÓŽ½0éy¤nÐÝ:g°,Ú¹`gÍqoÉ9“‘@NÀCMΟq=¹c}â¬À#J .r¤øVïqä |D6ÿÇ&_m®ècÛPpi:6Ÿ­ç9nõ¼É ];ò0‡­·f‡Á>³P8ˆR;³VWB^X#í&´bVÄIå¬ó:¥”UxÈZ¸Çè¤ó¯6ÔÎtÜ4gŸb™œèR n^™…ßI¢Û¼M:%o&äF¾ÜSî¡ä¨ÓB˜ä<– Eû¤‘ >‘³•­­ÍÁ`^k·Õšéÿ\‰Ø9mˆZ‡¦5“S±Xà ¿_(p/"êÒb].W*c3¶ÖÉb/Oí•ó%T´ßÍèJB‚šÇ‘¥K•U‘!y/$­f";þˆ4úáËn$ßy˜s,j¼ÂOÁ沊‚Fø¸ äA: w¼®ú>÷£Ð³IÌÁonXˆ>æôe¬Û1DÌæÈgk`É +íì»-~(ßï¬È)x9GM\’dœRVÍ«Ÿç +Ù9r !Ü+ëS¦Á¤¥ÆY\OAxàòÅ\¸rf…âháó’“,(¿‘pÕÀé]Ó„_Ï_Ú)mã5ˆ îIî ‡ùsV3zõÑ +¨ïÅ\:[I…:Üö‰C$UR©\& È¥ ñ‚ž¿^(šêxÆ©Ûƒ7ÅØwæ¹u]5 +³®'î9z˜ÍÊ›ÆÙÐW'0\˳Œyz:¿Eo°.ûH¨:@apSµ„àÄ£i[”e]v–ÃvTx&ž¤”4C#B#ÍÕ‚XÌyt€¤nN³;…ßfô}€à&>MßÅ70«ÎM'÷w@ãwªc¥Wfr_ âNsƒ>"‚F3x¨ÕjFÚïE+´Ó[¨Úq¾»Ã™æ&ªVe§pÇ  +Å™ v‘§lŒ¦ã;0nW噸pûâ3PÔì SrkGönYÊ>DèE5B9NÀPUEŸ®IÊxä4èŒy¹<€í©w) +{.U^Fí v¶óÎJ›øÝ ZÆu£yµiÑ.þ¥ $€î_¤ë|Ü-›únésg—À°ñD¼ôeR^Š•ƒ+ÙȵN¸\*dCÊ@åñ‰b†ì # IË„´=žÜ +ðp¥bă4ý\ô^Þúó†&… B´E%‰Ö’åd®¢ÑØݧJñ¹E~OüÙR^ê-BwÉDŸ¸·FXE’ŽCw«4¹h Ê4œW>‹®mt…X‹#ì™H À•~ï€i˜â¬ä>¹ñ`4/A–•üI²¬‡ÏÍ(²Ná ð€p <ò‡[04+KÀébù¬d܇C¾øQÇ´ÍŸøòóDßË:_âÁYUDîbé).6…ƒ"üHù‰˜ñ6 £4Ö“YÉ®üB6nM:ÙºíËÑF³§VEÞãVþ¨¢¿YÑï¥ÍÉ©âk*|¡ˆ¢›2ï§0AŽ–j€JÞV©\&UgaËÒ¾±@` Si/‘݃_Ôåòêü%uþ”*¿’ýσÏÇÀx;ã!<´3r€Ê#{>ÊÕ7³¹¢“ïdØ£xó 7 M?¬}ØÜ> +VèN½Ú{?i&¼¿ óvX›Þݦ5R‘ç70qÉä°15cºÄ­=Äža9å(aCï"Óµ;BxýQèUf˜ï©Š¡ÆÄmL­ZS®.Up·rÉ×— ªÖÌ Wyÿ®s–†P“¿=ižü•=Øðó ý"¯r˜%‡¾mg8yCß:‰³û÷·™äŽ¶™æMeß–6ëúTÜuUÏâÎ4 n{‚Fþ¡ùÆU¸•78ò[y]Ò—Å +=…ÎÙ‰–î'Æ¡„yf䮃§7æѺËxNÅ4´œ{’“/'‰¶õ£—Ù¥3'¯ |®³mf'¿lÀf~ž”Cpñ«æ’Ûë~ol7'ÃëÞSUñ*ËîzÏLrÛ{„æ-ï¹#Í{Ï™¸«Þˆ»ˆS­÷Ö¥AªX.-ûлfYÕ‚IÔG¤Œd‘Ëxó•¢Èâ<ÓoüpéHn+RhÞRäi^‘gâ®*2âþ<™ël~ë r?€PA¾ü­³¹Òî~ºÁ…”äÜ9U®Ü9ñ7$d´¤æ8_©9äíÚý¢I"’–¡ãŸ Ò“½Ñº—{záÁðºŒÈ7ßáOÓ¶wŽ_ä1rµOMÃ[a§òX+Úï¦×̤—fX«|åØá1Ô…Ï䪌óRÝ‘ù`;¦Ëendstream endobj -4010 0 obj << +4075 0 obj << /Type /Page -/Contents 4011 0 R -/Resources 4009 0 R +/Contents 4076 0 R +/Resources 4074 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3984 0 R +/Parent 4080 0 R >> endobj -4012 0 obj << -/D [4010 0 R /XYZ 85.039 786.531 null] +4077 0 obj << +/D [4075 0 R /XYZ 85.039 786.531 null] >> endobj -182 0 obj << -/D [4010 0 R /XYZ 85.039 766.606 null] +4078 0 obj << +/D [4075 0 R /XYZ 85.039 766.606 null] >> endobj -2951 0 obj << -/D [4010 0 R /XYZ 85.039 676.205 null] +106 0 obj << +/D [4075 0 R /XYZ 85.039 766.606 null] >> endobj -186 0 obj << -/D [4010 0 R /XYZ 85.039 231.642 null] +3020 0 obj << +/D [4075 0 R /XYZ 85.039 658.638 null] >> endobj -4013 0 obj << -/D [4010 0 R /XYZ 85.039 205.027 null] +110 0 obj << +/D [4075 0 R /XYZ 85.039 454.407 null] >> endobj -4009 0 obj << -/Font << /F20 2865 0 R /F56 2890 0 R /F15 2876 0 R /F66 3242 0 R >> +4079 0 obj << +/D [4075 0 R /XYZ 85.039 414.243 null] +>> endobj +4074 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4016 0 obj << -/Length 3702 -/Filter /FlateDecode ->> -stream -xÚ­ÛvÛ6òÝ_¡·¥Î©h‚àµonœ¶îÆI6q6»§íMÑ67”¨”/ß¹„$J~螇¸ ƒÁÜ!5 àŸše±è|–f‰k5+WgÁìf~9S±…óÓÍÙùÏI4SŸùìæÎâÉ?ΓÙÍòwïͯoÞ~š/´Ö^ìÏišy—æÊ»¾¸zÏÃoæ åáÐûl}š‡™÷áÝüÏ›ßÎÞÞX"•ÖHÀ÷³ßÿ fK ö·³À×y6{‚và«<Ÿ­Î¢Xûq¤¥ßœ}>û—ÅÅsÑŒWM7 -?L±ûY˜½¾Žs:ôÔvÁl¡¢ÀOÒô(Znð]< ¥B_«p¶H‚ÀÂÄ^CΔòó8ÆkP*õ“<œ¥aêDZ¦{xßdoµÏXžÄ‘Ÿ%ÄÙÙ÷™òƒ(Ï5Ã8m:Àx08¿Z©Ùe ”Îvˆe¼ 1«2GfTœøy”ÎÒ þ¥Ll…„(Oó0õZluß@ZÂØ+q®ÓÔµ6çêyº½Ãoâsœ£¡ëÏüýŠ`5.X¶ŒÛ,K¼ËvUÔßârÛÕ„xá Þð±î`¼]¯¸; ?éŠQ¦r:ÀjÛó ‘ -½Ûùv«°£íF8±¢û ÿ&å {ÏÀCË_;‹â¶©Üéл·‹’ØSõöjx0–°ÃÂ%;&ª ä #XÂŽ:÷î抉* ›·Ð語§7t1íc½¬–þîùB>Ÿòð7Œ‰®å±m+¹\µÈüŽi£Žm òãÿÛ¬@¥"nWÃP¯ïq 浶”ªÌHÕ}×âÚ C!Ū’%­Y*p8à Øg]°àñuä] ÙÆ}Gä5rìhÂfÀóndrÝ®y%9Ì¥ÏÞÞ1à.Û~àžÜ=f-cxÂDBbwÜÑ+Ã9{É5 8CþÄAY4 ˆÄá ¶4ðVEùP¯uÊ%e»µÚ XÔœ¹FÞÇÆ•+¾*^lùf%¯ã-ð.èk$G”¦_l¬…“%ízßÔé,óS𠉋“ã©î^¬Ù'Çè…~hÀöq"[öï -ˆ¹¦Ã¬Xí@º•Ÿ‚·pyéªHÿŠ±o§3ð0!l*_á¤Û20 hÂææÚW‰E„›ß±,°C^q…DšTSæWʧ¿OZ”*?ÜŽ[ú^]©W°Àuùßs½£ËŒóÜOÂtäHìr$Ô~ªY QFð%Þ<H‰š†}Û`Žn×%é+\uSµÙž×"ÌØ^WOÜ ›Ë­9‚±ÏÅ -qß ÍV F=a§ôã¡óæãÅIîìc…²`bD;,Èà2‹ YðG ÒƒAΕ>½!ƒî·Ãr ·–Å;û}u½³pñýMÄ[ÜëF{ßåIû1œñ4OF < ×xrjCÓýý&yâìw±\Î%lÉ ó ,~ÕõÜ|¬Ñç©vh|é­ „ùkò—Å=÷SPci°›îÉk…ÞuÇ‚·,Ö gc]’[N+ /ÜÁý>F‡÷ -q\SW´tà{¶jŽJÚbtCÂgòw¼~ ׆ԵͷZààC!Úè!úºÇy Aa -Åi6Er+Fˆ´×¥‰PZ¢¥E-þ![RØPÝNøÁ¾Æ( ó.̹TÌgj)¤€^S Æ«iyKêj•×0ð@Jo±µ@ ÍkV…p;÷• r÷vá r¡›Ëx«ckh`|ÛKƒ¢deø |øÎ=õÄ1¯)B,˜†•s}’Ä‘)dÌb͇ {¿•ñ2d×&úG:‡¥ÒWz:¡ÐôšBŸÚÐ(ôþ~“ -íìwŧì¬ü.·6ìFAK!z¬6$¨<(òš‚$¯—Ü ±mÈålÌ춷¢…°n8h. -Æ1ž+¶F*h.‡¨“€ Ôph­ô-Ðk¿qÏf\ËÞŸ+ÌBr‰—£<áC‘ëÂÞ“ºÙH',ü¸ö*<-âCEÆMS”´ÖŒË~Åšçß]âê‹<ŠÖªŠ[q?̱Nv|í*ÛõÙVÝ€†ØÀu’ 2K”£qa¤<%>A(×9zy2F0DÕÁÆeÝ”fÞnäûL¦‚1@5oêRŒ‡r‘ˆœŒÝá…< êû‡æ…5®çû06ð¨žEQê«ð´š0ǵL`^Q²S»‰Žío6¥bÎfW+Ð N>Yò)ÉçlvÛ4Øɼ/ëºý3‘X0aPÑ¢G‚Áz.@Õ°öQ *Dã)û4Œ²¦Šj&£êÈÚaÈH—P“=,S©!¥ٲͤ uC BÛ!Mqs®™@‚Øô-·ÚˆjÏýí†q°('Ê1Â²àŽ¿xꮄî¶éœómÙfÔœÐýg$€%·o·GÜ$‚Í’EЊË`on˜ `µ›ÈÙè@%( Ä®j¬loGþðÈ—µuè”;zK–x -ñuÑ7ÖÙÿ?Øÿá†ÌVDõX/Gý†9¬ -‰SôŽQ:áë eÉi­t€Ž«¥zE/On(Šy°ß”fºû}¾¸Fa‰&LK¼¥äŠ:”:mÏì©xþ‚êoãI´{’<Û‹Œî¨Îáß´®¶è7È÷nkÒØÁد sÒ.èG M34˜Ü’:5×WsRýíXëxá ªgñb¹nœ&xþs’8¢&‘Ä)MBöžôávD2LýL),„•V:.41àl¸`—+?K²]·†÷Äé{‰ -Ò~8ëÀ}©é•6´1DÁ׉M…Öc`øRÃÖºå^9¬¶jùñ‚ÝWà›ÔéµÆ)LU;mì"Â;1[åK¹Sž:îX÷mw”%^þÌßsüÄTuºÿùÈß_íñpr,ãp±½Æ× ÝV†V•¨ÑÁ»JÆé/‚Ü5•%’Ô™ÃÂãÞyW½›é†v´Û˜³¦W •Ç£Ø‡” ¡´p•ÚÒcê/\½ ‡²Â1ãQ©ÚÄS± OÐ[@N8#F†ã÷œ?×R>ÏS¯g5nª Õ_WΆyY’,w ²18Û´÷†98×c³ääð«ÁÖ7_xÝRjÍ5[\À¹;Š£Vܱž;(3‘B) ¿q“´±/f°ñ.±‡uI®I`Š©2¸0zIË]AªÖ<ÔµIY¤¾kµc(¡3ƸúØYU-(gVðHo"»u)hŠÍ#?׫‹©³©¢¹òs_ÅYà9*)P¸*Ì&n·Øk¶à=·‰c12HSag"ÔX|8|·ÃXžsIÁ7¶†kWrÆ+°‚„ â[XEñ#|ÍýQ“ÄiHÂóÌ{[È$Ÿ‚X#ŽŠ›Ê‚þÔ㜼A"ïÉ’ïÛZÊ úËi¯ÔŠ*Ù—2@Ž»±!8Œ×ò-xºàÔ Fzc¤Â…ÖMa’`¢=UÉ0µ\ª…sÃæ²ý˜VáÛUg*[{èÙ—¡½¸7Œ#? -ôLeŸªü•‡A½pÀcà}œxŒ_Ì-×",ì©÷ß*uàCXãlqŠ Èi2€k~$;dŒ‘Ë|¼8ï×@Ìî²ÝQ*I¥|Ž62Ø..ýSóÀ犟qp“*jE HÛž²ù‚òÎ-çpéùXU?ïMXyNeôÛs -"k~ã*ÆDÌ–'8^Ãe˜í3Ëfª|ëFœWÑjñ£Ö1Ó§Œªc?š6ðÇxÿÖïTíÏn£ \ó‘8LÁºE†> +stream +xÚZYÛ8~ï_á·µX]ûÖI';lg²±g‚Áì<¨mu[ˆly%9`ÿüÖAR”-«ƒ 1EYůV•"f!ü³4 +B•Í’4"%f›ýM8{‚7ÿ¸†biH–Í›õÍë÷Q<a…ÙlýèöÉ ÊâÙzûÇüíO·ŸÖï>/–J©¹Ë$Iç«…˜ÃœbþÛ;Ók=_ÿþ ŸVL|ûñŽ+œ|»XŠù¯Ÿ?¬çÉû_î˜öÏõÏ7ïÖNPï(B)ó?7üζp¤ŸoÂ@eéìÆa ²l¶¿Ñ‘ +"­Ìsu³ºù—Û‹ßé¯CÅR,U¤©žF.Š‚X'9-<äD(ª™%BèþŠäüx"Œƒ4JgÞf -ÍGù… ”Ž«|¿éü!_*Fù¸XÂsÑìË®eôuQ0EýÈ¿°0¡—UWñ§`ú|³Aê_póŽé·y—?ä­¡z€·ù·øŠ4ÅaÛ^S¬LñléžfiCô"Ò {¤Ï8Ž#íq\ïðäá|B"Eá1o êgœ¯›-À´à…øÔcCYOø‚äÞ÷4šÌ‹~’Xt PŠ®À‰-“Ã27nŠcUÂ#ï×fúÔ–‡'úF°D@¦¥PîÔÇjÁ†£–Øt;˜©Éʶֲ Hè$ˆP4¥åü©üF‡jy%FœXCE’¦‰~uFÅ÷ª¬Ê×þà7Lí +x¸7±†_ð\‡m¤Ï†ëÇ5 +£ùÁáã’Ö 8-ã*3ØÞ;lDgÝäì&ð¯Ì`þiË'Ü©õ&g…W?ð†/žvx +|¼²Ñ³_~ÕºUÖ~ø‰÷÷+ FiJú™BÕ£¹v-ÑKawŠ¡ »çGîÏñ®Þç¥AýmÍ€5ueî+Äá\»I â_I,ÍÒ#"qbé‹#u¥‘Û Åùï;Ì#ðôSì Í»áéU<Ù}¢ ¿Ï1:  þËÙÕ=цh)v3vãhxìÞ˜ûï«£„cåÂù¦‡KÕ{ç5\Â$J¿€KO4‹!šÆeŠÃåŒÝ8.»Û»Õ„yà QUEs%NèiOÆ æzœ°D/ʼn)†.Nœs>Gÿè÷çKMd†›ÉžWì˃P%Óöà]·K4i“ì¬=œ³µŸŸià=r™iœ˪w”á%s &™Ê^€©'š€ÉMÃ4ÅÎÁtÆn&Ýǵf|ðô|ýÚÈÇæn‘Á”|Á–Œ×@¤zº6÷h®;–%zɱ¦:Ç:ç8êX>Çæ>ùakJüª>˜Š³83p·@&Š~ÃÌ/›D5îò£«WLÃï–&5ÛQòöÄ/.Âì,¨½BÝ_ x'„éÅ€ëˆ%þt_Ò$ +>‡{ë \W›jºÝ•G~ò7õX©ô­ÜòZ-äÜäqMWΓ=-àJGÑ)ÉdY䤷Mñ”SíHeÎxŽxrc…5¦ÐO§†êK· ¦¦ÀÆC´ã'Ì+5 Ûí +ÛÀi;²(uU´ÛÇIJª¼<6”q[cK“0·2i°2±Æ`e>QBþTl‡I³A›iöÆÆJÖ$Al6vËG†dÉ`VendàJ‰sðÞRI øÞ„^|lÌñY3ÅöZÁ¤d„©šöäžæjÉ$³8H¤2%“²%S¾ȹZZ›Så#K?xæ¡ ±Ž¨Ÿd¦ ¨MËçÑ\­ dn/Ùí? I¬_Q©ZJS…lŒIáðÕ’µqr +îP%LÖâ8Fï!;å6UÝ/ƒ¨õ¡à)òc‡Ÿ¿0ÅoL> endobj -4018 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [387.747 631.127 454.872 644.029] -/Subtype /Link -/A << /S /GoTo /D (domain-member) >> +4084 0 obj << +/D [4082 0 R /XYZ 85.039 786.531 null] >> endobj -4019 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [155.951 618.184 190.52 629.874] -/Subtype /Link -/A << /S /GoTo /D (domain-member) >> +114 0 obj << +/D [4082 0 R /XYZ 85.039 682.89 null] >> endobj -4020 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [253.407 177.601 331.566 189.291] -/Subtype /Link -/A << /S /GoTo /D (groupmapping) >> +4085 0 obj << +/D [4082 0 R /XYZ 85.039 639.937 null] >> endobj -4017 0 obj << -/D [4015 0 R /XYZ 85.039 786.531 null] +118 0 obj << +/D [4082 0 R /XYZ 85.039 326.083 null] >> endobj -4014 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R >> -/XObject << /Im1 3957 0 R >> +4086 0 obj << +/D [4082 0 R /XYZ 85.039 283.13 null] +>> endobj +4081 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4023 0 obj << -/Length 3625 -/Filter /FlateDecode ->> -stream -xÚ¥ZYÛ8~ï_á·•X‘xèÈ['=»›Å$“M,fçAmËmMdË#ÉÝé¿uQ¢mÙ½À HK"‹d±XõÕAdzþų̆‘Îgi–„Vdzåö&š=BÏ?nb¡XÉ£yóöÅQ˜Gùì~=Ì“G¡Í“Ùýê·àÃ?o¿Üÿôu¾ÐZ6œ/Ò4 î~™ÇÁ§ÛŸ¹ùÃ|Øôùß¾ÎUüòóü÷ûÝüt?°à1k üyóÛïÑlÌþë& -užÍžá= -ã<ŸmoŒÕ¡5Z¾ë›o7ÿæâ>3ãQSû5* U -/: -³ÌLÒı -u¬@(Ö†‰I¡Ä¾Pb•…IšÌJå¿Qœžî/Ö66óæ:_IÎÖK=‡6³Gëõ«‡®ØâŠÀœõˆuj 2"ªÅ|¡røˆƒ8jW´ðxᎼ}ñPt%7 I±œ«4øŽgVîV<´ß%<ã™VÐP×nâóG‡½}ƒ«”ø*3 ýÎMV2ãG»T6ÝåÂù¾ÅOMVNíÓ†¹¶B½Bâ¶\ŽK¿à8k8ª\§(hPœˆ+`Ã(RÁœœÁ½”øi‚eQ×åj‚¿Ô„J¹÷s òèºÕC'1ÁžIAEÜ1 ‘Ä&¸ß”¼$Ë™}á`Ê-;'7á«gŠfÍO:ˆªc^»×M»-úqcµ¬èF¸s$áÄ*3°–#áÀ`ë€DYìø£™–øzº$¶4À¼µÁŽïeßqÇ 3ø±tsíYaPì.–Ëf‹£· 5³b:ýAòJÆÓ¬2ªo $¬úªA±5í+:ÚоÆ:ó(UúÑó©éâaôÝ=¯¸—eç–$ÏzKîÛ3ãí¶’©K&’3ü1'¥•Ó\•2iAB]6‡Ý\å ¦6`¦ìQªMÝñLþQÉ–,íèÓ7Ù_é(P Ž&«ì¸‹a×ðGFŒ/õ(ÔVº°‰öÖpæÀ©žH?Ã3<tL²Ô<¾Ž ÑeuD¯ èÕAO×›DP½zUì§!ÔÄ¡ÉSBÁÁÝ"v¥iðóÊæö ~%'ctzè¹?DÓ³Á—¹ÓšŽ§tjƒïþ´iÀ“¶| -·õ[Ãa-"Ý~e%¨!\ÅAȦ.[ò £||† ›@Aå»·ok6>€@d­a$GS˃¦ågM–¹ß¾]·ÄT°jB²¤C‹mðõež™ dåÞ¢üŒ(í°ÏD9š1T±Ø¾ÎØ:¶¤qʲÇ}£á|€IÒÇ£YÂ;"X…§ñˆßÃ)Îøå«gäŽx1R3¨ø&q2#rz;áÔ­»55f/´Ý!ç8)œ°¬ó(L´Ïò9’«ŒB0¦™ö%_ŠÒ\•`z#KmùX´+v Ü"^žNFn x®g8‚¦Z–žû‘8ý`Už§pžÂaYcG/128wq.J‹4f%åöª‡°e¹Jÿð´9•Z¦àuÕbš\œ‡FE0¿1yzÃÎ'é$ S/jÐc€(K0C›ïQ¦)Ëç†sR‘ùñV™Ü€+ÃÉaÎÙŸ³8Œ04Óxï´qcÔðöã6žÝ5ÀéìˆYžwáMÌ*”ù>Ã&anҙȇø÷.ÔјW?cœ’» -½Á¸|ìÇ>ß`zn{@jvU’Ž;ºžs)hlÇ¥»ÃC×Ó‹ Èé«¢®]:IÈA3”ÜBqëš›FóÌù]¤SZIg9ü[qOÕñTþàþF•‡æ›×”-,,Tˆ À¾]ù|Ð £Äl¨'¸{“3ûD[(¼v³ÁLc?Ìäü$uzÃó<ÁY ÅqhLÊnM¾2É¡úž£þnBð"RônF\=ž1–Æ2 xc‰¶"ì~H6\¬­°òT¶‹¶Z9LJ£ëæ+4;§È †ýDP=•;~­vL4”Åô†§&Œ”„5ÝöAœ4ûû\ZK\”MêÈխƺ†Õ,<Ê!V¨›GÊ"p{¸CàÏå*{`âöB„=i-û%Ã!-DútèÞ8Ö!3é(Ÿ†”‹bÍmC½vü”Ôƒµœb-Òåˆód|nŠ'i)ð‘€â­ Š‚dªî…±GàÖQæ`0”ÍìšÎ$XÂ÷†eÚ¡6 ,QIJY Ž~ázøÕ¿hÓ¼›ŽSÂ= ª˜˜õnÝš @©›©ß4 KàÔgFü¼‡Ö9 iµ8>®Òi¯2‰Q†”ËþØ+h$´(nø:Ô2‘«sqa¤Œ½(å3— <´ »žoú ®ýiŒ¥—ÿ5ÿ‹ª«RH­¨pj®^«hc(örÎJA¯Ä(aÏÊþQ- 11˜" æ{¢p‰úŽJ°ÆgÜ5[ªebÛ‡f×·$ÕúÂÍŠ›þ*Ÿ#Íy\6ðåa$Ù/cY*OÇ"Vžqh]-šXx°'U©+Fx¤Ðn9™ØKÞñT¸G|>w ã†ñýÃIUÛÚ¼'Ýf$l99š¾¼ôÅXiß1M#sSÖ]ÔÛ±èeÐ)·/Ci¢Z"žcÇ®è)ƒ´`aÒ,x_®¹Jn,—]äý¡-ØR JÃ+‰¼¹ì -4…âœU¹f*2jö*ƒ _´¢A!à}OƒñÄ›©Xc㢠¸­Ø+uµ¥|A°_-¥ƒÜ²œœDÏ´:&Hnu‹½ÕëcWùªÄ„I¬¯j¨G3X’£²†*« ƒHFKŠƒÍÉF,"ÎoÑ„|³A>[n¾ŸçŠ¶©©Pu]…\N±ë !ÎB•^/)­\^);¢W -AÞ\ AgëÙ‰B¿Þ -¶EûÂG{çó‡Éc¾õ(FbÔ+≮ˆCˆ^ǵ8N×›‡·Þ{)¡Éï¯J¤Ìë¢D"Ф\¿"‘‘èŠD„è5‰\[ÐIät½I‰xëÝÞ}»"‚g4¬Kå’ûé `PÀáæúK[m]ùÁ]6j{dË\ ùž‰¬"¯`Ù¨Ï „±ÆxÂ]0Sy¾/wøe_S¸ÿBfÎI4õuFÀ¦í‡2’±”üQÉ.Á ]ÕÁó×jÌþ@9¤Óñ0¯¸Ð€k›$ø|oøe¨EÀû¥ë>èRQôƒÝÂèì‘¥²—i¹¶]õrSŽñY[¢·699ŸCÏ”þÎMð9ܺÂj[¹†S(ÛKN†.¡u:\.âû¶Ø¹ÎŽ¯^į0?xOn-ªG[òªOÂsÝÔßyXݸ¾~Ë@h_-û¢/‰6;^ß»Y_\øª¢ÂÀªÿ›,0œ#vW»óhyø¾äX½³Ó(“ž‡”/¼Þp+Œbƒ¯,‹í^¨=Pã…ø‘(á°BÙ®i -î•›Œèdgý”Ðbš4Q¸e€Ûeẩœ|jÆ}CÛñÞ¾sÁÀ&YpÛ1¯J ÔîQÒG¿,H‡L›89¦4 È(ŸÀ©F;þê?P;P¦˜EsmZn!¹»o°[á€<ÕľÏÏŠËø.Qs%ÑÝ’ìYS}£l§.ÿøæÀ] "ƒ%Û`ÕŽM\Ïi‹®o®ø1„“8~W×·á¤Vy*i®ý×Ìœ»ìõ5ÁÇ~b¯$=ÈÅ‹ÕS5\«E k†pÔj‰OY†ƒ"Aû–\+¿Æ°Þ¯1`ç&GÐMß5r…"m/żSëU_ôfˆA•nëf7.'ˆÍùnéS)7%œzàE¢—ö–î–½óÂàB†º)z/¯ëåŒ8">î8à{œ4Ä~7’ÊÕMÊNŸ§è4Ã7@DfàÀ)‹è i{˜fÙ˜ É+™cXþ ð?𻙧WG¤wsNÞ®tà_LÅÃÙ¡®Òµ¶ŠB&÷ÏŠ[…eÆÖý„)–Ÿ0É­?6œ @©`¸k}¬À>^xب/«“‰PQn?ñ;ªÅ·á·HTÌñn঒d=Á–Â_úeâǘ,̳ a§Uø{1ã˜A±}Ê0„O‰é ŽÿMÖë‡endstream +4089 0 obj << +/Length 3077 +/Filter /FlateDecode +>> +stream +xÚ¥ksÛ6ò»…¿•š‰âÁWgîCÛäîÒiÒ^­^¦Óö-Ñ6ŠTI*Nþ}÷²(µ77F °Xì.ö «ëþS×E'¦¼Î‹,NºÞì®’ëXùוˆ¹ `¾^_½ügš]«$.“òz}ïñ”Iœ–ÙõzûKôÍ¿¿úaýúÇÕ1&²ñê&Ï‹èv¥"˜SJEÿ} cZ¶Ñúçðë–¿z÷Š·8ùÍêFE?ýøfý3O¾ýþÃþ¶þöêõÚ°¢ŒA2ÿ¸úå·äz ,}{•Ä¦,®Ÿ`œÄª,¯wW65qj|·W·Wÿñ¸xÍ^ó®%©¤¦ˆÓÂœŠE¥ bIÓ8³9‰e ¾F¦F`ÈfÑÔãoUX˜ën¥‹hj6ÕT3@3ßÂú=ÒIôfâµ-ÌÁ~ØQ º®Ÿßê nÚÏrȯ‰22Ç3¿&iâI ³ôa¨+9¥þ4 Y­x(åÁÓJçQlô+·Õ× +¯ Dw£P²%‰‚¹>âÖz€-¹¶ÈL>˦F3É(¡¡™ø¬ÂF Œ4Ë£õc#°;„ò´àæþÐmqhÏ4 1ÝCý&‹”h;L ÛÈ/ˆÈâUÎ4j:Þÿ„ûº#†c>a@´µþ^YRðõ’I?æ°Úï‘‹¾Ú lU¿ ŸÛ·ø5¢>M—Þñ¯[0™œ(|&â€^=ð*É%c²»fÂR+mU…À2&6zOýзm-KwN¤0f¶é¦mD+P˜p32E \ôÊÊ_ó™•ðÕãþÖãu¾] ÜñŽÞcã›Püä,ž+‘$à·B©\¥YT5¸§ºkkY!E¡M5ð8¸YùÝLMß…¸à*‰ºÏ##¨·ñ¯”•eœ›ô¢ƒ `È“hXUq™¦'ÉrkSllb8_¡¤IôÓˆø&¾«?Ö-3tªh>ò;ÓÊ$pgˆÌʸTæ2‘3ÌYw—oLJKD¾G3묜 ¨mq¢ˆ¶5ÈfhîÄê0ˆ,E€3/c[ ˆí0"ƒºÌ£–$ð#lçV 8ëgU) FÔ\]€Œ¼ÐL_ŒLQÖìö­³jT_t¾Ú žªRŒú£Ô\ ´0‘Pç”)\ö5DòSã;ÊZ#ÚÎÑ&6@nhBÕE\êÒÓ4Žxi=xó±žûF²4Ö*“M›ž\ðŽI …àÍ[•QuœzWÞ¤auÒî'Žl›¾åÙÎqýЋ+“Ä;1¥‹€'tc9¾QŽäõƒ¸#ÄVíä@¤—$•ÛXÙ”•KûjɼûaË:é$Z#GqiÎú¸R>®úÇ«‡©hCSûçRÑü;8ðßë,MìÚ`„QQ" óDã—H7Žž¤}&. æî(R8!"Sïú©>çlé4ù߉#¬ÕCíD* ²“ë„läõŽÓœn¶uÅ£''ZwÔè'† Îù~»„ B%áખâD;µädˆ¾w†ÔÍIàžúK MÏq¡‘˜³©º/dx'Lû %R:5ÁÒÆY–‹9Z¤xgðO½Ÿ^4ø½^¥:=X°E[ãlÑ…+—Õ%@Bïb4k!@ÒDÕ}y&@¤—«„ä4<”E y”ª“x©’,.@Žr ÏRJÇFéð°õ£ˆþïÚË!hpÜê/¤0ÃœƒÀ iú¼.œ6 âÒq^Áy^³4”„²­ÐûR5%ÖÎUˆæaÏX\²B’?"¹=c"Òz$xöFÀøc5Ì…ß©ïÀ2Ì3é­T%‹aÚªØd©˜ùÄ^ÿËÉØ_ô]Gsœ·žºŠ\Ám¹tEÊ:8î‰cSOEQR2=û¹(Û4¸?7ݯW¼íÄx8Y29Wª‰°`b鎼w/È.ykl8ŽÅ:Ó<<’HGG+ò;¾4ÖCÔøÌäÇÉÎxävÙÌÊØ‘@Ŷ÷~z â&(üêjæµ,6Ýl9§·¥ÌÌRZ•b®6¹Òv1»Rqá2²Xì,Ëc•2¸¤dþPʺLˆ²‘‡UK|PUÊöÌZs'i-ÂÝc’ ÏeOSV&GI%-Pq@LS#yòó +ˆÌõóª8ŸSBLÛCýÇÁ›Î4JAlu½Çn ùX‡Tž8„ê@™©ÖÜŽ/D¤…Š³B© Fq(=¢‡†1ø©}a‹ãPTºd«*Ñq™9^KÊŸq¬ÁijëLºg|¤¡xP5ÊüžôŠ¨8Å%¤¯zàmhªx»ÖÕ ¾¨úèR‘TtQäaºË6¦«Ò ,”6Næ¼>v \ÙT5nA-eò{r¢96ÁBNÌ­\=yÍqÈ{FÉ®Å9ë<‹Ü„«‘I²ç¹7į÷äj_½’V€2ÑV|VµCÑ0…GÉœze§^œ›;­¿v +νÁÇ6hÖ9wÔÐÑŸk˜ÂÄyQ\Ì9ß>x^™›ªi•·¨`Ëè52*~{ßôú¸‡ÃP‘·韡0…à_^np0g{\Sq”¥Œ¾oúN²R×A”wríšÉ7|XçqÉ$¡dMJ×Tø‰JutÅßQ åÎIšG·?¥(ÿ¼`´eàiÆ/Å™¤ÀCbÙ?Kò¹ØŠ@ÞþÁÔù #Iã2/…’ “ +7è?…Ál[ß“Shû„lšÂ„¤MP…ŒA‡öç5ê„Ž?ÓD ùtéÒ=0gYZC¬l¨‰ZY·ÕÊÓUÌæv^ + +qBˆs}, :Tþ3ÌY]TPŠ)Îc¿ÿð‚S.XAdO˜x¤ÞÃâxNñð« ÊÍVœ ÑÏ]J”,wwŸ¡É"ßú;˜^ •ì?rÊÉÉ+Ãì\É%@önÑÎ×~ßMÕÜ”ý¼àý8“°:ª}s¿ÂòyU–Ók\ËÊÕØ5¯Š—³1Zo{L@qxÔ–§Ã‰!`!!ë,|<>Nž55ó’g‡}9‡6±¶éœC'xw5Ó¾ëر±¼ÚÈCÎ’nM®aW‚áÛ#ñÖŸö­¿°Æ7Óì³Ô '*þ «&.ó¬dø4šÃ#|ô’à.Î"Í™/l“…VKÉoHÉåâÉ*GÎr†!´ôü;WÈK°ñOêqŽyÒ`Eê¡ÃûÀ.jj¹¨ÚÖBb·=i¡J ¬ϪMJ­\º?5gA(4\ãèCï2ã£=~Ür©êßÀhÒõ¿ºçóD„Šwâ)Ä·\_x±êlo•–6ë]u'ï.8ÇÏy«³ƒÔ¾8œ)À–!¤˜o&^‡]}”z#RT]›¯ž&wœØ}@¥òÇg‘öÊ·ýÎ1&½æzðh«öÂ;šö‰®!9ÊäÁëLnøn`öÝš«MÐ(t³Vú£'q ¥°`Ü6¾°™¶cÿ•Ûgš¢.öóUüzd´{æ\~.]êYÞ\·99~¯¥™ª ^wGî Ï×">Üà"êeóIv'ó%U*Î5p~ŒÉOx¬w.èÃüSÐaW®Žg4Bn#ç ­¿¦aø== ûÝÆ:Ŧ÷¾“âÄë4Üþög^âÆ嵑ӬàJŸ÷¬ŒFJøuIH êú5†u´=8í¡=Àê/mCéHž¼œËú}š…ãØ®`â-ÿ©ßSÿŽÃ½b²Îá’l™ä}•ùCˆX2ð¶­[Ù3 ¥T#7P\ßX +¦rðøØS»`B!Â<Ñ,•TÚï¨,K¸ôÊ<&+€¬läéòÓË·¢0°ïéD‹ryl®> endobj -4025 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [241.412 559.852 391.634 571.542] -/Subtype /Link -/A << /S /GoTo /D (passdb) >> +4090 0 obj << +/D [4088 0 R /XYZ 85.039 786.531 null] >> endobj -4024 0 obj << -/D [4022 0 R /XYZ 85.039 786.531 null] +122 0 obj << +/D [4088 0 R /XYZ 85.039 699.735 null] >> endobj -190 0 obj << -/D [4022 0 R /XYZ 85.039 344.408 null] +4091 0 obj << +/D [4088 0 R /XYZ 85.039 662.868 null] >> endobj -4026 0 obj << -/D [4022 0 R /XYZ 85.039 322.646 null] +4092 0 obj << +/D [4088 0 R /XYZ 85.039 578.181 null] >> endobj -194 0 obj << -/D [4022 0 R /XYZ 85.039 264.613 null] +4093 0 obj << +/D [4088 0 R /XYZ 85.039 551.083 null] >> endobj -4027 0 obj << -/D [4022 0 R /XYZ 85.039 243.416 null] +126 0 obj << +/D [4088 0 R /XYZ 85.039 383.788 null] >> endobj -4021 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F66 3242 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F20 2865 0 R >> -/XObject << /Im1 3957 0 R >> +4094 0 obj << +/D [4088 0 R /XYZ 85.039 350.25 null] +>> endobj +130 0 obj << +/D [4088 0 R /XYZ 85.039 253.689 null] +>> endobj +4095 0 obj << +/D [4088 0 R /XYZ 85.039 218.944 null] +>> endobj +4087 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4031 0 obj << -/Length 3884 -/Filter /FlateDecode ->> -stream -xÚ­ZÝsÛ6÷_á·R3 øÙ{rìÞµ&ñÕžÉCÛH¢mN(R!©8þïo¿Bewæn2Ž@`,°‹Ýß. .#ø§.‹4Œty™Y˜ju¹Þ^D—Ðòï %K!Yz4ïï/þñ¯,¹TQXFååýƒ§ŒÂ´Ì.ï7×?_ÝÞÿôûb©µÒp±Ìó"¸ù´PÁ‡«_>rõõb©¬úx¥ßq|úmñ×ý¯?Ý;<&•ÖÈÀ׋?þŠ.7Àì¯Q¨ËâòÊQ¨Êòr{‘¤:L-ßÍÅÝÅÜXÜ–\r¯¹õ¦ºÓBŸ.X¥Þ‚•ŠC­âËë±ë_˜Š&”"Ã;Xv¤a¿+!ýÅòºk—´¨¥¿ª”u´Ë$Ê‚¡b†P3£œ4jQ»Š «IaLÃ(½Ú-Òô¢ É&@ñã>Û-W­­,°©iªžv–“Ä o -·À}GòÙchT-|³d\ÓWfFô¤ˆEDœÐèMõhF*¡~ç%Ÿ‚¦àì¦EÜ“î*زÄF _øK„™N ùÕ3rZ’®%ÐMnZÎæˆ$®¹Éí\é4Ë kÒŠûÑþånÀý`éø›†e½¬p‰H¼A›>™?¦ŸÌÈ¥'Ò.²AT?M>˜-÷81i²ŸGÞPƒ¥c_&4)–RVUøeçPñcà1i»»úÀp味èë=Lw|ÉzÏÈÝ…!u{d…G@Àõ‡¾ Å ÈoNŒŸ*ŒÝü|_=²Ã¥óˆîüûŸ‘JšŠªi.:)‰†ÝÎÈ;Ób±@Ç î8`ÏAE ­q&»èÁ|« wídƒ›(Ëð0ñ(žiçˆhÑ´ž.{g†áÙN{ãßZR{lËã•¿-Ò ºtë|¡¸™Ì ­¦A±mH±éfð1HbdØ®v‹UwxÞ !Õ0àfŠIQÐlÌÎ~[ &0öj0ú8R`;´¿Òï[$”Ò<ؾ _k÷è(1z„PK@¦±0Ú3R„9`h -Ô„™uê2wTõe\'E‰pÊXðYF€àQEG¶Þi ™OQ–ýK: ‹ÜŽÚ¡³Î³àýÍ5Ž p΀#O 0P²Ã©øƒðCnÁ -«zÍFj‡ ÃùŒÿuýÙ\…y–û&(: múÌ"8__÷|’Æ@œ ȯ xñ—ú„ç°j$oJEÓ‚úâAêyè¦{œfÁ>_Q;ìd2²ì -|ð¥SûõdlŠ\ì\Q·7@~-Þ[>µük¸ýÌÖ ¯ìqëvt#%A:—ï‘T¦¤jrqvºØ‘† 'žë¦aòŸ™…n;Þ8<%€VÂ)û:ÜÇu©¸®­ìRsTOE®Ô“tw{ýuoKƒèƒ¶ú·ÐÆ*Y–¡ïØáûõéN†èMŠF+žQY¡4!J¬%…ÄÊZÈpÙ8 ×®öà —ÐÍj|⊦3è‹$TMÀ†]q‹B†e€#9“nvÛÎ!¢¸d ‹”†ixk™åý‚±ò\< %»‘X¶Š]ˤh -ë¶â Ô_*Æz+ÃÐÜÎXZÙî@¡–A'î7Ò¿ã_ÐÌw§¬MñrÑíMlNìÓÂûX4„µÁ’‚…¡À¦± ”È$ ֑ÒÂ/•8¶¢¹ò3a'nºó}¹–ÞOd– d?~º—[îvOØ™‰”€’°mâ?±Ÿ5&q:i<”ùdÃ:ßÛâÉ%F®tªC†¬ÈÞPdò•€<î{Þ‹Ô9tœ€±1Õ0¢˜Æ™.Û‰70yÍj˜ÀkRªÉç<×Cõ÷Òü ¦tŽéb“£Šer–É;6^µµ2 ü’$ØÙm2d8`0VdÂ)ǺØ3A—g¶¹Pª$F¯¸–0/üÚXÂêñt>‹‰”à“7R¬™/>Æ”‰¢œ–·è4Ýå -†¡^5•/Š,à`ÞÉ«œ6í¬ÁZÃu¢L™ ÚúÛ#µKù<Š” -²ºƒ9=¡]ËúVè€2'%ýÈY6£B'4ŠÙ` ö#9žð+Ñ®l˜Œaøç8QsÐã8ù‚³ØAgú·LÁÞ—ƒ\–wÏ´Ã|ž ûtsxÚpÄ(ZGŠ»4M'§Ï„$ 'UÐbL …ﾪÛA”›G‰6Œ6¦¡ˆD³u"êБ/fõ掿æ©+ ˆM_ýxœ!¶ÙX]ÀÔ³i]K²œh8«ë§±U\„YžÙqpk€üd:„J¿:SOv€°•.ôHýÉnûãc¥G¥ ¦ÔZÕÚkÀÝ=s/(­;»ó0q°{ÉÛíK¤³‰Rw3zÚP‰'‰$8Ó^ê¨1Œ„pñœ`rÆ…zC2Ñ+¢¢·dóÚ„V8GóÍKÇ›ÏÆAÿ™Äa’Šä“—âq€…NÁj4Ö-Pþ‡«9Á°³v äTùB:²:¦¸þœ ÒÄø AMD¯JˆÞÔkZAÍ7/(o¾«˜;?TÛF¦dµàûN®?À6ÎKF|CäD“Gñ†æÊ;$Ð0å:#Uü»žd_$“lÊša;8PÂxÇ¥ÞL·½8eaÆ7Öõ¤ ªÕ -•§¡+>0²Êä7Þ὞Iäb·Îf#­¹–Ì#G¦ƒ¯†â<ÍžU/PûL¿e¡'¢WÔKˆÞR¯×&´êu4ß¼zyóÝtîÛÍòjx¤aûƒ,ÁCÎ*U™†i¦<Oü‰z¡£gmŠµMél …‚_wó‡µ4r& -à ‡ýˆìH€m=Ik¤)$ÇÎã¥,…£œÏ™v‘ôÉÅ UÞ…ždoI-FÊ™N;ÖZÌ@i‚ 2ž¯—ÃLv€šMfe¡ÎúMuqÅ“Lѽë#Dãr™QðÅÑÀ$qELÁA#TÄÓR±‰.¯²hÊIGïq]-óll&?ÌÃ8s7ùßá©ž¬Nšø0¼j¹ù „p°rÃp,’s9_ê;ð/Kc\ÃÈ=÷’¢iŠGæ­ËÞE°Ø.¬þl9f´P[¶•Ìî–vŠ³ðô$¤=âëÕ ®"Ô+Z…75êWÝsÆšòq½xN¶ÈgC<¾)I9xIÒƒäë%¨#a# Xž»I› D -Ú=—¸›ô 7-zÓH3ȯ´b¤™¤GÛbu;Åw Ï0]aœ¹úuG.Ž8xîš0ÖAõ}Ýì7AŠÄÊÆmÊ¢@*»Låu'„×k4ÉV‚ÃöðÊpeüܹԣdZHºÂËÎé6ßšÄê•øÞ¸T›é't4:¸{,Q§Sô–€S ]?ž,ŠøI=éÀõœa§÷Ëb0ûN²uLÑ Ö ?ÝY-½²NTìÝu*íaÚ]Ùy™¾ui×BèeÌ⣛TKÊ ¬„Ù‘†7Ò‹,¤¢;>RfÑšlpœÞ6èPvd/+®nPµµÅ”ç -`3B¥ÔQ†2ÿíÎ]BœßEªÌNFKÑg}¶îQ»ÓÕSÆ ËTÿ]ö­¯ýk`z$Äü¶fÜSŽ/§Ÿ{'˜Î»~&=]?CãðD÷† ß/…_ñm7òÚ§ j0Óóž ·îåMßìäR_ ÷èPY¶ÜF17Ÿùkn 1ìw.½ÔÙI)CLºÑIeÀŠ À3N!±£=K’ƒ¢J#|Á>¾;ÍÍL§L޹Ьk;ù`ž0&I0I…ÛÇSš†qFé›{ŸÄ‰g“)fÚ[o® ìKêÒo£‹Œía&²äqï¥Ç÷ù´ÕÞðVûù|?8¬­¸w$_»¸:zÁ*;,5wpbÙÛ¡RÍLvÞé¥À!Þ9»Ë¼Ìq(ÉX—¹,g¯¿‡ûTâߟäºápR3Ì]"gE§D,í\Øtjœ3ˆ³”MV /òÀjëƒ+Ùv½`­¡_ûFcÍ^vk»K]¤‚f'4³™a¶HÂ$Ó2ñç®ÿòÈÎ Þ)—)Äi)Ä3yXz†W’‰$ø.ÐÞÞZ¦Â¾t; T‚‘#Îíü”ŒÝð3̾5ÁûÓnÄG¤½Mºžl–5eol–‚b¦sÙQ¡ÓmJT˜¸ÇsÛtΖÁqOæÃvøã•üOï€aIŠ°,ây»’Æy˜å‰e×$Ç Û÷§ÿa£üÇendstream +4099 0 obj << +/Length 2206 +/Filter /FlateDecode +>> +stream +xÚ­X[Û6~Ÿ_a`±€ ÔŠ(êZ Ù$ÝN‘I³±ÓnÐöAc˶ZYšRr&óï{nÔe,¹vLL‘çðžëGª…ÿÔ" ]O§‹8‰ÜP«Åötã-°òï%+!Y hþµ¹yñm-”ç¦^ºØì»}RÏ Óh±Ùýì¼úîåû͛˕ÖÚ Üå*Žg½TÌ)¥œßÀ˜–góé=~­™øå»×ñäݯ™ö×Í÷7o6¢ƒ£(­QÍ?n~þÕ[ìàHßßx®N“Å#Œ=W¥éât„Ú -ßåÍúæ?Ý^¼,˜kÊ*¡NÜ0Ñ—fQá„YÂЂ˜Ì²?ƒòeÉgɶx¸mÞàOóO>âGTí‘'j# E{¬‘½n6ÞÌd¼ÃãÒ‘\9;íº®üØõà(û.«–~ê<-W~9$»Ú"Ç-µ ®ÅN#S°g¸8=œ. ]ù ÷nò¦A¥ë +Ò¾[ÜÕ}`Þ‘e¢ÀU*ÞüóÒO âB§Ø³X0ÂÖÉôtFè¦+*þmŽ™é9J*‡ùJ¡¡©íÙqåi™h"4ð}gs´Lb&4BmNYY>±L2u^íÈÀ+¦nG0ÀIé<èÏ©!®,vü‰¦`^Se§'•s“ç– HOÏùt`Zd'Ôú^Ę|[›]Ãí±Ñ¹CQ;qh'\Ö²°:‰ +õ~ÂÏ:R®¯"qÖÃ25ÁÙ÷b^ ú0:T3áê$uý4nËUB¡Pš­ÒÊOá+ïö˜s€O*/MÅ£ýŒÐádÈ*J[{”ÖàYrþo¥ÃDá᪊涭ÍDêËsÅ¡«B{®BÊJkÑZ&P1òª[[µÅð¨çØ ´*†…±¸ÈÀ5c³ ’f&ï¬ñÄöõÁ®q GQÙàÀóI üÝÂA­Íñ¬ýšv~ñBC“ƒhÃ’)öXŽˆ¥cª!ñO`dŸšòŠ>ØE1Wù"Î8ú¤DÃ3eÑ´Ä+ä¸W%ªsᲑM_Í óÈ…íí6È—wEp`† nã'±ó5$û‚ ÂÙˆ+ +¬rdáh‹ëÇ|‹b~ï +%¯ø·=Ö9²CVT§Ò~ð}äBŸO¦hWC?™Ë1RŽ± pùlª©(èR +ZêÜîYÃŒõ8{ˇâ)‰??IÈÑõ¹’õƒ”¤°ÒÚ;Æã°Dëe¦&¶YQY¦uîJë@¾e­ò5ƒLÈdëvw¦óGA8¹ +b4Ô­}ï²[G*q͇ \í‚ +¾«ÀšpbçÍ—ìô`-æU]ýâ©àp69»¯SªÈÕê/4ìifñD˜PR£>œ©<Ï´õC5”Ë-!Ö¦lÒ¶™*•K•Ók_'ßÒø3¶TÆΚë¥m©ÔÞÊGXÂÜä<“Ùɨ§PÿEpD̘ʖºï(Öq,¢BÄÍ ÜóØð4'Jq‘"AšRVµlJÔ¶þB!õëwù8QõÐ`9Ûî$Ý ¸v}êÎZüì’ª†Å%œOˆœ“beèûPÓšº:  žXä®hèÄ„^Mv°y¾Çýês›¢:ôîmË1€£U*¢½ª1¸À™« AŠUQ_ͺMW”›"4é².ˆ¡§&É°.h¬ +¡ç¼®O™t*, +k¶%6M2ë©=2¬ß Ѓ."eÛíǽaxâ­$Ðùݨ½Î:öÜî5WÝÓÌ–(„pu &´–!}¸ÄˆÄœ‰%`2ªïìXñ'pN¹¾aºTh»xÁ\tGRƒ¦£èN™uÅOtTÁqcxî( ™„l'ñÖÈlsU—\¸L©Öœ‡=`ÛG¹­¾f0•1É)#qd|ÂË—lŒ›hÍÞÁ€÷±À{#Ž¸]öèIhí2­€ÁÍŠmÖt-ƒ%“ÿqîàÝö°Ôü{oýæÛÖÁWðhŸ-oêóaTeÂ3¼@T6/{æù˜ŒßM]v5Ú4s¹«ÓØõ¯7Ìžd¶£kt•øãÌý¿tt%®]8ÐðÃI2¡¡Žà—k dÕ=¶ÓŒ[-E,þò”Žre±1ÎÞåÌC¡N Ù|†ñe?lŽ–QäíQòL0åP]r*5Ã[MaÃÏÏ/(&˲FÆGćÁ‹Å•È¦]/9S¨ýƒ¯(ÄÏ(ÂB€îdB\¤þE8ÛÆz05?cŸ°ßÝÒ3ÔËØ7ßh‘0¹¥"æÉžÜ_t‡ÂA ò|\ú)jþµÊ`ôå2„óëqéó'JÌUyNwP_‘Èš‡¿á°¨ªä¼ §À°e‹w‘ô·ê¤ÔrÁ !¿°Ö绺ÊÇØ_cRJôPúz& 4ï@ÅW“p@sÙëÒÄÕ±îöA¥ÕEER^ä&˜»W¤Yšëâ”òâû#y?Tc,Šï®ÃÔ:ຠCŠ£ÖÁ˚˿á,ÌÍWhþÄÂ,&’Ö]%^Z¬eoØg© j³´S*E@3odÛõü|"¦Z$!ÁÚŒ2üÊÕ>ÕsýB…‰G×aÏ€f>„UöçCኴ>®‰ëBa ï]þ¥•§àºzf”ïnÑÿ}ñ¶°<=ÉËɉ¿iü%ßÚWض¯–/¾Õó=ÁÔuûhx÷À7\˜‡-~£r£ÕGþÍv§¢*ñgmmþ‰o*ø–2Ó.C¸YO"qøã ùŸÞí{h›¸)4üI›‡pØ(¬2 +¼ç +Û÷ýKÿŒüEendstream endobj -4030 0 obj << +4098 0 obj << /Type /Page -/Contents 4031 0 R -/Resources 4029 0 R +/Contents 4099 0 R +/Resources 4097 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4028 0 R +/Parent 4080 0 R >> endobj -4032 0 obj << -/D [4030 0 R /XYZ 85.039 786.531 null] +4100 0 obj << +/D [4098 0 R /XYZ 85.039 786.531 null] >> endobj -198 0 obj << -/D [4030 0 R /XYZ 85.039 149.668 null] +134 0 obj << +/D [4098 0 R /XYZ 85.039 645.538 null] >> endobj -4033 0 obj << -/D [4030 0 R /XYZ 85.039 128.471 null] +4101 0 obj << +/D [4098 0 R /XYZ 85.039 609.273 null] >> endobj -4029 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R /F20 2865 0 R >> +138 0 obj << +/D [4098 0 R /XYZ 85.039 499.163 null] +>> endobj +4102 0 obj << +/D [4098 0 R /XYZ 85.039 463.753 null] +>> endobj +142 0 obj << +/D [4098 0 R /XYZ 85.039 397.28 null] +>> endobj +4103 0 obj << +/D [4098 0 R /XYZ 85.039 361.015 null] +>> endobj +4104 0 obj << +/D [4098 0 R /XYZ 85.039 226.515 null] +>> endobj +4105 0 obj << +/D [4098 0 R /XYZ 85.039 185.868 null] +>> endobj +4097 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4036 0 obj << -/Length 3355 +4108 0 obj << +/Length 2553 /Filter /FlateDecode >> stream -xÚÕÙrÛFò]_ÁÊË‚U&ÌàLÕ>(’+‰e­Ä”R•ä& k ʲöë·¯ÁA‚tŠ~Ù-—…9zfº{úºþ¹“È·OÂ(°}íNë3g²„™ŸÎ\˜ ȬóÃüìüÇÀ›¸Ž;ñdþÔî;¶“yú‡uùöân~}?i­-ßžÎÂ0²®ÞO]ëÝÅÍ-_Ng®…C·slÝOUd½ÿuú×üç³ëy‹BIWkDàÓÙ9“ýù̱uM^ íØnOÖgž¯mßÓÒ/ÎÎþÕîÅsÞ„WÑëëÈö#½O°ë÷v•¶•r'¡ïÛÅ7[ *Š¬iYUÕs‘âPh}˜Î€´ ;±UâÔ6Kz»J¶H1p4èàF¶r"À ·~¬êËzê+ØsÃÐtüèѼÎ52Sέ›U¾aLòÇ?㟪 OÆx”U{V¡Eû,ò¤à™EUþé¸`¿|®“mŽd”ˆÌdæÂùÀ<¹ÕY@[ÔÓ™§RZšOy k„HˆÉ*/»qA†–<´@Ð -å34jd#Î5ikà(w ½’ýÊl‹g¼L°ª†‰²é*øæ• ¹J†IˆJg@ߢ"Ì×UYÀšWt•õÜÁ)÷Ó„ 2xªjn ï¶ÿÀÝ](Áeлt¿’ÑEmë×iäY >Aä’„ÑòF¨dàbö¬×„~ÿ´–ÝpX§}¢IïÁÏO¬Ž¿ÝÁíû¡µ­øûÁˆ†ö# ¯€†¤féLÇ3ó÷Ýö… õ§x‡uE÷œf&ò­‹e’—o€a¡oý{pÏ^hö¼¨»§›,²¤þ~̇ڕX×—ÊÜ(Yd£±BQ†.J2öR’A–ãkk  ]ës…¶ãsÆÃIùÊ€`D`Ùâ¹&­yËHô ‡‹“i”`A‹#sò¾³ˆ´è@ȱy÷PÁæá`÷«j Œ&¡í»™Ø•-ÂBRˆÃÆ¿ dÂsÃ25T>&)D죔,X;ÅU))@ò!aC,Ô í=«pàÀ´fÏÑ)0#›º¢aVï”ý / Íî •ò{Þ!žPŠ¢j *1B¡íÂoÖsx²é.O` U¡°šðXly¦eÌrõ†ò¡¢ÌWh]HØ.…µQá78X/«¼EÀ 7vZ½Q ³i%ÚÖbç^‹´%ÁvÁ†`AÌF­ñÿw‘®©› §É wÁE;óf„Ø—íŸòbƾ¥0Ù‡‘*h´ Ø]oóûâ ƒ:¾“?ñ"óM™4R!}ÇFö%o¶°ÀEî»\Ð…Hr|^Rd’˜ÿ‡Æƒ+ö}2[5 uÁˆÁF‹æY« í¸õÑ&~Â+ÊåL&§ÐËÖ=±Æ1„¬–è/´‡Ò‹›‹Ý¦@Kv5ìÃ6a/ó5v–Kv€ &üÙxÛ$M#ÁÙ˜‘o$å2³wS×U¶vÕÄ÷]Ûc÷ÕAû1e*c9Ûnp8× UìÃ-W;ûÌ Vx¹vä«6•;#1Ú"ŒôC;ˆwÚdUHímÅŒ”(mH*ƒ{oÇœžL>M€l/¦ À´‰€Ž08¿Y»“« -0 å}g½9ï‰ú®2òIs+#Âè‡PŠžKÒÜr‰C1ÝzÏp‘·‚yŠO`úÝ=æeJò7ýÒð&†8wÎ]å8_¿Ã‚;nÞQ°0 ²†ä:'cEéLl´!ÏJô:ö¬f% [¬{Qnì›aiø•°Æ šýçB¶¾âÜ 1Álþ.£¡ý 'Ǿù‘cÚ üÖÃõåo÷°âZ"]ÜázÈ. ÙiüæÁ§˜ÐÛùõ•-O<Áj‹®£ B‰Æ1€žEÐ]$˜æõ-4AÑ{`l4®8%IÈ’ƒõÓ¡‹“%Ïæ[Þ–M5m°/†œÝÊ©EþÑä©l*pœB±1.k²Š^‡»Ù&ˆH:KŠªÌÐ"óóÂØbÌY´oÝì/ðšèl¿s"O½ÔÖ¼£§â5…‡Èv²H¸Å×,(§†Ö ÁµÓ0§ÐG_‚ßG2½w‚`·s 屯E¶Ÿ ˆTÜ]ÁâK¾|®jÀ•¿ƒ±n>†CÁ¡í±qÎ0â® %¿ßõ#±¼‹þ0¶j†5:mí)¤‰r#öëûʪ=ÛYï–\-™ùæªÜŽWÄo2ðXœKHˆÔùåÝùÅÖUXeøD3tìȪ½rœÜø!øþÆîé<èÖa‚1êšr.Ä657ÕäKŠ!¶{,i«%þÕœúŠØÜW…Ìbuô^ -K8ùO†îŠj5¹¨Cñ[yêtŽtëpD€D.Hdz ºà -jÇœBæ(ˆŽnÛ2(ŽÞ3+«â¹.FÞ<F (‡ýC×ráy`d5õ¹rÄß -ðqììˆ,ø¡nõݵÆÖúñ±ë™˜¯œFvÅ8ue@{e* @þ8 ô¬~D QUlÔdNWµ©µ‡ý2! Þ°ÌdËÁÛÁ drà`ÛJ{¬30ÇñÞÝ ñ>ªK`ø]OŸ®KÝú#L ~qòìjIίÙq6‡,';½ëd¼]'s‡~´zÊ6\]òsÐbŠ1„8ÝõÖf:â‚°üE&R•{ -’u(ÀÜ]]ɲ‚‹0±E1Le_Іù"—2Ú ©3&KÞ9¨ŽG^ialŒ *WÐßP‰›ceùç&Yf9*Û‹ƒÓ9Ú­?ÂQú›Nýv¿ÀŽöøUlþÚˆ½'³Ã9Jì}yÝú#ä ÕsSNXPú±ÈZê—ðgÉU Í¥b“§K¥LžïDÿöKk‡éõ|ˆ»ÃÓéíÖ¡W€ö®“bÝåNØÅð^^c·>ðôÚÚpzïƒE’ÚÈ㢄1iÏ|zîâÀ:°!)¥¯¯£.q C·—8P¬=Rçh´Lå°–Uuö /$§—ßQmB¦öM`¿®Çýàœ¡eáeË)Úõûƒ÷Ž_uzTÚ[äÞè66wãÈÃÓ#ÑÞúÃ\0@ÿ±9þB©Óã‰Þú# *ïE\^`ýJ5É'a7Y Ìеîë -Œ‘®À÷œQŒß·l`‚üóno³¶n_æc5:óØ»MöˆMiðI× äéŸÖ(¶áÜl±HÛm»IjzRYäzúÁ1s ×)cs¥dã¸úÐ^=L&T%Ý“ê°BjäìHT—È×¼ö•¬›…þéÒÓ­?"=„øßS%ø®Öt?Óý1Æ! srÔéî¿·þô7ÍâÃkû¼•­ù.$’AhºÚW†äW¦”ÂÅò°ÑsCÛ Owù½õGh z(›-ˆuï'Jüæ$ˆºŸøñXÇ@)Y5ã ¹ Ãß]î&w¤ w2òÝþÖWÄ¿:Ú 6•î~ÿÄŽ $¾–ü”ÇÚy½'8ÜML¾X×4R𧺽{ÀQü5ˆ±ÇÐîÅöŠC>ø´ODûtåéŽN ól¼Â/?QÕ¾íéQ¯ÿyëoúõjûc\+C&_…vjƒ Òâù»›_¹îcü_Õ!SÓendstream +xÚ¥ioÛFö»ÅP23œáU X(‘³ë¶v³±¼Ù )”DKLIQ!©8þ÷}Ç IN60‚@Ã7oÞ¼ûKGÀ?é$¡/TêÄIä‡J:ËêB8kØùç…4žAñF8/ç/^‡‘#…ŸŠÔ™ß÷tRá‡iäÌW¿»¯þ5}3¿|;ñ”R®ö'^'îíDº“Rºÿ¹„5mkwþþ ~Ý2òôfÆ‹[¾šxÒ½{{5ÏÀëßfŒûÇüç‹ËyÏèH©²ùéâ÷?„³‘~¾¾JçÖ—iêT:T~¨•ù./n/þÝÓâ=íð©sZ±^8Áÿs(+áÙëѱ¯ãøI:tJ^YôC:½­B™øñÈV‘v¤ôÓ0D[´E"ŒÉV75h´CEçÇj5ØQùiDü9Ÿé ¦ŠQFkâ~Š/®*éÌj`ÓqjÈz#ºÄ©LF^%ƒÔâЉƒÄ—B«·°Z!« Xd^ྞxZÁÇvÅ‹2ëÅi²Ä„nñ; å¾«=„u]l ÞW-O‚Ø}hv3×¼h»I¸eŽŸÊÕUfÜé©vŒ»˜©ûˆJE+Ktš”äÈ¿Ë}Wl×?"‹×* è*ò“( ô¦®»¿M¼0ݶZ첶}Xñ§÷‘g¿]O¯nþw3½¾4 ÿ¾™½A?H¥‰  ›Æ»F_¿È–‚¡3±@>⟘= A¸È•‚g¬^R€ªð\ú¼jwP¥” +µ‡§…†BºC¹•NÝu¢Ñ}0î”NÜ +âBl•ó§EÈöÆÃ<Ì;€Ð¡18ѲÞòNöH‚p Õ&ÿ´G¬ÆCõËš›ÌWÆ°¶Ë¨zd@ˆ»›«ÿòVFw/ë=sÃÛ÷uà ºP€âæLÉØ·XÎT¾¶å_LQF<³C|ÁoƉ§X¦"Ö ÍÝ]ÍÌÉí2gÕ®³%ûÝ~bõÅØ›¬e„^\8bxÈ4cô»Ì:Ú^ñ½}¬ŸÃ¢!Œªî̵ï€B_p!;² N0{åãáÎmÑ ûr`|‹õ¶cà2Û2úÂZ¡^%Ûz‰·ý9±V_16«P¸»&ÿÜïé–õš"³µ­ˆ‚]«DÆF§ ^îc®ØXÖ®où÷úÙaÏgÈ8M½_Ÿó‡Šýe;ä²ùž\œ|ˆ2Gf7sÌk4e¸ ?OB0>ñ½bx»É˲GáJÍiJ¹/8ý,_쌗=˜CƸÐ%Š“u·±/Rfzº5¡Yvy³å(´jÆâÀŠ‰k ˜4³æøÿmð¼ïÐVß‹åØpÏøŽÛ¬Â3 ·¬O ~nbÓbV>`³ÏŽrDk¢U¯ Æö‰1E‹Ô×¥eÞiÖ¦e~{föa?) *¹5Tƨµ•ÄjGü£p`P¸wŒýÀ± Ò²:f>Á1÷'“‘Åù:ÓÇ”kvO±ñ˜„À¯' f:àOhH”º%¶BuS‘]Fy_¨±ùzïœÆÊÔ^PIaRØ$@^¡¶ÌñæÜIéO&#‚éD%¯"õ SZlo„~ª–cšÆccîØŠâÔŠß#a»)vÇr…ö#ŒGŒžÙâ|]šcJ½‘Ï„Š´Ÿòüäć. Äh¬µtÌŒfVÔ¾òA|||CáN©OÆ„Eî­(š‚Ô¦¥ð(v¯1±n%àóƒÅ];áQ¿æŸóÒÐ0#܈ Ë§$„¹!’Á×%pž t% !5ƒûË • +zYÉŒm)ÖÃ1/h4VIêÂÌÏ.Ž°€Yȸá1Ú” +YWô™öfEc›% IŒ¹¢é4IíÎûf75µÎñøR›|¾(7§4Ì ®,€:öÛ홊‡$u”ºÍÞŒò°¦Ñ;‚Ñ+ë°XŽu,ú®Ð² \&¡áÁ©`Dw¸savx†˜¬I²•í¸Ëhîb¥¡E¥µ<(P¾™kÏ<ô +þ–ŽêÞÙ¢ ÞÌ©#Ö‚µ¯E½¦)Ê™™?q‹'þ2Ë5…}™5 4¹¡,òûžjÎ[õ¶´¨û¢ùƒï!@Öñ®uŸQmGœ3Š’ (Ъx$3O‚ãþ +×®©éþžÀÌïKî ÿD¡vŒoŸhpýªº”º,¹7€cìS[Ë4I`ŸÃ† ÒM¨LN»ô‘Ñ” Q·šÁ“Xh‚çùŽjuK?ðav"gÚ5Àç\Å9½`©3üp|ëÑóqÙš_¾ëȱ‰[$8ãuuP,¸’CW7rÉwÛƒ™˜rÂ-5@Îx;ÆDcj(LÔËÁŽ™ÂÄîô|EÓî{ÔO½o­µ©mÕ.6îL},i×À«b½±Ó ¡aOM©jQØPdÎYãv_þ</ª7¬‹2?£˜6ao< Qc¢“EëÌØQ—ff÷R¹Sl´Éh©á¯Êƒ‰»!w²“)nfØé$9öZÜ{ǽg›–Ñ!¯2n옊é³S±”·NÑ4¤UìþÒ{…ÍD5¦¢Ɖ+zÌŽÈKîéÍÑQóŸ™A2ŸÇ©qbÎ%gzÄ·>·âKÛ® ­ªØíSÎ'L6!¥ç™•1©æd ±ÖᙌYixòœÎ(ZÏEí–+îÝyÀãn}¹Ìûž÷é§ÛÐÕöÙ©8n»ö©ÎKF‘/ƒä«}ɧ．û©¥/ãÎKbïcÝå—¬ÚÙÒ]daóP–õ¥¢~jX’ÐÓ õu{”Ó¾)•¾1bè5¿çYi^ß~bíÚºôYkÍQÞãÆ‹}šþz}ÆSÚÞrx¾þÉ:À-8!´± ÔPjÂo[sûxÏe‰£·¯D;zNʸò÷ó[Õ¿-?2`x‚ֿ^­~|ª%…NRU,üg¹žõw´a€Mü4 žšb?Šµe†Ü礇U⇉:Ãñ_wÐÁªendstream endobj -4035 0 obj << +4107 0 obj << /Type /Page -/Contents 4036 0 R -/Resources 4034 0 R +/Contents 4108 0 R +/Resources 4106 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4028 0 R -/Annots [ 4038 0 R 4039 0 R 4040 0 R 4041 0 R ] +/Parent 4080 0 R +/Annots [ 4116 0 R 4117 0 R ] >> endobj -4038 0 obj << +4096 0 obj << +/Type /XObject +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/note.pdf) +/PTEX.PageNumber 1 +/PTEX.InfoDict 4120 0 R +/Matrix [1 0 0 1 0 0] +/BBox [0 0 27 27] +/Resources << +/ProcSet [ /PDF ] +/ExtGState << +/R4 4121 0 R +>>>> +/Length 4122 0 R +/Filter /FlateDecode +>> +stream +xœeU9²,GôûeË@@Q ‡!é¡%bd(dèúʤ—÷ÿ(žÑ¯ +’$¡T¬)ÿ®ïë¯ãïãÇ_¢ýþÏaíÏc‹®½Ú¿G—=ûÌöÓ1ÄF¬lÖ]töö×ãqu‰Ý¦‹÷5š”<8Ç—ý:\;âúãñ‰üéÆ&ÞЇ h—õ:ÀÀX=&02²oÒCó eD3PMtð1CrZûbœ7³}t€mA£d«·íä'ÐWŠ!è®»½KO(°ƒÔ¤‡tÙKb•^¦Ìì »å*’ÎÕBêFåmY¸™`Uõ´™Õ -¿nÜž í½³`*TûÞ£jg“¾=Ås–A½R?Ô =}³Ú§l +¤Ï’ÃigÙ¥—ÇáC6uéíÛ&”\Ê GTœ„Méêö–KòlÜ’Fyu|?é%åiÈ¥K”êNÊq{vˆ*êèJE¢]8hÍò¤p0R±ˆ$Á(+Á nÖN¬ +qª„Ñ«ò^ÿï>‹«>÷— .13×…Óƒ!¶3¢SËAÕ”ih¥Å¨Š^…(€<Îm䦽ªšÛÆlLÊâ³ò7ÙaÆ´Ëdô 6(WðÚºK +г2"ïE9~  +n*Œ1½÷¨¾x¥Æˆpîâ‹&XîÃœ§³±è\íD¤ßä0}#XŒûž˜‹¸À>#^V°¡|2Îi‰9ÊÎr)`˜¢Xh¡Ò& „hb—H°Œe"Ãêʱ„£~Ï“a³tŒºìZDß!#Z¶ÚÂk! e'jÝ=§ _tsÙ¬ûÍ&­Nå@‚i¬ˆ3t%kÐE„\H–YZxÿ/U¥Ç™åë—Φ@±¯iW H +þrÓGçX5¾ûû8‡´ÕªOª«t–Ô³$Ây°‰—BÒ›ÀÄ5©/¨vp÷o`kA“ôr ±ñœÓ4N.4Žæ&F°ÑTÆG%V½ Î'ÌØR5¬BÔ‹`qUžv-UÍ=ëÆåQv2ë_ ”¿­qq‚~èr¯Ú5ÌJ¼ð˜°h»P¡õ‹kÜàéÚýªå>Ò¸D °o»Îi¸CrT]¿MJ¥ ÆÖ¹’°;¿ö‹ûóZ¼¬ å[Ç-œÁ¤ŸBx¿ýpü|üÈÂendstream +endobj +4120 0 obj +<< +/Producer (AFPL Ghostscript 6.50) +>> +endobj +4121 0 obj +<< +/Type /ExtGState +/Name /R4 +/TR /Identity +/OPM 1 +/SM 0.02 +/SA true +>> +endobj +4122 0 obj +1049 +endobj +4116 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [372.214 454.382 454.872 467.283] +/Rect [84.043 406.344 213.036 418.033] /Subtype /Link -/A << /S /GoTo /D (domain-member) >> +/A << /S /GoTo /D (winbind) >> >> endobj -4039 0 obj << +4117 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [155.951 441.438 176.004 453.128] +/Rect [339.379 379.245 525.639 390.935] /Subtype /Link /A << /S /GoTo /D (domain-member) >> >> endobj -4040 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [430.884 336.518 476.755 349.42] -/Subtype /Link -/A << /S /GoTo /D (NetworkBrowsing) >> +4109 0 obj << +/D [4107 0 R /XYZ 85.039 786.531 null] >> endobj -4041 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [138.589 322.969 301.915 335.87] -/Subtype /Link -/A << /S /GoTo /D (integrate-ms-networks) >> +146 0 obj << +/D [4107 0 R /XYZ 85.039 364.977 null] >> endobj -4037 0 obj << -/D [4035 0 R /XYZ 85.039 786.531 null] +4118 0 obj << +/D [4107 0 R /XYZ 85.039 329.567 null] >> endobj -4034 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> +150 0 obj << +/D [4107 0 R /XYZ 85.039 166.128 null] +>> endobj +4119 0 obj << +/D [4107 0 R /XYZ 85.039 131.984 null] +>> endobj +4106 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4044 0 obj << -/Length 3078 +4126 0 obj << +/Length 2689 /Filter /FlateDecode >> stream -xÚ¥]sÛ6òÝ¿BÔLEóÉÞ܃c'M:‰í‹ÝéC›Š¤%^(Q%);þ÷·_ H‰¶ç&Ó©,‹ýÞæÁþ,Ö®&³(6®ýY¶9óf+XùíÌŒ… ,8ïîÏÎ?5ó=7ñ’ÙýCO'ñ\˜Ù}þ—sùñâöþý×ù" CG»óEÅÎÕÍÜw¾\|ºfðå|á;º¾ÇÑ×y;7Ÿçßî?{ß³0`ÒCdàŸ³¿¾y³˜ýýÌsÃ$ž=ÁØsý$™mΔ]­B™Wgwgÿéiñššñ®)yU`Ü ‚Aè¹q¬¦pßý†SûýP› /­]£¢^_¾èËWÇzf‘Payš(·ðg…êQNŠãœUµA ]•ÛqCÍ+°@³o œ7ŒfÎê= nQ»]{¬]ßÜÐfQ \ê·Õê„Œ<¥^ä÷Aþøe:´Ë:<²èc: ËÕ€Ҕîµ°ÃM´&-ú‘k`@ -L…Z¼®AÔ….N%et£×#ÃÎþ™ù0L’Qcbÿ Î?müÙU |ÎF¬2ÙÅ.<\7Cpæ$ˆÕ¯u -¼’ùz«ûƹmê¿=_UE‹óÈA¤-z¯»ç–e£]ç×E7"ç -[ãŸæ;ÓØͯ«’Ì_ÎQ0hy5%ÔB&èDé6+rl‹nª#cb´$ÄížÔè˜Ë7ö€mɬ5è¢]Yo©«weÖâ8qºuÊÆÁ 3Áœáœõ±h”–ÂúÄ’a >¨™‰ÀK"J ¼Ô¬ÄZ_i±ôS ÓD™{S0G_ÈøgEêd5-‚Øv¨­ !l»Œ=Hf1ø`ìƚΠ‚³ MxT¬Üò±EÂS%axÊM Ƚ¢-‹ýúéÇ4I[ä†àsÏàH±¶êZ±³§Êí*O¿ª ‹ó; æ¤hÄN¶Nw}.hÐõcåÔüÛ­Ë–¹¤ -ölo…jÔœ5E—˜ÙWkôÈÊÅ#ÿH©ˆö†Á¥ôÈÉq¾­;(2òwŒqÀf4Œ¢ê™Û±Td%:`ÆÀ®¶T‰ÆFÚf)³Û«K¤-ÿ’0ûl=Ë„åC ž¥X ™…òÓUÚRèlþYnYc¨™–aX½g‹é(eŠa9ËjH2x™…$w]BE¾«Á¦‡´ÿE+•^±À}ÉÏU¶qEò´ÿBaB7ü™F·õYÛ¬+[©©úÈ”äƦ®*ë>R½K1S*èw_Þ_~úpÇ3)ô¨è¢±¥ìûëKE^G‰êéF¯p€Äª‘€±k"ÓSBÁE£“¹ zõ@é”NΛꔆç}%ÉW¨Hò¢ŽÂ;ÐT.ªj¤ÒR‡­UkC.@¹Ý^T²I–Rž‚Á¨­ÂñeÍí† -õà¿=í‘Λz¿Z# zY:±{÷é掑–´žæ£ªª9G¥,lf ò¸ t‰j¼¸Dwyf…Å­0¿&†´‹ÑëT}õ5ZÎ-l‡„Ð0h9 úÑ˪­0{!àŠ@ÊaiÛ góÖO³ÎW·à¥Úô -PÀ jÎ2ÚP†ƒŸ??]ßñÈvµ#£òÒèT‚ôQÛ[fúµ`<¢°tHä\áýCŽ!ÿ µv.ˆ±®”ÓN…¹*{Åf]Ý<ƒ'ø/F4¾VoDÝ镨¤·¢îµmÔŸ7uƒónÎû ì2§æ4†„0,"8¾~“ûÏ7¿Ýàõ.†F+3AˆI³nŸV¶ÚbÊ?F–(ûGhɤ`ŸÒâf ©ìx„‹ûm;a¬‹ˆã(v2ü¡ÀÞS'Á´¤Îyˆ†à¶“^¡®Zèb_9÷ë™SàJå6«R.sÛàøsº¥8Ú2µÏõª–!'¡†|’»ðVG¶ó§ èù+Þ;*¿ýÞ¾´ãà³0LVI!é]wJ+; v\cÏÏê='¼7Žá€Áã5JÔ¸ûg…Òr1G›×¢npPúÍëQ2@z9J,ÒQòê%'çMEÉð¼Ó(Á‹¼h5Gº‘+KÁãEƒ×ï1v`‡Nã†Fѯgb¢þaŽ=,:fäKÿÇNKÙ èŸ -rñnÄÃÀìkŒ*õ‡Mzè]F.¸4=ËV!›IÇâ£bÕjß'A È›ïÓ Ï\3öÝ {W£ “õ9Œ×¾ÚÖ”%z¶ŒÆ …hÅ«&ÎvˆhƒÎ˜CÐÁx¨SÚÐÇZ&Ok;`sÍ(Ätì`_S4Q;¢ \Ÿ0fxw4¡Gè<È}Î} gW†ÒUõ\C9®9UùTºQœ¥*`™ÄSZõªÂ„3éC‡E§ðJyΖÝBì J`„1ïa; -UAc•ÖÔ’#îÂ!w‰ Ñ„½v³t¡©˜C{®ñCÁ£;´uLøÕøBZ"¨¸ÐõÇj˜ærjG@p[( v@ÎÑpý!e-í)R‚OY¦Ao^Û h/¤w\KyÚ›w2À¶y8>xÎÒ\u}ëTÍŽ3"vŽD»e8y=õ†Â©(–ç¼–5%ÒÑíIdÀ€Š=¨.eË(Y*o{2ïÍ cÊ:%Åá3ƒ­hxâDKTj^Îl·™"\yU_²ÙîP.ùªÊ5Lù ÷ÀˆÌý¨ò•Ôk„A^b–ìÆ^:@+ùêŽÃT@)ÿ =Å_ºAeÚ<Ä—Íá–:„?Ô2(»©Na%RUþÉYçüÔÖ|_ùýŽ<ÙôE ,îÛ¤öbÂóSó¶¼@ÊTž^ñ2VžÏôs¾T7ßñ: —ÝT—C¡«Eô4·—‹EÙÖx“ÇIÎ(í9‚û:²bf+d3ïùÎVVH/ˆ–±.v}RîÄÃÖv}rÒ’s´È[—}=z²$®èÕG¸Þœö;½›C´?­Éyi2¡>óc¼6EÊ£ÑKžü etˆ7—¡;ßï_IíC9RVc‰Ž,¾„ô²Œx( H¨a`US|ôÍî„þ© 'ÔÄ]ï/H(î? f E7Du¸êe=¶é  ’Ù^Q{ÇZ æS™ËC,,-G*bXÕ_Ÿ;b$âkqòTâ˧rþ‹xÛñÄê…È”*ÖaXͽ¤•SÎ}–ÊåÖRêܾ"…ÐM%úÕ/]jùXTn¨ ràF¡³$î´⃡‚|KŽ±™Ûï1&r.çä*të®±ý†l±à%¼.ýH7;ôgC†æ¦ŠlÎ]ô´AbÜ ˆ^•b€3ѹZ1"åÃvO¡ê*× …¥g¬‰w<£tåivèÞÝ€UyæCœ” ‹¾W!lб -Ö-@ðáRyQߪ,ïÉÝ![vtÑ@õbDÛQ/òc;½¤m!·ÅvXC<ø´Á1ž«âøíþFiùˆx.纬“'ùeœv]ÑgÎŽaôÔáIíüð]ÅNã¹¼¡€ã6Íj¯^l_ûä {0g§ã¯˜*·=7Ü-àÆ2 ²r;xCœjþBhÒ@ oë&q•V‚·±—»tU¸|zä¹Gg,ìèøÍ“ÕƒQòW ~¶ŒþO®¨°ñÒnôÅÕžÎSöÎ_'Næ#òˆ3èt9üµªêeZ}#)ƒàp­aWü×]œwi‹wh¶ÐªR›JãXYM5%PÍ–eÝ2wR8ú7ÿÜÞüv3õ½Žºì†È×_¯?]Xô r½$2÷Gkù¡€ÃÁ—4[—[9ó"×ÎJ’}/¶ùDÔ µËu -aôWuù²M7¿ˆÜ›å.mÛ§\æUžî«›çöŸê0ý±LVû¢í&$Grù’q–ÌâHãFTNò$‚·ëz_ ªù4Ѹí‡AnïCV5õ…$Ž´üÄZS?µ“M€5uU<Õˆu£Nu½kŠ‡¢¡Ï¦ÇGÈ®ç¢}©jWñ?©8®#ð?3ôSÿÜ¢¯F*v¸7N# Z7‘²Ì LÊ3¬Ã®ˆáÇÿ[âNendstream +xÚÛrÛ¶òÝ_¡Gi&b‚àåÌô¡mÒsÒIÒœXm'Óö–hKŠTHªŽÿ¾{ ^$·MXì{ߥÕ‡µHŒçët'‘g´Zl7þâVþ{£b- kæ»ÍÍËL´P¾—úébsßáI}ϤÑb³ûmùýÿ¾ý°yýqµÖZ/CoµŽãdy»RK˜SJ-y cZ—›Oðí–¿}ÿŠ·8ùýj­–?|³ùÄ“ï~zÅ°l~¼y½éê\EiÇüróÛþbWúñÆ÷tš,aì{*MÇ›ÐhÏ„ZÞ‹›Û›ÿw¸x-\ð®9®x&ÑS¶(ã°%Už¯âElŒE†Ø’í¾Gƒ÷Êë?WAžû†O8Wkï3/Þ­ÖA ÏŠöxpûÑf`ÉKãdžR,‚€æš5ðÐ*YÖôzoç‘®Š—m5æ¦2‘)`g÷ S¼/Õ |t¸a¡×ø”cœxÄvÏGÑ*]nñ6ûì3­{ºªäç®:f‰ÇðE¸Ã„5ˆõp_JÆѺ—šÖÂ\¿Š†Ått•ûJÎ{¬já6œVáü1köuþÕ;<_ù Ü߆ßVåï¾ +añá¼f©¡ö«Ò¡°!m©N„cÞ$¢4¾ë«ÖíÀÐmXU^jŒcÝQxNè ¡§Q ص1þòt‘”8ŠaŒØÂê™d‚gmWÚµ¦õß}ãÃÔÏÝð6ÿ3/pÁÞí¹Æ]ý&W—.¥^pAŽÝÅz˜©-0f? éb·®I&‘XÚÿžWx›WŸxñXî%Ë]ί$Æ$^füZt¶Öò|…[ØïëêÈ£vŸ3É–Õ›'÷ÖZKE'š‰ê+&Pˆ6“”UË Ûì”݉ Üó|F"R¤…8ÕõÎhœµ¼P›‹–G‹C¿„Nßèå›#’iƒÃx¹Çñþxâ•ÚÞp[¹³S;Æüþ§ omQõyxîã¬p°×v &·'fAà:f¥U˜ÞÕ$¥Awù´Ïâ·×a±nŸ[è ]Ðxù™/€¸å¶À“ïòÿ\Г &'Wõß!ý•ë‘}å…¾îáUÁÅ“hàG^b’«-Ì„â0¨ÀÓ*Pü@á®Í‰•í!+$ Ø’’VÈ^âù·, aEJ11t†âßI.ñ+©øŽ,ïQû~¾ |ÿ+Cœ²†ÄCTgæèÜÅV–>º\d Éõª¹"†yV—©õb’›—BOî­Õ?fã=?…7d@Ƙ­uLÀGŠÝ™0žýÌbøÎhW3ËÒAÂshT‚€b™Œ Ï‰Ý ‘>H|×pAAäÅêiô0WÄ!@ÏÊã +Á^ #Šóq(¾bEÏ…GÈòë0Ί´À?GÝqñŽÿ…(9 +¥nÛsA£BB–<)^ÙE;IÜÞÚVòÜ÷è¦Þ ‘\òN/¤ˆT@?wù‰gÀRŒ|æx51Å1Ím±xšœ†é÷A8Ò\ÊFC©3CWõ ‡¹¢ô¬\!ØëÁˆâ¼8)Så,•åê„¢O¨Sv†8¸Å< Œ1ã×± Ĺ;JN2ÌÂÐç”nljQ:ÌýB‡™ 9¶:|Ÿ*ŠCp¤(„©sì»]^¢Wxšn³ÇmçVjV‰£å%Ѫøt=q`®ˆV€ží‚½hGçEëPüõ€9&xÔ0ò¥8ÃQgï1åa¤:KU6ƒÅI†W±ò¾¹“8 ßVgpØ)&0´{Ų&Ò‚íÏfà4ŸµvÔ“ExD]dá›t®I0”®“¿äˆl8®XÞ\ÒRtïc²£ÓÓ°îIÕ{A E´ö=?‰‰ØŒ(q4í{Ä׊¬xXdÅq»G¹€º&·‡&¶ÚŽJž(gÁµ-y—fÚ5ÊnËÁ>ÁA.sæ"fºV S/®_, ¹ZV›½2´¡8ô¶ÏÇâgà ڤͰì¡òíå ø®’coÈ1²é¼ilÿ 4(Àö|â]Óˆb/J”lÊ} +šmçñ5Úñ!sÈ0p¥3 ©½ä‚ñ´„¥Jl$>ºnÖ°Ær@¸tÕ“N‰J´™h áevÌ_ÎdøQâÈ_¬REéP"q”†°ñW³¶Í'R,ÄSñ³¨HE¢¸›âslj§º wÖ +ð"s L]¥‡{οJ]ÏîœÉw7À õ•s]²(p<Ë©Hü ŽÈ éC%L¸…1"Õ3;DPö¾á^ˆ ´…ÃìÅcÛ)@DâqÖ94OLln&€Yçë†jáNì…s®4ÄG„¶!ƒ S(ÏÒ!…ù’‘Üû1!vX¸T:Mðõ¬‘.sQe.}éç­Ã$Œ“p5?°Áà`Þzì¢gZÍÖÅ“¡[ÏÊÊ gÜ€‡÷wßÍ q`²æ߀ÿƒXá§|îO«Dc91J=öÅŽ_³¢Á¶ÒRåü"ÁäÉþ–„Г #β€Ø)µ †µ.@j+º¯æ:š`TÙP¯tOª1†Î‘E#pgpìºëÃùÿ¶þê¹x³d ¡ÔÕ`ud=/XUÒ%å¬h$™Á79(ÂwÆ?ˆ8ï‡4š3Jz]ac^në'2%ÐcTâÌŸ6Ýf'jÝA݉DìaCK§(Í Ÿz߸±å1Œ2~P›®ä¬J¶Èû`#1zm ‹Þ8òŸ'PPÿ:´æ-´-ÌØŸ4¼Îñ"\vû8À>áÝÛ\pyvôþ¦Í£ýœ¸@«ê¶3ÔƒQ|a æÃÆÏèONƒ¯wnß3¿ÏÈTÛ9£æ ûpñº5-EøøRz ßØõ‘iA>rcWjç0V}HÁ-Óì&'‰ m“f2¬sÎÕ)™ÈwžÀ¡åsPª¸Ïä½m;@Ê™Dl(1IM€)®ÁFïLfŒÉÂîl§{ý*pTë‰'­n‘]AQ]ÍCëÞhLxö¶ãjÅl¿RÁdבÿ‚ßqrvž‚”BG m\[Œ®¤ù‘üŸ_u, 8zC<°Xë4òB5ü:–ÁÛjö-1“='¨˜@‰o¢N3¬€bf¬R­1öÏƲ0ºTX#6I—h7YÞaí‰{n>Å!ñýÌþWIJµò¸HO-ç<Á†`ŒEm¢±Ä;ÔÆ\¼ +,mÅÌè¥Kó ~b³Öü>ý&e¢k˜«ç)ðCøƒ¼¦ßo®‘À mR]¹5l‘µ6*CÅ >šaCÚúDŠk­óaªk­v*³Ù]t—ÚbÚx¡žmV¯¶_¢ÿý¿4ô ˜ÄK“`¾bÀmGqhCzƒñí¿>LOü§–.žendstream endobj -4043 0 obj << +4125 0 obj << /Type /Page -/Contents 4044 0 R -/Resources 4042 0 R +/Contents 4126 0 R +/Resources 4124 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4028 0 R -/Annots [ 4046 0 R 4047 0 R 4048 0 R ] ->> endobj -4046 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [380.998 669.256 454.872 680.945] -/Subtype /Link -/A << /S /GoTo /D (ProfileMgmt) >> ->> endobj -4047 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [155.951 655.707 181.035 667.396] -/Subtype /Link -/A << /S /GoTo /D (ProfileMgmt) >> +/Parent 4080 0 R +/Annots [ 4128 0 R ] >> endobj -4048 0 obj << +4128 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [203.943 655.707 296.401 667.396] +/Rect [155.623 725.431 326.449 737.121] /Subtype /Link -/A << /S /GoTo /D (PolicyMgmt) >> +/A << /S /GoTo /D (domain-member) >> >> endobj -4045 0 obj << -/D [4043 0 R /XYZ 85.039 786.531 null] +4127 0 obj << +/D [4125 0 R /XYZ 85.039 786.531 null] >> endobj -202 0 obj << -/D [4043 0 R /XYZ 85.039 316.95 null] +154 0 obj << +/D [4125 0 R /XYZ 85.039 697.613 null] >> endobj -4049 0 obj << -/D [4043 0 R /XYZ 85.039 285.424 null] +4129 0 obj << +/D [4125 0 R /XYZ 85.039 662.203 null] >> endobj -4042 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R /F66 3242 0 R /F35 2880 0 R /F20 2865 0 R >> -/XObject << /Im1 3957 0 R >> +4124 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4052 0 obj << -/Length 799 +4132 0 obj << +/Length 3000 /Filter /FlateDecode >> stream -xÚ¥VQo›0~çWð2-©11°©šº¶[Wmm×æeJû@ÁIÐÀÎlÓ,ÿ~6Ø ÒFš"‚í»ó}÷Ýù°gùóì¹FvN\=;),`/¤ä«åi G«8 ÏSkôeâÛp#ÙÓùvŸ¸(šØÓt68¿:»›^Þá¹C'ÂÁÅíÐü8ûvS/Ÿo –n¦jt?‡ƒÛïçéµu9ÝBh€ô TþX³'`§ìµ\…öZŽëE‘]X>‚.ò¡žçÖƒõs»W-óíÚª/^C…°0D€=4v}í!wâUÄ)-⌠4Fƒ"æ³z|Z¿6˜«È¤ÇS ¢Ê(§Iœc3\ !+›µã¤d™Ø˜™Yðzö(J.êYÉ;m›ÓXxMx¨òtPý0*L¶Y œÖÓUÌùš²TãŠÖƒúÅðŸ2c¸ÀDCSÖR¸»8ßE”ây\梅ææûØ5µI/ŽüF-~ËÕŠ2mßLnN”ô%³Géèl®—Øp#¨ ¨YÚepÅè<Ë1ÿÔ[LÒ§‰W,[Î=è«çÝú7»T+åa¨2ÞJŒBô^/-i¡•R™ÌDÂÖ“´³_Ò2×Ë™f÷YË -Z’méÄâS–½àVW^·ØÝcE d@/ò TŒ¨ÿuF4M¯œÁN²ù¦ÅÌ̲¤QZ7aÙªSæy¾ã“wO ö#–†þ½40œÇbKÃÉÉÅíÃÉÉ~ ˜‚K­7#XTÈžLNÔÁ|•º&úÓFlnR¤•¥3Wݱ‡%‚Ìylª¢öÖæ¡ytJ£y¾k3 H èJhœîëTþ¨älTõÙ‹çx”gÏ#³K†c]”ä›#zøZ¶HOžñ6GDÄi‘‘·ê£DÙÑ5€n­ÌŒ¨KFÚåÿU=nÄ I‰Ø+÷ã8!´G?‘†ù]ûݲúºg»wtÍ‚Ú¬çn‘ë×Wƒýï¹|jÿumØÞ‚üÐÂñöNà5ïH¦uøŒ -Éö›ëEñ?;¥uîendstream +xÚ­Z[oܶ~÷¯XôI dQu)ЇÄNÏq‘89µsÒ íƒ,É»ªw¥ÄµëóëÏܨË^Ü ‚@äp8‡3ßp­füS³D»^Îâ$ru fùæÌ›-aä_gJ8²ñ¼¾9{ù³ŽfÊsS/ÝÜõrRÏÕi4»)~wÎÿýêÃÍ›_ç‹ œÐ/â8q®çÊšRÊùïhÓpèÜ|þ€½kf~uuÁk$žÏÊùøëåÍg&¾{Á¼Þüröæ¦Wt´¨æ—³ßÿôflé—3Ï ÒdömÏUi:Ûœ…:puH}v}öŸ^…3žuÌ*–cáÿ5˱´§.çÍ*H\­ã“rh–r¸ÅìÑžœþ¬"?v#=œUΔrS­ñ¬àŒB†‚x°"žÕU5hèr߬Â%Ê }²ÅìËL¹^˜¦³ŒÚ¤ý°+"¼¼Ü¨ÙEjÎFšŠØÅH.iª’‘W)?u£XÏb?q•§HÕO«õ¬Á<ü)ÛÜfÜ«:þ¶»èuU/…^ã®À z"ö¯Ð¨(¶#©-L{ 3´<“Éù®­È@~ì<ñÀéÍ|”¢déÕSíF*á•ëÒ;œÝ•µ©²5™UÆG€ã÷ˆÔm6÷Ò*Û,pð7•¸Q¡Ç€¦$¿4¢óá.Á=ÃÐ=¶¸¯ýˆ‚ÜJ/`#‰ÏCeû`%MvpPÖ\¸“a†ÁNà˜†‰¤>6¶¤}™#SÕ•ÌuUš×—ﯙc“å« +KkÔpÃŽH ÍÝD&,&IvIcØ&ià&±š˜$ÛÍÉŽ`bZž¬[5è6 +lÒ8„&„cWŠS§ŸTsÿ +ûïo¸S”¦ŸMÊVuÉ‚Íj®ø˜¡s×6n]±¶¯a¶ŽBêlCŽÃ·¿W|MFtš{ÜÀÍœFÎ-9ZÙ+µ#c›ùª©ri“ÍR= šÞ¬Ùhœm„„ŸîÍ´g1ä¹õ+Ѭ—|[™¶ï<ÙAXŒ7©iy†VUÚ©ôxÕo;½y7`ׂ9Å– +…¡ÙÍÆ*ZÕb¡Áö~Ù6ä´|)•¼°w+7ìÜEév¡Âh6Ê\ß1Ù*/ž-úþMÉ‚hì? Ž"ÁQЧ1ß;Gd çùdˆÐ \0ì£O˜:oþÎ6Û5_à Šó¦þÃSár'ˆ7óOSŸÀ<:ñ]?}¾x¾%G4ÔžëG iø±ãô©çÝ5?ÑE+Tè±cÚ†D;™ôéfãw‡Á·W=Ÿk¸˜kd'ÄÕ“Íø Ñc×KY—›…TœÌJ®Á«Á©(£­éSvŒ+6lg†ŒŠB¹/1T¢ˆ1ã]³Æƒ äøHÉiÉLÛ¬…Ø2„~‘A±gO]© ªrëæMM«øžèºü‘î‡vÓ8]ZÕŒlÊ:oŸ¶‚@6³>[Ã-£L-‹þÄk~žCæâÐv$&í£ +)£ÙãHÄ—{áz›uVƒ‚7b³ÍjYØO,ú›ß÷\Õ襳0JÝÔÿç¸~|›/DÒbÅÈqpƒÐ£À.‡»°ùv¢Tärð¿‹V"êyµ¢¢\8V 2)@µ=µj{½ŽŸ +/¢ˆ³Æ [‚‰œ÷õ1œkRÈL¼T0èÀövw\STTËÚM&¸hRZÊÖUa1_ÁcÁCŒrƒ´ÄGHE„W³½ò‘ð@,ÂdKÜ'Ð.‹©?1½à$ÐÇMØKÛiOoBÌ_=h1z2‰ÀeÛ6ò Ò8È'„k`ëkÍLŤî@@_Y°ãð…g3XÎÕè4®q ›%xLÙò$Ë%1óð˜ÔÇkJT=ã•œlêBe¸^AŸ¾Å+L]kGQúïMuÏ89‘h(ãCöf¹ëX΀$[FáRÅÑ”ºxvîñT·7⎛ìŽ1—ŒŽôÐî²jÝɼæˆcµå_ ½Ñ›"o0N¤&›â› Ĭí"o?7êþbq Cä§0­ÉTÖ¼(xä_ÈF—¾ÃUå[‡Þ×_¾ï8~ððñR%TñûC¨‰ÒÀùÔkÜrÙ2üDÌY™’{òDÒôüÄMªÙ‰÷Ljv†ÙÁ# +¹¦Ã×d­ÉR…Xâ¼ã()hDÈálÑßm#YÓeK½SÆÈŒa"ä5Æ•tàN­9¨´Ö:ÝnmzìIß‘£0aºs´ÉÎtÓ`” +Ц·9ü†ÀSxƒ ˆ­=ÂîÒÂk os. ‰Ú–_PÛª±F’'6þå8è•1­3ì÷9:¨ññêò7Êhí¼ÙÕø6c˜HQ÷s"µ/,p¦ºq¹²Ýjׇ¢˜Û€?è ÔÛu¿Ýo$Y½”v& º-‡˜6Kó—M-Kßö€9 ƒ¦^\¿ƒïkœ÷òüògy®Îו8[çž(ÐüX»ÚŸ-ÐF<} e"ÔÄC懑Ƕ„ ¥vü0ðúÁÕ `‡ŽªÈ|Uæ÷’‰Ohnš<_ÜŽx¡š•ã%ô‡ša½èÍùDDr,f­pb,$à  ¼ªâ ~׶¡¢w‰Ð?] á`&Ò‰©5L¤ôrj„.ùÞ›l½.ëeù²ågØ-ç¢Ú.ýµñCO_40DøXâi/sïÝ Á[èQ}¬œ·è7 +Y‚!}ûÕÍÛw>LRܧ;ƒ<ä‹5½OùZÈ°Žt™tMù·á£! õ²cˆe­¼®^üàXÎ!·Y'ôH˜Ü12›à>ô?/q.mòÔRø¢•›Ýº`ÒpI!5õ!”sÔÿìÓY:ÃÇʬx¾`OíØÛ‡ímÛ~ ÓiÖ/ö’7òîÄUÝtÔ®ÞôGá§ìC¯í&lâïq &Wf”Dó« ¡w®3îÅrxH'ø‡SÑéñ œþî- h·6ŠAÒ…&ÂnÅÕþM£žAl€í¨¦ƒ²3Çpò§ €ñFoĹÅO[º¡8x`nâ^àdrêØ<21á±éòSH&?Š¬¨@ñ|‹Êš»²'Èa…—¸=ü’âïåg TÞGšßç+Þ¿ï ‡-À€ +7[P*çÇ16Ý0Iž ± EX(}G?TAÁzƒ*ú‹÷S”ñ:yn5˲¿Ü$ +å»òÇ˽ ¼»;…¼ùU%m{JˆpŽ?מdØré‚á‘&Ð(–†£g@ Íîk~¨Ãs/ ¤’ lÑ +lôH p¡Õ©ã+Æó?€[ŽÓGÄ,ÿtB§—êhºÖÑóÖ¢rŸöŠ|Ù—(Q‡ðfï®éËßýñ»ÛrB´o92ÿR¯ü¼Ë/Åä-Hö¡Ä´xïj7KhrŸ/¬át,tÖG^4Mk_güD~…J´(ã' ŸUßFª‚Ø° y4$NX;ˆ(.êÁg>¾}Ë”8´P¼_ý$ê³9rv”c+#J5üå<¼â8ˆ AG¢ ¿ÑRûâÍ©¿n´òÏ û¾ÿÙLßô‡½³‡Éiȧñ7š8´Ê öÖøËLÑøÿ^.8àendstream endobj -4051 0 obj << +4131 0 obj << /Type /Page -/Contents 4052 0 R -/Resources 4050 0 R +/Contents 4132 0 R +/Resources 4130 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4028 0 R +/Parent 4139 0 R >> endobj -4053 0 obj << -/D [4051 0 R /XYZ 85.039 786.531 null] +4133 0 obj << +/D [4131 0 R /XYZ 85.039 786.531 null] >> endobj -4050 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +158 0 obj << +/D [4131 0 R /XYZ 85.039 606.533 null] +>> endobj +4137 0 obj << +/D [4131 0 R /XYZ 85.039 575.245 null] +>> endobj +162 0 obj << +/D [4131 0 R /XYZ 85.039 275.527 null] +>> endobj +4138 0 obj << +/D [4131 0 R /XYZ 85.039 233.179 null] +>> endobj +4130 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F20 2961 0 R /F58 3360 0 R /F15 2972 0 R /F41 2994 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4056 0 obj << -/Length 2698 +4142 0 obj << +/Length 3183 /Filter /FlateDecode >> stream -xÚ¥ksÛ¸ñ»…¾•š91ă¯vòÁ±’67®“&êtnrùK´Ì EêHÊ>÷×w =Ó6“q,‹}ï“þ‰I‡‘Ê'i–„±“åæ*š¬aå¯WÂbÌ,ÊÌÃy³¸zõ.Ñ…y”O< -ã<™,V_‚›¿]\¼ý4)¥‚8œÎÒ4 æ¦"øûõû;ßLg"@ÐÝGŸ¦2 >ÜN¿.~¾z»Xð˜J!¿_}ùMVÀìÏWQ¨òlò ã(y>Ù\éX…±Vv^]}¾úÇ@‹×ô„w’WË$”) $àÈÿâ8ç$ô©ã"$“…Zê³thWtxÄèê€ÎL*!'³8NÃ4ÓƒR9"ÌãÍ D&¹œ¤ e§d‡»ôÛ£z‹CÅ:ôD'¡Î‰æä÷‰#çŠq¼1 0 -F€Wï7b2o€ÓɳLwæ&fEæùŒˆ“0×é$•Y("AÌ.§ÈçLIÞOgàÍ“m§H‹‹ª/ðÓ¼c¤ù†(´% -Â牱0@ÞUO:Úßó¤y€¯ÈƒíwOéÍtØF8´åuŒfèg9 µ*~„®‘¡TÁFH$„Û§¢ýSÇK›†Ä]Yb¿[­q–,aÐÔSq"ƒL-q”¬©*’ùÙaÖk¦sQ¨c¶ÛÚCiË8 -â¼+ê¾4UÇ‘lª¦fTü‰½z§bßØi(2ð¥Â,UDÿ¹i¿­ÛfÒÅ2^óçîúÓÝûëSZl6¦¬©jÖMÝííû¥Ø“!>Ú³1]_´—ö؃ºb¹kËþeõŸì%±ö|xvB®Á‡“40«LʾljT{ÅÐ nŒêLö ¤–Lƒçš¡¥ý²%€(}2!°*»~ÏâxüAè·û0zÒ±ìcì°£ƒeÇB3ógCly¾±Ä Íf[‘ä$õSÙ’O°|u¦Š0=z)í2$¦a‘§“ÙÚÿÿ´½ŸnU–ŒlÏ©¥ -¥(6!³Ö/Z«ã)ÈX=¡»ƒX(E8è< °¯Ìƒ¾³ñÖð"c³Eo0d¸òßv;ùƒ’cdš{&„{rIŽ­1­Ñö­é]ú8*,t 0“§»Q1#+Fï)& “4(¡b€ôèD¥¡¤_>QŽÏÛ3„[fñÞyoÑ÷–.Á½l{—žVÓ™²aGÚ|F=5íŠÃB‹ ;Œ&-â€UZðRQƒŠÙ~HHƒ“,ÞM3°fË;6M[ðhUô¦¬:ž@0Ð׆5%hœ£ Ù~‘ÑDzûéDx¶ÅCa#v*3ÍH™€/¡+EñJ»¶õú“¯VFžyØ'ÔºO9¸^r¨ïØUÙ½Þ£ªšÖ»ó0ætnzsoº!S€6É—·=§T_•èPCgé±uäç2ù³=N˜r¯wÞã=¤óï¾ãñ´tÞ)÷Ï[¸4µêiHãÖ_F§Æy>fƒ­M=­]pÇTemǃÉÇ+^z4‡)ÆV†/uÑ»}_½³ÈâmqÖØÛ§ú;‘.À"}Ï—t8<祿óÈZ¤¶§ÄxسÃarIýä’Bç…cgÚÂiŸºœß·CcÐù¤©òóò™Ã~hìà_´¾âÔÓñ1˪,jôÇÍå%•ƒP±4XÚ@它%[†!¯ZS«ÓùMȃCÚ¤T€(­ËÈn@4²áäá §is9-›]Ç°;Û·S"¥þÞ´ƒˆC7tª$Õ/] Ø.…t±Ÿ¿ÊzYíV^õÀ’;4×`4ÎÇå*+èÅZœß#iìþ\/e£q õC¼†g.¾ZË0QÉÅÛ¹‡C¾*aU‡J'|-´Q&u˜Fœ,âPãýAçÁg³¹7Ü^Ï‘ÏÜPι§3Ö­pý¦©û¶©ÎñiÉ_äsÄ9SŽÏÚµ˜Ë8p‡6¹73棠ìø‹¦éylj,ê ™ÓÔ<©ifi¯x4¡ý#Öµ]sº`Åå9Ú‚©´½ðYŸ‡Ç7\ï=â§ÏïÛ]EŽÝð¤^²‹È,!öd–™I`Íñ…óùÀÊß¾0ô#ÅÆƸùܦ¤H,rˆ1¸ï -¸»«à‰[Zìm´7•e„®”-“íšÍðp µ²¥Ü‹Æ _²‡ÌF”©(f0w½8|Û$Öëu(-žÙ ”±5æ‚´n¬”-ß‚ ºMji¿|ïJ÷¨ÛLÑhéÐý¬ÅÛí‘Ù85–pÓq¼±;±úK¸–S»_c¿´ö—Û¢-ým¦BPÕ¬^Z¦Ò¦…Y‡(—‚‚ñW¬Þ}Xð pG Þ²gàghƒ’c÷jf¸¦øî#¯À;¿/Ð’®œ”¶¶µNb“'9 -Âgü©­¿à®ñ»«V z¡\½ãɪ°Oµ]%¥Á×Ôü˜ÂTv¶i¤ûG ÈR•½‡JR—ÔAssy Xío%Ä¥Šb¾FEÉèŠ0~Ø!‘][PùŠmo c>ZL3{9­mìMž‡ÊO/MpN[Pôìß΢dlÆœ˜ˆ|Î]8ˆMeÙ,L¿êè©× Wq6ÆL–HçÑÔ믢´x÷£÷xáB…·ž¯Q -R¶Î㋹ßÃ9_£d¦Ã$Ó¶FŶFÙZ„ •¶QÎÇÁ]ÑOUú†ÿš©‚$önÑñÖÍX»ø àñ íŒ82a–ë‹âx8çK™L ”)áõç`ÛnZ†<ó›Ëäµð=ÙØ‚kçaì<Žoíkù²ýÒ³9Ör×uCçØö}"Š}S/Í®³Ð²·ÞŠÖäqÕ ïõîx'_ ±â`Ç4u®JÄ×­õX\ÛR×óE–ä¶ y¯‹£¿—Þv¯^šŠžÖlÈ1ÓtLËÅ\éwq’œÒ¯Ýlø3ççº e¥©†&öR,H™‡*¿Ü¯y8C,xÏøÖyDÆI>Æ‚t!óýÆìŽßÑû]D6öÆÃæ¥\çq(õå öpÎ{½È“0O¹V^cúÓR .‹ã¡'ÉI­\ªµ”þõfíÎ^ièÁ½`àðÎl/š´êݸP>Bü5Š#~³MI™JhASË"¶7èü(˜ø©×—-UôXÉ»œC5€³ù¤9„R${‘ñÁ2-sqäaytB §’í=Øp[$¶´;E0>ð ÈÏ%^PpDÍÂÑÉ à—q¤÷šÁ¿Pmë†z"æéjÃ;ÛÓ ÒØêã® uõL(QÐXœëÛ[¼1T¿ÑÛƒNÑúØŽá+Ç]—½K%‚_óç®±XÎÑŽÓØ `zKáÈ:ëB‹0JäÅñp†X? ±.Ô~¬ [þÞþa†Žó®eBÆj¾ÃâˆC,îÿv¹ -ÅËU¨l6ú²®š{S}%íÑo â~¬9±éį5膸‘&Åû8¿ùÉþpÔ쯼™ßtèi縫“wUøcž~è‡æñÆ›…yvæ‘2£'©vÌ tvÈp¬²0ÎÔ ŽÿФuHendstream +xڥ˒ÛÆñ¾_Áò ¬a¼ rÐË‘\YÉñ®£¸lf ,‰hÔîþ}ú9 sH©´ôôôt÷ôô ü yêq±X癟Æáb³¿ [˜ùûM(+AY98oîo¾ÿ!ÍaàA±¸´tŠÀO‹lq_þæ½ýðú§û÷?/Wq{‰¿\­×¹w· =€…aèýë=Œi:ñîý ßîùõ§w<¸CàÛå*ô~ùùãý¯ ¼ýüŽqÿ¸ÿñæý½eÔ%ŒcdóÏ›ßþ%ˆôãMàÇE¾x‚qà‡E±Øß$iì§I,ïÍÍÝÍ?--žK¼jN+iœûi_ª%Lµ„aäÇa´X§©Ÿ%kÒË×e”{ÕËÀ’KU¡”-ȵÁAƒ—ÃÈS†ßíqÆlkEúŽá9zXF…÷2Vüöm™fžiŽ€K”AýIzÞÉ|¯ña\·[¦fü|@.œ°ùØኽð¼ãÕ8þ‡ioM‹ãÈÛ™açã±,VÑÚÖ 8ðƒœå¾ÅÓÍCï mWÂßn­½'Ü!¼"åéƒem5àߪÿf%®õïfƒ‹¿òšð<‹Ä»Â]jTfÙ¡ºÅ§{~~£è‰<ÒîZAˆýg^mh1›Ne¨»–‰\eåvQÁb¢5¤…2ž#ãQ¾öb~<)'MÀãPáö­Ç]Õ3pßáÓ++~íùy0Ãð„Êèú!pîG=!4)X2Z–ÌÈ£=€½¼Ö U%( o®;àÉ!Ýs"ídF~yDÚMÃ3ŸØ¬Zåò¾À¨²€ó-™ ‚o™Œt8¢)`s”^®Ë¡1µäHÈÏ:œÒª/”fp¯Kåå1ÇþŽ¾Š–…µè$‰/ô’$©·iêŠu/ÒTd¾–4÷Pü†jG²eß‘xD}Ësm5²r•ÿ¯ gßà Ë®öxh›³ýQj´¨J,…v­Ë†ÅÇåt =ã†Á̉îký +Õ™´(Nò³Cc?TÞ—]Õ2ÂH Võü+YjƱ"±PªQè’»œ` Þ•ÒÞØ$h×’©á™öµÊŽh›®mõ 7#ßìÄ1hÄÙ‰Éàxª«KU”(_7Ý:ô^±íêxOvÁ}µb½æ¡©UªÓ=«â!…¾Õˆš âJèØ°·ÜU¥¼ƒa¡{ç7´7‡Ç˜< +RzB$ð*s¶ÿÅñ0à{#ï¶vƒWG:´´€=‘Øδ[bØ(“eõhP€F§W5g׆‹¬½&Áš%Æ•× "Ý::$‡ß©¯€Cjd¦0PÙH0R ñ9ëÇñ–°£A£©žÅb.8W”húy!¸ƒÚW¦U³vîi¢Z5I±Ú¾ÚÖDM¢a„ƒé;­ko’{,—9ÝB¹|‘rk-¹ æâ2ΈNþ) +à« ‰¢¹Ãx¦fsÀ¡qNÃô2L!-Yöõ»¤‡ãiÝD9ˆkø1wûhb°¾ç[½©˜™)y¦¶¢±DE^qáKgtpᜢ"$ö#ðn}%éW]Ò±V<þ§ŸjŠº0¢øRËKýÈO=m\ÒWûN—CT'/ÀÞ£Þ¾û¸Ä‘щ§4ÅyÖJ¡CÛNxê\„Tí¦9X^Îæ0NÆ!†Öå±XwÆ`ݤF‰åI˜8±¦k} +zYý„I[ÛѸ^xŽ¸ÅáÇ–êˆñRèØ -HdKaÁÄ=Cl¿TêÆLãÖ:p“ö$øÀ“y³âJBÇs­¹n©xáØ«9Â%¯Gºôäí3ôÀxŸ «³`Ízû†ÇWnâ?qN£ãàʲiÀÁÍ%Õ&¦—ùº¥§| ¤~±ÎÁt úˆ/o"¥¼ Qaæ&ÿ7k©HºÒdì’#°˜¾5{É3šÊ¡’¸T +¹¢[9Εò•wÎÅÿ¼ºqv‘Jã5‹SïNh?~Ô?ЂM†(•T<¢ƒÁk%Ä6N€³W“Ç>ŒöV!¡ÎîFþäë‘cÂæ6á +x‚1“š‘Ñì4’T]¸l´1 à çE7 ˆ‚`CG¿éŽ¶xS›Ä÷†³u¸i0®üåÓÇóHÏ’>f|­›û«K‚bÐã4/Âhë¼Èš‘B¼°:••+|ê^dÍS9áëÍf¬úWg)¦8'¹ÝgÇÎSRщ㓺¯–´¸7¶ún$™µ©qUVg‰kNL~p„˜VŸ’mœg¿âg£È&¬eJ..P°1ù+Í(ÌW-º¢ˆe'z”HœpÔÏÊ9î¸" °úD"’ÉõÜü íúÛjA®aW“J,¯”ß”e‚“¢À•©„'G–KV #îlR™ k'ós c<@,Ž…õYC‚¦ÔÕNKq¿2gÕñ½ê‡s×û"iÄœùÞ™¬n.Å¢JC¼Ög>ïÅ™ÝbBUñ ňõIXŒ0ë23JCê Y‹œ>×ÔpƒuGé¼±g‹mšxИ:©WÜp«j)4œ „ÕȈVty•Ÿvµä30õýiî45ãÐCl„Ò_¦ õHJÆ4@áây!¸¶.§cH"¶Axâ¡&³Uú¼uè}¢,qœJ)¢”ŸÒDˆ<Û‚£nÃ>ßñS\Î0YéB•µZtÍ8ÿNûÑIt­IÅ¡¯ðã‹ê(Æx%YôïAÀjQÆk®È³K'CÐ ˜Yr9?¸vÀQ_ÙÚ—ªfq.š¹G ;Ö6ç©ÚÄ´=6SÝKum»C8óH•ôž§'?ç(>\É+NEBæÝk‹ƒ“ÿ¥Z’ÄX&˜†{übrÖãZÒõ¦k·Cì +n<Ö{=a$j¤ìps›`ZŽÈ\ îÚõšáxr•ôJRGï0\)ã<;ÕíØ¥½–«Þ0öÖeaû¶8™æ‹Ò¢üF]+$mËò„tå”@6BŽìUF[¥ˆÂ(ÒpÔ¯\šöiÒ¶Pˆ£S²K½Ë¶Z‚¶ê°éu`…î¸ ÍÍýu*ŸöyuÙZU)ýÈ/¨vЕöãu=iï[+ÿ«3~Êk²ÌuAí4c³Ãs\ìh0`j¯#F-ä-¶˜KœNºœý¾ðXaù™ÉqïòÓÑP&ËŸt9°Â{ßnÉYC®‹fü}œú ÿøäÜÝÃVÒÿõÃ4’ +«h>f¤p;³u¢ÌPKÎÖ°\rü_©‹ó²endstream endobj -4055 0 obj << +4141 0 obj << /Type /Page -/Contents 4056 0 R -/Resources 4054 0 R +/Contents 4142 0 R +/Resources 4140 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4028 0 R -/Annots [ 4058 0 R ] ->> endobj -4058 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [177.134 510.155 365.46 521.844] -/Subtype /Link -/A << /S /GoTo /D (passdb) >> ->> endobj -4057 0 obj << -/D [4055 0 R /XYZ 85.039 786.531 null] ->> endobj -206 0 obj << -/D [4055 0 R /XYZ 85.039 442.636 null] ->> endobj -4059 0 obj << -/D [4055 0 R /XYZ 85.039 413.9 null] ->> endobj -210 0 obj << -/D [4055 0 R /XYZ 85.039 300.495 null] +/Parent 4139 0 R >> endobj -4060 0 obj << -/D [4055 0 R /XYZ 85.039 271.091 null] ->> endobj -214 0 obj << -/D [4055 0 R /XYZ 85.039 229.396 null] ->> endobj -4061 0 obj << -/D [4055 0 R /XYZ 85.039 208.199 null] +4143 0 obj << +/D [4141 0 R /XYZ 85.039 786.531 null] >> endobj -218 0 obj << -/D [4055 0 R /XYZ 85.039 141.062 null] +166 0 obj << +/D [4141 0 R /XYZ 85.039 209.66 null] >> endobj -4062 0 obj << -/D [4055 0 R /XYZ 85.039 118.346 null] +4144 0 obj << +/D [4141 0 R /XYZ 85.039 169.496 null] >> endobj -4054 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R /F66 3242 0 R >> -/XObject << /Im1 3957 0 R >> +4140 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4065 0 obj << -/Length 3051 +4147 0 obj << +/Length 2267 /Filter /FlateDecode >> stream -xÚ¥YÝsÛÆ×_Á·‚3!„´ÓÇVk§±ìFÊ8™$ ‘ˆ@‚@+úݽ(’n'Œ»Ý½½½ý¾c8 è_8É?ˆóIšÍý$'ËíU0YæŸW¡RÌ”d6¢ùöþêús3 ?òÉýƒã“~’Ï'÷«_¼×o_}¼¿ùa:‹ãØKüé,M3ï͇iè½õîVÀ¯§³Ðèö£¦Qæ}ø~úÛýwW7÷N„‘aC€ÏW¿üLV$ìwWçÙä‰Ææùd{e’ØOL¬óúêîêߎ—àÌDV;og~’ŧŽ“ÑÃ(÷Mn&©‰ü€8áÄ¿ìʾnÖÍî7œ`¦~˜Ã;æL±l¶Ûr×OgI”x—ÏmÙ?5í£L¾ÇrÞ•í—jY2«àˆË¾è7G,®¿íu]-®»b»(®­㥠¯\ÊNwoXü\vgvZ´ÍSW‹º<¹¹`¢y’ûA–~ÕF4¬Ö(«5Œü8Œ&s“îE­4òÉEB?"'"É<ö• ‰ÏSïnOßÀ+—UQ2÷^])£æAhÞßÉ÷SE|v«fJ ž:ýôQhß‚i³Õ•7«ª±(ñÜIMì›ðìI£ÔRòŸÙwט‚ 9ç®0GÐŽÙð¢€ØÈH©¹Ì¬ZgIûùOB?0y ÍhÌòÇbÀõ»m8yÓ¤“#a…ïlĘ…%eŽ<%™û¹I'IúíaÙÎIæ}‚¼ÖÖ”RØÖI.¶&üÈÖe[#ꀢ³(¥Ã…®ÚÁzo -š|Ñ…ýF.ªºê±Ù³"aø{S ÄL‰ÒÆ“UäÆô)Ç5Aì½A >‹ :myh „ Sa{bÉ'w’d±G13OïGp¨«GÀËohE²ºÀòSµ[áŒ`U–ÿ!ßë3Yá=‹@LÈ›„IjTç8–ê\5hÒÄû‰ eø¶ÙŠ3ñÌ© Ýñ‰°”Óïë²çëgYUa±|Tæ윛©:è Q‹Åt¬ŠI#–¡âC9RÍN@>‘·ãíz9ýÇšÂý—A`ÈýH “Q`ýù0E&ót2sÕéÏgŽã˜§(Â踎Å~Ñ9ò„ë"”v¿FÌÜ[ØpÀÄ„µ •° £ê²hÿJ™çÞ»=³î˜$Pd -·rX hŽVÂ|{M'8ŽTú¾•(5œ‘‘‰$PiU¯ÒbZ×—ë¶èÅfzº±@+ÐP¤àÓSœ¢Nñ¨F'ÈÍŠ³œ=Ž<§ï |'Ä_côiJVlG\ŠšõÂÝÙÈI[ê$oÁ­úMÑ«£m*uJ$™‚Ç© 6©zdç ¾ú܃š(.:Íxà±j„øÖv¾÷¢G»¥RSæ¯ù|k™×U×+ox$hKõ³Z¦ÅÎf:ÃýÏ¥€è7Övsï®ØbÑ¢˜qä󙊭à¶Ä?J‡4rì©Q&6ªZ™}>ØѱíÜ=%ÅZh7VëÀ‹ã%tîGd€n*»!oCÍ2{÷<½wýçZ»¿ôâCþ"¿X±,,˜¡¯£ëç™ùj;¢¹ÜÁÆDmâ七ÿl‹MmkèÊ*¨Ñ@^Ëô}yéLYä§Aöõ3 4gŠ„=ÓÜPcÈGz½¦÷ G™P›ÂxŒÏ\Ò¿XnÝ6‡½@‹¶ªòBrèTÊ<`ÖE1–ØÚ–cƒ³j'Ìú²Ývf¬6€è&¤E›O9À°dÁùihS„Æ•î9ç‰Çåç× Œ9˜ÛrÇI3˜sŸÙÉs$òÒ@­(dÛ -zîFjeXì¡7”ÅŠUP€‹4EØ9‡²GÀ¡€å’ÔnÉuúr% ÊÝÌéyVè&qZô€ä‰\Ù¢ùQ_‰­HcÔ A·†n|b¥Ät'hVZYÈÇ…Ö¨ojqïbïU-Z"oÑ9³õÉe\9.y;ÍÛk«õ†It.ºRñÚ<Ÿž—ª”(—EƒŠRM3ä‡î(£‘ãTJ±)Ÿ…¦; ó€ÔV׊,0#Z¾Z¢Äš´Œ«¶‘ÀGUÏüå~.8lc!3ÿôÖ0$êX²ÛJÌ_jÝc‡ªt²s匫|­Ë`ˆ)ÌØ`ŸM¶ÎŒuï]µ}q«"ÂÛûëè_§Eu@õWwxùùVÆ˺r¨=!u«­eÅàÛ7B\ÈÔªc[‰­0VÜ{É÷’L -阙=#m·Ïº)Y±•¡”ëVñ+h¥7F§Ò$?J‡ŒÖÌ’æP¯d…uï}Ê¡+ìýˆ/–Çþe/xÅp_e{ ÝjÚ-ƒQa¯J£Ì÷(Ä£´Çbk/mf5IÌmÜa·Ô^ ×(“DrG¥¯Ø¥“®y%Ä(ë"åÓw¯T•ýrß낧>åa)Ÿ`QK¡ál§,vBËm¹ŒÇ.ÁŠƒ¢_ÙÔ*2Œµ[ÙÖ -ÐY&4x 4g; 8“uŽ¿k6;4àq†…™½ô„pÜ„XÊáèîB­}|Øù…Ù\GH¸ã#Kšè›¾¨µÍçûmÛo8ßÀ†š´‘•¤"@;{†½„-¼×ïäœä“¯•+:‹írm.;ïÎ5ÃÚÿ‰jx9>#%AJéâìkì»sÙ -V$ #î@ -¹Î‚*VÛj ï[Î^rÝð]Ï";§+>Q­ùMžXâT3|d¯ÊsnÓ¹jÁ¿¡ókrmŽ-ö|æÐ]ÏÁY­hiH‹R}]Îo)&â;øg!¿a…uUŒŸ¨·)e(ƒN×h{8ºiÀaFß?~WÀ(’W‚Ó6díáEÄ.pe¹3í†_B‰&Ж;ŽÀ^Oi`àš`c]˜ÕJz’üÜW¹®tÞW« »ÇVÔBÀô‘¼ô~ÏâPRí‹ÞÕýˆôô]/ñɵGLGq(/JDWn©xô­DHl¤³Þ¡â—·ÄŒY{QÔ_¨˜Ðúñø ïªúr¥r.Z1%†~¤•óHiJl:WÑŸÏ÷‰Q&ÎÛÔG‰g%Í„ÜCù–2•1Ð]è&~ì¸ý‡ÿö›Ò=˜Ñô¡,úCËêɢѓ2¡–Hæˆ¦í“ Ã{Ž+ب'TÚ$e‘7¨¹’·a,´)–†_ªÂÉ'ƒ;Í%ˆ‹IZ3³nø7¼Ô˜ÑóVLYòlêפʼnü8AŸEÑÛªŠ)rymï B]ɇ= À&Ñöit٥ƅ÷Õnc­ÿ»5íÂkÞ½âsMô'Šù¿~ÁwOV¯pÑù«$Jýyj¬0°„É_ -lé?•ø?3ñendstream +xÚ­YYã6~ï_áÌáÉŸß3íïóonç U´µ(æ7¿þN– Ò7¡²Y:9Â8T:Ë&Û›ÈYå"+ß››û›t¼x-šð®KVq6U.µçfÑî‚YœSq”Y6ù¤_òU6qaÌ×0Q€rη´¸)›5~GH½:ÀP3Òæ ·h`g²à™ÉÛC d½zäÙ=L­ë¼-ñhù#¯ûÃ÷Ó™I‚ª-/±mË|³Þ_§.9æ»%¶ùÔ¤ ¸L3Óh¹ŒT} ~»x]¢fkâ^\T»Ç‹ª\Ú­x¡­äw]5²õ±ªyW¸cË#sÁwÙðœ®Z·¨}Q +‹]Þâi_QfaßVlcR[] +©D›—3¤§¡P0°ªUæÜ â,SÖr†DÊ)8Wc¸0øךœ' 8èijA¦†gîóíCŽCpÌÜÞý|{÷Ýqý1/‰; ¹¹qì = ‰;Ÿ¦­EYÐT|µk€uÑ’5~‚F€Q”öë T±BÒÁ‰:1ÊÄstøÞé`AÜÊö™éGFZ9— ùäÆK9ã`7×Ï<[=`L-«.ðþ €Jð}h™¨Øា¬}DlžY‰#~àl…¡Š¤^"Æ ˜H€ÔØQ"49[Káqqð?ÐÕ‘DlyØ4‡-·ä…–£!ŠÐ34ž]¶œl´ðf¸^¢¿ˆ ›ï¦ô<-;"!Ås^;–¨ Žò…œË6¡ ‹µØTtùTµƒÕêž½÷Æ+.ÀBθP¡]‚güCÆd³¤¢[Ûvs[¯PÚ)” "‹>V@©óP3a¦bm%vÚúRxéDYí£‘@ ÎëGDÎhÖE-R||ëå®Oœ‘ˆ9Sð¡W®"Ÿ. ²öàÊ1eb•™dlÅ›„ëp­Ú1Æå›j÷žÅ`“¾ŒÉU4s©V TÁš™ÿ ÍÞSôe¹ã©w”jäþº7bì]ƒ;/ÇKê h®Â‹[6ðAËš8hºTQXµpj%NÉë–ü³äPA.Ÿ®°ø†–Õ–uÄ1×3( Ï~ú<ç“ëBÊ/LnÁ„’+†LR8çõ®ØjîFÙeGŸaƒÃÏû)Ù{Æ?OÒw˜³¨ƒLp€«y—¤6:OR;F¬ÜÓ¾8"ãœÙKŸ7HÞA ðà-CAÍ›—¹ñ¸áiâ§Î,ѱJÂW"¦§¹šQ¦•…,d€ýeÀGŸÄ8 zÙ—RÀ ò’Bš«)¹Dé4"…~èÚ¢†"œë(¸Gÿd!„ä·7|URÅð¨h¦Ù_ +÷¹à-ÖX›fŒÎÜ…½”æóŒP¢‰rYa‰Áïræ§Ï°mμ K„º'^”r£Ë5ÞðOäµ×åiÚ§áy>ŒêKW#ݸFJBK~ÃìV܇;9˜¹n&Á]‘/}Q.„¸oçp€ï¤z{FÎÛüK±–p‡¹±s’f5Á”$[ß:ÛÿÀÒ¾otšo†z;V»(NãM‡‘Šà‚ÙP…©Ã`â¥z5áÁÝ ô<õl@~{§<©æúkdý3›fÏX‹€À¥f®‚[QáÜúͺܟ*dàÒ‚ Ï2ÈÓ¼¬†É,Üóâ‘ÝåeË.Â[ +´Þr;^¤#mté/çtOs¤l +ÍŒ•éH@ +p¾ab˜´öÏŒ>?U¸P Êñ®XÔÓEŒPŒ0Ⱦ ÊA3 ëÇ©TÀꥠtEE}EY›F*{EÙÍU³pw× Èÿ†\3€X"?2†€CoæZó|òI¤ ýί¾,X ¾ü®0N³žÕ…dH€3T„ïÞ›rÙcæo¡ á¯f›r»§‹ +ŒWà .ꈲçµ:¢4MŠBðº_œ1$´ùÃF*=#6ÁíŠùâ9­Ø:£®ç\p+JÌ+ùÜ2£\h‡(³‡€¡¡ÂH1p?ß5¾&›Žê°Z3ÁüqÔ€À³^Cpð[¨]Wµø ƒ)¥[0"q@í:öt¯k94¨}£¶j‰ ½‹  @ óóvÄñbsh—ÌÙ5É󯧹Õo®´C׆šyL¿0äü +µ\B¹5oFªâ’˜ë"8PîȃJCè+‹Ñ­öõï™'JaW š.Y%9ÿ±Æ6 GP‡†žšrfLõ‡JGŽ/Dd[&}+P +ÆŸ[…a<—‡-“Æâ@Œ¥1„R1ݬ ÙÐøŽüa[¶m! 8îX.6eá{S\`¾¸w#Û8Öº¥šûÜ‹¦Ä…œúSÙ«à3Ày|!kÐ0ç&8öaâ;~7ó7>öÝó ×î$öt×~#†”&–ãTäÁ¶$’Öv,ú >ÁC `C¹6Yª²Ôþ)Dô¼ffç˜hÁYw'¾ +Š|+ÀN©‘æ`uúîwÀèQßú+vªÒÙ$*ÌØêvËîcI=l”·ßúöÖøð•X˜èOÇ®ñ4Üxê3tÀ¥Òó³ü,›éá-†äªœv]È÷ÜÀøõ$R~Ùy÷N›FïC)Çíq'¥ÜQ¥39 ÆS“@ïÍ(vÎÞ£¨âgº¾³ówÈ|ÓHè=í*ÜvôB0Hõi QS˜¯äõ7?ôÅMž¯ %ùÉ·Ú]k³¬£æóBãYï?õ¿ }¯†Ák.G¸ƒÀ‹“È C­š;Øÿ¯Ã¹ÄÿÏQMendstream endobj -4064 0 obj << +4146 0 obj << /Type /Page -/Contents 4065 0 R -/Resources 4063 0 R +/Contents 4147 0 R +/Resources 4145 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4069 0 R +/Parent 4139 0 R +/Annots [ 4152 0 R ] >> endobj -4066 0 obj << -/D [4064 0 R /XYZ 85.039 786.531 null] +4152 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [103.437 426.968 291.006 438.657] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> >> endobj -222 0 obj << -/D [4064 0 R /XYZ 85.039 659.087 null] +4148 0 obj << +/D [4146 0 R /XYZ 85.039 786.531 null] >> endobj -4067 0 obj << -/D [4064 0 R /XYZ 85.039 636.371 null] +170 0 obj << +/D [4146 0 R /XYZ 85.039 724.712 null] >> endobj -226 0 obj << -/D [4064 0 R /XYZ 85.039 398.984 null] +4149 0 obj << +/D [4146 0 R /XYZ 85.039 692.291 null] >> endobj -4068 0 obj << -/D [4064 0 R /XYZ 85.039 375.662 null] +174 0 obj << +/D [4146 0 R /XYZ 85.039 609.28 null] >> endobj -4063 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R /F15 2876 0 R >> -/XObject << /Im1 3957 0 R >> +4150 0 obj << +/D [4146 0 R /XYZ 85.039 574.737 null] +>> endobj +178 0 obj << +/D [4146 0 R /XYZ 85.039 516.703 null] +>> endobj +4151 0 obj << +/D [4146 0 R /XYZ 85.039 484.282 null] +>> endobj +182 0 obj << +/D [4146 0 R /XYZ 85.039 412.699 null] +>> endobj +4153 0 obj << +/D [4146 0 R /XYZ 85.039 377.953 null] +>> endobj +4145 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4072 0 obj << -/Length 4115 -/Filter /FlateDecode ->> -stream -xÚ¥[ëoÜ6ÿî¿ÂÀp2«’H½îÄy´.ê$»—Ú~wµ¶š]É•´qüßw^¤(­´îá â’C3¿yOøžf±¨ü4Í?VáéjwœÞAË·'¡Pœ ɹCsqsòÍÛDŸ†ŸùéÍÆŽ“~œ'§7럽Wß½üpóæãÙ¹RÊ‹ý³ó4ͼ×ïÏBïêåå;®~uvzXõîKÏ¢Ì{ÿÃÙ¯7ߟ¼¹±Sp&*…øýäç_ƒÓ5Löû“ÀWyvúåÀóütw¢cåÇZÉïíÉõÉ¿íXܦO¹×Üzc•ùq¦Æ΂Ã0òU¦qì':¥÷÷°’Rµ¼¾¨hËMÙRm ¿VX(»Ø®½µéÐ}î›îS ÙšË]_´=wÔ±ÆÚ›‡¸sâÒyˆKÌiJW×Ð;L¼OU½n‰Wüô¿ßa]³+ùWy絛€CÃS¦úJz½{ƒ…Ø+n·Ò¥oð›z¿™.ط溂IÖÍ®¨d¤¢^sÛºA^¥ \7=W?Pm cìª×Ë9\VÜcØŠŽ -)³ÞpÙò‚-M ƼkjZ¾lÜø09\”< ôÆÃÓQHCX‹û_¯ð$î+<¬;l¼Š÷ѱ@'Þ Ý/A¨ï°s[ôN‡zá`]ßîpPSè˜h [Ú mÇ3yDFM òå*J^µŽ<…PÖ~Ž´Ÿ¹¥˜ÙÒ˜Ö{ßà˜"‚,ŸpÐzM£D©÷Øquþj¾¹zô«mÅRÙ‘G†eË[·“>2"ÍNâïS7ê”dÚÏá;§˜†æÜ!šQÌ2±#áâBÿ€ŸÒ€%ÇÙ1É3ÜT`¸ÝÐÉ«h´5Z…ÞmÛksÌE×wLöKtd@Ò›¾—¤Š t[$2R±^²t¢Ñأ٘!T°®3âz[¤‘*ó•ÞU Óet’`¤ïÊþ‡†tHÚc<ûÆÜóz»jïÆ -#|Ûo'Ûs ŒÅº ÀââÒ„kn¬‹´¾~Ofƒ•7tŽ@ÊÏ’ æ‹óüçŒzg¾†#âö¿„«™1ÂÌ’Í!DègA*E?ÌœÔIiÔ#=Ý° \Ìå{XJ”*o[ (<á´-¡8¨eÌ¥š%•¤m7 -Þ£:ØulEðGlË1(FX°gkÌ÷®;¡®¦+¶^_h’h¤¢,ñï+;gŽ O `¶›3#Tùw,u´(‰[3®@ÁÅ/ ‚ƒb‰´å9‰]%Ù/Ã?t©j3ÆÀyÓ!eë-+>[×w‰r÷ôëšIÔŒ`Šë7ÿ~Í¡`¨ÄŒã/Bœ -ü4Lž¸èÄ ²‹!î;qG¹ˆs¸‘À*, ,6ÁqÖBÔÔ~VˆzJ§|„Dv&ç?%ÌY£“¤séFR¡cÍ5·Rš -iº¾‚¤{<\ÇÔ#>üÄ0‡ÌÄÑrÄ7ž¸q"T‡óé2"(R«<‚®@÷ê¯LÑÝí 8á}gü²‰2ü5ºÄýà'Зåð. Ógäg :"?B„‹V‹òsŒ‘Ÿ£ÜŒü8ÜX~Â|ì=„(;`>HnàÇÚú/ì&æìP戭Ÿ>ƒoü£`ƒ±La–é÷½Å»%ˆü%c•E ißV†V Ofa¦çbÕ!Ì À5ó¾³àþ7‘”­ƒe«¶Â˜ _<Ý8… #ÌŸ®C´|º†gª—N÷(;9ÝãÜät]nì…zì…J Kƒ°×%{½ìòb/ò…ðK²ÀåÁýÀÞ9Ï¢•v4ÙÖ²hå¬0p#¦**—ÞÌÌ1SÈ%™Wmä‹f3ÉÉ·Á/¹º{CeÉÙÍ«ùÇ-™^²»Á`oÉ$3ÙÑfÄrÍ-f‘X.¿2í{Cº6ŒÈË ¢Á3œ³ §#ò^nz0§ Æ»2áÇT¾§îþºêϲã¶MÛì&¦Ýq#Q!ËeUP±Ÿ¥á3ª0Q!ÂåÅ‹ªpŒQ…£ÜŒ*8ÜèÒq, ÒÐXÇT½’¬Ži þÀ^€û¶ì/ë Ã!6YrÁN{hi4q¡ðT3C²¼•_Ä/å®shÈÖ¤¥iUc}8¨ “¤³9´MSRN^ð|ÖÜÀóÈÄX“Étû‘Âbr) :¸[»fåš®«!µÂƒ «ÏL˜ä:¿DÒó\ƒÜx®P1{ A6q½c¸LÊj9Ç…UÃ’ÀI -¨ØQVÇ8Ù\ƒ:Õ“a7Iè%dʬ ºGs¸>{N©c7Þв\fjãÐ?ÿI 9/Oº\ýˆþË ÿBj-nÑà™—ŽÏŽs¦_cI’”XÕ–«¾iŸÎ2½ìGë,ô“4>Ñ2<"Ü d Ž²x8ÎMàÁåÆð¤cx€ßc4™ó¡Q‡ËS‘H0jÜIãØpb çã’äPýJéÍ2‘$r‚Ȫ0ÂÿìÊ(h$ÞK´¾qLÉ.ôb°îûVÒ\ØÐà˜è®i8rŠ‘¡†èV(ôXè•w Ú¬MÚ7m¹ž ~#‡ÓÒ&yâ?VõCÛl0Óxþ&0TžÛð—öärÃÛ!ÙPØ2†pØ5ÊžD¹ös•Ž}®VÐbŽnøÄ ÑÅ¡T¥!¬p»$y_®—¡#J}fÏ@Ç@t:„çœ.BÇ1v:Žr3Ðápcèˆ&žEM # -ÉEô(6"Eþ*»f96¸Š-îH4…hèbH48ÞX?¤‘À -5†ay<¿¨¦¾ËöVdk“ÚÞ—@"Ä|ÙÁNœ10ý‰Åg÷1{‚2k¾¸ÙÞò«º ”ŠÃœÅky2”½’ô\KÿÖd«°IÞ6E&•Âùnb\õ6ñÆ'²&I`ÊCP&#™|ÞaÐ1ÊóPB‘¯g¯šGa»ÏC²#ÜðÜ·OÿÃ<ÅJ$3É[I@åÇ ȽåVÆú`YÎÏükM‰Q.Óaá—ƒBJuÖþŠ-¿ÜjK~æb^@©˜nYf"»<…)17òß½üøfîB>‚ùš´g‘}Ù·,a°Ö!Ý8a–j_ÛÄÆèʈYæGö -Â×ÌÑpfásÏê´Ÿ@Gw¿ÝÙ[2sªNNÄ ·"Øü› ó{ç¹—­Å|ö© -" îßRË%ç'ÓV†v+3”û)Of—)‰Cg¬æËU¿kL.(СU6y|¾Ó.€˜Ÿø-¶,3ükµm˜5+ø›Õp=Æ/G¬¿—QÖå-–É€/AÒHa5!À^T8Sp §ñ»åg‹ZUš7Œâqð3~µ€}èz›%‡ß·íظõüÈŽ‡©z£3¡ñ=0Ar×6d8€úq”‚ŠÆI©B m"l*d¤‚?¯_ù\ÿé¾’°Bx@é®`e:×èì/©;Ÿ>›K_«[Á_-.ŒVzö9¥ü™>¢¦Îis-™–§neoÉÉ-Ôq.ïïŒÛ%¯[^ÏØOûúÔÆÂ6ÆfÅ„‚ã re\º¾ªW=«ia ¯Qñr†Ÿæsß×s/Féy g•t4XÏ@¬g0À5·?wòªLl“£ëP -AïÌRŠ]ãϬý¿”Ç̽ÖC¯Ùo×\ÕJ†V,3|Ë)3 ±µ¨&Va”€_ë~Ø'Ú t zí‡AL×÷è/<„ ™úÓogƈ? ’c•‡(î[@~0ƒOŒaâäŠ^Q¢%7‰™PÒ‡a0ÄÍa8yCrû±æ;@ó[æ²5¡¼JÞV HhIœþnY.XeûÒLC - ‡!6 ºá꜊pò˜½¼(ñ7×­B{[qϤÇs*ŠDvâ½ÆgX\Ô±}Q‚å×W>—Þ¢Ý'5£Ð–Sj„_ê6õ ¬’ùšã*™'žæ£Áë‹Gñ䦙QòÀiUÃ,­ TÔ²Ö6T_€V2 ©Ø×óPp*çñý5… §4ø¬ÙÂé8Jý$Õf2Ó ›¿º8œñEendstream +4157 0 obj << +/Length 2546 +/Filter /FlateDecode +>> +stream +xÚ…Y[sÛ¶~ϯPŸJÍÄ I$Õ>œ9IšÖ§mœ™(ã3Óö¦(‰5Iè”]ÿû³7ÔÕã—ÅîâÃîb± +gü…³LûZÌÒ,ñµ +gyý&˜m`æç7¡PÄZù:Ž¡}fòÆÍÞ$‘ÄéY‘q“F±g1Ò¼_¾y÷) +fQà'‰š-×N‘ ¢l¶\ýái~£uà}´µ)ç¡×ÌoT’zlÓ·¶šÿµüÏ›Ÿ–ƒ˜#×™Ð"I4 ,¦Š(ík’"Ëm¢3åýÔu GÑäÔ=»æñß +Ó6e³ù•z÷)Ô~Áì&Jý`‘9V-,Ž©g\£6Í<ʼî=oA„’Ý:­5ù¡¾¤CÇCýVhÚ‚V%A _á¤âÔÛ‰¾hÑAÞË”Z{¼!,z\Ø”½ M’ì¦ÌÔÉ1]W²|ƒ03 +¸y8îåÖvBþ¼&í<äm˜ª‚æËhžQ6Ÿu"o[T¨_²C« V„ >(wš6«§ruÅT¸¡ÉRÒÙÖÂbmê²Â%¦ž%YЗÍm®­MGÌc=°ÌvLoª¶0«é BOs @••aËñÝžÉÞ× µ‡k‹–ÛÈ¿¸‡NìbïóÝ’gèhðË–ÿX1º*Dû@Kì¸Óñ&Ym䀛"{f°eEÉU6<ôgÆ­ƒNÈÈ8VîÛŽÌ<þ/Ê™Fä¦ë ç;§GÝÙÚY{šz¦+s‡-ÕÞï é+ÏÝ“®ÈçÉsÅÒcgŠÇa0[:*ÛscGgÛ—ù¾¢V…fž&ÞÚ¶<÷' +8B6+jpp²d‹°l‡–­`PöÛX{ÎÛ‰SSLÂï}逴¨5†%h¯qȺ e†Ý…ÿÁvU>’¹Ó€)Œç *¹½)žt윇Þp¸%œ‘s7§F¹ÙT…¨Å6Ž«kã‚tÆx€Bâ×ÊÑH¶9Ì*a·E¯‚ ã<<÷ÊQÄ@»œCô±Ln𣽠8VÏ#l— _xR@±; +ë0°í 'Æà‹ê¾ÅÐÏg‰ìNîXÙ$q¶ëÁþÌDsà£H£”B¥ñ³Â½á6\1tDx¥»xÞòÞ9|DÐqô×Rxp›27O‘ZÆ ®é˜ªøgbyO‡ˆü-Ow¶rH`×"¡ªºÃ¸Æ÷ø§9 Ô¢*˜’PL*¸ýÕÔÈëÁp6Z¹kX% w×óŒmÆE¹‘ŒW ]Ëä0\ñ‰CW[ËÜáÑG[×bPDñŠ &œwûbV±òn±½f./´nÆà)›ÁœˆãÚ3Ÿ%^7˜#‘"0Ì÷;4Ö–nJƒ"0AÂÑü0ÿóþ–ßab±Áæ„èK ÷Ð’¼&q`eùKg²wiê³9ñ™D<ØÉ ðZ"é­îŽÕ0è2Á~[ž‹“¿Ü¡üûåøq¸à- aÇQà­ÆÌgÙ]â0ƒ4 Î 0Ý*\ú„K\´Ä¶ƒÛµu—ò‘û¿Fä©oö̤cjÔÇå6¦ÄïÁç‘ìªåœøúŽßCUÔ$ë‡ izD~¤¢«iú„†Òô8œ¤Õaúq F(âfz,/ ?ÓÙUŽæDâA"†‘¯Âè@â{ÃMÎÑb‰_wä5_p8:‰ì->ÚÏypTªýPÅWÁ™Ð\ǽÎ58ÇÏ‚3•ø¹èßãÎoï¾2©%ÄJno+JÕ® gðM®#1Ò\ABˆ^EâŠÀ‰#‰ç‘˜Hü÷žˆî\òl¹þ®û9YÊ4๼P×Ùš+hÑ«h\8¢q$ñ<‰ßºé%OÏ+¹n)wß 4¢óðD ågð½Ï„æ2<Žè5x® à9–xž©Ä£˜ò©¬Š!y +½ ZËážÊ{ÛJÎó…2™r{fÆyMJ‡±¨PæUß>ßþ÷Ýo% Ôÿ\B9IüôzlI®`Ì4¯B|YÚˆð¡¸óâ¾MzÃ3­pÈBºÑá»uï2Œ[îáãÇé1N“ÅRº7)KÈ# F+¹(Ør1LÑî^z$ Ô‘ïSÙ’op6,çŠ×1¦©QªÀ1?ÈØå>Rš#ElŒÕèìö2já(Ôøªá| Ç\~ed†-V +L.¹Ž!NH'Y J8zúˆÈÎ>"6LΑ¡¨åL2Eu¶æzWêH&] ¡jF—VŸ&d”BÂCV¬ÞmÃk“÷˜hF©B.€(I„(¹Å Œ§N’H$Ç †éz‘ÓCµaáíwü5"ÓY%`GV…rOðâqyVažØ˜Á¦ÿ·§ì¢ù”k”ÍiºæòvªjÄ1'n…{`›ƒ§gxï]Q%ÖòHë¿ŸE»M!Svß2;ª²t2Ê›*ª¡Äˆk¨´YÅ5„mÇsÈÆñ[3;© +êéOª­FWü> endobj -4073 0 obj << -/D [4071 0 R /XYZ 85.039 786.531 null] +4158 0 obj << +/D [4156 0 R /XYZ 85.039 786.531 null] >> endobj -4074 0 obj << -/D [4071 0 R /XYZ 85.039 695.734 null] +186 0 obj << +/D [4156 0 R /XYZ 85.039 766.606 null] >> endobj -4075 0 obj << -/D [4071 0 R /XYZ 85.039 641.538 null] +3021 0 obj << +/D [4156 0 R /XYZ 85.039 662.656 null] >> endobj -4076 0 obj << -/D [4071 0 R /XYZ 85.039 614.439 null] +4155 0 obj << +/Font << /F20 2961 0 R /F62 4047 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -4077 0 obj << -/D [4071 0 R /XYZ 85.039 587.947 null] +4161 0 obj << +/Length 3254 +/Filter /FlateDecode +>> +stream +xÚ­ksÛ6ò»…¾51|€¯~¹q­¦çNœäber3m?Ð%ñB‘ +IÙuýí $QöÍõ¦Ó\,€Å¾waâÁþ$\/Ì&I»QèO–»+o²™Ÿ¯|Á˜ ÊÌÂùqqõö]O|Ïͼl²X›}2ϲx²XýêÜüãúÓâ§ÏÓY†NäNgI’:óSß¹»¾ýÀà›éÌwôa£ÏÓ u>¾Ÿþ¾øå꧅!Á"ÒC$àûÕ¯¿{“ûË•ç†Y:y‚±çúY6Ù]©(t#ÊwuuõO³Ï© ¯»¯Æ˜ù™›ÑË<‰c7öbÓf•ªØæI¹±Jˆ'‘ë#"•9說çyh ¼yüˆc'¯W8Hœ‹ºøÍóÎõÝ%†ÈÎ/R8à°ÔÒ©ù‰›(–Ú×mÞ Qê”HS”8=Ò°-ø­xfèÃ4ò!R4kþ½y–Ëš€¾#ó·Ú /ku¢--®éŸÿŽ7}ûÎ,"½É,H\$‰ôÝâÂ4qrþyš‰ÓàêÕ^{tÁH¹qœÂ¸ô¾¬7ÜCy Œ75>Ö#g&«"_Ö½ADO¡#ï裡³4^k`·mÚà ]Ðg1MC§á©^:¯QµŸ§©ÒÛõ[b0 ðo +Ø à1›ê™6m^V<$Ã/òøž‡_K׫x"UÕŽù>ˆßG]fΡ‰©4BR€[<~˜o)¬mj*§.zÚË°ö[‰K6p·4˼þýGFÍ«JŸKû:Òf\$4aòçbNUñĪèð/±© ¡«fN æ0%@^ûô ãT͆ ñVƒ‘Ópùà1@oÓõy_6¤€(Öw¦€T> åÈ®`}…eÂ(¾-dm÷©ÁºJåMB±0ô)ý¶(eÃ,šÈ—ËæÀ79£§bó"¯‘Õ¥ì.´¾|ô93¶¹q9ø |Ûê%×ìÛ2ïåV€Ñ·‡®g$vVm +,ì¶xÖžçž´áPô[ÙÀ¦­ÖsZÂÏr|+Èè ŒJô`³pk_Ø=Ž,*QŸpd$E—{ƒ?¿<êJè‹ +á !¥Ñ`&ç–ÀpmB4^.‘ÖâŽa-5@k—…5ƒ¤9Œà½Á¹ÔAWZé{uÌŽŽB µ%“jÛ™ï‹9¨DõôÞåYfZ¹UWö=[´LéGÄ2 &m…P½5B,€WÑ£=·]Sç•S§–F~Q©ÈYlEºa¨ä7$ †Ïµ>‚"^´`0Ù`¡Bn6ov¬Ig#Ò„½,MìÛ×4D"ɨ©4¿\}cŠ,)]y»ÊغĶŽHF s4ŽGÆ b5®Êø8@Ë*¼JfP×µß6€@.ZUx}ŽVŞݬޞîsvMòùi~ãòèš÷›™Ý¹°±…%yáP±;Qà›Ð‡ ~? 9¶4„0cfÄ\’Ù XËW»´’’𠊽Æ’Û9jŽËÀA´™í aÆXŒ7DúaÏ_ÝE +VúH6¢´u„l/š²¨•ƒÎ&–Ç‚qp ’·s£ÙVñæGøi5mâN%4âÜá)é¾ÐÎ$ ë>3ß4M`±.Ø‚%øþ=ȦäÞNèÏéºy€Aî¹'øb„p´ !àøg#üâ£îBúŠôiƒÅïKñ|XÈã½æ.ÒtâØ\±–³p`|=¢lyá,™¢·g Òõ‰·ÆùI ZðxoDß© +^îWܼ·oINßC$ã=Wñ]OeYÈ(Ö˜¨nE€··;2o€Ì‰E©l;³ö%J}»t†¸qM”JÄ!òÑî&<(/GÅ"_V5†L…z¹æßœóQÞÝóïײ^éàó$ʉð¹Ä+TYb”†ÒA<õ™'Šú±lIÝ9+©{†ït,` f öçê|rd…ïGÿåýì1¤ÁßÁÿ`…c»…±±÷5æx² å›´:×Gâ×Òx2X¸¦FI ¸'æ7»Wîë ã +š —â|´Ü3%‡&cz4¾· 0-(ñ¤Ì CRçßR-d":L67<Õë“ +F°•È +é0C^l'h=Ÿ9’ÇsBYmSú¨ÎfPò:·=Ï°£¥ÈXÚLÅ9ÙÑç ÁUb(ÅÈ\Ž;a-.lm•CH®Ý8FW­µëly?<î,âZ\Á„‚÷Ì©Bz‚„ãëR“PU¤' '†‰î8èãI²5jX’ž%y— +"çSUä µÅ ÜŠT4z86»RÉÈžKЛúÔ…©\¯ +&aº‰OÝCžj7â¦>õÞ{f¡Ÿ»¦Ó=‘i¶®Q $ DöʈU­ù^ö '× À±'iÂbEŒ¶æ4ÎÌB:¿dÄnˆ—$¤-ZÁñ‡”Dd³2¿#Í=‹š*‹\_Å+@ý…p‡1Õ÷€¿¦“ú¿Çà£Ø©ÒtàHtÞ­;r3?j6]<6ºÅþX„ÐC½4YQI Æ`ï síÅBì{=ñ€ò-,9·Ã¤)¶f!ŽÒw®[Y¸­„(ä+ýd ‡î¯|;"{¾«¼ÐlŨŸœžçCXO£ôÅ5ÎÙ‰G÷ýÀ Õö‰_IÓL»‘xña¡xÀ¶cjsÛ)^jb qðrÛ¹Ìô[^:аåôÄQ¶Ø'^¯Vì-¸­¢"«i©¶Vµç<0Šh_¬"WQ_7¯óM!ßÜ`†à5·›{:mp· î!ÞRšÌ„ûÀ]žY5õpÅ3ê&)ŸyÏ¿_é§yÙYxZbŽ'}Jì6:²7nY<àDñ4¿Îêw@€¨¾•½F–¶(NKÅe÷L"¾l•?ˆ…áäºïŒw¥Žf->4ô6úÌÒ«){Ê|.8Ñš±fšÖIã~Ït¶£¥Ÿí¨;qÔ¡²&ïÊ%ÓÄSwT7ƒX©¡lØgžÀHFÜ3¬¤½Æ’‡¥GV(ÛðRø™…/[˜AyÁÀçUûº|Ú`^ÇÇ[×pÜ­U²’n¯G5²ÂêyO}Rß—l[Æ*pHà‡ŠÒ¨}¥M‚Ä(&vÒ áiiR凡#:”ªlu4lji ýa ¥V|Éð™l¶Šß°”¥0hÀygJÀÓw‹mAýÄÔ3MP?ðuáVØHI2¨€V<ÐÆH6Sôl-©`ÍßïçHìõ'þZQç?`ö ™g› Žf8ò‚eS›Î-::„±€x"«• +@j¥&g«ÙÀ­3OC2–E ®Pq÷¡C§#Ïг¡öÂjH/=n±ÃÔ’r™÷ÅJ¹>¢ò@zÔØluS£“†Ôw—ŒÌ#7 _¶2 ç²™i¤×ì쥡ž8jiö‰·»}UHAMzNŠ9ëÔßìðãKMO¼\–¡VOŒ¸Qª/R U„SÂGý`™@i}VÒAÊ+Ù¼d‚Š¶ÖïOye‹´Ê‡=?LQƒ 5a¬B¾•W­¼êä*øÕì‡ü^Ü2>%ä™Ë¼C ̸fþ¦HëF„ʘéñY£F:œu}‡×LØ›Yaˆ» ð™ž`Ãd´Ï†©NØSë¹%úà,2N[ÔB`éRö¥\%§öã~~ÂǦ~¶15¡ÁæÔr6¢‘C!¤ ýþþ8¿á&AAƒ¼—CMfgzW¹éc ~&‘×û¼ÖÁP’<ëÑ ö]2+Ñ©ˆhùáÿÞDöÈO|²ÒZn:%)=É]*#WûnøŸ¹ó—þÌÉh±JÝ, ÆU+Ã¥‰Aq¨3-ŽÂÔÒp„âÿÒÝÕendstream +endobj +4160 0 obj << +/Type /Page +/Contents 4161 0 R +/Resources 4159 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4139 0 R +/Annots [ 4164 0 R 4165 0 R ] >> endobj -4078 0 obj << -/D [4071 0 R /XYZ 85.039 547.299 null] +4164 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [449.546 389.988 482.144 402.89] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> >> endobj -4079 0 obj << -/D [4071 0 R /XYZ 85.039 493.102 null] +4165 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [128.678 377.045 273.702 388.734] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> >> endobj -4080 0 obj << -/D [4071 0 R /XYZ 85.039 438.906 null] +4162 0 obj << +/D [4160 0 R /XYZ 85.039 786.531 null] >> endobj -230 0 obj << -/D [4071 0 R /XYZ 85.039 251.478 null] +190 0 obj << +/D [4160 0 R /XYZ 85.039 766.606 null] >> endobj -4081 0 obj << -/D [4071 0 R /XYZ 85.039 230.887 null] +4163 0 obj << +/D [4160 0 R /XYZ 85.039 744.844 null] >> endobj -4070 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F11 2898 0 R /F14 2895 0 R /F35 2880 0 R /F20 2865 0 R >> +4159 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F58 3360 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4084 0 obj << -/Length 3362 -/Filter /FlateDecode ->> -stream -xÚ¥ZësÛÆÿ®¿‚qÓØ1a¼é¤KtRebÙØÉt’|8‰´¢ÿ¾û:à ‚ò‡Ú3æ=öîvïöñÛ…Ý…ÝEÚŽŸ.â$²Cß]dû g±…™ï/\¡X ÉÊ ¹Ú\¼ù. -®c§NºØ< û¤Ž¦Ñb“ÿb]ÿëíÇÍ»Ÿ–+ß÷­Ð^®â8±Ö–®õþíÍ-_/W®…C·lý´ôëÃËß6?\¼Û ,Lº¾ üqñËoÎ"f¸pl?MÐvl7Mû‹ ôí0ð¥_]Ü]ü{؋炯š“7ô;LüSÝÐØõ|ÛóÜE†vÄ$ñmƒü?.W^Z÷*[z±õ {Õ7<Úï -n”]‡Av‰¬æI3oj˜øÕqƒ-R´%v·¼RñÏÚãi÷Ò]_Ër.£ŠÉª=míØÊe¦žZͬR5wºi³c ceg=áÃ,Vr +o2%É¿]®'¶Ž¼WÀ{GQdÝ<ðŒâƒiìîš®çVÙáobeMR£´Ç¶Èye¶G*…×!|Ó¶ï¡ÅsÂÂgÓ³>/ÃÈRU™«žŸ*püQN"žkžƒëê˦æáVýqÔ­®ï^äçðMÓ˜P—Ðïy÷’Ÿ›Š'T&süB=Óû6{aª÷Æö¬‚8\ÖšªžVVú.ò#›ô¬ÌðOÓ‚ûN - -:&í™!.:!Ì™5O?,syüSÍ&ÒázG´±Õ:–º݃}Ž|84žç÷Ž› ÚúœÌÐ2¤C-³M©C:Mÿ -Wâ&dxø«· v¹§£ð¹|9ŠtéEñ ‰ÃMÇ·ñ@£ø'oöŠ” ¦´]g=ŠÜTUÑ¢™¤Éè9p‘^·©ÏAÝkäô]QѪ¾˜yJ\ìép²Â57´$— -ÝѶYíȶ¥õÃ`¼K Ô -°méQ¼#=|«øŽzä’ÎAÚ#š4öø) î°BÈ Úýîd¶¦ð8| d§N…û™ü`>êPSäÀßA`ð:¨§;”M €FUÕ*âÎNÉz%Ëñ†Çf õ Âù5¤côz\4î!C| hÒ§Ý~Øp yƒÎNá¹l<8“0±Öbè|ÎCBð´dK¢NÞðoÝôÆlÑù@d]áUÖ_‘3ÞÿÚtÚDºÅHôÝšö]±qúSÞ 3èrÓøû°$ï0>Sb¼r<úBZZ þVáÅ?ñðýÒKu;×Âl]öÈl#ÛíF.NÂ{Œk GÞR‡ Ùý}"‹R'©õ@ûRz¨˜=¢ìƒ£ë÷WÜxà°š:è¸1¸;hSŒÎ¹=XÿØÉ4úi5¶ ÉoùgD/ä!cÏÚìtXtñ²Žá±–¾’m¸†ˆ\\©ªŠÔáTÌîx8„MÛë§ÈYïµÇ,¸K^ GßËšcŸªa’Ønò"œI\z0Ø~¸t=Ûw½EÃo”·3É÷¤`nû½¡·Û4l߉“«s~׶ÍÒ§`)¾gŽO9`†Q‡, qü—¥ˆ\;ŒÂ‰®¢Áb±¹†®E~<ÿ¸[U³gŠœeøbǼ˜8èKûúRH–„›ŒY¼•íæ`Ÿ"Ê™ƒü‚X#Í ô×by±íx>‰õM­K ¹ˆCä%‘±y‰kôÙ—h!"ƒëd9èÒQj7µ²Vtq$’ÇBíÕ`¡’©bĈO q»ã”Õ£qz¿A¤Uɺñw¤ à¹òhu‘>€Øf²œGSk<ÿãÂÿÏÄŽnÖ_qâ…¦øE'nÐœMÙ‘.±É›Æ¦m!©o‚ÁÐ+äñ¿ËÔe§¹"ÉÏÓØ…‚BJ”5H†3mIÐYsF³¬md†þyÅÛ@£x(  ];ðÇM¯¸h)@⬌Nbˆ_”q¤9ÝÔ±ñÂÕ*ŽPÂK¬â¸®áà€)œeRx8’v?1=:k„úH¯¨æŒÃ¤‹[|[•_É`œâjBu.\Q¤Âz•|˜è(&á<}|KÜ1XBû Q"kD }7­;"lÈ"©­þªà¥Ñ¤ˆTøøTOßsŸ^÷¡—ÇFÕlyj ?;þ>ö×Lû¯±PÃ×ÀdÌ°Íú*_# ¢Mw¬úIQY¦:L¢©è-Ùn¾/ëR[9¢z½Ïã¤øIy°Ó²Á¡œ ¦ÇR®y¥È6Ÿ—FÆøÙXT”ñÇZY•‚Ÿyh¬RCóf-fHü7­YŒ$·6«þRËlåÑEp»ÇîǪW÷ª“5šg~„¶F‘ã\Ä!AnøàäéàÒÝW‘¸Ñ€NP&!?røŒûX|lž^ -ŽêKÑÄ‚iOÞÒ3>ÑnÚºaœcáUªè¼iÚÓ:Êð>Apò ×ügU¤€ãä-ßûÕ͇;“JŠü6a.~´¡4B7ï}ÄÁP-@.šºŒø•ªq€47mÚVJ2alq ~_é‹ÚÏ}°ëŒbA -pqª|“e }^Ù–µªž}æƒöi/4Èâh+:tŠ<Ííf –‘4U9¾.'8õÐÊŠ³ÛÌy®Iƒµ3C#èÁ[Â^çÆ÷-Ò<$_KI~¸}èŒßVÚ +rÚM¤^”Óª o¼×†s½_hZNM8:Ue1\ žC¹nUöeÑ}¡~w–×ÁÕJ*ßóxåÌ[á-ݬg¾öe’Ð¥sùÅôV>#ýs‰ áY˜ƒTåÒ¦ã¹ìbðTX OYضiú¿<Ë)¶E_5™ªº2çË?®oß¾wy.aíÀ÷ç?LÈÅþ_ÿh¬%v -ùÑ,ªÁ -šnîs†õÿ:åøÕµ ¨endstream +4168 0 obj << +/Length 3148 +/Filter /FlateDecode +>> +stream +xÚ¥ÙrÛ8òÝ_¡·¡ªF €×¾ùÈn2'ÞØ[™ª™y $Êæ†=$Ç?}¤DJ©­­T"h4º}#á,€?á,ü@g³$ýH‡³Õö"˜=ÂÊ¿.BXÈbsõpñæŸQ< ? ²ÙÃÆáÉ?ÊâÙÃúwïúÝåÝÃÛÏó…ÖÚ‹üù"IRïæÓ<ôn/ßäéëù"ôpêãŽ>ÏUê}ú0ÿóá—‹·Ž„‘¡ÖHÀ_¿ÿÌÖ@ì/¯³töãÀ³l¶½0‘ö#£å»º¸¿ø·ÃÅkfÆ»¦øtêG©3F†ÃPù:T³$ŠüØ$ÄqÙ"WÆ»†ÊUS·ÈS½¯n±ÌÛ?×ÌxÝðo‹4ÿ ƒª\å]Á8òήêýn®2¯ãÉ5å]Î[»š'¿ài;\ªç*ñ^Ú¹þ©õOIR‹&;Ý= qoÂ!÷Aè›@;DÈýA˜Ÿ±ŸFéÙ-ÌèÄiyN¼\uå•£ìÓÀËùóK¹¬kT¨YRAðêM½Í€Æ¤‚5K¹©«ªhxþ +J¿½ÒÐûÕÞS³œ/@ÊÝ®N2/ß­yRó Ï+xá¦lŠUW7¯€)d¯¼GD;”H`jÇÐ3á®4@wn”Aý¡ßM¾ê~†¡I¼û|‹Ë|¡q-b«z{Ï€O9.ZJp¹­·xbÁë—¤Y=­8G´Òtù*hQ§h+I ¯k¦ ¡êŠçòeY•¨ä¨~¯<×=‘ªyŒzÉ ®Á/hñ“éP-¡8&±wR½ò†â;J (oðL†gšò +Ç”õ&Ѿ +c ‚4æ#Âß0Ü~Z%`Æ f©'2,}+¾d”•'Ä5$à)G{êsÙV +Ñ’r½%\VŒk³Gl¢Ì +,,‹õz´ûgѦ³bY‹vØï¼C4ÍäÍwåVæ×D6òÈ3IJ¬é—![@…ã +\TÃ*MŸå¦ßH̽Â7 *4ž$L¼wì˜DßBÑÍF´y`7c‹Å´œ‘-¨¢„¯~‰¹Z t:ðTìxé¿È!9àŽ'î1ð\1ØBÐt? ¢¼b_Í_nœË»yj¼ŸyêWwùKѾºÅ¥X{7ï®ï ¹ÔVš¸…fP—›Õ$Á:GŽùEI¿”°\<ïzÆcˢˉ}˜&ÄßQ ö$Â)D½#º4;­•œFNP^ž/Z–ø*%Ó¤ÄFž3L½ì;þ&Þþ¼ÃPf~»c€w¤Ù8³ªJ1KÁ‘7ÃìêŽ]³ï±žnQQ¬‡•Ä€çü³¶¾Æ +£0pJ’· هػŠØq¡`ËÝØ+Ñ}‘V¥‘5æg'`ÄŽq K¼¹X„Ü)ð‹ÞPƒÂ0M©æ+AFKÄŒcTÄ’˜7 r+Gµ½V¯î +ú~™Z@ò•çQ{D>¡'a¦«ú‘¥’’7kÝŠÝå ÄqW»M@Ü%Äu]4¢i’‹@,Û4ðƒÓ7Ã[Þ C°úÊ_ÌK¢à)w“°Ç‘ˆ¡œÄÂcrÄ2/–'”жˆ‹IÁKðþ$<% +ž6€:Ñ€1ï|_‰F_I„Y?ÉwxsÝ +С‚Äs8‹U×Õšù@ÌÝæ;þüÈÒ–ËDZ¿ +ʃ‡ø%¾–EkQSp‚E¶*˜ú8&™ƒA˜‹Å…d^à5Úr·²)(alH?¿»`›‹n`j9à>f@ÜòÈ!X©Yx¾¥¾ÿmìLÐ*Sd”œåàÿÿ¼ª8ãÂÕ¿ö¥\ ÍRJ2 •…”y(I‡`™ ‰ðω+æüÓZõ%äfpF½®[:KÖj®K«á«}Ë7»f„Ûº’1Ø G“šwT d‰ŸÄÉ,RÝ+…©?¯43|T +¼@ …#ŒÎ»‹ž®PÈ«/žçdÿ¸È]vù²¼K¶ÐôNèXç{O"ДÂÈû\l€î#1IäÇZÍLúqý@á-ôb>Öžcœ¤ò5S ±P&÷<“bijÕè¡ã"q@’³e>ŸÈ—aKÅÇ’ˆ#ɶ#Ó2ßÄé þú¡Š¦MC`  Ó8ÂĦ¾JrbžŒäE2j€h^dâÏé¹°º´ òHfµ¯H¡Ÿ+™Üû.½å}”58üe+é’u98¦†ÀeÏï +±he|£²»VÒMLm¶˜¯úDÞê3΃þåKÉ’$5+«-Ö’®rÁîøçÔuoS¯TO8k¨vàZ’™‰Œ%ñ”×B/àãû=Æyà¯S믒q‹0p9)ã½GN6” IÚâ4_%©Ÿ¢â ëÌC)Ž:ÔÚ7à‡!êûJ¦Y³M4²Ž09_?ѧƒÛÒôlŸnC‡)X5¾6ñ -«3í‡ 7òæµ&ó®¸`¢f%y㘕 ü´kÁÜu½㧊õ™ý920c™X<"ó“4 З&%Гáø•r.f±‡ ¹¼Þ/9Ob(WipùƉÎ3)§wCyc{/”NãèfØî +ãq»ë Ö´Ζ=ZN_‘ê\B#£t Yù¦ýÜÂh»‰¸·å~šmc”– Ø·Pqæí(òì9à(í]UÝÐy%ë¹àÅÓä;Ž˜ŒA5åü³ävã‚™”ûÊrßÜâ ƒ×þµ*ƒãC±ýŒE‰:öÄx %“–šb@(Û!\æX,G•$·Ñ0‹Š±çáJKY´SWUß•©þã”Jƒr&ê¼F;gwPú`(u +­àWÓÛ]èa¢E‹‹su4¸¡‘aÞðôòkäUO9%wŠöƒp²¹ ™~žoõ+HÿÕùF?ƒü¨Íïnòž5ÙâïϺ#UܺÆ×ÍàZ¯ûkum‹æ”„ÀG†ÁùëÀœƒýPgìEqtâ´0'^IH)Îa‰* +f ïÓ‚ ¡Z +}V0˜Ó‚±@?̹`ŽOœÌðÄË›û3 +BN¨â\|²åùðTL¼`-Û»¦ÜršÏ΃ÑúÀŠ#ã]SS¢c HQȈ؜Ç/¡N€‘H Â ȽTŒ©Œ zÍymy•Ò6ø-·®§˜»¬~˜×‚·“ TÂ5®ÞÞóÄ÷\Ø·;pÊA %P6¼ßÙê3óãTøßãš]6ׄ8:‡OkÖ黼ìäÑÉ>Yp,(©c?ìäS­4€÷•Çë×*<ç¬Û—ˆ ßáß;ù:w*÷Ð`bNH¨ g":½\uÒ iy²C‚áãO~Ð(„EJºŒ±Ï0Ó_#|Ð5baû$¶¨‡¹É›Wg´±7}ID¤[ƒ1F*–áKh;nnµOõ¾²ýÙÈödùƒ)Lbo‹ DM]·ºh¸CÄúNoÔ'BôµrÍ®ÀÄQÅgp94\ãÀØ w|Ù2PÛ5ý“|ç2_ +[¶½ ]àj[’Z×ÃPÒ:m4Ñ¿,Àª^‚Š¼G~6àQJ±˜¾¹‚­áYlÒîižȾ‰+žË{y?«)!ÈÝûakÉ$UUÊz í :þe#s$öM“·üvÃÈ8 Ò® 6J¤]IFkëm˜\æՀȵåûnh‘ÀÒý­l¥ƒ.¢æ•ÒÖ|½ÌZÙ|ð2H°;^¸§÷[²j\Vä³Ê>tx²$°/^!·ì ¿°à:ëC#9òÔ » M6D±¬ap"_$6ÎqÈW#ßh= +ÿ×›éËÍÔÏÒ9K±5NŒ%Ù6é1Áö¿×Œ)þÑ0³endstream endobj -4083 0 obj << +4167 0 obj << /Type /Page -/Contents 4084 0 R -/Resources 4082 0 R +/Contents 4168 0 R +/Resources 4166 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4069 0 R +/Parent 4139 0 R +/Annots [ 4170 0 R 4171 0 R 4172 0 R 4173 0 R 4174 0 R ] >> endobj -4085 0 obj << -/D [4083 0 R /XYZ 85.039 786.531 null] +4170 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [96.77 519.205 243.975 530.894] +/Subtype /Link +/A << /S /GoTo /D (groupmapping) >> >> endobj -234 0 obj << -/D [4083 0 R /XYZ 85.039 588.18 null] +4171 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [474.635 480.678 539.579 490.247] +/Subtype /Link +/A << /S /GoTo /D (machine-trust-accounts) >> >> endobj -4086 0 obj << -/D [4083 0 R /XYZ 85.039 561.565 null] +4172 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 465.008 210.464 476.697] +/Subtype /Link +/A << /S /GoTo /D (machine-trust-accounts) >> >> endobj -238 0 obj << -/D [4083 0 R /XYZ 85.039 561.565 null] +4173 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [362.911 451.459 539.579 463.148] +/Subtype /Link +/A << /S /GoTo /D (passdb) >> >> endobj -4087 0 obj << -/D [4083 0 R /XYZ 85.039 539.908 null] +4174 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 440.031 134.49 449.599] +/Subtype /Link +/A << /S /GoTo /D (passdb) >> >> endobj -242 0 obj << -/D [4083 0 R /XYZ 85.039 430.597 null] +4169 0 obj << +/D [4167 0 R /XYZ 85.039 786.531 null] >> endobj -4088 0 obj << -/D [4083 0 R /XYZ 85.039 379.384 null] +194 0 obj << +/D [4167 0 R /XYZ 85.039 424.588 null] >> endobj -246 0 obj << -/D [4083 0 R /XYZ 85.039 223.271 null] +4175 0 obj << +/D [4167 0 R /XYZ 85.039 382.303 null] >> endobj -4089 0 obj << -/D [4083 0 R /XYZ 85.039 201.411 null] +198 0 obj << +/D [4167 0 R /XYZ 85.039 310.72 null] >> endobj -4082 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F56 2890 0 R >> +4176 0 obj << +/D [4167 0 R /XYZ 85.039 275.974 null] +>> endobj +4166 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4092 0 obj << -/Length 2060 +4180 0 obj << +/Length 3578 /Filter /FlateDecode >> stream -xÚ¥ÙŽÛFò]_!$†,šG7§…ãñîNvc'~HòÐ)‰k -IYñߧ®¦¨ƒöÃb0`wUuuuÝ%îÁŸ?O´ë…éokkgµ³–õ8új±GVñ2¥Z''&_ºžÝI žl¯¥hÛ¹S~ùº„ªéEÅgù•Ÿ  [üÆgã"Œ‹ Rwku <è6!º1ÃsÞ´ø•EZS–_øNð—šIÎö±ÎÎ.Bq:¨ Öûbóϵ©¤Á-{ô¯ËDÛæ$~ϺHBŒ|­ À›?É­˜é/ÍE#‰ÆAl÷"´²Y1Ö0C“¤ÁV˜CXô §‰ ©èN$ET"±BöwÜúžq”ÇMêºê´ru- -îªõÁtÝ)c‹Bý–E&üÝóU)õ˜7XC¼…FÀ3Yä¨P„µa4¤6—W˜Yð;( óã¯û/ -mþÁ¥±ŽâjœÂò¬è©êøÐ3n -”ï‹)kÞ ¹™rÂÎRä¼èÎï8H*àIœ -û¢¤$Ì)\ê%  K©R>dëc›[ÞèE´¢ºÆxnsì }ŸÜÞPå÷&„4OIïd}@¾#ïêxzÿÌæ)'NÐ&1ØðçáŃì 7ˆélAx]ÃߢçïïžöâZR°rø7õüªER‘vugE®úv7ºA|¿—^ZNËÕm#¥¢ÄM@uL‚ -¬A/Xðr“A†;¾ªó¹Íæä RLå£Ø&w#iܦBN·Ô †ÉÒ;l_±}6¯0îpyʤO¡òÄk¶°­ “®ˆ¥„3Ÿ¬ -Ï š>P©#æm%’«†$0,4Œkóe]JX½õÄÿ¢3ã†Â‡ƒu(ƒÐ‘åC‘š!©®kë-‚©ø9Ÿ:ÞJž§˜:¡_Û”ؘU‚dÏ €\S™ªmùq-¾Z•:㳂ª„³~7eq6RÆxcŽÔHz{Ññ!´4€¥}T…™.ˆ.« -^T.†¦$á‘Fê/É4©ÕQbà”·µ½ï•«ŸÅ&î%ÚÞçF¡µÑpg¦Q0~k¦ÑLO‡*Ü4õÇÓ¡–éð#u8f=qÉ3=tB½(ÁµÝìŠújøÄ3™­BW3Œxl*c‰·-&'âÌžüÕ«Á.&Á„Ä;áÐiÇApRš¡-jê—ÌEĤñi\œc;³Ë¼¦a´9 -Y%‚çI™r#ôgšYmÛ… ¬@VÈ€û8ì9' ù+ö¿a 3ÍôЩÂÄU¢êlupž‡Öçñ†¦n5ѱå‰g9¦šHhc—·ÌG%¯âQï¤I¦!»«Š;N›ad䟷ò@"=÷»§ñ9´•_Q¾—ºQ¨¾®ü3Ítt„)ÄD£#’èøPcÇqöÞÈÙ’JNg§*ê#'jùÙÂly¢4¤L{#hpfúYö’Qœ'!côÝ•gc>9·¶­DÆí/(ß=’>+ûK2xÓÔ}Û”äI"Ò‡Ú|6E)îõÝ„jÃÄwcø~Mµ#ši¿#ßõw¯A‚À—±ŒÓCà ù6à4â’¬€bÁÊ705¹Û±ÞäŒh„ ×mXÔR縔ñÔHˆÓ^xP7G ëê4Oâ¯dAä±;šRF8@ -‹ Í‡>í‹òÜ•M¨U»êþ}ðϬþ¯Ÿ:GEÁM“à¾it»Q¬¬0äôÁµÀö'Ñ[‰ÿù†ZHendstream +xÚ­Ërã6òî¯Ð-TUÄøÚ=yÆÉfR™o¬ª²9À-±F">Æñßo¿Bå9ì–«, Ñh4Ð~ñ"‚¿xQ¤a¤ÊE^daªâÅæx-v0ò¯›X0V‚²òpÞ­o~ø)Íq–Q¹X?9:e¦e¶XoÿÞÿ|{¿þñ·åJ)¤ár•çEp÷yo?|bðûå*ôi­ß–I|þuùçú—›׎ÉX)d௛?þŒ[`ö—›(Te±xvÆe¹8ÞèT…©VÒ?Ü<ÜüÛÑâ1½àYsûMU¦…ºÜpœÎl8MÃLç´áÍr¥U ûŠÜ“é©—íC?>ðïï°íºÙÂÿv™äÁKÏhŸÖšÇ{œ=à‰¼I¨lÛ£©èÓð÷Ì’ xJ-4ßË„{hß½ø:fàN í¦jUHMf&ÖT/Ü¿C´Xdç´ŠñKtÛ —C×–«¤TÁÖ æÉUˆdâ€$Œ —I©ƒ§¶;JÓðϳ閸gêàyá/1]a;;3Déª]-ÇÝ+7æp¨¶—4 yû‘áÿ‰Òè‡â`3âê59ßnH†íˆgE›œÙÿGƒò0;"‚$€jŒ›`3*‚g Qîbøç Âh&,©t9ŽÂy¯‡æ΀[¤g`’&#êöDJ„8öU'‹á@/yõÆ u+HŽ“vä+niƒ áÉumS[•ã©—§€âÂ+mZ)m••à×X€¡-© y¤«‚ó^j BCï 1ñeäí"èÎ#ê«°“qZ.“<ŒJæò÷šîÜDh>pówº §Šà$Šþæ–Ó$ÿÕ ­ÃÑ4`Öã`ËÝÛUÆÚ¢"»º«x¤E*¯ õ‡LôߣîeAÛˆÎ"Žì‰³FŠ6¢l@Í;F›»Ò—’BÍSiX%Æ©àÄïëª#U-àK#,éÜ“nl¬ p3‡3A|8eP!E³_pÄJI€nÔ¬€´^„41A¿~AGðƒmì`×Û3†H3ð6¦e°£xyG¶S]–¢˜öUœ9L@C{±pª(Ùäcƒì^}pF‡–I³X:²4[; Ö(» D > Ô rè*sd”Í­Go%Áã(IÛ-ñ‰®f¶¨EÑtª¯†¡$ØãfOpHÖS ‡WFówÉcõðkNvœHYÑ9‘Æ{¹çù°KÀx4+ÅÓ‡=¹5h=‘Þ á0ßTã ;Û†‰<Šeôv›Òfë㳓ãÑÓ| Û²]­êÒÙìÄ‚‰Ñùõ§ÜÞsÏ»ú'3I›h–Œ³§uSÉ q½iGá‚)¢b±Ùc@e5a{jÒ +ÚÒ'ôÓ*=KóÓD@Ý ‚5ÍÐ6xþž¢ž%0ö‰ûÈM|YMŒðÀ™£*{3pkOJ´Y½7GñÀöHèŽó +K¾øÈÎœ5óýÍä&áÔz‰d̺}"·Ï¦åÕM§ƒ3>ŸààæÁÇwèÜÅm1o“ÛB²­íäeÔ™1ˆU†îÕrkºht‚8ÀøIe‹<,s 5u”‡™Ê*,SÞsÌ8'éÊ¢­TF)‡¤bð X/<ÔD…*Îà<ì—ñC4q­´mèjˆÎÉÑ mì–xµá²§Èl7³~¬tX–‰PmñîÇiðŽBOhš6„ÈÀ½pù´öK}80žµÎ>¶½¬CaÒr(€ÛÆafAdÖÌö˜ïåN¯H9³RÖpï¹ÍÁ ^Ì®Š´¼ªŠ8 íŸHzÎœñB+¢¾RˉÚtxب àÚÞ±åZr.»=3vhÍv镳#¹•{Rnω²²lÁsçÂÔV‚,%©Xç´K5élþa&'¸·kñEÒÍ\‚@r!ð;é:´ë£mYõ$TÙÓÕŽî3ÇG p·s®ÙO2'yŽT“Tl6ŒÀüZ·âÓU2eÓ8X Œí ˜N°5t~:½2’ R'Fx YÛðKÁ²2E8ŒÎ ½zÎÁE„Š‡è„˜•‰¥OXSY {ÍedÆaÊ:ˆm7­u.˜ .ÎrÉGb/96Œ ¬IÀñ8âVrÑYƒð¢2È#åt<€±¤¸ÀÝØUÛKÊyìM³«z4•;F­ù=“2ÝoEk(dœìËKÍæo.¦ri"®þ@rD`{û´Ö¨3šË)k¤‹ë¦ [ÖèÚE?p²©{ÉÊ!vNSNã#Õ“¾*}/~>aÅylŒId4g!> þJmÆHf°¯%AÀ6zª ÀdÈÝýôäJb_ì†g‚´#eÅ]8Má'ô¿Ö”ž®}I;z™K4hZ¡9MÙ`ž©,ærì 7."$–.n$AþÁ²ü#f=RHÍüÜݦÊcÓ¾#¶¥‘¾¨ +ð 뒛̖”Ãå]k;¢  |·VæÀê•©$ñH;¦ºjÒaƽÎiÌÚÚj®dÈ ôÎv;iÉ™³eE7v@UÝ”K%ùSïWêÁ*WaR¼]´öp¨†«c?dâPGÊÂùùzq”…DÐo-hq.V<‰¼ã8Ð;9Yñ¾s³rKY“ˆÅ-Ô*@ß· Æⱋŗ”iÎ…ãy¨óBÂñŸñÚóÃ’¨ˆ‹5’ä°2ˆœl®Õô$§º"…q¡ÞÏ„ó†xé›âycÁI¾['}HrìfÁR»ª;ÂÝ1“‰sŽJGb=Ú#?h·g^ÊÀUë²4 +~n]‘0DÌhÕâ’ WÎÖÐc˜«5BǸš¡}TDùE”k—†úñÙ=º·œî½ýA…5S8€1VØKM#«y™&Š±ìZÒ¹í¡·š¶ÜΕ2nå #IQ2â|Wö-Dà(×g^¥c÷*õ Ó™Æ˶™š„«Éù³HõÓäÂt Œ>íHcg:ä‘Öí3—*‰B qytð%…º|ª`Õ\ÊÌ?W”I«X(à§a&ÖÜøõ0‹OÜßíÊ5Oƒ#c¥€£r©¿åRÊ>ºn—Ôæ^q Úÿ{ú’2A ãè>çWümlÞäÆŸMÓ<:ý¦&{á%>ßxÏ|@«ßSEó L4íÀ©Z„ƾ’ñqrò‡·>Šf/Ï}2=]'s–Of¥gšGsàîÌ%c4 FŒŽúž(AÅÎy´`ë6N+ÐðL,=`°eÞg@%ÚI\c3ú¯b’p6WÈÓ v° ÜOå™(·€À#™MnààŠP%å·¿`‹ tA_ç¾`ó>È ‹2uq+D§iXBÊÚ #½È!ßÔÊ2̲E–ðßÃ8r*,"åCUquиP¾½­“2Œ“|‘a¦h—<ÒíÜøͱy5a«>gY¥ˆÄŸOb#€·RX½E‰óëyÉÅW|hð»²åñ2øÎ=Ö’ëÏ÷¥b8M¥¼}]d å­Ýœ‘ÁÝ\ˆRª"¿¢'@¦L¯(‘\¾ÿé3H§D*’ùoSp#Y®*…܇ÕH—ç»±ŸK +’Çñ8 ,Àendstream endobj -4091 0 obj << +4179 0 obj << /Type /Page -/Contents 4092 0 R -/Resources 4090 0 R +/Contents 4180 0 R +/Resources 4178 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4069 0 R ->> endobj -4093 0 obj << -/D [4091 0 R /XYZ 85.039 786.531 null] ->> endobj -250 0 obj << -/D [4091 0 R /XYZ 85.039 726.833 null] +/Parent 4192 0 R +/Annots [ 4191 0 R ] >> endobj -4094 0 obj << -/D [4091 0 R /XYZ 85.039 691.892 null] ->> endobj -254 0 obj << -/D [4091 0 R /XYZ 85.039 486.938 null] ->> endobj -4095 0 obj << -/D [4091 0 R /XYZ 85.039 449.673 null] ->> endobj -258 0 obj << -/D [4091 0 R /XYZ 85.039 409.634 null] +4191 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [128.13 65.894 319.829 77.301] +/Subtype /Link +/A << /S /GoTo /D (passdb) >> >> endobj -4096 0 obj << -/D [4091 0 R /XYZ 85.039 374.693 null] +4181 0 obj << +/D [4179 0 R /XYZ 85.039 786.531 null] >> endobj -4090 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R >> +4178 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F36 4184 0 R /F58 3360 0 R /F41 2994 0 R /F37 4187 0 R /F66 4190 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4099 0 obj << -/Length 3322 +4195 0 obj << +/Length 3150 /Filter /FlateDecode >> stream -xÚ¥ZKã6¾Ï¯0rYˆ5’¨‡•[÷ÌÎf‚ì4Ãf´¤v -KŽéé¿õ"EÙro‹ZY$‹Åz|Ur¸ à/Üì?Pù&Û§~¢ÂMqzlŽ0òw¡Pĉò“8†öÊàÎŒîÒÈâl•FöØeQìÇûiîÞ½ÿ›(ðÓTm7aù*Œ6ižûI–mÊy©¿Ý%IàÝëâyzÓy»Siæ}ÜîB¯;A®[îú/];â@ß5Û?üôîï–a Í?Ißdq&!Ãd~ä á¨)!‡÷nùˆ»÷ÐŒTì½n£½×Mø¢¼¢kñu>£Ü›„¤zš¨KhÕ푉ñ0‘Š¼ñ©¸g@¢ªÀÿcMGüå»Ä ‹žô3n%o4s"ÃÖí'=òº 5“³,×Çùõ¡©P  ]ˆ—œÓ‰_êñi»‹ÃÏö{Æ@{œzsÐüøªO¸ÍA^?v'º.l±à´®iª^&ø̼Òn –hñð˜qo‰T‰g~üâÎc¥ü(I6iœûa@ŠÉCýqúj,Ô;‡üZ.×DyÜ>Ö%GI‚þ¸ ]©¡¼Í…ÕCºš0Å„ƒrÐç±êý[¦~ž¿m¤1Ò0öUœ.¶B?Ü'b¤!šiœ{Ÿ¶*ð*=N}5°YÞµ%7ØNÚ -fn±'«¾ÉÞLs[2I–ú{¥ˆ½2&¥4»¶’Æ#>Ð!é8uÃÈ-2Mà7E΋ NF -¼ä'´QÓ^–ÅŽŽ›Ãt:‘y’ò²ƒ˜â8ò>¼g ¤h°2¹í¤ÿ¤Ç‘—å÷2[jmÉ®rÐ8òÊTO–-nàâhÓпÐh´Õ¼ÔMÃÓ‡Ñ6Q½ÆÓ¾pGa§Q«™X¤¡ÇÎIN¢‘ äïùÑÉYôùŒkvZ–xá'³ÇØ=l÷JüÛé¦R1HãÛyv ŨǚØCNâ=»’’ŸÃÞªÑÎé„îUÜ(ß7tú¬@ÐÈ|Rš8õ|ä÷κ-Ô•úO»Œu÷H\%! æ,8$¡êv±úÊéµµöºšwG1Ä"Ð8hD Éäס…V§œH²ä™}eÂiàXËhî»Q7Í+÷•hªêÙ–1 Luy«¡‡ªÆÞWÔ‹¶ >Ÿ•BÌùñWäà·‡_ùµ܃²gÑÍ2P¢~+¸[41ð4î75ùô>ßƪœÓ}Ïýb94Ÿ$Ž† -;G‰ž-Ó³JB£d™ÕêÉö|dZ§–›'îL൮£®8*ð´ßƒ$8LäL®o–|@‡&Ÿ­¬Â¶Öä˜}X/d¿Rãov=x´¯Žº·p{îùº ²Âm!˜ÑLº6¦ZÆ4¸×, ¼Ï2hì(†ÛU”³^ŸÍjz삤ؠí¦¦ä®§Åá ÍÇÚ{+‰a´"F&…¥h¹ÏÂ|‘H«Ä>mâ))xÁxU -qË,YíÅÎY{¯J~]Œy2—1ë@ª¼Ñ¹Mê8“wÑ&¸‹†Z\Áˆ( ¦›xúù>çh‰ýQ(\`c¨wùuà¼\ñS÷´µ þÈÙ-£hÏÃÑá‚=å~_°wÌ ÍÛL)@[€ —©¢©lTE·„L±ÔÆ‘ôÿÈ}Ý$¢6ŠÆž:úê©&\ìÞ {Ÿ]þÊ“¥·eßQ(ƒ«'Ï úðÇdQê(ÎAÍ¡Ú³ÏÁ¶I -­ÐQvüì&YNðí`âjœÐœ›Áµ+æBó‡stá“D>Â~FŠŽ3c+„•§¤Êø\D·<ãè–C¨.FŽlØxLó” Ïãð -ºÇn:.^ns‰ü™w ×LWáž@nâ a©“îñâ“hÞâ©Ý6tñBÓ ðîxÆRÐñåãnv¡Ñ]xXLAʘ}SiÙöç¸ÞÝî½+ØoOd87üàA~|¶!ŠT¦Ê­ânaî}Ýô12Ù!!òî½{l„ÞL:£4ì÷Ì7 V‚1ÍÁD}6©s¤³2p¡ qÂË“H*²Àÿ'€, ®ÇQÄC8$ÿe.ÐêqøX/“Iƒ@F“wB—<žþøÄ/euì+ ,‘"}# %…nôìnyÝîcX ‘5‰0Ëp)«/ÁÞëDgwP9öPÏ^Ó%’;VM(Áº+sh[èCîÎ¥Ûzp°ïm7ðE1F²pŠQž2›Û YgØ+áD •Ž]K»‚Ž{²«XY¤¶AæH‘=ƒu}@à'6TâZÚ`èSÝînz‰£Òˆ’ŠÁð9¯ÁV[ÙâAÀ(.HÁ¤‚QqGÇØŒÚg©Ÿ ˆck íÃeK@‹h 1bÃ)T ²Î ͤhîîÞ¨ 2Zf+ ؔά†4íýڨ͕\'!þÅxŒBY)‚ÂLƒµä‹€uüNèO¨¯-zàrK÷•«ÁG¸$¿ü¸\’ÙEBhîíØÍj=+Є¯w¿0AIÞY´YR$M”§îÇòv‹" Ú6D@®ÖÇûQ¾ÅÞÔ&¶ÕM=³…Ÿ}îq>Í6ÀËô<Àkôì°Lç’­à(éE×?ÛtL /BQͺqf³‘ä ‰¥*A ¨â.ÖIhœœ”±5ƒdÇø’w]{ñÊ@¨š½‚°]JxMö¶²Èk`_æ)äøzØ^r‰a€%Ð9É2­@ò ¨/­Íá‘Z.¡ãú|%ÚÌŽz-"ˆÈÒÙL2€:‡Á:£ÂàòLàQFEN|ˆ$¸Ð0¯éúyÒá¼ðB±}€Í&m½$ã2)̵xYIGížä„Wêxl^Ž;ŽÐv® ‹N,²nƒà#O¹V¢ˆ¯#²AÎla:ôjÕL Qã{î° "2±$â(Õ£¦ìNIèÆy¨ç×Ç›!i&9˜°è Ž½5wf¾ÇKê&«úÐAþ„óBQgq›0!U”_¸Š¹tÁ†É½VÃòÜûM:ôã]Ÿxƒ±êEÂÐ_XÿopÞyuÅ•4¼ˆ»_|–Êgþ4!š‰ì¾ Ar¦î=-Í2ºÁ¹™ÎX•óur?• -«“-ÓåsZÃ5Té«eýn¡ýKO›Ó¾ß+çdŒöï3Ÿ_Ìg]‹ý3Eʼnýj©GÇN¢l/Q×TÒÛcUòMÐlã.émÍEbÿ-=Á1†B¸‘ªI[Wpò¬BÏÛÌÞB¾Ç먎&oŠ7-ç« ÖÃx3"CÂ4ÔeÕ“QaÑoŸ;²ÍùT“ i³ÅD{®€âSÊT'Sdo†Ó ®@ª?&Ikm•)zm‘KUºËy÷­Ë•†¤ -Mlvü„[¾ ØÍ0•2TMCñ&ðn1id:Åmƾ¥›£Âx5­ÓðNN)ƒ´¸= g„•Jüñ=ËÐÈO{‘0›J~ÝßaÚ™<ógF%%¸V‡UåÚt×W€wt³žf„Þ¸ÖûOYä~T¹–í=`YH™Ÿ)ù}þØm©VEa4‡@¹%pŒÈ†€vßáç!v¬âiq*Âu­;+3èýõŒí«ïDæûN˜f¾J÷«µ%C³sˆ¸¶»‡Šö~š¥v%јìjGû¡z{C&¹ÞoñeJå~²Oû}]Ôm~À**:gLă.¿ŸÃÈE’Äãµ@r'ŽSAɸ¢Š’)E‘tp’€Ë:ÒuMFpÑL.ðìŠæÝõÇËš§dÊŸ0•îz8g…3V‹%ø8É´‘”cE¡æu¬/H_¦9Ýí¯‚Iz ”xjp"‚šr…]Ž’‹£ —úl€>Í ”1¸ t.z0Æwr–¤žlBÍR|³æ”ÌÿË"Ã5îŽ`SÃ(ªñA¾ XÇõ­¦T•ðÁ-K}B0ç·-e&zÃR„è¿YÊ[K¹ÜoÕRœýÄ(“ÿ¸øv™ªDò‹¢K‰vFµò .5Ö´N¶GÄEßI}Ï5"îùÎjçÈT '·^pÇŸ¬O&­¯ûê;€¸ug†IÎÀUaŽt™÷Ò^‡ø›©ø2s€ŽÇ^о¸K`¹óQÀO˜]‘Í¢~Â6±Ñ”‹âõÂ¥´u!Ž•þõÝÓÔQÿ$ xwè•Ï+¦ê‡¿.°_oax†]ÏÜq+¯§Áeáʬ.å/V¶˜í,±¿—õô?4ðõ ºáÈÎàI#u:ðOù\[D\s2¥"œ%¢-ìw{BW<Ö€WDöH¿»˜á›|b¤±z0Žƒ}âçQS)}aŸŠ#Â`©úçúï5TâÇJ¹¦~óg3éÊwž õÁÍr(»D]ýxFíÁ-¨7öüì½_kendstream +xÚ¥]sÛ6òÝ¿Bo¥f* ~äÍg»‰{ã‹ÕñÝôúÀP´Ä†"ŠŽãûõ·_€(‰’;“É8v±ß»”ž(ø§'©ñU˜M’4öM¨'ÅúLM–°òîL ÄL@f˜ÌÏÞübâ‰V~¦²ÉüÁ“)ßdñd¾øûx~;¿ú4…aè:K’Ô»ü8ÕÞ‡óëž¾˜Î´‡S7s}š©÷ñ·éŸó_Ϯ掄‘: ‘€¯gü©& ö×3å‡Y:y†±òu–MÖg‘ }…ò^ŸÝýËÅkÑ„wÝׄ©oÒððÂÚŒ\Ø?ŽºpßÂ¥Læ-à>Oõ ¾¤^WþWiSx½ž§òºæM¶ €L´|ê`”÷Ì0\³àÁ:oòe¹Fè²AõölœúŠè*ÜK¯kúÀ2¯ßà8oåÝåkÜú9àÎ-¦ò6|œ7óh†«›·¿Ô%J85ÓÈÈŒn~yÁâ¬~âÖ0òAv´¸÷™Žaˆ@)õæß·üb)N½o¸£#– ¯ Wˆ¢È{/ljW~Ã!mÄ›ÿÌõ«y‚¸saŽéve×çÕñ(ó~ýˆ`-áª6%ñëí1õÓ¯ô+6²…!•‰ô@e´Ò~¤BwrŸìãÓ*öS“žDha0î(©†ÅP;oZfÝl\UÍ–YÓð·­«â…'P7a¹îŒ3&N#?,§3€9Î ôcN!tŒÙÇ8ʘ!F˘w]û÷}ä·[dãFè}ü æd¼¿Ê¢?Ê“ø©ŽNóc s‚ô*?N Üòcã8?-?È(^PC +´¼ ÀB‰G´TÃ@T¥üÎŽ×z2Nô`aà_2¶˶œ\tÕ#‚åf¨üDǧ¹¹…9ÁMz•›'n¹¹‡qœ›ŒyóSÏ×vœ‹;¿ù/œ}eý.\n½zÑ·hàh4@çò"]Š—8"9[GÂN^zÚ8ç)Àn´u tD<*ôcœÏæ„xèUñœ@¸ÏÆqñ 0~¢K.++š¾­ÖµÏ›%†œëóÞò[&VâBµ„.l4sYlzcQÄÒÆ{^UµÝxÏ#ŃÇÂâªB-/Þ|œûð“¤õ]ÂpG Í’—H5E¦t@%Á¹àÓóGt¥¬(‹Üî–7e(hc1TC7·Ð‰ÀÛŽ¾”xx̘’‹ðt¸ÀXÕ~†H]*m@X±au4~àÎsW£¼Û®|̧!*1^Z8Æ °x +Üïøå²];«ƒ×‹¶é;p‡GÈV‘¾Föæh%o4soÎùg”bð@IÓŸ§ì)p‚òW²Ô— Ã’ïÈ{~ùã;†¼'÷»à¬W`­s¦{–vÒÿ ï¬ØšË./äØgVi^.mî—Ø™–MnÉCÙ UE»›n;#q”Á@’fœð#¡äÕà°K—lçäN„D¤R^×pÐ[”yâ]1Áâ»6'„Ê3ˆ!€r .´!Qw}NÅÄbv> b¯n›’÷ìˆ,ÝDvËæ…=~¹¦'ÝCBfk‹ ] +†µ«Ù¨ÂªØÔµõñ‹"g!ø4;>÷¾í¾,»© À¥<ŽP ¥¥NB¡’Ë:.áØÅ˃4%C ’˜ +· IØÇ`‰“èrð"Eõ˜»¢¡P´‹œ¸ì­«zQ'Z¹S0¯[Ôr<­Øç nû;œ cEÕ6ß’,¸áÅ,ÒÆOL¼ÃÀ1žøVQƒÄWPá#Ü5Ú8„ÍŠq²¢Å +×jíâ™Õp¡ü +Ÿb<þ@qGÖ™0*òÊ0k¾Ðe êq©åÒbq­ ‘Ò2\SVË•½0ØæÊ•,$Ù ¡‚ÑX.ñKÝ.!£¬)ÞÁëÒõG, ^èÛe‰ÂGÝ‚¤í|ÉÉõæbï/ŒJ,h3Ž‡„_—y÷v,Ì'âD Þô¹µ% y`1RlW®[|]à‘±ÂÜ ÞJéh6­ksfÀÐomý­”^gCMvŒÕ1ìÀA…„Fêí&¨Í+Vcî¡"Óô›‘€ ƒˆ:Ò|_Ü°LrÀʆa³†1Ý•…ýL0T¨ÚN 3¹…&ÓÚm÷árÁΓ<•-•ö,zW×쬡©rR‹¼Ï?‹†m¨ Øàà-© +kFy=¢‚Ü‘%ÈB´ ‡²ii\Ùy<ô²P6;-BˆŠ õ U¼àr¿]lOÝuš»)ø̱ܕ ÏX.àYWˆ(ñÉFG¡WÄ*ænrÇ oɾ›T«üy„#Ï«ÊQ« ÕBeT<¸6Ì.Z*¾H$) +`ÖEwׂ›•ì)Ï/Ö¤)Õ¶#’÷¸`ñPo0q ”u͸ k£Ìñ¾Ü'#Ý+F÷YaklBæcTõÀc„—!6M¬£Úð 6Bã2WÛÛ¾œ¢ÑcÐ\)“„ŽhŽr‚¡©zÌÀ€Cÿ#Êñ®œC¸Ã†5-ÄòûUÙìž{ ÛQ­ŸqxIò¡nÓÖbà¢mÕÎ[Zi®¶}g½ø¡Æö Q<ÕryÐ |åA¾!nIÈY¸®À×ø@ÿHé(åë0þòÀweF?äáýãÇúøAq¶kYðÝs¶ßn"ß¡«õãhТȔi8!ý,5¶=NHòÊá5-t ý4 ®Óäëê¿(ËBŒ‰øí¥hâÍõZO.[ r2 TŽ Îå®Än‰’ùqQ'Ö~סBee57H‰ù©!æ¾R¢¸ÄòœÒè¼jì4èbÍãwü¼'ç=èKØÄÖnp<çñ~€¨¿ãHÛ üæ‡ÏÛ®}pyÏ*BÆ E]•A÷üVpT¾©h+³ÍIwêìG°R#ÌÓÜç‡wÅ÷åÚ¥† >ã…ë_øõœ_ïàŒ+Ü{ñ;Œ>]ñ,ÝüjîR÷Cʯï°ÿÀ³œß̯.±…›eÞõ?©À4s¤E¸M•a‰¢‡¢°Àæ ëLIŠ4Çß>[¿´@ù;À5lÀ=ï8¹Ã Ï’®ñÞÚ½3»ù òêê‹­br(¼—ÒOØ ¹›M%¸óÃÈ€f1ËëÖe¹èšùI¼ð7Úx·®Á¾¬à‰Nœªu|øÇ=›…JÊO°ù@ùIB¾‰—º¥Øå§AƒÐBÏà‡¶¸&×`\†‚ÇLÐ ì°¸X宼 4/£´Ÿ‹Ö)F%S6ûØ—¶0A’½‹IÄ$@fâÁxßÜÂÌ@‡× ’Ø×Ƹ“¸žF éUó`¿ýwŽxù},óÏ–9¬nAŠ¸äï?¢ŠÜó Å25°‹/î‡ÂŽ<7œKG±¥ÃÀˆn cÓ}Õlû¨ô›ñ164îðÖ†¾O8ˆeQf|À7Ù†ˆA耓îË~80†©g£?€?V·ú‹™Q +ñðÈ7vMœD“ÐøQÈì{‹öÇ64 øÿ‹ë•Ïendstream endobj -4098 0 obj << +4194 0 obj << /Type /Page -/Contents 4099 0 R -/Resources 4097 0 R +/Contents 4195 0 R +/Resources 4193 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4069 0 R -/Annots [ 4101 0 R 4103 0 R ] +/Parent 4192 0 R +/Annots [ 4198 0 R 4199 0 R ] >> endobj -4101 0 obj << +4198 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [432.259 645.989 512.306 657.679] +/Rect [465.728 117.052 482.144 129.954] /Subtype /Link -/A << /S /GoTo /D (samba-pdc) >> +/A << /S /GoTo /D (domain-member) >> >> endobj -4103 0 obj << +4199 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [249.04 478.871 330.742 490.561] -/Subtype/Link/A<> ->> endobj -4100 0 obj << -/D [4098 0 R /XYZ 85.039 786.531 null] ->> endobj -262 0 obj << -/D [4098 0 R /XYZ 85.039 766.606 null] +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [128.678 104.109 273.774 115.799] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> >> endobj -2952 0 obj << -/D [4098 0 R /XYZ 85.039 672.187 null] +4196 0 obj << +/D [4194 0 R /XYZ 85.039 786.531 null] >> endobj -266 0 obj << -/D [4098 0 R /XYZ 85.039 616.997 null] +202 0 obj << +/D [4194 0 R /XYZ 85.039 532.034 null] >> endobj -4102 0 obj << -/D [4098 0 R /XYZ 85.039 590.382 null] +4197 0 obj << +/D [4194 0 R /XYZ 85.039 497.288 null] >> endobj -4097 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F14 2895 0 R >> +4193 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4106 0 obj << -/Length 3558 +4202 0 obj << +/Length 2494 /Filter /FlateDecode >> stream -xÚ¥Ù’Û¸ñ}¾Bo¡ª<4IðôÛøØÄíìhË©ÚÝŒDi˜‘H-Iy<¿}%Jv’R©F£Ñ7Îø…³<ñU̲<õΖ»«`¶‘¿_…q- ×ÌëÅÕËŸÒx~³ÅÚâ)?)ÒÙbõ›÷æ7Ÿï~™_+¥¼ÔŸ_gYî½¾™G¹÷柿~æþ·Ÿnç¡wó~~z¹ëͧ‹_æQæ}‚‘ó??_½[Xr‚C¥˜?¯~û#˜­€ðŸ¯_ùì ÚÅlw'ÊOb%ïÛ«»«Y\<ÏxÖÔÞã(õ£ *ðó<ž„ ÃÈWa J?3Ë ÐePå~š¥3„ú=³ãý…*†Í\§ 2Èéz‰»ž*ü$OFëÝêGä~É|>tÔˆ½fÍm÷\/¹Ù7<Ô”x6{hl«¥îeÎïA`ßa»å+xiðÔžjhÁpÈ€Ëf_•Ýx¡þÑbŽ…^G‹Ôó¨ðúJ J½ÄÎesà~³p#-4¡CîS€%pmò¦Ý`‡ãeûí;Æ÷Ó>~9Ë-¥ïuç<–¦?²BËf'j°2]+cmþwKp‡'먻Ñn"¾{[ĨË. Bó‡õ5ÏY_Y†CÕ6K”wCŠšg<5*ªyq†·E8&¹H(÷ˆçÐÉÒ›kD`10~OUNìc+g¨·dâpØ»f_¡SO ï-ž“z0Û,[\2ŽpIä.¿ Ãö½:|Ñ÷[iõ,EØl½c´ë¶‘Vš‘ÒÖ |3±‚"”gŠÈÄeQ26VG7íZ”„9cŒÊB<¥µ(•a’&ÊI1ìã‹a™CJÁhì«8%%³“Â3Ï#â D4@pÈ{ve´7>T5M½×,ŠÐµiAÔÐ7¯xè}½næ*ðÚîqJSŸ£LMPD—i`& ”О也D¢[ +)D ‰"µß4,“¨%Ív[¶ÜÇŠOÍ)åŠÒ˜ÍºîÝ9à\îÅí„X3ì·Ê˧/Km›M#ÄXKõçÁ´º^(aÙÅV ÑqJ Nyœ]ñ†]¯Q¦Ð)¦AàÝV˶éš5šÆ<ñ>èú–œ²Þ 9ØÅâ -÷¯o-Ð!—û*Q  xr:82ƒx¡‘¡Ø ¶`Ͼµ¦ž"Ò´~**³|Ž!”Û“ŽQ\R9†ÆòÁÏ"àRïé,ªmEÔ<ÏóU+\PÔ‚3Ø5ÐÑÖäÖ›Í3ϧE×ýàÛ–l¬dþcM¤<ÕüjàMŠm䲞²õË^NŸÌ³ð+RlŒÎ™v'~y0ûFÉ{v{ÇÏ/8¹–hùOa. Ñ\(? ŒÎEË€ÄÄ-ú|œ²D¨å -|Z”öñtêÅÛ³ËoÚméš‘ÔÉ“3…Oa+úPÒãèÛÁþ㎯Ý-spaõ´A‰œbãɘ 2â,%*ñ©ùáR‚ïkdN»ã$Ÿö¸²l˜`D˜‰áä¸p]ñOÎqT$¨ñ@Â]„í[?Š;N¥aMNy).@B«È$é±÷É'iÀ~‘V vÒéHªR™ä¨22þq!ϲÿ`¤2óîʱD!kÂÖ Ü¡Šøp3ÎÈ8‹¡¸2ú^rÿƒÎ ÈVnŒfGq*A$á{0V‡Œ‘ã; ‚WNE+RïˤJd´c|’,!`/ÖH3çipÒÜL) ÀÌYÃgîä¨k··¹ç7î'{Øšå°‡²\xvƒ½­–²& °|ÙÉxiè~kˆÛ9é°a¡ÇA öWã{ƒP×8ñ«PÖqÏ`õúVâR\¨œ°Ò%ß )Uy1<‰ã¿ìà-„ MB¿@ƒ0¸÷Xe¾Êâ!4 ½ã“$ ÓǘO‚ŽÐ=v~Äö"Æñcc˜°Ç„ -¦‡B4=gv¢à L¸¸—æ|°‡©Ÿe§6^öì"UPh'Tæ`|Ç­!ÕhFS¾P³bu U@b|É(¾:þýŸ¹÷™Ôa-…c«1'F’HÜAŽ##óݸ¢,Öv¿KʸÂÄ웚ÁìAÛø¢Œc8ìÆÁ½F‹‡Hç ÉŽÕe[Ê$Ý -–¢‡Xq®@"ø~}Š®ªÅÙ™mžóC˜a­ïØ.ÖMÏ waâ™ÏQb*–Ôél²rƒ04i=AÊÃ|ÁQ}!'ú*kîú¦-W‘L–Ç)¥³Å‰`BåáQ !Hv,'áà›Û Ý´ü¼+—‡–"4{ÏÜy³´Ù2wÜ’0èÍ1Ö©Ë#©¥Õ ¡¹¯£J`Mܲm‘–¨HAmØs¡^FEÆÉô·eh9Ýærqø$^Ù©F…=€cÇ f§x@œhÚúÐ;æŠê°|HÉÓóç¡ìú k/(Î(W½àí%?&4+G}«Znéx$>Øeõ#Ü8ˆí”Ιè:ÍOÂUÙÊã%‘ëÝ'lPúl Þ–Ž;n(ZIÄŸU$6 FäVæð²‡S³ËS€”„" UשEˆ#ݼ’EY4èjèjf CÓ:ÉvÛ÷ E2+ZsÃXô¡cñ­¬¦öŒà¿Ž ŒùÅö­¶µg›¹Ã„›ñí€Ð¾B¥”½„ã²[Žu#KŒ¶ÏÎcãHƒt=¶Â8 "¯Ux†Ôü…c½LYæ¤#´Ñ¥©a“ɾmœ[ìqˆ>çº@¼£Ø»'Å6¤ëߖۃM¤ -/Çæ[EʸµH -cðÜ붷ùɧ–ÕÈËFŽÎÁª‡A1þÖq×@Ãcßì)¹úÑeÎ †nÚ©ÌŠ@ò®E¾èž"&”ué;Ù2vj£OÇt >—×kŸ5O¡ê@ ªauk:aÂ8€#ÒLö‘D¦ÀºmŒnàìÆŸØ$ÝH¥æ*fIÆ@lØM%€¸ÚÉø¶ÚU}÷‚ÈiàRT •*µuã°2nC3ƒp¢‚E3$PØrÊè™K`2}5”f##o²i -éÇ*IXâÉ"ba¿#™CFLµ8|yz¨xãe•fF§ eNóÄ”mÒiãï qÊ!$2L59jaˆ«fdÞhÚb"4CiÈŒÓ ŠÓˆúèXµL˜j\­ªd%“Â1‘Á;•›Û]É[0[8ºËÅêã7³ªz/†+Ä–\¯À*N3”fìèAÏ\·ÈŠi‰ÉòSþ@..ç‰3MhŸå“có7l²m'öܺUÕŽÑWòœ:¢ïlÄ1*¸BZLu=0KÙ`]ÁÜ Ái-÷"ƸÝXåC  lÑwyà;_Q „£‰cVá’\”Sœð`Ã^º=FŸ{w7·>éœú[#C­Ô“M¼mâežð]c÷FÍ©ÍÍjað&±džy&ºËmÎD¼üI¹éyEø¥g¯d|ùŠ× ‰@Ô87@ÔA²O‘à®J¿ƒÄ,r÷ÜõåNExâÄÏÃü‰aXWÁâ©ÜO2%P+äSËEK)L’8ª4/l‡CåÒƒHrd¬6F¾S™¤« t즆QxRåbåƒÉáa³h‘ -àšŸÖå¢d£ÙÂÎQÞ‘-”àͽÎÀ×F>öBjõ[©Qnib“Öùò •ïgöÓ—î· æ*ÀýÄåÔ\2o¬.Nm0¯b”×UýÁÜ¿u cÕ@ <¨¬kÉ9HÂÑJ&@¦Yµöª‹–ìøQ ›~x±|›Sú‚]–[9qëú¼E›àaè½:÷ýDD~˜—? p€ÎAa€¾ó ÅÅ劓õ¦>¢p×û$¶m¨>¤|—ž9ßCÀød •›ÌýÃçÖ~¥ MY@ŽS\èšöO4ÄG16EL¨ßZV;;ºÔ“—;'…QÏÏÔ (ö7Îö%\\äÛ¹_Ãög,÷¼áv%37e]¶zk¾+16¤leå{ú*Â^®ÄÊ{_󈽮Pt…x.êl_x¿}Óñ¡²”¬+Ñ#wÐ÷\îÔÑ“®˜°‰õ’ÑE0¢ç0K3µ¬¤€xñµ*SÜÛ£‡è€kò«‡Iɲ_¦¹W7Ëû -œ by¬ðçÕþ¯Ï/‡Êzîù™¯’(Ž 1¸½$>&8AO—« ŠÿØäˆGendstream +xÚÍZ[oã6~ϯ0údkF”D]؇©ÓÝNѤÙÄ‹Y íƒÆV¡¶”‘œ™æßï¹­ 5À^=^ý»‹û¿5¶^$B%ÁpÁR,X)…1-xûœÃª<¹|‚UÇc…«ùR”lõ–YóM™ïp±yƒ›¬~ã槪æ›]UþæÉ9¼Öð·á1;á³uÀ‚²F]òõö‘¯ +x­ÜóÆÞmCî$±gìz;LÏùþfÓ› zNÖ)KiŠÞ±FB=2Ü\³R}Ïû“ïtÃïùJËF™EŽwåÊO—gšŽ˜R¹ô…'gì²ÃšBi©IzR„^Єkrã¾<éE"Q‰S Á $^†„Î@ú7¶F³32P•ÌIõÄ×YSì˜Æíæþú½¦,#ºùž´ W­]4²•wjÈI©_°­B»ùƒtu˜ 6JB‘Â<]ÔZ˜ij hŽZ—À–Ú¾ÄQjm‰›ª®óÝ™)س=î*å8ÏçgmóÌëÏHY^sßCuÔ=¿yÊkh¤Ýktó~áÎ0úšÉxóàrŠf‹D†nš;Œƒf š¥Ù!°£¹'qœfK"XpS4g³o“%2ž}UvfÆ¡‹‡ë]vÊùîÝ^u|=#§ˆd?愾qðçì9'iµ­ì/8„i&0qk-ÜU|ó`-Ý ÝKï‰K§}ã¾J`_ýÁÓù¾Ö.sobʃñÜŠÐ÷d”§„D“ÉJtI:ÂG«¶0~¤fø0èµw˜‚áÞ³þóx2íah[üï íù m$裨wÂi•fÇßE7ýµ^,¼Ð^Ú€R q¯§7ï¥é½+c!£È½w;ŒcïjÐìÞuìönOâ¸Â,‰7Õ)+´MÆda¦É€æŒÉ%°5¦¾ÄQc²%þkÉЗB¹‰5­™%uRTGé…¬qB[Yõú1HC`Ç]¦[˜iz hŽ`—À–â¾ÄQ’m‰Ã"Ê—?S2J·›‰DÆg.ÉüøØ [Õh +Íä%|NOá‘ÒSxü‘!´°k‚°:óý<& ‚ª- HŽoüÚe(ž†tR€‡r”Zåuó7xU&­HÒºÔcñmIrá¦6¹j‘/¶Ÿ!»xÉ0íÀ6òßÍO7°å#hHuÑZtfÍKçàwè©Ø„aŒ¶áE=:PÄÑ_[B\¶©+÷Ù†…qئÍÚ¦C`g›=‰ã¶iIÄD¼ËÀux!‚°å@LóÇ#~$"å®-Œƒ šeÄ!°c¤'qœKâWĘÇ7ã¾Îù‰‰ÒY1¢wÆð‰F”ÑN=Ž–hVü4J¹« 3MœÍçØ×—8Jœ-ñ}Ùœa/[”Eú L¥zïBÃ0ºrûžNûMNÄù2¼÷ÝÆNG¹XÍ÷È4H!IÎðdå;îâs$xSÅ ï¹;“¼ÓÐÆÀ³ªLhÌ»0jÜ&åø:W‰HÝRqhœ1³ +Ÿ–ÖéûRܸº;q÷hëä¦BR#Ù«ÒÙ«ò).ä6çëÔ|…\´¢â©fô1ïlãÈÓaðk¾OŒ¥C|nøje;œŸ+ŸÃ5ÃIélß´õœ;kšHó¬sÿ@³c :¯4¦¢£¥u>¤M©æ2Ô zŒªÞ·ßÁ¬"Â.l¬lê¢N8Ј¯/úX£g_œ‹ÜùñÉ—‰ð#wêeaªA³&êØÙhO⸑Zÿ¿%¼ŒáóGÔ™¶° +å©Ñ¶hc22Q“ãÐ[ŒÃw~9Žu‚(¼° ˆQ/ˆT)ä0õD(a„«`N^+Êà)ùì­Ò€=ODŠÅ§…„ÁÓ4`ˆuOsïÖD ×ïOrqSÁ$Ö<õ°kk\Vvb+ÛOEƒúƒP(™˜\f%Y©Fã~¡¹îýò<®úà#yÃk;]ßÑÕÊÔñfë8§”xêeN-Í öfÍõÐç¬Üå{n(§ʼnì!û*šõXÀ©3Ê„1’úqÿ¥Í.Ýôœ±rð'Á3Ãg6ÒÏyM3ŹĊü*^1\õ´é§xÒ’£tæŠA¯-øPKý1)pÔm†‰Ó¼%uàŸ:Hv±B’DÄ`N–Èá—qÏ+H¥H.f¥ÝÂà3›|%'í–Ý“81gªo†vJùZN%RDa2R•–¤òEáïSbNøS Yw˜‘¦ÐéJ3ŠÜ]|›Ä°‡œá‘I¡y6ü°×§í¯–:Åj­¢ÊÑv7PX(–‰²ÊFô·8ŒmÓøÌÅc¬ºOg&Ä2² â5Ö¢]hs»ö¨OÆÑ » ƒÒå±u$©%ZÞßàÓÆ h †A²<½îžu£n¹(~­½ö¶Uï1k™Ü3ÎÌáCëÀº4 +_ÅŸ aÿˆ?ѵEσ쪒O ^ÎÍ Î‡©Â@ ¾!´`ü;Y¬ñ½ô›ãasüã1üçõ}Óï º“9Hg“‰tB™DqÕ²>˘ßKi5ãÿ»X¡ûendstream endobj -4105 0 obj << -/Type /Page -/Contents 4106 0 R -/Resources 4104 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4069 0 R ->> endobj -4107 0 obj << -/D [4105 0 R /XYZ 85.039 786.531 null] ->> endobj -270 0 obj << -/D [4105 0 R /XYZ 85.039 630.814 null] ->> endobj -4108 0 obj << -/D [4105 0 R /XYZ 85.039 599.289 null] ->> endobj -274 0 obj << -/D [4105 0 R /XYZ 85.039 449.2 null] ->> endobj -4109 0 obj << -/D [4105 0 R /XYZ 85.039 428.004 null] ->> endobj -4104 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -4112 0 obj << -/Length 3567 -/Filter /FlateDecode ->> -stream -xÚ¥ÙnãÈñÝ_! /4°â’lžAø˜Mf“™qÖ -&ÀdÚ-K‘’ÇŸººÙ”(o€À€ÙGuwUuÝ­pÀ_¸È?PÅ"ËS?Qáb½¿ -[˜ùËU(KY:0·««JãEøEP,VÏvŸ"ð“"]¬6_¼»¿Þ<¬Þýr½TJy©½Ì²Ü»½¹Žrïîoÿ|àñûO®Cïæýõ2ô>òÐݧ«_®£Ìû3¿þºúùêÝÊ¢ã *…È|»úò5XlñŸ¯_ùâÚÅb'ÊOb%ýúêñêv/ž‹¼jŽö8Jý(ƒ† -ü¬þ¤á@¹éq$ëºa}@€„]ŽŒ¬™˜¡ÈÐ'4–aê+0ÌøMTNØ°l'¹÷Kï︽áÑD\σƒÜkÞÙš$cöƒ×_îfŒ|áØã štŸ;ï›sÚò;oTA@´´´,Òà½e¹¨è3Sʦε½þ•veQ\ªƒ³¹1“4ÞòÚ5»_ðÝëÒ¬(yêЉÊE:ûKžE5ü#ÞÜî_vX]K^¦wÛ6@r’gl¹ÑX”`ÅäÞ\ƒAØxìl ‡sã"·„ÃÏ0Ú!‰Ê2ظŕæX Õfœûá v-ʯ$j¹ÏþÀQËÈrÀg¨N÷“ä£Rë—O©Äe¬Úh61<¡k³„D‚ÛL ܉sÀÁª1xšÓ#‚1±V3G1IU˜ž‹ŽY$‘—aÆòíyÚ ÎOLX‡f' +52û@^„öAëC­ötÊGǃ-9 Ùaj ³g³Ûœ92–gfîŠC´{‘6\fǘèm»‘-wÂÊ ÆÓ ½LÝl& ý ò¯€CýëéLÈàÀº%k ð‰ ­ŸdCqæq"ËÉDŽ…Nâøs'2€/dÙ­•…i”rúŠÅ mÂIìHv²Œ¢ÀO!s,œk+X/1L ‚ù„¥(À$n9ò. ¿ùv4×۲Έ p¼ -æîè -¹ÊxN3„1å?Êä?0au;k-g»ºÆ¶ ‚8ÌfcB)@~§DQ‘šU=·Ø>wß«5¥˜Òt7¢‰›×ºãp)+à‡ÀÉ/ò\ùMÊJfÈlf-‡ØÒ‘¨:Ž¨~à}@%€Õ¸vS•&©GHW½ÏR!64mSrŠnJ -ƒUðû»ÞQj-yýH Ì8hKz‘‹yɹȓ#Ï|n½·GT=·vÐ~œ5ª0YªÁ®«¶âëÚî:— AŽ@)e!"C*KO¼$Ì -ã¨Ù3Œ¦‹·>XÖI&+Ó{aIVð«ùsKtcËÆ-={šƒˆ'*=t¤­#`½ì¯/ÕƒTXŒÊí;Çwm];):Nïu£·“ú ÙŸ` Ÿ£@â30¼ÆSâ62ßò+wŠv^ §yâ@ÂRµ‚b+¸è’6¥…DuÓ`"5l?Ž™œËÐ+>ÇÓ[w왫\O&Võþ…²q ªo×¹*«FˆH±W¹Ÿ¦ŠhJýÈB?ĸ=.¼wà”r3*Íؾ`ã®m0!Ú; -ó/ ©Šø½‰¤3Sû5Hf¹¤É‘k#_¾J\Æ—’ç^äG „7¡©lGÕ¤s]AMÞr­ãÁÊ·Ô¦lcD67AŒß]ˆúñ x4:NE¤ð>WÍÔÎ%Uwu%‹z4 &£ëõ}CVb ƒ*‚½ü ïÕóØÇU,K¢ P<ÆizÿzàïÙÂgÉꪖ­*Uz?]ç1ne¢Û=žð¤y7R45æû4X6T=ªEÅΫ‡¢RBdáQâ9Ú½¨ ÚhÝé})‰•q²\æzaÉ/Ûº}"f]²ûátIÔ+)fÅÎÊ•¦(ã&ÏýþÉ_·Íó\]øqbbôE2FÎHÉ[Sþ«‡ƒlh†ßÏœ Á¥òÃœ_‚œŸ0^ TØv-æMI”xä¤)·7sÖF¤a ¥üÓYöZö¿±ˆD·Ÿ[tBû߉ÔÕG‰A:vn;©-“?l¶R›ž”^¨hÍ`_v-_pÿuò`¢,ÀLáý"¶Ùïtghjy)ËÍ´Àíø~{!feË:t!Ìx©èùÀ†5ÃÀ:‡d4†™"$œ%_8¥!3¨‡q$²²%YÎÚ±¤y-jI‰±«˜Ñ´4,Ö\6âØ®leªs¸‚KFˆsÓ3¡ç:£ðvçz:'á¾#“×LÊl5zƒ)F÷{ª›)®æqyO‹ÂF‡ºÔ}É/7¶ˆóìzøÀ† Ê”÷ÎÏå±s÷«ÐÓE¤Àuºžé¶ nüâ¾|2ðÒ>w4';N ÇÆ*œkàCÕ JIûQî¢tæñämDNöAD.…QXøQ¨Þô®Œ B¿@©½kd¾ÊS7ˆ0Hïf=TßÅùßcTMÑ R \¥©wÏÖüšëL&:fxdðà›¾80—£‚0Oý¬ˆøEXâó³4¡+QíK×ñá‘¿ŸI€‡ -0àF©A4’5'¬a+ 7 ™ÏI -"|%{T ë‹Ñ ÜÄÌ5 -œ«b[’Y= ª|5&”4¿ò„¼7A‹ëçCçt%Åp•©œÈö¶äm -e¢(åðdÇÐòº £XÔÀ1r\ÙáeG)ßÒ~“&ð;#=žkçÑw,ƒj)dŽøã3\áV›NŒaæ=še©¤ -*¶1‡ˆr±âa[Ó+ºáôÍ£ñˆ€ó&íf&8…¾Â¼^S=yæ'Ò‚ÅØÊšAFÆ’É/¢ñNòС'ŒaS?% ’Ùð<¶ŸÍJ,_'é î²/u#MSv˜)°º·¡R¬^÷-·H*±ññÓJæ(ïÂF/_þ˜ß  XxhZÆ^ª¤¸ð{šäH- 7kóÎcùB›žêÑÛu¢K?P¸d™Cˆ÷²üíä̹l™óÂÏÕ$7Sb˜?sª ÆöÛ‘"â -£²ç1ý[¦™dºã¡V¦Ø Ck¸ø$…ÿFs?âøó‚óÌÇõ&½#Èeƒž‚³’·þwc­0NñŸÍé–§ÓÂyN9áǯfø“_™àÌÝÄ×ô° -dùbóÃÜ87.çº:çÔÛÉ«9áÑòתÚv9[úŒ Æj,öÄ*ó>–U«ß£ÑzäyI b•x åFÈ{#¡{è²Ré!Fþa&¸Ïý87¿ ׳{øª0©ÏŸf¶’"ûÁaó)=Ÿß*æ- M±¥û±•îWG/Ô?V³N°ÿ_?Ÿ+&¹_䢎$Êü4‹ 2H~’œ…*÷“\Í`ü_òÅÕ¹endstream -endobj -4111 0 obj << +4201 0 obj << /Type /Page -/Contents 4112 0 R -/Resources 4110 0 R +/Contents 4202 0 R +/Resources 4200 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4118 0 R -/Annots [ 4115 0 R ] +/Parent 4192 0 R +/Annots [ 4204 0 R 4205 0 R 4206 0 R 4207 0 R 4208 0 R ] >> endobj -4115 0 obj << +4204 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [430.463 233.482 509.276 245.171] +/Rect [411.818 654.091 501.976 666.992] /Subtype /Link -/A << /S /GoTo /D (samba-pdc) >> +/A << /S /GoTo /D (NetworkBrowsing) >> >> endobj -4113 0 obj << -/D [4111 0 R /XYZ 85.039 786.531 null] +4205 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 640.541 308.036 653.443] +/Subtype /Link +/A << /S /GoTo /D (integrate-ms-networks) >> >> endobj -278 0 obj << -/D [4111 0 R /XYZ 85.039 410.091 null] ->> endobj -4114 0 obj << -/D [4111 0 R /XYZ 85.039 389.497 null] ->> endobj -282 0 obj << -/D [4111 0 R /XYZ 85.039 219.213 null] +4206 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [296.274 117.852 389.789 129.541] +/Subtype /Link +/A << /S /GoTo /D (ProfileMgmt) >> >> endobj -4116 0 obj << -/D [4111 0 R /XYZ 85.039 198.016 null] +4207 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [410.326 117.852 482.144 129.541] +/Subtype /Link +/A << /S /GoTo /D (PolicyMgmt) >> >> endobj -286 0 obj << -/D [4111 0 R /XYZ 85.039 103.781 null] +4208 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [128.678 104.303 153.762 115.992] +/Subtype /Link +/A << /S /GoTo /D (PolicyMgmt) >> >> endobj -4117 0 obj << -/D [4111 0 R /XYZ 85.039 80.463 null] +4203 0 obj << +/D [4201 0 R /XYZ 85.039 786.531 null] >> endobj -4110 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F35 2880 0 R /F11 2898 0 R >> +4200 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4121 0 obj << -/Length 3439 -/Filter /FlateDecode ->> -stream -xÚµZmã¶þ¾¿b|¨ tu’H½E‹}¹ô6Íím³R ÉÙÖÚÂÉ’O’³wùõ7RôZö(ŠàbŠ‘ÃáÌ<G^ð_x™Å~ òË4KüX…—ËíEp¹†‘^„"q%"WŽÌÍüâÍw‰¾ ?òËù³'ü8O.ç«_¼Ûw×ó·?ή”R^âÏ®Ò4ón®gQæÝþë§Gî¿ûð~z×÷³«Ð{à®ÛógQê}€‘f¿Í¿¿x;·ê8 -‡J¡2Ÿ.~ù-¸\âß_¾Ê³Ëh~˜ç—Û +?ÖJžë‹§‹Û¹xL_ò[S{UæÇ™:Þ|;›ÃÈWat™Æ±Ÿè”v¿è@û¶X-‹÷6ÀÞtêµ ÿ0¸)±y5 -ήÀ,K”,ji »äWaèÿ×vÁŒ:K¼ù†GñýÇ;hßr»¨û–_ïÊuÅ+—]/‹òŠ©·o*xåÓ^x™›ûOãÒÅ;K4?˜â*DKå´³§k<²¾Æa0FèCƒ¥ãÞAÙ¿‰€k­Ì×Y,ãß„‹‰)¢ÀO‚DDþ>1Ø;¶k¼TÃôN#Ù`ª¼Ÿïž¸‹LPv¿£ùʬ' -¬'rîF©ƒlýe§‘òÞ_iæ‘£ýÿswJšb+ºáq’Ò-ºÖ–}ç Ò• -c?ôÁYuåVà=Aä=£ÇuÜÄ“tÁØn‹ªÁvè½/úü¢ãçn£«’;ÂS_š¾¿‚L˜{OÙµuéL^ ü°ÁHÀFÓRÕ¬yê¡åþ•üòâHÑÐy\Mxá8…Ò9ì³.XÝw -ÿ{³ÁN;‚jY UÛ€Ê*VÞb?ãàŒƒ1(¡ý#„â±kûöyàÙŒ°]mwu¹5gÞPàûUÛ>í«Î,Ý»;ˆÇ àjJÃÎe^HÛ„-?/¦Nc§œb!>K­Ìå®ÑøâVž¶ÅS,±di\Ç8Œ ãñîÖ?‘Ì¿àèçÑ¡œÁhèç¸ÿ1g&iäG*#“$~äƒBÃÎà];SîZ%)9<‰5¡+AwÑŸg -­ È*¡÷fè:cÿ5u³â6žêЛÁè3<=z\¶Íž[›#ëþqjë¢ñÙ­2§á"‰C€ E[¿-¢<÷Þ?ñïϤيÏïa®¹ñ†e¢ ø|ÐñŸGþ}ìÚgëyäM8[Û ´àø =e‘ìk£ëâp%¿ì0ý -ßæ„#ÃaÀ›ëS‘IA¾DKqã˜TL‰'OƒÛí­ãeqðŒ2<@XS°òÄÒ&øñÎ4èÉò.ºÙS¦ÜÈ4&î°“ThyB -¹º.;“|y -Ái£(òîþ]Ù½—ÅÞaSIkA™Md[2뚟 -þ9@eì8+ìïd“Ñy _w-f·¼N@EÊ{BÆ%g÷ -›T¦ü$Oþ4¾-'1è”>ƒoî>c—PLtÒ#ÚQ)°;ðÞ@^Ùsÿ°)HBÜÓYæmx ¼ŸF$‘E¯²ÌPÉ -ërž‹}ä·Ÿ;q{^N¦ú´· ¢³;O(¿ÿG öBš™„3H= TKaÃ.@€éì)¦JªÛu+C9¥°Í™8e¹m>˔ײ /7Ú»§¼ÍDaiŒÝUƒx(nÒ{Ö„¦eˆR‰ý†¡NínÌÇYd·…m6kfxZÍë¥ [\ÌÈp¯c“f;xN3ç“A&å!Ðê3Ì!0x,×!­0·{‰ŠÇ;2»w–æ‚Í´=t…Ì¡ÐÞ›C)»¿ôüÂÒ(É^û@§>Ï/ÿÄÁ+¶ -ä†` ;¡¹û1·¯àlj ¥&£C£–´K— ˜þÎñÕfb»·Æø^JĉÂs+„ä÷Y ¸\W+‚0Ì)þ€«¯¨#cùƒö•N\#`äQ*üAá™ûº‘„Ûïß-wæp‹XOùž·Ó±t#R¬÷ê Õ!Á%*=¯ú(sÿužùAªIJ¹¢Ð‰F1&'#LÅ£e1‘™â~”všòÛ×ÚÛU³n²É¤úFæÊbýõÁý$ó“4±3¡þ`·ôhE¥áŽ~~A9^ïÀ^*‡Kx|°_á€ÀÛ3°Ýßq›8€Šµåȱk§XH6(nø– uŽ£qH078ÚbåÜ´wƒ™zçt`²(P#ÜN„Ó¨H"9´ìì &f¦’@I"1µ¼³£ ÍÑ6”oÞsUåÝýÃ[Ÿàó;sœ`¯ç… ™y¸;`PÀÆaF*8C¿ÜĶ¨ãD~¯š%’ ˆ¼'NR°½¹,tfa?æ&±òüìÌ ”EW[HE°Ö&Þƒ\~H®L|a[ãŠ&ÿc›1—§4m"^ðËæn¬Kúð+‚g('æ>Þì_µ¶Ç)ÞôŒ[0 X-Dw@û§Êð<±ÙZž”íÈšfô5÷ñºÐppØêHÓÂÂE,3‰òtÜ>´¡‰îJýB@ó±Ú„mp؉=áí*JG6º‘W¤™¹0|”ŒŸ|WDD1±íŠ”4pÜׂó0ÁÚ"£=]F甪(Ò”/üüD! =†Ôb»„!<ó³%Ð&ÿ0y&§óY•þÊmó^X¸š$—ëM%ùתþƒ¼W wqàŽNýØ´†{)•8J::1À㣂‰£`,&N4IǜԕOûŒc´=—Ÿ«~0¾†7F’Sˆæ bvœxL]OÜòLiáœË -E(?S÷r?04½ùNäøÔ3÷€ŒÑ¼kÛá€ó(߸Ñí–Ü@Ò,ãÆ©(ñã0;qŽÐiŒ3B_Á¸³ -Æ­7…qîzs¦Ö©÷SS}æ–Ã!¹cU Ų?‘—J[&•µtÄìì¿4L…»}¢úÃ^AÒ:Ø·7ÞE­Ìm ‡£àQ¸Í9z2¬:Áµ…›¶:€Î]‚Ø2SeH¨å°|³“«ßËŠGÙY¡£”v×”‰àA÷1Eʸ¶ˆƒ#âf˜§mF¦ÒÁj¿ÇÛŸ6dL°§•_[Șt2Ðá+è…a¾“4<:꣕¡l,¶±(÷ö¦¾K/›²)4ÇñÅ–ÒáÚ¦o.&z[¬J,Ö‚€#1ºŽÂñ#Ö{ <‹‹í~½!x=Þ*GslÂ1fM±Á¸ŒgS¯¸Ç,„m'ê µ´8€¡g¹4.ÌAÁ,6^%šØã]±(zšÆ-ìSõEš¿Ä2G©á™J"õÞÂ*´8ÎÞ›ÌeŠ Tþå!—7yN¢ÊÄ >lKl¾ñ®xŠA¦"½¿43G”ýèëØN>¾^÷¢óõ<þp‡Š_ËWξ­÷×`¹ãðàƪÉVã¹ÚS×þ)°‹ÂÌ#}ì¡Ó`g„¾vg°;Zo -ìÜõì"¤x{ȼEÁˆbdê@÷Ž Åò")uà¯-ãCWîj·,´ân v‘©`ƒr¼;•eØ€#¯‘NŽûšR`kQQÄÃU…p¸)}$Ó<E;Éñ·Æ–½«Z˜»YÎà¯}”€©©z#ÆÚSªH'~ššZn¿])WÙ8ö³Ì|N¥{Ivòщ>›ˆÂñþâD~g‡ÉŠP:”Ðê7Hÿ(ß›Ûq˜™¨ÜØ9½’2RÂï¢k?š›!>[²Òל¸°Âr%ó»"•,3mšy¶ÆmRS¡ËvËõµfåå&¸Íõã çÀ_ë´äLª*í¥.¨Ù|½Ë\(ÒEØù -Ó@ÞÉ#Úýâêð€žÇ¸Ò»ééÆ0k!MÈŠ?L5zTþ«Œ×²`~Põsï†EˆÕ¦V>ÜÛÎ',GètÂ2B_IXg”„u´ÞTÂr×»n 4e ^PL!>×':Šn¥3ÃÈ3aÏ™Ëȳ”Ò“ýÞÌé §yf"žw|lSz§’Êvp- -[ļ”>"`P;$‡‹fcÂ=GÛÚSíë”FæÙql–î¦&=-»jg>­Â,´o”³¨Z4kŠUÌ€­LRɧ÷)_§i÷UÈy2Må"'+8~¹&ñÃF€\…LLU¨FèFgbI *ÊÒA±W¯PŸþ¢ÝS!.3wQå Ýjp¨ÙͤÛ,¡L––âÉ·'l¨b_«É#†ì²ÿÓŸ©Ù“ЙŸg'N"ŽRH‰Ú(ƒ''¯6Îv¬ñÐÿˆ¢endstream +4211 0 obj << +/Length 3513 +/Filter /FlateDecode +>> +stream +xÚ¥Ks›Húî_¡Û ªˆÐ@ó˜›c'³ÙJoì­9ÌÌ–Ø`¡ÿý~¯†F`û°å*«ÝßûjåÁŸZ%Úõ‚t'‘«µÊ/¼Õv~»P±óáþâý'­”ç¦^ººÎI=W§Ñê¾øùúÇåíýÇïëMŽv×›8Nœëokå|½ü|ÃËWërpéæGß×~â|û²þëþŸï,$U ÿ½øã/oU²ÿ¼ðÜ MVO0ö\•¦«Ç‹P®™×wÿÎâ½pÅO-Ñ«ƒÄÕI0'X邵v£0&‚/™¦ëæiÉ* ë`‘ÙÖ~êômS×°SâRËÛUÇ¿™€ß}ýðþêó§;žu úySÊýŽÈú__┯]Ï«Ò@ˆ¶PY´)O¹¡˜c¶?=Ÿ_¦¼ÈMtòÚmäüº +•òÝ@ùöu߉æ²°ÃQ_¶ð* úPÈ €Mf +³ *æ•€V==[Ö8÷œŒÖ}'ãmSVx|…ÂI@8p +ÈÙŒËzÚ#V·Íi·çSnèŠþÃçow ´¥}B''Áw½¹¨C–'6 +•.%Òž”A6AÌxáïwžyLP™µÐ<ðïO +VòB[î*æQK:Q5æZLÕïIgìã£ÔùšUuW7=ï|@ôsÆŸjrÔ7€ø÷õ­9„‰Eèw Ôõ¨2þ„ÎïþùÆ(2a=Ud¸*v&+| Nh?Už1qï^ ~Âf%—\ó>ëî^æ}eTƒ P‘ZbzÞ7íóšD«^°ž(Vn¯šó²ý · èµ  :¿qÑ„ìoI™I”UQý0fÇQòøæãý—o¿‘÷å…n°¤ŸU.@héuÉêú7"”0þЖåÒrR@ÚB•ÅßÁÈ|‚LÖó¯=:yt¢Ãu±CfŠˆ<"Äc™+"^z¡s$. ZƒyS“6A0ŠtìÜïËN, A«C^ŸŠµÌõÀ+É_Ñ=#Ü—f×ÐpTib—r@IC8µ—§nʾ6ÀጽïO/L³z¨»2?µ¨Ë=Rÿl”e@öB^ljn•qLå;f +cDK’ßèØZÈÕˆVIŽæ5SQ±«¢×#óŠ©Л¦òÊ…£©œÝ¸l*Ö3SA6dIQ[ñ& ›º² Áî·’è£ëÇ<žë%œ|Z'!;®8rîÀyÃ=ÛŒ§ä/á÷ØÊõpTAžÌÆ£†âJe<;˜Kf´†ÓˆXó8랧'ç’{ U¸;µæ)0ÎG$-G}Ú †aȼ”#xž'5°4Ä̳„¶ˆÄS×/¨ðqÂjÛ&{ÁÁÄ#ä‘Ķpò´gUTÃ%T ÅÓ\H¬Ç1"‹FÙ1øùc#=^ѲºêM¸„GÈ "`OQJNžwÈK‰SdCâ +ИŽY ›ý˜ö3<;cö‘¶15®Á‡'öˆò8F  ÃйDŸU[¨u€“Nç?GgÈùH‰"ƒ¦­yné ZÌN˜ÞY Þ’â"“D! | 'NCò&¼kú!­“‰%i5ÄÙ,&wÌ#$†‘8ß:õDéŸì^ï?Ñ*vÓ-ß Ÿ› ÜT3ž>ÃLüCèÆö;!—•vî¨Ã<; éæyh½%§ÊX#rϼlRNDzžr²ÿ!‚«t–T…ÜXgÕ#m®°Iâjwä€H¸B}Éy‘$¬^$ZŠËý£/®-2:ô”Q²ŽÁ*ÊdžÍq80Ä£dk–?Àe# °áÎ^hd€©º¥FšÈÞI‡úy6_W½§ä¸iìèØÓqMÎ, b;zÒ3ÒmHÞ·ìfŸ$6v E»ƒ!*ÑO6g¼{z1€íZ¼˜kæpD‡rcºt³`U×ÔYÑÃíNhV‡oœƒÒ£v$T:À?xBl¢UË™ëHwM.…É]Åk!4å_‰/¦ œ¼Oì—ëªëy„.Žï +$úðøißÔfXI†äCPˆ`’ñU@ +¢f>¹ Lø0•Æ À¿®D;^xªÈ“ñd v}|àgyAÉ>/’¯g• ,k~x¢0Ô‚•ý&rýfÁOæàZŽhKΩÆ:ƒpÁ «›'Œrs,¸,L-P’¥U‡±øÍ +;ªÎ0fu=?3†|ÞrºùÐ؃ {`q{V·n¸’ljÊ Zn4Õ}! #ÏU¾~5´`(/óa7t!œZ •§8 +‰IÚ 0I S8ò5âj‚(v®(PsáÛ P¢ÈÙð¦4gGÔY\W˹I—Kä¨ð1X¼AÅób[(H}7‘:ìž”BÇŽxÖvdßSwyäE"QKê6šÅÍÃŽËD, 6~T¼5M1ò6¯¯xL&ø¥ä@)ñ)Êv@ƒkmR'=RêKžÐôapù0|):;ÖÑUK‰Árz#B¾$É‚1²K˜AL 6ÿÀ«ÆQáXªSŒÌÄ\ê¸Í‘ñô–È0.È[ò rÅ—NÏŒ~1àƒÎ™Æ„I™¾^q +;Duà­v·âÁwKy ôÆŸkÏù™È²C§»#‘œ0„PAAf3aó-&hWó*q£8Z‘Ó/ÔP ³±€j¨³“8Mâü%p£ ¦:ÈKSËÀ;QÙ”Kµy”œ[Ê®nÏnQz¡“m5dÝTcåßÇšs S“erÒù±Úò²³~)ðY'Ào GÇé"GdcÁ ÎkföC…N6Aþ[„䇶d#9ë:0ᬘ‰)òÝø ¤ Ì «©˜¢Äõà V÷ûJºÆþ(ˆÿ¤û—™¾äXbŒ6c}çY‘Ñ!\Îóæ4´ `b(ð£iK¢¥ƒs‘–Eyì³-%1| ÷#êÓ˜~’Jií¦~2Qp6ŠÄ# O”QxgÜèû•s{X ‰Wy1°}Ñö¸Ö¨‘ÝSñŽ;¶=‹«ãj7i`«.²cžu^1¨ q=°Ï” PdˆÒ:¿ìFzú_xMö™‰8é1õȸ‘ F— +Rl€+ʇìTSû‡mME®Â7g²Y7H:^âŒ-»üÝj ˆ #ŽöïpNy`Db-½ÍZP[ì $ÎÖ=æ?<ÍÏÞp‰¹°Ð¸}ÕIaŠÝ‹ýˆiNýÌGÕÍ®âôžzpé¾á#ýBKÚ Æz´äù—k|ú»ÍžÏ; ¹,â‘×Õ[Þ34ý|cΆ@ãqVhõê«í‰Z +/¡¨ Àõ¸Ee£)Çdƒ#ÇB Ÿ'NÓæ„Oúé]‰_=P[T\(@Ä«o®(y–ãH€3}[¡ížúÁ횶"Wl…¨ËÁµ#Åu1Gak +WœŒ’*Ü<¶ïA*™èW=¶ó¢Ç60È/SÙeOÆa²ËÛ5uEÏáVNÛ#çûxjø*vf†Þħø‡I2ÁOâ¨>ë%‰Ÿœ»ºô€}RCI[ +ŽögY¿ã18p~% +¨lyŒÿ +Þ¥K+ Ec|¡ðÇ“}öŽ8ïèá%ÇeïF¥1%û¶FJïzƒzÅê€ê{x”RÇcÏkƒcn³¢Ø¡§} ì°E¼Ÿœ$PXBÿ‘ +Ó3÷9{Æ¢Pì–ü9Øk©ÖÅmº ¡9»EâZ +i;Þ°˜|ì†ÊCÙ~AeÒ(œÔÉ”IÈÛ‚¡ïŒW¹©Ó´ýÔ‰'ƒRÌ¥/YØ(}(½XúK/ÏÕ Þrë;Œƒu†¡Ëìy’ 5ràw)]#8Þ6^Vé% ,>}ã+t\?ï,H¾ð† ‡N3Í&xJ!D¡«be7—ÆŽp(}ºNš»z©]ÅÚ&sþö½ÁðºKv8|ΤRÏ´‘ÄÑvA0(E³†ûÜ37RÈG½”~uZ˜ +kø©:ñÆ×*o›®yiÞ> endobj +4214 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [485.279 376.196 539.579 387.886] +/Subtype /Link +/A << /S /GoTo /D (pdc-example) >> >> endobj -4122 0 obj << -/D [4120 0 R /XYZ 85.039 786.531 null] +4215 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 364.768 109.672 374.215] +/Subtype /Link +/A << /S /GoTo /D (pdc-example) >> >> endobj -290 0 obj << -/D [4120 0 R /XYZ 85.039 686.185 null] +4216 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [522.435 102.224 539.579 113.913] +/Subtype /Link +/A << /S /GoTo /D (passdb) >> >> endobj -4123 0 obj << -/D [4120 0 R /XYZ 85.039 665.192 null] +4217 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 88.674 313.187 100.364] +/Subtype /Link +/A << /S /GoTo /D (passdb) >> >> endobj -294 0 obj << -/D [4120 0 R /XYZ 85.039 538.238 null] +4218 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [128.13 64.578 276.157 75.986] +/Subtype /Link +/A << /S /GoTo /D (NetworkBrowsing) >> >> endobj -4124 0 obj << -/D [4120 0 R /XYZ 85.039 508.834 null] +4212 0 obj << +/D [4210 0 R /XYZ 85.039 786.531 null] >> endobj -298 0 obj << -/D [4120 0 R /XYZ 85.039 105.893 null] +206 0 obj << +/D [4210 0 R /XYZ 85.039 460.125 null] >> endobj -4125 0 obj << -/D [4120 0 R /XYZ 85.039 84.697 null] +4213 0 obj << +/D [4210 0 R /XYZ 85.039 417.172 null] >> endobj -4119 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F11 2898 0 R /F20 2865 0 R /F14 2895 0 R /F35 2880 0 R >> +4209 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F36 4184 0 R /F20 2961 0 R /F58 3360 0 R /F37 4187 0 R /F66 4190 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4128 0 obj << -/Length 3338 -/Filter /FlateDecode ->> -stream -xÚ¥ZëoÛFÿî¿BÀ}D,—KrÉÃõ -ÇI[÷‘øjŠC¯(‰¶ ‹¤JRçø¿¿yí’”)§@ ÚÇìîÌì<~;´ZðO-ÒØt¶0iâÇZ-¶ÕE°¸‡™ï.”P¬„d5¢y·¾øêÛ$Z¨ÀÏ‚l±¾sûdgÉb½ûÍ»úþòfýá—åJkí%þreLê½»\†©wõã¿oxüý§Ÿ—Ê»¼^®”÷‘‡®>}\ÿ² ÷ f~Zþ¾þáâÃÚ±3bXiÌüqñÛïÁbŒÿpø:KOÐ|•e‹ê"ŠµGZúû‹Û‹¹½x.Zðª9Ùcúqª_ -¯ã‘ð*Ìü(‹& -ývB韚öñ¾mŽ‡å*cïkþ¹½ü4"Áö+…§gD½kª¼¬™¦Ê»¾h'Ëêæ köÍ}Sw“5ÏE‡‹¾úVY]%~h@øAÊœâ‘μþ¡€Fx¿Ýï› è>ßÿ¾êðbŠ-þßÃPÙÔLÓÜ ‹è”©B"í+`3 ºjão›ún†8ðe„Žö„½ñ ËË;<ùý•Ï½õòÐaGžÑ– -éö8WpûÝû+a³ÞÃè3io‘Ÿ˜x¢Ä¶¸/AÝxJ{¢†:¯¤·»+—"„K ÊŒÂD¤øÇŒ˜©¥±ÌÿMmçöÈÀ#!ùçÌÀs˜Z‚§¤rûëõÇ[â+kÿGÊiÑï’4W‚¢*Ö HC 7-]ù¾¨˜$ïXgÊ(p€l¢3«iÚ"¯èDH¼[tg1òÓÔ×ú‚š¢¿¨¦ÐckP('ò”óÏÇ¢wýé;±'¾‰M¾h¤ Éòž;vuE֑רϞWô Om–+ˆS²˜L‰¥h‹¨/™t2Qß7z†5©öª¦-¸ÅG×ÜijÑp™o1’å×\gœioçØk€‡¼Í™ÏžÉœuzol˜À]T>Ø;Ž}Í;ÔÍîß5-lA®…,¸ ‡6ºÖËXT7 ™0ËX3A0Q¼b -šIfþ´mföa‹ yÍ2”oœe<=”[¼†æ-ïä—Ž¨þò£H(2”æsÒ-S‰Ù@‹,%@Šî;Q°òØ ±·c¡zYS9A1¸X4 K7¸¶¬òöYÒ¤½DÌ ›bÛìÉcíQþ™Tg)©æµÜ>¢¡ôÂläƒU³æB_«p§¡oÀûÁÄУ Ø©*Œ#È]b¼mÛ,5@wŽÙåUvbçä"…¬" -‰ËnäE¥tìoΆÝæÖŽí׶ÿ$”îóÁ¨qËqq#S£Í -É­/“7¿qÔxæΫƒ»6Ë5&¼\Ö<-%¤`xÈyùK‡k‹;r,°‡¾¡ìy?ҞŇŸpiÞ‚Ç=O°LÐ@ûb ÛQØ#w×û0nüPÊH' ¤ÀtÖÐBãÇyýfghÊÏâxr³*ö“t°3å)4¶8ð~†`ˆ˜Á|Vlt—Ûms¬{«Ò$ñ—TAº€ùâó¡lAoyò‰6 …Co›‹é^s×|sN@¸Á“šó¦e@2L^³–3ÈÁ ¤á½µ«Š‡ŸÊýÍ!Ã\ —µ¥»ÀËk…ࡨ'8¿=¶<&³Ù€«è¬¼ë8*)ÌbHøß éÀ²*rÌlãÐØ6‡²µïˆñjl¦1É®qÛÛÒµXòø©ð¢cÏméÒ.åZ’ͮǩñ—xè=†"Ns„k!câå~ðŧƒ]¥ŒÍÙyNe=pAì»~Æ#s¾—/Æb…(QNÓäM»ÃÑ€øÖwy?R0’“‚±AA¨iK$«7Vpê¡¿"¡SWNTŽ·C‚%󙉓Ç*…Ǹ·H¾£—r[|bý1 - jM|Ò*ѼsREG1ŽpÆŽç‘ÂoOÆŠ­W–#OmÙ;mU‚qÛñëà -Äí4ÂÛ§ÎhqÒ­=wF´´¦+1}¢f£„Ü÷LBÎ SCLG ŒÖ¸TÄ œ9­0”lyÁ©RqŒ2,üv}ÞʾÁ±)Q¡ÛÖ¬Zw¶e¤ìßt3‚¢ÊìØ3²Bcá­¢CÏíÊ%è]pÊâWZB7ùÄü”˜} ßä äõŽ©º²ÞÊ˜Õ ¶WR®îÉ´°A2Cÿ"kr8r¹‰‘êCBíaRæ?‹˜iìßå4‹É# mVLÕ™[„¬Ø&ñâ8l@ðÜïÇûÒ£]fú¾¨½lL 8ÅG?ÐlL/l  %öŽ¡=o¾s ó:ãtÇÒâËP› ‚Aø‡tœµsìjھذn|øš3MÈ·EPõ(øáïË £DÁø,Sì ‚ã$ýæhCuÏûÂÈnÃ+7¹Ü¥h¤š·ìûÝÑZ)’Ò§[öö„}]^qß…VÜ«Þѽ3L)#]ß“—"ºJ8é$à§Ü}>D2 -½ŸÞcçòFf#2Maˆj¤]äNŒ„ -o¹EÎBrÿŦft±õô¤/ÇÂyt¤#x1„é«èhDsþiøàcü -þ»bµ&Þm^O(rj¶™„Ÿú0Èàñ(àÏ\˜,)ÜäžÅ7ìpðk‘àÇuÄ›÷WçÀ ˆá_ƒ#šó`P™o þZöŒoµ>ÍÐ +34ê$|Ë­š_ZœGò¾t&}”±1rfPD¹ÍÉ9iŠqh?\;㩇©1k)Øx¦Aél(hâŒ/­éîHññƒwHRUŽƾG,Œ0«(T\ú£ ñòq —¯—ðT*Ðq²´ L{Ìx¤}Ïà %!ÅÏü]Ñv¶n¾d]÷•<„ñÆ€æJv{)—Kô.9z÷£øMFG§½åXKÁ­Ÿ¾¶&lóNò°m3ð(:[ìƒk1ù£e÷@è|üÞïä¢5ZÐÙøí,1L²×,§µ¼E)‡Gqh x™†iS±Œf´yÏ@ÐTqØ—¶ö”÷㦺$sÄ#lD’œ:û8*û|#愤]ß´ù}ñ2–34¨Hð×¥•²bE=Xí³kÜ·E7”yvKwŸŒ¡Ñ5•X—Ó*î`…§Å¹šÆ ,Û—\yÂ>Áá ; ±mïÆ:uoó¹ûäÈ àâšË ÷…ÔÜ«Ú›á‡üÅ¢›„,B*eëóEaY[ÎC¿¸ OÉÿ,á!Æ@ÒçU©MX¥p7`ºF†¤Ãnh§Wg“r5}ùPÙ# -Cz‹†Z> @ŸÞ!¢Šh1äŽrŸo¸Y Lcý\…Þõ¯ro,Xyór+êŽÂvçÞ’d1X³®¤ÀÒˆ=»] ½‡ó?ñìBáJÆ•1lãW¶˜Óñ`‹Fb; €¦¶¶Œã›B³-l%n¯sĪB1,ZOŸ ضF¼!k6±s`Be\3~5»Žh΃ Ô&ÌÆ`B ˜øž -•OœéwͤäbQÞK©°êé®Úл^ÐþŽI\ÁäfP©ö£àõÚçˆæwvî3†™58m˜Âø½¼3g’*nõ ‡ò5ǹ&ÛP²³ÆŠÈ!3ÞÉ{øÔ[?ŠÉ¿á›«Làžî‰—×÷rL)ËÈšk;X “6œÆj¢pza‹¦ ÑôÌ£RH`D·A*ŸTÒ‘n¡Cö‰Æ¹›ñeCƒó¸~ƒ·üžtŒ’­à£É_0˜À ¤' á™›»žÊÐ,çî¶.¸RÅ5²œWœ;›Ç°Ò)#Eht.LºJFP•8æj+E@H4²9  –êg†c4=.‰ „Á’^iqŒHWsÂm; çÚ`éV“Ò°NH=.å©Ä]áÒSè,!DPõ¶}Fv‡¬SÓ™¶u/m«bÈkëü@Ç’qÇ…{TÓ -üX`¿U\ i¸)¯Ü¡7ÏX‡°g ”à ̉OA³É¼›¥À #6m¬=âØŽM™ãÒ¤RMÀ±Ñn¯K²óÞ -´m÷\o1”I›Ýp5\YëlÀ7â -Ýw8ꥄŒ­i×K¡àÑû3rÞòz„¦¬S4¢;ÚÊ7fê éBä ~#Õ#"£l¡µ8ôüÅ3IÆÉ"‰|£ì_a4õþyæ³h¨ý4²ßMÇÊ€ÄÑR`&ÑïÆ_ÎŒ@=¬- cÊÖ}f2£h ;Ù˜ë˜gHS?N¦>ùšcü’3¶8­£Ÿ-CÄ~Ätšbƒ…ô—þhÈ%ê(õ³4œÏÓø™+1‘e%‹Í)Ãö‹^rüÑs -ãendstream +4222 0 obj << +/Length 2317 +/Filter /FlateDecode +>> +stream +xÚ­Y[oÛ¸~ϯðËbe VD‘º-pºmÚ¦H“œÔ8/Ý>0¶l ‘%IN6ÿ~çBʺ%Ýb-`‘Î ‡3ßÌ0bæÁ?1‹דÉ,ŠC7b¶ÚŸy³-¬|<†baHšß—gç‚p&<7ñ’ÙrÓòI<7HÂÙrýÍy÷éííòân¾R:;_DQ켿™ çËÛËkž~7_§®—øu7÷cçæjþ}ùùìbÙªÐQRH‰ +üÿìÛwo¶e?Ÿy®LâÙ|{®H’ÙþLÒ ”4ãüìëÙ[^¼¦f¼kê¼–bá{näûcqQqr NŽÄy³…p“ÄŸ’$üÈU^ –uƒ(ìR [Ý|á»JE°%]_.CË°T–oãâO°²Þ£•ð•§x +îEº0¿ mcØÛ4ÖÆÐü@›'Ô¦ÞÏýȹGÑ+T©,àkÃ>±)+þ¸Ÿ/€(Åõ –‹-OkÖü¦Þ¿ª­„pEL©=¾hCûºú‰p=¶o€ #í¿móòÍ™GùtÉè ­iƒ‹YY³¢…Þcÿ‡ðûÅÕÜ]âÉÞ^¿Ÿàñ„PVÛª<ÎñÆh£Ùÿåò=î{7¥³ü4±ý ëz}o­Š®ÐÜȔ̉Ö^÷xæknQãªÞ¿áÉí1­›.û€¸Ûƒåé#qÌ{§“rJ¡ +˜“èýÀ™*5Z_êº1+]ÍžIF=Át]îuV?»9/Á»bg¥ó–noÒ)¸2Ť¦•Õ±Bÿlô¹g‹£5)pïN‹Uõ| ´ ?Y‹ú ï«D­ëlj#c䰯ܖÅ·¶¶b&"šµО€È8…CºarõÍþ3U/h¤Ði©~¹žà#"×ä‰Ïº2´$äAåžP9ŸaÀO*ÈâïóûåH†XˆXºÊW/Ùc^š=/hC9Ÿ~{Ý;T—Ü:}Ù˜¤ Oþ”1wå>5.ÅZU|!!)ð‹CõŒ1¼¡ÀøûLž²½§¢KâCö=ET/ª^Y4ÈM“ˆH8.Qì×Öà6½„ù|+,œ4Öé¿Oâa«»÷óÇy8ŸçÙýy­9'aœ†³ô1¯*Õ´Êe>÷Üâå {ª²Æ¸BžÕM/4‹¹Ÿ8^ï³bê'³æö¸õ¿rÌQPýÔYÑöåÄ®UE*’2&ó|è©æ…ž7ëeºô†0ЀêÞ0hÍæEÌ`¢V”¸¦Œ¦Ê4.TjâŸÕ‘‹B œZzn“åQ”¸,-¤’®žÊ ßΖ†Jµâ‘LÀ…ÑÞ^y>†PøHŠ PYPÂ2Ù©W¿y1 #|\¿š‘†ƒjRBÉ+z*.wx±žÉYU8”< 4qåb× H@Ú „c‚߃í9 +lÞQÑô)áÝԊ笗ÓéMõÊâɳ| y`õÑ•A),Ã$$hŒæÇŒ¢¤Ø›Ò ¦(z§>¸8£bÍ$r噲ݿɊmÍÄÍN›m»4?˜¹’7z•åTChÂà±Ê³´+«EÌÄ)§Â¸¢(Ë8×Ã6Ý–v=‰Ö‡@ð8àP ¥<‡a†¼æJÁõ`Ó@yÁ0WÀrU²vU™óŸ¡ÉZ„b¦–yÊ•MÊ#ÀWÜ}*sx~¯ ½M9mÚÓ#ó M¾k£×¶¼Âæ2”ÎmÞJ™Â²­íØìð»³ð¤»åÏÖÌf«e'Ïl¶â™v{ÝIðÍñhÓ™Ñl—ü:/ñ:nth^Ä Kƒ'¼¾X^Ý Ð7Ø^‡‘ó•‹±"j"b€.Ô×T±4#]úetxRø=e! Z-@1V*ðÙ.; CB ©¦ò¹æͤ«Ž#TÔpñ2dnvSÕ Äë¶âÒÔ.ò¬øÔà„©•)î£~aÂA¾G‰÷×i» .œŠwp<åC¶ËjŒIý6­Žì,çYYØó 7T užóÇ—lU•u¹ixh+züîD[Þm ¬÷£—fŸz¬M¼NG¼í8ÏhzªÎ¨Á©2jShð¦CŠ 8M›Ýé°GÓ³ÞR'›g+“ÄûUŒ ¼ëå»ö!i¶ø6p{skâ “iCþÔöd¹iÞx%h•¢æ.b÷AØ[ lv';.d¤Ì;Ä~O'‡qà b™#ï( 8g@l=c>˜0΃"eËSw c~Ñ€[£2Gc}jCIjHp›„îÒFIfäó¯r´Ñ Xw"$£ð€%tÂÉCÙk»pίCì`/á—H ßò_…¯É‹èeHP·Û»›—W ñÂ@—­Î{Ð*WAKñŠ–d¨Æ IÜDÄ]=8”U"8¥åØ•6²hDé! + a·ï§µ5ßïeÒÏõ‹oŽãÄWÎEû °3â†Ü¨‚ogžÜ‘;ÚNµÐŒpAä†^øã[™RLgFœ¨8’ʆ‡åÆ®g,^! ·˜Ç™8 ÑŠv씵Ë+öÌ,Ƈ€É6ŒpvL¦ )i¡ïÉ5×¼j3qO]¸™©—F~¡Ô}©¨´0À7=MÎÿ̦ùQÑéÍL߃x„Û8„ÜJ勇—Z dúá|` ©Øùß øÊS„lÔõÑ>Ä*zˆ¢£!ͯmÞꆯ›Qäúâ& ÝdêizØÁH~d™ê_,¯E‡Ù8B*ñ[‰ÔfvÊϹàeuEè¯ìr2Œ]«^Ê¡H²ðy‚ÎÎ3/®dEëú”êÖLÉÀé£÷Õ<ÓQNeŸìË1¥ ˜Ž%—<䟯[4 ؈g­"Ty4Œá&ñEöÉÒ¾©ÒÊ.x—› 5/p*[ÃÂHamæ Nà7}lÓïÂdTà)ÃÐsn6Lµ*¢‘òB61a lüÁ'Åæ˜3=åW+Jc µÏ¦$ÜdEÜ6zuÀIrm¤4±cBã…ßò`j¨üÔů ®l'1‘_l? í5ÿ©gܾ)ÿ¬}·ÕR±›Ä/8àtBh”Ácr¨p cÈwrBã¿"›endstream endobj -4127 0 obj << +4221 0 obj << /Type /Page -/Contents 4128 0 R -/Resources 4126 0 R +/Contents 4222 0 R +/Resources 4220 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4118 0 R +/Parent 4192 0 R >> endobj -4129 0 obj << -/D [4127 0 R /XYZ 85.039 786.531 null] +4223 0 obj << +/D [4221 0 R /XYZ 85.039 786.531 null] >> endobj -302 0 obj << -/D [4127 0 R /XYZ 85.039 598.606 null] +4224 0 obj << +/D [4221 0 R /XYZ 286.841 769.79 null] >> endobj -4130 0 obj << -/D [4127 0 R /XYZ 85.039 571.991 null] +4219 0 obj << +/D [4221 0 R /XYZ 85.039 376.337 null] >> endobj -306 0 obj << -/D [4127 0 R /XYZ 85.039 527.507 null] +4220 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -4131 0 obj << -/D [4127 0 R /XYZ 85.039 506.31 null] +4227 0 obj << +/Length 2558 +/Filter /FlateDecode +>> +stream +xÚ¥YÝÛ6ß¿Â÷t2pVDQÔG}ØÆéu‹Í&—øp(Ú>hmÙV#[®$g³ÿýÍ)Úk'A"šœÎ g~3dÔ$‚?j’›0ÒÅ$ËÓÐh5Yîn¢ÉVþu£„b&$3æ‡ÅÍ«M:QQXDÅd±vrŠ(4E:Y¬~ ^ÿtû~ñæÃt¦µL8eYÌßMUðööî§_Og*À©‡Ž>LãÉ$†cÃpYÕÀ Ï~%ƒz¦è·)`$p€¶àôà‰†SÜTŒkvè[£¯6²»—¹øûc?ðhWr^Êvk9ª—Îصèxàÿ%¥ÂîÐÆ8S}94%îJážC[R˜P%éÄCË¿€½ð*‡»¢ñ— +B¬l=¸Zk "x;ìŒa5 5X4ÖZÐiÀ6ô˜ Èð_ð±Ü=ÄeÁíÝö‘apÎ.,ñÐö¼þºÝ]Û\©¶VüWÕiâÍË– Ÿ¦J“š žùc9Ó œqÝówßÿÀQС®xvYîelàq¹´Š½‘ ¾ipK¡2}ýÙøÌÑì®âÅ#ë™…|¬:¦ë?“8¸.íÍBi‡¡£Ê!ü±Çý’0˜–ËÞ)ô nÎi…ͪùB«, Þã¸Þ•¶8ÈôÜ"L–rç›pã!6d„; AÅÔ‡Ž¼ÆdÙ6=oJE¡c’¾eà_Tüà‹Þ³BÖG´t*@J#•[µ.—¶c1ë΀%ûÌeÑ™ã×hNNæ ‡O+nlK)½\ù¤úÐ['%§Ù5È‚«•Tyá*å `"Å´vÐÈec9:†—f>–}ÝcìÀ™¼'µ9.Ñêz¿:xx·à ·…1LœæL ÂBb0ÖFÔN8ø|ü].57z˜i\¡Vö$X²«ã+Þ™üd%…×3ÿèKDåíP/%IçÐÔ6:³ðšuÆÊ¡ I),5ü»í˜”*|©ÏÀÁúˆ|Ç®ÂÛCql#ÇGÜg‡ú<âh†{,\u†¢Ú•N"pÑ·£­mhâÒ0zÓiüE\ÓÕ;qfZÙ\2¿*‡#á ·³$âÃï¨C„yD ¡Œòì] )ÎjKŸë–d‚åi’嵶_?L1lÛ=†7®¬yoé×<É^KªêQ ÕHݵUE9oÀÌt4Ør‘Y×½€·•k–'.FÏ j±Ä4ž;—h²¤D~¬cjn “¹h%1„áù±kf/÷²ë ”[Ûð¸£IeÏ=ÈŠiž¶V‹=s[1‰Üþ±—þQ‹F;ÖMÃ#A¦ 1²d¤=8`0¢Š“`k4¡§¶’¦±î¿C +¼µžž*·‘´BêÝAÜYc›´¯¤ºýÍêgaí +õŒÓ\ciÃ^`äJsHõnìÕgF)©3¯#[má91¥¯7{FÚŒ± ¾hwÇAQÛË ðìÚ~`¾xe®ÙÄU¿¶žÀŠ#,…ûm½ìÚ¾]ËÏÿb¥Ú¯<”¹Ü±?, m¨ƒ,¹©ø'q²KmäÁìÒ–'¾UÑ- çÏò.— +C5J©&Ø>ø©4àüö4Za©¤À‚%ÉdlK% +tâ '“N¿m¾±Öcó¤!¤Žè8!LÓóÎlúö<{4Yò‡\s¤êg>Þt,™ÎWó•”1Z]dËuF'ÚgÁ“ÐY‘nîšɽ€¡Ù ÓX­¤æ¡öžwà Áp2cC· ußÄK'å×c3ÊÆ9R„BD%+’ § êÊÇØ‘òï8Š¾ø¡ÇwÂ/¨RŠ~û…4—zÍ«ï~Kœ€²\XP¶íÁÇÊÂZnɵ\ÝáfƳÊ8××'øGW¸=U¸Í–)Ö˸‡ùˆ8¤ÃL×%ý +¯\_b¸*þêõÅ£¹zËŠÓ&–[–‘[–ܦ0!j¹M±©0x¨†)ÄæþÓN!òºO¼pÆlÚñö…%xsìJzžãêrÍšT‡Yú kFš«—±.l©‘zÌñúLÈZc‚?$Fx‘ò6ŠÁ(ž¤`…Z2*’ +®‘‡¹{ïõ$J\‘ˆ¸ñ¬¹E8öl+æ‡æ°b¥ekÑ‹o1;K<©¥ÏßtÔ¸\ œ1Þ©¶ã;£]ïwV$H뫽€«IZ{5‰ª7ËäÞœaŒ_U’cÉŸ¹÷‚ä]†ô_‰wUdaGþµñh\¼»·c+'‹C­‹1ÞU 0èRæ§Ïü„„nc=’XO%ˆ­^V×ô΢0úÆ3ƒGs5²•ÎCUÈ=›ÞuA¯Ñ¡êÅ…yD†*‚yz«Â_·Ô&!1¾Q6bš¶‘ æÙ¸ªß"¡½¯~4þ£wœ&až0îä½Ð¤AÓN£AnÏl'f*Lc-\Ö¯¿(a;%/À×ïö£ºó“6†ÞµNÃ$ÍOràòÍ{¦Uê»Eùm¢¢†H.bÖ@ÿT[9ûPŠÿ +¿¿çÏ/ØR âÐiÎÕ +AÜm¼´ 0=÷š3‘þú¼3C‡üßabÔó·‰û{yT&9Käþd‹/e!µ¯®ÁH.tˆc–ž¾ú>Hó#, Nút†ÂáZrk&ü_ç9Ù¬¿ôŸb.Ó’<,ò+%ÄÀÕ!Í« Dr®°44¹¾ ñÿMíÌ5endstream +endobj +4226 0 obj << +/Type /Page +/Contents 4227 0 R +/Resources 4225 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4192 0 R >> endobj -310 0 obj << -/D [4127 0 R /XYZ 85.039 344.328 null] +4228 0 obj << +/D [4226 0 R /XYZ 85.039 786.531 null] >> endobj -4132 0 obj << -/D [4127 0 R /XYZ 85.039 321.011 null] +210 0 obj << +/D [4226 0 R /XYZ 85.039 553.022 null] >> endobj -314 0 obj << -/D [4127 0 R /XYZ 85.039 197.555 null] +4229 0 obj << +/D [4226 0 R /XYZ 85.039 517.711 null] >> endobj -4133 0 obj << -/D [4127 0 R /XYZ 85.039 176.359 null] +214 0 obj << +/D [4226 0 R /XYZ 85.039 295.912 null] >> endobj -4126 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F11 2898 0 R /F20 2865 0 R /F66 3242 0 R >> +4230 0 obj << +/D [4226 0 R /XYZ 85.039 252.959 null] +>> endobj +218 0 obj << +/D [4226 0 R /XYZ 85.039 197.715 null] +>> endobj +4231 0 obj << +/D [4226 0 R /XYZ 85.039 162.969 null] +>> endobj +4225 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4136 0 obj << -/Length 988 +4234 0 obj << +/Length 2549 /Filter /FlateDecode >> stream -xÚ¥VKsÛ6¾ëWðVpÆD ‚àãÔ‘e·MšØnÌ:i°Ùœ’‚KBÑøßw Òr¬¸‡Ž'^pw±ØoŸ#¢~DT)žÊ:*«‚+)¢u¿H£{°ü²Á# .É‘Ïy³øñç"DÊë´Žší§N¹ª‹¨Ù|f«_—7Íå§8‘R²‚ÇIYVì|g[ýöÇ é/®?Æ‚-ßʼn`W¤Z]_5Ÿâ¬d×`ùiÞ/.›9£„…”˜Ì?‹Ï_Òh‰¿_¤\ÖUt€sÊE]Gý"W’«\†ïnq»ø}ŽE¶<¢[§°+YqUÉ×à…:/2ɳLD¥R¼ÈK~9ÆIV–lÔíOÓ$¶æ@×¾›à{‡‚TmÁfsšªbûчÝR÷ö6\ë{°èÈÂKx -9` ¿±è>î.ä²uðþ+J£ÃaöÚ€–gÃöè5¶ãÃîB"ãîG‡í‰’PŠD`=k_¯×Éîñv#¶7e‡¶UYÍî-I»wá°EYaú‚=áÝõÝŒ×a¼Îµ˜ÿ=]³—šÄWbx¢8wCœ™õE×¢Ì%k¦zâK½¯ÍsY1Ø- ~qÔ{YI^ -ÆQï¬#Ÿó‘LNÇ ¨ïCc ìfãóÉYW’y °{j§`3jP~¸Àž,ýe`£©ußY!¸(äÛ[þìã=«àµR~ÐEƥȢ¢®¹”´æÏ9¼ ¿¥R¶ÒXé¢`ïP”lcéÓava2Ñ §1ãÁ£‹Eð"% „f,o~úš)‰·ÐùœXÛ MYñ2Mó`¨ã”’–GÌ5Xôn<`íÍ@ßSž+öç%œoÃLÝêÝîp~É÷1Ì“õ7¨$̆Ts2ÿIl@9åiZKB¨ä(ÖkôR¼Èä ôf¦)×uþ© {,°¸ý.€F€~27Ó|¢»³¡Z$ð‚™+Ù®5G–æÐñb1p²«0Ù)ý­!luà½ÛÌdÒU7Z:mm‡£e±ø‡‰;¶füÄùÏæÄFÐ:À{zª5tîµ ‡­G·v¤#i¾Îü:þ2ýåìzÚ‰Ð2ÔøzöùK0Z€°¿œ¾ÎÒÑ´?̲ÑæÌDÚŒ–~yvwöŸŽÏ™¯:¯£˜¨ÀO”:Þ.ÉÙN¿ØNmŒ&¡Ÿejh§P%¾ RЬ%qŸâå·“M…Ê7&%Qì+³7FõŒá¨ZãúhÙnPËÐ*s4€»€eB/üé¥Î(;…µ½Ž¥šïHó‚JÓlÆ*ñf¸õEª¶ÐZ²O,«š³ñˆrœ/`z»âaË’„¡«Ë—b›0ôÃ$ûØÐBûºøYè!è¼ FÒ^•Õ ÕY~ÁýÉÈèÍ.ª-¶,k TÕªÚ6,óÏ<úÇ8Õ^Þ|gíÆ6-^Ô!‹ÿ ¢VŒ0®d +å wn«ÃÉ·W— ¬ݾà~AÆû~FýÃÖ‰/l‰#±wi›œ[Õ’inîøû‰²Ì¢§†Ç~ÿÈ´ï(Kmdåõ¢øŽt¥JP‚‰ý,ŽÀààQrÈ«1d¦SlhQl¸%Ô‡\:­›€Ái=6#ÈŽYQ + |f#“€õ 7¢Ö!B ~ô‘*pÔL’’x£¯#H¢&Ë4“ôÚ$üþL4pþ~Ž®*sÔ“TØNz|9Y§=ÿUA•á•&QѼF§Þ§®,8ÊÏÈÄ8¿71Ž’‰1iá,€b‡iƒæ¶UË5æ¡GYÑ®¥aatV”åÂg™¬˜ÓÿªBxÚí37ZÌhÏRìŽó¹i”xWœ|‘;•â5ßÕYùðÄÒºÊ +rìç õa„±÷_ÔCYÜ£ˆ9Ö‹XsÀâ!Eé(õ²o<ÎÝ›] +>>Õ;>dÖ랊N5¾l*n1<€t”³·•ÏRYíü^Š)žVÍpwRÏœ‘#¤ŽmÉÒé$€H!Ö‚/ê I£ðE¤³CÚXr"çÖïB†,qºçÞ·FOÁWÒÌURÆS ¦¹˜fÎÀ0rÝ·nœu²ÜÀè7?Q¾[b³³sÀuµÄ\ „…»-ýЛºÆ uªàĶu-ܱáÎÚJcÆ@/ öÖx€fÂÌôb…A؆'dNlXZyÏ\XÕ0 +¾S’/®¸_M+|éFCù¦Û²V[q-ìP¥è³¼C¸œz3;9ö{Šûo„:ŽÒ35Ÿ´nxÂI`yl\DÕÜûºs¡iYѲÆ6÷]×€hÝy÷ÉÄðå£ÜKPÑÌš´­Þë•N¼÷-sžÛí?y`oŸ¯ CšÞænÁ’Y-)ZíÐ]aÏ$Kл 5»Bgò,f᳄~ù²À¨ŽrÁ”EUrJÊ’¾Ú`Š¬_-ÇýrCW‘*6É›o³«Ú‰ÂNwY·ç”¼oŠy]5Õ²¥ ˆ<´Ë¼DVmÜ­ÜYJ'‡´öI]ï=Ê'WB³¨ö«ü°X™ÌO²×ñæ$þWÊøiøâö¢ÿ*þ‡ +€ ?t¹…& ìÄ v {“Ÿ:’RP^?QGr² ‡€nã„/4°#TRó>Þ·x‚7|` kL×HI9¼¨BË–E‹¡Dd笅FÜ26-Gô°@Ý1dþ ÀÍ(ˆV$_OÙ]¾ ¬p´“òêbµ&黄‰Ïd®&ð̪HG*‚ºÜÀw×t†ñ‹¥P` ÉŸ¹Ó8…Ðs. 4ˆÊÛ•ŒYô³c6{³æŒì +L@ï=qJQcá£îq‹IÙ>5»ÓGì wR÷Ê4AÍôt Löo”X€Îö Ô¥|Mƒ/×c Xƒ'}W»‰ÆÊAªœý/kD©çêßþÀkÞ”n¢iäÝݼåƼ,ö}pÁ•Ãاð€/Y¾–?‡>C†‘È’üÛ;Ǽuq†ŒºxEÁ7ž™M:©yöÐ +<ævCͽòJjĆ„1vTzaÈöüêAÀ‚q˜ŒÛ6Ò¯êUyò,çšÖ=ò!ékYÕ+`S\¦†=Þ½'"þe4ƒäá]Âk<ínH÷ä™ÉñÔsWTuIÓ?âõ†‡ !%„ºš’gùöàÒ‘¡!¡Dð.¤a/ñƒÍÎÝqÌ—»MOôŽKž€Kvt@Ãv r^?#¤Þ+ìg/Æ‚¶ç;NÚd+àåI`HßöP¦Ë_tÛ¯ s½qhõÏéT(…¢€1èÍ¡jmé.WÚ°áÛ5å4hÿñÁôÓŽ‘ Å>U}0éÈ7úărøúÄ=(ï R?KÕ0F‰ µ 8atE/ŽtêG©øÿñ²Úendstream endobj -4135 0 obj << +4233 0 obj << /Type /Page -/Contents 4136 0 R -/Resources 4134 0 R +/Contents 4234 0 R +/Resources 4232 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4118 0 R +/Parent 4241 0 R >> endobj -4137 0 obj << -/D [4135 0 R /XYZ 85.039 786.531 null] +4235 0 obj << +/D [4233 0 R /XYZ 85.039 786.531 null] >> endobj -318 0 obj << -/D [4135 0 R /XYZ 85.039 711.163 null] +4236 0 obj << +/D [4233 0 R /XYZ 286.841 769.79 null] >> endobj -4138 0 obj << -/D [4135 0 R /XYZ 85.039 692.291 null] +4237 0 obj << +/D [4233 0 R /XYZ 85.039 606.673 null] >> endobj -4134 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R >> +222 0 obj << +/D [4233 0 R /XYZ 85.039 584.356 null] +>> endobj +4238 0 obj << +/D [4233 0 R /XYZ 85.039 564.231 null] +>> endobj +226 0 obj << +/D [4233 0 R /XYZ 85.039 564.231 null] +>> endobj +4239 0 obj << +/D [4233 0 R /XYZ 85.039 530.087 null] +>> endobj +230 0 obj << +/D [4233 0 R /XYZ 85.039 249.795 null] +>> endobj +4240 0 obj << +/D [4233 0 R /XYZ 85.039 215.045 null] +>> endobj +4232 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4141 0 obj << -/Length 3066 -/Filter /FlateDecode ->> -stream -xÚ…ÙŽÛ8ò=_ј'«uP×¼,:Éfäh {‘f÷m©m%¶dHr'ùû©‹eÉnˆ)²È*Ö]ÅoøÞä‰ÄÅM–§~‡7›Ã›àf +ÿx -„Jb?Q -Æ ‹k³ºN#?PÙ"ŒàXg‘òU®æíã›ÛQp~šÆ7Ï7aùqݤEá'YvóXþéeþj$÷¾=èzzÍj§™÷©:ÀÇ|„^Õõ»ú¸úÿã¿ßüýÑ¢Œi‘øIz•¦„H -“›0ð‹ ˜”&~˜…D‘tDYâ}*ªÕ:ô«(Gzà¢æ R÷ü«ù§GèŸ$Þ·jƒ.*¯}f —z½ç/‚h˜¡QÕáðwÄ•yÈ38/48èqôö섈ËX"æi/£¡åߣî`ÃPoê£*ä&pi¢h º¶†ÃT!\?Ì¯Í =-t/+gÙ¥â€÷Fĵšî‚8[¢®N¤"8p§ŒÀéTºùÆ0¯Áù¿xq̯¡ú9[°U7%/Íøƒø‰êS/Ø„|÷Ê Ýx£À'–0nCéà†#Qg¾àEÊå±e˜÷¸$Ô é½AØÝŠø`O# JH#Ñt¼€¢ï,ušî¼iO|Åž.˜zí°3ª‡ÔüÀAm$.jÃÑÖas{Ú— ‚mZŠãxÔ8V“Ëã7^ÚÿalñÖÍ–§5ÿ¼ÔÓMljh^}n;t#âïSoÏ#ò}"RŒÐ¥ôq‡Æ¤¢ ¶ïôq ¦Á˜mgYñœþ‰eðÕ!/C¯äÒ1$,d‰hdãêQ$3h]Ñ¡Õàz)¾ç¬EŒ%Ç„¶ŠZ/ÜèA³¡b¦*2°W!•§N[ÞáñN¥@éx¡DÇaæÓƒ|% -K£œ?z9ÉÚ×F]Xx ‰ëZÒÿ -âæSg@û êÈû†G× ±lËSBxÙ®4 yƒþ;˼¯;#pø@)ÆP±3£Æ d2zÒòH¿þ†äÞ[^Ö¤,¸…Íí€ÎÔÌÃ@Ë©(\#ëرÓ!K¤Ù©Ñî«~Öý Û­QÍÂõÌq$>š‚˜¸éjá­À[OŸ/ÄÌÞ"5ÊÃy -ŽÇ»™æZ.ãxÝç–Ø×Úh€ª%!çè f’ßÅKF …^œ<Óxœ À¥$2Hù!NVò}ž ãÜšÆί»ŸÎD³Ãßó†°ŸßòO?´}Šˆ ÅÅv“,ÒÉŠðsj±g½d §­%õĒㇳ çXëŠÃåüÙä©Ê-3.¦¨–ôu ›€[¢\é·¶–‘™14!OÝÔM2ž—ˆµ.š„ôPØ„µÒ©6Äzñ|Ù©ù§á”ÖXœZ¬=paÌħiôå –.“³và¯8e7 E{¸Û #ðý¾vBvÛýâÍV 0Ö²SóOÃþË=cYøyp¦fê‹Hüs~ܪp®©®B¼¹w­Dè1wS%œëD2;ê°Ø,8âbI´qZéòeÏ z[õœG[%ã4ô!'Y ·fíq¼Un¼r?…\Áá Êg3Œ±òÃø:B™ã›Ä÷¸ð“<™àûd õ‚QıI–¿[«'…æ´¢D–n+ã‡Mn&I–£=V¬Rƒ ÓÊWÍ%Ö«ÌÏ‹×X?]a½½Æúk ëÏñ-²ÞÁ7fÁ½È9À„´"Æ I`»ãÞOÙd+ -lj[ñÒ(ÇÆ­½z[ŸyÛíe„ÇYº8©…fa郉øã¹Gy¹†Ã"¶çìh/Ÿç­œ4 ¸ûÄU7†Øëæ©®ßm¸'qZ¹5wH^_7`Æÿp®$禟t/¸ñpjë¸jŽ ?¨3¸»â±T˜]hÎÁÂ,ùUaνP™”`TàmaæÄ?B6ö\oýû/*Ä4÷³(ر¾à¦ Þs‡uhEŒÐôÚÄ6{GÂ9‰¿¦Ë|7ýã Ö~» €qâ+PWGÿ.êá:WÃt4NRsÞ!)ÎQ&qa:¾‚ó/éendstream +4244 0 obj << +/Length 3375 +/Filter /FlateDecode +>> +stream +xÚ¥ZéÛ6ÿ>Å»@4@FÑA]»‹2IšN‘9¶ãl´ý ±ä±[r%¹“ùïû.R”-y ,rˆÇã#ùŽíŸ{ðÇ?O#× ³ó$Ý(ôÏ—Û3ïü z>žùBq)$—ÍÕâìÍwQ|î{næeç‹•á“yn”Åç‹âgçÝ÷oï~¼¸ ÃЉ܋Ë$I÷w¾sóöú–›ß]\ú6Ý.°ôãE:wŸ.~]üpöaa–`-ÒC\Àïg?ÿê°ØÎ<7ÌÒóg({®ŸeçÛ3…n¤B©oÎÎþcxqŸ:çQSûÂÔÒðxÃ~4±á(rc•Ð†¯;ÜC·/áFÊiËMÞ—ØV`Cèô wôkØq‰åÈéª*O¢»Ü4OMÍÄuÙ£4ž/‚ÄiZ ùʃ·ÀÚ‹rÃõ¼-¹PMEKXî;ú–2oU[óV²:¦Xâÿ=675¨(òbçjù§}Ä’E½‡únÓãŠúÕ"»ôQ¢‰ h¶9΀ªi/Ýk¨dÞän‚$sdÃXìh-ØWíz=.GéL°ïJ¦ Ú:ÚæÏWP`ñuܳj„äz¸ø‰¹hhH—zÎ +Z4©µ°§¶¡ +•½‚›‡‰=²Cåd_ÞÜ|`_nª²Æ¾¾ã†g\*ib‰“®¹5oÅ&BÔSÉ+Ö5è“ëÍŠ¿ýº’[‹î´(K ×Ëd‰bp¾ƒ²ÎÜ}PDWX¶ÊudWs1gj£](?WÝ »Ñ®ñ»Á€>Aw¡ç9•0z$MåhŸ´Ð¼ëe`[þNÞÂ&(¬>\¤p–®lÿÀ–ÚRÀdUè; رbÐ6Zæ‹\†~ò1ûâŽÐÖ–;\ù מˆ9) j¬ +(üÖà6pg~ â+¸õ‹jU¾Þ1ãJÞåìˆÏ¸è¦¥AàFàóOLð¼†Q¼¥–[¶¢P² U]uÛƒ¥<ØÞy¼í¼Ø’EVF°mÞ£LÃ8vÖ9.-N"aŠ|c<¨`™@:×Zj0ª’AâûŒsÕãFd =¿x‘÷ˆnÓ û͆‡æÅf-„GÐÄ>“‘ + Å¸>­‚P»sþàªÄôØ8Pi"nk)R´S蔣4òÇœW´àß´·L½é¹¡ÓìY nz$7´ ¬ÔÎD­’8 ©€ÉV®^(Ê5I!ëò…'5^Ÿ +ØlH…e_1ÓÍ Ï2PÖzõZÙ Šê„ +DÂÍ„Xz#Ë-óÚðXôÇÝ¿nü–ÕŽäHFŒ( ˜óÇ( ýÓÏœ…<áU”dçÍ`„¸19-…éÜô³ð&óZ FU˼¯¢Ì°ýI*äB“T$ÍV£šµóˆ6¾ji ºÆz³q›¦cá‡t‚ K#Ò)Í«^¼f°Á¹ÆhœÒ´ŸÅÿS²ØŽÔŸ:«2ï÷Æ:î¡÷\a𬹲ͿŠÍá`MG§£¡Eÿ¬ÄRƒŒ1-•m”mµÐãuT2R‡ P$ÏÍy›-—#hìŒùáŸhŠqM¯ùØǧ¤9íž­*ôÍM4YoMè°N$xFã Žž= Jz;ØؘN¦¯µ´µc#H•9 â=«ølgA¢aä…æ¤9ô …¢’rU¶¥¦&M”hød_ûf7Ý4ih`nÅ·ƒ÷dQ}§V0:>í!J¹Tž ‹ƒ L°íË=~çûybKyAÅÆï;DpW%ƒnïX|ÜÈ(”%~k*!Îù£cjÂíp#NR +;BZ,쨵ÝVR'Å`â’+–!æ™3Ã(å¨9‘¢ÁuDB£p}ìW$OŽÿèPUÄ%ß×KÔôZ ’s6ËFbºÃ¥0´Ã§=Ÿ´JxLWuדÛÑÛAB±q°2+BÜŒB%{ÅèùÊ=¹0Zk¥F¦þ‰PzlÀSQ{öí Æl𫆈‘CBìâó߸6Dj[ xs&`oóÌ\áTœº~¼gZ4Ç×®,uÃ$4|põ¾{8™ïÅn +rj6Msz:ß\Ðåh¾YiLc,w=ÒÉ’K5Ô°£$ò(k@Åòõ½ “H† £¼(Q:9° o‡ÌýìÑ5êϦ¢0¨jŽÀTÄn M·<äéïØB0P7GS§z Èz•ÄPÊ—3@ {ÈpñK˜ $·eu}÷À­5$ŒAÃû;Ê ÿ†6ÂxoŠÚÃåükÂÃSW¥‘ôÿÍ_Nðð3¸ó+!ù÷ P¶ŸÅB÷£•{ZD|aòÞDWØ=äe8ôH‚ !}h/´­(樢7·cÒ©òm*°¯ §^=Áß Õ‡›‰P=|¸À\”wµÿ~øÑÃ2Ï,ÊNcÙ@3eBƒ3óXvb¶ËNMg°Ìš°,PéØ•÷jéljƒ*Kº»+>…æ‘÷\_DÐÂ$8' caˆ8È9“K}Ñ€VJJŸ‡›+6 Ébõ{Œª¾0f !§dhúR† Çq- ‘©³N—ɱ9ßèwgËêÖv.—ºïL@€GX#FÁ7Wý0-­pÎZÂ(s“08i-ͬµhÜK8k-§f3Örr:m-ö|l-‰?"‰§õ‘ˆvgÈÌÑaƒAR O¾J¤û.ÑŸt.ÐJØÇZTŽ0 I˾­ÊáÆšð@yŒN‰Ïè”ø#¢½¾®•í«)£Ñ—L¸ÙYÊYeÃQã¥ê´²šye ®AÍ+ûÄlƒ²OMg”mÍÇa\lhÀzo'1BGx( ”r4šRXÀ±!ÊEz;ÁÂýæ¢ÀJÈ[Vp),u¢I»¼Ò´¬ ´Â]¯ù00Ðåe%_髦»¢;3Íëû +–èã*(ñC&Œ•¶Ì °A•qØÎM&ǦmPòý#~å7ÆÎ}¯E':/ÎÅ3¡%Äiè9oQ½N…#—~]YY'\_o Ê›¸E™aGOG¬±ÏÞ!úd9†¥Õ9¿bå¦irÒ/,šY¿Ð4¸‰hÖ/NÍfüâätÚ/ìùk‘ÂLø/ üZ“(ì›’‘áç!mò±ì¯ëUÃÝBÁäÈ™ys¨‘è8ùzLkƒäèA™W•Wl Èmm2YS©<KàùþÄ[†J"öŽ$Ö¬ n¥‹´r#±ö JûcÿÔÚ>àô]h—%²‘'“ñ/õ7tCŸæYØUÿ붃§Ž/i ®è„1¾éõÏï#ÐHé±½µGj¤t&gÏ…v”ýá‘Ëw^ÉDkÊÕ`iM$‚÷çžÁðy‹ÞQ ÀTÙæagÚŽ·~óe¼80®*t(.Y9;‚Þå°f ¡wI¸ƒôMûr‘*g|¼©ÓoÐÍ,8hÜN< §f3àpr: ö| ‡fèùãC3ô¦ÌfLmø–ñJúDz=:JCë¤^ñ´á4E +}š†:ãF³X´îè@ãÚ”ôÔ¦œ·¬¦”žr`5eÎGcÔFž•ÉV±•É†J·c·¢F“”VÃ}ËnM졾x R€–\hr!@ȪsMÏiVÅP“÷kÜæw]’d «üÆQãŽÜêõÄÍr¼õ¿v³<¸î3 Òá¦:•¡ˆÝ0Ö)ŒU;DßÔüè¯ssŸ &v˜ \Tä\ëWg­PY°³±Ÿ,ð|kíKº„Wr …:1OÞR¶;ÃÃJt÷Öƒä `¨ÀÍÔéd¢E3BƒRHæãÄl`œšÎ†5GÙèv”­âƒ(´`ý¼ã:Þk> endobj -4142 0 obj << -/D [4140 0 R /XYZ 85.039 786.531 null] +4245 0 obj << +/D [4243 0 R /XYZ 85.039 786.531 null] >> endobj -322 0 obj << -/D [4140 0 R /XYZ 85.039 766.606 null] +4246 0 obj << +/D [4243 0 R /XYZ 85.039 492.496 null] >> endobj -2953 0 obj << -/D [4140 0 R /XYZ 85.039 674.702 null] +4247 0 obj << +/D [4243 0 R /XYZ 85.039 424.75 null] >> endobj -326 0 obj << -/D [4140 0 R /XYZ 85.039 525.576 null] +4248 0 obj << +/D [4243 0 R /XYZ 85.039 384.103 null] >> endobj -4143 0 obj << -/D [4140 0 R /XYZ 85.039 498.961 null] +4249 0 obj << +/D [4243 0 R /XYZ 85.039 344.061 null] >> endobj -330 0 obj << -/D [4140 0 R /XYZ 85.039 139.947 null] +4250 0 obj << +/D [4243 0 R /XYZ 85.039 289.865 null] >> endobj -4144 0 obj << -/D [4140 0 R /XYZ 85.039 96.006 null] +4251 0 obj << +/D [4243 0 R /XYZ 85.039 222.119 null] >> endobj -4139 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R /F35 2880 0 R >> +4252 0 obj << +/D [4243 0 R /XYZ 85.039 167.316 null] +>> endobj +4242 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F38 2997 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4147 0 obj << -/Length 3915 -/Filter /FlateDecode ->> -stream -xÚ­ZYsÜ6~ׯ˜ò¦Êœ”†"Á[o¶•¬ŠäÊV%y † ×3ä„œ±¬ýõÛ@ðìÝl¹äÁÑ@_7è/<øç/ÒÈõ‚l‘¤±þb½?ówÐó÷3_(VB²²h^Þœ]ü‡ ßs3/[ÜlÌ<™çFY¼¸)~s^½~ñáæ‡_–« œÄ]®’$u®Þ/}çí‹7ï¸ùío¡þr¹ò ðËõë7–ÜütöÃaÀbÑ\þϳßþð°úÓ™çYº¸‡²çúY¶ØŸ…QàFa õÝÙõÙ?Ì\Ü.xÔÜn£ u£4˜n׬íú*p•òI¹q˜Ð~o¶år¦Ê9ä]‡;º_ªÔiÚ[}§ÙðoÎD{¤È×H²­jØ» >¶§îÈÅ|½F¢æ½5šöc'%ú  Ãwôê´ôò¶,¤©Ä¶u[Ê›¦e^ˆ¶\ŸÚ}±’ ®|<¥ŒvµnˆÓ=®B>+b*?VPnêåJe™s_·\:ny+ç9WÍ>¯„âUÃ;hqÔnW¶ !ÀͶê˜qTÎUáùÔâ:GûÀ›’ׇfä›Wmø÷ЖŸ‘”H`Á Œ&­iƒÞ`k´üD,7mõoG±ÄsSˆ<š¢Ûߺ0û†é'y.Æf¥Þ<)>‚RÁã*E&èüª®dêüȼq•}Ï•'†2T -uCPsŸ“maë§|WÅóןh{źŽÅ¹«í/†¶®¡ãŽ¦Ö.§”ÞÕÃÒ*­äÈáwz—2y~ÌoóN[Ÿž¹ÀÙæšåÝKíдíjØk×s0ˆ,}ÜeËÅ íp/(Ÿ{7üKî™@ T -à‹KÜ’ê0h*~’¹ž%(É÷ÅœdDnš¤BXP¡÷óßo+í6qYV*¶_ ‡Â–¶ü+JžÅé4䨾°8ìš»ªæ⛫s‘!ÉAù#…_¸bÁ÷^! -AÏJ±ƒ–§Dåþøæ -~üsn!”ƒ…£^áçùy›×#Ä÷Ø_Î*çº}@­8!ÌXMr†û÷xñt‡E -ƒpÍ-adäŠùŽ4Ã\a ÓR¢ªÐPÙçO£whDSºKøV:lGØJ X¡R+iÅÍ;[y¸r®%LÃ3Y½·Xù`óâp;·š¡Ö -·f-i¡ðŠw%«¿Öö)V!žÍ±|k,úhLzž$ÙW,COô„e¢¯Y†§Ô–a¼Þ¬e°ÖCøŠ}Êwœ²…ãAÆš•õµR¼í.~æäÉq–|;§¤R@‰Um…' :¯ËÖ¤Ö°²§LU¿ MŠ±ýTxv,±gF8:cÏLj: v¿<í3r-t´û>IKÇ*$}¦kÖéò~é„ {€F˜ÆÏÅß`_)ê&ÛÊ’e+›»¤Wflä€Wõi<,W{]ÚJ¡‡ãº ÒýPiçœ2~`Ï+¯th±bkõ#ÃM$¯Íø?EÈ:GIYóé6M(o#U“rŸ|ŸYÖƒg%VŸvÍã‹ÉÄÁséWr™k >pЋbz5Í^‡$ -âêBlélúd¯ŒîjqèŸ×­ ]¨y ƒHzô‹ÊÌ·*ö]/zò뎞„4IA§ïfhq6ƨ0s•bMJ\åÂÊ>b’ˆü 8v^õ(–Üü¢Ï×[¶„P¿Y‚HðÇ8è(žè±{l²ü“Ûèif,‚ÞZ"e¥XB“E­f±­;–.Q¢ÎÃ8€ÝÜ -všÕ˜ sþ;lëíNRÅ°Ë{ÄN£/<¯=0½Ñ$<ö$$A€½”SX=ÞK,Y5ågƒS?ñÜ$Ìþ§à4Š•| ‚ °?Nz5¢Vz쬥b\¤()- òW*‡#K|®K@£÷3¬¨ÌMMHÝ´ -§ H£KŽÚÐBgÎó¼(°”ö‰ßyÎ} “÷Œã±ÁD´X¡^yRn÷lý±ÃJ¨È°Fæ\­Gé´ö1Æa­ËyÜ›Ù×ÈMƒr´ëŸmȯAF.ˆ¢ü’CD_Žž(%æ…1”%Òù`5µý&TåÀ]^ÎIÓä]¸mšãßæ.Ô9Й¶‹S×^t·$Ö½Ð]!ìZÝñ¯/öVÒqQ”Ÿ/ÌFv;!§åò³ù88@EmŸðkŸg2«`º‹[:Ö‹ Ùiù¸…E ðI ÁøMŒ‘Q¤ÀF§ ?öÜ4ý†Oá &Iæ?„[é¹VÖd33ŠÜ 0 Ò6lñ»™ëZÊõGÍßtad",?¸Ú Ÿ¿çÏBÁéÅ°&Àaø—ÎBϵ²&›ž… -•›~ÕDƒÃ@ “DÃë|/ÊóýËë+ûñ/¢Á{ý¤m¾ ÑŠ·Öš7H2•}9q i}V25‚J)7T:_½F¸¥‡ÜÙ<~’éǯ=¯ì£Íé'A¥‚ÿþÆGäe˜ÃYåüûlúÑÃøâCßMÀÃûÊsLù—.^æZY“Í]|¾*1+š‹¿üþÒ÷|øó.ÓKþéüjwçï|uOaÖúìIÏõôžÂ:ÕtO—c#x‰¶” XÝpÀYÕÏÄ~©Äõ¼xüåÎLÒ:Ë},Ýò5©Ä$ôaLõ>ŠLsóGn&ùH/|%÷LBïŒ?ÆËû7ÆX¿ÆeGK`Þ¿{&õáÐ&tT˜ñõG½õó£þxÉw5´z[ÉmȇB¹IIéÛàsöà÷¹b¦y|à |6tÛRgDÊ©™…>ÄR1ó™?uL|†tæí‰Oé 9‹Ñ±Î|à"$füyÑèýíÇsnã]ŸvEÿ:Ø«Ž,BíÅþ·‰Pl™[„`Ez’ød­vÜVq]>v‘òwçã¨þxëé›t»„©›¥j^_#е8 53¸µØ3¬¿]Ÿrü”†ƒ.endstream +4255 0 obj << +/Length 3177 +/Filter /FlateDecode +>> +stream +xÚ¥koÛÈñ»…Š¢D wÉåí°\/‡:Ic_ƒâî>Ðm±¦D‡¤Îñ¿ï¼v¹”è´è!ˆ¹œ7¥üS‹Ü„Q\,²< M¬ëÝY´¸‡™¿)ÁX ÊÊù¸9{ý½I* +‹¨XÜÜ9:Eš"]Ül~.8ÿxóöÓrÇq`Âå*Ëòà͇¥ +®Îß½gðår¥½¿Áѧ¥Îƒ_þzóãÙÛǂǤŠcdàËÙÏ¿F‹ 0ûãYÆE¾x‚qª¢Xì·&‰å½9»>û‡£ÅsÉ‚WÍ×ÄyhòøôÀÊxVJ‡±Ò‹Ì˜0M2:ñ}½‡£ìéïýr•Dið„Ǫá}Ø2àêŸ&ø\ï7nñÄ„Ôó|‘ósØV8ÈĪáå¡AZŒÒ#´†z/›á>=¯¶¥`=°)‰§.ª¯ÞLIDú§¥Î‚¶ÀÆ£}€÷ÇÇåŠædQÝã퀤V +YÐÁ7²3лÅíˆ_dn=Qqðë¸Öåyp …ЮZÑd±¼mª ãLD‡xŒ·nÍ}M"°{ò(ÌmIâ¯D¦´„4ËNÖoZ:ÖÚsG²Ü#(hï½¥À· »d° Jo¨ºi´{VîH­Å «×ö,ÌVø’†G*LÌ·­Ð¡N&Ê×Iœ‹bKyù%RÙñf*JÃÜäßÚÍ¢o7oãvŸIÏ6¬Õ=Š! Š¯¯¯ø–…B’hœ(Xâ¬=ˆŒ÷‚hûvàAW}Áû©ñânwÃs'È«†‚¼+ù²À~éÀCçeaIl­Ûð·MStI Ð’Pgà â(Œr¶ósÐj×广-ùõ#Ð|sÉc§»MÀr=È Tƒ¢óëgR²Q`+¾ò³iïQ•pØ“°Ð>[²áðÛŸa:¡Ü‰2òMó +F p ›²§YÙ•²ÏcÇ(¢€»©Ìžûj`ïd}ÃÃŒ² “(DÉzm7"y£á–"jt€ø”“[Fmáéׂ-WV}e?Dd×Bjhy”<±Ä^2­T™0Ëôÿ<@ÁMdfƒ=+Â4Ã\ƒªÆ$–nTaŽ®¾–»z/º¿·ÎÒ3GâüAÑÉrº>Ñþ¤0¡JÒ…§jÿ¿Þ¢i¨([¬\òô»LIƒºèo;£’0Wc¦#Ï@))’Æt3&„«-e;y< +rIé +À Œ¼€|îת¸¸Ücm”«dµTJÿ|»Ä’•ÈLÅN„YbÓ":݈¬7Àÿí'¥„8sÖß–ô§«ËÉÚÌË>¯1Ѿà¨qèÝmÃŒS*6 7/ÝjžHöQþ¼ùùz8¿0f†É¢-:“„N¦–$"•=TËëFx×µ ¤I¢É¬hb+´<{G’”ÞÓijLô§ÛŽW[KƱŸ±Ã+ÙçDê°Î•¦–‡™À®B¿Ê‹É÷èˆÌ½sé¼zÍ»•qm mÓîáž’ñÃ#S}ÚV{Æm½¼QJ.÷©%¿¾¹ yÉgªwšÊmFÏ]é,6rVEíŠ5ë Ò°‡?=ó£çìûúVô)6ŠÝ Q§nÐ0kˆE~íBp:Aí¼@‰L$KŽñ¾˜à¶ë–b âÀݱE‹²œù¹/ªûR72‡áÅä¯æ\K²8 ¶˜nªà¾_µÝ1BS‰ù"‹Lžä +qPòã^RAvO‚ëü¸ ‘q(*±éÙ·péi–ÿB£„<˜¡Û–EB¥«vDCâéS'ô¸O¤”ë®$Jo`|ÉCÅý0ëwïAfÎæ¢BLVEè7ºNXöúûxR.Di˜@%‘¿0Æ4‚y#óT·34 uL£TPþ:CBiH-Âûj¸@.ß}¸f>÷ñI| D=ëÇ” +¼¡u+x¨}¹«:ö6LðVl Ñf +[sãÃ9;×h°²o¹Ý ’<4qâç; +ƺDYÇ™xF°Égz¶›ˆë¦öÒÁLZ&°€ã0#Ô|²Ûºß2X´„â¹(/?Ó>üt]™,vŠDóW!Îy%ø}¶HMJŒH奇 «ÒuûœÂøâØÕ"p…Û=©”u’„T«*#ÍOu÷R ò²w‹½òÐOÓ÷cšx›Ý ÷ÒIG–åGìÅij“ùì”çÛLSB¦° îÿ{LqZ©89%àn’KQ)—.’q8ÓÔ3OºŽ—-shm-µÊ'w}.°Q´›t^]r¶BʆÍ:ÛV"-‹EËüt%·í6ƒ…–Ô~à·Á6ļÖn^øõ‚ÎsnZXXŲžóDŒ8ˆPòüI²@äqÙÇïMâ{ÉÓG))ÎLsu¢asuœîçÒpÄúîx£Û àfÞÝYvOj)/#ŠUB Aë£*ášžÓÛÚ0"?<'mW…=Ú£rCñu’íÃx’È|+Oºdܘò«ø¸BUcq ŒdÃÔMÞ°wT“ÄWI¿™´yÏr£è<̨ÏÌ57€_I²›Õ”oqF¥­¶c5S2„>Ѭ­ø´ ¯8ÕsÝ ¸Ç¥˜||`ýܺ>µ–´^Aˆ +¨ãfe¼&N#®'-µnÃÔ¦ÒÇ…±öGäTH»–¿Ÿäø‡’•w$4len¼Ó—¨½ ‚§tøê)]ÈIGQü‰¿µúK‡zWÁ½€_ÃÒ£gà‘ÁLI2Z>É–,'A¡ë±w_±:ÛS>…s.1X.)+ø;1çûÛ‚9¥îX?=d—¥ÂøÈ Ú\ýÈuW¬sO%ò¹H>R)YΘIÓfGe]ÙC{Wn&‹ñì…rˆó¢Xóuá“=3 N¿Eô©çÆó礹OÛšM€§Ë¦s¹ï†ã ‚¹m¤ 69ŸJñâý¡Ž‡\нsÚHÍ(>þf2£n$"577Ïü²¥BËI׎Ç~~ø¶¬â.MãÚÁ\÷ÁèyÉæ5ÿ¡‹f«á¿o8žê3ý¥Øë~"ÜÓ.–¶5"]éW¾½RnV¤z@ÈXõ +Í|ra㇡—/üÖ•­ØaBv©Dnœ€ÇñÑî¯9 gýƒ´åOoñÔ¦@½A«¸mª?€Qö®ul¡ãZÁ]N#*µPÙ6üJý*+¹Üî+i׃lëkö\ÐãŠÙ~ `}Jf[b¤OßÉ—ŽÞóŒ`U%)$.¯ý¯~¢c/»Uø©‚¶¨¹¨–}ÜkæßTòaåØ7"¹;¡tÚ¡^ú›0áçÔðŸÅò»~\â5ûÃ"×óy¹„’Ó2Cß-N¾ÑÛ¡œrü—Ó,endstream endobj -4146 0 obj << +4254 0 obj << /Type /Page -/Contents 4147 0 R -/Resources 4145 0 R +/Contents 4255 0 R +/Resources 4253 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4118 0 R +/Parent 4241 0 R +/Annots [ 4258 0 R ] >> endobj -4148 0 obj << -/D [4146 0 R /XYZ 85.039 786.531 null] +4258 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [243.979 292.112 364.253 303.801] +/Subtype /Link +/A << /S /GoTo /D (DMB) >> >> endobj -334 0 obj << -/D [4146 0 R /XYZ 85.039 261.05 null] +4256 0 obj << +/D [4254 0 R /XYZ 85.039 786.531 null] >> endobj -4149 0 obj << -/D [4146 0 R /XYZ 85.039 242.178 null] +234 0 obj << +/D [4254 0 R /XYZ 85.039 514.811 null] >> endobj -4145 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F35 2880 0 R /F66 3242 0 R /F20 2865 0 R /F56 2890 0 R >> +4257 0 obj << +/D [4254 0 R /XYZ 85.039 482.593 null] +>> endobj +4253 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F38 2997 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4153 0 obj << -/Length 3486 +4262 0 obj << +/Length 2577 /Filter /FlateDecode >> stream -xÚ¥ksÛÆñ»~›f¦àLáoó³qÙ®¥Ô餙D@$"P@èáþúîë¤Óz<w{{{ûÞÕ,€j–Å~æ³4Kü8T³åö,˜­`å¯gJ ²p`^\¿I¢™ -ü<ÈgW7OøqžÌ®Ê_¼—ß?ÿpõúã|†¡—úóEšfÞ«÷så]<ûŽ§/^_Àû‹ùBy¯aðñòû·æ¿^ýpöúÊà¨Âÿýì—_ƒY ¤þpøažÍaø*ÏgÛ³(ý8 -å}svyöw‹‹×¢mf~œ…‡× cçºJi?Tz–FÚÞ·lïî>ûìéYÄð_=ÛËuÝTÿnêåmSl«gçeõpÞÜo6Ïίëæü¦Øì*¼íù5BΣEøA–îç×ó…N½væ:óªï€yäÁ8·®{MµÏ:¾&¤@n Ô—yú:æÜÂàZ8Ȉ1#Úu N•=‰o8"ó¶Q±EqW@¦aÆEƒ/ÊÃKff&áå3¿”ÕŽ ;Du××Ì^CÖâ(ôn`±íx¶_ÏåÐ[nꊰõµگ|¾(vDÎy7[äÊ×1\R¡žäD>bæÒ~ÀùßÚíÝ=Œ{Zê`ꥩGWC‘d ’†(ØI¨}Ú™ä™%úëD"¸² ‘„±©ÄžH"ažE±W\•Ä‚v£û¾Ú Ï#P-”ؽYíy’õPöZÃø±¢ñöý%CŽE í ?ûµLD75ã°&1(ú*ˆX1‘Ü·ptJ‚/¿µÂeØ_âT$p‰%Ç%*ˆ ¥jïÊùæÛo%_{ק¥¦¸»3¯ŠîWV%ƒâèn8±'FìÀ d‡Ù‚wFJ7¨,;JRkx^D -­À™È{¬Qn^nZï*ân»Âsëÿ1ÀJ¿®w<*vŒAW‚„©8Ýw#À}KÆóL£O70~˹ƻ×Ý -¾èq2›pjÙv]E¸™³mSšãW ñSS?ñ¦‚N]¶÷pfîõ¼¼ÆKààz 0Ž6,qÒlÑW%Ø|¤•U(`¹ÐúÓ\¤rYY¸clµ¢f=¼í²““ úÈ9Jd—y×…¹Ï>yÞx1fÔ°}Ú\`I¼hË|)jò·ÍêÃ#Ê·Úl· Ë¥áí°I®‹ Ã4aJ;÷t"‹…f±wWìvtfÛ•ì#ã<ó®’pï̉®ƒ•²5Š/÷»/…C¤v}àZÃ&P˜@àLÁáQxÇ…n%@o 89Ï8qœç>N¼ýn;çq ·C&<–ÿ -â ƒ?jŸ (J!;Ø#h/ß00dŒ|xC\ÊãKöhÛl†e°cÍ !…É1…œçnmŽ¼®ºêg£´&%]Ûö™é®|MÂ,ùuQÈsËO›é`XùC Í#’ĤSÚæòPå‘ŸCúljŸç_/ ®…ƒì× -⤆ÜÎ9ñ2e7€OQÁÑ 8 û‹@H0ù-ÆT»‘-"âîúH°¯”Bfª%dâÞêQŽ$›‘¤2ä=Gä2T|ö`Ÿ6¨˜@°²ó™¢wb* KêPÝ( ¬‡àðQŠñéÆD9]RgÝïÎ:x㊽û‰ 2RIºcbŒÿ€&Ä9#Sº€þ,‰ý$>Ž‡v€‡G|_§„(Èhr2Q£S©‚Θë…ÔO@— ,ðÓœ…ôCË¡ä™ gø{cVAO³X‚ (ð›™WoA3IPèÀç $>Õfž¤9°i€\Ðç\qö;ð&WKøÏSfÑÄùÛ­ž½jáö³íbÀË6•¹6…¶¥³(Mü ŽÀû_¨q÷¥/”ççû!C²8ýœÒ”,ͧŠÂÄRr€ØKùGšo§m(ÉY›9医ê â–RÍ’Ï­wS$£b¯úý¾~ÀÓ6Ö–z^!ËPÑñ«LÁ ìFźHÁ)% ×B ò†w -‚O¤¸^²¿Ÿ¢ùà‚è‡W/y€Ü„+òf_VÝCÕ1‹«XUx­<¼7xy…ˆB²0M¶öõVF…$V0|\×ËõQ6&ÙX^xGPd¬™ìÊÖ]%¯“•àÓ¡á“öÂÛãºt†áÍ¡hr®Ð`ê7”~ÝÈÉ’ꈅ{¯Û‚Ì1¦4† ‹-š&¹al<9,¹±1cE'`¸0ÑÞw &o‘'àù€ˆQ 6MÕ!?®7• o-‡\®V¨E*{KQÃÌ=Y¥ÃÉ*µ£2Vµtß ¥ÿK9T$ýšF"•‡QÀòŽ-m1A¦ÔLàÛÄo#e¤ï9.䬺8¨›µZà6Ñà´ëv<Åh诤˜¬P!f\0ÊÖ^ïSÙÔ±P}m¸‘°C[áa{ßóy•‡Þ¦À¤¸[ÉrY­ºÊ€ÞðÓÒK²=uCujHg¸ÀNƒl^ -]„Üm°Ê›boàª6œáO\âŸó ‰–Ü°xà.|´øˆRÆ6Uù§ƒ„7U~ ߉…_Z1~«<-l·îÿ÷pÊ h}²ÏêÌWij™FœÃ=è°Ÿ¥Ì>Àì5fsqàý´#ÅY±—ywñà% ¶K†÷‹9=ìSÇ®ìy)¾íò6’©¸õJÖ—âIiB úíàÔç·&_±)O7VóâÓ½_f"ažè,òË“·¨×:’E­¦šc4ÓI{_0Dï—Ä/E';0?í>›¨efZ9¦hŠ•¸–ñ~ˆq’OÕRÂûÅ%»ªO5µ"Lÿ=JI¸Ú“*6ÜÚæA!¦š ÍH>5Q&¢°ÃÆnxžÜA¢‡¾­—)Éz¢‡­wÌÊÛ9Ä ¾0@-‹Í¦*¹²:ÏA‡1¹CÂ/?ÎìýÇÕû÷?^riÎøŸypXÃå‰Ào÷¥ÐÌ¡ðH²K>¹WÀMqs¥ZÞ÷Ø,‹ò˜œ*®p[`rn%õMQHšX=1ö³Àš|-Ê“¡÷…+”àY¦Lp 5Í ºü±ªèæÕÓTÙšäØš+Í$WµŸ§„ ¿“š,LÁtâk.VaõôQþK 6ì*HןÂ)ÖHW¯öô¿¤ÖzÕ\Yc_~ýÆ4Ñ]òð“Í Žµ[Œd„Ýí®gVV õÏ´› ‘ݧ6‰A†ðÄ) e.«§ë/í`7‚ÅP ÊÓÔ»£:U²vŠË~L ½ìlz¿‘d fQƒSm!“âM÷„>Õú{W=Ýïüi±Æ™Ÿ‚[d±X-&:Öâ‹ñY8ÆûÖË®åý Gq 7åVÞ5¿ìêÞ$HŸhsÃóHæÒlz8c y|‘„'Eû[U‚¸¬E…j÷’Æ©A‰©VH;Yƒï²Æˆ/T¤ 8¸5rk€+^æDGV?Ë5}„`pRT Ù¡Ö༨÷ÕÁò§ó‹ê\ÁÓùÏ0Ç9Ú§þ± ï!nW:æóÍžøãÔ´±ùJîa»êNù‘Rí˜õ¥ÕjþŽÕYæ -Ë(|è|ÒÚ·ú5¹oj„'Cߘ°åök€…’Øí÷·…¹ÒÄÆ…£ë;éˆ[˜Ê@µüÀãe¥Æ$íZ{œÒÀäsL}!]A±Òro ê]š¬ px”Û˜^l`„y‹ ’#½!•À3'“Ûªq€&² Éh”XLxauØ‹ -#_…§c/œBΚţÓÞ ªN¶Û÷NÙº«à¦Ã²gbÂêô^? Œ÷yI ¤;ªzÑ1.B$Ê¢è \€NpQ€ðp}”‹§Ž3\dýÔ -Á -Î?ÖåŠý(œLÔà?³ñ«~Yh[e~|?òi9ÖP0§‘!† èàW戇ÿ‚þÂËendstream +xÚ¥Ymoܸþî_± °¶¸•E‰ÔËh‘ØÉÕA/I/{@‹Ë•WÚ]]ôâHr|þ÷7o”¸Þµ[ô’+’ÃápøÌÌCZ-ø¯©ñƒ([$iì›H-6ÍY°ØÁÈ÷gJ$V"²rd^­Ï.Þ˜x¡? ²Åz;éÉßdñb]üì]þýå‡õë—«(Š<ã/WI’zWï—Êûáåõ;î¾\®”‡]ïÖøõã2L½÷ÿXþ²~{öz=™à©¢ øröó/Á¢cßž~”¥‹{ø|•e‹æL›È7:’v}öñ쟓.Ó žuj¿Vb¥2? Íó>‰c?âÉ'!Œj?Ò±ëcüX'äøGy—]ÓÀ¾»'Þë¾ï–QàõÃS›-'¬ ÀÔÀOƒèySµöSØ–kªò3c\SUÆ;¦*O¡½&ðÎáû›s6vßy‹Öv#wÝÀOà•Ü¨ÚM "wE‰2vÆÐɃ¸ë|³¯Znó¦|jÏ +¼›þ—mÍ2´-eŽQ ã~îÁm½\®th¼ó&ß,ÃÄÛW`š¢ÃÌÚ ÁÝö!ÇóoaD§Þ§À#ö<ÀÐmµÉëúú+Æ®/ þÆmâïE9’²‹[ÜÃ}!êÆü3*+^w܃ŒØ°ízh4Ü趬Ì8ex‹k4¸¹’ ÎhË÷̇ã âO2Ÿ%|çhßír…æ´/ƒg¦<8xïÍ2¼¾¤îW¡ÿŠ'¢Kr\¸`Ýݸ/{rņÚûh57Ôü›8ôßãn:Tt>ò”M_æc)æñžMä%â{â ΂٩ÊCOõ'ü‚Èóm˜ø$ì_ïÑ­*ônñ(º›ºl¸] üÛµïéÄWj>#yèÓ¾Ûõr,(v7Ø` áŽ{·F»pÉèë–©ÆsˆÓ€²d»:ë|:.„UY;»Wÿ,Ë÷[;c3Ö¢üØ/—ÖÿqFÞÓGþ‡ð?tí»;‰2à(Ã¥èF yÜ;,sñ&àTYâ‡i‹ã¢_«Ûe‚é$xÅaÉM‰z×)‹êñÒ´1ð\f=n‰’„ýTT±Kž°ö=„:7ÎþåTÑI«1’¦ì+áµïê’K™]Ïѽ÷€WèÀ}‚…÷ØÒ^µåÞœy‡®ÊâByáÞ*8q¸ëËS e8žK7]}¹ÙŸæ3„ÖõÕŸžH¼Æ€Ëãø¨´pJ&0'+-€*ÉÀaæI54)5ü%Ò‡Z¦D¯ÓÀOÒ™~ÄÚ©_@;´»uì'Šæ]‡^Ÿr¢»K+ÄR*©‹/ å:Ë"q¾ÉøyOÔqqݨÅUf.KEíÊÑË%)uQhŽ³0"I8–¸Ÿ ¡Õ×ðñ/kGáÛÕX¹'} ”6¤:s©)ˆÜuCàN± 6Ld¨X¢{ÓQ>i˜Œ¸ëQ“F‡)¥ç€+ª¾¤Ú†9d +Ʊj§èš·eÒÍÅmnS”AŽ§,džOÒ5çd÷¼tf|œÊÀÿ'„¬ +’Åjb€â!˜>ËP4SGÏ/Å~*Àâ +ñzÛU-ÕzôÝŽ¹TÑ59ó) T +P¢¸¹À&çl3À“+«†‘”í„Œ!"m`@Ý];>‘t¤}=Kpdžäc:!íö?×P¡Œñv%ÓjŒ]…Òhïöþ“9¦8ËkHÏÅ7i9Bó«-£(?1 ºmçrW!¸Y·üîEüŠÑO.l}t½ï¿à!¨¡ôû‚î)Ävˆñb߯œ +6ø@° §¬ù¸ªnú‰Y9…ªÊéÔ(£««™ƒQ–†m@XÌ㛑E…ü@¹ÌY}Ó¤ß*fãTð@ çý‘6Fe‰k3ªÇ‘Þ®™Ï耱œ—³ŒMh¥’ŒýÝ0Š©@ÜÐŽü󓔊RŽÊß",¶Ôr  Ï… Ä°‚óGÇ¿í,yrΣI1Qf+QðˆÛóÌ-q¼F¦/0JøÕåö• ˆl™Æa‰Þ²hÞòQÏæÄŽA°ÏQåש3}…6Ž&¹µ²·CE®]ú;däI£uá@ .^}Xlœº‡l*dƇcçKA/\ZBº—#Pz춎¬vï »ž"ãö\, tŒîræÀ¬Á^7©Å÷OiäVüdœJWêRWh0Á9¿"p æÙô]Ï›%ÅÉVE™ Daô@ @¨æ¯©¢`cÜKbŒ A7%‘œE°ÐfÆ»ÜS‚߉ øTO¨¢ë\YšÒ³ vî6¹†ŒìrÜ»Y˜SÇ`¯lØU1IEt§ò.€=üºBÜ,’¾éxD>ianvhº SÊ–;I¾ËÉ*ÿ‰2pÅôÙ2ïÈbÁ? w\”Ž[ŒÀš8u¦½ºZÃG¾éƈ"ìz*/L·33å÷Œ˜þ´%E¶Å)°ìU´“å‰féÐá¦vhnL…Œ^Ã|WRmጽ†°8ÐZ^ÃXyk[pHŠNñÜð,>rÃYè¬éÈáÃ!†7ñÑ‘ËÝXŽj®Áƒ˜$T"&Ü3eÕ;P82šÎ`<\øôó‘}Ù"ÜbR-lê¥U€i÷ùع[Nl ‚"º¹uHšž µÆ½“IÏ)­D;ƒˆÌ”þ{ÇßÌQµ3ŽÚŒ¯¯¸szÄoKlµóò¨60•îËqà´ ›/nXO‘ùÍôÒ) Y3¹‚MÙuz^L’LÛ@ˆ<× ã3< –›M– †ùšÌØæ<]lÉ\x@¾OâÆñ›ˆ)ÈžPfß•@Âé¾´RGN¦tΙs÷ì¯^ÂïxþQ8!¦ß•ã+ºþ¿ÿÈo¿\h,¡Ã×^rk˜x+ÏÛ]Y ?Ãè Ô4½¬Ú·J¤bhJÎïØüò܉ª®·wúÇOÒ‰<ƒrÁèj¸ÛšÁ:b(C]?OeÌY–QíîyýDVŽŒ¯£èôŸ8èo?Î[’Ÿ¥áéÌn ÒâD[c¨x¥ 6Qê›4:añï¤wðendstream endobj -4152 0 obj << +4261 0 obj << /Type /Page -/Contents 4153 0 R -/Resources 4151 0 R +/Contents 4262 0 R +/Resources 4260 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4163 0 R -/Annots [ 4155 0 R ] ->> endobj -4150 0 obj << -/Type /XObject -/Subtype /Form -/FormType 1 -/PTEX.FileName (./xslt/figures/warning.pdf) -/PTEX.PageNumber 1 -/Matrix [1 0 0 1 0 0] -/BBox [0 0 31 31] -/Resources << -/ProcSet [ /PDF ] ->> -/Length 557 -/Filter [/FlateDecode] ->> -stream -xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù -ä -6\>RgÈbÏWÖ¹j[†› -WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream -endobj -4155 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [369.053 626.992 448.095 639.894] -/Subtype/Link/A<> +/Parent 4241 0 R >> endobj -4154 0 obj << -/D [4152 0 R /XYZ 85.039 786.531 null] +4263 0 obj << +/D [4261 0 R /XYZ 85.039 786.531 null] >> endobj -338 0 obj << -/D [4152 0 R /XYZ 85.039 328.177 null] +238 0 obj << +/D [4261 0 R /XYZ 85.039 766.606 null] >> endobj -4156 0 obj << -/D [4152 0 R /XYZ 85.039 297.885 null] +4264 0 obj << +/D [4261 0 R /XYZ 85.039 744.844 null] >> endobj -4157 0 obj << -/D [4152 0 R /XYZ 85.039 175.943 null] +242 0 obj << +/D [4261 0 R /XYZ 85.039 744.844 null] >> endobj -4158 0 obj << -/D [4152 0 R /XYZ 85.039 160.272 null] +4265 0 obj << +/D [4261 0 R /XYZ 85.039 709.638 null] >> endobj -4159 0 obj << -/D [4152 0 R /XYZ 85.039 148.844 null] +246 0 obj << +/D [4261 0 R /XYZ 85.039 459.663 null] >> endobj -4160 0 obj << -/D [4152 0 R /XYZ 85.039 119.625 null] +4266 0 obj << +/D [4261 0 R /XYZ 85.039 427.445 null] >> endobj -4161 0 obj << -/D [4152 0 R /XYZ 85.039 106.075 null] +250 0 obj << +/D [4261 0 R /XYZ 85.039 203.168 null] >> endobj -4162 0 obj << -/D [4152 0 R /XYZ 85.039 94.647 null] +4267 0 obj << +/D [4261 0 R /XYZ 85.039 167.758 null] >> endobj -4151 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R >> -/XObject << /Im2 4150 0 R >> +4260 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4166 0 obj << -/Length 3224 -/Filter /FlateDecode ->> -stream -xÚ¥koÛ8ò{~…±‡d V$‘Ôc÷ö€n·]\v{M= ÛŠ¥$ÚØ–W’›æßß¼(Q¶äpRäp8Λ ü„‹ÔøÊIûF…‹õö"XÜÃÌ?.BX ÈÊùéæâòm¬aàgA¶¸¹ëñdo²xqS|ò^ýüòý͛˕RÊKüå*IRïõoËлzùîW¾zsß?-W¡÷:®~÷~ùùæ—‹77=‰¡R¸ýŸŸ>‹Hýå"ðU–.ž øa–-¶Ú(ßh%ß›‹ë‹õ¸xN/xÕÔi-Ä*Ìü,2ç9Ç~Ä=G"˜ ýÌäHF¾ -£EbŒë„X’ø‘ÇTÀ cï»ßðà» uØ{(±û»è<LŠïUSæ]Uïø«¾ã—¯ª]Éß7Ë,ôšCÛágì½D,ëu}ØuíGá¨*Rç8ÀÐCã\zDÐFÑož ñÚ’(¨w~ÇÞï ò-ßM¹F€z»%@š) € -yþi%^¾ŒRï™èàÐÒ²Àip—Þó¦Û|Ë`„†…–®9ÀG‹ð#É×LÝa‡;t<‹ •´mµEˆ=Ìl„€®FFV!Ȉ¡ãæ›Mž–+j¯ÃÓëÐx×x;[¤å{<È,AÒ¿àùâ…5·Ç‡t݃Ú2\ÞòÄ®¤ÑÂN<ýôPî,E<…À„|SYX9:U‚-ëzt–:<žÃŠz›ÓŸ&E>\ˆkÜs·”QªåhkÜýG”w¬J½Ûœ?·€¥Ž¯!ÝkÌxPìûÁ«¦ly\°³Ø!PCPíÆA¯vIÍ=Cý{W}µ{ð -DÆ,{LÐqWçe‘&Ö׈ù%Ú»[ÒÎÔÏð­«Ö BÏ<´&E' -’áæ¢Ä5HÛWYyrè„/!{ag@Ýö$ÊUYüÀÔw¼øUþy¨z¦µ7 Zü{ê{ÄÙ‰|.dÇJ+Cš‰­ˆ‡kj"0Y-â8ñA­ØÖàDs/«c¡Wø©Ù9ÆIzXLƒµ$q(÷*f~¬›jO†öˆB@œŒ)<²†æ<] -ºq<¦«Þ£m!ã”UHÁå[å.Õ)ô l†kÚí­¿c¸ÑÚøi˜ºTÅ%åìSb‡<±ó»ºc‘…û÷äó`ÈPX[Šì›Ä°YKÅ6«ùg×uCŠ…&ÒU±ÅJ2‹àÓö X×­™GÈM[sï–ÎP2éFYð /"T½˜ƒ‚ÏÚŸŸè½¥F•ìŸïø»üšo÷ÙÌê)ÑÃÍÄP?çÿ³"í;ÈùˆϽu*·þÄ-÷¦B~²€|ºßÔ·ùæ3“žøaHÿ „ -‘ñþæû~S¢-ʆ‡Pë°ÝçM¾-»²iæïÚKº[/àG‹ -ÑqÿGn.msÙÞV;è”M¿l%íeQ~¹Ü6¾ç6 h1ÜÁ=ÊN«+nÿz˜ DŒÑ~¤gf>Ö2:ð£8tc--±ÖUþhÍ;†G¹DSW×Ü~$Í,ÈÐ/Uè=µ2Ž0x ®o;7ù†û×x+ #¥|ç¼Íkqò^ïåj2‘Wåöƒ Ы9ÞD1í|æÀÌilX¦N–dÞ¾©I{×,ÝqŠ8uG -mþØ«5|ç %ÎADÿ‘& Ö-äZ°Ñ¨›Ç]Hñ,œ‰‚·ì(‘†Dž ÃhÒó±éä—¥‹nªÁ³‘r?Uh~†6ëÖ2¹0Cû@û‘Ħ › -¤<µßÏÜ”Nbà¹>{SL/Å'7¥cˆ¹Å,÷R¢ë Ù]°„Ú#˜EAð•åî?ï¹}¿$†ÑweÛ² Ê7s”ˆg)`æeLëÈO8ûûø0„™Ä`Î(pH‡¶¿Q%ñàÆ‚¯»–ºš[¿¥õf„f&ž%³Îtmì-Xc)‘¹#[¡÷‚'OäÆ„¿Ðâ©·ûn*L•IEGÒ¯'“wöyKÞB´¥°rM.$OŠq>+*Òÿ¥Ú”÷½,Ã0ñZöŽ¢=Ñ3*%ıµ ™ARíþÂè~•)J,u–L$80˜ÛjWõ^¹ -Àª¹ÎR"¢ç.Á´Wøt,ŸïÁ¨Ô¢tRÚÁã6öÅAfö,Ëp«¦ƒ$ìŸkópÔŠÏ=†3 -’ ´%œœ'͘¤¯°˜¨>ô)g戮¶ g(G)_ÁÀ½ö4%\á,5õ~,·ÖĪ§ -3öîHÞ7¼»wÜÍw§9,ŠÚ¸±IæjèT -4¢îåŽw³دuW~Qhà½ÅP4%Ð,(\ ç¶Ùfü˜˜äm½£„ÜQü€µ0§¥-• (›+xÑEMVžÓyý ÉDœ“g´RH}ØÐC`:—þ1ïh½¨hÀ¾ š ¥G \YA4‡Š-Ö„ BV{8lå¢OjŸ Ü<âãëñ -´f1Ȭþ­JA¶§’s\–ÝúÏðTL¤'±êSâBïaÆÌ‘‘òvù¶dseG9W¬g®CYó½Êmôˆ ‘p\}kŠ‡0}e ÷—‰£ÇŽ,y;{÷kº¥0vÔ=Œ%WÁü {èƒ)® ²³²“„KúQÖ"Ý(½m¹·ÍL`bÛ§MTÛA’å¦Y«|Ô·Ì{wÇU'mËË롨Ôð K¡ä§qì -‰!cÑr»ÍÒ iÅ?Ý„D¡Ÿ‘ÀvNÀ2‘$~’Æ®""+Ó}ËU¢¶¢ê[†·²w _ÁƒtÕ™Ûzéë t‹÷Î6T{XÍß{^Z9y´›‹f}(3¡+Aà+ýí4Þ>„L·'»›“ÛÆ4NØ0ÚŒsAÌÊDk0sÎ÷l…äæ’­Îú²_•_¶½Ó: îªeG;c¨I=±ìÅ Úž‡èc¢4ò{o÷̨½Øöõ*[ÐëÝ%UÑŽ¥¸7¾3u<ìZéÙVh(wë晪9Õ,Y’ÃÃFw½x˜áʨycøÄOö™û“Qà!WÃUy€::'ÆôAàÝX#kFUlÁTÂ6áDp `OÏl&âÁ©‰2³VêÝjPØh‰¡ÂŠT„lIäÀŠX ë*I–*~Ê |CÉdnËÓX毢ïÜú3II¤3?RçÓ)f>ŠTâ§A­äÖ…hÇ~¸e)e©€•„ª(~é‹£~¦äò`K¨!n¹= ™ûÍóèué²Ð(f˃ÝW¿>[Vz\ÇÁ%üâŒ=*¬Ôýëy×?PcqdÎÛ‡öUr¾éÀÌ{û y¥ÆÎ^‰³‡SÞæ3Ⱥsû gþ’eÃEö_éQ™Ô£ÐXe`Á7UÙ³2 -ã² /i‹Ü·<[ˆ¤Dë´¥×Âvú(«²Ø×ß ±p žiîÜqßd-ðj€žxúcÄã¿vȾš(¸23† tüpD± C`¯CðÉ% ÄY*û§Ì×›¬»“²ÿàc)\’ï»R‚àñØœ\+ãk5)VðËÆíÿú‡¦¡>lÅä¹M”øq¢-1xî8:a±JÁÚ¨ Šÿ Ëþ&Žendstream +4270 0 obj << +/Length 2397 +/Filter /FlateDecode +>> +stream +xÚ¥ÙnãFòÝ_!$LÍ«yì˱³O+˜‡$@Ú"%qL‘Z’¯ÿ~ëê&eQÞƒ1»«‹Åº–?óàŸ?K•ë…Ù,IcW…þlµ»ðf8ùÇ…/ AYŒp¾[^\}¯â™ï¹™—Í–kK'ó\•Å³eþ»sóÃõÏË»_ç‹0 åÎI’:·ç¾óáúþÁ7ó…ï èa‰«_çAê|üiþçòÇ‹»¥eaĤ†ÈÀ¿.~ÿÓ›åÀìžféìÖžëgÙlw©ÐUQ(ûêâñâK‹Ï¢¿5%¯ +SW¥á©À¾šX)7Ž8ovº¬A0?sA¦û[XžÓ´ kV ˜»åü‚ +Fé·ãŒi¬ª²¨©g¤5¼ß6;>ä7š¾£KXÊ»ºÎå£Åç†à`€(ÌÒó–9¡×Ï0½ÓøåW>xš/ˆW° èhᣠ+3’¹-:$XôlÏCWÖ^%°Øòš™…E͈먓=Q_¡¸H DÎA;Àq_V%=øS®á"H\Lˆ\,™~4¨¸£¿Â•ùØj$$»®7ÅgÑ”áø‘Ô‹WÔFs0tPY(œ +¹jv;AõœuÇgë¦`EžðBÿ »ú>{ˆ…n²ƒµMÓ=_¨@ñ7p±)úªYéª+s\~üéöáúÃÝ唵&t'@èKæÅŸâ…£ûÓw½îËu¡‡¥µj.kñ3ÚAÓ:ÔŒ +0WÍÝ1Î )¹}fœß®^yóÞÄß`5èÖx.¬ÿð”‡ly‹Â‘^‘?ü >Ÿt.Sº_3¤'^…‰‘îÉ{ä;ƱRóêÔ{ºãhGV0‚vÍVÞFžÄF‹àˆÂÜF¡rW£ãaÓóÚRÃ~ªdÕ7üDÏj6¼n8ƒÈI'[Á–ÈLjZ$‘GAtê2M‹mÊZWè¸É ö06á‘8+Ž†dà, SHdæQ¶k‹œñÖ­h ñz“`Í»j‹¾sûü‰¿ó‡çGULÅÀ瀭«¾hQPŸÍ§@ž¬²Ü¸ÿ"†¿=“,Æ®z*ö[Ãp²h$i |û3ŠPÊYÙã 2E¢i÷LYS +ÊT¤÷jï‡JQ§¾›¡oÚR¤BÏMbNˆP”\ø~*SÊ“ü'ÕW[rPÙCT.0,çœ+¢W•²©›ZtˆU¢³‘C¾ÿ®ÎÙ’e±Éñק­Éè¨g/vîñ‘p:y•uÃGŸÙ°²Ê‡S[à†—7¶8® r´v¦Úृ£Áz7‘Õ z!?PÐK©¢kÊDD\ȯ8?ì1 ö…â’•í„æÍ7¤p˜<@5áÿ.MÚxSîʉ7$ñŠ¨ôu8}âàŠ"çÓV÷—ãRY¢8­7¿œ,»ø‰„ÛSkò„ [r€cÇsÁ<>1 àñ“´‘1.~¾½á—lÂà–º‘/¤ú k>!‚H¹ì!²eðØ–¢ÔÙ‹Eä8‡‘º‚µ!×"PDGTðÔ~Bm‹ÓÊ€=³dʺ®uÎu?È¢I~§[-—û^PÙ=‘PC­‘@?Ç'$GÝ›Oœ8`w̽NVÊ)§·C5ðG<ååÊR&ZX*å¹ÕB@Œs>qJ2ö©4ŠsÝÕÝ¡ÒâiŠÅWvÆ7kÓYrñä]÷*45S‘HÀå¨ö³y¦úÆë‰òáSùD¯L€àšŸƒÀ½€l:0†õËDM¦Dõ¶-µ²ˆ¼Ó„rЕô:ˆ)m¯& <â«6<`-Uט›x'AœZiÕ´Rœ{–6 ÉHÐë@uó*"¬@¿%·PɠܳȈâç*µâ§6u#ù06\õ [K#‡4)+ ð(ÿò¶¥Äݔޑz>»¡Ãl¥iß½œÓµÂ~aOé>ƒ ¤>Qï§'ÍG¸\>ÃÜA=xuŽ©wV5Áq3Ìl8VØØš°`£ªìIMjõî­aÔàËLF_•ö×ÿ«>$Éá«0ˆõœ²¡÷ÿçÄ ólçXÈf‡–VÑ>x#Ð7}?k½“שb£Ì¨ËãùgÈïî?>" ‘AõŸ—ß\Ê·÷vÖ,êܨ+gdÈ­§>@=]’ðt«”ìá<†.TBU}OCªèþMkä'h0›…QBw +ÿõê"tƒdúâbah-FÄN›(? Ý4 ìQÔÎ7,NÂúrp™‚ÉxFKF# n¨¿‡—äB¢}åm)`ÆmHõ°½bû¬®öš›Œ—œì$œHl#íŽÃ­c¼=p‘¦n’…çârú.à±!WPlkà¸ÙWðÞd(D±·á³¶`× ’Ñ[׈2IwˆCiž³ŒÕÊ®.iÇf˧Úp)';î¹ãíh"†Õ¢¨ùT¦\ÏyÔ£zD¾hešbÞõœ¬ ¡XÑå>.”âhtÍ7± Ä°‘Ö®*vè70SÄ #£*ZÉÅou+¸«¦îPeC5`“ôqÍ·MìLÈخ߈+~!í(æܬÄ‘«’àÝe„svÖ +Bp¸Dg-%³Öõx€ÊKšpBÏÏq$”ÞåhÀ9;5^àf¡?55)EƒÔ@Ý÷ÅnOþóØϪٔ‚Æ ê­ñä¸Æ!d¸s‰Gב°ÑüâÃ2ºúü“a§—X3‹‰Gc˜!Û!Œ(B`žuÓît%Ý+ò¦xÕ‚Eñ>ɪ¥6Ñ/¶|_bîü\„ùaèFqö®?pÎF˜ï)7KÂq„Åaä„2@ŒÝ45_cð*™À¿Õú ¡Uúü…ùÊ»Ü8çðÝ4`Uýõ›hû%¼>÷É·}ÏY/¼ß•ÜõÛJÓ ÞzÔIÐ+ãìï{<~!&„TÛ9º‚?Îër¼¡h䬾í1h…úW6œas#u”¦b=ôÈUƒ´¬“!i+òW—g4*7 +' ÿ™Ôÿõ»Ž5W”ºYL[KAdÇId˜!ßÊÞ2l~ÿ9åø?ý˜˜=endstream endobj -4165 0 obj << +4269 0 obj << /Type /Page -/Contents 4166 0 R -/Resources 4164 0 R +/Contents 4270 0 R +/Resources 4268 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4163 0 R -/Annots [ 4169 0 R 4174 0 R ] +/Parent 4241 0 R >> endobj -4169 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [211.976 664.189 306.903 675.879] -/Subtype/Link/A<> +4271 0 obj << +/D [4269 0 R /XYZ 85.039 786.531 null] >> endobj -4174 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [395.47 69.841 512.306 81.53] -/Subtype /Link -/A << /S /GoTo /D (domain-member-server) >> +254 0 obj << +/D [4269 0 R /XYZ 85.039 556.144 null] >> endobj -4167 0 obj << -/D [4165 0 R /XYZ 85.039 786.531 null] +4272 0 obj << +/D [4269 0 R /XYZ 85.039 523.723 null] >> endobj -342 0 obj << -/D [4165 0 R /XYZ 85.039 766.606 null] +258 0 obj << +/D [4269 0 R /XYZ 85.039 264.572 null] >> endobj -4168 0 obj << -/D [4165 0 R /XYZ 85.039 746.277 null] +4273 0 obj << +/D [4269 0 R /XYZ 85.039 230.03 null] >> endobj -346 0 obj << -/D [4165 0 R /XYZ 85.039 554.208 null] +262 0 obj << +/D [4269 0 R /XYZ 85.039 133.469 null] >> endobj -4170 0 obj << -/D [4165 0 R /XYZ 85.039 519.268 null] +4274 0 obj << +/D [4269 0 R /XYZ 85.039 98.927 null] >> endobj -350 0 obj << -/D [4165 0 R /XYZ 85.039 476.904 null] ->> endobj -4171 0 obj << -/D [4165 0 R /XYZ 85.039 456.309 null] ->> endobj -354 0 obj << -/D [4165 0 R /XYZ 85.039 249.234 null] ->> endobj -4172 0 obj << -/D [4165 0 R /XYZ 85.039 230.761 null] ->> endobj -358 0 obj << -/D [4165 0 R /XYZ 85.039 104.375 null] ->> endobj -4173 0 obj << -/D [4165 0 R /XYZ 85.039 86.508 null] ->> endobj -4164 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R >> +4268 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4178 0 obj << -/Length 3139 +4277 0 obj << +/Length 1514 /Filter /FlateDecode >> stream -xÚÍÙrãÆñ]_Á7ƒ) `fp¸*Zq{“•”+®”툄$Ä !eý}úܤìX•réAs4zúšž>è/<øó±q=•,¢8tòÛý™·¸‡¿ù±UæýæìÝס^øž›xÉbs×âI<×$áb³ûÞ¹øæüzóáór¥”r"w¹Š¢ØY_-}çÓù·—¼üéÃ'˜¿_®|ç >ß|óíõòÇÍdz›–€‰¾RxüÏgßÿè-v@êÇ3ÏUI¼x†±çúI²ØŸi£\£•Ì‹³›³¶¸xO/ø«9n-ÄÊOÜ$0§%†nè…­DØÕ®Ò!JÄ÷WùÁ"2Æ uD"‰\r0:qÖÈr¹žÓü²#%‘á2®ÞÂL+޺ɪ_h«:&9ä$µ Q뛞þZj•ï‰!j7y ç'ÆÙ—ËU;»Œ§åÿ¯‘$ m {D*î=häµÀ^“—ÞFƒÄ!è²àJÎhûMºÇ½ÛTÎN·K@ø²ƒ€Ü9Y~¸·0–4ûQ¶Ço™’då£~bøÐ1}:Ù-I%+Ô Æ«5¹}Bfò){᯶¤Â®4Ù¯ (V' -mÉ<Á·LFzémïëÕöž¯ñ´¼ÁK9µy Ùñ$-`Rðø‰±‹m ñOK¸˜ÄCıì§|?ç`Ó¡²‚ĉvvìóÄ8w0¬P¸“ò¿mïÜN‹â…ñì2dã`éØñê”4”¡%M¸EÄUvŸï ¤+ãlpü`©Ñ„){;¶Z‹KyË?µR‡…mÉ[qÇ.§(u/t.7êæ%’1«»`:põÏxe±cè]¹çË ã†­á%~QÞ¿´/ØÚûÐÙ}õ%Þq¬&oÕˆè°UÒT‘ˆ±DÐ_ò]†d‹½«ÄŽU”0g°x¾e~@þ–Ü^çU¶mÊê…¡&Öåóõð šàuÍ÷–J9åÓ ÿÿŽîÏŽ({®ù¨Àó<ž»‹EÚd•‹ð²„}ÏÄ£>ìÜ[í% nœ>U(]œ£µï9õCù„JÂñ-ÂÈþ¶Èp–V¼Õ<¤ã •ây”ÕC“ÓAâÉZ¤éö'že9+oê UÇS!WÆÄÀÔdÔÊb5ÃezxáGr—×M•ßIÄ*ZÁ}Í -Y%8°‡ ä‡æ‹ðûJ@¸•ŠÇ -¶š‘ÛGˆ§ÇGâ¡ê NCºI»× -åèÙ,ñêÂŽu„@ê MÙ0&dr{ÿ±^Æ9¿(ö×ʉV®ˆ ì€p¡sŽ¯Ñ4ñ.™î]3ßxðÅ7T6YúGüËShð½Œõ›Pˆ:ó5ܹ¶tò‡u ‡¼’Ã<¥:­å¼iÄU˜ïè1 þþîr#4=¿íq×vwØ[¨ûé­¾{´¯¯>Õò[P6PsòçR³Ñ® -Íi5›ØjºÈõ‹.¹^_°~/é>7ïG·œüq½w§¿…ÞOñÒê½ÇÌV‘ƒcÊ òþÌÊ×ð¶øÑiåkí‚«›×>ùõ5Ì/x>rõÝz*G7Ž†·0Sµ&Ðg骭•¯/|ÎJPÊuõ÷ë‹à¨…¼õoü -@\›#A$ø¼Äÿc'tÖée¨¸Y?Pnø šÑß·¯óªû1ËO0ùǺõF€˜Áä©nx&5OŸKx° °G‰jxZ¤$&Öû[w[B¾: '5†ýZà°ºjËÒqmÀƒœ¤(x4L®pEÊ?8¬m5•Ëb¸tèåpˆ±++ó¾äL\›Š!΂ANÕVÅùʈ 2¦lh®òqñ@™×=&p¥P¼Ð8)JnÇõEœ[AÏ”‚€#~ƒ·‹Ärp£ºˆAÕC W=ð™ªÇç1îƤ„Ú Õˆ”q-0¯¢xãE.µt–¤i(j’ààûû¢¼E?ò‚,|¨©ÀÕç¬-ÂûÑo°EHè|£lðVYºûj)dÁeƒüÁ5â»ê …Ù@Ölãü•ÿu6v¤rÖCp™ý*ÅI®´Ö„¾\Òþz<íF¨žÀ¸ï¿f)½êÏ(j„“Z)$Ýê§ûŠ,öqB‡1®?¤b’™"Ä+'ƒ¢" NnM%`CW[oÁ50¼ä·d"\ðí™H¿rT•¾!£3M< ·]J\úº"ÓÚê ý¥LlÁ¹±´÷"2Þ¡rm¡E[öÂ/ÓJR¢ËsïΔ…þ‹zõ:ÌÒ‚|aɳjÆ´m“ ­ÉÒSí´ív2ÍM6u]‰ ·¡ƒ¶½çã)ЫøŒYŒp"WÙa[½<Šï·ä7õ3Þ*dïfêX؈¼qyB`N¯‰«¼h@[ž¬njj -8QJ\ÌKVÏS๑± ¤ú–jcÀŒ‹Á0è;=Œ¹à-‡eݧ:«¬)Ê5µ+§±½Êî¢YØÖR9‡T›O?#Á™36KcMMÅ~AHIÇÐ ù?G´Úö(’°ûÕ7q -ºÔûÙNŸsÛBÀ#š&ëêŠBOy´s¹•_E¤Òt¦ö764#n[ÒZyýâi¸6½ß=Ôø#DõcÞ¥´R”ýmCÌ&A2Š•œ ~³±´Í™†a2Ûh`2ï„ÆVÓDºúÒŠAo·ÑšŠ ³JéCìÔ%o÷Òìm,ÉYÑ„^±Th£•F¾i›1iEÌ샴(LŠ¼MYøó¼#cÐ[´ˆå<¨S¼üdŸí¥€ªè¦Éo1¶iw©Š2—–îKúe>ÓÃκ¾è§ -d„G3‡ó^Óÿ’è—A‹2¯Ž ÛAuiÕ‰'ä¶Z‰âJÝk2íx‰LCãOLжKl‚må‡-ØÒ´?ÝØÛ õö´nÃyÝð¨RÖÖ_»+x;-µe öTz˜Ÿa›Ê>LöX!Ü›†ï:sÃç%íµ®[cŸ3‚ ¼ë¨C6ç*½ßç#ÿr¤¡¤Œ«ùÇ}ÓRÀ+u¤ßY -ˆ!8Ò_6 -†‘¶Ä C¡š«§˜XÍPü_†Ú}nÞ|Z­Ã0ôŒZ­“$õ^߬´÷ÇÕÛ,¾^­µ‡¢\}Z©wó~õuónñf3B˜ÔaˆþY|þê/·öÝÂWa–.`í+eËz™P™(”ïjq»øs´Å{Ñ’O]òׄ©2ixî°66FÅQB_±OÛ¶¶eÃë¼mÐ¥¡k« +¼,ÐÉŽ·ðm{\GÞвÌ6 HÛc“¼ÑŠáÀ§QÖÚ|X‰×v ¿c4Žzb¬äoÀEÞæPö,>öGK N‚ñÜ¡eB)ȬØ>”#~õ\x€· þIM:Di»ZeÆÌ)ÕJSC”¹ +îM½1¾wm‘8öš‹¯j÷¼h"VÀ?ºB!€ÏÚáÆÅ7ÁgÇ[«Ð¶BŠ ònv([¹ÅîP<8õ¿Û4”Ñb?Þgyã^ iÌÏx™tžMµ8IUiNµÝð$úcžãgAÑîwGدªo +ò³k?…û µÅ¤©ñœ$nÙ17,·xV’bGþV³´ÃoÈQ´KÞ$¯¤kê2³žµ{N·WȲåCe¢—7 ;™”J$2ÉX (+¾ø:$[äú è™ÎÕ]aF&öè€'h`}b˜ñHn^P’¡2d —Jw-RÛl_ÀgŠˆ¼…•³PÙ².1?FžÂ9ª±eä¨åرeÆ4†/ê9ñÃâGÙ‹–d%÷‰â¼ µÛ´Ãy;¹·}/½d˱/å.JÖu.ÝòA=Š; m%ò9¶}8±ÉKè²H{Û£\ kªWP˜]SßCõa™VïQŽÃÀ™ÛóÁÑ¢ž¥} c`ñWÙ0‡¤&m ätv´’ÎçqÖ-^µuv&¸·¶F+ßì:œcë¾ÓíÝ…¨îZ’¤LgÕ¬˜M¤Òçìùh¨bÝG•E*Ë"Ñý⟫2?v*ƒù‚;䦨@C³üœ·,ò.à ¥ýÄá©ÜHƒ Ã~ÞëÎÑžŠ'O8k÷аãÀxׇ‚ Þ1¬5c' ‘Ñ©iÌB1‚ÍÊG`ï0€— ¯@€Øç¤ç"(Œf@×r²†°hýˆ¤9j왑(Œ»9'›€ÝrsïŽX +ÓÑ'<áâW¡(h!뛫$äÄýQäG Ö+>s¦3e|ÇôPôýí Ð"_ëïü÷_J@°¨UœD(©Û®¸I« ›¶ÙJ§;N{7„ÇMæûÊÏâ‘ãYËÇéÂY(m£ÜÙº‘Ú+L(æ½äªê±×k°Ê#‡¸–²Æ?0@9(ÀE:-B¦}ÛÀh©¥+pKE×mÓ·•ØYóŸ÷-u2îÞ-D¤£±†9z¡ë‚:XJž'1ô?üîÙÜ Š%ûؤ Þô˜²Øå.tN¦qšc‚õõô–Dñ>â§m¦ +IpÏæ >bWk«2?ñwO Ê +ãÖ‰ÚŽŸœ[»aËÁzÊÏxy[(ŒžÏ¼dµ[ÍÉnpYò›{*rÆ¥qØÖ=ˆ%/-,î;œúÑwìKE]èo:SIêòü¶XêŸ+0¯)ô(*þW¥Ø÷ð¹©Ô ÜJäzÐy]îË]7<6N¼­»Pe:K  ¹LúDEñ£·ÎÛÙk†o}O¤·Ý`§'A8½&èwY—2›¦m8µS÷S¤wê¹Ù®{$>”ü‚ \G”ï³&½Æc¡¼7ù}è¦ËžNç,„FEüSîé›þs&ü¯ŸyãË:JU–—Ö&H¨Y + Cì?ì~ž#þS{¯bendstream endobj -4177 0 obj << +4276 0 obj << /Type /Page -/Contents 4178 0 R -/Resources 4176 0 R +/Contents 4277 0 R +/Resources 4275 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4163 0 R -/Annots [ 4180 0 R 4184 0 R 4185 0 R 4186 0 R 4187 0 R ] ->> endobj -4180 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [215.483 606.235 334.938 617.924] -/Subtype /Link -/A << /S /GoTo /D (samba-pdc) >> ->> endobj -4184 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [226.58 380.651 265.633 393.553] -/Subtype/Link/A<> ->> endobj -4185 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [203.74 321.487 256.096 334.389] -/Subtype/Link/A<> +/Parent 4241 0 R >> endobj -4186 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [289.289 249.077 378.732 261.07] -/Subtype/Link/A<> +4278 0 obj << +/D [4276 0 R /XYZ 85.039 786.531 null] >> endobj -4187 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [250.286 221.676 327.4 234.578] -/Subtype/Link/A<> +266 0 obj << +/D [4276 0 R /XYZ 85.039 738.261 null] >> endobj -4179 0 obj << -/D [4177 0 R /XYZ 85.039 786.531 null] +4279 0 obj << +/D [4276 0 R /XYZ 85.039 703.515 null] >> endobj -362 0 obj << -/D [4177 0 R /XYZ 85.039 766.606 null] +4275 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F62 4047 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -4175 0 obj << -/D [4177 0 R /XYZ 85.039 744.844 null] +4282 0 obj << +/Length 468 +/Filter /FlateDecode +>> +stream +xÚ¥“MoÛ0 †ïþ<Ú3¢(ꣷ¬I¶[¿æ[ÛC°nE¦] ÛÏe»Ž» Ù"õ>$_}¢ á!z&ø¶+ ÜëÎÇ‚úˆº©G1šb±d0™ÍáœdP’‡æîº<þ´¼hÖWUÍÌ¥`U‡ËÕyEå—åÉY÷û¸ª©Ì¿Îš¼ºªl,Ï?W·Íi±n„$1g€—âúÖÀž9Eø£kƒ”ì +'Œâ¸ÿ~,¾—ÃYÝžƒ.k®Þ׈Úku¦r!…^Žäx"g &LÉÎ)YKÈt=Úœà¼FÕ"Amÿáö¦#ŒNÐçÂôç‘E'Óï.NvVÏÊ—ÓÁ’÷hÓ~°ÞCĤo«ƒŽ#³Bj{cÄlõE‡s²¬-"‹ÆÑ\QÓâÚŒz”ÒØ‘µÞžš6÷¿}WÅl¬c±!åˆ`p¹ü~4áLZ ù9Ò=Y3a{£sxR–[>uÞ^«­ÿnwÙ×?uù˜Ù•«çÝöáé‰#[û¿æ hl"Ú˜ÛæЄ0‡¯¶³êFzß]1í 7¯@91½Oað SÇE;ßd±}pÀ¢Vä¶Ç~â=ሢMéƒFÄÿ®$ýBendstream +endobj +4281 0 obj << +/Type /Page +/Contents 4282 0 R +/Resources 4280 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4287 0 R >> endobj -366 0 obj << -/D [4177 0 R /XYZ 85.039 551.795 null] +4154 0 obj << +/Type /XObject +/Subtype /Image +/Width 599 +/Height 387 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 25699 +/Filter /FlateDecode +>> +stream +xÚì½X×û¿-E@Qz°VĆÝ`#»&V”X1Š‚ÝØPQQDÄŠŠ‚ŠŠ+Š‰Šˆ Œˆˆ½»‰`”Ž÷‰çÿw˲.°Ï}k¯™ÙÙ™Ù3gÎ=Ï”sþý -pæ´´´_ýµyóæ4§¶¶6 Ðè»wï.ÓÖÖ–ozÇŽÙW¥—ƾڿY[ÈÁ÷UíÚµ³³³ù&bÏ]‚||ÿý÷™™™¼s&&&—žÓÔÔôæÍ›¥—©®®ÃM¼uëM)ËP={öd_õêÕ«¼444ܵk$ b¤’’Š§RRR||| hb·nÝh"›„hiiIÛ·oþüùì¯ãœœœhbݺu³²²ø–9tèÐr'Ožüã? +4Ô«W¯TUUMLLH²4ðúõk!ÛYzâÌ™3i3 A– //^¼°°°à½8éççG£-[¶ÌÏÏç3//ÏÁÁ¾Z·nß2cccÉhÏž=£)¤Hmmí¸¸8«[½z5Môôôœ>}: øúú–K‚÷ïߧOÒ7$ ò$öìÙCÓ{öìÉF;uêD£GŽ)=gdd$}Õ¥K—ÒË´µµ3g lÞ¼ÙÞÞ¾¬Õ5iÒ„&Þ¸qãúõë4дiÓrI:wî-YUUõÕ«WlÊóçÏUTT(®,((]‚„‡‡G§N A•—à®]»hú?üÀFÛ·oO£G-=çáÇ˺'HÜ»w—šš*puì~¢@h±å’àíÛ·¹‡d A–à‹/êÔ©Ãk=v•RàÓ¡-Z´ ¯üýý¿)ÖÒ_õëׯ, öïß¿\$Úµkçåå ¨€srr|8eÔêÕ«ÃÂÂh]÷îÝãëì€ü@¡Ššì°oß¾E‹‘ z÷îMõ¹ªªªðj¿Fõë×oÛ¶-yÍÍÍ<²~ýúààà#GŽ\½z•¤óòåKr–¢ç)ìùóçôw.\¸¹sçN__ßY³fÑ_þá‡Ú´iC™ðͼRWW·µµ¥ù){}||È”á/^¼`  + “““>¼qãÆÉ“'÷ìÙÓÑÑ‘ÝVÕíÁuìØÑÕÕ•"ÁÀÀÀß~ûâ©ÇSˆüä%##ãÑ£G¤6Ê"ʨyóæ3¦{÷î”5kÖ,+‡ÕÔÔè|ƒvÉqíÚµ´k¿|ù‚ü€JÆwOž<9qâ„ŸŸß/¿üÒµk×:uê”U›››SD3räÈ P~êÔ) +|^¿~l?~¤,ýý÷ß·mÛF™L~¤S Êö²Î@hgÑ 'N¤ÝñðáCÜv!Ê£ïàÁƒ‹/þ駟lmm^ «^½ºÝ€<==·lÙrúôéÛ·o㊜ ¡ G;"88xæÌ™trr¸ïH—ÖÖÖC‡¥]L3“R0ª,÷îÝ;~ü¸Ï?þجY3EãÆ{÷îM¾£èãܹs¸¥@ÐΊߺuëäÉ“i'ZYY•ÞÅêêê´ë‡ FÑ"†§OŸ"ßJIAAÁÍ›7CBB&MšÔ¥K +èJ‡ ­[·2d… ‘‘‘"LP2rssY°?þ|ÚÑMš4)0êèèPñ˜>}:šWP + +)Œ¬·cÇ///²›šš_ugffÖµk×9sæ>|˜æDuWeOöíÛ7wîÜï¿ÿžŠDéS£6mÚP,IéÊ•+¸gž|8sæ ’qãÆQ¨Èw•N¥¨h‘©˜½yóÙ-ÙÙÙ±±±«V­úá‡ø®pRõE•ØèÑ£7lØpéÒ%:çGvòR\\|ãÆ *BC‡¥âÄwZU«V­~ýú­[·Ž +aaa!² ñEFF.^¼¸M›6|÷tjÔ¨áêêºzõꘘ˜œœä/dº“'OR8p ±±1ßIWÇŽ===©p¾}ûy#¯_¿Þ·oß„ H||5££ãŒ3ÂÃÃ錤ɳgϨàÍž=»ôùX£F¨¸nÛ¶ M"*ñ?ÞÊÊŠ·zÑÔÔtqqY¾|9®Aù¡¸¸øêÕ«+V¬èÒ¥ ŸÛµk7nܸ°°°´´4d@¸øŽ=Jâã»ÿ¢¯¯?`À€õë×'%%á = ÿBLLLôõõ¥B[£F Þ’L{êÔ©80Hj/^\ºtiûöíy_d ˆ¯_¿~>>>7oÞ„ø€âBB¤ó7*Ì:::¼Wò©ÀÏ;÷Ê•+x=€*ÈçÏŸ7oÞ½E‹¼×ˆœ===O:•——‡\U¢¢¢ÈÈÈ3f4mÚ”÷X CcáÂ…gÏžÅI ÊôÑñ>vìXCCCî`×ÐÐ8p`@@@ff&²Te^½zµ}ûv:xûYÖÖÖ¦C†¦ãW”¿ÿþ›á>}úð¾ÆnaaáååõÇà>¥ÃCŠùå—ÚµkóvIùã?Ò¡”‘‘,@þùôéS```ÇŽy›œ¢Q??¿¿þú ù€(WW×èèh<Ñ €”)**"Ò¨®®Î½ƒß½{w²!®Ã FXãù?ýô“––wÍsèС‡Æ›}ÈÃJã„ 8Ò°;wîÄcØT†Û·o{yyq½Æ¨ªªöèÑϺ Ÿäççoܸ‘RîÙìš5kΙ3çï¿ÿFæ :>|ؼysË–-¹ËžÍš5[»v-šu@!ÈÎÎÞ°aƒ¹¹9wÓá¼bÅ +ô³ €pâââFŽÉ=Œmhhèáᑘ˜ˆœŠ•g…^~ňŽŽ¦C˜k‹FMMmܸqçÏŸÇM|xIKK[³fMýúõ¹Ûë}úôK‡/Õ䃟~ú {Yá 1bï???ÞÑáÇÓmcó[YYiiiÑl-Z´ˆ‹‹87³íÙ·o_óæÍi9vvvþù§À¿Ü¾}ûøøøË—/Ó€„rµ¤¤„ör=xêëë“ñ°7¨ +àŽ ¢S\\Ì®y¶jÕŠZŠì¨º¦*ÒEEE4@6áªkš_]]½,IQ¬÷ôéSÞ‰üñG›6mh ööö§Nø×/_N›6ÍÑÑÑÄÄ„b%îÛ²$(úöðýY:#%RtÆF_¼xA£Òl‡ðîÝ»îîî\›ôY& ˆ¤§§/Y²„ëʶnݺk×®•r'¶¥%8lصkWH45kÖTFŽÞ£Gn +I"—Áƒ³Qsss.”#E’8Ê’EŽ7n,}3.;;›¢K###nNޛ㶶¶ÞÞÞ)))t@ðJw6nºèÛ÷QQQ¥ÏåNž<)å /,,ܺu+w´V­ZTo UR X<þœ÷ŒŽÎu:$“3ºÒôóó‘ô}@gç. Ò°oß>ª#""¸)ëׯ733Û¾};={öš5k¨–ÎÉÉá»'P:“'O>~ü8Þ´iÓ³gϨÚ?sæLýúõÙD:]¤Õq‚300ˆ¥Ã'---$$„[ßlÜôòniýÀ¼SöîÝ;dÈYÅà´vkkkîv!U)?FrΣG†Ênü©ªª4èòåË2ÜHTR)÷•ÕÔÔTÚ§t¦ÇF…<)P:ÍõìÙ300†Çoll¬®®ÞªU«øøx."³²²¢ÃÇÐÐ’ ÔÔÔlll|||¸åðÍ&ÊÓ¡B$Ha&Ù–¯E—ÏŸ?ëééÉ6ÿ!A”†ŒŒ OOO®mÎ;Ÿ9sÙd{¥ÂÆƆH==½åË—ó=ì B‚ˆ—OŸ>Íœ9“Sa›6m¢££‘-@ÊP©³µµåô·mÛ6ù|’@)ÉÎÎ^»v­‰‰ ;Æ[µjuúôid ±±±NNN\+¸òü"Oi ΛçuæÌ1‰¦víÚ@‚Hœœö°.;ÒÛ·oƒl">>¾[·n\_™Ë–-+((óm.-ÁQ£~ +X-ÑdkÛ@š*ô÷÷ç¢BîQ[Ä£Gúôéà +XõêÕçΫ(MÝâr(U„ììl___]]]vÔ0àîÝ»ÈPIÞ½{çææÆ^Ò©U«Ö’%K« 0H€*Eaa!E…¬¥UUÕŸþùÕ«WÈP(Ö#å©««³æ¦OŸ®ˆ­»C‚TͨpÁ‚ì½Bâ¼yó¸FÅø&%%%»víbW(9rä³gÏô¿@‚TYÞ¾}ëêêÊ*CCÃM›6¡9nðM¢££7nÌŠM‹-nÞ¼©Ð ŠsûöíÎ;³ª I“&Òo( +÷îÝsqqaEÅÈÈhçÎJð§ A z9•AÎwñ‰'È€lSmmm©ºC±Ÿ?ž8q"{ú¥zõê‹/Vš‹ €!AFaaa`` žžm­ººº§§'n‚’’’õë×kkkS©PSS›:uꇔ¯rã•ààÁý½½H45nÜTÜrBiþ|¯Y³<¦;6Šý¬)9ùréÑ6p3”µ1”BC·Iú¤î›IQ$È(((ðööVUUeýö†„„  û*KJJŠ+À]»v¥Qå®Ü˜IR 1M:µ‡Z‚5jÔ(+Þ2d€Ø%rõêÙÒ+¢mೌ@\]‡C‚àÍ›7Té±-oÛ¶-Þ(¬j|úôÉËË‹½þ`llY*7\"J½e6fÌ°qãFr©sçv• ­”­ˆÖËFù,ãî>Ž7uìجäu°Ô©S‡=?}útEiT’#GŽXXX°7I/^,ÿMŸA‚@&¼|ùTRÒy.y{ÏE‚:µ×ú4ìâÒut´§BÈ6iÒˆW‚zzºlE´^ä[Ñ’%ó ÁÊ“••ÅE†††¤EJÌû÷ï¹ÖÏÚ¶m›ššZ¥*7HHA‚­[;r×*i¸k׎ÜhÓ¦z÷îÉZZš—W‚³fyÐç±cwíÚ Š‘;wî´nÝšý‘þýû¿~ý…’Aÿ¶mÛØ]]Ý­[·‹·!AHðÿ—`ûÿ#ÁöíÿÛ ’`ZóæM§äåå^–=<&Óç‘#aTº AÉU’:::4,ÞJÈ'OžtêÔ‰ÔAƒ½y󦼕ƒŠŠŠ‘‘ÑÏ?ÿ¬pOC‚@ÊlÓ¦%ëÑ°ÐHÐBȃ1B$w:::”?~ìׯûG:t(Wm ä:“ `ç6úúúááá ñèéÕ«W ,>|8$ B‚BÒ¢EsHL,Ñðòå ¹Ñ¹s=}}½¹QOÏ_ØO’’.q¹4~ü˜²$ˆ{‚’æðáìB ÀÀ@¼C¡ Ð9L»víXùœ4iRvvv%¯sRX³fMn:)ÕÚÚºzõê¼³}íµvž¡¡aPP——É—†=Ê-ÇÊÊŠ*úa‹-âââ.°Y³fì•[·nÙÚÚB‚@úÔÕÕÑÓÓåRÍš5$ôt¨ˆ–Y¼x.ÐêëëQ244X°`&“`ãÆ ÙDé'}Ú*å“ ÝÜܸ¾z«ÂJÆ–-[455i÷™››Ÿ9s¦2•7œžžnbbÂM_¸p!÷f=¯W­ZõéÓ§'N¨¨¨°á“'O6lØoÉùùùþþþÜt¾.^¼˜¾¥uëÖ-[¶LŒìÙ³NK45hPTh Jù=A%8k–ï–ÌŸïÅ$H2’aC1ÜV)eÁ8wîÃÓ¿ÓÖÖ¦J!¡¢€½zõúß‹´®t>SÉÊ>‹ŠŠ?~¼qãFÎG|ežW‚œãH‚Ü°ªªjé…óÎ÷@ +]\\h€þKeZùC$* ÁøøsW¯ž˜nܸ([ Ž1TSS£´£¢•µÍJcÆŒPz þûµÛúÉ“'³ÿèììüþý{/r~)ÛÀÀ€=-®ÊA]]ÝÚÚÚ××—{\ê›,køåË—Ó¦Mstt¤ RCCCà­[·Wå %(o‰W‚ãÆÖÒÒ,-A²’”·ÊÝ}\U #**ÊÈȈõ-NÃ8dä¼¼¼‰'²ÒH1Tff¦¸*Q¦‹.A[[[ooï”””ôôô‚‚!\°`Á¼yó*s- $(.þù矾}û²?;~üøÏŸ?ãÀ‘nݺeiiÉÚܺu«/\‹]‚¨ÆÆÆ¥¥¥…„„‘à7´´´*Ùã $ AHPŒ³Ç-5j”œœŒcGæï6nÜÈvŠƒƒƒØ;É»£¢¢¬­­ÕÔÔlll|||„HBÅæÍ›‹±rƒ$ Vž×¯_ÛÛÛ³žw–/_ŽÃG†dffrÍ -[¶ìË—/Êôïüüü*y-”YYYJ$ –‹¼¼<Ö«³³s%Ÿ?#11‘õ©¯¯¯|nÆ +ØB‚‚vòu KûëÀ]’~ƒF”ÄÚ…åœãdzJØÊÊŠ*dXIšìÞ½›=ZéääôìÙ3d$( êèèü¤ „+U¿ 4`mK®X±U®ÈÍÍ;v,+u+wGH’ ^–£+Ó˜|–“;wnܸ(ó””t©¼|xãþýDyH¥%XV‚¼40Ðwt´—h²··ƒ¿ÉáÇY_$ÎÎÎ\ç8 ¼<~ü¸qãÆ”…Éê%¾²½bÅŠÉ“'³á¼¼¼I“&é|ÅÝÝ=??ŸûI…»äöíÛ×¼ysšÎþüóOH”ŽÃÃC¼¼¦Ê<Í™3Cˆÿøãè¡C¡%ˆË¡òÃ7¨nd ¬¥¥¥!CÊ YõÑ´iS_|eûùóçdd69ùré̓Eb„þýû³ ÈÈQ $_P¦M›6MæÍò•í/^p‘ ¹‰{J§¸¸˜“cå»,«un±Hp„±»vm–hrph *¨åüž o*-AnãÙ Ü( T>-½y ˆP=ɺå¥þ­[·"C„畧§'Ë«M›6ÉIåÀ;ºlÙ2ò677çšýðá'ÇÊw)(Q Žù“ƒƒDSÇŽí!A\ûåPî¹P–6´æ•`ûömùftªWÏ… ²ŒZµjr£,ººº²L:$?•Ã¿_Ÿý믿–.]jeeõþý{öÕìٳ׬Y“›››““ÃwOP¸¿Ù¥ D%د_oI?3Сƒ$¨ ”ç÷B40Зa«ã è„……±û\ãÇGëj|äçç<˜2G[[û÷ß—·ÊA]]â¾qãƽ~ýšûJÈÓ¡Â%øÍ.¥ A:ynÜØFì‰þ$ˆHPìIHË-ÑÑ‘{÷n—f[1|éܹ è\¸pAKK‹²«wïÞx…ƒ")gggöQe^ˆ!A¥” œ'H°\ܾ}›ªzʱN:Qå )((èܹ3‹)s!’–àÌ™Ó||I4uéÒ„!A ăfff”i]ºtÉÊʪÊY‘‘‘Ñ®Ý-±×«WïñãÇ(R ŸŸÏo¿…zxLf/ Þºu…Ý…¹yórÅj€ØØ“¼wsnܸˆ÷´œôîÝ© ¬©©©ÆÆÆ”o­[·®²ñ`ff¦£ã/”5hÐàùóç(Ò‘à/¿L‘hjÕª$¨ˆåTÔ6ååï¿ÿfò¶hÑ‚{çºêðñãGkëÿžpnØ°aüû2” Ô€ˆPiPÛT€—/_’èPjÓ¦M•Å€NNN¬M¹W¯^¡$HG‚^^S[¶tN¢`BBH œ7oÞÔ©S‡]ÍËË« +977—¤OÙÊÊŠþ>ÊÀ7-Æ7Pa Ê$A‚á¼}û–]íСÃçÏŸ•ûÏ’è[¶lI¶~ýúŠÒ¿Æýû÷¬§§§¡¡aooZIA‚ €—/^è˜êÞ½»ǃ………¬%UssóÔÔT…ØæÇ›ššîر#+++;;ûüùócÆŒQP Žçjnn&–daQ‡ì B‚ˆ‹§OŸ²÷{÷î]\\¬|°¤¤dРAìø‡*Êf=Úßß¿¬¨¶¬cJ÷XúA2ú ·¶¶¦Ùþ¡ýn€ŠÇâÅ‹IÍZZZ àj¾–– xŒY½Ú„#=244¤#‹b åó ——ýµÚµk+J È033+ëÆ¥þöXº1´… r +²4¾U«VùøødddÐœ3fÌpss¸À²$¸`Á̘˜(–Nœ8Ô©Sûo¦Áƒûq?¡Ä^Œ‚!AÄÎõë×ItpM™2E™þ׺uëèOijjÆÄÄ(Ö–«««—ÕÐë7ûü÷ÿö(¼EÐo.hРAff&&åщ“À–%AîeyJ&Œ%èÓ××ãÞ…¿råÌС AH qñâEªxéø"q(Ç?:zô¨ÊWNž<©pobbÂÛh6/¢ô'ø¯ÈÍbsiÜ+¥ûäý¦9C%$ÄÐZuY bׯ_÷ës¼õy½ B‚H”ß~ûMUU•*·ððpEÿ/—.]¢ª‹€€EÜþaÆùùù üJ”þù,Æ{•›o¶o.  ñíÛ·}W®H˜¿‰µuú¹§ç/ˆ!A¤)ƒ]?LIIQÜ‘ššj``@dÆŒ +úîܹC!(((+++'''66¶W¯^ì+Qúä­[·nDDçA¾Ù¾¹4n`éÒ¥7n$QÞ¸qcàÀŽoݺ2}ºû7“·÷D‚ RÆÍÍŽ2==½¿þúK·ŸâÖNxß¾}¹ }ŠHbbâ÷ß_»vmuuu{{û•+W²é¢ô'øïÿíFÐÊÊŠb|vo6ÑŸýòåKHHHƒ 444hÃ"##Ë%Áž=»U²ÃÓfÍš@‚ ’†êºþ;ånÒ¤ w¡LQ(**¢ˆ‰6ž¬‘½)+„G‚Kˆ!A¤郎2:ÖºvíªX/MxzzÒfS$øòåKìGHTˆrЗ„’žžnjjJyKZQ”mŽŒŒdÏ¢›xH„!API®^½Ê°Ü³güomRRR5hkƒƒƒ±ï AHPáÊ ¥µkW,Y2O`¢¯$ÑÆì… §„¯«¬í¡´ýË+=”½rþ°hNNk ÜÝÝ{ „T‚uëZ”éÐW’0Hpðfáë|uíÚ¬ +VX÷CrÛùBIII¿~ýh#[¶lYXXˆ]&ŸlР^%û +444à“àÍ›—[µjþ•F‚––æ_Ÿëî5|ø .Ñ(M¤¯$'Á:uLËZÛBW×Ἡ{÷®`Õ!??ŸuDÛ½{wù|ã`íÚÿª;CCÃ/^`É­%Ñ€vbâô,¯|<~|_RÒy.Ѩ(Ü¿?˜"8š ®©WÏ’]»v7jiiáéù ¯;vt*k];c¿‚«$—š5kR>“nämÛ’’’ÔÔÔTTTbcc±§ä³r;sæEgâJññçø$¨¥¥²‘R‹Í!Á*+A¾ ›«V-å]²dï(Eså• ->©ø‘^!Á*È©S§H4Õ«WOHHŸ­ÊÌÌd·çÌ™ƒ}$Ï•›„“ ¶¶6«Áºti Vu ZMÿ“ ®nµV­þ» ’ ­mãÍ›})-]:§, zxL¦ÏK—~_¹r $X5!Ñ|½³Ó€kTDæ°[m۶ŭÀª,AMME‹fQjÔÈD$XH!¼víü®]›!ÁªIQQ‘££#åöÈ‘#åa{8Àž\U¬Ž!A±K÷!AJGŽ„‘•¸¼‰w4(hïèòå þŠ¥X–qO°ŠóäÉ“ZµjQ†“€d»%¯^½ÒÓÓ£-ÙµköK••`JÊÕaÆ𥨨C BK°U+‡Ž¸D£’{:TDÅCëׯËYrݺ•L‚S§N,íPi&Ú0HPÊìÞ½›2\GG§¬~Ï¥C=h3 €=R•%ˆ÷•¬œHÿ=A%Èw5•]ke’mC1܆¡Î‘&}ûö¥|ˆ¹¹Yi ’’¤¿a®®Ã!ABúúø±î«W¯¤¼jöDhŸ>}°ä¿r‹ˆØ+«4k–$ B‚@r <˜ržëî\:°~"ôôôd{G”«r›8qlݺ¥“ƒCs\…!Ae’ ¤·D®tÿöí[ö¤(×ø¤ÉÊÊÒ×ק5nß¾–Q Ê­¬fÓtuu AH”­ÃÂÂFŒÁ;ÅÏÏwtøðá4Ø%%✒°Ë1UUÕzõê?~¼2‹"Ñ¢ÌÍÍIOR8^¼¼¼¾>>ÝJ>›0Â%èé9ùر½,íÙ³¥, <¸»wïž,ýüó(Þ¯–-û•ûjÍše¼_ù#÷ÕÑ£û!AH‘ôôtKKKn455ÕÔÔôáÇܪái%“ }~ùòåäÉ“•YTqqq‡¤ÓñîíÛ·UTTÔÕÕoݺÅ(¢}|p¯?ÇÄ)K‚«¹PÑʪ~é®”cÇŽäýÊÄĸJ½,¯d°æÈÂÂvÊCŠˆØ[Õ.‡¶mÛöÉ“'lxÖ¬Y÷-[¶Œ’ [·nMyyy“&MÒùŠ»»;×n­:<<ÜÚÚºzõê|ÎZ¸pahh( $$$899Ñ ÆÆÆ®®®ÿ–êL™Íoee¥¥¥E³µhÑ"..NàlÜÌB¶gß¾}Í›7§åØÙÙ ì`[Haa!­±’‡ä;w(¨$7‘¤$zìwëÖ¶|úôéðK• f™üÚϳ` jB‚ $X~–.]º{÷nÈÍÍmÒ¤IAAÁ”)SÈ2ìr¹ì߯Ífúùùåäädgg¯^½zÞ¼yÜ‘N3po«q[²cÇŽû÷ï³áºuëÆÄÄÐbIµ«V­â‘Îüýý6l(p6nTÈöÇiE´º-[¶888‰ÉÑ£FªüQIb¢eRH(¹ÿðáô +:‹øøñ#üRu"Akë"G‚&U-ÄåP\—)R;v, 3›„}…FŒqéÒ%°°°ÈÈÈ`óS=Ì]A(©¤¤$ò)7ÑÔÔ4((ˆ¯ö²ÍäAáe{H‘jjje•:ÆĉE¿Ø[™™™ìyR•$Ê:uê|m¹(rQ\ Ž5tÆ•,­\¹°, FEš2eqtt¤ýÂúÑ(/ôÛ={ö  "ÄåP$Q.آΑ7öîÝKû¥eË–åýá•+Wè‡&&&_¾|©Ìa%ÏüðÈ B‚ $¨Ääç盚šÒ®¹|ùr¹~8jÔ¨J6; ÊUå¶víŠ fJ9EDì…!AHÈÙ×tÊÑeá»wï455UUU_¿~­”‡ÕΛªšSR®Þ¼yYÊéîÝk •Py`9äÅ‹jjj$µ¬¬,@{³oß¾ÊznY%±'44HÊéüù“ $ ™C:+WÿJööö4ÿÑ£G!A¥‘à±cÃÃC¤œââNC‚™sìØ1:ZíììD™9)é¿‹ÛFFF~$F 'Oþ¹cÇv²M›7¯«²LL¼#å”’rÈœÂÂBccc:`IpßœÙËË‹æœ1c†¸ª_–ÈA2¿R±páì*+Á |½½H9=ºÈžžžtÀÎœ9Sølý™››Óœ×¯_—„gÏžºMúÉÅ¥{— ^‘€¨Ê°¦DÍÌÌJJJ„Ìváš­aÆb¯~™ÉG2©ŠÝÜFUq âeyH€*©ŽYÒœy¦NúU !AD‚ˆ!A” R³¤¹²f  ‘½Y/Ê­CH‘ "AH‚=öinn^\\,p†k×®Ñ õë×—D  "„²ÅÒÒ’[’ÀoYÛ2•.D$ˆH ‡LŸ>]H‹ -[¶¤oÏœ9 "D$  |àÊêTâŸþQQQÑÒÒÊÏχ•O‚ÁÁ›VK9EGGB‚ +WZÚOSbòòò´µµIviii|_………‰×  \IðÂ…SgΓrº~ý$ B‚@® šŸv)oú¸qãhúúõë%*ÁQ£~Z´hŽô““Së*.ÁsçNP\&å” *biaiÓ&¿+ L>>‹%t¾ê￲ôêbcO²o +k“(ÅÅFŸJà›°"~þùg¾é 4 éÉÉÉ•àÖ­ë㤟FŽü±ŠKbpò‘”ÓéÓ‡!AÅ•`Ó¦Ê +sÔÕÕ%dSS“Ò«Û¶-€};}º»à+8x3$¾ iŽv••ïÄW¯^ÑD}}ý²ÞžÀåPå¨Öð` $X^ öèÑuÈ~\<¸¯D%hbò_+Ç}úô`«377+-ÁæÍm‡›êÔ1…ˆ”””èééÑ>zùò%71<<¼òB‚ò\­á H°bòôôä¦tèЦÄÄÄ@‚ˆ B‚b“`õjÕºÿ öîý$Ø» øìÝ»…R«V%øÇG|i +‹ +!AP.Hv´Ú·oÏF‹‹‹kÔ¨¡¢¢’•• "D$ Ê<þ` ¯W®\ ‚ò’‘‘AÊ#ñÑè;wh—ÙØØHô€‚ B‚UG‚))Wììím)ÑÀâÅs]\º³QJ£GswÇÍ@•÷Ã=¾ãfã~N©, âž ¨¤<ÚM·oߦáýû÷ÓðСC!AD‚ˆ!A> ~÷]Çzs©_?‰>*W^R"Î)¡¢~ÿþýÁƒëé鑆ìííCCC¥VÚsssUUUÕÕÕŸ={FÿÎÂÂBÒ$¨ˆDEEQFijj"+ AHP¢LOO·´´äFSSSMMM>|ÈM177§y”I‚?¦ÿ¸cÇŽ¬¬¬ìììóçÏ3FšžÄGÿ+..Ž>;wî H„ex9´mÛ¶Ož¶_{8 H„e(Á¥K—îÞ½›]©kÒ¤IAAÁ”)SتíÛ·“Ëh`Îœ9~~~999:­^½zÞ¼yܾ£>|øÀ¸Qœuÿþ}6\·nݘ˜Z,©vÕªUÂC<ÒªaÆgãF…lyœVD«Û²e‹ƒƒCéU˜™™½yóF†žÄGÛéëëKŸsçÎ…$X Ú)Ü1›’Ÿ#'é΄*"AŠÔÆŽKÁÁÁÌ&a_¡#F\ºt‰]ÁËÈÈ`óüø‘»‚*PRIIIäSn¢©©iPPýJÄëœäAáe{H‘jjj¥—¯®®Îl‘$>Ö‚è×–ú A V@‚Ê ÑÑ‘ÞÞ ä$?²ŠH°¸¸˜]ólÕªUjj* PdçììLM›6e¾ ›”””pó“GÊ’ÅzOŸ>åøÇ´iÓ†–`ooêÔ)?|ùòå´iÓMLL444¸oË’ èÛSúÿÒ*^¿~-ã˜õ®;räHî­yH@‚å•à]%—CeþŠUÈááá=zôà¦=:xð`6jnnÎ…r¤Hî™ÆÒÒ¡ÈqãÆ¥oÆeggStiddÄÍÉÛ¬­­­··wJJJzzzAA¯yg㦋¾=¥ÿì°aÃøž€•2  ëÕ«}Ò‚t$ˆ÷!AÜ”ÿ{‚ÇŽðòš*'é?Ž–K‚ÚÚÚ2ÙN{{ÛÊKpß¾}¤'Þ¦KÖ¯_off¶}ûv6:{öì5kÖäæææääð݃(É“'?~œ oÚ´éÙ³g………gÎœ©_¿>w£VÇ ÎÀÀ 66–¢Î´´´n9|³qÓË»=¼Ü¹s‡V”••E?§õ’¤YàI|´aÓçõë×¥#Á­—/ÿ!唃H„E?f>¼qÿ~¢œ$Ú˜òF‚2ÙÎaÃW^‚¤RyŠ›’ššJK{þü9ò4¦@éP4׳gÏÀÀ@?~¼±±±ººz«V­âãã¹cÜÊÊJUUÕÐÐZ[[«©©ÙØØøøøpËá›M”§CE¹ó˜˜˜øý÷ß×®]›¶ÊÞÞ^¼}Ú~mXãÆ¿ûGÒ‘``àéßãhÖ¬ $ B‚å=fåÿr¨]3¤z¦ÿ>ÒLîîãåªÅ +$>ÚSuêÔ¡OI<§*D‚***úRHìHiÚ´1$ B‚¢³GŽ„É䶅À$ðr¨®®nY h“ÝÝÇIùL»iÓF ÂAâ£=¥§§GŸÜ3®Ò‘ ––ÖŒîRH¬XB‚ $¨d‘à’%ó\]‡ûû¯¤´°@ ~÷]çE‹fK:?TPH|ÌGô)ö†Cåêr($ B‚å:f/\8µcG œ¤øøs¥%Èuª{÷î5®S]D‚ \äææ²~ÁèSo, +”`PPÀ¤InRNtÒ B‚ èÇlBBÌ‘#ar’ã„H†KKfÓ’.ŽŽö ÂñåËv{Ž>¹·%-ÁÐÐm$²† nݺ¾JL¼@£ô)– &))Wy››`‹…!AHP™.‡ +— ºR¢@ⓉIRK—ΧtèP(ûŠ +3nØà+–¢xìض|–×@‚ $X®cVþŒ‰?wüx8M Ù*P‚{ö±Ÿ§¤Ä³6pØ(oû3•¨dòn!‰T\ Jùr(ZŒ!AD‚•ù¦#¾*åc AH” ÞºuåÒ¥ßå$ݾÍ߀víÚµ--ÍyQN‚ªªª|ßJ'Õª¥ *ìÁ)¿" B‚ üKðôéÃ+W.‘“táÂ)> –“ löŠ„”_–wqéN>’~²µm B‚ ¢_½~ýÂÙ³ÇËJ7o^ò­tÒ!AE½,/åfÓd $ B‚ +-A…H ¢ÀšM“ZÚ›7¯#É6;v„!AHÿþ¯m©u¥$W „!Á²ŽÙÞ½{"U&A‚ŠëJIjêB‚ $¨bLjüÃ:Õõôô¤Ï€€IK02r©GBéÏ?c!AH¬$@|à‘H|tûúúÒçܹs%-A‰>³gOP¹$¸~ýjúU§NP AH€ª ‰á}ûöÑç¨Q£¤#A»ï¾ë$Ƥ§§[ NŸ>…~ellŒb B‚TMH|tÇÅÅÑgçÎ¥#ÁÒ/ËOœ8¶o_SxxßÏ;tp‚!AHP^H|t?{öŒ>-,,¤&Áää˼mÏè‹~ÙÓÅ¥;÷í[×C‚ $¨$>:„¿|ù¢¡¡¡¢¢"öæCEŒml¬hú´i“|| IÍi6ÿ•ˆ¥/A555oð™:u*+áûùíÛ·Qº!¹¹¹ªªªêêê4ܤÉMŠ‰ý¨,K‚wï^ ¢töì1N‚"B|øðûyttd%%€¬ÄKIÑ!åÑ‘Hú£áа؟é"ÁððJ±±ÿuìÕ¬Yc5‘ XMd?g…l)o hoo  sHyt$’þhxÁ‚4¼lÙ2™\­d*K‚[¶ø¯^íÍ—Xðˆ÷ =z4$€Ì!åÑ‘Hú£a:ixèСRàÀ?ˆ·×iKK ´¶n€´$);ïܹCÃ666Ê ZYÕ§éݺu0 7%æDH@‚‚”Ç= S\\\£F •¬¬,%“ ]Ó6m)™˜C‚üûµ;]R‰¯¨¨ˆMéС˜111J#AB‚ìè0lß¾=7eÆŒ4eåÊ•J#ÁÈÈ}ûöíàK/þ H€*ΪU«XÿÜ”ððpšÒ·o_¥‘ z‘ @ $;: I|Ü”W¯^Ñ}}ýââbHHe¥¤¤DOO×/_òNoÐà¿ç'“““%*Á!CÌšå!ÆT¯ž%$ A€ˆæè´²²â›>nÜ8š¾~ýz‰JPNú„$@Õ„õ¥ûóÏ?óM ¯ø$èëëíî>NBéܹ €ß„j~:Iy|Óÿùç--­üü|1J0>þœ&ÿU €¨jäååikk“ìÒÒÒJÛ²eK:<Ïœ9#F ._¾PÓèÑÃ!A PÕ ÁÑH²øí¢E‹èÛ3fˆQ‚ÜÈ3gŽ9VVJI‰ïS£¸ + AÓ§O§d'ðÛk׮ѷõë×—„…?sòäo €ÅÒò¿ +Hv¿-))155¥’’’$$Áºu-š6mÈ›444 A $ ©Ž>sss!oÄO:õk› %$ÁmÛü’’Îó&ÖÒuY<}úð˜1#¸täHß K—Îç¾:u"ß·/þÎûó°° €¨šÚèè#Í ™çÂ… 4OÆ åD‚»woá½jêï¿R`‹1 CC¾o;€´$ Hmtô‘æ„ÌóåË +i¶ëׯˑ­ªU³&Á¯¯}”)AãjÕZC‚  +CR£CÏÌ̬¤¤Døœ^^^byFTœT«VM]˜55…IPµZµê €¨ÂxzzÒ¡7sæÌoÎÉnQT(/ír¨±±.‡HÀGaa¡±±±è}ÚÛÛÓÌG»ùe\`à*Þdff"D‚÷îý™˜xKwï^ã›!9ù2÷íù¾½?‘÷çwî$@‚ ªqìØ1:îìììDœŸµ/ZÉîñž òë@Ô&âüïÞ½ÓÔÔTUU}ýúµ¸$8uêDgç.e¥ØØ“ €bçÅ‹jjj$µ¬¬,Ñ5jÔ(!mËT@‚r• A PE`-‚’ÔÊõ«+W®Ð¯LLL*üx $$€lÉÏÏg-¡]¾|¹¼¿uppøÚ_íHHEdïÞ½BºNhh(ýÖÖÖ¶’¼|ùÝ»·ÈOºwïOH@‚Téˆ#U,Š433£ŸŸ;w®2LHˆùí·PùI÷ï_‡AyK²<ƒ’ €@H^t€˜ššTl «W¯¦%ôìÙ³2ÄåP B‚HŸ^½zÑB"«ð222ttth!)))–`TÔ!Éò“RR®B‚§s(7¬±PRXNNNe–3þ|Z΀PuH%E´EGÇ‚ *¹œ´´4mmmZTrrrŪŽ‡oÖ 333Å»ä 6Ð’›4iR\\\ª—C$  Q¾|ùbggW®^“D'??¿N:´ð   rUxO@‚ R€ôDG„M…›ˆÎáÇiùÆÆÆ?~D$ AHù!33S__ŸŽR•äÖÒ­[7ZÅôéÓE¯:RRâ¯\9#? ÷$€òAb¢Ã¡C‡]ËíÛ·UTTÔÕÕoݺ%bÕqöì1ŸEò“nßÆÓ¡@©¸s玪ª*¹‰$%éuyyyÑqתU«’’Ñ«\ $€$(..¦ŽOOO)¬.++‹]wݾ}»(UGttäܹžò“RRâQuH°Â¹¡Ð»åY)!ÑÎ577'=Ig‘‘‘´F==½7oÞ|³ê¸?‘¼#?éáà ¨¤GúiÑ¢9ÒONN­+#Aö_TUUëÕ«wüøqyðÛ¤êÕ«[XXŒ;öÅ‹(r \¼}û¶V­ZTŠHLÒ\o¿~ýh¥}úô^¶]]‡Éarvî ‚ÊHpëÖõ‰‰qÒO#GþXI þûõ]ª“'O’täD‚ôYTTôäÉ“€€€ üý÷ß(u@tL¥¨W¯^R^ïû÷ïYWƒ‡Ru +R ”TÐË¡œÂ + µ´´x¿²²²¢)‘µhÑ"..ŽM,((˜6mšžž^ýúõÙÛǼ\¸pahhhi3r£4°qãFZ²¦¦fß¾}¾ZÅ÷Û+VLž<™ çååMš4Iç+îîîùùùÜOæÍ›g```hhäå奯¯OÃGþwx7lß¾}Í›7§ìììþüóO”s…D{SWW÷Õ«WÒ_ûÎ;Yë4>|(ýíf¹‡N†Q„@” E‚$¯Q£F•žDãïïß°aC6º`Á‚3fddd¼xñ‚ÍÏydÇŽ÷ïß(2^׬\¹’"»œœœùóçO˜0á›|þü9¢Î™3ÇÏÏ~›½zõj÷“U«V}úôéĉ***l˜gn³Ëú;¼6kÖ,Š=Éò[¶lqpp@9WÐ ¡FFF´7IF²Ú†=zT¬Ë] A™HcâĉÛØ'qYØ°¥¥%ß<Ì#III¹¹¹e‰Œ×5ÜÄwïÞ™˜˜|S‚d%uuu6L6$ÿ²aŠ"icø~»©4¬ªª*üïÜ0’¬ššʹ"Ò·o_Ú•...Â_U(êééÑfìÚµ {@‚Šr9”j~Š€:vìÈF_¾|9mÚ4GGGò”††7Ù¯­`…=}úTˆÈº†ÂOÎnB~K!' ÒÚ¹Ê6ƒû9ïO—õwnØ¿xjT1Ù½{7í8!ÏgJ‡ЖPIKMMÅ~ BHÅ\tزa[[[ooï””Šûh:7[:u(‚ã[Â¥K—6nÜÈ{B0Þ¦ºæÇæææß”à²eËÈ_l˜æçn#ÒÏ99~S‚eýHPixòä {"”$ÛÞmÛ¶maa!ö€å\‚^‘SH\¡±±±EEEiii!!!œf̘1sæÌŒŒ :ÙvssãõÅäÉ“¹—,ìíí·mÛF‡? Ï™3‡×57nÜ Åfffúúú<¸¬M¢yþú믥K—ZYY½ÿž}5{öì5kÖäææRÜÊwOP¸Ëú; r@{–Â|Úk#GŽ”“M¢Þ A1öe$(Ñ{‚ÚÚÚtîúòåK6=**ÊÚÚZMMÍÆÆÆÇLJ÷ªéøñãuttêÕ«G>âõEX={ö ¤aŠ +›7o®®®Þ¬Y³½{÷òºÆÙÙYSSÓØؘ—]Ö&Ño)î7nÜëׯ¹¯„<*\‚eýHP9`'Z$®HÈIIITäTTTè û@‚h6 r’àÔ©S$šêÕ«'$$ÈÛ¶­]»–½16$ B‚@ì\jÖ¬IåŠt#‡›WRRÂn¶lÙ7rKpàÀdÒ%t‹öh@TMòó󜜨ÀwïÞ]†ïD'''‡ÝtwwÇ.ˆÑ‹â‚´B¥ÝÊÊJ`ó,òCRRR5hSƒƒƒ±×$ Py"""Ø»x)))ò¿µ¬ 555´È AH€JrõêUMMM*ê{öìQ”möôô¤ 633ãžÁV”êN¡ëj, "–X] „ôôtSSS©u˜+.ŠŠŠzõêE›moo/ðå ÉUVè+ @‚"rÿþýÁƒëééihhСʺ„Ú# îß¿¿S§NZZZô/† ¢XgÝà›>lmm©„tíÚ•¯?ùçãÇ ÒÆ÷íÛW:Oò ¯4 ŠÎãÇé{ÇŽYYYTÕœ?~̘1 +'Aúí’%K(X  +géÒ¥íÛ·G‰U¨20`íâ&Mšì‡KþIMM500 ¿0cÆ i^]A_iè+ ü&£Gö÷÷ø•ÂYºhñuÓɦ„‡‡[[[ÓlÿŠÐð 7@§ú‹/&5Sñ¦Ú{o¼ðÖ-¹¹¹¥gŠ‹››ízª¢ÿúë/Åý—.]b74™e¤ ¢¯4ô•&i *Á{‚fffe5¿/¤p +,Z¥:‡ä&di|TÚ}||è¤9éØd­•–^ /ttpçNjÓ¦ J¬r@Ê ýNúPˆÇA…C!ŒÊW$݉-úJ+½Rô•&! †„l½|ù)§„„1F‚T‹ŠŠ~õÍÂÉW´„7ÅùÍ¥q 4ÈÌÌdäDAU®_¿Nš =>eÊ%ûkt*8hÐ úkúúú*±è+ ”²µ´´fÌp—B>|ˆØ%xçÎ*KAAAYYYT©PõêÕKôÂÉ;Z·n݈ˆ΃|³}siÜ#t +JÇ/ntp 8ð›e˜U:xoݺõôéS:§å=_ +Ç£G iw3Fá^ˆ*Øýû÷§?Hg†’ˆÑW$¨Ü—CÅ+A"11ñû￧o*¢t²·råJÑ '_™¤Kl± P>Þ¾}˺êСÃçÏŸ«Â_ÎÌÌdÝB5jÔèÕ«W(@%H’Zºt>¥C‡BÙW¾4ºaƒ¯X$xìض|–×@‚@ù P¨N:TŒ[·n­ô1 /?~´¶¶¦?Þ°aCî"H‚h@€JòòåKR•á6mÚTAP<èèèHŸáçÏŸ£<HU‡¿ÿþ›]mÑ¢E• …è·k÷_•R¯^½Ç£THUÔÔTcccv4''§*gEAAAçÎÙ{ ·oßV¦š“o(“]\º“¤Ÿlm›@‚@Ñ¡ªžõ1Ô¥K—¬¬,d8;;³÷èÅØåô•ÆNâããuuuQNäJ‚² +m@ö>`§Nªx ÈK~~> ‹Åƒ¿ÿþ{å¨}¥ýËó.0 +‰œHpóæuä Ù¦cÇB‚@¹pá‚––{#¾°°ÂKII‰««+ëþСC•\šrô•VIIHP®$ˆ°°0ªå¨ÄŽ?¾¬LàAOOOÖ.ñ¦M›*³(åè+ „!A P-Ç%ª ‘ ¤`òjÚ´i_¾|©ØB”¬¯4HP~$¹Ô#¡ô矱 P¾èfòäÉ,ºÙºu+2D¢¢¢XÔìââÂ]`,ÊÔW$(W”èƒ1{öA‚@™ÈÎÎfý&hiiEDD CD'11ÑÀÀàkËùMÿþûïòþ\iúJƒåS‚vß}×IŒIOOJUÝ-Z´`Oþ_»v R^?~ܸqcÊ@2 9±\¿UŽ¾Ò A¹•`é—å'NÛ·¯‹ˆ)<<„ïç:8A‚@™ ZŽuݨQ£´´4dHÅxÿþ½ecÍš5ÏŸ?_ÞXRÑûJûWÐã©@N$˜œ|ÙÃc2— ôE¿ìéâÒûáÖ­ë!A d>|¸F¬ÓUEï5Oæ9’ÝD£˜‹»€\E‚66V_Ÿæšäã³HHrphN³ùû¯D$”’âââ… RuM%ÓÍÍ /Š‹M›6±KúöíË=c € %x÷îµÐÐ JgÏã$("$Á‡o°ŸGGGB‚@9ÈÉÉqqqa¯{SÌ‚ /—/_ÖÕýïá› C€Ì%B)6ö$MoÖ¬±šÈ¬& ²Ÿ3‡B‚@Ñ¡j¹^½zT ãââ!’ ==ÝÁÁ2YCCƒ»§€L$(Þ×ÞË’à–-þ«W{ó%{ö "9rssÇŽËê%‚‚ä ¾ü÷©˜Ê'KK ´¶n€´þœ&ÿU ?~tssc…¿}ûö©©©ÈE¤¸¸8 €uk¥¯¯Ž<“àòå å0=bçðáÃfff¬•æÀÀ@€ŠÎ“'O:uêĪ²AƒQ„ˆ<å• wòÌ™cGŽ„••RRâÅûÔ(.‡)€ýúõce¾C‡¨-•:“Ù¶m uuu·nÝJA"²T@‚ÂŒ9yò7H(z%©££Cè$•÷ïßsͬµmÛW¹A…%X·®EÓ¦ ykÑŠÈ;wZ·nÍŠzÿþý_¿~^¼x1:cà¶m~IIçykéº, ž>}x̘\:r$Œo†¥KçsßN:‘ïÛ‹çýyXØNHˆ…¬¬,///uuuÖî'UOŸ>qûÝØØýóIKp÷î-¼WMýýW +l1†ahhÀ÷í±cЀ6/%%%¤¼:uê°Ž¦OŸž——‡l©R¤¤¤ØÙÙ±Z¥k×®4Š<’• Uµj¶Â$øÃÂ$h\­ZkHˆƒ7oÞP¥Çݺ{÷.ò¤Êž ­_¿^[[›µˆ>uêÔ> [€¤$¨V­šº0 ~mà¡L ªV«V•£  ÀÛÛ[U•JS5“¼>þ=-- Ù ÊU‚@²³³,X ¦¦FÅCKKkÞ¼y¸ý*Æ»wïÜÜÜØ33µjÕ"-fee![ AHÈ'………þþþ$>ÖÈÏ?ÿüêÕ+d ¨$=âÚ[«^½úܹsñV)$ y‹þ|}}Ù}bÀ€xûˆ—øøønݺ±V³fÍeË–¡Éµ*%ÁË—ÿؽ{‹ü¤{÷þ„Á¿_;§èÏÄÄ„•Uª¬-@BÄÆÆ:9ý¿Wºtttp¯¹ŠH0!!æ·ßBå'Ý¿„þÖ¯_Ïúþc½ßÆÄÄ [€ˆŽŽ¶µµeOOOoÛ¶mP¡ÒK—Cü½víZ.úkÕªÕéÓ§‘-@Êsæ ²È qqqÆ c…SSSsâĉ>D¶(“>¼ñàA¢ü$H°êðîÝ;///öÞáââréÒ%d C=z4tèPö^¡ªªê Aƒ._¾ŒlQ FEš1cŠü$\­ +}ú´eË®£g:÷4hPtttqq12‘ "A¥ýè`8p ÷ʃ¾¾þòåËÑ,?¨‚\ºtiøðáÜÛ¯õêÕ£c§‚ò)Á””ø+WÎÈOÂ=A…ãåË—t€›ššrO¸¹¹]¸p9ª8d½5kÖÔ¯_Ÿ ûôéQXXˆÌ‘ ž={ÌÇg‘ü¤Û·ñt¨bP\\üÿµwî±TÿOŽN.“RKÖV´Ýä–1'Ó ÉYD”$Š¹•[S1t˜Û䥆Q“º¨„a-Ò²‰2T$«Ð\Ê%¿ýžÛYŸÙéòë××·Nz=vþàøŸóy½_¯÷óóü|>ï÷ålnnÕcæÞ?zô(-NJb”——;88°ÙlQ¥(++{yyÕÖÖRd$Aér(ñÿRRR‚VPPe‘´´´‹‹ËÝ»wé¡‚ø===IIIk×®öMMM>ŸOS’þ^,)úJÎëñãAÉdpp0>>^UU•)a”sXXØÐЇ ~œ††??¿yóæ1w6lØ™™IWQ~‹>yR Ý‘œWss‰ D1<<œ˜˜ˆ"eFBÉÉÉtuuQpâ§-**²µµeFѲÙl' +éq²_&‚NNvø255!”„ +E1ººº²X,Q¶àlzz:=ïM“Hÿùóç9sç™NNN%%%t‹áßAI†Dð·066†³S £}0€fff©©©###‚ø÷xûöm\\œ˜:;;çååÑ4“N’ă®˜šé—CÀQnJJJL@ûh†O‚øÅtwwGFFZXX0ÅÈf³½¼¼„B!‹Ä$244„²Úµk—¢¢"SnÚÚÚ(ÀÖÖVŠAüvoª££Ã”§´´´­­-=ECÿ„ÑÑÑÜÜ\.—Ë \+W®Œˆˆ ið BéïïOHH022bžOø5::šÎW âijjŠ‰‰111a†·ccc¼ÙÑÑAñ!ɧ««+--Í‚™“M4_·ŸŸßÍ›7é¡5‚cll¬´´ÔÃÙß^4.ÉÆÆ¥Ô××G!"ˆ?‘@°gÏfy_Ñ|õ\.7..Žù%þràì q(f^ //’Áûto ¦ pÕÕÕÞÞÞkÖ¬™ø€½©©©¯¯oqq1:$þÓ‡3Cfµk(cÇŽÁÒ˜#‚˜òö0))‰ÇãÉÊÊ2=€ŒŒÌúõëÃÃÃËËË© ¦ÞI`MMMpp0’|â>%%%¹sçhZB‚ø ØUTT„††2«›‰†ZXYYAëëëI‰?—ÚÚÚØØX$óÄ¡ RRRHøÀÀÀªª*º?N„ˆÁÁÁüüü}ûö1«ý2+~Z[[£'yøð! "!ùŽÂ…¤x¡ ±===i‘2‚ ~D322 ˆjjj»8ÄÍ›7Ÿ:uª¬¬ŒzBr„¯ºº:,,LlPX·n‹‹Kvv6­UMÄÏÑÙÙ™••åêꪧ§7±{‘’’ÒÖÖöññÉËË«««£@¿’ööv$ž¿¿?ÒRLø–.]ŠtMII¡™"‚˜t‡(BBB¾ìydeeœœ"##ïܹC릓Žh9$—ËeÖcÎÇŒŒŒ|}}‘œÝÝÝ+‚ ~ –••EDDXZZN’/ê”444ããã+++i°ñŒ×ÕÕ!…x<žØ}j   `eeCWæ ‚ZZZrrr||| 'N´(bÙ²eööö|>¿  `xx˜ÂE|IOOÏ­[·$...P½‰Sÿ‰¦ÃEj¹»»#Í^½zEá"BbùôéS}}ýÙ³gýüütuu'¾¡¢¢Âáp„B!¶¤ÇÔÿBFFFÐôYYY[¶lAJˆ% DPOOª‡Dªªª¢'“ ‚ø£»»ÌÌL777±k§¢îZ¹cÇŽ@ðèÑ#ZqŠñáÃ4knnnpp0FOìž2PTTDzx{{#U°11Uill,((·±±ÑÔÔ»ðÅ\A577÷õõMII¹}ûö‹/È ü) ±jjj’““áãЈjjj_61‹ÅBÓÛÙÙEGG#ÚÚÚ(nAü@ÝD6NÐÖÖVKKëK› šØmÅŠÖÖÖPÆ3gÎ\¿~½¡¡”ñ7ÃÞÜÜŒ†ÈÈÈ8tè—Ë500øjÛAÕÕÕy<š?~ü˜Ì>AÄwd±¥¥¥°°6ÁÃÃÃá,X°`Ú7PUUÕÓÓspp8räHBBBqq1úØÎÎN +ãdÑÛÛ‹Þ¸q®AÞ½{·‘‘ÂþU ÐXØ`ÿþýh¾+W®@(éÚ&AÄ?dtt†Q(&&&º»»oܸQ[[û[ý°h18 ôÆNNN'Ož„>^¾|ùÁƒÏž=£aÔbôõõ=}ú´¢¢!B ‚‚‚ tfff œœÜ·",--½dÉ4„››ŸÏGÓÔÖÖ’Å#‚ø•ž±±±½wVVÖñãÇÑ›››£gþêE9±Ñý‹-Ò××ß¾}»³³³¿¿lllFFÆÕ«W«««a|^¾|9Fs <þ‡sïÞ=@žžuøða²¥¥%4‚ð?cÅb±´´´°=ž€Ó]Z‚ Iv¯¾¾¾´´ôâÅ‹p‚^^^666ȉ+¨~8͹sçÂéè蘚šB18|âĉèèè´´´ .\ºt©¸¸ûª¬¬¬««ƒè455µ··wtttww÷öö¾ÿ~ppª:22266öŸÏˆt|||oâO?~ÄfØøÝ»w¯_¿ÆÇ[[[Ÿ|Ö¬Y³ Gl6{ÆŒ,Kê3"³9}út¼)##ÙÅfØXYYYEEWWW×ÔÔÄ?Ô×ׇa°{öööØ©§§§ÈÆÄĤ§§ã‹Á$Š¬hKK ì'5A|Ÿÿ®*üendstream +endobj +4283 0 obj << +/D [4281 0 R /XYZ 85.039 786.531 null] >> endobj -4181 0 obj << -/D [4177 0 R /XYZ 85.039 530.598 null] +4284 0 obj << +/D [4281 0 R /XYZ 85.039 723.602 null] >> endobj -4182 0 obj << -/D [4177 0 R /XYZ 85.039 516.864 null] +4285 0 obj << +/D [4281 0 R /XYZ 85.039 723.602 null] >> endobj -4183 0 obj << -/D [4177 0 R /XYZ 309.697 522.837 null] +4286 0 obj << +/D [4281 0 R /XYZ 292.716 125.59 null] >> endobj -4176 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F56 2890 0 R /F35 2880 0 R >> -/ProcSet [ /PDF /Text ] +4280 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R >> +/XObject << /Im2 4154 0 R >> +/ProcSet [ /PDF /Text /ImageC ] >> endobj -4190 0 obj << -/Length 3631 -/Filter /FlateDecode ->> -stream -xÚ¥ZëÛÆÿ~…Š¢°œx|? -ÅÅv’3zŽë»Ô-’|Ø#)‰)E^HÊgý÷×.—å(ôAËÝáîìì<~3KoáÂÏ[¤‘ãÙ"Ic' -¼E¾¿r[ùþÊŠµ¬-šo¯n¾‹Ã…ç:™›-7fžÌu¢,^<?/_ÿpûáñíÇÕ:‚eâ¬ÖI’.ßü¸ò–÷·wï¹ûþí=<»Z{Ë·ÐøøðÃ݇կï®Þ>,½ Àå¿úùWwQ«ï®\'ÈÒÅ ´]Ç˲Åþ*Œ' -y®¯®þaæâ±pÁoÍí6 -R'Jƒóíz‘µ]Ïß÷I9q˜Ð~wU¿Z‡Q²Üã~Êa;jWk?]ܯêº]Áã Ñ¥Ë Pû•Ÿ,Ÿ°ÅDC˃èêi"î/±ýérl õûãå°+ù…^í¥µ'Ú—Ú©¦Òíe¸õþ‘ÿ äRVè”ÿb-{]{(°ÌÞ`àÂÃnÜ™Ÿ-ËŠvK3tÜ…[êZU䊘 |»íøÜ¡ (~óÓÝûnjP$# Âý4<ÞvE)Ë‘Ø`ô× ‘@+ð èÚý^5ÈÖ_‘û›ï[×*®ã¦)m¦kÛáÏ«uäG˦¸ñ±Š­õÿ¿ùñþÛ×Ò÷Óm±¯šª:5´Ý_žUß¿ ,hÁ©qÙë±mÝm€Û4ÒB8ghÁh]">Yþ|0ÚŒ–©U·EÙ°ÍòùòZ¨ìøß´Ò±­>ãpÙh^Æ–Më£á7ɾeू£¥î'mmØÝ>¡eÀ+eÁ†—%N˜ÆÕÙt¬ÅçÛöa'p$¼“~ÿä€>ofvFNêi:±ðØuâ,™,t‹†˜¹Ë—3ˆmÕñæÂÌ3 -é-«fËÃÈýNHõÞÃ4CásC!y!Ä;=—»$ÍÀÆ'í˜X|ÎE[6ÓýâFî ×i6’KŽj.6@jÞ œY'LJøl¿tYqœ‰gÍÙÊ0gœ±›ÅŽ©G1ðã·÷Lt⯀i*™ ¥âáÖ¯¹_ Ç,‡î§*ä<ò–”6Ÿs}c'˼ÑfŒ+rüLÚg<½ªm”k^ô8 -–·¸Oc°tDd³Èà ¹°]â„öù£@»n·$nØ ] u=õ$€¶#a­ô?õxïk?m9 Mâÿœ»41ØN¨øè™rG‡ŽŠ‡í¦Ì9èª;2-2ÕUŸQgjÒ€­Ð³{†e‹‚Z½È ÊÞ¢:Yɸi”o,ïpÚÍÌéÒK•xdýßòQ=2“C=ãïű@«/%LRèÃÄö^æQ[jÌyù3z×’W"_ªM[üª3ë¶c'ñc­[ÝÜ"ltϦõðöã?½Wü€¢Äÿ®Tõ^Æïÿýñííßï_ͬ»ö|SÖuÐÔ‚c­‰ðdÂä!T­I1!Žâ±…!Á´‰dM²aªx1Æ"°Á0ð\â@·ŠÌÔÔk‹üfžÎ‰[ƒx‹Î0%çrÂCÖ¸ñ”‡€«i¾¾ràeN Ú^y¯DªÏ¤G( -í» w´†'Z`ƒªjíÕ4®ÌÆûþ ° àœŸ;†¢¹†…ŒSüX‡¡co ݽ9OŽÍV‰Y´£cû+éÅÀÏ;…¯&kÝòÔúý\¯PŽÏfaê΃{±¡;…d³n ¢i%7(Rb㉠w¹i 7Èšâ"èdÉúY:ÁyÔ±µA?w »Ž¸Ùîô3¯ãgÙYLÅq‰—íA³œ»0!‚RÍVæ%·ÛÖ±·5Gw„U(žK¡ž¢7*…çÏC'ÿÂh+KÉn‰Ë@vrvÔgÎv•Ñ¡@çLès3 Mžk9pxxÀœ.]>)~ä˜Þ±~ -}Ås·²"ÿaêRÏÿ™²=Ë%áÞª®ÌY™V¿ó²ãlEÅ`©­¸7™§Ù\Á#Äȸ#*F]ŒŠ˜N`ÑRÖÜÕ[`„ÕÇÿ1äÜúî¦nsUßÀŸÔÍ3„d0¹›¾Ì»rè¡xš ®miâM’p²D}žtÁý©b›ƒ@£‡žðñÈíΤõ”ЋDÈ - üõ D±‚@a-l<áÑÍ’ãÄí$‡Æžv‹¢8^Þ M’s혰ñã2Òj -áསpÖ[®ü°¶ÖLÏN6?t9LæHÿ±1‰³ô -/«=^I+\c¼"ýšÊ”^«dÎEÃIÚ†œ )}<СdN½…„iQe¼e‘¾áÿO„A -û%êÏRq²~ÌwØ!¼œ0w=ª§,Þ’áƶß“2€¯ ®k€)cÀ+~ä; DxP!kàÆÄ„zm‘ÏXÃÉœÈî'NŸX*g\D!ØOlsq¦íšæÖŽR'ð³ÉÚcÊþÌ€ Daª>Ð&ž Øk}ô=®`À˜â¿þØsÙm/’‰²bK´±»¶«ûaì¸Þô–B²Õj+(ô§÷wÿâÖ')4àoF¿­ŠÞ¾l»¤šDB$o,¤+ˆäl^°ãçi…ë¼ôóÈE‰ˆQûçUKÞ7pÍ“Z•§/ö õºæ‘Y€‡\uˆäê{ŒóÀ%v!d•ò¦ƒò$ŽËcÈ+Ë‹:¼”Ìzk?ኈŸó#ùb:ÏbÙ Séº ¶_zg—«AÇk|ïã|Í”V-©ÑŒÖLF þË/ú®œ³%ZL×´ =:3|š83Cª†…ù‚y¤)`,g%ìÓŽ¨`R‚ÚÐM"ˆï´Ô%<’ Ú­M«è¬Kj? -¸Ú JŒtÏukª(»%ù,™È‚©ˆÌpªC?·Ï®¬Ù¬EÉ×g:ÔD£?‰åÛ•ÓG ØÁ°ˆø£lQHųðd"<™¼" 4±‚W9úˆL~ÒÄJH`*Via†îi°qžòàj“(×ÏWÛø1AJovZß’æZw€ÄÈ3òvJf”š …³ýÃ¥idÏÅ…â$º$WÊ\ÜŸ2„¥ÔK3–jÀÊ™L.s_üð}Ò‡7lIãGcaÐ.ërT*Œ'‰—¦±˜úõÜ=_Aº[¼æê)ÖàyX×è -Î87@¸çç%T*§¶ /Ø(×e®Çòu®”×]†(îe(”|{èŠ€àŸ j’(‰ºèó¶iÊ\b"B›gNµ›i1{4§ú:âó$,˜h£1“®sÕm³µ{"ö¯Ê:G["@W«~èÍ}—$"s6¬=NÑñÍ|0&v8’›–\²Êý2SNõtüð‡Ï)?Þó=®l·å·6|YJ€FòSµY‰¹Pãì&Rae|œˆ?ÎsßµºÒˆqmú—2Æoº×RO5Ýb$tÚÚ=С÷Ïü‰t_ž¯ÐdT_ÂñÉ7= l;qéZ)­tÚ ­«™d&²dzÂý¹é‹fbZ®¯­õç ‘kƒ·¼ù–î"—O”ê©¡¾óÀ¬¼çQQ8«§’ÿ¹›v“ãg§ØäüêȺN‡öa4ëÙ \èK[YÑ¡ÙIŸ|ïtzRãWT°0q˜ÛåXR3Ûˆ¼y}iJþäj6^ŒHq®Š9a0[Dt²ÓÿëóGSŠ S'K/\ýF~âÄ -3(Ú8> +stream +xÚ…YKsä¸ ¾Ï¯ð-êªiÞRïÍžÉ$³•T¦2®ÚÃ&Z’Ý*«¥^=Æë|H©vª"AAàÈoú…7Eêñî&/2?Ûòð!¸y¢‘¿}•#Ic?Mj_ÜÚÑmùA’_åÑ5¶y”øI‘€çîþç¯Qp~–Å7÷V‘Œ ¢âæ¾úÝËüÍ6MïΔϛЛ›mœåÞ—Í6ôúQLÓ é3uúnÂÀз›ÿÞÿúá¯÷N'šT ÃwU\ñ°Šazþ.Ø­UŒS?MsVñ®ÆšX~ f§Þë&*¼~F'ñÊãÝ&Úy)K#3ñ*çP›Šˆ¡÷$}ì“&"í›Qˆ#¯PNMÎDÌïHÍ–̨Âæâµ7b KY­¦=ì5]QÑ é*v}ì(`ZúÒÐd2)Yjâ´w¼õ²ïþ„ɯⶱ+<#ŸrØD¹÷€–¿Ð¹Aëf«0ésÏv™±mëA¥Œò­ê‘0åa³Å+!g‡Mî@.•ÝddPà$ehxº‘Æ¿Wçn¹·+ö˃?—ÉÛÇÎبÇÉêÜó–r=³ibÕ*0ÓñËØý65m3ò³(?±ø÷/Äþù|ÃaPøYNÊÑ7IwWÝÛòlWL—Û<—„5ý7‚)Ý‘)¢wcia±Ñ&~œd«PJ³€`ÇF{ˆxOvÞ×Mxµ™æí8"Æ3ﶫ$Ø%æºÞ7o駒ßUpáy3ØS:ò,ÎXÃ{Ê8ˆ<ùÆÇd­íGãHSÚ¡ç@œd¤¢†´Î8¢çvãFÄ™ ÂzâÝ!t©žq>Hì`¬a¹µ/‘ûÍ.ÐK|èL(×ëL&Ñ 0ùeo”áEÑG}^e`¿LqûÀ» +£ÄwÝwàLB¶E+ðÆÉ5«Á`µa! )ÛY6L;c›Ž2døÌiÆ'ùôƒÒa©ãЛrö28íuÍU|™íý¦ˆÉ™VI¹yKJPbç 2“H]ߢæåF5ã¸9Í´_–ÈÎöÔ~UÓÊq¡4Gó Ç;q¢Þr•¨ÐrU·ÍO–1ÔÕG¢ëLr€,´;“>ãpªa¹"§N£QA|n½=cšÉìä­±šFUh_…90þ+&cNþ;™Vfå.âµGq‚,Ä8¹=[ØO•‡—§©÷M8‰)Ó³ŽÕX¢ÙZˆ5K¾ä:Lc…aŒ~n+çÏOqaU?.ç1ŒÍ8ÕK2I™0·ê¡³Ëk¶E‡Ábq‰+†ª*ÎÔ¬ä(æ\àËòXNhÏWB½Úâ:ã¬B÷¦¹¨¢"ðó‚*½Œp?È}xR†uÆ´ÌÛ…û<Ï$b“¿öûjWx%%6­'Çi0é<ÝùÉnw¢Ûœ[–w5Š©>ÝeÉZ£R탵Ù?I±±¦¬ÍqGêõó$ õ¡AzCýÇÜhiEU¿5o繿‹R9ßTŽ—A,ŽÄ­%tcïÙžÙÈÕ ¼¤’öËÆÆ1Ú + +Œ¡DÖã+jQcã$¤Iy)ÙÃ1¿ªE #Cìs=RѬ%¦o=4Êý`'¹ùജƴ +%ãF¢Mö|Z)£,e@Ã×híªÕ!ØN3Âq'1þ¬åHg5"HŸ5Îyƒ‰ cƒ,LbkoéN_é~çâqÉž¯2 å”]«»—®2eû´ÎQ}©‹o%žd›Xhß¿|–†§“LÚkªÌÄy4±éˆÆ„'öþñKÞ~—Þ-Ï/ûÙa[KÑ(VÜ«´ ¸ß×ׄ<œ2_+åíêZ_KÇå!±+Hfµ«þpèušØpœ,Ûéú‚hƒf0ä¯@ó×"qlO1˜l3:{ÿtùseý{Wf%Þ3fæW —.tИs¡:Òm)ø;oNp!¹rTo¤sNI” +pÂQSI”ˆÃ¤^Ç•Àˬ½!¹È%LüqûOiTfâ`4£†+d‰Û¦ÞÑ ìó¥}š¢ðÀb"(âLJ%6JÑlun¥qúþ¿Ô}ÚŒAF“.?=C|¾(gKÑE +|DxÖ»;+$WB·9¼éY±Š¼Cn74¶¼ uõ$šßò´}X]ƺÕø0³G’s™ïSvB±è¸(W¹4X_ ,\­S +3.× ‰©Bb~viHÕ8“}Ì“¹ïxƒÔjåÖ![.äâ4Œ%[©‡Ú°­ÒÌfEj5º‚ÜÛˆ`ƺ+k™"ˆž FSE©%õ@ËØ4’]QîÊMêzh¤—ž ¢Â¼{+ÕÓ‘òX'ÚÄžè•TêèJnЮ€Ã„N¾«!i–ûuǾøˆØ<Ê÷¤ÈÆÚÉðT ¤Ü=r°p˜„½µóò ÄKÕ¦ît½ò:صqr¹ÏB#-²sI×9Y*A-ÞB•©µlÈÃ@.®(1ðÍ1ÔÒp 0À¡ár žùêNˆC}Än©õÝ [¥Òzù’ñÝL-Ô¡[ÿÜêåñt«|„=l¡xõ¹¡&xäèˆ PØЩÔZÏ4ú°–KAŠöìÁ*Æ:«=ÄpÂ[£Z%æ…àÕéSïº@<….ëA~ñŸ‚à–>prp—F›Ù†ÚY;u7!F•âdöÖŸž_óux0®b,ÉøÔÝrºµVûÞ>—ÆZ¤;Ê%pÍⵑQÄú•Š´†zQ±~¹’2²Z½_FE¶Ä!?¯b†-;y'®ìÄH”bóxÛh´ËÓ'ᵎŠ‚½cèÿ¢¹™´1K{ìßTG«æ‚i‰¿V&h¥Îe˜¼kü{|úš%«W¡S‡¸£Z0òÊgþ£1ÇŸU~0ã8ßywòRHNŽ[W? ßâߊ’_o˜ŠUàV×gê¿Žâ×ÿ²(v~½ÿ—ÊÂÂ/\IxòïMè'AlÅ`CäùåßE™_¤Å{«Y–óåNÿ, +#?£õr?NÞ‘~PÿŽ3³ [wËi>»ãêá«/s©¾{hÄ|TAª±}8{×jåÄòÕÛ®> endobj -4192 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [285.619 542.708 316.703 555.61] -/Subtype/Link/A<> ->> endobj -4194 0 obj << +4292 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [262.823 290.269 345.582 301.958] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [366.67 618.891 539.579 630.58] +/Subtype /Link +/A << /S /GoTo /D (samba-pdc) >> >> endobj -4195 0 obj << +4293 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [212.608 249.621 255.813 261.311] +/Rect [84.043 607.463 109.672 616.91] /Subtype /Link -/A << /S /GoTo /D (winbind) >> +/A << /S /GoTo /D (samba-pdc) >> >> endobj -4191 0 obj << -/D [4189 0 R /XYZ 85.039 786.531 null] +4295 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [279.784 465.322 360.495 477.012] +/Subtype/Link/A<> >> endobj -370 0 obj << -/D [4189 0 R /XYZ 85.039 380.004 null] +4291 0 obj << +/D [4289 0 R /XYZ 85.039 786.531 null] >> endobj -4193 0 obj << -/D [4189 0 R /XYZ 85.039 358.808 null] +270 0 obj << +/D [4289 0 R /XYZ 85.039 766.606 null] >> endobj -4188 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R >> +3022 0 obj << +/D [4289 0 R /XYZ 85.039 658.638 null] +>> endobj +274 0 obj << +/D [4289 0 R /XYZ 85.039 592.02 null] +>> endobj +4294 0 obj << +/D [4289 0 R /XYZ 85.039 549.735 null] +>> endobj +4288 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4198 0 obj << -/Length 2129 +4298 0 obj << +/Length 2731 /Filter /FlateDecode >> stream -xÚ­XYoÛH~÷¯àÛR@Ôî‹×óàÄžOÆIÖò"dó@K´L„"’Š£]ÌŸ:šuÚ˜ C}TWWUW}UEåIøS^i/ŠCåMgÒ›ÃοΔ£;’ñ€æõÝÙùÏ¡õ”‰L¼»‡žO"E„ÞÝì“ÿæ—‹wW·£±1ÆÄhE±ù~¤ü›‹ëw¼|suó×£±ò¯`p;ùåúÃèóݯgWw½•1xý׳OŸ¥7Q=“Â$±÷c)T’x‹3XãæÅÙäìß=/Þ³Ÿ:¤m`bÄf_] ÔUÚ­•mDú^”3TJúÿ•Ê– MZëQlýW¸ Ó)ªÙæ°SÎy)/ùDû˜ñB“.ÈÍiYfµ;ݸ_wäÝþj¿Éêo#ãå×¼—®ÚÇ‘â¥r¤¸”îNÛÞé.o+GÍÓ—oÐòÞØi9Vhª„T[«•B1T 3E,¬,ÓÚ­TüËZÁVº‚ƒ0+QP%móªdš:[nŒ¤ -(»c0¸O™´!Ë8mk&™gm/;µb!•£‰ü|–•cRMn)ÕæøP@ílƒCbÅÒ§Gz¨jøYìï6«) -ñÈ32@ŒÈ6Çñªéß#JüÉõå+±”@PäMË#²lуÂ|^W¨Âr«ÚQ 6ïGcùYQ•óæ†Õ+³¬%Ånh)¥…QÚ Ñ×eø|l™ ¡ø>[pw ë68ʆI`Ã#G½ÍeÜÉ4e(L¸ ÀHƒ¼"  -@‰0É##LÀ€ó®B7ãøÙSÔ‘køÕùÞWO i“Ä0Í`LòoÔ¢…óë…ò.+ÔÛ–ùŽŒ-â!Z¡H%B«DÔ(ìÍjŠþ#cv±äÝkKð•ì{;¤@ÏÍ vÁ§«… rRwžFà© Tà‚>^7ns‰t¾÷˜Íx…ˆXo.þØãÉý§Z¤óô„#{VÖR‹$F+ÇB[ÃøŠõÜQܶ£È÷m·ËEø-G…Wß?¢®J[°0Û“'°"”Þ’gï;šg¤ +¨pK -Š{×Ở¢@sÅžŒ–"„¼ù2uÔ§EÛ剢]VŒòºCLדsÂXœ¤°ÝcžÚÓ‚Ÿª(H +à ¾þ©Ñ§~âÕ¢¥ÜÝ¢É<çGR

    .SÓI~_ z¼ VäÊMɈz U“4u!„¾Ýì4(nKÏNHĦѱ‡=âÄ#=pÏ.Åô’/šV–^pŸ¶{Æ·xT<•ï1eǸ~퇬zO¤Ê¶ý~Ç¦Ý ܈®# +Ÿ»êËž¼?f&žØòô®£-YTÑnè|.ÛxýTó‰Ñpd“œñsjgÝjÛ;tuÃq­†Þóa/ +!#¦Û^\©ƒNi9º÷ë2Š¼¦Mï7ÕX+@™RTJC§\|"•žv‹çmd×Lí§l?”8 î¶ÄëœÑ[ªf/Ô‰×õ¯Ma—QÀms¦º àÂ*RHÛo6Rp)ÚÀÔ/ ¬y:YwuÕO¥¸ZE±Â ¹u¤Îe?Á¢Ýs1L¢"Ðß›}(ê#ú÷(÷Pª×X·5g¶“Þ­Þ1oÅÿ:í;÷u_"MI~ … +éSUæT:ÿ…ô£ýÊ!œ„a„)'/ï1?~û•Üß­^8­à8ÚŸ¶W6’Êùf#§c…s÷(8@ô-÷ømÝèpß}?È‘*%¹“&c5(‚ve¯AI†¬îujèZiLd¥)MÄDKAzmn’Þn<° dEÎ%Ã&n|óy-ÁÝZ±[ ÀÍCE˜†n'¡Âây*4Ó_AÅ)*%ÎB…-ñónÄæNC1Al,‰À~­ VX}úÆÔ +ƒ1¹çú'à/ITΠƙÍ-@‚‚!IQj>öüHMqÛ”ÚJ~ë¤|ÿ:Ç-& …4,ÖÍ÷‹M¥ Q#Š|çœPÈG ´¡ÛiN”yó¥©CZ2ÓØfwú«Q3ó €„È» ;Ìñª•¬›IÞòì00W`>•.¹aãá +6PRy8®P j-`íÇÖ5SGà…úê¼ €»kqäÀ§êB¶¼ÜBÂĦ‹Vá§2C¥»”ÀîR”€‹bpQÇà¢\ŽQ ‘FÃLêØ(‰µ›+€A´KÁ“€©û·%€:ó³“ÈbñPžû°ºA[— ŒÙ¡ŒÙ±ëƒJpçà1é K åjëÙﱿƒÃR‹ç +]úÐ.åtÛÜê‰ç´|7Ž’ÓÚ<Ç(¥÷ñ09GÜ9Ma„Ñ؆Ï-'DGо1ý#DJ½Ò}v¬|纆)ºo bçÁuÞäœý± ±sE>½Æ—yï´ª4Ì6²œŠÐÈ„xË„*ï4àÃ7»®¥¤¥Þ†2&†ÐÎE»Ùú‘ÚoÒ`æÈE¾ËïkêAå&93cè~ž ®?QÍ¿d?éL …ñSÏÍؼN;6{5F•Ü­ã÷@zX°$ÏÜhú›æÄVØíŽ#è,[6.Ok~ê;7ëÀõ?¿ðÝ ¾˜N¸Ã> »j# iUBÑò3z;Þ›¨tEÆ5½íl‚ð«\Ôhª&H•A ˵ +ÃÖÙ ?0ùFöÖ»–ÇÕAú(¶õÀ®ÎùÇÔŒ~Ç,i»-¿ÐІrk‚Ü“´Ög¦kWï±+thQsÁ/OrIƒñX}&]íò@Å•®'¨øMã.ÊÒƒ¶ö”jk >ŽäÉð¾Õê%!{¿áWVNÏ7k^»á‘Oræ$uî@l]T¨8Àh&ß5tð}'’Ȩð;˜²<³V¦'­çÕÁ àXTQo9wæŠ`…®MøªuÀ_¼¾¾ãÇIÈ]!ž5zÑ]ãtl'ßA¤TòqÎk_'0öÊk^ìVß„:{?­žvi­ÑLïÍh†,y7wäÚº7Þêù–[E»5°§²ÉL#×\Ü…~³F«//¸3ÜÌוi!D@Àßê(¼Ìs“8>Y“-ÓQxn†Ymj²Çn …çx‰‘"|Ã&|[RŸ€ŽE `rq7à’F¤˜’¬1Ô”`Iãqèªøô½»Åófoá¾ë‡ñTËÃ觌ý”…]6ÐÁâ=/Õã-­æÈ:T5Ð#ý†r6ä—Ÿy_©o!pþsË¿·ír{ÂÅ»ó0óܹ4 xû®²E`[Ýd̵úCHæÿöbÎ^PO8‚[~Ì™íRo‚€Û]˜É‚Ž¹q C8Ú–i~Ô)f4ˆGD%Ã˽lBFMôµÞ¦.Í„*ÒYAO _?kXKÞèáñVBJKÉwàÒµ$ÑxCzM½‹Ö –Ý0 HFŒ0ò±­4¦I¢œ«‡c„†Tã¶bKàô2÷£Ëd\Òò—ôçŠJäytfªÓwÁÞüeNè ªmq]èù aU—ZÜÁª~UÃËýÐvØðFú㊠’쟘Ksa€Ë_æó»óëwÌv> endobj -4200 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [201.985 624.519 255.917 637.421] -/Subtype/Link/A<> +/Parent 4287 0 R >> endobj -4201 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [319.668 624.519 442.172 637.421] -/Subtype/Link/A<> +4299 0 obj << +/D [4297 0 R /XYZ 85.039 786.531 null] >> endobj -4199 0 obj << -/D [4197 0 R /XYZ 85.039 786.531 null] +278 0 obj << +/D [4297 0 R /XYZ 85.039 386.929 null] >> endobj -374 0 obj << -/D [4197 0 R /XYZ 85.039 584.069 null] +4300 0 obj << +/D [4297 0 R /XYZ 85.039 341.854 null] >> endobj -3985 0 obj << -/D [4197 0 R /XYZ 85.039 559.517 null] +282 0 obj << +/D [4297 0 R /XYZ 85.039 191.766 null] >> endobj -378 0 obj << -/D [4197 0 R /XYZ 85.039 517.822 null] +4301 0 obj << +/D [4297 0 R /XYZ 85.039 157.02 null] >> endobj -4202 0 obj << -/D [4197 0 R /XYZ 85.039 496.625 null] +4296 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -382 0 obj << -/D [4197 0 R /XYZ 85.039 174.763 null] +4304 0 obj << +/Length 3511 +/Filter /FlateDecode +>> +stream +xÚ¥]s£FòÝ¿Âo'U­X`yÛõ&w›»ÍîÅNå!ÉH¦Œ@eÿýõç0’°“ª+—KóÑÓÓÓÓßCtÂ_t»N‚Ðä·Ù: Ýnö7áífþy ÄJ@VÌû‡›·ß%émy˜ß>lž< ’<½}(YÜýëÝ—‡o\®Œ1‹4X®²l½xÿn¯wÿþé øüi-Þ}\®¢Å!Ž>.WGûU-ý±LÒEÑÔ¸´«ò ›èXºí>t´y0²ê®kñ‚F黦©zþ5LBÜø8zçB8\º!$+¼)àÚ*B¦æÄ…±t+»ÿ‹ªÐE8/NuÓ0DOX‡¤kK=á`ä<ñ‚-ò×ÄxVÀ‡#Ìž˜vì¶ £›Ø,Š ÑÚ—J?ÃÔx[b3s„ÎŘC! Ärl Ëá,zÇîHkLJ)gXÒW»¢/¦nwˆ%qcë8вž{@”Ìóâu²øIøÈ3r ŸŠ žæ‰Î! ï訛îÈx´¤£Å `xêi¦„$£ d ¶–? .¨ÏÇ^¹þÉ`*)r0ÿlºý¡©ÆŠ{m5"ä$÷ÏÌWW ²øÐw¿†‘Ea•[b<·I`d¸*£0z™"âôŸ*½ JDY)aDìWÔ“î‹é8Ê+ïÈ Ùc’µ´ëͱ¡ŒÚ|1v<ëDÚHÝ?dU©º5<Ý×Hñ¨Î¾AhÃgˆ­6&9…ŽÈñXÉd-ã/žö/H¯F< +ð˜V_ßø®'Ý:Ž¤¾æ¤ž"¦z'ÐÚÊë8Qj:Ô ;@/>Ž™—Qùº6À"¾1–aÁ²G£‘±V·²©ç‘„®-Ýþž;'gdéŒÎë-ÛµÞ²Íè–3¢Æ"ùd™øõ—µ*èÊ=¼¿ç7"£­Ü bE¤Gº}¢†°õÄmÂòƒÖE;ãHM¡sΣý +!kÁ”Ënâ%¡öã—O3œ@ûñLb‰»¼!òì6ð,¹)øýtÏ¿?Ó6xƒê4ðÂx± ¢ð wa7¯IÓ!zØ@‰Š³ Ì™¨¶Šk½r9  ^ÛºŒvôbY­·ís9×ãŠà"ÊÀ)2H¶0ÊdùeG:]bɘjÁèiÃ;Oà´$Kaÿê5ODíÐÁEž[¿×=7ÇÞW#œ£çƒkÉ 3‰­¶Œý îwŸ…›4ôƒ¹¢ŸÖÎWh˜þ-#J%ow}îa +4ABÚb/-ä©5S˜dAØî¾Ao¿³‘äF(wk– ]»Ý1ÌY ¥I€üLÒ‚{Ë Üß@¥ ÷_UÇjoâŒ6 â(þûA ‡;>|Y;^o€ï_—`ë0aÇã"6Wµ¢—†Ï¶³K¡9t} NPx+«Ø˜`D—¦îŒC‡Ö‚Í„J~’‹ä‡ G&:¬¦Þ8= Ù$9K܃U¢ÆẎ§³3 NŒkÞ³*?“gX‰ õ™V6ý¤·!³‡¾¼ì@(k_óÀ¸s?ùLaç¬éêe* ¶Ï0›äueKž@ÉNq,87^oÖ^ÈrR¦QÅ” ’5—ø€DŒââ#Cþ!Z¼¥0º§§3µ‹¦ Û_>@ûŽÛµ ؉Jy¢÷•'%¤Þ£sÕjĬY/>¶ªfE)@}GiÜ0¶Süìàì˲ƒ–Á±ïZÂÏàm³‰ ’,}UÛ<˜—µMþJÛ^ÛÐiÛ厳ÚæïøNÌ° ÓE¥qô¸”Gñ_a¶ê±Â*Ql¹ˆÁË þ=j‚UñЩ.§U…óIc¾´æ48öœ>Ý0Ž˜p¸ã_º]l€æ<ÖÍYàð +戮þ¦ÜÅ)¨ø³ÊÞyƒ€ƒ&Š…Bmü+.©%WŠã£\£~ƒih>ÕfÒH‡ªøê’‡æ(»ÚŸùD"jË[½'ÆQõæùx๒q¡Ó˜sófÍK3‘»]Å(Æǧz|r;GÚXs9#‹ª^L‹•…Öd›ëë#9gGi>“aØ¿åßùBŽA`~ÓÔ•l=›; Q|:.oQÖ±«¸I¥OPx)²-¨…#8sRÇö &ûr­ã‰=…ªõ¾v9.wRŽ»Iù+vÑ>rzío+tU,&!ªÁU –HMSÌã†Ï6SN‡aQ ue \gSfgÃ<È7¼Tgà­†Ò6 ¨{…>8‹é/WLé L K±¡&70@ÇcgÔ:«kRUV¥°›÷'o†Éí‹gû +ÑÅ\§gÑî*êÔQ¸Ò´ÏóVO•—õbôÁ±+ÉÒŇôT€Fö t³ï…•Tœ“ÄÀE¼0ÞI É! +4Î"óB•Ó(·°ÅufÁqÍ HáÉ’º‹J/¹Ã&›”©®41¹ùÊÃî¡÷E)-*%õÕF+Û +>Šwð·Uš°­u^XU´gî#ÙJTtR'ŠS€Có¾Dž¯ºæ&;TìÁXî£Öä©TSIásJªÜåŸMÑìÕRø9²YÁ—©§º:%ÌJ’;ê^¤0àÒ6»æ„ˆ(Ç#%-3†Àºjªå0G´/¥†NµV“ C~Ò»Ê%F}WÅ»Yë +Z¨X”úƒ^Ü-«f,xÄ«¬c·@ßø}ˆn‰!2FbC…„Yp .¦-UÍy¾ÞíØ&™) 1*,fñÆ1Há\…‡|çÞm ²g¬g Í…m>†WŒ”šäþœAÛXj@箤ï&¦2 øbéö#cŒ ïâ&FŠ”ÆS^ÿûÑ•ÆkŠÝÝ.œÊ³Ö¼ t &’¨ËDàÌQe¦—øfS“6ŒÒ3'}ç°ãÎeîVpüÌï2:ÿ¸@ÀÆ+$b[˜De’· +ÑÃni}ðW1“äñ$_ä+ž0 ô³ùîqô3õÑy’3{@I‹T@Jk½ÈØ»ãÙãBjj:~ÔBHGÞ@LvÏ/;RîñæÊ#7{霕“åp*m@;u)‚ÓñäÕcKî\Cƒ¼ÃË1Ì}´ÎÖ/Ü$!ån¬øˆÀ=gŠ.r›ÉrV3=ì(úf|©¶sÕ©E=j9pñØ= ¿œ‰z»TÑÚ9çËAUÓ7¾ÜhÒJÉ&­ê¨f?*’¥ àk¯ä$>!?€ ú>ñ¥Ó¥0…E?NÑ:6$’«IeŽ•¿_ªv +ˆu©sî™:úøîÈÀ4ÏD ©øF©ƒs… y¾ÔZÃé©vÇV<÷ê +ÓÕŸ¦2#FÄLö ”¢×H{/fì0GÁJ+:odþ²\RŠ6k3­à"ã´ ã•9¨®Ñ°swÓ׌ðª,XóÛ³Ó'é‹)ôÃòDSMEDÑhŽ:ýŒFüš .vÎ +ÂY¯Šï*Z®‚qñ4A†G’êJË‘ÅEá“$?»¨Š°P1;ñÚÌÖa)òÏ%¸µ¹™üsùûœšäâPÉÚÑÜàP[Q\’KV–ÇS”Eƒ’´Ü¥·ÏQÚ[)~cB¦BÄ<Áp¼gÀZk¡«¬ÝƒQâ=ð+K¿ð‚DÛYë³LìÀ½ ¡c¼S MêŸêF:¯Š-dséç SÐú¸e,™âÈûÆÚÊ (¦T’­W[Å6‰h½«[ +Ô4"Á5Š¢;ømä!øåZ=ËsºRy9’à×A8Üy_Ð0#öü‰Cåž¾…o" +þ‘ÒcÀîÙg'—»)-{©ôž""Bù”H^uxIüWðê1’3k.싶Ø1ù"çï…ò¦j9å'pj‹ŸŠõò±‘ø*ðŸq›‰RËÇØø\`DŒüÑG¤pŽ¯îÃ%oÏQ ¼w_`qÿœã¡ëóòw%h€Ô­ï‹)­{©pj’ÀšÙGøgäÿ×7{Sõuäëx¾š€¹J3«ÄàiR{I°~ÛwMñÿV endstream +endobj +4303 0 obj << +/Type /Page +/Contents 4304 0 R +/Resources 4302 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4287 0 R >> endobj -4203 0 obj << -/D [4197 0 R /XYZ 85.039 154.767 null] +4305 0 obj << +/D [4303 0 R /XYZ 85.039 786.531 null] >> endobj -4196 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F35 2880 0 R /F73 3992 0 R >> -/XObject << /Im1 3957 0 R >> +4302 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4206 0 obj << -/Length 3111 +4308 0 obj << +/Length 2946 /Filter /FlateDecode >> stream -xÚ­ZësÛÆÿ®¿‚“N§d§„q8ùERÇõ£–<™N’ IˆH€@kÔ¿¾ûÛ½@¤Ý¸“qx½½Ý½}CjâÓj’Ï×é$N"Ïh5Y¬ÏüÉ=íüx¦,ÄÜ‚Ì0ßßœ½ø! -'Ê÷R?ÜÜuxRß3i4¹Yþ:½øéüÝÍÕûÙ\k=½Ù<Ž“éåÛ™š¾>ùF–__½¦ù÷³¹š^ÑàýõO/ßÍ~¿ùùìê¦#`@¢Ò×<ûõw²$R>ó=&“'ûžJÓÉú,4Ú3¡¶óÕÙõÙ¿:\²NäÔ·F'žIô!»Ê ØUö‚@Mbc¼(Œ™ß›Y¢§y^ÚÙ<ôÓéó,H¦Õ¶–Ù¢*óUHlÞÓ‚ò§·³0¼¹¬Š²ßÉdñ‘× -‹íÃ5‹èÍùë«ï0pB;ÿçkÈÊ%Ét­ì± Íò^ö˜¬--Ô¹\Ñ>Ð$k!ìÉÜ26WNÊÜô´ã6fÍo`XÓâRö‹¿á4[,°“oZÚË1´·8õ,c¾:—¿0‘ïû²÷êòÂÛW¥O«`y‘o>¯Ú¤¬…càÓ˦^W$>ä1t°‡eîhšGZ{qtjD¯—Ãj¢b/J‰rß÷B²`ßT3Vˆà€QLèÅAœ“åùašjŒ™þž-^xñr­&—Q:Ù!VðΈE§“¡N›ÈKI—£`uÚ>U@ª]çÙja -¶mZ™ÝâÇAAÇ6ÇòþPÖ‰Œ°Í€4¢ VÙdòT¬V2ºÏ­1ar‘Áʪ•ã0¥R»¯yy!“;‹ºíïhuÜæM;ÔL°ExÖ¢OØÓÅÊjè}Þ¶̈õ¼,Úœ¬dsQç˼¤¥•p‡µŽíZÈ8Ðç0Vž!™TçÏ+"t]¥ñdÞ¹´¯²@щ¯71òÙÆD_Ê™…>fb&ˆ¼PéÓ&fÒÄKHŸ¿ÐÄ z‚ÿ»…õx˜‰/Š$HÞ¢{biꌩ…ê«%+b}*±›SÎ}úäÅ-{d «?åu# kçø]`r—ÄîFÞx.>@u«²øOçÁ)t‡:˜þñ4MÄN@;Û*aq¶:°9ÃR,ÓÆïbÙo¾ñ?ú¿ú–ÐRFp±ª˜åÅ£6Ìõf„°bR+™Ý׎¨L^‹OLGnAr–QëÂ)PîX-Í™Og¹XnF\Eqç¢UnŽe÷\0ö%˜"_¤Eîy¹°."®Å ØU‰º¥ „ ûd7Öy¹m%‡8ê6æðçkÇm¤_gï»–JLΙ Œ7Kít*ôõ4[5F½ùPi±˜—ÍÖ¾è›.á½.€„›R&K‹2“ŸN>áY‰ÅvIëo®feuîq»U).qÁø%¼³„/—œYI‚t˜R‰!TP¨ÄïhEàÎyxt¾bÕ?hšS$Q¬} ñÔi^‚Ì˨°Ñ'™ BMwꯦblÄâ´œ—tqÓã€ÑÉÆÞ3`1/È",åáSùˆ½É[Nï_¾%éêXOËlq(‰{±êØ,h|!c¸ -˜W.æ07Q´‹a%¤‰tìúQhïªäÂ7‰¨‹’ðc•ù ý‡£Ò"¡2P”Y‚HÍ­þÑ åG^bÀh/ÄØqF,+ã%(½*Aþ)‡Får[Ùà>¦5x†b5l˜S¡S”QŽÌ"öÕd@ÑÙæ€ìÝØ%žÚ!ú:“Ôj©‘Â/Rƒj& -ú:Ú~Õ¸—o K…r×9Û‡lWá¤;àuánëÒÖNéç* ?@„ïÔ\ì}´m]àuݯùöuöèî¤ê~±Ê¹é‚>'½>Z¹M‹‰½Q6ïÄ j}åhsÙ¥øu´ -Š[[6XfûÑØèØá:BÛ3Y=V']©Õr3Ùq4âïnª4ðRiÖ×ßÐqýu@÷¬fŠ—Àh3Óèf¯7\ÏÐÂ]Å+2Ù6ÎõsU³¯µZÒ'‰u0Äîj-b¾Šwˆí{’AÈÅ*K jˆ®3É»qßã¾ë°ínº‡ÆxY­³Âîo×B 4>Åá$zسŸâæVOµ‘„vØö8 ïÞ_áózh˜¸ox åëW]§%‘*®­’¸>O&?Û¦Ï-Óþ3…íÔ.÷èvô: ÒØ@GÍü?‚‡hë*éÈšî‹…T²V؆ëù¢+%\ ýhzyQáܾ•d׶¾¹Øe»ùF`îªUïžåÊ-;ñ|ìãᇦ÷ãÃý‚óßÞÍmk¼Å#‡š…~~‘œ^ŠZ éýN£ÅªÈ»Çµt´ÐáéÜœÝ`Ï€·­±áße¨”ÊXm[ce9Ò<³#Ø-ÍFð‰Ã5‚Šü3©Åô@q_Žâ°÷Ò ·é\ëñRV{—GŒˆ¿¾ïbz¨m:„ǧÚ@ô+‚Ðëÿ„1`ཪm+¨î:ÿF è÷‘¿1Kç•2ù9øˆš?‹)#½ªÐ zŸ~—ö‹0#—†Õ[;x\Yhéâ|ÁžWÒ–¶9Zå‘õhòGÿD&_õ2g /M‚qÏf¨ÀˆâЃGˆ¢}‚Ý_ÒRü_…HmÇendstream +xÚµY[oÛÊ~÷¯ЇR@Ä,wy-z/9'9­7V‘9y %Z"L‰IÅñ¿ïÜ–‰ô)З³³»³3;ßÌ,½™‚Ÿ7‹W™dÅ¡o¶Ú©Ùz~>ó„c!,‹ÏÅòìíOA8󔛨d¶|hçI”$ál¹þâ\¾?¿]¾û4_cœÐ/¢(v.Îç:v.ÿþ¯[¦_}¼ž{Îù‡ùÂsn˜tùñfùi®#ç#ôücþuùËÙ»e+NO`ÏæÛÙ—¯j¶Á9S®IâÙ3´•ë%ÉlwæÆ |#ïÅÙÝÙ?Û¹¸ÏŸñ¨±½[Ž…—¸‰^×Oº¡ +[ýh5¢Ÿ pC?"ý„®va‡žën?qÞýHwO2PD9·W—ܸ,÷¿*Ïߪ´ÉËý”JPV¾.cÇC2zÁˆŒÚseHÆ»ÄÙ¯@ ?‰ïh•¬ªQ DŽv5÷Ü[ºÃî{l1±¡ÃZgI‹â…GÕH:<íi¾€!eÕÔ“¼kø+Q˜g|YäÂV¿AíRZ6¡]æ¸ Z µ¦÷ ê^ÁŒvºØyF–šé7K|ñß°…´R†é)°/L8ÿ¾eÂmU>°MalmµQîÓÍ®ç§yì;¸;Ç@‹8¾)¹çžt•ñK¶O‘¥ Yײ²H–2Ë-ôó‚YË2f#{J+¶ö7`\tBUBÎØ@ç6cÚ— Îò>-¾ÂsA"Vt*‰öÊã¶rŽa\ÝnÉ%%“Y…o›¢b¿ãŸpÓ~¡§Û/NAë4š8úaƒ{†§h%‘ 9Bs‚¨7I̘y*p#_ƒ¹A4p±ãgër@aC# ×ѸÏY.Ë„&y÷£µÈ“u`ñâD : \/ +f½…N¤±<¯Ks<JsM.•ïÒ‚íBGx‡»wWåžì¨Ù=fóœÖ@ø”{åPmÀ7Ú}ol§ˆ,¼¯o$ñ\åE³Ðá0”=£Èeõ¸©ÊC +ô~\¸z‡qèÓ<6ÎòýˆŸXhBî]Z7´Ãj0É âº?88K.È&~v:tìx{¾šÑƒ ëh8ËÞÿÛøzépÎ_‹Aœ¸~È;»ËØu+: +¶Æ€Qñ¡@¾ßÔüŠ{Ï­¯+†8x|A6(:^_‘n±T1¤ÁãË>klXøÊCëmZÙÉ +ŽÖDØ[ØÍdšF::hQ2"kzs”û ¿=ç´ácBC;:="ä:V-øé˜=¸ÂHè=bJ,»'ª¬J{×wüüL§{͹¢Ì™¡â–d†>«Á¢ tˆ*ªLßHÖ·ÍLR¸GÏÂÀ ˧èŽì>0].+ímŽŠ/µ+tCÉJëN}Óu•8˜æ¢$4’{á:ùiÃ/«ósw8‚Ô*£Â%_µâÙU‘•vŽ Nâ¡ñLÛ7" +ä¡ — <£å|@*„˜¢Œ»|Ÿ×MÅJ°z$Ñ$¹Ä<Å/‹ ‘G¢;˜v“6"4$ªóE²•5”òbžŸˆÖáyóqÉôžµD2Xxva& ÈãveSh_d-H€ Q‡Ã¦Ì+ÏÁ©Á™ÚS˶™½9Í@øì®=NÙH-HÛ— 7z)·vlï`] Ãºv%»¼±Ñ±’l#’o† Çî²t/ÍöPáË”ž ž‡º<’—UŽ"®DðT&MGL{‘Ò1{ì%}Wœk´ ƒ—Ö`ˆÓÃØ-¬C…ø£ +1¡û“[COa°rÇÑëhÖã™Ä`ÇPÂë>ÁàÏ[R:àê·e;9æ&YÍ´t€Âh‹|ˆÂ¤œŠI¥t1@BÒ³¹QAð×!û# ùÛĆ ^ãüƆ{<“ø ØÅ@Ìå“Â<Í¡ &ç,¹¤„:Š9¥A]è(â”)¢ýãÃÇ÷NF[qWÜÅÉ48ƒƒëÞÀ»s¼Úº@þs¦lSY>«l“w¥Ä`¦›¬¡¡>Þê^ƒÈŸî$”ÀšçÈÿö'÷ËL¥ÜŠ%E£ÿÌCEº¥ÿÞjl¨·_Xþ:2Ô&H„PŒdj¯ ’}†ö‡Ü—„L§7º@é9oKy½Ç¾ÛÆlšÂ‡šº‘P¼—Ål–‹%áýŠjT“uÓ†%׃䋠\_¹q ´¼ÜJÐÞ¥¨”ÇÖ³q–X÷ê{ÀeóoKÑdZ4+Õ$b;`œ²Ž5nÿ¥íîÇæPt5ùŠí<7 +ƒ¡í°b² ÃÑ%­ÈÝ•*Ãê¡@UGz5ÚÐ]K_¯²g?dK¼LpªŒ<,'ãÐ5"ßZšã‹òW[³ÝWÝMñXÈÜAÚrupµI’ïäm—¶…a¾Ï†_coQK¦2&®þKüÏd }ÈE˜/ Àû’c4Eì5A™\NsìO¹ç3Æïa¯[´C?f ”TB›’ÊÚÎ8(ÞV’6dÕT + ’¾ºá–e2Ð*q#Åî9®­ —eð<)Ë”o¯ï™á-Ó TûÁ­·L§+|Å&›¼ÅgÖç9}Èx´WP¨*bà¬F”ß‹ ~w6a†f±© ¾PœJåëÅHfÏõb!>K\,ø#ÄÁÊñ5‘¯ ªÿ5AsŒîü¸«‹3½Š¬Ï_ZxV»'èj÷ôÕxî„]-^B›¶îrûC#Ó´j'-”×v:¸»¨%eãžæ² 7÷%ìjÎä£l€_˜ÒJ¨{i…û¹—ns/ c3•«ßä«?•_¯ÑZ|×*T‡½£LY/Uf +Ýptûçˆî…nú¥[ä#Õ#k,‘àílXùDLåùí¡’«_`3EìøvȪ<“1¹Ì˜ò„m– ]«Ó"ÉTð"/»Ãž_ ú|îe+Äi/äù­ wÝy¨R%6 +jÚØ8åȹã*: RÒªÛ#û‰Œ>VæÍe¡c[¶•f͹A´—ÎIÔ»¤KX;†Å¸°O¤p0öëjVÈ=¥'@]·7ì-:'Qß?U/N|°k#7áB›t7cW(™ ~p` Xv£mV'òüC¯ö{©Œ¶ÁQû#{ÔòÅ)£¢ >vÇ q¬y–UÕ^äXù:rÈܹÿW(ë·¾¨Öy'!ÖÀæqÁžÈy‚Àƒ2cªò çxÐÝ~5û>‡z%-ò5)v>•˜Àõ§¾‰1þ?_‚üØMâ‰AŽÜ0ò­0”dÇ&vƒØŒHü/gendstream endobj -4205 0 obj << +4307 0 obj << /Type /Page -/Contents 4206 0 R -/Resources 4204 0 R +/Contents 4308 0 R +/Resources 4306 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4163 0 R -/Annots [ 4208 0 R 4209 0 R 4210 0 R 4211 0 R ] +/Parent 4287 0 R +/Annots [ 4313 0 R ] >> endobj -4208 0 obj << +4313 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [489.95 414.026 512.306 425.715] +/Rect [213.892 559.249 384.824 570.939] /Subtype /Link -/A << /S /GoTo /D (ads-test-smbclient) >> +/A << /S /GoTo /D (samba-pdc) >> >> endobj -4209 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 400.477 183.828 412.166] -/Subtype /Link -/A << /S /GoTo /D (ads-test-smbclient) >> +4309 0 obj << +/D [4307 0 R /XYZ 85.039 786.531 null] >> endobj -4210 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [214.276 400.477 356.796 412.166] -/Subtype /Link -/A << /S /GoTo /D (ads-create-machine-account) >> +286 0 obj << +/D [4307 0 R /XYZ 85.039 766.606 null] >> endobj -4211 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [380.57 400.477 476.48 412.166] -/Subtype /Link -/A << /S /GoTo /D (ads-test-server) >> +4310 0 obj << +/D [4307 0 R /XYZ 85.039 746.481 null] >> endobj -4207 0 obj << -/D [4205 0 R /XYZ 85.039 786.531 null] +4311 0 obj << +/D [4307 0 R /XYZ 265.175 682.906 null] >> endobj -386 0 obj << -/D [4205 0 R /XYZ 85.039 372.659 null] +4312 0 obj << +/D [4307 0 R /XYZ 85.039 614.633 null] >> endobj -4212 0 obj << -/D [4205 0 R /XYZ 85.039 351.462 null] +290 0 obj << +/D [4307 0 R /XYZ 85.039 544.981 null] >> endobj -390 0 obj << -/D [4205 0 R /XYZ 85.039 270.776 null] +4314 0 obj << +/D [4307 0 R /XYZ 85.039 510.235 null] >> endobj -4213 0 obj << -/D [4205 0 R /XYZ 85.039 250.181 null] +294 0 obj << +/D [4307 0 R /XYZ 85.039 413.878 null] >> endobj -394 0 obj << -/D [4205 0 R /XYZ 85.039 150.632 null] +4315 0 obj << +/D [4307 0 R /XYZ 85.039 379.132 null] >> endobj -4214 0 obj << -/D [4205 0 R /XYZ 85.039 127.314 null] +298 0 obj << +/D [4307 0 R /XYZ 85.039 269.226 null] >> endobj -4204 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R >> -/XObject << /Im1 3957 0 R >> +4316 0 obj << +/D [4307 0 R /XYZ 85.039 236.805 null] +>> endobj +4306 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F38 2997 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4218 0 obj << -/Length 3383 -/Filter /FlateDecode ->> -stream -xÚ­koÛFò»…Ð/¡€ˆ%wùì—±«[8ñÅ.r‡^£EÚæ™"}$ÇÿþæµKJ¤à1÷1;;;;ï•¿ðàŸ¿HB×Óé"N"7Ôþb½9ñ0ó·_ V²Á¼»=ùñ},|ÏM½tq{oñ¤ž¦Ñâ6ÿÃ9ûåôúöâÓr¥µvbw¹ŠãÄ9ÿ¸ô«ÓË<|uqýwË•ï\@ãÓÍ/—×Ë?o=¹¸µŒHôµÆíÿ{òÇŸÞ"R=ñ\&‹h{®Ÿ¦‹ÍIj7 ´ô«“›“¿[\<,xÕÜiC¸a¢§ÇõÃÑq}_¹ÚW‹8 Ý(ˆé¼çe¾\©(t^—*qš-wŠ‘“q¿/×8ý„ -@Ô#óˆeÎßÌ,ðŽ…ºm:¸ÑHø½+LóžLÝ7Qw¼dÛm3¼ã·ØE’|g+ „MD0•÷Â^X×CóQ¶]=ñ·y&jj^Oì†ïÏŠªÊÚØ0Çf´â·¢½3šÅGEX­'Û]§S¤d !°¡{@<£ uSÏÌa}Štè¦q:Ö§HôéCÓ‹6 A–¥a€9¢"~èjÑé.M†3¾“0Y™ëy¹ž‘8\Ì7e]Z8dpÖ£ã$Þ]FÝ .mp:—…=+sY'#5–fû¾ŒçgLIYw}VUoQX5IήÍ3Â~N Ì¥£´åÃ#ÝlKvÖ[ÄHcChLÉ¿)hêûªx3B ëF]ôŠØYËòéá0{iÉO> Að}Ùó°¸b AyߢšmEü©^„£bÇYv´Ã<‡UÄÂÓ ×ú¢æÙn{×­Ûr/¨’-Iüƒ …@Ó9†à†@.ªC1lUR ¢½| -G8}²±A…V$/rž„a¸ ±'yîÌÉ22^ee±ô}±y™ƒ^LáhÃÍ,_Ú5Œì’R‰{²Ëƒæ^§W‰¹£Ž!˜AîÅ %e®¡ â4żðý¡eM#æq¸Eavõ/ÇÌð†A! ÉG·È÷|?ˆ’?tKq°§‡hÑ ÷¼4°í–sŒæ!@d¢+hÐd›\ÊÏÅ&‡âp_È -±i/kt6äZUá¼MOÖÙ]®  fX‰:ƒq7“Á¡2´ ¦"m´¡<2×Çb„Löìšj+©ð.@ó=)6¿Ø:Ÿkzü®Ü°âÆ®ú¾¤``ë$=†Ö– KÑʵRo0·‘µÕ¢›1é&Œ›;‡©Ù;ÚÚokãšöÉ µ`k‹’-¹`R{ÁA|Y8d3ÖUækë¦`,ó>0ð róŽW&F0‡3)âP4¸dßñ%“:ËÈ#GÎ"¨g÷|šçܸÊÖVƒ±Oµ0ÐßyâR>øž£?CÀg1$;ˆKxÑŒ?×±NŸ‹×í2¢ïªc‹Ÿpëý° b;ˆ<?ñ -Qù‘ÎÜJJÇÃCö4(gÖ2P²†¶«È‰§AOXŒ𢄤| BmÁÆßàé6ÂD@øXÖ&›»dbÇ’“­YP¶Ë¡”¤KÔ@'/ª¢·f;Õ¬@ÔÈó±E‡V·M‘—PÇKbÈŇ â‰À…°ô¥Dsƒ"ÍPòŸ¦”ytjSÙ·Nc1ƒ¾—ü!c¥ãt(lĉñˆÒ›D@0Fl¥c)D§Äfû'„û‰ÍŒä m䇸§×@ã÷àñZì´²™“mÆvûê2r”Œª9ÆÍûéô0™UÔæ¯Ü)¾‚gï˜k9v5¸èÙ¤ñ¥ðàŠ/¹÷T  ”BB>M´É²§ÎçG ¾¼›Öu`ÎqOÚ-ÉÏ“ _XBÞB“ - 8¨Ê¿ù¯ùJaŠ0†â{²™•ÌÔ k/) Eÿîòã ðÍËÌzà©Œ˜èS‡¦>ƒÑ.,¾¢ƒ)[!A -&ÚÆ¡+VÀ™íÞ›ŠÃY•Äñ¹„€\#Dï.Þ#äÇOÜ7É€¹cLI(´5ÑÇkÛBmW1WêÌè¶Yf’Úë!£Üfïž$&€0Å,•`L÷¥\Ó´š±Ù7¼b8.Ùê ¶¦Ê¹1Ë+¯sÞ–Ô²XðšP’JæLUçY?i¬/™‹´€•‡\­ -b*¥sO#˜Ã®ViíÆa8vµJ\-8U[øǸ$£`í#/»ãTÅ?¿Çt9#u9”3+í»Áñpa9œ1+à™ÏÁÂ鎜RlÆŸ9 -ÃÊó¾bËs¸Äé;ÿ¸æþ5Å—÷’`sE¾`ö¯Ǹdé±LáÀ [}ñLPr±ÓC6‘Δsù .4:QŠà × ~¦v œ›Î–¸ËçžÉ ð¾öE‰¢D½Szô"øHÂÄnsç®›ú~&œ =W¥‰ÀaÎr3•Ë{)óE±«c=q§¶*ø‘.’pŠjõ‘ó\I6!@É#Îîi<ó.2öÇ©œWN ]i2zœ1Å\`¹9QÂ&åbYO2dd&‚lÇ$á'dGµnKzš‘ÇGzï -lv*/I0äAÈŠÜ«±°€öM;gbËšsG†««ÅÝVò³@9¤Óo:î4Ï»• -`Q|Ak.k|H0Ü%„\ˆQä´ÁWœ«U‚^tAÀ§â³—ÑðýXMÅG{òP -_+Q ^ìøÞ[y½ÉÑŒ}õ†ˆšmùr€z”mÈd‹¹Äi—¥îÌ¢•÷Æ÷8ÐW5Xˆ(¥Z-Ó/dÅD!M6ƒ‡ÝɃçŒ3¹âTJí&ya“ûÞUbäÂöÑÖk)„ý´ï4»Ã‚¾š*4 «†Ýæø·%¾J\P}ƒG®6žl§××GwcˆÉf;>ZCŽ˜„ãÍ8†‹@­.Rw÷• GÈ3©BÂu¿ÅÚ—š`€Xöux¦|‹÷”p)¦‡=‹ænøIFòA{­Á[E§ð~2rÍÕd×> +stream +xÚ½Ùnä¸ñÝ_ÑÀ¾¨iZ©k‘ð\Yov<“± 0™¹%w £–z%y=Þ¯O$Å> Aà‡¦ÈRU±î*YÎBø“³,¡Êgi–ˆXÉÙrsÎVpò× i dáÁ¼¾»¸|'3Š<ÌgwOŠ8Ofwå—àÍOWŸîÞ}ž/”RA"æ‹4Í‚×Wó( Þüí×O¼ÿöㇹ ®®ç ÜðÖ›7wŸçQ|„“_æ_ï~¾xwçØñ–J!3¿]|ùÎJ`üç‹P¨<›=Á:2Ïg› +kež›‹Û‹¿;\|¦güÖ±»[ˆ…ÌEÅçå“$" 'ŸNµP:ñåÇ"Ñ)É' +„ë¢ 7÷ÅP1¥æ×äáZzù6‡çv‰V·î;Ô}ý‡‹² ^61|g´Ä9ïàNgOŒ#iJ;‚wMt‡Õ†ø+ÚáT,*и È1[:›†ØÆ`ÿ²)^nÍ]àÎO%¡¿ÓâÒ™îú…³åÓuáGDŠÜã‰Ë{¸é\r‹…WM˜¦øm(= y^”OLÚHêãÞK0æÎVFeÄúS:–è§J+/kW/ñÃ@àïU4”%ü Y[[]P2Ã,1®É·9ÜŒ°è­êb@^ÚwÑIuBß6ª×S¶€umP FîIÅ,üÿa\¸¹¾åð¹aMŽÄ£²ˆú‰oØ#íÚTM;^ÕLFÅ”&àÑ¡&ÄÍaMª­¯"T$¤.(O\Œü@×™¨Ç&‡Rfï+Ë>ÞQý²©+R!É+w©Ðp: ZJ§:ó­BwKƼZ¿âäÎòÍ=×Ë oR‹ÑæhûŽyáÞÖ\:7Î ›Ë%ˆ¡Pf±i² Ä0ãÒ 9Z,.'0ºþ-øÇÙ¬ŠEñØW¨/k44Ö÷T¿ñºíølŠ/´ÍÊBB-"3ÀÖëÚ•0¥æ \“Ï-Et* ZôÐ?<ö·Å0pÒ§r§tù9¾:&€_Þ"ð•é€‡®y¤þªUªMI»±uÞAÏüÆ…)8è jq"ÍAO+$ôšçÒœs:ÍY —ÒÜ9‚.ÍíS<šæ|Šœæ2½S׃‡HžvÍ0ÓSÒƒ5Yvæ·¡Yìz|½ôz Àikg~ß²ã,ÕCê0³¡ ž]種 ÜÌÕÇŠÓÂä½)V¡—‡Æ»»ÇŸ!öVÆB¨ó‚8#Ö˜ÍSžjëÁBY^lƒˆÃIµd*~/šìR#ÃEOõ-9:‡¦SÖ>Ûì°àœÕ¸¶wxu‚ÊAÅ}÷nÞò³kia Å6”“ê«ii³Cž49Éa]qá‰:¤òqpT……Óû²£°±qI³¬JPY¢ÀO OÖ^ lp’‚Mò]¼^g8µ7 ƒ@²BC òÇá‡f§AÇÞ‹;9Êø>_ÇÏfz„uÍ‘ÖÃ%Í‚v­:K÷,¥©ÍŸÌMûDüQ!„óe¶s&þ ãÏ‚SüÙ£x<þx¯Z“d4v¸ÕØt+Ô6> ë‚:¢hª«µ™¡h†‚›§C ‚ºCïÛöÍŽuh“zÿܨZ0®²qŸÊÇ&lùxh†¶–,3qÐ*|±–DwÐü-m7]oM£§ˆ…d¤( aéÝ®ØecmzRÛO†\«3ç¹Ç¹’SáK1?ŽÐ ÇÆr;v+WôƒÛ¹ä^çn‹@~{Ý„s†gì‹ý€º"njâê”DY"¢†êŒK‘cuìF¯Q‚íÆÓÐXGDqà í{±ÙR|Æ™01„Ìý£á(Î^ú{0'GÃQ”ˆT²·¼§A0)ÒÜ«ýrÝ¥µ-bx*¬v§ÂTÙ¸uO/NºuõM˜†‘/éU^;Í€:»: 55T4šž( Õ8ÖíêÔd:‚H‡úðûCš§æûƒÚûþ ¾? už7K°Û4f‹TÄiâCìÿN1ª¦ ô°ˆÂHä*9ã ”B­½ûŽJÛ¸ðdäaí@QªDÆ3Ð7æ<7û˜›4Šª7öë‚I¢Ü~ES:òR2~0͘I‚`k{lëHï\ýˆP§/?ö<û¹f2õ¦<ì·f9M›?óχë·è²WŸ±Ç¼ûé̼™3õh”>êàŽD7ÿUŒâ˜§Œý›7Ÿç<¬=Ry¡þ‹­.i`J±r‡‰†&KÛæGx¸¼ä>Û+g¶ñ. 4+ñÛce’)Žj55«&•I¢Ž™ÎPÁ›ä÷ñÏ…8©"¥ÑÙ'Ã4Ä*ºFËxÊ!2 ¾¬Hâ÷EóuŽóOÌ"\XšÖNšNWÚBš“{±ìZsÌ`»èÍŒvÍ V¬­os;0ùCÖõ½ðÐW«Ú+ÿöÈ´. ++n¯ðS-Wf:›y’Ò ä8‚wöO °+J¡³Øœÿ —GPÈ4¨ È_Ž € ›ÊĘlž¥¶'Ë‚\ßÜòÖÁd' 3žmE²<°é–­i˜Ã–º¤û¦Úð3·ÙD¢åOp°y¼>&ª™ú?J¢6Lò| Š¡DÄQ¼£¼›j$Í]¤Jxá žÌ­B®3×8‚U¡t2‚ýMU¸QUh¦½¡?;†²®Ñ}Sq=4˜&5`ò܈…fCy9¤ºEZL¯§©]áICe&!6«ýd±ãÑ’ÏÅ(‰w:Ÿ(I0”á6ŽðòÊ=)JRçæº)yw4oM5}²¢ƒSæeJ¨ÍC;ó¸?†#I˜ž3éÑxZ׶;D΋Áü2Ÿ4Ó‚ÐÌ»“¡ÌíÐr¡"hêç)c0J»Ï³}µãså¹Þ‘z„MÑ?›áî» ¼oþ ¤ck뻦ñ¿žl6c¡Õ‰laÌá“-t&òìD²ˆ£T$©¶ÌP½žì3+¨¨A7‡ÿ]SSendstream endobj -4217 0 obj << +4318 0 obj << /Type /Page -/Contents 4218 0 R -/Resources 4216 0 R +/Contents 4319 0 R +/Resources 4317 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4224 0 R ->> endobj -4219 0 obj << -/D [4217 0 R /XYZ 85.039 786.531 null] ->> endobj -398 0 obj << -/D [4217 0 R /XYZ 85.039 726.833 null] ->> endobj -4215 0 obj << -/D [4217 0 R /XYZ 85.039 703.515 null] ->> endobj -402 0 obj << -/D [4217 0 R /XYZ 85.039 649.927 null] +/Parent 4287 0 R >> endobj -4220 0 obj << -/D [4217 0 R /XYZ 85.039 628.934 null] +4320 0 obj << +/D [4318 0 R /XYZ 85.039 786.531 null] >> endobj -406 0 obj << -/D [4217 0 R /XYZ 85.039 556.177 null] +302 0 obj << +/D [4318 0 R /XYZ 85.039 766.606 null] >> endobj -4221 0 obj << -/D [4217 0 R /XYZ 85.039 529.562 null] +4321 0 obj << +/D [4318 0 R /XYZ 85.039 742.055 null] >> endobj -410 0 obj << -/D [4217 0 R /XYZ 85.039 405.903 null] +306 0 obj << +/D [4318 0 R /XYZ 85.039 286.231 null] >> endobj -4222 0 obj << -/D [4217 0 R /XYZ 85.039 384.91 null] +4322 0 obj << +/D [4318 0 R /XYZ 85.039 251.485 null] >> endobj -414 0 obj << -/D [4217 0 R /XYZ 85.039 247.702 null] +4323 0 obj << +/D [4318 0 R /XYZ 273.205 216.485 null] >> endobj -4223 0 obj << -/D [4217 0 R /XYZ 85.039 224.385 null] +4324 0 obj << +/D [4318 0 R /XYZ 85.039 134.663 null] >> endobj -4216 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F35 2880 0 R /F14 2895 0 R >> +4317 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F35 2976 0 R /F38 2997 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4227 0 obj << -/Length 820 +4327 0 obj << +/Length 2867 /Filter /FlateDecode >> stream -xÚ¥UMSÛ0½ûWøh"¬OËÜ€†3´‰rPC<8vj; üûîJrâôÔÉÄÖ®žvß>­,&𣡖$áY˜jE$§a¾ ’ðf¾Ô#&2aÎgÁÉ¥!MH–dáìe'KˆÌT8›?EWgw³é}<áœG)‰'iª£/ßcÝž]sîÛé-Øçñ„FSÜ?\]ßÅϳ›`:ÛQ¤œcúßÁÓsÎêMžépã„Ð, —œHÁ½]Ám,7'B·êXµ‚)ÂRð„h-Žb(e„S’HI”H·’б$”i¢R ÔägBÓÏõQ. °pë0¡ƒæ“ã|<#R˽|³EO˜’ÑÒä1K£ˆ\Öððî•oÖà¨æèQÝônð ^é€3s€Ì éçíÁ9$xĨå»tö£ë‹¥_žïÕ1ÓQß¹ ÐC`òE9¹äãzx¢IÊ(€•œ}~²2]·™;¬R#ìdƒT°Á™kÀ¦…Øm,±\xä}ùDzÕÑ™·›úÔEÛSš˜‹!ñÅ¢°Ò½ÁJ®¢%4ýÈÀ<ÝW¸póµYúÙÜ7W¹¥4z5•óì$£CùpzélcÌ›5è—òÀ:œx¢ã¢1%œ5AET§pʲ,º~‚]d#dB>ïÎÀMé˪ìqc>œRí5'\z¬»8ªkæó# -I$õø²sirSU¶`<è†Ý`™-Íf·ôxÔ­[¯+;ÁG qâ°¥­&4ÕD«CQ@ -¥ >H}´eë½=æû°Q^½§ñ¨Ï¬ü¦vÆöl !¾]»Íö¼†ˆ–h· D° ÈÉ™f$ÓÜKøh%oÿ¡5œzÁ<²ñmöfé%áœɤ“DZ ´Bà„"£DE›²ªp$Ý°a·A‘7ÞS»±Æz³+[GÑ:Wn0hW¸9‚¦5y_´> -ÒxôÆJ„Çßg.w‰\»qkº•É­¼‡ÕîíŒõ%GÀñ;„K"Üòù â¿®—í])4l;þ–,…{A d³ÒŸ K®ácÎ0þ $£Êoendstream +xÚ¥YKsÛF¾ëWð¶`• ã1xí%%‘ŽW‰,k#º6[I J(“ €¢ýïÓ_÷Ì4Iåàr¹8ÓÓ˜éîéÇ×#äÑ?”F®f£$Ý(ôGËÍ•7z¢•÷W¾æ˜h–É€çf~õöç(ùž›yÙh¾²ûdžeñh^üáLÿsý0÷Ûx†¡»ãI’¤ÎÍõ8H鯟„>ûøaì;×·ã‰ïÜ iúñ~þÛ8Hœ´r7þkþËÕ»¹g °†æËÕy£‚ÿåÊsÃ,hì¹~–6W* +ÝH…z¾¾z¼ú¯ÝKÖÔH¾:§{¦n”†§ÊûÑå£ÈUÂÊÏŸKÒ&œŠ”(6ù3ßYäKhöF(·ˆžs€òà[¯…«)A)ˆR5岓ºgš—0ÇÛŸã`pºŸhDÆÁ‡j;gQm‹B˜D‰kÞ}‡#ÖUq¾ÉÙ]-¿û¶4ç–B¹›Aôë™Aº¼Ë¹å«ð-¤¯×ÄðÂzÊzNÚ‘<£I’¤ÉhâÃúKòévÖâö•“oa0ñ„÷–º"bÝõÓ={Ëï2Ë—K>nO[×µî%Ÿñ<×#¯ýgŸ!{E^tÖg<’›Œ˜¾â{ü•GûÈÈ°ïcÃ*R‘¡õ¬X|ßÍ¢×Eá¤ül“÷e$Lu_“¦t.¿×Óp{ ÅF‚G_F¾ë©, …e0fé{­˜ðövãf5‰9Hª· ö•H‡^dnœD£8&áõ­>æ$ê¢.à-“p< ’È#ç­Œ+\w×ïÐÕÁ§ö|eeòùÙ–a¿É/Êwvüõ“à"ù²÷æ4t(ç¨ r>nKa©W²%ù¬Ì»}#sßiÏ0V-û­wä°+¨¶´‹C„P)|À¿|I¬l§ø7rrŽõrZ!=5$GÙߟž±8_«Åq„‚•”f.ì\ã؃Ì9b)þd†3`0~j8¯Ü±7aÐàAÖ¸l,?k!Þ¬±ÁŸ^ä­ .­±†|a1Vú OàÊ"×WñhP‰ ®<øÁ‹*l¾›fêU`› °i@«Ê I£›ª,u醻‹]EN7éLëÍfÌicƉó®¡BzNÓ^@Pf—פð\DÊ*&Ÿ¥¹F5ÊF+¹KL*ý›Ë{å­F¦[ãí¨|²F‡+ÏVu#ƒÇ|ÏYh:¾/õ¶f€êNÆ_]e‰[œ—½šý×&#.rX®?=h•m  ]tÆàãkŽ²Àùµ”ˆ8U¼OÞqÀæà&×]ðkêxª¸ kœ“µðD|~É©âŒï› !ô¥ñëÛóX7³@Õìã)Wß+{™ïøpµÈs>Pç4¤“ +9\îz¹¬÷ÛÎhÇ”ŠCºÝr'ëTˆ+”Ú7²xà `vÌ–¹vÜ[™õO—ôó(ŒÒèuýzž‹Ž&ÔBınñèìM½°.²2UmdRs±æb³Ü3Fó‘ ·2ü{i•+¶9(çt× YC|D ýAŸÐ|µ.µpâë +ç®b\M+DT­åÌõºN±è¡ P¾^S¿ÇRÓO½v±×Õ™3.– ôz 0vÂâî~µƒD "çüLãi-‡Su·´1ùnD7}7°”Ùv#۲׳_AŽfßj‘r1+¹™¨ÆÄ%ø¸nti¡µýŽE/(ºZQ6<Õ{Ë™#Íز=hf’T.éõ™ÐÕú×ô™×[œÈbnbÐ(^››[˜Lž° +œ Ð×ÈT À¼ÏÕ¶ßù´+þ]Þ}YÐTgZÏÊ~^`òbK¯>ðÐ@Ó΀Ë3)Œ½VžÆ™ï<^ +ÎÁx"hÖ±`?y˜uªïls³¢Ÿ Øº;Þ¶ã||t´q/7:6Qz€JLGþ#VPãåÈÝvyÃ84c/Á¯rLyü¬ã§ZP5óÅþR¸è|ܤ=’®¨ š·$Sœð¡\t'7-$ 5Ôìôæî*eÎNÁÛrÎñ»×?¸£´[ƒŠËþ Ó‹fS°¨ëj¥ÿ“ÆÈ>'Ñ‚X¶4‘73<ÚZa•<ñäÕ‰^éòÊ5L p¢õf§‰µsN¦1Æ1ëú‰ sò\[Ï;½=×M¥t—üRšWþj[œ…À{’c€¿rZh¾ àpÃgèb®-A#ÛÊa³¦”T7]Y¸æä q=‚Žýãb:ú¥m¯{SŽ ß‚m[ˆ+—Ö»6È›òœ”,'Cë›ð…’Z‹¸¢”ßë[!Ö€“é Õ‡à|si?øžÙOº‡Îâú€ý *œ‹Åu>LQ°ž(Sy¢ Ãï ×1*s+=Ínfèù=q«Œ\~$ðZÛÔ ^A ˽zÄÐAfÓKØ ï¡‰<«]Ä&ž‹Ø+ð"7ŒÀW Á×T€R H 8 Ì„+ñbÆÙ Qþ¼×ÈËVfZž¢ç¶¯ºkÖ”X8pè×À°û¹’i{ ‰^H¿ÿ mÏs‰ù‰OHSâáU'ØReÙQÉ2!üô‘¥dà :J•@ã™ +(–ä’"ˆ9?ˆ›@b•°­±,ÕóÜT˼Ó{g:{tØS¯[Yz>rT>I',¬~³k¢¯¥ÞÉqωíÛi T›ÅK›cgÿGð•ÎQ,½Q"0”Ä™S%ü­DÑý†=FúlÞ\Aæ´J»1Ì(ʆjgˆ!­/ÄI%ÿ–"bÏëÌA_ ,I™˜¬øæ5ÐÉfZ}-çg™™‡f ƒµ£T+Ö•·_Aƒª}.‹ï‚øQZ@c« ¾ Ï%eŽ1‡hFTð“\i¬ÿˆ‚ÅÁ鶋ÕÇ£…ß6c†å˜Þ€EÃ!ÌU÷, ¶¿ýi> endobj -4228 0 obj << -/D [4226 0 R /XYZ 85.039 786.531 null] +4328 0 obj << +/D [4326 0 R /XYZ 85.039 786.531 null] >> endobj -4225 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R >> +310 0 obj << +/D [4326 0 R /XYZ 85.039 522.931 null] +>> endobj +4329 0 obj << +/D [4326 0 R /XYZ 85.039 487.62 null] +>> endobj +314 0 obj << +/D [4326 0 R /XYZ 85.039 429.586 null] +>> endobj +4330 0 obj << +/D [4326 0 R /XYZ 85.039 394.84 null] +>> endobj +318 0 obj << +/D [4326 0 R /XYZ 85.039 230.737 null] +>> endobj +4331 0 obj << +/D [4326 0 R /XYZ 85.039 195.991 null] +>> endobj +4325 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4231 0 obj << -/Length 3070 +4335 0 obj << +/Length 1645 /Filter /FlateDecode >> stream -xÚ…ZKsÜF¾ûWèHUyh¾{“{×[IÖ)•Ãf-5Ã5‡Ô’œÈú÷ àCó1C*¥Ãt£Ñ/4@ù7ýù7Yìza~“f‰‡þMqzçÝhäïï|åˆâУˆÚ+ƒ;;ºK׋ÒUÝc—‘eó||x÷ásàÝž›$áÍÃÓïnè7Iž»qšÞ<ìÿídîí.Ž=ç~0Í~wW·My» “ŧ_ßéþ,»þö?ÿ|÷éaÜM7³Ë¼užœÇo|Ïͽ|qºX'ržûáÖwìQ¨É§ÉB§Çiˆðçm9c¯Ç°é&ÖŠ§íËçÛ]‚„†'Ì8í~¤‘öÄ<†¦Éw~hÁص5 Ö—;µÊ6K,Ñ”ó¿ÜÒn-3~c‰æžóp,_Yr$Ï/˜ËMGƒky”;ŸoCÏ)Ípîø¸a’BK¹ñ±lJ~V>Ý°åDìªooƳíDâ$tò|N$J½K½±PUßEI>Ù˜~>Mø   “±ËËV5ý5“lJQÎ=Œ™)ûªÌP’³8txTuÑg½å•íÑ®ÕðhøÖžBŸY‰Í>[]ñqÀÐÓeÚÓs]~Ç€š;1ÃŽn qî —íå¤qï¹Eª^öÏÕ dk@¡ó·˜-ç0:RmÏÎóãäq¯o6±X¾±h>õV:b2VZðžbøY†eW)œZå¥çèNtw>u#æcÕjæؾp¤ð358?¥ ‹ùûð^ü;{[m#†Åm1׆ä¡'>¶ÙìDiÅ…Ÿª¶k÷üÁÄþ„Fê{h-Hé õC{1¥/Ø©<]ÊÞû©ìʦЉ’ìÙªâ$v~iw@V4\°·ái/V#`M4¤fYk˜Ú«’æq:ÝÒ™­ ñÇ^œÄPë”–*ï0)¦è^B;=Þù”ƒ!Tâ[; ÕÆ0HíýèFWxR ÆSuÿKÓ¥åÎ,XS“îŽÆÄ¢#r‡9½õ ˜rÂFûråòjFõdÿx_#XГ«XÝ©oè5À[_1ڶѰ۷õù/<Ç]ÓÂg±>gzj8[‡ ê(¸#pM§3£À"†¿ô|—ªÀ"j·Æij …Ã8vc?“cÿRxÑ Ÿ|ßêŒüz úh±ÕŒ9Ð OYT½˜qB<4º€:¨zàWW5øéJØõPþ¥?g<“«æ‚$…æDdÿ„湃×äÏo3e .bÜ0ƒ¾ŒN£A¦ øríy9'JÒ±zº²ô†•ñÚòÄ‚(”0ìY$¨äÜcú­Yš|d›ò@¡$7ÛªòZð]~¶ÎÑÏÚžGšBAÄ^Û¢'aœ`ï8r¾Þf¡s÷3:ì·¾Ší`#î»ÕôAæü¬€ë,e9ÑtutŒýDåÑn¬‹í_ªA!Á¸«­-¬™Üv-ü]UX“°bƵ$lÎ#öÞÂÕž;;C>‡E)›ÇPïÌ1â ×Â"˜ XÚ")YQyMs‰¶ª=ì[ý˜€ ÍHçÎR_õ£™—ôõ­•Cܽo¿B¢ÏøÔÖ4ýX#"5ÌÆcúÑJÅ"Ì&ïÓgH‹Úb—Ï>uÄ°!þNë¯ÚÄ5ª»4àÔÂl¨²¥¢þo,Šêû‡ŸP³:ÇÜÁ]Un(Oà~6}¯ß|÷`\$hÌÂêˆ4>œ§ñ”Y»Qžkÿ¡Š²Ø~%åOR7Mem»•Õva–»Aê/„"‹öG³o_Ö Ü|ÜŸµü=>¸ŸÆi¨ö¢ÜCýk¤Zþø8|± ©ÔZ#Ó¥%íJ7·h0å§yôî+†(¿¡7…è÷ú¨Äïô63·5ƒ”êÿ¬¥Øï}å/â§Øa¢<8¿£Þöx $¬ƒò¡æh½ì_>ßà”êçZ0Û@MÄ;~hâu6Ý쬽V¥ŠÝ( çEªíbÕÈz]«¢´×%×k—c %ùå–1×n²ð=ÿI®¼endstream +xÚ¥WK“›F¾ëWèæQÕŠÃð8¥ö•ØŽ¯rH9>°­¨ YÑ¿O¿ÁJÚR[[‚žîžîo¾îi¼© Þ46Ž«“i‡ŽÑÞ4ÛLÜé3¬ü:ñDc.*óÎÍbòÓ/&œz®“¸Ét±²~×1I8],¿ªÛ·×‹û/³¹ÖZ…ÎlE±º¹žù±ºýí–ß}þ8óÔõ»ÙÜSŸXtûùÓâËÌÔgXù0û¶x?¹_Øp{Zc0ß'_¿¹Ó%þ~â::‰§{xv/I¦›I`´c-ïåäqò»õÅkÁ”­ÎåÞk̽ÄI|ó:>aè„nhññaÕsc†øã„ADø„Nà@†1ÆUoë™vÕ0#µ¬ù÷þ„ªÉ·eºYÚ!P9K»õà¥Ý Þ!ƒè€ôÈ؈‹¡bíÓÆzdj¬y‘*„)¿vMZõê[ºn:Ú"R­ØãZ®ø=ëw:–9nC[vÃVüײ-E˜Y ;„&…xpaZ;‘Œˆ5Uy`Ñ¥2¥!Œ(ô8£U¶ Wñ¾ ¤ë]×÷’ï;l •Ú³8èCSãSîL°JDzµ‰ƒ(e ¬AiÅØe/5H-¥20ÑdÂU¾ç‡®ØPТlAæ|ê&‡ê ÜD蓾>da13£6y·®©€e›¢÷G¬þÛd%QT¢íÈPyQ2ùØú¡Âi,å›…zn.Á6–nKÒ,«wÒgN»Á¾(KÐ3Z=#¢&€Óà>FÏ+^ðý +% U»+Ýté™S¶:½;M@WY#éŠúRÊÏ ß]M‡ …1v†°;å«púé ‹]ó”¯0z‰'* _"õf#ÀC¿$|i÷Y¬%n »‡c¼ðEÃõÃ&u-órQÏAXŸZž™ï œn¾:ß t.®ÆOœÑØÈØzË]"äQµŸ\CEƒªe*,¤ØïJ^¤{±`BHÏ +1Q€¯.ª«‰ôÇÔ 1@Qþ>áÛGKKÃh6ö‚ •P{Ì~<"ʨÆÞ?üôò˜ò”¾‘Õ­ÐË‚¾ÈÊbÀ8°!ýç—Œvà¶>û3ï}ÍÎN1ðcßñýpB‰±¥[Ž6“jâ‚e»µw†¤õDµ> endobj -4232 0 obj << -/D [4230 0 R /XYZ 85.039 786.531 null] ->> endobj -418 0 obj << -/D [4230 0 R /XYZ 85.039 766.606 null] +/Parent 4332 0 R >> endobj -2954 0 obj << -/D [4230 0 R /XYZ 85.039 676.205 null] +4336 0 obj << +/D [4334 0 R /XYZ 85.039 786.531 null] >> endobj -422 0 obj << -/D [4230 0 R /XYZ 85.039 603.448 null] +322 0 obj << +/D [4334 0 R /XYZ 85.039 766.606 null] >> endobj -4233 0 obj << -/D [4230 0 R /XYZ 85.039 576.833 null] +4337 0 obj << +/D [4334 0 R /XYZ 85.039 746.277 null] >> endobj -426 0 obj << -/D [4230 0 R /XYZ 85.039 395.682 null] +326 0 obj << +/D [4334 0 R /XYZ 85.039 555.076 null] >> endobj -4234 0 obj << -/D [4230 0 R /XYZ 85.039 366.278 null] +4338 0 obj << +/D [4334 0 R /XYZ 85.039 522.655 null] >> endobj -4229 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R >> +4333 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4237 0 obj << -/Length 2744 +4341 0 obj << +/Length 2402 /Filter /FlateDecode >> stream -xÚ¥ÛrÛ¶òÝ_¡i_è™ -&^;s|çÒiÛi'“æi™ E*$eGö€L)‡¸,»‹½KÎ|ø“³4¾ÊfI‹HÉÙr}æÏV°óæLjˆ¹™;0ÿ½?»x‡3é‹ÌÏf÷Oæ‹(‹g÷ÅgïêíåÍýõíù\)å¥â|ž$©ww.½ûóTy—ï_Í/ÿðþš÷ï®aãö\Jéýy}{wþåþ·³ë{K„C¦T -Iøvöù‹?+€ÜßÎ|¡²tö c_È,›­ÏÂH‰(Tz^ŸÝýÏââ½pƧ¦86s™‰,ˆNK%ŽEìÇV*ì†B…1JEÊ@(Ì’(q˜XR¡@Q˜y×ßóõ¦¾KAœxWmó·/Ãնˇó¹ô*Øj›c¢ˆ‘FéiÚF¢MF΋YÚ”Am÷@J†ÞC[#aíyxÏUÃo”HØw˜çkm`T—=îE^Þ1/8.x(½¾Z5eÁ‡‡¿Ê«š~S9À}r@n—Äöp¤ÞB¿ø|Õ»x¼V“”÷xlǸ½šCiIÔçs”%ˆh.ñ}3bùï]= Ê« ÕOHBYójû€ßÀ[ve>TO†>ZË›‚x/~AX°;tHFâÛeÉHFšj‚ÝÇ0xÔøñæÖªȹ"Úbg‘Ó·§íŽ©ì(iJ"ðϵ(å¯l%>Œ8¢\1ØYzÚŒ Ví¥È¢ÈU­8 E–†£ÚKO¢îG¾w[>”]Ù,µê¿"Öaì{ËíºltÛðÞ]Ù=“G(ÕWœ$u„9nqV›²p´!¢b-‚N"1¨^¨ A -Òæ)hD1o|1­ÁëmRÌr|'RÐGÜxrý'û=~"_ˆ¸IòF_´¤iI¨zm?úËxIFÀ˜FËOÿN7%Ú€w-†«’wzDÏVC{à›ëªÑˆ€Ý²ÌÊDÈ4>|᧜ü î1ˆ¼7u»Èkoò._—€bJÁ?¯ò m>¹·ÿÜv_W]»Ý0®ÿðçOon?|¼™ÀÁcQµ=ƒ59*‡sîöúõ«Wwî9{_.·]5ìö ïÞ^Þ^OÜZ,f‘/¿–¹œs«mÙç Ñ„õÜC2 „ŒS!…¤£s#Œ >äy$,T€—¢b–íÏÒW?Éè¯ wQ~߀[˜e^Âľ|>•ý”VJ„Q¸§ï(ŒÎ1HS/7¶ ªi®—”U–怣̗÷Hùœ†nl*§9¶¤ âA£hù{‹@­X¤÷ËÁNÂwŽ1ÈA©£K9èça†÷|¹xô¤2Ù§7)#·£jíhÑ\pþŒ<’Ö£FÅÇÕÞÅÍ+q¬sÎÃÐ`½QMcÌ7†È5;^#HˆÚ€4é<ÔýšýçK­ÇØõ¹ñšáb¸ª+¾)~t)0<’ïN9K'YF!šÂiæ ^]0[_I;½Ø•ß¶ìêM„Ū?ÈO¤¸?ñäÏKóGé†ìXUèóKâœo¼bëâs[|`‹ï¼¡ óTÙüwE¶sŠJËÀ‚Ì«†Q¡Ô×ú[FÉ‹[óeò‹Á¹"ûcîÔhš­fЄ“¤PÚh€ìL<å_ïÞßé°`ƒ›—Ñ¥²JI†ŽÆ°iÒuR[$[*y\èBÑ”âÓp,oW‘<]°:0Ç3wå'"Š7stæ~N²#c‹c嶺Ðeš4½jVÇ(ó#„ê4e#Ìñ<=€º#KÔ©<]¥”}qÖšr•j%¨ÆŠ’ëMÇvŒI¯{ÄT¿€8Ép1*Ò–ÞÙÑ‹nù0)>ªA‹¹É›alŒ» - -RC“´¥cÝ¿´<£Yæ2«r6÷¡äDgIàJô¥¾/‚Cù äPq]2ê=|Yû"¡JÅ“Ok`æÐÄÛ؉-&$E¾Ðq©B!Õéëä·©LDi´w»T°-tõ]eÝ fx¦~sì™J¤m?ðŒ=é7”œ©ȾÝTìì†ÊÚc‚ 2‘@Ä?-Èè„ 5²ä©ëŒ OÞféÜÆ‚Ì¢CAÂJ¿±]ÈjÓU­Çèë3xÝ:qË^ô+´ é¶ ­xÔÖ­æ‚=£Î¢—OPcÑ -cÀ€ÉÕÇLo¦Jç¿ýÈ¿¡ÂšÒ)ã©NÝÏÿ1ˆ=™&><ŽŒE ¨+Ç[Ýjƃ[ç ôÜù‡8É+"ýDÄyƒ”Jß ïŒ~^ÆÒ¥é….˜Ó”(&Y²G‰nn¤6ƒÐCkl¨íʱÞj¨6_“€˜'ÌßX‰ˆ8Í~`%#Ð +Ñ@Hª:j%§®3Vrò6c%Îm—”Zféž®rJ˜e¦¢ÆÕù<æìhTëìh¬¼:y% ËKÃæ’f×Qüì qøÕP8^ BC&f¾›¬Ð¸£ÄðÀ˶3Ý)ãU'z›\¨à‚Qè6ˆ6'.ÈKkr¦TmhðÊͱ4ôh -Ü#z"ÿÜ6n3Ƙú”®É$ÑTm„9®iES´Swi=;y•V3ç*Ò² ÊÆ5• XÉ ³ØßW \°¯ļÑôC^×ÔLJm›RÛ_`Q7Çø‚~iT³Ú LDÑí§Ý¤KaàëÃ讨[ -kÔo…ÓÖ•´† í3‰µµ_RíVëTúŠÒþecŒæ¿ƒ#ïþÂ,lš5€;*éi—F•xŒ™|(§ä†vÛñÀe‡WŽ,nÙp„øúÓ¶kk† iÀ?˜ÖìÚ>œÚ¸ùO»è5¹íT¯M†xKÓk{Ê»‹~Ó¶õEŸ¯ùdÃ-Eî—²|a…vï‡ÚPaðöq`ê'?¢nùNõüýì÷Ûź†Ñh¸`ÇwÜ€# ¢ÑòýÈX¾¯Ó:Ãh;*®CïnqŸ:Îà–íÚØ ¥'‰.­ÛǵÎu³wÌ7·@MtÑœøN -Þ¦%Šwëv«·1÷XmíÏjIݶn‡¾0ÉÜŠÒÁ ñ_ãÒ~:æNrŠ}<ԕů?¨¸¹nòEÍ^Ä‘z—ÀÅΚ‘”³†Ði£)#ªÉšþ™ÒõK°­<ÃTdi0íX£ qbÓÄ?$Üx_5AñÿUð endstream +xÚ…YYÛ8~ϯèGˆÕ’¨s_ÉÎfLÒ ´`vY¶5­– IîNþýÔEŠ²ebŠU¬*ëøÈïøÞ剨â.ËS?Qá]ùò.¸ÛåŸïBáˆå'q ãâÚP×iäq¶È#:ÖYûq#ÏÇÍ»ûOQp~šª»ÍÎ’‚!A”ßm¶x™¿Z'IàýÚ½èzzíj­ÒÌû\½ÀÇ7ø½ªõqõÿÍÞýcc5ZY`SÞ´Éá!›Âä. ü"(\›Tâ'IF6‘-`HdH”¡%ð¿XB4v€¡ +<Í3ðz'6;I¼?«'F&v;þ}Åu£nø‹8º¦hTõ8|4ðÈ“͹÷M¤“'Vj¥ŠYbÆ·Èò1vÌqÔ=*¬Ëú¨ÇŠçôÜîR=Û&:|¸ñà rÊP![ÿŠ6ðe9)ËI|~®Ë¾ºÝȳ¿‚â‰7ƒ…”§ž¼€¢~0o N€¯‘èß‘ˆ^ÈÁVôÈ–™ž`¨ÅΕæ ~Éx9¹eëãäšLŽ˜Ž0Õw¨öµÞ¸n÷Žáä4üÒ/ºD¥ŠWªÐ ²œOŒ•÷Hȼ±wÃMg]v'Þò;Uyîuã¡êßêAÖ#ÿ¾!SwjØ 8ƒé„j@m¿q£¨°û_*Ž¯™úZÏǺ[Úõ®Ã)ÛoåäðËî’Ã7Ë¢Ì +^¶9Ôæt!«ú8’kR‰y>€‹Cþoìæg´¸Go±€BŽß¡úMæ’¼£8~Ô´M:OœÇ\Àe[Ékœ[8/ÊmJ?•—ÁÆ[0ù +.÷ë7pƨ(ñØL×Õ +Dš¨ÆÉÏOø{_ëv»¼¡žé¤³©ù„°@bÐ0I"Í/‰ˆÈ€Ê +HgüÙ‘ïlY3e; úЃºÇ‘÷†sܸ:ÐÃòÑlÅ0èþÇ/ ¾ùÈLúDAâzfT3”½`€u +‡tf@{£ŒãÜ㲂ã¦â. µM9ñV³Áí|’JS¶û¾²Î:øýJÛò¹ˆ8»á‘O 7Ñ?[¯¢Bžk¶ nÐ-½ÊéütÅùÔP™n(§¸·´<´–Âø¿_þýûýo5yúÎ"Úʘá!‡Þd…*&MzûÂ9!…vkbT¹«›í{YÉ?SÀÓB4l[õP0ĤÆ8‚3¸YØ-V¡8ˆ¼Ö½&;v6s)áâ(àM—œ‚雸ŠÓ’sÔ­iäeoÈ¢ù§1傾ŒÖçv–SÖ^”µ§zšDÞ¿º#×ÒÆBƒGëǃÄR( =Ç6ΛdB[}«›†«"–ßPÚq³›(·\- Mœ+?Ò›Æá10+Œ}§¤‰“ȶ1Ì +hÅ…÷i¿Òã©·5"M%Px}¬ÚŠŒçä¹b¡H¾iáÄstÅ`s+²Ò JìWŠ'ÝÒØ&ÄŒÄìÈt A'DE¯ë‘G$@ÛìFZÇ¿çøç¸G¨YI4ÐT-c$´•DYd(²#¶ˆH +5Î"ZlLX‹?Ò.Ä^“Ž`¶Éxeĸ"­Å˜?u!³`Ø"Æ|Á n™Pꦩ¨tÝJrçà Âü(Ka'¸ƒ'ÈFª¾Oõ¾åÑCË g'ž)?ƒ“æuØа'l²ä,Ò 7q@³]?büZá lp:¤ØV e_[ddñ„-¥0>RÛÌvç\7Ñ%¸D\"5צél®¶sÐñ¢ŸW†]1ŽÝrÍ’5–d2T$ঽÔ<¸] +ZâœE?§ÆšccÆ””6¼Žs.¦&oÑGfÓîË&ÆAâÝówß—‚¹!st¢\óφŠÒÒM„åî¬á—¡]@‘]Ú”Ü9š‡)S-¦Æo“Å\^Eæ°–ï­öv¶V|]+Ñ©X€X223h þž# \F>ÆÁ0¢Ñ?°iT®](¸f—ó{’Þ¾®’Ô4!½¯†¿]é®QùQ¨nvW‡‡ºk:µ6 BàŠ„æCOÏÎõ…AêçPÞo)4<gÕ= #_…ÑLãbZ:W5õu[`!V„7ùj9Ì®„°`_™:L Ê@c[滊†FöÃ5g«ÄÃÛPÆá¹álaú©³o(œœ}¦qÙÙŽFIâÞÈyB—ÒæЋƒ„\ö~}R00ÀµâO®¤6K0ÌWtÑFâý™xs²Ibï а1ÙÜYj>Iì<]€Iƒ=Ø„¯Ì=&/~0t†½€æ¸lÖ_Þ?|æ16Ó§jÂke$>”ö †'°êVïmÔIcÒVšz;v’<ïä* øª ôü¢Á’åú„ùóÚ°Ôøݤ©Ìe¦‘Š:p¬¿'‘ JMYȽç¼9.#k L0¥÷S¦mguÐí7N®Šë–S.Ì!”ÃüfÊ9<×SÎ0ý,ån)´)w®q1å\­ÜØÉšîYD—]æ¾lÐ'Øé‹ÓçMáH&~dú#:±ÛI>Á©Ðkq±ˆ¹\Š¾ï '½¢È5À ÁkŒËæNpÆa<øË—žÇ(ìö¦fïtY75¡ÙÊ↥ ˆ¸HÜŽËr#˜ç§p]ÛsuËç?©3å&ÎþRb#m1Ãâ,žŠaœELÇ%N>£‘SNÐÅyÄ Åã¡ïN\Ò‰Õ4FÔ25¦Ñ»üÒ]²kêò;uÿ ìIùÁb÷eJ8÷þãÃoR Þ˜M^,äyìŽ<ñH}®âÚëGQøiÝ Œ‰åz`ÏÏã†6gêÃQ·9Pþžö~\s_ðÜÓÀo†(™×˜ʽ¡4u´>òßpÝ*L~æÎ>ö¦…6öÚ>Ýñ[ãô‰‚¥ûf+ï¼+.cYwDaM½ôü]R”¡iÁbôG)òçj,"©´‘êê}åZ%«x½8ëåI*8n@"Fî%-ÎU&*÷“\ÝÐùpöÞendstream endobj -4236 0 obj << +4340 0 obj << /Type /Page -/Contents 4237 0 R -/Resources 4235 0 R +/Contents 4341 0 R +/Resources 4339 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4224 0 R -/Annots [ 4244 0 R ] ->> endobj -4244 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [233.71 212.514 308.157 225.416] -/Subtype /Link -/A << /S /GoTo /D (CUPS-printing) >> ->> endobj -4238 0 obj << -/D [4236 0 R /XYZ 85.039 786.531 null] ->> endobj -430 0 obj << -/D [4236 0 R /XYZ 85.039 766.606 null] ->> endobj -4239 0 obj << -/D [4236 0 R /XYZ 85.039 742.055 null] ->> endobj -434 0 obj << -/D [4236 0 R /XYZ 85.039 686.81 null] ->> endobj -4240 0 obj << -/D [4236 0 R /XYZ 85.039 667.938 null] ->> endobj -438 0 obj << -/D [4236 0 R /XYZ 85.039 321.515 null] +/Parent 4332 0 R >> endobj -4241 0 obj << -/D [4236 0 R /XYZ 85.039 298.197 null] +4342 0 obj << +/D [4340 0 R /XYZ 85.039 786.531 null] >> endobj -4242 0 obj << -/D [4236 0 R /XYZ 85.039 256.885 null] +330 0 obj << +/D [4340 0 R /XYZ 85.039 766.606 null] >> endobj -4243 0 obj << -/D [4236 0 R /XYZ 85.039 241.215 null] +3023 0 obj << +/D [4340 0 R /XYZ 85.039 658.638 null] >> endobj -4245 0 obj << -/D [4236 0 R /XYZ 85.039 213.511 null] +334 0 obj << +/D [4340 0 R /XYZ 85.039 483.626 null] >> endobj -4246 0 obj << -/D [4236 0 R /XYZ 85.039 187.018 null] +4343 0 obj << +/D [4340 0 R /XYZ 85.039 441.341 null] >> endobj -4235 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R >> +4339 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4249 0 obj << -/Length 1504 -/Filter /FlateDecode ->> -stream -xÚ¥WÝoÛ6÷_!t{1˜EêkÀ²ÎmWtm渊´²¥8B,Ñ•è¸öÇïŽG)R¬dÆ 摼oGqǃ?îÄóDâDqÈÁM9ñœ-켞pË1³,³ϯ«ÉüU(î±ÄKœÕM§'ñX„Î*»v_¾¹¸\-–Ó™ÂÙtE±{5åîj ÷âýo³‹wÞ/hÿjË)çÜý´X^M¿®ÞN«Î‰ž›\táÛäú«çdàîÛ‰ÇD;G =Æ“Ä)'2,ÂÎw“«ÉŸ.Ú“IE,ýùÂcq,Gy8÷™à>¤%X(£.-¼ŸîÇ,ŒB§e¼|ñxô8>.$æôt$–s{AßžHX{«Û|:“^à~¬ -Hò÷ù»¢šú±{À í4§FwKš—f¿Ñ4»Mqz?VSŠþÏ_aßt,™ õŒÑí!qÃ5pPæ‹À2¥› Uè‰qIC•„A.ʱº‘ܽ"=ìà×úu£j$¤«o1°†V‹Í:3ŸG * ǃ‡æ¢‚Ý ªŽ ̉H#u7W„—,‚Š'Ç+µ9ßUæ7;*=E¾å‡°¤ˆ±ð¥‘á«@bØNýÖ >ÔuñF“wUZÚ]­hå@ñ>œ›T qÂ4š„Ú…öØpÁʪ¢q7:¤HÝØ ‰Ù†:ˆÜuJ+xh^`ÂÉE¤o”ɨB;G£ÃÚþL9ýœxæFy1ÕåÓYஆBÙ§uI³YcÇ{ÿ¢a[ç{¢^PeêNL¿Ik*n¯@G C·LïÚ:†™I‡I–Yˆàä9”»¦]eÑФ_!±k9òïE£-Ca- NÀé_.˜ïÓÆØ=Æ:ÃÕÀÍR®1çöXñ€¼ÁÉ|ño$©’ù²­³y®7sÔÌFr -Ëš8;ƒ h¡ä~áó ×czôZ¦½g ZÐ;³7z}{ôDðQ˜ã5§§Þmö ©¨aáx[lpé–¦½ €”å)v;¢¨GØYØÔFøÐøt#RW+¥ Ä(ï²¢&r~ŸÖóf¯ÔnÞ¤å:ñ£'¸¹UÇŠH• ÿMW©2‹`?ÕGýŒŽÄä%ø$,TÚVËëZC334à'´׃l†ýzk¿šè‰<æÇŽª¾ÛÖê`ñõþøüzùáãåH U®×…²0M©'w¹Z^}Zò¹&ß ÌOö«7ËÅ3bX¶&žuº¹Ë«l ×=/†±BýZÇš¼¾Ïë O|ÆØqÆmnm2L©P£¸Þ×E…y|2]¸y¥š/vö.­ôhDp!úBÏÕ Ec}±•’•E5P€5b¨×ÕÝ@às>êZK–ÿ[Þ¢ÚX7‡ý7»¢KXVå‘% -}]«c“Ÿyõ^=ñaà‡ÐÂäÙï—é!>ìJ&dhzˆíl>tÆö¢ÅL"fÊÄ}‰0¨U!hEÕ ”zÌ«åYwxFZZëÔ¦_ ]Kó‰¡TwH+ea°Pw\lêFãëÇð¥™ÝDµe"”4Àu§—6;Äú;Z§î€mi>uªñi Û‚ôƮ՗Ù÷øP4ŽŠÍïšà}oZÀ©±ÏMeA¿ÉÏߟMÑÓMi îFíºhM`{Jí–í`@•Æ\·ViÕöÒÜ4=ØjßÅK©H¶{F°'ŠALÒ7ëãZ€ -ý}Ïv%c–ÄþxAPHa$[g0×ìp bxH‰ÿ‹´éóendstream +4346 0 obj << +/Length 3094 +/Filter /FlateDecode +>> +stream +xÚ¥ZKsÛ8¾ûW¨æDUÅ4ß½9qf“©Øã•Jªfæ‹´Å EjH*Ž÷×o¿‚e¦R1ÁF 4º?t7å/<øç/²ØõÂ|‘f‰‡þb½=óÐóï3_8Î…åÜây»:»ø5N¾çæ^¾X=˜yrÏód±*þpÞ}¸¼]½ÿ¼<ÃÐIÝåyšfÎÕïKß¹¾üxÃäë÷×ðþvyî;ï¡ñùîÃÇÛå_«ßÎޯ̬%úaˆâÿ>ûã/oQÀR;óÜ0ÏOÐö\?ÏÛ³(Ý8 +å½>»;û™‹û¢šÛ­æ8=7Ë¢—5Çn¥F#‘oiÄ÷|7òÂ…fB•üéùéáö|/q³8[X“ ÔžMN[«}‘8ÆcÇÈÃMñ³iå©yÊ ž3HÇ·‹ ¡mcÏd#È¢Ö´“;˜W&oe„"ê󤉣摑æ©QçÄ¡5€]­ëËî’͆Þ݇9ho`IǺ (:^Jn¬-%ã<ªfúUKêWí†H…Ô=²ð¶™ø§{´d6|ª©s³Š.îÔ§½WLº»¼ÆFÂZ£m?×¥‘Š…=„±‡c‘ +0Sêe4'w„¶F$¿çæ=ØÌþßʦк.Ož*Ò¿Fàùé +Ç\Þò[QuzÐŒþy™E¨bìÂ#ÀçJMg¸\óÆ@úlPþÕáTÄL>õÐ)ð*43tß• Rÿ¼%yìf o'ñÆâ!ï 7rAñ'IêziFZLÝ`tê\ßÁÚ’ÔùJ‡^´ËÐsžz¡-C8 ¤€•‚¦rî‹;#°ÁÞÉíwíˆm]“ ˱ŽØšR$v¥6Ùj ;æ™éxwµsNsš¡±°ïõ’¬¨µ1àþ”¥€UÙ¼‚aH²iMÖh{»ôöZåmÇ>ÆäÊ,þÒb'f„9ÎLä"i û…¬'%ÅOÝÖ8‡¬ãD,í_'’€0 ÜÐ{9ϱxN×U4Óku•—šºÊ¡ÄÙºŠ-ñ“õì0—FÒÝ\@„—3ŠF:†ö| ­ ]ØeMKÎê{fñ¥‘tÏVù)›J¢‚Ý„“‘—ëÛ@nêtåE˜ì¤7ÇŽoÜÈ‹œ^®ßqatI/À£ˆê¬bnP™í­«^hÂ+ù´:\æàö1Äy:¿n»­.BéÒ =? d f(ÄÓ¹dÐóÚ楽…Žo§+QH¢e‚©›J„vÔfiªÇåš ö¥Ä¹øê +£Ã#¡ ‡œ¶íͬs0š=‡r¬‚‹3¹¨…Û´Ò(—” [¸.nF¨è1(0*Ù)R1Žî †<Ñ%—±éÛRÑ))%÷~¹¡Äñ¿ÕíãlñçãÅX¡¤I€á0î“LZKoU1 š*Êvýˆ¢#‡®¤/$õJRá7ܧäÀ&‚>õšŠY(<4nVÜ`÷¼£T´`Ê4›ÄR_ÑS¸˜áu31)érdU÷-·zÎäPI©?ú¨ïÈÚ1un¸õtäxrš©oyô|—Ü.D(MÒß”ä')WEñ ç¸6GÈÕñù×|/õ,ìD²‰û?m¼˜GOî–È +rŸ¬(Å,3%ÊäÐ?Ùà0Ïî„ðC¡ZjA6XÍůù¼ç™›ú¬×Vj‡9"ñM®0s£4¶73Á]êi†âþÄ,¡ë§‰p¡¡dó¶¥ ëCk–Þ6}Ž­îk L€¸mÅ¢`Ç©xñDß #Ô®sE8+Âm]Œ•ò±`{ÂçSGn]Ê-ÈÝhͱ>CÑ;f’C'’µÉê Šü²•ZsÙÐ9Öãy¥ö±Ó;x¹T›g¢“#‡2z[KBV<¢+¿Xu:÷Dp@<à'/'ÏéàD3½œ¼$Ð'‡gƒ["Ƙ)ZPg®Ý^]=]ˆ@&†Ö0M¿2íbÀ¿«Öª®Ÿ™w&^A2¤ºå@“]LŒ +kÑ_1*çoQibŠûؔѻ®}.p¤3µNn".²å'rÈÕvG©=]wl%›(ù•.H|ZÂ5VAZE*¤˜´7 F…¶Yîߘ è,{D¿‰o]]´Öãe*à‰TóÒò«~6 AÌ”ï f•ð +%‘ ¼´-+‚±RuµLוu) ÛO˜œåØ[9 Kg°å«,Žu6Ÿ°Ùpž ˜Â%xŠPsyçQ+Ô!Ÿ÷aŠp`yÖd‚ô{]«Æp|ÉÕZ‰µg}àQøÊï#4Ë ?`žW pZÚøS€©¸ù_Œâ¾ôUó(_Ä°•šSq¨l…Lwö÷uûã4 ½&cQTR*…6~;6Á,Ndl‘¾ðÈ#fü•9ÛrŒLÓ¦Ÿ£âs@vXâ”ÕìõÞ³±j‚9t1ßÇÀÞjüŠOBXûc‰v[á•Y9³{æëjݵ}û 3ŒÁì=újÐþ„_ÓVæ£:ĤŽ^×JÔa¤v{¡jù'*-±ÍP†ÿ¬¤ô[cøQææÙ‰O¶1\IéÅÐWiïpÁ1„ÖqάøÿðZÜendstream endobj -4248 0 obj << +4345 0 obj << /Type /Page -/Contents 4249 0 R -/Resources 4247 0 R +/Contents 4346 0 R +/Resources 4344 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4224 0 R +/Parent 4332 0 R >> endobj -4250 0 obj << -/D [4248 0 R /XYZ 85.039 786.531 null] +4347 0 obj << +/D [4345 0 R /XYZ 85.039 786.531 null] >> endobj -442 0 obj << -/D [4248 0 R /XYZ 85.039 269.569 null] +338 0 obj << +/D [4345 0 R /XYZ 85.039 695.833 null] >> endobj -4251 0 obj << -/D [4248 0 R /XYZ 85.039 240.833 null] +4177 0 obj << +/D [4345 0 R /XYZ 85.039 652.689 null] >> endobj -4247 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R >> +4344 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4254 0 obj << -/Length 439 +4350 0 obj << +/Length 2231 /Filter /FlateDecode >> stream -xÚ}RMÓ0½÷Wøhb<ÄW¬@b/DâÂ&ÝDÛ&Uן±ãP -mU)Ï›™÷æÙÀý€ÕV* Ì×NZö´ß(öLÈÃJ…±(­1_«­œ–Êø«5…£òÚHS›Tó¶Ù¼ù ÓJ:‡¬Ù2-4s!Hë=kºo‘ÈŠ”å2éÃiìú”ß¼oþìPVpÞHç¯Ú”† Dw-p¤õ߀‘hÜ…Hƒœ+@2Áþ˜´Ïñ¦´Òt—ý\“ÙÁ2P´x¸`WA*ÀÌÞ #y«ƒçOB×|h‘\ì“’cÊ;ÞÝL"©[Š÷íK*ï—ÓX²ã$tàq^Nq †uú±ßå¡íkþ£ jþ1.£×ªÃ®M,S_(·s‡Bu øôsW&Vµ¥#ñ´é×›‡ô~CÞvÞÒSAF/üéEzʤ‹8‰¼ÐèE^Ÿ©Å-œüëL „+ îæõÍÙê]-´òR•.n>tRå…i´¸Ùüê¼ùþÕO7o^ºÆ'ö–n'Îw—Úyÿêêo¿û¾_/]í¼…ÅÏ×ß_ý´üý懳·7#µ1xýŸg¿þ®`õ‡3å™4Y<ÀZy:MõY/ Œ|Wg×gÿiñY°`¬9iC“xabNÅÕáD\­}Ïh‡¡1É›5K?qžD°küõ_Êf‚µxô€bö|^ã:Ëqû®l¢Àýš`ªnù ÄáN wKÍÐEÇ'eÏÞw{[àÙ†€ýžÉ9⥄ESöC— ­Ìòœ¸Á›H¶Á{Î6>(-H¿ì>{Òg §úTÚ ” ¡>S:>¾O«ÈKÂä‹Z˜“ç-8¹ñü#*ÜE¡‡;¶ |!|ªJƒÃP9ï³ØÖ¢Èyƒ•”m"PÑ'þÅŸåwäîø}³LA™»~`¤Wäꨴ¡N ¹þ‹bìaN£ÝÒñˆv2pà‡˜g´î~`cQÜgË›à»ô[s¦ßÖA*dËR6ndüsï°7 7‘üx’fy¿äœ@­%öÜÍ–²*o»1¸§ÞONœ8T`6–k(‰Öa5ÇîS¡àåªfµE “Îúˆ#7‚è¼¹£‚`y&ð{ç‡MkË^šî‹Q¿E†Wï"bAãkOƒ—*âÿs¹]Bu}`ÀS¨û~$p3i áÒî3ºì]d› ¯v}Ñ]’\jÏO‚ƒ\™·r |„GM )L™b¤„_”¦íjÎÉTmh#NË`ÖZ„R<ðB´«S­“Z0c¾$%ûÔV·±ó0Úo ©ЋǬÞV‹Xœ©g–Kv/{ä µ [HŠšüd»Ï¸Wt—l3µÜ/2Üvm;|‰\tµë»U¿.›ꟌÛî-ÿj¥dCV›âóªÙà¼óïyms ~5e~ßduqΟ¿i¼:ötâOCÀí…,rð)«z¡ äþ@*/Ø),²{*MŽåØf=x½0U=CäÈI•òQÚ³o__'j}:Ì@5}¾´Ý›Aª!Y3SYöÁ…b?–) ‚Óðò}߃¼!a“cpÝ¡`s–xqjq‡,–•Tê9û»~!å‘8>V_Î÷°ú²c³A[öšúêùn/¿½„ÞþÕ奂¿_Ú[ârt¡Kv¼¦­ÚÛ²9Ÿ‘ÒµWOìDáç§Y'_‘í%ÊýÔgcQiº'†}(Ñcñ°*1åãÞ` Ùê@iOöS\€ +ö"ÔŒÎ_œó"Ûr=N±A·P +’!µ%@éB®¹ËÐ*›‚Ç?¬q(P:ìd^ž æܨøˆQ e 8ó……ì' ð~7£:#(­Ðlk¡µ)Çæ*‡áCP|ä¼Ã5%q3ÉGÌH5We¸àÙ© +ŽY¥ÂBä\lZDÞ’Ï^0*kDF)Éã®È=“6%ôæë ŸYH(˜;éåªòÞ*O Z~={ßÛ§——¡ +ÉçGï–´7õð}^ûZþyŹ£Ý K™&9n^Ž‡1ìPé…(/†šùÕÉÜx~> endobj -4255 0 obj << -/D [4253 0 R /XYZ 85.039 786.531 null] +/Parent 4332 0 R >> endobj -446 0 obj << -/D [4253 0 R /XYZ 85.039 766.606 null] ->> endobj -2955 0 obj << -/D [4253 0 R /XYZ 85.039 651.298 null] +4351 0 obj << +/D [4349 0 R /XYZ 85.039 786.531 null] >> endobj -450 0 obj << -/D [4253 0 R /XYZ 85.039 651.298 null] +342 0 obj << +/D [4349 0 R /XYZ 85.039 683.458 null] >> endobj -4256 0 obj << -/D [4253 0 R /XYZ 85.039 622.563 null] +4352 0 obj << +/D [4349 0 R /XYZ 85.039 651.643 null] >> endobj -4252 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R >> +4348 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F62 4047 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4259 0 obj << -/Length 248 -/Filter /FlateDecode ->> -stream -xÚuP»N1ìï+¶ô^v½»~”€AEqPD¹Qp‘¢À÷cÑ è%ÛòŒgv†êbȆ$RŽh°~ﶹëxf¨ šj½/€þõA2Í‹¤ÙÄ›&´,s5t· Æ(0¼BH‚… ,DLÊ0ŒOî±v«^Èí½—˜Ü}=踳ÃþexøQRL95%_2†Tý´`fùVº?WSïÙ­ë§M»ŒM0ºëÝôL¬Ûö¶_Þ*¾›šjw3#Ì 4&,1,…¤j'-”¿è¿Uˆ¡Ê©‰š› •6¿PD±3§Ÿä|"«}·.OBçž_p`c‡endstream +4356 0 obj << +/Length 2975 +/Filter /FlateDecode +>> +stream +xÚ¥Ûrã¶õÝ_¡>•š‰`‚ xI¦ÓÙ¬7Óxw»vºé$y %ZbV½$µ¶ÿ¾ç’(¥ŒÇ&œû  õ$„=ɬ +M>I³DY£'óÍE8YÂÊ?.´@Ìd6€ùöîâò;›Lt¨ò0ŸÜ=xI r`uûCÍ~=3i.º„Àž¯«rÛñ¸«åé z¨'ÞÆÛ€Çq`®˜&IЕëi’/‡Ês,èXEàÓÀæä3h&×19þ Ƥ’^U4qy½1“«dŸ Ä´³^›l6Qª³“$ˆoÝè´»þ¬×/àI 4Ηq©#OÁµàÙn…`97” Ñ5»¶à9:’¼ì8,%‹ºn~O#¹nU“.xÒ-’îq@@Ÿ‘ãê ñLˆ°£ð ÷‡cÔž× +|$ª+Ioô.RàЋ)Âà®z»·ûcEñTcÌM±N.e’6e×,PÐ{Fkï'¦ÛS hþ}÷îÝ·ÔdË¡ñgÐþ=oÉÂDHÛö &øHBâˆÈ>—ÄåÄò5Ùˆ‡ýaÆE³,;ÓI á½])ée° +¼HZÔ<²c~‘4J#¥£TX½¥|}³,IÄò¹‘-IUù‚7`â?F:‹Uy²0¢LÑÜ,§Áè3el&è mÈ9¹î$SàÀ×sdl$oË9Mª¹PËïµÔ |~¤8;n¡`hô€Tí"ØÒî°mk³ι­ëµêÝzÁSBf»® ™‘¶oÏÄ[•¦éX'©8Šùâ᜼aí䫦yÊ ä=–Š5`tªr¼×èóÁÿ&.œ)ÃCq£4ÕÁµzóˆš&ƒ¼üXø¯9k&'Y’ Sš«Ôî·f}š”.jîÕ4â>¹JrwFz÷Ïntê{'<É&x1€9íIƒ´âÓžt†ZïIçÈyOÐ{µô.­q2iå>iQÝXË‘u,qÁaÑÆÿ_â‚ó¸ÊóóÚô §•É HÖžÖåiR½*ÏÐòšì‰ÝžS‡ÑÊú»/æ®»$,°Hž¼ìÒ¡VY~þ“úæ´zINëç µ^AçÈy è]Ó…P:¸Î3lE×6õ’_åbƒöù+牻ëu½Ý'ÆQ{\%š‚ÎsµÃƒ®Öy(Z9¶K¤¡ó·éža4_y±™©§p\œá§Tº|%:úH*0®kiܵXôAÕ >4AbÓ*ÉòÑÄFÁH $¥µþ;Ìoý‰ÓÝ8 Ï£¿†:ï5wyøO½‹’>½ >]¤RNüÑ}D£I¤@ðFƒ…>Íäž ýN%ZH&1ÿ¯Æ¡7Â/«éOý‡ Â9;ÑèYhŸ“4vÌнytÈ°ûcŽÿ G»>Çendstream endobj -4258 0 obj << +4355 0 obj << /Type /Page -/Contents 4259 0 R -/Resources 4257 0 R +/Contents 4356 0 R +/Resources 4354 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4261 0 R ->> endobj -4260 0 obj << -/D [4258 0 R /XYZ 85.039 786.531 null] ->> endobj -454 0 obj << -/D [4258 0 R /XYZ 85.039 547.583 null] ->> endobj -4257 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R >> -/ProcSet [ /PDF /Text ] +/Parent 4332 0 R +/Annots [ 4359 0 R 4360 0 R 4361 0 R 4362 0 R ] >> endobj -4264 0 obj << -/Length 3000 -/Filter /FlateDecode +4353 0 obj << +/Type /XObject +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/warning.pdf) +/PTEX.PageNumber 1 +/Matrix [1 0 0 1 0 0] +/BBox [0 0 31 31] +/Resources << +/ProcSet [ /PDF ] +>> +/Length 557 +/Filter [/FlateDecode] >> stream -xÚ¥Y[sã¶~ϯðyª<+º_úÖl»t&Ù=ãÌìCÛÚ–mèâ•ädóï‹ )9vr:™‰HøÐþÌ£?–Å®æ³4KÜ8ôgëúÊ›íhä÷+_ψâУˆÚft‘®¥çè=i¹QaÎíãÕÍçÀ›ž›$áìq;óýÀ ý`–乧éìqó§ã{î|Çž³TõÜwVj¾“Ô¹‘Ï=‘–ÒüV6›vúÎË|á;=ˆ‰óP 39ôžÐö4ÿûñ’mAå^Â{Ýòˆ0éËf'<~ñXÒN›‹®~{´ziµ’”tˆÃ5ŸÌaÍýxFºå^~¢y˜ºi”³4ûZD±Cz-‚ÔY³ $GFÑ̃ŒTãëVzªlæ¢|”¸Ô¯¨ÏFØÈLèÑlé_ÛÕj(i“•ÞêeNUuJUòÙª^ï7tj™OèFÎîXndì;´z«ú`w_sûðQ°æ­†ïˆÁÓÌYu-h/=†Y^ȵîÚ¾—voŒ±j̃R l„×ÚNºŠmØAýÞ¸ ¿`¿¶{Úu-X4ù//öÌÊM[[ãúñá—™ç|#ÚhË :â#?e÷…´W|š,2ìùb2ˆPIw‹]ÑèŒn}[A290Œ´[ù>Ã-&Ü}Y‚;»ö#glz÷Uú -µù²:ÿ'…’«¯Â˜Ð+Ot¿ºZ^ý×2ƒù"ß ²ð]>¼Ê#>Ò2ÓOù,ŒT‹(HÝ0ˆ-¬¤Iìæq,°’ºIN²Ç±ÅŸÙC+¶„êgªÊô( Ü(až³ï3Ÿ@=ÏC™3i³£bL¸¹«ýÙ¯-I:;Vø.&Œ³)Ɖ›Óõ‡ž{ {ÏžP -8®­E~èžçIË=Ú•‚Š…„:¯ç°WâŒè¯8Ü -™Îƒ-ÖÿåùÑîØ™5ÈuÀíö K:Ã;òÉÿÊa!,¾À¿rÄ&8ÜÎux†!ÅÉsÑIëñÓ×›;ú:ÏBÄhK„A½R‹Púʨ]©Á,UUßJ«? 'l–Ž!vO„=@WfƒðH| |#(‰Š ‹˜ˆlü½‰„sâ‰m41L†bÚÆúm€1±µ?Á7't÷Š¹L¤ŽYè bzÿMÙ«à „:“ÒJ …Js2l^eXP“}¤—Å[±©t9raR_ôóØC)â'z骽6 5µZïK}m¡ß({©ëyÑ|.éö h‡_Ëh°ŒiÿBmöß¡|ÖÜ~--®­ ýÈp¢¥xYxΣ¾ŒÀ`ÛV•·¸ðÄ‘GIÎÀ©¡ômDêïO“ħG3øDé¼ò=qìdI_ry¾Ü‘ôí°¼i þƒôÖ{°°}æº âRHÑL¸+ûÞ¢Ô'`ÉgÈü ˜÷ót¶uÿêZ ïvƒ4¤¯ïfyôayh„Ó Ú\Ê»¦yd˜G®—F&ƒæ\%ÊÏÈ 5ùDÖŒ;—·ESþt"u9Ï5l?’o2çý<7Lr7 ã—m]´ ‚4M†×GRÊ€ŠmÑ1"£Ç·9¾{=|””VšT£…øh/Ývû3ô¹ùœ$QºfòŒÎC'Ûp O¤| ïŠ!Ïôfy*Cm×ëd„†hd(뢿†&‰üsa¶™ Ù ¸ëȨB%!Jt&“€3¢¹GèÆ¡ ] Õí”Ï‹þR4±}²L¤ïdÔ§k¤åÀÄ¢Ö ¸ ¸ÈƒSîPg¢a‹î{¥¥ãWÔÇâž®Í9ÎœroSöÇ@% “/ÊÁÑqýGŽéÔc¼ÀMÃP“+FÍ)L‚èd»Ïó,â4?¢ËHªÑ™"(œHÊ{›D$”,Ò5. ²…4O²Fmjž]öRDâfèøqÎyldb?ÐÕ|Z”1ùX븨âxEÁaÄZÝ©>Û¢ Lx)‰" W'ƒ 4 -.¦dC]ëŠ*\Ϙâ óã­Pöü­^a3r¬Œ 3Ú/…-¦Diè¼ì[¡ÕJÌPHzÄŒ¥ÇùùŸ[U€^Gp P*í;ºœ” Ć`Š3véJª¯üï(…hNñßIC5ÊÇ+ŸæIfÇ&¹ ¢ˆJ«,&ñ‚Öæ.Ø‹)Z c5©môšïs< ÅyªR«Fí -]þHñ±ï¨Ú>Ÿý «Ê¦Nä’Ù£þ4|-Tóž¤ra³ÊÐä Ì®|ÒUz_ÊäÂzÙŸôüO'æ>¼qâžÔ²ÚAÈ@-»;€ªË -‚(=ï…Ïx/£ÚÎhË5CR%C(îºveß -8jRä2þËh ˆªªRý<_¤T ~e§ —HUÉ$ÕO„\š5lƒ/"ôþVÚxŽ\ëtö>®÷ú1Oíô·•ãÛž+…ÇøXz’'Ö¼‡’ˆAʤ1ߺ8Þõ±Øcdûæz ÷ndØê‘Ê«2¾x>I›i˜<ìåv§wíŽÏ†X;æò h°ÏÃy.w’ÊSQNíã`鈎À<ºÚo„ø…S­ƒI¸ˆ²|µ×PQ‹EAní¨âòø “j”éKFjFÜ8ÐÏ=u¥/‡Ø7¯ýö—Hx}å†}½8اÚ8óþ,ï%O@èr²“'§Y#çâƒ:A šBªéÜÃä Ûª7•‘Hj7…}’ÉuÅFߧFrn™# VJ?±PFÈ!op&óƒèG›(ÿ¿ S*A1È3?ƒ´ý•!wt¥(àJÎi`Mú*S,Éê õ›a7­DSçØëÊ•ò ýøc…œèQïÈO}_u5ª‹TÅ?²¤èw¯“»o|KoÌûËË/‡³,[W¥vþ]LÃjP q&:ëm&8˜: \EŒîÚEx°•ïYHë%ò‘_‚PBõm)„)B‘ û§˜ÙƒI¨ßC­ea0R‚5Ìcs¯ì™üÕ‹#?ämÓO3vîKüöÔn‡Ÿt¦§oƒqª¶ùe-õ ³ò®4)?êGÙObû‹Pþèž,M'ã#l%e@̦GH]> hJqê;E(¶ŠU+ G e’Vûæ¦dz›¼¾Ê?>æ:-ÅŒ¦µÙ_kØM²…ødŠ½œMôÎÓSìFáÉ/¬ï¿@Ù©çP¡—¸aœv Þn‡™gá{þà“”endstream +xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù +ä +6\>RgÈbÏWÖ¹j[†› +WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream endobj -4263 0 obj << -/Type /Page -/Contents 4264 0 R -/Resources 4262 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4261 0 R +4359 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [497.496 355.905 539.579 367.898] +/Subtype/Link/A<> >> endobj -4265 0 obj << -/D [4263 0 R /XYZ 85.039 786.531 null] +4360 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 342.356 401.53 354.349] +/Subtype/Link/A<> >> endobj -4266 0 obj << -/D [4263 0 R /XYZ 85.039 766.606 null] +4361 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [401.962 342.356 539.579 354.349] +/Subtype/Link/A<> >> endobj -458 0 obj << -/D [4263 0 R /XYZ 85.039 766.606 null] +4362 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 328.807 298.441 340.799] +/Subtype/Link/A<> >> endobj -2956 0 obj << -/D [4263 0 R /XYZ 85.039 647.281 null] +4357 0 obj << +/D [4355 0 R /XYZ 85.039 786.531 null] >> endobj -462 0 obj << -/D [4263 0 R /XYZ 85.039 405.033 null] +346 0 obj << +/D [4355 0 R /XYZ 85.039 538.26 null] >> endobj -4267 0 obj << -/D [4263 0 R /XYZ 85.039 383.271 null] +4358 0 obj << +/D [4355 0 R /XYZ 85.039 506.042 null] >> endobj -4262 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F66 3242 0 R >> -/XObject << /Im1 3957 0 R >> -/ProcSet [ /PDF /Text ] +4363 0 obj << +/D [4355 0 R /XYZ 85.039 278.031 null] >> endobj -4270 0 obj << -/Length 2310 -/Filter /FlateDecode ->> -stream -xÚ­YÛrÛ8}÷Wè-ÔÔˆ& ^ó²Oœ¬gÊ—µåÝš™Z¢-n(BCRvü÷Û7€”Dy²žM*%èºO7ˆ?ñà¯?I#×SÙ$Ic7Rþd±>ñ&0òùĉ™ˆÌ2gó“ÓOq8ñ=7ó²ÉüÁΓyn”Å“ùòW秿¸™Ÿ™Î”RHNgI’:·Sßùpyö»Cç”G/oñ7pî.®>^OƒÔ¹»å«óù~_ù…;ξÐ'Ë\\}æÞÏÿ¼øx>ý}þóÉùÜ>pÍW -Íþãä×ß½É\üùÄsU–Nž¡í¹~–MÖ'a¤Ü(Tò]ÜžüÃÎÅcᄵÆPŠTêF©:„É0ùrƒÀŸ$QäÆaB8ÝTI1ùNÞèOæÔºã>üèVy‡-ð:/PðŠàIœ²e‘âÛ¢Ú¶åÂB3á”/¬”³H[4OåÂN ãfÖ|³Añ’[îÓu%êhˆhéÅ -¤öKÛkÖ…LfâíÌGÈ2r±_Ïf 5·¯Šî U/®Ñ#_ÁRàBïGýóŸðãôN/n¦©r\î¿­»²†±%)?£ ~äž÷GOy­Ýð/Ù2\¥ÉBi/òM¾(;}a•NóLݶ©ÉIoÇ=ý›ç+y»‰6Ó(ëš÷? t ·ÑipøGÆ°¬ù÷yU‚Ìb$`!õ,vröÆ­hHÔõ×}ˆš¢*ž¦Qìäõ‚ ÂØ£]—¯qî{lÍpH bˆ!Ù Õ XÙµ#>@¼rèäU«];"ÁOÓ4dWÓx?e §6ÉNø>O §¯-jÄ" hA‹ôöÉ#·¬AÁí{B½ Ùe¢¥ BèxEcKûÍ‹¼ÒXó~:O È0ZʤW×sn4Ftv4Íÿ@˦XÂÔ>3“Í+@mÛJƒ§œWBsŒ«rê‚b^ÅmÞ¼pwŸ<ÊY1š(p\ÍŽT¤ª+4¥+uí¡Å8NÝDE¯2þ@†¨,€ÑÐUaLTæ®òƒIŒÔ0€Ià -’ÌZ±T;g š¦§Ê‡=ZÖ;fYä¹IøºaVd„b]Aæú Sì9CãVðµn;nq¾`z#Ùý÷ m(#;y1ÈyݲŒe4ûAó¼°0ïÜš?ÚBâ3 ãÀ¹ä4F™}Ã᜺dÿ6ïÈæä%&´ñc&–©­àØ?²ç榯¦¿|\áȽÀJsƒöÓy*„c¢^ò|vsÚø3Lœ…^o¶hX $L´ˆÛŒ†åsþÁäMW.¶µþÔM°.â}á-*äŠ|2gîýÑØ“ k&梥­p5 ‘{ØhW6 -(bÃvk<Ï›B†­šßä ÚQh”l••e A Pm8}—7¢ßшۇ¼+èÜ™” ÂMe*\·ƒ.-ír½!S ]Ê8æ þblò… väü#ë¿ð¹*¾YÕ€K65_ õà˜"²C¢b<(Y¤ë -áyÈ']éGKË­{”lç+aS»ìp>}g0K#ëè”·u'¿l s‡Nþi®Ðï¥0u-zùW¢lçUÅ Ãë;g¥9⬾Ïô@ ½dª¿O…†Ä ætÓL‘a໩ŸBsŒ(}BÑ Ui¯?”*ƒ’5²‹ ª—r"a©YÖK&”÷|;€,·`—õÂö |,¡2l $E)Íh…A9¨Ø¸ŽÎñªá(jʇS*|;j½þ+¨‰¡–÷¬ö°€Ô¨kMåî¢ØuŠ·%4+ÞV‚û™x5{pͯk ò7É¢·Õë¿”!P×uS»u#=kÉ*ܳµ‘2Bߟ8Ir|Ìàþ¯òÎÂj4…S\W&LÄ6RIÍ®=íQø¼Ð ¿_¯ÿ -|"´ÃypÚYe::D¸6ÄOÜÄ»8Œ' ä2£-¬‡j.Э¥a ²uv·K…ë!QG‘ 3ϳøÍHô#i„þg$MyžßW{ÕS™®ìur»ÆfÔí{;ÿâFÖZbܹ -ö~=Š^’¸~˜¼½^ÿôDèÿˆÞB×v+/ºÝ±\>s„ø±¤ÖHîr»*é7Riog$Ãû/V3IŒ¯Èå"—R%‰%û±eŠUÜþ®Zž ¸fpÊäUÙvÜZçuþXXîàú&1UbïÞ×P w52áX¡c -‰ÔP†€Øé'5ŒP1N2)J×ë{‘Ù‰bP‹eðQª®>Šº²xÜ692mihwCø‹Éô–O¸î£Ä'Ê}ß\îÈS^U×抑R-øNæЃk­ÕÙÅ¡Ì~?â/ä«{1ü*7Vœ‘g–ËZ`“´ïGî³ý?\NCn§þŽà2UË¿UñTT,ë»!TæCÙjÍBtÜã r¸®)k¨‰žòJÂ=˜+.»iŠ‡¢i°ìÄÏuN¥Ôá´"^éžeß#ºÔë«Ø=Ù¯îÓBÀ?œ³¨WøÒ$VÞ› oA -Ñ(‰ëe,~•¯e¾/}ÞÓ÷%ÖàËï -Øw…­¶+Ñ{’Ý,Åß™Ñ%ó˜.øõçXE‡æаñs`IJnMõ·—§žËC‰ÙHÄ›^Ÿq_‹î@r»Ùè¦;n´gÀJë¯#„wrf"å¹^šì=í©ŒŸ$`Cçô>à ^¼Á[åmÑ_×Q‹_ð-[D2âæ#¯¦y#ŸDÝô¦°”§i¢ |ùfBÖêà CÈDöêRc‚6rªð«È€ÄÂnp%øF-zÒßw?¼“ŽFÔí»¾2Ðã9÷6 ¤èÕ>བc"Ѹü€OUÿ溚'#þÊ3çH¬åÅY ½X -ÓŸ30B«åCÿx¨;[f÷…ùÃîÛ%Ÿt8²w4íî Ï7šn„²ƒÈ£ |ýŒ‚ƒ;42Ï¥¹U·m.ÍK7¬Ù½ëÏ¡ÿh<š=uªÈ Õèþ1zé?‡ì³d˜ºYŒ—QðLœ(c º˜Dû›ÿD:´ø¿p^ †endstream -endobj -4269 0 obj << -/Type /Page -/Contents 4270 0 R -/Resources 4268 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4261 0 R +4364 0 obj << +/D [4355 0 R /XYZ 85.039 248.811 null] >> endobj -4271 0 obj << -/D [4269 0 R /XYZ 85.039 786.531 null] +4365 0 obj << +/D [4355 0 R /XYZ 85.039 223.834 null] >> endobj -466 0 obj << -/D [4269 0 R /XYZ 85.039 668.735 null] +4366 0 obj << +/D [4355 0 R /XYZ 85.039 183.186 null] >> endobj -4272 0 obj << -/D [4269 0 R /XYZ 85.039 639.937 null] +4367 0 obj << +/D [4355 0 R /XYZ 85.039 153.967 null] >> endobj -4268 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R >> +4368 0 obj << +/D [4355 0 R /XYZ 85.039 128.99 null] +>> endobj +4354 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F62 4047 0 R /F35 2976 0 R >> +/XObject << /Im3 4353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4275 0 obj << -/Length 3692 +4371 0 obj << +/Length 2613 /Filter /FlateDecode >> stream -xÚ¥Z[s£È~÷¯ÐÛ⪦¹4·ñÌì®73òÖ¤jw„,2@ãøßçܺi!ä¤*å*Óôõô¹~ç µàO-²Ä¢|‘fÚO"µØ®‚ÅŒü|¥dÆR¦,9·W7?éx¡?òÅãÎî“~’ëÅãöwïý/ï?~¹^FQäÁÌëešfÞêZyï>ݾÃîØ»áÑO+|†Þ×»ûŸ¯ÃÌûºâû_ñýó—¿rÇízå9w÷?sïÏ¿Ý}øxýçã¯W-áÎÕT!ÙÿºúýÏ`±…+þzøQž-^ ø*χ«8‰ü$Žä½¾Z]ýÝîÅcñ‚WÍqÉÌXªÜÏÃämNjíë@[N†0ûQ¬‘“J…~¤ÂEš$¾ŽSb%p/þ%qî}¸^*¯&ö›cßój›K7—Þ$eœC¤¨Äª%%R~˜'DÊOU‡‡#C ­×ë,ò~¼^†:ñŠº†Fœ‘<ñùék¶ð¿½Sï¥ÇîÜk £¤PŽ/ø¯í¾UØýÄ3ŽæŒR– Ú|ºåöA¬ÌHÍwÜAÞøü’÷ÅSÉKnë™·Á™ß`ÅýkX]ðA[^z }zê+ž–ÈZàØR¡tsâÓ âˆ3  ‰ŠpS+ëÌ]"8ãP࡯ä”OÕ¯Bø߃1Óìy×4äÇž¸ËuFg^`FrIâ=bûýìB¤8…ýÞ]Š6DIêýöá]¾Âë#ÐBUh–ÀÝÜp#ÞS;¢Æ]É»–|Öš”XÎjà)àsfäD<0É!u§Ý·Ý¢ï«±ÏD[Á7Ðg†¯TÝ<ðú’‚ð9&!ƒvvM&Žô„çXâØr‡MŸ¡M°6Eª:ÙšTþXSö¼$ šhÍšÏxìÄ -ðÓÖ4]tà펓ñaÊ)P›‰ÄA2¢yeËü \eã.([ÌU¸óSW»È{ßB¡ŸéK€QŠ N Aªî??2o û¹ŽO˜3¢|ÐІQ¢Éº×1ÌÏðõ—§Ì_x®˜©wFüƒVg„‰è´€'$=ËSSq"×ïV°w+‡¢tÀëë(!ŒÎ Qêo.YšÄNIråu_ôç*“œ2…*¨¤ t°®~”KqŠòáÐ*©y1xÅùXgŒÜBbI&*¶ M˜œ@Ö¦LB¶Ì3O'5 -ç Üa¬‡™¢Ü®„½…áT ÛÍ„4kM™æ%ò[F~àÜo…V—…Móu ¼_Úç‘WèHñjû"‚{•`#*‰Ybd-ì2 -~œ—·lš +w†&៬%±gÆ·qÇ—­·ayqÇx[{„Ñ⫲¿h_ª§½x6 °>dY A‹¼¤ÀbЦD馕ÝF–pá“:?­Œo%H +ºò¹~§°²Ä‡vëˆíÑ.íÝs~+ß爎SÈìßþnî̹üÝ\E@)ÿꧬzüÁDœ@H䬺ûמmçÐsÇÑ(¾€1iòTGcO©”‹òÆÖ•xû–¾+À˜8æÆ7ú(WqÖ’…’ìÃìçYÅuçŽðùٰÔùƒ'ÿx8D>F«Ð°— E³^ Àà±Î’CŠÙ6²QÕØï¸&ÓHì•æ+<«à‡À ΢âœáb.S‰R?¶nÊasƒ<ëç>'¦>$„¶.@™““<öÓäô£dÛ1 #lƒ O·õå,ó>´‡¢yoyK0exå»”ŽD„íV\Î,É!‚Jòã—A—âÄñeú!Æe;ùÍ‘qøÝèÌwûbí”C—18pApú„Àè^ ¼‰ÀÕD*ðˆ)g“tÜP5¸'˜ÌØnÊ¢«¥ÍQ?&_ü進a?>¦2µî-÷G{Ÿ×SŽ(‚žá` .wpŠ¼ÝºààˆK6L ±Ÿkñ°»ù5ˆ¸àV¾0ÎT¤xÄpÉíF‰óO§,XÈÍÿ¯ŸCZ7g~ž…ó^0 S_§±!Yê)ÁI”ù ˜ã9Åÿsž_Öendstream +xÚ¥ÛnÛÈõÝ_!lQ€¢1/Cr¸ÛHœdãEMcY ›Z¤-Ö©”ÿ}ÏmHJ¤Ô‡"ˆ9sæÌ̹_FÞÌ…ÞÌ„Ê ’Yl"Þlµ½pg°òë…' AY pÞ,/.߇ÑÌsUâ&³å}wNâª0‰fËì«sõáõ§å»ÏóEN¬æ‹86ÎÛßçžsóúú#ƒoÞÝÀüÍ|á9ï`ðùöÃõ§ù·åoï–½ Àë¿_|ýæÎ2 õ· W‰™=ÃØU^’̶: T¨™o.n/þÕÅkzÆ»¦¸µ /Q‰ž—H©È:‰ø°ê©$ ‡ Cé˜$+_—È" ]ç§ß‘ïr Gë‡ïq¸ÁËO £(v®ê€á/qÈo{žû±“Î}ã¼ð>–‚ë¬ø€´ô¢|`à6]!þš`BO[ÃL¤ã‚àøÚ}‰gâæ¿ò‹ínó"[a¹’}›M…;že¸Ù‚ÈZMB2¸M·ˆs—²‰³$ê'„å5ÃÚŠ¿DFmyN[$6Ðtã:ßò$mø[Z´<Ë3ÞþLVcáh ODцզȅ?Â.ä ÿ ? ˜ìÙ8YµM‹RYÎüX¹à+ÄY[ËâyÀŒ3ÌbçÕºEÀŽHZE4〥2¡¸u  Àj#qÈŠýŽxE'¡F6ð‡­ ¹ÙÍZ°·¬³Àú÷Çë?ì=¼c\`^Á‚ïP›·ëŠŽÉx?§;ÆjN÷dÌb[¬À6Ð`´?Ò*I ©Ñ(e‘‚Ö–2€Ž)cx!– È{z4°wuíw0ßa¼(:Çù× ßEZÄ:ÿ¾/zQ1pU•ºžðþfB)ÎÀy˜öm” >NvAu2€  û;.÷M}IËwÖ9Ä&˜fóNó ù^fùÓeg›¬"þ=×Åâ.ïøè{°4¡iqÃKåh1üC?R‰9_ð pN–7¡«¡*ÓÃòFKys“>öY9b)y|sËEË +žyàqBkç ê:5žÓ´)I]ŒÂZQjߢxÎS.ó”OyKgCB›ËåP9å[pF87¯O Çõ”³8+œçde¤#¨!“¾0òï ¥Ô›U°÷µ¬Z‡Åñ6}”@DStpßx$;üZÙQœ‹ç†Ñ(ÞQR|D‘QÀEtôü—#t4/±/I@–hEòîo-#YŸýD¸}š‡ êºKGÍD}.Úµ­9zW: ÑÍ®~ÿ…Ç@Âúù„µö”Ggµ8ÀéL|¤EO+7ŽMÜC#× ’“L×wÝlk|â狀ºÏ›ÅR•éæÅrÓYŠ{œ“vÄ`wWä_†õ¡Ž¹h…Ö_¨å.Ã1áKBü‚ŠRtìwÊÂ*W6E4×,x~Ê\E2hlX5¤éÐ GÚÄ{Xz¸oWw6FV¬“à5à¥Ùd9e¤íÐ1$†Lç«Z íš’"ŒÖTtÃŽ]<>›ü¡¯› ×Ìðµy<Г¥‚Ç´ÈTi#Å>mé½ÐÆ` ‡´Ü«ê ^³-]WpÂÆè^oIå5±+T®°\Š( tкðαN–Ê„d…ƒšk´J़‚EGT]Á7ß×ظd£u€cžI ]A,y÷ À’Æ'?¨Ä%ÓvÑ-ü2ŽFÕn©Š·‘è¹°Ùùž"ŸL + P¶C³BS `(å -sÊL%݃¨ñ¨c|¬Úüçù"ö}ç=–‹ì>Èpe»„ºh¥Å…¾!iª²±.-¾î•’4›>dÇîæ÷-NÈôŠN "¦§AÈ8î³ÉeÛµVûMÆ ;ʇ¹å@´Ú‡"ÒôÑ‹…ZÛË¢/¥Gb¬ÚÆ{E[=uÆŒ¸QÙîø¾ªÇÆ1°ôÃM‚[”ã=—yK¸Š:›*ò¹Tð¡ãO·2¢äëKŽ€‘O#ãâ!ë{ËdwÅPµplÃ4®O„iF²¡òü4r!S9¯Ó*á—l‹XAœì¯¬À|Ý{G+mFêG\ƒÀ„®EäJìk!èqÝ6aˆÍe;×\KC,Ì®q|ÏÛŠ–±Iv&>2Äù–Ü9„ÃÞÂ¥#Û[Ôó+2üÓN´¾§‚Äâ¶ÃÜÌ7ØÛíW<¶Ø¼ ™£žŸ¥›1éÖ¥´ä»Á¬­L軳}c«Jzj˜(>lú©¼¦Jž‹:åöVÒ :úîùïDÓvKZ“c,£=ø÷T6o\ÊmlNúT¥)_Õ–—aè*;ûr0ÔDÃt&?ŠýrêÙïè7-!ög“ ÷ B¥ƒÉßÚà?Käÿúa³0*1þ´ ‡£X[b(´Ç‡Q¡ &(þ/v‚INendstream endobj -4274 0 obj << +4370 0 obj << /Type /Page -/Contents 4275 0 R -/Resources 4273 0 R +/Contents 4371 0 R +/Resources 4369 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4261 0 R +/Parent 4377 0 R >> endobj -4276 0 obj << -/D [4274 0 R /XYZ 85.039 786.531 null] +4372 0 obj << +/D [4370 0 R /XYZ 85.039 786.531 null] >> endobj -470 0 obj << -/D [4274 0 R /XYZ 85.039 766.606 null] +350 0 obj << +/D [4370 0 R /XYZ 85.039 766.606 null] >> endobj -4277 0 obj << -/D [4274 0 R /XYZ 85.039 744.844 null] +4373 0 obj << +/D [4370 0 R /XYZ 85.039 746.277 null] >> endobj -474 0 obj << -/D [4274 0 R /XYZ 85.039 673.261 null] +354 0 obj << +/D [4370 0 R /XYZ 85.039 526.981 null] >> endobj -4278 0 obj << -/D [4274 0 R /XYZ 85.039 651.4 null] +4374 0 obj << +/D [4370 0 R /XYZ 85.039 494.764 null] >> endobj -478 0 obj << -/D [4274 0 R /XYZ 85.039 162.781 null] +358 0 obj << +/D [4370 0 R /XYZ 85.039 441.176 null] >> endobj -4279 0 obj << -/D [4274 0 R /XYZ 85.039 140.92 null] +4375 0 obj << +/D [4370 0 R /XYZ 85.039 407.032 null] >> endobj -4273 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R >> +362 0 obj << +/D [4370 0 R /XYZ 85.039 172.858 null] +>> endobj +4376 0 obj << +/D [4370 0 R /XYZ 85.039 140.836 null] +>> endobj +4369 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F38 2997 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4282 0 obj << -/Length 3652 +4380 0 obj << +/Length 2819 /Filter /FlateDecode >> stream -xÚÍÙrÛFò]_Á·%«LÇàÊ›m9ŽvcÙ±äÕneó‘ˆ2I(hE¿}Í`@T6zØr¹L÷L÷ôô5Ý7sáŸ7KBÇ ÒYœDNx³ÕîÌÝäÙ'KAYZ8o¯Ï^ÿ©™ç:©›Î®ïÌ:©ë„i4»^ÿ:÷Ó›Ï×ï¿,–AÌs±Œãd~µðæo>¾}ƒÃjþš¡¯ðןß\\žZøÉü抗ï¯oðýÓ—ðÀÛ/ôÊ8—xôÃ׋ó÷‹ß®ÿ~öþÚ0nmÍ dû÷³_sgkØâßÏ\'H“Ù#<»Ž—¦³Ý™ -'T¼oÏ®Î~1k1LÍx֔ qÂ$è‹É -1y~àø¾7‹ÃЉTLrºÙ€HòÅÒ›ïa7JÍ3ú©ÀûMûu‰›~¬q,œû®ûC_óÏ¿>óoýTãR^s'k6 ¿> DiJV9Í)·ß‘D.3™+eIßÃ@¶ÃAäUBdN`¶”Ý.=YJ[¼øÌç”­×0[ÈÕ¿¿epù tòð0&ˆ(MùÓ‚°Æ¡‘µ`L“äDÓÔD6µ!‹&‘\æÍÛ ´µO Ë>Û t•Ñ,6ÿAÙ$ÊI½S²i‘&d#HÈ­•Í9-›IjZ6µ_Ú%UðPäV|0bº‰I«NW:`á¼1ñÄžDÁ ñ´Hâ$d8Ï9-žIjZ<µaºEY•Ùz•™øÜÑqãå7°+Qle‘U<òõüó¨ÜÂ|¥:!·iBn‚„;‰Få6ENËm’š–›Eígí\@@¾ï£ƒ¡ß|Bh:º†ãâè÷ç?‘-^_9<€’Q¼Ö*ktFBPÌÓÂÞ>N’“Q2|f€ûKQ2|f”Œÿ_¢¤oGÉÙ2HSÇ Q+0ÏN´@@ôm†¬bW2d|‚ YE)eÈøºÂüªü¾è&ËŠæo²H'ûE[‚qO¼Ù0(ãñó§6C.V2†. qjããlÏåé½ ¤Îÿ^$`¸˜îFÂ:<Ü•Õ -ùpcÞEcØàcA,ÁSÆ?ÀR¶#^ŸyÑa^T™ã›Î¹ô5\áõPÓ)Ü‹zCÛ¤ÛÙSþÈŸ¯Ê=f£÷ð’À=9½°9‚X {ëýPVkË*-ÀƒÄ­pÇ\5…Þ¾ŸtóÀ5WMY=ᨠÙpè¾9Ç;)À¶Ù*g|rKÊ“k%à|,VUY—w^ÏáDî†üÕVÖ¢tƒ<L4ŒÝoxË»Ña%’¹1麨L4 ‚˜ë©ð[—ì_1¾¶d|þ¨ ±Ž€$vXœ+§:KÃ'©´D}°ôŒ²rIjÌiîäP±G†)Q~ëûñΑ۵sxòÎhq¾#Ή‚ΊXMìF0€A<ÀïA{g|áÊÉ%˜b¦×AÀYþ!ÿðô[îím•Ë/d[~Êг’ðËzèÙ7V¸—¬ØSìR©MÁìy»9o#«‡¶JÞcòç8¬¨Ðù¥Œ÷œ¯Æ•åZG /Ü6Há 8C5çÒ9´IeÁÄ•1 ìV÷#ÌÔÚîTwæ'«7P‹‰”üÛKd®Îf™<¤±lLýÄ%<}çNDÈ,È>¦Ñé#èÄIq€‚mX{%ï@E'mlj¾ÎïÈ<¶(൒-«µ4Y(HêÙ~½Ã,)S¨/¤Y2ÚåbωÒå- ‰ÃI§ô€eƒ82+I— )ÔLŒ.ü'[m7$mKO¹Ž!°Çs'*83k÷Èó…ž=ô LQì$n‡ñÿ;Yëwt$Ú¬vm땳£3]®µÕ_p#ûÎNê¢Ñy¹Ët¦C ò×ÐñÕq6^HÎÿPqÑ•u•ÌM?®5j™Àq}…ªÖ׌÷ùüÕÀ«:EÛù&{§(5Úç»uÂôD­ÑBšPbA:¥Äã_V‰yTb‹ç“JÜ.øJ<ÉVb‹»QâëEƒ— }ЮPÜðs”úK7öØwQSÝ^fun¯¾­R@?^Þfr~—ÁÕ¾¼ïÜ›%?ªMÓ³«ÐkÚø&{±£Ò]g iB“é”&|YM>æyP“-žOjr»à hò$wZ“-îP“ÔÕK¬‚s]4CÊéEŽRZ¥D"Cp©Ðd·Ûüy¶á¹=žôð±ëà&-[ø\qžݸõm{5“~Ï­³ü Ù½é}@š$ŠŽ%/.ááµ]fï­|§0ÕÉzT÷ýtüó£ûÒ¸îk¤º?AðEu¿ÇóîÛ<ŸÒ}kÁ¿®ûÓ܉îÛÜ¡î?Vt¢e] ji:œVR?rbÖuð=+;SU’ºÖ ÒÔ¯ øDõ´T=ű!=ÅqN§ñ‰î÷Spl¥kÍ…Õ תp¹N?;Ýë€iû\VÂá=O | -Ç>@:FK~ýŠ"+~? åÅZ— ¤>ÕmŸš›‚Ÿø6ÆBš0ì;îÎ×cüÃÍ6Qþ4ÿ-Îx#†¾êæÜê#9RÏ|­SôGý…Qp@ߘÌ7…é” o®÷mez€·,ä‘>ütÅ/ø5 -ÍUÔ¿+ò°·œj搜Üp;‰¡ºbƒ£u¯²ß/½rk•›•Fé?” ZZÚhVZŠ¾\0|Ìœ2lWâ#µ0é«dO·”¥wþÇ‚Ø“Ë Œîòfö²æå´õ!ðqÃÕYn·#´á’Àä9_õä=ôùASQ_ -°ãì›)?@ÃFï63"„B Æ$Û¯‹vEçöÈâ9BžaGÔ˜—R~qBÙé  -Ä_Dè‚úA›?y}Ôêoxƒ·@?VÇràн$ÅòšñÏͶ˜ *ôZL„ÔùæÿžXÔî1JùÕ{ÅgüûÕ×Wü~ô™0ɹùqA–ßýNd ¸/ÅÉâ®ó ²ß¶§/Íqkÿ“þ—úºÎŸÛ_ìúš¬+®Æ÷â½cýJ›• Fž(!° :RøÏøK¾bõ•4ñf¡^8Vš”XÜKsôŸ¹ô9þ/ãøTendstream +xÚÍÉ’Û¸õÞ_¡ÛPUL\S•CÛmÇí¤—¸U™ƒÇJ¢ZKb‡¢¦­¿ÏÛ@R%gÑ!åª<<¼ oƒõÀ‡z„Ê·é N"Z=˜®¯üÁ3¬üåJ ÄH@F-˜wã«·Ãh }•úé`<¯ñ¤¾ +Óh0ž}õÞº~ø2Yk½X Gqœx7CíÝ]ßÞóô݇;ø~7iï ¾<}º}~¾ú0® h‘¨­Åãÿyõõ›?˜©Ÿ¯|eÓdð +c_é4¬¯‚Ъ0°ò½ºzºú{‹×‚ïêã6´‰ +{Ì®{Ø C1±{;Žë{Õ"ÇöÖÙthbo|-72W•ðµÛVü•M§Èy±ƒÉÍÐ$žÌ/á{+ +þ G€K°Ð.Ĕ㠫ò]lFpúè7_‡ûaxo`: aºCÙíÌíåSñ<ØL³jé€ß/²Ís.T¬àªD5Ò(É”XÏMÎdl’ðY6I=<ªXË ¯m²uŽ¤ùÖË63ž«EEH¦ˆï;#¨dÖ¦¾H¡ÀÕHÇÛÆoiÅh£"?êÈþÊXÐ7%4ùlËÀ™ûÐ*‰êü#ÈæEÉ(~¥³fð*Dß÷ì7?ô‘•+¡p +K¥Ík²4cÞ’;ûyfÉdüCÂO¼‰|’ßX-/?/¡Ÿimœ±ÕÓUƒŠ˜56·«BZKaÉ“uø¶U j‚)^*Ÿ<øÒƒµÀeÐÅY_0±š6L,K¹QvT$q<Ù z„éAœ(8ªMú‘ÎÌy‚»˜Øiœ°ªÔšóÒÀÔ& +öD- 1ÇZLÔÙæ Åt„,¡(öîœIà,È\>zG\zÊË?D^ýĺCÎÛ‚9iÎa&Ï¡t¼ › oÍ'ñ +gŠ9þÆìt€6ò¥¬½´Õ‹‘‘‚/7µ',V°ä< ZÜ[ŒÛ׉èrœCâ øÙ?·èt{OÚlr¼ì¡£oùʤÂcº+ñ’UHÑã»ñ¦…Äߨ8ñµ7FHn ç2²$03Á-‚`–cô'" L’@²Š?²ÕŠ»­c€¦wè±ÿ—uþK¯K·¥I]Bt,–~Ìÿƾè0mù)Rè +£‹­ Ùèq0²Ä +ŒBUMÏPR%g°¯ÌŸ—, ¼ 6[Eawû´g‚­3‘9eåüUsDÔlø÷~lß=ÜmE‰à“)Ù°v‹fsƘ¹Uš­ši¢,VÅóã/^ ̲‚À+JFφCÚÜĹ‚Ѐ‘´ä¼aYç‰BÒœÖÖ ˜Eò' +ÝuÐFÀ›e™ótÙ÷×#äÿúæI"8{rʘ‘ÓËŽp¶ߎžë‰‡ÝŒÁ8£ÁÕBüý*«jÿ 8­ “–7‚ ÿ” zÀŠWlbžŽ›ðX°×eÅ¿ÛE±C2ãÏ B +ÈtEòƒ‰¬ä™j‘Un$@p‡Àâ*¤‰ 6l Öá˦ßù+ßÌÜéÛ±Ïå$¦M©‡RA¬™Œ®Õž?fËmE>e91BÍz43[ÃÌL1Y` " +"{8¿XV°hZÝb)y,0¾+rp¸•ä), ´2¡T1Ha=:âZvä" f¹mø£fPüífh"ï7=ò*ZÙœ$yÀÌo6ô®Ù·€b‚~, ²¥¨âÂMûÆûeËSÈmGå 9€¶zƒkâîæ>¯~e‰åsÍ.‹÷S"óS©^™M**õ•1í” Îrƒ¦Ý@±‚’¸*äƒÛõS …ö@sÚa‘°¥b;LW´$ í”ËP½‰¿¯u>…aŸ°ËŠg¸6@,Êuæª=IÐLc¤ ô¦µºam!:¾‰Ô å›lââ(öBJ¤Å(Ìq8åõqK‹y^9îwäÂa©k£¦Æ­Ê–& ‚9yjÌe¤Ü±/ÄvæÀ¡´Ú÷p¼¬NU 6Òpɳ‰x ¦®à + 9Õ‰8DIGIS5hOc²5=–™’‹°r¢H²œØ»Ç¹qÀÕJˆý WMÿ.óöˆŒÔ$}dËÌ„ÊÆL,œmÎÁ†*£‡™èÏ[ÂB€ Oz[ÂÍõ:…†6ù€†G}ˆ¡¯’(ÀX žˆƒ)\¨8˜8UZ³‡l€úß·’ÇnÈg‘+:V*Xºªhùï)v¸ÎRlc°=¸mŠŸ¨U?ÔZ{ÿÐG“(Q1èä2Æ*È;âûúÿ¥fð¤Ú?ÑìѱVIzŽB¥¥©Áå‰ùëÛûq«ŸÖt©°+~ZßÍi—Pø9Ú¡Ú'—Ð~w{ƒ:¿þ2g4þtRç—¡²¥ôä"J/¥ó.CœÊqSŠ-&„«9XóãÁ/Ré€Î!M%mßÓý®Þun=ùüÓVÐœ +8Ç•&‰9äæ«íÇãL»Öÿe軸þ/wé!52­wŽÄÊcá'6ýúÇúº^ßÐõ§väií7‡_BûçX±ˆƒØòòP?ÕÞ¼×òZ°‘¾ÿ ,=Üwæ¤m\†úË„ø·Ä@N' pfi§þßÞœëäÛ5AdÎvÁu +ÅfÂÿ¸,ëºà ËyO ì¼kÔ¯pøU?~-«Xé{m¹ÌQ®'J}Ø9¯au•·‚¨D¨ÃG¤ƒŠ^yäl}¹–º°ºŽ…ýuI“¿(Õl¦–‘X”+wZí |†ÆBPžu¨A*e³Y«QxÄo§[Î [@±ªÛøȉPÄÝ8|}^“ a¾ âAZœ®’Ç~âüŒ”±·x$e÷Ä…ýŒ.9$±)dÄÄn¢{{ü5Õ)v{ÂÔhðhIRù£j¿o±fö•ÞtQ ߟKRå‹4I—›æ)­‘Q3Gb¢†|˜ê²þßdšzEÙ¡A8îI=úζŽ7yõ Ê·Ú ÚAöP‹µHÚfúÚ~….e ¥?Iÿùd)îÓž(Vþ3—$*MNx”ÄÅ#†Êù K°ûï.Çÿ ÿƒ7Fendstream endobj -4281 0 obj << +4379 0 obj << /Type /Page -/Contents 4282 0 R -/Resources 4280 0 R +/Contents 4380 0 R +/Resources 4378 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4261 0 R +/Parent 4377 0 R +/Annots [ 4383 0 R 4385 0 R ] >> endobj -4283 0 obj << -/D [4281 0 R /XYZ 85.039 786.531 null] +4383 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [342.437 635.375 479.339 647.064] +/Subtype /Link +/A << /S /GoTo /D (domain-member-server) >> >> endobj -4284 0 obj << -/D [4281 0 R /XYZ 85.039 736.988 null] +4385 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [155.273 414.06 312.906 425.75] +/Subtype /Link +/A << /S /GoTo /D (samba-pdc) >> >> endobj -4285 0 obj << -/D [4281 0 R /XYZ 85.039 722.833 null] +4381 0 obj << +/D [4379 0 R /XYZ 85.039 786.531 null] >> endobj -4286 0 obj << -/D [4281 0 R /XYZ 85.039 709.89 null] +366 0 obj << +/D [4379 0 R /XYZ 85.039 697.007 null] >> endobj -4287 0 obj << -/D [4281 0 R /XYZ 85.039 698.462 null] +4382 0 obj << +/D [4379 0 R /XYZ 85.039 665.591 null] >> endobj -4288 0 obj << -/D [4281 0 R /XYZ 85.039 682.791 null] +370 0 obj << +/D [4379 0 R /XYZ 85.039 619.932 null] >> endobj -4289 0 obj << -/D [4281 0 R /XYZ 85.039 669.242 null] +4384 0 obj << +/D [4379 0 R /XYZ 85.039 579.768 null] >> endobj -482 0 obj << -/D [4281 0 R /XYZ 85.039 501.341 null] +374 0 obj << +/D [4379 0 R /XYZ 85.039 361.265 null] >> endobj -4290 0 obj << -/D [4281 0 R /XYZ 85.039 480.75 null] +4386 0 obj << +/D [4379 0 R /XYZ 85.039 324.398 null] >> endobj -486 0 obj << -/D [4281 0 R /XYZ 85.039 163.443 null] +4387 0 obj << +/D [4379 0 R /XYZ 85.039 309.653 null] >> endobj -4291 0 obj << -/D [4281 0 R /XYZ 85.039 134.039 null] +4388 0 obj << +/D [4379 0 R /XYZ 309.697 315.627 null] >> endobj -4280 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F56 2890 0 R /F20 2865 0 R /F66 3242 0 R >> +4378 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4294 0 obj << -/Length 3833 +4391 0 obj << +/Length 2526 /Filter /FlateDecode >> stream -xÚ¥]sÛ6òÝ¿BT§¦A‚Ÿ÷–Ôiê^ãäbuüÐö’h‹gŠTI*©ÿ}÷ (Q¹ÎÜdb» `]ì,ü Yì+/Ò,ñc,6û+µxÌû«@(®…äÚ¡y»ººù1‰òs•/VOvž\ùqž,VÛß¼~zóiõîóòZkíåò:M3ïaxo>¼}ƒàÈ»aì‡ü†ÞãÝýíÇe˜yŒ¸·zÄþÇÏÿfÀÛÏÔeš»û÷ }ÿëÝí»å«Ÿ¯Þ­,ãÎÖ­‘í?¯~ûC-¶°ÅŸ¯”¯ólñÚÊò|±¿ŠbíÇ‘–~}õpõ;㢚;¥Xg~œéóc -b瘂Pûa,Ò8ö“(¥sºk`aà »¡·)zi}]^ÞN¬ÄFÇ Dm'ͪçoØ–›Ð¼»àN_v_ð¸ìß#<òŠºæuq`±G¬ÌØ™Ÿ«~芡™Y¦è kfN3Oá0bæ‘,®eûמaN{®Sß¾íñplLÑ®ímÛFv Ð5®õŠíÐûõöS¬ßµÅvƒëÂéAT,Ò™·ÚÑ™MÕ·u1”2ùt£€îJÚÖGÀ UÛðCËh4„ÛMQsŸFá˜õ5íPMöÖ”qJ$MmN³§óI¼_>üôoÁŠ‹¢¦™Ë-#ˆøÖ n‰Ìb¯)ö<§Àr÷I[˜lÛ¹KC“þâ!Eh]<îe³Žw¬x&ýÌàá@ÖGÚ;t¤{0þ 4ª-xÒd4yAéQšÐ¶ -^Ù劲¤³‡9Xh€D ì­2»ªMc§BÚ}ᬷ&A–Üyj»M…³Ö‚­šÿšÛ ôÙº›iïUƒó |ÛÂ4f5ÁÆZŽ!ãmõfña«}Â/ v»’øl!D+ˆèG¼pÍ–gêJÅÃA´Ý þ®buì+ÜòóÈ p|ócœ8VG«ØOUûÀ À²´¤Pœ¦=641U×f”+øCÑç;”pøtF3—üñÔrE*ƽG*BKÿ€-mdÉ‚ì[ñU@zçVÀ­ŠŒDª2Ã#Àx^ˆÛeª "3"'á /Ò{™l AP]Šk4lƒáB^2h]‰ÆÒ*bª¼¯Õ°ãÛ‘4M#ˆwd6 W2Žïar êPPï…¨†ž'Ù¼!¢@}N=™¾kƒÙð–ñlˆœDÓ嶇ªvôvΦ‘½A=Ú0›âØ “¹‚ïÓ±1'‡ìT_lŒ*´½±]F®ÉâA{ªå@ùÒŸk_Ã[ÜKgt?ŠrÜ"k´Ù%²à_–yrlÉ­UDâ¢aöf£ Îñµ"UÖP¼ˆÁÁ$æm Ïé6ŽÖ£tÁXן`/ZêI¿fl iZ¬éò7Û¦ÄÊŸí“ìªgtÓÜ(ê®,¶¯Ü)ÿÕÌ£"+Ò-WFr_oïÀwñ\fwFd¦ {3ô )gKŽ6Ô£*Gœ”uÉ -„šX:Ø• 4²z" «bä°/*Aî%6 »š˜Á9E¼z)„2œwÈiѶó]옋 ˜÷*jæÆS v+_6 ØúÈn²H7Gt5ˆÏâQ†£”õªekFQã wÇFAl¥5 ÝŒÃñ~Sîœ'Ú§þ‘ÞE +“Ȳg‹][S+%¯Eñ„÷$h¯.Hݪ­­î²ù­¼/F‹ýSé”G¯øÔ’žl %lù•—*ú—‹b§¤4>ô}êÚ=·~Á%P\¼­0(Aׇ¨í\$#ÿÚ W»¢y&Oþ̨õ„YŠ[­DdDd Çõ\"X”¶Îºj ÃM„ƒ€rì¿ž0î¥Ð*ù²Þ €|/±EPž”y¡È°¦˜ Ðíz(*6Z¥ ”·±G“[³‘(?Ù0âoaÖÛ³'XY#ÓópŠ ÊÉ@ÉèÄD?çñø‰SA ©è;q¿¸èÁussÏA¥vy€ ­y²þ€•íÊšœnÊ Ûr°Ù›è£)9§éì)è4G¹à™ÎÝTc?Ã<“˜4w.·ÈaçÇgÝyû*£%þÆ6ÅÓñ“ù(„…ï`ðgGXëþ*вª`à±—È„SP[‹„óœx -‚‘<ß©¦óïò®´*•sôvª}‰†/Pt™unò9 à°»r> -÷˜2’„fpŒP[óÎíê+ÊQOi15çY6o)Tn® ¾‚D¿±-ˆ²fC -¢z& ÿÎÂ5·Ok×”S}*æùXꇺ’»³gÙ"÷V9ÑŠ!Št¾g®Áù˜ºAûR„€Ã÷6BÊ1Èg,\l'æ‰\ÓÁÇ®BoMw”©‹ºo™tkV>ð¥ (çm.Xîé“=ý²Œc>ܺXÓ­³^–X„/kêK'²’PvŒ˜Ë ¡r4YÈ°÷Éhâ)µG Øni1Ž¡oL—Zþ\ÌÈÞ4ÆSäÀiÛü®‚ï…UyÀ|¡™ÅÎzŒc_zñæ°ÕÙ\À–PÌ.ñ†Üh®¦zh}bNz:Žã»¡5‰¥›¤®&4Á ù?ŽeÊSc9Œp•,bo!%‹´ÑKŒ/§e²ƒè­uàö¦PD‡Dt/†"Š]D›;Õ!â@&žáìù1V“KVSà™¿ånÑF©±ðsàKÒvtûY¦6}9ŠŠ!xÿ‹IDmÅJÚnc“O\áµaÖ‘¡¬zÑ0ıÛÎ}ƒ±fb¸9K/æàíè°·,žyÔŸ» Eéì—R¸<)¢š>)¢DIjbdŒÆz ± -»§4ø¼²‘ŸASÍ–TDgبŸr¤Ýy²ÄW‰a¨ß¯}¸ÑO3ëÅÊ#C‡WÞ:V0¡¯Âlr˜&#7VÀÅ’¶£Cص¹M„ÖÄDö‚³éF4MxÃhÊÏæeLg“<þØ‚Ù83]ŠÔq.DÞlçü+qª`–?6^@ÀŒ+Ã:S]éѱ>sŒbTšï—9083''4¸6^œ Ký*ëR„´}æÃu4õ„ÓËÚŽ6ú|£kSZC‹Tt…Y±þ -m*¾t=Õ„1 –Nˆnzò¶V“º\QR8³“AF(ñQ N=P89)á3´è/Õ^Åï¨l®tÖš My1uf£®™!?)d±©Â˜Ø gªäÛïȺÔ[îŽÕ -EY)ðÑsªìB5V¥›é‰!!PÈ:7gBB?È‚‹&ý`ÕúKµuó(­gÍ.€å¥ ¨X0Tyâ¬M8\K<"Ù/ëIÏ Ãׇµ°ën|;^¯Šk:0,ÉíPÖ®æ—Ü¡¨)Æ¢Æôeq“ Ó‹ØÚPb¢rhŽþsÛ á“ ýcIÀ»ÖÌÛ×”« sÿ¸"Ä^:­W!`ÓvDx5åçÍ8‚›=7Ý·¶®Õ’ë!ˆµª†Ó ›¾~hIA!Be/SÏ=}9¿*™ò…µp{ƚדóíl™t­ÜZ{b7#IWi hÊ´g̦=Ö£O4ÐùRܸ½ø~Ɔaà‡yÙ¸)‡ÍÍ®ÅÐaÆ ¦~˜ÊïîÊ¢½Ô®ÑˆÏ?#‡iêÇYöÍr‡†ž~CÀ~ŽÆ‹¯¬VÃ$öÓ$$6€»È‡­ô ¼‡r8Ó‚CLü>.u@àZyï?üõƒß‚äk/ñô¶íG:ý6Û#ÍÌ‹µa;Šý áëÕŒžX$†‚®tˆeønäEî[©ã͈hm_ a´i’"·àÏlÌ ³Úhƒ6oâ7zlœÔzó°'ü-)%Äæ ü;/‚¡¥+抃æwðyÏ¿BQd¿§ç\[ljà{¿âïíIžNµHtšGXÚ y,kmoO àt´8ŠêF€=µCÎFÃ\^“sçÉH« ™Æ­T‡u¦¼¦œí·6g©Ùé‡UWJÈØ™99$uÐ1p"o Øüîþãê;ž€«3ëÙàgò‹‚Œ7ŸºÊЊNl'`oRÈ\]åS/ok[Ž”ßA„9Ø€z`×þ¼CU`eÁo!_”crž®C([(toí.ö&j¸´àCÍñQÏãYùðÍ€º\Ñg«Ï/«ô°ÚPYý,.âlŠoÒ£ütZDØ¥¢>âHHJJ -oZ]\½Õc½Bé³r6ÂœY¦½¹:ù…Ò'•èð´\5÷ÉÆX-¹-µÈxÖÖô†U1Ì£“?ÌzŽ’ó -d,‘ÕPmªCa_,AGãÚöeH ª>˜Ÿ£ð¯q*ѱ‰ÛÙ·0À­åi‘Æš -X›®GÎ?³€yÓ¡ -§{²y4›`!¼tÊÌN5ôÜ^cÕ’·s×O# ²®üàæ,|7¯}’,_k¢_é˜õB'â”zÀ‚)¨:s¿TœnìÍ XÎÁqâLS)óÙêéó .}ÑÈŽÜæÑIïiÀx&ìOc®w{©î4ý‹¼mPh)O1üx’˲ôk èQ¡~åÎè•éùܘY5S觙œûÍÃÏßB~0ÓÊãÏ$”b;ů<àsÉ\iÜ+òŽ$™¤V’$›‰G8ý‹Ð÷“qö~$ç¯Uz¬®¹—ƒÒtÊ’}z€öx-;Ì*= ÚÃXˆ‡®Yx>úí¹ni3õnAÅyŽ1¯ktŠý,Èþw‘.Êý(ŽÎ‹t˜ ýëBp¯cˆÛõ\lÿyÿׯ^m†e~ž…ó B¦~’F†d?ÍN6¿Ž=çøo!Dendstream +xÚ­Ymã¶þ¾¿ÂEQœ\ÄZ½Ë +Ð{»wͺ—íÙm\îƒÖ’m¥’éRrÜý÷™7R’­´rK ÉápøÌ3CÚŸyðŸ?[Æ®f³t™¸qèÏ6Í7ÛAÏ_o|±!‹Á˜÷ë›Ûq2ó=7ó²ÙzkõdžgÉl]|uî¸{^ø2_„aè¤î|‘¦Kçáǹï<Ý=~fñÓ‡'ø~?_øÎh|Yýðø<ÿ¶þtóam ˜è‡!.ÿŸ›¯ß¼Y¦~ºñÜ0[ÎÎÐö\?ËfÍM‡n…ò]߬nþnuq_4ãYS»Ã¥/ÃëíúñÄvãØM¢”¶ûÓ|:ê4_Dqì4ó uN°£·Ö±0¯éKáWâì¡7ŸKçWü§Daêt(-yÀ1×ySv%ÎѬÚ²!á+´ŽŒFu¤¿=ãâJƒ h¹“䥌ìÄ€WZº2?pª¯ tQjîß‚¥cnHvo¥n­Z88pâÂGgä”üÔÁÀ}yÀù]µÉq;a‘€n/‚Ïktk±xˆgJ…m[ü'‰ó<ÇŽåDì˜!Fè5býk’(~«‘´.͈%½zC3׳ÇpHiºêÚ œáfÃdÐò7GâIA Ãmƒpu÷Ä ŠJ<‘:þZ¤|'‹ÊÙc›Hת¤Rg¤áºˆ9¨£ä$b];±;û }B°÷°·Y%ˆ—ŒMZH íZíLgÎr[ ƒtúÆ}d=6ò/ÂÉb£N6* óL‡%ÇF’½è¼´ç`kCÿ¶œ`41ÕõÞ©«~­j3kw‘y)Ã,ÎÕje×iÇe݈ûF?ÎQä<¢dˉºÛW¢À”‘íÉÀŠ´o‘&ê îße„‘Žk)1‚…X×b£320e|Û•/zÞÒòÞ¤®(?ÑÉ8£ÕKO_ö؃³OjT¦×‚D>ÏS]ôxL J[0ÀPâ‚ETÑé/·ßOÀóöÔêÛz|üy}Û.X·’®æXö3ýݲ?!»Ö튗7qdéÐ~ü4â9‘R. t/O(”¨ÑÓè0I`Ï‹Üi±-ÔDEëp¶Yæ`z€0 +*Œ!½–” 2ó¡ú«æ¹ƒ·(z† +8›vã¥ø•.Ãç7Ęhãû}r(Œ {OY˜ZˆAŠY%ð»›ǹÎC—`~f’”|x^íõ¦l°¢ BË9¤“y¶–ÏD>¤•|øA5h i¹=.Œ»“½‰ Æå¢ßcaŽÅ£âîš5(êÌ¿ïíjq]Ú2×Èñò"mƒ`È1¿Iç´L£Lãj]Cv¥èBà¼òí—=²M]Éý©eß‹—½'_Mb{Û¬Ìa/Ü©y´>i.±Ažà&œ´&Š„ìóúB-¢'b†æ¤Ý±o¢pˆøjGO)¨f䛶—•üúKû;Ò¡#¥âpx‘­PíI^áñ¸¢Äaªd6þR€6Šéü"uîôoPaìFüÔåïFð?;ëúyÊþÖ-ÝlLÿö·7I#c žN_l~ƺ¶ø7dþê2endstream endobj -4293 0 obj << +4390 0 obj << /Type /Page -/Contents 4294 0 R -/Resources 4292 0 R +/Contents 4391 0 R +/Resources 4389 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4261 0 R ->> endobj -4295 0 obj << -/D [4293 0 R /XYZ 85.039 786.531 null] ->> endobj -490 0 obj << -/D [4293 0 R /XYZ 85.039 277.588 null] +/Parent 4377 0 R >> endobj -4296 0 obj << -/D [4293 0 R /XYZ 85.039 256.392 null] +4392 0 obj << +/D [4390 0 R /XYZ 85.039 786.531 null] >> endobj -4292 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R >> +4389 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4299 0 obj << -/Length 2418 -/Filter /FlateDecode ->> -stream -xÚÕYKoÛH¾ûWè¶0¢ÙÍgvˆã$ëÄÎÆ^dL´DYÂP¤‡¤Æã?õj²)QÉ‹:°ÕÕUÕ_=º¥füÔ,‹ý 4³4Kü8T³åî,˜=ÀÌ»3% !Y84wgço“h¦ßfv·îù˜ÀM2»[}ö^ÿëÕ‡»7ç‹0 = œ/Ò4ónçÊ{õþâGÞ9Ͼ¿Å¯ö>]]_ÞÌuæ}ºå‰ë7wŸ°óñg¸øH]¦¹º~Ç£ïþsuùfþå7w½àŽj* QìßÎ> f+Pñ§³ÀM6{‚và+cf»³(ý8 -¥_žÝžý»çÅsÑŒWMY)3?ÎÂc3…±c&¥™h–ƱŸD)ÙiUïòm5_Ä:övyÛ ·ÿÁŸç¢EÍÎß*—Ñ"ñu -»…dÌçnS€5²Ä[‰ç|¡¼-4+ÖØöØ¿oj´âS[à„ ¶›zKÊwó²­™ç#Œ6źhšü ž…É|< -îtV€ ™%mZŠ¸»³2!p´É@ÑÙB´\(´¹!ÝÖ5®‰#oÛµØH<^‡ºÅ öþ¾fļ Åñ®d®nV¤24»š¿ùr®So+¶ÅïsQxv´—lÀvédå†ÙãĺFýÊAp2òƒìöØmY{4|Ïl[±øl" ûüPÖ÷92úBJ#uyïe·­+x½æ¯ÈAx+Iý$L -ßÝû˺ZOà&üÅ‘Ðý¨¨ÅÀœà»0†ƒ€–½°*•õqð¢5Œ¸bõÂuu˳eñ{QŽè“ø%¾¤ñ%B1!kcèß7tàŒ9ðBf^è,©'Œ;»C›ï¤ÅÛ,qÅf+xÆñ¼=Xaò–ùÛÍ”gq ½*"X®yÁ3N‚gŸr¯¦ø Ý~Û>Ѹ$1Q\tÈWÌ€s2 -Ð-ªvß”)¸Žò6y'Žn¥-Xž4Å™°hÂŽ¯Òî#E¦h©æ×BÈc(§,ò^U°„²_j¼Otè«~œ»¾ÃÎõÏ0sþßç: Ä[“P(‚Ýux$â†vÆãѱ¨0r!ÆЈßUÍ” -Û:"#!ýÓ¶,yòPPœ5ð܈) "÷_‚8ÈK:«zÿ°±[õT"YWT« %;ÉEEǦàüS“Z5{åÊIwuc#E¼!g˜ÌÆ°‘„/¯û[ËäHSË>í^ÇIQ¤¨û½3»évUȬ•ußÊö¤tÁ°3(Bhïnž…v6ݯ6!eøc+Üæ;¤¸ÏÙˆìþ Ñ”b8§NÖÁ¸ -€þýž{žsaÁ¹M@/%õm)ç9æ¼Ú&;­8ÙiÇ`ŒòÝåøÂmArÑJGIŽ6ßLw¡òµÒß!Ý%¡eÑ(|#ÝUõÿq¶ã„~Iu‘0í•ŒÑl[îH^^S”§y -´1xB%C.Bã9Ê.a’"ï ØD€>šÄžÝtϼ¼¯¾00!Üütù´í6Œ,gG,¯ÖŒ §Á©`äɆӭ»ÒŒ€'ryjbB° mª&†ùQŠÁÅÓÅ&ŽÃÄ,:q©’„ãìý‘«Cÿ1G>ùŽ»W6Ñ L9$$ ,$Åà‹™”B—ŸØØÕ)ùªNpmŠHƒS'öØ؃Y'„WŒ¸ïýe¾omÆÁ~ÅšôA:àT‡SkÊtäü±ò¦îåR»,lY”ü•€Ù‘};Hó4–Wv¿°¯I&í•VÆW9 Æg%à¸,xsO &)÷?XxÛ4Çi–בT&!v;‡íP(àEüɽ<IÞ×+FGöÁMKçÚ¢˜í©zò -#¼‰œbÒ€ -ùàu8s3Xaÿ¨ôt&Ò‰‡b§ònb¿^K±Ó²£"—¡`7öêÜ¡ïøÙ)Ÿº"è£ZQa!äÖØYæ2ºê -¶XÑ; - % ᚪÓO‹è„îzG…ØÏõaq€c®3aâ‚.ã l &;Ùb¢jÛ )®Îe+‡[à‚õ±SIý¶Õ46®$¾/¾,ë(ð#‡òA§ÚOLúë‡ñ’ø/V“.‚ïi:Hý8ûêKá@B/`&•oPÐ5´´Bé¦Lè'¡&!À€‘–Õ˜S·„'„F’zOá{yƒÇüŸ±qkž¹ oªç¡œÊƒÌ´üÊ(? ¾®€CCŒ@Ñk†@ á,ÕNxI¡T#Áh¾ZõoDÐu7t§ë#öT²/2áÏ'â´"0S€êKîÏ‘åH, -{T:¦èK?HÊÿ#ŒáQèŒò>~n%þÌ9¨àóát©GkZ&Jë85 -;Ð?¸“("è^<óìªXç{ôC,µ‰,Ç£K)Œ¡Uðû¡A«q Féž'<ÁZNå½–§‡†ï;$˜Qý=Û9z=L@U²6XNYãÖLdÃN^: úÌaíd‚ÉäŠãk»11Ãtæl×Ùc¸‰5¸Oß±„Ep¯–»|­Ç…û. ÔÛ®ù›óÇÉ7|Þ8xtù„±¦xØö*ɨ“œ¡}yð¦F:eœåøix¬ßuÑ‘ë_ÝÈß?¥ApƇ†Ë -WHr-Á]Þâ!J¥‰D÷¿O„ÿ î‚6K¨‹)¡¯2{ ýç78à­_®ý5D^ò°«”ò0_Mæ3RðñõPa-T”ø™—oçà/t{RzüFÞòØÁ½G){£V!D•4œ9F÷b)ŒN64Ù“ãq -Oðµb‡*tß=”¦üPªœ÷XA稬Š_B4ÜFÆ`¤§X¯&ÿ’À5î É_øF| nñβÙöÅ¡¢GbŠRôžÑFI|ðžC\øsäK8(ÞÞûRO?ª8§žþ×Q'n/hTkP÷¼&t€´~D B=%§g/‚ -‚yœ¸•Ž}“…t¨Ð(øÝc‰6QTißD™-¾FÅú§#ñŠþRí¦UxT»–BLôP¡¸vüñD½Æ~Ä– ÁL–ÿO-öEG” õtÍC¬JÒÈ -ƒò¦æP`ûä±ÄÅ–J1endstream +4395 0 obj << +/Length 2644 +/Filter /FlateDecode +>> +stream +xÚ¥Y[sÛÆ~ׯÀL +΄Ð.°X™Ž92±¢Úì(3I "Ñ’„ €–Õ_ßs[\HHv›ñXØËÙ³ç|{n»Ôž‚ÚKã@E™—¤6ˆ#í­÷ÊÛÀÌß/´P,…d9¢ùnuqùCl=­‚LeÞê¡ç“© ά·*~ó¿ÿñÍíêíûÅ2Š"? Ë$Iý«_Ú÷æú†‡ß½}ýïKí¿…Æû?^ß.þXýtñvÕ 0QGnÿñâ·?”W€¨?]¨ ÊRï Ú*ÐYæí/L±‰¤¿»øpñžÏWÍiGi§Ñ¹º:žQ7ŽkR·9‚‡ü©Ôáò‡h¼D'NCoi¢ÀFŒPS×Ý_Ë8Œý˲[_V‡ª ŠË6ßßç<Ü”m—7³›H°œðcŠz± ¿D8[Øøȳ-¹ý/h×÷Á øÚx§é«&0¢!LB˜ÕAÇ#Ll˜èJ‚(€MC8ü8VþÝö$±Ö¯Zþv(é¶Z°¸6ñïá£ü’Æ»²áÁn›¸Õ–ëcƒäÝÈžyð[æՖͧ²ùÛKÚ…Q~I»æÅ3›±¥!¸‹0ó»Ýó"üo@ ÔÀiìó +O ª§ýrÑLšª[„))“ŽèC¾ÇQ<{ìÒi¦~Ù2íÿµÃ‰Ø ]Kî<ã’ú8š©÷ÜÙB'_€=|›$®]ͳë¦Ì;á±ãÖùŽûÿ¼¹þ•[G>½iYl©Á…b€x¥h¥ ‹YPœŽ‡;2v’» +òãîY†Ø7ªp ŒIÑ_§ –M&¶zD( +ge ™Å¦âш½fçÍŸHœÅ_¹„c˜Ðæø‚§>ºÔ=µ·”$Zm)€íŸ±ÅÅè·ùF†)À—aØè8—;ˆí{Ç4}€BÑûa‰™ËÌÜq;‡ÌÄÕÌgC‹Ù‡O…@%ÿW!Îê–Ǽm]zŠ LáFhC+‘#Ä㟄6²”uïo¿çF_Íä‡J„ctD˜O>çk, ©ãTF¾‘(ðÌ4*)38*‘àÂÙˆï¸Pœ)f"fA•_ð`9žR”ÊÂÏÁ(N}þÂÙXê !;0x¸7õ)u4€SE­N’„‹É@1=O’©kúJ³ã‘¦Ü±5È0ÕŠ²§[Fòôø"Ÿíl +†‚ˆ0Ê]"2ÆÕ¨3)nj´X Qþ®b… +%;g[ ªqà»D©“7F•AÎ#Ó²­å-*ö Ù0çÏP/Õdéë‘Z§¨âž}HÈ Z#{§XD…áVà–reô÷»5*Ž0¦@î*@ü+oFeh÷ø£ g "l‡ˆïŒ~tåDc¡¯ÕÜ-UMݠ屩ÈìDX*ø°‘ Ogr31)”vW?lŠ™”-KÞSå¢RÌ”BCò)=~,A 4–U…£¼ ®e€iƒnˆ-Y®ælÖ…+£©tì"/†÷ŒJ¼ +×ß&çº"²ÂMØÅë9ß»˜¼A "Ñ­ú£½ \ö )=ä(y΂o_ë¨xœafß—Šr0DAsYL9Y™óˆˆ´’¢†“¨ÜÞ#g øÜRvÁ§ÕŠ]yÅ[ŸÃö˜7ìÜQdÉóðÛk%3æ ØÆrs{¨ A%“ÕgŽƒçÇØßP§k%7ä! ZU1ºsã! ’ع»ÏBûn¶=JÝ:ï!”•{™Íè 5¸¾úfrËŽü]ÕvL͘¹[ _I`ÉãvKÛendstream endobj -4298 0 obj << +4394 0 obj << /Type /Page -/Contents 4299 0 R -/Resources 4297 0 R +/Contents 4395 0 R +/Resources 4393 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4302 0 R ->> endobj -4300 0 obj << -/D [4298 0 R /XYZ 85.039 786.531 null] ->> endobj -494 0 obj << -/D [4298 0 R /XYZ 85.039 207.58 null] +/Parent 4377 0 R +/Annots [ 4398 0 R 4399 0 R 4400 0 R ] >> endobj -4301 0 obj << -/D [4298 0 R /XYZ 85.039 184.262 null] ->> endobj -4297 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F11 2898 0 R /F56 2890 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -4305 0 obj << -/Length 3070 -/Filter /FlateDecode ->> -stream -xÚ¥ZÝ“Û¶¿¿B}£f|4‚_éù±S'Í¥õ]æ\?PubB‘W’òåþûîHP¤ÎÉt<¶`±»¿ýaiµ -àZ¥‘„Ù*Ic? -Õj{¼ -V0òý•‰k¹vdÞÝ_½ý›• -ü,ÈV÷ûAOøQ¯îwŸ½¿ÿãæ_÷ï?­¯Ã0ô@r}$©w·VÞÍOïn°Ûxoyô§;üÕÞÃÇÛï~^ëÔ{¸ãÛ÷÷ØþùÓÜñî5Yæãí÷Üûý/¿{¿þrÿÃÕûûaáÎÖTâ²ÿ{õùK°ÚÁ¸ -ü0KWÏðø*ËVÇ+…~dBiWWwWÿtñ˜Yñ¬%+EaêGi87S9fR:óMfV‰Ñ~šÐN»æ˜—õú:Ò‘wÌ»¾hùùoüS7¸1xɵÂ5d4§j¶yuqÊKÑ-Ìyj‹}ѶÅî΋hZÓñ`U|-ª‰x¡ôÛÊÝáuìëÌ~&¤áãN)õxjÍ Æ{.A¯òÜê9ä(óÿ)¸'矻üˆivNnY°å¾ÿÊ€s=°³ç¾þ=¤)öŠªØ⬾lj»†þÀrÇ|»Ö‰‡Òe V N›*é`×ØB;]˶]+w§MÍâ -¡c=îÇ_ôÂÎë>„dqì¨h”÷Xq×SÞæÇ¢çÝË´F¤|FíE»  ƒ4Zyï^ø-;XeSâZ¹ƒ¶Yvܘ¬™Ì–×ò¾ˆÕÅ‚ƒY;™öÐî¬ZìÑ^³Ç_å‘ýÐÜ©w(Su,ÔòžŸžË -Æ*nlàÕ°ZGs,¸³j¨—Û¬˜š&µlñyC¹—7öCñ¼•e·Ð{ÂEÕla›Ö©ý¡5ïØÐT{»¢Ï˪ãnt줷”ÒÉ q:í±wK^y†`¡R€E«b)Q1" -´+~øä_;Ò„?“è<Óèl‡l[âÎyNÄÑz^.EâÉÚ‡GKäÐl~˜°A[6èŽöηÁb(ÏQ•E^ß”R„ô*V‰¯bÞÕ°Leƒr!bžtœ¹.Ÿž?Gìħ¸ïöž/ú4²O£Rr³A¾8®G{¶"Üìí$Ö‚Ï6AÐx-ªªŠÈè’›ºè»7q)¯÷»Ml°ã'ÀV+G žž -+‘¬žq"™å¥ãQ KnpèÔ„  *¢ª^xï€(ØØ¡ÛÑ>ò Ƽ(tš{j›ãîä¿YÇÕ)aäšAd·gÛ³S ‘Ð_TNøñ‘¥!® ŽZ$¬0â¦Ú™ Ñ¡0’óôŠ<ŸÀ‰v…G•ª @‘žy„܆lÌ2¼Ø¾—·Ì7¿o'üF^Ô<ûBº…ÖÀ~?îûüHËÝäÕt‰µìeû$åü «ÑZùq˜ÀÊ(7þ¶©÷ äÀû‰ŒÈa¾®$³Â:þº øZëhF'þ_Šþ]ZdXßfK‹Ó.³¥à?5qèC^~•z;2F•ŸáîFø3h]°.Lh|°mI?Šù]-„0Ý’ƒà£“ÄôD«â„iXL ¢…t$m¡°ØáÂV °I_ßÊ(sÉNý4azüpàh -µ:çèÕZüLëIâó¸Çþ²ãßÝ@¦$>É:xê<›#Ÿ­BHN)l|ÀÈ¿ƒâ_v²¸6Ä$ꤨÏw× Þ³•ÕW‹”÷~Íi%!žFòr›`†h ,ùÛW=A,#ÎË b¢ÕðC#'Ú»“‹xŒÃ^T#íʆg¢‹îâÆBG›I”™>¨é#mØý;¨A [ë{&Àˆ<Ï’­MŸ©·ézîèì ›Sµ“ÁéÍ„ MæÐûÀ¹#àä!cÊŒ’»bŸ£±*y Þes±œâUdÞ©³ÉXZæ¹9DG-ÝèÁ É£x%Å®¨·‘”ÃñžÜÓçÔ1.W »¶€ü<¥a/…6ÿ:8eÏ9Ÿzs²íš³u]p»]W¼Î¡2—CAƒ C-×1ì™,(5üøLé:K'AÖñ\føô+2NTJ‚dø-‚ -+'{W¬ú±Â\'bhh"l22ÎÓPG¾JôÆ,+LbHJ™›h.ä=ûQ‰> ¾ÙÂÏ¡¤K«%xV•Ì~ñZôDð£Ó䉈½D£Uˆà/Œ;ÂMp$46éˆ*f88rÌ-fàx)¯xf²`˜j^ô%2†lq’ ݈“Í…S>¥]‘cÀщ­üÒÌ‘ßa_üÎÁðÔâÎõ’fMý -æu¨%ŽÝ_+.øî ˜ØÄ|ë†ßó[·a$Ô&ò47éŽÝìx€™µ"Ê ñ×¹‡äÒõ÷ܘ¦ ”u½á+øæ$4†ê¦ç7a¥ á6²cö(´OV{ÿVÿxñpWØ’ ¹‰ñnÜú[8»ã Y# Ó¹m™>Û,Ó6Uuv4âX„:‹J” õEl¹·Lõ˜ÿ^ÚTu:Š#\VY -<ê(š3B®I%nM*=,¾›zÈp¥*ÞÝ,G)3ƒ(@‹ÁÎ’ H©’àªßç-•OžÞ › -ÓP¤+zÑ?d£LÒ€¥¡¨Á¹B\:cÄ·5_: F®ð"ÌÁ-ÅJ¤ú6w°ƒasMÊøðF‘Zâ9Áò—jÁŠ°IܤóšåÖ‰Yë0’ÚÂ4†Q”ì,8•C»óÝ×uÛCÍ ±Ê94±5cãëXOAl‚4F‡p*”/û‚u–diè'jìÈÍ©gÇR䂧Ü^ºµ!¶ÓH¿\>ì‹ñæ®×ð’y‘ mªBÿ¾¯\¬ÓÛ¥ž9f©‰ÑÝRq@y諸VaÌX@Ãá1r qÆ®4€­F6"Òt60„#°Ck`‡Ì'À®§ã…;hYøŠZÎ,b¡F¶s{¿tICãr=Ù$ör´(©Ð…r'þkˆmÑù7{’8mèÚÐs““6z)( -Ž±}ñiÝØ3)¡…z9ÊÂHûQöí(³!ý¯É$’˜½Ä™Ÿ$Êŧ1Yµ„_´*ÏÈv+ÉØf¬‘„F -Ä’¸„&§ÊÄ ‹pM '•]l`UG”u’ð2’-œ]Ÿ•—Iÿ³R1ê@Õ„nÙxî“ë#öB‰Fy¯²`ü®0ýÐq–TÌàŸ?ÌȆ/fL²Q8CìÛL1æ §Ž p¢X)//åãÆxéjH뱨wœeu家”bÆR^’€StXNÒñkv/@XrV$N’ y`8ÊôŸrñH…“£ÏGÒÁ‹›]=°S ,„>8„M,# -r—ã`Ó¤ -B(¼ìAi°\€Hq|~Ü34<4ÕØ¢;x2Ü«Znýóæ–'ZÀ•öl/!4þ2¤ÇŽi›ø@±I j¤ƒJ—øÆ3Þ1¡R6F,u©—' n{ái,WÛèjòÝ.]oy[Så½õšÐ°­q_Ž>úr”Ñ^ñ÷‰Q¸ëÊ •”¡‹>bÀ/PûµðÔÚ17aaÇÜc{Ý´4¸›ªÍ{º´pE¨ŸŽ-ûU0FªQ“c[>6ßèôKK⺀ôïíGªœX;hF’ #&Ö¦‰-Ú®—OR“M:ŸzrÑ•¿Ü!!âÏ>C š"kúÁ(u>¥ ›}‹µ€Å>g亠j¸D£û½8Póc ù£L¤ƒ£»%4Œ}vbw)À‡Á˜õ3¸£-è#øqbìbÐéìÆý¯0óÿ7UäØendstream -endobj -4304 0 obj << -/Type /Page -/Contents 4305 0 R -/Resources 4303 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4302 0 R -/Annots [ 4307 0 R ] ->> endobj -4307 0 obj << +4398 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [310.193 627.598 512.306 639.288] +/Rect [153.691 493.507 264.18 505.196] /Subtype /Link -/A << /S /GoTo /D (browse-force-master) >> +/A << /S /GoTo /D (winbind) >> >> endobj -4306 0 obj << -/D [4304 0 R /XYZ 85.039 786.531 null] +4399 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [128.678 148.709 182.61 161.611] +/Subtype/Link/A<> >> endobj -498 0 obj << -/D [4304 0 R /XYZ 85.039 463.421 null] +4400 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [246.527 148.709 369.156 161.611] +/Subtype/Link/A<> >> endobj -4308 0 obj << -/D [4304 0 R /XYZ 85.039 440.103 null] +4396 0 obj << +/D [4394 0 R /XYZ 85.039 786.531 null] >> endobj -4303 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> +378 0 obj << +/D [4394 0 R /XYZ 85.039 650.988 null] +>> endobj +4397 0 obj << +/D [4394 0 R /XYZ 85.039 616.242 null] +>> endobj +4393 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4311 0 obj << -/Length 3233 +4403 0 obj << +/Length 1688 /Filter /FlateDecode >> stream -xÚ¥]oã6ò=¿ÂèK`­Š"©}Ø\·½ôÐlo“"8ôöA±[XÛÊIrÓüû›/R”-{8,6"‡Cr8œoZÍbø§f¹b]̲<¬V³åî*ž­aäç+% AY87Wßý”š™Š£".fÏ~"Žl‘ÎVÌÿö÷÷¿=|øt½ÐZÏóz‘eùüþZÍßÿzóÁfþþzßdþx{÷ãÇë$Ÿ?ÞóÀ݇‡GìüôÜ|¢.ãÜÞýÌП¿ýñÃõç‡_®>fš†Ú‘R™œsÔž²-“±Že"i´2e”V™R¨hø;œ˜H“†;R9{F~I[#inÚ/kRà 3Ni )S#6 ÚþÚ·i âvÇOz{&á‡yŠfU@7òÀð™è©K`U~Ü8 „– -,m 6Ø%Ce•˜h„† ÆEa%n¸â¶Ÿ7²€0ð4²Sí;€‚õÄ [FEóUÉ~lÃ[áì©|•{’ãþ%í¯vrRØ훕øwlã]¹ª¸×’À­7Û7ì§Ì™?I7Û7F9²UÛ?ÍA¯im\ƒ9ÒÁòŠÇž[± ØÙ¢ADû¸•‰Ãi¨rZ¦j‰\¨)ëÔôþ[¾ÿî€+°'ùدx ï#bLÃ,)—½Ãªv"ƒ,ˆho¸æµfCô!cë΋¡.UÄRÏpûŒ†Åz¯DwJ¦‰‡©ÄnO.‡šOÄÈJàiŒí9-:6áfÌ D¸exwX¯«ÎÙŠcÒÊm'‹Ù/f”7ÝY‰ÜV‚ƒª‰“õzÃʹÿæà@rT ›þèl+F©{þ¾º˜aß1Jµ­ØëÕ)Þ±€9Åyþ$Øyi«çªõq‰ ©j&<”N!€KœI~«º)“œE*OEháÅf 'Q>6OëJìâ‰Á…‚Sñ±dNWKâAÜ·ë˶GE}ùŠÒ:ÿ„­R¼$¶E0%I!\lÅXtŒ‚Ö¥öög‹û­|€¤k+vÖaU…O©)uV æ¡gÜÊ B×{,ì:Ž“‘Zþ<æ-®qwV4Ù=:òA’mÁ¾mÕ5ÞΙ4žßUý -øV¾g¤À'‰Ê/òD±‚ÃðÀ,có³gCÌåÍÍ0¶aDŒ‡C žåj)ŠŽõÍ„™l™°ç­6ˆÑDj~ƒÛ’‹…'z' M%"ä<…íl6™1ºìÁHèØÚCèûýq6â²›äQž¤“éˆÃYHùH‚ùSêW¢<*:ÙOÈ/oÇ(_Ù "›ÛÑnB8çBôc?çmÉ_çí±1 E±Cn½¤ô»d ÈŸ+ãm[N ‚¬ðÄ×æ§I#:¡8ìTˆjq‘Áåâv0h=¸#숗o¾ *oÄ%’{ “d Ÿä«B™XEØÛË"3 ]AÂ&gEæÒvNd.îæD&Ø­Æ|Ô¼'ü,·uåü>ö7å šè!S?–K7Ž8kØÓdævÅJvæÅíIR¶x­1îÇã¬ÙpðBai2D´¥‡Î‡¼ì}È·{é§ä†äÓÄ’‡.9:¤4”Ý mš®ç‰ª‰ÃD[‘œp´…d!¤ô±¢˜8Bèö%J) -Lr„LZC£\N;³xÃöã¬ÍóÔAÓ™†iŽÄõ¤‘N }­Î%|Ç"¿áJB&áõ+µïíÊ(Ü¥n”Þï‹SÔ¡5‚Þ Y.$nEK½¿ÔsYåñöî>{½SwC«ùY‹nŒ‚0F_VÏé¼z:¤‹ýâv¢ž—wõ wx˜dÉ”¥B°‹¬ƒÁ“v=ÉœéD”e˜xàc-¶ù­óµ„@$xˆ/Õ4ç,gn_ÓL‚âTf7œ?Û¡·Æœ³õ!°ËÆY®­xKJGSS“esêí´9)—…c¯5K¶qÎÁzQ4S¢h}n‚Kœ+Ì2MfGQ¼ÉZ2ÎØ<œ/[-'Uí£?XÆsòÛŽ·¿1v¹BÛzÛ†c¥|ë^¾Ž’™ã$~LýNI29¥q:Ï"m¿CHç5Î!]tˆ·»¼›h\¸Û+…—IV£ÏÈ%fÅñ• tç±C^¹zÏqÀ¿‰:åñtm¸ð^®ê6Ãæ—Ë ˜ê‹Co';“ÆËåüOy@ÌÝuºPµ“(¶¦: .87ðÎΤÖ×*aPäSç§Õ ZÈ%ãÐfýAÔ±þfÃß¡ ä9´’40ááÜ€žÓÃí¹6—p…]'ÖåŒIJ~‹×&á:€ÀB­¹Å,0/2CZnüØ2­xœÔ -Ç)%#O Ð0)ÈÖs~z²º¸¿IÃËE­‡ÖçgU{©©Áp}ØtTZªP2m}:L<á@–é$¹ø„àœz‚´ 2òŠçžž¬<=I Í€zLÀÜö֤ܺ> å÷Ä\­ZQ4\Ý9úeÛ‹ô8矠’"ò5§aø“g©=µ4íÆ%ï³äÏ7ñ7Üx’Š4Ì_1>ËåÊÕ4J’Tœ‡ UëôŸ`XþpµqìW•;zmÂN-„’/ÍÓ!¢ZÉlr£yê(Š©Fr^¹¤™;í}¶º¾­} ú/mÃq1y!|^²iNµ’z¿#"[_áljô…zðeÍãÁZùÉsðñq‚)p’®Ðó!„t&v—çä¼r?m@‘ñ·»‡q¡VêG¹‹ ø  -hÉÑAßfÍy#¿ÍÄ^ÛL,\Ó$6_èTB-Jpî·S‡s"yN×RŸu%À9¯ëI’E±Q#]OÝ33Õúše4ÙÜS™@ÍŸËåY5Neê²8Ô8N#cØ ÞaXÝ$6Ÿ˜Žv¥/Ð×^é;^Äç‰f"àô·ª‚ÂI9ÃùmøºP.G•>|DÃx^ý°C‚„ç@ˆÆ£m'ª,ñ¸Œb¼%•O†Jœ -4^+ï{ a­†>£ØÜq†Ö§"µ½-q”§ZªÔ@ íÇî DÌÞr²¼m-Ür!›$R*ÏjúUפQê_1/½ê‘q¹ƒ*êíúÀA7×ÐM¥IqÆ@îÎi—JMç— àœ×.ecˆ{íH»2Ñ®ß;qþ©DIáï6>U;ïhßï÷Ía¿”ÞKy ·×‚9ÿce²(¿ükžå¼*¬ ~ÉQ`¼Í„a»DÂèL/%Óå‚ä"—¢ÈÑ5« %ªøŸî9ÎRÁ£ŸOà6>ˆÂŽ¸ëoGá7@ÙA-kŠ°ÞVíù‘ÛÞ¤Ó9@Cø!_žÈ'C›ǽSG…~Ä" ·üÜ`Õ¤A8?æX5ñ0»â’l«ÜB>æј\­O‘ñ}!¿T‚ý€3—M½–>Ë8v¶ȃ(\ -Z[ºkÿ†ˆhu÷ýäeÓ×BÇ /™<=ðlbYˆhaìý ÀD"Zqç*zŽÖÑæ3w£èllÁ*Lj-üçÿ_¿óÊcrp¬É´òXp¨if1xÜ\lu©®ž ø¿YÇzUendstream +xÚ¥XÛnÛF}×Wð-P®w¹\^¨»­“:I-A%Ñ2a^’²ký÷ÎeIQ‘ä ‚@{™™=sfhåHø§œØ©'ŠCa´råD:+Øùe¢¬„gE¼‘Ì‹ëÉÉÏ&t”‰Lœë›AO"…IBçzùÉ}ùëé»ë󫩧µv#1õ¢(vÏÞN•{yzñ†—/Ï/aþbê)÷W³_/ÞM?_¿šœ_ŒLTZãõ_&Ÿ>Kg ¦¾šH¡“Øy€±*Iœr-L í¼˜Ì&¿ºx/pøÔ!o{ O%"ñÍÓ CÊpˆˆ»ÐA8Žˆ1" "ŠH$ƒ w––óBFîéz?ÃIèÒ¸.Ó‚QñþeVÂdåf î·0¿Í×Çâd|›øi÷2d¸2žRE" +ø)¯oóvêÚwùW»)O›zƬny¶ÂI¾ÌxÖÕ,Úf]—W+^D‰5!S?vçV•’ygõ½ÎðÛÀﺿt·Y…G»|‘vy]±tºâ°µó‰hSåa´ žÂçMÈ«eJZ_bT¥dH¾>{)xtÊ?7i™¨9mòO<ò:ÛIG;QQ¢h®Ö… Ó¶Å-4¾$¡%ŒÄ‘ éñÓ¹¸€§DbÌèýÂP‰@›-ð”«}Fº³¬Û¬]S-ÝzÓð ‘UÎÅ¢®nŽÙf¡¾aÛ r[¡ ?QdÛÇi¬ÁŽ$!bƒ/ˆ³M›ÙðÙ…‚b—öû€Þ¿Á¿g^!$yC³`½îðëªÌ-€= +£VîsŠI;ž”cØÌ&K‹’OÿÈJñá¿w8>ˆxæ+¤¶Óß.@°%ÙŦAó¶àî8=›OñkfÕ¢y\Ó’ÅaJWµS¸¿Æ»—í¾±YKʼ‘w1'øDFî‚ã‹a•±Ûb†FÀ= +“ Wiõ¬cÑ?¤ +0Л&ã…zcwl`ž¥õÖ*DõYsÏÑâýMKä°½à÷.–¬¡JËìäBMÉÄ +y ²qëRðÆþƒ02€´ÏŤFPÝì‚#2fp¤m½¬íÂåk¬4$ƒ3Ãáà „F¨Ðü‡2Yg¤9XÑg)…ô“£zè”=<"qý•š!å5¥·…0 F|-A Àp¨9R1‚ßÔŒ^|¯¯Ü´Ò:I l’yÎG $‰f‘јŒß:E '¥rÎj0ÓYjÕz#½ÌNñˆ”›‘q|Z“ôô0=AÙ†Šæ‚cNÓFa × xUw,²«8qà÷"™­¤2埶œ¯ÓíƒÝ¤ƒ…¢O„¾*ˆh´2u±$¤ÁZäYÕ!èò¢à­™p9Ýô¹‚]†} d Nÿámz{Ú€×V»ÙrƒuCZä.ú7ª“¡"üÃÏÛ¼ }cº¦ènë v¨$ïX9¬zf ŽŽò/¹mµÞ¦xEc™!ôI_µ´‚¨Û–î˜h¹glštV)F"½Ïp(ð|ä<Ša<"œ¦å|mm#"°X‡¡êqâ^X‡`+·ç³¿Pݚ߆Â×qÐQSÚõ£Œ)?b}o/ò 6yÓµä†ÆîÕ‹à#ºŽœ¯VÙˆ½ØéÚòà¶Z4J]~oëí2î^tæÆÖ-êÀ:ÚY¡Œíϸ_ê¯^Ѿ-âsºzÄ¡lîõEAô­èˆfþ?g!/*9K¾›G})"ÿÉ~HäMôd³¦}¼$7kþ·šµ“¬[œÜaºaàæ=ѹièç ›qÜÔ­ÌÑÞ͇ÖòÍ~X@”ô¼¤T9رíva@½š-w VXÓÀQ¥åý¼}ÎlªÇ†@Ô-BÍUŸŠ|¾ÌnÒMѵŸ ðà„ŠýÝVŸþ´]œñ Òþ||ûþJ¼>¿zq~õv­Ú¨OÃ*` Kè Õ¿Ë‡Œ/ø{? ï–‹‘Gj  %Àn@´Ðpùw|Ÿ|_÷-/ã€x=Q6,ö“ Ûê¬íͨqweÔø…pÁ‡<´”mp)WØßœ^žÿ„ƒþžÜ§SDÆ0(Ó»¡%5-7ŒFõ·gÚ¾–l#»<Ô¢õßT‹Qƺë¹hÙ3Êö#m d8ððåΗޑd1ðí¤å +ügS¾ëïCƱHbÿpÂ`½1Ä Ñ× ëÿ ú0,endstream endobj -4310 0 obj << +4402 0 obj << /Type /Page -/Contents 4311 0 R -/Resources 4309 0 R +/Contents 4403 0 R +/Resources 4401 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4302 0 R ->> endobj -4312 0 obj << -/D [4310 0 R /XYZ 85.039 786.531 null] ->> endobj -502 0 obj << -/D [4310 0 R /XYZ 85.039 766.606 null] ->> endobj -4313 0 obj << -/D [4310 0 R /XYZ 85.039 746.277 null] ->> endobj -4314 0 obj << -/D [4310 0 R /XYZ 85.039 540.254 null] ->> endobj -4315 0 obj << -/D [4310 0 R /XYZ 85.039 513.155 null] ->> endobj -4316 0 obj << -/D [4310 0 R /XYZ 85.039 452.981 null] +/Parent 4377 0 R >> endobj -4317 0 obj << -/D [4310 0 R /XYZ 85.039 400.906 null] +4404 0 obj << +/D [4402 0 R /XYZ 85.039 786.531 null] >> endobj -506 0 obj << -/D [4310 0 R /XYZ 85.039 329.322 null] +382 0 obj << +/D [4402 0 R /XYZ 85.039 766.606 null] >> endobj -4318 0 obj << -/D [4310 0 R /XYZ 85.039 310.45 null] +4405 0 obj << +/D [4402 0 R /XYZ 85.039 742.055 null] >> endobj -510 0 obj << -/D [4310 0 R /XYZ 85.039 240.989 null] +386 0 obj << +/D [4402 0 R /XYZ 85.039 686.81 null] >> endobj -4319 0 obj << -/D [4310 0 R /XYZ 85.039 217.671 null] +4406 0 obj << +/D [4402 0 R /XYZ 85.039 652.065 null] >> endobj -514 0 obj << -/D [4310 0 R /XYZ 85.039 164.083 null] +390 0 obj << +/D [4402 0 R /XYZ 85.039 344.017 null] >> endobj -4320 0 obj << -/D [4310 0 R /XYZ 85.039 140.765 null] +4407 0 obj << +/D [4402 0 R /XYZ 85.039 310.471 null] >> endobj -4309 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R >> +4401 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F35 2976 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4323 0 obj << -/Length 3496 -/Filter /FlateDecode ->> -stream -xÚ¥ZKsÛ8¾ûWè¶tÕ!€Tí!ÞÉd½;ÙØ)×ÖÌh‰–X‘H)Çñ¿ß~¤$Ê{HMe„Gh4úñuÓzÃz–;›b–å©rFÏÛ³x¶‚™gZ(æB2Ñ\Üž½ù-µ3«".f·aŸ"V®Hg·ËߣüóÝçÛ÷_ÎçƘ(ÏçY–G7ç:zwuñ‡mô†g¯nð7‰î.¯ýtžäÑÝ O\¿¿½Ãþ§/ÿæ‹/ÔešËë<úáëå¯ïÏÿ¼ý×ÙûÛÀøèjÚdû¯³ßÿŒgK¸â¿ÎbeŠ|ö íX题mϬ3ÊY#ýÍÙÍÙÂ^ëZ6·EJ\õÜ|®Ñ£ØÂA¨Xò*2 lØ–‰o´z%ãõ7±8Ü€ùzá)yßMÛ-úWúEI•S®téÀã/#K«Åü¶Á;@gQ>õbvÈT¹õbŒ„î¾Ý{©Û†‡Q¹ÚûMµ• K‚S0Ó¯CÅîày%÷ÚÖÁ‘-Õ ¬í’TÅ.{5Ñ;תÀ(?²smUbH6`}±BŽJéâèk/ú–f¬OðK1_¼jCQ•ì¥ó‚añãc‰(À®êN]™ŠÓׯ2ÐLø -¹Š-ŒJ9Þ¶pn?nCÿÞ#@ê§QO¼âÌcÉ| -\L9âã„Ag…*4²ˆõ[ÈÚæaàÛ\¥±§#<§618I3<”@¶† 4 ö\ØG´KÞ&I ‚KÅ~ "ý¢U‚ŽW"ƒtk_“ª6¢ü $`º&Ä›ˆ3¼Ô™zrh -H¸ [È ÏÙ©Å07¼(Aìˆ!˜R,£éKaÜ›¨°ð h¯?žç&úïl ½L¼^šèfï¬Ïȥ㱠)ì¬{òh--Œ1d΂äÂ>õ·yÚ Hʦj=<¥É c)ÞJø¡ô„¶lø—d‹ @½âw3Œ0~ïÇÚ² -x -<3¹¯fcZÒyïKÈ«üÁ~&à  Ox3ÀŠ{Ræ ýÚ°ÛBÛ¾…àPÝ¿0‘¹çîDV FHˆmÞþ8»ž0¨½]ó!cVŠ8$²„5 6r6d -}˜@⿬#$†ë}¶&kHjcÂq¦†}~Zh >ÀßjC2+$”ÀHX{â±çÏxœKNãÄÑ»¾ò¨AX%NÅc3¥{Õ hB<±Ê@*òñ[Ž­Ýäi€Eµ™o†@*RîZžÙ–ßBí¶^—C¥” 8Ï_#?-Ί¾8Ôd2¤©"I+ÁA/6Ÿú±; GÔ>ƒò™š9t5ňƒ*Ê„y¼°DP3Ò‡Ügyñ$NäÇD-?ÂÞa†kLAžŽA3œÃc~uÏÝ’°‹ B>ò݆´ã~ð¾{~©ê†©6¡t¹"”‡º -Ø•!¡miÏGp*IœJ‹ôç\ ì5m6áM®LªÃ‰Ç.xfßÒÕC)Ï’É°ÄäÖÇuë ¹N³,Ï 1Ä'î“ÏsCAÖ8sæÃäœÇ& EXt˜›,”L¯Sþ|9âkP¢¹‹uôŽ€ý ¯’Ž3¯T1(6Ç Ö:JØáêTÃßP{pð´öØØDõÐ$ç±'@܆³8lõÁÄ).ÛqՆΧ/2ÐÐÎ/Ú;Ýg’ÌF ü\Qa„È0|䉻f$Ÿ.÷lÈFÞ a›$FÊçÒŒœË^H¨Ìä]š~Ý,¨~³ / TãLéÓ1E¦Ø‚FióŸ2¿×|´Ù„éıÊöy¢)ÓÁ™€°-)e—©¤re*MÜž¶j-Hƒ Ñ器ŽMxY_À.JÙê4âJ+VÇS£·ÁnÙ3åÑ^xbUí¸AN{_39¦€bÞ G”Z×÷þÈÂŒ 2•JQ)¡äd´â^]mÚ7Zž–añ9'lÙ¸*êr6Â×*^ãGÈsÜéÐ SüåBvâu{õbëAæ)œ Cƒú«ûv„ë¡–H&YÆÆÁÄî‘LÊ=ÛUÛð¬Üâ;²çQR¾f‰VEFa­²?g²Ó5•e¿€€¡àßħÈE׆êÁq]ƒÆÙ_¬XCÔ1»ÖZ–“½ RâQÒ}ø=ðb0–7 B$@‰z;ïáB ”“êB:ÊDwK¦¹ƒ&%&“)8`\•'Ék)øÜÓŒ%ô½Æí-˜ÎØ^€ý¾pÑ6 IvEßžªåTeYçJ;ŸÓo¶øA¶Ÿ*,™!Sá–›1§¯úTÚ„ÖQñ×Ð_ô l\•´™¸+ò%o4*9öLL`ÓŽŒ8ã×FådOœ&œöÿBÂתÈANÁg7 -D°¤W¤ÁÜÛî¤<#`˜ãñ© ZÔö2Èz”ˆ¿]pFýQ¡3|_ƒáMv„-, zôBŠÔÔ}ÐA=d@Z2n¡öÇ«‹¿õêd4¢iü¼O¼ NZñ„¥ºãæó0,ÌC‹1›I}å†~¥J%4ð,ÛmI/ [qÕñæ¾Ìƒ …5§,ÿÕ×a] þñíê/ÂBuÎæ NTU\ &³žwž2ìÿrì˜ãÿ0‰„‡endstream +4410 0 obj << +/Length 2444 +/Filter /FlateDecode +>> +stream +xÚ­YYsä¶~ׯ`*• +§*CÀÃO‘%9–••7’üà²ý@ ) ³r–ähJùõéà€sÈ[^—JEF£ñõ…^ÂKuÊÌKÒ8ÐRx‹ÕYè½À̿΄¡˜’¹CóíãÙùw:öDdaæ=>|²0ÐYì=¿ø—ß_||¼¾ŸÍ¥”~ÌæI’úW?΄ÿáâ掇?\€þ·³¹ð¯¡qÿðýÍÇÙo?œ]?Ž8" +)qûÏg¿üzˆúÃYÈ,õ¶Ð‘eÞêLih%M¿>{8ûÏÈ‹ç”Ç«ŽÖRÌ# ‰¾d;P‚õÑíBÐŒ«ø$ZnµÞã2Þ@ *ãh¼XyB™Öx y%@M ¨º»t: rË}¥Zê0SfÈÑûì‰ TY&™Äi“ð»3ÑÀùÍJxW-ˆé9’¶s‡/I*R+"Ê‚8Ñ^‰@Á(êãr†RÎ¥~ÇMáçШW8ú+Øô÷žfó(±ô [¯í¬_ä}Étí,Jµß°Ýn¸³­êš[/¥áy™7À¨iM÷×P¨¦@˜fþ-²½ºä‰g ¾ ñ…É®ü¼)û¶.PÏxíQ”ÑѺ2§CÜ·Hƒ'­jP*Ü.¨Â­_˜ªjª¡Êkî,º²(ì÷<ÀGòn<Œþê¤,»'G(jÏ;Uæ‹Ê™ãd_6=lôJ”"ØG‰Ê4¡×ÞG1Šo>ßW–TAvúÕö©ƒôË͈uvÊlÁž-‹v•W ·óaȈœeY çáѶ㵕ñÐ$7ÛUõPv´ÄcRhýÆdŽKLvòíkÇ\Ask:ös‹·Q·ÆÇ‚ þ GÞ¸Íì¡a2Ô‹á%A¶È™Z‰·ûeÞÛÌ…]ÅÀãäïsÃØ‚ñ4ý¦3‹G#Á òÞD ¼–ˆ-ì žª—%Lgg,C„=7xü¼ç˶ ±Ö(ó‡î)éXùmʦ\ãÆF44*ËÝ1ªC,‘…¥¡kaÐc„¥‚¤Ä +ÅÁ; ¶à¹ùñ œ› ê4ño¦œ¹SP,üûÀÌ8âá6Ö±Óá¡FÓF‡P–¥y_Úê|¡’‰´ySl˜È K²/T”¥þ­÷xâÖƒÁÑèT³Ôñ‹ØãÔ ³)Ͼ 2ŽƒH$ïjÆÒ¼/žŒ³@%r"9ƒ,óÉ…blE‰šÒÔì6ça<ÂóäÜ] ›.Œu-è¹Àb •jâ"ÁÝð#EÛ ìöè%Áðûgâ3½I˜ö¶jx]J]'ÞÊd•žNß}ÎshH‡Q蔫–‚oÊÞ" T{J Qà È2¨ð°y 4hfoØsh7ÍpJFÉïɸ£9é.$ŽH“Æš7Žœ¶é­ur´¡‹;ËÜn)d¦8ZO¯“Ë¡¾¯Z±ÚýÈõó™×Äíu¦5î4Ö\E5Vk‹¡µ1SÐ[K@h3S]ËHL <ÃÑ@ÅìùwÒÕ„J%ƒXrEÓµíðW` +üäpba:ÓsBpíùOü½(VP/ctáþ¶Îû~Ûvʼn{‹À—«ôý{shFlíß[$Ð<§Ð.•ùg2D[Ý >Ÿlð50ƒ\¤EŠC/2å}4è¢ß>&P$Ä* ¦›¨ ÒÉ»‡°4¾+óEDÙ±èáÚ "QÞ'ù‘í…2ÑÚqAàä0Ù÷ãR*J=G¨ÃÀah$Ÿzo*}£‰è.ŠédØ‹0ìt%‡8">¼Ø˜eO"BuWò³ƒ-qåÞº`aê${tƒôÄñy¼_KV8gÇ*"€Ð®_¥D¾E,'úöM‡>ë27æK9$?µŽ>eŸµµ7 yfG¶³våßZa­ßïìëjM8µîÇqÚË2/0Üñ„ó3ÙÚ€É~ÝË7ˆÀ±x³#ÉiÈ2 eW¥Á!ùlìÒsè¬ ³àÒ©€X>3Šyvƒ·®¾!m¯fGÞ2£8 â4{OzK²/þ·ü¤ŽŽüãËM‰]4‡^Ä%"|ëöŜȥ ņ-ݱ=ºbºÌadL‰¦2’Ÿ®ïï.ð'«ëÞãVÿþ`B>–J1A&ãZ°âÚ>¯†ØÕö§BÖvÉ5Pô28rË<3d ,ª‰©a¶4fFZ(§´ã#†(ÖÄôÙ8 žó¸Ç„>óWý47•YzâùNCA'Ê +CÁ#=U‘Jüüýªiendstream endobj -4322 0 obj << +4409 0 obj << /Type /Page -/Contents 4323 0 R -/Resources 4321 0 R +/Contents 4410 0 R +/Resources 4408 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4302 0 R ->> endobj -4324 0 obj << -/D [4322 0 R /XYZ 85.039 786.531 null] ->> endobj -518 0 obj << -/D [4322 0 R /XYZ 85.039 526.057 null] +/Parent 4377 0 R +/Annots [ 4412 0 R 4413 0 R 4414 0 R ] >> endobj -4325 0 obj << -/D [4322 0 R /XYZ 85.039 504.86 null] +4412 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [445.319 411.826 539.579 423.515] +/Subtype /Link +/A << /S /GoTo /D (ads-test-smbclient) >> >> endobj -522 0 obj << -/D [4322 0 R /XYZ 85.039 347.155 null] +4413 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [110.886 398.277 250.888 409.966] +/Subtype /Link +/A << /S /GoTo /D (ads-create-machine-account) >> >> endobj -4326 0 obj << -/D [4322 0 R /XYZ 85.039 317.75 null] +4414 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [272.982 398.277 367.214 409.966] +/Subtype /Link +/A << /S /GoTo /D (ads-test-server) >> >> endobj -4321 0 obj << -/Font << /F64 3112 0 R /F66 3242 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> -/ProcSet [ /PDF /Text ] +4411 0 obj << +/D [4409 0 R /XYZ 85.039 786.531 null] >> endobj -4330 0 obj << -/Length 3349 -/Filter /FlateDecode ->> -stream -xÚ¥Zmoã6þž_áû´°Ñê…z; lºi›Þm¶·I»(zý Ø²£®l¥’¼¹üû›gfHË–ÜWÈ!9çf>ý³,öü(Ÿ¥YâÅQ0[lÎüÙšF¾9 tÆ…N¹̹º?{óubfïå~>»_9<¹ïÅy2»_þ<ÿêÛ·ßß_<¿ˆ¢hN3Ï/Ò4›ßó·ï¯Þlæodôý¾áüÓÍí»ça6ÿt'·×÷ŸÐÿðñŸ¸úÈ]™ssû@¿ùáæÝõù/÷ß]ß;ÂG ¢dÿvöó/þlIGüîÌ÷¢<›=SÛ÷‚<ŸmÎLy±‰´_ŸÝýÛá’13“US\Š£Ì‹³h̦ °)B/ -ÂYÇ^bRæS±]ž_?Åéï¤õXÖOħ½|ÞSó±D;›ÿëý•4úF¦VËr nôÕŠ¦½È`…%¯:é¼{åIëJ‡—4Jø‚ùüÀP{[õ}š­¢Æ~•®~®êZvz>ÓyÓÒàgj¶5oI|'\`QÎGz®úGªaóŸÇ!ö[×¥€žAzÓ~^m³Ã¡Ak”Îo›^çôE/xúGáÍè -»Ç¦`ô½=Z+àF ÊŸ»!üÓêöÃý·"GØ ™8̲‘A>µ|¢šဖ°J‘µåªl[KÂR‘2<.›Ò:%šåž¾Ÿ˜YK!5ü:õö^–¾k68«ãϽåEÍt ÏVu¶”ÇV{ÆhÈh”‡†xEQÆ8h7æm¹Øµ¸¾ì|‘¾/³y»QÄG~¬jÙØä#È$¯¤=A_§Ó»lBn½ëËVú‹F¶cêÚ‚®Ñöµ[al7:oÌÇ­«®SRmeé¦è+(` XU¿œgqkU¡‡ ûâæþ¼YÑ7ËT›Ã,‡ -a½vT⥷hÚ¶\ô„›»v#îTŠèúÇk‚~Äî?骺*-“Ñ¿ÿêû77ßË짶Q£q¾Þ¦–Ñb…º=´ç¹˜8ÐMIåJÊ­ãµZŒõ®-—z9*ÞÔÜu|IùàÂr–í`¹½SY’kþ:ÊöMŽ³ù[>Ñ‹î48¡“€B;¢»ÔØ6½½a¦U¥w‘£ƒŸ y½;·Š°<%í„a'²'´S_ä5´¦9 -¶Ô˨ØHŒÚ]Ù Ÿ«*ì,¶»}‘åb­ŠåÂ3‡ü -€yN«Ø P´åš$¸™Ÿ¯Ãα3¥qhªP–÷4t qû‘7õÖ¥®èÇç­³¨(„ûÍN'²‰ K}ºø­lRlèéÊ×è¦d¹À&£ìŽ)å›ÇaùXwY -ÂÄß[¶ue9Lf<è˜o´ -ù¨‚ÆùèNe:î-؃¢Òζ€C ü`lË¥Û¸ë Ø&‹6ŸÉ©ñ&Eß—Ìk8¹^'>([€¨?ßNÜß^:‰› -\ÂR¬Ó³u«,„ ©%GÔ´¥tY&‹¡# ÎYN8¢‹å• w2,#÷Ö´vÍIcxcÄþ‘ÑØȯ•mB*ÂXº&w×ã“ÁЫQ‡Ñ_ÝyzÐ5Hã¹ÚvºØ÷ô$ÚêÜKa¤º+_§ÉYåéTo¾Ž†q[dB/Lì±:m<:ÖJ&x$²‘dÜÀñ4óŸ×uÃÇ®»_"qÁÊû'¸ùcó¦"QXvÎ’M,d&ë­Ÿ©‰pq: h¨¥SÕ(øéØÊì×ûHL¯x ìóÝW…I—ºÈ{ðlÄá-Oºñù‘\N³k§.#óBŠ¡ÿð.Lî™Øè¼Ó—‚~‘M'.b˜QØè=ŽRÏ$ñ§Qœs:4•RøœYÅñi4¼È'4ÒâÙÉ– KùÐÀË÷iG¹^‰´#õ’œ M³y³f2'$#çIB6¥XÖ™ÉM -ä³ßè4y`(áoÐæsìÇ€77›hö®!ŠgD Þ‹bI–²a²'^NI’É3/H"¦ú–oè Ëdf#ŠdÔ±@g™LD=;«ý(X@/åóâdUg÷Íš»0¡ÓN`ìœË±S* ë$™ÞRR†'ö°-GÏj®Yvõ¹zß–ƒš*QMìãŽû×Ü÷¯4¼—ˆv+‹þIÌO~aé‚®Ót÷‰=RÉûJ¶XmײüAœu*™³ŽE< -Ô@ÏÌ·Y©®È*/¹7ź^œnáoÇ’fÒÀ‹éÚ÷Rüÿ«´.ÈÓÙ–åMKIrÈðSZú©ÔïÕGLDSú(jjÂÀ3¹È2Iz 1 ,Á+–}/7B*‰°_˜fRN5ÍIÊÞP‚„‰b‡ èèIöûtîçœ.Pß÷2âè¼æˆŽ5‚XÁþ™>cN@ &9Åxd©…ÃO §baÚiŸxlér2LA¢kñN; 8µÁÆF°@áRŒˆ²ö²œƒ±Tq Zz9ÊDô|°Ðe%A¶wƹ«zéàÂòpÌC]™ÏúAcŽht -Ó[Ç'ükXO)výâ¨A ;jlb2½j8•^MËøÐÍÂQNÃ<–ð(7'£ÄxÙŸòÇ~4áÃ<™Ë>Æ -˜œ¹¶ò°èmU-+9Ë*…È¿“­ c.;YZ~q2tô/e7>&bmhß´²íˆTþÄp…!J&4ƒÈ.ÚŠK‰d‚°3¤ö©t9§Zê.õÙ¥E[lÊQ!¦-ËçuˆÙÑ\™Š£x~£äíå’:SYÜTøçÅ0ÏçM½Pˆê e†¯å3ƒ[´¤8<[ÒV.´ JšX å-×Ô=$Ï׺VâºÝz]j’¹<܆;\Ì\·ÅÒFæþty‘IÉe.´Ô¢U‚ T½“ôµºþV&:Qê~bùó"àºÜ×üxo e‰¥+¡à·>È bÍâù+Îö_I‡ëaØ–Ù×å”ÔuÆÙš8—ŸÌiÞÙræy˜Å6]ÏŒMè2Ö#Æ4K~)¢9ÁÁ9< }vCå“Œ2 …?¤ngäphH¨Ù_Ý|¸ÀVUC±Ê (GŠKS‚­q$§çváæµ@$Ñ–‚ÑZA6Ñ—î»[}YIQ3"ê”2tec>K8ú{+èb‹8?rÁ½†ˆaj{)Æì„Á€¹b$:n¯¥a GñQŽåˆÐF¦Ý~¸WÌÎ7RGä”®fÁjLûî¯Vót̺”Ïð^O±wà®´bËßVAÔ±nX¡c«ÁéøA½áÏdä&”:½–2|>ñQ÷ñNd)ìÓØÝ0ÍÆ·K…ß&>ÐÐÞÔRÇiW ê²ê¿£P$ö;Ž¦¸ì"!bµ>\“Í/ä#à -;°¹Æ¤|` ,µ6½Û¨±ÓJ;æز=ϳçè ®nY“föu³\eƒw””Y °Ýù÷üýEpp˜Î4œ¦CFëjÁÏ-ਈ¾¥5zÔKF•ík)ºÃšXjl‡"˜ŒãQ¶Q…c¨«ªc šÍ†Ñl¢Ñl"OšH4Kt7›§ºüïT$»{pÒ9H}ûDYÙ—ªe -6?Ä™I2 ™LƒùûjÑ6]³ÒµHó\Y‘§„î9 䢵Tµ;B,3ì˦ķ€´åSí’ãÂ=Kbˆ#›¦Wéiêîõ8íÖ¾B‹‡’¤Ú‚X*[%EŠï†?}µ¨ž -~¢0”GÌ08ðuËbdÛ†²ñ^×vòU»ÖI6SS°ïw\í°=Š¥/NÜcÎÄð92bWƒ¸2¥Ô4³¡÷?&ÏÌ3Y¬ã&÷T€Öñå°ÖÆáèfzð°€” -J!zô].IeL&,ÁôçÇJbéʦ†Žiî…É¡qR[$ªRQ«¡'ÐP0¨;JÄûvÃ1îRV;‚1¼·ïÔ±n’šò¦+ö:pþ1ˆÇ5T}Øi€‰ývíà-6—"ÐÞùN$f[­ë„úÊñv6ðô‘ Ä3çDÄ9–Go [?¦B.À/UÚRçR¹—êh(û“>ôíj˜j -5ƦåY~”ë#h&Ë„ZWÛƒß䇺‘ª»Z£ESüÈA+¦­ƒ®ÊéZ[{F~Wt\j£aÆ_úÍѾ`—yyN×ëâ0õ’ÔXbÀý,:&Øþ6iLñÿ1ˆ31endstream -endobj -4329 0 obj << -/Type /Page -/Contents 4330 0 R -/Resources 4328 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4302 0 R +394 0 obj << +/D [4409 0 R /XYZ 85.039 370.458 null] >> endobj -4327 0 obj << -/Type /XObject -/Subtype /Form -/FormType 1 -/PTEX.FileName (./xslt/figures/important.pdf) -/PTEX.PageNumber 1 -/Matrix [1 0 0 1 0 0] -/BBox [0 0 31 31] -/Resources << -/ProcSet [ /PDF ] ->> -/Length 557 -/Filter [/FlateDecode] ->> -stream -xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù -ä -6\>RgÈbÏWÖ¹j[†› -WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream -endobj -4331 0 obj << -/D [4329 0 R /XYZ 85.039 786.531 null] +4415 0 obj << +/D [4409 0 R /XYZ 85.039 335.713 null] >> endobj -526 0 obj << -/D [4329 0 R /XYZ 85.039 430.791 null] +398 0 obj << +/D [4409 0 R /XYZ 85.039 238.488 null] >> endobj -4332 0 obj << -/D [4329 0 R /XYZ 85.039 412.123 null] +4416 0 obj << +/D [4409 0 R /XYZ 85.039 204.344 null] >> endobj -4328 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F11 2898 0 R >> -/XObject << /Im3 4327 0 R >> +4408 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4335 0 obj << -/Length 2899 +4421 0 obj << +/Length 2777 /Filter /FlateDecode >> stream -xÚ¥koÛÈñ»…ûP -hr—ËGq9@‰Ä×Xq-Œ"ÍZ¢m”¨#©þ÷×’”D»i‹ æîìììì¼gå<øçbãz:Eqèí–ëot+ŸN|Á˜ʤ‡ó~qrú1 F¾ç&^2ZܵtÏ5I8Z¬¾9>O¯ç×ã‰ÖÚÌñ$Šbg>öéåû)‚ç”W/çøUÎÍÅììëXÅÎÍœfç‹œ½þ;Þ_Ó”q.fŸú鋳óñ÷Åï'ç‹–ñÞÕ|­‘í?O¾}÷F+¸âï'ž«“xôcÏõ“d´> ŒvM e^œÌOþÑÒâµ`Ä»†¤dtìšX‹Iy=1ù¾rµ¯F‘1nD$§«*_ƒPÒ±öœêy<1 - ³ñÄy>NªY…×<ýè›=ª¡„0‚ôþåùAV¬Æ“À§¼Ãoè4oÜcÇÄn†²ïC¹iª²`®ÆXÚdÅDÎó{Û¢Àõ@û¼í·º±ÄFÖgÄyƒôžðŠ%Ýóî7D:¹(õHÛ£¯ª²)Á|g |ûN=DÑø ÏŸ¥¸øp5Dc¢#ß áÊí ù©‹ïé€_Ð_˜¸:NdÛ*Gc(Êûm;vpºÁaäÜ䘬J´þ'YN ¯•~CÄYãàá5¯Ï.ãX;%›¬(x”ògž®qã­Lk¶: ÷Á2ã­%›“Ü8ÚÎÅØgœt…ÜT´³®²M·0KƒçÏyG¨ ):°âÕ‰¬ŽwÝ•EÁ—œ'Î=/$5ÁB¡/³Lão÷Ey›âæï à«.›¼Ü0–KB*Xkº¯5oïÂõúÖ]–›»õ‰˜ çó!º œ¿ PŸhåªHÁ×s½8¦½pEØa‰M‰Æïøóë&]g<,e•€_PB•Õõo¼MB8EË)ž²*p@IZ+ýu€Vßø™…¦VáW3øe]V­ê£Ÿî¼ç³Ï5¡=+¯ù¤,·&+ÅÃ,—ÏЈvv>‘EªflA½Œ ‹~h£ÝéAdwâ >ä O‡{–Áž©¼©yp›¯8ã¡jz¢€¿.Q’«öéÌÊÐ4˜&Ý*md‚þ€"ÀIk÷8¹„ñóOf_a&ã÷çø œùyË7 ëüúÀ •ŠÜ$´JyÝÜ}›»§âS0g]€ÿÞR$àpØ!«8v=_À)xí_«ÀIQÊ´ŠÇ1Ç\­­m J¬awc”ÿ$À\ïxùñËN´˜BÃ+·h -N 'ÑÔÆ%<‘c‘°Rï¶[@Å-;ßõHg‚Un‘Š>tˆâxáý ÓÞ -‚Ý -lìÝ€WÅÄ!óß8ð1 ez±lÐ3•ë+_Ê-J…/LÖe´á4CbY1ˆ’*ƒS’vîÒ\F”äá[7iÕ¸âiJ¹¡'†`8ySàšè É΃(}ˆ*Ø×r4ºBP ²$!R„¨ò²æ•;ráijúolªÁÅÝ–×–UYÛ˜ŽÔv·äŠ Oo«6OÕ`¬`d¡¢ïшNEÞ‚é²nä’ÇQ`•5(:G%¾,ái÷–Æ|O"W³ãW8b jJ§ˆÜÊñ…*à8AA´»oh²êè281oaJua=ýغÑæ'J…ûtº2—f üF΃o®T3°yÀ ˆh¤lJ,‘H‰ì¢ïwmU"g¦rÀ6­de\¦Š/<ÐrsV®YîÀµ,1:&Ðè#Ú¬í:WÊ(ž[—±z$´¾e…$ͪå -gm3$uê$`=F¨GXÕcÍ4Y\D½§OÀÅŽ/·¬Ý-ãGnèG¯ö=œ¶9òݸkŽŒ§ÝkpãÂ}8Œ»Ü¯©Ãйζ8C‡È—)yÜå=ßÕyÁ‡<¨:˜Á †,qÐi+æ‰æh̆cñZr~`sŒÚt¿ ¦9>Jî­ÊÝýC/yaWÓ@ò§¬ ¤èÊ"Ïߧ*Û« ªçÙD¾£]ääèÏã8à}ÈVÉ™®à ¤ýNÙJ„‹»éØ°»‘“U۪虱–©½zk‹ƒ8âËÁÞÛN‚­1îÝXbt¶b@*‡ær¦e‚š6• Ɔ1°R°©᫬KœÜH_kIÈ8ÆjèÀ§}ê"‘ÍPC¼‹É\jœ´"¤©ÜÃÁºm`e͈«®ŽÅJDéPîT°SäOöZ4î§Rl)Úm9+â)é†imÓûLN¦è‹°6>¤øwÉ…ò ÅHÞÖ ½ö -´³Ô®dY•tïÖ6¸—Ðc·*I÷sM‘íG¾ê¨ìj`š‡© ¥xs@%9e%:&•¢(Ä8LWjŠª/xý5¬‡ór$ @\Ê7{¡LK(›ã•—Å$:@Š<ß4UžÕ/1&ô^e¬Ãy9‚A±á†ŠøšR‡Þ:pS·œ§ç¨œ¬%äž×¥<Æú( ö<ÅÓ9u<|ÅਟB2¹Ý‘Q“±Ã©«²Ó,¥Ý6N™Às¦dä+–ú’‰‡(%þ¨Ø,JQ ûÖ€°”?E¾éö‡]¢oìÖåî*m†:#ãƾ}¦Ãš(¸@}ÞB ;Óqc`Ø„k»Â¿ó‘D x-äOwuuZ”@ö´N×·éé”æõPÑÄ0´œI…xžëÇ{‚<KHœFÌ0âÃx® -ôOˆ£ÿ.Ò¤6‚é`/j`SVVkž”wCo%>Œ©è=c¼™M/ÏYüóêü ¿‚,_x0=;»>ŸÏÿʳ_¦ŸæÜyûO/Ò[@|Dº<êxË0ŒgYóþâëœqz o¢d G[=àpžGÒ¢ìnÏZC»ïAÇnorÎ%“¡h]NŠ.÷a‰O»‡S|oë²@çk©áÈ>A;o¯Ž­‘+£E¨A¹"f.ôËP¡& -ë’%™´ƒÜ7µip—eÕÖIC·©·6 mìRÒ**[:Á Êîóº©lzQ6ÑÁ4òø4gÌ´²O=ûƒ1©ÁÁ…¤ôB n•:8Ôórö+/;SÉ`](¤õÌÖCÁŒ_R%þH€Ë§ÓòQœ±ÈÙ…Ÿí±*r½„}s9=»œÎ~ñ´xˆï£’XG±Ì!Køaìú®b@^E>iv—î‘YË[YçÝš 6-Ï) WídRožÚ'€î¡ ®Gã^IŠm©ÈåŦ‹û…Is\Œ,¨ùþ²ÿÂà½*»~t9”÷?‰¬GqñP¢÷Qí¯¼^ù¨l9JÜÛúú M¥îk„H–ræ„aï¡S3Àú¯FR[sENÍ^Te&RÞtü€ÒuÂ9+íèƒë «üuŠÌˆ)sÙ–Š#û­¡H1I%o³«:íIõÐçYô)=mÏ…þ¸-Z#ëUšÖH8IŽ}¹.ôý2lòjùÕÃiëÂZÊ°_~ùžr¯mqC*eç3¿BâëÍÕÈWEŸóMóRI˜$ÐPǯ²Ô¡¼\FÐvÏhx¬âÄ[ü¶ÐˆŠ<1çXT3¤fãÅ_uè÷ÜÖ–)?´ ¹ý˜òÌX]a5î5=¶àADòúlåNnvÜö —%;pÞê±É¥Ä@>Á†H,_'³'¶‹MÛ5È3y›©Õš_¿8Šq£VV/>hãü3ô¡¢à?sòýDÝ5PËÅjXÝbt–¼z2lÊ>æøßT7·Ùendstream +xÚ­ÙrÛ8òÝ_¡ÊK¨­Càõ”Šìx¶ìÌÆÞJmÍLÕ0$$qC‘Z’Šã¿ß¾@RÖᇙÊA Ñht7ú„ü™üYºžJgq¹¡ògùæ›­`å¾`,e1Á¹|¼x÷1Œf¾ç¦^:{\tRÏ ÓhöXüê\ýôá—Ç›Ïó…RʉÝù"ŽçúÓÜwî>ÜÞ3øîææ—ó…ïÜÀàóÃO·¿Ìüùâæq``¢¯ÿ¿‹_÷f°úó…çª4™=ÁØsý4m.t¨ÜP+™Wÿhñšžñ®cÒZŒ…Ÿºiž×H¹‘  `ÕwÓ0œj$ ÝHǤ‘ØÕ.H ÿ-ÂÐsçià”½h‰bçy®<§Ùµ<ÃÓ"Êw3õÚmO© +dP:ÏûˆC¼ûá‘Û |7ôñ~»„ãýØôµáñ›²Æ‘ï<̓ÄÉ:œ(§Ûå9òg:’m¹ƒ-Õßq-ñ±ÙÉ®²ª˜Rg ïÍx^£¸û‰çy³Ùîz ly{F§äÍ®F¢½å`%ês- ¯yŽïi{yûé±ël#7K†XñÐ.(má£E¤¤…‡lƒë_36_дßF÷0R |?ä}É 8×Î52Õâ¹oÚ9E ¿y¡‡k²¯'íÂàÍ¢¢à(ié°7¼¶PSöÌêk˜ý[Øê˜~F‹¼tÕlpm ’t­ŒAìzà(ã'd$ é*àó¥¤ý Šò„$“È <ÏãU§„’T 7‘ÒM^W‹2¦©S›žñwáÕ¿áÉï>jbv௮BÏ%>êå +þ2ÚžuªÀƒX°:¶{‡Dƒd¤w„˜¹*Ò–Ø:k xgäyÎæ‰bK¶»5™DUðôëæˆ$U³ZY(EwO%˜ªð"W+½gEÿ4í@í îy¼¦;TW˜Ž~` +2‘ƒû†¿ßÆ7ÀŒ?Û¬ëØ{ИÛÐ0æ>»1RÀcÊŽ'ˬÄ+¬Ã°E†‰ÓîÄ:åĪ섽¾Ìç Æ7R~ßÉ×eÁGgܘÀÄ¡BÒ„øÑ>1ñ¦µ! ¶¼ïpïç ­Cç5úLl0e?:ë ‘§ž˜‰§™:çm™øJŽCNžçè$ »GÂ|¯o`iç\]^Ñ÷Ï™ôû9R`fñùü:Á9™M"4Ü4œf“ðx6)ÉV _I ™cóÃœ“³ËÖý)~½Ä^ãwÄ9™AB°þ$ †¸„z/€‚j Nå£=!¸›½b‰öˆeà ÆC)šUYO¡ÚùBá +Á/ƒ5â4í9ž8Ðß«!”‘Ž‡eÞ@F“W [IJÄQ]Úþñ(@žª!SJGÞ+x”zƒ‚:»12LºAÄšÝ f'fÛ<¹|æëfHfñaͶ/›ZÖÅË`9Ç“×ì;M'{FqÚF¸É(s­…Ó2ψJxÜêBº©µº ÎI/ ¨BõÔI"q’û¦9Áï<ËÀ€rÒê5”ª*åšoH#: +²óáŽzRèCågõÊ ª bSÖ倇¶‘aÍ@‹˜¼3.­žp+Õ…lš•ÉÆ#à|Ôz.öDxKª)ĽpÇõ¯P(ä½Y%…›NCr.\Ï[“õB…J´ÈëjÍy`èÇâ,úsLãlw¤ù€!êX;Å‹_¿åŠYÇ¡TfÃ31S¬"˜­ûÅ­Š|. Œ*†äüjo¡Ü >ÞY,,­Å„Ø¡…Pvû©?œˆRrÚkÙ³Ñ{ü#H¡Ñ€°ÿ—ð)´^áJ±4Š÷øÜ|[x!ѦL*Q]öW0iigR…Þƒ2˜mÔ§bí¥ÿ)΄Ö+œÅ±Fj»>Ýa¾ÂïXh•è„±‚~™íÐëúŽÍöúþq;Óï¶6tâ%nìW•wTè<µ©Ò“2&ÒnA³‡ó›çkÀúAœHŸPQÄš-,§ÆÅ&Ã2 +‘¸‚ëNÅv œF*=Z'8Cl×ÐD“تÐœJp§âG§Ø×lÐñk®tnÚ¶Á>º=ç-•sÜLpNFz´S¸kî)QªI"eÍ´¸ri‡ ëIüfh²C\DÈ;þ¦2½°µ³È +Ü8ÝW4›¬6F*ªIy ˜€|U¿Ëzä3㎽áJÃxg…1­V퀉P«÷|¤GîÛlË9$Зñö9Y „Ûu~1 ‚·ïP_ží[q<ºŠ¨ ÐÈÐ8Þd5 rTe‰ ¢-o-ÜBu–$&K\ÈEš¬^~j›zE¥˜rn{†•²uK'cÓ"•V•µ5ô‡Ú(¥L³ìÉËxy˜ ½+)éà<¨§–½©>r_»ÜŠ^Ú,Ñ ºàM’—:Ý^=X`Õ{a^•“„XØo’…ía¨P¼]Am. gÀdËxƒInÙØ$j"t–Ã5G´“õ½^$(è—ðE‡½Dà|Ã1†¯ÑÎä ˆ^ˆ]-î,R +éÚÈË Oæ‡höÄ7­Y”u•Oõ†!ø<ùÀÃ/tg\‰ð}‘q oèðtm‹ }æÑ°¢Ä¹µ]¶†úº¥®5>”ii_µo-·eªpp>HBl$¦—v&rðt òŒß`ÀŽ©©Õlk>(8¨ËÅ¢nÛæ+Ýèƶ* ÆãÚØS¡f<¼å®©vÒHà zQYKÇ¡ôUÏ<ëÊͶ2Ø»@݉…mÛ{ØC4ŠUxBŸÕ…õ'&Ì;¿BàÝ÷ž³l@N"z¡â°$õ·!¸Â*½aÖ9 +ÑPªígyAhäÍi‰hy³1¬±ã )Ð1Teç[Ÿ ÎÉÖ'Wcvô_ZŸ+zöˆ"çž<[ž›? áà.ËÇÂù¥d +PH*ø^cž¡4qBæଠÊÉÄê'‰ëÇüCÂ`eÖ>`0ö¤­7ŒéIÁòÔõ ¬M · ÏÒˆ1¸„)ð‰/œG”Q'b4m¹"ê`Å´ßæTDØp˜6'ÌØs)“ŸŽ€hßPJ%@6MÉÐÉÅ6²ìBkõÂh¼¢ ß®g«Š~êŽc1 X»7ö‡X­‡­ùxƒa“$zÐÚÑcr,ý´Œ²5 ²uáV®DìÐï‚‹iº¯$u.o>"â§Ï7<—ܾ¯'©µ±%‘,©':±€[;^ÈøC7ÆœÚ~ 6ò>1Vä­ì^ã¡3ûufošª»Þ2ø½œ<à –#ÁNH> endobj -4336 0 obj << -/D [4334 0 R /XYZ 85.039 786.531 null] +4422 0 obj << +/D [4420 0 R /XYZ 85.039 786.531 null] >> endobj -530 0 obj << -/D [4334 0 R /XYZ 85.039 517.617 null] +402 0 obj << +/D [4420 0 R /XYZ 85.039 766.606 null] >> endobj -4337 0 obj << -/D [4334 0 R /XYZ 85.039 494.3 null] +4418 0 obj << +/D [4420 0 R /XYZ 85.039 746.277 null] >> endobj -534 0 obj << -/D [4334 0 R /XYZ 85.039 425.041 null] +406 0 obj << +/D [4420 0 R /XYZ 85.039 636.371 null] >> endobj -4338 0 obj << -/D [4334 0 R /XYZ 85.039 406.169 null] +4417 0 obj << +/D [4420 0 R /XYZ 85.039 601.625 null] >> endobj -538 0 obj << -/D [4334 0 R /XYZ 85.039 118.219 null] +410 0 obj << +/D [4420 0 R /XYZ 85.039 545.916 null] >> endobj -4339 0 obj << -/D [4334 0 R /XYZ 85.039 88.815 null] +4423 0 obj << +/D [4420 0 R /XYZ 85.039 513.495 null] >> endobj -4333 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F11 2898 0 R /F35 2880 0 R >> +414 0 obj << +/D [4420 0 R /XYZ 85.039 413.639 null] +>> endobj +4424 0 obj << +/D [4420 0 R /XYZ 85.039 373.476 null] +>> endobj +418 0 obj << +/D [4420 0 R /XYZ 85.039 247.696 null] +>> endobj +4425 0 obj << +/D [4420 0 R /XYZ 85.039 215.275 null] +>> endobj +4419 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4342 0 obj << -/Length 3180 +4429 0 obj << +/Length 1792 /Filter /FlateDecode >> stream -xÚ¥ÉrÛFö®¯`r°Ê„ÐÝXU5ËR%Ö2]òT’D€"J   eÿý¼­P$5)»RzyýúíK3jâÁj®g’I‡n`Ôd±>ò&°óþH ÄL@f#˜ÓùÑñ/¡?Qž›xÉd¾ìñ$ž$ádžýá¼ûõíÍüüãtfŒqr:‹¢Ø¹*çíåé[\öcÞ½¼Å¯vî.®Î®§:vînyãê|~‡óë¿óÂéGš2ÌÅÕ{^}ÿéâì|ú×ü·£óyOøˆ5e ’ý÷Ñy“ XüíÈsMOžaì¹*I&ë#?0nà™—G·Gÿéqñž?áSû¤d!f*q¼.É0tC/ì%©aW¹I $•Ò®Qzú‰¤º 8B Ϲ+`ReõÔxÎs 2#ç*ïhŠ`C9Ít¦œG,ª ›¦îp±†©ç,ê²=$3`Æh³ ¹:2»«•ÿÿ¥j‚„,bŸT=Eâzña4tÈ4<èm,3+±Yè+×cÙ“\#½%×È «ÂRLr½›Âª“6JÅôBöL*W³éOþV壡à£111ðF Çk=9«ÜÉÅŒw6BL«xäS*JÁÂȸ‘fŠÏ@w¾Ǹžã@;›6ç•u=Õ(]9²Ð­R´«+YýÓ <¯?¡'YZ€IXpþ¢câ÷ŽøÀèðç-ï­qŒWÍP|¨T…®½‹UQå;fæGÊ €É‘¾_ýha*‰&3<–ü˜EŽm |N>ª‚±f4X¿VTÌ)F48_P…³^£Òº%cá6ï_òô©Aò#Ö‹®å’>|ó2ÇÕE׋oXÉU.Oy€”V#?»<%_:$¹œB¼Ä”Ÿ8*€/ÄpÒ‰ -A6ÓÞO|2&€iédÇ¢ÐZÉ:$rI°A¬5ˆ²ãQT).ZþneÆ'P¥¸šåÉ®œ7YH@“åÍ6-OMOýݲ¼ZälË)™åúgs5[ÃMD&Œöóh4©¸C¤½¶E‘ù,2c£Ñeº"ÜruƒŽRU}:P,EÒ5:^Ê‹–¼»q´k¥™Ù ˆ»ç¢,‘ôÞëZÇa,RvòŒ÷[I½8¿ë°À•Z×­ègí†T™Þ—vû…àÚpý Š Œ øº/¿1Jœ¥Äš¥„̯åG—ð®.‹î_SqôPvå92åGzäV”T"%á„uÈÞˆ™$2du2ü™Leó@Ôu|®Þt?óÈŠñwõhí‰|œ.„ÐÀ§ÃÈ y•ÆC´Á¥+fœ#.TPQQ,”4úyQ1‚¸AêSfë^/r.(£*”·dhí,R›p} -¿)$Œ’¨€€ç–—“¯üµÆ`=•q£Uá/I%?ß“Lj¸˜¶æïnŽ/npì9ÇpptÜÀ¡Ïû”^Ù|ùÓÍBLoK8^á•|7Â\\Ãæ-¯åUzO‡˜¸ ð -;PMÁgØÛ»QäÆš•¶¬ õþˆhÄ;,îÈÂg9á*²Ácv¹Þµš±0q:"2#£\ã-å>êÔFãŠOfžÄN«ö ¬‚©KÞµÑÏÞ‘Ÿo‚ àöV4YÀr!71Õ¸QÏÛDÿ"Š1Gz›Aý"õ³$ ¹«¼b8N°ôá¶Oy¼N‘ÂocÄÅ>%gë‡eÃl;#n¢‡%£Ä¶Lú„˜]…^Ü|½£4L Fí¦„}¶ÙÂl¢…e•5æR˜žpS€Ûy„^[/S -®¡6éžÂ^0x[Ñ»ìÈ÷±šJX“2|—×çfve“·Rƒ^`\PÎ4‘s‹üÆÎ}ÊÀâ.|¬â±t(W9«Ô¯Ex<”ÚÒ`T–R ÚH'›â0ÙW#HV3¢qŠsR´¤EIiîø—07»i4œÕä¨qè$:7è+‰íQÇm.ÓK1w€M›i í„Ç˼‘Å€,ìP½߇¼ÊÎò° AypD1Á œC( d}ÅåkÎÐE!d¶›Ü86ÀѾÛÇÄñNøo°îò žçÉô3¥Ÿ €èƉö<Ã#(4$áa3`·²æf“*˜€ƒ |x³Dp 7 b¤·•“½¸p§ TÈÚ®w­‰ä™Ä,/øbÔc$*S˜¥é2]lCÊA^=ð›MÇç -ù¶«šú±Œ§÷xoÎãæ ÿfQ" é¶cGÜõÞÚ{³t²%äÏ8‰öJ›Áò¯]^qŠnY‰öq‹Dµkñ)îfs^¸±–QÍ_–Á*ý"Yñ§§LN—çUGµ) ^2r[IM*زß]þ®æ>eÜØyO.a½Á=‘—AP[ÉehìÜb1Nþó…2L3’õ‘0£Ç(Á!S£d¨©¤jYЈ(íyêàˆŽ6ªlpÛý†MV´Ç"ÙÈ Ø;Dcñk˜¢ýmMI®éâ‘a¹‘‹m¯£`xðÄ‚•w¿­û[‰jÛO;þÏqŠš6]æm'µ?þR6¸ƒÖCä%r`ƒŠø²´¹ -·ÈUDz==#Á~º=ç9ÖŒW¦ ÍÿÊ•ìÜðãïüúÝõ‡Ÿ<]º±÷úKöæðû+üsãÀßzÕòþz•®s~uý8ddu#év®©[>@¤à~•ÈfÏ” 倫6L5'w[AÂmZDn;B)Íoy½^0¶‡·Rp„ÚØJ3¬>é³m’D~Ǫ̾Â0¬®J*ÎpÖ?uÙ>O§üᇮ@ÆYÝ’½ëkæaÕ÷™íþ{#ÝJôu•K¯*¡Öö½ê©/:¾`ÌÁèÑÉp^êR&¨!œè(v#õÞéÁ|ïk£E5píꂘ«¢ÄÞGQeö­/…l’ï²nÖ£Š(íÛù“Ý—m1 Pr½÷¥_¹±Šù{ÇJ•ñ]e€ðáü+5‰ÄA •HWXhŸˆZl—bü± ´ÝG°%,:H¿»á_*þýÃùWè ¤ÿÃå¯ÔÔÎoO$ I“¹Ã—~Íx@_“##¶Fòd’â܃üÑð7œ…?BþN›:ÍiÛ cƒ[OútvÓ¿ûr†C§²ñÓ@U‹ú䉺.mݻԬDJMÝÚ¥|]w6ÙÐÃZzgìýä”ËÔЅΖ¾ýù¾ìò¦âž`¸Ð— ‘VÃÃç+ …;>)ù$«íFQÒ2—´‘1g‡Ýʃ|’D߯¶á<©ÍìU›!óÇy·8^Õm×îÉéþf§á„<á€Yˆ,Z2Ù7bªƒJGo÷½©b5öf˼5ÆzŒ¡íáˆé)ÊÇRùîiqíˆh‹c’†¯Õ–ˆÍCZTqìú~üÝZ?ì|ˆ~ÝÇÆb0Ø”eû áSŸõô˜¨è‚••]@{|z±Öä/i"¿±RÒ¯ûž–¶‹˜öÁ[¡<2æ~Ó?õ6Rüí2B¹ü„ÃçV¼…«çz1‡¾&Ð\#ÿÍŸç¢jyT®92Óä~AºÅ!®¾ò°D—²%×;‰ÀõÍÞòþ±¼~è|éÛ(’ø@èÈ #߃ÇÁK‚Á)!Þ™=ÿ"—œendstream +xÚ­XYoÛF~ׯÐ[V@µ!¹\y);i\À‰;HŠ4@iŠ¶ØP¤KRqüï;×’”,;@[÷˜ùæ\ûsþùóÄjϤó8‰´5þ<ß̼ù ìü2ó…b)$Ë ÍËËÙó×6šûžN½t~y=ðI=mÓh~¹ú¬Žß_¾z¿XcT¬Ë8NÔÉ»…¯ÎŽNßòòÙ«3˜¿\,}õ +ï/Þœž/¾\þ:{u90Ñ7¯ÿ{öù‹7_¨¿ÎuH[G±ôSöiD¢HG^4 À®¯Sk§ˆX«£0&Dbm5hÖzêhµ*ë"ŠÕY–ÃÎ(aP¼Ü7ü=i6YYã8R¯ÆSYYY÷V „ ÌÓÂ4$¼o˜3ðµõ ÿçÑ +n‰á—„U†£>ÒÚªY‰ºëx+ð¼ï¼Û´üýtÎßs m›ë¢C]»²Á³YÅ{\$€Ñš˜Ìa0ª_ËÂÚ,‚X]ሑóÉ1O`Ü0;Æ-P×€YÇ|îÎýš2ðYúhý”Þ$!É™ÝàÅdõ?ÁÐÔåZÖ6(q ;Ãy‰Ê›-hÅuÓóàj±J9—­V…d½c‡ÊN&%‹ ÷Ñ-´ÂÀfr mödüiÚ¯¼qK#R‘lÀCcÕyUd¤^q@ý¾½çÍnB¨*ëY`…<ÂP}\ãU÷??s,‚X{[Èâ÷EöߢΑêÖ$A+6rAÈ}å¥#‘ É¨-pÆoVËw52tV@kw$Q]îx”·=KRÖü½'¶­ÈGÈàҕΛúšWÿðüpÀ U¬:•=ðÆvO004X+HóƒØZ xFª!w1¢-9³Â7»eÃÑoIÐãò5ºvËcQ xáÝs¾­ˆáuÓ’±-K;îá‚;ëL.F/MTQÔ<]9K5yíäv:}WVꂨEGˆÝ‡Îµ*®¶’G¼P•hùgO@]º½ÍzN䬡:Ež8Ï'N:vŸã܃ª!¶Œö $²Š—È‘=3wCÑÄ—n¼f"T·rÜÇ©˜oÅ[¾‡ê¥—u·Pá aÒAê¿Ð†Sa@Ä)_ͪã;…†6 B1Sðï8dé>Xé +Ùº[—p¼¿‡1Å6{]ˆižó¼>Õçdu΋HzUÉ%y¶í8gò-eWhåUñâ‘:e£T‡ñÓujBCu*ô'uÊ÷|BrD(˜-Þ¿Ï÷"ØäÉ ̓w*£ï²ñΗÎ]Þ–­=O1pFz L¬9çk_m³ª’l[|/;ª0FJ'|Ù3Êj%<³Ü2ÖòšÑ È+g ñ ñ!¤¼¥!AƼuŒÀÅJ‰u‰dôB€š¾d‚Å®_7-å!‹§à'ïËo=:Z@»“£¯½`6;BϘ1pC.¯Ëï(ÈÜSº vˆÙW‰ä YXÊy²ÐKՀ¾.jµH cîjd±¥nÁÆ!í2W5äŠÑ˜¸tGWÅ“±ðÉ– ÇXYŠ6;¥tû‡·§ŸÄYî;®¦›©;@ã@‚öû.„дFþ܉N‚èÇ}°Ñ ÝÁ.xéx-'̺zAÇ툨tÕ«‚E¾N¢ðÿLxý@°(Ñq¼+Øã‹ŒëxÆÀ^9„ÇHbõc‰ òJ V|214O$&!úabzâÂ11íÝx81MnÓæˆ2öÃÄâ’ÓNVawwÙÄU—iíqn-©]{#g€.…fÒZáôyÑásJLü:¸ãìóo3´aG2$óàm©džã±5‘´dðæT…ñ–×ÙFv©ŒÂJÆînøcL0‚è§ìO0Á9€iˆ|fÉOì µd–všYJ(­Ë0ÔÝ…ã#Á„/ÃãŸxg‹:”UIïƒ{# +v‡FЀRŽ b«ú·ß½7Ò®Ë!¯’‹Ô<ˆs¯KßH×mÛQFNÝrdzb車1ŒÆ¾ȳ–»§¥oá} °ÿˆA3aGDì¹ðåZù\*­Ž.ÄS—‡­-=¶—=ŽÛšT¾(R¥àx)=¢­jÔ>‚kª}ßQ6"VÇïØBf^Nrî,‚¡‡‡1jJE‹Ÿæ¢X=8‘MtäGÓÇÉãoÒ +¸Ľf$q u²6Ëû¢•x®‡wÉäÍo¬æ’‚«Q¬·Y^ÈùCM +Û\ºyÚXšƒíüg7øO/’}˜è4 g^ ©(ŠC' ‚˜xû[“h›˜ÿέ˜endstream endobj -4341 0 obj << +4428 0 obj << /Type /Page -/Contents 4342 0 R -/Resources 4340 0 R +/Contents 4429 0 R +/Resources 4427 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4346 0 R ->> endobj -4343 0 obj << -/D [4341 0 R /XYZ 85.039 786.531 null] ->> endobj -542 0 obj << -/D [4341 0 R /XYZ 85.039 766.606 null] +/Parent 4426 0 R >> endobj -4344 0 obj << -/D [4341 0 R /XYZ 85.039 746.277 null] +4430 0 obj << +/D [4428 0 R /XYZ 85.039 786.531 null] >> endobj -546 0 obj << -/D [4341 0 R /XYZ 85.039 326.801 null] +422 0 obj << +/D [4428 0 R /XYZ 85.039 766.606 null] >> endobj -4345 0 obj << -/D [4341 0 R /XYZ 85.039 305.808 null] +4431 0 obj << +/D [4428 0 R /XYZ 85.039 746.277 null] >> endobj -4340 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R >> -/XObject << /Im2 4150 0 R >> +4427 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4349 0 obj << -/Length 2826 +4434 0 obj << +/Length 2602 /Filter /FlateDecode >> stream -xÚ¥ÙnÛHòÝ_!ÌËR@D“ìæ5À>ÄqfÖ³Çk‡™y EJ"ÂCKRÖæï·®&[W`a¬î®®®ª®³åÏ<øógIèz*ÅIä†ÊŸ­êo¶•_o|ÁXʹ[ÞÜþé™ï¹©—Ζë‘Nê¹aÍ–ùλ¼}Z¾ÿ4_(¥Àœ/â8qžç¾óöÃÝ[œÖÎ-¯~xÆoà|~x¼ÿ8çó3/<¾_~ÆñÇOÿ䉻O4dœ‡Ç_yö×ßîßÏÿZþvó~92n‰æ+…lÿç濼Y"þvã¹*Mf€=×OÓY}£Cå†Zɸºy¾ù÷H‹×ôŒw]ÒR¨7LÔ¹šTh©É÷WùÁ,Öë%ÔS“ÕÅ|¡Ó}[½Ê íò¢cðïü9”MÏPUoÛ~€Æ¡ó§zEUÖe“ …`¼¬²~`0krpàú¨¨Û_ü#¾Z(Ïõ’˜ØZn ¾£n @ßYí«u^ö?3¡#(ý°€È -à©Ø,Ôw¸g¥¶EçIèü„¤~BX;Ý(=c Û¼Š0(´|E[“q] ÛARŠìÜ÷D+ç^ý+éÈù½¸ü//àÍ’ÏÀPÔrtËßVj\ÙPõºh0I?)ÙG«LI`s– -A®)´©Ã<»/èLÀ ,ig\ÂI‘c âÈÉxܨXá®mF.Ø×LptT€dÖŒÅûÈô«Ò -q>öy ¾Z„—âŠúž©eü©JŒ`¡JGf`ÐÚ–¡Ý“O{G†Z6| Ž…‡_ÞÀK‰ë}» 6À‹\®ÑZÜpÀø¤¢„"cˆÐ{™$p Æy3âP°êŒ•C6PÈä°ÍdOÖ p|Í0:~åˆi–x!I×þéùJ0ˆ¡!ƒùZ"…BâÉùm+«»R®€fú1z¿–¢{^ÀŠZåuU÷´ e¶¤y¤£­ð3¢›[HÐQ• àr‹ã½è -°Ka2§ Xpö¸|ÍM ¸rlÙ¬ª=™/ŽÃs}k•â]+Åm ÷æoB‚ itݱÕV|H6{-ãu…ß¼edEÇù®œ¬ÿÒcå†DTŠ¬ öºo» Û¿´/ q¼“ŒýÕpK{“ Ñ~qqO„Á¬ÀâñÃÃ=”xrïÚmjCú€$ŽM܈¡b» œÜf½a‚®O8qG»_ª¢†3V\.­)rDµµRÏYL¾d¼uCGox¼D‘d\ðÂÀΪl“Zík#vê ”Qfª*¬}(¬)^擬8­œÀó8¸l€Ä‰~Á¨$OL¶ñŒb,ö_¡wNŒ‚'®¡zc’6‘Ä-îœn®"äÖ€C•Æ…ˆÃ -bPŸ;Åp‡Ô>¢øiìp~0†3K\÷ôn|šCYæòÚgë&hbÅÖ³›=ó“ÃX -¥™36Y ‚j_s$ÔR°¬ºNg½XU&¢Qì¢Ð -9«¯ùXW°‰á­íÙÌ „Þží9û¸Dǹý×=òöéöíý3©K@\1Q -|©ŸKB,ëãq¶*Œšr^'Bí5ù°Šô=çÎŒ7d;”èö -Ôùøq‰@h'@ž(׌Á-ÎŒAb š<µÆA4†Ä?Ž´<ÇÔør¥,ÇïÃÓÊòœ´Cõ6æ†|ôêÓº›8…ùU;ðêž óŠÞÚ­ ±M3çª;6ÿ$85˜Y¾c£Góâ)2RØ]4’%ržg¯‚* a"ãôêBÞÊÆs#ºœc\¶“†7[ê`e’±%ë^\óêzŒ‰9å†0âÌ‚Õgh“5NŽ„{Û…‚?|ƒ¹6µ¦ñ DD;è™*‘ à×Ø×}üëNÀë1ÖRLýœß?ä²ÑøU ¿äþ \ôņ~,yoU•2–d•)”:/Tª8ˆyz<‘ºV -™c¸@~Ëf-ý¤øDšJ nI9Ã&`* Žô˱üh j8[„ÜŠYøâdÊ DÊkd!Yœ-03å0äarX‘°£4¿lì¥{¾Öà©0qÓïtxÎØâùnŠÎ05IJÇ.ÀV‹ç;>Ö£!WèÜܯ!çîöúýn‡iÔ¡ž®Kþhì6 ¡Cqr…w­¡?O¾Íû„s½ÁSAä†>¿ÒXQÎ:[•U9ð+VÀšD© s‡ó³¯TnH¡”½)†wl[m7¹ìã‚>žPdÙÔ.Kô -ͯ œYxíòÇY«3–±10±#‹&::NHí8¡ëü‰!µŸúúåÚÓBèƒò Sse,ÃQÛ:ÆC©øB [ ;‚PM5¦<ÿ“'ý¤ŽSH½©íeÝ -I,×èc÷4ÍÓ¦kézŒçåRêš® ›LCh–WRÐSï—ò¶æh0I²iqÚ±*5ûW^ðnõròï†ÍNöqöÄ _V’¯&d[Û˜ÌIÛ(aÕ·­ÄóhÐË—[0ªXœ­3yìxlu]\zÈ<+ÞQ–’‘Þ~G œ’¦ŸSzÉšþÛωt•Ô±©ÈZµö¸\•ãKfÏ3kb´–åsƒBgÂ0ö$³Ðâ0†®ÖòÆŒç&–ãa™>ëÕ­‚6Ÿ4¹—»V 5P&> iÙOoÕ8"e+MÁÉ´j°ÈM)Ú­Õ¡ Zø×ñQÍ>–ý:™^p–ʃ§‹¯¼±ÎŒ'À]¼FKüÖ1S(eŸõ°ƒ}dºFMíÈYœ’Z¿­OÊ-î?³aÊ©1=®Ðð¤¡/€E´¿½¤Ï«:ƒçâ’œŒp¥¨D½TT^u»Ç–Œ1R–áÂ@Á\ý–BN•ó …Èœ4ðì3·[ØÖf~÷8Tm'}`¶Òå%©ÍÃÍãRyNì ÍîrõiËG™ñ¸R¶ªÐ\Z[Ÿ"É~<ѦŠ¼Ø0µUÆu1UQŒjâˆßZ_ùí5{½¼u5ÿÐzZ!Â?ëäÿúv¬35”ÈIp¹Ì ƒØ »fð’è”aócí9ÇÿTuÜendstream +xÚ}YKsÛ6¾çWèHÍD,_à£7§MÚôÎÔîôÐö‹”Ć•¤âúßw_A‰òø X,ûøv±7ü…›\ùA\l²<õUnöí»`s„•ŸÞ…B‘¨ØWIã•ÅYÝ¥‘$Ù*œ±Ë¢ÄOòi><½ûîSl¢ÀOÓxót0‚¤ H囧òO/÷·;¥ïqÒ]¹{hú®Úîâ4õá7ô†oÕ0nÿ~úåÝÇ'{Ø›·ÄqhHœPmÂÀ/‚Â'V¾R‰ó8mCÏHC"‰ +oDYªáÛ6Ê=ˆ&õ0ÔH\Vçí)º’WB¯ÃÒä^àßûV=è™YõMcy÷²>æ3ºjBÚ—m”y=nø +ºË`á O:™#_y§+Ý—_ŸP‡ š]ˆ¦,讥ȇ¡×Ò[dý wÈø–q¡2˜äpÁ;î‘•T÷´ýPñ¨©¿’‚øëÇýðõ8ô ?óìÈf…‰oBË_¤a¸OgÞgW(M +zå:]3#ŸðEÿ>;¢°Æ£¥…ñVQ£Òƒ‚¹Óο‚09^£Ò×Qó0®a¬B4ÿ´f¾«[<äÒò<<0ÞCÜQC=É•èÐ…ðÜÍAÖ Â] é+ëZf]ˇn„M©'‘pM륜U70-;žÙWt4TºD‰´D{š®³gKŒFÞçu'ä!=IÜr1fßòïÄ´ÊR?†#ߊi‡Æ@L˜ÀLêÄ´JR¿È ˜A&)¼OÛ8ð*=]ëA€4ìáiæ}¨º +-O.~u ç7%œi + +?Èï¢N¬Ò[ÔÁɽÆèPÊÄ)ÏêÑݲ§ "QÏv§1Ó(p v‡½qp—AWU¥ 1œjŽw=™P@M‚Þ@2¶¢4Šl\äªÛscdZ‹Á}OQtF#žÿ!t…Œ8zªI?,2pÙÖCDºÝ{%1ÀòhXד¬N'œØQªèl-»…ëeb1~dñ4E9“Œ«aÐV¯LbÄ>pX¹»X"‹Q¨m _áÌ5Áe´€®oD™Ìàó8’PKñz8ªÉÉc²kUò¸ÞŠïÇ„žð³ŽÊÄàÐËÀ^F[œ%c"À:š©aU¿Ç™Âë¯Yœ‘‡Á¯Áˆ`}Þn¬'^jµÁ~¼ZJnÅÆ°ÙÆÞÀ:Ç„MH’Æ'È.JH °°ðÁÿx‰ .À1¼*,ɾ!ìdÕíì¾ßc*ïäõ/®• GžëAŒÔ€(eB†FÔqâä +S=ÂtiØ‘b^˜ìA[ÃíC5T±0r8SµBB9â}²ÈûÒï¸ö*ä$âD4˜ÀÁ%ÂGsÉ‘ç ØãP0Áž5ç]b¨e Y8÷„ï¦:ÖDßP"«g7ĉWÙ´•šàÌÁ9àE ¼™œ³µ|hÎjkUm¶±Ë•û$•ÅuØÆaN”nÀk«ÒŸM +£ABÍe”Œ'eŘ9Aµ&H¿,TÈ¥dã½(„]¤'øÕ"O]Vºqè”Pàq "ºÍtšC;ðlÚž.ƹq!t4 To’¯ zV,¦Ûp©÷qÉ"LÄÃaKw§CÌ tš·s½›Î.†S*Æáu Síâ¿c¿Ë\ÀÝ:BÏ0TÇáÏXwÇFø*•j:*ò+‡&7ˆ½7¥ì+¾hTd*QCŒjüµ™›Î¦ši^Η^®PÖ‰+ EØ R|¡ñ`$­åðN·X‹Ù€˜ö+Ê!Œä*5§N+[ý€À²}3Ú- Y°£ëyÎâÑdsù‰‹sI_U?Âå0 Dãª/F{ï¼2Ðf*òŽ&‘“˜Ìû*aaä[Ý{o@Á+‡Ï¸c&ûj¥.æ•#àÃÄÃ;‘¼R„ÆÙEœ¾Y„:4wËd°¿¯2%er$eòºÓ_˜øxã¼²"ET(?Ëߖ¡¹[ +Già§YBRô,c$,Fb¤‡TSãë n "æ´Oì9aTOà4ið£9ÚBŒ ¨åðéd’p¾Òyá&oÇn—EÑÀÇáÓË(¸ßóÞ‰^õÂKyö4´ºôŸdëÕ•”UjrWñŠ3.PX8ƒ¹VÂä:ÕÝžq–ê^º)~ñs'g0Á'û\ÛUË:ÆÙ”{½¯ª^QØWžœË‚`Vlhž=âW#ŸÊy»»—glB{ÿTÒÝdV=¯ØŽtÛÛuÔÀÝ_[DÔû[y¢t¦ [ skäÏÓ²zã6÷b5bÚ±«ÜD¡±— µ™{ÛUà𤨠rþ׫ÚðÆ1sFm)l«Rv+§>µ^œOÝÞ¼ÉÕ¬¹…”:AÊßKÌSn‰¨2nšB4z2-MÌû*`íž· 3•ÔÚU!³šE#§“kÁ¯y)áãÜ6ædO/´{ÌÑ;B‚9TºÖ +ët[Q(ˆõE"ľ밨2E--V2™æx°…æœyác/YŠÈz;á@í®p›ÿI󨩯ýŒwË’9 ’bF™ìù÷Cû‚JÉb)ž`¶¬mÖ+ÿFȸ†M=Ml¢ìsCå& £@v¤xáT £ztØ%‹~ÇÎ)Ó3õÖA¥)¬°ªÇ#=;ÙK3œæ…  Ô#bH€‚ +zX¢Ø£<¬Ÿ#½ítáÇü>Ì‹E9ƒß˜z‘a§yz¨Ú~’-K÷|Ïq(XÚ1 šãÀCDp*çø[+YÿtÕµTNb›D:ª;Á‰ÎæŸGòŸ°9Ûn0y¤x³ëXñJÇ(ƒÂÊ>üÝ.þ[å/ä†.žÿË›&!÷½ç~…í¹rÀ½¼é­×—òáåï>{î?Â,éíëžì>À€aGo°ðúHÕ¾Êã7Îü*{X»endstream endobj -4348 0 obj << +4433 0 obj << /Type /Page -/Contents 4349 0 R -/Resources 4347 0 R +/Contents 4434 0 R +/Resources 4432 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4346 0 R +/Parent 4426 0 R >> endobj -4350 0 obj << -/D [4348 0 R /XYZ 85.039 786.531 null] +4435 0 obj << +/D [4433 0 R /XYZ 85.039 786.531 null] >> endobj -550 0 obj << -/D [4348 0 R /XYZ 85.039 607.39 null] +426 0 obj << +/D [4433 0 R /XYZ 85.039 766.606 null] >> endobj -4351 0 obj << -/D [4348 0 R /XYZ 85.039 576.773 null] +3053 0 obj << +/D [4433 0 R /XYZ 85.039 662.656 null] >> endobj -554 0 obj << -/D [4348 0 R /XYZ 85.039 358.939 null] +430 0 obj << +/D [4433 0 R /XYZ 85.039 576.349 null] >> endobj -4352 0 obj << -/D [4348 0 R /XYZ 85.039 337.742 null] +4436 0 obj << +/D [4433 0 R /XYZ 85.039 536.186 null] >> endobj -4347 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> +434 0 obj << +/D [4433 0 R /XYZ 85.039 327.936 null] +>> endobj +4437 0 obj << +/D [4433 0 R /XYZ 85.039 284.983 null] +>> endobj +4432 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4355 0 obj << -/Length 3730 -/Filter /FlateDecode ->> -stream -xÚ¥koÛFò»…PD4w—Ïû–Wsn'»çm?P-¡H…¤âúßß¼vIITP\ÄÜÇìîì¼gVjÀ?5K#?0Ù,Ic?2j¶Ú]³ ̼¿R±ÅæõýÕõOq8SŸÙìþÑí“~”ųûõïÞ›¿útÿîó|aŒñr¾H’Ô»›+ïՇׯp8ô®yöÃ~µ÷psûöã\§ÞÃOܾ»ÀþÇÏ¿ðÀëÏÔe˜›Û÷<úþ×›·ïæÞÿ|õîÞ!>ºš2ÑþzõûŸÁl Wüù*ðM–Ξ ø*Ëf»«02~éWWwWÿq{ñ\8ãUST -uìë`ôß8ÎD‘jê¸`¶PQèk\܇V°·,øñ> ¥´o”ž-b¥ü,˜—èŽD2O©Ä3=Kà–A”÷n`T?_(¯8%¬ -|aÏÙ×™òƒ0Ë ÃŒÚtáb4p}³S³· `:;B–÷]Œ6&dU:’4Å~&³D§¾ -#»CD—ó…N¼5üÍ´·Â‘îPs'S¸Ë0ÙÔ*ܦ-dUÞá×ÀBø(ïánnïx²+°Ûü7×z àÑÊ;ô¼¶dÂQ³ã•uÓK£ £‹ÿv9ŠqûŒô%–£Œet¡¾x“xÝžîDÇ­JÄ×Ý«ªž/Ð1£¨–ï–xóàû<‡}º,ƒ=ð½`Š·ßŠt4TšÔ'ÊzÝ ŽO¯¹½_N`{G‹amy ž#íWpÚú[^ǯ½æq‚g -R_Ap¾F ·Æ¼Ä¾ãe˜ÄÞÊòÙA»Ê)9ÑåÛg¼Qà Å#c -½›'œß•Ù#°{{¸_3ªw.#H4X3ˆãϵˆ0+êoeÛÔ»¢q #Qüx:~×rÍ÷ÄùWm!S·„xä{¢û‘h}ñ ÓÀ+{†ByÄu-‹a³#½)êõ˜t×oóþ2åàat$vØï·siÇÞ‡Ò²¼mºæ‘˜ÚÐ'|‘èa8I3v\ßãŸeY•}ÉŠƒb -®ä†%÷Íy‰%í¢©«)µ)ˆ(|.ù6ØlYÛâØÂÝ0—Ž¡2Þ¯ªÆ̈¼^ó,!CC2=¡AxE1bŠn^mFî£*ã÷H•q`$øl 'oàŸð0Q~ÖtäþAG¦²d¶pÎñÿw|Ç+JÍࢱÐ0Q³(K@w8ܸŸ§@j μ ‘ çÎIÁfŒ¬n‰LØ ­²³#:#tûƒƒ¸C§.œâC¯§-i‹ö bˆ@;\âü1Ó‘C^½Œ‚ÚSYU²Òj`aOÌH´Õ- ÎBÈ0F¿ý²iI,Ði¤0°ïK´ ؆KÃâëŸÌ˜ŒYæë‚Ú£Û-}°¥ wDî0õ³88rMi†vO퉺=¡Ý óžHF‰˜ÇHÝå;œ1ÇEË‘‹kvôíxFöÛÊÆÍ£/d0‰¯c}¢FÌ4Š ˜Íªk¸µE6Ь$h™€{gŽZØ~lÚ#p¶+#¼qЪ'žX|/ç5à’Œsq°cÙ3xõxrnØ:'«<‘Î3N³‡ 5àÅÖŠLËc´)½tÂÔcÐÄÞ -­ØþkrKpü쬕Óbû¥eádGn1lÚÑS¶@²Òýæ«Ü4:/&ìßž¬; SªûxàRw†Ghbí§Éq@pKäÔI0­Ø)‘š¼×¢l³Ú€‚ÁÈYaCó%®ÒÞàê£iîО¤0‡Š“ܸëIìÀù}Ï—•E¸‘/nölo|iŸ8àKÁQï(-¡ìžI:®\…Ú#Küz*L’CܽûüßwŸ'XcR?Hí>$/¡D€²À|3$9Jì†@oËž…uXÜ¥L„bB -°ø°‰ÌÉ,Pë²ÛW9“qg¶È\W¨*;hRt`r§$V(ÖsÇé‰Tks1ÜöæeÅú‹+$ïçÄð(ÿ4ÊY`E·6b)ë=÷¶ù"Èk(¡½©še^1äæP ö$sŹ²‹cú‹’Ö¹´#2ÀGl àÔŒ! -mÀLlŒ–10Þgv …œŽzTKÐÖ@âÖé@û!>ÁÀ›y@j\¸9SÌ:a^jÍvPÄQx´å ¯qºœ*¨¬mÖ‹VŽóУº;W ¶Hªj±¦p8e6 9x;˜Úq¤(òxʴЦÆLMë6KÙ9× ÜqIgãø\³Ç—ÁÚÆåTûz’dl‘JÔ’Ö€/ÏÛyŒÐ?‚(° mQÚZêVò‰œC$iX—ÃÅ[®¨_ÛÜ âHÒN ¥.ƒ‚ŽäYÎ; KÞ%æ*Àÿ’¨BQ³®`‹¬!*@ÄËï”÷LM'tWx(£q¨é6‚6Ð8ý):Ù¬÷îÚ(WعùôFx1¶Ã:LüLÛè÷Çin%FÙðxË4‡w‘š„ -u¡ °Å¤ìŠ—HŒˆ¢ ÿ0ÇÊFG)XÃ#»Å|ïXÕ¨¸÷i–«ñiˆ¸W[ñö,öxΪg£qÙñ{‡pxêëë7X³úéŽáV$»TìÃ.„Ì6ìJJ…Ëí°CÎì\ÙpÇ|Il¬¨Êª{Žu"Øl¬è ¤‹[¤’ÌÕ¦˜í|¿ -Üêùä€ LÔ¡º’Â3_©l‚‡a¤åëΖºÂ -Ë~“‹UH1”åÂLôÐæØ÷7DÜTâ l±]N)ö¡>e¹Cö‰†È6E‰h/ò%`¾¤ÞíÇ{ž³Ú)ÛÏ]Çž°$ì0šã~Wp³å.+q‡•èAwæâQO3œs ¾'N@‚p\ 0\J…+àâÉi^FÃNs‘c‹ #DÌCœÇ2q¥=¯mòµÍ|óN`hhí"éŽÜ ºeÀ%õ»œ¾ðl%nì¢ÙZ¯é¹¦ÃL±¹ø‘§¶á°íX'q#?›â"žJ¸‡uBÎiýà*Òç£7š$0Úã©"éÀy˜¨!ûŒ³äo¤ï‘Ÿ*kèȆNçÅh’D7/Á\NÚÑ´F‘>JÚ$í¯!g‚(b.«sÎÜóUÛ Ï°Ý–µM“.à -—’çÊ˸0—sx­c@Ÿ w„ÓJ’Y6=Ðh‹ªÈ]è6?•ÿpXá=ÁÞ$ä+óm®à(…‚žÀ“€wÜvÅ´½¥ÚžDHÒRÁcOœÅ~¯£s#}Zˆ¦B@<ÎPñppU,€í]Yœ–Ñõ<ÄÑ!øã5…i£÷“‚…˜sÉOáØtÅE<\êÞ|:wZ9 -6åÌ­Å÷°Uo·`ÑEÞcÁäÀÒj;å«{Î¥KQ&ŠY°^Êé\1Nê™Ë}ÏUÑ ‡5ˆöÀØÄ àƒ¦èÃ't7zdâìTz®yàþ ±¯o>`NJ®²Ê¹wˬcá -LÌèîó–Î -JgÐŒÀBu—jÃöI,1ù éísÒdhM˜j¥">D¡*&!±*’Æ£àÀFÁybßJ¥#¡06- -Îå¸c4"Øà·g“D'9<Ú¤D“k;—^ÆVøF•w2W–úaœÓ—?oíJW™†ÁÛ¢}óQ&¸HÅh ºUÅc_‹x =Drôâæóó€”}Âq˜y³àû~ ]‰ uW墤¡¼…£Z ®™ŽIGFÒIºëÞ¶øÑ—®Ë¡ÚßóÌ×Ã0(»žŒh˜2ÀÀò FIŽòœŸl‚XʾŸê"‹uBâ ö°£_aÀà¯o?1О½1U?ñàžçéQ‹¦T¦’\ÀŒ2 OQ)L‡zÜáan̦G¯¤¶ÜÙòÚÉ1>Ŧ`ð(ÜÂ…­øžfª´O•2£èéÊhÅG"4ÑQegFFžS˜(OÚ£GŠ¯ƒÁTStr¨(¡Ö…”P”Dâ1RóÒJÞL¾qTFYÍ·T•êl.m…OŸr3:Éõ“tÀ‘Úh ŽlKÇ3-–à±åB.hcZñìÄ,Õ©r\%»0„ Ú†ØÝØÒ$<ËS`š³ÄF· Tšs†adãL7Ò.µ…yhÑ›NÏ4¹ëÂ}%: -ß!Òm*@«l¸µã‹x×”uN¥ß¹¬a‡rõ‚}èO9{ƒ~K•©qFஞò0ù맗ž•Lä‡üÓºÓ þó‘ÿègw.tÄèTOGŽ‘Nü8 -2xÇ49E82)ýœàãÿïÞeendstream +4440 0 obj << +/Length 2460 +/Filter /FlateDecode +>> +stream +xÚ­YKsÛF¾ëW°²°*„0x#U{P$ÙVÊV´7NÊñaD@$Ê ÀàaIÿ~û5(‚Ì![®213Ý=Ý=ýøf¤füS³8°/™Eqhžš­¶gÎl +ïÏ”P,„d1¢ùyyvþ.gʱ'™-Ÿz9‰cI8[¦_¬ËwËëûùÂó<+¶ç‹(Š­‡¹²–óس.n¯½½æõ‡kX¸Ÿ+¥¬ß®ïæ_—¿œ]/{%Fj*ÏCþ:ûòÕ™¥ î/gŽí%ñì¾[%Él{æžøžŒ‹³‡³ÿô²xÍŸ1×”ÅÛA욬‚ “ƒÀýˆL^nj0£êÖ°*ˆ¬v“áGlu0ÝÌÊ’qõÄwóØ·.>ñäŸNàÝ]Ôëµ~,„ú'@V9wc«ÍWºÍ«’|ªæ 7²Ò®˜“pØÄ(æÓ%L¦ü] šç¼]ÍGtÄ]ÛͼW­Ô[ùb…ëï°–¯Xy8pÑB¡2¹yÆ•d©Yý#°'žE f–íbemuÎfhä)œuÅQð––ù Óv YTó(Õ­~„eÍz‰™Ä,ÚÃ7­U(¥^Ã4ùdèÎÃ6s7{•Ãyê½òDÍ.ÍS³ƒgí¡tYµ@²éõMÔà>—Õÿ¡«¬Ïû()qÁAàÒµHyæ‘3cÿåxddDA®Ê„¨­ø—–tQÈ,yºaÖÞ#ð­ð÷*‹•4#ÑuÙ ˆÝ…–Pê7Òí„GŒ +¾‚äÖ[”ÿ¨qxl[XzsH;NS àG[+]ðø¿·7¿ŸäØB¦Ù땸ÛlËãnhâéª:åÙ”¬Ðº%ÏI·vuÞ³¥¬gUMÈâó¬¥#9o6Vx¼Ï¦˜Ž ¡3`˜›øÛn‚µðXqI|®LF»²÷v}ì7¨2ýé(ÇԔ]@5ZÛ7â`ìFÃÒïÇ+$º¸ãÍõ +‡ßx-+Ó=‘>ŸŸ™ðÇÈ L-›Ê ]ϵ>óù`ç<çq8Up®5/oÞ=œc›øô3NøÇÂiŸæt,g?µ!Öûº!„¥}¤­„alG^p²ûh¨¸°êÛžŽZAè%6´49¶=È"p€uý¢·;©Î^Y—U‰Ç¶îjÈ)\S¦4ó"è`§ëIŽ¶¨Ðqm'J¤E¡.ø®*Š>J©Ö¬y<ø‚çJÙ¸ë¬áu]‹„4kŒk®N0IÕÉ•êÕ¹áiòAh¾Ê[ŽQ¨‰à-ßw¬›VØi3Ÿ‘Ó¢i§›×ýÝt ¾^Í?T¹¨àoCÅaúR‹€8ZÕ™¦¬GöïFC U‰cÚB“ê2ÅZÍJbÞw«ŒWÛAq`Þ¢£;*éÒ q³ +b#{ÙÛ%/ù÷DÜ÷¾ËŒ˜¹™ õ7Þ=íA¾.©¨O‡X)[ùÞÉÑôÁ¯ì=×YàvFCô+Ka +ŽuŸ=euV®$®¨Gci±VÝ6+[Ó’`ífVSU¶8©ê@s4P>t}F©œŽØ‘’ ?Tø«ùâ"]TeñÊCé8À–Vï÷²ÐV… Ž¤×¿1º…0ÿƒ/N®´l£WŒTÉ1œË–+àA¶ìÓm”˜àâpÌpðaL“WI×tոثªD]‡ÚH‘RÒ¾žsÄøÅÝL–ó¡¼]£iº-q¹= møúmë!:eÐJfwÆ(¢1¤mÚªÆÚ‚“yyhxqDŠB©!Á-%á¸P9µç$®µT1É †ÃïTºq·¡Å†÷Ñõ°gEÙÇõØ{ôP!‚©1Œ úV‡Û‘×J”£¿¡˜ºåÛº­˜ +9ªí10žbp öç} æÈ‘ÊÁxc,àÃEGÄ›O¾ˆPŒ»¡ 5,†*Uä n‹¡ =¸„Îø‹¦_Mk X†\{ŒhЫ øŒÌ/è5a÷&T8)M¶¦q†Á@Sš©¦&ü¨_åM;ÁÓEÈ÷]H¯‰;h”DrõÞÜA½ƒ;(ªo'‰;UÊbdÀ˧Dá˜àío_ûTؾçÎð`ºø*C„Ž»>ìóèS¿zëN솳ÑFÚšÓÚ¼•DwIꑶ¹÷Tx&Ò–Ÿ ÎãfÂ))t¯\d,ƒ@Ó^𙡿½µÌb„Q†(¤§íK”í¨hæà ”.2ï_ìÜ÷èèê>ªD°¾Ö¬s›Õ‰o7²„ãûË®ø:ýr—ù¶®é2¹c¹ÿæŸO7WØ|.¨û,?L°€ @^5¬Ÿ<À—ˆxqËׄï¦HñUGÕfÀ1=7Bù÷׬X&ÒG&#ó}ëé到uÇm²=ìu€a›Qþ=æW ®¹ÜèÕìy›±û©FS¾^qñ÷„=k¯LYJ5rOéI;®úõ„Ih­ˆ§T(^÷üAo Í‘:åBŠÂÉ»š 5Fý³w´r¹>0FñIÈåªê›uƒÉ¨â¡s«ÄÒ¦ùÁ™$…óÙË›êD|²¸Õ‚¥¥|Ë´0PRÏ€ŽÑVØ+þ½Ç¼xwõëåÇú 9Ez˜S*:-oÌ^öeuªMÓUCŠ_Çâ½÷ oÏòšJ˜¹S»æ•¦øõ„îð›Þ!¢€äÐ}L¤wq™®y‚º8^û‡¼ìô*ípÛð„A2”‹`l=émNoTFäsNΰ'lçû§Ž#:˜x–ÁÙþ=â  €rþêòˆ¡I:o„ãàû‡u×àöž{[lJáoÌ;µ‘eÆEÁP§ûë¾Aè®h™ªCwT ¿çE¶í&ÞDõÓÉJ§âêK‘Ó£¶V=z>JéÊ ý$ïŸdLâÂ^Ïc.R5Ó|¾¹}øÛëfUŽ¥n®Ÿ”/LHÁ+]9õ)xHƒö´R!4ÍØ=y¿Ñ½Š*ü‡ã«¨+WÑK¸nÖ”cahÝÕyÙ÷μ\SÌS¶žþóȈæhLàãÉ{gàó½3 #Ÿ©[®ô]ç&zˆöÈÓjÀo óí¿ö¾þÝ69éã!žqÇä=.ÕH¦¥Èà*ßü`²–G˜AEó*R úÃͨ×Ðè1<ÅÏù»Ðyx0ÁÝ_bø¶ Ö€)³ñ/?9dá±7Ý/EÿO¿ôc€ît `DùFŠ`÷­ÂæïS‡ÿ4endstream endobj -4354 0 obj << +4439 0 obj << /Type /Page -/Contents 4355 0 R -/Resources 4353 0 R +/Contents 4440 0 R +/Resources 4438 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4346 0 R +/Parent 4426 0 R >> endobj -4356 0 obj << -/D [4354 0 R /XYZ 85.039 786.531 null] +4441 0 obj << +/D [4439 0 R /XYZ 85.039 786.531 null] >> endobj -558 0 obj << -/D [4354 0 R /XYZ 85.039 512.424 null] +438 0 obj << +/D [4439 0 R /XYZ 85.039 668.735 null] >> endobj -4357 0 obj << -/D [4354 0 R /XYZ 85.039 493.552 null] +4442 0 obj << +/D [4439 0 R /XYZ 85.039 626.387 null] >> endobj -562 0 obj << -/D [4354 0 R /XYZ 85.039 258.772 null] +442 0 obj << +/D [4439 0 R /XYZ 85.039 571.143 null] >> endobj -4358 0 obj << -/D [4354 0 R /XYZ 85.039 238.182 null] +4443 0 obj << +/D [4439 0 R /XYZ 85.039 538.722 null] >> endobj -4353 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R /F66 3242 0 R >> -/XObject << /Im1 3957 0 R >> +4444 0 obj << +/D [4439 0 R /XYZ 239.826 446.534 null] +>> endobj +4445 0 obj << +/D [4439 0 R /XYZ 85.039 242.769 null] +>> endobj +446 0 obj << +/D [4439 0 R /XYZ 85.039 161.082 null] +>> endobj +4446 0 obj << +/D [4439 0 R /XYZ 85.039 124.216 null] +>> endobj +4438 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4361 0 obj << -/Length 3268 +4449 0 obj << +/Length 2119 /Filter /FlateDecode >> stream -xÚ­ZYoÛH~÷¯Ð[(̈a_ds_qœd< +YÛ‹<Ì ´¬ØD$Ñ+Q1Ìߺšl‰T6˜l‚„}VWWWu´Ô$ƒ¿jâ]š™rRøܾ¹žÎŒ1 ŒœÎŠÂ'7S•¼º:…Í6yɽW7øÕÉÇËùÅû©öÉÇ¹ýˆõ÷×ÿà†ókªò˜Ëù;n}÷¯Ë‹7Ó?n={sÛ1mMƒlÿçì·?²É=lñ׳,5¥ŸùÔla£¥nhop÷Ï;So áûªE˜ÕPߎ›©¼‡Ö;K”[éjþ>ãÊÍö3ÖtBdší6Œ^´«¯So/Õjųְ Ì{œ"KZ††ð&IW?€KìŸßгƒÝíø…˜¡tòPsuÃU:RB T¹Ã_y@ÅMÐÿËk$÷Ûwa“‘ªU°\ h”LOjCÀ¯¸›yó{¦,jÐ)TmÝ[¿g.û„š$Ôà(J' mîG¶Êgŧ“[g=e Ì]‘~NJÁo_xIò†òRî§ÃÐÖj™™T‚„ 3æË–”£×ß\~Ù¶|7¨ÛQ<£Û”Š*¹uŠÍœïâý9Ú^½c¼Â­lsp 0îå[_p«SëL¦ó_ߥ‹fó‰Ç-S묌ÃSX…ë–žÀ±q H ¢£1„=:‹±Gép’:Í c4ô)¬lRø ‡™üBŠ15 -¤ -)ðþÁ¹'K:Át0mz¨&dZ½›%ºpÃ1L!‹m¸ÊuXæZ÷ôgBä‘=Á%·ÞRWoÚ“AÆSEÞ{YŠY¯îծݱ³5ËM™Ü œóðÖà‡­(Ä=ØHŽ3Œ©[‰Ú`1ôÃ-äÐpÈ,ËMk²( ”Û*¶Š2µ5oeÌ¡ÍÒÃzà<‹e·Që’WlšöhûpBp‡qpl\“iD±Cmè¤Tüݬp*4÷X84^,,–ƒó£’ȘaÛ˜e''ë>*Æ -YpŸõ!›WìÉUk©I<ÝŸ@ÓÄtyVd¨q8 $Ø·[“§U/j -&¾¾Ø MqšB²Ï“«£ƒÂ¡suìÁZ]¤y¡&Fg©÷ß‘}0u㹇Y 5‹ˆ }] ÷»´¶[‘î9³×ˆÄjc‡&%2%Ÿ–.QðBÛõ°6#%¶V% ë¯øùØuU‘dÉÖ`ý¼ó5{gA"<êÇs©ûhV@PPOŇó¬1ç€Íj¾57Àò]ì­K¹ãÌHpÙåì‘”ÄoG\  7rð|õãƒ×%úñÁk¡FQLtiÒ‚C±¿|ðÖ,"6 -•á­§iá†wQ°ðÜ+#ÏvÄI ðud¥)Ù`¾€ $€¡>­ÚÁE÷–n/÷qÈyÒØCn ®Ð‡IË'A¼ã•š­Œ%EË‹ðä ÃØ+iCOÕöc†›?Ô6Lž*IÍêøÄ:õ±’ÀU±K[/B¨aa¡Û{e: Òc¡U’Õí²«¤ü÷²ZxײºÇy;`arÈñ¨ía8„͇1 ñç“·˜ÑmÆ4¡ \kÐ48¢ðÌh â(¶¿¨öÄIó ”¬Ûª­"ºüÒÎF®äq?T5×ɦZóëŸfË•‡”ÍbY>âÀˆ/¨—Ç /Wc‚ ©4i{¹\\Ç¿‡XTûp$ô‡SðôìE?KŒdð'ó£îÓ;>HÜ¥W_ŒHl'óÙXoåÐRIj`/K=G¯Ä![œÕŠšAÆÌGüéܸÔòžŽ_Îá‹ç‡~Õ½¿[Ÿ–^Ÿ;)qi3xÞbaùáÔãÿD*¸endstream +xÚXÝo¤F÷_1ÊåÑešn¾òælœ»V{{k'9)É3`›ì³ÀØ;ÒýñW_ جt²Æ4ÕÕUÕÕ¿úhÔʃ?µŠ×ÓÉ*ŠC7Ðjµ/¯¼ÕÌüãJ ÇFX6#ž?áJynâ%«»û^Nâ¹A®î²ß7ÿ¼þpwóq½ÑZ;±»ÞDQìÜ®•s·ŽµsýþÇÍõ»½¿áùÛ˜ø¸VJ9¿Þ|¼]ÿy÷óÕÍ]oÄÈL¥5šðùê÷?½Uæþ|å¹:‰WÏ0ö\•$«òÊÚ Œ–÷ÃÕíÕ¿{Y’EÚÄí×`ÿcŠÛïrjºc‡ŸÈl°5x¹H"¾1|ž¬úv~Þ6ßDn^°¶Ý×6^ê&çQQÝãù6%G‚BÏ^ƼÀ=ŒAž·œvG<³ayÐ&=KÚúˆXTg#b¬ïÑå¿¥¶<×=¦ñœ1„xíaìÏÃØïaÌLÍS±¹G7’+kA‡ržñ_Ý|º44oZˆ£<ŒìókM/Dîë¦É)d»H8ODƾ®þð”y@,6yöCb‡šÎ<£yÈ›l(¬I»ºùÎ Ÿ>¬È{Tß2‰6Fö?áò†pVRäò®fñøõƒå‚6â™Ç›ðàžÍ<Þ´ x[R×ãm¤ðfÀöPÛΆZ‹œ²ôç‡äBXÀÕ)àܘᤆZWT¼HÒ8s¶{ ÈâØñ|Fða|z"q]@-“QÀ ë{~îqò±&“a-Óñ¤G˜âs}<Š­„ú`Sλt–ß°£"#»žFÇI <'†OÚù¶bÄw…8M‰¡_Òòx`«‘Fõ9_*R¸N4â¦=SCk#¦—U‘'RËQTûº´ËèH½õÚ”ó¦ÔX +å‡Ø¶Oë tÒfK…7T(gKšSêbv)³ŸX Ù7UÔ$08Õ;ÇúhMžfg¦’£+æ5†÷Šq¿+‹®Ë3Ë¡ãÛ‘=#)ß8xƒ¤rá•×-Ez:0îêPu×àRÙ{Y¶Ñ;šûŒÉÜUå{Œ¤–±aD¾’&{¥ÄÕÚdf (´&KÏe}’iì)N9–A&Ÿlæ6ÕÙM0é³$ä¥%fÜħ±!öùD™0Ͼǭm +Í(xÞèM•îì +ì·àRr]ÕÕ™û-}ËT<‰†ù:LÆⶉ´@Ë¢ÕrñPž3jœç<åO÷‚ÐL($Ñ\f]RØgÖ×'3ëX#ç°Èw~yÿö?ÛwŒ<ôë&C[JG™—ü^â‰õ§‰tg\—$2"hÐäDü±úDC#w0RŒ é˜ë…‘˜ÂH˜Ò=¥bêól•ÛÄ¡7˜Y0`–ž“¹ã1«åû<µ' [Ò7>€%Qj2=hà¿´db‡A#k{…  +wMÿ³óÄ^çF§™v@n£‹2®‰°TÆÞ""î(ú`ÌÖ4Ôsìå(tä9UZŠÅ§ d>µ²Š{W`;S=ÉÛ¨ïj ºx+>G) EdƒX[»~žÆ/|wO9ùPs”÷É^"U/#Õh7Ô|wýv ÀµÝ1mJ~Û´ò|âçùñÐäG}Ãp¢1U}ªºo&nU…û¦¸ˆû¨ô“¸Ác§=IšÁéd±Ç’Sr<*“!ó/p%†BÄ‹·9·ôÑeŽ)'uio2¦fiåô4\Š «7ºûm¿4ûʽCÇÚÍrÂñÌ',Ëôµ„µ¤°OX¯5N&¬±F¾Œ'à‚ÀOG4öÚIhKgÍo„<:2¾E2uŒh4Tx™l_pQgõbPJ¿¤“xüÕ$‰HWŠªlH‘‚†Z4JáúØ2ƒ’T bé:Áå¾›(Ü“‰ÑéCv,År&¹ä²Œ²L«Œ3º^©ÿråPCŸÓˆT²4ílá.¤øgE_›í‘à¥FfÅ/Ø¿¶ípm¶¦N;Ü¥DÁÑÛÔu÷7Žøòj¦áö‰šÃº>lÛ´Ü¥¾-Ü?ÖÏ!]×ÙÙåÇ×e—¢Ê:“ô÷æ¹›1›~ºA¼š ʼn“ÆÕ&}ˆõuÐ÷û±k° ˜®eÉÚF‡‘sÓ4õ?ô´s¶ˆ”EcžË¨&•D.üFAë{±-@Ò.·-„V‰Ó_ä²fs1.jk~Ö÷ô ˆQÉ«ÒLxd);a/_Iù1÷¥q8ð÷{¡çk&Mwµ½r Ì屿T~ÁÔ‰ó¶cMGNÐv]ˆ+³(·Ö%'#ÔÐû +B„ûŒë“XGŸ l<\’a¹|!ëÛüŒkÝgöTîÇŸʺ¾9Ì~] þ8ÿ,ðÓö;ëÿÿᾇœ‰Ý$ö§@óFÆCøׯ t ¤',þ6WéWendstream endobj -4360 0 obj << +4448 0 obj << /Type /Page -/Contents 4361 0 R -/Resources 4359 0 R +/Contents 4449 0 R +/Resources 4447 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4346 0 R +/Parent 4426 0 R +/Annots [ 4453 0 R ] >> endobj -4362 0 obj << -/D [4360 0 R /XYZ 85.039 786.531 null] +4453 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [124.649 711.276 245.309 724.178] +/Subtype /Link +/A << /S /GoTo /D (CUPS-printing) >> >> endobj -566 0 obj << -/D [4360 0 R /XYZ 85.039 686.185 null] +4450 0 obj << +/D [4448 0 R /XYZ 85.039 786.531 null] >> endobj -4363 0 obj << -/D [4360 0 R /XYZ 85.039 663.47 null] +4451 0 obj << +/D [4448 0 R /XYZ 85.039 766.606 null] >> endobj -4359 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> -/ProcSet [ /PDF /Text ] +4452 0 obj << +/D [4448 0 R /XYZ 85.039 753.526 null] >> endobj -4366 0 obj << -/Length 4128 -/Filter /FlateDecode ->> -stream -xÚÝ\msÛ¸þî_¡o•;'ñÆ—›Ngì8Msmœôâ›|¸ÞÚbbMd)‘äËå~}w± ”H(±ÑN¦“™ˆÀåƒÅîbÉ}L1É៘T&ËU=)«"3JLnîNòÉ;èyv"xÄŒ‡Ì‚1çW'ßÿ­Ð‘gu^O®Þz9už™º˜\Í™>ùûÙ««§?ΔRSy:+ËjúúTLÏ^œŸa³ž~O½/^㯜¾y~yñòTVÓ7¯©ãòéÕ<ùÓ?¨áü'{Jcž_>£Ög??¿xzúëÕ'O¯<ð`jB)„ýñä—_óɦøãIž©ºš|‚ã<u=¹;ÑFeF+>_ž¼>ù——E}zBW iɨ*3•:T“0š„™rR“º´zºÞ€JÖ8£O§31ݶ§3YÓ嚷زÛb‹™Þ68è7üǬðÊõ^Ãt´xÅŠšæнش7»ågj°âÚ–»g$dw ÃÚðÖ×p³ÞÌùæ͆;ošå²SãŸ,€Õ¬¹ßÁÁíz³Àßf·p ÅôOÐáÒ8-̪²¶S?Ãa€_U‚`,¶tòÁNf*XíiéøzC:£9Q[_g¶eH§ë÷tÚpóÛõrIZ/­lûwnò¾.ì›ÖݛÌÂ]µ|ñgIJ¾§“Ot²œÛyÏ&¾mjÐâb…¿ÚË°¶cåÀìÈ:°{óž¯ÚÅ»[l¹¦ nní|¬Úìÿs·xÛnO–<ð½]&7’a,vt÷5Ÿ7ôó¡ÙìP½7A.›ƒâ𕾠Ž%„;«†¼§€-è\d#Ž[Ôufä¡ß–uÉ~«öüVø-Þ4«k9ä²BiˆUxlfÊ"±ÿë\Š:+T9™UÕÎ:¹)'w£Ü œïÕi]L›ë¥7VN}/D˜"ÓE ÷ÃË~Ø׬dV–j8DÉcPöî³/ ow¾ïS¢·÷×è…íŽB­µÇß›»ËS?Dì£Ô¹ÊêÊ ¡<@«¤Î4ÄÏ<+Ê26ÒdÚè‰*!]fµè¯ç9âÓù¾ -f£d|,ë¾Jg*ïûÁ“QýiLx,*ŽÎÈ<«´ê¡»øŽ^0g@a±HUgº–‰,²±H„¸žŽn)<8ñV‘4k‘°TñBûÔ;´SÈÑÂËM‘´D@ú}"@y)G÷ •fŸè„Eö‰×ùè>‘@[Ý6Ñ–ß%¢Úò>™@[OÆ´å}2À…»„}ûsˆOç™iVÓÉ:‚O+ÐiÕ_Íq|¥ÌD™H,ë¾”îûê“Q|&×<ø%ÁçdÅñ°cúø.Fcnoè…ÜúÛ -¹¨ %ã1üÁÔå`ÌU£1·œ"èÆ`ú¨à¼T£Q—G¥‰º°HÔ p]ŒFÝúêÂnL_>îFõåãn}uq7¦/w\>îªÑ¸›Ÿ»Q|.îøÎÇñ¹¸›Ÿ»Q|.îøžŒâóq7¾.îÆðù¸ówSøCâÀKoÞoâ+&w‡ (ç^F´($,„E•ð¬X‘ó®wø2,7ÓÝmƒ/Es=¥_Ô0àÄÕ0V§²žò€f¹¤+¨šsIf/〆ë0*/¸`ð_¿mš]‹†&r|‹nGöKÔæ`p©aÅ2o6ëí–d6ÙçÑ"Åú-™³¯ºàÛà!¸£õKWÖ‚h3moî,: ȇäPÌNgEi¦g[ºl˵Šu7Ü|˜Û(aày^NŒ'ÓêqÏ“NÖ,6ÛE îcü)Ó·ðnùE)S…† jw-5ZÀ q-æ¦YÒùŽk¶ø~Õžû:—°¡Õ’y‘U£ecÝFçuWÜÙ’€·Xba ý\`Ý«>xÕ]÷Zמ÷Ëkܸ[óê}^Ý`ïífË·øƒ'…5ŸÝv7¿>¶se÷ Å¶âi¯ºµË®¦Ï٠澜E帰†dì|½³ipñ^Ÿñ¸š~„öûvóyØÞQ©Þ<¿|MGN¡bÚU+7Ô…¥ÀÓAË1ûxq¡¬ÔãlŒeÍa6–›¬TÚßÑÆq,›R¿¸áŸ¿¢ß•8ß´[Ò µÑ ÝbÉœ:>-@¡,Ǻ$…H_´”}¯nwç(äùKÖ$ê¹±† +áëõðóŒªõ?¿â:—C«Ñ™®ºþ2P « 0Ü/·DÀ†S9 ="ùE>½ºå1b]yÔ¶xÙp³¯¿ëêÉíÆ)*45Vy=½Xß¡+‘Î*|ýØ×Yè^S]Ñ¿ìÛ¶£å ¼ì†ýYˆj¢ë"+hW|x:Ͳf°tZävuƒlzCf‡0¿u{DKä_xÄ‘ƒœ‹§gëïnáÒüªßµØ¹[ÈÊ7^ûÂ6\°³ -›{bÁ ñ²§î—+W©ÆõÑC®,Š" è´R6ŒN¬Y l ™(ê¬RÂßÑmï=–X}¼Ä², !{>÷ö¸åNÜ™±ÏíÌØÆhÛ{Á\çƒÖ†ívË@9írÉ¢í¢2ät4í0Z®ÌvÏѽ!oëç+–¡µŸ8àLlLèÖ:œ·7x‹å~¾9D$GmÈé߯úTª™6Ì—¹Çe1Ú@¨¸Á{Uw_8ž»ÙE/#SEy‘ÙÆŽ3ÕºØøš–%¡pt&Þ«¢Ÿ­¬ïc.¼¢kïXIüØؼ¿g©‡³¾\U¤1²¥v~¿ô¡{k›Â˜› øÐ`½qµø£Ù-l’ 26íÇûv»£±6éÃ_ž½ž¨$LjJ(LjJ¥8NRÂMRŠoêݳ‚gTUŠè»g…)9'&_JR -ä&xõEé^=‡0LRJ‚Û¿Žâv¯€CÜ1’Rh‰+Ï:‡Gš/®Ìðè1SÌëLI7E¯¿Š¤~8ÊÎc0½-8ÇIJnT’2H l¼ â%)%ÑWç1}yˆêË•.RèË—A¢úre×q’R|Ž¤ÇÇ$¥ßq’R|Ž¤ÇÇ$¥ž½#)¥€çHJQtŽ¤¢{IIIHòTÈ";a‹äA–¤y5̈(­W&ȲŽ„í Õß¾¶ú3¾B ²cÔL6u²â@m Lô€ž@É -`õkÌ­C+¥Å(•Ì¼¬ˆ Ð÷òÍ«x„|[x…N€’EÅQBš+¤Q^x”£ÉMŠ=çNndQZëhr#ë:ÓZ~¯.œ ¹‰ÂtÉMˆsœYçF%InaãÉMˆk”Y—D_>¹‰êË%7q}9ÏO¡/E¢úra$Äå“9–Ü$Áç’›8>Nnzëé’9–Ü$Áç’›8>NnB|OFõÇI -x.¹‰¢sÉMˆîaÉ„àUÕ*‘EvÂ"Ƀ’#ª! D)ÒeYG€Tªî=?“¼2I€:Yq ˜ä(Sõ€>Êr*]|©9”2S©È¿°ˆ9ð ~ -ás@¿,ÒeYG€â½²î}Ê,hº“dú/üIóVQ¢öTü­¢4È.¾ŽÑNðZ1 -Óg;ÎqF«•&Ûé„E²×(£5‰¾ºl'¦/ŸíDõåƒI}uÁ$¦/L\Ç­Ið9Fk3ZC|Ç­Ið9Fk3ZC|Ç­)ðyFkŸc´FýÁÇÝþ8îþ¯­R£¢Ž0Z¥Ô`ü·]¾ÀÎuP&(i¹ÐÐ=ÖSµig»·ÔîxȆ«1Ý'Bì*6‹]³[¤;;¦¹#’ZvH½ðß) -*A[zœ| ZíÂó9 -3½ßÒ »ûÆ’bßQ?•ôMw±¡–Ñom`ß—|k£à/fãœ^ènÍw•túiAô‡ãŸ )òŽ*ajfc@ãÖ-¡£½l©ÝB2µC¾»ýÎ+jddXF…SE½! ±3 -[Ö+üÄŒíóP¿^°§ŽäÚgP™o°Böî/œ¬Y l`Ÿ6vóÒß‘éf8••'AŒLˆ§ìçãÖCÂ2öôâ&C>UIÓ[ƒo1 ¼ÃÓº@ÃÃVKˆHMVˆb"„ YXcY³@Ø@6KUÕþŽž‡›Î7!£ ˆ[gÆ™]8Iœñ>OZïû [˜ ò< Zç=7?ùð¤R†ô€ ØÝ”ƒÛǸ§ø$ ªÆe-©j–5 „ qOeVŠÚßѽ$}Òâ»–”“Ì!ËÅõÔÉ}ò¶1ýÏ~ž¨[‰œ­0G+ìýEÈÃQ]”ø÷–·FÌËõ¶õWrÜÎ3ÈTû»/ lúû†¼B”%”UÕÐÓF^XfŽø¶¼~¤ÒIÖ,6 tXÈ@ÜJ®,:÷§ j„7f¿U99NñЈ¤$e þQÑeÅçƒ12ÇOÔzB@›Õœpþ¶¸ifû(«€XÕCŽŠCˆ;FaDiú¬ï.!>úG…ݱ¾Ñ|lÿ£mÿ ™:’™½|L›.ÓîϺ´ùãÊ{xÏÃñô÷`: ¯Y¨˜¤AxwIږƸ‹†ÿv -{$ýz'vçíîc³4'¢e¬Ûì…Ìí%³Ú˜«­>‘Œé9¾j*ù!òúÞ1uµÿr!¶«±/Àá8èˇOLG¸q_÷Ĥ+x4}Í^fE©œzU=vâ×ÿ,Yûendstream -endobj -4365 0 obj << -/Type /Page -/Contents 4366 0 R -/Resources 4364 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4346 0 R ->> endobj -4367 0 obj << -/D [4365 0 R /XYZ 85.039 786.531 null] ->> endobj -4368 0 obj << -/D [4365 0 R /XYZ 85.039 697.528 null] +4454 0 obj << +/D [4448 0 R /XYZ 85.039 712.272 null] >> endobj -4369 0 obj << -/D [4365 0 R /XYZ 282.773 703.501 null] +4455 0 obj << +/D [4448 0 R /XYZ 85.039 672.231 null] >> endobj -4370 0 obj << -/D [4365 0 R /XYZ 85.039 384.975 null] +450 0 obj << +/D [4448 0 R /XYZ 85.039 266.58 null] >> endobj -4371 0 obj << -/D [4365 0 R /XYZ 282.773 390.948 null] +4456 0 obj << +/D [4448 0 R /XYZ 85.039 224.295 null] >> endobj -4364 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F11 2898 0 R >> +4447 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F41 2994 0 R /F62 4047 0 R /F35 2976 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4374 0 obj << -/Length 3756 -/Filter /FlateDecode ->> -stream -xÚÍœMsãƆïú`%jÅ2E:"•Íæק{¦g0 €†(S.W™$0h<èé¼½X1Ëá?1«L–«zVVEf”˜Ý<œä³Ï°çûA-Ôdµ9¿>ùö»BÏDžÕy=»¾ qê<3u1»¾ýi~ñ—³¿_¿ýpºPJÍ¡åé¢,«ùÕ©˜Ÿ½??ÃÍzþ­Ûûþ -?åüã»Ë7?žÊjþñÊí¸|{ýÿøá¯nÃùûÓµywù½Ûúý?ß½y{úËõ'o¯xtiB)Äþ×ÉO¿ä³[¸ÄNòLÕÕì |Ï3Q׳‡mTf´¢ßë“«“„XnŸž¹£†²ä[,dž•RöOWÖ%NœNõN—Ï"«k9t&¡4¤¸‚þÈLYÄ-?›uV¨1E&uÛ…¦ˆºÐ·ò°¯OëbÞ|ZŸ.Ä| ¹®lO*Lõ·ß  领óáa>ì Yɬ,Õ,èSR›eç<‡‘ðtç[,ˆ/; •µ{ú•¶Yî]…,qך‡ßÖ§¡‰:¤Ô¹ÊêÊ Qöh•Ôôv]e9tÓÒdÚèY¥³B¾®±(po=Æ”C÷Zw£´ÃYÖ™j8˵È4l(•ÊdYÙ$_=Aæ>m\úÄ|ßëbUdyUÍ¢¸/‡ôÁxJ©%î`ÕÂ{€nì†ýòñ[U%ÌEnŒçV5,d‡ûo«]/¥FU™¨t4,-¡Ílæ°W•¢Ñ°½|.µ)Å¢„Ñ!*¾av‚Y|¨ÅX)Fq_J‘¥ ¥Øb^ö¹`^)M¸–É.Àêµhc @y–Ë2†º+ÿ$¹ -åÏæ*”?—+—Y•«¹ò¡Ø\i!²î§ÔÙ7 YT=§áòt’Žô¡x8]fµètä9Âé|®‚+Q2 …âáàÞ¦òNé_ŒfΔ-)Ø(‹f@ŒUZÅho¾A$¸•Ê6‰pO¨ÂÜde%•aŒ©Cj„\o!"íu)û•XBùTi)Ö ¯²Ãwösnò?Áÿ‚ÊR €š\gÕeP‹5o#: ç¨«èýÅt\r¬ -ŠZÂyeš*ˆ‚WodUœe]çC Æd¦0i@)Ö¨©²JUÐ7=PÕ¯"“€úX<(VCnLôl¨PótÊA–CYeE•èÞcÊÖ²{V„+Ó`ÚH IêRu /žY×Y©«4˜‹łɥ耶5;&“¤Ž¯_-Âuö³E¸m]Špx1¥dExQè¬TfP…ËQÞ~9e«Â9L¯ÂcÎþ,éµ³o•D‡GÁÆ…xÌu>ªÄSä«Uâ\¾¼çóæ»ùjç;._a¾‹¸‚—cj< Ÿ—ã<éñNzA.Çy>¯Èy>’ä1ßÅhþHI§À󢜥óª<¦{™,/Œ€¹¹HT‘m0¦"©QOöQ Âô J‘”bM€š:ƒ"Oƒ¢¤Î+“ÔÇâAQ)Su@/†Y¥ Wfª<¿¨TÕÐcªõT¯•:ՀòHJ±&@ ŽÇºúAá¶Í«7¡Äj'å’£íW—¯v¤}Xª5¦v¢À ÖYÌ v"ξ¾j‡Z¥Q;m0FíD\oÆÔN’|µÃæ+¨6_a6I¯v6áòf“ˆ+¨5ªvRðµÃòyµñµ£FÕN -¾ vX>¯v"¾‹Ñüyµ“/¨Ž.¨x4¼Lí@P¡dˆÅÔ£ks¬ÔI@”Gé…NKyŒÎy=e+sÊ rZÊ׉S™I4+µ±Æ‹€ÚôŽb¤¤.“PR(žŠÀȲ£n<§[LÀ–9N¿ú>oñqôaÜT*Ëu¢¿HDÁ˜J FËrxñ1 ¦[|ä!iñ1†¼x$-&Áô‹,¨_|ŒA§“¨¤Äç•pòÀ> ÁÄëÎIu™É|dKÀ]Ub:µÈ”pVŠïV¨Ó›õúëi¥çø7ˆ¢˜ïïv× ZÖÛÓ…,ç7¨ä›5l¡ðÐDìïOÐ~{ -;ì¬ä§íw¸™¾Û#m1vtدý¢SpAÊä×Ô…ZD±toi2PÛj³_{°^G—õÝS7._ÍçR -ûª¶1äÓ6Þß/Ýô% ÑE|»Ý>Ø•´ùÝû<âotgu¬:´Ý¦¬ïœÐ&+áqÔ€`*‹×åÌÇZDÁ†®jŸ&œÑO(Âa6›[÷åË -Ó†ß} Ü,}’þ×gMH¹M”Ë„ßk¯{·Ú|vÛ}™µ‡…d-7¸eÿ¸ò§ØeØ3*.uÛpA·x~,U÷V∱N(eŠyã>¨[šÛSìtÚÔàFüŠÝ±ºsn¶îÓ^@sƒH÷«Pù>*¥A™²Íȃíèö²ˆÇ~ÚDÜã^L{hûs.ˆøjNY‡m{Ø}Od7­W»ýκ+Ú¦#ïäÁþj¾ýÕÝ°Ùê×ÐOºï]¤yHWøT%1vªIc§9ÎØ©áþ-·ú:©Í¸­S¿ØÖÙž~ÜÕy€8hêŒ_èéÔcžÎ>☥S€®¯J=íé¬a:­ÍÊÔ© 0Iþxø‡}U•G™:£¸ L,¥_ÕŠ1_lêLÂV—Xn¿ºss¦Î$h¿Ç -k‘f…UÁ£N)K¾A‘€ˆ8ÎÕN°ÂÊb†ZŒ8Çm¾U’Ö(Øø -kÌ5êìL’¯0Ø|…1ÀæË?v¦ÈWx„eóåac®iwg>¿ÂÊóÑ -kÌ7mðLÂçWXy>ZaíÔÛ”Ç3ž_aeéü -kL÷²V ­S-ù·±˜ztmžéñLAç-ž,sxFpÇ<P'GIöΈò•îN- ÈS­¨EÁ˜î§FGº;“€zw'JîÎôwg -а¼Ê‚úõÕ”_`5þÓ9>Ù¥ª†6S Ôè(sgL·¾ÊCÒúj y„¹3 ¦__eAýúj :½¾šD#ýí -„¬P‚ãª*à6ª3wFSˆqÓ‹ñ˜sÜÜé[%ãQ°q1sš;“ä«ã\¾¼çóåç¨ù -ó›/?ßÅ\ÓæÎ$|^Œó|$Æ;ý9iîLÂçÅ8ÏGb<æ›4w¦Àóbœ¥ób<¦ãSèV% Ô© -² Æ$5:ÒðÔ;xP²<Ä GxR€Ó ê]1(o{˜|4Sïþ‰ÌçQ0¦¨Ñ‘Ö‡$ ÞûÀƒ:óCÌ9è~Õç)Pƒ>gQ½>Y_ùö•Ò»Xy\A´Á˜‚ FG ô$˜N ó$ÐcÈ#zL/ÐYP/ÐcÐgôºéüO HtFñ~d¥$Ì -Õq~ä(pÎbqŽû‘}«4½ ÆôˆkÔœ$_A ³ù -ÍW˜ïä«ï¸|…ù.âšö#'á åó=â›ö#'á åó=â›ô#§À £ = /Z-W¢ÊŠ:ÑryŒ©Hjt¬BO: êzzŒBOÚ*t4(ôôµ -=7™H%ÐC,¦\›cåyÊ Î9Jç-äqÎ䜭4g8ƒ2oA_éL– WŠ<ÑÊyl¼|££œÉI00ç!I˜ÇG8““`za΂zaƒN ó$zéwp&ÿg²¬ò¬,ïL–ÆdÒÝjùèL;gbú²B-þÓ—ÛÐæÛÖEƒvãÖ7 [¼Y  Ó6y$C> l7‹æÉ6Ù>®ö;kB…6ÍÃÒz¦²gäy~e9¿·î\Œ¸ú¯u{ÚHÛ b—jþÉú§É2†Æ¬àì\n\ ‰ßƒ ¾wlÀ¥´YãvçV…/d×¼AŸ6p§ónœŽ—xG—ëø"ɯ ‰»Ù:Wíj㧔¤ýÖ5 3ßx—÷# ÖOÞ¥ŠmÑ‘º¢ÞÜÝoq×ú–Úù,á¾Æm#ÃZsû•~“Õ^íñhHõvãº'ÆwSó»;²>BÝ,©"íI;EòÊgëKw -¬¦fµÞEìËvÏv½vIt–d8®MV/=/¨0´àiFà?‰YÿŸ¾Í"j44r <!^¸ÈzçS0•(þt®ÉÄÙܨA/Åg»„aâ=͹žo1ë¹r/ l~sù~ô{7nïÒÛ¢qøØ-»Õí²! ‹ÜX ø¦q)]’ü“·²Â1èsÅq]²}üÕ¸ÃñÒ|~ ±†õKÔW¹«;ŽýnÇ!Ó´¾í[7ÿÜùZi¨:Övø¦êݹªp¿ÚA³wì46ì8¦);é,ý$QbEŠ9Y¯7ËÕgëúveû„ûîÉžmÿOläë¦Yk°èÊÜÞdù¢k1EG0]r´è¸Óù¢cÏæ‹.:Û™í™ýÒöío˜YLzU»ù>a -½v³÷UøvA0ÇÂf÷ZÀ{á°¶êBù*öïìÜï›·Qhº@ŸG.ÛiO뻾oÂ`é\;Ø»Mš‰±ó’@Iw+šAïìm覫•”½–ÙþÃd¢¸4<•f¢¸ÚFLqQ#L-.ît¾¸Ø³ùâŠÎfo²˜o©‚f‡¶…Ķ‘ùZÙ›¾5õ´§Pî üzç:ÉÆZº/ß]^¹ot_'áó‹²¢ þõ"sï±Q…ÀG*~@Á÷ˬ;‹ºéuðuÚç¦l ´áð0Ü9ôvÒ‹ð âW×ì‰Þà9b±Úm×p¿u'r¯=Ù—mÜÉv{·ãr¹?Ç ï~„]Wñ5ºt£Lpø">‘ ËNäëúžv.±Sh†Ø¹MV â—Ýêaµnðݵ"·n´ßìݬ܉ùÞÚ«YÑMÀ:Ȳ=Ü /»Û}¼-—WÔ­ƒlä5e2­Ô°xŸxSâ8ñ®+xJûÇe™¥ö0H_çCO@¦RÄÿWgß¡endstream +4459 0 obj << +/Length 784 +/Filter /FlateDecode +>> +stream +xÚ¥V]o›0}çWXÚ <à`lÃcMñÅ—ýl¡tú:ß`éUÕ2µÖPpÕ–¸€s‡-¢ëóôFãN·õ +Šl4ëÙxz/£éd õ)išlaÂôt)Êûˆ5tQ2;˜f¹ÍMÓ@µÝjݘ(’×ϺP}P`]Ú£‚S# Ú8\ÒOÕŽÓ7§ôsÓ¤•à„Ét‹b +¼÷'€¥ž¿næ0ÓJDz¥ }Ð$*Ð_æÑ]Ïõ¦d¿ÿØõÇÁÀ£gGJ°&lŒsd»‚ÿà·bÔ$æ8¢r¯ÐÙ©d%<é7©+StsÊ)ŠÝŽV=$}G3çÍ+M“EïÆz5sÛ´‘i±Ê[tJ¦K>ï]Yÿ'”æU˜¶Ã4sN†0ÝVÿxuù£¾ºCÑ<ðÚ`o{«aΩ`ãáí0oê±ÿ) BªBø®”pÆ \•Ï5{¡8&Eò®]ÞõÿSîaendstream endobj -4373 0 obj << +4458 0 obj << /Type /Page -/Contents 4374 0 R -/Resources 4372 0 R +/Contents 4459 0 R +/Resources 4457 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4346 0 R ->> endobj -4375 0 obj << -/D [4373 0 R /XYZ 85.039 786.531 null] ->> endobj -4376 0 obj << -/D [4373 0 R /XYZ 85.039 763.817 null] ->> endobj -4377 0 obj << -/D [4373 0 R /XYZ 282.773 769.79 null] ->> endobj -4378 0 obj << -/D [4373 0 R /XYZ 85.039 485.925 null] ->> endobj -4379 0 obj << -/D [4373 0 R /XYZ 282.773 491.899 null] +/Parent 4426 0 R >> endobj -4380 0 obj << -/D [4373 0 R /XYZ 85.039 209.499 null] +4460 0 obj << +/D [4458 0 R /XYZ 85.039 786.531 null] >> endobj -4381 0 obj << -/D [4373 0 R /XYZ 85.039 182.401 null] +4461 0 obj << +/D [4458 0 R /XYZ 270.432 556.3 null] >> endobj -4382 0 obj << -/D [4373 0 R /XYZ 85.039 155.303 null] +4462 0 obj << +/D [4458 0 R /XYZ 85.039 271.24 null] >> endobj -4372 0 obj << -/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R >> +4457 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4385 0 obj << -/Length 1870 +4465 0 obj << +/Length 425 /Filter /FlateDecode >> stream -xÚ¥XKoÛ8¾ûW½¬ ¬UI¤^§EÓ¦mºH²[»m´M[ÞJbJÉ òïw¤l'v.‹¢59r^ß<ÔxÁŸx\¤a$Êq^da*âñ²Eã œ|ÅŽcêX¦<óÑë÷™ÇQXFåx¾Þ)£0-³ñ|õ5xûñÍ_óËÏ“©"ÎÉ4Ï‹`6‰ƒ7×o,ƒ×|z=Ãß$¸»ºyw;IŠànÆ7—ó;Üß~þ“ ŸiË]ó/Šo—ÆZ½$»˜º4í·(–(dgé‰-ùh¸˜7$¬¿¸º1¡U“cugêÝô„ôL€7¤”ÁÌÐ H?eÝ‚^‡DB£”¥@’^¨y­,¶¦×á˜eeÅËõcÏ2€>Ë4=Y–Ë°,äèã Æ ¦Qð‘€þÀ¸_*J€ ¢j¶š7༔Ôîà^Åœ .XÌT³P¼¼Ñ=²9'fƒብZú sÂI!¤(í][Ê‚´§÷Š2°g,Â3‚1¦éBýqÎaiæ`ñ‹ÛóœÏËLF¡” )&"Xê7 xL `´ ¢|›ó.‘…ƒ.¬q§ÎñRÌ åvoMí¨ª®ùÞ‚ïa:P6j>¯·,`Œ|•B´­ˆÞbÊ8 ¾´+.Xˆ ™ŒmTí„oí!쨀o[§â!¬¹ -mQ\‘RiHŠ,èÔZ󪧴¥%ÅÇ:ΖÝC–¯\B€­óʼð°%s[œÙ¹ÊÛ¯¡†ÕÌE˜CÈU¼'¼áCØé”s~Œå‰€¼‹+¼~ ´™ÓŠÀ‡§>䇞ç°ÿa—a©÷¹Fª$gàioxÏFºC«È¿­{°¸ˆ@ Ó»£¾¢:ã7.”ŠäÊ;1p –›Û9/åë9îH)m{¥õ¨”ÓH9ÌfwÊ®ÆÙL`Ñ–]ç¬+ÑþÔô¼¶SSuO×X®ðˆÄeÁ1AÚ #ùÁ8¦å®Òîî1fˆä„i¢ö]Í]ðåOv•Ž“àFdé´0)6¬Ò–÷Þ3Ô浃ÜWµœ“ˆ[·)TÀþà³Ák¸á -@¬KÓˆ%¸õâ‰sX —Û>{±ƒ -ó -SæH‡‡ÖÖÛ®ç&ÃÝßdÂ~jÀ”CJEÇ>É„pé„ jÅ!ÚAt0®Ö½„¨£ß ‡PBy¹Z3íqÂA¡ÕPÍÜ¥ô.O2½fø„¢R{«¸ÿIòsEžéY‘Z{ãóË¥ËQÉät!¼Á‘Þ—¼úè³í H3CªM\HÏÂù†~†ÞÆf½z^ÉÒ$á Ö+ƒÊ—ñS…SQ„i!Nhü==¯Ôendstream +xÚ}RËnÛ0¼û+x$bI._º¶hƒh.ÐC›ƒbɱG +dýýî’R¢6¶!@ZïŒwf–ÔLá£YtRAÉBôÒfÛ—bOˆÜlôÌ°¤³ë3`± …7RÙp–3kÁXi£%Îçjóé›QÌ(é=°j·ñhD™Èªæ/¥(œSü»Ðü‡(Àþ³Ãº…æÍ @ó?T óü¾(lá+#Ïü2ô¿•¶O§±žº¡ÏÍ"œhdCU+ª»Í×êÍù›'̦Ï.G±Â€„Wƒ{¥‡¸®­ë×ÁAKì\St[ò{ò5Lͺ*þÎIâÚ1­d©Ê•¸+Aš`’xµïp¡Vy¾&ð}ýŠû™Ú1÷š®ÉE/ÈX®_Èeý,LĦN7#]OÍiÈ¿¦=í:M|lm}L{Ç°x ø픑éõ€uÝ÷í¬º#Õq™ÖÎ$lžñuèŽû…¹ŸYÃŽ¾ŽLitvš.o™bã}*0î6] œ•2µÙ¾¼°~pÒÂ?GñÞ©”—àü2ŽÜD÷¿¤ƒ(]„+šò Öþendstream endobj -4384 0 obj << +4464 0 obj << /Type /Page -/Contents 4385 0 R -/Resources 4383 0 R +/Contents 4465 0 R +/Resources 4463 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4390 0 R +/Parent 4468 0 R >> endobj -4386 0 obj << -/D [4384 0 R /XYZ 85.039 786.531 null] +4466 0 obj << +/D [4464 0 R /XYZ 85.039 786.531 null] >> endobj -570 0 obj << -/D [4384 0 R /XYZ 85.039 766.606 null] +454 0 obj << +/D [4464 0 R /XYZ 85.039 766.606 null] >> endobj -4387 0 obj << -/D [4384 0 R /XYZ 85.039 744.844 null] +3054 0 obj << +/D [4464 0 R /XYZ 85.039 658.638 null] >> endobj -574 0 obj << -/D [4384 0 R /XYZ 85.039 686.81 null] +458 0 obj << +/D [4464 0 R /XYZ 85.039 658.638 null] >> endobj -4388 0 obj << -/D [4384 0 R /XYZ 85.039 651.666 null] +4467 0 obj << +/D [4464 0 R /XYZ 85.039 620.371 null] >> endobj -578 0 obj << -/D [4384 0 R /XYZ 85.039 500.506 null] +4463 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -4389 0 obj << -/D [4384 0 R /XYZ 85.039 468.293 null] +4471 0 obj << +/Length 249 +/Filter /FlateDecode +>> +stream +xÚuP»N1ìï+¶ô^v½»~”€AEqPD¹Qp‘¢À÷cÑ è%ÛòŒgv†êbȆ$RŽh°~ﶹëxf¨ šj½/€þõA2Í‹¤ÙÄ›&´,s5t· Æ(0¼BH‚… ,DLÊ0ŒOî±v«^Èí½—˜Ü}=踳ÃþexøQRL95%_2†Tý´`fùVº?WSïÙ­ë§M»ŒM0ºëÝôL¬Ûö¶_Þ*¾›šjw3#Ì 4&,1,…¤j'-”¿è¿Uˆ¡Ê©‰š› •6¿PD±3§ŸãùDVûn]ž„Î=¿q-c‹endstream +endobj +4470 0 obj << +/Type /Page +/Contents 4471 0 R +/Resources 4469 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4468 0 R >> endobj -4383 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +4472 0 obj << +/D [4470 0 R /XYZ 85.039 786.531 null] +>> endobj +462 0 obj << +/D [4470 0 R /XYZ 85.039 547.583 null] +>> endobj +4469 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4393 0 obj << -/Length 3103 +4475 0 obj << +/Length 2766 /Filter /FlateDecode >> stream -xÚ¥YKoãF¾ûW9Q@D³Ù|؃“ÙâIö`I”DÛÜP¢BRcûßo}UÕ$%уÅ.c6»‹ÕUÕÕ_=dý3‹,ö›/Ò,ñck›ÝU°x¢•Ÿ®ŒRD±õã(¢ñÌâÊ­®’Тt–F÷X¥aäGYšï®® ƒEøIb cBßšp‘乧éâaû»gŒ¿\ÅqàÝl6Íqß/W6I½Û¥ñöÍÒ^»+úŠ^›½,}X®ŒWôźèh¶Ä[·üóáç«> â¨4nŸ¯ <¡aM¼0Ÿù‰À¤y',ð}±[†™·.Vv¹ŠãA¸Ä8Р.yXîAÓwBQàxûòEÞ7¬È‹uUÓ£êAþ&«=”•á ¦›ö/ùž?#3(ƒ# ÚVwªß„æ¥êŸeDR¦LS÷•H¦Âl„–ä[XŒ²28朕\,ý…?lbìºí訓yÏ4gsh¼‚€]Øa]ë -ëjóÐÛ4,ÈZîÝIv²Ö<âx‡B8¨º[aO Fªbì·,uÝ`æEÙ܃PváCaš©R1ë´-ŸÚâÅ©ìLÏ?;/z…ˆkXçš‚uÇ8ñXÌMQ3tdx8¦¼Àâmù¥b3óWõ›°­_+Ó5[Q%Ã?Wå—ÁöJÆ'_ëfrΘ¾»Ÿ9¿Ï =˜)Ìsº`}å˜âýCÕ:Õ7}Ó¾-³È£Ž¬¥®DlÐñ°n‡¾l1—‘-ÅmáS¯TÚþY™ïëùà‘Ý$`-ŠÑrX,ö[<³ë?ýªoft{*ac‰ÁKïˆW,™× å uzŸ™éížr¼´¤‰HoÓ”œöغsÓ)æD4[§˜˜²n;½‚§t§Äh…Oì·´–¥ÀðgGA±"ˆZYt|Úòïc©º±DØä|ËVEkË ©§»UeÄv«}­Ø9ó¾T[>°p0f˜[B%\…é°cº»êOmÑë·ä‚LséuÖûø  rs'ãK êT -Ýåd1gòþòb;Ñ£Àî¸+ÂÏC«ÚB<¥¤°2xvµÂOû -0pýK%‡ó*Ó3ò -ãÐû¼Ì¬Û›p¡.ÝÎîa~ER_ÿ˜$“àbcãçAJ|D|‹Bˆà,ü*èè¦'x³ŒÜNìeB´8øŸnhhdß“ –E¾ Œn»)gX&(˜„P@ïW ±Ú£«l3\ -Êýs¡ÓÅ^Ÿ[Á_u=yLÓÊ"Ý°Za•Þ¶%Û·ÚŽ:÷Ui§Ê;ܤïÙ5÷£8Uýúíº#_º´‚Mý4´J5îd“b©5LÓ|Wíu†…Ãx‡7Õ#}ôÆ×áiFD“d~bÜîßp†…d2ô» -Ç´¦7•€GLüh¢Ó4牲ÔèFÄQà§Ä›š¿¯~ÿ3Xl)ùùù*ðmž-^hø&Ï»+ëÛ(Ö·úêþê_“ŒOy­&Ì8;:Ñ"ÊŸ2ŠaGè²?ߪۦ™d§ÀóDPÖ3w‘ŸdîÈøFÂEº!Zb¦€ßh 3÷Sœµ2Ç7Ÿž8$‡Ø;=Ú0‡3/ytM}rLþÚ…r¼À)+Þœ »ÑÉã$<à€crcY›©â³€gãxê4¸q¤\‘™÷ c,ù …„)š›‹ESA³yÛÔ<‰ØçãÇ}IfØ4 Â]‘ Kb~$ Xz–T•W ‰¦ûKHîš‹Y€lVÒ¹!ŽlŽÍff’:õ¡ä>¢Ê”¬Ò>4¼sa@ß=rTÛÉê$ ²åž„†¡Ã°Æ°p{?iÔT&CN‘!RÔ_xÝ‘s®Ë|ä4Ve²Ý± žW`[,ònSu,˜©­§ ØJƒŽŠôüø+Í=(‹²VÉ[ù|87¬>‡2AmD)GOèD3ú"Õ Ì¢‡æ£=²½KuÅÅzIÕ@ÈØs™ٻúÓžKB+­|çOÈŒ›ãA¨ïo?t2?ßHœxŸ:¨‡™‘¡c+_™33Xr Ô³M²il7£ÁcYô\<¹Ü±pY¼$•äqÇNÞ†£”ö’Mb‹c;ø•µz«hPW:b+Èå'–®=£>G.v -d<)nýs¤wUid ?Ãø¿@ú˜jÜ<™Åz2MšP¿Ï†? -ˆŒ”ú,b8™8[™ÔÿiHâú9`åtê'9 NÏ44ïa·d°¸ÐSÈmŠ¾Cž‹¿†Æyn…f2fñG­xâúvgtq"«ð]MKíŸMctœøy”.,e è~ÈUw)™øð0@Ö; N'Sœ†ýú /Ýñ0"&ü­í•ªÙ¯8íä·± k.§yO4'áÂx«Kä-´Äºðš(5~Lªô¿Ÿ6Êäéb…ÏòÿÏI!?L-=I®<új³Æ†Ä'J§Ý%Q“L›5Öd~œå®»Äý¥(÷~D3 7¿å¨ƒè¼ -ƒïË}ùG`"¾èï5“Û¯Ê7Ò¼ßL -óÈíL3ɆÉY¥Aé¼8huÓLMœpÓC’W‰-7jd…ÈägÕiû œ¯SC‰?¯BqKV3 :)élE7½I¿ÆxßIú`MsY£~O zÒ -¥;<«•fÞd8JÊztmV\¼ …û˜{Fç¨$~g‹0üdö4Åj œíò0™ÿ†h_TÚ¥|XRÑZ¾²Ñ¾»!I}“&_A)ÎD8õ§4!×78ÞQö  {¦Ñöè"%±RôruBSgÜ3‰&)Íâ þ*õpŽz˜ÏNåÀÌjö~]ö›k4ô^¶3y~’øi+i×ÃíÞ´7éÄp-?ɤCºÞ&=ñ :TºÒi{¿"]¬×½ ‰¥$úÈ¢HkRP( ?`“Ëð3ZèA¸îˆËè46tU¹QÚH†K€U 7ŇÞAÏ&ïd‰*:1JÊr ÷|“1ÚQQš\´£°&uGå<ÅÕb3xv8¸v+§uÒx©ä&ùï¡ŠÉBzF_Ç• ÑûÈâˆø¦ðÖ)%åÓårPz"Åx3ùvV -¥¹â\2d ù‰/ù'à…ï@fOºñQ†ô\/ŠtÐÆßhøKéÝdZ.dCwVÀJâ°b·~T(QËB×=@׺+âªÈUòô²+Ø#ä:¢MM ÞiÞ €Òäܧ¥;‚ »É¼DÌ Ò-ûì­L>úòµ×df´xäß4[iN»d4ªö›ú8yã -sÜÑì½ ?3Lo]·öÅ8-ýÂê®P©ôz]ú1*)4‰Ëý¦};L‚›Äü_¤NK}—>¤R‹j·Y«q€>s+…<8wr5¯k?%=t}#YÆ\î´w=4F†ž®8”ydYŠ™º Ýóøá¼å›±÷¨«ÍžãÆ.à k‰ÝíV¡Íºß’¹<@h9ýÚÚ`¨ˆ;7êKåª=§™ÙIŒ†%äg·ð¤¿áK6u;ù™nÒx±S£Ñ)ä¤åóžõůyÚ‡yä¬uÚÊ[oeѽÓ>qõ\ìGÖNCäûeÝ@z(-uKaJi`ˆ<<ß2¶¨ íWöü­endstream +xÚ¥YIsÛƾëWàV™–Á–[dÇ)¥Ê²_‰U>$9ŒÄ Ð(Eÿ>ýu7‰´ß!¥===½/£Àñé/p²Øó£ÜI³Ä‹£ÀY®|gK;¿]ŠaâÈ‹¡õ…Íå°»LBÏ7éE½c™†Æ3™ÎÍêêúcè;¡ï%Iä¬6# 1⇙³*þpß[,ãØwïía¸v±Œ’Ô½–ŸOº—åת.šE¸Ï‹eàv&î]‰^À‘ï2B Ø£ Ü´ àÏ]E”jll­~wŒï?u–Ämî'ÌÉo§ª(±yõëj”kà8 ¼ (ù ‡%b‡„Ëý|.9A’8àûV»Š¤ ]¹$×2LÝ5Ø;Ÿ,Êzf$c¬ù²U½`áM»-E~ éö¼.°¹Œ·iÚƒí+:Ë0«çžAŠ‘÷8&7XåÅÊÏÆvzußÚõ‚¸{"[Ò’Ü R=-Á«˜ë#32€9¥ûÎ2€'å,ÿCˇ G,ZÕ[²YN|®Û¦ƒsQE'õ(m§hu!‹kùiÚÙñÁGèûÜ7¸ìqÛ6 uTâú±?œ‚P óÍʬ;Ú È5“и_oïî«Ò“{WÊúǬAg@ëaÐÌmöò¹ív®‚˜5ЖÌg3œÄNQ’»ÍF~ïÊþæöó½|ÔöPŽŽŸó Qê»·_äÛ‚ÿB vòÃÜsO‡î>¯À&zZ0¯üSãÿ¾5R)ö‹J; Ãûïš¹ü›ýº<â@‘ºˆØ‹¬Ù-ì£~AŒŽ"#²ÐE;8ûí«r_â8L½<áü÷íê¿|§ `þýÊ÷¢7àžKFÉ¢Ù‰6óEeY ŽJßÒb ši!oëAkU]ÊVmÇB­È•þ>UVî”®8-~Y÷Õ“øÀQADZVɺ¶_Td½ ̯ÔhÔŒ‘ˆû½äå”ÜuÓP¢¯êͬ§ºOpÛu§±xàxÏvée÷…Ë#\®•Ý®êõîO¥=Áêñ¢Án6Ü¢™8˜|á¬Ò­ÞªDKtžŸM{IœY*ü‰Ù;@o‡sù¿Îöaàe¹ùaç¥TX¢W=/%ìˆ$š:¿ˆzh&CÏ‹Ö‚,ë~DwZÚþÔ–³¶V†šÞ›².‘×´ï¹\×Ò?dqÂùns±‡b°ûæP6ìëA&éu=¤Î@‘ùÝ ‹–\©¤Þ ›º$Z5pw@.ÛC§÷€ÜÏòúc<¯.!µéYHI ”èL(-IÙ.È%q‹‰$¿ïôã¹i¹K1ÚW`¿:P¸î;|&H//Š{Nj ó°ˆä={õRYyU¸i!ÁÍDß“hX ÒÓÖÚ¿XÔ‡idP%­÷ 6šGÁã»ìúüEÌßAÐæhÖÑ_N:Õ0Ú†ÛÙáŠíßÎ!需]#]ûÄ\¥gêò©Tbr5ùhÝýG¬óÊ}LDµß7jÉ]ËHIßósQÔGÔJphP¾l­ ¾tÐÃò+÷ßŘß:×e/mèØÍ Üî-¨#mmO&'Ý™P“!u½íË7cÀ§ƒR?ñ›AãU+ËÔ*ílÏ>HgâfâM ¤—‘ΘQzà²ô @þÉ‹Òûvª´¹9—ÝB+|•žèy¢À6 ÐþÔõƒ‚;ÎÄãŒñîÿ˜¦’j¡‘eÈUu´ÆÆVJ?¦ÇnìTRü÷¯ÄÖ».Æ ² &ƒm)jzYo¸õZŠ}ÅúFà&+uÜž{íjm÷rÆi›‡ý 4DÄý:û儸Âve¦q8ÊGÁÚ®©RôõL`»¿^´K§ÃtßÞÖËK§ÝV£§Žï ðÏ,š\,"ç¹µoåݤ8­9R3¼G`9g\ õ ¿²3OÍ2`wA:É +=õR¬Gí˺šE”.4±`¤H#­–bªcd'±{_Í +ê¥|jÏ©pç’’JÖ,?-ºc[ÚB6[{d¦¦ÜÔH=Rmw‚'¶‘Lá«Ùe€€&ÖhßI÷¡ƒ)ÊšºÁŠ;\Êe\èbÌ Íã2º)_‚Þ%uF»˜žu}©3ﾬÆÍš®t«ý‰ð(r<¼MÙkêI©ˆÖÛò©CYz Þb«5m)ÐÏ "OãS˜‚_F€•J‚kk½FÎ’>HÍïã$C¿Û1ÞG©9 @..G Pc~y9ï“ÑŸ–òPf®Êáµdg)løœ¦â‚Ó"·S +ƒžq‰¤¤·W*Ñpêî†Ôß üyW­qÙNðeJR*µùŠÓ„‚8ñfDe6¨~µù;F¬x)åù–I}ŽMÊ™‡nµÇùÄ îJÁ)ÿæl$Þ‘brƒœœSt«úr°î•&ûTðœÿéFÖxC¼ŸwÁ“KéŸôQÎnõš›áéUâO*-žÿ¼Ñ2kB'<{AOG¶n_­O{©±<>êEšW;y +àù0î?IØսêpŸ”j—1â"yøÝÉkêv' u-]…€ÆAÅhëîR#GWÞØŽÜŠ—·õ‘ßóäÐõyœ|æþë(]%—ŒmòÒ½ÊÈÑ)v›ñ“{Z‚¬^=ÞШõ*)$©¦›X °Õ9 léð¢šAoS)ÕÄB¡>cŽÃ,µzôbÏ–^`ùBÖ&©dà!&Š4¿ë;ôºÁSE£÷c])_Z9CjKФÖÛ/»Ùp¨²8³njí·Cׄmts´Ïz_>$ÎôÄ/M}ûqìq¦ÅIÉ¢ËÙkµWƒ|·” ¯Åüz….«íŒe=2lÏ“¾G¯Þƒì‚ð³¿B×úà¼ß+@ŸGpvø—¿¾}ÔÄm¼¸k™%¦Ê®#Š¾Ôo²÷LÍû øêù|ù‰ÅÉ@ZÊÒ·WÆQæÅYôƒ;ÿ~Õìendstream endobj -4392 0 obj << +4474 0 obj << /Type /Page -/Contents 4393 0 R -/Resources 4391 0 R +/Contents 4475 0 R +/Resources 4473 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4390 0 R +/Parent 4468 0 R >> endobj -4394 0 obj << -/D [4392 0 R /XYZ 85.039 786.531 null] +4476 0 obj << +/D [4474 0 R /XYZ 85.039 786.531 null] >> endobj -582 0 obj << -/D [4392 0 R /XYZ 85.039 766.606 null] +4477 0 obj << +/D [4474 0 R /XYZ 85.039 766.606 null] >> endobj -2957 0 obj << -/D [4392 0 R /XYZ 85.039 676.205 null] +466 0 obj << +/D [4474 0 R /XYZ 85.039 766.606 null] >> endobj -586 0 obj << -/D [4392 0 R /XYZ 85.039 329.547 null] +3055 0 obj << +/D [4474 0 R /XYZ 85.039 637.749 null] >> endobj -4395 0 obj << -/D [4392 0 R /XYZ 85.039 307.786 null] +470 0 obj << +/D [4474 0 R /XYZ 85.039 377.934 null] >> endobj -4391 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R >> -/XObject << /Im1 3957 0 R >> +4478 0 obj << +/D [4474 0 R /XYZ 85.039 342.623 null] +>> endobj +4473 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F58 3360 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4398 0 obj << -/Length 3864 +4481 0 obj << +/Length 2543 /Filter /FlateDecode >> stream -xÚ¥ZÝÛ6ß¿Â(8­‘Ôgß6»Í]Šl’v·¸Ú>È–ÖV#[Ž$×»ÿýÍIQ¶ì<‚¬$rH‡óñ›¡Å,€b–F~ ²Y’Æ~¤Älµ½ fkèù×Ð M²phÞ>ݼy‡3øYÍžžíý|óÓ“åÓÙ‰P -¹üzóûŸÁ¬€ý|ø*KgGx|‘e³íM)? -•þ®oo~±sq_8ãQSB •ðÍ*ðÓ4œ¤Aì§Q -’‹"?+98’BúJÈ™!BÑÕE¾ï`—ùöt—9KêonSùñäf¦op%¾HÆÜ­ší>ïá„âÄû#ˆ`ô1ß.ó…ôáUrLJû¹ -¼ÛÏø{w4¤ZV@PWý\ O÷§âÔ‡Cqx:«&9ã[Dß*Ù«xÄ÷Ó¦lËùB&«:~æø¼}Þu¨ZGÔ·¦-¸u™¯ðû þ)±{ÜÈñl!UâËňš’Ñü;‚ªÙÍaxý…„oy]78ɱÃoÜág_Ñãƒhú‚©›=.ï•-ÌÌu¬úž‹åKÕÁø5}ÒC “Øp>sï•}£ À d:Ä ¥ì¸zK~då„5—s’¢ðàôéü_" >ÿ,㉈‹M¹Å÷œ©Ê—ÞrD4¨ Í|EFp`·ã’®tadÕñsß’hÿFÊ¢œÚÕ¾ÅqÛ¼­êWà&M½¼Ãg†Làc[­AÖfr$è'hBý."áióÍa½Ñ¬J8ºÒ“á~m˼ã©2š -G<7ÈÆŠê.ËvÙŽˆk20pœ½‘úþڒ¸|<ØÐûØ ô¨ÃœœÒé7³þ7À -ÈŽÊrÍ;³ô‘ ÏM•öW8˜µ|§ÛWù>Ǿ -œNefêÈë¼ynmpcùXârIâ½ÍçRz«/å%…FÚ¹díæã(ôS WCCt9"äd}(»þÌMŠ(#y}MMs¶æÈQŠH@̯ùÄ -$3u¤Ç®{|æ°©j}Ì_5ÕØ ‡˜ª-¿âñWmYðܹ^Ãø|¯s:\TdÒ£IÇE”ãòVÕQ1Á,¤÷Þ™‚T—´êo\¼(í¢zE«¸È+kv*}!â±kD3†˜@v¶+jÍ2„µõß]Ï4ùŠt¼9Ìuqû r%÷u܉þB[†jŒ[â;^£×¾…&¡ŽæÐŽl zêÊ -¿HŸæîÜpÜTì€'\d¥ÍqðùÚ~žqáVÛXkƒûéÝÚ¿h "Ø~â+¶ ‰èŠe—oÏ!’~d×Õ4g‹Ž!– “Ñšl a”ùG!±{¯&V%¸/çG[Ñ™Á Ì£Ô+òžôµ¾Ôë\Ðzì#-Á‘5{öU^sGG”¨ƒgoÍi‚]¤RØpÊFú„'â\\Wr Ï}ümOüÞ*ÔË|Y—Ü`”6@uªû -%chP2 #€Š]*R³½€=d+êºÔ³ º¬Ê ¨Øû|Ç­ßó£Ù•ú¥PémÓêøõöþ¡¦ H]qÎÄÝΟ -8qÂåIå§Y¤kâ”ËK}™JM…±êˆ‚ 8*^ž)ld—×´®ÒÄ)»(|iêb‚‡~, CÝv¹ŸG¨Iݱ˜à `pÆš˜â+¨ÒÖ L`âó‡ßµf€û‹Ãô’<3æñ¥7Üî4ð‚¾Ô{xäçh‰Â: Ç _æ½a/üöxûÀ/§|Q›u¢ 7ä< ¹í]ŽB{åV?;u¤÷:Ê("êÛŠ‚Ú¶X!+ ‹°6ûÄà"RRê¬v«ÚúKbWF¡×Ç‹à8¨o€c‡è286Dãšá@Ž}‘F×Ö4g ŸäЗҹ 3BFx KÛR1I}gg€­—€(öqX£¡p äÿÉôM »¦ò/i ÄþéJ†$Žó½QÔ !\mòŽ‹.9ï°B@ß&CãY¤ÇFWEÕ7´ŸH†2LoD>¶Dè†(º˜0[D.”˜&J$)Þ$× -†He#©â)ŽØqEÄà3~ïF5@jáô¦Üæà ¢(í0©²×rpª+ˆm˜hEF;Ò‘?Éñ¹3i0JõP8µT%QÒÓ¯j¤ÐaàÇ—/9î͇{Åy˜M?“¦ê¡èjï¯ÌÉxX“Ú¬:qWQYxDÅIÒá…VF‘úQšŽÀ;Æ‹øBfcÙâ÷p¢2¤uåÖ©÷ ž »9¯qŽJ šö•3±Ž58mù²g…ïøÛâ\x·YÏßbÙÛM‰í´²>Á ž<ýãÄ¢þž ]£ -ÐãÀC -Ã* -Š€È'òagšŽ ž'%mTß ãé φc¶x^—- -àðìt¨Z6Ÿ_¹ã;i&ö1¯ý9H´SuÔ˜õ=WJéëè ¹i¶šæŸ)£é2Žs:~»ÇJÕ´Ú΀lÄ)÷áby sqg&…w×´Zdà™0®gþë­gƒV{¬X³&²ÒIHuÈA:fÊ=Ã|AW†%|R×F'xøŽú\éìdGnçiÆóñâí9Ðe<]òÓ˜€+æ © R’ ÐŒC³ ¦HSäÈ–ÆزnK’ž‰¯PòúÛÃ/ `9+¾4¢Ë@ÃÑi¾"ÌøZ£ó§Ë=Ì©^ùÀŸKòHCX–«_ðÊ*£[xg0<‘ÅÉU¶ ÍÛã|(SâÛdÉi¬ïkôdNÙ•F<§±.à ìX¦-Â怖>&µ»}0·"ÂO.õ½K9+ð1öL¯Ü¨ó[´ú*DÞr;E²$d5 WI ῵Žß…æQœ™*~—‰•KÅuè3 ³^§f£ˆèèèªò3ëA+ ´/·Õ}«÷&ÉÓ©²™‹â Û -ºc*AéÔ._ë‡kQ$À*ë%.R ¯›õ+gflGÂ9¦YvÝv¢Ë¶cˆPD/[d}d9ÿ}¸h7xnäø5¼)'¯Ì%`rHůrlhÎ8™ äĆÆß:w×2VCÀÕ4ÐŽ%Ç|Ù[¥3uPä¡7ÇotK Ok8÷iQ´0ååIâúc´ )©š0?ðH Ø`ªÔug^>¨®WRA/°éKp%ïÀñêÙI{ô¤Ö8ðã ËBú*Ø9彚ûNê¶'®cp~ð+¼hs1³MüÄ”&ãì%i€3Q[x,F¶—ÜHI¿) êÊiâ‹Ð Ü=Þ’yÅ’eÁEȵ AkRS£úgdz³C±/%ï¹X2gϤ.+Ü?…¼Q$[„25x¼¤ÈüT%#áÜ?ÝŸ:Š‹×WÛj½qÜÇèZ›qÄÁŒ÷—Fòcߤ/k ¯Íuµ3뛚xÈ{êíP,¾Õ£ @'@ß›½Îû²Œ-Ÿøzõ|¨™‚¯²ìv Æ¿)pçê³¢ºjÕ¦yN#Ã9×ÓF¡ï% å$½CŽö6 Aø[§³?“{…¬DŽ~¡€—”.è£ìÓùY€¾ uJkÕÔÑflŒe•%m:žñfè Õ%çüv¡1ˆ­a{ýW6¯½]DœøAôŸ9D—£‹!Â=ì*ŒûúÐ]*Å)¡§«Ëkš³åÇ… $óC%FË“‚‡Yì}|ÿˆwtYä%ü4?Þ(ØìvB†¤:øBð㛲c”o’Zç/šm^í¸1×Ôº¬¹PÝ€Mþ`+×?‹É[*š¸÷ ú§6ŸŒÖÀDDz/Ú'ðï³°±àAkò%ðºÒâ÷²Õˆ¥³^bâ7ŒB…~†WéÐXåàï*‡ÈèǸY!ð÷Y”#>Í!ç/W›]E÷Ç>Þ£#y&Ÿ‚HÝ\Á]àOO{•¿fB{4Yè'©àòy]pQàxzc“…Þª®†_KÈÌs§‡Ð•ðu£éO<øó'IäzA:™'±þdUy“ Œ|;ó…â\HÎ-š‹åÙÇŸ£xâ{n꥓åƒ^'õÜ('ËõoÎOý|»üú}z”ÓóùQ¼™³k|}.Ö ¨|zî;N¿ålg÷EYÀk¤o2Þðû+œ·ƒFI+Ty„½LæÇ _^/øåw/ò°£¨‘-ì`î¼ßKž›·µÚq}ÁŸ¦},°{ä×YE ÉÊDÛBãIõ°òe#À lú;÷Q½)飨v¥š]ѯlž41KR'íóº+ššÞ’ŸW(ÀJñi:l5¨¦B‰kç¤ÑHÖ£ºšš‡žstÃ…ËÍ%oµ)r&¤—W\Y6H{îMm¶©g¡8;žˆzA{Ï{léýª!ûÝóš¾êÙɉCŸÝ‹Yñøܱa°As£eLí ï‘““¿‘Ñ@í4Uº••¶i«¬´x­hQ’–X<؇5`æ¾ãªÍÏæ®—òæoµ3TY85½´úmÖcË“íc«èxL+–ÌX>iÅܨ|ãYOêXêgm~͈Á/‡uª°»©q«o2¡±&²ÿÈRÝ[Ǧ®º}!Ú§zÄ|×yô—7 aD§Ú: ÔKîõÓíÇËÛi‚*¡sF~¼àæî·^Óä—Žûfž÷Ê­üøÇ-?I\ô-Å;û­4H3¤…l¥Tªðƒy>¡ÿÔüÒ r“ÔÙ±«5mÏä:ïèÀw~d¯¼ çËlÜ·üºÒÎ2ôëÂø°ò¿ºág›—ùó4ŠG”Ãä¨Á0`ªòæáÖ;9ÛBVÏJåkÍУ’åg´HyÄ8«¡Æ|nA±c:Ä|¾lÙ55ŠÏ@54ç‚ÜIÈv¯yÏGY …è×E—Ý—ùš‰­qE¢ø4=¼@©,6*ƒ•®o–Ü×æ¢üE›¯c+¢¥>i¹mȈdWŠÿ¢"Ú«sÖ:Mì²ö»Å!¨ šê Âd•œ)¶Mkè”#\¹G"xìG®Á÷TrbÑPÔÁhèalEÝžsÑ(„ä8 ¸ªsGG9ˆç,W;-ùÁ4ðáÐõæ/G6%37MOoÌ¢9šDáÜM’ml9MÀqØ@cPÏ> `ܨðÈ®P¢Ñã·DcœÍ\wЀh[ŸÐ×_ 9½°/äŠTý1®j` 'Fâ a;yÉ–Á©•#R?d1Š ”ŠÈ±B¿Iåì —o¶tÊI/ ¢Ö¶á6 5"Nè›…ŸD}°`1 FVMµ{êMÚB£ÅŠŽ0 ŸNIèÚe-9îê©Ìdd(¢¬Ñ Š\Aìî‘hÔ‹ž‰UÄ…Ôæà>í8IÎTüî¶ÆA(¢(¸#S·: 3c@[謊VD?¢ØÉ +ô3DßšÙ÷*eèIþM®\9Û9@X;¥wÊ #OÅîÃ*½òÁƒ¶çt”­q¿`5k~Б¬çŽŒVŒ}ã4m™¿òK¡ÒÙlE)u"Âá“ß‚CÚQ§Í8Öç à”)•Í¦`ØIÃÈYŽúïèÔ"¸‚H>§œsõ× +‹ª†sÊèŽÙJÈõ0¬VÙ#¥ 1gY“7x&¢¾L)BÇ£ZeU>™‹Ç§#¸Fžëˆ§pÏ¢!Ü } ÷|ÏwC/Ð ¡®@íó}~¾»I”œd¨h8Ö÷gnàÏu"k_|0ˆŸk U™DmÖÜkÕû¦€ä°UúÍ iîZûÚÀ·„•ÿè„& ÇÒ‰cf˜Ah‰N[A“œ0Ó¼kƒãÜŒ †ìÆ-`Ø]eœî©¡ªn0+¨WùPGœ€C³äc® ORÂÔ¯NE³#ë7µ¶Ö¡÷ @ÜÙIÅ[4Ç5¯ˆÞSý)†Z÷ûG•os¼©ßi,jÚ|èù„&ƒpxqÑœIê #eÖÛú×z/5èqöQ*û#WãV%BvwÌ.qâΣà´] Í »Ñ»v9ÁÐØeã¸],ŽK¥œUY˜Â aû¡I`{!] ªë<`ì0A&+ê[‡=M¬FÑ¿·c öîUP d~Ô<¡ïÆÑi¼²hN˜GˆÞ5Ï †Æ<{ÇÍcqüÌ£nJ*2¨o‚CSª”e?Œ­h]£öÀïòVx­ÑZ¹•É±;b¸#EÑü´I Í “Ñ»&9ÁИdã¸I,Žÿ'“@²¯ÑLÝÔ˜T çÝäýÑã… ¦º³yb@¦‘$fƒ!Ü,ƒ[öd;ÊêŠWì¨Ï®à…#KEuÍë@ñüàî',ʢ뙠"Í6ÊÃê^„“—sì÷1—sî–ä§+ÀVEæ±Zn]© \Ǥ6cWTEëb›§ÖÔc)ƒ¢†ì«×w ñ{ÎäéìPŒyωg´‹¹Ú~P¥Ñš);G›¹º\ŒÞµÓ—5IêŽUÐ^àƒ4ñKLþÀÜ.¡—:eÅD¹_ódE$ð=ÞŠlAëž…°RV¢›]þ·-•ŠR„ì¼=àÊ·dw-j}+”J“Ì;4ðº©2sõèz»Ê¯¹áà½Òœ +üà¥?Zw”ykòÖjšùQÔ›±Z³|t€5¿ë‚ + my•÷[©|b¬õpóF•èmnÚµýCK3zŸµ‹ðì0Z[%øëÛo"ü‹ªeÔŠLŸêWMSXË K ûj>$–=5½*ȆÃ)æÚ<ž,ƒŽ|Ì€õfé\0¤`Õàw”…UÁ>ês‹Pí×—±“ª8‡X=1î¼14XY_ ”)é£ÎþÑD‚3´ä".-œµxT^^Šžê¶ž”ÇB~øÀ¬UŸ™I‹cú®ð&­!.vé:œø{SUj†ç\}Æà?yXG$.þòál¸y¯?ÏÄòÍOü¼DHæ¾²bDˆâùÕM¯6m„Ün¤ž1øFîz¢•'æVx€Æ⵪LÑõº¹–´¦è?˜ÿÕÜ«ONcéLä†Áh:ÿ,ÅÿôØ\«7MŽ\µ@Ïn<ÕfPmI²¿aõµøpÇÿS{Vendstream endobj -4397 0 obj << +4480 0 obj << /Type /Page -/Contents 4398 0 R -/Resources 4396 0 R +/Contents 4481 0 R +/Resources 4479 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4390 0 R +/Parent 4468 0 R >> endobj -4399 0 obj << -/D [4397 0 R /XYZ 85.039 786.531 null] +4482 0 obj << +/D [4480 0 R /XYZ 85.039 786.531 null] >> endobj -590 0 obj << -/D [4397 0 R /XYZ 85.039 134.944 null] +474 0 obj << +/D [4480 0 R /XYZ 85.039 615.144 null] >> endobj -4400 0 obj << -/D [4397 0 R /XYZ 85.039 108.33 null] +4483 0 obj << +/D [4480 0 R /XYZ 85.039 572.191 null] >> endobj -4396 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F66 3242 0 R /F35 2880 0 R /F56 2890 0 R >> +4479 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4403 0 obj << -/Length 3458 -/Filter /FlateDecode ->> -stream -xÚ¥ZÝÛ6߿¸—hZ•DR}9$isMÑlÚ®‹Ü¡íƒl˶°²åHr“ýïo¾HIkiï ÈŠ"‡äÌp>~9\ð/\¤ÆT¶HÒØ7*\lŽ7Áb#ÿº …b)$ËÍ«ÕÍ·ob½? ²ÅjçÖÉßdñbµýÃ{ýãË_V?üv»TJyaèß.“$õ^ÞF©÷úõûßïV8¢½·wo°ëýoïnCM•·zûþŽÇ¾ÇèÓÞ -^¾º]Í=þpû×꧛VŽÏ$¡RÈåÇ›?þ -[觛ÀWYºøíÀ³lq¼ÑFùF+y¯nîo~ukñ˜^ð¬)¥•ú&U×Z Í@+a¤ü( -‰1~¬RË]ñé6J¼¢¹]FQä}*O[§Æ¾O-ö)oS•Å EïZ&jQîé­8mšG˜sî -é9ç-‘|ÂIuƒ ÊR&hë%nòª²~ÎO@sÄnhQõÈ0ž >y{(heX'D/–"Ý2De$RÛþ -¤ÉT¤½îP`ÀˆMñ 6c¯<µÑä[&ªwü²  -ÚºŠŠù½¶Ùí-î”AäÙ¢·”]YKóyÔýg*Ö†x2ùfM7ôŽ{àÉ Ô¦÷ $­¬Æe_1/xoœŒÐ½a6:vHá/ïòYkÙÕx‚q^´AÓ;ðÛø€¡ƒl#G‹‰CtHê<Õ7žrƒ‚šÌ#&`8—EOÕ>ËKë1¼ ›Ö~Ðò1´ùûï@/™8zÝ’þ$è®jrþMnUYhS$46ߦƒ> ö„ÁkÃV`tÓ­O`V«ë§¬/ý¢¥<I-Ý…KX„9ä1Œ§2ÙHÇòb‚ž€–艠ONchC»¢ r$Þ–í,@"ö-G…ϼ²¸ß(n…øÃÁÞþ “^±Oç;%kFØ!d‰(¾Ÿcú -z*Ž:ãÓ*¤ÔûÇô-…‹—RÖü,¦ÀÅñ?XAè¯õðŽEÐgn B-ÖApC'”Ά@ôEË3&‚!ô -Ž{&É‚÷cl1Ú‹VˆƒŠGnmêK…‹öÎd52X–Ò…¤ÃkaBü©pÀß–G1Vá9¿ålaƶLè,ÈH#•Ãm¼ŸpÆæ‹Í=ál厾öþL„B5… -ŸŠ3aL³>j¢ F`W¬ÊK%å0=ÆñÑ¢K±$Ü8ç ! @·žä*ïØKë>œF×›jˆƒ÷²º ÒÊýû@Úßq_-Or]läöêÑ ÑçT°v!ÅIxžíYrÜñ5›ïoZY;hÛÀ)¿¸7h$hNk„2è{Y¼kŠ¼³7ì}Œ^®/´(cVÅâ{דˆKœ!øÿ‹›qn2¸ŽÃ _ÿÁƒ¨Ǹ†×#w_º¹î^ƒàÖ@c›ŸêššPÀ¢‰Q5T–£ ò–Ÿäõeà)\ëA…Nì½ Eu)'aʸ×ÒbL dS¯J¹¢0(a%Mõ‚sVÉÕý ÏBù[ªÅ©QÕ§Té`„$uÞßq§ øÒ«þ|ë(Ú¾˜ãŽk48Æ÷• 0yê ï‘v>ë¯Ú²t¶LuÔϸC-þÈÕ*,šÐæ›Ú^ÀÖá63_Ù ¾GôÌÔU/£8“ü‹@Fp´*ã9w^Gkì¢ -$îè)8Rö%¶ºr×X¤qÈ£ì#z#› #ñQ™l>.³ÌWÍèÖ;¨%  ê<Ñ]–ŠTG9Ý$ÊûýÄ—´ŽÐ§8k%õKZ“ ´J©5R”*£½ÇxÎ×®X˜°¿À¬ÑÅ´NÛ]$èQ÷'Ô̵sx wÇ[_-×;W⨸©g¸º: ‹V$Êš!XÃo÷„$¡Aú}l»â8¨´a$êåénõ Ó}@}ØÛ7°™‘*\·Á 1k‚L½å¬9$Çr>µpã¾€$g³MÁ}géMñƒ3S~ÚSÆNì5F¶ÅŽ -¬UÇïºÎ^—©¯æ§«‡Ñ>`{·6yÛµ¼.D_G)ÇŽ¹]&e€¡hGN|d -9.æ¥oAP n ÷84m÷i¡Ál–†ø…¢´œ@LËOœŸ -é(Æ®†[NWeFru”>ù„=³ðÆÚ ŽJ¶mœqžIJpBAûÃDÍûÉDàéâì¾l»æ‘W$Ì4\º$9Sˆrõ${ÈR™º÷=SQ–û˜övuU¹¯jýåNÛÓs‹‹œ|ˆ‚'¬î¹ùì®w ìÛÖütA&Ðý þ̈§nd€>òPz Ìšº«—³ñtSóµF>¯(|HÒÇDÑäQJ_¹]Fà®+‡U-‘*gÒ­x¹ öØ™b@S»O‡âß=-ìØ‚LdŒŸD“P£ÐOÚSUŸPi?T‹å`þDÕGe¾IÛóîžYþ8|/í»Â},;zàþÛ ¿+Œv—Q¶„'Ñzí\¬ä»=vNV T‚.A¾\m¤eñC(ÓŽü0ù -ÝõóŸÑM%ƒ“ˆd*Q‡š(@ç´ØVæ‹„¡¿h‰VËSòð"óœF¢Ô£ìË5ÒÏF#B4«‘”eùƒó×_³Ì†Æ¾âôÜôgXeš9Nßs¼…)„þ]Ãó?‘P&£_sLýDâw’ù©Žf—¡I,Ã-¡¯²´> +stream +xÚÍZKsÛȾëWè¶P• ãI¹Yk¯W›µ¤XÜRªv÷’ˆ´¢Ÿþº{CrR•KÊeÏ §§§§ß=txПðX:yà§ùü|¹ùÝûñç·ËO_/fq{„y1[,2ïî"ô>|¹üpâ½—Õ/w#ïþêúãÍE”y÷w²pýiyÀåWþœ«ëÏýüÛÕÇO.9û´´Œ;W ãlÿóì÷?ƒó ]ñ—³Àóìü™ææùùî,Ic?Mbý®ÏîÎþfiÉZr.»¦¤d0faîçQú}IÎçþ<˜[IF´šøq2w%™¦þô=UÛ¼uq¥ð]NFæ$L't.üE":ý©êp6˜jš½\d±÷Ž”@¬uI*ÚLæÞ=Øk6ôo }=cW/KM9(Zx-H>U ýû(«> TÜ»/—2ù#H˜O‰Õî”,}1àž·¥À/ëöbFxkôDHD#”¥UÑóŽ0½3GâQ¸!™'t?œI<”Ix³zÎY»£#Í ’(j8|ÀŠØX€Å$Š¼j·¯KÙÜg0Üoù¹¶˜@ŒÚ‡m{À „®ËáòêæÎ$ț½Ì(þ%XÌ-hì÷ÌSÛ ½¬\3Ã̽iÊÅ!$¦,MŽ¢'ÈòÇÛ÷W·2€®¾¢y!r~ÑmÄtâ,õÖ-Khœ¡jUWƒÈ‹öÂØsÒjµîÚ¾}„b5î§F¹7枢3ðÂÛ¢¯šG…«Ð0‡Ð°w:Õiåâ¿áYó4÷aô]Ïrp¬‡~ZÏšÇäõñÜññÐ q÷4—`òòŠ`7˜Asbë žf,xZ½}‹Ë8¤˜ò}ÿwpÞôÿy€ˆ1—wÅJZÂBeµHöÌ$ö -Í3cP´lr´ µBq6­ñ Q.¾èU_Û1“\Êø^1k Xx¿5‰>Vê€X/›u±ïµXÛ.0Èê‘YŸ…Ú¸XfÍÕÕ(ÄÁ&×Õ,ŽNÂ,þ°ta]4² wÆXWO|äs%)2Š§ÄF話°»1QÄRºF÷4F!ÄQ#V¿b¾ +ð´æðÔÿuL‹³ÀZ‹?‚0f¬õ UwãK×U¯A‹#3ÅG5;Iõ~[6‚ J 6îÑ* C‹ÜÕ'AÕôNYÞ"²ôòa¥qzéß>ÞJ!ÁAK”±ˆæ…#yÀ’dÜuŒÃy‹j›µ^Z «•ceJ¼À±“°,gÙ7LG ?È…éë¶ÛQÎ}Ñû&0c°W#å$*Æj<0f9I‚“t÷(ëb¢‰›¯’Hú‰âŒ hz#r]{Ê®‡Ëm)(D…Vh Øj™9æ­œÐǾ€ÂäÀÌ™ FæZâ¿n›@So[Öûþq7LSïåZü„¡"}ã±ÌÀ–±õI(³$lŸbÁí ¹–YXTéqçRYÅ’FŠ‰ «®Äô©§ +‰8øBè¬vUÍ’©mÝ•Fd䥠Xië÷”[Rfé_Töøà Üâõ"iÚÙ>Héw¸ÙÊ7ºbûz1VN"î…ð””iÇ„Óû¯Ûº¦°Ü6£ý÷¦äáX à+{ÌÊèÔ=îJ²ÍQ‘qá@#„Ö²<¢ä8ÚËâóÖœj*ÉQ¤x͆FQMÚ>ˆ™–Ž<18u+¶HhËæW·.»ÎñåÑÆ=ç—¶·RZÕSŽÔ£ìÌì¶ÊÆ–M½ÞˆO®˜X)룢)Î'‡Î-N ¹m¯mtÊòPêj|J¬—+Uqü„Ã*Æa;¨߻ªÇÂá^‘JË­–|ÀÝO6Þ÷rT5ÈXŠM¼È¹êDZ+m +¬ÃD'6:ö ‘ºÿ7îwÚÆ5pDÿyî]¾@ŒK¡»•¯ÓæFH¾Š dã¡‘ŒòG"Aé0«†_ØnÌ)~*ºˆ˜+zkÊnò”¢,]XÝàª[ÔêÓxL.Xd€C0p¬aÄG”®€­ ù¶7å]jTýèYYpÔÁèVDÓ!ïZÚdš‚4Ë=Ä1Š§‰)O¥5‘¡89sý¢U• ÁÂ.R½1)]g6^ÈÖxsµ^àCû_ø~¸€Vù.Ž=µ–š©LÀ+ †©‰FñbFeĺ +Q·N†… ±ù ú»\âN{¨Ÿ„á)a"ÉDÒnØj‰-›mïW*OëvÇR¯Àé ¦‡uò(±2!i.O#2í‡ +QIš™½Üô²¸+Ž®\kÐU²0÷–&!VŠdÆë.e^ʼnÇ.‡ié¡íRй€" Mv³ŠšÅ~à‚ЕuY˜îïÔdn÷£ˆXÔ¶às5žJvöÌ?ê6BóÒ¢VV¨E`ªZCtŽ éÁˆ­…ïp«‡?w+ +wØÔíHFtOYÇ%CDZy§’t>eç_«Ç­ÆŠ(¼Æ$†(ÝS8å1И|àÉ“ãÌ©°ÎÎ?ÈüTÇ;âÝl¤çû0.PÕT'JyWNYá…R{ÞŠU·†A]l¢Ø«üœÒ2NÅQ0Ê A›fÓ‰œ—D¢µ¹äƒÔËœ ¸ æ'þ¤F«©S2fbÉIIˆÔ$ýñæpL+|ˆ¦ºíd±z’HÒsjC îÑŒódì ûnDÐmá¾ +âä®<>JJ{MÀrež›¢Ž3£žòÀé/‡Yo8•l +›P^d±ÈÓðê¦×<ñÔ©»Ó ÖVc?b«cŠJP¤qj¤™s½ä´5M²“ŠJÁÔ® ]³¹wMæI‚s‚MÇ@ÇçôΆZƒª¶´ §Í›ÈÎxë5Å}ËÏ ˜¼n¥axÆe~0láp<ƒéWJ@ †=Ÿ|“ÚÆÛ¬&¡‰œIi±|+ξ­Mn~Q(”½Fó}ÿN2£Q•°`œ_ÆߦÚßæ•g¹ˆ›FÖrÞG¶Ë ³+T #Z~ä“]ãàt² !S»àf¥òÜk+2¿Õ»È¦þƒIÁnÓÍùâ´ØlºãŸfJ=’Ç©lõEÞqê|Ûþ‹<°Œ¯köµE7¶ +|uc ¹ÎeªI_PÛkŽg”i_¥`“AŽ‚LÁR6›±m“Ž +AÅüð@[œÜæ§j·ßÃSÔÔe!Étßë¡bëÃçš%&nÜç +çE!©2kÑŽ\×~¨4‘p%̈µÉØ( ŠªîоVB½[µˆSSȯE?اª$¥Ôd{ø$¦íâÁ±“5ñá–ÙIyuerì£èt_!ƒ¡¶ÏQk¹7’4b±>†R!R+ü =ù ôãWð²ô#6ÁÄ©–¨`k¯‚‹Ã(‹¤" 9TÇ¿÷‘u§¤îº—U.Ÿ ÛV*Ûµ¸,fæYSwÚàR$; ¥µf:^kì×Ú$3q+íÏŠŒ"å:1Ñ“V&ý2 •í"¤¡X~;m¹‘ýýá(I,¿`f"'æÌ¡ëæøÍ(ðÎHŸfñ¤2î\‰D*nÅ3*ôGÛP’yF”¯äÙyV‰ …¢Óz‰ùs2T¤áàôáP:~àèßú)1NýDþsÂëßè诈ðú ö—¾$óó,šþ¡/%Ÿ/à t–å¯NãÌO³x‚ã`Àb­endstream endobj -4402 0 obj << +4485 0 obj << /Type /Page -/Contents 4403 0 R -/Resources 4401 0 R +/Contents 4486 0 R +/Resources 4484 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4390 0 R +/Parent 4468 0 R >> endobj -4404 0 obj << -/D [4402 0 R /XYZ 85.039 786.531 null] +4487 0 obj << +/D [4485 0 R /XYZ 85.039 786.531 null] >> endobj -594 0 obj << -/D [4402 0 R /XYZ 85.039 575.671 null] +478 0 obj << +/D [4485 0 R /XYZ 85.039 766.606 null] >> endobj -4405 0 obj << -/D [4402 0 R /XYZ 85.039 554.474 null] +4488 0 obj << +/D [4485 0 R /XYZ 85.039 744.844 null] >> endobj -4401 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> +482 0 obj << +/D [4485 0 R /XYZ 85.039 659.712 null] +>> endobj +4489 0 obj << +/D [4485 0 R /XYZ 85.039 624.302 null] +>> endobj +4484 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4408 0 obj << -/Length 3536 +4492 0 obj << +/Length 2953 /Filter /FlateDecode >> stream -xÚ­Érã6öî¯Ðm¨ªˆ&®G·íÎ8/i¹Ó3•ä@K´Ì´D*$e·ÿ~Þ’(©+“r¹ËÛ@<øS£$t=Žâ$rC­F³Õ™7ZÀÈgJ &2éÁ|x<;ÿ#幩—ŽŸí:©ç†i4zœÿæ\þûâáñúÓx¢µv”rÇ“8Nœ‹±Ÿ8——÷Ÿïq$pnî>b×ý§Û±‚ÑD;7÷w! =Æ-$Ô,-"ÜŸÀ9ì -D§j¹]Ða³'h.sînå˜ØΞ‹eÑâ~ï¼*q~‘ÀÔñL*îGÆe5°§ V+à…œ./gõ;Ž´tÀ9÷Z ·p¾YVå¢X;7eÃÓ3Äæ 'œŽ; ”‡2 ‡g`7Ë·ûg7c7Ë|Qµ?ó¢íñox)!¸Ìü".í¨–&]bjõö_ƒý¶þ³Ö¤·Ø¾-ð4IbwD²U{f)A½ãæX¼Ô‰SE˜Á­Cí±Ÿ”U‡ÊMaó>××YÓ¼¡ÂU5Ù[P¤¬œ“\¢$,\š: æ·hT¶õ«g ÇÐ@Ç[Af.K•YÏyœÅ½ƒÏ¹‡Ä›©œsÌòœ U©Ê„5LRçËK^çÝ2¢3h¬¶Ðg!†Ll¶ë|Bª=ž£)kr]m/2 -4™l*®P­ÉN±”ÓR‹¢iëwüŠÐÌ%HìEnWÌyd ‡G¢ò—=ÿ–)Ú曎­Žè Þ¯xfl|âΙ<Ÿ£UTÊy|…£+Â0+å“PËZþ@2âòt:ìÈÙ÷gÒÊ®Ì[6†i_å(UY]Ÿ¡ÁiŒQóRm–Âh©[KÂS¡—ÀÎyÑp.Wò ‹Žß½Ð{ª«¯tÖ¾÷Wåò[,s°ÎlKeO^A°4ï붃SŽY8!†`ïÛ˜œ©,"‚-ñVC¸n;{OŒ¼g¼4jö{Å3ã1a€½§ z³Á¿üî)-dá‘L~6m5©ó}â¡l`|þl¶ …ŶO C»ïúEÏúÅÌ7ë5Asð‘„{úîÓ•—M¢îxÐ6(luÃl ?j-Š£‘B\AKâ½Ì‚3ƒÞZ“‡½ý†’‡þ~(ƒØıc­ F¡Ø±íïHäÉпa£¬6²ºT'ˆäXíÀ¶µ·Æ"ã²_³I:˜[WyWe7gcBoŽdƒ%²ó˜5Ævd‡$´Ã‘YV -Øþ6MË9” Ýgb@õ÷/9×¢"?¹`P²{è¾$Å6"wûÛM:V{0”WIä‘\Þz@‡åÍ·£Š¼íí7$oýý:y#"qºƒ”Ý1¬ w“”!¹l6ƒ¤k«ÚäãYÉùŠâ¸7ïÒ3 (KÕªªßù»¨dœ“¤¯‡cT~Bá{@G @§plCÀÝýÐÛ«\üJ çŠc«!ÿj9†X_E2ñ«Í–_òÑwÅ¿/ÔÇk5+– Œ‚£7 ]¢sÉ®ÛÕÉPº« Ê­Ô ƒ&)Ôð¡ïÔ´Ô3é7Ú”0 è‰Bg“1°É %ÜÁÆn\}Å3/; dGÀ 7£•ƒY¡d€MÓkgiä—Z ÐfŠæm¶6rÅŒœSßH f’ƒ’û%¶Òa+Jªk"ÉjÝZŽ÷l¸ŽÓÎS 3Ÿ+ip”† v…Œ³Ž$9tÂxÒ­ç2 !ŽKÍÙ5$ìšwÈ(¢'†¾å‚ÂÈRŒœ‡%æÆ4M3c( ½ÓY7< ŽóJàåìÏZzLÞ‚“‹f?1b-ÑÌer¦…¹‹•sÀó°ÙñBWEñ ³Ó1;tÊìÛИÝýÍNo¿ëÃyËÏÚóÝ(qÛ†Bco«êÉ¥ŠȬ•R$y [ù3þó)ëà›jSÛB¯I¢´ØŒí ±9È'*7RÉq>õ€óÉàÓÑ …O{û ñ©¿ßßã“¡ÏëÊW+¸†ÉµgEClüïÃÕåù‡«K¨˜ÅyÝUÿ†tCnãGG3ÌáLCG¾ >c'Óð¿#Ó(ј¡CR¤ÊØ‚qÒ!þ -Í'žSL6tä¹Qâÿ¿É†|×÷ÒÂ%@§„«[ë°píî7(\½ýþ‰àc’u;»ý`‚ÂùÖ -Ú¹»—Û¾ÁòŠv¤ÂEa"‰,…‰‰>Žk¤gt‚!æ?æ;Žìf¸±³Ù 3ºÍ>7]42[ ­‡*G˜‹Tt™VmÊÉÑ!!‘šßLšS¿³n«ž5·Î% .«E–h.ÚõAV(ð3JàEt„tŠÇ64ìØÝo½ý>sˆ²yÁßânåŒ}š†äÍšDSÔ“ÉH›/{ù63© -FûÚø»p7Ʋ–Ƈýb6涢ÁÁ€ï…Bä©wr„^UOÔœ*zÜT{ÇèRŠÐW‚‰ñ%]†­å«Ëh‰ÿ<‹Î”ptº<ä{üx¯rõ`¬ïQnŠÄè|‰™–×øò<¡çÜfëµ-(€?ù¨¹uƒ„`’S%å¤X¼aÇô„©“·èuÈÿäyÉS1úœrÁ9ÂÞì¥a$²»•Å·CØÇžëùÁqì;˜é7؇ÊCö¼×½ ãÛaõYÃ@§CsþsA¡ÅÆؼÕøkƒcu§1³8î¥Zf¹¹ MľõÇQ§>ß\¡z8FΟRŠE»)-D|ýý_èZw(Cí®¤ü0‚ô;àÆ9ÿð3lqN"`ˆ ®Hån?$Dü0t¦yw?o/lqàÆܘ"~*¸¡è "5e¤\Y+[áOo¹¶ÉðkajÌÙleçv75û[•\ñT§¸hxÈH#4‡1ôù¥Í}-Íç’QåìIAàßö¯ -Ù },j›ôb8B^à-ò’«hF.1¤Ä1½¸åO>Ä¿˜Íì턽Hþ[zNq¤Å -²õ¬¥«x¥x@S a#2eš¸w‡AÕÛnÆä Zœc­e^E%‡À¹hxr¯< =65Àö|Þ¿hs»û ÷EŒDäl%F"ˆý]zcC/é„|¢,ènb ¨–[à¥|Ù7FO æÜß+ÔÀ>æå¥ï Ànóú9›É|*1ÁPóZe—lHf"_^Xø½§z@:à¥jdÊý”M`û¦ä_y´}ƒˆÔÑQ*b©=ž‹[ÐòC™‡ >>µÀZÓŒò9øÆ-I= =$£Ð=T­ßZFëߧÉÁûªîž  gGj{š’ iõÎÄ’½ûHÙ5A5E%Á†y-ÍÏ&¾¥ÐV!z¦Ç YèI‘ÉZÌËý{?¦®—†rïWÌÑtò[ t§^зcäåðú_{‘€NüT;‹bÎ+o¹\˜ÀVžÜÖ×,A(-©¨Ï¯uh¢îOŒbÈLµLlVO.öy`ƒ ”§m‡%7_Ñã³%‡RÈܣΟÉÉÛ!ß<.ÂS/øAZÖd&qŠ)ø,‡}g£—h7¶/93¾¢¯6-—æºHš‚l¥öi@eÂɾƒ‰™Qkãî†gs^‰O…ö«$Ë0ôöÒùaêØu„JíÚIz®±|…­!}©!/mM%‘Ý‘þþ›$SmÝ@–à_›·‡ÿñª ƒÄM“wC¡‚æ0ˆ\î8Ô ¤IzàÄÿæÊsMendstream +xÚ­ZÝsÛ8Ï_á·“gÖŠ(êóÞÒ¸ífo›d÷Ò›½}PlÅÖÔ–\Yn6ÿýá‹íHNçÚé´²ªyðG’Ðõt:Š“È µÍ7gÞh œ÷gJ$&"2±dÞÌÎÎß…ÑHynꥣÙc«'õÜ0F³ÅŸÎ寷³·Ç­µ’ãI'ÎÝX9Þ\ 9pΙû៾su=½û‰snj뷳{|¿ùø/&¼ùH¯,suýž©ï?]MߎÿšývövÖn-Mif=ûó/o´€%þvæ¹:MFOðÛsUšŽ6gA¨Ý0Ðò¾>»;û£Õż`Ä£úP2•º©žF2ŠÜÈ‹Z$}à*7 CÉ0t£ &$<ín>`†ž3»¼=¿‚÷[X};|DÎÓx¢œÈͪÚãï†é×ø;oÞ\ÝÜ Aún&§mîdÈfö쾯ÜÐÓdóÅz=ž^ +Æâü·`×ùÕ-“ö»¢\òÏ2ŸwM¾Áð(ÏÙ3r~ÿ6#'«‹JH{¬jx±GU¬rUí¦” ‘m,E8$§!ÕzßÀKQ•€ikg¶™-ëb“ÕϬnCš«ñün±C‰Â-Oi¹hÎD{1ïÍ-ÿ¦1´†MÉ‘ž8uND°w làe!«(ѵ¿á?ÕÈô+—U¢@^)D’)3~ðD-kÎÂÿõT°fi~ ½ó¼™£à¹eÜŽ[± YÌôÏ¡ÑÈf%j¦8’`ÍÀÜ—X\óBÃÔ¹ÃEÁ êFïõ=QÂZw,eD¿I|Ž«^•„@µ|¶Ä²†_6Ù—dŽÔ\ŒM^—¹ h}*{€_뜌Q´¶'u‘±ß-ØBv%äÙ®ôrÅ톂Ԟ6t¢ƒ€„În¿Ý‚ëÄ€kcönÁ"hç3‹•†—¡Ÿ®…šáABÑ£ƒ„¼¼”Õ,d¢o²Ö@Ƚ)Ñ.£Žf®'Ñ´ƒ}d¥Øs±r†”Kžšx‰ÌMΔãÜÛç²jøÀ¶tˆèô6,ˆÆŠN?v½”uÞ·®^Šõò¤„Ï{Œwå‚Î&XþD€GŽïy³À9>ßÄô¬i7d³mdtS±°½«æÒ ~XHöý¾ÕµæšýÊUÑ+ÎQ4½á']W8ë“3Ö þ6£SðÏ@©Ù cÿd ·d^ú4qu¬[=”œÜãÉ”¹ ¤ŠS³™ÓÓ)å»Zùó]®ò9îõ„ÀrЀEáOz>|ev +…¬9¢Ï³¦=“ȳ¿ÁÏKBòü] l«Hñp sÊÇ%‹¹:Ò"r_àɾžõ¨Ò(÷ªŒÈݳ cpδߣ1]ûnÓº8H35MÐcià† å»-iÆòÄ(uƒXŸöÄNfØE§ô‡=ñÄl'žš®õDk¾){O.ñ.c—áôÖ9Wõ“Âv‡ôƧ¯‹–Ì0"ƒvéaNÌÖápjºk¾Áy·Nô‚€@P‘ ÜyF£Vù4 +\9ŽOCÓÉ C#2hj0 ͉Ù:hNM×BcÍ÷Ǿ»«Áµ,·By‹=‚Í.¯íƒØK$®ŠO_Ö-™AXŒ šÂrj¶–“ÓXìùúOÎbTe +Ù®9v:Pp‰ú§‰XU{WÎk¦|šÞÁ)×{µVd4Á5DØ OÕAvb®±n²ßM,Ä|ßÇxBÏœï¹Î…tÈ8ôüýïtöfw.®Á—¸œñgoôýÄÒøû³ÌOHº/âc8 êï×ú³Ó`Гa×u ã”Q°³±Í‚¯z;®9ùþ@­u΄Ϸü:Çe@%ä²j¦Í?dôÁÅY|„õ„Õ#Ñ2~LŸ‰å"rM1„ ®ƒ$ÕT${ÎÆIà`s¥[[¸ŸG`jÓ¬pJÙŠö>«Ñ +ª¯¨n•Š@"¢Ù {kø–&W´{ô}SÞ–¥ èúLTÀ³- û¥¸xäÛík7ð6q|g^•x§\ qNí„eÁ3*§i]”»ǘ%NÂáiç‚@llWÔÀQ´‹ySac…±&¿À-»Ãâú&fü˜Wu³2Sûõ×]α@¥¾d²TùÃh{/Ъ7íî Yspbïáà„SeF +/ãZ.ã%«nV}^“=ìòrŽD!µvà¬Òê¢ö˜*È/í""ã2Ñð""L¹Ô>€_+¬óq˜Uñæ%“»n*ÉZJ±µÜ×]¯>V\‘‚æû>_ÄñëBðBr=U4Û+ǃt5z=?ñÈ\Z’›ªÉÖÒ)ÀwÚ]i ~Dy$p›Û,L©ì¶­ÊOåP›þ°¿îe<§ç`…VJÝ ûÂêÚup3JQ®·×¢:èIžddÙ–O½D¨Øl3ÜøºÝ¾Îµótôñ\)< +9¡ñŸPjC ¬p’åŠöÈrœªÍFú¦=<«óÊsŽÛCŒ æPTÏãD“û„ G3Tµ*Ì®à«\…DEÓ³¨—ña 7W×Ó”[À…4áç¶uÞ¶T×vS*âæµ£PÒ +Ž$Ï*Ö´NÜîg ^G$½ ÒòuOºƒÈã»ö7Âx4- ¸Øú8VJ9ÿf†·v™õ·bžKxÝù¬êÅÎhÊDgV÷ÁRæù´I¸[«q£¬MÒ=‘ÂüP ëÇp¡UÁÉ+¥%3Øé÷CßuzÐé×ÒéŸRóþN6 l÷(r.ØFJ9˜7¬¥‰JŒEhÏCË=7xmÌ`óßW‰¦\ÞÌÅq!Ó´!JÇÇ 47•Õî$&º]eä~º¾úÌ侃äp›¢„ËEM]ï +ã%ržV•5Àæ§Ôù‰Å[³ß‰¿›éÂã.0ð¦Ï“>’Ø¡ü®‰¬Ôѽ‰ù¦¡ìí:£¤T:§Ju}k }(æuµ«fM[­}IriL U±î”4+sÞáecœb¹¢ÀÍÔ6öâK{pwEݦRTYkª6ù/=0ëý4¥è§Éá•Œ»²Hæë +Àz Ò¨:¹Œ®Õ¤KCtý²0ÈÅœç@Þ\ X _3‘‘;mƒ1¹cBTŠ$Ë ‰Yܵ-œýýAÐ÷Aç\}xðÃ1ÿ2ɾø‰ï$LÇ „¯)%_Mž¸o˜V4,cÒ§ïdëM{ÉÇ÷9;®&+JÎϾd¡”ÎÛT ¶Ñ.”1Ïë\.º »Ý͞者ܞ› :‹ïYŸi{>â,~êI†$HÊ1’fÍÉ𨥮‰q»jݪUôéÏtyÕÁ7›ØV1G: ¬°‘Á=7×lÝiâÏ€‰ÄËgÍ‚÷`çöÀ33íJ®kiíÓwP*„ê\*9k,L1‚šEr¼±ùŸ?Ò¹X7Öˆ£­B¹ƒ$)A&Oö&¿.wH™RõAZ‡MÛ }]P¾çÆÑé¯ – e’Ãƺ§ÜÀÓ­"Ä |<Ôh91aä*‹·W¿úk×û¿ùO°“FñK£º5‘ë[«G£×ˆw¶}Ù! +<7Ô¶Ýÿ¿q¬êÛ(8mæ[—ÚbîòwÂÉbÎ>{þQm‡ÇÚ ’j#Ÿ{ËZå…®TÖÎVæ˶æ6]A7æÖ ÅݳŢû(¿vúã. µ—güÄï’ÓKëtÕV¦ó×jÌÃC×¹(rÃèt#¾ö]‘yÍu‡gû©ž{dq¯ãZ¿â·¶vÛ“†‰×Z†ý˜ÓÎÆq q,ôÁ›B)šz<@‡n {?Á_Žä?ôŸˆ¬ö¼›&G6„CÅ1‘zLJîÚ‰î±ø‡WÌ:endstream endobj -4407 0 obj << +4491 0 obj << /Type /Page -/Contents 4408 0 R -/Resources 4406 0 R +/Contents 4492 0 R +/Resources 4490 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4390 0 R +/Parent 4468 0 R >> endobj -4409 0 obj << -/D [4407 0 R /XYZ 85.039 786.531 null] +4493 0 obj << +/D [4491 0 R /XYZ 85.039 786.531 null] >> endobj -598 0 obj << -/D [4407 0 R /XYZ 85.039 547.705 null] +486 0 obj << +/D [4491 0 R /XYZ 85.039 766.606 null] >> endobj -4410 0 obj << -/D [4407 0 R /XYZ 85.039 524.989 null] +4494 0 obj << +/D [4491 0 R /XYZ 85.039 745.613 null] >> endobj -602 0 obj << -/D [4407 0 R /XYZ 85.039 373.626 null] +4495 0 obj << +/D [4491 0 R /XYZ 85.039 621.549 null] >> endobj -4411 0 obj << -/D [4407 0 R /XYZ 85.039 353.637 null] +4496 0 obj << +/D [4491 0 R /XYZ 85.039 593.845 null] >> endobj -606 0 obj << -/D [4407 0 R /XYZ 85.039 284.175 null] +4497 0 obj << +/D [4491 0 R /XYZ 85.039 567.352 null] >> endobj -4412 0 obj << -/D [4407 0 R /XYZ 85.039 262.979 null] +4498 0 obj << +/D [4491 0 R /XYZ 85.039 542.375 null] >> endobj -4406 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F14 2895 0 R /F35 2880 0 R >> +4499 0 obj << +/D [4491 0 R /XYZ 85.039 513.155 null] +>> endobj +4500 0 obj << +/D [4491 0 R /XYZ 85.039 486.057 null] +>> endobj +490 0 obj << +/D [4491 0 R /XYZ 85.039 278.114 null] +>> endobj +4501 0 obj << +/D [4491 0 R /XYZ 85.039 243.369 null] +>> endobj +4490 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F62 4047 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4415 0 obj << -/Length 2942 +4504 0 obj << +/Length 3072 /Filter /FlateDecode >> stream -xÚµÛrÛ¸õÝ_¡‡Î¬41$@€dÞo²õ6qÒXžíÌvh‰¶Øð⥨¸þûžx‘('›¤£Às¿ÁÁ̇_0‹çëdÅÖ3:˜­Ë3v+¿œ±åæÕêìùÎßKüd¶ºíÎI|Ï$v¶Úü>?ÿûË«×K­õ<¼Å2ŠâùË…Šçççï¯/W¸Î/.ßàÔûï¬Æz¾ºxÉk?ã -Ì…ó.¼|µX̾¾Zü±úõìõªÃs@I 5bùçÙïø³ Pôë™ïé$ž=ÀØ÷‚$™•g¡Ñž µ¼gWgÿìÎâµpÆ»¦˜â –Aâ%Ê<Í8k=ëÛŽq -VCO‡ÊÓšEÆx6ŒˆsÀ, ì2aÄÅk x]ï+·ÀkçïÒ*½Ëʬ¢÷ø“óÆþ¼.v§xc”›øid{B60)wÈêÀS‰!d¯Ò¥t“.õb©@h÷€mSãÜç|ã ÑÞñZ‹Ó !® -ôâß¾ñü d§c"ÞoaÝð¸d’ñ´¬ÂsZ>¢¾åõë}©áÙ´Úð L×ø½mGUƒÂÔRXJç~ÁxÁ|µÍè5C6w–Ê:!j;yÕL&Çë´(² î{þÆØç"íÅ 2Ù• ­æ7÷éOyø§mè~(ðHËñ‘Ê÷¬uGÞƒèÕ|sCl“·g†Ê³q"V`ËKÄ[Ï[bOƒ,‹Õ€HZÌ{Z÷ÈÄN¨ ƒo²ÏÈFšB¾Ô÷%;!Ì îlå<ÒÏÙRù ç¡ñ÷ò=¸eáÿ’A:iÝÒѳ>£gEf[87¿ç…¼â…1fEá‰[Ò!€(«çÙà£À®Êä„àõ!Gºä冖dGÊÕùÛç+üà?ø;¿\_ •ÇèÎRø¢ž¶üRÈÚ§¿—¨³û5"»ˆü“p™7ËàÝ?âCdwtˆš_®B^ü¹&n¤dðWìö½ŸzWu(XÁ|üÇyгÆyäµC°K¢ðE°Ëi뇑ÐE08v²€Q¬ƒ†Sa2РÇz¶ìçv:Ï@(w@ÄÏÍIyk«…$@¾aNº$ÅU(õjÑå1â#AçuŠHž&ùv"ûýO)@HÁr¦6› SC…Å=.9D÷öch ã(úfRûí§)$!«Ò›b’PÌ+âˆ$âdü›¨o¤ìwÙï‚N"‰æ; t!%ì!±Æ ƒÿ#±6GðüfbûýO+@äƒ2ª¡bÎ2áyy˜¾};匴gÃcÚCÒ)âÂØ ìw×ï‚8B¹éÁtåU ¬òʾ”£ÄYÕ~'œY̘ UZ,«N, N,¤§Ñìí¨É&yj³ïóÍa@Yjï¬S—ˆ°’Pm×”i1rìÂåÿt(ºÄøQJKIXôÈÉj/4€8!?æ¾Øß ®R‚£±™€ï‹ ]½{Å™¾Íٺɦº#ˉ¾ÁÖ£3 ÎüÖŽÙ™ëÆaÈ#Á }^;O‹}oIœÛâh96½mÞº*¶Ý7=ÿ1༿ï¼t§QÍàÄP‰ôº¯óS..¾Š×—Ø -1òØ‘•è9:nw|Ìî3lo Ì·œöò¹@Æ„J -¢ÐÑ 3Žë2ÏåÒu©v°kë&“oS·‰IzP9<ÃѪ°—)Î ‹EÊb'’vbÊ}¬W’Îiì‰&¸:u@¼féð­«Ô³aÍóD±)ª´èÜ@ßìé¾;êúŒÊ€ W×Äý¶í+FjOæ”S®_sI»á)ŸaSÒŠncâ’l\0ž'¸œŒcœ©Q ŠGžN‹ÂU¸ÆxSsì.ð[~öœ£Ö©,ÒÞŠ_ðžÔý”$G¿k9|‰)*±ìêeìøà楈UIuÕoÐG¸ Öé`c›ºÖ"nJåèúžš?u…Þ'Òænßõæ¸^A…ñÅ5Šû#™cÓîQÊ:µ+Œ`L÷ˆ-ì5ª´$(Ð)ÜQï\f„¡4>¥*Q@ò`Ï/ùnË#ªÑ`+ç6P¹ï¯}`4é‚Ž©è…] w(j¦98É[uìlŽÃ[IKß©dþq< ’¾å c~ƽ qGiøÄ Ahr€xðaYG³‡NiQÔŠF[ÙñÔ¡(úœR;^ë}gpȲj;Fm‘)6ܺÈ70Sñc®3R#3p­a’ú]ݶÎ>8£ûÊOävýeÏl’$ÆõŨ‘cAù)¿«¯©çË· Zû‰ß\:g]kßA8;Å T‹´t")rj¯Êm>¯//þÅ£}ßj#|°£&@=«yA\ÇÌÀJlã#Ÿu²9«¼è‹ÍYÓu“úæìBzßÇýYÝõg×l#eZm†·u±e÷˜BãyáxÀù0ê­ -Æé¦Ì«ÜÕ6t“wº#dzÁ} ‰7Œw9ìÇ >°‘:2¶l¹Í\KmbMäÓ¹rápg”ŠºL³G]KÍÍÒ¾3GýyfËÉ0Óçº6ž—u#w›¬MóbÇÓÔÔ„ÉŽ7â&D­"Ï×ñ_¸ðĆÓ&»¥Ò >ź9«ˆQxæž #q÷OÖ; À>)¢ÇÔw¢8~é® •—Dãæ’=wAÕµÃ&.g6&Oßÿ`N_$%ðD†÷Hêð /y¾äõE³s ÃˤSI $ÎOcÚAžcº«(¼ã¯¿r¶^dákŒBª#=ºÅWN–#§¼¿ôi$ì4 -#Ý'n¸tƒÖ$ãaBZ÷6QyutéYäÚÝm(²jE‡×-¤@BàÀîoR‰Í.þÓ½ìT´ ¹÷ÿ -7µ2ß×JQchúþÓŸ‰-|×Ðt*Æ^«é‹INÂFÚ!ƒT%öa£cÏÄzãÿ8ÁQendstream +xÚ­ZKsÛ8¾ûWèHUE ߽ű'ñìÆÉFNù0;J¤%®)ÒCRqòï§_!‘’³›”ËE°Ñh4_?Ê9ðçÎ’Ðvüt'‘úîl½»pfèywá +ÇBXÏåÝÅëßÂhæ:vꤳ»-'uì0fwùÖÛ÷o>Ý]ž/|ß·€s¾ˆãÄZÎ]ë͇Ë7H¬×Üûa‰OϺ¿¹½ú8÷ë~É·×w÷øþñó?™pù™^™çæöSß}¹¹ºžÿy÷ûÅõVÜXšëû¨ö_üéÌrXâïŽí§ÉìÚŽí¦élw„¾¾¼WË‹kYÜÌxÔ”•B?±ÃÄ›É 3¹®gû®7‹ÃÐŽ‚˜ìô¹˜/\«kª¯¸ª¢cËô[0TÁí,Ïá¥e¾ŽÜÓ<ˆ ¿jVYůo³>«š ¿ð€–¥·ËšŸý¶àFÞì²²¶OуÕéy| <´ðÀ5î¸vàøZ.ü?ŽÏç:‘„ɹ a;A¦óò†ú¶Ooç÷!â±ÒG»Ùž±zTºÂ­ÈžF†r@¾oêýÿ+Ç¢^Ð-ðíäÈ ýšõßLLÖÄvd#OWöóŠ‹ì H„ÇF¦Qc?·%¬·ÏVUa@¬ ƒ““9¾º"èŠ@51ÝÂ@ ,Ö‹m'eõ?µ ¹A˜~-såÎO÷ Ty,·×MÃzPU‚òÀZá^Ñà"—Ñ2‚ˆ´´bXÊð£8°ýÐ; |ƒç4ðÓKÀ?3á/þ±Ò“À7•~ø†¼ŸþyÝø¦nü)¤®'!š†¶^„¨ÙqD⾜¥Ö~Ç! Ò«pìÅ€µë¹…(õ¢T£Ûä4‚TŒç +©Èßo³ž¹¶yEkÕ' X"¬C½XâPJS 5¹øfÍ|ƒ`׺BB[pgƒËùŽ†Ë,\Èw!-9Ïp\ÆÕ[qÒWÂðÞWž3¾"L/úÊé ­¯)=í+†Ò/ùÊ ïç}å¬nÊW Ý~$I@=5GxŒ½²MªÃ»ËlvŸ ¯îlzéÐó(}LL”8vœ$Þw7cð¦Ð`†XõLyc˜Ú¸ûØûö;€Ó ­½Êì°B¬SgÀ%&Ðîóu®2ͳ*¦ ‹ü ÒÎÄ©/÷`žŠ.`$q“û#}—­ç^lmÉ … Ò +Ap­ srÅwP°!L*~ý‚<å_{é½É Ž%x@Àµ ‡œSî†xÏùÍà9í~Šé%÷;3á/u¿c¥'ÝÏTú÷3äý´û×MÜÏÔíGÜoy¢FOûÞfm¤¹SκväGÿ»³¹àlþ¯}ácDŽ™cð,/Ž¬`ì%7œ+¶ž;&¯«RÀ,ô&|VâJäFH8(Ëà!a P MSë~"ŠŽcq:X#yKq¯0:ÛbSvª³S‡:îòj„xK„þòæã’ (.Û ]ˆO¡£#ö?À¢q¢ea¿ŠËdÃB¤ì}ÀÈd…¡7S8—ÀÁÆR´/ÌêH¹È‰1×ÀÏÖðl„Ú2hIYWºˆEŽ!}ÖòVbæŒ'„ä€;ìU÷ÐG*~ËÖÂʆ@KnÙrªÓ´Ÿ•ˆRì@T²nŠas`‹o6ÉËð8–=jw‘ÁX{VÙIë¨9ò¢/ÚìÀHÅÀzÖ[?€ e¶Fžu#Kî k¡óžP–3e>Nååa\xÝ­éï4z›Éo–ðSßFªeÙÏL滹]»§d¶ËW7Äؽ‚QTñÛjœÞOx…~JȦEBû_ÞĘz·d‰’Í#aƒydP^QË™ — ‘]>ðóêV=¨ž[ +6ä_H(€|ѹÁzgO J9dÎgk-|­ÓŽ4’É Z4r¥Š„3ëèÍC µÒ4!Á;Dšž5cØÄÌÃû¹Gû‚ZE $‚Š{e‘0¨U²!(õè¥H©“pa FX¨Á™šZ ¡Ý‰qwždOpp;å y#ñЇ×v8Ÿ}¹úÄÝ`dùšo-z ¡hå1>›*£;|eb‚ZSíÅcñè(Šç¶λ¿wûÕ­=Ú*q(ÕUщ|$ÞÛ’ËSnî&G¸sÙ O>c‹·õȉ^Ë›OB@×É•ï¨[š¤"†°t{Ô\U;ô{³Dvb-³{•ñ°§V(Úùª ؤ›X‘Õ¢˜Þ'h¢éÈ)†åL£’i*öz’6uXtU<âÞ:“—”älÂD¡ï¿r‚çàJD w ¿™­Ú¡4’ì 0ÒÅZÈGýÐpŽ]Ó /G\÷Äj ÷£ ¼G˜´÷×4¾pÕÝdžú²šœ|_¯…,k;T0§N…˜ûQàpxiØ9‚{PÄŒöz ÌðÜwÑðôÇg6‡,àqñs˜s@øPå2ïs‰PGî}'ó“Ÿ…{ÊË™Ÿ˜Ž•t"Vº=—`,’€*-.¹ +çÓ%.ÔH‘µÜžÄ{€ÿ‰KŸ!ÁÓÉ+pfÍ/(¡Î"0ív1zðœÎØ-AÎ^D Z¡÷‡”Â5Ä£Sª¨B™„xbÍFæcÐO¦¦lÝ6þLâC5-jB[—¤ +›˜„») ]¡-ã4êJ_G +·ý÷?Ñ¥GVùVÃÌd=`(*"¯eQ@aŒp][á)«ä–žÊ•C[ð¥ÊeòA4‡w%]¯Ë ­X7«Ë`O¥F€gSO',µßlÊD•bÐÈ* T +Õß™\|ƒ€‚ K «˜ZÈ™¼ÝRÔ“ÄÉ á>0“`TÊc¿Ø/ñ d&RTÅúà¤ûŸxlLày $§ö4Âôž»X^ãmt€|323ÐVíaP4Ý3×ݶÒÒ‘¼•¹?t´á¬³•¯”5®Ý¹/Ò 6—DIŠbvR¼vÕqw½çr#Ÿ™÷wõÄêõw•¦ÂÏ·‘ƒ©WǤ Ãcqy‡ò€`ÌÆç= e"M?øXÙ±T-ž?ïÈ ¦+¡oÕ1“˜ ×mÈ6/ð]…´S{ØŽƒÈ‰½„è›P{àÄÄAÏ#“KhóªÕV!Ie.úñùЊ½0 ë"kÉÇD’R‹èâ›Æ~VoÔúpØȱ™\I±HÙ%¨­.b”‚r +úä‰N‹hñá ad!©ÝåãŒ3`X;…¯!I@ª:S¡T¬U•HkV=ß#ã«|sP9vOò݃ÿ`4þŸ™šïä]§ƒs&C³V„òBçD~W4hCx¹–·?q-×]¸!6¡°+ù›UëHÀl€<…ºn6“v”?·E•s‹îËà™‡¾´S‹B¹ÏÛRÝ^ ïÔډ˒Ĩ0‘Ìߊô¸c—õŸo^h]Ò`À¶-¸]g´Í­¼ÒÇ©#–iSľd¼á;-NUf<È8l¼BÕCõ½+8ºgš”NG3oË.ùÛ\Áôå® ±»k쟀ĮÑn«[Pu§†qYÐKäi*¦?ÇPx²5¬a5[Ó(6¦Ì„Wö2öx;ÄwXWÙq´nuhV>Ûbþ:{澓„‰}|˜g¼5owÉß•.>.q©/5.ƉqÔRNGé“Æ]%á=¨FÀ¡ÿ×[>“}Åü+ºÌP1¢]ø9¶ôÎå" #—Je|d #ÈnÖlER2êê§ +ë¦U_Y‡t¨yñØ£1xPöâá¨9ú¡Žü ÈÐ6ö«¶JÀh<:©4™èõÑyzød0qgì‡vÀ?™:¾4†ÿÇ~àrîçTÃÕsb§É‰ý!`,Š¥ 4uV?»kü7ª¼DÉendstream endobj -4414 0 obj << +4503 0 obj << /Type /Page -/Contents 4415 0 R -/Resources 4413 0 R +/Contents 4504 0 R +/Resources 4502 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4390 0 R +/Parent 4507 0 R >> endobj -4416 0 obj << -/D [4414 0 R /XYZ 85.039 786.531 null] +4505 0 obj << +/D [4503 0 R /XYZ 85.039 786.531 null] >> endobj -610 0 obj << -/D [4414 0 R /XYZ 85.039 766.606 null] +494 0 obj << +/D [4503 0 R /XYZ 85.039 506.75 null] >> endobj -4417 0 obj << -/D [4414 0 R /XYZ 85.039 742.055 null] +4506 0 obj << +/D [4503 0 R /XYZ 85.039 463.797 null] >> endobj -614 0 obj << -/D [4414 0 R /XYZ 85.039 661.833 null] +4502 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -4418 0 obj << -/D [4414 0 R /XYZ 85.039 638.515 null] +4510 0 obj << +/Length 2983 +/Filter /FlateDecode +>> +stream +xÚ­]Û6ò}…å"ÖŠ¢> ÜCÒäri‘M.ë"äò@Û²-Ä–\IN²ÿ¾óE‰¶äÅDäp8çÛ«füS³,öÏÒ,ñc­fëã]0ÛÁÊë;% AY88/–w÷ÿŒ“™ +ü<ÈgËmO'ü8OfËÍ'ï—=¿|õa¾ÐZ{€9_¤iæ=Ε÷üí‹çŽ¼{^}ûˆßÐûøæáå»y˜yyááÕò#Îß}ø/>ДqÞ<¼fèëßß¼|5ÿ¼üõîÕ²gܹšÒÙþãîÓç`¶+þzø:Ïfß`ø*ÏgÇ»(Ö~i™îïþÝÓâµhÆ»¦¤ëÌ3=“Š'ÄÇ~¥$¦ç^æ .ÇÞz¾P^]Œþ¨hw†Acº ´Üí`:œ$Þ + ó¥åieŽš¢%2@8› ’ÝÜ× OW Lk<ûb·%.ï˜BIwö¬ADÓÅ­Ä`_”dÞôoÇC+å(ɽƒ8Ö€Híûû f&ƒµjÍxøô¦!£Pô¨4hoYk(”•oß,qËxh¨‘?å"‹2o¹/…B7ƒÂ´L½a¢8’ë);¨ÙæDMS§h8ÈÁ“ÀòžNUNy–œH5ù,‘ ¾ + 7Ƚd¯éøuW²8<áRÆ^¬Üì +Au.ÃUÑ¡ø]u ðÑÑXpdDÅpsKgˆâÓâp ê='±‹A3¿ûâÆá oR#ùøÎÄá£Yòä09ëŽÂÄc´šJZŒk,z³Y”5AX/ÈaZ±ú‰ Ð@×àÐÆ^-!þ>¤¯hq|Nz£lZÐyÆK+öÆã˖䢯ݓD4§à .=ðªš]Àù}8ø\uí pÙF±T¼`µâÞhréÐ,pש×ٯ妿ÍMŠÑE4ÀÞ_{QìÈå-à²ù`\8FéÑUÃ<¥#¸Ó)+ëƒdqKlƒß‚Ô¼l¯²^GÈß\yø\AŒAvת…±—½mˆ0”ðúšq¬õþxT{F½AŦéµkc¬̳ÀÛžk“^1œqÓ_mÝ¡ýã +é~ñõ2iÙÙ¡â« ÛÄÕ!Lfäq§è5® +fs)D\›Ê©•õŠÝ½+«É‘WíÎÔ´ÎáÀŸÌ%Øz{53UÙ9Y×çƒ$3}Ž…ð¯È†áñK?<>c¬{6‚õý¾†ø-@S V’ÒÿF2g™Ÿ¨è‡u‚ƒC p«ÊÏÑú8N´ŸA>w…ì8ˆ«ÀÆqà=]GÉ€NRNéàûqvˆUXèëï~Ïà Q€|k) ïnq(?Vù¹pn¦íq˜ûœ´/ç™f'¯EÙ:žPîÆñ‰¶ÍðVN¦•ÖBkÇákø3Α˜H€5eåR8šASËÊñy¸Xù¤ó®¶,‰^E`û6gØ°¥ÙTDÍ…¨<¢ˆàqXW#Œ²/ÞÕØ:‚)ì°9ž:¦”§Cð1ðhJaî-\ˆ%ã[¿¸N \„Ì1*ŽX¹M=x$Cç¹'Á‡?=¼[þdQdÇòT€aZ†þ¼op7‹µá‰Á#©fÞ/’e6äÈ…UQx Haå€!‚CônÏ[JÙjª‰ûâFAà'—¤€mŸzàìhz'VVCŸxàl§e»Ìšâ"CÈ‚˜Ó$‰^"‰´Mº`qDå +JgÌ“›/ã|5~§\ÒÍà*?%=? 'öU¦s_M¹¯ ›T&dKˆGYv’yÍÉ|×k#dÚוyÿJBŒ‚féô†–¥y¼ãb +ËÀùt6ª¦Y‘ˆç,A[JMYyW®ËÛ–„lrÜ “äÑ­‚>ßq}ò±:€”³¤·†²‘ñÙxÕX_E’”a»sC¹b Æ‹†?ûìÁÕ³«`²LB<®¨å¼‰êä|嬹 `œ:Ž2%ï†Àòc[F$®³¶"@« #ï\™•X#ngç›H!9дUHr%š–1j9õ;*-¹«ÀCŒöÞLfìHW+[ƒ»I^eÛ¼€v‡_Ãû8vUçÓuª“˜Ñ&z/¤žÄDèa—A†NŽI-9îPÊOºe/YØŠVX7–Ùñ•Ç*ê6lç ‰YÉ#«>âgˆy´d“Ð2¾†Ò*ö‡Ò\#q–!e‚—þ¡ò .äçºZ£FÒ™ªnØéhdÈ1œèFPh°7h(d”NXûP%AÆΙ8«+JËUäd¾W¢’‰k±S·¾E*#[à‰I7¼sx2$LÙ"àTRðùÜ°Ù.1-aØâž:ò1.¶΄HÈù€#ÎGÇ—ÎGÇ·Ýú3&1¤3:¶!&†ŠËvóú-àÖ§¡~×\ÇÑ.t¥£|Úax¨Wæð™[ÛA±»(^ê؉â%¸%9ê‚!.ºßÃT7ãg‚Å~žfl/™"ø }è´÷þ<‰¥#Å@A©Dj!ÔâTŽ%½$¥áE‹R€Úm6à”â%—q  ’¬ØY8mBh¯»8黃iÄq[J_jÄ1£þbª§ýÀ{ãc3¨þ*ø BG19!ªÕP}6¬`CK\¢Ciw]´Í÷6Ñ$èúÎ;ˆ¿AávL°¶m1éÈvkÀWqP¼šü +^t­xZ/rÔ5ºP<óÛ Iî çü|£Ú ã*¹‰|Ò<•|ôÕ>zôƒžìçy8U3ª õÃ(œ-R?NãúÛW™*ý,bF¹ŸGñt™i±,^úÕ÷¾‡w’P†—ï‹æ‘Â4ôU˜Ïœ“FìXœ³sM ÙyyiÎŽƒÓ׳ÞÌÛ>äô/ë2 ÑØבšbxĸÅý1ã¹ò•ÎBÐL³r•r¬YÓI]n¾LçÇb¹ ÀE÷˜È©ï8mW‚Þiã´þ.guËÊr(¤iÎSÙ—Ä7 HÅ(öd“s!°õ¿ýšÚ7]T –é6]T˜øIš ¡¯0‘F¸Bêò*(ðó8?ö]4Î\'6Ô®8›¬‹" þ—¥…®õ8±¢Ÿ·Î£Q{òR秕²×ƒ©_ ŠïÝ3Î_{‘RNa†ÙžíÏ*´?và‚½Í(oWä ÊI­[ž÷¿IÙhxóÑ–LN?‰³™< ,Y!¢p`.©8¶3V_×Â,™ô/·AÇtL”[1X]>P˜ÁWÊÃk†íß|Œ9þ*šendstream +endobj +4509 0 obj << +/Type /Page +/Contents 4510 0 R +/Resources 4508 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4507 0 R >> endobj -618 0 obj << -/D [4414 0 R /XYZ 85.039 103.595 null] +4511 0 obj << +/D [4509 0 R /XYZ 85.039 786.531 null] >> endobj -4419 0 obj << -/D [4414 0 R /XYZ 85.039 83.004 null] +498 0 obj << +/D [4509 0 R /XYZ 85.039 588.614 null] >> endobj -4413 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F66 3242 0 R /F35 2880 0 R >> +4259 0 obj << +/D [4509 0 R /XYZ 85.039 554.474 null] +>> endobj +4512 0 obj << +/D [4509 0 R /XYZ 272.129 263.494 null] +>> endobj +4513 0 obj << +/D [4509 0 R /XYZ 85.039 154.574 null] +>> endobj +4508 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4422 0 obj << -/Length 2115 +4516 0 obj << +/Length 2530 /Filter /FlateDecode >> stream -xÚ­Ùr›Èö]_¡‡û€ª¦išEU÷Á‰í‰3qâ+•©Êä¡H¦Ì¢ ÈŽÿ~ÎÒ  g2K¹dš>ûÒ§ÏAL]øÓH9®Œ§a8JŠé²œ¸Ó5@~™ƒa{çõbrvøSá:±O«Oì:*¦‹ô«õæíùíâòÓÌ–RZB83; #ë|æEÖ›7?X Ä·®?\áÖÇO73ÐHZ‹ëvØó­Î_ÏlÀ¹Ä˻ٷŻÉåbÐsÏ!%jùÿÉ×oî4‹ÞM\GÆÑô Ö®#âxZN|%åKó^Lî&ÿx1ÌŸ2Õ˜S|/p¼Òu¢ÈÃñ„‰–côBú &8U)'ðÃÁ©Bí9UÈØQ‘šöHèU¦`þ+öj“•è‘Ýôˆÿ2ö[Ý0¼¬g6ì"E¾zæ½-¼´H•$½Ä·e½­CGà#ß -á9RxÓÐ÷wÜ#?gíŽþÖ$´¶ÈÛ.¯@¥56¢½ Ο è©èL:u“rÜ$\z -Kï^Ütn4â\8 ¦¤˜ÀÁÆÁ¡<‚ „‚CyÓeÍ‹GË®í»ýº((j@öÔßD@†øÄÓŽÏì».7…¡BѾrzâÆîÀíã—6ój…‚†ÜczÝq\‡|7¶Ú®n²ÔlDm.=K¸Nt”­.Ùü>gŸP0ºš´ZUM-ÔÇ»{úZ¡Kçi‡…!4˜† 4[IjB ® äק€ˆ.˾çH›ï…ÒMŸ„HyI“ 4 zЩ0huÂJ}½mOOßÓ ý>¬“Ýt¶Îû¹öi4¶†ˆ]P Zß{rë$&ÐýÑ«MV¾Ð†ÒËÞ*\nxvoÛœYØêÇ -X¶ æÉ©è«OìA :^Àdo¶(m· M›ž}*Ú%p6LG@0Ò<Âîi>¶¯¸)Mp¼2d{=ûI¯Ú3A.4”vùÆä…rGE @PÚâ“NbB£kVìݽ‰R)†L¿Â¯‰µÉW¤åƽO¬†¾¤˜"úö( IÑmè(þ58ŠÔI“þ;‡Ó³”RBêDóTÐŽ5ÀîAïûu]Ô‰.Zn,ûæx%ÆÇj¬Ð0%=PYÀ—ÿš»3Å!`~–uË3X$úŒ)˜;–Ó“pJX©}B¼Þfm÷BÙ•Êñù‹ìqÕ…Ÿì?«ýý¯µCíö#'Ž¼ñÒ­¼Ð  ®eд8™jendstream +xÚÕÛnÛÊñÝ_¡·RÀ1Cr—·¢-ÇNêÓÆNc~Hò@K´E„]’ªë¿ïÜ–\^¤œ¢ç-˜»³³³3³s]Å_xðÏ_$¡ë©t'‘*±Þy‹'Xùpæ ƹ œ[8«³7ïÃhá{nꥋÕcG'õÜ0«ÍçÝŸß~Z]}^ž+¥À\žÇqâÜ-}çíÇ‹·ÖÎ^ýx‡ßÀ¹¿¾¹¼]‰sÇ 7W«{œß~þ .>Ó”q®o>0ôÃ߯/¯–ßV?Ÿ]­:Æ-Ñ|¥íœ}ùæ-6 âÏgž«ÒdñcÏõÓt±;Ó¡rC­d^žÝý­£ÅkzÁ»æ´ªÄ 5U“Ψ) ÝHǤ¦¢ý¨¤a}ìaXµ,TsX/ƒØÙ²j2>UËsâßÄÙðR±Éeµ­rhr¦×n Œá€ü«úp ZkgµL”Sñž]öµ™óLÝe;>È´!5Ðú§àâÌæ«d¾Ö¸’•¼´£IÓæ5ã<ÀþºB/ .8SoyS»Íñ"A©ç>ê<%%=V%l.y3b0Ý?ñþê¹-ª}¯Äb/ÚÐVñå TYùÍ>tM;™Ê£ì•á®f‡7€|»$"x_=_—=êï™_¹‘ŸNÍ/Nc1?52?51?T†›¦jÎò|?€%ôO7Œ#cüílÕOà--~ìzἩ$ÁÁ[¸úțѵ>ãuˆè°G»0&:âØM’xÑŸ3áÅ œäeDyù+»ÀšMMmÖÒp– Ûw:â\!¸³žá|"A=)A껞/¢ ŠL²BÓB“´,žÅÛT»ÌØñÅê\N9äÅŠ_)ÇšÉHìN3²ýµóäf†ÈsmÇ£ ¤Î7#uOùbÂsD+qÐ2ç0RòTöEáŠßâtÎ|€~þâÿwѽKqà¨n$'c7¤77ô}èU†]ØÆñ†®…†í¶à¨¤鱪yaWÕ¹AA Øó„LQ(sìÉr$©Æ„’g&e ”®ýø{s‡íO k/F0?䯼õ¥ +< «ÍJ+‰‘ð! +1¶ž»lD¥ å¼JúĦœ¢±s—‰1‘ŒòYÍìºóx>Ï5<à•)ó´Ât„ñ€Îm ÂÈyÎê.Ô僕¬,»À‚;­L‰S”‚ÐÖ’ÓhB¸ ]$LgïÁù4ObÚöS`_ìh=“7>æ5¹$’µ"àô6ÖÙ¡g?WAäì™ë®ŒB¾€À*ñŸ3$ãÏlþx^æ,-çÒ€ ™¾,é²=<3,Û›ó¶B¾žJb° B)³:ÛåýM´É[ÚS59p\ÞOÛäûêð$F×T&ÙgRm¦êÚVô‰s/&ƒ_¯ÆÔÈÉáXcm ï5ëûfί±~H“Õ'žqbXÀïÍ +¿)؉ø%߀+Aë|`s®oa‘Ѐfñ÷umÞ +zÅßÞ+a›}ÒÀ+qà•¸qNU·PÆÍÜUÏXJQ¹ç †×‚ŽÈL Eƒ‚5b®«O:Þ!ðT»‚ÊF $¨<Él³,ŸkéÁšØE$öž·-]ÏÓï”…lUeÙ©ÃFªÐÐÑæÒfWÏZÁÐ.þãzv\ûôõ¬tÇŠY¦®—ü†Å,´šJ©_^ËÆP}ÐwiÂàH-+H‚ó jY5­e¡gSq°èϙֲ‚r’—äåÔµ(NÂÐsî(îQ<‹Jöð½¼Eí}Ä7\Ãà†W.H­ÕRùS¥£?¢#4¯48-@s´xâÔõcÕ'bY¹&Ym¢eìdJ6ìd‘]kd ™­È^ãr–k' uO”6}.äUJí°|Ùù@4ÈŒc1=ÁöƒÉÒ-cì«ÖæH&ˆõlq ›Š©ýŠ<, ˜¼Õ®ôÅæî†yE¨íp8Ÿ$J,]c_;¯Œ°É3ä«ÄNDëé*瞲ᦠTx*×>¡† öG +©K‹w•g-e9[s$9ZÆF¢J¶ÇP)€p˜•$\Å»¸\pwWñ(àÄz¾D¸iþ˜•_0âȇ-Y¢¤.&š]© ;©ÁâRAØêê´²´ͳïs¥Ú¸æW:­fÊe}üq¶ÕùSÑE@Ö‹6šÐý ê@0Ÿ¾¿ð†ÍóâúöŽ{*í‘ÖW/ô.o)R\ß $oÞ«Är`•j7éPª?ðúÐÁ¡peÝ¿˜!ZñCáO? €o¥Ìa§í–{ +´LWAî³2Øýõ¼WûÎ3óls¼ût ãwˆ7l¢÷~™hnÑ vÀ»ÚS˃óªÝR£˜xhI{3’Îö2X‹SdÄÅ1Æ•õ™˜„`t;ü~‚…Ëw<îBØebŸÄž‰8¸‚a¿;ë1Mt™+tÑ„ :¥<¡$Ö{rL3rŒ›~" :B›îõ{ml¸°º\ÆìåY/âáàEhd œºN(ï‰y0élþ J“pô>i!A i!éÿú1|¦ïEÛèM)N§='¨¹~ßôÅýC³‰‘ äØ „ Bóî0õ˜áñÅo^dìVÓ4q%Ù§X6pٱĖó˾´ÇPN=ª)ñkjJÄ)Ç<ŽÈ#U͈F{¸GLÄÖ¶ì6©ß–”G 7•éK‰ØVÚmœXr¤}SNÜH^ká¾ÞärjõÈßõˆXt¯µÒãT;/¥;ÚyóL¥‡zJ'ÃfBϽ«5ŒÈY2’×P„te ŒkNB(j+‰úMçÐk.ž°É!Ø–B•| €œÁØäBU’(BzÛ›/~}OÁWcaË+õÓ‚ŸgÊ` ûhlp¬d³’ÑO€?|ž>Çr€½™L~!J]h-¦g~!"”Ó‚IàÆ^4Ì2ñN¶ç~»QO“ö­L§}ÏÙbö¨SQEV +0ªSaë$Tàb÷Þ†Y *ÙŸÔŽK©±p[õÈ™àÓ%ã¸Úób†.€¹ç¾æ'vlª+mÉfò.Ùo Éç`F}òÊ€î÷œd%ÿB@¡¬á²µ7 @Ÿéìi@‘jgKÓ¸ºÎº)šì¡2£– –ùUéeßmò [žtõ|0Ó‘mÃ]­Ô|.ºúu~dÒ‰›&GÚÔ,2Šµa/'Uc†Í5˜rüo±9øùendstream endobj -4421 0 obj << +4515 0 obj << /Type /Page -/Contents 4422 0 R -/Resources 4420 0 R +/Contents 4516 0 R +/Resources 4514 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4426 0 R -/Annots [ 4424 0 R ] +/Parent 4507 0 R +/Annots [ 4523 0 R ] >> endobj -4424 0 obj << +4523 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [437.587 654.697 464.58 666.386] +/Rect [84.043 99.916 280.066 111.606] /Subtype /Link -/A << /S /GoTo /D (XMLpassdb) >> +/A << /S /GoTo /D (browse-force-master) >> >> endobj -4423 0 obj << -/D [4421 0 R /XYZ 85.039 786.531 null] +4517 0 obj << +/D [4515 0 R /XYZ 85.039 786.531 null] >> endobj -622 0 obj << -/D [4421 0 R /XYZ 85.039 286.107 null] +4518 0 obj << +/D [4515 0 R /XYZ 277.887 730.6 null] >> endobj -4425 0 obj << -/D [4421 0 R /XYZ 85.039 257.371 null] +4519 0 obj << +/D [4515 0 R /XYZ 85.039 621.679 null] >> endobj -4420 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R >> +4520 0 obj << +/D [4515 0 R /XYZ 255.372 463.069 null] +>> endobj +4521 0 obj << +/D [4515 0 R /XYZ 85.039 354.149 null] +>> endobj +502 0 obj << +/D [4515 0 R /XYZ 85.039 338.087 null] +>> endobj +4522 0 obj << +/D [4515 0 R /XYZ 85.039 303.947 null] +>> endobj +4514 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F38 2997 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4430 0 obj << -/Length 3671 -/Filter /FlateDecode ->> -stream -xÚ¥ZK“Û6¾Ï¯PåªÊ⟩ÚÃø‘¬S±Çk+ëC’%r4¬P¤BRž™¿ýJ”|ØryH  Ñèþúù þù‹4r=•-’4v#å/¶ûo±ƒž_n|¡X ÉÊ¢y½¾¹ý9¾çf^¶X?˜y2ϲx±.þpÞüûîÓúÝçåJ)åø¾»\%IêÜ-ƒÔyóæþ÷kì ÷ƦûÏ–>ô¦ÊY¿¿ÿÈ}o±ÚBgw¯—+ ù„ï¾,ÿZÿzónmø´vâ+…\þsóÇ_Þ¢€ýzã¹*KOðî¹~–-ö7a¤Ü(Tò]ß|¹ù™‹ûšŠ¦Xù™›ÑuÁű{±\½¾›E -Î÷WùÁ"‰"7’ô†.leEžó©†¼j@(q ¢È|§|. @&ºÊÑHCù‘u”†#Ô‘"ŽîëX(QüpáEÎ7<š²ë«¶žc§}àÎ/ù»79våÐU%(¸éØÛ“U8ÇCÛÁß=6çC¯mýØÞîy‰á±”pLõ<7òšù&ïK”7J „°òáÜ"Ú“0„ã|Ž8¬®_–« œ¾%VJþjaÝŽ_ÿôü°$yôØ Fþðcx\Ê E”ðU—¸øíÏj"å4s£$–—ÛrØÞöù~“ßöûÍ!ïû§‚Mìfq&ƒ@^3ó®ù“i¯L˜‚ö§šÚ%­@åÝ4IXTaF]_õñÙ„~ìPV=6ôO(¼¶+¸£l¶Ý ö¨ÔTõü,ª>ßÔz"à+èP‰Ó´L€†ýá5¾'N&Lº­P’[™Nv:/±1öÈÌÔœòÄ%k0¥8SÎûfek‚l¯h`ŽÊe¨hjžÓZLtZ){îË;T®¸kÜËq;èÕqŽoUÎtZ!”D•/aʦ‘ËS2”ZP½ØÙò>¹áþ OðTi^óí–ô•ef“ÕÐÏéKä`ì–¾\T„1¥5Ž¹dóAwVa²¤v?ñÇ}ÃØÿÊLìøÌ-ý‹H|ß3ÐÓîIðQ  ÀkAèRò‹†Bp÷Á½€€q¬\?Ž¯" Es“ãȘTL“{Ä*mXp‰³bx~G0ÐYÜôi©<´2xm—Š°Š•Þ2è±4/l*Ì€§ôú¦FšË°+ßõ”6E^µËQ}«‘œÄûŠ7õ„œÙƪ¹CÀì»w§\qä&qbV#¶±£Û Ågkšze‘ŸïàtNq7l:x È©%V%èù?^ôûS~U‚¡øS~OĬi®s©ÒÔ Øm.+œñ‹?.ÅFO¬1‚àÅX#· ¢~˜1E8è$ÒtxV_ ˆ§ëéÀI‚Ò…€‚9AŶ=²ããÆËN{Iªxà[Ä¥G™§ç§v¿ ª>èO„¶ÿá=$"[ÁÁì+²ÀyÌûGÆ+¡žœ#˜, k4;Ä„´Ò욉T -Žœ qAÄy¶Yl™E8Ñ®çysìÔ¶lFè/Ôƒ“)eÖJÚ09?Ç Ý ƒK} z‘ÁæH“ÀM£pîHq€¡5D ¥œn˜¸I6uÑìüOÊ -n:²jìãȼpñmaTDÉw(:ìZžaxÔ ùÍ«ks}ðHñ€šÑÉzcyÏŸ„8~Ú)'/ÜXç!,\dΑ dNQ%÷P8 ÄGæƧžsµ@©šã¥óQŠÏGñ˜ñ2í±Ï›Bψ‡qæG4TF1$~8 šfe1„“h,ucM$g›œ­¨BÈZ®/È$çëM@^AT™F“õÖ1«X‡£]?ð·ñ³±ŽCT$±¼Ô-Fû7Æ6‡‘”âs"2Ê RäYIö&*:ƉpÊ’Ï«ÂQ-Àa®õ—ŠU¦á1#oƒqDb“xž D½Fn”#¯Ï¨ó‚hz<ùa3âBŒ8Ü0ÝuÏJØñWAÑ>¥cóÒlôü 1M˜B”JL#E˜“IßÊ?{œóñÚŒ -kÊšŒ'à˜ƒìrW¿ÕiÔ‚Ë9¯LtàcÂƹMKÃaýVÏT†þ²ýAÐß1?CsÅú˜æ{Æwe5m{'‹ÍšÞ¸Ø ZB‚ÆÎú šüTâùö¨sø›96KLְϵBTieBRLfcÍ#yÕsÅci%qBiÕè8„<ÇÙºœð´ –‘¸´”œ°KÙãg::gtRÅ4ÿ•ÖÖª6ÇÑ­Heê,ï‹çLóh®ä†¢2å©-È@ ;TéI)<.:ˆó=–ÏšEK£Û1ýÍfï¨x)+ŽRäŒAÅ?—5L`\ʼ‚§¸B»±CPê,óFØЋY…AŠ~ÌÊ%¸aö y£lBÎN`ê -™üFAdfû ÂÔ‚›¹Ø‡,ÅV¸Á‚¯íÊ"öAÄ’!»DœÿîÓ{=‹€TeÔ ZÍtÚ€‚žW©\<§ÛÇZç4;òªŸ CIÓömSK"‰‹#2>†-£·“°Ûe¼YOªž=­A‘à¾ÅF«d¾…¶œ:t'”zÓ@ñ ®ò¬Qº†NwFãî¦Õ -^õcœ”¿ŸŒòY97‹÷ã-ká$_㙥Ì.#-B[ÛéØ©íÚ.×ñ”q+ÚP) ª4–“1t›»¿TžW^æÆ^pµ’mÑ\.ÏYâ&I<)Ï+)ÏÃù Èæ9Яq`Ñ\®¥IB÷gËD¯;[Šö±ä1¹Âë®)«Ø  ¾ïsS嬨”€ý è“ Ûå†?¨¡bþŒœH‡ßB?]šÿÀªkŒ= ɯ(ÔÒ·ró0ÏT9ïÙ{RHN=TÉ$4²…Br®T\îîGa¹+ÿ9V„êvâˉŸ¡4‡nzJ¤(Ú1úù?Þ¯yÒQ\ú.¸Ù(­Ü÷È’Öò6"^ñK‡ƒW3¦¸ïXT¦‹›À’iÌ L¨&€…Æ òø…G{(b‹¾™À’PÃîP`E%§fÕå¾kº š¢’ $>F¼þ¢^r2›ºœQ(Š?SAÄm^"+çø>‹‡ÂWÙ?¾r­ç›ô|2æ}ûúí›q:¹ÃX>ÐÖF3?ïèfMäPs :½Š%²ƒQâ¹û% 8wµ)¤îo˜Gr@& ³ˆ-Çu%à³`/‘MZÕÕÀ!ù8ƒÍ×D8n˜ÉOœlÿØë1ò“k +±2aTËp´³ùyŸãÇ!ø¯«.g$¹ìóüH¹~N|^(>8½¤3ÔV8ÇJä¹I–]çe¤¹ìþ|¸Qéb©%†ûæ…7ñC"‹jL7$QÀgA°ÉZB]æ ­ð=„ð]ïÓ²S$)FŸƒŸd®¼âL„L¿Fó$ß"„â¡xæÇ!ǃ‡4ŽëYÊ®›Ô‘ç<€±FŽ?m0^ÒÔªöV¡Ãú ”¸Ù›Î7Zë×Ͷ>š­ýt©jå{ {½^¶²ˆ.×­4Ñw -WW”ÊÕÙzs¥+{½;¬ "«\ÿøÌWR‘ -ÆÓá¼^²nsLã/l˜‹¯°½jä -ËÔ¶ÂïŽ~ŒæK‚ϯt)Ù“°xþÚÅ÷;šÝÔ\Î5ìíiqˆãi¶[™ÔÅ’d¹*üÎUåHsùh…æ;'{m59ØÓÅæÎÕZìNò:—¼‘ëÖ ÿÉ·|‚ð‰¿S"·7Éô.&‘ò/BO™…ÿ| -ÿׯE hb¹;½ Ê|€|CÍ n9KOŽT -rQ3ÿkKendstream +4527 0 obj << +/Length 2508 +/Filter /FlateDecode +>> +stream +xÚ½YYsãÆ~ׯ`Þ * ÌÃUyÐÆÚl¯œ¬èÒÃz င€«Õ¿O_ƒƒiWe“R•€ééiôôñuÏ0\ð.ë:]ÄIä[.Ö»‹`ñ3ï/BáX +ËrÀóvuñæaà§AºX=vrÒÀ·i´Xm>yûûÕ?V×/—Zk8/—qœxw—¡wõáí’÷†g?ÜáSy÷7·?ür©ïþŽ'n¯W÷8þåãOLxû‘†Ìssûž©ï½ùáúòóêÇ‹ëU§ø`k¡Ö¨ö¿/>}Øâ¯Ódñï¦ébwa¬ö­Ñ2./î.þÙÉâ9³àUsVrKø±RÓÏÅi,ŸÓGŸÓ“Ï‹e觩šûR*˜Bø6Ž†ÇÏN·0MÀ ,±‘¯LïÂÐ\è¸úðú+¸+Û].CïÞʜ݋Œcóý±ÑUûI/_š¨ãxΫs, Õù¹º\‚ç×YÉ~'Ų¦Ík?ÔFÆKƒtG¤Áé¨ó‡ÕÞ•7Êú61sÊOý-¼ç7‘†~ (BÓ>=•ÕZµüŒß'_c$¤4»©vY±—ÝáÎP[ÙÈ_ùªW3KËcãd´óÎ8²ü-Ab›!Ï5H§ÙG÷‚”:ßY|ª  µ$³j8jÊü ±”<”e‘=‘¸QøI”Î…ˆW6á—Ô²E6ñMœÌ»Ði£Èk6R^Òö×mAq„Û³©—á;šÉÆl8Þ-ÉBìs€ÎÑ·+öO̘ñìÈw0¹Øjr:HxiFtüÄ+¿sзmz<±œÇªÄ´å¬Àùád…){hxLq‚Ú-»i­ +ù’í™Fó¥ct8ÏuE @Šæ 7´ôÐt÷SWÙÆ hÝ€·ÀÑÞu¶Fu·Ól•Ö¥J#™ý_]çÒòÔx€Ôf…”a•*„#|ÀLêÛ°j^„5Šäfu¶ËÛ.ód9UI4x!*so¼·±o3Qæ¹Î×bPáÝ» ïo †Š¬×p .|±jÚ™”n¶Õ¡ä¶BYàÊp¿_ÄHA䧋eÚ>+í Ú<Œ½·¯Ì¹É³Ö–ÇTœ3ØìV”&tifDH×Qà ‡²sÆlOûP[X~hœ°FúQrÔåkîL¦6¡@û½Sµ•BÄŽ®n¼ç˜†Õ^: Þ侬b¨) ¾È€¶^Vxð‚QQ4µH‰è›I`…h$¢RÄŽÁ—ñ.˜Ø·¹Ìÿ~hZ~“¾MxÄø^É:‡çœ´¦+h<¬ž9_ð]Я“,­äŠlÏ©šM³o‹‹Ÿ¶˜*ÆÙ­íÉ‘J¨ØõáÄ×21°Sê¹Ü{•j¾ã:Šé›å§Î™É„þ°ÙgTGzmH(öÊýiôÑH"E<éawPËi°cOñcl<¤Œ‡K +§jw!––ùïï®ažò“¨ˆRûÔ~'뽌¾LäÚƱoú*ÄÓ·«7ê'æ¸Ëë>†k%8j\ÍØýƒÜýÌJ5½TM™Èû£‡+T"ËÒ±:Ä¡†iÆÖÚÓj ¬Ýj+ýú.ûZŸ;9üµ_’®8E•žÐŸÀ•„=îààŒ`-S†@ öâ'ö蘅êŠå[%Á‚˜×=›6«[têów\~ZÂ%šê +l2¨* õdÃ*M~ñ¸;Aš ùûîÄÉCpÒLÚ:¬àsp‡Ù¡qá¥(KYB;÷-¡u‡L$~SO[ÁxS×òåÒFÎÙSÎ3U_kQµ[÷úLý[ÕöׂÔÈ1mëÓã[«ÙšGÊ;åjÒEõ¹hÂY÷Ô£/_—Áš™ÆQ**Y5Ø–·[n(©uꎰù  z„ÆžY× ,¢ˆrÜ°ÖÅãÀ‰îÈ7ãŒBj2ãz®ŠQyæž úe›³;Ô qÆÔ"B&Q&™ƒdI-?+‘q»»@“§0œ Öîœ RäC%÷÷xP$zÉÜÄ„9ø°Çâë¤AÛ‘˜.aðRPáÁäâ4~F'ÓÈÈ9ȸ;;ôP¬ö”²Íñœ×E·…M§Ýò•§¹^À‹KT+ÊkÄE.ϯòÅ¡/pM*”©À12¤Ð9ž}C{ɆÄBt¬êMo¢¸Í Êݺâ`=•Z‚éå©ûå³w§zI˜AÃ`ŒéH¹5’H!åÛ+jÕÞ¼³ÉðjI? |wx‹a Z“4Le +¾ +7Á„‡»‚l¯Yâø² +Žé¡i| Ÿk'î4~­Ý™u×5þºÉÀÑibŒ¬ld«MÎGL ?Uf˜ÓTutpkWF|ªî&5@ëŒz¨iCD¨ Ü\¢¤=¡,¼Ì…MÈ*‚é>€:J» œ?©¼·Êiïâ•ØVå\ÌbhÄ ÔÚ&ÞÏW·L®„*© á.ÎR7㆟´9œ` )ãÇ0p<Ü.˜üÜ‚Lt¡Ïˆ|æÙó€³'Û¬³¦S£*³ö$r5‡‡îª¢Í´vÜc=3ˆò¥DñÐÝ°êîà=!^:?$hnTj´:ÎLìã»è´²ÍP4´^-ïd÷Ü2Á}s87=ô ›V5ýY«‡ÚÕø¸Â‰BWµxZ”)G" ¢Ä”æöçÑu#§Nq`P¢“h&³.Òé8SÍzæn³ð­Ûrô‡Ø¸&®WyÑJIË+'VW¼fþNN[ßh=})qôm~%2‰Ÿ&jþ^ÏB@F±qÊ CRs¬°Õ‰o=£ñã8uvendstream endobj -4429 0 obj << +4526 0 obj << /Type /Page -/Contents 4430 0 R -/Resources 4428 0 R +/Contents 4527 0 R +/Resources 4525 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4426 0 R -/Annots [ 4434 0 R ] ->> endobj -4434 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [264.771 627.931 385.537 639.62] -/Subtype/Link/A<> ->> endobj -4431 0 obj << -/D [4429 0 R /XYZ 85.039 786.531 null] ->> endobj -626 0 obj << -/D [4429 0 R /XYZ 85.039 766.606 null] +/Parent 4507 0 R >> endobj -4432 0 obj << -/D [4429 0 R /XYZ 85.039 748.602 null] +4528 0 obj << +/D [4526 0 R /XYZ 85.039 786.531 null] >> endobj -630 0 obj << -/D [4429 0 R /XYZ 85.039 663.166 null] +4529 0 obj << +/D [4526 0 R /XYZ 277.887 769.79 null] >> endobj -4433 0 obj << -/D [4429 0 R /XYZ 85.039 642.273 null] +4530 0 obj << +/D [4526 0 R /XYZ 85.039 660.869 null] >> endobj -634 0 obj << -/D [4429 0 R /XYZ 85.039 309.602 null] +4531 0 obj << +/D [4526 0 R /XYZ 255.372 606.975 null] >> endobj -4435 0 obj << -/D [4429 0 R /XYZ 85.039 290.73 null] +4532 0 obj << +/D [4526 0 R /XYZ 85.039 498.055 null] >> endobj -638 0 obj << -/D [4429 0 R /XYZ 85.039 164.95 null] +506 0 obj << +/D [4526 0 R /XYZ 85.039 482.827 null] >> endobj -4436 0 obj << -/D [4429 0 R /XYZ 85.039 143.754 null] +4524 0 obj << +/D [4526 0 R /XYZ 85.039 445.96 null] >> endobj -4428 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F56 2890 0 R >> +4525 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4439 0 obj << -/Length 3629 +4535 0 obj << +/Length 2835 /Filter /FlateDecode >> stream -xÚ¥koã6ò{~…Q° -°R$‘zõp¸K“}¤—Mrk/Ú¢íÅ–mueË•äfóïo¤DI~wbQäp8Λò&.üy“8p\‘L¢8táMæ› w²‚‘ž‚°ˆmÀü0»¸zʉç:‰›LfËOâ:ANf‹_­›×O³wŸ/m!„åyÎ¥E±u}éÇÖÍÍã—‡ŽHëîá=v=~þtéÁh,¬ÙÝãÝâôIk†×?\Ú3ÀwÓËßg?^¼›µt;ñ„@*ÿ¼øõww²€ýxá:"‰'/Ðv/I&› 'B½Ó‹ÿ´¸xLNxÖ!¦"v‚XŒ¹âW<_8¾ïM¢ pB[fëìÒ–ž´jÜL6Çßr [ZpwÞdlÖ<Ýr×ó¥íGVƽ霧lv0§Èëu¶ÐPÀ¬WnïaŒðçˆyÅ÷ÌÎ'~{˜N±!¬t»àÆñø¿lhZx±/I†µƒlŸØj‹¶‡|Jh_÷žêf¾õ®”Uu^nkî)—øô¬fÕ¸“@Xˆ5®à7­òLÁÑæhãÜm1<7)m‡(Y0ÄÞ«rÃO()×·Š“rÙ %/ø“V -Ñonà¥GFžã{ >Òw\}æ8P­Ägãô5´m€Óé óô‡8‘Kë¦Ù}uÅ\A °Q///Î.]μÜ\ ©ô@Ø¢0œD~LI¦†±  ’9À„K_PKYŸJd–A·Èâ²Ú¤ &÷¥|.å¾á÷f­€;aþÍõäjOgÛÍC`øVžhb`íÒ9Ñ×Ë ´ÒñÈ&e±&†EÒ‘ìñ«_ZËŸäÙÁn¸÷»VðA<ÞòØôµf=ƒñëÅ&ßæZcš–è¿Ãp[²*-Ê›´j² -qÈÐzÀ7Ÿ‰Øe¹xU3n° ÷˜îšg†ßÓ\&> Úy.éq:Ï· ¦BºÖÃJîwâ’ -f©V¡aL¬¦Š†/"Ç…#Ž\xtF~5°ÝAEd€‘¤ù Ô€×éÚHK^¯È_”[$ôêŸ?oŠ»Å?`س±#ƒÄ·eâÙáHùÂÀI|Ù£} Õä$Å2LœPø&ÅËRsl]‚°)µ‹€êiÝM]â–¯x“üúö•[øŠÒ]^‚̽¨¤*ØJq›Z5Já8¡4KÙ~j/ ½iív^7U Éê£fÐåoM°´Û{Û/µ«ÖÞ£®Y~”evF¦Åóáù“PN$çý§rõ‡ü'ö%ô¢£hh’ h¸¥ ûXlM“ÀZ¾ôÛS| ×IPÀ”y‘&@¹ðÈe3ûP2ÿQkFeðÖdË=ùsâ9®LÁ F›ÈïvEWwor[¡“­ŒÖîð²€Æ¦Õ ` â€Ð`/Tñ4œ£„˜€ãuæÒo´@¡¨ ø Ó÷¥ùÆó¬øíFºyNáA*'¸»ž¯éì7©Ã®_ÃÙ -€„­aóÂN?§M"<óX´@ÖEàZ[Bü‚/`>çÚî©å¦i­aÃpÔ®¹½-UgkÇaö–»-1„x¯u#ÛÒö$e±Ù‹·ïy;‡;ÉQÂLol‡Ë<ùœÏ9'p˜†Dþïò*ä%àÿqÚÿ©r¦²ÄN,Å鈢['ötDŠR&ßZ(vï7pl©;#Ï8'cÿ̇fb¸¶†ŠfŸ{òì‰ c%Ï> #bª”°—(u¯<Àö5t#yExŸ¦Dðœ¶ø«£¡¨‘)ÐÖ<Ç2ØÇî~‘7(å6- -&ÇêŽ<sB˳•ÀùQÀÐLäNI8èÄËÃÍc+ž‚N=>at8¹ÓÖŒ*­ë¾Ä/Œå@F‘DÓ -¾°ZrÓ"Þ´ v§‹W~ï4P°&ûp¬šäœÇT4ÕÆ:DbŸ¥s ¡Â{|Çx†ëcK²kjEÐV)ð:Õ=ü H½¬¾*Ücý<,9®N§´ã>µofFJÈy'¸ë¢Èxp¾ÇˆDÐÕ)b§p>ø%õЈÑ%í°òS˜,@*Ú=hÈ"fÞìÛSªpä€Ï[¸9*+â[öè8f|h'Ì-t?`¬—øÔ‚"0Z&agõmjÈAkÏ#Q‚„HÜýà ˆ6D"Ù3D±Fa‹‰/­($äó§dñz=Ã'ÀvÆAo½Ç]çtpû÷½€É…Ø.äLnاåxŒ­ GdõrÄ!N#GÄL°ÜeÛb‘î Â^²A6܃Pío|á3èRÌÓºN Ä™S@ç¬ÃuüÀ†ë<0c½ü‰r¥mÖðz(KÀ¡Û¨WœšÆàày†aoGgÎSA¨îŸç§qžùŽ(wà¿ž§»Œ2üî4ûuhpé5ÌF*—/¥p’„ýÅì•^Ù„t¶1'ŸˆæP±Ïp¸ðZ±E ŸZ鸬ÅË:oMÃbÎécØQ…Qñið$mÚ°;×Y±CõW$¤lÎŽÙ ?‚,/:#ÒÐ ‘V@çDúÔ‚Z¤‡ëic=,— }Ç…½õŽÊ¥†>³ô'.Ýž°ýt Œ¦ª…­m ýñ?ÍGfÇ…<+ŒN²CÃœ&J€ñ“®èµÁ†lýZËŠŸh©ºÃþÉë\-%KÑ É¨JŒÓýq&1qã3òÓtN~N-¨åg¸ÞAù1Ö£r²ð‹êéðäòÁÊ,½y±¥xÔF -Â|·­Íbâ)²Oîq³¨ OS>ĉ”ßݾ»¾ÿy$]À÷ ³4Ìé5…©JDoͦÍCSTÆáuÁÌ"ã¤YI±.Õ$‘gma=«j…En6dr´Ž–¯*-‹(³ùVUböTìTÆ2e©åœí&E┿÷ã‘Û’tƒÚ7%+ åë¿*7,5á§Ê®;G.LDì;I䟼ú1`ˆÏ¾kJ¥Ò©±”´qÏs¤‹‚PcEY&ÖtOµNd… š -?gña„û„wÚg‚ßæBrøÉaâH_œ&¹ƒ9 HšäºCBß#EŒoa𥎇 æÆÕˆ*|· U(G• ˜Ñ¦Pì‹Ò< ¢Ë€ØVÑ·â0nstBŒ@šàCQl·0ûãt‘¯|ÂF=l„£ì ûThÍ‹¼­à{‘?“dQ‚®ï…ìX -kfa$œlêê áÑŒ‹5GfMJR¨Åt¨ÞrPYj=d ±ÔØï›ú|Ò„É|,{á ¾Óî°aîÎÒÄÛ;<ø±T÷G° Ž_8Ê|ËEY8ªÿÂÄT7Œ°^„ÊDZÔÕ†S¥r°¼P}YE:Ö…pL Ÿõª6* ¾:¤ZDÇS¬P• ÝòDB[éÒBÙ•'¾)¤OFvIX÷Ïm}ZÕ·¡W4¾élûþÂ-¥£˜ü}:)@!B@Ýä!ð,Üè]²)hÛ?PóàDöü°_ñf*uÁBÇQQ‰g«†–é/÷ÛæØV£Ä™§·ÚÁ·Þ>d=q"ú±,œ®ï[¬5ò¶øT BP%Ó÷»:¶Û8sÎ"ÌÆ^e’ˆ„íùìŒcîGÉ/:@B°»»í -T\¯e@ËÁ@“aœÎÂPU;– „#_©<Û£æ!Xm k†,èÛƒV‚koR(Jíz¸}¼²Š£°‘+}æy|ªÖ}¼»}Cñ®ºÝ‰œPxýëú‚#›©5ÚÏ‚bã[(€B·¿V3¦†Åãú°,Ã0UÆa…ãm>V÷:{£Ä… ä5Oh¿ŒZaÝL/Wr³¶ˆXíÔöéËF߯»mPd' W:–”à•å=~4¢2Át[)Þ0PÏZ5y/(ùÙ•à @èòÛr.d8%%|ËÛát;}Ëá•„^žö¹É›i• ä*†T{ïµfÞg•-—høš*'¤j•»´13ìCË€‘áˆýX†íúÐÇ2=ŒHóÊ¿þËt³XÈ•< ž‰!d3©V<ÈIxN…›"päá¢2ü·7ÿû”m 'c'9v%ø Û‘ÔÄ ½I2ŠÅÕ‡–cŠÿ üõè>endstream +xÚ¥Ûnã¸õ=_aìËÈÀX+ê®}˜éL§Ùb2ÛIŠ ØÝÚRl!²•Jò¦ùûž)Ê–ÝÅ``òðçÂs¥¢üS‹<ñƒ¨Xdyê'‘Zlö7Áb +_n”`¬eåà||¸ùñÏIºP_ÅâáÉžS~R¤‹‡òïOùðóÃçïËUE`.WY–{÷Kå}øúñ‚cïG^ýz¿¡÷x{÷éÛ2̽Ç{^¸ûüðˆóoßÿÊ€ßiÊ8·w_úåï·Ÿ>/{øéæóƒeÜME²ýÏ›_~ %ˆøÓMàGE¾x…qà«¢Xìoâ$ò“8’yssó7{¯Å Þ5§¥$Êý$ÎÕ¤’5%‰ŸÆ©é^ïQšµQÒÈë«åJyhéwÛY˱÷Z7 ŽBO-î_ -Ÿ°^®pãÛ}ÅÀa'ƒ²ÝëúÀã½î!@'¬»i¾ö«:Fª¦|¼14‘à(X=°B(=\sû°3ÙŒ¤ÁK…­ê³ ü¨øk%ð*àÆzà‰>´ƒ=©CXà* QDaÌeÇ°º—íMg6ë’™gŒ2pì*ÉXeŒ@ägd”¯QŸtÝ€Üq°ÜL>ô^`̧ü^—VC3*ФÀvOŒõ†­º«Ê#Ñ#ªVf{ïy™n ɵǦdÿá[õoŽ(xGᆠ+o`xIdØ"2Äè®a¾Æ]Àpæˆð'¼”ñ‚‹)å«4º=Fr‹V•_$‰ã)üf9»øLìÙ * ¼¯ú5{Ø¢9edJœ&3Ö9Öò…vXNóÈÓð*ËÎEONžËÈEœ>çáDŸV³/㯧cɼöÐ×ë†$†KF•·²gÓ6 ˜@P|„§ÀñÉ¥áæFŒèr±×> Gä± ÷ÒÈ!ýq}0êìé[‡8å¹éêà)$ ÝPXÓúÀƒ–ä#óE³XhbÔÀû`¹S¥Uâüˆ÷;ò„%Ž”÷%°Ó‘Õ²‹½çY¢Rv#Lõfúg“ ;Áµ¡ Ý <Vp¤7sˆ†9ÜÎ襜ºÙàºÓùçXíÙ3 n¿Gu¬áTŸ#8xBáãØûøÆHeõ¤xÉâÖõ84q–ð zŠc³¾y¢ÝX@J#Ó^ €žã©ÂÌ +–ê®EAÂC Åh‘t#¹š% +•p” +¹ã9*ý"ƒƒñ@äP&Î¥r?rAéÅ(‰–ÚªH /-ÿZ)™A¾¾òLÔðÄ5qn\Çrò+ÉÖ=oÉÊ/,ä(;¹EÏD\‚½†Ä‹ê[©PùQ–Olã ÷§µÜ¾>p¿{àù'²žé ä´÷ѦCÚ’Oê˜ÖtbaRA1{ÍùxÍÖ,s›Üx;“Áñ4K¤ùi¥ðžê¥H# w¸[(?µÝ r,‘?´è÷‡ ñµrý*!ñ÷&¥å&LEà¿I°×eÅ3¾«í®‘rbí’A@NìiL‰ƒ»MIƒ.Uëpºâ=O('°é†&ªÂ8wžP-Óíq¦B £ªA0õ¡œ‰0ÃÔ0M°^(Ρ{Æ Ñ”o\Uo;ºÐƒ½+1γ{f°“\ú9 ½}ÂY8q¡ÈÙ‘´Ü-;ž¬‡Ü¸(È3¢£WÁ£‹i¹†›wÕG·Œ`“ÈvËyv˜aK7„ÖòL‚:ãY&ÚžaS 7¼gWow<ªhtsÕJ‚š$§þØU ¯þ}­=„€\Þf¨¡:xϬ -Žr™…J³«žªÎ»‚rêä3̼YAÌɼy[sè$}†v'‡ÉXBL®î:ßs×mM†t7àżÌYg˜8IÇF'#Jœ$æú:ž]é–pÆ…ú°iZ)©š\ãc÷ÆÓH·8Ø4uŶ*õ;ŠK¬ÛDƒkGã6¶@C~Úû §¶MAhôÜZ::mãAáqÇiðãí7ì~`ðhÕ!¹.ŠÂÙD"¿ GEÂ9,?-™ñYÇ„ÜJpÐ#`Þ"…<<!yl«AZ»I/w’^Ÿ44@Íihƒ²¬…'¿ €0z.­7­éM©#ÓÀÑ +E8¢utÕ¶¶ávl¢£$ƒ30I3¯°aÊk‚o^”;“†“š8‘à “|&ø¤‰hvÿS™Ô³%°¥†©fN«†™ ÒÔÏ¢ë-‘ƒsñcŽŠ +?ŒÃÉÇœD>æp“lôó„ÜçëeD±@ºÜÀõp*C̲ìØ%Xõ—زWÙq.~ØQA2yÑŠÂhšà|2±j÷Œk¡)U{ÆÔüóCðÖòp ûKÆ?m±eŸ üÎYøªaÞªq^ýKïéCN¨²ùQ‰)¯ËNÊah¸ äe3ŒNzîÐyÕÇÕËoû¡«Ÿíëi Ÿ[màÇ%})À;Ó‹cÖóå~Õ£Ù³ðŸ%û¿þ6ºUœûE~Á«èNÒ,6Ì *‹ä”aó7çÿ½¤Usendstream endobj -4438 0 obj << +4534 0 obj << /Type /Page -/Contents 4439 0 R -/Resources 4437 0 R +/Contents 4535 0 R +/Resources 4533 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4426 0 R -/Annots [ 4441 0 R 4442 0 R 4443 0 R 4444 0 R 4445 0 R 4446 0 R 4447 0 R 4449 0 R 4451 0 R ] +/Parent 4507 0 R >> endobj -4441 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [470.223 738.375 512.306 751.276] -/Subtype/Link/A<> ->> endobj -4442 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 724.825 187.762 737.727] -/Subtype/Link/A<> ->> endobj -4443 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [236.019 697.727 466.92 710.629] -/Subtype/Link/A<> ->> endobj -4444 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.71 470.662 345.156 482.654] -/Subtype/Link/A<> ->> endobj -4445 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [265.68 457.112 479.579 469.105] -/Subtype/Link/A<> ->> endobj -4446 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [161.013 424.339 303.763 436.029] -/Subtype/Link/A<> +4536 0 obj << +/D [4534 0 R /XYZ 85.039 786.531 null] >> endobj -4447 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [290.138 410.79 335.01 422.48] -/Subtype/Link/A<> +510 0 obj << +/D [4534 0 R /XYZ 85.039 711.163 null] >> endobj -4449 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [405.626 307.184 509.276 318.874] -/Subtype /Link -/A << /S /GoTo /D (bugreport) >> +4537 0 obj << +/D [4534 0 R /XYZ 85.039 676.417 null] >> endobj -4451 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [232.649 62.109 313.884 73.799] -/Subtype/Link/A<> +4538 0 obj << +/D [4534 0 R /XYZ 85.039 416.197 null] >> endobj -4440 0 obj << -/D [4438 0 R /XYZ 85.039 786.531 null] +4539 0 obj << +/D [4534 0 R /XYZ 85.039 375.549 null] >> endobj -642 0 obj << -/D [4438 0 R /XYZ 85.039 382.972 null] +4540 0 obj << +/D [4534 0 R /XYZ 85.039 301.826 null] >> endobj -4448 0 obj << -/D [4438 0 R /XYZ 85.039 362.378 null] +4541 0 obj << +/D [4534 0 R /XYZ 85.039 249.75 null] >> endobj -646 0 obj << -/D [4438 0 R /XYZ 85.039 292.916 null] +514 0 obj << +/D [4534 0 R /XYZ 85.039 166.739 null] >> endobj -4450 0 obj << -/D [4438 0 R /XYZ 85.039 272.321 null] +4542 0 obj << +/D [4534 0 R /XYZ 85.039 132.197 null] >> endobj -4437 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R /F20 2865 0 R >> -/XObject << /Im1 3957 0 R >> +4533 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4454 0 obj << -/Length 2572 +4545 0 obj << +/Length 2206 /Filter /FlateDecode >> stream -xÚ¥YÛnÛH}÷WÈC(À¢ÉæýÑq’Y{ÖV€fæ"i›‰TH*¶ÿ~ëTuS¤D%ì5««»ëzºªíÎúçÎâÀv¼dÅ¡xî,Ûœ9³GšùíÌÕ Ͳð¼[ž]| ý™ë؉“Ì–ý>‰cI8[æZW¿_þ±üp7_xžg¹®=_DQl]ÎUl]]Ý~¹YbÆ·®o>‚t{÷¯¹K³±g-¯oodî=fˆæ[KL\¾›/ˆçž?ÜÏÿ^~:û°ìåhâz¤üvöçßÎ,'>9¶—ijg;¶›$³Í™xvà{ú{}vöï~/™óg²jÊ(ÛAì[Å Vq•g+å΢ °C?b³|Ú‘ø-éæ Eú¥­üvO… xrÕW[âMù»}Îeö/Çõ‰ºfæÄ*e7 7ÓjNc½wW¶ìꆘ몦lxYG£²®„ÿù óÙ\EÖ“ÞaY¶kÙÁÕ‡ÉYúüT8{ýŠæm /]|ô†FYèáÂ…‘6ÊEÑeÛ´…–¼bdÆ0²c? õ¨`™®yEXœÏ~¤¬–Ôô}ß*[üdJã6Ý@UŠ°I7—DËêl#ëêÕ|Ör™¦³eŠtÈÚé£È[vƒðŒXätÒc¶Ð¢uýrsý -ï@Y»–Okä+ÍX´ö3Û^VD©›MÚÁ?®E™8Èšözý ÝýX¿¤ß¢Þt -lŒ{¿¼ûrµürwùyÊ ®íº†Ó˜¬È$”-4X“EsÏì0«Î~r(ø`)'¶22-h3R¸q°ºV.äºçˆËïe#¥ëõk?Å¿ã©3rÄs£ÅãÍ^!d¼0L¬ßkXø–+¾ÏålxÂå"*ec£wJµ$K`ËŠ&]˱HÉb‹âŽh°Â9SØÀ>Eþ†ð9Ñ\œd™¯«ÆXï¾N·B|.;=Í•[¶WÝ–/—QŽãÿìEóí:ÐʪȅÀÀ Ã;Fæ+å9‘=ÔM{sùÄqEè.¿>¹‘ø_…–›“Ûò±’å‰ÍG) -ïž¿ -'ýŽ£ÁWü.SûüÁW:i‰£üaü"yÈ+«\}:Oy`ʘòF¶˜ŸP$ï‘Š,Ä‘ïŠÅ|×·*Y_ˆKÒæU¦Yyšf 1ÏÓà§pF«Eü$L\ÿÂD|8á~ØÄ‹|:¼·XY‘aì -FœfÒL'˜m2†G6\t$h„DÇ†Ï cø BiJ½êRs¾{/ -`/\:<Ö8Ké¡‘@d8^€‹ãôÕãx$8‰”b¼?ãÖ Ùœq"þ+™^CU“ -ü0)£ðm…‰Ñ0B„o=òg·v?Ë /ƒÁÈØDgwÌP&Ø£|'€ )‰½ÍÕÕd¦;þؽù’è0þA Í]®]'4vÚ®íä+]Ø1zJ1a\ >K1÷¾ëæþ^ëG5ùø.«¶# ðÉ¡ŒÁGn°ç'TÉêÆþz€÷~„ú‘¨Ð”¡Š.iÎÞïeËö|Ϫä×Ä… Ð6éWVI¯EƒlÒ«5»BUDD-Ö@S¸°p`çT(à5™q#ÑT,W~{ó’ÎçBZa3‚qbRH'($J5âƒ(9ƒÑš‚~”6:áûY>úæú^Ïls.Vé Áp¬VUtýeÌß*]“V¦¦ÄaëQø–øM…h¿cKmužñmÓƒ[‡á.ëvMaŸè'‚PÙ*üac´gá@9ÃÀU¶çªY8vì)Ö—z!ߦƒ}ÛLú‰u a(šàAH·sWgcQí]Ž©2ð8u!±¿ž‚0ಮ4k›¶ºÆÁ—)åŒêp»•¢®Ø¤Âˆ­¼¨–߶¿hErHŠ» ›iwçv®’ðX6Rˆ ƒs®C]ÁrœbrõEƒmÔÉ Å“4/èÛâ —‘)Ì1‹YSÄE¹ðK®ï] Ž¼löÞ‚dý†Šì$NL7÷’n¶ë¢½øüž˜³4'ëVŸªŸ¤Ï’AîÑ Ð$~ÓѸÜ)÷ùÙí«i•÷/ožÚ—8 3<¬×ò`YrÓCR8C +wBÕÁ%ÖƒŽòù"ï´ôi3¾²ZY¼I¹ÜÀk¤–fòê^L6àû'j·Þˆ3~Ö¯]èÔÜÚåÂß÷Óåjýº'Eúë°` Wƒ•Û£¢ÿÖp½ºÕÝ¡>tÿµ†ù%?-ù4,\W P\Ƴ¹ÊŠCîØN¦±ìv‹^EªÞ£ÜÍ‹áªW¨x´é׊oP;X‘‘×\—NkÛíy»[ï— Ó»_ÑžZ1Ñ[zíËŸ×[Kú_4ø¿þôÖ7¨ÔŸ&±šîOE·Û ÃMµãJlþFw,òÿÎÍ>ôendstream +xÚ­Ûnã¶òÝ_áG¨¹¢¨kó°i·9n7—“xÛ}PlÙbK>’Ü4ß¹”dKi‹s°ˆE‡Ã™á\¹rêÂ?9áªdÅ¡”œ®wº…•ë‰Ôs2ïà\-'~ +©tEâ&ÓåÆÒI\$át¹þêüðï÷ËO³¹RÊÌÙ<Šbçq&7Wì;xõæ¿žó´¸ýñnæÅÎÓ#/Ü~Z>áüîá\=Дq·× ½þ²øñÓìÛòçɧ¥e¼#šT +Ùþïäë7wºž¸B%ñôÆ®I2=Lü@‰ÀWz¾Ÿ¤çÀV‰€Wœ+§>rœÍTVÈsÍ ‡t5ó"g ¼ÈjÞýŠ䈵cÑ>턱¬xFÖð °Ÿh¾0‰âÁ¨l“ÂAs‰&bV 6ÑöX˜¼æû= +ƒ–­Дü=Õ»ˆ¡„ãq©<’šJ}\®¿5Éó +‚ÐK p<¯gð‘6ø/µf)„;ßð·ÙiÀCv(=þXå©XéÙ1)שÒC†î1Â~è‰ø¯ØoqF½"TR¸~Lì/‘5/ˆ*;n=O òþòí1ü˜¢ÎSB&^ J’ªÀ!+f?«²ØàjÄûÓ‚'ÏäbšZoml +xÑøE«)«Uþ¼ãmÚ@5:î«4f—6šgŒ5{ÕË·Ys…[wÆ_€ÆÑ,#ÅöyNÊSkîƇ1.¼0Ê›RÄ‚{Ä_ö°5cÁb^O»ãÄÑ„BÉw‚Xõ;*üÍäFÓ˜A«¬á[ú·w)ûåU’;’‚¿'ü@$Q<{‘pcI{*cÁàqC&‚ð1¡T°/ .¾fbƒž²»o 8%g…w uÞ,%§è²b¼žAÿŸøûÀ‰fˆö ήi Á_î¥!.‰-~vlÎÇ=œñ[:VD’oH¢×]Veߟûz”ˆ ¦>„?L}]£Ì;86TûºÁÁA`ä™/bNZ¬9'_HuΔŒ ÃGá»\œ ¶z7&c %Žìñ…ç'ÀFÞÆð +A ê¸üù抿¹ûㄉ,{F¾Ik²bĹª8¹sp©`‹d¤Å=ÓõšbHÍi‘6•§>£”éz•Öì¯t›a,b™ô¼éœ Šu€¯õV÷BÌ/‹¡89¤¯·›”€ƒ\±¿„¶@½îwÀºë’8*uúAÜ9£R±ft /Æ6çò¥ ä„ÓÑ°ŸO÷‚€WɼÁÖ0n#ß5úÂè9‡vDIkã¶ÞŠ©.gÈÐó| Ì›–Z0"̬¸hT_…ÎS§â¯‡”Š:á$êÇzâë iPŒ¦üG·¸‡tM»B]¹˜KPEÐofm#y­é˜¼jwWÝ@óKëùŽwf¦Räð­+h@rîÊ÷CSãùHž%ËméGl#\ÆT¾"VB +Žd0R„ß^+ ‹27éûÍ›qÂôI?U¶)Éd`J¬ÙRsJSÏ{½ô|Òl¨"Ö´Æ­¶ÈVV§@‡µÁ5j[`’u~XSkÀMÝÝ’a/½~á¬Ö]èôpá_Xìš +Ö81ÀÎ6€À¯ÅH*P‘+‘6ͤ‚Îh*08¨“§™’Ù€È\0¼~ É`ìþ"ø‡®ˆ |ƒsÁH?øC3)CÙã ŋܶ)ÀhŽc8^Qñëú^$)_PŠÛµÒ˜®Iï0µÕ¶"”£FAÔ01µ#B6’1 WÃ|(NsfW"öû¹€8ßívR‰n“ÊÎì»]Z-{¸P´uØŠ’v«åN[¡/Ç V:²×ã%ÀTŃ[½E:¶J&¸i{©™Ô‡b±|ÑEò5ê¾o õ5ÏOGþîKî­_¨‘Þj`þbMÜmáÞxY;õž:¾­F*õŠ³ŸßJ h Iì†1&WLŠƒNĈu/™¶Sbq¤ý¸Ä¦âÔäåP®8R0‡Ðt¨MÍ©«Ýz×&U¥:9 ‘l'_æël=Ö®B/‚äý—®Îh»êÅ‘ðdÐkWãÚ®bAêk­ço˜±z<’1Š¼ß¾z±/⿧ƒ3Ú¾zàpn$ÛöÕ—Þ¹?øRÑKB¯ +dL€8‰#Ú âÛ”R’&ü8hgq•êUØHMvŽP´K„ž·„ÈJo­ä¨…{>ãþö=\çpDg4Öf|låy8ëwªª,ò®Y'ÐÕÑs ´¿_±£Ã~mð‰ÎØ#o?ô¼H.`Ð}E J[4Z˜=Úõqw·ŸgàK¿j.6üµÉÆD‘ß}Ò™YÇ×#ºEe5á¥Mk“‘§¼1ipwÍR1K«Ôý›9¢Mï\s+ÕRk4¹Ñ‹€´¿íÕˆºÛE±gM:o0Äî÷©ÙWêïÖC§èÜR[ñþ3 g…üŸkUÔØë9Õ¡6ÿ½FW¿Ðè”Î5¿ìPk6mÇ€ã"ß3®.“m…eÞžp­é> endobj -4455 0 obj << -/D [4453 0 R /XYZ 85.039 786.531 null] +4546 0 obj << +/D [4544 0 R /XYZ 85.039 786.531 null] >> endobj -650 0 obj << -/D [4453 0 R /XYZ 85.039 562.26 null] +518 0 obj << +/D [4544 0 R /XYZ 85.039 766.606 null] >> endobj -4456 0 obj << -/D [4453 0 R /XYZ 85.039 541.666 null] +4547 0 obj << +/D [4544 0 R /XYZ 85.039 746.277 null] >> endobj -4452 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +522 0 obj << +/D [4544 0 R /XYZ 85.039 690.568 null] +>> endobj +4548 0 obj << +/D [4544 0 R /XYZ 85.039 655.822 null] +>> endobj +526 0 obj << +/D [4544 0 R /XYZ 85.039 312.591 null] +>> endobj +4549 0 obj << +/D [4544 0 R /XYZ 85.039 277.845 null] +>> endobj +4543 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4459 0 obj << -/Length 1324 +4553 0 obj << +/Length 3311 /Filter /FlateDecode >> stream -xÚ¥]OÛHð=¿ÂR_ ¯?»R   §¶:mìMpk{ÃÚV ¿þfvÖiB EœPÈìì|n˜åÁ³âÈõ‚ÄÇ#7 -˜•–ÏZÁͧ3Ž!qvhNçƒãóQh1ÏM¼Äš/·rÏ’‘5ϾÚÿ:¹žŸÝ lÆÜ¡3ÇöÉÐí¯n§s¼ í‹é9¢®n¾ ÜÆ=¿¸šÒÝoÚs¼89:@3³Ùðûüóàl¾µsÇhåýàëwÏÊÀ£ÏÏ ’ØÚì¹,I¬rF…9ƒÙàï­,º -âê JÄn‡Q ¢¨0æ»ó­q¹£p¬ÃòîÝЉüÈVâ¾Í•ÈèÔHú®ÛõZª†ëlñïJ45/×›Š—è1hw—hay•‰"ns؇|JÔGu»8÷=¶ÖP“M}çbÀ³²{ÅÂ*Ï -Ç¥Z»}f‘Òª§Û >déÿú±õ{'Ænûý+1ò}×g[côJ÷ØS‹»_e‡&ÿŽÛØendstream +xÚ¥]sÛ¸ñÝ¿B} +5S1¿Ù™<Ä7çk⤱®žN.´D˼P¤BRvüï»_€@‰N;ÍøAàb±Øï]Ö3z–ž +óYš%~êÙj{¦f˜y{¦c!( ç|yöòïq2ÓÊÏU>[ÞY:¹òã<™-ן½_~}ýqyñi¾ÃÐÌù"M3ïz®½×ïÏ_#8ò^òìûkü ¼›Ë«7æAæÝ\óÄÕÅò¿?|úÎ?Ñ'ã\^½eèÛß/ß\Ì¿,;»XZÆÑt"ÛßÎ>Q³5ˆøÛ™òÃ<›=ÂXù:ÏgÛ³(ý8 +å»>»>û§¥ÅsÑŒWMiÉ`,tîçAücM&‰Ÿ¨Äj2€ÙÈ£ÄÕdûI”’&Ay1¨/ŽrÔª&I½þ$Þr¾ÐÞ}É°PnÕ¬Ûy¨¼Çž.›¡ì©)‚ÏCíF÷µüfÃk¯Š­P¹.»‡WtÏ©4ü,Î~,ã‡dÔñ„·èÔO#ö–ßû’mÙÞá¯&Y.‘ ¨X•ÕppáŽÀ׎á¶e¨ `ü3svÔ ˜%M€GܬíeÄ”ý4ã½lzC*ZÏQeAÊJG½Zòïõí= .kÈ p­ù«’µ(@µ¹¯ŸÜ•«v‹‹¶´´Ùu¹ö‘Ap¦ ˜J@½+'Ö.xŸîIX)‡óË@Ûb…lÒMÉ°®ÜTý`¹ìYÍÕ ì4lw 톰NTüˆcTÌf!KTï屧„y⧠ïTENé¾ÐÒéØ[Z ‡Ø©OEJù +TdPUjêi7_€NĽæqâõžEDÈ·c‰J£?ú2®Ø“ˆ®yAîš-jðeÍŠ§6e§š©¥J¨uh£+æ«çï YP !æ·ª‹[À¯‰¦–›¿Á@çÞåÀø†N¶›P[Ãh]uÆÈ«\v.dIÁŸ{´oõͨ +&0‡¹ä r¬_©ï*$ŸGí¨‘ãâîÀ{&̲BCÌE½-,W$J‡ ©ô Œ]§£%êUŬ?üî…2Þ46ÇÈx6ÒyW ¥÷ESl0?â´âw*£pDîÑ^ntÃ~ÆŽ¸ÁÊá•´ï s=¡…%Mr¶*¾ +U„Aä°èÊ^,©æ2oבˆ}daõŒŸàŒÙ«îIFgm$‰ @·ó ÷žx܉òYÀêiÃÓýP>QL¢à”$ÌîäsTèâ ¥ú¨:ˆÀƒÔW9Ã_×5¸M”@®#ž€ä9(í!œ}Â[¥¨BžÚïøU¿:f›'‹®XTŠ³ 3a×e³!§Áî%‹¼å}ÉfÇ£´éÀ׳$ +éŸJzLiášHy{B `&²òÊ®ÑUÖ5HB£¨5«%Îj!0FcÇ•à‰ÀÇKôËHE”Ô"wr¡8¹`8edoß3|e´Nê‡Où‚tbP'ÌE4bx°PçÞ놽ŽVY¿ˆLðÏT‚¹¶£6‰e)¦ Îrê¥Ï{Nî]™!Äl±^áÖ‚þûõ»be‘Ñ?NуÔ© 1ÜK¨‘Ö"¸Ì¶¸²9ÎQPíÄ¥\P=[I¸÷"×­Éгc˜S2ZÕû55.¤6»†b•£à”Ê,›ÅYàqôSáah-b§¨Ìmwœì "üî®í¶à‚$)æ'Ó¡Á(qäŠ=½?z“œZÒsN©°—8ÀOR{ŽÕX¸gkv B}¡•ò€ª0/6ÎóÄô¥;ã‰D]#TWå½–mêªäŠá,äã' +ž6¶ü[·Þ£åévªŠ[G!,°7Fä¶ûŠÀÀ[¡VpP{åÚæ#ÛQSËmKq3 ú )éÂyô|8ÎÎ[‚y/Rj;ê”L„ò²ƒ`RnÞµÐÄ©¸Æ5r ¶)ß×Qê‡:œÅAæ«øçúaCká;õ}é1K쎓­)&Meš&ãÃŽ¾¬=¬][¬WE?0âÐ(¬xžz©5Ïlº²à–>ÊïÎn”-C³&µ.Â,‡î¦%,Ö"ñÐs1 c:gUͪä˜Lb°A:²Å-Ú‘Á¬È.¥Ôë˜j‹ý枢œÈK ³•%·¦WÁU{ãsTµÉ’´Woº Í! NX|\Âë7æt'ñ†«¨Vöc\·5{8R8JO‰bM§°(ßXIðc×™#,¹+|„ÓWÁãçŽÎx³Ã“0ŒC¯€áÄ'1”°u%¿êh³…Ì×Ûû¶§6_g„bO<=”Ô-J²'_¸·¢NÆh‚1;pOR_GãŽæ {[N*uMlDt@‚ñÁ0daö¬’à4žqúVb†‰,-õž,„žÙÙn¹í$wüË9qÅÕÈÞBÌ ³1^æ¡å+› ¡çÒ…Ú4iŸ± +t¿Šõ”à 3ŽC‡²šÇïÞŸ¿è©¬ä06÷ a~ËÝÜ0•Ÿ.sîžX3ToYu<äÄ‚8u…¶ÅÑèîÏ-òÞG8ƶ„îiø`ÅÇ%ZÁ€žk-îÙ®sl àãNÓ™ £¨ ƒBRÖ»ÞŠÀPÐs‡ƒÏŸb{F :ÁrÊB4’¿’ÕU?¥Ýê«$ÊjÙ›NQ~¼T,Ÿp»~CÊÙïÈæPÛAl÷ÀL”R¯ÛmA!”àM”-°ô}bhóm ®>,å Ý$ƒ+èB~¹o¦çU²°+ïÊ®£„æ¬d²!5gøžrÍÃ’|m™A´«¥+_ä¼!qÄù—æ €ê4…[qPçÌO H¿b¶ì•ží9•ÙWûÕ`â&Øu覦mlÉ)Àaþñ¾ª I‡38¶)öν¨ìyÒðaot`ìÄÊD‘†°këztEè^¢…‡ÌddM@SŽEOdt)h|í+¥ BjœN3çz8Ô 'Ÿñõp@¡ i+Ýh€).<(yçÞxÁÌ¡`¢JH_è_Ÿ•;(Á!ô–¿||yù‘ѸÈRɦ5Ï@)¤$, ±Ó!ÕhiŽÊÆeÖVÉÅ„F•3Ècéܧ_áo›+al-‰×OÞXkïe/-aj>6œ¯dÆHÙ ÑfI`n4#‰øu5‡ß‡ +n±õ5AÌpÄ=qa»CÄ“ëÕÈ\ÅvÆ¿a®—i4:~ã¬maâf¯Œ#Ò”=ýáÇä™ìkcëª=ÅÖ…Z n`P5ÐÍ> Žµq +>[°oü×e’ ¸ŒW¶Çíy!7c8Ÿ¯ŽuÝ袮pѸ®##ŒN*!#ìøl8ZH7¸+*½GLÔdÜo¼¤gìVs̶_± Û C§÷ín;4·}"È­*)Îí$ψpÒf&üÀ5å]+ZAÔUÁ®C“¶¨sn…Èíä²Hø嘥tÓõSùr‰Ù«åÔúLÄá=ž¥ìÊ )¤.œ—Fýsï\¡÷'jó;X¯ùõ„ Õ˜'§Èë÷»C{Û±OâŠWüódÉÊÕКn\¸%‹ñkŸµHšp礀ŸŸ7u{K-ì—Ó¬ µ•û#­Ex7Ö6BN*%îÙÁPcx?™Èµr’Žohfäàˆ"+X£xF£ˆôçÞ¹í@iuD¶é…ÊQŒ ì•,òAOþzÌ)©™RÂT‰ïY:ßd;rGÑSZ>ئäKÄŠÿ™×c¥~ÿÃ<¾{«xòDÑKsÇÏ’¡E +Èðˆ°“ã«óZ­Uà‡éá&%‰fZû9zÍÝ,W~¤ï4òÓ, 5]nÑ“Á‰ñÆvŽªn†cqͲ ÷_Pξ,9œBCBqÇ$ÅA8¼¼ÜF³7-ð;sX² ‡._þŒÎì0™¤pD28™Ë|™õ@}wŒ ^H¥n©ÍN±›jä1pµè;ÝÀ¯øÁo¶ésÏÈ©ûŒÌ½4ÂÁ]õʼIBk"îŒàÄ^œ†ùP­öµE¨Ÿä]¢•Ëÿ}O§hz^ô<Ë=k×°ì#qãõÚV±OÃI‡ çbkUÝq)¡¹á¥ŽNq/–_jÎCæw¬`žN¨€ñÒµ> endobj -4460 0 obj << -/D [4458 0 R /XYZ 85.039 786.531 null] +4550 0 obj << +/Type /XObject +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/important.pdf) +/PTEX.PageNumber 1 +/Matrix [1 0 0 1 0 0] +/BBox [0 0 31 31] +/Resources << +/ProcSet [ /PDF ] +>> +/Length 557 +/Filter [/FlateDecode] +>> +stream +xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù +ä +6\>RgÈbÏWÖ¹j[†› +WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream +endobj +4554 0 obj << +/D [4552 0 R /XYZ 85.039 786.531 null] >> endobj -654 0 obj << -/D [4458 0 R /XYZ 85.039 417.524 null] +530 0 obj << +/D [4552 0 R /XYZ 85.039 766.606 null] >> endobj -4461 0 obj << -/D [4458 0 R /XYZ 85.039 396.93 null] +4555 0 obj << +/D [4552 0 R /XYZ 85.039 742.055 null] >> endobj -4457 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> +4551 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im4 4550 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4464 0 obj << -/Length 2251 +4559 0 obj << +/Length 2927 /Filter /FlateDecode >> stream -xÚ¥YKsÛ8¾ûW¨*{ jC˜>Råƒ'›¤2‰'ÖÌa³9@"åh–"’ŠF³µÿ}»Ñ EJ”äZU*„n6>|ì >òàEŠy2…QÀ”ä£ÙòÊ=äWÜj¸VÅíèÜM®®ßþˆ{,öâÑdÞÚ‰=¦â`4I¾:¯ßÝ>LÞ|»RJ‡s6vÃ0rnÇ"r^¿þüÛ§ J|çý§·8õùË/cÒH:“÷Ÿ?‘ì%0ç;ÜÞ]ÐyÅ7ão“Wo&-ÎÎN¸”ˆòÇÕ×oÞ(}¸ò˜Œ£ÑÆãqÀS›¢Lì“ÿy||wûß™üç/q}§ïŠX¯ë%O>ʾüïç¿þþÚº~Ë{ÄÒÈ•ó"âuò=%§Yƒ{Tè(°ú.9!l.AAÂï Uàô&'ÕÓ±‹ZøÈOücÍí´×üMH•[•§4OK]§VÖ€·Ã'‚¯‚|qñBäU¦W+]áS›d`³Ç|ˆ)Rf†YWúèYªG°a@Ü™YÖnÏ‚0‚Y±D\K'8á4¨Æ-¦(ÍI”Ú*ÕÝY‘#1µU±SW(N1ßSýxÿþ-þåqLgV° …]$»Gïím°yÃý%ÕõTW#ªzçõ\âoÖ?_$ôÅýi?3ú\ä‹:KôŠ%‹ù9G‹ŒÕ{À.¹t×¢¦ñ"'µãÚÊ %+¹ïlqïúGI:)Ã=tŸ@ýÆ­¢p6ÆŸÆæ=]“@'éµ®S;;3k¦Æý*š3SöÍáÊEFóÙ¢ñÓú%΄)G¹ß´€ÐaL¼Täüˆ68³±k°³/«›®›Ô¨DÞŸÏ×RŦ´ åk“hBªãvÌSØ¡Q£Þ·ã6¨\ …,ôÛ¬ -ÌbL˜ÕCÄ+&}rŠO¾“uwJê¾ï3£ÍÑgl[’Nglðïöe&®ß/ùè¾ £V²ëv °<ê:° -X ¥Ç‘ -aÀÞ¥s“æJôå9z9Õ4œ™×  û±Îd| ߶âà(·Ñ -Z$ìþ³õXPh|Ý|ÉS#J蛉ø$çëA©›l›TN´ ã¡_-mž53+L]×3–.r³,ŒhR9ØHàÖ]9J8Æy“£ÓY™Ö«“©Í]’ƒÊ{dU¤®†4…áEÛp¾Õ©)¢Û¾:’Åô¶Ê¢¨_ÀžÙuÊ f­s o ¿’„µ'¦>æ}¦ ã®×EŽ5è ±Í¡9”C„Öï‡ûH©"‹è4¶ÞPï'}(߶w¢ -…X¡±&Ýta¡Ð¸q©—&dê´¬hZ—öaM-Š -½È m±Å$" -(°–¨6eP´ç4[ä¸èÖªÚI¦%}£ºSVÐÿ‘ZaÕ*½ÄxÇÅ4ILOe+F?L§Xà–ÃXB‹aŠ<}éD0|«Ö¸Õõ]e ï+ߊA®II£µºXBSjò‘6ÌmIˆxÖ‹,¡J&cÿør¶ïCk«vIRC.PÃ鬃U×,u¹hú¥¦6uÆsSãó“…OÄ釬-C%ò°î™‹Cé  µ„`ÁÓÃ%ÔyjAe<Ô#N”OVò¥‹JBHGjUÏï­Væ,Hœ¶sæئÿÿn{Š|×XßXš¡%kÚ½|eZ¦lcQ)ušÊP2Ç<{‚9ÍvºÁ9¶­Ò9¶w¶.e{Õ ÛT&€>C$u‚ÔñPÀ þL7Œ+ÑÆÂiê M‡â s¤sŽ¸ÖÒ¥¼íA¤m©ÇZ§™ÅéüÀ󼘉Hœë‚Ob¹|yÐðŸaÏ*£ogëRþöQ ØAuèw¶€5ÀñŸ€£úÞS€Ý0v£g’'ân£0L¢U:GâÎÖ¥$î£$±ƒªG"ö-YÝšòÁ€¼ð8\Òß³ÝPÀ å­Ò9w¶.epÕ ƒT=ÍùËMä|77!Í­ÎýòÀ'…ä, ÂSð¯ØìàYŽˆJœ£Ô*£tgëRJ÷Q RÚAÕ£t]µÇ<Œó#D<à§@»qÌ"?~¦ozpüîȇ‰´JçˆÜÙº”È}TƒDvPõˆLÒ,­­?&%&¤ -}­«çWhEÌê4ƒÒ;¶.dðÕƒ]T=Û‹&Û2d)<ßσÄy˜à>ß ä e]0~3ÞwÔê-üÓ êsÇàåš±Vp;´}Ú~¾€­=•5ì*ôI¸û…‘à“è•®À-=¯ ƒÌsr9F3„H ˆÓ!¾9t*ÏYÏS‚”Ax  #iò*Y9á¹,¨e¡¹FXßðN5P𵆕1ÈW_pÒŽ:Î…õžùvËPïÙ5UeäLl<òBsèQCMmsem$²{<ñÁÝ4õnB ÿñü°’‹Áƒ'RJ“€ µ*6Äa±e¨‘ Ú€lý < Á^4…ê—Ǫ!‰V_…*IfÓ—ú¼ i;:;t*1?ä:r³$y¸^êç ‰ÎâÅx85mÏ oøC2§;¢µˆù>;á™m µq³Ãûdç6‹¶%¾DA¹#ÔG'¹~ÂSÜ‹QžÊnØš·ù^ÌÏgÆ„Ò¶Øåx‘ªSæÐ=ÑOgʹöŒ=á„NDV¿Ëqo^ÏÄã[¡L·ìvN,AÌ”A½’$T˜$T9«œM í<ŒÙTà«9 K  .z=ÏIÿÆð²—¯Ðíú¶!c®^x¡;>>ò%ÙÐ,âÄÀñðØ’L ^${‡oÎôZ-Ì ýK×–#¿ â+\È¿sIäý‰!Šh^\y×óÂàDN,þ·l7øzzzüˆÑðê/ølš_hž<òŸÈ#þø¹‰ßø"2æûöÄ¿’_AÉ<—hhO,‹g­`­ßîˆ6y WFúêþÆRAa(—þF`:å`©!vª²©³áÄr3,‹þn¸ù´bÖòº >¢ÕF`8îå + ˜ý«)Åm$î¢8;–]ÎÓKIYv(™aF`‚ŒLÈ5%²ÿ¦rÄ(“°³A 5Çj+ !R¥ì‡xH†V½ðäÓòš±ï%`%S+p>4Œ¿ü´æc umA–I(èx2¥DÜð†?F‰ˆÛ *û^dƒ¿©³oÚbB¨td^kc“<•æ9àéÖƒ›O«fJŠÌq Sl¦R')BÇpL40² ÚÖMæ[ñ‰´fEcô[Äð–g=*™š Ï{ô¢ +F°$PnduaS™’°p™R*|· )ssÜ[î,µÁ:2!êWÓçøH*&BPβéÑZRñ*èÙprO‘uœ¼X-& +£Aº‚²Ék˜·ŠÆT•›ÜÔðÖBg|˜Gž_ºÜ\ûJ"UU±šé#ûä?9* Ðþñ|\jj Úð×ä81F…ب5ü–²;gœM³?TÅfÒˆ‡ZoÓ’OÁ Ab¯Ø©´Çh xo;¦w‹Xm Q/ˆÆs.¶Ø™ÜŸf(½€¥|>ˆÁàø§íXd§ô¤é…FSu$àÄŽàˆFŒæ5#9`slbå`vaD6o{sA4µ)ù¦xrÊ£uåHn|¨ à—³ 4ÕÄsn(jø’ŽärD«+t’šÃɼB“4ûc«‘ +åaÀ±É°@æ^ÿªR«d +¢Ì S("‰×¿1Ƹ¨²ÖGÙ¯]Œ¦”‚ð™Ä f ëtÏ”—qâfq:²cÓè`ÍSÇ´’í+.Í9íØE>±éåt“k³¡ìýj ¾}nPV'¾]•„Ûp Ä,6•åÏa"qˆÉJ“4ÕÛPœÆ¦}¼ð‚έ­äE_§z9½X8R›áÔ + +6DxIbÞ”©‘ÆÆÁ©ŒJ×#¡•Qa¦8ªF<ýT6òvgW Jùš‘Àh@ý…±$ùV¬„@×®"Ôî0Û§.é³ržŽéùëW è'<ã80#ÇJYsï„ï‹í á}Ø ]è#ìæNz0§¢1ô­r¡Ø>³œlàQ"Nô®-÷Ľò*¯ãIN>¸T=ñÃ> “0"x¥‚sqŸuC L)7„ü“÷½oj¨@+v½ #X»Þ»¹BïXTSÑBù€ƒÅè, ‘¬/Å,Þ3Þµ¡ ƒ«O‘#7üŸ$}Çž^/¾¬nŠbä»~ö³×ïï&Ãcâ‚gúI÷7ÀÊ/½Bû/ë2ñÜ ÕrÜ–Ô%jÑ$œ®©$š.’ØÉ"þRM—Äñ–kW",ÄøÌOFj6•ˆ‚¬že<W!*™*w’ i_œÐ+!ÔÙ2Þ´ëx™jc<Ð4 L¡âËÁ0¶:eãÍ;Ò~5\}ðœX“×f¯ïʬÆÜž#·üõb£ÔêÕ1ëVâ3‚q)³£x+HV‘µAŸêè„å76§nkgò×?ÉظÙ@]N!É:ÒÝGðdÝÄYà&Qúƒ¬pá'‘›¦É¨¡øüT´Å”Û\0è?á8qúqzqŒßs«š`Kp™Ú(¬éAhîv³à[2ŽN5‰°Ó b_:U \–­f®©q«g|¦ \ú†”¨IúAwb±Gy,Žn_­yD]PŸêš+šÕµ©z´:tH\Œ[¿#ãµñËÍNï•çå‹ÚHÍ-îý#fÞ]êÕ ‘§:!QéDç#ÏÚwEµƒä$ö"JNqÈñR»ë‘&’Þ7Ô€KµëHýdÓäB>å6¢¦m¼À›ƒ€<¥:tËcû¦Ë…“K~èO¹‡±p~êµM•…nE?~F¾ ×öO2¬mqç Тܞ”Ú—îò²²›Åà {(»%|…±ëÅþ¨X“£À¦s\ôÔÔ!e2`º–"膻”s—ˆøÜ[Š#À|ƒ Ât‡†›¶é:!t| çÜóÊC;4—`'eÁ)„Z)­ätÉFÛNvm‹îßÎ6%}8/ “‚Ƨm=´;;.â·>cþ91¹\@Š~ÜÔ…+k›ÊTÖð,¢¤;'ÕpZ½•m8`ƒC'3Õ¿aMõhu¯£•öGM Ÿ•=Ø’ R0TRƒJÿ…»ö¦erO'oq‰z¯!öª™Eª8ÎÐyQò†¦–ÃŒn‡ÅÁ®:«¡¸Ñ¡6u_06KWôL¨ç5¨ÀüNjýª9­ßN?Uý»Ï¦áfB®ˤûâö}9èLüv¯Àa¨ÉŸîá/ßáÿúÏæ?„©›¥Áôïÿ¸ˆ8 53(´,=e8R©¥j‚ãÿ]&`²endstream endobj -4463 0 obj << +4558 0 obj << /Type /Page -/Contents 4464 0 R -/Resources 4462 0 R +/Contents 4559 0 R +/Resources 4557 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4426 0 R -/Annots [ 4467 0 R 4468 0 R 4469 0 R 4470 0 R 4471 0 R 4472 0 R 4473 0 R 4474 0 R 4475 0 R 4476 0 R ] ->> endobj -4467 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 293.701 286.551 305.391] -/Subtype/Link/A<> +/Parent 4556 0 R >> endobj -4468 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 280.152 176.46 291.841] -/Subtype/Link/A<> +4560 0 obj << +/D [4558 0 R /XYZ 85.039 786.531 null] >> endobj -4469 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 266.603 210.278 278.292] -/Subtype/Link/A<> +534 0 obj << +/D [4558 0 R /XYZ 85.039 766.606 null] >> endobj -4470 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 253.054 190.036 264.743] -/Subtype/Link/A<> +4561 0 obj << +/D [4558 0 R /XYZ 85.039 746.277 null] >> endobj -4471 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 239.504 187.278 251.194] -/Subtype/Link/A<> +4557 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F38 2997 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -4472 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 225.955 232.763 237.645] -/Subtype/Link/A<> +4564 0 obj << +/Length 1754 +/Filter /FlateDecode +>> +stream +xÚ¥XÛnÛF}×WÉC)4¢¸\./ySjÅq;©¥"Ò>¬EÊ"L‘.IEðßwn¤d[r€†AîìììÙ¹œJ =øSÃظžN†QºF«ár3ð†·0s>P¢1•ñλÅ`òÞ„C幉— «ÞNâ¹& ‡‹ô»óÛ‡é—Åìz4ÖZ; 9GQìÌGÊ™^¾›¢8p&<{9ǧï|½¸:û<òcçëœ'®f‹¯8þ|ý; Þ]Óu.®ÎYzþçÅÙlô÷âã`¶èMi°ÿ|ÿÛ¦pÄÏÕI<ÜÁ»çª$nÑ® ´Œ‹Á|ðGo‹ç‚!¯:æ¥Nc¬7ñÍËž C7ôÂÞ“>Ì*71æГƸa‘'ÁyÆ¿ùàCc¯ËÑú-‹· ‰RÙ†Ÿ€Ÿ4ÖNÓæ¸M!ÒR´—mþ1d¬•vÀXXT÷›Œ1‚¨¿igNMv,®‘Ûu>’vÚ½sŽ@§¬6¯zî¢ ¯J³Ú¶Yñ€‹g…-pUÚ‚E;îÇž³Ë ‘Þ?Š©­EacK™··YÃ2[¦,ËʵEŸ.%aP5ö0mÍSVá­P)­èpd¡nÈ{ÏÒÒçE÷ äjË óҌٮOa@ÌŠ_Zp"¨ãþ%”pÁÒ4km^4î‰RCíE¼TÉ{•“LêØõ’àÓhaš9uÉ$ìÃÈ™•mgÍ)TbïEX{“z¬iŠ™œ—X"F³[¦gLô{žuÙkŽ<pºÂÔ,À{Y+‚$¦„G¡±Û"«¹ndI.6¡Ê¶–ªï+´×<Ôœ«¶¢ÑH4Æ3Γçç Ö´;fJW·¨S¦#Ùüy¾Ù4å‹Ór‚è‘R²­KÆ]^6.Z²íI6âÁ{Ì3 ¢¢'>¡åL“¨ž“>yÑÇ“B”m1጖ `òcdB(ÒÉ¡A8Ý'1â÷#=ãŸAÔ ê(™s·ÛŽ‘,c:¦¶äö®sžPÊßWUÍEŠ¨gØlò^¦lh7Ôܼºš^Î^/¾}™½‚ùÆY,>ñËôììz6ŸÿÊ£÷Ÿ¦çs¶¦N[Û­3ä%­íâ[Ìù¢ö¬¢}ϹÊÚwŸç¬PZæL ‹¯ø6úö”ŸèlÃjTê-H$™†ÉŒÏAícûSÍ0•ÛjÜw }ö>Ý9>²éaÊq%Ú›¦*0Z¤Iu›oä cçC)réð€QL›7ˆO‰cA‚¾EMâcXY•bbH›ª‰¥Ê¯32Út•3˪1Ÿ÷ênR‚V±5r +êì6oÚú{ ûsÌÙó7XÈÓu—r [Ëû>{Å¿í()~Üdà$Ä,ï¿Ijj1@lÅ6¤œ(2Ý€¦åÖ“¶è[@ÐÎ nEd /ømÀɆ£²Ûqw$ÓÊŒ²w‡[P q'œ“nòò)IWõÉ^\7ÐG¿ªáŸ·û_¿@ô!b7‰ýã6ps„QÐÁó%ÉSÀzoë#ˆÿI£K2endstream +endobj +4563 0 obj << +/Type /Page +/Contents 4564 0 R +/Resources 4562 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4556 0 R >> endobj -4473 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 212.406 213.157 224.095] -/Subtype/Link/A<> +4565 0 obj << +/D [4563 0 R /XYZ 85.039 786.531 null] >> endobj -4474 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 198.857 208.46 210.546] -/Subtype/Link/A<> +538 0 obj << +/D [4563 0 R /XYZ 85.039 766.606 null] >> endobj -4475 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 185.308 223.49 196.997] -/Subtype/Link/A<> +4566 0 obj << +/D [4563 0 R /XYZ 85.039 746.277 null] >> endobj -4476 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 171.758 204.975 183.448] -/Subtype/Link/A<> +542 0 obj << +/D [4563 0 R /XYZ 85.039 663.47 null] >> endobj -4465 0 obj << -/D [4463 0 R /XYZ 85.039 786.531 null] +4567 0 obj << +/D [4563 0 R /XYZ 85.039 631.048 null] >> endobj -658 0 obj << -/D [4463 0 R /XYZ 85.039 369.622 null] +546 0 obj << +/D [4563 0 R /XYZ 85.039 215.178 null] >> endobj -4466 0 obj << -/D [4463 0 R /XYZ 85.039 351.883 null] +4568 0 obj << +/D [4563 0 R /XYZ 85.039 172.224 null] >> endobj -4462 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F14 2895 0 R >> -/XObject << /Im1 3957 0 R >> +4562 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4479 0 obj << -/Length 1939 +4571 0 obj << +/Length 2772 /Filter /FlateDecode >> stream -xÚ¥XYs›H~ׯPykרÊ @Gªü Ía;•ØÞˆÔîV6#É$À"ûßowÏ Y8{”KfŽžžî¯Op‡ü¹Ãy`;Þb8›OíÀs‡Q6p†[ع¸šb¬IÆ-š_ÃÁù›©?t{á,†á¦á³pì`1†ñ'ëåÕò.|ýa4ö<Ïr]{4žÍæÖr4™[/_Þ~¼ qÇ·®oÞàÒí‡÷#vçž^ßÞ¨½W¸k¾âÆò×ÑhV@øz5ú¾¼9[š¸ž‡R~|úì cÐèíÀ±½Å|¸ƒ±c»‹Å0øg¾§çé`5ø­á¥öü¡:u ”À›ÛÁÜ{ŠŠ´Pq}úóá,ì©?#Xr^­!Gã`X9˸]¨G¸\]…¯/oQ;¸iì¢ :¸å×m)ê¢sàfùáæziÈ'3Û‰‘ü'µŸÆL(yÊ*«IÁJ¸ºâ¥ì]´Æ|“äZ¼ê^^Ýè¡žµÔ»{ž«Ñ:Éã$ßvéqRò¨壚J^~oIÑÒWKšƒ“0Ð -lDi'²+š™ç¢ÒwÀuFñD )³µ‰|né:c}` ¡f™TýâdµÔ\×Üh` $ö§p É­oïÌ™¨äU±;í‚D‚îñêY÷%3Ø¥iWñZդܨz½9 >Ù; ‹3Ã,ÎOÔà;KkÞ±PÐ&ºgù–ŸZ£k®]’¦Ú*ܘÂhm€,9@iѺG¼NœDùÅŠek¦¦ïYζ¼<õEÁE‘ò³8º¸QnOúCæÕ1¿_­Þ©(ªDä‡>®”ƒ[ÿ·ïµê_`œS±Ùœžç©X©}«J¥Y6Ž*òÓýAVV§ ]ü=‹¢”i»î=ý A>æ{x±·¯ñ®5‹¾ò<î0Åëðø|q~®â|Œ ïÓ‹B”Õç#"þKž›:_³4µÉ®6U#´w­úí{“&Ý¥ÌÆó*1!çc˜v-@Ûfrࡹ詹/cÑ}ã|̨IV]Ö›Mò`‚!> ¥†ÏºÉ úD¯×íJaþý:¼ºýªÉ·Ö¥­«ÌÇwïÚì¸ì¦<í}ÏzÝq%48§w§ÏÛç8“Õ£¬x&û‘Ë&×yƒd‰:¯L2…Ú’±}”›ŒóîÕòî8Ž”V1 -%?t SgŒyy頄żbI*·Õ^ö$–ÕÿäÏÅmÁ£dóØë"ÿ ¦KÎJû/ÒZ+á<µÕÉÉÌ[žó"þPã~º)€USß5vâkoQÛ3i4²£©Áu_ü\ë¤ëˆõ#J!¹(  -•k™¼|ÒÓ¶N‚‰=uŸoÀ[4ÔjNœv«éNlÏ 'ÞÂv¦Òšn߆fÙ·§Çþzih £ÖDü(¼éT¥o:³.K\‡.SodTH3H|}’{Sèq ùž†$wƒc’»sÛŸª&y‰r]Êz1ª$ás|/¨Ìåg(Q1#ºøFIZnïͦšP"#–!°ÑˆÆøbñäuT`E -,°-n“}q ±ÚÀú#’¡§ ïE3Éð3/ XÂhÄ5sصJµÀ‘õ̺¤ÂFî±f$*¤$¤¨J¦|NÑ‹Ì ‚5Îñs–ªÑ.ˆ¶‹yé¡êOÕaU…˜&k¤ªHP©Ú5mÌ6ñ{!Ÿ{’TÑ‚C¹Þq;ÒF©(qLJ2¬në’«µ=®8»Y­ŽÅ!åjoãG‘÷ê ‹ñB” ¦¨ÛbÄ-ªT²f¨ ¬Á¡3µa\†TKñ›Ë9¯¢s* ¹b‰Ì6ŠL˼¥ŒÉgDÛú×O9¹Þ¤p«¢²2©G՜Ҥˆ”SOâMç–‡…ËA9gºÐ#åV%õ¢]›ð`¶÷] ’ØÒ²š' -xd»FsªX‰¡eº»Åìqý‡¹H»‹Ý—BzÓEÅ)Yq–K Å#«ÔÞJ§&\RÛS‰ES+¯‡ØCèІµBet™<\"ÞJq 1ÉÌàMÁ×(§P`½ÁogØfâ)xn»³Æॾ&9öù%Šî&7¹¨ 4j°&—æ™QOõ Ô]›hܦ‚€HµÇ*?öHn\¤†Ù7Æ–Oi?¼ÀöÕç¾Ãî~J›ÿõ)°éaü¹½˜OŽ·0Úì‰ÛC½—ãJl¾>ùoÞ†3endstream +xÚ¥YYsÛ8~÷¯ÐÎËRUM¼Ùq&ãÙXöÆJ9[3ó@K´Å +EzH*Nþýö’’)e+[®2q4Я/4¤&ü©Il\O'“(]£Õd¹9ñ&O0óþD ÅLHfš‹ÅÉÙ¯&œ(ÏM¼d²xìöI<×$ád±úÃyûÛùíâÝÇéLkíåtE±s7UÎùõÅ9ÎÏ^ßá×wî¯æ—7S?vîïxbþnqý›ÿâ‹Ôeš«ù{}ÿéêòÝô¯Åï'ïàƒ£)­Qì¿OþøË›¬àˆ¿Ÿx®NâÉ ´=W%Édsíš@K¿8¹;ùw·Ï^5†’¥˜©ÄM|sÉ0tC/ìôaV¹‰1C$qà "$¼ÐÜ`hŒçÜçÐ)WÕT{ÎK„‘3ÏZêâ?˜PN=)ç æå’„Îm]µ8XA×s–UÑ‚ ΢}=vNºQüx‚ØÆ3£xÂ6‘vÃè°Zh‘ÛpK¨wwé µïÆq(ˆ× +&¨d&Ú ÐXÐû©R‘“Ö%Âøìá`—‘Ædñ“¿á‰ +Ð>ðoЦô£³«ž\V ëd ®l;ìKâªxàIÊOà¨fšpŽIÞËŠÝe~³`ƒß6l*t…Zzí:EË`šª”Ñ?=ã)ø§xü™V]Õ¶Ð^’QvÕÐ%5ØP‘¡!Çt¹ÎKXžá²W&$ÆUA8¨äçõ‹&¤¼h2ëüîçMnÇX‚8îÑ7¯ãXè aŸÀ?gûŠ dõwö%Æl³!¸`v™²J Y=2ÉC-¸uø\W\AÈmÄqë¬Áî'Z{„N]m¸C`M›ÅС7$Dͺ@RÐÉS¬|z¦­¬¦IË(c‰zC7T¶Ø+Ò}Õ¯Z +„õMSÄ9]âðÀ\»©¹^›¾ëq ÂÂäâêæŽÆv +"Îú… +SzNñ¨-w€–Ö§2G͇ä5´H‘6.cÔ—-1y&káöáú‚è+)R¬xÙåõ{Nf_;‘ìy”r<€UÚ²0¸ƒÀ'SòCV&Äkê¹À$£j1¸“Yùbfx´¼Íê<åÁ¼á/YIª}ã Šqt•1O\EàR²Èx’L\ëUV0! ­²rIdlˆ•Ð½r¥Å·Ë›‘ó÷Xã9oW=Ä£iØ` †Kà)Œ,Sà¹&³Ëx ×mwøâè]ºA€RÞ%Äáƒ(báð|Áß—½§àÎ9Âå!O;,qæâñeIÛAG°ç5íÈá›mÞ¦ÖÍ%`î Ç:Q( ×Ù +•Äêçµßyê¥S ÷ÓrÅ ÆOÀx»Úz`›ˆóöŸƒùªÈÆüsAÄû#ã lèØó)$Íåû ™ÇöiÊhyQµmáVcïÐ&ã„ͳ…pý"+põÀ³xtÏ×p®8اØ]ài9>Á¿ª–]ÙÁkPÆ”½0Žœ+9:Ãký-SvO 5>‡£(ÌÀ§»yIBD’äϽ2_ƒ6CÖ­uÚpã­@Ô]¼½=»ºÅ¶ÇÚÅÁ«ÛÏÜ vûñE‘ EGJ*’ ñÊ2}(,bhFÊŒa£ì$"vŸñÞ¸ã¾xu„©¤"‚6íÐ1çÇõ`ìE¿1±BúUGš¯~V¬Š†¬L¨_;ç"\õØf"Â:}Ë+›ÓlrŒFw>®M€7ÌýåÆP×H7–µp>ºhW¥uhc/e#††Ç2úU¶;®-FåkQ)}õr¡X߇›[žhŸUi%Á¡ßTï¦j æ%.eåzPÔ•|Ï#œo`30qå|?!V5»A—rè³aL˜–<[TMÇXàÖ X2”6ü¿Ð P0)Ù÷¬ÝB‹Ý0Gä!ùb…Uö6âCšYW<Õ ƒ,®ã»€·sÜf»šV‰dÌ.,°xÄ;Fi} è¨ø•~Ç—3ìÖR´ÞŽåí‡zIVEÞ´R<³×iKÔ i!Í5žD~É…} ±Ÿºx¤yAëìW3,lþâÒˆê‚^yN‚Û™S>hŸòÑ“¸Édì:cB¸I‚…Pà ¶3<=´Q*#¡H¢§¬„ei ¿ ¦áh÷]vX{,”é)\K¦#™/‘Ï÷}¾e›f-gßÃõžæh³sÂå”<+ ¼Vâ0ÏtJû`Ô€OAVi"’ÔŽg,¨SwÔhqOkŽgÇ°ÃìW‰Ôôײ €—2l’¢­´9l«œS^õ°m™$½f­«mÁ÷t,h¬¬XQ±nèŠNûTæM'WJ-·r‚’릴´i¦>ßž pÆR ½­å”Dxà†Ûå€w™½HÝEh`”ëä(˜Eöv€Ld}ˆ !Äû4Åo‘Œ- ñnºú.Û¼ŽWsëôkÆýUþ§§tÆp›ÖlÈÆ2R)e_ȇ``Ç‚1°P4(rÞ£t.à9ÆBÃQcu¾ Sþ4d _)- d„JÖ0ã9.»ù÷›-$k¬n™|ü¢FP+I5—)&Fx³rÕ›a<® +1³7g‹)±[ÓŽöˆê¶U;«¢°œK[6ämg<ðéî7ÿù‡i¬ÿÈÀ\fnùÉuqóöæÃ?¼ú‰rMxüÕs@sðÕÓדG/ûêéË«ç<݈|Ì:âVò ÝP={@8Ùô¨p=ÍÁG!ßǧ݀„ûÈ™ d˜ö%— ø•»Ì +Ÿ*–tÃ0ŽˆÒ`æ +o¹âeÕu\+ÛKJí_zºGx.Ò¥4·MW¦C/µÌ1ñó­Còø®Ô,Ý?ør¶¢´ùd‘¯=pÚ5ønN×6Ìj+6U»|»Ç(³SÆÂ…1‚õ¼§I?ŽÝ$Œ&¾ +]™¿j×ÆŸògv¯Ù`³×:÷ß][Š³t¯î*XœP~¬êM*6€þXoX£ŠC×[〆$ ÔðØSnàén# }´ÏOy¡ãÍéCKóŠãJù®VþÇû«9þ”óFží\}ÉVÐö‘ ‹ÞâPüP&qUœ¥§9Šý”# {Pö8Žƒ2àøáú7Œ£w‹»7w%Ú6-Èrï ‡J÷z5 ÞPÁ¥Rf¥d[î!À´éâøvš#€ Ñ;°lã8`Žu•®–iÓ¾Á;²¡Ëeí¸O—·5¹ìa,¡[’¸[YÙäÈ©²*ìÃALú#]ÖUcŲMÕÚDKDO)»|(“šþEs3†“™ö\/æßä΋6«)œ·yÏ*œL„ëxržÖÃØ¿÷j·›FÐlJûH+>Ù¡ˆAUáñ_;’Ö 4?2„#Ü:;Øc7jvgYK‡=£ÌÞ†,"Øó SîüÈsð{ºçm¿V@hú"[²wXn b÷ùétc·: +ŠŽb°¬xÊálsÀ ´q}àG[IÚÿ×oà1?cü Ƈ´©:aøçíKltìšXˆü_ÁXžþendstream endobj -4478 0 obj << +4570 0 obj << /Type /Page -/Contents 4479 0 R -/Resources 4477 0 R +/Contents 4571 0 R +/Resources 4569 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4482 0 R +/Parent 4556 0 R >> endobj -4480 0 obj << -/D [4478 0 R /XYZ 85.039 786.531 null] +4572 0 obj << +/D [4570 0 R /XYZ 85.039 786.531 null] >> endobj -662 0 obj << -/D [4478 0 R /XYZ 85.039 252.611 null] +550 0 obj << +/D [4570 0 R /XYZ 85.039 766.606 null] >> endobj -4481 0 obj << -/D [4478 0 R /XYZ 85.039 229.895 null] +4573 0 obj << +/D [4570 0 R /XYZ 85.039 746.277 null] >> endobj -4477 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R >> +554 0 obj << +/D [4570 0 R /XYZ 85.039 291.565 null] +>> endobj +4574 0 obj << +/D [4570 0 R /XYZ 85.039 257.022 null] +>> endobj +4569 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R >> +/XObject << /Im3 4353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4485 0 obj << -/Length 3475 +4577 0 obj << +/Length 2808 /Filter /FlateDecode >> stream -xÚ¥ZëÛ6ÿ¾…‘âù°V%‘zØ›W“"MrÙ=‡¶´–ìU+KŽ$¯³ÿýÍ‹mË»ÁŠÔ9$‡Ã™ß<¸þ̃ÿüYºžJgq¹¡ògËÍ…7[ÃÈϾP,„daѼ¼½øñm¤g¾ç¦^:»] 뤞¦Ñì6ÿÝyõîúóí›/ó…RÊñ}w¾ˆãĹž‰óêÕ§¼Åí¼ÿø»>}ùuîÃh¢œÛ÷Ÿ>òØk>íÜâÀõËùhn€ðÍÍüÏÛ_.ÞÜ|Z'ñ•B.¿^üþ§7ËáD¿\x®J“ÙÚžë§éls¡Cå†ZÉwuqsñ¯a-Ó3ž5%C±ðS7 §EnäEƒàÏœï®òƒY†n¤c’K»pHíÆ µP§ÎM'_Bßm ­~®<çÅNVçÜè` ÛÜe7Ùæz¹lvuNNx€ zšñ‘†÷Ã)ÆP‡Š¿½/ZàT%ž“µÀ‰´{¼Æý<ˆ:âÔ)7Ûùú$ê³Ç{’< ww²†Lm‹ JþËÝqì-íqàž·ÅÙÔ™ÃwÙ-±gÍ]Y¯y´¿/¸AýÅ@Ö–Äó#6+!ÊhïŠ$µðA¢¾»Çw7ÈÜÓnMk¡YXD|{¶½úAâFq4¬„‡øÃóã“•szzC&9Ù/ŠìýTê†Ix°ßÇâ®6<Ò,¸X‚GDmÑ“¶Ó>  Qf©áA£‚Qº—Ï8šut•û9©ZE žÑ/_Äyº¬ïQ#Ë;Ô^Ö˜‡¡“á.;ºÀTƒÃ,f¦e¢¬æpb]Ô¬" 9 )ŠNé<Ëöq+‹ûNÎ -òqî3u4ÄìáÉ›ú¬Dqì&Qü´XDçõÀ=£On(zp¼ß¤ØûÕßða5Ȫªa¡zNÝÔ‹,7Oö½ƒ-^Tà3jÀÈCYì¥GÛÕFTn©Ì •ÁžR?V¾wâܾvP¢ä2‰¹*ÒôªÄ 's+'Îvb¿Ø¹Ï:"SA:b,´—©MÖ2ë×7r´}E%.…—bÄW<\-‘: À&†¡]7(-îÐp¯ÁrySgFr‹¶Œäµç›¥Züòœ}IcÍ®çï¼hI¼×5w­c£iË5ܶöHÄmUd²R_|“5Ht|5õ„¾ˆtä¼ÅP¢ÚMÓ -7´âªi7Y_6µìTŸ¢ü ;à‘ó¢Ïʪãr:q>` ó#E6]™oéVÌÞ.gJs¾s aà´ãV¦Ñ2%Éï‹c£T‘rã(EçF Ef<Ô®gÜøbÙ§¡^Xä§nýxM<7DÈyµ” -N÷^„fŒdG`ÅܾÎúì.ëNX!¶ÒbáG„äi6ôb€ØdZò"’Òµ(Å÷VŠó]âU`G¶í‹–­qB[)àÑëÀïf#àcd -4ÑA€°©1tèzvv¬Á®4ÉN:g¢ZK4€«œ¸“Uˆ¶bxT¶ð.i@v›;wÙÔ«  =WC‹é¶È=º/Ü%·µ/ÛUˆ -šñ“Ì9HµèµÅׇ-@j‚ ˆŠMðå³iâfÛÞ,Ÿ3Í‹kdâ^è¡—ÍéèH%G§+Þ¥Á•ÒçÏñ)^\s'îv/\åÅ*C¢ªçeì¸SV\MÈ,ÒõŒh#MH5\?0RÝßµ@ ^PêÜ Am6x€¢U ¯ØÎËAÑ–=†€Ð‡&Ñ™Nbç7܆wÝ°V&]Ÿ¶×V\q²Á0ÒóÜ’É°…³¹;^1@Ñ &’yúbã´ç¦'¥ëo?ÜpÇÈXEÎèªÝÉ‹œ)9‹Ñ%AhœVÖ²ˆÛÛ*[JßÞ t—»Þ×ÖÆ%Ïoí£™{cô..FÉïø#k%vïú–”r]=òH.éFC‰D¶.$Ê# çñìŽDJÐĸ¤žÈ@”؆¢6¶Ww€@ -»É>|ç,¶}lúÂ8V’©õ!£Ô ¬eWÖ6xè]6â|EiØeo!ÉÆ°&QX¿„)ˆÉp/sšNîú xlP\õÃÍÙмþ¡ê(pö‰KXgèö5øÿw ò²Ÿ› È2m2Bˊ̺‡ÆTQÌG9j_boÅ_,1ÊÊ];Ëñ’·bkmÏ,¯H8Ðg¤M•ÛÁ\9;$Ò`¾›üÐó >hÀè\6„þdn‡G+9æ#`2¾S"¿1u/ -á«óì€aLü+’ÃÞ¸óà ëÖàõ©n†&Æ«÷ms ËË¥Û>Ð`!0°±3ÛIzìõ!/£¬š›t3ÅÈÓÔÀ*'yÆ =jИzZÑ+Ö\Ñmoøƒlª]œÕV^ŠTÚbÍaè¹x-ÃÄ‹H·¢°e‡ÔyI罨º„½·2H´Ì$¼{šJ› Í—j±fo´jHÍM:6žê+×ú> E ?›¸©2N´«²m~6ˆ‰Ý VBùÓÄR‹4rÌw•çz g–?ü0_„AHÙãž›dßØxQQ AÃù± -›yýBú–Ë¢ë.ùã3.êGnaÎúHB£¯ª›2X^D6ndaH»+H=!½ÛCZwY÷¦I+`B®“Ç»GÃÜÕ‹e}uƒ>î¹FÎ/›ÝÕ¶h¶Uq™/¯À–õ_ µ›v-ÇÙƒ?)&êV²ò?ù§ÆM× U˜?Á“õB‹æ|¡Sií¦©:*t&Rè”U£¬T3Ñá!”’õQ¹dwO‰0|¯š¹bLÄIÜú¨à@Cík2 -ª†v玧7‰Ÿ9ÞHs>!Q¦¢ñf#dR®d–ì*!CÐ4Àq:!à²4`<†o¦Næ ì}j®*SC‚Ī@Ï€ôÓÙ|ˆÎFÎU/">+H.Ú= ‡Ý­q’ŽlSô¨Æcý'×?Át«Ì_{Žt‚+¬ƒ¹“„‚å HûèPX«3ËóççׯÎB1³¬™”ë°,ÝŒ‚ÉJÚbEu>Ì-ù=ÍÆ‚YéYÆ®z&7´‹øT£×CnQ›AÜwÂ-ŸS›s’_+7 ‡‘ƒè! i›ª£ˆ£3@zêžu†Ó‡¡xŠs 6àE‰ÅùaÒÍ ­Ø%³Ý‚¤MEE*h¾‡‡0È¥™CÖeíq -;ÇHóðõNœ!’XŠ“1qÖñHÆ?Ÿ-Éáðk¶_b“LˆUclt¯‘fÓÀuèD¦P)Å+ ꈙSð=©6³a$‰õx’ÃH0ÀlZ²ô$-Œ:8núg±hÌ‹„,\®Ìã¶cÁÒ°$5 ‹ ogçÚ.ö‚,SEì@{®ïë)m |7ñh>Uo¶æOÀ²Ô› —JH@ïšMq–§ rÃé÷ŽïãiœÿOBD<-‡w½­T›)ª?Ë ÈÝó£ÿÁqþ -2X5k².áí,c~šºzú…໳æŸgÌ!c÷p¯[ŸOm=ý8ìÑæR²9®ñ!-êMkÕ°°{Ï…þÇ(!60Í°C-`xLc;óhe²Ât¬g #Æ„ÆòÄ“ –Øž1σºWìÙ"Wã-Õ8[¦(¾e !Á»{Úä!»,Ëïï7ïnßÀ¢?â)÷„£fSʱoÞeIà5Óáó~ìl‡^@L„žB˜ÆOtäü- !vö÷X¾Àk(5Q'˜ôJR ûÍ+ð"W{&—¨ë‰lCZLñ‹ø¡E1µDèj¸YaÇ|QZgN•(‰úèÌüðMïÝDª@æÂ%=_ùE¿ê‚ÉÙRÆM‡!‰œßìWs¯÷øãÛjÜAO/›¡” ”/$“$ÿ7ZÍ &5€Ññ'ùéÄÊ$“`ŒPPé|±"š‹t›øu?De2 ùÙœ“2]_:o³¡¤ý@Š—G·‡ôÄ𽚠V˾CvŒ1œ®Aô¢Õ3Úa.в–%Ñßòø¿Öœ÷\•ç#˜Â6œÏvbÔqM°Ê®‰PDã›wh ¥-Sªe‰“Ãçj‰|çÅŽÊXWÓÌ^À]Y%³fKáf¡&"É.ñ>8+½ä‡ôñeÔÁ~hçQ–æ˜'¦ñLaÊ*àÁ’Ìø\Y}>æR1Xb3òÝq!ýIŠÈé[ixè/Í”™Äæï8â“Ä’‘‰xè R±/@…§ï28­v 'Ê¥Gö,ûnBû·¸7?3()•$ äSeEI´6%´ö&¨-I"‘TI°AŽÓéA^Qtä•°‡Ò¢Hó&Þ2`Ø*¶â`–nÌž<8«3öM)u#µÏ{»´ÙŒ¹gk¥ÂYm>¤ìNî±’×qX ³¼×îÞ§‰ë©c¨Pg¡â×O/ÿ3å{h%‡À Î¹»b æ5ñôÄ%"Oð‘sEW«É<þ±Lÿ¯¿“J#:qÓäLe$„3þÀ Õ}<}ò0¬íÔËÿ©@ÈEendstream +xÚ½]Û¸ñ}…q/•³VÔ‡%Їl’¦{m6iv)pw´,ÛBdÑ•äl÷ßw¾(Ѷ¼@qhdE‡Ãáp¾­füS³,ñƒ(Ÿ¥ÙÒO"5+ö7Ál +n”`,eáàÜ=ÝÜþ%YÎTàçA>{Ú tòÀOòåìiý«÷ö¯o>?½ÿ2_DQäæ|‘¦™÷8WÞ›wo{·¼úñ¿¡÷õþáݧy˜y_yááýÓWœúò7Ü}¡)ãÜ?|`è‡_îß½ŸÿþôóÍû§qçj*ŠíÝüú{0[þ ü(ÏfÏ0|•ç³ýMœD~G2¯ooþ1ÐâµxÆ»¦¤d1QàgYüº$“Ä_Æé ÉX9’Tòã šY$åoJϯ§‚¥Ÿ%ÙÌ!vq Å¹8Q%î‰*ô#žœøîê'~¥ +†5 |kæ xþ»fX1So¨¦*JÆ^aÚ󸆡&œoB«ì` ¼²Á×ì+]3÷´r~ç(Zúyžºw~ýM#?L§_tai½.›(€Ä‰hzd÷åWO=¹g…ö¨ ¦º­u],Œ” #')<íp{’XB0jK†©‰$¿.[žP!ZÚÚd¡V)“¥g6ø½m[êžWw–¿úÀk»²-Á%A\ð"ní^X&úߌfIõÿ-§——=èvÔdf´»""?~âç)g˜‚š(Ú#§J¹¸ˆ+BñÏüy&%Óª÷;Óõ2Y‘ª:/ ظŒ<€Ïu_Œ,)ÅnÜ´Œwbÿ'Î ’ ¬«=!è~0–ñRšÄ)—ÒÍšã’€½ŠíñòN¬‡@emyÝàǺ·ô?x r.»|ÕAÓ»rƒgÔgØ*ï‡ð +@U7eÛñ2Ù9Àz«õk4™ìÀ6€DMwƒ/YËþ#¿ ,®™ÐŠüß%Ñ_îÿÉ£î¥ã·Ú –a8žIç E×åÞñþ–œÐÚ +'|«Å„u1N¬@]¡7_D¿ç±±ltP°TèºFO¥ hŽ´ß†ž(jô«õ‹l2ÌgkêÚ><Ê#sä‘'ÞmÙ·;ûÊÊóéxCááGD …‹Û†ÃßsÕHaçÃ&‰Š|ye$Ž;nÁÎ1>œq%ñ‰³Ü_ËW3‡b_«±ÅK'§‹—Ñ$!± EÙÅàEç9È¡Ø5UA‘{¹ô>}G/z…â.Ÿ˜²G…ïjbšyW&³A¤f{ù$óƒeø:ó#Îeà¶tÂÐÏâýñ#xÌÄàÕKŠâqMû *`…–ü((Vk7BÚæϾä\‡lÕ¡–ÇKÔð€ñ¼«H÷(#HÌzXW– k“-t#ô‹‚똤æ½uEnH˜ae½!çèrY5Œ$ÜË“vD‰ˆ´3Ì#Üfø´î@SA³GÐjË3»#o 1À)®¢!…§{•õvˆh-H[oX{=d'×À ýNËV-¾w@ˆ_¿à3\6oDÄR˘Çäax çA·¦åm‡–4ÝÎ¥@:vÝß‘%z´R3y1pÕ¼”xöëÏø`Ør/Âe߆ù-ê^:ž,xÃCütìƤ»£;e—>žgú¹)ê£(,‚^á-b ÜñEG£QΊhÿiJ:űmOuµ>É=½©ã„Ä•@‘/+MË1§eXÏQî› 1èZ Œ Zî­Zº< +¬˜Œ†0‡üN#=9íE9øi˜ ö‰œ’oç1:ïx\Ô•¤NxykQ§íñÄ~Ø©´zŒ-¨þ¾ºsö2’ h'âƒLJ¡qhÍjŒL¿`ÌÅëŒH|„@ °’âL®Ýv?ÊYec ²Þšè©Z‘žmà <¦?PWQ%G ü+)öz¼‚C/ ‚€(ÃA=fn(`)†´[˲Â{äHÄð‰Î)™Vö“ÇDàÊ–aHm ¶ød[¼P[ÊnTGıVƒã1µaœ‡ënòîþ^¼ªê%›ã!ôéíçÛûÏsð6bÌ(¡>ilÿ9c¢š¸Ž©¥"¸“K5N*À™áÓ«EBµXN.E@E´\á:½´îyÂi’¬ u ç•1Bc;!î Üþ‘Þáqo>ãüÍ»Gνâ(µúŒP-Ó¶eaó!´L†ŽV%O”Ú—†ˆ|` +ã°y&|ç ɈÞsií}øô$ ë_i†ÈžõÎìÙ +óGšÐ†‚ßÞ÷Ýu÷Ožd}4îõ3W'z½‹‡Î 1SŽ†‘"as$7?²u!\З)³ý:”Ãr0&™¢í¬ÙQšOh6BE³iLž¾CŒÐ+ÊF^é’€æ)ÝžÚéY p²ÎöìªíÎ&ß°"w4ûýpðÚKÆ”¹šJ™‡ú$ÊO[ƒêG‘¤¨¨;'Ú„uåh»T]|xàL8óHD¨Äë5Y7Ý’1†’8I±»)t!­7·ìëM_òœ÷m÷cq„63Ʀ©›’–žYQ†ãÄ{àšNî‹T½ž%Üaú!T—a¼ô3¥þPOÍÒZ8Ä.Só†I¢†§šjPœIS­Ýky)¸9JêñÀ„;²Bvƒ•Kã0Ä^J XkIj6sWL&6¹ƒ!+›¶½‰Œô„Êq&~¢B×oL÷lgìZ‰ªÔÏó×K4g(ÑÔ4‰Så¨<ðã–]w6­ˆû õiAêG…öMÆ‹ŽÍŠ¡7N׫g[Ëb_dpª²:ö4¤#©|QhRž 5+Ò„S’†w˜v=æGa¥ž¾Å•8œŒa˜R–1Ú¬™Ó0…±“ˆv§«\QC®ÄnÍ#Œ½Y9S#‰ÐPÚ!§ûBmǀꇳ, Ò*6¡©´Ê–8a·g°Téë\RÇ´S,¯ñ%ŽS?‡¸b#[ã„qüMѦG‘mÁ8¢ƒÙµ%~Ì?ïžÇ!øÏÇÿ¡Ÿ~^©ŸgWºIú¡˜á8¬Î9N¢ÌO²h‚åÿðg°endstream endobj -4484 0 obj << +4576 0 obj << /Type /Page -/Contents 4485 0 R -/Resources 4483 0 R +/Contents 4577 0 R +/Resources 4575 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4482 0 R -/Annots [ 4488 0 R 4490 0 R ] ->> endobj -4488 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [362.773 616.958 512.306 629.86] -/Subtype /Link -/A << /S /GoTo /D (passdb) >> +/Parent 4556 0 R >> endobj -4490 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [234.557 293.576 421.201 306.478] -/Subtype /Link -/A << /S /GoTo /D (samba-pdc) >> ->> endobj -4486 0 obj << -/D [4484 0 R /XYZ 85.039 786.531 null] +4578 0 obj << +/D [4576 0 R /XYZ 85.039 786.531 null] >> endobj -666 0 obj << -/D [4484 0 R /XYZ 85.039 766.606 null] +558 0 obj << +/D [4576 0 R /XYZ 85.039 489.606 null] >> endobj -4487 0 obj << -/D [4484 0 R /XYZ 85.039 746.481 null] +4579 0 obj << +/D [4576 0 R /XYZ 85.039 447.259 null] >> endobj -670 0 obj << -/D [4484 0 R /XYZ 85.039 358.542 null] +562 0 obj << +/D [4576 0 R /XYZ 85.039 217.996 null] >> endobj -4489 0 obj << -/D [4484 0 R /XYZ 85.039 335.826 null] +4580 0 obj << +/D [4576 0 R /XYZ 85.039 181.129 null] >> endobj -4483 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F35 2880 0 R >> +4575 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4493 0 obj << -/Length 1448 +4583 0 obj << +/Length 3004 /Filter /FlateDecode >> stream -xÚ­WÛnÛ8}÷WèQ*…7Ý -ôÁ±nŠ6ÍÖ.vndI±•È¢V’뺋ý÷!%ß"§M»0‚PœápfÈ3sH ?j®Cxhø縜ñj@ŒH^h«a·*öÎålpqå ƒ'$¡1»ÛÙ ‰ã†ž1K>™£ß†·³ÉË望”:–íû9´X`ŽFï?ÞÌP"Ìë›+œzÿáEApsvýþFËÆ(9aÎP0¼´lЙ‚âdj}ž½Lf;?"¡œ£—>}&F½‡‡±1qh«p¹ã -Þ~çƒéà÷--†^Õ—”Næ¡2÷éÄyžão—8FG)s8e†ïºŽ'|•9H–p Há„5W„æäk´*s˜J!1žo¾__áÈ3'ESaV2ÖZz'-NÍJDú_ òh5¦ÑjÇr]4爑1ïéˆö:*"êöEÄAÛå*¢Ù'¸–cÒb¾¹É -.´ CßI¨Ü…Ï ž¼¬0¬¢UiƒFiÖ,qä›Mg8+â|]g²ÐóòNOïä¥eÖ²V¹úŠW-Æ!f·j´–œC¾]ó^gÄÒB—#µ´~‰i»¸âGû ˜*à¤x –˜k®³äÕbÖ {¡'äúU™Ê2O_$ñ«2²â^ª±¬h2mS¼\¡2T4·Q]od•´?„ -¸Q£ñ…žï…˜\ )wùÕÈï±Qn’wëº-£b‘¶f¾8\¹¾U¶ŠªíëJ®Ëëq»‚2B{tóÕ‰ƒ®ËB§—“ñ$džc~)¸{éRAÄdrhÃíü{ÕÍ4mº­üü2Ñ·¡\Èb–­ºHHŽœß§q3ÊÁ³V«~|ùOÖÀIµºú¼zT²øAÞÝlÞŸFVÇÍU-:>}üÓ²…£ÏgÂúÓ­vµs–†„xý‡>ŠŠ£3'úî¡Õöæóöîú`VDjžKȦ+2 - Äq­‡Q¡ÿ·¾+4›j«§îd¥€RmÃ7msf`n+ØRh‹V¸5œ›*^ªøÇ -rm)û¸Új&ÚL©­ÖÙW[åÅn£=8š^3Цþ½#üç-ðÓƒ¿ßÿ8ªš´ú9üÿÈmO² mo¢Öë´ŠòDGj÷ÿ¹Ï©îL–xFçù3 ~æÖuZäàŸ¸Ú–Í¿—å;–Þ¾AþŸ.ñ£üºÊÍz5O«VpÚwxqñ¬3“‹¬˜.Ó¯F}¹ÌBéf‡¹;k¬Éº5—ëù:Æ›Q=q¶¸ò!+*^ñ€+f-²¥œ†i÷8¤á©“q )çë®N•sœ8Õ[Ó‘ã%À +å™’ÚŒ6D^¼Ø©ø&c‰Üypð·ß1ÇÊùe¾àNú‰ëlƒâÛ3å)Åv>,ÙäÙ°Mèpü#ɼùz Ê]‡BFßv<¯Æ‰åÓhÇìÏî¦C#©fŽTXÜÄ&à\ ‡Œî´ÃÕB9ë¦&îZs!H<šË´Ãý®!E9Â)Â$vsÄ]†Õm™Óê-N¦îeòÞJÂÖdÝ¢“R¦Ü¬.™°ÌH(댛µŒ‡‹ê“áÎ…Þ¡¾<±š°T„s l6‚mÆšíA» ´vßaQq\]ýé©p‡xÓä2 †J.À,¹ÖÂ…‹ò(ÔÖA_ûŽ; SÊ쪂E… ý¶-Ùr󼧴¶è1qU S›¬,aêÓ„F÷­è;#´±™ln-QÐFŒå½†Þ¬,‘¨­ +ÛOM»O;‰0q+ˆa,60XZÛ~0fI#¥þzû€U|îíøšŽ±Ìebì9¾çyXSÃL ˜Jwˆ${‡Då;„]Pb„Kö*±ßH$Vc‰À*çbû\pˆkÙ6ãâPü}~¹•›ÕžâJ˜ö|§µ«=°°™LRÙr}tƒÐÊ«‡‚À§b§UuLGwÄ3¡Pr5âƒB/p^Ó¡e‘›‹@ÑE9Yò9÷È~: ü†½Ê!¯¶$NX¤Û#T†ÈâÍBrd9ÏE—L•OŦ©Ûú^FŸKˆ#iS{“Qkd°,º‚­=X®eœ/Qžbõ°À¢®È—&É„8/Y€h¬8€àâ:E-ñ‰ƒZÖ»†ÞK”Ssi:ÐðI”%Ó÷&`šÚ¡cÌas=òmõ!—0K:Y#ËÕ÷®9€»(Û‡]ËO5ˆ±­¹¶'G$.zÖ~L.ú’I5BJG§Ç¦É;F“ž­>Fl+ÉÒ°«“mkp5A.Ä¢ã%‹6áÂ!Ò&å“0’Vv2ºÄ´´yRå;×”,x YP~²0ISkŒ÷·73Ç* ²rž'"ÞHéd99Xê¼íLîÛ>+_1éHÄiDͳèÓ) ¥*:j±€ 1i•ahœÜˆ¼Óò»Âê#r®KV"›[B:þ¶9 *CI4ð*aLÎiezà4•7¨H·)Aš1"›õN˪äÎljgh2‘ÝN8™NÀU»*¾û†2CHé{£(^iàÆbI£12çÃñµöœÛ¦^—öÈÀZAÑÖeßä5_àͬù=ÞFc^Dñ2ŒH‡¬Þh=Z«ú0$µ}b jóÔ¶zÕñ” +ñ°!é¬xľ–÷¾/EÃiZEÎõ²Þ¹ç`Ž“1²,eÀu)Kæå‘kÖi`£kð± fN9 ÙŒÌu™¦,æAHq'[s"Dˆ~ÇÄrôVP2 3p,}i6\\Ü›6EË„ÚìˆW&ò +#í¼&¼ Bƶ‹Pg˜Éþ*ãìšFLœékɨc~wÀÊ¢•N‘³T‡Ý×.ïÚ‘uµ5Ñ­8´9Ý2™£5÷Ž§0N=Ÿxs«83­\Ö[ÛÜŸzZ1RØ/림“<¸%ŒI ¸à˜‹{)ç6!åMQ–¯:ëÄ“!á;‚øCôJ‚qu¤@Ú¸'h*%fh;RPŽ~Ìû£k¾qìsþ„r[˜üÐ>Ea„’ÌŠ- +ãêC¨Fv}ªÇÕýþx؉ùCèCìé±{|™+¥œãû®+s©XMeU?dÀfÃ=§V¹Ù^„BÇœÄúÌâ0(Ç +_¿e‹Æ2ìÙ )’¶…q‡äE2y•bFr®”vŒpÖHÛ²ƒƒ¤;£ì&##]Zˆ(N^0÷YÃJrªo’-6gÞìê#Ý+œÏDþŸ›c›+Èƈ&‘e+CFqYvdr2÷ĵmmÕZûÓ·H“ö!K»’$+™N¹8ƒµÌÍ6±ô€ØÚ ×’¨7`è +È-‚¨¯˜J¹³ ;ZrÏ´$º6@­/gŒàœt8LT qè\ßÂü·?scSWÓ ÇŽ<ؾC‡ã›n™b| ÖÍ b½’ži)7Œ%›â®ç‹¦Ø@ŸsÆØÇÍ(¯ž8ò`þUð0‘Pä±8.È`^h%9·èiqâ$óÕÉ©•’¾¶ÄÚ¹+ªmý(ÁHà|Û—cEN|Ìš¹†íeÌŸžöXøÖnÏÔ%éãa=×ôâ  wmpv&Ÿh@Îuê0¯y´GŽ½²1´ˆÀŠ[α)炨D–™Çºz:Ôýˆ1”SþËÄ|$½Fö§3Úš÷ï«Žy}Ö‘·˜ª$šßPkîgÜ€ +¾ŒÜbÇ[‘öø[˜Òꦑ åÏ÷‘¸:ö¥U6Dïhz7á½2a—%Øæ—’&ð±¼ðÅg¿Ç–iô¬õ;Ònñu +Ÿçmö…"™ý¸@L¨+€û,‘ýI2켡Xa3äò?É+Íÿó¢DhøB©Ý0˜Lpá?Ÿæ‡¾²ir⦉?‰jßw}e™á,ÙαùÎòìÂendstream endobj -4492 0 obj << +4582 0 obj << /Type /Page -/Contents 4493 0 R -/Resources 4491 0 R +/Contents 4583 0 R +/Resources 4581 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4482 0 R ->> endobj -4494 0 obj << -/D [4492 0 R /XYZ 85.039 786.531 null] +/Parent 4556 0 R >> endobj -674 0 obj << -/D [4492 0 R /XYZ 85.039 766.606 null] ->> endobj -4495 0 obj << -/D [4492 0 R /XYZ 85.039 746.481 null] +4584 0 obj << +/D [4582 0 R /XYZ 85.039 786.531 null] >> endobj -678 0 obj << -/D [4492 0 R /XYZ 85.039 141.755 null] +566 0 obj << +/D [4582 0 R /XYZ 85.039 419.173 null] >> endobj -4496 0 obj << -/D [4492 0 R /XYZ 85.039 119.039 null] +4585 0 obj << +/D [4582 0 R /XYZ 85.039 386.752 null] >> endobj -4491 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +4581 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4499 0 obj << -/Length 3455 -/Filter /FlateDecode ->> -stream -xÚ­kÛ6òûþ -p@e ÖJ$õ*î>äò¸KÑ&iw‹¶HóA¶µ¶Yr$¹Ûý÷7/J´-;A[,Qäh83œ7Îø giä:›%iìG:œ­v7Ál+ÿ½ b! æ?÷7·¯b3 ? ²ÙýÀ' ü(‹g÷ë÷Þóÿ={wÿòÇùBkí…¡?_$Iê=›«Ô{þüíOoîqÅx¯ß¼Â©·?~?a5ÕÞýë·oxí®ÀœñîqáÙæ €¹À—wó÷ßÞ¼¼èt8 µF*?ݼÿÌÖÀÑ·7¯³töãÀ³l¶»1‘ö#£å½º¹»ùaÀÅkfÆ_M ÅèÐOT4[èÀOS3 ±ŸF)H.ŠüØ$ƒäTàH. •¯C5³@(º§¹½™íNÙ UâÇð¥ƒó|c9Û8ŒÜuì«äx㟷sÙ¸ž/T¦½~[àÀx‡Ž¦[~[áÁló 7B'ÍoKìó®ÃùGlÚ5~ g(ï°ˆÄÙ¼/½ÛWÚ¥K…p’*V¢º¨±%ÄC~=+öµ2²^í®`Šߤ¡@æõzäþ)¨fä' Þµ$£Oö—Q›Ì7‘%â· 4E…Ì“xü³ãITJ¸¯ëÕtE¯ˆ„Ùœ«“ñ ˜ËÕýæl¿ui€°ÝýÞ¢‚TOììÁOŸz¬ýX'_rè1ŽR稦TÈW¡ú’s' Òyù4à›ë'ÁWNp‹¦qœî¢•'ñå]dýh—cÙ›ã]F¹§Çr§ ²i Nõ;ö¯ïxzIZÙ VK d:U^E¦Þ[,ì*ÎŽ¢ý犖çcá“VÈÊ—DVsèGª@0³…Çš°q‰ÌúÁ+6+kEÄ”4ë~[²A™Øx òÑ—MÍ %Mk<ÍäHÊïó(öò²Bž—ÈÂÀÊž%Þ´=¹o8E×U øNÕ ü83³8Mà\ÃÏG0ͪ;¿×ÂA6¡6‰ö³8vDê^þBÑøŒ:D>Èúo¡ÎâºN -2 숺_ÎÈ -aÑüMd ®ÏEÎ%:"ëû·pê/^¿úõŒ¼€ gú[È\Ÿ!/ò}DÞ;Ì žÝaÞôó Ÿ­,4°ž*`V—2d ç^%ú‡¦ÝålLèÂW¹ Øvò¡A¥''KhŠ%&í -D D ©cÍþÚ@üèx> ½pÀÏY>ʼn¬t;´ò¥ĬÐ,â挌Í(,—šïka>CdŒ9"a—×äR9Aò/ä«1|˜%ÉÕÌÛ"LègèÇC ÷‹9À?FQà}ÿt÷Ãw—ö×™ŸB¶uuÿf‰ØýÁ.¢ˆSÿ—âûÉãf^×ð³yèÙÁâÔ®ÎmxeUñêŠVq.¯bÃóø *DšÈù±i‹¼ça]<ò \9ƇHy¨ø}Ó–¦æŸÖ¶>:_±Öb#/àÉ¢‹ÕîÃ"?;ˆ—ÆK<ðªÞÇ!:à®k^–0…ˆ,ã4~À§B{Ù±®," -kM'FB¡4gªx¦×ò¤YÊ^y;îUÖÃ^.߬8ƒY™ˆ[Ež„²®/  ˆ’ŸkÚ–yâq›÷B)|ÞíG”«ãöŠd«ºÀ9’.L„ÂØîâŘc}Ç 4›£žx¢lÍ3ÞK{´ÁÄY¯šý²,O¢Ô[R>i<ûö@Ù¾®g -“ŠäV7=ÏæÝû½à"^` O¸^ÙDX(†£ˆÂÍ*Bâ fQÐeß[^#á¬ï+!e]ô˜ÌÐfd$۹ʼ§)n7™#‹ -jò~˦µ[¶ӻ¼Ý”u^ñÛÒªª´TЇEPð§¨ÿ‡ê#ÏZ–õ†¡Ëº•°q¥G²›ºã/º-©_µfÐmQíy4à\ÛL¶RÚ]YÛ±|7xøà0pÜ -ªf‚Ór·¯,’H - çs8sðÖâj÷Ô‰º^ŠQ‘R~š˜«1¹\E™L|¤°5ŒxÏÙ‹³*¸ãD$Sý’/ó®¸D#d‹`á×ia.Ç1“PÓ)¢ñWì:Á‘.8“b >x -Ü åC8èle„€TpÁ󉪨ƒÀ²Õ¼ÔsÑóÜl@÷…Ÿ¾¯ì>O aËÛþ½à!æìC:mø)%ßòTX’Lf,“%µ¸²s±Qñꊕr³'«ØŸ*æÿ· -XÓ…×%ËcÁ +h0¤VæHíÅ6\a®ÊƒQ^Z’?´Ã®æå:ß±_€ Cž²_\÷¢”ø5@3˜-ú„üPõ²ž£Ã« -ô.A -±iÜŠMr¢=‘Ä`‘tŠ?r°Þ¢»Ý¯—·»§îSÅÿK¢n0½>ìö½ •øaj#«†ÃJ^ŠÏÔ¶›§3%b¡rœCsÏóŸƒ[*çC ’¿•$†+4Ô¢” 㶠ï˶X3:Tó  rDï'+`Øʧñí$œ¢Ή÷À¿™fpTÃü| èI‡‹&yxêò¾…¼ªwÞ÷CóŽÞ µ™p±ÖÿŒþ‹·û¼ßÞöÍm—ï–ùíÅã´§6á¼L¦¤Ò«Î˹ì`uõG O¬²¶©Q-7è’/;M‘N¡øN¯_80—Ý©N? øl$wƒP´¯PQ6¥ŠUN åD¤fguÞ6œ45ä ¤È¼–Hq½Êýf,U)qaTNi¬sÇMe¦ã - ¤—š–kaÒ>Ë£«ÏÖD—âHkF£ êM`ðTNtÓ’âÒo±Ӈ.åöqYakmîbµ¥¸!ah,À‡4áƒð6ÇØ.{·[úà1¦ÚבŸ†Ö«LÙßBex’Ò]H&C?©GYæ«D2¾ü›ïŒ¢ ÐP‚îƒc´ß@áV÷åC‰Av -ôœD° ?Ö±`u +H<»µèÊ…ÂgË Cúnàà†ÊÇ`¾d³C\á†R@3Š•×+)0@Ý Ôxru«@Û™²ççš)~ÓÙœö+Y[A¾YJ°AJKªtõX¯-&Ô¯\·6”?­Ìiç˜ú¤“Š3¨l(XÔ Ü^f¨>¯WC`p÷:gi,û©Ó¾ÑÑ_Ê:ÕÂÁ5щ!tjØp2é:;ò^ ñâËqኩÎR!á%N^âTdήƒ.ä_¡§ YŠ3?Mã¿Öã\ ÙÔµ §Ì°ã%QpñÌnC ¦-‹nè’{³·z|ÈìšNüÒàwGi¢ Txº¡Ö)Ö® Ô\"ÄZ UsÕ3–ÇGÆŒúízs¢ëb"¡abz⡱bæЀ5­ÖÀïžl…ë7:½lúÉ+›’ óš_É4Úæ°Ù2ìôE!ÞdÆIø>6ƒÐž9W„•JdHª{¿ßT „êOt’Â1oç—X‰äS©1_ sQF—øSZ9Q–Ù—ÐÐG á‘@Ÿê®Ð´UægŽ'ꨵ™øq”‡žœÕü<‡Yˆy5…ÒóüÅ~‚ŸÐ)õLgŸ€•,4xÙΘ˜y£‰Û×;5{ѹ³#ŠïÂAÌÖ–ºÖÅ~f’Y©Q¢9Þ‘Û\Ù²"Ó{QÎ…9êW+ÏüvrÏ}\š£¾%MÚ÷®çoŠµÌ××î°UúaxA5Ó£è.®5‘ŠR¿$ \·©Ž: ð*=ºph‡ro²8êAžê<–ú/ŠFöiâ›ôØ£³Àu†å8u9a„ûÈwÀË]nóP2Nž¼Ú°Y,ÏK³Y;´|2cáÅ”íÐfÃYJa7Œ$·íM˜§†ùy¥rt9ƒrùcØ \hǹGSŸ9 -“ ßÌfŽMþy G'fÉl1ü†æÏ;cwéK?hQ-ºS†dñ&ß ¿OI”´$AB9ö†¿*A_Ž“ýbã¶*àõ5bþʹ -ƵÍš¬6ä¼)ièí‡ìPS©1v5íGBòXªõÅpKpK‡=x R]}Ž‹¥ËK×0ª(¬€y¤†Âxä†q( ÇøhRoOrC—0´ØTtCC”Ï7Ü^1 èìCïf’& ¤(ð¸ Æe’FÚßœWlyFÚ8C©gë;lwoKþ5cþŒ¸8œnµ¥¶‘fã¹¥Òå†çÑ)èñè×R)÷È÷R§âÏ›¨bpð¦ÜøÃv‘ÊœîbšŽ¢Å—¼²lMã㌔o º†±=ükþ€SÚêÑ-:íáÁô⸆•bÒöj0A#Þ¤©üÐb±no{]Í£o«ùàx†â·ªx‚¯LNo“G)]ñËק:¢Ÿ&M´)àŸ¶¿Vúó¿Û/)]—O:ì}«p †š/A|Jq¤S?‚ÒåœäÿžŽº×endstream +4589 0 obj << +/Length 3738 +/Filter /FlateDecode +>> +stream +xÚ­ËrÛ8òî¯Ð-TUÄŸ§­8ÎÌx¶âdmOå03Z¢%V$QCRqåï·_Á‡¼‡l¥  ÑhôR‹þ©EûÎi–ø±V‹õá*Xlaä×+%3V2eå̹~¼z÷Kœ,TàçA¾x|¶xòÀódñ¸ùÓûðÛû/ï—+­µ3—«4ͼ‡¥òÞº~àÈ{Ç£Ÿðz_oïn>/ÃÌûúÀw¿bÿóý¿p}O]žs{÷+CýãöæãòïÇ߯>>Z£)­‘ì®þü;Xlàˆ¿_¾Î³Å ´_åùâpÅÚ#-ýýÕÃÕ,.‹¼jŽKfÆJå~Ưs2Iü$H,'CU~Ç.'ãØO¢”8 ÌK}à›Æqà]7õRÞK[ð¸\)o |H¯X7uÛr»=?ÑPÙµ—8$ëP¿Nj?‡HUñÌ¥‡ÊM¤>Iëhˆr¯ÛAOÚM¹/‹–(b@ýŒßÔ{(xOv3á«ô¯ Š=¬>í +õFc5ž¼CŒØ ÄgœZ®ÂÔ«›®ÜðЈÓ)\ãô¢Ãf}äiL nˆ›¼à¤VVÒ2Ú…ù lZ)¼òœÎMœ§ù°=H$qŸ¶… +½'øÀ6HäqÿMUÒ¸ÕHÞ#¶‘ÖÊà f©–R„o â–ÆÞŠ‘—²rgèÇNW ºžÍL1=—EwnkZI|ä¡êÈÄo€¿¥‰¦¦<âÝ1Ñxܶ¾aO˜úh ²çq™i`ê* +äªÊ;900ä6‚Ü&H€]Ñ9(NÈÃ#? ä @ÞÝ~‘9î ´ C©ªJàw’žs?´=^Nó­u‰<MÑ™iy‰?¸M¢rîÊƉ\5DnjÜáM7#-§¢¥ M]l¬@¶C»¦^'küHå°# “œÍl¦U:ç~ ¡g”®cp},¦öA–—FŠ¾#Zî!ÀÒ<ŠîD¶+äbʆ§7Œ¥X3“5œÂ=qÌêJ”gÞ bÀÆ32®áö_ÂõígL½cq`ñ¦£G^±ß³„TÇ­YÒ]ãŒÑç$í8Å¿ÄÝMcU¦•iMq4"¶§K«ÈÀ +ƒá‰ ‰ Ý,…wØÀ ™Þë¦f€•¹ÆCãgSÙÝ׃þ9—Ín¢Ù s¸ò*_y_a2qG‡œFC¡_ +é.Lç¯iß«bH.hÄ” ]Dà7_¸AŠ´^Âa¿Ñ>B$™ƒÊ]¥SnŸ¦°Æ4CÃâ±À ì@¿FЮ²ºˆGŒB8¢à°¬+ZºXø\ †‚?¯m“ybH°Ù‘ýÀ‰F‡±½)Ÿ 4xûî-Oqã‘¡`©,ìÂfŽNr£Dòs‹ÜÝ—þ…„+?L_O¸œ967'\Q$å† +³CÈT~CÊ AThUQ&7(mb!1\74¡•ó‘ЂY~B(7=áúKiæ ‚iŒl@þuáÄQªý4{½®à̹˜bF‘òÓ˜­ã“ã*ס0áÊM(ZãTÈ&&Ê^i²þvׇº•J’B'ÞÇ)’}+ß2sx§@mÀÂÆ»pp¾'>íKIßÙ<VÈ,–ìÆÉÇaâÝÊ ÈÏʻ⛵jÇëðÉ&³À”úƒ|ÀÄ6Q,é>)( JU@ìÅ +as[Ê:VXhðIEíh‰ÍnÂÄs|¾³[ë̬¤Ã~…-0{ H,¬ATŽEÇî¾Ø¶Ü’¤v'>„`ÕÚú` +  š…4R<ñŽ®k«æëâÔGÐ'ãN>o­Š#išº]¾ìJ1FH(mŽ¶gr%w¬!çèu#o ðÙ>ÔÇ¶Ú”Í š@"pãÞ» >LÎáiͤ~HÕ:Ký8!Õã¡f»àƽ£¨föÊ™>ÕÔ1N¤}ÎpR.Rl Ì°/ñƒ¤xcJ! ÷“(q)3çuúƘ>æ÷*Œ´Ÿé #¶·Fjé~±Bé˜FÍ]7² +ÉþÇfìaz¡|5»GqìsAceŸqÜØvü/sË f—{³Í}Øã_ñ§ÂÚ²/ 2$ –’×!¨85ªCôUGͦ±{ !~¢ÞlA;æÏ41ˆ$º†e•X%í‚áP°”ƒ/îS<#"õ˜ÈØbÉIh{ï[‹ÏšÀ!QÒåÜ7Äx™K_'˲¾„f)GÖØ£kª¢Ø½˜™ cÙ°}ɾΚçØØ;TÊËØòïÖšt–F$–ú†¾¬©Ï'†¢´„B'ì[·z0U¸}µ®Hh¼™©ý´ŽCQEw—ÅÞ§Ñ!uA¥ë¿JS_Jj•û™Šÿw_Sô4WÃ_\+ÙÔN¨,ð£TÙÉ0y$ºi>×, %È$‰‡™h;V ¼©YF€}]#Ûík“ɈS±Ñ.ŒQåÒÉØ‘ƒ•ìýRq–áL½ß'VyìG:œ¯Îäé\åUçà}«–‹ ©S¤K+×Ù²]:‘ýá:¾åØj’¨#¸ §¦=òã4\è ñÃ$ù©«5¸V²9úYÙ‘%7L=’™‹`!ƒ’ÃçÉ|Ö)5ŠãF\Ë°¼WúYn¥îíµxù©á¤°F<è8‹³ÑªûñÛ”[¸Hg¿ bµI”[âÂÀbX2ݨ´Á!SG·<­W¼§Êo`Nœ»6 á“âMnd”G›5U'Jñ €Ì+H-Õ3œÁ¹ìvš—¢ƒI + åy«(H µI?틵4¹ö“KøÈJFž§¦­¯HòØ”ÔÅ‹…ÆÀÀ9‡’è>®ÆÎW ›šÅ0Ï}¥³~ä?¥;×ÊA6£;AèGJÙYò^ª£I¬"f`âDF<‡ÞïÒ`Æ D*õÃ<ú¿Åàzý(Q@˜ ŽrmÒrËžc>¤H8¾Ã#¡Â“nkûq˜tûNÏ ÜÖzê æþÔaѪÇ4ãËàÒ’Àîfì]:wd|Ö`†Á<ÍŸ½ÆîÔL™˜)ýv´®Lð2e_“Ês¬¹7¸ssŸ&Œ³XçJU«†aô|ÑtÕúLuŽÌÀÙÃGÃ,Ñ}Ä<æLÄ¡ñý9…|&òóTý\Ä!¸V²™[ŸÅvC£YÏöájBO¶R˜þ}£§Á¢aWlKžQÉ ¾Û¾&‹ —Æ°g{».ø%‚`ƒ+ˆâ;êFðËù0¢†»V®¤oUº¨8%»â^ÔùÄÕ´B\Ð §÷…Ô¡è#Åл] K¤?Ë{Öд÷opQÀS›l96“J£©ë@M• Ä'êç}=Ûã¨Ýõßò¨Fój|kG†c§Ý +NB±_6ß«µM ðý„<"0E«™emŸ‚u¤·c:¶p‰{Æ‘ºõï%JrL Þ‘ q¨dI*¯y°h¢ø‘I]0(«¸p–:|‘IÐK2¨%KmôËL‘Tâ_IÞä<ž¦Ä æø.å±´ä$ˆ ¤ÚE¢²áETU +úÌaÏźãVØ‘ô Û‡q Há +Q²„Ø; ¸8hW<èÅ8ê_Œq#|KÕ”êåqÙ<2÷ +ì)Zfý ¯…t/DpIE³¡_†4æܾlkÃ÷ÒêgPpAçCi6d %îßÑõœ^ºªx¡@ǪxáqWkWF¯y¦€lâ涖°Ýˆ¡Ž†ÁûêHq¶3±TÓRªhsÙ€ßÍÌ™À_°ÈÈO AoY™À•Œ«ŠÌwm^–au{îD7zSÌ» - + ß^Úµºð#žÈ%ÚÀ¹(.=8/Anòxoñ¹Û‘ìV]щº¿áágsr¹’W~½‘ý +çüäÃÒܨGYõ‰ŸÌ ]`cÀ$è ¥ïø‡ÊànyKç©w]œ[!D°Î†p˜¤”Ò„ýÍ@šN3¦É^Ü\!kæ'pt»øcôB~˜ƒŸ˜ôZÐÃŽ£,ã_7©hú,˳å숑%UïÖ—ªpdR'zZ³LfígÈrýMOæP\ Ùq3/!ò¦Jw'1 |é–"ïM‡¼;·¦¸«¼7<ÀngŒŠÀN´?Ò±'˜¬è³TS˜Àr‡Â.õÓ8¥F¸> +¹ø[7”ߍÂ8l Å%‰ËÌCŸÆbÓìË&ü1û~ê¸ýkaæçÙ…t'C?T–~$`1&C™ž!ù¿¢"Ñendstream endobj -4498 0 obj << +4588 0 obj << /Type /Page -/Contents 4499 0 R -/Resources 4497 0 R +/Contents 4589 0 R +/Resources 4587 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4482 0 R -/Annots [ 4501 0 R ] +/Parent 4594 0 R +/Annots [ 4593 0 R ] >> endobj -4501 0 obj << +4593 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [306.528 668.246 350.4 679.935] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [226.407 384.444 329.642 396.133] +/Subtype /Link +/A << /S /GoTo /D (browsing1) >> >> endobj -4500 0 obj << -/D [4498 0 R /XYZ 85.039 786.531 null] ->> endobj -682 0 obj << -/D [4498 0 R /XYZ 85.039 653.977 null] ->> endobj -4502 0 obj << -/D [4498 0 R /XYZ 85.039 632.78 null] +4590 0 obj << +/D [4588 0 R /XYZ 85.039 786.531 null] >> endobj -686 0 obj << -/D [4498 0 R /XYZ 85.039 522.874 null] +570 0 obj << +/D [4588 0 R /XYZ 85.039 766.606 null] >> endobj -4503 0 obj << -/D [4498 0 R /XYZ 85.039 502.28 null] +4591 0 obj << +/D [4588 0 R /XYZ 85.039 746.277 null] >> endobj -690 0 obj << -/D [4498 0 R /XYZ 85.039 402.428 null] +574 0 obj << +/D [4588 0 R /XYZ 85.039 500.273 null] >> endobj -4504 0 obj << -/D [4498 0 R /XYZ 85.039 382.136 null] +4592 0 obj << +/D [4588 0 R /XYZ 85.039 466.735 null] >> endobj -4497 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im2 4150 0 R >> +4587 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4507 0 obj << -/Length 2443 +4598 0 obj << +/Length 2536 /Filter /FlateDecode >> stream -xÚÅY[Û¶~ß_ᇬ ¬XQ$u ЇmNÒ“"—¶ëHó ÛZ¯O$k£K7Û_æBêb[n>b‘g†3ß gå"€r‘¨t'‘0J.6åU°ØÁÊWÒRø–ÄÑü°ºúîu¤2i.V÷=Ÿ4&«í'ïån^½úué+¥<)ÅÒãÄ»]†‰÷òå‡ïW¸¢½7ï_ãÔ‡_ß-%¬&Ê[½ùðž×þ+0§½.Üþ°ôæ_Ý-?¯~ºzµêåi"•B)¿^}ú,¶ ÑOWPi²x‚ï@È4]”WÚ(a´²ãâêîê—ž¯éï:gGáËT¤¡¹l¸(Qõ† ƒ‘ᤠ…’á"6FD:&˱´%P`5£Sïc³‡ñÕßi¢È{,²~ªÍ¿µ8{Y“ÍÓR^…ÿÕÛ†éyÄTùaS??¶ù¶ß„;¤Û1gYT9Œ.«:ЪҜSUµQ¤êv†Ô¨Aöê°+žyr‹ -Òʦêp-ÛåìíCÎ$]cgª{žx,n@DZfÁYÐù<át6¹áù‡ -'h6Çõß髶«ÏDÝñ`“ŽŽ!Êh+§¢/AyÃj¡8I2b‘Äöô®Øò°Ø±#e[ñ/³‡þ‚I”î [»x¤3H®ø&zK{ ‹ûmÎŒö¿RàM_ ˜ôJ“ŠIl¹«$Ã[E²kÒ×+¬SÒ8; Z&ö®÷[ÇŸÄãñÔ¼~)‰eœ -Êð!åáš·“`ùúýÇ·o¯ùû·ÀOûöÝ£³Ûi”3ƒ¯ðÙUmN&bÉ$¤ØÖ²C[NŒâÀZù@Ju¬tp̓tpù$þºÓà•GN8^åíÖ‡*>£vŽÀ®÷/o—)„Ók J áË‘ŸèîUG‹(ÐBéäÏK)%âHŸ-¤|ÇË1#šÈ«)"ÙˆB£â7(£Å¥"„sÇÀpMwPi U*  T£1Èôw°¬ü¯Sù¥ás8Ð)@D×3 ,£DMtù€p~cý3·Qpšµ&©{È_Øs)PöÕ¡±ù†û8ƒ™>ï=ð™Ä©õÀfØööœŽp¬Ç]Þ—GC€¾{Æšý—·¶®CÏM¼MWZÍHf^C0ÆТ¨­œ¦– —*»®¯!¡6mú‘ªm3‡áFžÉËeúˆ¦Çp)R úóŒÒB'ÉÃ#Dpxÿ}÷vîx»ëâñÍ<ä°t’ré¼zØÛ{¦Ë­q·]1ثοvèA5¹Œ%.ÁèßœSá´´YËaöÍŠ"ßΖ+—O;‡ŸövÔP“Óu#Ô­í‘H£xaJ­ÿJ¤†ñù7›ïxù#f§–DŸ u ªð­,Ž“Ú¬mÑNÏ6$Ûšj³Ýyì=EÅ_FuUö™j É™Á&ÂÚæG›ËnFo é‚PM‚+‰E §¶þ×™ „º¡‹‹Vvþ%··Gû£œ*¿@8)†ürÙ¬HxË|OÊ°‡¼¶÷mѨȇú·/³ÆÕñˆñ¨H]7b4­;Wûªö¨pøzT¼oa_²ûÑ…µ.~ 2PB†¡5ïœùÕ_7ÿ~0ÿR’æÖ~çqCk)¤ºüäÑô°…i4ã†P¡q°elÍù²*KzssÕøª®¹ÐÌÉcÙœ‘' Ò= ÔeaA4½ˆ±bÓÄz$¬ô¤ÅØX±äµÃ3¨yùaÒ*ÛA§®vN)ŸÉ>6yÝÚ -~Þeå:³Ÿ·ïfÔ0ìH/j8¢™‡q§"ÙY¦ -¸zDÿ×Al3àÎÕ‰:ˆ($pÉ…~»Ÿª™ªc q‹d"¢÷Ä•ÈÄ,n<à‹7fîÂÌnÜT%¿ŒiþŽc6¢p†+ª'Ú3˜utrU£…ÿÿ u9—ª•Ž.§êͼ)‹PÆ7 -gÝ(ÃXíDÐZ>„BnŸc€óÛ­k˜Dá¯{n=ÕÕ¸7·Î6_]~pokz·µ”×Ô¢›‹x0%ø‹Ú4\LF" -¹R¸Å‰!ÏʹkDc.Ëþ©Ž‰­á¥éã gÖ„¢¹Mô©sâï™nkO¡.^‰ƒh( -È5q¹}@;àöÿuMËse5>,†ôÂå;ô½¬êc;TKÃEVþØÿá -nëáÕb:/Œ# ÙM¹PDÞŸAv|Ñ+G7Ê•*TGÝ­z œ§°à ‰/¶¬kØ}à¹öHfW9åBj@†ó'¦Í6¶ÏÉÁ³üF‰…ËrfǤ¤(xF…“P:V®*+¶£ž+[vÜ÷±«œ›lŠdÄœô¿,·v»îë¾ò¤QE‹¢åÒoÄöl®…L@vˆ á¨ý´+ªuV4Ÿ¹øD9QN1Ó»Ã,lBC¡H@‡ƒïù.ZÞÛƒMVÚÁ®Ë›öÔ¥ìI'/ %´Ñ¡{o…c€†½ëdĈ!¶'߇Q4ÒÚ†ã±ë;€ /ÍãñUœ¸š©ÆÂ5ûª±Z#n’ÄÜ"©£iw@ƒ%M_µ¼/²$/¸(³ÕN5Ž¡0‰ÛJµ¯­îÚ¼¶/u€Q¦^8È—hÏÖÊo¸ùFÅà¤ÕÎeµ ¯‰Ûu¶ÄÊÚ¡À…®H£«»ßãÓ_Ž?^š$Ƙ('I–åñåDÅÇïOŽqØÆoxöý%>u|}1=û0Ñy|}ÉÓó«kìøôœ|¢.Ó\Lßñè»Ïgç“?®~=:¿ª7^Mƒ°¿ýþ‡Œîà=’Âyô m)TQDË#ëŒpÖøþâèòèo5/ž³¯ê’R H´™Ö‡ÛeEæ·3{Û™ƒíd”(Qºk'å@æ)ì“e¶IöI°ÎA H¢o‘p’ÆÓæZ‰ÔZ^á ˆÌ¥E˜~s±tÑYÀ¢¶DÉTÀ{Z«Ñ®6‡4rQÀ°#­0yÙT‹\2‡¿K'Kø§öõ¤¥ÖY£…Ìl× H;¬I‹…nå>g„ñvþð´žÙäd”„æÍ[åË´Ô ¢ÿÓÜL b퀻ƒçiàµöÙçDN³®6ö x¨ø ÜåfÿfØÛ²¹ß¬a BxÆÑÍ xÕìŸåòëb¶ÚjÜkPÈ5zcÀcTš¶@›v½!¨»U¯óª:´X0êTfÝbòD&·àXlKû áàÈLg:^•ëŽÈ¸¼Ág\=mñ©âçÇ™Ÿ¹EºjKÊí|õÀóÛÇÀb>AÖ4xƒÍö¶8¼˜o¶~c\U"Á?ðߌQ;Õ6°@ʨø¦çëáØ"Œï]•µ§_þŠ¥‘u¹½9#ñ»8Í.±¼Q¹g¾ò+æ›æJ¬ÛÃ[®è!À’}ç‰êž_eû8ë(*lžšØºŠ1ÓPˆ%Ô_}C¹Ì¢õaH´˜$©)âã ÷7¾Â°âné‡;NñY*œÎ!k‚¥˜W~Úñ¼’³®Â(äg©êù$OðÎBÏU³j9ãA”%5|Ué¶\pY’Îñ#©_½WÉóãómc=ØÒ— Ë’ÊQž¦$e$ª°"ƒSVSkgղĢ‘5·¶„~³FEÜVü$Òï+ªÚx»ZW+´íÕŸú%Õ~¶n7ÙaKjÜzžS1 Ôm­‰/¶¼ÃKdæ—׎C¼&T#ºoO³õw*2=xˆ~‡k¼@4ÓË.ƒå×â"â÷N©`whO +B jU%Œ}•9VÉŽWÇiªª°©‰®!Ä Xl×5D›Åñéâò˳k.:n˜Žëýçv^nC}ô©E‚Cú){ñÉŇKžY•K¿ _n>ý†­wŸPûØÿü‘KO(§]¢NH åkOî(N¿`œ§yuÒÁ4¦ Õ3Å_z8X?Ïa'±øSA™–º¯¨ök”¡êv¹ V +T^,ýì:±°ÏºL_4•Þ´ÙÖ`YíHÐ^–õJ^à‹ÿYÓ—`œ¬íðSa–Áo!P¿ÊDöŸä°¡ã”ç•4˜u}*”"/l½#WØâHòøW6Hdí™(“wsÛö^Gp L÷ñõ…ï +ÿå]¥ÎÒ=?œÖB« Eai÷;“ÃñÝt@þ7éÍë2endstream endobj -4506 0 obj << +4597 0 obj << /Type /Page -/Contents 4507 0 R -/Resources 4505 0 R +/Contents 4598 0 R +/Resources 4596 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4482 0 R +/Parent 4594 0 R >> endobj -4508 0 obj << -/D [4506 0 R /XYZ 85.039 786.531 null] +4586 0 obj << +/Type /XObject +/Subtype /Image +/Width 582 +/Height 379 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 16215 +/Filter /FlateDecode +>> +stream +xÚí{\ŒéÿÿÊF+Q[)%YÇ°6§–œ’¢’ +9†äÜ.+9%"J¢ƒ +É–œ²»|vi}X¬ãÇçëÃZµNëµY…Bû}ÿÜ¿Ïý»S©¹çžûžy=ÿè13ÍÜs]×¼ï÷óz_×þþ ±±±#GŽTÑÁéÈë×¯Ç €¶Q§N3fÈÜÂ^.++;sæL“&M<Úõë×½¼¼ 4hйsçmÛ¶U¾ÏóçÏMMM=zÄ>¡««kaa1qâÄ»wïr[Ò¯_?îc‡Î6y`½zõ¬¬¬<ÈÞ‡ŽlfföâÅ õŽ†œ~iI<Ô©N7€ª3؈#.^¼Xe«Q.ºyó&©jÓ¦M䬒’’ãÇûúúV¾[bb"ex™§{óæM^^ÕnÖÖÖ>dÿE:¸zõ*sõ?þ yqFß¾}{øðaº÷)èySRRÔ;rú¥%ñ…-™ÉSÆ3{]Ð’™jåRB<=ÍÏÏïÛ·oEEEu‰HÁÔ4~üø˜˜˜ÞÍÝÝýÀÕ|ÅŠÓ§Ogÿµ|ùrö… ¥ÿÊ(//×ÓÓã$;;{èСê 9ýù™®¢@#gnMã§M›æïï¿yóf-™©VYJˆ¤§ô7(((55UÉ FS”|ðn4÷îÝ«îàwîÜaG‰þõèÑ£¦M›S±CeÎãÇ+×hÛ¶m7n÷ wïÞ577WïhÈé—ÈÏt9s#ìíí©Æ9uê]О™jåRB<ŒŠåŽ;)ÓSòÎïFƒ@CQÝÁ©þ¥ãpÿE¶Š‹‹Û¿?Õ€Üûs7h¦NZPPÀ„ŽÏD]£!§_â7_#€}4 ñ3·ëׯ·k׎¹Ü¦M›_ýUfªU–âé)‘’’2kÖ,ezjbbrÿþ}%Få·F£¿4ù¡€qtt<{ö¬ŒÑ˜ ¥¥¥‰‰‰½{÷æêCWWW½£!§_â?ÓU1häÌmÁ‚«W¯f.GDD,\¸P{fª2¥„¨29·k×®—.]ªuO}||¢££?x7ù«Žááá2ÿ²³³ëÖ­›Ì2;› 4`¯Òñ•Yuäe4äôKFã}м™&”ÐØ™<3q¥µa¦Z¹”UO‰cÇŽÙÛÛ׺§W¯^mÖ¬Yrr2ͨ³¹¹¹ƒ®|777·ììl™ƒ¿yóæ÷ß kÕªÕ³gÏdž÷ä{ª4ZEEEaaá²eËØc*óξFCN¿$q¦ó5hðÌ-''§òêúáǵd¦*SJˆ-ƒU¾FÁ} .¸¸¸4nÜXGG§sçÎ+W®¬|Ÿ„„™wïtªªüüü¸ë–U>cå}4}}}wwwnÝçëëKbUïhÈé—TŒÆË` hðÌÍËËkÇŽÜ[ÒÓÓ½½½5~¦Ze)¡s?aÍ;<033û믿pÚT7s+((hÖ¬Yii)÷Æ/^jÃLµr)!ÑH¨’dݺuªû,š ö-X¼Œâ`æ†þÉQZZºS^¾|‰Ñ :îÝ»WGDø¥XåååÂØ\œ?·4ÅÅŤ¯#GŽHÎhƒŽTNNNâ4ÚóçÏ…±¹"?t5âÚµk¤¯Ö­[KÎh&L8¬2Æ/f£õíÛWu6Ÿ?>Œ„§´´ô©*¡ê@„½~üø±5Ë“'ODe4wwwÕe0 MZFóòòR]ßSRR`4 <Ë–-Sé¼ÝÞÞ^„½>~ü¸5Ë?ÿùOQmÚ´iªË`Ÿ~ú©tFÓh^ÙµkŒ£umØ°a£T@“&MÄl´1cƨ¨`ñññÑ$d´ÐÐÐÙ³gGðÄÌ™3é´’ŠÑöíÛÇ+iii0P¯Ñ222T‘嬭­Ål´… ª(½3›â4Zzzz¯äääh€Ñ6lØÀ׫+!£­[·nìرKùcĈ0€Ñ`4aŒöõ×_óµ¼æâârðàAMÒF[¾|9ÁO~„Ñ€Œ¶~ýz¾Ýþýû¥b´ÄÄÄÅü±qãFñmëÖ­|¥/___ FƒÑ€Fóm^–¡F””$£Ñ ˜ÄÌé £Áh0ŒÔk4&•gÑ¢EÒ2ï§3Œ£Áh0€Ñ`4 FƒÑ€Ñ`4 FƒÑŒ£ÁhÚl´€€j'ž qøꫯ`4 Àh0Œ†MH£…‡‡ÛÚÚöå Àh0š0F£Þ®];¾ê‘æÍ›gggÃhÒ5Zttô—_~™Ìø„5‰Ñ¼½½Óù €ùXŒ† Fê#j1e¤^|@ÉmíÚµR1š““S'þpvv†Ñ`4 FXuD£Áh00Œ£Áh0€Ñ`4 FƒÑ`4£Áh0Œ£ÁhFƒÑ`4‘ßOXÓ¡ð k Àh0š0FKMM=ÄdÔh’®ÑÂÂÂè<åñí¾½{÷†ÑŒ£ c4J³íÛ·ïÂfff€Ñ°êˆ ˆÍh­Zµâe’fee-£¹ººŽà777¬:Âh0ŒP£©ÅhžžžÁüÁd  FƒÑ`4£aÕFƒÑ`4`4 FƒÑ`4£Áh0Œ£ÁhFƒÑ`4©mñâÅ‘<1kÖ¬ F0Œ£ o´¹sçöéÓÇ•'z÷î=oÞ< F0Œ¦j£Mž<¹_¿~.¶ƒOXQM;?¦mF Žâ ’Œ†}4Ôh5šHŒÆï/~<«Ž0Œ£ 5Œ£ÁhÀh0Œ£ÁhFƒÑ`4 FƒÑŒ£Áh0Œ£ FƒÑÄc4OOÏi<1|øp F0Œ£©ÅhÔ…Ý<±k×.úËŒ‰TŒ¶`Á‚ þ=z4ŒÄ`´^½zåƒ>}úÀh¢5Zxxøˆ#ÆòÄ Aƒ:$u£QV÷öö®Qǃ‚‚*¿ú«cW[¸XlÝö' ’0Zffæl^Y½z5ŒÄ`4^Ø»w/{YF3fÌRþ¿ÑrrrÖzHåšD–ššÊ^Õ¶}´Ê!¥&­›Ôù³ŽÝ; mç΋jã¬Ê¸Mr£•¹ £µÍÑÑQñ9ªƒƒCåž<£ùè汉±2Zzzúþ`FRä«Žžžž¾ +ãêêJ¦–y¡³³³;zv4Ÿbž¼9YkFÙ{îܹËÞãææFs9ªÎl]mÙITV¿üòˤš@5~å9sdƒ“ ÌÍ÷íÛ£1­Fëotgš”FsØ¿»í>:òш™#$d4¦°RŸÊ£Agq·ëâ×1W5i-..Ž†ˆŽðÝ9uêÔŽ;,†[.7\¾v¹ÖmûöíùùùÌÑÈ $2ª[§OŸÈÞGSßÂØœŠ5Ææ—/_ŽOŽ7›`æ:Í5®Ñ&Mšôã{ÂÂÂ<8vêXi­:Öt­Êû»Œp©SP§±McfNóŒ¶dÉ’sÿ… +º}Ïž=Ë¢–i󪣌Ñh@<<ºî߯7c†‡Æ---¢ˆ9Úþó¦.KNNfï£)mÅŠÌq¨@#£%''ººv`W]4ØhžžžÌuÞ¼yYYYtFwt뛫©5õ”3tûŠ‹}}û³[lR7š««ëÄšÀ-00pÕ{†Ja?{öð°°O–-ûJ –––:j”Åܹãa4 1F³±1|ô¨ÎÈ‘C4Þhl†¿yófffæûÕË æ=ÛÚ`4ªG&L0Ú·¯þ×_ÏÖ£ÕâÝ2‡’y3Ü:E*F[´hÑΚàããCF‹/|ÏéÓ§Éh“'»~½~ÿþŸ0¿Å£µmòäÉŠo'7ŽÎèv-Bó4w÷.T³h›Ñ/öß¾]ßݽ“ÙÄl´ÈÈÈQ£F)þB1býúõéééËþKDD'0ÐìØl&—´ÑT„$ŒF§íŒ²dÉ*Hã9äååQ6ðñé÷Í7ÛP£‘w$a´Ñ£G« vvÿç½Ùƒ +ÏW_}EF‹Š +]²ÄlêTgñ×h*F“¨ÑTŒ`4µ/ÙË0Œ£ÁhF“®Ñ¸Àh0Œ£ FƒÑ`4  FƒÑ”1ZVVVzz:·S[¶lá^ݹs'û-OUÞξ- +FƒÑ€ŒÆ¼½vWÙoghÙ²eÏž=a4MFKMM7ožœOÓGFFÊ|¥¡ÌæΛ––£Áh@\4tíÚUȵGµhX{âdûöíÌ7–K«Ùê-Є_{C&ªµÇçÏŸO烦M›6lØpâĉÊêÎ;ZU a툭[·’ѦL™"­f«½@ríQùJœ 'R1Þ¦Må?“EQûÇÌùÂÄÄ„âÿÉ“'ÒZ™iÛ¶íh¥qss£Š{ĈJ‡N*‘KHNN¦3zæÌ™jó«W¯”ÿy×®]?ÿüs%C-¹}û¶øíñãÇôB›šš"æ¹Ð€Ð°ÐàH¨ÍoÞ¼ù“L}ß»w¯ò‡¢’±Ä@\\Eõœ9s´­ã .¤Ž¯^½ZKúûôéSê/I1ÏÅÌÌŒ†åÑ£GZØw*Û©ïGŽAaíÚµÕbûu ˜:u*u|óæÍZÒߢ¢"êoÓ¦Mó\š7oNÃòðáC-컋‹ õýèÑ£ 1DFFRTk[ǽ¼¼¨ãû÷ï×’þ2?sܸqcÄ<sss–haß™UÇ~øa4†ððpŠêeË–i[Çû÷ïOÿ駟´¤¿¥¥¥ÔßF!æ¹XXXаܿ_ ûîääD}ÿñÇ@c ¡¨^µj•¶u¼S§NÔñÿûßZÒßׯ_S?úè#Ä<—-ZаüñÇZØwGGGêûñãÇ@c + +¢¨^»v­¶uœYnÒžÉù›7o¨¿:::ˆyaÀ€ZµL´9sæPToØ°AÛ:NÕ +uüåË—ZÒߊŠ +êoݺuó\,--iXîÝ»§…}gÞOœ80ìY³(ª“’’´ª×%%%Z¸©T¯^=êõ»wïö,VVV4&wïÞÕ¾÷íÛ—ú~òäI„Ðüýý)ªSSSµª×”Á¨×4?ת^ëêêR¯Õû{vb£eË–4&B~•xppp ¾Ÿ:u +a4___ŠêŒŒ ­êõ¿þõ/êõgŸ}¦U½ÖÓÓ£^¿zõ +aÏbmmMc"‰o}áÞ½{SßOŸ>0ÃèÑ£)ªwïÞ­U½>vìõÚÑÑQ«z­¯¯O½.))Aس´jÕŠÆäÖ­[ZØ÷/¾ø‚ú~ǣИgeeiU¯÷ìÙC½Vã¯o«ê5¾‚‹ Éï¿ÿ®…}ïÕ«õý—_~AÁÝÝ¢úðáÃZÕkæû™g̘¡U½nÚ´)õº¨¨a£={ö¤¾Ÿ;wa4gggŠêüãZÕë•+WjáwS¯Ÿ>}Š°giݺ5I~~¾ö½{÷îÔ÷ . €Æ Ÿ² ¤^ÇÄÄhU¯¥øË)ªæÓO?¥1ÉËËÓ¾ÛÙÙQß/]º„0ƒv¾ßiÒ¤IÔë´´4­êµ6+ou´iÓ†ÆäæÍ›ZØ÷Ï?ÿœú~ùòe„И•‡óçÏkU¯‡ F½>tèVõZ›¿£:Ú¶mKcòÛo¿iaß?ûì3êû•+WQ­•©¶}¶T›?{UíÚµ£1¹qã†ö½K—.ZõeÝ@S‰ŠŠš?>³Ÿ’™™­mï8pà@dd¤¶ýr±6¿ ¢:Ú·oOcò믿jaß™ŸŸ d³R¤C‡É~~~ó6Á¼{Ê”) +–fÍšií¹`ddD}oÒ¤ ý½~ý:#´Ñ€FR7ÚÂ… cÚ‰‰ Œ4Àhˆa²@  @  @  @  b€lb€lb€lb0Ð AÈ1 DÈ“'OƌӤI}}}ww÷7 +c4ùÇ)++;sæ µ +/²ˆa   /***))ÉÍÍ2dˆŒÆ~= ^ dÃ@Atuu_½zõAã°Wé±cÇìííõôô† F*doÏÈÈèÔ©ÐÖÖöܹsÌíïÞ½[ºt©©©)ÝßÃã°°+,ùÚ‚Ñ @ ÅéÙ³gXXØÙ³g_¾|© Ñ"##>|øúõëØØXööÀÀÀ¼¼¼²²²ÄÄÄ.]º0·¯Zµ*""âÏ?ÿ¤pÎœ9“&MRÜV0²ˆa 8·oß5j”ŽŽÎ Aƒ®]»öA£±7>þÜÄĤòí¥¥¥õë×g.[[[3—©@322‚Ñ @ ÕQQQqóæͶ¶RÄhô(ò üûÓ¸ ŒuëÖ…Ñ @ Uóúõk===ær½zõÊÊÊäíÅ‹-Z´o4ºÃãÇ«´Õ»wï`4dÀ/œsssKKKIO›7oöôôdnïܹsRRRyyy~~~PP×hçÏŸóæ ù.++ËÏÏO¾ÑÂÂÂâââ + éP/^>|8s»¥¥åÞ½{åK FC61 '&&¦ÿþ 6400?~<ûÞÅsçÎuêÔIGG‡^Üôôtî*"IJ9##£ÐÐзoßÊ7Ý!--ÍÚÚºAƒ...ûöícnÏÉÉiÕªU‚ìΚÌÃy3$@61 @61 @6ˆa²ˆa²ˆa²ˆa²@  @  @  €âêêÚôôô(†mmm•?ÔÕ«Wñº£PS>úè£:"ãÛo¿ÅëŒ@íŒfccÓUÔ­[F+6X´ÊmÞ¼yÛDóCZ0X±Á¢ €Ñš±bƒE £¥¦¦Âh `Š ¤Ã[·nµ³³KKKC£Áh@Ò1û¬]»v–––666;vüüóÏ©.ëß¿¿‹‹‹‡‡‡•••Ìzeê50šd´””:à¡C‡ªü¯‘‘Q•3[$ ®ÎÈÈHOOg~j¶uëÖ={ö$ :ÔÉɉ×£G.]ºPжlÙÒÌ̬Aƒ2F£gwssÛ´iS­˜=ÔÇ>>¾¾¾½ëÖ­c=<==™7~8::Òxð ]=qâDŸ>}š6mzîܹ*ï?iÒ¤­[·âóh@Õ«ŽÌïApáhæÌ™Üw-Rˆ^¼xñòåËÌ'(éF +fe\ÆË;C®^½J…dii)]ž?þš5k^¾|IW¹{ä夤¤òòòüüü   öá–––{÷îeHXXišÒÝ“z:|øp H.&§OŸNÖ¸råÊ­[·ž>}Êõ¦‚Ù@Æe 4wÍÉÉ9räÕb”Øœpÿþ}}}ýñãÇ_ºtéèÑ££F¢;SȪøΠ^£ÉÔkÕ½3„ÙG£ãåÓ+J mÊ”)Wÿ¾2:ï:uêDOD¾NOOgNlժ͖™í‰·oߦ¥¥Y[[7hÐÀÅÅeß¾}ŠØªòûÓ€–M½1Yyû FÙ`óæÍTH*þ6ÅÐÐPj­¿¿?•“̺¨››[­¿xF¼õZuwزe =<;;[]F¨4P-Ù®];®¹ììì’““ããã×­[·zõêåË—‡„„PJ +ÖÕÕõóó£ÊŽnÿŸÿùªã€ØŒ&ÿ'èáµûí0RÉ\¯UÞG£<™™ù¯ýKÎÇQ‘€ø¶cÇzøÎ;Àh|6`¼&ç!FFF#FŒ`Þ‚„$g´={öÐÃ322ÀhI6¯òöÓ§O[XX¸¹¹>| HÑh ‡W÷q0Ú“ Nž¸yó&^`4 ¨…œœ +<’†©M${؆êâû￧À:t(†© Û@ËùñÇ)𜜜0H^ö 汈m E~úé' +à`(:t „pýúu "§N¢vppÀP`4 i~ùå +à^½za(04/^¤îÖ­†£Ióïÿ›¸K—. +Œ$͵k×(€;v숡Àh@ÒüöÛoÀmÛ¶Uõѳ`´€ÑP·nÝ¢nÕªUMøäÉ“1cÆ4iÒD__ßÝÝ}ãÆÂMÎq233ûô飧§ghhèíí}ïÞ=¼¾Àh@{ ´OliiYÓ80<<¼¨¨¨¤¤$77wÈ!j7ý+44´  €Zfoo× h>¤633«éuuu_½zõAã°Wé±cÇÈ2TC 6Œ¤ÃÞž‘‘Ñ©S': ­­í¹sç˜Ûß½{·téRSSSº¿‡‡Gaa!sg.2O=gÎöòË—/é€x}€Ñ€öðôéS +`ccãš>°gÏžT={–Ü¡ Ñ"##I ¯_¿Žõ÷÷go ÌËË+++KLLdßu¹jÕªˆˆˆ?ÿü“j@RÕ¤I“>X£ýõ×_ìåo¿ý¶{÷îx}¡Ñ°«T)ƒ¢ËÐа¦¼}ûö¨Q£ ttt tíÚµ½ñùóç&&&•o/--­_¿>sÙÚÚº¸¸˜¹Lš‘‘‘âçÂ?ü`aañóÏ?ãõ@£‰pW}ß¾}>>>ÔÊQ^^^üñ^\m€* Š +zÝk÷ðŠŠŠ›7o†„„°µ•"F£G‘åߟù}%–ºuë*x.$$$PxàÀ¼¸c4îª;::=z´ä=k×®íׯ^\màõë×}ô‘’ÑÓÓc.׫W¯¬¬L¾Ñ^¼xÑ¢E ùF£;<~ü¸Ê~÷î]u-Ù³gÏ7ð² ¤ÑD¸«Î¥¼¼¼Aƒxqµ·oßR0†jú@gggšŒ•––’ž6oÞìééÉÜÞ¹s礤$ +¡üüü   n Ÿ?þÍ›7们¬,???ù1G¡K‡ºxñâðáÙÛ---÷îÝ[¥Ô¦OŸ>iÒ¤+W®ÜºuëéÓ§\±Tg4îªs¡œÐ¿¼¸ZéL~áS%111$ 6400?~<;Ë¢iM±tttèÔHOOç®"’iŠeddJ&•ót‡´´4kkkš\¹¸¸ìÛ·¹=''§U«VÔfvgûXŧm¾Œ&Ú]ufÂþÒ,/®–@Ê W @™÷:ŠpW ÉvTTÔ·ö€Æ ¯¯OAå<†MÉwï‹gWååË—ØGÓš4iBÁõ­Fᮺ““5éÕ«WÏž=KNNF¦=Qä<}úCŒV £‰pWýرccÇŽ¥§066ž2e +óöH  ˜™™Qä¡^,Z´èÙ³g8•ŒÄ@Æ éu,--EËCWWW¾«¤M›6Ô‹›7oâ$0š–#’]õW¯^)ÿýóhyxñâ…2¿b#>ýôSêH^^NgÍ@ËwÕ™}áÉ“'c‹\º»ê< f4oÞ\rgŸt[~÷î]j¹¥¥¥Ô  uä÷߇ 4©H@º»êÿùϨ ;v”ÜÙ'Ý–_¹r…ZÎ~£©tÁg4 ìªcW]ê»ê'Ož¤f888Hîì“nËsss©åð£EÖÖÖÔ‘Û·oÃvÕ…»êZ®{ðZ£x-‡Ñà FÓT£aW»êµÎjÜU‡Ðr àœBË5# Ðr àœBËa4DbFƒÑpN!ˆÓhŸþù(>øâ‹/¢££…Œé¶ÜÚÚº´lÙ’yéÕÃqqq–––Êw„BwÁ‚0Œ†–ÃhJmÀ€‹øÀÛÛ;66VÈHnËèÑ`4´Ù«Žh9b 2ÑrdDZ£œSh9Œ†H@ ÃhÚ`4ìªcW½ÖÙ@»êðZ£Ê‘‰]u쪣FƒÃ0VqN!ÀhˆaÄ0Œ£¡åÈ|ÍÅÅe L˜0aÆ BF‚t[Þ¹sgW>°³³`Í_N ÇÇÇóµr¾páB FCËa4%fkkëÂ]»vŠŠ2¤Ûrggç>7nÜúõëQ£x-‡Ñ h9ŒpN¡å0"1 £Áh8§ `4Ä0bF§Ñ°«Ž]õZg5îªÃ h9Œ*G&vÕ±«Ž ^€Ñ`4¬:âœB6€ÑÈa FCË‘ `4é¶ÜÑÑq)Œ9R€oì‘ÃqqqVVVø}4 ÙF‰ÑZµjÅ×÷d®ZµJÈHnË»víêÅôr¯]»5€Ðr ‘€–ÃhçZ£!Ã0Œ†s +ÙFC #†a4 -Ç®:~ -‡Ñ€ê"»êØUG/Àh0j4œSÈ0b1 £Áhh9²Œ†–«=†322\]]Ç*ÍðáÃãããa4 -‡Ñ”4š‡‡ÇX>pwwß²e‹‘ Ý–ûûûóÒò1cÆSÔÃH¨ {öì©À3¿šÉ^†Ñ`4´FSÆhô7Ma¶mÛVe–¯\Î^,¤ÛòÐÐÐ +³hÑ¢ÊÍÎÊÊrç–““#@ËåÇð°aÃBÃÏÏ/,,L¦#îÓÜõ·ëõ +£Áhh9Œ¦¼Ñ 0Wa¾øâ‹Ê è;®o“ M¦-™&°¤Ûòáǧ( ••[ÞªW«ú—ê»LpQ»ÑáõëדÑ6mÚ´ì=¤õ³gÏ.Z¹Èâ+‹ù+æÃh0Z£ ¼ÆÜyÕªU+ÿËöíÛ‡Ïn²Ôd~Ä|½ U-Ÿ>}:#²ó–-[‚W[Œ°HÚ”$9£Q˜ƒÜ¾}û›o¾9üþg•°ê£¡åØU¯õ®º’Ù•f×åïÉÊÊŠ‹‹“IJbö‚t[ΊààÁƒLË׬Y-LËUj´%Kf.^l< FƒÑ°«Ž]õZg5îªó›]ÃÂæúø4OL\/9/H·åS§:¯Zeµ@íF4hP€bУÈh³gÏfVS©^&£ÍŸ?.&ÆpùrM Fî:vՕɼìª{ÏõVÆh4'‰U˜!C†0+`çßCÙµ_¿¶?ý¤ûÕW>G‚t[îàà0MaºwïN:tè†÷L:õ½Ñ\""Ôo´C‡eÔ„ììì]»v±WéL¤ƒlØ°«Ž"1_{Óó¢æItW]ø–óµ«î5ËKvÕ¿´X°r2F£©ò2…¡ÒC¾ûî»oÿ UŽT5øù~n#Ý–ÓSïR˜Ý»wÓC¸·Gè–èèhµ¯:òŒ&¡}´j÷¦—˜„¬ ‘䮺DZŽ]u9ãÉ;‚EZ£µgW쪫}»êðZ£UdWìª ßrfW}éÒÙš±«>oÞh -‡Ñ€ò‘É×Þ´ŸŸ»DwÕ…o9/»ê+W…†ªÙhjÜU‡Ðr TŽLìªcW]ŠÙ^@ËyŒámÛ¶-_þÿÞöœššºråJöjJJÊš5kØ«7nd~ʼn!>>žù™B ‹N:Á2ê2Î)´\3Œ¶~ýz™m;9W©Úe?ûÀ¤,îg嬭­»té"X$H·å!!!2ù—suéÒ¥ÌdŒ¦d™™™ìU+++[[[uÅðæÍ›çÏŸÏ^MJJZ¼x1{5..ŽÏ^]·n3CfˆŠŠâê¯yóæ:t€e`4´FSÆh2»“ò¯úúúR…Î^ d>eÏN³Û¶m+X$ åªn9Œ£Á h9Œ/Àh0Œ/Àh0Z£ -Ç®:¼€–Ãh@™ÈÄ®:vÕ¥• à´F8§Ðr ‘€†Ñ`4œSÈ0b1 £Áhh9²Œ†–#†"-G6@$ å0À9…–Ãhˆ´FƒÑpN¡å0"1 £Áh8§ `4´1 `4´Ù‘€–K7†?ùä“öíÛÃ20ZŽl£¡åÂ0sæÌ3f¨"†©_C† e`4´F‰ÑLLLZ·n-ÅHPuËé¥TQË©´ &€+**ºwï>qâDÍÞÞ>88¢ÑÐrMA£Ñ899©h<{ô衢ѓnËýüüœU×òöíÛ——— ÀTùûûs¶}ûvîOè~óÍ7¨ìÕ´´´ 6°W©Ù ìÕ””Šyn¿‚‚‚_¿~ ×Àhh9Œ¦HH +îîîªË®®®®Ó§OWÅèI´åoÞ¼a„‘#G +P ÑK°zõj®Ñx„úµ`Á‚ÈÈHOOO¸FC˱«®H™ “])‡pGLþÕ5kÖp¿³:>>~×®]ìU333ê©áÉ“'¼hm9hô:Ê´œ„Š\å¶<###++‹½jnnN-§°WõÚ#hdUmÓ¦MtÎbíFC˱«®H™“’’"“]y„Æ“zD-§ª„÷MŠ-g +4ÊÒªn9 ÎÀU·öÈhÔ2š··÷ç*`Ê”)ŒÑ¨/X{Ô£aW½º–cW—]u¦Ì »ÒS|ýõ×<®àI·åL&LË#""T·öÈhô,TÛú©Œ˜˜˜MïÁÚ£0`W»êÊäõîª3e¥ šÌ·iÓ¦£ +hР“] Wð$Úr¶@#¨ñU ôlËU´öÈhB‚µGÀ®:vÕ•É jÜUgËbÖ¬YÓU;ÍækOº-g 4"J•lܸ‘y­=²š`íQ€ »êØU—è®:[æ /+xm9·@Þ×ÕR aíQ˜ »êØU—â®:·Ì%ç9Òm9·@~ghj)аö(L†]uìªKqW]-e/+xm¹º +4Þ×i2foo®>–-[ÖµkW¬=ª¨@î:vÕ%·«®Æ2GÉ<é¶\¿kÏŸ?Ÿ.™$Z aW»ê’ÛU÷¤õ ]qq±D[^RRrBäåå!{ٛƮ:vÕ±«À®:vÕ5fW§0@íevÕ±«Î 8‹ ØUÇ®:hÒݛƮ:vÕ¤N:uf̘!s s!33³OŸ>zzz†††ÞÞÞ÷îÝûàÑž?nöº€±rä¯_¿îååE÷oРAçηmÛ&‰–×y®®®……ÅĉïÞ½‹À(“FŒqñâÅÊÙ‰.„††………ÙÛÛðh›6mš6mš¿¿ÿæÍ›%ç&»Ö«WÏÊÊêàÁƒù›7ošššÒàÓD¢¤¤äøñã¾¾¾’h9óÀ7oÞäååÅÆÆZ[[?|øg% ÖÙ)??¿oß¾2ÙiÎœ9ìÝ^¾|Ié2Ø™3gN:¥ˆþÄ™]ß¾}Ëüjž„F~üøñ111RŒö +V¬ÀWÜ”ÉNô7(((55U&Éüõ×_ìݾýöÛîÝ»Ë?Ôõë×ÛµkÇ\nӦͯ¿þ*ÑìZ^^N•„FÞÌÌLÈŸã±å2F»sçŽs €fíùóç;v¤Z¦r’!~øáÊ3?ÿü³üC-X°`õêÕÌ刈ˆ… J1»R¶mÛ¶qãÆIhäuttÞ¼y#Ř‘y`YYõg¥³AukøûöíóññÑ××700ðòòúã?>x4쪫käE²«^Ó–ó²«Î>{JJʬY³*'™„„ÿÈ?‰€šqÿþ}æ*5†®ÒÒÊ®,S§N-(( åÊ}ZVV&ç84íÙ±c÷–ôôtooo‰fWê¬"ç,/-Wr䉫W¯6kÖ,99™fe¤ãÜÜ\e~TQÈ–³³²ßÿ=,,¬U«VÏž=ƒYÔh´¿«YÃçB¯oÿþý?¸ð%ª]õZgWµïª×täų«^Ó–ó²«.sî{e¨î ”Q)—ro|ñâ…¡¡¡`Fã+»Ò¹PXX¸lÙ2ÁZ^ë‘g¹pá‚‹‹KãÆutt:wî¼råJI´œ¹µÙÜÜÜÏÏOȵSPÝ++g Ÿ®Ö­[—þÒ9%ÿPbÛU¯]vÏ®ºâ#/¶]uÅ[Ž]uUdWB__ßÝÝ]‘Ï5 ‘gSukøe­¨¨¨!C†È9ŽhwÕk”]Eµ«®àÈÿ-¾]uÅ[®–]õ:Õ€l€‘GÌhŒÑª\Ãgyùò¥üU;Ñîª×"»ŠaW]ñ‘ÿ[d»ê5j9vÕ‘]PÑŠ‡Ì¾““Snnî«W¯ž={–œœ,ßâÜU¯uvUï®zFþo1íª×´åØU¨(;ýýÿ¯áS²;v¬žžž±±ñ”)S + «;ˆ8wÕk—]Å°«®øȳˆdW½¦-Ç®:¨.»bW´Ç XÃÇÈ#f€Ô‰9r¤ÀOJϸ~ýz >@vðÅóçÏMMM=zD—·oß>fÌîeÞg5zôhº7{°É¤º/,zòä ³I“&Ì‚ÏÆ™ÛéÍÌÌ^¼x—/$&&Nœ8‘¹\PPТE ö_ùùù$;î÷´˜››³ŸåáÎ~å|aÑÀÃÃËŠŠJJJrss¹›ø¾¾¾)))x ðÕMÜïÉìÑ£G^^s900*2òs•ÔÖ­[·ÊÎú[îéêê¾zõªÊ§ÎÎÎ:t(^¼`aaÁ}ëWXXØÖ­[ÿ~ÿ1ŸvíÚ•••Íœ9“QÕS!!!Õíïj¾°¨gÏžt̳gÏÒežúîÝ»Tôá%À zzzåååìUR³¹eËæëû¶¿‡.Œ3æäÉ“rŒVåݾ}{Ô¨Q:::ƒ ºvíû(z^ü€íÝ»wÌÒ¢]~~>](,,0`]hß¾=÷KS+íïê¿°¨¢¢âæÍ›TâuéÒ…½‘ +Àþ9  2«ŽÄرcwíÚEõ{ -;;ÛËË‹{·*&ÿ ‹^¿~Íý-z^¬:à 777²÷–ŒŒ ccã½{÷²·¬[·ÎÌÌLæ}‰UíïJ_Xäì윛›[ZZúâÅ‹Í›7{zz²÷Ä;CðHBBûî}†'Ož¿¸K‘ùùùd¨;wîp&óy4î¸_XÓ¿ÿ† Œ?žÙecðõõMNNÆK€Š‹‹ÙOX ɃÈ›ýõ^|±nÝ:á¿ËÛÛß‚šÊÿ2ÔÍendstream +endobj +4599 0 obj << +/D [4597 0 R /XYZ 85.039 786.531 null] >> endobj -694 0 obj << -/D [4506 0 R /XYZ 85.039 766.606 null] +4595 0 obj << +/D [4597 0 R /XYZ 85.039 763.817 null] >> endobj -4509 0 obj << -/D [4506 0 R /XYZ 85.039 746.481 null] +4600 0 obj << +/D [4597 0 R /XYZ 85.039 763.817 null] >> endobj -698 0 obj << -/D [4506 0 R /XYZ 85.039 649.314 null] +4601 0 obj << +/D [4597 0 R /XYZ 271.155 445.624 null] >> endobj -4510 0 obj << -/D [4506 0 R /XYZ 85.039 629.326 null] +4602 0 obj << +/D [4597 0 R /XYZ 85.039 313.054 null] >> endobj -702 0 obj << -/D [4506 0 R /XYZ 85.039 546.315 null] +4603 0 obj << +/D [4597 0 R /XYZ 282.773 319.028 null] >> endobj -4427 0 obj << -/D [4506 0 R /XYZ 85.039 527.443 null] +4596 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F38 2997 0 R >> +/XObject << /Im5 4586 0 R >> +/ProcSet [ /PDF /Text /ImageC ] >> endobj -706 0 obj << -/D [4506 0 R /XYZ 85.039 441.136 null] +4606 0 obj << +/Length 4813 +/Filter /FlateDecode +>> +stream +xÚå[wÛ¸Çßý)ô(÷T,qá­oÎ¥Ûm»Ùvãž}hû ÇJ¬[ÚJrÓôÓwÀ€ D åx¶'mÏž¬x‡?Àø“V³þS³¶*JÓÍš¶.*£fï.ÊÙØóÍ… +%¡È")óâúâW¿©ê™*‹®ìf×,ª®ž]ßþeþò·W¼~ýÃåÂ3‡’—‹¦iço/Õüê»W¸ÙÎå÷~÷õüÇoß¼úþR·óßúo^_ÿˆëßÿð{¿áÅnÕ—ùöÍ7~ë7þöÕëË¿]ÿîâõuO.MƒØ¿øËßÊÙ-\âï.ÊÂtíì,—…êºÙÃ…­LQYÖï/Þ^ü)ÚòûìÌ5æ¥Ê´EÕšS7©jÄMUUÔ¶qnúöp¹°ªšîV¿´¿\¨ùç 8êÝ¥næw°°ÛnÖðó/ܳÚc±zþi}¸ó¬ƒ‰tËg¿|»]£…¾ìÒo|³:¼]íþÅV»×ü}„BÚ—z·¼¿‡jª»r~gÂ3¯ÃÙ«û{ZÄí+¿üjû°\îï–ûÃj‡Õ.Y(ôXç.ñÅn‹§úä. J,tUÎ[øµ¿ÚÕæÖ¯á¥à/øp‹/¿_aÁœÚóû5Wf³|p«{_=uð‹ÑþäIå ü6óíã¡ðWñ½wöÂ]–ƒ —ˆË·áñLKgæ@qãêæèâ ÜÎñ¼[­{Öýˆc¢'Ënþ,.°~…@›-VÎæ;Ü_!TY‡×fËvþà"äc<‰ÛÕø€€_g.‘+q ÷´¶÷¦–þgŸ:‚î_ËÃz»ñÖv«¿?ÆÖ"îsÕälN8:7mßS$>Œøá'¼Ž6½¬kçWï±.©®±©‡ªÃÐÇU@v‡ÞA Áhõ¼{¿s‰Õ€ÝÌ­»˜°BNÇå›Ý0>Âæ{ !_û°Å•[@ÁíGoü~M¸¸ÿ×¹Þ§„îDק½OÓ5¡÷1G½9é}ÐYE×鱎G =n ýNQ5uZâø7vUZuEmš6ô¢ªÚØUÕ:骨Âzº¾ì /¹¹-Å´®c×xíG]U¶îà|x؉st«‹¦1³à”2”9¡œçØÒiwãëgÿˆMu³:øÊsõÏåÃO÷},ècJ[š¢k«1ÊZ£mag G”š+Y¶²3SV?sLê›PÎŒ;¨3~)”Z‰Ã{]Ãn3 Ô³º† ë*çä·7èÍ#—)ƒm«f½±/#[,™²КÖ?$Ÿ.Cƒ†(퇦AUh«EhÉK‹U5v@û‡õþÄB¦®DÀ*¥ +=Ð"æ.ϹJ(âl)“oØrSÌj ¡Lé-Ž>7‚*}½a‰ðã0U£ T7à|s +—lÛXh²L¡›ñXS‹ÄÖUÛ NJõ2ýÞêßó–¶0Xµí„·tÕm#ã.²ÅûK׺P•p]ý2Ü‚œòAlÂ?¾`k‚¯¿ÕÃú|‘å3N(nd‹çƒþ¥¨ôÐ/ó|p÷c°Ï–à ¶&ø +ŽÜ÷*×6E§eª—lMàA¨Îø^ßiZ‰¦z|d‹ç³Z­6Û«¿–Uù øŸÊƒÖ\¼L=“­ к+ô°•LcâÙj+‚I¶xÌJÁØ5ÃærhÕ@_fd@ƒ­ ÐÓGáW4›µH (?CÚ"–)› +z“ŠÏ[LWŒg-:›µôf%²³]§”§Ñ†‰†Kú]™ç¦,hiMg,­î¢Ù|EÂO}¾ÂùI›¦¨UËúIWʾŸÈç' ã"ºÊöºµÐ„”Y°Ä’µxOcÓÌ’UÃÉZ2²Ä‘äªÔg/ód¶-L+B,±dPãu€qY UIT&YbÁ ÂµN+ót¼?A´º)LiɇhMéÓ >ÞÎ@l &ÏtvX¼¦.lcÒ ›Æ« R]æþl@²Ä!VÖU:m¯Î@„D¬‰C²Ä"BBWâð5"Â`Êg CÄ é¾® DC¿Ñ6|¢Ñ½z41Ù¤7,‘ƒp˜ªÅZ8ߘ±,Dã“ŒPê¹yÚZ$ÆÆ3‘ +ª=åz•ÍE$üÕç"œ¿L7aGõzê/S7…*k‘-Þ_êÑ4Ý€+æ$§|ŒÅ˜QIð[<Ÿ-uÑàÓš„ïE–ÏB]ØFÆdk‚ÏØ¢±í€ïežŸ·• _°5ÁW×E‹Ok¸ö;^‰ö }ë§!Ý;ƒ¬©ç¢ï•ËªèlÍÎüÃ}±{’çzå8&ýŒ> +!–~C«íç3OfCq^÷áhÊÓM|oËGWd»[–‡u2yîÊ,Vn’¬ 9YÈ»ÊÎÏ¢]aAœå5•?SÀÊO~v½I +<Ò|©»Ür¿õÅ>FltJd +ŒîüœKr³°x NÊ~ôGÄ1 Ù?Üa™? ‹…;Õ­?bÎgü +»Ã µ_ý´F¡+ïðW~ó’¶â¼v2_í§l‚aXyx^¬º€ç.14ãÇ^»0(lüIg¿ÇøŸOtí8¤[¶›ûÏaß*Îx?#ï¦>)Ì2 ÃÊp]UâcÊ6+×N¤Ñµó½Sb¸%‡Ò  +‹®q¢üu;=Ÿ¨½?žÄ¾°ó©;üÝ#^Ânuë÷¼ÇúÄ…‘[9ì‹Ê’j çsƒ{[‹ÄØØcpØÙªxFÿÃ]NªCÁõpEï¨þwá²ß»Æê/)ŠP`û}8`yï÷=àË Dõ› +ºmãê +Œ®h1ÁH$Ãj…šV>ä´ëtF1Û€YUâ“£öyy˜7µHl¤apk¬”‰'¤ÛUxØ\ +—ÖÏ=¦^!‘‹o˜GZ¿ù~½?„Ôÿ*j<Ú+G¼³±Í…6þ„:äÀ?ŠÔ$ œ!Ýî<ªÆž;wŒKÉïS|î¬ëfàÓ+^tÐM¹ˆÁ›k­ÛAÄ|p]©©ËØÅa [ª ÒÂ]•– í{·NÄGxˆë‡`*Ñ€Íî´†®¥aþèÝXu™#aUCˆTÚ̯Þ*öŒäSV¥²3Û6E£ºçåSÁÖ"16’OY¨H‘¨Ï§ÞÝ2¸$Ê·¾z Œ¿»ïÇ$ŠÝ±{vý’‚Ý6ð[?ï"ÉÖ"16Òzap°tQ!?톥ӆyÔ¬ß-'ƒ“òéOÂÌQïFú«}g+³\þ@V‹Œ4ËÖx£Ü|Ò, ]k;^šE…òÒ,óÅÒ¬ /Í:¦•f¥”_(Í29iÖåÿ 4Ëb^¡«Í²º…Ü£>C›•XxÆò‘:+…{²:K„7>caymwpðŽé³š’“º–A«áÞYáÔö×7ÓiÁ5-øƒ{Îh!ÙíLû4…VbX"9LRh¥œY…’Ph%¶ò +­”*«ÐñVß8o‘B‹÷©ª$ÜZ¬¿H¡•rM+´DøH¡Åó…VÊ7­Ð’à‹ +-–Zƒx›Th‰ð‘B‹çó +­oZ¡%‚G +-/(´R¾i…–_Th±|¤Ð4óZ" ¤ÐâABkÐJÎWhI`F…‹I +­As9_¡%J +-4(´ çô$®K[¡%[ÉÖd×íd|ž€6×BñI¶xÐÆú9‘ñøÌæÕ Ï ¯þºæï  uºæóê¶@Þñ$ abX ¯f1IC˜ræU„TJDG˜Ë+ S®¬–PÄ_1³fýeLY”ªð—üÛ”ˆ¿Èï/c§ÖM¹òšBèè¡U2|ÁÖ_Ó¹GÛƒúÌg4%ä‘ŒÿÈÏgñÑ{¥|y}¡µ0µ­ _°5ÁQPÖ¼W¬>ÎT2ÕK¶&ðš0v¦áwžR®)(ÙâAQ-×5CG¾8O/'ÓýyKuëÐ4§!kˆa—œ `’-´Æ|@[ÍêÃnU¥e@ƒ­ Pœ%8ŠOVƒH9ŒÈÐò5ç0-¶‡–Íað溴æiÄÄ°DÃa’1åÌk©”ˆ11–× ¦\Y ¢ˆ¿ú†ó½Áû‹ÞcðW|'‚õ½‘rå5ˆô6ƒ½Áó…w#R¾¼‘Þià‹ïG°|ô†DÊ—× Ò› "|ô–Ïçß“4‡É7%Dðè] /¼-1¿óß—oL° ôÎÄ Ï}kBÓ¿7ÁC†7'Áxþ»˜ñí ”ÞŸ„åùoPˆ€Ò;.)îU—eñ¸g(;‡íûÃõX÷Ñ,»¢ê¼îÃÃíðÕ3Î<Šê‹(ÿ…‚PZ‡‹¸yŒÕ¡6[ÒÍéÓãBÜôù²µN•ßfŒ¦Új\Új +ûº;ÕWcAkãrFÉ{´ÿq"à‘z}ÅLÃ`bŸ-p¦‰­±§ÐpŸ§Mú`áa½wN¦^ · [»·BßD 5öÔºN# pWxA<·~Ý ‹qC°ï?3¹¼ Åýú2È¥MéǬç÷þÿú‚«¹Z¹™Ç´ñ=øÏPÞ¹ÀX…¡%Ž »8`¸Êíå¾A¼ #ËþŽ¾Gz/¨üµTÐi6í¼N%Áñ“Q>³²` Ð( fAI<ŸÙ¼Z"áù^·úº‚3™šWÔ(hþÖ˜§©‚Ãi5‡Iªà”3¯ +¦R"ªàÄX^œreUÁ"þêkÎ_¤¨áýE* EE ë/RÔ¤\Ó_á#E Ï5ƒúœüÞ¨_TÔ°|¤¨Iù¦¿:*ÂGŠžÏ+jR¼iE)jx¼ ¨„ßùŠ Ш¨aAIQ3ˆÃs5"˜^QÃCEÍ ÏWÔH`FE JŠšAXž¯¨%E 5)訢Æä5¬QQò’¢†oK&§¨%E ê5|S29EgTÔ°œ¤¨á›“É)jD@IQÃEÍxsÊfÙÙÏWüQ eºÂjŧÙÖ6~MåLázbX"Íæ0I¸žræ…ëTJD¸žË ×S®¬p]Ä_}šÍù+¦Ù¬¿bš-à¯>ÍæüÓì„kZ¸.ÂÓl–Òì„oZ¸.ÁקÙ_L³¾iáº_L³Y¾f§Ía:Í–À‹i6‹Giv~OH³@û4›iv‡g§Ù˜!Íf!)ÍNƒñ i¶fŸfs 1ÍNÃò i¶hL³YPJ³Ч ×%Xû4›ci6Û–²ÂuИf³ !Íf›RV¸.ÁÙ§ÙgL³Ùæ”®‹€Æ4›¥4{´9eÓl‰ìGZ$¢Ý ñó ו6Eî‘h(£ð…Ûò¿A·þ6ècû¿ÕîþµS¼:KþR7uøãÕAìÅçA é>f %Ü7uW~™þð¸iªÁ÷ž½¥Ó?<ŽÛ£–û¿Yíô§^Þ|Ž©@t”pˆ;~ëŧ^ý‹JÍ1:þ=pÿ ñäûÖ»þSè7‰¾3jüÜïÎýµóûÛôÏ|ï/ÓOŸÕ*®CE‘Xp}xtòÕõv“ûÞ«©èNù4¸'î/ŸÜv¹¿€ŠC¯V]¦Êêd¤5pÕšäùïendstream +endobj +4605 0 obj << +/Type /Page +/Contents 4606 0 R +/Resources 4604 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4594 0 R >> endobj -4511 0 obj << -/D [4506 0 R /XYZ 85.039 414.522 null] +4607 0 obj << +/D [4605 0 R /XYZ 85.039 786.531 null] >> endobj -710 0 obj << -/D [4506 0 R /XYZ 85.039 414.522 null] +4608 0 obj << +/D [4605 0 R /XYZ 85.039 698.134 null] >> endobj -4512 0 obj << -/D [4506 0 R /XYZ 85.039 391.204 null] +4609 0 obj << +/D [4605 0 R /XYZ 282.773 704.107 null] >> endobj -714 0 obj << -/D [4506 0 R /XYZ 85.039 351.165 null] +4610 0 obj << +/D [4605 0 R /XYZ 85.039 459.425 null] >> endobj -4513 0 obj << -/D [4506 0 R /XYZ 85.039 327.847 null] +4611 0 obj << +/D [4605 0 R /XYZ 282.773 465.398 null] >> endobj -4505 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R >> +4612 0 obj << +/D [4605 0 R /XYZ 85.039 215.867 null] +>> endobj +4613 0 obj << +/D [4605 0 R /XYZ 282.773 221.841 null] +>> endobj +4604 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4516 0 obj << -/Length 717 +4616 0 obj << +/Length 2746 /Filter /FlateDecode >> stream -xÚ¥TMsÚ0½ûWøy&Või[餤M¦MÚàžÒ0à ÆĘIø÷Ý•„K(É¥Ã0Zí¾]½}+™‡ ~<Ì4eÒ„i–P-y8®Î ò%à{H¼‡9˃‰ -9£†™0Ÿöu £Ú$a>¹#ç_?òámK) ç4ŠÓ4#ƒHdäüüæ×uŽE.¯/Ðusû=âÍ$É/o®]ì3FÀ§HŽÁYfÀá(ºÏ¯‚aÞóÜë„K‰,Ÿ‚»{N £«€Qi²ðlF¹1a(-©VÒïÁ(øÙ×r1º¬c¢ì17Ôý¾pIB–ô ˆrj´Fá8Tr¦ZÓD¥V9ˆj -MJÐLkFŠM7A’”Ôe7oÀäd²FOB&n[úí²éò9’Œ4„Zíñ-¹ü±ïòÿ‹±ü¹Þ|Ï_ZKËÿrÅ"5d‹ãk6¸ÉH‰4^ «Õ¢Wݬ­ƒ­1RvnS,üÄ5fíâظH¡ñ‡\-Ô(|´lOÁm™mÀk[û’uièµu®è,–TÏ`eË—c´«ßŒ«]‰Ë(Ö˜Âв´=¬…£@_-æp/´U¡\bû]»u/ Yºu—Ž÷{Q-w‡À¨•RdûÙG´5Œ6vòV[”Mn,u{ ðÉ-3 ¿j½¶±¢¦–š¥¨Œå˜Ï+,Ãqë=°Ë—bì%CH³ŠœJ0ÔuÕyP3Å©yG»#ñƦ귮Ÿ‚’L±™Ö÷éƺ^;Õ9 ]@}ŒDÖO¤'ÔU ŠxŠ.¸öó²-m·ñ‘v+/Ë?7nþn2^(ºdﾧð6Ó&õ¾ 0”;Ü«w!Õ"õ¸Ã«zx#v×@Õ²¤o¼UxaÊ}ÙŸ*ü]“ÿõÕë¼Ê¨ÉÄñ÷®… ‚÷dìçŠe‡ŒµÌ¨ÎäÊö[t¹endstream +xÚ¥YKsÛF¾ëW°rY°j‰˜Ák/[–í8Ê–¥Ä’˵•ÍaH‚$V¡`Tú÷Û¯€Ї-—  §gz¦çë'ÃYÿÂYûÊgi–ø± +g«ú&˜maäÓM( aYŒxnŸn~ü)NfaàçA>{Ú¸uòÀódö´þÝ{ÿó»_Ÿ>~™/”RpÎišyóÐ{÷ùö’µ÷#~~Ägä}»»ÿð02ïÛ#Ü|ú†ß_þÅ„Û/ôÉ:Z¨nûÏ›ßÿfk8â/7¯òlö +ïæù¬¾Ñ±òc­ä»ºy¼ùÍ­ÅczƳ.i)V™gê\Ma|AMqì':%5Ýmø EÙßÛæjê‹ù"ô„ô%ägc¿#ÖàMYuüÕÃ×®FšªjPW¯å~Ëó^˪’•æ Y­PŠkÿ1¥Á(öᲯbñœŸ9Ï|•*» +9ôO%…AâgqvM”e¹*+ #_…ÑXؽ©I ¡(lø¹jj¤¾ÀÁ}ÑÚÑ=? ³šG©·Ã¯§†^¹Ö ‘,xý®`þroV+ÃÌK`®dp_ôt¸bÓ>óÔMk¶u±Ç¾ãUájpOZÂ#µòjS2'>i¡·F‚j!B3§³n,:LÇϪ±÷n!*áo:} ‹Ñ ‚îïÌÀ4âéJŠOâ 2>íNÊínå´c&(íÚ>Cl-{)»¾ó'0–dÚÏáâ®lÄ3‰2˃ڈ&avMšÃÙUqhcyïèŠú /V¥‰×7øŒs{§´UÏ4;ÖïìHWð,ºjCæi¡U.«Â.u +_¤¾ÚK%ÂÆÐ^m{Ë Õr±0¾Œƒæ—v"Ênd‹|±Å¼µEÝ 0þ“rÏ›çÖâäXø~l@º¼ –2Ashq:£èKóÍò +¤´ö£$¾©gRƒVÓº"m€Ô5qR#y´‚Ãï |ÉÉóàÓêßO\ ’Jy:çÞËôÿ¡²³äš´Ž–ƒ üÈo]ÑòÍr +=À‘Nb¯”՜â¥÷øñÆÎ{áâÆ:CÚxÃOçè~çØêX*o€®ùg|–½*‰b¦âïÎx hCØkÄ/p¼ñø¡#³B§¨µ×pkÀ¹(ibƒG0½øWš€ mcÐùÓ†M×óÀ=qõ·wL s%«,˜Ð²(]@Ù ƒ?>)ßñ“ Ø^Ž8ñÖ¦ÌQ¥.+#¾gÃp6fz‰êëù;çám8ò%2·‘1~|¸ɳ×ßN™X &’×Sƒa>‚Qí+Œò¡8ÉýH³:À 2ÈÞû¦®ç”U’zÛ¶™«Àk»©íÈ2W·3ðL¦g¾Á5mç³ÙcpC\±÷ç¡èð&;þ¤ë¡Ò׳uƒHÂ]ë@|-ì-‘La_21º­ipc¶eˉÜèVAKIœ3~ ºØû/ùײäÓ~6²z´ 97ÀrqjÜ,Ú´å–ƒZQ0 èXóâð,÷«¦mÇ1Ù î´5Ê9´‘[’vF¬ ™p¶3#ŠuÖŒYÅDc™ø&b:æ™…½˜–,pupæÃñ„N[gèµó«hñ8p‡~Žrštú*ƒÜ!fÀpM÷3ú•ñ½2tòö*I<ÐZL­Ã¼ž9vÃË£©—†_ï!²›ø" °öp‰•YÙ .;èw¥-(( K+Ž˜ˆ é±b@Mjåg*!uæR²äN©M§Pÿ\÷ #žI#Ô På‘HYù¹ýÌÛ×6Kà”H/ŒkŠƒ‹/è£ÐØ‚„h(ÑiKB9ç%6ù‚ñQ‚Á|;ƒYWÎôt–{_÷k‹õV6†«µµ‘ÕÉã–­ ÈJ»ž–s!E–"©”ïÎl.å\ä±uhÍ¢gl#-"é5¦W׸Í$Ák†' ¢–½SÜ¡½ô%{üꇀ«  –¢¥=rÀ#qäxP¼½Cî =ò*‚F]I]Uð€Ù¯ùee°°BwÎ Ùg,Éç·VV=Ìèž ë%*ƒ1"b%Õïä.qdÍ)äóþ቙jó,™’ù^ÚÞH1ÄËØ ?Úf{JÂZNF3„v”à”#õSiØÈšm±0//6k‚i­-,/A@²µ( ÏÜ9‘Š*¨XïõöL?ES­‚2Ä+BøIé«Þ4w¹A¹aŽ±2q0ZáZ;[´âúTa§ùÑ\`ë©2qí¡(†å  )€Š+êQºhÞ@®!sY-ÁG[+ àÞŠW~©Jç‚ÐÆWI&aR²#x¥ ‡lÂŒRÆ¡}l³“lqKœ5#µÜ³ ²—-QoÞæ\YÓh[€ó’¤+à 1…Ìž«ª +‡À›7½ÞêÔ0¾I—#!P9Ҟߊã +á©o?O¥¿’¸>Ò&oø¸ r(H ›•Ûù O5JR¯£êÑb×|÷"ýÍ¥*VnÍnHþ¤”T#À7Gí¸ÔƲª³éš+§qeïðbwQ?ÓÞOsøÏ”•KΑ—ë—ªèe^[H°h{®¾:7‹*¶&0Ž7ænX«-õ¼%YÞ"èüôœu(<³T!‡ r©nÈ#ƒ=0ÎÊŠ?¥;zRz¶oB/‡žŒRŽˆ/@E€Db{žs\»‹GÍ…pØõv­x>ìÿØbÕàÝdG2»9K9ÂðI°Lj¤#Ö5®À³m±QcOΤáqPKÚ±ëà+œJ2£,õƒïTP#žÉ$3J"?RÉQ’I’ùùMRAîIê÷‚.ÃãÚŠ*OHwLØ TÙÒ(pQÒʹý–Ê–z@˜¤6ü¬ø2DÚ'g—$VxÁüšC»*º¦tçßí Žx&3Ê(Êü@2ÊÏ3%½JÀMª=ëÑÜâÊåæ`Ý+©±ìRqkãi®›ú×<_S•kžC]Y|Ѓì®L2]ƒž!KâqJexΡ³Æ¤Ó¡Æ;¶~ël»9å7€Kaà4.ºßJ‹ô£,ƒ¤Ž½÷Î Éí=ÛFñ¨!®F +-Üe/Í nùÖ]ÈRJ¬U;µ¡›p}’°Ÿg\b¦êšau guAS mšÄ5„–žIm„ïÅl‹)‹ ÓÀ¾SŽx&-6ÔÚONÊB%{ÇF¶-Ällaøuo¸œ$ÎÄ–d¶Í\…£ÇwÖS¡¹Ò{ÏLÎÖŸy°hɶ̉SëÈWqvýÔϤ †@‰U.¯R~¦àÈÚ2X‰Â½6¹Žóä +®•ð‰PªúòEŒH—R1õ{V¦|­¯ÿÖ9°ÐIt8îÓPÏÊ.ƒ'˜N5†¯Hs}áqÛÂ#qOä鴱ؤG ?+×/g V¢,nPõüãy[|`ßØrÃX(=ô¬˜ýqÍ@!Q–rý1ühìo˜úb +¨T24.ãã&£¬&çõuÏÂòña†?…ÃŒ’úË—¯b_ó¯Á§×ìÿ¯_ŠG­!?Ï&RA´ÝfØ$§;¶?)Ÿoù«Špendstream endobj -4515 0 obj << +4615 0 obj << /Type /Page -/Contents 4516 0 R -/Resources 4514 0 R +/Contents 4616 0 R +/Resources 4614 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4482 0 R +/Parent 4594 0 R >> endobj -4517 0 obj << -/D [4515 0 R /XYZ 85.039 786.531 null] +4617 0 obj << +/D [4615 0 R /XYZ 85.039 786.531 null] >> endobj -718 0 obj << -/D [4515 0 R /XYZ 85.039 766.606 null] +4618 0 obj << +/D [4615 0 R /XYZ 85.039 750.537 null] >> endobj -4518 0 obj << -/D [4515 0 R /XYZ 85.039 748.602 null] +4619 0 obj << +/D [4615 0 R /XYZ 85.039 709.89 null] >> endobj -4514 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +4620 0 obj << +/D [4615 0 R /XYZ 85.039 669.242 null] +>> endobj +578 0 obj << +/D [4615 0 R /XYZ 85.039 598.606 null] +>> endobj +4621 0 obj << +/D [4615 0 R /XYZ 85.039 558.442 null] +>> endobj +582 0 obj << +/D [4615 0 R /XYZ 85.039 486.859 null] +>> endobj +4622 0 obj << +/D [4615 0 R /XYZ 85.039 440.49 null] +>> endobj +586 0 obj << +/D [4615 0 R /XYZ 85.039 287.006 null] +>> endobj +4623 0 obj << +/D [4615 0 R /XYZ 85.039 252.866 null] +>> endobj +590 0 obj << +/D [4615 0 R /XYZ 85.039 170.059 null] +>> endobj +4624 0 obj << +/D [4615 0 R /XYZ 85.039 135.313 null] +>> endobj +4614 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4521 0 obj << -/Length 3326 -/Filter /FlateDecode ->> -stream -xÚÍ[[sÛ6~÷¯Ðäe©™%.¼ o®´î4i6v§™iû@K²¥n¥èxóï÷\¢HÙ“r3™ÌD$ppp|çJXŽbø'Gy"bmGYžŠDËÑt}î¡çÇ3é(&ŽdÐüpsöÝëÔŒd,llG7w5‹Ä¦£›ÙÑÅOçïn^½O´Ö‘”b<ɲ<:«<º¸øõ··7Øc¢«·¯±é×÷oÆzsÝ\ýú–û.±ÚLtƒç?Œ'@s „¯®ÇÝü|öꦖ3X‰Ô¥üûì¿âÑ VôóY,´ÍGð iíh}f-£Ýûêìúìß5/î3#Õµ)žb¢b‘)u<]f37nM§¦‹G)¬U]3%V( óäBæíßZ4iŒP™†K‘ê¤>°$ ÌSy"<±›±M£âv…»<‡ÈéÜ$îôw¯eŒNRaR óá°ïÛG¡âL 8’ÒÓIy0O›NGªªr 0¸}¨Æ$«Œö ™åUT-æÜ°/Öc•E·@W\ëó)O·›±²QÅ4ÛÛñ$I¢ÿx^ÓŠ¨V8f0ÿ3Nbhûå9ž¿ƒGh‘íå›Ì -m:—´ ‘&M4 ŠsŠ8tj„…½ÿGÄ™X¤&ëeCƒb`ÃOD·¸4¦!ÆÓõêð ­5ÓJÄ)›†Õú]±ß?nËY{ï4.•jpürñ<³#ù0¦e&lžX- -°ÙÑ/çoßœ£AJu´±ˆAŸZe:¹Å†Ï•²¨³`Š}µ-ç´XRv<K!•R:*øgŠÀ¢Ñe1­‹%ö¨¨œïÊùžZ6¤"¹ÝðÀí“9> äÿ"¯ƒz¹.V¡¬N{Ф PÝ‹öY$Žæ,Ò$£ ÀAЛƒÞllÆñzSømئz -¼ÃÀÛ¯¼|»išFèdñw×X²G„ض„†ö%Ñ¢Ø/ø pŒ$·h Ë8ÔA—€Å~qƤ‡ÈE.µa.™ ôï»ú©†³E8–‘±lLÂœ³çaÙ©ÓÓ`älÀœ[`–¹Èåi,+lfhÃv³_Š}u=¯zÁ\3ˇÒuC9xBnÞüÞCJ':ª–kêNØëC A|NøÛ"f{Ní0l¦n„´YÌ}‹ùæÖN‹(ôч!‰[ò±#k-(UBKOYlf]Ì”H•v$‡†¥ƒ™ò¼ úAãûÿW.úÁLd -ñR*t‚|oÛœƒñ›‚ŠßX «~+L.…²ÉsErÔ= -“èLH™Ö˜8Vå¼ùÓiõzUÜïû&`øåÒÕÓ¯[eùjÈ8GcŠš!%¿O /Ê=·íN%ÆÄ 2hìQ/8¤qúó÷CQz…8T”[l/Èü$¤UÈÕ¨èhÿ %/]F¹A)MATž0¡ñÏX&¸ÏÄ‚‹xwŽ†‡í;|ÀoßÂXéÙ$”¨¿„žÌF¿»0Þyž}Ð G@ûiq[¶Ìõ8TàÙ=M:„Ù!Ç’g /1±Ê¢+â¹Ü®ñ­ ÝY‘‚?ì+~Ì‘I{ûè/àôrùi»žwL?£é!¹Qà€çãø%xs7:Étt£¯k_ý‰ŽÐ@^’øÖ+D’0oPKp‰üg8/í[yØŠ%èµ8ƒhÐÀ§[Ò3ErÔ}&GhœÂõšœDe”ø“—ÙÞo77K>áN“Ó0üré“Ó¯Óä„ò]9gp+ŸÆ `fõà)Èž§emx&ØŸ™œ5¿QØY/8†XëÀþˆ­á0؈­Pêt— •§56îîN‚£á88Zòuƒ#ðë‚cˆµþÀ1”å06*3'Ña¬Zs0ðq9ýø<–À£-`'û6±¡mFšKN߸¼J%ÜÏøYTŒ±FÝôÍ>£b‘_Ÿ2Íú”É"ú:Vc¿âÆ[Ì~=u¯œH‰•7üõUgpG²­ùåŇï_tõ¸˜c9*‰Uô8AÄ_:l_y…ea±«LÃ}Hv¸Â²`ᬼŠ\iK­˜ÁWr+¦ÛÍ×(½éA -4=eMg‡4Ùz6BÛÒ[œ«ö(.«ö¡!Tjà° -"½Ì<;pÔ=FHiÐ_súƒ²FȘsbÐß»åj~Ê -,¿\¾Ú -µì´B¡„½•±}·µiëÀ ¹UüEhãÃÞQ–[O•aÐ -«Q3—cÿUëz>¶G>©e§‰êŽ/µº›,&1²˜¿4<¬VLQ -¬[ÇÚ­¶4’™9Òâv¿]¹ûE]@«6&OÉ|”‹8ÞKRoOaQ9T§êØAû¿>Ì€çþÎÙ‹Þ)IÏ187üUÔõ S4Šn|˜¡@w˜(Ì ÞÈù¾#Z9Òv ³q(±F¯ŽØÁK/ ¤ -êùé“÷h¹µÂ>q‹D©DØÔ¸ÀïÖ´éRð†Û?­Vð–lÝúGŽ1µŠ3¼vÎA=;úd„u¬‘Zç™\' §áþ®²è‹‰kË‘Bþ€!?þÖ×ZŒ¥+!üÍlγeÙÜÝÛ–Ÿ¹ÕÇÈíáh{º2^5ë{¾]ˆ_'ñ•Â‰4Ò"låpõà ©Ò,ººc:Ÿ»©ûÌ™ûúŽ†PÒ%xˆ¶¯ ׂí#jüQ­ô;VsÇÛ¡½Ó2ܹúX»B ¿‰îJ {X͸©Ù¾¥“‚!“‡É“:K}VJ¤>º<žî( M(vÓ$1YVlÛÌ eÍ%¦ÜþŽCð¥Žbñ…SÆħ• åEî‚Exƒù›MÇe ÷»s+?1?æ£Ði}¥£ƒ ^ãL<ˆçLT.R>Áĸþ$XÇE] {ìgÈ3#ßJÕuèKñuêb=؈¡Ž¨) @ˆ‡× Áö*ÀíµâàTRz‡´èñ„TÛ­ùðF2ì\žùEûDñ™ÉöG¬tä»bâDS§Ùè ×R§)_JÓY¶7ÓBÕ‡–šƒãcŒ¹ôçÀY:] è B¥Ck˜¥³¨J‹8;õù™û âÛ­U穈ãÓ¥jÃöq-úïÛòãÞÝ#ìqª ÓJÕ- ;}j b÷Õ^º€ÕxW¼N0…üº)^ùö–¿8³ -*×äÏ°kv -.C,}`´¨LÄöÙ"9ê¾Ïæ¹H¤:}=à¤Ù ,{ïî6Œ¾\¨æcù¡TÝ×αêd@ªàÂcɦ”/€“çöÀ9­ænº4+å‡ ¥ZÐÔ”5ŠIǥǠª‘ýÌÍt|8Ðbêðþêòô=žöràHÌi)bùÄÇðãÊeoår]”Ÿ,·»«ËÞêbÍsøµìùÖZKXC' nkÓßÀ4¸0YàÂ'þ%w˜Àà„_Îú‚®Ò>ƒï¾¤«e;ÆÝ[ÔM‹v0Às-i€ ü†¿ðéats2É”Bj.϶ëbÙë ^xÖ`Ýæ‘d|Ä…ñ7%eg„ÜŸ^qY³òàè=ÿ!5ðùkX|çÁ¡=¢‹ÿpHÜ¥‘Ý3<¾gÍÜ/¥ôø³D)¡¤a ©9䑱í:¦$מ*ùäendstream +4627 0 obj << +/Length 583 +/Filter /FlateDecode +>> +stream +xÚ¥T[oÚ0~ϯð£ó׎m⺸¯Ñƒ3ˆšÁ[« )íØ¿—WN–°âƒÃ™ 9€Ì™C²u”–L+Yé‰3u¾5µÐ§f]B©Žð$gƨÛHjÍ:*hT¢…¤à‚).Id¡üÉEpºžàf´!­bg 똳ŽB·; +ŸIáÿÕñ‡k$ÍöoÀéÂõ§¨¤YaA“l…B–º~H‹ µb£°-³–ªõ&ÚK» Ï«"›ÝIVe c1OÚUvEœ£þ–Cvæú=ìbë³:Ü–Ö†öëßmSœ¾œ3«ìõŒ›Â¢ y²–+Ïwx“«=Î*è®ÀóÚW>];1€ó&ßè¿Á5ü“ç+MŽ·º\æ·ê­ã<Æ]7°jµvšá²£gü–¤g–·4.åÂÿèÛwŒ)ªdŠ$%9%%o ú·[¨P›£ù ô<³õ%ÜqD*¥h¿98xŽdBJÛ‹ +èÕMQW:…2_.ª¦×X“š)|N1…?žÅ½ ýÊ°Ðø—¹Ñ¾Ï|Ñ céüì´4LyaäDRDendstream endobj -4520 0 obj << +4626 0 obj << /Type /Page -/Contents 4521 0 R -/Resources 4519 0 R +/Contents 4627 0 R +/Resources 4625 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4525 0 R ->> endobj -4522 0 obj << -/D [4520 0 R /XYZ 85.039 786.531 null] ->> endobj -4523 0 obj << -/D [4520 0 R /XYZ 85.039 763.817 null] +/Parent 4594 0 R >> endobj -4524 0 obj << -/D [4520 0 R /XYZ 207.409 769.184 null] +4628 0 obj << +/D [4626 0 R /XYZ 85.039 786.531 null] >> endobj -4519 0 obj << -/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R >> +4625 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4528 0 obj << -/Length 958 +4631 0 obj << +/Length 2730 /Filter /FlateDecode >> stream -xÚÍWMs›H½ó+¸ª–1=ß“›íØ»ImìMLNÞÐW¢Šd%W*ÿ~»@X8%³U.ÓM÷ëyozf Lñ¡U,.4V3% œ®ƒ4ü‚–?¨=’Ú%éøœeÁÉ¥–!¤Ì¥.Ìm—2åt˜Ín£ó¿NÿÉ.>Ɖ"`qbŒNcn£óóëOWYdôöê’†®?¾­VDÙÛë+o{C“QF†Ó³8AŸt¼¸‰?gï‚‹¬ÅÙ©„ ”?‚ÛÏi8ÊÞ)Ά?ñ9eà\¸¤LIQ¿¯‚›àCËÛdè¿:4)G"€3 n?Ÿq¦Î'vò‰½|i˜sŽJe8s qú™2ºë°ûßbe˜S -AjYlSºÃXãÕ8eYìt”OV4Ís¤ÀVÄqšê“KP¯•fR;ÌGŸ½Þå‚s`©ƒ°`e㳇òQžÝH”î,/àrê¥U½¬I)6ÝÜ-üèæ;ª¤\nîð¯ðjZlî½”öëæÃßþ}Äb6ñCšÆÜDß(h¶[¨ÔŠimºW°@e¦–‡ úZ>諘T2TÀ„TÏS2)‹¬®7LõQŠaüSíý8JÛ¤@‚>Ì•\ (( LY¨¨º\ÎW{“&PSxØ v<²&Ø04(vka;Gm ¹åÜÿ»0•° ¬&qHfÒ¶”gsªF¢”£YÛaJ¹a›*MÛrC³"hÞ–øúo -r~ÿºZ„¿ª¥ôGW~1}Ýe¯¶ÉÇÀP)­:µTÐ*wùºªéÿÚÖ¸ Nð°* ?^n|+yEåá3Ö;ÍWæU¯|Æ(ñÏh-!uLsÖ†ÐV§ŸïyQ ý$ë澿l]çxÆ1ŸÇ£Ë½(º„ÃˈAº33ÂG×CQyß÷ÑÔ0Â’,§YòÝzfóEþ@hËúTPâK³ª‹|M›~µý÷.èQ -x¹û°À WÃAgãŽÓÇ,/óI{äš÷Êd c ™ ÕÊd[Õ*ÿ nûB†÷¹a™`Vò#Û~µ»â‘ñ½"Ù‚C$C%µ"éÔ4¤!RÝ«1`¿ä=SÙ'¶¼}Z÷ä‰À·ŠU—h3Áÿì–þî«êÌHdoêKgùÕWRiîÑí۔ʫ/Ô7–wKºP~y¼göÞAƨsdÁœuèf6ŽÁàùˆÎçxB¯¿•c{†µX ?̼âœqpH“õµ =D”B†j¯äÿ‹ó ÷endstream +xÚ¥ÙnÜFò]_ÁG¡Øìæµ@äxm(°•,$#âkVAân²ÕÚÀWó§juÙ1{Üz^¨}ùŒƒÔͳC¶²«ºî…÷‡–¿Ï« vÛþâ…1çŠG# º®ä+j˜¼Øs°‰Bv¼Ð "„®‡ê€Ÿ’ïÏrƈ[Œ…á7YŽ³¿ðŸp¡Ü¢÷P° ¯µBHI;Ðʸ‡Õ©íIÕ¦fmో¾ŒV!JP%qÓã~è¶[üjIÌÑ,‚‚q ¸ºX¨Ûóù /­Û•AÏGîñ‰€ó¢æOÆ7åcGŒ +É–’¯¾ +Ëï•è%Šh^x3ƒ»ÏÒ—Y}¦X0Þa— <:tåSEr'>­ò4h¶ë‚6$RÔ•\VÉ®*Ÿˆï‚¡I|µ}®Hápòó=CšID-þÜ3à Ñ8 O¢c\~_u%ïÄ_V‰vÁcš«þ³¤ˆJõ0”ˆE£,‰¥¼«„~Tƒ6À|Él°²…ƒã>#ÈfY!J—;¦žtJxZ^,™ š ;±7hØe§í`Ëß +ùžL9ˆ=?efn!¤•L¸ŒJQURÉÛˆ¿…7,º=4åäD ¸ó[ãýJ<¥€ t AÀHlÝ1šÎ^÷mœÅ%¢ì„@¶ä¼œtKÎcTÌ µˆ'´¢´Œ—tœmЈ†ì+Fߦzì²AÄålw>ÚE V[Ï{w†¡@n>óø< ô@2üRzš×!ŽÎB×®äÁ¾œør,¹ç|Ÿ³ ùe²êjÿˆzŠÝ/w·ˆî÷ëO•%tüÎ[°šùŠœ&ŒÝßV‰aß‚ÐÕõD##«zÞ‹b®?„É"ã‘ò@q@"’v‡IÏ„Æý‚ˆînÇ™voV/óUˆY! Pjœ0{’é"ÐW?ôïèÜ ßu”ݔў†ôÆwQj:R<ðÂ^¢4^FçyÀøÚ4ÌÞú$ͬr9Â(ÛË· ëG¥îI0ØUÛñ¦ ‰ Á‚TUX›Ó¢ÜÀ{»ðš4µ¯½4²ÒŠM–u.{adêr*´Ä U›É5•åæÀá™Ä¦¢‚ë([`Ú̹=µ}!€Ý‘¿Ì„†…0}• ÿ‘A€3³˜Áe1„ TdNDDÀ6:ß®þøÓw +(Š~¾ò=&Î3Œ}OA\l®´ÄZfõÕýÕæ¢IP­¸Î‹&4á8ÔÓ…Èõï2¦{rœpʧj¥`~Àul@€©æÂ`@Ç[†«f‘—4œ,°00‰¥Å„;Râa‰QXO*Ž¼XÖ\T³Ö÷­Øî¸L 0ÿÂéS®^S&? +i›Î¡j[)%ZDàÁŸ²áÈ…ÄSyQÎщÇl3×—â'/y]bf |ŠŸÖ%›0@pŒ¬µFÆwTýÂI¥à<Œ»J-T#£”{{®X¨”*í¦²¼.møÑÁ$`š †º?³”,d%“¾­Ç©ÜÇ,º¶áÉfèÄ^ꥠê%u?J*jY¨9¥ð:#–[©Ž:çÿÈî´Ï)¹.3k¸ŽE¥M±ª'3Õg< Ú‡¢<“ëq"éOßýòÀƒ™:”À,®Ž‘ ¤ža·ãô* ²®Ýg¶^åŠÊ狺ªEÆ 9\ÆÁ;¤WÚ,Š‘s¹HÑØ>r䦤©M ¿‘û±#o>ðêýíûž×·”žXà/,Èîx.0*àÞ†#§àZq +/›DqÅ:í±ùôb’#Mfky@ +—$‡ºr»ýn Âaí +Rq5“з2!œKݶ³µª,^¬ F¤PM¥ž÷Ê£üÛK‚èŸã¸úáÅH&°n^OtÈ4<è“|`Ñ:€PŸ¨)@2…w}Š±të¤>T4©£áÅ‘Ô5X$k/¹´ÐÆx©¡g¹óÍQžoÒT3ÈbLÄÏ<ÑÂõm£œ÷-é,(´ë^Î\ËrA):Ò\èGlfŸËQ0~a­­‡ö¼JžlŒam’HØDwM°Ý¯%{ôÍ\QN\¾ÝÀUo´Ö%ûš&[Ê—OÆ^@.ÔöÜeé=†„·A—–X´ó-ò’ëÇû3ÜÁÉ )ä·ÖeÒpk" 'M–ïÈ•Ä#Žž¶–>1 “†`|‘³°²ÿÝdÑ+”;k<–þß^(/IÍ›&í+O'ɲ#¦Œ!gÑa + I¦†µÄLê~ÀþW A¬›”EòNŽb÷]¹/¿úÊP­&˜ß"pyµèÄKãKY1J9»“’Ÿ*êàâ–‚_d[XØÃj·lAË/jõÈ! K/ÌjSaÝ3÷€ˆv¦"ðï;/¾‘9ðG’‰Àz}ÁAêé «Ü½&S´¡(|[¨3̤õ)$ +J/Š–jW®m‡¾ËrÆŠ› ,¡Øýi%š¥£³ÓœbÙCB½L¾ÏÐF_$?ô้aÒKüËV§^˜„ 3Âãæ˜ÁS³±0Èà¯HnVI÷a•-¾gbV:DÚY\qF†…9£ãä‰zŸ„ B¸N0: ¶Á1T‡6lÊ&Výæç:3r7¶ñ £¹gÄÍlP?€»¡{ÍÕU~}Èz2¦ç‚7¤U…6]Ï(–]N›_zÔ[Ü_¨˜ãw¥†xüï_oÙà£Ê$sý˜ØÝQµk J\ù[}Ø“  ôÁ\Cê©‹Y—Œä†ÞÉ«ªÊ%ªã™Ïœý0ŽuÙs’BÌg©¯"àQÇGînÏ(×’ü ¼»Ô¬L4£•R‰ +@w¦¡’•BQ¸¦×Ä(E.•ˆðýïØRKA] g%{lã ,/J7r”ûö…©§Áíj*Ò…ˆCלIsy€Òr=u +¨-I½Ôh­še½”ÖèfÑ/ÅÖ~/´|©­«rzgQª¥.g*]1~Ìm…çʾNOÜQ<>Ž½8Iߌ 3È«!A@H— °9P¡Ž¿åôè"¢.ö©óÖýqzÿI(H½ 5K$Ä)D q27p/ñ§ß`°ÙWMŒ)TÄQ_±mùËÏNÐ&ç+ ϶-·a§_gyÂÓ›Îdss-«ä‡„ÌæPã*Ç„ÈK“àÈ„nîº%O ÿ1¹ùP~ÄWa…B2çF¬ì$¼á7ìpDäõX,˜fˆ’h‡Aµ€ƒ$q?‘k|Ʀ‚ZGÁ1¾ÿð;ºÜÖŽ/‡Ùµæø÷! ´{5¹iÈ`ú(·½^˜M çÖ‚Ã(˜ÐQ†ö“Ó;C(‹ÂD¿qéßÊ«endstream endobj -4527 0 obj << +4630 0 obj << /Type /Page -/Contents 4528 0 R -/Resources 4526 0 R +/Contents 4631 0 R +/Resources 4629 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4525 0 R +/Parent 4594 0 R >> endobj -4529 0 obj << -/D [4527 0 R /XYZ 85.039 786.531 null] +4632 0 obj << +/D [4630 0 R /XYZ 85.039 786.531 null] >> endobj -4530 0 obj << -/D [4527 0 R /XYZ 85.039 472.12 null] +594 0 obj << +/D [4630 0 R /XYZ 85.039 766.606 null] >> endobj -4531 0 obj << -/D [4527 0 R /XYZ 221.091 478.093 null] +3056 0 obj << +/D [4630 0 R /XYZ 85.039 662.656 null] >> endobj -4526 0 obj << -/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R >> +598 0 obj << +/D [4630 0 R /XYZ 85.039 301.388 null] +>> endobj +4633 0 obj << +/D [4630 0 R /XYZ 85.039 266.077 null] +>> endobj +602 0 obj << +/D [4630 0 R /XYZ 85.039 210.165 null] +>> endobj +4634 0 obj << +/D [4630 0 R /XYZ 85.039 173.298 null] +>> endobj +4629 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4534 0 obj << -/Length 2696 -/Filter /FlateDecode ->> -stream -xÚåœ]sÛ6†ïý+tWéB(ñE¹ÙÉ—·î¤IS+³Ý^(–bk"K^IŽ›_€aY<¢è“Îìt¦¦Hˆ|_àxp…2÷šeÒL‘3-ùàêö,\»+ÿ>ãe‰qYdœ”y59ûù½ŸÀ5¼x§>üñÛˆ»«…N.>¼×ÞÀwN 'páå«ÑØ•¹tß^Žþšüzövu&N¸” ògþ• fÎѯg“¶<¸ãŒqk·gJK¦•,?/Ï.Ï>Æ{…kj¾u¨RªãB1aôÓÇkÊÇɽÇÉ'Ëcά‡žTdLeî†i“§öÿFi<× ”åV°¼(b{éO˜›ÈSb眄þà$$+¸Áq†.V8ÂÓW8®ƒŽŠ-_ʳåŽÚ Yµ& -Ä0‡±Ôâ Œ(ýŒ=ÿ=èê#³­ó¥‹&ÆÜ,ŠI#æLY©Ž!–„º#ˆJ†ËévŽ¶þþƒ -À¹6Kz ÜÙj™Ý-Gê0ϺÔt{ètžÌÜa·?‚¹‚ˆ¹¼`…P(tÚͯ•,N‚ŽsŦ«ê -ßLaºvýˆ¸·}©&j)ØüWð=2|J}¶_ô¹ˆE -ü­ªÝ Ü*~}E–o¡Ä= {ð‰ -ÀZ0€˜ý`êÿ ”ö@Ê°N;ÅÒX@éþª£ïÜûQø†óM’•ª¡rçnÛتµ„s¨³ÈVbíÛHçÃéƦ7``Œ ­QÊ(4Çü ª¹J ¤šï¡¦‡™ÙýÖÕüôvÞ”E!ÑúÒ(šewY%¹úƒ(sÃT™«GP†+këήBý–sr3ĵ - -ˆ1OâÄT7ˆ)4×cš#ĉæjU$Ôút±Š8C…—ÙìE]|{ºù>¬¿4âNáªÇ³%å`V€òžœ£‘kùV[› ›†q¸VÏÊÇfMHØh%Pç±W$Ö;õ -ͱW šc¯H4W½¢¡= 'ÝãT¹2œÙ˜•qœè£i¨/\ZÌþ¥Ù>Sžh âQGÌ©¥n0Sh®aÆ4W0§šÏa=*{Ñ2â~Éâ¾½‘n -=ŽÆa±PºsÁxv4¿‰!Ì°­Ñ´Y´]}…öZÃ¥‡PÈ^eÒyç'|e* -ñŒNUk¦èTX ÄNUWA·>E!¹îS˜äاjÉ~m·j3|(§Û]ÕMðS¨î1üð㘕¡ð»3ÂÝٶȔ{b|ÒnlmÈr,¦Ëð¡3ð‰NàQ×øÄv'âI4GâQÍ‘øD󿚘&ÑÕãÙ­03Ï’ºÑ× ù ÛpÊ>@Ù ÛA3Ô^o꯼škx1ͼ©æ ¶¡Â//Þ4rM!¹Ç³Z‘+fr|‚ð;E¦=¯!͹¾¿+¡^ÌÚ¬f%ϧÀs1NìtØBs1¦9bœh®0~\ßÂr{> +stream +xÚ¥Z[oã¶~ϯ0ú¤àÔZIÔuß²—ž³Å&»m\ôm[‰…Ê–+É›äßwn¤(Kö)pPlM‘Cr8œË7Ä‹þ yâªXdyê'*\¬wWÁâ Fþ} +ÅRH–Í»ÕÕ›’t~‹Õ£]§ü¤H«ÍoÞûÿÜ|]}üùz©”òÂп^fYîÝ\G¹÷þý—_îV8{Ÿî~À®/?ß^‡0š+oõéË}À苽ܼ»^Í=~¼¿þcõãÕÇ•åÓ9I¨rù×Õo‹ œèÇ«ÀWE¾x†và‡E±Ø]ʼnò“XÉw}uõ“]‹ÇâÏšJ¢r?ÉÕT*aâH% #_…Ñ"K?3‹îàlEä=_G™WÖ5™^Í?¿a §,ñ¼546ÜÝo¡­{þèú¦%™Ú5;ü*e¡õ¿š#ÌØ£eVµ‡ŽÇ¦…ÿ¹î+h6{¸ž4 +¼îPÑŠÊ{Ä‘vÇ›Gü ½ƒî:œøŒ‹6í†{ôÏó'v–û ^j¢ :÷¦¹^≠ÇqàÝ} VÜ–Ó`S¿…÷Ê´­ö·2Šjr}…÷+†MŸÍš«7Q¼0ÁýÍ-7~’àÞt}ÄÓW=N{åñÖº9ZQAç­ÆåõMÂ)°JÈCÕ~9sÄ‘Xq‹fgNro_ÒÃÁ»3¯G‘$…w€þ–Nñ­ì¦Û–6M{ïžZtîrëóE ç¸RÝ9  º •ne©½á¢´+ ãÔØ5LeÝZC½5 œOP}£ÛžDe™aÙ5¾û´ e‚á¹ö y·÷Ü3¹Nðw«˜ßð·¹[åu¼4óÐv¾a#Êü `6V[Ôä$PÞ +b¬¡Ð6³%©åóØÄÑœ£9g)£Í¾~åÆdi2 Ýnx")²•=Tµ«xHÀR ÕÉÎKYÕ Ä%K!L}¯wHø Á|ãœiÏÂa´ +®èdd|(ÄM9\ëZ÷F%ñ.*¹G<}2œÔ–5ê®$©ø§8+À#& ðs~”ij^SH– 9Í(˜†CƒÇ¬7úÐÁQOv £ÔŠÂÝò²ÏW~:ëï—f¥Ëœ…Qáçص5Ý.ˆ(ÍÈË wÒ»½Œ|hF<ðùõ +¼›¯ø•zïY!P%jÐz¯èZÞžžOÅ¡&ÙE‘š ç£@¤âÔO!¹œ¯¶%;xïŠ5›‚/½§fd]7‡ÁëÁg¿Á Î.#ûŠ7á X×ÖÌ£"\8-vG×WB,2.„ŒÞñ®0ôLÎõuË«iî·>³¢£ #Ï­}ÿ™aÆWžE‘,Ÿ;`LmK>ÿ ‡ … Œ4h˜ l‰D‘O +ñ2cÄÃþJ%^GòµÞv§¹»|éË}gNJñ:Ž '^«e„ÇdKwâLl1Aƒ:1RT;Ý’OzåN-3dÏÙîipÜ1G-PŠú{!®I,Íñi;s¸Þž„Â{¦Œ²©,&Ñ6ÜÛ–º£ ÝS_$ñtmP Œìª ÃËÑYqje"p JÒÈ»kz™LúxJϨ¤©ùó¹"@$Ä2{afxÝ ¶¯4T>³"ä¬×¢³è×ãIÖºÈÓ@3u4fPxŽcÔRqltвè7G{Çóêajêš4Èž <1……0ÏL8ƒIÕ|ÐÇþµ>h«ÀùVf¥îí™xÀÒËñÌ¡9Ï ÅæÂÙÛi<‹ýw¸”¿û²âhf~Æèew¬˜ÓZÐŒAp –`ÍcM¾óPˆgÓì´ÁCkÁ×(Ðʲe‰øó-c°¯Ðñá=ÿ‹g7{ÑèaË%ío÷z‡3† CqžÆqK#O5»=é›G»äŽ 1ÏMˆ"?M!ËuôŽ©Æø–IB¡Bk¢ì”-)‰'Ùu2suvh½IÊ1²ävSofX +“ÜÓ\vëv‡ëu¨{ÞÌ°–Ä€\b!6ÙëÎàãëç_0HkpkŠ—í€d‘ŸéH'(íȲiÚ‘'²œ²ø‘¬ZÚ)©„öL*Í)3.®aBÍ?äs(¥l_¹GlK9¦Â :Ð÷Ž¹@í"«¾Uºæ•OLŽf„°~P›‹AcŠB6&´Ñ4¦¼_×ÇŽATÊé}”ª!éL €B9º`,&×€};=X|Ç󫞇h5ì£+c†HÁþHFA‚øhdÝAèAÊŠ/ÀŒ(X1õ¿@ˆú4µ§N㓠ݽ²&—;ž®×k>DÇßÖô9¯Î +´N;l˵¡Åºê¡F8ÉCz)^`óWºƒAí²]æo®„beR¤ ‡Æœñowš;J"qo8èExAnxmÊO¢'* ¹“†¤gL;€¤+ÿ» ÃB¨(›\H2ÖT@mÊ1øÁÓVm¹îù³-;Ñ*ë…s2ºy–º }Y/õ—M,º¾Ï°I wwYõR‚ +ðœŒnÆŠ|aÕKkRêÈ#7A¡rž!W‚s AGBŸ…ËzÓIà.µ©)X³ §¯>!2|Déì-t‚Þ/“¬¦ø<öI«ºåÙóÆ»q*ØXãÀM‰¤Ÿ ŽÐ5!xÆn²zl Ø„€m +;·T·Ú=pÏx˜Öl€Z¾çb15Ž‚&F¤~À3š=kÝ>•f{1ⶦǦˆg臬C5Àl•®¹c¹¢ŒuOå¹ÜEÆRÏ8ä¤|yf÷0Ô7ëÞÔÖh•¢ûCÀ}¦Ø3•CR”§l80«µâìÎ9Wrá6ÏÕt¢<òó(½ˆš³Øи5ÄMœûE]ÜÖÐLö=ÁÁ±éÏhcÆÁ”6Œcñ šÇZ tñËzŸ¦5µ3(—ó–Ö™ÆN—Òí²~ãõ´è<Â}œpÜç ’‰©%â´ói‚+.Õ¢ëǶæ7cŠU@†ç +Ë8†Zš‘–â—ͬÙóp’ͬ‹ö!•­9㮃×E_T¹P‡!²"PyB©´æ!‚‡ÆÕNÖÙ F„ ¢[¼HåŠÐýh´)°ôœ®Ó ["‰Ž¸&¥ÕÑÀÁç\íºå5§–Ù¤~ø+ ÌEWȨÀy€ƒ*jïL;÷Ar}ãÖ’@ÿp ~$rT—ŸTÔ€ÔÕ¨d¥'ºK”u×ÕÅ`¤…,œ¸á@cPçä@Kë9ùuÀx- îª'\¹BY­5SP±%ûz9«—âºJî'ù/©M½Ccâ(';ÁD8wÜÜû¢:Jr3éŠT +iœ×¦6l±îs|1ç̆ߓ¡ä»Ÿz­„zo«üm<Ò…<%ÁoçØȺz|e®¾“ /LZhzßÉÂ$7ÊdA&é¥hÚ}?5Çm³“p·™Ä§Šß°BXÌ@p Sò@É„÷¹/Y|“£e(óÌIØÉÿnyâ(Ÿ¦Œ'…ðþ¾iEb­î…WØ”bLçÖ&Š³’œ·Á8ÌÙéš/½N—âLhغ`h×U78Wcèq˜‘ 4L3”I«–Ûòª"?ã4¨{HÃ@ +$8Mr¥q”}ÈZBÒÅUŸÚäÓÎi> endobj -4535 0 obj << -/D [4533 0 R /XYZ 85.039 786.531 null] +4638 0 obj << +/D [4636 0 R /XYZ 85.039 786.531 null] >> endobj -4536 0 obj << -/D [4533 0 R /XYZ 85.039 700.264 null] +606 0 obj << +/D [4636 0 R /XYZ 85.039 575.671 null] >> endobj -4537 0 obj << -/D [4533 0 R /XYZ 228.576 706.237 null] +4639 0 obj << +/D [4636 0 R /XYZ 85.039 543.249 null] >> endobj -4532 0 obj << -/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R >> +4635 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4540 0 obj << -/Length 2868 +4644 0 obj << +/Length 3273 /Filter /FlateDecode >> stream -xÚ¥Ymoã6þž_áû&µ"‘ÔÛ}Û6ÝÅ·Û;$‹= íÅVlÝÊ’+É›äßß<3¤$Ûrp‡"@H‘Cr8œ—gÆá" ¿p‘F~ ³E’Æ~¤ÃÅz,¶4óá&´&Ò~d õg&Wnv+?0É,=c•(ã›Ô€æLJ›Û÷*X¨Àc½xxZ„¡òu¨q–ùQ’,6¿y4´\EQà}Z†^~8”õv¹Òqâ}ºG{_ËzÓ,uè=/W¡×É`^o„êK]Òº—å¿#+:= bÞøC úæxè0yóóÃÀ¬å5Nˆ±H¿y _'Œa@Gd'×щŸ˜ŒO½ïq¶/kjé&Êhï¹ìwè)ï>ß/Uâ=‚f¥ Á8ôêâYè¶ms¤™ƒ|íIô5Ýè Óõº/›:¯0×/Uê½ÊdÙI›cìû2"!•UŽ£ªBfúFÚ5ÓÒDNÞÛé¼ëXbô•zërådâõåv9Ž^ò+(Ò=@Z0ϸXÁ;Ö˜ ðpDJo‡Y»W<Èô=M~ùË™\ú_>ü·É ->2ôHUL¨½‡]1n‰‘¬„š©0$¬­›=öP—ËÛ0,Œ -K6tJ»÷BZ–’Ö†ž©·ƒ"¡¦’OÞ€x§å$"+ŽŽm·1V¢ÝÛ%ôokiÝI´ÂŽœ=ÇDôÙJ;UŒRå‡Q -}ýóæ·?‚ņtû—›À×Yºx¦~à‡Y¶ØßèˆL0‹íwusó¯a3HI‘Jëèê>¼* }¤'äælŸ•ãŠ<y5šQ¢ˆc?‹"1£Ä3â=Îü ¯ðuI£dG5n —pq_»&P~’fØxñ']& ÑL3íó-ÆÛñÀíǽZÜ5Äîâ„cÙw5ÙX ?~û9BrŠ~…Ìñƒ}@•ÞïAhÚ®—ø'ÑB~Þ ìVlŽ&G+tOÛÀzÒÌjYæ;KÚ³ÒÓˆ³!êBïIýÙgâÛ-Î¥‰åûÇ|F÷ÿy÷¹“Åì7Ðö;ðÐã#Ô}p,v”‹?bò|ãî%#‘ã Ý]n7…=$rÃÂ.l‹}óÝYï§6gŸÝ®9V04ö ú°ž4ñª¦Þ­ öFÝaŽ‡`×ÛæN0E_ˆ§åóÙAÊ3㪫0‹ý4‰OnL në*¨Ý–ß ;²³ªìúáb‰Â¢¶“)9–ÿ[É·Ý®<ÞI6â·½†RÊ7Id/y×ìs,‰Tä½Ûì˺›ËÊ­á[Db»°­Ó׬KÄø2Þó®\碌…8ø~DUYO—ïfŽp¦Ða}¹Ýõ|6v˜$R¶vS—í7¶¤»ÏE1xÒN<ñïAð)ÔßOXq¬ú‰cojèÑ®¼=qÁ´2\Îxb“„~D™¸¼¿àAá¦Ã,Y¬dÝ_r뤾J4µ¡ŸfæMÜc4ÅÁŠÆ…Æ×&žâC…äÊ-Œ äLæ½_êÀ+òþØ€´­ýXÔäÉÏs —¹mßäo¤¹ŽË4,LØcà•zä -WfXU£†R+¶E‰WƒW"K£WoZYÅ6Ií ~ÂZØ{¡€ °Ãb`da+õ??!¸•o/20b?æX7Ç;ˆ¤Î¡Ë” ‡€ - àè±ì[ eõ*Z<–sŠ>#ª¡›ï¥7¢ž/PòòåödŠ"Ћ OXľ3°è`‰{ˆ)³ 4 y-¦ÅhÖ^'(…!tàã 1 N¤ñbñsmeÐ/¥3Î"”N.Á(Íñk`­§@ÞÌ bŠ_Lü÷äšâø>A~B´Ž¼~é [Sa)ù¨á¨_5Ög@z²F‚9‹êÐâB&Dr;–Tátï)_ÛÉnÐÇòÐ[pŽ,)¡\@B$Ž:‹Ç¡-ßó{¹qJ ñf….ÄŽÈ»Dó!3º2Yh*po üSŠÇâÚ±Þ¨8£=æó!ëÈ­-ªØ—¼’g·E1ZìLØ ÈM„áÿp¡ÔO”£›$k1ƒ XÁùëCöuð‚‡Þ^M´ù›¼ Ë…F}c¹l°¦-x=`ì—W']˜=·p]èP&üB ÄjÅ2^d†%ùê,¥‡Áè’ø„FvL9:YmÿNΧ˜lÃâÝ8³0ö ¾¬Jn -&úA„ÅS­!¬¬’t"=FL›ÍŒ  ”Å™¥œÛ xÁÏâôD\~j$rÕüë©À¼±«TGNùÛ[›%QÌ2£‰]È€ÎO'É E8Âifcàè€4$»áUsn7LÆ{%^ï9¤Ò.Ï% -•¬¬3Ýñï?îœuoñMqý -A”†kµ•¥`îKVUš(÷ñbŒL1ò8¡$å“W¦ÆÌx’¯‰÷ñÉÎ;Ǭ̉ƒ”ÙÍ0R8‡K£Ÿ}°,V•8䚇¶¿ æo…)‰"åi;v²z åI<ßÍ1>M…íÃ@Ì™Ef7áÀš¯G+·ÊNwdQÔ²…€ ¬j Œ<Ü<Éhn¿\ ¡“x“*Im|BçV‹ÀeºW[ÛÑCRx p*2²Ÿ9Þ”uQ´®¢dHs>Mc*—ÙyÍäzÆè° fN¹f¢ëÖž¸B&’œ =Ïd&‘"½Œ“¤ 1hQãÓÔØÀ¢_gƒ¢äšXguV€Mšˆ›pl^BªÛ”zj†zª——˜* üÈ¿³R»«ŸÛÊ ”e€ÇçåúñG‰æt±Hxi›ï6Ä|ë_©F„Úø:y»Z2¡¹^- ÃÔâ¡Z¢lµäÎe¯ÝúH1„úM}»Ã›¬Œ4× #Aq©Z=Aª0¤ëá\ø1J¦.Ïh«xDt+U<#ulŒäÒØ_bà äUÒô öäÜÚ¼ JrºmóýŒç8³ñ¬¤¥(äAéQÈÃ÷±›"6%Lr\¶ÑFvïY"•æ>vQi2jöiÒF”»tSØ1Qjík¥ÏRG{à 3¥ž½ 0I³Ô7¤bóနO -åwÎ $‡ã\ö•×"¥np¯gK‹aÔŸw¯CÀ–½LL¶r€Ï¢ä ²`»¼ûÖAã)#.\F*öÞ=–Ó_1ç•^G”´œüH{U÷GÒKÕ×öc5lÇFªó3#MÖ“ê7ý/Ø™žendstream +xÚ¥ZKÛF¾Ï¯r Ì0|?ö²ð#ÞuàŒ“X†±HràH”ĘÇ$•ñüû­ª¯ºIJ”÷°0 uWWWw×»Šã/<úç/²ØõÂ|‘f‰‡þb}¸ñ;ZùׯwŠr7Ây¹ºùáMœ,|Ïͽ|±ÚZ:¹çÆy²Xm~w^ýûÅ/«[Þ…aèø¾»¼KÓÌy± 2çÕ«÷ïW¼9oïß0èýo?/}ZÍBgõöý=Ö^ó +Á"gÅ /^.ïç!þøaùç꧛Wöž£—øaÈ·üróûŸÞbC/úéÆsÃ<[<ÑØsý<_n¢8tã(Ôy}óáæWK kѻ昇™gá%WüxÄßÜÐi»I” +[¶MK÷?ðKŠžžyΆ4ã‰ïüáùÍê’1ˆiQÓëi¼'hÕéñ×Ë u>3‹÷H° ®…ú†7½ÙwG{JLN´Ð1f©ÛøjØ2ºc Póh¶ú/}Õoy-p*šëksjs¬Ÿ1šžÙ … K8yç3£saLÅ;óÜY7Ç¿ˆà‰ï-é™~£«OU¿çÍ?¼I‚§óÌ͘P¢«†³yŸrSõØ0M¸I–ë†ï;ç7ft9bT€÷ +ZÙÎݨ¨‰4mxf %Q%Ä‹Õžyžózõ[ûýREM ¯NyO ‡j·gZŠ÷ 7)…Mw~ä»±N¸Õ%Ž¿JÜfÖ7øÕs»²ƒ1 ‡á%`[¾Gja}S¹©ëå8 /"N~=Ôråâ€9©³‚%ÃS}úöîU ÿj¬‹šñZ±–»7|‰£>žáÄ «b€¨õü¬'ÑxUy!HöSˆE€£º…í#;·N¯ÞÎ( Ùqz4Â!™Æ¹ç|ä7„䀚-ÿÒ£÷bˆY §=MéSU³íbRÔußu_bÀ×U«†–iø½´Y3üÌY×U ( +²%uX¿êBì‘f}ùµWxщډ†7íjÈ{…òßV>­î4–LOU[r´s‡ã#Ù(©ËCDxe¿ dTêJ«4ÖÃä­9uæ6ÝœæÀýÁç´ÏpÇÝÔшú°·)FzµnD§äœ¶â…ÎvŸ9Ð_Œ÷öz{ u=Y„’žst⻫¯X ŸÔbtæ9¦î/“'Þ—OÌ4Ù‘yÄgyÄ êLÃm]™{«+ƒðÈ[¨àÓ|0®µ £Ï°pZ¼"}¢ÿ‡{²ÔÜ‘Ôp žóNøy°±žhXÓøžVï‹NåK´|À~tª„=Ô¥ŒY³(ÐGGœízyC±á0ˆCŒ¼p¤Ñ<ƒFø F©#ÎdÓq¬Œ#+Cç¨<î4”1éY¦vÀ'7[cÔýsêÁ“Y~Š›¹+^jz,L(D„9Ú!œuª[&èB‡Žª…##g]4§~í‡å)g6&êܪ–²O©Ë®3vQVªµm¹«º¾U»« bñÜùfN§Wƒ±CJX$ßñ½ŠÄÆ ‹BÇÔŠ&33„Qält ì*Õº½<1#ø¦¾Ž¤ÿÈwŠ!R¹oõld[ª°Ï"ÑÓŒVë³Âtœ‹aŽ@M¨#lªhey#g2ÙÝ`³yMÓ±xk ”i$¹½™l‘;æ¨×hÆ·°1?õÇFãs'ŒÎ+õ'ÞRÕpΙwpÉåÓÞfùªáe=ç±ë­¤ ¹$,šƒ$šz$Φ¢’&“k&w#B–BhI}!í9÷…Ý-ÒæKï›Rš߈Sn© ¥ÀGê cäÙz‹VPô´,4:ÊLbÄ%l2„žXÿrn%…d‘ 蕦֦Iq‹¥,ŠN"¸ï™\œbâ?¸ >w=òyWªÀã‰&2áC¡á™'u³kôJ[–„M| bUy`‰ÃÆLJu(‹dô,×}Ùð¢î{ÌÙÛ†kÙZ/˜+¿h2jÚÁã"yÝ ²Ì12e|y°$7ÞYrë–LÏ£J†°£Çš (G³„Þ›Ššª#ÒjM$ñ(ÃP“Ÿ0°˜á««TŠQt½4礩óª9D9ÜhLfTÕ’‘ÔR0Ç×Éuº³UÄwh–üµè-Ö™÷ÐzšižI#‹x¤(u~fËûðë;%g»©k'N{ßð9l:¬>1¶ ÖDØpÒ˜":A¢ÖY*®Iè„‚q`AÄ™ÐNÁbœ êÒ ÜuÙ?Caâ;øf+$«Ï40’áñ9+EÕ丶8”½õPתœ0¡ +Æ‹¿YFŒpl•ã»93Í–aØ2UŽïp{,¦;r]sàþ…)lz0†%—¤Î}ÓK9OÃÀ:éÒ‡r}j«ž7=_{@ä¹ÁÿzÀ€sµ +½Ì%9tB +¼CPô A)wõ^òøZš C:€øáCÊd‹–#k×—“pÀæ~åè0Ô™O‹£--y‹´:¶ÅÚv×BNCMg1”‡2xÏ Õ¯$QQ½o¦)—æAº:d¢±Þî3ÊrlÐÁx„gË<hòqF‡Cí~©×öåÁ¤=q€¤ïù‘ c{Ô´ÛA”ÖuÉL|$¡hØñÚõÜGe§Ù?["K“|*.*Ó€"Åð%¡ ´³Å!TêÙ㘪|4Uª¿b°»\Êàç—Ÿ« ÑA]ʃ¢Ç¢Q“¨#=HMo†Â*ñ”ó^Þæê­¦ü L³¯ÄxŽ+ôöȧö Péï}$„¦ó Â:ðì@éÝ+t&ÅÓ;"ªÔ§!ó“ ãr4;+h§‹ÞäÀ8ÕÒ¢I–œ]l–£fáˆGŸö0ßù'‰ª“—3ùz˜ŒŠsó“ø÷³ByϤf•L6°€ó 5êñëß]Ï.¿œø ´;æFöy}þ«½ø?üqArñDÚ˜¶cNlÌ®”4?—Ì™çÜNÒh¶Æ£…PÊÇ–0Æ5<8JfóO°Ïéê3ö-ÓZ©¡SÝô£Ìº‚;àU[´15Û~—%IQSa"ÿŒ„SäìÑX“ødÛÑÒ«-=¢li¡§‹úr¦–ª€ÅMÕ†Xžõ´ qž¤×GïI ¦.! L «6e;dL´§Ÿ kû)ƒ>3®»¶ùçNIŠ‰#ÓÝ‹Úl±±Ñ_«»¬”Ì…~œV´@R!Î|çHã©ØÊvk:øˆýÑ@¥ùþ5š{á «â&öƒ"ÀùÐ6µ4>¢oKùðÀCÓ=ólÁ‰­YØàø}Ú}9¸L¹¬UeI§Ô]¤Sù¨²åÉÈì/9!}-äò\ýSa§Ã‡°[Ø[-×~¼…™Ê¶çîK­ -ÚPtøñ4§ÝbËà5šRŠÍðþ±–=ÖOHÐ]›8¹Ö£‹3Õ vR5h6 [K€QyÖ͹η½6rÌEGíc‚Jò{êz̆j4ÿµ³“Z·e¯¤Â´¤Æ QԣƘV+ê„>Š¹^õÔ´YÍ×á‚:é/içl—`SÂ%…ÊŸ¬õ¦ž9uõy´Xx­›˜8œ§îE­E¡M„nj[2šÕùx¹‡ÕÒQu¡IÏ&Ù’¹É¤/pcð¡Hý3i’´|OSÓœÜl‡¨›:ùBøØÒKæWàpá™?*VCß7™‡Ò{`„³²6Ÿ`·ü{þ]ÀSz¦ÅtZ*O?*ŸZe4êO±¨wz¥¿Ã§+_{áÍá±èÕoÍv”{mÛ7CxÓÞ¦ÍîHïºgm7:£´±÷I®p¿Råþ´eÀÎ̪ccXökÓïžk~:ë$qoûe…ψ+2ãeûwµ.ð8ry²òO¦š(µóζ3Ùv¥ÁMx›r+PÝcí…GÌN5øíE{yd[ÈA>òCLxFy§EwSÇcÃ$.èC"ùáø£ÉÑÜ“&Ùuù5Š¡x¬ÏÝùÑ÷ä»$3)%¯ŠãfPn–ÕD &Ä&}^_û¼~0×?&èÄSÌt8Oš,µê,U;ù+ 'y®$ 3·bß8îÅ›Omyg«°âÁøÙÇ3aª_ £ë}ï+…|ìFáìçVúçþ_ÿb»QææY0ß ˆƒÀ |{t3¼ó›?”¹¼òu!þiendstream endobj -4539 0 obj << +4643 0 obj << /Type /Page -/Contents 4540 0 R -/Resources 4538 0 R +/Contents 4644 0 R +/Resources 4642 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4525 0 R ->> endobj -4541 0 obj << -/D [4539 0 R /XYZ 85.039 786.531 null] ->> endobj -722 0 obj << -/D [4539 0 R /XYZ 85.039 766.606 null] +/Parent 4640 0 R >> endobj -2958 0 obj << -/D [4539 0 R /XYZ 85.039 647.281 null] +4645 0 obj << +/D [4643 0 R /XYZ 85.039 786.531 null] >> endobj -726 0 obj << -/D [4539 0 R /XYZ 85.039 432.131 null] +610 0 obj << +/D [4643 0 R /XYZ 85.039 657.913 null] >> endobj -4542 0 obj << -/D [4539 0 R /XYZ 85.039 410.369 null] +4646 0 obj << +/D [4643 0 R /XYZ 85.039 615.628 null] >> endobj -730 0 obj << -/D [4539 0 R /XYZ 85.039 134.374 null] +614 0 obj << +/D [4643 0 R /XYZ 85.039 367.905 null] >> endobj -4543 0 obj << -/D [4539 0 R /XYZ 85.039 107.759 null] +4647 0 obj << +/D [4643 0 R /XYZ 85.039 333.159 null] >> endobj -4538 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F56 2890 0 R >> -/XObject << /Im2 4150 0 R >> +4642 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4546 0 obj << -/Length 2737 +4650 0 obj << +/Length 1369 /Filter /FlateDecode >> stream -xÚ¥ÙrÛFò]_Áõ>¬! ƒÃUÞ-Åò¡T¢x-y•­$ Q° @ÀHúûík鬷\æèéî黇jâÁ?5‰ëédÅ¡k´šÌ‹#o²„wGJ f2Àüp}tú6 &Ês/™\ßuxÏ5I8¹^üæ¼~öáúÍÇéLkí(ß΢(v~ž*çìÃø{1)çòïãòo..Ï™ú±s# g—ç<øtyñ+Þ}D€_>}¸šþqýãÑ›ëŽÝÁ…”ÖÈì×£ßþð& ¸ØGž«“xòcÏUI2)Ž£]h™¯Ž®ŽþÕáâ½`§ÆdctìšXï -G™pÜ^+ã†ADÒi«é,ð|g>õ#çnŸ–Ë —´ÓâTÆ Üie’– (§Í YªjFcÑ}ÉWpbÅ“ß=ãY€9J÷ªGì)‹uê'Î3ƒ=Ô€8"ðŒ@Þ©×%œ.sü»ä¥ªâ÷Vx8væé -Õ"š)”`B7.R¾kŽh2— DFC°kBfçø /_ D4oÚ:má>Ê9fˆu“á.ÞÐhØçÕ”?íh'·ÄU&pÕtb6‚U.Š¼DæèÖmM’¯êFˆ-ëj K'0­. i ¯ºÏläBÄü}Vç- ÖFáÅ -¹Ñ%ÜGJ8ô@ÈПù*[Òu𢠉‹;Mãg|&zÁ ’œè‚ Ô´š¶|oÆEÐh;ø½%Íg ,˜IüYŠ“íz¨ZC7D‰¢WZ‰j½_{Ç ºÄKã5•s"`8¼ݧ ïeOé¼]=[*Hzi!IRKRF+ÇìñÚ=Þk‡7÷VL`å:Aå¯ U0¼¡«-*$úˆÄß¹¼Æ3œ -œïyO<̬HRÞXTEš ‰bCâ¬JTà…r€zq^‘|ñØ>㳦F·~Æãw–Œ3q‡ÄïÝÖ>œ¿æEò)XHQ™‹l! ¯ \Ÿæßò¨d`„´ç# (âªþÒ´i›W%ºŠœ7è¸Ã2ñÁtG=7„oz¾q||.rG€Ž‰°=Ã,~mµC=àÎ(w¯5æ9CIâÞv¸€QÝ… r%«Nœ="̆éÂ"Åýå2/—<¯Ê]²hq]{!o»†DhˆBwÕjŶßeXe.³‡†§ Î"ó:ïÌ9Hb‘Ïòœm*¿ø" -ÅÕ+ÔûBÊûX9°uÆ}˜ã$ð#ª6ؼâμƜ¥³ª:úø… ‹¥ ×?·k›çCO»¡ŠF+ 3T >V -a‡ ¹Sî=@‘s˜ƒ|ƒšN Š1Ô¶’…Sþ¬© €?O[!±aͱ¶.ƒte7‡©Ó·zƒ¶QP°³Hô4k秜þrƒK¹~d!±|9ãÎÚc ôà3â4yË_Œª¬È=º2P±za|XW ýº²@Èž¿OWɉ®S] ©¥ Êä‘dò„ýšÓ~2Ô‰{—‡ðŸºœH[ž\Ñ´|B‰'c!ÝF¥ª¦EˆÍF%ÎÛiPyŠÇÈ–žØ™g« &ò;æý™"üz_ìÇ*¸g­Ú:áÄN‘{ñ[*ÌpP¤€ü5Ï2FW4Í8qõ_°ÍG±@>æÖ -%”W_ú0œéòÕËš3_…è3 êÙɆ‹—O/ç¿ü\e'pßò„®·Ï¨‰Ì7Œº:`Ô„|è½F}ˆœ5êƒÔ¬Q¨ýœ¢ÅR½cÙ‹D<6‚U¼Ú8Œ_ ˜Ïª+”v;¶¿°»LêaõÅmŽk -z”„)‡veìÍùl·..ÐÇõ RÑᦚëªjÿ¾ãhZ½( œ‘ŸÓ~K¯^Ø„…‹äšxœ¬Ëü‰aDb»6;áS»gœ¯xáªÍº¨³t¸ ¨úL;2Ȉ\ù¤`-³a_‰L¨kÛð†Òȶ§4h0`¤|–Wó²Ûƒ -7ª)—ø{ÎÙŠPV¼9¨7‚°ÏZµ,´¶âlˆ àË© -GjlEbé|c'>1"DË·„ûÊùräBý+A P×ÜI¾}˜]©lÀ‰Â€¾Fs†¸´¥fÉÏÌ´ C6ˆâê}D§Üb¥›£¯I°$u"¢ÅÀ³xOÕÿ·]¹3÷CîPñûÀá²iò[8.¡ðKN€NTê'ÀÊ-I½NkYùtIïJ¿òLZiZDýy˜Ü2\‹FÔÃár×ÃáÁS^ƒŽ“Øñ¾B’ÏPsMQ6€™]“ã(ú=7¸!ï[áFMö¦ã4æ2_ðucØ÷v˜„A}8袋‡%ÍÈã¼꿘w»÷ÍíŸ$M%ïJkjEÿÛuö=Có‹Tæ.±} ñèyËoQ‚’àÇÊïõOæ¥ÛÛn“~÷T°*q uNï[NÓ£Ú½u'Mw’ZÇÝ[ÖT^7zGŠ;Ò„ûÖõjÁIƒþ°äÝöžJ.½‘z`.b¾j<êgñFÝMÙŠíHG[Ou»W¶}ØÃuæoÛ8Ü°2’ç–`Ø‹qÕ‡‹ÜŽe8¹*ö%»Äÿk†«óÅ+å¡Ëm仳ù¼Z—-¸ÏNžKçóv,Ë…Ô5 “ÜZ$š“‹Rt“Õ®¦ès/aèã—äü…‹¬³(Š`ï-­¬»gz˜*ññ×µÏßۼ튓-‡(7il[¶Ä¡WKê×Ù2HÏ{Côô5ÚZs™DÊ=1Ž÷U'‹lð "¯sƧúþžŠ0@Êa ƒF–ËJ“11šzEe\€Æ¢QóàÐÇ‹sá -¢>K gc–§ƒNß1èOco5„4AgÄP&ôlC­À_^ÚÑoåà–š H_°’l'× ô|Ñ'pÄI^2øöէᢅKÅ-oßrx¸ê ^Öû˜kˆcÝðuÆnMÁ}ÝÚrE«høÖä•X Vüü¡UØó§XÆø泘"µzLrÛúΚ¯-R"Â`NÏFL(]·HÛ|Ný¿´a>˜=²Û2Š;ŠÓ\ŠùíÃHE'ëE&eFÞlÆ)¡»ç!•`3wø® õ(>ì*7A^úqT¹¡°KÐé+|š™ãÑ{$'YÌ­ºÐaK”Šg¹®Y@{8„/ÿbµŸÁdÿL*Œ\ûºZ•ïË@ø†“UŽNëûƒ×J?•P\Wò€ƒkƒ÷.Y‘´}bøƒõ Üã_®ÒÛ´ÉxÁf(gOd9óuKØ–¸M8ì|í~"=5å ßôM¦ Šunè«œ¼n,@Q%‘`•:ä}gÆbjÖ¶R±5©œö¤9†cœ‚Zg_ž#ùïXûÕsÓfÅ ›³?š4¼†ÕÓÕLÍÌÌWø¼*µçÏ”IB“‚@‘È}ÏçÊ -ÏÎþÁß湡}$žì6“ßCÖ¨ªÜ„~“ê'~ú¢z”(¾p}ƒæ»uÖ´ßI4%ºDŒ{œ\7wrøÏ þ_?Yw¡"ˆÝʯÑPa|ˆ[ªc†"™ÒÛÛ߶wYþ/?·Íendstream +xÚ­XYoÛ8~÷¯Ð£ ¬Þ"û–æئ@Žm¼èÙ<¨>¡²ÕÚJÒþû!©#²¤,º‹¢5ÎñÍpfQøÇ"£6JŒ&J°h±™Ðèv~Ÿ°À1 ,³Ïûùäè\éˆQb©æëZŽ¥DYÍ—wñɇã›ùÙ§éL3F¦³$1ññ”›øääúÏ«9îÈøâêIן.§ vˆç×W~ïw€&ã9n¿ŸÎ€çÏn§÷ó“³ymgË&Zù}rwO£%xôqB‰°&z5%ÌÚh3‘J%ExÏ'·“?jY~OFþT(ÇŒS’p~¨.±IP':êÄ:ͱ–÷ibZ)(Rš¦Ú<]^E¤R°–è{DuôêéLä‚Åvi9I¨dÕöÑÅFG§X5ÆbA,‡P4Y¼N­#C,üBü•DIÌÖÅÿoªh +?¬)® Ø8”¹b}à]™µy#x+ »’ÑŒóìái·‚|2. 5GçdsLsB!†Ôñ¿ëš+xB8Ó}æÖæU<æ½ÒÓ•„ê.N/oTjHf«Æj1”P¸‹3& MtŸy_ÒŽý·KQ)4IŒì÷10Iªˆ ‰0Dø¹Š×EW7/ðV¿àUÎàuûà7Ÿ‘ºÚí³b»÷”bíŸXnýò3,³í~AH¿ÎeOo‹ÒöO߀çÛЉ‹,}ý„äáŠÙ ©3$]!eñ„§²úé7Pâ®( 'tQäûßžÄi^ÂÎcñôðˆqt·QôΗ°éDþô•p“¢åá%/ü¢Ø¢&Žo©,‹Mšmýzåž34«ØnœD Ù¸|7P ¤5×b´¦·x\(¡4¡d”IE-È_j–tõ1ª‰QfTaÅs ñUò0yÊø+—·€Spü:¬¯œû¥Ï#â¯~c‘g¨Ò¿ B}'yÉ\<µt Ô/@K÷U&.w¾zú® +$æM¶[-¼ ™œØl»/Ó<_-‡"aZ¤á H`z3 # +›€t4ö¤¥ñ3¤$Ã+‡ í=6Vyê[]¾†ZtP áꇴÂó©¾Â¸–!hNý¾pjÕzð†gðÀô&à# +À;ûoiìÜxŒî«û°9XmFhñ #P1½…À˜Â®Æ^Úû¸\ ù ¹jEò/š(UTõ6;(â‰%F’î1~å¸ùPËd0¼QÛ´L-ÁObaZaf– ìæ0ò«Â÷,¼/7Khû&ÌzŒPi­ð,­µ3¾ñ©šòØá”ÄÎZr}lL;6Ü@´€Û2ÛÔgf 5ãÕoÅ ß1VÌÆÝxžH+°y!ué[éÊ5qãQ׿aë1}LëÔWf_Vò¬ÌV-Á®aÂó HJ|)Yø–Ž§AUÓêÝ᩾‹nZ‡w=…_úä[¤¡-×F„]ß•Ù"û–6! íá°«Cÿ/êrFº¡–ª®„Ϭ&{~=1Û… ºþ¨ùõÛÑÊkE´Õ££ ã†À}n&A€j°åa̶aꌀÀçF@Áë! ¯„™.LT½“pù ¨÷eÓåß5“lLzd ÔX(Òb|ÂjX†‹kày«¶Žh«KkG]oem©ëóú0¶Ô¡ïl+äø j–a×Ï[®h«]ï¨ëu½¥nÌu‰®Ó¡©>³ûÃÿ}ÙøŸ¾³àëÚð~‡4 ÎjcÐ!ƾ´•€ïa#zLþuÁã endstream endobj -4545 0 obj << +4649 0 obj << /Type /Page -/Contents 4546 0 R -/Resources 4544 0 R +/Contents 4650 0 R +/Resources 4648 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4525 0 R ->> endobj -4547 0 obj << -/D [4545 0 R /XYZ 85.039 786.531 null] ->> endobj -4548 0 obj << -/D [4545 0 R /XYZ 85.039 615.045 null] +/Parent 4640 0 R >> endobj -4549 0 obj << -/D [4545 0 R /XYZ 85.039 600.89 null] +4641 0 obj << +/Type /XObject +/Subtype /Image +/Width 164 +/Height 349 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 6345 +/Filter /FlateDecode +>> +stream +xÚí{l×Çm•ºmT/[[m}ZU”‘Lf,ºÄ\Ic2A³U·ª–¡«ËP1ea4›„T¦H°#)mÊR÷)·ÒšÞKéÅï'9yò}.ߧ­Ë·}Þï?šó|¾ç|Îåunßç<}¾/_REQEQEQEQEYW ©«Æ²þÕbÕ4Ö©¥æ°æZÖ²DÖdMÖdMÖdM‘5EÖYSdM‘5EÖÆe6Sþ×RÇ7ÑPMöIÖdMÖM¨ãóçÏ_KCÕÕÕ½xñ¢U²Þ¢££=<|x»W²ÙlÆÊÊʉ'ÂàAƒÔ¬ããã;wîÜ·oßëׯë•J3Žf© + + +BCCñQXXXRR’²¡®]»øõ×_KšË–-óññAi£¢¢>|¨ÌtäÈ‘ø‹O:d\‘ʹ{÷nP)å§ ÙÙÙ°K‚hO\æææ*£icbb`\³fMYY™š5rüí·ß7nœA©4ã¨Kµ|ùr\®X±¢ªª +Ýõã?–NÎ;×­[7t|$"÷Ýw°£¾éééLš4I™éåË—³²²èÝ»·qEZ(kÊËËðôôö’’Ô1<<¼S§N°»¸¸;.ãâârrr¤M#Œ=Ò›ÃEŽ]»vuX*G¯T€ŽË'Ož¨tìØSÖÅ‹¥=((öšššêêjºtéb—)æp\]]+ÒrY×××#ЦMaÇä&ðÝ¿_™cZZæC\º¹¹?~ÜÀˆ0,ƒz¬EŽˆæ°T2Ž^©0¥Ë¼ìœ@íÛ·¿pá‚´£Žš‹è…õ*ÒrY#dÂŽå —bãÎñÖ­[°tèÐÁÀˆ)—zÍ(rĨqX*G¯Tb¨bœªLŸ>pQ¯¢¢"¹âÃþôéS“H½Š´PÖh¥uëÖ!€R؃ƒƒÅâ…qªÎñÌ™3°`™60bÄ%†üÕ«WÕ͈ÕSä¨ùÄ^½R!Âû÷ïÇô‹.÷駟*êðáÃèÆ llù`ß»w/.óóó?ÿüscÖzi¡¬###1d°žSØ9‚½(ÄñãÇ+sÄÊ(¶ÁC‡ÍËË30boŒ…vì÷ìš³"†r”[&»RiÆÑ+–ã=zôéÓÙáïªU«ì +;4//¯Ù³g#\[[›˜˜ˆ©‘GŒ‘ššjÌZ¯"-woé2øRÌ{¤¼»ÎûáYSdM‘5EÖdMÖdíT¬­µ >ï<¬[èDAÖdÝŠY?þ|îܹ]ºt + +Ú´i,Ïž=›9sæ{¯4{öìšš™vÏž=aaaîîîýúõËÎÎ~©úç}³GâñS§NÙµ­¦èìÙ³ƒ†ÑÛÛ{Ê”)êÂëEÐËnñâÅžžžÝºuKMM?~×®]>pà€Œ™™9dȤ3fLII‰±Cƒ~"/5KX__ïëë ŸcÇŽ•åâ Åf³!¾qõ_ë¥K—Λ7¯´´ôÎ;“'O†%66výúõÕÕÕUUUIIIh1™6&&&??ÝcÛ¶máááÆdãƽzõR³ÖôÓ½{w4>ŒøhíÚµj‡ÆÔÙ!NEEÅÁƒ]\\DøСCʨ]aa!¢“Ϙ1ÃØ¡Öš%D`õêÕha´'šzêÔ©2U\\œDoP»×Å:  ¸¸Xiñ÷÷GÁD½]žÿ*¢'Èg Šæ’(YkúAÏÇTŽ/;9Œ ™Òˆ°|bDYŒòòrc‡fXk–088¸¬¬L„As‹¦ƒÚ½.ÖhjL2vù>’O›èUÐÎ~÷î], +h=ñx€q|yyôèÑÈÈHäÞ¿ÿÇ« ¯Áavza¥õ•ÕÔsh†µf íeQ÷F‡Õ]¬?üðÃÇ+-~~~²w¡b˜;d­ì-¡¡¡‰‰‰yyy˜.0#™g-„‰.--ÍËËK¯ +vfg†uee¥œ¾ô*…ÉAù˜±qàY~ü¸:NuuõºuëÀuê”L˜’’‚Úµk7zôè’’a?{öìàÁƒÙÛÛ{Ê”)‰(ïŒíÙ³',, iûõë—­ŒpñâÅ>}úˆûä/^¼ + +úý÷ßÕM¡ü¯œgϞ͜9ó½Wš={vMM Y¯]»¶¢¢âàÁƒ..."|èС^½zÙÅD[mܸQÚÅ uaaauuõ’%Kf̘!ìÝ»wÏÌÌ”üü|xk똘¤BÚmÛ¶…‡‡ÛEزeËÖ­[رcGll¬Cψ³~ýz¯ªª*)) ]š¬%JyXŒ°>^í[…}ûöIÜ .LNN~úô)V®×fXgddØl6̇={ö\½zµÁðáñ Ç~;!!YاOŸ &Ìjþ~6ØØl#BHHˆxPÐ ëK—.a†A×BÓŠ„ gß 0oà{÷á­æv5YSdM‘5EÖdÍ’´â Y“5Y“µ3—Dï¸YïÌÚø°233‡ ‚´cÆŒQžvi:4è'òR³„õõõñññ¾¾¾ð9vìØ'OžÈT{÷îµÙlˆÿÒÄaº¥X7«Ï¬»!))©°° 7mÚ$µõša­YBV¯^]ZZZUU5oÞ¼©S§ÊTqqq½ÃÃtK±vxܬyf­wØ­,Lyy¹<ÔÖsh†µf ƒƒƒËÊÊDdÅ pµ‡µ³kÍãf3gÖša¥±¡¡Aë94ÃZ³„ð¬|âHó Š—&Ó-¸7³;n6sfíuee¥|DÏ¡RzçÚš%„gñÞ3›CƒÃtK±ÖÝ(Ÿˆ¯ù¾ø½¡·¨Qæq¿ÑWQ½é×åQN‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚ûܹsmÜ|ðÀR¸ Ú +*++›¼Ý+Ùl6Ùµ–-[†ì`ŒŠŠzøð¡2áž={BCCÛ´i£—œ¬›ÃúòåËYYYôîÝ[gÎœ9'''¯]»o¿ýÖ8eÔÎÍÍUFþî»ï`ܽ{wzz:“&MÒ¼©¨—œ¬›Ãúå«W`!€!¬ŽSRRâååÕ¿ÿ°°0___ÍÇQôXwîÜḸ¸œœ9((Æšššêêjºté¢Lxýúu |ƒädÝLÖahÑ¢E‚¹×a.ÊpZZZ`` ˜ù?.Œ˜Ÿ5o)«‹ª™œ¬õôþûï#ÇÚÚZq‰€z(‡Å¸îׯ_DD„··wii©:Lˆ___¯YÇ[·nÁÒ¡Cqéïï˧OŸšl»äd­§èèhä(¸„Ñ1bDjjª^ãh&'kcýóÏ?{_I‰je¬)²¦Èš"kŠ¬Éš¬Éš­DÖYSdM‘5Õ²Xß»wÏÓÓ³ù½.?¯·‰ÈZ©~øaúôéÍo1‡~Èú³E´;wîLžÊ``\¾|ùöíÛرcG§N’’’Þ¹sg\\œˆ°aÆE‹cÛpþüy²VjàÀ'Nœáàà`ùè&u·nÝ4Y 1 ü(ã?~ü£L/pc`Š0f’ÔÔT»·Õi/\¸ žûÅt±eË–ÈÈH„Ñ—ä³¾6›í¿ÿþã®ÖÍ›7?øàñœÞKÕS—’…777™DÓ2~]]xغ{÷.&ÿˆˆÐ¿z)ìG5¸íß¿ÿáÇ ŒÐG}TYYÙ³gOd‡^ŸQQQòSä…iœ¬ÕÂܨ|ÞM÷èÑ#MWJ¸~ø!F«e¾˜üüüD844‹i^^¦LÎvÅÑ––æååelŒ]µj•xì='!!aÁ‚òSô"Ìd­Vxxø™3gä%Ú {*ÐÁb‡YqܸqréÜ·oŸÄÅÍ‹õúÁƒbM·ó#þû4¬ßÿý„ „ß¾1ÏÃ^TT„EVoëÖ­ØÚ!Slã±ß30Š=[ÇŽÿüóO„± #ü÷ßËOgÎœyòäIãû +²º~ý:²rÆÃ| Xµ1ÁbbÜ¿¿°gdd`ÿìêê*Vpì¸ð=ú½÷Þ LNNVû?70¶Ðè?›ÒÖSL˘± ”Ń7ÄÄô‹E?++ËÀ(vÚaaabÿ!!!Ê9=püøñÈeÛ¼y3Y a&TÎ~M–ÚïÍ:k¬žçÎk~1Ô~ÈÚiï›QdM‘5EÖ”5Y;7k~ ßDõ|:kõÙ¿FÏòTÅÎyQQQttôûï¿ß±cÇ/¾øâÇ4¶“µó³þòË/•o2‘Î?ýôÓ•+W–””TUU8qBþ{µžÝʬŸ={6sæÌ÷^ cGÞIÿŸn³ÙÜÝÝÍ$QŸq‹· ………ÁC¿~ý²³³ErÍ#rãñÑÍ›7‡ &oÍÉz!2Ê£®—žÝÎmffæ!CP’1cÆ8µ—¯ƒPö(3T6ˆÉ÷æ³FŽrbÄä#š šL¢wiòˆ\3íO?ý4gÎud”çƘä`1¶«sDL‡‡ìêS{|„Q|ûöm¥Ñd• bæÀ½ù¬ýüüä:…Nˆ1ë°å ’(›B¯jGäY×ÕÕÞD‡1ˆ%Ò¼]餲²RNPz‡ìêS{|túôé””¹øš¯ ¼4yàÞ|Ö .LNNÆ„YÅ`ñ5“ÄîŒ[¯jzGäfX¿|u`Ý”´Œ5 +Ûl”°~þùçñãÇÛíÜæääÔÖÖhzzú´iÓ„]ï]}j/?š5kÖüѨ +ÊK“îotÞØ$vgÜzUÓ;"7ÉÂæVZ°wúä“OÚ·oÂ|õÕWrÂѳÛM¶èò(ðŠ+ä õÙíNí•Coùì³Ï¶lÙb¾‚òÒä;ï‘ò)Y“5EÖYS-‹5ƒ²uÈ kª5éÿÎM*endstream +endobj +4651 0 obj << +/D [4649 0 R /XYZ 85.039 786.531 null] >> endobj -4550 0 obj << -/D [4545 0 R /XYZ 85.039 529.894 null] +4652 0 obj << +/D [4649 0 R /XYZ 85.039 763.817 null] >> endobj -734 0 obj << -/D [4545 0 R /XYZ 85.039 199.481 null] +4653 0 obj << +/D [4649 0 R /XYZ 85.039 763.817 null] >> endobj -4551 0 obj << -/D [4545 0 R /XYZ 85.039 178.285 null] +4654 0 obj << +/D [4649 0 R /XYZ 327.216 466.8 null] >> endobj -4544 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F56 2890 0 R >> -/ProcSet [ /PDF /Text ] +4648 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im6 4641 0 R /Im1 4096 0 R >> +/ProcSet [ /PDF /Text /ImageC ] >> endobj -4554 0 obj << -/Length 1711 +4657 0 obj << +/Length 2891 /Filter /FlateDecode >> stream -xÚµXkoÛ6ýî_¡u 5-Šz耴I½Ëcu‚h‹V–e[ˆ%j’\'À~üî%)Y¶$w}¡@L‘Wäṇ¼G¥šÿ¨æÙÄ`¾æz±ÕÂd`hK™ ¨Š©Q#æÅí`üʱ4jßðµÛE=oÛw´Ûù;ýå§7·ço†#ƘNM2¹®§_©~zs/†#ª_Mä8vOeóíÅÕÙõÐôô·ªãôêL6î®.þ–­É ¸¾»™?ܾœßÖp¢Œ!Øï>Ú6öz`æ{ÚÚ¡¾¯%ËfĶ˜z^¦ƒ¿ê¹ä˜¥É·º¸±™GlµÉ¡vƒj2bšTsm›8–+Øy5ô,çr;!RÁ“l•öXúøˆ°· bh® ÙÍSÜïø•í4§§6˜bâ4*!&_æð"ßdIÉ—ö0¹ñíêgF-"…¨ärÁæX)Lié½aü¡28 RÙÈ‚eDú2Ââ0ó¸Äv1‚EF-Â,GnÓ$ŒšškRb™Rcز-_ÉÓ÷µ–›!%ÒÆ—ãêÓ0³²èCF=XÕ=ŽlÓ‘_…Ìñ]b¸–@vþåøÃuÌh°Í1©†äƒÖlÅ¢§—eçRÅ‚4!(+ûðÛ&\dþqü»˜#âdŒxŽLÝ©JBÄ£Êýs/.Hž¤ý; -o£ÇÓ±l„Êý@2·J‹*‘»„µõP®T'P94]ƒiTþózrd*Å·J)x\¡h'}Röï¶+뻪°ƒJÀZ••O|Ÿu¥Â{ž5€Ø®ÓŒ8ü­gBÙðáž9†O\ËëÎ\U‰kå¡æWdB—Z-\\®GµÆJ-8UÌq8‡3!œB&KH °hÍI±jað,Êë€Ð†"C[H˜Ý6¶íƒì%_Ïât< äê˜0.c_Â15mýÏ6„Ú°¡´…ÍM§KÙLyžà-ƒíâ±(£¤Ô“p¾&Í{ÑkíɬL²ežF.À±ŒçÏ?…xÈ0|•á¸êßjá(kÏ׌7j†‘ZøÉÉÕ±`Ÿú)¹â[5Á*H—Ñ=iT]\þnWÔ­Ù©ê}ïýË©ü}§s¾-Ô¤Q¹åù}Ív”vU—0ëfd÷LfÁ}›þ*E`“¬"ª²3nð9~JÇ -Òï­µ¿L`•›<= `rq&Úü–oÖó¦ÊÖòidY”’&¢p¥È*õÒó«m=× s(_÷wý>³\W#æXà‚Ž;afQbÒ ßYŸîqÓ“g+ -Y"¢Œ¶}¬å«ö±‘,¹**MQV.6€Â w–°FŸ+3ý…tQª‹w¶x¹q,[keaÖ\¾|/ßÁš_;2ªŸtìcdyb##Ó'¾r­õíÐÐu!,ªl?WòË‚rõ±äñ¦A¥‚LáU¼`ÅøoËž\›G½£ž¡ÓïyLÀ»{–Ǭ,‹F˜ÇA§ƒ©®ÌÐdçu.Aãxì{PƒB©eG½‹éw:¦åÏ•×ÁEZYbt£²= ]S^y[ûiK_ ÓùýÜ0Ùa^Ù Ú KÈá»4Æ’<þ3ÚÛ<ÈQÌ,*IÍç\¸`ƒ)ÿ"je§Êñ_7à)!¢´Á2F¥­»®É}tâ“­²R Tsó´òÌ•W+äã¹°qqÕvJø3õ9x`ÏNÞ%ÇéæÅ3¹Î͘øR©Ü×ô %z÷ThñÕZ üdO ŸÇ uC¦¥{þäŒ'AœV%H,T©Û@.dL -Ã@aߺÐ]N­u6ØûW™l¢¢ìØŸñùãw®#¨Š‹2JÞ±•œó²]N¿fŸGÑϤeÚ0x×YÔÃØÀï¥? ù¦²Jý ¦áVz„÷UYé_h¶<¾>Ý7yüåí¬³>?b‹±n;¢öýcìÔ_ß3»+† .ä5Qç ~ ®þ“¯ ù?y^L»endstream +xÚ­ÙrÛFò]_Á·€U&„ûx”%9ËTtĤãl%y€HˆÄhÔñ÷ÛÇÌ``*I¹Êº{ºgúîì‰ÿìIä›–OÂ(0}מ¬vÖd˜/lA1$3æãòâò“LlËŒ­x²|V|bËôã`²\ÿn\ÿçêqyûy:s]×°ms: Ãȸš:‘q}ýðå~‰ϘßBÐÃ绩 ØÈ5–ó‡{ÆÝ `ž±DÄÕÇé h@x»˜þ¹üéâv©ö©Äv]Üå÷‹ßÿ´&k8ÑO–éÆÑäž-ÓŽãÉîÂó]Ó÷\ñž_,.~Q¼çMxUŸR$Å̵Ì(òÆçûfà…Jqž­)ζlӳ܉$BÍýaÙa÷x¶˜‘M4f'%͉DÛ×%ÚŽéÚΑįYJ]—¨ïך•ïX–ÅÆ{¬Êg@§¨ýºÎÊ"ɇ´ïD –x\-͈:ÑYuŒlÕёدMâ€:ÞX‹´zALZ]^­îeêûF‚+V¨¡tÝ%RžÕו"QÓœÕÔ°´VQÇâúõÔŠëSÓoÂgn“Öä4à3ðÎn3™9¡é„.ÅŽ±^å9¬‹cu¨*ék2n®€yšÏ”áà™ô{—­ª².Ÿù³ ¥‹Ëëù§…àg)ó¬@Œ@¹ßOaWFY‰åÉ¡Ùvva™7i2x†óáK–ðC³M¥äüp½Mòػʹò´Ø¤—Ÿ9šPndvÔ©°#ì +%o“"“Øc׬ÕU…ˆ'â@N‡Ôr×J_w=Ï1nÉO9™lÃÄtž\&BC£¡··†ßN5‘IG×4›*I…|,e#p¨½¤§=úü]ôþ”åÈ´AIï # {þ]kI~oJ¦Ù'xî&[eû¤I–ü+Ž 6tïû†ôÈÎ1cäç+ T_dó¢f½$x–¸(6x§¼ñõ‘r$àžú÷Û£€’C¦H7e“ñ¾!’ҬѬI{xÏ:¼5é[ÓvcË›Z¡œ¯‚.Eb_ œ V3×iVpéCVDxžò$á9TÉø_Ú–àuf_^hFõ}¥ÅªzG²%×­N9£Ô¯SÊS…ÛRV_“K“³—8fx”Ƭ˜MxÆ â“Œè…öqÖñBËxEaÈsVÉ +%cÁ×F>ôz¬t‰5ÓoRI% 9d‘‚GPŸ¾v3n­õ'’+)0öx×=þ›TÈ΋Œ*Q+’'dœ®? Œ„ªÄ,»Ù2ôkb(A!{ÜS¹§|Fþ•Á6YÝTï V™eCH%¢e©Ê‹:§@¿Æ!Ò,²¸¿…ç_¡y==­2Ö4ëÛ1´¦ÀjK¼ÆEòNDNGH³M0Oø'#¿Ub‰œ[•ÓˆD.J˜®'¡ì(öþIÈC¨Œ)=7Y©m Þ–‡\ø5P‹šÁ‹vbkUfVe¡d­d°œjâË·ž¨Ì£ÍKo¸ j´ –ŠüŸ”},±×„‹æ_Ä#¯ݲ; UZt" +(ÅY^­eu†4”«ùQÛXÅu•|µZÉÕäÒª•ãӈŠ4\®Ð7c’¾ø8<Š*E妫ëŠës(nNÜêŸ+®¡å¡R-%#j¿/J᢮¾ª™’*/-9P|µÝ O!²èO„µÜŸØC‚ÊiÄa”“9Œ®n_3jï £â‘(kQF…I2Ò2·çšPý`=.ü²@Ú[öÚXò‰oï~ €ÏSˆþÿ>âëçÂ&xDðÕ‚–} :xºY0vñ¸X~ž:¾ñpÿ#À~&fŒ¸ºAø¯óÅí9ÐÀûŽeV0ÚÁk4T¥ëtjöbДщaPvLØŠmâÄ .ó/Úè%)šdƒöuƒ{¢ €®-Ù¨±@S×B;’ᱜºä%dËþsx±mºQïL ftÓrÜÑCz~lº7>§H¢sƒŠÆlxRéJìUt‰˜þDëÉWôon<ìüˆ¤‡Ë¸¡…‡}R×í¬a6Ãx(k±B¥wx.R™¯CÊ×Ü’–±€Ô š©µêÌQ¢×YJÀºÈ(íT½Å©{tÿ»CÝp3©…j5Úøˆ1nSrÏ#:Í’¡˜Ç¶¢=Å[uà¹?1áAÎŽdë6ìS-͈O ¢³>5"°õ©ŽÄ~ŸÒ$ê>%ÚqÖ¬ðŽ¶i"°p#j\) S7e%o ’‚Ç› Z·cCr)Œ{Œ]‰}¾—bB(ž'®oCp!â;5€F3lItÎc•º{  Kävo©rU—X?p|#-•É6M’c(fèâNì“‹#<áWáѪêÉV¯†] µ×ï¿]@Äà$ŠHtÕ݈†ŒšÛ˜‹Ã@9ÅêÙÿUú|Я˜c7„ž¯â5bçª%z+jÙãÈy3äŽøYÐÉÐ'Òcåi͸$¯K~¢ÂÈC­sÍÓVPΠƯÕÑðLv¬ßµv›áã8Þð:ÑX ü¢†1¡G%¥»ªÜí›6±yZžöVq#ŸeP52çu[9ØÅdÀoÇ=wãõºÍ¸û1-rîqî|g`B\ÈnïΠ0ŸÆr›žvYÐmËu¸g®'‚÷;íøÀ8¨"K”z~wùøM¹—,äPƒ›Ã*MP”›ám'×·ß¹ù¢h09®…Îx6jiF²‘ :›F¶Ù¨#±?ioGFõs7 ý7‘Xòüè~Uôß»ön% +‰,ªÌàL¥êþÑ8Á#²¯zú÷zÈN{Ì0ÿØ¡Ñ ÛI³Ó˜@e§®Ä^;éÿž¤þµb,>ˆð‡ºMr‘>ÐçEy¼¹¾üxs͈’MœV‰H ƒú¡×ˆÆ¿Êi4ƒó…ã{&Øáx¼pþÂxQ`j³& |–w¦@EÙ“!O–Q NŽï˜Nÿý Ã1Ê Îtƒ’è¬[µÌFܪ#±ß­4‰ÿF7ÈʾékæÇ7YD°Y\1rûñIU^QuüZdlÉgéÿ’‹M亡 ã©Œ7‹Í°}$Ñ9ûŒ TöéJìµ.ñK­¾M`ºLv£EöçÑ%¦{±¬<¹“Ç|L_hÞä,T½d«V”–ÛÛöÀU ór£ÙE“G³2H˜V8nE2b¦9kai­1ŽÅõÛ¢G¦ðl›g[µ"äXÁrv¢JD$‚ Is˜†ŠÄV¤¸C„wè½:ËkÕ±ˆ%Úý1q}kZx÷úQìNthí%¡Í×ø'=lPÄo]ê³3‰oo䨽ët¢úЭ®kqÕ͘¯ñÏS&ÆùušäƒÁîú¦íŽ×xFÕÛŒñˆªæØVl†þñ•ß2î’ý^uáPHÀ*~‹¹5+„j)E!µä5W¤'ø×Ë ž4-xé¸ÓƒG ×tíõ*£Vrh¡´ûùoC‡·BÓ;wø–æÔ×å—}FT6ø­ð l˃¶öËîƒ[BQå\Þ~¸þ™,?¼1‰êæ¾£‰³ŠëµO´6fŸl-›‘ËZ$÷†_æ7\R€M{cˆŒˆÏ§ð®ôë~÷²û¥wêí—øù7–:÷ï[š'à©J¿ð|UûÁX\{Yäår ÄsªH惧$ž +óÁL.’.xJøu¯æà—Œ>¤£Dí‹ +viRœêã`ñN÷\ÜpÁ¿wCŽ‘â¹nß#†Ôô—JíuYdÆÑÀ°â;Ð}Ùj3’NwǾ™~äölùÿ=Üwendstream endobj -4553 0 obj << +4656 0 obj << /Type /Page -/Contents 4554 0 R -/Resources 4552 0 R +/Contents 4657 0 R +/Resources 4655 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4525 0 R ->> endobj -4555 0 obj << -/D [4553 0 R /XYZ 85.039 786.531 null] +/Parent 4640 0 R >> endobj -738 0 obj << -/D [4553 0 R /XYZ 85.039 736.632 null] ->> endobj -4556 0 obj << -/D [4553 0 R /XYZ 85.039 707.834 null] +4658 0 obj << +/D [4656 0 R /XYZ 85.039 786.531 null] >> endobj -742 0 obj << -/D [4553 0 R /XYZ 85.039 665.684 null] +618 0 obj << +/D [4656 0 R /XYZ 85.039 520.606 null] >> endobj -4557 0 obj << -/D [4553 0 R /XYZ 85.039 645.094 null] +4659 0 obj << +/D [4656 0 R /XYZ 85.039 484.341 null] >> endobj -4558 0 obj << -/D [4553 0 R /XYZ 318.781 623.298 null] +622 0 obj << +/D [4656 0 R /XYZ 85.039 278.781 null] >> endobj -4559 0 obj << -/D [4553 0 R /XYZ 85.039 366.461 null] +4660 0 obj << +/D [4656 0 R /XYZ 85.039 245.243 null] >> endobj -746 0 obj << -/D [4553 0 R /XYZ 85.039 282.418 null] +626 0 obj << +/D [4656 0 R /XYZ 85.039 135.134 null] >> endobj -4560 0 obj << -/D [4553 0 R /XYZ 85.039 259.1 null] +4661 0 obj << +/D [4656 0 R /XYZ 85.039 100.388 null] >> endobj -4552 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R /F35 2880 0 R >> +4655 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4563 0 obj << -/Length 2004 +4664 0 obj << +/Length 2961 /Filter /FlateDecode >> stream -xÚ¥XKsœF¾ï¯ØJ.l•wÌÃãàƒ’ØŠS±¬Øërª’Ђ$*À˜µ¬Ÿ~Ì«e•¤R.‹¡3=Ý_?X¹öáŸ\§Jøa¶NÒX¨P®÷ÍÊ_ßçr%­ÄÖŠlg2ßíV/ßÄÑZú"ó³õîvÜ'ó…Êâõ®øÍûþÇ‹ëÝë›m†ž Äf›$©÷n#½‹ëkøûv³•ÞÕ%ó‘ü‘—Ÿß^ýð~¤ÞgK¸¸úŸ®ÞþÊ«Ë(ðþÓõÇÍ»ŸV¯w£¹³ É0DcÿZýö‡¿.àb?­|féúÖ¾Y¶nV‘ -…ŠBû^¯>®~÷b^´f­%ߨ0* Oª™s$Ü>”Á:QJÄQBÞiK³Ùª@yw½>tMÞñ[£‹êö‘×­!Þ«o>”]]ís£ûáfÚê+3‹¼lt‹^‹¶ Îþó×ú¡ì™öi(NwD¼G|K̼(Xüu{Wµ%¨Ï­QK’ïòþÏÒèª "{Ùê¦\<ýÌ GÍñz£ap/é+v±Éæm }ß3]ùªX²ê_Ÿ6]îij{o¥JÔÂqê?žÆî“‚øè(ë¶móò·ÛàIdeY ‚\½uמÅ÷Í&<²!쪽%Ý7¹© ¹€–z}y—÷EôöŽ¥ø>°8 ¸H|Oß²,rÈÙ*ž;;“B¦X;Æü ¥Ƴ8ȧJ2ˆL`uøΞ®ù˜®.ó16`G_Þ–ö$I6òíѺ&ç:/"ˆÃ£ûwù])ÎS¥‘©ôÙî0“¡7aÏ  Š!mR=Î÷¾×Mƒ>h ®Þë¾×›Ð÷¸,Ùc·yÖžI†ì‘KYÉD$§Üv ÔF­ªÆ:˜éeOKl¿±dIŽåGª+cê‰9â³ïðO5f2ÌÆÍyq ÝðOÞÛM§”1=æ -x.Ê”÷¶µl~ô%€þ¤˜ð‰¨íÀ¡‡HÆëå!‘Lℳ…³²ú‚fX•1›Q‰„˜KFi0DìðMR2 5? ‰„%_¹®Àœ="™4‰Ú£M˜ÖlÀ”Ã`»q–¡!$í"À^<ÔèóÇ…ÊmÊa¬I8;Øhr«AÄ®^·Ú…5Œ¼£f ùýŽI. æ¬WÑ^˜mø–sõÃkŒ~-v{ÿãGg3-JBñcØ$2晄ÌSs\G±Œ%SžIOb²F.Š¢Â -†™v‰­ÂÁ1Ž¡†àת>—x‘Ê„TÙóöM2ç/Š|‘¦Ÿ%[ûž{æøÞ˃wõº^ßÀEê²aþÃ}Ù²‚ ËBÉMSáKW>©3"„‹¥^¨b‘ÀŠE)Œ´ºva/Ø”¢Á·7õ#ËÞØ"€”ÌHü˜ŽÑðÜVß(I 0jaäöìÑ ¦’‘EÚ÷Ug³P5ÖŽ0´µXX”»®bÕ÷.¥«ÎŒÈµª“ïŽ¦Ö ˆD0únhnÄ^C_§¾Š,*%@"·T5US˪¸¬á2·Š¹1eÃ…ˆe§’Ái¢°rVþ~gÀlñ¹j‘«¹úÚ¬>ÃæÜàï§I©u=„üšÛÕ=6iŒXYMõÃ.·Q@íÎV_Ëbè ¶†ìET{[eNw‚›½tˆÈg¸éŽÑD›¥`V?Ò;Ô¡¢2»… ï¸ â4–»…¹óÁRø.šÎ*Î[æ<àMtÿ'¶c×òýÀ¨ÙF`ßDk?`zÁhö”¡áf] 7ÓxëÚ‡(7‰F^›7®Õ²‰ã(ê†Û¦›zÆRh0^0sfbýÌCž -¨…òˆÈ`.A5l¤‘ö‰:÷×—?WÔö_+UÓRöï*”ZåæHü4£6ö`7#¢ÃØf0ØmÿW°ÔªtÍkpE -ÚÆ‘3xÈU¹0»Œ£%О”'$5%g{ÇOT,ó¾®hP…ïf3u'°i\ö/xèeœ;%{>ÙRõ–¬Iƒ'wÅŸ$¤ùýép20í{277nŠãt‚ÇIç<&p‚öðm±(¹]qv·OfÄ›ÁTæ0;÷–§Ã`©`ÚbÁ²¶tK? @F¼ÀšÌ4!‘Þ0 l+´[Êa.ÅXtUWvÔ+X9çñIhr{i~Ò÷+oî&ÈäÈe3Ù1Õ`MM/zz;·Ý¹Ù*ô¥€”{nv™DÎÏVAš‰$<ž­‚…ÙŠl‡™ -m×8W=Ì­K*Ü%ûn-¼fÅ<sžêã]15¦Á Æ&T8;»P`"ÿùÙm&s~vƒÏJ!Cö9M7©w“oCŒTä\}è—‡DyWïwL¶»éÞ0e¬ -Oæ@r´ÊØí{ÝðË 5þX*Ÿi:/Vo¯9åø넸}¡™M·ÛÓ„ol&Øì,‚”ˆø7ŧ„ÿ Äÿõ{ã4C§"ƒþÅ0¨ €±l4†`(ÕS‹Ý“§&ÿ Yün'endstream +xÚ¥ÙnÛHòÝ_¡·¥Ífó °Xxì$ëÙÄÉŽdL(‘²ˆP¢BR£øï·®nR"í 00`öQ]]]w•Ỗ?5KB×Óé,N"7Ôj¶Ú^x³GØy{¡b. ó̯‹‹«7a4Sž›zél±¶xRÏ Óh¶È¿87ÿ¾þ¸xýûå\kí(å^Îã8q®/ýĹ¹ùðé~;swÿ—>üþþRÁn¢Å݇{Þ»ÅX œn\ÿz9˜|ýpùuñÛÅë…¥sð¥5RùýâËWo–Ë~»ð\&³#Œ=W¥él{„Ú -óêâáâ¿ï3>5Å”P'n˜è1WT8Á•0t£ &®|.w@~^ãËŽ-?óÐ ³©«y%ãé§û»ÿ]½ƒ|€c?dùîÖÅç)s?v= Q¿)€i‘G]£'äÙ/p$„U…ßAæeÛK?v–8ÂEM‹×ïà/ôŠÕ¡);¼ö‰W¯W+Ä[#DNÇëï3|NöXànÃk9®tÙ2k @¦øŠlµª|²e°¦ø~ Š àåñ›å¥ +e’ÒK—óÀKnCw &3"—¯L8–È…ÀKœ-îf{žt5èf{ÎuËp(fA˜çŒ„gŽÉwcïó×Kœ¯k|*ßÛÁ¨¬w|8kW<"ö/1»»¢Y#%´_ô(ë1ÆÎ^3ñh¨Ç$ tOÞ²©[ÿðàòànÇß‚øÁ„£Ž Qce`ÕÖz‚±/x[—ЂkÒ[Ò¾57tñwXé•Ô&œ®$§ÆþŒ=Ÿ©á”Õ.ˆ"ß—ƒü„s—ø’ ™†¦è3gq#ûÃSº?ÓñêgÒ¶œèƒ3äb`ù-æ4š™ŒÌ–1 +åìÉI=òrI(´ó'*L&X6$ ÉÀÝéÐw•çÃñae¾E ÓA ,ÌÉ¥¸Èn.á½Ç2gT'žsnp %½ÏÖ |tG6ªCÍâ ¬Z®QââÔ*ô|ç#Z É4CÂsM±&9…Úh9 Å‹à˜9"è÷äåp¤nxµÜñl›udÒ¸öŒºUºû†õY0 “³&ÛAøwlö‹ÁP¥}o1µ¬í<µÔ¸Ò¨æqSˆL‰u·=Á¹nê­`gܹu[wrÝÐ^DíÿDm-÷™è©ÈÕ*y1ÏÀPDõaW¹)rÅFÔòŒ4ð‰O°é£Ì5J:ô $í÷dø°(vnê-ê ¦ îíÕ[ø‡ÓÈ.ß"ýx¬íšry芜×ßg«M¹ÆN?(Lb -xñA˜gS„0ŒÜ8MOýýÌ['ž³‘ð€ãŒ?­X¨›? :Nu¶*«>vÇ1BâˆEÿd$øÊŽ¿Œ«n q¹kÁòðÝf%²9<ŽŽªàõrE4Àê'f/’k<ŒßÂðÑß²›Ô Ie¤øäÐý4E6:Õò"ÞŒ_Œ iHÉFI2CWMbÃÝ]A8¢G Èû ´#ИaŽkúëÓ|ªdÂqXï +7Ö > α‘ÍâÐ&'2Þýx{ó Å8œ¡c <ñÆucRíPò{{Óò,#e ‰\öx^“ûÍB²@Ò¡†Lž fº™§0Kïöyƒžå‰”ByM3)·{Št}—±vü‹O/Ó p;ÁÆ€Ì7Ç9X”kþBè HE)—LÄü Û:6Øk7Y3HÝŠ²oQ+^ÙÖŒ!‘”r'€;Á»Gu7ˆùueH =ƒþñ¼)öû7èMò“°hpª,Û!“Í[ÆYÕ{2éÞe=Èë3¢¶µËÁ «†ôVʈö‰  ØÚ:¤Ü=ö…J°º´(ø@Á$³‘ëZÞ‘?ði~껑K† µÈn5åýÔõ%p1Åq“$‘)äH:tZqy”UIl Î]f|B³Í³eE}øJ›Í妔ðhö\™Û~Ï+KN– v©d’èg@Š “hæÅ:C®U<¡è:K€dcq[{Ò*e ¸g„¤®JK|Þ[NºF +†äÿ š¶¯ etYW7=®vC t•óùû0Y.fOºÍ€€i +‹œ´ï;&ïhl_Ä2‘ËKŽòŽ+ÿ<ÃJ27YG(|ÅÒì®ø›uX&ähmõÀT}‚Nb +œkÙ ƒ?¬ìMüƒ³õúü¬à4óWÏ䆇iÜŠˆÓXZú¬¡G­䛦z*ÃPIä&˜Jì†q4„8ÿÚœÄѺâÙ<ðµ›Fz:)1PEózš;&ûR#.èP¹±gƒ›þ’ºß½Z“ñaÑæ’u?¾ŠtôŒŠè< |'„‹U"èƒú{,dDJ¾˜¡b±åyú$å\Dƒ Ê>7êSnʶ¡ »&W|)E®Ô¡W¿ÏvP/m‹]Çyôâ2å˃ ò\6­U +Õ/ÓÚÃ<›MûIàÆ:ïžèt·áàω+º‡ 4Îö¢0æ&˜/ñ;V}4lyÛ€0ÞòCÉ1ØTÎÛ€ýO¶÷‚«6¦“I±ÿRðÚDyPŒ†µ{NÕ3‰‡°q”Ö`¹à<8øBí¬}g î½Úqª$ðCÀcF3øæð –æ;ù’>EáyŒ2•JRÿç¡ŽQ¡trÍL*Ä‚AFBSòìw0íËeØ´s¶ÒªÞo{ÙÀþòÐ ±`”[0ºâÇ0Ã*.§äDEž@Æ2dp»)ñ­QÂQ&ª!ŽÖ¤%08k»’Ñ®‡£ºÕ—Œ`wÅQð ŸlÚ—8Zq’ñ‡ë›wW‹ÿðüí§» ,‰©aCZ`õ7Ò(ð¨åj³;€­J‰ª£ÍvI¼ÔÁÆý“Éî,ß/ÜJ‚ãOÜõ†Ñ¨‰ìÅègqkSäfw vçïöY’—pv÷—`¡çL²Þ>jE2õDZp“H VXZ¸´™²¤A]’S¦OX™I)¦½š¯B×Ó½ÚæÙ¦‡‚x'C aWš¢<12eFÊémyØÉvœ>M“ªà„/÷g0Ï:`!)Ò' NéY0 1;š‚LAIÒ•(×>‡pî;òo0ECï†i>b,·e•5<áΦgTsÂ;Ç "ãÁ(“TΤ«¿$Æ5r~~† ÔÂ7ΧýKn3Œ\/6¸¸Œ|„LÙTÔAà9wSn;,™Q+Qw…ãê@°A§‚5Rû¦:Á2Ýôêöö'†¶okHÖƒudQåRAÚnùà’ŸN»Ý ^ö».Ò(ÈF˜e–tR~ÂÔù‰Oݘ®ªR<ûü´ÉPÜ!ÿ'1¥Aƒè:ÁS çW\Ä¿pÀ`¢×¨ÚL~&—c5oÛОí‹3ŒƒŸ þ!B–'Ÿv»[#*‘õ*y¥ùacÙûFºªZKY³°Å@m²vPäì¸]m³Œ1ª‰žÒ_0·eí h­*û¦T@ÏH=ýi©ƒëðL2À4CiµÆ+۹Ζgþ!kágœÇ-£¾¢K¹<Û¶#ç3%a§ –éGjø¾ÐCß*= (‰{´¥`Òk0‹šß957ç}z.ýVÓ¯£ÿ8“+ÄoÛWÀ×¼cØ„c$¿é'¾mÖ<ñÛ®5—A¥\w#jß°HÉlð>üᄇdä +ÐÔ¶Àc“AcsÛö‘žO¥üL´ž.€„C«²a+HÜ4ñ§£Vµ¯,1`õ9Åæ7ÿ1Éÿšùëendstream endobj -4562 0 obj << +4663 0 obj << /Type /Page -/Contents 4563 0 R -/Resources 4561 0 R +/Contents 4664 0 R +/Resources 4662 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4568 0 R +/Parent 4640 0 R >> endobj -4564 0 obj << -/D [4562 0 R /XYZ 85.039 786.531 null] +4665 0 obj << +/D [4663 0 R /XYZ 85.039 786.531 null] >> endobj -750 0 obj << -/D [4562 0 R /XYZ 85.039 557.958 null] +630 0 obj << +/D [4663 0 R /XYZ 85.039 616.318 null] >> endobj -4565 0 obj << -/D [4562 0 R /XYZ 85.039 531.344 null] +4666 0 obj << +/D [4663 0 R /XYZ 85.039 580.908 null] >> endobj -754 0 obj << -/D [4562 0 R /XYZ 85.039 473.31 null] +4667 0 obj << +/D [4663 0 R /XYZ 351.735 437.513 null] >> endobj -4566 0 obj << -/D [4562 0 R /XYZ 85.039 452.113 null] +4668 0 obj << +/D [4663 0 R /XYZ 85.039 369.239 null] >> endobj -758 0 obj << -/D [4562 0 R /XYZ 85.039 301.56 null] +634 0 obj << +/D [4663 0 R /XYZ 85.039 352.003 null] >> endobj -4567 0 obj << -/D [4562 0 R /XYZ 85.039 280.363 null] +4669 0 obj << +/D [4663 0 R /XYZ 85.039 309.05 null] >> endobj -4561 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R >> +638 0 obj << +/D [4663 0 R /XYZ 85.039 215.279 null] +>> endobj +4670 0 obj << +/D [4663 0 R /XYZ 85.039 178.412 null] +>> endobj +4662 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4571 0 obj << -/Length 3117 +4673 0 obj << +/Length 1972 /Filter /FlateDecode >> stream -xÚYYÛÈ~÷¯˜G -°dÞGÞ¼‡ÞÍ3†$yèi‰ŠÔ’Ôùõ©¯ªºII”±`Ô¬®¾ªëøª:¸óé/¸Ë“wYžn’(¸ÛÞùw;êùû»@9â$Ú$qLí…εí]§áƳE]c…ñ&Îcðüôðîçп ýMšFwßï‚ ÜDAx—Å&ɲ»‡òß^mVë$ñ½Oõ*ðšêýj¥©÷KÝWÛ±[E¾×¿”y¦-¥q¿7«(ðúJ>?n·Õ0¬þûðÚÊšÖ/ü”§þ¹kǾk¸ëݯn³º×4‹7iüð83>NÜ>-Pœ'Ê6Y\ðšËçU’Ò^é0ÛÕ:ð*Út˜%ÞoD¸G3ö¾Õè-»U˜{/h©w"ÊÀüý  ·Æ÷Îúç©j1`lÞd–#~¼ -cú#‹î•?Jé~Ù?·þã1Ë5ÌS¯¬{âeFo¯s±hÑöXVEàÚåXÓÖXäÔ˜‘~êŽç¼î;~鎪¡;õ[žw.Le—*…ë¹6Ò¸7œåÑkI|4Ûn–Gì׫èªéçÿ*á¨[a÷2{˜…Ø^k×êÏ»ïM´¡c»=Ëqá”ÕëQVÝŽ¤”qÚ[‹âÂû†s·²U<.ä¶ùAëú'sÏ”‡º­í•Žƒ!ië¾Y4ºï#. Ím×âžOƒ•¦éùcÇr,YivK‹ýiá4f+ -8è¥ÄA,*Ù‰"A­`ÜÁ€ÆËž7+5÷&N˜h?ŠÞÉÉt æã‹z.ÿ{+®gH¯¬„¬§ìWº¯Ä{©i JÄ}eÛ4òz-B…Îñ–ÏÏ7@Âç?Ó€(ÍIjN¸ôõ²¯aˆH;Ž,±ÚʱpÕ;á“K€z;“Æ=¦…÷Ow ì¾Ña¥lMúÏ“ÝI{9ƒ_pȵtz³$Ñ^·jxˆZ×0[ìîýh±ÿú7Ö2hÃ|êºæÌ_YM_I¾¹h·Ø 6Zcµ•s„QºèŠ¢X]M€QlÀÔþn²Ó AîüÎt‰ú۽Юœ"-'Ë<×|7íAW壬Î""HÙEDAÆ—jú±ÞžÝ¨ç.”²&™²DqͨªŒ>™+¥] 'ÃçùŸÐNX^@°f¸׉q8 ¾<\ä0ÝÐK=جåYºE£†M€µ®ÜH|¼Í(¢-Œß Î>Ò sD§˜Ý(Ô"u C|­!tÖTßt…KeŒÎc‘S!«þE‹#}`QÑ9Ä9aÌŠælj¶bà†™SÐJ,B‰$rV­‹@à´#öjRü!ÑP†s”.…ÎSõóÀª¬?Ôî(+?W‘Q?9ïõM­Q *21lŽa‘Z_*¢¶fÏŸ¼‰Ã™ -ù|é´öÁ~ˆìC‡zת]ÄKukôêÖQ’ãæe¶>YL+¢z$¥6u;#k u L“Y0ò°:åfuŠ‰li -ƒ);ö錽Aà£Ð/ßÒÏ_tµÓ2]]íïPõ[ë–Ms–¾ÈÀ“¢ÒñÈNŠ§íäUˆdó™|!tSž1ƒ@6P"·é ƒ‹4§¹RòÔì`,e°ï0ß3äÂ.’û,—Hÿ ×8yW¬‡>YcÿÒ–f¬Ù“’|˜.ŽÀ#›Wm‘ -$ÚƒÐÊq¨Áw)AÔè¡xLSÊ ü^Ê.ï÷éëö’än\ŸixñU‡›®éAà43œ²—Ö j+è“hhÌŸ«/âÓ6±Š®´_0¾€¬^<hL¯,T™-‘ª°Y;U×á|#[õ•ì(yg@×Fg¶)ê’ËšŸn¨àÄInSŒ$›²Ïu$üÊæ ‡h0T4L8¬„xƦQþª9ÎtØB–ÆGCMßè,7ÛA¾Œãx¥ãÛÑŒõTŠz#3>ʘ©Ày;s¢Â“>V®”.—'†=' íÓæFÑ=ŒƒM…?,ºÏxìBo¢8ÝÃ0¶ï x\xŸðZ@žðÔ»œ0M§gƒŸª¶âºæÊÈý…ñ÷Æ?~ Šb“Æò¶1+sG$Ønʻ՘PÅ”¾¦• šMâ%Þ¤z­/]/qHE*œ*D¤Ìi!J@Ñu‰”Y¦5;©MÞ.&§üp^„ªt --â£í¼µÅ½ý…º3§ÚÐqj+4@ãr:£”z¸œt )9óׂÀ\®šéOF&ã¿ac>eáüŠ®C)Íijd9’Büü”Dß™¼­ÈŸñ~‰áÓ* k@Ú’Ícß¼å ErŠ¤?X~^²<듨T<ßo˜oÒ,u3aÃtéÙÕŠQ¼ ¢/(,Wë¥é|½¨Ø$yr¶åõzAˆEjõ™N>Ķ¨ñ À~-™Êg„tÿºRÁz$¹r˜ï€üË‹±Wû!«e×2ØIüO›;›ê0¸â£Èí»ª(|ÆÞñ)&3°­€—ÔÖÕ4ñ}®²6 ¤äg¾Nu˜èeßý•×—BÒÍâìõ ŸÓcÈ‚ ðàØÒ(Fé”_- Ñi®‹Ý±ÂnÀ«<³æoŽ xbÒW0…‡?->d©ƒd(G3 ö¥] ²Y¡6ËÎ,6KíªAfÜtý(v…Yz6QÓíì:8½¶´ZµVE[OóN’ ‹=öREœ_ #óýëš'ròIfƒÍþkËéa‹ç®ËéÙ˜pª¸ô¹P Ñ0¯a8JÄ—}…ê—pvúËO£’I!óðÛ(ÊiñL+Ñv¯h¼ÍOàòØyZø¥[±×Ë2¹+y úÐÒÛ§ù¦9ÎlÜ-ô¦•L+“@ÊÜ>ÁÄÚÛ[X,J6qÍãÅMØ3±^#Â×›4tÓ1( ÒË5“(§àý`Ñÿ\òúendstream +xÚµYÝ“Û4Ï_‘’™FH²å¾µ¥…cèzéÀ åÁ;‰ibÛ¹Ìý÷ìj%EN|>è0%²´ÒîþöS:1åðŸ˜&Šñ ÆIÄT ¦«ý„O7°òýDŠ…!Yx4¯—“oß©h*8Ky:]®Ý9)g*¦Ëü÷Ù›^ý¼|ûq¾‚`&›/â8™½šËdöæ͇O·K\ g7·ïpêÃÇ÷s«I0[Þ|¸¥µïpæÂÙ^½ž/€æßÞÍÿXþ8y»trzšˆ @)ÿšüþŸæ Ñ΂4™ž`Ì™HÓé~ª€©00ß»ÉÝäw­…SÚ5Š +¦’à¡PQŠEa¬Q9dm{šËxV79èñ™+@Tùö]$½|º1ãÀ7µûy g÷°¶´§œ6ôXE!‹À"\Ó¯²Š`¿Ÿ/Á‚>ŽmøåôÕÕ/Ÿ€0JSÆãhÔ<­v(ý’;£g×Í>Ûõêº1ÝŸND ìð¸Çtñ¬xIªßg„ã’Dûf¾PRA»Aèú‰$Û!Jnv9ݽMM +>òÒl.V 8à5–9é;ìêlÜjÕ ¤v^ìO|ÑI›zgðx˜«h–íŽçß-ú)a[šóààcsF»\6[:„lkÎÐ š½2¶rÜ@˜i‘ÏÜÓÈ’º·Å鶟û°U–àŒŸE^é>‡"ëˆæßœ6jDC¤@rÐwNó€Ã*6¯µí.Z骺£Á>ëVˆÍ?!x¶ͯŽMc¯Ð Ðw ¥¸«uN„kmX+jfØaæz‚I2¼ÏR;Êi<õ•+Z_µk×'å°ÌxÊÁg‘ù_uߣ^X7+*7α4{*w&¬u”›8¾÷Àê[†ë˜1+°wmøu{†šœ^׿ÍðËÜÚ.·wX{4So@0s³æÑäš¹0Ñj∗NWHků«Ù£Íº«É VÄ ìWmll¯‰#ÀSÚªnv8ññâ‡?„^_ÿt@ÐÎ¥[ßëübæÉ“5Ú2íeb/ÖsZ¥&ÃÛÝeË àÌÖ‡á¨+¦a"k6È^o/È÷_Жö@´²®u÷²¡å†[sº-Ñ\»GF‡Ñù)Ô¸& xðÞ±@™ò,Fá.ôDãH§²¥“á‹z +Ü~å„p¿AŠ_µ£ã> 6Ž‘îj\Ö¨Qy™&x·î—@㦼¶^¯}÷Û˜Àåƒ9 ÅÍQ¬um$ +ûëÜM¥%ÿ2€ŽK~‘4É>âCQ +³~ºB#F˜oÂÄ‘ívZ@à}ræŒDÏÙ"¡­[Óìf毻ƒ­ŠHåj¿[=mÍi:¾póƒõN·wSwÎGÈ߃ž× àrñdÑ’µŸ~³Hÿñ›…bJ¦ùD/ …„»gk…ÙTEN“èuøkÀø‚_Ó­ Eì¢'Ö.Ntv*³Æl"Üqøéöæ7õá E@p"3½„3†ÛµþÆX +r‡*•7tÁº8kM"¢ž!chªˆ…ÒºªµÊÐØz&[(Î!@5ºÛ té + í@yã,ßkç-ۮɺÒù’r`¡ÿCí¶hAœïŒƒï胳ѹü¡<³£5·^J,uºTžg£C.Œr>»âÁ•°ÝSÙÜ•7J.aé2”²{ÔmWê\MÒ U’^·ª‘­SÆó¢ËÊ]kª˜©›Ç¶¬6fR1×4þ¯žõšbmËnW÷º‰-ía`5üÌw G^ÀÍ*ÔÆô T®ÇZ_ôÂB'\]– +÷R9p U"ÇŸ<})“°*XŠÝ­{(ZREï°0à.ÑoŸ-µQ +B×6ËïõO¡û“ŽVÞÔû½n*ò§ääœÅrüyΣÑröìgŸZ˜  ¥‘$Di†zí.BöòœÂ»\(B?XpV×zìjñC?ã"‘kÿBy-XN«ÔiÍ{¡WftèGP»otKMËV ³ü̺¦¡½ëé­xÁ…ê?zn‰gÔU9Ìe¤¿w™ùG¨E,ÿÏ‹6>Ñß.Íÿ(£ü§¿8ç Á1¼§š~~–`p‡—Û?,\‹ü7ÐÐendstream endobj -4570 0 obj << +4672 0 obj << /Type /Page -/Contents 4571 0 R -/Resources 4569 0 R +/Contents 4673 0 R +/Resources 4671 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4568 0 R ->> endobj -4572 0 obj << -/D [4570 0 R /XYZ 85.039 786.531 null] +/Parent 4640 0 R >> endobj -762 0 obj << -/D [4570 0 R /XYZ 85.039 766.606 null] ->> endobj -2959 0 obj << -/D [4570 0 R /XYZ 85.039 651.298 null] +4674 0 obj << +/D [4672 0 R /XYZ 85.039 786.531 null] >> endobj -766 0 obj << -/D [4570 0 R /XYZ 85.039 241.932 null] +642 0 obj << +/D [4672 0 R /XYZ 85.039 127.821 null] >> endobj -4573 0 obj << -/D [4570 0 R /XYZ 85.039 213.197 null] +4675 0 obj << +/D [4672 0 R /XYZ 85.039 93.681 null] >> endobj -4569 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F14 2895 0 R /F66 3242 0 R >> +4671 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F41 2994 0 R /F58 3360 0 R /F35 2976 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4576 0 obj << -/Length 3870 -/Filter /FlateDecode ->> -stream -xÚ¥ZYsÛ8~÷¯Ð#U1$Ásß²žd'S‰ãœÍlÍÌ,Ñw$QCR±ýï·/’hy«¶R1ÉF£Ñ_P<‰à_<)³0RÕ¤(ó0Sñd±½Š&+hùÇU,3a™y<¿»zû!O'qVQ5¹{°rª(̪|r·ü-¸þùÝíÝû¯Ó™R*ˆU8E|˜ÆÁÇé,>½‡·7ÜúÓǯï¯ï¾|–*ø7“ÞÝü„/i0¶Ÿß}}/äiR×ØÿûÏçL¾þrs÷›¾|šOÿ¸ûåêý€7ÅX)Tÿ¯«ßþˆ&K˜ê/WQ¨ªròïQWÕd{•f*ÌR%ß›«ùÕ?­,nK'ÜklµÒ$“^T–e:ÊÇI¨â–4ËÂ<-ì’Æþ’ÆIæE>1L¸¦¿Gqq:¿X¥0±‰'ë|@f9/ÏýñTfev4Þ\oï§YhXæ¬ ækÝágÍŸ?Õ Oºk†¦Ýõ¨Ì ó$F82¬WE²>4WÁ¢Ýa7ؽաƒ¿ÍnÅ =J'áiž}= ÐÔs›ÞAËÒ -À­ºvÄžÙ’žÚD2ÊW&IUXd(…ÊôÛûä<ŒhÁÆå…𡦧”H'5võ0MŠàui»?QÒd–Ti˜'ùÑÄõrÛ úM?tzh;X¼$ -hÄ0-ú¨ñã‰eÇA·hz\â$ Z”þÿÔݬk–†¥Çæ8Z~¢x=4ÌÈ$OsÔ?÷õÜró~:åy¸)QAA^NøCJ|z·dï]‡Íõxwך4Eí¡ëá´gIÜ!ûšæRòØ›uî‰Ä–5oñ37ñ°¹,nx˜ÙÁt³l ÌJ‹’4L]ÕÔq`Š dtlSœ55ÑŽjá“P`GÛ¶«ýif4ËMó§(‘dUðhúâÇç9>Ëà;™4nTKæÑsóÍ?fëNZê'o/"íØKl„&Úá+KØ,Û-д«?:ÔI©ŽR±f:Ëu?ŒX}‡ŸùȦ5ªÿÌ*àÒâ8z-릖½ ›W‘ -s8Y¾9 fÓãL!MÓàn]3Vßë¾Y0¶·û †Œ ¾Í)G¶vXÓÉùëà>r -Ràû²îi³;”…[ š‰uÝÕÍ.<ƒLà¼HC•%—AÚcz¤ Ó+ }q@éÓñFAÚï2HƒÇ̃ëO¯ãó/Ö4ñ4d;Œ½+ˆ†¨ÒŠsf0¤í©Sƒ&»©¹+¢1>?£æ×ï„K´G€‡Ûè䳯Íð0Ê;Ü~TœšZ‘ˆN¢Ú°® ·¸‚ƒˆþÍHõ—4‘DPIÀ°´A+ÚÔÇ»”§µkê¾ã'†(z‹êâh2ø(øF3`Ÿ™õ¡~ô‡¬Û½‡Ñ[mW¾RpöaD…½h60èö<-ÓàÍ9f=“Lœq”ñÌ£4èê­nèØ‘Öˆ4B伶ÑàÄÖÖ2€áçJ`úÜK—–Ù{ ’a‹¦³¹àM‘=PG/.Ôߣ,êì9è83Šƒ;2‹L±f°8ßåù8ýíÃPË+í<É3˜$QÄ7ÓöØ"C#.'ËpölW;^ E»Ýƒ- -Ò8­Y>ö18D=¬[Ú陵ÆËå!ü’ÓH¦× éÒ€’NƇ$o¼ÏsŸï¸‡èÊa»ùÐ eÂC „aMxÕVk&|Û5OøV·Øó ƒæ qð«/ä@5r;)˜Ë¡§—Œ¬ · íËüã¯üʼnª”ʉ@ê7²§·ŸØOLnz~ZÜh0ôåæ“d1ÄHc)D*Ñ‚Œ¶î6Ï´2«ómOB3=P„¬TŽA‡šŒ´úÃ~ja¸z¦:ûÛ"e*øøÀýqðvxsʶãV,ÐÚ¢d:xÔöØ Nm¸Åpƒø[þàøŠÎ No£qYÎ ±"n&ŠÅ07Ì’àúÐu^`‡a 1²=¤* 8„å „´Ø´«gfÚÓ€ÃCkÃÙž(HÃÓmœwC¦Æ‘ΓùpŽßoÉÁ`Î÷ÌYM&WïXÀÕ© -³Àû^< òe@x ¼ Êø‘Ì®$³Ã&öÝ®ÞV -\ámß™xóNk)ýÝŽâð›¾ÝÈa-7çC¦C^*F£À³¢¼°Ì¯­›=¾)ëL ‰äGã\(±ÇIÒ‚$—Þ±”`÷÷˜ bx†–^—a Lòþ`yú‘iÕ;0H³+K±»DÁVц8‰CNÔk?ÔÓÖZÅew³îj“z`S³cCÙj>2H³¦ïÇQŠ†È¶ÇÅä¾Òb2’‘ðå°÷Ì“‚dÿ¨×=Ò -2€èriÇã!|O âË4'|¯“E¨XÐ)Á ¢´ `ò"˜c’¹å÷w‹EMþ>‡ð³Ý±ŸAEfóË -vw>Ü[õ2¼\¶¸åƒÂ‰ËZºs…ïÛÖD3i 1ÑÖ®ª¶› -t‹E‹v…EÊT¸‰ žýðƒNƒ^ºaȪ{-„†Ú¸vÞáåíó|dãOcg„«›»”_Þ2:%QôÄoBøõ–Ÿ8f½=Ê–SÂjz í 7ÁÐ¥ÃÄnuÃE U›ÁK¯¢@’|l¦Ò bó¸V¡•Ä©K¡U¬©à¹ïZ[L sNè‰â„ %©5'SâU‰áÈ[ÆÊó+?šŽ"JÚ19È!ÏêCÓÙ4—åS¸+£ö¦¢Ñ6£Á'$³€¿ùE0=š®!§¿‘g{øÕ7+ -1pmÖú°e)deÖACÅÖH•Ò¡fƌ°ÍL¡­áÈåO¦hsÍ^¤D¬Æï¹—ÕŒÕ|êÍ~jãáABì{ -Ü—+Éέ?ÃL[pN …õNÒ‚—°K•q˜féEhðx,vÅa…±†•Waž”xÅAŒ†9êœA -œ0Ü4A­ÔíîÃœñìÃý©Â2COQp8—Æ‹LD±ËmɤȆ RÔØœs€ÙH]ž³ãy!‡neJ¸­÷xèãì8ĤHÈÔVÒ8g.¤#'õxAYœ›È˜©~•ÚÈäží1â$C*B_;µ#1*é£`~Šùî÷¸KÁj‚Ê8gèŽoT|1K¿òÇcÚ YªÈ^Q‘ N*Ÿ±)AÂËë¥RÁŽƒôÜPš ƒlkÍâüB#p`^€O31Â82 “«’Äîpad¬ðjêÏä"V¨j&öƒ ¬ÝcR`öÿ×ê̶c'ÞñsdÙ,ï¸ÜËRÙ‰!Ó9vÉ]+r0"¢ƒ‚=iÇ̸έœOÖ+B{a= FJ¨²:Éj€Ð·[ËÏY¦{G?9JŽ`IzÉêlÉÁU¶ ÝDuØGÔÄyã¹Ò‚våŠ2ÌÐi+±Sw&Ž9÷b^Nf¾ÁwµlM AUw‚….ºŠCem± hRHfµ)$œ«ó›ÃŸ¤æΧå‚KÏ4œZ¢*ÐüA£º¸¸I½¾¸àq$£oÍš`¿Ç#W°6—™ØDI0<ë'Šøñ6鈾¬÷¤­¯íÝ&7˜¦ï)Ç2UÞ3 è׋º‹“®þÑP•Ù_ç·¡eæö’óÂe(Ä\1ßÖV÷zU‡Ì]$÷,ÆÛo¬Pz›ò‰ð³(]ŠXÜRÓ‚CÜ4l±¤àpkšcѤax¡ÃvZÂŒò°ÌÊI\aôBÌdxf“ Ï‚&ÄŠßè­‰ÝözQŸ ^daœÇ—ž³Á#¶2 ËühlŠÊòüÖ\e~èLÞò3?yÅœŸž/çøh;˜ŽHØÚCC¸ -0öL$øBÙYÊ]8¯ÓŒ_„´i‚¿>¾é^ ¾ÇO!ZÞD®Þ`!25•¼¤².?…€{§·Ö‡(O;äs6´ÄQ¢øÍj:-7½¦Ú&Rd`,ñ¨Œ|ð-->¿Û+Ú’Oq9L£„“\£³b _iŽoO«44‹:7rQv¶èéKÊj4 þ 0¸Ð:Š}‡šˆóGßü‚q&>»fE¹öÐoÆrîö¾¯;ç…$°Ðæ2•3Cåo~ê®6WœÔšËÝÝ uš=y©ŽãÒwñ‚s½ÏlG E¤³QŠ™? pª&Àøòs!É°àmªe%ÅDÅ:¹ýo­zo^„Ž¤ -“¬x:Óè&úí“¦å aÍÐüà|,ôùL§* -s€‹: Ï™N'·ùQ—Ù‘N)ÅɬõS“1SUT\uæ[¿†÷•-ĺ{ -*#¡˜o¦Ž5&á‚Ìlo\‚n8*ša!PAR‚™æ{dËe¨¸‚÷…Mý7¼mUAÉ4ÆÒTpK1±‰hû<=£“2?te%à!¦‰û+W†æˆœ F~çÀw-|ÝîV¦ï°fçùúÓjŸŸVƒÔô;9‚°€òvëîHíÚÿh ÊžþŒÂ[xøúx¤7¢¥-ÆâH“iÏTR8Á`þmP,W+…C÷ÌÍÞÓmué,(9²ˆ„Îêâ~Àd¥fêÐrK9«Òeδ쉗Îá+ºÆÁÖKL3‰QÓT|> +stream +xÚ­XÝoÓHÏ_aéîÁ‘°ÙODº‡BÛ£-½6$àÁIœÔ"Žs¶Cá¿¿™µã$N +w¨J½Þ™ßÌÎΚ; þ¸iŸÉØ £À×’;Ó|ÀœPþpËáY¯Ãób!ŒwÌ°¬AªpgóHgYM v T/™² jÊÜb‰æ@öVô¬ŒµÂ-0~Ëï4[¬ìlý³IM³ÆdE/y²JéžC'‰’ÁÐT‚¹@´ÊÔ<£ñÚ™ ­:ËCPÖ5ίT¥ ~Öaù! !l²MIòO¹ÓdLгf#Ïm8–8içPkÉšÔ™Á®í8¯Ü*ŠZ'•ñçqF¢¦‰tg…•m×?ÚŠ–] +<­ÌÕÜÉë)½4ÖK !÷ËÌä ƒ +ξ]Yª›Ë:›n–fdBª´‹È™ÚF*‹²Nh3ymâbi."”21îÉIØ(A¬.)•v‰(ÁäÄg²D£ DúÑR¶®áî2Á(£È8ÝŸwè43/p•gw^\Ù\±›Ö +TL»ó²ÈqÐ~HiÜDËþ„¦0 ª¡_L”W3€ž Ý$u •«AÀÝûÔ Íy@Xv‹’Ô Êwú<°â©\84¸ëÔ§†Ûë°¨}™èì‡ë7ªC½¯ú  6­›»›ýÐÞ"&tYžìßé»È\5ª$vâöÉ]ÿ€‚ùJœþ®Ôá9 åA‡ÄqOhÛxJ] `GßÅ·f+O7uzªo¤bTEý[_ï˜ÙJŸO»æTôì)™[QÊöà(µ¯èƒê¾cð“ÍG²ÿþ±µ †Šüjf/8Z_ðÖ“Ì\ï[¬eeWö˜ü/ Úlýendstream endobj -4575 0 obj << +4677 0 obj << /Type /Page -/Contents 4576 0 R -/Resources 4574 0 R +/Contents 4678 0 R +/Resources 4676 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4568 0 R ->> endobj -4577 0 obj << -/D [4575 0 R /XYZ 85.039 786.531 null] +/Parent 4683 0 R +/Annots [ 4680 0 R ] >> endobj -770 0 obj << -/D [4575 0 R /XYZ 85.039 493.201 null] +4680 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [349.275 614.049 376.268 625.738] +/Subtype /Link +/A << /S /GoTo /D (XMLpassdb) >> >> endobj -4578 0 obj << -/D [4575 0 R /XYZ 85.039 463.797 null] +4679 0 obj << +/D [4677 0 R /XYZ 85.039 786.531 null] >> endobj -774 0 obj << -/D [4575 0 R /XYZ 85.039 381.454 null] +4681 0 obj << +/D [4677 0 R /XYZ 85.039 174.626 null] >> endobj -4579 0 obj << -/D [4575 0 R /XYZ 85.039 360.258 null] +4682 0 obj << +/D [4677 0 R /XYZ 85.039 145.406 null] >> endobj -4574 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F66 3242 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R >> +4676 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4582 0 obj << -/Length 4079 -/Filter /FlateDecode ->> -stream -xÚÍ[ÝsÛ¸÷_¡ÞK虈!>øu/Ÿ“´¹Iâ6öÍõæz´HY¬)RGRqüßw?´(%í¹3?‹°ûÃî‹þÄ" ý@¥‹8‰üP‰Åj{,î å/gÂP, ÉÒ¡ùáæìÕÛH/Dà§Aº¸Y|ÒÀÓhq“ÿê]þõâo7o>/•RžPþù2Žïí¹ðÞ/…÷þ ”^rëëwŸÞ\Þ\}:O”÷ W]||í]Ù_/>½1Õç2ñ.±ÿ%ö¿¾æêË«7Ÿ°éêýõùo7?ž½¹&àLQ(…âÿ~öëoÁ"‡©þxø*MP|‘¦‹í™•je¾«³ë³¿¼¸M/¸×Üj…*ñÃD.—å*ªp‡¡é˜Ö«¬aBN­¨»²/?ã| -˜_xÿ „†ÖÊ|"e¶%R®¨ ¢9_B‡æ~åñ%¥ô>à"…©÷34”uN¤2ö:î›} SÓoÊŽ»Ü¢ \΋u¶Çz⫼›MÉc–&«;\~XŠ¥À•Jifýåí‘Mì]ƒàÀô6ãOj¢Ñ¯o¸n•µ-T?òW¿)¸°kIW×Ñ,iÝAÖvᄇ6E–F†ýj[¦,qò¾æ"JŠKØV*Wú¬-f&øñê†õ°Îœ}ƒo”˜x\þ å-¿0A³ã•o¡#T×w\M{ìúbË}ŠšÅmì¼%1© -öâPœË(/Z`¦fý‚€&ØTÍü¡¬ïÐø‚È˪Š qnD¸' ß™¡æ§F¢:ÛÒ”Cxûž«›ÚPvÀ¸²…÷”I~t†§ísEIrÔsÓ[ƒŠ:zþ=¿z«\+cLU°ë‡_Þ¾{ÿÆ¿ùÇ jgè}x|[V…ßéù{û¸¶ßÄijIì§Â²ºnpøÐ[áÈU‘µÕãy¢¬´N½w5·fôÙ)b‘-lIóZJ-ü$”“Éyö¸€éÔª^ZnèvÙÊ­æÀr¹5mQð`[F—¹Àz šI³$¢/($)X¥?/#!½p#‘¬ ~Üñs¤¥JP¡Ç=[eµÏuMf©¼‡ ŠL$k0JÚì«œ«®y7krÓ ‡Zs‘µÚúMkg^˜¦ÖȀ͚°üÅH¼‹º{ÿ%êdýÇnd;TÖ£QÓðs U_ÊHC(¤ì:·]Ïß% -Š¥[`3ˆh/[ÑRšníöBSÏè…]‘˜Úü‘¡zßñº—.ͨ­A_¶)`e -XÑ•·ÕXe5â¡’`æ ­ ¤ƒ´€8K¢¬¶'‚,eëTS”MÍ•´ö 9×Ü2º9}TJZ#œ{žUþÓóZØM²ˆ”òã@Ïž²–féÑ)+ת…ô•'œýë²-VË*ðZœVÊ[ì2úΰ×Õ‚“+–ÚÄI© ÉP¨‘·BL„"} B$.Ê"5Û¯¯ ¨¶Éî6[¡ÝCÍ’&Pe݆›^Äs6 Å$TñêL } ¨Ìí/xäÌŒ›ñg^& -KÚ2Dà)àKp'¸WTå¶ì ´I K< ‹ì1êÞñ—“ŠO¬–Ô*kó%)PeD Þ‹W/¸gf8”ý SÊKB -R7} -j°ò~EI0º28ê,ôm6øgˆ?F =•1”:¯ìŠ Æø8º²±tTóÃTùAŸÖ|‡è¸æ["ÒüÖZÝç‚ÿ]^Ô}‰È¶b÷£©´>H|Ê“"Yš‘¦z/àˆ ÄD$Ò{@ã9LBë¨!„`Û~Õ›†Iv;ߦí™QÆí¸SÁ%¨mÖü›·4{ëŸ!›ˆÌ½ ©˜¤±W•÷LMæFÎ|ÀÁ‡%Ž¦Ž×÷s¾Eì ™Cêɵ¬)v­{°“;-·æewÏ¥!{_ÒdŒlIÚ±! ÛòCáãÿò‰}ø@ÚÖæ¨Å"Ë#d=¹\•j—æÐ3§›·™Žã´­:ØáóƒØâ²:‚ã‘Þ!96P,¯6LÞíW8¤ùrÜ@êõÈî -{ÃÂègPJ €%Ì:o›}ÝùÌvh„]ålrÎpX®f¬”]ž?Hà= -vñ¢ÄáêfBÂã 'T1 £6——ãQ{òëh‹µJ– ¸1Ãì:]é$'sG†eO’ž)0Q½a³ÿµ·:eš*¤¿·"lð…1öjúxä¥Qd€Ð_™ÀgÚ:!‘ölÌE¦$-»®ÂÅe;n…"„P|ØNk±{Ò†:öqBËÂ}† Ç¨‚ÁVŽè‰êMÔc2 –=z:A…ÄŸþ N7éZ7vÙ1ž³}8ÆEâiÌ…4ֿƲˆmS›yc—u³ç#Œ¾Èê&ã[—È9>¬94¨9×BŸ] mqq´p"-MŸ«y9¤&Ï p9ˆÇTȆüüyçõ q*{J£´LØõˆìÔºßñïÓÉØuãöÏçaÈKX6û™¨8ɤ‚CvD+ÎÆ8GßKÖ'b¬bŽK©×63q -~ «€|(uü1.|¬>æ2Ôd7Å0Ã%M*ǃ9ÝQjˆe¢æœ÷åt,|!¾Å8DÇqÃኽ§Í½§Ü[dBŒd6ØôËË}?ÁÄ~¤ôI‘,ÍHOb˜PWODb_n*TÃ Ç -|‘9`]³Èû®¢ÐçÞP“¯sLŠÎ`:E/qý{ڨ︙ÀJ67·LîD: zWý~*cŠÅ9òË æ(¬`Ȇ%‰m™h#Ë ñàÁúוáÖ“£š»`Ú³¾·MÛá@îü2^²ñïsJÃÙx/œ­™H™Î7ðé­Aš!”ÆL±µ.s¶`#MPaŒ+µ‡’ÄõC4…šµ«†C7±„&„UOAí‘kíÖ¿dĦYÙÄg*Á9p¡ÌÚFc9ºjÀ܉‡®ÇšB “]}2¼ðaÒyÈä ‡fÈMÍ ŒiÊmê×?DºëGLßrHK…¹p#qŒL*«GôŠø¤’‘=©°yij(Š1Í ?f/Z´Y6œp†Â|Yòܳ–+Èa!áë]ϼ2{AýÓ!E‹=vãý‘¯lˆ2 õ4ãxoà©v¥µ@¾ËÊê| ·N¶sÛ´…s{“&|Ó¡ôäàÓq[}ã¬F¾¢<^&$4tÈTGñèRB™ºeµIaÍ$Í 5DÈŒ}eº#Æш­ãR#1ŠXbÖfZX±Ê§ì4?Å<5_Z÷›<Ð b)‡’Í SÇæ Á+ VUlùX¥Ã +-ÂÀûÕÙÝ€K ¯­!c.Ÿ±óöeÑ3VÛžs¤™¹°·b†¡ˉ1ËØž×qê\Îá×mÖÑùŽÈ6½èm0)ƒõ¤2Æ'i´[&çYMÉŠ÷r&"cK›$Æ -Nʾxɸ”U1|`Òá`I—È3¹JørHVÝtwúð)EœÆæ)…zò”B<¥@Å„õ–s{‚·±Ð²½‰#—àéïJÁæŠr—I4ìâ4[d¨,íây -¡Ãme“~ =Vs"‘¯£Ô¬Í÷‡‰˜ÈQ¼p˜IÄ0Í”Óèê 'Š®("B¹k³Úa¯âŒ…ô㜺¯Ì ÞbNÐþÉ”tˆ¯yÄÜ”¦¦  ‚G°¢@ž¢Å‹%½P¯å|Ž3‚Û16Ô)6\2ÔS.#Ú—áH…¯¡/;È›r±"wuF‚$Y8Üþ{Ñ,³Ó²I-A5õD¸6ˆqãñáå¿šâ#r‹êðd„ûBEÏ3 Ëìô$T -bIŒ¯N‹‹¯®D¢ŸG\Ô8¡ÃÅrxåõ‡54|)ô'õS¤Ú‡(Çž|†Çttdø *zJ:«¡®x[Bë¦ÊGg÷ˆ">‡¤ƒž’ÔªáDÒ{Î\|ƒ¼VŸCÞÿ">T -t×"uZ„øÄ>(N¨áÈí9ôð”lƒ":µVéÜ7èâsˆ;*ã)qmtÅÝþçÚøOÔ1ýÿRÇH’ÊTÇü7³‚½µ;¦#³çÐÆS¢ Úx ¹ë¼µã÷p»ö0'ÿ žÏ!ÿ¨ž§äÔs”Ÿr+ŸM®„ž‚}«üƒ²>‡üÏŒàÔÎûôБa*þð2†Èëd€*dp:Œ˜lJõ$ŒV&Œ~[OÈãñÎhæAÜÅj‘´yÚãsâ¾mª#Á àrEéiÉGšã¡uŠ×Ï©¬9Ó]=;­ôȇr˜TŸåœØß±¶œxÂÆÒæѯëùÅô]hRG|T™z‰É²†Û8¿Œ%:(bÊíõ#'ÌcÊ“ M‘ú4}·Ïªîè›Ë 5ÏV×îNs7aêàŇyNŽ[[Ú±˜X¸ËÚœ³4LçfA…°7-Á±&gÓÛ²Ò¡Mmøo3Î õ€A£Dt÷ÃI½y³3ûƒgç -Z%oðUOYŒbèV/0WÒØa¸lÂÎœ0Á®ãUS2<±K¶µ’Óº’'›enø53?@Îì¢áˆ ÿŽ/°Ì²±‰’¿ó -¯ ~Uj ¾r¦} V£9o4¡”¾ƒ0dî"™CTüg”C‘ÿ ˜#¡endstream +4687 0 obj << +/Length 3016 +/Filter /FlateDecode +>> +stream +xÚ¥ZKsÛ8¾ûWè¶TUL|3U{ÈsÖS“Økw3s€DZbE"5$Ùÿ~úzæ°•ŠîF£ñu£i5 àŸšä‰DÅ$ËS?‰Ôd±¹ &KùåF Å­Ü:4ïg7wŸ“t¢¿ŠÉìÙò)?)ÒɬüÝûð¯w³Oߦ·QyJùÓÛ,˽wÓ0÷>|xøÏ׎ÄÞý×ÏØõðíËTÁhy³û‡¯<öG /öf8ðîýôhž€ðÓÓôÏÙ¯7ŸfVOg%*ŠPË¿n~ÿ3˜”°¢_o?*òÉÚ¯Šb²¹‰“ÈOâHÞ×7O7ÿ¶¼x,žð¬sF1·Qàçy|ÝpIâ§qf §ÇpEîGY414h¸È?^› +R?Oò‰ÃéDš¡¹.N©ÐTx ïk‹fÞ³É;0n…fÞPïü©xhXI£ßLÃÌ›åV÷=ïKÞægèëÚÐË™²…¶&Ò¾œ3-Î× äô„4ÂcÑ6*†Ñå®ÓC ¶á¡Zž¢€C ä ãÊ{ö/¹D”ùAž]ߣ‘†ŒÂhìGqê:wùYÈÎ þƒG'qá=N#\[¿ŸF×âK‡+I3ï½^|Çw²gSö—ô¾WõiN7UˆÒ´ðó0!ýžô:×ÓÛ0ν,¡U×cO›ÉíeW顢ݘȓê¥Æ-ª×õ€¬^y·Ÿsܺ\¶ŽÖ´%iÚ”E»kpTX–ýAÏu/RK–X/…cû,³Gžõ/ïï> åýç'ì̼žW¾١UÁX· +N$/~¨È­V¨R»n—À+ŠO³C'©§ëµÆµ­Ñ;cEžÚoÔ’…äÀöÆiâÍÄPH‡f1çãsÖ™â|Ö¥Ô½<7tŠª²Û®e°OÃÂûQ·;˜Õ3S-Ú¦âÆœ4©–u3 -U/Û5*Û í°ª{×qAXè­ž£fvó>}C‚¯®!á=î Ö!¨¶…G†¶É}=Gá0ŠÇá~˺-êçWiZá@gp-½t>w¨éP“ÂÏ/ktĪžÁȵø°Ç¹m'îžsµ’ £¼7ìJ¸—;у(Ø5WÔ”‘]G™Çd½øœEÑ;z̹!Äzcà‘ Í¬ÐyâÄûŒŽk¡©ì6(”\ƒUy3beËÍYœËw?B€«g;"•lsØHK¤™÷z3ÎЃœ=àþ–˜øE–³7䊉p~ ž3ŽÃÿ4‚æF]½y{W tôïP²„}g‚éäãJËù›#=a*ÁÏÂNÕw-:Ny{44Á¨–æW‘Ô¡±H¯ü¡Ã"i…~¨r镇 L’Þ#j¥)¥)ä%˜ÿe¸¤0ºªÐHsÚcH‚,&…Ö¥Ùrt¬0oïúºm.„½FžØÛÈžÜÓUCWW<£dâÑá„_Ý<Æl úRè…¾gô3Šì0ƒ3™Ú μœe•zvh +óÀ°úá¸ÁN¯Ñ´¯g_ßnä@Ä œ'ßqSâ²æ£KýÏ”„`Ëœ×8I õZøŒ.ÇîËóî|vC‚Ijd&šìÃÌp1¬oɃÔûßj<ž4wK™!\yf¥U³è^·Èš,&Š¡9 ;íI3±‹‚`šÓál™ô sé÷Üîk•HÝZÌ°¶°=‡‚úÂKÉm=ðì BšÊ¼ûƨ1Tº´£Üh%>ؼMXjD|l@r‡*j‚5ê“Eìea3øi4Ú«!½\7áW4{k3 |xâçžL€ö[3¥^U*Üê0Khl6âÙëÈ 6·[MH~]-ߢ}ïaJ{¬«§Ë»žKS^û¡">gÈ_õÀ¸M¹ÀdIÁUâÙ{1¸¼ûr)íÃÜO!Õ¿†=ÍE0Œå+•€a(`ØC{3'Ÿ–œ÷–qñ“ø1Z¨ä®GÌ5ÎpSeö"øH¾-`q~Mpó³âú=Õ¡¹ˆ§ ‚_Hk¢«e§)ªÞ‘?S +ˆQ*Tì3îAŽT~xMÁ¹Í’l¤\˜ðL†À!ëJÍ;Ic"UP8U˜§L”þZ¤9@Ž­Èðù‹OAí8¿€%ìz0Tn|ž²PIN=‘ÒÏg' +d°ß;άù2×L¹¨ß@:„"óÀûíËÝñ3u1»Ã±•³î…õi”®4ê¸Äƒ‘…ÈœuW†GTõêŠùÚ€Ù½^öŒd¤ +5a +;ç £$BÐyË€ïF‰²_§[AÓÁr»ÿ’ ÅÔ6B ØÎVU'Œtçrt¢gGËcäÄ#° —„îS^õÒø©ØÊs55Às¶[º¿kÙäSŸx6¹l_Ó…ñh_+î”<ä•ßÖº3›T ƒlˆÑŠœÉ®­›òˆb2ÐñÖUåa9ÀÍÉ©ÝîzØùíz Ã"õÃèzQÀ¡!$‰•[IXŒƒÈ2Ê.Õn® ´µ›c‰gk7®Äeb* Ïéú_(n¨@â$¶(BGAá­ùžÛ~Gsn…ŽoHf¶ÝŸHÙÌÁì +â™èx¯þÚ9ð³Ú€'ºp”y¿ ƒ¹¹©1j6¬ÆlV©Úm‹W"‹—Ûs@µ17l:×îm vÁ˜vЂáí`UГAˆÝpRíu»l¥‰îÇs˜ÅY1·5?I”×ü*÷«Þ$̆‚Ec–¹0Iµ2vÞ‚ªðТãqÔ9]ø†MC‘'D㇕äØ¢ûŽI"\À»zªFLËxA8²íêñ€uxt0¯ÌC.1có9g\CÛ¸W1 ×2ZDÄam##Û/õDf,‹í7P=EîFœPë3è]÷h„UZœ!Mx‚Áì êÅÐh´ä–±/÷ÐN÷)…[=‚”À–Ç %n‡¹¢,ä"A.ÿ$·qh® ’ý‘®éHâyDr$"ÅÚ±M(á‡wpºAÎטûâ8î +> +B—›º±·œ„W¡Û¯ZnØÍëëNd 2d‹!T\©z-:Æ%º÷CfzæÌqé-J%S§N¤x½G‰wŽQÍ Û4qDžɺzx˜ê~ÐsXJÄy $fºu/Òw£O'¸fXÕÝç4t62 +#_¥¬×Øa’þÚ,ü%'4ã`ëãh%0Í:e*S±ôÈsu#$î‘eñ¹9ƒ3»7&j‰ô‹]o®á\xc³…×Ï–Î&Uël>^o‡þÒ)TYì‡Åõ:ÍåShˆ~v +¯ ´§ðXâÙSèJ|ljoh|ºq¯4ê”4šmÆ2=ÒS&–…§5 ,#R=ÞBFW¼ÛJ&̳ùIÇ#‹.}1 +'s Äº8Nèñó ˆ¥Àqz$»–‹Ötû„sÔ–ªËÃ;뀥žã‘¢Øæî¡™½ÐòcÕb[Ä°ã:Ê@ת¬c¤,âÃÚ1ª^¶ˆg»¨0·™Æú&‡±ÓeÊ­ÿ»¸Àâ~ž»/+ÞÈÚ­ŠI¾ŽïÛýG›SÙ7Ì"ú€‰¾Èiz¹,á}¼Á´çJ>÷’ƒ¤…“·Ñƒi—ÇX«jueŠõQ–î¤(§¥ú}/Ø6šJ™Žü÷Iî]ÅàÚE3Jü˜ÿáÞá?3ý¿þVa¬åADÎÃó!" ñƒU†Kyé±ÆI”ûIQùo?•/cendstream endobj -4581 0 obj << +4686 0 obj << /Type /Page -/Contents 4582 0 R -/Resources 4580 0 R +/Contents 4687 0 R +/Resources 4685 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4568 0 R +/Parent 4683 0 R >> endobj -4583 0 obj << -/D [4581 0 R /XYZ 85.039 786.531 null] +4688 0 obj << +/D [4686 0 R /XYZ 85.039 786.531 null] >> endobj -778 0 obj << -/D [4581 0 R /XYZ 85.039 287.543 null] +4689 0 obj << +/D [4686 0 R /XYZ 85.039 766.606 null] >> endobj -4587 0 obj << -/D [4581 0 R /XYZ 85.039 266.952 null] +646 0 obj << +/D [4686 0 R /XYZ 85.039 737.087 null] >> endobj -4588 0 obj << -/D [4581 0 R /XYZ 85.039 238.862 null] +4690 0 obj << +/D [4686 0 R /XYZ 85.039 696.923 null] >> endobj -4589 0 obj << -/D [4581 0 R /XYZ 236.167 244.835 null] +650 0 obj << +/D [4686 0 R /XYZ 85.039 555.668 null] >> endobj -782 0 obj << -/D [4581 0 R /XYZ 85.039 128.42 null] +4691 0 obj << +/D [4686 0 R /XYZ 85.039 525.173 null] >> endobj -4590 0 obj << -/D [4581 0 R /XYZ 85.039 107.224 null] +654 0 obj << +/D [4686 0 R /XYZ 85.039 428.612 null] >> endobj -4580 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R /F56 2890 0 R /F74 4586 0 R >> +4692 0 obj << +/D [4686 0 R /XYZ 85.039 391.746 null] +>> endobj +4685 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4593 0 obj << -/Length 1766 +4695 0 obj << +/Length 2911 /Filter /FlateDecode >> stream -xÚ½Y[Sã6~ϯÈÎÌÊX–å 3Û)åÒe‡Y¶íe(Nlˆ‹gB‡éo¯ŽÎ±I‚ ÙnhÖ‹d#}ç"[ŸdÞuô?Þ ¥íˆ¨„¾-ïǧ{£%?w8i0RaK:?õ;»Ç¾×åŽ9Q·]9¶Œün?¹´>ìî÷˜ÂâÂî± ­ã·NzŒ[§Gºö¥‡'çGý³ó^(¬?°iÿÓ!T<ëB«}Ø??¢æžZÐÿú_\`óÁÙ§þ9ˆÎN/zWý£~íÀ’‹\0ÿkçòÊé&ÚÕÇQؽ×uÇæQÔw<)lé ºÏ;_ê±Pæu±WS´¤mŠçáâr)\œ»¶àn7Òö½ÀÄkXŒÁ¯©v+O¡¶Ð¾®u­â!4d ÊT–Î@"¬\ßg·àvŠ ŸuÃÙÅÉïØqßt‚6·¨ËA1}¥Ë"G½Ól¦Hü§# ñ©é¥ï9*%–õ…J'IšŠO•`Ë`®ÿªñttH‡ˆEÆCúï×cÛF‹â²¬úeÎ.vO3c/Œ«Ãáú®îÆ= -ÜÆ“*ÜJÀ€25>«Ìy ¡i«ÃmS]VZŽ«°¢0+&¤mùþ¹)R#Ö,U*›Ü ®–ñ9­,”ŽÀÈ´„Á RŒfϬÁé™ÅäBOüâJ×Jbã,7¾BE'Ñ  qÊ“_!É‘¥0úÑx—*ýzž§3fuˆXƒæO#æz>d€pC÷ºZh_tnɶ˜J˜›Ež{ƒ²§[x¸{,Vf|`óÐíê°ÛN„îþ5R?^—ERìý³;SóëëzLºÒÊgX²Ø/#ú׎(Vù:¢$ÀµYù"`ÈÝVïx½‚hê®ïð ÚS´a®?­^š)Å5f;¤»éµC®¾5_vÓñ…ˆ6Å”­˜kï³Ýô8×ïŽ !ý–é³þº~‘G‚»›"-N6ÐCcVˆ;óm7DcBÓ¯?Ҽɒ¨°¥ùx$´Å$N5•$Ý2Ö´iñr-EN§M£nž^S»*¨wv32 xß^ù^øDi³šËV¼Vï²<ß±&Èã`€A^õaOÿ¹%[çhHböem©Þ$-iëvS@Χ&ðÝ¿‰Wuö>¨´¦þÔaC›NSZ‹qc¤D:U6NÉ­Š½Ò†¤àelØvú|w!Ÿ2º­1C«¹—æĸ32 i|òD–çS¢ä@…÷šˆ¯»2[>žÿº‡Óñó\aE2b¼Ù2 µ‹$‹oJðn`Cå¬ÿ±VâLfÒÜ`%Q—4øÂ¥3`]a èùêª2:mj´ÜÅ<…—ÇY¹‚¶CØ~é­×ùgâjöTW  š`ñHÔ¿ ·Äâ‹Å¶T(&fŠpÛ“Þòy$ÿiz\1óÛZŸû¾ÅÑ ‹ ÓA<ÁÊÑ"ÎU•ØßcíZ'köFö¡Y7å·23†˜ñÊ4VéÚRóªu3ÎÓ8yG«ÔßÀ¶úûsÂØ+ð›çá›Æ^EÞjèYÛï­ÂÍØÆß?Õû¸ÿWöúNf+kÑìa<(òlXEtrÛ0kØf¿f„¤^@ˆp‰[ZK÷ gÒËð\k)¬èu[Æptåéå:®5„5ÀÕoæ5;Âs±@Àpfà3:‹«zjRÓ0¼aºT#"ºnú}…1²»žô­8O+jbsª§‡Ù1y„Ú§³þÊà|¯weÄJjÖçÄ%Ò&H‰«T‡stj¸Ã@g§:Ôš£¸Œ‡*-[O_÷sšªÁq›GlISY½¤²å)QÇlB•m—ÊÄž8ÖUÅl‰TÁM\¦†¼ú@¡Ë{l7¬FB;Áü%IåýpLdŽÄn !pi2–ã¡¥qùöy`éD#½Ë†È6‡pâú¾ºÓ>NëIðFy‰{+¤_ ZÕ¡êa1Ž!,P¿XfÛf ì–ÏBÚ~¥Xÿ´ ÿc†¾ë Fý9Ç í(t›?OH×µ]^qâ> endobj -4594 0 obj << -/D [4592 0 R /XYZ 85.039 786.531 null] ->> endobj -4591 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -4597 0 obj << -/Length 3499 -/Filter /FlateDecode ->> -stream -xÚ­ZY“Û6~Ÿ_¡7SUC<óæØ“Ä©¬õL*ÙJRµ‰±B‘³$eyþýö’¨Iªvíáh4>>4G-"ø¯yF¦Xdy&F-Öû›hñ3ßÝ(¡X ÉÊ£ùæþæ«oÓx¡¢°ˆŠÅýÖñ)¢0)ÒÅýæ·àí÷o~º¿ý´\ceÂå*ËòàÛ¥ -Þ/W*øñZ¯yöÝûO·oï?~Zæ&ø½ùðqpdß¿ùt+ÃKoqý[\wÇÃo?~¸ÿ„S¼[þqÿÃÍí½;€wDe ŠÿŸ›ßþˆ8ê7QhŠ|q„vª¢XìoâÄ„Il¤ßÜÜÝüÓñâ¹xÁ«æ´e)V: -3­/·ËŠL¶3gÛ™‹í¢ÅJ…E¡çvRIªvÌÂ$K}Šó_'›Ž£DZeIêxºI•x7)D–oòö ¨ºÜ£ÖŸ ÕT|3p§:„¾úú\å¥ÅÂÛèBKó²4çœ^çÛš;ç²ä&Œ#='Ë¥LB{!“ñeRª*³ÈàWå$Òª?~éW_V«H•dIðªl‡¯—«D'Áý®âFwl«ž›¿GItª~¬Ë–}Un^sóØ×c%íêKµ>Œt< f#Sh;‰0Ú]ûîð4Ó[e»¹ä1§„UŸ«þ¹k…[Õ Õ³ï¹±é,ÏçqW·"t=î¸UW|1Ͳù»Q4x‚úßüÔ­43¡Jô¼q) ¬Õ"u¨S¾Iº,“Ç`I#hl¬³p, þí#¢ þ:`k|…s& N5òbÐ?£ªß×£ivíÀ“Û®çè –0ëïýƒb‘Ò=.Ñĉ–î ÷éà¢{áTÒ -4³ØÞ1£q¡¤h\¯é‚Wrhß`ȸPN^pdê•.â ²G¤™‰£Cá±]®iŽ(ð±ÅcÊüÏÜ3ƒ±ëkËm`“·ì¾øÛ‚I" ›·Ÿiè=ó‚zË¿VqHð{¤âfêÖ"J)RÀLÝ3[‚Xy/ª ™u” *ñ™;;Ô®6Ñ$Ö(ÛÀØÅw-¯r*¢¡£ %K¼fR<þ¯öøHŽÖC”C%¬`“-`òç;nÛ}/® %º<)î9Èž˜8Ù„ñrÖK>ó0’Hr¼ñ¬‡ƒÄ/;»ìoR5Ùrª-Ó5&dâóõÈ ¼ "¢Õ2Ø —’çæn LeNs¾ñJØÔþþåx}=MìK”ÉŠÄwÈ3¨Þ¶n*øsÉà -ø\sTÐƪBEµa³6EB—†¿ý¤"›¯ªàPóÌ+“¬éH®n<å6:×4í.VÐJÁt~ÁKwd7£eQqcîÖI`>‚–cAÀa±P”¶š1¥òAÜÎ( ZÆ_eƒ -6y¦€j'd'CžòÌÄ4‚ ÆÀÖ›ª©,…,$-( (m¹—1´ÉÿàYpìØd¿•š=£RrFn“)£5ûéÞƚ˳nI‚Á;ÈZ œ‚±­¢Í¬KÈðwÜà ‚èä«qÿ$“©Âx)V‚í# -JæÚlV¨ÉòÎwé„"Ö™frÃà#žweOØ8¨Gª’G²5„ -8úþ>Ôb/äh,¸Ëž›{™.ÍÅs3öÜü%ÏÍRÏ†íª¦™|šÎJ{ÁñxÍ9ÎPtQ"765²ÅºxF:3þ²Á™Üy ¶I…H>i ‡1ÿªà+ -ÈÅI@Æ Qn°ÁF^¹ Àŧ¬Îy¼!j¡&=G”Â[¼ß±ÝFdØpÇÄÎg¾làƒÁ]Õ VÞ6y -›JÛ»)ð=2-™:ëµ ÎdãŽlÐ@ƒ”K—B>·“½F^P Rœ–™WÝ{wAáBØ‚ë 763ÀüH:RÓŽ÷K”t@PbÉ]ÏØQ³nÕ÷Ø0ͤEdôÐHkÖÇžBÇÙ(ã2àéÎQÊÀ–¶ÜcG³‘¤.ô†( žÈ÷1O -æiÊþZ:î* -:kþ=´gÊÉãÈa$›‚Nù‘»tãy V_ÖÍa¨'k†„ÞîÑ÷"^8D(Jfr‚ypü¸ë^‰àOdQyËkÀÌÃÀ8k‰¥¸q'ñÓeh{—|fÙ–&Ìs°‰Aâ´µ) uj€õ dØý½@¬S2;ªy ¢ᯠÀ÷â•©B“iPn°é«~…ÿ˜ôä“ÂH¥BÉAQØ3è([é:•h±i@?éuŠÒ»lŒ~WСÚ7?¼¼"W*ǧ[æizY@&³´’MTâ¡8•J8J}UPš>Œ<)÷ÁBMÅ“wBÛ½'¸{þœ`•”²+ h8ƒ‚ö”9Ï…”p{Jî…Þ4hêÁOZ3Лf«V„„•è-7ÝQt~Á‘‹:=ƒh€bÜÛØVñ) ý² #ÏE 8ɽÀ« -@ ‰`F .¡m™_œê±Ž0©³½°t±†£WGžsš&›E1.»ýš'ßo“.ÍáìÂu×ng"\„*²t^%ÄDæÄakÊa²µ +Ø|Cn'zAJ ”ÒìÙÀ²;ª›ÉÀŽ(æëÈ„yšŸ¾ ³'Dà¸&&ìß±Å\Æú -d/ª˜`)µd@§Ûâ¯@v€;iÈ«ž8H‹”OãT‚ƒþSS•UÞ<à¶^Ñ̶cbdéø{ -¤ žÊGÁâú—÷™¦ã¿qI˜«\è®y¢.’Peñ‹fíÑ8OTaIy2kƒûÅ™ç‰*Px Iü<,´á+0.4¾#í¸7ã7 C™ù W„(FÚ¼,óDsݬ€g’ùçéU¥€høµ²˜€—I+™wv7La¹˜tB=@õÄ• ²XëDÚý3Óȳ¯ýÐ`úPÿ¾ef^í{õx èU“ â½ö4ƒZìo;ɲ×^<Om*ù.ߘ$a+…_vºµ/I,ë$–´Édó@”=÷»'É2¥(übÉ•˜Érö*ËÍ«,M-k0uvÎý’d¤\$I -qÙį{ÏÕe·襬‘ÑKS4T]Ö6Rk©é ¡÷”H]nÝQ=ðsMSbíœg‰›<@vÚÄZWZÜ‘(ƒÅtóT_™ª"•û0|--!¹ˆ,¸í3ט&| ¡Æ½¸¦²»{<5¿ä̹1~€Â¼9K‚¯µ 4ÞÉ"­,‹‰“tÏ]OEM÷’êE@z•²e×6"§CxéÒs»ì窉T]ßq™Áù«Ñ:xš` -œò´ž².Ý—öu©<©Åz4~öÝ‚ÆøgØqÎÓRoD9¾«Š4dpÛ]e—\ÖÁÉE‹>µº’G>/°´¦–Ú¢÷b–ç(¿àÍô<€±šÒ ,MøeëV'Ÿ¬€Ò3&¿N„3\°Ï÷ÝR)âZáÿ †«+wGÔ×ÓgŒà*VÊq­÷yÜÙ¯80Sn>×Ã[†*Ìø4ÀE¸T̳„é¦ÃNÁŒ¤or_x;%Wé‰$U¾Ô2͂ƽ\‡ñj…¿ ŽÒ½Kɉãú¸s•z[ï¡‹Š¢™Ó¸`ˆ£,Dek|â˜,‘YçöãD/µ¢©˜•(.ÁVüö;ððt,?m1ДÆÀ[ÏÖómÆ¢O¿Xà -]IjìóÆ]¢Œšr\À_tóžsf½±Å#éw€üV¶k;fï?ál…ÍTÐîÛ@¸R®öÓ¢ÁÛ4dëG¬s³äö¢à×W¾÷™8¡à±åæ´Ÿy`#!š-=ö!Ä{µ¶ÞúËh‚”G~@:Ý ÓÁМܥàßq*e¬ö\–^h)³â7Þzø“[T`Ÿ»’Í¥äa¯v%6wyú¾Úw“09ÊÖ5$a4Óçï¶$ø줇èÁѸ¡2 ?ΦøÂhymº')¾p-즅GL˜ÿ¦õh®cÚ"£8?´Z ­ýûSHûŽ¿áÐÛó™‡~ZEŸvñŠ‡éÝp†x—üÙR/_ÀáÙ_àÞ‰ä:ìͲ0ÔËÐļðMÌI…Ñ›µQ˜²¥%®àˆÍ°{ËE–®5¼Z®Î›è“øFßP2Lr‹:Ø×H*'‚Ì«@U_9ªfdIê¹údÞ¡ÞTìÕè=S&o7à Äwëò±í¡æÐã±ìzþ‚°«µÃ¨¸ÇCoÁ:OU‚/"Áó'ºçi’ ú`ý¼ÏU%’06WþôEýÿùÓ—8‹üÊ_¾$Z‡Z9aÈ]tt.qbò0ÉÍŒÈÿ¯-½endstream +xÚ¥ZYoÛH~÷¯ò²°¢y5  ÇNf£žU€W…Š?-€Yø’ÍY¿LU~úeæÞ¬ûXQÞÎê«c²l´èh™‡¦Q¯Çšng±Ù±ê™¶ËåV-;I÷ÕüæÍ+^øG ‚9F¿®þŠ·¤&¹q¬h0´¦EîýFRÑÎOL8¬êþ”ñ ¸$%§Ú ±àÔßžëª/xøº«¸¯ÉB¿cGyº,QÆ¡Þ¬YN%V‰0`<áÚN#Á”ü)O›¯Äü’0óÐ;Y…,ëUyuoögŽ-G¦ui|Pè–Sr¢]›¹ç + ñÍê¦!W©zñ°•_+Å×z3°wt†ï¨ +$yƒb_}ÄÛòÍŽQæïxEÌé’ñóT­«ÕÇ™÷´«K#ñΤa-rFɯ¢ ãåx=ؽ»ŸscÔŽ{§8c-u½~2û8{º‘‡NÝ +»ä`’ ‰úÇjsK„ lL.<©€Ä2 +¼ÖF1¢ˆ\WëÁ`’$ð®JÔU-V·÷UŽq;ŠÎ¼Ñvðkï0’|EÑZ?6ãn†AŒžç«-XbL Û;7`Fäq¼®lŒB{úc½¸~'¹÷:7o. ÝÜ\ãXæÕí¶©ÌMbp­æÅJ¡5rë™]WmñT5¢²ˆ–ŽH«åØ@®l7ÈD¶"ŒPMT¨H€×M¥;£ôã£-M®±~¢{Ú†Lš3ú%îuSEäÉÅ«výA†ò´1šéVd섉5¶¥iàH'×}"0m,ă›Zø3˜Œ„‰µ‹][±:8}qvØ;R¯7#t“(Ó ¸eõúÌ'qêGPH½tÇ Ýq:w`]Aláé Ùf‡û…Aêç*qCCs´ãžU…aäÇ`rîŽWplUxm¥)p§e÷FGß5¦&"`ýþgûøžÉ¾Zݹ@‹R5J úsìJÐh¬ãÂkêGÂÇÝ~!]°’Ù¬Þã ëµsn=ÖñQnÞ šÜ,©rF÷@èNa‘qheqû`,1”E&Ç»'!ø䘛Ïj²¶Øµ¶Ž¨‚Õ0l__^>??û[]6þbÓ^ +’¨ÌO‹d_’s74Gì™û!'v0ª6ÜÅ‘%Çv¾Qrͳ8‹ü.q/PhŠ2Ð*ßa)ÌM™àù(ƒ{ܬ± B[d8b–åäaD‹=öùmŽÆÿD9&ZƒßyÝè 0C²ïŒGÁ¬I^ÙlÊP Ǿ÷ Z[î_•-YU-oNÅöÓ‰èø3V1¸ àÝkRSg+lá.‰òüD£ü"òý't»^ž3 ˆOúO +ï“nÜê%¬~wûð +¯.È„ÎÉüÄRü¡QgèRøF‰ŸgɬZ¨gù±Uò$»¦ô5 à`Þ½^²Kû`aµ”+¾<®]þó?ms[þ¦C±/€3~E{ZV©*¢YR ,JrB"¹À`©Ó9Ahfщœ$~‘§–Óˆè¥YmƉAÞØ›¬ŸVòÄÝçº_ÉÒ ?¯9? 9û´4°qÚ󧈉佅¥ñN2À)+…^&È;S…_$ÙžNµ ¸û­ñÆ¥#â´µEõ£ìIÀÏþ§7gPµ +ÔÉ7gp,êIt– - +€ ·„zŸ‹E!Xf^ŒïÒiâT)`cIr'=b£>î6¬{¼ÜƒS +uX ¬ Ë™|™„~PU‰Ó&áÇ3ÑÀåmNn6 æÄ‘TØξl‘¹k‘Q᧙šD0”…©  PI +7$Ž¬#I#™€j~7”ÚÆ–’—¦Øè¸ÿ Q¥;‹…ébUqÔç—ª<Ï‘’å ƒ&yãš?ëêÔ3 ´úðj¥ÇRÄ£ÁVëñ¡Jʲã"ˆ=ÃH*j¨nêö ¤¦7Bjmwx²¦^PÄ?2ö€b˜¤Dzþ3EOpI\Vü5ÏÙ³ù¤x¹“Ì/BEéèÊ}õ\˜sï툔Wrf^tµ\-Î$J\fíà˯*•%uc ²«©FÝ«?ˆŒ#."d6à'ÜߎÙŽå“:U>˜f$ÓÍŽhkñHÜé£W5š@ ª’Ûµ!ƒE¼ãü ³ÿT*„W¼#ycÌÓv¤¼ÛAØöz[Þ·æW.ÞNÇw•.ñä8®ì‰Ä+ƒXž|ûîña §éÁ«t_ äI˜°“­²LðÙ^õ¹ÏÛü³Üv0ûZðò°0)=³ÀÜó”~žùlÁ L•µ}ÀX€Âî­XnaNlŸ×J6äM<{|Ò®JÑò;„`OÇŠì ‘ÀÔØêŽ9«¿õøÂ=&FÝ?u bÃô¾oÞB8Iåq™Í?öòØ·mÆ—B¨«–UçþÜ•2æ6™tÓ°ËÙ:Ô¾¾žýÙ*óÃüåç´‘ä|….4?*Ð_ØÍÖçÛ,Ïí^†*³#I ò&q¼'ÉY¸kˆeÚ+â8q›mµÆ÷YºOG…\™Y¾ –(!Sd˜ü,9ù´Ù€ÿÒ¯ûãËZh÷ŒþUùÀ“XÑ‘ù!÷è¶Í*GäÿkÕäendstream endobj -4596 0 obj << +4694 0 obj << /Type /Page -/Contents 4597 0 R -/Resources 4595 0 R +/Contents 4695 0 R +/Resources 4693 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4568 0 R +/Parent 4683 0 R +/Annots [ 4699 0 R 4700 0 R 4701 0 R 4702 0 R ] >> endobj -4598 0 obj << -/D [4596 0 R /XYZ 85.039 786.531 null] +4699 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [342.154 348.249 458.69 361.151] +/Subtype/Link/A<> >> endobj -4599 0 obj << -/D [4596 0 R /XYZ 320.069 769.79 null] +4700 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [374.665 321.151 539.579 334.052] +/Subtype/Link/A<> >> endobj -4600 0 obj << -/D [4596 0 R /XYZ 85.039 675.543 null] +4701 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 308.207 142.399 319.897] +/Subtype/Link/A<> >> endobj -786 0 obj << -/D [4596 0 R /XYZ 85.039 379.216 null] +4702 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [178.437 73.761 317.883 85.754] +/Subtype/Link/A<> >> endobj -4601 0 obj << -/D [4596 0 R /XYZ 85.039 353.208 null] +4696 0 obj << +/D [4694 0 R /XYZ 85.039 786.531 null] >> endobj -790 0 obj << -/D [4596 0 R /XYZ 85.039 295.174 null] +658 0 obj << +/D [4694 0 R /XYZ 85.039 711.163 null] >> endobj -4602 0 obj << -/D [4596 0 R /XYZ 85.039 273.977 null] +4697 0 obj << +/D [4694 0 R /XYZ 85.039 678.741 null] >> endobj -794 0 obj << -/D [4596 0 R /XYZ 85.039 109.874 null] +662 0 obj << +/D [4694 0 R /XYZ 85.039 539.412 null] >> endobj -4603 0 obj << -/D [4596 0 R /XYZ 85.039 88.678 null] +4698 0 obj << +/D [4694 0 R /XYZ 85.039 504.667 null] >> endobj -4595 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +4693 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F35 2976 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4606 0 obj << -/Length 3184 +4705 0 obj << +/Length 3014 /Filter /FlateDecode >> stream -xÚÍZI“Û6¾÷¯Ð‘ªŠhbá67»ã$N%¶Ç­Ôd*Î-±%V$±CRîô¿Ÿ· Z"é[—Âò<ß[1‹à'fYF*Ÿ¥YÆJÌVû«h¶ž¯„¡X’…Gójyõâ‡DÏDæQ>[Þ¹qò(Œód¶\ÿ\ÿôòýòõ‡ùB)Îiš?ÌEðf¾Á/¯¡ô÷~ÿæÃëëå»óLÿ妗o¿Ç‚n€ì§—^›æ¹Ì‚küþ¿¿¹áæëwo—°ëÝ/7ó?—?_½^ºxKJ!û_ýñg4[ÃR¾ŠB•g³(G¡ÈóÙþJÇ*Œµ2õÝÕÍÕ¿ÝXܧgüÕÐnYŠ…ŒÂTÊóéÒ<5Ó©“éÔÙtÑl!Â<—C3 ‘…©–p.aœ&>Åé¿ãMF*L3(¤qJÝeœxGi©,žårž'Aq»Ã/aË3:Q‰[ýâ{_ÃG:Éa>üì_§g!“$ÌE:ó8çÒÐœqùdžÓ‘pºßÚlŲæòM}„Ú=×^!UÑ–¦“àTæ2º¦Þµ§Lk‘‡™CLŸ1¯tJØΆÃÇbiãPÇz&eÊL|,'Ø›CE0 — õÓQzI—y(…Þx|dq6K ÍXÔq÷2Ú=ÞÒ÷¸™ESì 0]Ùœî©"L„œyS}9ßv°iÆU ’"ÅÆ¿/[äpÕT÷®‚uÿ Ö=/W'M*x[w²3”Ä* E¦/³"2¡aJëšÿ h8gàc$ôÎŒ™dA}oƒ†Fè#I -º’iPnæƒfqìõ.Œâ€Éa}uuLê8xIô8À îó|¡U Z´Ša®Šñ¢Uì*‹Ž©`‘вãŠ;$-n±£äž®æÿu̓ò =ò؇ÏḨbV(€Ë…Ì3žù/sR2Ïé<°ÃRb[»-ûº4QTØаzñvvÕ;‚0Ãï,p<ÿ(†°³¯hÜ•“Ù—pL]D¢.¬ÀH&:{.K†zLEàq¤jR%* Åné]'³²ž hù ¡à<¦“ú¾œÝ^'Mñku’ÏðA±\!R,ÔZD 8:ü÷ÛÛ7¿cÉ[Ôdp(ö%·d‹ŽÉh8”•78)BÒ‚@5„½¶ÚPÃé,"*IJPG(rx\å]š~×q5Û¾hù›sÅ°†§ÁC ê(«~á”Võá`RÂKF%œþ­º@Zce>Uî¤ÇÅã‡{añHRðìŸm® õˆxà:•œ6×±AÔ6"žÕoŽ/gØ È$ÇV@<–'å#•ÿ$Ê6þÎ5ÏfeVF¸Û¢€`›±£™'4Úç%C3•Öº— (¯-_w(†GÔ÷S÷Ì` »kSF±`ßy¢á@ †¸8”F:âXtıdÉG£+Ød¥c!"°;Ë­¥±ÿý´wG6¸Øj8Ø0„Æ´’4§±ããÙ¿9XˆÕMÓ‹4ÑOÈu¢+Њ`É픊’€wluĪnÌ­¸'Mx»+÷ÓFò"~¢òËÉô2FRç)D™ÓF2†HTk¶9›ci½-T®õ_c¢ï |Û8ɦ}Ï7覣˜9í^æ=žeçäú+ÓŨ鸑l -þ;·èËéF/Lr¨‡@V´íƤ_ꈦ“ý¿¿•ƒ¸éD™ÄN4h%Â+¶±Ce£žéùÔï þŸªcSh´—òµ—ª[S¤‡,ç¼w…ŽNwvÜR¬Võ‘ãšQé¹.,=2 £üÙ.¦¡“ž$Ó,™”¥¡¦3©h·>Í)ðªú”SòÉ'NýL_Îv/NS|[qêçèW' œDóˆ}.­É’­¹U{mFéÃ2¨€!«q_Lôc¾ î×»zÃYi<Ý›0rðÜV~ªVå¤j¿È–~ËàÔ„oÚÁÓq-œã¨x\Ïvî¼ñ/É)n$=výÔ"G<2¶e¨7Ø–‡ñw`W°sÑ1}R‘+†•Ì_6z~íUÛçp¸pˆ‰bÇY#uSYÝË9¥|±X#ö;~á$ÖÐþlgÄP VÆIr=X%C±‘oÊbííôN½Q¿œE‡ÓIN=&Yy¢}§œü?UždùIybɦ‹ÐÒoLFèÀ]Î](0^X8Tïͧ+vZ›`—âÁèÕ$qïÕ¬(UþÖs¥’„ðz`ÚŽülÜeËÎtJVÅ#Yï[@¥_È93M… ìdßaø¯xPî§;ƒ¢ë(!õ›µÀ -I!X²»s>i}2ï2øOGgó£rxD}ÃAÒ‰MÃÊ¡JÓ0Â%c(P“À~¼ Ä“ÜY ôÙûàbkçùGìX«HZ/—.,•?T…Ql/,Ûým~ùÝÀŦÎC!„¡ÛsD*)»Ul(&íwìØ×MÉ¥ê0·ùŒ²C¼Úô@Êú®9_8å~hç$Ûð·ª÷œ_¶!ö?ØžA¼¼æ½ÉÁ—lD«bw&+±ŸQîu–Ѹ´¾†²#°—e3.,—8üoØÍRN.Ó¢’0MxC­ÿ¿~þÝ—7Å<­I†üx›Ë¯Œ-þ?‰X E¸ìX´[JãîÖ\õRdbØ×GªŽµ<Ò ‡O†gàfì+SºÙÇoŠà–ÄÓþ“E#“Ì·½Ÿs ¼a/¿I&ü<. ütÎðƒÿøÅÖÂ>ë@a«ç@az‹û%/=öü¦vr…õšÏÆ•Ù® £LÁ®ÆCj0ØW>3é˜é0KG¢8!`*ÄŒ”ç¬[È ÉL«¢)ïŽÆ -߇)aP¯Ð¹…ê¦!¯÷hí5Vöi3ê_Q†dWy…!Õ–[jsML‚Z‚/Í0õ¡äê­ƒKÆ·U㮌±—MåºåÇH(BG•-“틱œóU¸6yÈUgô "jg fÁJ5HÎÌŒÌh°¹Ùêã‚ÿÞÛûæ\‚Î%m[àF<ö -›£â=¿ÃéÇäû¶'ƒ÷õÞtù‚‚4º}Kå1<¬¼ûtitÖi++ÃH¦–.5‰ Â’ ¹ wóç¥vΠ(ö¸ -—‰â€?y(AÙÄÓO{‚µ„Næè"õ°?L2ΘÁºUSâãÆt̯d°V%ñYÊúhP\Ï)ŠCü ½03óÛ¡§XôhÆEO€[e| KÊ[$xÕJGRÏé îÔ†;ŠÆP¬ùTVÇ}é½dI<ë.ÜLbç&3’D|Ûb0LÞOyXÐòs [òC“šCшÑÚÀáòeÔQ¬YTš®pÈŽ€Y² MÅ® ¢'^"R¸V†ô–…šÈ9…#†ë -R|÷õ"ƒ_òõØŽ;ªÞ-¯VEŸˆBÂún QiBÖG!/Øví#ñ‰L€"6#øKuÎSgösø*ÌbP¡¦!èHœ”èPጇ@ƒ[)Ñ”zȃ—´åè•­É4\ׇŽŽÝ&øP^(‚Îíb®„Ñ!£¢cæ›ä»§°ê2IäTæ…Ek_ðã h(víÉ;ŠnË [2t©NW;ðß'(ñt覥)¹ë¦Øã·æ%‡}Xe&ß–î,÷ƒÃúo/‘7óèˆd«2™PR?mx÷¡áUÚ¼Ú iºó2,¥š‚I ˆ(•xF­0[×T+ãZòñÙÛ,÷­y°Æ$U×–»;4ÿIfBwÈz÷–åÓñ ¦¡·e@5t|Z¸T:(4ŽÖ3Ï4CŬ‡+µ¡ø•sñ?$êk§2[n~»Ô/dýóâ÷÷fïñ_q':cssü¥Á' 5ÜBô8lÛ £^Å ˆjØáû̃àÿÏáÓx–rXrb)C)3$ñR ¹Íq¦Xþjðiendstream +xÚ¥Ûr›ÈòÝ_¡‡S¹*ÂÀpݧ£ÈÎÆYߎ%×fkÏ>` ÉdhÅñߟ¾ @òéT¢a¦§»§§ïkdÂk¸†©Â‘x†«¬Ñr{fŽ6°òë™%™´`>-Î.>»ÞÈ2Ð G‹u'4 7ôF‹ÕŸãÙ—éÃâêñ|¢”[–q>ñý`<=·ƒñlvÿt·Àg|}÷§îoÏ-X Ôxq}Çk—¸sÎx ÓO瀙àÕüü¯Å׳«EÍgë$–RÈå?gþeŽVp¢¯g¦¡Â`ô +cÓ°Âp´=s\e¸Ž’ïôl~öŸ¯9#Þ5$ 1Q¦ÎiÁ¹®á9~-8Çj Î2-Ã1ÕH¡äþkZ~÷x–éŒZÈz5L¢å¶)Z¶¡,û€bò2M£,®øº.“"^¢°«¼€•7žÇż‘¸àïI—I[…‡!&q¡ØÄc‹] ÝcWµÙíâDv_ªj÷ËÅE²#– ø[.£]l,óíÅ +Y¶ßºÌ9®ç>)@9-?­h¶k¸¬é‹×sÛç,”hµ‰%U’gð¥"ºh‹’{Žø³ˆK”n¾‚¨ò¯/ Ì-á Ãn#ü+Øá†QñMð¦Jh?ŸOT&_ât·ð½°áMÆGÌÆ ]ÃñÕI=nÁ×c ôžŸ"Xëq—â ·).^z´”cøÊ;$xT'5ô;¤;8‘t}Ó‡ËÙä†]×ÃäË=~_Ü÷lŇ½¡sRæ47¶‚Ë;`f%Ò­ðo4l¥uĵ6]ãü†ô””U/g홑nî@¡@Ë¢½qLo¼ÀPþiÿׂ9¡7ô®Þœ ØèM‡â°Þ´(¢ÞLT¨Æ•B{¼M6ET‘<2ž!ƒ] Z`U2ôš¬qÛ»ZÏ>:Â9îú4×]œÈõõåÕôæ[—º‚M¾:-) sš¦²à-ï€fõ‚ÚRñùÅ¥ÐxGE­g¡Å>)D÷Eúµ°}I@¸Q„e²cSäûAkáT Ó6|ÓA»„på¾íÅ¡bN€è£jã“X–“5Ðx–³Y ùÍ'§O´k®çpQ§øE«dÚBw™&±°/‘ù%þf°q¡üåµF&‚üˆ2sÙÁÔ$cv¾£a] 8ubÏaŠ¯i©~°´¶;*s5Þ"/JžÒgàý.mJ¼˯/D$Ûéšp6ߧB:Ë+0[Hº]4ܵ$âêçü<§;wwLéw•rÙ€Ë=r³Õê[ñ¬¸¨Ÿ:]ü‘D½ècùPÒX#üG9,¯@ðáÁAðàI={1"ÿŸöÉrŽ@uB•d2½Ž–IÊ|Ãb/W6”]ªÍc?D ÈIÎ:x³c.ÛPûJ­sÔe;f)Óï¸l[»ìå iÌ€=5Ç7<Æ©Ž+%eù;ž'íÅ_JBð3úö»vˆñ´Ä2ù9].ó}V9©*à +¼“'mÁuõŽg–×Éná²m{¬È;€ÒKvsh+ÔKÛVµã¸Î@—lL¤®D$œZ!~žPAeO€ _ób€ÆÝâøÚÃëê&*«96Nx y€òPád­D%ßäÙ"ÙÆ ÀÒz=¼ö[²ü»³Ø?©fge³—(ÛăÌÞîËêØ2ÜGõ96åŽZ«¤Ü¥ÑÛ]4Äå—|?D˜n ­\É#ÇÎæXVUï­È×IÚ§.‡¶c¿¥‡þ©Œ‹ß!*+v»ïÒH¶ §¿b!RkV×ÍùQë´æuœèÄõ Û·Åf½V¨ñ¡Ëi¹?òRèþ‚C÷{^(YT/YÐ5…_Þ\¤Á²Hƒ#~VÀo^ØTw8¶ß°‰®/?]ªïpÀù[ þgñ4®¸s¨6íàõrãº::ÃU:%Ì‘Tö­^.&²˜Æì¬á°âžkÁàG®OšJ 9tÿûgJ½ëTN$Å©˜‚ó®™ÔÛ9g™ôQQV¦Q%¸ëè¦ùìÞnbJªßÕ€r¦Žþ3uBÚdêÔ Ÿlz€)˯<™,j6q¼•º—Q±bi ±ó-åÃí‘„*YÝEïáOÎpš­ + NfÛŽ8á;- =i÷Ó’.N”Ú÷¸ Dâß•›.C®eR{ÀP'9Ò0§Ùèbª“N8‡í–kcãÎ0C.’¿ÖUh…u$‹Òv])DaPÖœï"NŽ^W J— P £Á!ׄ‘.'’´ qAé¦7 Q8ÝΠ¯Zÿ“Ú¾\Ô#T®]ʪ õœP¤ÕÀù +±®¾) ºØIe ¿SwÁ IAàŒ?¢u„,%2«>.ˆ˜d6Mr'ó:¯ƒÐU÷Ók±x?ãù-›OjŠ½ZÃ"à¥6#Ow×ßxT „ÐDG8éÝƤï'åÍK 0ª)fýªŸiöñ#å’÷Ã<î‡-qãÓlñô8½ái-yÜ‘ìQypó¹à!|6ßd”ñGSW#$ªØŠ’Œ;~$ø³Ða¤o‚(¸õÚ#9ÜÂè>3A`@7 *M°I \s I£Ö¸Œ[Í +z„q<ö{é +Oìø”ÆƆè¹i’År‚íÛμ¼0ñ½4âŽúÁ탲—º­{y}¹#,(öH!M2í¼u[ó‘žPgX*RCÁ®‹ 1$ê@[ mJ6Y]ã´Ö5zt¥X5B¦2_ëfû|ZšòRíìbÙµ*#6_rM¾¢‹óò[¹ßzEã{T̛ɰeÕme‰‹kN4%ƒžªMûö)6B¦Pß²×T„‡^©97§î5yJ±#Z1d¬u¡-A"ËM²–Åæ, °t°É™œ0'_:š¼Sº‹Cù Þ±ØÍõ×3ù3=4ÑXËÄ T7Và_,Ž†<%"H²5©Ö6âœç°Í%Ø5dô$Lê²áÊŒRÝT}ãoöc䘄²{î·ZãÍP•¿‰«§¸Ñ¡QÛPRðǘ 4pE&¨[HFg«:BËgóhÒjà¸ý,¬!íGvBPµñW”’£†¡> endobj -4607 0 obj << -/D [4605 0 R /XYZ 85.039 786.531 null] +4707 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [238.407 752.227 452.306 764.219] +/Subtype/Link/A<> >> endobj -4608 0 obj << -/D [4605 0 R /XYZ 85.039 763.817 null] +4708 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [133.74 692.355 276.49 704.045] +/Subtype/Link/A<> >> endobj -4609 0 obj << -/D [4605 0 R /XYZ 266.917 769.79 null] +4709 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [266.863 665.257 311.734 676.946] +/Subtype/Link/A<> >> endobj -798 0 obj << -/D [4605 0 R /XYZ 85.039 209.51 null] +4711 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [216.195 534.553 321.127 546.242] +/Subtype /Link +/A << /S /GoTo /D (bugreport) >> >> endobj -4610 0 obj << -/D [4605 0 R /XYZ 85.039 190.639 null] +4713 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [429.952 221.732 511.188 233.421] +/Subtype/Link/A<> >> endobj -802 0 obj << -/D [4605 0 R /XYZ 85.039 131.43 null] +4706 0 obj << +/D [4704 0 R /XYZ 85.039 786.531 null] >> endobj -4611 0 obj << -/D [4605 0 R /XYZ 85.039 104.816 null] +666 0 obj << +/D [4704 0 R /XYZ 85.039 637.439 null] >> endobj -4604 0 obj << -/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +4710 0 obj << +/D [4704 0 R /XYZ 85.039 603.295 null] +>> endobj +670 0 obj << +/D [4704 0 R /XYZ 85.039 520.284 null] +>> endobj +4712 0 obj << +/D [4704 0 R /XYZ 85.039 486.14 null] +>> endobj +4703 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4615 0 obj << -/Length 3260 -/Filter /FlateDecode ->> -stream -xÚí[[sÛ6~÷¯ÐÛJ3CÜH°o©ãlÓi“¬íNºÓö’h‹S]¼"×ÿ¾çPD2iÊÙñììt‘À!p|ß¹°ÅðŸYÅ*¥6‰Œ£ùú"ÝCÍ?/„“˜:‘i óííÅË7‰‰8Êâlt{×´“Å‘É’Ñíâ—ñåw¯>Ü^]O¦J©±PÑdš¦vüf"Æo'S1þá -ž^píë·×W—·ï¯'VÿÍE¯Þ½Æ=¾±ï^]_¹â‰´ãKüþ¿¿¹áâË÷ïn¯±êý7“ßn¿¿¸ºm Q(…êÿçâ—ßâцúýE©ÌŽá9ŽD–ÖÚ¨ÈhåÞW7ÿjÚâ:=â¯ÚfËKLe¥Ržw—f©ëNt§Îº‹GSe™lë †•H Ë™4 NÕDGI’Â'&‰¤>¬¤I‚•ôR^—òv’%ã|¶Ây/`Æ--¨Â™~ùF˜àkøH'ô‡Ÿ}sºR©ÈÆj(p¦¥—9Óò¨ŸÓ–°»7åjÂúlòÍÂa ÊÊ]1GÝëíÞžXâÃDf(-ÆX¸Æ‡²ªÊ톿û6¯h¸®™K(|Õ»íª:–62ÊŒiÖÙðT -k ¥úEM¤I¡£ŒY÷õ°EamÖÙ }C3üä¤[9X™ER¨ö• ‡5v” -ÉÔ²)8LÏ&Í}¾ËiÖ‹ºØN©"J„]}½Þ¾±~Å•*Iq¤øë‚@0ß•€‘ºÇ”!ôj~R¤Æï¶5aê $FÙHX=̈p±…6£icˆþ68Ì@Ø&’‰iŸâLæ'"‹ÀãÏw4[y]ðô òê÷N<š}Ê*‘F™µ¡¶×¤ì[´¤s ï[D½¤:²‹*l,Qœ g«õ,šo7w-öSgÄz–[ç[ù}ujˆ)P|ˆ¶_ª’“î@T’j LÖ¨ØDÊJšµE kÀ°šƒÁrÀêUÐÃ׫ۀªWßT·KB +9¯ó¿¯¹`áñVqñ¾"§OË’Äcrole?á?Å®ÆiØܳàë÷,áø_@s] ×åø§woæ’6%@àŸ—¾pÃ…Àæ¼.7PzÏS3罺% -|rÉmC¨E6¾)àUp«jû ”Å))pæÇ¥±cvÓóý­'2õ¸ä¬dÍŸ3kÀ‹‰Tõ²&I4X6ŽÖÛŠ‰òk,ôª ;Œ+_tòæÐǼéÓØó&Tù -†Q)®3Ÿ¬ðEÑgcAØ ƒDòÕj‹ytR9ï'ÂAÉÉ=.·-Ð]bX¨b¨Þ•µ 7chdNÀäpÁI—böDñØÏîq}À°òÍU,aNèÖ€ÝÍ´À%w‰q÷ nÈÇ$eÝÿ!Öîãßd22íÇ¿„H§ñŽ,ÊÜ'80‡dËÜó‘ ì CÐádèU¿!ÃAÿÛ%â@ Œp$Mdíã!Ýžæ%¢1´ë‚Ø€­TÌ~ÙÞq`ͱôg.=”`Î؃=?q“ky¾!t+–#öæî£GJçVü’¯‘³9þóä¤g¾U|aêºOÿÎ[ô"òĹWÊÇ¡.ß›QOü|à -ÍòNB ²þÏ™PBX+z e¬„Xw0Ê{ð (óÑG'©Aª¾!xR…cø?«¾”UçÝShFÛH…Œ²½ŒbñŸ3£|±êO•Ð’ýbFµÃ!Õz]ØA¡!ØÖ7¼†mÁøÂ]"B±õ9±ÒÜ1±ˆ‡FI;/X1£@ÌÉûqâø‘ˆ½s´rÞ¤ úð“?R ¹ DCCG]”xwË"óUY°~\NA&”C’N›CûUîS®ó]:¥Të(Î⶜eã˜x‰»ˆ2ĺ=c¢èÄXúwL -ÙA”Š-Æø¶¬Ðg=PÐ÷œèIÉ`(ÿmN¤:Eô¥Ús"¥t ‹‘(òßyçÁ\>à<Šêë¨ Æ>aå8‚zö·¡.Ó(ξêNº ê`5øtB]›,1çÀK\Ó…C9Nûüí"ŸátcúÐÉ×k|ÀtŸÊӡΫÆ[UŒ"4™cíªÙÚàA×IÚxÝm×,ȱTA™¿Êb—1g®å?Ü6æý›¹«ÙÞõ禌#&„é¼öf[û8ÆÅH(ŒÞ×!¦ú9›f°UZ'ýxU€”8ëÀ+ù[0Êïä¸*Þ'©:|èv«Ü7ˆÁÁ(ž9‚m -m|áižo·ð|À­¥IDZn6pm¡{4™&q2þé|]þÂ6®‹bvÞû.9ªòÑcÙ¾ÚçØt7y†Xå=u’CFQ÷RGá}Š„Ÿ¼³¥)t ã˜ñ'{SZ…º‹6M‡¦GyO™P{N¥µUm»²P:? t´Õ“ÔËà´M[—osêè2*~ôÙïjÕ‚Ô`¾æDóoÜbÝòï:à™ÀÓ—dÖ(Wº5áó?(øXnÚ6i͆3â#¨Ã"Ι2®n~zR¾jú­«N¢ °®Ï™&ÂFÊ|†(:‹ŒHùx•3¦–¸ç 0èdrô©ÜÐ#Ðù8÷õ Fxûà_{Ší‚ó ç6Ž’`Ž(šíFÿK70þ¬°i»ß„ù4ö7/ôÜ‘I;J! +€£´0äÌðò» ?&…±láwU®Ëš›³]ªÊ0„à -Ê +í¼þq9ËWKpýHߺOà©î¬rAG¥C9íˆâ‰îÙvꜚ°«ªw%ß½áhê0zj±¼Å]NÙ("7Ö~¶nÎ ¡ŒÐ ¿8 -üÍW«&éu5Ny›ñ=UÎðŒ«ÂcÃók26‘Hü}Ž«OÅîi»)ÚîÍÅ‘”^îÍ|ß~åzð¦BGWöklâ²ø¦ØçãKÿEàD^ÐœL¥Áëöhj.—”ÔÜŸ^˜»†|ÚÄ7¯¢»"„ß½r†@Zœtçž$Ư%út| -Lð‰el -'ý¯$Üòó./”kþÇ.!nÅÝ*‡a:ãp϶+NcIøpA¢FqkYwkf+³›,2JB»]â’#\x+ëªXÝáíeÏGÁèñu™®jpIÓò<Èç‡M*¬rT„Çêk;q^7"E…½aˆ¯dj¨Ü‡îðYÍÒñ;×Pد%Ÿ¿ò¡ášËÎMjî½ô4M,Äή»Ê7}¢šóÒ½ª…–þܦrXð‰Ž€·›uÀ—.Ð(nQµ'Ÿùó¿–tj<ƒë8ð1RÒ½Z§ áNʶÔÝXÕ¢òŸ«0M§endstream +4716 0 obj << +/Length 1714 +/Filter /FlateDecode +>> +stream +xÚ­X[o›H~÷¯°Ô‡`©Æ\éuSunãJ+µÕ +vØb \ÖÉ¿ßsLbÜt/*†™sŸï|3ØžZðgOÏ´ÜpêKÓsíi¼ŸXÓ¬¼Ø"1‘ù@æÅz²xã-§¶e†V8]o{;¡ezárºN>/¹ü°~ýq6w]×°ms6÷ýÀ¸œ9ñòåõ§ÕW”qµzƒS×Ù°¸ÆúêzÅk¯p攱ƅ˳9ÈÜ€àë›Ù×õ»Éëuç Ûu1Êï“Ï_­i½›X¦ÓŒ-ÓÃé~¢<×ô”+ïùäfò[o‹×Ô”µÆŠâ¹éîiUlo¤*žg.•OU¹‰ö˜Ô&šÍß3¢8ÆœÊr*p¡åù¬ØÂLYï£6+ ™#¾çÊ|Àª<ç© ¬v¢Ý´Yžópeb×6pH“ŸVW¿kÿè>.»ÎÑѶ¬á±Çå•aÈsuuƒePæEòw*4·±€!eÜâRÊZ¤-ú9Ì’ûÆØ@w ¯·uTðX¯ÎìX´-Y.â×-– 3Å—¾&lµ¶uÔ´5 +Qš-ŽêÔ<G™÷Deh»ët»—ah¾¢ä÷ʯÊt¡ $Æ5FRA +ý–_Íà•B_ú°ÅËV»®†Âc! Å™ —¡oúžóà2g1º\z¦ïRÌÔkPhey\F*^ŽÅKRž¦ ‰ªB À^¶¼€¨¡nÞ-I/1ïB#Àÿås¡Ñ²L¹òxÆŸŒXnûèÉózFÕƒN‹ãŽ+KIV•Ëú^"¥‰ú/”Lkè帖¡Ð´#xË +…Q߆ð( è$"S4F±Û”[„…ÄpŽ:ŽEp%Ý<â:% Ïô{ŒaH+;€$¢Ç$€û9-¶EÚLŒ«j61Ž!˜A ¹DNåŽÄÁ†k7ÌÛ£´·ÌAɱ' é¹[iÞû±N¥¸®òô.Ú3œ1g*Ê⤠وÀí —™²«5ΆΠy3æ5,mPç.Þ¸CüBÊ5UÀ›W—eû äxF\ñÜm°@\œY¤m¼(«´È“¨ZðÊ‚MÛçM¯Ò»ö9æ½äêÄy—³)ud9¥ž†Š«ƒùQ‡ +¥ïábêªPú[@‚Â]}‘I9Sðd乌œŽît¥±Lh³(QBd" œvGÔ¶¸UÙÑÒP„Ôð`,⬠Œ¡»5a±NØ7è@™Vópc'ð†ý~0}0µF ¡ôE‡q'üvÈ$¸$ES…&‰EŸ¨0är4Y/¢[J¿CH#Õ ~qì#¾Ǹ`ìVyD<²Šödà‚%!Llñc˜¨‚a⢄™ŠUZ׎¢}„-Ð;©oÝ”ÅH̤Ïl€åS–A—(¨9/•Ûaî@pD˜êF)rCû'zrD…Óð=Bd‡wÈÜuûÈŸêûgÏF[)1k·: Ç7-¸Ò U†Ì°ÍˆÆpøÅò¬¸„ÛÂp=“Å:ýÞ&ü¶¹çg’n£.oAÓ>å׌’[ç(hèî|¼Eš&Ú3·=ÉÑÙŠ}?¶gGÿ®eóøÁ?3úË]¥áøØ’÷³†°ö¿ +¥Èšóú&ü{’ñ¯*}Þu×_®3K칡‹í ÓÞF"}OÔÙñKý¦»7Î4%j£¹¬ ¢ˆ5‰â\y"E JR1ÉLÕòr§˜”/Ã,ƒ\('gÚà¡,<û6{|ô÷ÕÄ›g¨}X€«OÄ%gnýè²È‡Êž\™P‡ü4ÇšZÔÉHÔ§yË9Ä*ÙõôJvw9ò…†Ìé«ÒÐ(woëR9’“O›_ÂÌ‘$~‚Ö¸»¯Š`"܃ÅÆ'B‹`uš—¦Šqšº®ðê 7´‘¾LÒ;*7xUˆó¨i„²Òï#¤4ЈamÛó,£ªtM·y~Ty¶^¥ùI•ñ|t!š®ªè_ªdóÇ.mEÕ¡(ý(Ç.Kп…jÿ¿ÿMTê,Aô=>N+‘Ð}Aî +TFƒ®ˆ‘Ž +ñ ŒÐ§£jËÏ{¤"Dµ¬4ÀÐY±“xãtj°ÜÃVñø#q¸\®Ásid"H:«þs,‹Ü!…oöñÏY×3ÿzóøkþsåþÓ/;ý7± +Ì08óIì9ŽéØ}0ü>ŽXÿtòßFíendstream endobj -4614 0 obj << +4715 0 obj << /Type /Page -/Contents 4615 0 R -/Resources 4613 0 R +/Contents 4716 0 R +/Resources 4714 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4612 0 R +/Parent 4683 0 R >> endobj -4616 0 obj << -/D [4614 0 R /XYZ 85.039 786.531 null] ->> endobj -4617 0 obj << -/D [4614 0 R /XYZ 85.039 763.817 null] ->> endobj -4618 0 obj << -/D [4614 0 R /XYZ 233.803 769.79 null] +4717 0 obj << +/D [4715 0 R /XYZ 85.039 786.531 null] >> endobj -806 0 obj << -/D [4614 0 R /XYZ 85.039 114.268 null] +674 0 obj << +/D [4715 0 R /XYZ 85.039 724.851 null] >> endobj -4619 0 obj << -/D [4614 0 R /XYZ 85.039 93.071 null] +4718 0 obj << +/D [4715 0 R /XYZ 85.039 690.707 null] >> endobj -4613 0 obj << -/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +4714 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4622 0 obj << -/Length 3419 -/Filter /FlateDecode ->> -stream -xÚÍÛrÛ6öÝ_¡·¥¦BâÂKÞR'Ù¦“ÄÞسm§ÛX¢lŽ)ÑKÒuü÷=ð&‘L&ÑCÇ3xpœ;,|ø ±¾JQ -£‚Åzwæ/n¡çßgÃX9”Uç§ë³oC½|‘øÉâzÛΓøÂ$áâzó‡wþó«Ëë7Ÿ–+¥”(±\EQì½]Þ»å*ðÞ¿ÖÜûúݧ7çן–±ò~gЫ¯±¡½+@ûùÕ§7¼”±wŽãÏqüÕƒÏ/>^®‹÷WË?¯9{sÝn ·Å@)$ÿÿgüé/6°Õ_Î|¡’xñm_I²Øi£„ÑÊ}çgWgÿiçâ>½àQcÜj0VÒ‘”ÇËEIä–SË©£åüÅ*I"ÇV -L"¤‚…"a¢°qøÛÒ&µ2R0Ä„Bêî(MØ;Ê«A³¼^&¡gord| -,éD5²úÅÛÀôFà Ár8êåáQ(?ðzëÙà9Xæp&\[yW:±(ö(u ð"¯ŽÈ‰¡ô(9ǼK…x®Òˆ8™E6B½}ùNC ÀÞdräÃ4ÜrØÃY:V¥çitÄ&^DÊ,’7,rféåR&ž-íŽD¡NË#¦¹è-õít7“Í® è€ „¿N+¤p]fpøuû úWlU^­@ÊûXÔ$;GbbT,‚XŸfGxØ6‹UkB¾K8Œxôµ$9ì á£PD*çq €H¯a}[ÛÊÙ†Ûû*«³¿PdR°í¡J¼M£“[hØǼftLP‡Uݨ¤®ó¡lUN'ųé)Å€Œ AìmëÛyÔ -â,“T‰$Ž\º¾Ë€>†«ŒÝÓg{ ¼;[sŸÍsnüÏtžr{ow)ãæÅrÛ/îaÐ÷>e͘èŒFy³'NêÐxÙµgù³;>üªúGÇ Ýï[ƒ -î;V‘÷6ËQ±°û á Ç+74­´‚Ãn‘æ²uºAxÔM–›‰'nP'ë¬r0æó¿¯ÀÁ7v„‚2¥eS·§ kù–|ÁŽ­@ã0°ýÁ…¿"=ûMƒž*î[çYÊvPL‡“HÙ‰ƒŒ„Ÿ|5I„O ᆖ³Æ! Cp ý­Ùü2ÿHŠ<[?Oji7ÿ·Ûiéµ–öÉ=oO,P ‚•9»eâ„ãM»Æî» Uâ–áä yWô½ât8à!A-œüBäA0b‘Ô_iÒ)‘c±$v6D!©B÷¹¡Ç1œHºÉrÒµŒ]ã´(Ÿâ(N,ÊÚ¡Ž¿–$‡=%Ê>ì3 çEYAhh:# -]3£[V±yÙo&Eº[çÛ‰îDzŽêV¤{d¿ÊóV¢´ ½ºÀ_°ôäKÒu¶}fˆåŸuAjgW›4Ïv›ièȳªæV±s2(UÎÚÖäÆ3HAƳ‘E?Ç)7Ž;GíRG,ê8¨xÌ7 ²ùbYü÷ìæíЖ]É1aÖéRJû¢8&À4sZúOqjÿ`é7a$@væ„ß$±PrÂ_±!a×[g;gpJ¶"Ú G -¦'Ô [ðZ0G}£}ò9úÒD÷¡F9Å ?0‰†%ŸŸ?3c,6 °×ò z±{°4!XÕÕˆìeNÔ Ÿ•ýµñs[”ÜøoV=ÚœÛç?üÀ§F®I'ÜM°·6ÛƒZ¯ÜÅDì8îlùƒŠH|rš¼& )Œö1Ç|?v6ØAÐEà/‡4ßíXZÑ= ÿpFZ$gµÝ=ðœʶøkÐò?s‹C’=<•Y:ŒÂMw×MÍG Fh¸¼ÀhêÝo€ùN7vnfôÖF * -zy{š6ª‚a5˜Èl€ßMžŠ¶bà½YÙ°Wé± ák"„%Æî7ÓYD›±z“3û++PµËiÝ<…pX9ã@Èä«IrØÊ©•/â0˜WN_Š0’Äý­½wñ²¹xp™1Iìý¤ŠöVùv’[¥¹UÑÑ(Q¥‘wÏú!dþeÊFì±ý„HÖy©P{(‚‚Öf?1iRÞ\,ønÞ[¹Aè•cÞj—‘U\ *Ö””&KýÂXÇÊA¼†pÒ[øm6 -ò̵¥Ýḃó 2##Ügñ°:Ö®´´­ê‘ÏI ¼w[¬9Ä\º8 ¤dØ-ª¹eå®d÷ü[³Ÿf“´aFk¤ï8œuÞØÙØ™ @!V¥Ÿx,«ˆFÔí]S4Çî¶æƒÔ Ìœ±Äþ†UÄüy„ºbO¦‘’=Ì°Ù7UÙþ–Áõ”C;-u -}^p›Lv{뢄ÊÕKFïhë »¼ÈÖvÒDÿÁqµŠ!°Ö QL¬¼Ãcßô˜WÔ]bOZR¹ú(r5Û¤3|j$C” “Ø£÷qùìî“Øß>VÛ_b<-]Y”3nÜf›ÔU ~ó™5¸De—q4ðÁ2N<úpæ`Uº2Ɉî`,¢^ ÷”Vï–÷­IÛ0‚u}ÌöM?‡Þªà^Ò@  äªfµÌéÊì_Y•Ý8c8šŸä”Nìþi‘èDZ£c…ówxM—(銺ÖEXÅY>YOìM| -ñž#³ï>è°¤NØ£§Æo -ƒœNÔ$Ëšýþ>·BXJË^ L‚‡%aÄŽSnË?½ªJ¶»E½Â "YÑä`ã¨>`H[Kî&V(o²-qú{þœ ^2à˜6šIÔ!UÐþ×ah=YJš/Öœä”O¬®z’ª»’à£ùª»^Ä1—±'œÀlúÚ[ã•÷YŠ[Mé‘üž‹‹:$YÆßC±B….Ø@[œ„€tP[먫0&ÆÓmï®ø‚‰oªg¬0r ÇîñÀ0¾j&ºqÙè¨4ž‚“'q0<{h’ -“ßÿ>¬ž4³O‡d¢…é …ôûÏ ÃU :2V B\¶ÃÇ%¸ˆÓsM ȦUÀå1W[øˆíkÍw¤¿b/¡”¦«¦dâÅä -Î?’±O9»‰gäíD³‰P ?H\í‘‚y.lÐý’¡‡´>t'¥TØgý*ä¾³{{ë&ÆÚ^“«p’‡$s­¸tÛŒåÏ=Ocù‡Š„‘wCužk¼ Èœéè&;1ÞÇëãÄíª—É(ñ>xo¬e8ÕËäc¿«èÓ› · ã ®ŠpXá €.ÀÒŒ0X2fï[rˆFäq]»Q7t3plÈ?ªDCx‡«bk$@U 2D»~tWEyß^m]åøÂÊ¿/cÍgŸè^! > -<‹Úfî³Mãhvþ½êž7žŒø@õ:{Û‡mÙžo­½íFn7û‰;å[È{"ÚàÜ;…rWém¯Ïq¢6Ž(øn`ËO:°Õ»ÆL›¬'…ýæËvÅ>qÚ ~]f£§fÜêïäݾªË%¤p *pBGÞ®QÐ 1ôºmLÓœUiDÕ¥("lg"{u䥳Ùåå «©D˜Ø V{oñ¨9Çš¥nN¨¨Fö5¿$„SÇØà]3×ÏÎ7jÔ=Òƒø<¬¾ ¬³iðÁwu]Õ/øµ›‘’Ï.Ûg­¾¤åÍêý¬+4Þ–eâbWÞuE™GFbÚrA² ½M -e¤{¡xS’¥Á;,Žø¯zgÈè㤅Âg±²‰H¤¢æ•äÕ]*¢^Œp|å½Î˜G+Š–T|ø¨x‰è§ö‡äù¡›Ù•ºËg4:bR#Œá„ï4¢CšÑ‡„kËI˜[®ÑˆÙÕè­ö±±^Jƽš]SìC(;À¨WÝKþ3éÂHEu×ÖIƒ™Ïœkâ -FaOücop+€ÕÕf;*"GE<-JúÂ(íNð²,ðµª[=~à«fÀ ‚ioX»µ#ýŒ¡1È ‹)—?ñåÊžÁ“´á]¹\ôD€“Z.QJÊü5øþ[™î¤på–ÉDuôØ ßcaƒq¤ÕÙ:t—·©CÆç¤2Añ®?dÆúð +G:59æý­ó=Í[îÜ•ì‚Ž62d{ôlüØ¡LÇÀ ¤³<å\,}ÿó‹ßp9A8Ž$žÏ;”éÈ6‚'àÚÝ”ïS¿‡—]ÚÐ ½`Ú.‰Xø\ÕxI‡‡éÂøf½ÿf›á¹+¢\Ú÷Ý5¾ßÊ.´eO›#«ùœó-cb^xUÍ-‰Var7¨¸ç®}©Ø ”ä >jZ.oó¹*ECÛ·†8¨Íj›KÊ'Fí0Ê{KáaÉÃÓÏv÷§4¹$1ÜsÇaè‹Ó#¯ørB”Z©ñ<ð Ì¿*ìîób¥‰ôßH)dÐCR.ÕX6mb5BòßJ,hWendstream +4721 0 obj << +/Length 1146 +/Filter /FlateDecode +>> +stream +xÚ¥VKSã8¾çW¸Š‹SEÛ²›*@`–)&0$¶fç ØJâ?‚-°¿~»ÕJÆCv‹ +iµ¾Vý’âY.üyVÈ—EÖ89œyVœ÷\k;ŸzžA dÐÂœÏ{Ã+>²<׉ÜÈš/wçD®Ã£‘5O¾ÙœÝÍ/ïûƘíyN0‡öYßí‹‹Û‡éwûzz…ªÛû/}vCfϯo§´7ÁÐö7ÎÎûÀÌx9ëŸî]Îw<[‘xŒ!ËÇ޷ﮕ@DŸ{®Ã¢ÐzÙu¼(²ò^À™ÃfÖYoÖûº;‹ö‹¬º’ÂYèðíg…ñŽ¬p±ÎÊÑQZ$ò¹?à>·›4™6ùBV›pÌmùˆQ‡‡¢}‹Õ‡-r‰ð‡4Ù³ðÇŽ‘…Á{µÈbv=<ãn·‡=ü]•æ¢zùT•ÍFÛzî»m'e.Òb*r U +ªm–È¥h2e"ª›â‡W^;÷`0'Éú¢’BIê*µ–Ô”…|"MZ@KéãQ½À®{!YbÇ=îâFièꄲë²TGTgX/ÒbXgbÓªË`IߨNœ¸,–¿ â^“€‚öý1°„­Š¸ª’¾+Y£VQQ)Òi xÒF éĪ}B.~P|&Q ®é0“ºS³£ ëeb(UZð!¦ÿë'öϧ/t¢Ðï~ù¸ï;¾·#£_nß}Íxû[|Ÿò¿ïD¨endstream endobj -4621 0 obj << +4720 0 obj << /Type /Page -/Contents 4622 0 R -/Resources 4620 0 R +/Contents 4721 0 R +/Resources 4719 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4612 0 R ->> endobj -4623 0 obj << -/D [4621 0 R /XYZ 85.039 786.531 null] ->> endobj -4624 0 obj << -/D [4621 0 R /XYZ 85.039 763.817 null] ->> endobj -4625 0 obj << -/D [4621 0 R /XYZ 307.409 769.79 null] ->> endobj -810 0 obj << -/D [4621 0 R /XYZ 85.039 294.572 null] ->> endobj -4626 0 obj << -/D [4621 0 R /XYZ 85.039 273.841 null] ->> endobj -4627 0 obj << -/D [4621 0 R /XYZ 85.039 208.822 null] +/Parent 4683 0 R >> endobj -4628 0 obj << -/D [4621 0 R /XYZ 85.039 166.053 null] +4722 0 obj << +/D [4720 0 R /XYZ 85.039 786.531 null] >> endobj -814 0 obj << -/D [4621 0 R /XYZ 85.039 110.14 null] +678 0 obj << +/D [4720 0 R /XYZ 85.039 458.172 null] >> endobj -4629 0 obj << -/D [4621 0 R /XYZ 85.039 88.94 null] +4723 0 obj << +/D [4720 0 R /XYZ 85.039 424.028 null] >> endobj -4620 0 obj << -/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F20 2865 0 R /F72 3966 0 R >> +4719 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4632 0 obj << -/Length 3116 +4726 0 obj << +/Length 1980 /Filter /FlateDecode >> stream -xÚ¥ÛrÛ¸õÝ_¡Gj!Àë>tÆë8]ïÆN«“ídó@K”Ä EjEʶþ¾ç@”H)mw2cÀÎçŽÈ‘ÿä( …¯ÓQœD"Ôr4[_ù£%¬üãJˆ‰™t`~ž^½}#é‹ÔOGÓ…;'õE˜F£éü«wóËõ§éíçñDkíI-Æ“8N¼÷céÝ'Òûp £7¼úîîóíÍôãçq¢½óÔõÃ;Þ#€ýrýùÖLUâÝàþÜÿøÈÓ7¦Ÿqéã‡Çñ·é¯W·SÇ@‡E©5’ÿçÕ×oþh¬þzå &£ûB¦éh}„Z„6ßåÕãÕ?ÝY¼Œx×´Bˆ0Ñ}qÉ°#.)•ÐRâ0Q“¼¶0´\!-p%Co†|–8=«ØûγuÅ¿í*çAƒ`+€Ê¶ùœ§u9‡‰W¶FÎ2…-vÒœÑÐGigg- -ïí{åwhU>0FÀRù¸ÊÆÚgb+ܳä-GìéXÈP™øƒóÜõIˆ}G±9ïÓXÃA[ܽ†ÍEÓàߺj c‘*Kh` o -rÈÑDÇp i<šH¼Ô”`æù"ÛÁyeËŠõ¥¨àk^ã­¼4¬‘Óà­òýW†ØŒ'°–o×HÈ„(á… ÅZòN\0ôEQW¶J‹È·²½}ηûºÊ b¥VïÇIàíÊÒè> DÁ{®K&ÑÒЩ‰1¤¨ˆ`îU„Jqæ}®ÃÈ3ÃjVÍyPf-ÞƒC`¶äÁ¬^çÌ-}¾p＋'ÚšäU[pØHJ‹KFCpL&^¯7xÉ}†deKB0a6Œˆº\¬–±!¾b ¡½› °Fs‹z˲£À×Þ=ë¢1™š6Õ $À¬wÑ;$©]†{hêÒœõ‡ú÷÷7ð#£™®Š†×:"À;]òô „ŠGω?Ÿ9 ‰±'diP¡ìYÝØ×”³!ÝÕ (7(­í Uè}滆 'Fõä±kÇoüûÀÉ2JZ#»ž¯‹ªhÚmÖÏ9Ÿ:­ë²9@*Àîô¿ÄpƒjA:Â¥ÀeÐ~,t¤N´¡j J©W‚bÕ˜Èãsî*`j¬”·›µ©zÀæ4ÚXÏy%¾ŒfÒˆ -cCäNB"¤èáÓ„µËèäØt -q+<Âv½hAd¾ -, ²"•Ck-ª%/ᔞäóP?Ñt@¾@²ëÎÉ'Æe­á›*ÛŒÑàÍDØðˆTØ‚¡ë³è:Ô÷ ;€‹as›¯BNØÕk¸rkTÇN‰(”‡@§À1“ßÈËœÈ -¨:ÀÖÁ«|†ÑÆ÷Ù3¤)xغ¥ ŽZŽ3Öy–WŸ @ˆVI'ÎØîÈ ‡ÎÆp þš¼!"Aˆ²^.;>BCÌúyp=&Æ }Äeüƒ)F½Æ™Ip¶ƒ/>hÆ\}ˆH=¼Ö-°ÖbÀUF{N"øNà óµkì¦b~H:ð0ú×;”âÜ€ž`´Jb"0£ m^PÇjŒ späƒ[# hòˆQœ K%4ˆÙ­ã‚“~ Õf¸2óz‘;7xð"uo|qéÔÖlËÊ­Êíý[tÓsÎ -“#˜ n[;33^†ÏˆÙ¤ÄR<.i\š…Ö‰>VÖ ~)7Kj˜j¸í²S£{Òç¼i˜já‡ñeoÚ:ïM-JCó¦Ñoz›ñ¦]ld‰ïÒ•@ý’­Q´O/5N$Vâìa ¯¡áM$E_q†VŠ­Êx¾¯#©±íyäPûŽk¦Ø¦lº5ÚÁ+×*•Çy=ñÇYŠ´™q‡¸÷ìg et¤¡U¶6Ρ^°/à¸|e(öT-Û/æ´(˜E3çDˆÎ :9=%¾´Ž Wý¤B¥6÷xê~Žqwýoä=ØÔQÍJ R ) ¥6žjøª’D¤ b|Ú׿}òø©HBCªüµ5 PÑÛJ”=7¸ÔeÐÌÐê¾Á8ÑQäMÇ);$ª%\Ñr„;ŠD’t«;­ÙѱiÛÒÃ]ô î(Ðv‰;åw@ˆ;>rˆ¨5“89©NÉÇE1TJÄÈ<ß1CJìÐÇt“¿*ó…A½¡Há4å¼£‚¼!€Ó/;ªÐGe€6}ÖQ]BgÕElÖQu°71Fc£Nl ìQPÕƒŸ'‚!§€! £ßS™OúU>îªOOmVœ™$ÝüÃ\aº ^hç0îŠW ÐÔq]܆›Š°¿àÀ×4ÔJ˜è؇À”C¨]§¬Ý0ÅvÌÝŠ(ee>]CŠÕfOƒî7Ú¹§§XúÅÿSK#õ…ìdzHÞ]ËT†îÊ^ ~°®Ms‚oźß"Âqÿ£%Û‡Äh>7ƒÉ2ÇýØÆq’   -:µpѹµg™FUÒoT%½FúÎÀ÷Þ™´Nyø8µ GîŸN®;çfòÅai.£“»zj–,LúcYµý ÍuübGžèkÖ»`j¢¬Zæfn{ÈÆ°À“‡4Nwª$«æÆÏ1AæÒ–§QÔ²À…<3ØøËP³Ç¶ÐYÏ$Z¨(ýqÿS‡)õp‡úŸ(K ©ÎŸC»|8‡G žœœsð…:„#pÎ Kp)RŒ]Ø%Å®ÃY ôx_Æ0 -D½G,?{ìš=~ ”¯ðàÑŸÀK*ìéâ¿Î˜˜80GoïÖjô®jGGó¹“ÎÁìN“®•7i‚ 2RDñÏ&?'ÍÉðª\΋ͥ]Ii~äÝqb DȾÛô;Iø€ü“™nçþ¥-X.ù4Xl±z²õF¿Õ¢B ²–ÃÉ.« Ùµ.®¼ÐU¬*ê]ËŽáuýL-œlWFïÐá5»ÿ(­ ´»²aÆÝ%:{Þn~»D \pdËÎJï ;ç:»åÆŒW¬; õ•„xE7™ ¦ŠÍÕÂ@Ùߌ÷ÍÛÊ8E¹-àxYeíñžïT˜£uSZt˜~úøÐo n˜v^ó¼âPˆ±ÁgßBß?¡‰ÂµÊ±§Š¶²MWS r'Lu¤ˆ]€RÖ¡æLÒEÞ¾Ž` ÊnäÖKÆ]3Â×/Mçݳ@÷¿ZVµiðBàŒ}}tg$,[žÓ6Ê"–+üš¼"ö–[ÊD6šž¤ÀUôcE l®Ì…(VÙ³ÁÁ7ƹHO(4? -¤È+‘ÌG„ëZ;È(p,ÓÇ«–\ŽãM›|5åB³¬YÑ2;–“%mÄîź^Ðb)B`ÿàÿ‚¯Ç€"ñŽšýÿ¬X(ÐΉ’"Iƒ‹–À§H‚ÄyjÌÇ¡!·î¼Ài¥ ša!£¼Ñl‚”_B €øByÙ½„ÀÜõlÆéÔK®‘Ž ¸"Ù~-ÕUxÖ«³ßX¤Z›Ö2Tßõ†ª®|›=Qo®pîϼfj_A€ìPøô(r®l…¥»ÐQp$œNàeá@Á±.êGb ’NŸï$¥áïáîwYNÖäàüËñ¡Û6Ư‡)ÿ>æ³ÝÖ5Œ™q’Þ;;™•õ²9# (êá/¿^w`Î?Ç*мB%'o`P¹ø{ès¯bŠh¾Ëk[~Ü1DÌ zY¬—üùÄù=÷Ê»0}Ä•ç"áêà@/œœæˆu±wu<vÕQ^^îí.ÂUãÂï‡Ð^Îaã9¥üä8ðT÷PSWTc‘@€F®˜rt.Ê¢µÉ˜³qy•¦çðÛî¢) àwÆbÓeæJ2ï Éùv¾ñ;D\-‡ÙUÝ´ý7Hɾ^ppR¨÷èõ¤²VƒSä—ßà[Vj»Ñ´…ˆm SyäÓAÎ{“9Á4¥~8°Tâ;[¥›ëÙ4ô@(ˆšÒ¾Öº#ðè`†z4ý5 -µé¾÷Ñ…a³Ø(d80,ι±PZ{1ƒä/ý gþÄ5lý!„%1äìTpJ±ý}’ÿð\[lendstream +xÚ¥XK“Û6 ¾ûWh¦=ÈÓ5#Š”,e&‡ÝlÒ$“&ÛØí¡-É^µ’èHt\·Óÿ^€ díÚN3íd²¦Àš{üã^±@¤Þ<‰Y$¸—Õ“ÀÛçÛ w3'2ÉÜ,'O^F±Ç–©·\zÒ€Eiì-óŸý篮ï–/>LgBŸs6Íç‰= ÿùó÷?¼["Gú¯ß½DÒûßM9pá/_¿G¼[äMúKd\ßLg ³Á‹é¯Ë7“ËÁΑ'\´òãäç_/ÞL&ÒÄÛÃ:`?ãg0 ¹DÂÌu&dÈHÉ,HÓQá¯ÑÚª²®ìËfƒÔÐÏtFժɉ°/Ñ¡Šöt±@ŒGt­œœéõfºA•¦ Ž¨zíÄ@A/ùööõK¢þpY‘jd”´U?Ђ<^Åõ+·Ááæì52Š‰¸|÷_; B UžÓ—Ù'÷YÑgÙ”¦ÊÕ–ååú_Át‹¦±¨ ­mTÛMá¾ZÒÈA-ÿxñmAìú©w- ½¥ +v7ÞÒÊZ’ß—p–«÷™÷7ò¾HRÙ³2Ëé:¢YÞNê›VW¤ *;s5IN‘´§`˜‹Ê («ÂimN³œj‹Åôv¸Ž>™0Ø…â+ç’Áµ~Añ… ˆ‚èlñESBÉB~QÝ€Z9é‡Z†¶%¢2% +t,=hF)ººö ]IÈGsÆ#n§ÁCcoê±—NÂÆâ4BÞG³@¦© ‘ÑÚôÉž¼®¹w«ÁLod©S;éµ–òd„S¦,žGžÐß\‡½)Ö6×{aøØU½RX£R†šÚÄÆï*³”¢s·;l"ââ-ÈQ.ÂâŽh…^ø'.é9XìèKSX¡œ¾anØæ]ÇS†t°=na„¾­êë(B.¡jÝKpÙØ•(Ľã3AŒQn¶}2™Ž™|EüÜæ•«5NÇ +Ï:<=_s èILøhµ6_¹ºS¯¶Øeúʳwä"k ó<2—±7Âã7ææÞl˜PþW¾…›‡ŸþD˜°t.l†Áé˜#ˆR$l” Å$ƒðJÁàS€ÿ\7Ø6X¡E".±AÅsa1{¾¢ˆ@²¹øÛŽ2”7gF°p²y0î—<ò×£fi;6Pc*y­ª 5=|ÚŽö¨ÖmVËOÓJhYY(UŽck'Gx È +ÃÐ×i§lŽ·Á]ïÀnB„~!Ól¡­vIí—»¦¢j”ÄÌGÒžÆr-Û••q,l7§ãÙ11e ƒÒc°µ£Ž-øî0Üå™õ +W( lt ƒcf;‹.¤j…̲ÊÉ|§†÷ôÐ-Mb­!JIáÂ¥Ít\<ÜS¡ÈªUhcY¸ð†N=\Û¸6hëÙ£jÔ¨#læ•ë"vŠ/ƒIhMT!ÂQ¹¿˜jeøX¨"rQtvÿ>\fãŠðžáGhC3J§ê§;t¦ºBzìÛÀ©íÈŽXÐåóžn†zÈ*"æÍXî4ݲ1þ…æ¼WÑëç63ÀΊ &’”=ܺ·¹ƒÐÝÐŒFå¸>Ð;»w}g±ß.%¤; õ5§Ê僉%wVšlìèi4L; ïÆu™¼'œƒ ”ê1péT×ep'kKzX Œd@U? Ê Ø ‰ä`…ÜZ9±­ÚôÊ\jUkZïûDZ N¬¸)¸}h€”]…2}ÇFÑaúoaܞŕ¯¨"`uÓ*”!$×9(©šô»ˆ§K¥O8„´^ëöÑÛÉ)pc1¼Ú”›DGO æåàWft{ ™ ÞjnJPÇV(wÀâ|—áB0‘|¶ÉE.ö?$Lû_ìúßµµ5³J[ì;*ÆûÍ©~k;£Þm° ¨‹Æ\2.<)?o÷Qæbs„©=Œè.¯ñl9JQz(Å=?ôîøDª»!¥Å.äަǼUí­õxsß/hc7ê#0\´§6AF¡‚ýF“ý쀫+:¯o—¤ïÞøÊ[»D#ð݇­ö¸£· £øÞMà |TW }\jI;ª£ Æþ¶`—ÃNU$Ûú <Ç£ êÂ¥ÑÇ:tnDŠ˜¤¼ƒþ“³ÿëÇ°JFÀ䘅!Œ©ƒ16BþØâþW³S“ÿäëlendstream endobj -4631 0 obj << +4725 0 obj << /Type /Page -/Contents 4632 0 R -/Resources 4630 0 R +/Contents 4726 0 R +/Resources 4724 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4612 0 R ->> endobj -4633 0 obj << -/D [4631 0 R /XYZ 85.039 786.531 null] ->> endobj -4634 0 obj << -/D [4631 0 R /XYZ 85.039 674.352 null] +/Parent 4730 0 R >> endobj -4635 0 obj << -/D [4631 0 R /XYZ 85.039 604.485 null] ->> endobj -4636 0 obj << -/D [4631 0 R /XYZ 85.039 563.231 null] +4727 0 obj << +/D [4725 0 R /XYZ 85.039 786.531 null] >> endobj -818 0 obj << -/D [4631 0 R /XYZ 85.039 333.848 null] +682 0 obj << +/D [4725 0 R /XYZ 85.039 328.974 null] >> endobj -4637 0 obj << -/D [4631 0 R /XYZ 85.039 291.364 null] +4728 0 obj << +/D [4725 0 R /XYZ 85.039 297.686 null] >> endobj -822 0 obj << -/D [4631 0 R /XYZ 85.039 291.364 null] +686 0 obj << +/D [4725 0 R /XYZ 85.039 133.38 null] >> endobj -4638 0 obj << -/D [4631 0 R /XYZ 85.039 270.836 null] +4729 0 obj << +/D [4725 0 R /XYZ 85.039 99.236 null] >> endobj -4630 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F35 2880 0 R /F11 2898 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R >> -/XObject << /Im2 4150 0 R >> +4724 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4641 0 obj << -/Length 3722 -/Filter /FlateDecode ->> -stream -xÚÍËrܸñ®¯˜ò‰Så¡ à#7­lo¼å’kö‘Úìš¡4¬å2IYÖߧ_I‰ã8ÙKJ¥"ÐhF¿1jÁŸZe6Œt¾J³$´Z­vdzhu #?ž)ÁØÊf‚óÃöìÕÛĬTæQ¾ÚÞøuò(´y²Úî.þ~þqûæÓz£µ”×›4Í‚·k¼[oTðþ ´^òèëwŸÞ\l?|Zg:ø'ƒÎ/_cÃW€ö÷óOo¼Ž³àç_àü«+_|¸Ü~¡ï¯Öl:{³õ˜Qiä>ûýhµ‡£þt…:ÏVÐŽB•ç«ã™±:´FK¿>»:û‡_‹ÇÌŠg-qËÄI§Ðˆ'þŽí´Í‰eKÛE«ŠÓ0Õöä:4+‚u¸ÅèæÉ:¥âP«xµItšTûKLã•Ran-^¢Ri˜äñ*…SF6¥[¼lÍ2¼|ÊX‡žg3à0¬¹ú¼Radò\3ΤMF€WïŽjõºJW3byÝÍda"Ve‰S6 s“®R8±É-{^×ëy(€è½+{üô ZþþÜT__½œª¹ÿÊ þ‘‡òˆ}ü+R¦.yìKUpe±8^K¯’Uw-ÎlO][×å^hat‡(49Q8pÍ4Ú»õ&N©0µÃe‡ -W¸åÑ5Ð÷Ô@{r6:ZÏà]ÛàöØQA]~¡Á´.³Yð+vkÅû5Œ4ྨ ÑÈÖÀ£çdãþ·÷Rë ½°1a´—Èðj%nÔ^×x¾ ¨^¬’þ—j(jÀ«eüˆÊ‚–pùF¶¥kÄ©û²ª›Ç)Ávd³Î”  ¸Æ#CÚüF#ʯU³§MzÜ÷r+„WéÅ~%}>‹ì·Žàk¿U\±¬Ð*§…!N9)I1%2qhdq;bpÙÓ¦hP [˜s`&&|Ä*î_ÓÂe/‹^;™ÃÎÞ‰ÃPvt1´=Aö<ûú]{äÎ0ŠÐó“\áž´È5Ê2庽垤ѭ߇Om ÈchA±'öé/˜;´©*OWo§ÿw ƒ®Ù Ûì›.2Ë•ªÔ¬8šYW¶ÁIGTÌ7da\‰á2­‚_ªò¡BMÔI¼EµÄ»ÇÎU¹»ï@5©,BÚ†¿Èí$Û„W„)$s8åP¬u2zÂ#&QF¹ùö‰F6Ávj‚åD6KÃ,6t¢·ëÌ°ÐÄ© Š¿&¸Ü"uæUEÑ«ß>2pWWeƒê2¼D1M‚ÞKám]nÈ–ÔÕ1þäåªáÀsIu„¦¥º=Ð2 9¶÷kÅk Î5†¡bøKÄÅ9r;$£Ìnì¶Ý‚”ïñBº’”lhÅzjcÙ~bÓÐm„=Åu®à ‹K–{"ý ÂJžT—è"·ÛŽ±~¾¼àÆ]1 ö…h¥Á O9À¹G€•ïe2)>øaÌæþŽ¢¯çgdŽ§Èq£,ñ -¿ƒ×|–j/‰}…5pîǽHhÙ XFžIŒµaÇ‚.—ß=òÅà¶*¹ÁÆ«ôh…TÂfq¤‡`³ã‡’< -¶Î^‘mT Y¦Ž¥K Àø·c2d " -‘ѱܑ+c{§ô À;Åý -2|Øe{KÎå+Å¿6¸%1ˆ¿FçÁ«,® ª&z²Áuæ -ølL˜€q‹fÏ›<âÆ Ôy¨(X‚«ŠÛü@2.ÚÇ—HÚ#ÂórºMl,ð(ŸÉÒÇ5ÉÎ9òEÀ -UÛ,JFæ^2–v€(Ï(?¿ß»°e@s¹À°L&÷ËmLdˆ |Íɼ3懥²ëÕÝ•q¨ÒDQÐ@·§TCÇašéï'9 “ÈÝÙÄdif¸,”Kî°“Ÿ9„Ò•Uƒ· ¾ähäH–ã$£{™ÞOÙudfà–Ž'·¸œŽ!Ñ"xW~¾/%Ý3èŽôè‹sN N%PdSQPÚa‡²–i>0‚¶7V€=zk^à>“ ¹J+Œß´‹ßô,\c"žµɉ­·acrH±…|5öX5U?tšQ’‘FÌ‚?ÍÆîÃÕøÀ]<:}ÅÄ7ûI(E·²Z]s¬)݆¿s2xkµŠ{dhùÅ=Ñäó "Ίû5¶ê Þ>æÁ€WYfrÄÞ*2S燣xµ7<âo -ÀÀ莡tÓðvܺS"I$®¸lïf—Ü@vã|NŸrøã¢Õ~Äo}X;5«Ð­Ö’E¤,kÍ浡٠Y©¢f<Llñœ˜xeSØ;GQt.Î$äõî;Õ±DCbr:ËÚ•—$“¨ªîpÔn)«0Œ_²"`­79çûý‚åˆu˜¥ù‚åÐÎÌckTKÍ&ä¾#SÏ"[?ò(â!ÂÖ È”HÁw¾®vÇ+ÎŒž£ýŽ2zÇEÏÊrÌ;ÜàùƒG©ìŒÊKlŽÁž´Vq]/½K´ÜTœÇœƒçs¿‘L#1k¨zϪ٭-Z}K÷³s©ÐøÊú*°ç=oF~½®èQŒ”A˜ŠcT€F‚È`kZ¡ÆÉ…„(=SLÕ -8ý0”^ä‡ñTr@®L°à}$R‚¼A%s¯tâ^S ‘S®¤f–.¥RAp…xlìœ꺉›iy&å,rZ4ϽÞø%­è,Mù礒!dx/LÏ®J“šVˆFþ\®hÿ¸; [Á݃Ë\\Š~©:J‚ëMÃOW¸(;b=qn¸Ð“¹I;ªK‰hT Ù± Õg«*¶ØfRkr$ZNŒàÑyðÃÓõ¦¨Ü2†‘ðZ–:œŒ«Ï÷G¶¯c*‰]EáuIB—à«xãßwƒ¯…%R K¸²"7£w슸p¨%`@€ß®•'î:‘Oœ£s:œÁÇöÜù-Ø ŠÍ¢yŽIq•dã0&Å|è¶ð/ɹÊÁè®NšKVPq]”ïa÷æ9²ûõŠ–„Q8O’R•™@dR’­§Ê;¯ëù|{1ipu¥½ 7ü’4¸"á ×<¾¯Àgÿê{ Š¥mhøWŒOõ -þ™oéŽc; ó,^VNÇa¬<1dbbû”b«³Ðfzäã°> +stream +xÚ­Y[oÛ:~÷¯0²Ø ÄŠDÝä!§MÛ­“m\ì.zú ËŠ­V–\Inâ¿œ’¢,Ù9À. +Ô9ä çòÍ c-þχži9Ñ8}Ósìq²Yã_y?²ÅTL5š?æ£Ëwž?¶-3²¢ñüIY¦ùãùò›ñæÃÍÃüöËdê8ŽaÛæd¡q3a¡ñæÍý×ÙV\ãnö¦î¿|žØ|5tŒùÝýŒÖÞ +Ÿs9,Üü1™ršGNxû8ù>ÿ8º+9µ›ØŽRþ}ûn—üFG–éDáø™-ÓŽ¢ñfäzŽé¹ŽøÎG£ª³hÍÓ®!¥HŠ)³Ì€±>» +;ç€Ócg§¶Elˆ“Í\Ów|®~Ó |âðWÉƬÈôoñ|“¹­ÅlO³˜¤’D`²Û®ÚxZÞòQž’¸ñ\“ÛW‡JgadzÌkœúâšWÄ98 =¨,þ´l—s^íª¸á¿YY?=gÍšFŸÈIEsmÇŒÜpH´¾5íi#Û´ì`p“Û,@ ¿­òr:Ë¿´$Ø9ÂÕ:M&»*ã$ ˆ¹'…^“è;>]IZ ìN‹¤Úoq'n‚aŒäõó„FYñ‰eÝ9qLÒzà´"m¨@±¡ˆ7ig+EÄÖ‡90¹å£÷÷úIô ,Êêçª*Aþ-í‡Ìn¾ÌînØÿxå r,öTi7é’>¶q¥|/mÒª>~È’¢f…sâ"à k1~;£c›R¨º ÏëT¸Ð"+@°M±Ò©»'·¬J`Ø Î÷D,,÷U~JÞùšF#Æ5îZ—âüh’aÕ4z+P0#7A«•`ÎE‘ªËÄ…ê ¸Å"¥-á~Ow]×5¾ÄÍ:,²æ¸°lW 6‹ÉnGKu*Ñ94mêP”E!‘4Y@Û©¸nVµdeµ?.ÓŸ–gùh/xBãüB ð²¸ÁÕä8ô‚HbÀyYœKô,…wñ.oø¤=øã?¯‚!ïØŠ$A¼Ýä“wì^«Þ`Ò&†úà +ÂÀÓcm¹ŽÅ§0áOÅbÙá+ãV¾ÂpáG]^RüKBZúvEîQVÍ÷~ˆ€Ûc(}ð/2CY7å +þsyù´CWFÍaÅd4e"à¯NhFy¬ +G r/ÂyÒ\ŒrTáXB`P-Àg¥¥œb*#£t¹ŽK#·wC³@(=z=j6¤LD™UcM¡;a-áG;îåþ‹Då¦HÌÚdª1@ƒ¡ÏH gï¹*5Íýënþáþ«è~íʆL€óìë§Oš—ï0LlÆ/i­ÒW(“x/¶ú×Ñó ust{£éàöšõ°ê‰ õ3 Ñúçs4Û!ÈBBœnNÕPÕ«”¾+ÀÕ¤Õ¶“rGN¨ê ®²ÚÄ4™ÊŸzµ}ëôÐÓµ‚Àä°+Rè&.¶29ù“@eÌ,¯ÿ +Ö5•*FäM–mé$ÌóPHz +ë´Ü”dOû~²_¨ªâ/T™”]ãJ3îªK +ÿN‘yÚûîÝÍÇä&[ªßÊ­*b.–²<¼n1‘À®»t:ù®Ò"­1÷lé„”ŽþCZÑj­Fn–¥ª¨…K˜ûùš !5Žùø4“-áŽo•èÙ°Ä›¹©ç?„%¤>rí=•ñZç&¡b[%’FfŸy¢p3mw¨WæWc¦ÙÿÛë…z±qìÈ ¸ž»YAÄÂÐ }r°Ï„—eŽÇaâðŽrR Á´Jo ó®èÓ™„ •U^üˆ ßÍ!1ÚÁ7~´eW’‹bƒ—JÌsz¬Ã±àŠ™,`BBõñ;˜ýûPb¦¿UMQQ‰Æ"z'‹9ú†h€Yè!À/vàœIgR´08µ.ë”vk•ÓØÂoL?ØRA gªÇU©8¸|êPÁ—‹x^ã5ýÐÅI +u³•ÀÏër—SògŒ‘>SØò^<ÔPªÿR]MAÍ!?´­áq?*ƒÿJeð“V¶¢:ƒ™¸@n60h©Þ™Ð3S\ Õ(| ñxýËÃä&þ)ÞÙð“#!´™æD+£žH^Þ«w3 }%á@UË\ã-P±€×óQ"ðª#X‰w"%?›OóùBk X®÷uCVÐ/θHSzy>ªž=û=BŽ˜g$±h:•-”Ÿ ¤DÛg¦D'ÿþ Ñ`6cV?›ÙNhÚVˆòËWk× ¸ù­ŒGÊ%P cÈÓ³¬ca ã>0¨Ñê2½óÔÔ“ÛñÌ(ôOËÝÒͶ嘑ï¢ÜsaÑÐé•••JšÑÅ;½h•cjiYÌfZZ±D6²xìnÒ¶§ +±¢%ª[YñŠ´NduD‰WÖ®xÔZ6øÄ ”Ž,CÓ¬–_¾q¥ÊdǦ^ï^y—åQrÌø\ú³P¿è¬ÿ?E—rk³ak{¼òc¶½”±C‰=îÄ^è ˆü_M•¢åendstream endobj -4640 0 obj << +4732 0 obj << /Type /Page -/Contents 4641 0 R -/Resources 4639 0 R +/Contents 4733 0 R +/Resources 4731 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4612 0 R ->> endobj -4642 0 obj << -/D [4640 0 R /XYZ 85.039 786.531 null] +/Parent 4730 0 R >> endobj -826 0 obj << -/D [4640 0 R /XYZ 85.039 617.717 null] ->> endobj -4643 0 obj << -/D [4640 0 R /XYZ 85.039 599.048 null] +4734 0 obj << +/D [4732 0 R /XYZ 85.039 786.531 null] >> endobj -830 0 obj << -/D [4640 0 R /XYZ 85.039 448.857 null] +4735 0 obj << +/D [4732 0 R /XYZ 289.523 769.79 null] >> endobj -4644 0 obj << -/D [4640 0 R /XYZ 85.039 427.66 null] +4736 0 obj << +/D [4732 0 R /XYZ 85.039 322.14 null] >> endobj -834 0 obj << -/D [4640 0 R /XYZ 85.039 128.427 null] +690 0 obj << +/D [4732 0 R /XYZ 85.039 162.479 null] >> endobj -4645 0 obj << -/D [4640 0 R /XYZ 85.039 107.23 null] +4737 0 obj << +/D [4732 0 R /XYZ 85.039 128.941 null] >> endobj -4639 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F74 4586 0 R /F35 2880 0 R /F66 3242 0 R >> -/XObject << /Im1 3957 0 R >> +4731 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4648 0 obj << -/Length 3747 -/Filter /FlateDecode ->> -stream -xÚ¥Ùrã6òÝ_¡Ò‹©ªˆ!ðzÚr<3‰³3ãìØ»ÉV’Z¢,ÖH¢CÒñx¿~ûHJ¤&[[.—p4Fß šð§fiä:›%iìGZÍVû‹`ö3ß_(X -ȲóÝýÅ·ïb3SŸÙì~ãðdeñì~ý«wýÃÕO÷o?-–ZkOi±L’Ô{·PÞÍb©¼÷o¡õ Ͼ¹ùôöúþöÓ"ÕÞ¿yèêãlïÀ~¸úôV†aê]ãúk\wÇÃ×·ï?áÔíû»Åï÷?^¼½wèQiäÿqñëïÁl Gýñ"ðu–Î^ ø*Ëfû i?2Zú»‹»‹8\lj|06K`÷®D5Ôqìý´Ð oµA¦ãÑ&ˆœg‰ë`F·%ÄSg¦/– -^>p¯&Ũbë¹s©ß>ÖÕó6ÄÊ.Ø,#XKWÿ´#›}¦Îeã6$#´Œ…³ëH{—èQpż.òõœd-ðæ/Îsµ žšõyñ…­ž¯<ײFÔ €Ú'²‡- d=Qʼ}.V›%(¶ò™xwÃfKç+ñv[7Y‹}ß‘6¶/™‡ïGN÷RAZ1sqê]Ö—Ñ$‰wùrI­8Îv‚@¾@û’Ûe+V0>>[ÌÔgè¨çöèß)ÎÉM!‘§Ó†• „>%I뎽, ™ŽÅ 8y‘óW£ò©Ññ‘Œ½Š{ÎÚè㮢‹Ûñ“ÃdÇA²O}“0æÖÁZß4âšLä§ÊÂÑ@¬ƒhw;ñ¶6åÐd©! 7áÐMXA3F®Â€½Ø•MË- -}àw’Ý& -ðpÀE»'s15·%d‚‘UÕ»5ÙÅe’)6 -C¨ñx©älNå÷ì=†¨-xØ .®Àz3œ·pþ…K#î-o )‹±ì§ þôŠÂÐÏ"#0åª:8Äì_¿¶IbüL+Y¿Cñ -¼ÊR+”¡eOˆG±Ÿ„ñÉƵó¿âåœÃ-»äoóU$&T¾Š†¾tS\79O•I‹(¡»¤„ -b§ÿÚ™òÙ%I³ -"_ÅÖæØ “ÏØR6[>ཱུBVp^¶å -·’ò£Fô-Ò–rå8¶ˆM¶šùÁÖ‰pŒí.5Qˆ¸p…½.n;—èÊ&‚<矋 HÑá¨.Eœ –#ï ”ü•|›ðËï–TøÏÉz˜Sý0¿#úah ÆüvìÂØwåÓ2¾¦ƒb!^EÃä5¹tÄó§YLÉgqQ WÕsí/¯°‰ 4÷ ,Rù€^ÙòŒdן¥[örüs°ÂÀ6Ô'2tq˜ `ÄÌk8`–]ÅñëWA§7Þ‡ª¶I½½d*Ü•;‰Kª;ì@WeOÑŸm)•G·¶­ %ç£Äa‡£9pMU4(jr¾ÐL×t’ùÚ„Gu„Pêoì1)ò,V`Ì4t^9[ü ;Míé¤_©/@. ‚{žd2]]ÐQê'ò,ð¦tê Äq IG!_KDò¿»ÐõéÝÏôÊ•8ѼºÚMÁ¢á-—{RWÌÆÁÖù¶ŠqQŠ1F;/¹*¬¥kãç³Y“d³"îHµÓ>*íÚ÷éTþ=ã˜ÀH•XÛú­éL5v®³0˜”XRÃîÈÖî(£~œ r·ÁâJÖS‚þ¦Ö½rg-Šâ~zÖ¥²G/‡AUVŸ°…ª®…ëßÑ@äuϨ“3l\ø­ó GšïžFb¾š®²üéç këSm4'´âa]•T¬Óý¶ì2¤£Ú"Ç•ö‘;ÛP¦–¶~žø -6ï¹Së“Àµ“uÊo DëÒ/˜x@î¼rû¨…Ëü[|É]B¹h¾”LRzCÂØÅØà5w‡Ê™j*šÀT_7³dLY„|HìÇÊuc¥b±É9[XªÄ³Ns”;öX?]ðuaº}×è¦{N„™~Õ„|2½ßÊ[#Ëëª":T_~ñqÛnJçVýÃôÛ„Š\€¹&®×Õ‰Çå'̃}J*%EV漯]NðööÒô¸"—J©G§ PiZÓ ¾d‰dfÇIg¤ü.ÚuÙcép?´¡éùêí…Y“eå:}áL¥ŠIÚ#gÀ‘Íë_ûY2ò:Q:!XÓW'>>Ë» ‹Üà ¼l'EŠô5õr”ü \³Ð-oÊƽɤ=ÈÝ“}¨J–f_q)Yà2<F+‡¿6­Æv]´ù×.fÇÁ\SY,åz/öûåêåé멳ÎYbe2‹ÏÜ)ÏÛ|ª°¦ -•¢[Â?‡â…±ŒP|tÏl!-;MÁ`ÐnÚÝ6`m¶îÀE¸å1''"QH€8†Aâgçßl:*?CFvA•ÊŒÅF<}à:äÚ¾Ê#Y’qÙJ†ƒr{ -£ÅÀE‹O„äU¦üD¥gÖƒ™U¢}cR:ÛÎDà,h7%{t)#¸Ûõ0Ê|íêš“ú@Û _z›rb8år®üðØ'ª Bô¤7ê*¬ËÓ÷Ó☒O"”ý$B…lƒò]õÈ]ç#Sï ¸G£•áaÍjW±Ÿ­›°ˆN‹Ù¡‚`ÞVÃnÿ>)ß¤Ö sY ­ vq’y?†¥š!µÇpS¹k‡dîKAÆ ŽlpÞöjVig zõ©Þ×5X¬-$@êÖH1¬«/Ú‡£Z†ª ?¦™H9¹â:Y#ä=©¨óÕ,.7 ªs2ž|ô+”žÐÁ_ø €Áö9 |–˜!è•M~sµèSÔ ¿onñK3nc‡B.[àL‘õ¥AԽ -d¸˜˜­îã œvëROrþÓ((~Ï®?é(ñÈ—Qø¾ÉIùî‰>ÁÁi—ÎAÛ}‚ƒÑOpp‚4ðu1\M|‚“¥¾Ž’¯}‚ú‰ÇŠäD“ OºƒÂ™™–É [z‹ÖÒ¶²äC¼ÄX[ x‡,ýëOlRÞàz;v6\J‘H† fbóïüŠ¯¨hdñ›Â¾û•ÅzÎ@îUd(,¦¾¢âðÙÄ]š„Ç3x§ÎŽ2#ÄV–ØHßÄV>û¶mìý/ò¶/ó+²ë±tOÇ>ø¥c«Æè;>9jxƒ£Z²OüP†!v.70R;HŸåá«ááÒF›àò" r*̸àŠu9l˧XÐztï:` F‹º¦€šûî.†* 0Á7u±gÖBûI>[ -%@.ÖÏòEήr»í&/w½‡ro¥Ð^—ÒNMÔ•ðbôXœÿ̇ÿë»Vm˜ÔÏÒ‰êT†~¨1G…ñ1ÅöØS’ÿ “ÑÈendstream +4740 0 obj << +/Length 2956 +/Filter /FlateDecode +>> +stream +xÚ¥YoÛFúÝ¿BHQ€ZD ï#€\;i\¸±7Öbº} (Jæ–"vüï÷»f4’(y‹4ÕpæãwŸÃ¸þ¸“$´?ÄId‡¾;É7Îd '¿^¸1™óËüâÃç0š¸Ž:éd¾ÒxRÇÓh2_þa]¹z˜ú6ù¾o¹®=Åqb]M½Äº¾¾ÿÇ×9žÖí×ϸuÿí÷© §‰oÍoï¿òÙ žÀ^`Íñàê—é `ðÓãôÏùoŸæšOC×÷‘ËïüéL– ÑoŽí§ÉäÖŽí¦éds„¾¾F'!ºÔ;žg=:G[.àgè E•D9@g³‰ÃÄŽbŸLí$ ‰9*+À[¶GD‚ijž²ŽÀHAY;èÀÊ«éžøÑóªø> ^€‡xØù ÊÑ1HV³ ¸ÎÑ_q±§Œfdù0³áe¹Ù¢ÿ‚ÃwMõÂ9)` 2-ØÑôå—’â³€Mß‹¬¥âŒbì¹D–Ö|Ä6‚EC¾.k6BŽ"{Bð£ç'â—C¶^ƒÊgAàYŸ1m“1ߦi3‘[5í&ë1°è}õ«É/‹>+«NxYñéÝï fˇ–/×@qÙ½ž´#¼ç£¶X­é©¬¿ƒ¸ó¼ª‚;‰ÂØN\Êî|Ô®'¼øfD¡‚žà‰{vˆY¿ÊI¯Í0U~Â,ݪ䵢Ƞ}¡%ên²>[dÝç~PV1X9Ê +æ<¿~œØN°Ç.Gz.†ÃX])¢í;ŽÁyʶ½ö3 B/õmÇA…Ŷ“Jb]G÷v«U/lŠå+àJSñm8ƒì´*4z>ä0ɇ¶ì‘¤¼Rrë†ÜH×(DV-³­  ØJ6èE [ J|+~e‹.ÕfBÙ“ ÁËb•!¡ŠâÀúCQ¾ãqÙ +aŒx|¯¨g¦#sjÎÛ×­Ô;ÎA "r¦$­Aº$JRh¨®âÓKþ!æÒåÇ¡ƒÐä%Ú…Ô +kSUÏÏœ_ÈédMzžùo¼ìÅUÍ(}a]Ïè¼U“TÊ8ý€Bˆ(½Žµ©ï’RþùTP¦HvYRQÁMÒ.Xð^²d­ËY–]Þ m¶.„_ʯIï²EUŒÉifÉ/Ÿƒñ•ó z¤Ó +6ÔÝyæ5葉 +Qx©sTæT͇ـ®AÉ_AÏDòÚ=HæB5{º¹/!ÀY!zÒK=#ɵBeE&ßðÃS¶/,¸†t—Ĉ٨[EõÚ˜ 4V|Ð^ëeIÒìUè l.Có§RlÀ5Lk M½C·«#ª FzR #ˆ¨„"B¾ÄÀ÷îx£J]•q–^tyæòÍ Ä|;òyÿé',´!_/¼¤xÄÅ;®õt¼Ü 1\.ëw²—çE‡.>,°Ï§ã¢~åÎ|¯M-ÈŠªËÄŒD7‚ñî6´Xí}Ý«%að`¬ò£=4‹WÅÜ廼¾|Ì6‹Œw®ó÷Íp¹-šmU¼_æ—ßà1ÃUÓ®E˜hçÆøSˆÿÆ?5Ê3>’ûQb‡qtv,7`¨õõœãË,?€¡8æua‰& ì| x¬ é—òb„Íå6º(ÍM_e”`rlx^5SŸ¾„Ê ÑÅF2Ð²È ±üÔöÃø¼X;˜ãŽ^áqb\{—w¨ôfÜü"ëÀÑUÎihà–Žaˆ#mÿ­’^Þç•Lñz@¿ß¨^JM³GƒŠ±k»¾t0š:ów3>aúx*}ú‰cmÐ×"b±1Æ‚8eÂ1MºKKŽûúŽ·Õ¬ë¦®‡\u,ùé…»QX¡ ::>– + g)‹ù(SGüóp‡×BF”#ÌÆ\¦2ˆ÷£ÒŽ‘̲LsGͲnè@¦/Šì(‰Þ˜eôÌ?ö¤CœÈ‘¡ä% ÂØ’Gj¤ÊMÖ¾òó²Ù \´Î.I-çZ¾ÄØjÇ*KÇ3-ƒœgÛB;ñ“=¶st{ê·½Ò&NÝÌ¥rõ>CŸ¬D¦FçN„½÷•vyÇÖõÀ˜gàȱã4ÝËl†æ¼”5祤9üy V†5‡Ç7¢9\_jŽ;_(+žj)âÃ¦ê± ­Píùrw1ôFãF|H,àšcá;¨¾t +k´Õ´!nx8ÓIŽÉpþÈÈ·¯rÎ1úæCº“VÿR¥ £$Ýññ¶YXm6!J«gÝQ<O$^ÏIíÐ9ÿqÄ€9}Õ«€Þºî=GP_ùRÜP¹ö5)jõi6ß«‚½ÆEv8öΊlÀœY½%ò9‚ZäCŠ£"›µÈwÍš\â1oKºd9%wÚ¾sþsŽsFnzSî3wrP—Û ¨å¦äƒq 7.ä¨èg,=çœož ˜3 75p†àNÇ5`PÜsö›¶”™„spl{§?à•ÅÁ·…NvÕݹ’º÷èT‘oÚÝm»ŸùnFÝœ¼Õj¹»4(S6ì”|¹‡i,šw45³³Ý-åHRÞ}Vþ6ðÞ^>ÂÄ‘UüÈ6Ø«cO«O6vK~ËGYÌæ_æxò V¿Þó›OÔêÄ13¡¾'űš«¹w:®•­yës5Ä×2~|¸¹–ýZvW9UQœÌ– òŒ5ú’±=—…),u}ùüU¯ÖðßØ'2ÏŽ½X ~¾ÁㆴÒxF¸‘íGêKÛÏóô¢¾‡ac*¢6Ô€-÷J1{”@ž¼¯8Ä¡?Ae7”ëSÝ”Åæ4Ï54ÂK^¾[ìn©Gú }ñV ß6A€&¤:S×`ºòIø00®Ia½ß×òÕSèí° Û 7;nO¨‘†ê±a»ø±Ív÷aLóØ0^âÚqèýO>áÜÇÈ#Àøÿ½Õ÷›XéŒ$µnW"ëãÄ$Úÿ‡ÃŒ Ùÿ×?Љ>ë&'êmèy¶çjfhHöüCŽCæìÄaù?§l?ûendstream endobj -4647 0 obj << +4739 0 obj << /Type /Page -/Contents 4648 0 R -/Resources 4646 0 R +/Contents 4740 0 R +/Resources 4738 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4612 0 R ->> endobj -4649 0 obj << -/D [4647 0 R /XYZ 85.039 786.531 null] ->> endobj -838 0 obj << -/D [4647 0 R /XYZ 85.039 643.417 null] +/Parent 4730 0 R +/Annots [ 4742 0 R 4744 0 R ] >> endobj -4650 0 obj << -/D [4647 0 R /XYZ 85.039 624.943 null] +4742 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [226.195 654.697 375.4 666.386] +/Subtype /Link +/A << /S /GoTo /D (passdb) >> >> endobj -842 0 obj << -/D [4647 0 R /XYZ 85.039 390.77 null] +4744 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [149.643 262.963 341.857 275.865] +/Subtype /Link +/A << /S /GoTo /D (samba-pdc) >> >> endobj -4651 0 obj << -/D [4647 0 R /XYZ 85.039 370.175 null] +4741 0 obj << +/D [4739 0 R /XYZ 85.039 786.531 null] >> endobj -846 0 obj << -/D [4647 0 R /XYZ 85.039 207.99 null] +694 0 obj << +/D [4739 0 R /XYZ 85.039 368.576 null] >> endobj -4652 0 obj << -/D [4647 0 R /XYZ 85.039 184.672 null] +4743 0 obj << +/D [4739 0 R /XYZ 85.039 332.311 null] >> endobj -4646 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F56 2890 0 R >> +4738 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F58 3360 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4655 0 obj << -/Length 3718 -/Filter /FlateDecode ->> -stream -xÚ¥ZÝsã¶÷_¡ñËÉ3MàWß®—»æÒ̹õ¹Óv’<Ðmq,‰ -IÅvÿúîP"å|ÌÍY °X‹Åîoˆf!ü‹fY„:Ÿ¥YÄ:š-·áìZþv ÅBHÍ_ï.®?%f…Aæ³»‡žOqžÌîV?Î?|÷þwo¯Zëy¤ƒ«EšfóOWÑüóÕ"šÿðJßpë·Ÿo?~¸»¹½Êôü¿\õþË·X0ó¯@öÝûÛR}¥²ùìÿûýÊÕn¾ÜÝbÓÍ_¯~¾ûþâã]¿o‰‘Ö8ý_.~ü9œ­`©ß_„γÙ3”à ÊóÙöÂÄ:ˆ–ïÍÅ׋ö¼¸Í̸ט´bq¦OÅÅž¸¢H:R³4ŽƒÄ¤$¯ò¥Äu-]ùSG ¯$Ìæw명5fÙ|KÍÅ–M5ù¼[C¹è¸ù—_øc dPHçõnó*Ý©gµ?ÀßMÑ•\Û­¥°DæØÖ4åY ÛÍËæú±ÚiÈf³B‘ÃòJ'§Õì¯*Ó”±× UÛVõ'¯Óù¦²œ»r…UɼÚñ/­«d²UUlpÔGþ¼'¶5ü2± ẄkAëèp~ņ–üdžOBó 4ªN Ær³aÒBh@.¼jaÛ¸¡ÈN× ‚’WVG\<0m¶1ÁUË®BwkÚ2 û×—ÏÿáÒÈ´õœv—4 ¨?êçAÏ üIüq©Š†¦¶®¡íßðB"Ü_ì ªÒwÕAËZ6Œš¼­‡sj”™³ö|r±¦ZbŠª-+Ô^S¶Ø„é¼±ãnió~%©ã÷Š<ë­ÌçOI¸¢~ Q,|YÄo+œ sš É"³üóù—;®ð´ «}-£…¦½Nö<ž×eÏš`^ןTèreàt'`Ih‚7g’!PQ:,÷(ñ®«…oÕòï¾a]lË•4t2»Ç¨½XqÏûÏ"RIDQ:Зb{·©ˆ“ŠI½pu—;>ÙF%çyÉ4AèÍb„ -Vd,µÕÊÊ ¾ŠXE¡¥·OÜÓ—&TüZ•ÏL×3‡UÞ×ÓcX<hELõc˜LÁúj®|›é%ÊäÐ6|°±v(q¨@ö‹F*[;ÔŒ¶>Nü­Ç”¥JöþòærL=Ò S‰üFqñúG™Œ¡æ½¸ÛeSÝ»¹°M^hM®j £^½S9‡dI#ß’&h‡è<Ë·ó/ö¯æßbµâÂoØ,âr6m‰#?qâvX£Añ–ü‰æ[WUo?–]ݼr-YÕeo¦æHæÓ­qDYšrë aÅVשæ–íõ:ÅZ> -!cZŠ%§IÔ[–B½zj¶ÙT½§ƒ­ì±RÛ;UaÑtBÓûü»úÜ\¢]=¸$•D¥ ¬¸pùrÉ„÷dÖ‰—Fã)dÜÈÖO ¨úÁŽ10t°Ì™ ;ˆæÔ‹8‘Ê Ø)Æ1$£y¿rCÑ! TSXl‡FÈíÚI-ÖX©I½±ñò[bæ¼V)¬–¼ïìç.¥SSz,ËM¹ìá6wd±¥$Sz®õ†?úãƒÕ#ÙÄÆ;MCía@ÞÛ³ªø]ï¬*•\øZlQ ÷¢=âTYíšIçþïÁN$Öw]…3CW•¨7Ü^¢ØX'Aø<=IØÈŠͲw5)’RX=p¥?æjȘ*ªc=¥1þh:1n4Ä4þ¢l J–±µcíd°à÷^4 ˽UÄÃ[6ó‡Âí®,ðÀ:2@Ð¥ h‚6%1èÈ°ˆiÒc7¡jJ–afÐÛÅ:çÐæaD[ºÞ¶qe1¼™“’ÖÖ Q…”<0¯¡”5oñØZiƒ´““d÷©Ÿ¸y«è<ˆ{Ws[î7`¦Ù*Ò2Ú§…´ø—7\ È„ßò¥Â†ÎjÄîQ°ˆp÷Œ óˆÓSAž[L4¶Ï½ð‰âÈAÙgÈaà |ðN8kn¬_n*f-GkD>¡ -¢XÃr€µ¸5°‹Ž¥ÓÀ®sßSå‚Tíš«I¡f虸Ž4OÎ?¤ì±4uãŸCK\}¹Çq÷Å}0uŽ¶ð¼-ä â‡Z4\µ®×d.ᇇÁÚ­E!2c'ÓA:ŠbW\^Z×PYDáqÙBÄi¦{ßÖ¿–#Ûh þÑ1$—0 –E8»H#–mEAžšl¦£òŒ¶[å9™Í+nq1V’bc¡•oiwô›Ö ‡ª*²‹¸+ž w 0ûæyW6íºÚ¬;Óѹt™v+ ˜ õC°þpJ:öîŲ#i‘±›Emk®ärÉmGØ …©Aää›RÄ „ ¸lJNÚ@y[ ‘}âž{׫ؖž2t.H’  Ÿ•€£™N\“¶³zÁÑÆ“«aá MÃìÁ‹­ ¸¦åjÔ~üÿÏqVAXñŠ¿ ±<ñšK V,ŽêØ"P†fÅõ˜2,È-R¸!£X]æP­ ¶œny²Yž6u˜6†I&æ0‰Qˆ¸Âú‘¿˽—ú:LÇ-Y”AqlS" ÖHÏ^ÿ‘MAïšÅý ´:4¬v`Š°Æ§ÉY†`!ã?1K×ÿÌ,…gùP7ƒÎbc—¬ÜÜ5æŽÐø­Ê© ¥Paö‡àõŸ^€%¬P¼ucS€M­Ôoz4 $Îÿø\ÿ3K¢ñ=‹¶õ‰F¥Ç»bÝ.Ì% -ŽÖ«c®ªàŸCëRŽé‰GoGÜx®“'o%ÕŒõddep<<ÎûÍ+$‘t6‘2•Ì›·áç¶Ø·ƒb6¬ØKï·Ô%~"e‚,ÊÃFh3 ¹ËÅæl®<¹Ds‚m8ûkɲ"XX1Ysý|ýÂÅ®©ö’:át)Ô1“Á †?;éÅ‘0– þÝpéh3 Ò™ƒf:*2¹“‘ñùÜœ öÆ2éþp8À͘ÄCOJ1 |ÛÌ4–ï)© |Z»Vä@1@œYê£ã¥´Áß0á˜Ñ†æQ(n½Ãd©ùéi:æ9mwã|Ôî‚Ê9„ ƒIkKs~*¬Â*{ò‰Î!H‰òùû]?+Pmšf+8+ ƒ82~”殘âX®JÈ×ÁW¯0Åî‘2±ñÉ­WÊ>Æ…r[J¡ãŒ3ßA1zÇeÉÒ33'CýñbŽ†Øø¿ŒÀ‘ß®a\rA”îwiðdºæcÛzIãÊ^å@Œ·œ¡™ÿ!aþÄeæ0Ëä°^~:•FK=”‚ôÇ_b˜i—Ï‹'’P¶rŠDüì#¬ÃÜ sÓFÎdr0¼”P\lv’ NJö1Õta$z5·tŸ{öo‰(£&Jƒ!;¶­Q÷䙬›¤ßÄ•™^¿}˜†YÚB·>G瑬‚™º™¤.E\Û¬¯w$è7œ&8¹¤J\72g¶ŒU²òMÕ²êl¶We.e„{ ­ª7ÌÀR¸TqdÉ×V¥×J …–1føòY´vÄ»I7ÞJÍTª•$oØMK½ðÈGŒÕO -“Áå6é4n1cÆt4œÍñ <“œŸ‚E[*΂4J¦ì¥°ê_%СUž:p™Xù)±\󯉪‡×¾/ä„ëßâã‘þ¢ØÛdäQïSéïO¾±jÎ]Ò¨ÜôÑÒ½ƒà¸0MÓIë÷¥|AÆi:Hv§é8®àS‡-°|âP ÷y(„#RÎsÁ™tÇ“ïÝ2’øc:8‘z穬¿HÓ±cÑ똭0Éß8–zá‘ŸÑI!çɸ[À†cîOW…q Ž§{tn,ÍùIBàd©LrìàÄ‘4´çIø?w )tâÙt¹Vt„œ¢l(Ú¢ÐÛ&ÔVþ=¢‡Œqžq¢Îœ1äï}ôydíeëO‡Œ>æg0»¸)áÛ;`Š¹ÿÔ¥àyøÐÛse¹À(-¨W^¥PűÆdS©€Ì §éó8ß!D…×Ã[Ãò¡Õ¤òŒ†Á½v®i -=ÐUÉ«W’KŠwæÌ™»;Š<ÑÌÂßÝãx°Ú§?ìÝœ\Åy÷Íýk4÷üÈx¸f]X±á bÚÚhD«ìk V±z÷îê—<*q÷AÊ¿Ã'Ø îá‚J<¸¬úK3—rc’ªaL>+$D­¢üPA ôAj -Ã%Ú€AeDd³(Ñô¼á À Ô |0ñ<µŒ8¯Ó UÓbjRÜÓÄ‘€…Ád'ðÄÙZÛÅa •žÆY'tûxBG )%ÔzP4rR”œÀ -a!tVmpøjoäÒ'ŠsÞ#µˆŸøwþ™ ”8+‹ -¾s@¡ßƒ¶k*NáöHÃ]ñþ "*„øtÂzÞ‘ù3SîÑ$Œ&©d¯°ìŒ7užL>šx`-M2–Ô&æ´K¾©ò-£?eäíÒ PϤ…lÊ_Nª,0‹PHöMaݬ\|pÆÞ|BÏB·Y¬wøcï´m”ÁÏ á4¡%6u$š„•…¹åfw¡—¢E‘Rmµ®pjõÈä9“]ÂðU xú‚‰{K^iJˆ…»à·oŒ|ÃʶdOüÎÙ™$öžZU¬< Óz”x `ê,‰.6Y+¦ w&šÐåĸ˜}ÖÈ#8E -mäRÙ`o[¢ÚG£kgÀÔ¿â-lüÓ"ÿlõÿ­ôñbúöNÇá÷ÛÇ&þóâÿÔÛnï -0ȳ ;a+€ä~2t ¨Ò¯"ÀO§üÖQg[endstream +4747 0 obj << +/Length 3767 +/Filter /FlateDecode +>> +stream +xÚÍ\[sÛ¶~÷¯Ðä¥ÒŒ…7^2“ÇrNÝ&NNìLs&Í-ÑIt$ªNþýÙÅ E2iËÉhÚ©)X,€o?ì.€ÒQÿÐQ,IÀ“Q‡Dr:š¯O‚Ñ=|ùÏ 5%¦¦ÈÔ+óüæäç2Ñ€$A2º¹sr’€È$Ý,>ŒÏ9{ssñv2åœ)%“iÅã³ ‹Ççç¯ß]Ýà1¾¼z¯^¿}5¡ð5æã›Ë×WúÛ ¿À;1¾ÁgÏ'S(s /®'o~=¹¸qzz=¡œ£–ŸO>| F èѯ'áI; Î@£Ö)…+¼x*ÿXÀ ÓÙá—%9^hHM:ð"ˆÄhƒDÄ¢ /¯<ÿ–ŽÏñá›ð©Z>}úWðñzðcá3LgØ« ëöjB$œw^ Æ9³mnB”.°Tâ‡KŸ²Râ²ÚPöa2Eõtê[…:Tؤ‹Û-Z¨$¸µ+—p)kÑWaG¹NÒ×_ëåƒM)UX|wun#ÒÒnXÍr¥R­Çµhݦ¢p°uª¹\’ÉTa“d|¼P¹ÐJ}Ñ¥¾’å‚Ç[P ²5”:‘Ù«©äBa¯?w*µÖ?ž¼úÄåÓl^Ὡl‡Š/r¥KÛdGÙÝ—æàb ú/Ço³»¬1/nFŸà.ž +ÏZ¤Òñ;*C­½+£“Í9¶¤õTy±¹ÓAs ÕN §ž©§²ê÷Þ`é"Å6³cŠŠíZå ºCïaŒçxÇŠÞ;Ýd)“‘L‘qÒ{_Ï·9Žvg"ÛkbêUX¬qÖ¾iÛ‘VÊ_Û´4b00é%µ;RnØ–>|•ùS™Ve·Õ‚·ýÉÔ¬Šúh‡Ôä‘Èù«™}¼€÷ï/Ì/‹kò\Ÿàpé>±Ê,GY‡ÂíÕrsk05.rkójU§:³]e{hÉÅ-ó«y&oc7@›¬\5ú«“«Vå·j|º¨–†ŽÑr”’®³ëò Œƒƒ¦ÍŽ> wðCîP´"`½ÜÉ"YÀÑzÀ2B/7ìö`@•‘ŒÀ“çàÀÞbˆ-\:Toܺè¤jl:éS=àz& ÕûH m±‘øÚÄúOÕ‚æœv»µ6Öâ_W SöëlÎlÜzfÜ~àà´V|U(˜ûÛ¼éí®PmÚ=gEotÜ  ´ÍË2~Âß2hËžÌرU¸fÎÖ–=—Æ7g·ÙeÕà¨Åßó +o×ÏÚ÷ÚîOtö0X<ÞØD† YglzËP0‡±‰u—;M¹’>„)÷éÊ%1â¾®­žè­Ðêtwîä¶ð<ô­Zp¡Â¡ +]j‰\vxßËÆÖ•9WlM;>pÝZæ9ÍÈD[¼rp6÷v;Óó“›Ë~2Þ»5ÿòîpsÝϬ­Y’²Ûäþî<ëœÆ ÂÔ +MBG+§ßÉÌçe±_M¼­×i¥cGI±ÚR7ñZ»¸í†BƒÝÕELS¡Í-´Þ„:ò +gd Óg‰4‡>7w÷ðoËÑPÎHÄbSʬ0z·-R]Évaâø[aKÜ«n‘!Òw‹1xž›x_Cÿ]Ë\¯ýËœ½]ƒšë³J¥wí. %0Mh·«S,´uö3Ät‡Ѷ¶=†?i«Õ0!ì@${Ä!,xi˜"kÏ¿r¡ xsõ%êÝ.ÛþŽq“2>{š¡óŒŠ×ΫUŸÖfšÔÔn=…âŽâ¹N%b%úot¼¯±n-чýü,lb=ÒE7††éúñ0Èž¼k³–áv>I’(iìbárÖ ™JîéÕ2€b2ˆkjVŽæ]…ƒÜ÷[ò…=GdC™­:s9«k­yŒ]åk42 +Œ‹B­‡†Õ½£7†à3ÿ€’ma5ó/æGŽYáŸvݨftØû¦1‰â®C›”ÆH,ÛÂê|ªUö?[u:éầUCCà´Omnð +⨦¸¬m¶ö@„¦ƒ©ï9n«Ójo¿Xb›#Ìøhðƒóà×bnu‡¹#^]AbÞuè3`$À;ðªqès†Þ‰pÅWiÿ! +¯¥!@Ø«7å ¢®øÂ?uè¥<Ôƒå m…ucd˜Ž ÌS0s²õê|d þ»&€Dœ é8` + ð+.@ø[s>yŽþ´›XØyÕ–e°€vÏ +düi½p,ßóÿP¤åí}|ÖÛ´Å.~9¼…%,Ř¥{z8uó•áš¬bœ6ƆƒóvWú¡Øßu¥Iw½cx÷Ã)£V3mt¾Æ’ÇDƼEåÿ[å„#endstream endobj -4654 0 obj << +4746 0 obj << /Type /Page -/Contents 4655 0 R -/Resources 4653 0 R +/Contents 4747 0 R +/Resources 4745 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4662 0 R -/Annots [ 4658 0 R 4659 0 R 4660 0 R 4661 0 R ] +/Parent 4730 0 R >> endobj -4658 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [342.345 336.894 409.913 348.584] -/Subtype/Link/A<> ->> endobj -4659 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [452.526 269.148 512.306 280.838] -/Subtype/Link/A<> ->> endobj -4660 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 214.951 206.209 226.641] -/Subtype/Link/A<> +4748 0 obj << +/D [4746 0 R /XYZ 85.039 786.531 null] >> endobj -4661 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [427.522 160.754 512.306 172.444] -/Subtype/Link/A<> +4749 0 obj << +/D [4746 0 R /XYZ 85.039 763.817 null] >> endobj -4656 0 obj << -/D [4654 0 R /XYZ 85.039 786.531 null] +4750 0 obj << +/D [4746 0 R /XYZ 207.409 769.184 null] >> endobj -850 0 obj << -/D [4654 0 R /XYZ 85.039 480.826 null] +698 0 obj << +/D [4746 0 R /XYZ 85.039 399.573 null] >> endobj -4657 0 obj << -/D [4654 0 R /XYZ 85.039 459.63 null] +4751 0 obj << +/D [4746 0 R /XYZ 85.039 366.035 null] >> endobj -4653 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R >> +4745 0 obj << +/Font << /F56 3226 0 R /F62 4047 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4665 0 obj << -/Length 3281 +4754 0 obj << +/Length 2067 /Filter /FlateDecode >> stream -xÚ­ÛŽÛÆõ}¿BÈ‹© bÈ/)ò®íÄi`·Þ Ò" ZJ¢V„)rCRÙAþ½ç6äH"eÔ)G3gÎ̹̹7\ð_¸Hèl‘¤±ot¸Øn‚Ŭ|} -ÆJPVÎ_ïo>G‹0ð³ [Üï†s²À7Y¼¸ßþèÝ~óÕßï_¼]®´Ö^¨ýå*IRïå2ô^-W¡÷Ý }Æ«Ï_½}q{ÿæí2ÕÞ¿ôÕëç8ˆ¼;@ûæ«·/¼T©w‹ûoqÿ݃oß¼¾‹Ko¾»[þ|ÿíÍ‹ûAGÄPkdÿ—›[õÛ›À×Yºx‚qà‡Y¶8ÜDFû&Ò2¯nînþ1œÅkÑ‚wMiËèÔ7©¾TWhu…JûJ…‹Ä?ŽÒ×ý¾a¢ÄÛ–-ˆV ›¾iß3´cÀ±-a±GYeá€ð¼{dzÇ7ç,zÚÓâJì­=Ûb—¯êy^vø› -öüî™B“yå×¥1^^ÁòQÖóÎî)ð+‘y¢â2t‹´Å†H5È.p¥¢Ð;àîÐ{‡³à\’–qò€[÷0D¥áxGm„9„la^N‘4‰V“D†Ùv9œ<ä‡QÈÖzظjDaƒ1I§`À]Ñó€ô Æ:èéò2}Æ Ï㸞Ë!îžSQbEk¤5ïš‘Q›-Ñ…­O“I[®fÓ©i¢vÉÏí™èr ù)£jÐ/Â2ÐÓ–/ÃPyŠÇñ ÇÛ%ÛDê±KàÒ³ž×PM;8=–}¹9Vyk™ïE—À<Ýùø kï0ªMý sshÐ"kv‰qâhÆ»†n‰¯ÓeýÀ‹ça§c0¡œ,}þR»YRiíg¡F‰ÁÃÚØ1âI:2_…‰à9·A„„{±<+ùF+8ØÆÆ2glØNTªýPMÄv"Š¶_œ×a¨|8x‡‰Ÿ5U)¨ÐOÆSUD¨#(V+gÿD¡3(5Ì@Äaí¬Jÿ?p…Ì~É€ I’Y¶ƒÈýñlû¯°-HÈöyJÓblÁtØ–£0zpxÉl_24˜Ç@UššÇÙ?/ŽEš­p¸˜“h,âìé«Wd’Ä×Aôñ2û¯È$HÓW4Q§âÅY`r~ic!3woR±›8ðc“^mJCÁjÞ`H ««(õSÍ‚^ì ô#ÆЋ@êIª6·.ÇNråhA@<ézŠñ˜è4\'Æð8ñîòÃ:硈`š÷PâÈ¡ë#GC>é?>–/gÔA#$×Õ0âLܦUƒJ}¥¹Ù¸Ë‡:GCÓt<êš¡À‡Y³ã_[iãøùlº°äJ¬ÿŽ½,ù2@|tÇ ’Ùór.4>i‹|+0ÇUï?ä!¯!¹Q¾B–ê÷¯_ýs"kIUi+. »NŠÈ b MÕH¦j0Ìðžë\Xå$E)Y @Ÿ’ mqIÇ­-]>[3 T Y¼OPɨ„* -Nî´‰ ¢iIl½)% ÆòïZöV´°5çñ§ÕLãƒHT£äUóÀÓ±&q÷Ó5©3çÞ*½¬8TÜ£èdLŽ§­1,ö䀈ÅÃ#t³µê›Zúµ,Cý&C£¢²Tz\ÚàÕ!hHÿ¶^ÁU,Zq‘±áwÇ¿9/#»h¨BfŸË¡µTl0$¥=-[ÑVNØH?$[0Ž -króQ/{‘¥äÚw®ZíöV­4¥,¼•b7S£›)5¸Ϩ$RN §´mkзTKÊN7ˆù<°þ¤à呯ף˃m¡·AÏü}Í¥l¬©=!ÜŠR¤cÖfì`lMIUŒ²F9tÆnÅ0´ÒM=æ)ýǶyi}üℹ M;vÍ0¡_ò”ƒ„´öùzÖNÚ±8r$‹ÝÈ]σhfQzws¹ãű»1®áÒaOì= ·;ïq4éÎ#bÿn_++” È?ç[)Õ¯Kift{6ê›Ñ',g°z´±nhRcÃ<ºc[ÒûSó€í -ºyURÊy×qŸ€ÁØPDÐP˜X…7›h% xRP”2g!#*ìy²Î™€pØ0ƒƒbS[`±•"6~hN5tõDÒÑâA¶(PÒS¦©íÉ`Dz¬JªÌàŠ&¥¡ƒÉTò!©#AhjK„ìøuÚé€õõ=sþDÏ!{Eh¨2øY-¨%Nþ‡„ŠúR(f -P´­USWïyŠµêŽöÄŽ÷ÀZ)À'Ȇ·¨DyåArc¬ùáaµða÷ºÂŠÆ¿ i\lDO‹È&Hä—ó½yâP2jo=aWõDûÑX¢ðÒDä}dÂ;’À×*ý€˜$t¼)=Âòx5H×.“jˆ£^â…Ê CÉNÝÁ¦×"hͨÓáA*rùæXm”WÎ[¥±/ûI¯€Ú9²²Üæõ¦¨&$Ö‰ŸÖ5Ú|4ý– òÕL±F@›QvªMåuw”¾* -¥òf›¥Gê¤I(ý0=Õ$‡~âê¡Ç/ êF2!EtÏ-Å¡ívtjyœhFt”ø©ºÞŒ88COù:ŠÝfDkåC•l{²Û±(ón›Ãar ‚žéEÛ6Kàóé ?rÌU~FœùæH‰Çܾ¿,‡á3.Ο_´º*KØÅppG—ÔÚ:‹>BeC–’kÙ¶YGNwƒ¹ 9|ÃØÞ}an­âŽC^VÃc3Ì+)*À,©·QôQé²[˜°Ãš¦•²©ø-?4žø¶9ä¶Ë±íP¾=Xó­+…–_¦šž^!Ø镱OøÊsƒ¾ žÙCù}û¸&›ß8ý”<2ËyPڗë`ì÷öxŽñµô[uQlmƒÕLº§LgO¾¬ê%œâ}}‚ß ”K=áÇxGr^çʆ XKØûðX’J~æPmÉw+˜´ü-«‘µ¡£QÔÞœô"ÄÈ^LBN¯{²¬ב‚ƒE oBþÿjÕÖ€êâ¹ 1Σ ÇŸœŸ—¨P´ActÛgà=¸·r‚2äׇö‘WVoyåì@>å¶$âFöŽ¡·>=£n¸…¯c¢/þTBd#Ùý$šS÷ë˜lÇÈgÌ9ߣÏîç< óùÏæúÚ{y"£2ã<¶¥ƒvgÎ8èšÊª{ nûû‹´)3âR•â&—ïãõI0åI‘ à ®ÃåÊSËzÁiö‚IÞ5üýûK³zBPß8ùä.8+iêOB0ý˜á$JCIOžï¯’“þëÔä…ߥöuãš•}šÔÜñ7R7îN羌O.eç<®H@ÜΪQÇ~l¢¨qDº¢FABÁÔ¬¯‘³j¼JͪѡvWôg*âדzôÈ})¯uŽ?¹_ë%'È«Ò£“Z&Žsž¢¶<~€D-Ç_ðµ”*ëò{+4¬TáÇ2©K ]²×³­Máÿ®óCñŒ¡«þýcÁCÁ[¿á7ûؤ!DŸÖ¶pþû?‚ÿ2U›þ9Š‡F q’˜™sþÑÝ5¢Á@ô÷?ø÷ÿ æî#;Õ.?Ò“aþ1sêïã†Â4Jý,ùnm”òU80CN¥çÛ?¤»dù¿ïÊîendstream +xÚ­X[Û¶~ß_¡Gˆ¸¼JÔò°×4íÞ»hÒÎ]b…?æiE¨ˆ½H‡D æçgÔ›åÝsc :<—£³ó[zŒ’˜ÆÞèe#'¦DÅ¡7š|ö¯~¸xÝ|BŸ12¢Hû®ý««ÇŸFH‘þû‡[Üzüx?`@Õ½|°´k¤ÀžôGH¸¸À3Æ›áàËèdz›Ñgç&LDùûÙç/Ô›À~<£DÄÚ[ÁšÇÞüL*A”î9?ž}ØȲ4éÙS}FQB¥Å¡U„êX…QN8g^$9¡ Í2)þ3Wþ2›¼Ž“ªI«7v§\¾]¤å"OßLÆo_¦Å:ÁUYMñ² 8`ˆ+6rêdþœÜ•Ó²eóÔɤ=Œ“¬^äÉú!Ùp½K«$ŸØõ•Ð=¦:âº^•ÕÄTŠÇ”SÁ.o®oâ›Û‹‹kq)…ºTLRyss çS•Í“jý®*—‹áûk'm°@œ\Ê( D,ÒUš«0qÈh$©Ðã”õÈ.ŸKÇÍU ÈEYg^ŒÇå²h¾é€7LæÇÏ 7·y2m}þùÓ ¬¾ÚnY§ÕžáþWëEóÏå➧¿é_ÿÇõ肘p\dôó<,çÏiå8cJûÜ>.¾ÉÛŽ;/§Y1œ¥yîN?gÅùsRÏú™Ë——NØq&#©E(£CcL÷à²^´ÆÈ?eã¯ß"x'²V“»¤n†i³‘QÌÅQ5ÿK*Je¼Y9O¯³ +bª¬Ö­åpó¼Ó5é´<ïq¤Ú•W³¤˜žÊá–÷~Y7;̯èa´Š:Òך2Òðêú‚Ça]H ¹Ì„·WÑ‘Â*¹&‘:Ý":<¦rzØ"$e$TÜ„® TsI€ ÐÉØê'5lÖ+\–Áü +ÂW„‘_¯‹ñ¬*‹¬Nš XÊâXǯö³ËÔ!XPJµ…{ˆ‹qŠP„ÿ¶¦ûQUg€6¹/µ‹ Éyž»56[Žq¹<ò'I2Äfæˆc~p Cø¿REïlS|xd–°€§Ä«à²‚IKcv ^·½Êš™]µ Ëà€Ç~Cz"ê—Y+¥°}}‰ŽÂç 1OíæPïù……! CéAˆ‘Xů·gAxÔßœƒVVÐvèAÆ$áF£)\´Óâ…ÙÌ2‹G$ÏK4ìÊ=ÑŒx[H6ãxw·gpœöKc;Ž,ø§“Q8«ß*+P™•iÓÚ¦6öZ!’²ƒ ±eaüZûZG„Ëf„™H#9êKNr7œŸ…sÿ‘í¡rA1ÛÞ4q¾4·Åk·±TämÕ½à…Z;e­Eþ¨Ì·L¡7îy=‚ ÓʃC¢Höf£c :w|­… ßQËñ˜P®O[nËsÜrŽÇ ¼\ä ?¡æ¤¾–ç@á®õ`©•ÞѸµ^Äû\Ä]Ÿ⦓™§Å¡5#j£ÉyÚØÅ‘ãælZÙÒUÙ½mHWOòlð”Ë°-®²Ùd¶;ßní¾“‹’ÝôÍ2Wâ¡ÀÚ‰Ö®€‡µ+öˆÓVÎ,TxÁ–Íž¬aŠ´;‹âþÎEkƒ^;C/"Ð&À)\)"°ÕnÚ³<;®ƒ‘/ ±I¨´‘ßN ¨6+L½¯æÉö:›^aíØö…ËV1Ù^¹h;¬ã¨çè +¼&— ×PçIaêÏ4í­'.šY¨ ¥êä(×áÙdƒë«NV0xy¼3w*:õï×ÃwÇôKè¯éßò%ÕDj+7Î{k¬Ü±ui k ó.½I ûA`Ü]©ÝXeyn™!ÁÄî'y‰ý ¦ù£pF14ûoº™qÒ@Î"]YR6Iü>J?®À°ØŽs’a‡þæ’ŸºÓ"ÄÚI*z¦F4šûà ô×ÂÄBbúäWc =Àc’Hãä"×/–¶MÐ9:.æt¢6%,ïÊ층)¾Ÿ“à(“-SÓ6f|Hª­Ö¬ØÕjQckNíHmɶÂY Æê6Y6ʸÿµpS`€Ajxê‰/°¢$ç¯OËLCDCÔõÎËÛx„‰í‡ªÈSP14†h ç¨ô"x3‹¢nÉCO“~ ^ÒàÕ.DÓØUzSæ%W6ãaE+¶EKŠÃê,Ý`º\Øi§¬0‚Úƒ¦ÚíY‹G8‘pÞÈt¨_7 'QxÄ ­¨`+˘¤{[—ë¨Ug²ö“ùPy€LÐpè•ßY+ê2Aq©»È>@b!‘ðnû= 9Q'!±Žª.¤ûÇkôïû[H‰ÿÀSÚ|ø𜨓ðBÌŽ_> ´ò/Ûpø â¼>’œðòòcÉÉ ¡tÜOtåïÿú ½ý®WѼ¿½@ Îb°)¸IØäåjÿ:í÷jÇÕü/ŽvŸÓendstream endobj -4664 0 obj << +4753 0 obj << /Type /Page -/Contents 4665 0 R -/Resources 4663 0 R +/Contents 4754 0 R +/Resources 4752 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4662 0 R ->> endobj -4666 0 obj << -/D [4664 0 R /XYZ 85.039 786.531 null] +/Parent 4730 0 R >> endobj -854 0 obj << -/D [4664 0 R /XYZ 85.039 560.658 null] ->> endobj -4667 0 obj << -/D [4664 0 R /XYZ 85.039 539.462 null] ->> endobj -858 0 obj << -/D [4664 0 R /XYZ 85.039 347.827 null] ->> endobj -4668 0 obj << -/D [4664 0 R /XYZ 85.039 321.212 null] +4755 0 obj << +/D [4753 0 R /XYZ 85.039 786.531 null] >> endobj -862 0 obj << -/D [4664 0 R /XYZ 85.039 277.468 null] +702 0 obj << +/D [4753 0 R /XYZ 85.039 428.751 null] >> endobj -4669 0 obj << -/D [4664 0 R /XYZ 85.039 256.272 null] +4756 0 obj << +/D [4753 0 R /XYZ 85.039 392.486 null] >> endobj -4670 0 obj << -/D [4664 0 R /XYZ 85.039 163.752 null] +706 0 obj << +/D [4753 0 R /XYZ 85.039 168.005 null] >> endobj -4671 0 obj << -/D [4664 0 R /XYZ 85.039 148.081 null] +4757 0 obj << +/D [4753 0 R /XYZ 85.039 133.259 null] >> endobj -4663 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R >> +4752 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F20 2961 0 R /F15 2972 0 R /F36 4184 0 R /F37 4187 0 R /F66 4190 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4674 0 obj << -/Length 1440 +4760 0 obj << +/Length 2789 /Filter /FlateDecode >> stream -xÚ­XÝSÛF÷_¡‡ÎDž©Žû–ÄL(†܇LšaÙX-ÉÄá¿ïîíÙ9ƒeh’ A{§½ýüíÞ -qø'¢Ì0®ò(Í,3JDãÅ€Gwðæð‰gIžßGƒƒ·VG‚³œçÑhº‘“sfrÊññ»£?G§×ÃD) ņIšfñÛ¡ˆÏ†‰ˆ/Nú•Þžœ]Ÿ®®‡™ŠßÓÖÑå :¾¶wGק~{(³øÏãù›Ú>¾º]ã««‹›áÇÑùàt´q pQ(…æ|øÈ£\=p¦ò,ZÍ™Èóh1ÐF1£•_Ï7ƒ¿6²èŽèÔ®hÁ>Ëá]¢ Ëdö²:¥$Sr·:%‚s0¿WŒ;ÄA Qž{[J"TÎLf¢ÄjÎlª6)Le$ËÁ -­YnM”Ê”£\/òÃ=yÖ5»M ™E™ÑçH0®ó\O@;û¿¹å6Î":iÀÒ(4ÖËMÁÎX‘x™fRF)—€·ÔÙ:š ÑLÈ‹Ûa"Ó¸ùâ׫j>*ËãÎ9³¤íepäMçü¬`gŒÄ§G:p[-ßÕÔô,Ö²Jdn'È=^6¿¶š8v+d|=)JŒ›K$"'w–>"kóЭEü7©«¯(­~øJ»‹¢F‚Ç÷ÅÝ„¶ššž«YAYÁÅrVxª„ÍÜÎbgQ‡gÓøÌ¿À@îw¡QÆÙ´œ¡©ã«|ªrϢ못:ÜÓ1êÇ ýzŽ^ãbÜNŠå¤¤…ó‡Èu ‘.«–>jiŒëŠŒözf“as^![½Ю]BùÕ=5ƒfJO綌LÕN\Z}ž±Õ°§˜Ö©`ÔÉ÷WRPZRGɦY|#03 Au0KMìYçÎ …# ³Z~+Ž{i£5V= „PšeHz®ŽX^Ðæ;O¨íd+ÿí#%«ê§:>˜ˆé7¦î¶hѾƒ·*m3–J a†ØgÔ~&FšxéðâMÛ-¼¹%á ~*s㣠F4ëgº¡¿?žDJhc9^¨kcü»”b6—žiL32hò÷¾7æ3óHôy… -ç¤.œ‘ÈùeH³-nº¹qÕ?¢È¢¦á;)\ -©ÙŠî½û@Ø^¸ÙFݦö—M‘2>/ƨë“ÿT-üë)"i>'p9Õ»` UVù!…²“´«¤MðÇW¬è«a‹µÚ_Âéøì*`!ŒÙþ˜ú xÍ„.ؾÞ«Îð~m¾€Cm[\Õ”•Í'ÔŽR†éŠ ×-nÙ¸©§; ªsàÓžoÚ´~ö€¼nÆYáGU7‚”Ø=ve9Iá‹YoÏ¢ p<ñMÁ} W§~ó™Ä«èyñÇKüt¡Ay§ë%ìø›‡2LïþZ€ÿ¤ì‡þ²ùÛÎXžõ|)aÊÙƒÞ ™?µØ¨ 2¯v˜ü%¤endstream +xÚÍZYÛ8~ï_ሠÄlñÐì>$™d·3ÉfâÁb‘äA¶Õm!²ä–äôô¿ß:HI>䉂Z4Y,V‹_K’þä$„¯“I‡"Ðr²Ü\ù“;ùו´3K2м˜_]¿‰ôEâ'“ùmÇ'ñE„“ùêƒ÷òßÏÿ3õÇt¦µö¤ÓYÅÞ󩊽—/ßþùfŽ#Æ»yó»ÞþñûTÂh¬½ùÍÛ7<ö Ž@Ÿñæ8ðüÅt4ïðÕûé§ù¯W¯æœM¤Ö(åýÕ‡Oþdýzå Ä“hûB&Édse-£íïâêýÕ»Ž™ Ï:e”@Ç"ˆõ±UdpÂ*A B‘UÖi‹ÊE^»=2lÇ^³ÎT„¿¤·Ì?úÒ,™hý±—•öµ0¡á iY.Õ>7émÀÒ&½9öä–~“¢)™¶©vå +›¡WäŸqÀ2Kù±D6զϨµƒVû”- ½³ä%3ik¢XsïCÇ0ö–iÉ%T-îØo&Ѽ Ù#mÛlƒ«àr­åG:Þª"«8¸Ñe%òo™‚þB ÖÜUæmÛ适hµ¶È˜õ*kӼࡇõ€ŽÉj-¹ƒ š—w O¬n¹{“Öw9Œ”©å²kPö‹ö +´ëŒ‹Ò|>¡?òU‰ñЩÓÍTEdá”;w )X󾫖ÏïÖV$ؤnûp©K¦–ÜkHzZAÊ:kZt­¼›»´—–V¤]¦Ì7ÝW{Soq'‹¢Bê°OÈ»UÑÜõnÙæUًݬɉŠSw¾ZlO˜¤?÷«3m?Ù>[1ª¼÷7ÀP5·Øô†è:¿*ø` \G³¯öÖªþL|ïxˆôxl¬cŠ¤ “H„RŸÅÌ ¡ƒòÑ!Œ”5c&À¤ I /Á ÞË:CÀ°Š£€adý +«´M)ìûˆˆÀ1 ÒY{šQ íL¢HÄÿ!ÃnÂúàxy;5wñ‘‡{PË?v[~>’¹Ñ,y….ÿ`§€2v·t˜ GJo5`fA’ŽjŽ~øh§­í ÉεúÉeº¡®†©ÐC+n2ÇÕâÐ~FGÂ7ªSü«ÑD Ž%3Çk6`vlic€)ô MMpðèÖ}ÁÚ|ôŸOzÆ6FØ#ÉŠÑ)­épÍ4„…'ÏHmá¾è!R„#)C.­ëJÆô$xB´ØX9ëãúé®h™öµp#; +º›b÷¬°?³¿ÒͶ௻í6£¹/°SKàr»Í–a5àˆÃŠ7_A&G\©9ìZ\¸ßeuî„m˜–A,…‡Ñηخaúý.¯Ý ‹LΓ§²1ÞŸÍáT–aCFî¼úŸ¡ìׯõÐA|ô¤(þè   ¸9Û!²«ÓïõºjÚÁïí6mš‡ª^ñïR›¡‰â륟÷~\oÓv}ÝV×MºY¤×n›®·«Åõ†·…·÷ã487æ, hFÓ$±PÉ!`*˜U‰.u·«¨yZ “@®h@3 +&4B|fçkN¹´·¥uÇù„öŠt‰~ûÙºTSm܆_wœéTt’­œË~R^Ÿ2ébç’§Al­{_ÏûEmùåš@Âú=EðÛê™ó ¨•ð±y¾"‘”‹™Ãct[áÉî°g§Áwm'`<æ좃Íâc×Ï7g3¥µÀ—)¤±i÷QÁvkRLläoºìI8(…XŸ@$QÌ:Ťž…±å]e¥ø'?>TƒP7£¬bwק=Ÿ˜ªÃ¦gy‡… I”Õ»,e™Ë³OT°ùÄØÝ .eh ‘2†ì{e'8æ8°´p?B +t±Pq<Èñ`„³µš³\žé¢3»«ÁSÌÙBÚ3äQ]í×™³ÿa׊8kÊ'¶g é"¬¬à›à;º`d9uŠ±V SQ¦ŒOö¦ú¼¶èŠý¦`â]Õì5Õ~žâü¨iÓr9DzNó %1…³£Ü@%’ÀL Ì +íG?”8^³³c˜Q&JEÝŠ'sf"ïƪÐm&wVÈæNx0y€5öm‹ì«Ú@\-ÕE´w¼Îko¤«¶ùªöÔ´€cè =xBØVKC%*{)ÃÂÂö>2<Ý {¡(›&”Ù^*Puw{§Á#®­Ù÷n%{¨±w¶›¿í!sÜ!3Þ=9ð•²ómû¢T'-ÒÍÜÝ\Cdú2PŠð½]×”›ß­­è.Q!K‘«,IJ*o¹wº sëÐþr+ªEZX€ll²ÅŽÝ­4쀌+J"ë\ú ˆ£Ü ¡A$œo†w¸r%€§³HŸ¯Ê ‚“ +¾¡}ÈÂdŸÅ‡jà«ŽÊ`O=!¶á>¦j˜âoÏÓƒP˜0õpÚ³#ÜQö]NIéhŽ¤ÜÇ“N¸Ü ŽÉùò܆SMhß·n+Ò°|÷Ø]È¿!Ê÷aöbÂ@„atJÑ#…uBHÇË•±Òçhai€üXy° :c\hŽ\¸eáäý\† W3·Ó%Ê×û"´ô:Ï +Æ—ÃIpk€§ô¿_<Çì¼| +.· +|v(dàSÄ›¯"®4‡¢jØ_]FRþ’ÄÐèʵ?¼µ°Èeö6ÄÚÎH`“àßRņ"òåØ•LI‰º­®íy¿Ò%öü¬Ü1 âæ äÆ»¦ ~¶ØbCäQE Ù¿<áÛÆ¥eZ ›'c¾r ÷|%ù¹|ÅÄ"Œ“Ó6Oàž *P"w•ð> U8Æ‘¢_ó»Q,b +[?Û)¾@k#"#Ç1íŒ+øá™Ùuuùzt;ú•.qˆÏÉ­$ o¤öä^e·)•éÛƒº×“fðjbô|^BøŸËæŸ#• D  «R†ñ/@<)Úw^Ð/t /8'vç¹Ð .!üÏŒÒ~(bŽÜ+ ±VØ%åY˜¦z_=Ïûu.áç¤VJ‹H™=©`Ú]®µöñݿ„Ô?ñîK8ç1ã҉݇ÔÀuR&ð 5¿qpµË‘m0¼À6Ÿât ¢=ñÞ¤® \ݺ›{_Ûí_Ûô/Lº÷+¹-v¥ éÕciþE´¼thÀÊÛÉ[4–X€›üá%àn©oa›øÁ¸â†ò›Ï”¥q`ÈãAí€ÓRÁC˜‰ _…BÅœüw*eä¥uI¥ã÷(v +Üý‚€vdr?A 1hü´Iü^+긾ÙèÉ/:Èj¹Îz¶ìÌñЙU"ÂÝ[‚Öœ¿§ÔÒÖYŒñ¹ … Ί ù…?þÃ7a8HïJ©ã`ÖïøUÆ;œõ~,‘Øï p _©à³iyª«ø!¾òÁgLj«)®’‚CX:+°´n¾ì~ü¿›À&´ï¾õо´6_ðFBæÍ£u–®R¬pºŽª,™¬uõRßï¹u_œØnúX ZõÎÕ||e¿UY¤<ä¾3:–Þ½vÑš|•Õî³t¯¸«ùí…Iû:ËâÊðh÷Ö (˜k÷f Î9þ®ŒV=Ye4I $„©î4|ÿÁ³+ýèÛƒÕù³Ž!$ŽO£ÒWÙ7¡Rÿ^3†…FêƒÂl6ôFs T84¢ûÎR Dþ?ùü tendstream endobj -4673 0 obj << +4759 0 obj << /Type /Page -/Contents 4674 0 R -/Resources 4672 0 R +/Contents 4760 0 R +/Resources 4758 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4662 0 R +/Parent 4730 0 R >> endobj -4675 0 obj << -/D [4673 0 R /XYZ 85.039 786.531 null] +4761 0 obj << +/D [4759 0 R /XYZ 85.039 786.531 null] >> endobj -4676 0 obj << -/D [4673 0 R /XYZ 85.039 634.82 null] +710 0 obj << +/D [4759 0 R /XYZ 85.039 697.613 null] >> endobj -4677 0 obj << -/D [4673 0 R /XYZ 85.039 420.461 null] +4762 0 obj << +/D [4759 0 R /XYZ 85.039 663.47 null] >> endobj -4678 0 obj << -/D [4673 0 R /XYZ 85.039 303.495 null] +714 0 obj << +/D [4759 0 R /XYZ 85.039 525.394 null] >> endobj -4679 0 obj << -/D [4673 0 R /XYZ 85.039 134.927 null] +4763 0 obj << +/D [4759 0 R /XYZ 85.039 489.129 null] >> endobj -4672 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F15 2876 0 R /F35 2880 0 R >> -/XObject << /Im1 3957 0 R >> +4764 0 obj << +/D [4759 0 R /XYZ 85.039 311.188 null] +>> endobj +4765 0 obj << +/D [4759 0 R /XYZ 221.091 317.161 null] +>> endobj +4758 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im3 4353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4682 0 obj << -/Length 1145 +4768 0 obj << +/Length 3596 /Filter /FlateDecode >> stream -xÚ¥VÝoÛ6÷_Á=U&–ߢì!KÒ5E‘lŽbèú ØrìÕ¶RIIÿ~wy—Êä"Ídòñ¨Ÿ‰{v1=?]MS¯“¿èèäò “\ƒØû“éy˜ÏÁ©p͆ÁlBèú.Îó2ä³ÞEÙ¡ƒ@Fn{¤Îc}àh©œ!¦áCNöG“ZÐþuGz@U®‹âçZÀ‹^ÃÌHÑ7öô!’ ³*[âÐã\ ù¡ÙñWjD[xíô±…ý¿>ë†B3ðñæÕñ:³JA‡ÎP‹ç[ía$ë#.ÿ ¾¾’ûendstream +xÚå\Ûn#7}÷Wô›% â6¯Múe‘Lf6^$“‹=Ø]$yÐX²-Œ,9ºÄñßoÉf³%“±4\@Ø`€‘›Í&O‹E²HZÕðVZ’š›ªÑŠHN«›‡³ººƒ7ÿ8£>ÇÈgEy¾º>ûÛ;©*ZS›êú6”cj"ª®'?Þ|óå×oŽ8çJÉpÔ4zðåéÁ›7ßxoÄàòý;Lúþ§ï†Þj>¸¾üþ½{÷5¾41¸Æ_~5Až+Èøöjøëõ?ÏÞ^œ‘$”sDùÛÙÏ¿ÖÕ$úçYM¸ÑÕü]jLõp&$'Rpÿ_ýÿëÞY,&»2 © Õl_¦=Ùx¸¡ÝAHIc¹ÌÐRT ´ÜˆÏìãH|k’ÅØj(Æýås÷Ké¬c ¯–`Žj Y5uCw†àÝl:wÝt— ‚C&hÇ®Äãáµ…åñ1¥H]ë¾ë!gÖVÀÏt#§ð,Ñ—•G(¨$6=„o– ĸ™ºŸõ.H©XZ¥h ¡@Α3E§D=¥ QL¼l(« 3¢Rˆ +DÅÍ—w :Û‘734ö­ƒÎ~ãí?&-RÔŒj,@Í,~¤¦”M? ‹`tü Si-” °dŸÊH!,ÄŸÜ“F¥ùC†ø ?0šð–B-wœÿí‚GŠ;]m%¸“øa?€;€ž.wŠc13 òІ4TW +<§<5l€O³lë7‰˜EÎaMѧ«¯}rè}"ôЧÐÿ}NlìÀ˜>ÑpÊ*%)ÑÂù´ãµwXçãõÆY ë›N7Ç™£@ >åÄ |ŠÄ9€O€þÿeœífÿûú7‚˜©ƒûH4”ÝgÓÍØ{DvVc§¸‹»ik›zNïM”óŽR‡§»rÒvEâÀ®@ÿƒ5Dë„·a(YJ¥'Fî°ëÛaëì&xºã¼£Ø+‡¿A Båä „ê:€OpþF¿Z‚IÒ)Ï›Ó`“×09wîÇv=]-Ư¤JWx ªä 2 q Ž þ>”j0^uæt…œaRæXSr»žE,à¥T}Ä[ì³?œ‰ß®í"ê +’¬Âk EŸ0C¥Á5ÖAa¤i*iPßÎ@L–ãY;¾f€ìÊ/ÀÑØ–¢1Úc(ZpËÐ^Þ€»gzpÛ\áô˜jŸÐUñƒÎãÙëÇœåmŠÂ%$:á1[6šÔ‚§&¨ŠP©+©¡µ[Vôc\«ÛWÛÛ¨¢\ÎÁdŽ`Eæ›sˆE݃Æ"BÜòyë( Þõ*Ú–HÒµæS¶¸ gmdÊäÂÆ 2À5r3È[Tß|kî°9JTa ÞæàÞvð¢m Ķ9ÀP Ñ=¼ïp7z;Ÿïm£3 ¿ ‡#t’Å%D8eK\6nÒ,f¬®Ä_fõz¿l­,o³UÄù%œ¨®Î!ŽÅàƒsˆ¹AƒÛ×õ‡÷—ÿvúuZ§=?Ž7÷IÚ–À}ÊÎW„¥H+íb¤5aJ8w½-¯¶É +ÚˆW¯?†KP7èH„R=ô âæhûù`iÓX¹jˆBÊFX¿ž­Ú¸–›ÍrõìuŽêŸÅ:·± +À_ñ ëéÝÅp$„œÃ›o.Î_’.°ûóÅ;e“Ìa’¥wj C%™"œ6»ÛÄë›v2<{ÜtÓ» ­»ÊJ;=ØäúQ6¹ä@ïbçºî#þj¼ñhC°úuíòàÒ%¯Ðóm²\Dc$Z™ÙÔùyÌ´“¾õÌGƒáÃÓýÔ {7³«ÞiY${D œrŸ¨5áµH÷ soIáÊ…áKdÒSë¶oVŸwˆ•ïê/Ñ)rÒ„NIsT§(9tŠbQsÂÌaêOñ¸èÓÆ’I3[/¬æ•ŠÈÆÅ«< öìçnê*Ø%–ñü€àä¨ÖäÍÉÈÉpyK@äÍ!¼±Q‰1â¿'éYÖ);ÐxˆK©ôî6Õº‚h¿ˆBg“&~Qe%h™ƒhA?Š–% ZæÃ`îh!~a{Щûêòë$cK >eÇ€ ¢¨NOùXJdš(íbZîVKÔßcÌÚ¡=¸ë¤‰ÛÕY‚¸9 q# Ž"n ȸ9Äœ1-{€[ÞÞÙ¥¢­W}†³%Àž°ÊRMz6‡ÛÙ‚ +Òpå2·q‘Ö–¶Sˆèâ¡Žl¨¼u3’æF’ÅÜ€q3xyÃ-o#¸ÓÅÍêùq¶Ó7ס)lH+m'Ý“$© Èqž7 +Æ«”g‹qAxQפÑz/¨( +:Ïî¡D•`or oùúÜò7‹˜J(×=ÄŽÁó3¸§úÎ’<%¹[Dˆv"¸fv™2A^<[m*®ÑnÅç—cB¸á«ÙÛÕR‚½9Ì-{#ÌG‘·â@Þ`n$‘œ½¨d$ëôÍaæ¶ôÓõ!¸Â0¬&½M'`@cDöÂN‡sܶèj9? °(ª¶…sB´‡-b1^Ú¢ÐÀÜN\°ÌÝxY¿n“ÙÁ(÷”½)ˆNMÒ¨!`16ª­1sØ3#ì0³Ð@ÍÎv 6Æ™\‚-ë„v¦ˆÑ"½ž%5 6œ’Z&¼õ·LÙ#àíduñš˜´¨²\ÌA\Œ ÀÅ@s8#œi.–€uÊÃ6¼®yó'ã6x›´¦¹q[2nwu–àdN‚ÀÉH‚8Yhàdg;vg¢h ”'ÇWóvî˜)óÙ§ö¢\xžˤŠÂ\ú¾<6uwØôÒµîn¾Â¼ç³‰·”3;ZB?X]ìl§2)|™ˆÁY”s÷ùxÑA>ŸMº^ˆ §3_œå¡÷{®ß²+æ¸.ê~Ï1ÔÓ§¡í}šmÜlnãóÙ¦†¯ÛÚŽêÔÆ÷ãÅÄd#ZQý1€p[ÇE×]0s*¶Ï;ØBÝý½àîM覽±‰Ú2î/8;·Ú4ÂôŒvGÕæãν±Ä<~Âa#js’  7"b°=já³oG:§¸vöyMï’߸ïˆÚD׫™VSFìPĉв$ˆ9­,íÞ½ûÍ`|3`™Ú²Ä¼À_ÿ>õZÊØz2ýáµá~´ùƒèzŒ`Z&ÓÛ±í¯›”åç’Î_öþĽ?Ì?hSëFö, `ìèÁš=7Ó_L¾ù¿þÑî`endstream endobj -4681 0 obj << +4767 0 obj << /Type /Page -/Contents 4682 0 R -/Resources 4680 0 R +/Contents 4768 0 R +/Resources 4766 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4662 0 R +/Parent 4773 0 R >> endobj -4683 0 obj << -/D [4681 0 R /XYZ 85.039 786.531 null] +4769 0 obj << +/D [4767 0 R /XYZ 85.039 786.531 null] >> endobj -866 0 obj << -/D [4681 0 R /XYZ 85.039 567.21 null] +4770 0 obj << +/D [4767 0 R /XYZ 85.039 738.175 null] >> endobj -4684 0 obj << -/D [4681 0 R /XYZ 85.039 532.27 null] +4771 0 obj << +/D [4767 0 R /XYZ 228.576 744.149 null] >> endobj -4680 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R >> -/XObject << /Im1 3957 0 R >> +718 0 obj << +/D [4767 0 R /XYZ 85.039 216.086 null] +>> endobj +4772 0 obj << +/D [4767 0 R /XYZ 85.039 181.942 null] +>> endobj +4766 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4687 0 obj << -/Length 2983 +4776 0 obj << +/Length 2070 /Filter /FlateDecode >> stream -xÚ¥]oã¸ñ=¿B}“µV"õùØÅu{{èÞ¢_÷áî -(6c +KYINâþúÎ%Ê–s@‹19g†óIE^‘—'A¨ /ËÓ Ñ‘·=Þ…ÞVþ~ Fœè ‰c/,®íê:UAg‹8rÆ:Sqç1â|Øܽÿ¨BO…AšjoóèE‘ -t¤¼´(‚$˼Íî7?ŠƒÕ:IBÿcµŠüÚ¬Ö:Mý²Y­#Ç“_̶]éÐïhžùÿĆ‘¿…Ñ·ªÙ¯þØüt÷·ÍÈŽp“I¤oò;¡»QâEaP„ÅŒ];$d÷KG“qúegËfIῪíJåþ·å©7=‡®==ˆt8l;Þs9aË™gpö²R™ßvßXYõCWm'$QY2¬A°m‹Û¾!f³•æJû›ƒAÍ€Ä믰 Ìë@|ÃÑ…?€uì·ø«üá`ð„ºö¡fi#ÿˆ` \ðrgÊÝ×™á„óŒ!‘†?v­ììÔ±y°d{^løŒûLÇAPð°Š)š®±Û†àÖëäü“+Ÿp¬‰‚j€¸w L'ÖD#4Ò¸ð?¢šr8u#ûd­b™Lc~£˜xìoñ(¤ßäq¹m—I:WÄã}yD%=€1êPÉõ!ä¹Ú¹Ê†µ²®qÉe¤‡ÍkV7Ì&{Êѹ`÷^ЉPK6žjK4åºÊñ>ß3ý¯hÍŽØx‘÷¸»®,Kb+ÂØÑëžñâVè¡z¯Íx:Lä3ŒïÙr¾ËΩ°üó&æÁ{ÆQaøêše'¶×»Æ?Ó‚˺oÉðì]¸ì ¯­U‘úì\ÝßLSçââ,ÈÂäÀ  ædüFJÚ3öìš5D¦,ìCÙ3y¢þºŠX“æi¨Z”.õÌÄ|¹ãÙÑÈua\à«TEÆA!B,í¨Âáå©7{Ã@ ªHüÇScyP‚¶!s÷Ö8KžÞ¾©²sZó-r°V±o;¤ù’pÇ(tÞn -)x5Bo$ÐoÞÓ¼Ü'²ðYN]GI€—<}!ªò‚¼0,ùggh7.t¥ ™1¤´GË \4Œÿr€ £Ü¯†lˆ¦!]5[A%ÅãÝxù_§JÒ¾+0¯‹zŽL"‡ý$¥ÔÕ¶sêe½‘užNñWòTNy -yØ1"»7ªËI1;cù?¶cv3ãÈÔ;ÜœJ<*ísÝv¤·räVb®%“kY/„…1`¥‘x;ÈM¶5C)‡¥,M;ðRÌNý€¬¤¹è#;J3ŒG…pO$n‰MÉRröe•S_²•ÈT¤!ÒFû͹LZ|˜®nIÒ3í"FsEW”C<«Žp¢/˜oÛÒžì¯WE!Á‡± -Aºe 1èi;Áêk¾·‹MhÛ婤~Aвyô˜: í’S@£tDÚ–¼Dÿß¡ø!ÃÜ‚AtE•Ä¼Ïý€9I%)•S€°g…ÏŠ•$»`Û óB”Å܇ h‘ÿ¥ÇigEÝ:Ór(ü%¤#,€®íŒ#ÕPaàY'„;ŠN=OÙì`.S³Ž†Œ… ýy´t††,N!h”(çó*¡ šÔ‰+S‡c+ûÛ˯X3V³œÍ±=£7û%×| øμUurM¿_I¿»•d¬[×ÀÒ¼|Æ΀áSMÊf"3ÆM–]³2Ä$ü>%ÈñåHyÌ_EähPÐÍj‹Î^YÀ=s|èⳈxÃär¿g3–k R Á¿‡IèDbKŠB¬GŒIV£àrFt‚Cì][׺É؆!A•ìwŠKœ¶%˾cÖ`gË|.”÷’5Eÿç—`q‡ë¡1µ_·Ÿm¡wÃl=qYe^õ ¶ŽÖPugTk¿ûíÐÛA]þÓÔÖEî½À8 ¢¢ðŽw:¶µHe^ßÝßýs¤²dyA5~‹ m - {NemY‚º7 Š4€L»AŽ„ @¤0ž)`ˆÕ÷s‹W7Ö¹œ‚®Ò ÏèÀûîEÐË…fgLüObàý§cäýЧތY¦»vs·’»ÝJ’Ä™§u¤™t+íQ"ßc½Â΃´æ쌿ÙrÓÒs æÚy‰:ü´m5’kƒuäx’V£ÉGdñ Íl !¾lãÇë°5¡Xà=úÜ‘z-l!Æ€û,#—SÊ5-vKÛô6Nï\Úx}`àç©›ÙÙ`i»™m]™føËå5ÇY$ sÇtþwCD[ŠÌ[ã¶âÿó ¸”@e~£ /â7_•Ç`%ÉÛÍ9 ²(µÍ¹’æüÁúí ÌÆ âåÜRx“• çv®â"Ðil“Õ‰™< áÀ)…ÀÙIÁ=éO‹y;³€ð‚!°’çBmÌT-œ·àwÊ[°IÎé)!džŠð¤rK©‘Aì{l£?ðxÞÓÝ­%Ì|Ýßñxz(ºîµ -âPIGÛaûkV ºg‚)ÿïÆ*ê),ôÇ)˜ya»içõ L:KŒ ³¼@`fnù‚–¸Yˆç×0ÛÜI3œó«‚X•ƒó΂«”=sÍûâY++ôTÄñ+ò±K‚õMêFúé‚|í:Sn¹ôå8>]+=ðcÖÒÎ4g.æŽTXãTp_ë7É!Ú7{xºtôZ‰T£mg/‡I×é‡j&ç¡Ïf}¡×R5³¥Ñ\ ¿ˆèQ8SËýºÎôR¥³Ø§ÊŸßéW*_yR ŠØþ™¡†Q6ÍA~zæÌôXèÓ6§7`æ4uÄ.“_;· -ÄË-2• ¼ñ_+0«1ùð„íÞ±áFóŒu*é -Æ”…§~äÀðˆ¤‘¯x<–Ò? pè*çj‘: þžz‹"wã†û5—£Mt¬?Ô V´\µ¡x½NÃý™ v{qžÈ£fÕô@|û_sœù5‚¹Ÿ5H´m,Ðù= Q r\È:uÆš4R¢÷p´œÆ=Ý) ‰sLà´Ü ñts Ì¥”¡Þ/Oý†+r§œ×yNú<Õ5ÕÓ’Gd“]h¿'ÃcÊðËA~Þ½–5¯u†›qkQdvi˜¸Š8 'ÓË1Ìz>UìÂcéòb£Éµì%?Œ]Ú<=’-½-]¿ÉÕ6ì;]o³Ìô°wá‹| œ+‘ÜðLB=OOüËTr_ý[+Ñ·‚¤ñ;f¬jãÄÅñQE¬éZlª±ù„uÛòÞÈRØV~¹gs˜ºQ~ËxeŒåp;è:é³ LúÓåkhÏ´P¹¤œÙ'à~:èiÞ,ƒ:ðIqq,ÐJZc..D&sŽCû´Ù’‰õÕø,bêˆ!&=ÖÀ•¢KoØÀJÞ|‘Áq¥3ßOÆV)„Ê®ä|~b¸'Ó¶¨CŠ6íáØù -rFÑ« u¤«y')›¯IÞEæDí‹vËÃÉëaROý´} G>o¾£¸H¥SœWòñ*Vɲ2Ý{|Åt\¯ç‚å"Ý!¥åªì§‡Þ`è&ñÎÇ—3…QÀ¡„ô¥ÐYÌ–6]kõQÁPò b"á‡Î#Ö\qèzd¬’¦ €Ødü–Ÿ½g2hª”ãÇ*¼·,m~?Å#¹ ¬J뛎>h-ÍйÔ]~ —kÈ,:+¢ -1®‰,8 ×HM_\‹ü¢^PMü½¨·tÄú”Ć+oþ4Ó0©Á2#Âñ¯¶p•_t'Û¦Ò¡ÿWLóˆÐ²÷âÞnAæÙ½Øv¹”¢“¨ÖsWâh»$]‘ýäTɇBùROiEÞ¹ ‚¿õZ'A¬µÛ^Þl3'Ôë.S‡:HÕHŽú]]ž™h¨ÔsýÆ¡ÿ$6(7endstream +xÚ­Xmoã¸þî_á"O"E½è‡\º¹æ°›ô6^ ÀÞ•-ÇV#K9I®7ÿ¾óBÊ’-{ ´óeHÎ<œyf(êÁŸ?µðT2âPhåO—Û‰7]ÃÌ/ßH¸FÄíÉü<Ÿüt¯Ã©ï‰ÄK¦ó—nŸÄ: §óì«s÷·Û¿Ï?|ž¹J)Ç÷Å̢عÉع»{úò8Ç™Àyx¼Ç¡§ÏŸf>ÌÆÊ™?<=òÜ_qÆgŽ·?Ï\yÁϳoó_'æž=K|¥PË?&_¿yÓ ,úuâ •ÄÓ=´=á'Ét; ´:P¦_Lž'¿u{ñ\0åUc X ×OD"õeàÂP„^Ø'½à´ap€U ÀF?®ç´{Õ¶y¹`ÂÐ)q *]ZVÅn[òp†Ãi›rï¥&©-÷ÚÍ +‘Ó¦‹bu=4K†—Í9È9¾1GúB{ŠÌyhÙò†/õmæÊÈ©T®Éذ♶bÉMŠ÷þoügfJªZn§¸¢àv6³öâ%ÿ²¥ÐÈ`jt–Ù*Ž2ئ¯9v×<Õ VFP9WKæi} +eâ´WÁLÀ á ‘÷è¤.¥Ä |ç{º}3¶ùÎ5LóŽ&U;–ZÂ~ÔhH¤åÎUžÙE|\þ»ç«úæ†wdz™nW(¬ìÝûÎ/Fqü5üé>”½›‘a ÚJЛ‚ó V=ÞÝÎíÌ÷´wýO­ÑÞöØ?•ˆ0ÔÓ0 Dà釗QŒ—k÷r{›‘' ô %w'¢Öhù5*‰öÆôØ>ïêcuµ—ýR×îuY]í+¡dr¢.`ëóm âÄÓˆ÷}è ¡¿6®h}‚<1G—]•è=ìÖEpÅÍ~†ñ„ÍWvT +Š¼*^Î~\ì`xË~EÈQ¨T|ܨÃ@3Žã0_>²c¦XA¶%!ñç•éÍ!¾?½#uÿöÑD':kì,w[céÌsèìM¤¤~}ئ ^ïÒµX‚©mö‘©m#ÎÐ[(¥ˆ¥¼Ho=™Ž­}‘hÝ£7D"Â[‡ÈÕÚsþñéã™ÓíªK§÷dÎ’«ÁÕë'Vñ¾]r‰„pvvc½‚•Ì˜ Sªc&¼‚náHqéÇ"€whO—¿¶2—†Â^xÑ@á[uoªùòâlå##x¼_~ßDÎr€Ô><®ƒȳ€~C9¡êò+ †Ó,#•3ó.5u ¶÷TÓVüÊJ—¯3Ü¢Ìx€tisŽ–e‹øFv"ç=Ã6å@¼…TâÇT’Ê{î/+xÚ¥9¿Ï¾Yqä(þ?rºèZÒÿœÅ3ž|©ñù‰+{amv§hI[îü Iª1m…7Ø㧰ØNq¹®ÂHL"p^4ñGöU±3î´7bÃJ>~æ`0š-Î/„-³ée 5€„ÔÔËŸRu¡RçÖކŨX¢Â{´KÚk_â8õVW *%(ò|>kf{(•žÄmÃçï ŽÚhcJ&úxBË:Ľ™ñwsп*pn·9À×c¼=»ï)Dƒ2¤útÑ{ÌÙ²¨_[µÙ¢+·¦jJ›†Dk +œÂe£Icüéëº üÒâÛˆ–Bˆþ(¿Uñ¼lqÈ‚£LÎÓéåÏSl2c÷ЦóZ¸Fy‰%ÓÛs/×D\²(¸ÔÁ¾'ÐD/±rLª(d¨a– ˜ +µÆàÁ¾õS{gQú†d–ÐSÞ ýo(”çy¿Í4šÍ°%ÈwØ_¾®ÊÎ?Ž&ÒBÉØ.§Wƒ)4[Êàpp/ù²Zga#Ïyxa[z +.]r-¹ÚOWö‘rx‹¥íQ©Þ}9\Þu7YÚ +àÄHåzä™oQ}·gßœ«ù4¥¿Ñ²Õ˜ó?}Æ=Ôâ1ÔÇrœõ5¤WéwÊPj“ñÉ% «•ÿ®Z/endstream endobj -4686 0 obj << +4775 0 obj << /Type /Page -/Contents 4687 0 R -/Resources 4685 0 R +/Contents 4776 0 R +/Resources 4774 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4662 0 R +/Parent 4773 0 R +/Annots [ 4781 0 R ] >> endobj -4688 0 obj << -/D [4686 0 R /XYZ 85.039 786.531 null] +4781 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 290.779 219.43 302.468] +/Subtype /Link +/A << /S /GoTo /D (acctmgmttools) >> >> endobj -870 0 obj << -/D [4686 0 R /XYZ 85.039 766.606 null] +4777 0 obj << +/D [4775 0 R /XYZ 85.039 786.531 null] >> endobj -2960 0 obj << -/D [4686 0 R /XYZ 85.039 672.187 null] +722 0 obj << +/D [4775 0 R /XYZ 85.039 766.606 null] >> endobj -874 0 obj << -/D [4686 0 R /XYZ 85.039 630.546 null] +4778 0 obj << +/D [4775 0 R /XYZ 85.039 746.481 null] >> endobj -4689 0 obj << -/D [4686 0 R /XYZ 85.039 603.932 null] +726 0 obj << +/D [4775 0 R /XYZ 85.039 622.822 null] >> endobj -878 0 obj << -/D [4686 0 R /XYZ 85.039 284.675 null] +4684 0 obj << +/D [4775 0 R /XYZ 85.039 590.401 null] >> endobj -4690 0 obj << -/D [4686 0 R /XYZ 85.039 262.913 null] +730 0 obj << +/D [4775 0 R /XYZ 85.039 436.348 null] >> endobj -4685 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> +4779 0 obj << +/D [4775 0 R /XYZ 85.039 396.185 null] +>> endobj +734 0 obj << +/D [4775 0 R /XYZ 85.039 396.185 null] +>> endobj +4780 0 obj << +/D [4775 0 R /XYZ 85.039 359.318 null] +>> endobj +738 0 obj << +/D [4775 0 R /XYZ 85.039 276.51 null] +>> endobj +4782 0 obj << +/D [4775 0 R /XYZ 85.039 241.764 null] +>> endobj +4774 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4693 0 obj << -/Length 4261 +4785 0 obj << +/Length 772 /Filter /FlateDecode >> stream -xÚµ;]sܸ‘ïúSy Uåá’ø•ª<Økoâıöl¥\©$Ô eñÌÎ’”µú÷×_’3ª»ìÕ–wÀFh ý Å›þ‹7EFªÜäE¦*ÞìWÑæ+ôüé*Œ­ lœ7·W?ü”éM…eTnnïíì®òmÏC=ùJ£¤ŠGÂqj•óMq’„wkf†ÆŠ´•n ˆŽªÂí<aÑÊÚñhX¶£ÿ4UÕ ƒpðÀ¿DvÛtæˆôU,g*O':éŽÅ|ÏÄŽB[CÒVoYˆ²nuêäi’_FÆ#-I$ú&÷F%,IîU@úŽ_¹oWµíÀMaÿ=_ˆ„ï-$‰E`º HaN…à¸ÒýËD4ÓôÍáDH]j‚ç]iJY˜ð°òØÐxÀë”æÁ›gîÙ›¼ãÕc‹lΣàsuÀ)ï*Æêð[rSCRò„ÕGnÈEįŒgÎ šOõ‘[õ¯'ÜbC"€Í´ÕðÍ*±=SaÈ¿»NÊÀ ­Ü™]Ûw_tëÄÁ#lE8Yãx<¯G’hÖ£óaÔ-ƒæ:±A`ÇùçÙœ€NÜÓ=Ê’×t·°ùdöÙ¶ 8X™Ã¡Ó:êeD 5­ªv––óÄaÀå)ÔŽxfãéŠ&¬Ž†6IfH­èà\ŠŽ+IËIÿ%Yä« ì¨ðàÛÁÄ5’pDéIJ¿ÖüÕ®I8vì:º–'™N±ne†G³†±$×þñ5f–?òâu!ŸÝí*9„òo<ÍWß“¡Ü­Y(x4[k†¥öØU|@ .E|ƽprdrÅ@ÒÓ½ŠwéA†Y‘¸Õ@ñ¶÷µŒèî¾®LÁ(À!­ «° ÐʤV : ?°—PïÂÖkAf~ynþzönÜâæ’$¢ÛÑÉÍBðÎ8&Õ`¤ ¸Gü±\¤9ÉŒ~ÇæhV³õÌ_{lÈÀ¨JÌ!hÂH’ȉ¶‘?îœIèã/I$™a¾ßcÓQ—f­åhµsw£¡³=!Æö8ðwÅ?Ž§ --ŒS“ÍëþÐ'„§‰_ -Ø‹$;V\æfQ5vDµñ¤æz½ð9yjˆßW a{–Ö(dëÐö¡’ª;s“†É¿\Š;›IQÀ! |‹:¾Þõ‘”N¼fð$–ü}牳„|ãT5ä½)/:Èò°€&ûooß}üÇ<¦Q‘ -ó8ߤy¦QñrP£B­²ÕfkæÚ:“QÄâѤ¢<ŒSeWDÊ>Þ||·â|& µ˜úW+ûƒ@¬H.í.-ÃBÿ6›ã©^Ø[ÑXžy{ûôîõÛÿ½é8 ËLý&›3s]Þ¸B0iéíî˧÷·k¬Sq˜…¿.›IXäÅ¥ y˜eÉo³A™ë… –qÁ¤î_ø°²½8w¸ÃÊ~«J<ÄÂ5ƒ íÉÕWšƒÓn‡Ž[ƒÜû]SµìZ±E8œ@¥Â€»†\ÞÑxü€p0îS1iÃÁ ÊÊ€÷+Çž¨"ÔIzéÒä:„Ù62†eúÞ™këL¶rmò<̳Үˆ”ýô㛵[…El„¥• Æa_¼8ZÁÒßdf®ËûÓ: •xû{{óùœ\Å®\­$ R ñ|ž\Lœ98DO½1,žÒ*p÷ Þ¤* sÍ™³X‡I‚S”7'Ît˜èÙ ;‚·Cî'Ç%;Î\|¸–¨?ØÙ á7ßëþ{S?Û…Ò ˆ—ÓÎJêËì"U™ÆìyÍ]eÊ÷4¦ ͉ŠÖÅ$aøæ4¥N÷ Š52Íäv^š`ükݦÒFy8î gØŸ¹ÐÙ1Ñ|Ï'¨M• vÎræqþnÅË œS”¯Æì§ä«àû{Sqú×_›a¤°/ò²*Õ’—)¢²oQ,)2˜A’ˆâËr”Z…Æä»Lks6ÛæPpvÜÔcïîŒáä°MTcIQèÎ æ–?Ö£uÖH0:.27«ÓsBðP1ß„s·€éÌOähÁ<„\T.Y9Š½'„wGþ­x$;ÖæÀকp?óŸÍAÂeÙ¤L¿bÕGç0j ÌïC±«8ž³y €1딲ģr¥Ý&\eâ¹;p5'Y‡Æ ")g`çás-G Aê´«™®ªƒ³u¬6[èƒDNW]í·Õü¹0˜¤F^\Xp û -¨HÂ4ɽ…9¾+â)kÌ9•ìÅÇ”÷¸i5K6@;‡àdÔ @(,b+c›ùùŠcv›Ýn FGÂè·"žæŽpîšúÚj¼vî-ü|–o: uœ½À· é߉ÜIkm(&©xä¸}KV&S—iœ->+K0™G -qR¥…„á÷SohcÇ @ž¦¹Ü˜@¼:œÃ2ÑH­¥Å”쀶W¸x…ûVÂÇÆdÒ®]ØÜŒZÑu䋦:Ìr?© Ü­»óüŒ àFñ?'¤ ü$\ôL„Ž•2Î32z™ÁY1cd®{êÁœõëq²ÐrϤÀ50Nu¢b³“œâyÞ‚àQš…"æ•`hÚæ0çŒ;wiJj)ì'ñk;†wÍB•iúM•»Ã²\±qFx<›‚¨`?(iÁ—ƒ§¥°Ÿ„´,ØãðO#4ò‹QÈ£LJ¡,ä"”¥ç¯8™ hpYˆ(øu×NéZÉJŸK!-Ò8:eð—Йë[áç–»„÷‘!¦‚ÍQ~eN›œ!+ ©BkïØÁ2xÞÝÙkFØò²NEtW=BÌr—÷$IÐý$ëlR°»~Åô[× Œ7+þßOŽÕ(營\¨E«Ýwä`õ>Ÿ1ÝM57cò½øÑÁ9ʧ~’x§Hǧr,‡s—û‚»¥ð5wAèÌ1+yßkùÐøCnùÞ06 ¿76ËÏaÔqÞ»P -"zý‚wá ×j‰´Zý½Æû.`&©õà—… ÑE’gAÒÂX•eî‘$~Õ©¦Òsjyär@.ž§­8…Sq02ƒq ±ÍõF7I™Ë= Þ†,ì=—ð™—=vGwbˆcŒGh4\_ÕYw%3ÎU]T觔(–”<%€¡:Ayjòõx¸£ZŠ7Ó¶±Î#e¨nªÃõ A ë´ÛT¼S²ëú•¥,’|9>Y®ýÚÜÙê=e°KT9 ›P.pCÃúhÕ][ï±rG~-Q•:øÚW6’£²“â`;åŒ~@ÇtûdŒG3Ö?œÕÉLÏ\—éz,ºTX˜çÖZ @=Ó ÚæhßF@§È]ï˜3ÉxÕܳµ¶Šo -[¦…=k/ñ’ç§Ù°(\ªÜ÷X -Ž8ƒ©Þt¨¢ðÛ£u”CÇúpåkdM{™xlX¡Ñ‰6Ðv#óy%xkõûZ¨‚€L\JZü¡^aÕd›H_¨, ~wgÕ7ÃüßqŸ=TpQ»¾ùJ& tv‹ä &”@+Þº£H<Ø[” Có•äœ*x™òÖž¸—Šû¬FºS™ãÁã—Õ}ÐvåGX]í»ÊÔÚi”l`6ŸÁ»Ï™‚ÔÞ ¡e¾jî„}ù¬Ô7¼buJOC°wOY­}%³_嬉±w¿+¼vqÜ:ÙŽ’»©Úÿ‘IÍQDã(ìXÖÙ %É'éÀÑ`×뾟ÒÑ4Cç=¯ñVcUJp…›”IåñÁyÍ‚)7ª0?¢dÍ©à§Þ9_QVÖ&έ„®Øw6u—¯ yòø ׬vþk¦ÄØQLÛÛº)xkœÃË|aî8ìÀ³®Ÿ—SST¡Üë­¹þüXSl«åbìèNÈ5ИT Ýøg§¾é>äP4*è) çþ¦¬Qן/¨™Ù;ÅÙ`躾ÑpF¡gqžÇ:ÒSÒ-RÓôÆP1Îð`Š-øe ߌ#-6GL QëŒYOþÕÚ[Hyt±@ƒ Î½þ``.÷l›(ãæBl—qëâsÎÜxæšrö5œøQå”ÉÓ+ÃY WßÂsNuœ¡N_pª¤óNµArêäÿâT_$É8Õs’fNu:öH2™YßíÈ@97öõ_Fù`:ÏDÚ˜aKC‡œÉUPÿÊì:qAq]ÿÄ^ÖÌ¾í § ö1]–z¾óŽ—žªrÅËR!è×…YÄýzÝŠßãÄy³i»ã°,`ºiÉ[Oâ™Ì“ÆúìkcÑfÑsÒdJ²ÿ3'nö¾÷œ„ê8Té ÉIé‚„ -•$É›-õpÐ"¥&˵šØ*ñÑú%‚gAÐ"±\º½eÁª…C¤ LTßòåžœhó®ÚQûÚ<•›ÔÜ€;è˜ä/ô„tá  ÷õ¦¢㎃Ëÿ6À,n~™*ÁYPµÌÇ¥GÕßÈ"7'z&TÑË\+7Á„Ÿ+vÞ°±k»aoy‡`6„ ãßÚ—œ1¿vÃßÙªÕ¸¿Jû擼ݻG'i}.øšÞ©ëÀ¦œåu?V6eÝûz¬švB­8E°™^Ñ|wp‹#åÓ=ûõ¶ˆ•iÇßO½Tt‘¡³¥ÒWüÆ÷ØÉúüä^Ù|îölÑfzU&ÅRùÛÜ>¸‘•ÿ' bf3^ ç¹c…)oÓ®›ô«3ff…12G¡¼ì¥]íîqäƤsïlàÓ)!/½}罌K -ÅdžE¨¾nÉöüòØ  â|F¡ÖC; ¿_¼ Á²Ø!ÌŽ‚ÿ’Gp­~x¤´FR:s¹6>ØóØÏ°qöðÐs˜‡fŠ\L‰ÔðD4è2OÁxÍÑÉZ»]õ–ÏÉ”jµ•Rû¬öŽÍß/^²x´^˜‰ìç\&ÿ­è<#ë¸Ô瞨4ÔügKs¥ÿX:þ£?i²¯6t–E²®XÓ$!Å*ÄÐË•Ì)6û´$ùL×4endstream +xÚ¥TMs›0½ó+8Š™Z•©3=8©Ó¦Ó&mLOiØ`›‰ãqòï»+ —ÚN.íîÓîÛ/qŸÁûJR&´Ÿ¨˜JÁýyå1 –Ïwˆ‘ƒŒ˜‹Ô{%cŸ3ª™öÓÅÁfTêØOó{rùeü#Ü#!ᜣ$Qd„Š\^ÞþºIÑ‘ë›+TÝÞ}8X• éõíµ}B è"’¢a|Œ3àd<¤_½Izà9È„ ,Ÿ¼ûæçÑWQ¡•¿‡3£\k¿ò")¨Œ„“×ÞÔûyðem‘oo+ŠŠJ%N«Âå *šSÆ?‰À]"LUî—ëf dëí¦îFÌÒX)¥Ce¤v“m·ùÌÒÜaB±8V¤]nÍí§Ë·EcV½³:#Uxi¶A'FÞîó33å ´|sPS’¬œjLñ0(qÌh%&%FFDJF²]·ÊqBª¢[5p„ô¶¨‰InʼnuÓYä>Œ4˜ZLëñ5ú.ì›ôÿbN;Úû c³Èп^’,m³CAây³†”Ê9²)áÔ­_,Ì”½è,,«­Ò¥ §Êt$éŒÀ£É ¦gmæìE‹]Õ’,w 7º­óiZ¼ë%˜•Â +&ö¦×p2/3õrÇÅìVîbÚ~œ: rs‘:°´/ÙÔ§#mR)ì>¯Ëº½Ž¢ˆL–ì!Ã> endobj -4694 0 obj << -/D [4692 0 R /XYZ 85.039 786.531 null] +4786 0 obj << +/D [4784 0 R /XYZ 85.039 786.531 null] >> endobj -882 0 obj << -/D [4692 0 R /XYZ 85.039 548.572 null] +742 0 obj << +/D [4784 0 R /XYZ 85.039 683.595 null] >> endobj -4695 0 obj << -/D [4692 0 R /XYZ 85.039 527.376 null] +4787 0 obj << +/D [4784 0 R /XYZ 85.039 653.702 null] >> endobj -4691 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R >> +4783 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4698 0 obj << -/Length 3939 -/Filter /FlateDecode ->> -stream -xÚ¥ÙnãFòÝ_aø‰,…÷ñ˜Ìd½;Èdg ä!ÉCK¤$Â<’²göë·®>(QI€…a‘Ý]Ý]]wU3¸÷á/¸Ï“÷Yžn’(¸ßµwþýF~¼ b- kæÏwß}HãûÀß~qÿ¼7ëþ&)ÒûçòWïÝ?¿ÿùùýçÕ:Š"/ˆ7«u–åÞ‡Uà=­Ö÷ñ=Ž„Þ÷?ý€/±÷ù= ½Ã¡OðòYz?~z÷履~\ýþü¯»÷Ï+ï Š§?î~ýÝ¿/ÿÝù›¨ÈïßàÝßEqßÞÅI´IâHÚÍÝ—»ÿ˜µx,¾çYK$H¢|“äÑ R‡AmÂ0¸Ï’d“ÆáÓé´J¯¦3ªÃÓÕð2NõnµŽSßûHÃø³{©»žó»Aâ. ¯a&¸`=¼8ñÔn:«–j¾aGì©ŽŸu{úÓjf^50l`ª­¸±ïœŽÐ­—ÛWj:ÐQ!ŠÄ«Ì{>Êœ GÎ"w¿Â`$@•ÉVV[Þçvz‘ßü †÷ † -8➟f×°½½†Un0T ÃÃ@jj Ô­ÂÜCÀ5¶Æºð’f+gŽÚ­Ú Ñ9`ß#ŽH&˜!8~=4rf¼ k5CK[’Û² ®ÒOµœ‘7ê¾#ù3Úð -;Dþ¨ºš·€…A¾ó˜Ù/oC=á ȵáTŠß¶Š&¿pkêñ™!?ønh>!àþôà >ª’gÑ–S|T™U\^€áI! Gð¦në‰DmàÞõÁú‹7rÏ„;Š#‡¶€~M'ƒ^$->'Ú $ÑÈÊs­¶5=é,ߥǙ!õ`Ža3Ðuly1¢@ oÙŸG@E¡5¯¹Oý[œX©÷Ä ø7?ñÆï˜@(éIŠâ®XVP³Bõô}>‚Ž,X0ýÕ £ºR3eÞ6ˆ‘–jêoêŠ5˜˜Æ©÷´×“…!EËÕBˆ³eÙZö - T#D¿f6žý¬Œ/ªA• IeãàHgLÒY·ÚÜi™îÏlHð‘"ûªÓ¼Î#Vsl‘)E'YÈ©QcßÌÚúh MÐ(ó–ZëQcW -î ¾¦ÃŸ[:ôXBu|íªƒši´¡åÄ°»k²Úe1u"-7K½Á®Y39š¸¡Ð0->ö÷òTeK'©Y/Q²Õ¤ÇcnØb“ŽOòìPF@Iea£·c¬;'3ÈŽáúd£!¯‰ºÕàaý‚EÅÏ %¬Ä^ÕöÝaœxˆ$€å²>9SóŽ )ÖÞ,}|Ô?9IÓpÇ–Ô½â†Ëp2”ÐG!“¡ÉóˆþðTÎ\²SÚ7¨W6ã©Ã ¯52æzg¦ÎÈdðEuã›k°¯ÖŽÉgϪG¾÷Cµ«Km ø#ûM=?wÖV¼@?0]?Ý)‰„Jö¾DŒc³ œµ¸ŽbEªÑœEi‚¬AÕF–¥©÷àø -ŽjŽŠpìÂqàx„ØŽ¨‚ìʲ–§0>v1J¶R2ÖÀ±ß…Ç",Š£Œ(Î\*'C€iy^Á"?SIY'àùðé§~c–àÛ¢ÈèXF4 Î =ök»¯eeTtPÛÆÎeRÃ^Ö¥"ÀT3Œ‡¥@…p‡XýáÓŒÒ؆ þÐe;5Ò¥©c¬}$F#r 59ŠŽ„‹×ydÀsG.·×/Jβ‰!ýû3Ó‹µbíxwZu7ÕÖÞ4´ŸpÚ‰fQ(4ãXs ù‘5ø"ÀqùÆ}e¾³ûm6LÒ`#‚°wü¶Õ®Þ¿P`În.`ËŠ¡ ÉúÐË®ïÄà D.ec5A*o`¢Èž½. }BL“𓜠v¡K@”Ü4Η88p62‰¸aYN‚EiãTyØ? \½—u¶OØePUÍnKŽøÊ ë˜SbcØš¡'ÅÍvA61r¹QĹ ¼Þ³Ž*`ö¾o@d0Þ³ -D³Km[ƒ%¸)3ˆWº‘ŽUsœ$€µÁí°d™ V0dý_’9V>èŸå•¬Dßµr4zÓfÔ¬!“nå(ºÊ”j­è­Â®oÜ0|!€#‡ê®‚j·¹Q2ïpž‹›Šü ѹdš#-óRíæót >^{¨e Ų™‡#“‹£x8Q­{F[‘jà0¼;'kÃj³wóx–ò’ߨ67u÷iÂAÎ!zZHÎÉ}ŠC¿5±‘—†]›Š§¡Ÿœ§o@˜ó8÷Þ3o†o²c{j4ž­ã¬$#DŒÂã4»¦:É˵¸~¼NÃ`‚†ãÉÃЫ^W ¸îæ,þ< ØŸ‡Ì'hNƒ2¥gIÃQ‘À ¹6OÀpÒÉM(„A•#›å lØ“£ LÆ2´t:&:¯¯­Î–BOÉBŠAq[â}v]sMO“íú˜³á€HÆDˆ‘/ÑŒim±Ç$e4oÇÑÁh…“©‚Ãñ3X~&4© ¤C x¥èvëXÄwŽVÒ!Þ«9CÀ%—‚§#yùP“É ÓË´¤adª3¡ ïƒ!À%–œ†ÒÁãm–ÄÁ*Ö+ -DçE̺dgõJ™Ýž,ÈÍ/œ»Ê!~F@µã2À’qžzÊ`«¸ˆ=Všµ6äòp\+>YÔ#AQsy!ØÅ2,;Vë)ØåÛZøOf•Ì—$­8ŠÆJÕ×Z‚L‰»~ÐÚyìõ9¥ô¶AEÊGdƒ±zç©ð :bªwä^¡c„d´%yÊÙ¡’%ây̳ÒÅ5šóFå!Y ©¹ÌEµhWÝE¤ˆÝ!Ú=6ƒ-ëÓõID@£èfUpÉ%6¬\˜Å:ê¸ôd}#„èÒè*"‰8qÿ±q0¬wõLJ™‰,L½0m7M€ê¬$–„ÉYU æJÐwë›.Š}6—8°Áà(6™Vœ%¦Ðƒý#Â)œÍӄˬ+ŸC®ÌVzhŠNY±1ŸÅÀäE³x&1Œ*?µïYÈ‹Lá™IK¦Y>¹¦*βyé)†|¬?Í,vbL%Ø8.ÜxGŒ|à˜1d¯¦þæHWé!ÿ¢H‘·Š×@3j²¨‘ûú¿é¤›Å)‰mÒ’Dœïp­ÆH/¡Ÿó•$b³/ -³NÀ7¼ƒöþ,J 3 ñ˜×ôµèà C\̪ Œ]¤ 8Nê’è¨7¹PŠÄ©-ÑȈ0+øz"ãbFønï ãN“š@ŸØJ‰Ý2 .5å¾KgD&J«ÝPáQWƒÊëÿ’ŸÉmvâüÖ·Ñ„¨´ -²8—C1úUÉؼÔãhØ™¤db;G‰¨©AÙwdÊ/ þ´½ŽWÈ•µÇ!s%ç]tG¨Œ>GÝK‹wŒ§Ù"øxd­Ë®a€Š uïNÌ#<žÈMeïÊ_yUºßd ÉpýE6H°O‘“>F{K~—ÃtcÍ ‰rŠÜ›b9õÀXª– ¦ßøT<0Ó¤K£,Ò£ ›Ì­ãx•ÔøÕÞÛNý•œ+^¿q?»‘ýG­#ZpИ‰Æ™râDÃ!†ŠH¡Øǹ‚"ù.'Ú—ùéuÖH]·¼HY+c¬ÉY‰¦ðû—Ù×™ýf#ÊB;y9Vb_É&m ²Ã¨«(¹o?ðÉ‚å¼™‡àÔ“@Õ 17 'œáÓ…,Õ…S× Äú’ÕqØ7#äÜX¼ã"çÑÒ¥B÷o­¿0\à–š#vŒ³ø0íĤüi6ÿò%ºkçcÕK Þ)^ñDïMÄ-|.ï“ñxá+ E`Ù'*j‘c–¸8Gáå¶ÅèÒG9ALŸ4n¥–÷jîN -ß~gVÜ{ª ù¹:•cê׬´çáZÓÒQí§]N1@ -xÁ/YeáþÌâÑ…£?O#“ÜI -É%Z¢×KÉ:³ˆÂ¿õ¡N±’Ь§º­»‰M€»æ_d‰Ôðt/×ÃtýåÜR›«1c’È ‰—)9°E‡"qº¾¯¾‚Á4>Þx"çÓ"\¼nõÚþzÔrdî¥o;$A̪¹Ôµ\k -î”’27.2ŠyQ¬y]N­ø|g¬Ë6´ì49ÖÇàãÜá`ÓšuhÌ 6·ªˆ\‚‹nÝ=âÐÂÝ#cï©´BÄ¡äèXxÂð¹= Õqžw§ªq’º`4+ÁeNzˆ€eßé -c,:ˆ0¼ÑR9 /¡„±V\nx/‘1]x/‹…£¾Å©0‹ŸÝÜTõÍo¦£dó'Ó—ß9Ã?ŸåÿúœÚ|0ç›"Í·Ò³š“0Ü„A‰DÑ%Æú»ëk”ÿôm­¢endstream +4791 0 obj << +/Length 2805 +/Filter /FlateDecode +>> +stream +xÚ¥Y[oã6~ϯð¾ÉÀX!ER—}›v:ƒÛé,’b +´}-ÅQG–\IN&ÿ¾çFIŽ•Á.Š/‡‡‡çú‘Ö+z•ºP™l•¤qèŒ^íWjµ‡™WZ(¬3¡³Ú “?»‰£PÙd‘FöØ$‘ mj‘æ»»«ë÷‘ZE*Œc³º»÷‚Ä ˆŠÒÕ]ñ[ £p½qN?­uU³_oLœ?Ýâ7>WMÑ®žÖô<˜7SýòñæWn}èÚÓ‘Iþ¸ûñꇻQ¶qW^ëoJ?£!éµ[if*›Ko\è\BÒß(u7T |Ap›¦,gýán‘æ°Ž’`‹­ Λ7pê(šò‰‰ö >̹wM@”aÓ$¸?á;\‰;Vm“×´r}fšªçµ9Ž=®h©ªqÃm]òÌÐòwוù@cY÷=ŒF)3GžùìI‰ ›FÓgtØ-Ð%AÉBDxPøGݲX‹¶`.œESY7;RÜÞ¼ë¹Å&„†˜Zž´—°IÜ!ï)Qšë÷q4³F›P+2¢l~é—äG¦?³žKÃ,Ê„¼?ñaèÐíáã—dgIªQݨÁSQÊøSFEÍlLžb¢3 ,ëÆ †¸öb ·5Žæ›7Ü•Š´x„žZð,Z ¿YÿöB;<”½4sZãíX‘=§ð•hpqZM±ü×Õo¨UQñã• +M–®ž ­Be«Ã•:å¤__Ý^ýwä…þ¡m¨S÷*Z¥€·<ù9Ÿ1þ¬‹Â´êã/¶°"ÌœC f +$É!EqLÿ¼Ö:lÈy!Z^V–ØÌ„iDlWÁI2m­!’y›Ž0®ofõ®YW3q…ífÆ—ÓE:s8eaœ¸•‹Ò².Š{'9ü®´íú;ÕáÀf¯rŒj!0íÁ’ÐF7Ú°AûÔ ø7özæ?œgoÁp8b@cA"Ï*秥­ô>½ûþ ·00s’e!ж_´ãVUÃCy›ƒG&Ù°‡@5:'”Rˆ»’Ö¶ÈÏG%´{ŸÚS-C Gr«Éé÷Ä®ãÙ)¸`¾?R|”» +UOdÅÂáHl«‚žÙ†>´ÍýÃic¡þ!+Êd åó]GêäìXvÞYž¼æ~¤ÔW˜"„dÛq¢8‘;ƒAø&r\FiÞ!2¬†.§©ŸÙ™›ù¬Ïu½œ Å&Jì$!rR×ÿ©hk”á+ï„ÈoמD¼ÐË%¡ÊX–Ó™‚ÍWd| ”ˆè§% aAkè¤à™SÏà5I8!)DÉ”º!ÂIÏ0Íz†Ù,Ifôç°iÄкæϯŸû‰s_2@"ØŒnxÝøÛš\ƒàâÎÊÆ[ÄÞGZzì—LÊÊ…ü~ŸïdˆXïº +×p^Ó… +6œJQ†¼é,È›±eæs$¹*„RxÖ˜Ñh®ºZªÌÜ\‚êEÙW1Ž#,ä·ümÉ Òp€¼% N_¹Kr?û:5‹ñ¢cãDÿ@cµl4zvòÓ%g¨ ?ÃЮ“ óá'램ü“¨ jc3³ÊbÀ”¬YQ%ãÙàYÁÅfã^F²f'+[Q©§™yiQ2²ÊH2Þ>,± °cÏ­\¬ÿÄJÝVº áXœF¿:5 c&¨þÄÜÎ.azYç—*ýŠ}Oå‘DRž±Ñxý›¡ ¾u#&yàXñ€d2šª®¹5ù3r¯ÇÒÆØ_ítð Ýûtpýä;`DuºC éÁÏ¥¥9+j`Y¯—k¨Ü¡`kÉ™ó;X5âüȳ¨¡ª¸¦¸;øÁ}%·-a:0h–fà‚Áî> QÄ…4KÕ‚¡¯]cf姎·Ëõ ÷IäŒ)ž`hÒq¹\¹“É–0*b¢N/ÅKÏîáЛjwçMŽ‹Ç +YñZf5~‘+?²( ÃìžÅ _ŠS‚¸:“ŠÅí¥2Ãý³@Þƒ,iéôìzÐG Wîÿ ÁbUùTGçŸzö¨†ª”à]x”Ã/Y|ÔÁ7-¸ÅWøžfÃ~ΟóÚÇ+0CæÒÙÃ%jvÙŸ­b#cëÅl‘ü>ñ"wÒFÏÂ&Æc.¥=)´eO„R‡£8Õ‰S­¼hu¹ÿâòäóL–±{ÄœÚ  ÍRï`Ô",”"NíîåÙÎ{KÏÃãõ[©Kçβ³'¤4¨d7,ånÞQ©"²-ƒp/"Eëù—Ü@€ñêçÐ"b ÛÇØé…ª÷·gJ×Ü9å›Y1ÁHa[> endobj -4699 0 obj << -/D [4697 0 R /XYZ 85.039 786.531 null] +4792 0 obj << +/D [4790 0 R /XYZ 85.039 786.531 null] >> endobj -4696 0 obj << -/Font << /F64 3112 0 R /F66 3242 0 R /F15 2876 0 R >> +746 0 obj << +/D [4790 0 R /XYZ 85.039 766.606 null] +>> endobj +3057 0 obj << +/D [4790 0 R /XYZ 85.039 658.638 null] +>> endobj +750 0 obj << +/D [4790 0 R /XYZ 85.039 429.939 null] +>> endobj +4793 0 obj << +/D [4790 0 R /XYZ 85.039 394.628 null] +>> endobj +4789 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R /F58 3360 0 R >> +/XObject << /Im3 4353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4703 0 obj << -/Length 3279 +4796 0 obj << +/Length 1781 /Filter /FlateDecode >> stream -xÚ­Ù’Û6ò}¾BTÕˆá}<:Žc;O*I ’#±†"'$åñäëÓ@P"µ[µ[©X Ðh4úîÆøþó7Yìza¾I³ÄCSœî¼ÍV¾½ób' ; æ뇻¯Þ'ÑÆ÷ÜÜË7Oî¹qžlÊß·ß½ùùáÝ/Û]†Ž¹Û]šfÎû­ï|¿ÝùÎïp%pÞ|ø‘óË;Xz‹Kað‹Ìþøñí¿¾ÿðíöχîÞ=ª,ºý0DšþºûýOoSý?Üyn˜g›{®Ÿç›Ó]‡n…òÝÜ}ºû·ÁÅkцw-±@CìüÜ̓ø6›’ÄM¼Ä°)ð,6ù~à†~°IãØM¢”ø¬ \¸±ïúÀ£8Êw_Š&ÎÈ‹õç -¿_#Iê¼)Šjª’¿>Õ6ôa«aMHܦ{‚!ºýx‰î ãèþø 4=owAæt= Çs‹´HÉXð -á6MG0Å6H'„h¼€0O¸©Fþªþðü.T2bÁpT¼þ‚³G˜­pÐâdæÔ£ü -JÚÚ!I€-j5tÉPcÇPÃQõzI6ŽˆY )ª—3+Éy‡ü¶í|àUL\ e¾#BŠ‚ÈQE!AÄúä(=‚¿òX1ð,i*Ÿ™)°µ¿‡™(Aæ^lŒø^ý¡·óY²oAÔð1’X]¡5ú±óõÄe5,ÐG6¦ý¹²¯åtÿÏÛ8qTsF6…@ì#þÆN÷ß(À/+ 1Àx¬,ȔŪ*4×kÑ„ÄÇà…"œG<‹qNÄ•$`uϳªÆ -ÝHOÕ«±îZžÓ -q}ùš¶ŽZz¼éo>콄úPÈ.üX#+ pª˜LÅì9ñìKÝ4²OµLðSñz©OÄ»+DðºÍ"Ç%Åjm:¿ëNˆÀ œùÑÓÞbìúÚÖ}Ïu8-|Ÿ:ƒt¤‡Ÿ‘Üî,ÛÅuznføæ¸ç]Xl?á¶Ïy&3Ä#LwýIµ…,î§EcËhØÈlºönáÞ,ðpIk­í“6F–6fΓ¨"Ê åÁžuƒ?h³z4’xåiãMTƒˆÿ&á•îŠcN" (7ýò²N’0s#š‡“@ÂÉOç†.ù¬5¦ÚÙ1$q>‘t8Ž Ç¸ÒITÁñûšv­E—$LÜ0½ÐR´S’I4“(ySŒ=Œ®–\'ÊŒ<í̲'çUø´72§˜ËG%çuÏ3q ‹’$Üå½Þ,ÇPh%O®Dßn麶DI«ê^[ÆÉæâ7sÉZRxK™èŒ’AúJ‹Ï„:ïŠtžÜOÎéi@âýHTÄËä€|ʇÀo˜ Û5VmñÊÆ£×ÍRZЖ·ß98Õ¦®øÖO¼ e -Ó6üb‡Ïc½7Èó«8>G%ðÿ‚Ôc£5GœKR½±ÓJÖ(½ñXñ`5ô E‡ü¢¹¾®±\"k¡ÞÒçÕ@^/B“[ê-{<²]öx8ks Æ±" Ô "BÖÐâ,•9þÑ~Ç$U:HŽî(¤ÛIšl>bŽšÄÌH<ϸ­vw•ÅËÕ|ƒtÝŸDa†VÑÓÑžin9ˆ ÖdPÑ’×H±qPM :'ˆgÕèLöÚꮇǷ‚†?µ«|¤üa2tæê‚Fì…cSµœã=­%Q!~oÅO f= ˆ2ÏMò‹, ”,à׶þrÚ?¼ÿă·”®Tí(E&O¼ Uk¾¯Éï­årüÍkõ, J<×ËYW~ÍC ².ç ~ø,a|À¦Â'sIPOG{Øm‡ üfÍ—Šò oçQ°óô OÁØÐõ¯¼@»ÄAÀbƒp¬®bÇH-¤÷<‘Æ39dËÏÊdü^4³rü¦©FqR{6“­@ÝêY"Ïp0 a…]”6Ú-yxu!b@ÆÛWê‰áŒüu6#4!1}wºé!©ªúÉQý)Ãá3˜æoDXÙ!ØËÀsk5^`WêðAcÙ#è,ILÊÄdb.º®p¦kH“ŒÎà—%ȦÔ1¸ò¬×< ò!H}g¼,€|‰z¯¿ôõ(CŠh)¥ªøi¥3Œ/딪à”UU-¯Ùq-˜Á€âW+ž—ìg3vÿ‚qR¼{äKè¼¹R⸄[¹ì›J+Éún$¶ ï X"ñcÝ…â}ºì£èJ"¸UD“î¹Ê®©õ±M¿GÅO3[85NóÉdÒy>Xò)õFæ -²Öôš`õ7²ó+¶!.+ÍAƒÎ­d 6Vàd¨@qcë[jô-}Kµ¾ÁÀN…ïW«ÝqÖCöâ¾¾]­:2W5ð”¿Pú´ÃÂÄw#?ºéü-˜õb¹›%A,’ ö©¡àõ‚ñ(Ãð•Ì~mûª©MEñMÒ=ÚN¨Ãú§­¨éÒM¢Ô âìöM&˜õ8ÎÁ s_| -K4y¬+^éëá‰GåYV´Ñª„µîJàmÕ¨5Áw—»Lõ5)”7õn±oHY ¶+EYV­'–ßéÃ82ÏíEÚ|>U=¿xÂŒ~g—OjB€ãê·Ü–‚«žxæò‰XÞËéiÄ÷œŸUرM1>Û.X&××*ÕHI ;ø”.xŒÃKé«â¡~ÁJV¬Ÿ€–MݳL ü…3ÀcÅôP»kJL ÿÊpúቮÂõœÌ¥³…`­Zˆ'éoH;,ñ¤NÇ6ëäe`²#Ö$ú©&Án!\‡¸¼§w3š´ˆHQBAb=^!»¹zO|ë­Î§7†½´ŸÌ¤¢z»© ý—p|½Ð)%môŸ ‡3l@ï¸IâÍ=Ž ÷ʲL\ü‰YÒµ(9P!ÚT7S5œåÎsÏÌ.Ï:å Àí댸zÙ35Ùô‡,\¼¢eüpöŠ½¼0%þ¦¡©[v+Å{ìFá¢Ó†ÿ™¤ÿéOŬF¶›gÁ²ƒÀ |C 9þ0º¤837ÎÂ’ÿ¤ÃPendstream +xÚ­XYoÛF~ׯ ú" +°Ö»ä.¼n§Ç¸@šZ¢%Æ”èTbÿûαKQçK Úk®ùffiåIøS^b„ S/N"aBåM—éÍáäý@YŠ±%÷hþ˜ ίLä))R™z“ÇNN*…I#o2ûê¿ýóâvòîóh†¡¯1Çqâ)ÿâö~¯Gcåß¼çsܾãéýõÍå§Qø÷vãâæ’'_n®ÿæÙûÏHðéËíÝèÛäÃàݤ3·w!†hìÁ×oÒ›ÁÅ> ¤ÓÄûs)TšzË6¡0:´ërp7ø«“ÅgÚc®C¾qã@Š8öÕÅilÕ…;êÂ=uÒ+‘¦Á!MÊ"Ñ1(Š”Lܧ٥5B3 ñ~xÂHÚw#™Ä¡H¥iÇÈ@˜$Òîøüz{—XæmŒ:¡† ‘G ¢ÈKD +¿€‚Pj&‰§ãTH þ‘Ffð£v#hDOäiˆmè»ØرŒ7d-@-ªÿ–]iСt‡ïl‰´T <¤;O«Õ*Ÿ¶xkí· ¸onç˜Ö¿FAìWì’ÖŽ9‹lŠÇ Þ©ÚE^‹#éâÈ =ZÏz4dt§_õŒñö±!£8XÄŒNýK´¦À0M×McQ­ŽYb%œ´dCsÔ}¡2Tvß½õ˜òW£±Ž"¿Xd`£ÍJ˜–´1ÇÃØÿx‡£ñï‹Õ ñÅ.2ßLp¡yqÎ<”/¼QYS¤­–ÏkÔ’ ˆÙ3p‹”]$Q–IhSÖNÖ3á|^gK¦ÖyÆÂöTu\@fùc†êJÀ‹ÖÊ_7^¼ü . ä²gLFé(ñÑŽªÍÊWfïŒÆ‹Ù’ì,š¶ÎÚªn˜Ä‰±¬xØÇÿDÿåÎ „fmŸ•Œy®‰¼(óùÑ»AðYœÕ¯ˆíä+l§6R@†t^x¬ê%XY`g‹rtJ:^»°äÈv¶HB[OÀÍßÀÂDþÅz¨DI-f¦µÑ3ŽEF€Ë­D—Ñ0Ÿ‘s삨fö2(p‰ŠòŽ©êíü*Ê’gØOÜé´¬ø²Ô_h+£{¿òƒXƒØÙøëL€ZQèWs[OVVc¯•–7³º—½*DÀ!¡ÂÙÄB¦lÿd"Tê cEçõšüQÕC>^»ƒ¼æ- $æ.—¤a‰ÈGW=òØ™ <  } +êÏüš„[e½þr†6sH ì-P˺±v¬º"ƒ\EÛì舚Ë#w©!5 ¤€-‚­ Jñ“@å𸠴ýÈ$ó ¿W¤[Y]öÓ +½… › +2ヶâƒ'  QäÃæC?‹ˆ©z´Ì ËpÀ¡Î!C¦Øré¾C†ß™Ç•Œ!ãhaS1Fû/#Âkå«ë† Å&³¹BêbNÑjG¶8èNžµ™:T¿¶¡Í‡ºÕL Ë`ÑèžäŠZ&.·¶ Í“sKÃ=§íxÈ3³UãÚ€¬eVXE;w1Aˆª„ƒd¿]V, Å[VJ®æ7^pí=PK0ULl%™Äǯ˷4´‰O>X7$ûïÕ¾OàjIèá¼÷JW2‰IN©r$'u)x“‡*è+›Öü©ÐnºxƵ|tË ¯»ÒÝ=+ºf¼¦WSi_…}œçíôܽ ñÅqÆûeÞmñfî™R´—–£xdå¯TÖ¼ òÀ¯D«¥×£ÏŽ~Å ÍÿMÚÿ’¶©õ?}I'"MŽ|H›¾@Ug ¥V¸÷o&Â$á“ÿ!í¥àendstream endobj -4702 0 obj << +4795 0 obj << /Type /Page -/Contents 4703 0 R -/Resources 4701 0 R +/Contents 4796 0 R +/Resources 4794 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4700 0 R +/Parent 4773 0 R >> endobj -4704 0 obj << -/D [4702 0 R /XYZ 85.039 786.531 null] +4788 0 obj << +/Type /XObject +/Subtype /Image +/Width 194 +/Height 356 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 7021 +/Filter /FlateDecode +>> +stream +xÚíyL•WþÆË~‹Ö…UQ›Šþ Zf:¶àhq£¦NǤqi4í—vDÇÁÒT­CG¨ƒ±µ­H“jÜ2ÍÈÀÐŽŽuu •Š‚#;(«¿'žääÍ}ïûÞ ÷"×ËóüaÎ{î9ß³}Þï9ç弯O=EQe/zHQý)¢HEŠ(RDQ¤ˆ"E)¢HE‘"ŠÙC=¶"žˆ¡!EƒE‘ŽR4ÕÝÝÝÙÙIŠúQÕÆÆÆÙ³g»»»ÇÇÇ»ººµº   ** +ñˆ¹ÿ~ZZÚˆ#žyæ™ÔÔÔöövý¾áÅ‹ †ÈÈÈk×®YØŠ]»vùøøŸ:ujß¾}¾¾¾ÅÅÅ2YPP*ìææ6yòä3gÎ觯 Ïœ9ÿúùù;vL¿sLv»øµ¥¥eáÂ…È2mÚ4u6l@ï=÷ÜsW¯^u$ŠV­Z…,YYYè1u«•6×®]‹ÀÁƒ?ùäÒÓÓ-¡ÝuàÀз¶ââÅ‹eee`Üex„ Ê”½½½">,,L¿8ýxeøûï¿?w,­ÎÑñEèþD5ÐÌ›7Ï‘(ò÷÷G–;wîh1?/bàƒÎihh@ÁŠhjjBÀËËËòÙ¡««Ë(ììì,ÒÔ××c¤bbb†Žx'''ýâÌÆ+ØєeiuŽEp¡:ý)«1zôhG¢ÈÅÅYpk›ÇeÊžžÄ4g EFéû±©Q†“’’ÎÌÌü駟,)Îl¼NX«st(2ÛŸ¢HæHy{{# fs³ ¦é‘”¾w..Ñ9Zêêê ± EXr ÜÑÑaaqfãuÂZ£œ¡2¾—ÍÍÍúÕƒËr$ŠRRRÄj“—>EkÖ¬ALaaaQQ">""—X¥\¾|Ym¡­­-''G¹Ž²’¢ñãÇ‹5̉',)N?^?¬Õ9J‰úTTTˆËE‹‰^2Ù­­­¢Xd:EUUUØMà=6räH-Š°)ÃÖ [ lÓ°YÖMÄc÷„=îÁÜÜ\u¿ÅÆÆÂ8“⎶ž¢¯¾ú +Û(x€ùóç[Rœ~¼~X«s”úòË/áßPt‹È‚5²`od³RbJE5€“ã=/Â<^RRbÛ½Ãc~BbáºÅN:Çñž:âÖÆm‚mubbbuuõ€ëÀ½t0@ PçðÙ5EŠ(ŠQ¤ˆ"E)¢(RD‘"ŠQ¤ˆ¢HEŠ(RD‘"Š"E)¢HEŠìªn¬)r°á E¤ˆÙE«W¯5jÔ¸qãrss>úžÃòåËG<ÒÊ•+}:"}}}—,Y¢®ªV­âÖ­[çåååíí½wïÞ·ß~{ôèÑþùç2ÁÉ“'ãââ799¹¾¾^ß R½½½[¶l3f ’%%%ÉW\a³¨¨(,, yõ{Ò$Ïäåå¡t9sæÈ*™í™A§èwÞyë­·~üñÇ×^{ 1;vìhkkkmmÍÎÎÆXHãéééׯ_x~øaLLŒþMNÛ¹sgDD„º¯LÚ;v,†‘øiëÖ­jƒú ÔÅ!MssóÑ£GœœDøرcÊh]MM 2âöY¶l™¾A¥,0ˆÊ`ˆ•MËÌ̼wÔéI-Š²²²P%dY¿~½¬’ÙžtŠ‚ƒƒëêê”1AAA€J„q;È·€•6ÑLå ¨e¡üƒ¾8 ¥O0’Ù&‹SF",¿á ¬FSS“ŸŸŸ¾A¥ÂÃÃei5ÍžÔÊ~÷î]Y%³ tŠ0ˆâåzeŒøLÁÃG%P~ÁlÛ¡›7obŠœ2e +:A¼M¯Ÿ^^~ýõ×±±±(}Ò¤I%%%ꪚL`¶8­°2í•ÍÔ2¨+;M«iÖôdww·Lo¶g¢€€`¯Œ ”ØÃ9+¿-£Õve—FEEmÞ¼ùÂ… pqp–S$ç_XXèãã£Ua£f‹³„¢––é(´ *…ÒáEÍR¤Õ“ð‡â;:Ù‘ÙûÔ3ƒHEkÖ¬ã½uëÖ믿þðÑw®¶oßÞÞÞŽŽ²d6Ǭ}øða ´§OŸîêꪭ­ÍÏÏ·œ¢>ø ªªª³³óøñãXê««j2Ùât(*//GF è‘#G–.]ªoP©ÔÔÔC‡!Í•+WÒÒÒ´š¦Õ“p){öìACnܸµ“2{EEÌ666nÛ¶mÁ‚öÌ S„¢O°‰ A“û±³(..ƶ÷v@⛸_,°‘±œ"T{¸ñ©S§ž;wÎäØ©˜-N+ ;‰‰‰Ød¡Ú7n”ŸùÒ2¨<Ìܹs±“š1cFee¥òãÊdZ=‰m)¶¨¨@dd¤ø¶›Ìž³hæ¦M›ä· ÌöÌÐyví‚Û¿¿tŽñ‹=6‰¯Çxzz&''ß¾}›Q)¢HEŠ(RDQ¤ˆ"E”ýSDQ5¸¢O6Rsss\\œìŸ%K–È¿šQTŸ +øì³Ï<== Õ?„‚ƒƒ+++ó÷¿ÿ}Ø°a‰ê7BB‰²!‚DÙ!‚DÙ!‚DÙ!‚DÙ!‚DÙ!‚DÙ!‚DÙ!‚D„l‚A"B6Aˆ !Z&HDˆ Qö€A"B‰²!($$äÿL)33³–_}õU“Ö|}}yBÒÁúùÏnöÀð¯ýë~ŠŠ2k™ 9€jkk+tµuëV+):tè~ ™áØúë_ÿj%Eÿþ÷¿Ù¤ˆQ¤ˆ"E)"E)¢HEŠ(RDŠ(RD‘"ŠQ¤ˆQ¤ˆ"E)¢H)¢HEŠ(RD‘"RD‘"ŠQ¤ˆ"E¤ˆ"E)¢HEŠHEŠ(RD‘"Š‘"ŠQ¤ˆ"E”ãéÖ­[/½ôR‚¶ ÖP4mÚ4ûóæÍkiiá@<é*..vuuˆ/GGGë›=zôùóç9RLLÌSºtéR?Ì–——«M8q"0096HéééWJGGÇË/¿L„¢ $"Dˆ5¸ !‚d%HDˆ Y ¢¬‰QV‚D„(+A"B”• !ÊJˆe%HDˆ²$"DY ¢¬éÁƒDˆ²¤ÐÐP"DY²POQ”u"E” )¢O¦ú=‘‘"ŠQ¤ˆ"EEŠ(RD‘"ŠQ)¢† EZ5´‡šÛsÝH)"Eƒ;‚¬)Ò‘–––… º»»O›6M/»víòññ >uêÔ¾}û}}}‹‹‹¥©   äuss›>^=²¼n¤ÈÞ(JOOG8++ ê¦èâÅ‹eee€ž0a‚ÒZoo¯ˆ Sæ½zõê ê:¬ZµJ§\ýº‘"{£~á;wîÅËpWW—QØÙÙY¤©¯¯Ç@ÇÄÄ >ñNNNFy›ššðòòR×Áßß_¿\º‘"{£ÈÅÅaøÑÔ +'%%!œ™™ùÓO?™LÓÓÓƒ&,u,)W+ )²7Šà(nnnîEX± ÜÑÑ¡•¦®®u¼½½ñ“ø~µ–}­º‘"{£hÑ¢E^¾|¹¯?áï¿ÿþĉê4mmm999Z¯Ç¦¤¤à§ƒbù¤e_«n¤ÈÞ(ªªªÂÂ^kà¾RôÕW_ùùùa94þ|ušØØX˜Õú`>ÊÅÎ N#GŽ´¼n¤h(ÈòÀš§¤¤‰ÛCŠõ"ø1¬Ÿ Cbbbuu5"E)¢HEŠ(ŠQ¤ˆ"E)¢(RD‘"ŠQ¤ˆ¢HEŠ,i‹V +W®ÔúI¶=??Á‚â°+ÔÝÝýüóÏïÝ»÷‰k8) ŠRRR***L&V†_zé¥íÛ·‹ð–-[fÍšõ$6Üa(‚µuëÖyyyy{{ãv~ûí·GðçŸ.Ó„†† ñ^ØÙ³geƼ¼<üäáá1gÎœúúz_ZZ:}út$öõõ]²dI_)ºqãF||¼ô3ZUWWûøøœ;wî»ï¾óóó»uë–º `cÆŒAå“’’\\\¤¢¢¢°°0T—÷ïß_¾|ùˆG‚'|ðàÉz*+Ù†«?ôªUîJÑÖ­[›››=êää$ÂÇŽ‹ˆˆ0J‰fîܹSÆ‹—¹jjjÚÚÚÖ¯_¿lÙ2?vìØ“'Ovtt\¿~ÖúJþÍÈÈØ¿¿>EÐ_þò—qãÆEGG5ÜÂr’"¸…Í›7_¸p¡®®îÚdgbv Tš…—.,,ÄÒE]"<¿òåúÿüç?ãÇ7²‰Ñ·ß~û­ÎºËóçÏÿóŸÿÄBî‡~P„Ò1_˜¥5— ‹axcñ6œNö>5•Tk•ëaá}úôé®®®ÚÚZl±•‰Íâ·mÛ†­·ˆÿàƒªªª:;;?Žu‹ºDܳÉÉÉ yñ/ÂH©®ÖqqqZÕKLLÄZB„ß{ï½™3gÊûZ*55õСC(åÊ•+iiiZ­]»Û½ööv §\ŸÀ¥ìÙ³ Á‚këŽÛçðáÃ$­r’¢ââblgà~±ÌÀ–GÙ™ اÀ'lÚ´ ÷ ;ÄÀ?O:{(“…~üñǸõ`÷cAA–ÏŸ;w®ÉçE\%~€bs´{÷n£Rp§Ãj8cÆŒÊÊJå[iÊdZ{¥²²²‰'¢!‘‘‘âËV6=‰U\¶À¶G{rŸ~X.LLØôI§1tNŠl¢8OOOÌ›·oß&Eü;EŠ(RD‘"Šz‚("ᤈ‘"RD EZ§b´ÎéFBñ— äMNNVþÛ¤A¥ìê8)ê“ôOŨÏéFB‚ìììššdÌÍÍ•go´ *eoÇH‘å2{*Æä™"­ÃHʺ555ɳ7Z•²·ã@¤Èr™<cÉ™"“ae$f(yfFË RövˆõUF§b,9Sd–¢––é(´ *eoÇH‘å2y*FçL‘YŠÊËË‘zäÈ‘¥K—êTÊÞŽ‘"ËeòTŒÎ™"}Š`'11›,lÜ6nÜ(iTÊÞŽ‘¢'Z<DŠ¬‘"ŠQ¤ˆ¢HEŠ(RD MŠ(ªß"E”M(¢Ôºxñ¢øï†###kkkÙ!T¿òðð H”5Íš5ëæÍ›@ˆ QýFHüeð$Ê„„e%B‰² B‰² B‰² B‰² B‰² B‰² B‰² B‰Ù!‚D„l‚A"B6´LˆA¢ì!‚4trvv^±bÅ›*õã?îinn~Ó”^yåq‚” 9B~~~úg†ÅÿæÓW·cö(òĉ ’c(??·¶rrr0Ü^^^ý£hØ°a»uuêÔ)ÃKÀÐoŠú‘‘"E¤ˆ"E)¢HEŠHEŠ(RD‘"Š‘"ŠQ¤ˆ"E)"E)¢HEŠ(RDŠ(RD‘"ŠQ¤ˆQ¤ˆ"E)¢H)¢HEŠ(RD‘"RD‘"ŠQ¤ˆ}H‘"ŠQG[¶lyS[K—.µ†"ƒÁ𦮾øâ cx›èèhýÁúøøô"}ýêW¿¸okS$ñ1sgg眜õ—`óóóûj³½½ÝäGeáBúyvjpAЙ?ž/üS "HDˆ\ˆA"BÔà‚D„’• !ÊJˆe%HDˆ²$"DY ¢¬‰QV‚D„(+A"B”• !ÊJN:E„(+Aâ‘3ËõEY'RDÙ"údªß)¢HEŠ(RDQ¤ˆ"E)¢HE‘"ŠQ¤ˆ"EZ“1"|ôèQ£Ê_eú .¸ººN˜0Aœåèíí÷òòBùôôtK(ºzõª€áÂ…"XâR«>¤è1PôÃ? 6 x³A¿üå/‰{_«P$¸sçŽÝÝÝ"&001€­¡¡Ì­–P„¦`å7láÊp™™™Y^^NŠ…"(//áuëÖ™¥¨´´ÔÙÙyøðáˆ?~ü¸ÉB]\\ð+–ß:<¥ìééA@Ls–Pd”¾°°0$$10xâÄ Rd[aõ‚ +tuu‰Kp9jÔ(#Š0(qqq‚o¿ýV‡¢ŽŽÌp5çÏŸú駱ikkS*^îhii1KQ@@bšIé‹*.Q+- uuu€¥µÿþ÷¿ˆôôô$E¶¢¨€¼=«Sõ T¬‡§L™¢Cц p‰5 Âøäû2RJJŠXí`òÒ§hÍš5ˆ')**Rîø"""pYVVvùòeµ ›““£\G }óÍ7ˆç¤È¶ÂâäùçŸÇ퉅è‚ À¥|;Õ¨nï¾û®ÖbX&zwwwì­>ýôS_\\Œ\„˜ôÑÛà;šô¿ÚnmìV°“š1cFee¥òÍKöSØþ`+„™"22R¼-³‹Wì±ÄØa5Û§=šV?he1jµEZ6D(zï½÷àRÔ&¦ýû÷›töôxÈ>/ŠŠŠúÇ?þ1@và¦àL<==“““oß¾MŠþÙ5EŠ(ŠQ¤ˆ"E×(;\H;ðM:¸¡Dù'T£®®­­]¼xñÈ‘#‡ öòË/ïÞ½[?ž eŠRRR”9”uxá…Þ}÷ÝúúúÖÖÖÓ§OÏš5K?ž eŠnܸ/Ÿ<Ë:¸¹¹Éo)¥odöäÉ“qqqƒ!99Yy(44‘02yòdù•Qõ%eWdff~üñÇuOò˜<ùƒFmÞ¼ÙÏÏÏÃÃ#!! è&##cÿþýFMŸ>}Ó¦M¥¥¥ò›ÀúñFf³³³kjj°$«±o߾˗/‹°ÎI“'þøÇ?þîw¿«««ëìì4ú~ )²9EMMMQQQÂcÈ:TUU-Z´hĈ®®®3gμté’~¼ÖÜã&$yˆB}`IXÀÐ+Yµä$òäOXXØÿþ÷?Îhm3õÑG½ñÆê®Æ¤píÚ5Ì)ò×WRÊ;7oÞÄÌ5eÊpåîî.“©,á'xžÊÊJe¤…'y”'”#&EMQww7WËíÃo`)by¼ÒHKK‹<=‡…Ê… ày0ûÈdêKøéoû[^^ž\ä<´ø$¼«Êþ“¢Çð`G¬‡eLbb"¶`˜ €ÁŸÿüçùóçëÇ™-//ïêê*GŽYºt©ˆ÷òòB^Ä×ÖÖæçç˲Ô–äO+V¬øòË/EØ“<òrùòågÎœ—ƒÄÒ‹=žÇƒØøȬ~ñ‹_<ýôÓXýæ7¿‘û,­x£©°ÁMaé²qãFùýüââb¬U0…‡‡c,Ë2:°¤¬8|ñÅßÿý‡Ÿä‘—Àcƒ³»ví"EEŠ(RD‘"ŠQT_)¢¨~‹Q6¡èÿ +¾ œendstream +endobj +4797 0 obj << +/D [4795 0 R /XYZ 85.039 786.531 null] >> endobj -886 0 obj << -/D [4702 0 R /XYZ 85.039 766.606 null] +4798 0 obj << +/D [4795 0 R /XYZ 85.039 763.817 null] >> endobj -4705 0 obj << -/D [4702 0 R /XYZ 85.039 746.481 null] +4799 0 obj << +/D [4795 0 R /XYZ 85.039 763.817 null] >> endobj -890 0 obj << -/D [4702 0 R /XYZ 85.039 649.92 null] +4800 0 obj << +/D [4795 0 R /XYZ 309.595 461.859 null] >> endobj -4706 0 obj << -/D [4702 0 R /XYZ 85.039 629.326 null] +754 0 obj << +/D [4795 0 R /XYZ 85.039 385.056 null] >> endobj -894 0 obj << -/D [4702 0 R /XYZ 85.039 494.239 null] +4801 0 obj << +/D [4795 0 R /XYZ 85.039 342.771 null] >> endobj -4707 0 obj << -/D [4702 0 R /XYZ 85.039 473.644 null] +4802 0 obj << +/D [4795 0 R /XYZ 85.039 107.434 null] >> endobj -898 0 obj << -/D [4702 0 R /XYZ 85.039 361.414 null] +4803 0 obj << +/D [4795 0 R /XYZ 85.039 79.729 null] >> endobj -4708 0 obj << -/D [4702 0 R /XYZ 85.039 340.213 null] +4794 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R >> +/XObject << /Im7 4788 0 R >> +/ProcSet [ /PDF /Text /ImageC ] >> endobj -902 0 obj << -/D [4702 0 R /XYZ 85.039 176.513 null] +4806 0 obj << +/Length 1960 +/Filter /FlateDecode +>> +stream +xÚ¥XYsÜ6~Ÿ_1ë}áTy(ââá*o•bùP*–KŽw+É4¤Ft8à Hú÷éàPJNyK%h4Ð>¾nHÌ#øóÔ„‘ÊæI‡F‰ùj3‹ækXy;ŽcéX–#ž.fGoL<Q˜EÙüâj8'‹B“Åó‹ü×àÕ»ã¯?-–J©@Èp±L’4x¿ÁñÇð÷t±ÁÙ[^Gò9¿œž|XÈ4øâÇg'<ø|vú_½ý„ ><_ü~ñãìõÅ îèBB)TöÏÙ¯¿Gó.öã, +U–Îo`…"Ëæ›™6*4Z¹y5;Ÿý<œÅkzλ¦lcTšTG˜‘qÜ^ 9OŒ cu¾Ö×på-_ÇnsÈ`ƒ6±ÍÝ"ÕÁs^»Ã›Ö}ób‹Ó®½wHÑA¹?æ¨ÀíÝêhÝÔ=wL¾)«ŠGU½Xâi¸)îý¤/ЖGoÔXu¥CÃý´ +cÅ~ÍëÍ7/n_˜H¾øZÏá*ÛçÔzÚqœ†*ÑO׈çÐ~®©áTB……‰(S“>)Íó<-λk,ï½uÆìÀd×e˶ÏaR³Ïp¸aê½S÷~Cí¾×ž¸-#Ïç›rÛ>ã zoÇñp‰Î¹crÓoqíZß;S«zÃg"K>åÈèž›ºîþ½Xi‚mÑñ€Änðž8³yîÖ;Zx‰jÛrËÄA_œôÛò–y84Xºx\ú«b”ÖE_Ë$Ë¡Ë ‘N+álk”xÝGϘÝ6îäm±BrA‹-Æ&‘qgïXØ1ðÅDDšŽ‚vgWn¹tÒÈáŽ6x& ¶vSP âÝà„¡«WmÍ.ÙXŸY8kûÆI‰‰Š.n‘í¯/^Êrƒº•_ccË× +:‘×É£ ÛÊ… J¹¶ÍpPW8\ù-2ÑKø#øNK™„Rn©¢0J±ÎjÜ}Ã'}e=t8¬"êõj¨®yÔRÞQ÷Rh”ã«ôÎ%¸³]Ý´ÿòý"ÀdÔëâW™$pì8Ü1̵my‰6V&f›Ã8ìÖçNšKÜÞ5)@qµFÞéÃ!ö~!Ãçl§ÀÙ…æÁóÈ(ºeÂð Ç3€pµÀ_"Ââ(¾tF·…°*)ý39R&Nay…‘ƒ?*fŠ`œbœv°RP£c)‚7‹TuÃkÅ­Ýìª<¬#0òS]Uâ iÏÊtEÎ42ˆ!§®ª>wá$;q­ s +J2J¸ÍŒ.jWF*³ÓÐ’ü9F%^!ÓOL¨ï¯SL:†²h¿EBWN=0;]ȘnMénÕLž6Ø”¥.6 8ý’dæÍh”2eô–ÅqâÄ{sàÉ /T¹OSa0ÖH®)1ʆuõÉŽsŒ5uŒûîà~‰AoM•\ÕUÅ´Í!¶=¼£RlË«Øî¼z¬ÇøîÒÔ”ùKEуBu¼Z$v&Ê®VÝ7ËÓp-2漇uàÔÁæZ¤l|:=áÁŽÑ•£¡ó1 ¤Në%F2u[®‡PÈ™®$/ ùyŒQ’‰m]4^öHÂÉkÊâ*gyÛºÙتbÌx:ÒÏí²ÝaÄ¡A’(xçßc©¡ŒÒ];ÄÕQ†®ÀA +‘<}Û1™J™×û:×TèKd¿)á4À 'lN¤r3N gyÚ·ÎÆ€¬õ/ˆ^EH7÷±Š;È`¥S¸œ×¼vÞP©‚ +Ù¦Š†ÎgTwnÉûlÇ™¾Í)©1'R—À5äŒw¶mÙÉáI—  Ü(PËÛ÷Ð +®“ÀÝ·p>¢`–">ë ï0‚üò_ƒ“_5ËÚuG¸^_êÔ¹×@5]gP3‡ »1  €‚fßíq_4ž^Ù®ôaQÝΕúCÇ0G(øì¹$èÑ::®?ážH&ÜŒ`é’¬NŠï̽ToLŒŽé׉’:ÔB=ù:ñÐsAª3̘áé+³ ¾Ü*ÁÞ»"è0¯aÌeá>%HCAµgÝ7l§ie‡ y1êµIb6¿ÇArS\ù‡bç^¦ûg1?XY'4Têšs|öYÃ;».`j5‰¿ð˾ù¿þ‹7€¤NÃ,}#ȃ2âЉ=ÐØÿ»ïPå¿0t*7endstream +endobj +4805 0 obj << +/Type /Page +/Contents 4806 0 R +/Resources 4804 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4773 0 R >> endobj -4709 0 obj << -/D [4702 0 R /XYZ 85.039 158.039 null] +4807 0 obj << +/D [4805 0 R /XYZ 85.039 786.531 null] >> endobj -4701 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R >> +4808 0 obj << +/D [4805 0 R /XYZ 85.039 695.473 null] +>> endobj +758 0 obj << +/D [4805 0 R /XYZ 85.039 324.413 null] +>> endobj +4809 0 obj << +/D [4805 0 R /XYZ 85.039 289.667 null] +>> endobj +4804 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4712 0 obj << -/Length 3601 -/Filter /FlateDecode ->> -stream -xÚ¥]sÛ6òÝ¿BÓ'j&bI‚Ÿ}sl'v/±}±r™›¶´DK­¢J—ŒY°úEÈjÙ¢br¥fc6rŽ«ªÍIÁJ%B›4k…ÝóÝ XÂM˳$2¢o·ä'¶5yj¢â;¼/LgE¾ÉKC¼]Ë€}h®¹2צîðol=ÕÕF³ÄŽ£[™r‡~(Q›6ÏÚ+71X¹!ÉClÀø@eÃâ­á£ÛîGµ5 þyf vª›¾fÛG³8${Î9Ò<ÒM‘`„s\¤[Õ-ú¡2×^©ÅÃGŒÁÆcghÈÃ$+ÜÌH -°f Ñ>’WI`Gž2¯èáO‚rI»ô'’ôç=iûuŠ‘Šô.ÝiüûN× ™úÚ ‰ÔÇø–íNòÝáχ‚PÙ‘ãßé푳ó‡bGn’BÙpóëÕ'”(;T!ìL1zóh/ªò‰ñú‰«Xð¶)^”£SKöôÁnb‹2ùŒgMÀbôXljCD·¾ÒÌò…[—.:w0s}eû‘? W½Hl¬+P”°Â4(q_ß»40eüL›\TéJ¡2ä'§ž›"ìZû×êî&Lö•@Ü.,]f:®o\Ü’gÍå z7!ˆÍGlNiï2½L1 -Ö9ßT¸6³Txƒ¡Ç‰ß¸­ˆ¡9nòœ£ÈEvñ¯¸ -ttÐDc•¡r}'é)—|‰ï…|’8Ç®<ÚJ@”Ì•Rù}r:3òRÑ(j2¡DþFœÐtR°³8ê²égƦ##¨„=6Ã\ ¦-îÆ]¬Eñ\ÉÛø¬…‡üI–kk‚e½óOÄÖ…ó²’ÝáÇ0Ê[N<Oš²§žÝ€—"ûÆRÆõõéû‰$G¾Ž?Ö§3ÙLçÃÓè.‚ÛE`Êb_ñŸª~f¹jteQ¡Î_HÉ6ü%[3VA¡½ã{F'‡Øc'ðÞÉÁ×B²¿C…ôR¹µÑ#f‹Í˜Ýµëj75ßìjühïjÃÌÞÙ„ÏÀÃh߀³LÇœ€®vbe͵ªIe>æsB’EêöæiN£ºËdìVl;Qk.ÚÆ+Äw -FAbKYÕ)§§”êv‰uÒ;ñd/ߙÊ+)N­zEÌ&Á+kY´šrÅX\³SdŠ›Œgøt?æœpÁÐ"À#»ÙLµ(¶zþâœ6®ò¥$ZZH0ÐZ@tZ3ÊãàN¸‚Hª. -.©Á9þ¶ÜuPöUlGa2Ý5ά‡Äá½ß¼r½Ø£ÐPBÀª¢ƒ•o»êô†Œr¸ß P‰ÄÁ`¿½šè91øʇÉÚaj»Èü­ÌÂ|·¦þÒ«“Ë´¢JœŽÇ>ªw/°=ï µœZgœ·”~b7­ó½ÍFUÞmö0ð  ‚JT½+É ׋ÎpËL{d énŽjÆuA2÷ ÕtH't#Ho)çÔ†Z;ûûª§·ßùDò$oKzÉÅgpÁIÚAÁ$pÅz¼’ä¥ œãé¹J õŽOwU{8ÇË -{vìwUc)+Ή‡ôÓK®0…w1”™öêŽ1oã -Ì¥–¸Óp™h(2”‹gŽ€Ú=â§T–¤ÌÓµgUìØ‘zCÞçx9¢BÏöBo¿ñ}Ïâj›tT’`°ú'Šxƒ*ÒtCaק(^Áªá=¹ÄÀwpôÝâ¹L¦–Pèw©0»jìøÔ†éú-ÿH;ꔄŽNº‘Ýj×0lKeE?PS_*“iŠ-©rŽe?‰ô¬{™s.U­j¹ŽCI˜)¯ébw"-OÜ -û+s«$H†Mä‘$3ãx­³;ÝÜ cÏš›¼£fÂ{U¡–º‘ÙZõ7—²hÅ'Ë’cMázV·imøk©%§;±„F¢á ßl‹A#C_œ”Þ‡N!„*<`6+g‡ÅÅ‘²·éuQîœÝO±¦žô’!Äëó@w‚{˜í!t[W\±‘òìªÀ¨7Þ/¹…Ÿ.Aü ŽEý/IyFJëÓ¼•žotGahÌ81BW¬nIsݾ!éMáÜædÂƇiìSŒó@Óûy^¯^=ÑCJÂwµóú®68 ÕA÷ÎÒ=ÐE„£d5&Öh¸O;°b\·MÙYö¶÷°ï#*C”š&¿£Èë.– —Ü”8µÛuäö2P××¥KÛšôÊ¥‹NÑ`¥™è”P¨aÓáüªhXuÙ£°oüH ‚À­°.{á7 -Wº ½€`ý·©ëº©¸„Aè:+¶²[ö£åW!G«²Š’Sîg;«\ -ä—Ë;xÖíÝœ!×ç·¯8¿¾y`è=ZÒù—óÏøbËO¼ýzû ¿ýßw_ïúõ9 ø/ é…ŠŸ|Ï/ñÃç‡`„~½½Dø—‡ùÝ€æײâá\ž¿PK¹ÃÞ6¾ó§y@¾¼²‘Åk4`Ožsp«“vƒc1çÅ´Ô¶C=_GO·C{8Çó²®À öò–Dò–Ï967¶MH>.jóŒ_×ùjÍùÇùKŠf[¤Úy+ifŒñî$¶Šßà½Ã9žƒ¸ €8a¤ÖGó“MÞÇT¸5¿u¯qQÌ/#Ä{„ͪV1²çµÓòÂDÄ~ó½]JóƒYv—«z@‰aH -Ú¬Ô»Ó ¿MTŒÜ±‹ªsÙô”>‡xÏW½¶ÙVV6¹Ž¯ˆ·0¯YXhõª,q}øz] .ÆY}Eû±Q7¡p;tNˆkz…æ‘RSᤌèMñu‰Ùnzü.*ݯy•¬Ê2[´ùK§Ì0¦æ[Ÿ´ÁQ¬"ãñðÕÏ'2xOôZTôºÚ-öø¤àt1òcÚYÖõãשÑdŠ[‰‰¯]µÓO辶B¥ö9!Ž l$„íÿ¢@Eî°S9#J¬y¢×£æ§a½¾¤TÿÃ(šuÞ<óˆŸ[’ƒ'[ZoòÞ¬®Qî­ÌÑ[‚t g‡¡ª÷³,¡|~»LÛ'þ)„r‚Ak‘ûÎ¥d ðsÁZf½tŸT•ÕÚNzï%¦òWÞ\Ù"8­Y÷ûº€2¿¸çA[§æF™N>Ou×îıçR¹Öù=~ðâ®MíÅñ^ˆ(’| FÞ»òh„õŽòãâ¶&Lúy ..œ2¸×ÅÙý‡L„=qØ8¼Š89ã?)ÿ)³×>~.0|S6ƒuÚ‰v±r’75¦B~Bvä þ’¯¬…†¤@4þFM‡¥.x_uËÝÙë­âCÇÀ–‰®¹™ä#–¡o!±Á¯3A\?\;Þ"üVg<‘gÙðLR†³»P þìB¹#*•è7C/â_P4Bbï6³¦`sù¥þ4æÇ^!›;&íÉ‘ŸuoøˆÌ c-ódº—cvlj˜™8Ë– ȳGÓJI”>öšŒbžêaºÎ¾ï(+ýMf FVKyz,‰Síó÷ó øŸü¿~\h²)?¶“øHw2ð<Ûs 3”ª`Ÿã@Åv«–ÿ ÓAçendstream +4812 0 obj << +/Length 1680 +/Filter /FlateDecode +>> +stream +xÚµWmoÛ6þî_áu 5-Šz ÐÙÒe)Ö$kRt@[ ²EÛBô6I®`?~w Æ©Ñj”Tõ¸kUØkÛäë¡ ¸Ï<ŸO;;õÜitwçкY —}¡‚^„Xº"Vmz>ø6sƒ!ú®jÏ1ÀT^K#?þ0_ÄÙ|Òî0Hoš…+i9Æ Þ5TŽ¡ “ +Åmgk³¼L±  \ÝWµL;Úak$ÏÖ­kT*Ué¢N‹uY˜æ€_àÇ:Žž\†5©Ïe½œwœú§ÙX}{]åV[˜éŸ?Ñ+ñq’‹|§ lÂl-àÉ´Êé»Û4®îôÌ.ÌôˆªÈÖ¿º¦ïÛ8‹ò]¥Êz——·-Ú2‹ú(.‹a@ö¿Ù"¼è*P*Í.X•l¢3ïà9ÊçÚ¥Ÿ{›ÀRÖÛ2;àìü”„P~—o“¨›eÉ=ýÚ„E!36p"¹ÜhðŸR¾ôÑ’w±>µ9RôÇìx,(yüÛØ^Ûy„ã1*·£j8Tâi7]Ât)Á®­»#TzIe¾Ô½¡Û<êfa¸ ÆšŸ„—ŠÑèNªÖìp‹YL¢ÉF¢éÊ­þ©9ñ‡žOA÷©OR·V·UŠB’üœ>sÅhê^!´ d.´eaºÌ#2û8â‚YÞÞ­YÇØ@á.ó}»ÝQU¼çR(±ßÅ/më3~ xê˜þ¡_Dw¼¹¢"Dàv"œ¶¦Æ7óOë‘l·|‰‡½¸—§Q~g¹&Þ~g5ü® ;6Å]i¾4ÐExmhæw¶'v¯à’cÝñØ$ô½Ç½ÞëŒ^/Ë +àz åõ9T$+ð)éK’åÝžšZA€·Â'Ù‡2Ô½F8K¬/¢é>ø”œÿ´Ï +ŒíŽµüEuñÂDó|ÀáÉëwà·<N‡nfu¨‘$ƒY¥þ|L€DÚîà嶤ýh+z¸‹“¤ãLûÔPô›¯ùLXð6÷ÝU—Ò-®cõDkžtH|õOïÈÅKÜñ¶8‰tÔ¶´Ú³;ðÎu\^$Ÿä `I¾ó#®ž?Ëà5dø%—´ŽIáÑšqH)¼¼™+¼/ ZÐÝ;d) ußNó(^éV—Õjîù“Ó< ã¬áfiœUš³l³øŽt 1pb -~íFo*Yö÷ÙâèwÜål+«zà8ù"îû ü¿l£Š«º ë|à$ež×ßxÿ¢/†å+l_w˜úe!Gà>?J‘à-/†’véû0$žuþH w > endobj -4713 0 obj << -/D [4711 0 R /XYZ 85.039 786.531 null] +4813 0 obj << +/D [4811 0 R /XYZ 85.039 786.531 null] >> endobj -906 0 obj << -/D [4711 0 R /XYZ 85.039 766.606 null] +762 0 obj << +/D [4811 0 R /XYZ 85.039 766.606 null] >> endobj -4714 0 obj << -/D [4711 0 R /XYZ 85.039 748.602 null] +4814 0 obj << +/D [4811 0 R /XYZ 85.039 742.055 null] >> endobj -910 0 obj << -/D [4711 0 R /XYZ 85.039 595.724 null] +766 0 obj << +/D [4811 0 R /XYZ 85.039 686.204 null] >> endobj -4715 0 obj << -/D [4711 0 R /XYZ 85.039 577.25 null] +4815 0 obj << +/D [4811 0 R /XYZ 85.039 652.065 null] >> endobj -914 0 obj << -/D [4711 0 R /XYZ 85.039 394.285 null] +4816 0 obj << +/D [4811 0 R /XYZ 318.781 616.398 null] >> endobj -4716 0 obj << -/D [4711 0 R /XYZ 85.039 373.69 null] +4817 0 obj << +/D [4811 0 R /XYZ 85.039 359.561 null] >> endobj -918 0 obj << -/D [4711 0 R /XYZ 85.039 225.054 null] +770 0 obj << +/D [4811 0 R /XYZ 85.039 287.376 null] >> endobj -4717 0 obj << -/D [4711 0 R /XYZ 85.039 202.338 null] +4818 0 obj << +/D [4811 0 R /XYZ 85.039 254.557 null] >> endobj -4710 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R >> +4810 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4720 0 obj << -/Length 3962 -/Filter /FlateDecode ->> -stream -xÚ¥ÙrÛFò]_ÁÊK -‹08kŸ¯U¢XYK)oU’I¬pÐYûõÛ× AÇU[.‹ƒ™žžžž¾g‚…ÿ‚E/}•/Ò,YÆ*X¬›+±ƒ‘®¸æûÇ«×ï’høËÜÏ[ƒ'÷—qž,7¿yoþùÝ/o?\ß(¥¼ Z^ߤiæ½»¼Ûë›À»{‹#¡÷Ýû`#ò>¼…¡78tÒ{wÿæ§Û÷?\ÿñøãÕÛGC•Cw Òôéê·?üÅèÿñÊ_ª<[jÏcݵ­Q$QÒŒ’&×T4k ùÂŽu_ÖÖÜI2´ÛóGÁ<Ó +V¸r s ó…¬ù³êÉ&5Žº‘ýLЖ¾Ü¢¥“5ŠqtL¡gØwG”È Z›»Êžx{ÑÛf§ê‚¢¡Ú•wÖÔxð¯·+BHëËu¦PÈcÀ»æЗ Kƒ¡#Já¤ÊÅ1#ù8oßÆK#ও“ÂÖ@„á…ÎÍKr¯ä\­´\ð\"b¢×zíZJ/Û‰þ²ôµ×¦}QÏ—â­$ˆ—„J_ŠŠ‘B–*J(F -Â¥ -ÂEœçK ›vŽ£è £Ü{(š…J©wç©ÐV)Rx°G8T´"d1¯É«!ä[4[?ÛýoÄEÂŒ¾«/ì¢U - ¿´#f&êÓ;J£%„¸¡{4:ò @¸XiqÜH86wçp|„²<Òô|$è Y(ŠùîGÛY‹ÝˆEðS|wmYŒGc>‘ù¾ïÝŽîê!»SåÆ@%BóÅY«œ1£óñŸ -r…ìˆHÁ¥Ñ*8ïv]nd°åßFÜ ƒnˆ‹¤G-¸hÚYN˜4aM=!‘é˼¡š£ »-s›²BÏ7Ç!™å¶X“YšY‰{·†£d¬úý<¸®¯‘œ¶3+98 -M áÈa}L9@lËk#›°‡ƒ7üHJ³!-²òt¾=×ÁGYª€Úlˆž½¡úÙ5p¢‚n4¸½æ~B↠½Á/GoÐ(øç@! ñc]ôlœ©¿ïHŒÆpŠºËº2V,Ê2—Çß—ç6—s…HAfÒj ß8ŽJ e¤R²%ËŒSÚKöU©Ý#v{áw v›ÿ6<Ôò'pD¨œƒE Šâ¡NVö›ˆèÐé˜SÄ5¯ ­ãS¹1ÜI*† %g*ÄÁ9ød0Ð؇FáfÙ–Ñ>fÚ%‰fç ws6 -q‚A–š€Xœ Û¾¹2H ÐZi|Q ›EA0•øÀŸ—rè¿ åI{ß³K/Žƒà¤uü\«„úzÑ,²7”=@p­¶çxfRµS|93:Ø€¹2Æm×¾â>sá µŠhv„«àN)1ÃöE[&º$ˆ /?+›sgq®Å;6†ü°Ö[ Ù-Y6 -R¡âÓj¸AÕÖÓ‘{t(”BëÚIKJàí -l‘Á)I%EõðAÎz²²ìÆÈ´:IôœÊ¶–©zj%N$¢jœÊÚTŒ`K ,¥.Ä_²ÚŠR[¦Ê˜$ì;7IŒUG‹4o¾ˆ€`Æ»’{¨¬pÑÚ|Ÿ !?MVu­+ÌBÅv­ØÕ…™6D…¸mDcçÙœUMsÖŒ)À~Ò;ÃbÎÕô„Z·Úº+6<Ïû’ÉÑÅ:R^¶io¸eø$ <•UÏ€Dx¿áªóØdzŒ@Uµô4\ÑŒÂ.Ç.í˜i‡8'•ß:¥R“° -¾ÑfOž)À,_r?î‚Ðg&6Z¯¹ÞatÙ)u©IÖϬùñÞă@‚{zøÍ‘ÙºtòÆG -F²³Ç¥#ÐÙ´ÜŠ‘dÁ9¼´lï9ÕÕΖƤ"0!^/SH¶É€Ý¹Õ2b˜†ó¾ H*ïqOB‰E¼¢å†MŒñ˱ޕ²Mµ®•ý– -PMÑ®eé]A¢"KT²ÂÐ52®«^ZnÂ\V Bº’^4—ÇÊFÐ¥9—MâŒ{ј¶FJ]FÛœÅÖšT⣙äHÈ!ÝžCjó  ë¸Û«B—ibwŽ`ÐuL)_[ŽIDŒ£Æ„z¢¯IÒÉÓT<ªÅÞó¾bƒ1ÑtQœ:j†c-«T²…™J’¦¥¤1•h3L¤$ ù9ŽÆ0Ö’n†aŒÅVJÖúI¥†"KMxõ -ÂÝt½ÌpÞ×d‘f?iïûšg, ¢æ;tÇ+ûiêÍ´ó<ÕO#XkzJùàƒ¤•¡ëˆßwŒÒÜ»â½Ä‰ðÜGû0¤{"߃è­êôC×R|˜cæR[ß9h²bÿoKó^fdýëkYmZl~™ÙõŠÞSQTæû*ùÁÌë•A®Ú"ðvô,Ì÷™cð»¡øf5¢Ôù©8´c_@†\ Äe)pmê8Z€ŽáE^ 4üml>~ØXÑti\¢êËï ¶˜ó¹Aü çÀÂë0òMÉK›W„çL3wkνՃH¿,¡T¯sœz1S'›Ãã¯O£/”÷Ø1üˆv¢À8{5 òuá;byÃ…5³.>@ ZZ“]ÆÊ<-;¿•g Ræ`¬N¶gÛÁ,÷‰ÇøÝ/º4 _‘„v¯õ‹5ʆûÒ”ì Ù@$¹yÛf9Û(1¢Wt÷ãyfÔ&)\5M×J_ê Øto§u\ÂN[öO¥|ËV·°™}3è$¼ï’Ý.|¾÷ ÛÍIñö³ïM ÿ|¼|oúj -IZ`½+ÊÈæìšcZXKVSy/ä;Ï3±[RŽI9´ð±Š~âÄc}Æ>ŸojðöCt˘o8‡†¨¬-‡S~á>K{B?ù !7+ŠO7o²]¼kuÞOíK¬{ã- ùjð•6îƯKO3ý<й—Éâ™> +stream +xÚ­XYoÜF~Ÿ_1ÈËr€ Ífó|Jli¬%­5†ÈXŠCI ó +ÙcYÿ~ëèæ1âH ¼0¬é£ºëþªšbíÁ?±NBדé:N"7”bW+o};+a(¶†d;¡ùy·zsFkṩ—®wwÃ=©ç†i´Þís~ùÇÙõîÝÇÍVJéßÝlã8q>l„sv} ßo¶Â¹¼à}\¾ááç÷—o¯6~â|6 g—oyðéòý¿ytñ ®>]ßl~ßýºz·Ä($¤DaÿXýö»·Þƒb¿®1>ØO\Ç8+ƒAÍSÝŽH¥+¢èÅnbBs²ÛQìÆé¬Ùñššä„FçqÒù\ƒžf®)4xÌc8È…’ô<>º"F4ñxàd3%¢Ð ^S¤9ÙL )‡pCg±•ì—=ÇHa\ryµ›ò—©¦3þ®‹Þ¶1C‹c:ˆQ¦w]SÍ"!˜}ï\†¼1(“šæŸj(cáASÑÉ°‘ë¿b¶ädФž›$á,häBмmªÌöG0¥¯b<ÔÍ$RÈ0¹F·›à€•ãé±óiË µ¬]’@wÿ¢rÅɈ#J1éö_ã‹iè + +‘CofïÇ@™f87U0x‹¾a$V¦·ùÄÔõsô@ázcA†ZÛ”E8P Bço§žüåûØ(ðŸáý»¾ŠO¾'¸iâ/Û6ô}׃0828–Ø~>.òÿzÑ,endstream endobj -4719 0 obj << +4821 0 obj << /Type /Page -/Contents 4720 0 R -/Resources 4718 0 R +/Contents 4822 0 R +/Resources 4820 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4700 0 R +/Parent 4819 0 R >> endobj -4721 0 obj << -/D [4719 0 R /XYZ 85.039 786.531 null] +4823 0 obj << +/D [4821 0 R /XYZ 85.039 786.531 null] >> endobj -922 0 obj << -/D [4719 0 R /XYZ 85.039 615.144 null] +774 0 obj << +/D [4821 0 R /XYZ 85.039 517.311 null] >> endobj -4722 0 obj << -/D [4719 0 R /XYZ 85.039 585.74 null] +4824 0 obj << +/D [4821 0 R /XYZ 85.039 477.147 null] >> endobj -4718 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R >> +778 0 obj << +/D [4821 0 R /XYZ 85.039 405.564 null] +>> endobj +4825 0 obj << +/D [4821 0 R /XYZ 85.039 370.818 null] +>> endobj +782 0 obj << +/D [4821 0 R /XYZ 85.039 193.166 null] +>> endobj +4826 0 obj << +/D [4821 0 R /XYZ 85.039 158.42 null] +>> endobj +786 0 obj << +/D [4821 0 R /XYZ 85.039 116.26 null] +>> endobj +4827 0 obj << +/D [4821 0 R /XYZ 85.039 81.515 null] +>> endobj +4820 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4725 0 obj << -/Length 2660 +4830 0 obj << +/Length 1286 /Filter /FlateDecode >> stream -xÚµÛrÛ¸õÝ_¡Ù—J‹!ÀûÎô!gëM·‰»i'Í%RG”¨%é(î×÷Ü@‚"åÝ™¶ã±âç~ÕÌ…?5‹Çõ’Y‡Nà©ÙzåÎòÓ•Œ¥ ,-œW÷W/Þ†þL¹Nâ&³ûM·Oâ:AÎî³/ó×~ù×û›‹¥çyså;‹eÅó· 5¿],Õüý Bôüå‡78ðçoôAw0ø(³ïï^¿»ýðÓâëýÏW7÷UÝÊó¦_¯¾|ugÐÿó•ëxI<;ÁØuT’ÌöW~à9ïÉ{yõéêoÝ^ óg¼jJ;Aìe KJ{ŽÖjú áå¡j›m^;a2ߤ붒q[ñs.–:¬u^|[è˜ß2^ƒp˜©7°¤ª÷éÉùÀjÃϹÊ/û=Ó5# è+ôüVp«#bV´ízgïÔÉl)ü/ -1!¦5¡æ·"ƒÍ}ÐãWãpŸ§tÄ#LÕéJ(@M[¬åÎ{óssÈ‘â–ç@`ô|ÂsªÇšßFv-NŸVﮀ eéžÄü°]hP‚EžŒW†|9!¯2â§Õí6'ÎÝÏÛ´iÊœm–ä ˜"Ó²ÀxúDÇËŽï¸w.Y¸RŽ -½ç=³Ç!«ÔUNd•J;žÒ³0IÏc×oô @‘’Ý9zÞ÷t$¼ ÈD?<Öi[Àû4…a9®z>vX8~c(Œb'òQx{0¢û±nª’m4rê곚)>ŠC.« •Œ@4R4-­\³Ðdj›†E~J÷¸É*å×Òvج8ˆf× $´uU6—†Êñ@5ÏŠ«Çé:—Ÿ8‰ŽÎJ*õ“ùcd x>‰FÐíÝ!âÌHbGç±~äÄnø<±=Î3ºÕh}šˆýç"Ñ>ŠÈÒCï,i"]Á°ó¥#¾œ ¼˜,µ˜˜·¤]ÐpÒZvÁYÍEsÙ y0af?¢x^¼õlÎÀý=×qcVÀžm–¶éWŠ *rT¬hµ† ¹ t0ÿ?Þ¦e3LÊü[^jÆyvÝ™´—¡£#o@Ø=²¥#¿F˜ÒDzÅioJ¾4Oñó©‹Å¸ŠŸïsN7%Úšätš0û=cÌ }àîDŠŒƒ<i‡|vÀI¿lóš¸k ¯|ZÄþüšé‘|eÆc™Ùöò˜4|âsVogs4ù´)dÅ© !1Õ ê[ŽuKo™<Þe>´ÑtöÙ -~ÿòæüf« ü¾yõöÅï³[¬;´Ö½¸ð…-@ƒý|· ä­³¨µql x¸èXWP(í7¼‰„À“rF”Ô<áGslçU*qöŒÑ¥‡?ÈŠBª¤„ÂXMs}Ñf¶±OÉ­— -H‹’ÒŽeçQ‰ƒÏ&݈†SJÖ¥¿®Þb#Æ£®¢­(ó¾´Ä…úù¨,>1‘I|(Žãàù*Á¹œö|xâYÚÓ¿•öÞGæ¥IïQxî|½»”ø|8Øsõóäö8—Ÿ—('Ö¬ÞwD˜ È@Hj ”$¢&Æ.©ÜЉÂè÷®(<0`ôrò¼¥v P¶üÂ5pq¤³U† Ꟃ`àKÚ çÿpûíÈblVÙÞðr?<¯šaöeëôHù¿(‹ÖØ5Â+~’凌ßR~|¦,QÇqjdŸ²èß©ÌО1yãë¼ÁªÎÓp¥øõ´ÍÖá & ˜ˆºúNÉNàœX(ÙÖal;sËcïUèHÇ2ÍÒ亻«‚”­'1o)±²Í3LǾ)ßœ¤Àžî¹#b¥CŸ—a®©…ú^Ï® úúz@Ì»¢ÆUŒû¾‹;8dL)#A¥ûè³#Åœ#3Bï&3  ä‡.Šu[UrwÛŒ÷‰-H£Š'›.gô‘ ß~ä~¯KŽ€JD¹•ö–Èb‘ ]a Ú@BBŸ5³Bcàa0ÐlˆþCj ¹¼Â™»qlÅ}2ÆBßj]ìV®°¡}2û -0‰9 ‡þbÐÏzBÇ<7"FÔ3Õk W}.t¥5ÔÑ4ašk7]¢–mR*ûâó\ÄÀjŠ ¼N\pLŒ „°åU´Û÷…’2¨êÌWèصÅN jŒRwÈNHÚ0RFΗNˆe]Õ5^c©?Æì­®KÅ‹¯z%øÊÄGœÝ 쎲NS,DLcÂ8>…´kÅÏ(qE‰Ï©šç-iúž9ç`HÍÇqÌDrJœ±š¼"À‘¢LÛÝZÅŠœ”N(zCL0VC&@ŽÂ‡ 'Wuw§²cyqÜ'÷ 4Ž'á¸ñäjéb_™×7jZe6××Úˆòï)r§âwmö‡ên“&ÊÝ_ð"€Ú "’”BV¬÷¡V+†^(…´AIñ›2 p^,…ðÄ8*2‰ŒÃP¹Ðr~=¹6µÒšáeɾ€åO&½šÆuQè;A¨l¿»»xé©ÙÔïj|gbJ€Ï[C2 ›²;ÎXCØ™p*‹Ãƒu.C…‰kÒŒ¶Ò”#®Ô6ý%7_)R(âü=6Ò ]‘+_R4Å -5nW°£V±D €Óeѳ.L)l1áÈ$#˽2¿<ÔÒ_QP~¿ïÙ¹rl_È@ö4»Wg})]œ6BƒíãÇÈ¿³=1:áúS Euñ@eZò„áÝ-È -Óší¯è¾4tÅiš1.%¼„tµéúLw÷åK", î‹0\O[‹AT’€Ÿ£e‚™¼zb0tð¤)n×[<åiBýÇÑ& ožºö~øƒ?~Y!«Ä‘ñAu»…¨Ÿñ¼ôÿa,yçìºÎ*ïMÓó}õŠøçÞgJfÍŸKÎú:œ%»fñ(Î'\yB{ó9‚s7&##•œŒ¨e\:㼞ôB¾Ûgp*ƒ® ÇͺLnÊm_Ò7 ‚ás0aÔϤ™¬»>mxº1ÍmåóǶ [û·ùRå†} cÛ³úÏZ\ cVn¾]HF ºËwƒÁG/˜¶ké®çy¹3«[^ÆÒÀ JDˆÙoyÄRFijâp¬é>zA2}qŠ€¾³bK9Õ/€@ê 8è±U¿l¹ì ’Áê5w sk„–åOl „e€‡J~4»]ê©®§<úÿ/;u‘¹Œ¥LRø7¦E7æ›>¿t÷šXˆ˜{ÍOyÛ‡‡©Ò.²&n¼Àñ½ÉïvðÏ»üW_­ûk¨ØIâ ·PÖŽV1tgæEç›ÏÛc’ÿ52À¿endstream +xÚ¥W[o›H~÷¯àÍc)&ÌÀ0°oiœ¦©Ç›8jWU°!6 +†,ÆMûï÷\Œ/»ª´ªjfÎœëw.3‘Žÿ¤i×ócÇD¡«}é,7ÏYÁÉí@ZŽ±e÷x>Ì—uèHϽؙ¿tzbÏÕqèÌÓoâúÓÕl~ó8û¾/¤rGcc"q?’âj6ƒß»ÑXŠé-Ÿ#ù‰—_‡‘ŠÄK¸šNxñ<½ûÊ«ÛGdxxž=¾Ï?n滽€¤ï£³¾}÷œû<ð\?ŽœwX{®Œcg3´ïêÀ·ûbð4ø³ÓÅgÃRç°Ñ~äêÈ?Gê3àhí†!pæë # Ä ©ðç2¥¶ánq“Õ[æ\Õ€Qµ{ãÃÜR“s‡Í:iÙŠj4õˤà}ƒì¼$“É­¯mò2¥sò +N­åy?™ã’ _g¼‘õ—ŒÞæU ÛÖ…UÕ¯cÌ 6–jL(l›¤n(À×â¯Q@ æ…àiÉ ÔU5¼NЭ”×ÍÖ¯'Õ†‚ÈdÅž·JöÞ3}ˆ<-šêXÁ\ĵ9Ê°·ê¶,µªÁO)¬®d×TˆÐ-~a@—tü§QoÐÂŽ&HL,Å>Mâ&­J»(é›a‚ &HźgÓNí™èý/^H_­òrÅû¼dÉ¿ª‹×Ö ÁY°H›ÁSk̨Wê~¸žBÄi’nò0 (K­DB˪fáƒ> «ne¡ÉÓf‘%gH Ý&ÀÜms¬ˆÎ jŠœpzÅ­&@ðûÔ$5;L—L¼&?JÌySW©“2³ÛK–èg¶IiË°à·@¥–­ìõ9‡LBwÎdž&° ¯°ÊŒ´fC$–¥CË–,€vÑ/+M@´‰ä€¦¬ÊvØ +‡füÝÀùa‡c¡Á†´ê•q=}¨ºE EÙP¤ÞÂA­f+fH.ý8àlWZí0”"ë«B/ƒÒªTbxÜ›5ÓÛ,Á,ÑQ,æ¸ÁÀiã{^¼BÉ®l}_³! ¿oLÆÞðQÅ'IšžéæÝ–'t ±¨éÛNK&ù °&€p0Œa¿i››Ú““„„ÚÁõ`8ì GÛá¡AøÅYjbqMŒ-²¾ \”x /p5xLR`k/²¥P­èiô) >)F‹òbƒÈÒºKåšÉ¶2פ'Ô]rC>ÜOi<Åì!!Äï~J‚ ¾ ²ôÑ4XO°_vžÃr +Wåo:rÒ[í¸'Kê°ÕT÷Çn+Kîf«ñÄðáuÈÔlL•ò¡±šVÝ@‘Jܽ0g¢Eµj5rüT?ù0çÊÇå[Í04œ7YÊ2)Ú«Û)‰ŒMÛ,u8õí%βoEƳí\îëlC^oÐÜ‚4`}ªÈã|Áׂ„î´1¶-6Ð`˪,³eú˜€aòpu7å["½[ByÆ5¾±×Dù²:s“ÈÐõÃÀ²´3bšl2Â܈<#¨#ñ‘ÞO/ºª†õ}ûTÜàÓõqùbþ‰ÏðŽ¢›I©À•ÞáÍÔŸ»»mÿa7ÜC^5vö¶I뱑åÉMgò +z¿C]qñ4™}íüd>~çÂŽë=§»¿$‚È#uþ­¬•r•ìœAÇ¥¯=nßݧ.ÿ­Ôðendstream endobj -4724 0 obj << +4829 0 obj << /Type /Page -/Contents 4725 0 R -/Resources 4723 0 R +/Contents 4830 0 R +/Resources 4828 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4700 0 R +/Parent 4819 0 R >> endobj -4726 0 obj << -/D [4724 0 R /XYZ 85.039 786.531 null] +4831 0 obj << +/D [4829 0 R /XYZ 85.039 786.531 null] >> endobj -926 0 obj << -/D [4724 0 R /XYZ 85.039 711.163 null] +4828 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -4727 0 obj << -/D [4724 0 R /XYZ 85.039 689.966 null] +4834 0 obj << +/Length 2771 +/Filter /FlateDecode +>> +stream +xÚY[oÛJ~ï¯È£ Ô®î—}ë¹dÑEÛ=@Rô{öA±[¨,y¥qšì¯_~$g$ËN°Íp8’ÃÛÐÁOÁMžlü¨¸Éòt“DÁÍöðοÙÑÊßߊ'Ñ&‰c_Y\ÛÕunü8»Š£g¬³0ÞÄy œ_îß}¸ ý›ÐߤitsÿhI‰?Ìoî«yA´Y­“Ä÷n›UàµõûÕ:JSï·f¨·¦_E¾7¼”yeWÉàn_®¢Àj™~Ünëq”m¿öVëÀë[¢6®þ}ÿw¿ß;.Ýù$G¼)Ç ‡å’›Àß~1—#J6I’±«§U’“tîÔàÖ¼/wø†Þ÷†ø'ÆVaîýÂ(맱ÆlX)$öJ–Œ–äÕÿœì¨Ã~U½Òqµ3YŽ¬ÂgžTr,µŸv3ð/?ˆEÕ~áUPüÀˤñAɲ *¸w,€Æk ;µåJ&Ý­IÁÊ0MO'…QæõøæDäkƒègÄJÁÄ-{• ?|)ã»ò‰tZõòíz#ƒŸL"ÄFúW ÝF90{Ê®³ níEÈ°\PÄn/ +f(ã>«†™kCÖ!ß*0¾ƒÕ‹‹½ÔHWY'J=äý¢…WV‡†µÉê1X)éF]…ÚÃ܇iÕ^a˜åbc=¶>žÄtÄä°m¨wåP1g;8Á-9qaY`R[¹ =ØR‡*ÀSߎˆ5 íEê Rcnzù»ÀYÕWôAV!£(ö~6fQD×!lZn•ˆc fÏ7†‰‰vÿÜK‘ea¨Y³Žw²â¬mìOƒóV=‚]®?Èä„]å‰Ùê‡ft~…NkLˆ™ÜX1Ãlã"æÒWXx0²<ð¾}ýô§ŒøÚ{og׎U¹öÐÃÍv¸úÒÙgÛ”ƒ`‰Þp)bâb«$Àw–·“…VÍ·ùÔ°€ÝÁ“‚m‡"¼b3;àßå`ší©åÑ•[<÷º¨ 3Š-)ëÌ·lo/²ÂQáã©l!ÌY*{7„â¢UiÀ¢aÀa´ð¯‡QZwa”±~ZugáOqa¨øÒ’‘²Ùðò\aŒ˜úp4‹ânæŠJ8´Î̸Sëdw4ˆ°=½ÈÂÒØxg1pgÒŒ\Çsc“Tz]Åi®¶ÿÐÖ™· Ì;N &Ò Ð:ÀÌq¹#Õw~Ì!·º¦,wLÙ¹j9Í.€B@RõphÄwŽdãbïÕ(Œy]AÂjx˜”7E;‰°ì"s¢‡EîͲ,¾î'êåë˜Üÿ~¯÷œA¡>>d¨»­oF¡Ùwµ=†Ñx5Ë© ÛRÙë8r …m8¶µ©‘í±¶o*«Î÷R-ÔON¾îZ*æ‹:í4Ä6FͱŸ´4‹®Ö(ÙÎéû0@´j§Ö<Ðâ;‚õr˜o$»×cêÝP×—ÑQ öÒö;ÄĈRêÇ¥#ê¹Ùí ÞgÍ•23µc¤ëÛ~÷"`ËˆÌ €e[Iâ•TË별ÿ—ŸøeÛÛ°DMQAàýþlꮚÕ+~†õ×< *2’¶ˆP ç=²Ç_¹I 1¡(\]Ø*Kb' /|Éå0¾‡ýE:7²Uò"’fP¾ai\?Q&fËä-={ $)Ý1—k8îììÑÕF]£n¾µ rúÀΩ!¡â¢ŒÔÏGÎ M7^z+¡÷‚ìíánqžÐSk¥Ë«œZk£? eÕ#SIÉ Ë@ß@úõó(a¶—¹ÕAœuÛ”­ànøDò,ã ^R¬È†ï:'?D:Êÿ[ÿ-ê<˜ŠMøEa+~*¯FÓsÕQq-‡%#_v½f´]#NßÍÖ,"#‹G¶Ú‘ ›Ú‰¹.„^(Kr±œúÜZc38V¹šçkt*õ¥ÀU½-+ }«Ið ü]†Ëx_ï_ó©h^¸/£Ôs‡×³ŸŸxG~c‰^LRØ0èËîÂÆI“)ŒM=Ì®±µ€"?F j•¯µ€À,žÈÛÄ꧚ÈûƽÚF n8¤$Lm€«G`ï ªÙ¤­=ÏAæLÚ±1þ0P7P§P9¼RÇIä,ÄC~uñœU"µëלô¤…­ñ¶`úf½ƒ† ]ç;Ç輄ë¦R9ØuilΛSfßèEWÕÄŒÒ [v*¤~›ƒ“z¸Ö<èÕ/§20‡”äk/ ëY’_©;v\}Ms)e¢5‘ +o× º(èlbjKî [vM:æwïÀõ0‹H)•¯3]sþe¶b‰}y®÷WT3Å‘y/ˆÌ!] +æj `ýùá³ÔíHnÏ‚­„zA,xlK#¦}xÛü° •<ÓÇeJ‘ÔläF=L7ð©ÓØ\V‚åjìà°Å».¶íV6›r'%zi6KrJ.o*q©ƒ¢\Ÿ4Øôb9k^úÆÖ¾${µûÇr«y¥±vuæ§Nñ•Îôýîη}òÂëÄåþ†³?ܦñìŠÎÓ;QÀÍDYŽZJnýù"Ëôç‹0”·.!Ü®‚ …3‡qËqÙ½nK„K¦ü¦)M(lIq0c3ðƒMìG–Œv³²åaŸnò$ë4‹²<»¦ã‚pCßü¸o_!â'Ò-zd·}—'ÚÂà·fX%'¤á7÷"« ­+äF™\Ç™Ç\\‡s–XªÛ¾“ß)FI±‡^ƒ^̼”R}ÄÇÑ™GÐT> endobj -930 0 obj << -/D [4724 0 R /XYZ 85.039 661.355 null] +4835 0 obj << +/D [4833 0 R /XYZ 85.039 786.531 null] >> endobj -4728 0 obj << -/D [4724 0 R /XYZ 85.039 640.76 null] +790 0 obj << +/D [4833 0 R /XYZ 85.039 766.606 null] >> endobj -934 0 obj << -/D [4724 0 R /XYZ 85.039 423.851 null] +3058 0 obj << +/D [4833 0 R /XYZ 85.039 658.638 null] >> endobj -4729 0 obj << -/D [4724 0 R /XYZ 85.039 403.257 null] +794 0 obj << +/D [4833 0 R /XYZ 85.039 251.169 null] >> endobj -4723 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R >> +4836 0 obj << +/D [4833 0 R /XYZ 85.039 211.005 null] +>> endobj +4832 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F41 2994 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4732 0 obj << -/Length 2833 +4839 0 obj << +/Length 3196 /Filter /FlateDecode >> stream -xÚµYmsÛ¸þî_¡É'êæD“)’éÅñ%¹Kl×V.½Ée:”DY¬)RGRqÜ_ß}vŠ”è\:m'X,€Å¾<»€Ü‘CÿÜQØŽŠGa4µ厖Û3gtO#¯Ï\Í1Ñ,“ÏËùÙùOSä:vìÄ£ùº]'vì žŽæ«OÖÅ›ÙÍüòv}vF+’ÿç3ÇVq4z¤¶c»q<Úžù²_é~~vwö·v-óG2kHŠì R§:PAGn‘0£0쩲¾¤M9ž^`•»¼\>H{åi-Í¿Êç¤"Ù¦ö¦Ùžÿ`7_›sy4ñ;r£ÑÄ m‡¤Ã¢ŸêMR¥ÿûgf2<.Îÿgÿ`§_ÓÃö©Þ˜Ì;ím¢|nN”c;‘ˆq½ËÉNå8p-¬¯ÇZTè¥ø“hÒc’5Òj²m*K»=­9±­¦)‹f$žÒôBX{ -ö|;ô#ÍYoö²,ÖKú‘NCÍ·K*3Ù±Ò&­°> ³Ii%«Òø¾nôÎÍfŒ#H"s++Æ^dÑô/ã`j%¹Ì]—•XÉ•M¾Ñ3ÁíIs ñz±{xʱ*YÞµvÔÈŸúƒtlî—Z·Z`9öBëAè‹vv¢)UúÇ>­Š.ßuŽ÷¬Ò%xËí–ç4yUËN/^] ÏÕõ\(¯W¯/ùâdìªè±,ͯ‘…—be•…˜MY ¸A;Ϊ†Žw\ÿ~O*] ã}^.’’< œ‰œ‹AR»Þ©ã+×ÈÃÿÜñcÛ|Í)rã.XuQsj‚Zë“H*¸„¶z"jÀÃ]0YTi¢›ähIÄh€qÀ±éþNíUºNöyCMwcü)ê‰sŒ1±{ÀÏJp2&;¤ý€µO”&-š M°c~¶%ñÇ÷m„äQÓøä™RËû.D¾ÿ,ò`}A´D4ãjÀÅÈ$6C»özÇÌÞU‹O2îxʳ×ëyS¹&o‰w“J›q!$u¡4Pd‚3Z¢ñŒR¾÷,· žPàúø– Zm4EÐ>èÙ1‹Ãé ƒ´•0òâ{Ž0–KÇqɸ9éY€·Å¯ ï¢h™g©0C“ -&ñ›TX:4Ž4/D­ãt™AdD®"T\`Å'3_›†ÚGÆÑ] 8ìûÖŒT.ò,Kæï£1†±Ðøôhš J<ÆhÐð‰J T 1¶×L¿]FŠÑåj hŒ£±L@ãŽn(›M|cm, Ž©Ý‹¹zîãyì\2xìO4´7½¶/©÷;ø1s%êz I5»wQ6-:˜ ºœ©{øì -Øt‚ƒ•£t »5ø£”mèøXbÕ3a-ôÎ2¾8C(Î ÎÇdqƒ*¬-Hð˜²ráékq 2¡QJ*lýbIЄˆ»nUí¢FÙ&ÅR¶um0íôD•j™X¡zÈÄet[ØF`ðÌM{:TÈŽæ-ÀàC£Ý+9sy -‰Ü-`w; ûÀ©1*/E¾Y‡ÚW‚Í‹‚ÎcŽ?œ 0¤Úµöº„Ô3øU††wX¶i¾üu ¿(–ìózéõ¸‘-pí¶Té}2½o¢¿³~@œ€Ó«´ÈäB¢H€Ê›rô˜Ü§B\ˆ˜­1¨ê\iué7§DL.mx‡]±òÄú´L“ÇrÏF ܇6ʧ6Ë«á£k¦Y7&æ“Hóâ6*Œw&:ËIdè)\'£¢6ˆ×«¹|×É6“çî2 §IâO–PÒÑ‹­Ø’ERë•ú¥¹æ‚Û7¾ÓêE$,ŽÃÆ6MŠnXèË?µZp3v/s_ vÝ”œŒdîÓZ†C,†G°ÚÚ–¢ôìdÌî:<:€b§1wsQKåƒëª„tçf\˜%ÅK]&…Z\_´³ÁÏø AŒüÅ›N\4züXgÒ'ÖZeu{½Ón+y¯fY­º'S’”JYxËf ‹À¿ Bvª¬~84j -ÀHk,„xkgé.ËŠ‹ÃŽ¼x¦tƒ`s¾o…Ót©Oòö‹¿ž¿O(qp<˜z5×øÖì,@ èë)ŒÈ…€”1˜·(¸)e1?Ðoׂ'Œå^æ´×æ}ÝÅœD>'¡¯‰Y[·(™~ -õ´î\‘wy²ÔÛ•ëÞFu_Zd«ÆúæÞÙ·ø|_7ÏÆu’×ì„í—µbtäôƒüڃ1ÔÖ&ì¾Z#”§ï ýkE¤¯Äßb:ÇZ‘—&¿§AœJ¸Ò¯Év—‹ç(~”ÕœýÔ¿÷ ~*%FÖüÊcû:¶Âáñ+ªÁ"†ä1] -yðÖ’Ó>îK–ø­¥1¿I?+¨Ÿ¬¤#æþN°‚ xv¿3xÞñÏ$Àк:¬oœÇÌq%qo*Ðn ¢ž.Dñ5?',IS ¼s›'.S.€`+åU©Ò?U|SAký¸Ô‹Õ#ÜF–7e…¶©¤’|ß«k|Ý'+NiÔé^o\A‘¡7…ÀöåÛã'ú/&ü¯~Ím&üÈŽ#oø]"ð<Ûs[aø=FEÇ›Ÿ}OEþ7ª¼ªendstream +xÚ¥ZÛ’ÛF}Ÿ¯˜Gª*Có*’Þ‰½™”3v<ÊÆ[I8%qM‘ +IY3¿8ºI]½U[©X$îFŽëÑþm»^˜Ý&éÔCÿv¾¹ñnW4òÏ_9î”ånÄóÙÍ›÷ñôÖ÷ÜÌËngK+'óÜ8›ÞÎ8÷?½ý4{÷yr†¡ã‡îä.IRçýÄw&w¾óá=ý £?>|~w?ûøy’†Î¿…ôöñGê¯ø‡õ±¯ÝKÞãùn_ÇËÂöùc{ǘ1r×~r¼˜ïMÝ4N¯­fXŽ—#Ò÷–{Ê7Ï“ØgÅ©ó´Î[¼òúc³«ËžõN»:òWº³ q=òyÈz€C$‘½1ÿÕXÖ+dµ³Ùñõ$±PŠ¾/1cÕ 1¯‡ÂÔõõz‰£ÔÕĉ!g}&&wØÁRÆÆ~H¯vNmÜ„ešö«Î›².»¾Í±0™Æ©•ÎÙ7ȳŠkªs1U˜7 §¹k,ëdûýÖ¼†ÅÌm¬¥|€vÖI&¾ðª¯€•%C-°Î­—7»¶#tH§„æfJÆ'‘Ú©g”°WO§ƒ_ÒóÈ/Ǩi C¬ ßm#9<,ær+,çy8'[Ž‰¡Ý #J®ìØ?m61z‚Û—_u ì׆ù„Kyü-p!.¯2gò»3j-Ú„/*^¶¢ž9¤ú©ó ~}.ͯˆýÌéŠj0YÁëÐ[CÏðp,Á^Ztý/ |Becfá>üD"-“[¼/ sØJ/7N6…Ù`: +oÊ;cWs!6[®dÿÒÙ[÷ÅM%™kLþ{WæÖœ˜tHÁiûE‘‡oŸƒ˜Ú"=…󢼈Æqº^œ\…ãÏe<6Lßäk ZD>^ñ,$W¼ŽÉ”êMû×àXÔø³µY2À(Ê(À[©TööØS0i;ž ôÐœê*x­Ü e™Ï˪dà`ÿ¥•èÌAÐ3äôÂVêo[lò²Ö¹Mm¥žjÂä[a8EÞ úv€¥À·ˆA u'† ú=âàLªøtàsÖÚÚx×·å|À õU(‡úÀâ ^è ´¬Í³‰¢·ÑþîK:ÚØW—|a»Í=”µDc +ÛZRpÍ*ç ÚŠI*èè*ôÔMJ­@”MaÒÈ5[ï’%^©(KÝ€<þHx.ƒ”aúH][ЂÔñŠgAj¼â/OG¿³Òl4¢bªF©˜UB¿fkv«µ8ëç§OŸÌãxÚ÷rÍ2¸¥Ûȭ𷊨*#¹(©¿Uêc†Ïø¡_ìâÍñvØÌ‹L-•í<€DTÇ}¤ÇÇZ–ƒµ”Tl fsŒ’E[½šòE +J,%ç=cªÝ« 7€èÑí¶º¶€Ê¥‚ÓÃR@ nzb¨O.EpÛ—UegʃM¹°Œ&\p›ZÈŸ«#$e€jvºû]ÛíÌu¡Öë ɸ4¯šÕ+¤dì„UÞ£²Ôܶ“M_M, =Î)I™c)lb¯°íe¦T©ôð‰ÆÄ@ ÷‹#a&¡I’­âóÑó6ï瘺抙K©X(JÓ#(‚ñÂèü©óÕ:H®‹ +dÉ‹9WÏay® CMO©sÕ5¨õ³×Wõ +#Eä Þ–­ÙIÜñ&«rÞÿF…Ú ]ne^? ]®ðLb³ÂS×q’-zæÄÔ¦Ž‰ƒÞÕKoË„E¡tžÑ÷\HJjmÒŒuþl[#Ø•If9²‚ã¸×ÚZS[ìA ©VüñÀnC:LY«FrñÐØ” çRe 7 ++ÅkMÁyÌ&­ûΛQäA™3VmëËI¦½(– ÍzÌeìÛA¢Q’ÕÆ)Z›»kc?òFºPÄÁ2Œ8 ,ͺ¹ólfÐld]®ÖçBd±j ®ÈBi„ÁPçæ•$ÔZå³”&ôâ¶%梸îÌC¹Ðl‘OÏv›È{ò]Õ‹œS³Ç™^Õ%e2¿£8+„ÝF”J·Z ¯¹Š5®az9YBŸ²Ò“3ݵö ¯ä éè“E’¨w$‰ùP–8¤Û¼· N’h‹Lù÷ÍŒi-i&€Úõ¦<2×òénhhš¨«‘ŽI§Û^ +ß ƒ|õ³6àAb¶n:MHöåP×Jæ •)^¶UÓù‹¡/Š-ïZÑÆTw|Pû(À×ÊjøKwë†qF‘¡-¾•Åþ4Uê;¼]’Ë+(l1™KâîJ«l]l•½gÅWªg[¹‘ßKß ªÃ7´_¯^8²ž ¾Æ‘©° 2Š]*ëÜHþ„ä8}¡ÿÅ.ÿ¯?/ú¢©›¥Áù(7ðíf$á;iŠš¿C9Ýò4°ðendstream endobj -4731 0 obj << +4838 0 obj << /Type /Page -/Contents 4732 0 R -/Resources 4730 0 R +/Contents 4839 0 R +/Resources 4837 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4700 0 R +/Parent 4819 0 R >> endobj -4733 0 obj << -/D [4731 0 R /XYZ 85.039 786.531 null] +4840 0 obj << +/D [4838 0 R /XYZ 85.039 786.531 null] >> endobj -938 0 obj << -/D [4731 0 R /XYZ 85.039 374.974 null] +798 0 obj << +/D [4838 0 R /XYZ 85.039 384.808 null] >> endobj -4734 0 obj << -/D [4731 0 R /XYZ 85.039 328.305 null] +4841 0 obj << +/D [4838 0 R /XYZ 85.039 341.854 null] >> endobj -4730 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F66 3242 0 R /F15 2876 0 R /F20 2865 0 R >> +802 0 obj << +/D [4838 0 R /XYZ 85.039 259.512 null] +>> endobj +4842 0 obj << +/D [4838 0 R /XYZ 85.039 224.766 null] +>> endobj +4837 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F20 2961 0 R /F64 4112 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4737 0 obj << -/Length 1974 +4845 0 obj << +/Length 3749 /Filter /FlateDecode >> stream -xÚµXmoÛ6þî_¡20³"©×~ë·Í–&]b Ö¡P,9Ñ"K©$7ð¿ß½²äØ]×vQäñx<>÷ÜQÒñàO:q <8QŠ@Kg¹žxÎŒ¼™H#13"³ÌϋɋסïHO$^â,V½žÄA:‹ìO÷äí«÷‹ùÕt¦µv¥/¦³(ŠÝ×SéžMgÒ=Ÿãˆr_]œbÃw¯æ0t‚C—и2½ç—'¿ž]¼™þµøe2_ôV ì–Z£MŸ&þå9ØÿËÄ:‰'h{B&‰³žø¯Í{9¹žüÖëâ1ßáY‡\èX±~î | •JI' -ú9aqŸÃ>Tì®Óé,Ý¿akuƒ]‘›<©sÜqÝÔ¨ ±Ä†™V´üì ßª*ëé Ë´+êŠUæÙÝOû©7*Ëê)´ŸŒš&¿C’ô5[žô„÷Ö‚f§¡³+~ž‚éi¹±2FÛŠ7GãÌŒf}™ÐÞ³bJ¢ÒMo¡U’=w05ôÜú‘vÁfáßC˽i“sÃøB%n7öO @R |÷¬jy0Í`R¸õŠŸl6h9O«w ŸV×yóÝ7%×ãz2`üÁ3Å3Ü´ ­X¾²ž^òIóù¡ÿ· VòLB#A^®zL‘wŽƒ=›¶¨îx v0ôÝÀpa¼;BPÀ`WÃ:¸¬Õ1p•;Ç ]Ý"|ßsoîóŠe·8‘Übì:HrŒSœFqólйyt“ -ÆŠŸŠ²äÖ=®=Z¡¶Êù¬nuwI}ÐÞŸ0@h:¼çU»ivÃÝ}ÚÁ¤*âF›w{$îxɼå1ˆ>Ã#V5²QͲ;Š»……}ÒÁ^ñ³ç¦PS¹YˆÆÈ·|`Öò²åÈöF)[òZܲSI ”°%ñßo_3 *U[.ƒ™ž™žžî¯Ð=wàŸ{ž„¶ã§çq١·gÎùŒüëÌŠ¥, šŸWg—ÃèÜuìÔIÏW½NêØa¯òß­«_Þ}Y}øºXú¾o¹¾½XÆqb}\¸ÖõbéZŸ>@ëG}ýõÃÕêöë"ñ­ß¸ëÝÍ{lÖýòîëé^x‰u…ó¯pþÝw_ÝÞ¬¾âÐí§»ÅŸ«_Ï>¬ôŒ#º¾ìÿuöûŸÎyGýõ̱ý49¶c»iz¾= Bß_Þ«³»³ëµx,8çYsÒ +ÂÄNalé;v’³4qj‡IÏ0´£ Öõœ‰ + Jô&ÛpÞ(¶îvÙº8>¨Ä°ern,;ÙZÑLövCcoŽéƒÌÍ?ƒ¨?´¾•5>oPÚ/öÅÖÍ*ÀFd]òÃsœWi~ÿÂÏ?7€yUw×q_MçѯÛláÅÖ_îKx)øe¿ãgßÈú¡ì·Æ°nÖfëžk²`lU ²úð# -XV(Ìó]aÙ´¦íÕè„ŽWæpÈHò²1èb!öÓŸ”Jh©œPãóßÓÐ"ååCéÀ%"ögQšän‘´ÚÓ2³&Í‚@ ?Œú)0W$Ó#e$ —‰ÂEÍ.@oÔùäHáùI¢YfÐ&ûwÛ¢ŽgkéœÖ`©32–õΊ9¡ÇÄ„"DÄ‘P m3€K¤,\"Éy”)ÞÚ®o69õ£%}AÇ“û(†öÜæΖ$wù¸,Ê”¤rŸ³@ÃgËWÏ9rLf(¤f0fE›‚ðmiH¤~œ —â4ÜÁè'šk Æ ì?÷Ù™ŒAÄ÷“ˆ@fà±g8ö#)pö3ߎ@¹L"gÖrßc8{aòå’ DÏW{©:MªŽ1•´5·2fÁ-¿1³Ä‘{×P†"‚ì© úÉ HçÓs䦢ÖK–zVMAß-ÖOf™aÀ‚Ö6èáU]–=ñ˜õ±æ€Ô†Ô FùKœöâµ¹)2_*p¸ÉíoÿñŠûWçß½:y{v1ÿ µ½…šn-NH8OŽÖ>Ù4M^u'uÕ5uyw4 ê»b™·Ø~wõûõú[ïÓ&]ç]Þ´½B - €€º ºêåC{ -‘aaY åÌüÍÇÓ›K¼à«ÇLSø”bë4_¥›²{9š€5Xéž^2³UPG¨\'¡P¾þn.O"òúWF’‘>~•ÄbùË\®c .U_ËåZKÅÑçòâã\®ƒnŒörÆøWIX8LÒ%xôŒœ¡øšQ%XŽS™¢›œ{H‘"[þ݆2Ü]Šs­¢IXCu-Ût=@ÇN^kpñ¡ÂÝíè–N¹¹àÑ)7bG’?&lk0šÔŠ°%ߥ#œYñ3µ Чîr~ÇÍcGi ÂhA*,Ùbº ±w9*Œì­hmQöÂxï||ãú4:”Dw!ëMÛñ”ݽ ^h‰ÜŒŒÏÁ˜,&´Aà|{þ? Máb:ìÃdÌÔ@Ñ~â;* -„ÿ¿L ×ë5ßÍófÌ×#®fmó -Ì0öaj¹cjÖn2Àí–ŸFÚ’ö^ò°ƒA¯ëf™Ÿ”5^äÿ£eÁ—SÈ87±ìP:‘:$žûÞt"¿Æ(|¡”ò„Šþåb •I~m2‰ 2âŸKvz§’¿Ž‰ïiÄSÖ刬phGO¾§lnàÄ05·]1¤;»ÅiöMm1f•7ÎB´PB9ô±jYn²¾¨Ô¤ŸžæûX¦pÞ㯠ÝFÍ´²äda>A'_%"Ny¥Íc¨¢O;0š ¿mn¹3MÜg©¸š}nûЋt¯8ô­ -àacéñ«FÂoGô%fàiز/|?<ôý~ìŽïúÌÝÈ÷cˆ0uøB@ø)™@™×b·Ôɾ/í÷p#50ù|³¿0endstream +nÆ¢ð +S:Ón®¿©ã{ㆎgá¼l‹ËÐK†‡>pÇÀ ¼¸Žçs‹9Ê‹lsú¢•%„0)A#ËžÙ+†àp:ãk¿Vͧu­²‘&Î)¡Yçø?±õ¤+ æáwÄd_®÷´à0±¹—¶ÚÓqwê °<Ø«—$°Iô,?"ÅK(;~áglÕMÏ â°áv‹l=4ꪚ}Wx¤¹ïô >ãÖô–ó`&kgxK•¬?è µ,lÓ¹›A:(Ö¢•§²ÈÚ{ä¿oiâ­È¼ØvR&ûFªÖ30}Füaø9¾7fÉ·Ò“1ñG\½©˜#@$M˪#ú9k V¦fÌŸiþ‚*QÀãøoAsx A9HŸDKØÊבÀÊgm¿ðàê"@°¸·8R4–Æx%vlœMãQÐ@m>Zç@ò¼q-Cï[î^g¤L²B¹áç6Ë =žÍ†YKlŸ;þpB§,~èA/ÃQÙAì´pÍ–A4BO|eÅà22:<÷úü˜C )^û¢î)‚’À³®7ÜÀô hȳš_øÇûÇÇðˆ|ˆíaûJ‰É°³ø¥Uò6,½f—óS×âÆ·ëÜá9úrcƒM €3O€¯Ã>Ž•—š­5Ø{Çg¤9mÁClÚ,eð£˜A¢¬–å×Æ1P«àØ÷´d<5z„ ð­;Øæßg<¯Ü¨±¿ïf€‹® —v}²ßõ¬oh™5Â…@$‘aÜf%‰÷ƒ¦Óíã¬ç²Ù·¡¹±…ð¸ïyb)OÞa‰Gîx!…ó8šÉ–íõ͵ҿCQTå:ëÙw¡üÄZ'’ëŸ + ;t¬ã )/L­]ËçŽA3@ 9²†ýuÃOök<â#)AIóev/Tbûí†ðV‡k÷"‡}lwä„Ñ/k-À9JàÄ [‹­yB©ì:<9ƒ8$˜¿ÂééóÆpάEÚã˽ +XÀÚób“á~UO¡¸Ç’V”¬hY­V¡Gôt8““u ãaREÚðsµìœ6 +nËà‘×lP,-2|&¡c²àÚÇ"ËycXz‚!ê‚QEsÁ†M‘õû¶¿Ù^ÚWFX7·+pÐŒFžxjéSмíXÉ[žX?p7á ®žç±±>¦4õVíw1QW `GNf!`OûC ·ÁùUÅ÷_ÖN„NŠÇâb{OŠü×~èî¡%Λ÷{òÕÔnêظJºK0"=%ÎQeŸŸfTôóoã”Ï^}Ç‹pÒ÷ÃDzRàk÷¯Š¿Ä"(<Œ²G!ô]FnHi!Þš³NUEÖ‚ûNF,pn5fòäŧOèè¨Ø9!éì´7•q¸§©—3A™ƒM¤†€™WÆm’Ôºzwý¬’‰ŠV—ÅkÙõÿ€ó9©õ3¡­ÄÚø”MmZdk4=CŽ³”T9˜¶„DÎñH!w…®)‰G(r™Š‘ >%Öž˜àø|^ ¡7´w`ˆ†ÖÿaݳÞi|Ñ[ùÇgµÇÙJ/±ÝyiÈôT ¢5ÇiØbmµrß‹Š÷ÑP°ãž­W]¯•K‡iå½ÊvRN.ñ©`š†÷%yºž¡½2àA3\WÛaÜ­—V#Õ0C"ö™õ Ž‘p©c&Xå ¶# k Œj*²{ô²ÔI JàÞ§w{5–9ÅħòŒ lÇÞÌ3 š“y†¢A9¾Ç<î¢ +Ã(ÛØeôža?Är£T#‰!ˆßdJÑL¸§©gÇ©;b‹¡Ã? ¾Ü4Þß±‡:¡ÇƒA# }ÏXBZÒUâMÑâ[q:¥ð4Öu³U5˜(L3•apÖ£ŒšIÆ’iž""Mj :— ¸•Zƒng‚ GèÄiezíbð¶°ÿCY«`@ʉ@xy!Ä÷FTƒZ‘%¾w=W#„xhZ– ÞÁ­T)óÖÌN)þèŒ0Á¨w­IYŠ\í½@½=aGBvèFGvŽÊ°#Ô!|Ûs%(‰œDTϳøíÒ¦AsQ…÷Òù‚é éò–Üüw]¤>³×P;‚x° ôÞbRÑL¸ÉÂÜI½dÄ&‡ Á´Ò )áCQCnJA±ï„CMS4{‹W³žYšßt|‰‹²ºè¸ +æDFv턆63{:øî –®ãÛhǨ؎“bëÂFmÇ0û層 :éËB¢¿,Œ²ª¼`ZÒ +1§MÛ­®õS^Æ|¼¦ì»j\àŠ”)ÁŽQÍ0RjîËBmLhKJç˜AÊR’Ø„%”È _Ê#«bž2ÀJ‡#)‡…úæ¨$/tu‰C{ ìz:lîÙ‰bóø3öi‡öó"Äl­l`|OW:<ªÉ¡5”òÕˆµ}©ï…z æâÀ/ú›NW™Öz<ïªj-ªJ£>×HT–•µL=ƒúËëDÜÔṙ=øºübˆËú“ñĶïÅo¢‡As= ì¹Â'v¾é¸†ý2GS 2aAJ¾Rí¦.u\pŠ#›¡/ºª"~ª ׇO“%u}hâ3Y “­«ëæâ… UBºâBhu¹(TD©×¬$à:Š„€ Ÿký*2¦1¢q_Æõ)èø|7Ž¹«Æ—õ¡´•¸H ]â–¾™+·Þ(Ãõ\7Â]‘¬ˆ£ã7ýEKBc¿°!*€H^~C-mÇétòLÑé‚8®½î÷¨Ø¤ØEëÑD6îʼnæN¼ý:÷m`“ÂTT)L¬ÇA®ŒŠÛôá$ s&!ªrÎ-r@öÒ–:ã•¥wd|H®>¦pZ’„cÎÈÅ!#²9›W2ÖeÚƒê´Ö¦lÏœùÄå&±¨It¹‰ú Œªk¸¥•y£“$Ý…éGÂN“d• ¥‰Í†MÆÜè3°îw<—?ÈæB#†G#¥¬Æ+m‹þQI)6¥XÂl2E¼ÐmŠ÷ã™_–ÄŨýÛ².»«¢-Sv*€ù¡ü™„úË2p£0!‰4‹=RtÃME®T>¶ø´pÁsšŸ«g8:§ŒØÏÑqà0¦^~*Iú(¥Wü¼RYé.4­x¼_×Ï *6hnšÖÈÁG¯½Ê©U0ZŠ[Éóǘ8ëGÎE¾´øÁ¨Ú¿Cv[‘´ùó•—Žö*kµó².‹|o|Ÿÿ5£Ú?›dÂüÿú¡£þÕgØiâ͇Ÿ!$¨ž«™AI»~rÌqè'\û3,ÿ2U<&endstream endobj -4736 0 obj << +4844 0 obj << /Type /Page -/Contents 4737 0 R -/Resources 4735 0 R +/Contents 4845 0 R +/Resources 4843 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4739 0 R +/Parent 4819 0 R >> endobj -4738 0 obj << -/D [4736 0 R /XYZ 85.039 786.531 null] +4846 0 obj << +/D [4844 0 R /XYZ 85.039 786.531 null] >> endobj -4735 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R >> -/XObject << /Im1 3957 0 R >> +4843 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F62 4047 0 R /F77 4849 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4742 0 obj << -/Length 2566 +4853 0 obj << +/Length 2505 /Filter /FlateDecode >> stream -xÚÍZëoÛFÿî¿Bߎ*ßÞ§ÄqR·NÜ‹}m¬$Ú"L‘.IÅçÿþæµKR©âz8‚„ËÝáÎìÌo;Š»pà»HBÛñÓEœDv軋ÍþÂY<Âʇ W(VB²êѼ½¿øëû(X¸Ž:éâþÁì“:v˜F‹ûí/Öåo~¾¿ú¼\ù¾o¹½\Åqb½_ºÖõråZ7W¸âYo>½ÃA`}¾‚¥K\º…Ág™½¹½üéúÓ‡åo÷?^\Ý©zr»¾2ý~ñËoÎb òÿxáØ~š,^`ìØnš.öAèÛaàË{qqwñw³¯ þê” -B?±ÃÄëÀ {:p=ßö¿»= =ÞO«¬øYµ;­ðP?NAMZûð²S Ói2£¾ ë?OÚÉz#[kà÷=Öª\z©Õ - vN`ŽA¥ä9—I9Jl -ãùì†þé°k†tÊqLš6kìÚ~äŸ1kG4cV!:gÖ9†Ú¬ÇüNšµÇïØ_¼ÿ c;EÍ+¶#šQ¬SìC­Øc~'Ûã×ù‹kpvªö¢Á‰ò¤AmU-O¾´ËÄK·m&_b†¡'šìRß¡v½n–ÓZÍX¯yNÑ$eZMÑó-HÓŠÀðm©§¾¯HÓ‰îæLf¢L¶Ï:•ïر±}G4c{!:gû9†ÚöÇüNÚ¾Ço" Q½QퟋÜø+hq앉@ÖðÐì=<¥ÝFÅ«.> ÊJß„Gl{ôZÕRi”hÏzß“J›ÏÄf,d™6“ÛntÎLÑŒ™„蜙æj3ó;i¦¿¾™¿{<{8#Xàœñʆsi…ñ}Ûð"ú}¨ ø©åý…V]S•G;õ“+û Š¤ -J¬V üqˆÏñ­g °ðe"/áåvXæåµà&†|”ÜaŠœÁþBÅ–®º2S -èÓqø_éKÊ‘u«è€àfV/¬Ò#ÏNã3 443dšsœá¦xÄì$;fƒ<“:T¼¥ä|^˜qŠÑñÊ/£™JmÚƒ_tàêjpÚŠ I©Û•†äãݾY¹4‘âV-òÙIóÒL||k«ñû¹_×Ãú¿_r¶ÔoèAQå[/:&²°tÒ)Yüi”ø¡Äg.Æ=¢œÑ9 Ì1ÔH9æw*=~¬K7Å*œS V„¾Y”LŠ%ÀXÑM&9ÛáˆÀ2ÈnÔn4ph 7À‘*~ru9˜úDf1÷ 7±ö$´*%Ê#T)ÅÌq¡Í”BB¯ÄñŽG÷=™Ÿ N6ÆÍÓz¶Q‡&€Žz-€«úi.BúZyq/½úxˆñÉ6ŠÛe[ìpEìSÔ)‹¥-Y'i¹5’QšÎ厾UΗg¼3ÄžÕÅ÷WþÔ@³-éjƒÓy×èb‚Oº‚À`Æ]µÕª¬ÊìÄáÔö¢‹¬Fý©×¿±* Ö5[•YWzxÖV ž‹vù<ß–aÈηªÍ¦êg6EC:¥X’©íJíà_~߀”=ѧ b¸çùñl¹GCêÁªk§ÙLh n:Wn`6ðuaaèX_–>Õ‡üOWƒãUîUù¥ó$œüYÕjŸµYÝH·V6öbÛI¹(ûG“Ý>?Wu{(ó¦Í77Õæ)ÇÊÈ ãÐú|õáë»/·Ø§w”íqŸî8 ½ËÔ¡h¿×ôÀÛÖ‡Œr |r€W‘íÅ¥áNè$¬«kJùFµææçÆÖË.€×:vf<[gÛœzè„Ó¶’uòtÔêPHmäöÓò1UtâšèQ ãbÊiÓÕ B2øžª‡QX”dRô:v5_”VÓsÅCðOÓâÛQaǽwë\ÀR` Oå]È|VºÙdí þÜ ®*ƒnüÖTœ½$lT¥Ž­ U¡t}€º««µ)œ÷´ÍTuØQÌ:Uf:øN`'Þ0xÐ'!ì÷TùâÙýcrÿ|Òïõγ"v4Ó~ïÅÔ0ÿ3¿çSÿA—¿*Õº¯/ÀÕ›ÿÀÑE´?íé,ÍxA<—ÂÁ8}‚Ó›Òup­Jt4So ÁԈΠ<^dÇM‘‹Éžƒà„Ó?%¡4ÍîÔìý89n@$Tc µªek5šü±ÔzÐEÖxëuñ°IÕE¦ÉÊAÔX‚çåß Èúk<«ì9ª®pR+»cZµÃrU)^Ï!ó²´}%âj÷KgÛ'ã2­ëŶ¥ZZÉ5X*Á¦Ú›Ë19-ÿìG?Ø=iÎÒfG#¨’Ú¡ È¨cÙK¾ÍV$„©ÎÔ©ýðÀÆf½Ê$¬yy“—O÷»º:<îží¼c¡Êð™—yI÷-|[¿R­ŠÃçL\¯É6U¹=ëÎÁÛ¼(Öíð˜ïtÈ÷¨“Þç Ê~OššzupbÌ¢‡–gùVTMRQ ók¹Jð—Ò&Œ’)ïõ Z[ó%衪;ò\ØlM¢–ÄÕðz­˜ó”ƒ©Rg·gv­³~‹éž~Aî7…%½rúÖuv~tU¡Â¾”„‰0´ÿä/Sð—åüSÿ§¡+Q;M&~µ =Ïö\# çRçXbýŸÆ"ÿ¿ êendstream +xÚÍYëoÛÈÿî¿B +„ŽÌ>ù0p\ÇéåàÄWÛE[äò–h™0%ú(ÊNú×wˇ$Rq[È-wggfg~;;³+'þ—“ØB'“(«åd¶<“ŒüåD: +ß‘ø=š?ßž¼}oÉA"’Éí}Ë'MÂÉíü³wþËÙo·×S_kíILý(Š½÷Sé}˜úÒ»¼€ÖO<úîÃõÅùíÕõ4ÖÞ?¹ëìÓ;lïÈ~9»¾pÝS{ç8ÿçßÜp÷ùÕ§Ûkºº¼™~¹ýõäâ¶]@o‰RkTÿ“Ï_ÄdKýõD:‰'/ÐL’ÉòÄXX£Ýwqrsò×–™ ϲVCáË$H”=lÑ0 B¶U0*ƒÄÚ¾E­ B‘EÁˆ*€UÃ?¾µÂû˜®ÒE«˜!Œ¼wh쨲Yírªá#ÏÖcFmµÒ‡µìhHKiü®d`…&-o²*cߥèâÚõƒûh{îà;]7*ϸ³|šú*bº*­a /Wk»‡¯²b/‘ ]!‹EŽ? ¦™ã X>×%ŠÄÕû50ÁÛ÷¡êi¯bt¤…õ¢â³*Kë !Ÿ¬ÈÈ„Ü¡Á¤«t™1“-HX»V “`ÌÒ|=€¾(‰úôúôú *H’AwÅŒ(ðV`£-Ôíþ¶þ•‘Í &Q À.ƒ·LÔP5Däáizé]Ñø2¦ý-lcÃÀ„‰3Íé®i”†-F“ž{Z64{ZnÉÙå„â>¶èX0d† í5¿4H¬¸cƒóó¯ü‘®æŽŒÐ6/1Ú¼ìí+c1Ê¡%í-M 0m„1CÃ:ÒÚÀ@TÐ"0êLK> #b–Œ²¡IØpËQosñ¥UA@óÃH€,3›Ú‚5"Px¡[ÎØþ°«÷à ÝvÒcùß+Ø0;¬ q £m?Þ0¤ÿž¯ÀËZ¡—©ãÃÏÒžù®öÚÄ N|íf‡µ×!€MF[ÚÿíÓ‡pcuQÛ债Ï©Ž¤.t‡6)G­  ƒDÇ jØR`A°¤ ºc€\\Óq5†ÑŽë10zHG+1ú:.]0º/‹ysªV£ˆ<†®"éª# Š·U}œSFò +…[LEá>&ã “FA.šŒc221ÊåT”Œƒ±cw 0RNYÄRn)W5`Ä€ó<C݇ÔE<&Jm«»üÏyä ©Ðšr È5œ„ZÊrq×eÀì؇”S•ÒË òn÷½j|ý2¤‹Ðcèß!ôþ6”ÌÖ–S¨€žŸeÙækÐö( 8"`!‘ ó];ê¦ð”ÿ[…Î;#ŒßeØ$ "®“F+oð +­»_ykWy¿ÇRd\usi€å7V5äŒÂ«¾q×Ùlå'×ðy^®ê +\:\#ÚHAApøΠG3Z[#Z,A5Žé òVPÎbÉ‚Ø¢âç‘ûÓù’*šœªäGÒšªlÌêý®Aqª³‹oÍDøzÎׄF´@ŒeA%=ç +›ÕœØæÄ!-x¨®Rº¼hËwèkÊz•x›´X;I+ǾÊî}´]ÿ,-1ã„mÅ—®$µõÖ.ªÃâ/ë1í‚n&ædëý.¤)ÜT'ÐE{iŽ%§B/^QÄ v™¯ùú‚–EB \a¸†(Ô©„¸Iïãf†c,fÔ¸kî•¥b·UɈ :¨fbüH9úÀ²°pÆ^ô* +bÛ­ËÊQc†\r“üV:c!ç—O´O¾2Ñ}:Ë‹¼îÞØ]än¥øõÛÞëöûK†ÍDÆ\·U»ÁEÖ®(ùà˜yé°üžPÈF͸P½%T Ýuä!¡dy)d4.UmI5£Rw¶Ç÷¤)‡¯”îJµ.ï?6llJ|c³,ðì]69âš»Ó;>ðÐiNHìoÁ§ö$^g|41ž[0t_a†cŒ #HR¢ë(\^ÔpË4ϺөÚx<ƒ¤'Q•§ÀKœxçˆYž´øûâ½‹Ñ }«Çn]uÙ¨éÎÇŸ|Ư«¬r°‹ªÜuR»T½yܬ:Ò|ïQCë$°ÊL¤‘ôuU‹ 7®ûOBŽÚï‘Üìð¤Ô£·PÈÒí+a§`‡ï]È(}ÕöŸ³‰â°:Û\ÚGP\ Ôª¡ÜJ‰Ïh+a!¥@»œ7VTYz¯ãÏ%•! ]ktÙ´[%ãäP2$€®?ÄĘ®çÚښTAa#ûcƒÝÏSk±Lm +·ûQ ~ßœ§N觫Û7Üâ¹ã{ –ŒÖui“©2¢Þøo‚ ¨når ÎªÁí1§wÎ~­­pJmÈ*”1×½'PA&Yñ6 ô}®Ùa² Z_¸h³À¼”—yŠŽQü¨/¼ŸyŒ—€ZUn ÝÍ+̳ç|ÖEŽÇ~7ÿ®pg̬Gf=mÍzÊ;݇²ŸíÙº _?³š‚C{ïJ*í©}³«2¯ÇÞþµ ŒÖÃw^ß¹Æ}ÕW{9dâ ‰GžÈ­R’­2|«•ìjluØX¨üo¾ÿ2:endstream endobj -4741 0 obj << +4852 0 obj << /Type /Page -/Contents 4742 0 R -/Resources 4740 0 R +/Contents 4853 0 R +/Resources 4851 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4739 0 R +/Parent 4860 0 R +/Annots [ 4859 0 R ] >> endobj -4743 0 obj << -/D [4741 0 R /XYZ 85.039 786.531 null] ->> endobj -942 0 obj << -/D [4741 0 R /XYZ 85.039 477.837 null] ->> endobj -4744 0 obj << -/D [4741 0 R /XYZ 85.039 458.965 null] ->> endobj -946 0 obj << -/D [4741 0 R /XYZ 85.039 316.648 null] ->> endobj -4745 0 obj << -/D [4741 0 R /XYZ 85.039 297.776 null] +4859 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [338.528 138.234 418.097 149.923] +/Subtype /Link +/A << /S /GoTo /D (access1) >> >> endobj -4740 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R /F35 2880 0 R >> -/ProcSet [ /PDF /Text ] +4854 0 obj << +/D [4852 0 R /XYZ 85.039 786.531 null] >> endobj -4748 0 obj << -/Length 3318 -/Filter /FlateDecode ->> -stream -xÚ­ZYsÛ8~÷¯ÐÛRUC‚÷¼Mâ$ã9âÙX»©­™©-X¢,–y($Çÿ~ú]žÝÚ­T"  ÑèãëfÂYÂYžøAT̲<õ“(œ­š«`ö3®B¡XÉ¡y³¼zý>gaàA1[nì>Eà'E:[®óÞþðý¯ËwŸæ‹(Š¼0öç‹,˽÷óл™/Bïçw8£¼ï?^c#ö>½ƒ©·8u O2úóíÛŸn>~˜ÿ±üñêÝÒråðFòôåê·?‚Ùøÿñ*ð£"Ÿ=A;ðâ˜5WqùII¿¾º»ú»Ý‹çâ¯:'‚$Êý$Ne%Ž BUøqϲXùì„BøEû¹j¯ËZ?ÃÕ’,{~ø÷õç[¼ õƒù"Q‰7vüÁ« Á¡\uízÀÛ'‹-hãër£÷õøÓ¥’¼~ºü,R_eÀtøAžÑª»Ý|¡2¯\¡˜«ßƒ0Q—Øp¢ðÆmÉF«š¹Ê½}#3UƒSyàéºîpæ ÿ¡Åk$ɽM×sC3a ›Ãåyl "ÀÏó<ò@b•z7Þ{m¸a††¾Á±[ºGÛjÎLÃ9-ñ }`8óîùŠHÜÃØ+ÞBÄB"LHã–OE-è€þ+ݨg•]Wƒ¾¯ù !î¨ñ”'&ºy}Ë Ý®¹Ñí€Åœ{RûÅ@'Œ_w"Í -|¬æ'6Ð세æÀ-A‡d-¿ÞXQÏç‡?TÄÌsuð𷻺[=¾éKýøYWãU u1ÿ/õ0JþzEëa‰Èz3£ÇšàÌ먜™7•ý6Œkþ¡ƒëÊœJd¶íø·/i_æ´ãç…Y|fM·‹jëýP£ÄЈMš\áK2§h•_@ûB’&à _Œc ¹p“±Å)YN¨ü(T3x!? Ù…ÃloCÞ¯óH$ÛdÔcÙâÝÓÌ»F­ I½ÒÔ{Û!eO”û™ê~ãÔ/Tñ2à q|`\–c•øp2qŒn5pµè„öÜÙ²çʽ¯â¶ãT‹œU]¡t‘,~ ÃÛØ8²§xùÚz¶Õ~` -Ù5®5[ˆ«Æ;-–ßóä=ªöÈmxZÍ­U×÷8a%wätvèX»ûºlP[•ŽBCëƱÓàÈðÜìÆŽicñÍe?ˆO¦39(i:ÐhÓ ’®)å¼ðºÂ%ÀÑ`wkå‚täB`†Le[’? -wtáïèRg\Âçy“§Ëaσç‘• j - ¡pº/ݸ3ðà†dÕpg]~µA»îÌS%Éœ+.Ã68vÙ0a¶%ìg|Ä£ð‰¤=rÃN×2ˆb-”7ìÙ„y=\ô‡hu‡ ->lLø¨p Y©7”rììÁÎ`øeÕ.M\CRs8uœ%6ਣ-Ÿ¬7£cL8b”¬Ô£d4L7^—ßøæø -àG ç§6ÜŒÂ7 2㜲IÛƒœE “}I^¢ª×Ü·À hØgà(‚ˆC6W-ºñ$KbM¼%£*¦ƒ`D‡võty™]AôíC„kñÇjàŸrÌÄ™Û>U#ê -j‰Á,4nÑHo]âZ‚Š¤D«ž´kh¹}±„`ØB^ìXqÜ·¾7"üÚ›²ïÉE?˜̦ÊÜZèzrÂÃé½:z”°07_DJ”2M¡ç@I)°$:zŠÂ[bÛñ×Ì… -Å+îÛ‘Ë…ÁÇ–`âð–GšrÜ2[³úã&JÁº³&Ö$t!Ùäø”‹­àV÷¬êg.¾!Gn@¿„;Âÿ{Áî? Ë]Y·ý xç 6”—à $¤~ Ñý%xàÐ\4Q®ü4  IмíšÆ`C1ïú€K€èæ?²Í‹üL4—áJ”侊`Ý P("oè Χžqe£1I`6FTt³5ùøª4QêÕ9G·-É÷2Ô…<&¦ëqÝM±là!xC Ùèy{6³‘§ž*„ªxŽI`ÖRÕâ^÷äêè:ë•Mò9²Ü È~%n}à,’Ä,ÜUf-Î…§H™á§çø$ ¶Ý¾ž‹7‹'%ÄΦ;Svg¹†\I•À ¦ËíñýF&qœI­Fßײ_·;æj‰–·bìË8†gl Š°yïC¬¤¤Žó)ê®$KpMlY£sc˜q9 -ª7ØÜÜ!q% €}åfàLBr`§ŒÚh8÷™³V¬l}©6 ä ×ø……Ù B[®8¦RQQä™ãG.,ù—‚AˆEÊ,|98D—ƒ!ú‹`ðâ NÎ; Üó®ËS6Š¢Šâl-I"{.& ¦„„A÷KŒŒÑÇ&XòÃ?Þ˜XÐ{Íûßa5ª­2¸öCL^ÚïG@\ÉïCÙbŠYóSánš'¨~¡ )ŽšêôÄ̼ Šä9`HbR:õz¬3tƒ¬!±dSQËh±)‘ôkãâ¨d‰þ‘òЇ-‰9³®Q‚.?NFž8ŸÿèœD+)×ËÍL*ìÀI ËTA«ÆªêJv“O ÐÚïdD푃‘ûÛ3…E¶¡áãQ±_¨è/Œg"zÁx„诌ç¥ñŸwÖxœó–ïãàèipDüŽ-ÕJÕHÐkptKç[V?ŠîDZìj-¹¯©»nH´£ê®qÁ‘xm${ê©2>ºLuSQ¯gªË•ãÊ=0ÔTá+¬&oµ4ŽDÇp“à̽ñÙ°PØ‘ž›zQµ²s:!"l©ù²œÃtÂû‘NáLœ¶ù3LFüc“9Ø/ r±/ÆKö6r¯÷öó¸Pm¥q^Cÿȼã„TU3”ÍRT8&½3z°X"p-E5d›sÓÑJÿ‹Ì£ÏÞÖmG…Ôs‹L|üÈGxh*Ç9{ºSÙn­,L1½Hq ~öxXÔ"ó>Þ.y›cï…km‚PäöK.4mż«±ª}âuk¿?€‘‚äd/0 5ÆÇô)«kíPÙ±SÁ51UàDyMU×\‚x€¿Ï†ÓÇ )å72/ß¿AÖ8t`»¯øs„Öp³ÊÎÔØ"•š u¤3SõÀ -ˆ4Øm$Ù¥¼0fͶ³¥ÖŒ+Ú&•¦.ZËN2É5+³TNƈn’ÑKÒI•žP]¬]&~õÑð—åó?ý7"[s¿ÈÕyGŸ(å«Ð2ÃåØð˜cóÿNYþõf"endstream -endobj -4747 0 obj << -/Type /Page -/Contents 4748 0 R -/Resources 4746 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4739 0 R +806 0 obj << +/D [4852 0 R /XYZ 85.039 766.606 null] >> endobj -4749 0 obj << -/D [4747 0 R /XYZ 85.039 786.531 null] +4855 0 obj << +/D [4852 0 R /XYZ 85.039 746.277 null] >> endobj -950 0 obj << -/D [4747 0 R /XYZ 85.039 565.53 null] +4856 0 obj << +/D [4852 0 R /XYZ 85.039 704.637 null] >> endobj -4750 0 obj << -/D [4747 0 R /XYZ 85.039 536.126 null] +4857 0 obj << +/D [4852 0 R /XYZ 236.167 710.611 null] >> endobj -954 0 obj << -/D [4747 0 R /XYZ 85.039 398.412 null] +810 0 obj << +/D [4852 0 R /XYZ 85.039 599.775 null] >> endobj -4751 0 obj << -/D [4747 0 R /XYZ 85.039 371.798 null] +4858 0 obj << +/D [4852 0 R /XYZ 85.039 565.029 null] >> endobj -4746 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R >> +4851 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4754 0 obj << -/Length 2373 +4864 0 obj << +/Length 2235 /Filter /FlateDecode >> stream -xÚ¥YëoÛ¶ÿž¿Âè'¨i‘Ô³Ã6¤i»›%MÚ$@1lCA[²-Ä–|%¹Iî_σ’e[N2 A"Š<<<ßyP‘~ä ò…«ãAÂ×r0]¸ƒ9¬üv"-ÅÈ’Œ:4ïïNÆŸo ]»ñànÖò‰]áÇÁà.ùÓ9ûÏé—»7ÑÖÚ‘žŽÂ0r> ¥s>Içò#®(çôê<çæ#,áÒ5 nììåõÙÅùÕoÿï~?ùx×JÕ‘[j2ý÷äÏ¿ÝAòÿ~â -Gƒ»BÆñ`uâùZøž¶ïË“Û“¯-/^ó¼«Ï¾Ž„éCH¿c©c ò¡ï‹À É´­g Q¹?êW—02u–Ïq5tLžØ?~ Uä¤Hù˜å@:g&Sœ^˜å¦h•ÖhÆõaãùŒd$|±±ü’tiÕÓ0òÐVžï:ŸÍ=›ùP‰jS¢¼J ²PÒšÞðÄåpä) -exVf›ÊCÈì-/Aö¤µ v¨ÊË‚ˆ¨"‘±1G'“힒ϨMY[þ6OSJ9„¾’"|Ð-E€žÐ^Ð @ßõEÅM†{^윢@I‚™³çŸÀ¹Ld\Êúr5„Fü¼H[šžžÀ -åEnŒþFš³>8jE¹‹L@í±á,É3MƇ!–”÷<…­EQò˜ò-0ݬÙΆÁ+\«ÊŠó¥gS82§*`ðç^¨ŽÀÒÚ0›”³)oËy­@ìÙS¿¡>é„_*Ü~ˆþfã‚Jfÿ¸U­äVÆ ¡<çQ rÁ‰¶Ç¸#,¼í Ëø†yÊ`8س 0¥* BP33£þƒ½aËï³]׶תD~Ÿ°³ 7`$.ŠÊJŸXm´åû\SÕ<Â68ÉꦲÑPËh‰É_ð¤Ø~@00‚šéú›š€ï.¶R–¬›ÅoWÁÛtº-¶}<>gÓ²¨Š™=ûó-,}¸â—ËlB-oc„'˦a·æ㋲FÿæYUCR¦¥m¢AÀSÉì+×Ûæ”ûÈMnam‹?²‹ç²›·*tCíHù·”ƒeYØn·äù«´æ‰$ž÷åÂË"WâAÍ)Ž¶ _õ"zÉýÛƒ^ˆpìe7®)]D$6I¢ MÅÌ^ aô<6QX?(¬þ±ÞñCÙ¤ïƒ&Cz‘Ý`¡S\Ôq¡œ[Š›Nyo¨Gòžz'J°¨ë5ÜVWU’‹U“[Ä´X—Mù4Nó´i³©Æ3ðDVŒ«º(Aßý§{-LµÞ—݇#]ïʾÿ•ÂÒH¼ë.ÈQr C-¤§IâÏm -h!Hw¹˜sÇÒ–"®êó{¾ßÃè”üÌ~kà Ó_•òâX1«7èZ“Ùð¤¬Ô~Ù€å;ì J“WfÚöfÐKœÛ†>Ο—Tñ¹/8ÈŸÖÿt÷)ߣÏH_ðûbüÍ[DŽÛ£*’n‘U6Éé¡98]—”@¤ÇñÛ}Ç@‹ à‚¥ýXøp‡zS–xÔ¡>„ÔÇ¢ªÍz 5²*>t¼2ê–D[’ÎÌfY#œ­¦Yòóýä§-ô~j<´¯Ü2à -1Ç@îòz¡ÖÐŒ:D‡PÛç„‚5"»! p7r{\ãI碂ÊÓ‚8ê NUq _”óæ¬@ÄýåJoN]d@\¼îï@péò°á…,?ŠÁƒâ‡Žr]AèIý|¢Ú8r6£ŠàhïsÌSE¤ŒD 7£W"rK}‘–æŸ"²ùõ*H²ÇŽA®v ÷ Ü=IKôÏ! ™ê"§k øP™¡ûï4VðÖ@riß¿J+WñË›/ü©Ç1á¼ (—zÿGú†jš¼öž‹m7>wŠ,îÞäYsµ8ÚX2 £p·nƒø˜à°kŒ"çêŽh<‹]äÒ]ÜyJ_õ(›Â)MýìzÊ´h*Œ„j>ÆoC=ê¢wŸg|mW'ñ"¿ãÿÝòý"z­÷Ñ…"„^ €-B¯ÿcBC3êõ wS‹ÞžO´Ö½_á—5üWÿ5i¿@GGš _)hS[aø“Ìš¯Šü–¶hÈendstream +xÚµXYoãF~÷¯àÛHÀ&ûà1oÉx×,’KK´EŒD:$5²°ûã·®&i‰žH‚FÕ]ÕUÕ]_tä…ð/òR„:ó’4¬Ž¼åö,ôž€ó³H$|ñG2ß,ÎίmìEa…™·xìõda`³Ø[¬~ž]|ûñŸ‹«»¹¯µžE:˜ûI’ήçÑìfîG³ï¯€zÏÜË›»«‹ÅíÝ<Õ³óÖÇO—H˜Ù=ˆ}ûñîJ¶ç*]àù <ÏÛ·ŸwȺýþ~þë⻳«EÑ#­ÑýßÎ~þ5ôVpÕïÎÂ@g©·: ¢,ó¶gÆêÀ-ëÍÙýÙ¿z]Ì3Ÿšz-'á«0H”:5—d‰˜ÓGæô‰¹Ðó£ ËÔ”%íD1èÔÉXäD40Ö"Þo^`BÚw¿äaj² M2M;:‰ƒ /(ìó›mê]Öà˜7øæG& +Rz~ê L{\ı—ü°Ð¡ tšz6ɧ„‹_Bæð_t¨(³U‰gM¤*›ºÑÉs»3þè{¡Fè<ÖŒn\—O»¦ø¤„Nòæü:²£c± +BaHòŽÝU± TO¹Û»çdNÜ{eçXš»ý‚p.š/%À¼@Àïêõ#ÿî*ä¼ðâyî“ô¶l[”-ë +˜-gÐ/adŠÍêØ£Ò Ììמ»¿‡6bHxz&ñÔ]« + ý¹CÄ« ±Mâè)G#kƒ(…K%MìB™2a@ð-Ä,4ê(²“Á ^½@ò-Fä¨MÁ¸©ÖÑ ¦4T0μ‘¡ÓXˆÌ×½9Öôw®K^û’j(jÊ—SŸDöÄ'=ö)Š2ÒžITAÐ'¿Ù¿4þ‹ïûàÄcöC‘W퇹o•-Öõ¾*&±|ìÚ¢¡ +B;˼b¢)òÕ{&÷MÙB/År×ÑýÀÃåb5=蜑§¦Þ=O¨d*¯V§êBVd8g‹/Es¨+QWlÚâHÛ§Û«Ú)=të²z§ËnÍTÙ½ÑŌʨìÿm Ø·{£  X=.ÒYL ÃËS¬ŒMI]W4-/þáý©íÞñª¥BÖá"¡š•piê ±®äìcÝ°dçT︨AAl ¶&MgOtOaèP˜â„D )¥³ásÆf³±gZ"‹ZQ @ˆ"µÂvºbØ3w"è/d‚ gI“ç)$Û’x$7D>_ ˆ˜(›bÙÕMYеÓN –wñÉFÙÈ_Ë@ã¢2¿9ð™ò‘º{£Ö~Iurñ lÜ¡>_ó“ñ6½D¾þ:oïÞêIÄxÄp5L§ÞJ%Å—Ùø ?ÉôâE'°•àr_”ߧ ¸º¹®Ø¼d¨ fú8S]¹Äüù0ÈtÈÜåUý“/ÿc5ÐhâlˆAŠ¦dö¶Ì~(;&( ðÛ_ µ(Éùç$J©ÁÁÙ†Þc¶l/Ö{‘‹J‡5Ê¿º<¡nãEk.-Q¤ÚÆÏ4¬XcU@¦“aTîº#TÖCÙVå[: ‹º"Èõà £Èœ u'rrò¿²ÆØ às"¶ÑìÇ’^ºÞuNTÞ=°`²Èó÷6a§ÃD‡¤‚ÊL Õª`üa#:v ÉQE@FÝ{6qéŠJÌŒ–Ø pçÜCð'1`3@Éuë‚9í¢…«[ˆ \Üîñ%†\È(eåËšmáé9öȬ)¾+>Fɻ⽃[?¶˜©ågŃdt͇&KÂy·}–l¢¸ä§y.WDzJ›•]å ¿›e*‹ûh«,2CiÀU-¿Øàç&XÑWè%ÓŒ VDÅ€+1²0CI¿ë]¤QÈ™7•]P|ñî–uáÄ7&$’|zÉwîv+Ú3¶K9\Ší½k”NÙÚ©ì“lÁ‡IŸmH£1УBÆØ@Ïk¡‡C¹ýºnéH:{×WênJŸOúóïx›‘ û™a?¨Æ‰¯lY„†&öZ +JËW‘\¢Ç‚úùMmÄ@5ñbŠJ?Î\ +b´£6uÒ +ËQQE1®¤H¹î…ô~Í=bÍËRDäv +êôª×øX9]’ ¸`H #Cï›赫Š Š8!ý•lðÏÐñpÕ®éÉ7b¬=:ð°™‚ V3F<43é¶hšBb4ð¾CƒU…Äø‡aýžC…Ÿyµi·!js+”H1¢ +¾j^ý0Ø€ËR,BtJ8œI÷-ƒYüFAÓ_:ìÚ’!ä6ã÷°'Y£õ5š^|rNÌx×ÊØCØá¶*}¼KJ®êÎÕÇÂ/"¤Ü%µ€„†’]_tõ1dЊ\{S#¼Ioýº¦§…T+¾ü•þïºð(3Jy”nö~ó¿ÿò¢ãÄŠ;V^µŽ‘wŽ*˜¨ñûj˜Îi—^¹ÉœÜª„€™4•ái‘Ê5Ù}9EþdêSÃ× +€†E£Q®›Sƒ¯æ¾© Úz;<‚/]÷ëDl[Ä÷SËë¾¹<‡ˆ¾yè(y œa*N/?À›²us–œ‡EE5ø&c’ý ÀÑGÆÁéVÙkØ˽š…\p°.›H† ùH–Ž Æ3 ,\ÜÌ8–ªnvNÅä,Š ì»nB3}7£Ä€;«Š=¯‡`rXÁØYàþøKÞ<þIÑ@hŸTrÙDâ²™úPÂÝ>ÔF" ™‘tÍ™øBCA3ð9‡˜£á‡7¸Ú‰:ç ×þ˹12[0£/0°Ú[L²Âå­îKª'&úÊè0¸ e…ªª–ŽÔЬtÄq½H÷=¿ (ÚmðÆ_7´ ŒÖÓÜßþ¢?n¤A–¾ñ—3«T ¢Þ|ŒÈ„Ç[6Õ.ÿ[Ð/endstream endobj -4753 0 obj << +4863 0 obj << /Type /Page -/Contents 4754 0 R -/Resources 4752 0 R +/Contents 4864 0 R +/Resources 4862 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4739 0 R -/Annots [ 4758 0 R 4759 0 R 4760 0 R 4761 0 R 4762 0 R 4763 0 R 4764 0 R ] ->> endobj -4758 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [147.71 383.271 511.015 395.264] -/Subtype/Link/A<> ->> endobj -4759 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [367.133 356.173 512.306 368.166] -/Subtype/Link/A<> ->> endobj -4760 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 342.624 331.441 354.616] -/Subtype/Link/A<> ->> endobj -4761 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [367.133 315.525 512.306 327.518] -/Subtype/Link/A<> ->> endobj -4762 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 301.976 331.441 313.969] -/Subtype/Link/A<> ->> endobj -4763 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [424.405 274.878 512.306 286.87] -/Subtype/Link/A<> +/Parent 4860 0 R >> endobj -4764 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 261.329 388.713 273.321] -/Subtype/Link/A<> +4850 0 obj << +/Type /XObject +/Subtype /Image +/Width 602 +/Height 267 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 7907 +/Filter /FlateDecode +>> +stream +xÚíLUçýǧC°p'süh7Q+P©÷J·XìRÖ`§Ù Q»™iÜ’®%”Ç’&EÛ’NÀÒ®»³À„¸îGš6“ëh5‹.ÙIœÉœé¦ÝÊ¢ØÙué2ÙÄVP~¨ðýÄ“Üï͹Ï9žË=çþ8¼^ÃÃåÜç|úœÏ‹çyìcðÿL[€*Y¯õ¡VÎ݉öÂ}‡ éðÔ +°ö"­³^jE­èHÀÚÆTŒZQ+:°ö°!£VÔŠŽ¬=lHŨµ¢#kR1jE­èHÀÚÆTŒZ%x­ð¿kܽöycCl8j¥{ l€ ±!6ĆØ –k/üßÕ®X±âwÞ‘ƒ¿ýío^¯7ø²öööeË–¥¥¥­_¿þÒ¥KÚø7vîÜyûí·ÏŸ?ÿ¡‡úè£ÜgC£uâĉûî»oÞ¼y999?ü°yAä»@~~¾¼Þè{“´ÃOMM=ÿüówÜq‡\ryyùÇ?þqå%_½zõñÇ_p“šššññqóò-9ØPYŠð;Q>þüç?_¹r¥Ðçó½õÖ[q_cØfÕÞPn´––9x饗víÚ|Í /¼Ðßß?::úÌ3Ï<öØcÚø÷¾÷=鄃ƒƒ###O<ñÄ£>:{l¸xñâžžž‰‰‰sçÎIÌ "ßõì³Ï—ò{“´ÃËjikk»råŠ\ŽtàP…^òŽ;vïÞ-ëG*óâ‹/>ýôÓ·´¡rɹÀ†ÖKQWW'+D +»wïÞ{î¹'îk ¬²¡l ¿üå/ËÁ—¾ô¥Ó§O‡¿æâÅ‹¹¹¹ÚñwÞ944¤Ëm˜••5{l(?œÿøÇ?ÖíYŒ +¢;‰ò{“´ÃHgVê,ôe‹- +¾L.£˵ÿûßÿ§NTlîܹF=jdd¤³³3;;Û¼ ÊYé¾7I;¼Ì_v.·´¡¬™à>E–ìÌËk´ä\`C£RèîD#ÆqaCp· /^ÜÝÝzžÊÖ/¿ü²\à{ï½·cÇŽàù;::þõ¯Éøï~÷»¥K—šD7+å÷&i‡¯ªªÚ¿¿¬¾¾¾êêj#nß¾Ýï÷‰:Cÿg™Qy–œ lhT +ÝhdÃ8®1lî¶á¡C‡–-[&?¢ÿÄÀÀÀÊ•+u3yðÁÓÒÒrrräf”8ƒ°^}õÕ;ï¼355µ¼¼ü7ÞpŸ ßzë-©FJJÊŠ+^ýõàùÅR _µjÕŸþô'ó‚èf¥üÞ$íð²Íy衇dm”••½ÿþû™™™ÊK6úR£ò-9ØШº;ÑȆq\cØÜmÃpvïÞú˜t:Þÿô‰o˜ø^˜˜˜xå•WìÚÄÅì¿#ÿ6kOÉÔÔTaaaècRlˆ ÍY²d‰ìAÒÓÓ7nÜøßÿþÒ‘X{ØpÖî ©µ`íaC:<µ¢V¬=lH‡§VÔ +Àѵ‘Ú¬wx VN܉ØÒá©w"€½ð»Üü þÕµâ_XpßaC:<µÂ†¬½Hë@Ŭ×ZQ+:°ö°!£VÔŠŽ¬=lHŨµ¢#kR1jE­èHÀÚÆTŒZQ+:°ö¬OÀâ 6¤ÃS+j€ ±!žZQ+lˆ éðÔŠZ¸fíMMM555åæ榥¥=øàƒØ0ôÌ@ ??Þ¼yº/Ý}÷Ý}}}rÐßß?gÎíøÝwß•qÝ+{{{‹ŠŠ&&&äxrrréÒ¥]]]níðÉR±øÖÊ}ë +Àk綾^zꩧäž:uê6 =ó³Ï>ûÑG…é»ßýîË/¿,?ýéO=Ï‹/¾(ǯ¾úª¼>üÅ{öìéèèÐ^¼cÇïw’¥bq·¡ËÖ€;ÖžüŒúᇚ‹oÖÚÐèKo¿ýö–-[ä`ýúõÒ”JJJäø±Ç;yò¤r÷ýè£ }ë[ߺ~ýº»m˜‹» ]¶®Ü±öRRRä¶Â†‘^õç?ÿùááá‚‚‚7näååýûßÿ.//7zqooo]]|ŒoÅâhĪXÂÚ0I×€;Ö^nnîøø86ŒôªwìØñÜsÏÕÖÖÊñw¾óÆÆÆ'Ÿ|ÒèÅò%iq_ÿú×gíÞ0¡*–È6LÆuàŽµ÷øã=zT~•ŸBëë뱡ū>qâDFFÆ‘#G丧§GŽ;¦|eGGÇk¯½&{÷îݹs笵aâT,‘m˜Œë +Àkoppð«_ýjZZÚ’%K~øÃbC‹W=55µråÊk׮ɱ|\±b…üDþ²¿ÿýï^¯W{ÙÄÄD~~¾´¸ÙiÃÄ©X"Û0×kÏÝ6t_Ũµ¢#kR1jE­èHÀÚÆTŒZQ+:°ö°!£VÔŠŽ¬=lHÅ’«VŽþ 6¤#AR¬=ˆÔ†`½ÃµrâNÀ†ØO­¸xÂF}¬¼ÒÝ5tâɶ[+ÆŠÀ†ô.ª„ YQØÞE•°!+ +Ò»¨6dE`CzU†¬(lHï¢JØ€ é]T ²¢°!½‹*aCV6¤wQ%lÈŠÀ†ô.ª„ YQØÞE•°!+ +Ò»¨6dE`CzU†¬(lHï¢JØ€ é]T ²¢°!½‹*aCV6¤wQ%lÈŠÀ†ô.ª„ YQØÞE•°!+ +Ò»¨6dE`CzU†¬(lHï¢JØ€ é]T ²¢°!½‹*aCV6¤wQ%lÈŠÀ†ô.ª„ YQØÞE•°!+ +Ò»¨6dE`CzU†¬(lHï¢JØ€ é]T ²¢°!½‹*aCV6¤wQ%lÈŠÀ†ô.ª„ YQØÞE•°!+ +Ò»¨6dE`CzU†¬(lHï¢JØeÎ?ÿùÏòòòùóçËÕ­Y³ÆÆš‰ÁâØœí°}J{÷î½ãŽ;-ZdòF1«$6¤waCl8;WÔÔÔTqqñž={®^½š°zJ:q’´´´óçÏ'`U±!½ R«ÙSŸ“'OÞsÏ=áãË–-“‹3gÎâÅ‹ùË_+ É'žxâ›ßüæ‰'"íÛ›7o>xð tww˱6("X»vmjjjIIɹsç´ÁÑÑÑÚÚÚììl9OAAAø9uǺ­“òœQŠL¹;Û·oßg?ûYÑ™Œ/]ºÔdJÖwÐ&ߨT^¦Ñ”°!½‹*aC{WTaå’»ºº¾ño}õÚµkøÃrssƒøÚ×¾öŸÿüç÷¿ÿ½è2Ò>áŸÏwöìY¯×;00  nܸQ¸ìL8|N[]]ÝÞÞ~ùòe#è®N÷©òœ¶lët_úÄ'>ñ›ßüfbb"š}œñY¿L“)aClH•°!64"(møî»ï>üðÃùùù·Ýv[è¶EvmrpãÆ[îzŒÞÎãñìß¿?8’žžœð¼yó´Á­[·šŸÓ܆Ês:aÃ7ß|óî»ïÞ¹sçàà`ìm¨¼L“)aClH•°á,¯€ þóŸ‹‹‹ÃÇïºë®çž{îÿø‡è/Ô†»½ÑW¥WK—½LèöJ3l(Á稺sŠ…å`||Ü܆Ês:aCall¬¥¥¥°°ðG?úQŒmht™FS†Ø*aClhÄÔÔ”×ëmooÅè:í_ÿú×?üðÉ'Ÿ´Ë†/^ôù|§OŸ–r¬ >òÈ#¢ÝK—.…¾²ªªÊï÷ëv7yyy===ýýý[¶l ß%‰¸ƒŸ*Ï©qÿý÷ÛkCáúõëï¼óΧ>õ)“)9aC“ËTN bCª„ ±¡ Ò´×®]«ýÞEð?ýä'?!~úÓŸÞ³gÏÌlþÌV,ÖÝÝ=}ó·häX¼råJeeeff¦¼,++K©©©‘Oe0''Gó½Œí©…QD9yå””¥‹òŠÜš„ˆ ±!6LäZ¹+—ìP¾aGGGcc£¼þøñã¡ç—‘ÊÊJ]pátq~¶cRðÉ›LIW:[®È}IˆØbÃĬ•Ë„håzÊ7ìééÙ´i“¼f×®]uuu¡åU†Í8ÎÏvŒ +¢œ¼rJÊÒÙrEîKBĆØ&¬ gåö÷÷J³---mii¹åwE盂('©œ’²t¶\‘û’±!6ĆØ0Ap(ßPÈÊÊÚ¾}{JJʾ}ûffC{S £,ˆr’Ê))KéÙkÄMBĆØbÃÄÁ‰|CAv…@ 77÷èÑ£3³¡½©…QD9Iå””¥‹ôŠ¢·aR$!bClˆ ±!Ø©…î¾7±!6ĆØ€n ±!6Ćt{lˆ ±!6 ÛcClˆ ±!ÝbClˆ èöØbCl@·Ç†ØbCº=6ĆØÆ'âü´šÏ;·¨¨èСCQž*. &f“w_j!6ĆØ&ÅùiŸœœ<|øpðO¯$‘ c9y÷¥bClˆ ±aÒáP¾¡Vðñññ®®®Õ«WkƒÖÓûúú¼^¯ÇãijjŠ— c0y·¦bClˆ ¹V³+Åq(ßP›@zzzssóÐÐ6h= pݺuõõõccc­­­ñzR³É»/µbClˆ É7 íÛ²…ììì ZO”­M0p!^{ØMÞ}©…ØbCH:Ê7Ô¾:<<¼jÕªàC<ëi€q·aÌ&ï¾ÔBlˆ ±!$å¿zêÔ©ÒÒRíÁõ4ÀŠŠŠ††éê~¿_÷F6FÆ~òöÚ0aS ±!6ĆŒ8‘oúÕ¶¶6‘Åt$i€gÎœ)**Z°`Ass³îì2Œñ䣷aR¤bClˆ …(ÃYØÇ°!6Ć@·Ç†ØÝbClt{lˆ ±!Ðí±!6Ć@·Ç†ØÝbClt{lˆ ±!Äçò c–Êgï[˜œM;hË”È7¤/aClqÇÑ|ÃXÞ‰v6ë'!ß¾„ ±!ÄGó ulÞ¼ùàÁƒrÐÝÝ-ÇÚ 2¤ott´¶¶6;;[ÎSPP~Nݱnë¤GÕS,,ãããæ64 +þ³Ý†ÓÆa‚1°!ù†ØbC° §ó C¹xñ¢Ïç;}ú´|”cmPÒWUUå÷ûu»›¼¼¼žžžþþþ-[¶„ï’DÜÁOM‚ÿ¬Ä#FdÃiƒ0AÝ”œ°!ù†ØbC°‡ò ßيź»»§oþkƒÊ¾‘‘‘ššùTsrr´Á#GŽlØ°AÐÛÛ«{÷@ ³]¸p¡É95¬Ä#šŸù^ÆöÔÂ( ¢œ¼rJÊÒEyEnMBĆØ0öU”8”oØÑÑÑØØ(¯?~üxèùe¤²²R\8EœŸí˜$|ò&SҕΖ+r_"6ĆØÜoØÓÓ³iÓ&yÍ®]»êêêBW£2„hÆq~¶cTåä•SR–Ζ+r_"6Ʊ¬€ åö÷÷J³---mii¹åwE盂('©œ’²t¶\‘û’±!6Ć 8”o(deemß¾=%%eß¾}3³¡½©…QD9Iå””¥‹ôŠìµaÂ&!bClˆ !qp"ßP]a ÈÍÍ=zôèÌlhoja”QNR9%eé"½¢èm˜IˆØbC» µÐÝ} bCVÐí±!6d…ÝbCVÐí±!6d…ÝbCVÐí±!6d…ÝbCVÐí±!6d…@lp"ÎO[ŸsçÎ-**:tèP”§ŠËͳɻ/µbClI‡Cq~Ú✜œ<|øpðO¯$‘ c9y÷¥bClˆ !ép(ßP[œããã]]]«W¯Ö­§öõõy½^ÇÓÔÔ/Æ`ònM-ĆØ0öUHÌ|CméééÍÍÍCCCÚ õ4ÀuëÖÕ××µ¶¶ÆëIiÌ&ï¾ÔBlˆ ±!oÚ·e ÙÙÙ´ž([›`àB¼ö†1›¼ûR ±!6H:Ê7Ô¾:<<¼jÕªàC<ëi€q·aÌ&ï¾ÔBlˆ ’‡ò ƒ_=uêTii©öàÎz`EEECCƒtu¿ß¯{#£ c?y{m˜°©…Ø$#Nä†~µ­­Md1Ià™3gŠŠŠ,XÐÜܬ{#{£ c<ùèm˜©…Ø€£e8 »=6Ćt{lˆ èöØÐí±!6 ÛcCl@·Ç†Ø€n ±!ÝbC€Øà\¾aÌRùì} “³ébm™ù†ØÄGó cÙ4ílÖOB¾!6ĆqÇÑ|C›7o>xð tww˱6¨ é­­­ÍÎΖó„ŸSw¬Û:)ϥȔ»3£0A‹ûbò ±a,m@¢“ ŽæêfráŸÏwöìY¯×;00  *Cúª««ÛÛÛ/_¾läÝÕY þ³e[ž"a&h½“oˆ ±!€»ó •oçñxöïßQ†ômݺÕüœæ6TžÓ š„ ÆÀ†äbCª`Žæ†#½Zz¸ìeB·Wá!}Á稺sŠ…å`||Ü܆FÁ¶ÛpÚ8L06$ßR%»p:ß0”‹/ú|¾Ó§OËG9Ö•!}UUU~¿_·»ÉËËëéééïïß²eKø.IÄüÔ$øÏJó½Œí©…QD9yå””¥‹òŠÜš„ˆ íµ!$Z¾aGGGcc£¼þøñã¡ç—‘ÊÊJ]pátq~¶cRðÉ›LIW:[®È}IˆØ¸;ß°§§gÓ¦Mòš]»vÕÕՅ޳ʢÇùÙŽQA”“WNIY:[®È}IˆØkHÊ7ìïï/,,”f[ZZÚÒÒrËïŠ&Î/6QNR9%eél¹"÷%!bC® Ap(ßPÈÊÊÚ¾}{JJʾ}ûffC{S £,ˆr’Ê))KéÙkÄMBĆ\;@âàD¾¡ »Â@ ››{ôèÑ™ÙÐÞÔÂ( ¢œ¤rJÊÒEzEÑÛ0)’±!×vAj¡»»=6dÐí±!ë€n Y't{lÈ: ÛcCÖ Ý²NèöØu@·Ç†¬€ØàDœŸvÏ;·¨¨èСCQž*.-(f“w_j!6ĆI‡Cq~Ú-<99yøðáàŸ^I"ÆròîK-ĆØ ép(ßP»…ÇÇÇ»ººV¯^­ ZOìëëóz½§©©)^6ŒÁäÝšZˆ í­$o¾¡6ôôôæææ¡¡!mÐzàºuëêëëÇÆÆZ[[ãõ¤4f“w_j!6Ćä†ömÙBvvv­§ÊÖ&¸¯½aÌ&ï¾ÔBlI‡Cù†ÚW‡‡‡W­Z|ˆg= 0###î6ŒÙäÝ—Zˆ  ép(ß0øÕS§N•––jVTT444HW÷ûýº7²1Ê0ö“·×† ›Zˆ  q"ß0ô«mmm"‹éHÒÏœ9STT´`Á‚ææfÝÙeãÉGoäH-ĆŽB”¡ËÀ†Ø`Cl€ °!6€lJ Þs¬OÏärt¹¶”ÈÊ9éçØ’¥/¹l†N\ÑŒÏI?džŒ6´“§ÌøS¢÷¹÷ߟņ  ‰l8m-&O™ñgBø9ö³Ÿ}ò“ŸÜ½{÷-m¨=)ýÅ/~±qãFmpÆ ò©¼þúër©¹ªªªü~¿õ˜øhl(ÿò—¿ÜÿýW¯^e½aCHئÚ—¬Çä)3þ”óÒ¥K©©©çÏŸ¿¥ =Oqqñ{ｧ ~ðÁkÖ¬yàäcøoÑ(Å%ôSÙWÖÔÔdeeÉxNNÎ +‘ µr‰‚YrØ ”©©)Ù~ûÛߦØ`Ö’ŸŸ_RR2<> endobj -4755 0 obj << -/D [4753 0 R /XYZ 85.039 786.531 null] +4861 0 obj << +/D [4863 0 R /XYZ 85.039 763.817 null] >> endobj -958 0 obj << -/D [4753 0 R /XYZ 85.039 683.458 null] +4866 0 obj << +/D [4863 0 R /XYZ 85.039 763.817 null] >> endobj -4756 0 obj << -/D [4753 0 R /XYZ 85.039 662.868 null] +4867 0 obj << +/D [4863 0 R /XYZ 264.216 562.379 null] >> endobj -962 0 obj << -/D [4753 0 R /XYZ 85.039 521.7 null] +4868 0 obj << +/D [4863 0 R /XYZ 320.069 523.591 null] >> endobj -4757 0 obj << -/D [4753 0 R /XYZ 85.039 492.296 null] +4869 0 obj << +/D [4863 0 R /XYZ 85.039 429.344 null] >> endobj -4752 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F11 2898 0 R >> -/ProcSet [ /PDF /Text ] +4862 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F35 2976 0 R >> +/XObject << /Im8 4850 0 R >> +/ProcSet [ /PDF /Text /ImageC ] >> endobj -4767 0 obj << -/Length 2964 +4872 0 obj << +/Length 3895 /Filter /FlateDecode >> stream -xÚYmoÛFþž_á”b–Ëåk¾%iÓ¦¸ -ćÃáz(‰¶ØH¤\Åñ¿¿yff—”eùþ îîìîì¼>36W ý™«*[_•UçÖ\m¯’«;Zùù•QŠ,·qžeôýÌâµ_½.Ò8ÉÊgiôŽë2Íâ¬Ê@óþæÕÓä*M⢰W7·WƤ±5éUQ×q^–W7ÛE&W×yžDŸÛÍqìV&êW×&º[]Û¢ˆ>7‡u³ú÷ͯ¯~º —é]EÇyñ7ÉÕujc[ÚY-Ê46U¹dÕd±ÍŠVó*NËÔ³jÀlVGŸz7Ä¢‰¶Çë†þºýE>fæÃäW&‰ë¤>áÃÚ¸6nvÝ´ºN‹š$e¢Áµ4(“èa•VQ£+sÍf•–ÑŽHZt‹…*rƒ8]ÀÎÏôÙ@½Æ—¤qWò9ú3öm3éžpµ‰ü•úÛ9ùÝPˆ#×týš^~»&ïq`4ŒwËJ4°»š=ñj!T´/Í£?“ÑÔ7RL–T$œVæÙ’nðÎ×48Š¢Õ,Ú` - ÖÌ`»•é];êöæžÈï÷g}’i~†¼ªhÝÈ°ë'×ì÷xŒaZ° w|HÄØ€6æwª®—}G–U-ÈdÜ܃©±!u›V¦ÇöDŒx‹­’oçõ-m:z‘aÀ‚Ûé v]{+Ÿ?ç;æ¼VeÏ ëü¬å¶nßê%0§á(Z‚TeôKËï»^>0e6Ýö %yôúyVšè“ü4^*X|·2÷î‡#dèIš§§Ý€…øœ4˜6æÀg>ƒäåŒO߇3\C¦'¯X‚_`(ý,Ã`°Ö¹˜¦_Ëä N -žÕ?c®-É0¨ed-)Š ªÅË1zýÏU•Ñ£¾W÷²6ƒƒõ¼ïNƸÝÚ”nÿîõ%c qÓ}¨¸H‚}ùjG|NX#Càøøó(“ØÊ»öÝÈS—Ý®qoéÁu)«2?¿k+ÛØžhá Õß$?ûÎ9UϪRŽ+½Ø•Ù"¦ã !úÓ_³qçv¤oÇÍ™Iƒgðc»q Ó³y k ¾r8NBÀ‘a˜œŒ`ãøít<¶äÓ:7‘UUJF­‹Ž –èHã:{ )Œ/] ×[¶pý¤—œ[Ѷó -Ú Â¼hG¼’#%Ùaãd ‘p %æäþÑÓî…”½™~aê½i¯Úp¬²:>^(vÝt~èí„è-ô¥öû5̾(§^ôAcùغI&„’Ò¹¼¨§øBšÍ“:Nª—‘É‚ærºÏj›<óé>Õtÿqe“¨mÜqôÉà¤éÙÊè}Û·,}°9]àÑý šËP +Š¸J<Œnü‹zlu$zËÙ+%gè|©SL‡  )–Ø·ºL`”÷Í~’E΃ÇÉÉHò‚^=¬'5V³0Ý­\Þõò;ŒÛElÆŒ@”b†¸yKAôÜ4«Lƒ Æ=-€TÔ 07`Þè ŠûGY¯àgYj€©…\eI ¼¼ð‰ïý›!%7Z׎²ìݲåô"(á üãô‚K ¼c6)Ÿ¼—…rGð&Ê;/˜ŽGõè)]h=žr„HO2Í øFf½ì_@>ΉrñœÛ‹Hf±)K’Q:¸?fy‘ä6x•a’„‘{¡ƒX×°dÐ 4Ã3qy'úí['a_³9O>gÜ•T)²Å2cdU\¡ªÇ­'rxxžŠz&æ6§Ò*- NB_ìÅ 0÷iJJ¨„¶þ†?’ýNßþ"[›£®Ÿëì'6—‡¥â™…äw[*™A¥9ô$dZ–CêI¦}$gw}…¡yMòñ }ö ¸7Q—"¢‡€éØHŠæ(úÕ|Ö°::*sÁ%ôðþƒ¾âü͉(Œ»óÇ»~à*x'#ðx໋!g™¯º-¾¼r»Š“–†'ÎŽ“ƒKc²Q«çãqB5ïŽÜb‚ë¿"ófè¼Ä±ön#Æ$| `|ЦÚ8 ß”&úIS0°'ö¦¥ }§2•V‘½ãÃÕÅ&Y;;ë¯]ÀÌÚùHíœ<Û—tÄË=´Äü9i'ˆÑt¸nò¿Ûn -¸D®–zn ]}çúûÞyÀ;(ÝÇ¹ç£ —»qn) ã£Ìž@Üàñ8ý‰F˜ââoHr»T¦ý&/×z šËõhJqÞÔ¡ýlµ½YÕ€t»¾Ûx ý±C2ß}ZŸ4›rÊ™“~'< úÚÊø7”IìéúP_Özù—qm-ßþ‰=¶—ÊÛÔ˜8Íë—Ÿ<Ó\.oMUÐTéË[xG} ¡†]ɨ깺E"w` -«~æÃý“öÄ[Sé€âƒÒóS¢{V@±¾‚Å-/=ž–67¯(‰!-ÐL£ç®g 1=×ঔº’ס3;Èïf?ø2”§}Ö¨ -Jpe•sK•,¦Ûo\€ Rn¡…‹¶×c;Pè + ‚(»ÿƒ£“ÑUUýmÑIÐ+›)ˆA Ü3  Û¦‰GL›†s’M­] ®]³lsaÃíÀóÆ$ßleaŽ;“'mäCXYjh’»NX™«/sþœ•Ó4§ 9ì9iv¦ü¿‹g¢Öa0çÚ€±'´¶”ŒŒI4ß‘“þ¬.­6ë‰z×M½J±tLÊ;¸ñxæOO“ ±™'´Â×r°Cp¬²P9– -·Êl¶H šåãríË9š‘VyÞêÔxV5.oÔÈ*\Z-efÂFe  “^ƒ2Hë|´fÅë½_¡ãýâ+Ða·_ø<½ïR¤6ˆªéË‘zA"µ‰kˆa¶guµˆÔ&2ú¯Í¿Oþ_ -ºZˆ¡[&“÷è0jt¾øßD“˜Øüÿj.h.ÇØ*¥ëœæ Òfï[~4êú𯉱bTšõ%¡€îü_‡e!¦ -ª»p©Ææ!¯RØÑï‚žê;çXŽnê¸ê¦ ^ʵ­rh·Üé?wºÓÉ•všGïùuó· “ñç'OÈgƒÄ ÙlZßÈq2h:ƒ‰…hòèVZe-$*m:nûÚwå° P¥áª×ý>H=o63{b-a&=7KÖZ¤á86ÚÌ>½3·UœWö…Kÿ £µÞ]endstream +xÚÍ]sÛÆñ]¿‚o…f,‡;|õÍ–ÄÔq-y¦4 ’˜€Võï»_w8í$쌆‹½½½ý¾…šEðS³< #]̲< ­fóíU4[Á“ﯔ@ÜÈóæþê¯ß%éLEa³û¥ÃSDaR¤³ûÅÏÁí¯?Þ¿ût}£µ”¯o²,¾»VÁûëüø®^ñÓ·ï?½»½ÿéÓu®ƒóÐëoñÂwöÃëOïdø:΃[|ÿß¿»ãáÛŸ>ÜÂG?ýxwýËý߯ÞÝ»xKTZ#ù¿]ýüK4[ÀRÿ~…ºÈgOp…ª(fÛ+“è01Zî7WwWÿt¸ø™™ñ[§¸e!nTqrž£i¦Qê8ÃSj“úM’05q˜ˆlLLÜ­Ëk]ëO³àmõŸHdKS[vuÛðƒ×óyÕ÷x·m³ëÚM?Å ™é,Å Q¬’2 ²03,÷k 0γ` Tµ›M‹{ôT7+MƒÇ²+·’½ƒçtÑõü.£áËÝšâu0[ÄòÎÛfÉxhñ*Øø@ÕÜâfô¦rÇ7 ;¥¼ÝÈÛ¥ Y—7`.œt×Ñ:¢íxöhÂ4Ôåœ&¯ˆâ7°ñF¡dć¶vÔ˜(xS-[ÚNUûžX„—%>ãM´KÜ­p ÷HwÇ +P6 ¾øžVØîùö ðAž|E/Ò¤ÕWv “Z‘ÆYŠþÜ[vÇ9í°a¤ëÉÒˆB÷P2àBd¯Ep®q-›žß¢eÃPˆ/Y1ˆ½V´íÏ<¸gùf-ñrƒ’Få½`¢GíV0Ð]½Û“9ÙŠ‹¾–{T¬ºßÕÍ|·yæG V…'/@U¥ÎÍÚä+0‚œÓ…§êƦêÙ®cWmy¸Ef‰â^Põ S/å^0±úXÄû%ˆà;^.Z«cx‡›°®{ða&SN[äe¡Cæ …Å Ð˜¹?ƒÇf–W“n)ÞZÔ6“‚p´ÈýG¾{VHVw­Ý¾c OÄrdÖ†_)ç„ÐueB1‹5"pÀ¸ýøz Dwübû^¦‡pÓñ[Zû$4å–ܦšu=mM)r‡OÈÀ˜CÃI#'ã‘^-›¶.ÑØDbÇx¸2¥Ä0F¾]å¶eÀ¦ߋÁÓ*½Œ{ºyæ²oÝ®¶¼'Å(;~XâÝnM;S³æ,xžG^y×3ƒö©Þ WŃH/ÞXê¾ê/Jö4½Ûí®ò}PÛññq–ÿ¡xÆE¬#ïXId ã’1îØu§Àè$ý«­•JIrû±ôQŽÄ…} 9e_sæƾí„;¦'m/Ú/.÷ëT7`M#ˆÀ7¯)¼Añ„Ø%½ÑeZ°¨€(2^®ëÕÚnzåâK݃]Úøh–ñõ³©JK$"YÔ Îé|¿‘{‹b[Ö¼¥Ä44#»¥X\9b³TöBoɵ^íÉ)ôÇÆBb§5Y|2ät!ÑVÇ×Îk¤´‡q +™ÿ8øDCŒš)ÙFvFÆ ¢Ã“•HoXÖžñ-°U\9£"Ñ*$P›Ë«,?øvK$´€ÀÆÛ 7³µn8ÐTâ,'|K”‘rwƒ~©%üÃaÞƾîmÄX6d¤£Ü9gÃÉ–|éxÀXG¾¦†Ã3ŽL E//ò>µütÕUIÉ[Ïd¢c‰ m$M¿ä—vŽÝÏ<°Õá<­ C‘i h;”´cŽ<­9 Ž½Í‚›5iÏ8hræ¼¹ö¦n~wlV4ÇðßÕ–¿24›–8¸É.ùVä˺VzµÚz!Ì‚áHgøBþQ&vnú¼¼Ozßnö.²ÉFÉd',í¢}tXgâX“¥6Áç“Y‘I>©òI}”OâÜaQħ¢K¥rÈ£bHºÂ$K}ˆÃÆ‘³³Ð4 u2äiiìE¤ÊQ¢v z‹PL]N){Œk?ˆg“44ióák;dN )m¡²™GÀ1•sDåhžCLãÀ“~«›xýýÁÝItäáíØúrõܨSD¯MÆI:»)â0SÅ9Ø$4‰™eEõçÊÎèOa¡w"ÀÂW"Ïc$.[l3ÔqqZ8 +È«` @܆ 9À:ð .÷Õ¹ >âeï;öèG‚ÊXϼÉþ8åÙyÒÓ\…i–h[õsŠÖÊG©‹ý7,ã¯9ø<þÐîÄ/¬JA²&ùeV¥bãpåÊIZDLq!‰ÓPçñiÕTÊ„ÀyÈC#…žr±­Ö¶Q˜7%úKHÅ9bãïbDí5ÅX@,%Htïûo¬;>­[~4N£``ˆçáfÕ•o‹±aNØü€uÏ/!fŠBjÊÕ6ÕŠ>?i……”Y +ôP‡B_D™ãýºzöiC7(´-„èÒ‹ÈFhmm–RR~é +LQÊÿhÚýAXsc³!Ù[‹>‰º– ÛÜ(!ñµ+[ùÌ¥»Ú_d-So<ŽñÊjŸÝ™åÝ>!½íÁ¢yRNgm1L›qÄ„€ÿêm‰c¼ ïµ%[¯x_ë:—…=\¤Àþ[±"î(-ÿ·5Gx®Œr"Ìp¦æª265ÅË25*6S¦V¯ÁÖÀ¿)8D;¨ŒbÍlÊÖ ø/akÎQk2 „Q{ç J-å«Aé©þ„²ñùÃû «b™†*äNŒ©hæiB?D°Pøg’¬~¯…_‹jI¥ŒÍηHÛ²{¶Ø2$ÞÙlrdWŽ ¦M4±’>hÕ±µvºº•×ÖŽ|©çÕ´ð_bïþ~öB¡¼š<ý8¢ÐÑD1L¨&dßmÄ„ø{S\@üϬã$Œ!7ð þýâ?ö(OåÖ[ïn]~ÅEˆ +¬;ÓH ´U3œ¡„—\¸0¢ÇÒ?*e‘ô·›Jßû´žo±þnДÿ‘o· õ ZÂ$s¿9VJÏSù»RyïáßÌ[pasÏÕŽj\¸”R¼á¼¤‰3¬æ{Êéw˜š‹©à’ʃ«^mÏ{³‹HãKœ!‹]Li´u¤f:ÏÃ4Ò¤ «}åÇ=í¯“Š<`¾„"Ÿ£Óhù˜Î÷Ëb,µyÖÏÕ—±ï•H„–5€Â`¶g¯œz6ƒî·ƒ‡’2ÝJ™ÁÅxº®ú E¹î¬ß³šwì™}’•rvGžº|äX½vǧ«ª?뀹ë«Ç‚ñ0 ÕsÙ +!%Q5o÷œJLkÏ%Dà%Ç‚:Ãþ5 ê0S •¤Ÿ gr\Zÿr¤ÃÅQx2¥PÃd—P¨s¤§*R<"}: í=]¿néøC×´»S~϶W¸£Þ5Ø´+νälÂJë9Ÿ4%ˆ—`ÝKŽË’4Lž²â*4)0!Â,âC¨¶Ù\«£|wJðì—¼s´&if’ù´Þz‡¤^¹£’óÞ“sT/xªAnã /P0{aƒ™æÀÚÅY§S¡Ý±ˆO‹è%˜ü¢# ‡i‘NGЭM +ûOÛÞUåÂãó”lX/!›çh¤X0öIü&‘NÀ)W­‡Þ‘0W/+¶p5œñîÖ·¢ôò 9uÙ–ŸÇa¿3¨ßRÉbTD„ˆÀ¯¹eº\ó¿¶ì»°ÓsZZ_j:¶¾µu±~\ȶïŽ3 MKü%öïEK¼2ᔼ TdfÈŠ<åV‚/¾ýÈÍp ˜¦6*ñȧöÇÞ£Ã/É‚j*ÜÖß^š¶?Ï©ÉÀ.æÉ™h›¤%2Ô@Ý+]½«¾!–ð^BÄÎQ™ÆqX$jDå·œ2þá€æ‰Nµ‡à`Ô@è ™®·L‹Û%øvqÛÆ >ÑP‚퀀í"=iv¾Ó;Î ÷3ç{Óch£tÜ›Koúw¶’4êM[wÕö ¿èxæ¡×ZÑI!ÊJ?¤_¿«u=6˜œ_™l]q…±ò>è(øËû5‡ômÁ¨=mÆknׂ‹åÜ÷-®ø'ÌîHôš›çð¹ßÿ^䇌G)õÅ!4`Ø÷®mKR-ŸÊ©­=õ¡ºãU/üž¶‰nõÒ‰ýž”ãÑw›„Û›ñŸ`ÊUÓR7x"}x!…u¼¤qÞrÎp3o©Û¯ö7›{Xd®äÎäTz8Ø=´x1Ã}´ð(× }ó|b«Žl;ÜØÂF¬%‹çÚô›ÈÜ:He›Ìá.æÎA~À],mc¿+‹H=\‡_л›qc¿ÕÑ"I=cÐãØóαŽwv \^?äqŠ»Üc[•EÂÙêÊçLèòD>Ê,ð¹k¹a+šØpHÈÙÐŒ€´r\i‘ã:K êŠô>   ³8 S` MÊ4‚jx€ÎjËÅÞ»8ØU7ÒåÈÊâmVÅÈf³\ád<2Õ‰6“ݵ˲_[9=m‡¤‡&)Î"fÒ²bãQ‘Æ#˪Ųþƒ,å¼"Z˦†i¶‘bQTpÎTZÔgI`&e®S僭Ô`Ó?~Ó°-âðù{Þ!÷Å/.dë^dÛÊEVD^ßNÄŸÿÈ‘WÔËìÀqâq‡ÓräsìIvD`¹`ÝèlfuB(êjW±1¯÷ÁÎéHÅ ÆÁ¯m‹eàæQ'íbS&¹âÖš¿M=÷>P²'0F)›Ç¢8Êc:u¤ð!¹§Ï4eÇuþ®ô80ùJ”üMÉÐ(“‡ÅT—[ñg¬1¤ FRœhŒïô ’ÿàÅÔendstream endobj -4766 0 obj << +4871 0 obj << /Type /Page -/Contents 4767 0 R -/Resources 4765 0 R +/Contents 4872 0 R +/Resources 4870 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4739 0 R +/Parent 4860 0 R >> endobj -4768 0 obj << -/D [4766 0 R /XYZ 85.039 786.531 null] +4873 0 obj << +/D [4871 0 R /XYZ 85.039 786.531 null] >> endobj -966 0 obj << -/D [4766 0 R /XYZ 85.039 766.606 null] +814 0 obj << +/D [4871 0 R /XYZ 85.039 766.606 null] >> endobj -2961 0 obj << -/D [4766 0 R /XYZ 85.039 672.187 null] +4874 0 obj << +/D [4871 0 R /XYZ 85.039 744.844 null] >> endobj -970 0 obj << -/D [4766 0 R /XYZ 85.039 672.187 null] +818 0 obj << +/D [4871 0 R /XYZ 85.039 686.81 null] >> endobj -4769 0 obj << -/D [4766 0 R /XYZ 85.039 647.469 null] +4875 0 obj << +/D [4871 0 R /XYZ 85.039 652.065 null] >> endobj -974 0 obj << -/D [4766 0 R /XYZ 85.039 509.087 null] +4876 0 obj << +/D [4871 0 R /XYZ 85.039 474.933 null] >> endobj -4770 0 obj << -/D [4766 0 R /XYZ 85.039 480.351 null] +4877 0 obj << +/D [4871 0 R /XYZ 266.917 480.906 null] >> endobj -978 0 obj << -/D [4766 0 R /XYZ 85.039 245.004 null] +822 0 obj << +/D [4871 0 R /XYZ 85.039 271.441 null] >> endobj -4771 0 obj << -/D [4766 0 R /XYZ 85.039 200.456 null] +4878 0 obj << +/D [4871 0 R /XYZ 85.039 236.695 null] >> endobj -982 0 obj << -/D [4766 0 R /XYZ 85.039 115.324 null] +826 0 obj << +/D [4871 0 R /XYZ 85.039 142.459 null] >> endobj -4772 0 obj << -/D [4766 0 R /XYZ 85.039 94.128 null] +4879 0 obj << +/D [4871 0 R /XYZ 85.039 107.917 null] >> endobj -4765 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +4870 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4775 0 obj << -/Length 2867 -/Filter /FlateDecode ->> -stream -xÚ¥]oÛ8ò=¿Âo±µ*Š”L-pÀµÝî^×ÝÜÖÅáÐíƒb˱6¶ä“ä¤ù÷7_”¨XÊ8Éáp8ä|Ô,„?5³qêt¶²Ik5Û¯ÂÙ¬ü|¥c)(KçíúêõO‰™©0HÃt¶ÞutÒ0ˆÓd¶Þ~™¿ûû››õûßK­õ\ÅÁb¹ZÙù§…š¿÷ù÷¿þÌ+ŸÞ||ûfñuýËÕûuw¨Ç–ÒüÏÕ—¯ál ìýr:µ³G‡JÓÙñÊÄ:ˆ–ùáêÓÕ?;Z¼ff¼k솱¶AlõåUì]Q©(Ð*š­â8HÌŠîXìàI8ZDv^a§óú\ò +yµ(›|³Xªù._çTóÜ’×MQ V%´ð…²ã"ZÍoqÄØ•#ÉÓ=¬T ’lyS‹L&EÃX[€5Ý`òÄëŠj^Êb¾2•#—£Hày– -_/¥Û~(‘ç6¯qkîNöׇ Q¤«ë®°ÄkâÄÌóæÄSB)ãÃá‰w=àÛʼÎðÖ¢"Ÿ‘ß„c,=›1 ± ƒÕœž¥8žŽÉ¦å…?Be¾u@†%ÿÒû “Üd/ ßÏn¡ô½Œ}aa‹7C0Šñ‘÷få–9ÝWM+X[Ǽl -ψ÷]Ž\¸:!iP”¬RĶVaÇÂ<½ÉÐëŸô@}CD -Ì€6ÇÛ`S•;Fè¹Iƒ(tx€ƒÏvGš›µ¬¬p0ENx6é €«Ò©™RÏž—3ü†Ð ·ŠÕ/;œãý®™Öazªƒ\Щ¥Ôñ„úÛ²NÁ6©I[#;ÕÖÌw¨óÄLȽhƒÄéRx"NˆV<,â° y²Ã®ï^DñÁ:I•!¤‘rj/\Wºš¿¡×……Š|”Ü `œàÀ[r ž°i°X"›ÎYn9Oê|wæ§Z[†e ÿ°b)—Ã%º>èAQEï·Zo{^n™|”†d'­ŒÅëF°Oà àYîE“­¨­÷«F)œ›LîâneûÈ‚àcV÷„¶#÷ð|DY‰á -÷m^äÄ/ˆ¥ë‚ÉV°³]Š_Ð"ÒÜ:˜Hgâ$ ’T¿˜ey8”‚D°ª‚…Ú§ q¼ -lÂidVÕ)B}‰ÃùçYE I04ÚW ¦:unYa¦8„Ü&6ÑËö8ÓIR¬WA´Š8m@›Z/KH1"DE}p™üÖ9Ëß²ØÈâEäð6xæ³&¯:U¨ù0‡ÉFz(¶ >7G ’¾Cúû>:3ò°²«¼Ð&Zs©sGVë}çÀDwŽò÷ÄzÖ§Œz ¥ˆd0ó¢ÉËž‡vir¤¾+´£{g¼/w‡Š2ÌCó•—,U¢<(ÿéŒ ÆXT[ªDA: BÅ?-FxںĿ_}Åó?³Í}õ?c%ÂÿrÙm¤Ã>UÃɶ{\—Õ!´3j8+›(pk”>W-ÁÎÈ¥DÎuI/nz¥£Ó+þÍ‹;Æí€ËjÑÁTû F© T˜ˆ¦ž³í*w‚~Ì¥>Ýq:L! @|æ;§?}&C·}êÝŸdQwu…êwá<…¨¤½ ’Ôå<¢iQ°/ƨSþЧ‰zÙz8ÓþÐDaµÛÀjßå{AÔŒ²e9ï²MÞùF’"èùÇ•GL+˜äeéáL»HbµÊ.ò-x“¤­í2*„Zžrz‚@Äuž8¯xôÍó¤ªa8Ú³I,ù[ò<,s—œ¬PÁ„b‚\åuʘʡ«5 [~1¼S3’Š;±G 3Ö¿†k½eéÞzOE,,spͨâO•¶õƒLöÙ µ\ÃχO?þÊ(‡B^DCRÉÑ‚u+77 º¬‰¹àbÌ–ÝŒ–Lè{Kã˜Ãûe§–²G¿ûGgÆÈÒùÛâ…ö ÖïÊ®RÎÈPR£€ñhOÃ*¯ ]ä åU™‹6Õ…×E$HÅ¿ÇìÞ'ÂÀ®óaÇ:¯bViGà ’ÅNÇ¥éHXõ¹æ,r™ ,ĵžk5¢ôý”ƒ+mqÃõ ;§ðš±¸ÅXÊdŸ?ñH -qÀ¿sáÁrúúÝœqáe\;W÷þñ\õŸØ}Y#R¾ˆ¶K]XÎŒ» ‰Ø¤ñxø ]¤åëð¸Å±dò°ð‹<…°#K¥.f‚Ô5\a\†ùwÖr´2v4·†{GFb^W\â]ªÃ–G¯/¯M*Æsʱμt¥éM[W”ôgÒí˜ðpZ iÓgˆÔI†X¦^—t㸖j¦’{•@3/Ròp¦“{e,5®ýäÞŒ&÷ôq$áNÊ$\PyG ó—&lú2“Êt.MÛ„Sù™ôò!Å -瞊T'×0¥>Ô1?¬áôùŦˆ$øˆFb‰Ã‹ïtIcã<‘·¡ïl<}ÐŽýE4ÉŸúª›,=ëÏÄ}¿-¸·.ª¹l¶‰_:·Nó a¿FÁaEÍŸ—.K”g”xIl¢¼I°¥ï“$òQ,ø>ù¸±M˜]Ç?ˆmóì•èÈ2ç»=¯}àæ…j/Ù$ΪãÑõ5/-²§©‚PêB*XçŸìTä2®²¤ÕAúäE`=õHC©á®qËT2aÃK¢>`n{¯áœ/båý“ -—Ån:‘Xî:»N}âl$·Ñµ[3ˆ^Òî§| —,ÔyÖtÁòåH¯ýH…|V»J^&oÅ+cSæÄ¿ãu|ã9\à0ï¡«ÚžSäkZºA¸p_ú_ºðØ™L(g.­€ñç±úä1{‰ªn›É4Ùù~ÿ³ -ûë®'}ë*Á´Vš‡Ï -ÏA±qÅ“Ä‘Îæ®SÇÑ£ÍøgÆÿ¯ïö}7Å©h¦ÄQÁ¡c†b„1Ï9vø/Yþ/gÚ÷ïendstream +4882 0 obj << +/Length 4709 +/Filter /FlateDecode +>> +stream +xÚÕ\[sܸ±~ׯ˜·ÌTV0 ‚·}ójíÄ©õåXÊÙœJò@ÍPËœ¡Br¬Õ¿?Ýh\9$íéÔ¤\eq@\À×¾á*€á*‹Yå«4KX…«íþ"XÝÛ?]„ªÆ¥ªréÔùéæâÅë8Y…˃|usgúÉçÉêf÷÷õÕŸ_~¸yõqsEÑ:ŒØæ2M³õëM¸~³¹ ׿¼‚§èíÏo>¾ººyÿq“Eëÿ£¢—ï~Ʊ¾†j~ùñ•*Þðl}…í¯°ýõ5_½wó_½ÿåzóÏ›¿\¼º1p¦F’ÿ¯‹¿ÿ3Xí`ª¹X”g«'xX˜ç«ý…ˆ#‹Hý®/®/þÇôEïÄŠZ­–®qÉ–r~:\š§j¸h0\t2\°º Yžó±‘`Z Ï`[Xœ&n…á_CZ˜,IRh'Œ »“ wvR×Ò•p+o6y².nk\÷V<“áJ¿xÆNkh$’ÆÃf?·‚GË‚håpB¥®sB¥7ΰ'îuUoˆ>€MqØ)lAYÕ–[¤½oZøõL5>lxŽµÃ5îñ¡êºª9P»ŸŠNNWus倯¾mên8-s–ÇñØ´N¦¥°p°yÎ’<š«3‹ –‡âÛP‹0·ùd7²QÝГªí÷bϦh>¼Ì>°A<ÍHÀÚEÖÖ¹©?¸úPR´Å¾ìå2·§XI‡ÉÊíß']w6O»ÈrÜ£ýç²Û"ÝRùØ<€þKbƒ—X¼=)~×ЬN ’å)KEºÌ¬²³4`ÄÑ7c$^"aÌxó.,1KRàÝ0g q•·­dÄ¢· ,²è>Mâ±.æF\ÄqêüQÒ{G䢑B¢oÔß;)Eö(;n”J9hÁƲ.ÍS G(/îe—l:KLü;@g1ñ„, +³ ìð”X„ fQÆå^ì*Xµ1 ¿Ÿƒe øÌÑÌEÄÁ=šo<1<%TôE­ …Ùz§ÑÕQÕã&\{gÒÓC©p£Q'Úg„¹©:Ü«sðýõlï»}÷æo2‰¾]©j †lu'E_!¦ï©–íãto*ÔA!@»+õy]wÍXKỂGFûLÑäe9®E[õ8WõrOçõ§Íë,±éëägÅ:I–¢r1!uC&@SLrøÅÄ9MG‹÷ u©‘QN1íž™#6âœÅYæû +†J¨êþ¡Ú?ˆ¯B¶ìK%“ ü‰êÑòd /_ù|Õj¾R¼ðPhØKäö«Û­:ÝöÙH^‘Žô— kj&sY«ºÓ ç£*>ÊweKj©&µSE»VS«~íKìÖùª A0AÖØÃŒå«$M™]Ñs'…ÏV[0F€•…ÞUO.N1€t ˜› !±7‰›‡Jmÿ#©Î®òÑ=JúËm… Ó»pEg¯°sç‹z;wµ4·U¯õ CßHAcÿP¨OU­N±¢~B†+6ÐóåÒ[Ý¥QŽ Y-qȶªêVmU¸–§‡Ž¬ð¿®‡^o‘ÿ§ùa‰Í;cÅ)‰sðSJw²4«$> ö8Oì*s¢o{sî~ù\°#/Ásóà™`9½y|w¶°|aÎÿ^¶ÐÚ‘Ýž¡&¦ÕCAèdD™a%¶ñœÕ#ÆŸP9PÓ€‚D€­—óQþ[|¥“[ÜüždÝ©š=Å7– %øfnzÈ7" ½ù9>-+Ÿ-úRPk`¡2Ôù<‚ó—vbœ(àþ*·Ô“ ß'Õþ݃âÚÒ–é©Š£ãikª¡­|¬Áð€¿Z Ž9c,î9ŠÜyžz4/ªycÙÀ.%|Ì 5‡ ‰ªâa¡LR>âQÙ²¥e;¦ÅŒfùÀK½…K ‘ÆÑ÷˲ +ãœñHüž4+.ãi¸`kŒ—k¢kéJÓiVb"Í*ʲŠ@}PÏÿ4 IÕ9!Ò7‹=ápïuxË7†]ezω"¥È%çtíò\z©/3ÐT¸ørzTÊOÒóЀɌOe×Åð˜Àb„ ˲ئGEë^K„¯N‘ŠxC®œÿ}êU_óÔgaÎÂ$ò¨_8A*©`BÄËÌ*Œ@ArŽÚªÈ3–¥Ñ¬7:@„F”‰¶U ‰JM5¦v§•¶¾²¹*±Ö$y aTkmȨ®~p´AiW´:ºal’ÎTºs£—]9HgjߎÈÙuyÀ²È['«S&@qŠ)´~;Ï€×試à|óéøh¢7xk¤æp(­Jà«î¶i›ôÐUv³Ü$0h\¶Ê`|]+Ô†Ž¼‘!Q$„3ͺ²¹&§êÊ¥â`Ó&œp*Ø…v¿;ÇÁ—г·®ó3³§•ýQŠM +‚EÀtÖ‚@†4§â¶pzb²¤È2ÐQHHm]e¸©«íó3Úî`Æ9Z1['¹Kë•ñÐ(dUN0õªØ¢Æýàfô|ÀÊ0íCTÖÊ¥…2œˆu­ÅS­xûíÞ4ÀÜM&épÛb‹×qDå…43j’¸:™m¼K,¾Þó2GE +ÛŸNek¦!K€Æ :ö(çÌ5¡lâÖˆ¢ÝíP yŽî$Î@ÏÝ/ëÚC•vg˜ü} ß=;ò_§fîIÂ_îʺÚW&D_›Ì a2oÒf›™ÓLÉ]}¸´$¥ÛáÙ~¬wúôƒŸOÈy^B÷ ÝŠÒ£˸dฬ/±?g-¨ã±3uPìÑP ÈÀ|4½²¯´vÑ–]S¥£¸aíf°À>Cx¦¹G¸U¡­Ñƒ)R_Gu¨m–õIZráçØ(¢»¯n¥{Ñ ã´¤S4 +ºÿ[¡7[Ù˜üãÐ}sìÜl0™æy_Hý«ëíÕ1'1Lü°Êí ˜Xþ³Æ2&¥gSQÏ/À&DÊ`E¦ÁŒ;?_Ûÿø#Mô ºÄšd÷‚”IÝ Hu'x çªRîKw%¬D®öCM¿/öÚ ~g¤õ³N²®w/ËØ^&ñ†SÖÁ‡÷ˆní%Vؤæå©s «¼»ÊôæT”ŽãË_Êù('eü’Åxµ³ÖŠ5îT¿¦ +–=Ècç³äùc;ÂK@è{èN e0 Ž×ÍÄ4 æa²Q$»’ 6Å'Çflk}yþû4Ɉv”qŽd™Dø$¿$ÌàÆ'´éðŽ¶ÌÈUçúíO3^yÕ/ÝŸúÚKܹLlƒ‚Ú:;Q¤›ÁÑf ÕÖ»ó혆ºUgNó­s_K›‰nŠ­ö½Œñ‹ãš7žê!áúV?9¹ 3ïýXbÏX[²”ñ<œÈÒ\¬¢˜%8¡ÌMp þ¥ÒŽ‚*÷Sy3ÌØÉôóöeu4ÿl”ÐêÖÑ%àõI¡Ô#Rjæeï"+·8ú¾”ÿÁ¿}ˆ\»×'¿[¡ƒË Ypx+X¢Ú~·(ÌUB`Êhã°>*x½‘:*nr’`°žõ&7)IÉu/¯¥³µØD¡JYî&>F¤Ç›¥ÛÖ9ůî'à,M\§OµhUAwžbË¢–ï0”( *ªø`4úÝ7ôwÛ¿ÞŽ±í‰? ë*÷w«†6Þ5l0¼(­ú6É]’8µR}kÜÊ(<^ÿôL-‡Ál Àü€ ìœó¸^ô2Зé$“bæ.ýmKqkM0äl²ÇáÎŒ¤¥ë»1Û>Òe +LåÍF³—T`ÜòÊ–‰k¥6jï¨h[¨fŽ¦#ò½ßñÛë‘…8QKªïnÄ ¿½øÛÂ,ίì$à…ãÿª4BªŸ<€¡äÝûj)ÓW¤`ûlÌÏ€ü:y3d™~R¼!0Qñ$9%‚‘o>cÙÉV){›¨ŒÎÀq‰¨9!ëì' +3óØj™N>‹è!I…Ƴ–é°¶ ØX¥IΔk êu Ó¨&fñYr_¦&“E§+‚cxXÊ¢ÖÅ'r'½ZÓè˜I>{»Ÿ¸äJ€à_mp2rynƒoO†Çjò˜tº$|jš<Èð¥Ú*N2“ +¯µ+N)r<‰×o‹Cq¯[5#­•H°RËPSMô"¼½ ƒ]5{y·ÏKñ+Ù & V}Œµ\ÜÀaÛÙ€²±RÇåæè¦=Ó¡ZJe§œ ›º‹5«½,觛z¡ûqÒ;v.ê´~|g,˜©±”Å—ò"™w;¦O^ê¾.ÎFNø%02#J–•_ôjXŒy‹<›põ‘'˜Vm¸u«>–d"¿¨ç%,J…·ùÒÉrçû6y蹓ó@ñaNÆxsléWGI3:«ñ••«*ìJµÁÒœÝ ÿCýη؃ä@EÊ0Y9»$OØ$T +DI•Æô5êËxÏu^h.ë4í)ãüþǺ+LÏ®?QÄÜœ¢ð(/¼í£KÄÁúűk_ÔÎ'·Šú…;ÓŸ71¼˜—æ©ôŒ`3:w±Õ½‚ãþ‘*{¹&ªu%\1*kOûG°‰ŽŠWÆ(Þis +à€Ê +zÒ 4{àK\Cük‘ 4Ó{íþkø\wuiû»SÁc¢Çãò ã.f"ŠÆÍÞ/¸#¿ÊìuY>9g<4ÄHÃVð!Åq”±8‹FHþ¾³¶Cendstream endobj -4774 0 obj << +4881 0 obj << /Type /Page -/Contents 4775 0 R -/Resources 4773 0 R +/Contents 4882 0 R +/Resources 4880 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4739 0 R +/Parent 4860 0 R >> endobj -4776 0 obj << -/D [4774 0 R /XYZ 85.039 786.531 null] +4883 0 obj << +/D [4881 0 R /XYZ 85.039 786.531 null] >> endobj -986 0 obj << -/D [4774 0 R /XYZ 85.039 569.693 null] +4884 0 obj << +/D [4881 0 R /XYZ 85.039 763.817 null] >> endobj -4777 0 obj << -/D [4774 0 R /XYZ 85.039 548.496 null] +4885 0 obj << +/D [4881 0 R /XYZ 233.803 769.79 null] >> endobj -990 0 obj << -/D [4774 0 R /XYZ 85.039 432.613 null] +4886 0 obj << +/D [4881 0 R /XYZ 85.039 545.303 null] >> endobj -4778 0 obj << -/D [4774 0 R /XYZ 85.039 411.416 null] +4887 0 obj << +/D [4881 0 R /XYZ 307.409 551.276 null] >> endobj -994 0 obj << -/D [4774 0 R /XYZ 85.039 160.041 null] +830 0 obj << +/D [4881 0 R /XYZ 85.039 351.625 null] >> endobj -4779 0 obj << -/D [4774 0 R /XYZ 85.039 138.844 null] +4888 0 obj << +/D [4881 0 R /XYZ 85.039 329.863 null] >> endobj -4773 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R >> +4880 0 obj << +/Font << /F56 3226 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4782 0 obj << -/Length 2273 +4891 0 obj << +/Length 3125 /Filter /FlateDecode >> stream -xÚ­YmoÛ¶þž_aû ±"Š”, ؇,ËÖtIo7»†6([Ž…É¢'ÉÍòïïy£,;rîE±­ÈÃCò¼>ç0Q£þªQùNGÓ$ö#­F‹ÍY0z„•_ΔpL„eÒãùq~vñslF*ðÓ ÍWÝ9iàGi<š/?yWo/?̯O´ÖžŠüñd:M¼ÙXy×W¿yÿ ¯Ì.ï~¼ßÏß]Ï»K{b)­ñÊ¿Ï>Ý£%ˆ÷î,ðušŒž`ø*MG›3i?2ZæåÙìì·î,^3#Þ5¤¡ c?œÂ@~’˜!žPù‰J`8´_ib‚…¢ÈÍ´³ŠzR:õ£$9&4ÑÇŸ>€9.”ž¢-Œ7a“ìš|Lâ] ÛŽä¶|‚KWwØ:ë iú.…è`yQcrmKKŠf¤¤‡6äÄ$€¯Ë†¹_îø…Tüj!Ç\ÐPn3Jú@¼Enæ–‚œ-'e‹=æ6$<ÊþxôRÕ¬²\6v× 4C‡¸ocbi>¡‹åÞjÄØØ”oœ•¹+–`&a+e‘·šmÏGDγ¢jZæÍÚ$‡þêN©Å•&Þç²""áWRâ¥ZÑ -·vÜa<7êŠse¿ØfMCF´µÀØÊÖ8'³~ðbá9ØQ`õÚƒ¤áðm\«Ce²«WÚÛäî商›6AHT<"RÒõZ½†z*(,kßعߟÂ4c–ãØÀ%×&€Ïs©¼]zPV?ËE8 ØóIܨ)Š¤¨šôÅ•zCÒ5çõ\p`ˆ„~EÅO±¼³ëéÁ²ªaÞVR1ú/X”EÞY `¥±„¥<pÐ%2 úPÊDSõXZn*¤9§ mÎy’¡¥ßÐÓÂuøecÝCË9 ã±’&‘·»Îÿ¸õ {ìF¸͸÷ç^럮ék(ì.ö Gìª -÷ýçõ&¯øQ’„ØX°œ7ý×òpSî¥cÛ i¯øÛµ‹H½à´—62”EÓJø"øž±G)õ¡¡º”ÞCš²Ó8kluê­µÒ‡vìÕwGçô[ ’È7ÉÁc)–ÇÒû9Jq ”»¯!¿˜f9t¾Ðöjiô†$3ÐëD¯¿ˆz<§_DÔD‡­_°WÉoø²x¤0£r¤@âÛ»¯0yšQ3±v ê"c”×*u•My+jÛ¥TòËîè|ðî­Ÿ™È5€+DI(õŽ‚°Þê 1 œ>Õ:‰];Ô jãëø°Ïûôö×ë?¿ÜþçêòöËÝåÕÛ›÷ן•6³?góë;]íê:¯Zè@ÚÚ–³¼%"ÏpxÛd÷‚¼)7a[0ÑCQí3μ|óÃò *Ð÷ÿÑn¶´)ï þÑܯNø3˱{Â9#ä1`ÂÖVO8Ã2ø<¼BLt=0W íkÿl‡¾t~<Pbp[“7 ù'ÀÒj+þR4ðrýóÆ»íÞ'"[ÑŠÄ?Ù 4—/ØÆe^»<¦¶-oïÎ÷’Éò¡uô žük€Ÿ»ÙêKpÿò¹öæ}[n]ß‹‚Ã`@¨à^éGÂÿôôFœŒµ´÷H‰›zÀìÂ:#Ïu¬Eãî`£gKz~äx|ìäÒ†â*+ÊÃhÅ^ŠòZ¤‰ÐKÛÛ.Ú4×èv÷A±G¨,å,¹iþûR¢mI]Ü¡hÍ!g8ÎüfT±ˆàX¤q©l‘¤&Œ•XlöWÑb3ÿ¼–beIVÍ?ÖW¯ÞÅf!¢0‹²Åú¡ß'‹Â83‹õö·àú—×·ë·Ÿ—+¥T T¸\%I¼[Šàýr%‚o¡õϾyÿùíõúÓçeª‚ÿðÐë›7ØÐÁýòúó[;¼”ipë¯qýÝ_ºYÆ©Oî–¬½z»îàQ(…âÿ÷ê·?¢ÅŽúëUª,]¡‚ûåJ&AѢɠk`, šŠ»ÍÁŽ?²¨¸¬ËÛ¯’YÃ*ÛGÞÒÈ },Ÿ`ê‰_–U<—`æЊÈ&Hk°¥3 ¤¸A“À=æ9ãö¾Üæ¸é,kÔαc¢ºéNÙ +04ò‚ó¥>H wð@ƒ2|µV‰š1pâˆÎ> 6¸¨:Í}—£›«y‡þaCïû»°GÂegW@cìypòŽAm@´eáñ%iq"«Y #Çz Ï°ç0ö…$ÉMÛ*¥ÁÑšTn·MÇ&ufD¤ÂD&À„p\³:vìÈÎîCgàì-™…r  š[¬Á„4ÝÆ£û%^rè¨.ðnm @[ŽYoÊC±é8h•NøvD¤,D »Ã ¾Ô©˜G =ÿšé'`i±œ~3܆'0Ç®¿ç^Ub}LUº'ñ•GIû‰ç ùaèѽä“Ö +kžKJy‡†I8Ô⭧щyÕ_’âÒ¸2‘Ùû»=4OhýD»²»lÀÆRKÞå÷6£êâ;Yöz2ÔÒœ¼ß4Möc±bÀò©3ÍÛ%‰„D0]¶-þÛÔc„óɉ€„Ýõé êi6¹'Çȹå6…&œ$7GÁkWX2Òõ†_Dk ±¶~¡b:~ù]GÑr×ÚÅí©¤2È=Ó'xœzBÚÀ¥éùäÑ£™„µ€ÂÂHË3\+çp­Œ¢ï¯þ·S©ÞË|æÑL‚VÅa +9 +÷ ¡¢fœ õ%NЛYÄýŠ%¼eÂö¥í +6"Ê7twœÙ…ýÕ†EUÙv4Çï‡Üsñác/·c8Q=01Ã_Ø™‡;î]Œ!Ùw#A¥ÎÑ%”.’iPwÒ[xf:ƒ Òó +ƒÉ <RÄÓ™8ø=º²+Ù[à.SÀNï,Î#²â{¾ê’ݸ¬yò Y«§Z{é?/!SJ9ìm Å—ŽG»]Ç‘ç줨B +4*>4ÕÖG +ÖÒ>¬%V‹ÕLô”*‘8 d£ZUŸÙØŸˆO©Ïqã"¶O“€!çïD„I”L9ª%ç<£ž4 3é$@Ð'›9 ¸¿xÈÑdªŽûãО¦n¬Õ³/‘i¦é‰º½L5¼'+lÙ—¢ +`XîÚI^Þ«„X™¸@ñö[qxiêb ¡$¡ÉœBÞ!8V•­ûHÀKÌ[Z˜g«Oh¡õŒJ‡qbN 7z™‰ñ$+“d®ÜÊë-7¸vѧX8…C·é¾›}áías*$ä/]¦% ¬ÂnN²cãº!Õ>Q’VXF'‰_´àé–€âi…oÇl äòÝ `t¹é›DϱAêk—y£ê ^ò{G?^Ö2pdýh‘0.ñËD0WÚካ0ÃiaGîñ^¸Ýƒù²Þñ‡|}i°å- +š×E5räÛ˜òmQ…F9ûûˆ býÛzŸ^cw€ÄÑyW´µ5e”ÎÃòØ?%<Ÿä(ü~jhüg÷ãªe—é%> ø6ùôÈ2eŒÀv¾ìåÑLBlG3ŸeÎqë!ö,;±}~¯º!*¬¤†7ì猩pb¨-bì™ök÷<µâ¼ +õ¿«-Òi[Çã§ïò'.ë\Æ:ÜM›99´»á#S”=×ýH 95ø×WÝ8Y24±b–ì!æ|r 45Yo›u yÚ|d+¯•vÀ¤@QžØ4¿@Yœ¼t–/~‰4xHÔîѵŒ£!ǤL*YEÕìvä>cò ¨ö†{9ÿl›}Nîvð¶Óp¯Ue(MA¨ñ•wï"„ë €ÑSoEÈ p7ŸÙ“ÙK'ìå1°…6Èèš=vsäx¡[»E‰°Ë·ÕDØÀ“ÞW’/Èt>£åPÉmKUHÍaŸŠ‹‰äóñÒ£Ÿä'WÑÂPvé*‡¤F1r¤ßS$ît\þÅÒg¡œ‹O??ö`Á.Í«ƒ“…²¤&¤{´ÚÅ]ÊÚn@¯[D½ïqï…6pMx®oeUì,³Î)„à?œ'ÿÀ1·´.Û=à2ßT±ÊŸD‡±™¯Ây4“þÑÑÌ— æ¸õþq–ó>?|k*68x¼¬ÁàT} ’ö€¤×’?2˜ª-I=ðÝ™U9pýŠb4UÀJúHy¯µA™¿[äo\½ªf‰:Â}JàÑA0k¡xŽ|o[̓CÂU1Ž ÐÌòîèØéëCÜçÜ=ÿô€cζý-ü§ï’È«#çµor—?{øŒÁË ”W¶ÀÄÄ«‘*[#US÷“AjÒ_Ïoûc„¡ŒB:ªà8ß1Fàæ´;ÈæÕ{®h¬—påTME@7^$4&Ì„éc]†´MêÑÛ᪖_Ãœ,¥a’¦?tOº))Beæ+)Í´›²4(˜švS3Ü75Ç®wS¿Þ|¥1MÉ¥­ PãPöÕìR „Là'F&”ßÑ¡UÅŠÎð¤-3œlwú ™èÁhNûjÿ£]l3ã¾'XYúbQË“œ&rVEÅ"x$·v úäÿ,RÓg6“`ÆŽN áWHµ°Ga˜¿sb#¿s/à2RŸ,ºiË$Ùë¦YšD ®…{ouòÐwW!9Z œÏ,¿±§å‹bJúB,D_T¥öyùMˆ ­²ëß‹Ó*†ƒ[Tš^iÃXN›È*Éø¥9f s”Kã›ÅJ˜Œƒ7 “Þ|Z[Âb;wñ´ŸÝw¨ßáWVªÕÓ4Ťþâq²yੋ¦Ù(ÕAÈ/8 +ë OíÃ~[çÀp‡"ßbªÎ=®)ÿ{ýÞÓ°Ëɇ"ÏÎz$ûÍUEÞÁÃÞ_ùt‰©V£ÿþ²ôÿ×öêÃi˜¥`(–2”¢†rS­Î%ŽUÆ©ùO\ãªendstream endobj -4781 0 obj << +4890 0 obj << /Type /Page -/Contents 4782 0 R -/Resources 4780 0 R +/Contents 4891 0 R +/Resources 4889 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4786 0 R +/Parent 4860 0 R >> endobj -4783 0 obj << -/D [4781 0 R /XYZ 85.039 786.531 null] +4892 0 obj << +/D [4890 0 R /XYZ 85.039 786.531 null] >> endobj -998 0 obj << -/D [4781 0 R /XYZ 85.039 667.526 null] +834 0 obj << +/D [4890 0 R /XYZ 85.039 766.606 null] >> endobj -4784 0 obj << -/D [4781 0 R /XYZ 85.039 646.33 null] +4893 0 obj << +/D [4890 0 R /XYZ 85.039 746.277 null] >> endobj -1002 0 obj << -/D [4781 0 R /XYZ 85.039 356.428 null] +838 0 obj << +/D [4890 0 R /XYZ 85.039 704.117 null] >> endobj -4785 0 obj << -/D [4781 0 R /XYZ 85.039 333.11 null] +4894 0 obj << +/D [4890 0 R /XYZ 85.039 669.367 null] >> endobj -4780 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R >> +4895 0 obj << +/D [4890 0 R /XYZ 85.039 577.25 null] +>> endobj +4896 0 obj << +/D [4890 0 R /XYZ 85.039 534.481 null] +>> endobj +842 0 obj << +/D [4890 0 R /XYZ 85.039 467.141 null] +>> endobj +4897 0 obj << +/D [4890 0 R /XYZ 85.039 430.27 null] +>> endobj +4898 0 obj << +/D [4890 0 R /XYZ 85.039 283.956 null] +>> endobj +4899 0 obj << +/D [4890 0 R /XYZ 85.039 202.66 null] +>> endobj +4900 0 obj << +/D [4890 0 R /XYZ 85.039 145.736 null] +>> endobj +4889 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F58 3360 0 R /F38 2997 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4789 0 obj << -/Length 3186 -/Filter /FlateDecode ->> -stream -xÚ¥Zëܶÿ~ÅæCa­‘•%QÔ#@P8›8hœÔwF -$¢[évUk¥¤õÞå¯ï¼HQû¸¶(¶(r8ÎãÇjÃEá"Ó~ òEš%¾Váb½» ùî&Š•¬šoîn^ý-‰aàçA¾¸{°|òÀ×y²¸+õ¾ýþõÏwoÞ/WJ)/Ôþr•¦™w» ½7ß~xÿöÝwx»áž#²°>Ùr§ŒñÖÜÕ´Mø|hZ3‹ûº9¥¡m€KÜiuÝáðgügV¥%"x&*y6"šë‘$¹ŸEÚ`„ŒøÕbt8¼éûn©¯®É#lž•g¢¹ŽI @•F$ÏÛX=ŠÐ¯¸ÑIÇ V*dœ<h¦ŽT9rÇžÀbÄ8 ѳT¤<ö4ÏoAžôÅXÓVaÊ‘ÔOÞ¡S‰Sã2÷jR,°9ÖÆb8hˆ:±?¶wk7[½slêOÂ$¥ëoq@z ‰Ë±¼8tDMP 6%“àÊÝÈí{ŠzbyÖ%9¢ÒTªyZf -ƒ:IS:/ù5²«yÎÁˆP¼ØèÆÉ'o~4§ > ŒýE IÓȳËì-nñ£\Õd/è H†gÏu ¯ø%ôf°åNæYEÀ¾Š8©b‡B&ÛŠ!û¦zœ‚5B1+LÞ£zºû¦ÚÉb÷YìêîÀq?€}4t1r‹|¤è-büc·A£ÕÃ.Úõ·7D7fÖQ¸˜äÕ-‹ÒŠÄ Êl«$(¸ï2pkŽ¤6kÌ»»¸»?&ÏÝ -A|l݈¡2Æ€wFŸëé”)IÍ´z‘ù"ººÈ0Òc ÓÅqöä×@T§ÊϲüYÐrh,ˆ†~®µ Z:‰ü Qˆ†^ˆHªïvwç“·np›U;2¢NS?‰™ ×à-* ­„Ίí-Ø,IÐj`áªF[K žq%rR<˪(¯©! ü,x>ëvh®c·ŽC?N2RÃ!–óò3'›oâ ðnNnáÌ -“mÄ‘÷ÞzP|OÞ¿C„÷Ã#¿þè KÑ"tw ©~€Á‡Žt7"a;ŒrÆdF̲z(T/¡56“¡¦£½CíýR#¢#êt‚ =ãHcȺ"çõ¡›OjòéEº©¸§kMø ó¾ÉšÙ3¤$â0Üt•r¹/(µþÄ$EY`ç(Vit}o±ëçK¸\–$ì`r6¬¦¢Ôà/½b¶TÓ> 5¡ ¢@ÓPns´Æw½'tÚlOÂýTA¨ -eãz®|w8+V ž‡±–Ü;$½ŠHSO'k]šÀ©¬9w³$ g‘=…ûEË›!Ò § ub_¬lw=ò’Z ŸÔTÖlWíz®8[wÀ¹Û@nÒãf÷7%Ç”OjEpüñnÛŒ`´ÖéúO¶,D&““!‚o)0‘ÂROù‚¤Ð¤>F¬HŒ{öGW½ÈÓ8<™¾×âJPÜ´¿à1f”ÙóY§CsÀc(ÁÏ<ÿeûĺ.!}è° ¨€l.da|Ûí$î´-T&#ƒr] S>€¸äpýëµB)ŸªøùN4×10:¦þþË2‹ÉÓ“Ã%PKR)wßÈ+y+Œs~Zí¹·¦òªþ\ããP42Õø?é{zPµ¸®Cƒî)§ÙÌÙ„âOÜ)Z!–ƒ=+^ LJY>y€ŠÊ)©ÇÎœ1)bçš·ÌI¯i(G›9% TîùÌ6x”óú¼Ôâ -GKîArÎíÎÈqåò p¡T{w³R,ÉlVÂl”ƒ+MM.e9Jš:âÓV/è€Ã½5É -NÚ%ºK‰\•#Ø«0#Áæ -€NNœa:å²ä%w¼ä „§—üºcüزÈtAýS -/²GP˜²U±‡0 -: ¸ß¨ö‚>.Ov¸UzÈ´swËÈWµ\Þ­ ’¼Z)£å©fÇ0ã{¤S‘ïÀ=ÍT ‘ANÁ¨c»r -÷^ê±®Â`ò_\; ~ÿ0Lçmì=>ýù'ãZ´¢c"ô²­Mö®ÍšÐ0±å™]œ,ȼŸØ¿µvCmªzJf{8‘ˆþÄŽ3aŠfóÉíìô‘ݧ ³þü’uÈ>^H¾îÆ1+!…À²úâÅõ“ž -Aðd_E™ù!'ÐNãñ‰‹p1M?R2xµ©Š 3 y ãö•œîÔ›–ƒFéima”%G¬0™!ö˜FkžÅt¾¬9Ó)Ã{yUÓSJ©L„˜n=¯í±k=5›õáÝÛZ}Ķšž†Ñ–UZn2p*¥?¢A‘CSrUX?HI979‰ž©ÿ@KTÕl6“;FW€¦"ÅÔï,¾E\Å«$_rWõÈaÏ9OäŽ_ªÈÉšU47¦+¹u†·jÑêh3Ü™xÊÜ@õÖH›l€ª“j´¾SáK™?Jgð9pß;hdM†‘Qá’­{¡èÛ¢Áàÿ‡x‰bêÂ\ DÚQ “1áÉALWÜ!€–Ì4±ÊÉ#^wpnC|•™8îrEmûK{ßO—dÙ0<]͉ײ…k᱕ÝZê¤uÉeOíøZÊj0éŒÜxMçû³i„™WND;bÓ -nÄ¥6âÒkДð@‡nr»HMÅû•«ëØùXR´RØÅ - Y0'WC{w¶“k<¾µÇ ǧéq0ñp2/!™6œœFµs-ˆÃçvŽCÇå\×gÁÁÏW»f¹äqè´Ê,§»GØœD -÷•È¸u’‹€!Z¼8Hœ{ùn‘Vr‹› f;À41i× -Áæ0ÉÈ•¶ ± ´®ÜaíËß`¦\ø5õêj¬yãè†Q&wãQ’C!gc ¿áDi`]Û,¶ŠrbñœŽ»©¹s+S¬0kRÍ5«]u5¤2 ° FâÁI±¿äÔÿ¸¹&Ìí.ÅBHÕl²8ì1å<Ò B˜òÌ"ÙÕéR³îeÊq[µÜr¨³ÓbâÍ/¶¦Æ7þ~™Ÿt|íˆ"ÁtÍÔÝ÷R›»kÏ«Zå/§z{0å¼I“§½ÀËy‚¢ŒßÛ^ó»Ye*"”§´‰¶‹À¢©™Æ.Oe… «Î-Í@ð®Ãä$ŠœÂ_¬.£(qr[|›Ê°O“[ÃÄê¿h[ùŒBÔtyŒ-Qz²‡ƒ$¸Œ¯ -ÅN¤σæ¦I…ç.•¸I=} ¸dØ™5äV½*ºŠ;S^S·ÓËWÈùäv˜úa-Vxg—ó­Üch8g¿æÇ_nyæìê`•øQªd¦“„š{wó9Á NnLáš{£¹ý¿$–ðVdüK…ÏPW—,Îÿ( Ã„+“Ó,ÊB'ƒªÅè0Š·0L%†Â_1Ç!cäÁ“Šr.ô‘VŠ¿KŸœijÝÎøŸï>Ê?É5œyt‡·»÷Á7.l1Îü,Í„nW´¼>]:p>}íŠLi?柮œÞÁ?ö¸ÿëg-Óíþˆ!º|ù¤£ÈB+ ݲÅÉ©ÄZe¾ÎÔ‘ÿ gO¼uendstream +4903 0 obj << +/Length 2935 +/Filter /FlateDecode +>> +stream +xÚ­ÙrÛFò]_ÁG°Ê„1®}Sdy£¬#{-e­l "Q&%ëï·¯€—ÊUN©J3èééékúªIj’ÅadòIš%alÔd¾¹ˆ&KXùç…Œ™ ÌF8?Ý_¼}'…y”Oî=< +ã<™Ü/þ®~¾ütýy:3ÆÊ„ÓYšfÁû© +n¦3|¸†Ù^}wóùúêþãçif‚ÿ2èòöNlph?_~¾ðTgÁî¿Âýww ¾úx{ÿ—>~¸›þyÿËÅõ½`$¢2Ùÿëâ?£ÉDýå" +MžMža…*Ï'› ›0¶F¾×wÿö´xÍNx×)m9 ˜„™Î¾ã8PbÅ'‹&3š‹Óü,Úž9ô}:Þ†‰NC¥­·abaG˜Ç1Úlg( +pâØ ¿L•Jƒ¢­QãU½<Ô­lI’ Fd'$¹²¨@üÍI„A4¼½Ù˜É»xŒØ²³]bWe#—S:“4ž¤‘ŸK‰ßŸJð‡4æ:C[>îÀIÖàzq’7¸hƒ\kvüÑ_ñSöѶgüG³"kžo§3"º +ZoH1]W5uÇm› ô+!|ýT¶pn45¬ p× âä¹êWÍ®G“áÑr’ª-é˜æ©ÂÍËé |HOñdþJ@ÅF9Ÿ¨‚š¿ÊÿEÊ`ÞWO4Y¿ðRÝð80_Ï +Š³'(Ò/PòÑËÎb>Çe‡ÿ»ÑñˆÔ­Ø,­ +±\1‰uï$09ŒS¢Ó‡hØÚíÖ=ƒšGŸWh: +_Q9 êø¹æ•b Éqã|d9Øœƒ¹_”õ\8œ%*&Fèûà5q†–sÆÞ7 PE“¡\p‘â‘g ×3Ó -Š ŠFÑg:¶,¨Eì˜Ìžƒ*0• á¡Dèh6N@Õ¢ÇÁ¯¬í—ñÚóªa89Œ[^lÔ#Žl-˜,Ûf·å©x*ܺbì°F'> ØËÅlž‹bxù䜃uõÈ£÷`Da¦e,«½]å·íºšW==îÖè‘Œ9oê¾mÖ¼‚,’e áaвy*›LFÁðB+Æo¥“™Ï ?ïµ +³Ü¾šˆ“Ȇ™¢¢†UhHÄq'ƒlh äC Íƒ_1_&ið½¼^4S—©cØ% –$Á•×(,|`3‘¯ñ…Œ¢^ðêo·7¿óìiNÙ6àM'ÅC…–»¼@§ssœBÊ1'¥Æˆ…Yd^UIœ$a:ªMP%>¯¹C¬£=•¨@¡^â®O],I'ËC©œ ŠPþçXX¨•Êí¹½çñ®œïZÊ ¤3Pñ ëìëfÙÓ…´–篋;àp^ŒK±8JÃ,ã,Ny¬É¢efsÃW…,$—MCœyQ3å„ô€¸*«–ÁußÕ“K €ÀÉå'›K\Jeßs +“ˆ…Ê`N9¿1S ŽOžÁg°ûåšpCÕ#iÞ ¡í8“îHe IÐB†"‰dw06'µŠ¢}·—À jD9“»mz †6åXVô£Š¼ð#•W†µ‰_#å>Ñ!û»5£ÔMÏʶ0n³Ù"v#eÇøp™³ž kŸvï\ŠûHs%Ø,9‚VM'ÜcÁ]lИô VÝ©ºO¨ë±*›ZJú‚4Ís⩯\…hhjpš‰õ…æFj&Bíb¥ìÙf¿òrÖ!KÑvbj] +aH’½Ë 4Ü¡hYð ŸÅbSÕžJß’ÉDl¡Û•ý¾ ðÝÓËòè†esÁ2câ¤è{gìÍV`ìãI°”ñaSò°hÖ>Áôãy+|IQC¬¿Á²KÄBÞ'ù£äÉÓ9ù\Õì„?ÔtíÃ¥N–¤ª.åðƒzïØ #GC.n¶ 8^’ ±6Fœ§jáÎ#'ÑàB¼ç(X¡{´âżßQüÄ*–Š…%U}íPcž©&…à˜›¿¡³¡Êâï/ýL/¦ãòZöj/fbâÖH°q)¸<Ó†é<VriÃTY”šPFó3m˜:߆èžoÃÀ†¡Î±z‰÷\'zp™¿-ù:Â1î¼¥º¢Þ}cyÕK×óå@˜!¿¤«Œ{Ÿª‚19@=ÈWÕ1.ÇÇš®p³^;×B” ˆF÷'ÍA<)zéoœº{áЀ=˜bÌÎÕQ„0)F;¬,€þ\Z•5/öÜFHäâÂAq€I/w­Ç^ЃùD=®nLJrGÓ¸. Ø1>— G­ÕØ:öÜܾðwµÙRðj¸[(¤¢Ã%bRsT¦ä«­ÜçosÝi_s§Á˜Ò5ì ?& ·Ü k;Š©€…,Páߎóí^wÙIñ‚vbÃòÁwôDm—A$Ç!Ðõ”©ØM•ä¦"E¤Ò„ÂèÍ‚[÷ŠJ ý­kj +×R€: +ï]?€ä "‚ê¤?Èqõ8RÆè…!:Sç˱’ë,c<çÄê™æh~ ÖýÝÍQ¦úÕÊX›*ãWû­4ÄT½×héþS•Ï¾ž_¹êÃõ®‹!0\ÜßQ±°-T àh—¡øoË3iI£°*{]žçl¥¯ÒŒºèý4³â\„Ñx{oßê(ŠÞþþI*›uUr®–r­ãºœ½bËs,¿rj~öÍÌjÔ¹—RoUËQâÏM3\a†<  ï]}Æ£FÞä>ŠGúRp¤£þ@j°*“ò –ÕÐÉ:ÉÆåkÁ Ü"P­JŒ– Æ\P}캄¬¡AÁÀƒó¦åÝ¿Ý^1`KÝÎ +<Åj|¡˜Ž’Q2y¢¡3v¼$¡cÛÍ\=¾}ƒw=’¶«¢hΊ¦3=É©dyvaoqéÐÄFÞ„> mv_•î iì!3·aÄò-fÄ<¥ +2¼ÈiÃÀd`Ä# êþxNJ-EXz<³`0òtžSèi}¿‡›ð ôGQ$b_Â\$æ¾r¥4#^‘oÂÃÕ¾ZsQk>ôIxT_<œÐïA=ÑÈëØš01JLÂ})ä§á‘>ü¢þG'’¯JþèW> Ä_™îÍ &U 1!ËL gK øôíJîcV¡šÌµ{—> endobj -4792 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [237.716 727.875 359.98 739.867] -/Subtype/Link/A<> +/Parent 4860 0 R >> endobj -4790 0 obj << -/D [4788 0 R /XYZ 85.039 786.531 null] ->> endobj -1006 0 obj << -/D [4788 0 R /XYZ 85.039 766.606 null] ->> endobj -4791 0 obj << -/D [4788 0 R /XYZ 85.039 742.055 null] +4904 0 obj << +/D [4902 0 R /XYZ 85.039 786.531 null] >> endobj -1010 0 obj << -/D [4788 0 R /XYZ 85.039 685.636 null] +846 0 obj << +/D [4902 0 R /XYZ 85.039 604.832 null] >> endobj -4793 0 obj << -/D [4788 0 R /XYZ 85.039 659.022 null] +4905 0 obj << +/D [4902 0 R /XYZ 85.039 566.731 null] >> endobj -1014 0 obj << -/D [4788 0 R /XYZ 85.039 573.889 null] +850 0 obj << +/D [4902 0 R /XYZ 85.039 566.731 null] >> endobj -4794 0 obj << -/D [4788 0 R /XYZ 85.039 553.755 null] +4906 0 obj << +/D [4902 0 R /XYZ 85.039 532.654 null] >> endobj -1018 0 obj << -/D [4788 0 R /XYZ 85.039 469.885 null] +854 0 obj << +/D [4902 0 R /XYZ 85.039 235.69 null] >> endobj -4795 0 obj << -/D [4788 0 R /XYZ 85.039 448.688 null] +4907 0 obj << +/D [4902 0 R /XYZ 85.039 203.472 null] >> endobj -4787 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +4901 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F20 2961 0 R /F15 2972 0 R >> +/XObject << /Im3 4353 0 R /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4798 0 obj << -/Length 3208 +4910 0 obj << +/Length 2461 /Filter /FlateDecode >> stream -xÚYÍ’›H¾û)ú6(¢…G;ÚžõîŒwbº7|ØÙh©Âz¹Ýo?ùef’gCª2³ª²²ò_áM@¿ð&KüÀä7›,õÞ”‡7ÁÍŽ0?¿ •"NŒŸÄ1k‡]§‘Ä›E=c½‰b?ÎbмxóöcÜDŸ¦ææáé& #ß„ÑMšç~²ÙÜ?+Ù€e¯u%Sº¥\‘ÆC·âÛ­åz Â¼†(+·¤1Ahaäñî{Z=O¾ïÉ­.ðÕUö¼™Ð߬¢Ü{…ðH(ëOó-{;ð´c”§Þ Æw];ÝË3° ÈÐÊ÷ØWl<û„oBÇV¯‚â3í®c6”Ê-;+¸DGªÀ:‰C(??ÄœIp'QŒ‹F‰·P‘ùý¾Þç“ðLL÷ÈYôCøÛöYõfïJ~ˆàN…H³Ð»³ãK•CÛ½ -qKêj69öåù/wXòî7™=âúüŽÕV:ÛW"N[òƒÏˆK0ùUUƒ+ù Oö°ÇûGiæõ•r‹]"²–êûs-6å(ÚC%£GÝ_¥=:9Ó"Ûà ÚîPLuÕ®è¶B³ÈÐûÁ!Ï5F¡'âE.yÞ·¸ò l:ÉÓ—™ï&®½¯Ðü8÷> b…Os¯áWv;åžbÏR¶!›aäJ²úÔ’g °†Ï"÷ø X±à€¾ÙR·}èú‚ðáíÂ%ñØÆÄеl²êZ€‚4ÂÌFÞÛˆÙ!’{Àΰ±sƒz„eÿ—l2ÿoœöDâ|vû&Nçþ/IŠ™óÙ¡>ÃÇ•!…$'Ó9_aRµ=ˆè}ÕTa̺xÍC»­ÈâDsÝG'†Ë|t†¢R0Ç8 ¼ç¢#;sNí™u t¶‘ïLäÅzh×ㆂƣáËÞ£‚Oœ oéö¡M~½—ó¿Øf;SXîÒA±“#§­Q˜D”d°: ¡[Œl>NÍO£VXvÇðqG,ÀØÓwv_fBh9ð&2­ (¥­-ûJ|=Å—¢NÝi0Él4I"~$“¼´•KQŠµÿמ‡ c¸ÆWq†ªóÍ~¶b›ì¼ˆ½}1Èè4ؤ‘·gviÀ1²’±\ôh!V+ï ”­ìõ„—hJç#Ã)Vâ&²€o^ªÀj=ƒÝoFÎݹ\XtäªfÍ·[/\o)’ˆ#]1EÏáÞxý‘·Þ šý AÇX”ÅÞ­¢Ø`i°›‡7Öa@ù*?ér÷ÚN `?•D¬‚G·ˆ¿¡÷[‡å’lÿzÊÍÌ%Ö#æR+Þkâ,‹èÂØ»sùËV"'‡°Z`|dËq`[±èqÛYP%Åö`;š‘d%BõÕí±†dBCŽw­A_pjõ² „f{¾…’³DÀ3Ѹ3pØ–’Ü k/jÊ}1ÜIþQ–pju¨Úi²Ô@%¸ö ßØû$²¨:6‘¼z$·['aÓ~òõ«l wí??åQÆ3n’™Ö¸W& ÜèØML“?JòX6å¸N©£¼B÷µœô+L‚³ÄbgëŠÜ\¥”JÅ‹ ÷ôq@ù¨¹Ê¾¨kÀÌŒðU(¦¤g+#И?8V+ácëHEuû|Ðtn)!`ƒ3ç˜x1bòhüˆp~¶ìÚ¾}dú®œô±ÿÎjZïÒNz¶k)]Ж+¿1ÀÎh®'$"?Ž\i@åÙ”#q]v4`1– L“ÒÌínMN£ù!³Éõd€ò2?H%aá°Dˆ"°?Q6„êÀEãâûÛØ*ÎM’ÈJ@bå±›Ç9ìªU+dÄ^ux®[uŽÀ²¾a/°cpÕ¸grⵞ!Êöâì…«è)ô—cYǵ`%¤ö(›ŒÃÿ­ RÇúm6“•8r2LµŒ3ZÆ+Ì‹)Ñ Ò)Jê»Ä`)nÒjÇžß/ Ð(wj&ó§"gR±ØKàU;AqÖF²§ÜdW ¨ív\3Ú^tQ õ;ËÛhöµ9I.®¯Öi’{ï¶[f_dHãUÃf $XOâHŠÁ=o#©#»Ì…ºú¹àº!‹fåx†ÇÛµøæhª€A0ì×# E4»kPÈ´K­ÈÅ•‹ -LY^©‰¸î§%춪©¨sg¨q$8 Kï3t|ëϤ÷Ьé­Ë¬Ó--†\H"ï¦Ï†¡zFÃþÔž•1 Ñêza}Þ©1r%üÇI]©n5Š¢§íL^Š`"™{^Ì©à×âšÁ«@ï«îÛxS® ôîî^êB&<­ýᬑ¾ÿªºÇétÎdzÙhì}Õ”½ïö21LfõfÀa>¢‹E£P 1Wrë¢tZÇÅÎ<÷CG„-Ì`ÄÚB«j{°s§bŒj i<¬…Û)V<{6¸ºÝÙÊõ³â˜œq;È!Õe6Æ»%%„¸çwAd’Ú ïÅ·.Í$†SYòbëÚµ3—\V_AŠ„N,–ô–¾ ?ÂÈäð£Ã«R¶“Õ5|IÞ{¯û´µ&‚”ÑÙ©Víx´…zLB4 -/É3P‚D¨>dzåáoµõÔh fµ,«´e£=deó¶“lt5ùÔÈßò§‹þ§Àåq¸n?,å¶@œ+äªó„Ÿý#Æ'³¿£AÓ6kªUOÚ°®ª#³ÚáéŸ#X3MW’˜1ÀFY"ugñ<{Öö !™ÈõK»Jgx#ƒé¹Gë'ªºâö;¦%_VŽªûýÃÝ­À¾üãÓÃU#¹ùöË>p—Àø™ô¥ÑvÒUs0²­ ÏÍ)–Þi|ö‡H—µ;®ÙÂÞÇË©gžùôàÉÑ-õ?6'ýÄë}Å‘ô²¯hã§Ñ¸÷@ãÍù™‰Éü$3?8ô/VvÒžendstream +xÚíËnãFòî¯|Y +°¹l6›½9;ñ``ÏÚJ²‹$Z¢,©%éñúï·^M6-j&@€= 5«««ë]Õe5 àŸš¥Æt6KÒØ7ZÍ–»“`ö;?ž(Á8”sç‡ÅÉ߯MJŽ¡µŸ’‡ §d$ËbS°· É¢a¿®òl¼–ÀÁ˜q‹¿f`9ÀÖÈa³û+038ëà»xëéÆÐý\Á¿@¤~’Œži«ðjý4AR¥~ªRAyi‰sãß|BFH“iD¢PNؼÌOL"̱J~‰”׈haFÉUJÃK¼²å½öH Í-ì~¸¹{`$Q$ ‘ÆÒkLÈæ»9@çì/@£EEÆlÎÝJ6‹oOGä*¦.©Ã„~¾½ù¹G0ò ѧûoÐ锡8ákp—éÀ= À[’yV‰—#âÊîƒYj<1Àa ­ÃÀr‚òÊš£]Z£”ûNüœQÚ®Á“ÕÓ@e!€Ú)Ñ)ßJçâžðX[Š]§ªñâ+§ˆ|›ÐκƳˆAÐÕ¼$Ú„Âè/—èåp˜³NŒÆ"chÚ!æÚWtº¡3Lò.ì7IuXà"ƒ àKÄ~ú=WtùaÔIàcQ‘ŠQÓa¢¡›ô0ýñš³K@ÈB|»zjŠ]üô¶)ZÈyu4¤FßjÙ ÄôÕH‰Á`±Ïˆ¦Nb“@ld^çË-/H5”‡÷œkÁ k£Ðk9J…|Í¿ë|Û¼ßõ) ²,HÁ¦[ï"ÊÅ $Î!gÐÉš°²&^¼‘<+·ö>‘ðvÁ +¿C¿;½’¤ÀÕ¡¿ôt¬¾´Oí‡&CÇ”‹yL<Ï5K“ß,„)”£& +!8 •ÙxUÝñBȦ ÅNQƒ=Ö{ìQÕÞP®x"5$CF…í¾0µ¶–{&@¹ mlÚˆ7ái¾ÄØ››¶ÁµEpÛdsÕŒy`I톒-Ê*æŽB¯ìø—”…—“à€@þÜî·9^÷Æ°œqW¶€5úD:´¡ÔVïà$e“!_›\®“Ì¿Ï\®b-omiã iÆxá¼F8ÀÓS±âƒ5ïÖ®çÒHïÿ*d…_ÐPчÔÅe^!×dz:~Ô¼P9ŒéëÂ)¨hò®$Ù°q_L÷gŒFóenÀ]Ê-%ø­mçí›”íÚ}‰me'¶£ÄW&”èlæFC&9ŒdhS;í%‚‡ŽôËq?i´r:Û~¸9pÈåòÁ?[Ž²0Ný,ò£Xd‚ß¼ã̾Ûw²! oœäˆØé{âôXŽÀך4æ ´o•b|/GUœ¸á286ÀÇÑ€>fb²%njИ²ò9qrè8ƒ.G­6'PX¼R`7ÏòU>­G8Ÿw¶'·q‚õ¶Ü‘Z§*,”ÌaÜw^¸5ï&ð—ò ¿>¸Ô1´Þq—$MÂHä?89bDl-€j1ž]Œ9+P$ð©œ?]ÒN%¡Ofud"YZZ˜‹weUBs˜“+5.pÑjˆWõÉbÙ±µ­Sv§©ö€mŸ`lÛÃ]kù·©¹tcª½¢óʲ18TvÔË¥«‡ß>cµr¢b¸<9Éy,÷)¸1q±Ì·Š¹]\cóšQ(mWìp#F…vyºÛa–Ç7‰½bK+ê8†ÆO4U#=v³a®‰Q›üI‘´#˜ÐΩ­#îÖ|¥¤Êwâ=–ˆÁMW†âHC€*ÏU‘‰ç|¿öoH[xDÉßxý‘" _–Fè]P0”m-øÌ¢4¸pü)?_àPªà'Òçf«ƒ*@ÜÇ­œÄÛÔ;þ˜y—SÝÑ£0ÃÏëÅg^´e7¤Š‰±N•˜ô«cçèhIã¨*V£ÑR45Zº.m!äÁ’Râ}(›bÙѨ ‚ ÏÔÅ6;pÈ PkÛcR@ÿêøëR 8G‡OZe~¤gŒH¼–øXÓÁ¸8òd²ãï1ÚH3û ‰Ø‹¨J8‚½ã)~ÓÃÚZ­˜'—4`⮶o0É[×èNµ‚¬ŸjÁ2gìÚFZZÄOµ¬”T’àÃ>|¤P‰ñUŽüÓIRa6Ôw\ï)Q‘q)HËZF¸™ã;<̤#„ŸÑ¸r¦Zô¹~‡é´x´/xÔÆ7œ +:ªXoŒ>?Áöôd_I”ÂÛª´ +ôöY`«‚ðai¹:è¼×Ã<âÿ4W õ_©et‡ËØ÷™Ú÷™Ú±™šy7RÓÃHMÛá˜Ôôû‘ +™´áD€ }Þ:ƒ4miy+´ÃñÉ÷éÓŸž>±Šsk¼>vÁ{{?;ÙÎvü<Ú¤b&ïw’"l™¡^êý „.”± ߧט¤_"—2ÑhjTÙé‘'V¨xšÓÖ²¨ù‚\-0R&ão'xD&$8®90$ŠèM»<éŒ> endobj -4799 0 obj << -/D [4797 0 R /XYZ 85.039 786.531 null] ->> endobj -1022 0 obj << -/D [4797 0 R /XYZ 85.039 766.606 null] ->> endobj -3018 0 obj << -/D [4797 0 R /XYZ 85.039 672.187 null] +4911 0 obj << +/D [4909 0 R /XYZ 85.039 786.531 null] >> endobj -1026 0 obj << -/D [4797 0 R /XYZ 85.039 578.47 null] +858 0 obj << +/D [4909 0 R /XYZ 85.039 766.606 null] >> endobj -4800 0 obj << -/D [4797 0 R /XYZ 85.039 549.735 null] +4912 0 obj << +/D [4909 0 R /XYZ 85.039 746.277 null] >> endobj -1030 0 obj << -/D [4797 0 R /XYZ 85.039 409.231 null] +862 0 obj << +/D [4909 0 R /XYZ 85.039 381.058 null] >> endobj -4801 0 obj << -/D [4797 0 R /XYZ 85.039 379.827 null] +4913 0 obj << +/D [4909 0 R /XYZ 85.039 344.191 null] >> endobj -4796 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +4908 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F77 4849 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4804 0 obj << -/Length 3457 -/Filter /FlateDecode ->> -stream -xÚ¥ZKsã6¾ûWèªjÄ%>÷æŒS;ά­Ô’h‰¶¹C‘Z’ÿýö )QJÕnMyˆGht7º?4.ø.²Øt¾H³Äu¸Ø쮂Šôüã*Š•¬F4?®¯þöS-ÂÀσ|±~¶óäçÉb½ýÝûøóõçõíÃr¥µöÂÄ_®Ò4óîî¡íæ×eè}º¾»çÎõrzK•y¿=®¹éáöŸ×Ë ºî~½âŸï>?.ÿ\ÿru»¶œxµF¾þsõûŸÁb {øå*ðuž-Þ øaž/vWQ¬ý8ÒR¯¯¯þeçâ¾hÁ£æÄëÌ3}*‡0É! •¯CµHãØO¢”Ñ•u1TmÛèq§¯P¨ö–+•&Þ€µ›hH gÀ¯"ª¶Þö\^‹Á”Ì€Ž *Ñ^%dMËßj·‡Îº*·2¨;˜Õeš'\Þ+”úÛ‹c&†×’É°ñÆÞp½h¶Lñ#vüó·[T -h¢ürÚï¶Ý•Ý-è=Š"¯*ÿΚ‘$‚lú×jϤZG^Ñ•\(¿ó6(4Z 8q;0Õ€"(š¾ªo¸‘Ò'vDcžîË7à[ÇÞ€‚¡Ÿ`ä#¿ >`z˜ñÖs³ -‚€K×7BÙ—äeÙU$ºwîØ€v¡6”ßMÁõD]X~Fn7F °ѪÙÉ¡—Ú¼Åô´¹ÕÌîHl*Ë=§Îvõ†åËÈd–Ê…a Ü–Ïn£P?*÷®kZ©E³ÌS¯¨k&D-Éތͭ°À2YEÛT›YÏãk]a÷S‘òYeÆF€‡»FHÌòÀÛ4¢ÛYL›nŸÁbŶªcô7¸éËÏwë[n¤E·\þ하é^Hø,ò™'š,x]âq`Ê/$‰¥`3[ -¯¶åH<†»Ó#¬Â–“ܲ‡e{¤¨F«ì°© Ua­( ¼×÷ܲFsÁ"É Xe*8 `5e‚Í€­5Ì`¾°4¦£ -´%«™ŸËb8 êh¶ç™-ˆ(aÅIjL½Çb‡ÒyBk_i$Ò$EÚ ë’Š²`Ïæ@ÂŒ"æ–ŒYºï×wö|îê’Ûï„kã-7LmΕ̂ú9ÝJu4G»gçØC‰Â -”÷V‘D±V±8cØ ñK$¦(ÀwàÜ›2d}RÌ):@$ãÈwUâì¸oW4‹D~ítcŸÙgN<\Æv-—äŠ4ˆ/Twûòùœ¨ÌÏ‚è"|ÑPØTÐù:JÆa3ožkb ƒ‹‚½x÷$vÈX’òÖàkmE|¡ížî+I\ä $6¬l›?‚0z9ðØÍžÙxZèË»r4çÁ@œehSk­€b -ÿ94•“{;¹‚?û¢§ °Õw[nu2Ê$@·ßùÀªâ‚ wÐ&iT%è4;‰ÂÐmR`®¸À¬I…Ì ídÊISŠ¾ÝÄs×›‘êB¿¸•|ïj#dZ)´#Êøþ]tB,Ðã×Îd`0ˆžÃÅ:Ï}o—ÀŸ#9Šu–úYžOP±úŸQ1C¶Sv|–€ äŒÑˆ(ç€éa@1zT€ý"fp‚Ï%£Iöƒæ—.ºyuÛ ð)øªË÷¨ÍyŒ¬cíë˜Y¸Æ<űÁa‹õGè/(7qfÃÈQVè}冶©ß¥kœ˜¥¥¤!á´ã,,M’%ù1Lfä…à @IJÃÄ3Ï:—*öû%'"лx†£0Cót.À%±k’«ÂÎIy,%çL£0u|<™9 ¢Ö.×v;»üàæ3 ¬áŸ»œf01?8ÎBfÄË–9›±ütÍ%ºµ›âÂYŒ:Thï~Q˜¦4®©Üuãº[å°)Ï!lœÃŒìH¥Öîb>ÍŸ -FXi„G0Úr®»”AËÃ|¦—fSÓÇœtSWtùÊÕVšç«2gÙ_…þTÍD~š´½V’y†xe -:Hª‚2ùX¥¦pÑí‡f… -EøZhh®§µØçéŽBðÄ>Ž¡1¹¬83˜Ãàf ± -,!@‚Ëï {¤jÞ›ö±r,ŽŠoÎäRH£(ç9:fŒu(<=µœÝÁ®4!ëUz›b'%Jv»,öqI:~'‘<¿éÐF01d²G¯.ç4d¼€pGÛÑÅ0wÞ§^æ\ÌT1ÜLôåp0¢9Ÿ,T¢&XƒDÍH’…6Áקˆ‹ÝSaR„+8‚ˆÑêr”?r‘r”6<³ ßðò“éˆæ|TS Â(ÊÂSv> ûpœØ \ííÍ) %û®‚37 -­©a¥àÏsQádæ Ú¿Rø“.Þáe(#6jVQó[IÆIójrÊã•ûRz{8c0ôPy¤“Ôbj~‚éFm-—÷Hù,JpJ-<@µ/:ä¿Úíï)~ј†“e§éQœÝùå4<—,#LväÇç2'sN] çcúž¥(’ÇceLHÆbÑZÀä™N;ïGî£0úœ$Ž!晸„ÍrzëVò¿Î¡ÐÛb–Þx¬ý t‚¾rn4åpö™õÖ½B…¼F:¯ƒå}GéÜþ†Á*§{îÞr4ÝtÕÓÉãtGaBrÔUÉðñìxLÑOYéÕ%”}Q.ž¸rS#pAØ•[îz«†×³¯_Hr.)‹Ï_ô¢Bï`"Z“ŽTÂç—¾%Ó•Í¡ä‡פèäÉþGÉcÉcó¿-ƒJ!lpö†T:òHÒ˜÷ÁS¬c^î5ˆˆµîäñ:ôkö -娧.‹Y|ç6>ÛíÈ*1ÓR<($ÅmM†™æ`~Ó°k9ìäBk9a~±iíƒ#€Ižä‚·Yõ|üJë"äZ« ‘½¢á?ó÷ Öú3½utû“ •ÔÆâ0F2ÅÖ¤L°JÇïý¢lúcŒ†{Æïo8¾’Õö|jÌYxÿ ï -G—…÷­êèxïp.P‡¦Ë/Žäüå6Ëý8P£(í^|( ¯ A˳7éþ_Fx&Ý鮫“\ß ÿp©Óì"ÿŽä||N2háð|'y-rÜ[Nÿä‚Œr±ñÁ$©L>< G oâ÷~Æ_Ô|œ·gÈå¸t>U¥$ÀÄFÍë2DÞ> +stream +xÚ¥ZKsãƾëW°xXeÂÏSJ^iãuÖ+Gb*N9>@D¢2®Vùõé× †ÈÝ8åòr=====Ý_7äÏ<øÏŸ¥‘ë©l–¤±)¶Þ]x³ ÌüõŠ¥,-šVß¿â™ï¹™—ÍV†Oæ¹QÏVÅoλ¯~YÝÜ-–J)ÇWîb™$©ó~á;Kßùx­ïxöúÃÝÍ»ÕíÝ"UοxèêÓ56BçÈ~¼º»‘áE:ïpý;\ÏÃïn?­îpêöãýâ÷ÕO7+s눾R(þ¿ýîÍ +8êOž«²tömÏõ³l¶»#åF¡’~}qñwË篚Җ¦Xú™›ÑyƱ{±ÑhàMh4ŠÜ8LH£ ÄÈ…S‡®ÚŒÂÌy_Õ%h Ž_ÊsÊnWÁ|ßÃ?UÛô§T!<ÏÊ6Òl~4![໑§H¶Õ ²Ð釼)`ÿ¼+p@9ÿøôáWníûo®ƒÙï7]»ÆÆË"HœÇjY0txˆçº¸üxb ã²Í9Ѳ®ì±ý ãÀˆö®š ¯˜we^ÌÑÊ<ß™¿tÕPšÉò…9úÎzS¨/PÃft.fkäÞa£êiG”•¼ bBÓ@ça¡½ËqY¥NYð‚‡E9¯Ü¾Ïwh¼9w‘qƒCË2NçïJaZÖ%IS2)“|Zñ/¿“Üy©`%´àPòÐewùž,v._¸•€ž½Hw‰Š¹œÐÇ +‡gT~Œçý8âñT(6öh7l|ý² +eÇ_a ¶L´=X25¶ÁìC•²±!)Û¶Íè,”<ï„Ãx$*&N\‰~áúX|³ØÞÔí{m!tкùƱwó9”Ý+þ´M‰è§Îc[£¸-Ž’ø¬ÅM#EÓÀ¶è0têªx“ö‘GÎ0‰ ãTŸV=.è*¨ êÙ_¹G¤mW㥸Šà'&úEC‹·hÊŽ»Æ‚ ½Á»À7½XÛ>ÊÊoGËJË:a\Tý3ê$Gm¶èµÀúœHSÜú hðÈe*ša b£¸àm:&:ð]r½HHªuÛKËÉôIä*_Éú-ÂsÖxýAâ;ìÔÞî¹TYæ*h“:#ko ^o‚ÑP±ÉÔ¯L2m*J¦¢F÷ˆQS¬Zd-*8}H4m-¸±¶â_rÃ2èíõã,…Žü56´ c +׃¸‰Ç¿Â!‚íòF®WÞ3´NøÝŠ”óJÈA¯ Ã\Ü#âÜbe<)N­[šÜi6ô`á·Éw¥HÔïרá-/Ïe ¼Ûă "ó°G³ A ÚnâÅ<¢njô !XIË’t-¨ õÙðÔ¾ßçtÁ¯Ü77ú߀pÍ‹Ñû=è…Ì}/’üÛóCè|! "2­þÃ}Å|»q +ó^d!w^årŒ+ꮉ9Ë5gnUcÎ9¡Ò<˜…xö¹eÉh½‡FÃk~Øã g`§Û\Zt ¶ ×Ve¤G&cÛ…¿–SÉ–îÆ›–'œªPL¿‘,ÇÙ …fèg¨Ö{òe2)¦ -ƒ¨7úIä5iF£c^†dH;~Ìdôrh Q#çCä|z;‘8†´FŸB#óFÏz§ýÝ/±JchÈ¢/E šÒnÛ»–8Ò}ã-”2®Ž½JŠ«Ú ?›K ßæE¯/Z_njxØØ5uƒH;ðùj‘ÃZ€ƒÄD‰sKá ²­žç¾Ü÷Àƒ@œE÷? ¸²zÀg?ƒ‹¼—mµFÂ-_òht* ¹£Ã¾e ? Œã-°ñeÖ)*’ŒÈ ’è@?])èª#ï˜)¶Ë@û>½Žl‡H)ªÌ—÷œñÃ=ä²É–ðg®žïBMßyW¥æ2n§ôÄnjî‹Ñ'sç˜~b>€“J?|ÅF f¼uÛ \¦åI… +’˜@Åvh^·û®”Í!ü“˜ö*Û5Ûtû$ÝÊ&ÔþŽ­ lÆìy£e“ðº¯à_8ìÏ­•\åWµd„gb+U"vØ<9÷0—º%ƒ›Â½Ä¢€ðRQXQÖZÞNiÆ9D-ìSÜég˜&.'â'³Ï‘ädbÆ«"u”’_ëhØ‘j×p +:_â“e†+hÐNÏ&ÌaìçEiN&ÌaÎÇcõ^WÉ=‡¶«~@ŠFÈ$&W@¿'aüÓê=;bCXÉ£ýk?”|¢–W(VˆƒÁŒ-“¨à¡ØèLúˆsò¦´(<úu‚Z‡Äó²˜AF×25<ÿ\’úŠ¬)šcc,}Ä`Ü gQ•8hÈ‹C¿òt5p@®¹"j,]mK0­–UÓ¹ +ñk´”¼¶B°#ØU„œTHÞYî™ ŸLž#WŽP¿§Ýí–Îünáû¾óÏ9O1Ü‚½–KÚ£„!Üœyì–°´@ ‹L9™P§P’R†Çó0f•©v½ƒÖ4¶ +Ø—_ròZêøUÇ“R\Î^T‚žÈÀGˆ]ÚóSxÝôSÓF§­à:LØC/GJSë®z°K¼'µ( ??YÄÙð±âÓæÛ!¢†ÙMcfëÜJòua‘*g*Ëâ”= å]¬[*¥±y'8‰·Š¿$VÇÑ‚p"¾œøU!qjGÛà0˜BÍ­c”ƒcbËØ4Q+Õ¥k÷·ñÉ,lŒçÊ'C@"óžúCÀŒ7·¤wŽ}Ì[¶#hAG3öU±{“‡yX¢ÔHÇ̆%í"¿ û>/däåóý{‘|¡óÖmÑ +òé{]ñ:Ò䶤òédþd¿»Ìãë{=p0U_ŠÙ£r´×a›¬Â"jÁ N×€\Ò"] c]9ì;6øgc¿[ }™„> ¾Â“2Èö´ðÙ@þD,aŸCã-ÑòžH繸½œÇ J~]c-Þv­÷`£¦j2Gž®µ¶ÆVý–«‘Jé;­¦#ϱ u +SX—úÊ‹Æ *ßÍÐá„„X¨*Âèy€:©ÚUT¯œ¢Ä±…EÐ÷)Îjc¬äu º<ºžiõÿ€º‚0qãó8q$9‰¹?rSߧý,^a¤—C$áÁÛL"“´âÔK$ÔýÊoLßø€$2®™Éo_ížuð±†9-¤7FÒ CáŽ1´óHÔ™w˜DGÑÕ÷ä‹PyÝnØ/YQì‹|ŸDÃ1 ÝV]Q:õdÒTòåD¡ÔØ-‘ÄíöoS©ç*ü˜Æ©%ÍINeþØùñ¨Þ"etj8ðÒr~IШ+óøzÖÐaj|縀Ï`Õd g^}Yè5­$ÜIঙøIÄdDQÂp#s'C­àJ„¿¬É`AÝ·<=~í1‡è3ÚIj± +G麶XÂŒãWS»ŒBƒ_ ãÌ—ÓÀ“llžNIe¬Ñ8n>á[»¾•³ù€7€ Éwöƒ†°'•²µ-Þ±•…u/^úMâ9H:Þ©‹¼¸Ž+’ížCÛT$ü@@6±Ðs* [ ÖÀÕìd,@›×Üé÷ãG=ò BÄn=µs"¢%Î#ÝLTUéaùK©Ø‚ ¸ã0”;ýúxáƒn\{Òò`­>V`%¤õèU¦J×9Õ’uX’…d‚Tâçßùqñï溤â†8(.+ýú>ßHâq®*?±2_îH¾Êéý„ñ%Ùü”uN¤¹^DXeÊ/Å›%ú ÐüŠ¤,¦*O +GúÖ={­8¥•M è.„6çŸÚxr¡æïx±ýY¼—ã4TDøgqÅ=¤Ô´þTXC “©³¦¯z‰Í1‰ÇÎ.oè³ý¾ÎI=’lLC ½ÞwæÓ »^ù-ˤgrà]çKØ髆«„¶8D#ÉQˆžþR«Óp‰${úF­¿&JÎô$ïõTe9‚–ºÚ—÷66ù}2ìÊÃ)úب•«‹'¿8Z`;ÔßFFyQ¢Q^VÊa' "<Õpº¤ÿ³^þ¯¿û± +“n–ž(òEA྆ tK©ÔR5!ò‹1)2endstream endobj -4803 0 obj << +4916 0 obj << /Type /Page -/Contents 4804 0 R -/Resources 4802 0 R +/Contents 4917 0 R +/Resources 4915 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4786 0 R ->> endobj -4805 0 obj << -/D [4803 0 R /XYZ 85.039 786.531 null] ->> endobj -1034 0 obj << -/D [4803 0 R /XYZ 85.039 628.804 null] +/Parent 4914 0 R >> endobj -4806 0 obj << -/D [4803 0 R /XYZ 85.039 599.4 null] ->> endobj -1038 0 obj << -/D [4803 0 R /XYZ 85.039 571.365 null] ->> endobj -4807 0 obj << -/D [4803 0 R /XYZ 85.039 549.504 null] +4918 0 obj << +/D [4916 0 R /XYZ 85.039 786.531 null] >> endobj -1042 0 obj << -/D [4803 0 R /XYZ 85.039 399.12 null] +866 0 obj << +/D [4916 0 R /XYZ 85.039 766.606 null] >> endobj -4808 0 obj << -/D [4803 0 R /XYZ 85.039 363.917 null] +4919 0 obj << +/D [4916 0 R /XYZ 85.039 748.602 null] >> endobj -1046 0 obj << -/D [4803 0 R /XYZ 85.039 255.733 null] +870 0 obj << +/D [4916 0 R /XYZ 85.039 487.33 null] >> endobj -4809 0 obj << -/D [4803 0 R /XYZ 85.039 224.208 null] +4920 0 obj << +/D [4916 0 R /XYZ 85.039 453.186 null] >> endobj -1050 0 obj << -/D [4803 0 R /XYZ 85.039 103.45 null] +874 0 obj << +/D [4916 0 R /XYZ 85.039 275.331 null] >> endobj -4810 0 obj << -/D [4803 0 R /XYZ 85.039 80.132 null] +4921 0 obj << +/D [4916 0 R /XYZ 85.039 240.585 null] >> endobj -4802 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> +4915 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4813 0 obj << -/Length 3468 -/Filter /FlateDecode ->> -stream -xÚ­ZësÛ6ÿî¿B×ëŒé™ˆ%HðÕoNÒ‡{‹åéuzý@‹´ÄF]’ªëÿþö”(§w—d<Äc,‹Ýß.¤füW³,öƒ(Ÿ¥YâÇ‘š-·gÁl=ß)¡˜ ÉÜ¡y½8ûêÛDÏTàçA>[<ØyòÀód¶(ñÞ|ù~ñ͇‹yEžJü‹yšfÞÕ5´½½¹P޻˫kî\\Ì•÷á"̼»Û7}øæÇË‹ º®n®oøû«÷·¿.~8ûfa9sxWQ„|ý~ö˯Á¬„=üpøQžÍž ø*ÏgÛ3G~¬#©oÎnÏþiçâ>=ãQSbˆ£Ì³èX*vä TèG*œ¥qì':%AôkØ@Ñ¿‚å‘÷ŒûlöPÉoYì° ¼=t(†Šë4FÊçÔ±Åq÷8Õ»§òœ'Ù÷õšë)žQj ë8K¼7mUôõnÅdýÚÌÝÚÕz^Ey%ӔͶ¨w\.–Kìix‡S÷<¼îð @(s…2Ëi AÕ>‰Î¼®ÞÖ›¢ÅJêõ 7.n µàF——ªä®-ÖŠ%θfX@[?ËfÏÜÀ&u–z·8ÁããÅXo€—:H­± Qh·ƒÌ1AŽFbkO¥d‚Á4œÓ®`ÜUF,A?kÇGò2Äا ãåEJcfØÖ ^Hl¢…Ú’»šC:÷”st¤/î ÉÆF—‰9LöÈX€+Œ…7G~•ZÇVëÓ±B]<}~>ê~ßsŸ=_šIžÐümÅýýºÊŸHèeC4¸^ð—õ©¦é¹•f±[½lÛ¸ —oZ9¾,ö†ë_o¸%åO‰ƒúY.L„>¡Ùl˜Iñ à hvˆNòüP߀`=ɱjA[õä[vS¤Ûó²oìaOÞàöàtœ§¤Ñ¿á9caÃʇ]¹@“Í`v°ìè% -ë™[Ié4Ý9¡Û™-=É\F¬„܈w¸ÞŒìztµ(cmÛYX]³u)«G£QŠÖ.Í]ÕAâ5;þŽ¼560Ol ”^Q±DE®_±S2è©A³B2¾cçÓàzJYê‡êâ,–¢2¤ÞŸØx­X@&@­<æf T$³]"$ÄÃßä¶?²0ìïHß“ö‹¬ÿÄåÝH„ =såX­å$99#ÐïGÿ’ÌQ¶l€bÉD¨m¥h¨k}!Êœ‰ù1Ñt’5M ·ÆTo(‚j€<2~vb1bd…]îáÒ~2dD€æ+ÌòÁ‡Yf¿C Š¤&vÄg'8QžZˆ½f78ñاl’eNfAad”hšz+%„DrìÁwé¢lñêZ¿wÔ$ó(û6ŒŸ©àQ=pŶÊø¼g–!‰$cßg\/¹Oj­‰ªÙK çÒè]YYè¹ÐŒGR¬Ï¶&“ñVœAÑhüB.(k³t¹‚0FážXV%lA\Ru€GÈùaK®þ-~UNܶ3G‘E=Œ9Áû'r`Qùaübún ¡¬šEÓÉZE™òÓƒQ•øMBH·<ðn dçÐɉŠ è)QQqE +€½§©÷–Ôi‹:Ê7fj²ø‹›hNçÞ¢œFJøUCHZ¥!hw_ÿQ÷µ¹ÿ4‹AÀrÇF¥z"<ŽÃÛM•+%&ðrÅ¡Õ+β z{nr2©½ž{ÇERØé$«R5²kSfÙmÆù$…!$G+‘,–áüРÝ3ÄÄ–÷o¡ü˱g¢c(.¦Ñ¹á h¾˜Æ56£ -±Æœq߀ˆ›aИy@‡]%áf±áIü"1uàn$L6$8©üÈ°8Îß÷µõX„˜S`'.áK)“ì%k£™Qh·ž Û(\¹RŒœ+”›ÝɨԊá\²ïa–·oØSOç~,öl -áœ×(R‡ÓÈ3ù ,ßQv -KïÈ€a12ŽƒÁ³KÅy‚â¥zzÔ#ðÌŒ\N"40+* ÿ2þ‹ö˜$Ñ«)$ãÇéàcS†~v`ªÊcgÁ†zjá$ö#»0¦šu8D |ÑÃl÷þD)Ù=‰ùt˜Ma¾( , žÀ|™Ÿj#«¤BNƒ· Ó`/Iü»Ã3ÎüÛ…»£Ÿ,„´§Ïá™ëeC\Ä}.×7?Þ|â¾¹>â/Õ~’&Ÿ‡?™ëü¥©Ÿƒ -»üÉoDÐáãoDx¤ð.Í? f®—yŒíkçÔð»=ú€#-Ô Oá?‡f®—9ÔÀjÀº.‡—xßÞPÀ€?·¹»^pì@W‡PF¢Æ¯ªl4óÈOóø0ȧ E’ŽÓ,«áÇ&M&é ödjLWt‚/1Ïg~híhôíðN¤F1çqøq¤cÚ!c˜OÇiIf¹i«¢|%£Ñúà1’]p¹vÐËN6„Žºìž ¼C[‹FPàÄb½+LäšÇOï†è©69Ö0€ ŸÖô["äÎÃ*Œ&ŸÔ×C(‹¯"“‰;zâÌAVÅG&Ö -üÌY’ÀÄÝ6IòÈkÙ<?æà‚éðÝíJFÚmôòƉªò±CàŽ0#ˆ'S ïÖtF›’'²ž†˜\O¦è”ö#e"¿[αM½`–?{!™†)½ÔO’±Â¿iv+êý~ˆ þÆhðg4𴹿ЧsÊ@i^±î7w€û´‡ M'²f±¯ùÇo‡I3øã ý_?Œ³©7ùyN›Ÿ8 ýPYf(}¨óCŽÍ/èŽYþzÝÙ.endstream +4924 0 obj << +/Length 2991 +/Filter /FlateDecode +>> +stream +xÚ¥ZÝs£È÷_¡òË¢ªf` o›]on/[vb+•¤îîKX¦VðÚÎ_Ÿþ!$'•ººefhz¦?¦û×-‡³þ giì*›™4ñcÎV»‹`¶7º…b!$ ‡æË‹«/q2 ? ²Ùò±ç“~œ%³åúWïÓÏÿ²¼¾›/”R^¨üù˜Ôû2½¯óEè}»†ÑOüöó×»ëOËÛ»yª¼òÒÇ›Ï8ÐÞ=ýüñîZ–çQê}Âï?á÷÷÷¼üéöfy‡¯n¿ÝÏ_þrq½ìpD •Âãÿëâ×߃ÙDýå"ðU–Î^`øa–Ív:V~¬•Ì·÷íyñ;=㯦´«ÔSu¬®0žPWû‰6¤®¯ J¢¼ÚÛÏ NÑìʶEq˺â÷]r—ûmÑ1áoAe÷«6LöÜÊŒ•l"oƒãúy?¬ÔBû‚š«›í^»—-?›b‡œj$úÿk~ñäM½ã‰=€Jbo[˜NÝñõã ”ñúƒßž¶e˲B#‚B!ê;#Ù¢Äx7K~â‰Ë|[opšxÄŸNúú*0ðÅTHƒ°0/vOîxõ% ++…Iè'i +çÀýoÿÌ$† 3i¡xx¶]WW|‘ Ϲoì†lMT!‘tü|)·[W3GcíIô±|•·ü¼¬jLêUü^µ—Ì°fÅ.Â4„{MêWÅ‘÷·›¯ÿÀ‘˜¦\ÛÀ-Ö™ag…·oä9Ï<9PµŠïGY¼0?—·=Û5;0È7yY / ’.+”ק®…ò’)Š +ÏÔ5o|†«T0m²—äÍ„“¡j•QÃa ÎF†O"ÇðBø† y{9áQâ'*’ß‚0Î7xñҰߥWk»²¶+XÂ5_ÑÜqi¾|b…8 ¼¥uåRøå[”ˆIî–™ V‚IW gÜ\v9Ò*; 3}€I¾šÃ)¾8ð$ÓÛA[5«ua2ߤš•“ +Öȶ)HÔ®&Aè&ÒZÁ Ãiaò”»’c>€pTãa†P¤”ãz;¦b“â +k6rZÒŽßÒÞõŽ½¢®Ä|ë‘ñˆõ(ÀGЈŽ¹8"má­§ª›NhH¬íOìñp|Ù\‚h û"n«ÃÌË«5._/™õ^öìù™WL…眿Ùm +y] +yÍ÷¨á™ýˆSÃê™ôÑ!‡·©«Ð±Â8ªÖŸRãµÏ+üè gpõò3Ñ ê-x=_±uÛþ–âG¼å³lÅ+œ@‡T‡å`á8p⨜ȵÜTu3böBÚ¡Í÷W·e!oêž{1¡‡û|‡Ò>äì.¿v¿æÐMøƒ¿»§ÖZ¼¤èº}bÃÆ?yåðe]ñ3çe¹áâÌIz|Ñû•Ž¬Qkò£aSaøÈ‹'Ã'r@$;USÌù–T3ðukïð?VÜ>oEDª—Eÿ +ЈbŽ^ð|`O¤qñ"çÏÛŽ—mB$ËÁœB®“ÀƒÚ¶ žè$¥¤ÇI.ÌÖe¾Å£TS~y)¿Yz{¾RxR:=š°L‡èEoa’ +˜PÒ@¯5/páçYé˜âJÅ7­è㯎­a&ðJúÚ‚‘»b¿…°Ía5%Ó«L?'BƧŸñ€'éâ•ÀY7¼Hñô9~ƪØȆtÄÞõéÜß9™1 cÉZÓ]#i0(ᓲC9œ> ] nøj.¢Lù&3:\mKÑZz3¡•`×gœƒo4äWú½×ä\“Áä…QÌÏ:A*dó¿f7…ÁÉ{ˆ_>Pßñ$çdzE9Eseü•Åí’ȯ“ËR¾­ÎõcN‡1u,Î.·—0w(m +9öÝ'4ÙæiËJ›ˆ±îˆH§¤”÷T;F¤é DEUÒ›êTü£˜0¦V~¤cTŽà+ ¹êúF'îñfr]Í×ÕöG#„id©À¢ø@g­˜~eƒ~¾et²ÄðC±â{v”wûRMûTîy:ùÆîµÄ*L.Å’3RŠ0[ƒÙHAmœFï¡Y§=š¥à­Ü«‡ædó@kˆöCë%\Pò˜T ktü†'è9Ž‘YÓò2¹3<6pÕT“7 Ó8wÔ‹”LiÄÑ>l-lµQº_ó:vmrJgT>È.¶È¡S°aÕ¸`=*#¨!§v1tŠ®¯s[[‘B>YZpÁ·ÉBÿá”!í›ä¼':4däÛ, zFRç™ñ~aø)ÜsZš£³TÁňvìÑ<;¶„oôúý„èÊ?1g%HN .4ïÉ}f·^ìÑv“R;Û= vËF¶þÊdM9¨By»š¢îº8¥8ðcWÈ@sF#Bô®JÎl8èd´ã´RœG6 +è +S+†nâi?‰”¯ÍùXåМы½«—3zí8­gÇco9Âþ®õWÉŒýÇoÂ…‘Qp–ÀRnܺ òÇGߊ…™a‚L wÚ ˜“Å~–C«ÈÙ|Aœ¶ãâè÷¡˧k¾4;ŽÓø;Å~ ²è_nÊ¡UñVnûñ¸ž…o$›ØsJ2LÉPnpU!¾¥Ì5à[l{ê„Bþ¥ð«W^q{á8—š[¿‰Æ^ ·Lõ¨“€ ÒqÕ‰7ª°˜°ÚÈ;b´é;°:ù¯ÙH‡ŽGƒœ\KÉv;ÛîL§“ãµ€(ÕRÇ_¥\BQÈNx®'× Àä ý#!ò7ÙÑö ôµ­J¹œ-œ$ÎI]ʾ¼Ú’ýÉ_ø+3’ª–•y£A>À7ᇠm”•Óã£\é#A¤Ñ×HÊߺíƒN Á–\R(PO=cYë›v÷Œ<Õý¹n[[ä€"áo©·@¿ºÞ¿‹EN"k[‘Œ‰Ó'OÔ‰˜ D}ÌæÙ``š9„ÒJÖ\¢%Ò„¶?8EC¿'üƒMäøB¢çÔ£"Ä1ˆÏn–úQ(a +ÍÉBsÐyÜÚöAñ¢ÄWÔ¡ÏÉoˆ\HÚ†²˜ð®Ck1aa ^·B ¶w~/£»™rOb†fóÔ)Š÷Œ©i`ôÐ4‚ñ j˜¯Ô‘.û‚°£ÊÒhÇáM£­W"Ýp·ŒœÔX)íÎÄg?æqÌ×âYVrá2üüŒwìv@éÂô‚#I õÓ­§ºÉ½&©™óÃI*ã«ò{#Þ¾uùhÛ·Op0´&ÃQgä8s ã÷›­@$Gâ-úÄpÌåËVZ¨‡‚ß‘› ³Àfp‹›âU®Úýa™+ìW……äâMe$$è;Ó¿©FœŠp »¸?Û`läîæF('<¨>xº¤Àu&r{Ä€ÉáäÉ)Ç iÊP×"ðB>UD~ŠYG|C›‚g¬ÂQÞ6Nÿ—‰Ô BÈLʲK\Ûí$ˆà1{=¸ qÑã8ïcüEÉFWeêvØÐ$Z"ž41–õ?pô€¾û߀š!(j7^ôÍY›aaœ‰~ªÄÂÞõ`ÎQgέ¥´­5œO‰°«í6ÖL@áHS[Œ÷–Î8¥'àø@ÍÉÖi‹çþŽÕ+?ý8@žÃŠýAæl‰d[l¹í´I|8€‡ù~¸ìS¹&Ëݺu†à’S&þ@‰ìƒ²dõ5ÿ9˸P‚ÿYôÿëO]œ^”Ÿ¥'ŠÐ +‘(ìC½8}TÜÙ¿‰9>òØ…Âfendstream endobj -4812 0 obj << +4923 0 obj << /Type /Page -/Contents 4813 0 R -/Resources 4811 0 R +/Contents 4924 0 R +/Resources 4922 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4786 0 R +/Parent 4914 0 R >> endobj -4814 0 obj << -/D [4812 0 R /XYZ 85.039 786.531 null] +4925 0 obj << +/D [4923 0 R /XYZ 85.039 786.531 null] >> endobj -1054 0 obj << -/D [4812 0 R /XYZ 85.039 393.25 null] +878 0 obj << +/D [4923 0 R /XYZ 85.039 507.319 null] >> endobj -4815 0 obj << -/D [4812 0 R /XYZ 85.039 374.682 null] +4926 0 obj << +/D [4923 0 R /XYZ 85.039 473.179 null] >> endobj -4811 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +4922 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R /F41 2994 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4818 0 obj << -/Length 1910 +4929 0 obj << +/Length 2767 /Filter /FlateDecode >> stream -xÚ¥XKoÛ8¾ûWè(•"Š¢§E¶I[]'›¸ØCÛm)¶P=\IN¿ó e%N‚ÅE#r8Îã›áРàŸpRå2s’4ö•ΦžÎV>΄áð ‹7áùs5;ûGŽü,ÈœÕÝ(' |•ÅÎ*ÿæ¾ÿt~½º¼™{RJWÄþÜK’Ô],vq5î_ç‹%/®æžpoæaê~½]1éæòËù<…¥ÅÕò˜?-®oç?VŸg—«Q³‰îBJÔë×ìÛÀÉÁ†Ï³À—Yê<À8ðE–9õ,RÒW‘4ójv;û{”Åk‘û^rCÆ~˜À žð?'UF¾xé¸Ýé'iøªÚ€î§RزÍAk˜%n±±;}Áb¬àDŒª)Òº>ôÈ<0žw¸ u“2rºr0C$“ÐMûžÉ¨=nvž³RM}$Y ‹ê‹MW ½?äkæ}âÏ8öciY¿"ª -ÿyÄ£Dø -Ø'(úÿ˜DØ‹,q<Ü–ý^š€Ï!ç$|…ŸfÑ›å)Ž•-„ªV#_‚›(8Qbù"áAIRP”T”¹ï Âm'2NÜË¢/·ë_)9VÌ›úyåO"hõ 3? CÒgÑ ”†¢ËQÆf‰ÈM¹aÁ˜^sÊáV” -eÛô„ì}Ïëý®EÔW9o^^­˜n@Ì= E½ -ÃÔš“šb@5æÀÙv?MBÿ°£¤ÝS¸G©h˜!Z­+:'!ü=æ-Lú@Q’ ´ Ÿb{¨´™´‡Ao ÊØP°dV-%ÕXÒ ×h{UÒâ#S5*“ó|‚IÀ]÷”³3zþDbñø‚e›¶áì쌉”Ã%D9Šá*Gûr¡"¿RSâeKËÛ#kÈþ+ S˜*{džô“ºÏ S Ø"Äôˆ|ÀÕ ¦Xªÿ±[œ#)Lf _ÈuST€AJ€!by}Ùlyx«ëµ~ÍH(="MÞ6òÈóz&)ú™àÎãKÉÁ„ãCåÖºáx§‘ûI±»Àß¼.›òžŽÉ5bŸh(÷ø1‚¾œ/{"›ƒF†6„p·[Fêή¡# -ð<ò —+–wLoœÓ[#¢ ½½P‰¾>BÈ‹ P«â0Ì"ÎMå–õ¾²"kú;Ɉy$…š/2Š+ʈøóh\ ÉÛézÛšLhZNLšÀU“{³ °ÎÀqK5ˆ¯<ÍÁÒƒ:ेh±m¦Ë!6§.ØÛz&ÈgwmWSZ¡wÉÇ¢GpB¢4!—tÿ“GzË©ˆÈHCwmp²(Ùu†oÁT®E‡Š« Rpx„_ÂVáÍ ¢n!…Áà’d0þ­Æœ|©"‘f]{ØšÔkÂ,VÍåÉã…Æô•›®íÛ;Ó\ãÅ{Îc"˜yØ·6槂ÍQ(ŸÅ7€ÕXrà -¡is˜Â.*ÁßÐE­µßv;äè¸\k$å6¨¸°¤Ç‚×s ¯ŒTyù~¤ÍfDqÜÓe¦±ÿ“Y‚ªÀ7uq§…4Îù6lˆ¬ à €UÝðÖs¢å8} Ûr²À9Æ(CûÇÜ‹åÈ¡1Úõ#žö?u72’M‡ÓÆ2ËòGfAç6¨o,f!×£gèBJÑÝe¡³n~Ç‹kº.0(c |4õÖ¹šÖp1Ç2a+m%ƾÂilÌ&m -15´G¡=ó³n]ï¿:èlè癳ÀxCO9ŠMÁ®`D†‹ÍŠ•‰J±} f‰¼g&*Ò<;¤y/pÀH=@Ág}T 7\ãž {ºý¥Ä€Âp1¸Ô¤/<5ôµ$à|ïÆ÷Í7`jЪªh¶¯×€ë4º7"öÍ–û2/žÔóö)ª½A&Í﬈"'LÑá?íƒG›5>ípRëQ^ÄzN“ÂôPÏ0êí»sÏ€ÆUÝÚ×Y„×Q;©Ìƒa¢Þñç“š)ðŒæAÏyë{è¹á 6÷’0æß3vÇãjmemô`\MS¼\ðkz†Á@á¤NqÂ>” ãÙä|å„€Lº7ãèˆ9$êµ¹fBèÀŠÓ«Êg=Ö¯‹‹³‹‹žgwØ°£¸ç+.ŽÈ®³mGíÂÍÆj~;ÆÕèe¯}lÇ\Éé`ÊÌiÔn-ê9ðŸ®pöÏêÊâÓ¦oÐ ß)U¨:ÁeÌ.ƒÑ¼tYõ¯µÚRù?Ÿ7¡ðŸuû­_—ÆV6JýŒô9ídUú¡•¡n]Ï5V2õU*_Pù_2_±endstream +xÚ¥koã6ò{~…±_Vj­ÞîÃ^6{M¯HÚ$ÅõÐöm˱°¶”•èMóïo^¤([Îî] &‡ÃáÌp^…³þÂY‘úA\Îò"óÓ8œ­öÁìVþy +ÆBPÎ?.Þ}L³YøePÎ6–Nøi™ÍÖ¿y—ß¿ÿéáên¾ˆãØ c¾ÈóÂû8½ëù"ô~¼‚Ñw¼úáúîêòáön^ÄÞôþæïоw%àyTx—¸ÿ÷ßß3øòöæá—n¼ŸÿñðÃÅÕƒÀ1ŒcdÿóÅo³5ˆúÃEàÇe1{†qà‡e9Û_$iì§I,óÝÅýÅÏ–¯%3Þ5¥­4.ü´ˆOÕ¦êJS?KrR×õD‰b¯i5ú +Å”IõçÓ®W«5Œv/¼¢·uÏ£'Õ©}¥i[Ç ³Ô#¬"Z‰‡»[na\ñ˜p€Ï¾ÌÓÌS»Ã°®úÓ=›¶3L dÕUJËx§À¬«)þBÏÇ›­-BTjIZx@@æ8p·kñNŸqšzŠ¡‡Þ +3-¸{„Éq@ºÞ¼X‚h¸J–Dè½{ìÚÞçQî‘8»5oyr¹Ç¨ûº'ýà´MÏtÚFáŸßƒ0ÙÉÏ5HÐF´ ÀŽY½^wõJ×-® -sC§*!Îé"Á@‡s¼%Æ®:6Ò¬A`•å~PŠR·j¦”CV‡ÅÐ(ð .¬>Õb4…|­y¼Aö»(±I 0'+m¿0šsÕ8EÒm“ W]/„;YWOˆ±«+9E·ò PÃì +ùÛ/êˆÞg€ª^¼á(N#P[jJm·6úY)ª ”ó"AXDi·¥¹·®íµ­tÛ½0ô®ä]*Æ}®w(O\»(øÈž7i 0z¹@žµGZF/Lȯe½_´z9l[óŠA-jî ò''ð%ŽÄ2ÆŠ êÏQyš³Ft`Ë„SHÿç̶%AxrÝêËrBsqimÿã!5#\ì0 ¾V¹g!¤ÖŒØB´LòüÛ¨A–IBˆflG-<‰bFÇt4­¾ð”Á;ºHIŽñgY>¡ ôѺéuEìÄØCã]&~Æñ+Á¢Pa:eÂìëe ÚÇíG"á´ÃÂ^ÑáÊè8ÒHÌÅ•¥Ý+…|î4Ó¨Ùn¢òI%0rnü‹!&l²Á™I62%£mHÆ7DZ¸þ4až2)Ä``ÓArl1‡‰ÕþdäÄ…ýtdóôÉFi8v•†s +î°sÈøÈak8º=çf ê:•[I¢°Æ'Y:NŽ<6­äƧÒÊ5†Ü,— +$Ê0SG`Ä<pÏšu-qÄÀªqÍ^¶Ú»Î8€&] +y˜(餮:ÊœQ&9CiÆP “P(áÞd즆}JS¤•z¶,Â-æÅ?÷.ߧzî·Ì¤|}F2”¥w½vÜXãÙT€ÄV3uóÈ(C:s[­Ü‚)c0ïlØg)Áoí½PÌ«1–äÍBŽªŠÝ²›s"­Šc¢Ñ©€‚uiBöÌ·žP±ZfJÀÔÚ0¡²¢_Å?½ÑÕˆ­éâŨ§ç§FÈæ ÚÄɪåÃq½Š‹¤ö£:îÿQŽ“òÇç«;¦²DmNT¨Ó’ryÝñR©Õ* +[Báø4tÕ•E[3u;°Ó7o5C—éšüf®W‡^3(%„”{„6N† èoÛæ-?Ã’pˆTLáòmð$õmZ*|L.î&~\ð‹uŽÌRìºggó¸dŽƳu5eQ³WO۪ΡÃu ÉËo%ÜÍTi]Êë7#™R¿Ì 0{x"¦!û·É’ð%'œohëߥèÎó|ÂPŽƒîÿ’Ú¦{ÁáÉÄβ£m«*ËvüílO”qƒ0G Ñd¸W–‰‡9%<”ÓW{=¦#X ýÐ>¦ãÓ?¦Q ´¥ÜŸ/Ò4ð®Ñ*5±Ü)sûY6˜¬æÐD@W<é5ù(&ôŠîÊÉK:ÞS¥i;©eyàìÉ+{ôÖ§' ÿg‘Ç~œÅSŠ€;J2?Ï’oh_„Ÿédû¯žˆYœ¥C» Ã#ƒ>¦cï%ŠÀs˜eº`p¸—2ð“Ä‚ËHĺnZ£ëêX ‚eŸç%Rœ}ž…~”eÌ(Θ¸¤"À»ë}8ûЛ3‡S!»pèr;¦pÚ1aTúYžÎ¢"÷ 1¡{e*)]â<ç’8†oÖ¼âp KzüµQ 0>ÜÞ3iiÈ·KtN-«Kkx=cý¤AXm‡=rÒëJÒ +Øì^ÞÀ–§ôP£ˆOLLÕ†¿Æ R¹þÑŠ¡š 7è{~wâ +KS°Ü… ÁX",Ò¼„g†iJÀdoYk2d’®b ++‹Âó%×xŒ.§@R‡ƒR(ðì†æý‘…Œïœ‰ÄQázC`¼!oÈÉìW8ã·ø­îÈòƒq ÛNÂýC;˜ojÇ=&R¶|#ÛrÁ> endobj -4819 0 obj << -/D [4817 0 R /XYZ 85.039 786.531 null] ->> endobj -1058 0 obj << -/D [4817 0 R /XYZ 85.039 665.133 null] +/Parent 4914 0 R >> endobj -4820 0 obj << -/D [4817 0 R /XYZ 85.039 643.372 null] +4930 0 obj << +/D [4928 0 R /XYZ 85.039 786.531 null] >> endobj -1062 0 obj << -/D [4817 0 R /XYZ 85.039 587.459 null] +882 0 obj << +/D [4928 0 R /XYZ 85.039 398.535 null] >> endobj -4821 0 obj << -/D [4817 0 R /XYZ 85.039 564.141 null] +4931 0 obj << +/D [4928 0 R /XYZ 85.039 366.317 null] >> endobj -4816 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R >> -/XObject << /Im1 3957 0 R >> +4927 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4824 0 obj << -/Length 2511 +4934 0 obj << +/Length 1828 /Filter /FlateDecode >> stream -xÚ•YYÛÈ~÷¯‡P€E±ÙÝ< $À8ÞÙ#pÈL°X¬÷’(‰k‘HŽ5Bþ|êjŠÔP3cöQ]]]ÇWÕ-5 àŸš%Öt:‹“È·ZÍÖå»`¶ƒ™ïß)¡0VûÖhOL.Üì" -ýÀÄ“4²Ç"oƒ4ß-ïÃ`~éÙãv¦Tèk΢4õmÏ7¿y*öç k특òªÝ|¡£ØËøó†ŠuS·õ¶ã‘OE c]3_À ´VO6ó NGÞ½?äóßñ SD´Ýùíò’)™Ež3Ûºâч¬\e¸òÝwýùäxQ g±zJ¸öu¾ªžÈÄ~˜¨¡z”ñµ‰FêÑÀ(Šœz*Ȥp0xyÖ=59Êݲ¸Yµaù?æUþ%PçºöÖ„õ«2^hHFeg*¦#ƒÔ”&÷ ­÷ mÕ’ 6WOh(4Œ w_rn‘¬äþ—ÀuÃíO÷°F÷M=ïZt“·¼QÆs%Ù/«d´ÞâW{$A~Ìš¬C)СºÛËö‡zW¬³ƒó…ÞÒI¾ù hÒˆy¥Ö#’/±Êq.«PžßxRš]wuS¸Žv{1¨ƒÚ`Ù™n‰6çΦ›º,”‰lM*…'š¶=îQ)gÇŽC‡z¾€™uÖuÕögyyT·"!L{MN¼j³Y÷§84L`Eƒ0P¹µŠqÂÿêæ+ø)º÷#7± ëÅÞIáÉÐ0½G]íö¹t3¤û6·Ð*p]¶*HÑñAí½gë‘%³¾œBØ´`„l—O8>’áXa56£Öt–m¸µÊhëjMNƒ#yGÊ÷‰¡„Áëý<1t¤0 ÁÕø€%iŸÇ²|A…RØÿt$ï¹ÓäÛ\ÖvõuȆièÛÄά5~¢vq¢Ù Å¿Ñë¨ò—á{ÍðÕL§t(‹òlÈväK8…NQ’¢+4HÇ¡ÕR‘WvÝæ>,—§Ó‰tW:üöÝFu¹ü×ãCÞ|Cz1Ÿò–̺]n(äOF,¶<h²-`ïºÀ¿ºæ¾èƒuy‡kK— ªïñÅ&÷³öøS°h¬Æª¾†G¡y]ÁלPÁì<‹’‡¶ì=V€Ñ2´f¨í§¡šqV£ë2:„ïûÀb‚®–qÈ¡<’ñ¢)Sô:Ëy†Lçµ÷ŸªxæV pœ)<+!F€v±Ëlщ‹‚f ‡Üb"DÖ‡"ËbL’–¢­¹à‰Æ¨SO-Y{Ç Ð¼Y‰„+lÝ ÆG„ d¥^^e+ñì>|þ¸Xe¼ %Ì„uƒ- ƒMb0G]I -Ø9·Óqà¯89÷ ¢} aû¿ƒÙ9b»ÙÎ%s§(¨ò0T:F#ÿ¦®\à gy”X‹C‡Bª”J%½RJÂáHkxlU‡°I˜’„p4À˜²¢'d5Xš\1<Ë|×1p*É8º;Ô«BM¨ÍˆÈa -¢\£+1LûA¬ÞÀ=G½ß.[jU‚Å„^éìr- ¼j,Ç(0Å{GÆu4ÚŠ6§£`0àW9'i–÷z„.P~¦1l<Úråƒ{n™n´¥I|cСÿ\ôCŽ6J{¿R¤<ñvNüÅ®¢b%ga2þ´{Œmi3J°Å`ÚdÌ]ŒÝør¢ G˜ç$LRöMªéådG;àhòçÜ&„òT=31ì¾å6Žz1 ŸH—W<ñe˹¨e¡›¼A×RÁJÆc©®œÈѼ!Kù!\/†²\»Z7L½;– Ëq²¨°íu<…âMÞ–usf:J ‰@!h>ã.ÆJ+6´ŸF#|b„Hï@¨ý.MÉq”¡¤:âVØømϼ+ð@×=¬år†¢ú:—:4¸TÓ¸îÈ*\¢¤já=ª qf ƒ­„Bd¬à4%6$ËŸY™GJï'ÊHE#5É™ - Â[vM”gE FD àÈüã©Z#ø/$„Õ€ÐBä+„ŸÂºgâ“›mûAj_%ÜÌ8 …ºšàf0ÜnòjVtâýžd]ˆuJúhÆ‘«ËÑ™G³5 (äR¡Mý$œ¼ž„(h ÛþiU6g(ƒÛÞ/½©+¦š,NˆÑ¨Á¬ëÜâòØñrª¥àË·.¹ =•%éSò¥ŽúÀò>AÏÏS.Dú*§É”`,v}q¢u_#õõ„–›èU¼“±Ñ}—`±F‘ã8Rs9I,eÐû ? ”­ ¦8J5áÒW¹ír:µc—S×.gF.‡õŸTAR~œ$0“€Ë5yÿj¦ƒ'j¢þÁöárÊ+ÇõLã%•f€9ºL 2Wë%áUý -kš¬Úõ/UÐï/îØù¥¨¸˜¥:”E©}YÞIFS‡Að|³´ý!ggùëÅ–™˜ÆŸûò´UÃ_y7¥@ßž2åÌxt¹yé3®¾Ç_$”òî-æ.ضª¥ÂN·§ÝZ©’KAc`æ,ÄCó[;x‘°‘$gh\’+†e Éx®ú,„1mÊÏç«A­†[qÞ,ÞüÍDC¡¢G¿ùÜüéäBúòþ¦íGaÏŽ~ܱêzO 5¶Mô+›þÞÔËendstream +xÚ­XëoÛ6ÿî¿BDjFI=ºO]mŠ"ÙÛЛb˱V[L%¥nPôßï$ˉíbm$âãxß^?ÒKŒTêÅI$Œ’Þd9¼Øy>L1b’Qæ×ñàðÔDž D¤ÞxÖñIaÒÈOßøG/žý6>¹Ž”R¾Tb8ŠãÄ?Jÿl8’þ«=¡Ýã³Ë“£ñÅå0Qþ_´ôìüÚ¿²Ï.Oxy&þž?ÂóWW´|tq>¾Ä­‹WWÃwã—ƒ“qg@ÏD©ªÿaðæ]àMÁÔ—ƒ@¨4ñV0„LSo9ÐF £Ïƒ«Áï/ÚÓÚ†VK1’©HC³Ñ(Quˆ†°«…ÒQQcD¤c‡(€ŒF§þ‘].Á~[‚ýQìŸT•ªÀ¯ê]Ö3›½ê¬iœ:Òlq°ŒE¬ÉÁ§ÅTÈÑèG“úÇE•O[ÝãTûY9¥úpžUD­Œñ³ žš¸³uMk·°]ÙëŽç’׳*'.ÑÁn«0AF ÌÛo3_‹ZfÅ¢(a~C{‹¢nÄ ñÇ=²™] d; cÅô% 4’èÑÔ™Lº@À95>eËÛNݚµÉÞ;5K¢›9£–¼×ʃñ†Z0G>EŒ:Y0‡ª@h•Ã0%à‡gy-v8>‚°Oö_ì5I…R¤ÆôÜERhezQ(}‰(šÀ]£†U‹Aù“ŒÃ²´ VUÑä4l,}3¢½ÅswÎëÅ„vj-.œó]V™TȯXÕ‘ì æ(ŒE˜JgÕ?ÃQiÿLA9Ž1ðzϲIë-œÖ–`§Yãœ|w ŸE^ÓÚ +÷ X§;Îo©9‰fŠFÃq^·(ížöŒ¡jYÔ.$ +‹²Ý@סK¡HèŽ"Ú8YØX^hæ,oj!Üx1c3”Ǒ~WçÕÛÀWP‹6Â\>aï¡Bx»£À™?Ï+žCŽé 9á–p!ç~ y B¾§ìø«95Á«7§CŽÝw¸ë(¿Ì‰¶l¯C>­Y¼¥/^® y´yɘ“Fgo]­hw: «¡3~•t=õuVí)±q?ë÷÷¿Ùä½ÈKèùÝØÚ)sÚÒ$)#4ýî¡¥ðK‘ÿ]ÿ¡ë¼£‘&áv´LŠPvʸvU§56*&Q[Tþ©”ïÒendstream endobj -4823 0 obj << +4933 0 obj << /Type /Page -/Contents 4824 0 R -/Resources 4822 0 R +/Contents 4934 0 R +/Resources 4932 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4830 0 R -/Annots [ 4827 0 R 4828 0 R 4829 0 R ] +/Parent 4914 0 R >> endobj -4827 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [291.589 551.093 894.567 563.995] -/Subtype/Link/A<> +4935 0 obj << +/D [4933 0 R /XYZ 85.039 786.531 null] >> endobj -4828 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 483.953 163.096 495.643] -/Subtype/Link/A<> +886 0 obj << +/D [4933 0 R /XYZ 85.039 766.606 null] >> endobj -4829 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [222.168 470.404 274.124 482.094] -/Subtype/Link/A<> +4936 0 obj << +/D [4933 0 R /XYZ 85.039 744.844 null] >> endobj -4825 0 obj << -/D [4823 0 R /XYZ 85.039 786.531 null] +890 0 obj << +/D [4933 0 R /XYZ 85.039 686.81 null] >> endobj -1066 0 obj << -/D [4823 0 R /XYZ 85.039 766.606 null] +4937 0 obj << +/D [4933 0 R /XYZ 85.039 652.065 null] >> endobj -3019 0 obj << -/D [4823 0 R /XYZ 85.039 647.281 null] +4938 0 obj << +/D [4933 0 R /XYZ 85.039 554.435 null] >> endobj -1070 0 obj << -/D [4823 0 R /XYZ 85.039 647.281 null] +4939 0 obj << +/D [4933 0 R /XYZ 85.039 527.336 null] >> endobj -4826 0 obj << -/D [4823 0 R /XYZ 85.039 622.563 null] +4940 0 obj << +/D [4933 0 R /XYZ 85.039 267.025 null] >> endobj -4822 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F11 2898 0 R /F14 2895 0 R >> +4932 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4833 0 obj << -/Length 1457 +4943 0 obj << +/Length 1024 /Filter /FlateDecode >> stream -xÚ¥WKoÛF¾ëWðV -ˆX.—ËÇÑväÄA·–‚¢Hr %Ê&,‘î’²¡ßy‘¢$Ê>¼Ü™Ùyí7³#åøð§œÄx¾N8‰<£•³ØŒ|ç8ŸFJ$&"2éÉ\ÎG¿_G¡£|/õSg¾êô¤©çû3_þp¯>_ü9ŸÞ'ZkWÅÞxljûùv¬ÜÙüæÛ'f\àº_z3ž(÷ên$îí ö·×sf~l™HßÑçå÷ùô#«¸¾ùcÊ_Èÿg6Ÿ~åíün* 4úmükþBš(í™0%ghø^ {4ww© SŒúßÑ_¾³„ }ùžNç¾}O{3 - ªÕ²_f£¿:UÌ ÿ‡“ltâ™DŸfY™^–• -<­'6Ƌ˜Bhªñ$0©û˜aâ^ð_ΔY¶ÁÝ}ÆÛ=¿*–Lj,D¿+Jøÿ”Èw³5|¯…û(Š˜Ÿ¬ÎYdQÚؽÁ¢Ì\ª²–#âÌCŽG1Ü´ú@V”¬ ø.Ÿ˜öÁW8‘JÂÀw¯Yù½Ù Ü[Ýê×¾q·Ï¼¶úµ¹5òw?˜QU±`îšB~ªy‡Nãùg^²î=r„’m q~¥tÚ'"£èDfsѽ#-ó_1oY‰¤æ”Âr—½ãM†w"ÖgœÉvæQ&ýt|ç|XÐ*ãV%®P7ר`B·×y ¾±Ý*e…sÔu—‰š²âÃĹG÷Z‚¢‹@2å?Ð&"l‘æüЫN´‡O¤Sø¹e[ -u2+  XPýöüÔ¤”(K‘8(þb‰Z’š ¨Ò¾çGªU5 Éx¡ …¿\Aä87R‘{± ÔåD«ÛÊÒ©êcn¿›®†(•Å+ÊB!j‘úÓ7>ì^[d‚ÁñG͞¨Í3Ë21°Da›/ª¨¾È…E˜Æ•ë…ACÃöƒ‰6Úb]ä UðAqm²'é/5öæm›€ÜÖ,´,º›_4뜬d¥:‚sì;éÙb3ÈáW:|Z*heÞV`Œ¹ƒdzg:x”^„o>n=j»pCO‡Q¿íFQìùqBé-€;TºWÕfƒq “QìN­­ÆÚÇj<ã¨ð'­1\C¶M0èqëÌ$ -/¢ýKqPAâEqä´BèòO_ÅÇ.)zJ;=]§YäÔÞAyéÞ/s`ïoÂø’›ÝdÚC•Ê<Çö§HJý:æ[N]›ó¶âÞÜ´ÂŊ׌ÅL6)ªŽ ¼ÄÝT[¶×bR”tc“¶€QIxL)ê·g“-‘såƦkH²­£Ì¢¢†õ¥XÈ™—®€lëj†8Š}…@Bâo‘"ܺë;&5¯”58%¯–ØÇêß.únö^®W>y. -òc4r[÷XyEsPËzŸ`v 8©Æ®ŠüàŸ¾î½Ðà¡÷Àý–ÁÜÇöÁݳwµµ„¹ýÓIˆ‹è)´ùo˜Žˆs4˽‰Eד nxg$üÚÔŒQå®DC½Û´íyXêZ0J<ì×KVS}ì „ÖU×-s;éß±´û¬–ì̵™8ôÒäí[ÛËœ¿4‘yçÎÞ²&WvllèÆzÆ®ÇIÈõ¨c[è0m¶ w„ÚEä>é™{N½Ê?ð¹ý¾s•Ù¢)Êù®OOõˆT+^¥–bú­ƒ#m.Ô®V«íúLÎÿÚ$2¥•ð0?8"›x?n›ƒÌí¦a¥*¥ŒÉ¡7²©x¥82!’4aô.9KÅCÉ/¹˜8€²À¡Oи_‘ ËbufÌï¿÷<ÑÃ^æaº¡5MôÀ¥9¶|’¤(;Ôñ]Î <­‡ ç;âÛÿú1ØÍaØ †l˜GTç M&8ö¸ýÕxêò̯Ýendstream +xÚ¥VKsÛ6¾ëWàÐ9BxÈLª,7ödìVÒ%“æ@‹’ÅDJ®š_,”)[TÔfüàbñí»ß‚ä„ùN¬¦L:’ZCµäd¶î1òèw~ïñ€H$ia~›öú×ÚΨcŽL?ŽQí ™æ£á»ÁÓÑ8N¤”—4NÒÔF×1nâ„GïG^zƒ»W7ãÑpz?Ž­Œ> jpw‚Š&ön0u,l4û!ØO&¨ÞßMÇ°uÿ~šÞöFÓÃZGäRBúßz?1’û£Þö•Î’½—åΑuOiIµ’a½êMz|áž"huªZJ*R/„“VR!ÅÉpŒ$\(*x§›Úˆy7(ô±—„sA%$1ŠS‡‰×-4Šp¯ÑZÈyJ$õgd:­{xWú"ï Üó—emàÆZjX!ùF8eÊ9‰˜–\çÿ|¬ZÑ¿YsrUúLÉQ²è7i9®“å¶Å7® u*%©°”{$;]úd‹-ÒŸ“‡9ê·Ù:HY@äe±y| Çë_KÝŠá«/ µFÔÞ‰-t4[–û ŠŸ³Ù”ú‹²Ì² +œÔM–¸c³Çê+ŠóÍcõÚ¬]Zå4åÊV»þó¥ÔJE0s?ÇÇD¤žÜ²~êÔœ½. W”á`ûÚ¥u–Jï§Á@¡}Å0櫯-iyz­Áœ× @;ž§¶¿/öȅܤìà€’ÔHsÜÌu™£hÒT_ÊÕŸI¶:6éSŠ¡ù©Ð8‰àn,Ÿ²Û¥—x´ÊÃr^OèóÏ«ý~“¼Ó,m&×d§àŒEÊâ®`L&L$Láš¹·:ºƒÀJhê„;K“¦“& Ž ;ir.Ú&gÃ54iÇûo4IÛýÞ>…~‡"«Õ™ "¿”F»òi¶Dq°(VóËw9¿¬:â,kzÁµi}øe¶CõnT1®–X7‹Y5Ïv5?ƒ³¨çw”o‹Ø!rõ©ÕË 0ÿà›°™WÛeñAÙ&>uäU"æÕº¨SÝ%lÂýnMT.NTè6›ÅÞäËó7H^‹rI•°½ßþx¦’jŸT ü† â]3e`vºG*}ÑÓÅ]J¹=ï¶0Õ` Ó9Pç¢êl¸f ÚñŽªØÀSx>x]ùT…û š¸Õõ­˜Á²îè÷eîÚ/öæEŸUÍ Æ5¯;Hü@§>[ÿqÆ5~-€“à{ŽÞj9Ðì×¥oš­‡>h~E ƒKÿ5§^{Ì‹ +½ºÚ•ÕwTw:6Áñ‰ÖKM•<ùô˜ÃO}Ù>_È–:+N÷S á¿0ÉÀ¡¹f/3ÖÒRm剔ÿüK¿.endstream endobj -4832 0 obj << +4942 0 obj << /Type /Page -/Contents 4833 0 R -/Resources 4831 0 R +/Contents 4943 0 R +/Resources 4941 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4830 0 R +/Parent 4914 0 R >> endobj -4834 0 obj << -/D [4832 0 R /XYZ 85.039 786.531 null] +4944 0 obj << +/D [4942 0 R /XYZ 85.039 786.531 null] >> endobj -1074 0 obj << -/D [4832 0 R /XYZ 85.039 682.284 null] +4945 0 obj << +/D [4942 0 R /XYZ 85.039 636.145 null] >> endobj -4835 0 obj << -/D [4832 0 R /XYZ 85.039 656.275 null] +4946 0 obj << +/D [4942 0 R /XYZ 85.039 453.027 null] >> endobj -4831 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R >> +4947 0 obj << +/D [4942 0 R /XYZ 85.039 224.285 null] +>> endobj +4941 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F15 2972 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4838 0 obj << -/Length 3264 +4950 0 obj << +/Length 2595 /Filter /FlateDecode >> stream -xÚ¥Ërã6òî¯Pù2T•ÅŸ›Ó<6›Ief¼eÏNª’`‘–˜¡H I٣ݟß~¤,Ú—”«D°Ñht7ý¢Õ"€?µÈb?Ðù"Í”¯³l±Þ]‹ ÌüëB Fk?Ž"ÏL®ìì* ý JgqdUªr_G -qÞÜ^üðS,ÂÀO½¸½_(úZ…‹$üHG‹ÛâwOeþrÇ÷v©¼ÚôðÛWkS/W:I¼ë®@3,WÊ£Ñá©wsØïa¤¼v ?Ý°üóö—‹Þ:~„$üHÍr,V¡öàæ%q’$õ£ žŠ£"09ôåV…òD¹÷ÓR^i†CW"÷= dš‚%xS6åŠpnèŸãŸ)¿È¡C!U¼PŸù ƒaî+‡×¨±j–aæ N£*õ*dPe^{ÀXnxÆðc‡x8m+¯»Šh¬ñ…Ž ðzZ‹»f&Ì4±F<Ö¨ sW®øhÂ, €œ/{"È¡‡šAAplø±®«’uÉïM9àÛ# -ÒâF_éâzkÊ4*„m TOÏ/t.(c‹t{OˆòZCÊo›Þ'yåܧB¿ͦš5›ywfÏ =_,a!¢»w %Â#ogéÈHwÈ -Ï€"D‚Æ­<ì8ÀÔ$´BåMÞµ¤fSdPŠ¬à·ìH¶ÕT¸˜d;{@îÊî -ÖÇ`|Ö4"Ì -ã:Ä >V lŒ7°.Å*@Ža÷‡ÆªWí÷²É$¸&ƒÀGQཆ²à×ýä¶îÂlƒé§‘òÞ3»6D:ž(^v†WÒ3d¨6[·A,ŒÅnºniyËúªI‘°A‚á)²*xŽW&^c/JY•[­ÁðJ¹·)8º·Î¶Q›"¦i­×Y:RN®oÃ!ÑùãM¯DŽ#ÒrvûºüŽî"M½×Ë”PÕæn‚opûa[ŽŽñC”Hò5NoK6·^–vD#b™ùê[:}êç<ÅììÖýŒ|EÙtÝä 1„Ö)ÂÀ¡ó3ïÉ® &ª†‘É –U{ Åì{Z]I?!•%›ž ÉpÅ«¦Îö•Pš«½ÄÓ7ݳ!Î ,Í Ü´ìWa¤ïjæ*ÌCohèü/³±¾†ð~~¼å'y[x~!ÆÄ#uÒ N…Aðèô®!d¢ÌQ <…¾ü@ -¡HÖC» @õ:‰-"ž)ÈèÅžA‡‘ãSVã¡ÈN}†š/ C¸ø$„® 3HçdÞÛº²ëY -Yí<0’(XMÝš‚!w-d#t¥ý`êZ°Éî¦Ò³â•Ã]xê£("ã,ê®=€k9?cÅaYǶovU]y»¼Fb­Ð|…<½ºFz¹D4ð -à@s[ êw6€Xw}£W.|’|r©{ž$n¾[¶ÖòÀ8aƒŽ/m7pŒçݬIOû¡GÖÂD| ÀœéIJjïêrG—+ô^»Šù¶Áœ^ÛõŒ>f.aìÑõáó"Úr^8ÞÑ‹AììX¢$>¹A¸p‘_½8í9¯*‘Ü󘢠3†D{r´€±;à ¼œù 2ø8‘Âåë¢`ÔëIÖ`obÐýü/ÉŒz*.14À•-[R$<ƒÂ•ä-˜1"ô¥ t5çSÉ8DClÓ)Ž÷Ks>vÊsN/Xå‚ï\ö†+ÝEÃÇUð½94LäžLaÇX¤<H€ÚѵB´ºap¶í,úܵ’„f `ˆ˜f@ˆaŽ¿ÚL=‚ûZ üܵh¤\V,$Z=f£„Ùðsmz›Ð…œf⳦³Ú Z‡Npš|M\âØ•S —nRIŒÌÙt?»3×)GiÖ¬·ƒ3+xÀlp?åO<;BþjïzÆù#ˆ4”Î3ùJ˜Æ"þÅNŽ êÇJ’BnÌöBæ ÉR‹ "²µ§Û{œòåªwF"¾PÊ;~‘raFhôΖ+mG—’Ë.x¦Þ4³— -ŠaęΕCÒ+ž¬„PW~;T”#hB:gny:·•åŒÅ1Cg‘Þå…*½ -`¾ýŒý†_Œì—á\Ü'§)x¸ë=ÓÞ1ˆòì¢ì¨˜· rZ†”ÔU0<µ•œ–$(ž-n·TÕƱÇOgÏñ$Ž`7SËô£µ -Úã Clk™9Wn1˜Œž7ì5'•+÷gU6&I@ªâ Ê#*ºs“´wôJÿ>S¹È–„äè(+…1kÅXt¢åú¸]Äûüñýo<Â;ôææ—õ¸Â…(˜DùŽ.ȹ3ƒ™ÿpêDï±.Ùqb?×cx/tÊ­ûcx0)Êg«6ÝfÓsånö{ŒûG~£|žT°9^ÉŒœ^˜EcDyÑC¹ÃrË‚×þÈYc/U÷üGÌ7Deàk“]I‰“”V<ózŸ„òùäv™cƒrÛŒƒÞ»OA1¦Û˜£¯%¯y报ÿ"£#Îó_QTر4 l>újŒ(û§Yƒ¶í^)#$iç SS?Ÿ+N …ã—‰jâ¼p†š—°jš½ -ýÔmž6õ%Ó¶i&Ü’lSêJÔJ|npá÷™ øé› \têPÛBXÚ’÷})òªi&ldUÏ« ?.]sšj’ìšæ’Ø'¼Á|]ŠsÃ=¦Šå^©½ïЉáhæ“ ‚1±å.+Í9ò\Avó¦ÞpÛê©(³~ê¬!GmŒFú!{#mâikŦȈ‰Þ–ž6faÅXÚÆÇ´Žv>Öž.ÏäwêÓµßYA˜u#8dXVð+%OþŒ°·wî©w 3Å›©'Í~„P¤€çå@㯗§`û¡‹Ê0¸Òº`þé}>âoeG9+OöÄrrÒ¶ÒöóœÎ‚‚çâYS¦‚t®£Mu®S0X^’gÞÏÎ9»O_J>ãɘìÚåðWÄâÚmŒšX -}Zd­„ÒñÓà$÷ØhüA£«ÚÃX¤O?0"ÜÇ™˜NNd?öl0+HNëBŸ“"U5OÚ=É‘GÛ4Æù¢â¯;I…£ú¸„bIj.#{Žeõ a/žQcU–*'*ÚîAVJý£Sk@È?F7¬¿:µS¹brp\j–õØïynK®×I‰)Á¬”<ç;3ФÄ+¶]t gÄHF´–«h[(ˆåR¶«HÊo@‰>[÷-õ¦ºÓá±TsNlÒ"`ùó'|ûrû‰_߶&Öò,IÆô‡{ áO8rAòÉ˳æÁ¥ #y2”#(¨$1^Àï 9ˆ”Æn×?>°uà‡'ÿóðlØv˜çA[ÚOBKŒr‹X?Ý0Ö™gúùÿÈ“¹endstream +xÚ¥YíoÛ6ÿž¿Â÷©2®fER¢¤‡Cše× [zkr†mÀ)¶ëj[™¤,ËÏi:vrÅ EkŠ|øðyù=/dõ$…?zRæ*µÕ¤(Ê­žÌ7'éäVþq¢…b&$³ˆæÃõÉ»os7Ñ©ªÒjr½ |ªTå•›\/~NÎ>žþóúüótf­M´UÓYQ”É·S\Lg:ùþFoyõ›‹Ïçgן>OK›üÄS§—ßà K®€ìãéçs™žš29Ãýg¸ÿꊧÏ>]^Æ¥Oß_M½þîäü:(©¨­Eñ;ùù×t²U¿;I•­ÊÉ#ŒS¥«j²9Ér«òÌÊ÷úäêäÇÀ‹×² ï:f­Ì8e + 1_qœ-­2Ö=.ë;åtñ"Ú” õ>—™ÖFYm&3WTàž ]6ÑZUyŽ.ÔºP®2“tLó‚|xÙ‘G4wóܬ<-@Ñ +yN~›h•fUe™&“ü;µhâÝÅFO¾é@ÒÉž°Ìw1&auáMçNUY1)L¡*—“°×«)Ê9³yšÔ0¼ÎÝï8•U0_ýŽ¤ÛÂxýÄ‹Û¦A-ÍõËäñapˆÎA<<¥]2Åž8•*2Oð„çt=3~€C2`?Èqx”+ÀöV8m»ñÈYºT¥uB²!±7¬j8¢[òïYäìî‘# ÓU”˜]Å‚ãÖvSSuŸ0™¨ç¨Íª\éÌM¢HøÿãÊ–\FÄmÕŸ õý Õ÷{P*—kˆíé–“`½›A]íïèˆ3(Ú×ÇŽ¿‡f” •½ì:\Ü oaEÍ»í’W›-²û'þ\"’úçWu¿Ã:)WUQÔ ïæš$]vH2ç|BÛYø%ÌþÆ?ÿ©çxÞ—ØÕ‚ÑCw=‚:ÞÞlëÇ‹@^•—îÕ:ÑýM%IÏÇAÄ[ ¤s +„2!9T7ë¬5áÜväñ²›Ú4éç =Úq½çõÛ!¼ª7·5 c»ÆTÅ_›úËÔ†?{䀎…„&[Ù%0è𠶞?eØV¯…] þ%ÕÙÚs½ Óg–2 Ú¿ÊJRvìæ«¿¼dÝAÉψ*ð¶¾9êP¡ÿL+V.@ÐO M Y¦\¡7Ó2ï•{¯äºQ–’÷a@±½^³´-)RJ€ìA&w©>6Rx‹™<½›cb¤” ÄÜkþ9"Ê @z¡kŸm8ë é‹õŒ=,Åòòü†brà¹;G”ÀÑcË åí†Á-5cÚš ß֛˄#,¯.B!Ýòh¾î†LÂ3”äõn‡xdþ°ib™êí‚EZ4kΡ0¢„õöHW´³–©òÐõ“ßp¢ß}Si›qû`*hq¼õd¼íˆ|ľóÇ4<èúö®%ÖëW7¢õ$À ­Áu­éåd /^~bb&¥>òqë“×æˆö!˜3@0ÕQ"Ì{ñ +g§—<¸ßÓËŸxp3ÕZC|)eæ‹$ +œ kQŠË|Á ¶~ÿ<™•;‡`¦½ìƒ¹îÁ£fCi¥‹]”ÆhRÔ¡IÂÅê÷Ðåê×/ç;¿‚Q¹Ð7É´ä°<ã—iŒjfÁõÈ·’ߨ´†î(®—¬ç€L‹'xäÅ]PÈ—§û¡$¥üÐ|+¤âo¢LÂÀËÀÅTä²dY÷LRËD¤ t~FnOð[ßzÁàƒ®R°slÖkLFÂçBˆt0°pÇÑ,üæ!§-xÙ×<‹.ñ‰ë&æ*gñ}f»í³ƒ^”™úþ•hç܉R=ú%ÍSo#kéüäÎøÀ-ì6P™Sþ*I¥¼»P giáuÀa?η_f5ÜÓ¶ kœG âïЭ}÷»¼´8–îyïQ °¿§çŒÛu³¯:gA +´óÁ‘(µÉ×]ßîøs…ËÖô³#&FÌÉ#ˆÜ,µ¤’ð;Fü˜×[lêm}×ð؃Ǥ͓Ïhc³ÁéÐC¯¸#kIôžw,IY¡£š¥éBƒk¾ºàÒÁåÝMÐðdFÚqžµÁÃ/¾e쇷ɞþ¦„k—ïmLé’!Uû¯žRR`UHGNñåÎ?Ž0ºòÉpdLüåúôttßÌÇë0.µBò¸j¹Bðgp~Ô½l»ß«ÑfœÇÄpèð×2ø }—3qï]ª"3ÒwͧÖ$« ¥_ëïþ*7ë7‹ Ê³›ƒqFUU>1™Vyú5/ǪpÙñÇ$Ïk1ãßXjãœ*ò*œHoŽYßé,­Sº¨DÃë_U30Êðª™Ìí’]—éÞl£÷…ë´»~žaUú3m}bàÇK]¨”Ž]vDZ~ïûp:FRý¤y“¡‡A¯‹ž ¡HdÉ…¿ÆrH)ÿêD9H®Å¡`Ö45xiñ¾½¾]7‡—Ïð|º´gzDÏ›ƒÏ’„ë#C4Wó‘ý²^RtüÉÂæ*;þ Y§?õg»wRUå ïÛ¹1Êè ½ê@OòLâÜ–*/í‘ÿ ÎòÕ\endstream endobj -4837 0 obj << +4949 0 obj << /Type /Page -/Contents 4838 0 R -/Resources 4836 0 R +/Contents 4950 0 R +/Resources 4948 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4830 0 R ->> endobj -4839 0 obj << -/D [4837 0 R /XYZ 85.039 781.388 null] +/Parent 4954 0 R >> endobj -1078 0 obj << -/D [4837 0 R /XYZ 85.039 761.463 null] ->> endobj -3020 0 obj << -/D [4837 0 R /XYZ 85.039 667.405 null] +4951 0 obj << +/D [4949 0 R /XYZ 85.039 786.531 null] >> endobj -1082 0 obj << -/D [4837 0 R /XYZ 85.039 667.405 null] +894 0 obj << +/D [4949 0 R /XYZ 85.039 592.586 null] >> endobj -4840 0 obj << -/D [4837 0 R /XYZ 85.039 642.687 null] +4952 0 obj << +/D [4949 0 R /XYZ 85.039 548.745 null] >> endobj -1086 0 obj << -/D [4837 0 R /XYZ 85.039 180.371 null] +898 0 obj << +/D [4949 0 R /XYZ 85.039 492.833 null] >> endobj -4841 0 obj << -/D [4837 0 R /XYZ 85.039 158.609 null] +4953 0 obj << +/D [4949 0 R /XYZ 85.039 455.966 null] >> endobj -4836 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> +4948 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F62 4047 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4844 0 obj << -/Length 3294 +4957 0 obj << +/Length 2292 /Filter /FlateDecode >> stream -xÚ¥Z[sÛ6~÷¯Ðæ%ÔL…’xë[6ÛfÉd½‰3íNÛZ¢e¶”ètRï¯ßs I¼t¶Ói ‡8ç|8WPÁʇÿ‚U)_g«$ ”NÓÕöpå¯ö°òæ*Šlš¿ß^}ûClV¯2?[ÝÞûDÊDzu»ûÙ{ýÏW7·ßXo´Ö^ªõ&IRïõ»W×÷ñúõ«w¸d¼xüpýþv½ ¼ë÷o˜i>ÝÜü ×Ö©ön׿޾½úþ¶«g"d(Óç«ŸõW;ÿ핯t–®¾ÂØW,®@(-ÏÕÕÇ«÷[ñšYñ[cD:UQª/1"ƒ •ÂUù*ò Ð=€è”eÞ±ø£ÃQêm×aâ=ä°Öýëu˜z_ðŸ hùåòÈdû†7 ¼\6Û]^V>·]q`~'héDù™e÷‹ù¯?Ýà©Ã0Pç§ÝCë§ÊÄáòyë(SQž·瘩ÔLoC/ù° „út—•i‡©b™È&’ÄUY±M$*ÎÂUœE@²×í#œLœxÝ:Ž½üØ]*,ïÐ#5¸ùê3h“­ÿsƤǠM|{}ЫÔ ñêDhÞwãlÌ–œº–Å*3É*Žµ2&b‹øRà mtxOmÑ´ßà8öîÀª²±(ô¾¢íæø™êßÙ¤¾·«qöeÇ»üöÔö£Ã#Ðâtä0ä4×[50'‚Yr\ÉÁ‰ÈdðhÛûÏ:5^ýÄ…Ü¡Üã žCÙâ\Ëë%<’2ä†M—âÇ÷¼pÈ»’ä„׶õÜÖŽ¢+Í’šÕ3¿ú`è]÷oçÇm’BF¶Léÿ·K4ý KV|-ûk®`¨0ÀBH õl~ˆ}4­!6†þ‰°³D80d„P àì›üÇ -h1F4ÀêˆgRÞóÊófé@ᡵhwL•óü[²œ;ž»'Ü!˜¹¯+ \ť׉*€†ò“hV[‡f:DI¢RŸýçÓ´1 úÓvK¢·d÷ ÎS…B=ó:&†,Œ­Ã’~[³j8Æ·H3|õ)"£ÃÕ˜b¾¶<½­@Û~·2 å'obèÍøÒŽ¦ä y‹†STÃT±“Í.½ðÓûëŸØ+rÚ®wˆox­{(š‚ý%·9 Æ1ÿÁü°fïL½ºeʼêÝL{ f&o»|_¨ßMe’È$* ãÑ3î#»C4rÈa¤b÷;‘Q_f.mT çÙ1É7ñ::áö#¥¥¯-«^?ÚpŒHKt3dù­È7Ž®hlYèu5SöÁÆîùCÀ“™‚ôÐI²é@4©¡’á$¤sì,¤³Ü,¤·è©w—Û¤X>1Œ’ -´—ãØ«á6ïŠKè C²…O5 —ÀˆfÀ"_O‚5Ç΂5ËÍ‚åp»´¿D… ™ÉùÏ,èÈYc¯¾ç¿#/»¦ö‹tlYº(ŠåM vÆÜ‘ xZuó;àf™˜õI|Ë_µnÒ§àRQŒÚ²¼)ò©ã4™VI˜Í§C4}œ–9š©ãœe'Ç9ÏMŽÓå6N¶UÍ'Ú^šøe0Á´b £|Ÿ—ÇI¸ m Ò´zš°˜¥&±šáe¡šce‘X9AÂèÔc«%­'3Å´«36n¤p/mëÕ›Tbî˜ -Mר¦=ÚIÐ/ªá‘Rü‰ð „ŠÓï…—æÝ>ݵج¡X‡—RùŠ¼?MÕ7íÐ]ûi°pÖÑÌa  -Ožö;{ܳÜìy;ÜnÄä?¡î嶜¡jKNµG ³ƒƒ¤¥­ Ä­u&ˆ@…Ó}tç)7³‡Ô|Sð¢¸:\€w šWˆPádÞ9vÞYn^‡Ûí˜òdì…Ó»å}úÐp†nk(]†NŠ?©Ì'ÄÑð;[(èÜn­¯¤)‰ïàø¢(¦âRªPvŠ3w(r5ÑT˜ijM…C3ÝB3 -â“&*”&ê†]¼³:÷Üñ|(‹œæ‹tAhWGʵ0»jlW k7ØhåøO“¬¦ÒÌO¡u æ5h¦Û%fPÛö.‡ý€ÉbDUü‡<½LN¦¯w1 -fÕøwÈO¨$(HŽ¸ü˜;ºqE`²„acFÐÛ“s75õxÏEoöñÿeË„n${¸Œ¯Ž á9zcÆ$Éàã8ðnª"ÇÈ`|зjåÄø‘×÷çaÁv\þPáØf"G_‚.ˆWîë†g[ŽI(½õîy¶9AöÛѲöµ[º çKi#ÿ×±R‰•­Ÿè®&饴QÍ5ˆ¼W-/í}ô'êι4¡[¦‘ÓâÞ1Öâ²Ô>FéÐ>Âø ž[}—W¼í»‚¥—Gì*¡SÜ“G %ó狘x1rOªÁ¤ßÈÅ囑›ÍTAp“õ|3ª3¾~&Œø> <ÚÈ?TTT{r«ÁfDcÛ×ê¾Z r<ƒ­¼hCòŠ×Q¹1ùƒ8Sq–ˆ|Gä!Š[ý^ Ì ØœŒìü .Ó…«4JWžUfÆ/Ž,ÍÆ!êÃÞep"’º×bÕ;ÄïK¯z»Ñ‹<ï[ Ž}—A,Ô‰Š!!ÍIji.$=Á-„Ö<²I!Œqý:›”-?PÀ D¦ÄZ…a|âÞƒw>sµ³ÏÒº¥1ëÛ»]qOmsÕñól0t:Dh«Š˜wøï—ù=å²PËönJ¼"õ*+ÕàõØò=@Bi™ÂÞ+5õf$Š1Ÿ¾RðÅY¥#ÂãÞhÃÓCîöª8“ YÉiH³Œým®qHì¨{¢„ô€îxkRØwš1 ìyD¿¡Gú¼„AÒÇf„Òf;¢çÈW§†Tgq΂ÔÞT,¥¬˜(VþTu.fâ~"JL2¢éx`‰( -[‘ç÷¥tñx_C™1/‹¥¹åÔ=A–øL–‡ðëxüF‡PÌÖ݈ë›@¥iì¸~˜Å¶Æ°Oc lâ -۾л¾çɧŠgSøOrsEÓÔ|;ËAÀÄÐ …nþrM⧃¶cÛ;¼;0ÌèeUvNå¾Í%ïíÊv{ÚÁ²¡•Ã¥%z']ýÃÂ3µ×ò-%{’}Ên=¤Hs’"»¢ªFÞæ¢jªNÇ(nüùjÖ¡™®ÓC ‰TH[§k[§Ïf(²ãÞÇ­×ïk¡Ç‡Om1%¿°• ™®Æà ‚N-:´0e?¯«Šïˆ†R÷ÛôIð$ÖÎÛƒ”š#6žª4‰„@#Å¡F.˜äI˜‚wKÆÇšÞ†hœ—Ú_=ù|!Ñ I¨¡À\ÒÊ›äIÆå½´|¾QÅ^:V:2§ß¶ ûÅ¢jë¡ÁÃW~ü <2e"ÓLJ£-¼ö§þÔÅâgÿBL»]2}np¤,ûŽyDn Úd©ŠýÓ|þ®¤±ø -Ý-5xWt\ck]Ú {^ âºâßóTÛÚœÍWܦåU#¦°Ý]¾ÁIÍrá—ò^®Ó”ô¦âÎ' [6®ìÈèPèÉð?ŸÓš4âKízæ«O¡ò ×´{‡9¹-Å$îwâ_/ÉÄ}É,C¹/¹à7v_âòËw;*Z†¦Ó†Onyº>´]À §@1¢%P¢P„h ”9†”s~£ 8ü†[÷iøb€Ÿê)¶ÜAøÌ‚9;Z¸½hf aš%df¸Y`Θâ20Ûõ-e~×S¹¸Är± I¨,^Âd šEˆ–P™cha9ç7Š‹ÃKpúÝ }5êìÞJävqß(,\Á:D3xÑs -çüFñpøUu.>1â?'%Ù,™¯ÒXÏc1ÐLC!4 HÌq Ιáà0«Ø>;ñ4ߢ¥Ø;ᮤ›GéÿŒ¿$ ü1ó 4ÓÍ$sÜ’sfc8Ìê6dÕwd'õ:_9>þIO‰µJâ$ši$„f‰9n‚Ä9³1$fnÊݲÖоqçmC’í7—?yéßXÄ)òTß ¿ èi¦qšœæ¸ÙŸœ1ýeÀÀ¬}àAªãÝoÇŠ–þö÷¿dLÍRÜ•.F¿ÑþçBò/ý*xøt¡Uª' -‘( Ai+ uz‘9—×þzøBàÿ‘Hendstream +xÚ¥]ã¶ñ}…ûfg­Hêóõ^sAs‡f·M$\‰Þ"KŽ$ßîö×w¾(Ñk{´0`RÃáp8ßCµŠá§VEŦ\åE¥F­ªýM¼z„•¿Ý(ÁHR¥Ió ‹[¿ºÍt'ùE9c›ë$JŠq>ÞßÜ~ÒñJÇQ–™ÕýÎ3’#±.V÷õ/k•D›mšÆëOÍF­[·Ùš,_[˜w›­Z×ø­rU¿1ñz¨yýï°ÞÃT­+˜ýÞt›ßî¸ùëýÌÐ|°¬Ô»,8IJJW*ŽÊ¸ Y6i”¦9±üµƒ3‘Ѽ\ÛÁ!›¿ŠõóSSmt±~âÅÊGZù{íヿ(€výÀ[÷¶Ã¯ –ÔzBà3þõÃïŒië}Ó¡°FB@švê9£‘±ñèÄ @zDAñú·=-W s^à{¢±1ñQýŽÇéÉ¡|Al[…¦P’t‡ÖíË$|´1ëÁÙºi_ùÃ}kj ]i@Þpèeçè,®#=bøÉïy½Gž¾áŸ˜,rćn<ËnèÜ]³ƒØDIR¼o Ž7]°N“d¤yÅEîMW¡L“rý ÓÙé8ÌlƒÕÚNÌõ£ëܯ±JHaã=é÷X p®šjj²H±xg÷(›˪> ,IZ=s +6a[´IžOÞ6 +X¶{™µìq°[L +åþÈ;ØÈÅ‚§†´¸ÐžžìÄÇÿxÇãÏd5ñò,X´£mÓ {9ýj^isÀ«• iJ8; +LæË}“[¶%Ç/<ã‹ bibÎo…†;m;ö‘?MçQ\r4»'³L3°r±àah·ŸÒ"ÐTRDe™Â^ÜžšÂí¼D ûD¯ O­2Á~²ÈVšŠÛVî05=ÞѶär°ò@®ekþÚs€B”†06Ì4a©Þå½pä[XFl÷èxJÆݹ­ðláGԌԂXŠ -XCŒ ãGe9â<öÞý?8w5 ýHj[¼]âƒN”ÈøTLþëÖd²=Þi"š GM1R“¥)ɬ )yÁŸ SËÃÉƆÂîç«”¢Ë™¢(`²÷j)¡!ÉN¼­²srW =o°Àü»¡" +¸uQT½ ä‹êvtÙý¬tR±í‡q{@Aµ ¨ƒ-‰2ÊGùÍ\KIÈLÍÕì¾³ïû•vŠ_}@w5KœÁ³ÞÓÎ*Æ;‹B^]¹‘t4ùe4lŒh¹–œ˜Ðú‰±‡Ýä8N.‰ýC—_ÜàX¢!šU¦Køîªþè3ƒäx>½ƒF†Ÿ™’nºÙíúYŒˆý°èó•V%Þášåalö‡v)P:æK#:&›GtÑÁ+õ¢”(]Bíý-^¶î?¹n6õÕç|ËØ{(•/±&°Çvò5L¬®Ì¶‘€ó~î $ŒQiûV*&¢_ aœX7\‡‚ì_ùöT~ÀvÈ?öёỹˆ< +Y8˜V?L¼šw~ùËñ Fwªoù¾Pˆº·¡sQw\ÚÀlpÁ ¦†ŒÙ»0rí2[J6±˜q *4£ÈO$%þhBs`ç‚5ãýÙx€7ª¿m0N³¸@zç tÉ°f ]A±×ˆ #1»—ôINÁtƹš;ubÖ?ÖN5¤oÔÔ’¾qùZmŒøTŸDŽkc^œ7ºZHQ°€•Ùåhg²”ÈÏ ‘Ñ·Zë}à`ý ó‹6„Fç5AÊ‘ ýøÜÓ8ˆÄ‹±?äã©Âe#Žƒó]Ⱥ敞ëî¡o[Š1wÍ4Ç£A\HÓ4¨ñ³Œ$óÊóg V¼v|üà›¥1‘E¸ibI ð%¿àÊuˆ…å!Ž?S©RoĽž¯ (Ì7—Kjˆ³PD¥X.ÿqóËoñª†Òú‡›82`sÏ0#ÕÂþ&j+Dþnoînþ1Ó‚Có"Ê }• mŠ Ïû”Ê\Âk¥#¥Í\ÂgÉJ©¨DwÛ­€ßDßyåâ€_zv:ÔÖ›[zlý«¦¦`õÇJA‹^–†Q‚91¿Ü‰·Ÿ÷jõ]l®N…ì6 ËÍFXÂ*]FYž®t’D…æ†è®ß»É×)ˆGŒö'å»ãðéÆ‘»gP¢˜ ®¢[âXÏ)ߨØB°w.jû2'>î¯[ƒ؉ùBý«_ï¿ç´>Üz¹µ½³þîîƒîÀW¥VB ù‚kÛ*å6À¶zâµ?í[DÔö%hÏ\ [y«ì¤L#½h`?ÿ»1¢½«8_myÛÿëZEE™¼Û¹ª¢Œ +£Þm®U–F®&͵–æú;/¯±:‚ÁÀd{Ùá=…w9Yp®öÐ +òR¢µÏKTÏ+Э‚8²4r°`_Ç¢é#•J)êÖ¹ƒ}ᣑ:ÉRBWèϹ©ž'ù½Çð5Ì-w˜R?òÎqÞtÚòQ]VÀm—+b¦æ*“I±K^hi5Hµð]ê€-­Û¤XÔ¥XÞàÍ Ç ŠŒ?Ó—&âÀMïìF 3¼3‚—ìÀßT´:MÍBisqŠJÑe9ÏQmº“}½(\ ôЃ-H4 ®k±Ñ-z-”„g<ѱš2‰ÒY¬µë^EˆFE©>‰Y{bíÆKòÓQf„3^¥&°j|‰C¸qÛÈuÂÒîù¤¥5ÆHªŒZ„±v_üm™§°ü‰ßy¨Š2E~ÅeŠâíƒSEÏEåšÊú:¨k÷Ÿ_>ÿ›gü.Q¼}ëxe`753ôôÁˆ/–€ìËÿsN ~&¬‹üHI;7Rct!ÿük ²Fy^Á|µã1|Ñ3:lwÜÏìÓÓV¤ïɆ<™††[$ÂÀH¯ÕüÞ²èì>; hW±à[,Q¹ ¥íÔU½ðtgüº³ço®Q9I.'B»tËÞ]/‡v“F‰9‰ìW#ü‚zàMl¢LÏä(Õ¤ú황)ÀíÌ;‡þ™ +œendstream endobj -4843 0 obj << +4956 0 obj << /Type /Page -/Contents 4844 0 R -/Resources 4842 0 R +/Contents 4957 0 R +/Resources 4955 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4830 0 R ->> endobj -4845 0 obj << -/D [4843 0 R /XYZ 85.039 781.388 null] +/Parent 4954 0 R >> endobj -1090 0 obj << -/D [4843 0 R /XYZ 85.039 607.698 null] ->> endobj -4846 0 obj << -/D [4843 0 R /XYZ 85.039 589.029 null] +4958 0 obj << +/D [4956 0 R /XYZ 85.039 786.531 null] >> endobj -4847 0 obj << -/D [4843 0 R /XYZ 85.039 558.748 null] +902 0 obj << +/D [4956 0 R /XYZ 85.039 766.606 null] >> endobj -4848 0 obj << -/D [4843 0 R /XYZ 85.039 545.805 null] +3088 0 obj << +/D [4956 0 R /XYZ 85.039 658.638 null] >> endobj -4849 0 obj << -/D [4843 0 R /XYZ 85.039 534.377 null] +906 0 obj << +/D [4956 0 R /XYZ 85.039 603.448 null] >> endobj -4850 0 obj << -/D [4843 0 R /XYZ 85.039 507.278 null] +4959 0 obj << +/D [4956 0 R /XYZ 85.039 563.284 null] >> endobj -4851 0 obj << -/D [4843 0 R /XYZ 85.039 491.608 null] +910 0 obj << +/D [4956 0 R /XYZ 85.039 189.831 null] >> endobj -4852 0 obj << -/D [4843 0 R /XYZ 85.039 464.509 null] +4960 0 obj << +/D [4956 0 R /XYZ 85.039 154.52 null] >> endobj -4853 0 obj << -/D [4843 0 R /XYZ 85.039 450.96 null] +4955 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1094 0 obj << -/D [4843 0 R /XYZ 85.039 422.342 null] +4963 0 obj << +/Length 3691 +/Filter /FlateDecode +>> +stream +xÚ­kÛ6òûþ +;ˆIÔó€~ȳ—6—í%[ôŠ¶hmm,D–\IÞÍþû›)Ê–½‡kdÍÇÎ{† +>ü Y¬|/Ò,Q±ëÝ•¿ø 3ß_±•óòæêùÛ8Y¾Êý|qsg÷É}çÉâfó›÷ê/~ºyóq¹ÒZ{A¤–«4ͼ·ËÀ{·\Þû78z/>¼ÆFä}|S¯pêeôýõ«ß}ø~ùÇÍWon,VÞÖˆÓŸW¿ýá/6€ÿW¾Òy¶x€¶¯‚<_쮢X«8ÒÒ¯¯>]ýËîÅsÑ‚WÍ‘ Ö™Š3}Jƒ ž¡A«$J‰û®Òî—«0óÊn¹Š"ßëÊ5^²Å© Õ-A¬—ðçKÕÀÄgœ¼[O½rXÂßœ-K\Ûð² V¿û¦Á®lbà¹OÅ{·w×u%Ó=2"I¼›-®îùœu![6­¬—“yú@uý({µâN‡®|s(¹1´È* Û*@ªæD†ž`ïé]Qgc ø=ïK-À,öcƬD ˆÇ«Ý¾6öOT¼›ÃV€Í‚ˆ;ðöVÁ?¿T ­ELh;^9’‡á*/êšÁ ùqÍF6oùw£TÁÝŒôѾ ÿ0D4†6‘·® ;,ÑàøëOŠ78c˜k Âåά¬ói(`¸ž˜~€™=c×vCÏ0BQ³uâ¡ "]{îÒ"ºï*ÉU†J…Ã@èd*‰ó'((Q'YZá]ÃЊ4IepŽÕ¼íûê¶.yˆO IeJ‘L ß#ÏÒ=‹¡êïd àŸ‘D)ITˆÊýça¢°iÁ:JÂ|/Ò‰ã"pñÈOþÇû¹, ¦á!mÖ”Üþ¡?¼û7CÐÚÇQ²wâ£0ö^ j^ÕŽ–Òʉä :kÑ&@¤Û'¬&a‡Ž²Ehí+·¸®úÊ ¢™(e‘7Õ9&Ò'ÔÛ®Z$èyNh@`å}ú'L¼ä1>¹“ˆ@ƶ-š¸zÃ]ºÏ¶´F†Ð¿·},™=ߎ²ÄÐ%»È#ãÓÑX±á³–ºJ\LäC¸Cˆã­Ü¤à.˜¶ˆ[X•€ý¹YÍèßYŠ(ZˆXdèâT]`- 6ÒžKqšÄk­× [ýîÇ>üÌvä2a‚ˆBaH*v(ÔC¸Ñ¨Âh_›˜ˆ¢%CŒí>î'‡;†²[±¤ZýîÝÓÈ+<›„N|¬!xÖøD“ùŠªÉOBF¾lxí$¶Ž}!5¯¤0²ˆA4U'*K’ Áé²ß†ÔiÊ`½kªr:ÓZŽ%šÆºöŽÀÂN˜‡‹Ú °y 0N4KNšÞ’ü­ØH¶0Zz6{µ¸+¾G;ÏGSˆHm?#Š³ +Å£aÃ&{Ç("=(í ц¢`+SÝñï<"°°’ À¥²¿'U(¬›‹„òÖìAªøò‘§7å]A–AÀ?¡í‡Û%ÇLE”ȥrþ”óÈB Áv“ÌmÏ#“À¨áœµüJáAµ¶šKÜð¢ÿ2ɘn§Ck[ Œ‡fƒégŽWœˆ cV’:lC¢Ðär›n—Š]to÷³Ki²m5v¼_%;=Tìy +rhç¡ŽN2 šXo +u¦DP²ª0SÞ[¼:!“µ-…zÖ0!r(sQ߯ËL •1wÐ(jk ·©úâVB<­S7UƒžÉ*¸wFZÒitg‚û1ȃc½ v£ïºiQò!´¹9NšßCoµöPó‚;ò†Zâ +6js)f¿…0žR¤p Þt +¤¤äûoқɻxb^¢RñÆ'û4%橤K)f±ßh=ú¸Ôg» è¬7T"!BöèÄкǙ÷®á•”{ RqE_òRǪ'²Û?’’1”`ÈÆ¥ñ¹+ è +×äL¼Œ‹>œ„C=WÝ CŠêh‡ã|TÊ{Þ‚‚[>h§iRŽ¾`íƒCˆO6T(åò„ìåxiìŽåM3û…€¶æ†©‰å<.ÍK\ý?áË$á}ê&ï+¬”ÆXçû\u¬”Å`#؃v•8â8â .¤.öÖ$¹ñÁÐS(ÂŒ^™éˆcÆcÛÐÛ{ ºÉ yÃÜÕV¹|É9«Ä{gƒŠ+@$ _ds¶°L^6)OóB~…ü aÔ»ñeÁ.¡ËÕ¸¾ÚX}€ÁV’Y2­R é{?M¢f@tçbHëLD[6”ûÈ;„¤(6-Çd¤àÅÞ©SŒKYîê±kÓ"kÞgdÇä·næ±6u©i½§¶\YT “^'6ìÿ~lÒ\ÅY AM¨²0™5²r`¬;¶†B”²Ø¬Š-ü=95ˆ•êôâ±æä܉U +âÜ@09˜Ó}ô.«µ­RÉóÐÖ-@XFˆ§ÍݲÉáø%E +KyŠ*mŽ¶3–º¼ÂfèÑY%¡¼°ÊfýxŽ1ý¤av™1#ÌyÆ fÖÃP–S²÷éÝ‚êœò*NU¢ƒ‹˜˜T¦¼JÐAÆ\ÎòÊVÝ´ØßxŒi\5ϱQmý£ ŸxWW˜qÃ0“e¯A Œ›{r™°²¦G¡g¼ó…jMÿ‡"™!®÷)„‘KGìÃ,xÊ-Œ?q{kyÈ57Æyrø»ŸT·z>AÞ˜±¹‘‡wló›µ/Þ< Æðb@™ŒÀ=ˆpøj°¬m_9¡nÉ_°Œ¥ƒ™s}1_3Þf…ó±[LÂ$ãB=ýòÛ3d{ôüj|#ÂpQ[ÓLjǕn›’·‘såy-±½¢ÀH(7:3Þµ ½·µ È-jÌßd¦7UÖb8È‹ ½n›õÙйnõ”HÓà„÷é°I5iö.Ëå¾sü‹,bö(y抵›Væè‹#J C|LàãÒ 5ª¦”N„?TZÝŒÒT*uØ"3o„YÃÙ8 À¬$¾ìn˜³–ËÀå*ïKTþ@²§žæ03v,Wx”K˜ŒŽ¼N4¹š5Q’O8:ÙPÅ"ÉÜGîžG¸äÊ­’¢NÔæ—@µ54*Èá,×Ù’l¢\2ƒA«ˆÆÿK + 9{!ÿ„P §üL¼‚à3áIIî0~^7–æô¤œÈ –²ÐÍ#ä‹›ˆJ‘±ó¥nдü;ý„Gö$ûlÆÇ’åø•6çú(§Ž SE™ö$‚5ϧ&5<ÁªÝŸú•¥úp†1|qkß[6\ëÓÎç ü†TùÌ8㓬6×<®€#ÏÝ·¥À#ƒöЙp*ðž—_×õ¡¯ìWA™>5™|˜…Ùdúä«€8Ç/3}öº ¿$cŸx’V9&Ú$9æñìhŠÜµy·hŽ‚.¶ÊSÆÈ#å4‹Æ[œ+§à÷‰üáí±VÃæÛ_ú(w,Êd*ÏÂyˇ >E†Š2±>ÆØ|½{Šòü}©tendstream +endobj +4962 0 obj << +/Type /Page +/Contents 4963 0 R +/Resources 4961 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4954 0 R >> endobj -4854 0 obj << -/D [4843 0 R /XYZ 85.039 401.146 null] +4964 0 obj << +/D [4962 0 R /XYZ 85.039 786.531 null] >> endobj -1098 0 obj << -/D [4843 0 R /XYZ 85.039 247.401 null] +914 0 obj << +/D [4962 0 R /XYZ 85.039 413.08 null] >> endobj -4855 0 obj << -/D [4843 0 R /XYZ 85.039 229.135 null] +4965 0 obj << +/D [4962 0 R /XYZ 85.039 378.334 null] >> endobj -4842 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F35 2880 0 R /F56 2890 0 R /F14 2895 0 R >> -/XObject << /Im3 4327 0 R >> +4961 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R /F20 2961 0 R /F64 4112 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4858 0 obj << -/Length 3035 +4968 0 obj << +/Length 3882 /Filter /FlateDecode >> stream -xÚ­ZßÛ6~߿·/•š‘Hý,pÉ"MS$½½d‹âæA¶ä]]dË‘´» Ð?þf8¤DË2¹IAÖ5Ò7ü83œ!,|ø,Òˆù"[$iÀDš.6» q w^]Jb¥DV†Ì‹›‹g?Çá"ðYæg‹›íøžˆ…‘Xܼ«_ž_ß¼|·\ !¼ eËU’¤ÞÕ›çï—÷þõÕó7x+ô®áòÝëßn–«À{ýÛ+’G™ß¯¯ÿ…÷–©ðn–o~½xy3¨5‚ -êôùâÃGQ€þ¿^øLdéâÚ> àöî”bQ(Ôu}ñþâßëè^¸ §æ(yÌx á³4 ge‚€3pà)òYä‡OÉSÀS'ñB !QúA2^ Bˆ…ñ®S@9Å‹L<‘±(Žðú¦Ïk¢ùü¶Õ~ÉS¯§žÿBO³îhjþô#ÿtÀop¢¡o"b–E‘ƒ“QȉrqbÔœLñf91ðî»’†¼©«Òä£haüÕö”h¡-uO™yös ˆU3‚¿‘H%Äû²]¦™÷€o©6—$^WåC‰óÞqXƉ—·9öîàõe_¶ÝOg©÷K“ÌAý(d¡^ ¹¨·jê§x³ÔxwM×+{³ ¼ºA²G |ï°À8ÏvF™ó$(64EÁlŽÌ  À9ÇÉ̼¯#2­$1KRƒŒ…’qq`AÓLÀf9ÁjŒD‡üþvÒ%”76»^æ{¸QŒ®gç"Œ‹ÀAÆ(daC ¹è°j>¦x³„xÀÈŠ'ÞgôY2ò½É‚Ë1ÂŒÅ)w1 -YˆPB."l€šˆ)Þ,ž4¶”fö±ûÛöq?pŒQÈB‹rÑbÔ´Lñfi1ðˆ–Ýßásx«#›1„,<(!6@ÍÃo–o—Q¹L[-eàs•È<… ?ƒ|ÒÅÅ(dáB ¹¸°j.¦x³\x;H嘵˜\t‡|SkªŒ(ƒ,>u¤t†Ðy2´ƒ + "ãoŽ ï”ð™X}S ìÉDì c²¡„\dØ5S¼Y2 <“Œ|YVyš`ýxΑšOOt£(N¡FLdB²”‹, &kŠ7K–g’Uª„ŸïžÆXÙ>•«(d©päl†…+%äâʨ¹šâÍreàÍq•C z’‡…ã©‹ˆQÈB„raÔDLñf‰0ðL"¤5Üÿ¤Ÿ¿º¿Ö]ñ­ß¸^ß2Æ>.Waø´r'â K„£ê3„,t)!]6@M×o–.ïó½.u†’…ø÷d¼Q긨d,ÌŒ‹ šæe6KË6ÃJ«ÝýnÌz¿có}‡ŽªÈ²£„\ìØ5=S¼Y~ ¼oÛ»29™ß“Éwøü:ÿ -OždGÁ¼’þIýݽ¬Qá"õœ•žú+]“ä²Jå =®ÞØßÑbû-ŠKÛn›®ÙÊw¤Þ;z¬éKº¾n‰³)‹ûv|ø*¯kõNÞ[ÜX©ÁmÀ,‹B2¦w×Wrð+.bo'm¨‡'îèÕ…±H¼-òÖ’ÜQ£è¡)àÞÍ]©+s”Ë[Õ+‹."o~¥;H ÚÎQP¸Í‹÷P}]¬àu÷ƒÁk¥£I&‚r¤BKûqmÇäàý£aƒ¢( “TzùFB½•/馴ž¦W475õVš””d$¯kz U Ú ¬/B®ÊégKYë|ƒz~¢ÎÑ‘áAHx,î‹é ÞÈK©®Æ ÉÎl¤Ü,_M£Uäm£°ä–RÙçU­ê G¹ù¨Æ„Û¦F4˜£„¶Ü  CO«mvØñ\Ë1«Í)u+—RìÌÞ|ñâLxÔg -£ˆt7Ú“Ý+„ðÈC*zƒ”q!Œ4Š|ïz)@ üÓJ}hÏ”l‡Ç0Â¥ðå âÄ{‘o>=â5=StÔ}%)P{®‡¼¯Ö²Rõ(õõÜðPÕÀ~fbÈÌÄ75@‘ ˆonq&Ð*³ÈۗاÌqBs --½v÷wyO’ãþtI÷òBQA÷1Ãß!ÞÑ%69æ°¾P Ov½|­ ÇÍ—a_ûÉ1Ç—&Vù -N‘?ç›/°˜•ˆ€î-þú0†!¬Èîƒt¹fßÑµÔ -‰mÚÊ0Ä‚Þ!“MzíÅ “fîGŒÇ h‚t»5Û4û- Íî9…ZW–YÉ­Ô‚û+GªUz×r¨¬ÕT<”!šCÚœ¡é¿E¹•{žuÏH¡86¢)ô»LŒ¢G¹£ÖcElBX¢B÷}Õìÿq²û1K£tê0?8³+™•!4xä©Á*!9‚ªC‚Ö²žŒ1HÊð(¤Cá_´¥®S{دš¹,…ûœ%àä6%µÌ‰’G³ÈQÉ$=Ròæ®B{J…G¿¡ -ÿ89Õ°é^ŒŽÅØ6Œ­§ú:!Vê‘֜ұ¥á „Åɾ¨7ªEA:ºôë‚û*áeâÈ_6ù!_Ëx ±HZ¼b_*2ï5`‡1ø~…Á<ŒCœ ˜M¡o¢Í=0줚£ÀzàئÜRº4“-]Ý`¿vlÅ)©’ ØŒûWæùF*³‘JæB³9æ!·ãâî.§C=ïÕº¤—@#´á%gÀ8;ë ~&sA»/ŒB_PBã!"8ÁFÎX¹ïé²h«‡R­@NGº|Xmj™ û,Í’# å:!“®6 åÊÿ€\ÓbÁ9¬˜˜zp°‘NNöÕ*Q‰ÂëiÙ}§G¥”LT³'‘?äSÅqtÔM‡ÿϸïûä -ø©Ö#¦+yИê¼ÖÇ´Í訪@Ëlzu°(³64Ku¦ÖÓŠM•¦š:aw=ËÒgè/#˜º:±`¥Ž ßQì8†„…ãï®ìMŽ00\n‡ !Ä0SAa– êÃÔŸÂôdEù —#‚¨Ðìiц!^þHO=B -¼q§^D ŹB‘Çܽ¿`/µ£P´ªBño®P4ñfeœÕNÕoøên°u¤o« 9$®Í…QÆB ɸX± iR&`³œŒ`ßóù]•àrÀÛklÈœOòy±,IŽ’üèéIþ¾¡èZ7û[iU†ŠMù™ ‹#nÀ(s>‰2ˆ²êÄÒXŠB(òÆCmTWö`8ºmóbXJ¡s+S’]`fþ…š¸Àá/eÕÔÞ—:a £hP«$]äô…N2doB[X5 HG[lêÃP >TÍ 3ÅÌÓ¥œVâ%Uõu]8—½Ú=訓’ehìuàMq²Pb4¹dfeHÌ­¹zá°’É·ïåkï÷zo¥TOŒ#D±¾Ò­ü¶A«fDÊ/e[Îe+ú«r‡zˆ(úTd«2HÈš‰ÿ3[2—M]\’MžÖt‡q;Ázk×`dÀ?r(ÒœWÊžci`àë|%fêi¯ÐãÛ!"ÈŽK}µ±uZ-á1ŸT,ñL×&§c‘«¸c„™Yð¨ N…‘úÚhK=¼$ƒªh´ÅM>šÜÊë¶Ì‹¯ô¨öphšÙ\‚ûPc(Ø°Ý*Èýð…\¨}æC­û²Vï”Ø5¦Öà µÇžšÎ ÎJ¨Då?ø#¸¥Ê`UvrüÕ‹ÐÜÑÇ(ÃŽ‹Ú£üÕ¾ëóºÎuÕ|ö[± €h–9Y ¡óË—r¬_V@µ€àÍ­`&ÞÜiÓÙÕ+'眮O?3hçh²p¤„\Ù5GS¼YŽ ¼ÿïç®s9בœû4Îqç:ƒÓÇo”ÑQ|î6:·®ýÓH’…‘ã„d”±|MI2®)-hú[Ê Ø짔#Ø7yÇ>C,×gtƒŒí‹)ãü æ<Úð=Ì1Øüç0Ø7ÐA £¬pi_›Â©ã$_%ˆÂ‡¥pNqø/´ï~ÿçéãf²`é¹(â°äZ™EGÑT_(B#qªðÿŽ~­Yendstream +xÚ¥ZK“Ûƾï¯Øڷʤñ~ä&Ë’-G±[U>Ø>€$H"µÙüúô×Ý3X9®”JËyôÌôô»{àß{ôÏ¿Ïâæ÷i–lâпßï¼û#Í|sç+ÄZAÖÌWï¾|'÷¾·É½üþãÁî“{›8Oî?îY½þöÕßüø¸ÃpåG›Çušf«·þêÝãÚ_½ƒ™`õêû¯ÑˆV?¾¡©×˜ú@uôý‡×÷ý7¿}üîîÍG‹•ƒ·†Àé»_~óî÷„ÿwwÞ&̳û'j{?ÏïÏwQnâ(Ô~}÷ÓÝ?í^2Ý˪%Äa¶‰³pN?vhàûÁ&ôƒû4Ž7I”2Þ×Qè­ +ùéKÜo×6{êùêÒµë ]í0\öøÛë‚a(Ïè_ˆÒo+“í…W•t‡Á”ò«çGÔ«ù /h,Ž&ó7K+=n_Ê®+÷Ò{:UºŸJ퓶;ÙÉ_í©Qu%#€¶‹ˆ\kÔÌùö[ _üþÈwóW„@[¤Ðn»êX5Ô/jÀ­kÐ&#Ú¾X½ͲÕGlâ.¾Œ€òà–滲Ð^_›¢îç3úŸ€QÆáèLÕdül>`*b6ä©«³W2Ù×`D÷™S,ª6NVÛBoH½XöÆïI§Ed@ÇO@Az_€‰vŠ¯ýéfö6Y+Mãx5¡RÏ;Ð$$³ûÊðgWt:Fܯ‹ýU˜b(ÀŸ˜`B+‡ +"…CÐnN„]k¥[du0ЄY˜l +‰à{3w0λH`åZÎã! fáêؽr¯{àó^fÇsÂÕŒ¸‚~Cu©Çóe§äãúÞ(,– ™õTÅÀ_ý«Å¡Ï +Ò6»« ­’ä$ž‰E’“TªQèµÏ¿™0JÔ® °A’ä(œÁSÂgh;!Ýt ,¡×D—c) µ±CD«X{|Õ6=«_¸ú–¯õdeQ¤’%2#ÀG0‰WZ} ä[\}Ôñ¹8LÙM¤óC?! 9•f¦G觲‚Nn@@²ü£Á„,ê©"4¨Ãc ?±ÊÖ*`¼ï(·ÙøQÙK½ðïyÝ´+±~š *©kïçwv¯f¥ +>¯Òßc'³ìY'—YWçŠYÏ +æâ·iå·`2™ ¿¬õp»aXðÄ&—‰È k¼7·8ÍÉ#Æ÷äç6A-zMY;0ì4o8Ðå}ù©„"„Ií¶jÔÈíà þv‹ç øŸEÈÀÌ0šºñ$š\ (ý B~`Gw†Ïô2q¿«"D^ÊNž~êRt¢ö¥¿èÌàšƒXÈûo£Ñ%)-IF¿”­NF±»kl‰±úÙîϺÓCõÉAG°•öÈʽ±ó¤ÏI­^Õ¢ë8ØièZ¤U`9Õ”…s€ePÁëTªn`D1+¬üZÁ;Ú©‘±}Õ«2èLµ£Øà hL‚ó&!Ï‹‚ê%úÿyAa^T…}ÞVµ*“(IŒ°BR=’Ô1 7Iî3Ãg*¦æ(™ ôµY©öBÒÒ.jB¶Ý<‚襜Ú}©¾XÇ­%Ù•¨ã×Ë>KeæE*\ê«bà“Áñ¿f’MžGŸÅÉÀ̺±Á&Š¦XýƒcˆêrYÉ÷£,šÀº nMmbÄœ¯Ãê +¯pë%ö±Û•7v‚Ï=Œ TÕà]†ñöÊrÛ‹â§é&"Z„ÞÆËär¯Däˆ4FÃÚn½¦ãÑ« i‚¬èej8ƒŒÜ¸gcFŲþ·bK÷²Î„4²›&0Qâ^ SL±gcÓ(g‚aMC+û|X£¿0Ä,7•n€3luöÕHM7 Žš‚Ý®$3V›F „¹ÙÏdl ejg`vµ0ˆ<»ôÆ' o1Õ^ n9¬¾IÛÆ­‘7‘:êÎh"ÃûvÆ^†F ‘k8ÍÔiþÀA2 ÌÀZ/…ln¢Þrn®~æ8(pO¤ ^ÆeHšGš9à—¿º¹¦f<ÐíŸ{1Ågs¸A£¯ÎŒë³tEÝÚ¾ìMâôâž`­nr±.):aöœ,cL]Õ_·†åW“Ì\ªzÇ­ãð,›±‹S=ÀÜ i ‹ð—oãÌ1a„cn¼\ôûÃåò#8®rA Üûzôî=OãÏîw„â¼áÔ&zù†raÚrÄš#i®E­´æ\)ÏÈ’\:§Èçg£4`â´ùÚf×CY WK~Ä-$ºœ2h§‚‚ÎÖ$`ä g³1töd£gðwÂ>FóÊ0Ë5„ +WʱuoHµWÉ´ +ÔJKÍ†È œ\3»-UôÓsÎ娂Ï2TȺ¦å$ wÚ#CÃg‘¶þEcø³¬µä$Høzõs‰¥´·@¦p>_Øm¡˜‰Ô09¦tÁª)MSIï& «zÊ@‹£‚s½¨gøļq#ÎfFSŒ•íA/Ö÷\Ù}Š„òªå„5X)]=ÂÊÛêbËq[5ˆš-X6L8&6ü­Ù +ÔD#{khCуȟ«°zR%ã‘_½ØÛì2Õ½Ø×5"è#JkA€±=tôbIÀ¬lÞ\v!¬X¨àXµSI#Që ýÌÑ]JŠªÁ'K™30‡‚£¨Á˜=?g\ ‘¯\5¨Ÿeû½Q÷ÀºãH’!©’]iˆ%¦†-º3µóÕ•+=ÛÑÑD«è“?âS™àÜRªóÕ$ÅÏ^ð‰3S±­÷r¬ÎMUNÏ<ƒë m”ÂFÝF)ZÓ³EÙ+×þRŒÔvUÏæC|)b4^!W#*ÜãªQªãÙ¦¤ƒjKÔ›bl{­÷2´›O¬¥îÅž~ŸN%P÷¨†édoÃeÙ`krª–0\Æ™3 8·bƒŠ^Œr^¶ºÖlZ.Ó •ª²ëeÄÚ?t¤Ø£ qëIëá˜oð†ûk²ä÷ážüÞ>HïÉy¼o•{ËøSÏL‘X4 ¹õøhv%{)€Ë>†‘Ú7#êà Pשŧ«]{ÕÂk·v +µ¼½Ø×jâQ§لْ=g!™ Æ.ßiÁÐ æå¾dÌ…= ­»d˜¾Ô?ÀCÛ<Ì—ý$Ñ6{=ßT*9õ¥IX*©;¶f@Ç«¼Ò ÛÚ^ –}+Kw4v`<–¬ð0¨´Î¦?µü°²ûmí):G-[¿¤6¾4Vgt+EãÆDÙ+u—A؇ˆt|¿D[Ç0´ÊøIEËúbvKP¦¾ v)EñÞÆ&¦–ÓÃTŽ«Ù“G<æ‰xµW¨ æZ2/³1rDyè¡­%Ùð¤a$OtÖ±Ë{Ú¹lÄI] âÄp’Õ»ú¢Ã"×€²ž2ÛÝ`CÆê?š É;²¢#ÌýÄF¢mÎŽ•Ó#Q0Y,Üo[£€ Gàs[&—¨Ž&ΆžÇ)5qx2–»±þ=fQˆ¼\©~9Œ¥ý™É»—R“Ðç|yÁé`êýTw™-ú¬¬gÔ­«ãIdmòtÆ£J4©l^4’ׯËFÞ vz‚ójrV|_‘§«wº[¥¨Û:X ­Ÿ³¤ka®2ÅNF ¶^Æ%Éôâm ÏEéõ-âƒè@Àyß•,_ôÁ䯱¤y!“÷Ïí$~ï +‡xM™€qÁA{ÙÏúqÌ•ŸcX¸ëz®ƒò€êë*ÿ⇰ì +«–­Èf·#‹nXÉi-ÔGÉNø6uûÄðY”„Ï|~£P]Y“j“¨fj1ÉÓÓd–ŸôL˜˜äN´or™²Ÿ^³t#عPô×ûEŠÕª0ÎW\m©µS©[[ÃÕqŽ&â|¬/R»lä¶;GýÖ1%q¯_Høüdc°&L4¡»q¶P‡ìÍÅÖVPµ†&ñ[ ”i=éiRáDÃ¥zVþ€ƒ Õ û «¾ÿB,(Sì}GÈŸ¸²cA_‹¤ÿ +7ÐSdm,kõã•ãi]ÈÕ ðU}#>¼‡fxã£}&öΨ”ƒ”ä}=’Æ¥ˆz‡º¾ra,äó ŽMªõ˜Lbj×vÆ„rT"£æ[rꌈ.[h1s¾<©ú⤻ö2VÚõÄ~üüèŒ@” àÇ“z¬sQÐñÈ–R PÄ_ð³ŠÀNžsÿ˜_¹lœÐPë°ì·jçôiÆ +Ë©¼±ßÊéRÿa鵘SoüÐ$Hc„™íô©”²û<^¤Ž¦tôû'† + c1cºä ×7e’Tó‚- ³0ŸË\òáJª_µdžT r.L™KÎU¾XtGNõR&Ëøó%iíÜO¾y%Ñrù*Ëœ‚Æ%éK_ŠHê·$@*=\¨Ê2]¡9z$À‹¿cºò7~üuRäù¦È”¥ ŸeÐr[À@muÁvv”8…‹(Á]ŸªòÉá3ÛàŒìÉ<=HâÑ€öÒoÿ—|&‰—k³‚ŒZ¢äæ›®âÊé ³j&¡¦$4 Ù‡þ3²V¯ÿBæfþ$8ÈœÌk9™渜˜ùZX¡yW0qí¹ ÍœÌögJh•$˜M­<sóæáàö{Ú`¡Ò¾Ç-Æ ¨$±Q]¤y\®µÜœÕ×1»ÌCšØ-«'¶nò;&nè1âÑ@†ÎöÅIâ ³ÁΦÆ«Ðà aòòç¿a¼‰äëßÛ—}ú/´ù¿¾ ¶ß>GÙ&Ï‚å¯â ؾEÌðãècó ñåÿ-R1Žendstream endobj -4857 0 obj << +4967 0 obj << /Type /Page -/Contents 4858 0 R -/Resources 4856 0 R +/Contents 4968 0 R +/Resources 4966 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4830 0 R ->> endobj -4859 0 obj << -/D [4857 0 R /XYZ 85.039 781.388 null] ->> endobj -1102 0 obj << -/D [4857 0 R /XYZ 85.039 428.19 null] ->> endobj -4860 0 obj << -/D [4857 0 R /XYZ 85.039 404.872 null] ->> endobj -1106 0 obj << -/D [4857 0 R /XYZ 85.039 231.197 null] +/Parent 4954 0 R >> endobj -4861 0 obj << -/D [4857 0 R /XYZ 85.039 210.607 null] +4969 0 obj << +/D [4967 0 R /XYZ 85.039 786.531 null] >> endobj -4856 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F72 3966 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R >> +4966 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4864 0 obj << -/Length 2747 +4972 0 obj << +/Length 3091 /Filter /FlateDecode >> stream -xÚ¥YYoÛH~÷¯Ðj†"š÷1À>xƒdâA&ãk8yh‰-‰Šä”mþñ[W“”E{°X‰ØÝÕÕUÕu|]qgüqgIh;~:‹×ö“d¶Þ_8³-¬ütá -ÅBH#š./®>FÁÌuìÔIgËÍÀ'´ƒÐŸ-³{ëý§ëÛå‡ß.¾ï[nb_.â8±Þ¾¾»t­»›÷ןq)°naøÛÍ—ååµn¾üÄôHóûíí¯¸v™øÖòòÛòç‹Ë^¬þ@!E™þ¼¸ÿæÌ2ÿç ÇöÓdöߎíÂòþ„²ÃÀ—qqqwñ¯ž¯3Þ5eC±pS;õ·Í¹vù½™¼(ßÓdÑeí»œM%̯!!¾ã ëˇkC4'ùÆsòvƸÏ_ª9ZM…îœjOs0J=ÓãE‰ÿ¥\ŸŽ8Ÿ›Þj·/ã¨$fŒ¼ ±>ç-ãnlŠ„ôî£<¦eeÈX0èK(Zo–=·öè¾¥®îÔÃsÍÚZ­ ÐótG\’ùt/Â÷|;pßlE $}[r?†ËЉða*LÆm×¢7bèXÿ¾ôðbƒèu'o®Ñû.ŠÙáw~§iÍ@ž•2…Ÿ¿·zþ²åÂ%â²;¥«“Ú^˜¾­ì@ózßÅKa*‘l/€¦OZÂRQð-;VBzão!EQ†{‰)Œ´áHÍ•ÔâG N6º0r•L¬óo(ûäº@ßÏÆÉ=x'÷s1U÷ -Îò&l©õ®;Ä#æc8¦*Ù1Š1É›B´Vâ|ïДDyëÅK©…IqH‹ÝåR_`<ÿðeùz–˸¯ëS"2Þù›ÉdÇ5ön]O=6GÞðp•B¬¨P7º\ku&š£©êù;{d<éYóQÎ4)¦ßÑyýØqÓµsyMS7™ÝË Õ= {AŸ?L)5iØÖ`0è Å©! #-þ”ÒòµæA5Æœ ÷.rA–M/°Lq‹6£o]i|gÛ=b ÎŒ™éÆÁFe2ÖI#+BþpýtªÃWÿ)ÆRë´Àº|Ú ssuºªÃN~ßäÏÿT«Óãÿ½«øwé&¡‹íMøËìÿ¯ÿˆëáOàÛ‰ÿ -ú =Ïö\# !½0z)oè'ýsÿ D8&Mendstream +xÚ¥ÙrÛÈñ]_ÁG¨ÊDp^ÇÞÕfc;¶RÙªÍ>ŒPD  €–¯O_s€åT¥\3==Ý=}ƒá&€á¦Hý .7y‘ùinvÝM°y„•ŸoBØ +ÈÖùéþæ/ïÒl~”›û½ÁS~Zf›ûêïÍ/¯?Þ¿ýt»ãØ ÿv›ç…÷î6ôîn·¡÷Û[\‰¼×ïÿŠƒÄûô–ÞàÒ|’Ùß>¼ùÛÝûŸoÿ¼ÿõæí½¡Ê¡;Œc¤éËÍ› +èÿõ&ðã²Ø<Ã8ðòÜt7IûiË{{óùæ¯%Þµ&‚4.ü´ˆ/e¦+2HS?Kr’º +ïëmšyªiÕCŒµÍŒ“ß½¬ðêž šV†¾«‘}ššab·W˜ç^ïjV¼«aúqDŒ€/g|¹×Lø,½a ‚ŽV/a~l‘‚<óæAë~:!²s>¨™š=??vˆ¤ENµ\Koæ=8;µBÀDY_Óx&ÖìmÂçf>,N@V[!c¢CFGü†X°ü +ïta`Å@¸qEFc}D +R“XDlNÏMÛòèAß ‹V·Ž@)ª"ÀšŽ‘Tšëö;O’<áy$íC-úŠÂªd–‹èhtNryp^Å °gŠŽhŒ¢ è—ðå~P2ÿjPØIâFEèíÚÆð·g>i±TiQX?ðÙ¨Óð^’ ®n@ÕB@%ØÆfz☯ ²Ûf§H+y¿(Ý8"§GbÖTM †ùP ¤°jÞ“Q‘˜§•+}°Æ³S'T–$,ÑáYöO­"‘—Ö‚W>%Íšã×øQZ§£qSH,XÔÀÓÄOÖ;žb29!­ŽÔzÔ¦Dsk6F [F¡øÍ0û,¨X€³pšÄIKkæÉ’½œ^Ošw059ȬÈcïnú…d–\¦oX3ûs“ˆÁ’Ù‰5šVãR0÷#©žh¯À“Qâ¡“ ôVi,Ã0lêæÚÅ ˆÌ†o!FÑ r°²'·Ñ1 +%§¯«—Etî`QÖ¸Ñ:äéÕZÐ8½©ÙÐ擬\_N”dÆžá/¡l°A`v›Q’2*ÐFp:;Á7q¬ßÄÌ vò°ùª‡HH’-Ï9ŒÓ Q ÊÀOòµ³€Ò3¸¹ˆ/ˆ¹‰;¢H%4XgR˜Ç¥{-în/ųÆÆn&Žát 0‰BVopüUÝ;!b`9ðÁ úÌi›Oi¦pÛX«J¦Û°2¢ïü;/ fžjÏh8­·#‘o3õÙ9xI$í©é)æä]c¶ÂK•j›'ÒsT炩ݽÔ<à‡#Qž8±¢‰bWqeëóåe0 +ØÒVyÝÜ68íqžPEÀN(Ž¹«»óð71€±?Äïžuÿæ#CXE5¾Ö_s;ë]€„\¸OÐ³× AñÇáH\€4ô¤å2ª(°;Ë’Ä=¶ÃÔQt¹NN¸Í™ëǹuO¦‰RB+©ÕBgÖ¶Á¥ž0· $¹Ž(p ¨ZY(AÃX@‘S…¢ȾÍ?1ÕÊîz % +Mt£|Åi»Áò|KΠŸxbOïΣ\Žr!KÝd2õANÕŠÌ‘ ÚoƒHź/œ¥ÜàÄÙi¯Èüž„^0KN@•ÆàáÏ“ì«æ¦2‰n›jŒÄZ ‚-<¬‘”àxæÆx!AËùh"‘ &‰Aˆº#µ‘¿š¯Ón{óívnºúåˆÔK6­iGÓ¼–·.“w*ƨ©ìn¾LX·ùõ ‡T¾¥'I¼%o¤2¨¿5“I¨°¾¦ÚÈqF4n:aH;'¾2.v™®FL•‚„ÓÞFçNÜÇ„F\=CpîñÀ/• m-‹Ê’‘\[ ¡Y'*Yí1`¶‚yžBÈI¼é@uK[1„ñàøòØð å¨:¸e8êfµŠEt=È9L¢ô<qXÞæàÍîªbÕAHp¢=iw4zæè’®«µÚ îÙÆ|n<çr9é®UdêòÂE+Â`Äå˜BL‚d?^ ’ó„òÂþ¥F…\ºP°n[NÈÆEOuB@JŒÖosÑëÕþN’å~”ç/ö¥êÉDÁeO&I"?&ÂÄ|81ôCjz”ÞÛo;¤åÄÙ J¾Ö‰ øß×»dIļ}†b3&C¦ÆÁ¢“Àóòe¢-ÌÕFR~˜r3íÃÿEyâ-ü­öŽú¨*†'Ùx}~«ÏÁíæ :Éep¿$¬U¢[=”Tõ~Ne“(Ù¯—G Â?M¢ì”‰!Àn§;3:„U«5ûŠ¨ˆ0ËÅÇÄ,S†PĶv«GÌʈ“«"\ìz¹o~©ypšl¯AòB{;PÔ[°›ÜûÉ-ëñ`vv<Ɉ]«_¹ ]Mrɵ ¶–ë±4*Šyójjk¼y,6‹+Žƒâjo,(×Óü äX[1*aàɪ¥;†ëºœ’aMR+éèÄDš0ýÂñ,qžW½‰ƒ¯JPÕœ){õ—^LbjU·Êé€^·_<3Ê8¹…jŒ„›§F·3ibF:[Ãcfð6™tî§9¼†nÙnŠ9Çg_?*§ð_V\4¯«\Ü{"gjÃ3qCõä¬ +·¦³¡xæä› ]÷ܺ­ÍÜž®…þ0†b'Š_ ˜ÌÕЂøÂ$; ý±„þ¾GJî`îwÖÖß¿û̃7lªýì–€î§ÈÞé–Z{µÔ¤¼È’…¹þƒ‚Ò‚ˆ8úM‘4ªÌŸ»ßyÄ>«Ì„ ˜±f1 ]”qYX½—wR|ÌRgÙÃNõÜ^Æï<ã ¼®ç‡¸s‘µ›šµÃo‹ØªfÿfrúÁwôNq‘]ýFÈßÌñCl710ÿºDÒNMlÂIòY~Ïá^•²ýDÜÛóêjä€ù³þ0ÌŒõ—S=ͼݶg‹Ìzó"»h[ÓúÀÔµÄ8õ“xÕ8à?Këÿú ŒíK~YDëê˜F‘…†²°4=§XÿVæ’äÿ“·öendstream endobj -4863 0 obj << +4971 0 obj << /Type /Page -/Contents 4864 0 R -/Resources 4862 0 R +/Contents 4972 0 R +/Resources 4970 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4830 0 R +/Parent 4954 0 R >> endobj -4865 0 obj << -/D [4863 0 R /XYZ 85.039 781.388 null] +4973 0 obj << +/D [4971 0 R /XYZ 85.039 786.531 null] >> endobj -1110 0 obj << -/D [4863 0 R /XYZ 85.039 761.463 null] +918 0 obj << +/D [4971 0 R /XYZ 85.039 467.277 null] >> endobj -4866 0 obj << -/D [4863 0 R /XYZ 85.039 736.911 null] +4974 0 obj << +/D [4971 0 R /XYZ 85.039 433.133 null] >> endobj -1114 0 obj << -/D [4863 0 R /XYZ 85.039 323.41 null] +922 0 obj << +/D [4971 0 R /XYZ 85.039 309.474 null] >> endobj -4867 0 obj << -/D [4863 0 R /XYZ 85.039 302.214 null] +4975 0 obj << +/D [4971 0 R /XYZ 85.039 275.331 null] >> endobj -4862 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F56 2890 0 R >> +926 0 obj << +/D [4971 0 R /XYZ 85.039 138.123 null] +>> endobj +4976 0 obj << +/D [4971 0 R /XYZ 85.039 106.1 null] +>> endobj +4970 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4870 0 obj << -/Length 1848 +4979 0 obj << +/Length 3176 /Filter /FlateDecode >> stream -xÚ¥ÙŽÛ6ðÝ_¡¸(V*.)ê,Ї4MÓ-ŠtÛuŠ4´­µ•êp$y¢ß9([ŠµÛ+A"r83œ{†VŽ„¿ÊIB!uêĉ:Iœu9“ÎNÞÌ”Åð,Š7Àùz9»ü6 -%E*Sgy{⊠ÔÎróÎ}õÝËëå럞ÖÚU‰Xxqœ¸¯~xy³PîÍÕ«—?àQà^Ãöç«·Ë…§Ü«·oq~¹¾þωv—‹÷Ëïg¯—G±Ž‚)Êôqöî½t6 ÿ÷3)tš8÷°–BÁq9¡Dh»/f7³ŸŽ¬ø,p˜jÊ¡ND˜èsèp`&Bi'¥e@6Ø7yÕ­Í~á…~èV¦Ìxõ.³n}yÄ á:O¡4)‘oòÖ¬ -KÓîëºhÛƒ·õUVÊ}Ýtu]—¥©6=Ý?$t³ÙYówø½TY‘uÙ¿£iwõ=ŸÂu¼1¸Ïÿ0Íf¤Û¯Y;Á¨n}>Þ4ù]O]öžºztÙ”yõ¤)ŽgDӛݬÇ^“—”æáŒòC½{KI)Ÿðäçç\K¨yµa®ÚÍS¨“Þ¡O±·ñúïõÅçû ^ÞžÛ¦Ø|ŽÛÇ—sqà¾òYiÊ 1>L2Ú›C›ýøÆY{(ÿ)ú(V†ézŽz’¡È³ÞÒàûÑ ¤)Ô?†/³x·«Ë¬}ß3§“„O¬ ö°§JjºÝ¸–Ü™æ’jÄekÊ•9÷àtœÙ4»üV k™§Zz‘dú_±ׇ…ÄÚ]c¹6o2Ú´yñÈû»…Ÿ0°É¡‚ß8pïw°É× ?vwŒØ"NÖAHÃɶE Ô‚5@3æå¾`j€#Ó®°\Ív›lû[1nL‰w­àÜ\´|¾ÉnÍEÇn±*M»Z€+XØ ;¼»> @‚ÍEs…ˆÃÌôßÔ ôÝ  - ´·u³A½ÌîÍ -·õÁn»]ÞòjOppÒ— k:[ŒÒ<ò}LƒŽhƒ’)šÎT…VŒù§5j€º6V\w'`¨˜W FÁ)g…[.žÕkhûO‡ ˜QK !…Œø´G+å ­|Gû‘P~ü÷]Z‡©Óh²Kc(KÈý$"’À†W{ÌÅëeò|J¦ñ±•Ç>È+RÌhå*Q -’vG¤8$²5_v®(£û‘‘B–ÎGG ¤©f”ÁšÄ?iE€Ë«R9ßÔ ¨3’•Ùz'¾$ªJFSG$Ò vü$Ò'I;ŠÝ¶ÛLŒÙýÙèÐsÏáÊÓBâAH¡¹·CèsáƒMþ›Tz˜”)Ö˜˜|Ã-FV]2‘/|ñ@±,¹\Bž²÷”Ŧ—7Õä17üÔw #õvçÞÝœ¡­%_ïxŸ6|…50v5ª~o5@Ð#°z}Ê·…úÓ•jk±Íº;˜Â*†€û^õœ±³jBnH]H:ûî (®‘ck¸ÄÀŒƒÒÔ €ëuM®ØãTÕC*0w°¥zcº¼®˜qó,‹Þ†ÁÝ.ãÅÜCFh&ÜíÍæmŽîÏ:ëRºIxüNÅ-|ðb“nê Ré¿'&æ¾&’¥ÿ¯V`+õc˜×}È›ôÙW/a!O½/Ge€‹…JC+²uZì\-ƒ©××¥E¢6NÃÃïV¤Ú~¹ÂjOå«æ6«n"ø1±¾ƒÊWi”ÅõÝhúÈivp~Ëßy×—?̦œ3¸í§…QÝÁJÎ -@8¿¡™.†ÙŽÏ6Ç aààBêwPIx%/iøb¬mÞ ‰|G ÌTYÊ Wë1­’A¡V±µˆTW¦`PöÐóa½_÷5 X˜–Q oÙ… bÁ ½ìKŽ•GÆ#âÚŽsëäÒ^A^£“šÆ•9Ó ÕwöÞ¢6Óº™8€*sþuáS« lG{uË¥®7Þ±RÏâ%ùôñ*YÉÏÇÃd4-#Q=øÝBOËì‹ÑˆS ®Ê,*Äsé—øyêcf/©ëú€º/ì») <ÃwÓ@ç.ã4´Ç»§µ¤ƒ?ù“ Lõ› 幎Uó'Š1Xߟl*ðµÿ_?G :<½N×óЇ@U½,Ô˜ÂøSyûŸ­Îþ û·Ôeendstream +xÚ¥ZYsãF~÷¯ð£T5Rx“9gãÉlìÔlU’Z¤%–)RKRöxýâÐÍ–Mùa·RõF£q´éÑþe¯½0¿L³d‡þåfá]niç§ _!V +²r`~¼½øásœ\úÞ:÷òËÛ{‹'÷Öqž\Þ–.>üüþëí§ß—«0 ~´^®Ò4[|^ú‹«åÊ_üú ;Áâý—D‹ß?ÑÖlýFƒßuõ×ß>üãêËOË¿o¹øtk©rèöÃ4ýûâÏ¿½Ë’èÿåÂ[‡yvùDcoíçùåþ"ŠÃu…:o.n.þiqÉ^t)§æX‡Ù:ÎÂ×<ðãÄñ:‰RæÁ·º¥·”Ý2ÈO½(Î<±¡åºÂ¨]ùb”­qGËOÒŮЅÌÿòü¨©G±YBàŒ¤¤18öÓůÝr¢‘c|¹ú—êzYùòùfÂH ÒbäUþ5Ä­ÀŽ»ª¯î ߈­'€a^º2v[@ZĹ•ÆæÌ ¦^iBöé#&1?ÅÆ~•²†Æ‘0 몔#wàÚ³Œ ùùRZp¢ožYÞ4uÕâìøŒI„n\Y+ù’êûùÖ •R2î ¹±å=Æx%~Y„À\‰*Aeç)YL=ó­?èß±îZ––ò(Hשxtu¿\EaâÊ…µ¢¯0Hîè'±óžòld-[ºìÃî _TlŠTT±6è„Mñ)J‚EÁª+€U ù˸q sQ0Œ:…`Ãà¸ä«}o°Ž»é6‚!vûÖÕ—˜YÑü¨®¤­ ¦‘¤ÆÅ÷>ð·²ÑûÂõ‡‘dÑÚK¢7ÃFx¯<‰óµ—‰‘“o ÖD¿†“#…_Üq¡V‡ ÙU[þÀsØ_BÙöUSwjXúÂLåP葤èŸþ}æ!q²“·ßaAÎúª$ˆÖ9¹E<ãvsR'âæv+Ú7ÊšJcTSª!ü Ìb4Uõê÷E»Q$õþг¾=²…ìùrXN—ðà•¨–1°ŒS•1»Ò­l¨ì7Ç~…§]Õ +ºÑö²2¨).½ìU»Aï°TÇPAK2|z–×lq®êWQ O£˜|gm}©zæû¤5õ {æwzŽ6ê"›gEÕ ”‘ @!ö^/`9žÜÙšC${Ð;…»êûhiÛ»pC#¾N(#…êÚm5Œ6t¾›ã( +B‘Í0ö5Ìâ8"aù//ö³0®ArÀãcJ—óþ økÙùYBsÂá.ȉâó/$d gVÜ̯g½®aFw2Ûj”ŠS|–ŶÝ)ÙûC±eÜéÀõWÎXÜøÐÔL"°%>›~bÿw‡£€;REŠ#°ÖV¹ïÁ†<šŽ ¤{4~oÝnÉ`7”`lÕ¬Þq ãPÎÿ–§´Ví¦;Š}U½ÚÎŒðEc?Þww68ïY9—Áhßõ•]Cî7bL{P)ó*+¸ ejO|+ŒoÝð)H{9Káz9¹`¾VEõ¶¨[M £„óê{Ù &ôB 1?¤4¥¾ŸaCÁ1Ú›**pAåú“[?…U“ÙE”èÂQ9ºåÄdpÒàwÖöõæQÜKè/̯•:¡$W3ÊjQ>.cöÎahAâWgTˆ áLËùS­¤°?¢‹ŽcÍžû?½9•ø2’Ó,/·Y^æS8ȼ³pzÀŒS¹Y¾8¶,'Ÿ­Üc¤™$¢¹uKïN¯×4;C•Â@Ø2–ä+ÈI·ì¨+Ù:¶Ó|>5ã§ÜËU\LÌð2FÑW´šÞƒ­â+NU›``Ш÷Ø>6œYLJEûÇÁ¿Xé«-Ã}£¨;µ!ã]m)¶I–p±Wœ'‰ù¹3JJã7S3ælŠE¤3Yö"ÅŒ5ż>6#4cõÇPi^ù±ÉK¯ØâØKž¡Oñ¾Ißs6wŒü€rLj黆 +A+ËuŠ&ÇNUpQþTü2IÂÄ&ߤ˜@€i!?l«ÃƒL€ïX n6ÜÀwô¸^Ú‹à÷,+-“rÔW/Ï+¤TZ¸šõL»‡šŠF·-xÁ©R-/˜ñ'Õ´-×ä×BSOJ®£ñßUoýUêŸTO ƒß^Be·—imâ™øÀf@nG‹¯M±a•æ³ò³ç Å\\i¥'Ò’N +¦£¨ÑowF˜³Þ<ô©Ï¢Þûn} ÏóMæ4î^ 'øˆçöœþ¹ý›AŽKËGÎlúz¬¥åL³RèöMÜÛ¥M¬q L˜4¯C“[QØ•#‡ 5 +ìäµL…¶ÇZµV¢É ïj“‚n8G éè­JŒVe¯ )ò JCH¥ Vï8žM0®ð1· ¡Þ¶²Tp\t7”ŠEƒmq¸Å*G>Újº¢œyìÔ`¦4êÇâ=¨ ¸—žû)û¢-_|*@ÍsÕ*|ÉnÚÂ¥C6Õ&„EÌXî:÷Ù•ˆÍU Ø‹w<ËξkëQõs¿*úJ<8z3Å +‡ŒBZa{öhã̵¯_>/ÕÇ7Ú@àWž?¿ñqƒNMܦ—mÜNáVl…–›V¼mÒnSÝ눿dwé€ÛgC¡ùL°ÇiÛ¤ñYsÐÄÎã¡–º¡[ªo;·—PJÌÚšUiÁÒˆüò(»R¨ªls‡þ—¹Œ*Ó}ÝžìØ8œzÎP¾üÝÈðž±î-e¦ ôO¾½îàˆï‹áa0í|bò4M±È¨M^f󯘽ZÏ×f‰s-MØúO² +9ñ³:^G¸Þ¤ü€/ë²%æêVVΔҸôeêäX;½gF­ŸËjü4ßÎj˜³Yúë( _d5©f5?²±ñ Í_¤Pí´ õ‹ò©c£[ S>|†t½òMÒ'˜³©Nž®ÃPXuSpUt‡ åeh56C‰ˆz9·Á°Á +% ëM×ÞËêÓÔB¤>²±yÖšçS–%ÖÛ>!wª<ÑŒØS‘K—tkhå;W0Ö)W“HÂÊâÉGd:õª†Sm™¬-s2qÔ À¡EM—(›JGÌ´·‡O»©c=¹œ8!˜؉ÐoY¡¯Òr_“¦wÖæcªÁë3àcÉ÷ÜöYžü•Î[Ø+¯1[,†y.¤ÒoÕjÙPŠ]³ æÂÝ\¹‹¦Ë·˜JÖO©—ÜxÃa‡•ùÌWxœ/Fç…žœuIyî´f13ÂÉðÄÔž|“>rÚo”¸i619ï>ù°òÒ”Û}øu18MÓ©ª£¶e‘¾s¢Qc©G­úÉN±(YÒßÄ1ç/ DhíJ)ÙL_pâ‰û> endobj -4871 0 obj << -/D [4869 0 R /XYZ 85.039 781.388 null] +4980 0 obj << +/D [4978 0 R /XYZ 85.039 786.531 null] >> endobj -1118 0 obj << -/D [4869 0 R /XYZ 85.039 205.008 null] +930 0 obj << +/D [4978 0 R /XYZ 85.039 684.064 null] >> endobj -4872 0 obj << -/D [4869 0 R /XYZ 85.039 186.34 null] +4981 0 obj << +/D [4978 0 R /XYZ 85.039 649.314 null] >> endobj -4868 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R >> -/XObject << /Im1 3957 0 R >> +934 0 obj << +/D [4978 0 R /XYZ 85.039 472.065 null] +>> endobj +4982 0 obj << +/D [4978 0 R /XYZ 85.039 440.042 null] +>> endobj +938 0 obj << +/D [4978 0 R /XYZ 85.039 341.361 null] +>> endobj +4983 0 obj << +/D [4978 0 R /XYZ 85.039 309.338 null] +>> endobj +942 0 obj << +/D [4978 0 R /XYZ 85.039 158.581 null] +>> endobj +4984 0 obj << +/D [4978 0 R /XYZ 85.039 124.437 null] +>> endobj +4977 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4876 0 obj << -/Length 2308 +4987 0 obj << +/Length 3063 /Filter /FlateDecode >> stream -xÚ¥YÝsÛ8Ï_áæVž©QßîÍ>¤ÝÝ^vzi®qçf§ÛFfl]%ѕ䤹ËJ²£|Ìl;-) ø Å̇¿b–Åž.fi&¼0ËfyuäÏÖ0óþH0…Ë$îˆæíòèä·$š ß[ø‹Ùòzà{QΖ«/λœ^,ý4wÃ0tDæÍÝ4ÍœwN/ç¹<{wú§"ç>?/ç®pÎÎß=Ò|¾¸øˆsó,t–ó¯Ëß~]öÇê7„#,ðLß¾|õg+8ÿïG¾.²Ù-ô}OÀtu‡òâ(äïòèòè_=+š‹f´jJq˜yq>ÔAt âÌá,}/ö#£ƒRËÕ܃ØÙ6EÝ©¦¥¯Ÿ©ùCµ(×ÉobÌÇ #Óu#8—/ £_€ô³}-2§š™s‡ýÔ)*¹.jÙ@ kë6²³=æU¹®S¥j\Þ5L­iJï ÏKôµ]Š,["h.íÌ.õš̹¿Þ•+J@VuƒÌy qæ²|®@e/ŒP—Òˆp%çn çºÁ£Y`ÄÜ]ÁeÑnì qèSÉ· *ƒ¶Å¾†ÑEÚ!ʶ+Ê’WxÜÕ«¹Áâ|«G¬þGkh­prI·Ì©RÔ~ßÁ¼QcÙêŠ{FF§ÊHê“Œ±±ÓdÏú"B9Vô©wuº¢N£¤Ñ¤F*ð•(Š·–êŒP—ñ$Ñõ¯±qt©˜»¬­eÀG¥skò5Œ#Gòâ’äŽly§ZsçjÄb°Xów÷O?d¶{ær oFðFëîodåëFm©çž -ê?tŒcúÒrS0q«ÀœÑ–ñÃÞÏÁÞ5•’õ«WdÈ‘ïù qÈ5±ÿBwŸMsxÁ¹ÀwÁo;Å›h­wø§ëÆJ -RØ`qxj»­l*¾‹ÞˆµìµEµ-•9x¿ñ=5j¸Âc¸}ÿ¡œhÇé¢^‚ÑðK4JÀ©šzÆoŒºÊ˜,tkAÑD6²"ðR ­R?¶%šµqvãÙ–³ñYhÙH±{€54ø3±?×Ç|"œf‚Ð-uÆä£Ø(›5ž½ø¯"³0‡Î‡».œÎžñ(uݲ/_2Œ״]£ >#¬npANE,ÆÞ†T!ä˜EäÀ¯©HhiÜ‘‰„bœ ˆ ó’4é9¡¤€€éƒá’!b>¹!‘<Üo/ò† ˆÏñÞ~çƒPÔÆblÉ -2!Úãƒhh¨ ŠˆÑÇDNƒ—Hß1GAv÷êQ-& øÉ3ZˆžÐ"=§Å§6´Z<ÜoR‹£ýNKcÕÒDŽœ°-q»ÛR neâv^tVÙ’×Ý‘ðº¹5g¶ì>6ZŽ6t^™è¦6æ t§Þ£J#ˆ¼Ï)} zBéLôœÒŸÚÐ*ýp¿I¥öûÜ*BDø( žk“WX,ˆœq½ÌÒ¡!•ÀÌ®ÎMÎC*lh·bµ²yº`Ê>¢âõE .Á%°ØÐâªXo 8Ñ'åÐi,;P\lû9O²4´“ÅÔÚ%ˆL#Ï÷ã=ˆì -“µ”Ä&^嶑OÕÆX%XãÊ%û÷ØhÈ%MV7ßú˜5Ç°Éñ›ÁL™3åh˜ÎáÂsBb[t›3¡fÙò+³MaD–Dðf"…ê#Ät"•Û¬d"Ira(ÊÇbðz¿¾0ØR* -†Ð=ÿV4u˜ü‹q=€Ê¼%ºÁõ0*MgèÞ ³³ÎûtTþtÊ+ÔvçZf8$¿ðÁ÷TªÚ„ÿP,(an ȸXÓŽ¨‚€! [l‚CK‰|l’C´‰Ð¾sjŒ¦C™d  ˜EÎk\“*âp‹eokç!ÐöIƇ|¹æeVæR“1^€áÁe& èœ/Êò ìl„°¹¸4žA%B‰ÆÙ¸²ü8ŠP±•Ø°0£÷06*½³wÛ©Š†1¥ÜÕlV0ÙÒpoÈø[­ñó–¦ÔIJÅ -æŽ÷46…´£…peŒF˜+!ÎiHnMƒ±ÛMÓÐùÅàËOÝD¹@C&$ ´Ò¶d»jÛ×ÜQ˜¶4ûŠ$kB¢Û]Ò‡¶I-®èä76 œ²R’È\åµÉa±; -Ô=êºm'&6§¤*Û„ÑÕœS–AÉÛ#?ulkÐ<ò*Qq$'™!úºI«wœ¶‡Rve™uÜ13yîˆoâÓ1Íûâ×®•õŠn¡¥J5G&>£Ýó–OXã7‡}ÁEk•wä—iaȈH{ABüÏ"åнûˆIƒè$H-sሴõAÇ®uCd#/ *#¨Z_í¬Cö$4bê’QÂÏLÛ2™~ï÷rÒs›4D’d²+úF°•Û-Ûžùbê¾Úðù§ ² _O 'îU†„·ô½z÷æ[#&¦ÄæztQ8l´­Ùd ¯­èM¹µ¨^·Þ„´T÷“IP½S„ˆEí·‰4*Yx~ô²4*KmEØ‚Lû§´ˆ)9HšE}6Eâ0’?’,Dûõb$lžûš£k"â#| aqÅ ’ÂEï½8$ýë”,‹y±´ÏR¥šLÓmÍÔ?=‘·L>ý@õGÞžÊ_žzw09Ì}¹ý~ßnµ.ïWMq£šû­nºöþËð{iî™ÉE£sÕ¶ýÃFKHÀ¼‡äèxÂÄþ}úéüìüý"%RÌ©¹) ð㟟/—Ô»R£yUª)Ô=×L$1m4/=õ×ýW—šÝ ÌIWm÷–Fï? ,›<ææGN=zþÄá:ÝÙë0 îôÕþëÍÔÒ¾ƒí/2¤¹äû¦„m´ÈØLO3{-ª™Õ‡æÑ>õH΢jàh=Ãûš ;´ìá&rµb‰[0ñEè{ÁbªB„Äú/ý|Ñÿ@É{.¦ËÌ8¼@س ("ÎÏkæxpàÿèËsÄendstream +xÚ¥ÙrÛFò]_ÁÊXebqycdÙVÖ¶´³©­l†$$Î@’ý÷Û× @¤·j+q0ÓÓÓÝÓ÷ØŸyðŸ?Ëb× óYš%nú³MuåÍž`åý•/ YŒ`~Y]ýí]œÌ|Ïͽ|¶z´xrÏód¶Úþá\XÞ¯n¾Ìa:~äÎiš9ïæ¾s;_øÎÇ\ œåç·8ˆœ/7°tKw0ø"³ï®ÿ~ûùýüÏÕ¯W7+KÕˆn? ‘¦¿®þøÓ›mþ_¯<7̳Ù+Œ=×ÏóYuÅ¡G¡|—WWÿ°¸x-šñ®)ÄaæÆYx*?žA»I”’ š¸ˆ<ç8ª[øS ¥†‘Z—Å\…aÍPÍæËf¾2g3Rç+Ê wÖm¡¾2ÈÆÀ®*uŠ âkª‚'˦Ãïž·½âêw Ð3P¿èç®òŠ—9I´Õ¼Wâ MuAT?1¼âŸ{~„p·Q9«î„Lܤ­> +8'‰l àœìîU[Ôxz“©³'î‹ö±AqU‚ÇgŒ´1s¶FO£¶ª×MÍÛUÇ Ä$h_ `ZØ r> +–>XÓJH•åwÆÓ4@Ôæ¬MoP7üÛà®Ap­!’nÃÐp*¸£žm¢Ùwñ]‡|×®Ù¤®—ó¾%Õè-Ãõ;& mdÓT¨-kº"šVóh`ðš²$Ê_uýôó³JRß “ð¢;Á)DþÈ|Ïw#/´ˆЖôø<ßKÜ,Î.h`NN<0>ßÜÐNd2šƒ’ Ýû¢/]ŸÊ²cQ„˷‰ + r$;@XÕZÉ×bOϤ‹(|÷œT£È ’ø²T˜ R JõƒTNœ–êèÄ´¦¥ô*z,â|FQµE©Áµ ­‹žÔ 7Ð}|íÎÉÇO]?I.Ëg€¹ ú¡|.8ÈçèÄiùŒN¼#·F†Müö$ÍžY³BRd;pôAÞäxSsx0žg{F^qž»ivQ\Ñx§á*N#7óØ` J.뻸tðXÎ’xQõ¦@Ç“¤ÎƒªbMŽg×0ÞÇ!êüi‘e ]¯7 †ü†¾ÚHØî^Ía¾UUÑí9åˆÓÀM²à2·ÌÙèGž›ÄìR‘¸5ð䞃÷Ö²W×6Ät¼Ö ¤Á=¬<×ÄÚøFƒ\Bw*7ªñŸ³"ç@ÑŒ™¤é~§z©’#? +áÂcÐmÓê¶Ò£ÙÑ Õ’ÆÁôž-*Wñ)Ž:]7ÏÝD8ÚãZc¢.qcøÓ„CüZ‰stß© +‡/X«8VâÌN 4W‚¥á_µaßJi‘œ§øÔ +¬®ŒiKú—ÆàÂÕ’BâÁá·¤3PcÓ’Ë‚€íÉc+&ͨؤäîQìIî<1{üwËs|`K*’V©É¿}çõGºèjo ¸¥dåÐìÙ> “5ÿ›^tKaˆõ‡†À©ç¼Zn%»ÄIˆ÷B{]s) ”ú+ËL 8S³jSœ• ¤«•‘sa²'þT¼äŧP?3ôtjR •ìP½"iJK~@rx²ÝfK&D£DD06û)Aú©LêÝ<‹HÍ"?p*JÇp4È íàØÓ´áÙeÔÉÈ7wׄ‚ªÇ×M\s&g±uw&§…™ )â4I¶xø ýn‡à`ñõ×LÏtæ)%Ðcê„9K–…„…©‹ÑM€àìŸÕù;Oõ”ìÔ# w#8ˆ½!j‹²¶6Å –âó~Ÿû@ð¯dÅ»¢ÜË1Å·žGÆ1à˜ÙhÀ#Ñç„àp”j;eè?½½cê>ß­xuêç÷7<^}¸}àÑ=R´ü²ü„U)•±8ûÛç70!@ÿºû–ÄÆ? •²Ë·üA.o~{ów¯L‘{÷v‚ÂÕ‡Vî‡å'€ù—9ƒÛG^7%9´FjnAöäM„=%‘«MWQZÏ{ëXHóø#m<øÕœfÐÁ !é±ÍñÜ©­É‚Q(þ²Ì¾ +*iv2XË a *œL¶áŒŽD2ËÒйí…~á£5M#C(Ë©ˆŽMâÏYG ½¤z¢½OÎ-„Ä„›4 ÃÆCn¹iØ—ˆÌ†oºg‹šŽW)Û­…’Ó§Õk@4VcY¸qðÆèN%ÓeNÁ††¶¥˜¾›j7J¬=ÛXLfÍE<ƒ-q†­œÎFðuù +Æ×1ó‚¼l>ë!"Ò_D£d 4P0ôo°Ú‚Ìk=ê (Ý9ƒI>bÖíAÏÝ·v¤smÏò¡{•|å‘‹_¼˜4;𬡵Ieè`’Z›où«B–Y¤\Û¥9¨*'CÛ ³Lá6ÎÄiÚ6H(O’‚P3Ÿ KéÃæi¥¼¦ú€ +«Æ,#ï²NôáÇ…0$ʤbtoôQð`‹ñŽF¢ã†ù/v:~X©™Ó-ck?"óÀ•ý-ÙÌR·ôþiz{Ñ`1và±¢ˆ% Ç+ñÙ[/$hÉX ‘cº¨8¶¯•B¾íšd–¸{¸úrÁM¨KiâélÞŠ€ìHp4ÑpóÁuv>ôÄ"‡lm3J`ÊTüÒ3+¾éÎ&TØ£ÂhäŒh¬+ /„ÃêÖºØÃŒp2ÊгkÄi¯6¹“cIL}¥¡$¨ÎQIìÅÇ%:´Rz0­ +†Ó%qB> IÁ³TGˆ¹?è"®ng› a=8~> endobj -4877 0 obj << -/D [4875 0 R /XYZ 85.039 781.388 null] +4988 0 obj << +/D [4986 0 R /XYZ 85.039 786.531 null] >> endobj -4874 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F14 2895 0 R /F56 2890 0 R /F66 3242 0 R >> +946 0 obj << +/D [4986 0 R /XYZ 85.039 599.78 null] +>> endobj +4989 0 obj << +/D [4986 0 R /XYZ 85.039 565.636 null] +>> endobj +950 0 obj << +/D [4986 0 R /XYZ 85.039 414.879 null] +>> endobj +4990 0 obj << +/D [4986 0 R /XYZ 85.039 380.735 null] +>> endobj +4985 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4881 0 obj << -/Length 2439 +4994 0 obj << +/Length 3393 /Filter /FlateDecode >> stream -xÚ¥koÛFò»…šC -ˆX’»¤ÈýàäÒÆEóÅ*Š"àÖ"%±åC©È¾_óÚ%eI.p‡Àá>ffgç=«pÀ¿p’Æ~ ²É< }•¦“e}LÖ°óóU(3™`Þ,®~ø)Ñ“0ð³ ›,VØ×±š,òÏÞÛ÷×·‹wŸ¦3¥”¦þt6Ÿ§ÞÛ×wÓл»y{ý·´w ÓO7ÓYèÝ|ü™áæ×ÛÛàÞ4UÞbúeñËÕ»…cË,dÈÓ׫Ï_‚Iüÿrø*K'~Ûõ0åÇZɼºº»ú§#Å{zÂXçD«ÔSu*dÆ©ªÉ<ü8Ð$ƒ¼¨Š¾Øîʦ/vÓYÅÞ²­kÓä<ù¯gÌBd!#œnÓx×ävDàPþÇì>}~/º3„Ú.âí|W~³ØµÙž9:&„£cL^—Íe.Ý&!ñ°ÛšeqÄXpÓ<œ`þÑÞwGˆaœÃ%s_Ÿò±½Z6ë#Èû.¿pí³Ê¡Oµ‰Ìì÷ö{‘á÷çÄ^m¿>GìëˆÈ®­ -S—5°ïdsY•…½ÀXÕÇÒ™éÀ²ðˆÄg9®ûB cˆøy‹¹ýðS86ÿ™Ò4œiå'*!ü Á­û-ø±ÙÕìð%Lh¹Û9»{Ä;‡i”\ ¹îõS§ÃÈWa4‰C ~|ÖU-Èl€!O ÇÑ*ŒR?™'–rú¯ œŸ7‡~î4†89ì(,¨ ‚G<>ì~:‹æ^2XÒ£»½Œó2!4/á¿žW:°9Ü_–«GZ¿]ÿŒe! V(˜‹%é…Ú6¼n:FÓFQ–¹‡qU¼âƒJÈ/* üD‡¡èÐ_é๭žžwV £óþ5ôEU± Ëž¿‡M¹D”ÍHä[¢Ü’ÆZGJåN”Ñ¢à­[&½·~Qøì±aâ+Ȳø… D,¿oñ(`øþ&Œ‚âõ–l%ªwž‰?ɤi‘aHÁ+tÆÞT‚!š¦­;S#ʽ™)?à¥CI†Q^¬ òX â›Æ‰gª=[#ݶ7¦J‚§»ÿ)WdƒÒ¦ØX,DÊ{³ïI­3oK¶iX<ßÉbÞ"ë/á%Þ®¨y„VŽ_4ù Ê'‰q€zh‹5]p6ž4ŠøÁÔÛªøŽ¹YŒ·œhqÒ6©óL²#‰ö0—[mþ´––€Œ¦²ç­¥Ù+õ€r'ârÝðÖ ½l‚¼R¤€ !¾°¢ßoyqž€§DqÙ1S;{¸©NnËÙ‚eb廙ˆ|¿x~G*Nâ„ZðV»ï!aÒD±aÑ2€&N ÝcgƒQ©y¹&¾ø‘Ø&w49´ÝÀÉbm*ÌØJê’­âT§ƒTt||²Ò‰‡þGsëžJÏa€{1(Ü}I®ë7<’í¼„€¨ÀðjF '2ÀiUÌH ¨îZì˜aÀÖk’¡í¶ñ9m'É(0*¨~³®ˆWû ’/dÞ×gÓ;Ž%18 ŠÁG÷2@þ“À²YÎúa‘,÷” LV˜ ²¿4Bðà‚'E“Ÿa+Ž|P§àµ«#$0•9¯V(„cKiïF˜=Xg¡…lK*H0˜ÊÀZ ©‚ê3Dí¥² -¡ I“ã(æ,=Jçܹuî“ãZÉ.`é}×ó^ñÜ™NȪs»çt„À¶À±“÷Ø^pƒ£!gÑÅp°Úµ ì„>F³Ì»u1—¡ÞYo˜œ»Éûw«SGq¹(Â@e¿øÀK¬y‰ôÂË5&ˆG¼§ìO»Îê <:Çx‚é‚AùzDŽ£/MH‰ë‚ÏìzÓs(}Ž?÷þ}#f*¢*ÔTŒ -9^JY"r8bO¤"¶?ølÉdzIÑ´dseÁSJÔ*€ÜÕ›²¡j˜€Æ‰ýÞ Îí¿Ä̇©Èfy@v9†S¯ -lêN`ALŸ'º²ãÞaÚÕ+ÞÀÂìôT‘˜íå±B$7<ê}^A÷Î/÷^ÐGáJ”Àøo ÊËÔ±+¸¹L>Ü~²XF–H—®]tD!ôEýâLD°%ň.@t¨AÐd´4¶¾£C¾›¶*xƒoË^×ï(!¬yݬ(¼øñ¯°«XÇ[ãS@û1Ú„}YqNŽ(Oò'Ð^,“ò}³±æŠéj”k[dj(pb¿è 4'·*鸘#2lL0’:.ã<žZ¼2N‘c Ò¡&ÁójÇJÊèÑ1B‚"î“ â\J -´¾0¹“/ž‚¢8öçQøìÖ†Z„vµù’ G—úà8äãCHK˜0 Ú|÷ÐC -²!\©Ô¶*xüÖæÛ9£$\Ü›K?§—® _MÏ‹’öaä ð†-ué†jÜ'Ïßp€9ÓÙBG&üL÷ž - AÅ5>Zº´\é7h‘ê(¶Z‹!!™s]Û¹òCIåðÜ«bî^ÍÐ6­dt ½Q¹WJŒšhøëÒȽ)z±™äß•'M¹ÏbQç ÀyKVA’Ý»6ƒ/+ÕWϽmoMIG“0rÞЉÃDºê³uƶ*mëUöÖR%O¡¬'˜ÖCW-'Î…Ë`³t'ÝTÚ¢k•Mv–Êc |‡ —J4ì%É擇£tuhy‚.þÜû>³Èo?÷ö -ø@äÞW00€÷ÿŽ¿|P£ »u¹Þؘ¨F,Ðcݽuz%1ÉÉ×&Žßð©†zÑ•¦°ì_È:PGEg_?áoõýúâ2—V~ª.¼¡ÆQäG¡å…sœ=å×þJsÂð¸ãŽ·endstream +xÚ¥ÙrÛFò]_¡ÊKÀ-Æ}Ô>Ù^;«D±wm¥’ª$C"'#+_¿}Í`@BÎV¥\çèéééé{^ð/¼.R?ˆËë¼Èü4¯·‡«àz3ß\…±µóúîêå»4»¿ Êë»{‹§ ü´Ì®ïªŸ½7ÿ~õŸ»·Wë8Ž½0ñWëÊèí‡7ßݼÿfõëÝ·Woï,UÝa#M¿_ýükp]ýß^~\×Ðü°,¯WIûiK¿¹útõ_‹‹ç’k^µÄ±K¿ŒÒ/³)Ëü,È,›"˜Mü8É\6¥©Ÿ%9± '7iRzŸÔa£àØYî}8¡zÝ +þôÈ”ñÔê3bGCcË·+„BØí4u»ãñ78ÞÒʾkžã_ùEZ|ù@ (Lî=Ìý<á{ÿp„ú¨ðº~E„#]‘"„' ·ÁlWQîYÊEÅ]87Ìþ~ªyôG­èÔ°üÑÊ‚_‚0ñF Ü — 4±ã‰{hÖ¸N'hö5Êfy7㜀–YK<Çñ¾VMóÄí¥½è0…ÙëòX¹QxJâÍæÄ7§í§¥GÐ[ܦƩª+™oñ7÷8Õ ²ªÒÁ""bé »–Ûˆ¬»g° kÅ,’9‡dì.’ ¢“zC7§pÛµƒ®êÞP¦„A„ìTDÔ( —8ï0#%^Ü׆ý¸”T #ÕGч…]OÓ õ£&Y/XdÎo…(µOpG0ñÄGÕÜ"ÎÀï“ûšÁg²”3£`xÛèºE¶ÈR—q8­ˆ€=Š¥Ñ6º¤šÇ‘@õÁ_±¨`Öâ/‰˜Œ)þAõªõöÔP %.*r¯ï6öÒGý¢%}Ýhµq€xÛ³˜cŸ´doľåÕúplÌÐA&¢Ò©YÉ;îÓ«4¢t="ƒžxy‹PsÉ»ƒþS]r¢e +ºjXó0°Å‰#wêÏš$TŒô~åjêþØ[»Róíߎ¤e`Oì D¹€mÇ}oõ®ÇãDè ^¢# Q’£)F(4ÇQ”«ó‘8ÌWÍD ŒÅš<–Z¶w$µ8{;W´£T²Vvàcômýš5»’0s4Þ¤µò‰sÄ~À1îøI†/4ïB€ã€ÇLÀ½¦;ܪÓP3,©R,B bÚíy;s©µ6#ÜNÚ¾ˆcIaøÂVópUÆîÚêqÏ-›Ô}=,…-§§)>—â–byw‚Lx‹gàÄ^$àØb`Tb°m&Ï7ŽuσÚq(ì´XbpŽ3ìÀû†?qó¼ÄªíY6îëú‡é¶DþUÆ%3/5‰Z +ÑmKÎK=h.¦ „èÓ ^ðé.õâàÍG$êæ'ž‘Ø2ç›.È|–ÒR/»LñméèqZ¸'3Âì׃YÆr>açcŽjJX‹…SãsI”6• }xV~h'éÀ8âä'"òÔcO"Ô§aÄúÎ&“™¼™¬s­HÝðp7÷LÆbZØÍd/I®¸[éAm¨RùœÀˆ¡L©Õü½¼“ÀÙLõù¼3ÎoPd¸²R\ÚÀûƒ4l±"t$dYáýðþ槗gRPÊ„ôÐÆÛþþ5·'³<`ýÚÇz§újr¨©q^œŸzrë€e0űîÔTRGlX6È¿ ©Ëå„ÊF ¶'äæä¤òh‹;Øj€ÜÈ­$*–ÔyCÑ-8ˆ»i Â×àÓ13ï{mjÉ}7t÷R¿|eòb‰Ä]0.'rJ66«§’&^Y8}äÚg¾œP ²»Z2«þ£òd5Ä©±ÒpØÓ;%NœŸy^è÷œä%N8óhÂ^Š’`@a-hÊ ÁE„/VçÈ»ž5‹×ƒ`ŠÍ¨m'ˆ;‘îb™Çä99^j58[·Õ’„C€H ˆ­¾¶f¤ÁL&4‘5…z[‹Ãå´ËÈÀèÃQiœu«ŒŽ U/8ÍZpŒÇ£À»¹çidþVä6#†+y¼d§p‹n)ìà cv±Í…PYa,ei¸‘ëÜ€ ¼YG>;âé$ÐYJÉðqä–æÖVuè½)’ì{ªJÙà#’L2J<{ƒîíY€C(+ÔP̾1vV’)ÀÙq`9´BŠ%Oƒ5N˜g—‹œŽ qOVèÀ{)Èe€y çÂX,Ü—Ï’tÿevv?00/…>ð ­ãä|-ò<+úËNpPÜ7{i"+±g@,h¹y2ø)¹²õa^VŸ§{„ä`õmǨ:Îrœ5‹EÈ™[ ²Å÷§È•úìCÁ‚½ÇO>‰— RN ÀLÈÅ??®Â¿`xÁ]†L­çÄýÙs¤cu9‘q‘X6eõ´€ËžÆT$lPRíºäÀE‚[ðk +>OˆnY;˜¡#ÃE.¥Ž _õ/JWœz9—ØÂÛ·„xæéÁ8âÊÕ¾¦Bs!ï²EîÈBl^I;ü™Ñ VŸ¦W‰¢Xˆk—Þߧ*SȲ¦ÂbJ„£)(ð,…„îƒ)ÏÙ›SóY¾!{LUžój«Å³‰Å«¶3y=©3z]÷Å]†üJà,4΋Íó· ¡­`û, ¸°*^j\à}gƒyÜ€Õ•{†}Zif÷ŽŸ[ÄY+„½¬Q³bñ—×*o%Ãi2öøQÆÀe¹z:Dô&Wñc`47¢æsE€¤Z¾9L¯žØ¥èÐì[xB˜¬Å¬çli䄤ÙdŽÁ<Àÿ©ÆýŒ…ró/½ûñ ŸýÄ©ŸðWSç_ýÀÆô·¾¨²ß%…_Ñò§CiùQh‰¡o¡Òâœâ4.ü´ˆHþó–æendstream endobj -4880 0 obj << +4993 0 obj << /Type /Page -/Contents 4881 0 R -/Resources 4879 0 R +/Contents 4994 0 R +/Resources 4992 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4873 0 R +/Parent 4991 0 R >> endobj -4882 0 obj << -/D [4880 0 R /XYZ 85.039 781.388 null] +4995 0 obj << +/D [4993 0 R /XYZ 85.039 786.531 null] >> endobj -1122 0 obj << -/D [4880 0 R /XYZ 85.039 255.721 null] +954 0 obj << +/D [4993 0 R /XYZ 85.039 766.606 null] >> endobj -4883 0 obj << -/D [4880 0 R /XYZ 85.039 226.923 null] +4996 0 obj << +/D [4993 0 R /XYZ 85.039 742.055 null] >> endobj -4879 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F20 2865 0 R >> +4992 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4886 0 obj << -/Length 1898 +4999 0 obj << +/Length 2551 /Filter /FlateDecode >> stream -xÚ¥XëoÛ6ÿî¿Bß&#J¢,붮E×f‡b节–[«,¹zÄMÿú݃’åXYÓ Akòxwü݃ä¤åŸ´b%\?±¢X -?Ž­t·p­ ¬<[HÃágÂóãjqñKXÒ‰›X«›£%å[«ìýô×Ë«ÕÏo–Žïû¶ŒÅÒ‰¢Ø~úòòz)íëçO/_âR`_ÁôÍóW«¥#í篞1?òüquõ×–±o¯–ïW/?¯FXã†!ALŸïÞ»Vø_,\á'±u€±+$,ïJ¨À7órq½ø}TÅkÅRs.¼Px <àñ‚¯oç«D¨$œÝε©³LÆ„ûh.žïë§Z'Y­sÔKe0ØἜZá¹3»ö­aÂ6Íšâv0ÇW5 ;C½H¸ W=˜ðŠìFåFáeiŒ½â}féÕë2L5æiÌnusÑî뺼h©F9—Y7õ¡ÍÏ60¦žònzzp½þø<ýº,Òcd¹#µUy÷ÅXØ<y6:»»&@0±¿)HW§§ipñðES¤]n _¦iÞÎðkAùp÷íÇêcßtê¿üGòRIù•la»·uÛ™S«Ër¸£Œ€+èofƒ‰X–W§ÉÐõͺþðyÿd¸„ ]xP„çß#Iºß”Àl´ÓÛÞrú!¼4€5Ž¸ËÙ-³†á„ÕSÐÆB·Ç…LÙΩƒFDIix°øö£3~‰ MtÅ¿ùg½Û—æâ¡Â’²‡B - õº‚úSEÊþ“z‡žwTëmøSµcê'܈ÊùÈpHiéíî:ªª7œ)è‹Ø N\iZ(¬Üh(x‚ÝŠny¼or‡ -²wçj°ªœŒyÖ¦+Àñ©Ú××øÚ·cWE6Ô v?`à+û7pš±ÙN=ul²Š&ÂPü7-öNPWs…—i°uþ™Q¤C#Ô•w¼b<Æê«àW›5\Ú«í´0¨RÆr»TÀ[ö9aðlm|‚kðeFY•Ílut–Ý;lLÍ.±V„«·ÁvK.$Aa:˜cÜرg'8Ëo4V}eGx8mRMfຘBd®™n ¨‚¸cãaBej2tUˆ´(Ñb¦ìƒÀ†~¾ªfz›EƒQDNYê[7­YŽ¾‚ML%_›é3P5=Ä÷j¸+ gv3'êQüêÁ'¹'%Ôú”†pÅŒn?ŠŒÈcUÓEâøÐ*nÐ3ÇcÐ2õ€ÝTÆLDN,É¡k¼Ãä »&gAæÝÖ³£Še#¶Áäos+ÈÀ^¬N¶5X„xàãÜ¥^2÷A þ±žÿõÝmü²ø"öŸ¯î9Ë â–ü^Lñ*Ø?ü‡_µendstream +xÚ¥ÙrÛÈñ]_ÁòKÀÔÆà†«ò [²­µWÚXL¼)¯†(!.™V¾>} ”k“rɘéî™é黇jæÀ?5‹Ûñ’Y‡và©Ùz{æÌîóîL ÅBHš×˳—oƒp¦;q’ÙrÓí“8v„³eúÅzóþü×åå§ùÂó»\v\ øVž‡<ýqöå«3KÿŸÏÛKâÙÆŽ­’d¶=óÏ|OæÅÙíÙß»½çÏxÕ” ÅB%vâÏ‹) íÐ ;1¹€UvC1ú‰ $ãÙpa +ÇB)|×Û]‘Â$¢¬ªD±üî(ÿî±ÖmóòF=×{žÁž†TÁ„]eŽG ^•¬Âö8ÉX+›ª(¯¹Yû¼„á#ös76D\#/3YM¤ˆ­æMK+×x·–ºÁÉn¾âŒ cª oõ7Yiž°L׸ûl–—wŒXW¸ºœ»‰ÕÖUÑا$æø¶RÑóëi:•J,Œ[ù%ú‰u¼äjôªÀ/q ʽÙ!†E¹ð@x‡æ«aÙŽJžeu@sR¹¡ïÛ‰8é¿æ1ÈöQd¦K£bXÓ+¢Ðj‡“‰7‚“¥¢—eõ‚vAËѵì‚;²žsÑíÞˆLLLM¬fÂÎ^¡tfDñlá%6{ѽfsIq÷V%*<=7!šj'‚îØ—óÿÆŸ·( ]4Ùpm@K‹ì›6kËý±@&7]ß.„­˜5°Ä»ú=ÛèGܯåùÄæwÑ“bëI|A> —|²‰Æ‡.qʈÂe›Œãfºf?ÇqVŠ¤ÂSÉKÁÒÁO Eç‚ëßÜ­æ³tŠn^s°aYË2L¦8EJæD«žiRÚ¾Ká™\‚¥…´Z”‡ãÏ´cÊåQ̱¶™ +d˜@¾.»ÀaFDg¡R†aÄ/ÞK !t׬æ8U¿y©d´xG’ßx6©m7–Ò“ŽšÓþb)úi¯B ËeŸã+vÒL'dƒ~¸ÖDêf»õ©FeïÁqçŸ^pì)[›¢ÐdGl9eÔÅÛÈ_ˆEÁqò¥ þJvèÝ’.RgúŸ$l!T¨ð…'äÁÒcg¾^J9ãA¤ uÊÆ19™ÄQ×–V +%9C8¤"aÅYe§…᨞hE4‘à^º bÅ^0>Žƒ†åPŒ–2-ÌtyH[!Y¾HÔŒo”Œ#žqЛ^“R!‚k„î(œ´] ‚±7Ù¸â‘ã*þŽìùeS=ÄðàT érÈíŸèœº¦®kØÓ¸\)¹”ѦlÕ’ Ž’õ·´hÙ ?컩“µ5¿ü°8®º=Q¥2Q\ªlª³æT½¼–RcXêÇB +CÓè¾(«S Í?±Iä §+Däò¥\ö‘Üg|yÀq­©ϨRÁ•]ÌD’<• ŸKoÑù"|°ª¯¥Çdž·6æ‡#¿¯bpBäßšÖÂ…„„È<ð +5jí./µ8ì²#iÆ#_¨‡ãH—Æ‚ÚLcFt"Ê:¾r±M'h +?&õ÷VFëŒÐbe&)°Þ×OŒÂd‰)f·…€ð2Wa x¢šQC¿ñaÓH~9=¢È5¸pC†( ÛÁdÙ ¬®Ûõ¡Û%•úºZÃþÄ'鈂˜‚Z.›ïËî"t"Ó×ÙH0® Ý#@*ø›‰äŠðuUÊÞw­1ó\–ËÄØúDùRŽBÆ '}ø‚I›:§ŸKg‚³±äã'ˆf¸•k¡Ÿ·9ýGƒàÎ÷0ÙA Øêr-ÈÕ8eæqÎïàpÕMêì+¿r^^žªGY7ýÊVwQöAÜž}\S–ÁHÊ2äõqG׫JìóCW’yXÅÄ7¯8^¯#$‡ƒÃâ rű¹8ˆN¿›ÇD POvG´Òô:üÄ0¶'ŸWÖÙ౦³Ry<üßËŒW£´žœ®"½pÔ+3dXïH8ksl0]/â¶Æ‹H¬ˆòî²aèñ«íBé G:ý7êµie7®TqÐ$ÉÆt´ßæàh“q=Iƒ_è„Š×ÙŽõp,u$Áš|× &E‚pêS˜´ÎÈ4³=tÕ麢Bg E}è7¼óõÍ’!oÞŸ_¿»dàòýÕ-CŧãóOç¿àïnøså‰GªÀö§ß¨à¯ûýÙ¿ËÅv»Ó]ëڮ꘡g¹ 9ä8ðb;ˆ½ –ÿ Ÿ©6]endstream endobj -4885 0 obj << +4998 0 obj << /Type /Page -/Contents 4886 0 R -/Resources 4884 0 R +/Contents 4999 0 R +/Resources 4997 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4873 0 R ->> endobj -4878 0 obj << -/Type /XObject -/Subtype /Form -/FormType 1 -/PTEX.FileName (./xslt/figures/tip.pdf) -/PTEX.PageNumber 1 -/PTEX.InfoDict 4888 0 R -/Matrix [1 0 0 1 0 0] -/BBox [0 0 27 27] -/Resources << -/ProcSet [ /PDF ] -/ExtGState << -/R4 4889 0 R ->>>> -/Length 4890 0 R -/Filter /FlateDecode ->> -stream -xœmYKŽ,¹ Ü×)ríEŽHQ¿Cxaû xf€~ à _ßAefUÛ ú‘’(2$Õå´£ð¿ýóë×ë_¯ßþÇïÿ~ÙñçkžeÌqüçUÏÙk_Ç__í´cVý,½¿n?cÝO¯£ÞÖÙð?ìí‘¿^^*öõ[ãçó‹Ü௰`kº=úq­®öç„Kþz]6\šËĽÁÏ;|½þxýã5æ¹Æ¨Ç²s4ÝŒóy¬rÎZúñý‚!­[¥Æ֘дqú²qÌ8{Ážß¯:ÎÚ¦³ŸËñóÑäÎÜççYß°Àbž§Ýç¿išáŒ7¹š½‹·b ÙÛkÓçAäYå(S+Z9K…­XÐXÃQeÏŠ#Z=½OÞ¥›M­hgYq̆­ƒšSŒFé!¸ø’± w|`ÏÃanÜî±1Îàï×9§1ï43[q®N\ÎB4¶ ûÓM«ñ{, €óq¦Áþ sñ‹Vyq^gðZ1¸ã„ }ЦֆéLþ³™ƒ÷À8GkOkˆX[NG4ëo_…tUAp:]Yò^vFÔ¹ÃC¤à»Ê`öÓq6€Ój Èqo´Ñêr}gH.Ò°¬¹Ôù¾¢"À¶èÛ‰‹à {Ê×Ã3¥ÂØqËXáæ=_8½=e<Ãâ\³ Ó»âiÈÒž¾‚ƒýŒ–ÁCV`Nl°·~Áò Ø߯þå…Ü `b¡I<Í*8²Þ²„QÂB+ػƇ&/òýZ„ø¬÷>Ҭܗn^ØuÀ%”›Q„Ksƒ:yl‹Ç!sßôsÕÔ“ئˆ °ÎqƒUtÈ‚ 2b1gl( Œà#ädl-œÙKóÅ-—ã;²Ð8‹÷K¤¿2®[ñ-ET>lÕ¥)Ìj¼ÃÙ ü€`“•‘{zÞ¾ÍP’ÔÖ[òå°*hÄ]ÏJH¶ÛiÎ'0oÏR³Vj¢7Ð{ÊN(@nÔcϵ÷À®–ÞL’€]båH,úì–3«LáÚ_€O¼®ŒÕÛéͶQɃ`7sþÕÓ,šÇÜî®=h݈³€¢à"ßô¥›Â[cñÆ8¤2‚ˆpÐjA´]Þ¦™ œõD„,8+bˆ4ê®1)…!¼ZûÀHýÉŽký‘ý¬% éÑÀîúNöËú‡˜à¥Õä¸9ŒrORWêü~•Ú;§ à,t#S͉£ä²,vz±YÌ$”Í6Û-“ãg2ÜõEeÆ›ä†bé­Œ7®ðJX’dL©„áC¢` »YyuÏžI¯ö N¡Ÿ9ˆÐðwå¡·<´2”d‹‹8o]I+‹Îs$´û>c -®1˜i¤ ¯I£i¢·°†˜¹=è ÊÏ•…§ÕkÔãÅŠRMâöD<¿†ãµ¥WSxË&‚—rlœÊòžý&Q-ÆŸÝë~x ß%ªÂ…=4êqÆêjsà#‹|æQ“©(5ËdŸ¯— ¡è¢oQ3ƒUzixìIÝ3ô-æ8ç¬÷,¦#çÓœî2‡P{Šâ­&o© -s¨&ÃÄÊÄv¶ ·ìj)¹âÒÐCœM¹ÏæhwC¼²4ƒ§MiˆKWV.\V©qõJ˜Qå|˜ÂdLé=…B½ÝØ=*ë’qí§­Mƒ'*0*2î±gO¾Õ1|:›rËócܤDR®&DðÑ"wv³B\HTˆÚ8!§ƒFø~¯X’ëÒl—³œ&jÔ …à9“ƒPÐQjk!S ¥3‘ò ˆYhÇPÑcU§í|øB*²Þ8inË_ìæ[´ç‹ïGS8“»yö?˜n 2%kvjhXlzDgx|¼ðtúê󨿿 Á$ç]–šˆù¼Ÿ‹F¾Î\o7À0òaNµu™ZzÐ\‚´*n -¬ÉQ0߯+#ÿ±-»=ÀMUxËùëz´Ù_€Ë3û&[(t½zŒeî— “Fò=of¶ä{_h¾‚¥9SŒ]`ô¤ž -®Ë¼«ÂÂìï{š)Þn~\ÇÚ¬£ZqÉp÷ìû15LIcÆ ˜Ô¤9±ô~ûz%“º˜ÏÈgâ^• yöNî³åçióþ‚•Û“:%NkjPñÓ’{øøÙ qo@B%™6•lÑ?Êò»˜«tTMbH -­Pø3øô™×!ý³AŠ<5§!Éçãß[Ž«¹5{Š¸:,RŠ½¥?ôök8ò® #Ž$„6ã?û¥?%lgŒ¢¹_z€j„Ä5ðñŸzÙXÑ9I/¨Ýu›ê:¸ãš÷«(=IeÉŠºî‡”Ÿñþâ{Ìß^ÿŒEZ¢endstream -endobj -4888 0 obj -<< -/Producer (AFPL Ghostscript 6.50) ->> -endobj -4889 0 obj -<< -/Type /ExtGState -/Name /R4 -/TR /Identity -/OPM 1 -/SM 0.02 -/SA true ->> -endobj -4890 0 obj -2934 -endobj -4887 0 obj << -/D [4885 0 R /XYZ 85.039 781.388 null] +/Parent 4991 0 R >> endobj -4884 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F56 2890 0 R >> -/XObject << /Im4 4878 0 R >> -/ProcSet [ /PDF /Text ] +5000 0 obj << +/D [4998 0 R /XYZ 85.039 786.531 null] >> endobj -4894 0 obj << -/Length 3910 -/Filter /FlateDecode ->> -stream -xÚ¥ZëoÜ6ÿî¿bkP-+z?è7¯ºR7v®9¤NÞ•m5Zi#iã¦}gæGRÔ®Ö®â%‡Cr83œå/<úç/²ØõÂ|‘f¾fÙbµ9ñw4òêÄWg -åÌÂùñúäéË$Zøž›{ùâúv\'v£8\\¯?8Ï~:¿¼~ñvy†¡ãgîò,M3çÙëó«¥ï\]<;ÍC‘sIÝ·o®—g¾sñæðçÝåå/<¶ÌBçzùñúç“׆,³!‘3MŸO>|ôk¢ÿçÏ ólñ@mÏõixsBD¹qª~}ruò«Y -cѳæX 1ÎüÜ̓øq6%¾%¡aS@£‘F ³É÷7ôƒE{nìEÂ'bML̉£ÜyÎ<(‡¢¢c×åšX‘¤Î‹?·5õ‹¦x˜ÇÚCí-~‡ûRãßÖå÷=CçªÌ´æ®?ÆÆ(uS?zü`#ŽÌ-ù›ƒ‰ëÇìå2‹œ¶®Ûe9UsÑV=ä^ »fÊz&qµëå·’ã…ŽG(8Méé0ŸBÀ·]»A«¸YžÑ²Ñþ£ñï±w´’¹Cl…½î1^x™›&ßòˆc„ì»yÛ¼HòÄÍ {²ïø,éØs®µÄ>ÜÕíMÁþÀU¹˜óÄ%yHÛ|¸gD†¥,ÿ‘úOh0£A–jW5Ë wÙ ÓŠ¥ÎR4kæ*qëÌçû ÉŒó2g æ¿>º®KÄø˳( -œ º=! ­Z`•¦™zEÍ'¢n‹®Ø”“mC¢ãé­VK¸b±åûŠÞÐbá^q‘Úàx5îÔ>z?LÆ+X‹‰ÌP‘™B.²b9sV†È,qny•m¦LÎ!ÒEtœ£{gIc¡ à¾¹r„&”óFØ)k#ק€C‚ESi'"ÿWÔeÖ»@»!˜";éuë¾Å,[,‡ç…¢/…rujº}µ>(¯}äü4Êô±ã‚j„d­F®TË’Ì-kÝÿÝó#¶ÂŠg»z:äÏvŽy£6¿Ñ(4Ží¸OgO”[ÕÏð‚µŸT# £Xte/zãÓå‡Æ„tQ0ÅdÂûÊ€v‡Žp¯hÔ -úbŽÖ´âC|ÅJ£6G,uì»_Œb€u§U A…1Ûmµ¶v0LÐË–hô°âåŒ_–qB,Ú•ì"§+·âÊb(פ“âc„…ùL mA8!XYhI2¤jXDÕÆ[ïØx1tÎ"òf,!þö¢i8Èó+:Ê/ñf¥¹é²ÊxŸ:æWµž»Ç£ì{åéÌ “«j2tN{­ªBO¨Õ¾r%\+dÃË(®´ÈoÕú{úGÍ|Cnòžó½ÄÍâl§ä}Ö“iœ3 ɸÙ_¦‘ÄÀ-CŒ9ß2+êcýÑM¿> )‹Ü˜ÂÙGiR84Mýk¹y2!IøÄ—,Šé:;Ø$é#Ì%m&™ß€°ÝiÑTž5c)xÜvx€ˆ”ÚͦÍU{[‰«Uq£ìC•ágÝ¢€Ä%«:«a‘ç;?2•Ï¹ +X¸Ÿàt—r=o_²"=øï§9Zý ú^—èŠËsçõåÛ§¯/Ÿ+C1Ûk‰É_{¸ÔÚê¢Á"wʾdÍòÈE éħ[¹Pj1,§9bøy­k}Ûis×cŽ%9qƒ”84å+¿E ›‚I¤!‹÷»¤ðY7À«ô¨ñó;–Ü\ôRþ©/è LÛab´v¢ˆ’»{òÀ3Þâ§`WO€ž›ÖÛ7¯`1*/üß«ÿ¨ÁŸ.ß½WÍó‹÷ -åWByóí¢Ù'6úòõ¥2Äa;/––Ñe€‘Â7Dx%À¤ -"œr#üOïDD ©b„ô³®Èý„e§W…¶°F1¹*‘ï¶H]ײwe7#€ÏÆÞ©SÜCl×µ5죽¾’ù¼… s7ÎâE”nßÎm)UrÉ/Îæ¶L,e&Qœ]Gfy´Z}ºÎ™¦Š¢.Ïͬ4(´RŸˆíÑžä®À>#ÇwÄa¶ÂôýëY´‰i]|¦ãä4 -ŽÝ–sŒçÀÓ‹M¼xÞÁ ›fµî™µ0lvfÛl²ìA°ˆÙO•A–AÐ¥!å0áHÓe*ô€6âÃc{þmÄÉw8e†ðm¤h®7Vë‹vR::e¬¡)‡¥z£ÜéÆ]ÜÃKu%ÊlBÜ$‡ I=$ÜoVõÎ\š5€£ ׳ü"֢锞²ý¡œð#F¬Ü¯4ÃN4òPIlʳ‹OÈfì_G+‚âÜM9#°Sú’ÖhƒÿÂùÁØåÌ2Ž[ Fî µ(ØV¢Ó´ -ºf -¢FŠ+Ü­Ä)šº²8N w†ö«Bû±¬g¡ë!Ùjà³¹©XC(¶^‡-’a ñXøƒ•«Iãꗗ׿¢¹â-•“ÔÐAþ90Qê»1é´uCÿÁ…CºÕ<¦,öÿ[!¢ÞMƒ”o¤ëÑï£AYw7Ìòǃ>Är©ÛbØN… ]’~ô}]†R2ØãX@{æÙ¸Ú]瀮Iàø©ë…ñ„®1ò#ûݽV+öÒ¿ÀÇÅàUÇé -ÚÅnh7”2­`BM@i kbW'åBŠîÔ¬™Bˆ„yiJržæÇ’ -B™Î2rå§çˆâ+)Њ!EiÎÞr²žy¶ ö’ô"ÊÜV¨êMªr0{Úñ”^÷+fõ«¢iL˜*;¤0îzEíáíäkmòzŽóÐ9fù‰a*võ“9 \s$òSGŸNÚRqà–h›u?Fvγo:mȤ6Ðãò -1‘sq $“rg§Cýóñ™ÂMGƒ¤®ìž ú1¦èI&,oÑ„µ#õoÊÑÜ«r Ï'uå°nÀ{ˆÂç9p`ɸ5=b•ÀÅXI™fj¦ÌºþŽ%Æ’SÝZ¤M*µ¨æ̸ï1V'kñîÍÅ{8ãYáiÔQêHÅ£0q8ÍÌg¯BÁ¾ÔÕ%ÑIøeVüßLU&kÔ·p¥~º¾mÇLšïíב%+ÈsG=s1‚Ä‹À]5 VÅ8È3}ï[`ðè}‰¶*ŽG!*þ Úè`VZf€¢tO(Ÿq½ŒäÀ$Ÿ‹àé&^¡Sç·Qè2ZÞò<—Rµ@µÂ3‡F¤e¡¿[h»ÃJ³Ûâ^\šG©Lc -5•—:œ;¤& -)?ŽÞm+%èn¢^FÑ5RΕ…Gjàq@÷Ì×´ÈW‰¿Oo’¶eá!ÁÔ5ª'endstream -endobj -4893 0 obj << -/Type /Page -/Contents 4894 0 R -/Resources 4892 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4873 0 R +958 0 obj << +/D [4998 0 R /XYZ 85.039 766.606 null] >> endobj -4891 0 obj << -/Type /XObject -/Subtype /Form -/FormType 1 -/PTEX.FileName (./xslt/figures/caution.pdf) -/PTEX.PageNumber 1 -/Matrix [1 0 0 1 0 0] -/BBox [0 0 31 31] -/Resources << -/ProcSet [ /PDF ] ->> -/Length 557 -/Filter [/FlateDecode] ->> -stream -xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù -ä -6\>RgÈbÏWÖ¹j[†› -WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream -endobj -4895 0 obj << -/D [4893 0 R /XYZ 85.039 781.388 null] +5001 0 obj << +/D [4998 0 R /XYZ 85.039 746.277 null] >> endobj -1126 0 obj << -/D [4893 0 R /XYZ 85.039 761.463 null] +962 0 obj << +/D [4998 0 R /XYZ 85.039 704.117 null] >> endobj -4896 0 obj << -/D [4893 0 R /XYZ 85.039 736.911 null] +5002 0 obj << +/D [4998 0 R /XYZ 85.039 669.973 null] >> endobj -1130 0 obj << -/D [4893 0 R /XYZ 85.039 708.765 null] +966 0 obj << +/D [4998 0 R /XYZ 85.039 426.232 null] >> endobj -4897 0 obj << -/D [4893 0 R /XYZ 85.039 686.905 null] +5003 0 obj << +/D [4998 0 R /XYZ 85.039 392.088 null] >> endobj -4892 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R >> -/XObject << /Im5 4891 0 R >> +4997 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4900 0 obj << -/Length 4366 -/Filter /FlateDecode ->> -stream -xÚ¥koÜ6ò»…›/'µ,ŠzÞ¡@sE{—¢Ms‹ö惼’w…jWIk×ÿþæEŠzìÅ!€—9Î{uÀ?uÅ~ óë4S¾Î²ëÍþ*¸ÞÂÌ¿®”@Ü -È­óÏû«»ï’èZ~ä×÷ã:±Åúú¾üà}óï×ïî¿ýùæVkí©Ì¿¹MÓÌûæ‡×ïo”÷þÍ7¯À©È{ÝŸß¼½¿¹UÞ›·ÿbx„ùåÝ»Ÿpî&ÓÞýÍÇûﯾ½·hÙ …qútõácp]þß_¾Î³ëgh¾‚éý åÇ‘–~sõþê?v)ž‹®ù«5Ä:óãL/i b‡Jç_§qàÇADDvp‚ºç“šßM{¸ 3oè`®mšªä3?àà ·‡]ÅWïºÀøƒ Ò¨8BÿÏ–5®Qáðf¨Ÿ¨â=ÚG¤ØÝwÚÅ0Ôx Äks:ö¥ˆØä qê‡i(¿±òçÔWAâgqvêÄÏãx•hæÖ"¢…K4úZ…v%Üòx£=àѪΔ¤^Qî‘šî}…?‰÷5Ãع¦a —q S³ÀtB•0Žü$ÕL÷Dú=Òýáæ©ßáÇÒÿVG¹\$ ð Þ¦t˜ÜvíéÈÍ~מ˜-WK=ù´xhø–u¬h‰VÆË ¤V À–· -99'ÔJä a D -Ð÷ŠC‰ íõ„÷ÀcÇ”CüÔ<Ö…n¨+ùX!xÅpEyƒç†Eèš^ñWµ¶‡æ…GŠÿVûcSñô©@W_ÂH’{õ0ÎjUÙÓÑ>S{h*‰ÆÀ<ötŠ¦.¹ûËÛ7¿q i «¹w(örô?ð¶B¯ki©vàYÆ?õjÀi²1ø<¸Ã3ž¿ Qí',ɘÈ]+”_¤rï˜Á9•ÜÔ«¯‘| ³}½Eri$µa2íaNX'ñ 8)3µ|C{(ï5.°1á<fM"²•yϽ—aGwºåÁA&Qëtµåb ëWŽóT#A²”Y?Ì2¯«öí@íÜ›1NÝ]1`³=0ð¨íx è>{`€h”¶“Ô(yG£AêG´2·?¿û†»È»Ìõ‚”e"å5$RÐ{fewÞ"ÊËÓ‘B/À˜;·ç×±%86‘|E'7gÈ"ÀLJ¶3d)d7Z€§û]Ñ;5Õ"[5²2͉°\Ø“Ád 2Ø7®Ô° üÄ3$íþ–m.8 ±g’t(YÙÇyä½A%‘‰yu®šO‚»f©RB Ú˜©Œ6„/7í~/zšƒL»j‹,ËV@GÕa¢û6° · Ô>Õ›î’]U¢°ÁéG\Ú¢\Q†© þÙUd Ÿêæe.MâÖºÎ#<݉or–éã,õs]fzè<Ó ÄÿÔ _oXu…î#vË®~2Ž¦°ü¡]°|¨|Xçf²@lÆð¹¨|‚ê¦0 Á7CÍjñô–^<øŸi˜Š{þRõ+¼J}•}¬XÌzÏkó ƒá!ÜX¼6h Åt7\Y¿ÔŒ`!濆Cåqwþ“w¿½×4Ò¾†ÀËQ¤º‚0Ud›Ù5MrɃ » ´]‹0y|—gw?~+æ‡Þ˜ÅÊê±@ld q O,„8R÷k¡QŠ -J&ÙÛv¨D é€Úr!ÑAhHÿ]ÑôÕÊR çL",p:4é D‘"ŠS?ð§Iâ|z«AYjŒV¡<´ÃÂ9p$»Œpvu(HW Œ&1 uÍe5a׃”´ñÌÏ5(Hêk‡O?J²‹¼‰ò‘­“Pûi`ºÓ*Aþ3s]Î ì·"=Ågby±tÀk+('cà@úX6„ëˆ#u1šÒqhü ¢aÌ,hñ…Þû‚ÂǧZï ¸ð<÷¾Ã䙨X\ŠÖzz!ðòPÔ²A1:$Mq0³àÁ Ë'Ãjˆ±/¬—²½” HB?7ÞïÎ% ^ΔóϤfb­ÕÅœ’cµ·âèÚÑÞAdó) -¢‘…øÞ¸,œ¤¸ØýG¾á÷¢º$Ê8ƒm—®âËØŽ0+ÙÁ6Ê4¶÷;r`’Œ™$½ h3׉K†éÙøW›ºhd„1§ó0öxì(÷Þ<2@±„cç—Ç°fŽ7;ñ7PJé8zEgÐ>8ŸWk¶(Mü`”C`–!3î2áf -CjY[¥Uà8„IÚƈ¶jqpŠ#°ôaL„Mç$ªåÁµhÇ{çôŒX"’º€ÃkZn7"ðž pÃ,N¶„ñð·~¹•Iܱ~ỤÁ s A¤C×ÓÛäµDJ³RÁHWáåã^v¤D P‚©0U€ci -Øp0UؾçEd­µˆÇ®mƒ1„|leª2ʔ㻗ÙB » ·TNµx`H¤XÙsß$úF™ÉæYCW÷û¦"!I¼ÿ’n=‰·7¦× ×UÛ¢+åœöFÚX„ -ˆ­¤¥ÞVˆ©Æ³°šð€h7’!kÛÚœ#A¿k»asBB¤ìµã¯ö§pEMÃÃSÚö<ølSU;Øׇz_È' BíÉæ[L‰â8`jY©h趇B&é@Ž2 ‹ƒ¶ˆ³§y l/Xã "½ã.f<ñºJìÂñŽGI|àd!ß”†Ò¸SqB§‘B†4Áiö¥‡£e:!‡,lDÁ&6Á®O‚S7²­5©Ø“:Ó|³ ¼`,sˆi7Æ8’|s“ÏK”‚b±.9^Fs‚¡¯ËŠ¿y:öN0K€t-0cÝGêž_4I%A¯™†¦ƒ›“«â,ß­dª·â•áÅä0ŠCÀr1Žs€ÎÇqˆ­É3þ6~ûŠ^S Ìmp HR(݆ªnÍiØ!Õ40 §6Lç~2CШ­0§Hž -cÂ,gÃ_«\[œ|mæx¡ -,òø+ù‚Éw¤”iÅGþ-øg ´¸ÿ `OUWWr¡*ü°]ä7)µÎbI2 ÄHucn¯î“'áã £¦¤%;/’ -´fø¼ôhågiþé.H­•ØÆÓ˜þxA˜j!5*Ë|†—˜b³øÃ`5E̪¤‚\°ãœÎ3+ª¤Téø(Óñ÷a½^ñ‘!{k½ŸêMµe‡ìg‰2Z›üѵ;LýTÅó°–eÓ€|–¼o!’§!’HÂiöÐ5aS“±·Ÿ*'k,œ¯õ‘Ý/„lQ8ŸëÞø“:“l©2%W(E¹a¿ÂIÏãB'›‡vH#L ÒîTIÅIÀãÄOŽ„oÊaÏÒÉ™*$¯ƒ&Ü”_$…3õæm¶]¤Ž¸Êß;”8põ#ï﹫‡Ê… P72ˆ,I'Àû}Ø×’}‘`@r§IR‰wI;‡Nª=W&ª¸3)Ò·•vò1Ú3úÔ09õæbSF†ÅÈ6›ÑÕÒÍØÌ7}Ëe¦Ü*tày¼*I8á û¿fG©¥-æ¦5´¶OêÙ¹Q.µÚÂ!æî?LS E„S,àe³d—øAL뙦yä[üùSÝ׆#¹À³R9P&z@¡ä_)[ÄàBÖTàs™²‚Dýt½b% -åë8rƒ (ˆ.A Äi®AüέX˜zòØsŽÁøü! -bï[hþI>~Û¡ˆ{?ŧØ×88ŒD€+Jb.<½å€2±äðÎ3ìXŸ‰rBU8hbŠ±—oÇÄN‰‚ç/(åú /˜jáE³æ¿NsLs*ŽÑ_ýæ¼ä n¿=U½(ñöïÏj©`^ÂE@æ¸ÌÂ4ˆsUæâB‰†(Å8Dö]-V§âÅ­XMæ¯:ðª~ïˆÍcÑ÷Ì¥¤éKÆí9á˧RÐ03̬lì È@Nò#X«H - ½0lS»&å“}6ˆvzãõÆ>¬`7O1æ’,Už:é9èl»Âñ’QÆòÄ«=½A7È!8ßÇ" ®5:óïø‰+üÕ·äæ*ðjñ Ïž§Dæ3–Á‘Õ{„ñ}½ÝÉ[>ìÈòY™Ý,~N¥>Õ6鳕:¹WIæ¾ZÈLêÌ™vM=U}2ï«>Uo\5*ð˜êŽ^`ȵµ/¨l©3•‚Onm ǪI6$qª”³y@»4¿³ªÁ‰_`Ýò ΊNÀÇ0™T¶¼à÷v§éK¬þ…]í—1·ù³÷d”¨d‡›ìäâØol¸~‹_¿“—Ë^ÉÓdÜëÎVUˆsîöíPž)½ëÀWÓˆÁµàñý÷[¾4…Í«6.!>Uzi„s|ÍY ü?cýVBendstream +5006 0 obj << +/Length 2819 +/Filter /FlateDecode +>> +stream +xÚÅYëoÛ8ÿž¿ÂØOò¢VD‘z-pÒ$}ìµI6q7»èöƒb˱PÛÊIò¦½¿þæEZ¶”´‡+p(P‹3Ãáp?5 +àŸ¥‘èl”¤±i5š­‚Ñ=p^)‘˜ˆÈ¤#órztü*ŠG*ð³ MNOøQ¦óÞ雓«éùõx¢µö”ñÇ“$I½Wcå½O”÷î9¡wrq†Æ»>Ö)².áãZ¨ï.OÿùöâõøÓôף󩳪c·Òmú×ÑÇOÁhöÿzø:KGðø*ËFë#i?2ZÆ«£›£ßœ.æ™Ïr•˜„Ÿ„a¹$Kd9}°œî-Œ&Êϲph%~ +LÎö£$îJþ:Û`?~‚mIû¡ÙÅGEøX)+„:ÿ~Î×èñøZìq0Aû0V¿:=LR?ÓᨳRÏ+ó¼9‡šÐœ›%šS‹e»äiÐÀj-ô¿eV X µaZEæWãI˜z³1ü÷ÿ#‰ùáLh ‹Ó¡=ôÃ.²Ïï%S~ ’Q¹¡Â„¶òñ~UÝánVŸp} +9&DFܿɺ¶zÒx·QŠŠlò\HÇä€b“¯ ‰âíúøg¿ýÒÛ•ÂÄ ÉŽf™×ä¬/(•ù1l(N2ߤß.í‡ÉpñL¬ªÉN×@ú…¡Ÿ)c×CÛpì‰V~ +D>Š~€‹~ö)ö_lš;Am(ëéÓ/ÄoÐÇŸÆÙP’£“ÁEꃬq”ú&yÂsÖˆj”r·‹wç7°‰Øny"\~àï7'c¥”÷û9 ROÎxÀ@ .Î~}3½¼Òô ÍH½›“÷Àz‰Î9aj¿Bæáé%Mön?4ý„Y¹„ìvœ//[ŽÔ´´e=Ãó “+ Ñê+î@wâuň!½ßÂG]ÌYk._uf–¢®]r" “5zçϪ͂!†kŠðnùÄ‚ª(e`ªP«ÛcÂ釖áêd¸PQ±Û]ëv'‰ðÏ_AÌ‹EŽÖ¯Z)\Ô´÷ÉÎ¥ø@½;"åÍ`A(ï®G!ì-bL€…¹Ìj‹M[â'ÒWåfƒm´Ö~uã')d)-Sb5¥G#ɼf{ÆÍú;÷/˜÷@ðÂgHÑ5Ï$‡ç-‹ÀºeÛt×EÃ'†·Ú4B®Ds» / &äŒÖân–5Šš¡, uâ!‚„:õîÉÌ á%Spw(q€-\¤— Ñ &ãœÃì«-ÀÌY–ôcTÅ\I\0JÖxdI±™— ½¹õ«²`Fç?§ÒZDß})6‘{YmÇŸ™Z +îíNƒ¼CµP-&ÜÅÆ„Üäµ€$„{·Àx79WNÎ3œy³Š` ûi˜õÓÙ%\ |LY+4„¯gŒBÀy{ÃWˆ'×'ïϧ„JL%Œ»0ùÏK€:ctêpx}Ž8‡_„søaqmÃ,b¸CÁ~ìÃR.¯€Àp‡Cמ#ä‘Ä@Æ Q®c1e§.ØôÃõ¨ï]I‰2¡š$Ê,–Ë„£þNÚé9ÿ<E=Á“¾éySR.¼@_f^U3Ý5%HX œ“ê ?äŒ$[àp]©. üíš+á:ð(wšúqÁÆrEüÄzýž[öÜp‡HMÊ=wô]=w˜@Ç’BÇbâ p(|ªÉe)+ô=wØs‚Ž”ŸÀö;+}Ó<;çyó¤o5Zûqœ~Gßúýçàl ç‘ŽóKÎyøj÷Ç°s8Z`ÁÍ·»3ò¿mou¦ý T?¦¿í({ºÁµBßìpÿÿÎ(5ø^÷cZ^Ì'Å=ûР#èyãêÃÄ~X‡‘g\SÀÄ×HSï=öÄqâÝÍ«1@ÓcôËK>×t"ƒÏ¶Jø-g,òŽC¢©Á¿âÉŒô|ƒ=f{§ùl騧c×hÕÕªyʧ˜AøüŽw2OÞÂ4ÈãÌš. Ì‘NNDzüÍùçó¦Â,yÜw¬¸-h¶"ÿ¸,„Wc§²ÙØ}’Ä$JÌ’r: 9c6¦Óª´—k¤\Tu[‘>8w%?'¿—X”Û†Ī͞‘·´æœœ ™ÿ(êà ŽûèW‘›kh¡êÏvK­µÙ‰mBp[îDUÒéDQ"ÑÍ‹°¸5üÊ åÍå,—bC­ˆ¹BóÖ­íÜh™JÔÌfü.)§RÏá÷ˆ¨hž·9A,íaè¤ì¿p âºjºcü‰½MÑ’Ñxö Ô‰"H‰¼†±ó)ó¤÷æ k¤¾[Ç,‘x=Ô`.ݶ%¦Í=‹>^ÆÛèNß·4qÎ9*6QØ!ÈCN·…¦tD›$òš¯„ÉôÇaÞ Ü¬”Î|frÛATÀ SÝnÙd†Ó†0Á¤)`BØK—Ä|àD~Ì:!ix·Kk™CéV=“ÈdtÛ.•ñ*`’˜2Œ˜3*ÌB’—.C©Vûí¶ƒ‹€RŽnN0HößL`lÙ¼uYD\T05ßT­ÛEÍ´½ê_Û´– % ¸Í[?l©jê˜ÿ¡»»àÚ8€äŽ–ˆs€:ÜÉw‰hÄ™_WщH~,W+þÊ÷ +i—®A;lg +m<]FMèäߢªmÏž;ñ‚çÛ«êÜ¿ØsĨÝæ’¦·Ëè€1¼ƒðu¯»7ú†õ׌I=taÄæ°R0†Úº¥1˜YÊ…H·{Xé"ën JËå¤zP˜%NÖÒîV"JŽ„_œPV.=ÉÑdë\G:eQ<™JbÀ¼%¯Ä}P³]I! †R6“oòád¿:¨#:+6eƒ¡-*êZn>8Zw¦ä÷Òw.ïèAv^6«œCY) +ç„};P4ôÈÈ·g®h~Þêñþ@ƒ{‚™‹wËCÜ4Æì*#wgŠr4‚!"‹^C¦M@¤]Lùwán$¥DŠ$—xlâWα’(<<ƈØõþåP„tÉ„ÙsÆ!.„œ™{o³Íàyü‘»fÅ„zw¶›Ð°æ6gŽ+-äðµ8Ç´U÷@vjœÅ…LÚ·{¢+Š7Rwï&Í=€DŠk>m°@á•ýÛ–tE(Ç@ÒQå’Æ®5Õ«ô%Í°~ÖI‰ hr†•|x!k‰€1'(Àê3ê*Áª˜wñ8TØð»¦,×å¿-ì!s)µk5?‹U V8§° ¥iཆÊpû€É€-|`ë2”;|^á&çöÍ¿ßQ/ûrüÞnâ×ÜaLPìbê˜}p}a.c3Š W ùÇn¿|ß.xã„Õ–ýÁáêÖ:ÌáÅU=s†õŠ¿‹|]ž‚2i%@ø³m%Ø™TéÂ’_òY't6@²äþó)z&Uû–Ó Ž³ºƒW–PfÖ`GwªNµ[°Ø`Æ"a ivå”rÿ„7F®ì6m.G >d•ðFŒ@É¢UÿY†Ï¥ˆ¸`Qçl›‚ß×r_ÚUí•|i *úeÜË9¸>P„vXpêFÕÌ~¢-FVƒÀ/ý0ŽË Œs¹zPÀQýaru–¾)º 2É~àìRAE‡ ¤ÀO\‚#ßh=ü° éñcþ–fR?{êÁ+‚[v¨œ1ôt‡G:õ£T˜ü­²×]endstream endobj -4899 0 obj << +5005 0 obj << /Type /Page -/Contents 4900 0 R -/Resources 4898 0 R +/Contents 5006 0 R +/Resources 5004 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4873 0 R ->> endobj -4901 0 obj << -/D [4899 0 R /XYZ 85.039 781.388 null] +/Parent 4991 0 R >> endobj -1134 0 obj << -/D [4899 0 R /XYZ 85.039 516.331 null] ->> endobj -4902 0 obj << -/D [4899 0 R /XYZ 85.039 494.47 null] ->> endobj -4898 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R /F56 2890 0 R >> -/ProcSet [ /PDF /Text ] +5007 0 obj << +/D [5005 0 R /XYZ 85.039 786.531 null] >> endobj -4905 0 obj << -/Length 4346 -/Filter /FlateDecode ->> -stream -xÚ­[moã6þž_‘æK`£•DR/=‡mÑ—-zÛ½nÅa¯À)¶ µ%W’7õ¿¿y#Eɲs¸‚@9"‡ÃáÌ3C:¾Žà/¾ÎM©â:ËãPåùõjw]?AËwW±PÜ ÉGóÕýÕëoS}Ga×÷c?&ÔF]߯?_ÿæýý7?ßÞ)¥‚8oï²,¾þñ͇Û8øðöë7?b“ÞÃëÏoßÝßÞÅÁÛwß1=ÒüãýûŸ°í6WÁýí¯÷?\}sïØr òôûÕÇ_£ë5ðÿÃUª"¿~†rÆ컦B£•¼o¯>\ýÝuÅmúš¿ZVq˜%æúNEažëEš8JÃÜä '…&ÒNNIäÉ)Ž“PÅɵ%BAíÛ&º‚©§Yð%>Òàx«¢ êçóŽ3&±¹öF9eEhNX:•< se&¬ à£îoï’Â>£ äG tl€ mn“<8î¸þ±í¸ðt€¶ -©úkÚßøù%?ŽøYEý€6h˜.sݬ*ð™Ú¹ŒŒ”øþÉ«|:T»¦±_aMÔŠ×.Ä•‹q šdW•Ûí¨t¬q:P´7ŸC¡‹ ±Ó©ÖL<´ü|€GF<Õ¦êªÏ`6qü+2Ñý†ÄT[ú¶Äz&µß›Š 5 r€H(CC>qÛï[Iÿ†ˆ’àßðò˦p’© °í‘æM¦ø›50šÁ‘Ëåj…ÝáëŠÇÅl¦bRâž+^è¡ÃµX׫¡íŽüMOs„ážÉY •´Hú¢9”;û¶)»ê¯ŸÃ\’8¸ßHmÙôÏný¤ºÿŸ—Õ¨{‹L±„°BƒŒ¨Åp7 o(j¥“óšI¬`°Œ:XînaEJîé¹nzRÐœyDª¨t -¹áz\m|ö›ÇxnÜ9â”…Üã@Ý.\X¯{´qS26ŽëÖê)çÀÖ‘'¶ÛoËš&G¤%«e{¢uý¯(VŽ_‘ -Ì{`z­òÖP)´ü±“4Ôõ ;yÓ³G+£H¹ö•´[˜™ël¿×Q–±.ÀÎ1™ þ‰ó‡•‚†”gW6üb…Çß Ðm0|q2ÆΘ[ÚDO\‡ ¿çâI[jÞoGŽÈî6UÏo2 ÉãûfbÙNç([ËÓ´Ôð4Ø“ «×Xõ\CÏP2×G'Ì>¯Q×°Šb™j`÷k°'%Ö¯¹_°) —:fƒkç:…ló°Èb«æô¼©W8• ëo.¥XßQÛVÃÍ(ÖŽ¼®¹Â­ør»ÁB(ƒ™ŒOÜšxÏT'a_v°#Íyÿ*4bî×ìYÛ†øøØxÉÇQ˜ñEf„dÎÌÔÃE¨´ñ™lnÈFµÝN¼Q®ÉX%Ä÷VUŠ tïY!yä'î&§¤$aªÞw[vÖKØS-é†$5º ì›7ô)Â,hÇŽ}æšüÏÑ}vtZÃÛ¶êÅŽ7øL<Ÿ ìПjk£«Ï…š:ì*ªo/G´ !;ŒïÙÄ:WÁ3ëЂ¥°#•ü¸ÙwµÛåÃÖ -熛Oy n2rƒõA8@º©·¨³­¿}.B6Y{4)àM¡ÚÎXGD¡,"ˆ‚ç®*.Ú*'0J©gb!"T˜ú‘û:ôÎÂÏþS½­žœºÀ#'2ˆŒ -®¾‘þq¬¶AzÅË/Sñ§ýp`)iØD¼«°ô©.¹°ï× ÈÀ7k/«N»%’'écϬ+î ÿ͵nÞÑtÉö•Û¦iÍ?lVk \ h-í…5A\zÆ0ÀÔ*}ú{DçM“%"+ÛYLÆNÂé©g¤šö„§< ¥/ó$4'<Í,TF}žúc#ŸOîÜ"Ørgcʵu ¸ÛÅÒÉŒŸ ÛŒî²Ëñ¦GㄇBAO˜Ú„±Iˆqˆ1 úºcL¼iÄÚÜç|$„±vß¿@ª°K¾>ÞÙ¾î¼ÎN9N¢ ‹ Ç{ŒñØL lNø„ð%/²ÿŸÒ× |ê,ÌõT²  ˜_Y–ªí´3늞lÅÅuiÒ®k¢ôgÌ K9M%[…œÜ% ÐÞs%y5 e—`ÍÈÆÜ‘CwåÓÅz8˜Ôù¦ vLa6|Ét³À:ÿPÚ|v÷£[ö žô^ÓÑÊCås@hÀ(ÏÛ'Fâ5¨­‰5¡nµ­­ÏGïçÁ»v —ÂðA"YüR7…y]ä¯ÿŸ~ÃÝxŸr[_AtXqœ ºvt´;á„ïé´ØãZ×)oÍq] Ѧ` -¥3î¹fÁY¸*X³CÇž»@ˆO‡áuæI ߊ_fSö\µk»Ê~FÁ sÅ -±+_®$ìé?; Oßlû#5fðÅc¢•$X‘{Š)à€¨„êˆix’Bq(¤‚'‚XQòc®X7F,Ê‹ºñ­q%š,>~VÔ½ƒ|X1‚䥕'‚ºíR”@1c/Fù¾* Þßô`ºQ»ôaM;FÖ+ÙÒ@ßU¿KºGÇ‚Šbî$ÄÖ 6þÅ&{̼báïJÂAϸ¨¬ÔýRÜJºå S¡lØ„E¹ ÚŠ"1/·N 8WqÔ‡),Ùzð¯Š×]×ÉE¬ÀHb±èdH×)Äd¯>b3ôÏMl·\ÁqiCA® ;ª'q‰ŸïC¥X/‚5v†nÝ-’àn ý¶ÙØF •…²½>àpXYòãD{¡Î±>llB"NO—¡+”Úgç@„¼a–¼Ò<¢ó ͱ¥Úípêè£.Ë(oíà[3&¨n2XØpåÏ Ì]½*‰F߬VUT’‡Qqy*–æd*³G^L¦2¦u´M"í¬WÊIõvWY-µ€—Ï‚c úgæ¹Dä.DäøJÒ… ¿þT`zÝcZ'ÂÝñ;E¯ûr÷P.¡'ú콞ÒóÐ :º<DNQ:™ÂðL“0ÅUùóib28ZÙJ9Õ”3+Áe3=åq½;O —çŒF¢B§/‘è‚Ñ¢™ÑX³ˆŽü&§áЉs> i"ðAÚçëÍ*HO—¹ObFÞxÈý{߆Q)Q¯<#‡it’ÄdjiNXš¶4s5hIyÐœêÞo»øÜX™'yæ -X¶Á~ìgxÁ…ìY’a¢§áÛQå„,ÝÅ ªá›zÈ@|täJÙçÛ– 6µÜà¢q(ß,Þ@j·hf7 À(vzÓó·cää㽪ÈÝüAÛ«]K9Œ¥dpãò°oßËB“ºóݽÝQ´ûå9rnsÉ¥ì{A¥_½ýéWx6{zë ûAŸuä|Ÿ5¿¼'=¢ó{ÒáŒåÊ)]úÍÛË`H‡I_æDhN8™!*3åÄåê)è\H¡Û6(S*‡UL,Ÿ;Ç÷Ó=vŠJ/ÜdûìÌIoœâMïäâI¯Gsþ?6`‹’tr‚¯åÿ½Ãö(ÿ¯9 *wîjíï"c#Íù#èX) f<ÿ¶LD[ÈžkÃ>òN¢‘ä4Ÿ#9K¤.™f’–ì¸ Meo ½–¾\ -í§KŽ“ùø|µ/fÖò‰[çšUK{j·|Ü3C z“¹ð–^ÆÃMx9I^0SþÆøW3{®(ùaÏ®Ÿ&ãgðö_z9gã]Ê„2ŸIJƒ[Ѥ³+Í–gxà±0í­;Ü¥ó£ƒ1sG|™}šÉ¥a: §/üe嚥kOÔ°x£ x‡â¡¾ÍDpÏþÚ£€£Ì¦/î]*îôä›A¤½fš¤9ŸFïd:1˜gFtòKPãWt -lâé6¸ n!8 —æ*hýZœÁ\a¼—´¯Wtm’3Ù8¨$ýM2U,¬x®….œ_v”f‰ìctN~‘²ÇàDÄžÚ I ì1ã«çÊ>íÌlCºñÐâ>ôÇž±÷Žür´EÚÞ·õxÇG{záF ʵà#NF°‡ñ§:Q|eû¢AâD(r­@HwKð¬ÞÏÀú}{)5|± í$ò`!ý -?‰‘q…KVËŠø‹ƒooÇ;ªÑ,MŸžÜÕ˜ -þÐÙl­=ÇþKô-¡¬±2æû”ÐÖUeO7ŠÂÛð2½¼Ü/, -¹å ϵ<9á¸svqã³¹Â{ýrgÜ%ëüœP¼˜v…–ÄŸúQ”ó•xiLIÝš$ “ØòB> endobj -4906 0 obj << -/D [4904 0 R /XYZ 85.039 781.388 null] +5009 0 obj << +/D [5005 0 R /XYZ 85.039 660.869 null] >> endobj -1138 0 obj << -/D [4904 0 R /XYZ 85.039 556.978 null] +5010 0 obj << +/D [5005 0 R /XYZ 351.735 483.331 null] >> endobj -4907 0 obj << -/D [4904 0 R /XYZ 85.039 535.117 null] +5011 0 obj << +/D [5005 0 R /XYZ 85.039 374.41 null] >> endobj -1142 0 obj << -/D [4904 0 R /XYZ 85.039 165.452 null] +970 0 obj << +/D [5005 0 R /XYZ 85.039 357.174 null] >> endobj -4908 0 obj << -/D [4904 0 R /XYZ 85.039 146.58 null] +5012 0 obj << +/D [5005 0 R /XYZ 85.039 312.099 null] >> endobj -4903 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +5004 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4912 0 obj << -/Length 4031 +5015 0 obj << +/Length 1838 /Filter /FlateDecode >> stream -xÚÍ\YoÜF~ׯÐ0–<½$»ye‘Å9,#‡6–7»Hò@ÍPmÎp<äXàŸºØlJœ‘Ó†`@Ó쳪úëªj²ÊÁ¡ÿ‚Ã4R¾Î“4P:MçËÿðZ~8¤ÇLºÌœ>ßœüëûؾÊüìð좟'R&Ò‡g‹ß½ç/ŽOϾûõh¦µö‚TÍ’$õžÿxüê(ð^53®tã$UYìµNÒ”!´*C¤ôš2Žåg¬)ÁBD -(?³(ò½o‹‹|Û¡°å8Å#ÅçÄ"·a \ÔGÚ'QBëûüH£šª·²á¯éøÂl¸Q7v6¬• _Ñbç î]ªªÙÅ|lT’ìçÝvÙm$b+>5ÿG¤Ð±Ð)è÷|cUÓ‚ë ª*yO0«gP0>£µ7Ö¾bVgë+*.ë¦åÒ<'¬Ð)€ÇmCËÈSÙÙòùÇWí¬\ñ<®å'½.j!ª3-`nGNÇšT}¾ä9Š ÏŒW"3 Óóm!V¬j©£‡Ú ë»v¢úUQUÎ˶ºåjÖÿy늪ëU!ë­ºõ„€y½’.·Çæô+W 1cï쪸¯ïa Nc,VõÒf+¦Q)¶‹:sŽêÏ1(\ãêb¶ðaËöSYÄsæÛŠÆ™f¢.ï"б6çÐaQ°B+h©ruÉÕÀûˆ ·*th@\ÿ5¬ð܆ÑÝÍfëÝ|¯!ü\J¿“׺ eÐpeUÂq\pçs¦»b‹ùŒOnoסÇuYU\B¹sÞ¢ûœ5u·{T./-½´¸åˆJ›;*±Ž÷t‰S‚»‡uè'°.ðôÜepþÃ@%è‡RðM6ÅÈ<:Tqh¤ÓØ, DÒ0”e3FJ¨|ÓQ²I4ïòûrdJ€çÞMY´sñ3P5g¯ 1T]EËGÅ$GPœL¬A²„ÍY4Ø‚Ó[âà ‚BþG’$½wBa@ï Ÿ¨(æ7>ÿϵ@îkFÜy§P¬òòæê§5©ýËëj½~=!Ÿ­~ûزðÛÁ34ð°:-&V8r­pš(¸ãˆQ­Öèµ™uN–OŸ®±d¼§ÍN¤M¿‹´le—N¤ìL+ß÷#Íd60þ¤5·ÍûWxÔ·7»@å¬9NÛËAª]Ѿ¶¯éT¾¶~ÝQ±Š3 (¼ -fŒ§¹”OŸŠY×&õžòý.ðþ;4{­pS¥Y{½|ÓÈiZðMªæ 8¦>¸ûÁÇ*²ß;¬Ú »~µ tÙ^Ú-ìvÐþiºŒ•Ö¬Wcìð©á_ß.dM"Šé h4°LªÀ}XQ¨‚$ø¬öÓ!d -ÌícËbÎa«â;Æ;ÁÛ@Íéj.ÉÈ5wÀÒ9´˜» 5 §Ø'3Ú¨ zÀ'3:Ua¨'³”ýšSÀg>À§iéE)‚§ÞžIø|Ì–.ôU€'4*Lâ ,]¿Ú°ÙG»…Cû—Ô:“pú˜ãÇ*„ÛÐ~à@•ÓÏkÉzB¦ÀÔ>¶,¦¶*úø-Ôæw>©ïD8ÛI”ö—À¥ƒ(¾ù½Ù‰¬Iø}ÄöLgXxÀGÒY¬t:•9s–œC{è0ä00„æùj^T5]þv#hn±nÒIªtœ>€ 4TFëO7jÎjS€gí<í_=“°ûˆß<éÈWiò€KP&>«es™àuÔ^¶,°¶XëÜ~£Á¯_¡¾zÄߤG!øZù:r\'“ÆÞ¬Äßq£âì¿ê¸oܯêj±‰“Èçñ¾,Ð:VYø€‹¥O;7•%ìלB™íãÀbÎá`s»Ô~ÓTJu_~0æ‘pIŸñä­| Ü ŸIX}ÌŽTª,yÈ‘Âca&°‚ýbSgé8=é_7“púˆ `˜EÊ$¼PÒÀ—Ÿ}Þ|!À½lYL9l±gUØXÊ.6p7@õ;,a $ Þ“' YBüEKˆÓ¼Áǘ¿ÜX‹È]‹ˆ=KÃ4†Ñi$÷ˆ]ü0 T¤pÒÂ4&û<è¬9ŠÛËAG—ƒpܯèœØ.Øž]êÝîÓrÓ0ûx«0N(c?€Ø,“~ºutV›:ûh·ÐqhÿÂЙ„Ù ¡3Üõ vìz¨UýQD±–(¹ßŽRrðã;ÇŸÍ+”à¢/ò6SÊ6 °‹*Çà9l P9(…6ÜšŸ(ÖsF1tÚO)ú/áeæ9Å1Ñ7ÿ–;ÓVÀó¢læÛ¦±‰*Ø´â߶£¤—“Á”$­gm!¾½Å£ƒÄ{é¦þȩ̀òÌIÁÄ®Ù.—ùæÅ$c¿§àõ Î:5ð‚Á̯¯ø‰Ö`Ы㟠ö\ë˜[:o-£•uYçH×e^®šv$V«*YœóíºãHuL5AìĺãÉ ¼YX:FâN¤¹æ_{†Î—Ý<b:\cìŽ$Óå’qzΉ )iÑÅŠ—µ“M².6¸[:åUSÐRŒ1ïŠ}žSäGL27Ž@ðmœcE36|zþŒƒ)/s5 5¯W#áÃq üH÷É4µÄòª”¯•×°ÞÊêŒòçÛúRÒ˜º|™a8?Ls—[.Æ· ÐBé>³"ÅŒMèÓ¦ÒÛf‹ÛÖU>/P×aس?LÛ9 -8èµ¼ ñ9ñsÎË\Äí®É`Ãηö ¡ŠÅªÿòÏØÉÁú‡ÃQz‰ñ®K JZH´7«7”8tÍ=jÒçœ_•„’»Aùf’ÌW®.Q5¥ a¦=D±¨#˜«¿k¹¼!l~¦îËŸ°J¢òâiW‹T騢 $iî’[û€‘;ðšuk¸"øRV€oð€û¼Ä”#G ;-fè í[ÐQ^ùB¼fönê.* ›÷úìÉÈÝž˜XÁÅ·ÿ<áq÷òÅH!öôaŸÂæ+Î…,Ô–¤˜°9tc¹æ¬ š³óè X#l%ÊvDYÖÖ¿I|¯ä!·œ…-[šŒe!%ô’È—¹ï^ø£XeöÕ7Ÿ[ÞOÌË´ Twý‡‹ÑAñ½ñ…þt':a4ÅÈØÑ¡ÖæmA¶öþ:”B÷sõˆ:ˇ¬ˆ!5à 9ùC#§¥ý>æbM¾ðýMDQ¨cL™¬¿Ï˜l/_¡ÃWÞìØJ‘‚¢]+õÙÆÃt l+–k¾0qJ‘¤=e*ÕÁ@P¿\°>œ×[«) -ÜúŒðk/ i<ˆ[a,¦àA‘ݼµª×O#N^„AçÍN'&º~¨ýåv|óÑr¹W°·\A; díŸÒåšò¶qž·÷}ØŸˆñXâ$˜ôáj½¥Åß­$Ù6÷•kÉR NÉ]¸‡åŠµ÷¦Þv›ÚÙr+AÿŸãô쬸ÙÐÍÉ#Vóâ†þƒ„ÒÞÖ8k4ÙçW÷¹RÉ‹s£Ø]yÝŒâ,VIÚyCmÑ´ëœ>Ù¢÷ó~ÌuŽ•U-]bIw*è&÷–«®Ý„+JÎ&zBE+ ø }×@Ó0•o%ót÷Eî‹S¼Ý‘ý¬á ecÉÏþá¯ü>ê¿â°)ÔFéÙñú6 -Áè-”;›{ï'ä¿ì¸Gð_cEendstream +xÚµXÛnÛF}×Wð‘¢ w—×¼¹²œ8ul×àIÐ"%³–H‡¤lèï;—%EIT›&) ƒ{™=sfVÒràOZ¡'YAè OKk¶8ÖfÞ¤Y12KF5¿M¯Ï<ß’ŽˆœÈšÎ[9‘#¼È·¦É'{üîäz:¹Ž´Ö¶tÅp¡}6”öùp$í‹ Î(ûäò®}3©1N]AãÆŒ^\?¿|;ü2}?˜L[­:zK­Q§oƒO_+ýß¡£Ðz¶#dY«ëiá¹Úô—ƒÛÁ­,žs-ÞÕçO‡Â õ¡¤×ãϾ>;Ò]‚5)šU¡E¾½,†#Ú³¸¦ÑG=»Èù›Õ¼ª~€m±éÄej3Ü2cqUwÿ¼,V¼¦ ­4WòÜ]–ÃHR áØÒ"°¯gW¯xÛg‹5wV1ö6ÜÉÓ41JüM`sVÅ÷K£Vñ„F»†*°+¼0pÞH¢o#r›¨»¦¹vµ©Ø+ÑlQpà"pËôæ\ÏC…Fžoÿ…Ç”˜e×ãÝåi^­ËFDK,fÇAåé‹¡´®ÙÅ®Ã9­x.ãHâxÃY†®xVe)íDv7F Ùè0¼r Á·'âe¸+3ÜENS-¡ŸërÃ{M7݆BHüÓ{¬¬1>rØ•ÍxjÙå <Œ ‡‰‡¸âÆÞmsVqD”Qÿ ‰€ŽÊqœ”ÍQwNG[B%Gr€ 2âpþãPf¾H Ù¬,g[óDoÀøå;âH±àyR8±ÿ½X€œî9^o±–‘Ýã5mr@ ·hµÚ“ÒUn … T[Pø®%¥ˆ®s Š)W‚Þ:!L k/ öºtÏJ³Ú”D>J´¾Y`±Eš—tÚ¤üÖ&x}¾’ÖijZMØQG.—>a§ô‘*~àYà5E\ûà%mÑ⺌hi¾3ÄÖrÉS€Unjˆºn33kÍ3Ì°z’Ç°ª«§=æ ¢%ŽØñLxÃsˆXad½-šPbÁß$«F=8Žïq«ÁînÕ.ZÜÁåÝÏœm*Γ†`ˆ Œ[õàÖ±]S[0 /2‘F¡] ÈÀÔµ[öL¹CLˆãÅš¸ëMèQO}d|i¦‰¿á›fDüà%uúèüÛöfê:¯äß!˜Ø`[¾ÁÚuZ5éÆ[šš¸¯×m‘Õ©cš´ÀÅŒ‚Œ`¤®Èø:åiúe Å2²Ö”ÞH<‘˜"›—ybƒ¸£òê0ú8SB¦é¸¿Í;ʾâ+wtî»Y8wµ®ÌK}ç ÆiÔ¸±6ªË£¬5?‚;,úE 5“r[ÖìR´£„RÒ’¾§þ_Ž†ó +^Ü0’–»L½ÃÒæ!—Ǧþ¡ËûmTÚ%i¹%i–n¸ÿ~Ã_³ºáë½´Ñ(t +å,/ ɯЬ“>vÓÒÕzR‰ö„Ë¿îÿ¸ÿ|îOý†¸­ˆB ~Õ_y +à$[eÐPéhÜüØx¨òßý°.”endstream endobj -4911 0 obj << +5014 0 obj << /Type /Page -/Contents 4912 0 R -/Resources 4910 0 R +/Contents 5015 0 R +/Resources 5013 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4909 0 R ->> endobj -4913 0 obj << -/D [4911 0 R /XYZ 85.039 781.388 null] ->> endobj -1146 0 obj << -/D [4911 0 R /XYZ 85.039 678.921 null] ->> endobj -4914 0 obj << -/D [4911 0 R /XYZ 85.039 657.724 null] +/Parent 4991 0 R >> endobj -4915 0 obj << -/D [4911 0 R /XYZ 85.039 545.939 null] +5016 0 obj << +/D [5014 0 R /XYZ 85.039 786.531 null] >> endobj -4910 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F56 2890 0 R /F35 2880 0 R >> +5013 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4918 0 obj << -/Length 3757 +5019 0 obj << +/Length 2207 /Filter /FlateDecode >> stream -xÚ¥koãÆñ»…{¨qpbøX¾4Àå&Òë5v€é}XI´Í„"u$eŸÓ?ßyír)Qr€âàÓ>fwvgç= /ø^æ‰ÄÅe–‡~œç—ëíEpy3ß]„±¥óÍíÅOÕeøEP\ÞÞû$¾JâËÛͯ޻ïß~¸ýö§Å2Žc/ÌýÅ2ËrïÝoo¡wsýîí8¥¼Ðýéúýíbz×ï¿cx„ùùÇâÜ"½ÛÅÇÛ.¾½µÇ²ážéÓůƒË œÿ‡‹À‹üò ÚÂôöå'*–~}qsñ/»Ï©K^5G‚$Îý$i& Â0òã0ºÌ’ÀOEDàzX,£$€N½;¡·n·[¼²n`lÃδÞ@»D€OÐØë¡dÝ ¬*<½öº®aò™gžQîµÝï=wïÚŽŸi|/½ªa¡7h\\Ùs×Á@À‚Gr£«þ™W•[ß³ ‘nÝóáóÔ«zþÕ5G/¢ À·Ê3èÓì} ¿™‡ÿç„W"JZþ¥Ã}†™]]­«ÁÜfè0¥`Åî¸éÜ6O¼5Bµxåÿ¡ºG¸NŒÐ4Ö†Îròá¡äÆž]ãvÏ -[ÛÙߎHuLzwÚvË\>@¿å¦y(ætzPlà)ÛÛ]Y?s Ê`rì¬ð"U=,+™µÌr‡ì¶¯‡Þ?%0Aêaq^ÒGâòfC¿H—ËÓB,±¨ƒt'>`NAÈཛrªæΖfÞ~Ç¿Ï‹8ä—Á^»ˆeî|èðõâ/I½w @™þÄ-Ò"ôóô¼¾r`NËjšÁ›Ôã-ÞÞ †ŒpHU(dWüÙ!ÛX±À‘ßð­VÜ~Ð=7›ð«þ¡ÜðqéÎaö¶¦›Þó4²¹ƒ‡yº{DâÜò Йy’N"„OÂNÄ⧊Ě;+BZÎ0è¾Ç3ÆY -0QAŒmT»z‹Œ¿Â>⤭q+Ðý©KË@ùYú“6îIÜ:þ–/ à/ä…“GP°hÏë֨̇hå™rkÒ^`"Øè§ÔÅA‘ë™13Òz’—ò+c”0É(Ri´ Uš>šŠP‰Ô•è¢²°!7vú=’mkàµâ˜!`€, ZãKÂnвú…ÖëžG]f µ~ïž‚ÀŸ{Ð×ØZ({ßì»u'›W²éŸNéÊO¤n:Þ©´æÌ2Y¶ßF{—+î°EPqÕÞ_%J.µfIÀC®[¡NMGÜÛÚÝñ¨8 ¯##ÓÖ®ôÊÚe4®såDn¼mñ´ ž¥ -b"üƒ´…!ĈÕ<ˆ(ö»¨·UyÕÐsƒv|B”p­4‰HÖZ~zûÎØ:9ôpk°ã0’0æ_Œp5“=AÆg‰ô;~f»;Ú“þ¡Å§ªÅ4•¼(Ýf5¾7‚ ¿ª¡Œc‡Ãcá95Ú­ºŒ#Ç‘§ï¤Êæ¤fqðŒœ‰æfÕì¼aWE4Ž{Û[áàqº°Ù à³lDÊSÜe æÔØ^˜{ªàÎÔ²ÌlT:Ž$Ç“¼áÎÚÏJ2kŸêR&Ĥ.wÛ5^èåVÉÈiø¬ÂŽo;täNVäùÀFȲqv @îypôózQY’yß ó°@„"Ø'•ÆÈ{´väPèl×k´S1,«Èãdô`äId]O–vÜsY5ô^e·?f^äך%%ÎÓQ­ÄÆ+ɸ ›‰¢o,zº”%š×Û<Äì My§I³=¼#éýaiߟ§Fƒbß -7Ò²òؾ¢÷Úÿ{(Æp¼#¥Tê5®"FE0º$…<žV…Ûa3ˆÂƒcÆ2Q[¯D}áVz%*þã·FŽ -,Åu#@¬\ÅPáˆë°G ;×Õx˜ ÃUÍÁÂZ÷snôNãCéûNã…hC‡Í°ÃÄ+¹ƒPºÓÛ’±u² ½ã_£Ä±mxàØŸ‰b#ãÏ\ý2ã¹D¥™@€.é3讜ÙT姆²b«×Ý"ALï~¼Œ^©9p(â¹B"òºa½z™.?&r?ÊÒ 1If©Ök9r AùC[oF×—Y)„Œ³Ìx[I£PW`´ÒÑ ®yCô“„Üd_F™$°æ­Qp9zcÈÉÛÒÝ5§Ãìic˜Õ ëÉ< =G9ÔÊ&Oa”+ M|y¿Þ×íŠêReÝbm&àâÃäÎ’–†‘)KÃÀ=B<ÚÜ… µÞ&ç#ç)³ØæÇ#ET‚ÁLù©,‹KL«È„¨åÑMØÊ]òØÚ°è (ウ•qré'©Hh“s.n¢„V¸ZžAÜÀ@¦3¿º÷Àîø\|2J¶~†G›²+\TYL9°Ê&‰ÉƒÝ0ìA–M A¤~™™}Ý‹éå)Ô1g4U¨$£Ùsø6Ö]Âdd%œYw¥¶×­$É„üÔÐ8™Ãü (GЊoM&8LÈlMA€¶¬¶Na¡˜UA ¡Yø6²]ÂÛXŸ^ÒÓØŒßimR9biª|#ÑGoH)ÎÛTØ„KÐ)“ŒF=Ö2&éTü*` Ì9ìÖÙØ,Óï'µÑû–œô$ròÖI4XMø ã[SýÅUV+<}râ¦ávßZWÀ~~ý ­¸<£“Ķ_5íjRþ½çW<¥ÙvRÒ¸µKU¬FÔz"Žsúçó£èÙàò‰eDÊB4"]5¨ïF®ŠÄyª•3c€õ§³­Û½Q.4ÈâŠÙBnª+0R ˆIÄH ‡XÁZÞ :*øãŒ#åsßÜ”bö»«7=4•ÍC[jªæöU`)X.Õ…A%qU™ -¼$þÖýI”’ÈdN9g0ÿ_»P -3\”Ú†MX«¬ð¸‡‰=Ñ]ä·”Ÿü LÌPn Ø*ÏD¦,²¦´:*“l,´‰M—ñhqÊÊÐÊÞÛQ -+J—Rã7·8ˆÍ6*ûä–à -þAIã ›åRR‚2Õ‰8¾Ü?p +ƒ˜Œ¶xc%_›ì8&8 `U³®÷›Ñ’s';eÕš­žb‚PI&´ bïyTÓo2–†öäQZ0']O×@P›Û/ã3“ôÀoe“]¸Á~#«4ÿ0Á°5z|pVÊñ<+¾*Qêø¶5 ÖÙ‰UÊÂ¥vðUbû–’j’`Å©N%3e/Ù¬ç ®Žq#Á$ Z*poI|ââÀXìTÌO*µŸåˆù™)FL¿Ž*²ão¸`¬ü¬·»º|cøÇ–Nä9qR2ÌE -2¤¥ q„Ó¸ðTÏh¹vOjyá‡)|1lw_›ÁǽK yà‡y8-5L°r=!-üBßÙ@%+FWâ Çp£wؘúÀ´¦Ž |rd©&ÓL²Ë0öú«×,üì4%0{·mŠ¬±¥4˜Ú…-b—æðr¼rìõœ2Çcï†þËÚ'~e— zü4N…i€ôpÅ(!n!Å‚¿ñO¹~h¹õ©”‡= “ñ÷ë¯ùwúŒ_ñ` ïDåYµ3«¢ÛÚíŽ_>‡&‡ȃõ~lmÁM½»‘Åg^çTr¡g+àØ™~¬„mÓW›²³Ÿeàv&4fƾcGd‹;V/OÙ›WhcË4çïêR¾˜J5L’ÛÛm©PCñ8Œ~BèîmöâT\šÍ•f¹(¤`S@i×âÃnR¦¹ÁšÛ™oäâÀf¿óƒ?âÿë«YûðOó³$Šü(4g¡OÓäð¼æëÚ£ÿDÂË0endstream +xÚÅYÝsã6÷_¡·“gjUI}ôž’lv7mšô6¹Ù¹i;;Š­ÄšØ’W’“Ëø!J¶•›ëÃÍNVüøiæ…ðy© BžyI’3o¹…ÞÌ|š1M±Ð$ ‡æü~öãG{, ²0óî-Ÿ, d{÷«ßý‹Ïg¿Ý_~™/8ç>Á|‘$©ÿqÎü«ù‚ù×—8ùg7°!ü/—0uS·Ðø¢G¯o/~¹ºù4ÿóþçÙå½ÕÊÑ›qŽ:}Ÿýþgè­@ÿŸgaÀ³Ô{…v°,ó¶3!y ×ýÍìnöËKÍ O­:fC ÒÿBXF†ò¨¸LBœfC‹B`£ZD=æbÝÇaIiÝ ± ƒp ¸C00S”RrrËM ÖíÐÌÅبš:Nì’8zß=„"˸"qÚ¤|¿'øñj˼5¨é9šj¶ ‡/iÊR@,Ê‚8‘^œÉ N‚î×sÔrÁYê_V9t6Å-ª¾ƒö¦ž/¢Ô_>·Šâ%ßÀè^Ó/ëꉧ}£x0_“}-« ÕsXûJ㋇¼-V8› 7/E£ÉÿeXV°`‰3›=´VÔÒì0K|ô¼@›¢‹"&£m´]Þ•uÕªH ¸±W6–`Þ-ˆdj «Õš|³1úbW‹£öÊlù¼©eõn¦IÔ›nS%ÉíÊ¥Z60.©†ã`Kêk•pm0†‹W1{ÿw8cÄ°0ñ¸,ûkÖdž̂ò”Eœ¼u/ss¥-ºé²_ÎõA2.Ý•Û=ØÍÉVºîxèrÚ™f_ôf>¼Êp³£÷J +ÎY…ÓµšC3BMô. +'ö(I<ŽBGâ [¥1ÕjðÁ´@×\h+p¼©N_t@§OSÐQé)Mú †¶ëè/ß*Ì5_ò1½ôh6¹šx5ÁQvšÉѺPßýz¨–Š.ËØ–ô‡¸kŠŽÞœŽ•¥P%u}†E£ŠÛSøˆðe5Ž&ñáМƇ!zS->ÆâÕ¨ìÈåÉ,…Á¦J> ‚"Â9ñ*è7ý’&¸@Ǿ¨õçƒ4á,‡á,mìS›ðÏZ}%ig¥CI³¿UKxÈ«¾2JyìˆÓ Yד|#æDD„v\€êñJ}-ž¢¨ßæI(xIù‚NÎ|ïfºÈTáÐpÞOÍé×#JžQ8>s#} p)II›ŸWjf­ZHñé')g{ía €NL(ãË%vtœ”êlùO]oŠÂúkL3Pk^mêìªu.'5~uÞÇ×õÌ_êEeüŽ4ùêÅ#uóͿÄ +®šÝ)•ÔÛ35ËcÇ–ÚÞË\B¢¤Ú{•wEÿnf ‡ +ÒƒÛ›S-åíÚT×M‘¯ùþ×ÏÄää|2Ãp(:£t:Ãô4ïQèüØ`øÀÕIîL"ÁP|-¤ ý¯sŽ{àP9ЋžÍþqâßAV-é2 +zñìsdí)¥µ°I¥{Rš’TQiOfúØd\|þåò_ß®o/ή¿ýzvñùêæGïÞÚ®Øb‹\Ç€q üw±oš¢ê.jоÞÜ-S[k±}WÛ¼úZ7Ïz÷8ø[ÞäÛ¢Ã_ïÂ0vÞYÿÙ·»]ÏùeÛ•Ëëzù\bÆa2‘þ—ËOß>|½Å_ͨ‚½#I1‡_vcŠÇ|¿é~2ôÁsºkö¤' +~ô +Êé×8ç%ÈÒG‹ŒÀkÌ*CP‹£±Æ’§Lù•ÿÝH£¢endstream endobj -4917 0 obj << +5018 0 obj << /Type /Page -/Contents 4918 0 R -/Resources 4916 0 R +/Contents 5019 0 R +/Resources 5017 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4909 0 R +/Parent 4991 0 R >> endobj -4919 0 obj << -/D [4917 0 R /XYZ 85.039 781.388 null] +5020 0 obj << +/D [5018 0 R /XYZ 85.039 786.531 null] >> endobj -1150 0 obj << -/D [4917 0 R /XYZ 85.039 706.019 null] +974 0 obj << +/D [5018 0 R /XYZ 85.039 232.528 null] >> endobj -4920 0 obj << -/D [4917 0 R /XYZ 85.039 684.823 null] +5021 0 obj << +/D [5018 0 R /XYZ 85.039 200.107 null] >> endobj -4916 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F14 2895 0 R /F35 2880 0 R >> +5017 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F35 2976 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4923 0 obj << -/Length 4132 -/Filter /FlateDecode ->> -stream -xÚ¥ksÛ6ò»…/s7¥n*š$ÀW:ÇI[wòÐÅîäfÚ~ %Úf+‘*IÅÉýúÛHP‚ä7™X °ûÞÂóþ…çYì*?O³ÐWYv¾Üœç0òãY(s™[0¯nÏ.~HôyøyŸßÞ뾎ÕùíêWïê§ËÅ훳¹RÊ 36OÓÌ»z{y3 ½›ë«Ë·8¤½|~¼~;›‡Þõûa~Y,>àØ,SÞíì÷ÛŸÏÞÜh  -9âô×Ù¯¿ç+Àÿç³ÀWyvþíÀaxsHù±Vò½>»9û÷°ésžå"A¬2?ÎÔ! ÂØ¢AF¾ -£ó4ü8ÐD„e³ÁsmŠz 2o '*ÚbSbw_¶Üûy'Ð]•~çÞ - b;›G)7kè[Uø÷'55ÿö%7:+û¾ª ĽàõpiD …e"è® m`·E‹¨mx Ú;€mZ%Þe=G9æ!R+§Ó5fa„%¾•_xÜe]2ƒqBí%.qñƒ²‰ûi”ž~¥´è°ëgó8Š‘zL9üøž.v]{±n–Åú¢+6wÅÅ]U_l¾Ò¬nÙV[™û­üvGD'I?Kó“2oÁ¿#Õ¾Ò‰Íï$Îü»yóHò®ëºù\ôUS#S“Ä«_Iê݉Bï®à¯"Θ®ª—%7#?:†yœøaœžÆ|„9.©‰Ò~œ³¤¾"6ÞfM‹¤¤„¤l»Š$-U€ G~ð-|f¬¤pлâf2N³%Œçuƒ8ñ’F`Òˆc#[õ¦•9Œ ·?‘دœü$»,×UÉ{HÇ~ò±øjS±¯¢Û7(öQžf4£¸æaÐ ’Ù$±È—¤~'° .ôvêwEÍBëÈO“P ·H€Í ¼%îZ¬×FMHåÀä=V£& -„MA7`H2#ØMK7x&X|Ù¬O©¥ˆ -}ù"Õ<„#¤a:¡Ø⊀¯ù-™‰–;žËš[£=øÊÝ#™B3HÈ4ö^ÑZ„N=8Xðð°¬,_rtøٚ×eÁ¥3 IÍ`#Ò3Ä„ .asZ*¢¤r‡¨n‰œ Má~s¾(QdA½Dãð>I Ž gÏ=V÷(¿@/Q…p墮:ê"ÒDGNq i'Û­4ªÍv]òBÔ|FI+¢+Çé´ïnæW.±MÁvä"¶¿q€`¤òß;ÖÔÚסQ‡¨å¦Aë¼{‹ þYÒþY¡Â·ü PÊ»*@8c–ØÎPvUeñˆQˆF6Wp˜1G -|Ä8‚D4ÓdPXmœCÄÃ@ùyj0¿YàŒ8>¼½¹q AaB*Ð5èKZq_ct` Ò¶ä§dÏx߈‹DM§Æ¡=ðiAÙÑ^îöQ|i±¢(%¬r!+¡­ÜÕKìB)ZW=.úÕÚ†DòsµBÁÎ; `ˆ`ýº|âÒuñ©Ä 8—Rÿ^/×»!hé^î;.ãpb•Aty.3·€ØuÙf‡ž –‡0=Ø\[¨NoÈ ‡ûM$OåúÅ“ýnöýU%Ì_lˆú×놘ź¥`< Á“L#váôãAœKv ~ ôåñEž]pü|AÀóÉ«¬+Ãã*mÞNR3—.JÌ -]hê“*5D m¡‡qàDÞ7Ù8ô(‰ü,-]þ¹Ÿ$êqNˆ‹='.§64ⲿŸS\¬ý~Ù¢Yi}[.¡yî” - ÇWm5 —$3øŒÝ·Å懮< Ðï²,‚DF‡ÆŽ^’-&&'‡놴<ó'ìúoA–zåàdžùAZ~âð'䩘FÐE¶Ó1fP¬Î!Ž*çÉ¢×*slïòS¾T¢ŸFl"Çœý(Ámy_š½›}þGp”}CØŠà@û -Q0Ðs üPö×D$I {äúË‹ ðß–èü®ÙµK+(ýºì÷qÕ:ñãTMqÝVsÃý•žUHE~ ‰ÿI…´€Ž+¤zF!On( -y°ŸK!íýö;ò l“ba£¶<ø–ˆ‰Ú®Dû%œÇ˜,4:N‰ðà+¤ø{oz*ô¯%j_X¢P¶ÄFZ{oèñÝüÜÜu(ÇÈ ov¼ìigßç¬= XìoŒ=ÇP+æPˆï° óú=¬(F ­”:ôó0}F)G J)@Ï)å© RîïçTJk¿¥4­qN‡–fÀ‚‰?[Ž©F‡®0μ+b@ÏÞ$™\ô¿…›\Ä‘¤#à(ÊvoÈ›«·ä߈ÙÌΈ<ÔÔ…#¯ï G‰½?Œ.{JIŽó¸¹Ä3|NðQ€žãã© ÷÷sòÑÚï|gd71ºHCÌ&õЪï„{uîûkgè& ¬ALJ‰v­Å6!0šÒǶÁî‡Géz§MÒA£à+µ¬-§M£º*ÈJßNtÌv[,»±Lk“dý€âQÕ÷Tÿg¹ÐÞÊfÒÚocÌ,­lª—•¬~h_ s×`™QV1mìҊ︺[UåáÒ´~±.˜$R0ƒïVªÂæ -£øþ±è¹õ‰Š`<¼¿Åb -NýCÿYp7ªuÛÜ—´hg -nŽ“Mî'=&ÄεH6Ä-¬‰aÒÁÑúŠ;z™²£â/rÙ(´»¾ .Z‚ÓùîƒOÕ‹ûH|¿ãJ|[L®îp.ˆ ÁLí8”½,ÞRi¶TÆ*®Å(&bà·¨M¥1ч~>‘*ÞÖ{·‰‰›5‰¦’ºJØÖ°À 2ƒŸÂgèÜ/Ë î9”×I*`E¾îÙç$dåªùò£™ -€¦û#’£\ª1ØuPéÇQ.ÇáV–Ÿgx2™Ãr²È \`k^ˆ×w¡Bÿº|0ª€#DQBh&öÔ€’,Ë[”ôªéÈ6-ûnjUØÍHé}©¢}T5ÙFÇcñãb·¦u•)„·›J¼©MÇ‹ -I«‡e{Lȃí}'…}È«‘ž‘Tµ0ðÄŸw|A4DˆÐ~aû• nݽÙÜ`Ÿ;¹×8õÐ\%ÂbO|ݶžÿYK-Øå|’Ä[&®åÍç²ýÚÔ¥û2Fãë‚{à w+×òzÜšm'Èá# óã6‰ò—{IGII‡ãÕþêü “@á,û—ý”u(­Ñï‹Îèú̇7༇`ÓqÇ©2ðÓwÜÌp; %ŠõxÇEDöí|èÑíQxW¬uÏWñ¯AŸ(¦ÀÆy[ƒ²êÁÖ+…Èc¦Ä\¥à …ðoj,ƒõo×ñ«“ÇaŽ_á‡yîk™["r§yÀ-¬X‚âaèY6”ŒìäV?Ë!¦æ¼e'W:ôÄV ͼ~°“ðÁwŽEݽtIvø©2’}MV)§0Uƒ–`˜LßW¼+6A[Ø–ãxÁ}ípiH aÅßÈ’’kÕKÉž–Yã 7Ì&U‘º:³yH#0…‰‡Ìf(„庞 0Ž9ÑòüSþ9¡5ä“*­&p —ÑKÁŠÖ•Í;©}àMi+Ó¶ã»øºçÂÅÆaéÀB®2ô*bhFÿ_®²½ò‡²Æ-—Þu÷„NñÃo2®øû(6O'çhIžxï:5 -ZÏ`ÄNø¥Ð†Ös]¸æÚ×¹ § k#`mEç+7¥óÆ(Ž}=dµXÛŒ¢ilq¬)µÒpÀ ™P‰Ã9|3 £=;¨£Á¼Q,­´FòiFËÎQÆ‹áµFÃ+´tË“ÀT-7/Ÿ¤Oàªzˆð¹FÌÝö%`Û¹nE°3Ð`m.Ô#”7ZÅó«+ÙW~X·mÁ$Þ.°Ãlúâq¼8¤Z˜1$é¹ÎD¬¦OûÁ|J01–âl?~„žƒ2O8\ï‡9¾‘Ü_DLÅc\ƒíN¬ñצì9£ýRN``× iDœ™ø©JÓŒDž<`|$€3ïubH¤íO"‹¨GÂÌoù5—S’ÈC£‰w»Wšƒ7ì+¿`‚<œ$gÛbHéšÜ Úæ©ÃdbL®b%„Û;8'íx˜HÛ&uT¢à8AYmá¥íÒ\X’[ß,æÓW:ùÑ -Ý”Zu É¿xDæò#Êuµ:rƒÊÝì‚|ú(ò Iöâ!/² !©ÿP¢úÅ”ýLÉ>šRôf)¤Ò±YÝQyµ“¬TÜ"5%#-øŸh8 -á©UÓk¶Tpl¦’:“4 ÅáS†l -¨±û–²iç-5/åýIÆÄ‹¡÷÷ß­ä_bEîá -­6Ù. dò<%—Eb ²h´£æéX³Y_1©À»«$¹Qòú®!|ÇsÔ–X‹(œòqCL~€÷·–tDB:ð³Ü(øðÆÉ¡å ~qâpO*ˆ¬wöC`ç ïÞHÅÑDD Sj=”=—Ç?Îç'TMÜ÷ScMKF¶wPñÞ»?è@hG±¢>Ci˜%õ™ÜVÈkÖ°ÄÛ“5ªc`ļu>ìR±¦ûì@¸Ðû -ÎVVuÀ™«ÉæˆËá?“òÿzl>D÷£d*w÷àNü(4¸Pæ’$ûøšGéÿ -ïo5endstream +5024 0 obj << +/Length 1731 +/Filter /FlateDecode +>> +stream +xÚµX[sÓ:~ϯȣ3CŒe[¾ðVÚ…B943Ì`ÅqOl+øBÉ¿?{‘7MZÎÎ0Ô+iwµZ}{QÄØbIÛñâq¶ôÄ8)FÎøV^„ᘖé€çå|ôü• Ʊc'ÏW½žØ±eŒçË/Öù›³óÙ§ÉÔóºýÕëâ5ÌRÇ\ ½È–‘÷ÐBñ”và‡äƒËr gÉÕ¤x°z2u¥°îÖi³N+8P<['q‘H•&H7Ú°ÕkÝæ\¤a[“”ké-Ln-]5m‰²u“%S”Î5-$ø³Épí–÷úêH‡$‰#BŽÈÚÀ¬àuV˜V+V¨K¡8ÙdìMËõ§2zŠ7Þš +tfL§/h¥DÝ °|_Zóu6!Wàõnn h‡´AŸ Zj¢v8ó’§lK‘‡ˆI-ð©aÒe¾cªÑüÍj“ói3à­4K pA*ìSØr};îã1±ç!<¸°*ìXÊ‚8¶=cÂAX.øBÂ5Þ¤ÕO:tÖT?Ñ;èSœ›•M•¥õ ;ÍY8à! ½!b…ãÚ®+ÆYLü*<ÿÍ»Ùßß!òή¾¿?;sùa†³7»ºI ¤è®Eh‹È½wáçmU¥es®Álߤ ‰Á³$­‘¾Re¡J>5Ž?ªJxïtDÐetº¡íĬsVªEž^oslð¾d(!U¼þ~ñùsð¦+-ŒüŠ#X¼HWªÍ›}0 šªM ø sн9¾gæoLhP$d_áwa Æù2Þ7(¸‘ ¤Á±1ºE•CôÁø%ÇJò,å`1bdl9^hëí½°5ܺÄÕÈB›òÔ@{¹O·÷1TU) *cbv["öP>Q&j:rÛ"g,ÈçÏ7ŽÀD±Æ9ŽjÖô \kÑ6H8À€Óì–%_!a²¥¿I¯• y*7ìš¿‰¢\ˆd®k¢è†y½O­´´T¨X±ú ¿µ.ŒqTv" ]þÑÕ¦~6ôˆd‡P +ƒ”ÛæDu)莂);¥d¬ú¯˜¡L;ݘ»aq³ÏG‡úˆï³ò*+7óu¥ÛÛõýúXl »ð›•«¬Ì0#âh±k)HnS=ušh([O…ódÀ„OŒçÁ­šÛñ¼Ø*¨Heº¤åʃÓXøà¬8¿¢Ê‡†/á fû`BQ® 7¶vÝ6)uÝ}8"% Šª”«ž1)3,³Ñí•â=i Ê%³êmWUÅVR‘æ²tœ8·Â#šjØ &¹Q£—JÓ! otù»¨Q¿5i®v¿á8ÏÇb£~ÁŸAGè›k³ +õ qYmaV²>^aôðþarE.ÄUþä¯ –à”ØM"3¥„z{¹:X«yóôw9b¸c_iLr£=¦º¨·Ü?Ìý}·Ìº¯öÍIÍ—?@˜o]>¿æY5ïdûwY]ÿ÷‹ËôË*U›Ï*;•’Ä!Ä¢ /Oþ xù¡è“ÑYÑQk(@™î§Nd ä!È)tbc´îpIñx_Ù~ÍË—isx§´§f.Uòø QÀ8¿Ø”M§ïG›Ö}Ä7D½9b,»2€ˆiÎÀéÄôù0&TZ[B—ƀȴáÐ+#V©z‘Aƒaƒ¤]BuãØúÑÒ“ˆÂåù8Ý1Äx§¹ÿ˜ÈÀ>#i:$Mp Ah-Â=1-A÷f0½À©W€€Ça{¬Çðô¯ßöü`ð +®k 7ê^Ž['ž¹h)v¡æÞÿ1ÈÍBXç9+âl·t ' ØðG¼ç9ùŒ|xpTSVŒÈ”ص8‡ "†rQž ›­q†·Ì´6šúšbY 5wåmÍ Pm }ë[ïUb3PC™8¹^“M_Ô™[NÔ‰÷Ü($=,+܃=JüÛî‰Xœ‚’ɾðøæN¿²îŠ-‚I}÷û§tÍVj„¿oIûVÃçŽ hE»©%½uÉ:Óûrʦdn¶è»Ø]Ž ú@QõâV> endobj -4926 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [297.182 492.39 447.569 505.291] -/Subtype/Link/A<> ->> endobj -4927 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [343.406 465.291 494.306 478.193] -/Subtype/Link/A<> +/Parent 5028 0 R >> endobj -4924 0 obj << -/D [4922 0 R /XYZ 85.039 781.388 null] +5025 0 obj << +/D [5023 0 R /XYZ 85.039 786.531 null] >> endobj -1154 0 obj << -/D [4922 0 R /XYZ 85.039 676.879 null] +978 0 obj << +/D [5023 0 R /XYZ 85.039 724.712 null] >> endobj -4925 0 obj << -/D [4922 0 R /XYZ 85.039 645.354 null] +5026 0 obj << +/D [5023 0 R /XYZ 85.039 692.291 null] >> endobj -1158 0 obj << -/D [4922 0 R /XYZ 85.039 231.247 null] +982 0 obj << +/D [5023 0 R /XYZ 85.039 153.609 null] >> endobj -4928 0 obj << -/D [4922 0 R /XYZ 85.039 212.981 null] +5027 0 obj << +/D [5023 0 R /XYZ 85.039 108.535 null] >> endobj -4921 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R /F14 2895 0 R >> +5022 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4931 0 obj << -/Length 3742 +5031 0 obj << +/Length 3169 /Filter /FlateDecode >> stream -xÚ¥Zmoܸþî_±°È*"õ~‡Ms×»r©{všn>È+ÙVowµ'ií¸ýó7RÔJkm D9’Ãyyf¸jÀŸZd±„ù"Í”fÙb½= w0ò㙊•¬š?]½ùs-TàçA¾¸ºøÄ~‡‹«òÚ{÷ÓÛ‹«~]®Â0ôTæ/Wišyï>¼½\*ïòý»·p(ò.àõ×÷¯–+å½ÿø#Ó#ͧ‹‹¿àØ2 ½«å—«ŸÏ~¸²Ë²Âr\Óïg×_‚E ëÿù,ðÃ<[|CôÂá?;¡þd¾¹Ãwç;t®EŠCš}”ú 9Ó÷[ Úƒ‘öÝÌñGàCÚó 5cKUZ iî§Iþ‚@¢g*D/ ô¹ @盨3ßÿ"Ðn{ƒÑcRåë礚úQ`l]ú”¥V¾VÆîZŠGëÙ†~™oÖhÊÛ"{åmhâXí9v§/I|­_8=KóÌá1ÍKg÷ÌlæèŽ&›=¹a2{p3’ᇱ‘Òaße‰g6æ4æ˜Ðe5ÈsG‡zpKd Øs Њƒ3ö¼û„Pê’{ÁÈ–›ÀµB¢î‰Œ©7Ñk ±^CˆG’¦ÖØn¹ýàٛ߿f—˜…~”ª‘Küpñ«£¸U¿öÑýùL¯?¨ˆO€QD±1³­=ñúâ7‰»øBBÅëk’úuÆÞ®ée¡ö„}·ä)6 ²yDÞ´ÿ;&¼-Öý·sÇç“¡_lL't’yeƒ/!ðmG††=¸À‡ªÅ `å'†;Ex#x#Å*‚çžá°o¬¥V°éMÒY h´ˆhS͹]N= œéÈûÞAeî (Ò¢HÚ(¾ÞàVþM».±_{k‹’P:O³V’dL ~¼¹Dq aÝ?YOƒgE9CYlÔ›õ) k4 ‚;j–Ñò 'e`:c&4ÕÞue<Ê(=Щi³='~¥´¬¥1RR›ðÐæš™ÝÛœê§nAæQúÆÀ;”üíÉ*w…Ž¿|¤ô‹5‘)M2ƒ" ÑÄ]Wßl†9)ÂàÆP¨š‡–à´ÉÖö­ÅÓ¤Œ‘SLUàœ·L¾«D|ʳ ÿDzC õl]¡¡h­aTù9z‡!'!j«”srhÁ‡I5(A fwEú˜¤˜‡'JIBl);†¡ËjMÑ^òx¶´[„´ÍƒÍ¡ÿ–(G€7 +Å*<µÃ0ñÀ‰gw8ÐÐãd¦êö°ª€;¼Fˆ½ ѽ®8ÃâÔ{èHÒ« -ÚãLPСŸg&4þ k0à'@”C¥œÝÃsš‰C'6©¼‘[§ö57¶EYq«îåƈ*`5þŠ}æda®¥Ø ?%¯Ul%Í$¢>rê®÷ì¸IJ•©Ô¸È¯-Èýf†–» ¼›#¤KQìDÖ8u#ý¯•;å2:@"RÇ1Ú>çž©ãR¶ùbkdPl‡FB.Ÿ½øC½2Ô¶*úJ Š -¢Dc\g\ Xï3x8¾v†ò¯ütò^îx¼‚8}]pÿ\…‡í¾‘È-DÉ.Æ”aĉ֨πu>“Ñ–¶65Zaür¤ ñ0Jxò£xÖ(Ao>øo!ä‡Ñ'™†ì.Qù#Çûš NLB‚á°P—•LÏÛ/pS+r(&! )×®¯å> —u/< ÑÏlu_tÝã’*ˆÊ)6¢|Úªä€ê€C8 "•ÔC–©g‘ ÌâàC¼¦änVª¡5‰_h+Qàý$xÎ|!çƒAE;áö¼s÷É°ôRª -¡ÓÞî-JÙŠºƧƒ†nLê€5AãȃvÁ}Ñ‚u Û‚.6c7Ì -ú+µÐµiHv\˜–C2†á.SÍ#øÅ’S4üS¾B2?þD²Ã±5!ùMÑÕÊW)’µd”¨h=µ@; w(Û4)—æµCЗuã0gfNRz´e Œ¬À©&‡Ä/*ò PDHhÆfM:yo9•x¢ñÄ?Û›^ô‘¥8ˆÊ Ÿ”!36êH% ¥­õ#ñ`nfD-òÜ å‚/RáxsÆYªÉÒÔj ¾ êàÓ–·ñ…+h$#CæN9›K€X“L{WF‘lA‹<n÷.cÌÝzs( D¥)ïçyì4ñÎ ^i¤¬5æÒ#£Ó S †.!rS$Ù9ù ¾[4¿m\·'æº#qn âÔF°=ÜÄR09/Ž’Ç„ÏG)æf)v=ã¢X?‚Á­B? -½ǘ€3&´ftÔ1x€è³W}ºÂÇŒ6)ÑØÀ€ûÀêØ qجñÈIˆÓ^>Ë(ˆF÷;N%||b{ -Ä´N¤?Â=ØeqÒY……ö(âR¼êI¼Âõèʆ½ ÒZˆí ÄïðZŸ˜(¾ãP;Ýõã}µãˆ„~@Or4€‚NCó¥”ëDôPÁöáD‘E8vuÈW7š/¢ý ƒAð,rCAŽPÌ“p"¯êZvÊn®]öœ,œBO”i²JF1¡œ%¨8÷ŒberEè bÆ:±aG³ôº>Åš“p vbM`-¹Z•ˆÁ‡5¢~_{&D F¢ZjIHôIÞ}èØ)#ä! -a7†<4Áê.ðÑY<÷±ÿ8J›øŽñξ8,™à°—ÅjøòûfwŽy7ßV…pú?øz‹X7ÆMqÉ.‹¥z {AIoŸÉxÆu³9Ghäd­ 2dvL ‚óÖÙc§®.etÇ3aê…GAåIf)ä3Ný’I’yÞÙ|}¤˜ôÑð YG¢”³ebÿ¿°”ÑõS¿Œ¡ÆV¿N•&à¼üX§Ï&îÍéÒ„NµMÜMi"”ÒÄ;LѸă’¥­9Å -Ú}ok˜`ý¢:µâ$÷ãüùbŠCsú:†Md,«÷t;°`K -ÖðÆÉû© ¤îæ2¾â~ŽÁÙ$)°7c9cL$™øþøÇÐ%pó5;ù'ªàxˆTÊÆñ~ G½k†Xx¿;,9? UFnR @‘®Á»ã›ÁšÐœi*éæR„6¯ö‡ºC[¿’¯G^IéEqháZÂdFÓË%GÖËÞÁ¯s‰Ó*Lç.ͼ±{ƒ}›Ž?@,ù -#¨!1U{ð)¬ØJKî\OVÆ´\ŒÃ&£ hürÉÏIHL³q-;z[œløVj§ ‚Ž™Ã-vä(QrÔ£Ù9BÚéãÚJ†àáØRÿ쥆Œ±‡RRToîÎi$p#3²ÓnMÅû¿í“UUãLéûíÌF«¯Q{¹•¡ßÜHY*² *ÜÞša×KC—FìE€ó«‹kz2FüEüÌ&<.ÄðjfÊÐ=¾WàÛDñEî^þ¥I6hçGLÍaSr×Öh=dõ­ì7Ü›Çóhé\Êä0î,_E¥ ÞTNØÝÑUà ÿ%š¤*|º“N°©áX™ÒÜdÓs?âÒ:wŠ¯ƒSàÁ8 ü!~shy×xÿi³2CÂ)<4ŽJšP"æK›ƒM ãï æÓRØCÆ(Ð}A‚:çwuE{C¯¥Î¹[0˜)T8§|ü[®¶¢ËXÖñJ(¸0F×Ú†eÈò†nØSÌW‡ª;º1QcøM9~Hìc%÷ËáèRßO!ü¯ÂÀ2¾û¾¾Û f0ŠÆß-„ãRöwàŸ4â´í i -¾à‰à“N»¾(·è§ñå®màP³»g‰`ûFh)SãÏé)… ïÁNBÒ%&Õœo”uÑowÐpù¥ÙWm_WQ±£mÐ}b«®õv‘¬î±lI³l‹'3#?ÎG¾…©×8õeô§¯|÷þ»åow?ܼ½³T9t‡qŒ4ýqóËoÁ¢ú¸ ü¸,Ðü°,ÝM’Æ~šÄÒoo>ÝüÃîÅsÉ‚W]cA~ZÄ—<Ó+hñ´¯‚îNu`¹‰ C3!…Z¢„»šö—6ðÏaKJ\YA‰Ss“kØðØ°NÑ°Ø8…›T?nëÚÐñpp/îS… tÌÅi Ì›÷³ô!Œ>Û®7‡}ྶp=IYÂõÔƒÀ;‚mÖÚù†pJµ ™spxâ½Ö]'6!Îrïí0èexàž †wy– ò¤_Ë‚Èr¾‘wb|èbu'º>6“Q@œlù²ÈàÞñĉàQ¦Ûº³Ð°øˆR±UÙL™qBÁŽÐ˜<™RaeÊ•0‚l’<í4‘!ƒFKÇ+F° D~pŽHJ];Ô¶LŸýߥ.&½†s¢,¦å©Y_¯'nÀéÉ_oÄ¿!4€Ã¼â¡V3*ê¡¡-kŒ(ð^â¡hD²1)ªÃ´×G«¿0šƒ˜*tôY {sÐÞA\8wYØó2*kkÈ»+ú[éÙû‰Vº·ýFtô¡i[£­ÇQ&ec@½&«2(º”±3î³ðd¹rT™#=Õ Ð›ã8%FtÕÑË)¢ÜD?°tÁ…D¥¸l²:*Sº/cqæÑJ£ŸP“å°H< qDü€¹ +ÜOñ‡Žs¤‹ˆµXмÞòw£»C«È.¿îÍfô£’½BF’zjZcRº…`Å=ØÔË{>p  «+c–%6øÔÉUÛ›s®'¡8 ƒ%IžÆºvƒ wñº¤ÄáS-6¾©fY'e@÷gè5–‡¼’4¼xÂÀ¦AâGIú¬…u`ÈÄ‚åŸMl„~Äv#‰òs|aùEZ<‹ÐÀ\`<1êaùq`|× ³‰)²Gé^â›)®š8Âi7úâÙ„…|*ÈL³ÁÙ쪽¤e¿iÐô(«°çZl2®x ›»g(‰@ ž:ÐÔ4œÌ¡Všº7|iEBAB*´•)D’ÆÚQ4™•ö«øó/H]!ìû7÷6šÌjÇ>·8qaq˜à¦gè ƒ ùó'^ð™´©âHB0½¿K¸AVæ7?“ìNb£ñʉ¢ øÁù•U"ìŽõpp¡çŠ2Îüx°fHrzð=š˜f•ƒ/y7ɬ¬kº³îË&0oÌwðêdbÔ[“ð;dT‘¸´ÍFD Q éÐÃø—+§uü8… .F»6îÛ–×EqÊfP8Eæ¢&èâØUéĉщ>JŒŒ£VÒ­n[mÏg +4S¤Š‚­éù[é#ÊÍô :'ÉùGµ6„h’n7nºvçt:¦Cc†å¡e:¶%&š]€«¾â†5ýHŠD¦Þ±„Bü"ÍDn¸’˜‡[¡—ÆåÌtŒo°g¦-odÜ'Ûô†ÁÇæWŸmÕ¦mj×óŸ†VçA~_sÄÃqƒFµ£~*„O‚Lòó!¼ó´M7@_³éÏ!´6ýãU›îb|Soùì¤Ö#b2wR‡¹çTOŠ0£©ÿPÉdŽîFã°4ô¾ÿç+ÔAï–7þD¥$vòí“ÙMÊüv#Ðü¼^èæ†í#)þt6FâX\ DµF +.բˉM27 ÆÜ3:K–Ü€z–”Ùll‚™°0£ŒE#¦a£é ¢Åì©F®bÈÁ`–••¼nx¯$Åyü‡g8O›.O,Õ +ÎcE·É³Ri±!Už$™\·Óƒ¨ Y<¢@–IÂ)>ï\"¬­þŠ§tܲɳ:äÀ<­Cèk:ôB«Cç¯ê‹QªIž]Žœ–I¸Yq‚þ‡­Y'ÝZ”fŒ©q §]©$Õá)r;nŸ—ÌÎðÏ…ÃI»©0ÒîÚ¥sd­”äÄ—ü+2& +\DÀ iˆ©µ²Z¸§œæú¶G%ÙhhŸ(2¸å¢\Lå„‘›%*qw”Å\Ê.FÖû!8Æʪ4LÆüáŒL #ìÒ‡mÖˆmÊ?±1YÊ»ÃtMÛ¨ü ‘œuà¢:Rõ" +ç(´ç2÷/k©°ÉV5­û€QX¡èñü'#«»e!u`Õñ]î|.‹0G¸µàDš-!´)îãЄw{-¯›c{k¬¹Ø˜9Ü˨ª·{¹Ç÷î¸qž…eD[-‹5›Q·T¶–ÝŧìA äƈtzePƒÙ’*!%¿#i-⢪lâA¤Ö—QE×´-‹HyÈÑbâ[‹—r`B’Y˜â2 ¹Y4º„(œK8a1 (‚ŠhŸltæÂâ‚]¤@CcÉϬZ…ù¬V´¥Ik £ä;‡§Tù²“Wü&Q얼ѣ›”]äe Û©Ý'µõ-èã4œUÞ­®YH>ñ{9T»—Ô±îwTß*KŠ¦qÚ¾U •\\®ÏÉá÷'+´X«‡Ë¼¢ÅûY˜ñ‘î KúYX¸ÊÅÅBJ²(#<{^¨ìnî8/vÞñ$Ý“$’”ešã‹Û[^ð_#¬m«|Wž|=…'½%[8ØÓÖ2Z ‚3×Ì÷ÏêÞX<—2œtX“Ü}Ô‚ÎnNór~ÿÃ/Y#û2ˆ#tË’˜¤–›'{ +C8çGÏG£"=‚™Êó¹ Ù² ¹†=l»Æ3õ×ÞÝÄ.De,éOÉžBËé‚ qùüÎp4ÆfN!a®°EN ->1òØ'EðÆ™Ž¢ÆTŒÄJ$n1N$%û1ü^TyÚ9²©c7† <Úe†¤‡¡v‰G‡÷T¤…îd峑šc,B¿Dtö‘ ,?)KçÅ"ôB©¸HjKå9ÀŸª5¿aÔæ ƒ»ø¼Q£ÚÕO½i„Eá‡ùó%7æÉW0Í|ÈhˆàÿpTûY,E¸ƒÔåi·1oL­žäŠ\„yš¥2²ÆÓ×$6¤¦¤8Çw¼ÑNâqò<÷ÖL¿àB'•An¿]Úáž“ØÏbþ‘0¥íö8·­Þ¨ö,ÇZýù‘Ÿßþ©hô~¤¿Ât…è)SøÍïCïã)‘¤Ñ©]³!¡Jý<*N”*ø’TÙ6Yg!âÙÀ¯ÞnÇzú+xê0cªO8¾’ˆôSŽ›Ú‘)ÎkóvgCQ¹.ù“ùò'eþ\Í=ü„r.ðŸÏòýjd.~YD×…,àBK iE–œSl~^rIòÿÔ>¦€endstream endobj -4930 0 obj << +5030 0 obj << /Type /Page -/Contents 4931 0 R -/Resources 4929 0 R +/Contents 5031 0 R +/Resources 5029 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4909 0 R +/Parent 5028 0 R >> endobj -4932 0 obj << -/D [4930 0 R /XYZ 85.039 781.388 null] +5032 0 obj << +/D [5030 0 R /XYZ 85.039 786.531 null] >> endobj -1162 0 obj << -/D [4930 0 R /XYZ 85.039 551.001 null] +986 0 obj << +/D [5030 0 R /XYZ 85.039 669.341 null] >> endobj -4933 0 obj << -/D [4930 0 R /XYZ 85.039 529.14 null] +5033 0 obj << +/D [5030 0 R /XYZ 85.039 629.177 null] >> endobj -1166 0 obj << -/D [4930 0 R /XYZ 85.039 286.527 null] +990 0 obj << +/D [5030 0 R /XYZ 85.039 215.269 null] >> endobj -4934 0 obj << -/D [4930 0 R /XYZ 85.039 262.545 null] +5034 0 obj << +/D [5030 0 R /XYZ 85.039 181.129 null] >> endobj -4929 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R /F20 2865 0 R /F56 2890 0 R /F35 2880 0 R >> +5029 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4937 0 obj << -/Length 3292 +5037 0 obj << +/Length 2311 /Filter /FlateDecode >> stream -xÚ¥ZëÛ6ÿ¾…±(PˆµI½ -hš´×-zi®»Eïæƒlkm]dq+É»ñó¢~lh‚„ÔpH ‡3?ÎŒÎøÎÒÈt6KÒÐ×i:[í®‚ÙFþq -ÇBX#žïï¯n~ŒÍ, ü,Èf÷Ã:‘o"=»_ðÞüôúýý¿ÍZk/Lýù"IRïÍ/¯ïæ¡wwûæõ/8d¼÷ðøÛí»ûù"ônßýƒù‘ç÷÷ïűyª½ûùÇûŸ¯~¸ïÅê_"d(Ó_W>³5ÈÿóUàë,=C?ðCÞ]P~d´<6eÝMû70S©ëx¶ñsøð‡GnX%~e£¾º8}ew»¢îæ‹HE޷ܼçwòÃÛ¦|êûö¹®l¾æ§×M‘Ó²ÁdÅǼÛN–»)ºÕM›ï–ùÍškÏÌZ6ö¹-òeULæŠsÌ›}ÑŠÈöÓKü±ƒœ"²­«Ãÿ±þsSv"GU¶Så|WwùzWÖ¯ø±±¶Ãn~ Çg¹P ÙÌ:ðƒ4¡U}˜/T”y+´T»ÓlÚû°”JŒw˜«é ^^ÁxKœL¨á™¸‹5/ÓÉkÇMË<ÒmóNx·BZ—2z«Î6®ó‘då% -r8šÉÇŠ¤Ç¼Eò ƒvB¶'{«±ø ÊkÙKmÍŽ ‹Ð>ö{]~fêŸAh€^É@{ ½tnË;ÿ‚ûFqâG:{wF<äs -FC?CÛ@ŸS¾Õ,Š"?Å7Œ}xµȉ¢FÃvñ¿…ã¾i÷ î.Ž½w'¬-ì|xìùQã5±ƒ÷]±êÜèåÂÖ"å'J¿¼µ‡¶NáD¶¦#? A<~µ‹©ÈxeËmÎ iÿ­’õ¿*Áy¤ ëíJ;[©ÄìóªµlØSÍóèþQ¦£uɾ £xl¯â‘ ßÛîæZÏ€¡ ·à5’Hlí-ò ÷[¾hJ—9ö‹æ 9Ù§ñÎh`Ž_b÷ ô?¨=¼è‹&6‘}ÁGL—½Ñ1 1Pïˆ1Æ@¤7¼#…ÑÝšár°h,# ™¯“øEωŒݨXùqNd$#à]¸ëO䤩v20B¦ÞJ@IöÁñˆÇdÜð `+o:…æEÁRÆã ‚jˆÖßF–ÜÉY+ÚwcwÌ2 ,ÞÝþ›{2 ¯‡ŒÝ¤8ý !÷x¾l:ñUj¾`Ó æ!LäztöíZ|DÏ—|©ñ.Ó©í‰p+Yø²pÂs"ÜÔ.~„§cáz»Ð D^ù':)‡L@ê ýsñÒÛ-ňÂuÍ O=–K -ö®y˜€4 ¼wà#„‚xb8ý“£ÓœÍÏpÉÁ…¹ 6ŸvL}Ë78[)áuLFŒíä†^Äò~²ý{‹§~»(Dæ:ˆȜæç5wÚ®$˜L#ïz×Çô¼ô5³0Ç#KM]œs8–†Ÿ÷½ŽÐu6"ú¶8«S8¯a €ã¾eÍcó ÏKƹ6 †Át•§Õç[Á²‘Ãëœ;o TÉ€'ëBœ­7ëܲ1Œkç¨ï&Äþ¯Î :¥I3™°²¤ãGiIÔ_:ÐÅ+8‰½ë·¿Þ1a)Çzý|Í$ÛpË!:r¿±µXP˜@æ­â#}®/úÌË™'ØBó‰1dŒfÈrÍä>pɼ½`••>E|ÅŸñ¶ªlS4¡p›RÉ¡hÄtŠÓ(•F¼ÁTGpç€ Uœ\Ja -§‘Û‹âω8Ó ;‹ý(H&â àƒÖ+Š•GN[9Z§ÄI¢(ÌÎ(\Z1L ;ù»F¼âõNB4ày «À8àÛ»Ó&µ ?9„³c¼×+z_Ñ2,’ E±Ÿ©) -ír„L¤)ItJÁyïÛ>ßÆœØrÛg%‚+JIæ=dR‰‰'I^’„År³¶L£Ûø§ gÂлwÊ‘šâ¯ýPØ9P:Yg±&ÓqÑmlÄ| ›T3èè⨿¿ûZÅZö}PIɬºu¡0;à•¬²H*Ìà*P8U¨)Π͆ëkLÝuâÝ>0Óø ™Â‘.EâLà‹¥8[m₇h»Ïää°ÝætÁ P¸\³õˆeÚ}òÀ~®r0 Ë\V´m÷ÊqcþR0ƒ[Mà'(€V¶}ˆ=…ùQÍ4ì03É—KŸ° _«ó¥OP”èÑpý^Z‡f°÷ût…“ -,ñc¸{b$j\­1ÆÏb= ¸‰étÞYNcB>»ÉV…c!•Q4ûkúÉ2Í<£>m`Ønnwáì­IgcaeÝÅha†·t o©ñàJô%²º—ã6)ŸÕ^ñ0±°r¦úÍ|‘Ö`FjRÍ…ÅGâHø£Ö“4ÇÞaÿžûS'À·åxA5lžÆ€X»Xw4&%›ÇÖ9 =ä{g˘ϔ8vWL¤©[a¿Ã»‰“ˆê8„Iòíã\á¦øLw¼jÇ5*.%Š‚”ÿ®¥W`Ñ`,œÛêyå뜅y çüŒ®Œ-~bÀ–òõ›ZÊhÛOÒ;•ÞÁ¹V..‹íèx˜@7UËý¼jÜð¥ë“—ªFé)§ªÁšO€™$ܤ· -â¨Ø{kwyYŸ–Ë!.êðm¶ª\ÁÈ„ o4L9ªjÖt^¡˜´•ÝØzJâã†ÎE …1Ò*´­\ÞPbÂþêŒúÕÉ-­(n|.¥­­0ôQœã#Ènøuˆ®Ä€ ôôZ*óŸ1äÜp†BÓ?mHSûÇs¶Z?• ÝL\*Ç<_ÁÍõ¼-¸Boz_¦‡ÿç¾uL¸|ÎSŒ$à£óÆ4ú^‚Ì /ŠUŠ™ÓJe·µ\ë9ó¥cØ -Ê¡¬7˜9ÈâC®Õ1µ…Œç00ôwV¦ãsâåR1UÙ± ‚®A¥†K 5ó­ðÀû›ûü±£ Ñ(~#…êÀ‚Ž (¹‹ÕZ¾ÁYSï?s@?»ÿšÂ©ÔiÍ.Y¥žIºÉ¥@ƒÒ1.¹–¨ ú»üñÔƒ(,HÒã`(%‰÷=E±Ðù}âôI"ÉpˆÔgÚ©÷aS±xÕG&L*ñ8ƒ "‘…^Zaxƒ‘ŒþÓ%ò§úm÷Ç£<öä¯=ªIí[ž·¹« Æ}”{¹3'ùªD*Ž¬íWÂ,—ˆœ¡ˆ±oÑ O-»“hÆ$!äÙl6ü(âÍló²¿Äú‰J0Zðcý…c¦ü8üB}Qx†š”³ÑÍQµè€E¥3Y[P9hxÑ™Š³ s”³e~L„!» \ý„ûtEÖ_£m‰8R_‚ƒñq™å0 ™Ým0‹œx÷tÉóW gÜ “G_Ù¸%¬ŒËg&œU3e…RšÔù6~&Ó/E“r%Üì¯]ÇzÂËUÐE ®ç›Í$[‡ï£¦ í(Š—ºÃ3U‡¹€Ÿ/ûÍ],Ä‘…ш6ð\64ááá.ê¤(É5º‰Í}W36¬w½jðähÇmûAl^’Ô±K:-[F‘ÆéXR€ŒéÒEV @üíC_‘£Ò$j•Œ±eÖA¹Ì×̸¾`†Š -ÍÂOµÏâ©´¹q%)Œø—c||ùÄû/ {”6ÇŸö|Ú7î—Cà‡g€äœ§]?“mv²ÊèsÓµðU­øO!æŠ87%jyúÈzÛþ#rCð0Ç{èü7j@úsîáïÿoý°¦ÿÎm´ŸŽ¾àOl!RÊW¡“…¾ßÇé±¼î8'ÿ B³+endstream +xÚÕYëo¤Èÿî¿í—0ÒÒ¦_<ö”D>Û{Ù[¿Ö¶´Ý<à1ò L€Y¯ÿûTu5 ÀíK¤H‘%]ÕÕõøUuuw|øãN¤™/c'Œ¦%wæ«ßYå§n9<Ëâõx~¼=8ü¨‡û,öcçö¾“ûLÇs›þêÿíèêöôzæI)]®ØÌ ÃÈý8ãÇݳS¤÷èâ_”{} +¤c$]Â˵=»<þüéâ§Ùï·?œÞvZõôæR¢Nÿ:øõwßIAÿŸ|&ãÈy‚wŸñ8vVJK¦•´ß˃›ƒ/,¢)‡f¹@ˈéHîû€ëhÍ’ʪڀ5ë&KÉM +Ÿwà ¥”{Ó”kN–0¼¤÷¼¨›¤˜g芚†Ê{zÖ8¶š‰È½›yð…½'Rš-ÍŒ†2òݲ4LsäÌ‹R“ÞmçT´F“T•²C#;tS6åtð†^Ë–Ç8J•³Xë¾£¸`Q¤£ª'À3ZûîUUÞ-É4˜„ðànò l¡Ïß|® ›%çð^Ðëù =/'@gâGiˆû5/Òr&}÷©¦_p«)ƒ!Æú5ƒ·<“Ȉ…ŠƒorXZñØ5Oá» }Þ!^–TÐÔ…AÐùdÙ¹šEÊeÄp^Vä,¤æû²Z%M^Z óľPl-ç=0–›"ER„óö+0ABf´Š ¡ZXŽëž+Zn¯Ç¾ï‹¡LtÆy>¯Êº¼oHÇÏh‹aép€h_XÕLL.d¨²ãI¡™ôµãqLåØP#æFDFøŽ¸ˆe84“kUÄ  ÕAŒ†Ù²x=ž}ÓrP‰© +TÌb¾©ÏdB0(ký’6…ÎЉm¢@uHf’»Ïu÷56[ Ü0 L6e6#ÊoÆç}¶¬AO˜7&yªG"š(¡°æ¤6ÍóæŠOÙ/ ûÁËöoy&SJGPg"Úpþù «˜n]®HÝ|ÕQn’GÄ”1P@É]ca® ξ£öfRÒdËgâ—ÚŠ3Bæe‘Ú:“›’hi‹Í¤MF”­3á£Ä²úͬ^YelaE7—0ÿJã[àK0G›.‚“srsNï ˜þNt¹⠻ϬÑêež¥j'ˆù°ïýß%­BÞX”zìÓE©eú%®b1Q”´TžkÒ–e²$Y–—*’æ`º~1!·,]=Rච— +² j RˆµHÅî‘ñTjj„?YRá¸Î’÷òqT$™ ãUêñLÖ¥°¡†ìﳺ© ./ÝU‚áÄl¥þ7D69”9&ïCoꦈb ZwRИi÷¨J¨ëƒA›úuN ˆmèp‡¼mn ÊMLÖdmº¸Ì®SÚuJ\ÈŽ}E«²;ú0ì$ ŠÖCühº2—” c¯ú\>.ÜsôKl<t£»Ö AE/½e¬·µ§²êào«ðlv½#IMÏa­À5º $Å"3&Ý8(0¢V“桬3Zªs]«EMo€›Ô˜ñgIÝP׌Ç4ïvÌ櫓u^ÓÓ´ëO¨A¨¶mtWÜa¬kñÛ¾OìüT±rL:Ýds뀉é½…$hy¹{rAgù]eÜýlç·rÖ´dY5ˆ "¯›|N¤íy!„C8‹Å‡‘]ârm!ŽÛfôã•› ´ÕMñ¬4 ‘8ô¾PQ_eã'¥F[RË-Ø‘|‘µ[bHk=Òøo¾ö­µðÊßÓèWÓФT§C³)Ñ(ÖY–ëÜ6×ÁÀÃ2êÕ 8ÂÁ$³ÑÜ¿ÇnY…·€[†ÁFhj¿òcÁ!°±nw í;«¾åó¬Y?œi_Xº@ˆ1|Ì»­È6 îØ)˜söáåØ +“ÐY¾q‰›Xá3 ?±ÙPke}ˆ)‚HÝ_‰û’ùQø‡­Á¾Ü”U²ÈÆLðÁÁê?–ûLpÍV£,Þ#j_ÊMcc/$ŠSìõîòJîÍ3ÄéåñRã¥ÕA¾–á-Ùˆ«žõ/ ²F>ddÛàôÒ¨ë‘/0vÅ›8ïõ2ŠYjGJ€}(_éÉZn¯ÇnvoÙ·r(}hšõ‡ÃÃUlÕV6/W‡¶åòá$ƒ´[šBø|˜ìnêÃû|™ååaMàú‡~~”,©×C«D2“"€tQ£HËãõ˜&;ÇLˆÀ¶—Û»z(^í2Àw[GpÆt”ó¥%}BÅÐKÊ»sŒWN)š˜"e.Nv‹»¦‰gQ'sÂJ‰Øš!Ã'š–-ª¼±]?åxÆÃ7¼¤»ÂÛ9̦wïG¶Ô ¡DµPb×ÄòB“ˆH®ò%ññ8ŽßïED p p84ÃWpÖr{=ö}œ eöpVoÖkØ'PK³ûd³l1ßÿZÏóôÏw?þ8”nŽ…ÛÔßÂî‡6:{>œóc0.ŒOÜ ´<^i¬Ûß•ÔõûŽ*k±³ïÇëÄç‚à·ÌRs¬‘apø€C$Í{øT2r¿àí]@èˆíÝqYàxaúTƒ¾QºŠEM•+Ó„ õl¿ !‚½­Àׯf<ÝI•±°ð}  }b°sœ°™‹æÑâfù·hDvÄ÷Ñ}‚¯!9SÑkX$^oË<‚Äy ‡eƃ¦;NhºD +ÔÐ_³Tp΋'~ hy¼Ó>‡’z@äÂgeý>w¤PÄñˆÒ÷û| ÏÒ0†(ä"> +ôîꘈØÙo>àY=tO¿››¤HŒÓ¶Ù8ij[¥fwpj°¹°Š$/KDè»·ˆM ‹MÚxq-¢OÁ§ô‹eŒÅRïÁw¤ †LD¯nÊ–Ûë±lÊ™o©Å§â°?ï¶Å;e´Rǽj)¤‚ t‚&-”›²åñzL# HzévDj¦¤[Ìw¬-ÿÕoP½ G÷ËZÀNÅ;eÌK ‡·?Ví«üoÚH'endstream endobj -4936 0 obj << +5036 0 obj << /Type /Page -/Contents 4937 0 R -/Resources 4935 0 R +/Contents 5037 0 R +/Resources 5035 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4909 0 R +/Parent 5028 0 R +/Annots [ 5040 0 R 5041 0 R 5043 0 R 5044 0 R 5046 0 R 5047 0 R 5048 0 R 5049 0 R 5050 0 R 5051 0 R 5052 0 R 5053 0 R ] >> endobj -4938 0 obj << -/D [4936 0 R /XYZ 85.039 781.388 null] +5040 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [409.348 675.624 539.579 687.313] +/Subtype/Link/A<> >> endobj -1170 0 obj << -/D [4936 0 R /XYZ 85.039 567.539 null] +5041 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 664.196 152.127 673.764] +/Subtype/Link/A<> >> endobj -4939 0 obj << -/D [4936 0 R /XYZ 85.039 545.678 null] +5043 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [409.348 544.521 539.579 556.211] +/Subtype/Link/A<> >> endobj -4935 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R /F74 4586 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> -/ProcSet [ /PDF /Text ] +5044 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 533.093 152.127 542.662] +/Subtype/Link/A<> >> endobj -4942 0 obj << -/Length 2940 -/Filter /FlateDecode ->> -stream -xÚ­YëoÛÈÿî¿Bp „ºF4¹Ëg?Õõ]îä5Vp)|AAK´ED"’ŠcàþøÎof—¤vŠK¡ÚÇìì¼gvè<úù£$t=ŽâÄwu’ŒæëotO;?Ÿøbb@&˜ÎNÎ^EÁÈ÷ÜÔKG³»Oè¡Í7ÎÅ/çÓÙOïÆ­µã'îxljsñæüzì;×—ço°8Sš¾»¼š'¾syõ³Àæýtú{ãD;³ñÇÙë“ŸfYÝ…DB -š>ŸÜ|ôF ¢ÿõ‰çê4=ÐØs}Ú^ŸQnh3_\Ÿü«C%{ÁHNA¨7Lô¡ üp _§ŽâÐsC/`!dÄNè9«<[%1s¹ïœþƒÆ§2žUâ,³šV²9„Ðæõï^èËɬ\Ð Hm“c`\M›/l™×¹¬2";^­hRUì<àÆ`ð=XlEk¡çsh ~"ÂËK@Ò˜øVÊÌå_™Þ|Ó¸¦O”RN[á_;íRÁøž—² ×f+ßloÇàeþ¢ØÓš„5©¼z< LOç¿¤Í p–…ÈÐÜ¿ÌeTæ–áž.ål7ô;‹Œø>äéwÏV–N0OÆÎt¢:Ž°ÆD`žÕ9™v˜*窪×$ñG~IÕV&iBFPI“6[ƒµ’ÿª´GËlmnÉtÃW±õÂë¬-¾]¢£UWC–Bæˆ §&Ø(€‚IDA  ‘¢”f°0‹ÌaÞ¶b·àQGÎÅ2ŸƒƒOƒ¹ŒYrùà죘* z-Ë<Y¯ QbÁZ6÷±èŸÙÍ>Ym[S•½œ00`hͤÚ¸ yfØî7c•:²šag¶iÍÒAv$ ÍÒú”ï°çòÎÂãî`aþ3ù+Ù'&uÅLW­ÕAObê´dÂ:&_!Øe^>ÃäþY1Ÿˆ qÉú\-dš­Cÿ-›¹9º6ˆ;Iê¹Åë[îWÕ­ñOlmê¢3ã¼rQoš¼/ÀÆÖb:¯»G»†s"þwwÓxͪÒ@to–î ÆZVoU÷ðl›wð;p…5%ÞJÀ¢m@Ë÷[Žuå½l-‰#çf3ÖžSeû×O1¡c×óâç™èaŽ¤8Ë„Ÿºç3—^khÖ©Æ™üýÆÚZT0¥‡FBÒ>ö6`¸û” ?µ„5ƒHB%ím/Ñ„¯5gÄe“î’’Óß õ‚Ì;Â7î ß‹‡6{ hÒD <²EoWœú68(òÍU‘[çPVKf¢ËkÈ߃` ¦ØÙvÁRç5S‘µbì@.ùÒ%r›EÎ{ÀqËBsEK9Áš(`ÞÀòPHÐ*å DvÈèM§„Ï“EM‚4qúäKlŒ5” …‹$˜êXT€å÷œ°¾ÊÄÒÓV0ä MŽãäŒi'Ù4în2šñê^háÉÜ9[Šïãd^ÕƳ%íW\O…‘ØRH¢Ì8¡-e•­#4l`Ð vcÎצæŠ%ÀÀŠAp¤L«Ák*,š·Û.4ðx?r®3¶£ÛLPÞUÀ·ëµ9‰É±y†K”"f7áž¹h "©5òÕŠî -È×^m û+ ímÐKã²—¶@³hè_r•Œo6UÙN`$Xìó%ðàŽVÔ³º{)µçÅs–˾͖ L?ˆË5írRä‡OþÕÒ&jÁ8…b` ¯‘)ѶJŒC‹´S``áÇbaA²sWe±î©âX -­vïþÿÍSùøœø¶1±¾ü¤l·àRäE+³®sE -æW‚dƒÐ*Ž†L^3ÃÃpÎ-EØB]M¡%BØÇß¡Fe£í0ºŠEÜʼ[ÖX Æ;Á‰#“’"ÍìÛÔƒqï݆c+p[[NŽp·#ć¢Yʨ=ÇÒÙ+=L˜¤í¹^›°*éy2ùÛd·†±«b54Þ?&“ß´úD b2È¿Ð?ø£TÃÀxAy+¯ÍÄàÿ”Òë¢z0«È«øÿšD§G¬—\^Þ˜Ò½çýÉ;Òð,MžÂ®Õù›é/ç$÷X}/ç«Í2ûÏù‡éÓ—ýz9½f`ï;ïzxž÷ô=ÓéÅÿE/Óê!¯§§û…š-°t”¸~|»±¡ÃÔ ©œ<ÖØiàzqò$>å x¼‡gb©šø1íGQW’é+ÜØR¢= ¨Â•&лü3|ŒŸ 5'Θ’ºyâéÀ©Œ«Çv¥!Uº‘Ç…õè3±š’h4à ÇÌcÏ;/œ]®õèÇŠ˜íð#x'ÄRì&Ãb7ŒÜ4ˆG¬ã®Ø èÁÆé¡^ô ^…ÎñÏo£…Ë_™#’Å øþrìØ#B' ³qÙ7¿ÈdqY5x6†…¦2¤HŒI²Ð­…ÊEÑönmÛ;uÆ üšD¤±ÛüïŠ1¢Q©vý8<ú °0“yØ8ôcM¦åw˜L&>¸1Nܘ,ïÙ Ìá;jMW© g¶îñé‘ÍÉÖ¼³!_ÛÞ„â+HIÒ%íHK*kåhk¥x¤…k®¡¸¸£e\Rur¦…5Õ2Ȥ/Çê×Lñž.q!Fkž}ÊÚú; ?ì:Ðt§óÃýIR<Ñžú†F{ g4j€¾©Ñçnì4ºã1.´ ¼pyY#.dÄÎçƒvAi -¬ÝýÖ6ü Öof±£_,ˆs5‘­nu\v¨rãw…éa˜×Z=à7Ò´(äóá G"~Ñõý¨!h]”r~G^‘ï*Ž™8Ø5P¨\_!,BƒÀߢMSxC-^€ra#§â¡s!Àû>„5cìt i¹ŠESg6Mßx&€þx· `v/³½X<Õ»åê¯Hx@jèTé7"D9Û½,Êœ_ŸÀrcÄ û Φe7Ñš Ñ]õZÛ«3ó œ™ðÚ>é!ùTÂò%¹‰Í*ôÚv¨òA€¶è ¤Š<3Fƒò Úç4ÿùÈخڃÞVûnH61HëßQ% ñS -݇”?_º K²öè©O.d©J!z¥”¢%˜¿-­ù@tÊTñ~*‘vøPÄÜv5LÏ…Ý€ÅÆ  Ûãj¦è¦îfؾâg0Z2Tr“ùŒC YÓHhžÛÖiÖQ5[±£E º&E÷Ö{ùäkåž‹u¨„S¦ûm7l¡ Å?éñL}¢í³S~¢©`þ„TÕŸš63EÜ€ÖÞÊ(7±mÏNCô¥Nb‚Í•±bí6íQEË|ß¹bÓû¥ôA)æ,+I_Ô³¡ Lì CQÐóïÚ"6…wÐ#û*oAƒ¥Æ´]A½¼§+þ(—7Gîõ=Ÿ,:6èÌg:Å…ZÝÉÚtA4zԲ߷Xly€jÍ”w€Dyçò³‰,ynŽ÷&L(–»öKÛ+cRSê¯sñ7‰ôn¼‘XeZ ëJ¾Ñ þâžÑi?1…MâmsL®^ä*ßJbŠ'.¿‚úÏ—4xÙf_û~Åž8ÓÈõ«iƒ-òšãlêüŸ€Åƒ“˜òwxViˆD*,¸/Ëß0h 9NZÿ4¡ò‰E¢<å*+ Ãn–°`š#ˬ|ÈZi#Ø@=ü‚±‹B ¿š#‹i Æ­»OVÝ]2¶ µµ‘ã=~z¬¨ôX1åŒî¿ëcy÷ Ðn¢Óãa9T$ZßÒÂ_:¢tŸ^ûQý€àÿ^ˆ×%endstream -endobj -4941 0 obj << -/Type /Page -/Contents 4942 0 R -/Resources 4940 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4945 0 R +5046 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [388.679 336.453 539.579 348.445] +/Subtype/Link/A<> >> endobj -4943 0 obj << -/D [4941 0 R /XYZ 85.039 781.388 null] +5047 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 322.904 298.441 334.896] +/Subtype/Link/A<> >> endobj -1174 0 obj << -/D [4941 0 R /XYZ 85.039 651.823 null] +5048 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [251.226 282.256 539.579 294.249] +/Subtype/Link/A<> >> endobj -4944 0 obj << -/D [4941 0 R /XYZ 85.039 629.962 null] +5049 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 269.495 160.987 279.79] +/Subtype/Link/A<> >> endobj -4940 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R /F73 3992 0 R >> -/XObject << /Im3 4327 0 R >> -/ProcSet [ /PDF /Text ] +5050 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [297.044 228.059 539.579 240.052] +/Subtype/Link/A<> >> endobj -4948 0 obj << -/Length 4128 -/Filter /FlateDecode ->> -stream -xÚ¥ZmoÜ6þî_á -TjUõÚûP¸Iš¦È%¹ÆAzHóA^im5»+WÒ:ñýú›gfHI»²SàÄK‘Cr8|8odxпð4OüÀ§Yú&ÏOWÛ“àôšZžŸ„Jq®$皟.O¾ÿ9OÃÀ/‚âôr=Ž“øqbN/«Þ“_.Þ\>ûíìÜã…¹vže¹÷äåÅÛ³Ð{ûâÉÅK4ÅÞúüíū˳óÐ{ñê¹ÐƒæÝ›7¯Ñv–ïòìãå¯'Ï.[nBb¡O|øœVÄÿ¯'oŠüô3•?¤æí 1å'±ÑïÍÉÛ“»¡¤->•^K"°çaáQò¸˜ÒÐSãÄQkì›8…˜Â0òMfIà'AÌr"Ñd$œ$.¼»~(7´æMCvÈ5É#M½§(w¨½«¹ØK}³Z”2ïÃ홡z4rçá›É,Ný"Ì_ÅHë“Éf»UD©&¯â?Ø¥vvÇ™wSžE¹w‡?5j -¯ß¯V`­îñ·_ï±ÈÍ=soÕÕåÀ˪¤ÿpSKˇێ›F‚¸²¿)Q«#S#÷ù‘ð•ÞÅ®* ¨ÜžE™w…’ß ØKYǽsš^;5C¡‘,ÎClyÁk[µ»?‚0¾Ó]94íŽ -4_’%Þs?Í¿¹Wa³Øû Âz ½É2ïüC8&K½²«¥£´S -æf*ðt/EÞa¢ÊOJ…¯–X2¾0qIò"¶éL¦“m2Qä‡ášQ)z!s ÚÔ½t›ínBRíµ«ëŠ%‚9ý0¹$ÜÆ|…†ä €­0ön!#ÙåZ¶Mˆ°M„ÚZ°Ñ ñ¸“¡÷ª2òümˆ‘]ÔiÖe'C4vÈ^~y²¡aDIM©“ñÀÛÛ|Ü+ñdJsd޻ݳtvlGH$\æ±eh2Û12v¼&¥µ¶è}}#Ÿ,úýs/‹•m¥ŠU{k™Ù°bˆ‹Š‘~çp€ÅšÄíÓ´ã±êÀ|b°õ:m•!ô³\10—à)ª\7º¯Áa*°½]€…!0™H©Á{«L\ÊÕdMå  1¡ŸÎ$Æ›–8ø¹bñRaàå¯p^?Qéê;êRˆ„åXZñ¡BS˜4ð6vSË~À©ˆBï=ƨ…ô³Õ‹ ªØ±,?ËGÕØmZíû^¤«TŽ7ƒn £„O“=DϤ%ø¿W€cíÛìD¿/`iC¼’šT¶b'?ðyÓ:*~óñ‡C­oµu‡~ž.8Ks>!½?5òa”ûi–º‘À5á3;šÑÄ„•Ç'’ãùfvÆ~’'³ùö=Ë’Ìb”æNf(¿…¶Ï½«Ÿ™Çæ¦ÝnŒÏ ›¥fíÜlÕ Œ÷dz<Â,÷“"TÀw·Ð2芬³¨7CúlIƒ~–íù¹!&™#žûî,‚Ú½Öõ{Q£–í’ìöœQ¾Iã\þ’àÆ‚¾«XXŽlbWPV•  -ôw`LÁï©“ȵϮZ6 -ý(ŒF½ñw†söËz(ð]£k»d—;§÷îՋߥôgªí>'ˆÏ^»ûçƒH'‡+K‹¯ }$zéJô5¤?6¡Eúá|‹HŸÌ×±9Ú1hwÒÿ€6Åçï^È70° Ù³„öÝîáÒ¬~”ôq–DÙ „€Ó Í¢Ó^%ù!涃ühbSH.0ZUÙ&Ó½ÇFý— .f*ŒÉ XÌqTàá ~χ¿ÝmG–úyžÍÇ«Ëï£OßÿþFDvôEC”/#†©ž¶ÔOŒ¨xXtNSoS²<*··¬DȤτMÎ9«ä–½Î+¸¸hlµQc§ ØËzÔøvÌõAÿvg‡T2Uü]¹[) güZW L‘?¹ÙêòDþSyõ¾Î‘æá`‹<ßDéˆÆ8*$Òk˜yò+¸Š­œºœª:b81kùT¼D7Œ´vèãø)’ø©uƒ«Úû2ªDŽA<×>Kj&6´•–nÝ‚ï -§\”bh•½•´8‹vJÕEàçÉ,6ü·X#ùïÏ¨ß—Û {úÖÁŽ)Fø܈CÆDì»ÎbWª$W‘)q„¤tÛ‰ÄXˆ“±*vÆÔA—ªRÞæzgmu% ƒŽ:8#¾%ئyäýt¯£Õë’ãäá;*¶íØmtnϹ‹R°"){)ëÆ¢ádC _¥õØCAL9ú¶j©Ykt(gñI˜“'¼­u.%ì]ªŸŠ»O?¯Þ½|) "ã5bÁÚŽÁKÚ÷ÃÂz'Ñ&ivà“7mw]Wô©gïKyi½j¢ÞHÔ²*7 &-¤P…þÚ4C|9›fhÀ÷ ´hÙ ‘ùv±3Éï5uf ¼ÀBA 6ŠGÀöxZ`ª˜ø¹™¹›zs+*w? ¸jÜ;ªÊþ“ضÝÿ‹FBê<â#Q!*ÁPßdÔ¨ A:*ädòQÊ8·›¦’σ#*‰¶¥ìÆžë%©cöéW¢ìqŠ~èʆBmð¶n;‰¼Ø Á®ïÄžÛ¹dž¤2Id•cT§š‰NEùí̈¡fbÄôˆZ†õ ˜¾E3¹áß0s‘OJýÐÌYÝЋ †s¶y·åŸ@*TØ蜤ÂÎ4&mwª'…33aÁ…?7y¢ÇuS¯DA/*!û¹%µóJœëáû ëKImº0,ˆ&ç,G «›‘kÊS€ÀmlîmDŠA~Ô¨'/ϼƒ$‡;+Ý2*êª_|‚ÇŽ½"=—¢&HT$è™ÈÖ­jûR~þÚ×ûZŒÁç—¨º‘ƶ¶fj/飲ŒâÜ—ûÊÛÌ|»4%و㱀£Ô'™º,î˜êd¢R$@AÏrœ°¥Ö(f¿ˆeñ€úýFsÔ¦PÑKîÔ`ø®íTBa8Ȧšt;qÍÊëÚzþI0ˆ 7ÆŸ+ÉÃl¤iÌ[ØœŽ²POë»fÅnib½ õ×Ùå0ØT Ê¹ èTñ¾Ün4yá±Î£¨®t¼äßÄ‘$ Ý©S01ÔªAÀ#îi<"u¢Ò1LÓKOÍù?‡å Õc[_=pX(áíäþ¡ÝpXIM·ôåS%»ºivÒAuшã›M¤ÿ´zgwðÁ®B)k”%;NsJ³ÍÒa²€—2ê¬Õ\òÐŽåõbË&+áô}ÉfÃ˹4²±ÆSâ·À}a;›IòyA-¦\ -Ô‡(øëx’0óÃÌ:ÿ MHûŽ= ù);XéÜ(²Ç{%ê‰ r]ÆåU»4}>‰§ø4³èkY¦;n«6ªáCQnZxß`õõnÉwnÓãôaw_,Œ‰ü8Ÿç"X&Ýu}¨Åª­æ€É‹JÈ5¶Ž£1—/‡W ~ÌÁŠoΙŠ}€³Àû79âtÅMÝÕ8HñxœMl\ê^’±úqäTëõ,ð XŠ*[ -‹à~·“,ŠY^täè¸8MÓAö=VCLvÕ¸X5o!ÌtßL<»Qp‘R˪Uµµ -’îÁkƒ(‹ý8 O¦NˆN¦Z¢¯$SP“©Gó-%S§ó ëC¾AÀ{“‡‹oÔ:¦¦së„åÖ=æÄßùþV(7 ÔŠ$ j¾ÇßpDšxß½¿”OÍ"¿È¬#ðb׈]–íÕLDëÇxac¨¯ˆ¹ã@òLf³¢2â÷RýêR Äÿûö †í§#éÒ;y½c£^T•º\á(¿½ãûØÅdü“ÎDªrÆã —WA'*ñãÞm°¨‚vP‘E/ƒT[Þ÷Àæ³î÷.áºÖ°í¸Ö•¥®øõÈ'zI:PF ×¹†raÌ~‹ËÖ+:@Ã~ñO1¹[Z}‘¾ æ±®ó $œ”‘Ÿ1©Æ>öM‡\*ève ù¶ki1i’vL}£ý[ù]ˆP½˜N7ñ|ÀÓôRßÎ/,Ý]ªy¶{r·cÈ?‡C;LÂÑ1%h³+G{z©q;ð%O5=?Êa~­MžæL3ÿlr0„2°àó“õH3Ý÷7å…dÝäiàB¶‰:¸M/¯d"¾û™¤Å0çA6IÐLÈÜ<ærãÊCÆî¢K.ăÞÛ €{¼‘O^ÅEyzðd0Ês¼ºsw&«¾:és -ÉüÈ/CÜ@û?õçÐ'°A¹Ó÷eƒ^7SU)OùZDÙnP (Ë5‡Þb/Ú‚+?P”.F‡ -Çé]ªäPpëj¢R4hÙé,c’‹¹ÔèúŽ0’:û³ɲ Z©²÷ÑšSÀÇ [¥&©TÍZ-gÀi -ØÆnäoi1 -ó…ƒeS€^¿gÅ}êLú½@ÝŒöRk8W‡ÁäòK\:í®™8hÑKˆA ¥ãà™ÐµòâaV<ôfâCÃYyÌ)TãäÇ˪4üÛl”\cñÍ ¢½M-¶\ƒ²ÑVI8YMs˜þƒƒ&˜t¿nfÏ ©š5ÆAvÇLž`†¸ä’ë¯åûh²!ÑâCú/kü¿ÞR»;íØø¹yàµKE~Z^øæ> ù%g’œtsÌðÿ`FEendstream -endobj -4947 0 obj << -/Type /Page -/Contents 4948 0 R -/Resources 4946 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4945 0 R +5051 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 215.298 206.805 225.594] +/Subtype/Link/A<> >> endobj -4949 0 obj << -/D [4947 0 R /XYZ 85.039 781.388 null] +5052 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [325.68 173.862 539.579 185.855] +/Subtype/Link/A<> >> endobj -1178 0 obj << -/D [4947 0 R /XYZ 85.039 761.463 null] +5053 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 160.313 235.441 171.397] +/Subtype/Link/A<> >> endobj -4950 0 obj << -/D [4947 0 R /XYZ 85.039 736.114 null] +5038 0 obj << +/D [5036 0 R /XYZ 85.039 786.531 null] >> endobj -1182 0 obj << -/D [4947 0 R /XYZ 85.039 553.141 null] +994 0 obj << +/D [5036 0 R /XYZ 85.039 738.261 null] >> endobj -4951 0 obj << -/D [4947 0 R /XYZ 85.039 532.55 null] +5039 0 obj << +/D [5036 0 R /XYZ 85.039 703.515 null] >> endobj -4946 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R /F56 2890 0 R /F35 2880 0 R >> +998 0 obj << +/D [5036 0 R /XYZ 85.039 649.927 null] +>> endobj +5042 0 obj << +/D [5036 0 R /XYZ 85.039 613.06 null] +>> endobj +1002 0 obj << +/D [5036 0 R /XYZ 85.039 517.65 null] +>> endobj +5045 0 obj << +/D [5036 0 R /XYZ 85.039 472.576 null] +>> endobj +5035 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F38 2997 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4954 0 obj << -/Length 4108 -/Filter /FlateDecode ->> -stream -xÚ­Z{ÛÆÿÿ>Å!ma*°h-àøâä‚Ô¹Úç:…k´DIÄQ¤BR¾»~úÎcwIJ”œ¸µ¹;»;;;ßÌR\ð_\&¡¨ô2N„¯’är±½.×Ðóý…0sC2Ð|{{ñìe¤/Eà§Azy»êç }ªËÛå{ïÅÏon¿{=›+¥<‘ø³y'Þ‹Ÿž¿™ ïÍõ‹ç?a—önàõõõ«ÛÙ\xׯ¾gz¤y{só3öÍåÝÎ>ÜþxñÝ­cË-,¤ÈÓ¯ï?—KàÿÇ‹ÀWiryÏ/ {{Lù¡Væ½¼xsñw7÷éK5%K1©ŸÊð¼˜"áëH91Iè~†(&!¤¯„¼ŒÃÀMrÑÄ>ìS‚„Â0ðÞä]WTkC{WMñ)oZ~YÕ3%¼†_ò‡¢í -gIoš¢êí}Ñmø©ÙÁ¯ð@º(q@Ž’®ºSÕ‰/âôü{Ú£ªàö(Sn‚=Þn`Q™Ä^‹kç ü[WÀË’›ïg2ñ²™Œ½Gnè ¯ÆÇÄ£=¶]V–ܵk ¡¨pl—Û–Ôö ÛHnQÕLô~8ò¸1pÑ’d:ÃÁÆŠjË ûÿò¼<˜>ÍÂÈËÊâ`3 ld ¢› ÔÅV$ÿˆÔ¸¾,ëÊ<­šzËOÝ&g yûêúnZ`p”UKn(iG9¨ŽÖÚ#B¾‹–GâfSäR—,$iÍRõ~Æú„ :¡0FØHÇÕå»öχÚâN9³Ó&aiæ¢ }‘¡éÈÍD6á­§´/Ôùå˜ä3«©Ô“p´Ú:ë»±&¥•äÐ jó£Ö O.öê}7¢’^C3ü -´û¢±.¹o‰’¶ÊMÿ -„.ó–W°zˆlei§X°?൸‡ŒÆwõ|BÙÖ90×|sêð¢XùRÄço@túð,.*OÞÙåÌá_ÍÞpµe¾ãã ]-Pq…0¶#äÈ3Ðùr¿“ÒÎMà›±Ê{»¦÷$è5¦Ýd˜YøÔ°¹É !ížõeY ºˆ®pÆ(PÂ`¸“¶ø$å” ùȾ…,-˜wŽ -´Fêg/Ãh 4­ü(a -Úng EÀªDôÆ6uM”ÒìãéIìÈÏhˆ£9£ LƒKê“úqf-«ç–²ÚÑ/5VŽ # üHE_¨:•öˆawŒ’[ƒ º#pêìA¨±SÓ6ï~ÓÙKØ°ž>{ÒVS>«7¬„Å fšcé»Y¢=Ç%b6ä’Wøî2±4KëCîeE™›n·tŬjƒQòls˜­×«‘ÐgšyÛŽ^w3u1-4YXUÙaí¬lýá:k²5rží6ÖÍú'`s˜€ B}6h\jp›ÃXû‘ŒRÉN½ëe^uÅêÑ$³#x¹bó)79ÂK 9æNðKÈBΧ3šÓP? 5P †ú˜®a(cŠ²h7x¬qĈ Û‡ -;8ZÇ8¾ŸÃ!¡ö)4&èÑîyô†°¶ ñ8†üæ=ªŠa¤FU芺 ;Á6€‚×ûÒX¼ 03¯ÙíÌòÛ/®ø÷~S,°}c—"3"äÙ°±cØ„a¨á·!æ0°UN#ôÞtè‹––¡ÞþÕðldø1dlË_ûEµš0xNB÷!Þ‰™««ƒÓyœ\‘“gI­ÌïŒÁ>¶Æ5¤ @3Ÿš7”UŽy[2€‘’–0ñØÑØÐ UÝñ« r¦†-x˜@M49r3(ªÅxHbÄAFGKC²-ÖârbEb¬°žæ]#ï"õÞVSà{E ¯Ûãn3>F”î#ò¦"ÏúTP¸GnéõŽqçØCÇ.#“¸£´yí@0ôd Ý[uyÅ-‡3iëPvÇ €ìÅæ%Ç’K¿žoÖ¡{¯›­]‰ÍÒ¥ØÈSg¹Í::²€'Û“#’V£àa F¼.´mà ¤büà‡y•mÝY!ò¾wù'Ïn¬ž Séφ욺Ñ,ü–j -íɆ¿8¹£mÆŠnb‹ùC×äìÊG[˜Qª’!'Ùqìd½‚ÄØ…pŽØšÆA™ÂüDfòWŸˆ¬÷ÉÐYå¹ÆY YEà -L÷cð¥®q|[‹õ°üH«QE(¾£zZ]AŒÐ2r§N:h|Ècn¤qFcyáߌG½£c]²j¶ÜÐ0gÈ>sb£_—T»òÀÇ#Ìð5»-à³ S W£zÃMrQ‘Àja{8w †ÚàC+uüëRÎÜYu®|ÂAZüÄ£ÝÊ yL†_Õ]nÜ$¡¶¬c—6P“°ÇpùÈá…½•í¬GÃ148—ÈÂZREÌxXvL–ÕW°·yPéRùÊFÐæÝÈãòÍ5žž?¶Év¿3Ñ­é8TêT ÆVtzý˜9É0ðÖµsÐC’ÐFÛ7ßs§ Ùð¸É3ãl¯-ï”ü%‰¸q¼!è$Û)]8 %¥/ÐAr[3;5‡}¾–ñ·Â¦¸”.°«_ À¹Í2›W¼#­â»ƒgòžŸýrcJ¥GGà H!µõŒSþå9ª¬y’ñ±~,¹m¥ÛØú4· –¶”¶ÀS¯)Wü)ÿÀÂóÁA#OhÉIA¡ÓþÚ†UlÓc“|6ÀÐâI¬ÍÂ+ -Þ[Cg€ì”×ÁÙ'-ÃÆQ²¢’AM馩9áÍ›®ÈÛ©´Ra¡èU‘á±Ô¨¦B“©O¯ ]&ú=º{œFÏ®…™¨!í²³B̘´JL¬À•J>ÈúŽ_ÉÀo_ï Y_ZW¼39¦ÐG‡FŒD|Á)e¶5þˆÅ 9r`åËÎ Cƒú讣ŠÆd½ïQ,¼R.µ‚Ë”<⢭*\³ÄÖ­3 {îÉoâÛJ‚pY¾«<Í椄RÌÈF¨ƒÜ8ŽÀHÔ—Œy˜ŒŒNS¾Â*@cá'%ª¡6QRÔ´­`=Eÿõe¹ñ “¡-Á\eg0}pfzû©Ð¿{úu…Ç¿¶Ó—ý¾Ç܇~E¿{ú\²°s+äÓµ£0µÜÓŽªKxÉÖÊGçíÀø_ò·›HüÄÎeÃ)àÉת¥}òðH± YžòB¤¾¤œaÐ{;5ÄÌ*1kykK››•6'¶6tÿC׫[ãðÅØ¿À‡ÄFaNâË$I б¹”‰½½; HC0¥ÌQ4£û¾®³ƒ:Ê/˜Òäº9›ßÐ5ÇpºÊ¯çN"åç˜;ctÀyÍ gÞmú˜0¿¿îT¼³"Æî>¤àEš`Õ·8´ó•%<8dVöy±é¢pÕm̈Âü"BC|ÛçËãÐŽÑD®Œ*å«P|iýÞ…½= -¶(m‘>ÑÏ6¾Þó 12A˜~©ÐsÌJŠµ>yÝýv‰†*´Sö~’ZGAêa§?¿k*ë[Þ×X.ÎÔ*ÏÞ€g–zú -P ¹mñ ‚9aµT½ŒF²P~XY¨)ÏA$°q¾ò’¡q,bïºâ¥\l•!ùÀÞ-¸+^©MØ…mÊîó§ì‰(ðCw/rûöõ·?–Uµˆ})ørŸŽ?ÿU -(¢'¿I™Û¹æƒÉø³›Ñµ8s 0–Y|,; Ê - ‹…”ó›*ʪ^Ù(‘ø*I§¢y÷‘· O(,7/ø—@àª{ÀÈÂ,2W!ŠÍm-ôS©63$ÿfÌØFØèqºZ}ÛÚ#¥`Gýe¶ë(R¹8ð¾E’ÛwäWIUp²ë ³ÉÐéÀæþ´½N†‡%ÕgÆNO -ÉB8»E'¤¥ýŽQe°ÿHm”ˆüTÃ!ZHuú[Ô†ðî”ÚعæƒÉŽëöŠðXêV4jC[¹ß ÁÒXÛ,öªên™Ï?]»AO^"j1Ô7+ ¤"en ¤­ƒ>1QB‚Œ=ÌOœ÷ ƒ}@‰CöZc`§%ô±N`va«Ø}Í?™% l¼¹c_àsÅÇ&ÖHÈÞW*—Ü‚óï+3M5! .1u%wúk¢ìŠO“.YúIðeÉÁà$Ú¡PRþ‘`.5 -‡²/ÿ¢£ M!‚¿c0i4®í‡Pø2¹ÕáªìY‘süÃ7âB †øÌð.ƼÇn×òóÊ×.>ï쩲ov<-ì»ëlápìª>:4ØG"Â#e,¶]j¶fêÁÖ-2e´Ç%ÄH¹#=ŠÍ]†L8yÇß2_Ñwe‚ܶdü3¨1$üšèc’+7‘VmÎcøƒ¶þKðþ=ªÊ–ÃÄPâ½DxR7<½»8À9ÈõšyûÂÞj’‘Ÿ„Ñ—j«Û]âu‘'ÑÉDdt›Iƒ”Vßæ‹)­TË vT3þ…w¬çÆê@¾‹=_î)Ž<U³_(óAÓHq̧öÚP >àˆµ7ìÈ8ÌÁük¾úÂ[£Hƒ–ؼ'6`7V÷§ýX¥3Y{Š‡…sx[¶ðÝOšû:5AßW"c“À/Wârs÷ Ö³h -Òò–ß-]¶ïê­¡²ùtó]Ë+_îmzL)ï8üâDxWÓPÍ*2ÕýaÆ ‘8ø”>~•½ø#1®Ü˜+üyo¯jSµÆÌ5’À(g?ƒÚ!Ò×}£™•@¶f’´Ô}-¾±·½ÇîÑõ/ÙäÃòq»ËùÁÇ ûR¶½á6¾;7&ª-ù{Í -ðZ– -dÁuÝý%‚1/è.¢ã×ùÛ'WYu—ýéþ=1m þ}b2*ÜÀûW?äÅ2/?æÍš®Šu±ÍÚΤBü„˜ðæ b°¯¸A™¹ Kÿ›a+~+ žw|o¼]2á_øçÿÉ‚=ûAÊß½À¶FȉX[Æ߇$ú0¡±æ£k³ð€«kú\”Ö ³¸Ô!Dx¨ÿ},è¶ ÉÞË©ù‡S¾”n‰¿dÏN|¢ N~ï\Nþ§Ïëݧ$Zù‰:HC) ‘2/ôíK,ù U⇉:fø¿j·#endstream +5056 0 obj << +/Length 2572 +/Filter /FlateDecode +>> +stream +xÚ…YYoä6~Ÿ_á D Lk$Rç¾9N&q°Y‹E6j5íV¬–z%j<þ÷[)õå…Ô$‹Åb_ÑñMñM‘†‘.oò" SßÔûÑÍ3¬üü!Š$Õaš$ðûÂâÚ­®3FI~‘FÎXç* “"Aš?|ú¬¢…Y¦oŸœ ©âæqûG§áj¦QðÅÔÓЬâ [­ãàyµÖY|©ö›jõçã¯~zôgy. M|ñ:ÑÍZéPçú]Q³´3],E“P'ÙRT‡qž8Qc6)ƒ‡Î=ˆÛ©¶Mß]“Q¶¿+ÆLCbÄéM…eT.ÄHKª\‘»f„£Ó4½5Óþ,¼KÕ†î*£’]ÿäË™ò•ÇŠrÜ, Q‹h0^‰fËS|sþ½…ß“(& +º.8»'* +îñwC‡<1ÕO~ϳžŒ°ëe½âá†nZ^/‚]?Ì‘Gqð‹H8VÍö#Z( +nAEŸò–#àºG:•xI<)ÊAl½ŸxðŠ²à"èœ&È(}>þÊ“{§žhvoü},-> á÷§ìl…*·¼ç•Ž^(=3ú~Þò¯G'†Š& (w±>M‚¹Z¯l4ŽÜøöß«Bã=A c¥¤!ˆ½ŽÌñÌ~É>­@†ïn/xçPgwjö™¾óÞ3·¦àñäúðã¯Éû4O´(þ ò Š”•YÙ¿ƒÈE8‰‰½ÜrË#N.IðÒõ¸ýUNrl­m]ÒIƒJÌ2É©sBJƒqÚ`Mþ2µ[Χ§‰¦²—¼jç×à¹|mz¹¥wÜ÷£å_è×ZKÓUÖoü»qjÁ4“©9ÍÀ>ŸZìmxÇFþ€œ>ué™Fa,bpŽáXmhCM’Õ“ó ¦É]%Ü0ù K‹ÑygÎÖŸx®–—ÎÇKk¶,³žC ôÏ»¦FÜ7H’ÜWα`aBv-\¦H/^QX¿+âLsµÐkø¦Q.…žëS¢%ZÑÜ`dÔ’Àì0­P’k«#;Âôh(þ1 + 茹êæPµ#ÓRÉ›8F´¤O9°ßŒ¾¨Í~ºeVTáÛÛ¹øÑ ¹:|_·F–*‘Ïû¡ñ÷8÷aE(+` “ûmJ­åH ë•Ìwqw¬RI‰ ÁÌ &BýbzË—ÀÈáÏšÁ‹±$:lr¡(Å$tðñ4aXwä?ŧ¡Âhfl’J‚/…¸È²›³‡¿ÀÀÊ.èD²³àÁ"…gçÊ×”ùÈcöo\Àý{ á þF+rv<»}:/|ìåÚ©jØ7ë0# ¤3N¸0=¤æ[ƒ¡ï§ôÞáU˜‡É±¾XNæu¨.Ñü% e :ÓÁˆðT ÌŽ€jž8à9²·-¥8¹N³?´Î²ë Jß/ ™D;ÉiíìˆtsÐòaè-%`N˜¨”v±Sðæ–I<Áê9•z$ÿö…¿ÿ"˜°åÚ'\ÅëZrÅIá@¯Ê@ü¦wöcÜì+߈1+*‰2ª 9LøTA ja"—%艬½çÁ O:Òùxäá}›ð›Ñ))'ÜrÆQÖ§’­Yp‘ß®bU- pî`àCЭr—u†Çüu5”Œ93bØwÎHjFmÀàÓç´XäùR…e–W†*äu6«« Á¡© [€’©å4?kënÆýæI‰#EVŠ¤IJ#ìf ‹Xÿ~ä¹¥»Ÿ¸¶o¤ZŠ8E`¦ö0¨ëÛþY´âpFÁØ‚$–Pß²ä(ˆ¸}Lƒ[[ˆ~À\À~8ÞbšÊ"êh0¡6‚.x„›,¬¬f+N×3ˆuÁ9ñÜ2 +Ês碿¦ƒ<ÿÄ Á3èŸRE±0•"SÁ”ùV£þÀìâríS©8Œ¢Tû#t-ÈWlƒWÚòý^lSè¦$ú–ª“$Ì”:Rhß¡oxí”RŠ*$a,*YÝHZ xã6V¶œÔ»½¯ÉÖ02l¼o0%)‰»‹«+,>H#ò‘™¼è—Çp•›xÞ,s*¹Ãþÿ (hHÆ]5Ì,Ð_ðëÓÎØOC-‹›j”›œ§t°!Ch²#tõ耑0yFt ¸ÿR¥âL¯Jüñð;l¸Gš¿ýÉkÕdûµïP+†/‹=÷L¬Ix™&EÁw½¶5øc3Hno°¢#!¦ñipÚtØW*ú& JŒ»V{áÖÕI2Ò SmlFé¨Ñ½Ç›~‚ûò«Êyæ¦Ä4^ w]ïcÂ\ÙØ]ï=Ç•À†ß€`ÉȤJž-º’|ò0˜K¥p'ttz +á6—Õa‚²\î +­µ>wÂYwµøùÈã{yZú–7Ó +Oùv¼ v‚ÊeÉïbð½#¾5ÓSñ‹N˜Ñ? aÔËVrE¤'W’½0¹ô6ÃtŒÎ,‘ÒFdî»hA'G¤2àÞœž2·¾Â" +®}F6­ùxáÂ?6> kÛoGT_| £3z5»v æœ6¨Þ·×:Å8Â8}¿S\Ð\íc…¹8/tŠZ:ÅÇU‰µëØ&þØŒ5Æ!‹Š ë3µŽäKðýÀŸ©móÕðø7ìc0xÝ5Îâ3™k½¦îÝKÎ4W{ÍB…Eé[MŒ-ï>o<8æÀY¼”*Ô ð¨DHH!gü¹ËÇßOUm³• 虳·âóU\bR3€¶ãù?s¡8ÃÜ”‹þѵ,‰ZÊ‹âÜÕRÊd‰.=#m{y`ÅÈ–pƒRÿBp‡2±Ìlßèý¸—î‡;vè`3˜EsS§æ¿èÆ=4¥EüÓ¿åøÐ>ºÖ½r#~Ê ws.éê–Å¿¥"%iùÌ„O=ÁyMÛú+Ý&[÷¢e >µVY²jœ{í‘)f„ƒ×é—:O4¯kvÝý ÎM¸Ö-ž|ñHJŸðü:ãÿzM9¸ÚPûSp%ÅII²ß¶!š§N¾o‡Óvþ ÐÒÖ·+ñ¨Ó0ÑGÿjº–3éyTêð§òì(õdÙ险.´Ðïú?]¨Íåendstream endobj -4953 0 obj << +5055 0 obj << /Type /Page -/Contents 4954 0 R -/Resources 4952 0 R +/Contents 5056 0 R +/Resources 5054 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4945 0 R +/Parent 5028 0 R >> endobj -4955 0 obj << -/D [4953 0 R /XYZ 85.039 781.388 null] +5057 0 obj << +/D [5055 0 R /XYZ 85.039 786.531 null] >> endobj -1186 0 obj << -/D [4953 0 R /XYZ 85.039 761.463 null] +1006 0 obj << +/D [5055 0 R /XYZ 85.039 766.606 null] >> endobj -4956 0 obj << -/D [4953 0 R /XYZ 85.039 741.134 null] +3089 0 obj << +/D [5055 0 R /XYZ 85.039 658.638 null] >> endobj -4957 0 obj << -/D [4953 0 R /XYZ 85.039 711.743 null] +1010 0 obj << +/D [5055 0 R /XYZ 85.039 658.638 null] >> endobj -4958 0 obj << -/D [4953 0 R /XYZ 85.039 684.645 null] +5058 0 obj << +/D [5055 0 R /XYZ 85.039 620.371 null] >> endobj -4959 0 obj << -/D [4953 0 R /XYZ 85.039 656.94 null] +1014 0 obj << +/D [5055 0 R /XYZ 85.039 452.769 null] >> endobj -4960 0 obj << -/D [4953 0 R /XYZ 85.039 630.448 null] +5059 0 obj << +/D [5055 0 R /XYZ 85.039 412.605 null] >> endobj -1190 0 obj << -/D [4953 0 R /XYZ 85.039 586.054 null] +1018 0 obj << +/D [5055 0 R /XYZ 85.039 150.159 null] >> endobj -4961 0 obj << -/D [4953 0 R /XYZ 85.039 565.459 null] +5060 0 obj << +/D [5055 0 R /XYZ 85.039 109.996 null] >> endobj -4952 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R /F11 2898 0 R >> +5054 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4964 0 obj << -/Length 2325 +5063 0 obj << +/Length 2441 /Filter /FlateDecode >> stream -xÚÅYëo›Xÿž¿ÂŠFZ,Å„ûà5ß²I:ñ4q³»™U[ˆÁ6*pÿ÷{Œc:©íDUÊ}œ{^÷<~`1pàŸ®í¨pàÂVA0˜­ŽœÁv~;†bdHFšONßxz ;tÂÁt¾ããÚÚUƒiüÑ:¿:»^¾Ž”R–ìáÈ÷ëüúìn(¬»ñùÙ5nië¦ïÇ“ép$¬ñä7¦Gš··ïpo(k:ü<ýýèrÚªÕ -BÔéëÑÇÏÎ ý?rlƒ';¶€íÕ(e»Z™yvtwôŸ–ïéŸês«Û Ô¡”ÛñðB Òßul×Ñ䄳r¶LëdVoÊä×áÈ•®õñ>Íãâ©âÚÏçÀûŒ6‚À‘@}B:Q¦IÉ$·Q½lxœÿúI(}?žL¦8¸ÛVu²RÇÕº(2\¼ÿ÷òý*ùGàáˆH®.&ã;Gü'öÅõu¯Ü¨Žæi–ü yq¼ -ÅŒ®×ñž@—ƒ¥ÈçéâJd ?ü…‰WI¶þ9¯®o[Ò·ˆ*òi²Nò8Ék”ZýxÏ~ë*²ØñdÜs¡?SêÛ››4-sã¨~ ±³×'ó×»,“8¦Pêc¿Š±ÙúÄþY&‹½Jõ³Es<Û<Ûq–ýÃRÑÍ“é›ýªÌRoŠ<­‹2Vm'èWnm²²?ª·ë}ÒÓ7¢‹FÚ³•hA+ÛSÿ‚˜b3i7°VÑPúÖ–'yQ§³ä&¡cÕ˨ÆåЪù,ÓŠ'q ³ôq(+A˜TòÑedö¿np¿Nxñã!…Ås<ºYáÿC°~M1g#¤Ó1B90”˜ŒõH¿læXpG8{úä 7Õã?°C@B|ø“ã:créH…Žoϳ_rг@<!áãM®H¯ÎpU¤H…KÊZòÁ€O$]ÿ”*sjå[g1*Nð˜gUuå‹$ÛmÑšÏîNzü €94~(‘:–P™ÒÚz“fCTòÐ ®k»~hN¦[^«£Å"‰Ų̀êQ"¶ôÜ^Ø­^ØUvkåíP»êe^ˆBa¸Ù¶ œÀQ^àYÅã0ùSëJ4.3ÛW]ŵp[2-´ù¿`§æÙ2­ÇÎþ¶eiHªÍzH1ëtÛf}^`\¢[–æhUŒðÜ,Ê2t.Ýý'Úá•YÌ0ÐÅéˆ=clíÆ qÒs¦Äp¥•æM´Õ ¤¹¢˜=ã:Ž5%¦Sc­0çÌʦ2`& ÅÀ¤-oÒYYTżæ)‡2Þ“ìÐ= ƒÓ›KÞ\£ -Q Ä«Êî)Fã9ج=÷8öù."Jôšwë‚wÀÑkJú¢lvÚ(d½ñÖ}½Ç.OÈÕšSÃpÚs†¡0ìpüÒ×W¾`Ë2iRÚH847Šcªoi‘ƒ ¢eô\h€ -LÔà7cåIíï0t[5‘œÕä—N_:ŽsúÇ-Ÿ™eiÂ^¬°„0yaüJžÀ…È°A½òxW‡È’C nÏA¯¿$°%?„~΢œQV<¢òV™ŒÁ…Öƒá3óPÇ,6´¹,x†…JÅaaRØJ4RNš–éÚ¡çïyj)¢ éz98ˆL›ã•$éú§úÖ‡É9¨ç”¡”Bò9¹aÅ»=WŽË—°ðLµ©(±ý÷¡‘è[¦È|1цKˆf{Zc+!×Q³iJÅsO¾tCšIT \{JM áÞ¬ùI¡Å{Õ†aOœRÑç@MgËÇÎ1*æ¼ÐænúÔLÀM!mX+¶áP¿ØgΠ?7YÆLצ¿°’ÊäHDÌflYÅ_Åv%zÅDOM×g¦Š€\ÐîÇ8á4ä8Ês&ÙÿVåt(À¼‹w÷wWïî¦=ܼöñÁÏ} Î[C¶Ö¿ôpPšðð_sqwÊ@K?d"ÓI×ö¥¿^|ËûåçF!$¤¦H–þ•òðz?8b¸Ú–Òû&:å1¹ÿ‚ϨÑj$m @ëÍwI_‚ÆvˆUîZø¶èPj—˜Q +päºo*“ <¦4ò|ÛÑa¨˜¦3&v†ÑÂéx%h:ØS–ùŽ:ŒIYtÓõìPû)[jþ’¼¢*ÔàN)1ƒ¹!ž‘œ“ô¡´â95|ÞSÎ`•‰¹?W|žÛRDX#bCý¢äᢦƒã ˆé¨'§«Ú T†•”â®Ú•«cìªRÙ$û¬nmÝ2Qs%‘áKE -žDKyL@U˜{t¹e…þ°OãëfH|ð³ó/¸_²xujq–æü|é%DLjhs÷Þ€ÍWÊ êŸ§ùbŸÍ[V/o Ïz|ySP‰‹Àù‹ÞÝ£nïF³%Ýä¢ÕXc O×5 –i–ð´f"ölše<å·Ln8' }ÝÀŽ¤GÑ·lrÇx% wú#brö¢ç„NçLZÓ»>ŽR³kðhóж½˜IÚ÷ ßé`BÇ:‹WiŽ õ¤…w¼‘£E5ˆîÑ}µSR«p4G:½8¯iLX·ÈÖ!^ðõÓDLÍóðy«0Ä7û’gô b¼@Óöc” Î(“êÛÈ€ . %9–›gºÈ1÷pqÞ€ò’çèaú€/s £ò’\¹6­”1)d(ŒÄ½î iżŒyÎR ¾ 9Ï{ -Ć÷Ž`EéƒÄAëѾ°](Žÿ-û’Nâ¹ïìcøMúø³˜²5ô—?Á›þ]¿Ðµ¿Aje*ÜuŽ½þ-¥-=+hìjáË—Îl~Éc¢ŽÂÿúeB -endstream +xÚ¥ÛnãÆõÝ_¡7SÅšËápx P vºI4É6V›}K”̘"U’Z¯ÿ¾ç6äȦÅb¡á™3gÎý2V‹þ©EnÂH‹,OC£Õb½¿ˆ;ØùþB Æ• \y87«‹÷ß™t¡¢°ˆŠÅj;Ò)¢Ðébµù|ûë«¿,¯´Ö2áò*Ëòàn©‚ßþúËíOßóÎÝõ7×ËÏ«.>¬ÆK=¶”Öxå.>}Ž`(ÔE¾x‚uª¢Xì/£C“hù®/î.þ5Òâ½dÁ§æ$4:M®_‹¨ÌŒˆÆ„i’‘ˆídÈ¢ j@ªmÛííPµ ÀÒ"è—W*xî‡r‹á§å[Û½ÃUTƒŒIÕÏ ´ ²CÙ1È]9Tû’wï—Wq”xËζ]é˶)ùÈ~VH¾fÀï‘Jðº >/ãœéO¶iØ~€»Á> «+…ª,Hö/G¤Ô”½‡EUƒ püy™'AxÎœqf*~ÛË&2A »*,ŒñLE¨5{8–þeLüÚ#7Ím²¤ipoûrÃÀÃRGA×嚬5ÏkZda¤ÞŽ笻¤©ŸŒ‰×[p8NÀž 늾ª¦l][T5ðÓ#ÔqãÅî—`aT³åM¶ +¯w]i‡²³á‘á¶;2¤ÐZ|Aˆ³ŸðV{új#ÄÈZ´¬ìV{>¸A¿{­)ÉØOÈÐQÁ#h?‰òàæyÆS6åÖ’³ )’ <ÉÅ3kÄa»FȺ<È‘uÛ £’Ldµžá[¼eÓÝu¨UÜAËcˆ<¡>ª5^øÀ÷±LÖQ¬ÜƒRnyéTAºcà Û"²CJ/×GÐõL|P4u½ :Ì ‰Qdظ=ÕBƒ¢ÙwqEµò‰7(TW’¢TÝ3ÃOUE?¦;´ò‹®ƒ¨·ä†ZÆcŒ²A+|a¢¡Pö¸Ã”{Ö81±ñg¹¢&üÐáÅDãý,Œ$QÁz—"á6*sÏ—;Z¤(ÀÅ„ö9Cäª,•×d[ ¤@;º ÿB´àYrÏ–ýž! *6Ê|¬MéBi¶‡)¨éNør\=Ì9ÍzDÎqQ$,/CB°ë–¡°BAÖîØAÅçÒ… ŽZÁO” O´ UXœˆ`×k—¸Fy‡Ä :•²¯fض£ÐC:’ø®„¡5£u¶Ù k`Þ×â“"1•$&¸n¸?(¿Úý¡f“h°éQæÝy/c‰o~CDMXd984FM„ùü©òWiQÐ្Ï"Ušcm‰Ãè}œ02‚±ÜÀŽfð1}ã"kÌMÓ…xlÃÏûˆ¨\MŒgR2V«ZéÀr™'¾¿H¡FøSEÕ\Å^ç¾áóîÇ^U³‘ÔÁîÓ35, lTø¸dE¡b׶F¡.™È<ïÀ»é®FîhÇðØ{9ƒŒ­á´4A©É•ô‰“z™±¯ìú“jñ·~œŽ“Ö õcü\LÑÞžÖ”,TŠ=ù·±T)‹I½|lFM–Ò$ÊHüÂ%‰64¯"j綺Êée:VZy\Ÿñ$ü²û@µcp¬¬NR2m¹Æ ¶G€Œï¿3¹ƒ6‹Áò(ìvýØ2ÖIÅE¥FÚο܈c‰¾ÇWô×SsJ,qzÂŒ8[ÿ,‰oφÜÑ°r<Ìðœ‚ubÇr¿¿'/@xÍxCs õ\Œó,Lÿ$¿x8g`œÆaœ˜“¨g'mÊí;îÖbödHæ€ ‘[Õ3<›",Þ~˜PÎfÄ8†¬qhÝà„ eÞ@ñûõL À“×8ï<È©3A\Pë¿<ò\_py–¡ŠÛîSh¾X[å9”ö&8¾Ðô ç‹Ô‹9“¯…3ioÅ„3(ßü,àxǨ-ïŒe#Î`¢±~Ÿ‰h–±nïþþ¯¨3id—(XaëãG^¿V1ÔèW‚©ÌΣ>MO±¼"žZŽ?¹âÄ«bØ>3jAÖ¤ Ç4* ”¸±9m{©5ÕG7œ¬\Ö¤‰Ä"#Ïœ„Çæ6NªÍ“˺ø1Õh8B®Á®3ÌMÅÿ^æzD¦iœüžÆÜÉã¤ë].–¬œ³pÁã°…¥?¡’œøå<¢é•A(Äþì$n¼;7tUÒ²º,¾åú$ß+mPÂÿ«º+ÚtÔÇŠ{™1!sôpï˦“!p…üô®Ù¿³TžJ€P Œ¡ì—u-ËWNFûX"âXFj\ÕU?`Û‚»îa áoŒZˆJ¯=€VyàD=ˆò„5är¿+&@?Ønp-Ñé‘Ë1†Ð‚—3zíã›X!cJQ 1"¬õ*ñŽ«w\ïh? +&?:Lщ0™Ûý׌Öœœ|†ËšºgÀº¬ÛKR’ˆcLP»—Õ9…ñ„ãv´ø!£ðZªÙÇIï kLµ9'8×ìè.vqãç;Þ˜&|Xœþpc ÍñórBP¸?¦9@±üXq2Ê#üÖQ@påboÚï™­äÔ0¾éÂú&¼È£¥ðl±³³‡AZŠ:pê?ÙF¨¯¯ç: mÂDÏNVðŸIþ_­™ÆŸ<,ò3µÞÄЖ¨‘êNÒì%ÇîÏ:¯Yþ/iæ„„endstream endobj -4963 0 obj << +5062 0 obj << /Type /Page -/Contents 4964 0 R -/Resources 4962 0 R +/Contents 5063 0 R +/Resources 5061 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4945 0 R ->> endobj -4965 0 obj << -/D [4963 0 R /XYZ 85.039 781.388 null] +/Parent 5028 0 R >> endobj -4962 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> -/ProcSet [ /PDF /Text ] +5064 0 obj << +/D [5062 0 R /XYZ 85.039 786.531 null] >> endobj -4968 0 obj << -/Length 3219 -/Filter /FlateDecode ->> -stream -xÚ¥ZmsÛ6þî_áëõÆt¦‚€¯íd:Nœ4î%Ž/v.¹I=Z¤mN$Q%©8¾ûó·o )‹rÛi2±A`±v»Ï.¢÷}ø«÷“Pù6Ý­l’ìÏ{þþ Œü´§…b"$“ͳ‹½éË(Ø×¾Jýtÿâºçª ´ûù'ïù«£³‹ï'ÖZO'êplj÷üõÑù¡öÎOž½Æ¡À;ƒÏw'§‡íœþÄôHóþìì-Ž&Ö»8¼¼øyïÅE·­nAØBŠ{úmïÓ¥¿ŸÃþÞó•M“ý;hûJÃðb6¥ÂÀÊ÷|ï|ï_+ öyÖ˜ÅD§*5áãbŠ´ -"Û‰Éø1im”Õf?}úÉ D+8§Qd©÷¼šÏ¡£˜µåòäÅ^{[pã¸.¿5·_–DÖð×u]-°yw|(—yuhµw‡¢mx춫æµÒõiuh}¯.—í·—<óü6Ãy5Ò»$Ä*ŽãÇeÑÓ,t8& “rÈâ´:4 î×ú1ü‚vÁí%”¶“cGäµÿž¬ŠŽ´Øâᵇr™ !Iy åaJ§Cú_|ÌI†–,7I»…æÔ‘}¦1áäv»>W‡ðã~D<9äPHp rpy(p{Ûr Rƒa¹ÐÉï‚­7ðæ¥ÓFKfqÃÁÅ„ÃE^’Ù`mÇ–³ùšn¾°@±.‹«Ú™Gö¹aÊëªæF]dyv…tó²¥;ø=oÔ7:‘‚KP>„QÜo]UíßÁ盌á -l X¶ü9^¼÷ìí¯Ϧ+ôÌ¿h|ËC“÷ÇÙòsö¯ðç¶ä‡¾‡ãtåt¬tb6D8™ñăYÎÖ|L¢©ùaA>»^?ù5/Ô“ÃI”ÀgÇnÓboó'«•0y•»ü•/žähdÌíôÉÑú«:~ýú€ØL@±&Þà•åy!¬à|E}Í -ù\=±éB¤V‘ÏW3¸Àƒ~†<°\dÍç§ð©øŸQþÈΪä ÿZUMÙB$ÙBZ¿­ÉÙa³.šUµld€£+¶Ü|•pÇ/ €ÝCz¸›6s\-²rùôÓñ‹¿xýöìÍ‹Ó‹K¦{þô…í»†;B¥e輨!ð?6¾/K¿>:åÆ›l™Ýõ嘜¶¯ËyÑë-Õ3ªZá¡·j±àÐⵛΪkÀsn„;±qˆxàúºXí‘Y2ƒ-D˜ \ÇæˆbÎæ܇¡µ¬²„ý[€xŠݦÞ° ð‚|›œ}(œn£º¢¨0¿G¸x€©°%CixԙõHÕÞf­k‰´-2 ÂnìPè¦øÖð|°Žb€pñ0ÈJ¤¸`ÐæXVnb$\A ë„mMëH]è]e–†M¬JÐâ¨Á¿¶T@rj -§Ù¬føfc‹à€A,´™bQNØBæÕÒ…sTC„Þ™Jð‘Á¬(MºÉÔP¦È1#Í52„à“ø|-:CiðE¹Ü¾Ó¼ÅßÖ=xtúdlP-^8HÒáˆEÕJ×Â&Œå@·w‚NšN`›9‹E!¡½€@„@Ièàn‚κ­å‰_qV8g7~(‰!Ä°m¾Ç$éd€®ŠÌÿ¦pI– ÒaŒ\ñVèê¸AF–¡Ü HœÓå“QÆO&èÓƒ9öNö4ðy4«gx6r­¨vȦ˪õ\Rr¿°(\Pb±,D»®«ÓûŠUÕ"Cºi8M“éÇ3îè…Üè ½w¬Õb ‰ ‹·ƒƒB»÷ZðÑAIG¡Iû¤«š1wwv X×nbæ   ÙŽ[ cïà HtêOñ+êzEÚag‰Rã½]ÎdŽCøئ•pªÜœÕÜí´-¾Ã|h“œò!$¯×”mƒ}“¤*ðCqäB“ N=¥äÚÇc­ÖcRšª$ú I¼Qª¬¯7󮶻7CP%W™uIÁ†’ú«ÜÏ9ç$ 5ž‰ ÝÚñR0ã] -I‚©Þ‚“n³Î/¨õ¸ÔúÑzË€fwí R0ÂP{²R{:&уù[)•­dÔڻḠ-˜tA–è7jRª‚éjA?™¤¢DüZl}{¹ë°&Rad?lO³»¸dýDE)ûêó -ïa˜’“fW‹ßAR±Í7 -ÂãME>ò†»éq×­ô9C€þaq©æáÞxžv\†3ûªH*s‡%TŒŸ€Y°‡Á5øÚµHBøfhzzòkbs{Ë­Vrô ?zį[Øx²bÉLò¶ìËaÐk6Ë^\»gúRæ‰O®™ž*bºCRD‘Í›Š[›` 72ƒ4»øñµ”5o4/»‹4ƒk^¢üMI Ãv(åè$·GˆŒ¸‹šHô´Ÿs=R˜ #+1B»¹?äZRâ¹µºØc®Q±l0«b²f½’©hP:ñ·á‡$)f¸}æ^žÖè;2¢ŠN·ÖÀ€«†[õ ×F »È`¶1¡ñS¥ãT\ì´hgÓ&[\eÓœ@3‰pËœï8 ; 1 sªQnâ£ù -uQ<ºŽUšnâËæ¶þàN—]îÄv¬¼~ÿÐÝ87a åžcîÆ‘Lzv7ÃçmÀÍÄ‘ãƒ{‚½Ç[ËÙ@iûèjL±µØ†HmªÂ$.Öa)¸Xã•ÐÍÏ,¢®`·TýBð‘T‰j_®&š2|4Q_‚å ûÐH î>b$R}â©ÑFýÏÍêöŠÝmâ=té &«÷EËÙ+övÁ‰}k"æ oÌ7ì:¡&ï0–ÇheùÛN I¤ÇFz¢GŒDˆ~ÏJ[ЙÉÃõFíd°J`ÐÕò ¶±¤Ä†’toEØŸ†ˆì‚ÈK™„f‚7@þ‚›»,%0××úG-ÐG›G,…0ë˜Æð])MdæÿÆL Ї2Y7Çí‰ÀÉ–=ùßpcÍ#Æ„EH;´&ØD¢UDv Årí×½ çå„Œ\žÔçÍfJ7&ã^¼ÎºìøzXm!ßûÿœ¢DTœ—-$*d3‡_9ú4‚Dö[¶täõgÊü35î‘EÐì¼&H°3“MšXr:ªÉâ—¼½Í% -@_À–ˆþõI3fDW ƒy!®Ä\ïÇ1,Øt¥dÀiË’ úÍXöBæå¼Üï=R„FÅ]ªã²ïFòi‡ÔrSºb -\‘ôA9 WwÛà±îßÝW#y. U’8²Á62zq& x¯;‘‰µ€30‘vè™\… ‚þu.ôl;@ÏØí`'4%ùBÆaÁ ÍB‚at¡Ñlä´&ÖàÿœøÏÁkà̦ï©tp,>Ž•&(cìv©®L$…“SÈsÏÎÄ­PJx7ÿ¿ôœ½yv4yþþì|ì­gº§êÍùAÞ5Ö݃ÎéɹïÊÀ?ô¥f®ùh@š°!‡næ ‚¼Zå;¿ï9€#v½N{õúl‹ëfÙúsL;9=ÙÅõŸoÞ”KákuøçøæYûØnyxc·c ­¯L:Êá¯ÿ—þ K—V%6Ç! +£Ý^(ýíÃýBxÐ`·7üΦÃ`endstream -endobj -4967 0 obj << -/Type /Page -/Contents 4968 0 R -/Resources 4966 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4945 0 R +1022 0 obj << +/D [5062 0 R /XYZ 85.039 724.712 null] >> endobj -4969 0 obj << -/D [4967 0 R /XYZ 85.039 781.388 null] +5065 0 obj << +/D [5062 0 R /XYZ 85.039 689.966 null] >> endobj -1194 0 obj << -/D [4967 0 R /XYZ 85.039 761.463 null] +1026 0 obj << +/D [5062 0 R /XYZ 85.039 447.943 null] >> endobj -4970 0 obj << -/D [4967 0 R /XYZ 85.039 740.731 null] +5066 0 obj << +/D [5062 0 R /XYZ 85.039 411.076 null] >> endobj -1198 0 obj << -/D [4967 0 R /XYZ 85.039 340.111 null] +1030 0 obj << +/D [5062 0 R /XYZ 85.039 287.621 null] >> endobj -4971 0 obj << -/D [4967 0 R /XYZ 85.039 319.516 null] +5067 0 obj << +/D [5062 0 R /XYZ 85.039 252.875 null] >> endobj -4966 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R /F66 3242 0 R >> +5061 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4974 0 obj << -/Length 2224 +5070 0 obj << +/Length 2393 /Filter /FlateDecode >> stream -xÚíY[OãH~çWd{gÕŽ´)êæ+˜¦éffÔ#1­‘‰ ±:±3¶C@ûççœ:e㓵öm»…R—sª¾úÎ¥.ÿÅ pWáÀSA0˜.öøàz>í +1²"£–Ì“½ýOg!“Û§q\¦]5˜Ä×·ÏG—“¿GJ)Gl8òýÀùpv4 -g|úáè »´s Õ_O/&ÑpN/>‘<Ê\]^þŒ}Ã@9“á×ÉO{' ¬fB€"¦?÷®¿òA øÚãL…Á` eÎt/ösµ²õùÞxï—f(êÓÒê¢ÀUsµÍr[©˜ïùßåÌåÚ°\UÑ+]çs/B1Ä ‹“ÛQkg÷¬H [KÎß…Ò¸r€1ˆ2|yÔû,Þ9ê|ù£þQ$wìóÙåÖÈǧc.ŽV,žÏ¡WzÐú|`÷Ù¸¤„h.&'ïäÈe¾ 6pDqœÄ¤‘fURÜFÓÄV—‡@·ð€_Á|l/^¯ú{µÅ¬äR‡=Ѻ ˜z ´ì}Ñ6¢'ô Àú‚ ·×Õl˺ÿÚ.QC­ò}Ÿù½Ð -®9gÞ[À=½8í ·5Ü[ó¿„UÉñW†Ø¿ÏÏÓ¬/·Ï„ »2T¢gN–[–ø.vã¨êËn#jàj¯¯ç¿¡ÚÅïÿ­¥»é/¢u½Wd…Í#Ko´µ¨A+ü­$úXÂù`áÕl#J~ëú¢/·Bá¡ð-àÂÁ­/ÜFñÝ;/ø®Þå ½·^8Föæ¶5[o ¹×;Êõ6D}|í ySÜîÁ~Ðß%ïÕ›°=R÷؃7$ Ç: {{„Ðůkò=Ï$mÁ -â]ö«„Ï»bÿD´o`.Œ´bžò üËÜ ¼Z®×k¸Z ô?ôSÍ0«bi=”¯üoØ6Ïmg~‹¿¾S¡Ðã2Í`¼»¿=‡r^âàV8††"½GѤ(©- Ó•¬¼Ñ]DóyRl`[D™™ÎBÈPç‘®Kv±mÍ"¾OA ¥„týÜ™•g5Ò)v)¸uƒN^VãiŠËŠ4b#C+ h`¡çIIªK™¯JRõp¹û€>(à[çÂNkéLŒ c#ÏÃÍ«M[‘Œæ9hÎ4ªRàa‡gb¦ÄRd wì*5‹0ºæÔIÓ¡•D@$Ö•›¡ +…x ­nÛRj -ÏòÅ1ù®’ºR–ÏTZi¾ Œ€Û¼†¸1¾1£°\³ºµÆè“ÒË3„È@2%Üö¶^àŠ‚yfÆA+\0ÖM®ÅeÆT§5ƒÛ˜:p^Ü%¶ZåôÍK[2o;2ôÈ„4 M2 ¬¾U¶Î…íAiºûa°þ‘FˆŠ)Zy–V6’@fUt|j²ceÈqRZ¨ؾ²2´¸ûííáÿïíoòÞn?dHŸqHÙæ ت(þ»™j[—%ü{r¬ùaó"µ}]‡ü"å»Î±ý°KÇ÷4g¼ÊhôóèÑ6ijàêÀõ”µè¨Bì õ|àÉlEšGË¢¦Ù¥´ ùÎå÷ÁÎqŸ_ˆ…pa„#]“W¹^¯‰‚7Ü=Ñö£gÂzê©´z¯Êm/©y¹n–$\˜O+­9£5=» oÎä‡2ëwúU籇ÉÎþÓ«¾å6Ç­X ^8-¸âVÔX̹É×ÏñÖß|·ÿÛÕ©gendstream +xÚ­Y_oã¸ϧðÃ+gEEK*ЇÝt{Í[¤·Þ§½}m%VW]K9×ß¾óc+9\[‰È!9g~3èY?jV˜8Ñå,/–±Ñj¶Ùß$³'ùéFÉŒ…LYs>¬nnÿj–3•ÄeRÎVžO™Ä¦\ÎVÛ¯ÑÝßÞ?¬>þ2_h­#eâù"Ï‹èó\Eï¾ürÿ÷ŸxäóûOÞÏ¿­~¾ù¸ò›b)­qËÝ|ý–̶ ÞÏ7I¬Ëbv‚v«²œío2£c“ié·7ŸoþáyñX6ãUS'4ºˆM¡¯¨Ìĉ—YNG¼œ/²¤ˆÎó´ˆì3wžá„ý|¡¢ûe4ìæ¾]­ç‹4ìþü†‹j^Su[nôvOKm'#ñ©{ad™´¯¾û¥À’?¨×OxÂYØ(]Mí¡ å£ô«èÈkv¶¸'cðž@g …*-IM‡S>#°{„Vµ‘ó§¹HSµ@niÆÉyôîpÒ!ydzÁ®î¤³«ÏÜ:5mËóŸhñÀäŠ?«»ÙÃvpT>&öN”æ¹÷ †pûö0F2†n™jŸgïˆI‚xî AÙµ9võ€ÌéÀ%ý÷¹Êj×0G ìÙË;ìd£ïàHÅÁÃ3ÏxbçgZãµWý(ÈÜ’xöùiÇSî™×‰±meËI»güï„«&Îÿqz3È–"08í?çpʈ÷. ©âÔ $ˆòjÓe„¤Â‡$¤ïow‚xpΞ“86`T ÜñQ;Õ±æøñ0"ŠCb]&Lâ-;žÛ<òÈ™nK¢xÃÅ%l3h¼´FÄ"P£·Âƒ YáãÂë„¡ëª÷q3vÒ|­ðÁ^gYpLèð1¡ÁÖ:xœÖ™¡Ë;È<þà9ÈûÜ€6PØ»âìa]€æYþ~ï,[4õN8ÅßVHÀ¸HÛvbdÐþò!Š‡žÅøŠ±‰B)ÎNŽÃvBYëÖ›Å'£Se0³Arñ1êé)¸áÈ£ 6cµý‰¶2q™ zÈýŒ¢íPtÝ*3…ðö{kÔÊ™ÛÈM +žu{í žeñ`)Zt–<Á|á3ÒÈ kÁinYfþkn‹@§ä+Ò}–DmÕܲbgØ&WÂïÞ›ˆ‡f­KJ.p|/h)Ṙa¾ˆ½‰0ƒËYµy…ãT¹c@‡’+kÄ`èTÁ«ã(­}i4üˆm° fÄ¢¤²é‡œïZÍþ¨¬KÞFl•”ÓŠ–«­GxºƒÔg2NuFY% žø†my-!5|œ×£V5{=Ž£s–×L§q‘—oæÁœW(b“艎y+ѹ¸û[ý®škf>3¶|¦ókB'&Vyñ¶ÐãœWëX›2¨¼I•5Æ>ÆhÁÑ•e;) ´ªµ¯X0ž«|,QpIPò%pÏ.šc¯j]ˆÄÞ¡ `ڙȋl EÏU >ÍoÄ‘6<¾e³9ór®èX×V-÷ÚûA¡J'’œá9B„OQ$dÌ ‰[ùÊm; a-j2Y1‰y/‚¯.c~âøÚ°En~ø6¡N‘†Ê9:ŽOM€ògyú)ÓX-‹XÐ$·i&Ta'‰ÕÛŒ¯ª’€wâx$·ÉeÐËË”¯ï–-]ûÜ›ŽŽµ3§”ËùBÒ–4Hl¡ã.4xYAÞ¶ëyX\,•d)aBåp^6÷5”ø¶3:_\Õ.äƒ |® s)øêÓ¨mz—h_å=!Qæ¬!\›„ïŽbVÕò[\‡pQý0íãW±$@÷^û¬u® +K-UFwoh­”0 +_;§ù®Yê«â)ú¡qµ§?®°¹Tý–*¿$z? N¡):0´?ÓKü +ÙRÜ´mÇ`¨&æ¶,®Z®èÖí¨4ëVPoÙ@öö¹w[QFC38ë øëPó5õZ7Ê8ÝN¨‚+,Je‚· ¶Ô§ +¡º#AÇÇÛ*®üû /ª†Ñ%_ò‰p ªä-i®GÇŽ+ +lßò3•€ö(™°¯ïFˆ“}~#{µ 3at¡6¤\ HFq¬®Ã,‚gKí-º:TnHY͘8k4Pè<ù2•ž‘TÉç2º ÛD„¸|Ñ$âK霸Ác píY,dÔaÔ¼t]΢óÆÝH=:B.YÕ¹pŸû…ï9–ô¯óתs>^£wXT”ЩÖí(ªÏ`ÒÑcƒÛðl(í#„ ÜX¬ µííTa|:튛p¶¸—E(ˆEƒwh°ìM=ý ©î”äuðå0 ©;ì~ïMhKŒÑ‹tëîšH£G@gSu^½8ô•bZ3…ðB•&—§P…w!~ÕÝÊNA¨¢YÕZ^ÖÂ×(àçÖü¡Gœ‰zD›8Ó“ï°ð˼þ§8EM—E:]Ó˜4Så…¡BlY\Jìþ3u-òkm¦Úendstream endobj -4973 0 obj << +5069 0 obj << /Type /Page -/Contents 4974 0 R -/Resources 4972 0 R +/Contents 5070 0 R +/Resources 5068 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4945 0 R +/Parent 5028 0 R >> endobj -4975 0 obj << -/D [4973 0 R /XYZ 85.039 781.388 null] +5071 0 obj << +/D [5069 0 R /XYZ 85.039 786.531 null] >> endobj -1202 0 obj << -/D [4973 0 R /XYZ 85.039 309.498 null] +1034 0 obj << +/D [5069 0 R /XYZ 85.039 697.613 null] >> endobj -4976 0 obj << -/D [4973 0 R /XYZ 85.039 288.903 null] +5072 0 obj << +/D [5069 0 R /XYZ 85.039 662.868 null] >> endobj -4972 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F56 2890 0 R /F20 2865 0 R >> +1038 0 obj << +/D [5069 0 R /XYZ 85.039 432.879 null] +>> endobj +5073 0 obj << +/D [5069 0 R /XYZ 85.039 398.133 null] +>> endobj +5068 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4979 0 obj << -/Length 2180 +5076 0 obj << +/Length 2259 /Filter /FlateDecode >> stream -xÚÅioÛFö»…ÐÍÂT!±sò°ä8iÜ&®6–‘’  EÚbB“*IYöþú}oÞ¢(Ù=âbØœãÍ»™g>`ðŸí2ü€»2‹Û#6¸¸…[qæd~ôÃkO 8sCæ×[<ÚUZæñGçå›élþêýp,¥txàǾ8/ßN/†Ü¹8{9}‹[Ê™ÁôýÙù|8æÎÙù0—³Ù/¸7 ¤3~žÿtôjÞ²ÕBäé·£ŸÙ þ:b® ƒÁÆÌå°}{L¹ZI;ÏŽ.ŽþÝ¢¢=5 S‡T eàê@îë@ꎸ®ïù_3W3e”ð&ŽoC¾à¿Æ‰{ú$æœ íLa }í¾”aÂ4s.Öùp¬a÷]ô`—-09ÑÁD‡4ŒITð6æÈz¸Gêìü¬CJr@Å~:qTwè¾ ù· -¤÷é$×}y”ž_že¶êÊÃs¤ï…áß@©LúÎ …ÔÁßà «UÜJxÒ—ÏOé.ߣ¤4ÓÞóøÃéùÙã—„÷t<—KtH½y;ëËÄCßgÏ®½_Ë䆨aG.!Åý¿J Ò#øIÅBß#°«¬X|­h\\Ó·Jÿ›X$žàJ¹4ñY¸&º‹Ò,ºÊCkܾËB"ör]–I^xœ–É¢.Êš¦Ë'.þ\LßLÇ//g8[•i^¿ÀÑ)þx8øë€GHPÖép¬@vçYÇ›ðàI븈jûÓˆ¥~ñôô—“W³ mYx€º1¸’J±–NT÷éH‹Y÷õ4,ª’òKR+›ó·™:ôd“ØæË5á™®J‹°‡O˜žHñGĹ<$g¡ö‚oGï’¡˜lÈPL,Ï£´ÙéëE™Dà¨ÂÍN÷¢_ûj/£mõÆìWL„š0ÿÿ?¼æÝÛ F§/üÁXIדž!}^Ôé°Cåqê%ܵPqRš`rÊ„V¢vnâœp'.S¼ŠÀBÌ'ƬgIE¸WCDT!D’#°%“愦^ZŽwîSÂS®à!Xyd -]¡ìvµ¾ûø˜cç'°Ïª,®Pª« ~?ÍëÆÅ-1Qâ‚ëJ/èúÚªl4pƒ´X£(àÎÀ2wŒ$u„X³¨N \zmã…ÞZs£WßQ¹³Lè0ê%kðZ„×2ì«Vçx(o€6£SÒ³'ƒÀ(¯ ƒÀ)F0 HŒ“5íEeƒ^[þSÃÿˆ Ù1ÐT²Á´àɪ¢õhzÞ î=Ð5²ˆzÅ Ù"Ió{}ÒŒE„X7jLh¾õ¸[¥Ò¥…Xd©už -ôìiYËndÍôI¢,[ìK¹(ÖäD©¸QoCá|Ÿ›1Jø=mb™Âº ¹¹¸³–iÒ¸¾X&·4Úú˜Bu™c <•¥”mÀÖ—Vv!K¿¶xyÇŒ€­uËG» elD°ÂâÉ6Éßöu°e”û†Qî‘“&´T-£– :Á´ds-VdgØA­ã†‰ž”d|AK&ÖáûÁDP\àÞ¦"2¯`å~•--€‘• “uMëedGRH†fËëÿn`wÇɤҎåCJáKñZ¶ò8?ž3ÃJèÔÈï;æ¡ÚÄ*àh™Ž*ôYD”V€õ<¨D·èJ& ÑVL!JÉY6üÃÆ×­ãÑÂC›U-Ä6C›IÒ„NÉhq„©a¯xVhf€ß†‡=R˜Õ‚ñÐÔ(mÍ”á/¢c]&ÿzÞ΋×w¼x™M™3%‹’,ˆ»fÜf¿ê@*B×WÂbŠð!Bȶ5±i´QH•ZpïkN¾D³­á‚ɉðÝ öÒ*xIÈ~µ©pßÀO×g~[7ömXZ*Ì÷Ô«èšBª½\-å~Þ0›"³"¿qinHº*|º+Ó1 Áºöá•\ D¸žO5Ÿ®ï/ÂÕX®Tè¼_ç9E®ç;å -ÃÉY,0„RsuÇåM -ÞgFQ[£ft .§Ÿdºc˜Þñ„–i?pÜ•é ,i*OîÑ®põj³"NL”u³(.ÖI–Ñh7 q%º¢J¹¶~¤y[¨q\­ÈÙ($ð˜Åd¢:¹1¯\Á{š¡fSo£';Œ~ ue)"qÈzQܸF| gmÓQÑTJ[õ>âñŽ¿øL°jTD¥ª­–C*fx¶ùÆ…½jPÕnʹØ^Ét7à÷\xŸ4aŠ®€Héš$…C^Ñ3¨ö·×´e¡[Œð–³³šèoR4R_5u‰›»cž>\]}µ£cÚÀ¹2ÅKR‘æj›”oÒÖ+L4r«@êG*—< -ûVõm¥ugÊA[¨rt„˜ŸžXÄQgkóW;—b[ÝzÅ€®‹,kë€)i7¯.[-š™šJcâ2 9÷ʺ8n-£Ýäc ·ÙKâ´nýpdÑÞDƽ씮ª0Ø–¼Ø\¯ÍMŽ£ûLÜäæ)æÀp_Eýz°”«ÅÂfœŽ/qïŸ÷ðÏ.,è{¼Í:fþÜ"âbcŸ=Ø;Æï}à}g÷±«ÂÙÄ6rlËh²í7¥rî*ÈBOôÍ&½¦Ó¤×šØGî#}‰óK8ò~úaÒkz½Ú‘aŒ=†¦×qõ:££^_qô4S½†Ý¨×ÿlç?¿{—æ†ÛžÚuå¦ë{7βQGáçó×£æíüû¬4ݯc"¶íQèkx»¶³D^´¸ ô_öíû,ò{ö·=€VË×ã½ÃÉŸóçsƒ¥ÿ²˜îWƒîà]Åá¡¢?$Æ7ý¦½:(é2<|sÐB˜†ñb.;¾îóÛü-gáÿ¿k -endstream +xÚ½XÝoÛ8Ï_aì“ ÔŠ(J²TàÚ\vÛݤíÕÞ;,Ú¢PlÙ¢,EÇÍóEYŽíôá€kP˜â ‡ÃùøÍjÀŸ¥±èl4M?Öj´¨/‚Ñ(¿](á˜ËdÀóv~qùkœŒTàgA6š¯z9YàÇY2š/¿xWïÞ|š_O´ÖžŠýñd:M½ÙXy×W~~ÿá7¦ÌÞܾ}3þ6ÿýâzÞo:PKi[þ}ñå[0Z‚z¿_¾ÎÒÑƯ²lT_D±öãHËwu1»øW/‹iшW:¡ã˜¨ÌÏÂøe+$‰ŸIo…¨ÊÏâxh…8ö“hJV€ƒkÎœÀùã8ð>ÌÇåÝÀÌícH¦Þ¬XlMiÇZyOç êP¿¬Ùž‡4Sñ ÿ„ÊMšÍÇ©öZv•jÐêk ¢õ¦@R +ß°¦À–#ÁnŠf¦ž-¹-a‘ìH²dÕVðQµÈµCÉ%|6kf4źìpÒš1˜&ÀÙ§N¶rûïÔÏœ¨äiÉùÝx‚¼¤äk´äå¯zhù:7GÚO4é—w\ÿõýæãÕ››ï·o®Þ½ÿpýUéhö×l~}‹£«­1Ec¯ÚÆš¶š–&ù ‡7]þ ·_L†QFr©êE[?€îʪ´OUñXT¿üc¹kÍòuÀÿ4«xà§ÉŽBÁ=žDQêMð'ƒxi–<á|ƒcSUÀSpeW0sÛTdfð5f`xWUɮˑá«cæÞ¤UÅ[¦;~ã†0Å{fgâAy¯€ƒ€@‡™Œ¥r˜oÜa×-©”[úZÂÐ?S™¢$ð“øåÎaÀÓ×L”(T¦H+?Ì”«™&' ÇŸk“/+f^ßåç +S(q?QhÏs¶Tê ÊiÊ®üT9ÃähS&àC0çÜ rÏ!azëm‘?7Õ“]ó\×0Ҩ߄”E‚Y ÇçÚŽ{2`'½@â¹LT|cíÃëËËÝnçwh3¿5ëËçÊh°F +ÝÜ2Ï,çxŽT80Ö¡]‡*¬ZÉË-#ð‚Jr(Ç:FIår±i€Ñ0ãôB> +Ôm³(ˆK’º£˜óDS@ð ù>.ì.H†œºôE”H¢,\Y0û¼¢)*çeTªj.NÕÑ”5Ì—û ÖÖ•V~;&`®—ëMÕ‹…^×Ru!¥ +Yj[^B5Šb½QŽºA¤'ç;tŸ¨'C,8uD >âTÕº%P²: Ú[–cÒ Í #ïê@J‡{0—®®g{¢nkøë#Pf¢L³d“V8Ví1령ᣕةŽ—5E$^o?€Ásˆ¦õ§/·Ò{–³x¥Uêë¾Å®®ÚºvP8umL;Ö-Ä]XÊ‹ºô,g¡*L?JRR† +ãZ3*"0he¢ÃhšzèuŒ“4Ø·*@Ý´åÑC•ÛžÁÔ̶h1õš*‰kú§÷æ\' ž1lü$*t, ä\Þ–TSœÏIáh¥ðà¸vѳÞpwJ²ªò~°Î¾˜DÅPŽ”&C_eqž¯ÔØL«ÀkZˤ;Ž2þ€ +=hNs3h¦“iâíÛƒ¾Q™b6¡À²ë»OÁ¤à¸]Ù¢aî}.üp¥9ØÌ’ŽtØÓ2ýî?а¶"ód_"º£í7Å6% +Ù:êÀ(:¼ ‘b* +¤‡‰u5æ #胖ãÔä5í]UÔ´µ¦ÈÜÊîîÔ86ûÚKqGBra¬9n#æšš>¹\¢ôܶœyÏ,°Û€ºa’¸r#+hjG¢q„"¶¦á£‡Í|±¢Hà+gÁ9óu§°—·ã#»Õ<ÍÐú7nW Uq‚2mk1£•5¸¨´#/šaÀsÑU”AKèù†6Î2BEæü3¼ïòc +L.°M¤ +eé±ß» ‹>»A¦w”Q°ú†Ðån0ék¹ì»ly®s™(ŠçáÒ"WÔ³qxaóÁtÎK—ÅŠ¥’ ¥¸˜b‡QÆQî‡æ\HF*ôøÞÌã¡<„G”×cÁ<ÕB$•þPã²Ú½°Xªo ‘sð¢ážUËOMhÚ»Ü5?H¡$°…qÚÄÁûO‚üË%´ë«Aè©pêå¯Èœ'િö• sN%ï`.–ƒ«¦!´ZoÜTÁ2Ž³4­·4ê‘¥qTg¥é¢B±•¢Ÿ†œ@Ä«7žÇÔÅ¡¬ôBwÏ8‡IqÐY0)ïb%¸ð‘Òðï¢Q>ZIWâ'ÙA¼ó“M¸¯¥ 1½ã ¤îíyì‚ÞµßÊ¥¹°bv,½0Oñ¾fêQ±ùé1i»ÞHóÜ· âK¹©ïŸSsvõ¡!ñÀ=·âqZó]4Ç`´=œmár­O¶¿ðŸOü?=·ï/Ù©Ÿ¥ái˜‹CÀ@Õ+ChŸdÏ5Ž5Þhõ •ÿ áÍó×endstream endobj -4978 0 obj << +5075 0 obj << /Type /Page -/Contents 4979 0 R -/Resources 4977 0 R +/Contents 5076 0 R +/Resources 5074 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4982 0 R +/Parent 5083 0 R +/Annots [ 5080 0 R ] >> endobj -4980 0 obj << -/D [4978 0 R /XYZ 85.039 781.388 null] +5080 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [207.588 389.969 329.852 401.961] +/Subtype/Link/A<> >> endobj -1206 0 obj << -/D [4978 0 R /XYZ 85.039 309.498 null] +5077 0 obj << +/D [5075 0 R /XYZ 85.039 786.531 null] >> endobj -4981 0 obj << -/D [4978 0 R /XYZ 85.039 289.509 null] +1042 0 obj << +/D [5075 0 R /XYZ 85.039 766.606 null] >> endobj -4977 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F56 2890 0 R >> +5078 0 obj << +/D [5075 0 R /XYZ 85.039 746.277 null] +>> endobj +1046 0 obj << +/D [5075 0 R /XYZ 85.039 460.651 null] +>> endobj +5079 0 obj << +/D [5075 0 R /XYZ 85.039 417.698 null] +>> endobj +1050 0 obj << +/D [5075 0 R /XYZ 85.039 347.73 null] +>> endobj +5081 0 obj << +/D [5075 0 R /XYZ 85.039 307.567 null] +>> endobj +1054 0 obj << +/D [5075 0 R /XYZ 85.039 211.006 null] +>> endobj +5082 0 obj << +/D [5075 0 R /XYZ 85.039 175.202 null] +>> endobj +5074 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4985 0 obj << -/Length 2244 +5086 0 obj << +/Length 1823 /Filter /FlateDecode >> stream -xÚ½YmSÛHþίðííUäªx2¯z!•„…=¾µ©½«ljKHk±%Ÿ,CØ_¿ÝÓ#Y6†¤rI¹4ÓÓÓ¯O÷Œ„èqø/z¡a\E½ L…a/™ïñÞ5¬ü´'ÇÀ± :<ï'{oŽ|ÝœE<êM®Ör ÓFõ&é'ïàx8š|ø¥?PJy"dýA„ÞÁépÜÞøä`xŠKÚÁô—“³I ¼“³Ÿˆy.F£s\ë‡Ê›ô?O~Þû0iÍj‚ Úôß½OŸy/ûÞãLEaïÆœ XžïQÌhåæ³½ñÞ¿ZQ´¦{´kWŒ -™ ÕÃ(Ó‰Š~Ð g†k„ãó“1ÃÕ–Îf¯Ýô÷4cg“£×Çi:D‚ó߫욟Ž~@GA# dØÈ€q° %ª¼¨³ª?0Òx‡U~ÛŒQ„à4^®’$[.¯V³Ù=QòbYdzY–2üæHt-6L„²7Њù*°Z†W5„<Ã\€xŵWOs ,qbð!¼:[4K‘Sà‹ú2ô²ÊqNËPg)±^öÁϱWY‚rÊë8ò?qœµ| ãžÆãxÞ‡M—ÀÓƲh“‘H[Th_ûj§:«ÈòBx=­Œ÷Xeì‚0˜ûÈú^dÖ -©<ŒAIõá0Ù{OÄ$®²+ë+Íï¦MÑZ)Aú´@_‹kG²‘ƒb>ÇGŒáHÑXͽòxUOö%Á8 Ø¸¸v¦´!€qY¥6ìÀ[^­ Ÿ|ÃÃ߸ÐÙ,¥|R\Ddk­œƒ,iBoCÕ’hwè@¹š¡yH ¼Y»Q]Ò3&xmD€À2`*?{PÃ2 -£žo$óñõ*VL+g YƒŽ°‡%ª¸`P­F´k<N.ÆÛ¶)å3ø/b[#ë+¶iθ¶]œ/>ŒÇG§;ê7@o"߬ªÊŠ’1Ïl~—ñuÖæ9ôl‡mÁ¹$€@à"&åf%´ ^RZlÚbØú¼ÅŠ+WK[W¾w`«h=Á婃Žâ‘7ϯ§}Qi†M7¢ÉºŠ£‡$´`µÖͺ…µfë&¡%K¼¢E(4>(ó×À/”í+§»Z—%à´têÃX·[ƒŒòRÛVºdiuÛ^s‡uR¢Ì›¾1^ŒšfDÄpéKâ®ã'Eb£ø1ç…Ê’Vb 8–©ÝÖ©Ûµ¼§Þ¡[á–amlœbü1Ùep°£Ìã;žŽ<0yAO§Ÿ#Q°uÉ @!ëÁÅh¼æ­r2ܶçk¢Sw‰qÙže¸Ë:„8Í—D<>ǽ¿NÎݾŽ0›ó:‡Cà¡'‹Ê¶l ÎÔ‚n1Ý%¬û¥K?ÒÓ¬ŽóZ)q¥-Ô’¦Áç k|Y¼&–üŠž÷ÔiÒ=è`Z4b2GÈköÈÝÅÀe‚åÒÕá±Còn’)èƘïÛ8À=+``´Ä"„î`š%7`ŠïCª0}%½@¼Cë©EÍŽò™ ²Ç·/±š¼,+h:Ç ÜZaÕýu‹©»à«¸€¬BnaÃ# ûŸŒCËbðÑÛ0èˆqŸJùÜåAúÒå<‰-v€xW¶Sú¡=ûÜ5#~Eç"nÙ¼¡¬÷!Vq[S|Ȼݧp=vrR £¶­á’eÏÜz¾VéNìíCAq&áZüÆõÎvïf½[ í•o×ÏgZ6'ò¼Ó?¡²ñ†úÞ°(ëiç¨u€/KÐzø’ž Ž¯â¤†"ÑOä¸vûVNÀvp“e´%ëZ;G ÷Rý®S"»«"]—É­nœy6ÆïÂ%bAК­˜#ÔqÛWÒ£ƒa;lßÜ×P©yj¸¹FWâL?’È, ¹CŒ”Ñmž) iÞZI]Vp²iì½ÚˬU™`¶{þf¶ÍÞ4æ8A€ Ëq^Ñw(5·MwG7¯Ë9›œ*³ÜåHá wGÈ$~ãñþŽˆ ζÅ!_U–õßÝ«ÌütdEMÓ7oÆÃï‡öùÓPž¿ÿ0vxz -¥Ï×z´‚—ùÖ£¸ÞöHµá¾6»õP‰ÍâeVý‘Õš-)êá ˆ—Øù*ú&o „î[¼¹Øåà‘ñÃgz³­çøtÔÑ##N^R8Å@¡/x¬å!ox ¡q.ù)6c+I<ÃjvùáÝÕ_,ÅÂyÅë]ŸoY{/£ŽoÜNvOÆ’²Ä=Õno¸¢ÙlLß„ ÷µ'C»!†–—X³`ùaMV°ÉõzmÚ³Íò¨…´ù¡ËBᦸÇÕÐ5;žê4C֘͂…÷¥æñ¾c†ŽÂöFaà âX Ã#4=AŸí cˆb0ËØîpôÔG¦ÃAg¦Æh‘ˉQ-ßI¬GkÆ‹µÍ¥¨‚Äú(NSfc]Ï»–G’˜—¢…7¸ãèHàª#×ó}^˜ûbwwÇ–Îñ¡¤2Æ"‹w¦Q¢Ø4"rÐ í5ãq^%çOÏ–ë˜m~Û9m§âÄÆ;JÆ/Ù‘9UºÖ/qr½¢‚ *ìh½C‹¦Ñ†‚Ò—,‡€ˆu bÄh±nHrä‰(9ußµ~Œ‚úxÙqoÃ=ÕÛ™ƒtã`ÙÉý$GªO2kb7—«“M—…ëQ Ðþ佺 ãoèòqZ5]Ñ2kâð¥^«jÔ‘ê[s›ëXÂ}¸=ð¨ bÍx0œ-‘ôïh|¸4õ J÷6Kvc kjõÒÌ€·¬²ëÛ”™&Ë&©‚+9MU®%|:¼B¦&0­ÉSß=qÃAä„0ØŽ’ì4’=*aÏ?Z;Dw¸Z²6É2UW +Ë<ìFîZ¦ƒ>n ›&[Ú(©^g4_I)š(õXšØá]úu$X(ŽmþeÇ—ÖÝy}¦žà#»çá,:°¾i¡ìÅȪf"éÞ m +”~b©œq5¿dÌÊn”¤T26Ä Usrý‡éº‘Bd¾õçÏøç L÷€Ê$VVßêlŽ{GW¤&—S©|×à~ssÀ7*,Ä #Ç,ØcC¡’ùܱ¤¬ù¹nêA¼37_Ó…àûö&n87Œ6õ‚§+(I¬¬šs#+ä¹ÑPšáKK.(—MË>M +PÙŧËåDm¦Y¦;d>B·–Á´$°’(fðb‡–é/ ò‚¡ÿîšT—ƒ®ã„Cùkªè§P^r-½.¿ºì›Ç<“ߎ§9: Nn:Ô‡rÀŸc·çý8:‡Èý'ÝN†êз08ÖYskŽŒ,—ðËúÜvÇw|Ks‰H)1lÍRv—nrë‘ï8^`ùÞägøãôÿ¯Ogæc[IìN +\×r }ôŠìÓˆ/¶‚Ø›ù?Ùúendstream endobj -4984 0 obj << +5085 0 obj << /Type /Page -/Contents 4985 0 R -/Resources 4983 0 R +/Contents 5086 0 R +/Resources 5084 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4982 0 R +/Parent 5083 0 R >> endobj -4986 0 obj << -/D [4984 0 R /XYZ 85.039 781.388 null] +5087 0 obj << +/D [5085 0 R /XYZ 85.039 786.531 null] >> endobj -1210 0 obj << -/D [4984 0 R /XYZ 85.039 581.088 null] +1058 0 obj << +/D [5085 0 R /XYZ 85.039 766.606 null] >> endobj -4987 0 obj << -/D [4984 0 R /XYZ 85.039 562.614 null] +5088 0 obj << +/D [5085 0 R /XYZ 85.039 746.277 null] >> endobj -4983 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R >> +5084 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4990 0 obj << -/Length 3884 -/Filter /FlateDecode ->> -stream -xÚåZYoãF~÷¯0²† -,šM6/¿,ª¯ê:¾ª¦: à¯:Ìb?ˆòÃ4S~”e‡ËÍApx =ß(¡˜ ÉÜ¡y{upüm¢UàçA~xu3Ìû:Ž¯V¿yï>ž^\}øy6¢ÈS™?›§iæ½ûáôr¦¼Ë³w§?`—ö. úóÙùÕl®¼³óï˜i®/.~¾YyW³ÏWß|¸²Û² ÂrÜÓŸ¿}W°ÿï?ʳÃ'(¾‚îÍlÊu$õõÁåÁ?ìTܧyÔ â(óã,ÚçA;5ÜÛGá™áŽì燀¬£  +ÇUÕˆ‘´JÇ&%Iœë ÃÜW)^)îm HFì})û û%~ni‹ÎÖYV ¸+^þ©BvãŠrž‡7ÔW¤V¨îkhØßÊà†äRÁÉ^“•y°÷%âLc¾7RB#O9' $%w‰ôµÀ3Dû)e&{‹He…¯fJ#V¾ª^Ì ù*¿1þ=¡ BþÅËîÙ… -‰Ný¦ç (N,jæ°‚m_éèßæ©‹ÕènA„¿¨BërÅFY±\Znâ,ªúrr¤a>¸b¤-@JË£¼9‰ˆ}-7bx¿ö¨4Ú‘æž[(tDrù½iÁ…ï_ÿ':X -:VçÙñÐú!Q#kŸôüêâîàø— _Vº \Êðu(ä½ … Ñ_@¡W(´·Þr׳P( -ÂÏAŒlä˜Ñ€2¡ØD¿.>Â:ª c{žn†œÅ™ˆ¡Ôº¡ö]]¾.‰ÏÚéãœÐœ9·ºfµí“žDzaêVdÍÄ™÷Þeª “ö7¤¹ªLíäWP'"ÑÜãÄw´Àà/Råø¯T9.+ ‡Ë‚29g,좄Fœm(KMNte¯¸ãÑÖ…> –©l,3e],FÑ*„*ÖCŠHAغ¶ h%ŒÙIH3„N ev8üÜ𯛀Ã8b1èù—ú–lÓ­»´6À6±b÷Ó0Â×æ¶Q–{IŒèYb”XÔý|o”‰ÆŒ’6± ’t£(~Ñ7O’];¿:â„ÉbÛ2‚$I<=@l6”ØÂØ~Ãø –/|®@ïùÕ„[Ý9Kψ;´6ÕªÀKR!•¯°òžZ!…-„OÉ~.XY÷%[%AN’%†hèTŽW¬‡ä[ÍÑÇpAÈ4öÈên)×rÇiÈ?·N”eäf#ðRöŒKÎR€ ±ìå5ˆ…Ê3°*KRHm´ÔÄR²™ªŠusËUÉéaqaBáP `Å\µÑÐIÆFr -~Þã{Í¥™…ó -@øÌ-(•3×4„JX4Î!°y3I¦%xÏNrDåÊz“~’dW]l„€N -²F;<&ÙL'µ^pÐåàвl;îE+EþøötŽÝï®ñåê¥çdBR[q. ãë(”¬½an‘ãþŠ,ãÑ…Óq}öaf² ­dÏŽ%£vŒ<¥\‹Ìº`.„¸:Mb³žëÀ—§HßâyNçp¢Ë—p&Ø-?Õ¯ÃÌæe”)42_[M0æîbSÓYlH¶…Šk†ÞõùÙ/\¢‹!Ó·y˜q„d؈ÏdHaSÍXá$І“¬&Qí(áª@YÖxœÅ`,Úª0N,OW$v([iJˆ£01OÜ…„S7!kléô”E)4¿Çíöº–¤4uHfJ{_=?ùóóWÜnñS’€í½ÅáÀYkYm¬€0ûƒäÑçS¤¼­èžV·µóÌAê/æT¡•$f²oGZF²KŽ¯m¢ÁÆ 0ÓüúMkÓ ~áÀ¡ZòboøØÛÍ(ˆí8†¶öæ?¸µ!{‚—n1’Í -–’+䶵}ué­)¶—«%çÄm»I“+˜)3çýÌÂ)!+ø‘‰1åR7‡‚ 1LÓC…6ìäPfæs|Ú!I ¸Øèa‘ -x¢DÊ\'™÷–`…VdÓ¯¼ñÌÐÊe‡yÙÖ=pMR¨ÊûmÏOšbçs–|æÒX{fìÑÄî9Œ>8‹@mî,ö´|F§^WÕË’[)/eò½ø'Q2|€'Mïe&³Ä9?Nr€ûFø‘€—…e*#Þ3Í¿þe-‹„ “é;QŠzðA]57ÓÚX ¶<›‰p®ª—ߎk>(òo5õÊû1ø¿ÎPÁôób6`LÜËyÓË‚Èv¹)jW&±ó.›õvSKZóÎ2ÓVnJ¬R—&÷EMo³n;:3MX-K›jÓœmÀnjNó%Ñ7l~›¶73-#bˆÉÁK´å„´65†á7È”0ö~¢T%7“\`a'ˆM`"ä­*4åçé£ ì1YE,ª T³ÏmØŒ6AŸej¢çhFvuEz5q„;z|5èR)gÓ¹¸ïC±=afba׬à <ÆçvX3Ϙˆ\5$§ˆE1oDC±i'ˆ’±§‡NÚRÈÞŒl`ùé®YOÝKønsÛVàøèû¨kz×<;× ù!sEÔ&%ݯʌF°oY©)sÛJìMy_~—xá;…˜D¯~Çáмü‘Š -5àêxç#•L>R9倭ãø3Iøå´øŸ¹0€ÂDá–© -JÊ',òéZJÎÖüQ$ƒs²Èâ“ÞR²Öš_ði¡U[Ùo_ñu/1"Ä78ý:#š—?hQAZí8•Ü<ÿä¹k¹ÁC(O=ÈÁ`ú)ÏØ*ôroIñÍIü"‘gcRZaæ¥%Éìr -*š ©X­ØŒð÷%QèM~q§¾Ê¡–/oøX«Ø|þ‘gfMˆP"僑iN7p&ÚI ¡¸Û'l‚ˆíTyd:@ϵʊ…3ø³óªQºwŠï9wu$á¯Ð©³óÁH»‚ß>O˜]£!ÌYúA–1ošþoü¥_û°¤<}ÏÕù5ö}ý ø›ÈÀûB¼Ä¦ ó)!†ÌäÿéKP« -:ò³(ŸÖ„8äçlÞ „t/Ž5_Œîmøßê&c2endstream +5091 0 obj << +/Length 2860 +/Filter /FlateDecode +>> +stream +xÚ…YK“ÛÈ ¾ûWÌ-T•E“l>v9Þro¶2ªò!›G¢$–)RKR3;ÿ~ñè&%qœÒ$Ý@ã (|è>䉘â!ËS?1áÃöô.x8ÐÊ/ïBňã'qLï ‹k»ºN#?ˆ³E¥±Î¢Øó8Ÿ6ï>|‰‚‡(ðÓÔ‰C~­ËîZÎÆv‘4¤ÿC!µVg„Y+h#ËCÝT(âH¢X©X|D9¼Ÿ #‘Zo?Îel›‡å!^÷*™v*>®°hÝ• +A4#;MÊå›î|ªláÉgÛŠ€m¢;kÁF™û·zÛw,Þn¿r•ÅÇ)Š¸‚”È}F5J¶ù +—}+Í›4÷“üçi~†ófš7¦ð£ÈØ4iš§„Hu†ëÌnúM÷,½-Ô‰³_xƒc“RFÿ?O8of}„¾‰"æ˜ÓªÉïÓjP¦0þŸb?J¡]Ú™ÃD%â»[î¬f¡®° œx'!JEŠäÙt3´Rm×®9ÍV¶¢-{Žj ¤ hZÍsÓ ¿¢8ˆËŠAˆKù÷¾áÐP™OõÈ9l-Î ø›B8 'ìerÝ©“,$µe3•®¡Q<]-Ñ)¡]'Hìcâ„óm…š‰AßïÓ9£´Ö›FYáû‹û°à$Å ÊÛ‡JòG×ʶ¶1Ë@š•ôy· øÙK˜jÉØ3þGð¹«õŠ#sÃy$™åÚNòI¸ù&–Úò$ùæ,Y}í°F°ðáÂÌpiF5*k{lBÑØB’¯†úÀÉo$uÔÖ[íz’}D‰…¢zÉÚ26{àeW5ÔÅI(4„''B'9M„SCL;{{)¸ +2™-êJ‰Ôz&éä ›¤Ý#d9Ëoý”WîoÈZtIÙÙóu'õý7WQ íöè +‹t!2[ÿ有 ²–%l£k7J eè£KÏ®q× hý>~‚¶vRõ5'$‚N½VýÓć}€U@ɬ cã5‹#iæËv¸œPŠ\$Q÷V&®¾ˆ¦­ç¸Š—’ÊdV +qùÎñõïF dŽÊ°fWõBQ£W˜m‡3ºƒD<]!àv£ìªfê•Ý“¦Õ$¬•25¿;‡·4­ª›Æ#æ]3S&«/·š=IM¾,„m>¤¢´ ø¶s!âHeÛq›ñéÞ7•„›ÌF~ð +["Øê ¤Þ +ôX<—=W õá$;]ÿ §$žRs°«þ¸”®¶AE“q·Ð+©ŒúÈË _}¥Õ³áˆVžjý4§²‚§X©‘ \›¾ÄƱS*£ÔH,?j‘.Ô#µ’k;ÁÝÍM–œ`*s–]U: ¹8?gµœœT=jgÌÄj¥lp‡êÚf0´å;ôR7ylLÉÌL[.ÁÀe;5¡6@ÖDˆ×ÛâƧÈX›œ M×u^åõNž’”:hêE ;M†­­wþAKj€—^jkÚó*쉕îè…qé,ÿc(ÈÌ#ðN3÷ŸÅ쓬<§¼GÎ’$åE¡öîé´ÀÂ|ø«Ý%h–¶Â S˜×Ì‚š‚·’¾ÙÖ×vŽQYp3eÂ?³€ž©Ï8ToÍØ©3Ôøìñ»(šSÞB™YB©‘­ïR²ò\“˜lînZk/6ÈæÑMm윴<ëèEU*¢sQlÙvÚý³c¡Uº.ô@é#?|IòYqM²Òÿ‹¸Ð\e™4úƒLñnJñ¨ð‹´Pdñ ª”è„Ð\IïQó±¤+ ÚÉ—d¶ÊŠPB¶<vÕ7½çú¸ ©Oˆ¢\À@”ŲÀhâGAjñT?Q>o®ûAÈî{Õ*–Y{ªqæé^ãq”JA~ËóÕA/ÒH;ÀËWnÁ’ Ó»ž+GìubVJZ§2´¬eþfgi2¾Ë¯xåamk®l%ɦ$EïvT'•W £A¥«G:gãó•8¦ŽÐÅ;œ¸à¡ŠåŽb+4\þ°R¹+rXO›Fá¶á@3U> endobj -4991 0 obj << -/D [4989 0 R /XYZ 85.039 781.388 null] +5092 0 obj << +/D [5090 0 R /XYZ 85.039 786.531 null] >> endobj -1214 0 obj << -/D [4989 0 R /XYZ 85.039 648.228 null] +1062 0 obj << +/D [5090 0 R /XYZ 85.039 766.606 null] >> endobj -4992 0 obj << -/D [4989 0 R /XYZ 85.039 628.239 null] +3090 0 obj << +/D [5090 0 R /XYZ 85.039 658.638 null] >> endobj -1218 0 obj << -/D [4989 0 R /XYZ 85.039 135.763 null] +1066 0 obj << +/D [5090 0 R /XYZ 85.039 562.194 null] >> endobj -4993 0 obj << -/D [4989 0 R /XYZ 85.039 115.169 null] +5093 0 obj << +/D [5090 0 R /XYZ 85.039 522.636 null] >> endobj -4988 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F14 2895 0 R /F56 2890 0 R >> +1070 0 obj << +/D [5090 0 R /XYZ 85.039 368.584 null] +>> endobj +5094 0 obj << +/D [5090 0 R /XYZ 85.039 325.631 null] +>> endobj +5089 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4996 0 obj << -/Length 1970 +5097 0 obj << +/Length 2858 /Filter /FlateDecode >> stream -xÚµXëOÛHÿž¿"Ê]…S‘=¯×O¤ûô=Êq$¨:µUebC¬Ævj;<Ôþæ±vâ½»ïîÌÎÎÎüæ±È¾ ?²ï;ÂTAßó¥P¾ßŸ¦=³ ”·=©9FšeÔâ9˜ô~{ãÚ}iŠÀ ú“«•GØŽêO¢ÆáÑþÙäõùp¤”2¤/†#ÏóÓýñPããÃý$ÙÆLÏO'Ñ4ŽOß2?ò\œý‰´¡¯ŒÉðóä]ïõ¤Q«9TP§o½ŸÍ~ú¿ë™B~ÿƦ@N{ ”pl¥çóÞ¸÷W#ŠivŸwu™ÀQ¾p|µiå´l mW¸žÓ÷S8¦MFM‡#ÇrŒ0Š¢"¹‰ ž>$Y”ß–<ÃËã÷Îw`iÂø“T6^4IT0 ƒô~1 ³*,ïY^¦ñÞÑ«Óã±)¿D±xur²¦VŽ¹MÄQ¥œ÷bÕ›/êÝíùÑÉH“Ž·©CÂN/`Çùþ‡½¶T²ÛžŸïÒ Ÿ¥SVk»£øjm>+âÝ-:uH»É¢õÝóE3ÿãýû$#mÙþÛıAö—w"šÏw[Æ>¼i ÿRÄ×h²7Þ°?:¼8“Бå W¹ý‘m -×öIô4˜÷wþ<&(1,ðGññ;8³¼.[4àøÿ{ÏóØ3ýo:¦¹”ÿÆÿý:ìžQà åBÚ°¿ç•$+«p>#çüöF¶Ó#¤oÈaÏü3h¾ŽlØ{‹y6¼:Ÿã‚k„ó2Ç‘g\AS#æIx‰.(j˜øëg^,gˆi|ÉA³éë4G½ohó5ؘ@Q;6å…Õ™m²t­FLÞ©uô"O¹äl%E-wZåEÂ[b'0ÆZxmr»†×…th祡²êp±å -}#³-VGÒïh¥: rtŽ-,¿H™"–.‘ý!æ&Ð¥a+ײ¦úNŽ«,»ôƒÐö. b·ªçUŽŽÃFÜÍ2ëPXšÞ3"D1P%éçH  Aý…Kg¨X0”®–>`mHzž¢¾bKm›¶ìÇ-j~-³}°´„’V_`W‹N‡žß ±%¼dî“r=ãmªÄ<~“dá¼ö7ôš¶ïçË,c`™È4¦h²ÂIU8˜ñbWPŒ4ᆭÔqcÍ“â§ÃÖ·xèÆ릮oìÁ-®´ã0EŸ_†Ÿ“7æÊ‹-®dqƒèW -P¤|ÍtÑÛ " IU™uÝÎêËMg]‘¹Ò”íHjêÀNÉGEE;Ú©Vã2¥ˆD«•”‚ ìqÅ Yí£8z ù´Ð –9ò'  £¸F;ÐœÈvΡÜ*h )%*¯³ zÎä?M}-44å{\´"æ++I6·ÃI’]Á,¯'|FRiê€Â;Nóâ~@BÝUúô´X`TÆYÅÓÑÅ_ÜÁ?ýjÞ¿úJu·‹³4·w¾Ý/¨ÍçÈÃ÷ÓÓQZÇÝvW›Ò´öD ÿH‡N6åWÁþ À¿ tlËøΟ,Z®ióT¿óìT—YšPðh¶Yˆ„ú \‰r]ô0h^¦ZþK&‚É;Þ`u™€|K²sT÷+Æm¸É¡‹(=¯8 ß7Ô ð¾ÇæIˆm-`Ãêl_à?kôŸþ*ºjûôË[z Dz„%k]¨éóü‡úÖ=ÝPø¡A¡~endstream +xÚ¥YKsÛ8¾ûWè6T•Å%Á¸7'öl<5ñdc¥R[3s %Úb…½$Çÿ~û©ø°•Š‰G£Ñèç(\ð/\èÄ¢|‘éÔO¢p±Ù_‹'˜ù×E(+!Y94ïÖÿø5IaàçA¾X?Z>yà'yºXoÿôÞ¸ú´¾ù¼\EQä…©¿\e™önï`ìúeè}¼º½ãÉõrzŸ—J{_î×<ôùæ÷«¥†©Û?îîøÃí§ûåßëß.nÖV2Gö0ŠP®ÿ^üùw°ØÂ~»ü(׋h~˜ç‹ýEœD~GÒ¯/î/þmyñ\¼àUsjH"í':šê!Lfô$~g¤‡â°…3ÁáÚ +ò´Ãsöå^uàoYl–*óvLØô»²í~á©-,jö¨¡¨CïxýÚ%xQÕ Kï˜æ`H6ô·ëŠö•‰úFöíúâ¡–%¡Ù¿G_P !û+HB9±«aUÑWÍ¡Û!ƒçN$k¥=X ´· +Q¹9iÃ9)˜y‹+™ÝYAÏ7‹Tæ` \tKgÌ@•ü½[ÇÜ ©IÜך‹ò}¼—Yf|laªb*žØ6ûA™ i‹kžëÛcÇæÑ^ÑL$ÝŠ7¡‹CWõÕwäZ‚oDZòÖ»ªc&d¯HŒBA·EÏsÕ£ld-èìR€2¥%t|¢d-!Y“A"1H çÁýΩkýÿe˜ØuÍKÀÅöÌëóÍõ%}ýp»¾‘6{-4Þ!߿ܳaì½€ƒ–f9Ì\sÛ."NÜܨ"Ö“P͸hÝ8¡¨©-ëB\B|Œø|)jâ˜ÊìFä2ö¥¥ÖÉÞ¸P ‚*;žÛjp“XË$Ö€SoE¹ÈÔš¸õ`Xv3§=`\¥°ÉþÍTï-9¢¥Ê{XBxe1óBç°r ­†”`Fd=@Cô-×?0ÂV JVþdÞÙãwÌÖ†´iëëuµ!¸Ûáú¦Ÿµmayc¼›¨aYÜhgú»òORØ4ØL(¤U{_éÛ†2TÇd*ž½º¾gòÙÈlj MUþè;©ä 6ãÆc±éÍ¥8éX»`¯=§3œÄ æ5’H!¥Sâ fÁâLõô`2ZŒðˆûÑEz4$׫ºkÐ+SLZ5›T‚NjS mEªpl/¾5D™µ¯÷œ•dcJÁHf].‚lÒ™œ3Í£qÊÁ#/y£)ofNÍþ£DC=…Ô10 @‰C4#ãB¢êwLòe>P±¤X¡•‰øñ Çá6+ö4@ÊtB)1­QŽò÷Wwoæ1NÁÃ^3ÎúX8 +ºzO<|±Øá:Ø°ªdæ¹Ç²èRp ÚÇ9 á¢äÓÉŽˆ©Š= +ö€-r™Höã¤D»í%Û ‰X…óWÙ(½ÆŒFÞ¨Õ·íçÀ\:q×!ɧäô´®yæiTZp ½8´>Âœà‚Ó$‚r€£üàYvØ‚’…êê•'ŒoN +5 °¦«öU ™“:ûâplNC¿àK@¾óº„©XÔ‡<õ!X)yú4³ÏCä$ÎÎâZ +fc?ŠSÖ&¡†/ÃZ@ôæ†8÷îÈj=ªé;Å~Æ'K3–ÍR©:Eô†ôx¬4쟃ZrAÿ}sø+ã§#©‹sì™C…‰¯â75ÐœÅ걆 AÄw–5î8”$ŽÆŽ=왵‡¶PáäÆt¤4Γ°<ð—tbÜ^Ò3å8y ¥eT³z l?sâHuÚƒT);— ·ˆ]Ör@°e‘™JDg‘*Ä“¦´M£÷ 4Z©œ ++|',øJsÏ £#ÓWžylZ^ÂJÙàÞ;ž:MP-#8 ½cl^™xä3‘òu ±•D“Y.1ö‰ÈÚäÎé†i•$ƒ—¯"H²|ƒ²Ò͈Ç~®Ìra°ý_¨0+ ¤´¦Ó!#A»nlñ)[â!ÿ¢Bn‰u]nçT•D~Ä®®&XLâ}‰*dð4£^€­?Jò³T‚›†ðŸž9…–}ùR”Ÿ¼.áÀš¡ï‡"s9s(Ò:J„×Õv;³Šü87*F 8墀‹2}.÷Í÷rÎ]r?³Th«H ‘6çŒ +äêmáŒüÉI/•¼?a‡ð¬Æx¢nÁŸçÂbH¡³ÕÖ瑱¤j´#NéÐOµ?¿ î°‘87ºÔ;{iñmn<Û–T’©LÊÐp»t®Ë8gªyøÁàs*!õ°˜»®z&ÅÆ}°”}ONíRH¬M‰2c¤y¥„ulg’Š͘²Èû¡(LK™ZP{nJûB“ÉÞð=Õ%.á–¾wìèíÒ®&,DllÞÎ2÷ÕznÝA"[wðÚ«3×àÌ©”† xž‡1¡6g õÈ„9>ð MqtŸ¿ð"È€%#h€ëÇv-UhTEmâ5Y¸V‰á‚¹6žËž •Œ`[YfÙÊnœ»´Çå\%!„å\·å(UApøtjðápíâ'‚6†d0.÷íÞ@d| =×dC(4?>ÍY¸¦ðw5†kÊÀµfO¯s¥Álòda1Ål‡“ Ø9¹£ÔWÁÏ›Cs°©n“:äɸg@ë§`ËqzBEì¨ÔbøÆkHëõ«™²)šŸHdñQã»,£™§ÑÂÜH:½–àè¾øF¨^àŸpÅ3'>E –ÇKÉÔÿ6Íá`ПôŸ„æ…"Î%Œ“á غi2}ÈÁ É{Äe°CwÜïéNDl˜_À?ipóÜ}ŽÈÌþ|ûªäÚÅÁ0=ÛDeh°#2´ï\Ùð2­ ½^_vpzÀ›Ø› [ÄdÚÁ­*Sæ}V IéÊZ~Bâþ'œkðšËˆ°=ãã¾,„Å|4F +?âeøD>rÌÕŒ:†›`ÊLn¦µ·©+RÐ7ìfqX’ã jƒÈO³ü-PéhTèL~À-äç=¥óáÁK>›Ö‚;µƒ;ó ÈÔÎ[¸Ö|㇯Ežæ÷ÀZ\v"…™¯õ?3öÝ"åñ4‹Ä~æ¢ç’¡œ8Êü4Ö#[œ ¥,°ÎŒðt+ùÚäQ nBÆ[B'^`‹áÑo³[^&¾Ê¿‰{©«8@´.…Ízû¦—!S¡‘®èxŒ¯æ fÔrÁú(Hc;-ùR<c…ãÚ'Ïrƒ +h²ò¹B%~Ì?·ŸÖøÏ6ø¿~Šž´Ÿ|-*‰R¾ +­0T 3u*±ùÍ~*òÿ!A ²endstream endobj -4995 0 obj << +5096 0 obj << /Type /Page -/Contents 4996 0 R -/Resources 4994 0 R +/Contents 5097 0 R +/Resources 5095 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4982 0 R +/Parent 5083 0 R >> endobj -4997 0 obj << -/D [4995 0 R /XYZ 85.039 781.388 null] +5098 0 obj << +/D [5096 0 R /XYZ 85.039 786.531 null] >> endobj -1222 0 obj << -/D [4995 0 R /XYZ 85.039 404.948 null] +1074 0 obj << +/D [5096 0 R /XYZ 85.039 547.398 null] >> endobj -4998 0 obj << -/D [4995 0 R /XYZ 85.039 384.354 null] +5099 0 obj << +/D [5096 0 R /XYZ 85.039 504.445 null] >> endobj -4994 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F66 3242 0 R /F20 2865 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -5001 0 obj << -/Length 3811 -/Filter /FlateDecode ->> -stream -xÚ¥ZëoÛFÿî¿B0D É]¾rŸ'iÝkR_ì^Q´”i‰gŠTIÊŽ¯ÿüÍk—”EËÅAÌ}ÌîÎÎÎþæ±ògüógIèz*ʼnïª$™-7'Þl=ßœøB±’ňæÝõÉ›‘žùž›zéìúv˜'tu¨f×ù/Îù·g—×¾ÌJ)ÇOÜù"Žçüû³«¹ï\]œŸ}]Ú¹„ê—‹Ï×ó…ï\|þ†é‘æÇËË°ož(çzþïëïN>\[¶ì‚ÀBŠ<ý~òË¿½Yüwâ¹*MfPö\º7'À”j%õêäêäŸv*îÓ35%DnC!š@¿¼œ -S7L£Éå¼ÙÂ÷aÅøy¶i”ópÉïϳ®òƒÙ"Ò±«“ОLÀ7 C<ßÝ( f1¥¾¦£ùÜ€\{xñT®†Ú -–^Ck: SE6WVž<ÙxO¡(“¬¯´BáàçÛ¡é’Ë4¶$Éd7!—L[ær»Ã½Ö$ÕhäæD›ùY, 5±ÖQ‡¥µùé`[1mþÎ,Gƒi¡|â€úuÙ½…­ÃÁˆ†Á<C´1}ñÀxÜR~êÜâéÊ’ævܺ]ã&«¦k¨d Uù _›¬”K M½¤~Ôm;¿]ËœçR.Ôù›ÀŒhp]8¼7+î®øXdY›12àCÖ#wõêApJçx߶¡t{hÙ4¦Í6-—›epÊÝ–[ªÒB)7r¤ñÀvšðôÐÓ÷ +*r®™¥è_Ùñ¨ÕñI -á'§¶{l3M S4f‚©í.AhLÆÈqynðçz¦Ûù« V›žË™ô1ãúY¹ZÓd,²嬕CÊLf)eµM†2 É®ØÐÚ¡ó¥ÈdTS»Ï©8øuQWñÆâÄȹèH´? ßñ,BoÀ‰_=_·]Ï•áBSõè0€³xf ²òÑ- 4ÏßRj7@ôƒ-|è¶tH¢Ë”e >A¹Ù²j“ùÍìÉ£¶uƒžõµn@U1¦5õ ZéžjQ$4˜fjÛÓ°”¡ìœõj·ærÙõaͼf­Ô@®=û2‹)‰@Ð’G§ „ÍÊ·áYX«¶È~›õEõˆˆIwÎs~ B*°²c($ùæäR -ûR¸9ñ«z ¹tè°øèH¸þ®í÷ šAtfƒÃôìÕtSD÷) âàv·Ü’‰“C½kBâ*ǶW=7Ö†…B¨&XÓ!Üä¾ÖJÚ3È'Çí§uÖ㚪bw¸Ã¶È‰a1cªÜàÒx‡å¶G:Ô;O;éæðXíñ8ÖÜfC6¦¨íÌ i:¡hé¹Ù ËI3 -ÅfÔ,·9ßf¥! }“Ôß̉oÐ+ÞuwzaÈ÷ÀbœàçàxPÊ6È'å» ¨#SÑÛ\…œ%µ\È`c„ؤh”zJß¾«p˜ 7ÃMƒéxÝ>茈8`{~¸QÙ™pÛ ÍñÁŠJè_I×ÛÃN•ºaî­÷Ãȵ®'^g‚ÔU©–ƒü,W]¡‡yRüÓÞqæ“;Qh«õ b¦ÈÖ —(Y™?+J»*^å@tD”Bô’(-hDùt½IQŽÖ{׎̂ñš¥ÍÆI®Öäéž“ŒRn¨$3‘Œ½$™c É<]oR2£õö•Œü²²ï&´ p ò"Ѷ˶¬g;N¢1€ž}D¥Ë¾SH’Fô0Áão´áùážÄúáDG„+D/ ÷Ø‚F¸O×›îh½o1Õ -ɸŠ{\ÉÖÖt-–UIgPqðrÑp·C*ù9‘yĤ/‰l :"2!zIdÇ4"{ºÞ¤ÈFë]•Õ T¾ú&V?gßßuÉ­™ˆë#׋¢YµOlk>_ë7Á?$sÞïgÐùR4ô•7üh=ñ>®ÓÑ¥¸¨;óâÏ)eâlŠ5í¹ž8óÙÓ R³¡ðનÄ>å¤à\8|Uðhoµ}ë!_)GJc%&£t&çûT’ʳÏ)o²…d üÄ„Ã|˜»¬DqÓ§¹8o¿‚Æl+è’µ’æx.@Î÷òe‡‘ˆŠÝ$2‚ƒˆ+D?3œ÷;t ÁD õDv°ÞDTEQNúYgﮯ2^õÜ~Š‰Ä=CøÇÄT©fž¢ïm,³šÂQÀapîþÜlpEú¶ÁŒwâ9—èdu1%§8pušþ¹IGسfò ×&íÕ{§zÌøSt \QÀ‚$Ø›æSC:*$åȉR¡PyÊ©qÐS§6.¤ÒQ›­8èò‚ßV&°8Ý»[Ò+Ô Jã–’@ 6Ø@ÒªzÍ îñdXyNïÙ»‡ˆ¬yb‡ýTã`âÒr½ÇƒÚÞæ½åUÂé”/zÀY3çé7ö6ŽÊªS!Ìn$•¨ÃXK’A 8ñ$ßõ}#œ7CþBò(“É#ísd€ßÿP’¦ç -%G8­‘hçÝNšé.®³z‰OÈxâv•¬ôµ )5ì¡\4îgø°gÃRë²UÁóváÓS4ÓüHÐyS™›çž¥G -¤k|Ï(l¾~ˆ‡é?Ö Ë»%kï:Ž¦4Dˆ#·A)=ŽíL.P…'ö1ؼ?Úœo?ʨéqR™rþf®ûÒfîxÆO6S˜‹c¶bêéäÖZ«s@ž“IËòZBGC·ÎúCÏçô³à=…Õ÷xD¶)ë³ÓÑCwñÄžw½ýYNi’Íf+Ù( áÝç/†7)0d%IO•Žö õâšäRP^J$Ú£æT´E­§ï‹ûr)ôŸ†ç™ÂäDµ+Nl· ëÙèPPCGûÒFuK|ç}#/ÏáÑ-˜j–Ó£à»0éRókè ¦¾òsG)ñÿÓDðÃèPM‰/[V¿J›~sWàF§S¾%üg~ÿÒïQí»½†XH¥Ójnà^èwqú”_pÕÀ‹U‡ ÿ¡)nÖendstream -endobj -5000 0 obj << -/Type /Page -/Contents 5001 0 R -/Resources 4999 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4982 0 R ->> endobj -5002 0 obj << -/D [5000 0 R /XYZ 85.039 781.388 null] ->> endobj -1226 0 obj << -/D [5000 0 R /XYZ 85.039 625.193 null] +1078 0 obj << +/D [5096 0 R /XYZ 85.039 435.651 null] >> endobj -5003 0 obj << -/D [5000 0 R /XYZ 85.039 581.115 null] +5100 0 obj << +/D [5096 0 R /XYZ 85.039 400.905 null] >> endobj -1230 0 obj << -/D [5000 0 R /XYZ 85.039 526.667 null] +1082 0 obj << +/D [5096 0 R /XYZ 85.039 263.295 null] >> endobj -5004 0 obj << -/D [5000 0 R /XYZ 85.039 507.795 null] +5101 0 obj << +/D [5096 0 R /XYZ 85.039 229.155 null] >> endobj -4999 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F56 2890 0 R >> -/XObject << /Im1 3957 0 R >> +5095 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5007 0 obj << -/Length 4267 -/Filter /FlateDecode ->> -stream -xÚ¥[Y“Û6~Ÿ_1;µUæTÍ0$Á3ûò‘8Îú˜µ•Ên%y EJbY"’òxö×o_A‘’¶R@Ýh4¾n4`ÿÚƒÿüë4r=•]'©ïª4½^ë5´¼¾ò…â^Hî-š‹«ï~ŠÃkßs3/»^¬†q"7ŒÔõ¢øÝyùóó‡Åoï•RŽŸº·÷I’:/ß>ÿtë;ŸÞ¼|þ›Bç>?¾y¿¸½÷7ï_3=ÒüúððÛnSå,nÿ\ürõãˆe‚Êô×Õïz×ÈÿË•çª,½~„²çúм»¡Ü(Tò½½útõ/3·…×ÜkNšâÞÏÜ,ˆÎ«)öÝ0VFM´únE¨&ß\å×I乑’ž@5 ß @CQä9o üîáÃÇÅmæ;ÏߣZ­Ä±ó©Ä¯¾¯€¤Æâšë_a¹üŠÕË«ç]¿žSPKÇdMÍmuùÈ…‡¶ªû²íN)7L]?ÉÎOw ¡éú‘efºAÆU0Ý7(Dê9M[”-Wrüñ} ©êÛ uzMÓ7Üöùö>Hœd8=е‡-ü}âÖ;œrþJÛR÷‘„"çá~ƒá}§h°å±ãÑÞ/¾ þùÝ¿˜b¹­Já*²À©za‡•‡®G¥.î}´ žÛž„kH‚ŽÖª£ò÷Ç -ÖŠ‰³ÌMƒ`VÚæÞ"bÛÏR7Nb3Šñ‡ç'Ž*t}už!“Lù–Ten”F#~ ÓЯ·Qää¸Uì"b«§JÜ0ã.¯ÀZ—·‘+¼ƒ^ ~%w1#7‰éº.ë²Í{Roœ#³À(E¿)¹P´¸¾bѶ\½BNíí¾å-EgÿáEÚI * k¢Yë®üE{tç)ØþȶÕaŽˆ¶Ï÷Útix¬ëªÿÒç6$Õ°(9xEÛšóºàBµ‡=ø7ÆЮPa@^ÿn >euIà&AxÁê¢3V'D—¬îCmuÇüf­Îâ—ó<—¨®f·ßjÕõ¥Ñ šÕŒ5¦¡{±˜”à G©óŠÐç+&Î+X”³„-ejÞ,• -Ü1ÉÔP\¼¶b³l]¶žÀƒ1ÁgÜû±©”qræiÀ - a£M«›šç¨'HuýFë £–Щ:ù­—¨¢²/Á:‚(4¤ØHÜ™žt\æ5½o2ß!–zHïmÉpÇ_4.÷Å£öÕ0¿±o¿§¿zÛ.í]ƒêýpz»×§1ùlÓÒãÞDq›¶“n$Z.à{Çàr@]µe^¯€×9.ôç|]rO…ЩžÄš«´Lùv+\šv¬8bJ‹U,\i»†ˆ=ÑKÃ5hZ½å–"gOã@9å=ŽÎësþ!ݶl:¤ô^Zñ¯ØŽ!C‹”ì×Ø ÇyÜ”µ ŒvÅ6»Û÷ßH¨ÆI‡¢‹sLO9xÁÄAuæ3~°ë›–‚ŽÌÇê3gp¤™å0šš1ÚHÕX°5§DÊVÛ+ö·öt¡¥[5æƒ{aceæaÀ\8-^½`Š"ïÉRòŽí|:Atp:†eCCà»)DEžPG^Ýï%Ørûâó ˜@@•y©ô¸›2vcãë¼Û×Óƒ%!„áá…Á4ú‘`à=N!Ö('^e:Û|†– â¹Ý)ÉÌHèªþTýÑ‚#[GÏb Óà7BS’¡êž‚7Úþ\ñˆ6Ùàš×t=t^QÃ$€Ì/xi«%˜ÙÓm¢}_kÌñ‰”ß ;’j866Jx•²%ñƒ}Î,À=L ÀÓ>ÇŽU‚0Cß“3yä9òÉNo+h€ÜS”€} <-N¯Ãª\5ÂvÝ–Ëöãš¿Ú¶¥@dÆà4 -bÝyIЭÀ £¢©¯ò­D6Å -iC ÿ†ý߉ӑÀû¦À=lÏqUi‘ð€äƒ¦_Qh툘CHZ)BÄZ|àu¬sl|e;b©"}c’m°9le B• -熪{âÃq§BÒôüë1Å í¸T˜ Èš‘Ñ„Ú‚Úã¨U…AH¿¡ _h ØaS¶å÷`¹q6ù#­h¦ÅÉ°×À­ÇÑ©J‰]¾…@¢'®„Ž¡î0@ *Ýz³Kõ‡H0žº-PP¡¼·g‹½=Å’Àï•€m°¯v\ªv;±%п =ŸùRE \üÏ|’ã…ŒExPryX/< -”ˆÇ°¸D¾)Y¿AÅD? ãÈYlªÓSô3Ë@ØuK”ˆ¢‹rXb´/ð©&Z„^ùr©ã `U‘Ïó3GG8Ö(Žì¸½-É¿6½ñ2ž Php S.ø‹¶E'p(_€ÎÀb"P3>zÅé|É"%º­º¥†ë$,gI]ŒBâZ‹ûí–êöëäkÜ ù~Ó±«°á”ÑäFo!¡DÊ ž›ÈA=A„¦ø Ì2çYË -Oa<‡'H5†}äA‹ŠMM-9üøLdÒÉ`_ºYΦÿã`šŠÙàÝI¿AK‡„,ZÓs ƒƒì¾8ÂP—Ïù53¨Ìè’‘ÒGÍ¡cÇ|©„ ’•ÃÎxµÂˆë°[øzž¤ºiÍj,{];b>¸Mj!ì™ÚWùÇ8 Ajš²$Ž£TãC¦°\kkQ7ë£Q$ÐwËJ"\å†Ò‚˜³tœ+Vò †©q=°À¶\‚°ÒpêIsù#Že9T¡ÝŽä×Á‡c¯vu¸+ý„³S¾Á¹Ž;ÆøAkItSoæ åû_ß¾å4­Ç ì ൑ž2M+rþ¥lYz9JMçˉ¿ ù ¨ˆi.)Å2Ã0p~Âx iûð}i¢8‹Ã ˆ'B{ª@¶ZzmbÓBþ…$0>bÇÜ·æàÅÍ%ÿ0“:ÂúW#»›Î]bØ|©6œº4Ïpn1¹8p×µAW8%¼ŒÀ7.t7ñ=•ÉPàø<˼î˜uÕEs8ÄŒ(^èì`¢Æj·'Ä -Ñï 0Ñyl] -™‰C9{‘ë†Iz•¶;§Wa(þÕaI(g€Rò-í³ŽkG©âáô»08 |nÀY™ˆ1¡»™óiusXãVŠÖüá#uĉëŠãCK€™9Ž’vLBó ¡dœ\¹Qצ¼9˜fÁô »Bñ\¤/­ô DØ[‡Á!víx>V¬4‹²#Jñ—#81€üÈßæ0å£Ãx,"!à º[êÓøø­çÌ6Êð,#Po+˜±ÂXÍn3°Ï£Ëty'WLzÖæT­¨¥¤ØNÙ¸Â}eÇY:,^ „( Bqå–ÑúÉJ#®D'o§ÀË»aœœ¿'°ˆNßh¢ ÷gÊ=Á„ßÜ=ÍïEk–À8YDJOá­ Š­k÷â6Z"º üÓ~áËTnÄõYo>c¼æÓn.Ñß“÷/ -Óý~zA¯Ñ½ -Ñ%½žc¨õzÌoV¯¿Ÿ*³®P¹¶ãPêFOé$HWÅÙyXD§u¢‰.èä,CÑÉ„ßœNl~FˆH—@æ”;ÍÊÐ%Õ<,=ëfŒÓ‚é¥UÇ®T€6†Èƒšoe7wa»‘ÉJ¯(XœY’D¹é…»éæÌ‚0Í¥õ8ÃM/dzÙÕ˜ý\­Ñ*·ø3 Ÿm©vp[Xø{„É•$,†´hGaÃ)½Åž\@ÍæŒÞ˜æ’ÞÎpÓz;b6«·ÙG­°{ðÆAGÉFé©7’á™ñ‰ÒòèO!„Þñª¤·€"ßš€˜N&Rm2)ø¹M}7sÞhÅ-ÖØ _ço·Vð]ˆ°&’JmN‡A¨e0"?—Ÿ­è^õ™•Íâõ^êYíåˆA²S ”ë'—¶Î@tÆ„è’œc¨­à˜ß¬XüžëXgZâTÖ¨é{ =‚X®ˆHn  nÙÈú&#ì†Àû€5z-ôÆÞ^…YhðÃ"åSXTvødÊ¥?s·LL9¶®ßªó4óàÉ NŠ{ï±ØPÜÛÊÛŽ Ž\ºœŸäñgDNÝÄßnõ! _­tVÐ §êÄy¬O'·æ¢¶·ã º;·Gý,p£K`,¢Ó{T]Ø£gÊð›Û£6¿×¨£Ô2µÊ0s“D_¼>/¾æôxp9ä„fl3p½Ì—.|þsœÌHÉ=×Ã8pà ´•ù'‹«ü°í;ÚÉîÉ…JR7K¢ 5Y(!º´Pçê…:æ7»P¿—V’B…Ú|•sóÀïWz:ÂWý~-¶.í‘ð–ï¬Õ¾y‹aŸœO—¹œo¸£¼]3¯Æ¬óöÙ}hñuDgÔ-D—Ô}Ž¡V÷1¿YuøEÞ‡¤Mñ9 i!Iœ]nå%’ £¼T€f§oÅ|8Mú‘y±ÇìÓtÇÀ¬3¥mÞ\ôå5=»Á±%¼é‡PÅœñ†|á½ß[ïHªˆ'f‘¤üÌÁÎôå:$m…ÊõÒd Èõ\.%5l4Õù´ui[Z†C©vz.Á ƒ¡ßG*Á]ØÊæmǬ©ÔUÁ…Ó¯EtÆÀ„è’c¨ ì˜ß¬YüèJ¥ß’‰~&–„UüfŒ˜ý_GïÄFQ1=@ÛKøÉZæg˜•gnôî„_ `Mß0IèR¥õ2®àlÕZ¹ì0ó¢j’·+šñðÔËùÒ¤ø[Š:|EFïÍÙÐ Ó{zW†%6a¾ïK$CË›.(¬=…7òV}” Â´ðQ’“–H¤Àb;;m?¹“oË]^Õfaæ‹ïÀ¡TÛ 2Rº¼Eòc8̇£—˜tÅb:YAò`qhõÝp {¦ãÂ4ù[pg}zB¢ã̶τIa.+ñ›.7Byw„cÙÚ£ %~ä¼;ýÈ’nF> +stream +xÚ¥YMsÛ6½ëWðVj&‚ €Ÿ½)¶“¸ÓØi¬Li´ÄÈœJ¢CÒIûﻋHˆ"¡´ψ$°À[¼,0÷øã^±@f^’Æ,’Ü[ïg·…š×3®-ÚdaÙ¼\Í.^E±Ç–™·úÒõ“,Êboµùä_¾Y¾[]¿Ÿ/¤”>Ù|‘$©s eWwsî¿]ÞÜRåj¾àþû¹Hý÷+*zýûržBÕÍÝí=¿¹yw?ÿ¼úmv½ê<³|çR¢__gŸ>ÞÆðÛ,`2K½ïð0žeÞ~F’E¡Ôß»Ùýì®/ª =j5Fƒ±XðŒe"rSÇ,âŽ*µœeQdSE,E°#Œ~Qø7ð~h‘•¢^\Uû¼Ä`&N€¬ŒûõsÓÒ竹ä~¾.w`Q¶eÑL±¤áœn÷6Êm(,8‹©Ü^Îaù-*÷ª<?Ç÷°2ô[r_ëG„ŽæmYšGÕÕ• õµF“Ê•mÞªÿþXNШ :óQt¨l°²Õ¹î}íTÑõ‰Fåú"›5öþH%›rl‰ Ž“#S¬Ô…ê¶EAª* +->>8| ð ŠÚ©¡Ÿ±}@hCïóŒOùQ¨õÑ´ùƒÒ_ ôÑŒgC&ºU‹Ü(°BÕê Ò‰oïéù;ó®*ðËë][p°ð!ž±4’Ý‚cF¿°Þe2™¦^ ^†¼S6Wz ˆ‚ba∱DÓfa5"/„v†=£¯Êí³R4U‹òf­b V€0ÊþDg¤èƼí¼Ó&'Ρ úA¬îZVÔ¡œ{j}S °þ†ó³ å?ô-•,NœTöf€/² ‰ÇÓPÀìä?·=b/̲ع„aÊdœu\Á¬é¹âg!lƈæO†ãçA s2õ¬ÎNÍ â‘:œÃȹ8B„ÍtIrà\T¼¨öO°L´ÐaFš½ _É w…ƒï¸yU‡>8 …ot ÓQl"Ô„°ºDâN¼,­Úè,­ÀžÖâ8­bOkÙOøŽGMMÓ–Hà–jÕ΂[È32 O„“ËfšctŽ`ÇÌq”˜y©™i»Ñ43݆ =3ê'jU#¯Ûò[³”6SõnÚH×4cŸUâ1§ Û†ê8ðº©îmTk£³T;{ªˆãT[ˆÅb­y6üõ +¬óƒa ה뢩žk]vÒÃrŠ:Üž÷iÀ²qP§ÎRçì© ŽSg!NS·Pw{·ú¿NÅ@p²÷ÑIJqp¨Îrèì9 Žsh!¾ÞU˜êdw[«Å÷Ôô)k]™¼·›’—K}Æ,=õuÀ|nìx`ýn25<“$s2iÙL3iŒÎ1éì˜"Ž2i#þ7&—ÖÝÏR0Z‘Iwj›Yñ#“SDb¥nF;¡ds–Ïi´žÎc¸q6{¸~®]Ý]+÷zù>=/p>Z¨Ý®½«¶•.Û”JŽjk3ªN_“1\›~©Ï˜"£)ÔGöú¯n£Êu +¥eí´°Î„’H΢ÔX6Q´ÑYU€½,Äq],Ä>¸Ò![­M†Ž²pr}¢;sî?Q ªM>Ñ &@0£–ìÕJNÔÚ•%ôm$jZº ùá.Ð̽ Z6E´ÑYE€½"ÄqE,D{ä¡A×VøázžÂ3§G«8º…à&¯UZ™ÀÍÍþɲ<´>|lë\ aÝÝpÈËí£*o^`AjOV8¥YR :¬jí%åEc¶dt¹¹´É»#O·@ “R2Ê}6!?–ž¹[´l¦å7FçäwvòGå·W¸D§Óx ¶ÅòÈ¡Þ/U„º¥a.„¨«,¬T[Ž*!«ê™Â¢²KÌ9ôCC×½ºõ=^c,­p'Ä®º©HÇN´0þ˜ãvÙ*NÅ>¯¨˜;Àv5•ÉY-'¡z%°Æuì°–›½ZÙ´uÞVD¨ð«/øä´½aÁp¦cÙéÚÅÒK’Ùº)f%s•oàê4KrƒP`?téCÍ°U·¨©[’pµ£f +S§§èÞã)A“ Z»íM¦%Õ6ç4u u¢àFUµà&N(¹uS3ˆWê}<¿Þ–F’.³è¢ö^äY÷ù¤ê¿©‹eÕl[ ò–Éó¸ ?IeÄB)Çïñôúý©{¼þN)eÙT² ÁïœQÿ JäÐãH¦ÊÈ—ÿ˜@M8endstream endobj -5006 0 obj << +5104 0 obj << /Type /Page -/Contents 5007 0 R -/Resources 5005 0 R +/Contents 5105 0 R +/Resources 5103 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4982 0 R +/Parent 5083 0 R >> endobj -5008 0 obj << -/D [5006 0 R /XYZ 85.039 781.388 null] +5102 0 obj << +/Type /XObject +/Subtype /Image +/Width 541 +/Height 173 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 8338 +/Filter /FlateDecode +>> +stream +xÚíyTgÖÆe“8.•hTÀ%b0†¨qA (.‰(Q4.ˆŠ Æ#*‚;¨1"`DA 2‹Äã8Ǹ$Ñ™˜‰—cLœ8ƒ&愈q”Õïù|ÏÔé„´ÝÕµt?¿?8MwuÕ­{Ÿzo½OwW=|H!„B!„B!„Bˆr4hЀI „«ê“““««kpppAAvb»sçNëGà+E!:šATTT\¹r%..®C‡7nÜÐHl‰‰‰3gÎœ>}zRR+E!:j+«W¯ ïß¿Qý©G„††>xð@zË»ï¾Û¼yó-Z$$$Ì›7¯Y³fxœ-­§cÇŽ5Â$ÈËËëĉ5¶…©©©žžžX {÷î_|ñE±õíÛ÷ôéÓŸ}ö°R„¢Ç¶òßÿþ×ÕÕU<ŽˆˆØ°aCIIIqqqll,Z‰ô–˜˜˜»wïæååÙÙÙ‰Çùùùîîî5VŽN´iÓ&éyö²`ÁÌÊÊʶoßþüóÏ×ìÒ¥K]ºt=<<¾ùæ‹Bt×V0Î;::ŠÇè/¿þú«x|ëÖ­gžy¦Æ[Ð5ÐV¤Çöööµ×o¸Œa[‘@Ûrpp¨ýÆE‹­]»V<ŽŽŽ–š!„µ•‚‚i¶‚ѾººZ<®ªª’Úá[ê||íÚµ°°°ž={¶jÕªaƵ»IÖþ†Xee%Âøᇠ£Â“¬!:[ˆÍ–~åÊ•èâqÛ¶m1I‹ŠŠ¤vó»må¹çž‹ŠŠ:wî\aa!¦?&´•ƒ6¨E~~>ëEˆ™Ç»6¿ù)³··oß¾}nn.+em¥¢¢âûï¿_±bEÇŽoÞ¼)^Z¸páºuëJKKKJJj|¶R[iÞ¼ù±cǰΟþy÷îÝ&´•1cƤ§§>³wïÞ±cDz^„Èr¼k훟"°ÊÊJœ=Jg°D×g/ŽŽŽ˜›¼õÖ[’ïô°Þo‚ÕßV0×èÔ©“ƒƒƒ››[ttôã¶ÌqИÐË Ÿ¼wïÞÿøGÖ‹Ý í|óSZ¸¼¼«b¥!DmE;ßü”f+)))AAA¬!„è±­h盟†Ÿ¢Î˜1£°°Å"„ݵ|óÓðIôÌhúõëÇbBˆîÚŠF¾ùYãI¬í‰Å"„½´­}óSzÓ%t44©°X„¢‹¶¢µo~š4iâïïíÚ5‹B!„B!„B!„B!DIªªª®]»öõ×_?~<777--mçΛ7o^³fMTTÔ²eË€ñ$^ÂX ã-x#ÞŽ•`UÌ'!„ØHï¸xñâ¡C‡Þÿýˆˆˆ   º»»7mÚ´¬`…X-VŽM`CØ6ŠM³ãBˆ~)//?uêTRRÒܹs‡ æææVO#°³³suuõòòûôé³k×.ž{Úƒt!iR‘L¤Tº7!ô"èEØN1¶iÓF$°Q£F³fÍ:þ<3cHˆ4Š|"±H/VB/‚^„-PTT´råÊæÍ›‹Œ¹¸¸ —••13æƒ4"™H©È-’ŒT#áÌ ¡A/ÂZJddäSO=%RÔ¿ÿÜÜ\¦È‡3‹ôŠ<#áH;› ¡A/š())Y½zµÔPFŽyòäIªÅÒ ÉHµÔ\P~‰‘Ћ ¡wªªªÖ­[פI‘Š¡C‡ž9s† +Q$iùG!PzÚ„^½rüøqé*p/¿ü2g(êÎ\Péšx( sBèEЋÐcÇŽ»ìêêš““ChåuAP&æ„Ћ ¡q*++7nÜ(”Ö°aCôЊŠ +V_; ( +J#tˆbñ³?B/‚^„fùú믟}öYédø§Ÿ~bŵ J#M'Q2Ž9!ô"èEhö¸C‡‡f•µÊ„bq^IèEЋÐW¯^}ñÅÅÕ°S4Uô5P dâz(¢Fn]AèE[ö"öïß/~§Ó¾}{z)ú1P>ñË5” !ô"èE¨Biié´iÓDOœ8qâíÛ·YJý‚ò¡ˆ¢š(+ŠËœzô"”äúõëžžžâü6--´PJ1÷DqQb&ÄÆ¡A/B1>û쳦M›"NºñÖwvŠ²¢¸(1 +Í„Ø&ô"èE(IRR’¸b³¿¿?Åf­"DqÅ5ÌQn&ÄÖ A/B1ª««.\(ZÞºuëxÁ+ÅE‰E­QtÖÚv A/B1ÊË˃ƒƒÅ,¿,d# ÐbfŠÒó6¶½zŠñàÁƒ#F ’'žxâÈ‘#,í€r£è(=0!Vú׿þ¥€ü q»@Ȇ£. A/Ba/"''G\³T®+ˆ¶‚±7_>Ìo+kÖ¬‘+˜¿üå/æ·•÷Þ{Oö ԻﾫŒü qMTˆ‡ƒ¶Æ¡A/Ba/â矗-•ÑRc[1¾­,[¶L– ÔŠ+”l+ÿgÔC<‡n-C/‚^„Â^Ä믿Ž5 R¸­@0 6 + qèÖ,ô"èE(ìEüíoÃ{Ÿ|òÉ‚‚£2l+Ó¦M3§ÄÛ·o_²d‰ŒmeÆŒæijyó樨(yÛ +Ö–jXƒòmEØÚ¶ !q× ô"èE(ìE‹;cè–7$¶•Çj+Ð^```˜©Aoª´€‰;žCNƵ½z +{‘‘‘x„!û/+ÙV·­àÜÀäTl+$„MCNÆ5½z +{×®]—¯ýôÓ8~oݺUÏÂu.£AèEЋPØ‹(--mÑ¢8þ<Û +Ïgä¢B d¦¯¶ò׿þÕÛÛ§dèÑüq ×¹Œ?U¡A/Ba/bïÞ½綾^²h žm¶i! ÈL›m**++û­W‹‹‹QŽ–-[J¯ÖþUe´½zÊ{¯¾ú*^JNNf[a[±€̴ÙVpîر£¼¼üßÿþ·ÅóÈÿþó<äÈ‘gŸ}Vú0%++Kê,u.£)èEðèVÞ‹¸qã†]ãÆo߾ͶBáYH ƒÌ 6 ¶•/¾øÂÓÓÓÑѱ[·nbæ.ž‡J]\\ð|¯^½NŸ>-žâ¯Âm…Â3Fxè›æ|¨çááÌh­­(,9%ÛŠÖ¦0ô"èE¨âE¼ùæ›ø»g϶žÏ(Ä&„gÝmE Szô"Tñ"† ‚¿Ge[a[QˆMÏ´·/T•æ¡ð†^½U¼ˆnݺáïÅ‹)<¶e€Ø„ð›/he¦0ô"xt«âE´iÓüñG +ÂSˆMÏ–ÛŠ2Sz<ºUñ"š4i‚¿ÅÅÅ…§ ›ÛŠ¥§0ô"xt«âE899áoyy¹ÂÂCFŒ1Ñ Æ·aù„wàÀ‘#GšÏÖ­[)¼ßbÂc[±ô†^ÛŠ*^„þVWW+,¼ÜÜÜEFƒwÕHið‚ବ,ñXáåääÌ1ô ñøNòŪð@^á¡O½ñÆ&wºñãÇÇÅÅiMxâqvvf[±ô†^ÛŠ*^DÆ ñ×ð.ÞŠ §÷;`Ê”)~ø¡a>£b¢œ>pjÙ¥¥Œm0§ÁÔ©SSSS 㙽`¶cª£Û7ÙÛ +v?Ø8¶lÙRCu>A>I&áÖ„± á±­Xz +C/‚^„*^ÄO<¿Š}£Þ„ó™ùóçïÚµ+ êaaa˜Yô è¹qËFyÛŠ‘ç3ñøûû‹xp&‰xzôJHJ½­@xñññ9¿šÝ¬Y³0}Ë|ö%nkœÓZ§C;h°­@lBxl+¦Á>ܘ{ÖЋ ¡ŠѶm[üýá‡4ÞV¤kåa$Ç“AAC÷íKS±­¬_¿^ŠçàÁƒãÆõOMÝk‰¶bÌù –D[A>·<gVxòõ°×Sö¦h°­@lBxl+E‹-0-ÍÈȸy󦑹үÑùµÎšò"žõ½㽈îÝ»ãïùóçuÔV/^ðᇎ¾¾îò +ñä¦'ˆ'66¶ì+V¬˜7oVF†ƒ¿7uÛ +2#¥§‹ãÇ{ÇÄ,× ð 6!<¶cèÓ§ÏêÕ«¿üò˪ªªÇͽzªx>>>ø{äÈ……‡t3×Ãb8C[¾|¹(tbb"fcÇöINÞ)£ð²³³ƒ¥Œùééé­`U¿{Á¢ÈÈH/<<üä#BBB¶l‰[º´ñèÑ^Ä&„Ƕ"ãĤNèEЋPÅ‹€zñóP……—/²O®`äÞ¾}ûbcÏž=_}õÕ±G|þùçˆ$:úÿ¯Œ§AáAlBxl+2NLêD¿^„›[sMyƒw¢a¼!n¼²téR¶ ¶YBÒšð 6sn,ʼn‰ñЋ°b/¢W¯öšõ"PSü;v,Û +ÛŠ2@lBx¶ÜVdŸ˜Ô ½zªxbÎâææFá±­(ÄfŽ3³IU4;1©z<ºUñ"***5jdggwçÎ +³4ÄÉAxuˆf'&uB/‚G·*^ôë×>¬¼ðâãã×®]+¥ÈðÛ©©©‹-ªó¥ÿb˜2ùóßÂÛ¸q£a?¥Á¶¢°-ñ 22Ryáaljœ”¢‰'JSRRæÌ™SçK5þE[™á-[¶L^áMŸ>=44ÔLá!…‡!]­ËpAHDiqlWzl+*zsçÎEœ¯½öš%bX±bE=ä^``àŸþô'ÓâA±žþyy…7zôèáÇ›“%4J___…ççç÷Æo¨¢:Éü«óY Á¶¢–ñË/¿4mÚK~òÉ'²Ç€ÑrĈ²·•7ß|sþüù&Ä3lØ0 ¹’Ø6lØ#­yÒ¤I†Â3¬¸áKÛÔ©S Û +&,óæÍ3-EÕÕÕC‡õ÷÷—QxXÚŠÉ÷ù5HB‚œ *ŽêªC/‚^„Š^FWŒ]»v-++“wªŒ!N^î# +(=>xð`NNN/Õøm%>>CñÝ»wwª2cÆ Ä#拾ÑVvì؆õ¸ñHS(Ü°­8p@Z^^^vv¶ô¯áKH^­ý’h+ C† ©¬¬TLr$!ANÒ5½zjyÒ€€*È;UÁxkØVdA´høqŒü;wî´P[Ù´i“ ¯˜ª@]†mÅü;2`mXgTTr¥˜äUKœœs A/BE/âôéÓbvóÍ7ßÈ8UfÿþýÇȇh+XóÌ™3—Ÿ˜ªà]8pŠ5P&°kX!Ú +Öò¸òS¼gh½{÷î'}úôÁñ•øÅäÙ¿Bâ`®)èEЋPÑ‹@Qð.oooYn;.¦*Ù&Ožì/7èãbØ4^~bª‚·„††N”±fðXò“¦*"KAòó=±ZeäÁ@6$Äa\kЋ ¡¢qçÎñ*ó-MU,‘ò“¦*–æ±ä'MU,Šò?‘€xtt_›‚^½½ˆãÇÛÛÛ;::žVÁv@¹QtqŸAÈ€ ±&èEu½´°Å‹cÓvvv111¬…-€B£Ü(:JÏÏS¬zô"T÷"’’’Ä83iÒ$zìÖ}‹‹³ ±bèEЋPÝ‹ÈËËkÒ¤ "éÛ·ï?þÈÒX(+Š‹£Ð(7bõЋ ¡z<.\¿Õ}úé§Ïœ9ÃY((Ê*~c‹B3!¶½zêrûöí 0{{ûøøxïÖqÊŠR¢ (+Š‹3'¶½zª·¼åË—‹QhÈ!ׯ_gÉô ʇ"Šó”•'«6 ½zªsìرfÍš!ÎæÍ›gdd°pz…CùPD”eBlzô"T§¨¨hØ°a 1nÜ8y¯¥I, +Š…’‰Ú¡ˆ(%sBèEЋÐ»ví¿©ÁyïîÝ»y†£ý³”ILRP8”9!ô"èEh‚‚oooqê;hÐ ÞãI³ 4(¨J†Â1'„^½Í’žžÞªU+1áš={vqq1ë«PE˜(ŠÅœzô"´Ï¯¿þŠ±ËÁÁA\"511‘—“R”…)EiP ”‰i!ô"èEèˆ .ˆ{gƒN:effò$G­S$%µ@Qø;GB/‚^„~Á\L|Sxyyegg³¹(ÙPp¤]ä…@9˜B/‚^„Þ©¬¬ÜµkW»víÄàæééùÑGQŠ––’ŒT‹œ#ù(äHèEЋ°&1³Ë^½zÌ™3gÓ¦M˜,\¾|YÆ»Û`UX!V‹•cØ6‡Jó}C$BEÀ›—'„^Ñ8W¯^ÍÏÏ_»vmppð€Z´hÑ ^Zµjåáááíííãã3jÔ¨ &L›6-44töìÙó À¿x/a,†…ñ¼Q\-¼Â@0 !<ÖˆzDïBÅéÁâââ""" ÔµkWé›áæƒUa…X-VŽM`CØ6J!B/‚Ø………ß~ûí™3gŽ=š———™™¹{÷î;w¾ÿþûqà_<‰—°ÃÂx Þˆ·3‡„Ћ A!ô"èE˜Ìÿʆ&endstream +endobj +5106 0 obj << +/D [5104 0 R /XYZ 85.039 786.531 null] >> endobj -1234 0 obj << -/D [5006 0 R /XYZ 85.039 761.463 null] +1086 0 obj << +/D [5104 0 R /XYZ 85.039 766.606 null] >> endobj -5009 0 obj << -/D [5006 0 R /XYZ 85.039 741.134 null] +5107 0 obj << +/D [5104 0 R /XYZ 85.039 748.602 null] >> endobj -5005 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F35 2880 0 R >> -/ProcSet [ /PDF /Text ] +5108 0 obj << +/D [5104 0 R /XYZ 85.039 676.933 null] >> endobj -5012 0 obj << -/Length 3762 -/Filter /FlateDecode ->> -stream -xÚ¥ÙrÜÆñ_±¥J•°U\ .ù!¡ŽØtt0";eûÜÅ’ˆ°ÀÀŠb¾>}Í`° J.…9zfzúîžU‹þ©EûA”/ÒLùQ–-Ö»³`q3?œ)X ÈÊyysöÝß½PŸùâf;îû:Ž7›ß¼W?^\ݼù¸\EQä©Ì_®Ò4ó^½½¸^*ïúòÕÅ[œÒÞt?^¾¿Y®”wùþ†G˜Ÿ¯®>àÜ2‹¼›å7?½¹±hÙ…qúïÙo‹ àÿÓYàGy¶x€và+˜ÞR~¬#é×g×gÿ´[ñœ^ðª9ÄQæÇYtJ;4P*ô#.Ò8ðã@ŠõïUöø_5wp=xÃ}‰"&ÎIì§QGâʺ]ÆÊ[/ãÐ+pqÍ ÂÀYj?ÒfÁUW5CÙõ 7ÁL‡@¤\à¶m TÝ”¢¢¼¡]®ÂÔk¹WmÁÇe˜yí‹”Ø&\pþºØ!ÄmÁ{€ãqhà¯Øì`„š‡¾Ä+t :I¼¿#GqÏv‡È.V*Šü ‹±œÈ ͦÅÝXÚ†¿{\%çÀGyw,Cý=à -4Ú0Øaß}â^Ñ3PùeOW%\Ö}6°Ê'$„Z. -Î%C$CÝ#­€tôš¹¢¼Ã†É æi'ž—ÝgD™¥€§kþw/k†Þ]±+«Ž‡ð@a\iÚâÌ7Žf>ïÇÌ àܶ•ýîʦì -C8¦¼së˜%ˆ•& [{@”¦Þëòsµ.¹ýŽEf#]Ú×ÈR—I%òÍÏc¤pØ À{6vHŠÞªöQ4¥É«¶iÊõàûƳI¨Lš˜‰,\æ}hȵ©”ù††;ë–L&7l“ÇÑ#ÀïAL˜(QÉ(L†¶´x‚vlM@E'hCTLî¶æ^Á÷^·Í¦ÊFa@ 8È~k:“|¹ÜÌ%‡,:Ô‹OÂ!S„‚ƒ;¦=™|:xSNd¤Ò[¸ -%¿§’ÆãÄë–—‰×îRJ6·¡%º¤[²ôÃèïÒÍصʘ7#ufÝ‘<¡™­š‰¹]Z[Ì"Y™ýxÕ4~+7TÆÄ×VÙQÎä*Ëü££ˆœŒ${ - -Å—r.RÏ?NO"uŽP#L£v£µc(Mq:ÐfM’”GÙæÞd˜1ñLÃ]¡EǽZn5#û -Bóãé(äaƒÜ܈UcæV™Ÿè¹üp½EÿÈmÏØØ>•Ì…iín‡G3Mbí§Ø¹b`8ö ¹óµ‘èœÃ Ž<û/$4dñQ” ä¯Wø áέUɾ7¾°mŠÚ -‹‘‘—þÅSEw Œ(ÂB ,Œ -Ð 5' -ý ¹×óë,k4@פ$Ý°> 'N5Ìs?„“bÈã8ýv6ùa:Ÿ ¯Ì^+g³S÷¡nΞˆwûH±úë·oùZW”æÞ`]]r?-î…ÎKÔ”nlV ;Ö-.gÎOr û2k{žÂ¢®µ9å•1è.Ë‚?Ç-ð=dEº¶>áQÔB穯ãüÏñHöZ9›ò(Œ?[d€fxôîâò½ÿêJz Çl\•:23˜¾³ùk¸ãØNŠª’t4×If\(p u¾çÁ²,;Þ¦jújSòúb®ÒÆ>˜1!¯?àÒkŒº4ºZ°§-Õ/sþ>Bûõ0D¦µL°?E!|­"Ù IÄŠ@~ƒlªåpé -J*!ð7‰$‘$J6D—WšúÚ›)‡Â+©Å)BIæ‡Êäz(Ý0sP˜SIp7rì`B¤™]ÇðÍã¯FèÌÓé‡ÖÊW:¤ZÒ È$Ñ¢ûxìÙ;î P‰8:JR"K׳‰‰Dzì ae!Ž¶C§' “dHâòlONóPÿMFƒÅ*|ö9¢ì›Ù˜ót¢ÔŠ+¤ÛÁQƒ(ʲD¥eYu¹á9›©jÐ(б¹ N³9œ‚¹U:˜’h}² CX!v«¡çÆon,õ—?dƒû¢+Ï+„81‰€O-éqÉ@!1Z"Rèõ‡ŽZí·&!4O"@ë$Bb7ìSèÀ™g áÖ èÉÓŒ Ë;)Öè©@Pyï\á9ªpoʆò¾Ààœâ˜« :Ö6àêËzËSXÁï-^¯BÅG8¹;Î#'ž“×ÂÌ ` ²‹FÐùÆŽ`§Ðù°— zþÕAfØI¥].iíÝî_]‰ÿÅKbd5ÕGÝXsÁ¿8V:£,˜HÐÎY­30+ˆÕÎ}—P`û°}HLmzrb¤}0î_=ANÏ›¨y”û1„Ëîy¨} ï’k\>ʬeÅ­W›™6 ï¢ -,¾ ˆ¾£‚M9çYÀ"ÙuÄŒ ôá‘Ï­ÎÌŠºúŸ);à8Z¶%/:­Cð8×Ï`Å4ŸÍDª¾Š èÅÊXP´xT’ŠÊf+’%rtÎùÇÅð¤ˆD Äù7DdúŠˆзDäk9>oVDœóF£M«Ôзo+TÅ‘Þ#†ª¹ëyê×:=Êsaप À¶ ó•Ñ¡±¥E“Ð ‡]‹ki7òL†»‚ø†9[!6Áñ’`nÊ=Ü—æ1(¡¿q”±è“ Ü„ °U9lÛZQÑÜïBSÝÅû=ëTÊêЬ ŠI$×…¤Îçæ$c>¥uªµa¢!0E€‹ýÞÔ¾çb³Ô´‰Íä Nqß÷ec/˜siîJîWƒ„Ÿ‘éäç¶ `*±ÝUƒv½¡ípÔTë-¡Ec¶& —MqX„XM†óRøâ—%*¿»}]Råo,µÐWRŸÜ›2ž-p”û™ò½}­«Ðœ†‰×“åŠàZ==áÀ¸›Snd¡Ÿ)c ß’ý~™›•U’;ìÀ‚s!Œ†Óì«(¶I‡â` ÍÝ 2J¥¾²õ =ƒ\:±õÁ€$WJ©EŸ:…8ëØ)étŽt‹éB3ã{ÚÎ장~j_æöÆßµ“>• ç•þsP£gª€§ÓgngÎÓSœË´MTû,§&¡È<—'Ï{»vžgVû‚k•RÊÞ|ÏØT±Ü»çQ$xŽÕõ@l§/g ,”Ü—ˆ±¼ßŸ?)²5Ø—ž<’𨀠-S·´lsôß ¯éDü%ä¥XF™«£ä¹ŸFF0øù(Gq”²viˆx²çÖ«É ¹ hü§½t÷ò -ÞsŸ”%×3ÏaÎZ)OÛ‘yÜØ…RSËü,Οø9îž*Ñ„iÀÇð«'7®½‹z,4ÄÈ/IQÊÎÙJ˜F`ņ7Å÷<ÒèT9.; Æv¦?BIåY”“PaL¤Dl.{¤HõäéýÔÛP–)™äVÊaÂ,[‰_ÎñÞ“?âyoŠ}aªŽï³8h‚>ônµ'ÅL7u[l–ãÃmfì|šZ8~9Bö?zxžÌõÅNZTš.¬„c™—&ó9—$Îü†çª­Šqž“>© ôž“~ÍåŠà½ó± - ~vÅ¡÷P™÷}èLÀ#ÌhôV6°7iš6z†›uÄ#”·Ãb`x—ôGlWõ½YP™=Y¨÷ðçlNIÙäJ®Ü•’½œÔÔT„†I›îñ™…ÕD‚õI’`j?æL,…:;Ͳ¦’Ã¥‘,ñ^äŽ ˆ½ãÛ°³c…fK%0K‘L€l BfD²’¢n|ë>Ò´ïWÄÐù’føál,d‹?õ«J§,êgѹp†~¨ .\">Á×üúòáÿ΂N“endstream +5109 0 obj << +/D [5104 0 R /XYZ 85.039 676.933 null] +>> endobj +5110 0 obj << +/D [5104 0 R /XYZ 308.64 504.152 null] +>> endobj +5103 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F66 4190 0 R /F62 4047 0 R /F41 2994 0 R >> +/XObject << /Im9 5102 0 R >> +/ProcSet [ /PDF /Text /ImageC ] +>> endobj +5113 0 obj << +/Length 2915 +/Filter /FlateDecode +>> +stream +xÚ¥koÛÈñ»…p ` +ˆx$wùºoÎãr>\œ4Vp-®÷i‹ %ª$Õÿ¾óÚåJ¢\ M`pŸ3³óžQ8 à8Ëb?Pù,Í?Válµ¹ +fO°óá*” 9²pμY^ýøsœÌÂÀσ|¶|´pòÀód¶,ÿðÞþróyùþË|¡”òÂÄŸ/Ò4ónï`íݧyè}¼¹½ãÍå|z_æQæ}½_òÒ—÷¿ÝÌ3غýtw‡¹ý|?ÿsùëÕû¥¥Ì¡=T +éú×Õ³ÞðëUà«<›`øažÏ6W:V~¬•Ì›«û«¿ZX¼§g|kŠ æÄB~–é—YÇ~¢SË*:¬ +ƒÐך™CÈ«azú¼0Hü,Îf°3„æÌÆ0v1†‘¯Âèã¹Ûíµ=r€A…ƒøç^ÙnŠzËã l¶E#Ó®Åk;¸§’À{{sǃ‡ù"JNžêï(ÏjËÓ.ÔOk\ä^±[l;¸ +‡»MMÄôu»eÂð !cX ì¡íû¡Þ>bÈ<`É"D!åôB|€Ig€?/ +÷_ø¯‚»€dšƒeZ`‚åCÓ>À›I:>’€N¼Gwí†'Ú%Iã¸T•|ÉJÆ,381Ê &ä}QŽ÷7¤”ÚƒHHP@¿µ´¾º@Y+Ç>Þ»òá7ý^“´ý€ç•öwK8™Tp› +ð§#¡ðTÙ(V¸Ï­·UIÒ ~×=›s†dÁ®öáŽgKÐü#Ö,pfÜ(š÷¶Ý‚ +è§}‡¤Õ@ )e’z÷Åæ¡àáÝrÑszÏMÅ+ïPx˜§Ëyïaõ—^~ú²Ïœë“‚ýGÛÿºî™‘eEF·êêP4Ô­p¾¹°"€ÅF`†¼4°¨p8*L +¾Œ:YÔzŽg^!$(­¶Á–üAÇ`X¢î¬È!rCHÁÚ½Ü[³Îðdhð•œØïð11ÚÃRˆ…†B¾Ð±›ê&üG5¸.¥^=ðʪÝ7%/!ËŠn¨Wõ®*ÞFÕ¥ãÌ/QÚÐZ î‘iòñθަ@¦ÿû5‰‚(Ä°¥çîš tܱΒ٠W l¿GìY[Ä1XêÎlñ¾`#ÖÔ"v£¡¸4ÈZUt‘èP<á¯e.¢hZCû(2Z“­?+'‚¯åÐåB~ã…g’½Ò7¤F©䬸ïÑî3xêB‡šPè0¶nÇ»®%…!MªH©:Ôq&^i˜Ýƒ¾;N¥dpÎJc´ A=ñA±-ô§hb5Ü5> +ÁY‰ÃØ|)ŒÑ] c>‘üM;T ‘¦äqŽV3ÎþiOD +5¤ ¼‡fVtd;ã[C³\¥§¶¾À-Å[Är¤ÙhZqâݼ½*¶<°xµ[oDãq§gén:÷ò8T‚¶«ŠÒxœƒÊ³Q"ŒÒz¸•Õ"ÒM– @?ƒ”´öõ–Mç›]jŠö‚C»RdÞ® óGë r6ʤ +è®ÅÅ¢”¦ emAfa-ךÊf r“<0~Ü¢¤aàëdùTŠ‚>\,„pÔðqϼzïúðs]`n~¯;“Dl­µ2Ÿ/¥:ý<É_Œ®Î›"À +ʆWh_§‘“"„^ˆyBŒÙ@BÊŽA_òY'úSªv”\ X½Hðxæb> ¡”Q’Ü’{ÂPQ’N‡,XæâYd÷•»1×?¿{Ëë’àPä/ëÖUæGªR• ´t¿Et<žà»ëÂŒCdž4AåïØ­æ¤Çû¨ _Ú±VK¤ÁLðY ‚®mQ–Tcª‹;ÅŠlò]Ö/^l;Ø´S}7' +¹t¨;:Ÿ€y¹6c·êÑb–g€¦%IÆ™Bë q¡£‰‡[x¤b;Á”}Oú©Æ’Æ×ýX\°Êkܼ=¯¦>"+†Ô÷­ñ/Âé1UŽŒ%(ûF[‰Âæ9ëpµ º!¤Öã"å-F‚Ø3¯ö&3' uClÄ-_ùRN"ì f Jå,²‰“’ZôMeH¢%yqlr³²¾ÂÌ)WF"´•ŒéI™dÅÅQ¤Çíû›°òWn^óR±•=æj†É‘Hç.GG4VøÈ%a?=ï×™/Âkt6µª$x¤Û8:*Lâ.%ÿ¾²¹¢Ô%l^› ?Hj +®sáºQb[>äþ '1 ¦~ )ÅOøÀV®„çjå'Š;"]Ûœ¸ë~󰃜ï€ÉJ{‹B¾5»=zósŽÝU>pÿñ  +øÔŸxú7ù7q÷K5<ïªÿùúMYVB-nçÐùŠ_^~ùa]¡ÔqJ/Õ±ôª3.S(€eŠû¥ŒyËz؃,ŸZ&.J)Ô +4ãc) XÊ>Œ8Š¡x(z9C€;È¢ÎÔ£b’Àž$¼V'N¦âã¤Sç,›òà¨/‡šü®ÑGÑ¢Û“jî݉S³Ç›E\<ý0QÆ, Üi*”·-6•¡gÒ€®ÉYJ~umÆõ×ph„2cã.x†ÖX‰xA„G‹‚=Nª­€õX±ïDþ¬mÛ °l…Uò!±Ýkôf u^†åÀ7[lÈòðuÒ¹jXP0Ø™˜DX:@a™Ï™÷gºJ嶆ÂçïD÷|ÄHšX WSµ• FÅÙ.Û…¥VmðÅ m¶ +P1g·Ôè€m›?©Xy…dÑp¡“%zJ1ðäwƒy)·Ô`ùniPI$]‚…m+X¸Fòy²€a2ýŽQ]k˜N0¤$ªŸ)ˆ‹nIâcj“ØteÁ]¦LbÀIÖ`s{Œªí;Ó• ïÀðl?“aŠ£Žê`âe×=ïl¹l_HïY8ÂoL3VùÇ¢on^ `C‹Ê©K‡kk‰,8fvÁ+Þ[w͇ÑAã¹'Þ¶¥Úò×^¶‡{;×US¢Ï€$òΖɰ52óº«Î‹wl<70™3ì€!—â|•%ÇaŸGÓëÁ17r!rR +ÞK×mìåI|sò(5ÙÂuòØ;­ÆžÐyûä”FÔ=ɽ¯ý؎ɽ$éÊWH0 :—R G„t‚ÈÓ$¸¹è×Ü6ƒ‰Tâç:zŽÏØ]o|䪮ú‰ŒGG~(9îtŸÔ€IÄ­7ÜC&pBIæ¡À°U;\ðEÊÓžSöm»Þ÷ÉQÓƒ?¥©!ˆy ÉJàÇ¡:Î ÍïfÜKr:”}]J“JÜÏ ¹Påëô”Zªƒ3,«(6S›~;Å°,óSËuÐ&Æêòo^ÙYí{ßrrX.!]åî6üM±Geô[3~@! C+N?M‚1@#‡Z2 Dîtïr=Þf‡Ï&« ò“<>â°TìÚ)·ã³RTjlçÂÙ#‡… œ¤Ú©ûãËM 8ç–϶ŽÎ$‰±'„f½›±g0cy®ïµàí…`‚-þj#‰‰’åàÍO[HðǼù¿~PQ™ŸgúPqùQh‰¡ÆYªO)ŽQ25AòzXòEendstream endobj -5011 0 obj << +5112 0 obj << /Type /Page -/Contents 5012 0 R -/Resources 5010 0 R +/Contents 5113 0 R +/Resources 5111 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5016 0 R +/Parent 5083 0 R >> endobj -5013 0 obj << -/D [5011 0 R /XYZ 85.039 781.388 null] +5114 0 obj << +/D [5112 0 R /XYZ 85.039 786.531 null] >> endobj -1238 0 obj << -/D [5011 0 R /XYZ 85.039 651.823 null] +1090 0 obj << +/D [5112 0 R /XYZ 85.039 685.011 null] >> endobj -5014 0 obj << -/D [5011 0 R /XYZ 85.039 632.951 null] +5115 0 obj << +/D [5112 0 R /XYZ 85.039 639.937 null] >> endobj -1242 0 obj << -/D [5011 0 R /XYZ 85.039 455.095 null] +1094 0 obj << +/D [5112 0 R /XYZ 85.039 491.969 null] >> endobj -5015 0 obj << -/D [5011 0 R /XYZ 85.039 431.777 null] +5116 0 obj << +/D [5112 0 R /XYZ 85.039 457.427 null] >> endobj -5010 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F14 2895 0 R >> +5111 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5019 0 obj << -/Length 4263 -/Filter /FlateDecode ->> -stream -xÚÍ]sÛ6òÝ¿ÂõKè™% ~æ¥ã$mâ6Ó¸oÚ›¶3GK´ÄF"]’²ëûõ·_A‹¢¯Ó{¸é4Àv±ØoÀÁ©ÿ§Y¬|Ÿ¦Y t–.w'þé¾¼; b! æõõÉ—ß$Ñià«ÜÏO¯o‡ubÅúôzõ‹÷æýÅÕõ×?ž/´Ö^©óEšfÞ›ŸÎïÓ囋ø)ò® ûãå÷×ç‹À»üþÃ#Ì?®®>â·óL{×ç¿]{òõµ%Ë"r¤é“_~óOW@ÿ·'¾Òyvúm_ðywD©8ÒÒßž|:ùÁ.ÅߢSž5űr•‡ñ<›’@E‰¶l -ák¤t” ›‚ T:OÓØW±Ÿ€590'Žrï#ò ß”-0!I½wM¿Üݱ­Ë³Ä 0DL;gf‰ Ä!óOdv³¶# aâ­°YÝŸ‡™WÊPC6SjÖ]_l·å -öE¡wÙã§Ø«:†nKÜTë<òÈ-4›wB”¸e‰òs8"媩êç¾@$çz/®Z£™£­$‰Š¢X&V5¬,¶ÐÜ}ÕÔLÕ nDèè7ð±äöÁ· :ë‡}âŠÍ94b?]„q¨bäp€’‘xw¸±0T‘Ÿ -y»âqb¡VQ dS ~f:êCèõ-PPm+½5üeŤeÞÛh -)jiì;Y§êù·±;”e±ßì[†ÿÕ¢Ör‘ǦYDŸvtÄKÙ÷[Í„‘dDÞë}ÏÌ‹b•…̺˜öû€`EÕ+… Àæ-¡è_0 a×> ;Â,2Ôr§Xþ±/H‰$äNãé>pŒøTáÖ72ŸnÍθßWw}Äœ¤QÒ‡%ÊÂç:‡ ¤â×ÇäˆL‡ƒ¸Ý£P²ù#úæ @3Hˆ”?‹Áìx ’Üëö8t‡ëy žk霊"Qá?õ‹žGvE]¬Kn£ààï1¥°:2¹¼-ˆÂž¾Ÿñ(ê!Û籘ž Ó‘ÓHdê{lµžì¯XÝ#eŒ%3ˆQYá×QFhßµåRNÀ뵌B§h‹u[`kÓ}˜tî]Ô²’#ÁÐ#‰g’:žOòÛìî¶"+4XÜS˜Öó´ûó8,ˆ·ÙËĪ#Š÷F>¦¶ö«ûݞĤJGÄø ½Á´ŸÐ2àæ"@\Z-(ÒâHÏ;tظ+îˆ<Ù -Í HÜÁ¿i -Þ6-7ÊÂ¥á÷æF¾ãQ5;î|`åÂ#¬1€æEÄ´"¹8†(…¾DÑà·ý/º¾iKöí¤f_¼îG¼XÎ'K潘c]j r4ƒK‚X%‘ëR/@¿ûÞ§²ïYŽÀ«¾E'[&;‚1ö+ÐLØß¡Çèxà¶9×¾'.™o¶dkYàmkŽå¾ly오ƒ|~¯Ìqç-ܾ&Š2ts]Ï­nìÃJã–FbfW­7Æ‚C÷ÆÈvî«’Ž˜t4óÅb"·6fòŸæÛ-‹3ù…zÝ™ÕÄËf"¯ÍN–6j)€VÀ2 vUÝMYHØ,-yh.Æ^ÙÌ£öî×ë-“¨E9 ±áÀ¦cà÷á^6û-ÛQüØ’upÑ=ƒÜem*ë!Éé ?[™`ŒoµÒ!ÖÑ~`k‰‘(wƒýLÙ€À·á àˆ;lK›L -ÑÌrAÎŽ ?¥ŽÑ‚€_è‡U(`·V;ûŠ ÝîË¥``í,+Ö<åðF+ü -×MÄ#°ª2f‡ŒÄõ·}µèÁ|³ìfÌ$cŸQl›5w +tÄiŠ_×àL÷ìJñã欹e)jvk%ðHær[Q¤óÙ (eq’ ‰AZ«‹|e™‚ŸìÖ°x)á,Ú4«ç¾]µ Rðm_•Ú5¥¦bàr›@"Htþ'é,÷–î/÷Ù¿µƒãPÏ¿=G’8‹(ŽpìIeìÄüÒÔ¶a™ÿÌç ÈVtÐá¸%$Äp ¨v<0ƒ4!Ê^܃¤òåÃí·†àGâbü¢D'B"Q [„Æ,|´ -RÓ¢mÃé+Ü5DršÖlK£ÙIšMºöØaŽ šñž'¢”Ór³’ÙÆ…¨ÛU?%åEÝ=XÍm9%æ€_‹ÀAãìSAÚpC¦†ÞÒ««<6²Wv¹O†cdxø›ó €¡8{Åb’4n¹Ô^bО¡|½8»]) }!B ÷ør΃ãÍž;¬C,m˜õð¼Æ¸cì5§e·,FÔ¿"¡M¨ù÷§ª¿C¨/¾ú‚%k‚üŸ6ç”QP[7ýWÓÊ•D¡(×{“oé,ae*¹í¨[ì­ký WÁ²‹ÄYØ£ÕsÏVxÀÕšZ&9²…©¢ü(ñ} -7+™K–¦ZžÅž{Ú¬¤P´@”Œšá®cã¤+$Ü£b€ƒèÙE®7Ë!q€Þ˜Ý×gš'Õ_K¶ÇÃ#¤³0ë¦5¢ˆ½A­}ÉZ|ò±¼>¥öÍZ+˜zëö˜šÜŒ/Ð]#^БÕ!¥aÆFé°ö‘B">etŠqê]€U8ô^­Q°’gKÈ(N•>R_eq.d‚92›ÏSu‚Pù™©ؤ ŒNG®†½3ò‘*LLS Í­¡¢ˆ *t¦üÀøQQvÓÕŠ¬Ã=lÈ{èÔž —Ž#•>Qµê0(]©©S:bsh—;rÒÈ‘¶G\5AT+ËÁAa×NÊ=>Ò܉˜0‹\'²‘…EOq#|äß <ñàáÍ´QÌZu}k¦ ˆV¦Ê’K Ä ä"× }cqãPÌ0®¸mcf©£¼·Šm²¬Ž7¶JÅ/yØ -"yÁ† Ò´_YÁSä¿üþ|Å¿W4ÏÖG:›‚6u±}õ4ÙÉs8»ø4‚|,ƒÉdG@Ìt²“@`€?O‘!èMªg±˜gÐA’©Ãt„Žs+àxë–2,èŸ;}Ær õ«Cea’·4ªŒ}¶a’:â 4Ú‡4žuÌ”ƒÐ*ˆ†…¯9ˆ9lÖAÌ£3§í ³¢+EÒW|óqö`|ô_s°–JÂä¡€fÈ Y'1‹Î -å,:#”ºÿ'ÊOŸãã4ÃGšwsè,gÑ>:è&DùZí0Kím ¶ïZç -¬å±c~-zªÿ[?¡ƒˆCB¼D¡‚ÙqW¡ÁÃé‘«@: -{–NÔ¿h¸ªyk½ÙÏR®(Kë1 ïôó¿ã1Fu´c’BXž§Ù¼ä8@Ç%Çͺ…YtFræщä¸èÞ85JÙ€þ¨‚Gɬv½+k>zpŠ¨(3WíX€=ÆÇÌWQ˜?ÃÇh†„££|œCgù8‹ÎðÑA7ÏGÃêÛ¾ïáÓ![óTÅiò?‹XÂ$QÙs’iafÊ0HT|”Ÿ3¸,;çpn¸.˜yuù`â)ˆHÖÉÕù²6yîw\=¹3!ÜLx*8œÚ4ͬ¥dzS §h -©ÑèùrÙX“Ü“<Ï^& bÂX+­gc˜d:ÇÍÁB ‰Ü±f• `fq™ÓpÙð…ãÅvõrTb†šëfÑYõEgô×AçXÃ(ð9wôssQ÷Ô¥D -±}«{.Ü-ß_Mð@lôÀw{XiN#±÷»ÝŽó ²‘0)È-“@KÊ#µGÒkS{GBé~ÏÞµ|k,•Êrų?îqÊÙK¾ƒ.šj¹2ãBæHÀ‹VndêƦDëu¹WÕ -‘Àb\Õ­2’°ck£Í~-C|u_ÙÇ@ë²ãk$¹‰ËHKV(ÐÏ$¹Ðq¹3@³qð,:#wóèDî\t+š™t»oɳÐÅSGâ4u¡ø¾Òq&ëÜ }#??Çî,Vqö» v Ðlð8‹Î²{a·ƒî£u£æzçÛÃÐg|Y µó„Ž€‹›N\Š½óµ‰Œ[i;<Ê Ï@çfÌÈñëpðr¾þK‡—†Ê×ñ3‡7ÍžÍF¬³èìáÍ¢3‡ç Ã LÝè$ ïLhºGºÜz(~ñ¦ÙŸÉ† à¿È’ÛK‰à•ñùòKNgÞð,[9Þ‰ø£åS>tñg¯U|&ö@lèÊ‚>“ºA¤|àÖ"HT¬9}Kwˆ±{±›G5ØI‘Ç/w˜K¢â¦[OcFRO¼àA(OâëÅ$¡Û`3ÞðkM˜ZVÈDtq‰o/›ñ¸Æ׺/Þh7µ¼Íà—Be¤å˜<蔳‘g¥«œ ÆoJGoFV2&kYç…qÈ…Hߨ@™Ç3 ý€Sä‚ §Œ9š×ÄõXvœ uäÁ…So'Ì&øŽ^þuÜ{Ø°ÊqÄÒ‘Ð+š[„.íÛ5ùÌ z²@Od]~“#µÃ¾}UÒí]‹^Þò§»‰/Aµ½$Osx¸½å¶’ÛtTÇXžÂï“Gãøe# ~¶“Þˆ|:;/ˆÄƒ$ÊG^«=–n½tñõåPX˜_ºd¥;Rû'ã·NçÙ·:æÂCg<“›æ×DÛOj[à/2ãúo¨²…‡‡Æ»Œ ¨UQðºGž¹ã§«")WS¬:~gõ ¯zßÚ­¾ 6:C(dWÛ¢w'ŠE§@æ6ý*ª¢)©ü-@=ÁªŸ™jݧ—í‚Ò)¾WÂLÂ"y>4U†Í"ôZþŠ¢ÚÛ†Þƒñõ³ ¾uæ°ŸÈñ;1~ˆº¢7—ÓêƒÛ¬\Å¡) _LFh›„†šé?)‰Tì› ¯'׈Uš›5ÌsðÁÀ`hÈa6Z.¹{³OÍU>Vm1|½uèø -l° /'YŽ¯’Pø (ô}Ÿ[¦VŠíŸ¨»²|`¼—ðºÃò©¿:Ñ™ŠìæŸøDeO«ÈjÃ`$—<§ëùh;shhM8ñìYûjº0ÿ3»þÖŸoÙ§Ó@¦÷@TZøøAqœ¢>$ø?s¡Øéendstream +5119 0 obj << +/Length 3036 +/Filter /FlateDecode +>> +stream +xÚ­]sÛ6òÝ¿B7÷Pj¦b ‚àÇÝ“÷Úô'+Ó¹iû@I´ÅV"]’Šãû’hçfšé¤Åbw±ß°šEðŸšå&Œt1Ëò44ZÍ6‡«hv+ß_)XȃùvuõÍ¿L:SQXDÅluçðQhŠt¶Úþ¼úaùnõÝûùBk¨4œ/²,^ßÀÜõÛ¹ +Þ,_ßðâj¾PÁûyœnW<õþ»Ÿ–ó–^¿½¹à^¿»ÿ¶úñ껕£Ì£]itýyõËoÑl <üx…ºÈg0ŽBU³ÃUbth-ßû«Û«ÿ8\¼–Ìx×”ŒÎC“ëK9(3!cÂ4ÉHMy¨€©DíþFÁ°“‰8«ùC;ÈÔ¶=”uó_ã·JoÏö=À\‰ûúþqgAÛ Äz\¨d¢xÇ°ã£h\3A±#¨ÜlpS‹Û¼‡çi¶«Ê¡n‘ ¸Â$Mƒw]EgôŒïòßx7 §…B1ÄwÙl… £ƒšN*‚ê#¢'ž‘ù§aWã™÷¼JÌT#0S;"K¾ëfSoBP?áÀü~Ï£ž©øc…ºÔ9é ,žÂJ›Æî2ö 4Ëý®~Àµœwáv’ȦbÙãÿï`òg/2`A åÖ÷u¿£sA½DK±¼¯ÂçT[©P¥úe³aHcXUaaŒ§Ž)üf9«#Xb91ܦ1Qp[Ö K.¶ÄM3Ñ3¬æÜÓ±Ü%Áä5©ÊUD7Mxšë0Iã ÷`žµ£Ô(°#M„¯v5ÒW$‘s°× åf¨?Ö4]YÍÄéNÖû–¡wd0ã.›õ±cmÙ²’§q,ï&i¦¨íWx•{9 wŠá“CÆfO²ê‰ +OxÓS’XyvÓ²Rw-êÒ^ȹԨ5B=±9£Ö ^#®ÐUÂÒ»ëW< ™Áú¦Üï­öÝ.ßÀÆoñˆ%Ï ­Òàfµ`WÔDÍÞJJ &Èæ˜÷hÍÆ£BËNœ…QQÈ¥ +ýrÂÙ¯‘JPbl><×DZ¤ŽÝC+l·–ùÝlZ{9ΣÀü]ÛMH†Ë7ß.ùkšÅ¶™fë+ö*¸¤~ÊdNLþTò°qú¤"wx¢b0¨ñ¸†—?ôâ"éë ðÖm¢RjŠ×!‚D¡°T°«x|  Äü‘áí¾Ú H&; gs:*À“ "ÑïæÈÚ£65¸*‚?±Q…q” +ø׳0‹-:çJ€ƒý=–žBÀÃÔ øªØ–,ì†C飸i‘ÇG D­¦ú„§¨‚”#Q99´Kòrè‘>§µ7IUp¡o’°(Ìu.[×óÆ`¼ÝO|Þƒs/è ˆ’I +Ò",T"h–ÛíÄIqæV†k +„CÛÐýlµÄ9…¢ï>ŽQ\:Û©D!ÉŽ0ö{²A…MÂ(5'‚¼˜ù‚hØ&Lt‹fuæX,h&”¾pð“ôeîв='^&#F¬5xsì\H"SÌc 'úÚêŸ0 厄 ~ùª‡1Øm;_S÷¼ðˆ“õ^ÀDõÜ!ûöþÞ†Vk e?ê=(Gi1Ed—›Bεm æ,îú‰ÕµìÔ†¿3xSIøìØËl¥ç¬CÀùó¼Wör¢t®ŸÞ±ÿÅ<µ.6©äò8rV›Œ+{4rØDä pðpa88ë4?~÷üo>u¥ä—p£¿¿›t'~®©Îãäço¨ªMøã¶mÎ2”óžO!ûáë–ÙCuk_W ‰F˜À )Žc*¨âXyÜÀ$k=rs"„“U׉qà—TI‚’ybÂ:B°å¡Â€„¼ÞU±/è7¬wÛŠ?Û;þöÏJ]@z‘³$‚¼ÀdŸ¯×ugÓÕúÂâZxÈ.‹ˆ$ŠCH6܉(Æ[(“€{ .Z +Ib¨¶ÿ4Z\Ÿ¡1ÉòŸÆ›·?½ýDüöæœ>¥a + +ñ%賸^¦Ï@RXÄù }ÒÃÁ{8ç4:T&ÿ24 +®ÏЈy¢wkÜ9MÇÄþBSI•þ"Z\/S˜ê<ŒrsBá-ìÕ+´¶·nV’Þ£Ã(IO¢%*Ë,Ê)—×™gS*Üæ\~Ü‘©â™ZÐmÀ¹Tq…¸`[O8ìA7«„g|—†ßìQÈ{Zú\c&;Lþá]UnŸxJBùD°–8»‰2-C6š꛺•o×@ƒqÓL¼×aúå^r^D=¦‡ëšö¸ßÊ”ë¾e¶Ÿ´Æ#kÂØB„ùƒ×P£vØ€,^µÍbB÷]IhoÛ’´íoXû%.àTK¿‚á,„êNؘpêóÁÚNÌs˜ßÏ7®Ç¤ ’ü벿÷\+O+ekþt©Ák˜ÈLz›»Ïa–ÇÏ¢¡M á‘@Ÿù,Û‹uf:u.+M¼Ö!”¸P&Îâ"!û¶e6 /öŒK mâ°ÂÙŸ3Ž¬(4Cxc¢}d‰&¾y}P³ë¨œy„ +Öň–]kî¹Vaš™Yœš0I„NlÅ9·%“礳§J`©»òcÅÓC˿ݱá¥ÁiEÏ+6Wfæµåù’òp^\{Š€Ç^h36€:PGG#AP-TS õÍØxö[_®ú•Ú4RËÐÞú·õØXãæâ…¢&… D֊쯩j±Š²Ù·YëcæEòb;9 àNúàI¨¡±¬à·Ð©íƒt4IÜ Ò*9´m‘T®×éú.ö¥¡øm¦\*UmÏ;2ƒ ¸¥{USïFŽ×æ8¯<™åQçä?y¡»—˜ùÞs»/½Ã)><}Ó1eŽÙÄŒïÄØ£ŸÎ·ùAÇ+`|nqí:\n-˜­Ró¿S0¶U犉ó¨„Ï›Fy‚¸ðŽäEþð÷qžÈF *{”MW¯O:?‰‰‚ÒkÖ0‘Ø~ÏC¯KÔpõ¦5$::ñ½Ðß&m†ŸÄÁum«¬Ö8kŸýûógÿX¯YزLÅÍɳ¾–×<ç> endobj -5020 0 obj << -/D [5018 0 R /XYZ 85.039 781.388 null] +5123 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [113.843 77.171 412.147 88.861] +/Subtype /Link +/A << /S /GoTo /D (samba-trusted-domain) >> >> endobj -1246 0 obj << -/D [5018 0 R /XYZ 85.039 761.463 null] +5120 0 obj << +/D [5118 0 R /XYZ 85.039 786.531 null] >> endobj -5021 0 obj << -/D [5018 0 R /XYZ 85.039 739.701 null] +1098 0 obj << +/D [5118 0 R /XYZ 85.039 711.163 null] >> endobj -1250 0 obj << -/D [5018 0 R /XYZ 85.039 626.864 null] +5121 0 obj << +/D [5118 0 R /XYZ 85.039 676.417 null] >> endobj -5022 0 obj << -/D [5018 0 R /XYZ 85.039 606.274 null] +1102 0 obj << +/D [5118 0 R /XYZ 85.039 210.444 null] >> endobj -5023 0 obj << -/D [5018 0 R /XYZ 85.039 427.349 null] +5122 0 obj << +/D [5118 0 R /XYZ 85.039 172.343 null] >> endobj -5024 0 obj << -/D [5018 0 R /XYZ 85.039 413.8 null] +5117 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5025 0 obj << -/D [5018 0 R /XYZ 85.039 400.25 null] +5127 0 obj << +/Length 1564 +/Filter /FlateDecode +>> +stream +xÚ¥WKsÛ6¾ëWèÍX A€ô¦ÆNã´u\[N'Í)‹ Eª U9ÿ¾û²˜\:‹x,»ßî~\ʹrž„ž¯Ì}öçøðaæ{Ê$óŒ}O3ßÏt¨¼P+7/g³ßz]¼§ç|j +†P%^˜¨Kd8Cz‘Ž ‡SÑìÀ©(é|JyzlrtÜ‚{ ®(ÑÖ¼³KQî_üÉy'ÝlP6o𷓆ƒ5Àª@<ä{Ú‡ bñ´XÂonYY»K[5EµqúîÖzIªZ¼äk™;Y{lZ§>EÃœxU·,¦US´›w…Q„–4äq±áÔ¢D}äÉ 'i…¿íù6B@  O x¾B#4—hÀ¡ÁCBùXâJq ×@ áSÀÒ ]’ÁˆØÃ!Ïœ³p<«÷iQ-zÍ0ž¶wuÍÏmmó¦½B„Â^ê–SQ– #cQåΚ‘Ÿ26?pàpb&rkW4<9XvnpІ[\·,”§L‚+¯·NÏE°œWÐãšPI–ªTÒÚ l­;¾¢{º`óÁk·d妭íW–¼&Ôœ¡i•M°ÆŠ¶GFV’k(wÖ#Ïù+^¶xÓóŽrfI–”¸Bþ}A¢0¢Æà(ô/ç<žî;?QbûJbµùóëÂæ›Î öV_Ãë#Å&. ¨{ì­ÔGË*z¬I87Æ$$H\®-• ±88'`ìBØE» œó.ðG„c"/R(Em÷T iÛªƒÄÏø)”@~”µ”쓃.×bi0©vf"Žv(/Ÿ|hBTri‚ +=ék'Ù¦ d^Vßö7¸b4‘8`| ˆÐ`û@ÌÔ:«ÐÖ-Û͆C"©¼dr‚ÌŠ¼8‰Ïrqà&_79n xúZ0åaâ·-%h¯ò—–áV#ðU¢=™˜óD‹\ÅqoG&Ü9Œ‘C01Ž-Õd…N¾sBFâï³rƒ“©ÓprÌÁ·µ;9„¶"îÃ…fW*yL vàè)žœchë¨äsÇäœl?b¤KRdŸé4'Pk™¶E]uê ”ïÒ¦9aQÖ6ã ¡Ôî‰{$AîãÏW<èIÇÛ–j‡üسµ9¿–¯¸ŒÎøÛñ=S$ó#˜{^3dvÃÐ!¤õä ÀEÇ$bÍ¥j.a„Íñå߰ਲr·—fÙPb¼R¹AG!Ú÷‰Ö±¤XøH'¸9p_×fØâ/_êA9S”–âÏE¢·›ä¬¡u½'¹m.©~“VÜÛVD§®¾» „ɳÅÉŒROaë7DViî`à;6y¿¥¸Q§{Ó)nP.(/Sï=t$ ýý^ÿ?’¡¾ D{JG£¾7„g M2ú -?6ý{ñ¶Þï©Ž±EŠÅµ5Ò£4aN§æ{æŒd¾Ù†‡:ö’$ sn9ÇsÛeW½~o‘¶ :Ô Ö]]5»âÀBAì‹fG`™±ø~ɬy첉'iËAÜŸQ ÞYW,Qu7µœHPöKÛܴ“"g^~¤> Þ™¥»Y‰Å¹-¹,¹æ™¬Ü‡Æ20jðð™IÝ2¹Õ¦ÏœPÄÏRÜ]ÈÒhÁ¼Ú‘ Ž ‡÷³=éÜ¢ùBµæ6ˆ^ˆô¸µµŽÿPy#0ÈŠ¦µ¿rw}“à+³×NöX.Îß*hK´šL9øg<ÿ×fŸ¸:×g0·axì¡2Š£×wŸ¢—&ÿÆéÓ¤endstream +endobj +5126 0 obj << +/Type /Page +/Contents 5127 0 R +/Resources 5125 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5124 0 R >> endobj -5026 0 obj << -/D [5018 0 R /XYZ 85.039 373.152 null] +5128 0 obj << +/D [5126 0 R /XYZ 85.039 786.531 null] >> endobj -5027 0 obj << -/D [5018 0 R /XYZ 85.039 359.603 null] +1106 0 obj << +/D [5126 0 R /XYZ 85.039 615.144 null] >> endobj -5028 0 obj << -/D [5018 0 R /XYZ 85.039 346.054 null] +5129 0 obj << +/D [5126 0 R /XYZ 85.039 574.98 null] >> endobj -5029 0 obj << -/D [5018 0 R /XYZ 85.039 332.504 null] +5125 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5030 0 obj << -/D [5018 0 R /XYZ 85.039 305.406 null] +5132 0 obj << +/Length 2165 +/Filter /FlateDecode +>> +stream +xÚXëoã¸ÿž¿Â@?TÖŠ(’zÐYìåè^q—w‡Ýý Û²­[[ÊIòfƒþóiYVÜ¢Säpf8ß ©fü©YfÃHç³4KB«Õlu¸‰f[XùîF …±:´ÆÀxbqáVIF&¤‹46¡É Ò¼}¼¹½£Y…I¢g§HŠDq6{\TÎÖFÁ÷M×WsÔÛùB'iPðÏ{˜ªVmÓ5›žgÞUÌÁ‡ +ZÜ°<Ò¸\ãrÜãÎïËù§Çg& +M”ΠW%$óá¥ëË“÷-m.™wSóìCqX¸ýæÛGF§½MC™)+D &³\_5Q¢M+54‘2¡6ÉÐDQ¦&q&Rh$“Ãát”ElKT»cm‹zÍê¿-ëòc¤ ®õÝkú ë«*žhHEeg*ûåm’…™±¤âãô‰mŒÎéÛj æ?ö蜻Gî…ÀÙ>¶:øÙ¨iq¬‚w÷@3ŠéžZølæq|Áíë²ãù‚äµ¢–Ùfÿ]ùT´…#œêwðQ²À=òÜV+Ü\ìYð—ª|>gB¤øa“X01FxXa2ätì5 +jKâ×7C¿è‚ÂÖÇŽ–ÚŽ?»SØ%Á¦m<ÝïdªXõGT'Ÿ€ÍngÁKwÒö h—<×W½^6Fv²-IhsD¥iOéˆkGÌ'À¹ºìQä3º i?ÃB8aðtZƒF  ’#Gm‚ úcµÝ•òY Ñ—¹µAA9Z,é§"Y/óLo˜°;àÙ² éýÞNÌŒFÝ–,§üúTÈ©A@ì›bÍ£e~/êUEØ3eOÇ÷ŠÓ0Êù@÷óÌNùªÞ`Ä´6.Ÿ`I6oŽrr\Êi¹qq lúF~Ù¼£´Œ3@¨ÄÌ,€@b2ÎK\h·BñË Cõb@~™¢cžx²÷hi:·GSÐiMi†–¦%Œé^£GzÎ%8ûHiça1p¦ôLÍuUÇœPUvÌBÃT®Ä=™ME–M*N1ÍŠ3„EYå2Cç‘,ÏLÓ3#î ñ¨àt. R(”«0Åqà)þõÓ¿1 I/V(}GòJ–‡(ÇaäxÂÇâðÙU´Âzµ¯D{9#ÎeÊ-q7b y‹zôÙ€:l9M0D‹ +Ch.¦ÿ“í`Ò@(—ˆ‚ÚdÄáýÛ.‹Î×\ g3ÁÀŸÆ˜€µ«¦pÝRCÆs>W!´×Ìþ§ˆNßt<ß kô <š, þY»—½Tˆ*Lÿ^T(&,Jš1º46Ííœ#ì9†Øš?PDlƒC±–‘lgc¼ÂgÉ87Xï{ï¨x€À0Þî2Þž?w÷¥SFbF€Ýz#¡[°ÊÞcUõ„¼T…‰½:K’}±˜(C•qïÀ m1ú;æ‘  LWÛºèKþ,ø‡Jµ°!>6 ZŸÔMÏ3ÇΛöa®îœ¢»¢=©½/ÙÎ{Þ¶d&l2®äd0¥Çf‚½gR/­óDr +F—¾lñàÆw'ügìi=§†juê àë…é@.r’' œ:éßhæÌ8{²ÅgY©ê³²âë.!~Pà +ç ǸXû$9çè– ð¾Êƒ+vVˆÐU5N2lÃÎ"¿Ãæ5Â>FHʯlPÂç’’“1Õm¡su*[o&ýãèScÐ`ÚßÞëlXshgmg³ü)Î{Z¸´XYBÍ7ã¦CŠ·5Øžä!´Ì²¿Þl'$¨$Ô‰ŒÝRñyȧF•+_®àŠ`Øö´LZ ÄTçXvÄ“òKý$RP˜âà„Äz5N¿zÖBNQwV¤¤¦$l_¶ÄÙ™ìž:|öm/z4NQßxzz—Ô8fí¼K«f +®$Þ¸ð/%³¤2Œ”Ή> O“S]mœj1÷Òe z@,étÇp*×^¸JÁUùÍD¨Ä¹†~ç*ÓÑ¢ã0S- Ñ•àÓù xÿçàÃŽÁõYYZ•œ5ZÖzºâøÛŠ{Àž1ð¾@$RÑù‚àðÒµ?)‹×ôtXu®E½õ¯ð½!Ìœû•âa}vÉíÐË&ˆ£èë|ºåÿ¾äóýõäÄBŽHó_=ú?ɵð \K\½¿_Ÿð7v6[ƾ‹<Ù°SŽì¨G¾r—G`Ëù-âÏ›Ÿ¢ÙÚðo¢0ÍÓÙ3Þ#Bè¯g‡~ÂÑò½¿y¸ùyøj¡Â|úÑBA nc|× mj‡ã_ßö+hèm’áU% µ~åÁQ9"tÄ·Ó–æ÷ˆýo.®N)„¾JgIê8šëêŒ9Qž¼Ö ¶O”³æö„5#•MlÂÈš)•/ßÝ„öºêP*"ÔÒ9ŽcÒüƒo?MÀ'Üì—T+%Øëâ –þŸä»»ŸÞaÜÝýã~b»»$]tR'/µ ñ—ùöKë§ÉV‹Šsf·œ„Ò´ý-oo¯tl£Ë‚¾h,OÜGªNä˜JL˜%Ékï}Pê2ÿ4À(çŸ基È?ÿꦒ84œe¯¾º)D{+/ àØZ°r»k½ÒœÒMJ(ÕzW K¡Æ+å“4¯ÇvãSm©««ã—›S?8„ÀXž¼0]Ò¸‡'*$¡ôsC[€Ý3h2CÛ4ý_ Å„ ÏjÍ¿·pñ§PÁ“O†ÈpÓ®y®yHÄÿ‡C#’Skÿ+;Þ¿ñ‹ŽTÐzrÙ¿û¨´ÁªÛw²£ª?¿ö@­mh´¾Š,.âN¤3‘“سã—èt,Óê,´™¾"ô?:ÿÛAendstream +endobj +5131 0 obj << +/Type /Page +/Contents 5132 0 R +/Resources 5130 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5124 0 R +/Annots [ 5135 0 R ] >> endobj -5031 0 obj << -/D [5018 0 R /XYZ 85.039 293.978 null] +5135 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [279.468 511.531 400.945 523.22] +/Subtype/Link/A<> >> endobj -5032 0 obj << -/D [5018 0 R /XYZ 85.039 278.308 null] +5133 0 obj << +/D [5131 0 R /XYZ 85.039 786.531 null] >> endobj -5033 0 obj << -/D [5018 0 R /XYZ 85.039 264.758 null] +1110 0 obj << +/D [5131 0 R /XYZ 85.039 766.606 null] >> endobj -5034 0 obj << -/D [5018 0 R /XYZ 85.039 237.054 null] +3091 0 obj << +/D [5131 0 R /XYZ 85.039 634.211 null] >> endobj -5035 0 obj << -/D [5018 0 R /XYZ 85.039 209.956 null] +1114 0 obj << +/D [5131 0 R /XYZ 85.039 634.211 null] >> endobj -5036 0 obj << -/D [5018 0 R /XYZ 85.039 197.012 null] +5134 0 obj << +/D [5131 0 R /XYZ 85.039 595.943 null] >> endobj -5037 0 obj << -/D [5018 0 R /XYZ 85.039 183.463 null] +5136 0 obj << +/D [5131 0 R /XYZ 279.417 300.885 null] >> endobj -5017 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F56 2890 0 R >> +5137 0 obj << +/D [5131 0 R /XYZ 85.039 164.866 null] +>> endobj +5130 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F38 2997 0 R /F41 2994 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5040 0 obj << -/Length 3056 +5140 0 obj << +/Length 1725 /Filter /FlateDecode >> stream -xÚ½ksÛÆñ»~£´cpÆ„¸ÃË3ý [vªŒk+§ãøD@"j ñ°¬éŸï>ŠÓ¤ÓñȸÇÞÞÞ¾wÌü fiä ™Í’4ðešÎV›#1»…Ž ±Ð æùòèäU¬fð3‘Í–7;<‘¯"9[¼?½X¾¼œ/¤”^úóE’¤Þ‹×§WóÀ»:qú·”wÓËó7Ëù"ðÎßüÀðóîââ-îÍSé-ç—?½\Z²ì…@B†4}>úðQÌ - ÿÇ#áË,ÝÁXøloŽ€(?RRÏ룫£Ÿ,*ÞS3>uˆ‘Lý(•û<"‡Aú2gI$üH(bBÛ”ý|¡Bå kxKÉã¼ØT L«=À¨Ë‡¶ÃMéÝV_æaêíΕ›§0T±w=_„ â¼8ÓvåuàÝ3Š¾d¼4·üÝAUx!/¶sÀx‡´ü*¢eDÞÒ!õx›weƒ ý1 -8²a?ðàb±{^ ø }¢Zåu}ÏuKÔ·Ÿèå· Y òº½íyŽHr$‰YÀ'sÞëëêvMhy™Îþ*‰O*È•¹¾™’´{0lÞÑõE‹ˆîx ò öÏ=±=)R~ñUe'¯¤«qà T2:vVÞäc ÄFaä]tU£‡?çõˆÂÅñ -Ýî—zòªmyÐ6ü½*»/fóyÞóÕå 3°<ë»A˜ânÏ^!7×Hw‚ôãë2Š}•füȈ^É4Æ[íøùÔŽ8Q^S“ -­-¸y9ñ“Ç,;öw|œØP+\ËkØ­5>Ú>>ÀÐ0úE¯Êa¨šÛßÍBz3br…ú€¥8%~˜„úúc44Ó@%S©WçýÀ#Ràûð;»c¹¨Tâå]WYõ†Í\ã¹[— C8à©×¡µâ/ˆuµ•ë'sŸÃ‹é±št÷½ÛnN–hðÝJdVt8f—Q—+öÄŽP¸>ó£8JCEÂJÃ\¾€à¡£Ð°1NœýZ{@¼ž¾ _Hìƒ5f î 4± -v ¢]æ%ê» Ä“;¶1ÜÐò7Èïjf‰ðEL¸u¯ð$ò7ìP‚P Šwï{ž‘ „í÷®k¡=å½Y~Ç@ÐZnÐ_s‘›„ 9£aìÀ>øN}hèîAo ¿…³;Ô&K/T`€ûÎŒ‰ áe2 =´zõ— µ>/ýÇdù0!ì-r®Fëož ¼^te¾aTÃ:׋@!F&\$“‡ocü-NrþXÿͲÓ!ƒQ?Tt4ðà6'×2‰FÚ‹‘ˆ!¾¢&8V†K¤už¾û1 -)Ff}"[¹Å° Ä\ÃlÔÇoÍj¨Ú†=Ø=£ðãù« 4hoùÓªÅX;46¾côèˆ<&ILG6à®ÿîa¦dÒ’X€žÇé·s%©gñÁ\ ( ¥ò…HÅC§àá‘ŸâYª2Ž¬À¦Tà·‚ÀÏP¢˜R%~œ…³(ý,HèùËj»ÿDSqNJ"®Ùçã,“ ㌉ð݃háä|£fg-P8›ÉxbÎûR7ïƒpš©dAø‡ÐÊDÎ!¢±É¦ÉGÃø=å#dƒB\?Œ:Uèýªùå‚£+NÙü! -Þ1ø`'LVí1n¬/×÷å½ÁMK;§×í› ¹ -Ò¢ÁxÚ’sóS.Ê$q¶Em¦8ò¥ªË[ΘV›5… !§ÿLqQ×2„ÓY”9Ç›a¬|Ôõº~z¡WÞÁçüeC~ŽÀO¶8€<îdû4Ÿ4:Ô¨INžœCMc &²‚‘¸:…+ÿñüt¾ù%>æòg]À yQMc>€ë¥÷ù¡è¼ !1þ ·AŒvË]7 ‘úY2aŠ]‚?èË’äõi_ã@¡ iÂþƒxHòdæìŠuˆ)HûŒ‚²Ôiøv–e~jYvBHKP¡ñvT6›÷:[V6HsúÔHé -ðA2éc -£¼Óºoµê¡×m´Z®)ÀˆâB»!g³ùCº‡¶ò;uOüOuOd{Ê÷òZÿ_µNe&$aàÌ´æÑù}Íw¦ªÒƒµPE¨þÓ8~L#Âbycò€Uù¸6¡ô“äuD"udÅS¡ËÄŸÎ+¡î]W«5 NÏL&Ù7Oøq¸·«¦qrÏ5{I*¸¸ƒ|ÎÞ^á ¤ÎAêQöõ˜÷Z¶Ú¾AU1°/Ê0LüÔz•+x€ø€}I…¼Iûÿ}øš¼96>Éü¢EÁWÙ„+\®7£9ãf*³³Nfñ'̆4ÛúãÙÓ"ÄÂL’ÑAžó[Ý6©$»ŒYç¤EœÖ•·U?LÛ0´¥œ¬u­¯XëÓî¶Õ”ÄÞòìyÿ”ûÙصCP v@+ý^k·%!¤Am´¡Úê8W÷~†$¶)ðh&žÅÑ®€gW»`» {€û׸s'´ñ§`8í\qØ•[Î|óÁ ?d2 £350h<Íd¡)”tÑcaºèýxm•Ò•iZî&º@NˆQjŸ -ü‰%Ⱦm–(‘2&HQ/)øç¥Ï£ÑL4”‹ -2‹€=#B‘îà¦é¼Üòꪥ|}\ <ÜÑ@Úi”Ea¹ú¸;wû°âªY~›Wº\¶?Éà—©ŸDš„Qhé4xnZ2hþÐj¾äæ4ägù5'ñX­…=J|`oí¤ ¸¾SO˜¬Ú±Ö´8. ¯t-Ov_õN牻Ïü–%…/Rîvm;|Ï?átÛ(@i":ÅÒúÅ»‹+ž/Þi08ñ×¾\u¥Ä_Tðû¤lÆ ºpHƒžŠF¡'ÓJlS0ðßøã±=¨T2†þ𾂤éNÿJ… ~¿¦ñÇ>bòÛÕáäñys£ÈÒM6(T4•¼ ÿ¢Ý3~¨àì@.¨¯w®YŠ$Ò?˜½xÍMÒÂà¦W¤ÿa‡êá‡Ù¡2þ˜ú?õ³½-&”¤’ô`1…¡†®“äCzÍÏû{ÿF8Çendstream +xÚ¥ÙnÛFð]_! ¥€ˆ!¹\}³;š¤µA’Z¤-ÂéîRvõ÷k)Ê:R ˆcîÎÌÎÌνÇü Ç™ö•Ó,ñµ +ÇóÕ(ßæí(Š©L4ç³Ñë+ŒÃÀσ|<»ëùä¹ÑxV~ó.Þý1»¼žL•R^˜ú“išf޻ϓл™½ÿô–gø‰½}?™†ÞÅõ$ʼÏ7°ÿ|5cä‡Dèìš–ç_f—o˜ÅÕûß/y…ø¯7³Ë¼]_ +…~šü˜}€+MCåë8'oÎPð92cmŸOƒŒ „UbhÛJ¬RíƒeÀ”~w÷ðs `«ÈO£T¨l/ò¿À’pËî¯0ñUâ$–w.ïØÓXÇ~œÅâp6'sV–k!ßœrú‹•”PFê€KZœ9Ì-Ó}tðŒ&¬¥´xäXçF5îT ¡æÐê¾23š¢¿Ürö?)XqYŽ ¢C¡+zï‹õÖs–õßiD.GYØ‘RqfaȬ¦®`Lž¡Þ¢yMm!dMßú8o̓d ÑøÕéÉYo@CSHØØWq2˜B4N!9Ï0ÞEXµá®íjEýtKRïÒ@Þ¨³óˆ:Âæ€:`/•B žžK5OsÝëºÜaúq ÆŽ•ý„éKe ñ3Ìö:š=‰»¹F¾ +£‰Q<—\@°ÞdÒð—}XJ¥%?GÐezŸV%l4쪸1Õ-O,nn‘Cr¦¾ãoÁÔ}FUb¶¾0 ¹Ö0=ß`×¾a¼qž:–qšúa|:;4Ç#Þý,âO ì#þ¥Äƒ?”x±6}°q)]Šk àšêW»cuÂüSÏeÎSj0e-=g^ÙΤì9™”ì ÇÉ£Ç ¬ÈË0âÍI¸KC÷ŒóÓîÚÒœp—ýÔ]'nÝõBâaw $^M2IE-ÎM ³ÄÔË,Í5dmd>dJ‹ã[lšÖGždp^ždä¹{Y>ífð ƒ-=ùt¼ÃŸ_mZÉ´… ¡Ç%EõÞ[èäQ9Ý/M•éyÐs®È#i”'ïVà¸}òâ¦åïà™˜á3Qì€høR,¨à¢˜'bo†ªñ#Ï=PÚfw´çØUÑÎÀt`ôÓcHY÷ãÎLŒŠc‘¯´Ãz°m ûÿõ7“múd~žE‡cYG‘…½2<Šd/5v\ÙWù_ij|Çendstream endobj -5039 0 obj << +5139 0 obj << /Type /Page -/Contents 5040 0 R -/Resources 5038 0 R +/Contents 5140 0 R +/Resources 5138 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5016 0 R +/Parent 5124 0 R >> endobj -5041 0 obj << -/D [5039 0 R /XYZ 85.039 781.388 null] +5141 0 obj << +/D [5139 0 R /XYZ 85.039 786.531 null] >> endobj -1254 0 obj << -/D [5039 0 R /XYZ 85.039 344.943 null] +1118 0 obj << +/D [5139 0 R /XYZ 85.039 585.057 null] >> endobj -5042 0 obj << -/D [5039 0 R /XYZ 85.039 326.275 null] +5142 0 obj << +/D [5139 0 R /XYZ 85.039 544.893 null] >> endobj -5038 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R /F56 2890 0 R >> -/XObject << /Im4 4878 0 R >> +5138 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5045 0 obj << -/Length 828 -/Filter /FlateDecode ->> -stream -xÚíW[oÚ0~ϯˆ:MM¤Æµã˜8H{ ´]é:ƺڇ41)–„uì×ÏÆ! % Þ6UÓ@cÛw>Ÿ£ØH…ü‹TJÄŽjS0¥ª+PpÍG•FibÔlŽ†ÊáiËRtÔáø>Áê0iݳÎ`xr©c Q ¶MµîEÇÕ‘æöº ¡²´_^öúCÝ@Z¯ÿQÚ ›«Áà‹ÐékCýfx®œ +XUBÁ˜¾+£¨ÿ¹v¨zÇeWÇ -ˆ…Ëu¤¸Ê×*”ÔYªôj¢€` -Å›`Rã™°Kµ ZKŽ³ðËtƒ˜Dë{1kKqtÜéêH¹—ŒS·È˜߈"U!Î!Q ÓaY˜«8õ˜ÂYJ¨½ô^9#^٠ጅ‹nY6)Æ“0öò*ƒ”Ò5$pàòôÚ-g'Ä  š’:.i¼˜M½¤ðòE°´H¸n{Ý#À?¥šÛ´Uà…í¥6KÓ⌛Í|? -YRÈ¥Ûù|Ô1ºWW®«ÒŒ{¼Ï™Ÿ±ÒÐðåsŸ%óx& Î÷— Ë|µšü8Öä£î³‡qäMòöþ¤P|d-pÍDPÐ]#l‰ß=t±ªïѺWÀr? gE˜&»øßlKÌgá·4šÇ¬ÜÕûAq‹yQL¼¬XK&›ÜOã˜sÛUMûäxF7Ûv·õê»›³"¨5¤$FÊ{ϙԽǶȎÄOÌ;8‰Áû>Ëóñ<ŠUÒÍtE9²u8Ï)üŸÆÍyü0>‡ò— ðŠ¬Úÿ;³Ûô2ÙhòÔÁlŠúò¹kŠ -þ¯>K䭼ؚ(}Û³rxŠêgZ5UC©<ðôøîáÕbO7mm!¶v«&Õ˜Ô$iiÂxÝR-&žóÅ1?$ü`þbb!Î]k·óBÆ*¦eœkˆ¬,/cù^U±–8I«†Ó$ Þ2p‰‘%:65Ù BZ5Ƀâì°Vé“OS×p'ªbA™jÊa²-WΉé4]øO2û¢[IuïâCG±S]9Ö·Ç4‰VXDˆZñ®n/€ãx©Øendstream +5145 0 obj << +/Length 2802 +/Filter /FlateDecode +>> +stream +xÚ¥ÙnäÆñ]_1ÐËrÝÍ›ÈÓq #»V mÖ€í‡Ö£¡Åc–ä¬VÎϧ®&{.=$ öQ]]wU×è…‚?½Èb_…ù"Í´fÙbÝ\©Å#ìüãJ D‡~E0>³¹²»«$ðU”ž…‘;V©Îý0ÒóîþêÇŸµ”Ÿ$áâ~c I2ågY¼¸/~ótæ/Wq¬¼÷KíÕfàS­M½\…IâÝöÌÛq¹‚U=âzêÝíw;i¯[¿·Çå÷?_ýý~"É^–&~–œ%Z-VAè+­_å(î³8q9Ò𘸉æåH#OQîý´ •Wšqß—HâÀL™¶`.Þ•mù»Ò‘?\¢_P¿Jâ C$êx¡•Ÿ«Ü!1Î2?ʉÂÛ…Ü.ƒÌá£=”j’„v›±lqx†Wš +t#jèp€Wk‘’FÑ€Ä-^ò­Z—¼¶ézF7na]÷3$á±E‘òîL³ Rï–åòµbv=]»ß‡BÒj¸|}_Ö•y¨aí匪×hÔ,ÖH0%\Ÿºd†ëÜðæžÇHVyëº*YŒ¼Ü–#Ξ‘¾ xâu’R×Õ0ËŽwÞþBê(,gÏo?#®®²ÒÍXuí,+á#H}•gÄÇÛå*ˆC–_æ=žîuó +³Ù“‰¶’׉oƒ€/¼ðŸ”w#¯ß£òF'_¹ân4HXaj"P ´ ]c*9׎˜LXÉ€š#ÒhíXLro E3A3q“9rßsvpª]t±ÚR•N7Øxĉ·Ù#ÙkŽ#€t…W§ðà ó’zãÓ4ËeB0»%úÄ,ðÄ5IbŒfhí:ónFFI6ŽÀŽÐSQI1“oþŽÕãÖ¹ÁÒi·ëŽÄÚñÍløÌ~Il¢.{!Úe#‘ªµ\–…¬0»£ðKaBw×RÃÞ÷Æ +4ÖœÂ$¶ªæ «¯Ù‰j˜Ü ¶Ø_¦-í}—›Þ~["Um08ÔrÌ 3ãV\µ~—¬Ñ£¶O#qøL@aDaÌpìù¡©E~¸÷àtj¡¸ð[”Ã…ׂOQøê¶HŽb97¡£à—œ—6È`»½ÜµFÒ¶f7Úí~¥HߪÁ†£DÍñàÍ9Îwç²A +†²G;Þ±õáÒ„c,l¶:š@`-y4vüˆÞQV·1†€[Æôéžç¤sø~!,¯Ü(¥xtȼs.Ũ7hu½"%~…ñ´ ²€âçRŒ0Y¶XLdP&OÔ³+ˆGò3Ö4ÓN¡)b6C9e5ðó÷ueq0⇤6¦ ÿmÝ™B‚g[0ÉgÑi^P”e ® x +A¹7º9I¦dÙwûÇs‚'_©0¢äå=ΈH¤QY¿¾¥üDd?oPFoÜââš!Ùë&O4me“Xƒ² +îÖ˜zR&®¦Œ7’fj' yè•ßû~D_ÃSŽ@"ÿÙ=Rèεw·î«¨N{BúýIükÑŒ¶Þ¾{˜Â’ò·ESÍLŒÈ±»žB^ ÅJÂ1vÇšÄ)§Hƒ¹˜Ç’á‰k#WY8œŒ'{{i)ˆ¦ðªrÄbM£SoÃשÖ7¦©KVn”z×o &'·§Æë ¸ì_¦G¸k2ñÄ{;ðÊd^Å¥a×’KEÉ«.EÙ ›,èÀ« Ù6 ÜXP +½,ÏÆñ.†=¬hä~Ä{*ƒ©¼É3oCefƒ“œ#>®JZj˜X nK£ ‹Ž{Á\êÓÃP¤b ùÉÆ[©øe2]ó0¼ £Ôì´CsQö-^û‰@‡¹Ÿá«¿bhûž~— äWŒû%<žËõ¶—¹™~•é1¬+Lw ÖõÈîu!<[ü¯Ò9Ã\ü)#MýP‡D¦ÛÚ:’óÝ,åv³Réf°©©UÏV(ð—‚ràCbT2'gX«¤ãäyuÜòÅ•aÿ`k+[¢!ÆÍ)ÆÏ\æÁê/wü­?IÏ>ÔZŒMQvô[ u¥ƒ(Ó릢ÞV͵ÕŽ×t8§Ö3õ4ÍÕ`Ò[Üvc¨n÷6ô¸møÜ’ðì}ÜàŒ•mvv£5aÞßqYŠÛý +"¹=WìÌ0ÃHaÄldÔÙ‰=0îíbã9s@¨áej)ÙW .oì[=Çù¾?â"·¿BašZ»¹….@Ù&> endobj -5046 0 obj << -/D [5044 0 R /XYZ 85.039 781.388 null] +5146 0 obj << +/D [5144 0 R /XYZ 85.039 781.388 null] >> endobj -5043 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R >> +1122 0 obj << +/D [5144 0 R /XYZ 85.039 761.463 null] +>> endobj +3092 0 obj << +/D [5144 0 R /XYZ 85.039 653.856 null] +>> endobj +1126 0 obj << +/D [5144 0 R /XYZ 85.039 653.856 null] +>> endobj +5147 0 obj << +/D [5144 0 R /XYZ 85.039 615.589 null] +>> endobj +1130 0 obj << +/D [5144 0 R /XYZ 85.039 139.723 null] +>> endobj +5148 0 obj << +/D [5144 0 R /XYZ 85.039 104.412 null] +>> endobj +5143 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5049 0 obj << -/Length 3504 -/Filter /FlateDecode ->> -stream -xÚ¥ÛrÛ6öÝ_¡Éì5cÑAðÒNÜ4íºÛ&ÞÄYïLÛF¢,n)R!)_öë÷\)yg:GÀÁíÜÏÅ,€b–*?Ù,I…/Ót¶Ü^³ùéBhŒ…FY88ßß]\ýG3øYÍîÖÃ:Ê”œÝ­~óÞþýúöîÝÇùBJé‰ÔŸ/’$õÞþrýi.¼O7o¯Á¡È»…æÇ›÷wó…ðnÞÿÄøˆóùööŽÍSéÝÍÿ¸ûùâÝ=–ݎᙾ^üöG0[Áù¾|™¥³'€_Àðöå«HêvuñéâŸv)‹fN¬ 9•ÆL­Œ9¥×·E˜ðÖ h´¨scØ?l)?…@ÆåANbÀ7&ŽV¸*A·4áõUê'*u½¾Îe(C“q ÅšVÔˉ\-Š¸5¬è(ä_Ðo ±HF³ÎËþšÑi÷Ãm' Ï{Úƒ @÷´éOë¬uÒÓŽö›ò´î~èiɾCÔBF<'½è8Ö°Æ$$/}o’m¥6N1v_‹‹›Ç;‘Ç<)!üÿ¼Ø„Çq<6Å¡PU¶·Y\7†,5¢_%µ•Ûès^sT?Èm®£(íçq®bˆ–)uÞ›»bË—£«ž ±@X|fçï f¼Az…ñg7ÔŒí7Åxw¿=2©jrÍ‹œ8¹j¬ˆ…%hÖõÍAöQ -óô‚Wˆ¼ßæâ ¹ýÛ<ËMR¾=IZð^'jLe-ÎÂ2Îkt=³›!ëÑf“T6Ë;›Ÿ€,s4ÁJ$$‚JÄÑ1~Å.¯T¦°›£7„ÌL}.1·% \KNÂÛ÷Œ;``ÖˆoØYÙ:a¾¡PfºŒ;¯{3ѧ9©?MÅ+¬ÎðR#½ÆÌsnï7ÉNg¿ây‰âMb[cp,3#ÿ,÷mka†)88D)+î8Ö(è¬Ñ0Y© 3ˆÐ¹Ø‘9–4£¢ôŒ˜ ³ÈDû0²$ÝKÖ;ï'RP.vVU7Á|hupÖMû:×eà'é+Ù§ƒt†ëé5®ŸÛÐpýx¿I®;û‘CŸÈçÈå0êG[p,ª¼ÚPäÉÄšÇlEBÑh ÒÊ-÷`“jЬµ¼!j´‰x#ªj‹æ4ø?¨êµ‰Ålu2År8úש~Ú´åòŒ³C¼®T§Üv$£ÃžÃoa Uhõqê²T¡Ûq@Nhî^¶ -ShiË£ô‘×2äáhZSF&©-¶T­y¤eX` »@gÚ²Ðî}M©Âö ®G¯"Œ!Nÿߢ•B 3õU[¬âSèô‡*ŒÙ -Ï®5…&:ºU¶^g3&Õ‡Ëf èœvTêUy×3ÔÔº e‡#1•S†>vë*;°'6=`ûxmñuÏnÂ1è4ñÔVeÓê]ÙÄÔN£p6*ËFÛAìk¬ºtXשwÃœâ{2U]mÚƒÂLø¥ºO¨B»'ÂTXs±:c&¹æ­}ÞšÂIªü‘Šþ9–Èa½Ð 8Úkw)ZmÙ/¡Ó¡iŽV0^û è?ÖP÷ñH¦<Š®öÌãøèu -{rfót¹Æ9Э¬Ï º‡Þ Æ -žOÜjÚ|«7ÒRøçÔ)Ž©z\O£sé[#ÜOVAGtŽc* $úð…¦|æÆ…Z„2ãüذ¨Ø2¢S»¤T㢷Hc?³O]WE¿¼Ú¡¾/óÝ„¦'$Ù&¿¿œXh宵Üï:^ ȉ‚:Š -$“á‘ÔëôÚȶMžèÕj×6LŠ.9_QÅlЪ,åAúÞ7NéØún14o_°HÄÙÕ„"Þo†8(š‚0µDf50 -›{aÿšŠKåü³¬JÇ2_ò[j¹¯Rs^¡c'ùUèë69=ô¸j†׎»jª@ñÔåØÄ(ýØÁé NGb |p¦·¡/ülnεaìçP º£B¨Ök²: 10E uÜå¶8£$FÑóQ_Þ“tó+y¯ÇtJ `Å4àŒ·ŸÒ8×<» šîS;Ø7q³&$ñnÖc£,1­T?ÛBooß9ÐQmVr[¿ýÆ‘õ'ŤèàÖ<ïúÀ˜óØZ°€lùh÷1 ڢ߷Æ>FA@Ä¥_#~½L ¸j ±Ôû†ÂBË{ ñ«Á/Á”w…@<›ˆž_§s¸éð1„æîk×bÏ´=5õ+´$ÿ ‘-ñpCè\Ðó  ;EUÔL™5½ˆå’!{Þ–Š˜µ;vߨ—[š=S) É5nÁñ¡^ÿÁ:¨NÏÿnâŠ_rzb‹ÜWhZa¦†J§ñ”aÓí-ìÕq>ÕŸ N¡¹{ã !”Ö¥®êÅ:|IŒÌó¡âR9É+Fìaix,õ[¬T@Ð,ƒÔÝ1:ú -eáÚ”OŽ3uùµìM\9ĘÚ.›2ÍÄãRBžc?ðØâÃÒ—®Ïû}7ߦ¾LåÄ—;úQ\„H½ònîàœþ@©Ÿfòà{€Hp?—@’ -‰lá{[Kôop åÞ_ SJÚãØ{›×lyb-þLM¶¤Ð·§ -5ï1ÇÍ0kUb´[´E­ÑÞ“¬mMö0uÿÂôøü§bÎéïÒÔuYéƒÍöð6A8 ´]ÆÞñ3©kKó-BìÂ`ÎSÛ˜z®Y¡uMòaq£Ì«î’e¸çï¬pzø­µ7½w^ëòaeÎ×-zú´=ëÊ~ôé nidÛuû¡¨»¬šNgWü¹ ¿CK¸«†Ò…-C›—~óÈuiÂ&[æ¢åO…tÙ测mÝ)%?]¯…?¾â_ú"Ï -R$ýTž(úª0ôCaÎÂZ¤ŽÏk¾Üøà±Gendstream +5151 0 obj << +/Length 2938 +/Filter /FlateDecode +>> +stream +xÚ¥ÛrÛ¸õÝ_¡ú%ÔL„%H‚—íSêng2‰+“v²y %Êb—’Šã¿ï¹ (‰L§;™D pppn87DÎ|ø#g©~˜Í’TŠ0Mg«Ý•?{„•×WRC,4ÈÂùÛòê—¨x&}‘ùÙl¹éñ(©p¶\ñnÞ¼º[þöq¾ÃГ©˜/’$õnÞ½ºŸKïþöæÕ;\Š¼;øüxû~9_Hïöýk†G˜Owwpmž†Þrþuùöê·¥%Ë$dHÓ·«/_ýÙè{å‹0KgO0ö…„åÝ%Têïêêþ꟯E3ÞuI*L…JÃsHuAÊÊH] 줾×̓Ô{š‰§'Úr]´Èñ¯sÄÞnãÇÒû\îác]ÓÞ–ç0ÓÀäüùæ~}^~`°< FYTD˪+ë=/­‹¼Ò'¡ IÝ–'Œþp|Ý59Ñ‹[sDumv s6HCÛ¹)hU'Ù@Õtûõ…9DxWÛÇú ½7ÿÁ —@JÏYkûªîõÚ´<§Ðïcúãáºèò²â1Ÿ2›º1ÞÉ×pQØÐì‘-ˆ ©ãÃ$‰ŸËá ÞÁæ‰Ö—Ì3ŠbaÀ\‰ÜWêØ©Ô»wDÌÁá;>hèxÁáf‘>çw_ù7ŸîîÉz”##Ž|85þ"‡Dw®.FPc’‰4 +FÑÐ&ÐðHC±Ø«b_¤Id£Kͤ^ˆÍ,óE$î *æ+r‹=€Râ¤C×­;eWoS¸Ò×ìð’É£!þqÆÄEÏMür»‹f¯Þ™C²F»pðr@t @™ˆ5S™qÆš½ù4ƒv@±Ä 6Ïö%{†2'r:ºÐÝi¬‘£‚ˆe`tõþ…6ùØ÷þƒ¡‡G0yÜø­ ¢8›8ƒ}ñCïࢠ¦ã]zÿF/Á†6“¥—ÛK±mW¶ÆÝAÖR踠°Ýtä;ÎtèFoxa—³›Ám«z7Îa’fkœG[·ýUÖƒ¿œj:)Ë(ž9Vôÿ›$Z½ô“Ù·eú–¾ðS5™^ª±ZC +|Çö5Œ’`û@+ +Ê@€,$j "ïç-¹/¸  OÔ>ˆi¯£P¹á•ç9Ì’VᣵAl­ÃÏ¿%¿öÀs9x.â<ä݈kQR‰@N'ÓÌh"¥!ÉÙ]bŒF…}ô§0ºÒqtƒ3Ù Àœä‰0“ó^âÆ4&b.ŠÌúg +@NÒ Kn¦…0ßKÊÜmèn1Ê&p‡íš%"3;[æ:ñ\WÔÁðd»µý—©@|w8×€{ó7}-;7s=æ,3J0^ð³)ää‘Ó™_GtÕFá´e;0çºÎR©šÅC¦}³¤‹bëÔifú8)Ê`pÞYr«ÆsÚ¯§sí°èŽàü¾ ±ñek mzFc$­ S® ª‘-¨8 ãiÙö0ã²Õ0Èk0.Û‰ÓzÙNgeëœç¤žÈ5Ý£M×µ±)­4uÑŠ +£SšP9"«0ENûfTViGe5uš•ÕäqFVîy—ì°µ¸¾d‚túúbÚ¿ãáÿÀºÒÎÁÍ‚[B0g§RoþÐQݦäµnN8žî…!ÔD}¬ëÊ&ïH±Ùù˜öT&$¿qíõ0ãÚÓ0(Íh\{§õÚ›:ÎjÏ9ï’öVUÝšRïÔ Ï}•¿:%Ê1!‘V?’ÓÒêaÆ¥¥az5.­‰ÓziMg¥åœçú…LyìÉ&ë?æºkfº‚ƒul†=,ÀÝ.§&È<3]ÁÛI#rH™uYi”µÛÝà"ÑbQýÉ: # Ãx3íñ¡}n9¤î^\js´Ü…1÷Âv™8H]ˆ “ú„“*v`FUl`’xTÅS§YOgTìž·4~H 8>Qbº+GËÅõY¯¤ps<£s¼ÑÆ‘²éŒÅ­†AV“qÑNœÖ‹vê8+Zç¼åÏ\üŽ½-÷]ر÷¥UŸ¤ôõ&|?7M§Ç$†ë¢*:·4ÛÌMU€NÚj<>OƒMhHu¯Cƒcÿcí‰ J¨_=©¥f´d +‚@È8”L.™î¸ÙÔ~‰.¨o>(‡œû-k]óÌÉY/¨%=S¾ÂÚ–U9þÓä;-¨¦cLb½ùÆz˜ÑâH¦©ð{Ó0ßÒÌÆZóYÇQ+…ôÝàBÊ}Bøí#ó†ÊÕìáò’TàŒ;¬Ø8C´œ  6uUaâšuô/ô>×dKõÐgÛNÿ•ÚÁȸàXï*›U´Ôö½¼jkÙŒcã´#™‘±jÛÀ„1^?PÁƒ£M­·´,:a +N’ÔF£«ù7§•o(º²Ñ ʳ0#¡€¤á“dîëc§‘n ötØæõïUËD>•@ò¹ j§üƯ»Á99‚5Æ=qÖŠJZ“Áñ몦‹[1¢wÈ´ë)¬$»üñѺ¥ £QÎ?׺¡A’ +eš¡¯/u1¡ Ëôú5ã¡æ¬2m+ÅûÒ§`>­®Y•óîî¡Æ.Ý×XWôJ¨¸õ@öÅÙ@œÈà%ú3g‰&ïþù1d‚¦{ÝWÒ'º0в~O|D’ •R™Y—S. ²p`¬ó;ó†HF‰¬ +öXïPãßµ$¨µãø0ºRØY-Øž»²@b÷3œ¤ÓÀœ:Z •HÁ=»”‚7ã¤ùRK] +iµ°ËŸ/è!…¯ òˆA'ˆ% N˜k€ã/Æê¿òDëõAÆž2Lbã +Ð#9®@àÓFàÝîÔh¤ø±Ê5/ƒSñÉŠ PªD¤~4|.,Ð ïM¥9U¾MlòceZª™qœú¥Žß©¨ÓDÃoŽÏp8(÷ôŒõ½ÄŸc®gk nZSƒk'X7Û»˜m·ùà­ ¦ðâ`?¾a‡G§ôIw›¶uk!Ù½¸ÔS>; ¹• ÎúW¸Á“¯1ù}5"x–$ÆpüÄX€Üâ˜< +¢n)°áèÔk¾Ä¬_šèe—ï,Â]ðç 1KÑŒ‘kãh´-µ¡ßF%Pc7öF£/yŠ$Ž&Ý@2ê4¹]MŒ¾ñ¾›µ4¬ÊÓ<6‰E¬&I1 §´ ³Øò0@ÌOîy¸÷®_êQþUw.} +%Î¥Ul +þ L±¤¬b}´A.vâP˜ÊлÝð:˜Ê3Äôû`lMSs¤kÞ'aþš}~Û-ô"‘$r`ðlydx×5¨#VVeç¤ð«\÷ÖeËÞ§7DÛÇ)û^%ÞÇR÷„ž©²>òvԸʮU6€"&û@^]À@"«Çr÷ЇBå’©À_fúOýw•¾÷Št¬C£ ï‡4ZÓÂÙ¿J¯ùo-gÿéY^endstream endobj -5048 0 obj << +5150 0 obj << /Type /Page -/Contents 5049 0 R -/Resources 5047 0 R +/Contents 5151 0 R +/Resources 5149 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5016 0 R +/Parent 5124 0 R >> endobj -5050 0 obj << -/D [5048 0 R /XYZ 85.039 781.388 null] +5152 0 obj << +/D [5150 0 R /XYZ 85.039 781.388 null] >> endobj -1258 0 obj << -/D [5048 0 R /XYZ 85.039 691.864 null] +1134 0 obj << +/D [5150 0 R /XYZ 85.039 540.39 null] >> endobj -5051 0 obj << -/D [5048 0 R /XYZ 85.039 671.274 null] +5153 0 obj << +/D [5150 0 R /XYZ 85.039 508.172 null] >> endobj -1262 0 obj << -/D [5048 0 R /XYZ 85.039 120.719 null] +5154 0 obj << +/D [5150 0 R /XYZ 85.039 464.806 null] >> endobj -5052 0 obj << -/D [5048 0 R /XYZ 85.039 99.522 null] +5155 0 obj << +/D [5150 0 R /XYZ 85.039 438.313 null] >> endobj -5047 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R /F35 2880 0 R /F14 2895 0 R /F74 4586 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im4 4878 0 R >> -/ProcSet [ /PDF /Text ] +5156 0 obj << +/D [5150 0 R /XYZ 85.039 413.336 null] >> endobj -5055 0 obj << -/Length 3652 -/Filter /FlateDecode ->> -stream -xÚ¥ksÛ6ò»…ë»N¨™ˆ&ð•ûä&ië¶I}±Ûô&ÍF¢$Ž)RGRQÜ_ûd®“qËž±»:÷àŸ:×ÓÉy+WÇñùb{æ¯aå‡3%s™`¾»;»ü>4çÊs/9¿[õx×úünùÎyþãÕÍÝË7³¹ÖÚQ±;›GQì<ÿåêv¦œÛëçW¿à’qnàõÍõë»Ù\9ׯ`x„ùíææW\›ÅÚ¹›½¿ûéìå]GV·! Mÿ={÷Þ;_ý?y®NâóŒ=WÁòö ˆr£å½8»=ûw‡Š×Ì95%㇮Á@{n›I¥|W+äxnà™NNj('åÇn…çõ§§¢cö”6®Òç\§2Èé~Áp?¸AŒö»Ûd¸Ýå÷A8€ôµ«G eÖÎæ&}#°Ñ ¸>°%°å6F`¸½zõݪw~û’ -Rp~Ó8Ŭ<02[Ô˜Q–ÌfèRÄ\à +ÓmÆd_Ýõ³ºcòªe4cÁ¿žÑ:ÿ8š²>H"ç_ª=¾„NJT€î•r xK軬®«z6÷}ßÙâÇÊiÒu†Ïg¼§î)WùJ¶|µ/Ú|Wpà΢*ËlÑæUÙðD[ñ3å°ó1«y\Õã¥MZgK×YSíëEÆË~C‚?<úlÜÌp„"“Q›ù_y¹>†Í€†´8G± Õ@‰ÌÐy¦(ªC¶t‰"i ˆ”y#\w<ØÕÙǼÚ7_Ì€,”ÍÓN;5Ê ¼‹h@‚ˆÃÊK>NK‘c[‹œÒuš—î‰wŠ¯‡±ïFAüùx0z<X /ăÏn(ñàd¿©x0Üï%Û>²lŒç¤-øRKF¼Ýµ<‡2Ççj] W²˜òcà9ÌüLô&uâ,ëÀyüæ¢ÃÇ.iF(v=…•‘ÉhVn_¾é"É[èÃÁ|5²]—í?'L…6’1Ý »çÇ#[úëð2ŒqÄ$ÎY†8¢ ’ÚŒU›Øù€ï<&3ÅÁ" *¢ÍQÆ)}ØÈß–dØØãN0å«È혺Ûäâ4 œ)_VU±´Îkûzμ †±›”mñ0òGqöe‡j™¯V‚ - 0 /yZÈ‚ObÔ(»ÓùÛ.m o ê+BÅ*¯5J¡+û”7m³ú¨q4&%BBRNÄ Íri1c†‰¤“rù‚¦L0€d'ŽD©®˜ Dw ß‡n Ù“o+´ ÕŸ_øBfT Ñ•á¬Ñv†³4;5ÊŒ, RŸÈùÏ,6: -8Ðx -ÁÆÙ -ø&ã!$¶qË-‘Òðä:ëÑèÝ0³éèB–î™u‘ÌPA+L*Àª½ÄÁF>åÅÎmºE<8QÀ™ÆºÕþV4‚v3‘ÄhßU•{³A2ñ¡iÓüñTKq#Ó+ Â_Èra§•½@µ–ÚQTmåDSÕÌ8²s¢ž¦ÇNâb¡Ä!PbFR¹ÏEË&Hpç-ठ±¯(¤©E‘~ˆS(?škX ¬BP Ò$|íÌŒÑ3&ô0©SÃI’L[µÛDI¨èÔŽÐDš¶¢}úªå„õÈ'Qìþ_ºdàk6.8@M1ëLc,¿ö§Nnòõ†GK+c´•ýš' šáO -AƒËž0CW#¤µýxÎ1á$HÆ¢% -A™ÍX9yTGr[ñ°5<9ÚÓpHÉAdÑðè,º\#½8U䥌0.á“O\ªÖ@Q r'$mZ Z qø䣼$W©ÛªÃVg¨O¨P[Š†á—mÛŒxÜs$ÊLqk¥Ä4‡ÆMÓ5Ÿ¡4ÎhoLCéÔÐP¼Y~![ºdÂxCÖœñ}–¯$¬Ñ âçØ눨ÈyÃ:BÜE‹ç=”ª¬ ÅñE©#mœ²ÊG+þ !a]ñ¹"Tl®ø´…ãƒÅYS¨Ô±ó9)Ñf+κæœu(Ô$9,Òbv°Ú£ÕÖ3Ò¦ƒ€¬£±NÄ—ò^¾ƒ¥Ý§­×`.§Œ¿¥´fÉô5±U_Ô™ syv °; $²ºŠDW‘sês¬*7Á(½êjD8Ý8äüLÅnâ=`(P¿£ -ö›Î4ú6¶Ú£?…¡¬¬d°@t¶ýP®yöEäÐ9ßÓaŸ51ÄÔû,C=ÌDéh2µ`¡Þ-ÁGA›¤†D”“Éøp²?wq‰=¡Sõ -ÏÜ‚]ÒW2ìÀ„ÀtRkÑ Á—¼†)ïVñ¡ÉtØX%'&h 8…žÈ‚âÇšE‹ûT7aê;"¼Íû"Eé ]au YÛ‹ª|"”Á B­°¥saŸ¦ÂxD¼¯ª切®ŸìÕp¼€‰ ï‚èµ+kóðÎQ7 .“øòÆè§ ­+‚BÖ£cŸt5ú¨¼ #Žl‰þŽ‹æ÷—o¯__z—91VâÙnºfÁq \¡¹Š¢#®`â¿`’«Ÿ­YÔ]À,ìUÅg~ÆÀÅ:u0Ë,î6?•Ìû±fX½<|HIs®Þ§äa°bNä¡ý?âðÒ‘„£¢Â™€ñ'ÛôaBl¾ï†Êö8 -bê™õÞ–fèj>äÆ”ÜÂøòQ@—Ü0Ñ-Sä"x?2Ý‘ŸL˜N'l6SITE±«Ô¸¥x¡±©ãù¤£’l|Žýœô„=Oë !Pðk~Fê*‰]ß$ˆ]O‹=rµÄÅ, ÓòrŸò·S@3qr¬¤zßØC ©´’Ñ&t}O$<¯ïøœðÈù½+¥xÀÉjÕuÜ&/ì—¢da–¨+ˆš”_g¥£´v,Çð1%Ò?±ñýœZøÑ nêÓº~àlÖ’&uEÞi8ÁöÆ¿ F\xï‘Î$¤ÄTêѤçÇ´3••Øp¯evЗL°‚ìw< ÊUÈÏ8?¯ -Γ°™ ½bD}¡ -xŠÞ1îeÖW¤B†™®À„f_“ÍBàyù 뛂òß.lq˜à‰:´ºh;aáaG²˜ß·__üúööÛ‰6'XVÑ2… /äìzóÐ@¦ý <&pc}-ž]USÜØ »;•/!YRîÒLÑâõ-Ì/aaŸŸ@¢ é‹:ÆbG“øqbÜ°UÝ·Ó 8XÆ—]]Qg‰²²žãðŒñÚp&žvi'Îä\É"$ç@h2y› -ÆÎÿ b®±i„±ü°ÉgÜ‹@ ¸|ÈL.¬ Ät,lOâys1اÚn¹s+ê=lO; Ô-ƒ”(åúðÀŒ¶ÌÐN³±µ¾móO™,p‰Ý…–i_/jà¢mÇIjÍÛŠ1py¢®Ó4ó’6Ò?¨“„Š{kÛÂëO[õúpÞu:[Û5Úâ1¶`H;C­‹Á -G[†`»±¶fWSyÅ´.Šœ¤PbqêÄÔ*ˆ¬Ù“ªp£®ßÀgU¥ÐzAÁ&Yã´´WS¹c@F²Þ,Ê#ÄL]&Ió‰v Þ] duÈ)`WÌMÂǧ‰šY8sTe‰F¢Äs~-ÅOA…&ÞÚ8%TçàlÏÞŒðÆȦ¥F¾Tšò[—| -²Š¤s×Sågå¢ÚÛ{l¸uýì½M0Ñ0P‘K2µÜN÷·/ÃÛÛMj/ ì 0TwÓ}u|US÷·¬ÙcT`Ä=—Ó4ÆKÔøæÀO\ûC·ÿ‘[ -`_ätØÏÃÜìSºÝÔ2þ Üóîx£ÏHŽó.Y2 y+<‹þÀÅ×A)oÇ}¥Bæ©'È»*ÎÇ -!ÀóJaœ§-XaöEEœ?zc°ëè7Ã|‹šl8É÷Ú¶‡cä¦FƒªÈ¤‘+»¢àé)_äupâFŒ-ª™ßÕ8¼Ø¨!eqƒÌ“ŠAX¡.oÌŸIàÍ«&om‚~tkµ’RÖîÒWáXbÍ}^î*á¹æ'«¡•BùuÕZá`Ç30âóFŸêüJ²UˆIy™ÉnFÀ1Gú†`êÿ¿Èv6Ûæãs)Þ}¬æ‰Æ›4®¹ÛSd+éåò¤à…ƒ•í5»t!­¢:K›ªl¦~¸áÑ/ð -Ž¢zUµÿ_ì~äjoþ?Ÿ\-·y™7m¶Uým“-ê¬}"0 ÉÊýÖæ@4£öU!þ\ljÉÀüܯe™Ññw1×åJ¢Š&>8­W%¿³¶ž1Ü;ý~B’Cœ¯Á ,ðó´´7ªù›8ð<ßÜNb¹ª›¼Íí¾î0@Ú¼¬Â1–áøü‡ï'n}DܤíÆ¢øSiƒ9á+W8âœGÿ[”^»Ë¢˜ä4mÓU^dÿ/rC³v?í–SøŸWå*_ÿˆü}þ?fÅîo£w7Åîý#C°|?™j“ñ·~}×75dNÉtï1ð}¨®--ÜJ é tì±>%ø-Böendstream -endobj -5054 0 obj << -/Type /Page -/Contents 5055 0 R -/Resources 5053 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5016 0 R +5157 0 obj << +/D [5150 0 R /XYZ 85.039 384.117 null] >> endobj -5056 0 obj << -/D [5054 0 R /XYZ 85.039 781.388 null] +5158 0 obj << +/D [5150 0 R /XYZ 85.039 357.018 null] >> endobj -1266 0 obj << -/D [5054 0 R /XYZ 85.039 472.088 null] +5159 0 obj << +/D [5150 0 R /XYZ 85.039 316.371 null] >> endobj -5057 0 obj << -/D [5054 0 R /XYZ 85.039 451.498 null] +5160 0 obj << +/D [5150 0 R /XYZ 85.039 289.272 null] >> endobj -5053 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F56 2890 0 R /F74 4586 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R >> +1138 0 obj << +/D [5150 0 R /XYZ 85.039 247.543 null] +>> endobj +5161 0 obj << +/D [5150 0 R /XYZ 85.039 212.797 null] +>> endobj +5149 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R >> +/XObject << /Im4 4550 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5060 0 obj << -/Length 942 +5164 0 obj << +/Length 2852 /Filter /FlateDecode >> stream -xÚ½X[s›8~çW0Ù}À3‹ª ‘7—´©;®—évgÒ<0 ;šÁ‚NÒ¿Â^“‡m¢Œs$s¾ï]²¡ü!›ú’È)„R;ßYÐÞÊ–K î âŽtÞ§Ö»g#"Ùéæ??>ð|b§Åµš'釫™Kq37 ©/çërÖ‹x¾TMž“ÈâÕb•Î\ä,V—Z_é|M’?UÛŒ'ݤŸ­é‘ÖPRˆ§Öõ ´ Éÿ³‰¨}/elÞY’ð=2”Kkmýut¥Û<[[M¥À'ø”œæ€ø£ €ê‡vHù~Ÿ„ V3Q0ÑmxÉÚó™ëcß¹þŽˆ§i‹|¨*Ö ÝïJúFð?4PQÙ>¯ËÝ*EYÞ¨LHZ.R¬£WDÙç-Áõ ÆkÒ‰’`³Qdû¶-š;³ ¹hë"7HVsPdÑ@ˆC£‹5¹¹0ÆêýÐþfMË+q@Á“ŒF>W#öq&*¡e~åCÝ@þéŠdM¦\Í›ü–w,ïöÍÑÍ7.Šê¾ü§úý@ƒ©Ñ0b’dÝí/ô>öÔ³ãZf^ƒ_u¾èsÑnÁC]Lù+±áÛ— ôô÷ü¹>±²~±ûGóq4Ú^SïÀù‘'³¤ -ÔÉ„üp/[)>1WŸú¬n•0x -r¦•”'ÙXöj­®ãB*W•®(¸T#¬aCƒ†bݤ~Ã20ÎZ&I‚\éU»:k˜¾€Ð¯ç©½ìK)vèv™¨ÐTÚ¾ýhÈ[-Õ\mŽósÝn d {2MUu¿é~k ¾Ùh»ýèvÿ¡0}"}áhêC>:æÝ“o‚両$:^‚<\>Æ£¢áS¾‡û”Âÿ¹ á´endstream +xÚ­YYÛF~Ÿ_!ä%`Ñl6Oypf}>f= +‚ÀëŽÈ1&E™‡ÇäÇo]M5%j‚` Éîêêêê:¾*©…j‘„®§ÓEœ(W'ÉbS_x‹;˜yu¡„b%$+‹æçõÅÓ—a´Pž›zéb}{àºA¨ëü“sùúùÕúÅÇåJkí¨Ä]®â8q.ß>¿^*çúÍåó·88WðùñÍûõr¥œ7ï_1=Òüzuõç–‰vÖËÏë_.^¬G±Æ A„eúzñé³·ÈAþ_.B]g;¤xƒAèäF%•yé‹´¸ì²›ª@"ít{xÆ`&+XÚT] +ÑNAü†ZHÚ¾³Ò©ÁðqÅa“ ðœªÉ@}J&¶6óÌñ+ÓœÙiÐx•‚ÝÔ…Ð6$‘Ϥ9ó Ø–‡ëlÔ:%’ÅÑ~ÌwÏ$tw$ªa<Š–HÇtÛyܳ8xA§¦v¬s4—ûòOb…Sù1Ô¦G£8v ù-ï¦{rì˜Óèå]iXÛtÍ-­ŒgК¦ª«¶!Öl[ù Y§.ÁE…é¼Ð{‡yt…dÞ]âŒ+æ+‰üœAÞͨ÷3d ã™Ó"– cFïr@ ”—IÂG&7%øý7²—œCJÇ â¥g‡àð§ø81õ)dÛTVÆèFY ¦jL*Á~x›íÞÑŽ?œzyÓ³–6M…ùÁƒ„ÊOŽ‘%2«¬‘b 1RLe²(ãÇmFxíaì|Áp— +æê`Æ?pòQ¸B@ ¾7Õˆ +Z^:›:dK”ŸCW€6¢8tÞ/ʾê0áQ:¾—ƒÍY͘”IˆŠŒ±ßZR¡GÝŠ]‘õ[÷ *ÒÈý(*¶hFP¸:ˆ,TD¡ë{Ê€zÂóAê­þ·–òˆÁTŠ~é?ŠÁT¬]­Ré§2úò…iÆRÔ…Aê&ÂÓ‚\zêB& Ò\:šÛbt©]y·“ò▊ߪço¾¼‡¡(Ðãڪ◠X°¼¦ìÏÎ8nú LÖÊù@à×?€:À7÷Û†ñ²Ï•*ŽX‘d6T½8b§Vh@:»Ããôv#ˆwÔ;7Uâ®+olüˆ"ý¶=T3$DÆÙÍ”a,×)—rGÔNñ'n¢âƒTr¾wtvÊT†ÉfàƒÃ3 ›E+ë&·¯b“­‡ÂåçšÛÞO_F¾ß!݉'@ÑqJ©™pbâ¡ï–ºn¡t+èö»ßrðv<ï™HÚŽpªùJŽ+íƒ 'ÉÂfû!è€! „vgĽcQ<†e˜e£†¶™^&±aúTÊDArb~ð¿6oÊ€ÍðäÑ„Í»8ö|‡t†Â.u¥i^Ç”X4º^¦‘óˆöC7ŒöïÄþEö觺I,E‚¬Ý±Pô8à>ŒŽµ(*ÆdG½Ià¡_0b=ŽUõ¬i×è8¤2¬"çA†ÍÐcÎzþ4nt‡«ÒÄ@˜ÕÇ/”*v…PšVÊ@®Ù´ÔbL(¯fâС*ÄŸj2¼µÁ¤»17ÝroêÌ4¥™Æƒµ ³ì¤_}ÆŽåææðþ´Ó—Z?§®ºI¡ØŽB¹xé ÅlÔgšÑ¬€¬”ß A‘üÆí…ÐÆv1õ*”ó;l¤˜§IêÑ Ò®ÂÕ_Ð4ÆÎ ²ÛR ÌV»F¬Î ï9³S· á™’Cœì àpJX>УBð¤ß16ÅžóFè¨Jëøý†‹¯1ljò›Y6™*лü=×Ë´¥¬bOŒ0ÐVQ·jû—n5€$Ïyu·¥®+2h 2Bî4í3 ƒdc$.ì²ùL)â¹\ˆœ"QÙÿ¡ÚMt:PBßw}edáÆ–:–7Ô‰&úTàÿPUÙendstream endobj -5059 0 obj << +5163 0 obj << /Type /Page -/Contents 5060 0 R -/Resources 5058 0 R +/Contents 5164 0 R +/Resources 5162 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5062 0 R +/Parent 5170 0 R >> endobj -5061 0 obj << -/D [5059 0 R /XYZ 85.039 781.388 null] +5165 0 obj << +/D [5163 0 R /XYZ 85.039 781.388 null] >> endobj -5058 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +1142 0 obj << +/D [5163 0 R /XYZ 85.039 761.463 null] +>> endobj +5166 0 obj << +/D [5163 0 R /XYZ 85.039 743.459 null] +>> endobj +1146 0 obj << +/D [5163 0 R /XYZ 85.039 496.683 null] +>> endobj +5167 0 obj << +/D [5163 0 R /XYZ 85.039 451.608 null] +>> endobj +5168 0 obj << +/D [5163 0 R /XYZ 256.553 362.21 null] +>> endobj +5169 0 obj << +/D [5163 0 R /XYZ 85.039 199.093 null] +>> endobj +5162 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5065 0 obj << -/Length 1317 +5173 0 obj << +/Length 1713 /Filter /FlateDecode >> stream -xÚ­Wm›Fþî_ᦩ¤Âí ØËEªäø’‹£ËÕ½ó©•’| ÀÙHÀ÷RõÇwfgÁ`ûZ©×œ¢egžyÝåÇ þøPù.“Áp¬¸+•Fë.As1àáˆÓÁ¼] Nß¼!gnÀ‚áânçÇw=_ñgkúa2_¼»¶)¥Å•k;ã±²¦—“›[7³éäUž5‡íõìja;Üš]]1·óù¯¨³•´ö×ÅÇÁ»E›VR0§ïƒÏ_Ù0†ü?˜+5|€gærP¯”ë{Òì³ÁÍà·Öé¼!Yk/•ë+yØéwzÀ¡H“®ÇFº Q^É¥gTÇ™ð;(¼;‚û›^+Ÿ±jé>nbÛ <ŸõE/Øyߦä?Æ~Oò Þ]e›~6(8On§óËOW ÷üNJyŒYÙŽVá6ÚdkÐ4Qøz7=ó_»*)6Ç 6:ϤhÎ1gᶪâò¾ShWr´ÐM™¾3haWrGgáºÖ÷äx=6Þë{#9¨sšßÈ 7Êë¦í;Á¡ï«·“ùŒzNààx6ŸöÁà¹Û²¦¬UhsžÑ&ºO“7yLþí8W›¬…²g@ß×û^ŽŸFƒ¹Kó¤s1ž Ué{4Å|uü¢w³FÔÞ¹ôÇ.Ë&Þé{Þe‡û¾ËÕÐñ¤;’ÄçE$vg/y`}³¡¬„6w…Þ¤¿åʪWÅDËÕ¶ãyÌ:‡M™ÞÛhY’éƽ֬jÜeF¶[+Ú»*…D´à!­W(“µu…)1Ùp^t+˜µòÔÏŸÞT*¼ÛË8{HNj¥qOœžæ´Bt“xZ’$*gà?“4¬h@<¡:BÐÐx©´‡„ wØ¡bMí?5ÆUú§ÁDˆ/Ö,°L«"?£ìq8œ¹d.Sc]MYõtðº¹øš%ï\¢ÔvÛ0²ßåû7´ Cí_¸ôtG&XнkÕú[”¥ òšœžB~øNúÌU§›2Ík4~MZç–Ö“I¼Nó´ªË°.ÊŸáß iÚHýkïD¤~Åôð»¨Ñ©l2MMůS#i€®KëžX¾zƒ×¦[-ðüBðú—¦ÈÍò ÷Ð -1†Ew^!U~¸œÃÏD;SôaåBŠ»[‹Õ–"~ -ŸèA2Z™8“üŒ™`L¡çÂÃÈ€SñÔ "ìWqkh}¤ÕŽ¹b¾Þ 1ü‡0ðËLzÞK«é„¡ í™è .¶Rÿc-ý úT¸¯Æâ?†Ø§kx¥¼Q­gðZ‹1è='DˆÈY‚2n=ØDã@;Df(Ô{¢ÛÖ rN§HŽ@Œ¨@®ªE­f®ÐØV¨AA¹<é -láõó„´¦ÚyëÇÁYþ Ô\îhÓÔ£@[?KÜHìcM§L˜šêú™ –ÉΦŒduA«Î5É´ITÝ*éeÙ°~ˆKÝXZŒ£ÍtšFÈh´ÁCg´iÈôº[Ø- ÿΆ -Ûd²¦@­<à†fVáÉÃu›Ž§ h {ÚùÉnʉFYÓ=Ê7ÄàKãè`xƒÌô|.S5³² uŒ…ê«Ó¹sxƒvã5Þû•¢NgL3ôA¹Ï|LÁäÁ± øO7åEßYí—$¼oJíGTïô…porÁ#àÀ({ù6ßc ÿ âj‘endstream +xÚ¥X[oÛ6~÷¯ð<•ZÑÕ–ì!+Ò6E–e; Hó@KL¢N2U‘NÚ!?~çBÉÒ,7-† És?ç;‡Rü±?þ8‰]/\Ž‰ï†I2NË‘7¾Êë‘o9f–eÖáùm5:zÏǾç.½åxu³Ó»QŽWÙ•óòÍñÅêäÝt†¡ã'ît¶X$Î˳ãË©ï\ž¾<>CRä\ÀöÝéùj:óÓó×Ì<ï/.þ@Ú4 Õôzõvt²jÝj ‚ KôéóèêÚgàÿÛ‘ç†ËdükÏõ\ŽÀ)7ŽB»/F—£?[UL‹Æ,5”‚8LÜ8 ÷sàÇ9ˆ=7ö"ÊQ…¬…‘¢ +"G«£”¸ ëj: xâ;[ä›[¦ÊºV5œXÑ^ì9ìÿž kˆœÉ9Ô4¦tI9È7ĽѹÉï)kè¸ Šzºbç+ÒÔ–M§bË­–Lž|˜&û¢ÏÕ„É&ÎÆ +‘Ro§>³<¾BnQ°k–ù†¹Cg q-ŠNqØž-Œ4†<¿¥u÷,×F³/MZ7¢d‡B/fû+CzÝ$AÏ>U _ >²†\²ì”VU–‚ì¿àC]‰ÔZ#5 œT´Öî¡.ñæ®ç/¿ÝÞ;‚vTß]ÆqÚsè¶yÄІŽ]0ëCjâØsþš†€!úÑó#t2E¯ ®ðTavç N<'—’h‰L3žÒ†—ï5áV¹¹ã´’©šªËÁÎàÙÁvxöñ<š»1…J¸¤D^l 'y# #`Á݉µÀ5FŒÄBré SçC[Q£V¿ŒKÈv²Õ²< oÆlÐn=Í¢ EÄKQ"dÖð÷!§À6ÈÁ,)lÏË~Ežæ¦øÊê¶ÚZÞ‡²ÚHMFÀ—šØuw’åRžk¥ØdLQhÝd~L§xÚñ0b¦ð.7¼™œœ¯Nhösç’5Œô¡A)ÂlçqìœZÙÛºí-ÍîÝpi¦^TLP–’tµ®å¦m,vrÀ0˜¨s‚YX&Τª« È´‡4.wc¥=ÏpöÚчfêž&–Á3£›ˆç1Î#ά'WöJOÓ¤E©Ï5SÕÖ ³[³¯éÖºAœóÝÈ%>~ w΂JôC¹Ï%–1žãB¡“å8¶E½E­nv>¢XÀ”lj=ms$ŽÕ”ª ôf&¨}â{žse$ËÒEë@nUJK;æ9@ÍÔ‘– ©Ê Ä­ï”…`èyÜjYNÁgˆ!ôE°\:i-w=ŒÝN·9£s}G•cë8â½9t¤Qâˆi÷šÀ°UEÓÖ¤[P¸ºõŠN¥H±·î¬C<‰¤í–nŒ7Û„DtÇ póVôw¨ü7|ç”íeÑ뎢…ƒ¯¢{Ç!N·•½¿ì Žù‹HiöÐfÇIR™ÊÞ]Ù™€xØÜ )ìQSŸæ¸¹á[´þ‚ѽ +»Ãb‹Bw.(¶Z)ó3Ügp¿óM· íf÷ü|䇄!SñrBofÕ#ŒƒyÔ•RÅcVç÷²~¬TmôãG?Œ®0óJfì.‚¤—Ð3…¯j¨K—k^Öoò[^ßäö*-keý9’&=Ò¢\‹#r‘ßÕyY’üÀëd¿rµJ¥Öt×9™š¯eŠãêN•R_O~\Lʺ#,\oɲW·…Z‹âšH‘çý¦jB¦dñòW~DQÌ ?\8UTŸm²DŠÐ¥¢å¥ìéð½I£Œ(¬Ut—ŸÔºoH´hkÕÝù õþ½Aœ©°xá÷ÅŽ •²åÙ7™åôjo3øÒ}£çj@Jn¶e'¥8ûèvf¹}~‘e6¢ïÈd!ü1èЦ‚¹^yóÿ#êìéŒ*0•×e“á!Ë=3"+óÍaޖ؇}ñ~¥øò4¬|Ïóy¸+ô`m;xj{Ñ2®uvHé`qèQT6#³æyñüYõœ×Ïô7›nPÝçžš!ñf p§ðãÓ ¢JÐÛê·q7V¥Þ–ò;QÚÃJ·]÷Yw.¹l2Ýe¿Œ3;ÿh<&<yê Îv¬tó÷&ɽ¨hBðÕðÝ(³M6ð1zn0ø)¿¬õýë¥ý ƒ;8 |ÅAà~ã {ÿõ·ùÍžÃÿõ¹ endstream endobj -5064 0 obj << +5172 0 obj << /Type /Page -/Contents 5065 0 R -/Resources 5063 0 R +/Contents 5173 0 R +/Resources 5171 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5062 0 R +/Parent 5170 0 R >> endobj -5066 0 obj << -/D [5064 0 R /XYZ 85.039 781.388 null] +5174 0 obj << +/D [5172 0 R /XYZ 85.039 781.388 null] >> endobj -5063 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +1150 0 obj << +/D [5172 0 R /XYZ 85.039 706.019 null] +>> endobj +5175 0 obj << +/D [5172 0 R /XYZ 85.039 671.274 null] +>> endobj +5171 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5069 0 obj << -/Length 3589 +5178 0 obj << +/Length 1968 /Filter /FlateDecode >> stream -xÚ¥koÛÈñ»…ê/G'šäò™ûP8Nrõ!ɹ±ƒ¸; ”HIßÌsàB;ù¶ÀAâܵն/[y™*ßi¦ÊsÚ¾;ÅÙà,¥QêG–@ ¥AÆ  ôKµ:‹f¤ÎsÄÀóãÃUày¿<Á4P: 2§gHW¢X[€ï̛|wèšé ^UÞ—ÇGë!¼Ád½çª_ó\™/¦ðXkÌag³ 04 AwÖ0&`'ËoiÉ ‚òº†á ²¸3óQÐ|Ú>’•9ýZKý­òc§Yâ‡Wï”Í:PÉ8`5\åý݃ÿŠ‘öø¤n¬bAúqd•d“Èüͯþ÷Eôü»Û÷oÿ‹Eà\"§~ T)j$²zçΙ ô¾c9²l˜×Ð0 Û¡X„hórAȨT4*ŸÙ -ÒH27†ØbÁåX®GJ£Âq…t² ù¤¡ÖÄæ‡Q—Ô¥EÃË2çõ Oå2dzÕ=r#K™ÂZfééOãƒeôÒB}œ8Û|c“r¹ÇÌc­»C>YK)zHPkXñ– 2ÅÒùWeØß1PO…gÄWš{1H%©;Jv'"Rg.¨Å”d¦ TÖÃ6=Û å…×ß–ú@øF«ïH„lŽ —†— @š·B-´€#ŽXÐzûîä'´åÈ©zœJœ6%jy\uŒžó£-¿îpŸ–O\2/y‹>9ôd8GºSWÚWÈgÂ>à[ ®—‚”q'/²ÿVcUÞgËSs:?!ÖŠ§û¦.ìsGt윱›ZA LÜÊûmA<¨ÐÄòyú‡ƒ®1âóº”O€9/ŒÒjb¿îŒì5r‘H,K7*m‚bî>W죗ÃoZfOhË÷iÆ„ÉÚßò•,˜÷ü|ÁµšûêHÅÎ}Ãÿ÷½—⑉ꈄ³¶8a9<òœõ&ï«F³EVçeˆ°'Ã0ž:Šq°Ñ¢®D‹º‘®sör0ÿ2Åv Gü«ø±A§† ì† ÃØ6Dœ° ±cȶéy0æLy-–+ŽÇü)îBjó—w–ÃÒêÐ2Ή‚—'+Ø®.ù+6ZrH:²ní°99kY¡¡PÃôȧ©8Ýߎ¦W<‘³ªà¦«m'0|dâ5«jÁq›“¡§öˆ<‚³¨Ó!RÕ}… dÓÉ,Óád@ùþndí†aÈA|ÖM>b¹s -}ùvÁ§€üµiù¹Ì‘¼š3]R*΃ړZr‹²Šcô‚> ™Ô¢ I])Æñ$)€#Ö¢ €dëJÇ ãð¥(÷üp«õ àÕøØ<æ`¾|ˆ96˜Ñ9èçÚÖ$€ýîEÞ??œU]W¶3ÊqƒLŽñÂÀ×MGÓÅÖäjA"s@ŒGŠNâŠÀ6Å#ËAãG9² gž§$s˜~Ôî˜Á¢p˜% àÀûü'òÑ3z¾ÖN:ÊNg•4ñ8#‚Çnc§.A,FÚl6Ì‚ØÊ ¨k~eEßò‹~¹ëL†)Ôu„úÜ(W´ -ÁÖKpÞ€ç´ ™çžÚfÕò±éa'̬$úCö.ÙÕ˜7ÌYïk…ƒ1,ù¹—º)NX” -øõKÇënÜUMnªÎW5Îéú+ç¥{õW"õ×õ·¦*ØŠ+áØ8›†Cgì,@jT5½êSò¼ÂüÕ®¥°Ó1:{k¥Î3¶½ÅÁ,dzÞ´Z¿qv4ˆ0K\È‹Ïña@9]Ü…I µ*û0Š¼IâÌøñ´)X–&·Ô>vhiJB K’8¶'à -þ܃NÔè H)a€L†’´yŸDÎæ0¬õg3Ïœì;yCC]‰å¨p² øC?¢žOV(b¯–ë'E4 ”‡@Ãé#ÏrBÈÈùrRÆ)3y[s Á⢃\j#ÙPfû\¤Ò93bªi¹Zbã#¿®¶ã”ŸöžYùóÀNå•éëòŽêrÏK÷§neP”y1£¹šÝ¯TÙ_0÷í¸ø8i~µ ªtUŸá ~bÒŒ:ôY—ßó`“WGÔ¶'2:1‘©E¢d0.S^ yLwÔ4¬ù­ç²X²§Ž`” ¥äb?ÆD±lc¨¬º¾¿è?× Ø²¤àcƼ‰Ž3¥¹>`(=±žºŸ}º»9þ<ïJ\ÌÏöŒÂTk7·&Ý i³ÑFFM„›/=ž«nÍ`²Xxrv‡ìÛ É¤*£b ¸‚ä ­a£Öº^:Q5íhK‘7"˜¦.¸NðÆ®öe#ÚVÖT‹Ôÿæ*ųKQ˜:4‡ZBŠo”‰/©É¾¢,ðH·Et‡’ø}üSÍ¥nn"F»'ɵ~¬"ØÙ/rq®üV-†°g€1ø–Â\,aº522Gw[°“V‹1Þ:º‘²º´,Ñ‚ú)“N%û~–¸¾>…¶pN7c0”™ëûŽ/͘/k¾*`7'iþ-z<Îýu4‡¬ê¯§è„T-‹Ï7K,œÓ©¾‡nœquœá+Ž[ÈAég-šº>Ê@¬jËÄ=á»V–n÷d\¹ñlTž•ÆÝ(l ä5½¿:<¸!8vFãå˜Æ™YH|tûg>^'±Y ~+9ÚQ…®¯ÎoÈ(Çûí±Zen”F{ûÝÙµ‘áGÄmCx,¬Â”jöšá`àÌ`¨ šö…GE‰Æ]quSéÅ¿ÐK¡SA*œL…S¤¬°8Yt•¥ßé5•"Û‚`GÕ=•ãã.eT°ïzQöÁHg+Hßì¹ µ`÷¬µß¨`ñjXJpÏDèFZ5n»çí ƒõ•ŽœGç¦iÉ êZ$:¶ÜÀþ=€côÅx[™¶‚NˆÊ=)+/Ìõ;¢28g$Å8ßԙݴœ6Ó°Ù¸”2¾žÆçpýÝóU­Ouµ.³àÄÕ:ß½PÑf~;€J=ð³fN)1Çîù^¶ËäfÙJ /‘r†Ù¹¬xŠc«=¼5)¹\íãíõ=¼Ìió ¯Šxm¯¤Eà}ÙmÂweí{%ꌒËBíjhCäA×cÇ—Þ‡4gÃþáAªü€7Î#mááÒ™ÂÕVRˆ/Æá¥\'Kdâßæ…:M±;诘Qr®îT¾ <Œò#š ÿLÛÿõ+¾¡Á¨ÜTpCx9øšÎ8²Cz#•‚¨c‚ÿÊì9endstream +xÚ½XKsÛ6¾ëW0ê!ÔL$ÁG;98¦ît’4V6Z‚$6"©µýñÝ@Ѳœq“NãÉ»X,‹Ýo’^ÒË”¢ÜK3)¢,óæÕ(ðV0ój$­ÄÔŠL2Ïf£³ïUâÉ@äAîÍ–=JÄ*òf‹ßüç?œ¿½|7™FQäËLL¦išùÏ:¿œHÿòâùùO8ûo|wñz6™Jÿâõ+–G™_Þ¾}ƒs“,òg“÷³G/g½Yý†`BŽ6}ýö>ð`ÿ£@DyæÝÀ8¦«%TYz3ºýÜ«â¹ØãU§\ ¢L¨,ºë©Nø D,SòÁ¯h{³ƒ3ÉÌŸ54µèÊÍžéëIh™-œ·\ZöͺœãÌÉÜï´1e½ê˜º¡5­fª¬¶›ÖÎQIi60ÜóL±€ñB/X宲3è⢚„)paôØ*^èe±ÆƸ%SÜi]àÒë²Á¹Vàu@dƒãÇa*Rt#üESOdú ŠzS7;•èìœd–M;Q¡¿Ò¸•Êüâj¢$¸Ë’f]v<Ú¿¬Í·“iœ>Õ +UÅžW¨JóÜA+Z–ƒÓÕV¼¬ù»ŸàF-©¿Ü™];X¾Ð¸º Ö¸œœ‚7ä^§tÍÌKÚ ¢ý ‹{b5Ib‘…êÁ +NU:¬$d"ˆ¯ûÔТÔðÈJßÖÒ'µJ3‡€NbOJ‘+…7šc ƒÝJŠ$Ute¯wz}|J'(‘Çdž÷Ñ“"ˆó3 O=£ƒÐ8‹ýf¨PmC@Ô*i£OmÞÔàÌxµkqgS65ÃþŽµ!f=aN±XðÀà!5—Œñ¥®Ç¢¹tKôè÷)ìA¿­qô±Æ€0(<~ù#JfKj;ˆÊ’Èö +ŸA³tÃ-â›"Ðõ€â(3Öpœgèe2£¥`ïrä¼4Ü­óY×D£y¹Öž¤ÝªîlºtB¥£h1!ÐÄ y]Ù¼Ò.F9ó|(J~ÂBëK}ÄZiã(•Æàq|µ’t×ͺ‰©¼ÌþB‹[ªM3Xc$k¸*¸CˆŒ[]´‰$6ï FÏ@Tj5¹†FDð”ÜŒÝäAÁõYÑ•šºî~X¸Âp¡Ž&ǪK[YžË㶨£ª‚Ñc0ªËR·b›x¶e™¹Ñw2dª€¯ôÇOÜ‚º=i±Ëÿ–MöˆÖ­OÇ”'4/-ÂÏîò¥”YiÃñÙ!týÙ(8ÚLÕƒÑQÊo‡÷<ï.?OºvLÚ爡·¶à-xÞ¶W1qphð?›ÂYnendstream +endobj +5182 0 obj << +/Type /Page +/Contents 5183 0 R +/Resources 5181 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5170 0 R >> endobj -1274 0 obj << -/D [5068 0 R /XYZ 85.039 522.834 null] +5184 0 obj << +/D [5182 0 R /XYZ 85.039 781.388 null] >> endobj -5072 0 obj << -/D [5068 0 R /XYZ 85.039 490.015 null] +5181 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1278 0 obj << -/D [5068 0 R /XYZ 85.039 403.708 null] +5187 0 obj << +/Length 3218 +/Filter /FlateDecode +>> +stream +xÚ¥iÛÆõûþ +Õ- +°XoÈÛq’ \gëUî•(‰ Eª$åµÿ}ß5ÑDm†¡9Þ̼ûâªYÿÔ,Oü *fY®ü(Ïg«ýM0ÛÂÎ÷7J ²p`^/oþþ]’ÎTàA1[nÆ{?N¢ÙrýÑ{óë»åÛóEEžÊýù"ËrïÍ»W÷såÝß¾yõ·bï¦nß/ç åݾÿžáæç»»ŸpožGÞrþ°üñæíÒ¢e +Äé¿7‚Ùðÿñ&ð£"Ÿ=Á8ðlïo)?‰#™×7÷7ÿ´Wñ^<ãSS,H¢ÜOòè’*™àAøI†²G²†С»=\Á„–ûc¹frCÞyš‡9À5P5ÛþëkD‡«ìyi0„i¬LU ü8ˆìEˆê¿•¿§‚ÔÏ“üÙ ÌÅ‹'¼Q*ô#ž¼ø8_„™W"'VúØ—d¼®ÖÀŠæ«¹Ôàl®ªÍ^v°/À‘É]Õàù¡ìú9„÷—+r¾mx]÷|ìзé”~„q]¾ärX_‘AZD@ÐóãÀ\—ú=<÷ •Áù‹“2p_üÓ2ʺæQ%+O»j…ð;‡ßº¶%qµ×TH¢E®!¶üÒÑØEé#fp…f`uQà9ëÌ->øÒŸK:œD¡…)kD…² c†Ó2Ai¶7hƒ®åHÆ‚¿ÞãÝZ®©jÔ ž¬Yãßq¬>FDÀö§y÷ÕÇR^vZ à–Ú¢lé~ãõ]ÙÁ‹8VÞ]]jæ!–xë1Þ#?4zª‚8Ñ•5ò/X£áwБݬy°&'ñÁl䱜ى7Š!ëóœÈ'!¢1üPá,-_ý”LEƒËžîÐlNòD+[ú7£VÊyp ) +tBwåæ(|vŽ­Ù…"šÛf¤í’!Ö;pta™§:ž1õÃñÀS|ù0N@@$4ç,OºR×µ\ʪeèÄ•jpoŒ]ÓBñªÌ£' !Úã°j÷" ZhN_EͦþK?ÐM{žï5B|á «\'ˆ¡Z¶l<ŸËYÀºÓ,3t™/Q¢ ÈÁfE¡Ã†˜7µ‹sy™²§·Nê…‘‚ÿÅ#¯üF˜@û kä¡ Oé¸IaR£êcÊEâËFÕhkY!ŸtŬí,o1ÛˆR¤bÁö⛼"‹`=oY“o—.àOÃ4ÝÞòïçÉhBï•ÍSeäha$G…ÂMãj­nž`Ù<0²y`U…ÖŠ’q/hQ•‰Äsò)Jã­™˜%{Ðx‡ÿp¥¤‰SˆvyòlIãÀPÂnìGqêÀà|à—˜e œõóÞ~Êfm1KSL¤%i潑ÊÌp‰Þ´Gø;(î†k¸C…B}õ,î#ÌÕâ*2_…l,·ÍùcEî§qnà"Þé¶3|pžà…}ùìÙÔ3°–z%1íÄñÞëûoq€éPƒÜÂrìØ ruœ{¥3:Â"öÓ0u ¹àšyÿ£ø„€±z ½~'!¬ùgZÎ#ëé\´‰씟Ý"D轚åÍâ•9ÙƒUErÕùaÚ˜QT#NÕzp˜æ©) + Ûs +˸ Xœ¸Râ;%lPÜfÔñ$§±ŸÐ!¿Ø—.èz оfL(}gOŠ›RžášWÖ>€Ǿ'êqÙÔ°8.?“ÜuÃܹðaä“#'ïDPªj‘{^»(Õ$ð~™ç±9·BdÉãâK¤¦Of×D¬¢ Âgñ<+F+b:ªíÈ +Z‰+ò8¨?–F^·uûHÙò/Ü—+SòLáä~‘>ßáp`®âÏü\I +AÍð1A5«x£ïJÊÓÀ|<±4r„»õ¡óþeæFýVºJ>_Ûr)D×-©LŸ(’í™8n¹në^r7þä¹M zÁ׆!<6б#ðß|ß'o(þx;LzyùŒ^5è¬(Ö<8Py¡Ã$›HzéÔlð Ïø{š´qÀ½“Þ_¤Íƒrï®­é£*¶Û·*ys°_à2=ÃÊ~‚Ëlk÷Ï }Q_ŸPYnsCþ6?/¬¾¼à§M 6ŠŠ‹ôu7iÏ&‚¹„_U´æì.åCœ?U+B¡“?˜S¶˜ ¦Ï-úÀ7¸5^–;y€¼`Ó“‰–Wl. +üioÿYuþ¯?Þqº{~]éR%¯‡ÊàÂ%9Ç×ü‘ÏÂÿ‹7íýendstream +endobj +5186 0 obj << +/Type /Page +/Contents 5187 0 R +/Resources 5185 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5170 0 R +/Annots [ 5190 0 R ] >> endobj -5073 0 obj << -/D [5068 0 R /XYZ 85.039 374.304 null] +5190 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [97.651 400.011 295.622 411.701] +/Subtype /Link +/A << /S /GoTo /D (extbsdpr) >> >> endobj -1282 0 obj << -/D [5068 0 R /XYZ 85.039 197.117 null] +5188 0 obj << +/D [5186 0 R /XYZ 85.039 781.388 null] >> endobj -5076 0 obj << -/D [5068 0 R /XYZ 85.039 175.92 null] +1158 0 obj << +/D [5186 0 R /XYZ 85.039 469.785 null] >> endobj -5067 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F56 2890 0 R /F14 2895 0 R >> +5189 0 obj << +/D [5186 0 R /XYZ 85.039 427.438 null] +>> endobj +1162 0 obj << +/D [5186 0 R /XYZ 85.039 221.978 null] +>> endobj +5191 0 obj << +/D [5186 0 R /XYZ 85.039 179.025 null] +>> endobj +1166 0 obj << +/D [5186 0 R /XYZ 85.039 137.329 null] +>> endobj +5192 0 obj << +/D [5186 0 R /XYZ 85.039 101.919 null] +>> endobj +5185 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5079 0 obj << -/Length 3465 +5197 0 obj << +/Length 1857 /Filter /FlateDecode >> stream -xÚ¥ZYsÜ6~ׯPù‰Sëaxû²¥U[‰ck­qy«²y ‡”†9&9R”_¿}‡äÈ[[.yp4ÐF£ûCƒî¥ÿÜË$´?½Œ×ö“är»¿p. çí…+k!Y4ÿÜ\üðS\ºŽ:éåæ~˜'´ƒÐ¿Üä¿Y×ï®n7o>­Ö¾ï[nb¯ÖqœX×ï¯îV®uws}õ»ëªŸn>lVk׺ùð–é‘æóííGì[%¾µYý¾ùùâÍF‹¥‚)Êôíâ·ßËäÿù±ý4¹|‚²c»Ð½¿¡ì0ð¥^]Ü]üKOÅ}Á%šS¢X»©záy5E®D¾V“½®†!ªÉu=Ûw½Ë8tìÐ HO Ð#,Ô…¡c]·EÖ—õh"Š¬Û¶¬û¢ÅJlýˆJjËGU¿]ù®•mÿ Ÿ‡¢[ÒR<âô¼Ü Éí†Æöj¹½”›@îÍ®X­½Ô· {Û@9±¶ -ØuÜÑÜã¯gmIj ¢^XqyØwh©¶‚Á}ÁtÔž¯h¡Ø^HÓ!Û®¼ØúcF¼XbRÊïWø‰™Ã3Žjj˜!瑽µ#Qšƒ¢5¥ìw(‰Ì–ËzŽû‚eCÍ‚ÂÖ.Z+à?Nè´Å=íE ÌÌÅ›=²!½”2œfv-»ÿŠ=“eU'J–d«Ž(v‘sûSÙï°€t¬??‰èpd{ÔÅW,1i^v=éò+ÎЗ°~x߈|û¦- nØîZ$h¶žYÍàâ"]°ËÀ¬œÑ‰¬n×´ýk(»0”ÚbXñ§“ÕvܘSï¡l-Ž§}Lô>bcb‰î±˜1ÙÃ_8¦D-h3H)ÐÑg-­»ª˜Í¶a®­‹’튩íì>ºA¥¬³{ͨ-ªŒ 2熛?qɺ‘gµeü£dj›j2 -^]¼É>Z.P>s™…†BYw=¬ í%ÎJ‚«!æÚ´ì…sÅ®Äçý•A³ì¯¢È±Q—öW¾ø+rèÀìq¯|ÍžŒü×oý#«~NÈ0¶c/8/ä@³ìœ"?…à Î)ð©abc'2)ïxùìç[UÏÜ–qú¢¬Ï¾fLJG¹ïwYÏ%>S²©Ø ]Žýv,Ú·{ËŒ 4cŸ‘ÏÊÚ|ÆJßm6·¨Q9³ùBt -Y]v{v.°Àõ Ÿ¯S›Ëç°!–M)è37•5ÿj?±ÎH0,ðò±}—uLœÉ ŒØwâ3KãàDŽõùVÞ3å=ZóÜ!Ô|=p -dçý‘97åä\aö'ŽA“åú¸ƒ^Ñã/Ÿ ‚Žc1DGAàš:‚1‡S:¡X—%œFäúÌ#hÁåC­ÜFÎÍH›ñ¸·*®á¼YóÓ®ÔR@ß’:¡ íÅ÷=ëرŸ…4ük:T`wÿ,ÝP!ÄÊàcCY4æ¬ÁÚSóÒBS¶•WjFµ'ÐÙÔ2 E¼V­ÏíeœÒù"dH–"LO?(}íMTÖq‡Žµh1<€ÖªTЉ:æMŽý‘<ÝWËÄhzt^ðªÇ”tX ,<–y¡àÿì ½2é`£ó¬oÐàöY9_lœŒ?q¼NÞ/Ókä™7½t -×½4P@’Êÿ@4`P<äP{×s‰ïùx.è$Ä-§™&c0›×k¾s‹óA©²Ž{žgQ jU2ш¬îæ`²€xªa"Zh‰ø6‰]“æfiQ2Î’tÜI ~Û‚˜7}Áõ»QÊ[4›/¤1‘£ã©1!‡}¦r¸e|ûa7{9³|s•lÂï¹D©™3ìUèGvœ†/¨p :£B!ÂEù‹*<ÇN©ð,7¥BƒÛ÷XòM§Ö[&öx…›ßª›]j ´uxD·£ ŽoýŠIô5R}Âq׋®Øóm/ˆ^pÅÑW,D/¹âs •+>å7ëŠ ~ÿ»ŽÇêEýÞŽPÒ›?ùq`¤Òõ§Ûk±îF¦ç”üÉ[PqÓM\ÂÃkÑ#wø«N–ÙÕ}­uÜXÔ[ˆícQ7€À ­§]Q3e©žGèÜò$·Â=å8›a ¢†£\ÅUv“½pD’-ÃaÍ € ËöRê”d™ºŸc«N,uG„©Øô•Áº"T•­‡^G´³ÍQFtÇ‘÷×é\aæE°Náš3ѱuæ¶-TN:DûÓ* ¯ãšîO ¨G¯Oìú=ßWâÈúB¶'Yà˜@ª/  n«cn:ˆˆŸ’aŸ¢nFmæLøêŠÖ¬(Ðò^’“í½-%yNiJàF ðo.<â3™k%¯„q=—ÃÿB†3àl4ø44¾iiïVªD‰BÚ¥Š¿êš?ä81ˆŒ_L±Vu0ÞgC|þ‚¯ê¤–Þ 97´ë7\Ž: î}'2¬“8®C¡2öXWÏ£@òG­; öÄ)[(™¦…õÓÛ ¶í$ÿÆ[‰-bàʪñQã~2L=qÆõÃ$NØ‹ç殺KY§m»—ë×àÇ´áµLLϨÝJ®lš”ïÏ{\€HÞÊ¥Ne¯ù†'ÙNà2²}y‘»žº¤ÝžÞ`éÛ¼U†gq:Êea §DtV5êæXÖ›î$›H~mÖ ¹ü´ ‡ °åä)\i -ifÎ&6³§#ÿÁÓºây¾93C H¢«ør×Hµ¬ù·ß çÓ#‡m¨5ü lgêzºgÞg²g84zãð]¢XÖÏdxglçÝ/ï•Ä­ «o`ÆAÜׯrEþ  ÐÂÔ2 ˜(Õ&VÇÙkw:„òôë j…•ªÜ—ý›Ä)T!xø éÖÁÆЗIXûÀøé Égn94`jÐsyò•|¶žâ`l22ý˜ÖÀºnÄÎ$u}zZ‘„&»õ×tˆXH“åÌùÔ\´xæ,ì`±ôa3c¼cMŒìj”¯Ì/0†œIÛõKé¾c{³ŸBÂóÿ¿¾&ÕOÜo'þÂ÷”! ÏU²Pö0uNå…{.\äý©Àÿ{©o„endstream +xÚµXÛnÛF}×W~¢kÍåòZ @ÇI®b+m +7”DÛj(Ñ©8î×wn¤HŠ‘8…´—ÙÙ3³3gg©-~ÚŠ|å˜Ø +#­LY³åÀ±naæõ@‹ÄHDF ™“ÁÑ+?°´£b'¶&7[=¾ò|cMæ×öÉ›ãñäôr82ÆØ:RÃQFöÉùñÕPÛWg'Çç8åÙcè^ž]L†#mŸ]¼fy”y?ÿŽsÃÈØ“áÇÉÛÁ餆UobÄôypýѱæ€ÿíÀQ&Ž¬h;JÃôr ”ïégƒ«Á»ZÏy¯êsA%1rºîîvaÊv¦³ÙÙαF0›¾ÐªÐ_+þÝÿšÁ$ ÐB_+'ÞöÇSIUBx>§_Á¹ÉÝ~­,å〓òôõ/]—»^¬âÀµ;íÀ©döÃéjªá”)ÂYAkžÎ9f8’ãÐߎön7ÐX'åFhúaQÂÈw^ ,†ÎK¶íZ/VC7¶ËÅê¶k’õÔ »ß°æth…ÚSqä‘]×·Y>EOgq:~ Ž˜fï×0…#@MI–üÊÓbÞ³(ËqNÓ@rª+ØxQñˆºi®hªòISq—ãô¯­àxÑÜ–®ÅרQþ‹dM¢.oäÉFÅFÎ’{V¶J–i èQZÒY5¢X²_i0™/«–c54qÈC¸.Ž`]^öè-ó2É:Þ…-xä\;m;X;Nß™nhnq2CMwb57e_Ú@ìÙnŸ¶M!«fÙ"mš“¾Ôg¼nY¿"SEBܲºë–eZ–}:Ë ãRÙ²þ8CîØ2yO4î?»dÚ ŸVÌö®Lé^Η¡ïC8ÂÄQÁt†®—3ÎŽ + 9èSî¦À”ã³àð>P-g6 ÝnÒB|’jÛcÒØ]·˜}O¶Ê²uZ%~¾ÂÅ­ÈùövëEù¤IÍøX¢ªÇ._j'V®Z\…OÞ¸F¹aÿ};ªôŒDQÏ}¥]å»´QO®way¾ +üøù°DÏX^¤b³Å…ÆI3òCƒì¤Î¸/ ë[Mbü2¥.É3N+‰ãÑJZü_‰Òºü5Tvåéœá>ËÏ¢jÔÐÕS"@¢«Em"t;QéÇò3 ‰®'°™P¹Žß¶¢PÒP1ÿøµõ‰Êœ¾ëé»éª‡ üg’/ÒHšmux¤ïò¢”›2¡K¢YjÈBGÑoÿêy•”C-%9j*qÜ%†È#ž1Û ŸG¢kÔPÖCQˆ¼UÉ !_ñ®=¬J¥êHåšÎÆš;`OŒâdÌwÞ25‰÷< Fhö•êÈøàý¼·Sý:4PòNÐïr#Ï'MöÌÓ›Ï.C£BÏ&>JK(ÓaðO>ôí›|ͳI–q#^lP%.¤Î _²*YI[©Å%Éš‰ž¡~Ú“j|!‹08¾öh€Ò ß°šY²jè«+7z7-nä&†E:lûá²íÉŠ8ÝgTÎå  +ÄÀ²ñ<`ŸT&)ý—Òc~ÇdÛÐHHXº¥ú4©nþˆkð‡ç»Ñwþä§S‘ÏË°f ùñ4æTm"’ù†«d_NŽ¬%Œü2 l:;„x¾çæÖ§ÐY&u‘±“ûÌU)Äå­e^{ˆ£€Øl.54ø¥h”ÔøôÂЩ+%‰2ΣD¶å²,ÝjÍD¾åûŠÍVÛgRãeÔÑ€PŽ †“ àd6 ¼ ùÞIÙ0V~ä[® Éo‚Þ×µˆŒ2”l®Ó“l"C”?4”hDY0…d²HT/Í}BMãAìCTÉì@jÓbમü&¦²Ê>7‚ôM6…T½Ðwì«f%B#eÎ’~àÒ©áx“G°ÏfÊ G8—Ë„¢W6Lî9wgp‰&"ÚJ’å^\½äALD}‚•()ù对—¯pãÈ)X«uc˵¹1Ôq'œÀðÿ||ytŽUàK k} .äq²ù±2¾L—BfQÚg+–¹­¿žÔ¯¯$ƒ{Æ×QmÂ9h>ÿ8dwJþ(”VuL«z Làª%:2Ž»'#‰ÜÆ›’û5':NçEíÆ›C¯¡âqk®[ÈúšÂóMƉ‡£é×{*[ÓY‰†Ÿ zµLF±ÁÍX(G«¨œ 'ïÇW|%£ûÿ°‡…àt.^‹`ÄŸ•þºúãÃáÍøýiŸU­w¸AtŽ T~ŽøÇÃÈÃãÂÁSùÀ½ü¦Šº´×|Þ…´Dm] !É$›¬,ÚÉ!¹2_ÀcÒuõ¥`ÿ\¾PÈcEn"Ãß`ºÎÍ #Ÿ7ÕÀfË¢³œµ®ólW±Do/ýU ÔFq½"øN½â™¸Ÿ®|×U®®° ¿ttñú&26»€ÿÊMdZendstream endobj -5078 0 obj << +5196 0 obj << /Type /Page -/Contents 5079 0 R -/Resources 5077 0 R +/Contents 5197 0 R +/Resources 5195 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5062 0 R +/Parent 5170 0 R >> endobj -5080 0 obj << -/D [5078 0 R /XYZ 85.039 781.388 null] +5198 0 obj << +/D [5196 0 R /XYZ 85.039 781.388 null] >> endobj -1286 0 obj << -/D [5078 0 R /XYZ 85.039 761.463 null] +5199 0 obj << +/D [5196 0 R /XYZ 249.962 764.647 null] >> endobj -5081 0 obj << -/D [5078 0 R /XYZ 85.039 741.134 null] +5193 0 obj << +/D [5196 0 R /XYZ 85.039 316.997 null] >> endobj -1290 0 obj << -/D [5078 0 R /XYZ 85.039 671.875 null] +5195 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5082 0 obj << -/D [5078 0 R /XYZ 85.039 650.679 null] +5202 0 obj << +/Length 4000 +/Filter /FlateDecode +>> +stream +xÚ¥koÜ6ò»ÅÖ8 2•%ŠzÝ¡@s¹´—¢çºµ‹Hœ¼«õꢕ6+­߯¿y‘¢´² \a$"‡Cr8œ77\ð.²Ø¢|‘f¡eÙbµ; ÷0òÝY(KAY:8¿=»ü6NaàçA¾¸Ý 뾎£Åíúƒ÷öŸo®oßý|±Œ¢È 3ÿb™¦™÷ö‡77¡wóþí›pH{×ÐýùýÕíÅ2ôÞ_}ÇøˆóËõõ8v‘EÞíÅÇÛïÏÞÝZ²ì†@BŽ4}>ûð1X¬þïÏ?ʳÅ#´?„áÝåÇ:’~}vsö“]ŠÇô‚gͱ@«ÄW)4à(ýÇÛEYä«HÍn,–aøzžlšÀ:Ü"ôh²Ì2 •…j±L’†c{1‰^„¡ŸÇ1^L¦~’«EªS?5ßLq¡”wD†÷U ,n¦Ü5³’<ÖSŸá4°2ÿœ6c8.ßïÂ`ñ(^Œˆæ…—ÎÊDt˜9ÒƉŸët‘*çȈèÛ-Z‚tä™·¿P™w€~ÕôUß{„§Þ¾0Å®¤ã•©:þ6-a슺~bHŸÄë§>`£‚Æ +%cÕ4üPÖÃF¹wvéN¢˜Ä¶jVBfÕ#_éÂQÂr:Q’¤ˆV×åš{Ûò€“’ŒvnØoöá¾nïðTõGajWp{Ík€¤1îE#D}]Ë +Ìú„G–•hÞïA•t:™´a®p§˜ùÌhbqOÜ8Ìœ¨Û2ÛKòQⰵѪ±W•8¯úoA°õÔÉ‚ŠŸ8X¥? â%ª Î Ù#«tâºtv03*RNæa©#»g‚o(Í=;ŽmÍCwxׂfÍ8ªsq¬{£"–ƒCµÎ¯Úð(EÏØØ£YŸBdBäã +OiµA뜴©Ã`3àpa¤9}o¶Ñ:3ŠÞ2m† –å½—Ù;ÒIŽÂeåÞž©Pña +7‚”½1" sÈ“Y}MN°_I +ˆvÄ£õÆQi–¬V­Ú†)BAckƒÄ9B¦Ã :çí} Œ:Ž1º6ÑÞéöZÙÝ7-Þðšb”<öÚ e'jOb2€lÛ®Õq»3;{|€ÔUgŒil¬rA؉=bãU3Çlùyb˜}Å‚ËZÔ’z}b[vUV÷Û;ô—`§Û–[ð0ÏvÚ bÆ+·œ5A”—P¾AÌ“‘T$ÊYÂö<4«5%%Q˜³òqŽç9Äÿ‘ ¯Z’¾]Ñ ‰pj0î·h¨[Þw]™Àfˆ_Qkû×̼ÁrSZ*A3| ö©¶©sÕ×°d˜±öfÕñÌF¾x4­ÝíDÏÐáýó +g£T,¬SÁö(¶@+14º#D 'õ_ '­½Û!¼•Žuæ\O¢k„¡Î‘ÕÍs) `J‰#–OØ!­’´(Ïç/À×w"qY‹ ~·sÁ݇Inñ¬ ä‘룡‡— JaãbÀ+ò׈P‰3†æcÕo™?ÓÄaxGh^±m#4˜Læ8Xí+s&Dø ¸Çò(½ò (nÇí^*9;o˜¾isG¶û¡ãæâEE#^åkvâãF¸Ä· Ñͽ™$QÁè\¯:†ž\ƒD÷¥þ)– ¬•¥ Yv +ÝLùPµÇÎÄTƒ˜d#´)]"ozx.Ð@£¡ÒèÅ@ÃÁy6Ð08.õ…­ðD$IR úO{×q$ñ5 8ÉÖsí§`Ž^¢Ìàœ6&‚À_2"ÍĨŠdö¶ÆçÀƒý.4l'µ·êSW;¶¡Õ(<\I`ÈP îdé»a1Ë ¸pDûäSqyë2ÁV¥¹g#ñ%߉uÁu8>ÅAîa9—Ì’Ì0èpF” %Üa.ƒÃ¾Ù’ūׂÏ«º*Ía°ßјï*éÊÆpÁÜxÜV6M0…Á/+ÉD;ÙÓ\vhmÜWœ´ÃêBþ™ÌæéÄû72¯åö®%e‡V·/VÒœ ½yyéØg…[¯Ø—ì•þ†¿åá`2^Ü”k]A–@SÞ…ìãÑ;wCÙqjCuYåB¶¹öH‡/„„ö •Ml+Ç¥QjcþHµÄI¼LVeÃßóàœ×‘à† ÂÐ? ˆÙ¹ó(¸Ã…×JYâ*‰Øb·ô®’ÌOr5í\pûÀÁ#Ãh¾uýÕ3Æ,‚ˆ+V/gMγÆÌà ’ÙؘJPhÁ*Æ8ÉÑeÙ¯.m&…x'iRè+_"ÓàœÐy’&¥JL[{CÊ\ ı:Ô Ÿä ·ePͼýÄÝ +86 +F«my¯g8ŠJ”’iá”QTr0)’öu8iä$-Œ(ä8+dQœ8¹;tÜ +ößbû|á»yÍ]aŸ#bˆ +Fc÷݀ʪôq $e¢Ëcª/Ö² Y(Xà‘ :¤iÍ_1= +û£äb!\ñÐÖnÚ‰k‰Â¿¬Öçn\rt.þ¼²•J7þ‰ÌMH¡‹"Ãní”Ïë‹7½ìû”gµEPæ”Å”ŠõŽOäêË7 “›jK˜ùa¾D¤A™R9Ö¹‡E2Ù‚±>pI‡âŒM#VëÉÆ™ØT ‘ˆ‡Ë½?´’Ñ’„¯¬¥Ì§N+ûìhâ”ëG°X±P×tÇâsdw©±ž„!E-£¢k鼪¹1ºá3ÁÚýØyöj“Œëœg)p¨sy.”Ç”¶‘¤ŠnMî«üRìöµ;TVzLl|P“¶±$\ºÀ‘ÁšXÂxcJ夾DeÄS­˜ 9'Wr(á¤ÚÙß°V`‘ÌVÏHT Âïn6W$ÂUHrð‚]ðç乇èî¹<†Þ-•Ð{~sÎ .ïßc) ’Ć•Ô²D^´gÔFÊùsï$nŠ&5Uƒ±NprçÊÐGÍ•8fê¬[çxJ5…“­¬9­+#ð¡*¤iØÉ”1°ý/4÷ËŸ¯ßòËÄ.ìJ†9Ñ£¾MÝLÞUÛ Z¿Ew€kë‹Ð© h:)ñ›Ó‡†’ß…É£$Íœ©®ËS…Ž<ëØÔ y뉴¶O‘VŽ[„WMT¯U©€%ã„\G\‰q_¿M<¯Q.é-c/¬¥2¯£Ó7s;KM=<áŸÔÄÖ}rÝ5¡Ý»Ù­“ Ó{[]ÈÛÁ$ ¯$|xÏ°ocÙÙ#Rë‘ðJvMláµ2d*‰¸¦¹A×îõu/9[|=Σ—ƒSçYwkpˆ…{ª~f#º*V[±Ò¤†“øT¦ÚYæñˤœÚÆA{÷Œ‰sÒ»xˆ‰PÊjÚ  +[TŸÁÜi"i”˜ËM´© QºJ%Ÿ„ƒ¡(Ñ£Åkv‰ŸydÕîv6…YcÐ%TNÇÁÁ~KM? ý0OG’Ë×Í’_þ õª”´š_Ð>ó¯Æ2ÌÍÿíoŒäç,û6nÌc)g’ö瘈BÊMwÉC¹>Úu-R%”„7OÌ’lÖÆ|e\? ;wwWËgìÙ(}~Vü£ÐOõËÒoQž~FÁm‰D{΀Mi}¨L<$’Ïyæ¸Èù¤Y/PeP¦dMä>÷#HĺÐ<á?•¤µRÆ×bóɼÒ1ÓZÌ +{5<ßâ|²{ìFÐ<ævô;+DâŒMa ¹aÈÕí¥útùÛ5÷†Ng IÁ8CoZØ÷l秹óëhÿjº#//óìÝò;q³Šž§:^—›‚”ûüÍ븄lð½jù‹DðFÊûŠº+ÍãB’ª"ðÇ®Ÿ©3€o‚4:³u†~®Ð€¹³)4XuÄ…ÝwÃR8Ѳ y +ü4×#®K}(qîk’„Öx*)ƒ'‰‰„­@Pð}à±þp4¦+)¥ +Hf‡ÊþØ"a•–‚—ùU^‚Ù¦TòÞë&&Þ²?ìÀ÷Ö¥`’ÉHLB”L~Ùô¶à+”qw¨mñœ£H§N´.û¢âý¨¶¾¯IÏO.×Äwn½‰ªQ…õÝ÷“t¸²<“ ûÏüÐ7 +|þÁìÔ À?¾ç?õ`û+g 6%ÊçmI¬@fCC r3ÌÒ)½qR›E§ÿ·tæAendstream +endobj +5201 0 obj << +/Type /Page +/Contents 5202 0 R +/Resources 5200 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5204 0 R >> endobj -1294 0 obj << -/D [5078 0 R /XYZ 85.039 556.443 null] +5194 0 obj << +/Type /XObject +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/caution.pdf) +/PTEX.PageNumber 1 +/Matrix [1 0 0 1 0 0] +/BBox [0 0 31 31] +/Resources << +/ProcSet [ /PDF ] +>> +/Length 557 +/Filter [/FlateDecode] +>> +stream +xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù +ä +6\>RgÈbÏWÖ¹j[†› +WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream +endobj +5203 0 obj << +/D [5201 0 R /XYZ 85.039 781.388 null] >> endobj -5083 0 obj << -/D [5078 0 R /XYZ 85.039 535.45 null] +5200 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R >> +/XObject << /Im10 5194 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5084 0 obj << -/D [5078 0 R /XYZ 85.039 374.715 null] +5207 0 obj << +/Length 3943 +/Filter /FlateDecode +>> +stream +xÚ¥kÛÆñûýŠË}1X4_ËG£pƒ$u8n¬ -åI<aŠ”IÊŠþ}çµËåCJ‹âpârgvwvvÞKÿÞƒ?ÿ>U®f÷Iê»ašÞowÞý ?Þù‚±”µ…ó×ÍÝ«T|ï{næe÷›§aåF*¼ßì>:ßýíÍûÍ÷¿®Öa:~ê®ÖI’:ßýüæÃÊw>¼ýîÍÏŠœ÷ðúëÛw›ÕÚwÞ¾û‘ñç·÷ïAØ* ÍêÓ槻ï7†,³ !M_î>~òîw@ÿOwžféýÚžëøpD¹* +彺ûp÷w3â{µÄ±ö37 Ôm6žÅ¡aSPßÍ”²Ù¤ ËëU:~9V 0–°[ìOF<¢IÊß=?ÒSî‰w’òÖ…Ô‘Ül(g„ç¦ë_t²¢ÐÐ3ó#φ Tzd‚Áù©“-°˜³†Î&îõy‹rp:ò;Ë„·m‘ÓQê;îÏùqlñ4™Ê¢•ùž™éÐ|j¨Ïã¡_­h/2tÎR_ DÌBÚ3&îi'k—µM¨&d‰]°òˆ]¨¦À‘¡UjN <Ù6§ŠN ”·Øç­´-¡I?CóÎ~ÏÙÜÈnK+ÈRÈŒ¨Ë¢Þ2çsÓöÛS/Ë5ü$éÂ¥EŠq¢ŠA†{Äøn¬ežs(qýò [›T²Ç™²GÍisÚq&<çm?3y¥5¬Uå‡ì¥Ï‰ñtøÐû„V­µ JO–®Þ‹ZŸõžÊ- +ç³Ù?’üGk/Çê"›–¡»â)?U"ðÞk‚*aïX;wá€÷”÷Ã*ˆÈÔéÐ o±µ+`/UÇ/lRB&ÈôpþG4û$hľ'™ Œ5þ|/2‡¬|ÐTñ¢u/ë•uWîhSQ +L/ƒš’—ÄjZ é8u=¿€ÃQ‡ÉŒø³ÜU l9>Ø Ü5 R>qNIæªTÝÇ^äfɲ·”µ…c<éÔ9iÊÃÉdoÉžò5ûÒ7HÅmp«d{}’КlJç„ÐÀ Ýä&Œ1#säC/s}¥Ft‡Áçr8ˆ¾£Ô! eK ÕØ{®¹».þ’\ðL R¨@,з#ê䜢ØàxÇR‹ü?clÓP€ófP)Ëý3H ›SûÜp ~=ð4~€Ìçy!lšs~‘ÑÈ8°FB,¨ ­ ”ýÄs¾–´ëóÂRQêzA$@ÈHs q_ñp½ª$5‚VÎöYÅØ‚]gU0dlŒA让‡Š#7 ojÇ€rU9…”sˆ%{rm&”xͺrAœb¦>´^”Ý¢I£L‰ŸXCÐŽ¨2f%GCËꦗÖm{QU/ñ€$èË{†iqÅöGÛo‹Ùù„ 5H2¹Šµ‘•ŽTÔsƒDËÒ‚Á~A åÆÊ´ÁT*°ú&þ«´Í¤À I@ǃTÚDó £®”‚^_ áÄ:€¤Æ÷³‘²u!¦:ŠFåFφ1*á¹ìt,f± s‘Æ£õ8rt༠¡èn9ÞKYšñY5¹ D–ã“xÙÓþúӑݽʔ³1θã¡S?À½TlËt ÝãèY·SÛ…ãP~6–ú%Çpç¶ÄYl”œâ>nw'TǃæE/½CÞÐt ò?2‘pÊÃùÉÄÆfŠ”­¤, 2à"sOÏ ç,„ ¶”’ å$‡®?w® =ÄÆØ0¾_´Ô—[°&^BaB+°’ž%WÁö,µÀh\nÒva'¡ O-V’¢Œ92…@tSBJ_‹6Ìïy¸©\'¢4“§nZL çªÉÔ8Ìs:Á@¾úš“}…‡Jþ‹|Tõª#v=æ³ÂWnîïugFÞØøÐ ‚}ᇾÉE¡§…¹ÔþûPlñ™ócQbpê´ýŠ 0R¹TXÓ.*HoÄmRJ±g+ç{©ûc)·‚oT‡Ð‘T¸²Nb¾ÁgI(f™r$vdÓä\ +7WŠ6‰Eá Ñqº˜°©ƒŽ8 ¡ŸŠqvZ[žK¡Ùj((à^­ëìvT@&&¥ÌÓ^eKóK>EÓæ’°ybfÉ.mf](ÝAóÎoïÞþ“[àhÐÅc³C„ÇîÒõÅᛥ*Ì\b…w\xò”–{/búØê¼¢L¥£c—6°S‰4À³f‚Íò‰Ÿv##î}ÍŠ‹´ò¯•—±ŠäÖ°±3†ˆp5.æí'!Iò#\½ïŠJ” ¢×xb‰J)²ðnYå™6 RaЯAºB ÿ±Õ<1t’Tg'³sÁ›ùBú@&éG‘¿`xöµ\Ì]”ç†~¼”» ‰XaCBá÷@Ã7­©UÂ#yë!ˆ+$`Uø°‘ãFÕKÞQX +eâx\G‡½¬¶£Õp2”$™¬]'³°²§”6y˜]I'·;éºL2Íw: ¬¬\Óð3›,¸©áÎU ×8Èšý© Y5n>[eŠäqt“3£f’ƒAšo“Cz¼”Úø…ëb#ý£:1Ö1©® °ZpŽy׉¹¦Ú[$eÎØi‹/'¶û»ñ´CÕ«—0†KÁ^9³ÜŽÒs~CŒ«½dèåðÍ–¿N4,BÙ-¥I–”:¿ìÛ\ÖÚq»li!à Ød}-%µ‡¦©Qd [êÊØGURÖðž¡ù–¯INâ09Hbç—šææ߈ö‹Wpæf/\Wœ§ ZÄ0˜Øê3DVÞDÛ ã`JÞJÊÇŠ‚EœÄº!á~.²K^å9d×­èowy@õÇ‘/–fѲ?ʳŒ¸¯#ÅUþœÏï,ëÍÙ8ŸWÐÝ =‰Ìñ~b +,ö’Ï¡Å +C +¡î‰S ɬyÄca'óªÜ1„)D@ÕìK©€GpŠÚà}‹“Ð% bu ò ’{‡B2¢«cW‡¡1’•Y´x–qäÊý³y %à…~ö1æ¶;•uåIÀýµ¬Š½ôÐÁÇÖu¾ˆ[¶À¶ÓFÇÆÎoDIJEV¤@“É5XŒ•…ýž«ùü®Ý.#èÚ+ Ž_—m0öc#êÊz¿à4SÏ ü@Ü`wb—¹æ„År:ÿ'Cî%ƒïlOÆI³S¿t£K®“h3Š{¨Lª¦ë=p0£#ÝÄõÃüjVš‹ÆÕQûD¸ï¼·vã + {Uh¢Hr^š~wÅÕ_ûÑí`Ö¹êê4%t§ÇªäÅÿ‹Bc|ŽÂ›„hœ%c7§7Ì’)V¶˜¬9çØšoÓQTÜÏõhLL8fýŸùùšQ0ªé®“0u>pÞ[ð‚gcûy¤’<}!Âs}nãƒ)xeH[PFBy®‡GdiÊ®ît»úEÏIª©·‘SNÄéÂsPyH<ŸÍÝcñ èwâ‘UÛ­”ªÈé:ÕšB’Z5Ü  Ó$ñ'ؽ[þ|á[¼PMÿíRÞc—JvÈo5mbA0OßšbÚNßhÌÍĘËä øÔ·ŽTQÛ•’¿C «S¡V*·ú:’¦ÛiŠË¤hæMJûÁö .ðn¬J5iüày +™´ìÐQxjTÕ®ŒÓë«©5P9ævxê„ßK%ÔƒþøVz@>ËWÅúè{8—¡i³òÀý|þÁ°å!!¨y~{­^$€+˜ÉáBx‡:…†IHµŽ"XP +–Þ@ç0höª¼”õrâš“6à“½ï¤²¯®ÁT2?óPq‡@ã+¡O +E*]ªp.¨ +Š¡A:QÑk‰ Vù±ùŽ€×­øžFB8œ°”´aìŒð…]ãÇ‘G¥ÁÄáKïR߸D:ÚJ=#/{ç ™-¢=LŒtêØõPŒÖJPÈ…^/ÐѳgŒ''€°S7q\°%{[› †YXÔž†”¹Û‰æbN8ÎÏã/0߬­<²ãg¾íO|wqÑ!† |áíï…Q'åQ—nì—}­zn¢â›¾Ö¹êk5q¡ +Ì*k"väpýż2¤:Ð-j4ÎŒœI^™R­È¦gˆ££èö %Ã( ob>ô€÷†ï’±©kŒƒï”'~ÚZdxQ4d}§0ÜE#9ª¶£úKÞ›¸4 + aÉgøÎÍ.`CX8-¾}„fU‹²pábò…|*3ª“.h!äÛš¿5(^gl˜;zúŽM¯$_×<ØåtsÍfÜ|ZcgÑ4MbnÆ22õóŠ{ùV<\óK·4‡Ê Ì­9œ»8 M¹| Ø7ÌË0I¨ª5Êåä.ÏÆç³tìÊv¸6äú»Ï•& +üp8m‚HÆŽüà\‡ÇW“‹Iì1å«Éýd‰ez5®4ƒw×)#.!Z-* ä<Á$þ÷£¥‹’¹ gÃÖXJ@.)褬öðŽJ +Ùg:k]d[(ùJ+H¤“’”Œ¸€#wW¿Ü ]Ï¿ýݎƸþÕað›»Øÿ¥È­2R½ë´hŒ 1³b˜ï+‹šîRK°2 »uàÛ`'v–»ÐnáµUÐ,?(Ò•@HEsøgÙÿ¿>f6ŸöF¡›†Wò#kZø+ätJ¯ +S8ÏpNðSendstream +endobj +5206 0 obj << +/Type /Page +/Contents 5207 0 R +/Resources 5205 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5204 0 R >> endobj -5085 0 obj << -/D [5078 0 R /XYZ 85.039 361.772 null] +5208 0 obj << +/D [5206 0 R /XYZ 85.039 781.388 null] >> endobj -5086 0 obj << -/D [5078 0 R /XYZ 85.039 348.223 null] +1170 0 obj << +/D [5206 0 R /XYZ 85.039 761.463 null] >> endobj -5077 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F14 2895 0 R >> +5209 0 obj << +/D [5206 0 R /XYZ 85.039 740.47 null] +>> endobj +5205 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5089 0 obj << -/Length 3839 -/Filter /FlateDecode ->> -stream -xÚ¥koÛFò»…à/GÍåòÙâP¸i¯q›K}µƒÞ¡íZ¤-"©TãþüÍk—¤D)èÃ}ÌîÌÎÎ{¥üS‹$t=.âD¹:Iëí…·x‚™.”@¬d5‚ùöþâêQ°Pž›zéâþqØ'tƒP/îóßœ×o®oï¿ÿe¹ÒZ;*q—«8Nœ×o¯ï–ʹ»y}ý§çº¿Ü¼»_®”sóî†G˜÷··?ãÜ2ÑÎýòû/¾¿·dY„@BŠ4}¼øío‘ý?^x®N“Å3´=WÁôöˆrÃ@K¿º¸»ø—݊炯šcX©ÔMýð<›"呶lòa6pu!›”ò]­üEznèÄ'`RÀ0HkdBž¢Èy‡¢_jÏyÆÿš¥VNû'oÛ²î‹A:ÉzüÆÎ[àYóÔÔÜ{Fˆ†ú ¶š½@½‡¡Ö[þ•ŠÝTó½Ýà¾Ùº/a‹L×¾Æê<bƒ -GÒbÙà%®¯RB{¿)–+?õǦªðK¨/kh>ñÄ?ï𫜟j˜KœçªÈŸhv¾Í:ie-žµ\ãaqÞf¸ä…7z€Oâºæ‘¿]³Ø /ƒõ;FX -È îÑìy°.&ç^ß0È&C‚óª°ŒEÉáþJ‡É™øŽ¯Á÷<[ëª,jœê»¯p1(XtÀ2G°%nõ¦{ÕIJxñ{½ Ep ²ˆj$E„%ÆŸKÐa­†ÛïY†àÌ-à~"´VvÄæ¯v÷¼sàAW†¼ñyñl.erû:pý8”“üî…Þ¡˜©0tcP³,ŽòEÎp¢}ˆ_Fg W#p9=¹ƒ=÷¦ïw_]]uûÝ®i{w[®Û¦k{wÝl¯òâ1ÛW½›u»Ïßtë2ÿû‡‡¯‹zµ\‘³ï¾VIª¼ðôTY«)å" GäÎjHŤFÂ*´A87=›É¬êÌMbo·ƒ›9êزö2~$x0÷ï[ž»Eùh Ú§ƒëÎ*žÉ#]¢!n|ä³ÚéÈ‹Œ6öœî.*ú5êï¦È´„‘Û¨~±hÓÄãYkv«»ÊXk4LЃ(0ô¨¢¥ 4_41ÈgdÎ[·åk'øø—ƒÛ î–eùø 9š’²†Õç;Û¢ß4dCrPÎ3ÑÃ'æ‘5ØjX[ƒ 3¼Ÿ]U#Ëñžð çî30~Ô©Áòo`ÓøAö »d˜Š©Xg²f'Š·FDùyÁfíñxÆP帬üD÷Øv†«Ú‡û¾ûil¿Û†@zìf0FÀðˆÍJ`yvDÞS›õE.Ã5ß²ßÂæ\r«ãÿÏ2 ÄG™øLÀ;:PÁØè:²ž; í‚ÝÍœ”EUÙüi‚-ñ®³‡ª`E¹KIîP¡XÑÆ/á¨1´ €Hm…:–_˜Ú‘¢‘¤íDÍßåwÐÿùŽÁXLÉù}†áKTzAÎÌÿêHC:J‹ì†;žWÚ78†ï±é’ W¯HëKžxó½j_xáÕ73̺FÒRñɹÑ\Ú1Ñ»Ž»H %~L´G»µE?øU˜#ÀQrÌ0`äÇèι”4Ç;pm‚@YÇ rûæ^³\dÍ„9×õI•/>³ -ÕF ‘¬À# «*»ž[H©ŽÁ¸|ζ»jDN’™‚É‘©†žH Bó™cG b¥Y¸´{4uõÂëqYËm4ëÔð?\9Õp¹#tå,qHrgŽò·~æfŸé(´çF.?€ýIFÞÝ»<Ì^ãtœÜ½‡ -sÛ<°Î¼0hÇ&µ`ˆf°8-ÏS´•ìAÁqò'Ð`Ëßí› ¡ˆe>¬ø…OÔì‘kFv|®ŸÊ~IwëÐyà)¯\ žÎ¸ÛퟞxKyôl»ë -(qÎd ã]gÉÃ2ÚÙ2†Ü–O›àºáe1÷ †Á4fg,ÇgjñžCänW‘©É$^ƒ1’Iø>o22· CÒœ±˜r¬·ÏÈ8¼0xÞð-T)[Œœ‘,+ ‹ 5YlXö|±=Š)Æ'b–­ù;³l Ú©têÐpîS™I®˜mqχì•1¡ÊÙK€t@1,³ÄÑ«‡¬³QZPC@âÈŽ¥ÃÈㄪž®A»-qü$…#kÏõ’XŒv³¹ýÍu vŒ4Zhhƒi®É&ãìU^KC¾—¿+à_—m²õ~×AB÷©hq¨¬›¾Xû¢®nn¿»»”¥g$éOQþŸDÜ õË_Â|`‹Å]Æ›¢ŸÏ¡¥uçUi|€È)|­JÐ~"7Ó€6¨‹A¦³6Û’Ÿ±GŸä?^ä&a²T9Ëla@VŒ­6%ƒgD!:Ä,AÏaClSŽêÔ‚hŒ-/ª¢·Vf`¨5>&Ä5ÞÇÄI¢q\Ÿ˜eÉSüÖX˜3¬abÍÇ#d~àZŸE& ‡È8ïcdÑ©”ÅH¦¶’Qp}âØ:‰ÝèD^iÏ=:}pD'¯Oü,>sôC|³gã«AøÅ\f'íü)Äë}I)F@g8 @Är†±ëÁg -ÌÂDG³<|†ø±iÆ÷áÀ œS[-š­ÕY†E »¾þà3  bØË1¿´Gñy|s„ï€_þ„rŠvXUN‡l^ÄÌpífȲæÅk±ƒ¥¹¡N¸ø‰åƒCAWéóäßa&áß[“êè4q°”ìÌm…˜ÜñTÆSRÊrèƒIˆRIC? »YýÊúɬÂÌòSÙì;˜M<Šnêü ®(©Žs‹µø!”Ÿ fWfÕX4P²Ÿ7%åÇ\zÑ -n=˹1êd@H›e«àØhÀXNò?qL`“·ôšGlQÚX¥Y¥mŽ#œâo›±•åðYùÎcÛlOI»¼Ò0í­¯/pÜ5ö7ÒÅvÖ1¼dÚÓ¤­?~ÃÑÎë÷xˆ;)·ãFXç&®‡“«‚( -ÍUqøx(d¾@pEÒŸœÂ–˜rž+ªr[ÖY?6$vùºA )PûçÆyMn[x"2—ø¤äqš ߢmMÒ ½¼$#×àEj(8&ÎgÒ…HÙzÞÎÊ8¬£ªžË¹0ä…G»MCž6çnÝôÜ°åvÞïoLd_à鉿›âؾï»B{Õ<=1!˜}ÕTÔ9eµTêz¡þ‚Õ€ÎX-ú’Õ:‡ÐX­C|³Vk„odµ|ÇçÏ3’ɤŸ¹?q~¶ì6ó B¤ÂS†ævÎÌÄ¡§¼Sæ%Å2ÙÆ=Ç&/VáÃhb¦)wbˆîEb¿-÷9~Áêrgª»+”ü´ÏT‚Üœ3fAʘ•su7Vqpéñƒxò"3*8)û&¨@'MmRÖŽ dØXÛ%FÓØÈ­9ŸóGQBy_ú–¼F?#>ÈF”Øf;#ysGgq.$^õSP“d°’5=ú%†Ã1Ï8ÂkZ>¦#…À[ l±ÕPúôÌ$%Msõî±/²ï‹0F$W*Žb< Ü|,šv ˜—ÝzßYoŠCEÖBÈ,„ð+Ì‘}³Á›j‡½¥N ÿ¢”L7âhôizO9 ñØA¡!Ó*–KÁ -Y†'È»íR㯠Žo1‚LÈ=ͳlÅòã Àš·åAå“3‡¨GÕTìg¤¦ÍJBˆºj²|xüä\î> ü£»çúš<ÏñÏ9ÊQÈlë±è«_sÜû¼±¼ƒÊœ¸ gâôL•Øà«šñ“ÞI£tìÆarÞÅŒ€N»ôs¡¸˜#|s.fŒÏº˜”QógH³±g˜ˆmJ©1î¹?—‚ò´CßM)»Œ­,ÎPhª~8xÓªiÏWŠûŒ_N‚È>¬Ï¼Œ61i”À>B‘@sòJN!l œIXèq…Ä·7Ê·`M— Ï\à -“ ?À%öÚì$¶f½:¿ðÔ0“‡ý™GkŠº%¹(ð¹{ÿåO×ØI ãÓ!ÝY—yÁÓöDqæŸñ cöíÅØNüÍ î=”_p§ Ã…NÉ¿Ö6—¢—+˜1?Õ:2—¦ê¾nömg_ç ×4§&”`sjPŒÍÄ£yó±@’ŒÐRÈï Ø6E®Ž‚IHÊ”²Ãñ)¿Á ø—0‰¤%\ß0ï'Îð€?†©MZ9ª~ËRîÑì)Ì…á/çv“4øSá^ß·.»c¬ø‹ -úV¶BA6›/‰x œ}>¶?Šˆ¼ƒ2‰Sçã¾ØÜäGÊÔ¹”ˆ‹]à ŒÎ>²]âû^š +‘ÇÇt`â=0$8"zBði¤‚À„¿^Ja«%ä_·Ð%Fzü“¦¢æ¡=ýü§:šÌ¾YÎùiÈçÀ†óM\ßâ6¿Îÿp.MÍO_ÍlÁ¼q÷ÆÉÃaõNHƒNÕîxt:<—¾BÓŒˆ4ííÚRýgCŒhb0wäÊîI:8óÛS ÍVˆ¼…ÜÎ_ú-°ýý*ª“>Qf -}Ÿ~¶Ê´ÐoxSuôK@€ËÕÇÿÌtí5endstream +5212 0 obj << +/Length 3515 +/Filter /FlateDecode +>> +stream +xÚ­ZKsÜ6¾ëW(¾„ªÊÐÀçnå ¸’]¥²Ž7ÖÖ¨JÃ5‡œœÈú÷Û/ 9ï#å’IF£ÑÝøº1ê:€ê:üÀd×Iª|“¦×ÛÃUpý=¹RB±’CóÝýÕë¢øZ~d×÷#ŸÈ#s}¿ûà½ùëí»ûï¹Ùc<•ú7›$I½7?ݾ¿QÞû»7·?aW轃Ï_îÞÞßl”w÷ö/L4ÿx÷îgì»IwóñþÇ«ïﱆ A„ eúíêÃÇàzòÿxø&K¯Ÿá=ðt®@(? +|WWï¯þ>°â¾ðšGS¥Ø¨ÌÏttYM±òÃØ jÒЫü,Š\5E!© 4ù°L +Š¢À»­_@qâ}8¼Ì­’ÈÏB5Œÿâ² Gg½±¼6³¥À*Éü4'oLàµ%È\÷¸iE;—S«Øuø‡Èiy]–Sk茧š­óCñ‘uù¾ØöeS¯Q˜ø‘ú¶Ž44;¼.­D51Í}÷G¡—ó£+PQ,·A}Ç›N½"o;n,¥³ßCgï‘÷ >2ïyúÞÞèÄÛ ± êó§§b'\;„Ì[àÜ{xͪ‚ ¾åÇ öHðŸ°íAä=¶,ÉUæõ½ìÝÙ†5Ù$hR6 ÐàF¡çd¤“nŸ·À-TÚë|*`Õqö* ÚÄIæ½mú„ b}ä=Sþ“fÉ¢×Yúúoß3g4rüzáÞ=}ü.kÆnZ^Z9ý3.ÃTÌ`³`ª‚Þ{šö‰{›sË«š|4%é,™lèƒÚvÔÆ¢à®c[ùÈO»ë:K­ª°­˜I ¿Ûßïóßb/å6’—˜³è0ÕW¨IíÝV-Œ)à‘Ø)E¨aó?ž€E5’,§9YþSi5lBE6™MP[¿…V‡_µ¼i¶+äQó³ø\v=©¿P¨NÂ54òü5P! +ìr'•µÂw“&QÞŸ@q@¼Ž¤„¦žÈ5Úý×"Уà˜bU‘&Úâ·Óà>è+¸ú†ŸÈ_'Ì©hûœ\hÃQèzê8¬†Ï¸±lØp%õòDÓyDõŽÙãg%A¸wlîÀçMiÁ z~“-vm×ÿ™‡£1`?‚¥ )ªh‡ŒSÔ­) Ù¿°ü­¬Ø¶b©Vn§µàs_ +¯œÖ/0^×vb¿ÜzBö}yÈ{ê«^d¦¦è·“Y4íLª^˳‘nR5FfÐÁá.žÑ*î«ùa'i”F×qúYrgÉÆ¡Žºùacip¾ms8 `µÕ^S¨‡“ÑUk£[Íêh™b zì*ÔøKÑUm{:R`üív[tÝ|-&üT_^Œ¥Y¬frtš öu:YÍ d‡l‡ƒõÆ”–±ÈJiÍ«Ê_Ñ{”$~šdõîЬêÝÒÊÉ0@Mß²ö^ÿž8zÝAX´-¿zÝQìw>ƒ”Tš¸Ò} )Åë8 9]^„›8óá*–8S€ñ*þ#¤N_Êd~àÌ÷¢ÌDù©Ê.YÌ?1B : 'óï :aӌ㮼óÉÓód: ¼NÂsMUbyâ®1Ðæ<èñ†,f€‘ ß‘¸`{~æuc]}ÃÍFÅà/±žD*«•Ú C {‰ÅOµóQðû®xÌ9TRò‘xw=w”|Èš„OÍFšs~ Kú ^Nåð9óÒ$ààšX)¥p#´Ç…áí±: ö¦ ˜ _ +ÞJ#»îLÈÅ^^V€­ˆ«ÑAƒ §ærtiÖ£ƒÐ¬X0ÅŠ|wàÍv#ǧSÛ/Ò½œ5N. +giÒM \e‘¯µžˆ7è3Ȧ8ÍàÜ#:æH\hÙYMZ„Qb†Á›ÝtRÃmì°©ÜhMßqÔÞRŸ¸Cåv8‘èÄÆé +ÂtÁçÌMÈRígÊÅ_žMd¼Gúd›Ü0¦V¡÷TÔE›WÜñazðw¹™x¡s!;´qæe¼º‘†œ‚ûʶ``À¼3ŃHj'&Ãß 3E([#sZäÚ`àyvÏ­ç€W)g¡Ä¢ŽØ”ã)‰¸ ² âéÈdTé­´£kŽÆ™¦ñEGqhVÅÒ ää(ÍQŒIº!dZÇu剋nYQ~œ…å³4 §¾‡€ +§»—ÄŒÅme’’Í]Áo´I´ðqÖ§’Ð{h‡­íd•v`Ô¯AŒÌC‹Æ-s¡"G©ð?ä¾,Žä¾DØÔnòËx¹C-yœ%©IΣøÁ$ØXöˆ1ñÍ]çffð.`:Ût¥#?Ö1+§í7¡$ÜÿO¼¿Ü‰K{Ú?0|:µ{Rªv<ÁtÓ´öJeP¢Z5`Âj/ão‡fÝ€…æ\¤ÿoì6V~fŲ4 ¹¦*ˆc? +ÌD060qˆ²hhyËá ¡ ”í¬rÊTª;= 6¬V(? /ëq YW#““ yJ¿êýu³P`”ùq¬.‰cIæòÌÔùJE®@síU£þíoûq¨.ªÏ¡YÕŸ¥!ÈÚtb Rù'ØÜóDÀ@Åœ£ÀÿFÑ6œq q!‚Üì’¨–f!ë_C(ÍR=–ðu˜¥Cp 3DE»-;Ñ;öæüØJã ¢IˆÕ´â©-d`óÈmù–k+Ô6h,Á¾m*&zàÉH:JüxüNEðŒ;tZõ"®ªy<Ë'Õ%‹$zJTC$~ä²マJ€xÔö~Ûôvˆ ßñÌO†*Hb%ø# ìrD”á#`äV䵕ú\Q6”$f¨r:‚Ôˆx°Ëf)4#¥$ÜN;—ã!ð2MYÄðÿ%%Lo…œö,ÎHñ‘àÞb!XСW ?»ÙÇ^zóÊ–,ƒiQ~¶ÍA(Y·wF9§‡¡^dÁ‘¸~Îþ.(˜7RH +Î;ªSNEãF‚Dó(5 +š“í¹ÌæZèJ¼b?Í¢Ëñb¤YB3‹;6Õ—Ií¨?µr/3I»RýËé²ð*!(ë‰ôŸnø¢7m¾q‽`Q¸2-|A–f!Ò´peR?œ)4§ª$ ýªìØžwü=h:”r4¼°ûÆÆ &èvDaé:N¶ÓÖ±¯ô4nq]vÌ”¹ ŽkÓ±@xMKíSëZÂû+{tPîaaãŽðñV}÷Š1Ö& •wÛqï˜Wh©êRÑAÛüŸ‹Ûጮ¡ +„L`KÎÚ»{Ç-ùŽ.M$ %kº'Xºì(2íú›øØÛ¢ÿîîç÷܈‚sIj{í¤Ö‘†¬áráСYõUFFŠ/øÛ"4ñ ¶Zã’Œ÷6ÓöÖÞøäÂhÏM®lKmB£{?Iµo6νõ….<¤¾î¾l+x1æ/ö¥ç:$-/ïÍípØ89ží¥ócä¹ä†ÍÇ1à§ë‰¬myߤ¬Is0”‘<ŸuÃÏóSG´ü\¡s<²@euQ캩FLj’™‰z·l²™„ò~ÀÍ'§Éœt®žž†  Œ2[Wµé%r´£»æ`KðÕà’ùµ-xNJ2×?2±Ÿ¡Z‡fk±¢]-kbWlÎe(21¯8Ðx|¬ ør]Ùj¼M°œŸ60ýxAįܨñŠÛ8´kÄœ£Á©+©íóüÖØaú9k +Ô,zÎ/|è_¸„Rò[Á~+Q0ýô„2A0ñ»@®¤N³LÒ΃ln›ó`2¯’3Dª=ØD–^PÀÖ½“£fžu,µv}ùä çÚ)¾ F€uaG¤›™#wºÃÛí/cäÝì—:ôãžm›?²Gâ×4 Ï0PaúQËï–œYd4Ù!·¿ëÀF‹2pÈ$=á:£*‚‹³_DÙß*9†€ ÃÝǬTò‹¨­µÞ²}A&&Àr÷'™‰ÈNm±‚áLàë³èþØ–þ¯_‘804~jVx¤µ¯••…Ñi6—7‚Ì2JÍRà™~LÚendstream endobj -5088 0 obj << +5211 0 obj << /Type /Page -/Contents 5089 0 R -/Resources 5087 0 R +/Contents 5212 0 R +/Resources 5210 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5062 0 R -/Annots [ 5092 0 R ] +/Parent 5204 0 R >> endobj -5092 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [154.728 677.397 512.306 690.299] -/Subtype/Link/A<> +5213 0 obj << +/D [5211 0 R /XYZ 85.039 781.388 null] >> endobj -5090 0 obj << -/D [5088 0 R /XYZ 85.039 781.388 null] +1174 0 obj << +/D [5211 0 R /XYZ 85.039 761.463 null] >> endobj -1298 0 obj << -/D [5088 0 R /XYZ 85.039 761.463 null] +5214 0 obj << +/D [5211 0 R /XYZ 85.039 740.47 null] >> endobj -5091 0 obj << -/D [5088 0 R /XYZ 85.039 721.768 null] +1178 0 obj << +/D [5211 0 R /XYZ 85.039 235.312 null] >> endobj -5087 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F14 2895 0 R /F56 2890 0 R >> +5215 0 obj << +/D [5211 0 R /XYZ 85.039 202.891 null] +>> endobj +5210 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5095 0 obj << -/Length 3827 +5218 0 obj << +/Length 3940 /Filter /FlateDecode >> stream -xÚ¥Zmoã6þž_‘ ¨ÔZ½¿´¸Û½¾¤h·¹nŠ½Ã¶Kqt±-W’7É¿¿yf†”lÉIC‹"‡äœ—g†òÏ=úóϳØõÂü<Í|7̲óåæÌ;_QË÷g¾R,”d1¢ùææìÍwItî{nîåç7wÃ8±ÅáùMùÉy÷ÃÛë›o½\„aèø™{¹HÓÌy÷ÓÛ—¾óáêÝÛŸÐ9×ôúëÕû›Ë…ï\½ÿ^èAóÛõõ/h»ÌBçæò›Ͼ½±lÙ ‰…<ýyöéï¼$þ<óÜ0ÏΩì¹>5oΈ)7ŽB}_Ÿ}8û—JÚ¢sé5·q˜¹qN÷ÀG{àûúÁy{nìE¼ Ÿv´‚¶Þ^™ÓSñïÐú¢Ì)ÛšÞ>£ºÂÂ[©n©’ßw—‹ ušePöMû,$Í<±CÅæ’¨nQ¢í²Üy»îš/‰ œ®Ù w¥ä ÍœÛB^e涫›m'5;æ¨QFúfL'úŽ°ÓlÑ–:¡ëáTh‹>v0ç·ÕŸ{"­Ûª$2?s -yØ¥-x”¾@E/m¼&?•ñuMX)ÕÅ]_µBÙßË0¡Ÿ;vks§·›Häõ¶ë‹õZûn• ìþ}%å¹Ý'Ú=F\7E‰ h3Ìl²úǺ“ .Ú²EòÌD˶ÞéúHš÷bw–Ê˳¼Ð •Ö/Ñmã eY2bÉ Õ#ê²ÁÛãˆašÀ—†Gì^ƒX—Rsñ¨×.³­ÒʼÇÌúlÅv æsÏ?ZÜBH¤˜¢{–ÚGÌ[˜% ‡’Ét½ÔÞYâ1us¨ÌDOµ‘¥¾²3³ Ð8ÅVÞ™->H$0d£çµã§i¤—H¯¨í–º¯UÏéç½À±ò…òºYA¬ƒ,=%®_‚×ûj‰óz¨±¶•4°Ä¢ð_ªÛw: íƒù”÷ÒjÖŒdòȪq–uŽßXm¶¹Ð¥ä1Ÿ)žxd"™Ë}+uÕHmž•¼Þ€•<®ã±7sV­TÐövRâù¾¦CóhÇú/„[l9‚êúγ‹-‘M’ÉTÆr8]5N‚å“žj'ϱl¶¥áº3Uèæ^µº}ɦ˜¶©XË r¸ª°Êÿ“ŽVÀË}Ý©h™ö«c·f|H殳ÞÈÐ,FDâÆÙ27I;’l‹ŸNf #×_žPH¦óx?jŒ³ø`¾+Xƒ(qv{³!ä6DQ¥'],­›JFÖÍ#ßɆꬰ³YÛ¯u†®êÉzsQ«`Õ¡÷}³!!_’€é…öV™nµz,¾#Ù{)–ÂwÜ“GGO/_9ºè…£S¢×Žî¥ ÍÑÏ7{t£ùptA»Ã>QMh+U©Fù‚j±±æduò§º‰ÝòN[Wo¥¨§ÚÈ›˜WªTó %bb&kÙj+IM»Š ªZñ8âüÀ΃š£ÜáP˜G’x`‡w—! ­8Â$%³Ù@šNðè‘ÝÒ—yhN³Q¸qY0DÓ½ù.NF”…ÄiNCƒ„TA¬¥v8~4|â¹I’h§¥˜ü _²ãËBÝÄ-[8uÚ[­ö¢ÒL:¤ŒF©_w_Á† æ(6C«x±TÀF³j õ3Õ“X,†.:[VÚ/ŠôñVAK†h‚ò r®ŒDS3l~FdBj -!8HÆë-ôâYÊ-¦Ün‰fj5ý(¿½þ(C݉O¤ªBËu=¸CT¯ -…÷:Šb”;(d¬qü4cpÔ\¨qÁ²âTÅÔhZ&Œ¡Pt”ú{m;ð~ÜÒÈSO”Ãuz5àÇÆsꔸSñ‡ë²3c¯³Ží…¶ºl©ÛʪÁ¬qH‘S“9Ö«¹´~`d;ÕÒyfåW7_k5…Ój·±î¯î›VãʪgsÅÜ°äP2M3ðlË‚„R]Ъ}p{ÑuƒÌÜÈûX§†ÒnÈÒ¡G™Æt”TþèJÃÕÝ”@¡ @‡Ž•9T‰Gëñºzµ©/Ól¥s!ÆqÅ1oìé¥Ö'[ .ˆSbD"£Lr 0Æþ4¨ˆÅõ÷ ©ö«{©{lë^Ьô[6­5:Ëþh,Úo;鬒ÐÖ8KP² ¢†uµ’xçYÞùìž»¾âMë8uK¼›l‰uß¿{šf?æõ®(¡ogÌqDǬ5³Tx§ç¦áÔdYgYµÚÔa ܈ÔÒ`¡3’óÉŒU@RCd·aMám©±[ÑÀÐ÷u¶¼I&Žë0½±½1—7 1"^ S'*ªZK©Vµ‡ÃÙR«E•T¶Ì{"¢T%òDïG ^›O$šF™;JÕJ¥ìŒjEƒýöþêß3G<¶f -eö·Ãžÿí QrÿE 0œ†)d)Ý4Ï,L ¦ü\“·”@…xL.Þ­É -CÍ—E\H5ŒšxÎw¡{" Ku[,ÂSk S×óò—3Ðœ4¡»Q” Ù Îå\$»½”š‹÷7š¨f3dQ:BÛ8;Î7r—£4-È6MÐä"6É]ôº×©Q¦€Eú‰Kå0J­§P¶&µ+À0¤•SÓs>Ï¡ûAª;àLc¤È ÜÀ}’º¶Zk®·â(?f»Xˆê…|ŠG0ø ³&‹•˜…k(ˆ•0•#lFQÅaþ£Ú8ùÌC›ÈÅŠ8ì âhöërf­ÖOGQ ©Ãžßü!‹±±ˆMÛu;AŒK3¡h=ºàíNŠ6JÁ ç>l:Öl,‚þ¹‚êsÝ(Üì)?×Kå -ÒŽAº¾ÙIÉB#ãmPYV»ÁÛcüydøEQ&'ˆ ˆž†o>wTvé9êÁ\:ßaKàq"BD²ï+´—Ë!t³ÇŽ—B¯žê®7™kT0†,É<=g t«ÍðõÝ!_Ó‘„KÌÉýØä¡sñ‘7):¥› ë¦a/Ì#±÷Ô®“·òvˆ…QC*¡ŽrãzNXg¯…œñM®"Û´æ®#ƒHÏb;^üíÐ3öËœëuUt ìbø†t¶S¡Ø‰>‰;`©Jt³˜1‚a Îbs™`žj~øËÿH#0~ÿEº¼#®–æ2ƒôœÃ¢ ö(wæ¤þÃr³×Û«b;Ü6 Ê1J¹y:$vô÷VŪùœho‡Ø}| ÚÕ·ëãK6›x/ÚºÑÌúI¶oÄ=qîâdž=ðSò¯$kGD§“µ†è•dí‹j²v2ß\²v<Ÿ=Š ¥0§²#ÕkškVúT>K {—RËÐÕ;”43qb. 'Ȉõ5J0²kk?s&wß1“y:„a|O´ãé ›‡ìâ8DÏ™Û_T›HTLÉ—È.¤í¯ #è φ­%²c¦k<ŒBYvךÚe»s1º2‚ìo%õ+tÛ•éc¯&w6ò¬Ê“·~š¸9aþDtZð Ñ+‚ÿâ„*ø“ùæ<‡¦T¬ÆþHô8 åH“ ±Óz\a˜¨g¾ŒåN‘D—1ZØrS¿ì> å¨ýÞ Œ§×óñŒpOø¤Y×òE*[Îd1õ°ÊÀ8Ã)\æOo~þÁT2»q‚sÈ&ab¢Ç‘©ó>-@™ZLTó²€kI„ÿ!U®ë^šø?²£[¢ݬAúy;±úŽ.-P1Nañ Tˆ9t-GB†u s[Cý­3餻¹/å9ôôP?gS0,x¢ý4&ÀÇc¨T÷2³$¾ˆª¬jQfTZ±0@ZОG¡ø¹™ýð³ÕÝ©Å`6µEÿ2Úÿõ«M‘|fá‰ün,ßð¹¾<8æ×|;aøPܯSendstream +xÚÍ\YoÜF~ׯ˜5`,Èô’Ýl²™ ŽsXFm$o²Hò@ÍPmÎa’#Y€üÖÑÍc†3²³´!ð}UUó«£É*þ£…¯’Il¡Œ™Ì—'þäz~8 숙2ëŒùæâä_ßëhø"ñ“ÉÅU»Ž¡V“‹ÅÞóÏÎ.¾ûu:SJyÓYïùÏΧw~úüÙØzgpûëéÏÓYàþüÇ1¯ÎÎ~Á¾©QÞÅô¯‹—'ß]4l5…yz{òÇ_þdü¿<ñ…JÌä®}@÷ò˜:Tö¾89?ùw³÷…ž5´Z¡Ú߃@ìö…öCÚƒû©4Þz 2ãm@˜t*ch¥û´®¡%C¹W8®Îáv½âÎzmo2¾Xe4ra›q(^&^éY®q•[ü/ã®fòŸ~YÅ­W0¡\/{ë'´ãéÙ»$>©·Âu7Ó´5”¥àŽòZÙy½.ï§&ôà G~âýRß8Žµ»œÉðÂnÎÜ줻;%?rœ•– ¾YÀ O|à Ëßó uX†p¿”ä¦-ÌQ´Ë^!$-`F!¡uY§×7®¯x‰«2³-Õ&“âì‚Dèè}iÇV$ô"Ѻƒ•( ¬/ "ZkðßLkßû6»J·ÈD50ÅÞY™¯ìåsk™®øX£È»ZO•ï•Ü{›Nì¾ÞVÜð +†ÿL*¿ï­v¾½¬î«:[V$Ž’@˜$îŒ9¨Qä ß>ÿÿ¢f“vȈ¤¤=OË•»D0HíšqDnqESÖ8ð ¼F#|PÀê>–á»â‰KÂOUóÝœ–¯håŠÇ"¶¶!¯§Mç%öæE=Ëír<µ&ý]]ÛQW„²½tå -d ÊtÉ3³²Pq)¤ ¿Ò›§+¾X±ò3*$A>Ķw»aÙ;¤Räó¼.ªÓ:³ÃÖv›•TíÞH VYr´I+V©ð….Ó:'…³D›g Cß»pêe—­H@G âËr›1‘+Þ"éÕÍ4émJæëÀ¾Ì×´Ÿý)“N"ïÂÍ×°¤9 :îhÒ)æv=jaÙH{¸ávª#x 9=o\ÂIÆÆÏé€íÞêš'ÑVÀ/ÛP"„TÀîænÈîsæV†—¼& 4(&ÑèÈ«IÜfgâ¨Ç7o(4yÅ5Ö€w4ŠYA®àuÃD/#îr|j߬Öu>·kW¼­÷lˆëº1ã–ÙJèî2…ÏrQéè¼ÒZDJ‚<(ÈÓßyHÏ,È@2´#în²2ZG +ßwË ­H!}eäÕÀ`zCÛؘБ¿ íž…@Ýze/È$"QÆ®‘Õs‹üÈ—¿¬r»;^ÀÃím‰Q÷mF[ÔÃÅ“.Ô³r[þZ’xO|/ê>&ˆ +üH˜À|¼«CÂ@wÙ¤s"qŒzÌ>/„yAð€Ï C¡âh4Ÿ×ÒuÇ$PA"Bcz|,ê¬5³i/dÍ–ü…¬™ñîš²1„}ÌÎäT‘zÀù)_€ #8¿–ÚÐ9Æ{ïŸ:c;¦íéfÂã”k›OJÿ/¸-_d)O‹ÊRk¨f6ÙvÍÑ<Ýðˆ¯¹oîØÛT–öªÓÁ¹”ÐÚÖ}ìLZˆùzueJ‰o8Áz*‘ß»2¯3¾´Éë‘—nëõu¶ÊJ—ïí3Ž,vLÚwK¦6³ëP´­¶¨NX°)lqš"J|°æ%+ïò*Û«?Hm@º©ú\cÒç^®÷ù½CO†Oéý‡úˆ¶¹¬Fv¿UÜr—²à*à¼Rlš5Ù¸TEƒù±¨,¤‚”У¯Xy$ÛN";áXŒD“ìÏ%4¯Aõ~¨©"_HÙ 5a)‡G†ÌÕ‚¾àݺL11óî+Î6vs»_†aÔIÁØ1¥;. ü7Úµg ¬5„Z¬ejtÛ(3\v²ª ×aôL„²&'Øó܆jB2;…ÌCó(¹­ÈÙ´öM„%&WÖ©Ù’/l‡Ã>g¬“ Ý½ù€ì½6õŸÎ@ÖÎã îÏõj]f‹8PB(ë'ì^jnØ)®ÖÉ-PÑ‚¨¶$»ÓK›·ÿ¹sÃÂщ˜W«x|¯bÌy#©u[º {Õ[ÛÂ¥R˜ÚRmj€˜ÎWQ§šÇ±ºæßfˆç¡Âƒœ{àÞ8_n¯‡j „lnU¿N߸ã2öY3([2@šq¥ŠÕþ¶lËÑ[ïŸ'Ÿ¶±˜á ±ï”Ua­ pèTn³¦ÜoîT-Ll}Eˆ¾¬à‹5ÂÁß`½^!¿ QG3¼î-¹> &äK[…QÖi£_0ºozq$º]»Æ€1L¡ã¦-,æþ +?ÿ+—”fíËÌUªøBïh¾­Ba‚Àù•âà©ZÚM*À@9ŽßùÀÛÏ¢óuk!Ø°aÞÀG#b“t¿£B0@¥uª CÃ˃[ðÛõüfmÀ„BK=ª C¤0ª¾>X£ýÝ*]ö NE±/[nøpãêobéaåów3Ψf¦j#õ6€ HSÂÀßÙÊŠïÈ„–oAT¹r—¿¬¨”¨›9‘*å”ò©; ëðZú÷ê.r$»úgÍ·wSRš7|Gaü’% —HbKt߶ÛYó©¯" Hï‚B{ í¢S* Ɔ´¤­Y-xbŠÂwèƒM¡qØñ#ÐÜìæ&ÙÅ›£Ê†Bz>IÕ\µ«µ±èN=ÜÞS IG‰÷ªÂYà[#é:«êMJ‘Ž +8Fº]à ¾)¦.¬[p®e~c«þ:µI8°§qˆfµÁGÅcŒ?ÊZ¹zˆZ}“Ú8%0‘Ð~¼ +Ÿd²¤HÓt¤M &¾áئâ'­êÂØ”9ëÄI²‡»”-25 +l1ƒ3ÌÌìz;1”4¸ W6ÇzL¡¿òNë¾ R8.WwmÚ³{SBêFf<6hûW´=Žï”óêØÕ‘òØ-«,^öå„8VÙÚÁë-ñº?4 ùO45…•%ÛøÁÄëHÓ_œ8 ÍN]xÃsQy[æMk€è®y~ÚØèm`sʬ°¥þ\߯:ÕÓpƒÅ6/ðY‚¸B:*ü¥rùêXõ>øP™ U²û“Þô}Ðß“hêáC%Œ:¡¥¤ŠÌ Õÿ'þÞ‹-ûw'öþüVƒendstream endobj -5094 0 obj << +5217 0 obj << /Type /Page -/Contents 5095 0 R -/Resources 5093 0 R +/Contents 5218 0 R +/Resources 5216 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5062 0 R ->> endobj -5096 0 obj << -/D [5094 0 R /XYZ 85.039 781.388 null] +/Parent 5204 0 R >> endobj -1302 0 obj << -/D [5094 0 R /XYZ 85.039 522.122 null] +5219 0 obj << +/D [5217 0 R /XYZ 85.039 781.388 null] >> endobj -5097 0 obj << -/D [5094 0 R /XYZ 85.039 493.324 null] +1182 0 obj << +/D [5217 0 R /XYZ 85.039 719.568 null] >> endobj -1306 0 obj << -/D [5094 0 R /XYZ 85.039 355.61 null] +5220 0 obj << +/D [5217 0 R /XYZ 85.039 684.823 null] >> endobj -5098 0 obj << -/D [5094 0 R /XYZ 85.039 326.206 null] +5221 0 obj << +/D [5217 0 R /XYZ 85.039 564.071 null] >> endobj -5093 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R >> +5216 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5101 0 obj << -/Length 2373 +5224 0 obj << +/Length 3353 /Filter /FlateDecode >> stream -xÚ¥Y_“›FßO¡s¥*¨Êb™AKy£­ø7GJƒ”6Y¯y/áŸg¢¥Õ8ˆœ]ƒ{Ú‰_™–Ö@Ê¿!)«­$xê䶫Œ_6ÄÊÄï¾òf³Jj¡/ªúèÔM?³“ÆDœ -×%:ü^»ŒÉÎ=²V[dÓžó˜øü‚Ò´ï¬@VÅæAdjBŒRß„îפ×YÃ<;$ >äØxŸ©C§i«šü©™©äe»bg#Ë›gX? ”Ú»õÞð¤ÐvÌâ"'EEêlNjV¨Ö~ÀÎj9c|p(0Ô‡úÎ[”: ]*¨¦*Pƒ©qªN¶p -Χ‡¶%•— ¿”)SéÒï.å÷p%²am„uÿÆèíå„O“c×I›‰pÊþw@ø {–’]S/v#þM˜®d 0ý]^;°ËÀÓó3°wÞÞXèuÊ;|HØ[¼ƒ>U¡ïù²NZö>Ñɉ¯#È|ohÈíÏêH‡0ü -Ak<®¥l³ºqÓlÁÌG -O74‘ðRÐN>¤2é·:PÊlÇ " âÍ[Üšv|¹˜n¬ôQÏ·µ‰Îþ ‚Ì.×{^‘}Õ…¶yUò&ZDr˜Ê¸TÎO§½. aýL0“ä(!ðbÅÁß»Ù3ËkEH^6yð€Â zo¤×=€h²’òF{žö"µ§(«ë"!Ô'¡Ñœ+¹Käžã-#»EÜm èü %rlÎ.a)ÐJ~‹¸ñþòι1:Ù:P@õ†¹™=?¾ QðÑŠcm$@=(ËbØ0ᤢ@ó]b½Ÿ¯ó̆><'íç ɉ㆒¸_/…áÓQj2óäÀM©©†RSxÐUÛn~¸½Í J’Æm ~Ì3(EËÌ-³ööT)”Õ}¥NP¢c9Ue%B¸¾OªPýS|Sðkœì5)6ë Ë•2ýû j²n*^QÀá"Í›ù¶!³£A  aÂm¨ÈÌ/ rm›dI®ŽñrÛ°ýæþóì‘EÏzõ|2$¤o8&æ¾ã^hïBðçùWûÒù5ªv•ɯRL P±ЋÃxz9³í Å{³Ê9­B0ƒà‘¡ë¡„Š§<§.‚Wr#ìç%3߉ˆ“Þu­AÍ&"f|ì홉¬“¦€‰Ü5x‡;»à3…nôBIêœÒã¶Î)°XšÂç1 ¥dð.GôÃ4ÜP/Âb€â씬ÝÚ J)å}ªJqœäÍù…µYUu»¦ž0õR¥à.õuc|ø¯Ñ2 ’DÓÅ¥?âD …ï×—_Ó´JÁ«óÀß„ìš³&؇+Ý·„µÆM;®`Øab&o|Ë;Fudð¤ÅåÞÖÌlèP™´‰†^?⮶¶—Wò©GyÙ3ÛÕ$˦µtÚv¼À"=¯³„ibŸ@0†/–Ž†>–€ÛŸú¥¨m&Å=­ÊÃDÀñh;‚Œ£º“~Ä{Æ0¾¨ÀyÙ¦C!¯aBí¦ÙyEyT$4á]ªÊDnp½‹8°\®êP'ôq¤NüsßÕì ‰ü³z‘.b™u‡‡fÃe»fj3©¾Œ×!w«lð%Û­¦ø}¨å–e?ŽçíI½œé‹5W9[qÖUCwÁoʃfùzÞã¹\r83šú'%ÛšÙ¹—s;0xµ}gÛ ¸Hƒâ0ÆïÜÑô†ÞiöÍQ²ÍS)¥=gˆ´KÝG6¨{ÞØ µu@Á>¨‰ÐkñÀ¡9ˆ‚n›På<ÈE]-¡ë&@±úÃNW™m[Væ§ßL¸_•n×,¸á̺ÇEU FÍTÐlER.¿üW¶mLRi/1¾*þ•Ö?‰JkéØNYiF`XG·q†‡}8€úçuu­ Äjp €dŒ§Âv„cì¾MRwcÉdðÜ ŠoøÏzÿ_\84fÊT<œ$&ÜÀït!p‰Õ©¾FE®‰Ô¹Âÿ@  endstream +xÚ¥koÛFò»…/8£³$—ÏW úpÑËåjè!͇µDÛl)R%©8îýù›×.—¥8÷1;3;;¯UxÀ¿ð2Oü@—Yú*Ï/7»‹àòf¾»âZ@®˜¯×Ÿ›¤—aàAq¹¾ñ$~œ¨Ëõö÷úûWo×ßü´ºVJya³,÷^ÿøêvz·7¯_ýˆS±÷º?ݼY¯®CïæÍw 0?¿}û/œ[åÊ[¯Þ¯¸øfmÙ²…yúãâÝûàr üÿpøªÈ/Ÿ ø!Lï.€)?‰•ôë‹Û‹[T<_òª%ˆë°ð‹(9/¦4ôãTY1E0úE’¸bJ? bH&ña›)(Iﶆªy1¤™wØó÷y¥B¯=tÜkW*ðžî¼í*XÝ ôI½×ín§›mJdqî‡Yq~# m"LÎ:L}•Ò^ÝÀC‰< ‹Iìiü$Þ¾ƒñªYE91#¿Á@{Ç@ºçÁ_ƒ0n²,·<ÔÃÎaU ÿÆë +§xjhù+4z¡zª µ_¢yz,O1²)!°FÌBô©ª¡SsçŽHËúSÙ2ãwˆç™Û·z·¸;X¨Qâ ÈëÕ¥ Ñ|¨€ÍÀi¬&w$>hA@€ý3`è¤Rî ùkðò²Éĉ¯²DÖmt]3” ~÷KmC¸zü¿6hpϲe9 <‰Úœ%šlTx?÷¤âŽ'XˆÀLŒ„Ï®¤ùŠöÆ¥L‚Œ…V¸ÛUƒÁIDQ~ |~ ûu¥èhóª"ÆŠÇ…GE¬0Lìá¢li§Ãg+’Žºš`µ +ÆÂ}Jc(w"‡8¼¯ƒ¡`µ½ä‘J7ÂCWþqÀwŒ ´Šsz`Xmt yGŒÚ¢7èv¸ìÐËøKuAÉ C*V Äz‰Lg·v¦öÈÑh±ìòÃwýs?Жv8É1! ¨)÷¨Î6­ ¶ˆóÊØ#>hÌì˜-C¾Ú†‘UCÏó„î©‘-`,h…«G=”†½#‹„Í¡%†Ð¢ˆ€c$ÀŽ:ÖÌûgž FèNF™î8ˆ")Ø¡BÄQ³r„JÚ‘ÆÎé–ÌÈ‹£Ó©HFH `ùÖh›5̼$€èûöŒã•Aßz¬(Ö§‘NR¤%{`&\‡Qn}³>Êü#®_?–¸©8e•ÇoÃ˱‰ŒV°ƒtc$Pâ)cðÇOFè 8ôè°9Ê{VîرÈØ$Û]õ§ñÅ8m•º@¥F6F@—$l>U†ª1:MLU‹À`’Ç2[t™WÑ‹è1|Ãa}ßb4x²*ÊÊÚaH‚4¦ºÇµ®R¢-Ñþlàž•’¨ ’oƒï‹®5^#‹->üÌè«ÑÃBtBÌU\ |0j\‹p€:B潪Ak»ýÈâ4+U‹Þ1Ê#+ßH[ÕEúPx乪‡k'­™ãÞ Ò?‰±4'ñX ™Cn—zƒ°Üsµƒ” OºzœÄ¸ËTö0îX/¸ä€ 2Ÿ8†nT •z7â@(P[@FžïêJœ±˜yÕL|h + +ÐÚkTOýÐiÜê£ p|U, R9ç°4”,hïY“s_È[b•úI¨$¹úe!G¹60®˜À}ôÂK¬2X)ð'd˜™ ßéM·J0(ГR@ 0̼DÃŽH€¯l»asz·~„ÒÀh‰¼ìÑôÆᎌ¤Þ’ˆ°o” Wq +ƒä5vFq%‰ Q}]óf½˜sð #˜d%Ê{%QQ¸É$ÛéTˆC…ôTñ¡ à¸«†hº8d&øYÊÐpœ½!¶úƒ1g™+ŒGÁ˜ÜSr)›dîÝiƒ”» OiDÜ <Äj “ŽrÀÙÓµE2óa•ÀYÔ‡Eã: °Ø©ë¡Â„÷y•Ç”–…|³š(wM— ÿ¢nP$n¶I£XÙ4 gMawÇ"02ŽÜ|i¨l`äè…“›†éwåƒî¶¼bïå¦6’—ÇÞÔ ÜŒï[J»9¢ØÐ0ŒÒa߶ü}Ô“D @mÆS¡"LWÖ™PäͦüâÄE1.À‚óøìEÑ¡‹b:†p”E„ûƒô ›Ó ƒÔÏÁœ#h`Ž(N\AF¾ +£ Å«ÞÜ aóW÷ü½fé¸ÒÞk² %7‰Ùìq ƒî ºÍèYO‰4-ü8OÏ‹t„9#Rú¤HÏE:£¸,R‡âÕþ¤õžBnËYÛ7 +׉Ã6] Ad1Ðϳó"aΈL€>)²3G‘Í(.‹Ì¡xõ âš÷Í.¿Q1%Aa„D(F ÉiÓà ™³}¥Æ²ƒ‹€\T]‡ÀîÅ?%Ì0ñ£ü|íÇ9#Lú¤0Ï…9£¸,L‡âÕÆæTÿhÿè˜%c´÷Q¸VÀ‘BnÇqýàúV³B$.®`,œ˜Ó±'‰$Ý-¹û{#×N —Få¹áÙƒq`NŒúÔÁœ#hfNqñ`\ŠWž<˜¾úÓ¤¡(T¾°»ý„`ݸyBÔk '™¦xFØ(ƒ$J~Û‹ì)äNöÀÿÄZôíÚxP•JHkY]—\‘®‰Ôµù’mï³]7­$-å¨rqR袕‰^TŠŠ½ÿrßîâJêy(ÎÊ,ÚKzBŽ¿XÝà!W­‚pR*;™c·DæNŠM›‘³¯«r‹á5Èä(‚"D`ó tÊ©ˆ ª¥&V?ó´•ÅnRKb» øÙaˆËme7ˆæE­`~ÿG‰)ÎÍTpqíX¦jv¬·¢k£\{ÇÏŠghg>y[Þk)%›„>ç8œâ +G”Enq–à7•äFD7çLŒ´Û{‡éaÝÞéú½ áŨ/Qóâv*3ž(=O`ã=œ©²ˆ`¶²„£ÓG™Š!VÆ%9çPnM¶Ï N5ØÜ*bRbËÌqÝ ­Š.<»„]X›]jÔ¤°y¬¿÷$ð"%ÌðYu‘™×WÔ´ ™!`U:FÆ#.3œ[ )2Ò³)rÏ}vˆÃÖœ!WÓ5å:4K—+^C%FisvÉžÔ”*Y÷Bïo ‚yE^<Ë)TìZ*›dÇÎyéÍZ?cÜø+7ñüÕ(“÷¤‹HĹÁ0×á1z9˜?.Ž“ŸÌ Vø–—€V&ùÝ×>ìÌÞ/¢hæ\{ÔÝRiì·ñ]EîQ÷¶¼©TnÊOØÔüAÛãVÿXÖ5jL’Ï„ªàqFÇ9OîQÙ› +¶òãÞª³2‰ŒWͦF¦¶†Îó>ÐkhÛìƧP•K ª«$BõLúrŶxÀ7è?Å&œ÷¯ÍKFÉ,ôÏî>b?NS.HnÌûÙa[ò°æUF©e”Ê}Ín–奖Y~ ,‡Ñ„ Ù¿ +7l)©¤î©ô#¨Œltò¬P“ÛÈB–:yÜ S>Ÿ0ó®f|”>Ý~ÀÞk¥-Ù¬Ž{ã+t4èåªí~·Åä0›©(ŽLïHÀI룵ҽdœDÎo1`ñrY34¹¢«Û‡¥B0â*æ?|8G—Ÿ@ ÈçÃnÿ¹kÓø @JUÀ`ƒüh ˜þâ%ÁdíÉ-eL1qŠÜ ]Ï”„O^ʯú…‡?Aøò3¦ÏïûÅH•Õ›8aó—§ÅvgÏÜnÂGÒ£$ð¤Î¸wÌD2 µñ¯ÚÛ§*_&~‘åì[óðèÔuþÁŸRÄéÌŠóF¥ðÂ*9Ê}ö 3åCd“—œ¯¾Zxë‰? RàSv(È))Wñ½ˆèú­Ý[âÀ¼@a€°WèS¿™R-±àÏäÿúÚX{S~®NÂ’(ò£ÐðB?+Â9¿‰Êý$WÇ ÿél›_endstream endobj -5100 0 obj << +5223 0 obj << /Type /Page -/Contents 5101 0 R -/Resources 5099 0 R +/Contents 5224 0 R +/Resources 5222 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5108 0 R -/Annots [ 5103 0 R ] ->> endobj -5103 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 652.239 323.852 664.232] -/Subtype/Link/A<> ->> endobj -5102 0 obj << -/D [5100 0 R /XYZ 85.039 781.388 null] ->> endobj -1310 0 obj << -/D [5100 0 R /XYZ 85.039 610.001 null] ->> endobj -5104 0 obj << -/D [5100 0 R /XYZ 85.039 565.453 null] ->> endobj -1314 0 obj << -/D [5100 0 R /XYZ 85.039 533.344 null] ->> endobj -5105 0 obj << -/D [5100 0 R /XYZ 85.039 506.729 null] ->> endobj -1318 0 obj << -/D [5100 0 R /XYZ 85.039 464.366 null] +/Parent 5204 0 R >> endobj -5106 0 obj << -/D [5100 0 R /XYZ 85.039 441.048 null] +5225 0 obj << +/D [5223 0 R /XYZ 85.039 781.388 null] >> endobj -1322 0 obj << -/D [5100 0 R /XYZ 85.039 358.24 null] +1186 0 obj << +/D [5223 0 R /XYZ 85.039 761.463 null] >> endobj -5107 0 obj << -/D [5100 0 R /XYZ 85.039 323.096 null] +5226 0 obj << +/D [5223 0 R /XYZ 85.039 741.134 null] >> endobj -5099 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F56 2890 0 R /F66 3242 0 R >> +5222 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F38 2997 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5111 0 obj << -/Length 3503 -/Filter /FlateDecode ->> -stream -xÚ…ZYsÛF~÷¯Ðê%P•…à\©Ú‡Ø±³JÖ±+–+›}‰H0hYÿ~»ûëÁA‘J¹Êœ£§§»§o(¼è_x‘'~Yúqž_¬¶¯‚‹5íüü*T“Ä~b Ol^»Ýë4ò“„Ñ;®³°ðc2Ì›ÛWß¿‚‹(ðÓ4¾¸½¿ÃÈÃè"-Œobsq[þÇ#ø«ë$ ¼·W¡÷åÓç«ë8ͼO4é®®C¯¦Án¨wk¬>ì÷4 -½öŠþë¬Ö;ݵ[¿³˜Å~põßÛ_^½»ÉT*Ó"ðMx’‘àâ:Šý8‹_ä2M3’„™sâ;]pIb £Âq2Ÿ¦ðnvC× -åa5Ôíî‘zü4‘aàçÁßiˆŽ(]úE’,ˆŒrâ6Ÿz¡¾È{–qe~‡CWõ,ÖÔ³;ž—˜¼áqµ«þ B3ôç8Ñ;^$v‚bÃä‚X,‚bAlùY½¹ÝTL‚!½!Úí¶ÝaþeG,Ôß0ùÔñdwåÞ€•Ï´ðÔó™¡ÚbéÏ y¦)QøQ1])´óF·Vˆßg\8èëøs6Žq2oYåÂÏã|y÷‘ÜÌË7câ‰Û|oHV^5ñî®®£Ì«X.«v+¯ - ¯,;YgQ>aq/ÐíþÐ0ŠŽõ%N½›ÛwlµkŒÿ é¾1—¤·Eæ'¤”×!ù”D*/"¯uw ÿÙ0˜´ŒÌ¿e<‰¼~Sï±Ì§,Z…6UÝaXV÷–ñ4æûN<‰(B½SòßS?w[QúÂ{s˜ð-o­|Ò‹eÝ+Š¡ÆiÉ -“¸30}°{b‘åÞöŠGwÖ+Û`…/!ˆ¶!L”z¿µ,yËâmô$_Ë¿—ÿ;ŒòÂÊ#ßÐvý%Ï èsèÝ2Èð‹ûý$Ä´û¦èpâqY$åŒ úídcm»iËÑÀçãS!FÈN ½gïò®±+¾ÿ穪œ<î·Ë×4)ïqS ÈGèAŸ\òv÷Ý€õG–"?J!2 }H1ñ•æ¦jú­¢º ºiUxâë9ráæAw>þêcKÜ*oš¬å9ãÃÆI—EG*C¿?M= `â(!«"Èö®q§¶¯y=áyÒãÝtj-ËW˜¶»JÑàˆ]\h°Ä´uJNãÇMåÈsÐP.ÛM@e%V¹^#3+¼éŸàúǦgq£4Cÿ‰D#+& - âm?`Ö9Wªx[Þ²ªœŒ %•èë^qì·UÕ4•sò¼,’¬£ÒpŧÙù[1ANx¥eÇœÝ).ë¢ó‡ñ7y†çgûŒY§êm=T%v,Öà8ÉÅÎj‰P¹·u‰‘œ~%†}á¤ç³‚X)œF»‰ób®ˆ¹ç~Qê`< C4Õù*§Gm0µ”)Š^x»©TßXàt§2Ïf)(#$á¾ Ÿ±AòÉØr8q©ëÎî7Nü3ýؤ~F/ö?f0ç›5DƒŸæÉ¢Yi³æã×Jf_ùÙɺϢ^$e‚9ߊ¡¼ÃŠp\M?I‰¿º`Ã%9K÷–e« %ÆÒú<ÕÅF¯Y,ÜWMr˜ýÕÖOJnô»ÚâG›°]„·èyYÐñVµƒÎÐUÏõ¡Ÿ5 ÷\†Ç“ù­5Çx^|t}L61ƒ6vv³ô‚ç7\|kJ}ÿ>Mç=¤ ó)"¢˜˜›Yþ®âÛ©:ýD¼! av•pVÖòÏJÆ .4Êü Š¡¶ -ò¤ b”—§q£娈‰ò¹SÇW­é\¸‰0ݼsm‰÷X8Ãd‘úy>ã1Bït×Z{°ø’ˆr-ÔBcϨúê0{ϳ¶%P@ùQΪ](³R/1: §g4Û“î NåHH9sñƒ—¤ÞJŒ)#%&ÏÔ·Äú˜MmÛ¡’Ü#AsH¡±6K¨hhž”qZbq¡ÅÒãXÞ¹û9ž ûHðº ûºþz6 -NN9@$0°;h©p-Ö"’¯àª)Úº®€œ^MÝ‚ž£•®@’:£Â`Y[ë}ÝÔ´l«:íÔ© ˜8!Ý€-KTÀ­.ÔJZz݉àAÙçxPúyä³ »‰éÍÊ[S¯Ãxý¬Òál¬®•··x½’¬[?¹Á@™£„/‹~>ĤpÆ›ï˜ËÜ[•è nJí4­>L‰Xx皣4Ž;YŒ8@J6 -l¯±ÛÔcµLáôWÚþéÝw=öZô5„ÙÇMÕlÙ¦;ãi@Þ/¾ˆâÈÏŠôoºòúz~¢G~„“9ýõ'öTŸæ‘éˆò•hAÉñw3…yùþcL“†ëÈSŸ\ÔÜÕjZÍŽ®iÆrAºÑdÌ]åÒ`ö}÷ø½ìì˜)]bi?k -Tžfõ¨«¸Ÿ{¿}|‰Îó8%æ#c‰)j®]ßXUzýÞ€®ñ³ÊUUkr0h¥cOÿ²GG¨.±1Ïæ)x¬ñ¤ö+I‰ÆòƒÎL5ƒ*·BK¶ -FÄ¿+¡K¢U{•§£*š\+Úã´˜„ -œv KÑ«¿É(acâpôè°+^AÇ[Ø’ãhêOz*ò¹Bªî-|/ôõ¶nl\H†Ù Ú»ºª—@‚“ô -ãŠä¡º\¤Ýýß°‡¯K[mñUm7©i:¦Sc¨’¯¤‘÷‘}@Vía¬²*v$™AÝDˆ§xBi*È'JüèûóN)âqánphÇÑ÷—¦Mé®gû’ó%î“$èc&é¼K0Ðûþƒò©0ÄÛÔô¬º²#[†{È•"Õ<ÊÏËÞ‚,'íÄj«Øåýh^}Û‹kèt3GÑîtu z^â‘þ³u¬Ç^&¹ë·ccÕð±¦X$c´§U%>è±Ó*„ŠjQðŠèiS/{B -ýµ¶ð7Z¿³çª¯üja^¬x&ó_óÃ0óÃhüPé×ü7è˜1[+Õ:'ºnާƟ$ˆ;NGÏÄú¿üƒØÂF˜¨¸x™“ æ|íVP ÉÒ3a´5 /,³(Z¿¹(f_tª£ZWßñÚ’pÇ 2ŠÐORÍ·ûíOÊv"1O?ÌŒƒ«Æ¦È~IÀ¨˜ò_}È€cíA¼§¶=†Nš E?‹Í¶E± y ˆß8ô¾!~OŸ{x{ìKÀPi{{¿-@`Úƒ~7‘Ùø\qêk4£ø'Ž_£öŠzÌ -Íò¬óä²áöSCâ:£`u¦iN¥"®ºZcð5 aeŽ|Ÿ YÆ q§Ÿ¹Ÿ_1¼8¦Æ8W‡”;%ÿš5É—]À^Ùd.h©M”%~:} .ûòœæ¤!•´…ƒœ»²é“9”DϽžÐîÚ‰÷°+žÎª=,t%9•ÊDºÌ㧪1Ë“›ôø#®1‹*]Û`±Ö‡èúif.ï#ò;cm1õÙh_ÚïC»ÜÔErƧs "þ•¹‹9ß&r§þì$öÓÈ!ƒÇ4Ç&qî'y|þÆÿËaendstream +5229 0 obj << +/Length 3530 +/Filter /FlateDecode +>> +stream +xÚ¥ksÛ6ò»….37¡n"à›ítn'×sÇIt±:¹›¶h‰²ÙJ¤BRv}¿þö”(åÃM&&°X‹Å¾!=QðOO’ÐU~:‰íúI2Yn/ÔäF~¼Ð‚1”Yçíââòa4ÑÊMU:Y¬»uB7ýÉbõ‹sýÏ«ùâýçéÌ÷}G'îtljs}{u7ÕÎÝÍõÕ-κŸo>.¦3íÜ|ü‘ñççùüŽMßYL[ütñ~aɲ )Òôõâ—ßÔdôÿt¡\?M&ÏÐV®†áíå†/ýÍÅÝÅ¿ìR<LxÖ B?qÃÄ?æGx*7Tñà?H{µ‡3%‘³Í¦^ì¼pç:‰ó„r„ÄN[ñ÷iFNVÃÉ_ð‚H°ˆvjTx.¹³¬¶[d]VŠ_" B@ƒ­b­[¸jv¿ÖØ­¶²ýcÑp+ÿ3Ûî6B•º›Î€zjÒNþ}‚J9S†wŒ›iäkJŒ0g˜ùqHó«z›mˆìðl° à´ ùU逛iŠ#ÞàC^€øbNÚæÄ µ0J©G>.bϲF6ì7²×šÈávû˜ IÈ›IËŠÖÞf%r9œ]VgÛ¼ÆNww›V¬ò“¬m ƒ‚´"ZÖjÛE<^­Ïœðú4÷×Dö­Ì¢ØsE÷'®y)¦»ï–,šïè¡›ÆÉÈvU¢é ‚ùCàþ\îÍõà”Ë È9LZf›Kf[\ã>»¼§/©ûÒ_¾YšÉÅNöúëN¾Í ÃÅ¡›xú¬Eëá6{0¸~õ´9 +ÐøˆŽ F,BÑ +Rç¦,«§¬-ª4ŠTøÆÎGÃi¸7©nùΧ)ÊeÎMÏõN„n˜Fç ïpNš¡ Aáo­ÔW5*±²1n§!šÖ`] sÀéÀw/ÌòA“/]ó‘ÀÔ@k›ÈêFž|µX 4©SÎà]]áWlÜ7 Þäï”É‚c,pú'£¡Û½fEð +L®O¦Ÿ{–¯A(3€b%ØXWëúÆ­yÌHÂ|50ê hdt|Å2Oeg¤àn Xæ{½;(艫¸Y›Ý7yÆ¢÷†¬¨òtvd„Ù6¯dÙŠÑ;ÙÇU· ìïYftÖ7ûzÈË„Ù3fÛ1Šñb5j‰Î&x‰ðǬ,ŒLld„:–ÍxJ/ÖìP¤s¶ì‘,"Âäoò„8Ùˆd{èÄ~(ûánöy~=&Ö`ì½@°~U¡B4Zù‡‘Eí¦A"ØŸQ]òm…Œ÷•û‡€ +ÿ,ihzxÚaò¹ÒÔ¹Î@|Qi›Š@µµ©xÀk L‹'û€áâ —ý<kpûF<êÕˆ²+åÆž!ÿnŽ31èüt{w7B0P)ÃÀ<ªxº]a}:îe# +BÕgœ#™pY4]‹ÏÞ5åÃ-ŒïÏV!ï¯ÊLÖ öåýÞõÆÑiö6"9}*V†ÂûB?f(ógn çŸðìxtµâ î.7{Oq0âÌ‚4uµòÎ:³9³@îG»òíB|ñ:>ÜO«ÈMàfÏmhpŽv\±ûïko°ãJë®g2‚$`_†•Ä㛊.‹Ü=ÂûžnH!h]ˆóeP?ÔÅ>Ú)ü~!!‘Åe, /Óä’s¥KO)Å;ºM™²ï®°F»x u}LÃ1§3B?¯ ¢ÁM^O)zUžóš¢œm‰<7I;;¢¿?%%aB;œ•’猔Ò7¥ä̆”ì8.%½¦À„ÀXü æ8=ˆ½ca€±04 ãMm£§Øþrì~þq1jè!†Æ_¡‘]­P"gnéRD2‚•ÿ †ìòñj/î]¢ºB û¯SXó…ØCŽ>,)ÇúA0>÷y/سúÞ Rv³ÝÕd–DôÉ ÃÉ8¼xÁùÆæôD!ô7o9£©Ä8Kºæž’v» ø²³ÒÞᜑvAú¦´ŸÙ°“öƒÇ9ÞÛñÈ&zqj¶ôz …T(t&¤BЬÍ$´HODLéAøŒ›ýãÙGçl¡è¾ èkßõ‚äù }ƒˆ©óžú{Fý„ß7(Ù(Óˆ”*'ois"wÄj"ú1·6ÀU€0çò¢× “o)€`Ïzèc28\“£9ØýÝG&…-eÙû­q p#”°RèEšÅ¤OᘜótyxŠ4е6qЖSOhåZ +@maʶìÑ MØúž‰j:ý¶U2F7x@2HÚ9åbü8†\%=«t=œÓJg¾¥tç6´Jw¸ã¨ÒõwaÙEå ¥Ô ÎX6ly-ðdÑ~ É)E’õ9 åjßë; ¼¦ë[öý²–M +S§+œáýßCô:¿Z¶”¼ÎP¹*:_Ýé᜹NAúæužÙ°»Îƒǯ³·#z­ª«£“V1†ÝýP Ƭb{P+µe]úŠYA¾ÇˆA%X‡£ŠŠÌFT-P¨XMÔ‡Gže£ Åf±›†c½Àwxc †˜ˆàZš¬Íî%#ˉ­häTâ,Mfò;Þ=ÛXlM‰W´) 7’ƒbU`]zÛ‹qDz©ÁÒÜ}Ãâ÷7yµº7KIÄM$sI™$`^ ‰˜W”°›ûT +wüÐÔJXðž‘—9®Õ2Œ˜…)[Éß=Ÿw•µ2_ò}l¶6ùÿn:ƒ€‚«±s/áàø¼L!S²{¡™æWüEiØÓ@Ñ<Êö˜pÒÄVfcOBåd‘â—êcSȪ~énÂÜéí;œz5óû³¥²É€ƒ¾Ø v(J؇¹€…'’¹:çú( +w°ùؼȅcÊ‹,Òà køÙÃ0 ‘HŒ4ñ»‡ÉNÆ´ +Çú6Š!¬µMÛÖ²ÕÅæÁ[ŽöŽ9Ž@¸"S:Ö¼ðŸ]ÔEX=®‚@²›’ø¶RWب R1©w‰›K]VcY›N\ÏVD¨ž·¢Ê”îÚp“kr.„ájßf˜8/Š:IÇÎ +X@œ§ðJô›V÷œ·/²,éÙ.©o¼‘:IŽ0Ö-» T$\|R¸pÔL6<†ŠêÅñïâxpJ@6ÔÃ'_Xƒ®s ?M£}¬¡ãùhI‹Õ¼¤- ±E¦PIزòÞVX„˜’QˆeW‰^çY#o~GJLöƒì~Örk¼šICXVøóòßsîS]­-¬XRub”å¦È»ŠP.ðK¨æ±z¹9,öZA¦:¹#yøB ”rIU³zLmî0x‹µÿè”gôƒpÀÊï1¦‘§Pyü +èáï…[ˬäÆá‹WoŠ:gáÝÈ mÊëCˆ–_üPeü«J‹Ø=½ǵ<™#ÁjGN¾olõ"µ± +¨Ë]ðÃ.†sk†ð U`©:ú s©ÊnÀáœÄï¡7`³}èx'ÜG-Èì22¹dæå¼]F.%Ô«§Â>Ù<ÐÃoè­lÈzTs œJΩtXpXIzÏT¶0ãŃ5†W…¿TÀ:|ï ‘Vù:£XJÖí©q½-D3È 5æ¡[0ÃkZz‚Óònòésm¡ävÆš,]rQ²ŒÌ¡3°Æú—d×Fjø0XË´]÷; è­¹ø°åV¾«g!T¿mþ>ú¸qh Ï‚Ÿû&3îϬlž?Y@„¾|ïrKÍ7”ó±zÃ9%x½‚ÈÎœÛcï®X¯ÓÚÊNÝîÈkcHâÎÓ\NÛŽ"´)î #²Rè&ÿ¯ð—L{k”rË6MÅø5½-ž*¼ pé1ügþþ_?Åë +ྛø' +c¡ç¹ž6´¥K~Mc~²wDðÿ£W¾$endstream endobj -5110 0 obj << +5228 0 obj << /Type /Page -/Contents 5111 0 R -/Resources 5109 0 R +/Contents 5229 0 R +/Resources 5227 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5108 0 R -/Annots [ 5115 0 R 5117 0 R ] +/Parent 5204 0 R +/Annots [ 5232 0 R 5233 0 R ] >> endobj -5115 0 obj << +5232 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [279.296 604.06 310.834 616.962] -/Subtype/Link/A<> +/Rect [111.316 441.788 154.005 453.477] +/Subtype/Link/A<> >> endobj -5117 0 obj << +5233 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [359.407 229.072 410.369 241.974] -/Subtype/Link/A<> ->> endobj -5112 0 obj << -/D [5110 0 R /XYZ 85.039 781.388 null] +/Rect [153.74 400.534 262.854 413.436] +/Subtype/Link/A<> >> endobj -1326 0 obj << -/D [5110 0 R /XYZ 85.039 761.463 null] +5230 0 obj << +/D [5228 0 R /XYZ 85.039 781.388 null] >> endobj -3021 0 obj << -/D [5110 0 R /XYZ 85.039 667.044 null] +1190 0 obj << +/D [5228 0 R /XYZ 85.039 675.821 null] >> endobj -1330 0 obj << -/D [5110 0 R /XYZ 85.039 667.044 null] +5231 0 obj << +/D [5228 0 R /XYZ 85.039 634.793 null] >> endobj -5113 0 obj << -/D [5110 0 R /XYZ 85.039 642.326 null] +1194 0 obj << +/D [5228 0 R /XYZ 85.039 139.391 null] >> endobj -1334 0 obj << -/D [5110 0 R /XYZ 85.039 642.326 null] +5234 0 obj << +/D [5228 0 R /XYZ 85.039 107.576 null] >> endobj -5114 0 obj << -/D [5110 0 R /XYZ 85.039 621.333 null] +5227 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1338 0 obj << -/D [5110 0 R /XYZ 85.039 346.512 null] +5237 0 obj << +/Length 3530 +/Filter /FlateDecode +>> +stream +xÚ¥koÜ6ò»…QˆˆRÔ³÷ÉMrmŠ\Î׸—n>È+9ÖuWÚHÚ8¾ûó7/RÔ®ÖîÄ"9Cr83œWŸ+ø§Ïó$T¦8Ïršâüvuõw„­r\¯>^ÿröúÚ‘å6 +¤éóÙÍGu^ý¿œ©Ðùù´U¨¼=¢Â$6Òßœ½?û‡[Šañ9ÏZbAbò0ÉÍ1t²ÀƒD…‰Š‰ã= Æ“5=,NƒË«Ü;üfAÓc¹Ùð`Õ70áË*ÊyV?à¹×¹·6Eå †[lºU¢ƒõ*‰‚§ÀJ‰ +6qƒ®qGÔðbmc­[»ÆíuAÇP‡Â7ؤº]²ÀIê8n–hrÑ@s]'¡v–z~g`34M»ÞàÅ©èÆ}b@‘¼(ò{ #¨-<ø©…FË.hW¤²sm‡£Òbtk@¾ÐÜ8ýàƒ + m|ľÉeuŒVñÞ-Çc–•À¹zíû‘(^ìê"öV2 ¯,àõ«#•†YdY½ßmÈP'd®Ð­" K†3ÎÂ4µúÎÿPˆ¹iƨê.Ú ÍØ,¯W„yáÖ»“㢦ã+:¢˜|†Mׂ1å6#öohà^°™ÖpÐ<òm]•çh ku”äî‚EIÁFm³a3tÆ--^Ñ_b‚s_.Å1Ñ–\¸:-I¾ÊM{»5½›ŠÝ¹ñä1¹ëØ$-±ËÞ’Y—C”쉚zÒâÊ·Ó¢—Öa£¥³^4jVŒÃ€²~82&EÆYüd¬ëáPœk_q”§lÜBMéìp? ª›ƒÊ=µ¡Å9ÚqnF@WŽf;öh5(>c‰D‘½ºÇªî‚¾Ë+ä·¥@#óÈÆ"]Ë –òe×ÿõÅïWØ×ÁUßÝY+1 àpÐ"âdâ¸nRýÈ`H!¢‡¡ö™ ‘Kíú?¹‡K÷Ý–'ˆ)„¡×|O@DH¨¯3Ã*&S9%ÿ$ƒÒ§å?áN.0µ€À ª<#Ä«µÚ%Ö±H­üSÜ.ö(¬ BºÈªÇ Cm7 +ã±AŽ!ˆqW®Ç–$ƒý.ì}€‚.f­ %œð·¸×"g°±'b…^÷µ]ˆ%¬ñSÉ"×½T쎳j%Κ+&í#wJiÐ6·!¬I$â\3q†t·¿Ö/oê%«S¸O.UÃÚDð¯\†ºUD§GÐØS¸µiþí‚÷ö•êkÒNqLqÙ´OW-°&¡RÈ:^AòüvÓ••$Béq^¥Òyr±á1ˆ„·ØÂÔ +vÄÔKe’RBã»+òð ñ¬}¶Â bº!ß1Ú–KM–mc·Ù2”Úõì¤,ÐT]RXM€u¹íâÒõóÚÁ ™r>—Šlª9Ê¥{‰ú9WOÚÀu3Ò˜ò4^]OÙjI÷GVÁb8m!°Tp•©Î•‰µÙ–ã1h¶ Û‘ÐÐŒ‰™:œõÛ»7¿óè1Atl´S[Kfo—ÿ }ãºC¸À¢+/@YÓ9£\='uãJ„8j…ˆíyE àL@ h¤hŒwˆ4%1™Íá•;1¶áĸãïŒáç*Öé#Øg›æ83Š‹‚”:ÙZ)®ÒØÓ8VìØ׺ûò¼ÝÔÇU'¶õX¤ìœ]5Šy‹ò ˜eÎãJÓü\ÊMwümk±:pð„Ï7øç?åô=rÃ@uXà \­Û@Zç|&‡i{Fpï°Î|ïÒ Ë@¸$Ê­1=¤b€Þ×kªWQÇÖ»RT6<,F«Ýgý`üŽô£ì¡÷(y®9uÐ8 ã"{ú 4Ž‹úF'¡¸zƒôÊDì'è(àð¿ xn°ÿ78ÊƆ1éÈÇa^ü'¾t€IŽY2\!SѬ*Ã|kI‡H¥7EÕEnl])WÅ\MT\JÝ„t 5’ðìĹñãÚ*|0{ŸÖiWRk—ôü°˜aFjC([á9A|ÿÁȤa[WøýRÎƉ ³—Xg@éäJ1æ "‰õŽd‹¶\jÉ „RóÒÆA¨‹ä tñPÏ23yULoñö©>,›µ`­ûºtu{“y.&| {á•Úa ð{Ê…ã¢÷–Ö’?'\‚¦’µ=”Þ¾]lɽ‚àùœÁW`"ãKT"QmŽ+A86{êeB¹¡Èº¤Íd쾜ê³8RÐñ0“ŽÉtû¼õù=KänòËm xÍžØMØU=ð> ¤ê¢k‘Ý ,)×¾F¤šßÐ`õZ‰ ¹+“ÂFÅ£“ •§’JÜkªëO5á{®<Õ.ºHAz{äƒ €d»ŽãØ,J‘!?Γ+"Ía)÷z•õR¥}潜5zF‘:¾C!ùcC ö·;—il=Õ-ÙØ# +FŽV¼ºÀ"öŽ„ÄŸÙ!¹g|@m5¢I~Âåx—,¾áì ¢¸,)ùCÐ*â÷– æRùÅúŠç(ÒQìî¦âVÏ©€"^¼8,@W‘ffþ¶„8–Uˆ´F˜ÜIUáErŠÁå,€)GÓj†¶Ä%A™‹^•IdݦíYEÑ-å¸À™ã´È—ÈÝ{eŠŒUÙ‹¹^ £žH-ÒÁ§ñÃÂu¦U.µzÉ^º”à 'QU׫‘­¼%ÐWöíÂÇV•¦ÍnØ13ZyšÖ¬RZOuoJ I§ÐÛ¢Éæ806Ia2ðpNZ‚²›¸èÈèÑYq¢æ|Ⱦ²¤½œvèùÕéyì€Ç6±•·¤içqÙPX£I¹,ȯõÞ×±ß×[/pG·ˆª•Æ ÏØ 6çpò~pÎ@ö¹›üžiïóÀèDtð^ž/pCO¼QðNÌaqÎ~øƒ`Ÿ­™#’×›™y¤ËE¿9ˆ´ØµÈc>`Þàˆõ¿ó%PE +,wyk…túvöT[ÀŸßÀÕ}32ÐÒè…=D¡ {Fj£7¾‚ ÇÅAçÑÉ·žH•×b”£o¢ĥzØ>ü­A¥þaXøziô9èÁVɟ÷E“<×!ó»°'–+#‘Z +fÃRàG$Âs¡Ì‚Öo8àrqMšsÀ5i> endobj -5116 0 obj << -/D [5110 0 R /XYZ 85.039 327.64 null] +5238 0 obj << +/D [5236 0 R /XYZ 85.039 781.388 null] >> endobj -1342 0 obj << -/D [5110 0 R /XYZ 85.039 132.94 null] +1198 0 obj << +/D [5236 0 R /XYZ 85.039 374.861 null] >> endobj -5118 0 obj << -/D [5110 0 R /XYZ 85.039 103.536 null] +5239 0 obj << +/D [5236 0 R /XYZ 85.039 339.451 null] >> endobj -5109 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R >> +5235 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F20 2961 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5121 0 obj << -/Length 3127 +5243 0 obj << +/Length 2661 /Filter /FlateDecode >> stream -xÚ¥ZëoÛFÿî¿BÅ}8 -ˆ(î.—R i›6Eó¸Ø=à(%ѯ¤(“Tßýó7¯åâ}¶hµÜÎÎÌÎã·C«EÿªEbýÀ¤‹8Q¾I’Ŷº7°òý…Š•¬F4¯®.Ö¯£p¡? ÒÅÕõÀÇú¡5‹«Ý'ï›^~¸úîãreŒñTê/Wqœxßüüa©¼KžýðñÍ»«7ï¾Ç§&•÷ó\~ÿq™޼–_¾}õ’ŸŒ,?_ýxñÝU/i/H•¢˜·Ÿ>‹¨ôãEà›4YÜÁ8ð,W §oC#ÏåÅåÅ_{V¼.ø­9«X“ø61çfQvd¥´o”^Ä6ðm’]¶M¾\)/ë@í–«0´^v AäUYqXêÔëà7—¹ NÜóLxɯ\× O!¯}Îã-ò¬CâýŽÿË…ÛéZÒúZ^ßÃBш ǬÇn©cÞD;a¦,¶YWÔ‡ VX)4RJJýØ ÿ’UÇ2”Æžc#ŠÐžÙq¹Ò&öÖ$JçDYq·‚äí¶ŽˆŒƒ J߯¾^&¡W7X–ïÕå·°µò™ø -î¶mÎ4e~“ÑV÷LulêÜ3«ˆjF›úºL¶ÒQè5ùí©hxRG,&"ú‚´N­3S#š³f~ TXº àùÑØ<Ê»#{åÍ!«ò–_Ag@N Û=“Þȱä‡&¿>-Q_j¤´%»Î-ÑÁ¬6 ¼·ÙoäHLО±#š„•§59[štozƒÐ€Lß :g$¦³È†³F½i!±¦^òH–¤Þk̨7Rîrx«œ;O‹”^¿¶Ñ8@aP#Y•ÁžVÅÞötla»¯ÁI\ó›“ÐN•éDÞ”ØM¼ŒO1™²u”·"óTÞñÂfÁ4  9 -iŸ‹æZ¡><jH˜%>9û‡6`×C>w¡yVBôÒsMb‚â ¤ÕéÄ;Ü0žß°Å×CLðk J`²>5üä’#6œSdµèx¶¼žÏ&d‚$6YD‰öc+yš¡ø8ʨŽz5"§ŒjÆfÈ•ÛwÝñùz]ÖÛ¬Ü×m÷<2j½«·§*?t”²|±L -I;Œ&–ÙwUùPpe¬¯µZDQêë -Žf5"š)8áŽþ#…+‚¢“BÑyªhh3 «ÊO1†‡j™*`D›AáÕ>¦H Þó…ÑohPLSjÂ_tùjc*I8sW oáóHk‡ß’?¢‡‰ý(VOë1Ð<^5#>„èD=.![ƒãm0„ÚÛg˜qÀåY¼òžŸ(ÇÉãsrù"+y…‘ã«ÝGž¤Dj±>s¾’B‚ã&ÏZ)«DY¸D -Å.ŒôCé8± í†å`FÛš"o5“¤ŽÈ´ì2h~¬ëøÀ WJ8 ˆÅ Æçötduë¦c ¢Äzo!x!ÇVž’ ´]V–"¬.ì³;ð ãY†½–lÝS¯rüòÃœVÙ¦pŽò ©i›JywH\hf—_g˜¡J¬ð¡ôƇrê½8%GCF>Õ±mI<¥nHÞ åìøÈH€OghyG29N_2X:´zÆ“"kzpÕú3ê¿ÇØR’ékԫጠ†0Z¹d‹D©·%—Á¨NÓ³Z•ðNëx ÷¿æᙜ´Þòï¡îx@åÀeÇSÙ Ã 0Tìd] IFŠ8ç€z¦,F¤eWPÿÅìQšSÇ)ØÄÆ51R×C6B€ù3€³q¼Èô®”dzñhµü - î)nqû¢ù.j0fÆÇTPü˜!ú:1p)já?H-åEŒ0ÂToð`4¤‡—oöÒ¾ä:­—Ç>: †/Ra¸OÊ÷±%ÿ±üLv†¤qòÅh#~•'Nmo4=(ƒcñ6âå‡7R8Gª¹C«1ìQ6N2ú0E CƒpqSBñŒÀ[¹=!á=“ÜžòSÞJ„„Fº-¥4¸²ÂÍ]áâ_rü«ìØr“XwC‚L0ƹoù„«™pýÛø -UܵXØ¥°Ê¹zZù*p$'¾„£ƒýîy*Äð‹!'©ëSǃs˜Žn -eË2áå³Ü ôUÖóL(?Ôòþ†¢<ç‡c3¾(º{‡ì(j×ânüôþ’Í–¦¾USy,)9\Sá{å³iž):ÉO•O‡íHFâš±ˆÆË'e*ñÄïŠ|爇³§R$^æxw • °ÞŸÏäûüBÇ­?HdwMvh+¸b=_ïë*_ÿv¨±²ƒþÄ?xæ4øõn_l÷¤NÐmSuûªo\`«ÈF w¡ª’'Yn…ð.xu²lïy¥Í;~CD–§íÒº’É…Û9T ©Ó•HþÐ]™ˆ&~¸’IV„­‹›¥Å¬f1ÙŸ{xF:'’K¿I­ŸFñÄ’WtÄ”–%+g’Œ‹ª¿HeCE0rQ©‹ñ—+¼]1HŸ MóÕYSAnµFá>þÏ jc¡ÎÀ5~®AŽaC?1æQ>ôV|xäȧ|VN*`—úJ …XO: p]OAöà½t®àú|¦"“i¨ô¦Îâvã0M ÓŒÆ$ø M¬ßTáâÛ$\L„d¾«cn$ãb#2¬Ž­Ÿp¯ýÑJ}*©^ˆmbÁ6Á¤¥káeÅ(*Ï”|~¦ByÏclpÕVŽœ}@:ŸFZh¸§2i&ãÄ‘ØS˜Ë 8ç.ÐQr5CHNÔp—F´]Q–<ÜÕüË™ _qßp,¢º<³26‘8 ûy }!¼ïiÿß}nwüP£wÒ!€ù¼y6#º˜áÏ$0+¹ëY– 5@H+´¦8Câ`3tú–1âA‚O°~Rb§ÎMߣ´X -cå9ëËÌ¡1îÌ`' Ëošl9ß‚áV!¡ç¿Ó‡†“ÃVh¹’²„“C6Ù°BÃSÍ/ÁirN-ï£ &ß.i;h㤠-€“.ï´wOÆSIïYêtû¥Íà ‚…]Ëob‘¦YêáLQ ]4ˆŽb¡Ãžâ究üË܇nª˜$èïXƒ$ìåÜóoÌù¹¤ïO_BåŠxÅaT¤šzC,ßOÕ“Ô¬Ø팽t¬èšÛGHÅß·f©†+m?I>yK®+iäÇ#9Ï4ùœ§¶§q_äÜ–„²Ôy«9Œ•o¬}¶ÿÅ+·ÅªÿNúÿW48 _Ç~¡Äè'›ÇÊÄÔß~² ®4@ˆ4ž4Áµ4Á/1á·Êq㛡LDØmDQtÓòÌu½Ä’ÁôßЇêËGÚßJG€µÍÓ 4·¿UÐ}™Š-}èÂÀ ¹ôqª¬)þéZŠ!@IÊ@h¹ckìÐqë= .siûóãè{+'‘Õä.YN¿[£8\NN ·q*¡Í\10p&é,ü›˜?—[ÿ:Ñ»¯ Ù¦tWðKm§Øn“µÅ–såä z³ ­ò§®¾!ˆjØ}>Ý”õ&+??ràpӳ߈à?ëý-Bï4 QbùÎdµ†;‘“…}Þ>”×ýÍ™ÀÿTä2´endstream +xÚ­koÛÈñ»…à0T4¹Ëçš&¹;RÇ=ûp-R $Z"B‘:’òãßw^ˇH©Z$wggggfç¹vgüsg‘o;:ž…‘kë(š­vÎl+?]¸‚±”Eç¯×?úÁÌuì؉gOßö|={X³>þüáîáó¯ó…ÖÚr#{¾ÃÈúøåÃýܵîo>~ø‚KžuÓ_onæ ׺¹ý‰ñç·»»¯¸6´õ0|øåâóCËV{ °#O\|{tfkàÿ— ÇÖq4{±c»°¼»¦lßÓ2Ï/î/þÞ’â5oÆ»¦T`0nlÇÊ?¯¦Àµ½@·jR°êÚ±ï÷Õä;¶ïx¤&ÐL`ƒ˜äûŽõ±J“&+6 ‡ °ÔÊ6ÅIh}ÛϵkUYѼ{dÈý6™kǪÒSêñBÛwÿÃ1 Ãñ½º­â÷¦€£ÃÀ*+`zV!-“«šC†cP:kصŠ$¯'•á;KºtÂ\%‡*ö‰™‡ž•Õ j™R±>Å.!S¸¯™³àøo÷üý”‰;ÀtBë¥f0QÃ[Ɉ3/Ç6|J ¼º€7àieÝs«¤@]—2m…Á•a¬€;]3B+YðfŒ˜SJZåYÊ÷yžJHy@¶QnªdÇW½F°GãrM‡Ó¯PÚ-/?Ò 1hÕs¶’h'¸F[_“U“¿ Qc8ˆU‘â({2ËéC^Õ„òÓ꣩ZU‹#ö¤öIè‘ëB€Ÿr]‹Û‰÷Ú†– +mb3û'¦te*0ú}&_ótg )´Ö Œ ~cÝaÐ\¡#´=W6”L0Y åf++´¬r™ä ßÓˆwv."T)¸!Úªâëk:>ZŠÕ)¨“b`Ÿà;=ás b ¤ŽŠe„Øç9’K¼c e°Ûx °=9£Ä*¾¡XÁmúõòƒ¹èšèA 9¬Pw[ÆJjþ^‘f{%àª#OãeF†’To‚€ž¶æqïqÚúNªtŸ'+ c¼dÍ–-'AöUÉÚLð. R€“á¥Ц°à ŸÁ5“Zë#Ue‘£Ä'2«+Û‹ÂqåÆ¡Tú¨òУÊeòEMåg׋lÇó!OÛn4À8þ¶]im;”)~¤líêé”n° ªñókkÅ{1;Ô”©MÆZЮ²c­f½“FìœóìSBv:—ˆ(òS¹ü¤¯ÉnŸŠC9¥£)fÆL îy¦b×vÜpæ{¾íÇÂÓ&/—¨¥üqÂÿÄ îÒç^”h€‹äzZ<,_²ÞQêÀ†rÀa/ÖØs ˜vn´’e.D¨òBÈZê(¸VrzëpÆÎÓæ´ýÔÏ/÷=ñš6ú×6gˆJrlÃ[293Ng`Ù*£lDž›sšÁŸ7Ã-/]M¥V˜k]ÙœÞ@Ã÷üù ‹Æ £|eÛS‰çØ(YþzÊþ;ïÇG¯JÒÑ®Wº°B„ñ»)xéÓtFýdêj4­D à4SÊ£µ¨êš³ÂꚌÆÔ†×kb¤5±1­e5,†8.{Ñå}/ +§S$6²Eüòû€©Ó{@0‘±$‘ßzû¼©}¬÷—*3#Ïê¡ÎÆÂ-,²xbéÓ9BëІ:q*8¢e@Bpÿ·Îµíá€!]úl‡ÖUÜÄ}ÅPyƒš!5ýRöú%@ÂrŸë*œ©)OqFÑ'ò­´¨¹SŠ|.-’¦7I¹ £¾®JWÜiE*©×áÝ%ƒc>Zè–1&+/ZI_ák>²,&l¤%×øÛíÍ?xÔ+¹pZ¿Õ†O"¾³OܲŠ\¸÷lÝÃ9ù( |ߎ\ð(àÉ£À6þ uÿâ…¿©’­ù¥€"\Jvé^ ¨¤Á®Ðùá °î¹GãÆŒXUSúÊŽÀpÎ +Øáœ4@¥\;Ýq,¤¢7LÓªÀ†Ôœ0º¦2£ÂWxÞde!›åK=kÝH; hç9Ó’ÿÊ L iH7¶]MžrùkZ$CM|÷âõÒȵ,M%M„B¥€úcåGèLsŽ0ä1x %Td¸n’[@Ü°C „Š*/¦\Õ¾áx€'ü¡秖´Û#)Ø:bWTÀ’Þxuúƒ–ÎR{Á²·¤ª¬‘³Sób“L€åz ±84Ãå—,ÏE€Ül)£aPÚ({sŬ,Så‘u\ÿ¨þµ†¶°7Ô»99Í~W ß'L(kik/<®9Í@LY&8Æ·ÀL+>d`;®ÚÚWrJy@ íé{É“¾§´éè¼ïu8§}Op¤”Û²·¼g·ºæ|uÊ%ÜžžŽ»Ü uÜÀ« |uÑÎphpF,u +n+ðHnE/‚QØ~ù],Š$ðâ’y„±‰Œ û«c´ß)äK¸¥¢Q<Žy1æ-ëTž®Ík{¡rlå/|¢pÇõÂtQ!¤²6XhÝöÏmëôrÊ2" eÃY»h1NZcPIN^¢)‹k‹7C7)ÌwöR”Ç<¹„O7:ÔÁ8âjè"¡¶ãP÷ØêÌÀ¸EL¾K ¸»OX>zBG`xæí’1ž3E2n<.y™jØxË5Ç:ÌéÕwF¸M³Í–:¾¿žº•rŸß‘L(M†Çš»ÀEuOàLçg °Ñú-UàÊóº +\)%ù¿àIÝdx[9Ï.wm χ^2C*~[UJK9ó&DÛ§hžjò• £Š9㨠+¡Õ%ÂTJ±%o~àmaØÛæ;¶ ¾ÅÓþO‡è@·!:áÔ)Š0ˆ¹Ê4Y¡ßÑž åtféÈ AÆ¡þÝD_x^ =[<|´—¦œŸs{µfÂUã姯÷ sÁkŵK^/+þvÄ€=Ë¢HW ÏPÆèkßÞÈb½âãÀ‡vWSÀåo„àë>/«îÕ`¢4­"ĺxºmµüÚVsÁ‰8á+e+×ðBMQìóëk¬èô˜áìF‹endstream endobj -5120 0 obj << +5242 0 obj << /Type /Page -/Contents 5121 0 R -/Resources 5119 0 R +/Contents 5243 0 R +/Resources 5241 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5108 0 R -/Annots [ 5123 0 R 5124 0 R ] +/Parent 5240 0 R >> endobj -5123 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [309.861 679.338 512.306 691.33] -/Subtype/Link/A<> +5244 0 obj << +/D [5242 0 R /XYZ 85.039 781.388 null] >> endobj -5124 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 668.213 136.217 676.872] -/Subtype/Link/A<> +1202 0 obj << +/D [5242 0 R /XYZ 85.039 761.463 null] >> endobj -5122 0 obj << -/D [5120 0 R /XYZ 85.039 781.388 null] +5245 0 obj << +/D [5242 0 R /XYZ 85.039 740.47 null] >> endobj -1346 0 obj << -/D [5120 0 R /XYZ 85.039 653.944 null] +5246 0 obj << +/D [5242 0 R /XYZ 312.932 595.862 null] >> endobj -5125 0 obj << -/D [5120 0 R /XYZ 85.039 630.626 null] +5247 0 obj << +/D [5242 0 R /XYZ 85.039 337.294 null] >> endobj -1350 0 obj << -/D [5120 0 R /XYZ 85.039 137.996 null] +1206 0 obj << +/D [5242 0 R /XYZ 85.039 281.191 null] >> endobj -5129 0 obj << -/D [5120 0 R /XYZ 85.039 119.327 null] +5248 0 obj << +/D [5242 0 R /XYZ 85.039 245.781 null] >> endobj -5119 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R /F11 2898 0 R /F66 3242 0 R /F69 5128 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im4 4878 0 R >> +5241 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F77 4849 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5132 0 obj << -/Length 1841 +5251 0 obj << +/Length 3276 /Filter /FlateDecode >> stream -xÚåX[oÛ6~÷¯0ò2¨IÔõaÀÒ®MS Y–8膮h‹¶…èâJtüû %˶ÒuЗ!D~çÊC»cþÜqØŽHÆQìÚ"ŽÇ‹bäŒW°r9r ÇÔ°L{ºýÚ‰â5Ì»†¬ˆØbqjôÌâÂ"a -;p|²K^Ét2 ¼ÀÚÔY©UÝðìGþ<©ƒS¦.‚Hh±fåê€u±Ý<Ë»f*e¡žÝåE¶“ð®-šO"UQ¨RȹÈsÜ´j @‘z}°éü‹¬Ï›MUåç,ær`ϼ®v’óüvYõy¿çÙâ̷ڪƠ¯¾Wgúoô}Âú'ªšYdZdåÁ¦ºªô þ2q¤œ¿qû15 ";vãñÔv("’<[gE"J¬ö+Ñ;8xšx±Umq[¥œ®•òlYÕ<˜ËÍ(bÇÚ@–̉—Xo(£¡]–¶¦,aÌ»LiÌM›gWš¿»ŒĨ6,—ˆC»ÄÓäf Ÿlñ‚L65šö 7Ãr É:NbÝüüf2õ#ß’å„”Áñ éÙè»·ÑLþÃq}tŽÔb ‹ó"ÓZ™¨J]8 ¬ˆ¤LQ»‰Y»†y¸3G¹d Ö¥ã0²ÞV8Ý!¿ú‚Câ©Ùà-pÐB¢Zâ^륚g2RŒåam›N¬¡Ð‰ꓧ¼¯¬4Jƒ‰׬N7×£Œ±¡géµ")^0Æ µ)´5DÓèzz «2MP¶ˆb­‚`Bs•¤î -‰®%yíòþŠrƒ! i.uV•gqžÚö²›uë&ˆb³¦i -|×÷¶Cž¼"@ ™3G_ÈÛSRtGÆ"°Žû¾c.2£–ˆ%7)GÈ£PX­ÅE‚ç]˜ ¤²*cS¸‘F­æ?˜º¥„B1sLM­+s42P±Ì»!ÌRDëëÑF™}ZoÇ<¤ˆÃÔ÷cJ&ŽÔ)2§yÅ3c™'œEéµÊŸxå ö€qÕYËëR'd*MàB’eÊró¬T6z,¶îKrÿƒÑDø‰u}õ›Ù˜gʤî‹gRpÒñ€Ñ‡Äƹ¬S”h(„I«šÜµÆúÙáE"Ýë$~¹l…!ÖÝBšô“ŒZšÕ-e¡ss:.~ P?;raàÂIù°÷Ú2ºVh}‡íN¬¹¡ªÇ.¶M/Œå0ô¨»dÁZÂ8>ÌZ07P#.´K2ÛÙq0"1¥3Lèœ1KiúÐáJtÄ;U8!dDiªâ´Ã­¶DPm¶u¦az s˜µf@^˜.—s©YR{±TŃ£(©Ô’GM{•Öì€#WÖÕòHÈ\.<«[¦ƒýÄ‘ñâˆïHº - yÞ¿7›HNÛ@øÒUÎòÁä xŽ|26±IÝŪ,xKfÌó9DY?ÁûÔ§ÝÙܤ=rW%ÛIéá^%ô÷®ƒDÒ$xeºZ>´ Øuë–Á¥ÌR•F©0€³emH;HcܺæÒ¼šwe©`2A Cäè¥'ÞÏåz_™¥‹àX·1 ê(÷·R•¥üÊ´ýÌcš(;‰Ü¯>Üz<ôBñ`Õµ4,¼P\Ï®7sÚŽÇ/7x¬y6@h¾À±ÞWÁñ* úÀ[`Cåê‘çMõÕÅ=‹ª\2ýNiMþÅTX5L\²(žPãøŒ^!4·üŠ{^¯=éuÐ%wzùð"õزoUM½GÎëš ã,ºoWkŠª¸°PTµêµ¨9ª„~ ±ŠS¸Ý¤nlì846Í8Ŧ~þàè% A7ÄØs›lxÚøƒ&±>ê‚bê¶*á ²¿C¨‘ðDõàÛË¢•*UÝ6?Œü]˜£ÙRmäºk: ¤s2ÂFnäƒà°F5•ýбæÛýÖ®à˜û¾ÄŽS¡U™; ÇýGˆ¹Ñè8²'ßÊŠÅíZJFÅr=t#4ü‹A£4¶¬&VŠÚÁ=ŒéÀû±Ï7葯;ò"óò -ùټʫ¹ÌùÑLŠ¿ÇÃ}ïÒoü9aÚb£'<ôä@ÿ]Þýÿ§·ü‘ÌO/ÍF-2™ÿi„þ3wðLj8ˆžpÓ…#ú‘€ì¶3h!'08ÿ• §í‘ÏTpÇöë7üó)ÿéºî€\ŒÅ3—@ày¶ç¶Xøj ñ¶¿äþ 6/D$endstream +xÚ¥ZûoãÆþÝ…à•žx|? +ˆsy9HkìàR\-Ñ{©”}úÇw¾™ÙeÑ.à`p³³³³óøfuþÌ£þ,‹]/Ìgiæ»a–Í–Û3o¶¦™ïÎ|¥X(ÉbDóÕÍÙëoãdæ{nîå³›»ŸØâpv³zï¼ùþâíÍ7?Ïa:~æÎiš9o~¼¸žûÎõ囋19o©ûóåÕÍ|á;—Wß =h~yûö'Ìͳй™¸ùáì›+–ÝDÈ!Óïgï?x³ÉÿÙç†y6{ ¶çú4½=#¡Ü8 +µ_Ÿ]ŸýÓ²’¹h&«¦TÅí’Í¡çfY4I“ænœÅô=7ö"«¦À›P“Ò@Më}Ùtè$uÚø&Îòyœ‡žSöOOî'tˆ$š6:ÆÐœHãÇ#iü$v?;gØÊ«~¾òÜYW÷ó ƒ ÜíÊb…Væ´Mý(­b¹ÄÅÄw”n ­6ÇìúMÑ•²ì®ít}]KzAºû9³#Î]O¦‘M\ðNË£­¶TYnéCÒÊÌÁ +œ-è–C/!Ýà¶s9,Iž³jÁå¡©!8ΈÁ¢AÃϪé£;"éªô8f‰:åÂS¢±®—±¶‘/‹ö¯ õ¤~áEÎͦ%˜)×ßq‚ª+·fvdfwS7]ï }¯³°"|¿Ïã\tm@Þ‘VåŽÔ•:º‡ï¬z8`êìeò£» I‡Y¶û½D”\ ¥ÌUºžÜ‚ãož­÷öXÐ.4NœË;á°ïEºô¡‚²Ñº5²…a&'-ºâX÷t»LŠ«dAÙ îõÐ)ôj©-Ø(‘>bV‡7³-%>][Pß2µiûá•¡*ÇôrôÈ~utÐ6‹JÌv_º'ínè³$IÝÌþ0 ³Ð Â`2˜á8ÔAü,^åiòc> #Õ"Ê7ÊrB(¬ø¾›CcBüÔMr’=ŽÜ$‘ÀÕÎÙ¡Á“£ +yœønÂÎ~Ÿù®åy($£6Ë8¼¾Üú³¯[tv$«°]øJ´ËÆÑ.NÜ™ðä'»tW«ßx« $“Œ1¶‡ÿŒÅPN…¦ûª@$÷Ùñ½i¯ÚmQ鸦‰û’SJÀ¼›•Ìññ08^lo{›BoKk§ +ªGÖÄR6ҽ盯V$øÊ°FO!êÍ|çëvkîrcè †¡kë¢c¨âØÄMÑòj”cÂÌ“0G³u»æX5²[½ã€ÌJ°Fˆq£, ô}Õ6t§þ«iѱC<É1±Y¿—~¥ß¦U‚¦<°Izx£ÐSç§;¡[’Ïô%âi’‹b±š{`Ÿb5|\w·w2S6÷UÇÉe1!¸&LH’GÎÃƺô“ÇÆWeú?{> óvE#± ¬X"±°ƒ¸ÀÛº”rJµ¯Àõ†Õ°a©ÇÈyºÇ +­GD+Þ¯k¤þ0!¹¬]•À;:,ýH®˜'ëÀÎœuý¾Ó–µB¬ß7#G׈6˜8‚{ƒ,·ˆ]aŒ¯ãÊNÖ­Z1Þ©{{@~æ.-èÙ÷U³üR 'ˆ%Êc×’Ùü ¤f›…T¬ØìßE¸iÎèЮŸ/VjäŒ ^ªÔ ô%åj\þ u(ÕüÉR´M d´ÓD©&4'â<)Õ¨MÃ#y`taX£C{Õ6ŸiÄ130Óˆš˜–(bb!ší°Šýˆh÷¨uj®‡Ð]qp»·ÞÉ0‡¢Óƒ9&h‚nyXÔÈ¢%6l×Fò)넽¸Ú°Ð.!”é§)‰¤ì2Heb´V'dËC±^[ø2¢ë…êØ:¥-»3h /uK*r(0x5¨ˆPh@Ò½hsšçmNipº‡Î$s.°Èâj†£Ã‘ù}ÙHÀXm9í¿êpƒ|€'’~榹ÿ¢¨†æDÖ#ƒ ‚È FÂRÌX–’¡mEí÷HÜ]eË®¿~4/Ö©Èa[¬J6n¦©I<Í?€ÖÄçêo£Ü¹ /ï«V ~Œ©Ñ œ×Œ.2clG>*„œ‘!5%×’©¦ú.;A‚Zl†iÊЄfÎ:©x©]Wýp.Í¢î[œ4t~¹ºüU×0–©&pÕ!㢬}¦±Ø_ùFÙêF¤ÖâZ…øR·]"GŠËÁfö†Ó°Ïp!ˆ½qÙ§áF LoJ.KÈ5åÕ&F6¬õ‰c%ƒ1O¦}úH£á Ð]Ì›@ôiî )wCÅhX&¹Ò‰ z'ë²)»¢–QhrËœ6·;Ãx¦0aËo;¤°S… l#‡´B¸æSµòŠÁb§GhÆLÑÊWNVœ«!~pŒ¬-(:>kbΘøGÁÈ•· «¶3µ“›º¹ÅèÈsI`Ê„û±PzüSlÙ0`ýLêmÕtlñ6Ôc¶Ö¨æ§£ + +½Ó—•^&VÑ÷ðmÖü¶—;o¬~95|4ëJi°µÍzz$[Ý +¿Ñ–Õ–-ÙQàLavq/¡°cÐz¼Ä@` ª¥;}P/#æ‡&/¦šfg ìä™Tª<5±éF/<ŒåEŒ÷5 +£ŽùòÑ÷¤Nò6')b§&ÝîE.Ä<l¶Íd…g^?¦Ž†ñ˜¤k÷µÀftá¤eÑ#VoG¯š¤ñR©¹BO#µq°¨Zº;©—x;®Þ±ÃÊ^"­&Q Ý +²å‹ :vŽ˜"(õr°Ðn²ÕË8=ð®`´ÁÅK'mkR?㈻‘ÇÙ:ó}ú®©ÏÁRË—B—kß}æG º?ú¾øãËÄÂû§4aŒDÝšRxâÒ¾1²Åòëý-#Δ‰dˆ4Ò)½xx¿¸BÁ”ãT íðC™{údÌ’0¢9…†O4qÉX1qøFVüBB½;‹+Å!èóîé[áÁ ß1î\ŠeLo|ðÿ¾~wºÈ™X"»y —<À™¡†J|'ì&s¬ÁLµ°†Úüμ¯Ùîvu9aÀ˺*íaȱŠNteßÃqÖà²Q©0Ù"«ÙG\ŽžH4o}?.à´ µJºµ…CÕÉsÿðÓU|¶4¶¥tô°N~:‰ Íew_-U à‡ÊEŒŒñóSÍÞŠÈPWUwPFÛ=Ê(ÝJšFåh뇀Š€ £;ÁR¶–:@9Oúæ°lÙvuï$"7.™}+_Q«…IØÈ‘=#DeÑžlOrö‘Ä¡@¥r’ÄÌL±q¸,øòÍ3l‰7P×ËØ!÷Pg{¨åYC·ÔiÁÔüÖ=~8²+¢ãbÅfXÃ\ÛŠ=¨%hN¤IÓ ~ò âéíWC_š_ØîÈêc?·[E­ÛKºzbl©Q8Ÿ‹WôÃçÒ·É ‹ËO…µn~ˆË‚#æ8G/ÍÚ~>b%ÒµØèA¦`ׇg ÌäcžDAüs¶0/Š"Å”2^:,rk/t¹•µ·£ø!ô‡ðA‹8úÙ7†0zúÆ€wÃvT]GSq$9H]/7¿ÃP±A¹/ÁQª¿–‡LA€B>G±†äQ&†n0ðœÖ£‘]PûýÀÈ¢({ò*2F ˜²~œ±ÓÈóÎ'K÷K‡ª×e¤£ÓwÞýAQ¬¤×߆ãIÄQè&aÂÔ$:gäÅâo ©xbªÄÓàÈþ»X¼ ƒ_³E)…Ü¿àõ=–Ÿuzi¯ºêž®FW‡ï9ÿ‚õ £H¦ø~Ê’ó {Ã&—W‘7_$ø½çí‘ǯóìüT)r‚‹ß~Óþì.êݦø÷ůoÏŸcn0ùRGræ?õŸM,¢«ÌÂg^ûâ pßÈ€.ŸÊ‡™gá©Àÿ¡“¢sendstream endobj -5131 0 obj << +5250 0 obj << /Type /Page -/Contents 5132 0 R -/Resources 5130 0 R +/Contents 5251 0 R +/Resources 5249 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5108 0 R +/Parent 5240 0 R >> endobj -5133 0 obj << -/D [5131 0 R /XYZ 85.039 781.388 null] +5252 0 obj << +/D [5250 0 R /XYZ 85.039 781.388 null] >> endobj -1354 0 obj << -/D [5131 0 R /XYZ 85.039 379.971 null] +1210 0 obj << +/D [5250 0 R /XYZ 85.039 305.03 null] >> endobj -5134 0 obj << -/D [5131 0 R /XYZ 85.039 356.653 null] +5253 0 obj << +/D [5250 0 R /XYZ 85.039 269.621 null] >> endobj -5130 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> +5249 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5137 0 obj << -/Length 3112 +5256 0 obj << +/Length 2748 /Filter /FlateDecode >> stream -xÚ¥YmoÛFþî_a0BCrùڢť¹6Mи¾Ú¹|h‹ëZZKŒ)R%);ʯ¿™yv)Ê’}w8­–³3»;³3Ï̬ÃÓ€þ…§yâª8ÍòÐWy~:[§ šysZŽ©e™Žx¾¿>yùcŸ†_ÅéõínÄuz=ÿÍ{ýÓ«Ëë~L•R^Xø“i–åÞë—“лõò×·×o/ÞðWLÄÐûpÉÓ¿ü:É•w ¦·»éWï¿…/å“?®ßüp=œt8ªàcþuòÛÁéœTzwøªÈOhø!M¯Nèœ~+û]\ücX -sñ)¤ŽY%Q¹ŸäêÐ,*™%L•Ÿ'Ùi–~Äb—u[Ö}Y/&Ó$J¼oñÓm»{Ö‡Ÿ†¼w±ãéõoµîzÝ?Å žY³Zéz¾'gfË£³‹>~áŸsÝ›?í‡,p[VŸç·g|÷~_ö«õËnu³nk¿j¬ßüªXNS„~JêË‘9ÑhËÉ4Jö›ž[Õºéy‡ÑíôÝvßÿaËOÓóO½›ž¿ÃèËôü‹5Ûô|ößlþõ›·+g9™œŽ-â.isS•³½‹©›#K-6¦³—ÙÜ=ÃC?´eoô»¹ç–K>`Ýšî)^Ó‚EÏWe½'t·iùá²éz{›sSo÷D_þ=/¥«ªyØë7íMó¯Ïë¯ðI¦R~¤‘Èâ²úËÃq$N〮"¥_E¿™ìx½,iÃXåý„¹b”‘ÿð¸Ô•Yê–€ÇðWá9þ¦®¶<ʼ~iZ;yK|M †Õ„–r,†Wì(æ‰aÞ5 7¼0oJëuàaL -ïmUæ¼¢0`º~A;'”û ÏÕ ˆÀï¬ÞcóöK«FðµÒGÍÂ=(Ÿx§œ­o@Óøü=ã -²¡ÇL•=`á}ÚЄÏ(B:H÷ûä–fµu«W²9–彫EQ:ÎOÔ£sÐï•^ñÔ=O‰sÛI²?n{w÷=ëqzGA@ä$Æì#…ã öFã@ÉmÈÁkô¦Ï ,YÙ‹2WšÄÞû¦5¢î‹E[rÛ8 -äü²úøNÀºæmWⓘ†ˆÍ-~ûe)°cÍÙ{ 'ÌD\—ÏîøÎÚþ yô÷ ê¦Ç‡F˜þ†ƒ`ó²îÎ@_´ K¯I*üÆ’6Î]ŠžIñ‹nw¹hÇWU¸öŒ®ÝÙ…7´+§‡ˆQR@ðZ99/\Ëáê™]ˆ&öa¸0=ü‹vkÚ;L^g¹XN¢Â»A$Šu8…0£æX-Õ5o'`•ÚËÒÛiçϬ˜J{L132j°É T¡ÄÇ0]„âBqaA‡)Œ¢”BaEfмcþ$ -ÙsÕ ØÀ’B5+Qòó« ËÈſœ·7]Y›N&B |÷e+'DÕRs®è-CÃ.ÐW´„TÑqHæ+jüÌ*aÑ-xæHå¢> €MEw…ì³ËAÔ /QÒ1w™;‰ƒVðê),¡Eý4Kž ÖÏ€%¡_°Ž‚5"À‰ó–„^ÈO™åµ©û–‹g•°²7ɉÝD5xðÓ÷’{òœ;µÐ»œ«1í´o¦nÌô3àÒšIíPI<¡gH­y?¯çŽçP -¨¿Hе¿×rñäfQ‘Âô+š¨ P%5LÈÄëxbÙ¬ $êGõ‡½>Æ.ò:pç°l:Po¤ «ìÞ {#y -Ðiá2(oì\•“+Y¬ì“°Éœî àÊ -.J -ÏhIîKþÊ-–.6‡’ ÿ¼”‘ ÒP -J¶€N"A ßOÒ±äD;Êûv¢©;ÐÇi™ú.¬ãÐ{³;Ž´ñ-? q&‚ÄÒéñ:îW =¶3E@&67š½3ɤّ,±ìÌÇ€Q!@õå4£Á¬*­½_Ll-LÊÏœ«ØZMí²—œÕ -ï«Œ–Ææ,Rzéff®3)G0õÂ.Ï=ɱú™½/A¹g7B¥ÆšSá-šs}SIáK£¡Yð@êfËs;À¶ù"ÿE< 8ñ¶£n‘i#óØ£è5k]•3—‰ö Ù£²ë”VÖ^†ýBêH&Ù³õðW"ì -/Áº½´ÊÑnCFãM§v(7Cûjœí½Y@Jøea{ö5ß__¡¤D]k?t©L -m™˜ÈÛ„%¡E»/– 5WÕN3ëªÈn$‰V€ê•CòÄ9뜼¹½.5õ|2œ¡Á•™—º7(u¾:rqÔ?‰Z‚\ÑȨkß“¯ñèÄǯúRÂÈ@bÖÔ3)yÛ]'Gì»è³‹i;1ÜÉvòXÃ#‰°• í"ºKÓWÀKûì>Z]w·üÊsD©¥»•}{@iƒgW¹Ç{ØdZéÁ¹oF9$»*å^ -\¨µûyˆèM;gW=^/„™òóôù?~Œxž®‹Â”Š§8Û«‹"W} Ë«—W:‡òžÅ…îP Ùϳ'‹¦©T¡ÕÖD—xígÑ+¹•öÞ´ßØEZ=!é‡]íxã‚Gãv¼°§¶áN"ÿdSÏíïmy/ov¼§ 3?–ÂâéÎN¾F¡P÷ =a÷8÷³ç­î8ž®ÑÂ(÷à ð¾‘'¨Ðmñ"‘IÙç›ûãoJ´Û¹L&,‹Ýß¾h"áO4I­:›$i$tšNV»39¹•7g‘£˜;’y@óýòìÅ6žDRd2›,¯|¬0VO–ëÓW?½\,x7›k­§Q*fó$I§¯~yy9‹¦—ç¯^þ‚Kfº€ÏwçËÙ<šž_¼az¤y¿X¼ÅµYª§ËÙ§åÏg?,{±úA„ eúröñ“œ¬AþŸÏ¤ÐY:¹‡±,ïÎ@(avß۳˳ô¬xÍLxט +¬N…Mõ©´ t%tM+…•†”ðßùüƒV¿ž/.gs«¬œþ•~§mÑÜ-×MyW4ù÷Ù‡²Z×÷nµƒ¿ïŒ”òê›G(wœ³X¼º$±_yÌ¢¾/šÅ«g(=NR¡ó'´¡&ì¨ÖQþÌ™$ò¡]øðÈ“ùôø4©*KzÛÄfE"³m“Ia"<¶B)6Í»â  k°+›b ¸xÞÍ®l[X(q¡†A…ƒöXŽ¡†©&UL¾À=³È ÊðO0¦ .N/Îwfòº†›L‚Ë8¶ó€/]&JC ©LĉÄF +§t›sS«$Vé´Y ¢5Ìäk¸ÉÚy©*îù{Ýàuï +¼çѶäVïÝìe„;$»‚AÎ$Ö-NvÏy¦® +7¸vÜfðÏ=±â…U]­KØבò‘AÕòÊnϬF ¾©·k +¼/¾=¶I¯©…‘ñ¨+{šy@D6ÑÀ•cUÚsÂó—Qrr¢„ÉôÓ':š“‡6µ±ÈL28q‰º-øÎùjE€ÜW¬7œÛ·d3ÒŠb›Á,(·*V¬E^`$óxãø¶ÌyiS·Ž/Á6Hu‡T^ ¦}ó¯yŠ¬ ¿rÄf¿K+KQ@ì7Æðf=m@ÄBwt3ôµvDÙÕÆ™°Z?m×€èq»z¢?²ë“'z»Ÿ8j×ðÄÞ®jáö`ST…2¡Aá‹Ð4X üFüÓx³ÂˆVöþ늌PðG•ï“K{Gg€Ž ª†ohì[ +=%´&„`¼ƒyb0ÐN E1÷o˶¢y +ù6c* ••ööÚkcîOa¢ ˆ;TUU¸»àé4èy×k¡íCÐvË3· ΖMѶŽ ƒ´h9 Ì@÷s§˜Ì¶8"@ñN}£Ý£ ’鲋̱»dƒºco¨ªÈ» _÷c¨i¤üÛ'‘“i(—Üv¶èÎm÷M™wü‘óc'5Gà|^eÓ&!§ó<Ѐ¦è|dw¡˜|ÓeNïYWÛ‡o W3Ê)4^ר¸ý–mzŸÉ¬Oý+ê,B"™Læ}}÷ÿ-A±¡EÊ…'û¼=-†µ"‰FoåaHTúÌêr()ønæ–W¬°”³&á+cû9š¦ø‚1Ó/°¸ˆÀ§LÐdë\âx¹r;óÊ—ŒgÈ+ï +yÙã”ÏrP¥š1òœ™ÞÔND÷›óô$¬æ#ÀXÞ±öTqBµ'þä õùÅo œ‰Y®m^…ð옘‹ŠæsÛå]YWÎ ”š¾½%™Ý +³çMᶬ ÌÕ!æ°ÊXØÎA<è\Ó>D´÷A@î9ÞRêT‰,~òýá@BMo„†4qˆ¸;ùŒEŒR‘€@bè > ®·¥ïç@ÓBËkÒ*κö§åy€B " ÄTï´ãê#W€¶_Fêé;hM:²"Î8môÓƲ­Þeb¶â¾¯q\rMPÜ>ðÆ•ÇŽË)ä‡0ßû¡‰Gr@-ÐHÊŠg¿ô§rú²rlNÍÄ$lË㦘»tF; ù/­@½†ˆÚ›}“wÜ +~7’+Þ¸ž3ÚUÊé÷þîXX"øè%·šâI¾š†‰ƒb0Ã=ð$™óÏ^ÙðUƒ°IË«ŠmXÔ*eKŸ[Ö^è#‰í ÄÓPc!_¤©ÛUd¤@’+ŸÐðBd,¶uÁ&c"2‘…«mÊ–gB/Îþ¬2p 3LÓï_À¶Ðß]âg–N¯ó†eç~[þ=-¬!q†b\æT»»í\©GÄ#ê!F¼G[\SùÐQ/ëŠ-éÐŽ)@Ú£³Þ„ý4±¿ÙðTçþ×Þ÷ŽvUß’P’óJwM²Î!ŽŽ³¡ÿ±SÑÅâé2hÆF2E3úJJ²Zf½)O¡ÉT¨Ø—\fk;Ýߎ¥¦˜Ç‹·Ÿæeåž{d”üðA°\œ‘$išè(P*ù#Ò½à-%ew7.`v[äA|‡ó(úR3uË÷%µÒÙÐU ø½.Û•wáö qÐwG Êûè…‹»Ê-d2Py¨œ —„&Zžñ#%¥­{Cê iãÀVu{]@œ¹ÄÉ ãä·$Ö1‘~24#/¥î=úR!c‘ ž:ÐÓœœ8,X#|¾Vƒ÷-5™-Mõ:Ãñ%Fü”L&9ÅÔ»]î]sMµMå¨)H—[~ó#ñc‚ +ÏϤH¬ hn©²æ¬¶-]¤£×¬‘Щ…’>àÞ—Ø'£P”fðø»™9!”õÞÍù¶¦—¼Z³Ùqß­6EÃOŒGrΕÑ"³Ù°Ì^¯EÈíå,š1AcˆñÖ êjÒ#ö**R‡ðgØšTèÔW©ô‚F¿Æ­õŽ›WAóýþâü·À] ƒêæÏÂÙd¦øéR- yÙžèýÔ=²OEvxbCÏËnEo›øóæý9#1:1"î•íº Ø[pðÀBávf±­éÊÑTŸ¦BÚìÃ"‚ E&y‰Üð‰IÙdxä‡ò?98Ö‚B«“EÙx¯J°À•äíA_K׋sí@qš ›pÏCàâ(=)áy•hê+dš¸Q —y×?šH¢.1x`ËŸ˜Á’âp}•c +ÃB×:f#]=×–>®¯ÁÍhÚ‚}ŠÞÖëkÏæ@YW\™Ð‡»f“‡-0í¨™€vz ›"ßîxØr°s+yXYX÷ø‰I¦Ûº”tUúg~ç¢EÙ¸ÿýÈš±Vé_BùÝü‰þJ +•¹üeK~Õ¡ÞÅ´Hõ#ÏbV)m^êѲøX^ÿ_­'ÿcª/eendstream endobj -5136 0 obj << +5255 0 obj << /Type /Page -/Contents 5137 0 R -/Resources 5135 0 R +/Contents 5256 0 R +/Resources 5254 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5108 0 R ->> endobj -5138 0 obj << -/D [5136 0 R /XYZ 85.039 781.388 null] ->> endobj -1358 0 obj << -/D [5136 0 R /XYZ 85.039 430.872 null] +/Parent 5240 0 R >> endobj -5139 0 obj << -/D [5136 0 R /XYZ 85.039 401.468 null] ->> endobj -1362 0 obj << -/D [5136 0 R /XYZ 85.039 332.675 null] ->> endobj -5140 0 obj << -/D [5136 0 R /XYZ 85.039 311.478 null] +5257 0 obj << +/D [5255 0 R /XYZ 85.039 781.388 null] >> endobj -1366 0 obj << -/D [5136 0 R /XYZ 85.039 173.868 null] +1214 0 obj << +/D [5255 0 R /XYZ 85.039 382.96 null] >> endobj -5141 0 obj << -/D [5136 0 R /XYZ 85.039 141.654 null] +5258 0 obj << +/D [5255 0 R /XYZ 85.039 339.209 null] >> endobj -5135 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R >> +5254 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R /F65 4136 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F62 4047 0 R >> +/XObject << /Im4 4550 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5144 0 obj << -/Length 2974 +5261 0 obj << +/Length 3504 /Filter /FlateDecode >> stream -xÚ¥ZYsÛF~ׯàú%d•a0ƒËy²oVÙXÖÚty«’<@ÄHĆ$”Vÿ~û$H¥²å*sŽžž™ž>¾nHÍø§fiä:›%©òušÎVÛ‹`v3?^(¡ð„Äм[^\þ=63øYÍ–w=ŸÈ7‘ž-‹_æïÿñöfùáóÂÓZÏUæ/¼$Içï¿Þ,Ôü Þ|¾º^^]ÿˆ=ƒjþõ§?}^¤z¾d¢«ë~úíÇwo¹§ý`ñÛò§‹Ëî¤ÝàTó‹_~ f\駋À×Y:{‚và+˜Þ^À9ýÈhéo.¾\ü«cÅsfÆ«¦¤éÔR}, Ä¢B퇡š%QàG!¹|º[x& æ«…§æÕnU7‡Âùó"Lq¨ŸÏwÜi°cÛýwAŠ(Ž×Øiæ[\x›sÖ¨yÁmÇ6áo%ÍV8þÔðí´)aÜbk‡s­Ì•r€vmy€N’oíkÿÌ“»z -–ÑÛ:/€WÙ–î•o`¡ŽàXx&x:※m±ñ òÖñü wÎñ¿gTT“Í¿­û“ƒ÷Øvz„¬‘G]ò¹mÝȶµåËOôk Ì=ÉÄâþ¶F9Å äãt¤¶†‹F&ž¿?´¨Òï, Ø‹;Žõ~'káË;ï -:°GÚXáû>¢Z¶àui©œRvpZóæð!: À`ú%7 â§0#púqwœðXp¢ähGm|xγ2Éñ~£§×@–h´ß6§‹ïó.€zŽ„¿ù$ô6(9ÖØÄél8ü­`ÑóXám¾B™®¹×Ç$0:‰€L˜ßº'ªi‹ï%tAMÞ fŸK»)çŠí„S«6ŽP‡BÈ ¦@Š$?/0Žì>‚ˆr$.cüÅB ¡ ÎÿÜE5òù¤ý÷pÌ(H)´ðûÆŠus´âÆ -ø¡Ûa'gУ'ã–œ!ßÞæ­980‹C@½ŽtŠ"óHæÁ#ïÀ›5¢£ã«'à@´ãÅ°£ƒ2x@þ´N|¥â‘ØWÕngWˆtüS¦ÁYuŸ7ÑiÓqD/˜ÎÙ ÅtŽö›2á~…„Æx^=ïÀ7¶:lÊB@4 {̆íCïŠc `˜0)²°b¥)¸}‡ÖZå!+š@CÃß!ï*¦Ù¦³Ø¡ýÒnz ‘û÷§P/Úa˜`¼l%ýîÐîíœ&B%øK¦¯n0$TrÈïPvßÝ ‚Ыñº{ÛrãHl‰K‘¶x_0 ´Ç - «>Z?OÜídÜу»é„ ¥n3|¹µÒZÛg¦Ïi³»¦›åÆ8Ö¢‹Ë”ää©CcÐÙ’$ƒ÷¸^âøeøO˜¸ü÷Íq =â­½»¡à/¹Õ±«L ±ÕZ¼À—\ò “óŸ¿|¡=?r†¢VóÏظy?áLT ü(ÖÓÞ0”Éÿ~€9€Óy}É8Ó ½¦§bßÄq`Uc>ŒU·œ6¯IHdÀ×ÜÚ®X3¶ƒ¼GhÈø°1––vø›ÏfÛƒZЇSàÔd˜è,tÐœ†§&‰ý KGðÔ<ýíÿ>t°k…–к¸Ž¶ºqYK2EæŸw8ô?à@íÌhOrÏw•Ì`'ìâpï%ÃÝUk[¯ik›oÿvJbTFOsÇBLó#3WXY8Ñ—Q C¾DÖ§¯Ð¦§ê, «‡½câ0³`äÀeh <;6TS Pÿ ’r˜ŠãDW),ºZÀB‘ê V'˜®”-%{,öé­`ƒOôûBL ‘›ÐÕÝÞO;k]V*€®çsÛ™+¥–›…ä®’SꆸQ~›5Uœ6’ß‚L8l‰ÚÕ­Ÿœº[ÿ–Ãr‡ él¶Ó»ÛAyb$“à»ÝË9?sŒäH:EýîóNq. ã@< jLnµ t¸¼¿9Lz£Xl0Ú‹ èWU]³wj9%!©ëqG -G.¼/J¡›™Ð{º(©Õk)ö¸„òfîå,9™Üè,ð{ õ4§ñ™Ð¼ÏÎí&èìp³)p6ØìÒ¶$êËÕþÁ™çå¶dGïK!Kl`ÚÍI1¤ÆOÍ bèhΈi^Ùݜ6›C¿Ùy1¬¤ÊÒH\}›Q\}W–S]ThÛ¼”¬x²ºKîGó£ -! +Ä]|å>š³é¡ÕZkÛÈs°‘ ³LœX/lÆV<(t­ÚqŠiÐH°½zx íìùq©€€w²–½×ïº*„bPj”“ÎÃáÈ ˆ ?Î^åª0RÉEk7Áù€š`î8m ƒ ËñEñ5zF¿}~`í=ŠŽ°(4²h‹1 u»“D¸úÍíº\HÅ 4 T6HF2Ø”’‰£Kað„5=®R‹¼™L8“8à³>hØZ@¨0@ 7ˆ|•†²8rEʉ3ÕdZ8 ³ÓÂ1üq‡½æû¬ó¾â8ÀÅ+R¼ÙÙ©k‚¨4XŽþs7õT!}8ý¸+|<´WçO2ȯ÷‚`L{Âtˆ(½JÃq IÆFÄD.`{WµL(¨‚;{ÒW÷ŪTÌY"…+©c[Â;3”Â`÷¹ dž8 ËÃŒàMÂlð9 ©¶R+ÁáÀZÀ€­kûà`"0DÈsT¤}“¼ü9Sûa2ý1Ós¬¼ž×qø0±òCX+4døÕý \ï^ýdYG…ÆÏ’?sÔ"–Ö& À'É ~é“lhQl¸EÔáá•»ðlÀ^t1“p”P%~œáˆòÓCÞuåJúöøžLsú,gÌàÅM–i&´éôý¥hàòj«f?TpÎÙè¨ÌÖëùòë¤CÕŠb?ƒgÛf‘(|QrnF±+zàÀOº:Þ‘OòÑ \éjX'ëغÊåQ$:bìÊŽî³Ou_¦Ñ:bz<¸Cè -¶vwG®¤^Ù‰½¼0Ï®ÍÈ/ Ó Œ[´œÜ JO¼)•ÿjÇU¡ƒ3¨ •r‚ì>}è8>†ü4é¼Àq=À$ -RVÈ;ÕüëzŽ¦¤2ˆ²Ý_*üuÓpD>ăøhÌdµ4˜‰dÿ¯¿®è3|í§§P}†~2i†™Ô:ÒCQº¿Â`¢Áÿ8üendstream +xÚµZ[oÛ8~ϯÈ TjHê:û°È¶sÉ ›f§)fyP,9ÑÖ¶<’œ4ûë÷ÜHѶì`±(ñrH~çB«Ëþ©Ë< #S\f¹ +Mž_.ÖÑåô|w¡„b.$sæw_}›¤—* +‹¨¸¼[Žó$aœ˜Ë»êSðæû«Û»o~œÍ1ÊÃÙ<ËòàÍ»«3|¸~sõ»âàª?^ßÜÍæ*¸¾ùŽé‘æãíí{ì›å&¸›ýv÷ÃÅ7wŽ-· °P O¿_|ú-º¬€ÿ.¢Ðùå3”£PA÷ú˜ +“ØH}uñáâ_n*î‹/yÔ”,Å\a¡“óbJU§Æ‰IC¯ +‹$ñÅ”DaÅ$&LÂ6(I¢àC= ÍæÄfÁÛ®yª»ž+ËvfTÐq¥þÒôCã,ém×lGûÜ \*ñ“oVH\oný¥ýñú”TãÇšÖElÙrR#½=Ä:Œ´-ÛL]ÕO^.ßEMl÷5þ­˜£e×®…†?‹US3÷¯„ùo¾àžVm³Áª—s©0QhjYA >7+==–8ú ÿÔØ’›–¿(®] +é[œ¬˜¨"ùñpi*û¾yØÔd6åT0ŽMð—q,-°D¹îPƒ%–S#²+–CÖP˜xS®…áFI\µ¢e²’«7ß½#qD{r臎µXË#J<â6a2¸–ûΩ6jÐ*2ƒ‹I‘f±G…DØÐbß³ûQF¬Z¿Ù’j$¹¯C& •Šr\ÍàT+œ5Í­Ba% ~jþSv3X«šÐ¯" «_¯>×A‡Ù0(sR&¬ÜÜ}¥£(úêç[VctÃÍòE5j‰â5©(”íiâ9n¹m×37¼.6ÁÑöR*i¢ÏÐÚ£ÑY¼Þ÷-.öŒ¬ýç¥c ‡!+ÆQü»½ÇLJR§6¾8·—üyš% ʸ▊”Ú)06-[)ø+l;Þ„U~ì'%¾M»¿Šè +p[64ÅÝvÏX.;YºÝX‘} ØœÇÁ/hŠÚ÷®‘v×Z[C½Æq[¹2Ea7ŽÅ§¦~–FÙ–no‘C[»e]î†á iûØ»?zû4{ËtÏÍ;¹ú‚eÜõáù•<ÎÎZs¡òq£@Ü ¸ì°b©|Õðöÿ~k/ «UžŒ¼æx-ÕÊÝ?ÜWž0¢b0Úé»×¼0ÉøØ0Ý @ˆÕ<"þlÛå0ùú·;ì{li,ÿ­X9Q6÷t½h†%žƒD†_]ôEöì  }‘©Ú½ÝKƒŒpUNÚ#03ªÐÊ}d^ã¾ +@xQã9 ÞgäISgÅhGA-,J#A³h7LAYq+‹dE„‹aÊŠFE˜¥‰ceÎ «)º3a8±pT¡dŽw +×-;awgÙG÷"Þã_~¦XÌ„f£ƒ‹µ½[`ŦvŒvŸX>l:¾r1ƒqkÇóç÷]½«¹øìŒÛl…†RÖ^aå„M…²€ÌÕÍÆEÿôÝ»søMláU³ c‡Ìjà¦FP¿”oÝu´O(®i™¾/Ñj¢‘ø5J¢Ñð£Õ/V·.­¡©; +ôj†ØéÛŽœ˜|[?5 º^Æšqf ´Ø^œ˜°›œQÇA•ˆ”!vE>Ò‹3B,›yRD£Ãà ôe »Ã…2ƒdnZ’˜i~T< +ˆÔ1dÃÀFvàø&½u§\­êŠ€#û‚Çÿ2åöl=Ô¢»î4؈fû¨ÓáÌ Ÿ×‰³¿gåJÕô[_f9~qð¶åþÑBÐTb! +ÒT8ï¡uÊcwF&{e=Q˜CYC߆!÷ïNÕ¾wq½&/#n@í„E¾ž€ˆ¤R ¤¼%‹ýj@ɤ¬C^"ÃX‡&)dô/³ä<…½*ƒPǺ{AÜJ‚ëMÏ°R²U9ÞH$ɨ32Å„ŽÉýgº›vzý4³lRðÛÃ3gtG¬êD‰±§jè8ÚXŒ¢7«îdÍY³ñ¬±¼E>G¬8•ÁÊÀC,i{%± (­ŠÌAìB±g2z€\àý@ŽûÿH‘Ä)²ç/à¶À-øv.¹ÈHhQïV’ˆÒd®3S-! ¢¹ú t+™ÏC¥õGׇ®V"ð£ÿÈ°Wg×Ë•sæs?Ö³Ð*§EWÏJÊbl€ YX!œv5<Ž !<èÇ`G “ ô= +ôcåkf¤Bp†ÝD¸GÊìp=¥a·ãÜ‚–æhÅý» ÀRzoEÖÌ5‚øüxXQrtœÐ³ìØWÁšXW€˜¯ÝÎw[îñ’Ü€i ü6pû ʹêûVæ4,œŠSæÚ^øk·X5G#ŠYTV£\4ÆQ[Ó\᩹õá²ær½Þ/S>˜Š‹0Í-˜½ïNi†ÎÃÜœÏz4g4CˆþP3Î,8jÆÁŠÓšá­¸CÕ0Yd/Î1úš<Œ´èK§÷ŒžM¾…áÌãÞr™ÜÂû=:UÀ¾´I%ò‚¯¨ WJæÄypÏ\ŸôSüPs=°™šò7^"}Z•¿äbº; b«;q:aÆYY‚r¥T˜§ñ>\ypsuû“xt¡Í[…:è7Qå|ßoÈÚ +©1BÇ2L€q‘ dÓ ì ©Tn¡²î Ÿ…sçvôZÿS Ò})Ý¥Ç)zÎ=A©ì-#Ò`ƒz,~RvcDz\7«¦ìxZ1hŠ|¹cLÿ‰ü Ê“&Îé¤85Âuñßwk©³µÂÒðXRàYb`¹‰å×îÊ3_@|¡`çL‡>ÙLQ³ÕRXehÚla+0yt ž8öj)e• "N²€óúNq¨íŸågakýN¶Š‘AÇ’&Ñm,¶ÿv¹F–h¤¾M)kKŒ@Ž}¥Ð–üq ÃZVr€Š'S"¤‰P +|SºÀÁSã\ö +!Ó”4¢Aë‘&rAÁ8µÈÈ=%2C`E8“jÖà~Ź5ýzf ‚vS®jN§±pÆ0„rÄìOm¸4'‘ÒdLåò)aØÁëµp:ê$Tœz /kOäÐ.=kÉ~ÈÝ ôäE¨õ¾É šÈsã=ÿ“ÜžëÈêKÏ!ÐÕ¿ˆ{¾&û ž™ï±mÅËïšÌIÁ(T_ìþ’§¯¹äÅFÊeWÕˆêäqáËÈè3¨€°GÛ´Èpa×âcÎ%åq˜ Š¼ìËPÞ³c“…Y¾Ÿ&‡Å˜=$? +[1¦ðëMê  û^-v/Ú \èÁ=œ¤©`,–ðDè[­ù­ˆ­–œ¯? ^)Šy€Z F;ÔðüJÓîlìjÇ `_(*.Þ#É —­¨°|àëA1‰·@— ›qºbd„}_g€n?4Ï!ðXõ-—¼4߯¤4H÷zÌb6Ëž Ôš3'‰LË6‡Ú î&õ<Ì¢s&0(WØöæÔÊM5yU½,mN)E¯$¹cŸ|äi¯çÆ]ou%6^z +žÆÍ3À¡o)<êxb—îG½E½¼ÚûEs¡ÔÇ,ð…`<ç8Ë^¦Íìzçãë©ì~µ·ÞžϨJ&mIÖ’,Š½cP¯Ø@†'> endobj -5145 0 obj << -/D [5143 0 R /XYZ 85.039 781.388 null] +5262 0 obj << +/D [5260 0 R /XYZ 85.039 781.388 null] >> endobj -1370 0 obj << -/D [5143 0 R /XYZ 85.039 665.44 null] +1218 0 obj << +/D [5260 0 R /XYZ 85.039 761.463 null] >> endobj -5146 0 obj << -/D [5143 0 R /XYZ 85.039 646.568 null] +5263 0 obj << +/D [5260 0 R /XYZ 85.039 741.134 null] >> endobj -1374 0 obj << -/D [5143 0 R /XYZ 85.039 490.045 null] +1222 0 obj << +/D [5260 0 R /XYZ 85.039 232.324 null] >> endobj -5147 0 obj << -/D [5143 0 R /XYZ 85.039 466.063 null] +5264 0 obj << +/D [5260 0 R /XYZ 85.039 197.578 null] >> endobj -5142 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R /F66 3242 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R >> -/XObject << /Im1 3957 0 R >> +5265 0 obj << +/D [5260 0 R /XYZ 85.039 154.145 null] +>> endobj +5266 0 obj << +/D [5260 0 R /XYZ 85.039 127.046 null] +>> endobj +5267 0 obj << +/D [5260 0 R /XYZ 85.039 85.793 null] +>> endobj +5259 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5150 0 obj << -/Length 3834 -/Filter /FlateDecode ->> -stream -xÚ¥]oÛFòÝ¿Â(D É%)²÷$i›º8§¾XF -´} EZbM‘*IÅqïÏß|ír%Qr‡ ÖîììÎîì|/ýKþù—Iäz*½œ'¾«’är¹¹ð.W0òáÂŒ™ Ì,œw‹‹×?Äá¥ï¹©—^.†u"7ŒÔå"ÿÕyÿãÛ›Å÷Ÿ¦3¥”ã§ît6Ÿ'Îû»›©ïÜ2ôæÓÕÇÅÕÇØ è;w78üó§i¢œ#]}†ß^¿{Ë=åzÓß?]|¿0;5{€]¥¸Í?/~ýÝ»ÌáH?]x®J“Ë'h{®Û ا…JúÕÅíÅ¿ÍR<^ò¬1®D*q£D³%Š-¶ørƒÀ¿œGžy!ñå]¶œªÀy\µÍ®Îñ¯ð#kR +G!.Þݳ‚ÄsîágîÓ™ï”5ðb…`ßÉøgÓ´·:BYîÚúi8Ï3„dØ|Â?™FݶSZ `½½f÷ÜጾØp¿_g5o¢ÇY^ö¸xSg!ÈÃÌG¶¥´ñ¦.`‘Ð œQqº£!uÓcÇ3©óÌí¼xÈví™úYU5¼eš“1t´¹¢e@ßð/¡Ðó`±ª´F»î ^é7/ò¶4ÖФ0}§’mÜãÉê¬}†Àô‡3d}fH⩽½óîñ—^ª@ÑLÚÃ_Ò.;P†0ôźìkÙÐÑsìtÕ Î¡"£]–²Ge¸á_´Lé™É8ZeȤz9…®y4ãŸÉwE]ÂQ§yàßÛ¢ý‚‹óÖ&B¡ïALaöQ#¹Ydž‚{ƒñiµ Ø’È1 Û‘Ûtb¦ï¼Â³ÅÎ2ÛuFäæ!ä5ú5ó a•}l¨é:ná1p4㟪l ßf|×…l2CÁQÄ›BgrW?ÖÄB–8<†ïLFî9ÏÕÈÐ(fMRQäôÙje®úZ°i0y0'"÷ÌDˆ6D‰Ê__úõ÷€ö²ÇEQ·ÓNÿítxã™T±HE(›eS¿n°¹ì š4CMéù¢‡h›{㣛ÇBøƒ;%vô²k£‹ÈÉœ•„ÇGéwHÃÔYáoäqa±uÁm[SŠýBªœwÏèr×±rPIp“n4d¹Ç¡©…z”²)Û¦Û›Ï .~},"!“ñ«‰¯ ½gJ²nºž[72gõºÅÇó~&Îäfû£,µ”âq«Oᨠ†Y('|ñÏ´é„öÀiÚ¦Dœ ¿É Išðç›ú@¼±r tA²”´¡`PVá±e®÷Á -ƒXñåÄh%ƒMÙQƒêðÃa”kÄ’¡”‚øãϸ¹Ï‹Ÿyì=œÊ¸dmeÝã`e±.(CýAÇ°óTbÄ µð2þ1©f·ÔêPnQ2X:cŽ«p~[<­‰\—†[¾°BLE[<ÛOŒKùúȧöŽB“ÖÑ2²î/ŒåT–1hµÛ©µÛ£¡B[뇃ì•ç}{hµåÄbN£&XãÌ,$¶Áá^'qc0Ð ÷ W0?¢¨B×Wç 2Ê1½=›¯R7J¢=z6>Ü]‰ûŸ¼Ís©¥˜„Sðöù{är>Ë?Á¥‰.9í(¯¤\˜3ɇûŽB7›} Ñ*ˆMØ®tüßl¶:GÂqt(Lõ `¬û0ùîãÕ/ {q"ÔÖÔK³¹e¿ª3§j Jùnùgl ÇÔBW{´lHiÝX¥ºÆ¢A Sç®3¯9ès¹.ÛÜKƒŠ5÷Ù»~‘Ž|ÆÕ"žðþ¡U©<_Ð5cŸŸê!Dž»©âðo;U¶“ìM=•ýš[7H’½Ûe‹‘?Á¾k5¾©o|gŠüÔAÁA–Ÿàp -•úç«8ÎéD®ŠØuÞ²ö¢7I"H42S>WIìPfôf:‹=ßùÐpÂÌNËE çü‹u°¾éx -¾8àRåP=€Þ¾×I0ÿfEÅÁAE9#rŸÑ’òPÃl«¢›˜üÞô5Aí±“œ–Ἀ|‰;“|gWí& µõc´¨ñʪä`úŽ“ÊŽ ^ºÓ9‘N€êÓºÔf‹§*ÓÜTF²¼x¯ðÿžø^æ™' ¡\iNr½Wîò˜ ¶‹¶ÏÊŽ1§'r‘Ù6;“n‹9ÖÏH@ÀU‚ÎTDï©p¬¬$:ª *½*y9VúÁe ¯qö"DáZ53þ‘š®Ò%£g¥Ëpâ“”C/E1~Ëàëc„*JY×Ðc,´l´3¨r^K¿Ÿ - (鹤ÊO¸ñ Éï€s:tœ"‡sÔ$p8$67XÄ®™—æ1¿G mí#ä-Ÿ8~5’oþ¥'þb‚Ç×ýÒ‡˜ét}¹¤Å¾Å=XðAuÜÈ+7Á)zȹ½Ö¦ñFž =ÛlUt`æRV®Æ)a ê¸Cqv˜Ì퇔6[ ЊˆXßÆ­H¯jûNÊÄ÷AŸç´Î pŽšÜÿ!±±ë·ˆÝ~`Ù'ì¬÷´/ÐÜùª=XYÔKÊ”q¨røÙgù“/„LÞ™WcY 22~¥®» •|2Y´UYgƒè¦¹Ä HöCó–#•1Ou2l}‚¦‚Ñ8…‚ìý7E’\™¾o¨íÏć⤠MØp·uQ‰áûQLÞœJÐ=7-%Á>Âÿõ©®IACå&êD=* -7ðõ^8ÃO÷«?é=Úðz³5endstream +5270 0 obj << +/Length 3551 +/Filter /FlateDecode +>> +stream +xÚ­koÛFò»…ÐÃ!Rm¸\>s¸R»i\ä\_¬Ô=¤AÁˆ´D˜"U’Šãûõ7¯åâ}m¯ îcvfvgv^+=s௞E¾rL< #­LÍÖ»g¶™ïN´@,d9€ùfuòâµÌ´£b'ž­nz<¾ò|3[¥æ§o^]®¾}·Xcæ:R‹eFóÓ·¯®z~u~úê-NyóKè¾;¿X-–z~~ñÃ#ÌûËËpn™ùjñqõýÉ·«Ž­Ž °#O¿ž|øèÌRàÿûG™8šÝAÛQ¦w'À”ò=#ýâäêä_*žóf¼jê,ÄÒ8*Š¼§Éw”ïxÝ1ipLq¤LhfÉS·¦@E~4`:¢faž&§µ«ŒvGôêœiYÂy¹AÒ/^î`ç¨À„@…€÷ =_£lÖEŽŸ¬\wÞòÊ5_+/veeÂrlh ­¯fÊÃm¾ËXúwy»•±-Ìgá.BP[º‘§\Í’u¢ ¯‘7ïØ+ +foD«`ùŒÔSH‰i@ÛB#É‹Lv¸ÍË…ÏÛ†ÁnªšÇ³d8dÏÕÍh¼MKÝ=Œ +@È°0´¨Ò.ûÒò丮“:Ù çÉ~˨ô\=v—_ý´v÷0¤n®sl‚0RŽ¸÷¡®Ò`|/žŸ§YÙæ7÷¨}K°Ÿ¥l:gØ©óÏWÎ_簸ȚGXB_ÅÆ}’åÌñ ±x<Ã#Àò +íMä£hþ³£=«¶Ð­-7Ô'ì/Pð4ÔÒ¢˜4v°€yÚ… ÁMÀÞž/–ž£ç÷ ^NÓÛ{¼‚q´Ø¾CEFª=Š=¯Êæ%£ï¬«CÑs‰šgÑÍq“´ùœžžÑ½pÀ Éã¹Ûæk"¥ ì-ÊH/ÃîO€•èÎ0;mVƒ€!%ÓÞö=C1?€ékEàt'|94©dÉãÌOqðì9wp‹7ÒlåÛ ùe.„+³TxYms{ÁÂù.Á¦PêU;qlI2£ÛÝ[lïi¢¢oòO…½‰(qÁP¹žXÕïÕ÷L +Ï“»|³%+³¬twvˆ;oí6xÑü=òŒ†ÏÛ Û‚Ž”Z8ó‡gqÏxXü%Ê£ª¦‹ü%lêz‚eÅJy|$M›Ô-> ¤+þ¬¹Éd|›å57Qɼ´€dA‹"iAÍqÎý©ØxÑfÈiµÍÈJjw¸8ÁmÊb©vÉ|²Á½]øÁ<Ù°eÊI-¬U7m&Ü4ÕnÀ3aæØvuçuML­{¸“CÜ37tª;Hj¾Eyª.Êk—´$™˜Ø-ôHцnBç D5°trt盬åF-ù¶à¹Ñ’”'ÃC-Žÿ"º@%HÒ +àx¿âQ×ÌŠ¸“¥çyx•ö9ÌÚ­µ?ä»Ä=e_Ú:ã.îy¹Êa‡ÅdÇZ^DšyçcÙ¥‚ó{Mòô±Þ–ÁPw™„‰ÞdÂÚ2Ë$€Mº¡rb±þ[T¼&¸§C^eœ‘ëÑ›l’–¸eºëõTe*«÷¢–`¼mÆj[0L' }d˜q7S7-ã¯JL¸;¥€0 [ÆVû_U!]0 _OÈ9!¶Mü¤#ñ<~aÁ!Ç3žçŒì—7ÒÁ†74èf¶[FýÀï¡É^šÜ´Vê5Ïõ1Ò=³G÷a{Õ%Ã({ß¹¨ÚÎcœ±M„Š•ìñÖQ+@?•ò•Úeóž!'nH㡃›©‡7£»jpøh3«2š0ßó(I¤ÈjNBé=[56ë;ÆÖ+2Üa'.aÖCV04Ã{qMu‹1Xô. c+MEç¸éLú­øˆ _jøn{Añ†aŒ7¹6Ø0ókãþ<828i¯;){”?@¯$õÁÖ¡±¶ 1|ˇíæëºjÀˆs·#MW ×yy±záÞ¾øér¸)ŸöÔß±fðOúè‘qˆökÒ†ï õ9ðÙèeí–§RQ¹Š'kÉ€6”výG< +å¢k§5 +`¨ ´øÈúÓ2‰[°“7CjkcÞÝü@B&‘{ÌÃ{ò‡8~C¦}g‘[††fèYÃYÖ(â«Çe]q¾˜Õmž5SY™¯¼HKVv–“Ï®6,q¼²$L¬ÜXV|‡¶ÑÃÂcä$Æ‚¶¢c<åcÞ¸žv›yÁ‚«n¹K7:xà¥È¥ ¾Cÿ"Â1±ÛGö¸ +•5•eå1Òa4Ì™ƒ$¡Ú*Ö££ü7%!ôŒ8X¶MØ"A{~o›Ö Y¨fÁäy©–;×tµÇÂóéÈÉoñZÀݧ„ôŸ†ÄÈzC¯Áñ2²Í¦$‚prMq**6¹2H;^Û‘"›R‘HŽMÜÑt‡î¨40"åFJ‡VägIËAªçÆÊÑfxÕ_çEg\( U¤ãž¨qôD=¶BrZ•¨¨Ã®±éêÔ¶€‹c +¢·ÕŽ7]¿·Ûƒª «’ŸuIA}§ ?@|÷r+pÖ³AË1X¨Š{°Ö‡2ªµÌÏ™MÖûÝO]|'Y¥@¦:Š|ìl$ëÂù¼€ü6a÷H¢4‰{¢‚R#¸I…¸QˆöÙ¥pè~M1VÊþJ²‹•Ø°7Œ:]åaÑ*ó½àüK(°{ÁÅ çÂZN[æ»D° cB/á±`âÅœrKç†{b_Š!ŽžÌÆ5#)ôP…¦È[f",Ê˃ù;ª¸b–%.|©hrÌe«8¶L2ÝÃ.ELuΩ›j»v jJ‡žZˆ+[Þ7XTÍŸ¨¦zÊéììD5•2Ö€¥Ò8cJ!„ áÁ†VìwÐ1o&ƒ› U æp¨çÅ ŠFÕÄ úç%ê±ákâÂùÓÝ) +¶ä´pšë¥]Uììùw`+œÎ®Þ¿û懇eH7 TР¢*rÃÿýa€N¾B,-®å?´D#ç(ôÓ!kÖ>´¸èGíÑ’ºëAm¾Ø‡®Ÿ}h?qìò”¿hårÖi^fѯ“F–£žã—³“FŠí Ã@‡ãd“5çºË_)½àØÆakô…в+ms٨ʤàù"A9¶Õþ9׈¾Y]‹­ÇÙsN—)"Jy(· #w9æÕÓA8â—ìŽ<(¯¨ø‹z€GºîäéÍŒp(Œ~‹n¸áô ÕÒâZ³}×Uqv{Ý@ó÷ÈD뺃`b¬f1(ª(Ïmš-?å-$û)Ó*¹=óô °¤ld +“T7Ózô–õ Žøð…g·W;Ø­×”œ@gP‹Æî9'v–Jæõ-©hó]cic¥<å5è«¥¬/'Î` +ŽttdyÙ‚ôÑʵøLÙUW^ü‡ÞÏzn÷Ì5Pu +Þþ†ˆu"ÌcÜÀãÍfÏRîmäŠ:“ûÑ`¢¡ ô‘3ü‚z +éÜØŸ¿àµf¸Ö‹T[…øÇd€§Lhqïm:É敘ê]~Ç;å7…Œ°ÛÜ۠ɵi+6xœ¥}»s•ñáÇF_dƒ—3;Ïå(7—AŽ$v{¬…xAdë–žTs¢È¨”€E(‹ˆ»Iûp Äù%«×Öuõn$Z1@ai6Iù¿¦´f¨²K͸ϲåUƒJúÔs­?û—¾-íÚ‘M×[¹1f¾\sý”Jvµ„q£ˆÖ¸]±΃ ¹­¬¶ÁäO6E6xÆqL½feÙ%ƒ7â‚ŸjK™2ì‹­%'~Ì9ª?Ûï°<< sç¾ÔëhvY݃Ž Ÿ2°Ÿßÿ6ºÍ>Y[¢yÙgm€¿€ÍdÙij(‰¿N›—b0ýqeÌ3ôK +º—UÕþe±ô]®èšJŽ-w—ïŸ%åmò×/ð癌­ùû³6ÑÕìc‡ÄŸIÈŽyÂ~õ&ËÓ¬ø”Õ8Ë7ù.iZ kíZß.¯0<úŠŒÐ¥÷1L]ïR†ü;þL&Þb>`TXaô‰ø !ü~‰‚Ò¸¬Ù73áWçåM%4^òijå¿.þ´¼ìK†ûàNâ¼+hÿȦ§ð¿ª×Û¼ÍÖí¡îpÿžòw I´Åqúõèúüâb…«{`mg\l7ûª*°qöîüÇoß] Õé±E oÎ.ίýKš©³·o?×ÏÏ’6¹É‹ìO"—¦»X¯‰Þ~Ÿ~|äwÆÁ¢ðį>àŸÈÿõ‹°î·#p…#?m»ÚòB?v‰££$ÀDÊÌ1Ãÿ²Š¢=endstream endobj -5149 0 obj << +5269 0 obj << /Type /Page -/Contents 5150 0 R -/Resources 5148 0 R +/Contents 5270 0 R +/Resources 5268 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5154 0 R ->> endobj -5151 0 obj << -/D [5149 0 R /XYZ 85.039 781.388 null] +/Parent 5240 0 R >> endobj -1378 0 obj << -/D [5149 0 R /XYZ 85.039 570.527 null] +5271 0 obj << +/D [5269 0 R /XYZ 85.039 781.388 null] >> endobj -5152 0 obj << -/D [5149 0 R /XYZ 85.039 549.331 null] +5272 0 obj << +/D [5269 0 R /XYZ 85.039 761.463 null] >> endobj -1382 0 obj << -/D [5149 0 R /XYZ 85.039 331.451 null] +1226 0 obj << +/D [5269 0 R /XYZ 85.039 703.031 null] >> endobj -5153 0 obj << -/D [5149 0 R /XYZ 85.039 284.114 null] +5273 0 obj << +/D [5269 0 R /XYZ 85.039 668.887 null] >> endobj -5148 0 obj << -/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F14 2895 0 R >> +5268 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F58 3360 0 R /F38 2997 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5158 0 obj << -/Length 3814 -/Filter /FlateDecode ->> -stream -xÚ¥ZëoÛ8ÿž¿Âè—“X+ê­=mÓf³è#·IÑ+v÷cÉŽ¶²äJrÓÜýó7/RR-ç€[©ø‡äpæ7C«…ÿÔ"\/ÈIªÜ MëÝ™·ØBÏ噊•¬F4/nÏ~x‡ å¹™—-n7ŸÈ £`q›ÿæ¼üùùõí«_—« •¹ËU’¤ÎË×KåÜpëõ¯Wïn¯Þ]b-„Få|¸Æî÷¿.ÓÀ¹e¢«wC÷ó·/žs-p½å·¿œ½ºµ’Z@ª ÅüröÛÞ"‡%ýræ¹A–. ì¹ -ºwg §…Ô«³›³ZVÜ.xÔÜ®DAêFip¼-*m‹ò×÷Õ"‰<7òBÚ—Ûû¢[®”SÀB¢ÔÙ6ºê°˜9k]װȦ瞻åÊO ™^/ýŇî²ÀÑ_—Ø—J¨< -!Z Ô8äë{l(k$öñÁfæE58¥H¥°õ°ÿ0?àÈ*Ÿ°ŸÌ]»‚j}‰kÙâ!-V²#+…ÛšÑ6ô¸¢D^A7jøB3¶ÅŽj,swD Ô#Ö$ø[Uá¸ÀùÝS!ÔÛ®çz]о@©oø[º­±è;šw•8ý}ƒ<¸úyÔ¸{ -õ¹ã>] _}Z¡p­Þd•p¤¬Å²8”»ªà¦²ïX—7…îQž–·Ã%>ã-‹ˆ×GœV£Ð©çlP„ªb):n+åÛß\X7»½nK %kh2§Ùð·kvF…ã%ÌõxãqÎÊ°«×Ô³ÇÍ“É6MËÜ>â‘wì”|¨qÀ7Tšp¢ž¬8‡Ž8ĵÔLB«‹BYÊ•"ÞŒ–[5r«]k£©å¾ÇáG»@ü–r£‘u‚Ô« -Wju½¬·ÜÕ=vܺ;ç«ktèXÊžOût¤ý,g®i§¹kPÀ`Ð%¨øÉnT¨g*sÝôg£Fî KÇ‘ šü¤UÑùò¡W¹ª˜/å»ò1™CÖB°ä¡ ²+4‘ç\^ 0WxZ1ïmœ ºx¬ Ðö&¹^xyðdpooÖ-–‘~ß3¡a -òíÔÊ"EvõÉ• 43†Ù¬,ða±ŠVö®èÙ`òAÙœbb{ÄÚߦíÁò†¿V£ L7¬!Ó5¼U¹Ö=Y(h°jS±šµ¤Ë+š·©…K®É¯úf%E™ o'ÝmЫ‘îñQéÚªÄ9tÖH«„o zÒ-¨ë|G«+»¾Õ}#T$¼1±VŒ“Œ(o½" a“£ ‚Ì·o²+PÙ˜4qhy/÷Šh]*Ýó¥ÞÑê„ës1'Þ OÒŠeÕ\¹Ý5µ±¶ÆXà•1Í­ðýDNnbèEö&‚ßé±%f¾ßöàN`_¨[:ÌXŽkÆ¢XMh”l2šS$A—…ß?ÆjËXZek,Ö½³cÙBÀ¾"ç¼cBÜÐu8”ô=e¡‡ àø}0{[¸!T°ñès<8Ë[¤΂ >XÕÚ´(ŽÇUâ÷ŽwÉ4·‰;¯ -®N6‰›ÀáÌŒ<Ú®Dƒí%}ƒ«úÞf5É -ç~ÓÜUÃnÎXñîG˜úè}H¹"_R@Ëk¸‰¯Ång½md‘/: Óò€Âøx¸…ô¤°d;Ò¬hvfM'Skºâ¾h(¬ug£×ý¡Ÿ†3½Dl*Æf®@ÝEA_Ü\Ã4 @{_‚€Àâ€xlW½Ìõ|ÕÄõš4.öZü/˜Xâ(t£Ì—¿{‘×tÍ ^á/–ç¾@Ô0x[Ÿ£§o+ÃxuŽ6¦e*‡* ß*ˆæßú‚{>³ˆ•Š7)ÇpýòÍŒô~â†apZzL»ˆž…ƒèPþùZä%=è4¶€Ñ/lçÜìy‘ÂIN«aâŽg,W (O¼6>¡v?ëzÞÝæÝ3Ü• 2²Ðõ—…ŒW<ºFÆóùˆÈðô .ïc¢ü N™Õ#—ÅÝä\CTuñ¦ãA¸Msª‡®1o·Þâ°Î‹¢3êÃ7ÚÞ,#Ôõí¨º™cQÄ]i2œ $æú¢ÚX((Ë*0ΩXb{›2»CYâFšlÑNîš|¾›ä[r6™óp–!HgmC®Š CÙrјsvªÏx ©‘µ£xŠ-w{³ $@sÿÈìì‰aayj„ÚMø‘‘J•k¶Š´m8vëf,àÆøLë˜ãm¹qj?VbG}Äæ æ½Æí¹1€ÂX Ƶ†ÙÇbâ¹èbSXÕ¯Ù0):åSH¶=…G4§‘p§ ¤ñ û‚„ç@ïE[~e8gì{‰²^Væhh^½}}Jì8v³4|Zìæ4Ì ÃÄæ^¡_J£“KÅk£°sî—(2ýÞcßZœá8þ7ŠÑÈŠiF.…â,¹…¶é(w‘ˆ‰f@ Ñä¤$3³Â)ÄhÞËÜoof”øhÍ^è¼GØé -W^V+ŒQB£LŒßy‰8ŠÀöջÝÄÑzß[tâÔó—M(`‘—[ö¦Óf&¦»Ã¼¬|%føxMϯ¯ðÄ2%'–ù“]qË S›DnìGb/Û%"‹ý=ƒH<†5-¾rCÁõ«®"€ -nš1¹èA‚xjr•êŽ…Úë¶g©Xó¡°'Ì6¨b*Ž¡Fk¡ã†²ï¬'Üœ[À˦٠\/žšæ;MF-#EÞ™<´§c’qa .Qâh’=]oZaÄ]é`9ŠKd‰‰‰×‹IK NR)ÈÖšÁ,v¶-Q9®HPˆ,Ùµ# Ž%F%´¦1QœüO–ORа/ÇÈ°ò _ç^xŠu -p*t*´¢ƒ¹žºÝòÓÔ ãzÙĺpв‚´§žQŸp£2Î_‹p§+Òè¹)alš¥ÃŒ¤`Lš=)8ý wÍ¥®òÚûÇØ -±ƒY…¾9ܶ`KA">Ð~͘*n6[Ï=U³€–˜äH©C¤? ÊˬhþPèWTÕÊN!*WåÉ -ǛŠžD’ÝÛÌèÉbï‘H ë`Í•œ6JB2n"MÝzÎ -D `õ£$¶É©ùÇOˆ®>~ºä:îÿ³!ç -6 ÇÊ *YÖ«9Ð2 ÷Õh¸ï9—>ÃCåºÝp¶öfTºŸž^ÉGæ%0ìYâò'QçZüEB¶c>:¼äº-$‹B³Â­ÝS8µf2Ö£ÁWýhúN&Ò"èÃD°jfùH 6Ùž–)aµ2xPKL!_Y[aA)´†ä£˜¼9/²ña¬0Ÿ%G€£7-V±D† ßÄÈ®³¹£–)> ~Û+y óˆˆfäÜö‘QÀî˜Ö„yX+Í£>vJCBFr ”¹¡X›ËkpûjAùÕ[ zm†ÌºT?ðÝ$2‘à«šr!ºw‘ÁýÈANE¯±û5Ås¾4ó]£Õ‰c²:Fž×œ•*;1v~èfÉ4|c¯@[!»0ø¬ p¥Á -ãË!¥'x?§¶é3æØF l mR¦7Ó:9…1y¤ÝÈ®ÉY®yˆM‡ØìœÒÔ7X×O!xgÿô`en”ų€¨^¸—Éé‡Då.ò)Ÿ•‘j¥Ïõ $58=ñ'áàó d¢H±R¿kØ Üš.UÈØBä¹ø²P®fYÀ4£2-`X5üpµS‹‹$]L„e¾«c*Ò1Ò‹ â“…FnÄ¡Ðí2 )¨ÄC™}K€¯Dò´$ÈšJù¾½á/ ›|ô®&ö˜:'h~ÿLÖÛ¡oìÛXçÞŽAÙ90Rƒ&A0Ù8ä%o‘8ŽKšb/I -lzeò$Û²6Vs¢—\žÌ˜`ðÀâJôÌÌ^V¬\_¼žaçGnênyàFËc 2Ÿ) -‡}U% PVš%“]Á ¯ÒœN"CÆÏLx@”â<2ga¢Ü$Ù¿`†ÐÖ)Éþ¢áÿ·˜+ôÑÙøžû?^U'gOçTT¹q2I©’RÞˆãĹ Þ[_è÷eS-Zó”XšwC›X¹ü ©–º+×݉$‹Lÿä2,Éé‹Ù½$R,ÉXüÄÜ/(¼áxâðíœÎÍ“B"4QöI!±‹ÀZ«ï­`O%/sr{æ·½p³b¬Y»œÈÕ‡¶Ï<Ø>ÐTh:ÁÄÐß´fl1sÓÁp„pH4†­gAø -ÚHÝMÜù(Ù9îbÒ -P@ì—áÝž@ŒG&•„‹MTjû€½¸Ya4²Ù šº+)ˉDPµüfS n¢Ü9|’kº×¥ž~Á I·@‘M XCÛsÒµÇ4¸Di:Ê’ãP ’S ˜óÁ'p~þ^öMˈm9MX@w¥øË–NŠ£_s$É÷ÀûøðlæÁ<ÚÆ ®Œ®fV¡‚ñ3«(’—ÉK«—™L87°wIG®>ëÂn‡""ªŽGSÖÇKœ/]ÑAY^Ù„z˜:7iDèý3©{ÜFJq»sI2¼|øH9üª‡uáGô‹¡¹ƒ¡ÊL¢‹š ï)Ç¿-¸–#4 Švú.x´™«n¸qœ º(M?Ü ™W,cßrÍ“‰b¼ú@y¼ÚNUðÁ¾äìÏzè¡»ð -ù©Ç0¢3vflXÌ#(ÁüÙÐè®ûô¨&öw,È’q2 'ò»Q©È™Â°ž„¤”k‰M^GáÃã§Ëv<ð\?›3ãðÇ[ó—~8$Ü7 ²ygù¹)# …ïýNÑütðHàÿrýRendstream +5276 0 obj << +/Length 2645 +/Filter /FlateDecode +>> +stream +xÚÅkoÛ8ò{~…°2P3¢HYÒ~Yä’vãmâæ÷ÒC[,K¶…Ê’+ÉIóïw¤,×jQ ×}hH‡óâkÙj"äéÓÑ»î þÿ:r…ŠÂÁÀ®°¼>¦„¯•çG7GÿiIñšð®>ø*~¨u üŽ¢±Ð‘¾+|W³Êb‘-Yžþ>ùžï¼;ûý½Túv2θy¬›t­<„ëMY朿žü÷ùëBTÞÛpŒ¡\œO'7®|ów’ŠóË˨`q$Q‚ˆŽ¼HóÍÏ9ðâòº=Ð „ñçé&-’´hðÔúÿtl’¬#9—ßóg;™N~õ±/¯®²â©äMâæ)Žq¬ÿk„MO!ìªJŸâØû"yióÍûw•.÷BÕOö*§ÛÏ"Éó_&/ŸŠZžÎ^ìGåN½*‹¬)«"^·™ Ÿ¹E¼Í¸üqó¸ÙG=y!»ém$%äv0ÒJŒU@Ûÿ‡¹¹ÜBΖ‘³Ž‡^è<ÂÀs2wÙdóÓú3œóœf“qÃ4Èj$îq?m¨˜"á”OÛ FMÊ£˜?w¸miO„Ý[˜X½V@{ÄÊ å¹¡¼Ð*A+¬ Äß¾ë€Ípv{ïJ –ëQI=öÍæ÷®ïN˜•ÀEQ"?<ñ€pYÕD‘§æqM§ÝÁHù‘¡@égeHX­°~*8HB5å¾sš×%*7 º©bTú’Ps€Ñ8´€¶Ó饎 Š²ÂW¸•|Ÿ¨¥ï¼ÈNÚ#¹ž66ɈAà¬Ò*e¨‰—ÌF‚ã1Úððp¬àÂo~=Tì-ü ‡ƒPž4Û…°Õ(¥\¡ÐÒ<7ó-¼`:¡lë*>)Q“¿5ȈrVä×Ö9µÔ Y„Í2ýn³!Ÿ++³°(+ÈÕÍVÂ.Gó8ÏÓ„—!h—Wc¼säne½ÆͶÚÈ5¢ÒÄhÜ(šÄ‡¾3³ ±9^·£í¼Ámmm„\Ü ½; Wñ„©¬Ë^_±pXá”v[b.òO¢ðäê9¯oǸA|¼šèñÀ¨+g²` ëàH,~ ¼4<Ó”ŒUo»úíž Û(cIr…Å@]Óž’P¦¢ æ–VÚ#ú<:ì U0MA¢åç"4­Å š'k²ÒL0F‚² +ÚªP8àó$FdXqÔ^äÇ´ÊLNgçºîÉÛkžçYJ±©1^&Ã’W‘_S<…Ï-òY ·%jñ¡æéë3Á@ë[Ê÷©q;ãyr¥ó•CPâéUY7 1·x«ô3ð¤Ê(“£#Ñß‹w£f ¦ž5uá¼TmÉš<(‹Q(ÛX»oãéì·œ¨>îHÙµ•º 5èû0»Þÿ`rÓ>\D¬vw‰•û¯0 ƨ9ˆŠ*ƒF÷¾[{™o|äéxΉ³¦µìÎÜs\jVè€åv¹bÚæô¥6%”²AzJôŒ©CHo%Bt?¢?iƒ€r-Ww˜1áŒjU2D1é‰ÂÒS"6‚&uqxĪù›ƒ[P Õ.èÏ—{Ê7®v‘ò¸ +¿™ž1ÀEEl.œ´@e—k^½%£$lîšçžÆÀœ—•½šo$¿0:×6Á*P`)k0o„8}Ú=€|Ö“ŠÒÕ^ " +mX6\‡rî‘WÝc<¬ih¢Í0àµÇèù˜R N‚lVäÓ£¢I†8 T?ÆB$¶‰›•![ò7¦û½sIÜ7zÍHgvÞ‘63jÙñ“ý;W,–ð·Ç”IÝVcÏ_¡zoñ5èâþ?ë¡°)0›úéʱPcmP6ÁÍ í¡ç…"”á÷Óãü}HGiáiïûéôÑÀç4ýý$ÄWžÉ<|—Óáw¼“I|¼ò{ßÉІ¥÷u:´Ë: Yô}:í‹¢„NyícH-F„Wc1ˆ\¡%0x‹¸Ù˜–XqŒøBL‹í‚2B¢8ø4ÂÕQ¤¥ó;¡hâd²–ƒó¸t5dGºÄ)xG7FbøOBñÕ5¥O[µAT¨Ò¹é&pŒUDvO1šá$äÆ]ôÂNI¸S 08ÝôŒhoaâšÁ+§ÊšQ…Ó©‰%`RcÙ“ ®s¬ŽhÓßn*eŒ8 qËQÉíV¦iœð(/êõŽ)ø@j³&ÌÞ›jöS|Çm^‡ŠjÛÄ}dL:TÁpa hma{(ž-Énéd¸“/ [Mq9{Æã‡Nxo‹´j‹‹¬X21&9/ÓªHs†¯ÊV[ݪmÏĈgªL”+¡Ø5NX(®²Zô¦« mêHSøÅþÂ0NaÊ% ›TqLV@ä—­HÄ0®Y† †©ÌÈGq™jÐ…%“™Yþb‘†¼ßQKƒówæ%`ïÐSÔö:+°}v˜ ¡°0@.š.ëY™S·7o8 +X?Gàœ¢pÕ†SMß#¤/Æ¡}„´'æKÏ&¨SÚj¨Óö\[åBÉÛwiákü‡~în¯¾V"TQÿÍ÷=ˆuÒòB10Š¾ä×þ,~Àð? Lendstream endobj -5157 0 obj << +5275 0 obj << /Type /Page -/Contents 5158 0 R -/Resources 5156 0 R +/Contents 5276 0 R +/Resources 5274 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5154 0 R +/Parent 5279 0 R >> endobj -5159 0 obj << -/D [5157 0 R /XYZ 85.039 781.388 null] +5277 0 obj << +/D [5275 0 R /XYZ 85.039 781.388 null] >> endobj -1386 0 obj << -/D [5157 0 R /XYZ 85.039 665.372 null] +1230 0 obj << +/D [5275 0 R /XYZ 85.039 137.201 null] >> endobj -5160 0 obj << -/D [5157 0 R /XYZ 85.039 644.175 null] +5278 0 obj << +/D [5275 0 R /XYZ 85.039 104.701 null] >> endobj -1390 0 obj << -/D [5157 0 R /XYZ 85.039 479.466 null] +5274 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R /F62 4047 0 R >> +/XObject << /Im1 4096 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5161 0 obj << -/D [5157 0 R /XYZ 85.039 459.938 null] +5282 0 obj << +/Length 2688 +/Filter /FlateDecode +>> +stream +xÚ¥YûoÛ8þ=…o¯‡ÈAM‹¤ž[‡´IÛ,Ò4×8›Ò`¡XJ,T–¼’œ4{ÿü̓’e[ξZ´âc†?~3¤åÀ†¿r¸ÂÖáÀ¤ÐA0˜Î÷ìÁ=ô¼ß“FbdDF™7“½ñ;×H[„v8˜Ü­Æq…ãêÁ$¾¶Þ~8<ŸŽ´Ö– Äpäûõöôðb(­‹“·‡§ØåXçPý|r6Ž¤uröžåQæòüüö mM†7“ŸöŽ'­Yí„`Bˆ6ýºw}cb°ÿ§=[è0n\[¸¶C>XV ¬Ç­z+1åEDµŠkQc!°rh‹æè…Ät=ÎRh›•oÍXæq¨FZeÂ-Õ¢oÔaFª þ.Í8·Øù„¿óTÇbåJ¡.½Oê¸L†ZYIÉÒkësBáKe„a;íY“™YT–¦ÚRc)¿gRcB§õ¦yi>Í– '8ÙÚ`* ^–¸!M“¥9;NÂ*pÕÑ·ŠasÕ¢d´”ì„=x‹>ËÒšÖü#/Cw—aÀráü'â`8ò¨¶ÃÙ<’KÍâƒÅÂŒñ!n¸Ïâ,k;;8\~G§§ûìÝ«¢8NÌX°¾¤¼‹¦‰©.^ƒÃ¤H–³¹ñvUu§]¹.wäó¨úöª‚ÿ)aw-7³½/ÌB#þ,Š*­Ó3cÍMé×eR>q±LªE‘W¦ã®,æ\jl°EÀ _avwÉkŽŠy”毯Ž>>ýtþñølrà +Ÿ.^__¥y\5âï=I´é‡ò¬vÃçEmD¯(ÊÆ.õÑLË)³{| Hòy$ŽÅ æjŽ˜à^ÚJ $†ŒDÇJ¾§uƒç{ bÑL¡à…!i´kck3Ë}ÂI4)Þf€ÅÊšÈÈÓ‰K¸Ìøeì3¢è°˜Þ;L$h¼Fþêä̱¹-*M«¨Ò®»Êä(ì-–YÌ*Oè4<:XÉ“N‹«åTdQÆÕÛ燷%tÇa0þrŽÛÛŽ +hÆäÇÉœ·[oi@‚µVÚð‡’þPj•:AGƒ IàÆ^: ¼d$—Ú vÙâ¦bMƒKÕRPg4l&Ží1÷TKFŽèÁÓ§œæjsZ&À2O†ɧ}E’ërÓ(7)á’¬ÚÎy¥ç ,Íi,€˜ìmD×Òìùèz¤ÿ¶øß•ÊZ,ëâ´ãQn« (ê¢%j§¡òfY¶âÝØ‹…›˜4·0ëiÕ/"s¾|)³SžÒ÷ÖœÉLÕœÞ}sЮ餌Ÿ7ÆÔ8Wì¸_iO +é<{/\‰Ð•HÙÛW"­=á{lÜ}V(¡Ñ­Nh1÷‚5à—ŠŽß<e„J‚Øõ|ë]Úz +z!…-¸ýz1Ô %c³ÆÒ‹›]KÔŽ°ùüW2;ï}ÚVÂS|r/ +Â&\ê˜S¹ò8dŠÂ²t`ÝtÊï¹Æø jD ÜÖ*_âðŽÆ¤LÝ-bš³©Úâ°Ì`'@Ç zwÿý FŽ¥¡¬ÓŠa×òåÆ —g'_ŒÑx±Ýb1¶ÂNrÖgdMªÛ;s%9+Ä .2ïDfl¥Å$i±¬8%ñ9·!`“ù”Ó¸^7§ñ!ìVÆ´Y„ò-@0WJŽ±hóµ SÚ%EÐ[ÝJ}òÐ6ÍŨ‚ÙÇפÍ΀$¯®1…*˜ëÑ0í®(Š„KÙI'ø•6ie3î¢ÕD6¼è¦Q”5E›`º!ªjQº½äÁ¶Y7öX!С óò¡8#.š¸ÑçªYš‘E¥qR“;ÆU‡Ç1Yð°zšµ_²ZÇb¨m"æÝlm3!“™„2CÍy»/\¿7\?k§¤Â;xFi¸kÿYžéÈÏåt"—-¤í@è"0ÛßœOÚžÜàÙ ™­טMJ`i©Öf¤\IaüǬUa ßÈ$g“—ÜÉ·cl⤖[1›Áo'›áƒ¢‚kã¤yPêÝs<-=¯ÆæU…ƒ4¬nµí†"ð›(} |¤\×: óTÔø€ð”ÔícÁ¨QèâÑD·!?(ü€¨¸R!Zn‡®$–Ø΂Pø°lÃ?vÀD†RèðY”¬DvƒÄÈüFž™­…ÈÆt½éLÇ ÍµF…Û× zÕâÉ„D8 X¨…”?ów¡Û…ÔvÁ°Ñ=à€ JEYé½èpéY·ƒÌž\ìÁ«ü|Ø0¼ôDˆÉ +EÈÊWxI§k­ÍW'(ª€ßš ÕÆm`åEî§+~é&œWwÈÔ` xƒ"±»›šÒÜÓ²¨L¹«ÚÆéšsºá|Ã÷ÈÊZãC;±kšbø|jŒi¤Ìe½'@l‘¶ Ziéw_Ú±Ç|9 £°$ñÝ<ž7™èÑ6Âwi4n1â>q¶ÌsŽx{žÕ•'$d?ìYÝÕ”½³0ï§ ^µ±ffL¥ëDzOQÖƒã0©›çü摲ç!²q#Ô™,BOf|3ÇÃyöT7û`RYtÞz¤EªüU®«|·Íu•ïµïUXÆt÷žEèûîÆ] …hÅXèBëóï»|ÿÙpÒPºq'\–è¼EãKœäìûÒã¸ú~h”ºéLǤ{›ÂÖ­¼§m²i!z~1)> endobj -1394 0 obj << -/D [5157 0 R /XYZ 85.039 148.969 null] +5283 0 obj << +/D [5281 0 R /XYZ 85.039 781.388 null] >> endobj -5162 0 obj << -/D [5157 0 R /XYZ 85.039 132.625 null] +1234 0 obj << +/D [5281 0 R /XYZ 85.039 361.14 null] >> endobj -5156 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R >> -/XObject << /Im1 3957 0 R >> +5284 0 obj << +/D [5281 0 R /XYZ 85.039 326.996 null] +>> endobj +5280 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5165 0 obj << -/Length 2373 +5287 0 obj << +/Length 1932 /Filter /FlateDecode >> stream -xÚ­X[sÛÆ~ׯàð œ1áÅHŸl7v•IŦ'î$yX ‰ -”¬þúžÛ. mÚÑŒ¸Ø³{®ß¹ÞJÁŸ·J#WÙ*I=7HÓU~ºQ«P>Üxrb+G¶³3ow7¯ßÇáÊSn¦²Õn?ñ‰Ü0 -V»â7çÝßÞÜí¾ÿ´ÙAàx™»Ù&Iê¼ûr·ñœÏ¼{÷éöãîöã| -aÓs¾Ü!ùçO›4pv|èöãD~óÓÛ7ü¸jóÇïwVS«h•¡šÞüö‡Z`Ò7Ê ²tõkåz@>Ý€žnò\ß|¾ùŲbZ¸â[K^1'¶¾rß¿—d‰ˆ .ÄWâÔjëÎÁ’$ß·{ ¬gÄ+uÌ©mà§n‘Ϋ?W“Å&I‚Ÿvà<@H…üúö¯þÚ‚b«_®ãú™›x‘­@TcøÃ8qc …*v}Åñÿ]EJÃ?ï2N^º« ¬ÄÑ’YWæÉ•íìéÅ3 ^ðEÞW‡s_bR‚ ©òú=(:ÝŠ}Wùè<ÿÝ¥®~¬\åeKÊN¾—3WÚ½sÉ ÅýZ5ê¢Ýø©ó40°ÿ=ìÃÖXÁº9pŒ-Ó5?Öðè'N¾ÙzŽ®%z8/WËþÒ”0ð]?óÿ“ß­IA˜¸>äñ6r=oÉh@¬@öþ·4³Ø -?”EÏyˆò@ñ qU’‘ç*ðV˜&ΩÅð⪨~W^œŸë‘ŸGðEËKoÀUGtN‰þzD•P29»#z™Ø¥Î½ -4á~7SçA8 -»9•|¥T'djÔ`šçäº(…«>´¯6ÛÈœ§£!7HŠW‰q¢ -€~bëºÞ›ØÑÿah{ÄIä;ížÁÏS Ý4IÌ_ݶßDžsX@½»*óäà+äO²†êÐ’zÀ•¤Å—·_Yú½{&ôê±jv!RtSàBí8i[ÌdZÑâZ©;ò¿Á1úbë)Ð3Î^¸äË@ªÑÕ̹5 G=4]Fg±r¬ëtÄ‹tK §Fý@ `%à£lX!–ÓÐ*Œ•àXÜW5þŒxë™/ˆe™³îÈ2Æ’ìµgßÑÿ5+ö -CÄGGŽ#†V0u£.o8…ë„.·x!šù—"ç§—æ ¢ü,ä8ᙾƾÊÇù}²Œ4+ë½°j™ÓšÜ°%bÞÓ¥²á#mƒ=¯!³B°À{läè¤[«ˆÑ3ù[ž¯l¸$¾åÉŠ$pÖ_»žj"EÍ›€3H®ÈùGI8y ½é'¡sO(œT2CcƒOE9¿n1x'IR”#Zèq´ïliÆë s”ˆCB]Õ¦‚L¥þ0·•{Àpî:Ò¯í±r)E2®6Ê›ª ¬¿ò}¯OåÓ†îñ ½Ä! äƒúŒÖ‰Dº©ùæªÒã缯:B/mh!ÇÞýÈ‹‚Ü=Ë ;÷g£«ù]Žâˆ­7•PÓ¤U©‹gÞ§*ÒóvG}ïTòÓ+—†‡mì)çï£3ßÊuà ¨¹qÄž€+4¾¡Â`Óºíõ}Í~ÄUcë0EhÔM.¤sǼ©Ýâï)Ѓ -–蛊òRcpÐÈ TH…€µtíökkt´üd‚|7jMúµç÷Öä1 ¼RTV—|lûª”£mÃtò}{îùix8ÑOÁc>Ú׋@Ý/™ÊRAë5ÞÅ!„jÛÏ6’0†ìEÁ¥ÎÊ0Ògg¿òOQ ]­­£é"o™ /§ ›ÒÄÞ”ÑR$°íšS«ì]î/çE^Í} ½„>zhnÅÒ´CdhúæŽúbaZA'ÆÏ& )uº‘U$À´H\*&5ñ2âR7‡³>ˆ9„c ÌáyÍá,”bBXó¹ `¡óÑ×Þsçán -¯C*šWœÛ&w1ƒ”+Ö(åCz©éx\Qј­Âœ:ýÀ§zÞ3ñŽ„ÄN7P&º3 -¨«áˆ‘ÁkTÕ¼Ù åq8×èhq;·£aöÓÌNƒ›D« éxŸ;‚Ø°T‡¤¾bN>‘Âý!S£5èäTˆáÔê°- S$O‰ìhžÌµpAŸÏšÐÀ»Ø-‚©ñÎp4¨¤ü‘ÝÚKÙÛ CviÄhÊùV~î_”d`pmqÑŽ†“ë¢c±”¾’ÑÇÖ¾ŠFœF6½2Ú´sPÿ¼­Û^î’£šò©*ˆ‹ëJŽTj¿p*b0S’¿mbGJ`8Di iÌì(\[Dæ ó`)r‹Ê˜³]°vÄÖI - aì^ò0+„×è’XÙ0 fN8á´…ð-–;ä’⬠¿ /Þühxàiƒšã»HhÇZIWQI7ì)n Ôqæ¡4<òƒõ$Zò@0­ìÙGêÒlŸzâÇíNH“L%ä^uêjëYCcÍùüž5ÿÈ qQñ(šÒóeŠ±M¶ë˱”^Oq/øõjÊ£í¼WCÒÿŽ°"€Âì_®½F, -‹zÖ¯ðV+c°ÇíxˆÛØžèWž»yÊö¦R%ÎO0Kñ‰—DP6¸GÞ±Sú#4o-HZî½÷z –fÜÒÂ̼‹)'oaf!g#uÏ¿ë^£}‡ ;öCw!­å‚ÐמøÆ“¯ñ±œÁDl›’`–ÓTÌE|ùõçIØh§{!ÏÜÕ,Ud”ÕŽ:H.¦'::ðÏh´‚¼=[rIço&9@؇EÍ/wHzà| ¢_þ™C?AN#0R $%¯+aÉ鋱ü6žé+ <ðørÞTô`a”º¶õ©ªñf’M-$Hg喙° šd"3]Õq;g *p™y7OÕÅÔ:àÕîœÏ^Ðaÿ …2Tù³ɵ.ÉdV³I y6‹õ·ì§x$¾šÆŸ^?pk†NÿO×SýUΧ%ÚÀ×éÝ@ Ça†uߧýê[Yó©+¬SÁ ø£Ëd,èÁ§¬~jŸ¿¹TWÅÆôÛâº:™qs¡˜àöý|®å1íÑ~‹’DæÕFDŒãIÆìþbž½ø¬°Ì¼3_çå×ý7_ËåúÙò>‰ðÿç _¸i-à‹|ßõ=£ zÔWW_£ u£4¸Vø_¶¨ô¶endstream +xÚÝXëoÛ6ÿî¿Âë:Df†=3äC–4mº$Ëf…"ɉPYr%9n±~w9?‡eGrn½ÊAÇÁŠ@#ÃGR—¶]ž=%õ—‹‹¬0r•p¿Mn5ÏYKË­uŸšŽŸz_¥»@ðP$ÏJͧ;HýX¥wCF=š}aIžÃªô€ú·‚išs9:ÝÓ¬! hÜ• Q’¤ mÉŠ&­ÆQœšéôRNxd‚yœˆ·qT7Kt麴PL¢úÓ!LýIÆ×Côº4ÖEÆDzΚìÁ(,¢‰}ž¥ÕWVi=-‹Ú,Œ«rB£… “DzÏ]þܢ؀×I9‰²âðæøúj8¸ÂîðøÞ\_žýa¦Ã´zH«Ã›a4¹5ÆK&™}Ø„&+îŒÉYž®…JÄQó œï”ü#ðpôˆs{ KI8&ϪxÄú­^\oïÆõ?ÜmU@Al«Yw‚êïÜxĺ“èšÛê@ÖoÖѵÞm´,˜wòZñ¶¾ ë¬ÃÝZE:ÞZ°îä0Ûê@ÖtÀi´­dÝÍ|ºµÀº‹ŽöüÛROÇþ]Åœ£[4•–s—gî– 9AÃþ©X¾â>G1OyZßÕ=\OS¼·Îçs¸YøÂú“~\ÁRÁÉÜ–¾Vˆ“ˆ~rX/Íz96›lX_aašðïÝw6ܽ}뢬 cÔ*{@¶´jåa&/ n¥Ö“(ÏÓjŬIT˜q«,r3ºü@j‰UmÀ÷.-Ò*‹áª¸¶Ã0mWÙÔFë5yÅF"½çÂj®‘ª‰†;ò™™ˆV"ü0œpë²l4ÿ0 Qº+Ž9¢«Ã«goºÐž%$¡ÒûmOJá‚$Yé¶<5vŒ+ŒÊdë…|±žÏõìV}+ɪ6 â¦Ä ’ò•ªòA Ê@ J³4Ó†Vi¬M,Q€Ù×Ù |§³Þen*Ñ‘¹AédD‰ |±5^ +¾—æä¯Î`7XÊ`¥$ \A’BÎ¥µ×lHvé3ÉÃ9QŒQeÓåý„xŃÚã‚Lìnvw>®Þo!ÕàSÄQú!|t’¯šÝ U¢{ÁpŸ†~[“”ô·c4A@nm]È@r´i_ °Xú‹S§RM»8òR³ÇQ“•ÆRy†i›“ÄH#‚¡ÂRÇmTÝÂ<Òj|Ò`·FÞÚ2l¹0G4üž\í5« Ú—¡Ž[I,¯õ˜¹>@환ÅdT}‚YšÂ‰š{C1u¡BnÍ3íP+t­ qÝ¢TV ö ¤a¼#tÆÈ%Ïö’3ÖÌw©™6:kõ0Êë’vè"tƒå®RZ&:ƒƽe`Þ鮺ûa°ñŠ^¢JGÝĸ4¦8g&ÀøêéNØ”´¡³VÞ]:|Ÿè[¥a˧Ašå ‘¾êþ8£IÑfVš¬*„è`¡°'ž7 1EïO¾Ë,ñè7 É×ße¤0. ˜˜Ï@»dôZ€Ñ:¾OãO`—çY֓盶ƒ“ªÍûìçH:Í0Ãuœ`ÙJè^KÛ´“íTú‰Eé4“ÖTOSÅ­8ÏZ(Š¦m› €ïWÅÅóP,x4+¥ÑÊ‘ + =ÏœÚCI&yÛ·p"u!±Úôa–M¼·ÑgŽÊnáRòJs*#€0;·FÔë€J¢  5p£K·øÂLæà¹Þ”€/\Ï5E^O° –Rc‰øHÚÔÒÏfgSšž¨ÍÀXa¿œµŽ­àa¶<`Ž\­¿•<µS0ÈË;d†ðEæeÛóS§¹.S„Ô¦Àò¤«J ˜U%–áݽa]*»†:‘®yS]øB@Å\ߧº©ázL·š–5pŠ`Þ^êéû^U–Í÷to„ì°ÓÂ| íï.~>à{Åþ´Ê “á:ù’×ô»‡ûøÿí-.ŸXá3ÈX±Ù›¯º>´¯Póö¥ nfÔ2ÊM<Ë/MÎò-æß~h¸Ì‡Æ³ìÚÿù¹IâE}öxVU]‚$xlÐíPc»ôù‹ìÁ™N —«Ÿ&ë÷Oè*"P¾k˜GMp[€óÖpVô‹è«!9DàêÀõ” ìÙtËg(Ø`×cÁ£ûí<šV-ÄF”:pü‡¯ +ÞÐÅgrãqdÂ?zÊïN¨Ú@…›WBÐDk º,ùÚ©Ó>ù¯üè²K7endstream endobj -5164 0 obj << +5286 0 obj << /Type /Page -/Contents 5165 0 R -/Resources 5163 0 R +/Contents 5287 0 R +/Resources 5285 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5154 0 R +/Parent 5279 0 R >> endobj -5155 0 obj << -/Type /XObject -/Subtype /Image -/Width 780 -/Height 318 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5173 0 R] -/Length 15650 +5288 0 obj << +/D [5286 0 R /XYZ 85.039 781.388 null] +>> endobj +1238 0 obj << +/D [5286 0 R /XYZ 85.039 282.399 null] +>> endobj +5289 0 obj << +/D [5286 0 R /XYZ 85.039 248.256 null] +>> endobj +5285 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F62 4047 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5292 0 obj << +/Length 2086 /Filter /FlateDecode >> stream -xÚ퇂Û*EE¨zIüÿ_¾d{Kö%öÚNv&ŶŒ%.g†2,,Ú3LÌ>Ú73¦m´Ç›s$Ö­o§+§9ÚƒÍçNƺõý´aþk"¢¢‹\ˆZˆv悉_BÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ¹µ-r!j!ZäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ¹íQZHÛ6õ^6m~ªY-hõR²:ó~ksEë”õöñ©²ãùlÛ¶ÍÇáÝá¤.?(<̧«‘ Ñž¡¡5›|¡µ>jd®ÑÔ¥>ŒZxßj{iu¨…TWŸjÑÍ'.\MgozùàììxO­n#¢=I z‡ÚwÒ¦u駻KcR™¬ÖÔ'ú¸`’îá™iò³¹¼I@ ã¹½?Ÿ „ÿŽ#1ó-¤[Ê´:&XÔ¯Ýðø¶‡ú®yrºÆLáZ‘ Q whÁAsN5ÓÁóI´‰/ó‹·c´&”±>=UÙœ…f|¢ª„Z|òo:«©8qa­¶Uxs[¼Tj÷© :é©Ö6½\\:T`—À— ±m~ÉŽÕx`4+xáp\)èJwN‹“»–ÂåkÛ<âk\ø‡µ 4•Z©ƒ 3rB¤òu²ÓµÐ&?9''i¶Ú †Ö^xÓ'.,ð„„†ß¡ÿ5z¦ƒ”^j§‡W\ÈöDh…-:ø` ¡PO>’WSÂû:tׂ»v”vÔž.Ÿ—¯#¢îÒÂbm‰ú©‰m Jj»¾´“P}uQé\áÂE ê^¡ítTÿ+zh˜9Vv@ÔÜ š}ÚkmŽ×ä[Æ_s!XzWç§#^ §÷Öâ‰ÖƒOöM¼J§úHZAApî%r!já.-ä­¦º'.Ùo­{ÕÄ–šAãži¥O &=‚ ¨Œ%„Ç›Pþžâ…})¨™Õñ`¡N±s4Œ‘¹Ëå+.(ðŒ’WÓ[.dè´õ§xaö¯¸0;PWyxWpùKG.D-Ü©…*¨ulG§É§ÏÇ^¸PúþTCêƒ\(°c -”’žœ$MGÒ)Ojpü›·ñÂ9üµG­Í…̧ Þ¼há̃¾9 -Vp‘ Q ÷iª›ò§x¡ÄšJÔë&VGüõÅ¿ãBvá ùñTÁKÐÔ)åÖ',B_>¥ñõK§(¼¤Ñ‚; -½pAW¶¸`ô©Ž¾Ä 䢅Z+™Æx!já^-Ô]¡“sÝE{5œÖ†þÿñäÕ¿ŽKhµ718m>j)Te}¹ï;­raŠÐV¼N ¯/$ÊP˜Ë^qAºW\0ã¸È…¨…»¬[2_á¿úTRªDÛ¿*‘,9\h¨ÛÓåÒ娿M½zS7G§~BÕXžG„3ª–óàð^ë«ÓK¼…¢/ãÆSÞ¾T¼9¯OÙ‹åw®ê®p*Ò ÞU¶]ºM+ýz~S}Ó1^ˆZˆæs[{Éþo<¿Mî;ÙÙ~ûr÷CiþÿŽè“YâË,r!Úsµêôý¡JSÌ y$c¹$íúÁ -±¿­±Vÿ°ì²ÖÍ‘X콕ô(KœþõZÍD3ߺ=r!ÚSµÀ¬üH ¥f»ù©BÆ¢w>ÐBî;úãž%ä|VrN2ö3Û´…ô)_käBÔÂÉ2Lò5´KÂÙ÷fi“ N5;ÒÈͲ:dBZ«:l 3äPÚËÀ±âKGL\Âs¯¹@ºpJܯ$ÁÙ*Ú¥"~®º¾­áN®Ý±1Ь]ÒÖˆ&(Ñ–è³ÕKŽé²zé$>^ò¸àÙsðÈ…¨…“ p‘V§™Mp† ð0!äRbbº#GÜ£…0Y®O¥[6ؼ„L³‡yZÈ«ó†ÂÈL¼WâóÑùöjç*N>’ Y÷²p†^á摬ð1=gåc3È'\ˆö<-„¬Ž¦d_*¿„œï*øH•³ŸçµP†d¾Ž$N'©¤‡Ò;&GÅ$µ¡n·˜>’¼¸YJ®Lâ…Ôã~W˜˜3z7àõÚr?áé1dªÏT -Õ}™µî¦né=¦!Vº xùÓWɹµð±­Øc.`‘…Cº -ªeZ€ï{f­0ÈlÞ6äP[·SihãùH[ÜÜZWòJ aÏžy:q¡Ûµ»N‹ù„sˆ¨µªwz=òoOÅü_ -8Ð\• -=nˆ„°íCù*xäBÔÂí±SÒЋäœeSuÒBGÙŽµÝþP²Á°ú(±óŒŽs”ãf ¯cguÙ³'paС¦5&P©Ýl°v+Ü5€¤úÂj&à´¦E÷,+ŽWtÈ©#­}úœà9r!já0ƒ\ºƒƒÓ£'dÆŸµ Ó4ÍB?6ï ›zªRJ› ¸3_T¨ LHÕZÊ“?QaÚƒ ÷é):,2Ç#$HKð‘*ÜóAbÏ+\x*+3P½i¸/S9 –:„Ó´¹µp>+x>fU®ÝÔiÛRÐÀY 'µœ¸ ”¶P1í˜ÃÁÙj1´Zå¸ ‰Ð¶†xXN„¡3hî…Ðì2¾§ÍÑÉ:qABX ŽÜòÐþ/ -.L!XmÐw¿‚c-ºNB«Å!šË¶¡‘ Q ÏЈ5 ·’bIØtA«=Ä ïœ`›Ü"F¨ìª÷–¶Ž„ÀYëB`Jšqv¼,³aóÁ6lÚy±`¶¹ÕbLŒZp -Χ¸Oà58Dö@-Äs¸u÷»Ç'Ðã¹í‰Z0=³ Ç`ÂÖO¸y² ÿNb€ @†m—åЇFŸl>9÷ø¢} {Î}¥¼oÏ® §Ä†Oû@p»g2ù9üw:×D¤ßÃÅÉá7>³'ûqÆ-„ràøÈi‹ÝÈ…hÏw^^m¡ö€Xœ=iÚÐGsE"¢jœu<›ÜŸõññœóF.D-\lþua’ÓsN¹µ-r!j!ZäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ¹µ-r!j!ZäBÔB´È…¨…h‘ Q Ñ"¢¢"¢E-D.<Ôfµ-r!h¡”Q Ñ"І-j!ZäBC&£¢E.|0D-D.< sÔB´È´¢ŒZˆ¹€6}g0D-D.<4b(¢¢E.|÷ˆ!j!rá±`x·¥ä¼°ob4j!rá©`˜­]èw0æ¢"kÛöN õ7ùÉôŸÕ‚$O´é~°xžê\ÎßS rAò'šyÃÓ-yšýÑ®îyýÂ6üE\(Šíi6¼žËH’'~6þ*뽩ži}䛦ôMÄð͹'^òõÉŸªój—‘¡JŠ§YVD.¼ý‰û´0“§Ú|v¹?íòÌ…¿O }j8ߟó—IäÂ;0L?j¡{¦?¼•øcóqزOïó¯p¡Oùþ4ûH ÿözçdýQ ÕþÌ+®Ýé¿ýóZøw¸ð{µðo¯w&¯Àð{´°?@ ‘ ‘ ³—õÎÉþG´PÍd¨""¾RœÀË?¡Ò•e÷鹑 ‘ ´ìÒ”˜? …û,r!rá‘`(Î`ØË暈ȅȅ§€¡ ‘ ‘ ÿr?’Ì.•3‹\øf\à„Ë}—`ä¤rQ ç‘ ·Z™¼ÃoÔÂÜÃðé6è.$p¬Nݘ~˜#p*ŽËï¦ålë­ZHÓ²ói ¶ägÇ3¹ªl‡OqmÖö[M—¥."mu–ÀVðÈ…íe’êšýv-ìã0úøì¨t"{\´·jAP*¼pTPQŸßÕ¨®ùÄVŸâ‚é\¥“L+!˜Æy†‹–Àá;Ë %àÞŠÓk#®²—Iª…üÝZxþ¸³jéâG‹…Ï7Á &r|P)-ÈÓýéŒ,ÄÎ¥J' -\U¬nÇSO¾ÖËBëÕ2©ê“\8´P øZX-Ý]E¸¢«e”Ò%iÙû‘®Ãù^øbþ¾umBMAÕm¦3/¸DP¡ù¾h¡€V{nJðëÑ»ù,^kÁž´0+ô‘lÐBï Àȧª/ -ÜЭÀ­û¸xµ`VäBe¸Z¤?àÄë¡eq|á`˜ ü¦Õ*¥³ê{ê¸1B`ÚPÎ}ÐBëA©+Á§ïû¬°OU*ßhÁ/¶€X|¤¹°;ZºÚS—¶^ ›ŠOÇ .œ´°#FÂ…wÒ•\0··6ráz{ùâ1Žþ ×;Â9§2_0hû…U‹ àÚ3[O³Jqh¸€Þ8Ñ2B?§…n &S¨ÝEã±_ o¦½mÖÌC3{Ò_P‘KorASl¸E>nŸçOê-<Ý· ‰¶Zی󦓥ÈM²,HšG.Ü`—IªsGþB.ðödÅž}:˜†ašÈ̺½‡G8¦@ˆÇ^&’px¶O ž†^§Ohá ÍÓ¯æ#qrºCx˜ƒAø -7+‡»†à=Câ¸ó-ý—ˆ¡Oþ‘<ûL_nœ§ú÷Ûe’ª/åßÈ…´ößG qžêŸÃæc~¤ïÃ…^‡¿ò’~ˆ­Á"®i§À0•æïäÂDŒù1Ót[âÒ_haªš0B3¾Ôäù|~Ò´h{Ñùô¼¬U6ɸÝÁ>´õR7ÃéùæÇ©¼êº‘G.üÚäå‹X³—ˆáïäBéÀlþþ`ŵ0[ßc©é¥¡ç&vÕV%ÖöÕ ö®s=ÞÁ“i¦”sÙ9üa#y·|å‘ WXv™¦_È—JóWr!uE¿ºy×’ä‘Z`¿»E |ÞÀ›ë,¼B‰Z8‚uip0ÃO†àL©Ô¦÷p!Óá+u_÷aú‡ÖžóaØqºv¿ãTr¹p…‘K«Ø_À0èöoäŽúzßÂ+ -!(÷-|àaáùêªèê§\‰ô^‰QFd®õiN¼bÑyäÂ-\ø`˜È…»À:XïâBµâàÂl!Xm_ûHBkÁtX‡?ƒTøjͨÓáîì@ 7d»’ ÿþ£ß|’³œîÖÔ±¢LË4- ­ !ùZŸà¡Ò¬ÉmZ¸ ¼(#>†Kl‹›ÛÞ/”'-ä>TÃ椪[o´ßóª¶gק¥øˆ X¹ÅGºŽ ô‚’¾)ÎÙ‡s.׉în-ˆÔ[dz |~z|9¥WxˆF­7iágë÷sÄð¦ÉÙù\¸Å.“5I7ߧ&=¾]¨ÙÃÛØó=@ÛÏOñÂ|êé´Ö$‘Nß”7ìJ.¨ËÇ)í›ß¸±ºS‰®Øx¯*•“ä ïßf¢Aé š9O~©oÒÂÿrÁì=1kÏ“uXÍI+ã¼=j!|w£‰\¸ —Õ ù¼Æú%¹ÄÔ´§sfËA‹tüœŸŽ&ôW‹¨‘ï¹iÉs¸ –¿þ¦Z(aEH—‡3´³E0½cVSœªŠI²Õô-TP›æó|£VÍ,Ëo_|¤ÿË×z[¼°ÚVnº!½ívê˜ÐÙ\‹Ìaî0ˆ8tN|"ՙȅ뭿ŒoÛ_6é­Ü6 [?´Ð¹¥ØÝÐægïõÛð.dP›.ZÈ AlÓk-¨Çp¡•‰nä`ÓÅ&¦Ð%Im–7“œYá¼*xäÂçÀð—­kC鬃)T%TÄ“(ÃÓ$ƒË únè8ýl±ÙõZ0àõÍN¥]×¥ÁÓ -7\´ðxá@ E¦ti¸Ò ZÐy!f×/Z—E.Übà Å_¶ÞùÂ…¹×nª´²–œµ€ns¥oµÒ‹/A\®„°ifa°Åú\„>%ÜKçغX.7’¥«Õ®e•‘ëO\`Ú&œŒðºØt“W/ü}ë‹Á'àø˜lòE'}ÑT»ŸŠýð á)V?— NÒMÆêçuôj-äa AMÂœØINþœ ©¥þ\؇~ß·oyŸ%¼ïù¼ˆ£p¿öªÂ ÙÇnÃ9iÕëæé·iá ÏG’*ûɳä—Y™®\¿ðòs¾sS)wÚÝ–‡#û~¾‰\¸Ád6?B Û]$Œ¾ò<ÕìgZJ“®ÄKZ™8Oõ~;÷ Ü¥…Ù‰_–©µxŒþÝyªüZ{.Éû<ÎSý<îÒB®S?Ë 3ÅM&TœÙð|eœú9»,šz¾íɘéžkÝ®…[<2lXh>gXÈ4 óÖÂû¶¾¶-L?z79 òxûDÙÛùÕn‘ ƒ¡¿_ Jï¾u‹ÕnÇ›S§µ«<.º ¤,ÓØYµªËÚ…ßÄ…UìžPg­«'?âh\[±ºÌ×Í÷áYÂ;5š -ä©1uøH¯Ä@è91 ïêÈ…kí”à-Í&¨÷:!¨Fëž87æÚú -Xpž¹ -ÏÓÆé„SçÚ~zÝó'¸P/Þ [‚{¶.é7æ KùºZxG"T‘eÔ šú°ÏŽ÷l5åºÚ|‚Ä€1Üd7x ¯b$rájox½W NÕ_€…Ök˜Œ×o>ÕŽLV¯Ù)N¨Q0£.€[t÷i-ÜÌ…ûÒ…³¦‚×ã«…ò=æÌ£í×ÕÂ{.!qT¹”Rt0{­ÔhZ`,uû,ûz0›P4Ù—FÕ <ÓÕÈÎé:ráêVýÞõÎPík\³3BS ß'-¤ ¤p9ÍÜ i¨S-R­­súÓW» •š}ÎÎ!Jëð^§ùŠZÕ×ÕÂ\|ç¹^;WŒñšu¹KSG·Â:Ú­3˜ªœ¦ Ré¼qcb]¹p}³¾ßÍ…ëzM-4ºPÿ¡í/WàŽð²ÓÄÕZ+¬‚"Ó6ËÊtø´næB-Žy»Àìv2½-¼[èó•¹`(&¼Ô9Qb’½ë¨ÍL¶q[²Õ8-G»Ê­Ùp5h-ó´0)‰\¸þ(ïÔ‚Áj~âj!KáúH~búLˆšéF:]ÅöOkáf.`êÔœÍÞ4Ðð“#*M‚T\Ó~.Øq3Ò»"–¯B[:¬3»äE­ÓœA¬ì{P”¨†Jï‚ñÈ…Úu~Ÿ ÆË7\ qbƤFŸúÔjpWÂÚúé‹ÝÎLš…­sàÚçxAñBfÉ—ÕÂñÂL ç;4øœÛfß“ÆÕ¸  Ò.#ã¦o3ׂ\È¥l-ÊD.ÜðÜ·Þëyá·t÷2Í&¸Ãý^}ßõ!UÌ©â]ß7)~ÝC5fŸ`¸ -X 鬅Ÿ<é3`WèGò›¿¬~ŒÂR»b¯õFÕnØblNj]o}«³B7¦qÅ¡Âl2Øzvˆ\¸Á¶á>-ôÿ3ɵh­nü^oçBmÿÜ€Kíj¤rÎἡÞáÞ ×ê«Ä ‡xC%)˜³"!T7¤qNƒ¯d*|¢u -±3cŽöà&©5ráz“Ùtß|¤Eó{p´žq;&u$(2|“3¸¡Äü~’•_W æƒù©GB°²ëÉjö4Åá¶lØIŸ¦˜Ã$UbB¹¾ßYS¤†¯f+"n±¬¿oç}üP ¤J>OèãÎÝÿvœVWÍ‘ú2ó‘^¶oæÇÍy?ÁÁ·c+„í±?ç1^¸ Å_ºÿ†üÿÖ'4ÉÖÂùTÛ¸Þù³`¸Y k™eÙÇyTBâõ>­Òêà^¾>4}"„þÌ<Õÿ»ÎtÝL?Ì\£p™¨úÑr†S×åN“òøëäzÌÚö~J!šÐé¬5ÁŽ¢u5.ä8m£õ,Æ WpY*˜n¦Ó NÞûHÎB 0på°\mL&pšt:$Î :ét–E.<ÕG - šq†*ÄÊv&-&ÊJ ¥Ïh¢èzóU¥—¨‰Ð´`ùC ±é×\`ŒÒ%3’†4‘{ò2ìGÚQ ”‹zcúRè4Ó˜8¯®Þ\&)û•¹pg¼€6b˜ÜjJšîXâOÁÿµ…xY@GO¨Ñãöä9¸€ÉØA žáÙz£þ-.ð}$ivÒ¸žì¤t[cwœ®z¬ê‡x!Áôd|IB9.–Ù‰ÕÆæEÈQg‰ÎÈà”‹ýHÏÒB}^™UÚ ÒiÑXÐA­]ŽÓ¶nÀG%gòáÄ\áãv¯´-«[W¸ý{ñBãðÁªd-“¹ÍŠ¢è×' šN§ <ÜÀ -åH«ó¡OÝ8·ºê×N R€·.“"ž¤…Ξ;Èb€owÖáFOsµß©uV`@ÃÑÔK! Ý)YâX”8¡Ûº´¸Y ÿ\¼pha7|¡ZmÐÒCœ¦ÇÝaæ “:œx«©Q‡p+ŽCpnjLý±¬¦p9¹ð4-¼¶ód†ùÈ%y<œÏ{i¾›ê°èêØÞŸ˜Ô“ºÿ¹qça½dB*º œ£~Ø’$é éaÖ %ëi¬CÚ….#2¤éÞÓzœbXã¸óoÐÂÎÕ«Q…‘ÝØýsãÎüõöÍæœ?óaIøË#þªàyÖêËôÕ8é‹j¡¯ºRå­•øŸãÂÿÙºòOÏa\ø"Z¸Ïþá|ª³È…¿C ‘ ï3ÿ }äÂÓÂ7ysÚÚ£\hÎq¿“î‘_räÂΗüUÎ#>”ÿ+3¶$ráiáXµ€ þ:-o˜­.©…– ¸&!Œ±œz–v¸‘µ€ún9¯á ÇÃBbVšÈ…?£…J³®¢¾VªYZR­÷0¼¹p7xQî<Ëø^&j)xÚíRš^Ùn7å2g×n0C['fÏŠ<• %‘ Š ÂãÔ£bÃe/é²ûÈ…‡p4lß-3›Ë„Bsã¨ÐÕf]ÍkG•"µÚIêúÒ êJ"œ£¤p¥‰\øC\IêôÚésò‰9rá1\È\’9·wlWŒ{U¿ ©˜JðEwÛ®‹0ŠÎ~aœ©§æ-1Ÿê‹¬Õ ˆæ’&2Æ ŠŒjG¥ÒZH¨ì²f»©€ b¢j áà‰euÝî˜Lª•;ß­ˆû/ü).hgUËqòj8í¹ð¨~$Ò -š×BuD-’ÔŒS»TB¡—7͘’QUŒ÷n›±êU*`"ráÏÅ aNR‰[ŽøI°-Æ âBæìVi»‚„ZÀÙÜ’¡d Í#Ù£rg n5ÍU-ƒ$#þ\¼pŠ(™[\ÌÆt*1¾Á‡y|YShaø¡. v†`ºÑb_œ`¶àdÑ7©SB7Dµdç…ËbÞ¼?ØtT wJ4ÛcÌaKïÈ4¹¢gÐGu;Í8/RÞu7tý^5+ïÚf3;ORH‘·¥Ù±‡•,‚Äñ…?£…d¹ä?Ús¡ Á4ÖõøÊ¢…˜ 8MÕ+ÚVnÂPÀḛ Ãk;?­‰&§’;ëL_ø3Zø©‰öZˆó‘®7SQç#}A-¤ô OœtÓ„ÔÇùH_P Óôˆ³D.Üd<ÎSý’>ÒC,r!®_øòZÀL†`ó³µ¹ð-D.O3^\÷ÚÈ…ïÃ…ããpL»>44þ•&ßµÕ%^ÀÞ% ÉI Ϙ\~_-ÌʽûŽ³ñú -§¯+¹ð]¸`ÎÝ©ËS+à¦Áèᬅŕ™«SÅ‚Õ)ÆÜ-…7½”Šùò¬ÏRO;ˆ¥É7Ñ‚|Ÿ!¯¸%#’pWõD.|.Èv;Ýë„Èe¸if_2ÐÆ—TÔÇØAUž¿l*–ª<Óû>?鳨‰Ï3?Ôò+ia*ë¾4^%e‹ûï÷¦ d-¤5&Ç3#ø‡~ª5Kgß·õ/«àCïU†ûõŒP¹ÖªïZþ¦ûé*0D.ÄùH_D ñå'b‡±dh§øçf霱š…MyúcÄ™ãÿ$=6êØÓÚêÖã»AÕ·ú F’KʽÈç#}-(-ŠF»)ÓºídˆŒÔs=¤ºöV«µÇ™mçü£V« §²gº/àEÄi™jÅ1ëj§uÞ‘7ÝWÍTŠ\ˆ\øZX5öø -—š«ôfî¨Î@ é±@Af5-`UÐ@•*£˜.Kx\k‘ŽÚáê·wï€ék*täBäÂ×Ц±õ¨už\ªr«[Êœ™0v´õ‰ÕV@ÛŸ=h笫p7­Ðð˜ÞÅÕÓ•Zˆ\ˆ\øZ èãƒÛ“d-ôàÿà%-Ç<‰fPß«P×Q nÄP¦Äˆ-øRfLŽ™îUrþg¯ú1¾&ò\-¼çBoLäÂïÓ¯ÇÊ„¶àáLõÒžë©Å5ýA P÷A uøGv$Lç¥ÓG -€7)qY/îðAíJO]â…-¼¹n6÷×áÂ,rþL-ð¶å)‰‰\ø]ZXè¯R¶ìRháÒë³QÁŠ>ÄÎÊÀ-D¯üçÆÐQäúа6ÐB«ÝÒ°ª·±ºr0â qAi÷X5ü|OhoèƒÔ¹p… éþ•x–@]œÍ¥‚Ì\‚¿€H!dÆ{P¦ì=!œm.2~øÇ—m²"œ@â$u&ªã4öQ§Wiá÷sax­…W_Oè^n¨S¾ÒBvJÊy6ð.q‰Tv»§dä{ãÛGZˆ\x­lôõRü‘w ®Kñd.Lcûƒ-õËýzy¹ì<äêíŽë¥¯ÎÝÖ"¹(Å-\^ÿ=-·Õ&]Þ©^hþþCæB×m´ã‡ey›³Ó×]N¿] -‰» - ÏæÂ,ÜÕ¦O«ZÇ;®Wß|9]߈p®®;½‹vþ*ìË׽̿LWÖægÇ ³œß™/Ìt¾?™ÂŸïΡå°ã]ßÕôêrÓÞùËý¡Ûû7fêã§Ùnö‘Ö~}{ª~»|Š—OÙ8>ÍÑà«—®ö3Æ Ð<Ðõ ;s ^Ø^Ç Û›xÁŽ$è›Ø¹4œï¯þJЂ[rû°Ã›Ó„¿}ã…+âWíî„/ÔÄ«„_õ#ÕzI âø‰2x£…ú«w¬}¡ñ…ìÑ éOÇx–Ç›ŠýË¿Ñw>çq>ÒoÔÂ7°8)r!já_çBœ§µ¹ðõ¸0fÎ>èLž>0õòV§)j!ráëq¸rý¨|:>ú;Y.óÞÊ1j!ráëqÁ¸Ôp>Á‡Ú_±™5 âЉ _šQ!á²²D f -qÝö—бƒŸ¦cW•é؈åXüLÆ÷n—$haOΑ ß’ TâZg«›;І»l¶¹/uOƒ‡ÂõNòTÍÜæÎ €Ø¡@oÓÒõP÷9xO«ÎähÎZ€†²r ´tá)k «=j¹ZPs¨¨¹ßu–BáÒ %ra”Cã!¾†ZøF¥˜<é eí2áv,¸E²:¸×BÔC:W}äÂ÷ìGª¬6[­L±v¦–¡«žYf«ó2øÑ)a‚\þ¹ï%Án™<…r)¾«ÂQóS\°=¸OŒÉV’éþgZ…ú£š÷k7¡«!ò\â2L¤Ï}¥Bú¡m \ØñË®Å.¥¥þäôðÈ…`žjš|k-LØG†ŽOi „7àîíæwÛ¤¥Ÿ„šÑG*pÏ œÇR2úÙËE.Äyª_] !hiuÝÁ‰F×T®öʦ•++×dp µÀÒÅñ¾sÉÜgW E.Äõ _^ &Ke5n½2wBŒ³'­ DTT4rjVÒt‚&žã^+Ÿœ#"¾fU†Øù#,ý´""¾º|C¯ÕBiÙ§×eD.D.|}-Ìì¯K§ØçŸÏ1¹¹ðõµð{,r!ráËhaÎÞÖ»)yiz*ø yƒæi*n¬Å‘ ‘ _F ܾu„æÓ’“Ø(ípå©VJ¤Í""¾©ÂÌ‘0Gä¸ÿZ “œXã_˜å%H–Ǧ?ÇËG©“¨…£=:&’L¿jœ""¾Œ ݇¥eØ+š)+Z «Ÿ—Âg‚-vœ(?([Žíø°lWS+z/sf)÷JÓÝ. -—?ñŪʓ%ÿU÷È…È…¯ã#¹¡€:\»ip¹¬géì/m)åµ®ä¹Àl\kè±ÝUœå[=®L@TìJùÑ%ı¾Ó…Šd.5k²È…È…ï¢ÝgЄ nÎFÒ†¥Òm^²l„J*Ýh\(°¹¹a.J ?-ç ea¼yTãŠÌÍÒ•àe¥¥N“A©9{õ.LãEXò'«%d³G.D.|Ž ™•¾wòY›OZ°E˜X!y)€yžæcˆ¹PV1ãFµ»–¨ˆ&–6ZµÜý2’¾… “»|¨æ'£€DgÔÂœ•eZ–˜ÙçÆ\Í‘ ß PÕ'šžu3Ôméf¸ -Ì Ü°÷”Ä¥H ;iœ¸PÚ;{–b*ŸÜýr¯¸›¸j7Cºû‰ªëW±þÚgd•YiBƒãª…W¡ƒî[êÙx‡"¾øæš¾u=.Z[†E—“£C®G‰b!˜åc¶´a‰7hgÖž´às[n‚ùBw&p¡óJ ™k¤.ÊøP SÌm‰Ó-\UÁÞ2—„¬Ý}儵ÜüB7k¡ôržq(‹Z säÂßÚ$öÎ~¸ ©Â/™O«—»èRN/z¡ZÒtL‰†ú -ðP.~®«Ÿ…èæýRz.k½Û£¹ 0•@¦à -q[âÂtÎ'U -¼õåÂztÕ ÌÂX¹ðwjáMe;œ“ZÌoæÜmí ü8¾wix•)ùX¢úæÈuÍç­\ÀŒ$uÐB«Çªr9píèCžŸ¢Ñµ´ÔdY¹b6LäÃxv契 ßY ¿úmª}ì9oæÂRtÀßZ/`Åî0ÕZ´P[àÖãµà¬u ÊÏV³+1íaä¿®?äKõàoøó\ÈñÇ®’Þ­'-,ƒNB_Ó£µP΂¸$«z ¤š>¡…ÿåç÷na¹ðûµð»… ³»h¡Ñ]ïTYë$pÁ.ì:O¨^fý”x!pëÌðäÊ Z×qÁ¬E9\¡¹ðG´ Ûæè7;7™ï ~•ß—Ö÷µ …79Áž`ïÓÔ—‚Ve7çëc¹µñ£>ä}Ìhsôظùg–£šxäÂoÖ‚TéoÓ—Ÿ´žºhk ->’ߘµB~F ·ë¦Óù6Tº6;g j»{ø€ã1ÃmEàøS+<ä‘ ¿K ¶úmZøòó‘N3q1ÕârÞúk´^ÃÎÄ̹[Î[¥³·#Å]@hÏÍØÊR)š²]Õ¬”RõN*â¹ð»´pÌÛÞ¡FOÚ,l‘2×jÉKߟgÞÔBµ“—µª« -¼%>¥Ÿ|ž*/44÷€b×ä.'ÊÕ£½Io›Ì-°{¥E;:4.¯•µ¦m¹ð[µ0+Uæ:›µªZx¥ÒZ·8§“­2–V.÷ÔÂAêWuŸJ#ùÏS5™.Q$Ü@íŸçÖõŒb.hbdgÍ¢8l•êbÚYGXmLçÖÚã…ß«ÒÉ0óH7~²cý) ´-¤ ª1©ª¢ãËÜ~"â¾› ·çºÿR\Hôˆõºß6WPF¢ZIZeJ·S!…¶Öê±sïmµ;]Q+û‘~·T¦t>a¥jRÍC6½“ÀoRn)°õ©i‚ÛªXÇ?fQ/6q)‘•ÛTKH˸Q⡆d+ûÊ ´ÀmÛEʯÒBäÂCµPê<.û„¦ ;tZ`£ÑK1S:`ý§ts›_äY’nãBØ%'ËáÖ(çG{¥LÓ 7§µ§÷jaVÌþb–_;ßÝ”êeZ ‚ê&LЂÚå¨ÕN€Eå2äÂjs"ØfÀAZ"~§òuØd£wŸâüÔB>;!+ã~]©®6ðŠ -” )Ü0AÂ0Øs¹öAÙ3:e$Z&ªm"q â¡íØ/g‰\§Û®Ã0ü¼m]ìt/vSáøBËM¡œ=W9!¹Bç©çiqÖµ¤²7T»'©›kÁ#~—&¦ƒN¢”JÔ‚Êq§ÑC ?™ªŽç„'ÂQEý  –~fgž›¸ÐY>‰—P–«Åo¸k\ç…DÕ¾ÖɦÕPºá!Z8¥@À]Š‰/òEM¥ÄÐ…ís8*W«ëùN.à¸s– a-Ë8߇~ß×CX3I Ä ÷b0<Ëz³÷CwþmZg™s.ýÔóvdñrêkp‡p›!³ÉŸKàÆ´äØjb†OùÖ7q¡Ð«×ææ ·l¸­\1Û%M©Ãø_ªqåC´P8;µÔuª”¯´K¸z  t©k½rÝt/^ÍGâæ<øÌ/£Ðð;¼9øò0rá÷há#ãŽåʾ_å¨l«,ÿüYo‹*¦.¯ ¬ò;ti³ÙYÆT˜¯‡²$ÑB@ãèîf¬7ܧ·4Æδ–ù¦ »ðÕî)ÎSý{´à{ÊÄ_ú -‹;Nzú|2æ%«™œËÙ'.÷¶˜p=ÁP\x”¤ÃìTÜŸ{²yÊ&¬îÛýÈ&9R…£*ˆâú…洞§ØM\H]¹Rh¨½à†ñCbGok¹°"±Ëcµ0ÓPÂ^õp¿So´ Øh€ ‹½»)ráKkáÓ“T§ýöWÞÄ…©eLô>x*~SŒAèÚ‚Ó´0F‰s%*/Eò8-xŠ;SpÃÕ$hÀ“Ä*ð‘LäÂ_­1¾ü˜¿¨Üï -,·Ï¸qÜy -eÇc1Í1äŒëPo|¾2^8ú‘µ˜µ1¸P)ß:* ’È4“‘ ³^¦çw¿ZÀU½-Ыõ©\8U1¡»{¾›+ÇÏïjÀl3¸žû¼o1nƒ<”óÌšáýH‘ _Z YQ-ß…—£ªóÝ󲬇,ËkpNʬÎ|Q×)¸#¡À’s?¥ex‘߬…Ûç#Mc韯…XäÂ÷×B㩦Tw»Ò8µVÌoÚŠBèeq™WNu™£µmˆr-lž­U©¯nÞ¬*æS\øÚ\ÀL”‚ä3·‚8•-¡WOÍZÜò]ç <èÙæ>$ÔîÝ­cÏ1ÏväÂ×您C­¯˜¯´RÂ-¸‹³Ç=•#p#Ãiª¦»ð!‡q·Ž5D.D.|q.´a¦4û•íû!ÙG-4vfŽDíÃP¼XeЂq·Ö­È…È…oÁ…ÎÊÍ¥žÛj@-01Mª>¶QïG†Wbƒ Øý¹¹ð×hA5¡?h¡Pµ™`Âo¹àSÜ+ÐÂÀö!%w VL3ÃÌ)×nŽ¹¹ð-´ gÌùþñ~ò¼ÜŽ~u¯Æ¾˜N=ïs’¼ó Xª›;þ#"¾°þ¿Ú~WÙD.D.üZ¨•AŒÞ>¹¹ðµðkïêöÏ‘ ‘ ¥>a‘ ‘ Q ‘ ‘ Q ‘ ‘ Q ‘ ‘ Q ‘ &ráOiañ†/ÿ×·sa—äY&‹×Z(žx¡þµº~xš‘ ?ÓÓßÄ>äž<ѶW=¿ÓðÌ+½Zå'‹g^ÈD.ü¿MeÖ}ù?U•2;Çßëñ¹ð -jáIXäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ¹µ-r!j!ZäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ_BäB´¨…È…h/ZÐy´‡[#"¾Ÿ §ãŸÇÿÑ,âöÛÙgé<6endstream +xÚÅksÛ6ò»…&×›P‹Å“õMŽ“Æmâêbyr3I¦C‹´Í†&UŠòã~ýíbAŠ¢d×½(sÉØ‹}?@˜üç£}&£Ah¸/ÌoØà +v~>àcäPFœ£ÙÁOot0àÌX4˜]®éh_i9˜%Ÿ¼Wo'ÓÙëÑ”ÒãÆŽÂÐx¯ÞMΆÜ;;y5y‡[Ê›ÂòÃÉél8âÞÉéÏ„8çÓéo¸74Ò› ¿Ì~9x=kÅj‚ÊôçÁ§/l€ü¿0_Ffpsæsؾ9¡|­¤[çgÿjIÑžЩ]&ÐÒøÚÈmH½Ãšùš)kJjïx8R‚1€iæ­ŠáH í½H€É±ÆÜÐ +ÎHTäq3²tߟžœ1>YÝûIž®Âd8˜p-uð,Ff¬£§%ÉMÄçü×÷ï³Â?~>‹"Чa¥‚(øVVº«ÒïIJlZ•¸~J*ÅØžtZs:½és +#¦˜z¦›¤~–õ:J1¡[V& îöë(durzÒa%9âŒïŸO×>"€_í'º|Ò˾>J˜ýës/ºú`|Ë0ˆ¢ïÀ©JûÁ …Ôæ;Ãb‘ô• åþ9Ý[œ”fz¯åáü‘Tâ6Æìµ>XVoßMû:ñ( ÙÞ­÷{•^7uôÂ(þ¯Ü 9rÃ7X*…¡]äåüë’æå%Ëì?©#®”O‹EÛgâÛ8Ëã‹<µ¼F 3ú ú¨½¬ª*-jBO²*×eõ@ËÌQù̥Ÿ³Éû£ÉèÕùô W‹*+êpöQŠ›gmG†ÿz¬„áBÃþ6á¿è +“ãߎ^OÏ´‹c°Çú\\÷ùHGY‚ôcõ4Ÿ<^¦Õi­\ ,\ê(M]›]¯ˆÎdQ9‚:|ÌôXŠç¨s¾KÎ"˜oTGo²¡”lØPJfÄ~Œ6=~3¯ÒâTøÓéñVòëPm´µÝ˜ÅX¨1 ÿéøÓÞ½š¶É©¤ÈÀ²>-ëlÔUÀ¼ú.Úh8¥#X¤Øžp·“Œ’<Ð"ä*» +ã¥>3®šc[ó–«pöw,ãeEËpPA åêŒb½ ÜÏ`lK«¼õ`tb\ZØ ŽOÍr»…YV®–Û‘¼­ŒÜ«c$—ÇuVÀ…Ã,¬¤ñðã@ëH.Ñ 8VË<]ô¹W´Ñbéíöl„{Ö˜–ì‘íªuWâ2åp±jŽyoYgxÕ·`.fË:]8©b<~‡¿`¢©,&J¦ÚŽw²µµ˜µËÀßG#2+lIÓUc·”@ëÚ)‹âäØ1ѾYã}Ø·Ç1Šµ€ºãè”EþÐ9ŸNˆµ)`1/WH,¡URÒøcQZ…$žIhåvUZWYJŽp;×M\î2HU"RhhvªB[´F±éåÙWÇ ·[pÑæC]µ´n;È%‚ë†Û$ÂÚÄZâZ·žìŠ×I>\ZilBS&``1žN$d¹°1—ÏñœÍŒ²ôÂÃ4Å­Ö-‰ _6Ë·÷úPyÙjZa>A€áM…V2z]ppqGFÊ‘~ñr´•¨³Î@ÁG.Íp{ŠÞ)/‘ÄËiG3+à#"xJ›å‚QŒô²åØv|è%7xæ"&xB™š.)€pM_]î°ˆ €ð¤àk­¥À0LÛd‚庶¾Î{á PÞ¤õu› €n¡‹uòγ8GG ¨AñMÚì5m:Í@ÈЇÛŠÂM Ín­l+•‚«T®fÞȵÝT"櫈;21^þ%¼Ì©·ÓX¸ñµ 0 +1ŒðàRÀúÝZ¦¤¥„«¤‘²[»ï®³9¢_Ó3‘m YÓXòç*]¥Ø1–¶ Û&ª·­±Ò¯ÎpÐêÙ6,BëGÜ*‹+ÿ‘w(¡µIöäZÇ> ¶ýx$$@èýŒ?ô«ð5LyVEáŠcèU ´·7Ÿcbdö–໬¾¦Yœ$Έ,ŒoXô´Èk+2ßñÞÅ£À Ý)ÎlËé½uˆîqÛtZ-ÝVÚ†ðN¢áFL†/Wµs í°±ìE=‡S&ǽçÚÃޛꡋ=G.µÃÞ æaïýï°'׎ + ½@ì¬ÏðC|¿éïm•‡€0ò‘"¯…ðod±Ó`¢/oó÷‘-ÿ ï÷>9endstream endobj -5173 0 obj << -/Length 107 +5291 0 obj << +/Type /Page +/Contents 5292 0 R +/Resources 5290 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5279 0 R +>> endobj +5293 0 obj << +/D [5291 0 R /XYZ 85.039 781.388 null] +>> endobj +1242 0 obj << +/D [5291 0 R /XYZ 85.039 255.301 null] +>> endobj +5294 0 obj << +/D [5291 0 R /XYZ 85.039 221.763 null] +>> endobj +5290 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5297 0 obj << +/Length 2212 /Filter /FlateDecode >> stream -xÚ`ŸÿÒÒÒòòòfff777êêêVVV³³³õõõFFFÂÂÂŽŽŽËËË»»»¤¤¤ - - -ííí|||•••………«««ÞÞÞÙÙÙœœœýýýúúúrrr---âââÕÕÕåååÿÿÿŠ”>­endstream +xÚÍioã¸õ{~…;Ý"2kHŠÔáA>x’É&ÛîØÆl‘Š¤ØÚØ’+Ë9ö×÷=>êp츃Ù)PùÈwó]ï0øã_ÙÌ :žÏmÇ÷;Ñâ€u¦pòó7=ƒÒká|¼?Sn‡3;`Ag|ßðQ¶TNgßZ'çƒáøÓçnÏq‹ûv·çy¾ur9u¹5º8\â‘´†~¾¸w{ܺ¸þ™ðg2ÞàY×w¬q÷ëø—ƒOãZ­Z ¨ Nÿ>¸ýÊ:1èÿ˳Àï<ÁšÙŽ ”­¤càùÁèà5+:“¢Úååø¶òm8ªåƒ€Ùžëu<ÅlŤöÁy/ñßâÄ~Ìâ£6<›/køïWWifŸ^^u{J(ë_Ü‘h1ˆïqÔ. v§×#Æëg;žÏ ˆÌ®Çg@Ê9ÛCÜÈþ­H¦öùåð¤W½“Ép¤ÉzÊö„ßé ÏfÑF‹˜Pé'Œã¸H“‚Àw_Ò,ΟVáUâï³ï¾ÛkÎ;Tˆ³~ËpA¿í¤å2®Ž'Õy·'8c S£î¶Ÿ4˜Ù¿žÙçÁ— Öèí6|q}ñ_¼ßBŽÃrƒ8Nî7/·HˆÛ⦾;2¤`ìûBcÇÝ¿Û¾k_siVV7{Úºeº-Z¯ÖQ”¬V÷ëùü…vÒlU†óyÛÈøýo§èª<›û®–0¸/!¯Lx`íxÌ*g°‘®àÖªL–ÕvB‹¸ÀóÇ®ð7ÈV³| ó˜À;ˆ ÏJˆKQ‰ˆòi–ðI +¬^hµ&\tôWDžgðë +Ë™dHWéšaAZPß”RÖ?»¾´@+‘%ZƒØ°Ê5ÑŽíK4¬P/XQX$÷Ú>‚Ÿf•I¨›B=Ј¥ÖkJ8èX­1Ò#j¾X„Y »¨Ÿ`Öiž–D®Y=ÃQ„¶Ï –SC[VLò"nßå÷FºQÇq!(—Úñʈå‹Z› !pÍ;ð„åk}¡ÊѬ4nh6´ á7¤Ÿë­¶À½Àö¡h)áæ}Ccpláín ½ŠW¯ÅLWýÐ澇¢–ˆfŒÆݸ&£×: +áÚBñ¢cÅk¿ŽB¶rCÇÉõhrròI7ã3ì¶ØŽ•„ð+ò‚Ü»Htˆ¯Bº0¼R&­ñŒ¶B2Ñl‚-!&9äW`=¦ùze¨nÊYGºòp)mé«û§ Á,̦(E@à,&ÎcI[)F‘VJ%ˆÐAK"pëtݨ‚µŽ*#k™6ˆ¬¥”ƒ²Wx„E꺰.‰Ca2‚<1Lu²Ð¦L´µ®ŠÆš–#ÂCW¹Vx7Ol]ÒuýÉáƒÑX˜ð—­#5UH[ ¡'„t ºbr&ñlõBØá3èô šJ¡é1ÇãWÚ#RUBtj›i?, %ÕÄF".*l ,ñ2ëøq¥Àø!Z80ø žNªêëî(Mx,u‡>•#á{ ûîœß —/㣺’6¤L±ª#²––#·GëXó¬+H²ÈÑ>\ÅI¦sìª#'¢˜Úe‰>È3 •À³R£Î U2¢kõ)³ŠMÅ9”ö#®TÍ¥Ú;›·ptö ¶=›KGÚÜ¥ã¸gƒPa»˜Ÿ2°NfIô€ÅÜã¥w1 žuªÕù¤¶ÎtR¢Mè:M>&tÁ´I’¸@÷<êÆ P½_·M6ƒ$‚˜žÜ#†fü–?Œ{ýÑàlWÊc64§ß˜+‘Ž Aˆ×œF!…‹t”u#œ|ë.<4Éø…©}Sä‘6D˜øK™ ]{Cšß“M…«½kê”V¬‘ixº­Ú¥‹×=*=’!“­2i¦‘íÄZ ÙjjöéseúAž™š¯'5(óÍ´!µèÒìw0#ÃÒbô&µHç2Ú^97ë1ÌÊL'ÊÛHT†tïžðbFƒYBƒ§+ZwíÀc̃—ÓfêhC#Ç®#0·§UåÚž¡ˆr]Íô ¥»–dt-gÃ{M=ÎéI[F°ô Õ®E7P©Ö!f"§Ô]á§ìRâéÐ *Fu96J‚TÅÒõ@[TøpNÃÔà=¥ Ã¶;„ Zs×·Z  0]AÊ<5 Üå¡3Š(û„°ñü…¤W¶ëKÌ>Ûu> endobj -5167 0 obj << -/D [5164 0 R /XYZ 85.039 758.673 null] +5298 0 obj << +/D [5296 0 R /XYZ 85.039 781.388 null] >> endobj -5168 0 obj << -/D [5164 0 R /XYZ 85.039 758.673 null] +1246 0 obj << +/D [5296 0 R /XYZ 85.039 459.145 null] >> endobj -5172 0 obj << -/D [5164 0 R /XYZ 260.019 389.014 null] +5299 0 obj << +/D [5296 0 R /XYZ 85.039 427.122 null] >> endobj -5163 0 obj << -/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R /F66 3242 0 R >> -/XObject << /Im6 5155 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +5295 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5177 0 obj << -/Length 2213 +5302 0 obj << +/Length 3017 /Filter /FlateDecode >> stream -xÚ­Ë’Û6ò®¯`| Ue"@ðáœìLâL*ñjgäÊ!É#QcJ”IÊcU~>ýHjÄñnm¶¦j¢~? ½þ¤—êÌKR)tšz«ý,ô¶y;“#°(ÁçÍröÍqäÉPdaæ-7#"£½åú7ÿ»_/–ßßÍ­µ/31’$õ¿{¿˜Kÿžww·ï–·ïÞâW›Ò¿@ð¿îæ©ö—Œtûn¿þåÍkþÒ"œÿ±üiöý²ç´ç¸Êͳßþ½5ˆôÓ,:K½GX‡Bx?>…‰´ý®f÷³÷¤y|jJ+#É2e¾¬¹XŠ(Ö½æ@¥ÈŒAÍI©„–ÊKL(L‘ê€f$@\øú‹¹–~Ýv÷«¦6(Þa®R¿¨éþè1?Â"ñ ¤gÏä#Zkd°EàVUŽ„ÎS„gÕDá5 -Š -$Ú¿)zRe˜Q˜øÝéãŠdØПð_Ýäx)!¦¤¢¾ÍWg>±A1£0E‚¥jTì㩼u¶]ñq¼´)­&P'[¦ánßä¸ÛT–tÁΰ÷ -| -ŒUnø®3ñvb´^…¶"Ž‹ ™„n]°Á£4¼`§hZÞÌ-Ð]A&Á 6š -iåÕWó M#¹cD)bZõä-ÚO¡@$HhTµÃií¡µÛø„o–—Ý`ˆÂrÇ?ÈWYuÁ„°%Þ¬² ¡9¼h»Ê[h½]¾‰;Êæ]X îwæÇcºâƒí±äèÀòýŽ±l04üu!ƒ%|“¶a ”~QÉ!„Hw·¸±ÀNixϺv©€8­*ÇéT$ïXP@‘KN–ú*d%`U†Àiú¤‹(N7¸žH xzÝPØ=Ž­jr‹=*’m -›V˜êy#ge·ÇœŽëcÔÝɆa¶ÂõYM›Ò¹YYš7jr¶äi¹ Œ‹þSZxÎèÈm]‘K>RNÆßu}p Ï!–Ï ™/Õ®þB,ð2Ì\Zšü›Qé©í5åï¡ÔEcK\c¥ßý¯ò4zÈTÅvŠÌ ðœà¦È(„nU4~X”_éøÚÅ[}½)·e_1Ç=ˆëLÍ›Òÿ¹C“Å“JI¡ÒèY:t*:¼btý„NขÔ,E¢‡¾'Q]Z"â xO2HœŠTü®f½J.”—¢Zô0t¢é}ô¤£,ÓŒ3Z“ƒ`´ñÍí^z75pê]0ËtƒanÒÒqv7±È¢Ä3&™Œ‰Ùå -l“SåEÎ9U0è{ôlÛ :Ú³©·hñ|ß2†k¡„òл"´ç–}Úø‹‘{¿Æ¶§¶„üô¼¿â{ns8BJ®¶ ’ÄJ(øÁ\³-¨ÏCm±‹› r:¡¹4Š£ˆ2ˆ‚Í@rŒ&¦™ú/.B§›âµ!Ù]$§Ît¤¤„ðÉ…JÜ(â½!Î5˜7Ï îÌüÁîž)Ÿ˜tWó¦m˜ŠU¹±‡ÑˆXŽke[héOu2]SWx:¡3•]׎WêÕSnÊãÁÄEÃxí Sˆí×ص¯ð -U$Ægv šbnÕ:¼îXÍí.bŸ«£ -!®kñ²¯w½Åh@¸^rfï¶ZB³ÝöZo˜QS5‰ýª¦Ú]¹çÀ¥/Öf÷j}øÚ•¯Ô_íjÛ£Ú;÷ gþàs -`ž¯ªãcõFlbÑ…Ö{hWË^&}¤!øÏúc3q’¨Äª¤rÍõ ñ~¥a"-# Ö­_£MŽ•=åT×N8oúÎ%‚Ør=5FãƤj÷" ú°·¸Ç1­LÝÌ·6iO“e”H˜|3o”€ÿA>Ç¢!³Ä úÙý/2`7¡ I… -“kb \ÄÄô“7=Y±¦ü‰á[) E(áÔï€WºÃ¶ ¦Ô••ËÊñq–@‘Ê2¨R¸£b(¤8WW’ëºâfiŒéðR‘/Ì$PU¢jNZŠ8‘ýLOÙT…JH*JP•´šëZ<{&".ÌÅLô„2²ñC¹=Q;˜ÒK“š˜xb=‡²Ï«+v“P¤`à vG¾À8Wì]Üó”׋¡ÉtM‰}ÔQ¹ºcßܤI ‹Qç*€”¤§£/({‹(6ÐA€§ä7…†(“ÿì­÷(èõ"-ŸyLRZ€O{‰‚~ùúq˜ÃŠOý`i[sí0u¡Á Ñ9/$ŽŽC>"ÐÅÙZ¬ ÞLhÓ†A´ÀÄ%C(I\ÁíM˜¸ëÃ×ñ7霼sÕêÑRªÝ•CóÍs¶ÕÅ÷…3“?¹JPôŒ–V`¾õ0ñ” £|ÄÀ‚^ 5Ðy×ØÓþÏôÐ@ ¿oÐ3U1õŽ CÈÙèŸoo~~ÙëÚµI«Üj~-*º¼9còϼVq•Mû¨UØÿÇG#-Rý̃§QJ(éxA)!=å×hP.¤Í+†ÿ‰tæendstream +xÚµZ[oÛÆ~÷¯ò +ˆè½ð²Ì›sk\$ŽOí =h‹‚’(‰0Eº$eÇýõg.Kr%Ñpê"M¹—ÙÙÙ¹|³Šœø#'&ô…N&±‘¾6f²ØžˆÉf~:‘–bfIfÍ›ë“Óa4‘ÂOD2¹^ û„~êÉõò7ïídzËë÷¿LgZkO:‹cã½ýtv5•ÞÕùÛ³O8x—Ðýåüâz:“ÞùÅOL4_//¿àÜÔhïzúÇõÏ'ï¯{±z† B‚2ýuòÛb²ù>¾NÌäÚ—0½=¡ü0ж_œ\ü§ßŠç‚ ¯SA¨}¬::H"?H‚I +?éà㻋ó+!ÿ\fþ»Op^)ÃPxgÐãÐ tƒW»r: Uè}NìPÀ"x­Õki¸§„Ш l&QðäÓÅõ‡CNq"<§år›È…{(Ô+G ÌÈ*<ât~qîpÒv’B>ÿ‰–iëðQ|á2ÿÕ-³ÕáežŸÏ¦¸u$…ðt%É¿À©ÎA+šç7†ÛÛåá™T¤cýügº+8¡£guÚ¯¸’ŒBcÌó³úøéòðP2‰cñìêû³ÎÖÌÍ$ι”2Œÿ_nñ¥‘®i"‰#¦šÕâ¦ávµâo“ÿÙ="%ƒÀçN¬åñšô.Í‹t^dÈêôƒtãû,‘~¤#H1HÀ¬Ïʪ…µAË÷jP¦6ÞÝTr˜û]È`‘¶yUâtâå Û †n,PðÚ|KK›6ÝÞò4žã춆v^"§™”k¦¡,úÞ02‡^Á{:À\ ÕTÅÞ=ï_ìa”,ÿ’'~‡KI‘Úö™®jhÏ|^ÀÌÈ!tò‚ 5gõ}ièZlÒ†çórQg)í›-«ôIû|ÁáŸÄ+ åj%ŽñJI_E‰ %öA:…ŸÂ{»É7 Yyù +¿1œ)ãÆ»šôwYÍC¨W¤­³Eµ.átKŸOµÑÜ®J·°lž>v¶0ñe>}¶†Î¶g§Ý> +ÌT):ÛE…–÷¬ƒÐžË)š(›+ž!<Ò=Þ[µ+–<4§Û¶KÀ¡ó¦µÖ>X ÒÝçpáÔº‚žóôæû65A·Á‚P2¡½kÔbñÀóVZ=0U»É›WØŒaaϬ(¸µ¬Ém;·û§#V¹­¶d_ì;(!XàG«<¨ã¾ 2Ö÷è‚Ep¤7¡é ÇŒÐ8w(Ì7R ȃ:XCÖŽù2-mÚt'6‹ +@Ì@УM XÆ +¬µ 5gË»´ä(Ò'–¶ +’º]Ѧsb¬¼nFÒmrKL@QÒ°ée”Ó ‡kòœóQ¡pr°! ¡ŠR¼“h³UU³¢(8æØÓvì®É@$|0Gy„ô ÷¹d_+¹ç䨤Ea½‘?`§²“mŃd)›´\gA8¢¦-X‡ÈnN~j,Ò:[a .ìræ²›T9%H¸ü ‰ŠòR¹f„êôÔÍ‚@yÿET@P‘  c_‚Š÷÷.òn¶ej&îòÎnîy"%ˆ€ÑÇ=¸Ýæ/¼GEȤâU{à…ÅÔ(&ß=”™]Q•Ùˆ"š @'ÆÊ:Tz +! +o«rÝ´<.±Eó’®á=Þ”M§0ÇÈqÛß,¡´ß½@ }‹†`QU‚±&ë4Mç Ä`g0‘Öl2yùí®Gv/¦*ó‘¨ÂÃWo5rîÁ‚2,^¶ÜÛ¤8×9‘†ÐJ»Û y°KPÐyš"(×]wZôµÃ’'WhŒµÝrPÌÜ"iÚ®(M‘3½²ÖÒ97,Ácq hm^1,Î!\è=9VüÝ;fasÜ wS{Þ¼=~¾p²1À)Ž?½?K/ Osú†ßs +¬lÉôà’^\ŸB-,N½D"zȨ ö“$xÈ84™ŽèG@æ)†=9ä8 +d\Ž½ê”I0š+ÈícFƒ¯‚[¨@¤5Qßõì£ÏQlû¬h~†&Òj§/AÉtàþ"ã ¤1Ưð5š†Œì$^ûz3§Ä +( !’æ¢e<ÙI%ý8,°`•ÄÖ± ó[‹g˜?”ÑžO®H øt`ß(°ìGt‚1 SIú„Á¦O {ˆkÝÊ~½JŒîòr(ö´'“Ä…<Ä`ÇZ$$GX µ~baôÙÎ(‹ìa–0ãÆ=„9Ûœ§–×ÕŽÈØ…`y®ÑVlÙF˜6èÛUR=Œ ¹øV8Ru/³PBi ˆmÁv2¢‘Øjë®û*«ï(„ãÖ€q~ É xXäTnÈðKÉÂŽ°*ÎÆí2§E6ûöiçõr¢©„Öþá úHû±êîm³eƒ‰P@Ö3¨ÁÑõZ~À¸¯( Aral¢lZÝÛåׯ¸1ßuK©„BÆp;@ë HCôÅF`œæR倎lÀÀÕ†i‰F‹x ã1åäýsYÕ¸FTt—/³î†lãÅ»ÚróÂN¥óþEñÀ¦• +Ä+÷ÉC{g%‡Û´ž»J(øZHMÓí‘Vï¯_¬ã8?ìºO<>VW/‡ù_ÇÚëÒ?t$Ûq¬:ŒTÛ{‹`v¨Ö¨I‹jÍsd/±ÞQÞN¬W:²’ +QË"åÏ»/WÝb*÷qÙwAc¼,–VA•ˆ\¾ ~"h†°°ïé2½:9öý¡äÌ5ëŸ H0=€2FkÇï ̨v^œ´ ,³tiAÈHI)òìó›3*Àß~½¼š2& £‰æ_T ‘å­w]=YZñ^nvØaÓ_Æ|uéT„_Ïß÷Dµ}Î:µO\§­Ýé´d›ÝƒfJ„>Pu‹«5ü7þ˜7„Š«³ÏüËœnFÇljñ“P? ’ÇQ£¥ùh|‚[ØBF‡Ý¶#BŒøùzqþ+¶ ÜLµíÌ &øòxjp˜ Ð_m·¶4åª#bäHðÚvó»)ä½´ÎSö~ÿè *4°8&[ÂÍûMVgL|=Ä"ožzçŠÀ-Ò­m‘Eº‡{8v÷ppÿ-ÒÎù´÷âû÷ïÐûþ‚»ô«.TuÖ8Oç oåòJ¡xL ^6ŸªùUûž¶¶ í`¾.÷^~ö (öuÇÖ\í£Ï·ÂWɘ9Á_Và?ú×"Ão0Ú7:·ÉP)_ÉN_‰àPÞî_• ü?]×p–endstream endobj -5176 0 obj << +5301 0 obj << /Type /Page -/Contents 5177 0 R -/Resources 5175 0 R +/Contents 5302 0 R +/Resources 5300 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5154 0 R +/Parent 5279 0 R >> endobj -5174 0 obj << -/Type /XObject -/Subtype /Image -/Width 780 -/Height 265 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5183 0 R] -/Length 10989 -/Filter /FlateDecode ->> -stream -xÚí CÛ< †Ø9œÃvî[ýÿÿò“œ´” >ë -‰ ÒÄM[W¯ËgݱÝÛòÞþß&Τû[ØÛýM¼¡…’³èþfs¨#¶»Zöm-ôœOw6ƒZhOlw5V¿©…šóéÎFZˆ8îkó{¸ÀZ¸³É•µð)ZP¬…/§æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0X Ìæk¹À\`-0˜ ¬æsá«i!H2´©-þÇgüï¡Ǫyézœ4/>ƒ®ì7¿º>'sáê=ùËÁÿ&v¿=ï·4N>¥a.ü‘…çµEëWrNfý®÷Tã _AÕ³ÇC¾Uv¾y>Ÿ/¶0>Oœýh.Lö(FûZ_J’Ìšx?Ò«}å&8Ö¶a.ü‰~uݬ´¿8ôÅ -ï¼ tCGæ¥õGƒ0xîbp.¾&ÈñæSb ;k¨ Ÿ‰yø£¹PÁ‘w9/§lù”øì$XȼR†OŸ¨<+‡¹ð^-´G–ïî*ôÙk…ö.“œµ¾UØÝu¥öÚ–òäô^%Âÿn‚3—Åc§ãC) %>S[À÷;táþzúx]üýŽÚÂÃp!9K M $OZ0»á;] _|µä/Í…ÃŒ‘T½X'_—É,æ÷dÀ®µ°íYí¿1äƒ Ñ»Ã:0+Þbœ2 ¶v§Øœ9}Ö©ÆoºcÛxÍNj‚l)N[Öàëmøº¦B)ÅkTÙ\ßG ë—Ó‚lËzJ÷©,'Ìóf„0Z-Ør¿Ô6ÛÕÕQ· -Ê2ðZâªÌH2M«Oq$—¬ŒöÒ¥©Ê*þZP_\ Ú¢Z °¶TSµÞ–e…OЃ&[÷ô^»2ŸŒE+'*¹:|ZBO(B aó‹räB˜8À¯³ÃØ®^ñHÖ` k1¶.;è%~ˤ=w-| . WZP~o“žã3‹%ý=ŠúÒ6îEË@\Pá%†[r: -j¡÷÷X(0eb)^Ó{ -`.ü¤”®±*¤ÐW1‡WÌû(Ú]W‰ïÞ˜¢‚;Ì|©Ò€Te 12赤Ùy¯©zd¬¼Ô‘Fº¹ªhÍýÖEÉ€´`I=›¥ÄÝèøÀ¿• µ™S÷ùè_ƒ eëm¥,(¡\Dks*•Fkæ]]ˆsÉu6¥k¸FP ‡Ù_o×µÉ0íZ(Q*q¼R~7"î¬þt-|].Øu]±ìÀbþ(ƱhñÁÒf9ât¬,QÉ£©T¢Z”+'Ga©¿—5§T ú·â¢º9=1¢’/ò7¯1ÕÇÅ;Ï°ú ½a¿ôƒ¸p±à$ì¸çZ‹yL,HÆô:^(-¦|L°až»n•>û<z¶¯xD¡¶ €;Äo§ôüåÚQòµ6æiÍtåLN«Kb .±³w8ÃêOINÝ\ZŒÔñeÈÕ·vH¼þ\ dë8œÎOÛµÐï͹ñ®…c…²ª°ê…Z¸_»Ò×àÂXy3¨…`ÏXÊñLÌ{VO±³\,–9¡u•?ò$â! -1ÁñÍ¥âÜŽdê3&ïýIÚ~ÐÌÊ\xU “C;Ž½÷c ,N툰è^ Ë°¿ÿ¹·ó©ƒâR°ŠC §] ÎÖtö©iÄ{KyÔˆ‹‹ÂýÄ¡…ëš×§æžZøjñ´ïêç‹Š†jƈž´Pbv/x&&-l#òܬøðR<íHr½h¡õþ—cx/˜àNÑØwnGòïÁ7!mXOñ­žXv-Tç/$Ư¬ß¿¿¶Õg-d{æ£0Ý3.\}¨k-\qa<NϦØyüa\¸jGŠÀ7!{v4Õ -^ W\ r?Ë0ßH b…~*\„,Þ.j¶>ÚTw-4WZQs1‹OîþíHç@Áûv}»ýME˜ë55âÙåø:¶Cõ}Í…u¿CCZpoiá9”õ÷)Ly_-|µþ…f0PœaJ¬A¦ëþAqs·ž¼Úýëª0y¹w7„«8´`~ã‚4{ÓŸ®…ïÀ×Aéd`mƒùX¹“ èv|–˜ÌKÚÔ䪳Å8[ø]i!ǧžÓ#PVhÝ»¹Ð›Xà‡¯¤œ;ÔØÏ‹®´ Mç¼+PþG>ÿÊSWýÎŽB`ò{ÒBäój1@UËUø>ùŒ ×ZÀÃÁƒ½þt-|ÝñHÓÓƒbk€†ºÄÔÌïs]"©›“÷Æj·>Xé´:i}7ñý ôðÕÖÎEYvíÙ{˜Aã‘æ] Ôé@£ ê“ÁÀ;ÞW æ Áðý tS;’ó7`§¶¤Æ½ì8þÞ¹0þ¦mmÙ&æ_ >¯Í|C-ð¼6æsáËpáGjáѹPlÌ6æÂ75æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0X Ìæk¹À\`-0˜ ¬æsµÀ\`.ü`-Ñ'ØT0‹ Yÿåm|s¹Ú« úîh sᱸ—·7e~ÊÀÞ]¡ë;´À\øV\!ɾ¶™÷h!¼{–GÌ…Gã›_Ù\ÿ}µÀ\øf\(Ôö…-U9síN\ø€°´ö?úõ§¦é­´À\`û²\H·©¬è'i ýª /ÌæÂÃs!M×s‰ô+r)[Í\`.<<ÒÊ6j£,‡Õ×…R²ãš?P´âê1U™>Vkb.°}i.tH¡…Ó9ÄjK…N7%ð6ÇQº‰‡î'SM¢PJ«T1Ø { HV0èTeájò±Q›šÂuÍ3%¦Ö¾P:êÍF:ÕI„]¢˜ lÈ!ܼÚXéì8Xg1áQ½B"Q ]XˆL=dB„`À–‚¹Àöp\¨§,KJ½Ò ØFºÂ@ :h¤lìº9ª#é®ÈÁÚµ`‡yN™ lÇ…c¤P+—"BŽ¡²Tˆ Ùt`[!J¨høZB)UÊñÛãqaÌ,ê#‰ÏUÒ5QZ˜d`FjZ‘ö–eYõx%D¥pÿÛcÆ Nd`©áT9õ4˜„ʈ]«=¶ >H ìoxP.dõçZÆ\¸i;…ÊX=ŠÀLA¬BÔ¢Ҹ­¬ qAõ1Z3‹¿ÐÂCr¡ûäqðsá¦ZH] v#d'-ä²v›xËÌÇή‚Ñi-K8æÂsËígƒ¡g.ÜT ›š V–Jè÷ÔtÚA¹¨ÆÀ ¨›4¶Ðªmˆsá.¬Ÿé.íƒká¾ã‘öHX´°n±»ZÂ(K‡h…˜@2–âëû>;?$:#?Ñ]"æÂÍ´ÕÚ5©Ñ”}_sm".Ã. tŠu8JÄc××HUt<ƒ¹ÀZx$. œº:RBi¡”Â_ j_Ò‚():OµûàŒ!æká sá'nçñ©9§‡¹ÀZøÒ\¸ëOækáqç;3˜ Ìæs¹À\`.RÕÁ$¾ €mµ`¶W’LFü-0~rS¡RtUåV=W3vèh;fû_N~0~©n—@ùZîXæsác\ðZX±Ä³Nõ/:¥^楈ã]ºˆgL±ù³q¡õ§rá\꯫wA¡ôáŠR‹C ?–ò$s¹ðN-k0‰ˆðw¦6µTzº¡¨,Ø$[åÏÚ°ÑŸÇ…ìá×9¹ ¨-€©ßpØ`.`õ ³' ñ]3zq_¶Ö ÌæÂû´ƒ.!Çß­Ð5:TC¯SQB^ö`!iˆgñ°ÑŸÉ…ý ÃX¢ócu©†®ÁƧÄØ0A@XâÛMOÎ’ÅÌæÂ;µ`¡Ö2¨´¬¡v³Y'å± S«çàõ|–r‚\}ÚºyØiš¢©&·GG Œ@!ŸÐ,DT–hh½£L'g ©d.0ÞYG[(=€Á EßÙÚX¦K<ÂàjÈ0´= ÊÀ°ó–‹J~ -hÕ‹²† î$Å`­ÖÖÔÒ2{›êBáY"¥}³¿¹À\x• ¢¾Y4Ö¿R)! ³µ´ –ìb¸e;Rå—¡¤G„¤¿qMW‰ Ú^<„¹À\ø.¸Z©”Q ŒRQpMÕ¥É)æføL.¸Ý7¡ÁÂÚ‡ X9ßõf@ï±s¾w¸u%Æ oö½1˜ OýÎ;†ƒ ½ `ÜÒ¹¢æÕ­ƒ)niþ¿ŒÀ¶é<º¥Ÿ/¸£Mu•²ƒì„2 ­O€ºí$"#Ø°5*©1î§6Uæsá½…5jÁvÄ›“lH= k¿®¡Í„Ž{kMßÁ ubìjl?|^ÿÂfÏžWÚê4¬¶ï×1´Å©]íŠbŒ%¬EEdÖäƆ -¹`n¡æÂãsaÛæxI·¸À£¥ÀßéÏH‹¸šM…*f5Ç…ë¡Q©Xš((”ú¼~g).wÐZžäÜÆèé4 C.ð"*¦š“h‚Ƨât-0Ÿ 4ÜŽÆ=Ëó¿S¥µJStÿÌ&RÈØÚùršç/°“ o(#Ó(˜V(õßnmËóÚX _œ o˜Ž¨ÏÍÖê¯wyf.°¾5¶MÄS25âK/1X ßš 4kAˆ¿§sµðÕ¸ iКâþKf0X _Š :(˪¢¹óâþZ¸œ¡Ê\`.üµ\}lçb2ý-¹ ^èÌ\`.ü©’,£í -?8 á³¹  b.0n¤…}°é¡N…Ò#‡»½ÿ nˆš*L´ŸSþÜv}ΉÔ_ÄC}O.|Š˜ Éê@ÞDfÞ¢8«Xom=Ö¹»VÑ8&±NSgãlšºÛÊqÌbµ)5”c(<ÒMŽ“Ò›¦¦¬Û÷´3Ý K¤çºni˜vxW,’zŒ´OÔu$?Ã9.Çlc.0^ÓB¡•R.ƒNÍvµÖñ -}Ûù0ä6-UZZ†v´˜l>Ž˜LÌ¡íÇòB-¡5x® ´«ÀXߧ…›q!‚n¥wR¯#¾wqÚzÛ×£5¨Ú°îŒ%Åô€‡¶¾Å˜mæÂCr¡Ø–ei-$b¶0m®arΕxBåОdc!ŽÀÒE°n"”²…PJÂ$ñX>6›KPEœÞ7^hý¼¶ls’ GŽx¿˜èŠ ɽCJ*isRæsáE-ã§Ï÷r¡Ãˆa3=ÖüU+þ7›ÚÄT=º”s'üãrÓh!†X`i 3êfXeê •MðQwŽöÝ+3ZæT£|‡DûKJÃ/³`ªÙ¯qr°JæsáE-øƒúlQª°£ÛTìçò£0ìQ@Mýq‹…º,˪C7IP7Õ 5í{kÃvvJŒ$™ %QªwoëyS.PL>Œ®¼Ê¢MrÔ‚Û}Cš™­² ˜ Ì…µ/Å<§)£jG@ÈH ‹9ƒZìËFÚ£ÂV®¨i­‰ÕÐŒ–†é-¢_ió6QA‰®øÞížoÊ…Òk!9´ iÕV>´€\p;–‰ÖÕÚÒmŽ­´¸‰S-Šå@+ň9ËjÒÂÁ…÷k¡ÿWZÀ¾ æ +Eâð Œr -##ü<7¨#1³éœj×BªÖNëT Ð Œ­Di‡2‰QBÝ7[˜I!DhÓ©¤sB@A‚@~ .tþÆ-E¡ŸÞ`ªcâ%,O¯…?àBdY’Míÿ4æî‹Gu8&éK×›$~á Ì…Ûsá¹6‘À8«¹‡Vˆ¥"°K6Ú¶L!rlicr ÔRÂHzR• +Ü—àEú§ÔÐâI…íYºTB¯äÜÁ-´ð\èÏu³×4Þh dZ Ö…^ü†Ÿ·}Msáha¼æT±‚]Ñ{ôFŠ0!·Zdà-Z„JQ5PgÂkUús}¡°žôþØù\Hɵ÷…T3;—0Qh°v6Ĉ紇 ¡E÷v!~.<¾ó:!ÔQe5Ö9_{½Æ¿ïr(âÉÚù÷m\?t6a.Ü^ º-çsg@º”¾LWsÒwaä÷]Øʼ«Zl¨»¼Œ)ªnǾ[êwŽÆ¼OfÁu;v}‰ÉuP¿w‹«S-± +ò•†OCI‹_Ôy˜œ‚’‘ªjp6Û}ª¯ÛwÔ¹oÊ…‚ã£T¯½¾MaGÿ ~ÏXC›1n¯…M‹§~±ôH¤ÆÅÇ¡PJè=!ÆÊþ†‚Îùö%q>—úsÊχPÛ=¹ð–MÑž‹ÁŸÄŸ7æÂ.¿fÿ(Q]·ûúfmY·˜6¡låvTƒã¿Ì¸ª«†Ò4"ÉDÍ4Î$­jªm“ £…¹ps-¼¶dXútøÒQúkº«g|©ym#º:q[-˜?×Â@]Mo»ÕTfÓÑ -NksÊ0®É\M[F$==³¦3Hi×lœa½/‚p]sZò©Á:l70Ǚ×V û„~8Ò'rAJéŠZ#¥9ˆO-x9@/1¢i¤_>L8©]6™;ÉSQÛõvJ¼ð>èF`}*‘’¹ðPZ¸Ï|çaÊ‚?ÚÊóæ\0+(Èöh Åç®à+H)½Þ>ˆÖ÷aºëè×|e!­¿¶k!Ü¿ÕiñccgæÂ}íæ\ A.¦ËOö_ ~2XËù©‰îg!PÜ°ž‡L9ë³h×B¶gHÂíH÷ÓBúg‘¯ƒñ–"‡vûz¾£&¥©£í ›C Ò_Ü -iºã¹Âø®Â] Ñ~½d.ÜM —Q¦ŠVÈ 52ö©k4o-â×e3>ºœêâBðë±Ú_¡H •t^ •9º–;|dÖýU¤³ÆýÊ…Š¹p/-¨¢.ö©œMU’%Ù@››/YU¨%©JüI¢Xœ×ÑècÅ\xO;Yµß:€HúÆ^×ãE/$çÛu]‡Ö¿Hìês¼à¸á.ZHŸîõÁÙÂ%U³…æj¼j²ßO‡"e.¼S ©±ú¶ÆÎÒ@&ellA¯·HÑÛ:XÔÒ—ÙØZŸÔ³¼æ5.Ôm.MXæÂ?ׂHΊh®Î€´=Mq;k! -‚ ÌyÙ @©™ ÿ£…þJ §ØìƒZðÈ‚5€N~°l)NbÝK™zÿØ4 -#ƒ}¯• -ëGkWÈ•—LÌ…­UØü(çQ ¹Ðhn†PÐÌF£ -:''(ÝÑWB¬˜ ¯k¡õ#AΦJ¶BGKöµ¢±Æ3zû~<úТ0i¶v–Ñ݆ªÁwU a_ù›Ïõ80þµ Ù -öy ‹í/\°Þñõå9Y{9d.œþÝü…è]‹¢1Þ§­ÞSVÃylj¡§&#ç2ôö XGŠiêÌ ’˜mØÆ멲>‰ éÒo® ¬bk–ô¢“kêê/Äé²Ì­¹LSHÓÅ\`-|.¤Ûj²Eüÿv:´k§zÒÂa]¦¶K¼` ÆpùY2©ß7e!Õ»¥å‚<Öû™\X¢øCZh÷ éË”¹p¥…ÀÔÁÿªAL0žýµ°m[ƒieº]¸P—u]&ír¹7Ms~‡Ò"Øí<_â¹ W|ÿÛ×ÐÂ÷™ï\ïÍà¶øé\HŸL‘¨¯`¯·Šcå‹s¼€á‚¬Àú‰ ³tîX;õHWžÛ”Þ˜5t|)ç-pÿœ _ˆ#ý -Zø>ë`„P·QÂüýµ°Á›{sW¯iaB_LèîÜs6¼:ß¹^Õ‘¨IéÖ§¾6û[ª¨ý‚Jo¶PE`-U¯¡vý›íy¼ÐËÒ¤Ÿ¯…ïÃ…}8`áøí ×7RÔTuxá¼ð¹ûŒÁ&¯-ò¨†£õªMU7–&7_Ú‘Ô¯a@ø®éþ]Lº†¶ˆw+:»èÿ5%ð;¼èY­ç÷Ÿ=¢°n¦HÊh’ÿ„ ­×Û+V¾Ò -ª°à/Ô/ý Xq -õS;Ò¯ZXÌ»:Ûðv™S²DW¾ü\¿üÏ“_¢ùàq¸@M-Xy² þ!êäÛúNùF’º—N¯~ÙÇ+3gO2íkTÈúR_êTzt:d´ðð føÍïuó„’7¸IŠ>®Í{øÿÿ{þà°µ}.tXúˆ²”Ò¼]eüBüî;P§oo -ì[I’×âE‹z͉£ºÝWÅë£éD{ žÕPf»fôPgj©êB-eùkg6†ÎÑ{$!ê Bˆâ¸ñ?qgãåmSôÛùÁ|Ô‘lžÉÓ£p%ïGÎìM Né[j¡Ü‹õÇ·#ýÚ¦ -¦ŒÕÿö¸¹«B—Ík/›}â‘s4Á¥¿õÎõï¨zî®°×±ó›nó{ìlËý­Þ• ‘kªSð›VÔÚ7·Ó‚*Š"Æÿò!´pÃþ…ºxkkfŒ”ë?^$üzóïõ7ô}žç}xî¤þóþÒBùïË·»r!­ #g­Ü¹BWÖÖŠ›iáìv\Xºb̃nûž×ãK¹s~ævZ`.+rqk¡3{ÿ‚ì!+ô{_ÂÑ¿°’úkáo¸PV‰ŸòP€3ðb>Töà‚lbŽ˜ ï4 š6ìê ë<ª¨ó>Ù²V§Yë¨n”ŠëðصS5õ ã:£:ÒTFÿ‚°\{ú”Æj:@äƒPûmÑ'µ;ká,<)ôÙ£)¡d.0^ƒSZŒðþ£Î5áÔ"hþ>W3”ó„û茿jG2á)¯éS†{%i´™Ï‡¨°áŒ.#Ø8!-4])]7ždXÇ=`õü¹"’D¹f.0^qÑËÈÓ† ~xPêíû‚æ4`¥•`{ω:À|5te‚Ñ´ï“éó%±òØ5õñ‚´Öô5^Vt뾬W° s¹ðóñSŽ€š`&-̦ßϤáãÌ ^Pì¼"M`ò—£Óæ=^æ ˜ Ì…‡˜ïÂ@u:%ë©%.P\ ŒçQ ã;×àwÅ$-Hã]?AED°ü¡b.0… Žvÿ K¯DÙcàµPíÎ`Èí¬RIg¡Fü‹O2˜ G|Q.ÄøIcaâ #EÎSx­…ºò²sÁ¿dBZ€C ÌæÂÞä„£§éÿK@ÑØÔ—S)§?¦™[qDµè¤…ÖXR¿ÛE ¥•²#¿E.œÜ“¢}WñŒãæ‚÷ã $«²@½’4ÝfômµDcß­þ=•jÊèÙ\ž§Å2îÆa»>?y-Ôèå¾ß-:kúèžqêH‹¿üÑØ™¹ðh\p~gmc-ô/§M—<›ŠWXÃÞØ>þ-•n!¼âEªªñÓÜnÃÒÖwH-ŒøßdCÔY|ìàà‚£K>6'i/\8ÚT­½9N¬…oÈÔB-Šy.è¯wÏ3Ž#U@åRQCDU¤F‘ú¼»cmŠ`À¿þÎé.×é¹0ZÔÂì=ºµ˜™ÅX¹llˆpð.ø–ÕÚ6ÒvèÃþQf'lU‚¸-rèóOûé sá/´ày±5Kºé4Žgßë¬U/´ÔEl+tÓ;ôvÑ€iá‹9.6’΢–B¥¤e >•ÖˆéóôžñÂ>P[Ф 6"Ý ‹?!µÜxçÕÎ'ò O/áyzBbÝm¹ÃçZÎ\ø¸|T°ÚB‰¡Ã*S=ëM=•³h±è4^WMë&-Ù´¤j© @iUç±Ù°–:^« S&H‰Õ‚©Äý¸ðñŒµ¯Òô§Ûraˆ>×æÂßp!Ä=X[£Ÿw³¬ñ(C&d }TÐh$,ùE…*×Àf&‹#Ž$ÇŠÖZNâ~\ø°au)j‚‚Óm¹Àöã…e™ãJ‘®ÐJ·õPÊ‘F*ÄÆÆz±‰D ¬6/¡1Ž¶aê$MòA-4EÚz-à}äb ®ïß9Vï³ç;Y¼”uǶoË»·#…X‚Î6%„A,âaAϧÕT\†XùzP"F —j!qJìZ0‹ÚD†ŠÐy¯ïÙŽô¶STœ>¦æÂr¡+˺Ì¥°îC §ª3ÛŒá„Ó¢©Iø±Új›íB‹n¿¥BÓ|7áÛTQ Ô®ªi¢›îïÛŽôOÚ%™ ?’ å‰:žÇ"ÛiÚaè [ Ǻ@.¨!i0rF÷ï!“!µ%Ñ"«ûÂHBŒ$iAä½ú&\ø-02^8OvÎ`ÔmlÖm™…›'•+l)Ä™_Š^’tj .¨6Úµpp!§êU„xÐýûµð×\îb¯¶¹ÊWŸ{½†s¹°·©úä*ý©CßV¡i„B?¬%Ö‘¤Â"uX‹ÒDr‚À¥:5½¼æ‚…r#$Bõ½P÷âB`1Öñ¶¾r'aëWž[7Ú–¹À\ø] 4Û¿Lié‹IŽÐÇi¼Â$ -Û7ÆÒk6ÄÁ9qà é\cméŠ òXµ` -%ÂËbÿž †þ+™É_ƒ~õù!ˆWÜ™¹ð¹ *¬]Õ£]Wk*¥ŠÐÚΚR©¥;‰t´Xú†èåº5v56,4z=iÁŽ¢ƒîhsâÄdíø®èù\ÀJ™<ì5§—W®ŒÖ…À\`.œÝqŽç«¦:Ž¢f¡(XC4ÌXñO—f(ÒT/Mµ…§ª–!jc¥¶"^hô^<+Œ¶a´ßÄ$¾'®®í)®Ê½ëÌEeÙ‘:É ÁÿÃ)ÀÇ»·eí»f3šû93˜ LŸ=Òz?‘Òû<ÿ‡‹ãÚF‘ž¤¨…NÑ(CRw‹¢ëÕÁzKSØ`DD+Ø_G’¶«é -y¸¿#-1ž‚—kVÌ…ŸÈ…™ò«I~¼¶úy.ÈP¥zOXÑ«à¬6Ú& ÅI(Qû “§WjVÌ…É…iëHÑ ¸p¶ŒPú'”'·Ïúï-ø™=ûâûJx¥øß»2˜ ¹¼Íö9\0án&ô@q- ïîê'.Ðz`´øÅ•~öÛßh¹À\xÅ­õ^é6íHWñÍpóZhýæË®±/~AZ EbÉ d.0~iTýµ_ìÏ»øðú7áÂø’hžsá˜ØIZÈZ´`øÛ:sáÁ¸¦Q9\§IŲüi¬ –ká_qaÛ«@áï\}=êÔL s¹ð‹7Âõ¼›4ÍÂ%ýÃ&¤ðc;‘ܾáI r5Xî/öw.D@ͨÊìà`.0žÊôþ™T ëŸÕ’RñÑ]ynÄ›çy‡ÿºáJ ø,[×öÒ¦j.d'Â:µë‹›–0~6H ©Ð©N§´ê…ßÁYi·/$—ð0¥µç}?m&zâ)GK‡¥r„@Òœó 6-ðð^ýέµçFÕöZ¯{,> -stream -xÚÁ!@ð -QW4?uO4U”¯éº*J‚ 0#‚$¸Ý½ws~ïs~ß—s6ÆŒ1ÖZÖZJi)E)…‚žs´ÖRÊ”’÷žÂ‹1 -!œsµÖÖƸ÷xïýÄð:Æendstream -endobj -5178 0 obj << -/D [5176 0 R /XYZ 85.039 781.388 null] ->> endobj -1398 0 obj << -/D [5176 0 R /XYZ 85.039 761.463 null] ->> endobj -5179 0 obj << -/D [5176 0 R /XYZ 85.039 741.134 null] ->> endobj -5180 0 obj << -/D [5176 0 R /XYZ 85.039 431.141 null] +5303 0 obj << +/D [5301 0 R /XYZ 85.039 781.388 null] >> endobj -5181 0 obj << -/D [5176 0 R /XYZ 85.039 431.141 null] +1250 0 obj << +/D [5301 0 R /XYZ 85.039 485.637 null] >> endobj -5182 0 obj << -/D [5176 0 R /XYZ 270.807 114.482 null] +5304 0 obj << +/D [5301 0 R /XYZ 85.039 452.1 null] >> endobj -5175 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F75 5171 0 R /F56 2890 0 R >> -/XObject << /Im1 3957 0 R /Im7 5174 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +5300 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5187 0 obj << -/Length 1390 -/Filter /FlateDecode ->> -stream -xÚ¥WKsÛ6¾ëWðVj¦Dð ²·$Mg¦®b+§$Z¤lNdR!©¸žþùî¤(KrÏPXì.°ÏoaHøSAši²À¥J˜4 V3Üçb¦¼DäE¢‰Ì›åìÕ{JŠLfÁr½?'qb‚eñ%|ûáõbùîzcB•‰yä\¾ý¼˜«ð†w×—WËË« ¤bØTáç²ÿ¾ž§&\²ÐåÕžýú¯7¯™2Bο-?ÎÞ-GKGÀª Íü1ûòM¸ôq&…ÉÒàÖR(`?ÌÀN‘ÄÆÓ›ÙÍìÓxó‵NE%1©HRs•L¢”FéÀ%R$2¦¸,Ñ·fÅF†Ûœªê¹NÞwzÏéïSÎ#>ðFÕá/’ ¼[á÷ž9(Õ´,"Ũš×]p‡ÑÇÂ]*\!¯då'<¨ÙµL}Fvõùˆí¦Zå}Õ c° éð€~[O˜ˆH¤0`9HNpp±›\gl.è:ÖÇ:XµÕ¿ÛÅaŽ×,ÚUõŠ´ì$ß)ÊŸÕŠwXº ë™ÚÕc Z6î›îíèÉØîÉ3„ƒ…ê’N(Nøˆi2ÊûÖPâ§l{f &Cö²üUª¨Íh;Ê6,—3¹¦\RVsZ·«úüÖë¡èzN)'æ>…H¡7­¿¬ô{`à‘Q÷à=:­lx ¹r->׋ Á˜¸Ÿ÷«¼æÞ¤À–uÁT…äöÌQõ?°rpR‡âLÃÚL‹Ø½ˆ={ê1 L%2´fßcúÞÆÜc7±k¨û$‘ázÛA®±¢¹ø¨ŒþÅq)yqÓ¬û9”þ#~ò¹ÁòŠ×†×— ^¬ä·¬S7u´@Ñ¡œzÞG #m¼´î¹»s1p)8‘½„½Ìy¤±V -é‹ôC‰™Ô&%ðÐÆ…÷¸&|Û‰¶M„‚hJR;VÏÒw%V¤©óÒß+Â¢ï¿ …¨ÇP?Xn¾Ù»ÕÐŒ 4¦âÎD­¡0iÝæZtò K•‰D8†?vTk^cKõÛø’ƒJn׈;PQT¼‘Ò¢¢Zø m© ÇÖ¡F*¤òXB"»RÊ‚7¨¿àw„O$¶›¡›H‚be^å—Ž€ñA½;×È¥2K-šB›Våà\ÞÖ@÷ÆR2Vç· ˆrŒYŽ‰½y\:.³>¥›æTÖ•±T^¤YóYg?yÀ9t1 YÇÐØAF;´Zk9o iz‘'Þ¼¥u@…o»©Ußî!Qs0åž"S0è´Þ éœ Jˆ5Œ{7³3{´"ÑÍwÜÈ™Äß»בd×;,}HÀ ¥'÷å -syõÒlš»'!!), -ñ!l|A5؉GÓ`¢¬Ç±0¸(ÿ·Êª·ÔÝ\êô&¸cܦQüšz/šŽë›a”ï=A2¦£~ã“ êÈx•9H¿Ê̳W™9z•¡gð´3§PRkx†)¥ óJ)(¥æ½Ú‚ÁþÉ:—ÁENÓŽ¶1ÙÀ}uù6`Wðé¤ Ä^êýsÐ%A*2è5è Ø:a¡§tš‰DYÊÁÚTÓÀ)‹#/†ÎL…sî”[Gî :ÑD‰¬HìA#žŒf¼¯îvTØ)½Õ͉þ-©µïÿ?ž›«ÊšSæî£ïeŽÌ;¸çùI<’η!5*½:ˆä9 *gT¯#?(Ξsøv:šÕ±Ëâô¥”Œ¾g…‡"˜¬êT4 ˜abgê×þQÁS4„.µ§ïðHðKwŒµ‘š3ï&¬†Ç‰‘B3òhižpø§‰…&ÿIé^yendstream +5307 0 obj << +/Length 2604 +/Filter /FlateDecode +>> +stream +xÚ­ioÛÈõ»…àvaja±3Eá»ÑÖñº±Œ HŒCÒ‰THÊúçûŽ!5%7iëÀáoÞ¼ûË‘€riW¨xFÒUQ4J—Gbt;¿I11  æÕìè/¿è`$…‹x4»ÛàÑ®¯Õh–}r^¿;¿š½ý0ž(¥¹ãIFÎë‹óë±t®§¯Ï/pËw®`úaz9O¤3½ü•áææêêwÜGÊ™og¿½õdõ 1ÒôíèÓ­e@ÿoGÂUq4z„±p%l/€(WûÊÌG×GÿèQñž?âSûD UäêH e µ%)=WIojájá“êÕxâ…Nš"w‹ØÉqTŽ½Èi™ÕÉÍI]TäT-ìÿ„ûOOcüïÄ@¤,©“œÎ­—Y ÛÅNòºÁ'±¿u>Áµ×7(Úk”°d¸øCªþ‰"­ÖpÆÎc±XàH: Ñ–ó$áÏ¢hÚ¢<÷<¯îÌvw(ƒ½Ú¢×®“%ο_ñ|…+xJ¾hªu ¦áû¢§ +ð1DÙ‰ëÑÜ]Úˆå9"]/ÆH­2>ñœdY•÷MÛ1/AÅšxoçÖ%Ü„ó +'x-(Ä— XkØð·BRÏ8$Bñ|›Y^ó¬ç|æÓGTR™1ï¡óhp¡¥ãU·<é‰J2:u +ë^ì”U;¼dw/W‹Y?&n}WÜ* z&¡!oeŠF>œB¥ñ8+Yybx‡mZR´šiçIË£ì$5ª-Š}ç÷šW‰ðŒÇ??#jÒåÏC0íü‹wzÓà ˜Ê•'D_nÈIxͶ>\FëÃõ„Ï ùÝõ m[c$zkd À–%êHïX"œ)óG­ŒMâضŒá6&ˆh Ò˜ÅáÍ Ó’—«µ¹!J–«EΓ¢ÝÃÚ¢ +Ù+•g‘8²¢¸±‚@ÇâXÆR +†ÚŠU*pC„ …4éÀ¹¬Ð¬ñ +òÔ6M`<7ªFFCá¤Õb½,yÜÌٛ6®V3$©’ÄÖ²;7ÂÍA ¡»q‘Ü)®ÅÎ]U“t&‘rCåmÉ(ORTì …Ï7¡W…«ºÍ3ÞJjÖÒæ[Ò7Ò.ôFÏ" ,pŒTJ;˜–Hq€‰MŽl™ž…ÃFOÍ|Ëö„ÈãáÎM0’Ú²’ád¬I¾G ””޿寉P(U hUÛ4„$]C`¯(ædzA°1=?Î+0—¡[¬jFçRcN¨œœ"É® <¼ÀÖ É#èôÒÃȉJpê¨d¬ŒÉÄR €;…A5 +ª Ncª ‘Yÿ,¤Obâ‹2p^2|Ä•,óæ€t仞Š_”ƒ3¬³:<Ús=î4ÚsÒ¤äR£NëZm†JÞêR-.Š¯ƒRž3½ãe F9uÝ8º°ÕÒe´AA7ð,½J0¯‹ÍI–qÈ@cå!EÃH­7ˆ}sƘ€Ñÿth |L1›HìYmL’à) #®á6ájj%ˆ¢ EÛ¥ú,&MLÊOÙ¾ k™²õ±hK%üÉŒM(ºµÎílc,{·ç|ËV*;å•¢µý¶‹´@V¾î8rCZ–Î OÙƒPá+×L1^UퟰÒP—§é¢ÈË–§“Üûé ~€w ñÓù,•O"—ô!ÀÚ‚Ùìq~Œa»Â‰3ŒÕø}Š‚c P +÷X·ƒØñòy5OÊ6ižšîÙ»7—Ók!ÿÈr÷ÍÅ8p¨´ àØÿ.Ã\Ÿðj•ugoºÃöüÝÅ “:n[wÉÑ pñ3¨×ô +}&0øAW^àoò+]QwGãM®mL)_6Å—ŽM³Ys»¸Û£ïMSGV"Cª³)"»Ì“P7°ƒäÕð:ÕEpüÛ:_çfí±+ò‹¾ˆeòµ«x†ݲÉm4‘Ih8 Æïé®–Ø6 s­–ø„¡"lÝ:áÃô¹tÞåvà¢P* c\cáóÆ°|ê%=S‰Ô\ ’´ “2KXÄtóЮЀ°²aš‡v-E …ž4HÓŠŠ%—Ú@ˆÕä8 +43ȱ ·¨¡Œ´#þ8ãXsMÐ35F¶rSu=U,·¤3‘aèzBmYÎ<¡¦ê.ª`\sçîÅ‹ú‡%¢®Ä€üù–O4ó„jmKlvË䛇¶È~§Úº°âsƒÚv Ó¶}ƒŸM»Ò;Q +íJÿÙÐó¿V,‰ì¾.(HsQWÂ.Ñçø‘m7^u€ƒV è;µ¾¹ÚcpÚwut¥ï {ohpÔváë +ÖëÒsVë}Dž)¯­AAiÂ%´½¦wä÷8ccCꤿÇvIÛqŒ½NáÁPvŒ35„½Z"½‡:L©ׇÒá¥ÎÊ‚9ØaJ*yÃ36æ‡uYå=7zë):×Ó¸lšÓ4æ-iÛ„Qêqá@©àe60{CpbeÒ¤õúçw¯0m×Yøô€Ó#¾Ð +M>†_ûÝzè +Ry®Œ´ÑÒã¼Ëé|ß{›teoÊvpÈësëN¾EÒZzŒ0ûEcÞhû¦-/öOäy¶E¼ÏöÒ;%3Ü6bX&«?4óœVéÆÜÄÁ@Ñ+ÃÁÇUôŸ+‰Þk=(WÄp[y +s{ðû Â6-¹Ÿ#W8*Ê;S\ÐÄ|[fQsD_Võó±ÁØ=áöìÍ+>ƒº\ jPTÍöf2h€Ý(øï•P©åí‹Þ:1ØlI ‚ †‘È™ù¦Œh¬(ó”¤-½*ó|P4g\⪷÷ñ~™€ÿéa½›AßzÑ>½t´ Þлôv4üo:ÿÓendstream endobj -5186 0 obj << +5306 0 obj << /Type /Page -/Contents 5187 0 R -/Resources 5185 0 R +/Contents 5307 0 R +/Resources 5305 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5154 0 R ->> endobj -5184 0 obj << -/Type /XObject -/Subtype /Image -/Width 780 -/Height 265 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5193 0 R] -/Length 11734 -/Filter /FlateDecode ->> -stream -xÚí]‰b£: 4àƒ€ÍiÀ! üÿ_>É´}ÛnÏmÓVênKˆ!4ÙvlŸnµ?ÿÝŽÝÀwé³MvÀöù&žÁBÅ·èó- `§ÛgZáy, üT>×N±0Ù>ÕræY,X¾OŸl3báÀ·ásmyIŒÄXødË _`éKb$ÆÂgcÁ1¾‚ Ì l;/°^`^`c½À¼ÀÆzyõóëæ6Ö Ì l¬˜ØX/0/°±^`^`c½À¼ÀÆzyõóëæ6Ö Ì l¬˜ØX/0/°±^`^`c½ðfgʘØ~°^˜j´¡–¶}Ò‡ZJ|¦ªÚ¹îñRUñðõ¸îZî'?]ßSuõ°p’2/°^¸ +!848>áBµC,¨‚”óã¥fùàeɾÕÐÉÜ}Ûº…Oá³Ü“yõÂß­€Êg™ˆ‰õÑ>„Œ®W; dKQMÛ-Lʪürª¸ ½ (§pdo Úê­‡°p˜Ñ,ba(Ц4‚¥Ø \c%L·±pù2™.±×ºhÜZO7^ˆ!”D¡-¯mª#8:ù)¹SÉ xQQ•Ÿ¶v¤ Äh=Ìÿ 7Á í=,¨¸6ŠCGÎl\¢?Ç¿ûí­B •@Kõˆ‘±^‘xƒ–!n‰s u<ÇBUÐH„w³…XŸÖJwÓzaÇòbÁÿ‰…†îÔ€þ_ÞÓÑwXÀ:iC›È i³»w‹OG^oð¸1Àp »û¼0ü¿õtã…Nsá…œV¥ÿ 7Á Õm&,TP-bÂX“Ùˆ#†Ö¦›ŠKaßEÊO¦„¤ %z‡7 Ô®kÌß‹Ž­{TUÈé9âN„î‚ùr^0·Ã YæÀl -¬½‡oÐÄvŽ±ªÝ*P0Ôš!a—/`ïNËPT[»j{c¸Ç ‘¼»ùaŒÔ=Š…Šºï Ó¶7w)d ûɼPÜ-Ôâµ[Û´sfaÞé{z˨þ™VÄ‚ïb5Ñ`>>f|¯ŠÏºº`Aî’IŸWÉzáðNŸ.Õýþߎý4JòàÖÅ0Ÿ² -~£°“û„·yÚ€á`M¶hhã…"~óúEXˆÏ);/ øè<~FùþÓyA–ÑÞÏv»{F\Ѧ[}TÞÃÂâZy!; ÝN Øí{(Š‘â–³,÷{œ…zlÑB÷µ£ÈnC/l ¹v®OZK‘æX(ïa¯ªîuB{NCÝ&c‰wõ˜ž›öÐ*p#µ€VãHͤ{Œ´ñ~F?cÈK ¨}ö,‚(zGržB8$mg4?]/Œwzá¸Õ˜ Ý‘‘À|z€… -½È‚^p&,,µ€›ñe}Ud{;Ò|Å´Ÿ1GýEØ쿘n ÙÖcUÆÑDïŠ;ÄxžjŸþ®»÷I´Ÿ!v˜am…wBŽ9…Ø GBe¶ƒð&ãƒKBÄBm#°À@¯1^Ýû/ÆPßûʱ[(¥]EäðÁ­ ˆVR€t& ¿¦éj«9åÖê3“Ò}À TïG¬p b†ú˜úV^rci dÅÕ7Eº,‹a½@ÄÊo¨Ô­Ž/EÜ›™»Þ}ó ÞÈ°àu+ÙŽ5zŒ‘\vàiÆ1žgû +€zam÷Þ8Ÿ¦›Cg÷‡Sx³â¯µ]KÛÐÓñrÿ¬r¸µþ…d{1’.||×þ ¨›I‚ú؃‰|kž>ËY´Ñù³?±¹MáM-ë…Ï6 í_áÍñBæ:]!A?Ž]›èæ¸×ïLuÌÆÊèü§È‹CÏI`FKPÞµOñÂŽé¯ö³ß8ßù`áæúÐÔËnŽSr¶ìxÇ ÔhºK]BÕ6Fu6ŸŽ4øw‘6í<ÞÇ‚ PNÌ._Í Œæ…GÛT/Cé$mdi0K±aO}ú*b/Ã%J*¨[È»:ª¬f+lêæ윕$£'X±@il^_.Q¦Ñ¨Jjê`½ðéø×âÖ±p¼]­‹mäZíjjÑûü‘uÝܦª|v=ÎÇ›¼*ÒÔß)6ï·ý÷4þYôòå…ó#1/°ý^½ð °ÀóÚX/°1/°^`c^`½ÀƼÀzyõóë6æÖ lÌ ¬ؘX/°1/°^`c^`½ÀƼÀzyõóë6æÖ lÌ ¬ؘX/°1/°^`c^xõµÄŸ›ü—þ&½0ÍíZñìJ?‚î%'¾5“^°pËVþ -^(`nŠ[4ÉoÒ äÍZÅ/ᙉÛ3ï‡'°ðCõ‚³×6½ ?ƒ¤QëÍ™RÝ“¼?“n7Øá÷ðÂ÷ÂÂÕ ß ¿’Œ÷´.¤øËQJýS^`,0/Ü”:TUY•e1-æ©2fù·¼` Ì 7€3\ÚÙ\ÿ8TZÙw‡]¬˜n y Å4M‡¢ƒ>z ˜@zÅzyá`!A± ü2C!'¢x 3à–§-߃ÍT| Æ7Ì^„õóÂÏÂÂc£Ì‚õJõ••ö„ ‘·¥•Õ15“„¹\r|-m‘˜5ŸŠ¤²EªX/0/ü8^ Î¹,qÐeÁIë VF‡¸%EÓÑ'¦‚ %„ƒ0„yQ¬˜~*­…nß-¢§}–Œ›Š ³Lu.Í&$ ÓCH<†K.ˆ…$Õ¬˜~Z;R½7#Qݯ’jòÆûÚ¬€C.„Wq@r@œhq ÇLBã_ÛåÀzyá;ð‚EV®÷ùºæg‘LE H³±à×lUUå€n)¡7Ü¿À¼ð3õ‚?OZ±®fꨧ°`š™6 ƒX°"uWú@^h ÷/0/üÐv$…‚xN ªM«j¬ù•Wc…²YG^Xô:I^ ÷/0/üP,¬f©I;£@U˜|i©áˆ[Q;[¨2ÜQÕí‡ócyá–°°¢¹Y%Àµs¹¨E†Dô0åC³®µ&}8/°^`^¸ , {-/À0(@‚“PQ?t@á MŽ4‰8Ò[ÿëæ…ˆÕXÇ­µ´‘غ³ZÛcn’ªîd³ä«i­Ô9¾5ÔU"Öü´Ázyá'aùà2îNyoh¬Q.rãźæÂ(³L¢?ÆÇ#‰7ŒÔc½À¼pûXøËÄuÙÞÿ¾cNë…à ýZk> <ß™±ðW^è¾8ŸM÷s±Àzá›ñB¾0ËÙQBý“y±ð½xaþÊkŸ~2X/|7^pÙ—^û?Å‚Šõcáżðs± –¦ÔŠõcyA-î ýȬÞ†ÕŽ-Ú¨ÿâOO¿•% ó¿ǂR«Êó8*#ß{òËnªKgÃõmÖ oÁÂñÒ28?åÕ¾¬ž<©Ýgaá7ó²ŠE§FÑïèíbÕ¸E„÷‰•†åfÑÚÖ oÇ‚$^8Ø'k€ö/_6 ógaá÷ò‚Ðs19oðwgõÐTžz"Æ(qß±œÇܤUÚ°^x3öZ†ããŽù²Ì Ÿ…Bèl`ÌÅœµ„ѬÃì4×mh/8ÍóÞŒ…ý«”~ªlÕǺªšô|^+ø7›ªêHN§&uªúlçÄ‚9,YQ²³(ª)î_•mòËYN™Žwzil“2/¼ *“ŽÂPÒ<¶$Ë„„2ëÑ÷3Q´YReô‚õÂ;yAÒÚ8Ë6s¶ˆØ ;žûmGJ¬Œ÷™b¦ ä^ÈÎ XÊû):X¢_CLšDR¡A -ÄÍSÜ{b^x /,ÆŒ0£`NƒõKÑ•¦>: G¿æ±Ôã’.qbX/¼U/$hc.¥BÇ\ŒV-Ô‹è]X<–Hq¡\ÄÐÕGUs<ßñB‚¡«N²¥ghÏ\+LCvNCˆ¶£Û5ÁÜã©õgæ…g°0ä -±€+Ä‚PYb;ªY¬ž¯"Z5c¤D?p¬ÞÕŽ,‘á¡ÝBBA[µßô´ùa=¢¤¸¯ˆÈ{pGƒo.EŒ„BÈ°Ú¢M,þÙ¶W0/¼ ê¼AÎv²°P‰;,ä.HK?¶5¬Þˆ…áØ”áêŒk{´3Þ™Õ«ÆìÒŽÔ€-‹²¨‘–Û{.¹óB}mn:m«¦}#!xä1ÜÄ yžNPÐÌ oÅBNXY‹ªY<›ÍÍ17}kæà½Þ¼~Äë…ûzaq!ºhJ ,œµŒx²ÍÉ/«±†‡XØyA>ÄÂÑÅ<>!Ëvß¾œad^x/Ði|n|w¼¤4¾ ÐâËÞ+“Îó«'y²^xÐŽ”ÀLoãí=j¼÷ñΤ"£¹`a\Ðr#ãÂBÅ Š)5yÁ¢bƒÄÊ'X…ɘÞÅ 6;PÃ)JgÄAêÀ&“£v¤\¯”…úÕ}Ϭ¶©Æ¯¤7Ÿœ`“PËz¶è¶JB'»0,gH6C¨¥ "€Ó=^pÔÈZ_±Ð „Z `¨gÄÍy -nv5òÂ9·0ËÍý ¯ZÉ“æ/ˆ-IRüMŽ”BäÊQ…æì©%oQÛÞ·Ìb½°™®Ú˃ªú³¨êÁ&ç‚œn’ŒÍÚJ|Ò[äÈKuçÎYq¤žé‰ªØ]­+ÀHÉzLRÑýÕe5e.Þ®VÛ ™>Êhå…¢m­`ÅóÞ‹…kS™Eö(Ÿó'æ…7‚¡ >·P¾ë´¬>ÃJr__Áô~,0/<êÆBŠƒï̺ÄzáßÊðA:è ó¿Á¡¥Ïw¾},œ•Åú¼ç÷cáwð‚ÊÕfœéÇa8{‰?1/l¶¤dËòÞªžõÂ-báeþļ°-Vh™›ß-›õ¯ÁÂoàpœs`XÕMðëæ…/ÃBa–eÑ’z P6ıE”Þâšô"zKý¹/fÐP¬˜¾%QÌǪg˜õóÂMb¡9 !²X¯ …M{pmzpP -aanµ…Nå3”ZW´OBE!Uíc¹$À(–š4¡ÑÛ™¨«£a½À¼ð ± OMSÊ‘¢_g"ïàäsŸ„Ùh©0¸#¡ÈŒÈdH•ƒ4‹¬%2¾‘#ÍPÏrƒçJ ñ9ëæ…}ößIä:„4Ïõ6UÔAc¾—\kQA²¤i^@ï% ý"¼Û.Þ,'z¼_*Ïý Ì ß uYUå)É1ê—*ÓÒDžuõäåæØyŽÁÒžó¢È(““ÊsK3k+mö•psš™e_2‚•õó­êG©±›žÂ`-X¨6,/ä5çE.–#-Ò%U.Ú -·Pl?ÀB#¸yá·#‘åi ^HÀ­#yLƒ‚QÑ–Ú†•r^ˆe]ÒÅ«¤ ЫTˆu¬AbØt¢©1R#x<ó·Ç)ej „D6Á P@´M÷G°ÈBºtq.É2Ê S„Ê{º?A@Y† ßÏ Œæ…ÛÀBªV“(O¨&!e3ƒºij¨ ÆNîØHèò1€<6za,n3áåý¼Àzyá‹°®¾«–@-H«H(iU×›Utu•Ryœ$*‰…2ÍSªyÓSÊ[w r6¦²Z”¨Â‘õóÂ7Äú¿¾—Å"M·yœk?ë¶ðHÚNšNaL2õ‰!‰mô4%”À¬¸/åLrè©œJuªX/0/|C,<Hwhg®‰!qst—›=çÅý­K :bÖ§VÖ Ì ß ¼¾3cyá&±Àzá»óB_ 5ÇiýËéè—8XiKõØûI¡9à7òcá[óBý—”ÞÑVIÞ±”}¯èxüZ,(õEX/ü:^`‡ScCX?Ù)>ú -ª1ÕÇYD®¯Ûû/ÿ’íìS° hL…ðñgK  ¼ v¥m—‰»ÞL9¬~./Hع'kVÒ‰}õúålY/üx^ˆÉçº"~í/)ü„ãê*½kG¢³êBÒštçy¾¶Ũ`ã…â¢ÀýWbA Õºñ-Ô)imªiçJdˆüŠŠA -Ö Ì ±pðhq»Þž²ë‹Ò°:Ù±ùKk™ë.ŸCK.^xá°½_}1,W%½p,š¦ì ´W½ÐÑ‚i@©`ô6°•õóÂÚù^ûªÙ>!-EÀ ¥Û»–|å6^@•â‚r/4›-/(3Ð,OÄÂÞŒ4 D6»^ Œ“èUÔκÎ䬘iS=Ç -¾Ü´ñ);Òá4 ± ÷uRâñ¨®e\e4ëçû¼`Ï{”õÁXP¯ñXµ:)"ê¦@V(…ˆ¢#,lÑ <ÑpT•×¯hIRêšÝžõÂß-³ÛÂÂü6,(Ú,ëCXP7þ¬iUwü¼%u°ýªFI3 Öœ•…4»Ï Pà¡Pg9ÉÔ”~ÍB:j –¦/G½ÕÂ’_y¡‹)êc‚É•¦ƒN/Æ‚ÇÑ?J8Ãzá¯ÖÀ\ˆoÊ õý5±´£UFM:`H´lo‚Q…>‹y :ìö}ÃL OD^¨0>:€£ƒ‰wšÂ8º2}1”rtÔÞŽdð[X¡.z!jg¥®¡Î‹y¯ÁÅ+æ0f½ð7£^N׈oÉ Su„Q^ u&-¥¬ãR¤Ô{ÌÑÖµÜûÐr­LZÐÙÆ*Á«*Y—‘Rkï(©…,5oƉzŠx©^¨»uÂN 4¥ùÒ¿p¯GF×êÅSa« *¯ò|x ¬Î[¿ûn¸Íù ‡'*eCt£}8Ó± Û.ÆìmH¯¼€Ð0/ûö~ˆññb,”0ôS?€ÍþŽæ…óeô‹;}?^ø×Xp[Î:ù,ˆ<ÏýÞ$$û¡A4HÄ[_%Æ°~GX˜ïaÑb_Ü¿€X°^x ®wW?fÀPÿÝ0­¿›…g¿Õÿ¾âÅdë™þw)‹1K¨½@; ^h¾„šd[›ë½M^0Ù´±'m´½Ù‡'ÙjÕ¶Xsm›;,PB™—7#!¤7ÂÛklX~'/,ýèwvˆK¿ø®¯hóçƒ ‰Ysqtáý>Áßãd‰—ÓBÄ‚“/ ïûŽÉc6Ah“¿›E@7ÃJã5Å«ëá$;ÿN^xʼsôÇI6Ãö÷%†e#éÎwõÌô‚žb£_àå(±Ã’¿ »v>#xö+Às÷¶ü–záU³…´Á¦ß°éÂrêûé z¡¡¸Ä¸ˆ±R½¨iUÏG?æÓ+F#‰ÂEŠ -mSåþ…‹vvùœkûf¼0Üë—x};’RûpŠ—w2¨µéŸÅÂtÌ_1¾C-z³”ûÚ^€…Ïá„¯à…ƒ´Éé”OÇ· («æyîæ®xW›*!áÅ!Ï‹bóº1ª*ßLñx¤g±ÐMŸwmŸÌ 䊨 -³sxÛ­l·7c+ù -$p~¤¯Å‚ù̸ã“y¡ i.ª*C|‰¸öWcÁô²5f]o #}º}*/ †KƒÐö¤QÏ~*h)æ[JÆ㑾>ŒN‚+³Zî¼Û°Íðù<,¨ÛJžÇzá·òB+C'B¶ñ‚„®²áÍÑçSe,|c½@1’nãGZèP1X/ü6^@,t”5Ïm¼`ÃöHCÆX`½ðÛx!ÛyÁG^¨CE“'1X/ü^^ðçÙYK+%WŠ±ÀzáwóÂн÷ÚY/0~†^(·à¨X/°^øå¼°„9ͲÛŸ(ëÆÂ7æ…0# dYT%ÊpÜ¿Àzá÷ñ¹9áùÊ&;7%ÙÛAVé™±Àzá÷ñÂ_;ëÆ·åÆëæÆëæÆëæÆëæ…o‰…»TðÏ•ËÍ“ý_;=‚õóÂMb!M陋ÌòxŠ\¤I¢•xüÿËœ¤X/0/|;,¨tÛò"Ó%ÕrXÔj4Íƃá‘RJÉpy•OϬÖÃzyᱧ۲Sèè…x -KU®¥ë+Ež=š{¬ðìºÏ¬˜n VÐêoYŒÔ5¡‘Š\š rB4°QÀö^Ô¸1ö) Žm§2´‚õóÂwÄB†ŽlÔL‹:“ê471[n³aV£Jeà«#1ˆ\ë…μ¨E#psYŒ‰(UC›³^`^øŽXð{ùR˜¤Æ`iÀj=_*ÊÖÑŠ¥pÒ×0eÂä¦-Ç\‰î GaÚ¹©¡K휈jnkÊi/D…ïu©b½À¼ðý°@+šg‰ƒƒ×.ÈJ:Ê8_nèE¡PPpd½6Þçk^³VBA ”tƒD¸Œ^"(½GëjûF,°^XÚ,müÓ.×=å$7íet§zߪŸÌ wXéiŠÊDUFï}ê:1B—³^ÅœÁ੧uÛC}ÈsZÍsõ™ÜÒè\©!bA"PZ˜WŒ£¯X/¼ ( % ìßÌëGøt]¸¦yé0/\± / •ÈÔ¬A’c”“¦쨼7JGK6˜µ­j*¶ˆ”>.”k&èH0èü•Ã £¨ßÓŽôÛõBëŽH÷êá ,\nC+ý¿ÆÂ¯Ñ ]QUeÑš\¥ûÊ%`¤ƒ™+Ü›†€XFa4Šˆ*kàHíDÈÓ–Ó~ã ¬hÃé=X`½P@FëW0ï>Z ÿ•X/|¨^ð‚®æwXХà¨Ä ùRÄõòìµÃIÄœóâO,ÔïÃë…ÞÐⷬ–$bžë--­N@¶mv,UoC{Ôç´ÏÎê°¤eÕl©U’²JÎSòXø=íHÙµ[-X‰á+Ð*UbiQ7¯Ä &…ZPçn„ü„ª™Ö")Òþ>zZpç1ë…´:'Âoy’1HÒPHÂÂ1Ʋ.¡¬íàØ/àRÔ þŒÈpûÛ1¼»¯âļðú6Õm)R/|>Ïb -6óç:i )aa„ˆTÒ³ T…!^ – -ÔÎH¥-­äƒoB£KLŠ…ù÷aÁ$ÁUÇr­Ð3ØcQS§´‰·>@'­í`NŒÂGRQá]b¤­MdS…ÐÄrÿÂ[±pù–G¬³³ ò\w÷PÃjp×€r"ê…)tÚ©QëoÈTp&BˆyáµXPi¸ÃÂ*¦È´(®ã¢ª¹2M@&ö‰ ÛÚ’fÍ õÃQ×\"ê@íHÄÒ݈‡Ž¸ñ×(‰õ °@ú¹Ç§Ýž7½pNNÕΟ·5P'p°¥äÝx!Þ”ü¾¥™^…uÕ÷¹5K;µ)ù±É“©Oãª>zLð·Ñí¡ßºRB÷‡„^l§z¡uÏU?ªxh:&‹b½ð^,$øMkô÷ˆ…#ÕR]„…%bæ-WûÆ tS².‰·æ…7`ááüj9Uû–Ù·r³ Ç÷.…ó­˜Ú^ãA©æîPÖ ïÇBæê<à—%,4ŠÑøûXè¼wñŽ ¾ß@0/¼ 3k“:^¼"ë…aá\¹ƈTtÃÜÃB…?gÿã±Dåp>1/|ÄÇ`õÂ},$Á‘«B€¥ÛsÁ15¬>à…ü,É·SǼðUXXUÒ¦êCxõÂvDµpü=Ó·ž‹RΉ9ö;D, ËŸ2´EFÈêœÖ0X瘾 û¬hÎôAXhKºAIEÇNøk´µ–44IW•n_|—˜î|øÿK ¿aÍÏ×Ázáß™¯¦ˆŠç=œyáÿPHʇõM¾¼ -bù0,°^x¯¡²cðÄã‘^‹qØÞaCÌ+I¡´¯dÖ ÿÔ?`¨Êóbáwð‚™hÐéÝÄ}aiBÌ ¶÷l[—××ùÿf„ÁÜ{½Œû¾ - çQ:'ÛóGbaþEXX¥´^El%^ÈãÌ -ž–Õ¤:_—Üh½DYTªÑßÍJGàßj‚ŠÀ3l©ÄC X/|Îqp߇báñ‚(æVÌH‡aNDJ™Á¬6«©ª"„*©©€;šU”s‚U¢wxÄÑøKºRÊÐMF™©kg˜ÿ–.Œõ óÂ,x H«dŒuÐI½t0[ ³6B"8 UCe 4©ÇZšåv ÈcVH|Ýаn‡§Ó9ë…ƒ…ßà &³’LT SF™ÁòÌ£× Ü´‹N,à3íjÂÂŒñ“0f^;Hüµ#„6ócÚ!Œ©f½ð,ôÅnÍÇe§ã>˜”£(zæ…7óú—W&NÅ9ü4•íì3CžmAJ}QeëšU 76S¾@ôþÜÀÉ£^ „”ôº‚2;bY•sÿÂ;°PÃÅžXÖχ§Îˆ·gà~UŒTˆ±0¯ÔŽä‘*²­·4óß´æ;‹¦s,‹©±@)¡È †Ò)¡Iˆ…“àþ…waAByØì)^°Öÿ õcáwé…F¬9ò†…q¯”B˜2é¨Íh #ÖôâÇ3•¥a©{‘ ª»¼–Yóì(=Ö Ïò›—ym ôŽ…ߥ yb$šµ¬É’dñÒ­„˜°®ÇȨŲGÄ‚…jI¨HJmª&¯¡Iãk-ÞƒÖ ;/Ü¥Ê3òX s]Q‘WÃ,Ǫ:gò‚¶©ífY7|g(M\˜ÎN~0þÆ ç……;^Øb¤lqèó¹HçõÂŽÊ@ìeX=aa9„É -7‘^¨$d†¯«p|//0òÞ’ e q§¢ƒ®r.ËH/Làð€¡ÐaÌÚÁ ÎÙÁœÛ䃱ð4/ 0Ô_÷ãþ/¨È (“¼×æ)¥…/$G¥” -ÂåhÔ!À(EZʳW.ê0fïãÆBäi£Mñ– I,òí«‹æ ½“jwH-ù²7¥zKþ°÷ñÂ_kÃb!ŽGÚ´3ò‚Sâ„0!;`Î… ›^ >Ôjã8Áw@iXiõ°Lˆý ÁzáXØÍêmׂȩÕô ±í4TgB<.„ìŸ`ái^h_j§ñ±'v4f²­YUj tÓ£”-î‘]],f5‡b‹‘NÇa¨t¾nei‚¿íÛSº½ÄÊc.tU–²Õö™%ªX/<…Š5´õ:‹±°OßÁý†…I9{Á%þ„7hî÷ñÂ÷±—Ì_ðèÙÆÇåG<¥ _àï|[ÍЈmüÝ”™mª–Uûć\Ä`ȇ0™x®íŒ¬Þ§ô½êAn§XôÆbaç…%VÚ·. É'óÂÂÂS+Ô>XåõÂIü’Ͻêu³€X/¼¢éŽVˆ6æÊ !ݱ0B§h¡1ú‚…ù·bá1…=†WÎj`½ðQíHW^Hqw{æ /\°àC„…™ëƒÇX¸—]ï3ûy¾óðBÓöôÓ/w¼RRÕim±yaºò>èn=¯õ[n ó«ó}d -Ö ÏòÂÅJ¼%ò6BL¡Ý÷þ…ˆJ'F£+g€Úü,ül^PoŸêÿª#ë…7`aª.6žE'ó÷±ã9mÊd…áœ5evÖejþBVP‚mŒ”äG^Ûoçs”ÿçËTÙº¶6«ZÊâ¯ù€óD+ôì¾u]–?{ò±zÐßœëÄ>ÖÍzám&¡LÒvígcáó‚éc?³Æ³£¡.a29ÖÈ“Çâ -¡h‹™&Àuiþg °âAÓ“5JXZ—õÂÇ`Á[’óxþl,ü\^P¦¦Ø¢‚:Á()­ h“—æù%…úÿ Oõ&Ðc”„ ª(LºfÄÀ ¥tDpM‚! …Ê5ýf½ðQs<Óé0~ð éßÍ j ‘B·Æõ8E ¥OCPF§&v@‹Eë%IÙ-ôfa¡1´0R†îNkœc@uM–±¬J§*b`YEº@XXé¸Ñ°^ø±ó¿;Ìt'©m1heO¼Ðw$­Æ©h OWмi ,ÊXz—Ä•Ú–â´ rb²ŒÅ¬R!œú¹ôã\8„Mâð€F˜ìÄÀzá›aáçò‚Q(m/ò8ë`VJ4,nA lVøŽLÒõ”a<ñŠƒ®’PÓâ.„ÃI˃¬”Bàêƒ@ -mÖ Ì ·µ8ëé·ÛŽúÉÑÍåêS½HÝœf>íBJ«*œ3M=üN™2d‚PunâLT”+`€zÕù ±ÐT>K$GÙ,‹”ü±vëæ…ÛÀBž`µM¢!Æüi眛傼 Mœ0҄Δ¨˜‡CŠ -`½L[Ї’1¬{¡º@cº“S’wpð9µ#e4½$§¹ 6›6Õì+j³b½À¼p‹XØZTÕÚQ† µÈº ð%y. ¦% [>h:ÿIåÛÔ7#ráEzêÀ¥«ëH,Ó¸môl³îX UAŵ?lX@Yro¡PÖ Ì 7ˆŒtœ”c„·P›ê QHDÕkÔT# KäÓRœÊÅ:ÃÉ\± `!*ØÝ@XÈX/0/Ü&ZŠ‘¨Ñ³ò±“ÀlX ÂB”+÷Ê/‹0 êæ&¦‚ÁwÇïKG3¡•.Ûü>èQ|Ûì ž†õóÂm꽓òH£‹h†r¸Ç èÐÏUV”.5"Î)·pÌÐÝeœ¾F‰2D ‰ˆ ôÄ}, ˆÈQPi¡aŸÇ†#ëæ…mGRNÆèeB |“¢tñ( €Ï‡pX–)t¹‘ ÓetÐSÒ—dÑæc’gÂD3î™a4wXhñ”z)a^D®¥ÜôÝŸm¬˜n Âo= yk ˜«V™4Ìi¾Š2Âh‚ 2Íó´ -Î…î`LÒA8ù¤¢#BפJ©c‡¥êV¬CHðÐS ,tÒgSƒ¢ -Ž‘²ê±^`^¸M, l͜¯É4%JP¡4¥]©^Ô’çÉtÐ4º"étsÒÃk2¦Êˆuœ£Š£‘„jO= ãÀƒ¨ÛB/(Ë¥h'M£À•H0DêGb^¸Q,(Óuûn•±ÂÛ˜Ú—Ÿ2—ʘ­¬2û †ë4›a_jÿX¨±|~92WiŒâñHÌ 7Š…{C‘>Ø"ÔÃOú“X/0/Ü ”Üú/Ö@§þ¹ûË*5[Áó™n «I -ý/°°¦m¢ }:>6AˆõóÂÍ`a5âŸ@çá˜Tõèç°^`^¸,|­±^`^`,°^`^`,°^`^øj,d^Üœy?°^`^øl,ÌEQÞ ¹ß¦n÷Úú_à 7k¿L/Tå­šü%¼ O·jó›ôB·lͯà…og?T/(ÞðϳZæG𷳪¾¹1/|/0n Ì _ Œæ¶¬˜ØX/0/°±^`^`c½À¼ÀÆzyõóëæ6Ö Ì l¬˜ØX/0/°qŒôÛ±pÊØ>Õ^¦ù>}®y:3Û§š{IŒÄOå³ ‚tí“ÍÍÏa¡à§òùO¥û"œ³uendstream -endobj -5193 0 obj << -/Length 105 -/Filter /FlateDecode ->> -stream -xÚÁ¡@PKXBÔÕ†0ƒ(Š’$ü¦‰¢¤‹Šàœ;Eÿ½½wιÖzïåœ1J)k­9ç÷}Zk¥”!$¥dŒcbŒ„Â9‡RšRòÞC­µcç\k­÷xïý `;/endstream -endobj -5188 0 obj << -/D [5186 0 R /XYZ 85.039 781.388 null] +/Parent 5311 0 R >> endobj -1402 0 obj << -/D [5186 0 R /XYZ 85.039 692.47 null] +5308 0 obj << +/D [5306 0 R /XYZ 85.039 781.388 null] >> endobj -5189 0 obj << -/D [5186 0 R /XYZ 85.039 671.274 null] +1254 0 obj << +/D [5306 0 R /XYZ 85.039 611.338 null] >> endobj -5190 0 obj << -/D [5186 0 R /XYZ 85.039 588.986 null] +5309 0 obj << +/D [5306 0 R /XYZ 85.039 577.194 null] >> endobj -5191 0 obj << -/D [5186 0 R /XYZ 85.039 588.986 null] +1258 0 obj << +/D [5306 0 R /XYZ 85.039 136.435 null] >> endobj -5192 0 obj << -/D [5186 0 R /XYZ 231.163 272.327 null] +5310 0 obj << +/D [5306 0 R /XYZ 85.039 102.291 null] >> endobj -5185 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F75 5171 0 R /F56 2890 0 R >> -/XObject << /Im8 5184 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +5305 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5196 0 obj << -/Length 3471 +5314 0 obj << +/Length 2608 /Filter /FlateDecode >> stream -xÚµÙrÛFò]_ÁÒKÀ*Á îÝÚJÙ–,Ë¥h¹–´~Hò‘ ‰”¬|ýö5P„”캶\2æè™éîé{¨&üS“$t=?ĉrý$™,¶'Þd 3'J f2À¼»=ùþCL”ç¦^:¹]õû„nú“ÛåOÎûoç·çŸ§3ß÷•ºÓY'Îû»ùT97<:ÿ|y}{y}½•s7Çé~ž&¾sË@—×ýôÛß½åžïzÓ_n?œßZL-€UŠhþ~òÓ/Þd $}:ñ\?M&Ðö\ÓÛÀÓ _úåÉÍÉ¿ìV<LxÕW¹:††üùq~˜ºaçÁ6qàzAòâ>´Êƒ}¸eÀ÷™)¥]_i@/‰]OEö²b=QÊMÃ/K©ØR=‰ƒØMU@·u[ìžóÓ€E^â†>¡6ù}¢àÜ4õfÐ&Ä{‚hàûËm09«ÃÉ’¼ïl°1!©’D©0rÓ žÄZÞ !y×æSà¼rº ƒ´O×-7f›Slx΢ÞNgÊÙf@-y¬«h±É8ù¯¢žêØi¸ŸA¿,¹}¿‡NQv3„/*T©sºÌ±ûP,èÛÊ‘õ -¹‡©PrRB÷iª§ÞÃÖ¾§‹MÝv-.Z4Àl Ç}ç6j`€&‹±m @Ê/W¼ö Q¬÷Ü!°ÝDÆaZ -¤â‰w£Í\è¯e‹ŒÇñÀ ñiDâOÞÑÿ‚^GÅÚ™Ñög糂þ}ùŸ#À? ±«Ö:ŒP4Ci^‹]Çã4Ro ħZòxYT|±Êyƒ#ÊìÇÓLCàdÖþVTë!¢!áyâQ!G§)É~uõ7fp“s£¨WûÎô 422Hœ9™+èÿì© Ì‘Ë©r®³-b2Iã¡‘œSd»b¾yJŽ‡ÆkòE¦‹–¯Ë pY¦·½pÔÄ­Ž´@¦[e2ç^ŒcìI¼ØaÒè½ÂoœÞ&ØIœü«¡Œ»ò‰ -¦]h¿}¹ä¡&'&ˆžðùH>-«v¨¦ÜCÅÎuþ8‚õ+øé$ lZP»–{ÌŒœ;9·Ì³–KœˆœLÖ¢êe‚!!´$_ïK‘TÊ›²,­H¶N#§bÓCŒÑIâÜcûi{+õÄôzeXWÓ-£=òA¯`ø꽋\'ð0âŽ%;EUt[9™Þ‘¨CcOÒFöz,`Ð8}ûa~uÊí„·jE?ÔŽ &ò%Œé<0ÉM~À¸0röw‰ Æ˜ë0q. ysw }1¿âFÖ2pÛSŽªƒCfŠ0ÆF•,Þ~@p )®x 7¶cº‰R€f^;ªª,ó¯E K”sq}Ç ‡BÕ°´Ã8jh ÐâêÔiê{dö=I¹µÅY‘9YRµ]V–ùr'¢¤h+Gqƒ¡l {S¯}⹜Ô1 åw{.ä»ÉØÉ ”®klÙYæÜ[æhÖØ«äբȇÞnòfÔ¦­j«3‘ïœß̹—9âôt€Ìú8€[æ|-e-^mÉãf>CDš…ÕfC6°d’óªcÐúå—‡{ú/,*e9H#H -ˆ:’Æ!`ÖÑAâ÷~¿ž!“¾2oda†R½ݪ+Ò.ÞÄŠºx 6ŠíŽXxÏŽjËwx¡9—¨©À=rðýµ&[N6ûÖi€ÉÉ -Tg£y>pD A±|ƒàüªA±ÀÖû;ß¼á^©ñ1ã:4o'\+çGÂȹü†ÐI(¾õÊÀ`osþ†Ñü,8+ç£!Gȶ‘@Ô=™UÄž g•Ž-ÒÒp×uƽä#¸Ÿ.ö;Œè|À8T,D3°ÿ³z9 N ÒVd%ÇKÀ4_ca|-tÌLE‘ó^4>àˆŒÈða¨}¬=Š¡Öše \I6žY/E`÷¤WµIµ`«u^åM&«9²„Æ¡4™éUªgàB‘­Ö}"†›Ìt9vh—¤00’(ñjMÈ-óòoàuî« ›D‘1Äú(ؾ½KñU¤ò0»_SäÖq1 /%Aÿ+†)ÄõA“3e™ÿ‚tž1¹,):>uCVÒˆ.Ìøs¶ß‰ž(ç«50q‡ûÝ#Zö±/g¤Tdä°‹»ì œ¦±®á - :¢—±)óRËó;€”,¹~RY<ÆÅE&ÛÒ±;K.íJú“mñ‡¹`_²^ Ù— m—ËÑÐcÕcõŸ<3—©SäÁyk蛕mÍ­*ÛZQK¥Ì…as ¢0³0Å/±¾Ýq´¼–]dsÖ…áŽ6^‚Y¹Nõ‘þã<Ú"“^—d`Ž /*[ ]ر=œÁ°5ÅðøA‰€ê5Ãj–š¿6ŠËîK12E÷¢m¹¬¬çª‚V}& tÓaëÛr§:gÓ™á"ÕÚ¥rn™MÛÊœX°&× “-¸LµD4¼‘(ÌA!ÿ¯Ú˜%] «r#wER`»iœx #S[1£RRÌD¨úÙt¬5VjaõŒÛ_Šj9(Ô‰J†â8|€Qˆ@grßXVë'ŸIÚ±‡’„ÂÃ^ÞÂgpßµ"…ó3~>@/DH# -‘Èíàâd߶¯ê‰\Ë$ßчm<˜™ÝwýŒ(¡ð{T—€¡)âFÀµâÈËÓÕ~Çów—Gö¯¬éÅú\†ñ¢Ý•½•åÍeβo{«ŠÄè›gSSyû,Ïq\_ïP.°NL§K#ùBʈµ¬–Tìí ÖØö†:²? rŸТ÷wTbnú5mÍftc‚ÌG^úHhvÑBdÎ -iÏ Á ÉçÀ v8 _¯„*”ŽOWoF(ÿôþÊ8þe¤¢nf˜QÙci°Oö`ÁÁ;M·Æ‚úFìk‹É{2+åxHhã4qø(½‹dÚÖÈ|ª‘¥T#{fÜQò£×îñK)gî*õ\/úæ·`¥c7öƒ¿ZÑ1à/½GðÕò¬âÈM¥ä0…A¾ŠßŠÖ/= +°Í¬ága_’~ -¶_xÖ¯< 6~ùYX…H¿]ãOTxh’;㸜ÛÝÆÔUÔ qfÁ†+³õ8”ȃ‹ÀÔUÇ¥Uîs®KDz’óÒ:–ã±Ré6#ß‚–( L;ñ-6€Ñ(uùÃÆâc¦–ØqËÔ€DÞ¼câîhŒtñm8ñ@ª‡Ño¾Sdpž»’òP …âKlЛ[µØبTT[ 2þÛË°Íü´²ÎåR¶Hv•£RZ›‚5LUµÜhOïQ¹<“`†éÚYD1*BÇòÀ¥jΊ@îSIéÛƒâˆP·å°ŒâœN¾\ÐR4/¦á’Ù'Åöï˜EÓÓçH._7'‡húqjÑÄv_TˆùeZÆW&vix“%Œöåõ“êH+9PÒ?ÀF-½;vìzLÙ©±>®P2«¥êøü¡àìƒØ֢튲4>ÉÛÙº“~µÞ[¸o°—ÿ— -¸¯ÜÈýü1/¾é‡J}eÙw?/,‡Z»Z¥ßs5ó^{Ás^†~↉/@„ÿÓz)Þendstream +xÚ­ksÛÆñ»~Gm‡`Æ„q8<ÝéY¶ceGµäf2if|@ +#`P²Ú?ß}š”›Ôµ-ã°·¯ÛÛ'¤füU³$t=ÎâD¹:IfYuâÍÖ°ó퉌¥ ,'8/¯Ož¿ £™òÜÔKg׫‘Oè¡ž]ç¿8çoÏ.¯_¿_,µÖŽJÜÅ2Žçüû³«…r®.ÎϾǭÀ¹„×÷ï®Kå\¼û–ñçÃå帷H´s½øõú»“×׃Zƒ@P!E~;ùåWo–ƒþßx®N“Ù¬=WÁvuJ¹a å}sruò÷ï3¦:f‚P'n˜èCèðˆ tä¦aH6h›¦ÿÓbú¡Ón³lSuϯËsÜüË'ø3PÆÏyWôy[Þ-¿çUª”Çëêq{kêÞtŒQ›ªò«³^ž-Ï?\^¡­f¡ûÉl©ðl))“U9cþP qõ˜#Ÿîj—eE×­v›ÍãÀòYßl"ì˜%<£¦6]Ê1íF:"©g··àü;Ë¿Ù‘j€4ÏtÁ @eŽóž7~ì˜zá§NÏ8=’è²ì‘¿éÁkƒ pÞèÛňiizDxe'D%¼T¸_Xi°F`kÑ‹QY4*½ˆ¶ˆš%NO2%/òl–=Wóö,ò÷2^ÿW¿ +ÿ¨[ÉzâHâš_áI¼ÿ;}çšÌŸN‡~ìm>1¸YáÓ^²†®³2uÎ;tհѲ3d¸K'>¼‡VgOXŸ„™ +1nÌÖt9aÓ¢»Í…$ãçœpÑ‚èV÷H‚Å­Ó-ÁÄAZv Â>=bÑÓ)ÄÂW +ã% õ£„’,].ÂÞ6]?áÉèþ>¾½kPï~yÎ~”:·_î'Š¤Z^¾©€÷7¼F ûQÌFñiÚ; i/w=‹¨Y<gy1›ëº„~¼&iäúaü;ŠøJè…G‹ZÓó€ß“lˆÈ6¼ì}.CñÔ¨“…# +fJq™XÍRÏ èhWy1]˜Z¡;áM|vJ‹­=7áì·™r½ M5cLÖ¤ûx$<¿¨ÔìUZÎ&Š +×åÈ–ôTÉ$ ”ŸºQBÁL\*Rï‘BÏ÷¦˜©ëypF”1!pŒNY1™…÷‚ ´Óçfƒ®áKa~ÀUƒÌC-øåŠ7ɹp±EÇi)¯öŒØá¾rÐëê‘8ãÒ.¦¤¾2Õ¡ØZFp}ZïE˜ÙqËÕ3õ#ö)Øå(ˆ*f³[ãÂǨ¥§ïú蹟ØÑY»…â½/DÇœq¯(Az[¡0´4Y³®ËQZI«a¯»e[¡ô®‡¨)òÃ~Ä@Š“#œ$ ´óó"´¸FQqžó‚,϶ ÜÞ`=m{Æ£âÊ"zpm|P"1=?7…é„ Ëàðãí‡K^tåº6›}Ñp #i¯ÝáQê™­¹ªvÕ %âœ+ð`tNÏìD§][Æ›I¯Àºß1Ä Ä»:·½´&{ÁÍÂ]‰îŠ{Ë·þû— ø¸-)3®ø•¨õ”óñ ¥ièª šMòÇÿžŒ0ßa‚YîWåG_¹I|qfбvSè\l:Á$¸4öË:HÝÀç´c +p›ÎùíJŒyEΉ {ȼà‚]›_.[¼8ÏÉŠ|G8ÅŠü¢ê#gÂ#­¾†úÒ–¢‰³2U³C?‚ҶŵÄ4ÑÐM7 z»)s¦iÐ[ÙÁ…B:@Ñ-G3â_NzŠ•ʳŸ¢aä9…ôš·¡=0}NðÚôŒ<Ë.xK©gO0f£¦=L'ÍW9·å%ß#e$(isiOÚaHÔíØüB.£¶›§À†‰6–I?®ž‰¾€ºß'ñþa7Dà†‘1e²×Óæå¹ÍŠ¨Øµ z:ž8Hþâ Fœ'#Ö÷bˆXn]^w“.+ ÍFŠ²â¦íÍàÇ+ò#šé´°¦J#Epr +Âo„˜ ­ƒÁšÌ4Ð2å¶WD™R¿’œ[ÊГ$*v‚ ‹Õ-CLK …ÀŒ+{Öcfh±Ž"Î4e.Õ—ídàÆ­azÔëd+r>åü8f-ä8…}™“ü`HØMK}­{bŠÓ3ÑœlÈØ+Ò×ÚŒcº6ÒTØÆ"Õ´"©02á ¸/õV2€y¨ƒEg3^³Cùy=_Èh§¶æ¡‘Ž(Døm Ÿ\_‰a¹L …üÄŸ ú´†N:öžÃKy~äÜ`e”·ìZ(cÕˆ0nuS,ÚT<¿Õ¹Õ*gÄÏý i&™=\åì†RôþïZÀC ³´ÑØH*žô«Šû9€Ms*‚e Ì;Ñ +íË`Ö~ƒ‡n…‚AêF᥻mð69¿®wì­’ø –ÙF‡K.s@$‰Ž\‹C–䯼KwdO&ö]ñø‘K{ô$…£‘·d㶌 OBáÞp|=­dºY„’ØÃÄ~B9Ãø4ÍjÐ$ÐœÖÍ ç­¡¡|<•JqQÛ–*Ñ+ü°zÅ n?éî>‰~Tu&ÉñA*Œ\òîz)› .¤^í:¡†Œ +êØ´ïêÕþ9†öÝx˜¯Î~å^¢Ü³%v¯ß/ÌTÿ€ç¡€$žç®"WGÖHÓæàϬùsP½}AqÛ{^ª8pƒÐž5!Ú÷CRÜŒ†CcDßCAuÈß÷¸`çE.{7¶šÃ¾©›ýÌ°ûEˆs µ…ðJÑY5dŠiòŠZ9XîlLv¯cÍÖÒîžÅç– y)¡&Çå˜ =Þ$ ËwCôiƒžCž0¹õùű^ƒ/YSvȆáVëHº„ý‘}µuô0ƒNr;Ë›œó‰:s[2i]Øjªé+/=ž-UL€ðW0ú̺ÀËOûÞA TŠ²µmG“i}Ñ1çAéÕzb*>ê†zy04ÓºiÛ#[Oå#<±ò­qiÇŒaþ?Qsî–7cwõ\¤t㇓J4ïøˆü•7 Ãá"³Áù{†YíO7Íz= ܸyì›$}›Àšà'tóøJ/•n„ Ó—:?‰©ÝÉû _0°¼`Æ÷tl> endobj -5197 0 obj << -/D [5195 0 R /XYZ 85.039 781.388 null] +5315 0 obj << +/D [5313 0 R /XYZ 85.039 781.388 null] >> endobj -1406 0 obj << -/D [5195 0 R /XYZ 85.039 465.898 null] +1262 0 obj << +/D [5313 0 R /XYZ 85.039 373.935 null] >> endobj -5198 0 obj << -/D [5195 0 R /XYZ 85.039 445.901 null] +5316 0 obj << +/D [5313 0 R /XYZ 85.039 338.624 null] >> endobj -5194 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> -/XObject << /Im4 4878 0 R /Im2 4150 0 R >> +1266 0 obj << +/D [5313 0 R /XYZ 85.039 267.041 null] +>> endobj +5317 0 obj << +/D [5313 0 R /XYZ 85.039 234.62 null] +>> endobj +5312 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5201 0 obj << -/Length 3170 -/Filter /FlateDecode ->> -stream -xÚÍZÝ“Û¶¿¿B™éL¨™G?Ò'Çv\gÜóÕ–ëv’<Ð%±G‘ -IÝù¦ÿ|÷ $eI×L‡ŒÇ.€ÝÅîo ëYô,µ*0Ù,Iµ2i:[Ù¾¼ºÒBá ‰?¡ù~quýCÍt ² ›-Öã:VEÖÌ«Ÿ¼ç}v»xùnîc<©¹Ÿ$©÷üÃí\{ïyôöÝë›Åë›WØ‹`P{nñóÛwóÔx &z}3~~ö·ïŸqϨ`þËâÇ«—‹Óà*C6½úé—`¶‘~¼ -”ÉÒÙ´¥áóî -øT62Ò¯®Þ_ý}XŠ¿E3žuN+ŽÂɲÐ>­¹X«(6ƒæBøªUf-jNëPÎ(D¤:X3R nJ³6¥Aç•'Þ2¯¹qè -lÄ^^UÜøXÖ«fn´÷0÷µ×Á$ ýÀkwyß+ž÷)„²å±ÛÛÝ%} -cOJ8Ò„ÚNlc0ÌxãŠFÖ["«(v¶y½®«»"6º=ü¦^AÄþ²Ùáï)K˜ -_z¦CãAIx6ý&^w@Ê}U¿N\ñfŸpâ#Óö[þˆô;^ò°†¡œvìÐl‹V^7íñ,íáÚ-*ôâk4 –óWjºþý²-‘ ä3±ñß`Û[U‡=8ê(´ÞK ºÇI´,ª%‰¼rÍÓrþùP—ŸìúMÉŒbÇw\TUÙmÞL;] $'Αr³uzƒnÝHÊçÀ–›7p[°žË¦Õx*os@ƒŠ´·æ…R^¨iKdÈD¡÷VÜhÊš·ÈwÇŸwbaæòªc´ -j|j笷ì¸Ü][Èäÿ0Õ#myàÎ`_ØéòuQ=r»o¼- - ô%|‡²ÆÅ;6àò™ Ab”ÏÄÄ6Ó¼´7EO:ñéT5Û¦Zákkþí·7ÈoÅgiàfÁ¿÷ -Ü¡ÒÏÍÌÐoÿÌC¬í°01·,7’‘¤²YÙóï¡^nñ»¶ç6ôVLŠg!³ž# #ø*©ãÈ­žÈ„¨D\¼cðfÿY’½tC71ײWî°‡78ùa°Ù–¿¡Øøëvø°Gõ°€ÑóØ¿]Ï­ª¼“•pÛœ?’€+ÞH8º‘PCˆ:,¾l¢Ñ7_£´8JT¨C¨16S6‹Ï†Tc˜(¦סY¬Ã-G~¼Žï¸òm¨ Ó'áQ¸ITœï&RAÌg·h:‘Élœ*m)tÍ~iDYf˜fÒ&ÆGhàúõ.š½h€ÃÙ“¼®?Y˜#F:6VY”Ìâ SZs:±˜§x¤Å§ì]Þñ(;…ŸÞº2ÁdV³ƒ@£ ,‰:dŸÒXð#ÓQ -òB>Ödê½ ÂæF8èÀ¿Ð¸ -!:¾)dâ‡v#ï¦)„PûrÒ…™ºÙ—k”ôýþ;FšôfÇHs}ýðð –‡}§švsÝ]¿ß¯Ô~{rÌ&°*ð™U6>ã?!:=2ì¥i4¬Ä˜0§`kb@ }…•KW<¹å ˜âÖ¿è”Ü!D,q^ÅÂjªÌÄG²ˢC¤bh„„CÕwÜY•Ý¾Ê1T’HÍÖA¢Þñ‚!™f×”ÃÕ²…}-ñ`)ƒ›Dà}Êú' †tã#àç@Gí4G@Î˾ëð¬ßO4¤ÀÙl‚¾_æ1t–ÌüáòU&„«[f¿z™4V±Ž«hB})LŒª8 ŸSÜ04D<ºsõò¶fëÝ\ŠY‘ëS(! JG‡©iûBÈ -ŸY㺗#VÃéÛ˜øýÁ†=l'€[XA> -¹]½wO½G; 0|\‡ô1”|%fºD“Æ’‹®(L}ÛK–6e,¾+t|c 8Tž.j¬‚”Fh…{ô¾nås {€:§ûDV%‘¹"ô9¶!è»0@M–>»,^ÔT'Ç—*ºâYÏk‚ŒvŒ÷†Àáðyï`´f¢(11pz~–`K(äª0S2ÎqÕUqïP¦èxwÝÃ6‹XnJÚ ¿Ÿ\ºˆÖg¾šûr5¹ˆR„ä¡tyÀyJX!Ò< ç4ü(4’>G O.×eànFž¿¹P¿ûÿ½øŸ²? ->ýΉt‡*‰Ÿ(“Ä*1éÿÊ£ ˜t†¿=Yø2*«UGŽL¾ÆP—†“K2t†ÌM+…›øæŽÌ{ÃDëËpFÍ¿Íàl›’Ò€ŠW¸/¨’38žÏ9¹£P+p~’r"ÎÌЫùø牄˜†Üs"DIzÀpB MšLÅL¼»Zî—Ôë·yÏ-&önp•ÌŽxeNhÎgù9°Á(OÆݹ݀sÊðÇ!ÇòOÁarýÌŽ· 4Ž&xõ ßIN’ÅÞ›g7<¼Í¥h’% °Ò™r~_µå=ñ•%ÌGNe‡¬ µ§ñþ<¦<§šÇB0EÌÑÐà’D‚ëݳAÌ'½%Ýjä#ŽàbÂŽ|üxT›ü|½—B$CníÂØ´¾¬ Xràj/õ°ðìâÜŸx;ŸëضÛ:ßgBL’нŠgö Â)›ÐIébˆ› &Q •GÕpõUÎ5‚(¿*ÛbÙùûKSôåá(ÍÇÃ\ÊͲ!Cæ² ¸3D*4þª]¦¾‹Öé)G‘ĺ82ÉQ³íS§:ø;ºëH¨!…ÝHá–j²Â>šðŸi|žK ]²ƒQØÊA'RüÐdŒiFÀ‚Ûè·ÇaÑ°)üæb.>ø$ €£ø @‡O–ÔÃÂô$Ý<ûhøÌÑ£AzîÑK©T”‡ƒŽ $ó€±õô5 njÿûJzy%h¥:ˆÍöÒƒAh æ²ØeéFšË!œDÓƒ¡r–Üð€Tí:îJô)ö<°«e;¹ŸcÉÓp’ù!®3yŠÀáš®øþ€Å¯ØÄë,äìã Ü•õ'¼Å–/«Å¹7ª7‘7§p½)¸1 06@BŽ„+õØ*½½œJ$9Ý›q&Ê×bRŒ—³bûä-@öÄ æj5¼Õ”ãÑ qt™×ßÊÞÓA}î*­¼gqò\UÍdDúŒ#}vtꦑ+8-ð¦®,4§z= Hø ¼.ß¹bôv®JQ1á?}ár m›ÁRp¼ìÝq뻎¿Ð“Ûëôkº€ùO_ëB@ññZ®êã`/英_±õ-ð´áËâŽü­'¾qÆvÈcà{?Øß-9 -4$ÉOc)`ØYó{Ÿjù\ºEe.“…CeÛ„ÐÒè’aYf¸Ó€Â(fX\»æ Åðr÷ÈCâ5B.G©Åß±%ûTpþCÉ*soB“ï2dÜåÂÒ²©‡'¨c·DÝŸÊ™·K$Ý–=ÄíC[àa€ó¾ïsy*¤Xu˜¼€¡ƒŸGA¼¡GÑÓ?¡0>@§(¨ƒLÅF;Œ·ïQ†¯ãBÈ °h ú‡rÐÕ†GžµK'Ѐ@çø b•Fúi~GšË¨ Äa" ÈŸ{ãÒ»$)’*ºgâºHñ)Üÿ °’ã|qì8L§÷ØõÅŽ’§Cl~BdOX1qSŸyÆ c¸lÆ./yµ4Ð'=}æ²p B‹µ0‡×5¯ž¯ðüËž_çØùõO[ÇÑý^QIÒAÜ8ïNÝB;B?¥x€ðR&)ø³\2°I‰àQÙWf~ ì;™„@ðP“Áú©Öc¥×±A#k=²áÀ[a‹Ý¨^Ñ9Ò=åÔƒv–ä!åä1_TÈ÷qõÍfˆÁšß‚ñ·8züÆ‘]ÓÊÔ‰It˜Û&™SšÛ¬^UÎ7;ž“óóµñ¸rðå£Ådm š„2Ïîoô%<›áÀ_ÖÆWýÿ“Áã"£Rs!M²aHÏÌ j? ì—üZ“*›šS†ÿ ƒ~eVendstream +5320 0 obj << +/Length 3379 +/Filter /FlateDecode +>> +stream +xÚ¥ÙrÛFò]_¡õË‚U&ÌàÌKÊWec[k1åÝJò‘„5(hYÉÏo_3 •Ú-—…9z¦{zú†çü ϳØt~žf¡¯³ì|½= ÎoaæíY(KY:0/Wgß|'çaàçA~¾º÷‰ý(Öç«Í/Þ«^\®Þ|\,µÖ^˜ù‹ešfÞ«Ÿ^\-BïêâÕ‹Ÿp*ò.¡ûñâýj± ½‹÷oa~¾¼ü€s‹L{«Åo«ÏÞ¬,Y!#M¿Ÿýò[p¾ú< |gçÐü¦·g@”GZúõÙÕÙ?íV<óª9Ä:óãLò Œgx~DăMø55®ìÊf¡2oX,UyÛbÊî× 5‘J½ãAÛÎjo+Š†;C÷(–×®ë¶/‘%p ™CB˜i?Ér ±õb‡^Í€ZÃÈÏ-pŸªÈÜ´HÜCÏ€è¨.¹]~½¯ íÊŽ +‚çöœ)÷†éí`¸)å|o¾Bï¾nqPfé U³ÁÝŽ÷>x¾ óÌr ¼œH{äè@{~”WýÀ­®ìq-í><DZÌ{Ä-‘°-ÀÓGîÜT³_ðOÉ{"3y«k¤ÌCÞ¦^;àu€\¾+>[`å¶lÓ™Õwã¹B³eÕ3t#[¸bh·t™ +Ú»rI7Ü6Ä2jô`6dd¥œtw Ì¢`›‹hK'{äÎ5¢ä‘Wô•a?jænÛi¿à^M…Ëk¬Ä"èr”8þ™(øHDµ¥‚ví„žd2;<Ã-£(ö^Ü eÇ@ã-Â>wÓ[£Ón¤ÕïºÒeKL\—'@ÝV{‡Ì.7R·(Hýš#R|•l~‹-R] …âQVÛñ&‰þcwŒíOx¨f4,8ö@œê>#ÕÝÈ·Gl{’$¾R'}ÒBæ8 +]„~6N`ðx ×é>²0Hü Œè ldÝÔ¢†ÊסrÑ}¸7Ê\àûQ³Dåàq"¹Ÿ÷6,t,Ò0þt$.‰L"7oï@æÝuw-·èïæuî‡Oqq„9ÁFz’'ŽŒÜÃ8ÏIãËÎ +‘•®A,ØJj’ÊÝž ÛŒî[G ôi¶Œ0'Ø"@O²å‘-{çÙâ`œJ_yÕÐψZùI`ìÆ%80nd}R  Ù÷(qÅ×rΔ䉧&®¸i1ØenœE~®â“Ìu`Ž3×=ÅÜS-s÷1Î2×ÅøCu‹¶¬ÆÏè™]ÀèÎŒ/×uE–þ³ø>Ç#üŠS?SÉi~0'ø%@Oòë‘_{çùå`¼*kñ­3¨C?†X€^µ ¸áÁ÷Md³ï¸?H´¢{½¡ð“Ù ÑêûUôúw+¹ãŒX#Úž,Euø8COåŽF\4=º_ +—P¶k¢lŽ´(ðƒh¤,d_ªƒŽ‡_?ÈRŽ\!°ÁH°|À†%a – ‡^²ØÒè†Gg  n†~ÁzqÒè®—”˜`‰×°÷ŽL‹¢ÙîjÂb˜ÊA8îy#ã`„ÜSx\B0%ÔU‚ÞD=ˆê0‰´òóÐ0«n1Æ@±ÂPk>+Yš%nLr‰Çp#2¸l°@'­À!á#‡\¥èã̽ƒª¤@&u5äf‡bä|VÿœÙ*÷ƒ<4•Ã`\ts;gAÁ«à¯n +2t`eÉ@_bLP4åÇRÁFúwý_ì>ÜG¤y—\ Öù9*M¿k)9‹0™˜#X9¬)ÈÝÈ>—Ѐ­bg()JE©Œ> 4ûú\ò +“Ü»ïˆíÆHã¬ìfdÄv_Ü–˜q$Úf]£Îc…‘H›“¨bßf制½îp7“Üï o¤"3‹;J¡˜Hž¦{Á)¹Ò´1 <{[6eWÔϸ;×Lv¥Ô XEQFƒ]Ú ƒÙ­Ë”ößÊf-7òý®B¶Ñä]Yq&ÞK“3©ÍwŠfmŽ¤QxMŠ¬CÚ [+wKé®6Ü €¼Î}H[8Ýïáþx€ºœø²ÎñªŸbJmµ<¼'!0³Zd‘#0r‰Æ–ö—¬T{«;ÙǦ«Eß +}Û1"çmÙasq•rn•æ‡Y0Nã¥ádÓ +Ô£U(øóe' ±Õ†»¯Í^_¤º`w|ÇÙì‚ 3ÂÚ²vnµ.9¸fCâ*¡3H–Êo7žAV<»œñkD˜»• Cñl†O½9¦ëÇû¡ªkjÌÑÚí½Ü.Ú[!#Ä{Ù"Õ +Pw|Á±ch Ã%[á‘i…G'd=DX¹<‡ûØ}öºüR­Þeø3žçÃ$î co fbæ#66$¡SßRÞë¶ùûb\ ~˜[òÞö Ю(z™á1Öð +Vâ©Ã ÈÉÍÕÚ¾Û 6•EÃ5º™ØU§‘Ÿ%áÉØÕ¡HTèçh"mÕTC<el4ÃÌÏ0SÀ€píw—>®yè½x$­þƾëŠ;Td`à5ÌÊP²£{'rÙ3i0ŒShF–ý"¬#ÇŒR?|ê˜#ÌÑâ°c¼ŒÌã¶ÛeÜp·ØK$5ËwzZ÷ºÝ¸] +P\³AD0S*´;"µW’e.Êc¨ ÿuɃ¤ˆµõZlTŸ‹¦9%ÝËŒîi !%*[~¬î£à«âè$¯˜ãéz*:…ЦCûgÓ!#Ùë̱‡²†˜02±(™Œ‘©–œ ØÆ(µ3QY¢ü,5QÝ-6ZRijoñ[óxCBäØäÌŠÚ>è~à‚ób[QÅ4'&ˆà LüKݺ2ö•vD³âÔ+dÓ¾úƒºÏ9°ÌA‡Â|Z”ìö„­@Ë\™Z¥$ä\žÜþá«[Âh$zŒaŸ H •KÒÓ8Âœ@zRO %pã¼: GaÁsÖ†‹ƒ) »~·½™Ðl¦làqfÜ;wStíͤ¹ŸçÚVãÞ +'ÂWË$^1š +¬¤ +|G–ªI²}qƒ:“óñ*7À¢á‘ê0ÀCÒÀÑÓ GrýØl¤\Îâ4ˆ„´SàÐu]É Iϸô ²×  \®…–Í^À!(l„Ä{J¶R‚à±ÝpOÁ;wÉ'âëQ‡z~¬JÀEšó4ÿ°ÄfÊTÞÉ$g@{ác<[®(üiº²ØŒQ4@ÞUne#rM™dG ób”hÌ8¥b,ÌGò½Ð½¡ ~˾æ,<|tÉA:WõÈœ>1gwcÌ{òüCáŒS¡óÃ8É$‚V;B 3“dƒÅ"Á ‰2=|U M…û2çN¤Lë}ÁÅp;n…:ÁжíÊ~òÔCãN  ϱ3 6åEŽÅy®Ý¶¦3˜².èÍ ;$á7ÂFMðv%YaÙ&Le× D*Hz(À”ã%mH‹ëÕwàgãÞt‷˜z“Þpá5&±Á2Qu„ä!ÜôEó3WnŠ³ {C•[~dfœc cš7|²Qo؇®„Kw¥}v Š’øÁD¯6bA`¤7.‡é‰sq³ß8@ +þ’5Ï&l\xÄÌå9‡¨Œ•7³)´ßñõFºV"bÉÈ°1>'bð`p.KÃñi–vÈPLÙPÕ'¨ïðÃN¥¶>eͯ×8…8Uf_±åÆz~ý·ñn…F­¡‘ßÑî•&#+y-ÛÔI^ÝZ0•+Ϋ¡*(BýƒHØÈ ¦«àÝú²é«kþƒâ·myHÏ"O~’ñšSkÜò¨™±w‚e-w²\îY5{}æñ0±[ý]»«ùV±[5¤“pŒæqÄZÄe=8ÎP…GR/:¨zÐî‡%b—â)×(¯æðÁþÛÅ2ÑÙ~µKxẔMoËÊ ¯È©˜J™,mÅ}¸3þ¦&–úüSYn•:%7f“QÈ4·lv"Íì†)9;Š–uoËjkL2ˆК´Í:hé6‡H¶‡,±éy:Ä÷{1ŒÀeSÀþ?*ŠzäK@Õ‡˜Ùµc¡ÿo)f³l_äaåX§„UüëÁQØ]%²sž¼Fûðh—œCc¸ÂùµC5gj²y¾ãnK¬¢ó뀃ؤhÆ,ÓTðMÖ«>C¾9þò`Œ³Lì.U"S-¢ûé×Æ`ô†­ö)NéÃF—¹€¯cÚJYJWÜR€zw¼îø*Ÿ‹×á?_þÿõ›4›fDÚÏt>óÇJù*4´ KUpb˜ß®ü_h=~·endstream endobj -5200 0 obj << +5319 0 obj << /Type /Page -/Contents 5201 0 R -/Resources 5199 0 R +/Contents 5320 0 R +/Resources 5318 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5208 0 R -/Annots [ 5204 0 R 5205 0 R ] ->> endobj -5204 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [424.243 605.692 454.872 617.685] -/Subtype/Link/A<> ->> endobj -5205 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [155.951 592.143 306.851 604.136] -/Subtype/Link/A<> ->> endobj -5202 0 obj << -/D [5200 0 R /XYZ 85.039 781.388 null] +/Parent 5311 0 R >> endobj -1410 0 obj << -/D [5200 0 R /XYZ 85.039 761.463 null] +5321 0 obj << +/D [5319 0 R /XYZ 85.039 781.388 null] >> endobj -5203 0 obj << -/D [5200 0 R /XYZ 85.039 743.459 null] +1270 0 obj << +/D [5319 0 R /XYZ 85.039 374.861 null] >> endobj -1414 0 obj << -/D [5200 0 R /XYZ 85.039 241.642 null] +5322 0 obj << +/D [5319 0 R /XYZ 85.039 340.115 null] >> endobj -5206 0 obj << -/D [5200 0 R /XYZ 85.039 222.973 null] +5318 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F62 4047 0 R /F41 2994 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1418 0 obj << -/D [5200 0 R /XYZ 85.039 125.442 null] +5325 0 obj << +/Length 3307 +/Filter /FlateDecode +>> +stream +xÚ¥ÙŽÛFò}¾b0XÀÑ$›Íc÷ÉGœ8ñ1O]$y %jD„"’šñüýÖÕͦDi†‡}TwU×ÕUÕ +¯ø^gÚT~f¡¯²ìzµ» +®ïa懫P –²t`^ß]½|§“ë0ðó ¿¾ÛŒûh?Öêúný»÷æÇW·wßÿ²X*¥¼0óË4ͼ7^}Y„Þ—÷o^}À©Ø»…î/ï?Ý-–¡÷þÓ 0¿ÞÞ~ƹE¦¼»ÅŸw?]}gɲ„iúûê÷?ƒë5ÐÿÓUà«<»~„và‡0½»¢|+é×W_®þm·â¹øšWͱ@«Ì×™:åA¨gx _1ñàu¹XÆ:õŠE”yø§èÊï`,K½a ‡+H€> l×Õ»Ú{[>T+Ùâ#@·‹%l±.xU4Üh˜«Ÿ¸ó`ROU0ÑTCE˜Jä°ìüiyrpkoß4N0hÇãÅzW!!»•áŽ‰iîþè`Ø–(&àÙ2D–æă®,zÜ®Ej£Øë·í¡^0%‘vè…NKt=Tíhì¢ê„p`¦ZaKÖ|li‡uÙcß°µ ñZ„ÙhÕ`f¾Ò!d§ž&CW”‡ ]~ãe‡‘7÷ÕÀD ƒ6tî”l¡jV‚é CÉ¿r:sà†„ ½¥¡¶bžbç7’¨Š„xTŸbØ †uBÈ™5¥ueÔ5!ål¶Þ=±¦‡*À©Àòÿ˜ÉlkKàX±´¨Q *«hùûé׸…šõHįðÔ[å]S>36 +þ8„H‡Êa óÞ3!|N_ÕUÉR* ~«€¥h †ÝÞ-2P«nÀÉ +ˆßìP`;R²~xNðˆH¥Þ=1¢1錉âœÑ¬ÐÛ1 5¯íÍ´ÀÝ’ÔTk²J%Þ[Ÿ;\ ·¬ïÁ]ˆ•0Ø”â!÷šA±o‰jœMhà‰ŠŽpÅ”ª-ÖåZ ÛƘ-ðø}OT³4þñ'ßý¶èJn ¨Ö„ ÊÛ–õž[íÆLû¾ºýM&;þv{r+ò +u5ž +CÏ7„F©À€„Þ. :T6Ž¼*tjJ^Ѭ¹q¢p°†¨B î¢!tF½žµO‹VOš Po ]¬úìðpæ£ØáÂŽl[¹_À‘Z“ʼn®üuµêHutäõí®äÖÍÀŽÖüU³[»áEh]»;5g2±È›åADü# R£7Å5•|‰_ðeÙAã‹ø2d§Y×¹š‹òXê$Ȇ抾*{`Y4½ ÚðwÝŽÆ» uâ ±É&±<ªÝ¹ñÄS+$d[ÐzA=Éí š!¶ñ(Ý»¬!Ú~­j‚ŸbÉq»BL¸¦PvÈ€0`Tqsìãaí O• ]Ÿ÷[A¼Ä0¶Äû9Ç¡O¼>(\RÅnæØx¨(]A„.ÕÜ_•Q%„SÆóò·þ¦¯ºÑõ øÞP‘TW"gZÙòw[ m{¾Á›ïð›²!âìÆìU®{ùZ°¶Ÿ’Ü”Ü0¶§Žˆrc“8,'™¨ð)¦BY&*ôþ‹l²T¹fŽá%ŽñâÁþH§ÊSº-@«Œyà4ßäkv=q,ý2úf^þç–gEžkVµV¸Ø dRÏ ­ Aì¸SÌ 9ôx¯²ÏÝçkÃÐû癘^ëÔÏ¢äb2âÀP ‡N ¡Ên„&¥Çø ñ3]Dh`N0NBÿ0Œ|FŒ¯;+{‰0Ž—ï¢ÀÙ@'~$€W~Ï zò¸Pèüé@oU’ÈdEÑ+À´‡nÛr‹þ®ÏñU~]Nò˜ | gùzáÈ×#Œó|u0¾cÕ;½èÉ3 +‹)t ¾»;Ç“@ù‰ºÌ r# ó,CÎcù1E7ÏŽÝç½ÉŸ$.3w+2dLäzU&ZG“žÞ²/úµ £ÈÑË[ð°‰xZÔÈw¨žÅ·R6˜Pœ'¾NsY¿i)ï;+Œ8h^”†s^è9y\BhrŒqV".Æ«{ÔÊ?£t5µ7á4·¢ÈӟǪ†¿ÃñIçîŹ«ËºìÀ\àž=˽ Gîaœçžƒñö%Ü!öÂÎ3 òü„U8†IâŽàŠÐ»—>q§¨»²X?1¨-8`g[R=F‹nØÙ&爥®[[¿±á‰KQ]ô·z7Z*ÛæEÏ3c˜³2&Wí—s9QEõL;ÏI:Èü4Ó—%=Â\´=+é GIaœ—´ƒñ•XGœ +±ÁÒi‡Àð•!¤–‘åÞªé“å»19p™Jòf#ŠS×…ÚOÒѵa¤B |L;|“ %IYa›ª©è•É¡| ®å\ÛZïÛóÁÎÆ BBÛÕ”7mÓ”«á,¡IàG‰!T±KZ 'y‡nLá±Æ“€ç‚éûx?`Á'W£e ¤­Ðv“ã×±YÆœƒjœ fB%7(î‡éJη6­4Øã$eíiŠ‚æ³”sº¬¡™NYumrup§E/^XÒæfêm]G͆=F++ƶ¹` JǾÎò‹êÀœ7Pôœ^Bh ô㬺h…#íXp9UMðÝij´ìÕú,XØTîT1uäy(K†£“1ÃY2Ô*Ù43“È£ØI¸öºä$"’·$¬Mq¨‡ž,Ù?'¨(õãgädA.ˆ‰až•Òyl£¦èæe4¢{ã'(¿’ØÍ-Ùj7Pªn$Ê( ¤TglAÛ•ó͈íúU!Iá ¯@O‡›5±PLÉÆ~É|V‰.³x„¹Àcz–ÉŽ\>Â8Ïæ F|ÞJA4ÂàWrHC¨ñ—IÈñùz§àÂçËw€×Åúa¢E‰‹ý¾~š±“(ó•6W”T¿Q÷”¤Gö±gÀ)Ol"I˜É¯Nû½´órmQ‰è¨rÕʤ0¹*}ÉHÇK +]nîë(œæþ.¡¢—R„f±Emjl¨u#û`ºäG¸Ù×òMÌ5øy ‹48 8¾¨aÌy 3@ÏiØ%„VÃŽ1Îj˜‹ñ7ªîÕ" ¹j_˜Š:°Êõ ‘Šj­0`¯cVByÑ#Iî%øay¹aR¥¸0•9QRÖ^[´œŠ!¾q©uR¢Sô€5ã¶ÎJðà~ñ⥇àHû4Ü}ܲÇ‹úæš&­Ÿ¦¾ OÄ%Ü}8tãe}¦ðˆSÇuM¾îÇ¡6ÕüÞÞ;Ó'~7Ü´Ê:̱28Òq2DÙƒð!‚ œŽd©<'P7ÀJ/?_rmG &Ôs›Ð3¼_ʧ<@'9$̯gž‚‚Ä­êRŸ|´Ý9~"¦£C³.¶Ùò¨æÊ×yœ©¯Ú® ¼YdzÝw(SGïQfÝ +NÚâÖ!V¾â®$q΂o'猟)pcAî÷â´úCÁ콓u ÐÚC½6Ï Øý5ÍeÊoNpÞaîÓ-æ±¹rÍb´æ~Xó€öÐTR'‘0]OsµZ¨®UpÌL‚=Ày[Aï!:¬Ë‡ÝøÜ‚#üfÙ§r«z#ã3ãeìÓŽŽ=‰Wç¸~Nàâ0ñ¾Ðã)‚?èãØc…W.¦ÜºYq…cåˆLÒÀÓýÊîÒ Ùp†Qj¯hì`uÄÒë¼âØb“êS>»Y?9ì@¯§6ˆˆ3oÕ¢~Ð5?:ÀÑý¼è²gA…¶»šÄn¦&ªƒ¼Ì2­–7œ¼xÅ9‡•5£M°-ðn+T)˜ù\Byo˜¬„À¢æˆ‡N×Ï(Ç×Ñx±k‰‰TÂ÷0®·ïnΰ=ÿCÚãü¯<ø)MM~ó…+Öóïþ蚇JÆŸ± 5&RSÉL%9ïf¥®>œ¥Çy%A€Ò“³¾¢±Î¾ìï*µ¨Ù\ÐfÓ_øÏþ_¿ãkŸÊÏÔ™ZG‘…†<@dÇôšßûü?˜nÃendstream +endobj +5324 0 obj << +/Type /Page +/Contents 5325 0 R +/Resources 5323 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5311 0 R >> endobj -5207 0 obj << -/D [5200 0 R /XYZ 85.039 96.038 null] +5326 0 obj << +/D [5324 0 R /XYZ 85.039 781.388 null] >> endobj -5199 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F73 3992 0 R /F14 2895 0 R >> -/XObject << /Im4 4878 0 R /Im2 4150 0 R >> +5323 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5211 0 obj << -/Length 3775 -/Filter /FlateDecode ->> -stream -xÚ¥koÛFò»…Ï@qÔ!b¸K.‡¢@ÚKRMêKœOm?0%³•HIÅqq?þæµË¥D;A } ggfç½V—üS—¹ £¸¸ÌrÆy~¹Ú_D—[Øy}¡b) KæûÛ‹ç¯ÒäREa—·› _Þ® ~øñÅÍíËw‹eÇ*ÂÅ2Ëòà‡7 ¼çÕ›w×oo¯ß¾ÆY‹*øpƒÛ¿¼[äqpË@×oÇío¾Á³8Œ¿ßþtñòÖQêhª -$ó?¿þ]®¥Ÿ.¢0.òË{G¡‚íýК$–ùîâýÅ¿*ÞK.ù«9©˜8MŸ‹EO,Jé0Vú23Qh¢„ä2Ü#pa¢`Ãòãb©ó ÚÁRRíóàÓ¤AÙÕí`zäDžz¸ ¦€:"¤o®êÍKø4ÓÁðpX8C¾šPdò0MŒ|w’QðòÓ è˜‚P5«v¿Xª n`²åõ ;XØá·H%0ÝUòIÏ¿ý˜1&ø£Zá×sª‚5ó4´ V6<¯AÎÏ›„ø€ i&çÙpˆæ‡×ÓYýÄøQ¼=š†˜kÉ ¯ïÚ~觷ëkkÍŸj« ‚ 5³Ü;+Ø«Õñ`Ñ_ñÒo‘‰ÜÅáWÎYÍhV‚õÞàöÁ/œ[‰ -áŸäJTF Žù.tI룣Yô¦dö¤å­Þ¢+{ëR Ô™O ø ?*Ãò•µ1&q»» -Õ>mB“é/hßô„ö З´ï©­öž7«}ÞyVûtžÚ0Ó6kœ;ÍÓ9hž 08+ùçjâ‘ø›5]‡§W¼~Ò%q®´:#ƒ §xŠƒmÕ€§[ñ„/ ¿¢[îf4ëÄ êÏç²ú;ã¥,«Z"Á¹ÙмTiCÊ¿ûrÒYþ)ŒbÙmƒÉE›#†Œ¼EEdIÚ)lÛ8ê™ ­ß¡p›ó0¾r‘ÿÐ_ñÒ#v;’Å¢e×;2u@[ z´oêXHÈŸÂïyLº¯ -Æ$cóð-P â –wø[ÿå鶫<ò¨Ÿ‰)*Ê †ÉúÈ&sȘ‘(ºûº·\¦¹6OˆáÒæ )†ãU{”¼Í¡ 'ÖÒ_—ú”ëÑ?…±O¡ŽU¨3›\hÊ;I]A;Â`O5ÒhƒŠþ œ'›3JE³"ß‘Ú¸Jwer_ŸLnÓ ƒZÓqjrâ3b "N.MšCq–}¹Œ©ùRp)¨–®s߃Y¤à,Ò¾k·L$eÞ¤Ž ª…Ò“7SpŽ…h.žF"@@v[%ÿxú¾’jŽ4K%a©É%Œ²‹Óxb‹ö˜UWã‘f+™õ á+k•à–E2ÆJñ®y.Ÿ* XM¡Š´V`1øÚ×o?È`~ë áÖ-̨X%[ÙÈÉNk—dXí^L m…gtß„1“€>ÛÎnt[x7Ð<ðÇ«} „”¾ÄDôݪa^‘O_æg„ªÞdJØi¸˜/s‚ÉVÃàN¸’ú£(v‘Ì`§Äª€ò¤¡¶ê‰ëœ½`솃ÅãÎsW8.ÇZš@{çü¤2¥˜‡ØšvàÁXBõk3hP‘è‰2“é«à†Â<øx$Ò8Ž"´¾¯¤•¹HØóÖÀÙVË3 ÷wµÊCŒQWq×Ï3æ '÷d°\IRùÍ‘¼À@˜Šú<Àó‘¾Ê•GìàÏù÷JJ;£©)”´AÊAa+Œ®-×¼H‘DÓue=ƒž“ù3ŒX -«/¿˜WMB`OÄû¼¤g‰ºQcÕØÚ\㜱 ‘ï»YZ/nü|D®cGé@bRwAè>¡ô¿x™©Êȵ¨ž÷<÷*xŠ„ûªYSà7^% 㟹ƒ ÇÏ(œÎÍ.…öÛ2¨ •4fλ¶úèD@»©{n V¹fTf*)(ñw ©7¦¡\aY¹”8»œ’GV=\¡ž€‰»›ñÇcë¯úŒæmoÓ¼öE ®ùùüÔÔ;€Ãäîz¸—TýŸPFÚŠôx¥Ý^|¼„©X‡y1ísÙ £ìn²uaF®š¯<ç>$Ýù§ÚËUN®8³ÇÏH"5a®­$^-2T;´"j¤<‡øÛóp6=IòD¾…¼fUÙ “í*6”’ìO;æy -¿àÕŠø ÇB/=ðsŠiú™Õõâ³ß²]Jš–$Pý$Óã¨ñ§Ñ(1a”]&I&I2ŒdéÁÌÄ¢)Š ®¹%wÛs[rRáOz‹äRv®àê±áÅ;OØk,¬/¥óOϸ÷¾nýΧ„郓§õv©Aȸcc[.Ÿ>Œe(vfòi+ ]œ½nÇPÛ7§Õ”KËD{Ù8ŒOs@üz&†¡Â'6 -"QHƒ ã' â{iÞ1¦thÀäâ?ŠE -§í 9Å“PÃßo\ê}â_- LoÈÇŽèçkbeË8Ò ‡’;x=Q|ô„50HW¹`¶£Ä!òº'Ñ+–pÑ™ÀØn¦õ½´Y¬Xw¼<Ær -•¼XËa¬IËŽ§žÕËz¢‹K1ÒNÔÕEÚ˜¢ª‰`6mãúŸ9 -ÏA¡@'ÒÆURð”=tó#ÙM·jÆ(=¦ò÷ç ø¹²Ük#I’äÚH^$žy¬ŠÂ´°ÙûÆó¶KºžÃÜ+Næ‰-…¥º¡àº³ß5€íÚ¸Aý5±Ê™GÂ8÷%ó䃧CMî - ”ΘëCyÐ,0U„&„C±h7 ã£\ -v¸ˆ#zì‰Å»¥©-c2ïU&¯êë„"é?Â@…´býäñR%†`/þØv#°3×è¹/èT&ÖÁøôwÞ(ò0Ò¶ò¼8˜>ß×û*³/’Jå¡2éØóˆÆŽ(·+i0Íê‘L.«…ÂUI€ÊOèÃòp›éBŽúÇ£$iä0žæ'ýL?scÉöØ»b÷KÚÉÒ‘B{éäÙª¥€Â _Ü”’‹òür#ÅäýjS(z÷VcOª”ŽÛ¤P¶q8”ò:m’©ñ™‘hDŸî½u͸¯ŽßìÚmCô êtGg夲à'î¸ÇÆML\±Wq -žŠœçø\¹f4÷wô&À¢du#XëAþë¬Í6qRª#§æLÚ•ì™çrdkÈ)ú‘Õgœs‰ëeG»²n°>Ðåu’Ma€Ú—²xàf0,aï´7™°È­ËzRé1_Ë”ßÍ ø6µM|ð4H‹Y³˜ !ÞåŒrÚÂLû•íÆ{}š3Wìå¹?!x’Þ”GÖFí+¿g }e³³ 5’@þJ£—ÇkìŽþ¤*×ò²A -ó§k2$ã{™<нÌÓ0†$|™Äa§,ÄÃaI!JäùaÉf54ÂVc?@°Eï=ûææ_¯Ègî%T¹¼™÷ ëJɲ鱣A¢ÕšZí:}bSî+^¢æ5ªZ:g>ã”ò8Ô©•mˆŸÓ¥!ovÒ žc"pÖ -nK’óÕHr¹¥üJÛGE[ÂÍE1E©UÑ £\¯{Iy ¦é´¢ rz{gÿZ •¡¤ MI½v9Þ¶ngì’ºâïÈIøp¢sÒ¹€á¥¶°ËÃ7¯F ¸¡”moV<Vò»¨ $ÊBhk¦D|ý9_u` ÙÈÉè“gü)erç2†|ÂÖ¬¯ C:„hÀ/àžS¯tV 2zVH¯dmÍitŒíß"Èsÿuv•a¥Û7i©¶RÀbñ‡¬«:ô<°¿sûǾÓõo£ä;ÙûC¼Fß—@Îî°lø/À M“ö'‘–€ÉS¿Ø#Îù1 \!áàôW]yIÔ›qóF‡ùø÷E ƒ™¤&#úmòzŽ$ Se»a5û¤µçs¿ˆc…‚ZßRJm,`å¶á¡ËœÀl“òõxÚy¸y,‹± -.©‘›@RFodTòœa‰+ÑÜV¢ÅÔõ³­*šÔZÊ7›ã,‚Ü<9c5IöÂĉïÛ™Sò0Ém(Jæ0àC½½ÄïÁ> +stream +xÚ¥YéoÛÈÿî¿B +,XÌ\¼²@[¯íl¼ÍáÆÞn‹$h‰²ØP¤JRqÜ¿¾ï˜á!ÑÞ‹EÖœ™73oÞù{Or&à?9‹_èdÅÒ×q<[nOÄìV~>‘–baIšŸnO^¾™~"’Ùíº?'ðM g·«OÞù›³ëÛËó…ÖÚ“±?_DQì¿=»™Kïæêüì-.ÞßÎÒ»zÿ3Ó#ͯ××pmkïvþåö—“ËÛŽ­îB`!Ažþsò鋘­€ÿ_N„¯“xöß—°¼=¦üÀh;.NnNþÞÅkfÆ»¦Dà(2ñŒ¾3 mð/ UYfËÖG›÷™zdFô•Š-1øD'Þ‡’£ó‰‰vƒ‚!Sž-t¢ý0V#a.+2£:=¼Ã_hzŸE šM…R¬p*è eÕòPÕl¸³ÝÀÛi)å?ëìWøé˪\5§8ÃjØÛƒˆñÑ…iÑTöÌôëÜݺs·Î»Iòû6³‡vÖ9²ÐÙñ=Ÿöpl[c bP°ŽËŸÑæäZ Hâ…‰oBSß3- +­`Ýãð³¦ì‡äT:^çR¼0¶ažËKþkÏ·³Ë"ÑñxÀ- ¸EÓnóÊn.*RÛ¢Þ±Íi|*kF×u^’‘½¸5P@i¹â° ÑWxéwŽ’‡–©}•8Ë\W$‹¬öùP»zñüE’aâBé¡€MôS¡­îñëÐáÊ œ‚!Òì\¤§É‡Jø±‰º0Fó«ðã¹W%‰/„:|ßîâ+²¶oœ•áJ»É9ÄaÐÙ8h»Ð€³/úìxÅAÑ*@<'# UBNý¬ ø8ØJ`áŸ×¼Fé­Zwáš $'KN &92Ÿ hšWÎCHY|½§ËÐI ­øÚ¶qw(­üeÙÓ›7o²ãË RTuK:ÂSÚ£«Í‚ÄøFF¿WÀ˜¢i°²pg-‡'c_w÷á?îQ8oßZÖ9%̶K ôÚ×sÈqœ]HU2JÀWäÈ®«špA˜Ñd»í´GnŠZ$÷_#/!æýÆO¨Ìy¼UÄyxù?Ô†k½Ú ýPˆ©«âHKÅL8 Œ€$ÿ˜–ìY‹ÁaZRÊ—2în<Ò“ñÞÁàìê½~m÷We5£A +Q22â.â`¶Xr¶‚3¾0äHí‚ÊÈu»œ …¿q›ò²ÉW.ƨŽ#‘oV±‹DðŒª¬FýÃÿ¾O„ !(r!èal,x[Õ1áñ̈Áâ¥=…H7ShÂç­| +mÄ¡GÝ…)-ƒÍYB;Ìß©5á»-k¦e›È=ƢОyÓ¦|ëvâr·6`ÆwÐh¦|¦x¾RÐÍÇ(ýO_˜ Ù¤uF¥O8f¿ ŽæˆPPAq—K®†É8(XlzŒ'›}–`,OQ§ÆáE—kž$[qùÅöåFoõv‰P†MزäÃmCTߺ ÙXVu FWRÐw_c0?’ Ìõ˜ÜÈeÁÜ¥ÓQJ;&¤‰`ʦgÙAÆçuŒµ}½’3ƻݸ´nQ½¢â-#Ó °†þö寞ðXàêYÐÇ9¼Bú0»ƒlàŽï“\?{¡£9ºq#¤TYÔèF”¼ŒId%-¿Íô§œp0|8}PADÔ³2û–/ç @ú;2¬€t—XFŒ„€º„4WÖNí)ÔGž%/‚’Ž\(ÿ/ˆÀLr(a«Î˜–ZÑ°¥ÁókrTÂÒF¦ïz +ÎEv•µi^tE¤„ç±(éË@ë.ç&OØŠ‚:A?ß’ÐfWu=nÜRùË­Ë%T!î‚eËsÌ…¤Jžní–”ÿAsœ‡ZRP൵M¸xH× IäA3$€Ú²¹K„÷ÛTK–Õß^R‹ H.>ÜðÇ =†×`Øéî/¤Öj»cöòµjE`aë‡öšóWŸ¥6†ªO^½/Q@øù²ÌÚª0Í£}“Õ¯ê +å…ã@¹âv wØsÜç>LRÿñ׫˲­ÝæýÛjw6½AF¾<èÙ#/øïæìÝOg‹›Ëÿ¸üˆã75Ët›½˜0´…;jð°A#ä›»ßÅýÞ¹ˆƒNT„”ƒ<*¶?äÐ/=í SÆ•")yÓ7¯V?¢&„×rþâ~}ì.¥šã”¿¹ð¢€O]f‚VH¬çâÏ +.ÄØmœ¤ègꔓplœ Ã]}}ïáL2°¦ öHëŽl˜àlOýX +ßhØ¸Ý ˜ÅÊÝùÌAO\@O3AÔ‡$š´!ɱ÷oûÏW;÷‹oJíßakûÍAÔë`°«ñ¦©`Ó¸¶ÉäÖRð»HM»öµC›=+Ð2-õE;c0A R ±U‡Ö)2FvI0ŽIÁ0í¶“Äèør}è¾ûNo-ÒR±û]Ë.ðMöçOœ8‚0wPòäšÝ„¶ùvØ¡Ö§šWøT2…®ÅÌžõ‡~Èï[>Àw2Ð@ J:^ø§‡äß@Çàú˜áÿêÒîendstream endobj -5210 0 obj << +5328 0 obj << /Type /Page -/Contents 5211 0 R -/Resources 5209 0 R +/Contents 5329 0 R +/Resources 5327 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5208 0 R -/Annots [ 5213 0 R 5214 0 R 5215 0 R ] ->> endobj -5213 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 538.171 193.25 549.86] -/Subtype/Link/A<> +/Parent 5311 0 R >> endobj -5214 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [455.889 456.27 512.306 469.171] -/Subtype/Link/A<> +5330 0 obj << +/D [5328 0 R /XYZ 85.039 781.388 null] >> endobj -5215 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 443.327 146.066 455.016] -/Subtype/Link/A<> +1274 0 obj << +/D [5328 0 R /XYZ 85.039 761.463 null] >> endobj -5212 0 obj << -/D [5210 0 R /XYZ 85.039 781.388 null] +5331 0 obj << +/D [5328 0 R /XYZ 85.039 743.459 null] >> endobj -1422 0 obj << -/D [5210 0 R /XYZ 85.039 374.255 null] +1278 0 obj << +/D [5328 0 R /XYZ 85.039 484.308 null] >> endobj -5216 0 obj << -/D [5210 0 R /XYZ 85.039 353.664 null] +5332 0 obj << +/D [5328 0 R /XYZ 85.039 447.441 null] >> endobj -5209 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R /F11 2898 0 R >> +5327 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5219 0 obj << -/Length 2562 +5335 0 obj << +/Length 3197 /Filter /FlateDecode >> stream -xÚ¥Y[wÛ6~÷¯ÐCÏYj ‚dß;v”Ó¸ÚDÞ>´} %Úâ®Dª"åÄÿ~çP”L¹Ûúä$†ƒÁÌ`.9Šà¥±ˆt6JR)tšŽæë³hô_nΤãKØãy?;»¸¶f$#‘EÙhö°— ëÑlñkpùñÝtöáË8ÔZ2ã0IÒàòn:–ÁW¦N¿Lng“Ûœ ÊànŠŸþ2Nu0c¦Éíþó»ÏïßñL‹hüûìÓÙ‡Y§i§h•¡šœýú{4Z€IŸÎ"¡³tô Æ‘ðy}zŠØh7_}=ûW'Š¿™¯òŠQV¨±HUúçÛé8qf·‹F¡Š¬Ð‘:)‡VE ‡GžýPN(¥ZªQ«L¨xX‰I)²8ÆÃ’26S£D)aðüà´nkpo;ePûÕ³[iḔ9úc$Ed²L3OoLì #ÂÅd-GW5h::P–å†=Á¤¬L{‘%cøh’‘Í-CÊΖcÔ”ÝòÀH” þª Ç<‘-Ûg&–ëÍ8TIPá\ÔæUËŸ0+‹¤æE5wïimÓŽU|ÃhZT¼Ô“Q.šr]®r¤n™ðyÒ?@—â)K«˜L ¥Ï¨ÉL’8(µÂ¡ñYò#Ïêªà˜‚à4ußAJ ™`p Ü| 7«rž·e]Áø‚÷¨›¶AÕçÛrC'M‚"¾M[®V¶)è¸C¥É¥Ó É$S(à&É:ÙH£ã"_¶dJÕB Ål\ß³‹E±@Þ£_^³^“£0üq³UY9‘Ξ—ªÕS¹­«59EÓ[V¢ûUÑ0õž’ŒÇ.¥À{ò|(‹b#£SáñTýÍ0 ½ä^ò¯s§˜…Ì©ü©à yØB`Ð ã ;aœ”UÓ•=öòÂðå»fB'hJå©i¿v!M¡£ó6ðmÙò«à´ÅÕ8¨Hu› Ó<W£C!ù “®.[ µqKÚ¸ \³'IbýÀrXG<¾tÖ•óÕ¦cö92!8p}h"KÊâ¾8<Ï{× ¥®.†í`mí~)Úa°( -©î‡tø›}c˜cç0sæs-§AC_*ßWíõ¸Âó¢®3  ÒŠ:þ’‚8Ø’.[[5å}¹*[cÈ€çìc¸êònL‰ü2õÞ4m½i"[zÚe U‚¶;>ˆ£“ ³ DðPCkÞyjáÔùŽEGY¿¤øƒ„Ú°ÀE\C‰¼€R:^ñÏ™0Ìk®ÐNÝ~¦•&[T9ïb&ëÀÇÀÈ$RÄà‹ØzvC€(¡¯„¸.{; ´ž™7‹I2Óæÿ5¸õIT -5B€Ó^G¥&ƒþ*èý2jo+:…êñ45&qê¡)D¨4†áh|šªW iOðihj,àŒ³åª®þµ(±½è}ØaI5‰+Ëøñ%žB꺤À+Ä>¸f‚Ÿ=dáF™¯7¾›ê^ àd[䋆yWåÝëÝ0!ËæÇ´Š!”9-¬¶î­ »Ð]lˆ·T|H¥»æ–.©2†ÖÚ €¿w¹:ÜG¦ê`Ÿ{ÄêþÃQœÂX¶Ѭ=¨`JDÊçófÑÚ\'B‚Õ½›]¯ Á*øæÝŽ/F´iîørg€n:Š»—ôË8¦wZZr¸Bœ]8ôI ôwœÊ}`Ú^C†1Ò·.eÞ½j)ªÌ -£äÑCåë -º³Äh‡j~ e²ž²*NÜ{Wšs¬ ªKFüü„áÆUóFŶËžÑý2³äC'¡½wˆ-a-ªÈW: 4œS øƒàf2[vŽÕí{ *¾·œ/^ó;;þÄ«·ûtꀩ³lJNÒs^àMêîÖòï%~àç¹ð‡¿žtø„²Ü„§7?Aù³ÜÃMi°Ü<®þjòuæÿ”ò2ªžXëûî’bæäFh¸C÷äN·°^©‡i¯ Ïý› „€Ž§!šMœØëI`­8Æê^šŽ_ÓNBÌH¨lžÁ_Ž 7ý¿[òÀõ©Î†1^¬”PÒë‚žSQr¬o¬ñâ®_*ü?ðçendstream +xÚÅZÝoã6Ï_‘îKd fE‰úÚ{(²Ûv›vÑM»9´‡¶À)¶ëb[®$ošûëo¾Hѱ,z‡b+~ 9ÃáÌüfèèËþÓ—y¢Â¸¸Ìr­â<¿\l/¢yw¡…b.$sæÍÝÅß$é¥U—w«aŸD™$¾¼[þ¼ýöúöîëŸfó8Ž«Ù<Ëòàíûë3|¼y{ý§Lp ÝŸn~¸›ÍupóÃ;¦Gš¿ßÞ~À¹Yw³ßï¾»øúΉå‚ÊôÇů¿‡—Kÿ»‹PÅE~ùíPi˜Þ^€P*1±ô7/~t[ñœ¹äUc*Hâ\%y|ªŒè UÒÁÍ,ʃ§Ù<2QPn6Üè×p¬ +ÛqÐØŽZÑÁ¡ã^ÇÄKÞb·²¦\Ö;ø>Ȇ»%/©w]»×0µ{8屄f[Â}ªötº+·È°â™'$+gQ<óæ¿…I¸@‚EØpK¼0Ü;~œ§ÊhÔžü¶©w=’^¡P3FÁÕm‹c´òHqi¤òBÖ7$—sc +‡ }×SÐìS:ŒM¬K”“Ï„#9Ipi-«Uy@©ûN¦è =wV¨ÑVC{]‘ÀPMž7+fôŒ,šwˆÕLu–1 Ô>‡¾Ú-¾"Í1Áƒe_2ɦ‘~# =l`¸†¥íwL¸€«îHGá‘rV-hË^%œ[v§ƒ¹j;<Ÿ1ÁìâxÏ$t4Rêó=ñ­Ž6b"2±G«t˜ížó{”–Œ ð@Öì7•RjÆz5Ið7hΑ—½é1¯J‹éhäHÈ#˜4*6©çˆi–¨"NH7 +T| Z£'Äi¼kú]ç¸4vŸ)q<š³!…(ÆþA­Aõ“&X¶¨ZkÏn˜Ì*Mr{¶­#7$µBx +núãmU.ŸyhF~ꮺ€XøWœ5UyšÉ±ʾnvÌöžl‰Ûì› ÖbSW;œèENÜÀI9Læ´3"u–ª "1³ß–Ï#ÎM«,aßàë?ŽQ‘=:K-Z„‘” ¿.àB´å‘…\òºÁ“¸_÷LÓð©dÁû°÷[¨MëÅcQÉH^ÍSÛráwMá\ØìX(ô¡8 +Þzæ`]÷ä_2¹©ú«Ž§Ù§½c[o>åâC ÷¾œZB~Æp$‡†!æQ«Ä¦PJ‹žx¸¯÷Ï ºƒÑ¶^ ÿG™s¡'·s„©·P ¹6tÌ0øf– +ßH@Ó–Û½sÏq¢ºq m†{{Á{‰ª^"ë~D5ÛrW> G‡7ø¾b‘Ðë"-ö Ã.X£¬€=}÷Š'È+|Ê=²Ü»Í>ǹ8(;ùâvŸêÎÞnP»xÒÑ^™Tµ´Y€eR¶åC[bkÝ}‰1X×;ÙÌjãÍé¹Aíxíq‹†l‰ô[’Y”  Z#ö?Íp–¶nÄIpaÝuh*‹™yHIEw kXËf2óÏŸñb+îì*wt é)VÐÄ }'Bc_î-tq…±®þ·l¶jd¨ãÞ¿š{nà•µpÎSE¼¯úÞíéaܵá/%bبLÉ/›Ý•t»¾i0ñvúÏ®&À/I"•MÁGãàO«£ƒ›$ÊT‘¥üé@c€MÂà#¨&#ü +³$ +G’ ÀGj~ØcL§p‚gà{Õ³à톂©]ñUkÓ¤Oh@gŽ%*M¢éc4gQÕ±Êc.9îØB°Ñ®çV'p#QVsà²mý°–À§E0ä=0÷©®žÐJª%÷!æ¡ Ù…Zƒ^òÚ[*)b÷Ð1Ù=FÓg¤Ùzœý„ŒGl ¤6ú½Ë5wÝAs=¤‡ÏÌû:Ý<ëeìëúöðð°ñåͽäÚkŽä€…3dÀk0ñX7 égC)µ —4V¶¶¾~/‹¸+ñ×F;cå’[ä…äßµ$izÏÅŽÀƒœ£W" 9"|ï9ÙqÝÎÓÍ’ Ã76v„’/…‡42ЋдÅ-Kĺ€vÑìVî]¸… ®¤Bû{¿vEÃk†/Š¡ÄNÂ8PmQTfYÏûòþ~fK¦¦à^nŸé:¢ä½°à;ÕÆÓºÚñôÖC‡rOq…ù™P”|´¬DÈ=‹Sµ¢<®¸ÂT¬$åÛb,^H‰QʹoCÕ&*hÛ`É„þÐ×U'ùÌHö©¡€·i+¢¥ÖÇGY”rÀ²õª^N4Õs¾‰«x‚à_EåÕ3— QaTaÖWá¦![kÙÓGÑ_k¼—NœÎ=ÀLJ‡÷Uoݺá95xæÖPròâC5“ +FÚ+i¡³oÙÝåÀX³'ƒ‚.²emåe.5ä]±Ý‹Ä@.Ë%b§F¬ëÛÊ¡\'å!¹5·]j$å®î+ ŸDƒcxííÒWøT’{ÜS¸£QÆ-P’ ìWÞ½!¹Âýof¬åI~|õš+<ã‚Óf†ŸæCKÌ÷V2”çh×¢mhKHÄ”$ÞŸðÈ˃ÄØc®ó²´q  +s+¤ã`Œ¯D|ñDv v­ÐQ ߟë]ô=R}ñËígLø3aìÿÌ}g_Ž¸=aÎ÷e ¯8©¸=ØZÂ÷Ö8=Â,¥0I&aFJJŒ¿=÷øÞ ñdM©!ƒ§‘áu Ät/¸愵l!áÙqd†1¹ÜgîUe'-2øRÑ€7’`ñØ£µ'[ysxÀf] ‚y;†%™°6AŒ¸ÈqŸ(è"õñXd8÷„ùûÖÅ ØmP¬6>UÉF‚uÙ”ÁQ ÉØ.ÇAH†mÛÜxB¢h {a×U"}å=8 ü€StÑ„xypM¯m:¶¡Â&0¾¨ÝX•ž*6Â&Hñr´RO”6ÆOW@L9¶¶ GÐgžkv=Y<$)·cRÅ© +C‹8K«ÓY+Ú7†§µ…#œñ+eÊÜÔGLQÝèfKÁuÑöˆR î×#Ü“DÅöÂŽXîìá(ûÁã6üµÙu®—/.Û gŽ²o¨ù%­PYvü¶zëaÏ×Cº£'ξå­p’Ÿ: +2´®;n­,U)/ŸØ¶ÛV6ºÕXP 8[ + þt©'¿áO[¼1þ.^.O‹EhD7ü6ô̓_n¹OÇkV¿ÜBð%Ñ^¿¬N2­²<·Ñ*…ªb¬:’¹G3Z»}PÁ×/yAå’Nr"‚i>p‘!xŽÏçΦ{º€|åÇãW®Rµ˜~¢ Ù;Ê"Ff\B&™{4ge´4T¾ä¥C£ Ÿbfi¦¹é°PEjŽØ}ðÞDˆ×ÕHVjr¥óÈ%¥PKû‚‰‰T×Ët«† +¢ªUç4hŒ*¢dZƒÍy + 2Îjp‚Ù Á)nNƒ»ŸjWlj[DE,~¿(æ$ ÅyD÷±  ùHâ¬e C ¥÷èJvâNËi(?¥EÁCÀ¾[7ü®„©ÖéEiæE’ú¿.‘8üÛ48(mªEϲ×rž…¼èVö<À…' F,GÇ@Yê›JsLœ(êB¥ªÒÔ¼ˆºÕªjyëEÕQÝsÖŒàö¢,Ÿ6£æ¼ òϚѳÁŒ¦¸93òؽwÕgþ½Íôm¹Ð]l¹£g[.ÈK ´[yÚ`îUOöµÄ2±s®‚~ôfóè!utfàöŠIHðhF!!Ïb·ªãÍ($LqbH˜ä#·ìóqÐñ+qã©ð/¢‚6Ü$Ť1z4çÅšIT˜bæŒq’›5FŸÝÿ´Î@$=­Áæ¼…f¦˜ œâæ4è±E“'£ñkQÁäé *àü9T€º 0ú¿ESdÌò½Å!¡Ç‚Låî/ PÂl8,ÂÇê‘“8l ŸfB›Û¡<ƒˆy”â“Ñ 8zù:c+Y¦ ›4•ä¬¥ÉdÜŸàäìdŠ•5×ÛüîÇ1¨™ôµTÃYzWíøŽ!Yq7­àflm[ÞŸÑ]ªHO'_ÉYÝ ²2çt7ÁÉénŠ•ÕÇkBw4€ïa‡¾‡ñSUZe§Ƀý‰2 +ý”y O®#?ÖÄ Ðhô…lÊÿÓ_`¹| þ–s&‚'QZ±²P°ÓáKyí_jüï‡"sendstream endobj -5218 0 obj << +5334 0 obj << /Type /Page -/Contents 5219 0 R -/Resources 5217 0 R +/Contents 5335 0 R +/Resources 5333 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5208 0 R +/Parent 5311 0 R >> endobj -5220 0 obj << -/D [5218 0 R /XYZ 85.039 781.388 null] +5336 0 obj << +/D [5334 0 R /XYZ 85.039 781.388 null] >> endobj -1426 0 obj << -/D [5218 0 R /XYZ 85.039 367.956 null] +1282 0 obj << +/D [5334 0 R /XYZ 85.039 704.69 null] >> endobj -5221 0 obj << -/D [5218 0 R /XYZ 85.039 347.365 null] +5337 0 obj << +/D [5334 0 R /XYZ 85.039 665.132 null] >> endobj -5217 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R >> -/XObject << /Im1 3957 0 R /Im2 4150 0 R >> -/ProcSet [ /PDF /Text ] +1286 0 obj << +/D [5334 0 R /XYZ 85.039 552.746 null] >> endobj -5224 0 obj << -/Length 2599 -/Filter /FlateDecode ->> -stream -xÚ¥YYsÛ8~÷¯Ðú‰ª -iââ1o™Ìdâ©ÚŒ7Q¶²y %ÚæD"’òñï·€‡EÑÞl¥âh úBK,Bø'‰ B•.âD*IëÝY¸¸…™?΄¥ð-‰? ùuuvñ>Ò i˜.V7ý>&ÐF-V›¯Þ»o¯V¿ZúJ)O¤ÁÒãÄ{÷åj)¼ÏŸý«ÛŠçô‚WM¡bT˜DâÌ!–É„ 5á’í÷ÛbµEU^Të6oý¦­ól‡Ç¹x/†ËM ¹ðµ -"Ñây37”×.eì=,eâU<°[ú«j€Ë’æ8ðýŒ¦öÐÚæ 6a¦#™ý!×øHäG¿¹Ë·Û¥/#iF3ûªi›u]ì[ØÚÄÆS -¨DzmþضվAnŸ/Ý”¶Æ©‹ý6+JÐeŸØñEÐVw€€Ôpê¬i¹Õ"^ˆ\…¡Å(Û18Øi˜²Ìvvu Û»(^±‘1p*wš–àŸM¥ k–ô?¡Ð[`Ö³š¥h+fÅ×Yç^Uòì¹ o²(Ïy0#9%/¡½p~Ë+³¦Û¡÷e(ƒ§0$Ç9Ž ,æЄ+¦óã5ŸƒÙj¡@Z~(`²D6í/ X)|aà®hXMGR¤ŸD–zmÁ[úR¥^áðd½„ÿ6ù†WÞ,I_;žGÒ批e<‡SÅíÝ–?4Uàv·zu“gí朹T7lçVs–tÁÂ;‡“‰à„+1\à4ç4dÿfýË@ ¹©‚X±ýƒ+4°W­…°nÛPQì}ÊŠ:ßåeÛœKÇóRu$$”;%+”uÔÎB(-#ð+|ØÞetOØ3Þ®bã­IÅw8wM7@÷Üð$Œð6ØÕ6­.xÎëiï{wdè}¨¬eZe¾§Vý6Ñ( ÚÅwÎœÈ(AÕN(Á¶Ø-j™Ù–µwpsî;ÃvU¢_ÄÖ¾vzêor´ÕNoÝvwn ÎAöÈïßµH:˜_g%7öÛé(m[ØÁØP»ì -mñÝ"B›tvX ÍöÜGÈ>ØjVVÃÅ°ËÇB€Gqä]¶8-<ºÍCãzl¢-â®B²NÜc‡Ë;[¼댙¥àà“mœ ‚aìȽ¦Ú »lËc=ö—úù£…Ð~ŒCƒ‡ w‰VžD=x*‰ ^DlÃsèÊð<8õPîè˜"ãIÖR:\µ‘s»ïT´vx¯cÏ.ÉÁ|tH<¼…¢D¬æ0´à¹«&âCO`P Œ±v†H!¡pQKC $ÔàÇîÈByTâ3O qü Üd†c&Dy°lHkcM& 6ë‚y„$`ë^QN$ -’¡4–6þ¡?Ú§}>(# i¤%Ì¡‰,EAÞ¥¥ÁB{®«ò~2/ˆÙqcs§»¼ä"Šß‡sju1{ì1²Í ší“]W6ŦOµÞ}Ái²º<÷ÞÎïj%A&ñr†ª „Š4šÌPATKÌÉmhQÛpËRwñL€"¦1}Ĥ†a,¢$‡Ø³›Yûãó1•Œi©q«Å…B¦Šim»? \\îôâ· -\Œdä}ýÁÆÕ’Q©Ž!ÇÒAœº°fo’‡ÍKÈm±­ö]©Ä;Çö;zƒÐó$íÝд -Ê´GÛœ3Á «š;dôÆæ—¡“¨-ó¦Å0¡# ïli ýؼi«ÜRŠHÒ³¼ŽM´$Šµ4íÆߦ.÷Ìì–äv÷då¡ C£ÆƒójE›3!ç´¼E¨ÀªÒžyuh§¸ë@EÊRQ´ ðLù3hîªÃvc“Tš -©ûè™Ð{Ecýc»?Æë.†"þð%Ü—?|÷Äjx -ÔeO›Q¤í½¸QÞßÕ5o}hrË«-ÚmÎ"¬«}>‡«='Et&·ùðL_Ç×üíÈž 1Õ`- -ðH”žÌ÷? êÒÐcÛ°DÈýª.JL:Ÿ3MEÉtž©¥9b:6È4 ’01u)áþíà -ZñÛåþFXü)¨PjŒóù «COˆáo‰oRôÌÝnôꀎû¶.…à2ðž_{3ºaƒ2 û¢H`S Ð΢¼å~–”Qœ¸T™Â•DbþRD§/աĨÏƳü˜äˆÝø:!ÞÊDŒØuþ"_‰G本.Ö<ö7&æ׶ŒóÑc¯s›jt#´Æ-èÒJÁ ¯…Öf‰yý)lãˆJóØöD3ØZ¢WÌ,Sg0Ï™Ž–¡!ìynÚºÓ¯´ x€Ñ„UOma¥Ô¬(3û6ö½pSûeÖ]”­$¡6Ãæ×NYO¡ -˜(¡^@µ'šAÕ½Õ9¦ªÏ˜N¢:àù¿¡ÊJì³»êñêbäõa3el-r²Žf1¦y `3;¼Æ'áê¾dä÷ˆÇö÷æ]÷—î]û]¨DDQý€tJpÐQ½€eO4¦%z šsL;8Ÿ1ÄsÀs5åí¨"Õ:ggó†)Dj¥å<¢Ó88¢Wà0ËÔáðœéF&#¦ºÿÚÛª#nû†K¶JD£<€GÆY9'‚vŠ*×6aqûí -r~ X:>üÄ8YâüÑ·Yx‰0eû^k×mWÚÛг:ãÎÍ°<$0g¨«?’'²fxÑèT¾²Ë„*Ø®\ŒeJ?J"ï²d–»Š«5vf ½¼¡I•˜,þÞw%Š'{BBŽ˜g =g»DŸÚ¶8ÒE -I…øðkƹí3Tà=çAµ¥[wNrߺð: ªÇÀPþX4­õÁÒ]L_W9.p æ°Ï¨Ø˳ òTö%ÛàøݽòÁ5Q‹ê!X {¦ù:{¼‹þ•y‘Æ ¿û=éçþ ŒðâB_GŽe®,௕š/M‹’?eF¥imKÓWuÞÊt-Ú-Ÿ•£§9]†ôÒð#á-eh‹À™íg…-–A$÷®¨>Ó´Ÿ]A™Ô•-ŒIÿq‡qh¬m©°Æ"#R¸"¿©àñÐÚEK6hv…Z\ò¥Ddž:Õ›ºRë6/ó:k]­³¦u¯‘ y%2k+7y_éP\//ýŽþÂÆ–Ž;a¢ý€3®ožú™xr2å€?>çÿõcl§GZÁC2V##e …“q•aò\^÷£í‘ÀÿgCªendstream -endobj -5223 0 obj << -/Type /Page -/Contents 5224 0 R -/Resources 5222 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5208 0 R +5338 0 obj << +/D [5334 0 R /XYZ 85.039 518.606 null] >> endobj -5225 0 obj << -/D [5223 0 R /XYZ 85.039 781.388 null] +5339 0 obj << +/D [5334 0 R /XYZ 85.039 326.61 null] >> endobj -1430 0 obj << -/D [5223 0 R /XYZ 85.039 560.955 null] +5340 0 obj << +/D [5334 0 R /XYZ 85.039 297.001 null] >> endobj -5226 0 obj << -/D [5223 0 R /XYZ 85.039 540.364 null] +5341 0 obj << +/D [5334 0 R /XYZ 85.039 269.903 null] >> endobj -1434 0 obj << -/D [5223 0 R /XYZ 85.039 111.433 null] +5342 0 obj << +/D [5334 0 R /XYZ 85.039 231.376 null] >> endobj -5227 0 obj << -/D [5223 0 R /XYZ 85.039 95.089 null] +5343 0 obj << +/D [5334 0 R /XYZ 85.039 199.646 null] >> endobj -5222 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R >> -/XObject << /Im4 4878 0 R >> +5344 0 obj << +/D [5334 0 R /XYZ 85.039 170.037 null] +>> endobj +5345 0 obj << +/D [5334 0 R /XYZ 85.039 142.938 null] +>> endobj +5346 0 obj << +/D [5334 0 R /XYZ 85.039 102.291 null] +>> endobj +5347 0 obj << +/D [5334 0 R /XYZ 85.039 77.313 null] +>> endobj +5333 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5232 0 obj << -/Length 1694 +5351 0 obj << +/Length 3214 /Filter /FlateDecode >> stream -xÚµXK“Ó8¾çW¸8ÙUc$K¶µ—­ax…60a/ÀÁ$ž×&q°`þýöCv^ìUDjµZÝ­¯[ŸGþ© ·B&.Èr%’<ë‰ î`åùDyØ«Ä:ç“Ëg© ”Nº`~»·c…±I0_~¯_\ÍæOßEq’$¡r"Š³,¯ßÏ"Þ°tönúf>}óg„*|?Ãå¿ÞEyÎYiúf¿|õúñÏ!£O󗓧óÁÓÁðÊ¡›_&>É` !½œH‘¸<øc),¯'ৰ&ñóÕäfòv0Åk&à]cY±I.lžœ§EÙƒ´(­UY)¬4”—Ç»BP&üÅ*¼‡¨ -Ø°jù—dÛmë,,Qi‚jsÇÛª[þ}ˆtÖ;ž´¨Vn–<«7%[ª½nwïín ¶Ð4ìm`ØÑ~žSoâÙ OoIc -ࢠ-ɽ4ìj^Þ6äºÑý‰—Ä>òXaú…;¿/7QldŠWƒ#6;عiYühÛ”ñG©Ìª+›ö k¿§Ã\‹m‰’ „Ð@Ç*G^z›è"þÞ é£ACÉö†f‘vaM‰ë[‹^£ÚzËèÌ›¶ž< ¬Á¬š,,x‡˜\ˆ-ùÍkQÞà—*ÉœSºá÷7×kž\Ý\Oé–¦~sù½»€¡•áìÉ3™4|Bþö¾˜ÅÏ_ –Íïýõ®‹c°¢¦´•|+#ÍYÎmÈ·3d±eiÅÀa±ú†®ˆ…‡öØÜkP›¾~êm“FmpúHzP0 -ÆdÜDÿ VÕ"²,ã5á‰5Ýèå6²0n»vÑ ®ŒŒWŸLEžfÞØGiåš(†zâp‹ŽÑ›$PïFÝrAø~@‡]¸,¿V 2·\C%]&z€9Z Lo¬·]Uo8_¨A€ÁÁ¦öTÍeÇÒrÙü¼oKغ,—¼Š§±ñšý…áxF]¡ín /[.>ˆ‚êP…#˜.°ƒkÙ$ö%c¡š`Œ@ÂñpÈ*' ðûjV|ÇÉ¢X­Jo{ʶmWo[¸PÍ´vj>Ш¯0ZJ¼Ö#†Í÷m('w,‚DD¶ZA%8ÉÛ‡o°uÓ¡o¸TqÁ¦‘8EõX7kj*˜.–1تTÒ<ÐÀŒbÀÞ•ä2!ê$K`B"‡VŒØ”¤* §x2zRS»#¨Õkï]åרôò}é‘þ-ÿö¥GèÖʤGYùe9&"s鯫ñëf)»mÓã•I ûjSW'¼‰ZÛƒêq\†‚d¬•39XÙ{ˆ8©…/·KÿÒµ|‡}¯@Ø]`ÐyxÚt -/lÇ¿÷–kjûK‡Ô¹T|õ÷=ô¸Ø‘°@±£¨Æ©J±"(Ó9XȬF‚5îûÌ­d¹ì‹ ñ˜èÞjÍúü†ƒ½¾Jñ”ê n:;§@™Ë<JN(PrF°|€Gé1ö”F$ -ëÁâEêµb£µp–(Rð%Ø ÙÃ,spP¦IbžšÛ~ùrºvÁ“ ÞžsR-µÐy6/x9ráA4)B%ËE–ÙeÞþiæT®…¢¦L–Ó±¸Îâë÷Ä›È {ÔN,£Ϫ»Q†œ˜±549àúSw545êí>û¬ræÜÑ)'vð¬YÓ£ð íéºcøñóC¼FµCBßc8ÙÚSüè¸þøM: Ç%´üiö‡¸› -h·ÀÀÑó‘ȸð¬~ï ­dØY~öI¤  «r«aà‹.^JC¶ôŒœ’ —mdþ‹-P9~PÆÎA æ§ìUø“ìxþ|øÊzì;Å:Kú÷ »´ŸVÀ¸çç8SL<@º¨©C}%îÒ?^ÝØûuª¬ú¯h.ï/#çA[Ðæz·L&H>ž:: }'?|¦ø23nyBeP KÌ”jTêóˆrb¥~ù×ÞÞÎ*O)áššÎk0Ñ“U"PY­>-¿Õ}†7‰È7Þ¼-<«Zõ¾à5héNýíÿNqæð¿47 endstream +xÚíÙrãÆñ]_AóÅ`Õrvœ~Ii/[Ž³VVò‘²ý€%).c hU~>} 0AVª\•§”·ÌAOÏtOwO_#3ÓðŸ™å‰Ò®˜e¹Q.Ïg«ý…žmaæë #KAY8¯n/^¾KҙѪÐÅìönØ'Qqâf·ë_¢×ß\^ß¾ý°X:ç"“«Å2Ëòèõw—7 Ý\½¾ü§âè>?\½¿],MtõþkÆGœ®¯¿Ç¹Eî¢ÛÅo·ß^¼½íÙê  òôÇÅ/¿éÙøÿöB+Wä³Gke`zL©$vò]]Ü\ü½ßŠç⯚Aì +•Ø|¶tZåy<‰SJ' ˆ)Ñ*Ñq/&“b$ƒbJžŸÌè&‹Y°Ñ1sžšÑ…*ÒxDî’å[oYúk𮬚-ÛûÅÒæѦnA_qGÝ ^6÷<Ý}BôV–îàcb)–õšÛ†?"öja³èwÙ¬á}:˜ø´áñ="`Ø©c´5±§ž‹)3*Ëí,³ZÅ&›”’ ,œc!!eÖôûå>§U8•ž¥DçéxÕtnéÔ:±îpðõ ø4>>_¡ð›N’VÝœgQŽ%Jéé+P”3ѯ:Ñí§æP«5#=á<@è×y Eø¸ƒñ¡Ù3ufLv‹š®k\Uo…É"¥g;&°*‡'f”ͽ3¤HÚÒà­+Hb+6²duIÀØD»a1 }±©ypþ¹ØÛG2¿aŸñˆ9Ò$k!ÍR0³÷x@9©KAÁ˜S·ø ¥þŸ#åïp@ëuµ[áñeÊ~s²`âå;«ƒõ©SN[ H—ý¹¬ÉŽ¼A­yɈdbU’§²¤+ñÞ‚Z’œmì›ý~+‚ ®£Ý³@[²ðOleõ–§ÈÜ€Ûù×Va­ˆnþ¡›£eZüAÍSƒ Ã&àŠ¦ÐtdIKcpÊùÈ Àal7b+;ïÄm•üÙ›ïæÀ€Gü@CÆ @§!J[¡{:ì>ãÁªÍ–Z43uÊÎ\ªŒsç mÀ9mi‚ƒg³'Mí ±ÁÖÎQë- ZH¬ÍÙSÖfTnr1ëîîÈsui½!‘ß•U×’© 4bqâ÷ùHÞ¤£ûRÐÀ¹vç#s€sZЂƒtÝIAŸ!6úµ^йïûÀ¹°h÷,î»AÜ,At)Pû«ü(Qµüؾà!¹Í +5 »MÄò)%š"‡‹”ùŒÍZîü±ÂÈ˸çú:¥,p%ªpéYe8'•åqh|JYçˆõÊ:KÍ++$‡iTf%ÊÜ(8åBÙàAZö˜Ë$5Ñëf_JDÇ¥ü?šzÃ;Pr”yÅã–0: bsK^j-IÒnUVŒQ5ß!IÏI-d† +Ðù+>LÄåKå毗6V…M(Ö9§/o€^¬Ýà¢ñ£å|‘?Êš]=}Pºø«6Žî¦^VL:ÖrTÄìÐZ½Ó¦´¤ëø`-/ëEÞþe±L“8ºàMýeÇK7;ŸÓÀñ9’!î7Ü#P,"Ž­d•°î·Àí«²íBQ%$ 3êƦÑ#©“. ! >JJævŸûð‡°ŽÇa•QË”R$=îðfW<#©÷a_ÖbÈ:mQ B’A)4MçîØMo[Æ8>Jƒ4ë ƒ rÆU³K°…cÝÚ‚µCóhð´-OÝ rèÒðû¡íµã/f¼Ww8mù".'†¾~@H‰¬ã`UíD8­0Õ0a<ÒHLŽÅøÊý þ;r¶ÚŒ¹¨7¨[¡q,¦US¯HÄœ>Ûu¾ÁcÚ(²Êmj)i¡ßõžŒ×v‡²#A¥œÝ“=ñ¹6 0\@Xþ×çÃPºç{³)äOº¶‹ã3PH¬#oÀ™X°K¦7H–)­ùvÕUCœÈX¢0XKE&Ë <‰Ôìn +È@¬K-ÔŸC²˜ЫJ::ÅUðPÜ \8š8¿‰S•'>ß½§ó–˜‘¶´i®‹6Õc‰äVånŸ\®”M¤©*&Í™01%¾N@Êc·½’|è6ퟘ”õyùådÞ”(WøÀÍýh•¦ž×W“{ÄìD¿|¡¼T¬/LØØ”$0Äu6Òjó¶k¾pËÀp¼4–¬±‹~"¯Ã…)z|A²Zk^Vö%Ÿ9…üó5ÿ–^ÎSž€\\qBÃÇ"ˆ-Ä8/Ò=zÚŽ {L¤^ —½råÂ5‚Ÿì­;S±u㸿áìàŠø‹®¡gé·â+¤c—ü*(Ž¸ø¥{Ë>704ôM´‹°Îx¦{ˆ;¡'·…<û[«¹]ÏG]švÎPLUmRøkUa˜¢`<ÂÙçIÊQ$í»Jæuôiä™RòÉ©Bl¨ÎØ÷ ˜ÒL38fø4CsXÞ) 葘oÅ <}+6šdçO´\øÁ³ sÇñ›À6ðûšåïù›—eõX‚É3Le\×ϼ¹‹ãèÝ"ÅI4 ¡.ÐÍæÐ{Q„¿*sžÁaœ*·O¤)qPUlÖd´)[y,Ñœ “+šòT(´aèí 4=Ș7­R¼m;!Ê \–ŽDÜÓø3!„û"é° +£¬0#‡Ü—ûp«Ê¾¡ÅH’žIû"õéx6š ziD©½nêï1Èh"X˜À±ãåª +6æãX ½ó¢WÙd4^&y2¸Os\¬6’rLT}:W&IÂÚ¯=è‡ïm{²ø˵²±‘…˜_C64xào'¿!Ï\—ä˜/“x€ÅAðÁ©ùA:J¶ú{ŽT ÁÔÐÇáïq›wµô‰ò¢c:-EÃŽƒ[SÔª,¸öÖ9DžÀK´Œüþö ž¼‘žê®ãEþØ€Ó—8_—ÝùôJ:­ ãwh.O2EuâWÐîäå;ªzîìïÂó!„Bp÷£ôƒx<.WZ +€ê&,c(GÛ”{þêXI6ÆÕ•YhÖ}€fürØ.ðÊÃ=…BÕÁÍîª/=†2Öß—Dx.L4²yXL Hø¤Ô~wë€V1Ä"œ«úäˇ£S5of;(¢q\¯¼·Ú55»¸'ÿT1yÄ‚—=¶tò22ä¬îd„Sì±EäK?}Ìö‹¯dÎjeLþ_<“|)J&ŸÉ@*/’ÓûÐ* ûðˆÑ³gûôŠE¹hßrœÓU MÞÍ +|$¾u +ɨ<–ìîÚIŒeŠX¹œž]fÌŒÒqQ8F ÆÄóp¼¼Ú3{Ów³€AÙwlÌ]¡Q&mý,™ÙܨXóMºÅ D –C0Å k£Ÿ(¹¢‹ÊÉ­õÑt4ùóµ[+Æ¿hHµÀú‡ðËR`ï{//4K¹Õ úú™¾ÄuXÆ‘† ϬÿïŗϾ;Qñ›§I’"~EK¡’Òzò´þ@7fM·ÄYŒ(I›ÖÝÃN¡ÉWÕ I º®à÷­ou(OZõòžZ3Eô²sR{½€ß—RâÅ&ÔBá#T}·…ÇB:«2› ÖÍ%ÐþÛ«ËågæÃ8ú0±=X@b’aû‰½Mª\_U…Çw6úNä­èü9pÅF¥E6«o]ôí6nY,†1Åøþèû"¨=Ô¼oÇL¥‰ÊŠädû,å´îGÉ@>nÍf.w‚åõŽ(S¡ï›A>‰Âñúü â«a.5©ásYµPÀiâÆí¶4ßÛöÔã[ò?6Sý3}º40S'9´uYÔyû {%?=e›P”[{d›[®5¯›;Ìì|§Í uáNاKût’¤wþÔ»wÍÉ;B4‚/åIÒš âm2Òx_|»"‹Ú§–Eº_RŸJež8n/Šý§`Ë>ƒÌTš_0à’…Õ±è)°o‡¿ï÷e-­8ÞñKŒvýó„Ï”ZòÏ›ïoN6y)Éû—<¾7Ls$y¸?åe \HµocÝãNG‡nBW6WIæÿ=±S\—5u¦¦”îb•%þÆì9+{˜zLŒ‹D™8õ™ÉŸÈr0•2Øëÿ¬èO¥^i®ŠÌN½bé™èæOýTŸ•ÅN官~ K¬U–ò2eÙ¬9úˇÄÞr'HÃÿm¡endstream endobj -5231 0 obj << +5350 0 obj << /Type /Page -/Contents 5232 0 R -/Resources 5230 0 R +/Contents 5351 0 R +/Resources 5349 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5208 0 R +/Parent 5359 0 R >> endobj -5228 0 obj << +5348 0 obj << /Type /XObject -/Subtype /Image -/Width 780 -/Height 412 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5238 0 R] -/Length 17146 -/Filter /FlateDecode +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/tip.pdf) +/PTEX.PageNumber 1 +/PTEX.InfoDict 5360 0 R +/Matrix [1 0 0 1 0 0] +/BBox [0 0 27 27] +/Resources << +/ProcSet [ /PDF ] +/ExtGState << +/R4 5361 0 R +>>>> +/Length 5362 0 R +/Filter /FlateDecode >> stream -xÚí]‰b«¸eß1`vðÿ9–7 Mæ¦mÚ@#uÞ»-¶Ž$ÛÒ²  |V¬¾ôJ!¹í`{ ¼¯t„ÒY1Cl”÷•lÖX ÄÇö@y_‰lÛ®ìœÎyå½±Ðð_:SäÄb±€X@Aù€ôP €‚¼€òîX Y”eY6Ê»cAM/̈”÷Æ‚žj›©‰X@yc±zoòˆ7M9®GBycIƒ X¼y.– Zl”7†…[e¼€‚‚‚X@AA,   ^+F\œGÄÂVÒîD}g¿É»ùDb!¶’˜'ê»±ð«X°òóˆ Ž‡êM'†þ õ‰tã_ ÁB3Ïæ:Ï#gÁ‚y -›Áa!>œ§ðÂåg#^€bWÇ»§OÁB3Ó±€X¸ƒ…ò/ã“gñbá ±0ü),<‹ È È ¢IÐFB^@^@^@^@^Ø5‰‹X@^@^À8Ò²“Y}}xMþ/¼9œyö¾z­ÕÈ è/ü,Ð/cÁ¢sŒ¼ð‡xáÝm¤ ‹¾º`3ûÐÀÈ È ïé;wçÅòÂÍ&yó8RËDÿ“&Ø®0ÖGDœ¨¯iAóã¥m‘þ -/¼»4”SÍþ =Ïb“µªçr4}ã¦6³!‰L05äM-ô>­›~\|Ï„E¾ž¼ðgx}gð/¬±J¹Ø–ƒMÎ@þA1\8dög¤ÓL¸‚Kˆ¼€þÂßÂkÏ™Ø]4Iõ†žÍÌñÙ©µÇ‚7Ód1¢ž=S%È …(b¡¼0— Ö-ÓðJ`a6¹ýÍóÔ^ñ$—œÔwF^@^ø_^–¿/&ß "¬Ð–œö¼XÈ0Ž„q¤¿É ¥ðŒ:O¢§@œ’q¦¸öNSE^À8Òÿñ‚\–4®Ï¾>óËå/äŒ#ýa^°5µÀ"d‘þ/„Ueï~jyý…×ò‚}Í - 7—®ãHÏâ…âCN‡® qúïÖÔ@^À8Ò§xÁ^m$OØHÂa#=‡¢™rðÿYx5£ów±€¼ðû¼ Áæ¯`lˆ…{¼Ð¯ž/‹ÁØaäæ3ãHƒÅ%b—ŠßÂñW”óŒ¼p€8R×ç›a˱ûì†Påò«êâ²™| -&¢šùu95fSÚ¶òÜ=nóƒÄ ïñ¶2Å«Tû Ï[³Íž£I;µÿg×#/üF©ß}©KEàqgóÒJ£ÁRé—k1E•û2žçêX¸Ç òM¡^<ªÛFe*¬f=×V? þü ,Ÿ|¨¨ Ò¹–zØÔÕ-ãÆ©\¢ÏG^GÊw…¯¬ ´ÕË:U±|%[3ƒãÄ+KÈ97ñ°pÏ_˜iÌl:ß”¯ÌT°aMžTð²ð -!˜5Nð$,0^Ф3í3ñÕY]»êp]ŒV̨Š³ô;oýã¼`oÆF2uüͲ9æu­V’_iº—ø {,0^ð$z'±\xµ\~Þˆ Ðtë½Ô)¨ÚTyx^€UýÄþ?Oåð3Ó¦¡ì ˆ#%—J=‰ -I¢f(¿TRZBËöò³ñ;oü"f¥#ÙëÇ›Xø|ÁWÅ‘îòB¾ ªå ”Ç P§dóäÁ‚€f§yÁX s/t’ÄRG]‘•¼qba#-1|?@¦ªšTx•µ¹qšd‰&Ö€“gGç…2‹˜±ÝH g¼@ëŒËáX(,ˆS…8_iºcñªÖ2*–h6SÙ—é6ˆÈ9 eÁ ›X®4TÓÐ UÉ)ò*[›9éìܾŒ‹áZü}Z?Š3çÙ¼ÀÌ5 ŸÛˆŠÕ0ˆ3Ä…TòÃü{3HŒìÍ€óUÞÀXS5úTß­7ûª8Ò¼çÔò—^4ÜIÞx,üÏ`Óú¢gðB0éñI)”_Ш¦?Ci‹xs/Û¯¯Q}Ç$Žô/À¸Å±Þ©ŒÊ£ç;i‹X¸Ç ¾¤Má|Ô̺®”ßr:^àŽN´ç¡Ÿõs°p´8ÒÊ £úÒP„[ú;ïzp,ñB:ŸŒüÇN:çŠYÏw< ¿Ë mÉUqÏ ` ò7>/| ^l×â§îç¼Àš$¢1§”÷#uOˆ…Wñ‚­ÂÓrÒË“ àOñÓX¸Öcø?7²M¿÷õ¯ç£QËÔþÞz¤k^¨T: ÐMj6°‚Ⱦlk>='þËž‰…–=;áø$½œÔNçßÃÂËËxÁ ”høÓ¢·ÌžÓ_Øïw¾Ü©’Ý¢t#§ëtŠÜ»fkßç°PwIü~ ö¿{ú3¼Ð /|Vª;XXw<—þjjœ“•ÔH>ÀÛdÚ¯3vL; ¬y³ÁôcX®*Gs4Œ6õ/ÌzJ öyë[®°¤ËÝäfHнX¾@⛳é‰øÝu-9u´´û6ä…›™æ«7(ÁJñúÂÑ-W˜æ÷tólÿyO`S>!7Îø`dÚ i ¾xôMb9ôòÂK°€y¶ïÚH¾>„ia LÛÈ¥’6ÓyZæM ³žt.-Çj`Ð'…׃ {ìm'Â^$cq,f#¹¡Ï'—YB©¼ðwxáOæÙV¾s¯â[Ü\k ºHG‹ÏB*fsùÙÝΗëÅBJé;·ÏŸ'¶,‰©%óa /ü ^  ŒLC Ï¶^êø¶Þq¼¤6Qyÿdò`SmM÷)¾³¼yyá XÈ6Ó%Ÿì¶õº‹ªtžŠ¸Â?€2æ"šT2Q1Õ²ÿýo£#/œÛ_pÿ.âM ØÜ8²õ$\¨¿°TûîÂuö|ô³¸od:+5×rG»,œócyá=âH+ì ë \¬G,½·ßSûÅ‚¬!tS÷\ϵub²ˆ6Q‚¼€q¤Sa¡Ú =V¼Ði^È5/ì°«Æ`WVÅ{^`¿u¹Ì©j / ¿p&,Ô{)»â…ü&/À~3v!—|wÅ \‹\ÛœolãC^À8ÒÁ}çjã;[ñB(+,zù­ä…4q"‚hÍa‡¼€¼p -,lêL­1ÕñÂ&øä‰_%/8ú€5q0Žt",@ -A i/~{€2“%’Óq­PýDgt„½ÉÌ„jÇ9é\ò»őx&‰ÜO†µ7ùàÒ7 ÁhÀš kbW÷Y›‘ –¨‡À³·œtmò»őD”š!Û)6X˜ïÅTkˆ"M ¬Jb6–ÌOdÁ³]¾¥‡Ãq=ú gÁÂâ÷¢ÎT%p¦çrÓQHWI.Æ`‡ /=Å7›ô&#| ó<’JL;˜¢jÕp^, /¼M)MFmÈn”Y*$šŽIª“Ï‚Dn;bW‰Cc˜E—§·†pRà_¢Ì—¶c’œt/òÂÛð«yãHˆäŒ#!þ/ Ð_@^@^Ø4 ÚHÈ È È È È »&Á8òòÆ‘¶M‚X@, / /üÒãK;ä…›¼p‚Î;héA(òÂ8Rs†Îƒd¿çÀÂyä!,´Ç—'òÂi±ðëX ä2? #bá©bÄÅydø7N#OÀBÚ§ëbkAùM9È÷±€‚rWë<ˆ”G±€‚‚X@AA,   PP ((ˆÄ - -b±€‚‚X@AA,   PP ((ˆÄ - -b±€‚‚X@AA, ïKÖžM_ööÙ|g»ïû -žöež½'Ö=ãGÂú/÷QŸ¿#P½BþÛÉ$eÜ1'K›¾ë:Uè6:hSTço „ NK¯Ž…ß“#î_øÅ0Ú`á¼Ëº:Äbyy±€¼€¼€X@^@^@, / /  È È  †o,­ŸeÖ¨TÎw–Åé2¦…ÿ’uá3fGçQ•wÚ³ñ‚ãZ¢‰ÆK]Å—? ‰kŸ¼$]ÿ¼XZ%=¬iÄû6§åR°û½›øŠ2ïÛ³æmg>¸*Í2óÓñB?S®5ÃÄ7·ÿ^`v`5AmΊcž{¦c²ƒrOÈ\ÕÐ¥ö’Úг&,#ùnJ›p~p…¦OæütþB9σìì™ÒüðBö,¹9/:è¾"X|6¤yœï繜͸«†¥šg³K—”±D3~ï6Ö£X°è|>^(g -XÈL£ Iþ/¼ØÐ/Ö“³×àÄà˜8ã_èlê¤Ë·±ðØjåžzÁ 3î­'^pÌ3caÒ6SxHpÈÈ€p$ÍL¥i4ÜWЇ$Mª4Nqjø¡3ˆßƒ!‘G— ’%pÙ­‚$=%/8dîÿPéÝxѺÐüe)Ä«7|—½êÙ‘ûéˬЀÏa6Ü!±¸§N*Î=Ædš–ÐôÒ4/œHÍÛ»=^Ë oËØÅq¶ ˆY_á/ aDçÉ -o‡ÁÎÊ É%Ž#:Ã0a¯ÇÝ°¡ö7k‚Á‚hã©yac’D C=y×\lá+Òµ_hU¾¥ ´>V;œ„?ÎØÈä:ÂøhJùYv<^0̹ðþà¶tžÒšïÞl¬xA¼½àïðBañ=y4O„²Ð‹Ë_ÙT„‘ä² "J’“óB±ê°‘˜ï*Ø`³3¤äæ—þÓwI¬š]f¹ ¿!µýÄÏéL`¸I'Ñ@ëÅX‹i”g¹Ãñx@Œ´ˆQfƒ!í9‡QöÀ ßÍKiü^€—# íe*œ>ööÄkØ‹æ|@Õì—ää¼kŸ‚ä.×Ua"ìû¾ä?ìß ùJ«8’¡·~Ç_<ˆÊŽ*Í&#ªêq$T¢g uù.ì À˜3x$uXÆ#ž1 íßá6n9©Œg‰ß<× ê‘C( ¦2Êé'ç…Ô£³p{€å48˜Öz;6è¢ $¾…z­NrBƒÙfS¢›é°q$ÀBÙªˆ›Ã&ÙvL#xÉaœÚþ©8’üŽJô$ËÖYªÌTüÃ_*0œœX+^ˆ¸ñÃÀ!Âãš|%‰"ç›7RX`cªš×•yƒ û/x ¯åÕT"Êéž²ûÎÉ “ Ca³N4 eDSTÚÂf¯~v^¤‹ÌMiò/å/PC{õs°0…²¥ Þ«–1À3!ÎΙ.üt—ä@¼0IEù´d®']Úé¯ò‚–Êãˆáê+v|]‚É Ôçä¼iWØÖЯW_Z4E¤çܾ‡îò^7¬ŽdK,À8?Ô:/(Âb×,m)m<ájm°0T6He§ç© £À‚µv“ÇëµW円Z6€s&,0ï€u±oø£qà°6råaþ„åH,Psé:Àò'å›(,(¸¸âÕ‘ƒÉ¬å¶ÃÆ ¾zöðô¼ U?aXhy'ªrs> c + T^ЉÁ²a!hfb±2¯qä§{¬ƒ!DOÈ÷5PbÌÙõYã¶Ê›õ$±TRŒò¼ƒ• ÉÀLo`†§ç…»X! -˜0ÿ¡]GUÍ  ݉°Àœ¾i >$âݬ¹ =¾b;w–ga¡%«¥A 2òÓÈœ¥5tä8R¹ŠÂF²ÖNÞ`!p-ñ3þ=^PA@ è‘õf £‚+/òý­äDX°øÃ¥açʧn¯ª'—Ì -žt'[ÆÔÐbËÄš¼…Ø°)|’#Ç‘dTE(Xv‘öÿhé”ï̧¡ZOs,Ñ=w©þ@c?ˆº\ª‘\âÁWî{fb†*6âÓ»óÚ/çÅ9kVD¿GºÂU1Up– î]ækæÜq¤ržß¹³/IÇ8³eÄ`ZAÀÔe.lo>Ør*T.º½·ðõóÎS¢Ô:àS1BÝ‚r~^˜sα`0où]\zöyçÔü~°ôALW<ðN&øÓK„BUªåù_þ’Œ/NhSIà"æ¡ãò'~^àE<˱rÅîXœ%Ä¿ÏÍ Ì)+ïsGf9ÝfËÒÜ[Õ2UÎX¸í2¼œLS–ӱŒŠ¿ÍRDþ¯=O=¿P¾扨C¬µ ø†`f4bã9±ÀPÿÚÍ7³8 ¥ƒÛ‘%–°¾£4$q8±2×8$/xl½ ¥Î„àó¿='ã –§¡Õâ—Mš ^È –®æºƒœº!foµ&/Æ>-ω…Ä÷Çå<òr^ðXg_ -ëÁ¼)!?€´ÎE7Á -ü”±æ?u s…= /æ…ïpðÀBxm¼F“š 51· Š¾î/ý^ØJ¡=Šü‘Û!þ,/ÀQì–ˆH"þ/\̓¼6),g#Ö‚Xx^0Úãò?Á „^'|sy’ÑyX:Ò®/sÛZº"kaÇZ!ñ´gÀ y!œïèò_à…Ô0>¼B긑 –Ÿ 6Ÿ©:7)_$g}OP4ë/¼ ß•ƒaÁá9ä…ca!´ÎŠ•!5†mýà,WõÂÞìTE¸xöD¸8-o@V¸‰yD&V5žùH£ýøRÙÃñB`?Í¿È AEí“b!ðLXlIÞk±‰lïÁ†iC“@J\È|aö}£fÔ 2W=,ÑøV›>/ žjN}&ÇÿÑxÁi>¡n‘ÜOæ;Ú ˜f¦Oýâó ÛL±Ó\ç ൠ\Õ’Vò¡} -ØÈt Zs6Áé6šç¶q7Ÿ—Š5Á{ò‰± Ê,¶B«djXXk5@ºŸ…gKR %'±‡²ËŠäâ¾ÚöùŸ8EÑÇ»ìh¼} ‘¬Oî9¬5ÙD¹èJ<Ž\r­Z‹ôy¹Î. i¹£Vyô4,Œ$ªtBÚ2º¢ˆþ'ÍÑx!zo^ý˜už¿v^ý#С°ÉºrËÅ8›É£Ó:Ëq†h­|;–Äϼº<™Xã8VÜ9§{^p²ž!Y&r¬¹yéõ…ñN¼ ÒRsmÙy—Ó`AW°¹Žƒ%äˆG YP¯,=öS6<‡t°¦yI<<  ®ÕàÙûÀ¹§ñ)x!ڄ߬Fþ§ïà ÖÌ;ÆÏAwÞÿ:GÂsDÎ?çóQÉl‘C5Û¥ÀæÙ°¶9ìQr0~æ¾ a4k'F°¬ïš0]¨“¬‰ …æT:*ü–CÆÍ>}^0ª'€üyscµK */r@øx/½‡„ˆ: Ì{è£B T߉÷eÃœÞK×òí8R¤Uòè'à…¬XÒ–gN‚7é…Üw&/Ów®Î…Á©B=‡Ç‚¥B¥"O£ô,Y!­þ€é^UIÇ$Ü0˲jO‹# íIK=ä·å=b8jIª€¦$ÉûÄ‘TLÕ[ǨþÿˆáHXPU¡$¤÷ Žë –•¶Á]çIxËncJØO~É Å½]á‘Ÿ)ŽÄKUÈÞ‡$ŒMúÅìÿôãHX`#®/ŸÉâ¡!î=ä2%¢KEåRÎP}­8mG¾§I™ëêÍÄ!”¹Hl!õaê/ÜÅ{öfÙḕò&¼R_Ô(IbÙy®Ë£ðÛðl‰ÅBŒE„Mù æ›¢“;ݜƬJVÖósSíI^ØTƒæœX—ç.¶Ù!,P cò@¸[ý¼`mR£3‚Ÿ ^—Ç‘¿!œeUNiXwbP£•ÛUTןÕÅ6÷“"ô­œ>9qö/,¦^Û],¸›æCäÍUÝ{`g 9A]žLê¸(¥¡7³õºŠ`L·aræÄjG0)ùqÈ4>õ™:m#éz@¼üQàJ9LÏ»X°ö¼Ð30Kñ߃Bº.Ëá X²ó†Ãb¡k&á4€ n&nŒ•I¤kl•&¥f/Ô=ÈÍõÉÛÌ3 %M<Ÿ€…ðÔ´JŪ3Å‘ü¯ÓñŒ£ƒ¤}^€àrëŠùvΟ!?Ò8è€~â8÷ZŽo<=qL&×ü­¨ h)Ž8VmfßÕÀ¿<¿°R¡œÆåÔXx¡\dó°MaR@E†ôL¼ªPhÏ‘wÁ¿ˆ]xÌQ׈…¯ l™Èc‡·)|^ò…ÞqIŽÆ _ÐÞ‚,& ¡æP¾¼/@‚¡ -f¢¶÷?»> ÿ+_ÕÆ†× ç ½ 3ç½±ÿh¼h 0IÍž¼ºÚœï¯@ø‹¼pÕy¼^O¶ ¾*~ÃPps$÷«IÚIªÂR« ¢7,oÄ ‹?±Îãkh²æ‡XxD£.¹ãºþÿì9\Œ¡šš†Û~nbö]ûÕ_Ì 38²óÚtbá©rÀüH­îýÀ0‚ 0?bá‰XÀüHˆ”óæ!P ;Iƒg™¸È È gÆBOL Z7’’uÖ'–‹êiÜ¡³ó2¯¢Ò@Qt/>¼ È ˆ…‚/•Ⱥ5ŸšïÂïäj©4V UIõÏn‰ïmÖkãèuX@^x{,\ÄVH'$—ƒF?–×5é庀4ç2ù”Ö¿v!´½Üás-Î4gÈ È ¯Â‚OÄ ™*ŸI^ò«½"ÿ7Àg’[fZC'&óº+ïŽT5ùMÞ)_W¶y±x³—Êï*¶_üÐÎã~ž¹{l4 VÒü¿VµApÓ-€ÃÆë°€¼ðæXˆåP ©¾ÖU€áf+Øÿ ‘醆YdæòåtŒ¢úåuX@^xo,8*õ„³Ë¾ã«ô ÁÅÎsÛZ-^ZGäö:ÈÞÔeÃ>]l¡‘ÞƘ±«c1Ô·a.i–WÖâgìO 3‹¨r[ØEÎ¥b֕뎯ÂòÂ{c!W^¬µc‚HnR¾Èà']Ý$‹&IÜrgA%ý ¶vQâ‹ÂÝi!®&ÜIš¹‚dŽ {"Ëd0Í%Ot*“œ–âëž»ýy±ð „:#Q¼ý*™Á¥…µóM^ÂÒy‘žùfÞO¼ÕbCЈ^rŠ é´Øèp2mØ;DgwçVT@ô<š¨R’šÜƒqEàÉÞ%²{Ž0Ï'veÙB[U¢§;:/¤Yá,ŽÝ—•»6qÕ—ù‡=”Ò. -£f Щ@fê²öècçéXš™¤Ú¸'&H3õ±3·Y;™iˆ—kžTˆÕ¾žTK]à®ó× ­!yc« 3¨Óf¬¤Ò †˜48ž' ‚Ì{§ ¸ùPXwØHnú~¹Çya sœíJb[2¬GëöxõIÕ‰erGCU£ÈžŒ•X¼Ýõ¨hoÐJs2ÞS(í|òaš:¯l9¸vo¤›Ï®s·*cÌ?ƒ¢Ué`Ah’3‰¶boÕ³?›îç¸È {DÖCv¥âxã¦és(_¿/$dfƒVcWL? …YQ£(2B}¹rŽ¯ (ws#ù{4ù'ª\m[äy°í¨JÕ_}a®W8¢!7QÎè?9ã¼Æ‚¨ó0ðWdø•™Uú=“˜iʆ‡QÆñX›Fr¼!Î{ðÓÐTÔ‡•B쟂ýÓBeCç¹XpuŽwöå³_ój|¡P:Ž@Í)LÀ™#ŸœæVXþ뛊ˆ”§%ÎB*z•ÝGÆq= C¤ÌüT×Ï`ÁÚx7`Êiî½û|L^ÝË ;ÖI#ê}1àÿ>/˜*ÞÒŠê<ò`cJÜçb!ÓÚÍWmxœÖ¦4[a2Á_•·õ¶C*ëAfö³cjYvIƸ~uRFñž–~Œr /= æ¨=¯:0 ?½ÙîÇã5ž€c†Ù#ƒ?¾ƒ¿0®ñ‘{Ÿ5€°«G|²Th›¾ºÎŒ5k@&O ÒÄ+pT\m+5²×ÂEXÔ0g¡­*‹« E՗ɇ¡®Ê¨VNWÄÿ,,ô­V-FM>áA$;L—£Ç‘بâɧ„Ò -´)í£ñ…¿Ë æÆwjyA/º„ú›Xˆ”Ãx7£&WNc®J­ªª‚ö:<îc¨3ç\üTŒuÏ›ï˜AkÕNYã*s‡lÁ\Íô'Âj¡V˜bV#—TÙÃñyA=;LŠŽ`L½â:oÖßå…ríG’ò k€)¾‘8ìû6R¦ZýƘ̔Ԍü°÷3^¼çúþEf¹eæÏæsʤ‹<~îíðÇÎC?2Å#æú±ÀJ5S†úÈÊJ™=™ ØÔ.¬çcA9äÜX•€Ã âHöªàn¹ˆ0R/|^P–;ø¤#/ç!‹ºOÆ‚¥^)Ün?X½`‘‘–– -ëìBÔ2Y¶5wRUtgSžŒ~nÕòEªæÚŽŽˆÇúÞ6O¨À|ý|,Èš‰e¥0c7WÕ¤ÏÀ Ópا  ^ ¼WÀ>Ùw6dñef7˜·”°½xJéèà¨a7ìñDjÏò|J‡Ã¨B(!ÍZsÈù¹|¤J}ƒÜìѹKPA5žH%<-Ùåáó± |g¾b$uBÉOºVù8,/(7,ÔePÙ0bú÷à…fã/è1:„¥Ís±0þ{Ùà;{Ó,ñýµÕÇMšÏvCÈW~ìû÷&’e=ÁÑw6>ìhüÈ\›ÄŸ; õP“κÇæ…c¾p,ÉjKCƒoÁ ê5ye’äbËpDaä'b¡ío™F¿"Ñ/­îâsm‰¤s÷Sš°($=:/Hx¦<„géu¼Õ‹gþ8/¨ ^&DÅ6˜ÍM’§bi$}Í.²Í4ôÏcan\À\jK"ßq2²_tÐyg11Xó -†0sž©‘$a&œ - -þRÛ(lt÷ã Œk_3²·¢Á/a@‹‚_¬þ·>Ž¡ß.*eɲH”è‰zzµÀåóÂL«.ƒ¶æç¾è¢œ~,Wõ],´Þ,zhÈÛ(?Š…Éï! Ú$/(x>3Útérx^h&¹ˆ^OjÊÜ„ûGýÃþB/_XôžŽWÒhy2ØHÓ¤¯èf¿!ñòKXh‚Ÿ¸ÎêÕ§†Õ¹ÆÇ1èˆq¤1nib¥èVߘìoûêéÿð¼s5ÛETÎòt,Œ®õ’ýÅé8¦¿ˆ…ùøx¼à¥Ëhì¢kéÀ—:.o & ]ûHœ›áF¬¿ðL,x=Ò?äï¯Gz(ƒXøã¼ðˆüi^@, / / /<×11iyV^`X˜óæ.wç{b!0~Ào ÇhÄÂÑxaìû­y!ÈÍü¯`!áÊíT}÷ÈÙéƒ>ëë;Ûþj~¤4þ\‘ÈãÑ¥Gý=žŸÁ=m®0à…ñw±­ òGkI½ÂRÏånÿþÑ·yÉ$¸EûÖ+Uÿ= -΂DÝ/Ý/­]Ý˶~©l9DtóGM¥`º¾ßÌ’þú™ÊÃuSõi_4üáQíŽÄWM9çÁÂxM ?ìÒv×Ð^ß!ý%ZâÒ4=iA[U<¶EcV -~5™fïê€eêæžiN67Ö‚Âf¾h_uìQU ª$c_Õäj±±oÛl 5§bÝüŠB$ 9--ð o»¤Ð?MJ§ÃÑ÷š·òC:¨5² 7 Ëy2 ’T“,ƒb&u<ËbƒÕj-w¢Ê]©mÌ;0dæ\¹•w³½õ…ÄÐœ -2cÂïx œè±¼…ÃÑBÊ“SÕ°Óv¥ÍÜ÷3mh¼@5ÓŽêFm°‚Ô=fÛF~γïCž&àAÎá"‚mëb0ñæ)ŸIWTe,§H.ü€;C£;öƒùó“ ÍáháÊcø!Z(d®oGä{d6 ³bŒÑ!kdížx2*ßË ó¥$o>H"—7}æÙ3|¹' âùs?Tà)ð~Øõ{$”Ô´çÂBÛü&-ìCIÇ …=1ü-@êHG >¹pœ*’^?F¾l«+¨ºU•4Dš1¢o’¶¥aF§Å™¿ÚtmsÀí”åZµˆÚR>¤o‹—§¹ü¤´­$2ÀÊÍÍ!&e®’Kø2NŪ¥JÏjéhUôꉮp/,–)cÿ¥‚M¶7†6á Rö%H³™ŒØ`!Oùã>„y«m$ÄÂba6¹ðÉ.¨az;}öÅ€½ø¹Tó¹¹ÜÇÂ’zŠ¹N¶á¤k^ØM›Ñ^"gƒÊŽˆ™¸±€XøQ,l&¹{{¹…­É‰U‹å4¾g#q -ñ³^,ĘÆû¼ÀüJ˜P¾ªÃWgÜœw¦ýf†™ù h#!žŽ…©i¦fòÊÚ½ÿáÕ -5!,õ|è`6z¾Üåø ÂX¤ŽAÜô¦aL#bþº­Á²Á‘O—Nºo~äÄÂÓý…ëc;¶å[V^8i»é8`º9qÖ­ÇÝŽ©ô¤ï KÊà#ì»ÍX@,< ׶K°›R^Ä<4〰ê­õ OfâÜ4¢â¾Þ\,gÈšy¶vPjÀ‘ØÌ/Àê3X@ ±ðãX€¥Cý•‡ k¢½¥4mf!¶¼`­BŸ«ýÅÌ'1ÇýüŠºG±€ó ˆ…_Á‚OvÄ06B%-ª¬J²X­ž-‚i»òô¹NÈf¯4¶ë‘ÒI/ˆE ±p,ÀM´E”r’«m¶k0vQÒ] &Å´Ú;j›ÙJ±Ÿ†Þ­G -o­ÙF ±ðR,ÀŠ$óf`ÁfW6óä‚ý“5é8R® ±_›\L¥ß0©mvž&ÀN45Ü*ë¦&»ýÜ¡×ÄÈ ˆ…_“Á÷‡@›‡?ô¬áøÆÊIÙÅÆ‚‚X@AA,   PP ((ˆÄ - -b±€‚‚X@AA, P OÃB` Øÿß‘v0Q“gtFÄÂ÷¾¡¦¬-û>Ú¬2 ê¾ïùr¸¬Û‹Ù¿}µítv „¥kiÌ>ÙÊU’Æô… 9ý¾„‡·ÊíéÿUlþ°ìüðá{&q¾¢O5LZxvò_di@,|GB¾³ ¶ÕoÊ -ðEÔ2 ¯Z¸ÌKßl4d„K`w}0]•¨Ù«]ø¨þPóÀ#»äõÿ#NÏ7EŸÑ†î:]ÇÃ8u?……é^¬!ëÖû{+Ë ½xõ„ca›:Þb!ÒXØ4¶5o°@)QÿQ²R3µíUÍ .Ûþ?……|—Màa¹Ðù9Xpˆ|9‡ÎbáÒl&jßî kncÁܪÀŠšŽöËÎzîe¨—bÁÏ«ð±Ö{çØùþÖ™³¯<šýÉA¢òxüŸw\`^3"¾*lLáüÊxš#)¤3ù€vƪ×3¬ÿ5À s÷#Óÿ"º§¼ãE¿£Až¡ÄXê?ãs[ú©š'ï#*ºI—™–ô1,<—>U¤ü,´ÛæxL?Û~¦ÇŸ¨Ýq{ó ?+îúŽù3ˆáM±0i1^0/D¾Ì‹°óX覵­óÙ+V^¸7ô_*f|•U1Ö¹­L'£ÊÝ%±sé”Èó*ã†á¶[,„y.m$ÞLÓÓ›;Ú3õR«b–¡WÕ|8¿õ«6ƒÊ@‘•ÛI›±KšX?™ÇóD}Ôú9û ×1¥«k™åUMpVWßk ²’=±Wh܈Ù3Nâ:h§47ÍÜX¢¼f¯ÝÖùeqKB¦š?‚SAƪ¤wA,|M2å/3^ Éꜱ6õo`Á²uÈ0ç8ú·ÔËÄÙC¿ö’ _Ìü¼Xe6•š–*¼¯\Á+ë#lv¥Ì{‘NfÈyX‘¡ó"Ï)“¾s«ôœÓ5³@Ýêú嬔2ÎT”­gâ–ûÔÌÊ„fšf/’E!ä æê^rGt¥n–º 5IG½”J©ë"Ñ?·Xd÷0n–y¿ÉEtá¬#|Ìpõ _“RUl‚ìsA¬#I6ûÒþ£ïlùT%Géfj<€…ê$xy D.³xµÜ/ÄÁÌèê"Öð"<iñHUÄ“Òtã Úh²‹ -0{ ”ÎMÑÕDF¸Ø‘ÙŒ»Ø”éÄ$¢5¡í‹Â“u!ápÀ]à'¸âaíQcׂ.bf Š÷f6{êÞ†'0Q 8;°Gñ¢^E8÷×FüõxõjöHy¯ŠU{uT7³‰ ‚Çž±9pX;5ê°ûìpB ~í³¬/áCºœ&Ï ©H _zkSÊä¼À”/WÙ7°À,!S©@?7ËÆFŠ-WËpË_XS=^8žX‹°µeü - -Ùò´xµÌœTýÞFêU:#—ò¤Ù| ïáyS˜idƒk†I<õ •ƒ/{ò¦åI·C1„ËgPþ‚Ä;Íôå ¹S zZ–™ô¬8ÆaŽÅnÅ=øøR(“×2³S@Ü’©¾¥¿ÐÉëR™D¢®|3áíDÝÄ·ÒVðBKçõ!›`ï/À];ÄÂW$TÊÏU5N”‰t‹\´ðN(;XÜžk‹núζ/ÅG×Y–´Â˜BóÛþ¶Õ˜zR+êPÍ"",Š• õUÊ!+¸6{,”êž©÷ÌÄó K„ -*Ž$°4Ú’5‚âY=B$G{Æf‘ð”uRpŽ -Ìݵ- GcezƒÀÂE´K(­Î¦XÖ©Mþ´Ö¦RÍ Š›sñÑeƒwþÚdbaUà…:ø"ÃÁm^ð¥1ÒÁà÷),X²‚ s4 à ôe½°ÍèÍ Ô Ì¬V» ±žKk“‚»ä:¶ÃÂ@tËΆÅp³AÏð @½ãkÍ<%Õ}þ¨•ö¨øieNÚ¾dJߤ¼âîZöÞÂIYÆ`;¿À¾’Ccià¼a|hgwšÄß©æ wÈ›_aQ‡XøŠZÿŽGTOùDæM^¦o¹¦•éÖFʳH‹s{~Ah“ÒNGS ¤çº b¶ªäÜ]ª“&FX˜bD¬díYa?Y\‡»ÕCÏ®°àÒ[•J‚Áq™•oŽx¡ÐC¿UÆ7R³ -â»"YótÖÄß]›óoÍ¡è[ŽWó ÜX,3C¾°U°ÑÑ…„V^PàuÁ p±ð©õK ^` - ÿáÖøM^V®˜Ô)æÏÌ/ˆX3€è ú8ÞŒe)7¸©üѦϵEî™"Ì"° †HÉÑ -Žˆßn‡…îC*ÈÖ­ûFD¢ø÷¼`o&\bþ ±>J\yÒ`ÙD›=h¾«kÙ· "^dæÝ°å6¢^¦cåd"ï•tä›p³r‹C;tˆ…ÏÉ:»&xt ã&Òr‡`¯à<‹OÍ;(Å:±BÕ`T¤ÍÎÎ2o­¸ l¡¶Ôk4†ÖÙ 7«wXˆ®S‡²Ê'éoòBµñ[’7X¼0yŠ§Gkh¸®í®è7‰§miF5ïÜZ¹|­~ühð;:yñÊ úØb™Xf‚Xø‚Ø×¼à@C³±¥^îñ3uØXòÁës¼_ÈmWö±½zð^ åu2'ôÕOz{²‚š}lRó Îj‡¸\‡Ãî°]ñó¯gÒT™?¦ä_¼ (ô/t*:6­ðýÀ µv˜£Á6ë‘8^r?¤¼ƒÍ *³w"žzÇ ±ð5‰u+J^³wt…†ÝæèXŸ îÙ î¿y†<t&YöþÂ…ÿêÍÿZ¶ ÁȵxT$þ w®r´j ˜ïù Fv1à eöíDcáÊ_°÷6ÿ^¨”«ºú ÌUf:{å/¬q1§¥ öë‘7çÙø Aä:7yAû ”gßùÎÜqG,|)Ždïx”ÀªDYå;¼†~7Óñó¼4óĈǾò %;Ù«òø}Þµ7-:yFZj,:Þj -¯ZGgÿ - ›A“{:DÃa6|àw Ê°g'þG^`–|¤IÏÈ‹PŽKuyÑ_ëW¥«aÔh^h£¾5d" eGâcÇ-^P†¡ì¾-BŒ#}}~¡ßó3êK¢ç\oñBÛ̦'.{ Õ:ÞÛÌ0W§:TÔEtvÕfûÛ¥?rÝE–œÜ­ôì¯ ¦Fjò–Ç4Óûó %{Ž€iU ïÈ__éºÀ¦h$«׼R*試^v­zï‚_»–IqÄ\…ä Fs[Åï–kÍîåZ•¼ OPíîn(ç¾üÖz T¼ê"ð;¼]+9;ïZ«øW>‰­1©²x(¾/)¥æ³ûMŽ´Ü¸½‘ä}>ì-:Q[‡×Û‰…Ú‰uG¥Ùø¼³!NQ³º7æaj{ZRs»êˆG¤ ˜:<¬œwŽÔ"¡ŽêÉ€/D3i5/Ì|õa$*ƒ~¸–Ažreu]q/>®ç£1ï IÙ̺Šb¢BO–3XNIî]ÄÂg…顳ã¾ÔK4þ^–ƒo±Ý׶‘KÃT0ñ 5xªAÏá>dòaÿ2ev3KËǘ÷둨´Vg1{h“ªµì÷Š¯ù‰äÍ`ÕOÜ«E@7Ö#•5ÜBZ<´/"Ûä«Œ q:%L5£õá|oÖë‘ö¼ÐëQ˜WjìzÒUåÔµ›õHóTÕðÂÒâ^ÐH_Û¥ZÈT@ ¬¶'ábßäˆÀ²§–åFù°brܵÞYC,|úêlXh)œÈIhÑG½4ÀXÏÕ@ X¯÷;ï(hÖ-Ð hª« nž¯¡D®ë¥\ I2uÊ~mžKTe)9ƒ 戹½¢¦Ívµh¶ßïÜò Ø%\˜ÊøHÌFðwÓEaG/d%ÑfoQóãºM“ Ú2âkJ{ñúÚEÝ[¬hZÆRì  -i©ó"ùšü‹Öù˜Ãs8/4rÅ«aÚJí0„*Ä—dTk|ƒÌûÚÎ.„ºº¶¨ÿdÙ¶XÝoׂCBy`ñkT*Íìz+öž¥‡8ïå~aÝF -ã]zé'/w׸‡[y—ÇÒmc»ØǺŸ¦>ÏìX`ÁOj¯éÕ%G -Š²)Õ¦G<¢o×¾:P6SÉe nU²^Òe¨m®Õc‘÷•³9߯KvËB~X«/bvÓLk •8N5鯖×6ž¾–Ý;ÎÙûU® -‰}_t-g}Írjzñî¬.âü¶«¢Q, ¬¼™òNMh³&-© ¸áëQUêüÞÃfkŽ ¹Ü#¸ -¦Á?"‚ÒõÐnª×´ƒ,Ú¸!í¸ý8ÿ‚LÇ»¹Á ¿jâ \ݹ½¾öÎíÚ« ¯ÿÞ~$pÁ͇òp_Û×Å0ïUký iæiÜcá{R]矉^Ö‹ëüÂKKt0úƒøôûž3æÁøù.L—6^—¢þ9,L¿E°-½…êûm æGúqI Œìf™òÂóyÁùdÆ%Ä•X¿Ó‰ÐÀÛ¥k¬ð’_c¡x%/ø¿ƒzw%jÿýy¶÷ÆÂRÓ_!†È$åFq“*ÿ¾iëªm¾JÖ|¿-QoÿNŠæÖ΋ۆƒùT¿‹…tø‡!HÒå'©wxNºo¬¿€‚‚X@AA,   PP ((ˆÄ - -b±€‚‚X@AA,   PP ˆÄb±€X@A, P ˆÄb±€X@A, P ˆ”×Jzb,ÐÚFAyžóbåÙ‚X@ARœ ¾W¢ <[nÔßûÇ—à¿endstream +xœmYKŽ,¹ Ü×)ríEŽHQ¿Cxaû xf€~ à _ßAefUÛ ú‘’(2$Õå´£ð¿ýóë×ë_¯ßþÇïÿ~ÙñçkžeÌqüçUÏÙk_Ç__í´cVý,½¿n?cÝO¯£ÞÖÙð?ìí‘¿^^*öõ[ãçó‹Ü௰`kº=úq­®öç„Kþz]6\šËĽÁÏ;|½þxýã5æ¹Æ¨Ç²s4ÝŒóy¬rÎZúñý‚!­[¥Æ֘дqú²qÌ8{Ážß¯:ÎÚ¦³ŸËñóÑäÎÜççYß°Àbž§Ýç¿išáŒ7¹š½‹·b ÙÛkÓçAäYå(S+Z9K…­XÐXÃQeÏŠ#Z=½OÞ¥›M­hgYq̆­ƒšSŒFé!¸ø’± w|`ÏÃanÜî±1Îàï×9§1ï43[q®N\ÎB4¶ ûÓM«ñ{, €óq¦Áþ sñ‹Vyq^gðZ1¸ã„ }ЦֆéLþ³™ƒ÷À8GkOkˆX[NG4ëo_…tUAp:]Yò^vFÔ¹ÃC¤à»Ê`öÓq6€Ój Èqo´Ñêr}gH.Ò°¬¹Ôù¾¢"À¶èÛ‰‹à {Ê×Ã3¥ÂØqËXáæ=_8½=e<Ãâ\³ Ó»âiÈÒž¾‚ƒýŒ–ÁCV`Nl°·~Áò Ø߯þå…Ü `b¡I<Í*8²Þ²„QÂB+ػƇ&/òýZ„ø¬÷>Ҭܗn^ØuÀ%”›Q„Ksƒ:yl‹Ç!sßôsÕÔ“ئˆ °ÎqƒUtÈ‚ 2b1gl( Œà#ädl-œÙKóÅ-—ã;²Ð8‹÷K¤¿2®[ñ-ET>lÕ¥)Ìj¼ÃÙ ü€`“•‘{zÞ¾ÍP’ÔÖ[òå°*hÄ]ÏJH¶ÛiÎ'0oÏR³Vj¢7Ð{ÊN(@nÔcϵ÷À®–ÞL’€]båH,úì–3«LáÚ_€O¼®ŒÕÛéͶQɃ`7sþÕÓ,šÇÜî®=h݈³€¢à"ßô¥›Â[cñÆ8¤2‚ˆpÐjA´]Þ¦™ œõD„,8+bˆ4ê®1)…!¼ZûÀHýÉŽký‘ý¬% éÑÀîúNöËú‡˜à¥Õä¸9ŒrORWêü~•Ú;§ à,t#S͉£ä²,vz±YÌ$”Í6Û-“ãg2ÜõEeÆ›ä†bé­Œ7®ðJX’dL©„áC¢` »YyuÏžI¯ö N¡Ÿ9ˆÐðwå¡·<´2”d‹‹8o]I+‹Îs$´û>c +®1˜i¤ ¯I£i¢·°†˜¹=è ÊÏ•…§ÕkÔãÅŠRMâöD<¿†ãµ¥WSxË&‚—rlœÊòžý&Q-ÆŸÝë~x ß%ªÂ…=4êqÆêjsà#‹|æQ“©(5ËdŸ¯— ¡è¢oQ3ƒUzixìIÝ3ô-æ8ç¬÷,¦#çÓœî2‡P{Šâ­&o© +s¨&ÃÄÊÄv¶ ·ìj)¹âÒÐCœM¹ÏæhwC¼²4ƒ§MiˆKWV.\V©qõJ˜Qå|˜ÂdLé=…B½ÝØ=*ë’qí§­Mƒ'*0*2î±gO¾Õ1|:›rËócܤDR®&DðÑ"wv³B\HTˆÚ8!§ƒFø~¯X’ëÒl—³œ&jÔ …à9“ƒPÐQjk!S ¥3‘ò ˆYhÇPÑcU§í|øB*²Þ8inË_ìæ[´ç‹ïGS8“»yö?˜n 2%kvjhXlzDgx|¼ðtúê󨿿 Á$ç]–šˆù¼Ÿ‹F¾Î\o7À0òaNµu™ZzÐ\‚´*n +¬ÉQ0߯+#ÿ±-»=ÀMUxËùëz´Ù_€Ë3û&[(t½zŒeî— “Fò=of¶ä{_h¾‚¥9SŒ]`ô¤ž +®Ë¼«ÂÂìï{š)Þn~\ÇÚ¬£ZqÉp÷ìû15LIcÆ ˜Ô¤9±ô~ûz%“º˜ÏÈgâ^• yöNî³åçióþ‚•Û“:%NkjPñÓ’{øøÙ qo@B%™6•lÑ?Êò»˜«tTMbH +­Pø3øô™×!ý³AŠ<5§!Éçãß[Ž«¹5{Š¸:,RŠ½¥?ôök8ò® #Ž$„6ã?û¥?%lgŒ¢¹_z€j„Ä5ðñŸzÙXÑ9I/¨Ýu›ê:¸ãš÷«(=IeÉŠºî‡”Ÿñþâ{Ìß^ÿŒEZ¢endstream endobj -5238 0 obj << -/Length 105 -/Filter /FlateDecode +5360 0 obj +<< +/Producer (AFPL Ghostscript 6.50) >> -stream -xÚÁ¡PS˜ÁEQ5(Kš¨]ÖAÖ4UÓAÏýß{Ç眵֭µ”c¬Öº÷.¥|ßg­sžsBÞ{)¥sBÈ9WJc!÷Þ‚bŒ±ÖŠ1RJï½sÆ:{endstream endobj -5233 0 obj << -/D [5231 0 R /XYZ 85.039 781.388 null] +5361 0 obj +<< +/Type /ExtGState +/Name /R4 +/TR /Identity +/OPM 1 +/SM 0.02 +/SA true +>> +endobj +5362 0 obj +2934 +endobj +5352 0 obj << +/D [5350 0 R /XYZ 85.039 781.388 null] >> endobj -5234 0 obj << -/D [5231 0 R /XYZ 85.039 625.245 null] +5353 0 obj << +/D [5350 0 R /XYZ 85.039 761.463 null] >> endobj -5235 0 obj << -/D [5231 0 R /XYZ 85.039 625.245 null] +5354 0 obj << +/D [5350 0 R /XYZ 85.039 745.394 null] >> endobj -5236 0 obj << -/D [5231 0 R /XYZ 251.11 161.585 null] +5355 0 obj << +/D [5350 0 R /XYZ 85.039 701.152 null] >> endobj -1438 0 obj << -/D [5231 0 R /XYZ 85.039 113.315 null] +5356 0 obj << +/D [5350 0 R /XYZ 85.039 660.504 null] >> endobj -5237 0 obj << -/D [5231 0 R /XYZ 85.039 92.118 null] +5357 0 obj << +/D [5350 0 R /XYZ 85.039 634.012 null] >> endobj -5230 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F75 5171 0 R /F56 2890 0 R /F20 2865 0 R >> -/XObject << /Im9 5228 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +5358 0 obj << +/D [5350 0 R /XYZ 85.039 606.913 null] >> endobj -5242 0 obj << -/Length 1495 +5349 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R >> +/XObject << /Im11 5348 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5365 0 obj << +/Length 1720 /Filter /FlateDecode >> stream -xÚ­WKsÛ8 ¾ûWhr’g*šO=º§ô¹îLÛ´qOmŠ-;Úµ-W’»“ýõ ¤¤ØŠ»3»“‰E‘ |øB"àð'‚Ô0®² ISi,wl`åíD8‰È‰D™‹ÉìM¬ÁYƳ`±îÏ1L,V_׿_ß,^žFJ©Pdl%I¾ür3á-ÍÞ|žXÌ?¼Å7 “"ürƒË?OS.Hhþ¡_¾~ÿâšÞãÓï‹w“׋ÎÒΰ*C3L¾~çÁ -\z7áLeiðŒ9°¼›€ÌhåÞ·“Ûɧî(ZÓíCŨ”™TÃ"Ì!$SB‰áÌpmq)÷S™†-xS‘+í=Œ ßàZÕ´·Ëº<ÀtK|ãBo ö”ÇÊ°X‰s—“,q.«—Õ™Ë<ˆà¦Æ¼•| Œ‹gx©HË”eÆBüzœ,L’ %ÒÎh‘ÀKjüòl¾´6a…ù~_Ô´Ôæ -þéNp×k<¡ÞYÜW´t‡Ø>8E¾è0¯©dˆsªø’#9”HžŒRÅËD!r[?r˜œÄÝI”P"9Ó¨4ê²B9×÷fðB%êk¬“[b_kY -wUÇu¾ß¸aµÆ§ù¦hphW4uG0“Ü¡&Ê#u‹ÍaµÀÙ5½>ØZ|¤ÍË©LÂ{ -±-ÑÅãÃ5†Ç§‚µdñpê¼92¼RÏA[p‘™”ƒñ3 -r -ÁyFA~Nd‘Wî¥r‚ã/†÷Y‡éìd-:Âû@"NÇ •?ÏO4£ÓQF$ÆÆë"­BOÓÊ ý‚V:Zé£ÕPßiÛ¾äe¡¤Á›\&£CVóp[m0–ˆù–„°ØåÍmßwÏngs_]]È,C•J‡a4ìšc`{_л-Uä•b&t!KÃ+ -î¹ëh„[G´óŠÂ¼>î½6ªýÅh딥ãxí^èB´Ð¯¢}I¡ö©¾Ñhô-«#%¦MÑ VäŒ0Ö†Ÿ—0B½ þ¨îÜLEÏ’î7ØRÔ­¦ˆã‘¹Å—ÔÂJéuÚmk(ñ¹½"a.õ5¨êUÚæ@ rᤛgö3¯gÀÆÙòxhfXXκ­˜Š!zpßÊø_\‘Ši_þ¬hp˜Eý‘RÇÐl¦F´L|¢_Ðóèÿ.}m d¬: «ÐŸ"}[-x̸#9ÞÍ àáCÃ`XÀTAfåM ÷î–ÀU“H}Ù’^†¾{â‘ß~÷PŠë©RyÅ'Åîº jõl÷`àFoéI©ƒå£d Õ £z ø”º¥)ûyʺz«–ž¦ma bÃãpî”yåua…¨Uû¦¼s¥õRWâ­ëíA¥Øÿ5­-9‘skXxšÖ&–‚pXë}NáÀÆÅ_Då߶ÂÙµ%ì M÷™Å‚llÀ ·è¼mè`ëóáØÒ&ë‘Ka|¾Ÿ¿íÛNª+¹¸5ÇÔ?lû²îôÏ~â™+¶´…Óª+«.·Yv¾°°þ*â8,ÉLƒ}HѽC3¥[ɨe[.mQðº½M¸áÐDþðÜE³¶‘Ì° %•‰Gt¬-väÜ0æ&ÜWNƶ9EûD†(ÎÆ¿7àŸ øp(3©zâ7R2è½-½g_ÿþƒüÌàcÇÆ#endstream +xÚ½XYsÓH~÷¯p±»¹ + ¤Ñ‘ª}0 G€ ^ì,†ER-:i„É¿ß>F²;YX’Š5êîéãëc&C ~Å0¦å„C?¦øXÃ%p^ „–k‘ñ–ÌÓùàÉsé …e†V8œ_môHÓ•Îpž,Œ“—“éüÙ»ÑØqCæhìûqòf2 cvv2yƒ,טÂ뻳óùh,Œ³ó,2Óé[äǘ>Î_ žÍ{·zƒàBˆ>Ý ­aþ¿X¦Ã5¬-S»€S¦týžfƒ?{UÌs‡¼ëÄX„fhˇaò„ézN“ \a†RnÃ$-SZ.ÁÈ„&„i@RZƬ]­aT#ø¨Â’¿\Õó<"ú2å×sä·\Ò®´n˜Q]ñá­{%*Å%Èܧ˜Âp#C +y „g:Å÷¶»è¬ðÉ…hZ¢x†ºŽ®¤q5LŠê^,-™”¡­{h_§Õ3ê4ÖÂv`¨Í +õ3Ó¼Z;üðÁ¢ö‹°fQ2—¿fMgL[*SÒ™0[ULmZÔIƒ­U K…èhce 22öÒa‡®‘Tø¶.sàTQÒ0õªÒlaYG „JrÑcÅ0P(”ka@á¸ù‹&C¨—¼û}V"l‚ g:ö>'Ó÷¬ð:­S&eÚTSæšrƒ2ÑÈöõ§5*‹ê„‰,iû¡6$~ËJ ;Ôš§y«`ŸÐ.Ÿ]1ïWm †q¤˜Å6»Ô!aÇgß´ˆE­ ¼›ÍXÁ*" (ϸB‘ªÐ¡Q·%F¯ï¸¸¢uØ2­SŽG˜¨œ†^°“涡¬:k­§˜ÒÄnfÁz?r’çi*š%q©~Þs+ù™• Težj›6mSZ„Sgߠó=xÀ¨eA·“:0’î€[b/ HÄ3gÝ u]µýi ó͇.ö8’,ôÕåÚw«+¸¸áWtP¶±ÒtÞtgá›!ÜÙû(I¾f¶ÌÒó»=K<™ÀŠ¥ÛHëŽDÏ3è¼å7_Užó9Þ·…«g­«[žé—¨àš†ºÐ¸¬¨»ppºlÇÂw&¹[½U›ëcgÓPplD±.Œž€Y³å¢ ›Ö1GîlGá:P(| ¬«Jý“É–P11JZ*~Mþx:Ÿ\Lgü>¾Ðb°ã·&ëT Žc~¥e[À(û ן# +Fš¾½;‰ã"aáßù±µåÀÉ·ÀËRµnXoHøüx‡FÝfÝPæ”tòú¬¼ªx%¼ö»ÒÝÙ¼-Çà1/ìUt…7Î4¶åK^MOÞðB»4îtSÁw8&ôëtrþz²Ñ2Suÿ· ÿ‚ÍË4KÒü2­—Zo¶ÌŠ¨éí„BX¼Âé0a3rñ¦/)ЉŸŒKq»ºŽJ5·\Ù%ðî{aÂfë~‘¾)ùCÚsÅï÷§¼·=»-÷Áp•GËæxa} ,ü9ÔšˆÀñâƒp\üÛxŽoÛ)ºóŸYJ×b¼Ö?¼ùñcøX­ +öùeöW•·x“¥¤ne¦Z¥–Q­ƒÛ%ü#ªŽ}Ñ~³Âñ~ûþ´ä"›ížGtÝÞÔ*ƒÆëGÿ¥‰m"ò*Ÿ £Ýé)¾çËÇ2íƒ_ÀÃð]_Cõ_°À±8÷|¿"m¸ì‰ÎÃö]¥˜2pöþo÷Žendstream endobj -5241 0 obj << +5364 0 obj << /Type /Page -/Contents 5242 0 R -/Resources 5240 0 R +/Contents 5365 0 R +/Resources 5363 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5208 0 R +/Parent 5359 0 R >> endobj -5229 0 obj << -/Type /XObject -/Subtype /Image -/Width 780 -/Height 418 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5248 0 R] -/Length 21835 -/Filter /FlateDecode ->> -stream -xÚí]‡‚£º¥WÓC'ðÿy-Ù¦’LٹɌôîÛÍÀ†èXÅ*zFDDÄIÏF"""NY6f6ÑŸ§ °`ODDžlÂaˆˆ°@DDX "",ˆˆ DD„""Âaˆˆ°@DDX "",ˆˆ DD„""Âaˆˆ°@DDX "",ˆˆ DD„…ÿ‹cÿB?=ѧ±ÀÎ)IÞµ’(ÖÒΆ`L3­š‚ýüÄk"vû%X¨8ÿgšf×U}GÉ Aëßò}ù÷uHÛŸ€Cïi0Kb·_‚Óy@¾˜}ù?Âgƒ'ez ^7Ä!á}ôÏç•Êÿã§$ú),tÎõ>áz{5›ÿë§*Íô䛢»Þa†CгŽêÿÛ§$z,HæòÍâ -ÕÕ©Ž…B8þ½ñÛ`õW‡°ð&XÞº4?o4ƒãsIRùfî\µ÷À§$zE,€²ôÓ`(¸1s=– Iµ -þÚ¼YÃW{,>%aáe°àŸ™Î+Þº¶? … Ž~ˆmžŸøe0Ӫ״ªêÌÀ_¦üoÁðMX(„ªGXx,øAº§®3MsVpp‚è'"†ñâ«?«n¦V,>~ÅébGø—ò_bÁ¿‚ÿE,”âQ /ƒ§;ô%¬hÒë¬Fýì¦¸ä ‰©¤™ßÝr{¤]ÔŒóßy“*ÿ‚ôU,\ /†óÜgZ*Îû.â—±ÐÈ•ß÷µ3CCÍøßiIQYð#,ü,Ll6°î° Ä‚ÊéLÁØ‹ÿT„…·ÂÂÂZþ¥x,È/Îv„E*m§!,¾ SqQ¬¥½z)†;¦¼æÿ’Œ°ð° ØïÌÆþY,¨9Ww.žõ¨Ÿõ}~?”`ðö¿c ³ïßÝîДM ߉…y™ýAƒá ‘°lȳ~T«#,ü,Ì:úéÞs¢".Ë(zNp0~zYcÇÂÅ–½þ=M*“ˆØ3sNœú1q !,ü,Ì*Ç¡_&j+s¸À —ÀLµéI¡¥f Nï´xÏŠIÉ©Ð$º¢DŠvráÁf‡È/8zKâ¾[Íù  ãŠÙÅi§šUœl¾Ýì/D›™FMŠ\.CwðNx®¢Oé›»§$zY,4çXHÊrË|Iœ/¦v¾Ò2ͼ8›Ó¯Cµ]âYp…]µÝ-öwý~þö)í§Á ¥¦=–E?\—YÀœ»›ÔIà³Ôwä™W³Å+ç¸ÙwNq/Zl{°>˜ÀwÒ&{»Ç_=¤zÊŠ¸÷}±PÞ¦Ôðß~8IþaÍà8·™h—4Ú`yhÉ&B~ªv¶Ë£‹;OU—ý, E£Ü¿·Á –UğسH%Ÿo° ®ÔƃãÜ¿ÿý§$z; ÒPŽRjç0ù'êç8="hÖ\rpË…K*çka¨'i@¾sÕ’›wX`›ÈvÿZ -¾¿ÕÔÄ1˜—vuÝÿÁS½¼í¼]Û"ó,¹Œs÷­™™Î3©7¸¤•‹©ÿ¹ô¢¤rœ³9WÉúÍCÊwu sL¹¿NÈæÆK²‘ „…·ö©nl»bpnjî޳겾ú¢¬À:Cbµ_À.›/ä}«EÑV!!×Od5³t{g3Ô  í¼ë¾G÷°ÐþÇÜŠ!Xô±ÍýYpô”äOzu,Ì{m›X· -\ -˜}ÓÆ–ÎÖÚ -®@œ·MeÎ:–3ÇT0(¶2*j@ -´½Â†YÍý H$©³Ê}è›8Žµt˜­Ãýü¦“{{b‰W;ÙçX¸š(×øýÓ¦ç±fúsÊT¿`áð){âÞÇÂÌÅëekÙ»:A_,Öñ¬79Ûí0('Тµj>}æ¬Á«,—›¢\l-Ž.ö8hËäªrñmчòݘ0(­Œ»¬Üw°à (,¹I;‹²ÅÖNÄS^¶OɈ{_ *ìsk:Wób×mì䤿úG!Ó•kgUk*ît`}ž¿0Å+˳oŸÜ+ç(íWgNyXó©œ?Äl"¾Ä—ýà´± ^UŸ©‡û(rÚk{/,Ì?ä&I%Zî,N´nUfÙš‘UQpã`Ò¤z½uRÝÁ‚ºbU,x3Kv»M-%äV̽xüÅÄö nr+0h„…÷ÅÂ*—§º5§¯~u{m¬ì‹ëÂø¥äøþ|é³Xà`pvU:žÂƒÌ¡>Ú›P²o™Dwjø<Æ‚só”ì8r–°ðFXHâYÿß,é3[†q«…{õ7ΑWv%bü­þp ÓÁÁŒöèqdÓ"fÙw¸<‡…£—Rî—^ 'y ¬hÌeÞüŠ÷Øêðkí É€ÎØÀ| ²zÒõÎiuáÙz?Ú¥»‰_4ÃèƒX8ŽìÖ«aÁÚ5¦Uݶ&ÌšUçU®¿o¤.l'=¡‡Y—½Yim¹ç|€¨7çîôWVS8΂^õWsoÿ뎯˜ƒ -K cA…ìi_+ÌÙH€æQÞXº_eÚ¥o>é}„@ƒyW4Ç€UV‘LÇø-!„.ºf·N' Ýó©ž„“§Ã^ ÉÙVJ%“Z§$)cëlü -`wBF½>U]˜-Ì«¯{MÉ­š} gIÖ­2Ü ïŒß ↕Ñ:' ò—o·*Âq¯ObaÂlˆâ¯oËÏ;{ÔI/°ÿd¡˜û~…{X8 TJÒ\„…7Ã×—¶ÛiÊ\¸—\Öí5‚¥vë¥Ó·7y ¸¢ÇZÜâÁwRvd.<Éw÷k œcáLî(mçMXx',€)zÓ‹DHÜYbû½Âû«@´«YµÑwaÄâÁߪKþÖ?V9Jîîž~'6ïô¥¤·îÂÂ;`AÙÏ×aÎk¼1ï•jöÚq² ÷î†} ½¹ö|mbáÔøOÏ¿ú,œz´[ã™°ðz~¤ƒjó—`ºª9¬ú„º¡êd/«d4ìR½ ”¨Š£ï‚2.«,´¯Êߧ«ÂvwO¿ƒ…Ó—rðÖ ¯†ÇŒw„yèçE-úÇõºJ………×ËÁ9PÀ‚´a߆4fúeSzµH«Í´g+ÑwwµÿÏ`á@š^ ­‡WÝõÔ Ž¼ÞzM"óÀÿ éÑé­öy,ðq–,…UŠPðL1™,\>Œ…Ó·ÎS•°ðzráƒXH›¡2àaëž?Êý—™ñí7b«#—›Šª3¢Œ…Ó"¾}Û„…?‹@CwЕÐP±oĸŒý´‡X ¹ð‹°ð¼ŽtëaóvïýÐgsy¦$Iž…ë¢$ý˜ŽÔ?r­‘½ð±ðŒí|`'Pio<á?“¿P´šV¥æðxà&:=Uˆõ_Ú d;ÿF,ôð©žÜJIñ°uåcA“.ßÇ}æšbÕÎôAŸêåûüHÚí -BXx{,|f¯í€`sljº‰ -?ÆBó\ѼµìJ·àxº7ï÷c¡¿µ² oY¯ëKöÏEÿ$P2Å¿ÞvK8ÆBë<Ý®öfÝgb0>…Ó—©&Ð~”“èŽOæyÎKæ.´›è„c{áòt_…›ýÀG„E¥µ«ñŸÅÂiN‡ -î]ïÞÞ ›ã¨"FOul¯–C,0 -þxÆ7©3̓‡Õ@[ µÓñi,œÅ©Jo¼ „…·ÇÂã¦iÒt^y0¡sºV±»|»Þ…:ö©¦w³ÍÖ¨1÷`,w…“·y¤5Þ Ê{ïßÏáZX9ÅÆgk¦Ê‡8 é±îuwŸïäѪ»ÑWóرp¢$Š%ÂÂûcaöÞŸ†jÏí]ghëœÚ é±I|[šîD~h·zÛñÃ~/ýÓX8áìÃqµ;ß×¾-”ò{b1¨“ËUV豞àâ9ã’(XÀ<Ò¶õ›’áÎãªe{Fïç±p¸…¡²­·/@ÙÓ?Ø8›°ðÝXPCí[eí¬¿ìî’h¸å“âVmR¦Š\ÔxÅôÍÅ?Ò¤4ÿT¿Jº}àÜç±°IÚؽ’ÝóD—û»óDo€.NÛã,U«W÷Išœªkœ¨Þµ7…ù–Z÷¾s©Дï2¥26ü«v¦Ô-püøƒGg«ÃV?ûhÀ Ñ+baN_挵]êãÙ¼]óÑ,HœtÇ'‰jµY®ç~Ý^—uÿ…´Ù”ÛK¢¦›KÒß­¹¿Õ®^ «|ÿ¸æüç°ÀA¸aî9£ïÌpû”D•â´´¢º[·ÍÒgÔ™”ªxñvg‹pé›FëW\Ýlú/øAU¾Ê¢(Ûf“üïßêBÕÑœ—úÉëâ€_Ât\™’-ë{åi.Wî ð”Uó›ø0I5è÷¾Ô_Ÿõçò…øÌ¿ž)y+,pûtÖ}³‹(*J-½¬º“íÞÌ|º3TM‰ç·ýÜ¥j¿ˆ¯N‡®jë¿5D=aÑùêl«`ܪc3Â|çjj8çxÕCj=…¯ØβV ÷o«¹–sëÁÚ=寲‚П -ϲu@·,þ3–YÎר*·rµVÆ™•ñ7cX3eË[ת7ÀÂÒssø/A€»Ž»bN»ÞRœŽ»oþÉ"®­ù}gs/#oû#ûçm9Õ -´²6œ+LẚÂm%ñÏ`AiwøN.Kdç óh³îå³íöòîYY2•Ö8zêYÃq¼rÎGÎÞæ8Ž†ü¢G‹¿} C ÿæó{5Cû°0ųãÆó -ŽÓ¦ïç̽«RFɉvTܾ8í¦»€=v¹®ûðn§àluºÏÇ#5¦sxÿK{îr»^ mÄXå`pö¿p®±Â1“È÷Ü¢´(°öøX8eI® ´8l`-9óT;`úàœ]C¶­ìO¡™¾ ~ÁÌ£rÇ3jüÍS¶¿ -eÈÅÂTXa¦Ö/Ì ­ÄBžBˆA ô#f~,` ÌÛÌe'8‰Ácýå¸ Æa½amÝ`á&z#ªç ‰ÎMÕ˵áÒsö÷›ŸÇB‰xówH;kF­]ï=åû’1Ö€+4¤’¤ž·– ™.AbŒ¶¶‡XˆŒœŸ×]ua.jz=zÓy¹W /DQóÏþ -šmG_ÁB-R&ÍÏ›l‘†™šªÿ 6ÆéÏÓ -à`Çßœéâãñ[sÕý6°!jÌõÍæû]Ë ؼnç|5ÛäøÝø'Xo®=À\›²!´°íƒô\ù‰Í¥ëzýk“¢U#Ž35Áòb¡”öBÆÿK„¼0ÏäB™q½*¬k 'úèq{"=x£ÿÞ -G0Ƨëj_ÀB¬5 üÅ}ÁâJÄ bü¿™Æ±Ó¯êü!ÕÎÙ$‰¡9P0 fÚ%EÓ›Ãå¢j`rcÕ¬šè™9÷óœù5ýAÝoñn´æøiJùæ¢C¹€Ò'ðûwÚÝ)%q/Ÿ²ëãß‚…jÌ™À‚fãúŸdVœ­åBeðË ·‘Xð´ -i^9’‚¤ˆš0ìÑçéÜ/8üžÆJ}Ìùiæ–_À·y’£ºZ5mü”c˜Ÿ·p~' 4¿W&aQ 7Ó`üòyÇ´œ³ö䜟 }.+ñKöøþŸòí¨]Ô¬QKÇŒêùlc/L$Æx%fªwö‚‹g ãO}ÈåŽ#>sã»þ²½@ô´‘ ¤Í[ÂRŽJ’=ÓV.pÙž¤,d|ÝG{Áò2AÃî>žéËë’µ½Ñáì‰/"S=ûm /……+aa–5¤\¨ÄçÜŠ”½'(I\Eš´G~¤È;ð7Åp–Ø»d£•[ðaä‹’Ðj@.¤`'sÀ}+*IÆès,œø‘fùÕø½ÎÏ`XÈòœÿß%,\x],ØR.¤ËÃÆ€·­½À@Iš2«x,Ð÷Fs8h#d§vaäÂË!å¬ÿ™Å¦d/¸­P‡|I,8Û;z¦äYEÎAf } -¼+aä«ÒGB.Lfh!Cn툱Â`ZÉ…›8U[¤sÁÓúš‚É“)áê©ÉAVfÊ $^šÐ*g¹Àrd`.®[¹P…c-r!Ì%Y³#Éà Œe®Y‰­4}C»vGK "tk;³|M–FX ¹ð‚ä°d—yX¡Æ>ÑÅàf:™ç!£j–Õ"cÏ sœwéBҥߔK~hÌDT†aÁÆ´ [”øH.¼ÈÂIŒaQƒ{b%ìâ'1„È°÷ú Œ`1D>ÍÜ/pDê4¨%Œ©[Zw¦ ->7!,\x9bYø%­eE3ž'ÂÉ… ë‡˜ö>®†ÀSMX ¹ð~ä†ßÎmï1/lÂÉ…7£Öó¿ëV†§«èxÓN $ÞŽþÿÀ[ÂÂÿ…‘àLXx",\ ",üŸT´‚~Q]ì¤ýD;íG§$Zû­S:0¯û‚°@ôéjÓä[÷¼˜ löºùýŠ^Uø¤#ô1fjë&6µ/a;Ã#,ýC2`óØ8ŠU4k&ù8<¸ÏðÔxþRdïŒn}ª†ž¥ú0~›°@ômXà0èì;ŒŒy—Sm߯ëYÏQÞx}tŠiïZ†G9–H²£1 D߉…»ä>L§™ LÛ›¾ ·–‚¬9æñCvˆ1Òô_™7†áˆŠwº!ÿ,ëµèJ8 PuD¾ªEluhN„Lþ”Aú%E]жµG=‡ˆZÚö¨M¥e¹0Fè ï¦C©y?†d3àßòhf…øœ5üúÜãŸ5LtsG×Âë£é‚õÓR€°@ô1rFˉË!ë˜3aX³BÇ Ÿlݘ!pÖ‚ÎõzS8!g|s ¸ì¼1K˜æ¶V,Ø£u-Z™Øæ0¸4AŽÛ,Ï“©äØ°‹È!¹gàŸÛÒÇl·zÌÒ"ÖG«L´läB†¨à> ÿ»cnü°UŠC×°EÒ§ðH:Hu‹Rkt°Ù…,ÉDX ú ÉxÏÊ©p,ÔB]7à!V2¶Â‚L3Ç’!˜K“ÌZcš Éi¦d?ÄxG¯X¬E uÈêwÀeYoØ CMV̈\¯‘ö‚0AøvJE~Nk…Md©ë X•¾ƒ)({Ÿœ3ÂÑÇ)Õ1¹xH¦~´P±Çš[™P50ýlÆ“^ÓÒäÚŠ(‰™† €ŒË ª`W ídV~BÖzT±R-¨ ¦I[¹æ§æu»¶W ¹Ô§U¯7WXP. 1„¢ÏPUëæµYÐâ…šŒ¢Ê©(Z1cóÙ*[«u_9cå‚âOΛ¦*_¡…`Ϻa ™ÏÂçÙZcaÊñð´˜+O!à - ír`µ™Àu¤fÆ‚+ýM Sf,pÉ¡ˆ>! kØÊ\¾Ls,ˆ%½-À‚&×\ÁgêyG8rÁ²ÍÜ\P|Ë1l°¡GµnžØãaÁ¿ldpC)Ÿª:¨Šc a³’ Á-ÖÜ ,}”¼1wÒ4ò*q%ÂxÈ °c7/ï+¹ .iJ¨{Zw1èB¹ ª·°÷µÆ‚‰ Íyå×¢NiöÒhI4ÃÂÂjÈà€ÂWÙì±àÌ:ÖŒ…RΑ°@ô!â–.ªBþÈ5úJXºB=—Åè4`õÅvÆ–:`e{|a„© -̹È_öœªÀøXcÁFUú>È„RΠHL­ËÜ~W`­¨>&^h²-l©¥ Ö²‹°@ô¼± Z¨EUˆüÒä¢Ð#4Õ¼¹`Á½ê±`êÄÂE¨Å \àË2€(qá єA $ð#y ²¿û Ê÷„l@G¬óÉê€ôMq3½¶X°d©`bÏn8¨0LX zHœ'³«iä!x-a“Ë ±Àµ•¼¾z¸ ·`!ÊǬö]8êríʬ³1±<¤åvbÁGýêdxá‚ÖÊj’Ü"Îþ5ÔõҬѫ¯:ÖAºòËGp7ÿÓÕn*à ëÙÃâèˆ%t¹¿`>†Ðöôf:!,=!p_8«@-áöì£ùÊùZ‡Ý䬟6û·ûÈœý› ?™¨ìk°…&°09¸ íiÓ |ñw¤íkÃ1Öõš*qÔ»j¼,Å«²`¿{u 1p[Ù`{{ÁÍpp$±?è$jˆ>L…Y×›âª,DZí(ÿÑÀœºCÝ¿¨bùg˾6LÜYˆÒº69wV ž—æÐNhÑW †ÓË ÑPfš6uú¸½Ç8¢°Žá²uWlΟËaˆ7¦øb8 šÓ¸¹<•­…Ãc§4ƒYî2ª§Jôe!{=I,ÿbŒò`'ìÓtT$É8Š˜%,} Ñ?ÇB>þS,VÎ D߀…r……Ë¿‘ ߈÷ vhN„¢¯R¬ËšZëÿ¤ázdèÅ·Ýìâîw˜ ïã DŽ’ãê#„"¢tVýqb:`!´ˆˆþ<…€"""Ø?O/QpIÉh""""""""""""""""""ú·T8RíGô2ˆþ4i¹Ø¤ ó–^ÑŸ¦Æ­<Ï-Q²“ˆèc!‡)B£„¢?/ aˆ°ˆˆH.-¤Ycæ¹^NX ",HŸjFX úÛTºn¹®½ ¢?OîþÆDDƒ¼s,TÝÏ%)ËäÿxIY$Ä DçXЬ” ÚÕòœýðã3·±2 -È"ºƒï'½K.tû¨°æJW-2˜ˆÎ±àxþgTbó̹ü°\(pÜÈqÑ’Ü*'¿³4õ‡±@Dt g¶]yî h[–†—[™!T§ÁËsþ%–Ñ-Œ,Ý“fJu~™#Züépœë6©¡`níÆ&܃_–záèéQ _·zÙ™åù8dTgyæ7úMÃÍæCz5êT‰éæ¹{IŽÆ­Ñåf\½ÙŽ[ð5£XÆ…'Ê®­^‡\ì·å¡7æØœišúj†cìe£e¹¶ÓÔbñÂÑ–Ëp´øe.g¬>ò«øÜKƒ÷AW?þM8æÍt&Çy‰ýÿR¨ÿÆã¥Çlr¹‚*¿N‚ä\ð—„gRã6h”ó¸7ãúbÜì…n=n|6.ÑßÃBL}ü€}L ºvxÐ,°‰e0Z—)q°`âAç2fÀgIfÖ .«ùÇш&̓>°Z®±0ê ërÎ|‰f…]$za¦üžAQØØ|VEú¸çÉÒ¹ aœÝ;Œ§â³ã|mriÖÉÔá¸c8Û„Â8öà8nt4n~ÙŒ[ÜŽKô±P‰ÝQ.ʘל)ÊL¤¿aK=ÙÕ9d¹êêKÉsW]¦«e>^Ó)¡ã -Fƒ[K{¡—<9ˆ‘S讉Iîx²·<63·lÓló)y7ãÆrÜ5<1uOÙ èGêĸ4>?—èba\ÉŽÂØœ1(þßÀNu#[’ñã%gB}Š¢ˆ¯ÏÙ,UF,h5¬P-êmÑÄx-N\%xR`AF -zœ5É‹õž'Î%âZ[ ŒŽs)š¤”ƒEMÂÇ­æq›qƒ…ý¸R7çd«q ÂaAq·J¹ªsΊ 7ƒp>×åÈâñÐŒõ]õâ<¯2¨ wÜÉ\ÎMäÉ|TXPÕ<®–Ù؆Îñnmg7ƒ&°  YÊ#ŠÐ”’#\»Ó‘jöl#Ò1O–qõõŠ@ô§±`.äXPmZ+0FG+³ÝŠ±gHž[ÌŒX.X(WXØÈ…=OJ¹³=Ov{žL ²å  c>dœÇíÕþba+œ=ä¸a°pKRKˆ¤ÿÛ˜¥Ž¶V&JÙÁ…¿Ýɽi¤ôí¨ÓâP6xti¡òçì×ç\˜± t#gÏ“·‘µH˜-J¹)̶‘ƒ1³‰åpÜætÜ\˜±`œéfD æl;ûJ¹V âqæJ2qÜ9Ôƒ§vªù×W©ÿ0iÙ"ÛJ^ò¹ÐÈ…Jº¦Ü=OJøqàSJ>ÜINKŒëÌ㶺\º='*©Ø¹„Âpm)¸ò|ÊŒ3”1b·ygõ©sn@Tx 5ô²‚ÇÆ^T,Ø„Hàæ58òá~f”£Ýjûõ9ïÍ­\€=ˆw -€'Ík»`Áv1ÜOÁ©TÈ9ŠqmþQÛfêãq-ð ÜÈÀ;Œ‹>Õd5.ÑÛQi\™áy†ÐN:ÝóìêcX@wŠØ_°l;nã,ïµZÀD‰;†Y"g ›Ÿ#Ü"nCØ\›Ïã‰y£¥ܾܺvÞÈ> Ë‹Õú<ÛÎPÍÌ‚TàI–/íî/µãë çMQ&Ç-a -–ÍÇoÇuf?Rã¶Üœˆ¸M’Ë¿ð¥@ë*)Fô¦T…9g¾p´L±Âöªñ1,¸ÈsÛÙàp1Òâeö,CË¡´Xbä¡¥›!ÚÖ|º«¸ÖR'‹عc†›Òø9¬ë«2zˆúLš?ð;¤­ÅaPY(~&;z·ºZ5Zò³¶…ÓV˜!ˆ„Æ…»êå2.jD7ã:Ž+õ7×ä÷IKˆÙN-á¾7Ê~2J‘蛩aÿ5²AíÆÜŒJc< B;ÃB | kbŸ˜¦dò¨ÒbJŠ’MqÄÿ^ ¬º](_lÌ)ÌASnÏÖ4‹‰ñ;LQ‰ÇXw(ú†%E‘LøÇ$¾fq¿g˜:ò«õ¹H‡žÍ'7ÃЮƕƒ•ëq‡yÜb=nÔ7‰·Rm=®ð'9aá}I ÅR&¦ôê^õ!,ðë.ˆ…“ËPäüëÍ(M&Ù vºX?Õ‘Œ»ø`§«UK½±\~+׉Pk’ÚÎ|!µ„MÛŸ %7ÍA©ÿwÄM·o+ ¾&ÞuµçãêU[¹¸yøƒãý,ÈhØã¶+7sí”+µç¹®g>‡n;çr¡€»†§VÈwQ—£±“£@øÁ¤äÔ‚§C_ÙŽKôäB&mh«œŠÚC{²ä|d<‰…Ķ§Ä©O2zX`{®ñÏaâZ÷t§üñ7(Æ¥ÌÏß DlÜ1›‡ÃÁžººvêZ{ DD¿B.ˆXð úz*>fɇì"¢ß@ZˆÞæÜ´•[´2ØŽ°@ô×äÂ8zW#þ¯¬Ñs]dª¼JùW ‚}÷huò`ȾKŽXì°`é¸ ?n -–?½TœÞ1Œoöuj#¦ÕÝ©•$†´Gr²¾òH«i%ÜfÎ~à÷ÅBðÝû|=$eh¹w^¯ì‚CÖíC¿} ÝûbÁùv,„“jÐÝ!Fo¥#} QSLÚЩ@¤Ô47Õâ&I´Á\ûý“V„cS4QÒéí$âfŠ:ˆ$ÂKÓ¬ä9m±Nò³9Tl…"]ÂÏ%}eôÚíÆkJ.åµ$ešbÇ=Ò¢È좤qt~¬ìL-Å'1ˆ‡C¹Àâf) Ÿ¿Lï‰!£¶PŠqËù©ˆ^M._ØFiÃ8†ª¯ÏÍŒu°\.ËdÀ^´mÕ.’în/2þ…ê[ á¥c~.ÃðÒo'ãKÍ µEÞ­< ‰-ÄÆávî½¥_,u÷)Å3ñ3×jøtÜ"÷ŒºeW~Zhà {܈Ä@\” „ÉBoE” <ÖÆŽ-Y7‰!ÝÉÀíÊg‡'-´¯8nC¬÷rÛû.œ\Ç€:(:¤×†µvÊz#çƒsõÐQÊtP]¤×„œ?øŸ;00¨*f8¦=xcfÔœí:8?7=— ólþB§ Îû5çH°X+kÌj#纊“–îl—>«Ü†DŠÃ(2ƒO2ã ø² +äßsØy!¤mCìvƒg¹èƒF¹€ê¥árÒ]¬¦ÃtìB¢j1$ÚÎ-?b@ZÆ€¡.p_kôHyzg:Ų^†=ç†Zè]í ÕîâBîï!lc¯ï'Ù˜b ~@/¾„ªJ­…Yt¸¯qjˆG,ô!@R¬S5"çà˽P…XG/…3ùHXÓ4 ˆ<)XiA¾üKÇu˜¨,ÒÄGC¹°˜ZüR~7|°wp=0D¼}JyÁ18ê T( â¬¿ ¢¾ ⌠6e¥±ÕUöÞ|-¬t!DX>š{,J5§8-UCÑ’Û' óÊP‚˜ ª(…!j  -…Q° ™1Θ"Ý_ƒ†H³à }EÍ OÃëãp±P†’ ò1uÌml•6í«ç¹PZ¢pƒRd|ÜFM™èbAhD5ÿ;àʺë&Ýe‚¡ ècdCÀ™ #­± ÜŽî.³ †~b½%®/eF*’ظæm›ð1æjY ”a‰‹”wþí¸cÆÌع©—•j€oU ‹°%Ó,Z¡Æá>‚r‚i|µ=ÈzÚÊ™/ “Ö‚škQŽäB'“˜P¬©Œ¦ìd?“èͱ ö“ BØ®¡—Â*”ŠUR¸ø›·ò¢h‹æ”\ˆ%&‘šÉµîR31gÓ.qË\’-êweó|S¤åH.äseIC=ÀV ÄbŠÂw*÷'¬8fÙÈ…z EæPƒS WX¹¨ µÔ¸Ù¿Íæ úµåW± K¹à¡OÕÎÃÑê'«‚i2á Ù©eÂØN.ÔgrANBå)iOÅžZßµFQN¬ær†KŸASX°MþïË`¦‚«ðª€ÑZ¨aU+,p–Ïõº¯Â\ÂU5Q}À0K”„‹\d$0cSºƒèÅèj_Å‚7/{ 8ד4[­ñ+,,ö‚`sWØÎâ\U¤h%Ph°eØÈ¥1ZZÒŒŠš[LÕ_&t$…§B+ Ŧçc!R³SÅ]T„]äB,T©DN>²ÄÍ+pl­äBe)Ûc&õŸz-TW,¿Drá•éyÍõܧª‰õ{˜¤Ih¯Î<À‚XêÁ>E¹€T-uUg,èJÜH^Ž¹9œ -3«É q1#mçZò¿+LVS}öïÊ…FžéÀÕ[¹°Ò‘T?\¯‹\ЖROÒKÐcù"f'@Vó– aá5­€/caÌ{£G’3vE¢Ã98fZTe£ £Ë~ÁRFf¬°0ó!jØ«ŒJô,kÔKVÚ°®C¿†’5  ™¬ÈFOc…\Š¤,ÂVÁh͹Yz$€½Í(º"4ïÉ›%…ô•\H¸&—iUÇ)§i“03ÇÇFë¢ ¡U,#–æðúÖ¥þ¦4s)îu¨äÆ®îÀŠ\Ù®^—ŸÂ”Î]mÊlé{3ËGœ•-ÇDŽ°å -ï{†ü7šDÑÉ 9Ü ó¤ëpÄþ8¶Ù sYÏiuXÔ ë9#æ¡(6Ætœ ¨€\ñá#á'3~$œ]¤ËY' B…¦&_C¹äptaIïeœjRÍÖzX¶9Ÿ™5f˜"†´×€à ÓÙ`—–˜Xðe¨C_ŒÉGøxÌOùT{7ó°ËÚÕn–¹ë»Ô:*õÚ¦Ÿ™¦g™÷º‰}AR/s¯Èšk³æg‰¥¼Ó=>jQšíe™-TðÞæ¶8v…kuÜ?/ ~žqJ.|.º²Ð=*nÏXˆm§!f'ÎìÄ™xNdØÑ4ïÊ‹ÉðhÝðÇÃãpÖÖ%ÙÅÔð™y5kt¸7Ò˜L=³çWbÐVWãòy5aá…0ijBÝöºò~Øv^E$‹.@gÒ|‰§¯±°½ïáÇéf´õöõv.í¨?5ëÇ'%ºÒ±(Fïåìn×™‚1½Oû‘>IöÚ—Z/5¾’ïßšõ²è¥^}cQ¦Ïëù‘TQ;m´ÚÆ‚¾Æ‚³øU¿?L!2ú×zõ½A¦óëɵéËÍ˾Aõ·~ fø¥㤈XâýXH"¢E.¨Mª${Ý"ÙÓX`å—V·(>Ñ™‹’”i¢ÿU.h±Áɾ>"¢ßh/¤÷<Þ„¢ß.®2ãeš:ˆþ"¹cnC -Khw7ZÚ‡±×®‡ùøÃGËñ&]w9äÎÅÄ.×èCÃOZýA§’iëFDìò«É 1~ÆÀ}çL›>Œ…*mãó>è&²‹ÞÙ›ö2Ýà9rD¯ ¹våKb—ßMšƒñH­c›>Ž3t?*‰|hYh}laÖ¬Ñ$|†ýÁ‚)ªx}¬´::Ê×'º‹öQߧ¶IR”ã¬j\X} "€;*?¤ðð¨[-Ñ#,$ÐàÅl*úJ:¡’¶ªâdù,t‹¨d¬×Xá5cSá ¬Iûùë)®ª­Á´´‡# 3Ç[•#hB(QvG=ŠãH$áµ™¸ÌŽáiHfaAäk•P¯–Ìf ‹m,|7XÉ+“ùW‰…Z¹ÂÕæÂój7¼†JÕª°²³7VÂäæË"0PýÏd} 8M“ÍXã*3‘uˆ8ÁüÖ`[ )€á±–“œš Y`)°€Èä4¼¬¶Ò“½ÎG -($, Û2(±Å9ÏÒQ´ṅËåÔ8¯\ú - ÕUBa ùÏ«uJaÀñdÁB×ô3bJéæ©æꕬS‰I›, œBͻ뜕½K§IUñ² -ååâr,t7Û0,æDUõ X€@þCÌ5¡zx„‰…ËÍa{ËÃ8§™º¹úË‚ÅìÌâË©®j®ÌX%÷ æd#ZY#kq•–(a×XªN©&YgÖ†¹8®W¥#éP¹H }U €K˜Lõ0«Ù^.x:Rw‚¬eùT.ΕjC°€¤ °XG p€2\™ƒe¿¼…þ@ªlåÖh‰çÌXPÒ°P®±€÷Ô Î×"Ì¥Š× SR{/<%F ¶Í $ ¹5àl¯<¾^×RO -–Ü`!• ,§u‹Ås=ðõV.dªÈ’P‚Z¹×Öªôu¬T(,aÎfK"÷ÚDùaYÅËU¼f,°dŠ¦/Q»¹  -íµ€|’ „…3¹ © fÎx²ú;øN3¶Â‚/å o s‹G–þÂjï{¹€ÅèûÕÀùµ8Ó]fkK»Ø/#À¥¯ýHʾn@ï_c¡1Ú,e¶r¡“!Œ5L‰äÂï¡$™’r£`åyDųr¡­Ž+6xº.ŠåÂûhËUXoî/0oôÚ)qB·XàlîÆã†÷0Ýú‘Òp4ØT¸˜R¸4Ua ëdŠ]pKI'º_€f,öøK25™ÄÚŒ….„k™½4}ßÈhÒLÉHrá×P“ÙU†9FC·:TÞ²£/ø‘¸f’¸ã˜ç!úîKo sn;ÀØÒ\òè}Ôrn¡Êz`R#RÕ´P9Z}½×‘°RïÊSŒÁÈù˜¢H˜òÈʯ54©-üÚA¶U¼t”b¦%Þ¿˜¥–uÁ¬qɸnÖraŠ¡~.Š‹Í~$»S†–åºØaªÈÆÜóN÷NO°PyœU;u¦ó…|Šj/Ï3ÕþÙÊ=tÈ\=‘8ÊŒ, &Ûý£4²Þ XK|]„³Îu³7÷fÑÙ,ÐvŽŽÅÝÉa>¯ä Ó&zO, ÊÝ"ý#—:þ2þ-ÕãÇR&ÚŠ5=‘ûNW¤ê£¶óÓ`[ã‡q@.P˜Ñ#ªÂLþm˜èBúóKc:¶},Û2¶rJÏ$z(än†êLm  ¬î¥± ùÓðYÛRz&ÑCÆ’.LˆêAs1vòmœjÂývÛèàÝ·-ô3úËaèOa|ª¾ª†„æžðü/Çko*»²öù¬!“äí±ÀÉËpÇÂöa¯-o^ F>È?ììq·?;ß×™IN²ñLô×umyÅàB¨»±”.yÚFõf³ê±IŸQ)±÷¦*ÌÍÌ -Å®i©çô{âü?°€¡ ø‡÷ØšÜô$ôü öÒgMõ¡e‰²i³)e–UãàÏ4;5Gê,òîrÁŠVíΓ¸}©ý… Žþxi®õD«DÎ#,dUšvfàa…|FE ‡ÄÂô¢C®Ýžjüë…=ñÓ{ËëYÑþÿbá³H?Æ‚JA˜D¿«ÖtwŒe,þ´§°~p7œèå±À®ºk›¢ôW »ºìÉY'½ú¸©»ìßµF•Ô®[GSa¨³’Ôv]{\j†Æø×¢['ÞɈô &Üb¨ùÚ­.ÅqusÅìƒO‰WèÓ;ZÆ -q8üÌ­å‚ây]Ôh3-WÞ¯¨½13®|ÜfÆ‚fÌÓ;¢,¤À¼÷ÆBþU,h*Þ:ƒ.­ã\¢8 ¡†Öš˜ô ÕSƒÑÅï]-Ç `Yv…Öîe„_c¤tóle/À!÷âw¶nĸ«~á1Ír Ç…Û£UÀ-†JœéÅ+,¸k,ØÚ Ðdl~1xñ´²jÑ÷÷zjè04„èµ(êRö5,DÙè¥e1B,3³ì<¬Fµ$ÒÔ­PïÍ ®  *žiùU30ï†3áÐ6A3q£0³†³ ¿ÓÕwXà84#…×Ë3K~gw‹Î÷®Ù£æ×£5ôSœÃ ù™K%±Yÿ5˜¸™zÛP¬¨ç(é*1.bÁáF…Ö²åé¡õœCý :Á‚,‡ð5TX›aÿxh *~…’ \‰1E–|•û‚Ët-²ÒRHüLE…¢4Üc‹'áé†7¶–’Dp·HŒ+La/ÈÂL¢TØl;w¦iF&BÉ‘»k=JàÅ…‹ ܲ¨Åá³Úx  þãXÎÎÈ\êZ`Ê¿H&.E6D¡€Š¡˜Õ˜MKf¶“•Ã°f¶Z·½= qÿ•Ž¯/¾L¡#AbšÌ7C,$Ùxv\¼øT-aGƒ…/F¯Üaa– æ(üâÓÚxI>vÄ& P$HÚЪ4E -L/Ž¢bQ*¡CH>ùÍIZë¸ä‰ÖØΨÒ÷XÀòx×ÆŸ·Ë¬µ»Ç†LÅ(:zÉÜP8;/‹Ã54/ãÿsW¹L«½ðÆ4Ë~‰Ø  O9~yD smYÛbœ_LBý))g,è3Ъ 3OÈdêä‚‚½Ç2”u‰a'ŒShYúN.¤3'÷°¿P¨ræRJÃÞø?#M­ôÜ&èNä‚»q‚ÒS,8Ä&Y.äR)‹He¾wà¼ÿr! Q.x;¹PæcV§… k¹ Ÿs,ðÓVEÄ ”lj\ÀL¥HÉ‘ öFéÂlaçúD.€ -WÀ€Ëx·¯âBlò—± —ð"Ëcµe…ŠùV.{a/|1n¯j,¡\¨çê+gX˜ƒ2;=— h;+ËbÕ£ÍØÈ…>T²­Ôœ{A$ŠF}Òu1"{ácÁóíÙœ3;zˆš\ðÏJ.TÇr¡…^4 P²È…j° ¸`Ÿc¡Æ¨Z¸ÖŸîÈ…+áà +kÙ=ÞÊhfŠ`HlYæ@.0QiÜÀ°“¢Áy±æt)U,Òªÿ8˜7æŽic½/w´j³Î±Ÿ‡ØŸšå¡½ …£Ûu† -,,r´sÃ4Âc,` ·`0v*¸Qá Ï4•‘½³½cfÛz>†×3?4NqƒAW!½õ¤j÷)ÿT@Hþ8 tÝ({K:n5c«¨gäÂTã6²gŠz{‹\Mv=ý\.@M<ÜwŽ§S¹€ñ§­<3\^Úo48qØÉ›nüHó¾ó%Ÿ4]O<9H&FûÎ \© GÕ·® Ù¸@K±É_»¹Qª%S‘â7e‡ç¶0qãu•L=7 åqy|°¸ãJH3ÿ¡u¨Á&Îäã®7‹5~—DŒ;Åx7–:&“g®cXÛnÑš4ƒaÔé:ĖÔ:ü¢àç ¢¢Öa2<%Ó‰,«!.ùëX ºPaH¼ŠÀ , ƒž¬ÂëR &ÂÑô°1aˆèWQ©qj½ÑmáCA/„èÏRo…ÐÙf ù_aNNt¢?­-DŠÑ_¦.\jkQ­¢?M.‰"¢­`°H,‘` ±@D4auUò‹ˆˆ‰"",úEN$""%H,¡` ±@D$‰"" ŽœHDDHìéêôDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD¿™ÒK@DD\Dkw""¢,[ôý] - :+‰ˆþ81°@=„ˆˆ ×"aˆˆ°@DDX "",ˆˆ DD„""Âaˆˆ°@DDX "",ˆˆ DD„""Âaˆˆ°@DDX "",ˆˆ DD„…¥„EeÜ6mŒšo} ç c*Ë¢ˆX’¼8Š¦2‡Ëõêûþõz †T‹…|O„¾ß‚…ιžÐh0»ª)_Qc^|Çñrç¤í0hŠoοÆÄn¿ I·f¤[r€.C_üÏR¶§HèÀÁÄScÿ â}Š&!¶}Y¹°a®Kú?¡õ×ôä+-püóñ?ÇÂ÷ɦ];âÚwÀ2×Eû®¤ç QwŠ$ÇïÙ›`!‰Í³§$z=,€mšþ¸•X¤¾suªÃ¯Ì ”N·oÇÞ â) ¯ƒ…[[áF4¤?+íü~ˆ…ÈtÖ -?úü\ü8‹“½>¡ê^ h7¯lSßéÖhvpnGXH–is[Ƭ4Ø[€=†¾ü ÿ”Á¾ ¥ïüó©>‚hÚÝÿšFÓ´ª üyþaÿa)`x„Mñ»ï›Z±W¬M/ó·Žö/± è«X¸ú„…—‚Óé?¬Y4ó«tœqÉ-¢@âÓ Ž\‘‹-áÑ?›žf -*¿ø”‹aÁ<·XÁ ½z…ᘓ~CõïÌE„…¿ƒ¾*£áþi?…6HÅ.8]“ZüKñâ?aá½°0UÎÿ`1œb¡Ðôýæ\–)?ÓJ2ÂÂÀ‚Z‰ÿ¥Îñ<ª'æ,Yìg%aá`ajœŸg­3,$rÍ¿¿ä§Î{(I„…wà |©¢Gÿ;Øà?¡¯µÊ¯Ú ߉…yâZþïXˆ.ýKùŒZ÷Ä„…ßé˜ñý“jV´šÖWšÖÄÏHV6üô^ÓÚ8J>Š…Ë3X˜D4ú½ ·$Š˜DóÔœ#~®Ö”Úa‰b|Êæü! ï‡MaáHå`M:\d̆s Lí>—š9\œåôjŸÆ8×õZ*•ÿÕ÷ñN.øíÝQ*ˆ¹A†Æ~®«9ßÚ-Ž+¾ˆª`—Ë‹oûè抾”o¥SÞ?O)‘=ìž’èe±ÐH,8·XÀ”š%n ÖâKŸÝ/iÍË:‚N猰A,´Š½ªöÚOõqm\Ñq4ÓL?ç› SŒ OŽ3Ç?U‘0ε›·‰„ðkÍe€Ãû³ËÑS’|x_¹Àúƒ”ßñ»cÿMÑùG§;Ã:˜BYêÛ„Åú*0ïóv|Ò Žs‡{Ùe<à8ˆþøâ¬OÔGÕÖ‚Çà{ÖïŸóæþÇOIXx,ì“Ò+È9{«¡-ª’3DGXØ&<É¥û ø¾‘ųÒèU±°„mVÎæºRw¯§Ë¢Ü&ÿj%gCÆ¥“±µœ½0o¶Á´Û‹†rØÎyXÏy‰+°à·Í.…®}€¿¯ÄŽti•‚4ƒ!ºo/Ô¤#½:âëѾssùøjj1·SYÙ¤ÁÂÝÛEnÎÀávdƒg³(ÖLgŽ£+g¤âÔÉÃC…”.–J;¯äPñ"úæp¼gQ@Êþ.°píqoo^â=ÀÂ5À÷ÂU®†ÁÜ’B›EÑê²>ŧô7OÙ÷¾8f.^{(Ëy™÷»U ¥¨¿8‡¹4’…¹6Tl Ù9a»&žÇl¯”ΡÁ>ç®ÙœÎs3W¾®Bé÷kç@§8O:θæÕQ¯àð97ÕXåûÇéE´¿ðfXP ñæ—ŸcAý}ŒY q6ûaj¬½¡LÓ]ìÐ,Dƒ³-Y3TMñ”íÐÌ<¿uê$½|DµìO«½vH -⇕• -¿ƒ‘F´Ý)Pqïû-BÂÂ{aaÖó7§i3näúœš¿¾@î‘$ÇÍA¥Ú“XXDÒ¢l_†ô1f»Ç¿ ì«nvPé³²y¥’ÝÇ‚s“[¡À°—~„…wÂB嵩µÙ¿¶ç ÷ÚËüåƒë^eš>‹…=ÌxÐüëY”’sŽyƒ'(Îâ=,¬ŒŽµ­"ãfƒ°ðjXàܳ§®ƒZî›Ú[Õ-[æDƒ¿»H»“‚kqÁ’éY?’rXÎ1|Ç7›v¼ŸÇíj½‘ÑÝͽ‡_»c¬l÷î ¯†…94lK›êyÛåQqöp¦ôûš†=ÄGƒûX'ÒÁlÏVþüÁ50Ó¾)÷~¤òƒXð‡èî+I ¯Œ…'ª oƒuÌGÁ¢³>¢8©TŽ3ú.,pö.µmÜë:>°b{f—Áñ’lšë¨±bጱÕ­Åaáí°°¯Ô{(ïwdýfçϼ:AÿÌ^ñSX@/g“ÂØAä©Y*ìO&mwGÞ­§äBs×£»ÙG!,¼ ¦z¿&SPî(<é^rTKì äû°oÂrYÙ¤Ã-vÅÄ4çCñoÝÝ,Ñ;ñH§õ¤0]÷/!,¼d®Ížå[ßTURÛûë‹Ë**Õ¹i{W<| ˆ‡BC<ø0DèÔ>†íƒX8·¡ªÛ;ÞÄv†…ör›ƒ¹bô;?a{»Ã°æSÜOèbAÈÍÜ8—Öª2¯íG°p¦ÞÁB÷hy¨ /Œ…Ë!Ô«ÿ†Á4Í´×â㸷þ1äÞÕj•LÒ›\/.ª†}Pü4æe•2 í-˜§‹ÿuw«ÊßÁÂéKin-«aÁ7YrKw®««ÞåíÖKçpkìh§ø³XçR7g®­,šÙt-?„…“Óï`¡",¼1ÎkÎ?ÀÂêCÅy-{íܺ?‡Û戟Ç´N&] ü•Òû4N_J¼7¡ /ˆ…Ö†| UÞü­«©¨Ž6‹¹…~Ù'l~ KŽòòhÑýí…ïÂö aáoaár~, 1N·uþ&øËX˜£1ðÿc¡%¹ð ±ðŒŽtc;ÏšR¡A_µ½xØ…FŸb!aQQ>æç›26ÿ¿ŽDöÂoÄBÿÛù¸ZWÜ›Ánsl»[qŒ…bƒà Þ‘b`aMöT!Öi;k·é<„…·ÇÂû ñ£2õ<±ÝÛ¦SbA1ƒk5ãìöݯÊôAŸêDZ>U´¿ð›°Ð<ö?©E°»w†±usÞÜ:™ç ÍýPÐ#=N±Yb>ìçó=Xè͈öâ«?Üà©-i=ôÁQÙ1b•»ÿxq¿Ù|hðoS(>…ÓÀŠGúXˆÛ¡æóÑ?…yÐë ³P=…êYÅ.ºTkb•1ýY,œ,Rœê¯ÄB¢’ûµG¦ëvOXr×Î5aAå–>‘t#TÓÃ3a¦‰Bví‹X8“Y”¿ð+±03Z÷À¢˜y6‰ÊVKÍ)_+õâħZ=Û¡S…-±uÅa–Š¢‘ªŒüg±p*³ŽbÆ ï…æQoÀn·¯TÉÆí}§ÓC,̉ÖÁƒm%ò ë!Ûm” 'nd“ò%éíŠeg¾ë{ÛÈñ­ú °°ã’ļ[žbÏyÉÕßåUYSoö} '‰míц aáý±0ç3‡¬²¨õżò‡dlÄÌfGö KÄý’ó³.ÕÜ0Þa½²[cÿóX8„é ÎͶ´ŠTéˆkß Kémv¨ï·XU)½{V6|¢b8ºž‚¡OÕ¤£ú¨«Ç=äNõy,>¤v¨U*,˜Äµï‹…¥|ÐA{U~ÍHéa ÅÍ‚½)¿¢úuɱ®!Jþ‹†h®›½±BHws]qÓî X8ÈS¯dï#¾<ܨ!zy,Ì ·ºÊÜ®gýÃÏ‚d¸YÍ#ó`j ã6d¢Z•œÐ-=äö¶˜Oaµl Wg_p¹91ùÙs]I‰^ K¡mÇÜ°ËÜlàXAá«ùîwW[mÛE|.*3`£„UšÝ¢%Aמ mVy¨I±ê†r[xU2|;Ü–‡ý -®Îu]9$Ñ®'ý殤7OIôFXH–BÔ—jnF­šÐ–”†Ž8«¤Î¤œ{—l£›‡ÑÕìRs¨nõÕÃ*ºª× Ùz7¬ é9ªÊŒÓK¥ ””ÕåÀêý°Ù‰¼kç7\óSú×a÷”ïO‘1L¬†ùiTéa¸ËT Ãü²“.€Ï&Ú#uì­°°´YÀ&U•Ö4MßKs²ks₤ÎNãçkZº„æíñjÛËl=ÅmgÍMuÕËëa}ûyœ³VLá >UÙ®ÍLáþéà/Ö~tªð‰‡~“`0FsŠóqfE–ã…kËÖÈ!oŽc8¨%-þ[éãLÖ²ŠÕÎ`a†…—EùÒÜòÝu$\.¸Q±Ûmræ }tÒKw“t9ÒÁ“jÕ]ñf -ñôX0U7.IÇåšöž€¯5­~AªB—kÖ8fò§KÃ-F}Ä‚åIÒç·^?ÇÉÿ7ÍA>ÿp•ÃÒSöo¬ˆU¿ÎžLúë}48§×þêœM¹œ¾ þµìææV’½û”ïM^È#.±S|ÊP`!ób– ú3¿N -[€ÎT)|I9æàCÎÝ4ßñ÷dPøÅ?Eâ©»–âá¸IWLß‚¿<À%ýጊÍS>›\ñ”Ž.üLVèJ^Œr+[Ë…<)/2+l± X$K,&,âÿH¦R› Ô$Ö¤a–D‘ŸOcšr} üYÓ]ÝF¬Ö¥”æ ûX¯õˆOÊÁY5"ßï_%1ðŠj8CO×`ÕåvÎû’±“x7Î)Do÷C¹ñߎ³ëq¶âó§\©mý¯Á‚ |X¨Ã]sÔ=8ÖJ,d†ä}{4¬¹PxáZµaøOÓ²'#7m~ÐnNÈS]žÅ_ÀBê_€®ÝL¶²‚D~ÉðaHËóÛ%qøÎæüKwR:obý , ÿ ’)‰´N„üùŠ@;Nï·¼bqãåó¦dì$ßÍI `%¾½Ëè4¨ “\w§+;?uyÊ_˜TZV)°zBIÒGÓ[Ë…¬s|Uyž†'Xˆt‹C0æ‰ÀW VEèÙÙhÁ«òÃ1ã㇧é2ZÚt$.|¾æÁb±ùœo ÑTû°›fܧæ κª¹Wb˜•Z•¦iÕ7Ç•W~BŠƒC%Ì`0Ó>~ªûùxþÃÁ£‚SÄ؇/û®9ìä‚\ÑGçô‹ªºaߎ $ œ%·öÂTã9ú˜6áΧZïlgÏÄóõÑÃçü.†øÌÙ_¶‰¾ÕZtî4µúk$Ù³ÆÏÆT 팅6´ -¾æç“&±’vrâüL~¹ g ÛÁã€ñF½ïºN³%& /†Ÿ°€ª½!åB:’TXù´“ Œó²É?Ø '~¤Ù§š×©Bù¢óO -lÙ,HrÂÉ…Ç— éÄd®" ‹½€JÎ-k-|´¿Pî$ì}t$ ~?×0lþ?Ã!,\xq åçÙT¤d/š0osþ÷c¹À-Š6µi¯#Òüœ $^×vvg¹ÿȳiÚÙ yý±\àrÆ=2O€#lø}ÑY5Ù¡AX ¹ðªd -^ÈÍBGè\˜œ1 «i– ^jJŠLy-¸Jƒ1Þ%ƒýJ€Ãaeó/ŒíÐt;",\x=*,Ø2€Ø¼ØHÀžâÅ^fyÑï}ªã¬ÿ2†/ÊGܼƒ½¶1÷øuð¯!-O†Â^q ÂÉ…4`/\ô’?&vÖÁ¡Œ3¾–é äÛp}ë¹\Ô™—Éÿ²9<12Ë\­+C¤ÎÃÜoYsóÐò® )¥xÂÉ…—£þÔçÿA’É~ÞhÎþ#¶ÚŸgw›qH.¼¹ãwWɘŽÅôH.¼i¡÷]·Šln 8J÷² $ÞŒŒ9‰óËjR¾$ÁÙ$H.¼±úÛJ ¥õ\( MKÂÉ¢aáÿ¡Nfä zYߧx¿©'å»à`1#,¼ÐÏ!ékÕYܳQcMæº÷Ü™–ÿ`$ÍûŽ* -U'»™jA1 °ð§ íî=ÏÊ%7!L:ìÜçQÅ>ƒ%þ5™¹óø‘÷¬íä°‘a`­ÂÂßÆ‚ãÝñ×`.Xdëw×Û$ÏÙK`ÁɧéâÛQŽ@f¹þ:îR6>áØÔB}z,\?®šæ# -½úè]~iµmÛèWž9ºuËÙ0L©­×包JÔQ+Û®…Y׶n_"(èlvP$Ã×ÌÊÐmQŒ³r¢’ß^VB7Æ©Z®¦'9õ†®²Ž›Z7ânƒÍ×2yãÊWõNYò«„¶ÅCN^±ì0$)Ÿ¡P0[CVFëù©NuÓòQb˜§8 ¾„ú],0Ym;Lƒ¡*§ˆåcÇ ðW”VN1Û¿“;Äèe/‚à}×ÃÏ1ÔV±ðkPXÂa°Fu´Wf V-ÔYÎÌt<žq#‡¸È>nX˜hÙaY¹§Š nl¹+,015>›ÂqÒ8{´ñžÀz±'&¿¨fœUq| åÔ€gŠÄÝònªðCÀo$Ìsö -¼ž_¡ar+† -mՆ♯¤z´ê¾âõJÓ¡^Ö…óXß×Ö¨OÅ%í!,Ë¿¬5Óóø&ÌëNÜ}* rHW‰ÅöÓÅ!Ìp´µ.WX°áFC6º+,Øpẋøb {Þë4Îð‹îUªyCE¯4ÝTÃ;c~ÑR>­ˆ™0[†:w„ežŸîÀ}\1)݉n¹ ¡žJ X‚´>È‹#,üÊD0– -Dr g§°à -öÓ×XUKá/éWºbk´eS±z2Ìãœ#«xh ˜\“ ÆîÛW± RDN1ÿŒ[šm‹8 :k¢}péضÈ/mø•~1õØà:­ëf2Åf‰¡^t×*ƒtrì¹ç¸)ºîò¿Ù|w~Rm@é¯B5‡‰ÆfÑ`ÛAÃP|ÅŽj½Öä½`ú«¡ˆórÏÏ•‡Š‹m×r; ç§Öü×ãõ%*M°Eú2)}¬#C]ƒ¹@ñH€‚UÝ­È -_´Ááýö³JÇù:ŠÏ5(Nõ¯a½+òñŸb!¡ü…?A—U`\d…ÕkÎR ¾ ©|Æaêaá·Qê-?=ÓÝö5géd÷q"Ýý¾!u¶ÏPb™;ˆˆ¨ÑC†°@DDX "Úa!³‰ˆþ> endobj +1290 0 obj << +/D [5364 0 R /XYZ 85.039 761.463 null] +>> endobj +5367 0 obj << +/D [5364 0 R /XYZ 85.039 741.134 null] +>> endobj +5363 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5370 0 obj << +/Length 1655 /Filter /FlateDecode >> stream -xÚ`ŸÿÛÛÛttt•••ÃÃÃ"""‚‚‚®®®gggWWW±±±¸¸¸ùùùõõõèèèýýýÍÍÍCCC444ñññµµµìììÑÑÑ£££áááåååÉÉÉÕÕÕ½½½²²²ÿÿÿ`a?[endstream +xÚíX[sÓF~÷¯ðÐé ÏàeW«kfú`R(¡\씇Å’mÍèâJrLúë{.+YND¦”¶OÂÞΞ=—ï\5–ðWWHŽý@ ãU>’ã œü4R†bjH¦=šËÑóW®7VR„2/×G>®p\=^ÆWÖùëÙ|ùòÃdªµ¶T &S߬ó·³ÅDY‹‹óÙ[À\ +Çù„®£Í:-F¿v¬øÌó­!¸:n Ú@»=„Røž?ö])\é ûÕ*©ëõ>Ëî&S×v­:ixç¡R’çMiöªô6©xþ:Iã$»Iª ¯L7iÕM{~¼ýIºr¾€ÿ•@+¸Â·|¡ä¨Ê²ùŽ©«Ýj•¥IaÄXÌ~y1›ž_μž^2¸ñ}¬ªVÞéŠÇ§I±ÏwUZ€$õSzм§ÐŒ!½·Êc¦þ‡þº¢àÄ9¹³Î¢M}v%?ÿ\ƺ`œÙ Ò‡É}jRImŒx +e†×i®\ŒÜ'\dœ¤¤ƒñ öL>9:ÉP)ëZ³5U/<7ª?ô³r<ᨰõ¦V„¾s‹žNª?»¶6:% +´x“À†–$iWd€$Nâg,J”eLï$n³’Rî*2IVš)AÀ”ãO +wŠW†îxj².bÓDL!N•ÉØ È /@äùPèÂ> +o„‰²•êhK„ràYË®ÖÓùG&;¤”û`Ö}<ï|y«h®ÊÍwgRÕúì ˆVà!øÒ=´£ú%AB—#uLj3ƒò￧¤¹#xôÁ–æÁ‹'(Qʆ:oŸ¼]Õ¤õ$ÂUY­‹WŒ°Â¾î§Õ´î27ÄŽ¹Ø”|XCÏO©¬ ½?ÒdÆš…ÿ}c +BT µFžê÷˜m¡Nó®p¶-ÒKØøŒuŒ™ø~?q"pÚ0*Öø7˜Ø¡wô»âŒ/˜ªŒ©z¨éÔÀJåPË„ú ø©\S¬CóRAÙêz,YÔ]ܦY²éòŠæÞ& ®_,–ecÊ]ÕÞ¥;æ)z1O Cc±Z +{0ÃkñM¿ãéPè +ô¹kÛÂV­,h5[éûò¶¿ z ðŸ†IȲendstream endobj -5243 0 obj << -/D [5241 0 R /XYZ 85.039 781.388 null] ->> endobj -5244 0 obj << -/D [5241 0 R /XYZ 85.039 733.638 null] ->> endobj -5245 0 obj << -/D [5241 0 R /XYZ 85.039 733.638 null] +5369 0 obj << +/Type /Page +/Contents 5370 0 R +/Resources 5368 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5359 0 R >> endobj -5246 0 obj << -/D [5241 0 R /XYZ 257.292 263.979 null] +5371 0 obj << +/D [5369 0 R /XYZ 85.039 781.388 null] >> endobj -1442 0 obj << -/D [5241 0 R /XYZ 85.039 117.572 null] +1294 0 obj << +/D [5369 0 R /XYZ 85.039 259.884 null] >> endobj -5247 0 obj << -/D [5241 0 R /XYZ 85.039 96.678 null] +5372 0 obj << +/D [5369 0 R /XYZ 85.039 225.744 null] >> endobj -5240 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F75 5171 0 R /F56 2890 0 R /F14 2895 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R >> -/XObject << /Im10 5229 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +5368 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F41 2994 0 R /F77 4849 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5252 0 obj << -/Length 1713 +5375 0 obj << +/Length 3206 /Filter /FlateDecode >> stream -xÚ­XI“Ó8¾çW¸¸ŒSEŒeY^æÖ0ÐÓô„&}"V×x ¶ÓÐüzÞ"/Yzæ0STu¤·émúžŒp|ø'œDy¾L8žLg]Î|g œë™° +²˜È¼\Í^¼‰BGø^ê§Îj3ÚQ^¨¤³Ê>¹¯þ¼Z®^ßÍRJW¤Þ|ljûê~9îG¦.ïnnW7·×¸ (Üû%²ÿº›'Ò]±ÐÍíȾzÿòŠwÒóç_Vog¯Wƒ§ƒàUŠn~›}úâ;„ôvæ{2Mœï°ö=ìr~z*”v_Ì>Î> ¦˜:¬u)+J&žJäyZ„š¤EˆÀ“"pbå{Ê)/¥™/„««y¸Ý|$‘ÛÕüû~b×à&v÷o“³˜þ -›Â@à uoº–å5ZÊU²JÞÛk‘oš´a­êQ·[S™FLà üÙãÞ­[«Ní¬¿›º)õ¸æEY7KùYL_Já¶l̬{_u‘ÿ¤d( }M¦BOúPRmæ -ÄÛÎÀ RÅnÖäýkYó(Õ‘ô’0°šÏ¹uºz‰+j†[G-Œå×Lá,t–š™‡|M.({® -ðÙ!˜Z³âÍÚ‘—¨®;í=Õ›Aàù‰8oÎ8msÊ“æ”g͉ù….õe@7ŠÖæYóöRÐM‰—*j^ç›3ೇqœÂAq@”PÄ°ITÏ~qS -áüQƒg·s¸Rá )†{+΂bC­Â(ö"¨^@¿Ü'Ÿ}åkø#NS'à>ûPÙ@FÞ1D=_¯²uÈ5mµ»èÛ|{h° B¬èR›Aƒ¾Í~?õ5/† Ï}soEN};:åÄžµœÓ•ì¨%× Þ¤}wÜÆHë{±´W ÚÓ6vèÞá]B²íÔ pù&Ÿ„†Ð}É?d|ˆF*€ÁñÐâR¼Ð¬©øox±ß-ô²ÁÍ¡°êý1 Œ˜kÈ5‚÷ؽ!7­“„väÀká†>dh&d*Ÿ3Fà…Íɇ÷ýlaWŒlàF -L ý×h@4Lc¶^óaòXª- d¯eŽ®2^Ð$ ›è&R†Á†ÄCk{Ó²`¢=Zq0¹³RäLQpójËÒï«Å¥IÓ5F—8*.ÙXoš4Oy6-äZ Õçšb@½÷°$.^³b‡*Cþ”·ã1ÌÖŠÎ3KqGH¹7W·WL£$!)ïZ¦Lg ÝíÉŒÁÁbœ‹„~êÖüMÜu}hz ³ÖuÙ¹0|ñ‹G–®'ça©!QìÃÂٽñŒûcÛV2©¦À,õ߶¹q—[Õ‡£†d¦áRØÃ5žhå•ùqâ iíLW7=7¤ðáx‚ºö‰¦Tux¨- -FEwbô oÆŽôw8·S÷ðƒ·½W¸¾Çun§­$ÄI+1mp¬Û™Ü.÷Í’Y®¤› ^íóKM¼«…õ$ÑØ#¯ÖsHÒ®¦\Õ}™eÌ—¦æe6.Û;<ŠÝW(:<ºÁ.”4uukmØZÚ-w^ÿdGþŒDÛ¦Mkñ -ùmGx‚lìL$5ô‚Ë/ÝØŸÜݸ5ÿBĈRô½Teµíl¤QˆÕoxœˆÜÊôP‚»Îš8v”4ãO}èXàqf2K÷ü´të’.M¾&ÿZæà%¯ø¤^w—ª×§ûpŠ`—®gc¸ð"Э{OU¨+æÖ•52I1læ+]­il-PíÌuä+õ¾4ý÷ò©4`‡‡#®¸H"ÊhŽ­.\z£!d ðtШÉÀ•~x3@gÒÆi ìÄ0ý\éƒ ¼&ogªÕ%%Ì~¾ßÓ›|ËNèþH¤i‹IHÁrR>A¨ð\[CÜäaf(V¶ßi;t. ×L²`½Â0¦úOœ p°DšJM -Ïöø èaÍq=ïeóÿ"†Æ"ÌסåÌôÀdÚм.ys}{ooÀyù|¶BR@«§M1îÆÏVØ䤪(zID‘âKN#åh" ïþêŒ^«ŒH 7IÚ'n(äÒg'®Þ€Öòå>Ö…o1é{AzùÉjðÿEµ"?ÑÚ: +[ïpVL#yh•8£­ðsõ ý»†zqŧuÅb´8 +H9[­BÍÌ{¹iqé¥#ð{þzà·ýp}µiq³ôV~Û€§ƒ êÅ/‘rô<É:|N’onçð—i{6 µŸê ŒˆTï/Õ«ç—ŒË+Üûøõn€ ÀD¬b™8¼¶Jüœ”Id£¨ÀÖª§1/h´Ü YÈ%™¶øIö¬P +“®–ÓoܬD:pĈ3?ÍQ³-I3ç0-I ³¼e™ÊÍ´l|öýýЉòØWQ2rÂðDu˜i? £ÑÄÂÑÿ5n…ð›+}Þ€hw Ò³© +”áÈ¡Âþ Tz€"¨Tê,vÀÐÐp§q8 +¸¹}Ðý$Š"o +æ·h + õvQ²­Éwʶ¥Á96 Š÷{¦(f6ÀÆ-VÖÜw¿ü‹p îœégþy@:r‡†;þ â@ØFÞÌ=bS±Ãpm@ùì°Æà·A–2Ä™©—x~r<™ŒgDs7ŽjYíÌ–¡µàmÒ¦Ÿ9%cðt¥ã“öwhŽÛß=fÿS ­ý÷9Úßå¸Cs­ªB¬"°¿)ï;ÔË;2’ز­ä×hñ«Xã ñ•À…:?Ãç–ˆ<á§/Ž#Õå³cª á`ÔÉiÕv4'T+DªöÃNµ{‡Uëp,Ú,ŸIÓeÑŠ¾Œ#â!´E—í—¢ÿ©ìÎ…Ÿv!¢ÉšG,›^Dbì@ëë®e·K8âèóIÏ’«’Dkž`0IØ:Æâžï»rwÜFAèçútvëÐœ°‘=j£ ;íq¶‘ñü1EÇ%‡ÜÌK„Â<›a¿ :ÐR5W¤œ•d0¸3§*š/Šb0bIÏ|ØèUÉ7Å€f>&ç<Ö·rúm4·Ø²Út¢¶‹¢å^ÚNýœ™•ÄŽlJ–»d¥ÚY—Ñ¥øVÇÃ5Jà´<í ÉqGšÇüà7ë{ì½ÀaÇGW&GüŠ¥—u‰i&ö0 fLƒvN7èkåDÁOEø8Eè\TMË_©[…ÓYä³ 8{Æ‘ÿR9‘ÙÝ ÿ¶"‚²BZSjq×­®QHp›0àL®Y"EÊ?ÌHû§”´¬´sÏ?bÈ C% ìm…Ñ>3GŸ3 ÆÃ^ ú’N©RºC-¦·R•ÖRÞ’¡ÇGyKšz«‚|¾ªt¡³°¦ úl9tÏí¾AÖ¡ßZí;Õ<5?öÓV* S@º°ª…wˈè4„Œ²»òò%ÉÓÌ‚t@2§±w-3‰«שø·ƒM×39±¼ÂR8ÌßpG8Qç< g“M™ec j·hFRÖ~ðÍJs¯µ'+6L6ÊÃÈ5œËZŽÏsžàÊJø),‚ ú¦\îRpÑžˆƒÕDËTR¥&8 \”G S0W´q1;È1Ÿ…ˆ]ÑYi}˜Š_Á öÎy]¬¹½¯üÆÍ52Ü‘ëAk_Ñœ-ÜbÏŠ J9;VÀžáân+C$êRÊûðúúÃÂü¡a­ö±°ô;¥v1)éÃÏôÂ]tZlÏÍpKû¹˜Ò¡G›ºè—+uЭԷõ•ܦcÅ–²[T(`\Ñ7À LE\™´*êÕÏFÌå­É²].øê! =ßìê› ç3ê“•aƒ˜®Ó,1]П%~d0Øsk.X°·à®Þ-zr(œ£ä$‘v"]§9!L±6Ù&Œqð\ÔýÍ¢¨E)®œš{q)¼”ÁoÎ{äÚIQü‰ Ûæ2¬ÎxÂ=å°ÈÇN¥é®=‰±S’~pGe õ¾ër[Ô¬ØV¦.¾¢mK¾Òs<‡‘[I 5@Ü[À[ÇÄtk&ëõ‰wÍÀg‹±Ã`à ²ð%_`K౩uÀ„LB¨¶aŠ’NÿJ°¬ºåßË))PÐû^–›e9sxÂo]¶;œ¿1Ï6‡|“¶z¯«V0–Jó¢5s]ðý;9N¤´ÃlaìC1ñ·üaýŠF73'ò±‡$æ…dá-w Rú6…ƒ8ç´È,+W–çÑÊFNRQiAAW0VðOmC & l:ŸYD|%Бw‰—˜‰ä0[nÈéA´Íwöo¹çg¦ùŠwøÑÛµ,EGÕ7”™Ò烊¬OMyóDŽ’ïº%IH¨h¤ZÉz|wkX±Vñº®8'°‹M#ì¥RvçR¦ß"¢|4Vø]AõæaŒæB]¥`3œÈ›®ªÆÜv™¨+ û±]UõÞ÷M3¾K&ÎíU—M¸ä,kb¶•«Z»ç ŠŠ¡Ü:í(Éñ{ +¡yìžâ7{O±ÇnðžÂaw³ÄågIbÞ†J:c8c:XJS‡<‚e£¤{J²¯I½EÃÔOÂľT½z~‰zž¼¿¢Çczþhªz«£’B•í¿TõÖpÉ, ¦((é¦X—,9¾èÑkžñUJä°ÛW¾TÅæal.7o˜ufêk¼Á´9s¢¨G¤bàfñiÝ >9ì®äzäC +¢mË ¾ÓÞ“¾é„’Ǻ'~~WÄð­¿1‰{³þ„ÉaÉ×r­#_åzßzÒÓK|Úá,þ9Ó¤dS¦d°x ,W‹…9·ùÉÕˆãSÁ¢4ôÓ0s Z¬NtœzûY}I(# t,y2vn»ëûšSLmiÈT֦ƘۚRåpÄHeŽkàabâ” n«•[aWOÄ¡·’N~·r +W± ÿpt„¯¿áÇð?úKÝSEègá‘ôXkH£,h­¢}yã0ócÈáþ|ÉùŒendstream endobj -5251 0 obj << +5374 0 obj << /Type /Page -/Contents 5252 0 R -/Resources 5250 0 R +/Contents 5375 0 R +/Resources 5373 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5257 0 R +/Parent 5359 0 R >> endobj -5239 0 obj << -/Type /XObject -/Subtype /Image -/Width 780 -/Height 418 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5258 0 R] -/Length 26233 -/Filter /FlateDecode ->> -stream -xÚì]‡‚£8 ¥7Ó{ äÿÿò$7 ´™›bíÞÞ cˆžU¬Ò˜š4ijÌY“&M@¦9›‰¥IÓ§ÄD,XWMšþ7çžžúÚ!n åÂïÑ‘®vy/(i 'õð/ ûÁnoOl#TNŸnX¥"6Ç‚CZJãN.<ˆ~`™çAo}k8á:‰`ñû²ÙÅNŠ§®¹c«~¼¹bo…ÝÀóÒ£wÒãÙdàûÎáî)5}[, w°Ð:©ˆŽcr^hŸ¯„½zÛÓ/ûÔ›>½àŽ®Øîfû»2^µNû0+Ï–céAŒðR®³(Ϲy2w–/ô‰{š+Ás9b.)é½x…Ƕ=zãWä ¼›ö”Û‡ôCsïw·αÐÞ¦Ô‡'ŒÚiYÞf¢]ŒqÃ%””l"ä&É%b«íý bx·sÂvÿnè}j®ʉÃÂm<Q™.áö1oÇïÓòÞSjú®ö™Ž„i(G‰€†£ytÊ“L´tØ`á`Dco»¼`qœì3è»Á'î7‘íÁ¥]ßÜVSãÇ`ûR>ÿÁSjú®:’´·kÛž&—•é­>?†§éÂ(¸dáHï¥õ§i@°*÷GX06Ée¨qŠPÞì P–ûãñ5~(Ž}ªkÜš±~ó—=«®ëk Ë (J‚T¨{ï®ö ™(¸¼‘Õܯ¢‰Ý_™óVEáXXä®ûF4Þ“ x’Máp^tzGMC_0È&%×À¹ ÷;ráì¥,Á­BªåÂÃBP¦Ó¡r}$"%¤ú=ÊÐ §ý4,\Y?’ËÊ}ˆß–x¶‚Ø}Û=¹p4(ôJ\Z.ü0,€ò°ÝNVè½ä2g¯¬µ[½‡ù>/`q7!‚Û8ì­;Ç~2(÷ž§÷ ¹p&w„Ž“– ? è™ ÷ËÿK¬±÷ªÆRøñøYX xˆY¿ªà ‘c¿†ûE¹°Ù‘<\-~D÷Ë‘Ç~x¼Ä7Ú±z3æû´IÿYX`x06ÕOŸ/žÿôs¹p¾‰oßÏZ.ü?ÒÅKÓÐ1ìÊ¡O¨¢Nö*:Æ´Üï{çâá ,póÁSÇãçÙ2ñ÷«ÊßÉ_8})öͤ– ß AO;jïp0×ëj÷û¸j÷V< ýçaoc¬›ÒÊ"Ý?ULæYíßy Ã)´\ø6Xxù«x „Ç\«^r´=Fáp«†½ ]3–,—°p;rátÆÂÏj¹ð±¾‰…;f¨p5mÜóý»c¸S"@ñnR.> wüHƹÚxó¶µ\ø~:Ò‹wpÞÄ¢Á9Ú„ìv>†¸Þ_Ü? ÆÝÜÿcŠµ\øÅrá©?0oÓ£&åNÿ‰X¸ ¡øÿ傶~£\xÁv>Ü‚ƒÆýmwžÈ_ Æ :éã=‚›èÀ7mçO´íGú›¶s| WZJ’Oœ´Í=Æ‚ÍËm<ž°(;/‰uÏvÚzW.<ö©êý…ߤ#½µ×vÀ¯ˆ‡U:l¶±±0Ow%a¡ÎO÷æ}[.œ¾ã6}BË……åÁ¢=ˆÁ8³+Ô’)Ó#,óó EÇ(“6û3°ðξ³˜À¢åÂ/²dlÞøW“Ô„tpl/xO÷U¸Ñã)vÄ°eñm?ÒYN‡L­– ¿È^vèys³ýLôÏr9°*±Ð?_Yø†õ‡BÐFm- EÞÃÛ~¤³8U±€l4A-~ºŽô¸iš0Wfß“Á>©úèÜrø‰OUºJiý²eÛ°_ƒÏÖmV:»½?ß• §2ëÈÈÒráçcA„\žÆ'ï3Ý'L±ñB{b<‹Ñèü¡õÌë7©` ïFž -F\ð®\8}›GöŠ– ?Þ^ÞûG9\J&= ~=Y3ã>ÆÂZYØxòÑúskúîÞ– 'JÒ¡XÒXøñöÂZyûdy¾)R¿Ü=?>·œcÿÔ£þ R~Ø·zÛñÃÞ¾x[.œ¼NçȱF. ?]GŽþ‹A˜ w‚âDÏ?pñœq IŸƒ¬Ü§VïèïX,Û½oË…ãœQ+yûˆ– ? Ò¡s¤}“ƒ; ñ("ž)¬‘KWÀwú~!Ö%»ðMx/h6×w:_……7䂪¸«‰8ÄðŽúA6 7Imx“j ®ápº1 ¶¡põ°í¿:†cçôý(ÉBm1×Þ@êœeýdU -}D.ÐŽ+ò!û5³(¹GOùKÈ.2xÁÅ8Ù&c‡–žOc·/‡ÛgJw7ÜS§¨‚Õf ’·5’ŽºŸI ;5Ûtα-ë'oäÈûrwkKÙ;Y Ù·ëÀ¨Þ?å¯.²“ ¬[Ié±YÙN~þr{u‹´Üq£Ú¤é@«*o¸÷œsÇMÓ× MλéÊ°Ç.Wµïn -[îýx¤!,Æ/½åÔ…v¹\~§ Ý ßƒ\ðs¾þ;scªrÁ´8›'sr†Òs—¥Q–²!²ü¹F jTÂÞ×PÁÏ kBŸ5ã×ëHwX2(Ãø…ÓѶO=UÇ#½‡ÐÚ΢ºO<ÆëõäB><*÷q<£ÝS.¿ -mjÏu)|§cJR5§¦*Lg6qMïÍÂ9ÃÂdú³_\"ns¸sÿ™ RŠ­í«SÌ`]ÌEH- ?þ_°@[`Þd.£ª<žð¡wT£<®7l«53n¢7F@Ãp¸£l,·¥inKƾ/‚ñ¶½ºOfd_î=å§IƒØ÷¶þE7nåBÏ”$ÇB¦Ôü[K»÷ ÚÎ ½+8k¶ú+Éæ Ò͹öÉÜÁwe¸Õ{r!ä)“áûO;a »v¬1ήËÄHÙéëù¥çœ8’c>4Rt«sC¨¶Þÿ¬1ÏŠ`ì+­ÎáÞ\ÂßMp‚…ˆ}|³Í§Îmû“ƒ§üeÐ5ò*ˆÀ‚Aacnå°kBåE¸p?’¤hg/¸ôÌM—I†›0y‘)¼Ž…ض‡Áìé#ÏK˘z´ø*ÆÿŸÞEž¯A3 í„`à†¡cò$Y`0vsä[l&b Oèܘ]Ê/£×u‘cïæDÀ´ìCµUµ"èÔ˜‹srìñÁdœôÞSþds`/×nð€?¨ráJAÒw06ÃB׸ŒœR -€ /w¹)nÎHÆišúZúmßÁ§ÑØbW«a˜Æþ¹Óã…ž“‡ç?lÞ“–v|gΟôö¹<}KÇoŸz%¿³Ñ¹Ë–ê•$Rt`låU’¹ºÚó?éIöÜx–Ço¶f¶7'ݳÿ+4íå‚&Em¡rŒd`ùDÀV.  äEx5úT-@LB?ßbÁt3 ×M4¾. Š\¨¥\;i@ìå*I}Ñõ圉–·qUu¤’þwF Z.|Â…\È4’»îz+zÓÏÑ*~,®p¦o2¹W欵áCúó57#-¾+Ìœ¥r”$YúF.€ÚSø`' ¹ÐŒ¢³r¿²4õG]£¹`Z—;ûõµº4 ƒSàÿ–Èë5´\ø~4øE+± Àý¶žÆ`0¹àͪ>,(ÉÀär¿ üÂãDó\DTP¼PÏ«ïZæÜÙKsf¹þìöt¯­ÕXÐrá[ϸwÕv”gk•™>+³mcÌ6•™Ú¿]`våœü"ÃàôJÑP“j,V 4gK‚!-L-¾#¥Œw¹¿˜yÜ™÷¸ï•”_йLãT·^æ‰)LîJÿÑà¬flGÄÈo½ú Z.|2ýÏ ±2ØvóêGzl¼k,h¹ðmçqâÕ³ÐXÐráçQãV¼áˆÙq½ÀB­± å£© ?k¨²ÉE¼ŒÙ Z.hz4´\Ф± å‚&…óåX1,||NÌŒ„jÒôí7IÈ>yZ²Ï-ÖXøcr¡òKøÖýòÎ)È#m×ÝŸZ4§îîW<ÐCLÂÓîãðúpÂøŽLcá;YbJ_ž“CíîA†£Â;_•1ó%8^Òe>Ÿêù¡ë©¹)ÖÐdèr·ï ±ðLjbÁ‰ÎÓ¾C,ô—à.LI‘=º“7g_ð<æc,8{Ÿ*)fzÄ,…¿Ž…»j¾(ÈuŸ¿ï_y_"²ùõ- BÓ©1J<ÑXø­ŠW™u™àbg¸ÎàÂϨèôVMj³céñ ûÙ3\ÊJ½ç•¬–FãÏY÷–…[U$7Ùa0šÖÉ`ÄI(Rq“0ÑQ7CoåcdvYÉâæ.pb¸‘ $ÂkGË¢&µ‡S¸4vÇ#º+f[&Ÿ°¸æˆyÓÙv+Hr¸ªÈM1g½â8ÄÊ׬ÆŸ±l†&õønà­åCA4~%ÅæìÅZúqážÞ†âEÚÎ OAâ½\H¸3(€ÿLéÝêé߸`a«À¿8èÄ%L„9ω(³Iç`­D¶ó0]‡‚y8È°˜€ð#]'1ªÆ¯CÔ˜ *3,Ð4Ç+ÖØí}ÆœÀßöŠ…pîV¯iT^Ù)r¡>cIÄêø[˜©E-¦ivm@Aå‚8°õ“->ÛáX%–@.Øb2ƒÆÂo¤”rSã2,X+¸»„l°à‰´/\y±œ\çV;¹`ò½å¥ØaÁa¼=È~ÆNçœXÊŠñæŠéÝÈ…µŠŒ7ä&µ5\ˆÔ €K锢Fʹð¬³;Šýq W ¥âu7XÀG—r¡?h,ü27R17Xƒ“öÕÊNÖrý U‹üLIÑ7 -¶§³Óa`DÉ€› ßãºI@»öZÈy„ÔÍ\a;“jM Z¿~EÈÏqÞ UÈÚx$£·ó:ú3ÎÂè°Ée=p-qœâB'ESø[™<%,hÐ]è•ÆÂ/¢ÞH±o:i{j;©32Ûúg®šË31CtHSn;Ú)†ô³ãÄ°{‘Ë3:oÈEØ5};^Ã5ŽŸÖ‹Ó[1°CzÂ(âûZ1Þ«ÇáP{1R,Óo7Î?ÃPî,©ÌUèíPüÜؽe\Ð[Ñiðd":)…ê­°\˜³¤ÕXø­ÆÃú5…ÿM[»5w£]ãâk‡¥l4ÛW…ß…Þ×X8ÂÂào,4~«ƒõWÈ…á_bÁݽ…ßIC½Šÿ>Š¾i[ô°¾—64FÑø‰·Ú¯­»KúÖXФIcA“&Mš44iº‹…¦o5iúãÔ7ˆÙõJ“¦¿K>bA“&Måx©&MšRÏÑF“&Mš4iÒ¤I“&Mš4iÒ¤I“&Mÿ–H™×yÿy£~šþ4ÙÛ¤ñ»X¿ Mš.ºûh,húãr¡˜Ók­ 44ýy¹€¹”å¦v¹&MU.\µ\ФIËMš8ŠÙÌܬÓrA“Ö‘¸OÕÔXÐô·‰ÔMUÌ]ÓÔD¿ Mž\Þ-O“¦¿N™Æ‚&M š4i,hÒ¤± I“Æ‚&M š4} Kt¼ÿïïEËÂEŒ#š›ÆÐ_¯“aãŸ÷b¨tnÖýþ}ÓõcT§ÙíÙ„Ö‡ìm»×ì ±pt¼8æù£Îa*9—S$$4uÈohðS#²†´Ér3cƒÌÙ/L6þàúxvQß0¨ëï[€»vMWlÉ©43khSæ|ÊžvJ—¦¢4;ü2ûë8,‚…ÚaßÀByÆò°*ŽwÌgÎsVY™?› GÔGOiûzwöÍ®3 Ÿõ\žº¹Èš®Ù—Ì{, ÝÍIù¬`¡œ7Ù5EG±°^Ø~fO)Mß‚œ.O‹y6=ºbfØ&¹î_ÅBKYå¥Ã»±KÑzsîh‘C§˜³ ÂEvRîHC‚[ 1×Ò§aå«pÁãÆî÷€é­YÁÂo£¾Å¬¹›mï8ZGúeˬßáòa3ïÙlàÇæU,äëê?®Ò«Ì2*âfý`å®~ÜXØ‚ ‘O7XheWq¸®ƒUS -9¤òù¥›;ƒ…¶šý\á¤bÅBæ›·XpV,ô;ô¿ ³ lx™Aý­¨rúw¤ÿ!úŽöcMÍ0íü¢A&ž²Ú1 —ä&2YŸ›¾oFÈ5aæ•EÁ•ª˜ ”ó¾m§Kˆ*¤žR¹Æ±\ÜßàéŒNSn„K3,xs^¶XÈfw1%ò9±n°w ’Uˆœ…‰6q]€d›tø`º.ȯ pfœï0†ë/wj¾b!d=eëÙô;Loæ³çt‘¢wÑ%°’éÏÁµ~=h]´~aYE§3¹eÀT«y6vvlj\¸ÒNKÕ\D·ÎŸ¾õ©ØŒääí¦.2zŠƒp,8¾ ƒí±à<]˜{*â=hl>˜«ùèwÈ…Œ¯‡î5»¡f.ÈÅFêŸÃBÂñš‰˜j6û«íÏ]ê„ÌvnføÑèðÚ€`¤¶\…]¦+ÆÙÊ£ŒáÏ° Ê…ˆªPX͈¢[gV_Üø‘ÊÞíF¬êÈ^èF6÷‘ 8!¢9?³®ßþ;°Ðpå4b •E<Èy Ù|aX  ªF5p¸€žk¯Z{Iyï®\0­ªª\á9š*šhTX7é§Åü R.PTçöÍnµ}brÁbo£L´KéwèHŒ1‚9)0DðT7€Y<…ŽqRÍ?ý€aöcÆÃã¸u¤½ɘùæD&™Ì—ñ\àäWüÄ6µPûê€óIKào.²¹À„ä1¨O5c^³y`rŒ­,Ò8øm:R\Ù#KÆe|72Žãs:RÏ—ÞšïQ%pÎÀù± ÞËà„hÈ éܱß,i€™vX¨ä„;Š3Êó– ™‰íµ -£ÂÐŒô+t¤9k‘ÿAAwé±yg¯øP.H©’:’í ¹ƒúµÑ‘nä‚#"wUN”û˜8l"/KøÞ[µÆä" Ölç: `÷ý¹\ÈŽåBíû"T½šc{ba,¤\ @Ì;íHú%rÁ÷ t„:4:ù>û—°œä1,PŽ¤¶³*l¾Ýeø°žÈÂ…@«oöSq -š-Î̾ó°Å‚á³Ð{ oû‘È€Ô‚mBÚ§äBÒ¥Šš‘~‡½šEáREi¨ºôƒ;[G‡X¨¤O5¡šõ©®rå üÒfÈJ[¹PÎ&Á+ÀZ¿ö®\Ýé…~Þbí Ÿr=Æd„äÚ.Óé¶XÀP½I»›ù ¹ÔÆ Kõ;?ÒêLBÅkݶ3è]9Zi/T³Ù^UNÓÏÖ‘`M‹Wî'íݘ‚C,¤b¯ÍŸÍÆä{m -b;®[н´­\p0õ:føy·Q»9¨½ ®Ð ¸u× ÂlÜÍk,hÒ„´›i,hÒtÅèŸÿ ÓZêëJⳆûø û$Þ§üǺ!‹ÆÂçݶí:™á|µT»5׋ωˆ‹½'NªXèÇJ¡¯cS#ÕÜ•:^¬ª¶¿ 4¦GÐQµº»Š ‘ý¤njž]tlꯤ #ö3VFkž}ë ±°nôå‹É’Îç`á¹ ”,x¯í×kú!dƒ\ð ̽Ï;/fëÿÀÂËôIXßÅ‚– ¿’X°jÃB’› -¤÷±0¸Z½¡›°Z` XǹY¦Es"ºF‘à‡™Çu$øŤÁ¥e^¯‘;”xíRÃõì .ejÔeEá²È꾄ãÑFG²-¼cM­iÃíÄͿÑ.Sí‚ÏÁÓs‹É€í²NÙÉÂÁ…óÙ͘f4 'Á†Ë£‘-ôH•5âÃð&§Þ Ò[×? „—n50y <ݹ™}–dS^ínö1Õ3tŒÓf_æŒfÐ’À€…n. -VÖ¥Áü‚lÆê[¬ªX0›…ov´vMPÀ«rfZ`ÕÇNÁBX°ä |øn¾š"ÉL(å-rÍÇd‡Ã]šÒG«› 4݆óg¿¼òùû0OÀ1ñ$Ÿæ2¹P²{aÄw Ÿ}xš˜³[fº¢ÞĂͪÿ°Üý¨²€†§t$jõŽæŒUŽÚÂo±*cK«Sî`õÕš²QF÷Pø`†L4ö‘?‡|—bd¡µð¼y6íkŸÌ]+Ê¥ÆF¹¿bt3Ȧ>ÀÊÂ}7"‰NhA˜/:V³¬‹¿ˆÍ¦‹bj]uX[š0”ðrf×ÉEnïMüK‘E´ -Ú@+€7\.þœkÛ`i˜ƒ6¼%È„ÅÜfßiú)Xph±•++fG­h5ÙëŽ$ä>,·4òô™šU:¥ÕV*Y¼ÛbæH^an[ª±V “ .[U „¥ÇuµLI™¦¢¼p³bÁæ™C8ÐÂ2žµ°jÉÊ·*^+ƒ=jؤÜ^€)b@¬Ñ|€uÊŠ– bÁeuB( ¨\àZeÕˆIÇÄ©ËVú`ƒ¯ Óÿt¹Ð¼$Z¿h@5ž¯g{bÓš×î\$›êìåì7)Û%k¹VFó¥¹\È9s¥Ò:¥b -oBÚËŠqfßøTé[y3£óMõKp:NåZqnlŠ_ÌDÏÇ)g2%[­ŒGÉeÐ@º¢<|&UL fòg§'-±ò‡¦EÞÆ^ÈnëÆÝ÷#eÀÙ *‡qí(Ÿ.µ‹ú9bÁF ÓU«„é¬õè–dõ#Y 5I,ð¿–”±fZÓÓ8ƒç!¾b;VFïXSÛ´«DµÿÓË*>€Õø²W?’˜r¶¦øãìD™Šq0°]“ŽÎä@j‘x"¼àFrt'>Ý;¦—¦o*ÌÉ~ Ñœô… \,¬Ž–ÏÊ6)ÝbSp¨+ć¹ì±@åÂ1ª¹Ë¹Ä™Y`»‰tYÍPçØRÅ—[w10Ý\­3Ô4›:Ï^Š)ß`!ç7ˆÊ -Ó’ra*â©ç*b^!ŸnæiîúYß]ãÑý…ÐxcÁöM¬Ätv#d´(QI‘õòÚlbµ_ÎèX\p$˜–—<¥x­TÏ0|Ö)MÙ_¸€©Š¹Î™X†ã2[ †EØö¸Šo|ÅCd¢YNå‚íÏ–=¢>¶Á‚ ׊úgÐ`VvÈ°`Ê‚T«Rå‚íûºÀ¥=–ýûûÎfá‚b<‰üsE•ïÖuÉVïªMG¨ØÓ\¨¤Íéq[—fQƒÞ6«^héÑŠ^ hDÇ‘UܵJ'“Ç/j%‡¦0mm†QxÏÝc¡dÏB›8Ü•¹ Ÿ -+Š\;Vy¼o2ÞôÓ¨-±#Çuô¬*z# ø å`åå(—¨|#挅\‹ºçì{+\¶A­no¦À ƒ€ÿ+†Y—òâD‹ü)XÈø4PW§Criîù²u“#d¥˜(ÂBœm9wè7ðü=Zvq>UÞ¶Å)зD-û’n5€K€*°$ç@¯›}þ^:Æ‚ãÓå3g¦âRÌf]g~ÌŠÎú Y—4±ÎJL¬¯u„ÐÖàCä$µüÄ¥äè,‹Uå®.¬ªPöBàá/C.®fßMšbuí[0fç«SÇÅÛÀÐ9UŠ€eÖ9r¿Á…G’ù8 ôP%¹ '„.ÜÄ‚{uRóÊ’ÂgŒSl’l~5öVÓÇBOw`ÅdxÇDWQ¾t¸Ïu´KškàP«•‡Ö,bæ5ͱ|{D• „C¶Pç–YcC&P duÈ®-n›—n* ¬›—È¥>)¶žûŠÞÐÎW§iðœŽrj˜5è”k˜Ñp |úŒðóBõ)Tk4³mœCQµYò˜í¾¦n%ÚÀÍdÕórïÒÒÞ(ÝEsÌ_Õ·jÍ:{;ÄVW#í2¡³Íº‰UÁæ züOzg„ƒtô¶¡!Y†™Öœ^mzí ~GÊépûMðCëÐ1Õ^¢Äç´v˦<²Yô¢É(†Ø¯ýb,õ¤ÑííéüƒV<¤¦¿……Ï"5TG‚jÒX¸J¹ IÓ_ÅB¦`AgŽiúËXpòÕ£»D¡~ßšþ,4iú¿©' š4]1ÏÅÕXФéúJsžc,,V–•!†I ÝøÇzh9üŸsiF³)ë'K†õQ=}dnQòVç8)5ƒý ú`­0‚›¶õ‡bÎu´>!jŸ'øÜ ´±ÀxÛ³ö ØîöÚ6ï†Etó[¶|¨vdÔôÿ“ŽváºæDu}a+éæ5-J4Xs¢§wò¤\ØgF_ÖÎsXHç"5ZÚàÕd ÉÍ'a!/¢{¸L1üÃ|2ümtMÃ…ê·±à¼s™£]Ãß‹šgªë@Ë‚ë^YgÌyöëµVXL I0¶Ÿ5óA”å!”æá ù§aá.™ï,ÔÕ«åù>*-¾üÂ5S`Ós-ÇnnBDz N3wQˆªŽY:5Ms7|ß73÷¹ÐÇÉœÙõÅÆ‚ˆ…Öš]›¥¤‡FéôFÛ‡éªoF°°£Ñ˜®ö%e ì+I/,‰b¡åÍ -í4åI½‘^R*ÆnŽ–®a¹ÊaÀ™àLÃã¿ÄJ÷ÃÎ\ÜÙؘ½Í®dÿƒßÔÑqDÇK­\èËÈÝVÏñLqÜ‘‡ñçPË…oˆŒÆ”eÐœ{ž*™`X%³êÙ¤E¿°€M[Œ÷Ï`ÁƈLø ‰Æµ­ZþÈÅbšºãøV£ô^NyÒPáÖU"~Í. qŸ¶ÀÓh†ÌGiì컣¸gÌHèhx(‹†uiçqÓèfŸW¥GoÆHçÊõ®Ì§â‘Ö‡ydrôçy¡sÌl 5ÍM¥ø Á¶tp);ÓOÆæÁb_ÍZcá»a.ñqéHíÂÀÚDX=¢ç~$Z|‚ñ{pµOŠç`aªÍ¹«ò«´1w² -±¨PWG.Í&|ù]!ÄLèÏn”»”)ÓÙ÷Ý4§é#ìŠ.ÙÜÅ ôŸ©›Íhj5>pø`ÁÏIÜÓšh†“Ž¢Í…{¹yFË5©óÛÙ¸;›2V†'] ê :º‹£#Ôª(7+‰Õ0 Tq9Σ¢ M‰g–Hå,[cÀÑP5ÕXøfXàÊw?¤uÓÑìc—–£h™ñ‹ÖphÕ4UÕaÆîZXë{Á½^W,pÛÙbb†®‹!+rC§%[x×”ŠÔÉÄÖëéb¾b¡¢¬ÕãUÓ9eQj/ôÅl_Ÿ2~Ü1ßÍåd¹n†TX¸I±˜&ŸQSéŠE<øè4á“æÁˆë’`\èä…Ÿ ²µ¦YC¤ñ2²I´^ ³„4ÿ}3Û™­ÈT è -ä¢Öbò<õ‘üYP…XŸÆB´ÃµEb<]ŽÃÙWœóóÔÓà»”WejXšpɘ´èW,ô3Z±²W˜PÖ6h/z/Z~"çÆûyÓe|zòͰЬ~$š¡LŠ®ó[x^œ‹±á2aŠ\ˆø䈘‡•¡ì1?Óãb$T -ä ß 9WNÌ$„64:—caðýt0lÃbäŽ| °Ò'92xÈë¸H¾¨ê2>ÖÞbi’´ÂÄ‚áê&WF–I‘ºÊQÅˆÖ Ϻ/ÃMA©b·çÄ…9çÜ®XØè=êH~¶Éýæ>UQà,vè™-®!~–óüÎ.ÂG¶à¸1Ú§úå‚Ë8¹ÇLüÙ®ØÔvë/èÓ'È…TJ¸÷¶°ûÈ,Ý‚aYX¦hì|–—†l'±°ÁQ@[A‘ºÊêM×bžq„…­\ ÷Nfç7É𳾣ó{4Õ\KÙt¼õ­^¨í\P¡²3Zô˜“‹’5¶Æ·ĂɖÌrë8bß,¥±¬F—è1ñq¹æ²†a:a¼Ãhô¦u‰/ª\(™\XøÒk¬XpÓ¥†+«r0T¹}Æ€ Ù=/¦¢Í‚ØsûÈþ Ýa…ùzë‰ù銪óŒ)0¸Í¦´ Ÿ–ªéí=]¾A9t¤Ÿ4.…jîœvÀŒú«U4Æàd¬"°Ÿ„èq!¤¾“ËY/ 76XàU[Xí!Ñ'1WC€ÅÈŠ…ddy[(:» 3êSlVê,äB®>ÍÅ7‘ËéŒãBš+ãÕÆÄfÌöÏV)d6‚?õë<âë@S i)ÖšŸÝÛ ž ÛAÓ÷ÃÂb¢\Ÿ‹ X;bž³ŒçµÂ°ÂDL¹ªÿ®&óÑÙ†ðXíj«£>UÚ)/;¦µ'¬´‹ð#qi†;x³ß²ÇQ°@‡§%+˜{ç¾\¨ÔŒhî|êy¢ê¡±Ž>Š -~¹Š…†‰¦ìºøóÀîWÈ2“(Ø ^Ž,gåÀy³…oE"_¬7q®K„’ˆ*·ò([ƹUöØw¦q-A@"ï},”sçaÝ;¿n‰a"_ìäÂœ÷ýàÎ sâ/YX˜kB"ÊQ+.%LÅlý„•†[œ‹ëŒT.ôÙlã”Ðj`¹tÑV.$³JS|äÓ¾"Ô— R'á£`ù"$cØ­I§&›6‹V}›ÌX¨2š‹”£c…ó»’^ #±ôþÂo¥ÇXðØNtF»…`ŸsÙ+ -6­™} —ôó>ÝUÆýÙG‰S¥ætO ÛÝXT_Éé2bá£Àƒ³Ê«¬[Ï°°Ýks¨+Mi’Q$ø¶Å:zÛ/(CWŸªOûîÐp­ˆõã©úX8ŸË¶o1A§éx¤¿„£B1à~ndÑH‰ÆèñÌt#Ô»K7í×ÌàĨ²Ñv^*3£ÚHç;QfV6ÛNpø?0^ešì§°1qß8ÅßúÈukPó5‚!YîDʚñ[^Š 9í«–ºîZÁ+¤Kú¨r®Êè=paöJEäBjKÙñÍ°è;Ô›º‚¦ˆÒÍŸ]–:)tñwMZ.P+£é§`Á)Ö$ ÑôP“¦¿ˆ…^­<írÑôÙd\úk;¬[Çýоt= †¯Á‚&Mÿ–H—]¯®ï)j¹ûÒ}gj,hú d¡*2,¼X´úr\/BcAÓÏ"‡J ÓåUo¥yزþ], QÒ4¢é¹ZAøÔFé}Ùf;þYÓq®-;â°¶Ìv™{DsËï&—úéU,œpËÏÒÃ2]ïa6•šeâ¼ûD]–>¸I¶OÛ{³ÇËŠl*Û$<½€>„…“ê´ÓõW“훌o˲+Ì—>#ös²Ðv‹"c_¿]uÿ4rí¤Èr·b«dâbpPQ´Ÿ„…Øœ}7 -Ó¤`ý3›'°P>6pŒb¯÷%ü†³ouÙ¤L¿£‡XoÎ"ÝYwbþÕ”°hiøâ}Œ ËF^õ%š³Â/ -û–bxÑÑ6iX%Ìâg –<Ó5¡| 0¶‡FX:À3r!Œ…þÆ»­/VßH6ÒÍ’óŸææX/:4ý,ÊXÖ‰ ìÝcyψ§Q>BG¢ -¡#÷­C³¯\®[˜¸’Š\ƒÅ?hZˆ,¯Q[Ål¶(T -ß´€•%O’bö¶ç7À²™œë]YkòØ<¡ÉmfRÓj\y7wnЯ°ÐP—€Å‘õ´Xá§f(x0–Yx=Ið¢pU‚ŠÚ”ÖWݪ(:‹(pß.°ªéû“#s(CÉá*x‡z£Ê:ô¤äkûLz‚°l[ÿÀ¬<°0*UÄÄÏV¢1Y3X˜^´usÑŒz—•£¡ -X/G!kœ±<ìõ“. V˜¡×/W‡çÅ5T¤ùÆÎ^g–šãGÊgm$Ìbq€kkú¹r­8ãßv¶bÁ]åB…šI–g*âÂú‚£¸~ ¼J+Ë„O˜T±×|igf¹]5UÓ4YÑ2E^Oà‡°ås…?sd–°Îs¥‹v6HgV=©‘)¡«AP`5k5L3Ùpí¯çeŽx%IM¿“ ©#Q- Ç”Å ­JP×cZB±VÚ*ƒ¹ -í~xV.p“›Ý(a' ¾,äb0‡ ]§™kŸ—öÂu½•Ü±ÌéÖú\ÔÔ®BÅzQ®—ê4Ýžba ‘ìk\,ZÒ 7æE.h,ü^š¸k$c‰½À‹Ó­½à²YP‰‚+´{㨤ê$7¡ -ž°q_îN´¼Y\FQ@¯çZò2)¸ðqP¸¬ê–!`¸uäRÉsÙýT.¸K õº›Æ¡ºß†ˆy²BóvsMߟzSøT “/nä/ fÑŠ&4ŒÀeµT¹0sEÐÛçcu­÷Å]ʯ!¥8PÏÓ÷%²þÖ^À€?ÒPn?·+DçdÄuøI˜U#+åuí=:Q,5FpW^—lùÕ”¾íiä"êæáb+d¡Û>Jî÷ùÊŽ¯‰úÓ´“Ó¦šWZ€xò©iƒî g•Õ³ÖX¼ n‚»™¼¾gµÆø)´Ø:¿œô¢}>sê[›”‰" ŠnÖù¿^0ïôå6òFìØþaÌÚq Fe]çRì¤uCµ¥pôagd¼$W™Ñÿ.E¬]™Éûˆ{®ü9ÍLK`=Êq“ˆm.Û.-0iÚngZÙTv‘·ëLÖ -Ýq-Z3Ç1øNôPÁ”"­!ýr2üw–»,a8dûŒÖŠA±Xð‡½·µÌRç§(ñt·g©Æþ@šw†îÇÛ#ýK³Öôã)ªÆ×/ªFèEmãíá…1@XšþçŸÚ-©.Ý«éË)[í|#%ÛÓXÐôå䬽 ¿Q.Xèë\M_Nî7 ×~˜ô7£é :EX“ ßN,hÒô¿ák± I“"´XФ‰ --4ib‚A‹Mš¨`ÐbA“&&´XФ É)t˜&MH½£C;5iÒ¤I“&Mš4iÒ¤I“&Mš4iÒ¤I“&Mš4iÒ¤I“&M׫㥚4iJ=Çœ5iÒdš³_hÒôçÉG,¸¶¡IÓ'ÛE,4ý¤IÓ§±¡X ‹&MœˆÆ‚&M š4i,hÒ¤± I“Æ‚&M š4i,hÒ¤± I“Æ‚&M š4i,hÒ¤± I“Æ‚&M š4i,hÒ¤± I“Æ‚&M š4i,hÒô3±#ýÀ‡êÄ5}C,L-R<_±Ÿ³Þ3Üwrf|^CŸí°Äô¦ø£ˆú¤‰iú‘X@.²4J€,ü'Jásdªx¨à;àÀ*j`ÁâgZµÂ?±Ýäôð-ÑÃuÐL"'¾'›Z#·¬<ÚÌÛK/QmY¥ý·ÆCSŸÌJN 'FÑö?¢¡ Ííÿ mœ&VütÙðU”Xå01 (QÈiò 1œIY4Ï7X°.Þ#*a‘OÒ¸=刨JJ8ïpâU4´¯c¡ -Î*MÚ.ÿ×â K@ÒØZMût,Ä­cYÑ-?q®BMܸ]c;‰è%iýè™^½ÅBU^4·çpŽ§ÔJ.ééÄTßâ—±ðĬØÄJ ^Ìÿ‚„Dlek-é³±€kë)8ªà†ãÁâXH"ò †š‚'¹.·ÒžŽ§ÒŠÒ{W¦‘¼¨Ç<*|r+üz0´t ,CcᓱÒ6¹x -ã¥BPÓíyJÅ“r!}C.ðû'Þ âŽ*s”X<•[“ü50¼‚ -6ï«Á_.¥¥åÂçbõ£<]jpbQBo‰d+jÄ7öÇBù ¹wW.œ¨å*Oßò\[&:ñœ¹¥ê:R ïb]È{XØšã'3ƒñ¿X2L^•ã÷Rj¹ð¹XˆÛÐ*SEäWKäEøK¹Âd†O” ež×7ò< -Ö%$“³½ I-Á“Þ%—NUôòTU]®Ÿ½Æ¬ ^ÞT‡d%¹¢Rz_Í“-_»´\ød,´ix U¡;I¸¡48š¦ Aûoì…4iê%¸Æ#r¬EÅâdóÛ#×Z‰gØ0eBÿ[ì°¶Öç*«W. ©•ÛÎ¥QmUµDCš×_ºÝr!«åÂçb¤Ò“šoN›àÜÏ*¡Aí@EGú \ð¬´GVþµñ`OKnw›)ªS±ð'!F]Ä«M_Ÿ¬Î_p&­r! ÆÃmÛa^ER4|­–´bAË…OĬ­‚a`Ù vx'4'O剺*ráƒö‚g]ŽÀ@ †½|ùëÅ“Q VL‚éöò‰„Rn\*§} ©uþX°J8‰@)¼—¯ ÈÐráŸ`¡Ík±è×–q| 1jÁSé†g?Ï^H±À¦¸Dµ¸½Š9qŒxIykÑŠý×Ê…ûo—ZJÌê+¹RË…°›¥Æا[»’§¼ÍʬêH³¼;XX&!TPt âêxÛwQ2Äg¾Ga›/0ë³X€÷Rq¡úøh¹ðͱ v´ìödŽTö¯‘ Ô¦ ÄúëL{É»£¬·Bv¤VÚ¾Žëê×–bø/U’´\øX€ïÒ;ñWžð”º2ÿ{{áF“SÖ_!Ò63º5‡øÊÖ5y  ­­ÿÁ­ªåÂçca5œð¢²ý”Vë*üy~¤ô„*§\Þ Ç^^ß¹”Ôõ#EêžéĉÔÞîçq,üOOy^Åéç'?)t{Ék§ÿ",´+ÆÂ/%Hš×òÔÏÛ_x€ÅX®¿y"¶„¨Âh¿;óNù#¾»ó¼Ž¤¼–êXQCGXl‹¾óvLîçÛáé?Û^àÒÛ¨ ²b¡=K´‹'Òò‘ð®g ®fê¡OŸÈ¯ÃÓXˆcéf©ùÇ9xi5Reÿ*{NvÍj»ž `=ó ¥ç½ªÏëH+Ô`®Á(1!ŠoW[I^ÓitTÜ.F¨ËÍíÒYö;ý¶¸“»¬ú«1ÜŒD§ÄÝw>gŸÜ˜ŸNSHgjÕ‘1µ ­So螨ìá¾(x³F|«#ý[{A^~YwÅ’ ¢¢½'Qª$O0¾Ê}C.<Æ‚TÞlóvr"ŒhÉ£€E>Qü™' FípIðô’ž”J’l³‘Hä·6 Wm+#Òì,¦¸5")¢ËW@ÑX§üÝ:.Àcªµ@çÑ/¹v¦?†édÙÅV§±0:)T¾›/” õ-RKˆŠ;qY9ðDš:¯Û OèHžåÈ…¸u€£‹íKC/°ð @1ŒeE4pM¸`6’âàó'¥í"ÒŠ/e›“v‰,xÝÊ}S/ÈqkþFãbPNa9™ì„grÁ$ƒ¼Š~…žô,âE„þ?ã|—(r†i³1ýeöÂ2I¹ ¿öÉ©žÚGã1äó÷Úð]çµÐ2w+)†€ä‡IF^YõM¶]k×Vy”œW& -ËûmÎÙ`1˜”77NÓÜÊ÷wå¾r­ÄVb•™ø/ÉéµÒ9Þ’Ûü…ä‹íÅ´îxIH>s{ބˉw¸œìRBöh¨“ÝêççÞYÕª­a›Ô q\VÇÙMž—ìsð&& õf`ï…í˜_i÷=ääS¦ù¢ý…5†O‰%¹ŒS²JûÑðÂ^›0£‹«5Öeö(çé}È­ ç¸9Ý ¤r!U?a¤È…xº$·¿³L;Ú¡XÈeüÁåážÍ¯Ä‚·Þ+k'XøÇû Â6H“\>×äXkÎV¼h?ië÷iIÊEúXÖNÄÚÌS£Ð‰Tçk6ÆVäıˆl)ÀIpztñöñÁ©(ŠDÚ]ÀKàH# -Ì£Dr~ÀGªsuÑÓ\ˆ¾ÑÄ“¾»:þX,på{ü&Ó$_c/HÕ`“Û¦( ð%[ujÇä3vŠžÅB,;Ó9–¦¾çÕUR—)¦Fk®™Q˜R1©&¸ÜÖ ¤¡ã„ ¸È`yùÖÚ J¬ÄjØk*‹VFóc·Iׇ -K½9 –‹”_ê‚/äB”Ñ;q8C ºú[~$¹¨¿²%ûÿÈ…É© ØƆŒ7‡õ´Ì­ªŽœ{KŸª#ÅÓ´2^´‰e_µÏ ©¥åD&£¬|SkõÝI³ÃË­”eRÑz˜Nb]ö¢Û†!–û ü†G¶¶0©ŠŒ‰´è8 ¸q°¶rĻԈ-tnç÷caœ”Þݬúöº'xËsj⿇+/à!´—éKå­#éÔkâÜÆÔ\#hƒä¢:Þâ‰Øu-¡Óº2J‡•'Ÿñ#]z¬œºû‹83@ùŠÇ&.ecQ[—½IßÆ·Þa©ìûɸåî@‰²Èx¤]}¤uè®—m6® »ß˜ÅÓj2Ã2ÃRã–ØÑo©Aö4*éF"– ÿÊ^`ëïªdï6Xãh­[ l,E ê“(Þƒƒ¢#YipC%µn-0„W6ÚxH'ÎÚßz²ù¶ˆ’:±×xKÛ<k““8U©J¦y²L·t®(ëI«`¡J‰"–¿……5”Æû¸Žôa¹ŽíÙa^IÇû­ôˆá)òƒº— çe‘Ÿ“ /Ž³¡$©£(ðÒµ@RµñT®Å=ŽüsÒ6X£6b®Ú­((2¨µ¹aa#d´âa.ŠÄTnV¹°ý^~ ½Ž…pz Ÿ”Zµî Ía°‡/k¹‰“Ž•ÍòŽ <‚1X/£A­tL›­T.vÊ'+{l -…h¶°Ü±6¬Ž±ú%ËÌ f9¹ç+YÒ*Þö%þ,x÷B,¿X.xùa¢:/7õ‘ŽÚTŒv8 w°"ûÖL/µål_u[º ;ò¼<öB‰4í•ccžF‚ªüt»ÜÀK {ã -=” rq+­Cu_e/DÊï—Ä\|,|°žª÷pýõ+%Ç&ÅÒbùGpU&±ÂøßÔôÒ,è}²¹àbÞna_«`Ô&é-ºŸkÑ3ºÉQ8– m½ŠÞ3Çá·®„Ù–í_ÆBú XH¾¬žjZÞ”°TØe2¨y‰‡´¬¢— -Ã?‡…4½ª[ŒuŠíc­ƒVºÛ`¼} b»í‘#5ëH.¬›gßç$\I€Ð*þÉ¿Ì^°>­žêÃ:ÛÕ½rÙÈ~FZƒe›—·Á¡^¼’$¯`Ḵ+]\ñf‘ÑÞËì<˜ïÔŽå-ñUx‰•§t»ðîWw$&Ç -¼mXû¥Â3>¤Õ.÷NÔ*íGúì…K0hÒGýölÖ.(-xðòW6RW,ðxFeÈ -­IVE©¿b–#\§ØHó&÷vXX÷Õ+kš%2´wÆ>” âûˆn‚Ü ­]V¬” ÊÆߟĂ”Iù :Ò¿é¿€M².À–÷”– ºh¯-eEÁŠÛé˜Ú›ý…ºÁèö‡Æ×åž[I‘<ÜŸ³´¤MåÄÖ°„¡†bÓ¼À³gLgÛ#‡rAÔ§IëêÄûæMºÍŠ•ránnàÀ‚L_Hrò¿Ë…ã²î¸­•TÕKmÑ(Â2®SPÒƒÛ+oÿˆ75Iy3Ã`€ -ÃUî4ªrû!ÿ # /t£ì{Ü—ðn’&YŒ›"ÿÖÙná±\Èåõñš5’EÈ…ûõ~?Vwô ¥ƒþÕþÂYuwt(:/oc´ÐdÃ)#§©Foâ‘6ÍlIZkêƒîT0 #d Àõe°i‘²Á]˜vIJw ëо}úC¹°ÆƦ§ä ü]H¹ð[b´ßÅÂ$ƒ#ßJ|ÅdE?eß97ö…ݱ< +¢òV ¨BvdÉ”H9EÌ =B–}+nS1s%wò>bšÉ_Õ9Ao½ÃX@0ÜìbÑ‘¼²°‹éc¹ ŸpDÈÜ!Ò?ŽùFŸv"Üëù,ˆx¤”ìÕxtÄ|(tÃBs‘i)óa”òÜ[:À¸›–H‰Ô> ódžj²tƒ/Î;,,˜¥|»öæ!ì²öäšnúD»/q]+±Pþq,ˆb Ï‰–ï;^Öíé!Œ“§óÏáù  :ܸ€õv1Hû@–tO"¨­C,`¥0°Í­¨LÓÛ¬ýüѾ³"‚ò>Q¥åÂŽ›d2OýL2@'b©khŒôFIü¤¡¾Ç»rÁH1xÌã9yJúKˆ?¦#1u¦¼Þ©vÀCap)±\Æy{NÜÉ1Øþy@`—t¿A’å/¨rA–LëU"…A˹ª ƒá©ª,zS¹_/]à³û¸ÜíÆÞÛr8¼ÂàéÉææVéaàËÛrÖ9£î™‡4R' -,:oÀ¡ÿ¶‘•ç;¯&ƒw“‹¦TÇ@ƒƒ{ÀR¿leWâTÛ³M‰ÅÁìíD­›¡Ö;ŽG¶ sz@ûü…?/лx¹<»Õ²¦„*¥$‹s>»;+=ˆ“ß^˜ž•ûybŽƒÍ*ònþ If~œï,[µÝVNÏ -êŠ`µì?ì!¶W=8Q šwОëxßYŒûBš¢– 7JÒMâ쉊tSIaÍ*|Pgmµ˜¶ä}{¡•Vû£š2!^®àk?Õ»òëuóZ§ -¼Ãæ¢j¯£$_nkr¬Xؾk$u3‚DÔP3ž÷e ÆójZ.¬¯Oô_x¼–¬ácje±•—ïo0(ÝÃ7õåÞ— R¿{ØWïñZ›gjÂÈÆ 7ûkœW^/%„§üÖ§Ó†¥·© YJ‘y¦Ö -8” éÃ>E1aÙýZ.{w¼ÛÊU'bÁ»M´Œ•ª÷ †6¬ŽÊó|D.ÈÊ¢©Ä™Ï×E|¦VÊÔô0V£ª£uR-¦]CÂè¨Ð;ú„½­Šwf/ˆ2ÞY¡¯ØŽš!׶Z.œ+>X]öC]ŽÊ²¬}ÜîÚ°k¹Ê­.õ¾\ùòa,˜ û'ã’Ÿª›·öSÜjþ²fÞIì§"JùàÀ¢9u55¹'R×4“㼶‡&‰\š9]çb$-5Ÿ»I «kd·º* -Ar®¥®·Ùå™|`¡Íó§Jίu'žŽ¹y®nY Hn|›·ëþvޢ؞ü¼M]ìâíª,íE¯²Œœä;¯e0 >Vz ‚(jD0¦– ËÁº~¹TáÞI2¾>M6L«~·.äáåûýéì;ƒÚ%sîe¼éÕyº‚òsõT×G?éawè'Še>ç* ^)ò0!mUC•òÇùÎkòòáW!7ZR9’– ǼYéIÝv%g[¿m¦29SLd©Ç½»ér™JöNû‹Q"Ë{¾ó“ýÔB[ës=ˆc'žuã’yÈGí‘dœ0þ]ÛYmþ~T0Dö}OW¹¡åÂá¶îEG)3q;¬nÌEËB0hä@!ðŽ}ñ 8sqç›lN½ ¬Ò{µÙù³ý¤¤dG<°ÚµòŠ±!áE=j•6ÖË —mP¥l˜•F‰}ßQï’– §Z’G«§´{/7¼¯Û$€C†ˆ¬ÈÞµ‚Š'bäë׿çÇÅ©*½H0’Ó¸) AËO–«ƒóõ~m÷YdmMw+ã?âÖd`õÛ+Šµà¡½ö0,^n®lÕ>¥/k¾>àUû -¹@“•½n,PNãÂðßxû;~³=þUX@-Iéb¤óASjÉàÔ•üúŽjZW:S9 :±1ù £ NnÕÁªVïvž>"T…EC•‡4ó'…Ö[;LÅâŒú­<Ý‹D©ó½ -Lµiö†³qYQòmàeN;Þ†cÛÂf´Ò¶°ÇVO©X¼ºž0Z—´76Tž›ŠÝ­l׳Õ¿— qÂıP¾TåX‰|ñïþƒA!åUO_€Œ$[Y -“eóÔ€ ×vaŽ¬RŠùH•]h#Œ¿ iXˆuSÖîGuï>–¿€úrklÜ]BlXl80äÁqœOÒ‘hÌzºïê´Æ|¤ub¹®ÖÉY'5o¿-»Ø²Lf¸ˆÅh”ÒÄÛ#GÙèó@îagÐ’/Q«Ã‹°ÿ'¨%‹Sê©_ HäGÄ6‹Ž;zãÅ-º´ ³sZtÉ©Ö0‹Ì˜HUtœŠLªŒ­Æ_€… 0Í}ÐIRcOlê]κ}­^"åòK”ðfÝ–•Ô‘ÒXµLn¶ >$p]Vû²zó뽕B^MoÔ„y¸\N‡ê¿Ô:SPÝZ()ŒK]1)åñSª°*ªf‰ö`4YZx6¶m|Dæ  -‹‹`]¥†•”žƒ B¬iÆ¿Gï²)ØýÏåÂdæÐÅ]Cà@á #essM_DGƾ™“ë$ì"°‘0ø·%@<' $ÿ1þ€›ó»<…å€îÔ$—è>K¦ArX#ûÃùÎ 9lì½q^•í{µ…Ÿ`‘UÕWWÔç½ÍÂ"ª­°õ®U§.èéi)Yë²ÛÕI-õä9lì×µMÕñ­lþçrTsNÄB5gø-´áœ™ª\0Ý™†ÿ€¼h|ŸÊ…fÜëYI7›U±$²Öi¢¶¬ŒÔ5³hB¦l‡<33Ú?ÔÇDÙ±|  ôƒ•¥Ç/; $Î=~¢——§_6Ò; ú°\À÷YÉñÖÖý© êνt¢ÆmyÓ.ˆ{&j£[2êŽoJ.éa¡ðºJ÷žîxƒ¶ÍVFkׇ µwjê¿– `-àªX¸>jÿS• f9›íDåE¹ÊFbGÍy®- -§¦>›3†Ãî0Á«3A›g´ÂI.”±·±€;j%"Ý1Ae;‚”ÃôKÞÖ@¡-9Àh'Œú’5Æq<&sF–m¥ÿ·±°ˆb¸+zˆ¼0µ¯ìøáåƒï–Jî44†ö7Ê‚èý.øÌC6s`3¼õôÁžŸÕZÕ}ó=`β² -×ÆÒn·ùù žlqQhÜ}û8Ê„û¶8Òч±ȱÏJvÇŸõúOö"3jS,ôî\CQ ËV.´¨$ /@MâöB»ÛwŽÛ±€vC8:~aãYtïŽà :DþË#þ¨Ou¯‹®õûߨáKF"íôµ .XÜÇ¿üvß{¯½ˆxñÄUñʸ×Mžçß<~œQOêD±ºMŸ_[¹#H®¬ïB.4ý.)n©\ VóÔ.«XÙPpÊâOÆ‚&MŸ',.R6¯]ÍÄ‚*bÀzÞö*ÆéEåÂgv`\*M5žEÀF,ä I–AÆei,húvX®@@S¹Ð"ÿvÅÐîåBkw~‹}{#„`@¹âÎô»aZ(bÀŠ9ã®{¡t£iÙjƒ š¾ ‘šFX´ å\ø ™ör!†í`±o¥\ öB3¢O,8% àªÇq´Àš£ÙO{Òƒ5€±Ópˆ54}7Bö¶'.&XÄAUšì\ˆ‰7Ï°ØãÉ46¯0;ö§#$™ý,j1Pc¦! (æ"ÉÝÙ÷À¦†ÿ5‘ÕͦcTÇG÷Ú4iúƳ9{ƒQøá„ë¿ 6„” Ä‹[fÁºî/0=Z§›q§ªÔ>†³\#Yq‹v*º‘44}_%©!Àì4ä4¶qÿ%ŽÐ†CšìÐAÈtc!Žej¨lï´vP:1Õèm”6ÝŽ‰% 0€{8ZGÒô ô"T’xÓŽ‰íƒÐ_Ø¡˜¹~ZÆÒôc£Jÿ*%„€` Ü\X˜/µ¡©´Þ&ágÇ›½M߆Æz®?‰ãÁ+3žÇк"è\ÒXÐô,†ÂøœX§É.0ÕeaÜ…Æ‚¦Ÿe1„æ'õ—ªsyîà¹O•øÑXÐôL†eø´¡Vc %O MßKMú¼‘âÕXÐtÊIOtÌ~tFü0ì1Žÿ¯ÀÈýÜ44½‰…6~ÌÉñàñÿ…ö¬Ã„³-Rª± éˆ}’."üsÞ%®.ŸŒ,»ëø¡Å¿îß)5›‹†Ö8†ãdwnk,hz :g³ÕO¼êÄ!¦º°ˆ—·Ü&qý­S1£ÿ_¦ÄmTœ4cÂTQ¢± ép{jŠ\ïlÑÇ@!ÄvUÝ“ ñÐuËôÿbaÊæÑ4 E§V\ÑXøƒ¶!ã8R?ãDÚ ~aÕ‰ñgÛÀrì{ôÀbø¿²mÍ9ìãxìYŒ#$èùì—XKÔã"˜lÖÆ-œ*" àÄ~ƒ:5¼6æWQw(­õ5ò#Óz/qM ÷ÇŒ…výˆÍcñ@ĕ׉ßMDqL0‹v¿Ï­±ðçhjÃÊÍšhh—ÉIB;É\ü9òh)Ý,q0) ±§I8W‰ëZX7*nÃÄÍÜÜn'#)æ¦6†<·c0Nƒc†fP†ÅF¤áÓDC̪4ÁéQë5Y“² £°Ê§T°0µiãâµ0™—ì §ó08õ‚Fp;ä®Ë‡ç&p ‰›Ø“œ–­÷ªÌÅòáFÞÍníLX•ËÍjç˜ÖFê6éÔ4×GcáÏBahXŒ³iLX2Ť•³€kì¢pñg°vinØÈÄÚœßò£6žX¸óÜ9c@…Ö+jm:Ý¥ã¤+z>Š‰é˜ƒßÒ²¾cû»¹…!Õ Žæg+¦Áå3#3D0içá83-öŽŸ"Û‹CÃe~Jäì`<6PQŽ!=­å³#yÞ-hX7Ê ¢±ðw¤j."ÇuÝ"cÜ‘Û¡9gK‹<®aX3K±äX ?7ŽÓÀÑ>ŸýÚq.±ËbN¼b!Îæ.7Ò ³k€»|3Í-‚5ì2ª"TDdkÚ¹—ÔY:‚oáU ˆÀ"2<˜ ÛF,Œ €3¼£E@ûwCãký¤Êó³Æ]”Ù‘|îJ#„áìέRƒÔp7öXkf.ª¬liI&…?,̹ìÛöŠE Qߎƒÿ.j{Ó‰%À.¨z8 -ë=üWÃWšw ÇÓžÖõËþ;!ÃëÃHzZ•”¦ŽÄñdÂâ lÛ ÞoÂ@‹‰%½üO`s˜C˜ fî°z’ s4á}:ÆPÌÆ•ôiç¼UbÁ%cÛâìZrEû¡|%dÈL‡P{±•Ã§}óž÷­¬$°î1h,ü5¹08á,ßÂ:L,¸ \ÐÀBŠ 8¦ZJ¹Ð£jƒ:¶9±.ú‹.MÊ÷æ 9À_n¬LoÄ óÙŠULD 0?>tø-øÀ¨ç€ý*°€¢œ.Á`û, ƒÆ¿þËÒ`ɘ×ô6÷FøÝIc1»eŸÑŽ±ð#ÑÚJpvåö( è_먉m Ï_JÂÜÍ -6 t»‰ C‚½€|AóG‰…tf 1èÐ!c˜7Yç[·–[Ás bòô1„ÍÈŠá‚»LqW`Ý% åEL61+€•.Âê¨|in%äyšp@„½ °€7ˆé¦Çí]Ù’£:  a±ÙÁ,æÿÿòêÈfé¹ó8]ÕSX/©N0Õ:‘ŽdK …ýmÒ ib¢ÙIÒ|>Ï5C;z.B*XEZ7±$‹VŠüB–}ÏçÑ}íWé±ðZÑ9Îþ¦ShýÂÈX Ÿqé°Þ€¾u ˆp [ªÒA jÝÖŒøÃ|?×6p'Õl·ä#Bò0i‚¦yÚ -5ƒf7¢m#Ä2‡í+aá<|cÎ+/,Òb¥—:«ÁÍÛb­,îR§=aLÇ#8v:†ý9Š4mS’¶z{ž>%— o…‚˜ö°Ü„GÀG%ˆ–ƒûó~aáCÖ†£ÁK°,‚²‹Ñûé´u¼0Î/ þ° ‘èÈâÚßÙ¡_ˆ¨#Ýþç””ãÎÒaap~¡$*¢E´R,Ð6çlNí*n“1Ë¥Š´c$bGK HÛü‰…Øû…7GH"fiæÈb!TÆ-àÎÕÊAË$Ößù‚ìÒÔv¥• àñ•/À„WD=O,ÈÚN7 ¯3ŽxûéÎÏ–/mN¾@Ú¤ÝÂX0äs …þr홈œW&@7Ò– ]œCþåÔnGÓt=@- ªÅÊýêQW¤õË ÜeÉcá­X K^ffYႆ °Ï1_ªöÆ‚óH*È…I…Ÿ™H ic&ä¬æ.uy¤œþöIÑghõ¥¦kc…Ó]ÝÚ @h–Ò¢´Æ#ÒÑO‘ÜiæÆ‚tšÇÂ;c¤8Ýëª*™c i¿ -Ñ®/ÔE"v¹ë šÂò¤+0€\A˜UÍÄcÉ”§1°µ¶qo£¬ q¾øáÈÁDò427Záö Äà {Y1q}-Œ¤ÒýÞ–i“pÞ3*Æ4jP²žÇ.Vg¹†¿»©#¤Ýæ´Cw¼±èFt£S’¯ ©Ðu Æ‚ÞXXû§é{,¼ sÎpE.ðß(˜G}azÓíȬ¹Ò;åD[¹¢¹Â÷Å܉nTæ¼ïHmQ´iAW’_(&j°mò&*YÉãËÍY»ÚeÐŽ2*슸hb¥$”/°É=—Ía¾WØ«=ƒÔØó©¥â Ó®süB¼Êßö‡²µ=gÀj^i+ôr6îºÚo]kôq7±>w~Ù}j§ËjÛìlÿèãÅSh ¾ôâêõ¥œúp»¿ÜÜÚK;yµuïhyíSµÆßïߧêåäŽ×DÆ‚þJž¾!½Ü~9]á±ðr,„O,ä? É7aÃN/6`®Ë JŒI`~¢–¦©‹o©á(ýyg/Öo~Äغ?z†ïÀ¨Zåû`x¹ìái Jý ZþÅÛßÉ‹—?²'/^XèI/^^.s,LýèÅËË¥ŸìŽ/^¼ìázñâ…düj«Oíendstream -endobj -5258 0 obj << -/Length 107 -/Filter /FlateDecode ->> -stream -xÚ`ŸÿÓÓÓCCC‚‚‚ÛÛÛËËËgggµµµ°°°Â£££ñññççç‹‹‹¸¸¸WWW›››!!!­­­|||“““tttììì555ùùùáááõõõêêê²²²åååÿÿÿ$<îendstream +5376 0 obj << +/D [5374 0 R /XYZ 85.039 781.388 null] +>> endobj +1298 0 obj << +/D [5374 0 R /XYZ 85.039 253.216 null] +>> endobj +5377 0 obj << +/D [5374 0 R /XYZ 85.039 218.471 null] +>> endobj +5373 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F77 4849 0 R >> +/XObject << /Im11 5348 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5380 0 obj << +/Length 3193 +/Filter /FlateDecode +>> +stream +xÚµÙrÛFò]_¡h“ +YeB ‡÷Éñ‘(Ž­¥ÄÙrô …pÐÿ~û$œ¤r”ËÆ=}MwOwÓêÔ…?ê42Ž«ãÓ0RŽŽ¢Ótsâž®açÛ% Y `¾¹99c‚Så:±ŸÞ¬z<Æñ>½Y~œ½üîÅÕÍë÷ó…Öz¦"g¾Ãhöò‡×s5»¾xùâÜògW0}qy3_¨ÙÅå· 0?]]ýˆ{óHÏnæ·7ߟ¼¾éØê 1òô¿“·îéøÿþÄut>ÂØuloN€)ÇøZæÅÉõÉ:T¼çŸò©)9&ÒÇ:Pf ¥½…å¤A€æqî…³ +á–pN¦}­f¯`ž@Z•%L[ÚZʇµºi-Þ¹Ïö<Éžò¦ÍñÌšC–¶yU2ñ¶Âûå,ê.&YÛ{¡ˆ·Zf-JÕ³öÀK !`Rg th‡Èjžú’’*dÀqËëÉ:±w¸ÙLø³ÌQëYMB“l-“Û±’ñ6k²¡±œEåâ`Z¹ ½ðBÇ Á´ë¸QH¢_#· —=Ê\íp¢˜u¼Óª±4$) +ô:màÆOÍþ;|9 *F’{9ƒÂ‹@º#±Î¬Jð¸*D‘ŒFÃõm¬i†ŸÂ”¢˜÷}Ç +í£ÚrÀ<¸rÃbƒö@à;Ôy3Ñ|iMí¬‚Çw +ƒ,çooà81z%øál6síÍîš9ÉB´»†ÏŒœÍøNèr2F³@YCtc6Ç΃P¡+Vâ¨ÚÈlSÙõ±¯ÈåtÈI[ éº5]d€„²`/ +¾aâd/Ê÷oè*i‘w¡@ƒm‚·¡¡<[#öO¸Í÷Æ«½má9Ž÷6 ³¬Fq«šáx‡-¹¿}ß÷ò°›F i6‚ +ܸßÁ ŠjÍ C +Âà€Ë zê=¯P|X þev·³öpHŠ¬? *ñ==Ö-|OÛ{U³Åq”ÀçFyôŽtêÁ3½zp¶«æªÆ€ j¶k™^YÉ áM^®‹y‡®ÈKá•<´ŽHÕZXéŽØš6©ñd,¥ ©$ª=å+þµñ9Èb¸ÂI€GvÌËIÛf¤Ž-û¯ÉI2A4`× b@Ô;ÇqÙPxš±Q 5¬…”I‘Ý !Mûd…ÈÐ[7åKžxb0Îj6yß0¼gÙ¡(ísØ–R¤ò†·ˆÓ;$¾o3†Y‘¡ïŠM;PéÄcÞ .”?Px[Vôê5Bܺ¤9Û´ì"«ÄÎee]–#ø:sŽÃngI”EUcs$†k¯Ÿðz j5/27Ê$Äq˜Ë×>8¾vÇÔÚzße}sð>ãú¢K+€®¹Ï…4šFÞ…&\±„Ùîë‡æ‹‰Û?R1Ø çHlÓXOÅ[i"ñ¬s”Ï8¡]U<±ãMT½M ÜCFr¥ld_‹C=tÑ+[Ïe}`;䕤ĘóaWy¾[Ç +Ù!Õb7—çûaÏÙK&Œ¸òÒÀ´Ìˆ1Ês<ɲüÞ‹9Ƴ`U;NÅúd&u.(ª•@ÝK>7x€üøâüt:—7Ëû‘÷›EȆpv•£ctEˆ1Æ€K‚º#v€Cï²;û†Ü.Û˜kL¾‘¯ÕŽ|4˜ñ•g%ƒ$˜‚4ÙæÄ ^}UçŸ((Ãø =ÚYó9y ®Ð þ¦<=ÌqAañxÊ1A4v}ㆃ»4nDNUá0–[ÌxÂqý¡R°¤ÕŽs œÍ¼dÄÞÄÚ3bã`ŠŠ³Dì_K‚L¸‡ÙAa7¼O¾ƒƒŽCÉ˵-7M%àŒ‰²ñz1õä)…ú„}táX ùåƒìcN1:}UY7õ!oƒh°ê«^#+ÆÁ!÷¸¶¢´˜âÖBB–dÒPPÁ…3÷Ìb2îÊæ0ç(›ó8:÷zÎY¬¯+22r.áEÓ¹ÁÇ-‘g€/oarþáâòÜ=GçdžïƒÆ9$¾kŒ¸Ä…3ïŒÈå[.‰lÞ…Ëï*~¼ñ…læ@p„°¢áD»¼yÆcG +H˜åVš$€á—·ç´÷Kœ{çœë›hàcñ7É~¢ð|Gi):ã‚z~&U4F«8䇾ȧ½·ç¿\áBÀ¬Ñ‹}e3>—ÆæÅåÅ}¦Ïx€:-ÉäoûR>+˜±w쯔 + ãKÃå^“x,çb¶’Z”ÄäSÆÁªÕSªU®r\_‰âÒ¹Qød/´2 (o:ÖµŽ7T‡Êö¢A­—á›±¾½(`ËæΦRÍêd/À«6+yÈ)´õL\™,èiãÈ߉Â`Ì[+À#¸ýB +3; +ŠQDᶂŠŽ"€V1>Âr½'']ózW,©xXzÃŒ;7jöo¬zôŒjžV%;T‘<ž*ž$Ê5«Frœ¡U²NFy8ßü˜»Å³ESa9Œ(™…V’@ºÃàiÒŽ%Â|ô8­è‰ßpP° 8>J4a cÜÓ–Â|Ý#Eî‚ï9&ÔÙ¨}€ó’¿Â q¯~D´èº×_±Y‚åB@8®kí²\­'LWŽlœhöD*"íMàóµãƒWý.º®s±eMò¿Å‡>þ0ƒSOY3W{Žçë?Î)G„)‘•ãCüaÑ£Ù—ü8vŽ¬¤·³+&2öˆ;—uu—`™]ìy=íâúLÃCrFØO“mÞ&‚ s(fkj÷ÄfXNFšƒ€žq›e·Åp¢v&˜+JQ7í£aÛ &Ôá +©#|¶LßØœðƒ¾¹Yá¡G\ !Ê–<¤¾E5·Mëxœê§ß+ßÇÌH<ì@8»æ×7r!ˆ *\ʸY¹g3Œ¼Ê¬h„æ¾¥g­?Ž•Ç­¿Ð8Š5ÕXIqŸ9±[b7pꂧÞm9É—çA9¸ã÷hx«ÂÅÁ`ØFóa/jÏ“Aש´ØÒÔ&§°ø˜“"(çÅy"À‡ÖÜ|ó§›oüòx¡ãzzdK?–Ö \>T…5rA.I`uP†\Šãj^ZñÕäþ²‰8Õ1ÜŽƒOßr´dz§ôM§ÛfÙuÙ(w£¢CQaå ‘Öˆ¹-pvc½#—miÃãÛ±‹ÝSc +W)C“--G®ž¡ìfåéº+x!1×XßQ’á†Å/^±È?u-Å­4?¹§Ê |i•p"O²•e—ÐÊ[J`Ÿ2N@^pŠ0NûGC(öÂQ+Hî3{ÌL2¯vÂö ? W‚yyÉn¶={±ä5#´ùJ3qìea0ˆx Wš¾Ñ—ç«hgQÔµ€tÈ™´ýMj>î[Ì™@þp–v†»ô, ÁÅß™ƒª‹9ÒãHjS„}Ã_&ÕÐÂãí!³ Í_. Úæ8è]B%üœ{ÆCâu?{eòd d~ ™E&¿9ù.ïbZô o+á~•mûr™Og‹Ï¤ÄW.e³’ìv“FNµë×VƒÆMc-êÛ Ç¢¼²À/,ÿhœ¿ŒëòøêzË‹:½‡ð¶»ºÃùô²zñ7rü>EÁïqq•´÷ǯJûøw 'œnQ)_âˆÓAiü'-½v–E1I$i“¤Y9ë¡Y;OÛåí±G½¬ÊU¾þ+ˆû]þ9þ¿ËŠí_FïÜÛÛ‰—5+Á9[¤ÐüYÉ.ݛ˛Ï^ÁßBe—6ÚÛÑ0#‰¶, 2ùG¥HvM³¬?ý³DàηËôŸjg™´·Ÿé'k×ñâ©n2üevþÒƒézÒº#O·¤¥¦²¼ øž2‡üÚÿ.sÄðÿ¯øòendstream endobj -5253 0 obj << -/D [5251 0 R /XYZ 85.039 781.388 null] +5379 0 obj << +/Type /Page +/Contents 5380 0 R +/Resources 5378 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5359 0 R >> endobj -5254 0 obj << -/D [5251 0 R /XYZ 85.039 720.089 null] +5381 0 obj << +/D [5379 0 R /XYZ 85.039 781.388 null] >> endobj -5255 0 obj << -/D [5251 0 R /XYZ 85.039 720.089 null] +1302 0 obj << +/D [5379 0 R /XYZ 85.039 580.482 null] >> endobj -5256 0 obj << -/D [5251 0 R /XYZ 248.731 250.429 null] +5382 0 obj << +/D [5379 0 R /XYZ 85.039 546.342 null] >> endobj -5250 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F75 5171 0 R /F56 2890 0 R >> -/XObject << /Im11 5239 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +5378 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5262 0 obj << -/Length 1786 +5385 0 obj << +/Length 948 /Filter /FlateDecode >> stream -xÚ­WIÛ6¾ûW¨¹T"YI-z˜,“8@'“ÄÓK’ƒÆÖØj,K±äSôÇ÷-ÔbYžK‹Æ$ßãÛø½”°|øV¬=_&V OƱµ*f¾µÉÛ™0®Qq:/—³ùu¨,á{‰ŸXˇގö”–ÖrýÅ~õîêvùæ“ãJ)m‘xŽE±ýêîÖög^½ý´¸Y.nÞâLÁ¢°ïnQüá“K{ÉJ‹›^|õûË+žIÏw¾-ßÏÞ,»H» ªÃü1ûòÍ·ÖÒû™ïÉ$¶~ÂØ÷ˆ‹Äéi%Í|7û<ûØ™b™²x×TUZ 7ð½(ÎÝEIdÜÉ‘;yæη\1Ë)OAeŒ³pZ-WêØK4Ålý°z>GE 8ŠZ‘*‚Iµâù¢õº„Ȭ瀸½H葶ÀWâù«0òBÉ(ôŸðÕ×~ -ÿÄø D¤½P‡àÐê©ÄÎl÷¸ƒM¬õ0[Æ0®óÍñjb‚a„Ñ̯!Ö~[x~€5Aýãp¥<08n_£sÞ‰Ÿ±%j“»[D¶ë¸Â>À ­qÔdF…k¥ã±½>ÂpEÒ÷¬q¬óý†‡o·¸ÎêUk1¯šqJ -O>|òºÔ$T' ZÚb*y@o ÿ­åz˜IŒMMWPp •~äùQB¬Ò•åùîèÐN7óÃϼٖX°†ç«rÿÕ˱j `–¤5ì -Œ‹­];±²eá¸Ú×ö_h9;Ô9V[ûÊüéç0Q¡Ýlóš—·iÍ(”mºGŠ°×0îKt„„&l<¢Œu`xÜC8%ªåM6°vnÿ Ùd93!å{'H1¸æRZîD^›CÚdkÇUB€ÀDAÑhñ´ÇÈ›’.# Ä>µö¾Ä ?Å´6Ù’«EfnîÌ“)ë†,®yÅ'ƒ".që‚Zx£ÎY#‰@ Ãj¸Í(Eÿ$¹gUÝ”‡´†¶y†½‚ -µC'Æ2T-±±šAŒ©bOqô8OyOÕ.3ãm¶Û™!çAaþ¸´Jw»œÎ˜Ùä„„•x³É¦žà¡¼Ø“5©^ù̩ÀS‘4Ênýú ¸ý#Z¼ÂáoTÑcEµ;wåJYÆ'åªRbš‚P5óH±½Àùô‹Vö#–‡‰Hë"ºDѺìAYïmØBÝ¢½­4ª¦üC²ŽÎV¼³fñìg"üNÐÜ°Úã¼FR -`ð¾ä®‚tÜ-ÿþ³Ál³Š[èR9˜¡xS• P£26Ÿ3Á¶U¡I‘o¶Ô3<Ý—fе(òNz¿ã†Ç v“zßpP{¥”}W1Çã¹4Fýô ˆß-dàˆëœý/žCø2HTôäÓn C”€V°>=åP*Ü£Ús°99Ú§†-€{›²ÂS #;ݯyЋéÛÜ£—BR’ðéP{Ë·ƒˆ!¾ ¤P¯ø8Jd»–j´ï#kÒoÓ2@€È„LÂÔl>63¦~¡« 'yÁ—#®—hÚ?mj4í#ïµ€L» žà*í`w0Æõ¼oe‡—5oá¹èâ]—¯1‚1“þ©E‘ò¿Í Gkøx2Dÿèí@qÒ)‚§òÁ˜žÍù9¶À7 7îØ¿ß¼¸@BÀÃPÉ'éa s™É\‰B„'L&c‚"Ày}©ˆ´˜­þÄo¡]_KÈc…2jd»½/>ŸþÄè\&7PÖð±Ò};¸tÙæü€Åȼ,Püј7„è•Ë"c-ê?È@QÑRo´Í×T‘³‡Z#Äñ÷J­›æ†Ý÷Q¯?BàCÚþ°Ÿ€Mx{„ -@÷уOtØ°àeCHxíà”è~ç]¢³ù.¿Ÿ·%X›hlΠã¸m_8nŒ¾Éš2E¸VÄüa2Þ#†ì?™{Îäîy÷7\©¬ªË=Ò•LD_öU+;uW%qî ß)¬„ôr<ö¨¸ÅèhGþR¶¶þ>í«{<åó —¾$Ó_ˆæ,ÿŸ/D%½X&Ó]ˆðÑÆ‚5D0ŽWËØÓ±<ø_ uÓendstream +xÚµXß›8~ç¯@{÷ÒáúÓ·”m·©Ò”nèõ¤í> 0 RœÍö¿?6Ù¤wj7(ÆöÌ|ŸÇÆÙPþÉ(€$0}†aÌL74—räÆ@½†Ó«8:obãÕ;Ꙃfœ?ù¡À¥ÄŒ³;+|?‰â··¶C±¶ãûÌ +g“…¬Å4œÌÔkE²y;Ƕƒ¬éüFë+/QôIÙŒX±}0ÞÆ­PR§ïÆÝ=43Éÿƒ ˜¹“2Ho I +P—ôíµ±0>®ô˜kj«s! „ÊÈi =ˆ"žÔrMŸB@¡Ûáš×¼Ìx)òbÍÛ׶C1µî¾!âªKÚ"O)¦šuS”âO%}%øæ)‰¨[Z¶Ä…>ÈÖë{ÉÊAŠtpA°\–b<ˆù›I4׳Ù½(Â4 +O.:‰´N +¾ü‘ +’µõztžbÜm%A¾oNæA/‹ B5î,ò¢äªfü×\­‡BY­ë‘W]¡¼Ñz×Mñ°—§e^i‰¼î¬÷ÆOÿ›7mQ•{|–ÐËùù0)«RËÅ-…:ž¼éŽhAιš4éª<Ûfpóµ(³j×öþcý|dÞÿQ‰±ú•ÂÃJýt_ËÈ«}ð»Î§]0Ú%x¬³3{-¬Ê¼X¾ c¿-~Æÿ=_×/vô:l¶¿)ÄäKÍ>ÎãÑ2c‡’lÛ6kNâD/ˆ!ƒUgéhGä0¤–ëˆñ@Æþ¦ÃãÓáÑ¿éðøßtoøæ2I…-Î’r¹M–\·zUü«™æÕ;tXK8I3*Ÿ>@Ìȩ̈¹¬lílì[\ÉÄÚ5²B’'¼n‰•lõòÕƒ™j «K9Ú_éç7ˆ\/­š”™îÒ|ulß´ÊC!ö.È•VP.d÷ºƒè=)½RÙ‰J+g…T#š…æ¶Wèù£ø/Fiµ©“†Ÿ æ0WYB6¼c¹UtÄ_º‚¢$ån”÷Êb¥X¶ºQ+9UÃBY«,Ù-ÆQa']<¢—¡©*ñ‡^º6+ò\‹Øé6`Ÿþû†bM™tçêÝ4$C ‹ Tê8fqËè>¹ÙNàRxÜujq­¤AàÓ£žóe4çJ_yiÏ/ª°‡ÿd †òùhËSŒF{.j&yÏùî+ñÂÿbËendstream endobj -5261 0 obj << +5384 0 obj << /Type /Page -/Contents 5262 0 R -/Resources 5260 0 R +/Contents 5385 0 R +/Resources 5383 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5257 0 R +/Parent 5359 0 R >> endobj -5249 0 obj << -/Type /XObject -/Subtype /Image -/Width 780 -/Height 348 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5269 0 R] -/Length 23954 +5386 0 obj << +/D [5384 0 R /XYZ 85.039 781.388 null] +>> endobj +5383 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5389 0 obj << +/Length 1304 /Filter /FlateDecode >> stream -xÚì]‰b«*Å÷ ùÿ¿|3h³6]ÞmÚ2ͽ¶FÑÄ9Ì>ãèRÂ/a; .ØfÛ¶‡ýnç“15Û¶œ ªð4.z³nÛí´Ã6‡m §'»Óùº-¶ÓÛÇ«ÇÛé±<‚mÇ×-žîoÛO[·¶´1ÆÛNÇm· ƒÛv;½ƒÃScžNŒ ùi‹§O»aÚÝéfI}߈…hÛ¶ÝnËa;o[`êbX·!l´ZOðv¾;}?LÛ`;Ý_O;l%œN¶m[¾N·m|Ú6¶Þ¶¦‡u;m§WÛU«Ý鸥°Í¶m²H\†u‹§ 8Ý߶Ùî4ÜÚ»vô-3èÆÄñnËÏ™¹Ðë¶Þ¸0ߘ8ß¾gfü;ºÀBºnņ±a]`!;m¾bÁlX ;,ˆæÝéýÆÔó¶õ¯±€[ÑlXhNX8œn„ð} éö±àmìÔÞ ÕN.è&ä&ø”.!•ï° OÛ½\Èß ìö‚È…å ó˜Sž¿‡dûB:R¿mņqÒŽ:R½r!êHû‰íNï7,ˆd8mãNɹ…ºnÕ¦#©M.,Òíôl»ê¥’Ã6,°õ¦<éF‡­ $Û6Þ†±§Oi:9,|©oÃBNíPð`ëí¶lým;ÂM–§m ì“ŸȴévzÛjÛ&Û6Es¶`­ÖåiÛªm» “Ý8=߶xú´mCJåº aÛᾎÛ`; ·Ávó¸9ÐàéÅvú¶EÀ’~ÝúÛÕñð p#þ“¹£ÝÓ@Áç°ðç°Ð:,\DZºoå¯aá`ð::QèäŸł{ê×rÁÙ  Ñfø::Q“:?Ò_Ä‚£;äì‡G+9¹à°àÈaÁaÁ‘ßÆñ}qàŒjÆuöŸÃBëâ Wt_¨Ãâ‚TóÿÞA1N¾ŸÀ45‘úÃ4EX„ÊaáIrñ…œx?È/)J&òex¸@VC’<¨6 -rŸ|ÔyÏK}å°àäÂ¥Ž4œÇÚü*¸"àR|ÉÕš)9cÂ"©Î®WÉGeCˆ§?‹å§ gra™ðÁ(ûí+Õ4uQÔÛ£š¦Ì„M}8IMÓ:èûO=~MêÁÁÇ«ÏrVG’±`™ÔÿÑPx•·†DÕ nÛ/ÑQW¼ Ä›}g/ìä‚Ç´ÆZåž#'Í’HP˜1|oE·¸0IŒï‹pý„±ÐšÃпŤ·æX_w¦ë”ź‹C¦ããK„JÄñ±'¾Éø‡ÁPPÆèµ\¨?ÕK«äÓ`ða”=¦íRyä%‰p7}X./±ð°&ÏÓ£=ˆéj™Z:–·Ó­'yÔ øš&]>­¾=]§ö†£±™òÏñé%üéDišäÕôɯ¿ñ`œTnY?Y -Üרpòì…òú£Xxîí‘ gw!¬„ ÌP¬3Ý@F[b– S>ÝĜв0$ƒy2°Ô¨Žz(gýrJ¦ÙV…•I4YQf…å&Ißb§vø€ç¾S¦’}j*#D=l¿‹CTiË…Ze>œ ˆxë$,ûå³X¸ ðƒóè ÁR¼T¾¿–JWt|è.Ë2=u‡Eî°p®qèeÓ´©¬r±0Ã/šeéÁÕPJJ…_pÑD:ˆ‘JE¯<-xÎ$e:FþE=#YåçWE6À¡¼i¨ L$€Žž ÒiæÙßBû9/¨æ ¦úLÃNN*mÛ»Q&A”ÉžJߢ²×áa‚rL‚Á u¤¹—I“ -Þ ¦ -É)“ïe¦ {áZí¶ÚL•~)j 9¹q¡ ü]g ç”˃Š½Ê…x d`mKÖ€½0 |U‘F À¸!šÊt¤ç{S ^‚Æ8¡2a➢T›\€ãL1gs 2˜½C¹$XúÌx¡áŒ~©*ÓôKŠNÈ'&@6ਾ^­sukAE¥ÝÄêHq‰ÅË~‚rx(Ø€íAGŠEwa+|  üR.\« îŽÔWba´FÈ•žù sXxyò Owö‚䜷ö“˜Ûš~Sé¾ï9(Mí׺3BÀž¡ó5Ì^Øv¬,MYÏt³a›ŠBÈdtáÇܤg11µH x\€XX­d`êD™XçÙ 0P«›J‹¸“Â×–Æ%åÂz[ÉtdDX(lÓ/Z6h¾‹w|ÁŸ$¾xK.˜å æë ,L7Qg÷zÃÂÿÍÿeY âBzvWkÊ¡¶þÖb<4n -‚#VwÒ”Ò,†|àjÃìèO,4³æ4¹À°×D£‚aÌ„²X°}\|`˜ë vÀ_LJßb¡Q+j‹˜s,”ˆe|*u…X°×ÑÉ*)h+¢U.Ò¶–)Õ{±êñ…k¹`š`<çmU„Es›m• -‹úò=‹…ssa¹é .ôþFÕáøwS? Œ77N¬.â LhAs˜ðm3n–zÔi6Ý)•À\ ›¤ºk±Àl;‡…» Eú€…tÀFpµ1“ Ú&TŒ,4 Ìß"­Ym”î³vpï ðlÔ‘æ=J]Ð -ÏF íýh°XÐ!³r*X± 8ÜU-«Z÷a¡¸_¸!Ttá¾o–ÄËst‡úWÒ¢H½Þ:{¯ð}Lj`ëG,\¡®‰‚È;¸þ:œ—œ°Ø¤0 5ÁMäƒjx»&žáÈ$‰àá6NCßOÖ^üm,ã ©–´r1ŠÁÔχ4ñÍsT »g 00Ù•C 6© A é¥d€½!\Õ!б¸ÌZP‰’aµƒD‡z#¤×ÑÑ!WBĽövþ6Øý\œb ³zDÌå 6ÛG/Õm ßY)c*³NQ2ÔÑ@Ú!ŽÀWÈ<ýl 0VMºh°¼ OÈ‹…Ó~5yÁ1:v”.üü¯«òÿŽ‡@l×@×tÛeT«óyî û«d½Éõ«(Ü>‡…פX|ÇU ù”\ {Û¹öVV:E‹Oêw½îðv‘d{]Æ)p›Mi Å#Cyãv˜^G[NX˜¢ $yqwƳ<ëúBUh=1_ç©ewùÆBÀØUfÃ+aá;r'†ÅÛö‚¿ó©nRÁ_ÃÅd~§ý+b=¤ÞVVÊÚΰݔ p›=ÿn¬•&•gßoBïÄÓ ÈÔ^šzÖ3{!Ö‘×c‰ÅŒ§V3\…Öv>ÝÇŸ÷©¾Õã·=š7åÉwnÿ•ÓN¶ƒµEóð8_§Ì¥UJ›~¤S`DIzK<¬û1µµÁ©~ I4›ÌYÐes-öTE´‡«ó©:z WraY3‡Š»ï36m.Ñ}¹òz™ƒÉz»RŽiìS0,ƒž%­ZågEÀrÒÌ··¢$™îaÁŒ'wâ!÷Òðj\ra>XgÑŠ…½êZ.\žx@ŽÃµô>GÎk¼«ºò§ÝvpyiÓþBßž|ÞÑÓ äàBT²t먽|rž½]¶†• ›¬Ÿæxg ?ׂ.ëöUmG΋½“ˆØsÚ -•ñ2…¢9ÝÏ ,ØAu^'Qœìg'˜Þ=±°‡ô•\ð.µ­C‡Ã>¨ä8GaíA:'_=ïu’%]Sòz~)è/´ïQzCôÖ†ówžÄ}v}`šKx*£æ²LŒ'×JÊã>†/ÜoûÒ7î‹|“–}¶©IÙ·ëäÄfà¸&î3Ä‚_–1à•-Æ Ê2°Eߦ¦`#_³²“¬ï@§0z<æ—½¿´ˆh²¾„ûi‚>î-Ylê¸l}ÁHK¬¦MñÊL™²êû yYNp%àŠÈÃ:^N|M÷ó"xUö†É1•5¼_¸„h:°÷r£N`‡dUÕ“p¸ƒ”Ý Ûr˜ æótfõ¹Õ^²®éiú¡ŒAð‡r¦šÄ1‹NRYÎ\Øo:Ú™­¿N!M/²®è2ãÔJ•l5½Œ»¡T£§fiVÆ*‡>Îî+ -»%Æ¢yLõbÏ:ía¤¹Õkáb–¢á<ëõBF¶Ã`à0šŸÈ8Ô‚XL&“Ž˜W×€ð’ð5 ó8 -—lÖä‘•1nÖ;W;¶òvVíÍ4¢ähšŽÝ3š'±°:`Óƒñp`i;—×w±pžäz).’j§Óm;,\`¡Àê2›r ’˜If¨›ÛŒo2lÕ*0y.– -ä…Y†¼‘³É¤eñBÛ™¶Êq´ã$9açveð'@ h(Œ6˜¬]efm°S~DÉmöªãxž‘-›«uâc1cJd‡ AK^©œ Ñæx1QГʕ`ê“( ‹aiu¤õš ÄõEGmß¾}£Þ9Ù-º:-䌧ýêFÀÖ?qíÎ7”{~Ø<‹AØr*¶¡ðø\ÝÇÂ?_Ê…‹ M'qæ°`Îó‘ˆ,lÎM…†I\Ä ð…w´íf©LB™›D -GJÆùVëéáG,D˜®Wró,çp<àqFCm¿y¦9ãò¤ö£šncÂA¼Føh˜PúíÀ9—rÁœÓø„…^ÛÇËl‚^à*„”\‹]üÐÃIŸ1‚ Üý†…þˆ€BÔ&š¯ßÃ-éQaÜMÅe§”4»T%Ì :ÙÂobÁØÆ'-É»_3q…«¸ó…[ØaáÂ^Ð;,ÔkB熫#{M1ÓÝ rIãj¨L‚0ɲj¶O«”}œé£IêaICÉIñˆ~͹Þ-4æŽùLΰÿôŒPÃÏeÁè¹,€)!+ø—tCœÍY@кµ:ÃÂDV©0L ¿×y/NÎ#Ï&~ÎäÂR‹½ñ¤ê)-ßÎGz  yµ³…Çw`a‹Üy',4“ —UB —&ZÖG)=— ð+ -,TÙ{WîA, »2À26f+Íà_(ði5ºD‹àˆšfcþô:˜/Ñ(±PŠô<ÆõeivSˆ­ѳrS°C饸–'í*õì$€……kIkÄB&¤\‡ áfàkI9Ós ïóð8Y6¯ ‘áLHš6ØzîîiLs9pã VÁZˆw¸˜šäº‡ä›Ë¬4z)ƒ­Îçä—J5›ù! {:(xøaœhWÕvLßsh±u¿8\éà z"¾ìO¬¢ovª.’Ãÿ¸OµÐ4íêÇCèËŒx:Sƒ¦XúE+ñ+Uíà+É_RàÛ©(uã å„©ø,€µAGŠ0)¨ä ¦ÿxZa¶]#¬«*²‰Á?.šV'¤ÔÄ×óÒØü.\Žit«2º„Ìú{ÓaV ¹.Ì8TFót®eÚ+¨T™ü á¿K!ûzâ-H¨)•úîÖ÷bÁŒ^uV‹¶·Oö ~Á„‡âˆ“ºâççõU~áÝkü}hž^»§îéHÅ´ëYæÕŽ&ձŘÃ|u’`·l³èÅæ/S˜•Á¼(_{IfƒRÒ®Ûc”š¢^«¸·7­äB°ba´PO×­µjÇm=„iuˆÙjè°«*èHÓÐE`AˆøÐúªY¼^×Óû~i;ðšÏ# -ÄB`td;Ub®T­=Ô± §¦€,³!‹¢^ؼý ‚(BwhR/ß퉒‹ŒŒ:‰ò­IWî±v“FùEU~á{ùV/êÓuCJClÙ›}; O6ù¡ÍÒq ¸ïü<ÖFÖ{DU颒bSÞ<å°€X¡ ub&=ÙD¼^’!ƒI[mãòR8³"[fpØXh@:aÁ®…`)`Ö6µYØJØ:¶ÑéÉBK–6[T´Þ à -,^™¨Ê&&×uªÁ _ß_ÖÝZÓ"—ðX‡ ÁZ4V@(YÙÐ1eÓdáB¥=.˜Š>¿ ;{¡yºoP1â¢=Ë­ud›bÁ÷¦ñªÉASB³ 4u¸LX(qãðcŒ6Md¥«ÛÜßø1î ÷‘NËaÞG¡œ\°³ `X,,ýšç¬,z¬°œÎåB-ûÂD(4ê `JcEïmõN,­?gZ³ïV,4€…«öÃaÎl/àvA%+‰›L5þZÆ,xXX˜p¢ŸbeíP˜cu Êì¹ 2Õ°µRh• ½­¸VXF‘5&å'䯠´úß4ùéX¨C7ÄN¶0Y:é.Œ†@áüƒ2^Ú6ÛÀ]‘’]ÛP÷µ/†:G,è0•8ÎdÚ_Àüž†,dkû»–­G´˜lãb:R%ð}±hPûY3ôaŠ -@#–º¡b -9ê`miáÕ4Ì„"Dš‚ñöBȹªàZñàx³`‘(IÃPGå’êw`¡¦ì¬ößaáo`¡ÛÕòÔ´0K a“ 8cq2tµœm+òŠL‚!SqF[¶ø}c=8AæÞj1Œ„TÉz„fiµè‚v="`JÁ˜,1vlSŒ+gŽ¦mM΀×p-à $„èS‚ãVU‡+UÓ VRàöõp&(ͪ‰áNg{ÿèR>¼KßÈÛôyá_pXø{ñ… ÝWí4ÉÓ¯'=³^}G÷OÝZ„57gäCÿ°C@}}]üM]~<@­}a"»Ca«¦Ü÷äjŽÃÖïÒ‚/×_pXø;X ?ö‡[œéG¨/ú`8,üu¹ðH•«öÏ_Š0øN‡'ÂʲsXøsX û’ŽNäì…?‡Gwè×É…¹ª¾~ª&WKdçÒÂ͘4M²®S~ŽÕÜ  ¯A$YWùüZjiS®öf<ÄØO±Ñk“h¡•ÒZ­ª¼ÒaÁaá7S(}°8±u›â€…N*%q1c“h]×:ÆÂñÕËM÷ÍÎJ -‡…W¢ó†¤ÃÂÛS¬QÁìžà튆-;)…ZìZò¥n3L'h/+9ePŽ­Iãþe°ðÚk~ÙZ'ž ,}éfXö”¶¨#Õ2ã>ðs ŠZ·éa­õQH/peï4hÀD£¯zÚÄœÁ‚«ý¿…ߘƒñ¿¨HÚÃÜ´D…H¨• µÌ)5'ä‚ä\¬ë\`ƒÂ˜<æ¦ -Óíãaj+_IGrñ…ÛXprá J1!¸çJF‘0l• : -„â±’`/dõaÍ<Ûq·ا³Eþ—=„”·Vrráå䂳Þ&»¸FÏ ëAMb›\ˆÎEZ£\Øe |èÄ´½í@MÅ´8,8{áw|QX×Õã -b:`@aº'(b…ËžZwi˜°•ÄxC:Ž›‚¼ fιóaSã'¾ï°ðÑv]˜ûŸäÂl¢— (jiã kõz<°Æð†‰5gÀîª×LÈåz]KçS}9rXx‚°Âû”c¿X2‹×4ÞbêÛ£7Í֯Ú(@Ï*Áð\ÒÙz¯ËàOßsXxurö¤DõüÁan5ò W“ ?’<ú|Z‡¿¶¸ÊJ‡‡…_i>7ï=¶i^ aš¦£{¤çO£ìûÖaỾýo\ÇÓÅÚ®æ¬kû5ö‚Ê&Õ]•¨(]÷ˆNâ_F\|üÚ·d@íï"ó^ .î|C–ÿª¸s¡2\p\È’[MÍûœ°[·þÝ4õ7¬‰–žîÂ7ÞÕJP.ÖöZÜócó‘l_qì/n7øÕ²2)òäÖØœ4ÈàžYû×v mjB×:Óy³–À…uª·Ø°"8Ï7v²ß®€ Ì~ßkG›—G­Éñt8ªVár8Ø’ÆÐÎÉ…Wf¨Ÿš›—2©ÙdbÊ$OŒO{)*ÀBPpßiÖžéý ü¶4ª•šã•¥–öY'س*a í8dJ)膅XhV(̲¦™){&Ù‚m>åÆÊvOjL%lOöLHî)>°:x/f†Óý†–ºZÓ®ÓA$p¤röÂëRM)ë ½Ðp>&šÂü‡To`KÿŒ®áêäÂËɇ…ïò\|rFYìÀùÓð¢(qXø.r>ÕW#!ÖÕÆý[ -*í°ðbÄGßCÚé)¯f4„$$îõ /¢÷9rô½vbQ‡~¾žÒÞ} Ž:­µ{îçdëÚÜ×ðçÈÅn˜ -  .î|¡#aÜÙ} N.8Zû#¹¯ÁÉG¦Û¹t_ߣ)ò"ß} ¯@I4¹ïÁ‘#ûàò92‚…pºÙk’וeû…¯®pßé#,PÛoÅÑ+ÄW’ÒŸñ¹›åæ“ÿ;D–I‡…RßÅÂDFòU¯¢ú)X°µÿßb/ ƒËÑü>z_@,ñ«èaá{â΋/¸:–üV,Ü‹/ôCJ–/£ðÇ`áÛâÎÜEz^W.|1~ˆóüÛò‘¸Ëø3Xpö‚àSD{š=°þ¢\hRßO9{áûÈaáeé¯Ú  Žœ½à°àè+ì…1,Š°°›btrÁaáÇQ\úöÂ8Æ´ âeŒû>ÇŸ,TÛ–±ÃŸ£Gëx¾GG •]9È¥q©³p¼‚ÃÏ‘ ¡‹/üI*¿ Ä×™R½^„ÏæOã/ .¾ðW±À¾À^£!!E&—\HÞŽ9ç< jÜY;¹àäÂÇí…м°ŽåDHÎtŸPJóð‡Êât$'>£#M²¯ —Õã9©‹"ü©öBÍØ÷dÉ9,|+Myt·öÿ]ñ…0ÖŒK¹”š–2.\|Áaá7Ñûâ “{­áms2ºø‚ÃÂo¢þ}:RY¤’…c4º¸³ÃÂ/“ ï‰/Äœsæ—ä°ðDZ’añÓü†|¤Æw9Û‘’²,óOÚ ãªa…ÿ ò³ëÚ\-ÏŸ¤G>Õ'í…1 ¦3aô£ I¡«ýwXø±XxNGÃ@ƒ™`,Æ¢ãðË–‘tD…‹;;,¼>>“4†KÀR !0

    SAx‘~˜\p¹yN.|À^Ç’3ªý¢bœÍEÜ#)ã¨Ç–3æ>å¼\Gqö‚ÃÂkS,Û}Ü^(zår˜¼úåàUƒ¦ÒëD­/ÅÄ¥—ë¾øa~¤qZ‡GïÒ‘È"KUgÃØËeZ eÖ”Bu<äL^ÑHz±_pXøíXHu\O§tRjjJ¦DoZ>Š²^ˆép7ˆââÎ ? oÙ d’m ¶óDEš…‰Îtra}M¦¬Ôž»]ÜÙaá‡ÓÛöÂr†ý°´ƒW.Š…k-/¨\Šrȇ²)³18'^›Hâ'ˇu¤…$œ3!S LpŸíØ ¸_Æu,kÛÏ‘ ªïûÒaáÏÑgkÿÃ%–t!a’y!FÜRÓ´ei¸„ÓL¡‹/8,üút½ó†#Ád¤Ðf!¨v à8&p»>Û ¯·þÂ9Õ®†“ Б0ñèñ‡Œ$×ÉaáçÊ…§°@F2>õþ’ ®öÿORAòq{! hÎ"ò …Ëi\¸ø‚ÃÂϦgò‘b•-rm ü#d5˜áB¼!Ö}íê.šèQnVâÿGóL|Á‘NÂ1è"2z>$‰‡?Žý0Õ¹h\øÁXP:yð®ÈæÀ¤ñ2qÑë’ˆ².W½½ìU&)ÓA˜¥YBœ\øIXP9i{˜·šŒVM}h²Dø‰×&êñw“ÓN™\3 1Œ)"¿L1¦'jyÆ¢èuÒdÒea±0$M '*š¦ŒA[Úü õÚ - ?Œ¢a“¾á¼—ø8ù’JNulJ-uZJÊun`º’´ZDǹϤZþð•Úä}öq{au ªÆ1,„êyAFÇo§ú'ÆB©µøÃX‡&BN†ÜL½ªAG&MÚ!¯C–ÚÕ­iúԈشҘtHÆ¡-ÔÆÂôS1)£›\  ¥ª˜ÝÉáêâÎ?G.»Ï²à«” uB†Rµ™=o{Ma¢115`K˜OjÏúñXøäú cÈEQû½)8U“ÌãÀÔTŽ£[á‡b¡6×r)t² ~+3b!d‚•x£“:B¹ dOi™/¿ Ÿ]! †>b‚0´èHCŸs^På‚…N.ü@©Â^é)]Õ%í ¿zA,TC7ZÓÅÁŒÌLú¤¢Éô«±ðt>RèQÞOáÔó>Ž%ëýpikòí…?^û²-µWhS*Íý`(;‰zQc’¡œéÀ!q-2#DjsM¦á§‡*Æx÷9 ù<m‚Ky¢½Ážqßdøù‘ÏKþ2tIX>e¾‡þËë”ñºÆ˜€±8Š›±d,iA38fBCZb~/½£Ÿêfàÿ5[Éóæy.¾ðsìß=‹Ú ¡è¨ŸZß¹ÀyD˜jRãt„kë#ü­Fu¶³&‡†\;þIx¬^;·žl;\àN…—qX¸‡…Ä1ÿGí… 0„ÏÕ/ôøÓ×!†ù[c-1Äðk2$XE€q†ŽþV,rÔG•¼*¾T’ÙÁ€¹c<¹Ö†Î1Æ îôq ¶êpr‰#VqX¸Gʯó\Gz®–ç\.Xí“´5..î!Ó»š¼„¿—rÁ(©g ez- &-}›Î»Òî[Ó¯• Uÿ1óu:×’Tß}h˜Æ»‹ÌÂÕ;;,ÜÓ‘H*E›~ —ra¦·°àW ™pã=9û7´ýêïÄ­¿ðw±p¿ÆT`qZŽ‰§O¡á){!×\Hf:É%?c ´4&0‘iû~#ùÕu¤æ½¤ö?ï¢úòç=Tœÿ¼ƒÂ'Èr&ÁמÆ]¯¹|ø¹A©}õðÜù”^‘?lȽ•rÀ !Kÿg{aÔsC$kdgFáÝQôŸDr*t íkÞ;NÍø÷ÌÐlO‘Ü^»|ÿ}žôúϾ®~¶—ý÷YNÿìëâçðßöz%bù_åB…IÁ=o˜¦ #%qV]3l÷›R¢aˆFí•ßæyÅ»—Ò1}ŠzüÁ×*ñuñ³½ž¥_ðƒ¯+êÖW¯»~Þ ,³ÿ2û7g4ÏÙlÿ[©ºEþ\Päçm/ø¹AÞádzÿn²|»²˜Ô]:~\Hâë ;Æð[ÉŠÅ YúÚß›œ—5ñeHÕxe˜}àâ×®²&öœ†ìèYê‡eÕÜŠET멽PÊë ÛB¬¨RYcRÁ¨„oúšyCNä}Q•RN1íÛÆ=NGŸ  æW¿þZ?R±ÜÒÔYVj°˜É'[]/7²)J¹®" 1¹{’Ž¾ ã”M5ù'qgÊ)cÆgB”Ÿ˜Ê.©ÔQ-yÉÞïj¦iZÜãÿs”€ÝÅÂ)îLþIÜy)Aobèã­ïzy¼'š-j.S™©gýŸêšœt7¾ küÉø§ëÚ>$Âézâ/¸ \Œ}MýÅ$>ÞÒ‘B“ ÇQ´º‹…ïŠ/8zY,ü¿yª­¸1õ×qÙ½O=QâÆí.…üpG·o‹;;úv,Ð……3¹z_âÛi¼›EX‰7~xÈÐɅצæÿÃÂgû`|‰½pVßÖxê…í…èkÚ—îb;á {Ju£ÊTØÞð:¤ÝÔ=6ûrŒéaŒ”´Þë#ÒÙ'9µÊÏà²aGŽì­QÀw–“†m'*þ_xc朷Ÿ²ˆMù´)¾ ‡•w šF§Œ,¹|®·¯Úwï¦Iï5+~ }É8;0SÃ’[‚ÑS2\Ä ¦¯†ü '5×ÀRšã~ã™Ò³}žºÁPê$¥R,0Óâ»üÏtèeiþýÒ’O­E²xQžç>y·\¸˜÷ÛKÖ¯îø‹ZÞ<’—e 5¿Í>ê^—zjêfýÈJ©¦S¶~Û¨ªF6R¯F˜îÕ„kܾX÷XB®@¨µåD‚mÙ¸)–a$J¦hµÖŒÛâs{œ§}¬††«Á{°9ûòív—IRÀÂ6ÛPn1RšX4J -¼ªd†^©¡µ½=¬NW‡Ûƒ{!Í9L3_N/ˆ’ -LÏ(ëwË…nÇÓ~_uçð¦‰óHš ÕÊPîò5Ô¹PWûüŠšÑÙ/Þ°_eݶ@±²ÄîÑýÀæŸJæ†ÂÇŪ;t\Ê°“Ró@"$_à;…}æ²H€ºbÌÚ‚M vÝ›™ži3SRŽÑAÚ9g‚¿iz®_±r!Œ“š&Z¬ßóDCº˜VjÆsÌ ÇÁíÍÚo%)X{n77pÅNüã™ì{L0õÔ’ÖŸ°j s|…Àý0™$ž&0yá_øµ¶ð€¦-Ãè šäLº!Vœ+qÔFGD÷‹§#øjëLŒ? Ø9$Õ!ÌþcÎí×¥T˜Ì07s˜Üýa)‘_EK/ò¸0Û¤j>‡›ª6˜ŸÛ ›Ê‹+‰¬³®(uH™ÑËd¤´raÒc€œ+²hM>Þ‡•å Ìž¯æuxÉØmrБ̤Ì’”1 -3R+A¤eWX`øvq¦$/VÌWÂdö“´ÁPÞ,ê -äÿл!L§”|JGÒ¼Ê>"ööЄùÊFˆ¾/‡ÖÀ4â±çíîbz]ö _ ¹k󮜧CEýÐx²ö‡IIoFiÂÔEž>L2ÍÝmf,¿"(6¾á9‹iWv–·U©C,DXüá[o;‰zG©ä¼‰`.‡4¦•‘ã ¶iN·a!_‚C -ì\H Ì‘U[úðÑ<~mG×C·¢MÃ[ŠA¤*Ùu$xÀ~bEò¼wÔ‘Òµ b)Wµå`!fëu:1È_®ÿ,´ŸŒ/ì…ârÁ~i+(-°Ž=ØÓs¥s«!j¥åÑÖŠ{îe;ññس -¦íÁ3/$üoÏЖCâ£î}×A^5¾Ðã¤ÚõÂo9°0NÔí(ìuËÈ:än|ÿ€˜=êxÈíÄž‘¬\˜ðW¹ÀËK½4FÊÚ Ó 1JêÍ^áÄP˜Ï0nØjämEÆ¥ðkÛ° -›šûØÚX442د ø0›Ý¶–({Óñ‚8ËÂSïÓѤì†>Téÿ¡…Ógã ã’x’úO6\Êï˜GâüßÓõ[Œƒ«ÀX™ º¿Éi†_KîÝñ©6í|ü,b“ 0Õ‘¤Á'ЙB{¶B¨òlû°„¼íS}Ù ˱é o€™™³Á×Ø÷}"’ÂÓŒê^4ÓÐÕÌØ›Žä Y ˜ E+à ý¥߬Jð0Õm/뢪&Ñ^¨ ­S¤ÙŽMRÝÙ¢Ç!P¹<!˜XhOœç`Ö`¡C&¼Û–}ªÙÐ/ "¸,Á©ŽOa‚êB%.ÂÌCW´ ôé?ß+Ǧ>F#îOˆŸÄýT|!$¢Tˆ/T'««‡§_µ¯i,ä‚ ôì<”é²ÕqÃEL‡ùží|ªý/d[”O -Îà˜Qj… ÂÁs«ÀÔ‹ŸqÆÕËÆÚúˆ”DGNÀœ#— XöÀ€BÒДXú‰í€¥”¥RbM¹j:-e l{#ÃPqkC©>ärõæHMëI€lFå*Q¼˜$ÉÈ95Õl_öê YʹMŸüHèŠâ7´Æ¨Eº–i⬾%ÊdØÎg…HäøÐmáæI:ãMfZÀ'Ë$|¢È&%ˆÀy(PÙfø«&õø‘>Ÿ4.¢¯?wn2ÖÏðõ$”—xŒéªb­ÎbcÉéSE‘”LXGœäÓöð½'BêV5íÙ£{`C¡Ö÷’Ƴµ0…ÂÖiܤ0Á #ßZL¡oŠÂ_pݹƒrúÖe°øÅzº*°b*µ:÷²iÞ)~cµ?ÁiðcŠþWð \k\íݘye‚óÕ蟅¦S¯‹pj4[!Xs ­îðÚ·÷¨ð½íÐÃ]†›!WZ•ož°¡%ÞGQŸ>P"óoåÂsX ¸NÛ?웧hŠ…¯ì·ž¦Væàc·ßŸòW‹mÿèîg…×”}Oß¼·%–¸3'ˆµx»~™9öŽéB)â^žž^¤ËXòÿÕ«Ù=º½†þ/qg’$Éô {a• Åçó‘ž·öù—¨ŠJüÀ¸³ îȵ­x;z¾ŸAõžÖKÏÎr5rÆÊÿ×ÁŸ<º=Õýó8iÿ¿Ê?ÿOGçµËMþ±~ÕGÆÑϤo(^Þ^(¾ª~á#ó;uÌáè5°ðQ¹pžW”ÆSw ‡ñþ-/N¦èn±Gÿ ÿÎ^Ȇl8(-þÙt(ßdT4ooªš]Ñg[´bD÷øÿyeYßb/\…Úf0*b×ê!ÅÊý¸ée'÷œ™?ìuTëîvÿGÆ»³X¥*ïºiklÅèXãÏÑ×Ä>"ÆtÏÓ> QÐ23©¦3‰‹^Ê^å}rÖ‘;;ïÏÝøg£6"£}˜`AŽõL7>ÁU9“¢dÕYs2Åî†\íÿßÅÂ÷ÄÚ3ÖÄò 9)‡t0ä_*“DSƒ%š‹¾ymZ%é›Nûˆ'OF\p1D~5=ëD-×ÆÉ…i/øÑ•®“äg& å¦)EouCj¢EŠTæCl¨h0ÛµVïÑÿ\pXøN{aeÂ^H®½ ×öìDú‰e†ùÐb¶WbñÔ0ñ®Þyµ“ ’2!Dù-öÂ-ðÉ`*t4aŠp)4¦§àRz¤ÏÄÈz» ./sÌø/õ 7ù]¤)/Ê]î?H¸VË·Ø 7òŠ83ª¢i(•¯ÛFЂ𫌋øBŒÝª[tB%ã˜W‹[\ÿŠë/8zY{!É›4Š^=qXñvܹÒ\0‘˜yLL/•×5™}/nõÍACb24F“¬Ê²k8ÔÊ=aGÏR?ø7W·º$чOEæs¹Ýh¤M¢ÉÔuSlÍð/yó&›òÚ70e^aPûmØ.=îq:ú”\Чչ¼ž;L_“³ýŒÞ·ý¯øOkÜR$ŽÞf›¢¾Û(ÈkÛÓª]^š¿} Ó_sÇÏÙ -þÈiu¿~Ë®kü9ê46‡ú‰j…vüÙ#½öãêAýÂëÖµ9ú?éQ|ái,|¨*&ÿ`-Qû_Φ îúT]ÜÙaáƒÔ| ™ÆBnWžÊ»ùØ9=éìË[–èè‘Ý=ÜIºKOlÃuŠ™vx^Ž²EOuG°æO¶}YS\ò|!ö×ÓëìßÛ4¸øÂWaAŒë|wcÜÍ“Èδ묻#˜¢ýQrùó6í厕CÏÑ^ÌEÈÊJ+8¯)ÀŸKªÖŸ#Íç”UÙl2œ‰8l÷ïÿ=CéïÂÂ÷õÙæÜ8ú6j?Ÿƒñëèût$‡…勞èôÛ¨fœS‡…?G)èS¾û^„9rXpäÈaÁ‘#‡G¯N úãþ%eÛæîk8#¬ñtñ…¿GΧz .¾ðg±àbm×XprÁÉGN.8,8rXøÛTqæý¾ TÕ÷ø„›–þ&ùysp pí4taF¸¢T2ÃßaGV¸ò ‡ )ÒŽçŽÌ¯FšÜ³ƒÁS¥“ W¢òð ÏSór8Ù®÷¶Ì/¹Ò¹“ U=Àá¾D¶—(šl>\¯s} L[H\¥"wt87²ë²]× )Aí`ð_& <™ãÂ:vyª —•up8¹ÅsM½Ž*‚µ¥MiìZË5þ]‡Í¶³ ;þ­Âã‘ê}}<îtÈn§Ìî´#ªú°óõÈéHŽÞCQ÷%lÜ”/ØL8¹ð“3Ò7]ùcçµ¢ùŠq”¼[™Z—}ÿ=e«N.|'ÅRÊò[®ÜñÍïê|…ç†pÉÍâ.†°®mpXø{ì·Åüà’¾²Ð$%ÍžœïïÆÎ¥¥y4™´¤Ýû;Þ|_ÜÙaáobá&¥šQ9¤¾¦TÓënDr*t ë{÷0ß·þ‚ÃÂwcá…ò‘(E'èRêÂ$ímŠ<‘NÝKeü!šäbHYß‘Kä‘Žä°àäÂ7[ò¢2fÒ>šwF1~#&Þ>agØ6ú¼j˜}mz~æxd;Ãu™ô?'-{GÿµoêiUÉ·ð}Æš Z¡žäÐAeOç«cÆóÈsÃn˜þypÕx¥”SLû2Æ;ùïiøŽ‹þ^xiÖ¼¼1¿÷ ÝwC/çÃS¡á¦¼Ñú´ÔÄxCäÃ0ãð±Ô¢lHÉòo‰L‚‡‹£ÿF’럶L1‘lçÅXù£÷D\R©£Zò’ñ}±NÃñß%û××ü+FºøaXPaWb®OéÓù2¾p'v0—©ŒÌÔ³¾xw|á€ò¯ç®Qòðf/UGŸ%ÀÂO“ %h5­|È¥Ýy -=¯M4LÍôû©êØBüßc„D²:tXø_°¿-<°°çoaûè–½0 )„÷8F]Ø Ù U‹K!³ÇvFp·]`!µÿ dbŒk;G.|ŸOµ·¦ÿ"ñÞ§×5òVx¤ñ½ñÃwfëÚþ5F²-¾Ð ß#¾ ÏèýÏPýå©…6îüÏu$’X(ȉ8Îý>¹ðqg•\à¶ö>ÄäÉr!!¼ð#rAþs,ŒE,t…cÜ?'.ô…™àËÛ¶oð0/µ¹4‰×2·Ø£ÁkÉ……øp]±8±ð]r¡âü›jÿýèÌvV »]jjN;vû½óÛmò}ؼ1Wî¡¥Þ¿}úµ½k¢+\æï|ª(2'¾M.|£ûTž8Óc¼,=ç‘ñzPŽªréC“2ÎRcfÎË{ -“’'±‡·ˆ…ŽóØŒtÁð°÷·qMÂ8Þkû×3t ÚY 1¾@Ò#¦¡Ÿù*çNGfMð2–F°€ê0ÓÝ,ÙÐ[“N'ýˆU|ˆM©³LÆJÄÆP¡t®¸œû!ñuY±§ ˆ¾ #a¥ Q.ìˆ -˜Ó‡d’~Ó0½/&úºˆÆÞ«&ÞÎ Ìêú1â¦i¥Éx3꼑‘7Œ +@*Ô*”Áëba!éâü©Q.\¤X×2™m–¦®=­zf|Úž. ÙÝÕÁQt74hûÇð8.ëP§³ÛÙCHÁ>ØÈjmâäå°°…o” ª(Šoªý?ÝvFªµH\ Øo”ÈA¿¹`±àO"ƒýþÖÝ…Û«¨O™ˆ+À‚‡Ç7†·´AáeX°™¦’.é”.ÇŒøîÅqœ} }§\hµÖý·`¡=Å[=™`Hj¬^`´1±Ä$:ôäbR0àþêèa½è{±¶ -Û¼°¾I†¸ÆT‚aPi± O5ØÄ­VfÇÌ õ°öÿ‘OõŸ¦Ï¹\½?_°-$7¶d’ 0ºqt­.CÍó&0¦™ìá7ÁtÏvÞÕþ÷šI›Hs†}òÍЀÈÁ˜f‚‡!L>óYä`BB2Žø?¹²|‘Æ[&1ÒÙç4Þ3¥ñ*·/vï*OíäÂëÆUÕ¥NºÌNÿŽŒ”QA‡¶î’ÅÞS¹IQçû0ÀǶ(:I1îL0&‘&¥².F¬ïÄÝ|/ªy®ªÀóó÷Ç)AºN¬SûÆöÇ’\‘Ÿ"¾nðvUתòÈ‹­·Ë_Œì/ä ó^²ˆúQqç§iúš’Ôƛީ#…“7—ñœ࿸¬’ýtÎ}Û¶¥5ƒ1¾A×7H‚ì©,ûvνK³9œ¢¬ËÊÙ{ó²m¯†.ã`ô5,<’égоvžêÇíŒ/é!ù¨öŸsÎ.±@–$Žç<¶Ÿ<Ÿ»`wH8ÇQžgþ»„1¼•É†…ŽÚSEÁŸ7ôc)$Mú œºQ—>U2eq•–/#‹ 9NÈ °7¾– €xã„{æ9ÁûU–&þq©b¸ÎzµíbyWfxÍÛH»Ÿõï9þ¼Gl$~œe? /_ðÚ¯éÜ>SŠÔ¼Ûo|Ž`…Ù2g5Ç {tóXV=á]XØÏÝ0{Û]ó|” $ÈVöí(Ž³õb0ø^Ü°ÍûŸ±ùV2 8ç<ûåráUÈg)³Ë‡ ¿Hõœ¡Íœq–RÔOŠ¸Œ°Ùa­Uu¬‰A…`¾Q4*ãa `ynãÜ£Ô‹ªÖ²kpdþ§±ÁYå‰zPê+Ë´Y¯f‹"Ï‹òª]/ßùä!òxkûHsÛ®³OÚ ã„7àä¿¡hˆ†{#aÚq?d¦Únˆ g¥ÞMëMó —£Ó5¶sÁ5I çeI‡Ò˜Dó8ã:UCÇÙ3ã\b¤±Õ7âÀ[ÂÕY&À»¸/ÛfówÈ…<ËRÿD‰êÏNÈŒ‹ýsÎ IY-ˆïZ¯¦0$Ç™’ FÈæq~ ða\øG”èT{¦S“djs”Ð(aCã½¹ß7õ{Vñ£o´36lëj7œY±c\Qñ»"¢Y–i<“ رAÕ%;ß' = Ðâß… ÜBâgÖüX‡"^‡ÇÌËÉVÃqÞÇÜbœŽ~ÙÔJ”*þ\¢`Fùír!ù6Û9ÉösXÖåØ´^/¶ì ÀBƒEüÌä¿7½snâS/°(›@µJ†…"x ªÍ¢§-ç£KçãÁÍý]ëóøÉ­>{áÅ×ÛÝëqïÄÂrk¨ÌNûa`§ø 7–‡GTw•M.¤—oò›o8¹ðB>ÕŽß²gû5Îä¨1™Lê· -~*ì¹ñ`t.(“CbùNÃù"îLüÖ²S^úV*œ‹³•??……qɪÇ¢Š”dÄŽ©ç -‡¹g1Ü” ö Ô’.ÙØv&#øÿ­ˆÚõ[÷ä‚mp6ŽwçãË„ç^;î|;ˆ®X˜µíè’FŒ«wŽÓˆÞ÷%èB`8Ç1ç*z/.âΡõêTÕ’¤E§çªÄ - ð¨æƒ -4¦íÞ>Mlo¸ëJº'àîQ0ÌÑî¼1Ó,øo¹ÌîÃe}kÓ:X,V.$Eî70HàX<ôLZ©Æ -Ææ|¼ÀèäÂi• h2¯™þà¿×W;h Ù¬öÂ4x¡\2ž^çí¼ÞyD>¢ö’(ë-› $ÂÙ;ÎX¸>„x-\¬‹Þ-’ ,1­º,Þ(K÷hûâðNÖÓÊÇ$éºÖš0e×uG˃ŒÞ6LÖE;–‡…Ã’pZ߬^£$ã'Æ­\0³ÎÔ,ŸK,Týcžf f¯IÏ+–!2k&+“çõÕ´z.cÕ¸ƒ[Ö'ð&&}Äv¾ɳgÇáæF:ù§NiM3zXÓñ“rø•Ÿoa<`Ö½¿ ÿÞÞ›ãlX‡9ð|e£q·ëá#ñð€õPØ#…a‡wQšá»9\ì%ÊVŸ‘ çü{Ök›¼[ú`(˜Ñª# Ù4»éÁA“ ä °®r¡ -¶sV]¤ãÁ•ÂûzwåBØ©úÄëN@@3(ÏŽQ @}¶{ðh‰CçkÔ.Ï£õã’cdüp,`*;°<e.Ÿ½y^ìÕL~Š\ø>ºÝ7/†9À˜ÄM/}ë\öÍ«¸Í­ˆxXÚQ°vÇãBðw¦ô°0’Y³MÈí€ìr0naaõÙ³­O&z>ëúI?Œm3>f«ÛÌ6«¤Š†0ºŽóÊê6™}+C¥Dñ<[¹€*a‡_Ë8Zi³kãÛ 6;°€AIÄv”¿Œóéµã átO×9í¢·^3-·O>½~w“¾#¬ %hßÊÑüœ)íløÀ^d$vNEõ"N¦ë%žÂ ¹ökl'çMÃ'ËÂY%~ê{ù‰ÛØu€qÉë{Ù -HЭˆªŽõ˜E ¬¨ÈW½1öàX¯²øÊrÂBÖæpѲ̂OzsÿbÜùåèˆ;±ÎÕ[³Ûg°0««jËHÚd¨¤ÄG<<'¦³^¸x[Ü9Úd\†þ ®Â€6ÖMöº³åb̳€#ƒ1´^U6ûni$áêGò -’c°ôÆõØ0‰íÅ×ø bÁ;ó’Äëº×p$ý¤¸ó;üDñ×äô½b<`Á*7´šÏa¡8 ;/ÕÊ[‡L Ðdªƒ‚^aíµU—Æ'°àír;`jãMÕ!;±0ÏÇ¡(€8£<² Bv&ÌÑ<8µäö¼óþU’Ú¸ù*ÖV, ˜ÀÏ6½HÕø3r¡AúžþèeË‹úõ±qêûK¼«¶-ã3,sþ•X˜3ßO?^Ó°‹`[g϶ËÂ!@ÃÏz™ÖLög˜')@)no`ÁºiA‚ìý¨ès]¥ÅÂÑö*Á¶§üHBˆïñ#Ŭ>DÊšºÁÿÔáïÛ;ëug}^wаþü¸¦>œlêËÁšÝÆâ)Ÿêš4:G_¦#Ù<ÕþøSvÙ1ÿ;Ü9úóCåÐ -ˆË}×/œ'ƒ½AU\P¢ÎÕfáÞP›‹ú Öâ8\d\².J§qçÕ5Õí|¥#9ÅÊÑ„z×k­<÷Úñ…DS³õq‰t‚M€Ñj£‹ÉÃô‹Ñö3²Ù¥¶oF*/?QÓ¦õ‡ÁfQã`>F ñdŠ­ò"½àb¹îŒo—« y…ü í… ˆ¢(ß^‡Rà<ïn$Kt(]ØðPÅÞýYöª–)ÊgÑ Bã¦îÉ#6¢m}Ä‚UAd­“ðèÃ=“ ö Ii}Âk>Õ*²èÅ°ðÚqç™rFvõ±Í©ê‘SKŒ€yØ=5í±€´xd€;ÇþÊ!Ò£6} Ë6lÇZ÷#Ø¢`{¿ ‘{”h'Tå³qçÍvοT.\•µq—Œ—> eJò¹íæjóîq5Ž‡t¢=°€Òø²æF^–AîïU«5éðKH¦ÝE+ÖÔÇb°NÂûùH+hâ¤T˜³µzn-5­?N.¼Äú ¯äí®±ð•¶sŸbV0y·ùè¬e×ÔËã2;T¶åd›Ý÷´³« ^q‹hˆ[¯¾Ö«ÐZŸP@ UŽÎ¢ [„!Ç]4-d/OvrÁš Q‰ GŠË>Ú>ý*ÊttráP!¤ä§ø‚õ#U_‰… Îv4W—Þ­ëG‡f–i·Ü¼°k÷²úX˳ÖñŒI•Yq\¦Ž’FA•e›mŸ°08g5:Й;cáÒxC.„ÖëU›é¶üÈÞÝêGê^¬gÆ3rÁ–t;ö¿L}UjkC]½»Usš;-‡n$AØiô̧:/)ÌÌÛk!o„ÐÛ?Y *Ô’Ðv=uȈV<;[| çs0)omù`bŸ°€5®ŽÙXëÞH®å‚÷YÍö6КCbcmŸ-rñ…WŒµ-½&÷ -oÚ’ˆ-ÇÉ®Õä¢;š§»XÛ…ºÁùᕘÃ-3c7?ÎÑÚˆ7¹pw^SœòìÌÒÁvù±«ÛO7‡ w°#8¸¯ò ›r%ìÚ²òÎ)žÃÍôzXpqç/ÀÂ6áßJ«ý©mƒÈÊ‚57úFöÍ–îå#íÇô¢<˜¯ÅPXR– '?TtS.XŸèšÊ±ïjPXÛdè`EÈ÷÷Xغ@Åó¦®å˘–[¹Ï8ùg4·óTWQ<|ˆ ïwŽ½tíZ<îcm›wu_MI·Á±õƹɳOÎüºÇºÐŸ+¼²,Çþ÷ýHø5ÚIñ: Ãf³Ô'd—[óáVW¶qÿ3:ÒVä%üòç0^7Ó¾™§æñ.3oK'©²ÓÊ6Ø8tàúË6áè­Ÿn=\Ç.КN› àçÊçS}#¾p¨ý®;1n…Ð[â¾µh¯ëÂø<•çM,,X+p£^bËù¹ã·¿Y¿0N]päçC–E¶oçn¶3Hˆ% -ª¶?}H°Öиs5ï_$é»*ÈqçŸ)Þˆ;/[KG,V9gÏ0Y‹6±:’ªl¼ðanµ4ÏbaCÀjä½d5ølßQ¿° -%¸õ}«Ž3ûÚÆÚÐá;¦Øsï#ÓQ[;“ ãÚZãLi$xîÜmqç,\ÜùA>ÒQ0äY5í¦Â1ôm—ùPϵiL]t^L?ϻұg°°»ÚÙ@Ö§ZUï냱vfÝ´¤ëpà¦DY,ØŒýlo3±Ž:Ò^¸Ùâìl>¡>LZ 1ÌËâäÂïÃÂÙú +3Æž–â¬îÉk‘­ -aNÃí¨[Ÿu~ ƒY-«AŠæAšY¦î’÷õÁØêÚVo3]Ž†v¶·:”UȈMÁ8eòaÉç¡ÖnKÇ‹BkĪqX‘½3e§®~?W.dRÈÒ±ÿ¹)Êso›°fêäÖq8MÑ–‘œ¨+àF'Öǘb¦éª£„ÏËÛ8l»Ú6ÐäuÛ@YÞ%¾$[º¶šåØÿo­!8¯í;ì<Xô†Ä|Õ ÉxìÍ·“Ú¹¡ÝPOì±¾uÞVkÇ‹Ÿ+¥TãØÿA|aeÏ-o­²yÔØ ~-<Ëöù>‡i³y2›ñcó{Nµ4Ïaá¸èA³¡{}0Ö‚þµ&Ìç«Æ4GžgKˆ°ó Ñ®r³”¢¯m‹¶™Ö1€qj[ø½©^˜²‡Î[c³Ð]|áWcØ(Øjsìê¾…e+Ð -.úÁ!U'8$éäYv -"?……­9Ë~ UNäqýÂ-/±¾¤ÜjI0õWkú“’ðÞ0©.ßÔ¦p“~ˆöµp¢:h€+NðV¬º7® `J–Ζ¢pqç_Žûô³cÝÍ¡æà2"†KKÓy¶wâÖú…·«§É2[_Í®ÂØvߨk»éqEó#l›–Tå[2’ÍGš ØÎŵ‡vËbá¼ ÂaB‡Ýmû™ÙÅIª}êyvì¼lû#9¹ð‹±`'kÐPÈíkÙ©vr? Ïǃ0Õm‡3wPRb¹BðV¡‹]°ÍVµ­¢”¥äázmq5¯NÍ+- «{æÊ–9ƒjÏ•] 3’<z˜ò±5È$c€µ×ÄÜ’]HŒ!ø\¶Ô‚Œ[~Ðáٮ+yŒŸ{Y~œ\P˜oà8ÿü;©²9¸^Ç“4ɫή¦Ófy2ݪ9À@ð ¾´«hzþr±ò-fÓåþÛE_dL½|> ”ŽÏS›§wk6&)¾V‡?ˆ1‹©­¶’7›âwLT¼ k1Í© ¢³V«ã’ÏgUp(4%‹ŸW‡CýÓ¡ÄǽñçÉ…NJÙ;öìSÝ%®‘É·K2áý%Êñ ltaWW¾ÌÈŸ[º|«jÛßn6Z—΃·ŽÐpÁ$¦Ã¢ÒÛ›»c»hÐtyIôìþ×Þµ(ÆÉ*aPQX.º -¸°ïÿ–g7Ýlú7—¦MÛMò­—AšÌç {›î«½Ýúl^ø·¤Æþ.ÜT¿¦™áÛD¡Ÿ+ŸVÑ‹JÃHø_×_ü·Ãç·®Æÿ¤ò°ÿB-ÿ@©váSææÕòÛKÈ[™””8ì3Éñí0ÜË­Sç©þR)§å®\ø‚û- e"@õ—laòǧì ãO´ yýÂTÕÿa ɘsåÂ:4ŒëÅ0šÅå¼Ê-É8Qè®ð¸m2ï»å>à -Ù7Z†_øÌøB-¿ÍCJj¼:7(÷öº”wÌ…÷ÛÉžn-› C$¥:í)þ´žu¦…ºÆ+þþ¢Gg§TK)Ròà‚S'ä°EvÕZïSbYËBÀc‹Æ•Øãm!a:­Ï Fµ • £YÐÄêÙ GæÙrî€ iS‹èh’‹l¶h‡¾ï÷eC½Š 0'yY½t™/B¡zãĪ]øP9ÃkGW.|YÇyP#ÕN¶jÃ’w]³]`œ$‘À]Êý› ™È¹ñ‹¹Hè_4Wä/£Gg-Ü\rr¼Ï.4cÍ›÷b)F/+¾nÉw™ ›šNŠv!ŽLéÅ%àB´=BeCSMd>hA®VbŒ!^¡Ä‹Ð~/ü‚¸s-¿ §ÌÐpË ?ìÂÚÄ“h·Ì…ÕÐc*ÈÌ%Ö§ˆâå¼È°s!²ue§òwþ8jÜù }¤8ÑÙI:FÙš›]X Wr.Ð’es&Jã „Üfè6œ{?eWéº0ZãΟå#U»ð•}gÊí ZŽSTxÀ…<ºœ™çs›ä?Häi·Úz’4ó‹†þ·’ã$¤å±5V¼©r¡ÎÁøãÆT™Hô²ÌŬÕMÉvtpÝì–,ÙKæB€ƒ¤QDT/À›' -ZΥ̾éëökûƒÃÎÓ8¶• _ç$A¯y¡Qºç3N¾ƒi.¥äjÒ: Žh°Šêì7M¿k{Ë>žæ\×þ×øŸUè(Þ3é.‚‰»°ýhº^/T.ü¥–¡{ó¶>a;íÙ†þ‡ô©qçÊ…ß®Å4½\Ó ?ü¤ßùýÞß½cY\(õ<(¼hCµ • ¿› -¨£¨{ÜÇ!míËÌMÓwö˜@Ýþó¹îãÑ÷Û…¼1é\5ÿyß™-+«\xý¼ë|(q­’5SsaœÈëožN&zq´‰¾»OŧöÌ8yˆ#2°æV«ú¸ýÛõ'Ž=Õ~û‰™£áÛèE<üõÞb–ècµÕ1Õ¼ŠqvEòN ÙÊ‘` -Ê,ir&ÙÛef"tê†p¸OåFxQËmŸkðÓ…d.”3xßj"Ü‹\! …ó:ìÏÐ{>Áçpˆ`¨’ -«?w®ñ…:ãT¸!&Ý“Qˆ•bk¹p ì‚fS&¤K´çô¤¢kH¯{.E«7Ǹ$ ÂÄ]Æ®³R\(n¸t… x RL³µ÷dh¬¢¥ê$eóÝÁZ9a'$è@„\4‹ÑÒ† ôf™\æV†wÇ*jÜùcT˜<Il:¯ÖÅZx;*b¸<©WoYäI‰Ñúqjl|×Àñ-f¬Ñi,/ßФ.££ˆCbä~ÑÙÉ‘nE\PÚú¦÷òâ"jã2*±ç¥i¢rˆÇ•Á‰áñ½’í¦Ä…¨+EFšdG?bªT}¤pa1¦ñ'ä™1` „ÔgôˆÀÊÓÚÆ&3sw%Â4-q›àXÙó•H:¨&Ám£¤Ì7×ÞwÈ÷&©l2Lr'¨^ç ŠÈhé\oƼ™{ž°tK5‹ BPsBPñÕùÁPå´rWp–¤›«]ø» êœí7 eNœsàüžô"“ 3uæâLÄ™NÔhD8W¸ ûˆˆ A[¹I¦g'gËiŽ rfj£½oG•‚!™ z•`ÌYp° q@"å~HÕtýŽÙº©ãÁrpºè$œ ‚¡AŠ`™·w„Šç÷Ú…~]׺~á!Ÿ—ÎV.¼BIÛÇ6sa¶ ¢uç"ÍÎ…èÛv» ›Â A*\ bÑÄãd˜.ะ^Uއܪ³]™ à5VÅ“#¼®†nRÚ8‰{2 ~¡5›œv.p]ã 5¾ð{¸ øÕŒ¾EÞj*9øHi†÷ünà˜ÂñéÚD—="° kìõ& V,OÈÞÀŸš(™S]d»piü47ÑÎCöå4ѵië[=¨…‰tE¾5Zë؃üåJ¹ -\.!³]X<2À4èˆäŒòù@R;W.ü:.,Qpôl…„÷´ðB¨ úÎ`ò’}/}”\HJÊûxÂàÃ( „¸ Ú<ã:«ÖÅ.\f…TËyQ lW" UÇ¡ -œ¡Ýc®xŽ7`àNRAåj[á¹ñbœç˜D.å2ð ŸGíª]¨\øudÀ­]‡SßÅÓº >.Hct¢èh³,ˆâ~mØF¶åMì.–m4µ ø?Ú÷©†Ó!4SþgÛ¥í{ÚOyO0¸S´¬M›ì,§©Yíxd-o·€f[ÇÝþ¨°n8š´´æÁø”À3”Ê…W-ƒÖzߊ–Üì鉎¸™.¹Š4Þãm4Gãv2 Ó2a(”ƒò®çeÊåðIžÒN%­Ã~tè÷>»)bøp»•Þ=š³èwÇÆXí;?Œ#Õ’$öMo1qô×äÛÆ=ßÞ[3eäaÖê[ã ²òˆR;µÛ4ofy੺óŽmF -§{¸m;p˜Úi»Ã0eñ©-ÕLm/ˆA ¸‹ßaG€©TÓê"–ÑâZ‘©‹áôñô‹ø s5ÄÛC¼-¿!ˆO}©fjŽj²X³ã_Ø4­åõ‚ð(éñÄŒÞ_ð>¯lã€ë nFœsv.¨ hÙ`.€Ëfq·ßÄ£9b¹‡¸¼«f9ÐO€—û"¶c^Ž?”p¹»»¿¯æTnÏ‹Á³vçÆßð(®s¤Ñ•FXæ`ø¼#S-¯•izŽ¿î ?%ÓÚ·Ù…oJü.¬wZ¸ÜaÖÂÄ%ÞÅæ¢Ô»ƒ ݸ0Ø\hŽ-LAqþ¦ÄöÙR?pA?p¡=¸Ðþ'Ôèkù§Šú » ?Ï.Ì?oî(õš]`ï· Ï©dNÊG]v¯_ÿÌ×ùo¶ >’)ø=»àÞfô›ìBuáÿ®¬QÁ¿ü÷'€ã }FÀ…¬ÌRŬ¼`¯â¾àa<â7$ vÉâQ©¾`/˜ÅùîsG;nOï -ª¦ˆeÔ€"S -Z‘©ƒñõNür‡¹”gAk†‚¹ñ7Dp97â àt‡<ŠÿE0îYƒ›ÀºHU“ ŠįIBºuƒ9"K’ßç­A 4ÕŠ¥íEV›'qA'e¼Ñò†¶mí=ì³ +)«’˜ @³&ý¼i@»îòÏkâÛ¤"%£û+Iã†(ú…ÕÎ@ã’:±,#–¢®6´Ñös£ÜäÿL‚ +ÕfëÒ6UyF-=`QˆÔn Bi]UíÏtî°Ò¸ÈÍ£ÜâØ~»Ëé¥ÛŸÃö7Ú§p"_2ë¾.N ªÓl>%Ež!{ þô‚Ã7x]në¼lQó9:·ô<™¥›¼Ì›¶ŽÛªþå+ü;¡“ÞÍaœ„ŽŸ%)-þÞß*8]˜¹I÷yn$ÐuéùHì+>‘àÃTµ`@˃HÒª$æp|æBàfÁƒÎæ×Hœ¯¯0½\§´P“{^¤8q½µ\ïÈãÛø‚Ñ“yg‚Ÿ1³óóF*1âÃã0A¢(òÕ\è4ÔÞÅ­aù@y”æŠIåùOÌD~Ï ü0¾ÿ“!'}O´·Z©Ù”'º)\ªÐûŸ.ŽÈÛÜEÍÝv{ /µ/B <â:\g_ãͶÈhso#ïÕf§9ŒxV+Ä”UMüæ µ'GÍV@ŽIG¬h@3Ulœ6ë +MÝ›mO’u·Àß°Æ[U&ÅÎæÄ€¹7gÐqéí™’bX{\KV{æÆÍp¼pPù ×úùu‡ÃA†zZU¸TV“ú8iÍÑ:£EÒסÎãåXŽÚŒµšDz¤u)6$Ód‹‹ GZ¨Gš„ISãÈ:Š2ì'”¹‰KœÁ'vï´ÎŠZé(Ã~aX¾X÷MÏUÄ…—™;RÁt‡‘‚á˜ÉU›@±Ÿ+3q05ÐÀ†½ù1Ph«¼\Ñ$k+z¦4EëÁH&½ÇUìñtoÜo|¤æzÑ؇ü§ÄžôýÒ¡ÁÜT"ê?N^6éy®Ç»X°ÇÛ}çüc5eïendstream endobj -5269 0 obj << -/Length 107 +5388 0 obj << +/Type /Page +/Contents 5389 0 R +/Resources 5387 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5391 0 R +>> endobj +5390 0 obj << +/D [5388 0 R /XYZ 85.039 781.388 null] +>> endobj +5387 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5394 0 obj << +/Length 3072 /Filter /FlateDecode >> stream -xÚ`ŸÿÁÁÁéééÒÒÒ±±±fffîîº›››ËËËVVVÙÙÙ£££FFF666µµµ&&&ñññùùù‚‚‚­­­õõõýýýŒŒŒ“““uuuçççÞÞÞ©©©åååÿÿÿ >Œendstream +xÚ¥]oÛÈñÝ¿ÂõK(À¢¹\~æ +ÇI®>$97Vw”–h‰gJTHÊ>÷×w¾v¹”d÷¡’³³³3³ó­¨Óþ¨Ó,öŸ¦™òu–Î×'ÁéV~>Q‚1”©ƒónvrñ1NNUàçA~:»èÄ~ëÓÙâ7ïê—7³_'S­µ§22MÓÌ»úty;QÞíõÕå'\Š¼øüzýe6™*ïúËÏŒ8ßnn~ŵI¦½ÙäÙ/'f–-{ °#O?N~û#8]ÿ¿œ¾Î³Ó'x|Ëë`Ê#-ßõÉíÉ?-)^‹Ny×1Œ©Êý<Œ_WS¢ü(ÑVM!¬*?cWMqàÇADjÍä>ˆ™€‚â8ðn‹õ]JH¯Ø NüqÓV›¾lñ#iå5xmß½¤9äUfbVÅGîT%¾Nˆ×ïÕ8]4“0óžºÉ4 +"ïËì" ‚€?¶° |NÂÜëÒ•í#¢—(J ˲­è:„4“),Ϋ¢/Ž „¦aê5mÏŸOU¿â·²˜O`eeÐä¼ÌÝ€“8òf«’h—Œ³iÚuQ×€ùÌGôðZ<SX•¨CPÍTáEç$ì}ƒì®Qá¹×Üj{ŸÐZÉTÕ[x;‡Õ4õ®~ýì~~¼þô¾ÞÒg¢÷s¼ß(ÃûEî ¤yô½cÕ(Ô‹Út;vKú"Ι§—9!ãÑ[¹íÙVu\·*íä¢Þn­íP¢ý0¦Û “‘Ú'JîJ¡ÛVða®Óœ%lÓæÌÛka”8:ÃH!*-tƒÚ©ÆTnÐ$È™P!U*C¸ÅïžùbÊ5ˆÏ9Gò-†YŽ^ŠDÓÃÏMÓóKkô6øŒ ¡4àßѵ±a#PˆžYéÏbÑzÓZý¶ éÆØ:Òÿ7 P9¬`/­ÐV嬶ü\Tm¹&û‘ë¥5°!G/ñÑ` ƒœ-¯® kÖBHFÒ^‚îùÌØtÙ]eÍ>ÈèpéŽä.«Í’á}S/ø­¸c؉ r±‘%<îqÃ5"麸«™­7¢ îÓª”£À¶…Ýg^BE”]oV+æŸÞ 17çGŒ¤È´OU‡‡Á˜v˜Ëa-ëŒQù07¯¨i—íœãd±ŠEÏ‹Ï£R+d̆(¾dä øyï;dà ßÅàºÕ{Œ™}Õoh[ˆÊtÊ­‘åXØ<0 Hñóºs_l·zždÈ „ÂÔ #¡/ F$jæÇçC :Ãà!ÿÓi8¸×ÖµX°:죱p(vÂól?¦ ð†®€­‘l~³<㋈ÙïL7€ˆèƒ˜…iÝ y^6:„xXr…$á»ZnÄ>5%O\ª›e5‡B07%›xHt§ð´Ù§î+Ä­K³ÏIržsZ¿‘ŽèÔbÁow”¼ŠÍÜ2ÛÈ¡÷ì˜Ä“¹8hÀõ=ŠZS§–døTv•„VŠ~+r @8&b¸™³cþX”¿*Ú” &sO^/]³–b±†hÞ563bјðšz¿qðïÏÏü±ë܈"üfá0,hï¾ÕcYhÕP]Œì[ƒO‚ùØ€’Fcoé9ØÂ[ÑŠ­?Mè^éï'5õÚ¨ o€…Lf«1E\\u6œ m~ 1õ¿ÞÓ8ò6ge®Ix<î ?‘áJ²ß¡às +ïhVìàl†¶^*c{–{ßFƒ•íå_è…¹E³l ±b6 |[Šj¨Y¥62žÀtÉ9w±óÝa_zØÑlšÙ¶u–Ç+ù8 ýL¿^É;8/¶QžBw–ÚŽTÚŽËǦZX9 l”º쳡\-ÜÞšdèg’~Îqv¡Ò—»–’FÇè\x:”®¸2ØHaúžÔ‹ GÑôqñ£<öÕÿßÁy±‘®Ì׊Ã*fË( +½)>ô¨h¢üµdø…žö¡Ã²1 ¼;©:p ëš•5‘’äeøÒõôtƶmî(‘íwÔ‡ÞgR+¢þ‰J¼ë9áíä¯e] 興“ÞæÍÀÑá^°éC‡‚„„t·DKç‰÷'±ØñÇJ +)ñ¶<Ù4ò‚å¸ÒCV•‚ ½:óVŒ?âµäµ¦²”OúwÁ°BP)£0Û!•6*÷FƒÌ««b¯èúóÃÔÊAš:V©Ž ’‘Ó½ø6%©kŽ²XoeÊûŽu‹`CˆzÓ3­¹›ÕTÉè òXY3B(_/Ó!s+,ë°JQ ž6&q¥‚û[® a›M,D<ö?À£ˆÕ÷õ±²m[P ƒ€¸]I¸WhC|vI‚"Enü;ç`N¬Yâê¥ëoç-%c¡ó¾­ Á÷­Ñv/¡´£B*àaï”+Dü†}ø­9dÔVæp阘M©²’èL \Ê +Þqço» —"³ÎC?IóWC“ƒc#säÃ}8¡I'ÊWyj"3„.ä ¸8ìÊþ%FãÌ‚ôuFœc¨µæì?3d,ÌdÌñ¹Ž½-É5j"9]÷¦M%ozÄ^”²§àÇ·/×ÿb,èÄÀRbôÿý~”ž¦†Ç]ûÂpªˆÏËÅDúíü`<€°ïÕ +ꨥÃÿˆÎݴǪ<¦²TTT‡yhzCÓ7ñ0(0˜…™H!jkç"¶¨QX®±ô1åJ^*ïx#‘®úaKq`:Íü0„gû)X™.´KÁøê„Áž:èdÚµˆ}š¨Ußoß^\TÀ3Z©ß5»v^B-½,¹ÂGþ|•…#nÊþbŸc¤~e§ažg3\ƒ3u-WA‡–E~ôª˜M_Œ¹Zƒ÷›Ûb*rÃZìPºcÜCAj^ïlÎX0\òc˜Ž¨Uû÷‰@Ö“7Ô•„ÈÉ‚mÊçD?³q+”ùQ9' VqâC‚Ú›àÕ¦éÚÈ$”jÔ‘Žú»;:[  ¶©mY‹IF¢­#+1¼ß—EO Ë-¢M¾¶îdšT™(“йHÓ²H— û®xƒ´A üß lBáÅiQqÊÄÕ¢ÚPªV‡;U[.˜þÈPÆÝç7ñgb}@M“Šó}ûH=T‡‰Œã öaL&ßWJY¼aPM—º´m9€Ö…¨y^Ð}+ïR¶’ÒÂØ{O;æô/·kܵ猇ùscz%&:P¹ÄŽ%Gâ3ŽhÔ¨c=tBÔiÅru1[ +®—OüͬgĺÛ=a. bÉe¢6D§+£Þ¨TbfD£œ:»¶àX=xîU©È±p¾(ç£ &boECBdn~|K6?É´‘›ßhgoê]šée$¤2|~¾5EãW,N®ŠóéÎN®ƒäxÏ8¿¸@Û–c œD4A"¶ôC¤§ª[1u„.×êÝ0b"Å à´{/7ᎹØ-eà +íþ°p–C[6Fì·5©Óöºx‡^%a©Œ Sæ…„ OhJÎûÈxZdï=¦êzŸ{›™±ìžï\̓»%¦Cš•ð´ëŠ»Z6KÒþ‰ÝÚæô“€‰”íX3…a%ð†ñNe£€y~õJ½àÿ턱ÖÃ/b6—ÔNO¥sì©JêQ²€¦ˆòZ˜—­Pá9EK>+§ò/gTN-].É£à9ÌTÐe³ˆË÷ñ6Ú¢Œ>hÛºiu»-ç^R Rhº8nÒhnóXÍK3dlÏ >fÐSÙ̱v§dh3‚K£°¡!ÍoP„“˜^ªñU„cƒ×k|çÅé‹RX­h·ÆWž’ñËw?%\MHyÍS4M“c(ªþþŸ*öõúoø΋%~¦ýTr,ªxO‹Š«ñ xÞÔu9·c0S ØËæA;7v¦_ã¹¼;Fë‡qi(×ìÞo_jpèKŽÉÙ&ÿ¯ÿ#0 š´Ÿéü¸q*à *0TÙ>¿±Îü8Ó‡ ÿMá$9endstream endobj -5263 0 obj << -/D [5261 0 R /XYZ 85.039 781.388 null] ->> endobj -5264 0 obj << -/D [5261 0 R /XYZ 85.039 758.673 null] +5393 0 obj << +/Type /Page +/Contents 5394 0 R +/Resources 5392 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5391 0 R +/Annots [ 5399 0 R 5400 0 R ] >> endobj -5265 0 obj << -/D [5261 0 R /XYZ 85.039 758.673 null] +5399 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [377.225 306.326 539.579 318.318] +/Subtype/Link/A<> >> endobj -5266 0 obj << -/D [5261 0 R /XYZ 244.345 359.014 null] +5400 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 293.079 108.944 304.769] +/Subtype/Link/A<> >> endobj -1446 0 obj << -/D [5261 0 R /XYZ 85.039 221.947 null] +5395 0 obj << +/D [5393 0 R /XYZ 85.039 781.388 null] >> endobj -5267 0 obj << -/D [5261 0 R /XYZ 85.039 200.751 null] +1306 0 obj << +/D [5393 0 R /XYZ 85.039 761.463 null] >> endobj -1450 0 obj << -/D [5261 0 R /XYZ 85.039 117.943 null] +5396 0 obj << +/D [5393 0 R /XYZ 85.039 743.459 null] >> endobj -5268 0 obj << -/D [5261 0 R /XYZ 85.039 96.082 null] +1310 0 obj << +/D [5393 0 R /XYZ 85.039 522.834 null] >> endobj -5260 0 obj << -/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R /F20 2865 0 R >> -/XObject << /Im12 5249 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +5397 0 obj << +/D [5393 0 R /XYZ 85.039 488.089 null] >> endobj -5273 0 obj << -/Length 4410 -/Filter /FlateDecode ->> -stream -xÚÍ[[oãÆ’~÷¯0ŒDû›‹Ý™d’8'›xÇìÃÙZ¢GŠ)Q‡”ãñ¿ßº5Í<,c’ÝÕÕÕÕ_WUw—ÔeÿÔeúI/ãDù&I.×û‹àò3Ôüp¡„b)$ËÍûû‹Õ÷‘½TŸéåýcË'ômh.ï7ó¾ýñÝíý‡‹¥1ÆS©¿XÆqâ}ûév¡¼;.½ýxóËýÍ/?à—…Bå}ºÅê_?.ãÝ3ÑÍ/mõ»ÿ|ÿŽ¿Œ,þ~ÿÓŇûFÒF*E1ÿyñ·¿—ÒOoÒäòÞ_AõþäôCk仸¸»ø¯†×ÙKn5¥•Ð$~˜˜±ZTØQ‹RÚ7J_Æaà‡%½TY}Ê«S¹XêÄËëÅRyëã78ª€ë°¤‚ÁžÊíŠuêe‡ÔCqFMˆÅ>«Ýa$m3P´µÆû®<üåÄ­^ÐSYaå+—ìùùJ5ÏÜË6ïßñOÎÕ1­kü‚.¡ý6;pÕi _»ú_q@#K… -Ki€u¹ÇfÐÖ&Ö+ùI ˜Õ„^V ŒJiTYQ8² VïåyeÂ5–—û}3V*Øe“f›Í²^Øê›æî˜â‚0(vO2D¬hüôŒÏš›r91¸#Ö£ÊïÜN\yåi›W¨§8t‚%•Ì™Z…oå±ÚÁƒY5" OnäŽï¦BÄ¡wÌ m[¾!ð”UmqãÒ¢<îsîƒëi ˜0ò~Ë×N,=&ÑëçõBÇÞ¶;øÆžÕ¼ö~@¹iŽ€K|¹í Q†K÷eÜ;õ3—ãÄ £5/Àñd§œë]‡ë¢¬©¶xe\a¼#·¯I½ØÃC!M_v8xÓÞ·XÇVÇŸ1QªüìÙ9óס¡u®¡Vù)ª¦]çØžÈò:“úÐ+Z¾0 …ð@4Qì½ÏÖO XS05õzN0áwV°–fÞEQàáû-b?Ò^á`I_8—ˆ.ú U Ož¼Wþu!J•-Z8»¹E"ð8PÉ®^ø0ÞÕV¯‘Bö -´”€BÞ#C¬M<·‚pŽ˜ Y àSóä3†Q03ëµü\eûšMÙ¡ ‡™h6:(|"H1PÜ]äË*Ï6¯\ŽÃ†šBÈؾè¶ÖXúÞä¿ïÖ4] ê+¡Ý‰<™H’»õ”UˆÿñH&µ‚O©]E£äïGtÅïÍé²ÆØ>6óÇuWǪ$·‹¡-®˜CùÈuÛ-™ìÏÒyG[¿aǵ´Ã9n” Éùý“%#QVOPóÍØäÐ TÔÞ;Ö­z墢#6*ˆ~ñ1k¦ÂÂ`>ô90¶ñ­ëTÿùœ?ç\|ÈÅ+±±T1[1¨øM¨ÉúOŽŠ±ÃÖ°#À×fbyâ©wq$È´™6 },]’é¹v.¿@1QA³QÐì ÃÞÃ”Õ -õ»SÍ/›¼ñž»CFŽ¤< QÕÖû¥"¨y’6ܹQåä¨@?– ¾<× šQ¬–Ô`&·yÍ‚²ÇîÉÏ…ÕÔ_yQd_0JˆÒ1LÁžuü5pZKä„5NTãQPC¾Mó!v™T·Q\$c¥(-’užçLöHFbÏ\ðòXRÈEkõ¥Ux‡]H !Øû+ ˜¹ˆÆcÝï :U­Õ)0Y885ƒFšéµ‰ Gw5î`±Õï‹£Fc©+ŸÉ,n™ä‘ˆo{4$Ž_P¬&j‘Ð54ƒL+ʬøë×;XäAý”§±ú™íß3T¹:sD~&—¡ }¥âIoîh–¢&ιsG„]?×£uê+ìl‡B3ê°?À6'êuw¿%Ëa€Ú÷ã½õÁ‚?l„²1©4‹­9rVÈ>ݽ§5º.·*ÖlLÏU#BÁä¼#À‡s3íÉ BŸ&ÐO“°b1ØXN­Êå§ø¼éÆ°†MFœ»š&~õ½é+0†=$ì$Ý\]¯À\¯àeUƒY¤‰¨ô ¤´Dg"Dl‚«I½>AÂ$ÔçûšQŸ}°ØØWQÚëSàÚùøêê^˜g`™{ -ˆ6s©pxWO!ÛÚÐí‘ÍA¶6¹t0ž fð„f<ЕÄ›e ÛÃMãÊŒÄÐØõ÷AÏ.$˹|G“p -#_%ZàÄ -`DN¯wÁ¿?dÏ›S* f¡eñxD«óÐêÍCËQ˜-èø¢ 1ÈÁØœí\hF«¡´ -{3ÆtjÏ™$¬“„¯s&I§|n SØ]v7è•4œÆÖ¸fäZ©òU€Ð¼p.)N¡6;ïØ“.UäG¦ëNò/HÚ˜ÞuŒ¶ö8­d -Äl³\F(³äôf:ö£  ÁHh µ3† έß@WKt]BD8_×h†§Ü\dÌùN…fÔéÀÍ¥>ì){2ªl f-Öõ-–tQÓX.¬ í†‰€ˆv·§w¶Í7ýVÎÆ …Ò±¾ÜpýÎáô‘×Î3À,²‰ƒYà+Z×nýƒÌóŽ!VWjb:òcm߀XKtbB„]Üâ¾a„±Øâè|¯B3êu€±È·¦ß«xÇÀx‡"PÞ9¡àmg`ÆøjÎU¹žœ -´üùöãêçÛïøcÆ3BÍpN…Ý-}N~ÒÂL’Ÿ„ò/¼‰5@š ²ýq¤µæp _pµ6âµV#a­€_» B&g•ê™°Ÿ@a;ÔÔßcèØNlHulÆ– '¯äjwî¨Ùˆ"áÐ÷b?Î÷b=G‘ðÒ¹¿à6ÍNb|󷦶»3­ËõS~Û õJA¤à+sªù}„ ?“7PÝAµ¡;˜Ð l¬9ß¡ÐŒ:Tý¸Š“^‡.ÊÓ“˜"¼ž¶ïعhê]Èvs{Ë/ˆ@Ts­0Ú¦ÃóKêbFV(évE÷0›à ǧ: d(•œ|×pD¥Š½€Æcw:TâÂñêªÁP½u¼Š$´‚'P‡tq3&¡Ÿ(ç¿aþ¯„)à/5>/SGÒÙ ©ÔA¸¼ &: -}XjÂÕÕ,,­ùâ2#Õ¾r ˜z¢YÿPÁ;ÿaà¡ÁYØ®às‡IaÏ_ô.qú§<”°ZvxZà‚G„ò­Ÿ£KF«&ò«æx—Œb_Nº’ÕȼZÉ? ÖgtÂÎ çôkÈêx—5 ÁˆAœÒ•U„ — 3¬?%œð:/\(?€Ø£+ÜÙD§3oë†æŒ­f -dO§±­6€‚ØœíNH†Ý NhÈv»“C“ΆX×%ôàvrh¬±žì<¼¿¿å··£­M2µ-RœTBwqØxK•'´¥`¸Œ 0`1Ò?t«k1K§æc¢ò gœø‘q™ò×}AqÒ—‘30£xßQäatñî³™‹MN`pö)ý“ ¶ÂÕŒc~pB t#XwW‡åt>–ÏîìÀÀ°p‚n]× à:2jÆ ¨DûÚ&neiÜ@â4ë¢BØâB0ͦý¼íÂî¡ >çt ÆÁhxªOÌŸ²Ž×²Ãll9 ‚ôã(izœsì‰ìבLx—ÌŸª';šä7„ Q¤è«Èëx—— ;swÆAXk¤¾ŽlÌê ÑÒÄlÔíœ{Ð,¦·üC‡hÞA8"š¼=åÒ|„¨É} -ͨϑ—¢¨×§¸‰$'*@9æuŸ÷À†5ãÙˆëˆ+]{W´9LÚì=|Ïøñßt»¾))à—–xDÔ7†‰»ÂÌöKç2lÒß¡‹ö@MNÙÔ D×ݼ‚¾=¦ƒ¶’i†§l”1cŒãŒ‹ì÷`Ò^`×û¹*Ÿ«A ·Fnƒ9[:FÝý:_‡›®;êðw£¢Ä•‘Ö3ñ»¯Âþ€`¯R!ÃëcV×0ºÍü߆˜†´3èqN …΋ðÇ;ÖQ -ûÛTøQtb9KH[ƒ«–ÃC˜ØÞ¡óÒmµl±·t È”“|Ã6n9½ºlЂVÒWÑ!>ÝÝ(´ºãøBÄȸAxÚQ #©­42X×]WQ²B£©ú¸ñ°ÿª°°ŒtÇõošD^܇¿,øˆÈ‚ò™\ ÉVð&Žì”±äæQ4‘w¤âÉ{`\ÎM€v]=”‰ñõPb -¢Æ˜2wA+'éb!¥N’.\2 -~Iþ%¼MžU`ΖóÑÁBY½.ë}U°ýîg©YÚýrÚ%bAÕèh*Å‘ÉçJľʛ4]š:1awÚ i÷áÞ€¬0nY ”ðhŸðècÕ²›Z)qâÇiجŽû¢SúU䇆‡npB¬„â&7«_¹„bZ‹Éõâ v¨¤éëHØâóC¤9·ƒ‘.²š[Ý5ùeE!|*n~Û´Ã~¥’HPíÐO0¯ÉF1åùce“!f)ñ²9ˆ‚*w"¢¤¡^b—dîœö»ÎN»Ç‹@ðd—Õ$V4¦ !)+nsæl<ðXXÙõÄ\Ò˜ùÉÃÓhÃÈûõвÖr¹EmÖås±á×—VŽt.-m¼ei•cå·Y#Dg¢»¨Çyºª;iëë]†Ù²H7Ø*0ñË–óˆ(7šç«·Û³ÝX5RÛ5Þg;™|´pÔ\ÕçíÄq×ÆÞ5AÛp½ºâ¢Éllùe„`¸n ¥‡ÃÀFpÏÍI;ðÄyüî{®eiÈš 4T–ñãêØä–>~Î"E4³"x›…õåT~å×Øž,E,"ÔXÉ%W«^׊3ô(_èŠ)QP¾Aç¬Na&≛ß0 Á¦—à‹]ПŽÇ¥Hëeç’gq¬ùc†‚·aÓÜXÀdz3ñ “–ípƒjL1ßëv~>ƒ™Çœ¤rJ2'"7™ŠEAúÇòiý_£Á „¹Jús;v|ÿ­ Om_’7 Õû6ñ\…^g­”MºŠ&sÊ‘·€~<éä›YØi*~V¸óOp—ÿê˜Ù  ±§é@ño‹R›Æ|J;wGEËÏUs¨éendstream -endobj -5272 0 obj << -/Type /Page -/Contents 5273 0 R -/Resources 5271 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5257 0 R +1314 0 obj << +/D [5393 0 R /XYZ 85.039 392.679 null] >> endobj -5274 0 obj << -/D [5272 0 R /XYZ 85.039 781.388 null] +5398 0 obj << +/D [5393 0 R /XYZ 85.039 347.604 null] >> endobj -1454 0 obj << -/D [5272 0 R /XYZ 85.039 691.864 null] +1318 0 obj << +/D [5393 0 R /XYZ 85.039 143.319 null] >> endobj -5275 0 obj << -/D [5272 0 R /XYZ 85.039 673.598 null] +5401 0 obj << +/D [5393 0 R /XYZ 85.039 108.573 null] >> endobj -5271 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R >> +5392 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5278 0 obj << -/Length 3109 -/Filter /FlateDecode ->> -stream -xÚ¥YK“Û6¾Ï¯Ðê°¡¶,šß¹l=±=©¬­ŒåJm%9P"%1æC!©Qf÷Ïo¿R#NöryˆGhÝ_ ¹3þ¹³8°/™E±k{q<ÛV7Îl=ïo\‘XŠÈr$óf}óú]èÏ\ÇNœd¶Þ ó¶x³uö³õöÃíjýÝÃbéyžå&öbE±õöËjáZŸ¹uõpÿq}ÿñ=Ö|ht­/+ìþô°ˆ=kÍB÷‡îÛ½¹åšg;‹_×ßß|·6š@«Õüýæç_Y[úþƱ½$ž¡ìØ.tW7 §øžÔË›Ï7?š©¸ÏŸñ¨©S ¼ØbïúXÜ`t,®òl¥ÜY8vàøt.›¶8VZ–Pð«ÙqC€-æXv­ -¾®U/TbõESç‹l@"Ý.Td}]¨ØÊë¬ãŽ*ÅÆ'žp³Xb'÷[žÕµºÑœÜ×Ôü}ÂÉš¶ÜСäÔ©Ðç•ÈK÷©K7å ì/Nàdz•%ÞËl)‡°tñ$ÚùÔŠ,Qµ²ÿîa -7fMà{© 4RÔ?;c{ÚæܸÅ9þ‹ãúûŠ¤xNÔ¸`l¾—XŸj‘ïyÿ=×v ÕÈô| XÀAh¥E™â9—2ø-Ž5f Ï/Ál¨£­;›.à}׃ÍÖZ¤0g•aŸ‚ áJžXNŒ& G¶”€)EÒ¤å±Xàš0m†Å/LÏsm*‘?õ U”Eë?-bß‚ -ce}éÆzœ XJÚQ£åã°ƒ´MÙ2û¼}…‡¬,Ô¤g‰²0#»NÑJJ)O0ÛŠòÁ=Ÿ[@oð€ã«þ–wêwØ‘Šf ‹z¡>žz×,– -PûiœÁ7ã úSÌÉs+èuíuçv•í¹j: «+Î6h -ÚÁòà)ÛÓ±k*6Ïíëw ok‰+hv0e/Œ¬ÿòçРę+Y9–C¼¨äO\C«ïY¨¨û†Ký!çŠæíÁ+pÈ?_Ú¿Ú‰úóí‘ h“Ýq_†¶9ï·ŠKÏq£)‹—ÍNز‰xn8Â,ÚhpÀÞ -´Vtì¸!اñ´«'n=i£#„AŒ%ÆšÏ\"¤aÃÄ«(K ÔFh[ÿÆ Ð# ƒá`ák6šª(a$*s)¨ŠpgGuÚÊí3HéIMi Ð(|ÆsÉ[©¡žMÏe³ÿGrŒ²ajÆÓmØÇ/¦Æ¡|Ø:ÓèøÀ_ÖX6É<¼×‘b§oÍׇ‚0š«+Fj†š9·¥¨w¶Ä‹Á*Z,~I%Zkëð¤Uàÿ¡›•q]hÓŒpn †ÚÞCý¦BWºm±ûØsW–?[>a£ÀõvZˆ¦zßxqdý†G¿é¸²k¤u¤6Ô~:ä5—ú–צ̻CC!¸!¯÷•* Mp#éNts*åô õkM1â̵”#9MÛË"tqL¦P€oyÆ­ N’åöxŒªȨüp° ,Ÿ&¥´\Ì–å­ŽÔØ' õ’3í¸£/*ÖÔ2Œ„oÄÁZÚº>ÝÓH8–Àq)‚Ô]‘I÷ó‹Ä{5¾.M%.èCŒÁaÄ}š#CŠøãû‘59Lć5çQtǾð1cKŸ¶û¼ç2mVVÈ(Zd´Bó´RúPöÔ寇Ìau×qóùPP`;ˆ–“ŽµÏë¼}3fÀ»¶©¸Ä¸ôwþƒ¸­:玕V1±4ÞÒÈ¿óç¤x4QUzïRÂÅMÚÉüˆMØñïöô&“Ü=¿Ý´{¶² ¶7À)̳ÅkÁB›3wÛ×äܲìK¯L žVvt•Æ 岨‡ -ÍÈLÃPÊAþšI©0²=Çn4ŠY×,*m‚"‰ WÙYz*±ÄFÑÐà*ï -ˆí·ÌKæéñX[ -D¯ëÌF‰åímÎßVm9ò´œO©i»±º @€ÉDÁâá¨|7{ªTBVpsõB¨ xÕÔû®ç -;ƒµC(¥6ßá/y|»Æ¬Kàr‚ã»Ñ0_ò0g™#Më~ÇZÏ—R‰ƒIæxVw"F~ÀšÂЄŸÕêŽ #À†"“0È b♊Pø9O0 5®rîX\_OOß!ƒóž¥ ÐÉQ}cFðô1qLÂy׶{ @r;×fáû¶çë æ~ĸ s'Ce£uèБ´ÒåHÌÄ é­š?‚¶‡³¥\]ñt%׺­v2s£A*•öDñ€ï^¶0Šaïé$˸˜Š.ÓÇèYÐuBÅI†ÄvŠeÆ¡êXš @ hò!â[Cü³J‰ Ž£›ãÀ i•Sß,·MÝõíiKÈ­;Š•ÕÄÁŒÉkÉÈhP_û–QÆÑip–†N”ìÜ#Zñ˜u]‘ã(VüÖlèV_óÂJЂÇуý©À„!¨ ¾†Õ`%ËÒÞø RO_Y÷=I"&Jãã[àˆ·n LÜ9P:_Pá@a›DS¼®—à„^`”QñŠöåICAJ|]!ZPúò¨µPò±à¾ÆSçÂ7 ®òÈhVœRçU÷—z à-ñ©áIG ÉiÑ’c‰ÄÀ::V×âk#¬Šý`ˆÍ=-;É8±Få?±x¤_Ë®nO%­£i5šû™¨0Ê q*}û$…†å2ÆQažxe“ŠÏÁyU2¿F@Ûœ¤Sý¦þícÄFæS&YñOä#/G°ÆZ9Ä3 -€‡Ý²°œrϯ^ˆçAWÕ´’^™u‰CŒ\aw*YbÑ@g1U—Ô4üRxþ¦üð}’¹útSæ×Tþ ?äKgVL€Á ZÈYˆh{¾Ï -â#%~y|Ü0°ƒ$‘€2>K‚’ã5‰ìØeZ$¤¢k²H^Ÿ©7Å@h—´Ë†:½1ú Ï --7½‡+åÙÀ¼/ìA’¶WŒÆ>±RçôL­ó󒀈’+wŸ\`ŠÜŒÒ×N‡q褈ơGx¤:~QÁ•hô„¼“Pn“ױω¡rŸüiêyýö—y箑ۀ¾ÿÇ<#ažDò9,C02Ù¤ñ–”á{M羨epÚs—N@ ó1/–;¤”×™’úڜݠzD$ô„L¥ŠçƒÅ¡Ä¡ÈôŒ‚Œ<±¤(3 8?pAÓ‚£Žc}ªõG±Ž„ Q¦kœÝÊ“r.<ÿhÔL‘[Óý±’סdGíPéÁeÊ.áh?ѳš~_¦¶rDJA¾ ¢p~À©–Ï:¹ëÜy¨&Q h"‰mS6Ús@bßò®º¿ôӂ·)m›cp€ÏÜ*™h‡LSåRøÁ¦œJË!lÈ«?ÌíÓNΆ0´9áS8zÉ”ÇyŽÁs`ðÖ¼ú`íY:Âæ`èh‹6É€?R|ym588{ãë ‚IÌià­(›¨Œ7éT$¥ù ²lÝŠ±$ðâY¥«¨¿>‡Lê x•f±G#ëIð±}Óò½TúÂØ3Üçï’zljË ¾1P έ°Äá',lO]ÏÞºìô³âUX½8 `À èÊžkdH€¬ôœFÍ i:òy5­Œ#‹ÄÆ RéG ì?+-/hÝ>q½ÓŽþ–c“ê˜Ú÷–@ytJõQ(ò·^1WóùN# ܽâ)Vw?êTÉáøñÀÓä½ ?ÿn)Ó<ÿ­PòGgí/§“–ô€7b ãäï4ýÎÖÈC ßZ!µë€û·~Lò[%S¿%ÁÖò/ýo~‘ž{Éô/RR¶rµ.x* -â3}õïöW -ÿÞîÏendstream +5404 0 obj << +/Length 2550 +/Filter /FlateDecode +>> +stream +xÚ¥YKsÛ8¾ûWèHÕ®‚ ErnYoâx6“xc¥æ03H¤%V$RCRözýö !¾\S[©Xx4Ð~|ÝŃb‡®'“E WÆñbwºñ{˜¹»šb¥IVÍ?67ï>†ë…ðÜÄK›§nŸÐ B¹Ø¤¿9·ŸÞ?l>|[®¤”ŽˆÝå*ŠbçöóûÇ¥pïoßÆ©Ày€î·û/›åJ8÷_î˜i¾?<|Źe,ÍòÍÏ76­X-C!A™þ¼ùío‘‚ü?ßx®LâÅ ´=WÀôé„rÃ@êþñæñæßíV<,xÕ˜ + ÅJznój +=7ô‚VM°Ô$<áž\"ÔÓú§ÞÚÃxam6`hhEhs¾+…Åñ¡µ–K?vžó4‡v±_®|™8ŠvhŠ¬@‚IÕ‘Ç«ì Ø)ë¼)«W¤õO¸auRM^šF2Üg¯ªÚ¹áñ+uR– r^jFûûç¨fRKÂwIÌÍsEËH¤¬â±”Æžq †@ƒ —•@K%t̳ÚáÜe¸vÔž„©§ÜÈK@—ëyÃv43†ÕDov†agØÇqÃZG ‹áÔ2¶†Ȉǚ‡ +c©«¨Æ¿ +wzåÅOeÅ]•…{{Jçþ„+ΰ ÒZ¢¦ió¾Ý>­P4¶®ÔøZ,º¶˜;a²uì»Q8YÍ´É Ñ[&›cØš¬ÏqÔd6ÇQ“ýæEݨã„z"ô˜Ëi­ÓÔˇI=’Ü*·"Ü=WÜ!ãhKàxJ¦ÔUã˜p0«òÄeIÑà œì +ݬ‰Ðß½Ðcçb'I`¤0.xôþd INåSrhwîù‘èÁ*°ÂvNŽ_½2‰üF«\mfå‰PÛ´cF^6÷Õ ™nÕÕnâÚbç¥EœÞ±¿l&f´ŽÔ£ç¢pÎd(ÈØõßHK 9¦³ÂMÂÐÊÞkðOrU68.pö!q‡¡çÜvÁ¿^ƒÛæô:rþIRæϦÿ°D­ì~ÐÏ>›Ý50ß»£Æ“& +£ØÖ!‰½AP +Ö#]‡k8Q>ñofA˜\‡BÅWa wÇ(žÌ—º)œ-¹^öŠkKtäÑÙj +œ’ý3» ýôëÓ’Hˆü²$¿lŽ÷Ī²§Ñü×Àjýr›ÿ4<¡Žµ&É Â h\Ò,åñŠ›wL|È(¤Ä(ˆà¨„HæuSå8piÑ +ǹ:àö©¬2ÃÓ®0äÑÓÀ·îi™dŸ?MówŠEëœlò!Dqßv2ˆ†åÒå5O*îîÿ›£‰¹Ì!%À\CÉpË8ý]ɬiþìy9)+›”²K£Gv<ÄU•µ+†Kâ +Zøò±[uÌHz‰©‘Xð¡á€UyäÔJ[hãaÆÏ4# w)Ãê½ö +Ò¬É@ ˆþxú™B§Ð÷Ü(ðgÃÜ¢™D§ ]€žkt’(î{ Aû¶#BÕŒVŒ£Ï‰t½7d´h&¡bßõ}¿ƒ"éÓõ‘¼ïÜèÉ'áêx|å¶âŸ”ÜDmU]­äAM¨^uRƲÐÙ²osçÏ‹JóÖ`ùs®y‚ñ)§aOŸ6›½1׸ûA­F<±ÈMî:é ¶ +äÚù L}"•!œ[éÅUYñÊ#yÁ¿- ßIêõAÈÈìaCé<[ëlCœ¥<ñýÛgÞ§E(Ú_ï£ÈÍ›‹®lp(åÄ^`0•*mc¶`-«Ÿ„Œ?]â UK~Œæ\‹.¿t“Ú玈#¯¼ˆ ”¤0ôm@œ¿#Uâ1îxjD6w霨,ìlMVB~c¾,åYÌ)økyr~Ò¢°ÏõN2æ|²Àï4 +ê´ðÈH®ì@‡´•p¶,tƒÒ`ÕߣàIƒÌØžŠG?×Æþ*à†ÓðJ#©„|³,öF¢*ã´~ÒYÚ:΄c(]ôQ'¯í +pw¡€l,Hf?É´wÀ–ï>¾]„À„¢®lxþúö»I¤)Z##Ç´ RµmÓJ?…è2N\¨·æÀ²#™Äs¹\? +®ñ<àyQÃpCÒ‘Ów!œ¾å,T4S¢j&³²v4“À—WHAÂþRj/“ë˜Óÿݯž‚hÀ€¹ÆJY¶?&\ÄàÞƒÜ ¹¬­Òr“{ùò‘ ­±&Àëä2 ºíÕö¨Yåz‹w¯xÎ +tªÑw5¬¶>}Å™_7_ÝswËïÕV5‰AËÕ$x0T“S^XÔÃ+DAI°3°.ƒ‰ÚÛ5"ú‘ë%±•y%W¾ÝûC=RÑ[Q|Þ©iªä˜®Ûóñ)ø–‡5~ûRrš|°ðÃÄ ¼hÖ-šé CôÖƒÅÃöÁ¢ÏqôÁÂæ¨ø¨œ´~ðòÒªP`[¤Âø1/:{?p­£KS¾ ‘•ÎÍÔMÑ— ‡—Ì«®£™Q&zSu3 ;Õõ8Ž«Îâ¨Uw·ù×߸eÒŒVÓžQΔ vñhâº>¼Q;óžWöêõÝ_T?%Š?­~Š$?’ôØíEë.¢|ˆº$ùa09>ÞO)C›“N‰€]}û# øÁG Í{˜Ù±fæŠI¸ê¤ê ô?œ±ÊÙ×öÍÆÛ2 h'³?Ì¥˜ú—¦`Ìx1·+»¾æs~#}²q,¡änt]g~Œ¦¨nQÌÀ‚ÅÕ{QÁ£¶|™Þš¡¨ˆm5sä©Bœ`_*~áªL¸”ѵ•,žÞ*S…%/Š¹ú±Eý±,ヺ‘¦\ÐeèLÝKå…õLo=gá”Þö­[uõÆ&Í›û|€äøù€‘-¼·ÊÜ°êé|%Ng{Œ?M0®Ý”Ÿ—jí£´ ¶b3߸Tܪ›Ì8Ÿ&ãsÁ”~ ¢¸„în`k{ó—Jõž)`‰ªJt³!ߺH‡Ý#ÒHzÕE:LôK´_7ŽÓ Ü@Ì_£-šiœ6DoáôçûGqÚæøT¶u›2÷$~F ½Ú¼ÅõórÕ˜òFULœ7Ù®¹TYïë‰öä½ +ú9eðA„à°dó½'‚Ÿ‰/‚šdÕÑŒØ"€wMCÕ÷ dø¡?SÍ0Ó$óÌäÚúM¿ú î[ÜXMaÑ~cRg~ÐåRQ5%.ç£$ãW®ïaMi}Â2@Ó¦ÉÖÀ§Òì5þ”2a…Ðs}Î[¡£™¶‚¦AÅø“V˜cf¬0ËL[ÁbVë·Ûid#t¾_ëxÚÛçFºHNÕs ´?Z\ÁN"ÿ×ýîÉNº±œ(ÐB°€/Œ,d‘ôå e솱 +ü?T¬Î‚endstream endobj -5277 0 obj << -/Type /Page -/Contents 5278 0 R -/Resources 5276 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5257 0 R ->> endobj -5279 0 obj << -/D [5277 0 R /XYZ 85.039 781.388 null] ->> endobj -1458 0 obj << -/D [5277 0 R /XYZ 85.039 623.857 null] ->> endobj -5280 0 obj << -/D [5277 0 R /XYZ 85.039 599.875 null] ->> endobj -5276 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F20 2865 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -5283 0 obj << -/Length 3225 -/Filter /FlateDecode ->> -stream -xÚ¥ÛrÛ6öÝ_¡ÑËR3M/}ÙIsiiºÞÔyØéö–h‹ŠTHÈ®ûõ{nà%–ÜÙídçΨEÔ"7a”‹,Wa’ç‹Íþ"ZÜÃÊJ0Ö‚²žà|sqù>Õ …ET,nîF:&Ô&YÜl ÞüøúúæݧÕ:I’@ájeyðæóõJ¿0ôúÓÕÏ7W?ÿ€3 @|¾Æå|ZåIpÃHW?˯?~ÿšgI­~»ùpñîfàtà¸*ͯ¿þ-¶p¥Q˜ùâÆQ¨`y|†F'2¯/~¹øç@Š×ô‚w’ŠÇXÃ͊ؼ,¹T…:MÉÅ°ªÂ”œRq˜¨x‘™(4‘&ÑMÂukµ6& -nv%\;Í‚7íþPÃJép]mܱ+ÏÉBç¡ÊŠ—¹qˆ;e&ï:p î®îàè8 -žVq´G˜¨"x\ÅY`›U\Ž—]Ë¿=p - ó0è·Å½øOÙ=Tåã3(îéd^¸¢»•ÐRÁ¿#¥qÅ ² -z^€CT°å ˆOdyÍÁ|W>ñbWÖÖ•sv‰˜Ýà–pååC^¡¬A„k…À"ØÍÜ ¢&;Y8€^kÄmïXǽ/ GXüwýQ NÕó’u<ŸžU6[^ á!=¯néîk¸ ñ„¤÷ÄQƒ·sá¥I‹<,2ý¢ÒLpΫtšg¡ÒÙ\¥cQé=2º/¶i›‡þ3BãEfFœóœ¦ih¼kú| HG:°G×®ùÅV V‘î¸q=¢¤ƒúéÈÀ¢4Û¾¯nñy„Zˆ£VÍ=/±Ùªá³–^GÈÞáãtŒhéAžxr_±4<ýxWßñÄr‘å)E´¨:ÍCÂILú×Ul¢Þ¾^¼é­ër‹^ZGÁ÷^_£ì¼ ádË:UâE@å*ÁÙz}ßT2¤Õ†ù¹³ƒm·r®ÿµ÷(¢Aø ãŸ^®ÊdQÔ›é¥ ß<@‡¬«Fçñ÷Õ:×<‰nFûE®ÀkîÉȽÐÐÞ98 oùv8ñì¾úW µ‘ -we'KnVò¬0´²Ý!ùžj#Hh¢Hß±(a½•³;FØ·ìÇ¿yRAKÒA½óÖ_L`G¼GðälkÏ ¯l8ýGÎ"·{¡‡Šo»ûRÞ!I²àÀ -Mþ¢ì@˜‘´É‚_ª‰‡ûaÉ$ $߈;;õîxzÓ:’:ë|jÁ7½÷Ž“ý<@Iqq˜‹XÒm²ikrxìïDN²Èg”i½òˆe¾ˆØìǃ‡kÂÕSÓ Ž•zbš]yÙóN–c!yÀ:w´µgŽ•½?eÂ=­U÷§‡&å¡t4w^ßTt""—Y¼[©Y(Uì_Š3útš–¸²bîÊ@}«ºæ…þ¸çÁñ0çÒ -³­³‚ºœèë‰{{™,Qô'AmêYJ‰m£FÑSƒõ$—¤åïÿÑôâ–Œ‚÷k®|}Ä0& ³Tÿy&™nEz2“Ä;Æžâü,Úyô9µçj­!K“tˆvY< ½Y˜À»NÂTq6ySž_‘Ñt†¿ÄÚâëB…‘.Š„q&cb|¼.¯özñ¶3&™îzB˜Cr> É ØâµQy˜šœ™ƒŠx¥Ò9Ò>áÆiðž õç'ÊhêGEQ„£ Ý\÷ò}2KL g`“tíxè·hëwŒ:c/Â(O“5@slå0ˆ•œWf²§)|ÃceI6Óor%³\56)™Kl $ìÌp<æ#œ·!zW6®~âu·³‚é¹3˜C)–LÔ -ÛQ‚±Ñƒ”RpIH–\Òs[œñ -§Ñ:&*ÿîsL›€5™;ü<̼ ¬—@*¥kTpFâZÁG_Ïäzöª´‚¦MK­å¤¡JñІz–¼ù pJñ --Þ¸{(;žßúƒ #k¨i>fù!üðp ‡ÅçæQe9/b· —8~ÏjYí+·dð@ðwGð1ëö¾>!jÚè…Fûá}’ˆ_ "HL–ø2ˆu®gP×¢ÖÜïH1`®xËÚ[X¡eyê*Nÿ_¡DËT˜ÄNÞû`èYš˜]ú9û¾ð`Å¢:¥®9[O="Á¯öPtÕO¼jx²Ìqݸ—Üï|¶Äq"æäñür£g>\g -ªéb1q–Á÷¢ƒW˜óÐøÿÄ£0ÎøBpÝ/Õ5NCð‘/Y^„q<¯±©±–Ÿì -rïGÑ’ûtþEò±§+¯¤Hüx¹³1Á9_y%¸ù˜-ó_ØØÁQƒ;ß Ó Ï 5†ö¹~Åá¡ãdóP†`b?dH§~Âü”W¹ñäQ‡$N%"[)h@0èÖÀ™ °Ð¶–¼i_Ú¦ça%G‚·•R&Mëø¾^8ãEg¥¡¤s”¤å&ó…hùŒ*Ãì‘j¸,ç—©Ù µ#w9]Ÿgé [ÚžU¿äÁcåv­/ê`~ˉ Ö1ƒÿCü»‘ú‰j䛣â4¥ƒnYŸLâ„üâm«ûÒw„‘DÇq𹟅CÀnJŸñ""Ó€_ûE2YÄÙØΟ1dá{ÎjÎðz¿låD7M×Àèœãv©AQÕ°¾W¶–J¤iM¾Lj¬¶Ÿ–ë€ -¤4ø4Ô?¾”UxV®QOŒ -$¬Ð¹ÅP -¬•ß¡C€“¯G›ãXÊUw¼(Ép,×”Fð¤cN–Â*ä*O¼:U†ôÂÈÆK•°ÄâÊÄÌ–Qr6íž½¶o½Œ¢yƒ±ÏDZ¾æâÑ­°uï¹4Ê'~ŒsdaàP ,p RæäáÏÁ!V|¨%Þ<cIJw¶“æYe'¦GßB-ìë·<@ëâ…J)b†ZÑ÷ä@P¤¯Ø¨ÁÂùy¦j ,@¨ÁrSìv¥—Dh}Í¿}jÈ þÀ¿}»ùRºï./!T€†K)ý]¡0:Ú;ÉxçGª<–#¹]'‰QÏAk;üµüó\ÿRN-Ñ[F[ŽÏ6´žÈk,!I²ižÛ°š¹IÅ‹Ppr¨ó-ðåôiâ—¡ÊuCƒãZ'8mÍPŒ6ü‚Ò†œ§‹¦O¿üñ¹Ëƒ¥{[u#cKŽ.IVp¯8ó] *q¼ñ ïŒS0D½ªv»¥l¾÷Ê -8üR¸C|-”NuOõn’¶cǾ·àƒ¢ae]‹ZòY1t`žkôÎnÙö-ž¿¥7J -öeE€A—Y‚"éðŽUŤ³ ®Ã$Ϥ:BeLŠ(¸ÄÞæ¥k/¯¯q÷Û:¦"ÈÒX6’±å4ÚFá;çdÄJ] …¢§ßˆSšÔ‚=k0I¼ž¿ï¤ÕÈõ pcZ¹lHÖìÑi9vð}õë±,'u y8V›©w:â¾4C µQQ;•H§þ+ÙÔ7Ãèy7+Cßg0ƒdYÀÛÁ›ñ‰q\â?œºSæÚ·âX­•<å–ÑøÖÛ]¢’Yc\CÆ_ª8HÛ£÷ì%ïõ^ãíݸØ31ð™ìײ,„Jûl•ƒÎ!¢L§ñ2“ ‰~5ëŽN¹ -Ü,ªÔñl;µ_{¬öcŠ|Œmˆ4Ôš´ŸÚO·\_=1lþ9!DÓw¼»ªl6ƒ—EÞv‚vg7î\É…ñI#ƒ¿,œ¿ô¿*ÆÆFæÉK5qÆÊó‚+ó-¿&ÉC“'Ïþ/îÞDendstream -endobj -5282 0 obj << +5403 0 obj << /Type /Page -/Contents 5283 0 R -/Resources 5281 0 R +/Contents 5404 0 R +/Resources 5402 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5257 0 R +/Parent 5391 0 R >> endobj -5284 0 obj << -/D [5282 0 R /XYZ 85.039 781.388 null] +5405 0 obj << +/D [5403 0 R /XYZ 85.039 781.388 null] >> endobj -1462 0 obj << -/D [5282 0 R /XYZ 85.039 761.463 null] +1322 0 obj << +/D [5403 0 R /XYZ 85.039 638.284 null] >> endobj -5285 0 obj << -/D [5282 0 R /XYZ 85.039 741.134 null] +5406 0 obj << +/D [5403 0 R /XYZ 85.039 603.539 null] >> endobj -1466 0 obj << -/D [5282 0 R /XYZ 85.039 698.974 null] +1326 0 obj << +/D [5403 0 R /XYZ 85.039 520.742 null] >> endobj -5286 0 obj << -/D [5282 0 R /XYZ 85.039 680.102 null] +5407 0 obj << +/D [5403 0 R /XYZ 85.039 485.996 null] >> endobj -1470 0 obj << -/D [5282 0 R /XYZ 85.039 408.518 null] +1330 0 obj << +/D [5403 0 R /XYZ 85.039 389.65 null] >> endobj -5287 0 obj << -/D [5282 0 R /XYZ 85.039 389.85 null] +5408 0 obj << +/D [5403 0 R /XYZ 85.039 357.229 null] >> endobj -1474 0 obj << -/D [5282 0 R /XYZ 85.039 124.319 null] +5409 0 obj << +/D [5403 0 R /XYZ 85.039 101.685 null] >> endobj -5288 0 obj << -/D [5282 0 R /XYZ 85.039 103.064 null] +5410 0 obj << +/D [5403 0 R /XYZ 85.039 75.192 null] >> endobj -5281 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F56 2890 0 R /F66 3242 0 R >> -/XObject << /Im4 4878 0 R >> +5402 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5291 0 obj << -/Length 2632 +5413 0 obj << +/Length 3112 /Filter /FlateDecode >> stream -xÚ¥YÛrÜ6}×WLé‰SBÄ…·¼ÙŽUªìõÚr¥RÙ®eð™[?~ºþpsýág¬h”Á—ØýÏOëL7,týaê~õþõ+®i­ÿ¸ùåâíÍhéhX•£™^üþG´ÚÂ’~¹ˆ„γÕ”#!¡ûpvŠØh[¯/>_ükTÅ}fÅ£–¼ëLÄ™>w‹Œ=·H©„–j•Æ‘ˆ#C~ö°bX‡FÅÁÊ]Õ¬U PüO{Ûc‡ Ú®ÚA;JÒgÇòw(߸ò+Tªf ÛµJƒ‡ž›7uU²F«ë{Ë®änÔÖ>>è–*Ã’YðÛ:3N¬â€*}äZêýŠ%î8&”è·œÖyceæÑ. ~U@³tÚÐq©.{üÛ»’··²â¨½=YQ95*ØÑÛPÝ“!?¢%Wï´¿ ±HUº -‰Nɶ/Mq[ÃT1ø`hù»i›¯e7på®rÝÑ\êî¦Áwmw(†±ÌØE¶Bέ™²V$dÅ FyËö“_h¿I76 {ë —ªfǽí/ ì>ÖÕ"¥E W \±AT¤z{W﨡8\²‚GÒÔeÿÏUn«5ŠQ¥÷¼5¥kÍ´)Ü€£Aªf©ŸžIw­…„µt”œLè ñQòFªL$i2jBÂäéٌک¿=!‹œÍ7 ©s8àñl¾«rØ\mNÇþêPJÓ?»b€¼8_Xñ$ô[¡—Vü­ ÝŠŸÌ·¼bo¾'+e¿Û¡L„† ¿€Œ4ôu Hánðdxª±Á¢@UÚCl(˜âˆ# £Ÿ„ÝÉØrŸ8¶Ž!¤û#}ÉQ1l‰ú)ÆÝQèaÉ:°Žzª bÙ‹ˆe/{dHôô§N!Û¦%è - ûBë Öt î`C¥Á ~‹ºá›[>½ZK)Û©và³¼-¹ÚÚUv-üJÍ„<¤Îbü%G<…„ÁaÁЕY`o¢4¸npScÔ ¢…PàU;Z6‡Ìs1¢•P©¶ÊŽÝòóÉBÓÄ;œÛ©ïm“ò]…rG\çäyä[º jÜ×‱™%˱© ð’d94G\>cc†Y  /Ž‚=±¸ rSÕÛ7¹P‘ñ|Üu{ß}ƒm¼m¡ŒÓxÖýµÙ -\Hض;²ßð/§ÊÐÍxfT¦&ð!°é¹ñ 682ŽòIð=õnؾä)ÁÏžM&ÒÜyþà "/Í>yð®Â†²[²(»qãð°lYÌHGx -käex Û¤rEÄ´…" b`@ä4ÑŽã¼=HA]Ó‰¡=Tpݦñ ¤Úfiip‰i‡P¼+ëXatÛ+¥%k!naÅn±\âŸEôÀ3FM!g’ ¸0^e”Hëšî2(wå‡õÀME¿d-˜›¨øesǘB€%K-Í è,Å7@’s4ñ9HÀ9ÐíÃA]ô-0gëpÊŽhGM<‘ ® ?°Y]i7žªuµÛ|³"6;§`Û,Z±“|´AÝûrëð’'–£ -€`⫤ƒž,ôy¢ÜCMZÌô¬™Ô¿oF p]ÞdË„ÌDX,Ã&„#5ŽŸØ%šo™´¯Ï–{AÙ§T_6DÒÝK ì‹À2/ž£¦p[ ™š—ŸÈ:F&˜,>‘Ái.2x@?§†E †K$­žh™¨°R1œ>9RÓT½"ÇóŠÁ™Š$W+@)Î/|hù¡"ùõ9_¨7‰PLwW®$àOžk–ñÊdÿ´,j¸º>ÈÕO-XºšËzCO1óöÌ?Iq"r“®T –ßn+~º)»^¸:`uÚ賫̟6&Ë3+,;fÝKŠuB–xŠ}–v¦xi|‚^1þ2ùì¹yR粕9)›; -ÊnS.LÄ îc\ÿT]vB‘{|Ž¤‚Ž úð‡'QßÔ vÈȈLº•x¼k—%97EG"Ks+\ g'ǤRÄ êéßyê]%¬ºžU¯ñéF¤ê»Ro¶kžWY}ÐçÈW¼ða›W<*vûa‰pST›ñËݾAq29ÙÒ®KÆ'±æì3‡™T#ÂÊ­PÂä;B5–áÒŒ¡(- ÜCB(Æfá{®uÛǸ#ü¥ýr<Î|™¡•6EKÛ³Ún²§55Þ Ë}…³ÊšÔ&–"r†ô·E¿ ݬ¯¬Ÿç±¤iUþ5çÏà-ˆ¬¤S¨^5z ûÅgQeåaur¼Ô”D@‚X‘nŠ¡ÃI’È”ç +!¡u~¹×7‹¯S¾˜æ#²×^¹¤Û[òËÛÛßyð%Pv|ΔÒJH~,p›UM’n1 ø™Ò ¨èd ¶E]1Ô[œ *ëø4ãkǃF)&éÝÝGŒN´\[™W$ć#kª`VD¤zKšûc»apÁ*ƒÃ-˜_ÈÔa×ûj€zøÝÆ;è-+‹\k"˜‡ÔÜkò)BõBîˆÂ#3…õ¤µe®È‚°F ÃAÊÓ0û@#ƒ$°.…HÚv‡nʲš#=@~(Ê’GM¾‰Q±2Aê¶tP‰{˜Ð„¡n#ÞµÉ_£a5{ê¼éŠ\¬ +ò õ†qêŠ|)Œˆ8( +½ Ý§™0°FËjÆSWâx'¤DðùáÞ¢T¥»ÜÆXòcÈgt#¹€{†”âúîYÕ˜¶éá=”‰Ø{ÌZÒ2œäk|Ûa@ûHÚå;žèýʦh»Fâ HçÙ¡©ó«ß^¿Á©“xìAPŒâTë £PÈQBOPnY/™ z¾í9Þ_ÓóåŠÜccÄ•«š¥ßÔå>a7±SÛA~ÇNÝ)¾CÔß'fÿ j®oGnô÷ɽ¤£)šUxg†ŠöžãŽ.”ÍÐ Þà6RuÚ׸¡*†zg¸e€¡zá3E[á(ŒÓ2}Ðל €ôµ_;¬ÈRL‡E`m®´Åâ+qˆ¦@ûÊûDÄ3wIË#ÞF†Ûält »r†ƒ{NÒ?Ëœƒ½Æb{ù#Å;㜎M¸ùÇ…pJ­L"û£Da'A(‹ã·qÏ(2/´^‰ÐB +Ï5(» €ƒ0îð„NzUa7ó«ª;TpqF|gp;2¹“°"± ðN‹ˆ +B9<1¸"ã¡Ñ’˜=,æ3žïÒ¶|¯L)£HÒ.pZ‰uh… “!ºÀFZƒzƈx9ka´Ë6ÊÂ@'Yb<yKDZÁ +CæQJ¨¬ŸL’„¯5•¤*À° yK’ÒL²LŠd¨Q¤#0*‹]Ñ¥¥Eø®s  Ié<{-úŒ±®hrMƒãnŒ5–;½›.$„ÔHqyJÚ–¼›¦ÌQ²‘=1ÕiE ‹#ÉA ÷»ð¢DlàËÁïç¸ <áL*+,Ä(!GX\$1G牧Ó*ÅY+sÃI™Þ`Zç"1áX=©c݃ÒÖozdû‰ªÊ;vÜoVÕÕ¸.ÌB¬õC£¿ãC˜ð\ÚXŶR˜Ýù f'À6„tKª/Ï}…?õªšæž'!«Ht,$€dB¨ð.6¤aÄy +9[ÕÁú€G%ÑÃËIAÁ‹Z<}nPB;ðÔ7ÏmàŒk{M'ôm_%†5‚+]×ä¤XèÆ6<ñæŸõ›$èe¾ÚÈšŸ(„¶ò–BÒ™•òBFÔ7z¿/déðlë¾d…·­¶ÑrÏ[k~Þ/´ªœRvq—€×¥¤þ¼ûI]Øç‰c}sÇA‡œõéÞsNA‚Ø^Ù±§$yUQ?Æ"oÇ.hN@†Æå/DAZ~Ô€«¾5Ö`>A$¾Dw×q9\Kԃ把aB\ëL.žIYŽ=‘F¸l·Ï£°sªk~Û~âμÀ±ãˆu áÍFÞ›­DA^ ؤuž¹ç EŠ1]·~qÁÙš‚mVóbÚÃ~_7½+²¦nëuggõîb•¯ÓCÙÙi»ÿúc›«ßßýW ¼BˆŠ?¨8QN0:‘ã€IøpöÌ}Ú|4ÎÂ@Ûïx6dY=%‘!:_…ÖóÇsĶ–WÚT‹á{'ð“DŠ“VðA®k‡ß¯9¾Rg²^礙TüsâŠU¡·ö“Á¼ËNSqUDíž|vÇm!®OÜTh†üÒLPÐß5š~ïã÷œ­ôZq0–€ ØÔûoÁUµï‘øprü}·¯¸;NÕÓ$”z·û/Éè…Ÿ]ÞmkŠ¢Sqæa‹egŒ6ˆ‰"§YÊHn𥿼¿“»QØUj;Î÷ݤæÒ™hMá9b dN²TGÞV¶ÓØ틆‡ã¢A„LùodÝê6I!Dô“ÜjÝvü6T'k–S½@rµW›&íØϺäipîµD4ÝdÄÙµŽÚ¿ÿÅä–]´$4© ¶¹Tîœ7¨ÞÓõ×¢3”c’"Q{Žš7A`¥¸C™êN'Ÿ: ¸,ðGJ +ûh¥yuI=à‘q€Aõ˜84ÝCÝç{’î¢W<ñîÆÌwÉR¿žÝjÔåçG'ŸÕŽÈyé¹ã&ɇ6éjùÌ,‹?,_öHº;q1•?_¢.9….T,ؽTqŒ.^°í»-[†´Û¡Äã!Êâ)8¨ÅG}­˜SFGþPœ¸“V(r9…ép«àb¹òM¨Ÿ†(ù×Nj<ÑWSûqã²h»‰{¤tB-ÆqŸdR]±Yø‘xfq—’tmp+nñùq€Å¸(§?Ô0$¥‘ö9å`>Üû ðݱÄpŽ<›Ïž]ûòê_¢u~dºx«…·"ÞÞ +!ý:.$¤j D§ïØlÖò}éä‹¿4<×1Cu)ëÙ€Œ>$¬JpV¯Š1‰ÓpÜú‰§%+s),Ì[zO¦>Ì1ç +[GÀVÊënø» ¶mRlŠ¸P ëWñ)£½Âø¸kGßf©óÓê8x ÓOÈA¾„ ½,L±ºÞjkôÿR¥¸œ˜½q·HÎ?pÑ¡8àòÑßÃ}Eg/V• äyþIy>þÚtw—f‡} â—¼APQ­ë.Ï\ÈqËë7ç²ôóÔˆïa¢ø?™¸¾9Ÿh1~ÏÎÿhã©Ù±Ýd*ŇKçýï +£¿Å`2]&®k»JóBu¦;ª³/¶ƒØ3ü?¹~Cendstream endobj -5290 0 obj << +5412 0 obj << /Type /Page -/Contents 5291 0 R -/Resources 5289 0 R +/Contents 5413 0 R +/Resources 5411 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5257 0 R +/Parent 5391 0 R +/Annots [ 5417 0 R 5418 0 R ] >> endobj -5292 0 obj << -/D [5290 0 R /XYZ 85.039 781.388 null] +5417 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [497.496 347.146 539.579 360.048] +/Subtype/Link/A<> >> endobj -5289 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R /F56 2890 0 R >> -/XObject << /Im1 3957 0 R >> +5418 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 333.597 401.53 346.499] +/Subtype/Link/A<> +>> endobj +5414 0 obj << +/D [5412 0 R /XYZ 85.039 781.388 null] +>> endobj +5415 0 obj << +/D [5412 0 R /XYZ 85.039 761.463 null] +>> endobj +1334 0 obj << +/D [5412 0 R /XYZ 85.039 433.802 null] +>> endobj +5416 0 obj << +/D [5412 0 R /XYZ 85.039 388.728 null] +>> endobj +5411 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F58 3360 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5296 0 obj << -/Length 3466 +5421 0 obj << +/Length 3215 /Filter /FlateDecode >> stream -xÚÍZÝsÛ6÷_¡ñ}S1$ÁÏÞÜCš8©;Mâ‹Ý‡›¶´DKL(R!)»É_ûEjÚ›»¹É8vñÃb±Ø…»pàŸ»ˆÛQÉ"Š][Åñbµ»phy{á -ÅRH–Í÷/Þ„þÂuìÄI÷ý8íjq¿þÕzõãËÛûëWK¥”å&öÕ2ŠbëÕ/·W®uǵ·oÞßß¼‹_>TºÖ/·ØüáãU¬¬{&ºyß7¿|÷ÃKþR¶sõûýO×÷¤ U‚b~¹øõwg±†)ýtáØ*‰ÏPvlšw §øJ¾‹‹»‹vCq›¿à^§PÑK˜YâóÈ…®í‡ªC΃V×N‚‘s]ÏV®·ˆÇŸ ƒ1¦ëÂÿË p¬Û+åZUÓÞ­ê|ßad!PõÕÒµr(”-–²š›^g Bõk[,UeÃm¿9ƒ]o_c[%¨q¹í±B>2HY•H±DÚ;aY›¼š©ð#;pÏ@ÒÓ$Pì•©ƒÄK¸ - ùPç|“—i…âëÕÒKœÉë?\ëùÊ‹­ e«3nÞ‘ i‰ -Wµÿ>ÀQãÇ¡¡nkþzD¸ja€]5ðP/£ì þ€Iª Ëæ+Çú1«³ï°1±Ú-4½û.öˆ#À³tQ¥xº$fÀúà J”,ˆ­uö”¯¨Ó’`y½ÈÊV¤¿9®c‡:Öª¢ÉïRè‹ËL•)J¸6GnÛë6B Ù¶ÛŒ oì–Ù?oóNyËmûº"þÄ>£ñÇæhOÕƒWdö‰É‚M ƒXÛµT…ŒÌ8•HîlÍme.„ÄvUíõrb- éÚi õ®ø—¤®p:O¤75W—´W–²î´}îUøÒöƒAG* ÇŽ¸þgÝoóæÄ|IQq¦^ì3CT+P‘5$ö¬5.i¸:-é§uv•’¾bç\Túæ ÿ¦Ü™EçOkÔü[§äÐŽ R° -b¯ÇªÞ¥-Š zS†q#(k,–Æ<”UT›|›sB—”ïqôX¯¶[€Å+ôN@÷ÔžÃjÔdêvhLêt¶ÓÇ›[. Ùƒê¼ÝQc.§˜?‡µiO)¶9¯€§%;Øwý†= ÂúÜcÙ «J´\¾«,Zè£Ø–fåJHòp -'†„¦&âÉÙÏ©±XçZ ¹m"l4%$ °õလ‹v™—ß¡•RÚÞ®êVÍgqKZ fG/ÔWü{bSôb`ù-–e6Íñ¦R²\P¨QÊRÀƒH) -Vƒ0¹X;DãŒÙÈÈbΨ·aÜÙy<ÙR9ód÷Óy§£a€úmÚÛ £?I„Ï\]PÿL©ßi-]È4ÿrORBø¥mBŠ„_÷[i¦y‚ -Ó —'¦˜ïxyªºí>Z¢2ãB!Ûñ³ Û仼HõWò«m¬k}¬^¼Qæ Ø‘¤ìPEÄöo«Ã¾yz•Õ ¿ú»ß`Ú¼*_<•k –uÚžº°­0„B׶à]b31t‡ Ý؆!1¼¡øÛ+{`©VÚ#¹^••´Ã†á>а•:6KH¯M£^r¢Ü0)Ø·otlëAi«Çlë™;/º°ÈŠ¢“pÄ -­@Êúä‚îPý}‡×Æw|ëÀ:Ͼi»ã/“Áä[®Ð&‰-4]ÖigHxrXªN¨¹k]⼂çÅüôˆýp¶nÕ¡XsÕƒ6 HÝtƒ=u®™Ði™ÉûØÈ  PŠ3ëu ×,FŠB³VáñaëãGÙ“L¢f—Ø;´ÞA=¹1X¸æ:6dì!³hXkŠ´®±gxV§¤(¿Â:}›ÁŠf[¡Új9>6Và‰·õa…k;´hð3¥sÐÄ.WJHÅÜ1š4@½e¢uçMb×îZÖ.vr Í[)»¾HöV–‚jX_¡ÐH+}Û@iÑÃÆw7ï®OúÇ'¹DJ¶‰R‘%j…EàTŠ•~îd—*íæ%›÷¡'gB4-$R]’Bh@Ú¡Æ£žàÆva_>¶Ú/lO»rÕñAßCê¹æn/>–=ðëè¢ñ¯†'^é×g®@å²îÇ$i÷Z^òø¹ ”òÏ[œaw*.Ù—Þ KèSÖØ 7„~o¸BXd'@¥/øVçƦ’3Ÿ]ðããÿ!%m6׺~Ç}ë~vWQŸüÎá!%GZuh{ÝPÆ5iÒÐ&8‹ÅŽ­ïÁ.ÊSÚÂ-7[òµXßï¨)åŸÇì™ ›n:ý^q?¾m7„*:ñ,(v\ -iTm_ ÛFÎiÚBkaWÕ,5ƒ3Üçâ|Ÿ:C¶HH.ÂY÷–Ø?éã`=;$ÂÀ¸tî-\ÿ…w]0}}MðÁ-«– Æ¡Ûù¼dþà#-@£HÔUÁ#÷X<lÛ§bVjþnkæJÃ>ú²lu¿’}`ýØi)Q©6™h ø@›LÜ ž ‚ºÉËFk[ZrIÖ¹Ås—q䱳 §ãªóÕÜxßGT\'´ã ^¨<®Ð;RÑ4Kƒ¨ 3b*šAYgÍgâGl/Úã-VàX–0±åÏË"4#Y†ñ(¶C/ÈR룻Ær õüüI·¶ú¦Agäð¦¡ãt% ýÝíÉåÎøXŸ‚7ölÏUgàí‰fà¢1¼ÞY|£€ñFhF ñ}Æצ̌ðØÀˆÚ_˜Ý±‡bÝ–;ôÏ ÛÍ +D„î×]eËRî)uum©yîB3â~¤®ŽíC£É½Hz×FvõÞ8^ çk -•î4QÒ•žh!B¹²}S•‰½ŸÜÃ1ì8wž¹ÐŒ˜ˆCæ×{}>è»çïó²ßÆ;’®þk[Ùwí <kO4«u°zþ4®‘ϸÎqš÷£½«Wƒûÿ®^l;nxמhW!"«ÿ9§e›ŠÎžÚÈQC¨y „f$Á¶$þ@‚ŒI"À‚g>ê)\\QãQˆ,{˜—è ²=Ñ ²B4@VkíId#›—@hF!Ú4š#‹:{%·:õ¿C×!Ýø º=Ñ ºBD·žvUtÅkPϘÛÈöæE Š‘G¦ÀMÜcw隢•À{Ç÷ïâÐßž^UEUQ>‘ÇÓ¸xqd«0™ÇÎ šÆN±óflª²½yˆb$Á‘fzž)Á _èO¡wdW§Ðéâ3.{O3ƒÓ0tûmÕV3Ú³0ƒs¬…ä˜õh®í€¡4Xÿ…Ã{/ŠûçP Û;c {šÔ˜Æ@Í›-fØfx É1ï#Ø"†­ç=©jæi~ -; -«öØ Ó*SØù¡yîðz¢ô„ˆ]]|$@A{ë\§÷«c{ó2ÅH‚ÑÝЉ’i¶çy¤Qvý™¿Çwƒ‘;'²Þ`d‚nèƒvǽ Üï3ÖIò”cgøIч¦ *s0ÇåB"Lváoƒñ C¤"^uÄ TÎÓ¼à`DûUlû‰?ˆÔìu„,­tÓçØ|«9P¶7Å›U`²é Jeæ(–¦£ ­DÓ0àeO<Øð\¸‡Çáìƒ ƒfú ‹ç(¨J†oXByÃòšã9]02ž˜Òz }’»§ÂÜ~RDZ1mTíRzIJzñXÑî*–˜ å|y!fð)G@ÀgF.­ %>¢{:ú'-TÚL€„›;Œ£Y šéW-#ñ]6ïAÎ.ˆ«dæ(jÆ­óofúC/t6ÖQR-Ų>•ujá*3ÒƒN´À³ãhâ°š¥AÄ“4ß¹àZ‡à.j"œ$,{4â¨|ÛUó ™dÌoª5‹ƒ¿7y­wF #Cã‘$±p¹oÚj€-Ñ#ÀðÁÄOèr‚hMÖpc×}ïC@ƒºjæ—\Õ›O¹ÎTe<nà}Y$»Ælïí‰û™”99´Ïþ'¹‹•ëì;«brÑ=ÜÙgÖ¼£™Yr¦9·â3Üô‚1;¹Þ=³»lUáÞ÷ý@ßhµÙôý°ÏbøÇi ‘q¾äAô>Á‹±ètîM¬ŒüD6ºÎ+iñýÈXì.]™ ÞjQÚã@:OÔü}&ÃÄa{Å)Cž}»ƒ\EHô4L±Tt‰âç­dfb¾@Õü*_÷㉇˜B0Ü—%òVGÎuÎrxKƒÞÝ« -Ê ê$Ÿ`ÅlO{ˆ/q§rJü4”™Nñ:Ëú ÕcËÇ6¾<â<†dºñxÔF§-|™=^¼§TβÞE:v#0JìjdmZ½Š}I,Áõ .>ýŠÕñãñjm©ó½Z±,Ð:{ FL±åÌ#tÿr '=ô?âì"9A(ïæ ¡åëuZwÍšÓ5+-»’à_Ð¢È (-*¥9€¸âçõôË–tÛϨ™r1x~'Í<üñ€ÿÑ{Ýîöá¢&ΊÀÃp¸–'àÍ,#5øßÀ“¡endstream +xÚ¥ÛŽÛÆõ}¿B0 +X,š3ÃkúäºiâÀp·Þ òø+R+6©”׋þ|ÏmÈ!EiS,ÎÌ™9—9÷YµðáŸZ$¡ç›t'Ê3I²ØnüÅ#¬üp£b- kæo÷7oÿF å{©Ÿ.î·Ã9¡„fqŸÿº|ÿã»Ûûï?¯ÖƘ¥J¼Õ:Ž“åûïîVjy÷áý»¸,oaøùçûÕZ-?|úáæçÛÛâÚ*1ËûÕ—ûŸn¾¿ïÉê )ÒôÇͯ_üEôÿtã{&MOðí{ +–7@”FÆû›»›õGñZ°à]s"Mâ…‰9— +gdú^è$ƒ‹¦`.Ë–3æo_g-²ÜñD½åßn ²çÔ‘óʦ>p˜U‘Ó•á;k²wEÓ~7Wœá"Ö¾¨x–IY;0Ä£ögxäñm^M±)ßx:ÑWÑY˜3|#™*?ñbæžèˆÕ–%“±*–ŠT'Ë'ü¯n~gc‹e…s Ÿ Ò‰Rã•\•ŽsQ:†¤óÇY{*RW‘ Ȳ‰h´©p„í²Y8zu¨Wk`:‡ùS{‰ï(ò´¾Îvr™k!¦«KL_ÆÔó<Æ4Ïò€ª­›Ö±Á{N—¬"ïÚ¤žz‰éæ2×Cl—ç|§^¤W± ȶ çàX}3B—åùJl g¾*¬òÇ ü°üûà!&r§Rõf³éʺº$.¥=_›ëâ`.‹K`H\ÏgÒŠ¼ ®"3di)»ƒ}i×^—G&.%/¶Ùi¿3š…ŸH!DˆÖµHêÀíšÐŽ7möß|ŸûØÈKÂä*B s†q,-’Qz„ñc)ja¢t©ð'&¿ËžEe%¤zðsGJGA­-hÿÌ+Å·²íÊê‘96Åײ>­úýcýÝBM6d‰Cµiª(F‘Þ²ÚÖp1!h±[Y¸ýûo‡èØ‹ÒHöüæ‡þÓãèQïñ.Ëqãbmbí%èµÂô ¥-‘1Ç1øw~EQLÚüB2Ëkb¦å¹œô†¡š–·>¡„ps·ã‰·Ÿqç#º]ÖY@>µMY,M.Èå3…š-¢©ö€‚?è*ŠF°;È1Ç({¦ãˆeŸQ|ḃƒÀí_G¤t6/Ñì¡æß÷?ßbÖRUÏÜ[\_E¤]­ÓÊ ½ “SÅ !‘ +…Bè;øË¢Š}y Ñg}V€Ó¯Þã ®ˆ& Ý”?½âeðŽ¼Û2ÕØ™ï&Û׌çõð C Ή®”…=²Â({~ X|!ë ú F®4àã™ýL»#KØKŽWÕ¶©“Þ5ÌZ!Ñç…šäP“ÌQ°ñȦ‡IfEä\ð\*€äøºãêA®ø-†yÑm]Æ6x­1ºy§5 |V,5ÿdh€9^jÄ0R'S|âHðÑÎ9øžŽÌ‡s;çnbP`c.»@mºS¶ÇHóÌ´Ia€Ÿd¿”Õãµ`‡$>·`»¸²ç#rËÍW>|Ý ð©cíÔ`M1ø>׸±( à”9•'ëesªøãÞ3Yý¢ ÅѨ!Iáp²eU·¥Nqà]š.®g--Ô¤íDy™õáE`žJô“øåR@Æý3ÖŽwoß¡êJt‹F$FÑÄ‹£JÐ4Q1Œ:– Ž:´‹‰…“„3šÀ”²÷~ P×ͨ‡Ž½4T¶Ë\?‹hzLWBKž»Ò´~ü½Ëxxã™ËKݸp1ï]!*¡SÏ‚‘Ã"Çh½D•´¾#ЋéÕ¸ð±œ÷T„D3^-ŠÀUÇF(-”†˜cáo^¶›+Æ1<‚à3„Ý—–6MZîvb8ÏV”)5oÐÉòêéÒ…Ú G”cÏ#Ñ$àŽ­xÃÊ  œ_”¡»V$ 3rñö—yãæ”d*e³ƒåŠSd'¼šzm%Æöˆ4ïë,')¶M® ?6 (ÖW£E¼çϧuFà'k‹,]_Ü ©ƒpå +#“àw’°Ä±†¢Š´5P²—" +ì™àz.ìÀ\Ž)襠r aU¦gÊ‹qˆ+±^þqª‰XÙŒK®2( :^Ÿ$³¼§æ-äÔ¨;ƒQ`rÇÓ–Æ…CÑ8;¾vÜ~(w¢¸:$±¸æbœ×QDµš½D3ãKÇXQ‘ýpIbŸ¡ßØ÷ʬÿöƒUÜ37QfVt;Ž9Or§‹÷rœgÖÆý`i?­îx‚,!@&h)Ó-ö2û‡–ZÈ]±Œp¾¿ÎM™ ;Ë-zãGTùñ¸hô§5Œø‰À„#?aüdVmüx¾Ht|u{§h§é‘Pp?õaAyfÓÚìÀwâ‹%¡Û2ìzŸ‚€H³ +<Ðp®!B'Q&ötl žò=?áÞ'LÖ`g¶ØQÖ†”UÌMŸ¼ç¼¾/+ Yª-a`m¢åa¹œörhÖêJë/ +L·uV1êlßYþ̧ÃY¸R£lSJMyqŒÄH­<ºbùL‚¬Ão´|%Öƒgˆ  –ž¤¥0ãЖµŽkj¢8é*ÌÓ¤ñÔçm5î}7¬F©E×”Qµ]Ötö@ Z¹$üyIkß­Ö¡Ï]€ºzÝñçC“«lÑÔ§5H³&ðãß'÷uˆ`XeÀf+ÂNùHp{êÉo{äûnq-³/ m±e…TËrÃE†d©ô̺òPŒ=N­ÛÂ9K¿¬þ*Ýëᥢ3Å#\`ŸAB‘‡Bk:ºût +–Д[q— »x,ͺʭ$8Ù;Wþû%Ù‘Ï«(ñvÛ~jÐ8l^®†—‹>£ÇâÒ>rð» •˜ŠR/HÌÕJ̹\‰Y —*±kûJlŠq¶s1~2ôxrRV2‰*šõí/ç.í³ ëÇg_yÚ¢;åaÌJV=öŒ„–ã·ÿ¥Ä°í;ÄÙtÖfLÏ4õjGVAjj’àú­ 0WnM€^¼µ+‡[›`œ¿5£½5Óð6‚šlÕøJ¨ÎH®Ü¥y5Wûº˜½íqd¬C‚cÉòIë—·LHÉgÅ:»ø4ºéºj/×3CH ‚dö 6&6•ÎœÙÆ|Ÿ9Ò¾ŒÆÝì Š„#Êã©°†¥5'rí;žiKH)îľ”ÐvÊuˆB§r–žW(i +ÐKZ­.ìÛGÄŸH8€“gÿ~\wCÃ+ë +,½[ëD/‹o]“ñ®-6žqnêrqŽžˆ%vEŸ+pñ©”ä ”j´øÝ·pPÕ]¹)²‡½¥ëÖ ôëvù…Z“üw:0p».ÚHG”KúfpØu[»œê`ì†r™ìSK8½”-d‚&~÷> endobj -5297 0 obj << -/D [5295 0 R /XYZ 85.039 781.388 null] ->> endobj -1478 0 obj << -/D [5295 0 R /XYZ 85.039 761.463 null] +/Parent 5391 0 R >> endobj -5298 0 obj << -/D [5295 0 R /XYZ 85.039 740.47 null] ->> endobj -1482 0 obj << -/D [5295 0 R /XYZ 85.039 215.786 null] ->> endobj -5299 0 obj << -/D [5295 0 R /XYZ 85.039 180.641 null] +5422 0 obj << +/D [5420 0 R /XYZ 85.039 781.388 null] >> endobj -5294 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R >> +5419 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5303 0 obj << -/Length 3771 -/Filter /FlateDecode ->> -stream -xÚíÛnÛFöÝ_!øei ¤Éá=HÒ4M±M½±ûÔî-R7”¨’T÷ë÷Üf8”(¹Àîã"ˆ9—33gÎýœQ°ðá_°ÈbÏóEš^˜e‹åöÊ_¬aæÃU ®€¸ÌÛ‡«Û’hø^î狇ոOìEq¸x(sÞýøæîáýç7 C'Ƚ7M3çݯw7sÏ£wŸ?~zøøéö" œ_ïpú—Ï7Yè<0ÐÇOãô›Ÿß¾á^èù7ÿzøéêýƒÁÔàXåˆæW¿ýË_”p¥Ÿ®|/̳Å´}/€éíàéÅQ(ýæêþêŸf+ž‹¼jŽ*q˜yqž’%ˆ-²*ô” -iì{±]~ÙÁE*¸E–;í°©:nn«aÓÞ¸*sJÈœºç‰aCðpY y2Ù<òü |pÛåaß·Ûb¨—·+XÐÞÄðú7nàÔ0°t;üìy£#,}/ CÙèép(nTê<ßd‘|KßùÔ•Æ7E —¸÷7…“± §ãI øŸâìª8öâÄ)@ -çtâ®æ°Ê½\ NÛ¢„Ó#8ˆÝ3¶}M¹ºçÑ’ç+‚VM»ª¦<ÔÁ\ ”F?v>b{àuHoÜ©ØI`wf3kä_YípwYJ„heN©áïa¨[Ùjhù»Çók†«q›5ÞhAWµIRVû­ª€ô¯`Ÿ r€hr„yj£wœF`Vx*2;ÿàã‘kßNÑñÚnÍ›ýîÇ>Qª’]Š¦o5.Ä“4Z¤ æ‘Ÿ°¢àD·ˆÏ–Êhh×'• m¶ï‰ÔØ ÃþõííÓÓ“‡bî1ÕB?õÂDè  ‹.Ð)q6U³÷6ö9Æ[±†ÂϽ,NfÕ›!\ äT¹§»àñ@´€$+DuÔ²ÆZi ™O2$BÑ´Dz‘O¤Ò¼C£äéb'm!Ü+HXiv,HB„µhä‘ÀLMõa@P™Ýºê¸Ûµf‰j»¡*Ñ ¤©óq`˜MÑsöž°£@IE`aÈw:Ñ8¥XR»ä…(ÐÏ3&B­L ¬ù+cÈê¥Kº5gÁâÔË¢L–ª öLbÀN¯;µ\¡Ðâ”y Øh›BK¶kZ›RoTˆ0¥­hÌ}êj2Žaâ´+üÆÆ4ÑXSòàÄ^²Là|]VÅ+n²Ýà6ó¾{æµ[4Ȳ®ÐØð`½%nqˆÁå$’l¬«]ÕKWô'w«ÿÔìUD& -¿­Æœ„GÐìHFÝw8ÌEçûÑ< -¹³¨ªEà·w KJ±îØ|©˜ÈÙrÓfûd‘L{.Ú‚Ü"À÷šˆ.žøÌã*Ï׺—ËΫ™»Wý‘M_ÖE£7èÏ[qøñŒtmÜ)ºŠˆ‹k$~QŠ%§q"#ò§«èÆYà3jâÈQà‹r,BóÄ ¤aÓ'‚o¾·È77ŒÒQò¢lVà`9JL*…‹°Œ%Œ&D$ uQp †fõÓ¸;,ÂCšž'Vy!hóB®6Vãý´´Zþ) -XØ?qŸÐ¦†0…B‘vW4<üz›¶hÍ­;~˜²à‘ßý •g€–$…yI;ôŒúã.Ø’ýÔª)‡Ÿ‡=[“aLÄêLÅv]“׆ùÞ27lP—ÂœL0XŠZ­Z±Fa`¦¦Ö­ž—˜áÙ ë¼RE–µÜéxzi¯}DŠ×ÍàÖ´I¬)Öòôb7#Ýkú -Æ›jæ²à†ES¨»9Û;èïÃD¢|ø7)°¦NÍÛb‡¬á$9HR§'K*(!ƒ ]ìtX˜LÅ›¸‹Pz3-)²šÂAâôã/V~2Õ šŸXÑh -i]œÍÔ¶ÕôƒN,à$?ÔW-É©ýŠþ²B²GŠ£huìгúj4ã¨ØqçÐWZ˜HÖÐâøéá$àyê²âÖ£]qƒµÜ‡dGöowãXÿÜ3·¼RQGkØ·L‡¬^±¨ã6ÕYã8eñ+&^=çÀúj°•(l`òBºp7qVª[<â2“–k¤­¥Õm²öiSOâ•S˶ûÒó&.Š¥#º®5*Ö–/d×_ -%¢RìûkŽ¢ØAæ‘eßqa±2ÒÝéðm.áVòÒLç¤Å~ßÀѱBgëkàÜí×]éq‚DÆøµØ”²ï™Mw!uð!üäÍ{²—¦‘—äñäêœ@44f -5Ùm±#ˆ„êa†MG„\ot¿bÊ™!¼"¾ÉAoI,ŽÀÿÛ²ŠÐOZ¸#•œu§*fOÍ<¥íš‚áÀy}jÀZ’óª8é4± f³ôüjôT&©Ã¾è{íy±¬¼6™×@v«àvÕ¡HÝØJ¢‹@ÿääV%2éuâk9^qþøSCo“x‚‹[’<žƒQèŠ~0ƒC+YäVqðq-éfîGΛ]WŸcMfâš]­odB§ üÞ (]=ç»þ$~‚Ä ¦çK@جMA”ž{,wÐSÚþÓ`³1V#hYC=4ϲƒdÍöfRø¥ ¹ùBT¥C> ¯ó!Kþª2m©`“n`)/Ä%à¬æTxŦ9ôC×3¬hUrjN—2ñÈIü Ú‰2¨ÍŽ)gc|!®>Y8ë <ÙÄg„ð¬ãÉ­ng -䟭ˆClðL­5 -Á6…êbÝØ‚¡Š‚ÙÀËÑ€Õ“jaµ'Ý ÷b R`^ûÎ{LŠí¾!]K, -„>Ùê$530½)–C w›¢ÞõçW`m³ô2â#ÌLeW#î+/ ¸üóc…†,JrΩÁŸ•I“¸_™ë`³>üJµaKÖ’d'ÇÔcyè؉!Û“Ì2# -¸ÊÞ\ô.õÖÀl RkŒ#ÆHä1pf^r´ÃæÄm·+ªÝ_òÏozSIÚêL-±"±( ¤Ølr¯$àZ)|²²$`Z*uâûxȶ0¥× -äwÜý©¾¯þ,W×k±f¶dƒ\2è!×÷Æpþå˜+òƒ±~“¥VÜé=q„§,£Ì®«'3Ú â,„=7C7–SRù‹V'µÈ€¢Ë$;´¿ŠÇÔßÎe,ÆUlY -®•KvÿZ -; ÿ®Ñ^ö&AúvýúXµî„¡ò *žUB ãZ@¬…Ñäå"ó’41;‰QOON„—dÓó&Z‚mÊâÉyB_ô¾iv,¶0Òî%þ!uÌ)àØSþ‡=NRéáL!ðFp)aX¢ï "G¹ÆùÒHì0éM±òÛ„í¼_'Gbäb\nJ)ü™À…ãyÉÌL­˜¯-û÷¦6e ïÎòÚ½àÌ[ÚÈëè¯è%^_:Póúø¼Y^[çe]®‹²!ÙZõáJ²a|ÝD+¥$“nH¾ý$ÓâÊa4M€VŠ¹V2¾ÐÔÜ;›Êà†*x9U¡ô¤\Í$$)x¿\ïp–¯*¼$Ê/óÕ:ÏW ô_/(|=9oŽ¯öyš¯JM"Pì’¢LºÑ‹Â˜Âò<$ ýÀ{é÷<=ŸOI ù¤~¶N í¾ŸáF{úId?¾<˜ØÇÄÒ` TÉÚ†#<νò3cDw0Å=œ·§mБ÷S>?q[‰Ûφù÷Xš@0-•éìCu Vñ_”EÌ\–\ðŸM“AýTMåÆa$ÊW¼¹¶pjCa¶(ê¦\¸)y¤j¬…Rs£Ÿ²°WèañÀ*Wøp4DžŠãYÿHRW¯É™bñY[6ÅçõˆÒÿà=.葽¤G—Ôzt|Þ¬Yç*¾­GØô'~n+‰©3ûù9U”!6ÖhߟÓ*é˜*¾ð!{9í5Ê£(”Fl,D¨!Fíd;½1ô¯±öRZ¨ÆD$L¦ÕýcW¥ú t ö`LQ°‡?£HyŽ=4(蓹å$ƒæ\W›êÀ×[y›ãj…Œ6—.)txìZ Șµ!Ešq€gϽYl8®Ñ¶Äælð@@ª~,côt…)ήŽ^°½\áßí£x8¹ëT}ô¯q‚ÈÛ‹tL¼P…º¼ËKŒêÍ K:4žÚh**êÆälËÔÑÛ´~J2ÕÌ×L®ÉωLê®r/K­½DYn¬bÇuÿÎ q*ÓÁ¾=Æ™mgë¾õ’)bœ×<`„ëþX ÈÍÌFvé‹­´NHfvˆsþñ|E3ñ–bÄe»Ûµ“øÅ™ó~ß·O®‹~óféП-{ÜÑ{‰…¯&E;E÷H3ý9€~ªéG -¾ÅÉ—2Ò)ã‚,÷ò47ï!û œª¼ý¾œáF’y©JÆßÿD ,|pÅëh»°³B{Çž†Î,”Ã/¤½ÿB›úG/0¨Ê®*ºæYKª ’ \±?[þHB/M¢ËFp„9oæxé4±€Ç‡Í@ë°ÿ>.>¤ŠúžšMVá?ú_ýPÙª²{Yx&ã•òT qÁKª ;ÆWÿ ùáÿ…©§endstream +5425 0 obj << +/Length 3348 +/Filter /FlateDecode +>> +stream +xÚ¥]sÛ6òÝ¿Âçé=ÑÁÏÞS’&;mê«ÕÉÝôòÀˆ´Ì‰Dª$Ûÿþö $RÊÃM&&¸X`‹ý¦ÔeÿÔeûÎ/ÓLù:Ë.WÛ‹àr 3?_(ÁXÊÂÁy³¼¸y'—*ðó ¿\>ŒûÄ~ëËeù—÷öÃë»å»?®ZkOeþõ"M3ïí¯¯ï¯•wûöõ¯8ywðúÇíÇåõBy·f|Äùóîîwœ»Î´·¼þ¼üåâÝÒ²e  9òô÷Å_ŸƒËøÿå"ðuž]>Á8ðLo/€)?Ž´¼o.î/þe·â¹è’W͉À`,Tîça|^L‰ò£D[1…0ù:J\1ʼn $£BNåÉà±$‰W”øVòººªá©·j·Û¢)O $JýTEçYqˆEÏÜ$0•|“K` ¨Ý¼OB1T~œæ°3¢e¹ëà²jä¹¹Ö¡‡üÒ¢ƒÝ“ÀÏ’DÁIN³ãØ[ákÑðËx¤^…/xèæ¿Š€Âzt*’ #->“ÃÏõ$Q³`³q «®ÞÁÄÀ‹ÛŽ§v]»FÅ–á´î¹Z퇪4dÂÌ{aì{@ƒ·/…g ‡~Å ' /1ñ÷Ob¯îñ™xIi½¦}N’à‘Ãœ¶DœÛ7ð§©ñïZ–_³‚àø5ZÎ'^ùС,qTðƒD¹©«ùŠuA{Ññ6ˆppC{žâ u7 …U÷ AUJ…J”vÜÅe« _{’NÀr‰rŒ%œ'Þ¾qÀ›Ü'@åÂéÒ\7üd&˜#Äbs°„/eoàqÐïW¸æ‘!…Ì  +txÈ4Öa¢€Í^ÝÚ+I.]‡[V×ÌÈH¹*e5Z-XžݑʶÝÀ{lÛ¦Z¤ójFbÕ@—êÃa €øpŸË GAê<õvE7L±gpÑ™yœíÍ +R@ |· ?ñPø$Hál +õ +ű¹B¿¾ûäóšÛÙãQ¦À‘‘Ag¤ÄF„ˆIǯF€zNaʪ¯× Z¡Ž48ô34D΢Ð{BN 1N ÅÀ£z`ÌU!KV]UàuÛåš.œ˜zâ÷SüÂv¨MÃ# +¸Ý¯…zWÄÓZ(´]W­„®kI«bÇ+*v•£é +ï(Šð¦‡ßTë‚Äô‚FxýKÏ꺥KuŠ"EN g§Å6*ncêÄUúi’ŠCÞ슒T¦nf|w”ûJç|w¤rR¤MàV<ÒÞ¶deÕ5ÞI• «@ù—Œ°êhº`îÒ$r¯a ü4‹\ÿZô$¦±ª rÓZ'£çg×)9œyůƒ5[u֤Π|ªÑÿàÈ,§%àhtµ?ŠPP¨Íæ…Ç«ßΊ¦)$álS=ñ»«ܵ ž®1§ÕŒŽüùñößœ=íŒGã «ß1þèźÿjû)Dœç%Oœ“YNœä~¦S›åhÉr~«×]1ÔtTˆíç5Wo7à‘€½zU ï¾b0ä?å?bñ +qù(@QAÄ:q”$õƒ(=”çd6kåç:±ÙÐBÇ_ ³^!ŽÀYì¢ðòPÖR+žž\8ÀÊÏuU vU¬+7b0ü "qÔ†và1Ç5Rµõæœ4õ5Ø]œ’rÆbðÔ~Àƒy•Î#õbC ýÐF7ª½© +=NÄäQ(}F}@/Š®§áPâžqª§ÓÑUoRo!ûB æÆ==y +*!R;Ѿ¬P(‘Fö6Æßî7èTÀÛøŒóï{õU!¶‘Eó—¦w&½TègÈØ#R zàá ²Úîùå¡ÝàÑHºOözKž¤àR}«[I"q¨ü†{‘ó¨4Ð4ì‡vÇk÷½I^š»à-‰;v‚D§èŠm5X )Ô—aR;pÎ2ìw”_L%ñE„QFƒwÙZ;¦Äi(Ž(ÒšS?×ÖíØ 8¡ J!šK˜üs d2¯~৕..Õ&½`kÚ;y4¢^}"åÏ IuqùÆ ]ñG¾6\™Ì‚ò"ÙÍHÂÉ•5È*8å…<®›~ý(hW0ÁWœÕ\lFÏσX©³˜}!”»$=xÚX)"zOÈî®ÙîDMpˆ=%lƒ½ +< ¹œvGN†ÌÛ/ÂØŸcƽ¤Æ<‘¶ë,ð>üŽ"ø´ü_߲ƳŠOA'è"Óœ<œ! ½ÿ`IOW `NÊѵÊõ‘¥°ÃcO{jð +°Ut#‹;²ú–“—Ìôlh a×mÏPôWm7õ~®®ÿx"Ø@ªèúl°qp(ØDÊMÆ ½‰ æ6HH.?=¦§‚ÄÏâì,Aƒ3¡xÞTùZ…íå„)„™ŠÊ^¸ +ªsR±Ô-®|a—ï8Øí$ÐÐSàÁ˜r°a–ä埰™cÐĹÙRÌÝ¿$ªpMOCnor ªÌÄu¯\ ¾Ì¨3Tžh:A$®’Ý…I÷{™êØ'PÜ6AàGü  Ð UŒ*˜Æ{\3ïƒhÌî‚xV'Èm$ï5éîDfˆEó̪YWsŽ $8V¡ÖŠûŸÑrH½|'gµÜÁ9­åé{Z~Ž ÕòcŠ³ZîR¤*5rb¶Ž””6ß%™XK_åʨd,éã˜ášŠµÌ‡u¬ç¨Ùµ¤{£€Uº× T¦Ú§ŒM¥‰Ÿ$ç{ÓÎic3Hß3¶s­±Sœ56—"VQ œŽap—°¯BÔ¼GJbàiR{zÁ– .™t×lg0>xuÍp-—ª¼ßhŒ8CÙ*‚)ßÇÁQ{.R™ÕÞ(ÿJßä;Û©Æ%u×ÜœTõíf?6kUNÞŸDžøù»ùŠLÃò +ÐÇâIv¨—¢m]ÌŠƒÄNv³_ ŽÖ £5EÒ\wtùH½ È€/£/À®ÌÏl¿0ÆÄÄtGƒp’鮜¯ù8?¦xGwcê1â¡Ó»7_12˜^n·®§Öº—Îy(jV®~äf5> ý(Ul;8Ñ­ã׊{á “éY+$rÔðûñæ?ÔÍÐû=xøU±a]ùM5ÜLr¥<öãLòudÓgÂͬM²NÃ1]󌿒KY÷\lw¶j¢û½ûŠ~%K%£ñǬg5ÿBe?ö-)’Áîèîñ9ã<·ï©›Õ²Ìþn`Woÿ¼»gɾãŠqz§‹{¦øál½ ÿÙ,þ¯f]SígúDÍÃ=…ÊðB_ªÂð˜ßXgt«†ÿQŸS„endstream endobj -5302 0 obj << +5424 0 obj << /Type /Page -/Contents 5303 0 R -/Resources 5301 0 R +/Contents 5425 0 R +/Resources 5423 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5300 0 R -/Annots [ 5305 0 R 5306 0 R ] +/Parent 5391 0 R +/Annots [ 5429 0 R ] >> endobj -5305 0 obj << +5429 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [418.678 719.682 512.306 732.584] -/Subtype/Link/A<> +/Rect [111.316 119.05 296.579 131.043] +/Subtype/Link/A<> >> endobj -5306 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 706.133 216.896 719.034] -/Subtype/Link/A<> +5426 0 obj << +/D [5424 0 R /XYZ 85.039 781.388 null] >> endobj -5304 0 obj << -/D [5302 0 R /XYZ 85.039 781.388 null] +1338 0 obj << +/D [5424 0 R /XYZ 85.039 761.463 null] >> endobj -1486 0 obj << -/D [5302 0 R /XYZ 85.039 434.632 null] +5427 0 obj << +/D [5424 0 R /XYZ 85.039 736.911 null] >> endobj -5307 0 obj << -/D [5302 0 R /XYZ 85.039 414.041 null] +1342 0 obj << +/D [5424 0 R /XYZ 85.039 599.198 null] >> endobj -5301 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R >> +5428 0 obj << +/D [5424 0 R /XYZ 85.039 556.244 null] +>> endobj +5423 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F41 2994 0 R /F58 3360 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5310 0 obj << -/Length 3752 -/Filter /FlateDecode ->> -stream -xÚ¥koÛ8ò{~EÐ/k5#ê­.p@ßÍnÓøš8`w?(¶’h+[®$× öÏß¼(Q¶,_q(RSäˆ3œ÷ ¥Ïø§Ïã@9^rÅZyq|¾X9ç°òþL ÄL@fÌ«Û³‹w¡®•8Éùí}·O üÀ;¿]þ1yýáåüöíçéÌó¼‰NÔtEñäõ—ùTOnxvþùòÓíå§÷øääž|™ãòõçiìMnèòS·üòêÕK~ò”3ýëö·³··-¥- @U‚d~;ûã/ç| GúíÌQ^Ÿï`ì( Ë«3 S¾'ÏÅÙÍÙ¿Û­xÍ?ç·†¸â»¡r#xŽŠcFkWyÚÖŽ -¿e¶Y§ÝX…Qxn€w::Ú?žö|¥½sk¯C„ rˆ/°ñy‰ -â ‡¯yæfÌÙ?ÀYLgzR®60[d8n2˜Ö"µ7ïxTú/æ5ÿÖÙzêÆ“†š’g{‚O×Kla²)|ái3ÁOf–jäèYhïÆpBŒd§›M‘/¦;I‰È6+q´¾ØL=YÞó½óGZ9‰Ùá×.‹Ì"/TIœk4"W:%×1„F®ûøåjá3ru]–VÑ=6Y•Ý—Ukâ%ι“ -f[7 úÒrÍË°É€t¨<³X$Ñ”›z@^ B(´èÉÌÐÚÐ#Î?„~0Ùá@än4yd¦ª$ÍYÂp»È,úæH~)í[T9Â7HÈùÌuØ£ÁÚ"âêò -ÞÂë µŒ&C @Ânð?*cY75à‡ÙM3Àí'<Ù m0e:®|Ç£ÓhÇK(Aí!%ÚR±ä™ºÉ‹B†%žC^JÍô&}ÈM‰;)ï™!:ô• ªC æ¾ïMHá€ÿ‘áÅEr.È}˜É65Çœ=ü!ðU·[?cOáPBÊQ #?Þ´©y‰36Äó•'(å3P”SdÉ)ï -:çë%­vnn?üRK>çzàjÛsø@Ï‹µ‡Ž&KÛh€ä}q@™u»çŒLL4™ô=¿»`ð -'‡w=8|Ú¤¼Âù ³üŽ·Y.)gyhÁÐXøím®glÛ…Äå~\ý·Ï?ë’)L‰ 0T“>JFÛ1árÕ'‘áÇ…C—άŽ¸ekÜx: ã SÆ3†ÐÏ>¾Aã±ðõÛ’æJà9£µÊzÉ¡ +q•›Úh[ß Å2ð®¡ñ}wéEôuj‘Ò÷B{÷Cª†b€MÕ[ì³Ï¥Ö´Âã›lXT¢2=’–7ÈØ»Õh…jeýD Ý)Ф ÛÕRœ./¨òÛ;º‡*çµ€ŒÊK¥ÃhÕ#J½Êª…Ñý´Àø)Õš4•w˜5VÜEž7µ¤#Ü5ľyìöÓ¼@CE¿1YƒvZD£Ô0¥ Ï!…Ž™ãàÁž£¥zV#•õ‰_Þ-½E,ÞN¥!}Ï6&n ßí¬ÏÊmÃ#ªycßTJýJ34ª–¥åáÂÙиA0ùÈ~÷þyd¤'Wé‚a®oæ?Ïù÷òb¿2ü}yi>Ìg_ÌøfK¸)‹´’¦÷|#M?ï/g—Ÿq®}ûµå£¾ 8€[¼BªÂÐGWã…“7ܾlÈ#&Yç?xd2T×RËáShÄ£VL·Ôˆ!¾¬)[7ž§PñréT´jDÃÙ&o,eõñŸ:Ø—ŠœŠƒŸZîë;eLEiŠLÜëÐÐnO®8.X–¹Š…½ò†éÂI:~Z˜Ç¬Ø0P[Y­ñ„¼½ Hß*ÓNã -`Ä•¹:<…wðÐtB’½\™Œî‰gî3c^”RμͷúÝDz½Î@K>îÞñ7ðN¸÷hĽ Ð)÷>†P’÷|ƒŽÛÂו¸=ŒA¬œpåñ°!Ð'°ïí‰Øßçt[H&>· -ÇÞDpQÕ±# -ZÊ" -Ùikß33°6Ul¦hßÕÂJ¥2µÎšÁヮľ¯ÂS·²Ј Ð)%>Žðg•xŸªA%¶¨ºÆÔóÓ¥¹E uMP]_ÀüÅ)ënGÎA»>Ö0ùÝJI¶w1šfMµÝÇ%á^”œ‚_­ÂS–|!žœ`¶hxµÎM!p"¥“Q9 È8C'Q¡öÄ8Ѿ‡PÅ7 -‘£¯§µ½HǤ J<¾ „ß”(ù¦HÞ¯~¼ÄŸ¬ÒeÆP&«Åñå«+ôï‰Ûõ9pšïOÚàžæëö~2ñºB§w¿ òỷ:Ž¸®BØ*›Ã G–É–¶ZIGϧÍ+Ô«£HöG^ä Õ ©¬ló5=\ß\¸<ú]NLšö¡==u¡åTÕü -²ÂU#áÕ®ÂL œ×¸¿ý±Õ0û<‘&þŠO‘®7‘Ÿ5)wüùÒ‹ÜUc¹'.rÄ÷Œ~¢¡÷õ¸«é`Ž{9áhŽcûI?³OÒ›±Hú0¿üí†+·Ãt#À†4çëßY£êrÛÖò ÷ T×5ØzŒFYj@Fé÷|­böX8¯nÞÌjIÍø{,T ©hÛŽ{fŠs¬©ý„ÏŸ"ì5õLóÄq•ëúýò.—õ"w¢‡dOðûaþK-3ty¿æ‡þõAxm!¹™+ê’Gò­劭“‰†*b±¼Ï|ƒ–Êvvk‡æÙy6±È…1Àª’½9e`«b[G×™éõ=%e#…dÉßótïƒÒùÆd•6ùB¬3¥„cÜ$ýDEቯ, £ SVyáÏšå>UƒviQE -jØÄmþÀ -ãï‚ôT:>ÌÃñ¤ÖŠêس[›¬L -JÐaÛM€¶ å½?¥ïh•DÉï­˜Ngà,Öø“6™u'÷Ôpô1ç®'[frOú–9rFÞêUúØš_{› —445ëö£ÍtÑ°Èž¨…%+Ùªdê=†\ü|’R¶ŸÏ’â; ~ú*_øÄÜ]+M[3’®˜¶=%êÙµÁ½ØÚGB»¼6½ j÷I¹Š5æì°¸lýŒ9DéEÉ ”ç(wðŠ -þøÿ×wíÝE—§bïÈEWà‚Ö†d<$¨^ ¦æü_ÄÉ:àendstream +5432 0 obj << +/Length 1411 +/Filter /FlateDecode +>> +stream +xÚ¥WYsÛF ~ׯPŸ²œ©hîÅcúä:G•IS5V¦Ió@‰”Å–‡JRVõï‹cESŽä>t2-,ø|»–ÓþÉilý@'Ó(–¾Žã麚Óм›Hg1s&³‘ÍËÉÍ[Neà'A2]nžüXßX=]f_ÄÝO·‹å›OÞLk-dì{³(ŠÅ݇Û{OŠûùÝíT±€ÏOóKo&Åüã;¶G›Ï‹Å/¨ób-–Þ×åûÉ›åÖp „`LO¾| ¦Äÿ~ø:‰§X¾u5 |k´û.'÷“_W¬3SÞu ‚“ÅL&~¢ìË0…Ò7¡`R 5¾6á&ø60 zofM"ûUY@Êݶ¨ˆ0‹qAaÝç-Ê"1¯7§ÑViš¦fyQóž[ܲ&ÕcΪ×'/mNJXõ¸? ;²ðúÃk<ávq wù‘4/#ñdCHH{¡a¤òÀæ7/6"ç¦8eÉ°ÛC¬ŒxËâ´æ_Ôî¼™ŠE«´wûû†Õý¤EÇÂ.wÀ4ns·mÚ¾‹#ö˜%×01~`Ô‹¹Žl®V= Ær¨ºuU¿kªjTÅ7mËÕí®Åãü\ˆ'€ ü8Ð/ íGñY°ÒO¬«B˜ö³`¥± Äœûì¡àö +Eå:¨EØ!•žÅ;Ä;í°tL‰,cÛÕµÎr⬩_yN‰‡Ü-Òõ:ï®Â¡z½œñ“ÍÕV´‰ò•Ž)ã×P )^Áñ*Âi™Qy¤ØìOm˜³Šú‹Ö +&ç [±qwiGÆ…˜¸ŠqØklÙ»=Š´,œÕ¦iyÑoÝYŸ?Îç9=žBéóŠÅ6Hk·É…UÓÓHyÜ™]ß´yæâ¨`j!`;K8<¥g0 :G‹fÿ)+ò:ƒD¡Z˜Ü‘M¶i·åÇã6iˆUš2çuV´=ãÏ›¼§Poºmš¦àï€HP²Í¡èßqˆ—ðfŠàš9’…²?mvÅ-D™ É “éCZÔìØ›±¸O+ܺJ¿sã<XŸqKäŸÂ]…Š¿êSb:LÀP[Îk.4ÚÑŽeUæy„üBâÎœ,™ šUšõ¥2nX+ºUú 3­"_‘3;‘bÜ£|­å”Œ¥×ÒëõúäëÀWÉåWŸsø¿þ z xêäòDX$yŠPJ?×êØ·±þ6à©@]1endstream endobj -5309 0 obj << +5431 0 obj << /Type /Page -/Contents 5310 0 R -/Resources 5308 0 R +/Contents 5432 0 R +/Resources 5430 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5300 0 R -/Annots [ 5313 0 R 5314 0 R 5315 0 R 5316 0 R 5317 0 R 5318 0 R ] +/Parent 5438 0 R >> endobj -5313 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 389.924 387.717 402.826] -/Subtype/Link/A<> +5433 0 obj << +/D [5431 0 R /XYZ 85.039 781.388 null] >> endobj -5314 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [157.067 308.629 429.341 321.531] -/Subtype/Link/A<> +1346 0 obj << +/D [5431 0 R /XYZ 85.039 761.463 null] >> endobj -5315 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 267.982 343.884 280.883] -/Subtype/Link/A<> +5434 0 obj << +/D [5431 0 R /XYZ 85.039 736.911 null] >> endobj -5316 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 240.883 508.187 253.785] -/Subtype/Link/A<> +1350 0 obj << +/D [5431 0 R /XYZ 85.039 694.042 null] >> endobj -5317 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 186.686 338.269 199.588] -/Subtype/Link/A<> +5435 0 obj << +/D [5431 0 R /XYZ 85.039 653.878 null] >> endobj -5318 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 146.039 400.551 158.94] -/Subtype/Link/A<> +1354 0 obj << +/D [5431 0 R /XYZ 85.039 653.878 null] >> endobj -5311 0 obj << -/D [5309 0 R /XYZ 85.039 781.388 null] +5436 0 obj << +/D [5431 0 R /XYZ 85.039 617.011 null] >> endobj -1490 0 obj << -/D [5309 0 R /XYZ 85.039 471.827 null] +1358 0 obj << +/D [5431 0 R /XYZ 85.039 520.654 null] >> endobj -5312 0 obj << -/D [5309 0 R /XYZ 85.039 447.845 null] +5437 0 obj << +/D [5431 0 R /XYZ 85.039 485.909 null] >> endobj -5308 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F20 2865 0 R >> +5430 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5322 0 obj << -/Length 3267 -/Filter /FlateDecode ->> -stream -xÚ¥ksÛ6ò»…Æ®ÔLEÁGîSšWI_¬\î¦íZ¤,Ö¡ÿþöP”D93×éÔ‹Åû^ELøOLRå2›$©ðešNë³`r+΄ŘY”Ùç—ùÙÅû8šˆÀÏ‚l2_îè(?Rr2/~÷ÞüúúzþîËt&¥ôDæOgI’zo¾^O…wÃÐë/—WóË«8‹(¼¯×¸üùË4•Þœ‘.¯v˯ûå5ϤLÿœ<{7ï9íy®2dóûÙï“®ôñ,ðe–Naø–×gÀ§¯"içõÙÍÙ¿zR¼Mx×Ø«Daì‡ BÀ £'Uæ«,=. WNÕi®iSdxd±÷©Ì„})ÂÉ,N”ªUN„ð3¥PTB$~œ…“$JüLD$«+ k¦3ᕇ¯Ú£¡/ÒiN¾O„DY&g0&þw×"ÀÅåZLÞjàt²Ç,Ó ³"è•P±ŸEÉ$ (VJÌÎWSäs&…òÛM§×¹©ï§aâéé,L=†0†i'»GHä-Ðê5/ÂÕfû´™Â>BmLÕÀ÷Î׺ãML!÷ƒŠ -)ÍðÁP‚U&#—e[6¦~¼ÎãÃ`dVÈv < £–aE[•zû¶+‰¤ÕުꃿÊ+ŸiKuN,–8/©¬;š>a{àØSñZÝOEløZ‰Go³]Óv$küCˆá+È@¯þ-ECY2™á¶ìï°V(É -‘½è¿bùAšôz{FÁ¦G‘Ÿ¤¬gà³”ïA¾K©À»&Q5d'4B݈ﱂ'¦ÑecÊv™/JžÞ,ÚjcºŽ*ŽB?Š£—™Þá°q¨¡q8¦ÃÞ†-üë Ú@ìåuGÖxÝv³!Ië˜!±6„ãm—ßÑ gÉ{ÏAwÂÌ3¤h|'DéWƒ¿NÏ™Rn©ß£‘±<²RÑÞîåæ¹3¥ÿ›?¯Ééÿc>bP¶L¤hÜËG*ó:¤‚G¬ÑrÒ0çPvìÇ!o§ýX/MÙà0…+;ÛÁ2¦[_¿ùÄØhgíá3éŸ!ͬYãž|³©{'“ã£Tºé˜ =4ÀŽŒï®lÊ6GÒŽÀ¨‡'K¸á†ÕŒ.Ë¿ô­;D‚¢Ñò|Òž|:ÞŸ“K€AÇu¶.ª?î‚7íXؽ79*¬Ù·àiˆ ‰oýÌktIô¸¥‘`›#åuÕÚYO ²!X«k«ŒQÌ*@ÊÞv t¢[ô_¯)퀾þ‡!ä~r³Ôíºc2( ¶N˜8'ˆãµníH£U+õ#÷ÊRà¹aìý%¦·(ƒÔÞ¬á iT˜¦Ñˆ’̦Jxæ=gR îsÙ¿UÉ+{ïÌ Ýð·/pb8_ÑÄWâ}„•mgõÎàƒ_¤ò*èá±àlè†2à -P.Þ«xe#éÇ2}ˆ?«ã û2ColxŘrˆ9‹2?¯ј6Ô›¼X£*¨Py³ 7‹xoÈùü¿^Ü—æÕÅœ Ñn"¢W™‹Vñ÷b“›Õ…Ñ•KHfä÷Ì÷ -²ïÐr”G—£’’шE@V´®îVÎråÖÙ*NØ÷Àà|‹šp?Ôÿ µ^jͶ2¥,‚6iþ®­ª‘f -¢Ø3P›Xà)6ÜXóEǧ¤“i”q2„BŸÙëE﬎Mö‘kŽbÀW¬«Èš׺sž6”y7Øþˆ¼P´ºÒ­·l8!›‡ï3…±m˳ݳÀ„óqçØŒ^Ïûn(…A, ܵqWhû|–öíéXé)בèvõ9.Ìcd6ˆ?¸ª›’Áõ£ ¹ñè¯ Ã.oû¾-·vã - :+uãX›¡y#r~ËõÚ–-ÑœXhÜæÝ7’_Æe¯IÌÙ+D´Íä¯Iìò#Ä¡üa?6ÙÇ(ïÖÆwš,5©oÁ3Îæ† ½õJ¡:•iâ». -ÂÛ;‹ðeÚ;äÙ›Rû=Gq@/º2f†¿©óç»*ünÛø ½¾ OQ5wV׳^'Þ{¥B/ Âk ½ýÎ+ø+³®o&¡'Ñ‚½/¥­OÎl€t\ RBN@)„¢"’ -œÑ*¢N_Æu¸ï "’2ƒÊ®/ãb,àÀ\‘+3S uòT`vð§Å¶@CÊ€|IRŸ›,, o¶-é’‹èPÜ}#¼¡š(vxµS7“±/“ðå›ípN×zR(?8r\ÁUÀÝãÑt ï—JsÇBÈJ8+7Haó -«®è»¡^°ËkrþŒíºšówXê2¤+ÛýÐzÊbÃó—õz€sºñ*ÈŒ25°Xá ÛwyæÕ’¡­Ù$¿õ6Z°í¹¬ÖÞP-¾®c;¥0 pLZqNN`ÎcL.Û¾clצ$Ð'Œc—¶¼¾xéÎiceê'£ -0*Ôa!ØÇ{i uÃ_”+TØ3à … -L)ë,iS'ì–a«Üz -’?llÆ•’€¦Ô»>+å|ÏNŸ™+­:Êöö!$°ñ¸îô­ì¿ãðW¦_âžÇ‘(#H•_>QŽÏÛ“„•ª½óÊ'nl©•»jÆ9ã¡)aûÓ9Œƒ*18#.xÜEi·rF ËÞ^2Do JckxŠÑêÝoxOáˆpwR×Ç<ôzF'ò?T„>¥³za5sæÊ*Ô°ÈYº¤ -þ„^ˆ lèDÐëÅé´^8¤èÅ‹Z½8:oL/†çu;Ù¡‰Ø¢4‚,äv¶.yÌ™ïÆå¿€v(?ÚªÛ•"8îzß|TEIr8]4ä×0QO<ΦÈÁѼ=KÇšÒ–”2ôª¾+«ü—s6ÃŽ$+Ø #‰5x ßæ·&Á#ãWIÎñ~Ñ.Üí$ɉëC¹ê^¹ŠïÑ*.•g2´føÀÚ5³Éháõ;[ç—m~QïôüT¸Qâ«L¼98§Ã¥ÊO¬¦¹pÚpù¶­èy!–½{*AhToa Ô6Z/’@°DaC°<Å°=çE†w8§C˜¶g®¿pà…اôvÃ닼oíÅbû % -¸ãæ@K”PR£ˆw -g,¬7Ö!RemÇÔ$…Ϲyùxþ3¿ÿZÆ þ( ´”NXé-úôW+À iµÕ$J6¹cv…ýg}K,¸¾3”ɘfZûlšWºk~Ãkœ&'¤ÓøÍ›¾Ó°.»†lD½{óçÔ©ç¾ö÷ š×ãþJÏð4»ÍÝÏ*/ÿ‚ƒÙtp”z„1¶z^¤Ÿ&Q(VFÿÄêã#.S1õ¿qj vc­AÓ˜:Ô‘\÷b뱶AŠ£>“ä·XЄNm™QA¹VHQtZúQÀ][б²¯‰ç¾½×ÆË!`×pÂÙ 7kàZ·ÜøG u«Þt¨¡ctKS¶úùˆ/1û@\¤þÞºª+ü)†Î¯(ÄXþ>7£¿äS[m¢ŽÿýÏ¿JÊL?Y¤+ÍvÃ@¢(_`&Þùˆ]r-GnÒ·úùœ‘œ<@ŽòX€±¬­Î#`ךßqiÐIl,¿ËS¥|‰ý˜C„ÿù•þÖ?=éÝj$ýTfã^UA -Ç J% þ= GÈJä1Ãÿzù‘éendstream +5441 0 obj << +/Length 2913 +/Filter /FlateDecode +>> +stream +xÚ…YYoÜF~÷¯Ðê%`Å°ÉæµÀ>ÄŠ(‰cÁ–‘6ûКé™aÄ!Ç<$ϿߺšÇ2ˆ}TwWUW}UÕ£®øSWYìQ~•fʲìj¹{\m`æ—7J(tù±ÖÐ>3yãfo’Ðtz–FθIUîGZ!ÍÛ‡7?¾ƒ«0ð“$ºzX;F’,ð³,¾zXý×òÅMÞíBy_î?/n¢$õî¡Ó,n”W@£êŠjÃãŸûýZÊ«ð¯éx´¨dÖì€üÑp/òƒÅÿ~}óîaàÒŸ&~–œ•#¸º #?JÃW…L@!:§B* b'S!Ã¾Ê ©PL{wU×Ô$ª_vE]]âQ–ŸçQƒèuUì‡a6ãQùyOxŒ³ÔOg<*OÉ}¼G [Óá-ômQ©‰g*쯸óÛ¶²JwíAܯñ:¡!^U|æA>å0K‰×‡­²Ð»­w;d¢F ÈÀ€þ¸ûÏa„™×ñÜç µHÝÙýÄ'6ƹ¯£p8øƉf#Ÿ&8ê› ù©Ç{¢ ·hìÇgg™Ÿ§Ùüì#9šïœx´žÒ*VÅÖ´¬€ÇìçÙeMZ¥>£Òls`Ú=‘Ô{P^_š>h yàýTB»ä%;ð¹8ñþ†‘ºá¡ßÉuq«þï´*† ÀmŠ +"?G+Pˆ29±úØy­ˆòÌ«jÜë…;í÷B(ÈÁý;þ¡ì¶¶hxhµ ©”·††éK¡ÜÓùlÄæ†Ç‰¹CKöAr&Qâ=,²È«™€ÆÁÂÜ;ða¸¼›ÂK‰e)ÌñÄD·´ô#ñ’¶—]Íš/I娪`¦£uÛ•‡E¦½ÂpVÒCx×x }+½—E˜â¥(æa4ý‡h>Ü£P¤+ºëÒò¦­ÐÛaùA†ˆ6d ++r'Ó À"#Œ<âFf‰<ñ°ƒrN^¶Åû[îÂí¸µ¢ëÿa”##Õ£CO´Áa„˜Ô*EiOÜ•;®QC±fþb੦ƒa„$ˆçÚÅè\P®—k’ºZZ^¬6Ò,d#l]産doõcÉv%̈ ÈÄ°KÅäuÿ8Ù ˆX 7rjuü)úd®TÈ‹àÛv¦‘Ù•%ßÚl8¦*RïÓà)ÔhxÚíòleßëÛÒ1µÅ’ÌU.Š²¹æ èú·ª›nlÊ–îE%¬}%ö_“{u¦¨ZÞÙðdYwçÄ^£yD¨:à½nv†`Æ€å­éd– S{®´Ï‹8쉈Ö]Ð hž8]˜úAž¨ ÚJØÅ÷lÎ D?Rá×¾èøeÈ8®í ÷Qñúù×Þò”AçÂÆ~ô 2AÛ¬ peǶépŠÆ„O)Èð'^LQŽÇv[GŽ0ˆëÑøÂeŒ¨–#Êâ 9B’[FÑáÔÛ6i™cëÒðЯÈ[Ñ pXÓOÃÓÔ±ÙÞ#‚:‰‚-•}AcÔÚ{k {GáðhnØl1LR„‰hAcÇÛ ¼uƒA[5ú­0ÅÙÃd‹®1+ƒÕžÚÜ,| I(ác–e@›Ü=Ð1XD†$L+Sìæð¥Á€‚a”• ج…Øì ©Ò«äê°³'o$ƒ†ÞW)7L[æÂ&÷ÝtéÔ‘y¼_ É@åð¯hϨ§"{W±×b(ÅãvJ³ÌûdDõ|‘DÔJ“ÌHNî±áÇéшøH{‹#_k>óÀš rÇ;tPØÍÈU,1B,‡åhAxH¸ª‰ré0žó ^Oy)8Ù9¶´fŨqÀEuÏ–GBíA‚µ/-»†Am°Lò²ŠÚÙ@ÔûôÑý élÀzAól»^œsw[a€°lá­Ð=‚W.yò$8ZöÄÀ‚7ßvþ…L>‚,]Åù«™ü„æbÕ%ÊO3=«:B©:>>[ªûžQ°£ œÈ¯r2Ò\¬)"@öDO€=ŠsöÎä0S1Éß*u<`˜bß IoÇ#­x »X9 NC TCyw²Üñ"ûKžÎùYS¢FÍ'ñxr¹*üÛ°Úgƒsž±j² žPµÌN-l˃/Zš&D¶Åt>cvÑ +ÊèPer†¤»iu8bˆðWˆLx½Ô'À š*-®˜èî´ÞKí’G>Ô­SÕ]Vû¡ŽND’Ø{G¿aË¡@cðpH)–7OÜ{=0L^q€>–;ÖÀX:‘Öê9¢¼V’ûh5^b'¹oóÄs§qƒu’yÆØd„bšrjF,zkÂ_ÒØÒì ÖÄEI1ªp`@ejíÊÕ±(ü0n÷'#:ÛŸ,9Jû°¬¬«¢«ÇóbHëÈû¸æw5Oªë9îHiZ¬ùë"Í©ØTGëÒO Dò8ïdxñ¤¾}‡EŒ‡ti^Ú½7ÐùåJV7›ÞÁw.¯(óý)c‚¯¼t#´þÓ+¾T=<ظÃ\´ÌEä•cªAÓ}ËV å^B¨¿£ ,ðy樒÷´š¿öÛ¾Òö8ö¶ÃÃ1LÖ•å[ÛP1ëáí‰ô†ßYx‡Ñž€Ž3%hœ+R.kI±õa\|b=q|/Ä +¤ÙÜ’g4$súƒ?xá-˜K%›Šà›¼þãË„æâY*€3ÓÜ•l¡ü˜õ–/¹[òOB·u%ê£øN¯Úµü> endobj -5325 0 obj << +5445 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [309.861 384.459 512.306 396.452] -/Subtype/Link/A<> +/Rect [258.436 549.863 289.974 562.765] +/Subtype/Link/A<> >> endobj -5326 0 obj << +5447 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 370.607 273.67 383.509] -/Subtype/Link/A<> +/Rect [84.043 242.621 135.005 255.523] +/Subtype/Link/A<> >> endobj -5323 0 obj << -/D [5321 0 R /XYZ 85.039 781.388 null] +5442 0 obj << +/D [5440 0 R /XYZ 85.039 781.388 null] >> endobj -1494 0 obj << -/D [5321 0 R /XYZ 85.039 654.087 null] +1362 0 obj << +/D [5440 0 R /XYZ 85.039 761.463 null] >> endobj -5324 0 obj << -/D [5321 0 R /XYZ 85.039 635.418 null] +3093 0 obj << +/D [5440 0 R /XYZ 85.039 653.495 null] >> endobj -1498 0 obj << -/D [5321 0 R /XYZ 85.039 355.164 null] +1366 0 obj << +/D [5440 0 R /XYZ 85.039 653.495 null] >> endobj -5327 0 obj << -/D [5321 0 R /XYZ 85.039 325.569 null] +5443 0 obj << +/D [5440 0 R /XYZ 85.039 615.228 null] >> endobj -1502 0 obj << -/D [5321 0 R /XYZ 85.039 271.122 null] +1370 0 obj << +/D [5440 0 R /XYZ 85.039 615.228 null] >> endobj -5328 0 obj << -/D [5321 0 R /XYZ 85.039 252.25 null] +5444 0 obj << +/D [5440 0 R /XYZ 85.039 580.685 null] >> endobj -1506 0 obj << -/D [5321 0 R /XYZ 85.039 147.591 null] +1374 0 obj << +/D [5440 0 R /XYZ 85.039 387.159 null] >> endobj -5329 0 obj << -/D [5321 0 R /XYZ 85.039 128.719 null] +5446 0 obj << +/D [5440 0 R /XYZ 85.039 354.738 null] >> endobj -5320 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R >> -/XObject << /Im1 3957 0 R >> +1378 0 obj << +/D [5440 0 R /XYZ 85.039 135.061 null] +>> endobj +5448 0 obj << +/D [5440 0 R /XYZ 85.039 89.987 null] +>> endobj +5439 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5334 0 obj << -/Length 3540 -/Filter /FlateDecode ->> -stream -xÚ¥ÛnÛFöÝ_aôaKÍápxY iš´.Ú4;›Ò<ÐmqC‘ -I%1úó{nC%J.°bÎåÌÌ™s?g¤.ø§.Sã:»LRåë4½\m/‚˘ùùB ÄR@–Ì·W¯âèR~d—·÷ã>ÆŒ¾¼]ð^üòüÍíË·‹¥ÖÚS™¿X&Iê½x÷f¡¼}óöúõíõ럱Á òÞ½Áé?Þ.RíÝ2Ðõëqúùï?>çžöƒÅÇÛ_/^Þ˜8V¢ùùâÃÇàr Wúõ"ðu–^~…và+˜Þ^ž¾‰´ô«‹›‹ [ñ\tÉ«æ¨btê›T“E‡,J…¾VáebßÑ¥nàaâ­[¸Pùe¦^±X*»&è° Å`÷MËw5ÂÃNêå]H·ø²0ÆËK­ò»Jf°ÛK³ão·ÿ3Pñª¤#ëE˜Y€^ÐÚÈvŒÍl¤ñ¨×ð·YäWÙrU•Eð²´r±¶C.É– -)š,Â1 ŒØÊU€«9ìNLGÌë®Ï«ª‘¦æ/cÞ *y1Ý1PÑÏ?%¡òã켜 ÄÏ&•Ÿ3ágøIÒm@´cÎÕ áÆÞOp÷y'ÞËoÅjß—„{ó`˜ïæ<ŸÀW:‹ðsZã4ñU”Æ·ÌÐÈkú% ™öv9 Q«Ôqb2D /²k°½k‰QDzw›‰ÈY5O¹Ë‰UE+p@¿(R#v£\Ù“Û¼¶ ¾0s±™;ü¨²Ë`I¤A-jü£~Å T7åm$ï¦'ç&â†#Ì“æ¼{¤3¯s5œŽØw.Öo®éú›]c×?ƒñ8òÐ ¾À¿=\oìÈÕ›™k6"{̧G†HëcÐá¦Õ¾í'bšz/a‘ŠhedªôNvø í(âÑ.‰h»ÅlËV)›­¼"ö>ìó‡u)J¼kÁ„¬@à|3Ç[Þµ¡ºÒš”( Ø~FIöÉúGñÞ8¸–/s&º|[°Y¦àƒ^ ø·­Èaõh¡]é“•ˆ#~kÙ’.ß<´ù–Ç-¼?md/yÓfæ^¾Ø‘(X{üDÞû©2É05k¿MùŸºæFCê½Û»’žÂ¶²;Pí·NH4N ‹Ä™f[ôÂìa‚íÄb´î\x_‰ÅG¤ÈÛðQà è¢dÚ­…siõ “]S1%سÁu´âhH `ÈâJ,ÈeêÊ-ø§–!$̪€}-Éf 7¨›>÷ÞÒ®ùè¿`Æ?å˜ Øç0;oè˜Á5E¾Žb×ЛDùQj=SBŠ”y¯É^õ ­€@„ÿ´ŸØ-½i˺/ëîa 2EÀbøabÅU÷ÎØ_¬Ÿï^_ÿçê&ßÞåG?ÓÒöÖß¡¯ë(º9A‡(ó³X§ÃsÚá™0ƒÀŽ…ê†dnU ºB[ Œä¦l„#S»NÁ Dº±»ˆñ^‘¸. °¸FWìtÐÑ‘ ,xT„‚€ àìA¤8¶Ò¡ƒ˜Øì¯ÄRÈBÔÑ0%.ÛqE•÷è›vûŒØ°TÆøàêjÉ`Ÿ!üÚ•«~ߎ}Ò -øv¢_7è5D–¨†h­5ë”ØC.<¡x±;»ùz0|ìëïÅøÀI9ßr|$ÇH†˜‘iv=N7µìQ"OÐ9ùœØ"r{r5ã²’&°öZ€~ð݃3„pïðˆ¹ùb= `± 8òÈ{Ð鸿%æü!êL€ÉÑÑ Ëí®*hÓ!œÆáAHa„äøA"•"˜‡úx|鯛r…ËÄ:åÖø‰Ì†%ú5k ÙâýZ²Rœ²\õ„Æ:0§ƒêÈd¾ÖÆ1]ÊST¿BcÔ²±fËóžýÈ’\ߥzþ‚G -‡('&]4Ób­Fûç¨S751YÛ³7aNÛ&2ˆØÙi±¤¡Ä! LŠ>fËá;œ˜½*%ŠâqâÏfHˬ Ã)Eí¤þ(ÀpÄ*¯¹Ñ矬Ä"kÎÍXä c æž¿yÚ,Ä3ÒÙí¿G…«f“DÅzÈ+@9ÑÕN†Bxdž¢.0R‘EDð;µ 0p ¡¬ƒÓ³Æ‰BûO<îš~v}˜RŽÇ?e`à]ú±Ñ³B`a–KA4ñ 0™ÄÃN’›$G'‚ïPúü r|ÞDêtæ›ÔLÎû­è™.±Y¥¦ô›&aÚ†Dh)â8yËN¬6r±9>€â#Ž»fƒÉ™¼Ý’BH_Ñy²;@§Énž ûÙ…ìGçÍ‘Ý=o–ìOQ…¦Ú1–Êí¤‚I"2§ý gT¼Q¹~L5X2DÖ_J»@6ë낦5o%Hä]ï"%ÑFÞûo€í‹#úJ­ü>D(mñuµl 0o<9›°ÈB’$øîmî/krþåÍ<|X‚€!Œlpíå={‹Ë4kå±Rr§ÔØcɉÖK¹øq6rB-ȨۼOn[q8E†^ôÕU×Í ä3€ìKÇÛ³!ó~j©sPÅÓL-˜øn®ìøx|*±…£TYÉ ê‡){íWekyÔWNèFœ†a< -qŽ ›G…a"§!Ì]Κ°æ®ËëÜp)QÛì6 .aЭӴÈWHUÔª:r8áÆ’Ø})桧˜{g„ÔEr+«f.7ZN ´kâ 4#IA·½ó!Þ¼ŸI ˉL$pNñ -ÏüðP5H;“®]^Q±Qy'Ý—¦ôå 3:Àœ±¢ ó”=sšµ¡‡ÍšÐñ°‰,H4ŒôþA2p'89E ñS­ž Át†ôÎh©pxÞ,œó\:¬òÝ”¨H§ òûÍhd!ä5N1«+8Þåm>–D¤ú"´Í¡í–óFWaW¬%ýK"ÉÏà(Θ(èÚç[ÞJN#¨I—¦×ì7V%Ç|ucт܇ dé‡õà9U^5„Õ–žB0u?`‘†p¦ª]4­Ð†ïrªÝ†5[{¶SH~ŸJ<üv)âϱú‡Aæ«èo¨ -¼´ßyǧpž$ÅžE»ƒß.§T÷Ž ,bJ™4Û¨êáäq‰ö*+ŽÏᮉoæm\ˆ¹)Z̺i‹µÏW»®%È×–Xfb€!A¦Ý¡e¼u9Dû+ª¢âààb1ŒÈm ±¢†0â4Š)ÕSÙØãêþûŽ¡sbM5D19ÙÀ£Ê¢[ÕqvâxœAj?Gr-Ïp0¶äOÞñ·j¸\6Ž`Ô%´Ï¹X½±S’Ä5wEâë’Ÿ·â”ÓWbÕ†¡Ä÷bYœÒr[Œ˜{×ÙçsVûuÂ"‰¡t1€ÚI¶Öbñ& Rïúž!Þa—ÂÐ{ýÇ-8·Àñ]YOÌÉýyÀÑ5Èy£Âl>i©)R‡Ú²½H7,ïH㤒Æ43ï‡JOF[^&:¬ý=ŽÏ“ÍV*ÄÓwù…ýô«·Š#·äláÊ9]¢SFûqšLJt¡”蜂êŠU4þ" ‰÷ksGQlac‰ZxÊ1G× ñœ}{¤Z0Îr/~=râš K:>ÿ†âÀœ®Ï)­ý ãçýÑ.Îh:øÌLTwK|›{ÀhQ[s@„ûbݲ¡×‘yLîDØPV<¸s¿Uß´> +stream +xÚ¥iÛ6öûü +ûEjY¤D³H$mÚ)rmfºý P­±µ‘,$g2Ø?¿ï"MHÈÇÇÇwñ´šDð§&¹ £¸˜d¹ +ã<Ÿ,Ú‹h²‚•_/”`ÌeæἸ¹˜¿2éDEa“›»=&&žÜ,?/{þþæ—ÓYÇ*Âé,Ëòàåï§*¸fèûWoo®ÞþŠ³€*øã=.¿û0Íãà†‘®Þî—Ÿ¿yñœgqM?Ýü~ñËãÔñ\ÈæýÅÇOÑd "ý~…q‘O`… +–Û à34I,óæâúâ_Ž¯%ÞuN+&ÎC“ǧjQæŒZLš(!µü'RI¢TÓ™ +@)¹QÁoÝTçÁÃTgAõ‡´ØÖÓ™‰â`\óŽ$‹‚Ån “1–08ê60¼„´ÝÀj×—#|kX¦%7Bê3Œ7|öÀŽhäÁˆ¼<àJÇ;ûª)ÇjÉ<·î+:y¬a²gz`Œq [npqDiºm +œ)ÔoA +Y‹ð³8Kƒa·ÀÙg&(èqÓ‡ºixýv:ãs\îgìZä‚¥&þJTvóÈ8‹¾b)hêlÉ”xŠÂÜ–õÆÚhiÏø#Á‰¯yt‡RõLω£èÂÓ ’¬ÝˆPÔ~ª¢W÷x>Ü4zÙ– €”Ú6µ¥UŽ5¹Á€Ë hÍDV†¯e»uNw >•Àåë÷âòþ-nÔÁœ°ÆÅ|‹6«ƒWã½Ö`Œwµß#¼šÂ±]ߢéqùÅõÏÀ„ +™ìk"»*¾¬†D¥“ºU_¶è? ù!° ºš%qx¿«{¹€á®Œ«¯õ0ž(6‰ ögø–üÙz ;µmyÍ¿0u$o@M‘K¬„§¼ªgئlÝÀ£lUh7€ÿâ9g,ÞWw;{·‘ ¼ù}ÎA¡©‰ƒ7èŸÅ»’(Ëcõhqw=ðw`Óú¤u°ršã°C—G¨Xk#~[Ö¾:Xž²G®‚„)ÔU?0·¯0¤“N`eY‘f8£æ°Â•ù«T{±Tea’BH&´›Å©Áh8,C2w¼å0üBŒ†ðË[Ê z­Ê‚å[Kˆ%ˆèjÆAÎ^zXÀ@×QYìZQ“øÝ6ϱŽ‚¦¶fˆU¾ÊÆô²×röÝ a¤ŠV§T1ýwƒû¡†f*JÃ(ŠõHÁy×s’‹=óÐ)÷žòiR¬Çíå|Þt‹²YwÃx™Æj¾ìP¹›‘4®Ç¶9f/Ñy˜íØ;JÈç„©8¦„L…O)„.£ŠoE¦aU…†5—ýS†I’ÑYPé,€Aј(xMö3]¨z´¸|ô‰[tòF€<ÔäF0ÂRã—t È«žF'¡ÒúÛÒìqž¬eL¡Ã8âïºlÑÇn)ºFú}IÑOÄÈ©ØÅ;ÃE Ù™ðz}[° ëzË»(Ne]ª™pvtö¢ÜðàÖ’'(ñv[7^6Gš¬J¡*q2Æ‹ ãÛ¾DvÏE§Ý–ÙïzŒÂy’oÀ±ÒÉ)ˆä +3Œ ;ŒeÓxÙÖ%bÙÚ!㺖5ÿ„¤ûò¡¼mª¥œüÞ« kYÝQÔÈá\¦à +Énf3rv.ú.¸|Âh^7X'éÄØ + ãÙUO< +EWtû|×3†ÆÊ`9†NRÖR4—DÚU™àÝïZt”Í8–AœÕilcž  Åq°ÃȆ4Y^U~Ñ$¨…¬ç6$ÛÀ[Q1N +“†TöÙQÛEA¹âqtŠ°¦f…`F +‡*øPÚà몯\ŠÛLJ®貆Ä»ਮ©Þ05*‹0ùúìQE +ßGRì»ÌÒ+t›ž]ô‰BÔ±Z …tGˆñ§‡1‹¡";±yœ(º O 7‘Vñ6áÄW'¦ÙD?Y½!ú3þ¸æÇшé×_â—+ðÇW‚ÕÙ£-~\õÀǹpÛÖ€®¡²ûow‹¼j“÷;Šz…á®"O‘µŠëmrø8xÇåHÿPÛºOÃÉ–d+B’P™”ÊJ`A¾~t¾Xµ ú7DÏ-^OG‚Ét‹°B^RW'QªlÎT`7cÖõå4ÖPáœÖ]q&¹–º«Ûº4ΠIåvIí­ ¾Þ¬(!fÁ;A+ùóš•îù•!$æã@‚’Fã<ÚÄ`¿ :‡8Ó¤¬S‘t–…i¡„Õtp*Va’ÙÂsGÂ4µkÄ2ñ›Œo’ë)ÁJtã3nÓ¹ð¦ÊYê^,ËÂêß›°ik–BCcÍmω)»4‡“mÏþåRO¬u@ +‡ÅÀŒ+ï®ùK-a9‚EZºbÚp䀥šJPØM Éf1²ý`…Òq¥½&Ð+¹óthaYû‘‡ð÷{KÞ%¯·ü?™˜Ä±«¼dK”œ°'Æ)wS]7þ¼ +ÄBÃÒேu½Xóxho— ù·ÃÐ@n˜2ø;ß ý0æg±ÐzÑ×$Šô2Š"äòŒ(°sÑ?nÇîoqÑbÊoŸÂ‰(Ôß ˆb)+?Mùcÿ>¹'‡Ú¿¡àTä˜BÝHBºmyÜá¸úL šû=_”‡Ef#ÉOg…j;ƒ-Œ ¢a 'éÝÜ‹™wÞa >¬Ý‹˜.üö½1jYq•#ír2y¥.ˆçΤ“ÓQ˜©ƒ§Zè‚h“úõ–±e!Ž_é@º•¸†Mî½ö’.å—"¸ºs„$‘Áì{U/Ê}±•ízp¯Ÿm¯‚ðgüñ ê“Ϥz…"'º [ÑøvŽ¡S/bå:uÌœyŽ¡‹òb%S°|o„ˆ°Ã&Â(jŠ(®$ÁPÏ„q™-¦Û–KcÉèTLaD –+d´Í,ò]m :T—AÅœI‰¦gÞHÚJ¸îûK&~“sÆ-ÀÎí–ܳCÇÒÆnDª}9|]MÈ®Ç>ë‡'š?(q¡ÝUãQ\áKµ9û(Žaj¾ BîSthWtxÄèÉ×n*•‡Ð¸vúò}ó\D!xïDC’Œø¦Ü@Cx$ž ©4 ó˜úÖÉýD…QR1£xcbz/ æW­R“Ÿ;`oâq(tganˆ‚“†œ™‰† üº÷©Û5èX†«¸Øh/[ƒël¸÷å”=P*…R1O¨˜;LoÊe|ºˆ<æ2¿Ä‹Ì¯OÆ PIˆëìøñÑèyø°Oì\Ÿ`Kôùbå¥W¼óƒ0b«ª3éØúðRœ’ߪÅÑm†Ç±¼8b…Ç;ìÉèóä8kÃ#©ä‹\üYD~… *_ª9‹¯„]$—¼©µ†+ŽúB˜—MØ\0ÙÞh ,ÛÆsÝ0=gòV둇ò1¿.í‹ô7¸êä7îÞ¾b§žÁŸõ[$Äv2$YaßqèT‰1#ïhwôÔ`6Ô;ÿP!¿­vè0˜Ht°þ9*º÷Uìëj*;r bÞl;Ûù& +än÷ï:d2 hãåt–BKïé·Ö‘7ËžaùùAà † P– ª»-ý8B¥>íàWï„Ñ¡ ef†/½é~{KuïX9@9Sv9Y[þò”2ÿª‡k÷hCè m'\úÿ´ùp#=äºß_`|Ï»Õe…„’ÝG5óÉKgR˜P%éÄ‹Äß×1y¨÷³éw%›ÉÎþú +ÿYåßõ#¯ËCPµæñÆFëPC*ˆ£P³‰µ6Çj´?3’ÇðÿQ•Xendstream endobj -5333 0 obj << +5450 0 obj << /Type /Page -/Contents 5334 0 R -/Resources 5332 0 R +/Contents 5451 0 R +/Resources 5449 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5300 0 R ->> endobj -5335 0 obj << -/D [5333 0 R /XYZ 85.039 781.388 null] ->> endobj -1510 0 obj << -/D [5333 0 R /XYZ 85.039 721.69 null] ->> endobj -5336 0 obj << -/D [5333 0 R /XYZ 85.039 700.697 null] ->> endobj -1514 0 obj << -/D [5333 0 R /XYZ 85.039 587.292 null] ->> endobj -5337 0 obj << -/D [5333 0 R /XYZ 85.039 539.158 null] +/Parent 5438 0 R +/Annots [ 5453 0 R ] >> endobj -1518 0 obj << -/D [5333 0 R /XYZ 85.039 471.161 null] +5453 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [204.407 665.788 429.761 677.781] +/Subtype/Link/A<> >> endobj -5338 0 obj << -/D [5333 0 R /XYZ 85.039 449.301 null] +5452 0 obj << +/D [5450 0 R /XYZ 85.039 781.388 null] >> endobj -1522 0 obj << -/D [5333 0 R /XYZ 85.039 164.907 null] +1382 0 obj << +/D [5450 0 R /XYZ 85.039 651.519 null] >> endobj -5339 0 obj << -/D [5333 0 R /XYZ 85.039 144.317 null] +5454 0 obj << +/D [5450 0 R /XYZ 85.039 617.077 null] >> endobj -5332 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F14 2895 0 R /F35 2880 0 R >> +5449 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R /F20 2961 0 R /F38 2997 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im11 5348 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5342 0 obj << -/Length 3794 -/Filter /FlateDecode ->> -stream -xÚ­ÛrÛ6öÝ_áñËR;M¼&OiÒdÝm]mâL3Óö–h‰ŠTI*®g~Ï $QNfv'—àœƒs‡ÂËþ…—Yì:¿L³Ð×Yv¹Ü^—k˜yw -Ä\@æÌ÷w×o“è2 ü<È/ïÆ}b?ŠõåÝê7ïõ?^-î~x?›k­½0÷gó4ͼ׳ÐûÀ£‹÷7·w7·ï°Á`è}\àô/ïg™öîèævœ~õó÷¯¸§ý`öÇÝ?ÜYL-€UŽhþyñÛÁå -Húñ"ðuž]>B;ðC˜Þ^ž~ié×.þe·â¹è’WMq%Ö™gú”-aì°% •¯Cu™Æñ¥o·³y蕳¹J#oŸÌ+Û]-›–›bÅ=ÞÓ(ø³ä¶mÃýž÷¢å^[W ¬[c'†©bYróFÛŽW|(¶3Xq/  ½×¸/_Ôwf -:rüã ö/»ù̘‡È«œiºýz]lÕ¬ùúð0l<âQ%Ññ¹çK|¬Ýðü°©zn]íºö&ê’¼òé$áª{ÊàòkÀ€;†¨=ö<¼ïé4<^%^±§³ÊѪe1ЬÀ¶H_ýÄ¡å%ÄžÔCT -žù=ˆƒ{Üà‰!7°ÍK˜µ¥±Œ¶Ï¼jl.Ûæ÷ ŒðnöÝ,ä…ˆ;ì2¥s—Ô˜(½y˜Í#•¡éÀëP<šž;( -6lJ ¹)¶ÒÛ´ýÀ­B€:¢^}ǽ'¤¤ÝómƒüÀVS -’¼w+[Ôµå8\ñ -á’ÎÅ>žyÅó°òTdvI ÝŠp «ƒ ©@>¹‡0û†G[ù®*ࣾ a@×l‹%â¶!á(‰@¦õH&‚5f-jÚšõŸåbuŒ4—…–$st»d6ðvkÚ|è'H/–Ä&ÆMTb`bsÍN8CDˆFà+w矱ƒIeKŸµé /³‘¯£Ä5^I”…Ke°ãÜPàÝîÃL‡pÿ({ø§û ¸%‰·Àa¸ùËÁý2$I½÷7ÐY¼`8¢†ß"L=”]Ï}¢¾ÊîKÙqû?–‰©Ÿkv3K²6e3È:ÒzA!À«æ@–3RÐCdÞøàÈ«Á0 †i3"8'§ô†oé ³Uê3ŸgösÞS$Aâ‡AH¤ñ±HØíe A³x´,HR[ó8ê#5vDÐȪüR-Åé`¿Ý UÛ·‚÷ 4ß±¶ÁQ…uhïû=+ºÌ‘P¶¸÷—j5š/ÚöµOଊ@{[4ó ñߣ+*–¬+ ß]Ù½UdíRס_ƒ? Ï<¶ ³ -1xØÕœ²Cãêf!•C| -û™Æ91ϵñ< $OtoiLOµ«…ÃyÙS’ß°®láz4ûhU²‘íØ®ÉËäkzÃO*÷¿Ý±›oJ{ÑÒ>0Ì_pÚòŒ¤w_®c{Šµ…ïϵAóW2Øân34þ¢†XvYè÷£(ñ^ív5E¼Þ9¶á=£(õú§ž1Úöx#Y,âˆsEWrãrb“"þ†‡ñ¾jd,v¬v‰EÕ˜ §Æ8ª›ó·.YúŠ{¹o;PŸÓ+ÝAúáæP®‚È£¥@ÖJ,‡ÚìGàËSÈÒ–·¦ÈCçáÁ-‘M’¯â¥:Á…óG“ëßt=ïd‚::—ÔE·.‡¯¸Ü²#§›Ë.ÜtrA–ñ ¾áw¨ßˆèàVEÝ®{žº¢ék&»–x麆W_QgN—°1Öd?AïŠF¼ZÞåorà -¦œ*±Z+@¾Ý™Í…Uü'9ŽÞ˜ñ¿6\5øà ø3*¾™CËÚ ¼ÎƨâáT(\)ZÖ+ŒFTľöƒ 0F‹dké -º^Ä—Yüj±xÃkIÆñ‡Sl±ÍБx™Òó¸Û;nWý¹0´+øI¸¬-WbÂ}*Ñ<|j_`XÉUÁ¤fœVaN+–ÿÄÚ4ä=ûã#³‚-%[X³f<ÏL$ŽM6a˜@ç¹G9+Š<*bs2“{ÆÉÊEž+É/håç«ÍI9ÌŒ¢"„Æ.¡J'~š4·dF"°_;¤Änn8;²>8?ì'ˆ×p…–]ÉìÁ¦–Tq†ƒcƒ¤¬£QâÁzgõ‘Њ$M›ýŸ¬ÅeÏi/„}ñ½†Ý) FÝ·Ü«(Ø#/„é »÷1&‚ß«bþ0½.{È(ˆÓ³¢B>ÓÞOì&÷ÁÔõÇÛ›OxéViXx7ÜeÓžEìZËÑÀØ„æLŒ‰m´3¾ê“yÉ¢±fáÄæyBÀÂ.5æð4æâP ,aCÁBw ¢ÀüÙšãƒ0”È£e¤`JØ—Yœ¯÷&XáÜŸ@Ù‹Ðr‰ð)b9µû©ÞÃè(®MZj°È²ª¨yæ4jýzì2Žé<÷•<›Ž906÷ ý99¦c-Dž;¹o衸Æqà¹Y!劜s -Ù´ÍÜ”:J šÓäö#Ür@zŸÎ#8·ý$ˆ°$ -‰(ríSÿÛÀsuµ­¤Y âË07 b‘áœk¼bP{6I…"9ºÁžw;-ñ˜×‹uÉSíƒ`cR$ј-L‹™d˜“µª[ Òéà$7Ö,µÖ Ë¿ÄXÙO2‘[˜í9ÚYµ1Â̲ %´!ˆ[ÒN$Ô`AbPâL²IÃÖªìGnÝ3š*Φ´ª‹{‰öÓX-¥Í¥Üd*µ£aLj¼­ -[É=Qh›H 鎑NÆt¿Þð6\9!ÃÕŸŽï¨è«@mÌR‰ÊÈMQcù9ær¥2åʹRäKˆÌÔªˆ‚?8HÆÊbp‹­48‘#¶²ÂÉ¥M—q%zë÷7 ñ\8BdœÄÌB#€âerxªÀ¹Ü½E$£È‡¾ï04ëݪ‚ÏŇ›–b©Ã%[ÙáÈîT†%˜çEäÐ)ê3ŽYm­7C-XU’òšJЩ¦mmÖ;nA :n:Å”(2¯Ûb ååÄÁ¨¬´e ˆ ŃS1 …ÌiB8©yÎ!ãéy„ë«…{»QĉîEŽðPž¿ÍµôÎ9Õ¶B¬E{æ+ boŽž Gk.:K„È¡8л‚p‰Qå)Û úlµô‰KÚnÅ',P¤wýÛª¦üP>¤Æ¸‰ ÂI~€™0CY×=ç<œÈ@Ãyìá·zÆ#cu†ûnôs´k+bb—¦ØŠ2°ä,̈—Ä âw,ÎpŸópÂÓäwÚ©Xã³Ý,(ïš(Õ QŽ¤"EpÀžj1 ^+ž9 ”7ðäÂQÐì}ÏKÅ•Àšºd¬`©d"Íàî Žb wÖ[¬ÒF…L~‹l²mÇ™Èv¦ÆcaÌÑt0a>†uXy ¸’Ö ü¥ˆÅRFüòG°2Áº[a…Y²iØ0ŽÛÃøø!§©Ôwç´îØŽ…ž)Üq)Fê0g-=&OÔ`˜˜x±’mÄI)§`8©ÐItÀc]Ѧ}”ïóË&²s!¨Sõüó‹s>U  êÿ€J-—Ö=ž{Ü` ž%Ä@œ>C|'wƒO)ÍI„ò‚µm’JhÐÓa/W‡c’Ú—]Tb,*6üý•dfåÔxæ¯M•®r²1óéÔ®ðæqk²0Pp÷jÙvå·¿IOp ´NÈ¥6ÎK)Ž‚,Õ‚ÃpSéXâ¡D¼4®$ø¹ÉÐ%ñÞLÄzM¦ ".ÜÞ]«^Â;¸z9AŽóRŽáv$GËÝ‹u_E•÷jÕÚÓ”ü±3”›!Ë%Þƒ®ÒŒÂ}“2U­½¹'šÃsËFê÷Rý{í:3ã_8Ë™(‹.—òþJ<¤—có+…Æ<ÉjØ`³ç€žaøwµ™…eèöűZY•P‘Ÿ)Å2 ó†UËýÑM¨2?I³’þ5=9Nô~ö4†89ì@uîÇYìF®C©ˆÃsSð­¢ñI}`U¤Pæ³>EŸOi6Óš•æ`»èM &o¶”ÒNÛv÷%½í¤<§ ܸ…¸5/rÝÒÑkß©„ph+΂YµëoÅ=ÔÅ Ámo½ ͈„ÑÏ4*‘Ÿ¿àz~â{yNFòÔTø¼ŒŒ0çeD`¾"#Ï&2r|Ø”Œ8‡‘Œào&Š^¾ü; ¾/æ 2#gšæßD´{ëlm$€³’šà÷ôƒÚ‹g‡o™ô»È ûŽ{¢’Ó­0d;B+ËBh]â@OGÈBÚ;ñ„`‚ׄ£dãVš8z'¡ÔÇsv‚†²ìJ4âv+z@Z¯-&IÀÒ–„'CH¥ßÃG‚$ö3•Iíw‡Útü r?àLûQª¾þk:ÓÉäoéæf«ù¸×é³ä1~%æûFr,"þ“Ï4ù#„U‰À¸¨—ûò\å1ðÕdàÿy¿ÿéW–6|Œ´Ÿé3ñc W¨Bƒ ⯔:Æ×üóáÿ_^3endstream +5457 0 obj << +/Length 2589 +/Filter /FlateDecode +>> +stream +xÚ­koÛÈñ»…à/¥€3Mr¹|´8àri.ñ—º±ƒ¶Èå%Ñ"cŠdI*Žûë;¯]Rå Ð"@´œ÷ÌŽý…ÿüE¢]O¥‹8ñ]•$‹õîÂ[laçí…/W‚r5Áùùþâú-|ÏM½tqÿ0ÒÑn¨Õâ~óÉyýîÕíý›Ë+¥”ã§îò*ŽçõÇÛ¥ïÜ1ôöÃÍûû›÷oñ+ ï|¼Åí¿}X&ʹg¤›÷ãö«ß~~Å_Êõ–Ÿï½xso9µ<W)²ùï‹OŸ½ÅDúõÂsUš,ž`í¹>lï.€OW‡J¾«‹»‹¿[R¼.øÔœV ÆH–úeÍE¾FÊj.€]ßMµžjN{®öBÒ \þ»ÒÚsîJøصU¢G±Óã×Ê]7õ"Ô¦ïäÃPÖÛž!ÍRyNÇø¯I¯wçÔ&®§/ 0⾞1½¹*"þïÑzÍò*ô40 ¼í‘c\ì²eù1ü`Ê)ò.GÜÈÁ­ž—Ck‰ÒhaQåøŠ¶PY/ƒÄÀz{… ÖÙ@Ë ¢†L*ö-Ÿ|„¦FwË vV¨÷5b5Hé÷†H!<[U9ƒVY_®™Ï×¢dÐÝ•Þ‘’6ú} ×í¦þ|ÆQ»©JN6NcqZuä´êÄiñZð|5gJß Ý8‰Á”®Ž£)Æñ¯5¾Ÿ¤nD‹«(NÀ²g¬o° Jüæªhb-YãÖþ‰‚(u£X/&7°cp^f瘲swÆw0¹|§ï ª8À9ôŽd•kEs2œ&Á}Y–Ôw=?^Daàš#ëÓ¶jƒ¬ú<õ4M›U“ «(g‡R¥‹Ðqd¡~d”g™öúŸ=P ,ë-Ÿ’ÃkÔí^g-©³]~ÀÀzß.'—±ëAª%!-û@€Ó|÷Ÿg®Z7œV$0QÞƒK^¡+ÝÎ+åDm†—_]jídxâºgO¢ˆ†ÿ§©®ûÌ:G6Ãæ +6(Ïiœ®ÏV“Ø{j›Q)*{…Â`²ùn3n÷y/ +iâssgžºrø.Öô‰±çŽ¿hz2ï;Ûì2e´kXÓÃüý“\µ11MîÙŸÉ«!T^OÏVgô9H¢þÿÖ(ØêÄ¢ðÅ*í‰Ï5²(1 }¨zôCL‹¯Œ´Öìù£Îmò¡faÁB09×Æ5CZ*®ÓdÆ”{®xˆb*®©^A6㯓aýTNx™ReHVÉÖ[4aÖ¥)šh$?倘ÆJ@¦ < +À¿þ"$êÍŒKÜ’Øýp·îJLx_¬œß=?4žŸý~e¡:fé8 ;Ì +ˆùâ|Ñ×3l]•9 CºÃ+òw Æï9ëWSržή酕æ¯1ò©É«ș7ç±½mω’X''>YÍÉ_7x ôDµ%Ä€Âd„ÔŽ °·ýȆCÁÅ-g¼Gá‰öˆóà@™\ ÝF˃ÜKžJjÆš½|7-e½¼¶.Ç2Þ{ûñ†YKµ¶\gCÙÔ ä0ôudráiJ9°t00 +@+‹’QâîC!¤â\¼†(¢ïãì‚° ÉƧºžaeÝàÏùy 畽ªÊ$.e‚埄¿i¹eÔÚ}šZná–ƒêÇ0cwÔ^DeD€m6qIà3¿ø×2¤¾¬#7K5g5Œ2!;Ï ì².¯dÍçÉ]Rvj•ØTðaZs\›ú›ñ±Ú¦²Î…Éu…Ü?ÊÕxâãû›Îòèĸ‹ñ#s b¼3ëЀĮQ)•Å]90hÛehŠ¢\Óy°aþM¶(çÁï-% X`•$’&Ø´1Òó훲3}Èz0 Pâo‘O8:l r4Èé$™ ø<ë*1Gì9ù·µé=÷}9Zl‚rŸÀ܃¤;Ïy‹½^Ÿ8ë¨W‰<´ÌP6“º<ñ@Ø;ˆšK†œ0PF6î†áT¼ÐŠ´sI¡P7¢ä‚Z› „®•ó›k°Q^td@i‡½ßk… M³C6D)ã~èr~§`ô+íÜ< "»ÆDühE0 —žž}qlœj:ç„Ž¬ñ÷i;É~›ük¹Î±”OÉ™Øõ‘<ÊŸÈF\ ð{¹¢­ü±=8ºR×6—g»sÊðÊùÀ-=C<$M¿)ŠÝ˜ºz®ó„ÀEªÅäiÖŸ;n()ï”òŠÙQxæu¶ï¥ëÌŒqÔ´f*©™ØaÚÂÑ”‚GM„{¦ƒ Rí¦:xq<2Á9;ß b^ÞÓùŽ’ùÎoÍ´ÓÉxrjKšú&ãž&9vRÈ?2õ‰»|l̃Ÿ˜?¾üœŸú@Q‚Gåˆ5âœmi¹¡ +H¬w4ÈQIÌVJ"òzøì«r[Pu$?ƒ Š¹F’*¢H!imgò§¥µ¬ñq^Á«|Ûfš³¤´‹nŽqkòX§9X–<åÜ Œ4ç×왟m^çöˆwf°s:;A}Û¹o0wè„Ô@¿ðP—àWÒHðz“c]ªs IÜ~î-Ed¸n +Ö“4êÀ“ć“2šd4£O¼À­Š{ )Ñ`Eh>Ü™§»¼jRÏéÛ±¬KÖdzÌàü¦6E>L‹ÁúL±-jŠÛ)«ó”Ëâ¾cÆ)Ų1Ñà¾<åRÆe+—k9AÃâ‰48ä†|¤;¶vùBYIФoN¹‚Âí܇!6tâ|±íšª†âW›fqè;mÖe»üpŒ£Óé ¡–£Â lÞñüÍN$h_Ü£1‰fýzص×cÄ´Òv)F>¿Û¦XØÚä•°6áÿ¤¤}¡™u”Æ®TocÈ|¶±jÆŽžž]þ8V~pÚìhÀ@zçøþ¤\ðÈïbv.És†K>õ»§=ö "!È—?Ù»yB!æ“CÛ®¡aöÿÂ/àíÞ&”Ù†MY‰™T'=üòõ:Ä,! iƒ”£Iû­!ËY7~•}Í…‚樠¡LÙ”5µ«içýQŸÖtŒÁ’»WXôä-šI—+dQsÓ'€Æ)2e¦§Ú ŽÂñÕËE;¤ÊÌ¿=ÿNòBŽÊF? Mß‚`2yæ•Õ!QOTÇ× |ŒG‡ÂúfÎ{tn˜RÂXÙ¿q ¼µˆì¿¶?ƒ½ñï]( Í¿’¼N•Áó/_„¢Þ ©´AÂëÓjb»Cˆ¼žñl[WP»  Ñ{¤Ü¶O7?–~#W5r.³ó&€ÿ(xxøÙøÄWŽ Zp\É,<,öÀ©^ªÖ&Íl8×­)Ï ÒùiŸú?Mû”›¨3c{nà^õ ˆŽùÕ*qu¢Nþ/¹dŠendstream endobj -5341 0 obj << +5456 0 obj << /Type /Page -/Contents 5342 0 R -/Resources 5340 0 R +/Contents 5457 0 R +/Resources 5455 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5300 0 R -/Annots [ 5345 0 R ] ->> endobj -5345 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [277.578 480.435 451.387 493.336] -/Subtype/Link/A<> +/Parent 5438 0 R >> endobj -5343 0 obj << -/D [5341 0 R /XYZ 85.039 781.388 null] +5458 0 obj << +/D [5456 0 R /XYZ 85.039 781.388 null] >> endobj -1526 0 obj << -/D [5341 0 R /XYZ 85.039 664.197 null] +1386 0 obj << +/D [5456 0 R /XYZ 85.039 761.463 null] >> endobj -5344 0 obj << -/D [5341 0 R /XYZ 85.039 616.861 null] +5459 0 obj << +/D [5456 0 R /XYZ 85.039 741.134 null] >> endobj -1530 0 obj << -/D [5341 0 R /XYZ 85.039 399.026 null] +5460 0 obj << +/D [5456 0 R /XYZ 269.675 691.919 null] >> endobj -5346 0 obj << -/D [5341 0 R /XYZ 85.039 380.154 null] +5461 0 obj << +/D [5456 0 R /XYZ 85.039 461.055 null] >> endobj -1534 0 obj << -/D [5341 0 R /XYZ 85.039 213.727 null] +1390 0 obj << +/D [5456 0 R /XYZ 85.039 295.952 null] >> endobj -5347 0 obj << -/D [5341 0 R /XYZ 85.039 194.855 null] +5462 0 obj << +/D [5456 0 R /XYZ 85.039 261.206 null] >> endobj -5340 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R /F14 2895 0 R >> +5455 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5350 0 obj << -/Length 3607 +5465 0 obj << +/Length 2375 /Filter /FlateDecode >> stream -xÚ¥ZYsÛF~ׯPô¨Jă{÷!%ÛÙDI¬h-º”ª$‰°p0(Yµ~ûšÁ•‡-—Œ9ƒžžî¯¡êÁ?ÿ4\/ÈN“Ôwƒ4=]5'Þé#Ìüpâ ÅBHÍ»åÉ?þ‡§¾çf^vº|˜Ö‰Ü0 -N—ÅïÎû/o–ß:_Aàø™{¾H’ÔyÿùæÜwnyôæÓÕõòêúì…0è;Ÿopú×Oçià,™èêzš¾üøî’{ëÿ¹üéäû¥áÔð\eÈæ_'¿ÿé°¥ŸN<7ÈÒÓh{®ÓÍ ðéFa ýúäöä?f)ž Où­9©„*vUÀsÓ4œ¥ñ}å¾ÑEžy¡o‹ÎW©'ñ©&BÙýáùÉþöü týàÔZëðƒLrø½Èþ^¹Qí|¯lóûä[‚pãÔY/|ûU‰­ö\eÎ8ðÜØá3aš®¢ZuÍ"e ˜gìäܪöÑúÀ͹’a¼]õÕ†G^³èq‘gœ¤÷0žDÜáá–)ºžMÞâø«,€£ ¥õ>ãŽàõ(B•F}ŽB‡”÷ÃÀÃ$xÞÑâÈYw®çE¦YÆËD¿D1ôjš”WƵ¦J¦¢Ã€ëÃÀ5ù®æ7òºf{‹<õ¥»ç©V²UÖ[tc…§ü8°á}Ùjáˆôr™È¹ûùúê7nÍï§ò–E'ÇOT ÷ˆQÇiê^ò&@Y4¤õ -fC7cÒz±Å8Qn˜Å´1%„%Ø'R ¬¾ó¢å º»<Ï€÷¾aÑÁx^óÄmÙ?—½Eù‡ywË[xø¬ˆ¹LLpƒïYíÈoÙiœÒ ¼¹Ó‰fƾõNÃÔõCÆâ庆à/\9n7Ümr±ìÜÓ”ØÉœîA^ J>ÂU…ÀÑJ¬¥/µ*à("<7¼P·“Çõh¯²X_•íŠ H˜X€2AÅí™A¡ï& h‡ïÒ+w0³Ä‰Û[gC®ÈÚÆÒ¾Ž;NÎê|ú¡Ó–eÁ­îaDpÁfŽÈið•-na¬ÆmÁ[Á  ½Lë/ÌXÀÑ„iHŒïõƒW?ð)Ô0‚uꯃä÷ÑoYñÐËÉö+D¾À{ @|ç[~ëùäš÷†hÔX s¸ \§¨ÀÛ÷,Ägºt¤÷Â:Ï¢¬.aˆ¶ñ7H¨Ø¬>{TIŠ^—ܦ3¯VÒö%Ò ‚¢TVØX3v{«žxËÍ -^£B!ßã|]ÉÖ!®8†1Q¡ÀßXžEc0Æw³(²-/JRW¥…1¾ã#ÐDžsÃÒ$(Ň}ý ÝÀN¿m[v-ÐäÁæÙÏŒ8m) ô¡Ž6|&N9ßÚË’o¿ˆ Dowìæ›cè%ìæí@Т9Ž>Q”¸È‚>È8}™â© çƒ{FíG-ÈG&ªdòN7®—LÅúÁªiæ¢ñ¢ðŠ± ?0²„&Ê’åç¬Æ)ˆò ?akÓÜMêß  lW¥Añ=%EGÎß{\s§—õ|ç ”00c,ÚŒ!äø+£±DNÆŠÔä¸_–CÃsÕÓŽz¹‚¾j †æi_0ÝvãÄ[OÚñzÀL- æmÁK¼ ù•u=iâÊC~ ¾Ä·Âã—­4 À?Ê7©Ø©‘l¼ù}^ðÀ„"ÑV¨'`4Ûø†¿ûý ~ˆOö÷Êot]_uÎ #Õ —,ç¼Êל o£â{|,^6 ŒÝ¼ÿ…gÆw¶£ß'í‡Ö7 Šð‰äE…jRu-E 0:tÛVK)5_(Š-î±åØíBìlÎË `ÔüÊ°nÂ;F$r"0ó,›/YU±Êû‚GI h–ëR{'ð)!}X—Bõ…ü¹í(>tTÃwÄæLÐ=“!…~N–C›TV²ˆ!Êä@I !ðMNcpÔÌVgV{9A+X=‚­rR88H€D©ó@Za^m :£OÂ1ŠjÒ¼âJ„gã:Içsð(;[›¼N†v&£_7ܹ,º{(`]ÅñA¤ 6„uhh}¬V}7@ÐHø8ïºq-Ée?½¸«ý¯L0)4ö&…–×Qgu»—utâºï謩W’Ñ–;–ö<ÂgÝBMÕ䄼²Ew4X°õLHJˆ”;õ±9.¯0X”ú¬ -ž›Å°žX0²ÕU‹ƒC/tSÿÍp"9™r³4܉‚•DÁw˜jC¾ žê ›9þ×£ Ñ±Hî\5çˆ $$¤ý±ÌŸ%¦ýeC¹ù˜Ú<»öXd@äGoG÷ÍñÈ6Hà™²>_I@Ùˆ"€|eW»’Ld ×›ÚÑg®Ÿ£„o‰|©šOÒåò‰#íï¶Z‰uĬÔƒdY¢XR0ŠJY§hª¶2õ\5‡ H–J´Í$¤lVÄÚh|u¤¤eE’ÃHÁÏJ׉ö]pSâAÐje‘cq|î%̸W×Ô~^ #”ÛÛL1Ð@ƒ'LöTðø&×5) dz 6ÓØy¡8³–@ÈÒ8Ϊ©ÊS>W:#¤•9‘º˜ -A©,í–1pð~ª³Æ¾QᢒªÓ¾S¢Õ½ §À}Í¢@n1"àØ~§>gyß cŠ*iÎ#ªJc@Ë·…EsÜS¨$rÃÝrI ŽâýgèÜÜþSªªìÎGLÛÁÉ®LMvì¨F[ž}wŒß$p}/~›ß‰æ¸Px¿ ¶ïTHá¾ -•s¼ˆDsüš©¿[ò/x±— -# låü>]6øÎi0R¸ùpÁóm²=LKÑ,|PÿC¦Ià™óš+øˆÛ?@3Ò¾v3©Ë†X¦EÂÔÀœÂ„«:@8%j¡fºŸ’CËWrqÊô¹¬–óc.û†áOW7Ü0|TãÀ;‘ ’ôå_ÛjŠ¸ç®K8šŠ#ç=2ûÛ¡Ÿ.?rƒëï-w^ÖSµ€ÐζÃ(/¯´¥É%E(w| 3}¹@(~_J±|]ÔÕ,˜3ž3PN…F>+tÿˆ…µ1® ŽôèXw*Z#ˆKI²dÈ\éµÒy}ëÿ¢@Qêúß(!yY\H¯¶JMDaeÔXâì÷.Ãô^ʱ&'›zVjsÓÐ=1ùl)ƒÓ¹¦ÂÈâXŽî«Ìõ¢·c‹æxìåû‰«T¶|…ú®Š²tÑÑq殊[mÇQX“á´ž‡7œ×5’Ôÿ—'ÊgýKëŠËºášN8 ùiºî:"/pÕß”-,šãÑ]ªÜ8M䛦ìdÑV{W¤ž@ˆI°øZu¿Ž†uò–ëäwêg0u)üífz±k)K‚ÑéØã›1ÃÛ«©‚MC;—±ºyT2¨«']U„á»] û¹^òo†}ÆgÁ£1 ©ƒ3/›c;– 3)†RùWétŽ•L¥³n° ß…à ÆŸ³ËxŠ••C¯ñ¹+lá¡·o@fjt¤uÁ4ã`’¦)#°¡@§‚`˜œ–:=%{kÂ’±„Š‘P+sc 6Ñ §z87¿(±Jwqx¬èSz$/dàÞp]õ\‹;Æ–#e1ÏU³E1øcõø¿~H7U H™ŽTÖ"¥\åk^ðl” -öù‚ÔÒàáÿˆÒÓ!endstream +xÚÅioÛFö»…`À( ,iÎ ‡G[¬¤Ý­ãM]ì7@i‘¦hS¤JRvœ_¿ï˜¡(‰²d°†oÞ¼y÷13þ‰Y¬=_%³(žŠãÙ|yäÏ +ØùéH × ¸#œWWGg?êp&|/ñ“ÙÕ톎ö­fWÙµóúç—Wo>œºJ)G$Þ©E±óú·ËSáüÊÐËo/®Þ^ü„_…óÛ%n¿ÿp+犑Þ^l¶ÏyuÎ_ÊóO?^½;zs5p:ð\%ÈæŸG×ýY"½;ò=•Ä³GXûž€íåðéé@™ïêè×£¤x/˜ñ©)­X Wú^$åþuQ™ëÔÎujï:æ +àYMÝIOÔïéHvÖ„Ž<Ã"ÒÂó“Å„YÌbY$4Ù›O ãtyê +g«*g]ƒñ¤ßòû]•KyB&³ÑM{ìXœçÙÙ¥„ì¼8•±“·m —ge  樨`Ýܤ»8•ñ¨.Gæû¶Ëºèû‘[Fhj# +ØM™8=jw… ÂÐS ú áöÝÁà>/d{"šE"ð’8 ¯‹ª¹A­Wñ~rt”„vW- ‚jèQ uÁRüæÈ÷à«î…ÃótÅGêti`i¬Q[ç5¯š4c” Uá‰1•'²î ”d4òz ¬À’‰tSÏr¿%¡ð•[£å+]Nó5¡‰o]léîìáTk'Å#g{<°ì4ð7všê¬ƒ8€o²ÍITû 2SÎ_ÒÄF§Å:ïŒ<Íý;|lŠùǶìÓ›Q8šÍ fŸ:wø¦ñÉÜÄKš-2æ´mXQý_øûïæª “íÈQ·Ý€é_w+Òn>/!rw¢MÈÐÓ´ÔžLôËù[y2šÎÞ®¥åŽˆMd@™x1+‹´¯vPWÅ^¬Â¯sS“Ž¬À¤›®&â‰àeo|t\˜k™Çz;¿q2üoøºK®Ët™5Ö×¥&ºæ©{øÒ¼dŽUœŒPFc/~ÆGMú2†Hël‹¨XPŒ/ÞÀÇ¿¾çí?²tHD,Fˆÿî‹`:'·ÇÈÌÙ*׬ ñ”>H¼ýð£l—5ß ýÐ`œõËÕY7¨zÕ¢½ª1šû+Ÿĸb(¨ŠÒœ¯o‹‰+\B3¤Ä–Žø S>ÞÒº'«‘©Ü[,Ýia…†P“âÿ-¬acò넽sOîüÎ=Aqßñ×gòö“Ï,úœ¿æ“âGPàÃà?%¾á«]ZÿâL#’Ѓ¾ñ‹ +M=•ü˜CåËKžÒù3ôõÿ¤¶Ü£°m?q~Ñt½ñÐÌ.eЧ-|ÏÇNÕçéà0”ÚN­[ú52zÙq¯FÅèÉL) ¦Ž¾­FZîˆØDŠ/„ ±H(Æ'LT¦ø¦}bSª@E„‡¦$¥%§:v,Ú ‰ø¶ +UŸx‰ÔÏ•ÊóAv ›4Òáh¦” *‘ Ñ¢‚A Š†‚‡´žç˜ùÃÈy^#³w±nÓ¾„ïiùexA,žen„³oKG'dFäîy%OAÎÅÝ ®³¼z}RѤxÀÄ@}®*^ô ƒ2ojSˆ +rKˆptüìÐìAL‘(¨*ÂîÚ4èHÁèíi["kOæ2Þ½µ±ôÈ`îWš oT<Îvzœ ¦ZÛzp‘÷D¥i1넉whT +ÓDüq@Â,¦ñ~ø“!»‰QF‚ISsBÌnZ:EJ1¬}æ#¼Ë•]Þ¯W|zŽûMKçwÞ[5 ÊÚ¦^æƒI©>l ˆÍW:GS72¦Y´+¡Ã*LßH-¢-šµmÜòûaÊWܧz‡‚‚=†AøÙ Üà )Bx ¤!1Kj?¥áT¶ö×yÝ·Ôy‡!õµŠ[B_vs—Ÿ`û¡ƒCAc!`¼Ô膊üÒp¸,‹…±8~Þ‰6gçÛo\{Ãrà‡Ž)©-6ʯGô]Ç‹ëŠ QLÝ ü€e/«œËž¡¥9H’–Tšq Æ=R+ì¹¹\'ãM°3Áhf7DïèAêØ9¯ºÂ"jß¹ rÚšÅF bM°!qð…xÓrS4p~ÃïkôBŽ‡¶´Éq˜;óÁ}rN²â­°ÈöhS$=nÀ!–µlÍ‘´È‰Z fýde°gùEVCˆ!Ã$/znÑ¡e§Ç cJðš~E†ÆjjäÊÊXZDIŒ]ü9Þ~ƒ@P7åa(}í1Œx:ÆE$àõÒ¡ˆwôšm ý‚QÁÅùþzÃÝ|Oè©!å¹|‰¾"Vú‚‡Æy³ÍÇOAuf¬*}§\.ðѪϱyQT$¾ËÜ^8!A'èfENˆþ…dhøEIª¾þ;àhjgÛMÞ†³“IcÃTjи9†[iiˆö¥]Q2ʇÆKãTWO¨ƒÚÚûv\¦E‚»Ì€Þ›Çë*ô?[5àw_ûüŒh[f×¾Õoõ„æ?$Ú ÝøÀ”s]2=£1¾iFº@y±J¦›-¥'…åÕ&e´Ë¯V±§cµÏð¿0 ´³endstream endobj -5349 0 obj << +5464 0 obj << /Type /Page -/Contents 5350 0 R -/Resources 5348 0 R +/Contents 5465 0 R +/Resources 5463 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5357 0 R +/Parent 5438 0 R >> endobj -5351 0 obj << -/D [5349 0 R /XYZ 85.039 781.388 null] ->> endobj -1538 0 obj << -/D [5349 0 R /XYZ 85.039 688.307 null] ->> endobj -5352 0 obj << -/D [5349 0 R /XYZ 85.039 658.106 null] ->> endobj -1542 0 obj << -/D [5349 0 R /XYZ 85.039 590.109 null] ->> endobj -5353 0 obj << -/D [5349 0 R /XYZ 85.039 568.913 null] +5466 0 obj << +/D [5464 0 R /XYZ 85.039 781.388 null] >> endobj -1546 0 obj << -/D [5349 0 R /XYZ 85.039 404.81 null] +5467 0 obj << +/D [5464 0 R /XYZ 237.129 764.647 null] >> endobj -5354 0 obj << -/D [5349 0 R /XYZ 85.039 383.613 null] +5468 0 obj << +/D [5464 0 R /XYZ 85.039 330.546 null] >> endobj -1550 0 obj << -/D [5349 0 R /XYZ 85.039 286.651 null] +1394 0 obj << +/D [5464 0 R /XYZ 85.039 308.229 null] >> endobj -5355 0 obj << -/D [5349 0 R /XYZ 85.039 266.06 null] +5469 0 obj << +/D [5464 0 R /XYZ 85.039 283.678 null] >> endobj -1554 0 obj << -/D [5349 0 R /XYZ 85.039 129.056 null] +1398 0 obj << +/D [5464 0 R /XYZ 85.039 214.884 null] >> endobj -5356 0 obj << -/D [5349 0 R /XYZ 85.039 96.236 null] +5470 0 obj << +/D [5464 0 R /XYZ 85.039 180.139 null] >> endobj -5348 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F20 2865 0 R >> +5463 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F38 2997 0 R /F41 2994 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5360 0 obj << -/Length 3205 +5473 0 obj << +/Length 2908 /Filter /FlateDecode >> stream -xÚ¥ZÝoÛÈ÷_aŽ,†äò3Erqî’K㪱Ҥðå’h‹ŠTI*>÷¯ï|ír%QÊCa\ÎÎ~ÌìÌof‡ò/=øó/ÓÈõTv™¤¾«Òôr¹¹ð.¡ç× _8¦Â2µx~ž_¼ø%/}Ïͼìrþ0̹a¤.ç«{çõÛW³ù›“©RÊñ3w2M’Ôyýi6ñ;¦Î>¾»¿»ýßB úΧvÿãã$UÎœ™ÞÝݯ>üüŠß”ëM¾Î»x37;5{€]e¸Íÿ\Üõ.W Òož«²ôò ÚžëC÷æöéF¡’÷êâîâŸf*î /yÔ˜V"•ºQªŽÕâG–Z|?p•\&‘çF^Hz¹ -®&Ó0Ȝ柩sõY_ÒX¨y[p㪩V ²f®‹îw/òQ -Ñ1ùi$N./]^®¸µ˜L^<4mq ”(púµLûjÕH¯¬‡ƒ•‡3¥Hój‚ÿC'ˆz±ssóž`_ÞMñ½\ -´£hPyÒ9)»ç1ïAÁ>Žôy ŠLÛ€¾ÏeÍÛù°ÀÓº\âø5“vQ¼á)ãÓX(N™#û÷I;yYåúô¨§91°›i+¶°C| if¤V$›[½vÌ….‰\ÿ*»]^qû®Gk[• ‰¤²^VD,dy6ºf×.¥Í€vJ¶Sì/a†{v¹Ëõˆ´yª Ã3‚©0¢Uñ©Ã6j¿Ã­• SÈUŠ& `D„)VÌÐ #1ârÒ¹YQž‡g¦•=?Yà$뢔¦qq|±EnGD]‰9‚)nDT„&ÞHñ»ç+R8ÎÒkÇSl¾œˆ"Ç4c xÐSr™Ãx(´_c§‰U°»- W4[m0 fëäs‘+öf^YhLJ#¼m!E§û3ê¼Ò§1 ,,!$BÃOtÒ"_Uvë}^l‘›J(dŽ\´• ¼]Êf‘¼”ó%é­ß6hCÜ“»Fß ¬->ãðÐYïi*Èb²iqË4YxuÁ®È¾ôi_a6(BfH°¬’á¡ýëìï×ÌÞòŸÏ¨vÒÛÊ1Iž+fÇr^óû•N ÝÜ@û=·Cû3Ú±ð#ôÁ6¯¹goIeõÈi/Q±F—ß8"ÔÀüç0AŸLÞ«Ü9R )Šçùgó=‹‡›zC¬ÖNl¢,tý”w 9 ™LA -ç®è) -ãYÕ°¿8qv[~JHcXˆÊ-“W N!íêxª«&_!Ê|7<+€á8—Eqæ¦*¡íSJ•ÆxÜ>rð0Mtš•FC˜òåü©ùò‰0E—åI(뀰ژ¬¥zæñvŽ¯]ÉzÅÕdK”üö-¶¹x ÒÉ‚ªRŠŽËÌJª'Ê8šÚh‹ˆ)‡‰H í»|ƒ<‹œ_;ìØ]¤ÐX‰TtzD1af¸âqØÞO„z³–½)W̹lêA÷uYÔKÙ9%<ÙѦcÒñ(wÊ£šö[×ç}Ùc{½ÅQbç£ÐÊ“”,5I jWŸMƒ[è!ÆD‡A8¿!æÛë[Y]¦à€,Ù2£/SÖÇÀg%QG&…4ΪrìêÍ!¡;Æžó6Á1¹ÉˆÓÐAT‚0Õ¯)ÉLG?sfßîZ½fÀ†8 r ¢`sו5+ “ÙgatS#®?3ï€õy_È*`ÖÇ'7€w8ØÞ N%UpÊäÿÚæÆž¦îÖ喤ǎ0KÜ8<ݵx üùn†‡1à8¡‰ ¾ƒw´(‚«ÊnÛå«U·Úâ%ºe&ø`X£óC}b1?h–‘°G|>%C -Èë©ó2 <§10Œ#À@5\Â4À½k°ÊÑVQ -:|ÊkÐêúRö(×+„é½E7ívϲÃÔcqiàšç˜”˜’ŽöÐ|ñAœÂžÎx³¾ƒ kÙñ~òšäÕàu>½É´C/Ýóa $Œ¿øls³Üƒ¹¨q¹¤à×A×!Ôâ©'£Ç p±ëÞFò¿|e¢Q1âÔGN }NZïG MÈÝco:¦èž§u¡IK©•Vò-lDùSN›Ñ'c¼õ—¡‚ñ*äaMWöco¸¿¢çäÁ“ ƒ3ë ƒŸ ã0È; T•Ž¨:#ïÐÄ e¥ø››H:z’oaÃR‘ŽH¦ŽX ¢4­tT•&¼”5-¯_1U,Z[+Š¥¨åÉEÞqj (îŽeŒ=ÚXÙ¢`h¨LÚI/t‘ C¹Ábc¯>ïv9‡b “òO$Q±žV%©âUtY¤.ž(‚>ºÕ%t«³ÁDzñK[x5Z—ñg†›£<™´‡õ&$ß°ÓQFéÇb7>%nç/‚÷/¾Ìx‘=P `‰4Î`1\ÄEHÛ†-ó¯%â¬xg ÐO%ŽÜ»ß‹ä‡ PšÊjuÓìÈOÝPsè,…Bhäf¼Újáœ%ôÀZ*€d³±¡“…Ô;°;¦ð\ÒBú]ìÄ€"½,0¬/v,t@ÌLD¢âÏ|9&uºq Ó~af§û_ˆa’ý£IÞk¹ Q¹¾ŠlЫó U2”’û<  ±Ñn/x¦ùcÁEœMvf«z®CùPÒ†~¨J¤×rˆ¬Kñ^‰ËdC¥ p -ª$ÆÖývï2ŶÆ5>_É¿¡±•nfvŒÎfém.÷Ë("‘Iw#â¢îÐc#Œ t`Ê>°0pÃL¢Ï´Ë7‹|zˆQú«Ûç­ûøß1 20ñtð¹$É“y1znMR`^LhWÜßØ·4Ž¼àD¨¨F“ìiVöí¨QòÝrÒR²Íu.†“3Ž|G5Ò!ËÍœ‹Àºâ3fómw|_<Èðtf¦ŒN¤xšgj1qŽg–ñÑ’ØÌ„²€ë$G+*HÕù™åx½½£TZ´·žVX·“t°iµùÚD{ v¦0¬ý±i‡Ë@NkIW’¼¢qT‹£ÙqnRÖ=©ZÏsƒ(üj¦3ª¦©öÜ‚Zµ‡ëªÖZï¼j” ÕÚ·ÚޮŹPÌa»­dŠFð’t ŒGYnwRÍÜïj¶˜N«Y3ý@Íg5­7¦f{=R³Ÿî©¹cßçü ST48¦’¿Ã3çCƒÎÁtÅÎâû¡{ÁmÂg (3™£ï «8Þšš>ô`šÙéK“” yHÇ{âi§’švïâœ2¢Lp²¿o(Àd ŠMçÀ”ÙrÀˆ]‡ôŒTJó½µ>~ǘª@Ù>ù¤„Y„ -t>­Ï%'*¦šÎíœ&ðÀó<™Ë$þ@þ2ã±|™ $mÁ…†ã+„wHñÌmVÉÉO…ÂÃûi€ õoülMå]1Oe%Zjí)‡ŸQ ýå8ô·è:ùä°n§ØO×öûßu^­Ä„4_4’À™µQ<}«áŽ¡6[.¬½ŽÜ¢lÀ!#ùL—Të =²H &K1çÃ&,«Rξ3ÉÖH±#¬ðUp¶Øañœ.؀ɸʋ÷ 6lfX^ÅšL« z1~%PUÕ)[âbŽ»lêIÌ€/¦â³8!‡Ÿ%[œ¯»[<§‹6~’¹‰ï“3ñoùBÐH5 ¾®M^Y7r7¼Þû†À/bög*sëoQ¥ž˜‹Â½Tûåô¹jqœ)*h†©NAW¬Íã¼0ŒÜÔ×iáË‘™¦ -VÁa -÷¨Xñ©Þ?VÍ"¯¾’ÕʶérRT"¯ùšoãÇ3_Ô±YI\‹Oû¸°B¬Ë|Ë<œ5 šê½‰ëe ™÷zK'w¿l6›¢î÷¦|…8ƒ™hÜø$Ù˜éÁ?¯ðýff¨:Bqû‚À |½”(ÂÃýêßÖmøPÂÑhendstream +xÚ¥Z[wÛ6~÷¯Ðúe©s*šxSò”dÓÖÝÆñÆΦç´} %ÚâF"µ$¯þýÎ h]òÐÓ4Äe0 æòa5‰à?5É“02óI–«Ðäùd±¹ˆ&O0óÓ…Š™Ì<š·÷W?&éDEá<šOî>I'fr¿ü=x÷ó›Ûû÷Ÿ¦3cL æát–eyðîóíTw¼}Ã=FÓ?ï¹xï$u2€Tsó¿¿ÿM–p¤_.¢ÐÌóÉ3´£PÁôæä “ØH}qwñ/ÇŠçâ ¯:¦K1ƒ“Íur^s© +ãÔ8Íi˜Uá Ù;­ãÒSë‰çžqú^Ä$6anRЇ çqNçø7./ëeClxÙ?Ú +¶±›š¿TD¤˜©L¾#ñK”ÇN\¶IÃ,ñ¬úR¿JŽn¤ÃXiûCÓ¡n@ñ=ÐK:eÕÔÅz ­=Ï-šúHÅ0ð´kQPs sñ<ø|sýSm‘CUOõ<žâŠoS®×ñt±`M×Ș‡HKÀõa:Ó/XÁl±~äñF¾w`Àñ¡ø{ǨV¼wušEÑ×UYã`Ojmá­%ñœŽß–[w–i½3ƱB“Ã#uÊÁÑŽŒc³]ólkaÕï`d‹± ̓û•]\µH‘‰2‡¾è¾rëwGCG.}Û¢.ž„s¿v¹DyŠ)è m˜D— ÿUhÂ8…Š££àèúˆ*þÓ<ÈÍ€l«ïdY.¹‹’׺*7<ò€‚î¹Á +¯# CŽÓ\Y~0ˆ¶AªnàÒrÅ 7¨²¥ó^tß~§äö²“åø†ãñ ÓÀó`k²´üßv°§E/W{¨Ò¸6lÉå¶ÀõØwZ×ñ`å$q¬5iŽè#k·¤éªç‘Ž?mY,÷!mxϺò·-ÔÎEÚC¶[=–„4TÂSbàȆNŽÑ}>‡è.k¬¥K&¸sŽÆ\|CŠÎŠ|¨%²µ<"„Jy$á[ä5¹l°#­Îg`œƒ”iË…‡Êuå9m.™-÷Ô‘«Ö…Ö˜Bó²LŽê…’…y¬põ®¶b OFÉ +gþÙ::çF$úVQÚ#Ma­µcúˆ A“†›KÛDXPu h +ʾ®efWUÇRB©²#Å‘€-X Þ|¼—½…3çæ=wÆG\ʃ¶½/Ú°¡u°vƒ™Ã«§œÝ´_ÃØ7Ñ1¨*;‹}=š“Oxq8½<Œ¼<­3H¿®»)YL%Z‹á?”ýŠBs°ìx„gÒ¿€îE²sHNbû8Õá\ñÉGuªŽ¦_Fö…´xÌÙrqà 9ƒ`ëŒrP2£¨.Aœ\òEòQò]{é)åх͞цExD¯’Wà&„û²Ó3eë z‰¤{uJÏF‡¹žŸWô@CšŽ•§iÁ 72Ž#%•½ÜOEi˜'ùÙ -ÍÁŽ£»UJ‡lþŽvÌSŠHŠìHÃÐ×~ú7ckNm  Þ39±ÖÊ §k}!úÐ ,”}ÐÆD˜ÆEH|pë”cl%»ï³õRÞ âÒâ5a‡«A9ƒ"Lž†Yž‚îP¿N!Üõ‡¢fÒ‘Îf–v„=z4½Í&>¥_3š£tßãñŽ{ï4¶Ø@cm…¶¨ŸàÏàî2 Ug±ZW¶~Œ<äžäàòj`~„³JC“Úý_@££"cسö[—Šaˆ †E®t]µ¤Kv§‚±™ëPåú¬ y4§]È}Ï…Îmè\èåŽG]ÈßqYúÈ›žiqðË—Û[zÚw"/0hdfCœdQ&.†œQJSàv½nŠá±„kÐã`xÖ'£äY’ÏŠ°ÄÝD†¯˜!8„e]<¸¨‹;·ãPŽ3 Éö±qyKéÙ …cVOؾõÌå˜=Û°qøÖcIæX&¢äQÍŠÁN%½{ĺr ò9IòœÎtì«âÖäC#rçòƒ ¬Ê=·¸,µ`]¡ˆ^Ûc{Íùò¹fdvxB `iK¼¹¿Òÿ¼úí–{cõŸÉŽÅÂ4£X¼þîé?b9ù×;*^}àÒ3>ÚQ#3¡÷õò‰V½;R4ø”°â¿¤1hz +peRGøRH~~üÎØ83 AFy6@dÕ•|ä]} /ŠÅ˜gÛØH²%* aØoÆÚ£ ‡Ö¹E•L‘]týÉ0‘å»an 9‰9u–‡ižŒ@g, ó=´±8%•ƒ•_)¨$¯-C^’ÏZUk‚sŒâë¾²%ëÇFf¨t¾õ¶°PöŠì¢/ûY×·e±ùÛ Eè, ÓùylêÑœ§:€‰€Š ˜{²Iu‚;pLê=ÇReo‰)š­¼¸Áå0.ééêE•Žé8í½ž£ªO*Õæ”kß+Y0zTÃ'÷|ÆPûk•W¹:þZ؃m©îTž‰xÄâ멺ۂ¥Ï3ÌÐ*xe¡òGžøU¯Žéøí™z/\/y}=§ü#7;[\ov–|×–W‘Á¸ÀŒkŽUqœ|šÈÔäÝß}ÉÓxc´®h÷CÕfèy¨‹G*D'Æ>D%P 5dèŒêèÿ |,Äa¨uÅ™{¡±ÙþE˜ñjHгe"¹ú1’!7Ê%;Û×®€Ê¶<õXQyšäü/nÍi¤e‰¾‡´ÎmèÖË"-Ç«²'ý^-¨vL–wµ©8Œ‡RõR€ÓS/d•F¡þN À£9£ !ú®2Îl8(ãÅŽÇ•áíx^¶p ËÆúEî|Ûô+.V[ÜŽ°«¨l›m®­<¸‡µpô=r‰,Âk–QQŠKà2iƒ!LŽk•p7RMóóçs¤ö·€”3½úÜ>Y"5ÂNd¼:»Úb¾fÃP@_S"Ç,î%ð“@&<^€ÿYoéxe“07'j‰Ö¡VV<„ÖùKy“‡Inþ?tWŒendstream endobj -5359 0 obj << +5472 0 obj << /Type /Page -/Contents 5360 0 R -/Resources 5358 0 R +/Contents 5473 0 R +/Resources 5471 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5357 0 R +/Parent 5438 0 R >> endobj -5361 0 obj << -/D [5359 0 R /XYZ 85.039 781.388 null] +5474 0 obj << +/D [5472 0 R /XYZ 85.039 781.388 null] >> endobj -1558 0 obj << -/D [5359 0 R /XYZ 85.039 610.001 null] +1402 0 obj << +/D [5472 0 R /XYZ 85.039 761.463 null] >> endobj -5362 0 obj << -/D [5359 0 R /XYZ 85.039 580.597 null] +5475 0 obj << +/D [5472 0 R /XYZ 85.039 729.511 null] >> endobj -1562 0 obj << -/D [5359 0 R /XYZ 85.039 497.648 null] +1406 0 obj << +/D [5472 0 R /XYZ 85.039 524.557 null] >> endobj -5363 0 obj << -/D [5359 0 R /XYZ 85.039 477.057 null] +5476 0 obj << +/D [5472 0 R /XYZ 85.039 490.015 null] >> endobj -1566 0 obj << -/D [5359 0 R /XYZ 85.039 212.132 null] +1410 0 obj << +/D [5472 0 R /XYZ 85.039 306.182 null] >> endobj -5364 0 obj << -/D [5359 0 R /XYZ 85.039 190.936 null] +5477 0 obj << +/D [5472 0 R /XYZ 85.039 268.651 null] >> endobj -5358 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F35 2880 0 R /F14 2895 0 R >> +5471 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5367 0 obj << -/Length 1666 +5480 0 obj << +/Length 2940 /Filter /FlateDecode >> stream -xÚ¥XÛnÛF}×WnÈ \qwy Ї\ÜÔ⪶ŒHò@Kk‰0E*$%ÙùúÎì,iŠ¢…as/3Ù33g—æ–?ÜŠæÉÄŠbÎd[‹ÍijV°óa„kDÜžÌÛùdúGè[Üc‰—Xó»';óiÍ—Ÿíw¾™ÍϯWJió„9nÅö»›™ÃíkZ]]\Î/.?à̇EnßÌpû¯+'–öœ„..Ÿ¶ß|zû†f’yÎ×ùÇÉù¼ó´ó¼JÐÍo“Ï_=k !}œxL&±u€±Ç8lo&à' |iæùäzòwgŠö|‹´ÆP dÌ‚XžÂ"ƒ,<”,"+ -<x¾Æe›6kÇ D`ÿNé>­¦õ¶,óinnSŒ ^ârô!Ñ:·Uy¨Uz›«#Í¢‘Ýînólq$÷¨ê¾` åV;U7´_ÞŸˆ»Aö/´P«¦ÉŠM–j«Šem4 £Rî*UêÛ.«ÔFM=âÝ¡ÊšŸŒ£ÊŠSÑA(}YeŒëßö|íV D%§)x›n” ÍèõckJP—pº•ÜÕJ$K\Ì pG…Ì¡y9–««‰ÝÕ(±&­ †§¹Á“Óp7°o¶Ð‘>Mñ}»Â ¤¯r§0äöwÍPXBnËUÅ -ðñ±øÒ9´;yN •Úc(:ö47ÝãÅŒü8òu‹.Þ­Ž`«_ćö¡ v0·ð—ûïw4À þ„‹Å#ÆcaÎâx#ËŠºIóüô ëÉÀ=Gµ9·zBxæm~(³)÷?©ë‘lº!‘œi˜ ÈÌy3?»xÅí«ÌÏ&óåO¤Â(˜Ì‹oÞÛ___Ïß}žÎ‚ ðt¦¦³$I½·7×Sí}áÕëÏ—ç—?à,„EíÝ\ãö§ÏÓ4ðæ tùq¿ýúêÍkžÊŸ~Ÿÿvön>P:ÐTeHægß¾û“žôÛ™¯‚,<ÂØW¶7g@§ŠÂ@æë³/gÿPñ^8áSc\‰‚TEipÌ°%òUä‡Ä–ËšŸuQö‹éL{‹Ý^ÖÑxSmJ¨ESOMê=t?3ô*§)þW2úœª:ž¬+˜Ôå+dÉÅûÀ%!R‰I'³0Pqùv»®y_5õE³èË~Öõm™oàâ(‰¶êB}ݬÍeÛ—ïŒï:xî̽,áç.Â$`rém])+S“xø¢†~÷u¸ x-oºnzt´-“€oy¸hÚÖ^ôë'^]ÂRÓò¸%>òäkUÃVÑÐ]z‹uUÛ;Ê¥­d˜]ß¡4Rã=Õ;†ÚäøºÏðõˆ™dÛ }|¾l‘_ ;3ª•s,SP„Å@}^”Ký1å·k+r| ­~B´=ƒKû W‰¶YŠáA¼v(FX¶mÓ>·¥ C6z‡™ŠSóck +”IÆmifqÍdǦD©Š³p¸ù³nYþ¨†û‰ŠÃ¿`ø­1%ä“d*·p + ò Ú<²õ™‘IT’%Ë<­UEøâÌW¡Î&Qª0e…øØLI·ñ¥Ïi¡ÃT%±FŒ“?&Zùa– ⌉øý›háâr£'¿4@æÄ¡TÐμ,›Ô‘6 “$šD±Q±aÙ”EÕƒE€|tÄ$[eÖ‰çú±´.{9ÚBÁã~ ¶G}sF–CƒJÃŒu¿••S /»šdb_ò™ÌzI6Þ.JqXéÒ©4ÈôD†B{ç|åÀôäí&3“ÅJ#»#·ZZ‰65¸Ÿcº"C#¾,Gu^7ä»1Ê|•&¸êt>Ì"¥ÃxâhØßWW´í'“Ùïþ¾è~À˜ußFPX•ÎÞä‹i`¼û»¶ÙžG°M@é-”^°ËRï–Õ‚:êc–®ÑgCNXkèû<È/ïp©b}›ITAp°s®ã§È*h»§Žƒx¢ /÷«¼fRú6/5OtÝkhjRZ¹: SŽj0¸%ZIQ.sôÔëÞ ‘¨Íº±Q,òéaæí8(¶<ëþ­%™Ì +K4*^…~Îç7e^ *â™Lö#žvÜ'ìÕV©ñPK.Ç’(Ãð Q¶ î÷`«rÃ’(ÞΟ½L'ï;òÂûbf#™yÑßMè]'XJÖ½Š‰fGNd@TØD7ò&ˆêòOI,†#ùv@¹ldPîß(Iÿ¦i¥¸—u×ÒÕÖÎñÂÿ‰æ´&󧺯CuPöÝNÐeÆ™g¿ ö8H÷ +‰«µ}. ƒð{.Ѫž»qWö²€.àÁx¿€5í·¤^´³hduPÎ…\w´ §ÏkÌá(-è[‘DZ+µ>,4>ÖÅ!2£K÷0 ¼ÇUec¬¬™Xq…ÆȘ1¶ WP"ž _³ú/€éBFUw=ÌÊÛ+~ì]")KÞÛK&ô,ÄA #щ¹Ò“Ð ±s„ 9½†Ò4ÉèM3¶%åZ”uå½õ¿¸›‹¬v=Ï3ƒþ»x˜F1G …U„×Üqã+K]cz]µ±Â$W°Ý}µåÑàyáÒ¶ÜäU-Úrdä´Ð$¯_Z+¯:× s¼ + òTaø±2œ£Ÿì®90”-ß©È`g +i¤Ng*Ppm„~£ùŠõ >Ž½eÎÞIR¥*Ÿœ˜Ä‰wUö+ôW c@“84¯”ñn»nò‚Ç[D¶ëx’óášî}ä5ÈtO0Á$©Š~Àæd/ „¨’$šKGšN-¥Üöqp…| |)MFÅfÇÏcŒv_fŸ¯ß +ìaxCˆc×B–í´ ‚öH=w\I==æa­;eØ g….yp ô'´LXàp£ñ>Ç“on9óï¸a8¬Øß±·ŸÅQà½ÇÆ+¹ €ÉGQu‹D,kh‹¿aà"–çôØ/ÄŸ’Õw•Pãb)>b‡ ضÁø/Ä-­ÊÁÜ*õh½I!ñ•œ‡Óÿâc($Š¢LÜ=*ó¤–âW׃˜q=·ÅiUDœ_Àè¡’bíüšÔF’¾ŸêŸÅµãËÎ÷Å)‘”<‚0_wÍÈóÛrYJ›³olÇUZ§ûøö@>ygÛ•ÄyÙú17—ëæ`å×Oúuþ‰§oˆ8Ä©sÑãC–Y2n§Cj8>âÕ˜+ØN¯ÍA°ÉËŸ‚kÁñbK¨éxÓžzpY/Êç ØðXÙÙ°·r +Ö +\´žœÒ ýC &ÝÖ• 9è Ã9jÖV‡I¥E]§‚¤»)„NÞbyZÃ}uÂaêب0 _t˜ 9ÌP»];_+°œ² 8Ÿ<¿OCèI±ôzáB stã‹ÖÚ¨@›ƒ]>|¸¹”VÙùëBÐkë2G ƒ€ ô?dumAçq‰¨£Xei$5ÙŽ¢ÕzhÚ›ÁtIU]ƒ‘p–Ï0kk$]ƒ…ÕŒeÍMã’OC¬*PîRöìñHŸþyJrA¤‚,zYr{˜$'@?”Ü î%÷ìÆqÉ97º’ãŸ36ðpä ëÒ +²ãDÃØ>ÜÞT.ZþuG]ë¨H³P Uö_èÍG\ÇæÀ¿-À#'—÷“‘kŒ]oý¿ û?Èa˜+@?ì îûìÆqÁ:7Š`G˜Ÿª$µóKä06'ún„…a¨"?Ð9e Ü9\åk?怹ªÄŸ b`Ú«ü4‘Ú²´.Ô¾ðgèCB +®b»‡Ë}œQÒ_n Ó>u×ew% {¾)1ÕI"ï5¯Ö壜ÁàúC×XN5êgZÌ`Ü@¶¢C”$>çGIÜÑïö§@'%’ò$C´¿…D²Bò)C¡æðƒbµ<ü9›ƒÄø°t\^¬f@‘Æ4þ8>ÿ_?½†ôŲ̂VGÆ(£--ÈGc²çôÚŸèþ/”5Ò¯endstream endobj -5366 0 obj << +5479 0 obj << /Type /Page -/Contents 5367 0 R -/Resources 5365 0 R +/Contents 5480 0 R +/Resources 5478 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5357 0 R -/Annots [ 5370 0 R 5371 0 R ] ->> endobj -5370 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [354.8 480.691 512.306 492.684] -/Subtype/Link/A<> ->> endobj -5371 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 467.445 136.217 479.134] -/Subtype/Link/A<> +/Parent 5483 0 R >> endobj -5368 0 obj << -/D [5366 0 R /XYZ 85.039 781.388 null] +5481 0 obj << +/D [5479 0 R /XYZ 85.039 781.388 null] >> endobj -1570 0 obj << -/D [5366 0 R /XYZ 85.039 518.654 null] +1414 0 obj << +/D [5479 0 R /XYZ 85.039 306.297 null] >> endobj -5369 0 obj << -/D [5366 0 R /XYZ 85.039 494.672 null] +5482 0 obj << +/D [5479 0 R /XYZ 85.039 271.551 null] >> endobj -5365 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +5478 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F62 4047 0 R /F58 3360 0 R /F20 2961 0 R /F41 2994 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5374 0 obj << -/Length 2137 +5486 0 obj << +/Length 3146 /Filter /FlateDecode >> stream -xÚ¥XÝsÛ6÷_ÁÉ=5BÀϼ¥q’º­]×VÚ›Éåi‹s©’”5º¿þö HKŽ;×x2‹Åîâ· t|ø“N -_§NœH¡“ÄYm.|çV>_HÃáoÄóÃâbþ) -é‹ÔOÅÃQN(‚P;‹ü«ûáÇ÷·‹w3OkíÊT̼8NÜ_ngÒ½gêíÝÕÍâêæ3Î J÷Ë-.ÿz7K´»`¦«›ãòûëÞóL ömñÓÅÇÅ é h•¢š^|ýæ;9˜ôÓ…/tš8{ûBÂòæôa Í¼º¸¿ømÅkûÎy%Ô‰}êŽÜ"¥Z*'}úùå3/T¡+æ«Ý¶óºl³ÌDYw}VUh‘#c!åx*>Ž[¾ -ø÷V}Ç“ [Hô+ÞVÖ,³kú}ÖÀ=fRâþ²Í³~à}(«‚Gۢݔ]W6uw~ãÝ®®‡}Û¦ë=«/QVÍf“Õù ›ŽprS3Ù û¶UÑ´kþIŽçEBÅàÝ@‹HÇ$h±}•R.l—îª-·ˆIÚíÖÍfUÎNúf‡®9«pñÀ‹Ûݧܞej7Z[>ÍTâ-¯ýÛ—n+PBÇ´²FŽ¾±»a½`í'×®âX(„)>ßuí¼[ýЕÏs8¨h»ù9³U’ª‰ó•+È’¾iarÀðÏñoÁ°ƒ¯€S¦ÑÙÀ;Dâ—‰vù ‡G–}*dzJyA”Š4”CœÄ -¶%ä8‰E”‚ê1ˆÙì?f@u³¶F»~'æš= FiÒÓùŒIe@®÷'c²âhæWå\6 ®3јåz#Á¤±LÆ‘F" b' ã)ŽìË`%d#@ð7ßÀ]îßμÓÔ†®“pU÷ÌiñžG-aÊCàeá¶%Ò/"/J„åy7ŽIÏ.Œ²ÇºÚŽ ÓR$Ijä¨  †°:H(.((pRÖ`ë©ŠS•žâÿô'U 8’÷`‚)²ÜœÒ<œ9ÃSdÞ`+¯ÄÚä@S­â¡<…Q5' \¸=kw?S1Œ!àÛÿ0%£ ¸¤ÙÕ9“úuÙÁåjH -Ðf‹<‡ù¦y*Øóöœ±š”w´gò8ô³¼iëo,tí®ç_œ Fׯü‰}á'ÒÚ4_ß7l;a±®7QœÏùÇ×àÞÈÈêV¬ÀaÛƒ¦’u†ÄØ„08ƒk T<µ¶áJ>RM+׬Î0W‡ÅIn b 4uFYäo$%Ì|2%‡úþÿgÊi† 9ñžéT*‚4p ‹ä\m¹ž Š\ Ðç ¯Vs…+®0×6·ìq¹p<4d@¸Eð6T`{¤b•íyɤ[!QÖ%#™Ð±k©PqÄr‹û–ÈUgíHRs1†ˆyË›—&½áøD _Áˆ}’³B©à‚Gè¼ PîMcâ‹m: ýP¾{6²9wÔ-´+s ’WXÓê †¿[ -x<ý©Ì ì0tB±z _P0 JR›ö I<ë°ëÁV¥î’´x–¥ìÆžq-3ŒKR¨(jžæV$_A‰ZD&¥ö%?íÀzrP€ÖbJ+iüÊ®Y›\E#$ÅZH?1áJ®ÚY±Ë„½Aì^šò€x"÷²x"½€É’~.û3 …ÒThd£///Q&¯`‡ ÉYÃÑmBÏjˆd+®‘>d'oCiÔf¤Âvš/»$>¸´È½ï yÙà4v#¸Ë( À¶#Ø‘þ=ÿ·L _a>£ MÏÛ±[&ÅXW’áÞPƒ¾9QÁ×–KÌÞ}Á‹T2p°_7Õñ ¼F’Áw8}tÍ®]Y€“_HçÜ,Ò>aÑk C½7γšâ{‚áý#EÁQ}ãˆbÆÓd‚pÌ‹§•Œß2¢ÛîY`§C¡hpl‹Loòj¤~cbs 3™8F!&ŽO‘oƒÁ/—*iNЄÙ0þ|û æ"°±3nÂqF™ì°$§Q^2ðƒ­ªÒ4t …A2…¬ÿÎËÅ’—ðAÛïèÒ#Ë¢ÞÊbƒÆû²ªXšÉ gLΖձÀÚÂËw¿Ù–£µ‡¦åEÊG›ùî…o¯_¼ð¸V)4©üÕAìPF>WK'"áú$¡û ° }÷®X55Þõ­'£Èt4‰ùM„À(°Þx\>€é’ÂѤ$àûTR è^2'ŽÀsÑ÷Í9òð3àÜ_…Ð^ÇÑñ¡$±iêƒ$š>/;^EZSÿ³gŽ[Î+Mkz+íMS 9Qÿ†É”M#: çi2¿þ o™Â©„%65Öf+û$i<ˆ`¹YÌ•ïûóÝŽ…`* è¶wgšôPÄØ R7ÂÞù -òófo¾Ü,ÞòÅ›a†½5ð4"´æKE·ÛnÁ1…Y_ÞñGxƒ%лNBß6Pg²,åíS+róÅeb>®îJ»ö¼» -|2dlÐû¼YÚR€ ˸Q\"Ch@íÄ,Û µÅ±ÿiLeJ3·A'.è„N.~Íý£9Á¹Ÿ¤àjºxì |nëË{±§zUiú¾ŽûwhÑŽ\æŒØó„R"üòÛÇ,Í/¥C -lë;‹°Ä5ûá“b]üå}üÀèè -µx²ñȦ¡Áiš<ìuñ×{&ižççòüçKø[4‡lf%ãoË•JZ]Ðr¥¢çúÚŸ' -ÿàÄYÏendstream +xÚ¥Ù’Û6ò}¾B5/¦ª,†$À+ûàò‘uœrœY{\Þ­l8Gb,‘2;ùùí $QòÖËŽFw£Ñ7ÎøβØT>K³ÐWY6[Ùv^_…±…óâöê‡ÆÉ, ü<Èg·÷#žØ×±šÝ®~÷^þüüæö§÷ó…RÊ s¾HÓÌ{ùñfzxõæý›w·o޽ƙ†ÅÐûxƒÛ¿½ŸgÊ»e 7ïÆí翾xÎ3åó?n¹úéÖrjy®rdóËÕï³\é—«ÀWy6{„qà‡°½»>ýX+™o¯>\ýË¢â==ãSSR1 øY¦/K.ü8ÐVr:t$¡¯53@(ºÿaz|»0Hü,Îf²‚æ„b»ÃÈWat@±ß€tK¤ ›¹À™ŸÂ£µö]±Zu»;†<@ç~’F9ô€¯ÚVý<ʼoóL{>Ac?UŠäd©‹NtóEèíðÌÝ|¡@Ñáoä­ªn9t´]®x©øš¡àDê K<·á•UÙÕ–ïpháŸ~S¶¼ØáD¹mðÈ#bõÌ¢Ü{Œ‚GÜ)q¬¼GÀz‚ ÞFìízž—_÷Û¦%éшð4ýÝ9€[£²äæm5¢ëK$‹«zÍšN×ûfÄЗ;Võ¢†¥ƒ,q§Ùí ¡ˆûòv4þT0ß«3çåðÇwoþÍ£=ÓE¨žNE»DQ"Š\öÞ–ÆÆä’,óU^4†T2‚]í+8î#‰3?Çx bó>vôÖÈc’’\øPìî +œ'x Z/jžÈêꡨ—¨)¸ói®BXV(\Zø›kO:EŒó5ÝW×~®¯­êßßRƒGˆà6aêç*"F+xÂwƒ$š®ÿ°l«}Ïk¯Zć˜Pùh‰ÞaIój¤Ý«s²U™E—ŒsjîO |°|bù9¾§Šh@3À$ÌD댮«0÷î›­˜ˆU8DúVuÏ@Íuà½nÀ– ý‹6ìóúÛ²ÒñuÃèDád¶k +Ö_ ^TBÉÀpSÖ‚îúG^ÔÓGÆô¹6vŒ³ !Ö1~ž û »Dm +2ï™vûkœ¦`(ìfoö>íy†ö)âBs/z­h_–[güAü ÎüqS‡…›½ +€×=y'‘ëÖŠ öh‹"Æ?Q +w°Ýtëk¢¯¼­)-?¸8¬»@|Îõx¯_ôÅ„€ËA ƒuD€Ÿ\À£Ôr¿!Õb—Dî¶ßØÇŒ:“Ú )ÅGу_XöðT4=HÈâÑ[ñÏŽìÉqˆEŠ¶ç}rå2-J{·n­¨º¦—¹l†-1Ä¡"3˜wä‹+° ¼ögL6† ™E—³)æ|N`€¾—\"hs‚cŠ“9KñWÒo+Aj`:òxFÃLÂhCòm —ðIñw]ö<Ø5¼:„Z¡­ó)úʆ¿jÙý8_$aì}ÚનA»ñ‹b:`Å©V¼o}‘cv„оX—DàÙ„ŽÚú£)$xˆ*O(¬ã€ ʱf8°.Ù¦ñ kþ_²ÕÜãoìÉæŸÍÝYXh•\¤jl5½HØõ L§jìY[FH²)œŸð‰ä¡Ñ*±p>‡äªe±å5<ÞP‚eL\hŸÅœ$U›Î<(ŽÄÌEeAmX@r`Í;Íä…±‹­ãS£ûG{Åñè°ž1Xh?QáEƒu`άúžÁ^"h ö˜â¤ÁºO 6ŠFo«£ß“¤œŸI™V¼DV +:vºÅ?®yåËÐô²Ù}3É*+, ƀ˶Œ›·Bˆ¢wÏ[¬wµpÂ섇êTC%‰€§–pø”µ aU 9aµXts`L3†–ÔŒ}™‰Fo®«ƒ.ªLù"Ÿªõ>£ü¸ÒVc~tV #åçß©$˜ J(@ßU G%<¢8­„Åc%T¹r¢†Ê#vVåCÕˆª D]öl¶OÚÏ Q"Žö¶zAà­ ]•w¨œëµ¤¸§}œPÀ¢µÃ-ªEtF ³ØwÒçºþ|p°.%¼îF×A›×œ¸`®¥‡Èi;ãï4°ßÛŽ‡KÑJÀ‹¾—F …I1ÖýDäÁ„†Œr*5Åü‘rƒ'GÙTk¥’¹&ÞPþÞbo¯1˜!`T”jÃ)Á}®hò¶%×r¶' C›'ñabf_ÿhÕSÄdìdl7VÇO0xQEœR÷¦µ)*¯Ö0°ÀEgêmË¢­yXHª<È™ —°R´fÜ,‚Qb\ ìSöf£ÿÂsã¡Ô­ÞSoY©Ò„>OIEùlß—E?X‰tS¥›ÍG#ðrc ÃmÜ-Øq¼lvc®VA)ÅÇ1ïÅߎ·KAJæ@É(/³ü1£ÄíeS/mæ× 1lã\à¸Í…ûFL¸Ï.¹ù{€L(Á¨?(DP1¯t*‰/l°—…û¦eЂçÖ>»¥mìí)l55CP  ¤Ö^"¬­ma“ÚƒàQlÅ@&Ç2v¨Ÿqà(Q¢OôG§Òÿƒ­øQy`Ǹ‡ ÉØ° é¼8®þ\0Š?Éò‹Q̱}ÀÐÏãØéUEQî‡yäôC/Äf \ú5µÏÞp®‘Þß'zdÐpÛÓ4ùlÊX¢‚ü >˜n„iϤ0g.A4L.77˜³ ¸0‡_Í¥õ;LwR.–9ÝIô„ªâz̺¿M]Êàž­"Á˜› ]Ï3Ç·P¨õƈ «C¢GÇÜ6í‚|¸¥°â8¾è›… …¢M‘? S6#Æ¡³Îf „%% +<…äiµ£;VVµÛ¢'“J¥£céÂByÎSâhB/ªðq»1i`ªYbðÛSØ-yro°sêƒß>ð/‰©èïÉjvâ ës’UªÑŽ¹%iÀMGes»ˆ2.ÛîÓ1X{=úôêÆeo·.OEÓõGXÃ÷Š;éFQp|˜¹iÅr!¡ 䑦àZ±l©©«µÔPxh'j +¢î ÷“‘È‹ ë‘‡ Ý D¦½De€˜È"M¶·g¾Pê@ûa–ȇÇRûk‰À§_*æÈáw¹8è©©¶*¥ ~9‚à±)1A%Â\wÀøùŠÌ*±âˆC…Nîb 0z=ü-¿ö’ê<¸ID[•¹ÉË·¼GÚ“\@\žù (î3­i¶Æ\ð‹P‡Õ˜ÂO§c°mœ–ÆŠÅa¿âp¢¡ú‹£CÍcV‹´)¡¯ˆ5 “Ü»–F/)ƒø úh‘æc–"¶ÄÕR’K";r0z¬lÎ…º!ÇþÓŠOÞ¼zÛñÅ5!vÃ,¶ +ÄMÕ<ô^•}ÈãÞÎé}×µOß&T±¯aÅ>Nø”…¤uµZÈBŠ2N2p«ù¤«á :ûwœö8Ã{’­µndêøü#×Ý6d§‘뻫–WØw×× Jú4ÂÌÅ.ƒ“Ç|8L.&C],üêrÂ?Ab…º´ßîÙUJµl\f›C7~ ÖÇ-!¾÷¢¤ÿpçª*ê±4ñäK–sÙf›ÒœDìíabzˆ<_úøç2^(¾£É|þòUÿ¯ÿ‡26þ”Ÿ©|:¿Œ£ÈBà ŠÌô˜ßXe~ ¾å„áÿ·“Dendstream endobj -5373 0 obj << +5485 0 obj << /Type /Page -/Contents 5374 0 R -/Resources 5372 0 R +/Contents 5486 0 R +/Resources 5484 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5357 0 R +/Parent 5483 0 R >> endobj -5375 0 obj << -/D [5373 0 R /XYZ 85.039 781.388 null] +5487 0 obj << +/D [5485 0 R /XYZ 85.039 781.388 null] >> endobj -1574 0 obj << -/D [5373 0 R /XYZ 85.039 290.091 null] +1418 0 obj << +/D [5485 0 R /XYZ 85.039 688.307 null] >> endobj -5376 0 obj << -/D [5373 0 R /XYZ 85.039 269.5 null] +5488 0 obj << +/D [5485 0 R /XYZ 85.039 627.421 null] >> endobj -5372 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F66 3242 0 R >> -/XObject << /Im2 4150 0 R >> +1422 0 obj << +/D [5485 0 R /XYZ 85.039 256.689 null] +>> endobj +5489 0 obj << +/D [5485 0 R /XYZ 85.039 219.822 null] +>> endobj +5484 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5379 0 obj << -/Length 2819 -/Filter /FlateDecode ->> -stream -xÚ¥ÛnÛ8ö=_a ¬ ÔŒ(’5ûä6I'ƒ&ñ&îv>(¶l •%×’ëóó{.ÔűÓYì (Lû…‘þÉ5ÂWñ ²R(k³õ™?XÂÉû3é0FeÔÃy;=»¸õ@ú"öãÁtÑÑ1B5˜Î?{ï~O¦WÑRÊ“±Ž¢Èzï>N†Ò{dèäáænzs÷w€Òû8Áãû‡¡UÞ”‘nîºãñíÛ1ï”ð‡_¦¿]M[N[€«Ùüvöù‹?˜ƒH¿ùBÅv°‡µ/$¯Ï€Oa´rûüìñìŸ-)>Ó¾uJ+FYa¬:V‹2=µÈP k¢Ad|a|Mz_^ßßMÅíõ-JäF¿»Óû·W“G-.þõ³ã_?LúdžN/¯®'Ó‡@L&—'.ß¼»¿ûpóV\~øpâtòx{מ´VÚÁ(ˆ„:@ŒÏŸ²b^î«áÈÆ»›¾áEàû¾[&Åœÿž8À6åEµÛlÊmºó§ç_¾ÐwšÏtB8Í+lºãvìÔw)¡d00&Zî"ÊÄÂÄáIÁÏ‚ndðº«Ñ-èðŠÑí :£†«‘b¡|ÕzRÇ"Fµ€'ÉH„1𮕬$YïJ‰z8’^z,*£ë(* ‘æàÛ@ -_DZbœÞšè#ÀÅÍZ.KàtpÀ,Óõ³`Þۃ‚c Œ´BlÖ›n¬½§!¸”WÖ+píÇÌÿjˆ2À¹ñÆsX—ˆeB¶Ù÷tË~÷¥ÆK9_’^Åh ìÑÿ§^¥¼€|óÈ«ÿ‘Ê??„;¼ÇÞ†^ÍòÐ ÀUÒ÷JDû„W³îÞáj -‹‹àëÆ¢%à ö0>p³!iEÖ,!¸K„ÞàVªJB6„å¼d…:PYôÅû,ÏyÕàK‘- æ£Sù„1RƵMºÂÚ)0¿Gî;pÔ™À»!aî -€†Ä}c>Qs;Þ8,È>°ÿƒ ˜¿³B3×£b¤ßéCˆh| •T%êÏH¢ ºäí®Jy1nµ7«$TþÌgó-lÀ]ð`[¡ŒñÖåww5Ažö(™Ñ]b·ƒ…âŸwèì(SP\“Cæ¬RPU(9 û±ïAêÍEl/n¯0Ë3ð“Š7,,êÿ(Œü6ø›ÎáÉÉŽuIðÌ¥v–TtG¼L2:’PÕâA/qý…<ˆÉVÆÑ`ÔÝÿ?9cÕ -"¨Î/¢à§mö­Ö´‰,ð².çfø¶°6"Õ@+™ÔcÀLÜj<û¶Ë¶Y±u…¡‹Ò”7cÜ—)Ž"€]’\& -#ï:C·ƒÐ?ÝϨ8&ü¹=ÎÆMH#DdE¹›Ê$ñŒ>Hl›Øv\ÃzÜÏ*Æ6žƒ.Ïáqúd¶ …]$]7))–üÛ#y»"ý±iÒ›AGÀzó ˆ†3cÚÈk¾AÀ}u ~ L<;ZmrÙVâ„OW)bÆ·!¸(ÊÚAÎ÷!|6Éòä‰DÁåQÒˆ›XÔmÂ~È1%½§†´`펓Š¯Umö_6¤”†¨Mžôös¬ÉŦ¬”þ¨ÑP )¦f‚'#­tAšŠ½ä‹] ]`­ËÙâ€ò‰Žæ”]÷„1J Qàeÿ²¾"—ë“ê™wdZ8ÎKR ±–Ôînš55¼†bÄz“m‰ÊJžrGá¿J¹6EJÈóbá—´rN+ÙÖ#\gÅ,G'˜cáB¬"©›ò>+*:G§Å-µ§«î®`HãõL­Õ²šç@¬txŒ€’²éŒstÅ—„¦ "ŒR3rQ'þ²˜¥˜Þ# î‰ZÖm‘ÆnÈ1ìZ#â Î]µhýÎeo<úÝ7>‹ÊÂ]xŸé6›ñfBª®êÇÙ6ÛpǨ¥)c>Ó-БL$wbÏŒYžª¬Eä±Yct';V ÒͧUw¤c¯ógP|â¢1Øü R†´²J¶ÝwH!ˆöÞQ“>PZÄéK àMÍ76´k¤uŒ.n©·œePî_X…A#°³òß]1…ƒÏNªÿÛ:ŸÂÛœ†mUb(ÎÝ¥>åƒd{î -ˆö ¡õø…rÍÇûUÚÐì" ->ÉYðf™Ö‡’^sCõD[»ÆÆæ©‹í#Û‚²$eæ-r‚géšÄÀú eU£¦Ê˜ÏÖ%: ’’¶±–åÁˆ1gYãQ"­„[™rÇÌ_ÌXñH/«˜9ü–¨7õ 1nZ½«vNPê .Èg–x6C½%7äE§+v` ðßVìÎëmG }Úð°í]ÛqÅï(Ð_r[1¦kî(ð eK­;bò›ôëòS²Lø='„²BÝ>öÕÏÇ/–E‰T¶=­Æš_>qúÝ”Gó×t(éøç:êp^ïj?RóÓÊÇʵë`zÍâ:t¾€+|Cš0pÒK|:ir<¬«rQ»ߺìÐnñ”»Uí.1—» Þ†ZÆÆ@à9~?áøºO ³rÙöVÕ9#nÀXø:„™­uTF\ç-•jÈp;L š¬ÏNˆEéÐ(}ÿkîéG¢ç!­·mˆ7uï·]¡õºÀÈÍ,ýIÐÚ¬€us¹ .nä w]GqjŽËË“A@úF¡@ †°)К€/L`»Ac#­{¦DŠ®š Yë—¾©üHØ È(¾6ìœx°]:Œ‡ž›6Ø£úñàKš(᪮7¿\\ì÷{Sêsµ³r}ŒîAd±ª×ùKÖ Œ)03pöòI’QŽØ9›tnññCÄ¡=0ÅðkŠ¦©íÒh‡Žo käNÓ¶éYÁ¦×ªZV|å‹yòÔõÿ¹k¼[²çã[€½EÐøœaɺΗ®?#šÎ9û‹ë0ìër$XP ½Š–{ª\Ì)Îîø-sÆL·N|w§/þ%9ä=l¶ 5§¨Óи_=Nxá’./‡&@UàF‹Ì×aÎ2‘ˆUäøbïÖ¶éK{aA¬"›šJ™k-­¤â”PúJ³Ë›Ikµw_ÌRFïµP$XóѾ`]¯` tz/¨ò¥îR,¾æ6Ö5GÑ §öX»ig½ÉÝ»Sy^®òl¹Â'’š8hë® »jwÒËŠcÜÉI\ã¡Ã$‡©„=Ô³åaî=þmá†×ÝÔå7cRÊÃÕ W’¾…Mv³«ÁDF=´ágœ-f!N˜Ü*zåë]ëwÑë5?û¡>wÜ7‡2ôîÜmÛQ—/tŒý®NT4žÁïÊM¹”Ï٬ѡ/l¶Íõ ·¨èv0]?&® ¤’¥aˆsq Q®%j7è#;ݱ©M¢¡!­#㓇Vo¤¡Ë‡åÿ>UPáž F³N²‚†¸Á%¿Þqí#V§9?÷û:Xbs®¥zÑœS—­UàzÓZÂâ¨æ8—º­> +stream +xÚ¥ÛnÛFöÝ_!ô‰"–ÃáðR`Q8qìU±I¼±7hû@K´ÄF"’JÖûõ{nC EÙX  gΜۜ»Õ$€j’?ÐÙ$I•¯Ót²Ü]“5œÜ\(˜ ÈÌy½¸øùÚÄøYMG<ÆŒž,Vxoþyy»xûq:ÓZ{*ó§³$I½7Ÿn§Ê»ãÝÛó÷‹ùûüŠ`SyŸnñøÃÇiª½Íß/ß½¾ä/íÓ¿¿]¼]ôœö<W²ùõâ¿‚É +Dúí"ðu–N¾Ã:ðï.€OßDZ¾·wÿîQñY4á[ç´b!f Yš—5+?Šu¯¹N•Ÿãjξ "Ò Œ|6x÷%|T«zªï{ òljwՔߊ¦}…_±TÞÕœ?òjÅ0oß]?§£(óÃ(|™ë# q­Ì™÷V±¯cbz^Ñ0f+à˜ Sf64Þ‡»W|Ømà¬àÍǺržw|¼¬+¼ö ÿ+ð!Z\”µ ÿvê^—‚~…{• }ÀËOcr{ÄUþ®hø|Õ fr-h<ŠÀ…Ú»;+½Ò™†‰#êÔ6Sh )b¿¢D ÞÀÂ,ðrÜÙÂ:ͼ|Oçå’å.‰u>"ëu“ïH)ðº|…È]½ÎŽ/u›¢lx¹*­¶ö°‘x5­sK˜H}ÛÍJ¡z‰7Õccô7S¶'\ÿò5pùÔ1(H}¥¾i¦&é6ôZp{95D4³°®ž®Šo%É,{^Á»<’¬3º ‘X^’øIb©kê^Ò m¤4Èš?Bv\ðî’^yË[õ#ÿZ#ÁËð ´WvV•ÅöQtôúö€Øø˜7,°ç–ið[ O5º˜Vœ†Þb#Ï„7¨c$Hæ@Q°ÆDLWa¥¸þ¡çm%/D¦àõ²&#Ú‘ßÌÏÊ?YNåòš¬î@Æ^šD䙌x»åE¬STiCæJQ(1^W34¢jÈb¿AÙâ;d¾)ˆýž8%˜ž Å'sœÊè@-šPlÔ(Ø™Û3¶ib_)±Ô@”¯]6lS†®Ž-Ë(?LäYS‚66ˆG =ý’ÚÂSš{rúbΘd”@øŒÆüƒ´Z²FкÁjR“‚ÕMïR0{ +\Ç`†{£`&Ûö½ùd[sppÃ+ +ºÌ+6¼\5X^Ûåd¹½´*ÿK–Ÿ°¤*Æ#ütô… +›±¡ b}U±b`d>k·§ÿy‡¬Q«”¶ÃŠáÈÚJ–NÎË +ÕxèÐå²È»\bÐF,%ÄœjÍ@÷Ÿïæ÷°÷ùæLÇ·øéž"/Ú,ñ>cI\ÂGìÝïÎ)F§"Ú8 ‘€²Ä|÷¾'ß/[>lzÓ‚T ôÄG˜'Ä…žDvú—[æ‡VX˜O1£+˦ ˜Ši‡¢66”‰[6²]Ù -üx¬ +.ঃ—…ÝŸ``DpM!hÆ9ˆ,&Ï‚V g²„Þw0“ãý],»>$€š%x ÎG +4;‡€ b`#dHé±~Š# ¹Âj[V båÍñœ83“,«Cqfó<®Õ¸ÎÈMt’¹o ^Ÿ;zÜvKÖoáŠ5¹v6݆†bÔÆŠ·¢Úä•dPCñ3É;ÔOG„®ñy·ç’húAêäPt”0ÀŠ[y¶fÑ\¶H…ðëè¢W˜Ž•¤/¿²>³rXÉ 3Hb7¨*2-&R‚nçTSòšS%EÈa¡Øõi  (écfÆžaHpæ”JìS6=.œÞïx{ð„þ3…µ1¡©ðÿè>Öûæl÷ÆÄ~ +íÀsxèVxxeÁ‡xúR>ŠŒoÕ—òqä4 YàG +8×Pî‡Ü€¼¯9 Ëë¹r +t”BºcŒ“¯åQ–iqÖÄýQ*Úøy¾S“«Øœ8œ +Ú™ƒ—›×T˜ù1(׉eÌê‚b-–©xrœõ‰7) T«ÜŠdKn<,å—ê|(>î Ài`$,B|ˆ½Ëýžý‰hlrNž¸^nê¶T0³?t²@@'ÂVÎÝÄ8дKkÌ…T8TPÕ‡Žš|Ê6ƙ،J½G)èHâr°‹2Im'.1â¼Æ®üjöéýü÷ÙC~¬0_Iè.¥\|B Ò1ï_*VÙ¯¿r®Ç\—ÂÆ»œ]*ŠC®¯cåýÎ?¢Z_åÌœb¥ãËàö‡“rò$>ÏšñáLà‰8í +R6pHtáÖ ÿb7þA[ãtoX/S¼ièÁ6P°Jä +Ž¥¸‘è».+ÛNŒTG>ÄÁ Iºåè‘ŸáB+¨þ"½½º>ƒ-Œü8³E骀:‡_õ[”ì“b””°**[›ˆ·¹ Ëö30ßû2ŠcÄiÅ'dü@Â(§(&ñ^öãQˆ˜3hP£Ñ'£}ŸeggaìkP?ÐIýŒ6äç\†#@`šöí/q˜$JBÚÑ*4uÃ`8Žƒ +E„ƒYh 50Çit ÈSLvD4‰ µöÓ(é ÖœœîäAUV¦©|PAzN¤ÑH®Ìœ;ÌCèã!^äáº\Ћ°ªR™¯Î1a(öüË)¯aø¤3ÌöÌY˜w:§˜Üh2nrkÛ-ÜÔR­Ýò!¢ Ÿ[§ÿÌ·2¼–/§~¤C?+{Aï½HÚÀЀÂUäIrNl°Z(,2õccM´}åÇiòâàO%Ô/+Ô9*0ƒq¥–q%æN§·Ü¦v¶ùÛçoê +ç—}zÊ+g&AãÌO2Î|·Ôº´Ï”\–•E:Â<;ËT衱:3Ë£(2T½ñ“cQñ) Ž jcLûiMU2<ˆÊúJ"íƒs_ $ý”Ž¿d ˆ¤ÊI½2H‡½/|¹*¶ZN¾4j—OÄ!°a³8Îèî@±Ï!ÒÄ&‰TtÞ89 cj†e9ö³IêQz~ö ¸¨!N0 ·\*QŸÇ£_«+<§*¦‘;ÌÚù[tRå\);ÁíŽVxÇ:ÿ×TO64§ªÇVð±vv<_Å7ÒÆ£v\k°yÄ/Gw¶W¤P±'Щ-hR 5ôæ' 8ïÚÓ­5«¼•öØÃ× ðÖMMc¾•ÐùT±ºÂhj²õ9«EÒ,¸Ï!e==gàÒšm@Fq<ÈÝßS3œ0iÅóV@÷õ@uJÙII‚WxÖƒÓOGáÆ-Õš­£F<$5&›/¥)D4¨6ˆ_ ›ÕdóÌ–Ë–sþÙ¯åp$˲`ú”S"Øh8é>ÑîŽëN\¶ì°ÝêÇêT†Ùº 7¶åÀS’çø;ùzi*Ô䫲å?F %Ž/+†°¬ŽæEø‡‘xÄRy‚žü‰íVÈK>6¢'ƒàÜ­èÉëBœÅá_!î?ß0œAQnGCOÜ\a/ñ"þæK$¾)Åì¥æ $ëúH³å[|íËÓpQî,Ù‚ãU?Æùº¦¿šÜ°ôÞT=“§tÁùÜ.šú¡Ü~lö¡(ÔÙùTgB¨J”å_&Ô£ŠÑèÔ7©3ü?»Ø Íendstream endobj -5378 0 obj << +5492 0 obj << /Type /Page -/Contents 5379 0 R -/Resources 5377 0 R +/Contents 5493 0 R +/Resources 5491 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5357 0 R -/Annots [ 5383 0 R ] ->> endobj -5383 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [306.831 175.625 509.276 187.617] -/Subtype/Link/A<> ->> endobj -5380 0 obj << -/D [5378 0 R /XYZ 85.039 781.388 null] ->> endobj -1578 0 obj << -/D [5378 0 R /XYZ 85.039 408.185 null] ->> endobj -5381 0 obj << -/D [5378 0 R /XYZ 85.039 389.517 null] ->> endobj -1582 0 obj << -/D [5378 0 R /XYZ 85.039 251.906 null] ->> endobj -5382 0 obj << -/D [5378 0 R /XYZ 85.039 216.704 null] ->> endobj -5377 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> -/XObject << /Im1 3957 0 R >> -/ProcSet [ /PDF /Text ] +/Parent 5483 0 R >> endobj -5386 0 obj << -/Length 1554 +5490 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 318 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5500 0 R] +/Length 15650 /Filter /FlateDecode >> stream -xÚ¥WÛnÛF}×WA®€rµî’lŸr¯ÔqcN‘äi‹ˆD*¤dÁýúÎì,)Ò’ƒs/³³3gÏ\$2H : âDr$Ár3Áì¼H/z‘p ób>™½±Q OEÌoz ŒæùgöòÏçWóצ¡ÖšÉ”OÃ8NØËWSÉ®iõêÃÅåüâò-Î"X”ìãn¿ÿ0M4›“ÐÅåqûù_/žÓLs1ý:7y=ï-ím«R4óûäóWäàÒ»‰à:M‚Œ—°½™€ÜDÚÏדëÉß½*Ú‹:u•N"ÏRe~Œœ•<²ºGNÁ®ä©1ˆœ”Šk©‚ØnDä -øjÆö2»/²] ®[Ëv5~c¶€dM– ]WÓP²Fe^4Eþ@þ¦š|”q&K3xìÞd•Ò˜ü¾‚k—x?¤â”=LUÂê=N¶Êpvÿp;¬ñ}E»»•?S¢’•ì²5 ×´Ü:½M +Û-}Fd(“Š-jeuë— <û@;\QØÞÃr¶mÔG»rÒ¼[MÑ€nöF½ÖÚ:¦çïr¿mùj½%Á ­1ìÌÍØ‘NX^Ów·BþD:ŠÀ©ZmöSåÀº£íg@à.ÈÃò–ˆòŒŽà{»Í‹"Á\"h)VÝfœœá¶ÉIÄüUYŽwh¦:žÆ<±ã·uC5gT¥(§ #]~ÃÕ¦XS˜´U$É%¦li+þ8÷v9ÓÂC+ù?ÊÐ âž-Oü… -™øI=>UmüˆÄ“GzÂΪÐhÃc«ú|«Q‰ŒS°IXy^nO]$1ž&ÎÅà{ ¹ˆÒT“Ì`ì ?:äf›(xUƒ…ÁÈHÒSQJ†k,O£8°âBR TˆªV-:fZÅ* -Êœf˜·P¤Ëh8nj͵Ÿ– )J¤¸Ôº -‚µf›µí'^ŸKú^j1¸µ‡;b"6½bœ7SÔ:åÈâƒð‘ÓÚ-{öþ½dYWÀ\4Û)Š·Î%çú²„JH ÞÉm|Ek›+­;¿u‹_s,è¸Ø®jÄjÓ:æ.¸¼îMútXÕ•j‡»{w-VŽ*/qK¦àÄxÌa‘mú&Áo–î! -(tF[Öµ¸åž¼Óˆëî9a|ÀœSwF|ÃqÊʬœþMŒ3¿¨î˦®6E…EOIðÇPJ -J±â¾_y(P+ -–¾X€TôánßW,-JôþºG†J0ÈâÒBTw¯|í2Ñݺ Õ×å]E -ÞWgCVÒÝQªŽPl’˜Þ&£¬vSV¹3äÐRV{US…œª|r¬+W×êõº÷ö$ßEp³‰å'ò&C „xî'“ç8ééA_>î”æJÉÀ(Ác}ÚãjáWœë©Dìó@K2ÔÒˆ”JI§Às–wGN ë„ð¼kB@k¿RV¨j‘\þë©$™k÷t¯™Z8wýñªÓO$=;<Cr,º¼Œðü¨0{ÔYÞs -,™¨õi#?”ê2" -‚ õf@°ËùL}›}º¢Ùr]Ôu9…ü‰_5Zp•žûM#ïÉOý"ìEš':=Ï w²‘S*yl¯Ñ 7‰>5ø?qFendstream +xÚ퇂Û*EE¨zIüÿ_¾d{Kö%öÚNv&ŶŒ%.g†2,,Ú3LÌ>Ú73¦m´Ç›s$Ö­o§+§9ÚƒÍçNƺõý´aþk"¢¢‹\ˆZˆv悉_BÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ¹µ-r!j!ZäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ¹íQZHÛ6õ^6m~ªY-hõR²:ó~ksEë”õöñ©²ãùlÛ¶ÍÇáÝá¤.?(<̧«‘ Ñž¡¡5›|¡µ>jd®ÑÔ¥>ŒZxßj{iu¨…TWŸjÑÍ'.\MgozùàììxO­n#¢=I z‡ÚwÒ¦u駻KcR™¬ÖÔ'ú¸`’îá™iò³¹¼I@ ã¹½?Ÿ „ÿŽ#1ó-¤[Ê´:&XÔ¯Ýðø¶‡ú®yrºÆLáZ‘ Q whÁAsN5ÓÁóI´‰/ó‹·c´&”±>=UÙœ…f|¢ª„Z|òo:«©8qa­¶Uxs[¼Tj÷© :é©Ö6½\\:T`—À— ±m~ÉŽÕx`4+xáp\)èJwN‹“»–ÂåkÛ<âk\ø‡µ 4•Z©ƒ 3rB¤òu²ÓµÐ&?9''i¶Ú †Ö^xÓ'.,ð„„†ß¡ÿ5z¦ƒ”^j§‡W\ÈöDh…-:ø` ¡PO>’WSÂû:tׂ»v”vÔž.Ÿ—¯#¢îÒÂbm‰ú©‰m Jj»¾´“P}uQé\áÂE ê^¡ítTÿ+zh˜9Vv@ÔÜ š}ÚkmŽ×ä[Æ_s!XzWç§#^ §÷Öâ‰ÖƒOöM¼J§úHZAApî%r!já.-ä­¦º'.Ùo­{ÕÄ–šAãži¥O &=‚ ¨Œ%„Ç›Pþžâ…})¨™Õñ`¡N±s4Œ‘¹Ëå+.(ðŒ’WÓ[.dè´õ§xaö¯¸0;PWyxWpùKG.D-Ü©…*¨ulG§É§ÏÇ^¸PúþTCêƒ\(°c +”’žœ$MGÒ)Ojpü›·ñÂ9üµG­Í…̧ Þ¼há̃¾9 +Vp‘ Q ÷iª›ò§x¡ÄšJÔë&VGüõÅ¿ãBvá ùñTÁKÐÔ)åÖ',B_>¥ñõK§(¼¤Ñ‚; +½pAW¶¸`ô©Ž¾Ä 䢅Z+™Æx!já^-Ô]¡“sÝE{5œÖ†þÿñäÕ¿ŽKhµ718m>j)Te}¹ï;­raŠÐV¼N ¯/$ÊP˜Ë^qAºW\0ã¸È…¨…»¬[2_á¿úTRªDÛ¿*‘,9\h¨ÛÓåÒ娿M½zS7G§~BÕXžG„3ª–óàð^ë«ÓK¼…¢/ãÆSÞ¾T¼9¯OÙ‹åw®ê®p*Ò ÞU¶]ºM+ýz~S}Ó1^ˆZˆæs[{Éþo<¿Mî;ÙÙ~ûr÷CiþÿŽè“YâË,r!Úsµêôý¡JSÌ y$c¹$íúÁ +±¿­±Vÿ°ì²ÖÍ‘X콕ô(KœþõZÍD3ߺ=r!ÚSµÀ¬üH ¥f»ù©BÆ¢w>ÐBî;úãž%ä|VrN2ö3Û´…ô)_käBÔÂÉ2Lò5´KÂÙ÷fi“ N5;ÒÈͲ:dBZ«:l 3äPÚËÀ±âKGL\Âs¯¹@ºpJܯ$ÁÙ*Ú¥"~®º¾­áN®Ý±1Ь]ÒÖˆ&(Ñ–è³ÕKŽé²zé$>^ò¸àÙsðÈ…¨…“ p‘V§™Mp† ð0!äRbbº#GÜ£…0Y®O¥[6ؼ„L³‡yZÈ«ó†ÂÈL¼WâóÑùöjç*N>’ Y÷²p†^á摬ð1=gåc3È'\ˆö<-„¬Ž¦d_*¿„œï*øH•³ŸçµP†d¾Ž$N'©¤‡Ò;&GÅ$µ¡n·˜>’¼¸YJ®Lâ…Ôã~W˜˜3z7àõÚr?áé1dªÏT +Õ}™µî¦né=¦!Vº xùÓWɹµð±­Øc.`‘…Cº +ªeZ€ï{f­0ÈlÞ6äP[·SihãùH[ÜÜZWòJ aÏžy:q¡Ûµ»N‹ù„sˆ¨µªwz=òoOÅü_ +8Ð\• +=nˆ„°íCù*xäBÔÂí±SÒЋäœeSuÒBGÙŽµÝþP²Á°ú(±óŒŽs”ãf ¯cguÙ³'paС¦5&P©Ýl°v+Ü5€¤úÂj&à´¦E÷,+ŽWtÈ©#­}úœà9r!já0ƒ\ºƒƒÓ£'dÆŸµ Ó4ÍB?6ï ›zªRJ› ¸3_T¨ LHÕZÊ“?QaÚƒ ÷é):,2Ç#$HKð‘*ÜóAbÏ+\x*+3P½i¸/S9 –:„Ó´¹µp>+x>fU®ÝÔiÛRÐÀY 'µœ¸ ”¶P1í˜ÃÁÙj1´Zå¸ ‰Ð¶†xXN„¡3hî…Ðì2¾§ÍÑÉ:qABX ŽÜòÐþ/ +.L!XmÐw¿‚c-ºNB«Å!šË¶¡‘ Q ÏЈ5 ·’bIØtA«=Ä ïœ`›Ü"F¨ìª÷–¶Ž„ÀYëB`Jšqv¼,³aóÁ6lÚy±`¶¹ÕbLŒZp +Χ¸Oà58Dö@-Äs¸u÷»Ç'Ðã¹í‰Z0=³ Ç`ÂÖO¸y² ÿNb€ @†m—åЇFŸl>9÷ø¢} {Î}¥¼oÏ® §Ä†Oû@p»g2ù9üw:×D¤ßÃÅÉá7>³'ûqÆ-„ràøÈi‹ÝÈ…hÏw^^m¡ö€Xœ=iÚÐGsE"¢jœu<›ÜŸõññœóF.D-\lþua’ÓsN¹µ-r!j!ZäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ¹µ-r!j!ZäBÔB´È…¨…h‘ Q Ñ"¢¢"¢E-D.<Ôfµ-r!h¡”Q Ñ"І-j!ZäBC&£¢E.|0D-D.< sÔB´È´¢ŒZˆ¹€6}g0D-D.<4b(¢¢E.|÷ˆ!j!rá±`x·¥ä¼°ob4j!rá©`˜­]èw0æ¢"kÛöN õ7ùÉôŸÕ‚$O´é~°xžê\ÎßS rAò'šyÃÓ-yšýÑ®îyýÂ6üE\(Šíi6¼žËH’'~6þ*뽩ži}䛦ôMÄð͹'^òõÉŸªój—‘¡JŠ§YVD.¼ý‰û´0“§Ú|v¹?íòÌ…¿O }j8ߟó—IäÂ;0L?j¡{¦?¼•øcóqزOïó¯p¡Oùþ4ûH ÿözçdýQ ÕþÌ+®Ýé¿ýóZøw¸ð{µðo¯w&¯Àð{´°?@ ‘ ‘ ³—õÎÉþG´PÍd¨""¾RœÀË?¡Ò•e÷鹑 ‘ ´ìÒ”˜? …û,r!rá‘`(Î`ØË暈ȅȅ§€¡ ‘ ‘ ÿr?’Ì.•3‹\øf\à„Ë}—`ä¤rQ ç‘ ·Z™¼ÃoÔÂÜÃðé6è.$p¬Nݘ~˜#p*ŽËï¦ålë­ZHÓ²ói ¶ägÇ3¹ªl‡OqmÖö[M—¥."mu–ÀVðÈ…íe’êšýv-ìã0úøì¨t"{\´·jAP*¼pTPQŸßÕ¨®ùÄVŸâ‚é\¥“L+!˜Æy†‹–Àá;Ë %àÞŠÓk#®²—Iª…üÝZxþ¸³jéâG‹…Ï7Á &r|P)-ÈÓýéŒ,ÄÎ¥J' +\U¬nÇSO¾ÖËBëÕ2©ê“\8´P øZX-Ý]E¸¢«e”Ò%iÙû‘®Ãù^øbþ¾umBMAÕm¦3/¸DP¡ù¾h¡€V{nJðëÑ»ù,^kÁž´0+ô‘lÐBï Àȧª/ +ÜЭÀ­û¸xµ`VäBe¸Z¤?àÄë¡eq|á`˜ ü¦Õ*¥³ê{ê¸1B`ÚPÎ}ÐBëA©+Á§ïû¬°OU*ßhÁ/¶€X|¤¹°;ZºÚS—¶^ ›ŠOÇ .œ´°#FÂ…wÒ•\0··6ráz{ùâ1Žþ ×;Â9§2_0hû…U‹ àÚ3[O³Jqh¸€Þ8Ñ2B?§…n &S¨ÝEã±_ o¦½mÖÌC3{Ò_P‘KorASl¸E>nŸçOê-<Ý· ‰¶Zی󦓥ÈM²,HšG.Ü`—IªsGþB.ðödÅž}:˜†ašÈ̺½‡G8¦@ˆÇ^&’px¶O ž†^§Ohá ÍÓ¯æ#qrºCx˜ƒAø +7+‡»†à=Câ¸ó-ý—ˆ¡Oþ‘<ûL_nœ§ú÷Ûe’ª/åßÈ…´ößG qžêŸÃæc~¤ïÃ…^‡¿ò’~ˆ­Á"®i§À0•æïäÂDŒù1Ót[âÒ_haªš0B3¾Ôäù|~Ò´h{Ñùô¼¬U6ɸÝÁ>´õR7ÃéùæÇ©¼êº‘G.üÚäå‹X³—ˆáïäBéÀlþþ`ŵ0[ßc©é¥¡ç&vÕV%ÖöÕ ö®s=ÞÁ“i¦”sÙ9üa#y·|å‘ WXv™¦_È—JóWr!uE¿ºy×’ä‘Z`¿»E |ÞÀ›ë,¼B‰Z8‚uip0ÃO†àL©Ô¦÷p!Óá+u_÷aú‡ÖžóaØqºv¿ãTr¹p…‘K«Ø_À0èöoäŽúzßÂ+ +!(÷-|àaáùêªèê§\‰ô^‰QFd®õiN¼bÑyäÂ-\ø`˜È…»À:XïâBµâàÂl!Xm_ûHBkÁtX‡?ƒTøjͨÓáîì@ 7d»’ ÿþ£ß|’³œîÖÔ±¢LË4- ­ !ùZŸà¡Ò¬ÉmZ¸ ¼(#>†Kl‹›ÛÞ/”'-ä>TÃ椪[o´ßóª¶gק¥øˆ X¹ÅGºŽ ô‚’¾)ÎÙ‡s.׉în-ˆÔ[dz |~z|9¥WxˆF­7iágë÷sÄð¦ÉÙù\¸Å.“5I7ߧ&=¾]¨ÙÃÛØó=@ÛÏOñÂ|êé´Ö$‘Nß”7ìJ.¨ËÇ)í›ß¸±ºS‰®Øx¯*•“ä ïßf¢Aé š9O~©oÒÂÿrÁì=1kÏ“uXÍI+ã¼=j!|w£‰\¸ —Õ ù¼Æú%¹ÄÔ´§sfËA‹tüœŸŽ&ôW‹¨‘ï¹iÉs¸ –¿þ¦Z(aEH—‡3´³E0½cVSœªŠI²Õô-TP›æó|£VÍ,Ëo_|¤ÿË×z[¼°ÚVnº!½ívê˜ÐÙ\‹Ìaî0ˆ8tN|"ՙȅ뭿ŒoÛ_6é­Ü6 [?´Ð¹¥ØÝÐægïõÛð.dP›.ZÈ AlÓk-¨Çp¡•‰nä`ÓÅ&¦Ð%Im–7“œYá¼*xäÂçÀð—­kC鬃)T%TÄ“(ÃÓ$ƒË únè8ýl±ÙõZ0àõÍN¥]×¥ÁÓ +7\´ðxá@ E¦ti¸Ò ZÐy!f×/Z—E.Übà Å_¶ÞùÂ…¹×nª´²–œµ€ns¥oµÒ‹/A\®„°ifa°Åú\„>%ÜKçغX.7’¥«Õ®e•‘ëO\`Ú&œŒðºØt“W/ü}ë‹Á'àø˜lòE'}ÑT»ŸŠýð á)V?— NÒMÆêçuôj-äa AMÂœØINþœ ©¥þ\؇~ß·oyŸ%¼ïù¼ˆ£p¿öªÂ ÙÇnÃ9iÕëæé·iá ÏG’*ûɳä—Y™®\¿ðòs¾sS)wÚÝ–‡#û~¾‰\¸Ád6?B Û]$Œ¾ò<ÕìgZJ“®ÄKZ™8Oõ~;÷ Ü¥…Ù‰_–©µxŒþÝyªüZ{.Éû<ÎSý<îÒB®S?Ë 3ÅM&TœÙð|eœú9»,šz¾íɘéžkÝ®…[<2lXh>gXÈ4 óÖÂû¶¾¶-L?z79 òxûDÙÛùÕn‘ ƒ¡¿_ Jï¾u‹ÕnÇ›S§µ«<.º ¤,ÓØYµªËÚ…ßÄ…UìžPg­«'?âh\[±ºÌ×Í÷áYÂ;5š +ä©1uøH¯Ä@è91 ïêÈ…kí”à-Í&¨÷:!¨Fëž87æÚú +Xpž¹ +ÏÓÆé„SçÚ~zÝó'¸P/Þ [‚{¶.é7æ KùºZxG"T‘eÔ šú°ÏŽ÷l5åºÚ|‚Ä€1Üd7x ¯b$rájox½W NÕ_€…Ök˜Œ×o>ÕŽLV¯Ù)N¨Q0£.€[t÷i-ÜÌ…ûÒ…³¦‚×ã«…ò=æÌ£í×ÕÂ{.!qT¹”Rt0{­ÔhZ`,uû,ûz0›P4Ù—FÕ <ÓÕÈÎé:ráêVýÞõÎPík\³3BS ß'-¤ ¤p9ÍÜ i¨S-R­­súÓW» •š}ÎÎ!Jëð^§ùŠZÕ×ÕÂ\|ç¹^;WŒñšu¹KSG·Â:Ú­3˜ªœ¦ Ré¼qcb]¹p}³¾ßÍ…ëzM-4ºPÿ¡í/WàŽð²ÓÄÕZ+¬‚"Ó6ËÊtø´næB-Žy»Àìv2½-¼[èó•¹`(&¼Ô9Qb’½ë¨ÍL¶q[²Õ8-G»Ê­Ùp5h-ó´0)‰\¸þ(ïÔ‚Áj~âj!KáúH~búLˆšéF:]ÅöOkáf.`êÔœÍÞ4Ðð“#*M‚T\Ó~.Øq3Ò»"–¯B[:¬3»äE­ÓœA¬ì{P”¨†Jï‚ñÈ…Úu~Ÿ ÆË7\ qbƤFŸúÔjpWÂÚúé‹ÝÎLš…­sàÚçxAñBfÉ—ÕÂñÂL ç;4øœÛfß“ÆÕ¸  Ò.#ã¦o3ׂ\È¥l-ÊD.ÜðÜ·Þëyá·t÷2Í&¸Ãý^}ßõ!UÌ©â]ß7)~ÝC5fŸ`¸ +X 鬅Ÿ<é3`WèGò›¿¬~ŒÂR»b¯õFÕnØblNj]o}«³B7¦qÅ¡Âl2Øzvˆ\¸Á¶á>-ôÿ3ɵh­nü^oçBmÿÜ€Kíj¤rÎἡÞáÞ ×ê«Ä ‡xC%)˜³"!T7¤qNƒ¯d*|¢u +±3cŽöà&©5ráz“Ùtß|¤Eó{p´žq;&u$(2|“3¸¡Äü~’•_W æƒù©GB°²ëÉjö4Åá¶lØIŸ¦˜Ã$UbB¹¾ßYS¤†¯f+"n±¬¿oç}üP ¤J>OèãÎÝÿvœVWÍ‘ú2ó‘^¶oæÇÍy?ÁÁ·c+„í±?ç1^¸ Å_ºÿ†üÿÖ'4ÉÖÂùTÛ¸Þù³`¸Y k™eÙÇyTBâõ>­Òêà^¾>4}"„þÌ<Õÿ»ÎtÝL?Ì\£p™¨úÑr†S×åN“òøëäzÌÚö~J!šÐé¬5ÁŽ¢u5.ä8m£õ,Æ WpY*˜n¦Ó NÞûHÎB 0på°\mL&pšt:$Î :ét–E.<ÕG + šq†*ÄÊv&-&ÊJ ¥Ïh¢èzóU¥—¨‰Ð´`ùC ±é×\`ŒÒ%3’†4‘{ò2ìGÚQ ”‹zcúRè4Ó˜8¯®Þ\&)û•¹pg¼€6b˜ÜjJšîXâOÁÿµ…xY@GO¨Ñãöä9¸€ÉØA žáÙz£þ-.ð}$ivÒ¸žì¤t[cwœ®z¬ê‡x!Áôd|IB9.–Ù‰ÕÆæEÈQg‰ÎÈà”‹ýHÏÒB}^™UÚ ÒiÑXÐA­]ŽÓ¶nÀG%gòáÄ\áãv¯´-«[W¸ý{ñBãðÁªd-“¹ÍŠ¢è×' šN§ <ÜÀ +åH«ó¡OÝ8·ºê×N R€·.“"ž¤…Ξ;Èb€owÖáFOsµß©uV`@ÃÑÔK! Ý)YâX”8¡Ûº´¸Y ÿ\¼pha7|¡ZmÐÒCœ¦ÇÝaæ “:œx«©Q‡p+ŽCpnjLý±¬¦p9¹ð4-¼¶ód†ùÈ%y<œÏ{i¾›ê°èêØÞŸ˜Ô“ºÿ¹qça½dB*º œ£~Ø’$é éaÖ %ëi¬CÚ….#2¤éÞÓzœbXã¸óoÐÂÎÕ«Q…‘ÝØýsãÎüõöÍæœ?óaIøË#þªàyÖêËôÕ8é‹j¡¯ºRå­•øŸãÂÿÙºòOÏa\ø"Z¸Ïþá|ª³È…¿C ‘ ï3ÿ }äÂÓÂ7ysÚÚ£\hÎq¿“î‘_räÂΗüUÎ#>”ÿ+3¶$ráiáXµ€ þ:-o˜­.©…– ¸&!Œ±œz–v¸‘µ€ún9¯á ÇÃBbVšÈ…?£…J³®¢¾VªYZR­÷0¼¹p7xQî<Ëø^&j)xÚíRš^Ùn7å2g×n0C['fÏŠ<• %‘ Š ÂãÔ£bÃe/é²ûÈ…‡p4lß-3›Ë„Bsã¨ÐÕf]ÍkG•"µÚIêúÒ êJ"œ£¤p¥‰\øC\IêôÚésò‰9rá1\È\’9·wlWŒ{U¿ ©˜JðEwÛ®‹0ŠÎ~aœ©§æ-1Ÿê‹¬Õ ˆæ’&2Æ ŠŒjG¥ÒZH¨ì²f»©€ b¢j áà‰euÝî˜Lª•;ß­ˆû/ü).hgUËqòj8í¹ð¨~$Ò +š×BuD-’ÔŒS»TB¡—7͘’QUŒ÷n›±êU*`"ráÏÅ aNR‰[ŽøI°-Æ âBæìVi»‚„ZÀÙÜ’¡d Í#Ù£rg n5ÍU-ƒ$#þ\¼pŠ(™[\ÌÆt*1¾Á‡y|YShaø¡. v†`ºÑb_œ`¶àdÑ7©SB7Dµdç…ËbÞ¼?ØtT wJ4ÛcÌaKïÈ4¹¢gÐGu;Í8/RÞu7tý^5+ïÚf3;ORH‘·¥Ù±‡•,‚Äñ…?£…d¹ä?Ús¡ Á4ÖõøÊ¢…˜ 8MÕ+ÚVnÂPÀḛ Ãk;?­‰&§’;ëL_ø3Zø©‰öZˆó‘®7SQç#}A-¤ô OœtÓ„ÔÇùH_P Óôˆ³D.Üd<ÎSý’>ÒC,r!®_øòZÀL†`ó³µ¹ð-D.O3^\÷ÚÈ…ïÃ…ããpL»>44þ•&ßµÕ%^ÀÞ% ÉI Ϙ\~_-ÌʽûŽ³ñú +§¯+¹ð]¸`ÎÝ©ËS+à¦Áèᬅŕ™«SÅ‚Õ)ÆÜ-…7½”Šùò¬ÏRO;ˆ¥É7Ñ‚|Ÿ!¯¸%#’pWõD.|.Èv;Ýë„Èe¸if_2ÐÆ—TÔÇØAUž¿l*–ª<Óû>?鳨‰Ï3?Ôò+ia*ë¾4^%e‹ûï÷¦ d-¤5&Ç3#ø‡~ª5Kgß·õ/«àCïU†ûõŒP¹ÖªïZþ¦ûé*0D.ÄùH_D ñå'b‡±dh§øçf霱š…MyúcÄ™ãÿ$=6êØÓÚêÖã»AÕ·ú F’KʽÈç#}-(-ŠF»)ÓºídˆŒÔs=¤ºöV«µÇ™mçü£V« §²gº/àEÄi™jÅ1ëj§uÞ‘7ÝWÍTŠ\ˆ\øZX5öø +—š«ôfî¨Î@ é±@Af5-`UÐ@•*£˜.Kx\k‘ŽÚáê·wï€ék*täBäÂ×Ц±õ¨už\ªr«[Êœ™0v´õ‰ÕV@ÛŸ=h笫p7­Ðð˜ÞÅÕÓ•Zˆ\ˆ\øZ èãƒÛ“d-ôàÿà%-Ç<‰fPß«P×Q nÄP¦Äˆ-øRfLŽ™îUrþg¯ú1¾&ò\-¼çBoLäÂïÓ¯ÇÊ„¶àáLõÒžë©Å5ýA P÷A uøGv$Lç¥ÓG +€7)qY/îðAíJO]â…-¼¹n6÷×áÂ,rþL-ð¶å)‰‰\ø]ZXè¯R¶ìRháÒë³QÁŠ>ÄÎÊÀ-D¯üçÆÐQäúа6ÐB«ÝÒ°ª·±ºr0â qAi÷X5ü|OhoèƒÔ¹p… éþ•x–@]œÍ¥‚Ì\‚¿€H!dÆ{P¦ì=!œm.2~øÇ—m²"œ@â$u&ªã4öQ§Wiá÷sax­…W_Oè^n¨S¾ÒBvJÊy6ð.q‰Tv»§dä{ãÛGZˆ\x­lôõRü‘w ®Kñd.Lcûƒ-õËýzy¹ì<äêíŽë¥¯ÎÝÖ"¹(Å-\^ÿ=-·Õ&]Þ©^hþþCæB×m´ã‡ey›³Ó×]N¿] +‰» + ÏæÂ,ÜÕ¦O«ZÇ;®Wß|9]߈p®®;½‹vþ*ìË׽̿LWÖægÇ ³œß™/Ìt¾?™ÂŸïΡå°ã]ßÕôêrÓÞùËý¡Ûû7fêã§Ùnö‘Ö~}{ª~»|Š—OÙ8>ÍÑà«—®ö3Æ Ð<Ðõ ;s ^Ø^Ç Û›xÁŽ$è›Ø¹4œï¯þJЂ[rû°Ã›Ó„¿}ã…+âWíî„/ÔÄ«„_õ#ÕzI âø‰2x£…ú«w¬}¡ñ…ìÑ éOÇx–Ç›ŠýË¿Ñw>çq>ÒoÔÂ7°8)r!já_çBœ§µ¹ðõ¸0fÎ>èLž>0õòV§)j!ráëq¸rý¨|:>ú;Y.óÞÊ1j!ráëqÁ¸Ôp>Á‡Ú_±™5 âЉ _šQ!á²²D f +qÝö—бƒŸ¦cW•é؈åXüLÆ÷n—$haOΑ ß’ TâZg«›;І»l¶¹/uOƒ‡ÂõNòTÍÜæÎ €Ø¡@oÓÒõP÷9xO«ÎähÎZ€†²r ´tá)k «=j¹ZPs¨¨¹ßu–BáÒ %ra”Cã!¾†ZøF¥˜<é eí2áv,¸E²:¸×BÔC:W}äÂ÷ìGª¬6[­L±v¦–¡«žYf«ó2øÑ)a‚\þ¹ï%Án™<…r)¾«ÂQóS\°=¸OŒÉV’éþgZ…ú£š÷k7¡«!ò\â2L¤Ï}¥Bú¡m \ØñË®Å.¥¥þäôðÈ…`žjš|k-LØG†ŽOi „7àîíæwÛ¤¥Ÿ„šÑG*pÏ œÇR2úÙËE.Äyª_] !hiuÝÁ‰F×T®öʦ•++×dp µÀÒÅñ¾sÉÜgW E.Äõ _^ &Ke5n½2wBŒ³'­ DTT4rjVÒt‚&žã^+Ÿœ#"¾fU†Øù#,ý´""¾º|C¯ÕBiÙ§×eD.D.|}-Ìì¯K§ØçŸÏ1¹¹ðõµð{,r!ráËhaÎÞÖ»)yiz*ø yƒæi*n¬Å‘ ‘ _F ܾu„æÓ’“Ø(ípå©VJ¤Í""¾©ÂÌ‘0Gä¸ÿZ “œXã_˜å%H–Ǧ?ÇËG©“¨…£=:&’L¿jœ""¾Œ ݇¥eØ+š)+Z «Ÿ—Âg‚-vœ(?([Žíø°lWS+z/sf)÷JÓÝ. +—?ñŪʓ%ÿU÷È…È…¯ã#¹¡€:\»ip¹¬géì/m)åµ®ä¹Àl\kè±ÝUœå[=®L@TìJùÑ%ı¾Ó…Šd.5k²È…È…ï¢ÝgЄ nÎFÒ†¥Òm^²l„J*Ýh\(°¹¹a.J ?-ç ea¼yTãŠÌÍÒ•àe¥¥N“A©9{õ.LãEXò'«%d³G.D.|Ž ™•¾wòY›OZ°E˜X!y)€yžæcˆ¹PV1ãFµ»–¨ˆ&–6ZµÜý2’¾… “»|¨æ'£€DgÔÂœ•eZ–˜ÙçÆ\Í‘ ß PÕ'šžu3Ôméf¸ +Ì Ü°÷”Ä¥H ;iœ¸PÚ;{–b*ŸÜýr¯¸›¸j7Cºû‰ªëW±þÚgd•YiBƒãª…W¡ƒî[êÙx‡"¾øæš¾u=.Z[†E—“£C®G‰b!˜åc¶´a‰7hgÖž´às[n‚ùBw&p¡óJ ™k¤.ÊøP SÌm‰Ó-\UÁÞ2—„¬Ý}儵ÜüB7k¡ôržq(‹Z säÂßÚ$öÎ~¸ ©Â/™O«—»èRN/z¡ZÒtL‰†ú +ðP.~®«Ÿ…èæýRz.k½Û£¹ 0•@¦à +q[âÂtÎ'U +¼õåÂztÕ ÌÂX¹ðwjáMe;œ“ZÌoæÜmí ü8¾wix•)ùX¢úæÈuÍç­\ÀŒ$uÐB«Çªr9píèCžŸ¢Ñµ´ÔdY¹b6LäÃxv契 ßY ¿úmª}ì9oæÂRtÀßZ/`Åî0ÕZ´P[àÖãµà¬u ÊÏV³+1íaä¿®?äKõàoøó\ÈñÇ®’Þ­'-,ƒNB_Ó£µP΂¸$«z ¤š>¡…ÿåç÷na¹ðûµð»… ³»h¡Ñ]ïTYë$pÁ.ì:O¨^fý”x!pëÌðäÊ Z×qÁ¬E9\¡¹ðG´ Ûæè7;7™ï ~•ß—Ö÷µ …79Áž`ïÓÔ—‚Ve7çëc¹µñ£>ä}Ìhsôظùg–£šxäÂoÖ‚TéoÓ—Ÿ´žºhk +>’ߘµB~F ·ë¦Óù6Tº6;g j»{ø€ã1ÃmEàøS+<ä‘ ¿K ¶úmZøòó‘N3q1ÕârÞúk´^ÃÎÄ̹[Î[¥³·#Å]@hÏÍØÊR)š²]Õ¬”RõN*â¹ð»´pÌÛÞ¡FOÚ,l‘2×jÉKߟgÞÔBµ“—µª« +¼%>¥Ÿ|ž*/44÷€b×ä.'ÊÕ£½Io›Ì-°{¥E;:4.¯•µ¦m¹ð[µ0+Uæ:›µªZx¥ÒZ·8§“­2–V.÷ÔÂAêWuŸJ#ùÏS5™.Q$Ü@íŸçÖõŒb.hbdgÍ¢8l•êbÚYGXmLçÖÚã…ß«ÒÉ0óH7~²cý) ´-¤ ª1©ª¢ãËÜ~"â¾› ·çºÿR\Hôˆõºß6WPF¢ZIZeJ·S!…¶Öê±sïmµ;]Q+û‘~·T¦t>a¥jRÍC6½“ÀoRn)°õ©i‚ÛªXÇ?fQ/6q)‘•ÛTKH˸Q⡆d+ûÊ ´ÀmÛEʯÒBäÂCµPê<.û„¦ ;tZ`£ÑK1S:`ý§ts›_äY’nãBØ%'ËáÖ(çG{¥LÓ 7§µ§÷jaVÌþb–_;ßÝ”êeZ ‚ê&LЂÚå¨ÕN€Eå2äÂjs"ØfÀAZ"~§òuØd£wŸâüÔB>;!+ã~]©®6ðŠ +” )Ü0AÂ0Øs¹öAÙ3:e$Z&ªm"q â¡íØ/g‰\§Û®Ã0ü¼m]ìt/vSáøBËM¡œ=W9!¹Bç©çiqÖµ¤²7T»'©›kÁ#~—&¦ƒN¢”JÔ‚Êq§ÑC ?™ªŽç„'ÂQEý  –~fgž›¸ÐY>‰—P–«Åo¸k\ç…DÕ¾ÖɦÕPºá!Z8¥@À]Š‰/òEM¥ÄÐ…ís8*W«ëùN.à¸s– a-Ë8߇~ß×CX3I Ä ÷b0<Ëz³÷CwþmZg™s.ýÔóvdñrêkp‡p›!³ÉŸKàÆ´äØjb†OùÖ7q¡Ð«×ææ ·l¸­\1Û%M©Ãø_ªqåC´P8;µÔuª”¯´K¸z  t©k½rÝt/^ÍGâæ<øÌ/£Ðð;¼9øò0rá÷há#ãŽåʾ_å¨l«,ÿüYo‹*¦.¯ ¬ò;ti³ÙYÆT˜¯‡²$ÑB@ãèîf¬7ܧ·4Æδ–ù¦ »ðÕî)ÎSý{´à{ÊÄ_ú +‹;Nzú|2æ%«™œËÙ'.÷¶˜p=ÁP\x”¤ÃìTÜŸ{²yÊ&¬îÛýÈ&9R…£*ˆâú…洞§ØM\H]¹Rh¨½à†ñCbGok¹°"±Ëcµ0ÓPÂ^õp¿So´ Øh€ ‹½»)ráKkáÓ“T§ýöWÞÄ…©eLô>x*~SŒAèÚ‚Ó´0F‰s%*/Eò8-xŠ;SpÃÕ$hÀ“Ä*ð‘LäÂ_­1¾ü˜¿¨Üï +,·Ï¸qÜy +eÇc1Í1äŒëPo|¾2^8ú‘µ˜µ1¸P)ß:* ’È4“‘ ³^¦çw¿ZÀU½-Ыõ©\8U1¡»{¾›+ÇÏïjÀl3¸žû¼o1nƒ<”óÌšáýH‘ _Z YQ-ß…—£ªóÝ󲬇,ËkpNʬÎ|Q×)¸#¡À’s?¥ex‘߬…Ûç#Mc韯…XäÂ÷×B㩦Tw»Ò8µVÌoÚŠBèeq™WNu™£µmˆr-lž­U©¯nÞ¬*æS\øÚ\ÀL”‚ä3·‚8•-¡WOÍZÜò]ç <èÙæ>$ÔîÝ­cÏ1ÏväÂ×您C­¯˜¯´RÂ-¸‹³Ç=•#p#Ãiª¦»ð!‡q·Ž5D.D.|q.´a¦4û•íû!ÙG-4vfŽDíÃP¼XeЂq·Ö­È…È…oÁ…ÎÊÍ¥žÛj@-01Mª>¶QïG†Wbƒ Øý¹¹ð×hA5¡?h¡Pµ™`Âo¹àSÜ+ÐÂÀö!%w VL3ÃÌ)×nŽ¹¹ð-´ gÌùþñ~ò¼ÜŽ~u¯Æ¾˜N=ïs’¼ó Xª›;þ#"¾°þ¿Ú~WÙD.D.üZ¨•AŒÞ>¹¹ðµðkïêöÏ‘ ‘ ¥>a‘ ‘ Q ‘ ‘ Q ‘ ‘ Q ‘ ‘ Q ‘ &ráOiañ†/ÿ×·sa—äY&‹×Z(žx¡þµº~xš‘ ?ÓÓßÄ>äž<ѶW=¿ÓðÌ+½Zå'‹g^ÈD.ü¿MeÖ}ù?U•2;Çßëñ¹ð -jáIXäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ¹µ-r!j!ZäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ_BäB´¨…È…h/ZÐy´‡[#"¾Ÿ §ãŸÇÿÑ,âöÛÙgé<6endstream endobj -5385 0 obj << -/Type /Page -/Contents 5386 0 R -/Resources 5384 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5357 0 R ->> endobj -5387 0 obj << -/D [5385 0 R /XYZ 85.039 781.388 null] ->> endobj -1586 0 obj << -/D [5385 0 R /XYZ 85.039 761.463 null] ->> endobj -5388 0 obj << -/D [5385 0 R /XYZ 85.039 743.459 null] ->> endobj -5384 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R >> -/XObject << /Im4 4878 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -5391 0 obj << -/Length 3617 +5500 0 obj << +/Length 107 /Filter /FlateDecode >> stream -xÚ¥ioãÆõ»…j ¬hÎÁ+(x¯ÄA²ëƶE ´DÛÄʤ–¤Ö1úçû®¡F%§ ƒs¼yóæÝoFjÁŸšdq™|’f*4Y6™?œD“;˜ùöD ÄL@fÌË듳·‰¨(Ì£|r}»Á‡66“ëÅ/Á«ïÎ/¯ßü4c•‡ÓYšfÁ«Ÿ/§*¸âÑËŸ.Þ]_¼û{Uðó%N¿ÿiš™àš.Þm¦Ï|yÎ=FÓß®¿?ys=P:ÐTåH槓_~‹& 8Ò÷'Qhòlòí(T0ýpt†±5Ò_ž\üs@Åsv«Ƹbuê`´}~;çaœ'£ÛE€/OÂ8VñЪðpËoã™)¥C£4P•Ø0VfVª'J…y£°”JÃ$דԦa®,Ië]ìí§3”»|uà6OC¥ˆsòi¢ÂÈæ¹a¯MØŒÎ.Ôäu”N6Äš<Ôq2Ñ* u>Êc'an3P=‡qš§Q™§z*€,5q@xî"ÍÂ4I&ªýýæ™ý2j½µÝ‡ªžÎldƒü÷³ßpsŽ¼\S«[µcoÇÓSMýeïw§: Zü(ƒUÏ­þ¾äÆ«ŸaúòŠ;—´¨ë¯æmµ"üphT&…Ú›i ÄW}&° fh• -ÞâV ®o§3 V;t%6mðDh×_ô‚';¢¼‚å’Gê’0Ò¼ú†G×Ð-ŠtöÖÄ>órÆ5‰;ýþ囯¯p‹Ë6 Ábn÷vÊà ÌÃ?oѱ×XÑÙÊÏU³î–OèNöUBÔ+I²PeUAè° -: $DTÁ£û9<¾« ¿Ýˆ(KQß»/ˆ·k” ÀÝâ7Baƒ"¬¹ÓõÕr9¬Qr<õaqj N-‰·Å)‘)_8c‚óÜ™‰‚_#e—eG=Ü"Dó =_Ê2TÕ¤ € /Ha‹¾jܘ0b4ªý#Í„ Ÿî³uמu÷E[žÍ׫îlÑmw6vkÑÉqª–ÄÌ{¶6QEÀ®mpÍ|%0S;ÈGÆšk‡I” Z a&L¶ž°"tÅbá8ðp3fY†ãAÿÅÑ-€·ÈRÅà9á/aåZþ’©ëž$@í¾š»æ `X,î@·®Ñ2ÊÓªïŽXòèÜã)ŸIè;æÄ:ÎP‡ÑÖ«ž¿¨)õBÀ x"pcýýA»s&Æ·{è°Ý; ¤Õ´û£û9»?¾Û½¿ÝªP³^‚'¶&Ì™™m# M0Ãñ¨*kb>ÌàÂyJBp¤‘PŽ|þ;Nž÷ßq&Z8-cfu¨Ò-ùÞºHd›%4 ÙÃÔ Ó@†$â‘uc>8wQ­z^ͦÉíªîúb¹,/°;7F˜¬{õ²Á“#4jp½ ¡Œõ›]ÉLç:hnñ«˜Zß~ `Ht±ã"5ÎïÓ;žQ\Áy£ÜøîúL<û×%¦Îf—Ü»-*¶^gAÑó%Òv=f`+ÿžf–‚N )<@Ѿd M•2Ì'ÏAS$S€Áícì:¸o­cÁ æJ8íeép´’Ùº‘am³¾»ç!"¾§‹rYrv{*3noöUUÝ—í ŸàxH'l,äˆúØÅ…LýL[a%w)À<’pj;¹A«±óqÊ\ÅxF[1 >q»÷vÞ¶c½¥Úr6ÂtHËPÇã˜=&|%ÅãNA‰ ‹Ð[3é…NPdŸqº8É̺çѵ“.–qˆˆDYÈš—§PH¬—ìíxœS¹pÄÅùŠMý«ì¡œñKŸ”#>Ž{S³©NvܹMR91÷ˆÌJ¦vƒ `"—$û²ìz:â¶(l`yŒ‘‚¼ ¶%ÇÁYÊsr<¤á¤ ¦9—ÐPµn§g0u¾x¨êªë[ªÆä‰fD\ÎP(ÿ ¥we·Ÿê…@2¸ïòTÝÁÊÀ7ÖÏ”PÐáÊ!%ö` ut?WBßK(»÷õœî9ÿ2$öo@ÛÚeîsöÏÝíz)ö‡0^I1$ ÆEŽaÜýÝ÷W˜D çj7úgT&N-‡xD]I ‚Ô=†?­¼l`çEÍÐCbÖ %þƒÐÀcÕÏïzÉþ”¯Su?–kb(@ ɤ§F<ÁÎ7hëOÜf´ ÅA:†3j´Ò;ÆT‚Á…w&IZ(‰${Ü®|ô²vå.$Å.—±Ú+<1Ýp`Ð*¸Ìùî=jLJë÷Ü}Õ@e9û¦>ýìÖ…ñª÷¶%ø9éSɯ‰"FšíÆ1¤ôÃYqNQl„Í¿»9j:¯e;î¥3TÓR:SûË8Cc×iÑâÃYÊ)¯rŒ#äõ½\S Ô‘£0Sî‚«]¡²ó9ׄu?v¹4•oÊ1›x¼…ݪ&¸+{¹%Ū3—³të›ÙœoºŠzAyÇ1YHf¡ä™xï-áù߈TAyxwúóoJ «PCR‚T©>ú²§­Ô›»fd÷XÄOJÚØ0‚½èyÈŒBàG†_AJÁ¡”’= ±#À>ìeK€€*ø^ðç®ì¹±Aožxçªl¶ŒzxÆÃùÛ¶yøæ˃âffê9ql€ŽˆC€žDZ 8v÷‡·ß†;Ѷ>B‹?Ýæ’äí¶ü²‘K?ò*s·%ƒ·{>ž./_KÂÞu y¿¹‹—EïÊœ˜rq®èÅçßûd3LÇrÎÕš¯StÌ9qŒï*øþnšS,üÔ7æWüòC#ÓÍ#ôŠ‚×ë²ñðË¢Ä(œ<þèƒ+ÎÒ%/e4j<© ^Û}H+¹tß’â«,È…¦ë÷±*aÅW„ ÑHu­“Ø=?·rÃŒCNpÔý+Ñܽ”ý]&}åÊB›¹ëVõrdµJÂ(ݾO=ˆà ºUÍÅÿBʬDž”‰ “,ùƒD±™îyhäŽ: -“$ùÓ$â œS-¦MÂêà‹¿]¢F úºŸ˜ âömÞ5Ýž™Hƒ€Š…4)‹6o+Ø~…{ ™'  &´ó™fÝußÌ(zZ‘’Þíã©j)|OG°K‰fd¨v<ÕÌ嚺Ý2§§ÜÒÝÈûxøÙ‡ÆÛ©šô­*†êG þ¬(HhwÉÕÊ›Yªåe ¯ÐV]߬°¾ÃžÛmð8‹>‹ÞØ Û¤HL÷G†!F4rÚ°”ìxSÍ |‚\näñÞõ!T‘ô`ßOÊo¤ø"‹llA)º–ä]§žëMåµiH•ZÎÎ`* ~„æþ^ 7‘ú* ë½|+êÄœÅjµ¬æSz~£JE;nt¶šÆT­tóV*•}uW‘mìŒþ“sC¿¬=ÉxIV5þË9øg5ùK?‚ê(3s òÅZ‡Z9Zè‡O:ߥ7£Œ3³Oðÿ@t²endstream +xÚ`ŸÿÒÒÒòòòfff777êêêVVV³³³õõõFFFÂÂÂŽŽŽËËË»»»¤¤¤ + + +ííí|||•••………«««ÞÞÞÙÙÙœœœýýýúúúrrr---âââÕÕÕåååÿÿÿŠ”>­endstream endobj -5390 0 obj << -/Type /Page -/Contents 5391 0 R -/Resources 5389 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5398 0 R +5494 0 obj << +/D [5492 0 R /XYZ 85.039 781.388 null] >> endobj -5392 0 obj << -/D [5390 0 R /XYZ 85.039 781.388 null] +1426 0 obj << +/D [5492 0 R /XYZ 85.039 761.463 null] >> endobj -5393 0 obj << -/D [5390 0 R /XYZ 156.947 730.534 null] +5495 0 obj << +/D [5492 0 R /XYZ 85.039 742.197 null] >> endobj -5394 0 obj << -/D [5390 0 R /XYZ 156.947 686.358 null] +5496 0 obj << +/D [5492 0 R /XYZ 85.039 426.321 null] >> endobj -5395 0 obj << -/D [5390 0 R /XYZ 156.947 613.958 null] +5497 0 obj << +/D [5492 0 R /XYZ 85.039 426.321 null] >> endobj -5396 0 obj << -/D [5390 0 R /XYZ 156.947 376.847 null] +5498 0 obj << +/D [5492 0 R /XYZ 260.019 216.657 null] >> endobj -1590 0 obj << -/D [5390 0 R /XYZ 85.039 243.395 null] +1430 0 obj << +/D [5492 0 R /XYZ 85.039 174.953 null] >> endobj -5397 0 obj << -/D [5390 0 R /XYZ 85.039 210.114 null] +5499 0 obj << +/D [5492 0 R /XYZ 85.039 145.059 null] >> endobj -5389 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F73 3992 0 R /F11 2898 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R >> -/XObject << /Im1 3957 0 R >> -/ProcSet [ /PDF /Text ] +5491 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F66 4190 0 R /F62 4047 0 R >> +/XObject << /Im1 4096 0 R /Im12 5490 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5401 0 obj << -/Length 3637 -/Filter /FlateDecode ->> -stream -xÚµZmoܸþî_±p D[de‰Ôëý¤¹;_‘œ;¸iPpWòZYÚHÚøÒ_ßy#¥Ý•Ú"ˆE‘Cr8œ—gF.ø.²Øt¾H³Ð×Y¶ØÜŸ‹-Œüp -ÅJHVš—7gß'Ñ" ü<È7·ã:±ÅzqS|ð^ýøâêæõ»åJkí…¹¿\¥iæ½zµ ½kî½zwùöæòíøAg轿ÂáŸß-3íÝ0ÑåÛqøÅ›—/øMûÁòãÍOg¯o§Žà*G6?Ÿ}ø, -8ÒOg¯ólñíÀaøþ øôãHË{}v}öw·E ž5'•Xg~œéS±„ñD,¡Î*^¤qàÇADr¹o»r¹R ‹~ÏÌ+7•©±'õÞ\¾yÍ­a #_áÈBƒ‡™'ÓÅA¨y˜?¸¬Ùíêj³Œ•g–«Ð*˜Ûb«¹Øìw½¯_š;V´j Ãý€ï=¼oºj7ð‡ˆR_ëLöøg‡Ï‘ŸÌ{¸ƒÍ€±;a÷®ìÊ[9YꙺoqµÅJ%©¯âx± -Q¢9-S—¦èáCí ­<ïJnìÌVZfƒÌmÚ}³T9œ§Ùr?¬™Gú!ìĬ^|1ÝEÝâ1· @ùOùˆ3_Eé dÞZå~†cÖb”6,Þâ}û7kÜ´®†¯3,‚÷NÂlÂ#ä‰ëÇWrÓ-ÚN]pOM>[äÞáùê=M"ÿÄÄ»‚î}cÖ¸PÉAÞNGÓµÙÏõ=TÓæÇ>íiku4O+Ó|ËVŸØÍšêÑf³–:nfM$Êò7E™³RlìÅèÍ×Ah.ðj+Qjî¢ëvû‘ˆÍ‚žµ…í_èRŠ»zžA÷\WÖŒyªŒáEá< -7ØaÙ}ÄÕvŽ;•)ÿd!©Y.vo÷¦3üiRYp?¹xŽŽ À¢¡³µ+– ždÇÃ2ÉÔØkh¨—9½l$ -­Ïñm˜ä ´/±¯eÿéò3¦©£ÈÏ“pŠËVb–225Ë at¤¿”¥ )¹Rå!ꊄPR ôa* Äö½èýPȘ;R‰íݤ«ä6\Ý5O>ßõC»ëϹ_Oj6£ÛeK´nEÂh‡)?ïÛÁp“ì¿cÅeïQöúÎ ô£DÃyŽDOxO!ú–û|jCë?÷›u “ýœÊå÷ -l½¨—:Eâ>‘®@!U•³I:áuCÏ#äðpVï|Hán"à -t¦ Ü,Ò=\w@û…î -î@sI)°kG°gGÎɹí0?a‘ -F7cèÆ©ñö¹»PŸ€îâWÜ9ïÐ1O´wÇÝ ¿cjS §•l†'ÀÝ(2Ÿðƒ ¼~LW~wsïâ¾JÝ=aûàžÀšŽ|1Ê ƒ -Bëq×äQ›¦$¼£8׫ïçðMäGá˜Ý„‘T"yp³Ùƒ¼çvÛ”ÄËs~¥62Þî ù¨Ô†M¡c=fïtøÔ¡ûŸdN¦èC¶øé€@ѧº—êŽÇûÀEî¦nIñ$oBˆ=¡`^µäÆTâ§Â…lßÏlZme¹B^)“^cÉ¡¬gd±‹ã‰ ÈeÛ<—P¨3ðªê@ª»`Å°Ç)GøóÔç_ÛõŠ­¢¥äa`韲'~”Z(Ëq+Šf÷qŸnœb ±·ßÜ1²ß×Kò¹B`\J!äÅï: TR›¡Öl¢¯´¸ðŽJùP wÌ-»`щS4+ápGáVÀóŒóâS‹&ι…®½t¡G¢Æ¯¨ìk™= $õ5/ ”óéÿ“Aãvüî»UÑ,èÄìÂ${:èLˆ:–èAçÉ %èœì7t¦û9g¦-˜‚h?m´ŒWpRÏGœ " Øs°w°¯’æ£Ö1µå%ðÚàaÎÄsH3kQÂzáOíú†pð§r‚®ì”‰Oß´\á±Ñ$§ô@'šü˜NÔÈMrné(5A¤$þfÌIH—RÂHm°–Iz -]ñÎÉ$aÀÑs²:K[–3÷–ÔÜV1T–…ËÀKqó-ØÜ;ÄÓãºDC5Ý!—€°üm(›¾¢øI 4üdÓ‡†Åç°YU”ÿqyPÙ0‰ÝÔSYþpïv˜9a“Þ•Á:´r#’”: ¼´cxëdïëÎf!öL?-'ØêÊ-ÁlS=—³Óù•!îýýAª*\ñÍ)‘xuŒÔ_gVméÌ]i+uBQ¬ J«§Ð„èq'd‰¾á„žÜPœÐÉ~sNhºŸ3ÖASY„V”ÛÚÁµÕ>WvCŠ#¬! ~°9$ÝÐŒ¦”IT†»mC1&’#‰$˜Ø&Sª©Ê ˜¸,¶˜§ã 8Ì £ÎKF'ÐqSW¥œp£Ö±ý ¡ã‚>} ’¨„Coo.ÔßûJa*’:y^$qÙh]šÞV"B[vÄ Ó¢§A™u-šžYãqÔÔd[VËBp›Žq+è:gy+_2$1üÖ•ŽÖ`{^®«]IA-ô¥ ¡ç?ò], -ðSNøä7¾ ©™‚Ñ?NÜ:Ñ9d¸!±æëâ§%ü¼Ç÷nO^4Á*/è@=¡õ9¤$¸Ïûªøõ ¢ƒâO‹yšε>b$–û ÍŒ‘XîÓØC.°ÝOÅ áÂmϨ¨wß*ÖB~ˆ4Û¦ÖÔ·sÙSÏ]ƒ]Ñ9ù²(…ÜPJ¢Õ”ÆåR4Wà 1ºí©àz¦‰Õ?r§K8 §ò1» -½œW -\Íh˜AKÃÂ@‘FE˜««¿J5Vî¥ÂZ™Á}OAAŸ@OF\IÙeš‰r‘&÷ì -†N í[ªÝÞÏÔeT7áêdå°¡/•»]q192€ÅA"Ô$5X}”SŽròm-ƒ•Ó©×¸Á”bûâ‹°=½|À¨i$ˆ´âŠ 66-uDjxÃSO¤N«¦X¯iª’þº6rc=÷~© 7ãˆXŸ!(yv59¡?sÁ/^§ &ì=“ØÞˆÖ Ý=5’IF™:ÜF9öûÍXf·©&9_ñ³<&’*bIÉ -e—å[~Žî5HFLkÙ$&8Ç=âÙ›f?§Ò#ªÒ— c¤¸ -qÿx™]1â x†¿1´ (ô.oyŠØ¿cÓëž v ÆâwöA¶„UºO3kšN˜#Ëi9w¦Ð±tðH²sn‚Už½.G ¤XlKO¦Õ`ñ  «åÈáü[w@ð~àV ‰V#¼+Ó„±,t'aäsäs }‡†WûiMÝ•¦- ?® ;Sy=ú¶?§Ö?OÁf8">ÐóÉ·'Øm(ÇÔsàfs„~L”¸øD^&>ü­X@Ôƒ\ï –âû‡¹xIè»Òìw3n¥ ž*,ƒGÚO4~ýìëãÚ¸0¤˜±·2üìÚY|þ¶|àñë7/¹A“Û®øŽ_? _w%7±ê7¥à·g}¹éÊáÙÇ™Õß•ãìæ»ÓqÆ3%òà ücé°y/¥©ÈoîwõÒ¡NlµgŽŠ›ñGS¯ÅY©½, Aƪ—e{û«=ôþÜ­NÏpx§ð¬åRßO.U$vÛåæ_—×*PéÌU\ˆ’ÂÏá -] ð©+…=-> ¸l<8¶ëvcê;ú„¯\èBñçSÿŸK¼ÁÈ€P.:„)sÕ»ÈÏB[Þ¬7FO6S‹ýÈ}h?D¨'‘ÓÀ(œ©£#hù‘”µp’KŒ M_ /°£‡ºû’ öV㡃ô/g¡ ìk g¬FRüYR2Å"×Tm@eÕAö ì©!ž³!Œ• sîç¼ –˜‚ —žÁA&×3-•aÌydP¨8N«ÚÁä÷88¿¥ _¨Æ¿·kJ ŸÉ¾%§iL,È éJ†·6¡ù¼·N?AÖ> +stream +xÚ¥ÙrÛFò]_ÁåKÀ*08“'‰W©ÄÑÚr­·²y€@œ´ÌÝŸß¾fR’Ú”ËÂ====}ý…ÿüE¹žÊIê»*MÅáÊ[ì`æí•/kYO`^Ý^}ý}/|Ïͼlq»ñDn©Åíæçõß_ÞÜ~÷~µVJ9~æ®ÖI’:¯?Þ¬|çÞ¼¿~w{ýî-öBô78ýóûUªœ[º~7N¿üéÕKî)×[ýzûÃÕw·–RKP•!™¿_ýò«·ØÀ‘~¸ò\•¥‹h{®Ó‡+ ÓB%ýêêÃÕ?,*ž ¼jŽ+‘JÝ(UÙâG3l‰<7òBbË°‡s”«u¤NÛqÛw6¦QÐ߾ǿ N÷ Úlñ¸Àõt‚>‹]"Iˆø“ ð‘ïìðŒŽ v½Ì¾Œ‘çlJÚDïjØEãŸo5@s/~|wý [‰³…Ñæˆ`›|ÐM=’–Ó CµÐìš¡Y­a¢h*¡Åƒ¼ÅSå-²AHA^ñÄǾìöÅÚ7T4ð2¢úº^!me‡¸rf`W>lH<Ãñc/Ü„qÏA2è›ßãÚ’¡l–XÌ0s£ÂÇœ(¼C2+= ü‰A·¬Y¶t:k)cÍqÀÑã°äÝàp‚ªy#‘“ Õ}s ŠY‘ Í›ò@t|øža—_Lœp HÀÿ1^åÅJÎý®o¶™ñ•<%ð[º¥,9Ó+Tm‚,Éhv$od2F;qEE§Üó @™Å/J5®]²@Œfi´#M½dØ;„8qû%JA3r†®­»èÖÁ™ÅÅ ô ;ö‚Ԥt~Xïg¤dŸO}¤JâK#«’ÈiñFî*ÝïéF`„î €­æ@{‹PUÞ#J|çš‚a–Qþ£`¡©XÂJËVÚ,ƒJeâÁ}Ù†rã³õTv“ØÒg=CwiO†3»Î&à·óyEÎoÌG#±QH^‘b¾Á]}”:ý>oGÆ™QØa°´×f¢"cÁ–††¾Z<[7J‰'izcG]-©¬ã¢Q #…[‘}gÁ('C|F¶Òno•ýA#òa?â…ƒ{Š‹Gx¼noÅjzÌ®NÅ™3F5š§b3H x^")%l´Ñö½§ŒChIÌ3ÁŽõ{Þ.+´²s=0o¨ûŠ#‰œBD$"j¢… iDIjîö“«+ô¨0İDz‘ÓÕŸXœØú? +ø`…l”¥|Ð{ÚŠg r|¨¸FÐònLà»l ý=y ÷„dneƒ˜Š!΋P1±¡sþˆ‰3[N# ’„Sbð1q0ð%ç¢!\!n›ÕrŠ~à{é„„ÌðÁ˜6 +ZYAgêqc8eAÇP¹"ä™#·SDhŒkÁü¦!Ïl¯51½Ðmöøl£jC 9S„¹ËM&2cE(¨IG€@½hêÂúßÇèvBˆºÜÞ‰ ha½>€g¡™%42±l‘°/6Ò ¶§Ž›ÔÍ@ö²’~ùeB‡6¤æݸbÔœ!ùjÀšu=ªe ±óó–g KŒßžÓ‰]8²!v(D— ŠGrŠ»J+vŸ–V²bÂ]-XYÙaÀ2óË€æ¯ç!x9Ènõ†g$>Š*ò³Æ CgøjŽö&[=/Óöà Éåf–MVT’ð<¬ÀRLÈñŽÅ˜—ãøÞå°¢ÑI”cí;%0@ª˜¨Ñ½>«åè7ÊÁ¤ÔAØåüé_†Ûý‡Ðw(A輿”Ü ˆPiò=±—Ç¢Çõ—²zìoHî­#„Z ]{1Á¸šœãÈѵè +œñ­±åŒQa„#òœ?Ÿuù€œ.%ø% ¡!Æ…HwÏD­Obm»©ÕuŸ¨x…IäÆ©z¶z7¡2U³¾›!Km™*Œ¾áE³Ï…tXßMÒàI<´Ê<Ü2àçxläCf‘ €âp­ežú@y Pß5ÌTäÑÅ9ÚÏ7MCĸø}á»^˜eŠA&m¢~< |}}ðo s1¡TЮ'x9T›:?ÈÜ8‰ +Lê-ùA!ÖÖ(¼9î‚H9¡ù~GžDZ¼Q¬±æ¦¢Ñ3p.1ÚD÷llVµ“ä&Yõ_þ€ï¡„š¶®<>ß̺æÉêDW>6‡á¡xr‚RØÕôZ››7kÉN26|v…¼‡@Úä#ù¿èlûËiÖ;S Á=„Ö‘ÃØ)wN€9U\2ZÒ0kþ‘„[ò?§].k[0Šî2o d9qð¼v¶=ñ,y0lM=tM%£•4š–ëÑ<ʈZs~]S¥‰OßÖh~À°-–g’c[•_@ +æb£~È[®²î°\pv¬‹=›×…ãÇQŠeÿ®Ü2v<¨M¤_Ä=zòÀ$ç’Çs«ó¦Aä© {Es¬68ûÕ {)uôs±>8(¤Ôç’PêÉÃaÌñ‚"¾ÔŸ–© +¶:Ó¿Ù·_8oc´ ¹‚·¬ÍÓ9®Ÿ³²´^Ní—DiWjämÀäÎï• U”q2C)ŵ8Bhy$zM¿ù@j÷‘uãéúa¼˜Ò¿`–Ñöû¯íïAþ_qfã½,y6Éõ! ŸØôwóìzõùìñãç ßJùÑÖ!MЋeWô&öU„@¤l³­ì<Ê¥"ëqR¾Åm¤j +jÒ›—Y¬Œ6F¨±w?½L*U_ôM!xºóó•è9ñ¹¥p8ä7HnÈë6™iõLöã{ž¨Tr”JsBHk ç.&6’Æ~¤ä¨æ¢ÛLº£b7±ÓüÓ›_ Û+G!E< Ÿ¶òî$¯ßøÓ¨0FϨ0ÂÂ%Ó]Î$3&1 ¤%P‰gÅ1Tß[`éÑdW*L%sÂ9k0òµ?)À+Í<çƒ>{³‹¸14? +©¼¥"š.&? âÝ×T-Bˆ+¸ÆE¾ãúçbwz™ +ÆçâPK¦4>÷ÈÝ‹Û|"yG×2û•7ôøN`×þ M¬ž”E4“I:†÷[—¶XKuóðicN7˜WrÕi±ãì#ŽW\‹Ô¹¬ï”<ñsû~‡¦>i çµIþe4°¬÷âì-~Û˜ß Œi tÆÊ=MËZʨz0q¼±\Rn…ð©€\VfsÕAøÏûK¿ìkŒÊMU6o}£ pßЂŒ TpI¯ùà#‚ÿÓZFendstream endobj -5400 0 obj << +5503 0 obj << /Type /Page -/Contents 5401 0 R -/Resources 5399 0 R +/Contents 5504 0 R +/Resources 5502 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5398 0 R +/Parent 5483 0 R >> endobj -5402 0 obj << -/D [5400 0 R /XYZ 85.039 781.388 null] +5505 0 obj << +/D [5503 0 R /XYZ 85.039 781.388 null] >> endobj -1594 0 obj << -/D [5400 0 R /XYZ 85.039 407.331 null] +1434 0 obj << +/D [5503 0 R /XYZ 85.039 475.683 null] >> endobj -5403 0 obj << -/D [5400 0 R /XYZ 85.039 386.076 null] +5506 0 obj << +/D [5503 0 R /XYZ 85.039 440.937 null] >> endobj -5399 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R /F35 2880 0 R /F20 2865 0 R /F56 2890 0 R >> +5502 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F62 4047 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5406 0 obj << -/Length 1921 +5510 0 obj << +/Length 1248 /Filter /FlateDecode >> stream -xÚÅXmoã6þž_¡¦WDjZ$E½x‘yÛÖ‹Ävc§{‡tÈ–’‘%¯$'Í¿ï G–eÇÎfs킘äpøpžáÌ67,øㆧ˜%}Ãõ8“žgLg{–q3¿ìñJ£]©´:Çã½ÎGÇ6¸Å|Ë7Æ·+Ål%qxmžüz4Ÿ]¶ÚRJ“û¬Õv]Ï<¹¶¸9"éð²×÷ú¿àÈ!7¯†8=¸lyÒ“R¯¿š>º8>¢‘dVëËøÓÞÙ¸¶´¶¬òÑ̯{×_,#JŸö,&}Ïx‚¾Å8LÏöÀN¦lY“½ÑÞo5ÍÙ­Úæ•¥F˜ùB½î9‡3Û‘µçÌræ+…žã\0É…á*‹)ËÖ®Lp-ðÅ϶R–y¹H·ã˜û­67§‹y„a1•É>N¸æNÄ (±sOÚQŽ£ Œ,3+"R,´Îš.´=Æ]ÿuR+MŠ«F8Ô¤„O" 5ÌÁ¸lL Iž[mÛöÌç–ðÌlAƒ')~–$)3jÑpnF•Ú}PFCß¼ËâFw4™¥gžg^%å}Õi?R;И`¦uJžãŒ[oy§…•5³,Ðcàˆ6Çã'bhq”ƒ“… N®ö•ŽBf€1ןxÒ3Ç÷­Æt9‡ž†tl“ô¾I†˜O¤F~)h…q…´à6Ë×V–5æ´Ð ‘ë$N ‰K{î‚1–k(JH}™Á16³Z*Å„t‘fZ)4ϳݮæ÷ '(ÉÐ’ˆ¢»`l1W'ËÊkQŠ,|af·ÔÔ$qŠîñ¥æm§šF‘Fy¯÷€^¯RL)`¿œœƒpiÕæ%ýaq{Éú&ÂœäQð@Ýy² ÄÔpÙ,jìF›Agé–8¸ò¨»™QËLpÐÎÊ’T>S¾³µ,Á~žÃîî„Ñ‹,€¡žÖv6PÚK›ÚʵW¢ÎaW¬&—9>XnCË=Mñs ¤àÒT›ôî%ÛjÅ™çs6¾ŸÛXiñ¯Ñ×$VÜ´ Ó› ã4s5‹ ·Ý¦ªã5«Žr˜o»†#SÂÑÿ§åÙºÂH ™' õꊂ]¤ttÊ@þcM*ij,C«€4„ôÆ@µæo+A…Så6@t}™4ƒ(:ˆ§Ù"¥Jó–ðÍ+ªq@¾¼º[ö„‡IŠ…€˜d³Y†]¡iGi…ÕéÔà9ý\Úÿªö—ÔÐÚŸŠhšGpË“pJíÁì!Œ+NŸ¥ø·ç|˜ë—Œr•‰`Ú<ßeÒk6vƒ¼S̳,é ¯;ålÞ‘‘ïMnE/̉jbvšNfóyH›(·¹IåEð‹àïƒ<"ø0áÝUèA˜?æ,ĬiìÐœ tGZÖ ô¥õ¯À/â­à$&hÏ~4»Oæ/€Qx@wú?C/c kZ~`­ÑÃù!¤‡;PqæX$œLƒ¢lÈ…ª"ÅáÀLJþôÖß0þ4›qzx ß(FmýMâ -Œ¯¯ÒøÏj8Šr ux=¢rŒ"Ásƒ//²?¾ÆW£›Áñ§³“ñMÿèâìædp~ÞõU΂‡:âóˆ*,ö!8£i™åÏ4DŸ“ë¶GSÖ ·qRA¼1Rƒbs‹Q[)XÊRxÌ£ñäS€Œ¯–kÛ ¦â·¶¦¸2¿w•i[at$lY½‹Þ›3e ×Jh£/a{¹Éœ`}=%,¸*¾EO½—]3Qwpkª y·\&6™IþÝÌ|®ÌîàV…b±•Ú&m¾An Çï¥å-÷5ZÂe–ï}ë–ÊçÓæ-µq¾íb‚ÂG¡ñþç8 ³§Êý1µzÎþk—ÅÖ~3‘»Í˜ïn¦xw5Ý¥Ÿ»ý«óóîæ6WöÑg­¶¿»’OgU9¬NöíõüûHlT¥mv­Ñ¬‰ìä1ÔëÊêÓƒµ—½Vút»H’ç¥NQI…léDQÿßwO¯o[t±ƒéÖßòìAÈõûc8<ý@“»ß>ßxB~ôÇ#vññ¢¹MCL,\ï=؃ã³áÈf§—¿¯ƒ¯äÕ»Êßûj«A~=nù+àß0ýôìãðr|)ÐÅMô¦üý轓Aÿ¼wÌNÏÏw¦í×Ь޷¯TùáèbÐ×  ‹kᇃ-þž‚êx V þö§ zmÇï­ÒŸٶüÚ -ÿdÑõkvý›­-™'wüd«ø‚/mAÉ7íUÒcÊ“/ þ 1G6øendstream +xÚÝVÝoÛ6÷_¡G ˜~‹Ú[Ú5© ,óbÐöAµ•X¨-%²R£Ø?¿;’úˆ¬x +ìa0`RäñîÇ»ß~,0ŠP‘‰aD¬÷3<ÀÎõŒy‰Ø‹Ä™7«ÙÅ•Ò£$¥i°ºïõ("•V›áÛ÷—‹Õ»Û(B„,%Qœ$&|{·ˆX¸t«‹ÛùÍj~s_Yx·Àíßn##•šßôÛ—¿¾¹t_‚ÐèóêÃìݪCÚaT)Â|š}üLƒ \éÃŒ‘šàsJlïg€“()ü÷n¶œýÞ©r{2p§¦¼ÒJÄœ’„óSsIšxsbdNœ˜£A̳˜²Ä5Ì€€äDj>‹¢ï3ŠOQÔ®·£E˜$)J¸]áZÂGÚî^Ì÷L¿T,è±ÅŒibL4L8LZh’Â?Ä_PiÉ¡RN4¨D|¢ŠfðÇÆâ”wRn­§ntâîöHÜŸqø€„#½ˆáªxx®s Œ±äå⊩Á)Í åè”ÿùkB‰¡ÉÖ›c{ae¤m-j`tQFÜ„MÓòÁ¾©Å3Ÿ$(PšC³p]£äcã·òz ]r±—gÜÜ]A äRÈ2B“ÉkG9P—ýXb!Ó\-5Š+¢t_j8ì””P5uL•’€+¥hx½Ey_¡ÛÐ_Z‡â„Í6w“eußD‚†GüË"ÁÂ¥s'};_¸É}…ûµ;SVe¼@Q0±6°ŽuËž¶¡lrœÖ‡Wj”bœp#Ï;¡—9¥“’Pë0nè„÷9+7·‘½ Éñ•_‘¤åý 5Y¢ †òÒ_‹5rî«· d!¸^2Š"tuúamm#GÑK\ÉZ‹[·A‰lSØ$¨ÊlçDmù(7îã ¶ž‹ÆŸ€˜ò$¬Ã1‚Y^ßãþÎ+ß&Írx%àçP˜‘çHQGŸ?«1¹ Æ–†Ï°d¯”oÜBUºñîfþÎf,Üe â¨ê½F2rÎ'Q8%8ÍÜà F‚ÈGw)fuþ“£–uc†²/»ÜE¼•›núi6f‘(ÂLº]5]¦HÊR/RÝ;4Ÿ(“»È§ƒ,À8í-ïN(„A…ºs]Y~ÿ¼¿õGQ•í.&´*á%µ¥NB\Ý¡ú»[ü‚'«lãö.èV庩ŸÜA¼(¿Íjt…eDV;฿ɿk{îà2?;ŒxÍÝËÍq,ÜêÀ'ø ØgÍXwPçåêÕ<,íé¶F´([V¨·zøî,óáá7–Àwœ@áÇ#.¢‚Ì«¶R¥#KkÅËú¬° °ã2ᣵæß$T‚o§Ý@‰+€}z!/½é­uû&ºÃÓ¢w#&ÆtU”(Ïôÿ¥—’gz)®SBõù^ŠKÕ¹ïÕ^ŠAû"px ûG½T{$îÏœöR#½½”ø÷½”€r¡ÅÖ¾—ò"cl/{©—zþ.Ý Q¤´T®ðÂÄ œ”öé‰ýÃòªû6t ×Éë.¡ÓbÒœ Fßq%Jgúßt\ڪĴ Ÿ£?d£ëY¤ F¤ÓQSðörxd%Ü‘š 1ö †(#¼Ðð_•¤Aendstream endobj -5405 0 obj << +5509 0 obj << /Type /Page -/Contents 5406 0 R -/Resources 5404 0 R +/Contents 5510 0 R +/Resources 5508 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5398 0 R ->> endobj -5407 0 obj << -/D [5405 0 R /XYZ 85.039 781.388 null] ->> endobj -1598 0 obj << -/D [5405 0 R /XYZ 85.039 761.463 null] ->> endobj -5408 0 obj << -/D [5405 0 R /XYZ 85.039 741.134 null] ->> endobj -5404 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R >> -/XObject << /Im2 4150 0 R >> -/ProcSet [ /PDF /Text ] +/Parent 5483 0 R >> endobj -5411 0 obj << -/Length 2520 +5501 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 265 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5519 0 R] +/Length 10989 /Filter /FlateDecode >> stream -xÚµkoÛ8ò{~…/ØCd ¦%Rχ´IwS$Ž/q® t‹ƒ"ÉPYòJr³ù÷7J–r¶{-ŠTäp8ï™XþYߦ -žo åûƒhqd>ÃÊÏG–Æi”QçÍìhüε–)3Ìæk:Ž°5˜Å·¿œOg—wÑRÊ°1yžo¼}˜-ãž¡Ó»«Éìjò3ÎlZÆ×o2fŒt5Y/Ÿß¼9ç™æðÓìýÑ嬕´•¤ -PÌß>~21¨ôþÈ*ðÏ06…Ë‹#S8¶Òóìèþèß-)^³¼kŸUå ÇW»fQNÇ,–TÂs½ç˜Â1m²ËrU×iþy8r¤cÌÓ,áÑøkXŽ«eQdãhµ¬Æõb9VIà?Îe fxt-¬øû›¥ìWÛ§ù¼¨“è¿Ò21^èuÓ1¥’¾ðyþåq\̎ͤíh¿g“ÃF*€¸5üš”ág-Ú^:¸y´gwŸz« -Ô{ -Ë„Õ‹ËXTãó‹w·“Ù½¸ywÓ§à - -(ׇØÒMºzçŽnÎ~Õ\Û „û£T»}s9½·ÅÅÝúuÛÆ!åÇrÇqŽç|›ã|Û´…úÁÚýr=}U»Eô•m ç;h¹ùºïœ¿¢ÜÅå»éÝìN®óiW¹]Ê9+pDð”“ÎsÝÕÛÛÉõÕqq}ݧÜ -9Nª`W·þœ; ›úQI7½¿¹Òl …s¥”»éf{ßXK|Ë÷wâzC-é ÎÜ}·ÊóV­¨X,Â<>ãY¹Œ¢,Mòš§Y…ÙSQééh¢¿'eQÔ¯’¨Lê Œø{Æ1[„çÇÒ<.žµ1laÃ)juÏÀÊ•–?îž,gÝJu¶}æœM®¯Ïºéκt˜´[/œÝØ }ºMû´Kö´Ýxºy› :‡Æi7SO;‘}|Âîéêξ1›êŸ:Œ^7'Á¿ÕbÛFÚã… £þe³mû=Þ8ýSfÛµZC§Lóº1ÒEÇ`]áR­¢(©ªù*Ë^œª³,‰E#!¥KðƒÒÅ‚^µc Ê­«ì uÚlª’:>¨M¢ƒjÁí°ú&º{üv¿cD ØG«.øÛÇ‘Ì>~guû×´­¶;ÙP¯•G<¯æX:lãe(}£XQ£C6zFñ…§QV@nXFbù¶qŠÐ Ýa'YÆDâ´Š±À¥¯øJ†$ÖÈPm„К!K€„ħz"wD‰yí·ã¢²\£F*a^Í“2ÑëH8Oò¨|A*u‚Tbí8Ö¾kçŽxˆÉ@õS‚e<§e‚:š kCàG²IB²…(mþœ, -n2Ù°ÁÖ[SÌygk[œdkÅ¿0dUY?5$µ·i›äb8r¥eÌž’DV—-ÊŠh… d›]´®šLMtð Jo#šdT¶ E 3‰XFuQ¦Mšb5²ƒÚPÆ s]±¬ä¯¾Ëã0kËEˆ‰ûÂ`üA‰Lê%z+©nÛ\ðq‰û JÔ?}b ‚ÒßYQ)xγ"Œ÷d8µ×üƒÍî¼,< ù fIz~M m!„ÅÄy£Vâ4Ÿïa¨6vÇàäž!b[Í^4m$úD“®f­55C¨z‰èy -’®/|çà«Ö…¢N¢©âP®ZR(K¤ãÁñG&±Q 2X(¼ÄCý£†~„úåB<Á…:Æ -e~ìÍq„2_‘m³§4Â)è’·­Ј!>”O@‡Ë%çEžÄÿÂ(dÆô `c€àM¬SÜÅÕ¯GVè3´9›Áo¦eÃŽÆñâ …D QÌ™‡)(~øh‹È§£=A¯8›¶+w£¾éBEØÿF×àŒ:H{ )áB“Ó ‘›w" -úDa©Ãìånp…v àºÜ aÅ~Hzë2"»/¥°PµGôfjI×øš†Œs…øS·•Æm-ù}Õ&O½Ëo»>À²vjFĆªC›*r$ŒéÑöb½'ÓplT £ØujË8ºý‚©4–T0¹tµJÿ£Ïý–ôexëý5N¿ó5Ê&û|ˆ—výAVÚóVd*«ã kmöæÔ¦¶Å‚³¸(C²vý¸H"µ>±:m#Ÿb£Ì.~3½¸ºã9½bT¼%nÂC ÓÃôén°ñ¶­LOX>èO! %/Q‘Ï÷Ü" |JhÞÌæÙÄêw§ë -õŠ7”Î$d¦z}ÙϨqå>'[> xžD5:Çä„ÄA[=±ÇÀ+*5¯Õ…þj¿ãø>Ô,£¡À “ò„‹³ô,8á)[bÀ'@zC@êMÈ}!p¸!i1øµ¡í€dºà{ãåœüÁ—¥UìöÇÌ©ÞÛv.å1»˜™.ˆ£Ð×6(Ö®M_Gqã5)j|¸±]~#¢†Üöý«P¤)Ѥ\éYqÛ覞¿iŸHá‘1(ôÓ,¥ëè oF¤”˜2Ò’®8!Û#“Áè üÑåúj¥s¾âb‘'½OWe²(Ȭ>m~˜CWû&_|}ð€¼!Oùõ”çá˜?|†Óරløl쯘3ô²ØÈz­áÍÉ·ËjÙ¹fSÒ;&nLç=÷&e -ìKøa­ÿ¯_ü·w/[ _ûÎÁ_Y,Ô3*¹-oó;ÿ0Å endstream -endobj -5410 0 obj << -/Type /Page -/Contents 5411 0 R -/Resources 5409 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5398 0 R ->> endobj -5412 0 obj << -/D [5410 0 R /XYZ 85.039 781.388 null] ->> endobj -1602 0 obj << -/D [5410 0 R /XYZ 85.039 268.85 null] ->> endobj -5413 0 obj << -/D [5410 0 R /XYZ 85.039 248.26 null] ->> endobj -5414 0 obj << -/D [5410 0 R /XYZ 85.039 220.497 null] ->> endobj -5415 0 obj << -/D [5410 0 R /XYZ 85.039 191.278 null] ->> endobj -5416 0 obj << -/D [5410 0 R /XYZ 85.039 177.122 null] ->> endobj -5417 0 obj << -/D [5410 0 R /XYZ 85.039 137.081 null] +xÚí CÛ< †Ø9œÃvî[ýÿÿò“œ´” >ë +‰ ÒÄM[W¯ËgݱÝÛòÞþß&Τû[ØÛýM¼¡…’³èþfs¨#¶»Zöm-ôœOw6ƒZhOlw5V¿©…šóéÎFZˆ8îkó{¸ÀZ¸³É•µð)ZP¬…/§æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0X Ìæk¹À\`-0˜ ¬æsá«i!H2´©-þÇgüï¡Ǫyézœ4/>ƒ®ì7¿º>'sáê=ùËÁÿ&v¿=ï·4N>¥a.ü‘…çµEëWrNfý®÷Tã _AÕ³ÇC¾Uv¾y>Ÿ/¶0>Oœýh.Lö(FûZ_J’Ìšx?Ò«}å&8Ö¶a.ü‰~uݬ´¿8ôÅ +ï¼ tCGæ¥õGƒ0xîbp.¾&ÈñæSb ;k¨ Ÿ‰yø£¹PÁ‘w9/§lù”øì$XȼR†OŸ¨<+‡¹ð^-´G–ïî*ôÙk…ö.“œµ¾UØÝu¥öÚ–òäô^%Âÿn‚3—Åc§ãC) %>S[À÷;táþzúx]üýŽÚÂÃp!9K M $OZ0»á;] _|µä/Í…ÃŒ‘T½X'_—É,æ÷dÀ®µ°íYí¿1äƒ Ñ»Ã:0+Þbœ2 ¶v§Øœ9}Ö©ÆoºcÛxÍNj‚l)N[Öàëmøº¦B)ÅkTÙ\ßG ë—Ó‚lËzJ÷©,'Ìóf„0Z-Ør¿Ô6ÛÕÕQ· +Ê2ðZâªÌH2M«Oq$—¬ŒöÒ¥©Ê*þZP_\ Ú¢Z °¶TSµÞ–e…OЃ&[÷ô^»2ŸŒE+'*¹:|ZBO(B aó‹räB˜8À¯³ÃØ®^ñHÖ` k1¶.;è%~ˤ=w-| . WZP~o“žã3‹%ý=ŠúÒ6îEË@\Pá%†[r: +j¡÷÷X(0eb)^Ó{ -`.ü¤”®±*¤ÐW1‡WÌû(Ú]W‰ïÞ˜¢‚;Ì|©Ò€Te 12赤Ùy¯©zd¬¼Ô‘Fº¹ªhÍýÖEÉ€´`I=›¥ÄÝèøÀ¿• µ™S÷ùè_ƒ eëm¥,(¡\Dks*•Fkæ]]ˆsÉu6¥k¸FP ‡Ù_o×µÉ0íZ(Q*q¼R~7"î¬þt-|].Øu]±ìÀbþ(ƱhñÁÒf9ât¬,QÉ£©T¢Z”+'Ga©¿—5§T ú·â¢º9=1¢’/ò7¯1ÕÇÅ;Ï°ú ½a¿ôƒ¸p±à$ì¸çZ‹yL,HÆô:^(-¦|L°až»n•>û<z¶¯xD¡¶ €;Äo§ôüåÚQòµ6æiÍtåLN«Kb .±³w8ÃêOINÝ\ZŒÔñeÈÕ·vH¼þ\ dë8œÎOÛµÐï͹ñ®…c…²ª°ê…Z¸_»Ò×àÂXy3¨…`ÏXÊñLÌ{VO±³\,–9¡u•?ò$â! +1ÁñÍ¥âÜŽdê3&ïýIÚ~ÐÌÊ\xU “C;Ž½÷c ,N툰è^ Ë°¿ÿ¹·ó©ƒâR°ŠC §] ÎÖtö©iÄ{KyÔˆ‹‹ÂýÄ¡…ëš×§æžZøjñ´ïêç‹Š†jƈž´Pbv/x&&-l#òܬøðR<íHr½h¡õþ—cx/˜àNÑØwnGòïÁ7!mXOñ­žXv-Tç/$Ư¬ß¿¿¶Õg-d{æ£0Ý3.\}¨k-\qa<NϦØyüa\¸jGŠÀ7!{v4Õ +^ W\ r?Ë0ßH b…~*\„,Þ.j¶>ÚTw-4WZQs1‹OîþíHç@Áûv}»ýME˜ë55âÙåø:¶Cõ}Í…u¿CCZpoiá9”õ÷)Ly_-|µþ…f0PœaJ¬A¦ëþAqs·ž¼Úýëª0y¹w7„«8´`~ã‚4{ÓŸ®…ïÀ×Aéd`mƒùX¹“ èv|–˜ÌKÚÔ䪳Å8[ø]i!ǧžÓ#PVhÝ»¹Ð›Xà‡¯¤œ;ÔØÏ‹®´ Mç¼+PþG>ÿÊSWýÎŽB`ò{ÒBäój1@UËUø>ùŒ ×ZÀÃÁƒ½þt-|ÝñHÓÓƒbk€†ºÄÔÌïs]"©›“÷Æj·>Xé´:i}7ñý ôðÕÖÎEYvíÙ{˜Aã‘æ] Ôé@£ ê“ÁÀ;ÞW æ Áðý tS;’ó7`§¶¤Æ½ì8þÞ¹0þ¦mmÙ&æ_ >¯Í|C-ð¼6æsáËpáGjáѹPlÌ6æÂ75æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0ؘ Ì6æs¹À\`c.0X Ìæk¹À\`-0˜ ¬æsµÀ\`.ü`-Ñ'ØT0‹ Yÿåm|s¹Ú« úîh sᱸ—·7e~ÊÀÞ]¡ë;´À\øV\!ɾ¶™÷h!¼{–GÌ…Gã›_Ù\ÿ}µÀ\øf\(Ôö…-U9síN\ø€°´ö?úõ§¦é­´À\`û²\H·©¬è'i ýª /ÌæÂÃs!M×s‰ô+r)[Í\`.<<ÒÊ6j£,‡Õ×…R²ãš?P´âê1U™>Vkb.°}i.tH¡…Ó9ÄjK…N7%ð6ÇQº‰‡î'SM¢PJ«T1Ø { HV0èTeájò±Q›šÂuÍ3%¦Ö¾P:êÍF:ÕI„]¢˜ lÈ!ܼÚXéì8Xg1áQ½B"Q ]XˆL=dB„`À–‚¹Àöp\¨§,KJ½Ò ØFºÂ@ :h¤lìº9ª#é®ÈÁÚµ`‡yN™ lÇ…c¤P+—"BŽ¡²Tˆ Ùt`[!J¨høZB)UÊñÛãqaÌ,ê#‰ÏUÒ5QZ˜d`FjZ‘ö–eYõx%D¥pÿÛcÆ Nd`©áT9õ4˜„ʈ]«=¶ >H ìoxP.dõçZÆ\¸i;…ÊX=ŠÀLA¬BÔ¢Ҹ­¬ qAõ1Z3‹¿ÐÂCr¡ûäqðsá¦ZH] v#d'-ä²v›xËÌÇή‚Ñi-K8æÂsËígƒ¡g.ÜT ›š V–Jè÷ÔtÚA¹¨ÆÀ ¨›4¶Ðªmˆsá.¬Ÿé.íƒká¾ã‘öHX´°n±»ZÂ(K‡h…˜@2–âëû>;?$:#?Ñ]"æÂÍ´ÕÚ5©Ñ”}_sm".Ã. tŠu8JÄc××HUt<ƒ¹ÀZx$. œº:RBi¡”Â_ j_Ò‚():OµûàŒ!æká sá'nçñ©9§‡¹ÀZøÒ\¸ëOækáqç;3˜ Ìæs¹À\`.RÕÁ$¾ €mµ`¶W’LFü-0~rS¡RtUåV=W3vèh;fû_N~0~©n—@ùZîXæsác\ðZX±Ä³Nõ/:¥^楈ã]ºˆgL±ù³q¡õ§rá\꯫wA¡ôáŠR‹C ?–ò$s¹ðN-k0‰ˆðw¦6µTzº¡¨,Ø$[åÏÚ°ÑŸÇ…ìá×9¹ ¨-€©ßpØ`.`õ ³' ñ]3zq_¶Ö ÌæÂû´ƒ.!Çß­Ð5:TC¯SQB^ö`!iˆgñ°ÑŸÉ…ý ÃX¢ócu©†®ÁƧÄØ0A@XâÛMOÎ’ÅÌæÂ;µ`¡Ö2¨´¬¡v³Y'å± S«çàõ|–r‚\}ÚºyØiš¢©&·GG Œ@!ŸÐ,DT–hh½£L'g ©d.0ÞYG[(=€Á EßÙÚX¦K<ÂàjÈ0´= ÊÀ°ó–‹J~ +hÕ‹²† î$Å`­ÖÖÔÒ2{›êBáY"¥}³¿¹À\x• ¢¾Y4Ö¿R)! ³µ´ –ìb¸e;Rå—¡¤G„¤¿qMW‰ Ú^<„¹À\ø.¸Z©”Q ŒRQpMÕ¥É)æføL.¸Ý7¡ÁÂÚ‡ X9ßõf@ï±s¾w¸u%Æ oö½1˜ OýÎ;†ƒ ½ `ÜÒ¹¢æÕ­ƒ)niþ¿ŒÀ¶é<º¥Ÿ/¸£Mu•²ƒì„2 ­O€ºí$"#Ø°5*©1î§6Uæsá½…5jÁvÄ›“lH= k¿®¡Í„Ž{kMßÁ ubìjl?|^ÿÂfÏžWÚê4¬¶ï×1´Å©]íŠbŒ%¬EEdÖäƆ +¹`n¡æÂãsaÛæxI·¸À£¥ÀßéÏH‹¸šM…*f5Ç…ë¡Q©Xš((”ú¼~g).wÐZžäÜÆèé4 C.ð"*¦š“h‚Ƨât-0Ÿ 4ÜŽÆ=Ëó¿S¥µJStÿÌ&RÈØÚùršç/°“ o(#Ó(˜V(õßnmËóÚX _œ o˜Ž¨ÏÍÖê¯wyf.°¾5¶MÄS25âK/1X ßš 4kAˆ¿§sµðÕ¸ iКâþKf0X _Š :(˪¢¹óâþZ¸œ¡Ê\`.üµ\}lçb2ý-¹ ^èÌ\`.ü©’,£í +?8 á³¹  b.0n¤…}°é¡N…Ò#‡»½ÿ nˆš*L´ŸSþÜv}ΉÔ_ÄC}O.|Š˜ Éê@ÞDfÞ¢8«Xom=Ö¹»VÑ8&±NSgãlšºÛÊqÌbµ)5”c(<ÒMŽ“Ò›¦¦¬Û÷´3Ý K¤çºni˜vxW,’zŒ´OÔu$?Ã9.Çlc.0^ÓB¡•R.ƒNÍvµÖñ +}Ûù0ä6-UZZ†v´˜l>Ž˜LÌ¡íÇòB-¡5x® ´«ÀXߧ…›q!‚n¥wR¯#¾wqÚzÛ×£5¨Ú°îŒ%Åô€‡¶¾Å˜mæÂCr¡Ø–ei-$b¶0m®arΕxBåОdc!ŽÀÒE°n"”²…PJÂ$ñX>6›KPEœÞ7^hý¼¶ls’ GŽx¿˜èŠ ɽCJ*isRæsáE-ã§Ï÷r¡Ãˆa3=ÖüU+þ7›ÚÄT=º”s'üãrÓh!†X`i 3êfXeê •MðQwŽöÝ+3ZæT£|‡DûKJÃ/³`ªÙ¯qr°JæsáE-øƒúlQª°£ÛTìçò£0ìQ@Mýq‹…º,˪C7IP7Õ 5í{kÃvvJŒ$™ %QªwoëyS.PL>Œ®¼Ê¢MrÔ‚Û}Cš™­² ˜ Ì…µ/Å<§)£jG@ÈH ‹9ƒZìËFÚ£ÂV®¨i­‰ÕÐŒ–†é-¢_ió6QA‰®øÞížoÊ…Òk!9´ iÕV>´€\p;–‰ÖÕÚÒmŽ­´¸‰S-Šå@+ň9ËjÒÂÁ…÷k¡ÿWZÀ¾ æ +Eâð Œr +##ü<7¨#1³éœj×BªÖNëT Ð Œ­Di‡2‰QBÝ7[˜I!DhÓ©¤sB@A‚@~ .tþÆ-E¡ŸÞ`ªcâ%,O¯…?àBdY’Míÿ4æî‹Gu8&éK×›$~á Ì…Ûsá¹6‘À8«¹‡Vˆ¥"°K6Ú¶L!rlicr ÔRÂHzR• +Ü—àEú§ÔÐâI…íYºTB¯äÜÁ-´ð\èÏu³×4Þh dZ Ö…^ü†Ÿ·}Msáha¼æT±‚]Ñ{ôFŠ0!·Zdà-Z„JQ5PgÂkUús}¡°žôþØù\Hɵ÷…T3;—0Qh°v6Ĉ紇 ¡E÷v!~.<¾ó:!ÔQe5Ö9_{½Æ¿ïr(âÉÚù÷m\?t6a.Ü^ º-çsg@º”¾LWsÒwaä÷]Øʼ«Zl¨»¼Œ)ªnǾ[êwŽÆ¼OfÁu;v}‰ÉuP¿w‹«S-± +ò•†OCI‹_Ôy˜œ‚’‘ªjp6Û}ª¯ÛwÔ¹oÊ…‚ã£T¯½¾MaGÿ ~ÏXC›1n¯…M‹§~±ôH¤ÆÅÇ¡PJè=!ÆÊþ†‚Îùö%q>—úsÊχPÛ=¹ð–MÑž‹ÁŸÄŸ7æÂ.¿fÿ(Q]·ûúfmY·˜6¡låvTƒã¿Ì¸ª«†Ò4"ÉDÍ4Î$­jªm“ £…¹ps-¼¶dXútøÒQúkº«g|©ym#º:q[-˜?×Â@]Mo»ÕTfÓÑ +NksÊ0®É\M[F$==³¦3Hi×lœa½/‚p]sZò©Á:l70Ǚ×V û„~8Ò'rAJéŠZ#¥9ˆO-x9@/1¢i¤_>L8©]6™;ÉSQÛõvJ¼ð>èF`}*‘’¹ðPZ¸Ï|çaÊ‚?ÚÊóæ\0+(Èöh Åç®à+H)½Þ>ˆÖ÷aºëè×|e!­¿¶k!Ü¿ÕiñccgæÂ}íæ\ A.¦ËOö_ ~2XËù©‰îg!PÜ°ž‡L9ë³h×B¶gHÂíH÷ÓBúg‘¯ƒñ–"‡vûz¾£&¥©£í ›C Ò_Ü +iºã¹Âø®Â] Ñ~½d.ÜM —Q¦ŠVÈ 52ö©k4o-â×e3>ºœêâBðë±Ú_¡H •t^ •9º–;|dÖýU¤³ÆýÊ…Š¹p/-¨¢.ö©œMU’%Ù@››/YU¨%©JüI¢Xœ×ÑècÅ\xO;Yµß:€HúÆ^×ãE/$çÛu]‡Ö¿Hìês¼à¸á.ZHŸîõÁÙÂ%U³…æj¼j²ßO‡"e.¼S ©±ú¶ÆÎÒ@&ellA¯·HÑÛ:XÔÒ—ÙØZŸÔ³¼æ5.Ôm.MXæÂ?ׂHΊh®Î€´=Mq;k! +‚ ÌyÙ @©™ ÿ£…þJ §ØìƒZðÈ‚5€N~°l)NbÝK™zÿØ4 +#ƒ}¯• +ëGkWÈ•—LÌ…­UØü(çQ ¹Ðhn†PÐÌF£ +:''(ÝÑWB¬˜ ¯k¡õ#AΦJ¶BGKöµ¢±Æ3zû~<úТ0i¶v–Ñ݆ªÁwU a_ù›Ïõ80þµ Ù +öy ‹í/\°Þñõå9Y{9d.œþÝü…è]‹¢1Þ§­ÞSVÃylj¡§&#ç2ôö XGŠiêÌ ’˜mØÆ멲>‰ éÒo® ¬bk–ô¢“kêê/Äé²Ì­¹LSHÓÅ\`-|.¤Ûj²Eüÿv:´k§zÒÂa]¦¶K¼` ÆpùY2©ß7e!Õ»¥å‚<Öû™\X¢øCZh÷ éË”¹p¥…ÀÔÁÿªAL0žýµ°m[ƒieº]¸P—u]&ír¹7Ms~‡Ò"Øí<_â¹ W|ÿÛ×ÐÂ÷™ï\ïÍà¶øé\HŸL‘¨¯`¯·Šcå‹s¼€á‚¬Àú‰ ³tîX;õHWžÛ”Þ˜5t|)ç-pÿœ _ˆ#ý +Zø>ë`„P·QÂüýµ°Á›{sW¯iaB_LèîÜs6¼:ß¹^Õ‘¨IéÖ§¾6û[ª¨ý‚Jo¶PE`-U¯¡vý›íy¼ÐËÒ¤Ÿ¯…ïÃ…}8`áøí ×7RÔTuxá¼ð¹ûŒÁ&¯-ò¨†£õªMU7–&7_Ú‘Ô¯a@ø®éþ]Lº†¶ˆw+:»èÿ5%ð;¼èY­ç÷Ÿ=¢°n¦HÊh’ÿ„ ­×Û+V¾Ò +ª°à/Ô/ý Xq +õS;Ò¯ZXÌ»:Ûðv™S²DW¾ü\¿üÏ“_¢ùàq¸@M-Xy² þ!êäÛúNùF’º—N¯~ÙÇ+3gO2íkTÈúR_êTzt:d´ðð føÍïuó„’7¸IŠ>®Í{øÿÿ{þà°µ}.tXúˆ²”Ò¼]eüBüî;P§oo +ì[I’×âE‹z͉£ºÝWÅë£éD{ žÕPf»fôPgj©êB-eùkg6†ÎÑ{$!ê Bˆâ¸ñ?qgãåmSôÛùÁ|Ô‘lžÉÓ£p%ïGÎìM Né[j¡Ü‹õÇ·#ýÚ¦ +¦ŒÕÿö¸¹«B—Ík/›}â‘s4Á¥¿õÎõï¨zî®°×±ó›nó{ìlËý­Þ• ‘kªSð›VÔÚ7·Ó‚*Š"Æÿò!´pÃþ…ºxkkfŒ”ë?^$üzóïõ7ô}žç}xî¤þóþÒBùïË·»r!­ #g­Ü¹BWÖÖŠ›iáìv\Xºb̃nûž×ãK¹s~ævZ`.+rqk¡3{ÿ‚ì!+ô{_ÂÑ¿°’úkáo¸PV‰ŸòP€3ðb>Töà‚lbŽ˜ ï4 š6ìê ë<ª¨ó>Ù²V§Yë¨n”ŠëðصS5õ ã:£:ÒTFÿ‚°\{ú”Æj:@äƒPûmÑ'µ;ká,<)ôÙ£)¡d.0^ƒSZŒðþ£Î5áÔ"hþ>W3”ó„û茿jG2á)¯éS†{%i´™Ï‡¨°áŒ.#Ø8!-4])]7ždXÇ=`õü¹"’D¹f.0^qÑËÈÓ† ~xPêíû‚æ4`¥•`{ω:À|5te‚Ñ´ï“éó%±òØ5õñ‚´Öô5^Vt뾬W° s¹ðóñSŽ€š`&-̦ßϤáãÌ ^Pì¼"M`ò—£Óæ=^æ ˜ Ì…‡˜ïÂ@u:%ë©%.P\ ŒçQ ã;×àwÅ$-Hã]?AED°ü¡b.0… Žvÿ K¯DÙcàµPíÎ`Èí¬RIg¡Fü‹O2˜ G|Q.ÄøIcaâ #EÎSx­…ºò²sÁ¿dBZ€C ÌæÂÞä„£§éÿK@ÑØÔ—S)§?¦™[qDµè¤…ÖXR¿ÛE ¥•²#¿E.œÜ“¢}WñŒãæ‚÷ã $«²@½’4ÝfômµDcß­þ=•jÊèÙ\ž§Å2îÆa»>?y-Ôèå¾ß-:kúèžqêH‹¿üÑØ™¹ðh\p~gmc-ô/§M—<›ŠWXÃÞØ>þ-•n!¼âEªªñÓÜnÃÒÖwH-ŒøßdCÔY|ìàà‚£K>6'i/\8ÚT­½9N¬…oÈÔB-Šy.è¯wÏ3Ž#U@åRQCDU¤F‘ú¼»cmŠ`À¿þÎé.×é¹0ZÔÂì=ºµ˜™ÅX¹llˆpð.ø–ÕÚ6ÒvèÃþQf'lU‚¸-rèóOûé sá/´ày±5Kºé4Žgßë¬U/´ÔEl+tÓ;ôvÑ€iá‹9.6’΢–B¥¤e >•ÖˆéóôžñÂ>P[Ф 6"Ý ‹?!µÜxçÕÎ'ò O/áyzBbÝm¹ÃçZÎ\ø¸|T°ÚB‰¡Ã*S=ëM=•³h±è4^WMë&-Ù´¤j© @iUç±Ù°–:^« S&H‰Õ‚©Äý¸ðñŒµ¯Òô§Ûraˆ>×æÂßp!Ä=X[£Ÿw³¬ñ(C&d }TÐh$,ùE…*×Àf&‹#Ž$ÇŠÖZNâ~\ø°au)j‚‚Óm¹Àöã…e™ãJ‘®ÐJ·õPÊ‘F*ÄÆÆz±‰D ¬6/¡1Ž¶aê$MòA-4EÚz-à}äb ®ïß9Vï³ç;Y¼”uǶoË»·#…X‚Î6%„A,âaAϧÕT\†XùzP"F —j!qJìZ0‹ÚD†ŠÐy¯ïÙŽô¶STœ>¦æÂr¡+˺Ì¥°îC §ª3ÛŒá„Ó¢©Iø±Új›íB‹n¿¥BÓ|7áÛTQ Ô®ªi¢›îïÛŽôOÚ%™ ?’ å‰:žÇ"ÛiÚaè [ Ǻ@.¨!i0rF÷ï!“!µ%Ñ"«ûÂHBŒ$iAä½ú&\ø-02^8OvÎ`ÔmlÖm™…›'•+l)Ä™_Š^’tj .¨6Úµpp!§êU„xÐýûµð×\îb¯¶¹ÊWŸ{½†s¹°·©úä*ý©CßV¡i„B?¬%Ö‘¤Â"uX‹ÒDr‚À¥:5½¼æ‚…r#$Bõ½P÷âB`1Öñ¶¾r'aëWž[7Ú–¹À\ø] 4Û¿Lié‹IŽÐÇi¼Â$ +Û7ÆÒk6ÄÁ9qà é\cméŠ òXµ` +%ÂËbÿž †þ+™É_ƒ~õù!ˆWÜ™¹ð¹ *¬]Õ£]Wk*¥ŠÐÚΚR©¥;‰t´Xú†èåº5v56,4z=iÁŽ¢ƒîhsâÄdíø®èù\ÀJ™<ì5§—W®ŒÖ…À\`.œÝqŽç«¦:Ž¢f¡(XC4ÌXñO—f(ÒT/Mµ…§ª–!jc¥¶"^hô^<+Œ¶a´ßÄ$¾'®®í)®Ê½ëÌEeÙ‘:É ÁÿÃ)ÀÇ»·eí»f3šû93˜ LŸ=Òz?‘Òû<ÿ‡‹ãÚF‘ž¤¨…NÑ(CRw‹¢ëÕÁzKSØ`DD+Ø_G’¶«é +y¸¿#-1ž‚—kVÌ…ŸÈ…™ò«I~¼¶úy.ÈP¥zOXÑ«à¬6Ú& ÅI(Qû “§WjVÌ…É…iëHÑ ¸p¶ŒPú'”'·Ïúï-ø™=ûâûJx¥øß»2˜ ¹¼Íö9\0án&ô@q- ïîê'.Ðz`´øÅ•~öÛßh¹À\xÅ­õ^é6íHWñÍpóZhýæË®±/~AZ EbÉ d.0~iTýµ_ìÏ»øðú7áÂø’hžsá˜ØIZÈZ´`øÛ:sáÁ¸¦Q9\§IŲüi¬ –ká_qaÛ«@áï\}=êÔL s¹ð‹7Âõ¼›4ÍÂ%ýÃ&¤ðc;‘ܾáI r5Xî/öw.D@ͨÊìà`.0žÊôþ™T ëŸÕ’RñÑ]ynÄ›çy‡ÿºáJ ø,[×öÒ¦j.d'Â:µë‹›–0~6H ©Ð©N§´ê…ßÁYi·/$—ð0¥µç}?m&zâ)GK‡¥r„@Òœó 6-ðð^ýέµçFÕöZ¯{,> +stream +xÚÁ!@ð +QW4?uO4U”¯éº*J‚ 0#‚$¸Ý½ws~ïs~ß—s6ÆŒ1ÖZÖZJi)E)…‚žs´ÖRÊ”’÷žÂ‹1 +!œsµÖÖƸ÷xïýÄð:Æendstream +endobj +5507 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 265 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5520 0 R] +/Length 11734 +/Filter /FlateDecode +>> +stream +xÚí]‰b£: 4àƒ€ÍiÀ! üÿ_>É´}ÛnÏmÓVênKˆ!4ÙvlŸnµ?ÿÝŽÝÀwé³MvÀöù&žÁBÅ·èó- `§ÛgZáy, üT>×N±0Ù>ÕræY,X¾OŸl3báÀ·ásmyIŒÄXødË _`éKb$ÆÂgcÁ1¾‚ Ì l;/°^`^`c½À¼ÀÆzyõóëæ6Ö Ì l¬˜ØX/0/°±^`^`c½À¼ÀÆzyõóëæ6Ö Ì l¬˜ØX/0/°±^`^`c½ðfgʘØ~°^˜j´¡–¶}Ò‡ZJ|¦ªÚ¹îñRUñðõ¸îZî'?]ßSuõ°p’2/°^¸ +!848>áBµC,¨‚”óã¥fùàeɾÕÐÉÜ}Ûº…Oá³Ü“yõÂß­€Êg™ˆ‰õÑ>„Œ®W; dKQMÛ-Lʪürª¸ ½ (§pdo Úê­‡°p˜Ñ,ba(Ц4‚¥Ø \c%L·±pù2™.±×ºhÜZO7^ˆ!”D¡-¯mª#8:ù)¹SÉ xQQ•Ÿ¶v¤ Äh=Ìÿ 7Á í=,¨¸6ŠCGÎl\¢?Ç¿ûí­B •@Kõˆ‘±^‘xƒ–!n‰s u<ÇBUÐH„w³…XŸÖJwÓzaÇòbÁÿ‰…†îÔ€þ_ÞÓÑwXÀ:iC›È i³»w‹OG^oð¸1Àp »û¼0ü¿õtã…Nsá…œV¥ÿ 7Á Õm&,TP-bÂX“Ùˆ#†Ö¦›ŠKaßEÊO¦„¤ %z‡7 Ô®kÌß‹Ž­{TUÈé9âN„î‚ùr^0·Ã YæÀl +¬½‡oÐÄvŽ±ªÝ*P0Ôš!a—/`ïNËPT[»j{c¸Ç ‘¼»ùaŒÔ=Š…Šºï Ó¶7w)d ûɼPÜ-Ôâµ[Û´sfaÞé{z˨þ™VÄ‚ïb5Ñ`>>f|¯ŠÏºº`Aî’IŸWÉzáðNŸ.Õýþߎý4JòàÖÅ0Ÿ² +~£°“û„·yÚ€á`M¶hhã…"~óúEXˆÏ);/ øè<~FùþÓyA–ÑÞÏv»{F\Ѧ[}TÞÃÂâZy!; ÝN Øí{(Š‘â–³,÷{œ…zlÑB÷µ£ÈnC/l ¹v®OZK‘æX(ïa¯ªîuB{NCÝ&c‰wõ˜ž›öÐ*p#µ€VãHͤ{Œ´ñ~F?cÈK ¨}ö,‚(zGržB8$mg4?]/Œwzá¸Õ˜ Ý‘‘À|z€… +½È‚^p&,,µ€›ñe}Ud{;Ò|Å´Ÿ1GýEØ쿘n ÙÖcUÆÑDïŠ;ÄxžjŸþ®»÷I´Ÿ!v˜am…wBŽ9…Ø GBe¶ƒð&ãƒKBÄBm#°À@¯1^Ýû/ÆPßûʱ[(¥]EäðÁ­ ˆVR€t& ¿¦éj«9åÖê3“Ò}À TïG¬p b†ú˜úV^rci dÅÕ7Eº,‹a½@ÄÊo¨Ô­Ž/EÜ›™»Þ}ó ÞÈ°àu+ÙŽ5zŒ‘\vàiÆ1žgû +€zam÷Þ8Ÿ¦›Cg÷‡Sx³â¯µ]KÛÐÓñrÿ¬r¸µþ…d{1’.||×þ ¨›I‚ú؃‰|kž>ËY´Ñù³?±¹MáM-ë…Ï6 í_áÍñBæ:]!A?Ž]›èæ¸×ïLuÌÆÊèü§È‹CÏI`FKPÞµOñÂŽé¯ö³ß8ßù`áæúÐÔËnŽSr¶ìxÇ ÔhºK]BÕ6Fu6ŸŽ4øw‘6í<ÞÇ‚ PNÌ._Í Œæ…GÛT/Cé$mdi0K±aO}ú*b/Ã%J*¨[È»:ª¬f+lêæ윕$£'X±@il^_.Q¦Ñ¨Jjê`½ðéø×âÖ±p¼]­‹mäZíjjÑûü‘uÝܦª|v=ÎÇ›¼*ÒÔß)6ï·ý÷4þYôòå…ó#1/°ý^½ð °ÀóÚX/°1/°^`c^`½ÀƼÀzyõóë6æÖ lÌ ¬ؘX/°1/°^`c^`½ÀƼÀzyõóë6æÖ lÌ ¬ؘX/°1/°^`c^xõµÄŸ›ü—þ&½0ÍíZñìJ?‚î%'¾5“^°pËVþ +^(`nŠ[4ÉoÒ äÍZÅ/ᙉÛ3ï‡'°ðCõ‚³×6½ ?ƒ¤QëÍ™RÝ“¼?“n7Øá÷ðÂ÷ÂÂÕ ß ¿’Œ÷´.¤øËQJýS^`,0/Ü”:TUY•e1-æ©2fù·¼` Ì 7€3\ÚÙ\ÿ8TZÙw‡]¬˜n y Å4M‡¢ƒ>z ˜@zÅzyá`!A± ü2C!'¢x 3à–§-߃ÍT| Æ7Ì^„õóÂÏÂÂc£Ì‚õJõ••ö„ ‘·¥•Õ15“„¹\r|-m‘˜5ŸŠ¤²EªX/0/ü8^ Î¹,qÐeÁIë VF‡¸%EÓÑ'¦‚ %„ƒ0„yQ¬˜~*­…nß-¢§}–Œ›Š ³Lu.Í&$ ÓCH<†K.ˆ…$Õ¬˜~Z;R½7#Qݯ’jòÆûÚ¬€C.„Wq@r@œhq ÇLBã_ÛåÀzyá;ð‚EV®÷ùºæg‘LE H³±à×lUUå€n)¡7Ü¿À¼ð3õ‚?OZ±®fꨧ°`š™6 ƒX°"uWú@^h ÷/0/üÐv$…‚xN ªM«j¬ù•Wc…²YG^Xô:I^ ÷/0/üP,¬f©I;£@U˜|i©áˆ[Q;[¨2ÜQÕí‡ócyá–°°¢¹Y%Àµs¹¨E†Dô0åC³®µ&}8/°^`^¸ , {-/À0(@‚“PQ?t@á MŽ4‰8Ò[ÿëæ…ˆÕXÇ­µ´‘غ³ZÛcn’ªîd³ä«i­Ô9¾5ÔU"Öü´Ázyá'aùà2îNyoh¬Q.rãźæÂ(³L¢?ÆÇ#‰7ŒÔc½À¼pûXøËÄuÙÞÿ¾cNë…à ýZk> <ß™±ðW^è¾8ŸM÷s±Àzá›ñB¾0ËÙQBý“y±ð½xaþÊkŸ~2X/|7^pÙ—^û?Å‚Šõcáżðs± –¦ÔŠõcyA-î ýȬÞ†ÕŽ-Ú¨ÿâOO¿•% ó¿ǂR«Êó8*#ß{òËnªKgÃõmÖ oÁÂñÒ28?åÕ¾¬ž<©Ýgaá7ó²ŠE§FÑïèíbÕ¸E„÷‰•†åfÑÚÖ oÇ‚$^8Ø'k€ö/_6 ógaá÷ò‚Ðs19oðwgõÐTžz"Æ(qß±œÇܤUÚ°^x3öZ†ããŽù²Ì Ÿ…Bèl`ÌÅœµ„ѬÃì4×mh/8ÍóÞŒ…ý«”~ªlÕǺªšô|^+ø7›ªêHN§&uªúlçÄ‚9,YQ²³(ª)î_•mòËYN™Žwzil“2/¼ *“ŽÂPÒ<¶$Ë„„2ëÑ÷3Q´YReô‚õÂ;yAÒÚ8Ë6s¶ˆØ ;žûmGJ¬Œ÷™b¦ ä^ÈÎ XÊû):X¢_CLšDR¡A +ÄÍSÜ{b^x /,ÆŒ0£`NƒõKÑ•¦>: G¿æ±Ôã’.qbX/¼U/$hc.¥BÇ\ŒV-Ô‹è]X<–Hq¡\ÄÐÕGUs<ßñB‚¡«N²¥ghÏ\+LCvNCˆ¶£Û5ÁÜã©õgæ…g°0ä +±€+Ä‚PYb;ªY¬ž¯"Z5c¤D?p¬ÞÕŽ,‘á¡ÝBBA[µßô´ùa=¢¤¸¯ˆÈ{pGƒo.EŒ„BÈ°Ú¢M,þÙ¶W0/¼ ê¼AÎv²°P‰;,ä.HK?¶5¬Þˆ…áØ”áêŒk{´3Þ™Õ«ÆìÒŽÔ€-‹²¨‘–Û{.¹óB}mn:m«¦}#!xä1ÜÄ yžNPÐÌ oÅBNXY‹ªY<›ÍÍ17}kæà½Þ¼~Äë…ûzaq!ºhJ ,œµŒx²ÍÉ/«±†‡XØyA>ÄÂÑÅ<>!Ëvß¾œad^x/Ði|n|w¼¤4¾ ÐâËÞ+“Îó«'y²^xÐŽ”ÀLoãí=j¼÷ñΤ"£¹`a\Ðr#ãÂBÅ Š)5yÁ¢bƒÄÊ'X…ɘÞÅ 6;PÃ)JgÄAêÀ&“£v¤\¯”…úÕ}Ϭ¶©Æ¯¤7Ÿœ`“PËz¶è¶JB'»0,gH6C¨¥ "€Ó=^pÔÈZ_±Ð „Z `¨gÄÍy +nv5òÂ9·0ËÍý ¯ZÉ“æ/ˆ-IRüMŽ”BäÊQ…æì©%oQÛÞ·Ìb½°™®Ú˃ªú³¨êÁ&ç‚œn’ŒÍÚJ|Ò[äÈKuçÎYq¤žé‰ªØ]­+ÀHÉzLRÑýÕe5e.Þ®VÛ ™>Êhå…¢m­`ÅóÞ‹…kS™Eö(Ÿó'æ…7‚¡ >·P¾ë´¬>ÃJr__Áô~,0/<êÆBŠƒï̺ÄzáßÊðA:è ó¿Á¡¥Ïw¾},œ•Åú¼ç÷cáwð‚ÊÕfœéÇa8{‰?1/l¶¤dËòÞªžõÂ-báeþļ°-Vh™›ß-›õ¯ÁÂoàpœs`XÕMðëæ…/ÃBa–eÑ’z P6ıE”Þâšô"zKý¹/fÐP¬˜¾%QÌǪg˜õóÂMb¡9 !²X¯ …M{pmzpP +aanµ…Nå3”ZW´OBE!Uíc¹$À(–š4¡ÑÛ™¨«£a½À¼ð ± OMSÊ‘¢_g"ïàäsŸ„Ùh©0¸#¡ÈŒÈdH•ƒ4‹¬%2¾‘#ÍPÏrƒçJ ñ9ëæ…}ößIä:„4Ïõ6UÔAc¾—\kQA²¤i^@ï% ý"¼Û.Þ,'z¼_*Ïý Ì ß uYUå)É1ê—*ÓÒDžuõäåæØyŽÁÒžó¢È(““ÊsK3k+mö•psš™e_2‚•õó­êG©±›žÂ`-X¨6,/ä5çE.–#-Ò%U.Ú +·Pl?ÀB#¸yá·#‘åi ^HÀ­#yLƒ‚QÑ–Ú†•r^ˆe]ÒÅ«¤ ЫTˆu¬AbØt¢©1R#x<ó·Ç)ej „D6Á P@´M÷G°ÈBºtq.É2Ê S„Ê{º?A@Y† ßÏ Œæ…ÛÀBªV“(O¨&!e3ƒºij¨ ÆNîØHèò1€<6za,n3áåý¼Àzyá‹°®¾«–@-H«H(iU×›Utu•Ryœ$*‰…2ÍSªyÓSÊ[w r6¦²Z”¨Â‘õóÂ7Äú¿¾—Å"M·yœk?ë¶ðHÚNšNaL2õ‰!‰mô4%”À¬¸/åLrè©œJuªX/0/|C,<Hwhg®‰!qst—›=çÅý­K :bÖ§VÖ Ì ß ¼¾3cyá&±Àzá»óB_ 5ÇiýËéè—8XiKõØûI¡9à7òcá[óBý—”ÞÑVIÞ±”}¯èxüZ,(õEX/ü:^`‡ScCX?Ù)>ú +ª1ÕÇYD®¯Ûû/ÿ’íìS° hL…ðñgK  ¼ v¥m—‰»ÞL9¬~./Hع'kVÒ‰}õúålY/üx^ˆÉçº"~í/)ü„ãê*½kG¢³êBÒštçy¾¶Ũ`ã…â¢ÀýWbA Õºñ-Ô)imªiçJdˆüŠŠA +Ö Ì ±pðhq»Þž²ë‹Ò°:Ù±ùKk™ë.ŸCK.^xá°½_}1,W%½p,š¦ì ´W½ÐÑ‚i@©`ô6°•õóÂÚù^ûªÙ>!-EÀ ¥Û»–|å6^@•â‚r/4›-/(3Ð,OÄÂÞŒ4 D6»^ Œ“èUÔκÎ䬘iS=Ç +¾Ü´ñ);Òá4 ± ÷uRâñ¨®e\e4ëçû¼`Ï{”õÁXP¯ñXµ:)"ê¦@V(…ˆ¢#,lÑ <ÑpT•×¯hIRêšÝžõÂß-³ÛÂÂü6,(Ú,ëCXP7þ¬iUwü¼%u°ýªFI3 Öœ•…4»Ï Pà¡Pg9ÉÔ”~ÍB:j –¦/G½ÕÂ’_y¡‹)êc‚É•¦ƒN/Æ‚ÇÑ?J8Ãzá¯ÖÀ\ˆoÊ õý5±´£UFM:`H´lo‚Q…>‹y :ìö}ÃL OD^¨0>:€£ƒ‰wšÂ8º2}1”rtÔÞŽdð[X¡.z!jg¥®¡Î‹y¯ÁÅ+æ0f½ð7£^N׈oÉ Su„Q^ u&-¥¬ãR¤Ô{ÌÑÖµÜûÐr­LZÐÙÆ*Á«*Y—‘Rkï(©…,5oƉzŠx©^¨»uÂN 4¥ùÒ¿p¯GF×êÅSa« *¯ò|x ¬Î[¿ûn¸Íù ‡'*eCt£}8Ó± Û.ÆìmH¯¼€Ð0/ûö~ˆññb,”0ôS?€ÍþŽæ…óeô‹;}?^ø×Xp[Î:ù,ˆ<ÏýÞ$$û¡A4HÄ[_%Æ°~GX˜ïaÑb_Ü¿€X°^x ®wW?fÀPÿÝ0­¿›…g¿Õÿ¾âÅdë™þw)‹1K¨½@; ^h¾„šd[›ë½M^0Ù´±'m´½Ù‡'ÙjÕ¶Xsm›;,PB™—7#!¤7ÂÛklX~'/,ýèwvˆK¿ø®¯hóçƒ ‰Ysqtáý>Áßãd‰—ÓBÄ‚“/ ïûŽÉc6Ah“¿›E@7ÃJã5Å«ëá$;ÿN^xʼsôÇI6Ãö÷%†e#éÎwõÌô‚žb£_àå(±Ã’¿ »v>#xö+Às÷¶ü–záU³…´Á¦ß°éÂrêûé z¡¡¸Ä¸ˆ±R½¨iUÏG?æÓ+F#‰ÂEŠ +mSåþ…‹vvùœkûf¼0Üë—x};’RûpŠ—w2¨µéŸÅÂtÌ_1¾C-z³”ûÚ^€…Ïá„¯à…ƒ´Éé”OÇ· («æyîæ®xW›*!áÅ!Ï‹bóº1ª*ßLñx¤g±ÐMŸwmŸÌ 䊨 +³sxÛ­l·7c+ù +$p~¤¯Å‚ù̸ã“y¡ i.ª*C|‰¸öWcÁô²5f]o #}º}*/ †KƒÐö¤QÏ~*h)æ[JÆ㑾>ŒN‚+³Zî¼Û°Íðù<,¨ÛJžÇzá·òB+C'B¶ñ‚„®²áÍÑçSe,|c½@1’nãGZèP1X/ü6^@,t”5Ïm¼`ÃöHCÆX`½ðÛx!ÛyÁG^¨CE“'1X/ü^^ðçÙYK+%WŠ±ÀzáwóÂн÷ÚY/0~†^(·à¨X/°^øå¼°„9ͲÛŸ(ëÆÂ7æ…0# dYT%ÊpÜ¿Àzá÷ñ¹9áùÊ&;7%ÙÛAVé™±Àzá÷ñÂ_;ëÆ·åÆëæÆëæÆëæÆëæ…o‰…»TðÏ•ËÍ“ý_;=‚õóÂMb!M陋ÌòxŠ\¤I¢•xüÿËœ¤X/0/|;,¨tÛò"Ó%ÕrXÔj4Íƃá‘RJÉpy•OϬÖÃzyᱧ۲Sèè…x +KU®¥ë+Ež=š{¬ðìºÏ¬˜n VÐêoYŒÔ5¡‘Š\š rB4°QÀö^Ô¸1ö) Žm§2´‚õóÂwÄB†ŽlÔL‹:“ê471[n³aV£Jeà«#1ˆ\ë…μ¨E#psYŒ‰(UC›³^`^øŽXð{ùR˜¤Æ`iÀj=_*ÊÖÑŠ¥pÒ×0eÂä¦-Ç\‰î GaÚ¹©¡K휈jnkÊi/D…ïu©b½À¼ðý°@+šg‰ƒƒ×.ÈJ:Ê8_nèE¡PPpd½6Þçk^³VBA ”tƒD¸Œ^"(½GëjûF,°^XÚ,müÓ.×=å$7íet§zߪŸÌ wXéiŠÊDUFï}ê:1B—³^ÅœÁ੧uÛC}ÈsZÍsõ™ÜÒè\©!bA"PZ˜WŒ£¯X/¼ ( % ìßÌëGøt]¸¦yé0/\± / •ÈÔ¬A’c”“¦쨼7JGK6˜µ­j*¶ˆ”>.”k&èH0èü•Ã £¨ßÓŽôÛõBëŽH÷êá ,\nC+ý¿ÆÂ¯Ñ ]QUeÑš\¥ûÊ%`¤ƒ™+Ü›†€XFa4Šˆ*kàHíDÈÓ–Ó~ã ¬hÃé=X`½P@FëW0ï>Z ÿ•X/|¨^ð‚®æwXХà¨Ä ùRÄõòìµÃIÄœóâO,ÔïÃë…ÞÐⷬ–$bžë--­N@¶mv,UoC{Ôç´ÏÎê°¤eÕl©U’²JÎSòXø=íHÙµ[-X‰á+Ð*UbiQ7¯Ä &…ZPçn„ü„ª™Ö")Òþ>zZpç1ë…´:'Âoy’1HÒPHÂÂ1Ʋ.¡¬íàØ/àRÔ þŒÈpûÛ1¼»¯âļðú6Õm)R/|>Ïb +6óç:i )aa„ˆTÒ³ T…!^ – +ÔÎH¥-­äƒoB£KLŠ…ù÷aÁ$ÁUÇr­Ð3ØcQS§´‰·>@'­í`NŒÂGRQá]b¤­MdS…ÐÄrÿÂ[±pù–G¬³³ ò\w÷PÃjp×€r"ê…)tÚ©QëoÈTp&BˆyáµXPi¸ÃÂ*¦È´(®ã¢ª¹2M@&ö‰ ÛÚ’fÍ õÃQ×\"ê@íHÄÒ݈‡Ž¸ñ×(‰õ °@ú¹Ç§Ýž7½pNNÕΟ·5P'p°¥äÝx!Þ”ü¾¥™^…uÕ÷¹5K;µ)ù±É“©Oãª>zLð·Ñí¡ßºRB÷‡„^l§z¡uÏU?ªxh:&‹b½ð^,$øMkô÷ˆ…#ÕR]„…%bæ-WûÆ tS².‰·æ…7`ááüj9Uû–Ù·r³ Ç÷.…ó­˜Ú^ãA©æîPÖ ïÇBæê<à—%,4ŠÑøûXè¼wñŽ ¾ß@0/¼ 3k“:^¼"ë…aá\¹ƈTtÃÜÃB…?gÿã±Dåp>1/|ÄÇ`õÂ},$Á‘«B€¥ÛsÁ15¬>à…ü,É·SǼðUXXUÒ¦êCxõÂvDµpü=Ó·ž‹RΉ9ö;D, ËŸ2´EFÈêœÖ0X瘾 û¬hÎôAXhKºAIEÇNøk´µ–44IW•n_|—˜î|øÿK ¿aÍÏ×Ázáß™¯¦ˆŠç=œyáÿPHʇõM¾¼ +bù0,°^x¯¡²cðÄã‘^‹qØÞaCÌ+I¡´¯dÖ ÿÔ?`¨Êóbáwð‚™hÐéÝÄ}aiBÌ ¶÷l[—××ùÿf„ÁÜ{½Œû¾ + çQ:'ÛóGbaþEXX¥´^El%^ÈãÌ +ž–Õ¤:_—Üh½DYTªÑßÍJGàßj‚ŠÀ3l©ÄC X/|Îqp߇báñ‚(æVÌH‡aNDJ™Á¬6«©ª"„*©©€;šU”s‚U¢wxÄÑøKºRÊÐMF™©kg˜ÿ–.Œõ óÂ,x H«dŒuÐI½t0[ ³6B"8 UCe 4©ÇZšåv ÈcVH|Ýаn‡§Ó9ë…ƒ…ßà &³’LT SF™ÁòÌ£× Ü´‹N,à3íjÂÂŒñ“0f^;Hüµ#„6ócÚ!Œ©f½ð,ôÅnÍÇe§ã>˜”£(zæ…7óú—W&NÅ9ü4•íì3CžmAJ}QeëšU 76S¾@ôþÜÀÉ£^ „”ôº‚2;bY•sÿÂ;°PÃÅžXÖχ§Îˆ·gà~UŒTˆ±0¯ÔŽä‘*²­·4óß´æ;‹¦s,‹©±@)¡È †Ò)¡Iˆ…“àþ…waAByØì)^°Öÿ õcáwé…F¬9ò†…q¯”B˜2é¨Íh #ÖôâÇ3•¥a©{‘ ª»¼–Yóì(=Ö Ïò›—ym ôŽ…ߥ yb$šµ¬É’dñÒ­„˜°®ÇȨŲGÄ‚…jI¨HJmª&¯¡Iãk-ÞƒÖ ;/Ü¥Ê3òX s]Q‘WÃ,Ǫ:gò‚¶©ífY7|g(M\˜ÎN~0þÆ ç……;^Øb¤lqèó¹HçõÂŽÊ@ìeX=aa9„É +7‘^¨$d†¯«p|//0òÞ’ e q§¢ƒ®r.ËH/Làð€¡ÐaÌÚÁ ÎÙÁœÛ䃱ð4/ 0Ô_÷ãþ/¨È (“¼×æ)¥…/$G¥” +ÂåhÔ!À(EZʳW.ê0fïãÆBäi£Mñ– I,òí«‹æ ½“jwH-ù²7¥zKþ°÷ñÂ_kÃb!ŽGÚ´3ò‚Sâ„0!;`Î… ›^ >Ôjã8Áw@iXiõ°Lˆý ÁzáXØÍêmׂȩÕô ±í4TgB<.„ìŸ`ái^h_j§ñ±'v4f²­YUj tÓ£”-î‘]],f5‡b‹‘NÇa¨t¾nei‚¿íÛSº½ÄÊc.tU–²Õö™%ªX/<…Š5´õ:‹±°OßÁý†…I9{Á%þ„7hî÷ñÂ÷±—Ì_ðèÙÆÇåG<¥ _àï|[ÍЈmüÝ”™mª–Uûć\Ä`ȇ0™x®íŒ¬Þ§ô½êAn§XôÆbaç…%VÚ·. É'óÂÂÂS+Ô>XåõÂIü’Ͻêu³€X/¼¢éŽVˆ6æÊ !ݱ0B§h¡1ú‚…ù·bá1…=†WÎj`½ðQíHW^Hqw{æ /\°àC„…™ëƒÇX¸—]ï3ûy¾óðBÓöôÓ/w¼RRÕim±yaºò>èn=¯õ[n ó«ó}d +Ö ÏòÂÅJ¼%ò6BL¡Ý÷þ…ˆJ'F£+g€Úü,ül^PoŸêÿª#ë…7`aª.6žE'ó÷±ã9mÊd…áœ5evÖejþBVP‚mŒ”äG^Ûoçs”ÿçËTÙº¶6«ZÊâ¯ù€óD+ôì¾u]–?{ò±zÐßœëÄ>ÖÍzám&¡LÒvígcáó‚éc?³Æ³£¡.a29ÖÈ“Çâ +¡h‹™&Àuiþg °âAÓ“5JXZ—õÂÇ`Á[’óxþl,ü\^P¦¦Ø¢‚:Á()­ h“—æù%…úÿ Oõ&Ðc”„ ª(LºfÄÀ ¥tDpM‚! …Ê5ýf½ðQs<Óé0~ð éßÍ j ‘B·Æõ8E ¥OCPF§&v@‹Eë%IÙ-ôfa¡1´0R†îNkœc@uM–±¬J§*b`YEº@XXé¸Ñ°^ø±ó¿;Ìt'©m1heO¼Ðw$­Æ©h OWмi ,ÊXz—Ä•Ú–â´ rb²ŒÅ¬R!œú¹ôã\8„Mâð€F˜ìÄÀzá›aáçò‚Q(m/ò8ë`VJ4,nA lVøŽLÒõ”a<ñŠƒ®’PÓâ.„ÃI˃¬”Bàêƒ@ +mÖ Ì ·µ8ëé·ÛŽúÉÑÍåêS½HÝœf>íBJ«*œ3M=üN™2d‚PunâLT”+`€zÕù ±ÐT>K$GÙ,‹”ü±vëæ…ÛÀBž`µM¢!Æüi眛傼 Mœ0҄Δ¨˜‡CŠ +`½L[Ї’1¬{¡º@cº“S’wpð9µ#e4½$§¹ 6›6Õì+j³b½À¼p‹XØZTÕÚQ† µÈº ð%y. ¦% [>h:ÿIåÛÔ7#ráEzêÀ¥«ëH,Ó¸môl³îX UAŵ?lX@Yro¡PÖ Ì 7ˆŒtœ”c„·P›ê QHDÕkÔT# KäÓRœÊÅ:ÃÉ\± `!*ØÝ@XÈX/0/Ü&ZŠ‘¨Ñ³ò±“ÀlX ÂB”+÷Ê/‹0 êæ&¦‚ÁwÇïKG3¡•.Ûü>èQ|Ûì ž†õóÂm꽓òH£‹h†r¸Ç èÐÏUV”.5"Î)·pÌÐÝeœ¾F‰2D ‰ˆ ôÄ}, ˆÈQPi¡aŸÇ†#ëæ…mGRNÆèeB |“¢tñ( €Ï‡pX–)t¹‘ ÓetÐSÒ—dÑæc’gÂD3î™a4wXhñ”z)a^D®¥ÜôÝŸm¬˜n Âo= yk ˜«V™4Ìi¾Š2Âh‚ 2Íó´ +Î…î`LÒA8ù¤¢#BפJ©c‡¥êV¬CHðÐS ,tÒgSƒ¢ +Ž‘²ê±^`^¸M, l͜¯É4%JP¡4¥]©^Ô’çÉtÐ4º"étsÒÃk2¦Êˆuœ£Š£‘„jO= ãÀƒ¨ÛB/(Ë¥h'M£À•H0DêGb^¸Q,(Óuûn•±ÂÛ˜Ú—Ÿ2—ʘ­¬2û †ë4›a_jÿX¨±|~92WiŒâñHÌ 7Š…{C‘>Ø"ÔÃOú“X/0/Ü ”Üú/Ö@§þ¹ûË*5[Áó™n «I +ý/°°¦m¢ }:>6AˆõóÂÍ`a5âŸ@çá˜Tõèç°^`^¸,|­±^`^`,°^`^`,°^`^øj,d^Üœy?°^`^øl,ÌEQÞ ¹ß¦n÷Úú_à 7k¿L/Tå­šü%¼ O·jó›ôB·lͯà…og?T/(ÞðϳZæG𷳪¾¹1/|/0n Ì _ Œæ¶¬˜ØX/0/°±^`^`c½À¼ÀÆzyõóëæ6Ö Ì l¬˜ØX/0/°qŒôÛ±pÊØ>Õ^¦ù>}®y:3Û§š{IŒÄOå³ ‚tí“ÍÍÏa¡à§òùO¥û"œ³uendstream +endobj +5520 0 obj << +/Length 105 +/Filter /FlateDecode +>> +stream +xÚÁ¡@PKXBÔÕ†0ƒ(Š’$ü¦‰¢¤‹Šàœ;Eÿ½½wιÖzïåœ1J)k­9ç÷}Zk¥”!$¥dŒcbŒ„Â9‡RšRòÞC­µcç\k­÷xïý `;/endstream +endobj +5511 0 obj << +/D [5509 0 R /XYZ 85.039 781.388 null] >> endobj -5418 0 obj << -/D [5410 0 R /XYZ 85.039 109.982 null] +5512 0 obj << +/D [5509 0 R /XYZ 85.039 758.673 null] >> endobj -5409 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> -/ProcSet [ /PDF /Text ] +5513 0 obj << +/D [5509 0 R /XYZ 85.039 758.673 null] >> endobj -5421 0 obj << -/Length 2757 -/Filter /FlateDecode ->> -stream -xÚÕYYsÛF~ׯà:«ŒÑ®Jm9>beËŠÖ’ËNl?ŒHPÄš$h”VùõÛÇ)JÅO[. sôÌôô|}R$üS£Ô -i²Q’*aÒt4YžÈÑ Ìür¢}‘£)\é×)L–Žî -…‚éå ð)ld|qryòïn+ž‹F¼jH*֤¦æ¡X”í‰E)-ŒÒ£ÄJaeDr¹ë4(7p wcn5ÖYÐàˆ š’gnòq¨x0 -ÏMA4œ¯Ç!ì’W<½YÁÄ4¯êÆ­¦XÝ<…%ƒÂoPÔ¼ƒó›—´žÿN=I·»'jª{?ãYst ÕÄFÎË{¯Ç öÝ~6ïñ½@x¡BÙf$‹»¹Ã½cÉ Æ -8+€vuã势Ÿ¥•Í„s¿ÀOUÝ) X3Ïl·,ëVŒ0…RK˜º\ÑÂSÝ ¿x>ÆëÑ-¾’Ÿn`pž“‚/¹ÕÉÚ—n‰Ë®iýËÖthÅ»V5#»Ú¬¸Qú/įaÃï3ó²n@êî}úÚôAfE¢“QKE§ý0­†Wجk7ÖËkî‡oø [_»:¯n?41ß.Ø¿åïº*VM^­Ü2? t±ID”Ø£¤GCš¢aV‰ÌÚ¾¦Ä„¦Sº ¸%Èæ€+ƒ7åØHPyšß*Ÿ”7«âÏœ»ˆŸ7;`7&år½È›|ʳ5nPÆhLòºžmP‡î¨•ÐÒ¿ã–æ°5ˆ¥™a+ù;Z:6=k÷¨µ -¬Q-ùuÃT;{ê˜Îc2·¸C€9üsO2@XÎ[%™àÔWži%ã !ÔAcÓ(ÐxÜÂïÐB!?¤äÚ¶¦AÔ»V„DJ: -_GêÏREù -€WŒíd@$«ÎÆùó\MúF©MØÑ*ÇÊAŠBf£X"ß›%«PÓ]»öJeü‚Óî&¯yÒ-ËÕMÝøµ=U$»Ó¬éï³}p´j-ÒT ¢£¥ {DðÐVÄQÜíD* œg"ÄÅÑã˜äÁi;ðR&fwN»`=‡WÉLð²B‘Þr7bùÎÊ&[|ú=®4¼ŽŒû\w¾F˜ÈºÞÐouœ{m•ˆä®¬´’–y­žÖÿ!ÕFsF„ÝÒ=_±XÇdW‚uYÐݦb@ÍPZÈ«lík”*òJ³å“ÊlQªƒÐ4úc3ÝO?1‚‘i©wü¡@¼Ÿ_ê~¼`tºŠ´t^4ù„¨U• ¦ÀAFà -Ró·DG è‰H¬!x츂{§ C°wZA¥ÁÛ¶ýþ2¡cÕçé;È{g^[ þvOT„@xÛGxß»^A`h{´‘G ìRVÜo­¶?œG›²@ ±ê³ÿž¾}…èÓŒ>ö@2ñ ²^ål±á¿8 -B•Š8µ€pKt„žÙ4Ax츄{§ ƒ°wÚåfçéÐOnü¡g³;äè'l|Z“™\‘¢æŒ~ÄæÅ_xž‚øN·ÖÔ/£8–|üüñeèÑC ‰~­d]Íóº ãhÈ—Á(m_^;ŒG‰gÇ.n玭³†¡.î¢)Ük›ÎÆ!9ç'·®8üF?Ž \Ó_ŒÚLœÍxj›ùÄü(ýmû ôq[&S¿ö¡zëëÊôÖQC;l³ \;¼¢ÈÏ ÒÜÍ RPB:ùUÁÂÓ>°ÔÁºƒ=¶\•EiùQé0ïbô@ ¡®§›4Å6ÃÐ]N¡ œC8‘„ŒT`§võvJt½|BÇù"£9O,ñnwø>‹ÒMQc1%„±í+å²€| -Ïj»$p¿_ ú&§–·”'nè¹)5èóë17wS¿¥Z^wÙáÒ€ÔæMd8…s 6 F¦~^:W1ÎÓˆcÊ8x“W9Ó:Žb«|Zl!Þ”sÁx9ão‡#™î|<ÛÁŽ#Y@M¾Xs«—Ï'œºÅýŸ~'Xãñ]ܼhjž,V7®ò¦*ëÞÕzPA:`v#H– ¤ù ŽÏ‚½ËâAׇœH)äám|´ô-O½ç@;3o©xë@½“ñ%"΀s 6.Òtùó’EŽÏôà¢Ln¬Y㞣o#¨¢,3LÓkÿÛkÑÀéÙR^–Àéh‡YÞ7ìmÌ>)ÝÑÞXdQ22T퉉Ù3Ć²\ºÀï’_KuqMååK:ð­©^¢ ¥AmºçAR*wCÆ™^Lx,)â|Óƒ@UQo~u¹úÑ“ ¾©¦ (—‡^8T‹è›V2«™·ð8¨V›®¹BD™S"©Äƒµ¢œ2q^¨Êg%òBŠk©–åÉkñê¦õ.0€I:Ùâeç7¦<3¨÷+tT‘ÒÁˆ”aMÂÆ4Ÿ9J4îÃN‘û^ŸÏBñ3¿+0j/öæm± —ÎÞs{M*¯}qˆ­NÌÈ¡.û¬Ú½r„ît -…Nnqº F¶ñ•ânB³›j< ÐQ¢ÀÕg£žîü}MDeWY2 -qYö}Æ -tá”–(ÅGË :ƒd=I—ztš ¹_é1¾Ò³-Ý(vý`ƒ öù »ø„jn4ë~\¼Ä΋Æ"±Ç‹T=šÃ§"ò±bW¼ÐiLÜêG¶`:M!Djx˜°‹ ïÉýŸLýºÖ7 Æ=E¹\b—÷,ù[m8üÄvé¿Ž?T“„|÷âå‹rk‡g×ì) «¿vNgŠ*ÀåÊv•jµ‘c$Ž%kª=••§žT~­w¹\ã.Ü‚§ÝÂ7È„lœßßÝ8VSo5ÝӘ܎u‰7p³#%œü.œí—ž¹æ :ÙÅÅXöqíµI[?Ke|qÈ+0ð BŒ"\a´A%rªà¶µ¢§QM/J‡áÛ±³O9€ÃØ£þ¾Bî{þ¾üííó³óóço_}†\ÿW%ÞäHívO -TŠ/ñ—€ópn¯†þ…"öžj[¡R½#{LαÞð HÅQF;PÕŸ’‰¯õÂÕþéŸ!N"F°øYÕÍ` -ÖvlVù·MÑåS$ÆÞtâz¡áÿ³A{#Ž• õ°|Æÿâ€YT¬¯ÎŽšÅÍaƒž% Í}ƒ6è¯åØ`Jg`zîðS5˜Ì ÍJ££ï»~4î€F$5Ù0­ÖB«–*³Ïoûãò†ÿË&tÎendstream -endobj -5420 0 obj << -/Type /Page -/Contents 5421 0 R -/Resources 5419 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5398 0 R +5514 0 obj << +/D [5509 0 R /XYZ 270.807 575.51 null] >> endobj -5422 0 obj << -/D [5420 0 R /XYZ 85.039 781.388 null] +1438 0 obj << +/D [5509 0 R /XYZ 85.039 525.568 null] >> endobj -1606 0 obj << -/D [5420 0 R /XYZ 85.039 637.475 null] +5515 0 obj << +/D [5509 0 R /XYZ 85.039 505.239 null] >> endobj -5423 0 obj << -/D [5420 0 R /XYZ 85.039 614.157 null] +5516 0 obj << +/D [5509 0 R /XYZ 85.039 411.523 null] >> endobj -5424 0 obj << -/D [5420 0 R /XYZ 85.039 584.309 null] +5517 0 obj << +/D [5509 0 R /XYZ 85.039 411.523 null] >> endobj -5425 0 obj << -/D [5420 0 R /XYZ 85.039 556.605 null] +5518 0 obj << +/D [5509 0 R /XYZ 231.163 228.36 null] >> endobj -5426 0 obj << -/D [5420 0 R /XYZ 85.039 529.507 null] +5508 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +/XObject << /Im13 5501 0 R /Im14 5507 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -1610 0 obj << -/D [5420 0 R /XYZ 85.039 298.378 null] +5523 0 obj << +/Length 3435 +/Filter /FlateDecode +>> +stream +xÚ¥ÙrÛÈñ]_ÁòË‚UK,ƒ3©Tʶd¯\^…±äøaw $ƒuäëÓ× @r¶âr¹8GOOwOßšyðOÍ’Ðõt:‹åê$™­vÞl;ï/”@,d1‚yswñÓ»0š)ÏM½tv·ð„nêÙ]þ«óöç×Ë»«Oó…ÖÚQ©;_Äqâ¼ý¼œ+ç–W—Ÿ®oî®oÞã,€Eå|^âö?>ÍíÜ1ÐõÍ°ýú—7¯y¦]oþû݇‹«;K©¥¨J‘Ì?.~ýÝ›åÀÒ‡ ÏÕi2{„±ç*ØÞ]nh™W·ÿ´¨x/˜ñ©)©ˆ…0~ð'®a…^8yhtä*?~ò<9Ácß*ô7Õ±}«(˜)å¦aˆo•zn @NAì¦* ·º+÷§Ò¨ÈÝ€e0ûc¦\/HSÍ £1Q=pC ?]]6@ßlD¢à]Œ‰*©“òS7ŠÃYìû@uB4~†÷ïæ åó…xN¿•Á«MǃÅöVÍwYÂN¾‘m±Â¯<]Êfî'NËó æUÅãûLʪ_”µ\“Ïénå<”+úíäºfÍ·<ÏýØiðœà{ÃmÓõDöª!+§GAã‹+T ”X{ t­a°D²j0é\öP+Äž všt{¸!q˜›ùxÆ ß)Ü9˜1(^š“È ¦èåB@ò#ÄG<]^áÏ¿ôúíÕßö5 6~1ö¦>¢¥àåý©'>úneø*÷ý|hx\ivDÒƒ/„ë2]Y?ÂJ üâ63PȤûZÖ_×Ú{ðŇûꇢ5[ÂÂR®÷‡Ó' ‰‹²&A‚R ‚ØYÞ ¢÷<ùÍSAE´¢WKçÆ°³3ïGô™ã (Oa´æ¯ (ñ—é‘ *-¨aYËzÙá/èð–õÇ;áX v‹‰‡@ ‰Q½cz>«\G¡ÓðzEßVF1Ð/-¢qàlJ긾%kzdÜÅS¶ê«gž”æòms¨rôž )@•æ:Æ9+etzvüÞÐ9¸%ðàIÎ Ö}°©¶+›ºc¨A`«5†\YWäÑóïQ¶H7NÛbs¨2ñ¸P"½½5ØóòU‡z«§œ³qˆW¡qú©ÓöÍzÕ%ç¯ü¸Þº<¹CÿQ '„˜e_fU%Û,!È°P¦8³Šãƒ{ ãwHó/zÅ•¨fm],òbœ  m‹)-k "B_›x£ËqÆ^ïo>Ë`N—Ó8ëø·c! MÐ2Óá'j8_O=/YOù ø¹‡ó{Öÿ‚߇ÞO˜Cáútf÷ßð^¨žh‹l6‚°¹ÏîññE˨q|êÔ‘8Ôú²îz«4U‘3fÞ Ù›Nî»Ív÷™ÎsÇZ·3L„ð@oäÈÄ^ˆ.[g "gÓô<èØÛ:ÅŽ mèÙV¥U/E‡†—úÎݶh‹u3(bä\Ý.qNÛ!<¢²Œ®z(ªF¢XΠ#:³z‚‘¢&VjVÖ¥ùÌ̓u\ŠŸ—/=)踓x,áÕ²jBµæ•ûÃf"yâx/'ˆ<ëkðö¬bXòð¤‰Ýí¹9€ }z(zçAX……¥å ¹•sÝËŽÿ šHÝ`¾ËØñ1B*ëj +co‡§Eâ­`\Óí;ž@nŽIöéry‰Bfÿx˺¼€$°X•äé2²áé:2ˆcW«o×Ä#.bÂóš8àe"®‰¿l©¨ÀáAùK.óŠ, »ž`Á¿ìs8“ÏÃ3ä +à7Cª¡?ªš°&…­3Ûàà–„Ä>£¬}œƒ—ÈêÍ¡ÕíJCá¥IÎ_~azb˜K{›Nuâ‘+aÅÆC8±gz`Äù”ä÷±À)En%'i˜~”Lò +ÖGZd×r–“°ƒÅÂö´ ùHÝO° ¶¦ÓP°<"A†«çy  ‰AtHE²¹ÅWÐ1¢W`†q…<ô=±26‘ «1zŽs°\U™º§ëcÝtmó0„€ýeòAà¼Î›Aò>ÜѾãñq>ç̉¼ºgVìI–%ÄáXÄY jêD´;*B„Äs‡ìÑÀÿŠ}7œGÞ®†2BÊ}¸2_˜c© .³š ¶&nŸxëN!ÚQ<Ö€ +*‰Lìo¹/A­>öuä¥oMørkŠž#cRŽÍå`«ÛRF)¡T6Xo$íÁUJÙ4éR'K\¦w.Ë‚ùçt½”;JÔk¼¤òZ;«F‹4- ­á…ý5½NÙ˜MVŒ†¬曢.ÚLPÛ c+bE1 kÃ!˜ò]doºÚÙ”,N¹wÏéQJõ¬qÉÀU¤­lað—ó4‡ãÏ +Š0¿ƒÇQµ°Þ;ÕÉ]S‘Óáz·VY̓RR"’yÔ¹Õ‰¿CÑuã%“ƈÎel~ +ÿ\b=»·ÈžŒĽÏ\ýÊ?Sã‘·vYmR_ànŸ‰ô§:U}Ëq¨coÀʧ’³5 Ä^â|Á*œ-ÓTä§2'$âºSKžËÿHU@[ùÜ<–Y)µñ˜rí;r¦âªŠÌ<Vñ¥T‚âÆä|Vu êlgÄ- M°æÁ(é=iDÁBÌjܳæm†Â?lÝ›·ÅEIUŒlÈ ·uªÂ¸†þÅö´¤œÆÆ–mH”¢ÙG˜Æù“TœŒ Í^c!Z›6ûX.¦ªÌì¾üJÙ»ˆ\]×Öcs×A§C-%ÝéNúÓ„J?&¥ür«-3Â7©mÌ!<¢r‡È­áYFOµjc4¦ô#”TÁ`Ï¥ ]$€ë99]6¿–œ¸¢/ÊÙ²’s !wªAgªç¸nB¨ÉD`Œ­©á"Í}xŽ/¤¹‰É¢ÂnŸÚ†ÁInYà9ExºšOœ(®žj ‚”æ‰bÒ@®$£Ð,5 +]Æö…ÜÅ„L(®Eà‘†b¸ã%1”δ»qµZÇ‚œ§Â¯B€}[Œ­ŽºI°L*¯Ãéñ;ÿÀPŸ¯‡MˆLÍFÈãÚ6‚ØÐíM®~´aÓz8|è&kF2«x|ÛPƒç¦#ˆö)·¯|§ÙKCÅö· L¹æü¤ˆCÒŒ²‹ÒaçÐ ½kÓÊd]\ È‘ `äÛ>بs­GÒ®¾/F·£‹"±F£²&²™›åîÏ:Úx¢þCv |Y~øˆ£Øw>¼ýÈ ¨Ð¸ zL6Ò.òBP×Ö³Yï ÀãÏ`" ñŠ±?ò$8c 2MéyžfËÓØ·?zÕQ/¶~–lØeeƒGÍɦŽ³D÷…"\ÅÚ“ïÿ¼ŠeQýÙfŠ@¿øqÕMø‹ï‹ßVU乑–š®ZlMÏtúCk»‰çËwV¿Ìümu<~á;«~ù3ë€ö寬ÊO`‰©}ÇÂÒu£ø£ùƒL¾ú¤á ‚u$ȆñËg¹>c÷J{gßWÇ–C4½@Ç‹Ò˜žrF«mY^Ô3_¾¶_ÏùŠ1R”—Ü=$‰¾:j’ò·“‰v,5…“Ð6 ü$’C!`¥&´²3ŸÐ*É_±ËÄi±ÅÑÙI>±Ð÷·gÆLÀ!óJXÁ{Êß ÄæBœ¬âœ’3tõ‰,ù&Ài,}Ng¤÷# +ºfÝsü!ÛÁOƒS)ÅHÓ@ïÿJP•­¸yþŽçÁû²ªXóm‡ºÙ uÙîôŸ—ûÿ=æQ÷9ùþî³ï*M5dá?Ké»þêghëj7ÑétW7*|ð¬Ús}~_§B u↉ Áÿ¼¦endstream +endobj +5522 0 obj << +/Type /Page +/Contents 5523 0 R +/Resources 5521 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5483 0 R >> endobj -5427 0 obj << -/D [5420 0 R /XYZ 85.039 279.71 null] +5524 0 obj << +/D [5522 0 R /XYZ 85.039 781.388 null] >> endobj -1614 0 obj << -/D [5420 0 R /XYZ 85.039 109.129 null] +1442 0 obj << +/D [5522 0 R /XYZ 85.039 503.818 null] >> endobj -5428 0 obj << -/D [5420 0 R /XYZ 85.039 88.538 null] +5525 0 obj << +/D [5522 0 R /XYZ 85.039 470.272 null] >> endobj -5419 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> +5521 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +/XObject << /Im11 5348 0 R /Im3 4353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5431 0 obj << -/Length 3698 -/Filter /FlateDecode ->> -stream -xÚ¥ZYsÛF~ׯ`éÅPUc.ΓbçPj-s%¹²[I ”“M€Òjýö13Hrm*s0ÓstO_÷HL"øOLRF*›$©UšNæë³hò#?Ÿ K1µ$ÓÍwgoŠõDDae“»e·Ž µQ“»ÅïÁû_.gw?Þ\L•RÈ‹i’¤Áûϳ ÜrïìæêúîêúgüÒÐ)‚Ï3þts‘ªàŽ‰®®»áË?\ò— -£‹?ï~=ûñΟԟN•á1¿žýþg4YK¿žE¡ÊÒÉ3´£PÀðú έì÷êìöìŸ~)Óž5&G1Î2iNK.¡Ž•—œ„QfÆ ä„¡r’˜(4‘&ÑÁš ZàW›1QpUÓæ«4Êê„'AûXpcv¡DP7íí|[nZîû°-ŸŠ-·ëŠsþy‹¬Jø¦Ãºí1Iê4Ivš·Ž†x¦§ž7™qðv¹lÝÆp8™é`¾Û@Oƒ=ùZ‹f}!“àGU0Çþz½Y¹Ym±ø؈Dðr!Ó Þm™p±EŽž°¯¿zÉkË̸ͶØäÛbÁcKè¨-]ûÈ á|U.Ô6v°æß;h÷¢Aæ¿ðVÃÊ(JÐT z0ÇneebžÜ›†?-øa‚5~ìš–‡6°dâ8Á²Þ®™ Ï‚(ªõ\¡ljç•m”•;-é ÷µüûTæÜ8ŸÑJf&¼©Þ  n±' ÚsT@!‚ŸÐ"ñ õš·ÏG8ý¶\Ô¸ÖsÆÚÉò;¶çû­?xS0 ±C¬ÏÐa½Ä[´ùœµ!g’†%Â×¼ý~_sÆÅiÊDª®£™öˆXwûMÈ4Œ“د„üý‰ä`G¥C¡NoÈ$‡û lEe¡IÍ`¿º§•)ÒO‘ˆþE]=~W‰ ©_¹«ŽèÄ]Y¢×îêÔ†î®ö÷½«Þ~ä}X 픜yØ9 -ÓÊ©®j®‚ Mbëp>‹$~áïûë®hÚ²®ŽKÏ@°HÌ+ÒëˆNHϽ&½S:éíï7*½Þ~KïZ2Ñ9Lh“ €©WäZ¸s^[™ý§®­u ïÄÑȺ/æ툵°2£­\QdE?G³Â0³›8Lýð #kª0KcKñ¾®ªâÂàöãëáÞQÿ™há<0zp§}Îqt»þ$Àv¾feÀ–Çüp?0Ú°P²BÊ^Û±üàH"äÍDªXÓ¯QéHW‘&gqH¥îgþæÅàÂnW -Þ¹¤Ánr»Æ®H‘'¡ãö–®ö–Þl ±&ØS¯‚ù4À¯Î;eißЯQèŠRçIW5]â…‘x Të”pñÚ]åùlp¬æÜ^˜¤’A¸\Ö¨n‹bûŽ±ñ'8¼‰"¸>´ÿ.¾7Ø-‚ÍsdÅp${.1ªc‹Zñ}3qÎ#U¾vꃽÖpXøˆ¤H -`LÜ}< +×9¢¯Ž–¬Ï’{”]~[lˆÊ `qä•Ðd Wp"©¢lK‰[Bo§p_ÎXŒ¿Phv lø÷œ¹¬½®Î÷}šR"L#1‰#äé7d Š‚óXÎ0ukM{‹z?¥@½íwDÞ¥ˆ Ÿ¸¶¬!Řâ™1—móXoÎÙ&AN-™Ð›.Φ°œw"ˆ¬è‚¤„HË!.-"v¤Uø›“ëàvÓ9!îp»Yt^BhïOì -¡âÞsÛûu™I\~£ ßš/É,s¼RB¤'#ýb]Îùqè3B‹!ø—YÆA§TÅ3“nz°µËÚÉ…5Ü=¼ -a_›Tšê(q‘WGàî…ÊX‡&s[UL¡Á[‘7¡úž9Ò±µ0—6#¦7bII¨¥[ÊÚÈö…ùè±D2ÃÆ‚®eã±™Í#pÐÀ`‚dˆ Yä40¹ÀÕVùýÊ¡PP-u¸‹†ž¹ a£Œêô¬ ‚ÉâQ»£+Maëøè:4+‚u¸åÈ÷ì×£%•éÊÛo"ùzÆ0hÀåÅGÃëš}•ÉU&×'G1±:ù:Çž\1M¯M tŒQÇÛ«µ˜|¨á¤“ÁayÝioav6i_M ¡)™hà(Ñ’ évãólò/À0úD”'fè‡V/Ø‚œ¯X•9ú ×Á¦ˆwKøßOB_»Ýrëi n@¿á?ëñB#¶ùˆ9Eb$¨†©}‹kçsîìPd’2”¡Æì5ao‰”þÂï¢î0VS½±½Î¨¤ Û†=j¿]ªu ¥àírôŠm=í³ÂÖ°Î[tuJ§à¢pq²dîXÏzò\êÄÁ¶jÅ=ôPz Äœ7@Ã♢Âú-ÃiVayžf7'ª‚–^XvL‡õ%>Gÿ¬M4ÄYú -{R`ƒÀ._Y=À¾~y¡Gêp(¶}±Wu¼£˜¿Ø?›}àFm·oÑ1QÇÒvt¢><õåÂ…Ž© ft¶fQAª¼¬·LE!~÷ÁaÛ`ˆ…î;ÀH”,j¸>þæÔ-÷ñ¦q¤³t c*þuç6ØÙò×vŒ½i3¦æÆìitxMŽzkç.c·Tvöçë÷v{ñÙN¡" qÑ­ªº -Œ÷ݾoÓ‰€&›ôüåßp¿èãEÙ]ÿÿ˜Ð÷å*L³.k@îIœL”IB`ŸqðZ΃°±Ú´â7ÿ€ÿo0°7ØñscË-\MA·0{û®jóâïÀ LH¦Z…1d\‹ô‡¡–=`‡>7lJÜ»PUð—Ž©…ì O8¬EDìpÁÆâ§/>´Í0ÕlÈ·T±°N›*ÉHqs5ãÅ–»Ê´h0u…¶Cê‚°ýºn-$°|AsrNÚ¥˜[þ:gÈÆ¢Á9öš.Û+ Ó±Ô¶ÊT0YÎ}N >¬Jò˜Š‹X) u¿lk·|æh…‹Â»UM†#‚¯èéÊ­Ûޮȥš§rU<ðEø3ÀJëzOعEŠCx„ZƒÈžý³åÒÎäZgÆ0ÞÖÃ#S \`ƒÀH0ß·eî.+7¿;\»%pP\Ùj$+²ûÊòªù˜¢ƒ‚ ),2åü„Ü×Pmp—ºuµ~Û€æGÔEJ€n0ˆ¼Ô$F+¤Á¼êôcEæøCŒ„#§&Û{ˆ‰íCÌåS].,¤æªLg Äc ¿^{Œ¹-ÚØlúO3OüñžãQÅYÕ†5x_¥O3ÜÑ‘àeÌUÌ[FýÚmý?èÝÆ9_îŠ;˜ŠÝï\Ø•®ÐƒÍÜ5ïB6PÀ$èv¿*Ö4fCðǺ±«üUßÛ‡ˆäþ(œç¦‚ý[±ZÙý›zí*0wAšü¦1Õ¾)‚è!±&.4_­èî«ÆrŽùC(¡]¼M|e )èdõ½/>®îvˆŠütPp¶oLˆÌä_¡ÃR®a<ÇYÙËøŸOÄ/¦xøõ°_k§“§ôdê$qÈ»çFƒ -Bƒk[æ6©§[Õ€¢]iG~–+x6],6E¾˜6¾E'ÁÒÖÇ a /<Ÿ°6Þõp±ÁŸÄivp™ âyÞùãÈ{ì¼Ey¿Œ°¸-;±ðÑOˈüð·è*¢÷Ìñ™±h}ùøÅz€H¢¤ •·]Í‚rÉ”]̆ºá•…–„ßh¤xæÆa?¼ð´OU8#H ¿aM*ü«hïYð»Ãtƒ“È^ ¿öîzÅS9GA&þ‘/¹ª[nœÂÓ¢Ê;%·Ù…‰Òžkî¸Të£iNFÞûå$ìø£1Ø<íêÑû὞6©"aƒš´¯,RÇ›˜É#¹ì³@@ª.z£YíÆ:±Þb[¦; )]=9s„TY)íó$w1Øi-ç wn¶ìi{úŽ0zGÏ®Enãci»{w¬²"¤ µ§_…zDÇ_…Ñ+¯B'7´¯Bû½ -õ÷»|âÇi„>1—üÁ@¹šÜ¬æäb¯C°Xqø„˜.´÷¹éP,Ý!!üdoh]þ×¾C-Ñm`ãvƒp§ðÿ,Æd MÿÈ:¸Â:¸É1.bé êÁS[QKR¸ 1öGc/Yaâߥ>mÚrŒÓ±!_:þ(„d»Þ¶ù}¹*]bú2r|¬-¥Â¶ž­T‘°¸írQwH\éWòœ5°Q,çT3¨W^ï;šãÊki^ÑÝS»YÕÝßlLs{›}pˆƒþN…ÒÉã—Cþ©œ¾ÌòòCipU- -V7B‚‹¢šÓ×;ןŽ]ž‰÷uhXvïF#±§ƒ{ÇËbÈRÕ7Ïjq*ÂTêÂÿþ‘lsÌbL(“¬÷jµRß Wzzå)¡:¢]‰¥zåï :šãÚei^Ñ®S»YíÚßlL»z›ÝØ7Õ5C»jÑÏU ?)£OøŒ¿ª¾»H’`»s¥Ì˜;^¬Ÿ£žŸ°§®lôy¬PRæ·àœ Ðý`hª³8¸Î}ñ©¿ðv7؆ü­ñçVIÜAûž°î^0ù²ù“š,‘Ù»¼ÀbŽów5WcGÞãU˜%.ŒàßP,+Cá†?ù%ùOòÆί $¿Î¬¿±Äq#ÊAÍ>ï@–”pc]äb3À¹gcâȽÆ Õ9îÊvoÆŽ•…Jöÿô`XCO7UÊÑì:šØËù[qéSV̾Ց·S7 …; ½œ*½^ƒåÅTø? Xendstream +5528 0 obj << +/Length 2812 +/Filter /FlateDecode +>> +stream +xÚÍYëoÛFÿî¿B +”Bšûâ£÷)m’ž‹ÔucåÒCÛ²HI¬)R%);Æýó7]’²)_p¾‡ Ö>fgggg~3;³þ‰Yb‚P¥³8J’ÙjwÎ60óÙ°¾%ñG4ß-ÎÎß™h& ÓÙb=ð16j¶È~ó¾ÿûë«ÅÛs_)å‰4˜ûqœxß¼š ïšG¯>\\...Àž†Aá}¼ÂéŸ?Ìå-˜èâr˜~ýÓw¯¹§‚pþÇâdz·‹^Ò^*E1ÿ:ûíp–Á‘~< •&³{h‡€éÝÈ­l¿<»>û¥gÅszÆ«¦´â(|8Y*Íóš‹D #ÕkN¬RcÆš3a`BMš–:€ÓÆ 3cBÐt®PgQì­–7mŽÈ[–%7>UVÏ•ðîç¾ðZX䯡zÍnÙuyÆëþ#¹¥lxìêêM{JV°g8ÐÐ…™0 *bËøˆ‡‘‘ðV((;Û9¶3ø[æ8"ùdØh÷ð›xùÊÇ«z‡?{¤,`µL½ŽéÈzà(¼š~•×r_Ÿ"Ç…ïw3–Üî¶vËòK¼Ã…!ñº4›¼±\×uã–À8ñ+ìÈ®¬ÛîzÕ¸e‡*Mùm%¥³ïj:I–—-Ü®–Â{ ”w¸’xU¼K±f–K>ÂÇË‹_ÏßtÔÃg¿(é0­hPÒ.gBfDJd9áD$" l¶8i5UÕ¶±]â¨yìrRAWÔUž1QM:° +ÔMѱpÝÏ×VvwŸE;¥«àe +U†¯œ7xVÏj.c°=.›0‹’=.GzxÒ0Ð$š4&õ-µÏ4Q +`³¿f"uš*¦µIæá,4p~±bö¦éf#-[àËqcìB¦A›™Id +¾àÅ<ÑJK¾–ƒW·<ÚFÁ:†ÈÁ]{ˆäd¹¼Šì~iâÛàq¼üM•£jím¬]ýX[*I#T/2ÅLœh6–âÃ(z:jDNjPcW|ÌÕ°íºý·çç÷÷÷Áê°‡@ÂaRPf2vˆºÙœwyÛí÷Y°ß>¹])L`@ÿ&J A™Nb?"zzYÓ £†ÅÇ c_ÖË¡û€ лyšÚ¸0Å?é¢Ü!÷,(Ë^›»‹ƒ…Œ0ÚÐh{(»–²¢Ý—Kñm2VXŸñ¶ØQ˜Ì3² ¬åf¡¥“!“ E¸Ä¹PŠmDu€ôÖά{6 ¯üKy–2GÉ?»b5µ’ð<Øc4ÃV¬,°ápQ ü±¹,'B-Y°„X€(Jª« -m€’‰xâJ=ÑÊe+ÜÍ+\uSæÙß`ÔÏŠpyœ_KN…“{Ú™%v¹ˆÛ kÈ nJ»¦Ã¤WWÞU>q0È êC³²˜ÞnëC™1VßP±丮½f‚cÓƒßC¡J€jOi뼶Ž5vš@èh6ÖÀ4ÆÆ3¿f¼(v@.}Ä5b^Lq5®À- ×(Q´µÛ*r}ï UŸ-Ä ^t`6Aí´»¡'t +†…G€IRVí€JÅÒËܵÝ«Ü¥‚±²YhSÞJ÷µ)*w½0~G/iÜÍﯴ¾s +ÌÜ{wµÇŠ¥Åbw?Àm‰9ó=nÇÑ«ehê…öf­¶µû«Sp5rÃÿÞ§ÿ?ÑJˆÄ|93ù ¼’ò?‹W +@ñ2f‡AØcÔÿ0e1>R*J9»Xcgì,]ŽˆÒÇ}œ^;T#ÚŠyldÿ¸ö.wÏ(vŸ+3½'ÖSßS!¢s×bÌ]ELb˽Zo¦$Àò¡‹_s¼õ?ÚÈf'Ñ‘–ðý^-wùT°A¤\À„W~M±‰lφ€–‡ìb›ƒYÚQÙ@‡ +ž ›nÇnòÀÃ÷G™u3ð¢Ò&RŒ³cweÄðøq¢Ì['/{0)Àžh|þ¶ë}²¿s|Ëhã½+lðPìú`D·Ü¥Òüò³ + %JþšDç’‡É<|³ø,˜sí§zÄ8ZÎohN»mÕ:=øPöž“x·¤ÍÉŒ{„Ì/Àù£–¾8øÈ0ˆEúli\†q y«“µ‘è>¢¸Ú2UûÇš)•Hmý¿åº¿M,`l=.êWuå_aßADg‹ýÍsN”²D"!£gO5¢9YðôÆ£Š¿6’ŽàÓ´Q#ÌA«6z\®á +üäiWÍrÝ ÖLcSZît–é–ƒBvY Râ·€Ž§öœ€Su*OÀ³CvH{€ ³›ƒ|Ëf*e;´F×YT\dž-•E¹¼±¬¥ì3[êPUÚNUð[ÃØc?Ž0œ|…άÆaêáßØ­ÿteo·ÁÒÕAi`kc¿«¼ QYpT>g2žù¤q¬EÌpSïž> l¹3äÑ©-ÔïlogmÁ‚‰­ÝÃTâU=—Ÿah[ïûç=µÎîÅŸ"nmY:áÒsÝ<ݼ¢G¥(½E8Øï  ù¨ Ã[w'1€£gÂ& ¬ÕSÖ@æ«;’Ü}Ú²•o÷¹©¯”Db01ü|B©ÝPáš?¸ôs„5fú€ŠÝ=¿yXõ.ÂŒùØ úñÈÇ_Áèdð›Ã7 Ñ“(ßÛo)ôe§ß¬~ôÙŒ|¤ +N=)`¿é9TÙP±~ျ[vãÚ{5|¢rw‚,šm‹._u‡&§è¦½ëÎVý8Ñw< N  +ž§°þó•¾èCr˜Z‰J§ÓHx- ' *N*óX^£ªÃ>øßBöeºendstream endobj -5430 0 obj << +5527 0 obj << /Type /Page -/Contents 5431 0 R -/Resources 5429 0 R +/Contents 5528 0 R +/Resources 5526 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5398 0 R +/Parent 5534 0 R +/Annots [ 5531 0 R 5532 0 R ] >> endobj -5432 0 obj << -/D [5430 0 R /XYZ 85.039 781.388 null] +5531 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [388.516 578.594 482.144 590.587] +/Subtype/Link/A<> >> endobj -1618 0 obj << -/D [5430 0 R /XYZ 85.039 761.463 null] +5532 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [128.678 565.045 216.579 577.037] +/Subtype/Link/A<> >> endobj -5433 0 obj << -/D [5430 0 R /XYZ 85.039 741.134 null] +5529 0 obj << +/D [5527 0 R /XYZ 85.039 781.388 null] >> endobj -1622 0 obj << -/D [5430 0 R /XYZ 85.039 255.079 null] +1446 0 obj << +/D [5527 0 R /XYZ 85.039 761.463 null] >> endobj -5434 0 obj << -/D [5430 0 R /XYZ 85.039 234.489 null] +5530 0 obj << +/D [5527 0 R /XYZ 85.039 743.459 null] >> endobj -5429 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> +1450 0 obj << +/D [5527 0 R /XYZ 85.039 207.299 null] +>> endobj +5533 0 obj << +/D [5527 0 R /XYZ 85.039 175.081 null] +>> endobj +5526 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F65 4136 0 R /F41 2994 0 R >> +/XObject << /Im11 5348 0 R /Im3 4353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5437 0 obj << -/Length 3335 +5537 0 obj << +/Length 3684 /Filter /FlateDecode >> stream -xÚ­ZmoÛFþî_!”*–äò5w(à:i“žãèl½CÛ´HID(R%©¸þ÷7oK®,ŠNp¹;»3;;/Ï íÎøsgq`;*™E±k«8ž­vÎl3?]¸B±’…AóÃýÅw?†þÌuìÄIf÷ëaŸÀö5»Ï~³®Þ].ïßÞÎJ)ËMìù"Šbëê—åܵîxtyûþæþýÍOøæàký²Äé·óXY÷Lôþf˜¾üðÃ%¿)Û™ÿqÿóÅÛû^Ò^*A1ÿ¼øíg–Á‘~¾pl•Ä³Gxvl¦w §øJÞË‹»‹õ[ñœ?ãUcZ Tl±:U‹jqUTÁ, -;p|ÒËrîÅVÝvw«¦ØÙ:>曦øŒ3yó»¸ÏÏ溞­\o©ÐN‚`T$M³0ˆX$ó¦\/¶Ã(ìwB‘~wÜè„£òmWM3d’S~£*0ø]mëù‚´#[°¥ÐXšáÉ!ÒûyYÍô”Ͼryài?ú‘q¤®@®õz¾ÐzS?VøZºIÓ i=+myÍ]½îÖ´ߊª«y~Ù°„÷Êîè8^€u"]7Æ׆+ØÄõ¬n‹’¹ÊÊòuŠ¢—ÝÈ1^âÃA}Ô#[BÞÒ¹öeº’*/²žø÷Mþ¹Æãáà§b¢-Ä¡H å¬Q Ÿr`ù_u‡Ç\ñ+èOÐÁHË#Od¢|q¬ž,Å‘'¨ò<ã'ÔÒ¯pv›V›œÇ‹Žà ÷'“Ú±6¤+’š%°q¤ì{¾ ’¬>ˆ“¤ú·,ÉKèw™áùȪò) -“ÐVN4í@ÑyÒD/8Ð$Cq ~cdò»«wyWìH‘xg^`Ü™ç[«´’Ôÿ–¼à¼Ã¹^bûž¶–%Ä&Üâ¬+ö¨òÀ±®ÉªÍ!¥[Ö#ùç¼³?/¡cÙ¼Ò÷Á,H(…v[µ9 ^¯YÔ}CWXæ;9Q×<º x ã»7"Bb»¡8“¢Àìr ÊKïéî~b'‘+«Ô »¢áu[MJ9V™v93ao1Ó-ùù'xÞ‚fiÞˆü0µ×^„+öÂmÓ -­ºn9±®é…#NÉCŠ$­û;vn H|ƒäjaLöcêM2Î;Ò#Š‘¿èZöYß‚›mN»VO3áYLó’cMpÓ~õŒÙ¨[ Ìî$Êš…çØVäÚÿ3B .z$98˜ Â݈«)ô:åi1˜Ü\ƒFA;ˆ¬wä4`‹m¢9ãt* - ë|1, -f -!9û‰šÄ iÓƒYßV~¨ó ™€çÚ¨Ì炱,Àج÷UÛ¥˜KŽêp– œ+ Án!3ÂQœ&E„ïH8ò9oxèÇ¢DÃ…»´:@˜»”—`|hQ“Õ†,ÞKˆìD1mö@~±Â%E^uú’ÄŽÂi”`‘›L«Æ :¯MD¸ñœj&Ù‰j¦¹‰jLnTW ‚g ÅÑPC'?BŸƒ1ÈVs(x; ŸYÆ¡Žá%LŒ# ¸’ÀóÆêJ¥Ø6Ó>ëÀ°Ê¥¸›çR±èòDE1ï!ûiššaQßk{ØÃ)`¶n0‡ ÍŸ¿ØØ þÒÅD+Dx`ÿìÅN±Ó;ÉM_¬Áíÿr±mÞeØY¢µG® “­,§B;Pìm¦|û¼©©ŠÚð5L üeµŽœE+Qõ(‹Aà Ãp[Óvª}¸¾†J°£HŒè…£9@’eäšåž‚ìj4w¾:Hwè%•&ŸöyâîQáM>=J¶ªØº®Ùà°ƒÜ~BŽ?¡/fú‚¿a¶É±"Ìø¥ÕiéaAǨwphIîÏï ¦ëë:‚¯ó°Ûãþx±y3V{Džźrývd×ÈvïÙž ÖœÀv<÷HAƒÕŒqS‘É·jtõüX©¢÷Ží@uá†_­ÏŽý—öôežå ö„úŠh‘}à ÀIvH7Úš¼@Œ'wTæá“H® ž²ýPïó=œ ¢þØvžo®N±«ºBWÞŒì§<»oM~?†ÙÁÌûÏioÿêoò€yH% [k[—Y¶4`L+G_&iý-H4Ä}(ø$‰Ùlç–Ÿ€0@(!”sc%²ùGJÇ8/òŽZ0Æ0qY×Í.í -ÄŠ8¦9õFˆ~õ!ŒõÒ}ë¦îæ$Â;\5H5Zz#‡¾ð$.8AYØÀù´ìó{šQî:µÔü¯‚€Š,iŠz*Ùá!+ú-V]=zmòŽúdåx0zÖdž„`°þlÌ:·>5CoÚæO™òU¡Õ=”‡R¤/Ć$&RbM‰æ:è2°È™ªW.<Ӷ؄a ãy¶›£Pü^ë%w<ñë½1§„ÁÈÒ \~ÍÁ¡¨ UïiºŸŠ÷fógá{º”$¼QQù‰îHƒŒ•RZ—wyãEË¿%a¾/xMex]“o˜@¢•:ªÎ\ß·UJQPôÅüõïºÆ -#0¶‡!†ørš|ý;”›§à]X“a }b(þMÚ¥_CUWëbó5+Þååþkè¯ûHù¡®Š®þ‚“ã'ø²cºáP÷Oû‰£žd²;ì s ‡¯%9l -µèíh£„³Œqk—•ÑÁÊwºåÙ÷Áû ¡hŸ/u;Æ–#.~ 4+ÝÃü¸CI]–ö¨ë»Æì+¾ºùåúú•=rtBr1õ\U¢¤!MP·L|.î;ž­òþ«AâIôÖ¥á#Q†óÐS¾—Z%øÏîä¬1䢹½"´Å°SƒÖx­«²¸c¥ºG½—O"ŸK>ë*-ù}oȃe0 >rÒêés#Ï2ÖM\ù¯‰O’7pŠKxÐÇMùas±8Šö)I‹QÒ?ñKßoCfª#I€œúG…VV*ÛbH‹cüï*NZ¼ý˜Œ/'óšÜø:X¼hó¡m>V<˜òOˆ]MðÂO¨ôÂ)³+‹#þóFˆ%Là߶býß8=ÔÃÏŽí¢gg&êøŸþ¬Çྲcu‚¸Ý~¼¿ýxƒ_!Ljïó.ÿøi™ïžn?ŽËo?|ó–¿Œò—¿Üñî~ t ¨ÊÌß/~þÅ_làJß_øÊdéâ ƾҰ¼¿:Uù®.~ºø×€Š×ÂïšãŠ…XÁͲ zs±Valΰ*Æ.ç"_E~Hœ”°+ +3äövÜ9Ž‘wȸ8ñÞ—ÀŒª/Ú²ÞòÌÛv½+ûbÝ[ÜR¼Äœ0Q‰_'w„!ru4#h¨ØgAß#}a˜x릕Q󈿱×Û%&§þãëp [èž;¤»/öü]vüû 9-Á]ãÝ@ÿR‡¬ Š@p$èf×t}·n‘I‡ž¡'—ˆ€û‹j™†ÞmÍÔå› îêËF&ú†O½YB‹¤êB]!îÅÊø™JQ@%"Ö}–Tê{Ç®À~^×ì 5ýn‰b‚µg´ËF."Ž²ï¤Y‰÷T£n¤‰÷o4’æhwG>ìnÙó2HaM¾~“ƒá\(ê Ò&ÍÓ{$$ǵgž@êr<Ž7ðä¡:¢Ä¶DöFˆ«y­°€Ú#‰!aFÙ“n˜0˜ÜnÆ©eWè{»ubSç‚âfó>ç‘E!éâû¼—MHd½qÙ {,¿‘æË,ȉ×!ò'- ÕiŽÝŒ¦™(S~‹ú|¸ÀïÐ#¯>,#8¤›S¹TEq:*]6ûŽYÖ>³…:QqNØF&²Æk4{¶u<êOy=²‚ø²Íà/é(2®EޯŚMkÃ˨Òø›“äb8ƒUx=cXZ«(°–•ûf×Ä 5"ÝÎ]È’ñª±± C )ÚÁÚ?Îo +и" >M="IÆÛR´–ùÄàƒ"=áÓ‡Û°åSXA_YÄh/ïaäˆFl¬©4…{oIŠð!ÄÁÖ„ô–ûCUeðñkUÃÐdpðKDF%{AC²èʇj\!‘9îçÖxè.§)9§-*°)_Î’–»É¹èYÏ­ŒM%·°A6ø^Ÿ·Û¢Ç1p)ELE‹úÄÞ£‰ èª yBÜNŽ‘Ýß±cÜ1²]ƒxžøã1’Λ2’6#D˘›-^¶Èk!”—éÖ£¨ÚnlbüˆÒaBdMo5˜¾îñ~&F%Dïæg`à"í“¡ Æø)X¸AÓ?#œ 5‡S®óªzæmŒ£?ø3çŸ'ô¡Mû±{Ësg +à“$ìtÉ¡Ô#©bª‚Nµ÷\çïÔs¢„~'| žRÙ­A¢|Hqpëí#'\âaÔÁ©ýcˆd°$ïPH¬äýOÖU‘nz¤Ë.%#9q.: àt-®¢Î{Üjö¥¨žg4ÎÒ ²)NBîåÌYl(LlŽÃ¢59ëÆVŒmÈ'àÄ5C´y–Á`dX<&4œ» ¹’ ¼Ëoñí€Åz©^Ò»¿Pd80¯èý©Þ½rà¨w''Îës¢Õ» ó%R­öùé‰Þ!ÄDïp"gÈË6ï&á­åùM+®±½Ä‰Ì{Ú±¤È±È|`éù <Â¥p[Ôåkþf·ˆh¬Ôñ¾áßœ†¬ó‹h‰8¾Ó8-™ÉÚª/š¡Õ)×é*Iy€ñB€Ü3áŒ'ÿM®bð9¶2’ÌI|Á‰©JåÂK,³¹ðñ%a†OØ‚{N,§¬©ãXrÕCY9Ùâ+/šùìX ðë7^}*á,rüq0qü)Tâ6 Ý"Yqæ­vüû_ÉŸÈ1ïm[¸Ë ‘Þpk K×N܃9”:Z"õ pãK¹¡`ëQhq@YónîòI¦’ÐfBï— ªS„©v9®1}âá ;´AE`³3Èé×+%µÈá،Ժ…ºk¨èu,LÄï!¯Ç ½rÀg\÷ N¤éִ毮‘o9Ðí)qa`T ™Í„¸Óg y¤SLN"°–{òQ(™i[Å€ÁºÊ¥¸fu„ãLªâ(;I^.Èc°¾i“s¯“hò¼"ëð¹+ÍŸ]¢T(F/MTì‹^ÂDìXbl¯p(ìê¿Ë ùd„–Ë„gén“úA{B” Qö¼soÈLÆ>0ÉÈm§ g&!m4Ã$ ½ï(IgÏg“i¹5Édxͨy0¼—dÝŸØaãÚ¹˜˜ +Ùü W¨lûƒÓíjð½Ý±¢P§Qž†ƒ²ê|³:o`ƒÏˆ³ña€œ#Ïí¥»añW<}ž?ð>ü(oqóœ¾`Rþ { ² ïbÈø(¾K] ;Ûc5~Ð3gÌùWž+刂òé +øfé-…D.'dŸË̦çæ¤;‘‡É?S×$S… ,¬Ìy%ð‚€Úñ¬ôp{LÊ)íÉÖ}¹'0uú*+H\“Ã?'NÃþê‘þÐAÓÃ-`íʽM+ ¦ŽâV0íM7ʪ´R +e÷†±™8c•)vTl«3d\x½ëÃŽ$ˆ<E0èzüë´rÿêowÿ|OÖsîäW.âXþ`†þºŠªÎ¿w¹l/¬l¹Ó„S²E±€ÑÍ=òŒx 3@0µxp¶†&/ó}¾¥ô%¶B¶°™iZűJ2Å3L0“Øàh/ß–Û¼lå½mã‚èâij;(Ô˜> endobj -5438 0 obj << -/D [5436 0 R /XYZ 85.039 781.388 null] ->> endobj -1626 0 obj << -/D [5436 0 R /XYZ 85.039 636.493 null] +/Parent 5534 0 R +/Annots [ 5540 0 R 5541 0 R ] >> endobj -5439 0 obj << -/D [5436 0 R /XYZ 85.039 588.965 null] +5540 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [243.069 432.524 323.966 444.213] +/Subtype/Link/A<> >> endobj -5440 0 obj << -/D [5436 0 R /XYZ 85.039 548.915 null] +5541 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [339.156 350.622 424.694 363.524] +/Subtype/Link/A<> >> endobj -5441 0 obj << -/D [5436 0 R /XYZ 85.039 519.09 null] +5538 0 obj << +/D [5536 0 R /XYZ 85.039 781.388 null] >> endobj -5442 0 obj << -/D [5436 0 R /XYZ 85.039 505.541 null] +1454 0 obj << +/D [5536 0 R /XYZ 85.039 761.463 null] >> endobj -5443 0 obj << -/D [5436 0 R /XYZ 85.039 491.991 null] +5539 0 obj << +/D [5536 0 R /XYZ 85.039 736.911 null] >> endobj -1630 0 obj << -/D [5436 0 R /XYZ 85.039 368.071 null] +1458 0 obj << +/D [5536 0 R /XYZ 85.039 282.157 null] >> endobj -5444 0 obj << -/D [5436 0 R /XYZ 85.039 344.753 null] +5542 0 obj << +/D [5536 0 R /XYZ 85.039 248.017 null] >> endobj -5435 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F20 2865 0 R /F56 2890 0 R /F76 5447 0 R /F35 2880 0 R >> +5535 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F62 4047 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5451 0 obj << -/Length 3169 +5545 0 obj << +/Length 2704 /Filter /FlateDecode >> stream -xÚ¥ZmoÛÈþî_a(LÜåkP´ð9Î%A⸶ܴ¸Üš¢-Ö©©SŒþùÎÛ.I›JŠA¢åîìp_fžyfÿ؃?þqºžNãÄwu’çë#ïøF~9òEb."óÌÏ‹£ŸÞFÁ±ï¹©—/î{=¡„úx±üÕ9wvµ¸¸žÍµÖŽŸº³y'ÎùíÕÌwn¸÷êúýåâýå/ø@§ïÜ^áðçëY¢ ½¿ì‡Ï>ý|ÆOÚõf¿->],ìJí`U).ó÷£_óŽ—°¥Gž«ÓäxmÏõax}ëtÃ@Ësutsô7«ŠÇ‚cž5u*¡NÜ0Ñ/ÅÇâûÊÕ¾:ŽCÏ ½€ÎåSSÃNÊ®ÙòþîM#ãŸå¶„ñ?f*qŠÙÜwdt=S±³ƒ‘;;™Rm¡‡Ä²%´žøpîfs.ø¡¬í¤¬‚fEâKV°ŽmiVÐ5¢v‰ÊÊúAºW¢jIÒ¼4™ÂS§¨ZBi¸8¦¹§˜Ò®¯¯Îy¾¬*ÙxVV(ùÓÛ0ž·†“Û¢[âFK\ù3­ðõ43Î }ׇæüyBuêÆa,ã›- hêŠm­‹ uQ w'Ò £I¥ -®ØÓ"·Äã¡õRª\/ÑV+ ŒMF¹~¢Dà⛹Þ|×Á¯R -Ìäå‚Ä…•I7Ewe6‡S <º¯^èÁ_âQê*Éy³Æ9ë¬^Ò-Î5¸BÇ|!É3ÙmÈΖYg¯ž—‹í ]X¶Òc±¦[ûÉÈ2[Ђy ªÄ2÷Øâ ”%k±gè«[°åʈnH­yM„ÎÂ-›8Œ¦N7t(¶(cÌ/-ö¿w8M—˜çÍÖ -å]%"ßuÆö¦zO³‹NÌ›[Yû|Ç¥¥O8ÍMºR֌ǫ“TÔCWAšqstÛ£·ÉÊ·-ÏAC †ÌY@ e}C«¡]bç=4 `rs×et *¨—ª²íX¼¹Çž$ælyS@0¾ö¡…µ|p¾dyIåÜ¡#I”þnÈÞ+õÝ]£ÇûH§ƒ"Z3„>€W+°Ì0ôœÛz Ëíà¬ø0¢X.[p) f“£‰”EÝq÷žÈþ¡}5ì¡8´»Qì½Ìá˜ÁÂϧ=,V‚eÑ3äSù8ŠoYÞM ‹ŠÝ85BëÄæ2Üšòœ’noí”zЊ–·:†…†%s¬Šl˃wèÑO"¸*ÌÜšhÒxH0åö€•u.ROhÍŽ³2ôuc(æÍø»´Þ^ñ"†°DV -‘ÝK¢±•²7À¼@'¼’-F‚‘{:æM5Öõ2£¾&oy`í&Ë ±Üy qè]±í¥èÉøÑF~~•<±{isã å¦Ã—!ü Ql”ÝLÞ;_fI`öòü¬^¢fEë¦×Ìï)šGëø–À£…á}?xƒÀ J‘že™sD yfé-²Ç–÷%†”8û2S•D®¯R1ÀzÂB‘²†2~‚›ŽBç–N牵[«Á‡=?T%Uê FGÑ¡ÈÓfÈņ’o~Í[—a‚ªÈä6 -sv݈—éá¡óÙÅ>¸{Í›ÖãMÇ -‚z ]Z.>d/˜C:'gÛ|UvEÞí¶Å ÷}õu@û cWÅj´Û“Mý€¼°ø¬ýõRö¶¬ ™u5Λú¾| æ»¢ÚPÃ*ÒǬ~Ø]F®lõ,ž6Åë5>ßc_ûêÏpÞp2°•“‰†Å»Ih·ŒÊ_È”á ¯X$¶ AT ¤å!ë@xÚMWHwf~y^k\؆ÖJÀÓ÷‡0›¯JÆdu´è†CËÊꯞuÂ7C³hœ¼&Áx(f1xH ïŸX¾ ~ƒ9íƒ=rGÙñoVó‚‘T˜°ý=MrÙŒÓ4¤( àÑ!pèf0ÉtŽ&Û4¦8tud.6QÚJ­*ã¼ šœ^QS ò%ô½ØMchÀcC0/úgHeÇu1A¾I=ù;§a&¡C—¸žJMɃ8qÞÒQÓ:%çÌaÈOrËÜ`L££cÀˆOçÏô7ðG&gò,~OClúÖÚYû£Ôø`·À­mwÖ^Ï ÷Ðd4DÑÚúTš Ákƒ`D£dÌWhÜ{apÄŸ±ÕÓKþÈ Úë)®¯È -Lqå]<X… H;,î±nPÏž;÷«2_qá¤B×ÆXA¨Äç*H]¥Â1—x#DÒ ¢<îëÄܘ§`ˆŽ¦“£ç&Z”@òaF >Oø‰¸6N>Î S -Âë""Óð¤pÚKw*‰æ"œ„hŒ+~"WÈÚâ¯fk× L¨ÿ7^ˆB»¦ãŒ›Ø™YÓݳÃîÁM¢{ P<ñ‰e&Œ ,&68²¢¨h¢)矪! -´{;‘oPt?ýBæ‚~Ðà;÷-ߨlgx&—XËM"IOHÕ7ì Ÿ•y #cÉv•m x¡ëE)ÉôqJ†£-²‚–qx”Á†Çv}5`yžsMøÈ@NÄ@¢Â&Eø§ Fê `‚šýª©¦P•(e-!6h‘O©4åD -5xœ5ÜmëHø`é&ßRÕlúäÍ4Å% -%K%<Ἆ3 z—ñ! 3¹µy'ÏØn†–À¼QÂD"±è%ËÝfp²QÎy¶keQƒc`è¼³ÜËs¾PY²!µ†€¬7»qÍ $©KƇ}¹-ˆ€„˜ŽjæilëV}&*÷v'TfãÎŽŸ*()[@LÉö¡u=3Tªy|Šûjh =|Ý-2i0Äk¾|OÉðš;3|ÿnõ„üÑ2®¬+›Ã¼×$á8y_ÊÆpâï»bûÄMó&J'êÔià†^Ôh*4Ñ‚+*¬R2žÈ¡e ç\” „O˜5¡sp½8€|:ÒcH$ÇÁZ{UµÜÜѯîëu8Œ;¡{Žïèn¬ô5Ôá]üéêìææËçë7§¬šâgÊa‘(+…8™íF¼lw倊ã µ«Þc¡{P¼Îm år©úCr -Jì¢QYkGr<Ò"øÄ;1D‹dÜSü">#ÓGéC ÖB®©^k?DR¤6·6~ÚsU:…}ð—uÿ_ÿ[Á"(\F¢Ói ñkoÖ‚{Q:z¾^ó¿^,ø?9=Vvendstream +xÚµY[oã6~ϯp+/b…I]E¹¦4iv’Ù>´}ÐØJ¬®-¹–œLþýž%9¶g,ü`^¿s£ôHÁOR*“’T‡&MG³Õ‰ÝÁÌù‰Š‰L4¯nNÎÞ¹x¤U˜©ltsÛóq¡uft3ÿ=xýóË«›·ÆcL ³p^áô¯Æ© n˜hzÙO¿¼xõ’{&Tã?oÞŸ¼½é$íd©2óï“ßÿT£9éý‰ +M–Ž ­B Ó«3tÖHyr}ò¯ŽÏÙ¯:¤gÒÐ¥f_-Æ Ô’©0‰“Qbâ0sŽÔ’¯×Ër–·e]­ë¦mf›rÝŽ'Z9äåxâ"ë†þ¿i7eu÷ШÓ¾ƒ½?þ£²?ÉhæìJ2qa¥£‰5al’dÚs“Ú`UäUYzï^Wkƒò'¢ ]Ø0ÁJÛeQå+é/rYZã²BÚOW¶@ËãÏöž óòZ™ B8*5ã ʵÔþgILÐÂÜ®02ß6Äw){Ó–m¾rº‡²] BàÞ&¯5£Ó×UÁø"±áŸÅh¡Na}u×°]:z:/äñÃw4­“PÃSÀ9ˆÂ y€&6Bñã¡MB›zÊâ Cí"¡øéûE)£0d2Å)k lå¿aEäܽ+ªbSÎxìj¥À­q†Ê&]­e%] ˆ—„Ó60úÍÙ Æ.ÂýàÚ_-°±ÓØïrà *—ãÏŠè8À=mûuÏÜr=‚(ÉÂHÙ£|h•>Üòä»|:·j8’Ètþ#¶x»ä-ÈX ’G6tIL'¼¬Û¨Ÿâé9…Ú™(Œ™ãèï‘•Í2Ã$ƒ6IߟŠΦ+=zSƒ˜£¤Âv2àK’ê;²0NÜÈeð‘¤7 F`„(ÞcÃÍÿTpß‘<â€Ê¬¡“n›6¯øÐ8=/e¦ØвÊðàÉO´Š¦Z\ú0Æ®Òv-Ž<ŠyIÃû¡`Ëœ¶ãñ‹)Œ\¼å­z\{îþ$Ͼþí«ëÇÜŒ37‚×ØÐf®3ĸÐ>ÃýÈÚÈ­a  5° µJ7±í­Ùe@'êwV597Ô2ËB—°/NÀ³ÉQqî½Æçál»æ‹ÔÁ¤—ræo²\’RÛˆ‚ó'3MŒ_ax¨´ßå²8¤.ª8{¾º´2¡5Þ“»KL@0(<ÔLbƒ¶æ™U88÷¨¾/g2DÁs^ðþE5/ª–¢ü ýÙ'î×k‘µáÃk‡VÑÎáok¡±>–Zö¬èÄ»ZtÏD×õ›¶\.™ºÞJ„«˜÷ؾºæºh +Ëèþêªù1$XHDH)«šwÇŸóz8;¯­‰tEú›/˪ßJ´oEu_nH¬{T›…4èžVæ0óiY48ŠRDúl‹ÅQ²£ñûXÑ.#oõÿsçð™ÀŠ$~dñù}!àV béÐœÿñjüE Ðv +š(«¦s‰m§j0#@Iw‘:î#rx"™£òÚ\XBšD)´“äÿ†®' £Î9Bº˜BN¹×þõµÜ£j±+Öí$Š8Œ"ǧÅF—D`GD&/½ŸH  +ù­ÎÙ0íV?Ùu^Ü—&äoÄ`‰£Š…–¤KHjè88@â 4k´?fIúÅ,þ¾B›g>Û]7“Ak(Vs–Ï’"Cô9øO’ÚÞŽµÊvû„[.ËÖ# goñ?¦åûçã8ä@¡V±©`vÝ´õº9mˆói’uø‡¶Ã +`Â)ã×NŒ3Á¶)¤UVÞy‰Eç>W¡¤®bªx˜Üû·?âLm> +‹Á72N¾‰i絧;‹mAf÷upê`/;„j0äA"öŒ´sG­@”®t|V® Bfí³Ù@I¬­ûÖ£ õ‘„œ=4â/&¬(Žâg€ßÆZ'A¾©ÕÝ‘¤Ò—Ð(Ÿ´5&H2lIZÍñ¤uÀ÷xÒjÈAb®ŠßÔÕ?Z._¨·[o†RÒH•è0¥êÓ[šZq"Y„l©â\&ïÂ,>b2I!ZV6dù-F[$îÒ»…ˆò‰™qgÛ ©ùà)É<}%û…‚—,mXðž-9¯3„ÍOÎË ûÅ–íçq ¥ôQÛ`âØŽédÏÃü­œsv÷ïö_­ ¶B ‹ï¤Äâê,¯¸±”FâíËë×Sº)öÁ…Ÿ)[ÒYðóÕäü—S Ëo`Ñ»Óý$àIn¡©þŽx: ú·°åMyyÎC{ê–ÛôjSeçjï +ž¹E*ôw ÷1vÃØ©ÞyèÁÁIÉÕ幈yÀÍôËmƒ÷è€ßžK;‹º­'¯ß)=Ù]N>€ß §Àï¢ç‡Ë^]ëó)Ã9Ï_IÖQIvÓÔ+IDè¡hŒ‘¸NÏÇB­Ÿñµè,tø*aԅIJ+IM ±lyÃÎ †^×Õ}±áw6P Ü8 >Œ11ñÅCsì`)Ñ×ÐÓµ¦F EX¬6E>Ǻ?‘šTÓ€TÔ5ä†ÎYÔYçů‚?Æ+»oürHÊÈ?ÇÒGk~*Üô[,»ÔŠÇðsÎM¾kZÏÿ|ºÉî&¡Å5‡ýl“¯|¼P\-ö®”^9ÏEm%G¬¸;|¼¤’„p7xHi„+G“†;3~-Ãêˆò*âµì,!Ã~¾âȹ–î´m¹'Ö¡¼uÈ‹¯êÖpy¹Þúòú‰€ º ÌÑÒ]>(òŠ ù4˜¾%WÅm¯z*N6ÍnÞ˜vpi» ë’àaÙ8Ð/„E.Äx¨ [?^Á–Ju— ÒKpÈ[…–¬Dì… ôÛñ;Pï3˜Q¸¯¨mé&ó%»“™€†»9õñPþ°y_ñ͹ .¬—²Têô¡²ÀØ-PmÿZõ°Åç|µöi•.•t:ïšÏ{'·,ÿ3öiï÷BŸ‡v¾ÿ%aç›Æk“$rÇ¿t¸ÄÆHèeÈÑO±<)¢ +œIºÇé¶ µºjõ髳Âí‹|Z>ºµÉÀ•¹aÔÕâô„÷‰úÚ7Ýíïœ$¡R査A}ûò$øýÈ3 #§üþ豉/DÙÖü$˜oû×Ñú€¬GwX,.—!%‹ÃêŠîS^æ}¬á«= 8ìa³ä6Òdw$÷)"6òE°Þ± ãw¡e·<Êv@#·²!ã‘Š]ûwfE5’O“ïñS¤JL²m·z³6òP'çêaUo:+ÈÑ×ílš§C“mZþÎÆëâ˜ç(J¢ÎäûG³Qa” +Îj$B=ë‹gÿ=„©ÉGxAø×^TBd’§òú/£{ÿ‘"?‘endstream endobj -5450 0 obj << +5544 0 obj << /Type /Page -/Contents 5451 0 R -/Resources 5449 0 R +/Contents 5545 0 R +/Resources 5543 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5448 0 R ->> endobj -5452 0 obj << -/D [5450 0 R /XYZ 85.039 781.388 null] ->> endobj -1634 0 obj << -/D [5450 0 R /XYZ 85.039 651.823 null] +/Parent 5534 0 R >> endobj -5453 0 obj << -/D [5450 0 R /XYZ 85.039 630.626 null] +5546 0 obj << +/D [5544 0 R /XYZ 85.039 781.388 null] >> endobj -1638 0 obj << -/D [5450 0 R /XYZ 85.039 245.88 null] +1462 0 obj << +/D [5544 0 R /XYZ 85.039 269.971 null] >> endobj -5454 0 obj << -/D [5450 0 R /XYZ 85.039 222.562 null] +5547 0 obj << +/D [5544 0 R /XYZ 85.039 235.225 null] >> endobj -5449 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F76 5447 0 R /F20 2865 0 R /F66 3242 0 R /F14 2895 0 R /F35 2880 0 R /F11 2898 0 R >> +5543 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F38 2997 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F20 2961 0 R >> +/XObject << /Im1 4096 0 R /Im3 4353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5457 0 obj << -/Length 2911 +5550 0 obj << +/Length 2450 /Filter /FlateDecode >> stream -xÚÍksÛ6ò»…N—S3C|ææ>¸vܸu%'7ãø-Q6'©T÷þüíàâåtê×NK`±Ø]ì°ìÿÚƒÀ5-üÀ6e ëkp +¿Ø -c¬PÆ-œ_æoN=g`[fh…ƒùª¡ãšŽ+óå•qüþh:w1K) ;4GcߌãËéÈ6f ^œMæg“_qæÐ6.§¸üñbHcÎHg“fùèÃ/G<“¦5ºžÿvðn^KZËR…(æ·ƒ«kk°„#ýv`™2 ÷0¶L–× §é:RÍÓƒÙÁ¿kR¼æ xWŸV\˜n wÕ"Ý–Zl[˜ÒßµL×rH/]áÅf±H“8«x:¾<<‰²¯Ñ?~À?‡ û,~Ÿ½»ø„:$”Åám\-‹ä{\0dxr4ùýˆÇgÙ*ŸUE­yþ))ªm”òdZ$YCžÉCTÝÀ5}áÆ65$Ñë%cü‹?/ÄŽ¸Yƒ±ðM+dNWŸ“l™ß—Œ1™ó÷Gà]kä–XŠ㜴B!·´ÏqÍÀ:›?ÅE™äÙ[Æ»} Ú4'Ñ:ÖȽçí#pT,î’*^TÛ¢ÞüS'twøO£êN“8~ûÅ–Îç³ÉdŽƒÙCYÅk)p\nò<ÅÁÉÅxÈŒ¥øOàáˆP¦³ã‹³éÜ<9?ï=tTE«$_†ÙÙäôãl~ñÁœNOú¸çÙ*¹}9~x¸éüòì©Ó½ÓÍËrCU¾?Ÿ^÷xóI¼‰³%Ä2r,5Ë^¥ÿ¿cº/K’”æ‡mŸåë*D›"Š‘D`T²á¾±$øw„3¸dü4)+EË%`$¤ øbRCèËvR˜Ó&µg›-5DQ¯îû4º‘‡Ú>M1 ÙÂ…FE„ãC<®+‘ -ÍcRÐX¹­¦{”?ߦ°¥ ™:ǯo4G&€§äAÑñ`„übØH -õ¼v¹’–é‹XœƒB>®€àiBç._Ã'G¹Ö0XGãŽä‚† -ú?h>ËCÙ`(Ûv]解À1òB‹É:Á3@‹0ãSMée5[É*V‡ð¡šz²£e&c«’E- uäQ/É–‡Ï2mô'ÂЈHi¼úÅr-Ä á˜éz„§k Šò -Ñ« GËm_óÞ=‹ÃB‹ œ\žŸyÜòºâõo>ÑDIhX|×ÞÛ¶p¨ó°j›!¦¦ó‘Ð'…‚³ -4€pLtsËø|¡¬ûmÉÃ"þ¶M -4 ΠÀK.˜``ÂT×a‡+á{F - ÁE-WÊÆv±ˆãåS—žéí?¶Æ CÛ}íž´SrL^^äÐ%I×iÌã5Ê¡Ÿm¢[CÏ#žòÀ -½ºÙ¬°¾p›W±BÊ·zÕ¶RÓUOd '4}OGàb»)A—åú¦'X]Îé)Ì×H2"ç²}•ý•¥I”GðözÛXPF£RÈJ :³n¯™Ò:䎱ã)Í 78ž qHÇ+X%Ôœ±hG#„YTQ’1ö"ÏÚÙ¼d4½šíÞPóD_[dI÷8Xs¦ØªÂ€ oÆ=Ášæ±ÎnA=N¨œIÆE)*ïäN ă° Zã-V'¿i¿Ì°ÖE PÑÁI D 0ã†p¡ºSÄ*$ÃYņ,ÇûH()²-p*·l]BÉ×÷.Ëž££#³o¹m7tL7.BäC!¥ï#)ÀlýîèhoDî¶iºhaüÿU4ðÕåËg2­3˜Y\Ce­ [}Û´#pdÂ`•§)ÕHPÔ}mRXØñ˜w“ÊÀöˆ–¡Å@ÄŠë*!nƪèC1~·êoꤊ9£S›°Õ²-؈•{Kâ<¼}œìt¢Žoºa¾Ó8㧼öÅßéù^M‰õiû;¥cÚr?CFÙå×I±2„{·ÛáW§ bu~“V*­´¥B)c¸!Oil‰@ -Yònꥆõ¸·È9V<¥VR±Âª¨ áBu§JšººõdåÚc[Ðéë|Ó]…¢3N©àj®rçZÛ1+h÷ó7Mf.(ÑæE =€zqK5f‹® ÄˆßÉü5n¶œßqŒ~ÞÓ5Bˆz¾­DÔm7ù(*- Ó5ÐÝ=›˜"jãmA‘µA¾^ÀFñ–1測mB“yh¡ó -Ã-Ío¢ôZõ‰Â1ÃG}bÉÕ‰ª.—w¨–^¨Ó”IœiÕ—Fø½¡I#ÿ|2Ò,Ï à™HköDšBz.Òö1Ô‘ö˜_o¤µø-òê“…PS`ˆ‘D]zª‚ëjEq!1Á²N;çt UPd=æQ#ežh}•qñ½Nômj^]=tð±Òiü6«^õP]Ég©è½—âGàõx -4~]pê:Öa$,Ó²ì—:7(1 Rê¿vv­A(xŽÕ{M‡;€åvÛ¿ˆîh‹7Ø»9ý?;$Ý]ìUãžnŸ)Obj¡,ÇÀ|…_ÌWø­{%@ZCq©îÜ\ÚB -±®¢Üã,“Bç›dÊ$V¦QÅÊ~Ôíü—3ßáœåÜ`íæJLµÂèNj ¼•îjMfÝÕl:IX˶®`«¬ ã‡C -K—CgE¬h[åë¨Jµ Úr…R·`ÌõXKåún¯e²ÇŸkáÆx -|¿]‘·“x3üÛhì9’Êj‚]p6Õ'[Ìß\ž‡%kÖø˜ô˜N•|ȨÔȦ֎±¸Sú:êp·£FÔΫ -ÑQ6À1 Bw´Â®s`Yg×ôCÕ H?h À;®Rë ü ´ˆêúÍDÔ`øjø¶ÇHÐ ›–Ôå JÂî2%S¢¨ë¤H{ó2 ¡P6QV´7˜Xø$í[࢛:BxмêõWª1ñ0]ˆŽvÆ—ø<&©¯^½-£:höVY¢Æsåþ*ÛBzºÊj¤gªì^†ªÊîð뫲m~u.óÝVŒ¢úNí7¶qXÄ ÂN·ÉW|Ýô%§X AA²¥×?¿uGÇIt“ª;œcÜSûV)îúbâë×\mtßÐú«k†—w‘H=aìÆ¢àKÕ¼buRo@×Uè#ê´kO; ™8ûmÝऻ#•-pÛgºì,ëûiÉà&q–XDÀ|Yór pˆ |kçÁI’i߬è5$ûLž¨>»ó‡ß(-âhùð¤i}Å3×ÒçiÓ*œgL»›2ícf}¦m1«ëƒç¨çlÇ“Æf÷ÂFð&@qVWmœ|U­DÆS~œ’Æ,âʽƗÒ&ô÷IëÇ´ÞÚ ¾]÷Ÿ{(q¥é8º)…¢­'¤k›žçtƒ;§k󚟹@¼U”¤˜ƒà¼÷úB š!@”ñw2lhcLÏò®2øÏÿ_B¡éÿ+þX“7´vÍ'Ànj~ôG¤9¾ÚÑ.gÄûuíì ¨Ií»'!í¶€—“Ùåññ;üIÄì6qÎ/VqQä…zðsðp‚œ½À˜¯[Gš}å4ËŠ‡ÊqúÞÅ-¸ª÷…üÇ.ð—~pQ¿®;Ò dدWSØZÔƒ;1­˜±#ðÿýÌmáendstream +xÚ¥Y[sÔ8~ϯèÍ“» + Ë’|™7†H¦f™,„‡-†§ÛI|ÃvCòï÷\$Û}…YŠ"¶¤c£ïÜÕrÀ?¹HŒTºˆ)T’,VÕE°x€•×ÒRø–ÄŸÑüz{ñü•‰2i.nï§}ŒÐF-n×¼—W/nn»ô•RžLÅÒãÄ{ùþf)½w<{óöúÍíõ›×8Ò0)½÷7¸ü×Ûe¢¼[&º~3-¿ø÷¯/x¤D°üxûÇÅï·£¤£ UŠb~¹øð1X¬áH\B¥Éâ¼BÂrur +£•—ï.þ3nÅkzÁ_CŨD˜DÂ¢Ì –4q/b‰Ô‚%kÛ²XeCÑÔÏ¿Ök±iý«›×.}šÅ¶é‡~Õí°ô¥‰EöeÓ>”CÓöÀóWrÎÐ7"“…¯•P&†·›¢g$ù©½aPæüµIf_-"7 ï6íÒHï$'‹HE–ö3ø¶)VË0ñ6§¿LruããÙ‰ºl†ƒåŽçþ¤†©rþÉÐð)n–aê5´å€¶±â龜 xG~ @o›9ÞÍjÈ¿º<«¾‡,[øUÞå,KÆ/ Ü2Œ½oˆAÃJÕt|.$¥£<Â8£¥–ŽG§øåˆÐ‡êœ‹üè÷›¼,áè{Æ£PÉ ð†üqp*íù-=¥­qéy[fE ¾ªLðìø#æ„aè•ëŽGbæ€ CååYÕ28ªGÀì×Ãæ˜KΨ´µJŒð?nÁ‰Hgíhi%0œù“†Ÿ,W÷™GMÍÏKÆ ˆIï’eÍúñ«ØcõÀ(³'á¯ÁEk%»ÍÐòY¥¤_BèP¡ÜÑ)û©Öl‚+` ’ ¿À”JدÉÉߺ€#)°P&)H‹¸$Kv& ªs:ïÚùÝš)_l¨ ZR׌yÇì‘I6Å•ø NHñ`÷ɳaK¾ƒæž÷¹½ü‘´s §‘âD@×±‘IÏ&§ EáV%ÇÜ19iˆ$a(!¼ iÀÒ_¡Ôåã±£Ø{›Ù]^åõП’JCˆÌy©&’jÇüÜ>2±Žœo0X.¢€WWÁý„£ýpË«¦B3»#ÔYÇV¹Æ:ͤWÈ5ï^<-V íþµ'«’ÞUcý,÷+¾æ.ªbˆ#]aë„œAfÍÀóeQC¾æÅkxnY0›y\èá¤èÌLè èôø†®ÕåþŽÚŒPãî:Ç/YH>ÔÒ@¥ÿÅ%E² H/ä®Ûhü:¢Œ—vÈpb<5Jüì³åD/Léœ,QÎ//QWîàÄ=žÇ*Ä…+ìõp$“fGØ[m-€½v@èÈ#gÕéoÛ<º£Ä›Û¥lmßHDLûXbâÐTD6Gᬨ²’W;tR’U6¤Íıw}Ï’M¦Ÿ „¸ÉÚ MÀbB•Ðq ÃóRÆ +ƒoc¯)€á,uÇ(Il×ÂÃŽ“u”×7.}àè3pýÌù˜S'Q"ÝÖ—¼fà'‹X‘ y?7o¬}–Æi°£zeóI•¯{Ë4sð„léÛaî£ÖŽp¢Cèmp=LYŒ›»:¯¶µGÁG”\ŸZ7·E`V¯G*ë6¶†r@[xmm79šÝPÁ¢¯ÀGocšÄ×yYe«›¾|rÒõÅzª‡ !Àêí_'¬ +a‚øÊy‰„æh9€… T¬NîC_°¿1y¸·ÏØPf¸¸éY¶Ä­%ÄB׋vÿx–JF@%©{X|YHè4UL2{'¡§ÃÐÄóëJÊÅo ˆ·˜Ih÷õgsêÙ)“ÂTDP +‡I(\Uf5D›Cmsɘ>ã]¾|37ïxtRô%¯ÞSí×ñ˜œjÏL2´•nbÚ³rØFq­ 4 † +¸1ó^HSŽ&‰•ë1p¿†÷?t—~X³H*ÉðYÔ-º;ÙsHÌØ7$‡*žæ¶ÃÅb4àf;PÖÔ $”Aùö›f[Úï‡l–*h—MÞ»0CÃdVXzœRº‡­UŠ7o¢y%±{À–6£Ô6Ì{©O(ò¿oûùÊP ¥õÆUÓ.B4-ƒÂcSÛé¤É|ùÇ}ã–¡a¸8Er¼p³$þŒf,ÜíÔáñnº¢Æ¼¼Ï2Òànñyž–æ€é®sD©HÀµæL{„‰™ÛO`† “±­¦9«„Ú!ˆ…Ò|Ù:“Ýæ<ƒ™±f€|‹A’÷Â:wâ§ætðÃü­·±’¹¡Eqjn)wœHÃT±ƒ-t(`MÙù¸Reš)£³JÑœVª#BI>aî³ÓZ¤2>ÏÏÒ0ÜU(ÔýËç Çx]oG@;ìÆpnî,׿ñœhÉè6øÉlŸOîƒ9®® kXŸÀ6ŽEœ†ç±hÎ`k‰ð¨àë‡Þê; -ÍÇ=pÐÐEÏ9ÎÁí‡n´­{ºªÜ%”¥hÆxõP`ƒ>ó໌£eçïX=n– °óݖ˽pšXè(9çDsNKD­ +Kw}¶k¯@«õy¦–æ€ë¤Ô s®ÿ R¶^À¬r÷SÓ0^ÝmǸt +: ©Íyè&š3ÐY".á)¹Dn°3(tβ´4<÷"·Ø–ìðüž£ͨ!Ì'ï&8çŸV3¯îüyžDKdTO["4ùI(ÏÃ9ÑœÓáÑšK´#xK}ž§¥9`º‹g,dæ·ÇW +G…áÃ¥‘Ði|öøÉéÓ[šñ¾.' ßg R+ÈßçxZ’}¦{§DE»LMðWk cLÖ¶‹»àßèÑ$êW±TÎÇ.&X|&Ç]‘øž—*—7¸mWæè¦ ++ÊÇ–;|jÚìuKì­É×3w‹¥Lº“ôï‘0„ʚ̻k¶ÐYÂXÏ +Û¢æë8_Ké]×L^5ãu-ŒVYOW³*¢>§¬È8õ5ïžx2ÏzûFw©ðü6F!,O:›ñ/œ‡¶¶¶G‚ož©µÇ=ZÔÏ/ÿ]Èúٺ.Ì”ï‹~ÃçN™dûgÛÒ»»ûÞc/듬¶óm"ûìºâÁþ +b܃ÛMB©£ÅÔKþDcŠÝ¯„6Ù±ú©nYj¡õÑš þ3ì?õûÚÔH+‘¨ôø© CR'-BVs¨’}ÝïpL4øiuÄendstream endobj -5456 0 obj << +5549 0 obj << /Type /Page -/Contents 5457 0 R -/Resources 5455 0 R +/Contents 5550 0 R +/Resources 5548 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5448 0 R +/Parent 5534 0 R >> endobj -5458 0 obj << -/D [5456 0 R /XYZ 85.039 781.388 null] +5551 0 obj << +/D [5549 0 R /XYZ 85.039 781.388 null] >> endobj -1642 0 obj << -/D [5456 0 R /XYZ 85.039 350.751 null] +1466 0 obj << +/D [5549 0 R /XYZ 85.039 475.659 null] >> endobj -5459 0 obj << -/D [5456 0 R /XYZ 85.039 329.555 null] +5552 0 obj << +/D [5549 0 R /XYZ 85.039 441.519 null] >> endobj -5455 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F56 2890 0 R /F14 2895 0 R /F74 4586 0 R >> +5548 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R >> +/XObject << /Im11 5348 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5462 0 obj << -/Length 2498 +5557 0 obj << +/Length 2058 /Filter /FlateDecode >> stream -xÚÅYYoÛH~÷¯¼»X4›ÍÓoçr€Ézm‹…c`(²%qÍkH*Žûã·ŽnŠ²Ž °ë fÅêêꪯ¿¢ÅÄbù¶#ãI [FÑ$-ÏœÉ -f>ž -1Ó"³‘Ì/ó³Ë7Ž;ñd¾ÜêñmÏ—“yö`]z{;7I)-ÛÓYFÖõ×Û©°îyôöîæËüæËGìy0(¬¯·8ý÷»i$­9 Ý|ÙN¿ýõ—·Ü“¶3}œ>{?,l«b4ó÷³‡Gg’Á–>Ÿ9¶Œ£É3´[ÀtyvÚ¾'u¿8»?ûÇ Šç¼ ¿uÈ+¾Œl?’ûnþÈ-BÆ åOBß±}Ç#¿4-l$¯¦ndõª…Ý„¾•wø ¬§ -æê©ZÏÏ,Pî…Û÷I‰½EÂÝìÔî”Ó™°’‘ð¦S¬³_+ôÔå?YæŠÈv6ƒ6©j*]kS6mN-0¬ã—v¶vFún³˜ÎÀÒW®Ë2Á'ÚŸ±}&37öm~ž ôiLï¶ ¿Jï9¼¤ømt -DJ'Œ‡VQ£ÎÕ ç»>¡râùÅfÛ&×’¦ï¨Ii'g<‹n‹ªyur>Œ£‰Àrða~‹Á³K–ï׬Çh¢‹ÜØêi–eŠ¼ëi·ÎÎ67,™ YÖ¾àPdu%6;2c)ÚDMö{TG[gy´%Ñ‚-éKUÎ*±£gÆŒ¹ùø 2ŽFë–‡ŸQ<Ñ -[Vß'¸j¯• ÎÀƒÜ»SWjd%xm´QŸöI.¢Žc O³bw¥ )×ÎÓñúfjœÀòi«³0,½Xq?:ØqÎÀì¿ahn§­ƒVÔm_¼èó^Õ<™TZ³2!Ê1»™šÛÝ”>=>ˆE¡JÒ~.ñ<«Ç£C\b ¢²í‡„ÊSôœ•}¥‚0²cWœDÜ‘ A‹ ³ÂŽÑé-µ¥p'AÚNÌÐ( °¬ççûŽõkRmˆ>Ö5ä(ZTeE^¡‡ƒÐz×æßɟоAoÀ^Š‚²w†GYW§Ð‡er^´Ô³›’÷ÜOkšTzxÓ|Iǵˆê“9°•²~/ üE¾ÎzA‘[ò–Qg$BW3\‰ÎÚ[¸Ózƒ&᯿‚8ðáøQd{Apr'#Ú‰<”ξçڑƯ¿€õ®oM’•ˆ7Ø™5ü,_ºrÑw}Óš‰ïüìêôIõW—— [àa )®bá8Zð½~Þòór]—êòiÓö—iRÕÕÍÜ4Ù£[pÚ ÈÆ9%› -ƒ&ºÔi|Ðس‰-p c£JJÍÊ‚1+A`‡Q¬Vù‚‰5ìzß¼2(´t_¿ZãW7tº$%^ï®{Qƒñ;¤†‰›'lNf”¨Œ3.dHÊWßïXy ý ÉZ“Døõ4𔞾9¾“`ä>Ù F.LVý»¼UiÏ Õ-K¾C†áÑËóëÛË›[P!¸ŸÖU5 -&¯Öø/¼%ˆ&ƒP¥Žâ,úóyAØ£¡ e$ªu®/ÉhlƒRs$M</4y2MF2ÇÞƒ”žÿ:á]ð÷¼m}_3|ÃýÉ-v5Î6£‹=)Ð{Žu½VéÈ‚²|ÉocÔ2.CçVÇ7PËcäxÂÁÔ«*ÿCéeSé.£ I ËïxŽˆÓeçHæˆD$%¡Æ|w "m“¦E®ª^'ÿ׶®û¿ý€=òóª¸îÁšç :MŠuÝéwÿÃU«4Í®Ý}Pˆ[Œw‘“EdβHVÝÕƒó#rðçqÿöC,¸zø&¤‡ÿŸ25[ä}·®ìŽVx<´™êÒ6o0ÜFÅÅÅŸè.P‚Ï®^˽Bˆ“#Èè…kâÖE†]9"çTÙò Á -ï0˜Dðß B=Æq³ä¹ªFºá;šü÷XÕá8±}l }6.qXŸaØÓuF>ûÛ3ÊUbfyNL©´S·a] ¢r…2UÃ8ðƒŠ1mÎWW*sCL‡¦2Ââ)6˜ -;á÷CÇú­É)Ïë%÷Á "D3øývè*s#Û—žV‹56^ôŒÌlä*¡$·Ù Ò ìÀøAÈ¿Ì´t¼‹b¨€Ö[˜Ü=Å…µJ´ß·%W^Œ‚ccj2s­ÐYÖ—ºWûvÎt   éß9ëA"ªLÄi #Õç¡£Êèò-#ÆŸâÞtïEº2%* œgƒ0§LÏM‰4\HÓ¡õIµúE^rSdF¡©¡"+#¤Ýõš—e ¤Ñ0’V›òKnbµ³¯"aÝßYÍ% ,Pg/xIž¼0¡çð £OC9„½á’|ÓñÀøCt›¤ëÈ’ºÕzèâ×\¢3‚ÑBoå@†HÚqhX’Ž|XÙÒsv­ôÇë*æ^,øŽÇ­O‹¡¼à^b2ÚeÝé `ò1v4r‘:*¨ú†pÐh¤Õv±­·€a•ô»¡@µeìl?ý¡¢TW {K²aê„ãÒ΃Â]ïy®UëøÄ12Ü3†{øm?RsI5YÉAàü¹ÍÆBÓ!˜>g=‰~7S˜™RÎ5ݹƥô‰ä˜]Ø@æ–Ò.àhăbœ®Ëpçt†Ouœ}<ç™ÑìÃâÅäÉ¢“´“¤JQÌÏ“w¢é +Tz1‰„NÝô+Œ#!a{39…5ÚÏדËÉ_+Þ3S>5f•–"ÍReO[.–Âĺ³œ‚])Rk‡–³‘°‘!ËK+@[6³6 +.ªü}$ͺɫú.¥ýñ“bô4$†´#(c¡c’⼞…FÚàëL%Aæ'uV¬Î`¨mp1S.(ëße9 eP0Ú5Lˆc:Í Œs^&Â|‹G›*[㢠H9Op´eµÉ<›¦äߌŽ|gú·¯æÿðòǬÎW<ÜÍP挗o¯½Äßë&Ç[7`ÍØ¥ÁÓ™3AUnÐ’` PâC¦¤r§Ò²*_sÆÐzÄ^çۼʚ¼fV™g^ñö +eMÆ”‰®X}ø·âm¹…¥Ð߆;# @#"áP'x{ÑŠ¬.Q䇷D«‚¯7t7OŠšim·›Á /.Ð4ZÃàŠ¿“ ·|¤îèV¼[nsÞ)=ysãê[¹ÃqœmáϵZ^òôŠ^ÕËŦQ½‚iÐüïe z½ nZ“mù0=Àà½,é^Ýâ;#Ê"ÜÛUyعÉ=^èDF½Ld@{”O6¼× †» ‡íS3Õ4x/¬ê¡eAöNîÊCød•g±' —«Aá²"Yãy¸ýA ¡K“óËGs²ýœçlýoZ§ÒÇOÏxï1Šÿ÷œ¹Á[Ñâs$ ñÐ3ü)xuøDM¶"p–›víÊ_Ù)\ûTÖÖMg†š7 +ÿ N/}L!—®;ŽÇ–x9 ÄO)„"o± Ä‚Ü ‚Å‘p©x@¿.–3«àô¯‚ßàr7³_²^¶‹xíECÅ"‰[fï#møMzÿA‰:—K +'«üK±¤aÍþ‘“ñB´ÐÉâ=øóÁr×ä75Sxpc[z +rÖœ„[ʼnˆã=›å´íÇÞå1&­0ô¨$|0)yFž¬’ÑÞŠô£×Çä28ã³™Ì0kÚ#)¶ù7¿ÚÂßÓ”¼ß ‹“e¶^wÒÖ¼¶«›rÇFAûY‰PU68G«Xá1xvU‹Möº.>a¬†û(F‚RÕ-*°ms.aØ@…ND:ä´É®ñ™À†]úªÏxM|ŒU•D"‘Îã«Ø ŽáuŠÖ#€„Ô§²Ãã¾:2ìDóÆëTÞ6KrVÁ§bfë¯øŽ­ç†´‚ênVŠôVü&½ÿ¹QÿK”ˆUücÿû²]‰åí®É¢ì‹AwU1îðä2ÕÀeZÆ›THçz1PËÌ»Ü}ÿ¾uC8kÃâ Óºà(€YŠ†o°DÒ–S?:$j“(`éݳ<ú<šgë‹ +Š> ó~g2.bðÜG~ƒÕªøÊgýι©üà4mºœ‹;ŠG[¨˜íqÉœ¤‰/™õAɬJft>à¢ÇJP©´p÷PJ%ÒX ii±€ÂI¦Ÿ§h=\oIÄ$š;M­,¥S×mߟoàÍ— Ú´—.TÒ-©p—bPCôt RŒðБ¡Ç@}e•ë°–!m'FÉ)Di‘¸tL¥£J¼=±jˆÒÎ(ÆÓâú–R£^ÊŒ€;V"RʃûÁ¡¸ +=hTÚÞDLr$ÜÞ-|¨jîmŸü+*³®€Z}%dðE+Va¾)œí;!W[ê#…ŠNZ¿ÓKÛXH°pˆ’xLw¬©Óò¿uœâDžlÃt‹ØÊ“Ý Fõ»× Zß R2¼«ÔÐ|ºíI¸wÇ] Ž!µäxUß‘’T +"¶ñ–«»ˆƒë@hSîæ`sYR¤úB¥LÕŒÄr‰3J~W5‡Q¸u ®¹ï3ÂüLñøKÉ ’€«2süHÕl +ÎÇ>c,sõvÜà PqÜ/{Óáz:(CÛ •609®{€M±m+)0½'äB6¹p¥ž +\‹¶bÂaGÊ' {᜽èN-±EdÅ¥¡ß O‡œ—xå^¸Ñ†(«?õtYí¥7蹩6[ç߆!‡{Õ¶yávÏ7ó-®v3.G³mß|Si¸Ä‚ú¦oœ1ç{^9÷E‚µ¯¾š÷­[ãxØAú%È‚?~Ü•šUl (Ó¿%5«¤fÓ~¤ú}©99JÍñ‰Ô,£ï§r³T`—ü(7;Gzš‚nÆýdjæ#af,3ïñIÌö3'x›cY‰™Ie;HÌ{|è UˆCl?þ‰¾” ºçå€Ò×”…ÛÖô0k«LO˜»ÏÅðá|*Nþ¿TÜô„ØëN~ò´†Þ ¶¸ágÚ@3¾íÖš"¤„×'‡.½í:9eJ>ÕmÜ »V¾ì tÝ5ÑtD¢ˆÓPîJë¼í¸µ|œü=Ö2ð‚úŽÊÏ*%”leAs)Êk¡¸°N ü/5v©ßendstream endobj -5461 0 obj << +5556 0 obj << /Type /Page -/Contents 5462 0 R -/Resources 5460 0 R +/Contents 5557 0 R +/Resources 5555 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5448 0 R ->> endobj -5463 0 obj << -/D [5461 0 R /XYZ 85.039 781.388 null] ->> endobj -1646 0 obj << -/D [5461 0 R /XYZ 85.039 678.921 null] ->> endobj -5464 0 obj << -/D [5461 0 R /XYZ 85.039 657.724 null] ->> endobj -1650 0 obj << -/D [5461 0 R /XYZ 85.039 602.015 null] +/Parent 5534 0 R >> endobj -5465 0 obj << -/D [5461 0 R /XYZ 85.039 581.42 null] ->> endobj -1654 0 obj << -/D [5461 0 R /XYZ 85.039 454.773 null] ->> endobj -5466 0 obj << -/D [5461 0 R /XYZ 85.039 433.572 null] ->> endobj -1658 0 obj << -/D [5461 0 R /XYZ 85.039 171.433 null] ->> endobj -5467 0 obj << -/D [5461 0 R /XYZ 85.039 140.016 null] ->> endobj -5460 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -5470 0 obj << -/Length 2016 +5553 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 412 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5567 0 R] +/Length 17146 /Filter /FlateDecode >> stream -xÚ­X[sÛ6~ׯÐx»cj¦¤‚W÷Ém’ÖíÖõÚJ»3N&C‰°Å E* Åÿ~ϼH¦<é¤qlçàœS~Ä4W&Ó(ŽŒãéj3q§0óóDÛ°Øž“ù›ÐŸ -×IÜdºxèõŽÈé"»·~úåòfñúvfK)-‘83;Šb맷73aÝ1õæöêzquý3Ž| -ëí Nÿq;‹¥µ`¦«ë~úò÷/y$wö~ñëäõ¢ó´ó¼JÐÍO“û÷î4ƒ~¸ŽLâéÞ]GÀôf~:/͸˜ÜMþÛ©â9ÊRcY dì±|ž Ò"‚Ør®¸>¥¥Vú³ÒeºQ÷ï„ôñ÷c¦ìeÞÔëjû£¶@Ùê¼l^Ááæ©Þ,›ºÙêrLE½Nµb§8¶Ué†ùîÒÍ2ÙX7ì€ǘ‰Lç]`có«j³QesÚÃWT«´É«r\K­¶yql"èó´ÕÕJÕu¥/î÷yI$fµýÀ‰E<µ½ÈqaUQâ_3[¸kéíjUäà‡h¿å§®ªæß_àŸ!¯øyþ¨Ž–ǃ€Î™‚1ëªnÈràD^t…Võ®0ÆöiÍ/½¾½ýðöú·ë?þºþ@Gãõí‡W·WÂ!5ó7b¸µGÄå9q‘Òk•7kôI†žµQͺšÙ^leHVõÀO`aŽf J+3‚Ѐg³Iˬf -쬈ïK–K—¤hŸñ¬QUU»Â˜j%™!åG†Ör–ÔFœX‹u^óÚ˜¸‹Y7 -5og¶Ÿ„ Ë‹,L”ŸD¤ª**Í,R¶;4‚ R‘{fS€œ™ÚP´%ðÑ|ƒ°éðȼÍ:çY?‰aë–h3Çm Oð>‘uY²º´aW7Ûªbñjô”¥Z‡Œäà'æs…Ö–rTÎ 5¬3òÁ€7¯yÀž§Š‡û¼(˜N@ë - Ž ©¬I®K‹ÊD}ìL¶JEì¸^‘u¶]cg’|5kËU{‹…/eÕð û/šØ?ú]®Ùž ] -s£úÁîaR^ÖMZ*;sNt‚ÀŽç¿ÜÕl>ž?cE\tÅ _è‚ñ ëvJ7ʸEÍ_úp3hô$Š¢Á®ûtÌQWeíÀÊ -¨o’š¸YHa2ܨ­Il/ñ†…>ÜÂa°®„æXô,@Kga‰Ä§BJ6’°;Ü6XŽcq£¾‰¹1¬Ã—†©¼€DåÓ5®îÚY)³¨½û2´®æߤ©íÔF|mô·$PùÎ~Ñ2b+[ãìS·íxí ¬ìO=“æk¶5kÊKÎ \b_lº.¼ †r¯©K“$T| FŒõ±7Áªýbñ©ù†oQµ&ñš¥‰·?|AÔC$F@áž Ï%8“.‹Þ3Êrµ]š­ë€•È¼´T*N̮ۡ#¥ -®#èæ2eA€,ÜõÈlÀËS«!4ýþm)½3L Ã)9^X˜ê–vGèãò8}­Ž9Ux@ukL¿5µùÁRyBÐ#ðªáÄK9È·Dœ×!úkü8Tûœ` ¼¥ü8Ã:À˜Ìç²d`”ÁmJ«3žlñ"aE |Ox>`…ðe”5à9²<8¡Œ²‚e倵5¨ÖŸy”ΞíéF¢´bn“z@Y”oN?•Áiá^W@¥„ŸŒDYͤ}'—°F"y9ðžç4€¶ÿHæRhÀR㕼ëÍŒ{æ'®˜MËʲa˜Û3Û¨?ø -£GXû«>w,Ö¦ŽÜ ©^ïOÀFu¯ý.ãT«ö"ytAåƒÕUMî—+ì‹tÿfä¹jè3ƒñáLWü½¡1Å“¾5÷¸CŸ*¢Ò 4VIà—ý›¾gö;Àè²/G‡)† “'Z_0ÅžLŽým¿{>søÿ˜•"endstream +xÚí]‰b«¸eß1`vðÿ9–7 Mæ¦mÚ@#uÞ»-¶Ž$ÛÒ²  |V¬¾ôJ!¹í`{ ¼¯t„ÒY1Cl”÷•lÖX ÄÇö@y_‰lÛ®ìœÎyå½±Ðð_:SäÄb±€X@Aù€ôP €‚¼€òîX Y”eY6Ê»cAM/̈”÷Æ‚žj›©‰X@yc±zoòˆ7M9®GBycIƒ X¼y.– Zl”7†…[e¼€‚‚‚X@AA,   ^+F\œGÄÂVÒîD}g¿É»ùDb!¶’˜'ê»±ð«X°òóˆ Ž‡êM'†þ õ‰tã_ ÁB3Ïæ:Ï#gÁ‚y +›Áa!>œ§ðÂåg#^€bWÇ»§OÁB3Ó±€X¸ƒ…ò/ã“gñbá ±0ü),<‹ È È ¢IÐFB^@^@^@^@^Ø5‰‹X@^@^À8Ò²“Y}}xMþ/¼9œyö¾z­ÕÈ è/ü,Ð/cÁ¢sŒ¼ð‡xáÝm¤ ‹¾º`3ûÐÀÈ È ïé;wçÅòÂÍ&yó8RËDÿ“&Ø®0ÖGDœ¨¯iAóã¥m‘þ +/¼»4”SÍþ =Ïb“µªçr4}ã¦6³!‰L05äM-ô>­›~\|Ï„E¾ž¼ðgx}gð/¬±J¹Ø–ƒMÎ@þA1\8dög¤ÓL¸‚Kˆ¼€þÂßÂkÏ™Ø]4Iõ†žÍÌñÙ©µÇ‚7Ód1¢ž=S%È …(b¡¼0— Ö-ÓðJ`a6¹ýÍóÔ^ñ$—œÔwF^@^ø_^–¿/&ß "¬Ð–œö¼XÈ0Ž„q¤¿É ¥ðŒ:O¢§@œ’q¦¸öNSE^À8Òÿñ‚\–4®Ï¾>óËå/äŒ#ýa^°5µÀ"d‘þ/„Ueï~jyý…×ò‚}Í + 7—®ãHÏâ…âCN‡® qúïÖÔ@^À8Ò§xÁ^m$OØHÂa#=‡¢™rðÿYx5£ów±€¼ðû¼ Áæ¯`lˆ…{¼Ð¯ž/‹ÁØaäæ3ãHƒÅ%b—ŠßÂñW”óŒ¼p€8R×ç›a˱ûì†Påò«êâ²™| +&¢šùu95fSÚ¶òÜ=nóƒÄ ïñ¶2Å«Tû Ï[³Íž£I;µÿg×#/üF©ß}©KEàqgóÒJ£ÁRé—k1E•û2žçêX¸Ç òM¡^<ªÛFe*¬f=×V? þü ,Ÿ|¨¨ Ò¹–zØÔÕ-ãÆ©\¢ÏG^GÊw…¯¬ ´ÕË:U±|%[3ƒãÄ+KÈ97ñ°pÏ_˜iÌl:ß”¯ÌT°aMžTð²ð +!˜5Nð$,0^Ф3í3ñÕY]»êp]ŒV̨Š³ô;oýã¼`oÆF2uüͲ9æu­V’_iº—ø {,0^ð$z'±\xµ\~Þˆ Ðtë½Ô)¨ÚTyx^€UýÄþ?Oåð3Ó¦¡ì ˆ#%—J=‰ +I¢f(¿TRZBËöò³ñ;oü"f¥#ÙëÇ›Xø|ÁWÅ‘îòB¾ ªå ”Ç P§dóäÁ‚€f§yÁX s/t’ÄRG]‘•¼qba#-1|?@¦ªšTx•µ¹qšd‰&Ö€“gGç…2‹˜±ÝH g¼@ëŒËáX(,ˆS…8_iºcñªÖ2*–h6SÙ—é6ˆÈ9 eÁ ›X®4TÓÐ UÉ)ò*[›9éìܾŒ‹áZü}Z?Š3çÙ¼ÀÌ5 ŸÛˆŠÕ0ˆ3Ä…TòÃü{3HŒìÍ€óUÞÀXS5úTß­7ûª8Ò¼çÔò—^4ÜIÞx,üÏ`Óú¢gðB0éñI)”_Ш¦?Ci‹xs/Û¯¯Q}Ç$Žô/À¸Å±Þ©ŒÊ£ç;i‹X¸Ç ¾¤Má|Ô̺®”ßr:^àŽN´ç¡Ÿõs°p´8ÒÊ £úÒP„[ú;ïzp,ñB:ŸŒüÇN:çŠYÏw< ¿Ë mÉUqÏ ` ò7>/| ^l×â§îç¼Àš$¢1§”÷#uOˆ…Wñ‚­ÂÓrÒË“ àOñÓX¸Öcø?7²M¿÷õ¯ç£QËÔþÞz¤k^¨T: ÐMj6°‚Ⱦlk>='þËž‰…–=;áø$½œÔNçßÃÂËËxÁ ”høÓ¢·ÌžÓ_Øïw¾Ü©’Ý¢t#§ëtŠÜ»fkßç°PwIü~ ö¿{ú3¼Ð /|Vª;XXw<—þjjœ“•ÔH>ÀÛdÚ¯3vL; ¬y³ÁôcX®*Gs4Œ6õ/ÌzJ öyë[®°¤ËÝäfHнX¾@⛳é‰øÝu-9u´´û6ä…›™æ«7(ÁJñúÂÑ-W˜æ÷tólÿyO`S>!7Îø`dÚ i ¾xôMb9ôòÂK°€y¶ïÚH¾>„ia LÛÈ¥’6ÓyZæM ³žt.-Çj`Ð'…׃ {ìm'Â^$cq,f#¹¡Ï'—YB©¼ðwxáOæÙV¾s¯â[Ü\k ºHG‹ÏB*fsùÙÝΗëÅBJé;·ÏŸ'¶,‰©%óa /ü ^  ŒLC Ï¶^êø¶Þq¼¤6Qyÿdò`SmM÷)¾³¼yyá XÈ6Ó%Ÿì¶õº‹ªtžŠ¸Â?€2æ"šT2Q1Õ²ÿýo£#/œÛ_pÿ.âM ØÜ8²õ$\¨¿°TûîÂuö|ô³¸od:+5×rG»,œócyá=âH+ì ë \¬G,½·ßSûÅ‚¬!tS÷\ϵub²ˆ6Q‚¼€q¤Sa¡Ú =V¼Ði^È5/ì°«Æ`WVÅ{^`¿u¹Ì©j / ¿p&,Ô{)»â…ü&/À~3v!—|wÅ \‹\ÛœolãC^À8ÒÁ}çjã;[ñB(+,zù­ä…4q"‚hÍa‡¼€¼p +,lêL­1ÕñÂ&øä‰_%/8ú€5q0Žt",@ +A i/~{€2“%’Óq­PýDgt„½ÉÌ„jÇ9é\ò»őx&‰ÜO†µ7ùàÒ7 ÁhÀš kbW÷Y›‘ –¨‡À³·œtmò»őD”š!Û)6X˜ïÅTkˆ"M ¬Jb6–ÌOdÁ³]¾¥‡Ãq=ú gÁÂâ÷¢ÎT%p¦çrÓQHWI.Æ`‡ /=Å7›ô&#| ó<’JL;˜¢jÕp^, /¼M)MFmÈn”Y*$šŽIª“Ï‚Dn;bW‰Cc˜E—§·†pRà_¢Ì—¶c’œt/òÂÛð«yãHˆäŒ#!þ/ Ð_@^@^Ø4 ÚHÈ È È È È »&Á8òòÆ‘¶M‚X@, / /üÒãK;ä…›¼p‚Î;héA(òÂ8Rs†Îƒd¿çÀÂyä!,´Ç—'òÂi±ðëX ä2? #bá©bÄÅydø7N#OÀBÚ§ëbkAùM9È÷±€‚rWë<ˆ”G±€‚‚X@AA,   PP ((ˆÄ + +b±€‚‚X@AA,   PP ((ˆÄ + +b±€‚‚X@AA, ïKÖžM_ööÙ|g»ïû +žöež½'Ö=ãGÂú/÷QŸ¿#P½BþÛÉ$eÜ1'K›¾ë:Uè6:hSTço „ NK¯Ž…ß“#î_øÅ0Ú`á¼Ëº:Äbyy±€¼€¼€X@^@^@, / /  È È  †o,­ŸeÖ¨TÎw–Åé2¦…ÿ’uá3fGçQ•wÚ³ñ‚ãZ¢‰ÆK]Å—? ‰kŸ¼$]ÿ¼XZ%=¬iÄû6§åR°û½›øŠ2ïÛ³æmg>¸*Í2óÓñB?S®5ÃÄ7·ÿ^`v`5AmΊcž{¦c²ƒrOÈ\ÕÐ¥ö’Úг&,#ùnJ›p~p…¦OæütþB9σìì™ÒüðBö,¹9/:è¾"X|6¤yœï繜͸«†¥šg³K—”±D3~ï6Ö£X°è|>^(g +XÈL£ Iþ/¼ØÐ/Ö“³×àÄà˜8ã_èlê¤Ë·±ðØjåžzÁ 3î­'^pÌ3caÒ6SxHpÈÈ€p$ÍL¥i4ÜWЇ$Mª4Nqjø¡3ˆßƒ!‘G— ’%pÙ­‚$=%/8dîÿPéÝxѺÐüe)Ä«7|—½êÙ‘ûéˬЀÏa6Ü!±¸§N*Î=Ædš–ÐôÒ4/œHÍÛ»=^Ë oËØÅq¶ ˆY_á/ aDçÉ +o‡ÁÎÊ É%Ž#:Ã0a¯ÇÝ°¡ö7k‚Á‚hã©yac’D C=y×\lá+Òµ_hU¾¥ ´>V;œ„?ÎØÈä:ÂøhJùYv<^0̹ðþà¶tžÒšïÞl¬xA¼½àïðBañ=y4O„²Ð‹Ë_ÙT„‘ä² "J’“óB±ê°‘˜ï*Ø`³3¤äæ—þÓwI¬š]f¹ ¿!µýÄÏéL`¸I'Ñ@ëÅX‹i”g¹Ãñx@Œ´ˆQfƒ!í9‡QöÀ ßÍKiü^€—# íe*œ>ööÄkØ‹æ|@Õì—ää¼kŸ‚ä.×Ua"ìû¾ä?ìß ùJ«8’¡·~Ç_<ˆÊŽ*Í&#ªêq$T¢g uù.ì À˜3x$uXÆ#ž1 íßá6n9©Œg‰ß<× ê‘C( ¦2Êé'ç…Ô£³p{€å48˜Öz;6è¢ $¾…z­NrBƒÙfS¢›é°q$ÀBÙªˆ›Ã&ÙvL#xÉaœÚþ©8’üŽJô$ËÖYªÌTüÃ_*0œœX+^ˆ¸ñÃÀ!Âãš|%‰"ç›7RX`cªš×•yƒ û/x ¯åÕT"Êéž²ûÎÉ “ Ca³N4 eDSTÚÂf¯~v^¤‹ÌMiò/å/PC{õs°0…²¥ Þ«–1À3!ÎΙ.üt—ä@¼0IEù´d®']Úé¯ò‚–Êãˆáê+v|]‚É Ôçä¼iWØÖЯW_Z4E¤çܾ‡îò^7¬ŽdK,À8?Ô:/(Âb×,m)m<ájm°0T6He§ç© £À‚µv“ÇëµW円Z6€s&,0ï€u±oø£qà°6råaþ„åH,Psé:Àò'å›(,(¸¸âÕ‘ƒÉ¬å¶ÃÆ ¾zöðô¼ U?aXhy'ªrs> c + T^ЉÁ²a!hfb±2¯qä§{¬ƒ!DOÈ÷5PbÌÙõYã¶Ê›õ$±TRŒò¼ƒ• ÉÀLo`†§ç…»X! +˜0ÿ¡]GUÍ  ݉°Àœ¾i >$âݬ¹ =¾b;w–ga¡%«¥A 2òÓÈœ¥5tä8R¹ŠÂF²ÖNÞ`!p-ñ3þ=^PA@ è‘õf £‚+/òý­äDX°øÃ¥açʧn¯ª'—Ì +žt'[ÆÔÐbËÄš¼…Ø°)|’#Ç‘dTE(Xv‘öÿhé”ï̧¡ZOs,Ñ=w©þ@c?ˆº\ª‘\âÁWî{fb†*6âÓ»óÚ/çÅ9kVD¿GºÂU1Up– î]ækæÜq¤ržß¹³/IÇ8³eÄ`ZAÀÔe.lo>Ør*T.º½·ðõóÎS¢Ô:àS1BÝ‚r~^˜sα`0où]\zöyçÔü~°ôALW<ðN&øÓK„BUªåù_þ’Œ/NhSIà"æ¡ãò'~^àE<˱rÅîXœ%Ä¿ÏÍ Ì)+ïsGf9ÝfËÒÜ[Õ2UÎX¸í2¼œLS–ӱŒŠ¿ÍRDþ¯=O=¿P¾扨C¬µ ø†`f4bã9±ÀPÿÚÍ7³8 ¥ƒÛ‘%–°¾£4$q8±2×8$/xl½ ¥Î„àó¿='ã –§¡Õâ—Mš ^È –®æºƒœº!foµ&/Æ>-ω…Ä÷Çå<òr^ðXg_ +ëÁ¼)!?€´ÎE7Á +ü”±æ?u s…= /æ…ïpðÀBxm¼F“š 51· Š¾î/ý^ØJ¡=Šü‘Û!þ,/ÀQì–ˆH"þ/\̓¼6),g#Ö‚Xx^0Úãò?Á „^'|sy’ÑyX:Ò®/sÛZº"kaÇZ!ñ´gÀ y!œïèò_à…Ô0>¼B긑 –Ÿ 6Ÿ©:7)_$g}OP4ë/¼ ß•ƒaÁá9ä…ca!´ÎŠ•!5†mýà,WõÂÞìTE¸xöD¸8-o@V¸‰yD&V5žùH£ýøRÙÃñB`?Í¿È AEí“b!ðLXlIÞk±‰lïÁ†iC“@J\È|aö}£fÔ 2W=,ÑøV›>/ žjN}&ÇÿÑxÁi>¡n‘ÜOæ;Ú ˜f¦Oýâó ÛL±Ó\ç ൠ\Õ’Vò¡} +ØÈt Zs6Áé6šç¶q7Ÿ—Š5Á{ò‰± Ê,¶B«djXXk5@ºŸ…gKR %'±‡²ËŠäâ¾ÚöùŸ8EÑÇ»ìh¼} ‘¬Oî9¬5ÙD¹èJ<Ž\r­Z‹ôy¹Î. i¹£Vyô4,Œ$ªtBÚ2º¢ˆþ'ÍÑx!zo^ý˜už¿v^ý#С°ÉºrËÅ8›É£Ó:Ëq†h­|;–Äϼº<™Xã8VÜ9§{^p²ž!Y&r¬¹yéõ…ñN¼ ÒRsmÙy—Ó`AW°¹Žƒ%äˆG YP¯,=öS6<‡t°¦yI<<  ®ÕàÙûÀ¹§ñ)x!ڄ߬Fþ§ïà ÖÌ;ÆÏAwÞÿ:GÂsDÎ?çóQÉl‘C5Û¥ÀæÙ°¶9ìQr0~æ¾ a4k'F°¬ïš0]¨“¬‰ …æT:*ü–CÆÍ>}^0ª'€üyscµK */r@øx/½‡„ˆ: Ì{è£B T߉÷eÃœÞK×òí8R¤Uòè'à…¬XÒ–gN‚7é…Üw&/Ów®Î…Á©B=‡Ç‚¥B¥"O£ô,Y!­þ€é^UIÇ$Ü0˲jO‹# íIK=ä·å=b8jIª€¦$ÉûÄ‘TLÕ[ǨþÿˆáHXPU¡$¤÷ Žë –•¶Á]çIxËncJØO~É Å½]á‘Ÿ)ŽÄKUÈÞ‡$ŒMúÅìÿôãHX`#®/ŸÉâ¡!î=ä2%¢KEåRÎP}­8mG¾§I™ëêÍÄ!”¹Hl!õaê/ÜÅ{öfÙḕò&¼R_Ô(IbÙy®Ë£ðÛðl‰ÅBŒE„Mù æ›¢“;ݜƬJVÖósSíI^ØTƒæœX—ç.¶Ù!,P cò@¸[ý¼`mR£3‚Ÿ ^—Ç‘¿!œeUNiXwbP£•ÛUTןÕÅ6÷“"ô­œ>9qö/,¦^Û],¸›æCäÍUÝ{`g 9A]žLê¸(¥¡7³õºŠ`L·aræÄjG0)ùqÈ4>õ™:m#éz@¼üQàJ9LÏ»X°ö¼Ð30Kñ߃Bº.Ëá X²ó†Ãb¡k&á4€ n&nŒ•I¤kl•&¥f/Ô=ÈÍõÉÛÌ3 %M<Ÿ€…ðÔ´JŪ3Å‘ü¯ÓñŒ£ƒ¤}^€àrëŠùvΟ!?Ò8è€~â8÷ZŽo<=qL&×ü­¨ h)Ž8VmfßÕÀ¿<¿°R¡œÆåÔXx¡\dó°MaR@E†ôL¼ªPhÏ‘wÁ¿ˆ]xÌQ׈…¯ l™Èc‡·)|^ò…ÞqIŽÆ _ÐÞ‚,& ¡æP¾¼/@‚¡ +f¢¶÷?»> ÿ+_ÕÆ†× ç ½ 3ç½±ÿh¼h 0IÍž¼ºÚœï¯@ø‹¼pÕy¼^O¶ ¾*~ÃPps$÷«IÚIªÂR« ¢7,oÄ ‹?±Îãkh²æ‡XxD£.¹ãºþÿì9\Œ¡šš†Û~nbö]ûÕ_Ì 38²óÚtbá©rÀüH­îýÀ0‚ 0?bá‰XÀüHˆ”óæ!P ;Iƒg™¸È È gÆBOL Z7’’uÖ'–‹êiÜ¡³ó2¯¢Ò@Qt/>¼ È ˆ…‚/•Ⱥ5ŸšïÂïäj©4V UIõÏn‰ïmÖkãèuX@^x{,\ÄVH'$—ƒF?–×5é庀4ç2ù”Ö¿v!´½Üás-Î4gÈ È ¯Â‚OÄ ™*ŸI^ò«½"ÿ7Àg’[fZC'&óº+ïŽT5ùMÞ)_W¶y±x³—Êï*¶_üÐÎã~ž¹{l4 VÒü¿VµApÓ-€ÃÆë°€¼ðæXˆåP ©¾ÖU€áf+Øÿ ‘醆YdæòåtŒ¢úåuX@^xo,8*õ„³Ë¾ã«ô ÁÅÎsÛZ-^ZGäö:ÈÞÔeÃ>]l¡‘ÞƘ±«c1Ô·a.i–WÖâgìO 3‹¨r[ØEÎ¥b֕뎯ÂòÂ{c!W^¬µc‚HnR¾Èà']Ý$‹&IÜrgA%ý ¶vQâ‹ÂÝi!®&ÜIš¹‚dŽ {"Ëd0Í%Ot*“œ–âëž»ýy±ð „:#Q¼ý*™Á¥…µóM^ÂÒy‘žùfÞO¼ÕbCЈ^rŠ é´Øèp2mØ;DgwçVT@ô<š¨R’šÜƒqEàÉÞ%²{Ž0Ï'veÙB[U¢§;:/¤Yá,ŽÝ—•»6qÕ—ù‡=”Ò. +£f Щ@fê²öècçéXš™¤Ú¸'&H3õ±3·Y;™iˆ—kžTˆÕ¾žTK]à®ó× ­!yc« 3¨Óf¬¤Ò †˜48ž' ‚Ì{§ ¸ùPXwØHnú~¹Çya sœíJb[2¬GëöxõIÕ‰erGCU£ÈžŒ•X¼Ýõ¨hoÐJs2ÞS(í|òaš:¯l9¸vo¤›Ï®s·*cÌ?ƒ¢Ué`Ah’3‰¶boÕ³?›îç¸È {DÖCv¥âxã¦és(_¿/$dfƒVcWL? …YQ£(2B}¹rŽ¯ (ws#ù{4ù'ª\m[äy°í¨JÕ_}a®W8¢!7QÎè?9ã¼Æ‚¨ó0ðWdø•™Uú=“˜iʆ‡QÆñX›Fr¼!Î{ðÓÐTÔ‡•B쟂ýÓBeCç¹XpuŽwöå³_ój|¡P:Ž@Í)LÀ™#ŸœæVXþ뛊ˆ”§%ÎB*z•ÝGÆq= C¤ÌüT×Ï`ÁÚx7`Êiî½û|L^ÝË ;ÖI#ê}1àÿ>/˜*ÞÒŠê<ò`cJÜçb!ÓÚÍWmxœÖ¦4[a2Á_•·õ¶C*ëAfö³cjYvIƸ~uRFñž–~Œr /= æ¨=¯:0 ?½ÙîÇã5ž€c†Ù#ƒ?¾ƒ¿0®ñ‘{Ÿ5€°«G|²Th›¾ºÎŒ5k@&O ÒÄ+pT\m+5²×ÂEXÔ0g¡­*‹« E՗ɇ¡®Ê¨VNWÄÿ,,ô­V-FM>áA$;L—£Ç‘بâɧ„Ò -´)í£ñ…¿Ë æÆwjyA/º„ú›Xˆ”Ãx7£&WNc®J­ªª‚ö:<îc¨3ç\üTŒuÏ›ï˜AkÕNYã*s‡lÁ\Íô'Âj¡V˜bV#—TÙÃñyA=;LŠŽ`L½â:oÖßå…ríG’ò k€)¾‘8ìû6R¦ZýƘ̔Ԍü°÷3^¼çúþEf¹eæÏæsʤ‹<~îíðÇÎC?2Å#æú±ÀJ5S†úÈÊJ™=™ ØÔ.¬çcA9äÜX•€Ã âHöªàn¹ˆ0R/|^P–;ø¤#/ç!‹ºOÆ‚¥^)Ün?X½`‘‘–– +ëìBÔ2Y¶5wRUtgSžŒ~nÕòEªæÚŽŽˆÇúÞ6O¨À|ý|,Èš‰e¥0c7WÕ¤ÏÀ Ópا  ^ ¼WÀ>Ùw6dñef7˜·”°½xJéèà¨a7ìñDjÏò|J‡Ã¨B(!ÍZsÈù¹|¤J}ƒÜìѹKPA5žH%<-Ùåáó± |g¾b$uBÉOºVù8,/(7,ÔePÙ0bú÷à…fã/è1:„¥Ís±0þ{Ùà;{Ó,ñýµÕÇMšÏvCÈW~ìû÷&’e=ÁÑw6>ìhüÈ\›ÄŸ; õP“κÇæ…c¾p,ÉjKCƒoÁ ê5ye’äbËpDaä'b¡ío™F¿"Ñ/­îâsm‰¤s÷Sš°($=:/Hx¦<„géu¼Õ‹gþ8/¨ ^&DÅ6˜ÍM’§bi$}Í.²Í4ôÏcan\À\jK"ßq2²_tÐyg11Xó +†0sž©‘$a&œ + +þRÛ(lt÷ã Œk_3²·¢Á/a@‹‚_¬þ·>Ž¡ß.*eɲH”è‰zzµÀåóÂL«.ƒ¶æç¾è¢œ~,Wõ],´Þ,zhÈÛ(?Š…Éï! Ú$/(x>3Útérx^h&¹ˆ^OjÊÜ„ûGýÃþB/_XôžŽWÒhy2ØHÓ¤¯èf¿!ñòKXh‚Ÿ¸ÎêÕ§†Õ¹ÆÇ1èˆq¤1nib¥èVߘìoûêéÿð¼s5ÛETÎòt,Œ®õ’ýÅé8¦¿ˆ…ùøx¼à¥Ëhì¢kéÀ—:.o & ]ûHœ›áF¬¿ðL,x=Ò?äï¯Gz(ƒXøã¼ðˆüi^@, / / /<×11iyV^`X˜óæ.wç{b!0~Ào ÇhÄÂÑxaìû­y!ÈÍü¯`!áÊíT}÷ÈÙéƒ>ëë;Ûþj~¤4þ\‘ÈãÑ¥Gý=žŸÁ=m®0à…ñw±­ òGkI½ÂRÏånÿþÑ·yÉ$¸EûÖ+Uÿ= +΂DÝ/Ý/­]Ý˶~©l9DtóGM¥`º¾ßÌ’þú™ÊÃuSõi_4üáQíŽÄWM9çÁÂxM ?ìÒv×Ð^ß!ý%ZâÒ4=iA[U<¶EcV -~5™fïê€eêæžiN67Ö‚Âf¾h_uìQU ª$c_Õäj±±oÛl 5§bÝüŠB$ 9--ð o»¤Ð?MJ§ÃÑ÷š·òC:¨5² 7 Ëy2 ’T“,ƒb&u<ËbƒÕj-w¢Ê]©mÌ;0dæ\¹•w³½õ…ÄÐœ +2cÂïx œè±¼…ÃÑBÊ“SÕ°Óv¥ÍÜ÷3mh¼@5ÓŽêFm°‚Ô=fÛF~γïCž&àAÎá"‚mëb0ñæ)ŸIWTe,§H.ü€;C£;öƒùó“ ÍáháÊcø!Z(d®oGä{d6 ³bŒÑ!kdížx2*ßË ó¥$o>H"—7}æÙ3|¹' âùs?Tà)ð~Øõ{$”Ô´çÂBÛü&-ìCIÇ …=1ü-@êHG >¹pœ*’^?F¾l«+¨ºU•4Dš1¢o’¶¥aF§Å™¿ÚtmsÀí”åZµˆÚR>¤o‹—§¹ü¤´­$2ÀÊÍÍ!&e®’Kø2NŪ¥JÏjéhUôꉮp/,–)cÿ¥‚M¶7†6á Rö%H³™ŒØ`!Oùã>„y«m$ÄÂba6¹ðÉ.¨az;}öÅ€½ø¹Tó¹¹ÜÇÂ’zŠ¹N¶á¤k^ØM›Ñ^"gƒÊŽˆ™¸±€XøQ,l&¹{{¹…­É‰U‹å4¾g#q +ñ³^,ĘÆû¼ÀüJ˜P¾ªÃWgÜœw¦ýf†™ù h#!žŽ…©i¦fòÊÚ½ÿáÕ +5!,õ|è`6z¾Üåø ÂX¤ŽAÜô¦aL#bþº­Á²Á‘O—Nºo~äÄÂÓý…ëc;¶å[V^8i»é8`º9qÖ­ÇÝŽ©ô¤ï KÊà#ì»ÍX@,< ׶K°›R^Ä<4〰ê­õ OfâÜ4¢â¾Þ\,gÈšy¶vPjÀ‘ØÌ/Àê3X@ ±ðãX€¥Cý•‡ k¢½¥4mf!¶¼`­BŸ«ýÅÌ'1ÇýüŠºG±€ó ˆ…_Á‚OvÄ06B%-ª¬J²X­ž-‚i»òô¹NÈf¯4¶ë‘ÒI/ˆE ±p,ÀM´E”r’«m¶k0vQÒ] &Å´Ú;j›ÙJ±Ÿ†Þ­G +o­ÙF ±ðR,ÀŠ$óf`ÁfW6óä‚ý“5é8R® ±_›\L¥ß0©mvž&ÀN45Ü*ë¦&»ýÜ¡×ÄÈ ˆ…_“Á÷‡@›‡?ô¬áøÆÊIÙÅÆ‚‚X@AA,   PP ((ˆÄ + +b±€‚‚X@AA, P OÃB` Øÿß‘v0Q“gtFÄÂ÷¾¡¦¬-û>Ú¬2 ê¾ïùr¸¬Û‹Ù¿}µítv „¥kiÌ>ÙÊU’Æô… 9ý¾„‡·ÊíéÿUlþ°ìüðá{&q¾¢O5LZxvò_di@,|GB¾³ ¶ÕoÊ +ðEÔ2 ¯Z¸ÌKßl4d„K`w}0]•¨Ù«]ø¨þPóÀ#»äõÿ#NÏ7EŸÑ†î:]ÇÃ8u?……é^¬!ëÖû{+Ë ½xõ„ca›:Þb!ÒXØ4¶5o°@)QÿQ²R3µíUÍ .Ûþ?……|—Màa¹Ðù9Xpˆ|9‡ÎbáÒl&jßî kncÁܪÀŠšŽöËÎzîe¨—bÁÏ«ð±Ö{çØùþÖ™³¯<šýÉA¢òxüŸw\`^3"¾*lLáüÊxš#)¤3ù€vƪ×3¬ÿ5À s÷#Óÿ"º§¼ãE¿£Až¡ÄXê?ãs[ú©š'ï#*ºI—™–ô1,<—>U¤ü,´ÛæxL?Û~¦ÇŸ¨Ýq{ó ?+îúŽù3ˆáM±0i1^0/D¾Ì‹°óX覵­óÙ+V^¸7ô_*f|•U1Ö¹­L'£ÊÝ%±sé”Èó*ã†á¶[,„y.m$ÞLÓÓ›;Ú3õR«b–¡WÕ|8¿õ«6ƒÊ@‘•ÛI›±KšX?™ÇóD}Ôú9û ×1¥«k™åUMpVWßk ²’=±Wh܈Ù3Nâ:h§47ÍÜX¢¼f¯ÝÖùeqKB¦š?‚SAƪ¤wA,|M2å/3^ Éꜱ6õo`Á²uÈ0ç8ú·ÔËÄÙC¿ö’ _Ìü¼Xe6•š–*¼¯\Á+ë#lv¥Ì{‘NfÈyX‘¡ó"Ï)“¾s«ôœÓ5³@Ýêú嬔2ÎT”­gâ–ûÔÌÊ„fšf/’E!ä æê^rGt¥n–º 5IG½”J©ë"Ñ?·Xd÷0n–y¿ÉEtá¬#|Ìpõ _“RUl‚ìsA¬#I6ûÒþ£ïlùT%Géfj<€…ê$xy D.³xµÜ/ÄÁÌèê"Öð"<iñHUÄ“Òtã Úh²‹ +0{ ”ÎMÑÕDF¸Ø‘ÙŒ»Ø”éÄ$¢5¡í‹Â“u!ápÀ]à'¸âaíQcׂ.bf Š÷f6{êÞ†'0Q 8;°Gñ¢^E8÷×FüõxõjöHy¯ŠU{uT7³‰ ‚Çž±9pX;5ê°ûìpB ~í³¬/áCºœ&Ï ©H _zkSÊä¼À”/WÙ7°À,!S©@?7ËÆFŠ-WËpË_XS=^8žX‹°µeü + +Ùò´xµÌœTýÞFêU:#—ò¤Ù| ïáyS˜idƒk†I<õ •ƒ/{ò¦åI·C1„ËgPþ‚Ä;Íôå ¹S zZ–™ô¬8ÆaŽÅnÅ=øøR(“×2³S@Ü’©¾¥¿ÐÉëR™D¢®|3áíDÝÄ·ÒVðBKçõ!›`ï/À];ÄÂW$TÊÏU5N”‰t‹\´ðN(;XÜžk‹núζ/ÅG×Y–´Â˜BóÛþ¶Õ˜zR+êPÍ"",Š• õUÊ!+¸6{,”êž©÷ÌÄó K„ +*Ž$°4Ú’5‚âY=B$G{Æf‘ð”uRpŽ +Ìݵ- GcezƒÀÂE´K(­Î¦XÖ©Mþ´Ö¦RÍ Š›sñÑeƒwþÚdbaUà…:ø"ÃÁm^ð¥1ÒÁà÷),X²‚ s4 à ôe½°ÍèÍ Ô Ì¬V» ±žKk“‚»ä:¶ÃÂ@tËΆÅp³AÏð @½ãkÍ<%Õ}þ¨•ö¨øieNÚ¾dJߤ¼âîZöÞÂIYÆ`;¿À¾’Ccià¼a|hgwšÄß©æ wÈ›_aQ‡XøŠZÿŽGTOùDæM^¦o¹¦•éÖFʳH‹s{~Ah“ÒNGS ¤çº b¶ªäÜ]ª“&FX˜bD¬díYa?Y\‡»ÕCÏ®°àÒ[•J‚Áq™•oŽx¡ÐC¿UÆ7R³ +â»"YótÖÄß]›óoÍ¡è[ŽWó ÜX,3C¾°U°ÑÑ…„V^PàuÁ p±ð©õK ^` + ÿáÖøM^V®˜Ô)æÏÌ/ˆX3€è ú8ÞŒe)7¸©üѦϵEî™"Ì"° †HÉÑ +Žˆßn‡…îC*ÈÖ­ûFD¢ø÷¼`o&\bþ ±>J\yÒ`ÙD›=h¾«kÙ· "^dæÝ°å6¢^¦cåd"ï•tä›p³r‹C;tˆ…ÏÉ:»&xt ã&Òr‡`¯à<‹OÍ;(Å:±BÕ`T¤ÍÎÎ2o­¸ l¡¶Ôk4†ÖÙ 7«wXˆ®S‡²Ê'éoòBµñ[’7X¼0yŠ§Gkh¸®í®è7‰§miF5ïÜZ¹|­~ühð;:yñÊ úØb™Xf‚Xø‚Ø×¼à@C³±¥^îñ3uØXòÁës¼_ÈmWö±½zð^ åu2'ôÕOz{²‚š}lRó Îj‡¸\‡Ãî°]ñó¯gÒT™?¦ä_¼ (ô/t*:6­ðýÀ µv˜£Á6ë‘8^r?¤¼ƒÍ *³w"žzÇ ±ð5‰u+J^³wt…†ÝæèXŸ îÙ î¿y†<t&YöþÂ…ÿêÍÿZ¶ ÁȵxT$þ w®r´j ˜ïù Fv1à eöíDcáÊ_°÷6ÿ^¨”«ºú ÌUf:{å/¬q1§¥ öë‘7çÙø Aä:7yAû ”gßùÎÜqG,|)Ždïx”ÀªDYå;¼†~7Óñó¼4óĈǾò %;Ù«òø}Þµ7-:yFZj,:Þj +¯ZGgÿ + ›A“{:DÃa6|àw Ê°g'þG^`–|¤IÏÈ‹PŽKuyÑ_ëW¥«aÔh^h£¾5d" eGâcÇ-^P†¡ì¾-BŒ#}}~¡ßó3êK¢ç\oñBÛ̦'.{ Õ:ÞÛÌ0W§:TÔEtvÕfûÛ¥?rÝE–œÜ­ôì¯ ¦Fjò–Ç4Óûó %{Ž€iU ïÈ__éºÀ¦h$«׼R*試^v­zï‚_»–IqÄ\…ä Fs[Åï–kÍîåZ•¼ OPíîn(ç¾üÖz T¼ê"ð;¼]+9;ïZ«øW>‰­1©²x(¾/)¥æ³ûMŽ´Ü¸½‘ä}>ì-:Q[‡×Û‰…Ú‰uG¥Ùø¼³!NQ³º7æaj{ZRs»êˆG¤ ˜:<¬œwŽÔ"¡ŽêÉ€/D3i5/Ì|õa$*ƒ~¸–Ažreu]q/>®ç£1ï IÙ̺Šb¢BO–3XNIî]ÄÂg…顳ã¾ÔK4þ^–ƒo±Ý׶‘KÃT0ñ 5xªAÏá>dòaÿ2ev3KËǘ÷둨´Vg1{h“ªµì÷Š¯ù‰äÍ`ÕOÜ«E@7Ö#•5ÜBZ<´/"Ûä«Œ q:%L5£õá|oÖë‘ö¼ÐëQ˜WjìzÒUåÔµ›õHóTÕðÂÒâ^ÐH_Û¥ZÈT@ ¬¶'ábßäˆÀ²§–åFù°brܵÞYC,|úêlXh)œÈIhÑG½4ÀXÏÕ@ X¯÷;ï(hÖ-Ð hª« nž¯¡D®ë¥\ I2uÊ~mžKTe)9ƒ 戹½¢¦Ívµh¶ßïÜò Ø%\˜ÊøHÌFðwÓEaG/d%ÑfoQóãºM“ Ú2âkJ{ñúÚEÝ[¬hZÆRì  +i©ó"ùšü‹Öù˜Ãs8/4rÅ«aÚJí0„*Ä—dTk|ƒÌûÚÎ.„ºº¶¨ÿdÙ¶XÝoׂCBy`ñkT*Íìz+öž¥‡8ïå~aÝF +ã]zé'/w׸‡[y—ÇÒmc»ØǺŸ¦>ÏìX`ÁOj¯éÕ%G +Š²)Õ¦G<¢o×¾:P6SÉe nU²^Òe¨m®Õc‘÷•³9߯KvËB~X«/bvÓLk •8N5鯖×6ž¾–Ý;ÎÙûU® +‰}_t-g}Írjzñî¬.âü¶«¢Q, ¬¼™òNMh³&-© ¸áëQUêüÞÃfkŽ ¹Ü#¸ +¦Á?"‚ÒõÐnª×´ƒ,Ú¸!í¸ý8ÿ‚LÇ»¹Á ¿jâ \ݹ½¾öÎíÚ« ¯ÿÞ~$pÁ͇òp_Û×Å0ïUký iæiÜcá{R]矉^Ö‹ëüÂKKt0úƒøôûž3æÁøù.L—6^—¢þ9,L¿E°-½…êûm æGúqI Œìf™òÂóyÁùdÆ%Ä•X¿Ó‰ÐÀÛ¥k¬ð’_c¡x%/ø¿ƒzw%jÿýy¶÷ÆÂRÓ_!†È$åFq“*ÿ¾iëªm¾JÖ|¿-QoÿNŠæÖ΋ۆƒùT¿‹…tø‡!HÒå'©wxNºo¬¿€‚‚X@AA,   PP ((ˆÄ + +b±€‚‚X@AA,   PP ˆÄb±€X@A, P ˆÄb±€X@A, P ˆ”×Jzb,ÐÚFAyžóbåÙ‚X@ARœ ¾W¢ <[nÔßûÇ—à¿endstream endobj -5469 0 obj << -/Type /Page -/Contents 5470 0 R -/Resources 5468 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5448 0 R ->> endobj -5471 0 obj << -/D [5469 0 R /XYZ 85.039 781.388 null] ->> endobj -1662 0 obj << -/D [5469 0 R /XYZ 85.039 501.248 null] ->> endobj -5472 0 obj << -/D [5469 0 R /XYZ 85.039 480.047 null] ->> endobj -1666 0 obj << -/D [5469 0 R /XYZ 85.039 247.068 null] ->> endobj -5473 0 obj << -/D [5469 0 R /XYZ 85.039 226.473 null] ->> endobj -5468 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R /F66 3242 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -5476 0 obj << -/Length 1928 +5567 0 obj << +/Length 105 /Filter /FlateDecode >> stream -xÚ­koÛFì»…Ñm¨ LŠî¡—÷)}.Å–e­»HL‘äX¨¬ó¤sÃ~üÈãI–ãG·®iŸGòx$%6öáÇç‹dÅÌq<Ζ#|”×#f9\ËâxžÍF'¯B9f¾—øÉx6ßè <ˆñ,¿tžÿxz1{ùvâ -!–x7Šbçùû‹ sÞöâíÙùììü5BÌyä_ÞNbá̈éì|C>ýùÙ)AÂó'W³7£—³ÞÒÞ°*A3ÿ]^ùã\z3ò=‘Äã;Xûòrvz®FïF¿öªˆ&Ç$µ/*‡ ž%<8¹y2}ä¸?ˆcÜŒ£À÷_šÐNÆ<ð7ðBˆ[ ç]y¯àz9ït±šN\'¢„9EœÒB ,sÒ% ®SâÖ‹Tw«©- ¤á;^4åmÑÐúU‰*‹–”~ô?Íó¥¤ÜE àÙ¡C‘EÑñ°lxLXD°/,>÷bÆLX¾]Á§YeYU5øðÀqß7JéïîáÇ"2zþF[¯~ò¡¬su×t>£ç}>±ôå±×鲘î#}sé›tq|b ÊÖ«6on/¯ªéò¡]^ëV¯šÚ»¸xò‰c{þŽèº4‚¸ôÕjzþþ§Ÿ¦oO?˜ØÆC¬|`Ä+•¥ÕBµÚ\.$D)„Eäù±ÈrÑ”µî\1ÃÐK´ë,+Úv¾®ª”u«Óª*r78yņgx,æp„ŠÐìu®´É"æhH›q¾ó0á±£Ö AYZ×@U–Ø«‰ ô¢ãÖ‹²¥U‹é¥‘ŽP9‡g8¥å›§%f¼aòÈÜ3KÊÔºÊ-° £Š[´ÄdmM˜Ôn•vƘ«±FÅš¹Ó&[”ºÈôºée}7ùܾ©^t:ð;þ~Ê ÷ºÔíB­\a¾Åõ2\qü3¬ÚWGøß›6ðKý¯¯€›Hx±ØäÞv5åÜ㬳#ÀåΧÉ@Ä^‹]ƒÿ;\AZendstream +xÚÁ¡PS˜ÁEQ5(Kš¨]ÖAÖ4UÓAÏýß{Ç眵֭µ”c¬Öº÷.¥|ßg­sžsBÞ{)¥sBÈ9WJc!÷Þ‚bŒ±ÖŠ1RJï½sÆ:{endstream endobj -5475 0 obj << -/Type /Page -/Contents 5476 0 R -/Resources 5474 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5448 0 R ->> endobj -5477 0 obj << -/D [5475 0 R /XYZ 85.039 781.388 null] ->> endobj -1670 0 obj << -/D [5475 0 R /XYZ 85.039 761.463 null] ->> endobj -5478 0 obj << -/D [5475 0 R /XYZ 85.039 740.731 null] ->> endobj -1674 0 obj << -/D [5475 0 R /XYZ 85.039 492.747 null] +5554 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 418 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5568 0 R] +/Length 21835 +/Filter /FlateDecode +>> +stream +xÚí]‡‚£º¥WÓC'ðÿy-Ù¦’LٹɌôîÛÍÀ†èXÅ*zFDDÄIÏF"""NY6f6ÑŸ§ °`ODDžlÂaˆˆ°@DDX "",ˆˆ DD„""Âaˆˆ°@DDX "",ˆˆ DD„""Âaˆˆ°@DDX "",ˆˆ DD„…ÿ‹cÿB?=ѧ±ÀÎ)IÞµ’(ÖÒΆ`L3­š‚ýüÄk"vû%X¨8ÿgšf×U}GÉ Aëßò}ù÷uHÛŸ€Cïi0Kb·_‚Óy@¾˜}ù?Âgƒ'ez ^7Ä!á}ôÏç•Êÿã§$ú),tÎõ>áz{5›ÿë§*Íô䛢»Þa†CгŽêÿÛ§$z,HæòÍâ +ÕÕ©Ž…B8þ½ñÛ`õW‡°ð&XÞº4?o4ƒãsIRùfî\µ÷À§$zE,€²ôÓ`(¸1s=– Iµ +þÚ¼YÃW{,>%aáe°àŸ™Î+Þº¶? … Ž~ˆmžŸøe0Ӫ״ªêÌÀ_¦üoÁðMX(„ªGXx,øAº§®3MsVpp‚è'"†ñâ«?«n¦V,>~ÅébGø—ò_bÁ¿‚ÿE,”âQ /ƒ§;ô%¬hÒë¬Fýì¦¸ä ‰©¤™ßÝr{¤]ÔŒóßy“*ÿ‚ôU,\ /†óÜgZ*Îû.â—±ÐÈ•ß÷µ3CCÍøßiIQYð#,ü,Ll6°î° Ä‚ÊéLÁØ‹ÿT„…·ÂÂÂZþ¥x,È/Îv„E*m§!,¾ SqQ¬¥½z)†;¦¼æÿ’Œ°ð° ØïÌÆþY,¨9Ww.žõ¨Ÿõ}~?”`ðö¿c ³ïßÝîДM ߉…y™ýAƒá ‘°lȳ~T«#,ü,Ì:úéÞs¢".Ë(zNp0~zYcÇÂÅ–½þ=M*“ˆØ3sNœú1q !,ü,Ì*Ç¡_&j+s¸À —ÀLµéI¡¥f Nï´xÏŠIÉ©Ð$º¢DŠvráÁf‡È/8zKâ¾[Íù  ãŠÙÅi§šUœl¾Ýì/D›™FMŠ\.CwðNx®¢Oé›»§$zY,4çXHÊrË|Iœ/¦v¾Ò2ͼ8›Ó¯Cµ]âYp…]µÝ-öwý~þö)í§Á ¥¦=–E?\—YÀœ»›ÔIà³Ôwä™W³Å+ç¸ÙwNq/Zl{°>˜ÀwÒ&{»Ç_=¤zÊŠ¸÷}±PÞ¦Ôðß~8IþaÍà8·™h—4Ú`yhÉ&B~ªv¶Ë£‹;OU—ý, E£Ü¿·Á –UğسH%Ÿo° ®ÔƃãÜ¿ÿý§$z; ÒPŽRjç0ù'êç8="hÖ\rpË…K*çka¨'i@¾sÕ’›wX`›ÈvÿZ +¾¿ÕÔÄ1˜—vuÝÿÁS½¼í¼]Û"ó,¹Œs÷­™™Î3©7¸¤•‹©ÿ¹ô¢¤rœ³9WÉúÍCÊwu sL¹¿NÈæÆK²‘ „…·ö©nl»bpnjî޳겾ú¢¬À:Cbµ_À.›/ä}«EÑV!!×Od5³t{g3Ô  í¼ë¾G÷°ÐþÇÜŠ!Xô±ÍýYpô”äOzu,Ì{m›X· +\ +˜}ÓÆ–ÎÖÚ +®@œ·MeÎ:–3ÇT0(¶2*j@ +´½Â†YÍý H$©³Ê}è›8Žµt˜­Ãýü¦“{{b‰W;ÙçX¸š(×øýÓ¦ç±fúsÊT¿`áð){âÞÇÂÌÅëekÙ»:A_,Öñ¬79Ûí0('Тµj>}æ¬Á«,—›¢\l-Ž.ö8hËäªrñmчòݘ0(­Œ»¬Üw°à (,¹I;‹²ÅÖNÄS^¶OɈ{_ *ìsk:Wób×mì䤿úG!Ó•kgUk*ît`}ž¿0Å+˳oŸÜ+ç(íWgNyXó©œ?Äl"¾Ä—ýà´± ^UŸ©‡û(rÚk{/,Ì?ä&I%Zî,N´nUfÙš‘UQpã`Ò¤z½uRÝÁ‚ºbU,x3Kv»M-%äV̽xüÅÄö nr+0h„…÷ÅÂ*—§º5§¯~u{m¬ì‹ëÂø¥äøþ|é³Xà`pvU:žÂƒÌ¡>Ú›P²o™Dwjø<Æ‚só”ì8r–°ðFXHâYÿß,é3[†q«…{õ7ΑWv%bü­þp ÓÁÁŒöèqdÓ"fÙw¸<‡…£—Rî—^ 'y ¬hÌeÞüŠ÷Øêðkí É€ÎØÀ| ²zÒõÎiuáÙz?Ú¥»‰_4ÃèƒX8ŽìÖ«aÁÚ5¦Uݶ&ÌšUçU®¿o¤.l'=¡‡Y—½Yim¹ç|€¨7çîôWVS8΂^õWsoÿ뎯˜ƒ +K cA…ìi_+ÌÙH€æQÞXº_eÚ¥o>é}„@ƒyW4Ç€UV‘LÇø-!„.ºf·N' Ýó©ž„“§Ã^ ÉÙVJ%“Z§$)cëlü +`wBF½>U]˜-Ì«¯{MÉ­š} gIÖ­2Ü ïŒß ↕Ñ:' ò—o·*Âq¯ObaÂlˆâ¯oËÏ;{ÔI/°ÿd¡˜û~…{X8 TJÒ\„…7Ã×—¶ÛiÊ\¸—\Öí5‚¥vë¥Ó·7y ¸¢ÇZÜâÁwRvd.<Éw÷k œcáLî(mçMXx',€)zÓ‹DHÜYbû½Âû«@´«YµÑwaÄâÁߪKþÖ?V9Jîîž~'6ïô¥¤·îÂÂ;`AÙÏ×aÎk¼1ï•jöÚq² ÷î†} ½¹ö|mbáÔøOÏ¿ú,œz´[ã™°ðz~¤ƒjó—`ºª9¬ú„º¡êd/«d4ìR½ ”¨Š£ï‚2.«,´¯Êߧ«ÂvwO¿ƒ…Ó—rðÖ ¯†ÇŒw„yèçE-úÇõºJ………×ËÁ9PÀ‚´a߆4fúeSzµH«Í´g+ÑwwµÿÏ`á@š^ ­‡WÝõÔ Ž¼ÞzM"óÀÿ éÑé­öy,ðq–,…UŠPðL1™,\>Œ…Ó·ÎS•°ðzráƒXH›¡2àaëž?Êý—™ñí7b«#—›Šª3¢Œ…Ó"¾}Û„…?‹@CwЕÐP±oĸŒý´‡X ¹ð‹°ð¼ŽtëaóvïýÐgsy¦$Iž…ë¢$ý˜ŽÔ?r­‘½ð±ðŒí|`'Pio<á?“¿P´šV¥æðxà&:=Uˆõ_Ú d;ÿF,ôð©žÜJIñ°uåcA“.ßÇ}æšbÕÎôAŸêåûüHÚí +BXx{,|f¯í€`sljº‰ +?ÆBó\ѼµìJ·àxº7ï÷c¡¿µ² oY¯ëKöÏEÿ$P2Å¿ÞvK8ÆBë<Ý®öfÝgb0>…Ó—©&Ð~”“èŽOæyÎKæ.´›è„c{áòt_…›ýÀG„E¥µ«ñŸÅÂiN‡ +î]ïÞÞ ›ã¨"FOul¯–C,0 +þxÆ7©3̓‡Õ@[ µÓñi,œÅ©Jo¼ „…·ÇÂã¦iÒt^y0¡sºV±»|»Þ…:ö©¦w³ÍÖ¨1÷`,w…“·y¤5Þ Ê{ïßÏáZX9ÅÆgk¦Ê‡8 é±îuwŸïäѪ»ÑWóرp¢$Š%ÂÂûcaöÞŸ†jÏí]ghëœÚ é±I|[šîD~h·zÛñÃ~/ýÓX8áìÃqµ;ß×¾-”ò{b1¨“ËUV豞àâ9ã’(XÀ<Ò¶õ›’áÎãªe{Fïç±p¸…¡²­·/@ÙÓ?Ø8›°ðÝXPCí[eí¬¿ìî’h¸å“âVmR¦Š\ÔxÅôÍÅ?Ò¤4ÿT¿Jº}àÜç±°IÚؽ’ÝóD—û»óDo€.NÛã,U«W÷Išœªkœ¨Þµ7…ù–Z÷¾s©Дï2¥26ü«v¦Ô-püøƒGg«ÃV?ûhÀ Ñ+baN_挵]êãÙ¼]óÑ,HœtÇ'‰jµY®ç~Ý^—uÿ…´Ù”ÛK¢¦›KÒß­¹¿Õ®^ «|ÿ¸æüç°ÀA¸aî9£ïÌpû”D•â´´¢º[·ÍÒgÔ™”ªxñvg‹pé›FëW\Ýlú/øAU¾Ê¢(Ûf“üïßêBÕÑœ—úÉëâ€_Ât\™’-ë{åi.Wî ð”Uó›ø0I5è÷¾Ô_Ÿõçò…øÌ¿ž)y+,pûtÖ}³‹(*J-½¬º“íÞÌ|º3TM‰ç·ýÜ¥j¿ˆ¯N‡®jë¿5D=aÑùêl«`ܪc3Â|çjj8çxÕCj=…¯ØβV ÷o«¹–sëÁÚ=寲‚П +ϲu@·,þ3–YÎר*·rµVÆ™•ñ7cX3eË[ת7ÀÂÒssø/A€»Ž»bN»ÞRœŽ»oþÉ"®­ù}gs/#oû#ûçm9Õ +´²6œ+LẚÂm%ñÏ`AiwøN.Kdç óh³îå³íöòîYY2•Ö8zêYÃq¼rÎGÎÞæ8Ž†ü¢G‹¿} C ÿæó{5Cû°0ųãÆó +ŽÓ¦ïç̽«RFɉvTܾ8í¦»€=v¹®ûðn§àluºÏÇ#5¦sxÿK{îr»^ mÄXå`pö¿p®±Â1“È÷Ü¢´(°öøX8eI® ´8l`-9óT;`úàœ]C¶­ìO¡™¾ ~ÁÌ£rÇ3jüÍS¶¿ +eÈÅÂTXa¦Ö/Ì ­ÄBžBˆA ô#f~,` ÌÛÌe'8‰Ácýå¸ Æa½amÝ`á&z#ªç ‰ÎMÕ˵áÒsö÷›ŸÇB‰xówH;kF­]ï=åû’1Ö€+4¤’¤ž·– ™.AbŒ¶¶‡XˆŒœŸ×]ua.jz=zÓy¹W /DQóÏþ +šmG_ÁB-R&ÍÏ›l‘†™šªÿ 6ÆéÏÓ +à`Çßœéâãñ[sÕý6°!jÌõÍæû]Ë ؼnç|5ÛäøÝø'Xo®=À\›²!´°íƒô\ù‰Í¥ëzýk“¢U#Ž35Áòb¡”öBÆÿK„¼0ÏäB™q½*¬k 'úèq{"=x£ÿÞ +G0Ƨëj_ÀB¬5 üÅ}ÁâJÄ bü¿™Æ±Ó¯êü!ÕÎÙ$‰¡9P0 fÚ%EÓ›Ãå¢j`rcÕ¬šè™9÷óœù5ýAÝoñn´æøiJùæ¢C¹€Ò'ðûwÚÝ)%q/Ÿ²ëãß‚…jÌ™À‚fãúŸdVœ­åBeðË ·‘Xð´ +i^9’‚¤ˆš0ìÑçéÜ/8üžÆJ}Ìùiæ–_À·y’£ºZ5mü”c˜Ÿ·p~' 4¿W&aQ 7Ó`üòyÇ´œ³ö䜟 }.+ñKöøþŸòí¨]Ô¬QKÇŒêùlc/L$Æx%fªwö‚‹g ãO}ÈåŽ#>sã»þ²½@ô´‘ ¤Í[ÂRŽJ’=ÓV.pÙž¤,d|ÝG{Áò2AÃî>žéËë’µ½Ñáì‰/"S=ûm /……+aa–5¤\¨ÄçÜŠ”½'(I\Eš´G~¤È;ð7Åp–Ø»d£•[ðaä‹’Ðj@.¤`'sÀ}+*IÆès,œø‘fùÕø½ÎÏ`XÈòœÿß%,\x],ØR.¤ËÃÆ€·­½À@Iš2«x,Ð÷Fs8h#d§vaäÂË!å¬ÿ™Å¦d/¸­P‡|I,8Û;z¦äYEÎAf } +¼+aä«ÒGB.Lfh!Cn툱Â`ZÉ…›8U[¤sÁÓúš‚É“)áê©ÉAVfÊ $^šÐ*g¹Àrd`.®[¹P…c-r!Ì%Y³#Éà Œe®Y‰­4}C»vGK "tk;³|M–FX ¹ð‚ä°d—yX¡Æ>ÑÅàf:™ç!£j–Õ"cÏ sœwéBҥߔK~hÌDT†aÁÆ´ [”øH.¼ÈÂIŒaQƒ{b%ìâ'1„È°÷ú Œ`1D>ÍÜ/pDê4¨%Œ©[Zw¦ +>7!,\x9bYø%­eE3ž'ÂÉ… ë‡˜ö>®†ÀSMX ¹ð~ä†ßÎmï1/lÂÉ…7£Öó¿ëV†§«èxÓN $ÞŽþÿÀ[ÂÂÿ…‘àLXx",\ ",üŸT´‚~Q]ì¤ýD;íG§$Zû­S:0¯û‚°@ôéjÓä[÷¼˜ löºùýŠ^Uø¤#ô1fjë&6µ/a;Ã#,ýC2`óØ8ŠU4k&ù8<¸ÏðÔxþRdïŒn}ª†ž¥ú0~›°@ômXà0èì;ŒŒy—Sm߯ëYÏQÞx}tŠiïZ†G9–H²£1 D߉…»ä>L§™ LÛ›¾ ·–‚¬9æñCvˆ1Òô_™7†áˆŠwº!ÿ,ëµèJ8 PuD¾ªEluhN„Lþ”Aú%E]жµG=‡ˆZÚö¨M¥e¹0Fè ï¦C©y?†d3àßòhf…øœ5üúÜãŸ5LtsG×Âë£é‚õÓR€°@ô1rFˉË!ë˜3aX³BÇ Ÿlݘ!pÖ‚ÎõzS8!g|s ¸ì¼1K˜æ¶V,Ø£u-Z™Øæ0¸4AŽÛ,Ï“©äØ°‹È!¹gàŸÛÒÇl·zÌÒ"ÖG«L´läB†¨à> ÿ»cnü°UŠC×°EÒ§ðH:Hu‹Rkt°Ù…,ÉDX ú ÉxÏÊ©p,ÔB]7à!V2¶Â‚L3Ç’!˜K“ÌZcš Éi¦d?ÄxG¯X¬E uÈêwÀeYoØ CMV̈\¯‘ö‚0AøvJE~Nk…Md©ë X•¾ƒ)({Ÿœ3ÂÑÇ)Õ1¹xH¦~´P±Çš[™P50ýlÆ“^ÓÒäÚŠ(‰™† €ŒË ª`W ídV~BÖzT±R-¨ ¦I[¹æ§æu»¶W ¹Ô§U¯7WXP. 1„¢ÏPUëæµYÐâ…šŒ¢Ê©(Z1cóÙ*[«u_9cå‚âOΛ¦*_¡…`Ϻa ™ÏÂçÙZcaÊñð´˜+O!à + ír`µ™Àu¤fÆ‚+ýM Sf,pÉ¡ˆ>! kØÊ\¾Ls,ˆ%½-À‚&×\ÁgêyG8rÁ²ÍÜ\P|Ë1l°¡GµnžØãaÁ¿ldpC)Ÿª:¨Šc a³’ Á-ÖÜ ,}”¼1wÒ4ò*q%ÂxÈ °c7/ï+¹ .iJ¨{Zw1èB¹ ª·°÷µÆ‚‰ Íyå×¢NiöÒhI4ÃÂÂjÈà€ÂWÙì±àÌ:ÖŒ…RΑ°@ô!â–.ªBþÈ5úJXºB=—Åè4`õÅvÆ–:`e{|a„© +̹È_öœªÀøXcÁFUú>È„RΠHL­ËÜ~W`­¨>&^h²-l©¥ Ö²‹°@ô¼± Z¨EUˆüÒä¢Ð#4Õ¼¹`Á½ê±`êÄÂE¨Å \àË2€(qá єA $ð#y ²¿û Ê÷„l@G¬óÉê€ôMq3½¶X°d©`bÏn8¨0LX zHœ'³«iä!x-a“Ë ±Àµ•¼¾z¸ ·`!ÊǬö]8êríʬ³1±<¤åvbÁGýêdxá‚ÖÊj’Ü"Îþ5ÔõҬѫ¯:ÖAºòËGp7ÿÓÕn*à ëÙÃâèˆ%t¹¿`>†Ðöôf:!,=!p_8«@-áöì£ùÊùZ‡Ý䬟6û·ûÈœý› ?™¨ìk°…&°09¸ íiÓ |ñw¤íkÃ1Öõš*qÔ»j¼,Å«²`¿{u 1p[Ù`{{ÁÍpp$±?è$jˆ>L…Y×›âª,DZí(ÿÑÀœºCÝ¿¨bùg˾6LÜYˆÒº69wV ž—æÐNhÑW †ÓË ÑPfš6uú¸½Ç8¢°Žá²uWlΟËaˆ7¦øb8 šÓ¸¹<•­…Ãc§4ƒYî2ª§Jôe!{=I,ÿbŒò`'ìÓtT$É8Š˜%,} Ñ?ÇB>þS,VÎ D߀…r……Ë¿‘ ߈÷ vhN„¢¯R¬ËšZëÿ¤ázdèÅ·Ýìâîw˜ ïã DŽ’ãê#„"¢tVýqb:`!´ˆˆþ<…€"""Ø?O/QpIÉh""""""""""""""""""ú·T8RíGô2ˆþ4i¹Ø¤ ó–^ÑŸ¦Æ­<Ï-Q²“ˆèc!‡)B£„¢?/ aˆ°ˆˆH.-¤Ycæ¹^NX ",HŸjFX úÛTºn¹®½ ¢?OîþÆDDƒ¼s,TÝÏ%)ËäÿxIY$Ä DçXЬ” ÚÕòœýðã3·±2 +È"ºƒï'½K.tû¨°æJW-2˜ˆÎ±àxþgTbó̹ü°\(pÜÈqÑ’Ü*'¿³4õ‡±@Dt g¶]yî h[–†—[™!T§ÁËsþ%–Ñ-Œ,Ý“fJu~™#Züépœë6©¡`níÆ&܃_–záèéQ _·zÙ™åù8dTgyæ7úMÃÍæCz5êT‰éæ¹{IŽÆ­Ñåf\½ÙŽ[ð5£XÆ…'Ê®­^‡\ì·å¡7æØœišúj†cìe£e¹¶ÓÔbñÂÑ–Ëp´øe.g¬>ò«øÜKƒ÷AW?þM8æÍt&Çy‰ýÿR¨ÿÆã¥Çlr¹‚*¿N‚ä\ð—„gRã6h”ó¸7ãúbÜì…n=n|6.ÑßÃBL}ü€}L ºvxÐ,°‰e0Z—)q°`âAç2fÀgIfÖ .«ùÇш&̓>°Z®±0ê ërÎ|‰f…]$za¦üžAQØØ|VEú¸çÉÒ¹ aœÝ;Œ§â³ã|mriÖÉÔá¸c8Û„Â8öà8nt4n~ÙŒ[ÜŽKô±P‰ÝQ.ʘל)ÊL¤¿aK=ÙÕ9d¹êêKÉsW]¦«e>^Ó)¡ã +Fƒ[K{¡—<9ˆ‘S讉Iîx²·<63·lÓló)y7ãÆrÜ5<1uOÙ èGêĸ4>?—èba\ÉŽÂØœ1(þßÀNu#[’ñã%gB}Š¢ˆ¯ÏÙ,UF,h5¬P-êmÑÄx-N\%xR`AF +zœ5É‹õž'Î%âZ[ ŒŽs)š¤”ƒEMÂÇ­æq›qƒ…ý¸R7çd«q ÂaAq·J¹ªsΊ 7ƒp>×åÈâñÐŒõ]õâ<¯2¨ wÜÉ\ÎMäÉ|TXPÕ<®–Ù؆Îñnmg7ƒ&°  YÊ#ŠÐ”’#\»Ó‘jöl#Ò1O–qõõŠ@ô§±`.äXPmZ+0FG+³ÝŠ±gHž[ÌŒX.X(WXØÈ…=OJ¹³=Ov{žL ²å  c>dœÇíÕþba+œ=ä¸a°pKRKˆ¤ÿÛ˜¥Ž¶V&JÙÁ…¿Ýɽi¤ôí¨ÓâP6xti¡òçì×ç\˜± t#gÏ“·‘µH˜-J¹)̶‘ƒ1³‰åpÜætÜ\˜±`œéfD æl;ûJ¹V âqæJ2qÜ9Ôƒ§vªù×W©ÿ0iÙ"ÛJ^ò¹ÐÈ…Jº¦Ü=OJøqàSJ>ÜINKŒëÌ㶺\º='*©Ø¹„Âpm)¸ò|ÊŒ3”1b·ygõ©sn@Tx 5ô²‚ÇÆ^T,Ø„Hàæ58òá~f”£Ýjûõ9ïÍ­\€=ˆw +€'Ík»`Áv1ÜOÁ©TÈ9ŠqmþQÛfêãq-ð ÜÈÀ;Œ‹>Õd5.ÑÛQi\™áy†ÐN:ÝóìêcX@wŠØ_°l;nã,ïµZÀD‰;†Y"g ›Ÿ#Ü"nCØ\›Ïã‰y£¥ܾܺvÞÈ> Ë‹Õú<ÛÎPÍÌ‚TàI–/íî/µãë çMQ&Ç-a +–ÍÇoÇuf?Rã¶Üœˆ¸M’Ë¿ð¥@ë*)Fô¦T…9g¾p´L±Âöªñ1,¸ÈsÛÙàp1Òâeö,CË¡´Xbä¡¥›!ÚÖ|º«¸ÖR'‹عc†›Òø9¬ë«2zˆúLš?ð;¤­ÅaPY(~&;z·ºZ5Zò³¶…ÓV˜!ˆ„Æ…»êå2.jD7ã:Ž+õ7×ä÷IKˆÙN-á¾7Ê~2J‘蛩aÿ5²AíÆÜŒJc< B;ÃB | kbŸ˜¦dò¨ÒbJŠ’MqÄÿ^ ¬º](_lÌ)ÌASnÏÖ4‹‰ñ;LQ‰ÇXw(ú†%E‘LøÇ$¾fq¿g˜:ò«õ¹H‡žÍ'7ÃЮƕƒ•ëq‡yÜb=nÔ7‰·Rm=®ð'9aá}I ÅR&¦ôê^õ!,ðë.ˆ…“ËPäüëÍ(M&Ù vºX?Õ‘Œ»ø`§«UK½±\~+׉Pk’ÚÎ|!µ„MÛŸ %7ÍA©ÿwÄM·o+ ¾&ÞuµçãêU[¹¸yøƒãý,ÈhØã¶+7sí”+µç¹®g>‡n;çr¡€»†§VÈwQ—£±“£@øÁ¤äÔ‚§C_ÙŽKôäB&mh«œŠÚC{²ä|d<‰…Ķ§Ä©O2zX`{®ñÏaâZ÷t§üñ7(Æ¥ÌÏß DlÜ1›‡ÃÁžººvêZ{ DD¿B.ˆXð úz*>fɇì"¢ß@ZˆÞæÜ´•[´2ØŽ°@ô×äÂ8zW#þ¯¬Ñs]dª¼JùW ‚}÷huò`ȾKŽXì°`é¸ ?n +–?½TœÞ1Œoöuj#¦ÕÝ©•$†´Gr²¾òH«i%ÜfÎ~à÷ÅBðÝû|=$eh¹w^¯ì‚CÖíC¿} ÝûbÁùv,„“jÐÝ!Fo¥#} QSLÚЩ@¤Ô47Õâ&I´Á\ûý“V„cS4QÒéí$âfŠ:ˆ$ÂKÓ¬ä9m±Nò³9Tl…"]ÂÏ%}eôÚíÆkJ.åµ$ešbÇ=Ò¢È좤qt~¬ìL-Å'1ˆ‡C¹Àâf) Ÿ¿Lï‰!£¶PŠqËù©ˆ^M._ØFiÃ8†ª¯ÏÍŒu°\.ËdÀ^´mÕ.’în/2þ…ê[ á¥c~.ÃðÒo'ãKÍ µEÞ­< ‰-ÄÆávî½¥_,u÷)Å3ñ3×jøtÜ"÷ŒºeW~Zhà {܈Ä@\” „ÉBoE” <ÖÆŽ-Y7‰!ÝÉÀíÊg‡'-´¯8nC¬÷rÛû.œ\Ç€:(:¤×†µvÊz#çƒsõÐQÊtP]¤×„œ?øŸ;00¨*f8¦=xcfÔœí:8?7=— ólþB§ Îû5çH°X+kÌj#纊“–îl—>«Ü†DŠÃ(2ƒO2ã ø² +äßsØy!¤mCìvƒg¹èƒF¹€ê¥árÒ]¬¦ÃtìB¢j1$ÚÎ-?b@ZÆ€¡.p_kôHyzg:Ų^†=ç†Zè]í ÕîâBîï!lc¯ï'Ù˜b ~@/¾„ªJ­…Yt¸¯qjˆG,ô!@R¬S5"çà˽P…XG/…3ùHXÓ4 ˆ<)XiA¾üKÇu˜¨,ÒÄGC¹°˜ZüR~7|°wp=0D¼}JyÁ18ê T( â¬¿ ¢¾ ⌠6e¥±ÕUöÞ|-¬t!DX>š{,J5§8-UCÑ’Û' óÊP‚˜ ª(…!j  +…Q° ™1Θ"Ý_ƒ†H³à }EÍ OÃëãp±P†’ ò1uÌml•6í«ç¹PZ¢pƒRd|ÜFM™èbAhD5ÿ;àʺë&Ýe‚¡ ècdCÀ™ #­± ÜŽî.³ †~b½%®/eF*’ظæm›ð1æjY ”a‰‹”wþí¸cÆÌع©—•j€oU ‹°%Ó,Z¡Æá>‚r‚i|µ=ÈzÚÊ™/ “Ö‚škQŽäB'“˜P¬©Œ¦ìd?“èͱ ö“ BØ®¡—Â*”ŠUR¸ø›·ò¢h‹æ”\ˆ%&‘šÉµîR31gÓ.qË\’-êweó|S¤åH.äseIC=ÀV ÄbŠÂw*÷'¬8fÙÈ…z EæPƒS WX¹¨ µÔ¸Ù¿Íæ úµåW± K¹à¡OÕÎÃÑê'«‚i2á Ù©eÂØN.ÔgrANBå)iOÅžZßµFQN¬ær†KŸASX°MþïË`¦‚«ðª€ÑZ¨aU+,p–Ïõº¯Â\ÂU5Q}À0K”„‹\d$0cSºƒèÅèj_Å‚7/{ 8ד4[­ñ+,,ö‚`sWØÎâ\U¤h%Ph°eØÈ¥1ZZÒŒŠš[LÕ_&t$…§B+ Ŧçc!R³SÅ]T„]äB,T©DN>²ÄÍ+pl­äBe)Ûc&õŸz-TW,¿Drá•éyÍõܧª‰õ{˜¤Ih¯Î<À‚XêÁ>E¹€T-uUg,èJÜH^Ž¹9œ +3«É q1#mçZò¿+LVS}öïÊ…FžéÀÕ[¹°Ò‘T?\¯‹\ЖROÒKÐcù"f'@Vó– aá5­€/caÌ{£G’3vE¢Ã98fZTe£ £Ë~ÁRFf¬°0ó!jØ«ŒJô,kÔKVÚ°®C¿†’5  ™¬ÈFOc…\Š¤,ÂVÁh͹Yz$€½Í(º"4ïÉ›%…ô•\H¸&—iUÇ)§i“03ÇÇFë¢ ¡U,#–æðúÖ¥þ¦4s)îu¨äÆ®îÀŠ\Ù®^—ŸÂ”Î]mÊlé{3ËGœ•-ÇDŽ°å +ï{†ü7šDÑÉ 9Ü ó¤ëpÄþ8¶Ù sYÏiuXÔ ë9#æ¡(6Ætœ ¨€\ñá#á'3~$œ]¤ËY' B…¦&_C¹äptaIïeœjRÍÖzX¶9Ÿ™5f˜"†´×€à ÓÙ`—–˜Xðe¨C_ŒÉGøxÌOùT{7ó°ËÚÕn–¹ë»Ô:*õÚ¦Ÿ™¦g™÷º‰}AR/s¯Èšk³æg‰¥¼Ó=>jQšíe™-TðÞæ¶8v…kuÜ?/ ~žqJ.|.º²Ð=*nÏXˆm§!f'ÎìÄ™xNdØÑ4ïÊ‹ÉðhÝðÇÃãpÖÖ%ÙÅÔð™y5kt¸7Ò˜L=³çWbÐVWãòy5aá…0ijBÝöºò~Øv^E$‹.@gÒ|‰§¯±°½ïáÇéf´õöõv.í¨?5ëÇ'%ºÒ±(Fïåìn×™‚1½Oû‘>IöÚ—Z/5¾’ïßšõ²è¥^}cQ¦Ïëù‘TQ;m´ÚÆ‚¾Æ‚³øU¿?L!2ú×zõ½A¦óëɵéËÍ˾Aõ·~ fø¥㤈XâýXH"¢E.¨Mª${Ý"ÙÓX`å—V·(>Ñ™‹’”i¢ÿU.h±Áɾ>"¢ßh/¤÷<Þ„¢ß.®2ãeš:ˆþ"¹cnC +Khw7ZÚ‡±×®‡ùøÃGËñ&]w9äÎÅÄ.×èCÃOZýA§’iëFDìò«É 1~ÆÀ}çL›>Œ…*mãó>è&²‹ÞÙ›ö2Ýà9rD¯ ¹våKb—ßMšƒñH­c›>Ž3t?*‰|hYh}laÖ¬Ñ$|†ýÁ‚)ªx}¬´::Ê×'º‹öQߧ¶IR”ã¬j\X} "€;*?¤ðð¨[-Ñ#,$ÐàÅl*úJ:¡’¶ªâdù,t‹¨d¬×Xá5cSá ¬Iûùë)®ª­Á´´‡# 3Ç[•#hB(QvG=ŠãH$áµ™¸ÌŽáiHfaAäk•P¯–Ìf ‹m,|7XÉ+“ùW‰…Z¹ÂÕæÂój7¼†JÕª°²³7VÂäæË"0PýÏd} 8M“ÍXã*3‘uˆ8ÁüÖ`[ )€á±–“œš Y`)°€Èä4¼¬¶Ò“½ÎG +($, Û2(±Å9ÏÒQ´ṅËåÔ8¯\ú + ÕUBa ùÏ«uJaÀñdÁB×ô3bJéæ©æꕬS‰I›, œBͻ뜕½K§IUñ² +ååâr,t7Û0,æDUõ X€@þCÌ5¡zx„‰…ËÍa{ËÃ8§™º¹úË‚ÅìÌâË©®j®ÌX%÷ æd#ZY#kq•–(a×XªN©&YgÖ†¹8®W¥#éP¹H }U €K˜Lõ0«Ù^.x:Rw‚¬eùT.ΕjC°€¤ °XG p€2\™ƒe¿¼…þ@ªlåÖh‰çÌXPÒ°P®±€÷Ô Î×"Ì¥Š× SR{/<%F ¶Í $ ¹5àl¯<¾^×RO +–Ü`!• ,§u‹Ås=ðõV.dªÈ’P‚Z¹×Öªôu¬T(,aÎfK"÷ÚDùaYÅËU¼f,°dŠ¦/Q»¹  +íµ€|’ „…3¹ © fÎx²ú;øN3¶Â‚/å o s‹G–þÂjï{¹€ÅèûÕÀùµ8Ó]fkK»Ø/#À¥¯ýHʾn@ï_c¡1Ú,e¶r¡“!Œ5L‰äÂï¡$™’r£`åyDųr¡­Ž+6xº.ŠåÂûhËUXoî/0oôÚ)qB·XàlîÆã†÷0Ýú‘Òp4ØT¸˜R¸4Ua ëdŠ]pKI'º_€f,öøK25™ÄÚŒ….„k™½4}ßÈhÒLÉHrá×P“ÙU†9FC·:TÞ²£/ø‘¸f’¸ã˜ç!úîKo sn;ÀØÒ\òè}Ôrn¡Êz`R#RÕ´P9Z}½×‘°RïÊSŒÁÈù˜¢H˜òÈʯ54©-üÚA¶U¼t”b¦%Þ¿˜¥–uÁ¬qɸnÖraŠ¡~.Š‹Í~$»S†–åºØaªÈÆÜóN÷NO°PyœU;u¦ó…|Šj/Ï3ÕþÙÊ=tÈ\=‘8ÊŒ, &Ûý£4²Þ XK|]„³Îu³7÷fÑÙ,ÐvŽŽÅÝÉa>¯ä Ó&zO, ÊÝ"ý#—:þ2þ-ÕãÇR&ÚŠ5=‘ûNW¤ê£¶óÓ`[ã‡q@.P˜Ñ#ªÂLþm˜èBúóKc:¶},Û2¶rJÏ$z(än†êLm  ¬î¥± ùÓðYÛRz&ÑCÆ’.LˆêAs1vòmœjÂývÛèàÝ·-ô3úËaèOa|ª¾ª†„æžðü/Çko*»²öù¬!“äí±ÀÉËpÇÂöa¯-o^ F>È?ììq·?;ß×™IN²ñLô×umyÅàB¨»±”.yÚFõf³ê±IŸQ)±÷¦*ÌÍÌ +Å®i©çô{âü?°€¡ ø‡÷ØšÜô$ôü öÒgMõ¡e‰²i³)e–UãàÏ4;5Gê,òîrÁŠVíΓ¸}©ý… Žþxi®õD«DÎ#,dUšvfàa…|FE ‡ÄÂô¢C®Ýžjüë…=ñÓ{ËëYÑþÿbá³H?Æ‚JA˜D¿«ÖtwŒe,þ´§°~p7œèå±À®ºk›¢ôW »ºìÉY'½ú¸©»ìßµF•Ô®[GSa¨³’Ôv]{\j†Æø×¢['ÞɈô &Üb¨ùÚ­.ÅqusÅìƒO‰WèÓ;ZÆ +q8üÌ­å‚ây]Ôh3-WÞ¯¨½13®|ÜfÆ‚fÌÓ;¢,¤À¼÷ÆBþU,h*Þ:ƒ.­ã\¢8 ¡†Öš˜ô ÕSƒÑÅï]-Ç `Yv…Öîe„_c¤tóle/À!÷âw¶nĸ«~á1Ír Ç…Û£UÀ-†JœéÅ+,¸k,ØÚ Ðdl~1xñ´²jÑ÷÷zjè04„èµ(êRö5,DÙè¥e1B,3³ì<¬Fµ$ÒÔ­PïÍ ®  *žiùU30ï†3áÐ6A3q£0³†³ ¿ÓÕwXà84#…×Ë3K~gw‹Î÷®Ù£æ×£5ôSœÃ ù™K%±Yÿ5˜¸™zÛP¬¨ç(é*1.bÁáF…Ö²åé¡õœCý :Á‚,‡ð5TX›aÿxh *~…’ \‰1E–|•û‚Ët-²ÒRHüLE…¢4Üc‹'áé†7¶–’Dp·HŒ+La/ÈÂL¢TØl;w¦iF&BÉ‘»k=JàÅ…‹ ܲ¨Åá³Úx  þãXÎÎÈ\êZ`Ê¿H&.E6D¡€Š¡˜Õ˜MKf¶“•Ã°f¶Z·½= qÿ•Ž¯/¾L¡#AbšÌ7C,$Ùxv\¼øT-aGƒ…/F¯Üaa– æ(üâÓÚxI>vÄ& P$HÚЪ4E +L/Ž¢bQ*¡CH>ùÍIZë¸ä‰ÖØΨÒ÷XÀòx×ÆŸ·Ë¬µ»Ç†LÅ(:zÉÜP8;/‹Ã54/ãÿsW¹L«½ðÆ4Ë~‰Ø  O9~yD smYÛbœ_LBý))g,è3Ъ 3OÈdêä‚‚½Ç2”u‰a'ŒShYúN.¤3'÷°¿P¨ræRJÃÞø?#M­ôÜ&èNä‚»q‚ÒS,8Ä&Y.äR)‹He¾wà¼ÿr! Q.x;¹PæcV§… k¹ Ÿs,ðÓVEÄ ”lj\ÀL¥HÉ‘ öFéÂlaçúD.€ +WÀ€Ëx·¯âBlò—± —ð"Ëcµe…ŠùV.{a/|1n¯j,¡\¨çê+gX˜ƒ2;=— h;+ËbÕ£ÍØÈ…>T²­Ôœ{A$ŠF}Òu1"{ácÁóíÙœ3;zˆš\ðÏJ.TÇr¡…^4 P²È…j° ¸`Ÿc¡Æ¨Z¸ÖŸîÈ…+áà +kÙ=ÞÊhfŠ`HlYæ@.0QiÜÀ°“¢Áy±æt)U,Òªÿ8˜7æŽic½/w´j³Î±Ÿ‡ØŸšå¡½ …£Ûu† +,,r´sÃ4Âc,` ·`0v*¸Qá Ï4•‘½³½cfÛz>†×3?4NqƒAW!½õ¤j÷)ÿT@Hþ8 tÝ({K:n5c«¨gäÂTã6²gŠz{‹\Mv=ý\.@M<ÜwŽ§S¹€ñ§­<3\^Úo48qØÉ›nüHó¾ó%Ÿ4]O<9H&FûÎ \© GÕ·® Ù¸@K±É_»¹Qª%S‘â7e‡ç¶0qãu•L=7 åqy|°¸ãJH3ÿ¡u¨Á&Îäã®7‹5~—DŒ;Åx7–:&“g®cXÛnÑš4ƒaÔé:ĖÔ:ü¢àç ¢¢Öa2<%Ó‰,«!.ùëX ºPaH¼ŠÀ , ƒž¬ÂëR &ÂÑô°1aˆèWQ©qj½ÑmáCA/„èÏRo…ÐÙf ù_aNNt¢?­-DŠÑ_¦.\jkQ­¢?M.‰"¢­`°H,‘` ±@D4auUò‹ˆˆ‰"",úEN$""%H,¡` ±@D$‰"" ŽœHDDHìéêôDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD¿™ÒK@DD\Dkw""¢,[ôý] + :+‰ˆþ81°@=„ˆˆ ×"aˆˆ°@DDX "",ˆˆ DD„""Âaˆˆ°@DDX "",ˆˆ DD„""Âaˆˆ°@DDX "",ˆˆ DD„…¥„EeÜ6mŒšo} ç c*Ë¢ˆX’¼8Š¦2‡Ëõêûþõz †T‹…|O„¾ß‚…ιžÐh0»ª)_Qc^|Çñrç¤í0hŠoοÆÄn¿ I·f¤[r€.C_üÏR¶§HèÀÁÄScÿ â}Š&!¶}Y¹°a®Kú?¡õ×ôä+-püóñ?ÇÂ÷ɦ];âÚwÀ2×Eû®¤ç QwŠ$ÇïÙ›`!‰Í³§$z=,€mšþ¸•X¤¾suªÃ¯Ì ”N·oÇÞ â) ¯ƒ…[[áF4¤?+íü~ˆ…ÈtÖ +?úü\ü8‹“½>¡ê^ h7¯lSßéÖhvpnGXH–is[Ƭ4Ø[€=†¾ü ÿ”Á¾ ¥ïüó©>‚hÚÝÿšFÓ´ª üyþaÿa)`x„Mñ»ï›Z±W¬M/ó·Žö/± è«X¸ú„…—‚Óé?¬Y4ó«tœqÉ-¢@âÓ Ž\‘‹-áÑ?›žf +*¿ø”‹aÁ<·XÁ ½z…ᘓ~CõïÌE„…¿ƒ¾*£áþi?…6HÅ.8]“ZüKñâ?aá½°0UÎÿ`1œb¡Ðôýæ\–)?ÓJ2ÂÂÀ‚Z‰ÿ¥Îñ<ª'æ,Yìg%aá`ajœŸg­3,$rÍ¿¿ä§Î{(I„…wà |©¢Gÿ;Øà?¡¯µÊ¯Ú ߉…yâZþïXˆ.ýKùŒZ÷Ä„…ßé˜ñý“jV´šÖWšÖÄÏHV6üô^ÓÚ8J>Š…Ë3X˜D4ú½ ·$Š˜DóÔœ#~®Ö”Úa‰b|Êæü! ï‡MaáHå`M:\d̆s Lí>—š9\œåôjŸÆ8×õZ*•ÿÕ÷ñN.øíÝQ*ˆ¹A†Æ~®«9ßÚ-Ž+¾ˆª`—Ë‹oûè抾”o¥SÞ?O)‘=ìž’èe±ÐH,8·XÀ”š%n ÖâKŸÝ/iÍË:‚N猰A,´Š½ªöÚOõqm\Ñq4ÓL?ç› SŒ OŽ3Ç?U‘0ε›·‰„ðkÍe€Ãû³ËÑS’|x_¹Àúƒ”ßñ»cÿMÑùG§;Ã:˜BYêÛ„Åú*0ïóv|Ò Žs‡{Ùe<à8ˆþøâ¬OÔGÕÖ‚Çà{ÖïŸóæþÇOIXx,ì“Ò+È9{«¡-ª’3DGXØ&<É¥û ø¾‘ųÒèU±°„mVÎæºRw¯§Ë¢Ü&ÿj%gCÆ¥“±µœ½0o¶Á´Û‹†rØÎyXÏy‰+°à·Í.…®}€¿¯ÄŽti•‚4ƒ!ºo/Ô¤#½:âëѾssùøjj1·SYÙ¤ÁÂÝÛEnÎÀávdƒg³(ÖLgŽ£+g¤âÔÉÃC…”.–J;¯äPñ"úæp¼gQ@Êþ.°píqoo^â=ÀÂ5À÷ÂU®†ÁÜ’B›EÑê²>ŧô7OÙ÷¾8f.^{(Ëy™÷»U ¥¨¿8‡¹4’…¹6Tl Ù9a»&žÇl¯”ΡÁ>ç®ÙœÎs3W¾®Bé÷kç@§8O:θæÕQ¯àð97ÕXåûÇéE´¿ðfXP ñæ—ŸcAý}ŒY q6ûaj¬½¡LÓ]ìÐ,Dƒ³-Y3TMñ”íÐÌ<¿uê$½|DµìO«½vH +⇕• +¿ƒ‘F´Ý)Pqïû-BÂÂ{aaÖó7§i3näúœš¿¾@î‘$ÇÍA¥Ú“XXDÒ¢l_†ô1f»Ç¿ ì«nvPé³²y¥’ÝÇ‚s“[¡À°—~„…wÂB嵩µÙ¿¶ç ÷ÚËüåƒë^eš>‹…=ÌxÐüëY”’sŽyƒ'(Îâ=,¬ŒŽµ­"ãfƒ°ðjXàܳ§®ƒZî›Ú[Õ-[æDƒ¿»H»“‚kqÁ’éY?’rXÎ1|Ç7›v¼ŸÇíj½‘ÑÝͽ‡_»c¬l÷î ¯†…94lK›êyÛåQqöp¦ôûš†=ÄGƒûX'ÒÁlÏVþüÁ50Ó¾)÷~¤òƒXð‡èî+I ¯Œ…'ª oƒuÌGÁ¢³>¢8©TŽ3ú.,pö.µmÜë:>°b{f—Áñ’lšë¨±bጱÕ­Åaáí°°¯Ô{(ïwdýfçϼ:AÿÌ^ñSX@/g“ÂØAä©Y*ìO&mwGÞ­§äBs×£»ÙG!,¼ ¦z¿&SPî(<é^rTKì äû°oÂrYÙ¤Ã-vÅÄ4çCñoÝÝ,Ñ;ñH§õ¤0]÷/!,¼d®Ížå[ßTURÛûë‹Ë**Õ¹i{W<| ˆ‡BC<ø0DèÔ>†íƒX8·¡ªÛ;ÞÄv†…ör›ƒ¹bô;?a{»Ã°æSÜOèbAÈÍÜ8—Öª2¯íG°p¦ÞÁB÷hy¨ /Œ…Ë!Ô«ÿ†Á4Í´×â㸷þ1äÞÕj•LÒ›\/.ª†}Pü4æe•2 í-˜§‹ÿuw«ÊßÁÂéKin-«aÁ7YrKw®««ÞåíÖKçpkìh§ø³XçR7g®­,šÙt-?„…“Óï`¡",¼1ÎkÎ?ÀÂêCÅy-{íܺ?‡Û戟Ç´N&] ü•Òû4N_J¼7¡ /ˆ…Ö†| UÞü­«©¨Ž6‹¹…~Ù'l~ KŽòòhÑýí…ïÂö aáoaár~, 1N·uþ&øËX˜£1ðÿc¡%¹ð ±ðŒŽtc;ÏšR¡A_µ½xØ…FŸb!aQQ>æç›26ÿ¿ŽDöÂoÄBÿÛù¸ZWÜ›Ánsl»[qŒ…bƒà Þ‘b`aMöT!Öi;k·é<„…·ÇÂû ñ£2õ<±ÝÛ¦SbA1ƒk5ãìöݯÊôAŸêDZ>U´¿ð›°Ð<ö?©E°»w†±usÞÜ:™ç ÍýPÐ#=N±Yb>ìçó=Xè͈öâ«?Üà©-i=ôÁQÙ1b•»ÿxq¿Ù|hðoS(>…ÓÀŠGúXˆÛ¡æóÑ?…yÐë ³P=…êYÅ.ºTkb•1ýY,œ,Rœê¯ÄB¢’ûµG¦ëvOXr×Î5aAå–>‘t#TÓÃ3a¦‰Bví‹X8“Y”¿ð+±03Z÷À¢˜y6‰ÊVKÍ)_+õâħZ=Û¡S…-±uÅa–Š¢‘ªŒüg±p*³ŽbÆ ï…æQoÀn·¯TÉÆí}§ÓC,̉ÖÁƒm%ò ë!Ûm” 'nd“ò%éíŠeg¾ë{ÛÈñ­ú °°ã’ļ[žbÏyÉÕßåUYSoö} '‰míц aáý±0ç3‡¬²¨õżò‡dlÄÌfGö KÄý’ó³.ÕÜ0Þa½²[cÿóX8„é ÎͶ´ŠTéˆkß Kémv¨ï·XU)½{V6|¢b8ºž‚¡OÕ¤£ú¨«Ç=äNõy,>¤v¨U*,˜Äµï‹…¥|ÐA{U~ÍHéa ÅÍ‚½)¿¢úuɱ®!Jþ‹†h®›½±BHws]qÓî X8ÈS¯dï#¾<ܨ!zy,Ì ·ºÊÜ®gýÃÏ‚d¸YÍ#ó`j ã6d¢Z•œÐ-=äö¶˜Oaµl Wg_p¹91ùÙs]I‰^ K¡mÇÜ°ËÜlàXAá«ùîwW[mÛE|.*3`£„UšÝ¢%Aמ mVy¨I±ê†r[xU2|;Ü–‡ý +®Îu]9$Ñ®'ý殤7OIôFXH–BÔ—jnF­šÐ–”†Ž8«¤Î¤œ{—l£›‡ÑÕìRs¨nõÕÃ*ºª× Ùz7¬ é9ªÊŒÓK¥ ””ÕåÀêý°Ù‰¼kç7\óSú×a÷”ïO‘1L¬†ùiTéa¸ËT Ãü²“.€Ï&Ú#uì­°°´YÀ&U•Ö4MßKs²ks₤ÎNãçkZº„æíñjÛËl=ÅmgÍMuÕËëa}ûyœ³VLá >UÙ®ÍLáþéà/Ö~tªð‰‡~“`0FsŠóqfE–ã…kËÖÈ!oŽc8¨%-þ[éãLÖ²ŠÕÎ`a†…—EùÒÜòÝu$\.¸Q±Ûmræ }tÒKw“t9ÒÁ“jÕ]ñf +ñôX0U7.IÇåšöž€¯5­~AªB—kÖ8fò§KÃ-F}Ä‚åIÒç·^?ÇÉÿ7ÍA>ÿp•ÃÒSöo¬ˆU¿ÎžLúë}48§×þêœM¹œ¾ þµìææV’½û”ïM^È#.±S|ÊP`!ób– ú3¿N +[€ÎT)|I9æàCÎÝ4ßñ÷dPøÅ?Eâ©»–âá¸IWLß‚¿<À%ýጊÍS>›\ñ”Ž.üLVèJ^Œr+[Ë…<)/2+l± X$K,&,âÿH¦R› Ô$Ö¤a–D‘ŸOcšr} üYÓ]ÝF¬Ö¥”æ ûX¯õˆOÊÁY5"ßï_%1ðŠj8CO×`ÕåvÎû’±“x7Î)Do÷C¹ñߎ³ëq¶âó§\©mý¯Á‚ |X¨Ã]sÔ=8ÖJ,d†ä}{4¬¹PxáZµaøOÓ²'#7m~ÐnNÈS]žÅ_ÀBê_€®ÝL¶²‚D~ÉðaHËóÛ%qøÎæüKwR:obý , ÿ ’)‰´N„üùŠ@;Nï·¼bqãåó¦dì$ßÍI `%¾½Ëè4¨ “\w§+;?uyÊ_˜TZV)°zBIÒGÓ[Ë…¬s|Uyž†'Xˆt‹C0æ‰ÀW VEèÙÙhÁ«òÃ1ã㇧é2ZÚt$.|¾æÁb±ùœo ÑTû°›fܧæ κª¹Wb˜•Z•¦iÕ7Ç•W~BŠƒC%Ì`0Ó>~ªûùxþÃÁ£‚SÄ؇/û®9ìä‚\ÑGçô‹ªºaߎ $ œ%·öÂTã9ú˜6áΧZïlgÏÄóõÑÃçü.†øÌÙ_¶‰¾ÕZtî4µúk$Ù³ÆÏÆT 팅6´ +¾æç“&±’vrâüL~¹ g ÛÁã€ñF½ïºN³%& /†Ÿ°€ª½!åB:’TXù´“ Œó²É?Ø '~¤Ù§š×©Bù¢óO +lÙ,HrÂÉ…Ç— éÄd®" ‹½€JÎ-k-|´¿Pî$ì}t$ ~?×0lþ?Ã!,\xq åçÙT¤d/š0osþ÷c¹À-Š6µi¯#Òüœ $^×vvg¹ÿȳiÚÙ yý±\àrÆ=2O€#lø}ÑY5Ù¡AX ¹ðªd +^ÈÍBGè\˜œ1 «i– ^jJŠLy-¸Jƒ1Þ%ƒýJ€Ãaeó/ŒíÐt;",\x=*,Ø2€Ø¼ØHÀžâÅ^fyÑï}ªã¬ÿ2†/ÊGܼƒ½¶1÷øuð¯!-O†Â^q ÂÉ…4`/\ô’?&vÖÁ¡Œ3¾–é äÛp}ë¹\Ô™—Éÿ²9<12Ë\­+C¤ÎÃÜoYsóÐò® )¥xÂÉ…—£þÔçÿA’É~ÞhÎþ#¶ÚŸgw›qH.¼¹ãwWɘŽÅôH.¼i¡÷]·Šln 8J÷² $ÞŒŒ9‰óËjR¾$ÁÙ$H.¼±úÛJ ¥õ\( MKÂÉ¢aáÿ¡Nfä zYߧx¿©'å»à`1#,¼ÐÏ!ékÕYܳQcMæº÷Ü™–ÿ`$ÍûŽ* +U'»™jA1 °ð§ íî=ÏÊ%7!L:ìÜçQÅ>ƒ%þ5™¹óø‘÷¬íä°‘a`­ÂÂßÆ‚ãÝñ×`.Xdëw×Û$ÏÙK`ÁɧéâÛQŽ@f¹þ:îR6>áØÔB}z,\?®šæ# +½úè]~iµmÛèWž9ºuËÙ0L©­×包JÔQ+Û®…Y׶n_"(èlvP$Ã×ÌÊÐmQŒ³r¢’ß^VB7Æ©Z®¦'9õ†®²Ž›Z7ânƒÍ×2yãÊWõNYò«„¶ÅCN^±ì0$)Ÿ¡P0[CVFëù©NuÓòQb˜§8 ¾„ú],0Ym;Lƒ¡*§ˆåcÇ ðW”VN1Û¿“;Äèe/‚à}×ÃÏ1ÔV±ðkPXÂa°Fu´Wf V-ÔYÎÌt<žq#‡¸È>nX˜hÙaY¹§Š nl¹+,015>›ÂqÒ8{´ñžÀz±'&¿¨fœUq| åÔ€gŠÄÝònªðCÀo$Ìsö +¼ž_¡ar+† +mՆ♯¤z´ê¾âõJÓ¡^Ö…óXß×Ö¨OÅ%í!,Ë¿¬5Óóø&ÌëNÜ}* rHW‰ÅöÓÅ!Ìp´µ.WX°áFC6º+,Øpẋøb {Þë4Îð‹îUªyCE¯4ÝTÃ;c~ÑR>­ˆ™0[†:w„ežŸîÀ}\1)݉n¹ ¡žJ X‚´>È‹#,üÊD0– +Dr g§°à +öÓ×XUKá/éWºbk´eS±z2Ìãœ#«xh ˜\“ ÆîÛW± RDN1ÿŒ[šm‹8 :k¢}péضÈ/mø•~1õØà:­ëf2Åf‰¡^t×*ƒtrì¹ç¸)ºîò¿Ù|w~Rm@é¯B5‡‰ÆfÑ`ÛAÃP|ÅŽj½Öä½`ú«¡ˆórÏÏ•‡Š‹m×r; ç§Öü×ãõ%*M°Eú2)}¬#C]ƒ¹@ñH€‚UÝ­È +_´Ááýö³JÇù:ŠÏ5(Nõ¯a½+òñŸb!¡ü…?A—U`\d…ÕkÎR ¾ ©|Æaêaá·Qê-?=ÓÝö5géd÷q"Ýý¾!u¶ÏPb™;ˆˆ¨ÑC†°@DDX "Úa!³‰ˆþ> +stream +xÚ`ŸÿÛÛÛttt•••ÃÃÃ"""‚‚‚®®®gggWWW±±±¸¸¸ùùùõõõèèèýýýÍÍÍCCC444ñññµµµìììÑÑÑ£££áááåååÉÉÉÕÕÕ½½½²²²ÿÿÿ`a?[endstream +endobj +5558 0 obj << +/D [5556 0 R /XYZ 85.039 781.388 null] >> endobj -5479 0 obj << -/D [5475 0 R /XYZ 85.039 472.152 null] +1470 0 obj << +/D [5556 0 R /XYZ 85.039 761.463 null] >> endobj -1678 0 obj << -/D [5475 0 R /XYZ 85.039 196.464 null] +5559 0 obj << +/D [5556 0 R /XYZ 85.039 743.459 null] >> endobj -5480 0 obj << -/D [5475 0 R /XYZ 85.039 175.263 null] +5560 0 obj << +/D [5556 0 R /XYZ 85.039 564.002 null] >> endobj -5474 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F35 2880 0 R /F15 2876 0 R >> -/ProcSet [ /PDF /Text ] +5561 0 obj << +/D [5556 0 R /XYZ 85.039 564.002 null] >> endobj -5483 0 obj << -/Length 1570 -/Filter /FlateDecode ->> -stream -xÚÕX[oÛ6~÷¯° ¥‰Eê`iÓ®)°ÌKÜvƒ›E’caºU—¤öãwIÙL,§[ƒaX‹Däá¹ñã¹a–ÿ™zÔá‘„Œò0´’ræX×°òãŒi[³ØÏ‹åìùk_XÌ¡‘YËõNG…Ç­eº"/ß/–¯Îç6眰ˆÎí ÉËw‹9#Šº8?=[žžýˆ3DFÞ-pùçóyÈÉR1ží–zq¬fœ:óËåÛÙ«åÖÓ­àU„n~š­.+…-½9”G¡u c‡2X.gà'õ×óbv1ûe«J­ KIM¡âñz!߇…{,Ì )ãVà9Ôs„„å$îãu^dGsÛs=²úȸÀŸßÓ̾ÊûnS78mÚ¼ê¿ÅÑîþú8rñWyוW}×7mE‹“KD\²z)äëj_?ÅH24ÝÓ´(¦ô¿ÉŠæ©Úé¦h¤î篙‰˜Í…Ú‚Sá+Èγ¹ÍH™•s7 Ws~KJ ñ=L#Ÿô›&L€$¸X—%~â -è)Ò}rÝffY×­¢õXϱŠK=º›»!©5I#×*tEjœ“ºCZhä­ZMLÑÉüõe­"å•âéz¹‹F"lkLœ/pOŸ!q„˜ LZÎ;•I-7XŽ;Ä\‘ - FzE”c$J\’LZÕšÊýL)߀L ˜ƒXZµóDÊd)=…¾ˆ(ó£G+ŠÁ#SÇuÌÔa.å̵|Ð@0 TÆ(8áQ¬'€9C7§ªWÙÜ÷É…œd D¨CÀ.‚YQ蟼ŠqÛMžh‘F+Ò!„‡"U ªêT”àm§‡'íhýf”|ÈÚM¤ÍGÇs´8›´ÍAhì‚.ƒ ðGpÇ3Q|4‚^àS)¾Ûài›$)ò AöߵuÝ÷þiB¢¾ÏºL{ªæFõ jsç™"u›ºë% ÜÀ‚(£”RÖC’d]·ŠâNI€‘êûZ}ïû°39QA<ÊB÷^ýyTaÄ -ÇÛ…¶p¸J oœ\å:•„#|wjJª@J¯ K&<Ò™âjñÓ0ðv XjÁÍŠm¬}w+GRK;vÜ·ô• r‹¥"ÖŽ ¡WU ‡ªªõCƒS¬* -$7y'¶ÙiµQ¨t£¦ƒLÔ¾É Ý@œ¥Xc[Xíx@~à €¬?`?­«gs6:^í -“˜îgÔù]]‹Q´Å2ÿa \ …*gÙM^"@Enôp,æ8FdF™Ng¯yjJíTבæj- a/qÅ¢i{‘G–º÷àj]a2 ¿ 'iÅ6·æ›"b}^W®Oâ±LÏ7Ò ¨ï‡ bpòÜ%C‰‰ƒ£¬í&2'p©ë0-²×J¤ÞG‡‰*Uc #:ð ÅIŸ€iß%æÂí0xè^pÔp* Â ÿ†S2¸çÒ ðîEÃØⱯ™¹šµ‡š—€KˆÇ‚GK¯Ás¸y î©aô°y£ê^ª1UýF5‹ñF —ºÁ“Ž YD‘ý,"ïçܬóõâÌ×Z~ìl>ÙÄÝØ®ä…HÇ]‡¡è${ "(S¹“Ô×UþG–Ça¿ žÃ}‰ûŒ†"øº¾tõÍر';‡»×äôOõ¹–%Âè,„p G13Ývæhe¶u+¶G£¹ýw±_ŠÝŽöö£O·ËÚí†&®íS·}íÝA™’Ëý¢Õm F N3Ž¶ê¶WŒ'u•Mq<~"΃.X–p_´ŠÈbš­¦œÏÔ[gu›¦­ñ>S·G«Û¼’¤¯ˆõ}$J\ûtž®>äUZßvŠûl©¾ŸCj[ 3 O »§ÕZ_ȸì9A·,¯÷PÆKý6t§ô›*Ïð(5ó—ô¸M6yŸ%ýÐneþɾL»‹¸ß<囶7í¡ò¿ùÆ÷þOü‰&ÂêN>áGyñ¤¿ß]š†|÷¼ÿPpá¾ÃF_p×®Ø{ŒçÙsø/GKúHendstream -endobj -5482 0 obj << -/Type /Page -/Contents 5483 0 R -/Resources 5481 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5487 0 R +5562 0 obj << +/D [5556 0 R /XYZ 251.11 410.338 null] >> endobj -5484 0 obj << -/D [5482 0 R /XYZ 85.039 781.388 null] +1474 0 obj << +/D [5556 0 R /XYZ 85.039 366.651 null] >> endobj -1682 0 obj << -/D [5482 0 R /XYZ 85.039 649.169 null] +5563 0 obj << +/D [5556 0 R /XYZ 85.039 331.905 null] >> endobj -5485 0 obj << -/D [5482 0 R /XYZ 85.039 614.419 null] +5564 0 obj << +/D [5556 0 R /XYZ 85.039 262.561 null] >> endobj -1686 0 obj << -/D [5482 0 R /XYZ 85.039 434.517 null] +5565 0 obj << +/D [5556 0 R /XYZ 85.039 262.561 null] >> endobj -5486 0 obj << -/D [5482 0 R /XYZ 85.039 400.373 null] +5566 0 obj << +/D [5556 0 R /XYZ 257.292 107.397 null] >> endobj -5481 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R >> -/ProcSet [ /PDF /Text ] +5555 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F66 4190 0 R /F62 4047 0 R >> +/XObject << /Im15 5553 0 R /Im16 5554 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5490 0 obj << -/Length 2424 +5573 0 obj << +/Length 2910 /Filter /FlateDecode >> stream -xÚ­koÛFò»… »ƒW€Ép¹¤H怮ã´.P×+èœ| )J"̇J®â½óX>dQNÑžgw‡³³óÞ™µœ8ðONBßvT4 Bi«0œ$Å™3Y×ΤÁ° Š5Àù~qöæýÜ›HÇŽœh²Xõt|ÛóÕd±|W?^Þ-®?Ì,¥”‘=³‚ WïfRÜ3ôîÃÍíâæö\y”âã~þåÃ,TbÁH7·ýçËŸ¿¿ä•²ÙçÅOg׋ŽÓŽà*B6;{øìL– ÒOgŽ­¢pò sÇ–ð¹8>mßSfŸÝŸý«#Åß¼ ïÓŠ¯BÛÕ±Z”?P‹ô]ÛsÔ$ðÛw<ÒËÏU™éª.ã"};³|ןQ kI<6"´wé*ÞåzëXï·ê‡Ë_Ç°¿EÔÿC4-ϱ¤sCÚó·™%ßõ6Iò,-5o²>ÖU¥ÿñ~ áñ<-wŶÎJÖÍ9Ãò*‰óMÕ˜½ÿåa]§[žû¦xÔÞÖ%ñѲ1${ø$•‡¿OËÔzÌt³©¶¸ìSÎ2m’:Ûê¬*ÿ‰‹b¿¬³/)ióâmÖhRèäíÃK´7ïåÐ,7²e肆•­æ&@ªt+¶à×q‚[‡®ÐX¥n¢DÝÀr0oüœ*Ìd··Wej¾¯XãntÚžd>»¼7.—‘2A\Û—Ñ«é€CyÎu†yNº¶’îò)E. -)_JXði´@pq§_ \Ðsç¸×˜pö 2LE£é`)!9ya$(Dò„ÆTó9Jm±Ø°xG²b¤2òF]ñ"æ!©fà"uMÛ=ؘ~É’ÖŽ²)àߥ§ôÑì{îëúêqH_îÒéË íÈ èÐÿàWí@là̘Ö:&çÎ÷ Ä.Z¿ñæ¡Øð:àu Px!ç9“$ǘÜÈ«j^£G BAy14˜-ô|qS2&q7m(-ÔÁJ,ê¥nctK%»œf$Tä‰U\dy׼⼆³_Iˆ%‹K²\€·oR:+ò)àóB"•Ôš!uJ,gàf $¼ðã±îÔÖJ,;LnSÍú…¯â=ˆr›fë ¢=ÝjW³!,TýyìŠ5ÚÄwÙ68Â': æ÷q=rÞBHñn D$@U†ôâH±ªjCÊäÚØ -O–ë£ígàV¾hh—/ ”ˆ(AÑ—_sͨâ†À¥:ìmn)Y±Ó¤m -"ÒÈÆÜï€)óÔB xX‚¸O¼›<0ÈPžëæL›P~Ûu©ÓÅÌ Å‚t -ÃÛ¢fСØÇö\§è/P伈sRkÌ 2×#÷ÚwDyà6(d;ò=â±d?DÓg$,liÚCw[–"‡½,ykLw=k²¤‹¸»ÿpË3Îc/9…6Š½äb5œŠTGfâPt?G*=¾Š’0³ÙdpØ A‡sBQÙ!E¥C£ôŶœÎT°.çøé@ÒÕv ‚΢ [•¢\’!§ðZ)½VÐñ¨^„Ž‹»KF‚ñ~;ï*bèÌ&™S{Þ}p^C‡ôµ7s÷ºb»'Ýû÷[Ø…šõ -·óÃZÛ -à Mkp^bÀSLLÛ ø”b¤gßÒL3òX)CÂ’óˆ`,¼ÿ|ÐNÿ?QËOg7+v–L›·’ª/›šòÜ@©J¦j|ˆË÷•qKãr]¦U|[(,I-j Š¬á—..3°Ó©éu©`|ó÷âEæa˜;þþ™†%Í)÷–NhêU#ö(§Ý; -y·z7]±ä£:ýÖ£ ùæQæŽK}ðÒ²˜AŽ‚2Q -݆€2ÏqëS)šV¾*mrÚc}Çv¥ÿvûçýuD2,>¨9“ÿÒ(:õ@P„*e‚üziyAí¸žû’ßöG ÿM³qœendstream +ôùàd¾!lNîGP3Vès Øf¯;ÞvªKäš_¦Š]¹ÁH(Žup+Nñ*FÁ£öç;òõ¶­1>]ÖZǪ‘>À›¶í(Xá”™g| N3À0Dñ+Uˆ9›C<¬‰Rvæ©Å·{¸í×$3B/¹ïxG%P"ß°vûá-/vhY/;çMBÞî‰1¶""y…z{ýŒ–ºçû“ÜLÄÁWkçÎê«Êý/p8ÓʱEFßq¼FÛ‘¸\ìðü5 +ñ¿@xŸp`ß3ŒKXøyA‰µÁà +¯Gñ5„<Õ º‚Là·µ(1qqW6eá’œ¢B<Ÿí ùm$G)X/ˆ„ŸQŠjÃÑ+S²Ü÷~óYø0èáZ^-ø³,·eƒAÔX ½GìÝ wŒáûÛÀ»Ôá”Ç™‰r¯Üœ +ViÀ¤f ¶×7Qê8ƒ˜6íjÊbë’z̦âø×´áðÖìW8¦Baï™8W’ÈøXX2´Tÿ$˪Ïú¨XG,y]ÝÞÜÝðÈKOaŠ?2!E¨’$¡Na’Ö“U”ráê«Æ‹P@Tmvë²+±Í@èƒð„äÑ'']2–IÀ×Ǻ¶ZnéBF²XdþUr ÚÖ1ƳÏsn¦àbYHbL(ÅVN«¶åïGœ^õ<8Ø¥D–S¦= +ßX/ÜÓŽ¿>PÓIkRü±òõú̜ +ãóÝí?17ÐÁI>ÈàCeB˜$@TKV2A-Èf^xâ¯5h¦ß¼àýK,e {tRáPå-Šá¹Ðš¶>cØcÑŠfД¥¢ƒ÷ø‚48ä¸Tu¯`Ù值tð@~nóUÓrœš,ÝÓÈ2¾¨åˆ$ÚªØ-ŽSü=a½–¡,4Å +ÄKSmxXRBÕ%FŠÃåX;èæJ ç’:N\cïè¼X…)þ¾Hȳö»·@÷Èëíþ•âžtØNIåXäËæu¾ ŽBŽ·O|+÷Éù³;„/Ø‹rlG1|ÃÔL#É»r¢7š;R:æÝ»Txξ¤eò€S´¿ºHˆ`±y›,ÔqS q¶âï¿—>LAOp\\©oQ¡ÕÉà§GàjS-Wî§E-m@ô¾T›PšSWÄvŒ¨s¬‚Ï\pÏHЇ¯ÀB5 -iúßÚ-ÿúØç&*øÓ+½(…:¯Ó…Ôÿ§NM˜™WÊt«u¨•ã¯¦ã“_ë-¼°ÍÌ)Ãÿ“»vendstream endobj -5489 0 obj << +5572 0 obj << /Type /Page -/Contents 5490 0 R -/Resources 5488 0 R +/Contents 5573 0 R +/Resources 5571 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5487 0 R ->> endobj -5491 0 obj << -/D [5489 0 R /XYZ 85.039 781.388 null] ->> endobj -1690 0 obj << -/D [5489 0 R /XYZ 85.039 554.519 null] ->> endobj -5492 0 obj << -/D [5489 0 R /XYZ 85.039 522.496 null] +/Parent 5534 0 R >> endobj -1694 0 obj << -/D [5489 0 R /XYZ 85.039 228.95 null] ->> endobj -5493 0 obj << -/D [5489 0 R /XYZ 85.039 207.75 null] ->> endobj -1698 0 obj << -/D [5489 0 R /XYZ 85.039 108.73 null] ->> endobj -5494 0 obj << -/D [5489 0 R /XYZ 85.039 88.135 null] ->> endobj -5488 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R /F66 3242 0 R /F11 2898 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -5497 0 obj << -/Length 2087 +5569 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 418 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5579 0 R] +/Length 26233 +/Filter /FlateDecode +>> +stream +xÚì]‡‚£8 ¥7Ó{ äÿÿò$7 ´™›bíÞÞ cˆžU¬Ò˜š4ijÌY“&M@¦9›‰¥IÓ§ÄD,XWMšþ7çžžúÚ!n åÂïÑ‘®vy/(i 'õð/ ûÁnoOl#TNŸnX¥"6Ç‚CZJãN.<ˆ~`™çAo}k8á:‰`ñû²ÙÅNŠ§®¹c«~¼¹bo…ÝÀóÒ£wÒãÙdàûÎáî)5}[, w°Ð:©ˆŽcr^hŸ¯„½zÛÓ/ûÔ›>½àŽ®Øîfû»2^µNû0+Ï–céAŒðR®³(Ϲy2w–/ô‰{š+Ás9b.)é½x…Ƕ=zãWä ¼›ö”Û‡ôCsïw·αÐÞ¦Ô‡'ŒÚiYÞf¢]ŒqÃ%””l"ä&É%b«íý bx·sÂvÿnè}j®ʉÃÂm<Q™.áö1oÇïÓòÞSjú®ö™Ž„i(G‰€†£ytÊ“L´tØ`á`Dco»¼`qœì3è»Á'î7‘íÁ¥]ßÜVSãÇ`ûR>ÿÁSjú®:’´·kÛž&—•é­>?†§éÂ(¸dáHï¥õ§i@°*÷GX06Ée¨qŠPÞì P–ûãñ5~(Ž}ªkÜš±~ó—=«®ëk Ë (J‚T¨{ï®ö ™(¸¼‘Õܯ¢‰Ý_™óVEáXXä®ûF4Þ“ x’Máp^tzGMC_0È&%×À¹ ÷;ráì¥,Á­BªåÂÃBP¦Ó¡r}$"%¤ú=ÊÐ §ý4,\Y?’ËÊ}ˆß–x¶‚Ø}Û=¹p4(ôJ\Z.ü0,€ò°ÝNVè½ä2g¯¬µ[½‡ù>/`q7!‚Û8ì­;Ç~2(÷ž§÷ ¹p&w„Ž“– ? è™ ÷ËÿK¬±÷ªÆRøñøYX xˆY¿ªà ‘c¿†ûE¹°Ù‘<\-~D÷Ë‘Ç~x¼Ä7Ú±z3æû´IÿYX`x06ÕOŸ/žÿôs¹p¾‰oßÏZ.ü?ÒÅKÓÐ1ìÊ¡O¨¢Nö*:Æ´Üï{çâá ,póÁSÇãçÙ2ñ÷«ÊßÉ_8})öͤ– ß AO;jïp0×ëj÷û¸j÷V< ýçaoc¬›ÒÊ"Ý?ULæYíßy Ã)´\ø6Xxù«x „Ç\«^r´=Fáp«†½ ]3–,—°p;rátÆÂÏj¹ð±¾‰…;f¨p5mÜóý»c¸S"@ñnR.> wüHƹÚxó¶µ\ø~:Ò‹wpÞÄ¢Á9Ú„ìv>†¸Þ_Ü? ÆÝÜÿcŠµ\øÅrá©?0oÓ£&åNÿ‰X¸ ¡øÿ傶~£\xÁv>Ü‚ƒÆýmwžÈ_ Æ :éã=‚›èÀ7mçO´íGú›¶s| WZJ’Oœ´Í=Æ‚ÍËm<ž°(;/‰uÏvÚzW.<ö©êý…ߤ#½µ×vÀ¯ˆ‡U:l¶±±0Ow%a¡ÎO÷æ}[.œ¾ã6}BË……åÁ¢=ˆÁ8³+Ô’)Ó#,óó EÇ(“6û3°ðξ³˜À¢åÂ/²dlÞøW“Ô„tpl/xO÷U¸Ñã)vÄ°eñm?ÒYN‡L­– ¿È^vèys³ýLôÏr9°*±Ð?_Yø†õ‡BÐFm- EÞÃÛ~¤³8U±€l4A-~ºŽô¸iš0Wfß“Á>©úèÜrø‰OUºJiý²eÛ°_ƒÏÖmV:»½?ß• §2ëÈÈÒráçcA„\žÆ'ï3Ý'L±ñB{b<‹Ñèü¡õÌë7©` ïFž +F\ð®\8}›GöŠ– ?Þ^ÞûG9\J&= ~=Y3ã>ÆÂZYØxòÑúskúîÞ– 'JÒ¡XÒXøñöÂZyûdy¾)R¿Ü=?>·œcÿÔ£þ R~Ø·zÛñÃÞ¾x[.œ¼NçȱF. ?]GŽþ‹A˜ w‚âDÏ?pñœq IŸƒ¬Ü§VïèïX,Û½oË…ãœQ+yûˆ– ? Ò¡s¤}“ƒ; ñ("ž)¬‘KWÀwú~!Ö%»ðMx/h6×w:_……7䂪¸«‰8ÄðŽúA6 7Imx“j ®ápº1 ¶¡põ°í¿:†cçôý(ÉBm1×Þ@êœeýdU +}D.ÐŽ+ò!û5³(¹GOùKÈ.2xÁÅ8Ù&c‡–žOc·/‡ÛgJw7ÜS§¨‚Õf ’·5’ŽºŸI ;5Ûtα-ë'oäÈûrwkKÙ;Y Ù·ëÀ¨Þ?å¯.²“ ¬[Ié±YÙN~þr{u‹´Üq£Ú¤é@«*o¸÷œsÇMÓ× MλéÊ°Ç.Wµïn +[îýx¤!,Æ/½åÔ…v¹\~§ Ý ßƒ\ðs¾þ;scªrÁ´8›'sr†Òs—¥Q–²!²ü¹F jTÂÞ×PÁÏ kBŸ5ã×ëHwX2(Ãø…ÓѶO=UÇ#½‡ÐÚ΢ºO<ÆëõäB><*÷q<£ÝS.¿ +mjÏu)|§cJR5§¦*Lg6qMïÍÂ9ÃÂdú³_\"ns¸sÿ™ RŠ­í«SÌ`]ÌEH- ?þ_°@[`Þd.£ª<žð¡wT£<®7l«53n¢7F@Ãp¸£l,·¥inKƾ/‚ñ¶½ºOfd_î=å§IƒØ÷¶þE7nåBÏ”$ÇB¦Ôü[K»÷ ÚÎ ½+8k¶ú+Éæ Ò͹öÉÜÁwe¸Õ{r!ä)“áûO;a »v¬1ήËÄHÙéëù¥çœ8’c>4Rt«sC¨¶Þÿ¬1ÏŠ`ì+­ÎáÞ\ÂßMp‚…ˆ}|³Í§Îmû“ƒ§üeÐ5ò*ˆÀ‚Aacnå°kBåE¸p?’¤hg/¸ôÌM—I†›0y‘)¼Ž…ض‡Áìé#ÏK˘z´ø*ÆÿŸÞEž¯A3 í„`à†¡cò$Y`0vsä[l&b Oèܘ]Ê/£×u‘cïæDÀ´ìCµUµ"èÔ˜‹srìñÁdœôÞSþds`/×nð€?¨ráJAÒw06ÃB׸ŒœR +€ /w¹)nÎHÆišúZúmßÁ§ÑØbW«a˜Æþ¹Óã…ž“‡ç?lÞ“–v|gΟôö¹<}KÇoŸz%¿³Ñ¹Ë–ê•$Rt`låU’¹ºÚó?éIöÜx–Ço¶f¶7'ݳÿ+4íå‚&Em¡rŒd`ùDÀV.  äEx5úT-@LB?ßbÁt3 ×M4¾. Š\¨¥\;i@ìå*I}Ñõ圉–·qUu¤’þwF Z.|Â…\È4’»îz+zÓÏÑ*~,®p¦o2¹W欵áCúó57#-¾+Ìœ¥r”$YúF.€ÚSø`' ¹ÐŒ¢³r¿²4õG]£¹`Z—;ûõµº4 ƒSàÿ–Èë5´\ø~4øE+± Àý¶žÆ`0¹àͪ>,(ÉÀär¿ üÂãDó\DTP¼PÏ«ïZæÜÙKsf¹þìöt¯­ÕXÐrá[ϸwÕv”gk•™>+³mcÌ6•™Ú¿]`våœü"ÃàôJÑP“j,V 4gK‚!-L-¾#¥Œw¹¿˜yÜ™÷¸ï•”_йLãT·^æ‰)LîJÿÑà¬flGÄÈo½ú Z.|2ýÏ ±2ØvóêGzl¼k,h¹ðmçqâÕ³ÐXÐráçQãV¼áˆÙq½ÀB­± å£© ?k¨²ÉE¼ŒÙ Z.hz4´\Ф± å‚&…óåX1,||NÌŒ„jÒôí7IÈ>yZ²Ï-ÖXøcr¡òKøÖýòÎ)È#m×ÝŸZ4§îîW<ÐCLÂÓîãðúpÂøŽLcá;YbJ_ž“CíîA†£Â;_•1ó%8^Òe>Ÿêù¡ë©¹)ÖÐdèr·ï ±ðLjbÁ‰ÎÓ¾C,ô—à.LI‘=º“7g_ð<æc,8{Ÿ*)fzÄ,…¿Ž…»j¾(ÈuŸ¿ï_y_"²ùõ- BÓ©1J<ÑXø­ŠW™u™àbg¸ÎàÂϨèôVMj³céñ ûÙ3\ÊJ½ç•¬–FãÏY÷–…[U$7Ùa0šÖÉ`ÄI(Rq“0ÑQ7CoåcdvYÉâæ.pb¸‘ $ÂkGË¢&µ‡S¸4vÇ#º+f[&Ÿ°¸æˆyÓÙv+Hr¸ªÈM1g½â8ÄÊ׬ÆŸ±l†&õønà­åCA4~%ÅæìÅZúqážÞ†âEÚÎ OAâ½\H¸3(€ÿLéÝêé߸`a«À¿8èÄ%L„9ω(³Iç`­D¶ó0]‡‚y8È°˜€ð#]'1ªÆ¯CÔ˜ *3,Ð4Ç+ÖØí}ÆœÀßöŠ…pîV¯iT^Ù)r¡>cIÄêø[˜©E-¦ivm@Aå‚8°õ“->ÛáX%–@.Øb2ƒÆÂo¤”rSã2,X+¸»„l°à‰´/\y±œ\çV;¹`ò½å¥ØaÁa¼=È~ÆNçœXÊŠñæŠéÝÈ…µŠŒ7ä&µ5\ˆÔ €K锢Fʹð¬³;Šýq W ¥âu7XÀG—r¡?h,ü27R17Xƒ“öÕÊNÖrý U‹üLIÑ7 +¶§³Óa`DÉ€› ßãºI@»öZÈy„ÔÍ\a;“jM Z¿~EÈÏqÞ UÈÚx$£·ó:ú3ÎÂè°Ée=p-qœâB'ESø[™<%,hÐ]è•ÆÂ/¢ÞH±o:i{j;©32Ûúg®šË31CtHSn;Ú)†ô³ãÄ°{‘Ë3:oÈEØ5};^Ã5ŽŸÖ‹Ó[1°CzÂ(âûZ1Þ«ÇáP{1R,Óo7Î?ÃPî,©ÌUèíPüÜؽe\Ð[Ñiðd":)…ê­°\˜³¤ÕXø­ÆÃú5…ÿM[»5w£]ãâk‡¥l4ÛW…ß…Þ×X8ÂÂào,4~«ƒõWÈ…á_bÁݽ…ßIC½Šÿ>Š¾i[ô°¾—64FÑø‰·Ú¯­»KúÖXФIcA“&Mš44iº‹…¦o5iúãÔ7ˆÙõJ“¦¿K>bA“&Måx©&MšRÏÑF“&Mš4iÒ¤I“&Mš4iÒ¤I“&Mÿ–H™×yÿy£~šþ4ÙÛ¤ñ»X¿ Mš.ºûh,húãr¡˜Ók­ 44ýy¹€¹”å¦v¹&MU.\µ\ФIËMš8ŠÙÌܬÓrA“Ö‘¸OÕÔXÐô·‰ÔMUÌ]ÓÔD¿ Mž\Þ-O“¦¿N™Æ‚&M š4i,hÒ¤± I“Æ‚&M š4} Kt¼ÿïïEËÂEŒ#š›ÆÐ_¯“aãŸ÷b¨tnÖýþ}ÓõcT§ÙíÙ„Ö‡ìm»×ì ±pt¼8æù£Îa*9—S$$4uÈohðS#²†´Ér3cƒÌÙ/L6þàúxvQß0¨ëï[€»vMWlÉ©43khSæ|ÊžvJ—¦¢4;ü2ûë8,‚…ÚaßÀByÆò°*ŽwÌgÎsVY™?› GÔGOiûzwöÍ®3 Ÿõ\žº¹Èš®Ù—Ì{, ÝÍIù¬`¡œ7Ù5EG±°^Ø~fO)Mß‚œ.O‹y6=ºbfØ&¹î_ÅBKYå¥Ã»±KÑzsîh‘C§˜³ ÂEvRîHC‚[ 1×Ò§aå«pÁãÆî÷€é­YÁÂo£¾Å¬¹›mï8ZGúeˬßáòa3ïÙlàÇæU,äëê?®Ò«Ì2*âfý`å®~ÜXØ‚ ‘O7XheWq¸®ƒUS +9¤òù¥›;ƒ…¶šý\á¤bÅBæ›·XpV,ô;ô¿ ³ lx™Aý­¨rúw¤ÿ!úŽöcMÍ0íü¢A&ž²Ú1 —ä&2YŸ›¾oFÈ5aæ•EÁ•ª˜ ”ó¾m§Kˆ*¤žR¹Æ±\ÜßàéŒNSn„K3,xs^¶XÈfw1%ò9±n°w ’Uˆœ…‰6q]€d›tø`º.ȯ pfœï0†ë/wj¾b!d=eëÙô;Loæ³çt‘¢wÑ%°’éÏÁµ~=h]´~aYE§3¹eÀT«y6vvlj\¸ÒNKÕ\D·ÎŸ¾õ©ØŒääí¦.2zŠƒp,8¾ ƒí±à<]˜{*â=hl>˜«ùèwÈ…Œ¯‡î5»¡f.ÈÅFêŸÃBÂñš‰˜j6û«íÏ]ê„ÌvnføÑèðÚ€`¤¶\…]¦+ÆÙÊ£ŒáÏ° Ê…ˆªPX͈¢[gV_Üø‘ÊÞíF¬êÈ^èF6÷‘ 8!¢9?³®ßþ;°Ðpå4b •E<Èy Ù|aX  ªF5p¸€žk¯Z{Iyï®\0­ªª\á9š*šhTX7é§Åü R.PTçöÍnµ}brÁbo£L´KéwèHŒ1‚9)0DðT7€Y<…ŽqRÍ?ý€aöcÆÃã¸u¤½ɘùæD&™Ì—ñ\àäWüÄ6µPûê€óIKào.²¹À„ä1¨O5c^³y`rŒ­,Ò8øm:R\Ù#KÆe|72Žãs:RÏ—ÞšïQ%pÎÀù± ÞËà„hÈ éܱß,i€™vX¨ä„;Š3Êó– ™‰íµ +£ÂÐŒô+t¤9k‘ÿAAwé±yg¯øP.H©’:’í ¹ƒúµÑ‘nä‚#"wUN”û˜8l"/KøÞ[µÆä" Ölç: `÷ý¹\ÈŽåBíû"T½šc{ba,¤\ @Ì;íHú%rÁ÷ t„:4:ù>û—°œä1,PŽ¤¶³*l¾Ýeø°žÈÂ…@«oöSq +š-Î̾ó°Å‚á³Ð{ oû‘È€Ô‚mBÚ§äBÒ¥Šš‘~‡½šEáREi¨ºôƒ;[G‡X¨¤O5¡šõ©®rå üÒfÈJ[¹PÎ&Á+ÀZ¿ö®\Ýé…~Þbí Ÿr=Æd„äÚ.Óé¶XÀP½I»›ù ¹ÔÆ Kõ;?ÒêLBÅkݶ3è]9Zi/T³Ù^UNÓÏÖ‘`M‹Wî'íݘ‚C,¤b¯ÍŸÍÆä{m +b;®[н´­\p0õ:føy·Q»9¨½ ®Ð ¸u× ÂlÜÍk,hÒ„´›i,hÒtÅèŸÿ ÓZêëJⳆûø û$Þ§üǺ!‹ÆÂçݶí:™á|µT»5׋ωˆ‹½'NªXèÇJ¡¯cS#ÕÜ•:^¬ª¶¿ 4¦GÐQµº»Š ‘ý¤njž]tlꯤ #ö3VFkž}ë ±°nôå‹É’Îç`á¹ ”,x¯í×kú!dƒ\ð ̽Ï;/fëÿÀÂËôIXßÅ‚– ¿’X°jÃB’› +¤÷±0¸Z½¡›°Z` XǹY¦Es"ºF‘à‡™Çu$øŤÁ¥e^¯‘;”xíRÃõì .ejÔeEá²È꾄ãÑFG²-¼cM­iÃíÄͿÑ.Sí‚ÏÁÓs‹É€í²NÙÉÂÁ…óÙ͘f4 'Á†Ë£‘-ôH•5âÃð&§Þ Ò[×? „—n50y <ݹ™}–dS^ínö1Õ3tŒÓf_æŒfÐ’À€…n. +VÖ¥Áü‚lÆê[¬ªX0›…ov´vMPÀ«rfZ`ÕÇNÁBX°ä |øn¾š"ÉL(å-rÍÇd‡Ã]šÒG«› 4݆óg¿¼òùû0OÀ1ñ$Ÿæ2¹P²{aÄw Ÿ}xš˜³[fº¢ÞĂͪÿ°Üý¨²€†§t$jõŽæŒUŽÚÂo±*cK«Sî`õÕš²QF÷Pø`†L4ö‘?‡|—bd¡µð¼y6íkŸÌ]+Ê¥ÆF¹¿bt3Ȧ>ÀÊÂ}7"‰NhA˜/:V³¬‹¿ˆÍ¦‹bj]uX[š0”ðrf×ÉEnïMüK‘E´ +Ú@+€7\.þœkÛ`i˜ƒ6¼%È„ÅÜfßiú)Xph±•++fG­h5ÙëŽ$ä>,·4òô™šU:¥ÕV*Y¼ÛbæH^an[ª±V “ .[U „¥ÇuµLI™¦¢¼p³bÁæ™C8ÐÂ2žµ°jÉÊ·*^+ƒ=jؤÜ^€)b@¬Ñ|€uÊŠ– bÁeuB( ¨\àZeÕˆIÇÄ©ËVú`ƒ¯ Óÿt¹Ð¼$Z¿h@5ž¯g{bÓš×î\$›êìåì7)Û%k¹VFó¥¹\È9s¥Ò:¥b +oBÚËŠqfßøTé[y3£óMõKp:NåZqnlŠ_ÌDÏÇ)g2%[­ŒGÉeÐ@º¢<|&UL fòg§'-±ò‡¦EÞÆ^ÈnëÆÝ÷#eÀÙ *‡qí(Ÿ.µ‹ú9bÁF ÓU«„é¬õè–dõ#Y 5I,ð¿–”±fZÓÓ8ƒç!¾b;VFïXSÛ´«DµÿÓË*>€Õø²W?’˜r¶¦øãìD™Šq0°]“ŽÎä@j‘x"¼àFrt'>Ý;¦—¦o*ÌÉ~ Ñœô… \,¬Ž–ÏÊ6)ÝbSp¨+ć¹ì±@åÂ1ª¹Ë¹Ä™Y`»‰tYÍPçØRÅ—[w10Ý\­3Ô4›:Ï^Š)ß`!ç7ˆÊ +Ó’ra*â©ç*b^!ŸnæiîúYß]ãÑý…ÐxcÁöM¬Ätv#d´(QI‘õòÚlbµ_ÎèX\p$˜–—<¥x­TÏ0|Ö)MÙ_¸€©Š¹Î™X†ã2[ †EØö¸Šo|ÅCd¢YNå‚íÏ–=¢>¶Á‚ ׊úgÐ`VvÈ°`Ê‚T«Rå‚íûºÀ¥=–ýûûÎfá‚b<‰üsE•ïÖuÉVïªMG¨ØÓ\¨¤Íéq[—fQƒÞ6«^héÑŠ^ hDÇ‘UܵJ'“Ç/j%‡¦0mm†QxÏÝc¡dÏB›8Ü•¹ Ÿ ++Š\;Vy¼o2ÞôÓ¨-±#Çuô¬*z# ø å`åå(—¨|#挅\‹ºçì{+\¶A­no¦À ƒ€ÿ+†Y—òâD‹ü)XÈø4PW§Criîù²u“#d¥˜(ÂBœm9wè7ðü=Zvq>UÞ¶Å)зD-û’n5€K€*°$ç@¯›}þ^:Æ‚ãÓå3g¦âRÌf]g~ÌŠÎú Y—4±ÎJL¬¯u„ÐÖàCä$µüÄ¥äè,‹Uå®.¬ªPöBàá/C.®fßMšbuí[0fç«SÇÅÛÀÐ9UŠ€eÖ9r¿Á…G’ù8 ôP%¹ '„.ÜÄ‚{uRóÊ’ÂgŒSl’l~5öVÓÇBOw`ÅdxÇDWQ¾t¸Ïu´KškàP«•‡Ö,bæ5ͱ|{D• „C¶Pç–YcC&P duÈ®-n›—n* ¬›—È¥>)¶žûŠÞÐÎW§iðœŽrj˜5è”k˜Ñp |úŒðóBõ)Tk4³mœCQµYò˜í¾¦n%ÚÀÍdÕórïÒÒÞ(ÝEsÌ_Õ·jÍ:{;ÄVW#í2¡³Íº‰UÁæ züOzg„ƒtô¶¡!Y†™Öœ^mzí ~GÊépûMðCëÐ1Õ^¢Äç´v˦<²Yô¢É(†Ø¯ýb,õ¤ÑííéüƒV<¤¦¿……Ï"5TG‚jÒX¸J¹ IÓ_ÅB¦`AgŽiúËXpòÕ£»D¡~ßšþ,4iú¿©' š4]1ÏÅÕXФéúJsžc,,V–•!†I ÝøÇzh9üŸsiF³)ë'K†õQ=}dnQòVç8)5ƒý ú`­0‚›¶õ‡bÎu´>!jŸ'øÜ ´±ÀxÛ³ö ØîöÚ6ï†Etó[¶|¨vdÔôÿ“ŽváºæDu}a+éæ5-J4Xs¢§wò¤\ØgF_ÖÎsXHç"5ZÚàÕd ÉÍ'a!/¢{¸L1üÃ|2ümtMÃ…ê·±à¼s™£]Ãß‹šgªë@Ë‚ë^YgÌyöëµVXL I0¶Ÿ5óA”å!”æá ù§aá.™ï,ÔÕ«åù>*-¾üÂ5S`Ós-ÇnnBDz N3wQˆªŽY:5Ms7|ß73÷¹ÐÇÉœÙõÅÆ‚ˆ…Öš]›¥¤‡FéôFÛ‡éªoF°°£Ñ˜®ö%e ì+I/,‰b¡åÍ +í4åI½‘^R*ÆnŽ–®a¹ÊaÀ™àLÃã¿ÄJ÷ÃÎ\ÜÙؘ½Í®dÿƒßÔÑqDÇK­\èËÈÝVÏñLqÜ‘‡ñçPË…oˆŒÆ”eÐœ{ž*™`X%³êÙ¤E¿°€M[Œ÷Ï`ÁƈLø ‰Æµ­ZþÈÅbšºãøV£ô^NyÒPáÖU"~Í. qŸ¶ÀÓh†ÌGiì컣¸gÌHèhx(‹†uiçqÓèfŸW¥GoÆHçÊõ®Ì§â‘Ö‡ydrôçy¡sÌl 5ÍM¥ø Á¶tp);ÓOÆæÁb_ÍZcá»a.ñqéHíÂÀÚDX=¢ç~$Z|‚ñ{pµOŠç`aªÍ¹«ò«´1w² +±¨PWG.Í&|ù]!ÄLèÏn”»”)ÓÙ÷Ý4§é#ìŠ.ÙÜÅ ôŸ©›Íhj5>pø`ÁÏIÜÓšh†“Ž¢Í…{¹yFË5©óÛÙ¸;›2V†'] ê :º‹£#Ôª(7+‰Õ0 Tq9Σ¢ M‰g–Hå,[cÀÑP5ÕXøfXàÊw?¤uÓÑìc—–£h™ñ‹ÖphÕ4UÕaÆîZXë{Á½^W,pÛÙbb†®‹!+rC§%[x×”ŠÔÉÄÖëéb¾b¡¢¬ÕãUÓ9eQj/ôÅl_Ÿ2~Ü1ßÍåd¹n†TX¸I±˜&ŸQSéŠE<øè4á“æÁˆë’`\èä…Ÿ ²µ¦YC¤ñ2²I´^ ³„4ÿ}3Û™­ÈT è +ä¢Öbò<õ‘üYP…XŸÆB´ÃµEb<]ŽÃÙWœóóÔÓà»”WejXšpɘ´èW,ô3Z±²W˜PÖ6h/z/Z~"çÆûyÓe|zòͰЬ~$š¡LŠ®ó[x^œ‹±á2aŠ\ˆø䈘‡•¡ì1?Óãb$T +ä ß 9WNÌ$„64:—caðýt0lÃbäŽ| °Ò'92xÈë¸H¾¨ê2>ÖÞbi’´ÂÄ‚áê&WF–I‘ºÊQÅˆÖ Ϻ/ÃMA©b·çÄ…9çÜ®XØè=êH~¶Éýæ>UQà,vè™-®!~–óüÎ.ÂG¶à¸1Ú§úå‚Ë8¹ÇLüÙ®ØÔvë/èÓ'È…TJ¸÷¶°ûÈ,Ý‚aYX¦hì|–—†l'±°ÁQ@[A‘ºÊêM×bžq„…­\ ÷Nfç7É𳾣ó{4Õ\KÙt¼õ­^¨í\P¡²3Zô˜“‹’5¶Æ·ĂɖÌrë8bß,¥±¬F—è1ñq¹æ²†a:a¼Ãhô¦u‰/ª\(™\XøÒk¬XpÓ¥†+«r0T¹}Æ€ Ù=/¦¢Í‚ØsûÈþ Ýa…ùzë‰ù銪óŒ)0¸Í¦´ Ÿ–ªéí=]¾A9t¤Ÿ4.…jîœvÀŒú«U4Æàd¬"°Ÿ„èq!¤¾“ËY/ 76XàU[Xí!Ñ'1WC€ÅÈŠ…ddy[(:» 3êSlVê,äB®>ÍÅ7‘ËéŒãBš+ãÕÆÄfÌöÏV)d6‚?õë<âë@S i)ÖšŸÝÛ ž ÛAÓ÷ÃÂb¢\Ÿ‹ X;bž³ŒçµÂ°ÂDL¹ªÿ®&óÑÙ†ðXíj«£>UÚ)/;¦µ'¬´‹ð#qi†;x³ß²ÇQ°@‡§%+˜{ç¾\¨ÔŒhî|êy¢ê¡±Ž>Š +~¹Š…†‰¦ìºøóÀîWÈ2“(Ø ^Ž,gåÀy³…oE"_¬7q®K„’ˆ*·ò([ƹUöØw¦q-A@"ï},”sçaÝ;¿n‰a"_ìäÂœ÷ýàÎ sâ/YX˜kB"ÊQ+.%LÅlý„•†[œ‹ëŒT.ôÙlã”Ðj`¹tÑV.$³JS|äÓ¾"Ô— R'á£`ù"$cØ­I§&›6‹V}›ÌX¨2š‹”£c…ó»’^ #±ôþÂo¥ÇXðØNtF»…`ŸsÙ+ +6­™} —ôó>ÝUÆýÙG‰S¥ætO ÛÝXT_Éé2bá£Àƒ³Ê«¬[Ï°°Ýks¨+Mi’Q$ø¶Å:zÛ/(CWŸªOûîÐp­ˆõã©úX8ŸË¶o1A§éx¤¿„£B1à~ndÑH‰ÆèñÌt#Ô»K7í×ÌàĨ²Ñv^*3£ÚHç;QfV6ÛNpø?0^ešì§°1qß8ÅßúÈukPó5‚!YîDʚñ[^Š 9í«–ºîZÁ+¤Kú¨r®Êè=paöJEäBjKÙñÍ°è;Ô›º‚¦ˆÒÍŸ]–:)tñwMZ.P+£é§`Á)Ö$ ÑôP“¦¿ˆ…^­<írÑôÙd\úk;¬[Çýоt= †¯Á‚&Mÿ–H—]¯®ï)j¹ûÒ}gj,hú d¡*2,¼X´úr\/BcAÓÏ"‡J ÓåUo¥yزþ], QÒ4¢é¹ZAøÔFé}Ùf;þYÓq®-;â°¶Ìv™{DsËï&—úéU,œpËÏÒÃ2]ïa6•šeâ¼ûD]–>¸I¶OÛ{³ÇËŠl*Û$<½€>„…“ê´ÓõW“훌o˲+Ì—>#ös²Ðv‹"c_¿]uÿ4rí¤Èr·b«dâbpPQ´Ÿ„…Øœ}7 +Ó¤`ý3›'°P>6pŒb¯÷%ü†³ouÙ¤L¿£‡XoÎ"ÝYwbþÕ”°hiøâ}Œ ËF^õ%š³Â/ +û–bxÑÑ6iX%Ìâg –<Ó5¡| 0¶‡FX:À3r!Œ…þÆ»­/VßH6ÒÍ’óŸææX/:4ý,ÊXÖ‰ ìÝcyψ§Q>BG¢ +¡#÷­C³¯\®[˜¸’Š\ƒÅ?hZˆ,¯Q[Ål¶(T +ß´€•%O’bö¶ç7À²™œë]YkòØ<¡ÉmfRÓj\y7wnЯ°ÐP—€Å‘õ´Xá§f(x0–Yx=Ið¢pU‚ŠÚ”ÖWݪ(:‹(pß.°ªéû“#s(CÉá*x‡z£Ê:ô¤äkûLz‚°l[ÿÀ¬<°0*UÄÄÏV¢1Y3X˜^´usÑŒz—•£¡ +X/G!kœ±<ìõ“. V˜¡×/W‡çÅ5T¤ùÆÎ^g–šãGÊgm$Ìbq€kkú¹r­8ãßv¶bÁ]åB…šI–g*âÂú‚£¸~ ¼J+Ë„O˜T±×|igf¹]5UÓ4YÑ2E^Oà‡°ås…?sd–°Îs¥‹v6HgV=©‘)¡«AP`5k5L3Ùpí¯çeŽx%IM¿“ ©#Q- Ç”Å ­JP×cZB±VÚ*ƒ¹ +í~xV.p“›Ý(a' ¾,äb0‡ ]§™kŸ—öÂu½•Ü±ÌéÖú\ÔÔ®BÅzQ®—ê4Ýžba ‘ìk\,ZÒ 7æE.h,ü^š¸k$c‰½À‹Ó­½à²YP‰‚+´{㨤ê$7¡ +ž°q_îN´¼Y\FQ@¯çZò2)¸ðqP¸¬ê–!`¸uäRÉsÙýT.¸K õº›Æ¡ºß†ˆy²BóvsMߟzSøT “/nä/ fÑŠ&4ŒÀeµT¹0sEÐÛçcu­÷Å]ʯ!¥8PÏÓ÷%²þÖ^À€?ÒPn?·+DçdÄuøI˜U#+åuí=:Q,5FpW^—lùÕ”¾íiä"êæáb+d¡Û>Jî÷ùÊŽ¯‰úÓ´“Ó¦šWZ€xò©iƒî g•Õ³ÖX¼ n‚»™¼¾gµÆø)´Ø:¿œô¢}>sê[›”‰" ŠnÖù¿^0ïôå6òFìØþaÌÚq Fe]çRì¤uCµ¥pôagd¼$W™Ñÿ.E¬]™Éûˆ{®ü9ÍLK`=Êq“ˆm.Û.-0iÚngZÙTv‘·ëLÖ +Ýq-Z3Ç1øNôPÁ”"­!ýr2üw–»,a8dûŒÖŠA±Xð‡½·µÌRç§(ñt·g©Æþ@šw†îÇÛ#ýK³Öôã)ªÆ×/ªFèEmãíá…1@XšþçŸÚ-©.Ý«éË)[í|#%ÛÓXÐôå䬽 ¿Q.Xèë\M_Nî7 ×~˜ô7£é :EX“ ßN,hÒô¿ák± I“"´XФ‰ +-4ib‚A‹Mš¨`ÐbA“&&´XФ É)t˜&MH½£C;5iÒ¤I“&Mš4iÒ¤I“&Mš4iÒ¤I“&Mš4iÒ¤I“&M׫㥚4iJ=Çœ5iÒdš³_hÒôçÉG,¸¶¡IÓ'ÛE,4ý¤IÓ§±¡X ‹&MœˆÆ‚&M š4i,hÒ¤± I“Æ‚&M š4i,hÒ¤± I“Æ‚&M š4i,hÒ¤± I“Æ‚&M š4i,hÒ¤± I“Æ‚&M š4i,hÒô3±#ýÀ‡êÄ5}C,L-R<_±Ÿ³Þ3Üwrf|^CŸí°Äô¦ø£ˆú¤‰iú‘X@.²4J€,ü'Jásdªx¨à;àÀ*j`ÁâgZµÂ?±Ýäôð-ÑÃuÐL"'¾'›Z#·¬<ÚÌÛK/QmY¥ý·ÆCSŸÌJN 'FÑö?¢¡ Ííÿ mœ&VütÙðU”Xå01 (QÈiò 1œIY4Ï7X°.Þ#*a‘OÒ¸=刨JJ8ïpâU4´¯c¡ +Î*MÚ.ÿ×â K@ÒØZMût,Ä­cYÑ-?q®BMܸ]c;‰è%iýè™^½ÅBU^4·çpŽ§ÔJ.ééÄTßâ—±ðĬØÄJ ^Ìÿ‚„Dlek-é³±€kë)8ªà†ãÁâXH"ò †š‚'¹.·ÒžŽ§ÒŠÒ{W¦‘¼¨Ç<*|r+üz0´t ,CcᓱÒ6¹x +ã¥BPÓíyJÅ“r!}C.ðû'Þ âŽ*s”X<•[“ü50¼‚ +6ï«Á_.¥¥åÂçbõ£<]jpbQBo‰d+jÄ7öÇBù ¹wW.œ¨å*Oßò\[&:ñœ¹¥ê:R ïb]È{XØšã'3ƒñ¿X2L^•ã÷Rj¹ð¹XˆÛÐ*SEäWKäEøK¹Âd†O” ež×7ò< +Ö%$“³½ I-Á“Þ%—NUôòTU]®Ÿ½Æ¬ ^ÞT‡d%¹¢Rz_Í“-_»´\ød,´ix U¡;I¸¡48š¦ Aûoì…4iê%¸Æ#r¬EÅâdóÛ#×Z‰gØ0eBÿ[ì°¶Öç*«W. ©•ÛÎ¥QmUµDCš×_ºÝr!«åÂçb¤Ò“šoN›àÜÏ*¡Aí@EGú \ð¬´GVþµñ`OKnw›)ªS±ð'!F]Ä«M_Ÿ¬Î_p&­r! ÆÃmÛa^ER4|­–´bAË…OĬ­‚a`Ù vx'4'O剺*ráƒö‚g]ŽÀ@ †½|ùëÅ“Q VL‚éöò‰„Rn\*§} ©uþX°J8‰@)¼—¯ ÈÐráŸ`¡Ík±è×–q| 1jÁSé†g?Ï^H±À¦¸Dµ¸½Š9qŒxIykÑŠý×Ê…ûo—ZJÌê+¹RË…°›¥Æا[»’§¼ÍʬêH³¼;XX&!TPt âêxÛwQ2Äg¾Ga›/0ë³X€÷Rq¡úøh¹ðͱ v´ìödŽTö¯‘ Ô¦ ÄúëL{É»£¬·Bv¤VÚ¾Žëê×–bø/U’´\øX€ïÒ;ñWžð”º2ÿ{{áF“SÖ_!Ò63º5‡øÊÖ5y  ­­ÿÁ­ªåÂçca5œð¢²ý”Vë*üy~¤ô„*§\Þ Ç^^ß¹”Ôõ#EêžéĉÔÞîçq,üOOy^Åéç'?)t{Ék§ÿ",´+ÆÂ/%Hš×òÔÏÛ_x€ÅX®¿y"¶„¨Âh¿;óNù#¾»ó¼Ž¤¼–êXQCGXl‹¾óvLîçÛáé?Û^àÒÛ¨ ²b¡=K´‹'Òò‘ð®g ®fê¡OŸÈ¯ÃÓXˆcéf©ùÇ9xi5Reÿ*{NvÍj»ž `=ó ¥ç½ªÏëH+Ô`®Á(1!ŠoW[I^ÓitTÜ.F¨ËÍíÒYö;ý¶¸“»¬ú«1ÜŒD§ÄÝw>gŸÜ˜ŸNSHgjÕ‘1µ ­So螨ìá¾(x³F|«#ý[{A^~YwÅ’ ¢¢½'Qª$O0¾Ê}C.<Æ‚TÞlóvr"ŒhÉ£€E>Qü™' FípIðô’ž”J’l³‘Hä·6 Wm+#Òì,¦¸5")¢ËW@ÑX§üÝ:.Àcªµ@çÑ/¹v¦?†édÙÅV§±0:)T¾›/” õ-RKˆŠ;qY9ðDš:¯Û OèHžåÈ…¸u€£‹íKC/°ð @1ŒeE4pM¸`6’âàó'¥í"ÒŠ/e›“v‰,xÝÊ}S/ÈqkþFãbPNa9™ì„grÁ$ƒ¼Š~…žô,âE„þ?ã|—(r†i³1ýeöÂ2I¹ ¿öÉ©žÚGã1äó÷Úð]çµÐ2w+)†€ä‡IF^YõM¶]k×Vy”œW& +ËûmÎÙ`1˜”77NÓÜÊ÷wå¾r­ÄVb•™ø/ÉéµÒ9Þ’Ûü…ä‹íÅ´îxIH>s{ބˉw¸œìRBöh¨“ÝêççÞYÕª­a›Ô q\VÇÙMž—ìsð&& õf`ï…í˜_i÷=ääS¦ù¢ý…5†O‰%¹ŒS²JûÑðÂ^›0£‹«5Öeö(çé}È­ ç¸9Ý ¤r!U?a¤È…xº$·¿³L;Ú¡XÈeüÁåážÍ¯Ä‚·Þ+k'XøÇû Â6H“\>×äXkÎV¼h?ië÷iIÊEúXÖNÄÚÌS£Ð‰Tçk6ÆVäıˆl)ÀIpztñöñÁ©(ŠDÚ]ÀKàH# +Ì£Dr~ÀGªsuÑÓ\ˆ¾ÑÄ“¾»:þX,på{ü&Ó$_c/HÕ`“Û¦( ð%[ujÇä3vŠžÅB,;Ó9–¦¾çÕUR—)¦Fk®™Q˜R1©&¸ÜÖ ¤¡ã„ ¸È`yùÖÚ J¬ÄjØk*‹VFóc·Iׇ +K½9 –‹”_ê‚/äB”Ñ;q8C ºú[~$¹¨¿²%ûÿÈ…É© ØƆŒ7‡õ´Ì­ªŽœ{KŸª#ÅÓ´2^´‰e_µÏ ©¥åD&£¬|SkõÝI³ÃË­”eRÑz˜Nb]ö¢Û†!–û ü†G¶¶0©ŠŒ‰´è8 ¸q°¶rĻԈ-tnç÷caœ”Þݬúöº'xËsj⿇+/à!´—éKå­#éÔkâÜÆÔ\#hƒä¢:Þâ‰Øu-¡Óº2J‡•'Ÿñ#]z¬œºû‹83@ùŠÇ&.ecQ[—½IßÆ·Þa©ìûɸåî@‰²Èx¤]}¤uè®—m6® »ß˜ÅÓj2Ã2ÃRã–ØÑo©Aö4*éF"– ÿÊ^`ëïªdï6Xãh­[ l,E ê“(Þƒƒ¢#YipC%µn-0„W6ÚxH'ÎÚßz²ù¶ˆ’:±×xKÛ<k““8U©J¦y²L·t®(ëI«`¡J‰"–¿……5”Æû¸Žôa¹ŽíÙa^IÇû­ôˆá)òƒº— çe‘Ÿ“ /Ž³¡$©£(ðÒµ@RµñT®Å=ŽüsÒ6X£6b®Ú­((2¨µ¹aa#d´âa.ŠÄTnV¹°ý^~ ½Ž…pz Ÿ”Zµî Ía°‡/k¹‰“Ž•ÍòŽ <‚1X/£A­tL›­T.vÊ'+{l +…h¶°Ü±6¬Ž±ú%ËÌ f9¹ç+YÒ*Þö%þ,x÷B,¿X.xùa¢:/7õ‘ŽÚTŒv8 w°"ûÖL/µål_u[º ;ò¼<öB‰4í•ccžF‚ªüt»ÜÀK {ã +=” rq+­Cu_e/DÊï—Ä\|,|°žª÷pýõ+%Ç&ÅÒbùGpU&±ÂøßÔôÒ,è}²¹àbÞna_«`Ô&é-ºŸkÑ3ºÉQ8– m½ŠÞ3Çá·®„Ù–í_ÆBú XH¾¬žjZÞ”°TØe2¨y‰‡´¬¢— +Ã?‡…4½ª[ŒuŠíc­ƒVºÛ`¼} b»í‘#5ëH.¬›gßç$\I€Ð*þÉ¿Ì^°>­žêÃ:ÛÕ½rÙÈ~FZƒe›—·Á¡^¼’$¯`Ḵ+]\ñf‘ÑÞËì<˜ïÔŽå-ñUx‰•§t»ðîWw$&Ç +¼mXû¥Â3>¤Õ.÷NÔ*íGúì…K0hÒGýölÖ.(-xðòW6RW,ðxFeÈ +­IVE©¿b–#\§ØHó&÷vXX÷Õ+kš%2´wÆ>” âûˆn‚Ü ­]V¬” ÊÆߟĂ”Iù :Ò¿é¿€M².À–÷”– ºh¯-eEÁŠÛé˜Ú›ý…ºÁèö‡Æ×åž[I‘<ÜŸ³´¤MåÄÖ°„¡†bÓ¼À³gLgÛ#‡rAÔ§IëêÄûæMºÍŠ•ránnàÀ‚L_Hrò¿Ë…ã²î¸­•TÕKmÑ(Â2®SPÒƒÛ+oÿˆ75Iy3Ã`€ +ÃUî4ªrû!ÿ # /t£ì{Ü—ðn’&YŒ›"ÿÖÙná±\Èåõñš5’EÈ…ûõ~?Vwô ¥ƒþÕþÂYuwt(:/oc´ÐdÃ)#§©Foâ‘6ÍlIZkêƒîT0 #d Àõe°i‘²Á]˜vIJw ëо}úC¹°ÆƦ§ä ü]H¹ð[b´ßÅÂ$ƒ#ßJ|ÅdE?eß97ö…ݱ< +¢òV ¨BvdÉ”H9EÌ =B–}+nS1s%wò>bšÉ_Õ9Ao½ÃX@0ÜìbÑ‘¼²°‹éc¹ ŸpDÈÜ!Ò?ŽùFŸv"Üëù,ˆx¤”ìÕxtÄ|(tÃBs‘i)óa”òÜ[:À¸›–H‰Ô> ódžj²tƒ/Î;,,˜¥|»öæ!ì²öäšnúD»/q]+±Pþq,ˆb Ï‰–ï;^Öíé!Œ“§óÏáù  :ܸ€õv1Hû@–tO"¨­C,`¥0°Í­¨LÓÛ¬ýüѾ³"‚ò>Q¥åÂŽ›d2OýL2@'b©khŒôFIü¤¡¾Ç»rÁH1xÌã9yJúKˆ?¦#1u¦¼Þ©vÀCap)±\Æy{NÜÉ1Øþy@`—t¿A’å/¨rA–LëU"…A˹ª ƒá©ª,zS¹_/]à³û¸ÜíÆÞÛr8¼ÂàéÉææVéaàËÛrÖ9£î™‡4R' +,:oÀ¡ÿ¶‘•ç;¯&ƒw“‹¦TÇ@ƒƒ{ÀR¿leWâTÛ³M‰ÅÁìíD­›¡Ö;ŽG¶ sz@ûü…?/лx¹<»Õ²¦„*¥$‹s>»;+=ˆ“ß^˜ž•ûybŽƒÍ*ònþ If~œï,[µÝVNÏ +êŠ`µì?ì!¶W=8Q šwОëxßYŒûBš¢– 7JÒMâ쉊tSIaÍ*|Pgmµ˜¶ä}{¡•Vû£š2!^®àk?Õ»òëuóZ§ +¼Ãæ¢j¯£$_nkr¬Xؾk$u3‚DÔP3ž÷e ÆójZ.¬¯Oô_x¼–¬ácje±•—ïo0(ÝÃ7õåÞ— R¿{ØWïñZ›gjÂÈÆ 7ûkœW^/%„§üÖ§Ó†¥·© YJ‘y¦Ö +8” éÃ>E1aÙýZ.{w¼ÛÊU'bÁ»M´Œ•ª÷ †6¬ŽÊó|D.ÈÊ¢©Ä™Ï×E|¦VÊÔô0V£ª£uR-¦]CÂè¨Ð;ú„½­Šwf/ˆ2ÞY¡¯ØŽš!׶Z.œ+>X]öC]ŽÊ²¬}ÜîÚ°k¹Ê­.õ¾\ùòa,˜ û'ã’Ÿª›·öSÜjþ²fÞIì§"JùàÀ¢9u55¹'R×4“㼶‡&‰\š9]çb$-5Ÿ»I «kd·º* +Ar®¥®·Ùå™|`¡Íó§Jίu'žŽ¹y®nY Hn|›·ëþvޢ؞ü¼M]ìâíª,íE¯²Œœä;¯e0 >Vz ‚(jD0¦– ËÁº~¹TáÞI2¾>M6L«~·.äáåûýéì;ƒÚ%sîe¼éÕyº‚òsõT×G?éawè'Še>ç* ^)ò0!mUC•òÇùÎkòòáW!7ZR9’– ǼYéIÝv%g[¿m¦29SLd©Ç½»ér™JöNû‹Q"Ë{¾ó“ýÔB[ës=ˆc'žuã’yÈGí‘dœ0þ]ÛYmþ~T0Dö}OW¹¡åÂá¶îEG)3q;¬nÌEËB0hä@!ðŽ}ñ 8sqç›lN½ ¬Ò{µÙù³ý¤¤dG<°ÚµòŠ±!áE=j•6ÖË —mP¥l˜•F‰}ßQï’– §Z’G«§´{/7¼¯Û$€C†ˆ¬ÈÞµ‚Š'bäë׿çÇÅ©*½H0’Ó¸) AËO–«ƒóõ~m÷YdmMw+ã?âÖd`õÛ+Šµà¡½ö0,^n®lÕ>¥/k¾>àUû +¹@“•½n,PNãÂðßxû;~³=þUX@-Iéb¤óASjÉàÔ•üúŽjZW:S9 :±1ù £ NnÕÁªVïvž>"T…EC•‡4ó'…Ö[;LÅâŒú­<Ý‹D©ó½ +Lµiö†³qYQòmàeN;Þ†cÛÂf´Ò¶°ÇVO©X¼ºž0Z—´76Tž›ŠÝ­l׳Õ¿— qÂıP¾TåX‰|ñïþƒA!åUO_€Œ$[Y +“eóÔ€ ×vaŽ¬RŠùH•]h#Œ¿ iXˆuSÖîGuï>–¿€úrklÜ]BlXl80äÁqœOÒ‘hÌzºïê´Æ|¤ub¹®ÖÉY'5o¿-»Ø²Lf¸ˆÅh”ÒÄÛ#GÙèó@îagÐ’/Q«Ã‹°ÿ'¨%‹Sê©_ HäGÄ6‹Ž;zãÅ-º´ ³sZtÉ©Ö0‹Ì˜HUtœŠLªŒ­Æ_€… 0Í}ÐIRcOlê]κ}­^"åòK”ðfÝ–•Ô‘ÒXµLn¶ >$p]Vû²zó뽕B^MoÔ„y¸\N‡ê¿Ô:SPÝZ()ŒK]1)åñSª°*ªf‰ö`4YZx6¶m|Dæ  +‹‹`]¥†•”žƒ B¬iÆ¿Gï²)ØýÏåÂdæÐÅ]Cà@á #essM_DGƾ™“ë$ì"°‘0ø·%@<' $ÿ1þ€›ó»<…å€îÔ$—è>K¦ArX#ûÃùÎ 9lì½q^•í{µ…Ÿ`‘UÕWWÔç½ÍÂ"ª­°õ®U§.èéi)Yë²ÛÕI-õä9lì×µMÕñ­lþçrTsNÄB5gø-´áœ™ª\0Ý™†ÿ€¼h|ŸÊ…fÜëYI7›U±$²Öi¢¶¬ŒÔ5³hB¦l‡<33Ú?ÔÇDÙ±|  ôƒ•¥Ç/; $Î=~¢——§_6Ò; ú°\À÷YÉñÖÖý© êνt¢ÆmyÓ.ˆ{&j£[2êŽoJ.éa¡ðºJ÷žîxƒ¶ÍVFkׇ µwjê¿– `-àªX¸>jÿS• f9›íDåE¹ÊFbGÍy®- +§¦>›3†Ãî0Á«3A›g´ÂI.”±·±€;j%"Ý1Ae;‚”ÃôKÞÖ@¡-9Àh'Œú’5Æq<&sF–m¥ÿ·±°ˆb¸+zˆ¼0µ¯ìøáåƒï–Jî44†ö7Ê‚èý.øÌC6s`3¼õôÁžŸÕZÕ}ó=`β² +×ÆÒn·ùù žlqQhÜ}û8Ê„û¶8Òч±ȱÏJvÇŸõúOö"3jS,ôî\CQ ËV.´¨$ /@MâöB»ÛwŽÛ±€vC8:~aãYtïŽà :DþË#þ¨Ou¯‹®õûߨáKF"íôµ .XÜÇ¿üvß{¯½ˆxñÄUñʸ×Mžçß<~œQOêD±ºMŸ_[¹#H®¬ïB.4ý.)n©\ VóÔ.«XÙPpÊâOÆ‚&MŸ',.R6¯]ÍÄ‚*bÀzÞö*ÆéEåÂgv`\*M5žEÀF,ä I–AÆei,húvX®@@S¹Ð"ÿvÅÐîåBkw~‹}{#„`@¹âÎô»aZ(bÀŠ9ã®{¡t£iÙjƒ š¾ ‘šFX´ å\ø ™ör!†í`±o¥\ öB3¢O,8% àªÇq´Àš£ÙO{Òƒ5€±Ópˆ54}7Bö¶'.&XÄAUšì\ˆ‰7Ï°ØãÉ46¯0;ö§#$™ý,j1Pc¦! (æ"ÉÝÙ÷À¦†ÿ5‘ÕͦcTÇG÷Ú4iúƳ9{ƒQøá„ë¿ 6„” Ä‹[fÁºî/0=Z§›q§ªÔ>†³\#Yq‹v*º‘44}_%©!Àì4ä4¶qÿ%ŽÐ†CšìÐAÈtc!Žej¨lï´vP:1Õèm”6ÝŽ‰% 0€{8ZGÒô ô"T’xÓŽ‰íƒÐ_Ø¡˜¹~ZÆÒôc£Jÿ*%„€` Ü\X˜/µ¡©´Þ&ágÇ›½M߆Æz®?‰ãÁ+3žÇк"è\ÒXÐô,†ÂøœX§É.0ÕeaÜ…Æ‚¦Ÿe1„æ'õ—ªsyîà¹O•øÑXÐôL†eø´¡Vc %O MßKMú¼‘âÕXÐtÊIOtÌ~tFü0ì1Žÿ¯ÀÈýÜ44½‰…6~ÌÉñàñÿ…ö¬Ã„³-Rª± éˆ}’."üsÞ%®.ŸŒ,»ëø¡Å¿îß)5›‹†Ö8†ãdwnk,hz :g³ÕO¼êÄ!¦º°ˆ—·Ü&qý­S1£ÿ_¦ÄmTœ4cÂTQ¢± ép{jŠ\ïlÑÇ@!ÄvUÝ“ ñÐuËôÿbaÊæÑ4 E§V\ÑXøƒ¶!ã8R?ãDÚ ~aÕ‰ñgÛÀrì{ôÀbø¿²mÍ9ìãxìYŒ#$èùì—XKÔã"˜lÖÆ-œ*" àÄ~ƒ:5¼6æWQw(­õ5ò#Óz/qM ÷ÇŒ…výˆÍcñ@ĕ׉ßMDqL0‹v¿Ï­±ðçhjÃÊÍšhh—ÉIB;É\ü9òh)Ý,q0) ±§I8W‰ëZX7*nÃÄÍÜÜn'#)æ¦6†<·c0Nƒc†fP†ÅF¤áÓDC̪4ÁéQë5Y“² £°Ê§T°0µiãâµ0™—ì §ó08õ‚Fp;ä®Ë‡ç&p ‰›Ø“œ–­÷ªÌÅòáFÞÍníLX•ËÍjç˜ÖFê6éÔ4×GcáÏBahXŒ³iLX2Ť•³€kì¢pñg°vinØÈÄÚœßò£6žX¸óÜ9c@…Ö+jm:Ý¥ã¤+z>Š‰é˜ƒßÒ²¾cû»¹…!Õ Žæg+¦Áå3#3D0içá83-öŽŸ"Û‹CÃe~Jäì`<6PQŽ!=­å³#yÞ-hX7Ê ¢±ðw¤j."ÇuÝ"cÜ‘Û¡9gK‹<®aX3K±äX ?7ŽÓÀÑ>ŸýÚq.±ËbN¼b!Îæ.7Ò ³k€»|3Í-‚5ì2ª"TDdkÚ¹—ÔY:‚oáU ˆÀ"2<˜ ÛF,Œ €3¼£E@ûwCãký¤Êó³Æ]”Ù‘|îJ#„áìέRƒÔp7öXkf.ª¬liI&…?,̹ìÛöŠE Qߎƒÿ.j{Ó‰%À.¨z8 +ë=üWÃWšw ÇÓžÖõËþ;!ÃëÃHzZ•”¦ŽÄñdÂâ lÛ ÞoÂ@‹‰%½üO`s˜C˜ fî°z’ s4á}:ÆPÌÆ•ôiç¼UbÁ%cÛâìZrEû¡|%dÈL‡P{±•Ã§}óž÷­¬$°î1h,ü5¹08á,ßÂ:L,¸ \ÐÀBŠ 8¦ZJ¹Ð£jƒ:¶9±.ú‹.MÊ÷æ 9À_n¬LoÄ óÙŠULD 0?>tø-øÀ¨ç€ý*°€¢œ.Á`û, ƒÆ¿þËÒ`ɘ×ô6÷FøÝIc1»eŸÑŽ±ð#ÑÚJpvåö( è_먉m Ï_JÂÜÍ +6 t»‰ C‚½€|AóG‰…tf 1èÐ!c˜7Yç[·–[Ás bòô1„ÍÈŠá‚»LqW`Ý% åEL61+€•.Âê¨|in%äyšp@„½ °€7ˆé¦Çí]Ù’£:  a±ÙÁ,æÿÿòêÈfé¹ó8]ÕSX/©N0Õ:‘ŽdK …ýmÒ ib¢ÙIÒ|>Ï5C;z.B*XEZ7±$‹VŠüB–}ÏçÑ}íWé±ðZÑ9Îþ¦ShýÂÈX Ÿqé°Þ€¾u ˆp [ªÒA jÝÖŒøÃ|?×6p'Õl·ä#Bò0i‚¦yÚ +5ƒf7¢m#Ä2‡í+aá<|cÎ+/,Òb¥—:«ÁÍÛb­,îR§=aLÇ#8v:†ý9Š4mS’¶z{ž>%— o…‚˜ö°Ü„GÀG%ˆ–ƒûó~aáCÖ†£ÁK°,‚²‹Ñûé´u¼0Î/ þ° ‘èÈâÚßÙ¡_ˆ¨#Ýþç””ãÎÒaap~¡$*¢E´R,Ð6çlNí*n“1Ë¥Š´c$bGK HÛü‰…Øû…7GH"fiæÈb!TÆ-àÎÕÊAË$Ößù‚ìÒÔv¥• àñ•/À„WD=O,ÈÚN7 ¯3ŽxûéÎÏ–/mN¾@Ú¤ÝÂX0äs …þr홈œW&@7Ò– ]œCþåÔnGÓt=@- ªÅÊýêQW¤õË ÜeÉcá­X K^ffYႆ °Ï1_ªöÆ‚óH*È…I…Ÿ™H ic&ä¬æ.uy¤œþöIÑghõ¥¦kc…Ó]ÝÚ @h–Ò¢´Æ#ÒÑO‘ÜiæÆ‚tšÇÂ;c¤8Ýëª*™c i¿ -Ñ®/ÔE"v¹ë šÂò¤+0€\A˜UÍÄcÉ”§1°µ¶qo£¬ q¾øáÈÁDò427Záö Äà {Y1q}-Œ¤ÒýÞ–i“pÞ3*Æ4jP²žÇ.Vg¹†¿»©#¤Ýæ´Cw¼±èFt£S’¯ ©Ðu Æ‚ÞXXû§é{,¼ sÎpE.ðß(˜G}azÓíȬ¹Ò;åD[¹¢¹Â÷Å܉nTæ¼ïHmQ´iAW’_(&j°mò&*YÉãËÍY»ÚeÐŽ2*슸hb¥$”/°É=—Ía¾WØ«=ƒÔØó©¥â Ó®süB¼Êßö‡²µ=gÀj^i+ôr6îºÚo]kôq7±>w~Ù}j§ËjÛìlÿèãÅSh ¾ôâêõ¥œúp»¿ÜÜÚK;yµuïhyíSµÆßïߧêåäŽ×DÆ‚þJž¾!½Ü~9]á±ðr,„O,ä? É7aÃN/6`®Ë JŒI`~¢–¦©‹o©á(ýyg/Öo~Äغ?z†ïÀ¨Zåû`x¹ìái Jý ZþÅÛßÉ‹—?²'/^XèI/^^.s,LýèÅËË¥ŸìŽ/^¼ìázñâ…düj«Oíendstream +endobj +5579 0 obj << +/Length 107 /Filter /FlateDecode >> stream -xÚµXëoÛ6ÿî¿ÂÍ0DjVÔÃ’ú¡Eâ¦kŠÎËbçC‘cѶZYrõ¨g`üîAÉJm†¥(DÇã=~w´ìÛðOöC_ØnÔB)Ü0ìÏ×=»¿„•ßzÒp Ë°Ãs9ë½x;òúÒ‘õg‹½_x¾ÛŸÅ÷ÖøÝÅÍìêv0t]×’‘ ƒ ´Æw7iM™zs{=™]O~ÙDiÝÝàò·ƒÐµfÌt=Ù/_ü~yÁ3W؃O³÷½«Y«i«h¡šßz÷Ÿì~ Wzß³……ý-Œm!ayÝ=…ï¹fžö¦½?[Q¼æõy×1«øn(üÐ=4‹ô;f‘Ž+GöÇ^’]f+ †žçZ«¤âÁýlzÖÅå`(­OLòùS%kÔò9Ìi݃®&`VÃV œÐÚ&säÑžð‘À<2ó1Ae±9ý -V&3\ÂQ#Z-U’íYÁØý¡¹ÙP¢y"ºÎZóX+öVrvQµÐa8Þ0q m¥ qÂu£0#[>†²·cwí-áJ§? -B!ŽC=)ï éA‚âÖÛk[y]Tš¬›U¨ý(°¦•Þðè/Û· =Ï×k¼š ->1PåK°IkMÄòð²lZœÌŒËŠEÝ \ ÖÔ§.@ÎxþÓ—Þó ²æÒ~ |dï@oÐg-Þní9Žõ†5j倎_Ñ!qLnY>Ci]îpÍ·²œÂŠw8ÎkœxÖ×Î’o‘ñ¾#A;r7Èâ%õßöU<ßÀba€Ãæ¼”`d–H¨T -ÃTUInh¨@}ö£¸Û«©ƒ×ȳs< â>c¯Æ¼f"‡ÑUÌlŠ‰[ŒÞã3&;…ÖûºUˆYPùÚŒ“AKÆôÀ¯´À+*ÌW'à Œ -Æi³Ï|+£V“(¸m‹×RijtK0®PÙj¥a¥UŒ -¡Õ1ÍÎ~ÿˆ\Z×xƒÛ)¡ooÆã×CZšL[ øðáê K H¾º=ãÙ7nW¨ÕŽiY^ñà Ågza¢£¢O&ã‚âu0vÏNdƒaz;OfC‡ç4ø!B€w~ɲ?#/Íþüƒ1Y*p“KÁ -ÉŽT€ȺʾÐÚó]0.@ð`âÓF0×X£ ý€˜S¨Jó;Aæèz>×%…Ý »`eõ‚§í²ç!»¸ÇPÂ÷ …’ìò ˜Â4ž¯rWÿŠ$§¿gLfíJ“3&¼zÅßßUñ"Í—/Jµ~P8åú!>q/B—Œž¼C‡§õ­FÓþ^èAY ûv„Žõm_‡½•×äB. 0À[‚·òŠP -Í^èï˜>eRé“JC}l÷i¥÷<§áÙ¹bäºMÀ™U’rULèh”W¨ô ZÁ<Û"F|@&„•¤Ïy†+‹ý0ã!f¹Zcæ=àè¼dòº‘•ÅM¾ÕÑꦀƒ@³­Í~•>»vo¡Å€úˆð‚(€0§bSC·JÚR!0H¶ÖD*±n’ûEI ö „éht¬~‰gÿñ¾œœÚ F7P*40Æî0x3¾¸ó äH_ÔiºcJ’•P–R >B>>B†Î£#Ô¢[Þ<Р»çŒ¬3E7.ðÎìnæ”Ös`©QEUò,_Ê`Ë‘æ¦Î§ -ýl¬áX¨pO[ q¢ -m)Ù5營¦| UþÄI©6Ó-߆˙©æ{¯¹T]Ï¡‡Ò䫹)5ˆ«Ä83Ï —GiU­^ÿ”# ]ÖXMÑA[Uò`2û<]Ìï&Ó»ñøj:}{÷᧼vÁ­3©_Žr,ÙÐ9i3MgËO«•ªøѨ›ö®#|PÛæn¶*¯‚4`–¹ÊX qJ#Ý ¾ÕºÖGÎvØ ¥‘‰ ð‡¯¬!>³Ï„[;vhøŸ³ìú ÍÉ´ÝïçûÂãíérƒÂ-°†Ž×,ŽnÀ$Eèo×Ç”i.sFƒ5¶{TM| \†ÖCÍzy2¢;"¸slAZ4YÇ9aMb|œg|Ϧ¿Ä­”dðý(™¸i³lvîÓÒæ7çÔ0‡‘=øŠ]kÔMpv^d³aÄîFÂè8@Á5`H:½Ù`ÍŸòì×xRj€Â ú­Ž\/0øÎ.0Ñ_yâÐÛ]ß®Ÿ#¹g êë¦îskB?49y¬zÛÚtªÅf>Oè¯ -••k])ž'æ{w^äyõk©ç…®Î qÎßsÕë 7¦pØçÿð`Yà@Bóß,©P>Na³?ƒ×ÞË{fýtÞÀd\<;7¹ÈL+“¢Â€Ö_X ÷0Øô}.ÿlCE'5”‡g¸ûj[¨c–lKøÿcÏ¥®6ݾŠÍq~¢vmáDÇšiøÏöýO?Üí[rW„nt¼#÷G8²ÑÍáxîú6?ð(ü/¦þÍendstream +xÚ`ŸÿÓÓÓCCC‚‚‚ÛÛÛËËËgggµµµ°°°Â£££ñññççç‹‹‹¸¸¸WWW›››!!!­­­|||“““tttììì555ùùùáááõõõêêê²²²åååÿÿÿ$<îendstream endobj -5496 0 obj << -/Type /Page -/Contents 5497 0 R -/Resources 5495 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5487 0 R ->> endobj -5498 0 obj << -/D [5496 0 R /XYZ 85.039 781.388 null] ->> endobj -1702 0 obj << -/D [5496 0 R /XYZ 85.039 689.601 null] +5574 0 obj << +/D [5572 0 R /XYZ 85.039 781.388 null] >> endobj -5499 0 obj << -/D [5496 0 R /XYZ 85.039 668.4 null] +1478 0 obj << +/D [5572 0 R /XYZ 85.039 664.766 null] >> endobj -1706 0 obj << -/D [5496 0 R /XYZ 85.039 599.602 null] +5575 0 obj << +/D [5572 0 R /XYZ 85.039 630.626 null] >> endobj -5500 0 obj << -/D [5496 0 R /XYZ 85.039 578.401 null] +5576 0 obj << +/D [5572 0 R /XYZ 85.039 534.789 null] >> endobj -1710 0 obj << -/D [5496 0 R /XYZ 85.039 498.176 null] +5577 0 obj << +/D [5572 0 R /XYZ 85.039 534.789 null] >> endobj -5501 0 obj << -/D [5496 0 R /XYZ 85.039 474.858 null] +5578 0 obj << +/D [5572 0 R /XYZ 248.731 379.626 null] >> endobj -5495 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R >> -/ProcSet [ /PDF /Text ] +5571 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F66 4190 0 R /F62 4047 0 R >> +/XObject << /Im17 5569 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5504 0 obj << -/Length 3238 -/Filter /FlateDecode ->> -stream -xÚ­ZmsÛ6þî_¡Ë—R‹&${Óé8I_Ü»¦¾Ø™ô&ÉL!‰–8I•¤âxîÏß¾iQŠ¯×d‚ `±X,vŸ]JLø+&Iä2ĉðe’LÅY0YAÏgÂŽ˜Ù!³Þ˜ç·g?h5ŸéäönÏ'òU$'·ËwÞ‹Ÿ.¯o¿=I)=‘úÓY'Þ‹7×SáÝ0õúõÕ«Û«W?⛢ðÞ\c÷¯¯§‰ônyÐÕ«}÷å/Ï/ùMúÁôÃíÏgßßv’v2€T)ŠùÇÙ»Ád [úù,ðešLî¡øº‹3Ó”´ï›³›³u¬¸OMxÖ˜V"™øQ"Õ"£žZD”øBNâ(ð£@‘ZÅr:‹ÂÈû–«¬ÝÖyÙf5¿çuݸ7Xh&PŽ”&Þm̪ùæ]ð9 ðχ‘!¥)²oÞ½Rῶ6eSd­Áf;˜ÑœeÖ,ê|ÛæUyrê¹}¼¼~9¶ô¢*Š¬l¿y|Ã;¹®šö†xÏnë,Ÿ»ÞU¶ñ6/_Ý^„ÿ¸øíšX^ü úÊ›IEÍ™’¾–š–yF!¼·` -çh‰÷0 ¯ÚáKì-°Ó”ü²k2l¤^ £×Yƒ}O¢q °)—ÐG=ço×Ø’^»¶LØêê<£¹ xµÉ,Ã{”ÃFyºBÃÃG‹–2Ÿ´-˜¤±ý™y˜íDˆùx ž/©D-G®hÖ3ØR˜ÆÞ)67üjÍÔ´(LUÂq)Úãr—ÀÎ4uÆWvèïâÀ# ³O(Ëlž¥¡#=¼âpJiØáç# µ/;v[k%GxéÄCýD^ÍÚn oU*NýPÆ“Hk?QÉ—Cˆôø¥±2s¼f=f‡ñA%¡¯cÕ­ˆ¢åå]å³W N©ÃÁ)Žonc‰“›¡Áýe»ÿ¾çˆ&cEAüiÌveöy §œ-1è'ù’hÎæõ¦Z|0ex8ZE1 -Xš`P…ñA’Tàó}×Z0P´ð.°G{7CpA´!ÛZF-N6 äý‘)a0á!$²à’ŒL.ݹgK -°0 vÙ¨êÖ'&m3ò–h-{@k -‘B'üÏÔK¤ šJ„â6¹[—wì,Qzs„V–IÐ’ÌÉVLvó‚qÌGb^Úµ­%cûÈÿg¯³UÞ1®žáµP÷b“gVšûÇÎIHC­±Íc„›É(„‹ÚÜãd5*)s§’($& !–B ¤® -~!Ž!§àIî³Vvµ6ƒAGCÖD^¤¿Eë-6ûs—œûŒ¥#³PúŠ†èë¯@LZÇQR"!|‹§áLXVF_Â^¡ÿ”¿?–qè!µ„Ä"= =zcŽ#%ðè¾´Eœ)…)=ÏK3•œ–š@E@ÇD‹?§«½1#Å9'š~ ø¤ƒ~Òå Cù° BA@°¥j™¸F³Þu>®dê0àšù&#ü+ñR<ô¸aã¾ÎÛ6³szR] -_çäDMmçtÊr{övmƒöZ±=ófú—âòæÅÕ3®¾{†=Ô½Ê`“Ât - }ŽÏ.ï¨pITTÉÆN¾Ä@ãXr?×ÈJ®c¨¡u ÷p…ÇJ%–¤Ô -"øXUŒî‰íÒv¹  <¶µ­lu%»åXX©éØð"bÏ=ß¼ºúÍÆíÿð£ï²•HÀ/qùÇMa­s»]S‰HpXçä+;°#-ò¦[ØÁžm—8ŒÑ@¤X“™Þò1¼W˜¼Ü*›É8özÅ¡úQ°E•Ñq åE±3À Ì²eÃM‚D±†ÞÃ|¹3Mûwh‚Eæ-“ê…8É0ƒõÖÔèÈéfAâÖ¿Y´s§M1•Oá8½åx V*í|/¥-T†£E»ò]åòDS‰fP3†Šab\Ó{Uv‰•®¸Ô Å †4\"ŒSg~ÊIŽ²8ÈpLaJwÈqÂ9@µk áµØfC®ƒp& Pnºe× ‘`;€RÛ”„Ëytòtv@/òÕÚeZôÓ*&ÐÙjчÅÙŒÌdÑÓªvI€¶PÑc7T<ƒ/­ÐâøÀ›Ò@­õD?éB1ʲÐÄa3*¤æN ÇÁ<‰zu†4àÃÖׄWo`=?¤] AÔ¦³Á¾júÕÔf^‘Eøº3Ó S}$¦àz€¬»ÑÊ€£™v£Ðé‘:ÏF {Õ`_¿Lé¾;7#ð†Ñ5'av‡÷ˆíÊ}›ë葯¡ê8¦-š‚”=e}>×{Ú ‹A]Å¡ø²ÅàAè -™“][{r¾›µøÃ"ûô¼áþ{uôÑ6ÓVE–ÖãJà -ž[Js±èßéIÈd¤(e¿Þ<Š@ÂÙc(, °ˆxêôÆGa"E£! -“…ý­ ùŸaD -€â´tû!Ç«S"F½‘lWtãì'Ù|˜>Ä µ°U¾º5ïŠ €/kdáÈhúË%O¹œ]’sx9£=ŠÃ°ËëCìh áîxhµ/IÔ<’sfhàÕÉ,B4úø +Žèkô ¸³\U—ªª0ð~âJ­×+Ñ£Î" -Õ¡{D‡/kƒy9¡M-öÚä—  uøX‡N;Ä Ýåe5¢]áòŽUf`tXãÞwÛ. ^²#Ã]a~9‚È.çà?‚¡RÚP\x³”!ùïHC¦9ñ´á?®“áוþø}Ì.b?P.ź_çÎ%ŒwàqOÖçÄ4WÝN¸°!m]ðªŒ[€K²à†,+~ÚðLjÒ0 [eÜgìL.÷ÑçÕصؗu…P mD¤íõU²OÎyàþˆ Ðœ3àÊÚ…oëø÷ -w¥m4±eö‹¹f~uµcOz¾Œ0¤Cʛ̦:Ìc¼6K&ö?}ƒÿšq¹i,Cv_ÔN_þÑo JZ8íR#0¹=@`‚FÕár|ÙR¡Ã~^UÞ¿±> +stream +xÚ¥YÝs›H÷_¡òË¢ª†a ÷dg“¬wïo,?eó€$d±¡ZG÷×_ !¹®j+UÖÌtOOwϯ?†øþù“X»žJ&&ö]Ç“eyåMžòáÊŽ™°Ìù𧧽þø§7åíF€ Î £s&üm·Ìú=¬C0@á‰\Ôá}þ¼¯3ÀLL 4¨ÊÍ{_vEëèäsªk‚a¡>£k§›e9Õíè”9!OêÙtæ;5 ÒGmV3ðw¸VMgAì¬ö0\5ÇÅ-sì›|ûÌÃ\gÍÒJÌwí©=!^zôšï;»x& 8?t=sÖv@n€öÿY¸!þ—~5…1¨õ (*„ÖƒåúÃDjœ` õhí9è¹2}ÎÚj~R‘qÒíŠ=iª<§N¼„óé%4Ûqøº¦=ÏVŽÂØѤéínÙÀ]ß¿§pßXO“ZxÕ^è´Yk2¼Üe›WBIeó¾å9Á†˜þôüÆÓü Dßs^ð‘TÓv$JËVG'¡  %SÄ$#J«- yζY¶YÃÓÔ¾jÚÇeïp#/¯aXW%º”.¡À—”£ÛÑ€ÈYWu™¶ ÜVhÌþ¾³aSš—¸@w$÷CË…¯á_Œ +´ Z %£9ŒÀy (ûºn™°Ê;Ï-Ûâ J‰æ¢C§,K‹+?c”ç%o7ÕžÌ[ÚŠ1*1r±p¸u,ÀuÍÉ·ÄYoRP?Ú `ã84[Ø‚VàµHùÎ=Í™†ž@){†ÌŠW˪éÕºµön™ÖnÒnÔ+›vèŒ{tÂ~Ö˜Í@4Š,9o¿ÁÐ:†ÁÿkF +AM'…á7å”ÖìK¾s²ø¿]ªyš”yÁ?KDô†xZ¦WkþíÓm ‹áôÉQëç7B]a'¡üWC}Às1))­ÁX}””bIJŒDæ¡/;Ê?÷T (UEN³Ãv²%ÒÈ£S½¤¼\™×•ïy.æ)ønè}Áš b³¡ðÆX­÷¼þÑŸ#~q½©#L[å ·ê?È>Ì}Ri ¹Â‚ŽYäÌ]MÈ1‘Ñ6®†¸¯WôH(¦H‚ŸØ½H.=± ¹6m´YÉÝ3}åbß#&Lœ›}Sߨîâf¹ßY17=ú­7°nÞ†˜/)ý (g̱Âm•búÝQúÖa‡–‚Çù‹V¯Zé-w Ù®©¶v×±HrLÎC]ÏsîzÄ4ÎjV£v{tvE±ŸóÝ‚dh5NuLwÜ×ÀäÛyŽŽ~ U–ëÿ²Eäq2/×8ª6pp½`Š‘¿âñÈê^ûN!÷Œí¿PÒû àz1—Ö +yë¯äküE|¡Sö¼HÅsXèq±óŒÓ0€y“7ÿ‚Y(ɾ*iOBi¥C½n$ÊpKZË ß6mZXþpºÀã¼…K g׬^æ2Þ‹þ^ͪ­U¤:c5Ǥêï ñ߬)þB-&„Z*µ&9W |ÀM…*p*0ó\è«s2Õ™«<IôÖ µ ¦ªW<ØI•àÇ•)4Ì/¼lbJQíJ©sgüaÛt9õýƒ”24§Ùs•€|ƒ”y¹›=œ8„«ÕµT ++U(ÞBUèËʆY‡þš{ Zù]ÔrÿaC3¤óæJçS””aÎæÈ+÷B‰ <·ŒzµÄ x.ÖÇ€ŠNxT©oŸ`‚€Ãòx—.¿M5Øh4—ôy¯êÕó\,}¾‰\ÃOµ95Ås ÈR<Úu=L¨ç€ß”yà G +æÕ®ßÀÊóÌTD •-ýÀ(åéõ"%Ž„-‚ò½±7¤p%°µèÚpF$(ÐQ4cö¹NK9Òöôcx7½|Ì–>¿p0ŒæY¥«¯ÛŠ'lˆÚ£}TIñ¸‚ç«ìï|I§€u1´ÑàìZxÑ%a KpÊÊ`짌x\$7ŧÎèH†òÞ<°5ªçmM¥|·îæí\CÓÑÚŽª¸FBĹ~¸&{Ç8º“Cµ 4wÔL×ÌÊîÁ6k¥¹Årò Z¨¨¶jeǃ,EU–Š‚äbX;M”ë´sx”(çݨÉ:\Lü*FøôêøhŸ TŒ6d„ÆXsÒ‚ßMzô~ˆæ±ˆ½î‘0{ú|ÍtÎý ç<¨Um÷ʈ»\ly;e{½Ç+®öôh›Êà [È‹3.“öm„ð!AÇŽI˜'ÆŽÀoJRr¨5ï È MÁ÷Ñ7¯¼N9 ñ°ÉòZXŒô‡4˜ÐEr”ˆ€§¯´¹}ßfLa=qYHå –ûw¦HLE®ÉÂÉ’Þ±¨C–1[÷Ž'«6rȺ*¨D¢/b÷Ø%EÞ´”x•ó»==Ûqïm?ÑÀ°Ìå>qÒ$É‘ÕÝ&zþ׊¸ºMËΣ(.•F^i7Xêƒpïž²Þ†Wzó˜Üm$‰?Òr'ÄS¯“kÞ`}ÇŸx`áÓ#ï>NÛJÞÙÿ欲ÿ1z?(ⱞh߃óŸÏ…cÖ³tÝÁiÆæbô)Ùr¼v–e9=ì¨äûžq•Š†§Í7ö[Òb×Fª+—eb3Îq{ÛA¡÷ߌžïè›ï²ÚnûŽÑ~§&Wj‹9¼íÜn™#Ãû,ú¯f"½ûXfìû×èaä_úPà¹ArþÛ®ÄÀ?ú¶ÛUn¬’óÞ×Aà¾Õ„£ÿ5Ð*Ш±Âÿ\Qendstream endobj -5503 0 obj << +5583 0 obj << /Type /Page -/Contents 5504 0 R -/Resources 5502 0 R +/Contents 5584 0 R +/Resources 5582 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5487 0 R +/Parent 5592 0 R >> endobj -5505 0 obj << -/D [5503 0 R /XYZ 85.039 781.388 null] +5570 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 348 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5593 0 R] +/Length 23954 +/Filter /FlateDecode +>> +stream +xÚì]‰b«*Å÷ ùÿ¿|3h³6]ÞmÚ2ͽ¶FÑÄ9Ì>ãèRÂ/a; .ØfÛ¶‡ýnç“15Û¶œ ªð4.z³nÛí´Ã6‡m §'»Óùº-¶ÓÛÇ«ÇÛé±<‚mÇ×-žîoÛO[·¶´1ÆÛNÇm· ƒÛv;½ƒÃScžNŒ ùi‹§O»aÚÝéfI}߈…hÛ¶ÝnËa;o[`êbX·!l´ZOðv¾;}?LÛ`;Ý_O;l%œN¶m[¾N·m|Ú6¶Þ¶¦‡u;m§WÛU«Ý鸥°Í¶m²H\†u‹§ 8Ý߶Ùî4ÜÚ»vô-3èÆÄñnËÏ™¹Ðë¶Þ¸0ߘ8ß¾gfü;ºÀBºnņ±a]`!;m¾bÁlX ;,ˆæÝéýÆÔó¶õ¯±€[ÑlXhNX8œn„ð} éö±àmìÔÞ ÕN.è&ä&ø”.!•ï° OÛ½\Èß ìö‚È…å ó˜Sž¿‡dûB:R¿mņqÒŽ:R½r!êHû‰íNï7,ˆd8mãNɹ…ºnÕ¦#©M.,Òíôl»ê¥’Ã6,°õ¦<éF‡­ $Û6Þ†±§Oi:9,|©oÃBNíPð`ëí¶lým;ÂM–§m ì“ŸȴévzÛjÛ&Û6Es¶`­ÖåiÛªm» “Ý8=߶xú´mCJåº aÛᾎÛ`; ·Ávó¸9ÐàéÅvú¶EÀ’~ÝúÛÕñð p#þ“¹£ÝÓ@Áç°ðç°Ð:,\DZºoå¯aá`ð::QèäŸł{ê×rÁÙ  Ñfø::Q“:?Ò_Ä‚£;äì‡G+9¹à°àÈaÁaÁ‘ßÆñ}qàŒjÆuöŸÃBëâ Wt_¨Ãâ‚TóÿÞA1N¾ŸÀ45‘úÃ4EX„ÊaáIrñ…œx?È/)J&òex¸@VC’<¨6 +rŸ|ÔyÏK}å°àäÂ¥Ž4œÇÚü*¸"àR|ÉÕš)9cÂ"©Î®WÉGeCˆ§?‹å§ gra™ðÁ(ûí+Õ4uQÔÛ£š¦Ì„M}8IMÓ:èûO=~MêÁÁÇ«ÏrVG’±`™ÔÿÑPx•·†DÕ nÛ/ÑQW¼ Ä›}g/ìä‚Ç´ÆZåž#'Í’HP˜1|oE·¸0IŒï‹pý„±ÐšÃпŤ·æX_w¦ë”ź‹C¦ããK„JÄñ±'¾Éø‡ÁPPÆèµ\¨?ÕK«äÓ`ða”=¦íRyä%‰p7}X./±ð°&ÏÓ£=ˆéj™Z:–·Ó­'yÔ øš&]>­¾=]§ö†£±™òÏñé%üéDišäÕôɯ¿ñ`œTnY?Y +Üרpòì…òú£Xxîí‘ gw!¬„ ÌP¬3Ý@F[b– S>ÝĜв0$ƒy2°Ô¨Žz(gýrJ¦ÙV…•I4YQf…å&Ißb§vø€ç¾S¦’}j*#D=l¿‹CTiË…Ze>œ ˆxë$,ûå³X¸ ðƒóè ÁR¼T¾¿–JWt|è.Ë2=u‡Eî°p®qèeÓ´©¬r±0Ã/šeéÁÕPJJ…_pÑD:ˆ‘JE¯<-xÎ$e:FþE=#YåçWE6À¡¼i¨ L$€Žž ÒiæÙßBû9/¨æ ¦úLÃNN*mÛ»Q&A”ÉžJߢ²×áa‚rL‚Á u¤¹—I“ +Þ ¦ +É)“ïe¦ {áZí¶ÚL•~)j 9¹q¡ ü]g ç”˃Š½Ê…x d`mKÖ€½0 |U‘F À¸!šÊt¤ç{S ^‚Æ8¡2a➢T›\€ãL1gs 2˜½C¹$XúÌx¡áŒ~©*ÓôKŠNÈ'&@6ਾ^­sukAE¥ÝÄêHq‰ÅË~‚rx(Ø€íAGŠEwa+|  üR.\« îŽÔWba´FÈ•žù sXxyò Owö‚䜷ö“˜Ûš~Sé¾ï9(Mí׺3BÀž¡ó5Ì^Øv¬,MYÏt³a›ŠBÈdtáÇܤg11µH x\€XX­d`êD™XçÙ 0P«›J‹¸“Â×–Æ%åÂz[ÉtdDX(lÓ/Z6h¾‹w|ÁŸ$¾xK.˜å æë ,L7Qg÷zÃÂÿÍÿeY âBzvWkÊ¡¶þÖb<4n +‚#VwÒ”Ò,†|àjÃìèO,4³æ4¹À°×D£‚aÌ„²X°}\|`˜ë vÀ_LJßb¡Q+j‹˜s,”ˆe|*u…X°×ÑÉ*)h+¢U.Ò¶–)Õ{±êñ…k¹`š`<çmU„Es›m• +‹úò=‹…ssa¹é .ôþFÕáøwS? Œ77N¬.â LhAs˜ðm3n–zÔi6Ý)•À\ ›¤ºk±Àl;‡…» Eú€…tÀFpµ1“ Ú&TŒ,4 Ìß"­Ym”î³vpï ðlÔ‘æ=J]Ð +ÏF íýh°XÐ!³r*X± 8ÜU-«Z÷a¡¸_¸!Ttá¾o–ÄËst‡úWÒ¢H½Þ:{¯ð}Lj`ëG,\¡®‰‚È;¸þ:œ—œ°Ø¤0 5ÁMäƒjx»&žáÈ$‰àá6NCßOÖ^üm,ã ©–´r1ŠÁÔχ4ñÍsT »g 00Ù•C 6© A é¥d€½!\Õ!б¸ÌZP‰’aµƒD‡z#¤×ÑÑ!WBĽövþ6Øý\œb ³zDÌå 6ÛG/Õm ßY)c*³NQ2ÔÑ@Ú!ŽÀWÈ<ýl 0VMºh°¼ OÈ‹…Ó~5yÁ1:v”.üü¯«òÿŽ‡@l×@×tÛeT«óyî û«d½Éõ«(Ü>‡…פX|ÇU ù”\ {Û¹öVV:E‹Oêw½îðv‘d{]Æ)p›Mi Å#Cyãv˜^G[NX˜¢ $yqwƳ<ëúBUh=1_ç©ewùÆBÀØUfÃ+aá;r'†ÅÛö‚¿ó©nRÁ_ÃÅd~§ý+b=¤ÞVVÊÚΰݔ p›=ÿn¬•&•gßoBïÄÓ ÈÔ^šzÖ3{!Ö‘×c‰ÅŒ§V3\…Öv>ÝÇŸ÷©¾Õã·=š7åÉwnÿ•ÓN¶ƒµEóð8_§Ì¥UJ›~¤S`DIzK<¬û1µµÁ©~ I4›ÌYÐes-öTE´‡«ó©:z WraY3‡Š»ï36m.Ñ}¹òz™ƒÉz»RŽiìS0,ƒž%­ZågEÀrÒÌ··¢$™îaÁŒ'wâ!÷Òðj\ra>XgÑŠ…½êZ.\žx@ŽÃµô>GÎk¼«ºò§ÝvpyiÓþBßž|ÞÑÓ äàBT²t먽|rž½]¶†• ›¬Ÿæxg ?ׂ.ëöUmG΋½“ˆØsÚ +•ñ2…¢9ÝÏ ,ØAu^'Qœìg'˜Þ=±°‡ô•\ð.µ­C‡Ã>¨ä8GaíA:'_=ïu’%]Sòz~)è/´ïQzCôÖ†ówžÄ}v}`šKx*£æ²LŒ'×JÊã>†/ÜoûÒ7î‹|“–}¶©IÙ·ëäÄfà¸&î3Ä‚_–1à•-Æ Ê2°Eߦ¦`#_³²“¬ï@§0z<æ—½¿´ˆh²¾„ûi‚>î-Ylê¸l}ÁHK¬¦MñÊL™²êû yYNp%àŠÈÃ:^N|M÷ó"xUö†É1•5¼_¸„h:°÷r£N`‡dUÕ“p¸ƒ”Ý Ûr˜ æótfõ¹Õ^²®éiú¡ŒAð‡r¦šÄ1‹NRYÎ\Øo:Ú™­¿N!M/²®è2ãÔJ•l5½Œ»¡T£§fiVÆ*‡>Îî+ +»%Æ¢yLõbÏ:ía¤¹Õkáb–¢á<ëõBF¶Ã`à0šŸÈ8Ô‚XL&“Ž˜W×€ð’ð5 ó8 +—lÖä‘•1nÖ;W;¶òvVíÍ4¢ähšŽÝ3š'±°:`Óƒñp`i;—×w±pžäz).’j§Óm;,\`¡Àê2›r ’˜If¨›ÛŒo2lÕ*0y.– +ä…Y†¼‘³É¤eñBÛ™¶Êq´ã$9açveð'@ h(Œ6˜¬]efm°S~DÉmöªãxž‘-›«uâc1cJd‡ AK^©œ Ñæx1QГʕ`ê“( ‹aiu¤õš ÄõEGmß¾}£Þ9Ù-º:-䌧ýêFÀÖ?qíÎ7”{~Ø<‹AØr*¶¡ðø\ÝÇÂ?_Ê…‹ M'qæ°`Îó‘ˆ,lÎM…†I\Ä ð…w´íf©LB™›D +GJÆùVëéáG,D˜®Wró,çp<àqFCm¿y¦9ãò¤ö£šncÂA¼Føh˜PúíÀ9—rÁœÓø„…^ÛÇËl‚^à*„”\‹]üÐÃIŸ1‚ Üý†…þˆ€BÔ&š¯ßÃ-éQaÜMÅe§”4»T%Ì :ÙÂobÁØÆ'-É»_3q…«¸ó…[ØaáÂ^Ð;,ÔkB熫#{M1ÓÝ rIãj¨L‚0ɲj¶O«”}œé£IêaICÉIñˆ~͹Þ-4æŽùLΰÿôŒPÃÏeÁè¹,€)!+ø—tCœÍY@кµ:ÃÂDV©0L ¿×y/NÎ#Ï&~ÎäÂR‹½ñ¤ê)-ßÎGz  yµ³…Çw`a‹Üy',4“ —UB —&ZÖG)=— ð+ +,TÙ{WîA, »2À26f+Íà_(ði5ºD‹àˆšfcþô:˜/Ñ(±PŠô<ÆõeivSˆ­ѳrS°C饸–'í*õì$€……kIkÄB&¤\‡ áfàkI9Ós ïóð8Y6¯ ‘áLHš6ØzîîiLs9pã VÁZˆw¸˜šäº‡ä›Ë¬4z)ƒ­Îçä—J5›ù! {:(xøaœhWÕvLßsh±u¿8\éà z"¾ìO¬¢ovª.’Ãÿ¸OµÐ4íêÇCèËŒx:Sƒ¦XúE+ñ+Uíà+É_RàÛ©(uã å„©ø,€µAGŠ0)¨ä ¦ÿxZa¶]#¬«*²‰Á?.šV'¤ÔÄ×óÒØü.\Žit«2º„Ìú{ÓaV ¹.Ì8TFót®eÚ+¨T™ü á¿K!ûzâ-H¨)•úîÖ÷bÁŒ^uV‹¶·Oö ~Á„‡âˆ“ºâççõU~áÝkü}hž^»§îéHÅ´ëYæÕŽ&ձŘÃ|u’`·l³èÅæ/S˜•Á¼(_{IfƒRÒ®Ûc”š¢^«¸·7­äB°ba´PO×­µjÇm=„iuˆÙjè°«*èHÓÐE`AˆøÐúªY¼^×Óû~i;ðšÏ# +ÄB`td;Ub®T­=Ô± §¦€,³!‹¢^ؼý ‚(BwhR/ß퉒‹ŒŒ:‰ò­IWî±v“FùEU~á{ùV/êÓuCJClÙ›}; O6ù¡ÍÒq ¸ïü<ÖFÖ{DU颒bSÞ<å°€X¡ ub&=ÙD¼^’!ƒI[mãòR8³"[fpØXh@:aÁ®…`)`Ö6µYØJØ:¶ÑéÉBK–6[T´Þ à +,^™¨Ê&&×uªÁ _ß_ÖÝZÓ"—ðX‡ ÁZ4V@(YÙÐ1eÓdáB¥=.˜Š>¿ ;{¡yºoP1â¢=Ë­ud›bÁ÷¦ñªÉASB³ 4u¸LX(qãðcŒ6Md¥«ÛÜßø1î ÷‘NËaÞG¡œ\°³ `X,,ýšç¬,z¬°œÎåB-ûÂD(4ê `JcEïmõN,­?gZ³ïV,4€…«öÃaÎl/àvA%+‰›L5þZÆ,xXX˜p¢ŸbeíP˜cu Êì¹ 2Õ°µRh• ½­¸VXF‘5&å'䯠´úß4ùéX¨C7ÄN¶0Y:é.Œ†@áüƒ2^Ú6ÛÀ]‘’]ÛP÷µ/†:G,è0•8ÎdÚ_Àüž†,dkû»–­G´˜lãb:R%ð}±hPûY3ôaŠ +@#–º¡b +9ê`miáÕ4Ì„"Dš‚ñöBȹªàZñàx³`‘(IÃPGå’êw`¡¦ì¬ößaáo`¡ÛÕòÔ´0K a“ 8cq2tµœm+òŠL‚!SqF[¶ø}c=8AæÞj1Œ„TÉz„fiµè‚v="`JÁ˜,1vlSŒ+gŽ¦mM΀×p-à $„èS‚ãVU‡+UÓ VRàöõp&(ͪ‰áNg{ÿèR>¼KßÈÛôyá_pXø{ñ… ÝWí4ÉÓ¯'=³^}G÷OÝZ„57gäCÿ°C@}}]üM]~<@­}a"»Ca«¦Ü÷äjŽÃÖïÒ‚/×_pXø;X ?ö‡[œéG¨/ú`8,üu¹ðH•«öÏ_Š0øN‡'ÂʲsXøsX û’ŽNäì…?‡Gwè×É…¹ª¾~ª&WKdçÒÂ͘4M²®S~ŽÕÜ  ¯A$YWùüZjiS®öf<ÄØO±Ñk“h¡•ÒZ­ª¼ÒaÁaá7S(}°8±u›â€…N*%q1c“h]×:ÆÂñÕËM÷ÍÎJ +‡…W¢ó†¤ÃÂÛS¬QÁìžà튆-;)…ZìZò¥n3L'h/+9ePŽ­Iãþe°ðÚk~ÙZ'ž ,}éfXö”¶¨#Õ2ã>ðs ŠZ·éa­õQH/peï4hÀD£¯zÚÄœÁ‚«ý¿…ߘƒñ¿¨HÚÃÜ´D…H¨• µÌ)5'ä‚ä\¬ë\`ƒÂ˜<æ¦ +Óíãaj+_IGrñ…ÛXprá J1!¸çJF‘0l• : +„â±’`/dõaÍ<Ûq·ا³Eþ—=„”·Vrráå䂳Þ&»¸FÏ ëAMb›\ˆÎEZ£\Øe |èÄ´½í@MÅ´8,8{áw|QX×Õã +b:`@aº'(b…ËžZwi˜°•ÄxC:Ž›‚¼ fιóaSã'¾ï°ðÑv]˜ûŸäÂl¢— (jiã kõz<°Æð†‰5gÀîª×LÈåz]KçS}9rXx‚°Âû”c¿X2‹×4ÞbêÛ£7Í֯Ú(@Ï*Áð\ÒÙz¯ËàOßsXxurö¤DõüÁan5ò W“ ?’<ú|Z‡¿¶¸ÊJ‡‡…_i>7ï=¶i^ aš¦£{¤çO£ìûÖaỾýo\ÇÓÅÚ®æ¬kû5ö‚Ê&Õ]•¨(]÷ˆNâ_F\|üÚ·d@íï"ó^ .î|C–ÿª¸s¡2\p\È’[MÍûœ°[·þÝ4õ7¬‰–žîÂ7ÞÕJP.ÖöZÜócó‘l_qì/n7øÕ²2)òäÖØœ4ÈàžYû×v mjB×:Óy³–À…uª·Ø°"8Ï7v²ß®€ Ì~ßkG›—G­Éñt8ªVár8Ø’ÆÐÎÉ…Wf¨Ÿš›—2©ÙdbÊ$OŒO{)*ÀBPpßiÖžéý ü¶4ª•šã•¥–öY'س*a í8dJ)膅XhV(̲¦™){&Ù‚m>åÆÊvOjL%lOöLHî)>°:x/f†Óý†–ºZÓ®ÓA$p¤röÂëRM)ë ½Ðp>&šÂü‡To`KÿŒ®áêäÂËɇ…ïò\|rFYìÀùÓð¢(qXø.r>ÕW#!ÖÕÆý[ +*í°ðbÄGßCÚé)¯f4„$$îõ /¢÷9rô½vbQ‡~¾žÒÞ} Ž:­µ{îçdëÚÜ×ðçÈÅn˜ +  .î|¡#aÜÙ} N.8Zû#¹¯ÁÉG¦Û¹t_ߣ)ò"ß} ¯@I4¹ïÁ‘#ûàò92‚…pºÙk’וeû…¯®pßé#,PÛoÅÑ+ÄW’ÒŸñ¹›åæ“ÿ;D–I‡…RßÅÂDFòU¯¢ú)X°µÿßb/ ƒËÑü>z_@,ñ«èaá{â΋/¸:–üV,Ü‹/ôCJ–/£ðÇ`áÛâÎÜEz^W.|1~ˆóüÛò‘¸Ëø3Xpö‚àSD{š=°þ¢\hRßO9{áûÈaáeé¯Ú  Žœ½à°àè+ì…1,Š°°›btrÁaáÇQ\úöÂ8Æ´ âeŒû>ÇŸ,TÛ–±ÃŸ£Gëx¾GG •]9È¥q©³p¼‚ÃÏ‘ ¡‹/üI*¿ Ä×™R½^„ÏæOã/ .¾ðW±À¾À^£!!E&—\HÞŽ9ç< jÜY;¹àäÂÇí…м°ŽåDHÎtŸPJóð‡Êât$'>£#M²¯ —Õã9©‹"ü©öBÍØ÷dÉ9,|+Myt·öÿ]ñ…0ÖŒK¹”š–2.\|Áaá7Ñûâ “{­áms2ºø‚ÃÂo¢þ}:RY¤’…c4º¸³ÃÂ/“ ï‰/Äœsæ—ä°ðDZ’añÓü†|¤Æw9Û‘’²,óOÚ ãªa…ÿ ò³ëÚ\-ÏŸ¤G>Õ'í…1 ¦3aô£ I¡«ýwXø±XxNGÃ@ƒ™`,Æ¢ãðË–‘tD…‹;;,¼>>“4†KÀR !0

    samba@samba.org
    Last Update : Fri Jun 6 00:45:54 CEST 2003 @@ -56,18 +52,13 @@ url="http://www.fsf.org/licenses/gpl.txt">http://www.fsf.org/licenses/gpl.txt - - - + + Attributions - &attributions-dev; - - + - - diff --git a/docs/docbook/devdoc/modules.xml b/docs/docbook/devdoc/modules.xml index e2eb78d6c9..171ee27f90 100644 --- a/docs/docbook/devdoc/modules.xml +++ b/docs/docbook/devdoc/modules.xml @@ -136,13 +136,14 @@ for each module and SMB_SUBSYSTEM() for each subsystem. SMB_MODULE(subsystem_backend, object files, plugin name, subsystem name, static_action, shared_action) -SMB_SUBSYSTEM(subsystem) +SMB_SUBSYSTEM(subsystem,depfile) -Also, make sure to add the correct directives to -Makefile.in. @SUBSYSTEM_STATIC@ -will be replaced with a list of objects files of the modules that need to -be linked in statically. @SUBSYSTEM_MODULES@ will +The depfile for a certain subsystem is the file that calls the +initialisation functions for the statically built in modules. + + +@SUBSYSTEM_MODULES@ in Makefile.in will be replaced with the names of the plugins to build. @@ -151,6 +152,13 @@ be changed by ./configure are rebuilded in the 'modules_clean' make target. Practically, this means all c files that contain static_init_subsystem; calls need to be rebuilded. + + +There currently also is a configure.in command called SMB_MODULE_PROVIVES(). +This is used for modules that register multiple things. It should not +be used as probing will most likely disappear in the future. + + diff --git a/docs/docbook/global.ent b/docs/docbook/global.ent index bb1e586cb8..297d1bc883 100644 --- a/docs/docbook/global.ent +++ b/docs/docbook/global.ent @@ -12,7 +12,7 @@ JelmerVernooijR. +JelmerR.VernooijR. The Samba Team
    jelmer@samba.org
    @@ -57,14 +57,14 @@     '> - +JimMcDonough IBM
    jmcd@us.ibm.com
    -     -'> + '> + +&person.jmcd;'> @@ -75,6 +75,15 @@ '> + + DavidBannon + + Samba Team +
    dbannon@samba.org
    +     +'> + RafalSzczesniak @@ -149,9 +158,8 @@ use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic. Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file. +override the log level parameter +in the &smb.conf; file. '> @@ -163,8 +171,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See &smb.conf; for more information. The default configuration file name is determined at compile time. '> @@ -172,8 +179,8 @@ compile time. -V -Prints the version number for -smbd. +Prints the program version number. + '> If this parameter is not set then the name resolve order -defined in the smb.conf -5 file parameter -(name resolve order) will be used. +defined in the &smb.conf; file parameter +(name resolve order) will be used. + The default order is lmhosts, host, wins, bcast. Without -this parameter or any entry in the name resolve order - parameter of the smb.conf -5 file, the name resolution methods -will be attempted in this order. +this parameter or any entry in the name resolve order parameter of the &smb.conf; file, the name +resolution methods will be attempted in this order. '> -n <primary NetBIOS name> This option allows you to override the NetBIOS name that Samba uses for itself. This is identical -to setting the NetBIOS -name parameter in the smb.conf -5 file. However, a command +to setting the netbios name parameter in the &smb.conf; file. +However, a command line setting will take precedence over settings in -smb.conf -5. +&smb.conf;. '> -O socket options TCP socket options to set on the client socket. See the socket options parameter in -the smb.conf -5 manual page for the list of valid +the &smb.conf; manual page for the list of valid options. '> @@ -317,12 +319,14 @@ this parameter is specified, the client will request a password. '> + + --U|--user=username[%password] +-U|--user=username[&pct;password] Sets the SMB username or username and password. -If %password is not specified, the user will be prompted. The +If &pct;password is not specified, the user will be prompted. The client will first check the USER environment variable, then the LOGNAME variable and if either exists, the string is uppercased. If these environmental variables are not @@ -435,13 +439,12 @@ an Active Directory environment. - + - @@ -507,7 +510,18 @@ an Active Directory environment. - + + Currently NOT implemented."> root# "> +$ "> +C:\> "> + + + + + + + + diff --git a/docs/docbook/manpages/editreg.1.xml b/docs/docbook/manpages/editreg.1.xml index 3427552356..0a6b36bcf0 100644 --- a/docs/docbook/manpages/editreg.1.xml +++ b/docs/docbook/manpages/editreg.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/findsmb.1.xml b/docs/docbook/manpages/findsmb.1.xml index e5ec26c4df..8a89b2ce24 100644 --- a/docs/docbook/manpages/findsmb.1.xml +++ b/docs/docbook/manpages/findsmb.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/lmhosts.5.xml b/docs/docbook/manpages/lmhosts.5.xml index 12d69a7e56..7e1988c121 100644 --- a/docs/docbook/manpages/lmhosts.5.xml +++ b/docs/docbook/manpages/lmhosts.5.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/log2pcap.1.xml b/docs/docbook/manpages/log2pcap.1.xml new file mode 100644 index 0000000000..2a336dc326 --- /dev/null +++ b/docs/docbook/manpages/log2pcap.1.xml @@ -0,0 +1,138 @@ + + %globalentities; +]> + + + + log2pcap + 1 + + + + + log2pcap + Extract network traces from Samba log files + + + + + log2pcap + -h + -q + logfile + pcap_file + + + + + DESCRIPTION + + This tool is part of the Samba + 7 suite. + + log2pcap reads in a + samba log file and generates a pcap file (readable + by most sniffers, such as ethereal or tcpdump) based on the packet + dumps in the log file. + + The log file must have a log level + of at least 5 to get the SMB header/parameters + right, 10 to get the first 512 data bytes of the + packet and 50 to get the whole packet. + + + + + OPTIONS + + + + -h + If this parameter is + specified the output file will be a + hex dump, in a format that is readable + by the text2pcap utility. + + + + -q + Be quiet. No warning messages about missing + or incomplete data will be given. + + + + logfile + + Samba log file. log2pcap will try to read the log from stdin + if the log file is not specified. + + + + + pcap_file + + Name of the output file to write the pcap (or hexdump) data to. + If this argument is not specified, output data will be written + to stdout. + + + + &stdarg.help; + + + + + + EXAMPLES + + Extract all network traffic from all samba log files: + + + $ cat /var/log/* | log2pcap > trace.pcap + + + Convert to pcap using text2pcap: + + + $ log2pcap -h samba.log | text2pcap -T 139,139 - trace.pcap + + + + + VERSION + + This man page is correct for version 3.0 of the Samba suite. + + + + BUGS + + Only SMB data is extracted from the samba logs, no LDAP, + NetBIOS lookup or other data. + + The generated TCP and IP headers don't contain a valid + checksum. + + + + + + SEE ALSO + text2pcap + 1, ethereal1 + + + + AUTHOR + + The original Samba software and related utilities + were created by Andrew Tridgell. Samba is now developed + by the Samba Team as an Open Source project similar + to the way the Linux kernel is developed. + + This manpage was written by Jelmer Vernooij. + + + diff --git a/docs/docbook/manpages/mount.cifs.8.xml b/docs/docbook/manpages/mount.cifs.8.xml new file mode 100644 index 0000000000..99bd6b23d5 --- /dev/null +++ b/docs/docbook/manpages/mount.cifs.8.xml @@ -0,0 +1,302 @@ + + %globalentities; +]> + + + + mount.cifs + 8 + + + + + mount.cifs + mount using the Common Internet File System (CIFS) + + + + + + mount.cifs + service + mount-point + -o options + + + + + DESCRIPTION + + This tool is part of the Samba + 7 suite. + + mount.cifs mounts a Linux CIFS filesystem. It +is usually invoked indirectly by +the mount8 command when using the +"-t cifs" option. This command only works in Linux, and the kernel must +support the cifs filesystem. The CIFS protocol is the successor to the +SMB protocol and is supported by most Windows servers and many other +commercial servers and Network Attached Storage appliances as well as +by the popular Open Source server Samba. + + + + The mount.cifs utility attaches the UNC name (exported network resource) to + the local directory mount-point. It is possible to set the mode for mount.cifs to +setuid root to allow non-root users to mount shares to directories for which they +have write permission. + + + + Options to mount.cifs are specified as a comma-separated +list of key=value pairs. It is possible to send options other +than those listed here, assuming that cifs supports them. If +you get mount failures, check your kernel log for errors on +unknown options. + + + mount.cifs is a daemon. After mounting it keeps running until + the mounted resource is unmounted (usually via the umount utility) + + + + + + OPTIONS + + username=arg + + specifies the username to connect as. If + this is not given, then the environment variable USER is used. This option can also take the +form "user%password" or "user/workgroup" or +"user/workgroup%password" to allow the password and workgroup +to be specified as part of the username. + + + + password=arg + + specifies the CIFS password. If this +option is not given then the environment variable +PASSWD is used. If it can find +no password mount.cifs will prompt +for a passeword, unless the guest option is +given. + + +Note that password which contain the arguement delimiter +character (i.e. a comma ',') will failed to be parsed correctly +on the command line. However, the same password defined +in the PASSWD environment variable or a credentials file (see +below) will be read correctly. + + + + credentials=filename + + + specifies a file that contains a username + and/or password. The format of the file is: + + + +.nf + username = value + password = value +.fi + + + +This is preferred over having passwords in plaintext in a +shared file, such as /etc/fstab. Be sure to protect any +credentials file properly. + + + + + uid=arg + + sets the uid that will own all files on + the mounted filesystem. + It may be specified as either a username or a numeric uid. + This parameter is ignored when the target server supports + the CIFS Unix extensions. + + + + gid=arg + + sets the gid that will own all files on +the mounted filesystem. +It may be specified as either a groupname or a numeric +gid. This parameter is ignored when the target server supports +the CIFS Unix extensions. + + + + + port=arg + + sets the port number on the server to attempt to contact to negotiate +CIFS support. If the CIFS server is not listening on this port or +if it is not specified, the default ports will be tried i.e. +port 445 is tried and if no response then port 139 is tried. + + + + + file_mode=arg + + If the server does not support the CIFS Unix extensions this + overrides default file mode which will be used locally. + + + + dir_mode=arg + + If the server does not support the CIFS Unix extensions this + overrides the default mode for directories. + + + + ip=arg + + sets the destination host or IP address. + + + + domain=arg + + sets the domain (workgroup) of the user + + + + guest + + don't prompt for a password + + + + + ro + + mount read-only + + + + + rw + mount read-write + + + + rsize + default network read size + + + + wsize + + default network write size + + + + + + + ENVIRONMENT VARIABLES + + + The variable USER may contain the username of the +person using the client. This information is used only if the +protocol level is high enough to support session-level +passwords. The variable can be used to set both username and +password by using the format username%password. + + + + The variable PASSWD may contain the password of the +person using the client. This information is used only if the +protocol level is high enough to support session-level +passwords. + + + + The variable PASSWD_FILE may contain the pathname +of a file to read the password from. A single line of input is +read and used as the password. + + + + + + NOTES + + This command may be used only by root. + + + + CONFIGURATION + +The primary mechanism for making configuration changes and for reading +debug information for the cifs vfs is via the Linux /proc filesystem. +In the directory /proc/fs/cifs are various configuration files and +pseudo files which can display debug information. For more +information see the kernel file fs/cifs/README + + + + + BUGS + + Passwords and other options containing , can not be handled. +For passwords an alternative way of passing them is in a credentials +file or in the PASSWD environment. + + The credentials file does not handle usernames or passwords with + leading space. + + +Note that the typical response to a bug report is suggestion +to try the latest version first. So please try doing that first, +and always include which versions you use of relevant software +when reporting bugs (minimum: samba, kernel, distribution) + + + + + + + VERSION + + This man page is correct for version 3.0 of + the Samba suite. + + + + SEE ALSO + + Documentation/filesystems/cifs.txt and fs/cifs/README in the linux kernel + source tree may contain additional options and information. + + + + + AUTHOR + + Steve French + + The syntax and manpage were loosely based on that of smbmount. It + was converted to Docbook/XML by Jelmer Vernooij. + + The current maintainer of the Linux cifs vfs and the userspace + tool mount.cifs is Steve French. + The SAMBA Mailing list + is the preferred place to ask questions regarding these programs. + + + + + diff --git a/docs/docbook/manpages/net.8.xml b/docs/docbook/manpages/net.8.xml index 9787f4e0b0..21dc54d452 100644 --- a/docs/docbook/manpages/net.8.xml +++ b/docs/docbook/manpages/net.8.xml @@ -1,34 +1,8 @@ - - %globalentities; - - - --r - -Reboot after shutdown. - - - - --f - -Force shutting down all applications. - - - - --t timeout - -Timeout before system will be shut down. An interactive -user of the system can use this time to cancel the shutdown. - -'> + + %globalentities; ]> - @@ -157,6 +131,20 @@ user of the system can use this time to cancel the shutdown. COMMANDS + +CHANGESECRETPW + +This command allows the Samba machine account password to be set from an external application +to a machine account password that has already been stored in Active Directory. DO NOT USE this command +unless you know exactly what you are doing. The use of this command requires that the force flag (-f) +be used also. There will be NO command prompt. Whatever information is piped into stdin, either by +typing at the command line or otherwise, will be stored as the literal machine password. Do NOT use +this without care and attention as it will overwrite a legitimate machine password without warning. +YOU HAVE BEEN WARNED. + + + + TIME @@ -175,7 +163,7 @@ displays the time on the remote server. TIME SYSTEM - Displays the time on the remote server in a format ready for /bin/date +Displays the time on the remote server in a format ready for /bin/date @@ -754,7 +742,28 @@ Interdomain account must already be created on the remote PDC. Shut down the remote server. -&net.arg.shutdown; + +-r + +Reboot after shutdown. + + + + +-f + +Force shutting down all applications. + + + + +-t timeout + +Timeout before system will be shut down. An interactive +user of the system can use this time to cancel the shutdown. + +'> + -C message Display the specified message on the screen to diff --git a/docs/docbook/manpages/nmbd.8.xml b/docs/docbook/manpages/nmbd.8.xml index a98d189839..056c12e342 100644 --- a/docs/docbook/manpages/nmbd.8.xml +++ b/docs/docbook/manpages/nmbd.8.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -134,8 +133,7 @@ NetBIOS lmhosts file. The lmhosts file is a list of NetBIOS names to IP addresses that is loaded by the nmbd server and used via the name - resolution mechanism name resolve - order described in smb.conf + resolution mechanism name resolve order described in smb.conf 5 to resolve any NetBIOS name queries needed by the server. Note that the contents of this file are NOT @@ -174,9 +172,7 @@ If the server is to be run by the inetd meta-daemon, this file must contain suitable startup information for the - meta-daemon. See the install document - for details. + meta-daemon. @@ -187,9 +183,7 @@ If running the server as a daemon at startup, this file will need to contain an appropriate startup - sequence for the server. See the "How to Install and Test SAMBA" document - for details. + sequence for the server. @@ -198,8 +192,7 @@ meta-daemon inetd, this file must contain a mapping of service name (e.g., netbios-ssn) to service port (e.g., 139) and protocol type (e.g., tcp). - See the "How to Install and Test SAMBA" - document for details. + @@ -212,7 +205,7 @@ and /etc/samba/smb.conf. When run as a WINS server (see the - wins support + wins support parameter in the smb.conf 5 man page), nmbd @@ -221,8 +214,7 @@ wherever Samba was configured to install itself. If nmbd is acting as a - browse master (see the local master + browse master (see the local master parameter in the smb.conf 5 man page, nmbd will store the browsing database in the file browse.dat @@ -278,7 +270,7 @@ 1, and the Internet RFC's rfc1001.txt, rfc1002.txt. In addition the CIFS (formerly SMB) specification is available - as a link from the Web page + as a link from the Web page http://samba.org/cifs/. diff --git a/docs/docbook/manpages/nmblookup.1.xml b/docs/docbook/manpages/nmblookup.1.xml index 3da0649dd5..14df0066f5 100644 --- a/docs/docbook/manpages/nmblookup.1.xml +++ b/docs/docbook/manpages/nmblookup.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/ntlm_auth.1.xml b/docs/docbook/manpages/ntlm_auth.1.xml index a37b5b3b7d..77794f0f3f 100644 --- a/docs/docbook/manpages/ntlm_auth.1.xml +++ b/docs/docbook/manpages/ntlm_auth.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/pdbedit.8.xml b/docs/docbook/manpages/pdbedit.8.xml index 8f7582dcb5..8647631f63 100644 --- a/docs/docbook/manpages/pdbedit.8.xml +++ b/docs/docbook/manpages/pdbedit.8.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -31,6 +30,7 @@ -p profile -a -m + -r -x -i passdb-backend -e passdb-backend @@ -40,6 +40,7 @@ -s configfile -P account-policy -C value + -c account-control diff --git a/docs/docbook/manpages/profiles.1.xml b/docs/docbook/manpages/profiles.1.xml index 1dbff39efa..3ae823f634 100644 --- a/docs/docbook/manpages/profiles.1.xml +++ b/docs/docbook/manpages/profiles.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/rpcclient.1.xml b/docs/docbook/manpages/rpcclient.1.xml index 688eef14e8..98795f1775 100644 --- a/docs/docbook/manpages/rpcclient.1.xml +++ b/docs/docbook/manpages/rpcclient.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -58,8 +57,7 @@ server NetBIOS name of Server to which to connect. The server can be any SMB/CIFS server. The name is - resolved using the - name resolve order line from smb.conf + resolved using the name resolve order line from smb.conf 5. diff --git a/docs/docbook/manpages/samba.7.xml b/docs/docbook/manpages/samba.7.xml index 1339f0bb87..35fd15dbf5 100644 --- a/docs/docbook/manpages/samba.7.xml +++ b/docs/docbook/manpages/samba.7.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -240,6 +239,14 @@ + + log2pcap + 1 + log2pcap is a utility + for generating pcap trace files from Samba log + files. + + vfstest 1 diff --git a/docs/docbook/manpages/smbcacls.1.xml b/docs/docbook/manpages/smbcacls.1.xml index ab4fe517eb..78980a6aec 100644 --- a/docs/docbook/manpages/smbcacls.1.xml +++ b/docs/docbook/manpages/smbcacls.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -24,7 +23,7 @@ filename -D acls -M acls - -A acls + -a acls -S acls -C name -G name @@ -56,7 +55,7 @@ - -A acls + -a acls Add the ACLs specified to the ACL list. Existing access control entries are unchanged. diff --git a/docs/docbook/manpages/smbclient.1.xml b/docs/docbook/manpages/smbclient.1.xml index 8e52e878dd..d3b0bb45cd 100644 --- a/docs/docbook/manpages/smbclient.1.xml +++ b/docs/docbook/manpages/smbclient.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -221,23 +220,6 @@ - - -l logfilename - If specified, logfilename specifies a base filename - into which operational data from the running client will be - logged. - - The default base name is specified at compile time. - - The base name is used to generate actual log file names. - For example, if the name specified was "log", the debug file - would be log.client. - - The log file generated is never removed by the client. - - - - &stdarg.help; diff --git a/docs/docbook/manpages/smbcontrol.1.xml b/docs/docbook/manpages/smbcontrol.1.xml index 7bcb7420ba..af6054de58 100644 --- a/docs/docbook/manpages/smbcontrol.1.xml +++ b/docs/docbook/manpages/smbcontrol.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/smbcquotas.1.xml b/docs/docbook/manpages/smbcquotas.1.xml index 90166beaf1..53735b76d1 100644 --- a/docs/docbook/manpages/smbcquotas.1.xml +++ b/docs/docbook/manpages/smbcquotas.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -177,7 +176,7 @@ by the Samba Team as an Open Source project similar to the way the Linux kernel is developed. - smbcacls was written by Stefan Metzmacher. + smbcquotas was written by Stefan Metzmacher. diff --git a/docs/docbook/manpages/smbd.8.xml b/docs/docbook/manpages/smbd.8.xml index 0566c67fcb..ded41f995f 100644 --- a/docs/docbook/manpages/smbd.8.xml +++ b/docs/docbook/manpages/smbd.8.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -144,8 +143,8 @@ file will be created for informational and debug messages from the running server. The log file generated is never removed by the server although - its size may be controlled by the max log size + its size may be controlled by the + max log size option in the smb.conf 5 file. Beware: If the directory specified does not exist, smbd @@ -192,8 +191,7 @@ If the server is to be run by the inetd meta-daemon, this file must contain suitable startup information for the - meta-daemon. See the "How to Install and Test SAMBA" - document for details. + meta-daemon. @@ -204,8 +202,7 @@ If running the server as a daemon at startup, this file will need to contain an appropriate startup - sequence for the server. See the "How to Install and Test SAMBA" - document for details. + sequence for the server. @@ -214,8 +211,7 @@ meta-daemon inetd, this file must contain a mapping of service name (e.g., netbios-ssn) to service port (e.g., 139) and protocol type (e.g., tcp). - See the "How to Install and Test SAMBA" - document for details. + @@ -265,8 +261,7 @@ Samba uses PAM for authentication (when presented with a plaintext password), for account checking (is this account disabled?) and for session management. The degree too which samba supports PAM is restricted - by the limitations of the SMB protocol and the obey - pam restricions smb.conf + by the limitations of the SMB protocol and the obey pam restrictions smb.conf 5 paramater. When this is set, the following restrictions apply: @@ -352,7 +347,7 @@ 1, and the Internet RFC's rfc1001.txt, rfc1002.txt. In addition the CIFS (formerly SMB) specification is available - as a link from the Web page + as a link from the Web page http://samba.org/cifs/. diff --git a/docs/docbook/manpages/smbmnt.8.xml b/docs/docbook/manpages/smbmnt.8.xml index 86596f3ded..0495fa5be0 100644 --- a/docs/docbook/manpages/smbmnt.8.xml +++ b/docs/docbook/manpages/smbmnt.8.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/smbmount.8.xml b/docs/docbook/manpages/smbmount.8.xml index f3f7d1a99b..0017c99cd5 100644 --- a/docs/docbook/manpages/smbmount.8.xml +++ b/docs/docbook/manpages/smbmount.8.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/smbpasswd.5.xml b/docs/docbook/manpages/smbpasswd.5.xml index c3bd654564..cb6a6070bd 100644 --- a/docs/docbook/manpages/smbpasswd.5.xml +++ b/docs/docbook/manpages/smbpasswd.5.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -140,9 +139,9 @@ account has no password (the passwords in the fields LANMAN Password Hash and NT Password Hash are ignored). Note that this will only allow users to log on with no password if the - null passwords parameter is set in the smb.conf - 5 config file. + null passwords parameter is set in the + smb.conf + 5 config file. D - This means the account is disabled and no SMB/CIFS logins will be allowed for this user. @@ -199,7 +198,7 @@ The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at + excellent piece of Open Source software, available at ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 diff --git a/docs/docbook/manpages/smbpasswd.8.xml b/docs/docbook/manpages/smbpasswd.8.xml index 37f617e46a..3ee3a9e12e 100644 --- a/docs/docbook/manpages/smbpasswd.8.xml +++ b/docs/docbook/manpages/smbpasswd.8.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -318,8 +317,7 @@ has been configured to use the experimental --with-ldapsam option. The -w switch is used to specify the password to be used with the - ldap admin - dn. Note that the password is stored in + ldap admin dn. Note that the password is stored in the secrets.tdb and is keyed off of the admin's DN. This means that if the value of ldap admin dn ever changes, the password will need to be @@ -370,9 +368,7 @@ allow "localhost" access to the smbd. In addition, the smbpasswd command is only useful if Samba - has been set up to use encrypted passwords. See the document - "LanMan and NT Password Encryption in Samba" in the docs directory for details - on how to do this. + has been set up to use encrypted passwords. diff --git a/docs/docbook/manpages/smbsh.1.xml b/docs/docbook/manpages/smbsh.1.xml index 1bd29917b9..73eb04d4c6 100644 --- a/docs/docbook/manpages/smbsh.1.xml +++ b/docs/docbook/manpages/smbsh.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -14,7 +13,7 @@ smbsh - Allows access to Windows NT filesystem + Allows access to remote SMB shares using UNIX commands diff --git a/docs/docbook/manpages/smbspool.8.xml b/docs/docbook/manpages/smbspool.8.xml index 340c7ffff2..ec62a0d5df 100644 --- a/docs/docbook/manpages/smbspool.8.xml +++ b/docs/docbook/manpages/smbspool.8.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/smbstatus.1.xml b/docs/docbook/manpages/smbstatus.1.xml index 657175bf48..1e96b39263 100644 --- a/docs/docbook/manpages/smbstatus.1.xml +++ b/docs/docbook/manpages/smbstatus.1.xml @@ -1,10 +1,8 @@ - - %globalentities; + + %globalentities; ]> - diff --git a/docs/docbook/manpages/smbtar.1.xml b/docs/docbook/manpages/smbtar.1.xml index 40c915f1f6..c773937844 100644 --- a/docs/docbook/manpages/smbtar.1.xml +++ b/docs/docbook/manpages/smbtar.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -222,13 +221,13 @@ by the Samba Team as an Open Source project similar to the way the Linux kernel is developed. - Ricky Poulten +Ricky Poulten wrote the tar extension and this man page. The smbtar - script was heavily rewritten and improved by Martin Kraemer. Many thanks to everyone who suggested extensions, improvements, bug fixes, etc. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at + excellent piece of Open Source software, available at ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for diff --git a/docs/docbook/manpages/smbtree.1.xml b/docs/docbook/manpages/smbtree.1.xml index 05f0256b87..9ed2ed4ed8 100644 --- a/docs/docbook/manpages/smbtree.1.xml +++ b/docs/docbook/manpages/smbtree.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/smbumount.8.xml b/docs/docbook/manpages/smbumount.8.xml index 665ffdceb3..d8feb8e938 100644 --- a/docs/docbook/manpages/smbumount.8.xml +++ b/docs/docbook/manpages/smbumount.8.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/swat.8.xml b/docs/docbook/manpages/swat.8.xml index ad6829c3a6..c0579a9f1f 100644 --- a/docs/docbook/manpages/swat.8.xml +++ b/docs/docbook/manpages/swat.8.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/tdbbackup.8.xml b/docs/docbook/manpages/tdbbackup.8.xml index c8c5b7e33d..e5f060b101 100644 --- a/docs/docbook/manpages/tdbbackup.8.xml +++ b/docs/docbook/manpages/tdbbackup.8.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/testparm.1.xml b/docs/docbook/manpages/testparm.1.xml index 085a645a88..84ead17234 100644 --- a/docs/docbook/manpages/testparm.1.xml +++ b/docs/docbook/manpages/testparm.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -182,7 +181,7 @@ The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at + excellent piece of Open Source software, available at ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 diff --git a/docs/docbook/manpages/testprns.1.xml b/docs/docbook/manpages/testprns.1.xml index 2afeba22d3..50584f5a18 100644 --- a/docs/docbook/manpages/testprns.1.xml +++ b/docs/docbook/manpages/testprns.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -138,7 +137,7 @@ The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at + excellent piece of Open Source software, available at ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 diff --git a/docs/docbook/manpages/vfstest.1.xml b/docs/docbook/manpages/vfstest.1.xml index baf45fb0e4..28b543dd81 100644 --- a/docs/docbook/manpages/vfstest.1.xml +++ b/docs/docbook/manpages/vfstest.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> diff --git a/docs/docbook/manpages/wbinfo.1.xml b/docs/docbook/manpages/wbinfo.1.xml index 075ce140cc..728e4f166a 100644 --- a/docs/docbook/manpages/wbinfo.1.xml +++ b/docs/docbook/manpages/wbinfo.1.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -20,24 +19,31 @@ wbinfo - -u - -g - -N netbios-name + -a user%password + -c username + -C groupname + --domain domain -I ip - -n name -s sid + -u -U uid + -g + --get-auth-user -G gid - -S sid - -Y sid - -t -m - --sequence + -n name + -N netbios-name + -o user:group + -O user:group + -p -r user - -a user%password --set-auth-user user%password - --get-auth-user - -p + --sequence + -S sid + -t + -x username + -X groupname + -Y sid @@ -60,18 +66,36 @@ OPTIONS - + - -u - This option will list all users available - in the Windows NT domain for which the winbindd - 8 daemon is operating in. Users in all trusted domains - will also be listed. Note that this operation does not assign - user ids to any users that have not already been seen by - winbindd8 - . + -a username%password + Attempt to authenticate a user via winbindd. + This checks both authenticaion methods and reports its results. + + + + + -c user + Create a local winbind user. + + + -C group + Create a local winbindd group. + + + + + --domain name + This parameter sets the domain on which any specified + operations will performed. If special domain name '.' is used to represent + the current domain to which winbindd belongs. Currently only the + , + , and options honor this parameter. + + + -g This option will list all groups available @@ -82,18 +106,22 @@ seen by winbindd 8. + + + --get-auth-user + Print username and password used by winbindd + during session setup to a domain controller. Username + and password can be set using '-A'. Only available for + root. + - -N name - The -N option - queries winbindd - 8 to query the WINS - server for the IP address associated with the NetBIOS name - specified by the name parameter. - + -G gid + Try to convert a UNIX group id to a Windows + NT SID. If the gid specified does not refer to one within + the idmap gid range then the operation will fail. - - + -I ip The -I option @@ -105,6 +133,16 @@ + + -m + Produce a list of domains trusted by the + Windows NT server winbindd + 8 contacts + when resolving names. This list does not include the Windows + NT domain the server is a Primary Domain Controller for. + + + -n name The -n option @@ -118,8 +156,46 @@ 5 workgroup parameter. + + + -N name + The -N option + queries winbindd + 8 to query the WINS + server for the IP address associated with the NetBIOS name + specified by the name parameter. + + + + -o user:group + Add a winbindd local group as a secondary group + for the specified winbindd local user. + + + + + -O user:group + Remove a winbindd local group as a secondary group + for the specified winbindd local user. + + + + + -p + Check whether winbindd is still alive. + Prints out either 'succeeded' or 'failed'. + + + + -r username + Try to obtain the list of UNIX group ids + to which the user belongs. This only works for users + defined on a Domain Controller. + + + -s sid Use -s to resolve @@ -129,23 +205,22 @@ S-1-5-21-1455342024-3071081365-2475485837-500. - - -U uid - Try to convert a UNIX user id to a Windows NT - SID. If the uid specified does not refer to one within - the winbind uid range then the operation will fail. + --set-auth-user username%password + Store username and password used by winbindd + during session setup to a domain controller. This enables + winbindd to operate in a Windows 2000 domain with Restrict + Anonymous turned on (a.k.a. Permissions compatiable with + Windows 2000 servers only). + - - -G gid - Try to convert a UNIX group id to a Windows - NT SID. If the gid specified does not refer to one within - the winbind gid range then the operation will fail. + --sequence + Show sequence numbers of + all known domains - -S sid Convert a SID to a UNIX user id. If the SID @@ -154,17 +229,6 @@ then the operation will fail. - - - -Y sid - Convert a SID to a UNIX group id. If the SID - does not correspond to a UNIX group mapped by - winbindd8 then - the operation will fail. - - - - -t Verify that the workstation trust account @@ -172,64 +236,44 @@ domain is working. - - -m - Produce a list of domains trusted by the - Windows NT server winbindd - 8 contacts - when resolving names. This list does not include the Windows - NT domain the server is a Primary Domain Controller for. - - - - - --sequence - Show sequence numbers of - all known domains + -u + This option will list all users available + in the Windows NT domain for which the winbindd + 8 daemon is operating in. Users in all trusted domains + will also be listed. Note that this operation does not assign + user ids to any users that have not already been seen by + winbindd8 + . - + - -r username - Try to obtain the list of UNIX group ids - to which the user belongs. This only works for users - defined on a Domain Controller. - + -U uid + Try to convert a UNIX user id to a Windows NT + SID. If the uid specified does not refer to one within + the idmap uid range then the operation will fail. - - + - -a username%password - Attempt to authenticate a user via winbindd. - This checks both authenticaion methods and reports its results. + -x user + Delete an existing local winbind user. - - + - --set-auth-user username%password - Store username and password used by winbindd - during session setup to a domain controller. This enables - winbindd to operate in a Windows 2000 domain with Restrict - Anonymous turned on (a.k.a. Permissions compatiable with - Windows 2000 servers only). + -X group + Delete an existing local winbindd group. - + - --get-auth-user - Print username and password used by winbindd - during session setup to a domain controller. Username - and password can be set using '-A'. Only available for - root. + -Y sid + Convert a SID to a UNIX group id. If the SID + does not correspond to a UNIX group mapped by + winbindd8 then + the operation will fail. - - -p - Check whether winbindd is still alive. - Prints out either 'succeeded' or 'failed'. - - &stdarg.version; &stdarg.help; diff --git a/docs/docbook/manpages/winbindd.8.xml b/docs/docbook/manpages/winbindd.8.xml index d41620b707..b13ec718cf 100644 --- a/docs/docbook/manpages/winbindd.8.xml +++ b/docs/docbook/manpages/winbindd.8.xml @@ -1,8 +1,7 @@ - - %globalentities; + + %globalentities; ]> @@ -207,24 +206,24 @@ group: files winbind [global] section of smb.conf. - - winbind separator - - winbind uid - - winbind gid - - winbind cache time - - winbind enum users - - winbind enum groups - - template homedir - - template shell - - winbind use default domain + + winbind separator + + idmap uid + + idmap gid + + winbind cache time + + winbind enum users + + winbind enum groups + + template homedir + + template shell + + winbind use default domain @@ -287,8 +286,8 @@ auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok winbind cache time = 10 template shell = /bin/bash template homedir = /home/%D/%U - winbind uid = 10000-20000 - winbind gid = 10000-20000 + idmap uid = 10000-20000 + idmap gid = 10000-20000 workgroup = DOMAIN security = domain password server = * @@ -350,8 +349,8 @@ auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok - SIGUSR1 - The SIGUSR1 signal will cause + SIGUSR2 + The SIGUSR2 signal will cause winbindd to write status information to the winbind log file including information about the number of user and group ids allocated by winbindd. diff --git a/docs/docbook/projdoc/AccessControls.xml b/docs/docbook/projdoc/AccessControls.xml index 44780501fe..344e51e5c0 100644 --- a/docs/docbook/projdoc/AccessControls.xml +++ b/docs/docbook/projdoc/AccessControls.xml @@ -2,20 +2,21 @@ &author.jht; &author.jeremy; + &person.jelmer;drawing May 10, 2003 File, Directory and Share Access Controls +ACLs Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of resources shared via Samba do not behave in the manner they might expect. MS Windows network -administrators are often confused regarding network access controls and what is the best way to -provide users with the type of access they need while protecting resources from the consequences -of untoward access capabilities. +administrators are often confused regarding network access controls and how to +provide users with the access they need while protecting resources from unauthorised access. -Unix administrators frequently are not familiar with the MS Windows environment and in particular +Many UNIX administrators are unfamiliar with the MS Windows environment and in particular have difficulty in visualizing what the MS Windows user wishes to achieve in attempts to set file and directory access permissions. @@ -23,12 +24,13 @@ and directory access permissions. The problem lies in the differences in how file and directory permissions and controls work between the two environments. This difference is one that Samba can not completely hide, even -though it does try to make the chasm transparent. +though it does try to bridge the chasm to a degree. +Extended Attributes POSIX Access Control List technology has been available (along with Extended Attributes) -for Unix for many years, yet there is little evidence today of any significant use. This +for UNIX for many years, yet there is little evidence today of any significant use. This explains to some extent the slow adoption of ACLs into commercial Linux products. MS Windows administrators are astounded at this given that ACLs were a foundational capability of the now decade old MS Windows NT operating system. @@ -41,12 +43,11 @@ for delivering the best environment for MS Windows desktop users. -This is an opportune point to mention that it should be borne in mind that Samba was created to -provide a means of interoperability and interchange of data between two operating environments -that are quite different. It was never the intent to make Unix/Linux like MS Windows NT. Instead -the purpose was an is to provide a sufficient level of exchange of data between the two environments. -What is available today extends well beyond early plans and expectations, yet the gap continues to -shrink. +This is an opportune point to mention that Samba was created to provide a means of interoperability +and interchange of data between differing operating environments. Samba has no intent change +UNIX/Linux into a platform like MS Windows. Instead the purpose was and is to provide a sufficient +level of exchange of data between the two environments. What is available today extends well +beyond early plans and expectations, yet the gap continues to shrink. @@ -60,17 +61,17 @@ shrink. Samba Access Control Facilities - Unix File and Directory Permissions + UNIX File and Directory Permissions - Samba honours and implements Unix file system access controls. Users + Samba honours and implements UNIX file system access controls. Users who access a Samba server will do so as a particular MS Windows user. This information is passed to the Samba server as part of the logon or connection setup process. Samba uses this user identity to validate whether or not the user should be given access to file system resources (files and directories). This chapter provides an overview for those - to whom the Unix permissions and controls are a little strange or unknown. + to whom the UNIX permissions and controls are a little strange or unknown. @@ -102,13 +103,13 @@ shrink. - MS Windows ACLs through Unix POSIX ACLs + MS Windows ACLs through UNIX POSIX ACLs - The use of POSIX ACLs on Unix/Linux is possible ONLY if the underlying + The use of POSIX ACLs on UNIX/Linux is possible ONLY if the underlying operating system supports them. If not, then this option will not be - available to you. Current Unix technology platforms have native support + available to you. Current UNIX technology platforms have native support for POSIX ACLs. There are patches for the Linux kernel that provide this also. Sadly, few Linux platforms ship today with native ACLs and Extended Attributes enabled. This chapter has pertinent information @@ -124,16 +125,18 @@ shrink. Perhaps the most important recognition to be made is the simple fact that MS Windows NT4 / 200x / XP -implement a totally divergent file system technology from what is provided in the Unix operating system +implement a totally divergent file system technology from what is provided in the UNIX operating system environment. Firstly we should consider what the most significant differences are, then we shall look at how Samba helps to bridge the differences. +NTFS +File System - MS Windows NTFS Comparison with Unix File Systems + MS Windows NTFS Comparison with UNIX File Systems - Samba operates on top of the Unix file system. This means it is subject to Unix file system conventions + Samba operates on top of the UNIX file system. This means it is subject to UNIX file system conventions and permissions. It also means that if the MS Windows networking environment requires file system behaviour that differs from unix file system behaviour then somehow Samba is responsible for emulating that in a transparent and consistent manner. @@ -152,12 +155,12 @@ at how Samba helps to bridge the differences. Name Space - MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, Unix file names + MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, UNIX file names may be 1023 characters long. In MS Windows file extensions indicate particular file types, - in Unix this is not so rigorously observed as all names are considered arbitrary. + in UNIX this is not so rigorously observed as all names are considered arbitrary. - What MS Windows calls a Folder, Unix calls a directory, + What MS Windows calls a Folder, UNIX calls a directory. @@ -166,25 +169,26 @@ at how Samba helps to bridge the differences. Case Sensitivity - MS Windows file names are generally Upper Case if made up of 8.3 (ie: 8 character file name + 8.3file names + MS Windows file names are generally upper case if made up of 8.3 (ie: 8 character file name and 3 character extension. If longer than 8.3 file names are Case Preserving, and Case Insensitive. - Unix file and directory names are Case Sensitive and Case Preserving. Samba implements the - MS Windows file name behaviour, but it does so as a user application. The Unix file system + UNIX file and directory names are case sensitive and case preserving. Samba implements the + MS Windows file name behaviour, but it does so as a user application. The UNIX file system provides no mechanism to perform case insensitive file name lookups. MS Windows does this by default. This means that Samba has to carry the processing overhead to provide features - that are NOT native to the Unix operating system environment. + that are NOT native to the UNIX operating system environment. - Consider the following, all are unique Unix names but one single MS Windows file name: + Consider the following, all are unique UNIX names but one single MS Windows file name: MYFILE.TXT MyFile.txt myfile.txt - So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in Unix + So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in UNIX they can. So what should Samba do if all three are present? Answer, the one that is lexically first will be accessible to MS Windows users, the others are invisible and unaccessible - any other solution would be suicidal. @@ -196,7 +200,7 @@ at how Samba helps to bridge the differences. Directory Separators - MS Windows and DOS uses the back-slash '\' as a directory delimiter, Unix uses the forward-slash '/' + MS Windows and DOS uses the back-slash '\' as a directory delimiter, UNIX uses the forward-slash '/' as it's directory delimiter. This is transparently handled by Samba. @@ -207,9 +211,9 @@ at how Samba helps to bridge the differences. MS Windows products support a notion of drive letters, like C: to represent - disk partitions. Unix has NO concept if separate identifiers for file partitions since each + disk partitions. UNIX has NO concept if separate identifiers for file partitions since each such file system is mounted to become part of the over-all directory tree. - The Unix directory tree begins at '/', just like the root of a DOS drive is specified like + The UNIX directory tree begins at '/', just like the root of a DOS drive is specified like C:\. @@ -219,9 +223,9 @@ at how Samba helps to bridge the differences. File Naming Conventions - MS Windows generally never experiences file names that begin with a '.', while in Unix these + MS Windows generally never experiences file names that begin with a '.', while in UNIX these are commonly found in a user's home directory. Files that begin with a '.' are typically - either start up files for various Unix applications, or they may be files that contain + either start up files for various UNIX applications, or they may be files that contain start-up configuration data. @@ -231,12 +235,16 @@ at how Samba helps to bridge the differences. Links and Short-Cuts + Linkshard + Linkssoft + Short-Cuts + MS Windows make use of "links and Short-Cuts" that are actually special types of files that will - redirect an attempt to execute the file to the real location of the file. Unix knows of file and directory + redirect an attempt to execute the file to the real location of the file. UNIX knows of file and directory links, but they are entirely different from what MS Windows users are used to. - Symbolic links are files in Unix that contain the actual location of the data (file OR directory). An + Symbolic links are files in UNIX that contain the actual location of the data (file OR directory). An operation (like read or write) will operate directly on the file referenced. Symbolic links are also referred to as 'soft links'. A hard link is something that MS Windows is NOT familiar with. It allows one physical file to be known simultaneously by more than one file name. @@ -247,8 +255,8 @@ at how Samba helps to bridge the differences. There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort - in the process of becoming familiar with Unix/Linux. These are best left for a text that is dedicated to the - purpose of Unix/Linux training/education. + in the process of becoming familiar with UNIX/Linux. These are best left for a text that is dedicated to the + purpose of UNIX/Linux training/education. @@ -262,7 +270,7 @@ at how Samba helps to bridge the differences. Managing directories with unix and windows - ActionMS Windows CommandUnix Command + ActionMS Windows CommandUNIX Command @@ -281,67 +289,44 @@ at how Samba helps to bridge the differences. The network administrator is strongly advised to read foundational training manuals and reference materials - regarding file and directory permissions maintenance. Much can be achieved with the basic Unix permissions + regarding file and directory permissions maintenance. Much can be achieved with the basic UNIX permissions without having to resort to more complex facilities like POSIX Access Control Lists (ACLs) or Extended Attributes (EAs). - Unix/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. - A Unix file listing looks as follows:- - - - jht@frodo:~/stuff> ls -la - total 632 - drwxr-xr-x 13 jht users 816 2003-05-12 22:56 . - drwxr-xr-x 37 jht users 3800 2003-05-12 22:29 .. - d--------- 2 jht users 48 2003-05-12 22:29 muchado00 - d--x--x--x 2 jht users 48 2003-05-12 22:29 muchado01 - dr-xr-xr-x 2 jht users 48 2003-05-12 22:29 muchado02 - drwxrwxrwx 2 jht users 48 2003-05-12 22:29 muchado03 - drw-rw-rw- 2 jht users 48 2003-05-12 22:29 muchado04 - d-w--w--w- 2 jht users 48 2003-05-12 22:29 muchado05 - dr--r--r-- 2 jht users 48 2003-05-12 22:29 muchado06 - drwxrwxrwt 2 jht users 48 2003-05-12 22:29 muchado07 - drwsrwsrwx 2 jht users 48 2003-05-12 22:29 muchado08 - ---------- 1 jht users 1242 2003-05-12 22:31 mydata00.lst - ---x--x--x 1 jht users 1674 2003-05-12 22:33 mydata01.lst - --w--w--w- 1 jht users 7754 2003-05-12 22:33 mydata02.lst - --wx-wx-wx 1 jht users 260179 2003-05-12 22:33 mydata03.lst - -r--r--r-- 1 jht users 21017 2003-05-12 22:32 mydata04.lst - -r-xr-xr-x 1 jht users 206339 2003-05-12 22:32 mydata05.lst - -rw-rw-rw- 1 jht users 41105 2003-05-12 22:32 mydata06.lst - -rwxrwxrwx 1 jht users 19312 2003-05-12 22:32 mydata07.lst - jht@frodo:~/stuff> - + UNIX/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. + A UNIX file listing looks as follows:- + + +&prompt;ls -la +total 632 +drwxr-xr-x 13 maryo gnomes 816 2003-05-12 22:56 . +drwxrwxr-x 37 maryo gnomes 3800 2003-05-12 22:29 .. +dr-xr-xr-x 2 maryo gnomes 48 2003-05-12 22:29 muchado02 +drwxrwxrwx 2 maryo gnomes 48 2003-05-12 22:29 muchado03 +drw-rw-rw- 2 maryo gnomes 48 2003-05-12 22:29 muchado04 +d-w--w--w- 2 maryo gnomes 48 2003-05-12 22:29 muchado05 +dr--r--r-- 2 maryo gnomes 48 2003-05-12 22:29 muchado06 +drwsrwsrwx 2 maryo gnomes 48 2003-05-12 22:29 muchado08 +---------- 1 maryo gnomes 1242 2003-05-12 22:31 mydata00.lst +--w--w--w- 1 maryo gnomes 7754 2003-05-12 22:33 mydata02.lst +-r--r--r-- 1 maryo gnomes 21017 2003-05-12 22:32 mydata04.lst +-rw-rw-rw- 1 maryo gnomes 41105 2003-05-12 22:32 mydata06.lst +&prompt; + - The columns above represent (from left to right): permissions, no blocks used, owner, group, size (bytes), access date, access time, file name. + The columns above represent (from left to right): permissions, number of hard links to file, owner, group, size (bytes), access date, access time, file name. - The permissions field is made up of: - - - JRV: Put this into a diagram of some sort - [ type ] [ users ] [ group ] [ others ] [File, Directory Permissions] - [ d | l ] [ r w x ] [ r w x ] [ r w x ] - | | | | | | | | | | | - | | | | | | | | | | |-----> Can Execute, List files - | | | | | | | | | |-------> Can Write, Create files - | | | | | | | | |---------> Can Read, Read files - | | | | | | | |---------------> Can Execute, List files - | | | | | | |-----------------> Can Write, Create files - | | | | | |-------------------> Can Read, Read files - | | | | |-------------------------> Can Execute, List files - | | | |---------------------------> Can Write, Create files - | | |-----------------------------> Can Read, Read files - | |-----------------------------------> Is a symbolic Link - |---------------------------------------> Is a directory - + An overview of the permissions field can be found in the image below. + Overview of unix permissions fieldaccess1 + Any bit flag may be unset. An unset bit flag is the equivalent of 'Can NOT' and is represented as a '-' character. @@ -357,7 +342,7 @@ at how Samba helps to bridge the differences. - Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = Unix Domain Socket. + Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = UNIX Domain Socket. @@ -403,10 +388,10 @@ Before using any of the following options please refer to the man page for &smb. User and group based controls can prove very useful. In some situations it is distinctly desirable to affect all - file system operations as if a single user is doing this, the use of the force user and - force group behaviour will achieve this. In other situations it may be necessary to affect a + file system operations as if a single user is doing this, the use of the force user and + force group behaviour will achieve this. In other situations it may be necessary to affect a paranoia level of control to ensure that only particular authorised persons will be able to access a share or - it's contents, here the use of the valid users or the invalid users may + it's contents, here the use of the valid users or the invalid users may be most useful. @@ -417,8 +402,10 @@ Before using any of the following options please refer to the man page for &smb. Samba being removed and an alternative solution being adopted. - User and Group Based Controls +
    User and Group Based Controls + + Control Parameter @@ -427,7 +414,7 @@ Before using any of the following options please refer to the man page for &smb. - admin users + admin users List of users who will be granted administrative privileges on the share. They will do all file operations as the super-user (root). @@ -436,59 +423,59 @@ Before using any of the following options please refer to the man page for &smb. - force group + force group Specifies a UNIX group name that will be assigned as the default primary group for all users connecting to this service. - force user + force user Specifies a UNIX user name that will be assigned as the default user for all users connecting to this service. This is useful for sharing files. Incorrect use can cause security problems. - guest ok + guest ok If this parameter is set for a service, then no password is required to connect to the service. Privileges will be those of the guest account. - invalid users + invalid users List of users that should not be allowed to login to this service. - only user + only user Controls whether connections with usernames not in the user list will be allowed. - read list + read list List of users that are given read-only access to a service. Users in this list will not be given write access, no matter what the read only option is set to. - username + username Refer to the &smb.conf; man page for more information - this is a complex and potentially misused parameter. - valid users + valid users List of users that should be allowed to login to this service. - write list + write list List of users that are given read-write access to a service. @@ -510,7 +497,9 @@ Before using any of the following options please refer to the man page for &smb.
    File and Directory Permission Based Controls - + + + Control Parameter @@ -519,67 +508,67 @@ Before using any of the following options please refer to the man page for &smb. - create mask + create mask Refer to the &smb.conf; man page. - directory mask + directory mask The octal modes used when converting DOS modes to UNIX modes when creating UNIX directories. See also: directory security mask. - dos filemode + dos filemode Enabling this parameter allows a user who has write access to the file to modify the permissions on it. - force create mode + force create mode This parameter specifies a set of UNIX mode bit permissions that will always be set on a file created by Samba. - force directory mode + force directory mode This parameter specifies a set of UNIX mode bit permissions that will always be set on a directory created by Samba. - force directory security mode + force directory security mode Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory - force security mode + force security mode Controls UNIX permission bits modified when a Windows NT client manipulates UNIX permissions. - hide unreadable + hide unreadable Prevents clients from seeing the existence of files that cannot be read. - hide unwriteable files + hide unwriteable files Prevents clients from seeing the existence of files that cannot be written to. Unwriteable directories are shown as usual. - nt acl support + nt acl support This parameter controls whether smbd will attempt to map UNIX permissions into Windows NT access control lists. - security mask + security mask Controls UNIX permission bits modified when a Windows NT client is manipulating the UNIX permissions on a file. @@ -594,12 +583,14 @@ Before using any of the following options please refer to the man page for &smb. Miscellaneous Controls - The following are documented because of the prevalence of administrators creating inadvertant barriers to file + The following are documented because of the prevalence of administrators creating inadvertent barriers to file access by not understanding the full implications of &smb.conf; file settings.
    Other Controls + + Control Parameter @@ -608,58 +599,58 @@ Before using any of the following options please refer to the man page for &smb. - case sensitive, default case, short preserve case + case sensitive, default case, short preserve case This means that all file name lookup will be done in a case sensitive manner. Files will be created with the precise filename Samba received from the MS Windows client. - csc policy + csc policy Client Side Caching Policy - parallels MS Windows client side file caching capabilities. - dont descend + dont descend Allows to specify a comma-delimited list of directories that the server should always show as empty. - dos filetime resolution + dos filetime resolution This option is mainly used as a compatibility option for Visual C++ when used against Samba shares. - dos filetimes + dos filetimes DOS and Windows allows users to change file time stamps if they can write to the file. POSIX semantics prevent this. This options allows DOS and Windows behaviour. - fake oplocks + fake oplocks Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an oplock then the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. - hide dot files, hide files, veto files + hide dot files, hide files, veto files Note: MS Windows Explorer allows over-ride of files marked as hidden so they will still be visible. - read only + read only If this parameter is yes, then users of a service may not create or modify files in the service's directory. - veto files + veto files List of files and directories that are neither visible nor accessible. @@ -733,7 +724,7 @@ Before using any of the following options please refer to the man page for &smb. On MS Windows NT4/200x/XP system access control lists on the share itself are set using native - tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder, + tools, usually from file manager. For example, in Windows 200x: right click on the shared folder, then select Sharing, then click on Permissions. The default Windows NT4/200x permission allows Everyone Full Control on the Share. @@ -783,26 +774,31 @@ Before using any of the following options please refer to the man page for &smb. -MS Windows Access Control Lists and Unix Interoperability +MS Windows Access Control Lists and UNIX Interoperability Managing UNIX permissions Using NT Security Dialogs - Windows NT clients can use their native security settings - dialog box to view and modify the underlying UNIX permissions. + + Windows NT clients can use their native security settings dialog box to view and modify the + underlying UNIX permissions. + - Note that this ability is careful not to compromise - the security of the UNIX host Samba is running on, and - still obeys all the file permission rules that a Samba - administrator can set. + + Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and + still obeys all the file permission rules that a Samba administrator can set. + + + + Samba does not attempt to go beyond POSIX ACLs, so that the various finer-grained access control + options provided in Windows are actually ignore. + - All access to Unix/Linux system file via Samba is controlled at - the operating system file access control level. When trying to - figure out file access problems it is vitally important to identify - the identity of the Windows user as it is presented by Samba at - the point of file access. This can best be determined from the + All access to UNIX/Linux system files via Samba is controlled by the operating system file access controls. + When trying to figure out file access problems it is vitally important to find the identity of the Windows + user as it is presented by Samba at the point of file access. This can best be determined from the Samba log files. @@ -811,93 +807,89 @@ Before using any of the following options please refer to the man page for &smb. Viewing File Security on a Samba Share - From an NT4/2000/XP client, single-click with the right - mouse button on any file or directory in a Samba mounted - drive letter or UNC path. When the menu pops-up, click - on the Properties entry at the bottom of - the menu. This brings up the file properties dialog - box. Click on the tab Security and you - will see three buttons, Permissions, - Auditing, and Ownership. - The Auditing button will cause either - an error message A requested privilege is not held - by the client to appear if the user is not the - NT Administrator, or a dialog which is intended to allow an - Administrator to add auditing requirements to a file if the - user is logged on as the NT Administrator. This dialog is - non-functional with a Samba share at this time, as the only - useful button, the Add button will not currently - allow a list of users to be seen. + + From an NT4/2000/XP client, single-click with the right mouse button on any file or directory in a Samba + mounted drive letter or UNC path. When the menu pops-up, click on the Properties + entry at the bottom of the menu. This brings up the file properties dialog box. Click on the tab + Security and you will see three buttons, Permissions, + Auditing, and Ownership. The Auditing + button will cause either an error message A requested privilege is not held by the client + to appear if the user is not the NT Administrator, or a dialog which is intended to allow an Administrator + to add auditing requirements to a file if the user is logged on as the NT Administrator. This dialog is + non-functional with a Samba share at this time, as the only useful button, the Add + button will not currently allow a list of users to be seen. + Viewing file ownership - Clicking on the Ownership button - brings up a dialog box telling you who owns the given file. The - owner name will be of the form : - - "SERVER\user (Long name)" - - Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database). Click on the - Close button to remove this dialog. - - If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone". - - The Take Ownership button will not allow - you to change the ownership of this file to yourself (clicking on - it will display a dialog box complaining that the user you are - currently logged onto the NT client cannot be found). The reason - for this is that changing the ownership of a file is a privileged - operation in UNIX, available only to the root - user. As clicking on this button causes NT to attempt to change - the ownership of a file to the current user logged into the NT - client this will not work with Samba at this time. - - There is an NT chown command that will work with Samba - and allow a user with Administrator privilege connected - to a Samba server as root to change the ownership of - files on both a local NTFS filesystem or remote mounted NTFS - or Samba drive. This is available as part of the Seclib - NT security library written by Jeremy Allison of - the Samba Team, available from the main Samba ftp site. + + Clicking on the Ownership button brings up a dialog box telling you who owns + the given file. The owner name will be of the form: + + + + "SERVER\user (Long name)" + + + + Where SERVER is the NetBIOS name of the Samba server, user + is the user name of the UNIX user who owns the file, and (Long name) is the + descriptive string identifying the user (normally found in the GECOS field of the UNIX password database). + Click on the Close button to remove this dialog. + + + + If the parameter nt acl support is set to false + then the file owner will be shown as the NT user "Everyone". + + + + The Take Ownership button will not allow you to change the ownership of this file to + yourself (clicking on it will display a dialog box complaining that the user you are currently logged onto + the NT client cannot be found). The reason for this is that changing the ownership of a file is a privileged + operation in UNIX, available only to the root user. As clicking on this button causes + NT to attempt to change the ownership of a file to the current user logged into the NT client this will + not work with Samba at this time. + + + There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected + to a Samba server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS + or Samba drive. This is available as part of the Seclib NT security library written + by Jeremy Allison of the Samba-Team, available from the main Samba FTP site. Viewing File or Directory Permissions - The third button is the Permissions - button. Clicking on this brings up a dialog box that shows both - the permissions and the UNIX owner of the file or directory. - The owner is displayed in the form : + + The third button is the Permissions button. Clicking on this brings up a dialog box + that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed in the form: + "SERVER\ user (Long name)" - Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the + Where SERVER is the NetBIOS name of the Samba server, + user is the user name of the UNIX user who owns the file, and + (Long name) is the descriptive string identifying the user (normally found in the GECOS field of the UNIX password database). - If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone" and the - permissions will be shown as NT "Full Control". + + If the parameter nt acl support is set to false + then the file owner will be shown as the NT user "Everyone" and the permissions will be + shown as NT "Full Control". + - The permissions field is displayed differently for files - and directories, so I'll describe the way file permissions - are displayed first. + + The permissions field is displayed differently for files and directories, so I'll describe the way file permissions + are displayed first. + File Permissions @@ -921,7 +913,7 @@ Before using any of the following options please refer to the man page for &smb. "Special Access" in the NT display list. But what happens if the file has no permissions allowed - for a particular UNIX user group or world component ? In order + for a particular UNIX user group or world component? In order to allow "no permissions" to be seen and modified then Samba overloads the NT "Take Ownership" ACL attribute (which has no meaning in UNIX) and reports a component with @@ -963,7 +955,7 @@ Before using any of the following options please refer to the man page for &smb. with the standard Samba permission masks and mapping of DOS attributes that need to also be taken into account. - If the parameter nt acl support + If the parameter nt acl support is set to false then any attempt to set security permissions will fail with an "Access Denied" message. @@ -1013,37 +1005,36 @@ Before using any of the following options please refer to the man page for &smb. to control interaction with the standard Samba create mask parameters. These are : - - security mask - force security mode - directory security mask - force directory security mode - + + security mask + force security mode + directory security mask + force directory security mode + Once a user clicks OK to apply the permissions Samba maps the given permissions into a user/group/world r/w/x triplet set, and then will check the changed permissions for a - file against the bits set in the - security mask parameter. Any bits that + file against the bits set in the + security mask parameter. Any bits that were changed that are not set to '1' in this parameter are left alone in the file permissions. - Essentially, zero bits in the security mask + Essentially, zero bits in the security mask mask may be treated as a set of bits the user is not allowed to change, and one bits are those the user is allowed to change. If not set explicitly this parameter is set to the same value as - the create mask - parameter. To allow a user to modify all the + the create mask parameter. To allow a user to modify all the user/group/world permissions on a file, set this parameter to 0777. Next Samba checks the changed permissions for a file against - the bits set in the - force security mode parameter. Any bits + the bits set in the + force security mode parameter. Any bits that were changed that correspond to bits set to '1' in this parameter are forced to be set. @@ -1052,12 +1043,11 @@ Before using any of the following options please refer to the man page for &smb. modifying security on a file, the user has always set to be 'on'. If not set explicitly this parameter is set to the same value - as the force - create mode parameter. + as the force create mode parameter. To allow a user to modify all the user/group/world permissions on a file with no restrictions set this parameter to 000. - The security mask and force + The security mask and force security mode parameters are applied to the change request in that order. @@ -1068,11 +1058,11 @@ Before using any of the following options please refer to the man page for &smb. parameter instead of force security mode . - The directory security mask parameter + The directory security mask parameter by default is set to the same value as the directory mask parameter and the force directory security mode parameter by default is set to the same value as - the force directory mode parameter. + the force directory mode parameter. In this way Samba enforces the permission restrictions that an administrator can set on a Samba share, whilst still allowing users @@ -1084,23 +1074,24 @@ Before using any of the following options please refer to the man page for &smb. parameters in the &smb.conf; file in that share specific section : - - security mask = 0777 - force security mode = 0 - directory security mask = 0777 - force directory security mode = 0 - + + security mask0777 + force security mode0 + directory security mask0777 + force directory security mode0 + - Interaction with the standard Samba file attribute - mapping + Interaction with the standard Samba file attribute mapping + Samba maps some of the DOS attribute bits (such as "read only") into the UNIX permissions of a file. This means there can be a conflict between the permission bits set via the security dialog and the permission bits set by the file attribute mapping. + One way this can show up is if a file has no UNIX read access for the owner it will show up as "read only" in the standard @@ -1146,7 +1137,6 @@ are examples taken from the mailing list in recent times. - Example Solution: Go to the top of the directory that is shared @@ -1156,17 +1146,17 @@ are examples taken from the mailing list in recent times. Set the ownership to what ever public owner and group you want - - find 'directory_name' -type d -exec chown user.group {}\; - find 'directory_name' -type d -exec chmod 6775 'directory_name' - find 'directory_name' -type f -exec chmod 0775 {} \; - find 'directory_name' -type f -exec chown user.group {}\; - + +&prompt;find 'directory_name' -type d -exec chown user.group {}\; +&prompt;find 'directory_name' -type d -exec chmod 6775 'directory_name' +&prompt;find 'directory_name' -type f -exec chmod 0775 {} \; +&prompt;find 'directory_name' -type f -exec chown user.group {}\; + The above will set the 'sticky bit' on all directories. Read your - Unix/Linux man page on what that does. It causes the OS to assign + UNIX/Linux man page on what that does. It causes the OS to assign to all files created in the directories the ownership of the directory. @@ -1175,62 +1165,62 @@ are examples taken from the mailing list in recent times. Directory is: /foodbar - - $ chown jack.engr /foodbar - + +&prompt;chown jack.engr /foodbar + - + This is the same as doing: - - $ chown jack /foodbar - $ chgrp engr /foodbar - - + +&prompt;chown jack /foodbar +&prompt;chgrp engr /foodbar + + Now do: - - $ chmod 6775 /foodbar - $ ls -al /foodbar/.. - + +&prompt;chmod 6775 /foodbar +&prompt;ls -al /foodbar/.. + You should see: - - drwsrwsr-x 2 jack engr 48 2003-02-04 09:55 foodbar - + +drwsrwsr-x 2 jack engr 48 2003-02-04 09:55 foodbar + Now do: - - $ su - jill - $ cd /foodbar - $ touch Afile - $ ls -al - + +&prompt;su - jill +&prompt;cd /foodbar +&prompt;touch Afile +&prompt;ls -al + You should see that the file Afile created by Jill will have ownership and permissions of Jack, as follows: - - -rw-r--r-- 1 jack engr 0 2003-02-04 09:57 Afile - + +-rw-r--r-- 1 jack engr 0 2003-02-04 09:57 Afile + Now in your &smb.conf; for the share add: - - force create mode = 0775 - force directory mode = 6775 - + +force create mode0775 +force direcrtory mode6775 + @@ -1241,10 +1231,10 @@ are examples taken from the mailing list in recent times. An alternative is to set in the &smb.conf; entry for the share: - - force user = jack - force group = engr - + +force userjack +force groupengr + @@ -1252,14 +1242,49 @@ are examples taken from the mailing list in recent times. - I have set force user and Samba still makes <emphasis>root</emphasis> the owner of all the files - I touch! + I have set force user but Samba still makes <emphasis>root</emphasis> the owner of all the files I touch! - When you have a user in 'admin users', Samba will always do file operations for - this user as root, even if force user has been set. + When you have a user in admin users, samba will always do file operations for + this user as root, even if force user has been set. + + MS Word with Samba changes owner of file + + + Question: When userB saves a word document that is owned by userA the updated file is now owned by userB. + Why is Samba doing this? How do I fix this? + + + + Answer: Word does the following when you modify/change a Word document: Word Creates a NEW document with + a temporary name, Word then closes the old document and deletes it, Word then renames the new document to the original document name. + There is NO mechanism by which Samba CAN IN ANY WAY know that the new document really should be owned by the owners + of the original file. Samba has no way of knowing that the file will be renamed by MS Word. As far as Samba is able + to tell, the file that gets created is a NEW file, not one that the application (Word) is updating. + + + + There is a work-around to solve the permissions problem. That work-around involves understanding how you can manage file + system behaviour from within the &smb.conf; file, as well as understanding how Unix file systems work. Set on the directory + in which you are changing word documents: chmod g+s 'directory_name' This ensures that all files will + be created with the group that owns the directory. In smb.conf share declaration section set: + + + + + force create mode0660 + force directory mode0770 + + + + + These two settings will ensure that all directories and files that get created in the share will be read/writable by the + owner and group set on the directory itself. + + + diff --git a/docs/docbook/projdoc/Backup.xml b/docs/docbook/projdoc/Backup.xml index b3c37aba53..bf391c5c6d 100644 --- a/docs/docbook/projdoc/Backup.xml +++ b/docs/docbook/projdoc/Backup.xml @@ -11,8 +11,6 @@ This chapter did not make it into this release. It is planned for the published release of this document. -If you have something to contribute for this section please email it to -jht@samba.org/ diff --git a/docs/docbook/projdoc/Bugs.xml b/docs/docbook/projdoc/Bugs.xml index b2b8d5c67e..0688e23cf3 100644 --- a/docs/docbook/projdoc/Bugs.xml +++ b/docs/docbook/projdoc/Bugs.xml @@ -2,7 +2,7 @@ &author.jelmer; - Someone; Tridge or Karl Auer perhaps? + &author.tridge; 27 June 1997 @@ -40,7 +40,7 @@ that list that may be able to help you. You may also like to look though the recent mailing list archives, which are conveniently accessible on the Samba web pages -at http://samba.org/samba/. +at http://samba.org/samba/. @@ -80,37 +80,37 @@ detail, but may use too much disk space. -To set the debug level use the log level in your +To set the debug level use the log level in your &smb.conf;. You may also find it useful to set the log level higher for just one machine and keep separate logs for each machine. -To do this use: +To do this add the following lines to your main &smb.conf; file: - -log level = 10 -log file = /usr/local/samba/lib/log.%m -include = /usr/local/samba/lib/smb.conf.%m - + +log level10 +log file/usr/local/samba/lib/log.%m +include/usr/local/samba/lib/smb.conf.%m + then create a file /usr/local/samba/lib/smb.conf.machine where machine is the name of the client you wish to debug. In that file put any &smb.conf; commands you want, for example -log level may be useful. This also allows you to +log level may be useful. This also allows you to experiment with different security systems, protocol levels etc on just one machine. -The &smb.conf; entry log level -is synonymous with the parameter debuglevel that has +The &smb.conf; entry log level +is synonymous with the parameter debuglevel that has been used in older versions of Samba and is being retained for backwards compatibility of &smb.conf; files. -As the log level value is increased you will record +As the log level value is increased you will record a significantly increasing level of debugging information. For most debugging operations you may not need a setting higher than 3. Nearly @@ -142,6 +142,8 @@ You should also detail how to reproduce the problem, if possible. Please make this reasonably detailed. +core files + You may also find that a core file appeared in a corefiles subdirectory of the directory where you keep your samba log @@ -149,8 +151,11 @@ files. This file is the most useful tool for tracking down the bug. To use it you do this: +gdb +debug + - $ gdb smbd core +&prompt;gdb smbd core @@ -191,6 +196,9 @@ where it occurred. Patches +diff +patch + The best sort of bug report is one that includes a fix! If you send us patches please use diff -u format if your version of diff --git a/docs/docbook/projdoc/CUPS-printing.xml b/docs/docbook/projdoc/CUPS-printing.xml index 252da6f4ef..945092d413 100644 --- a/docs/docbook/projdoc/CUPS-printing.xml +++ b/docs/docbook/projdoc/CUPS-printing.xml @@ -5,7 +5,7 @@ KurtPfeifle - Danka Deutschland GmbH + Danka Deutschland GmbH
    kpfeifle@danka.de
         @@ -17,6 +17,8 @@ drawings + &person.jelmer;drawings + (3 June 2003) @@ -30,20 +32,15 @@ Features and Benefits - The Common Unix Print System (CUPS) has become very popular. All - big Linux distributions now ship it as their default printing - system. But to many it is still a very mystical tool. Normally it - "just works" (TM). People tend to regard it as a sort of "black box", - which they don't want to look into, as long as it works OK. But once + The Common UNIX Print System (CUPS) has become very popular. All + major Linux distributions now ship it as their default printing + system. To many it is still a very mystical tool. Mostly, it + "just works" (TM). People tend to regard it as a "black box" + which they don't want to look into, as long as it works. But once there is a little problem, they are in trouble to find out where to - start debugging it. Also, even the most recent and otherwise excellent - printed Samba documentation has only limited attention paid to CUPS - printing, leaving out important pieces or even writing plain wrong - things about it. This demands rectification. But before you dive into - this chapter, make sure that you don't forget to refer to the - "Classical Printing" chapter also. It contains a lot of information - that is relevant for CUPS too. + start debugging it. Refer to the "Classical Printing" chapter also, it + contains a lot of information that is relevant for CUPS. @@ -51,12 +48,10 @@ basic functions may be grasped quite easily, they are also new. Because they are different from other, more traditional printing systems, it is best to try and not apply any prior knowledge about - printing upon this new system. Rather try to start understand CUPS - from the beginning. This documentation will lead you here to a - complete understanding of CUPS, if you study all of the material - contained. But lets start with the most basic things first. Maybe this - is all you need for now. Then you can skip most of the other - paragraphs. + printing upon this new system. Rather, try to understand CUPS + from the beginning. This documentation will lead you to a + complete understanding of CUPS. Let's start with the most basic + things first. @@ -71,11 +66,10 @@ and IETF (Internet Engineering Task Force) standard for network printing. Many of its functions can be managed remotely (or locally) via a web browser (giving you a - platform-independent access to the CUPS print server). In addition it - has the traditional commandline and several more modern GUI interfaces + platform-independent access to the CUPS print server). Additionally, it + has the traditional command line and several more modern GUI interfaces (GUI interfaces developed by 3rd parties, like KDE's - overwhelming KDEPrint). + overwhelming KDEPrint).     @@ -95,31 +89,24 @@ Basic Configuration of CUPS support - Printing with CUPS in the most basic smb.conf - setup in Samba 3.0 (as was true for 2.2.x) only needs two - settings: printing = cups and printcap - = cups. CUPS itself doesn't need a printcap file - anymore. However, the cupsd.conf configuration - file knows two related directives: they control if such a file should - be automatically created and maintained by CUPS for the convenience of - third party applications (example: Printcap - /etc/printcap and PrintcapFormat - BSD). These legacy programs often require the existence of - printcap file containing printernames or they will refuse to - print. Make sure CUPS is set to generate and maintain a printcap! For - details see man cupsd.conf and other CUPS-related - documentation, like the wealth of documents on your CUPS server - itself: http://localhost:631/documentation.html. + Printing with CUPS in the most basic &smb.conf; setup in Samba 3.0 (as was true for 2.2.x) only needs two + settings: printingcups and + printcapcups. CUPS does not need a printcap file. + However, the cupsd.conf configuration file knows of two related directives that control + how such a file will be automatically created and maintained by CUPS for the convenience of third party + applications (example: Printcap /etc/printcap and PrintcapFormat BSD). + Legacy programs often require the existence of a printcap file containing printer names or they will refuse to + print. Make sure CUPS is set to generate and maintain a printcap file! For details see + man cupsd.conf and other CUPS-related documentation, like the wealth of documents on your CUPS server + itself: http://localhost:631/documentation.html. Linking of smbd with libcups.so - Samba has a very special relationship to CUPS. The reason is: Samba - can be compiled with CUPS library support. Most recent installations - have this support enabled, and per default CUPS linking is compiled + Samba has a very special relationship to CUPS. Samba can be compiled with CUPS library support. + Most recent installations have this support enabled. Per default CUPS linking is compiled into smbd and other Samba binaries. Of course, you can use CUPS even if Samba is not linked against libcups.so -- but there are some differences in required or supported configuration @@ -127,69 +114,65 @@ - If SAMBA is compiled against libcups, then printcap = - cups uses the CUPS API to list printers, submit jobs, - query queues, etc. Otherwise it maps to the System V commands with an - additional -oraw option for printing. On a Linux - system, you can use the ldd utility to find out - details (ldd may not be present on other OS platforms, or its function - may be embodied by a different command): + When Samba is compiled against libcups, printcapcups + uses the CUPS API to list printers, submit jobs, query queues, etc. Otherwise it maps to the System V + commands with an additional -oraw option for printing. On a Linux + system, you can use the ldd utility to find out details (ldd may not be present on + other OS platforms, or its function may be embodied by a different command): - - transmeta:/home/kurt # ldd `which smbd` - libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000) - libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000) - libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) - [....] - + +&rootprompt;ldd `which smbd` +libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000) +libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000) +libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) +[....] + - The line libcups.so.2 => /usr/lib/libcups.so.2 - (0x40123000) shows there is CUPS support compiled - into this version of Samba. If this is the case, and printing = cups - is set, then any otherwise manually set print command in - smb.conf is ignored. This is an - important point to remember! + The line libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) shows + there is CUPS support compiled into this version of Samba. If this is the case, and printing = cups + is set, then any otherwise manually set print command in &smb.conf; is ignored. + This is an important point to remember! - Should you require -- for any reason -- to set your own - print commands, you can still do this by setting printing = - sysv. However, you'll loose all the benefits from the - close CUPS/Samba integration. You are on your own then to manually - configure the rest of the printing system commands (most important: - print command; other commands are - lppause command, lpresume command, lpq command, lprm - command, queuepause command and queue resume - command). + Should it be necessary, for any reason, to set your own print commands, you can do this by setting + printingsysv. However, you will loose all the benefits + of tight CUPS/Samba integration. When you do this you must manually configure the printing system commands + (most important: print command; other commands are + lppause command, + lpresume command, + lpq command, + lprm command, + queuepause command and + queue resume command). - Simple <filename>smb.conf</filename> Settings for CUPS + Simple &smb.conf; Settings for CUPS - To summarize, here is the simplest printing-related setup - for smb.conf to enable basic CUPS support: + To summarize, here is the simplest printing-related setup for &smb.conf; to enable basic CUPS support: - - - [global] - load printers = yes - printing = cups - printcap name = cups - - [printers] - comment = All Printers - path = /var/spool/samba - browseable = no - public = yes - guest ok = yes - writable = no - printable = yes - printer admin = root, @ntadmins - - + + Simplest printing-related smb.conf + [global] + load printersyes + printingcups + printcap namecups + + [printers] + commentAll Printers + path/var/spool/samba + browseableno + publicyes + guest okyes + writableno + printableyes + printer adminroot, @ntadmins + + This is all you need for basic printing setup for CUPS. It will print @@ -210,63 +193,57 @@ -More complex <filename>smb.conf</filename> Settings for +<title>More complex &smb.conf; Settings for CUPS Here is a slightly more complex printing-related setup -for smb.conf. It enables general CUPS printing +for &smb.conf;. It enables general CUPS printing support for all printers, but defines one printer share which is set up differently. - -> /tmp/smbprn.log ;\ - echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ;\ - echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log :\ - rm %f - public = no - guest ok = no - writeable = no - printable = yes - printer admin = kurt - hosts deny = 0.0.0.0 - hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60 -]]> - - - -This special share is only there for my testing purposes. It doesn't -even write the print job to a file. It just logs the job parameters -known to Samba into the /tmp/smbprn.log file and -deletes the jobfile. Moreover, the printer -admin of this share is "kurt" (not the "@ntadmins" group); -guest access is not allowed; the share isn't announced in Network -Neighbourhood (so you need to know it is there), and it is only -allowing access from three hosts. To prevent CUPS kicking in and -taking over the print jobs for that share, we need to set -printing = sysv and printcap = -lpstat. + +Overriding global CUPS settings for one printer +[global] +printingcups +printcap namecups +load printersyes + +[printers] +commentAll Printers +path/var/spool/samba +publicyes +guest okyes +writableno +printableyes +printer adminroot, @ntadmins + +[special_printer] +commentA special printer with his own settings +path/var/spool/samba-special +printingsysv +printcaplpstat +print commandecho "NEW: `date`: printfile %f" >> /tmp/smbprn.log ; \ +echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; \ +echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log : rm %f +publicno +guest okno +writeableno +printableyes +printer adminkurt +hosts deny0.0.0.0 +hosts allowturbo_xp, 10.160.50.23, 10.160.51.60 + + + +This special share is only there for testing purposes. It does not write the print job to a file. It just logs the job parameters +known to Samba into the /tmp/smbprn.log file and deletes the jobfile. Moreover, the +printer admin of this share is "kurt" (not the "@ntadmins" group); +guest access is not allowed; the share isn not published to the Network Neighbourhood (so you need to know it is there), and it only +allows access from only three hosts. To prevent CUPS kicking in and taking over the print jobs for that share, we need to set +printingsysv and +printcaplpstat.     @@ -275,20 +252,23 @@ lpstat. Advanced Configuration -Before we dive into all the configuration options, let's clarify a few +Before we delve into all the configuration options, let us clarify a few points. Network printing needs to be organized and setup correctly. Often this is not done correctly. Legacy systems -or small LANs in business environments often lack a clear design and -good housekeeping. +or small business LAN environments often lack design and good housekeeping. + Central spooling vs. "Peer-to-Peer" printing +spoolingcentral +spoolingpeer-to-peer + Many small office or home networks, as well as badly organized larger environments, allow each client a direct access to available network -printers. Generally, this is a bad idea. It often blocks one client's +printers. This is generally a bad idea. It often blocks one client's access to the printer when another client's job is printing. It also might freeze the first client's application while it is waiting to get rid of the job. Also, there are frequent complaints about various jobs @@ -304,19 +284,22 @@ printer(s) in the correct order. CUPS/Samba as a "spooling-only" Print Server; "raw" printing with Vendor Drivers on Windows Clients +spooling-only +"raw" printing + -Most traditionally configured Unix print servers acting on behalf of +Most traditionally configured UNIX print servers acting on behalf of Samba's Windows clients represented a really simple setup. Their only task was to manage the "raw" spooling of all jobs handed to them by Samba. This approach meant that the Windows clients were expected to -prepare the print job file in such a way that it became fit to be fed to -the printing device. Here a native (vendor-supplied) Windows printer +prepare the print job file that it s ready to be sent to the printing +device. Here a native (vendor-supplied) Windows printer driver for the target device needed to be installed on each and every client. -Of course you can setup CUPS, Samba and your Windows clients in the +It is possible to configure CUPS, Samba and your Windows clients in the same, traditional and simple way. When CUPS printers are configured for RAW print-through mode operation it is the responsibility of the Samba client to fully render the print job (file). The file must be @@ -341,9 +324,12 @@ one by one; this yields the old LanMan style printing; it uses a \\sambaserver\printershare type of connection. -deposit and prepare the drivers (for later download) on + + +point and print + deposit and prepare the drivers (for later download) on the print server (Samba); this enables the clients to use -"Point'n'Print" to get drivers semi-automatically installed the +"Point and Print" to get drivers semi-automatically installed the first time they access the printer; with this method NT/2K/XP clients use the SPOOLSS/MS-RPC type printing calls. @@ -358,6 +344,8 @@ The second method is recommended for use over the first. Explicitly enable "raw" printing for <emphasis>application/octet-stream</emphasis>! +application/octet-stream + If you use the first option (drivers are installed on the client side), there is one setting to take care of: CUPS needs to be told @@ -381,9 +369,7 @@ present: - application/octet-stream - @@ -391,10 +377,10 @@ In /etc/cups/mime.convs, have this line: - +application/vnd.cups-raw + application/octet-stream application/vnd.cups-raw 0 - - @@ -411,6 +397,8 @@ convert file 0 in your CUPS error_log file. Background +application/octet-stream + CUPS being a more security-aware printing system than traditional ones does not by default allow a user to send deliberate (possibly binary) @@ -437,9 +425,11 @@ of this chapter. Three familiar Methods for driver upload plus a new one +point and print + If you want to use the MS-RPC type printing, you must upload the -drivers onto the Samba server first ([print$] +drivers onto the Samba server first ([print$] share). For a discussion on how to deposit printer drivers on the Samba host (so that the Windows clients can download and use them via "Point'n'Print") please also refer to the previous chapter of this @@ -447,6 +437,8 @@ HOWTO Collection. There you will find a description or reference to three methods of preparing the client drivers on the Samba server: +add printer wizard + the GUI, "Add Printer Wizard" upload-from-a-Windows-client @@ -456,16 +448,21 @@ method; upload-from-a-UNIX-workstation method; -the Imprints Toolset + + +imprints + the Imprints Toolset method. These 3 methods apply to CUPS all the same. A new and more convenient way to load the Windows drivers into Samba is provided -provided if you use CUPS: +if you use CUPS: +cupsaddsmb + the cupsaddsmb utility. @@ -483,8 +480,10 @@ UNIX printing architectures. Using CUPS/Samba in an advanced Way -- intelligent printing with PostScript Driver Download +PostScriptGhostscript + -Still reading on? Good. Let's go into more detail then. We now know +Are you still following this? Good. Let's go into more detail then. We now know how to set up a "dump" printserver, that is, a server which is spooling printjobs "raw", leaving the print data untouched. @@ -521,12 +520,15 @@ how CUPS works and how you can enable its features. What follows is the comparison of some fundamental concepts for -Windows and Unix printing; then is the time for a description of the +Windows and UNIX printing; then is the time for a description of the CUPS filtering system, how it works and how you can tweak it. - -GDI on Windows -- PostScript on Unix + +GDI on Windows -- PostScript on UNIX + +GDI +PostScript Network printing is one of the most complicated and error-prone @@ -534,6 +536,9 @@ day-to-day tasks any user or an administrator may encounter. This is true for all OS platforms. And there are reasons for this. +PCL +PDL + You can't expect for most file formats to just throw them towards printers and they get printed. There needs to be a file format @@ -552,6 +557,10 @@ interpreters, etc.). Windows Drivers, GDI and EMF +GDI +EMF +WYSIWYG + In Windows OS, the format conversion job is done by the printer drivers. On MS Windows OS platforms all application programmers have @@ -571,29 +580,30 @@ converted to the printer-specific file format. +PDF To the GDI foundation in MS Windows, Apple has chosen to put paper and screen output on a common foundation for their -(BSD-Unix-based, did you know??) Mac OS X and Darwin Operating -Systems.Their Core Graphic Engine uses a -PDF derivate for all display work. +(BSD-UNIX-based, did you know??) Mac OS X and Darwin Operating +Systems. Their Core Graphic Engine uses a +PDF derivative for all display work. -
    Windows Printing to a local Printer - - - - -
    +Windows Printing to a local Printer1small     -Unix Printfile Conversion and GUI Basics +UNIX Printfile Conversion and GUI Basics + +X Window System +PostScript +PCL +Xprint -In Unix and Linux, there is no comparable layer built into the OS +In UNIX and Linux, there is no comparable layer built into the OS kernel(s) or the X (screen display) server. Every application is responsible for itself to create its print output. Fortunately, most use PostScript. That gives at least some common ground. Unfortunately, @@ -617,6 +627,8 @@ to be used on paper. Background +PostScript + The PostScript programming language is an "invention" by Adobe Inc., but its specifications have been published to the full. Its strength @@ -637,12 +649,16 @@ program or on paper by a printer. - + PostScript and Ghostscript +PostScript +GhostScriptPostScript +PostScriptRIP + -So, Unix is lacking a common ground for printing on paper and -displaying on screen. Despite this unfavorable legacy for Unix, basic +So, UNIX is lacking a common ground for printing on paper and +displaying on screen. Despite this unfavorable legacy for UNIX, basic printing is fairly easy: if you have PostScript printers at your disposal! The reason is: these devices have a built-in PostScript language "interpreter", also called a Raster Image @@ -654,30 +670,30 @@ you see it on paper, in a resolution as done by your printer. This is no different to PostScript printing of a file from a Windows origin. -Traditional Unix programs and printing systems -- while + +PPD +Traditional UNIX programs and printing systems -- while using PostScript -- are largely not PPD-aware. PPDs are "PostScript Printer Description" files. They enable you to specify and control all options a printer supports: duplexing, stapling, punching... Therefore -Unix users for a long time couldn't choose many of the supported +UNIX users for a long time couldn't choose many of the supported device and job options, unlike Windows or Apple users. But now there -is CUPS.... ;-) +is CUPS.... -
    Printing to a Postscript Printer - - - - -
    + Printing to a Postscript Printer + 2small     +PDL + However, there are other types of printers out there. These don't know how to print PostScript. They use their own Page Description Language (PDL, often proprietary). To print to them is much -more demanding. Since your Unix applications mostly produce +more demanding. Since your UNIX applications mostly produce PostScript, and since these devices don't understand PostScript, you need to convert the printfiles to a format suitable for your printer on the host, before you can send it away. @@ -687,10 +703,12 @@ on the host, before you can send it away. Ghostscript -- the Software RIP for non-PostScript Printers +GhostScript + Here is where Ghostscript kicks in. Ghostscript is the traditional (and quite powerful) PostScript interpreter used on -Unix platforms. It is a RIP in software, capable to do a +UNIX platforms. It is a RIP in software, capable to do a lot of file format conversions, for a very broad spectrum of hardware devices as well as software file formats. Ghostscript technology and drivers is what enables PostScript printing @@ -698,12 +716,9 @@ to non-PostScript hardware. -
    Ghostscript as a RIP for non-postscript printers - - - - -
    + Ghostscript as a RIP for non-postscript printers + 3small +     @@ -718,7 +733,7 @@ intervals, now by artofcode LLC. They are initially put under the "AFPL" license, but re-released under the GNU GPL as soon as the next AFPL version appears. GNU Ghostscript is probably the version installed on most Samba systems. But it has got some -deficiencies. Therefore ESP Ghostscript was developed as an +deficiencies. GhostscriptESPESP GhostScriptTherefore ESP Ghostscript was developed as an enhancement over GNU Ghostscript, with lots of bug-fixes, additional devices and improvements. It is jointly maintained by developers from CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat and Debian. It includes @@ -729,6 +744,8 @@ the "cups" device (essential to print to non-PS printers from CUPS). PostScript Printer Description (PPD) Specification +PPD + While PostScript in essence is a Page Description Language (PDL) to represent the page layout in a @@ -761,6 +778,7 @@ file created by the driver. +PDF A PostScript file that was created to contain device-specific commands for achieving a certain print job output (e.g. duplexed, stapled and punched) on a specific target machine, may not print as expected, or @@ -775,7 +793,7 @@ for further processing by software (e.g. by a PDF distilling program). CUPS can handle all spec-compliant PPDs as supplied by the manufacturers for their PostScript models. Even if a -Unix/Linux-illiterate vendor might not have mentioned our favorite +UNIX/Linux-illiterate vendor might not have mentioned our favorite OS in his manuals and brochures -- you can safely trust this: if you get hold of the Windows NT version of the PPD, you can use it unchanged in CUPS and thus access the full @@ -784,7 +802,7 @@ power of your printer just like a Windows NT user could! To check the spec compliance of any PPD online, go to http://www.cups.org/testppd.php +noescape="1" url="http://www.cups.org/testppd.php">http://www.cups.org/testppd.php and upload your PPD. You will see the results displayed immediately. CUPS in all versions after 1.1.19 has a much more strict internal PPD parsing and checking code enabled; in case of printing @@ -792,6 +810,8 @@ trouble this online resource should be one of your first pitstops. +foomatic +cupsomatic For real PostScript printers don't use the Foomatic or cupsomatic PPDs from Linuxprinting.org. With these devices the original @@ -863,7 +883,7 @@ Make sure your Ghostscript version has the "cups" device compiled in may encounter the dreaded Unable to convert file 0 in your CUPS error_log file. To have "cups" as a device in your Ghostscript, you either need to patch GNU -Ghostscript and re-compile or use and re-compile or use ESPGhostscriptESP Ghostscript. The superior alternative is ESP Ghostscript: it supports not just CUPS, but 300 other devices too (while GNU Ghostscript supports only about @@ -873,6 +893,8 @@ Linuxprinting.org for all spoolers. +cupsomatic +foomatic CUPS printers may be setup to use external rendering paths. One of the most common ones is provided by the Foomatic/cupsomatic concept, from Linuxprinting.org. This uses the classical Ghostscript approach, doing everything in one step. It doesn't use the "cups" device, but one of the many others. However, even for Foomatic/cupsomatic usage, best results and +ESPGhostscript broadest printer model support is provided by ESP Ghostscript (more about cupsomatic/Foomatic, particularly the new version called now foomatic-rip, follows below). @@ -889,6 +912,7 @@ about cupsomatic/Foomatic, particularly the new version called now MIME types and CUPS Filters + MIME CUPS reads the file /etc/cups/mime.types (and all other files carrying a *.types suffix in the same directory) upon startup. These files contain the MIME @@ -899,10 +923,10 @@ for mime.types and in the comments section of the like this: - - + +application/pdf + application/pdf pdf string(0,%PDF) - @@ -915,9 +939,7 @@ Another rule is this: - application/postscript ai eps ps string(0,%!) string(0,<04>%!) - @@ -961,6 +983,8 @@ with its filters. MIME type Conversion Rules +MIME + CUPS reads the file /etc/cups/mime.convs (and all other files named with a *.convs @@ -972,9 +996,7 @@ reads like this: - application/pdf application/postscript 33 pdftops - @@ -985,10 +1007,10 @@ cost of this operation is 33 CUPS-$. The next filter is more expensive, costing 66 CUPS-$: - +pdf + application/vnd.hp-HPGL application/postscript 66 hpgltops - @@ -996,21 +1018,21 @@ This is the hpgltops, which processes HP-GL plotter files to PostScript. - +application/octet-stream + application/octet-stream - Here are two more examples: - +text/plain + application/x-shell application/postscript 33 texttops text/plain application/postscript 33 texttops - @@ -1024,6 +1046,8 @@ this differentiation is needed for the syntax highlighting feature of Filter Requirements +MIME + There are many more combinations named in mime.convs. However, you are not limited to use the ones pre-defined there. You can plug in any @@ -1053,25 +1077,25 @@ name of the filter being run)     printed     -Printer +user The string from the originating-user-name attribute -Printer +title The string from the job-name attribute -Printer +copies The numeric value from the number-copies attribute -Printer +options The job options -Printer +filename (Optionally) The print request file (if missing, filters expected data fed through stdin). In most cases it is very easy to write a simple wrapper script around existing @@ -1084,8 +1108,10 @@ filters to make them work with CUPS. Prefilters +PostScript + -As was said, PostScript is the central file format to any Unix based +As was said, PostScript is the central file format to any UNIX based printing system. From PostScript, CUPS generates raster data to feed non-PostScript printers. @@ -1106,12 +1132,9 @@ print options already embedded into the file.     -
    Prefiltering in CUPS to form Postscript - - - - -
    + Prefiltering in CUPS to form Postscript + 4small +     @@ -1128,12 +1151,9 @@ stapling an punching it, etc.) into the PostScript file. -
    Adding Device-specific Print Options - - - - -
    + Adding Device-specific Print Options + 5small +     @@ -1172,12 +1192,7 @@ that are able to generate device-specific printer data. -
    Postscript to intermediate Raster format - - - - -
    + Postscript to intermediate Raster format6small     @@ -1186,7 +1201,7 @@ able to include per-page information, color profiles and more to be used by the following downstream raster drivers. Its MIME type is registered with IANA and its specification is of course completely open. It is designed to make it very easy and inexpensive for -manufacturers to develop Linux and Unix raster drivers for their +manufacturers to develop Linux and UNIX raster drivers for their printer models, should they choose to do so. CUPS always takes care for the first stage of rasterization so these vendors don't need to care about Ghostscript complications (in fact, there is currently more @@ -1194,12 +1209,9 @@ than one vendor financing the development of CUPS raster drivers). -
    CUPS-raster production using Ghostscript - - - - -
    + CUPS-raster production using Ghostscript + 7small +     @@ -1233,12 +1245,9 @@ filtering: -
    Image format to CUPS-raster format conversion - - - - -
    + Image format to CUPS-raster format conversion + 8small +     @@ -1249,9 +1258,9 @@ filtering: CUPS ships with quite some different raster drivers processing CUPS raster. On my system I find in /usr/lib/cups/filter/ these: -rastertoalps, rastertobj, rastertoepson, rastertoescp, -rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo, -rastertoescp, rastertohp and +rastertoalps, rastertobj, rastertoepson, rastertoescp, +rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo, +rastertoescp, rastertohp and rastertoprinter. Don't worry if you have less than this; some of these are installed by commercial add-ons to CUPS (like rastertoturboprint), others (like @@ -1261,12 +1270,9 @@ closely as possible with CUPS. -
    Raster to Printer Specific formats - - - - -
    + Raster to Printer Specific formats + 9small +     @@ -1356,7 +1362,7 @@ This backend sends printfiles to printers shared by a Windows host. An example for CUPS device-URIs to use are: smb://workgroup/server/printersharename Or -Smb://server/printersharename +smb://server/printersharename or smb://username:password@workgroup/server/printersharename or @@ -1387,20 +1393,21 @@ printername). Not all of the mentioned backends may be present on your system or usable (depending on your hardware configuration). One test for all available CUPS backends is provided by the lpinfo -utility. Used with the -v parameter, it lists +utility. Used with the parameter, it lists all available backends: - - lpinfo -v - +&prompt;lpinfo -v cupsomatic/Foomatic -- how do they fit into the Picture? +cupsomatic +foomatic + "cupsomatic" filters may be the most widely used on CUPS installations. You must be clear about the fact that these were not @@ -1419,9 +1426,7 @@ You can recognize these PPDs from the line calling the - *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic" - @@ -1434,6 +1439,8 @@ auto-constructed from the selected PPD and commandline options give to the printjob. +point and print + However, cupsomatic is now deprecated. Its PPDs (especially the first generation of them, still in heavy use out there) are not meeting the @@ -1515,9 +1522,7 @@ associating any PPD with it. This command: - - lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E - +&prompt;lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E @@ -1550,9 +1555,7 @@ message in your CUPS logs like: - Unable to convert file 0 to printable format for job - @@ -1573,10 +1576,10 @@ application/octet-stream. In /etc/cups/mime.types make sure this line is present: - +application/octet-stream + application/octet-stream - @@ -1587,11 +1590,11 @@ line: - application/octet-stream application/vnd.cups-raw 0 - - +MIME + This line tells CUPS to use the Null Filter (denoted as "-", doing... nothing at all) on @@ -1631,6 +1634,8 @@ conversion filter(s) may be applied to which MIME types. PostScript Printer Descriptions (PPDs) for non-PS Printers +PPD + Originally PPDs were meant to be used for PostScript printers only. Here, they help to send device-specific commands and settings @@ -1648,10 +1653,10 @@ PPDs for a non-PS printer have a few lines that are unique to CUPS. The most important one looks similar to this: - +application/vnd.cups-raster + *cupsFilter: application/vnd.cups-raster 66 rastertoprinter - @@ -1673,74 +1678,50 @@ different paper trays, or you may get larger margins than your specific model supports): - -deskjet.ppd -older HP inkjet printers and compatible - - +
    + PPD's shipped with CUPS + + + + PPD filePrinter type + + deskjet.ppdolder HP inkjet printers and compatible -deskjet2.ppd -newer HP inkjet printers and compatible - - + deskjet2.ppd newer HP inkjet printers and compatible -dymo.ppd -label printers - - + dymo.ppd label printers -epson9.ppd -Epson 24pin impact printers and compatible - - + epson9.ppd Epson 24pin impact printers and compatible -epson24.ppd -Epson 24pin impact printers and compatible - - + epson24.ppd Epson 24pin impact printers and compatible -okidata9.ppd -Okidata 9pin impact printers and compatible - - + okidata9.ppd Okidata 9pin impact printers and compatible -okidat24.ppd -Okidata 24pin impact printers and compatible - - + okidat24.ppd Okidata 24pin impact printers and compatible -stcolor.ppd -older Epson Stylus Color printers - - + stcolor.ppd older Epson Stylus Color printers -stcolor2.ppd -newer Epson Stylus Color printers - - + stcolor2.ppd newer Epson Stylus Color printers -stphoto.ppd -older Epson Stylus Photo printers - - + stphoto.ppd older Epson Stylus Photo printers -stphoto2.ppd -newer Epson Stylus Photo printers - - + stphoto2.ppd newer Epson Stylus Photo printers + + laserjet.ppd all PCL printers. Further below is a discussion of several other driver/PPD-packages suitable for use with CUPS. + + + +
    -laserjet.ppd -all PCL printers. Further below is a discussion -of several other driver/PPD-packages suitable fur use with CUPS. - - - Difference between <emphasis>cupsomatic/foomatic-rip</emphasis> and <emphasis>native CUPS</emphasis> printing +cupsomatic +foomatic-rip + Native CUPS rasterization works in two steps. @@ -1748,6 +1729,7 @@ Native CUPS rasterization works in two steps. First is the "pstoraster" step. It uses the special "cups" +ESPGhostscript device from ESP Ghostscript 7.05.x as its tool @@ -1764,12 +1746,9 @@ advantages) than other methods.     -
    cupsomatic/foomatic processing versus Native CUPS - - - - -
    + cupsomatic/foomatic processing versus Native CUPS + 10small +     @@ -1777,7 +1756,7 @@ One other method is the cupsomatic/foomatic-rip way. Note that cupsomatic is not made by the CUPS developers. It is an independent contribution to printing development, made by people from Linuxprinting.org (see also http://www.cups.org/cups-help.html). + noescape="1" url="http://www.cups.org/cups-help.html">http://www.cups.org/cups-help.html). cupsomatic is no longer developed and maintained and is no longer supported. It has now been replaced by foomatic-rip. foomatic-rip is a complete re-write @@ -1788,6 +1767,8 @@ too. + cupsomatic + foomatic Both the cupsomatic (old) and the foomatic-rip (new) methods from Linuxprinting.org use the traditional Ghostscript print file processing, doing everything in a single step. It therefore relies on @@ -1855,12 +1836,10 @@ backend, which transfers the job to the printers.     -The resulting filter chain therefore is: + The resulting filter chain therefore is as drawn in the image below. - -pdftops --> pstops --> socket - +pdftosocketPDF to socket chain Assume your want to print the same filter to an USB-connected @@ -1904,12 +1883,10 @@ which transfers the job to the printers.     -The resulting filter chain therefore is: + The resulting filter chain therefore is as drawn in the image below. - -pdftops --> pstops --> pstoraster --> rastertoepson --> usb - +pdftoepsonusbPDF to USB chain @@ -1922,44 +1899,46 @@ supporting more than 1000 non-PostScript models. +ESPPrint Pro +PrintProESP Print Pro ESP -PrintPro (http://wwwl.easysw.com/printpro/) (commercial, +PrintPro (commercial, non-Free) is packaged with more than 3000 PPDs, ready for successful use "out of the box" on Linux, Mac OS X, IBM-AIX, -HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital Unix and some +HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital UNIX and some more commercial Unices (it is written by the CUPS developers themselves and its sales help finance the further development of CUPS, as they feed their creators). the Gimp-Print-Project -(http://gimp-print.sourceforge.net/) (GPL, Free Software) + (GPL, Free Software) provides around 140 PPDs (supporting nearly 400 printers, many driven to photo quality output), to be used alongside the Gimp-Print CUPS filters; TurboPrint -(http://www.turboprint.com/) (Shareware, non-Free) supports + (Shareware, non-Free) supports roughly the same amount of printers in excellent quality; OMNI -(http://www-124.ibm.com/developerworks/oss/linux/projects/omni/) + (LPGL, Free) is a package made by IBM, now containing support for more than 400 printers, stemming from the inheritance of IBM OS/2 Know-How ported over to Linux (CUPS support is in a Beta-stage at present); HPIJS -(http://hpinkjet.sourceforge.net/) (BSD-style licenses, Free) + (BSD-style licenses, Free) supports around 150 of HP's own printers and is also providing excellent print quality now (currently available only via the Foomatic path); Foomatic/cupsomatic -(http://www.linuxprinting.org/) (LPGL, Free) from + (LPGL, Free) from Linuxprinting.org are providing PPDs for practically every Ghostscript filter known to the world (including Omni, Gimp-Print and HPIJS). @@ -1990,9 +1969,8 @@ the -i option: - - lpadmin -p pclprinter -v socket://11.12.13.14:9100 -i /path/to/interface-script - +&rootprompt;lpadmin -p pclprinter -v socket://11.12.13.14:9100 \ + -i /path/to/interface-script @@ -2001,7 +1979,7 @@ with CUPS they provide the most easy way to plug in your own custom-written filtering script or program into one specific print queue (some information about the traditional usage of interface scripts is to be found at http://playground.sun.com/printing/documentation/interface.html). + noescape="1" url="http://playground.sun.com/printing/documentation/interface.html">http://playground.sun.com/printing/documentation/interface.html). @@ -2024,6 +2002,9 @@ Windows clients printing to an NT-based print server have two options. They may +GDI +EMF + execute the driver locally and render the GDI output (EMF) into the printer specific format on their own, @@ -2045,45 +2026,45 @@ Both print paths are shown in the flowcharts below. In the first case the print server must spool the file as "raw", meaning it shouldn't touch the jobfile and try to convert it in any -way. This is what traditional Unix-based print server can do too; and +way. This is what traditional UNIX-based print server can do too; and at a better performance and more reliably than NT print server. This is what most Samba administrators probably are familiar with. One advantage of this setup is that this "spooling-only" print server may -be used even if no driver(s) for Unix are available it is sufficient +be used even if no driver(s) for UNIX are available it is sufficient to have the Windows client drivers available and installed on the clients. -
    Print Driver execution on the Client - - - - -
    + Print Driver execution on the Client + 11small +     Driver Execution on the Server +PostScript +PCL +ESC/P +EMF +GDI + The other path executes the printer driver on the server. The clients transfers print files in EMF format to the server. The server uses the PostScript, PCL, ESC/P or other driver to convert the EMF file into -the printer-specific language. It is not possible for Unix to do the +the printer-specific language. It is not possible for UNIX to do the same. Currently there is no program or method to convert a Windows -client's GDI output on a Unix server into something a printer could +client's GDI output on a UNIX server into something a printer could understand. -
    Print Driver execution on the Server - - - - -
    + Print Driver execution on the Server + 12small +     @@ -2130,20 +2111,19 @@ printer is a non-PostScript model. It also requires that you have a Firstly, to enable CUPS based printing through Samba the -following options should be set in your smb.conf file [globals] +following options should be set in your &smb.conf; file [global] section: -printing = CUPS +printingcups -printcap = CUPS +printcapcups When these parameters are specified, all manually set print directives -(like print command =..., or lppause -command =...) in smb.conf (as well as +(like print command, or lppause command) in &smb.conf; (as well as in samba itself) will be ignored. Instead, Samba will directly interface with CUPS through it's application program interface (API) - as long as Samba has been compiled with CUPS library (libcups) @@ -2152,16 +2132,13 @@ other print commands are set up, then printing will use the System V AT&T command set, with the -oraw option automatically passing through (if you want your own defined print commands to work with a Samba that has CUPS support compiled in, -simply use printing = sysv). +simply use printingsysv). -
    Printing via CUPS/samba server - - - - -
    +Printing via CUPS/samba server + 13small +     @@ -2170,10 +2147,10 @@ simply use printing = sysv). Samba must use its own spool directory (it is set -by a line similar to path = /var/spool/samba, -in the [printers] or -[printername] section of -smb.conf). Samba receives the job in its own +by a line similar to path/var/spool/samba, +in the [printers] or +[printername] section of +&smb.conf;). Samba receives the job in its own spool space and passes it into the spool directory of CUPS (the CUPS spooling directory is set by the RequestRoot directive, in a line that defaults to RequestRoot @@ -2196,6 +2173,10 @@ need to make sure the Samba host gets access to printing on CUPS. Network PostScript RIP: CUPS Filters on Server -- clients use PostScript Driver with CUPS-PPDs +PostScript +PCL +PJL + PPDs can control all print device options. They are usually provided by the manufacturer; if you own a PostScript printer, that is. PPD @@ -2211,7 +2192,7 @@ printer. Printer driver GUI dialogs translate these options CUPS can load, without any conversions, the PPD file from any Windows (NT is recommended) PostScript driver and handle the options. There is a web browser interface to the print options (select http://localhost:631/printers/ +noescape="1" url="http://localhost:631/printers/">http://localhost:631/printers/ and click on one Configure Printer button to see it), or a commandline interface (see man lpoptions or see if you have lphelp on your system). There are also some @@ -2223,6 +2204,8 @@ PostScript RIP on the real PostScript printer. PPDs for non-PS Printers on UNIX +PPD + CUPS doesn't limit itself to "real" PostScript printers in its usage of PPDs. The CUPS developers have extended the scope of the PPD @@ -2248,6 +2231,7 @@ proper raster print format. PPDs for non-PS Printers on Windows +PPD CUPS-PPDs can also be used on Windows-Clients, on top of a "core" PostScript driver (now recommended is the "CUPS PostScript @@ -2309,7 +2293,7 @@ of Death" on a regular basis? PostScript drivers generally are very well tested. They are not known to cause any problems, even though they run in Kernel Mode too. This might be because there have so far only been 2 different PostScript -drivers the ones from Adobe and the one from Microsoft. Both are +drivers: the ones from Adobe and the one from Microsoft. Both are very well tested and are as stable as you ever can imagine on Windows. The CUPS driver is derived from the Microsoft one. @@ -2332,6 +2316,9 @@ better, if driven by a different driver! ) CUPS: a "Magical Stone"? +PPD +PostScript + Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very elegant way to overcome all these shortcomings. There are, depending @@ -2351,6 +2338,7 @@ although the first feedbacks look very promising. PostScript Drivers with no major problems -- even in Kernel Mode +DDK More recent printer drivers on W2K and XP don't run in Kernel mode (unlike Win NT) any more. However, both operating systems can still @@ -2372,7 +2360,7 @@ owner of an "MS DDK for Win NT", you can check the driver yourself. - Setting up CUPS for driver Download +Setting up CUPS for driver Download As we have said before: all previously known methods to prepare client @@ -2386,10 +2374,12 @@ relationship. <emphasis>cupsaddsmb</emphasis>: the unknown Utility +cupsaddsmb + The cupsaddsmb utility (shipped with all current CUPS versions) is an alternative method to transfer printer drivers into the Samba -[print$] share. Remember, this share is where +[print$] share. Remember, this share is where clients expect drivers deposited and setup for download and installation. It makes the sharing of any (or all) installed CUPS printers very easy. cupsaddsmb can use the Adobe PostScript driver as @@ -2427,68 +2417,66 @@ too if you need to support Windows 95, 98, and ME clients. -Prepare your <filename>smb.conf</filename> for -cupsaddsmb +Prepare your &smb.conf; for cupsaddsmb Prior to running cupsaddsmb, you need the following settings in -smb.conf: - - - - - [global] - load printers = yes - printing = cups - printcap name = cups - - [printers] - comment = All Printers - path = /var/spool/samba - browseable = no - public = yes - guest ok = yes # setting depends on your requirements - writable = no - printable = yes - printer admin = root - - [print$] - comment = Printer Drivers - path = /etc/samba/drivers - browseable = yes - guest ok = no - read only = yes - write list = root - - +&smb.conf;: + + + + smb.conf for cupsaddsmb usage +[global] +load printersyes +printingcups +printcap namecups + +[printers] +commentAll Printers +path/var/spool/samba +browseableno +publicyes +setting depends on your requirements +guest okyes +writableno +printableyes +printer adminroot + [print$] +commentPrinter Drivers +path/etc/samba/drivers +browseableyes +guest okno +read onlyyes +write listroot + CUPS Package of "PostScript Driver for WinNT/2k/XP" +PostScript -CUPS users may get the exactly same packages fromhttp://www.cups.org/software.html. +CUPS users may get the exactly same packages from http://www.cups.org/software.html. It is a separate package from the CUPS base software files, tagged as -CUPS 1.1.x Windows NT/2k/XP Printer Driver for SAMBA +CUPS 1.1.x Windows NT/2k/XP Printer Driver for Samba (tar.gz, 192k). The filename to download is cups-samba-1.1.x.tar.gz. Upon untar-/unzip-ing, it will reveal these files: - -# tar xvzf cups-samba-1.1.19.tar.gz - - cups-samba.install - cups-samba.license - cups-samba.readme - cups-samba.remove - cups-samba.ss - +&rootprompt;tar xvzf cups-samba-1.1.19.tar.gz +cups-samba.install +cups-samba.license +cups-samba.readme +cups-samba.remove +cups-samba.ss +ESPmeta packager +EPMESP meta packager These have been packaged with the ESP meta packager software "EPM". The *.install and *.remove files are simple shell scripts, which @@ -2500,13 +2488,10 @@ files: - -# tar tv cups-samba.ss - - cupsdrvr.dll - cupsui.dll - cups.hlp - +&rootprompt;tar tv cups-samba.ss +cupsdrvr.dll +cupsui.dll +cups.hlp @@ -2515,15 +2500,12 @@ handle: - -# ./cups-samba.install - - [....] - Installing software... - Updating file permissions... - Running post-install commands... - Installation is complete. - +&rootprompt;./cups-samba.install +[....] +Installing software... +Updating file permissions... +Running post-install commands... +Installation is complete. @@ -2542,11 +2524,11 @@ right place. - - cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/ - +&rootprompt;cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/ +DDK + This new CUPS PostScript driver is currently binary-only, but free of charge. No complete source code is provided (yet). The reason is this: @@ -2567,14 +2549,15 @@ The CUPS drivers don't support the "older" Windows 95/98/ME, but only the Windows NT/2000/XP client: - +Windows NT, 2000, and XP are supported by: - [Windows NT, 2000, and XP are supported by:] - cups.hlp - cupsdrvr.dll - cupsui.dll - - + + + cups.hlp + cupsdrvr.dll + cupsui.dll + + Adobe drivers are available for the older Windows 95/98/ME as well as @@ -2582,22 +2565,29 @@ the Windows NT/2000/XP clients. The set of files is different for the different platforms. - +Windows 95, 98, and Me are supported by: - [Windows 95, 98, and Me are supported by:] - ADFONTS.MFM - ADOBEPS4.DRV - ADOBEPS4.HLP - DEFPRTR2.PPD - ICONLIB.DLL - PSMON.DLL + + + ADFONTS.MFM + ADOBEPS4.DRV + ADOBEPS4.HLP + DEFPRTR2.PPD + ICONLIB.DLL + PSMON.DLL + + - [Windows NT, 2000, and XP are supported by:] - ADOBEPS5.DLL - ADOBEPSU.DLL - ADOBEPSU.HLP +Windows NT, 2000, and XP are supported by: - + + + ADOBEPS5.DLL + ADOBEPSU.DLL + ADOBEPSU.HLP + + + If both, the Adobe driver files and the CUPS driver files for the @@ -2620,7 +2610,7 @@ native installer and run the installation process on one client once. This will install the drivers (and one Generic PostScript printer) locally on the client. When they are installed, share the Generic PostScript printer. After this, the client's -[print$] share holds the Adobe files, from +[print$] share holds the Adobe files, from where you can get them with smbclient from the CUPS host. A more detailed description about this is in the next (the CUPS printing) chapter. @@ -2631,19 +2621,22 @@ chapter. ESP Print Pro Package of "PostScript Driver for WinNT/2k/XP" + +ESPPrint Pro + Users of the ESP Print Pro software are able to install their "Samba Drivers" package for this purpose with no problem. Retrieve the driver files from the normal download area of the ESP Print Pro software -athttp://www.easysw.com/software.html. +at http://www.easysw.com/software.html. You need to locate the link labelled "SAMBA" amongst the Download Printer Drivers for ESP Print Pro 4.x area and download the package. Once installed, you can prepare any driver by simply highlighting the printer in the Printer Manager GUI and select Export Driver... from the menu. Of course you need to have prepared Samba beforehand too to handle the -driver files; i.e. mainly setup the [print$] +driver files; i.e. mainly setup the [print$] share, etc. The ESP Print Pro package includes the CUPS driver files as well as a (licensed) set of Adobe drivers for the Windows 95/98/ME client family. @@ -2653,11 +2646,13 @@ client family. Caveats to be considered +cupsaddsmb + Once you have run the install script (and possibly manually moved the cups.hlp file to /usr/share/cups/drivers/), the driver is -ready to be put into Samba's [print$] share (which often maps to +ready to be put into Samba's [print$] share (which often maps to /etc/samba/drivers/ and contains a subdir tree with WIN40 and W32X86 branches): You do this by running @@ -2666,6 +2661,7 @@ CUPS since release 1.1.16). +Single Sign On You may need to put root into the smbpasswd file by running smbpasswd; this is especially important if you should run this whole procedure for the first time, and are not @@ -2674,7 +2670,7 @@ working in an environment where everything is configured for -Once the driver files are in the [print$] share +Once the driver files are in the [print$] share and are initialized, they are ready to be downloaded and installed by the Win NT/2k/XP clients. @@ -2696,6 +2692,7 @@ automatically prefer "its own" drivers if it finds both.     +"Printers" folder Should your Win clients have had the old ADOBE*.* files for the Adobe PostScript driver installed, the download and installation of the new CUPS PostScript driver for Windows NT/2k/XP @@ -2703,8 +2700,7 @@ will fail at first. You need to wipe the old driver from the clients first. It is not enough to "delete" the printer, as the driver files will still be kept by the clients and re-used if you try to re-install the printer. To really get rid of the Adobe driver files on the -clients, open the "Printers" folder (possibly via Start ---> Settings --> Control Panel --> Printers), +clients, open the "Printers" folder (possibly via Start, Settings, Control Panel, Printers), right-click onto the folder background and select Server Properties. When the new dialog opens, select the Drivers tab. On the list select the driver you @@ -2716,9 +2712,10 @@ Administrator privileges to do this. +rpcclientsetdriver Once you have successfully downloaded the CUPS PostScript driver to a client, you can easily switch all printers to this one by proceeding -as described elsewhere in the "Samba HOWTO Collection": either change +as described in the printing chapter: either change a driver for an existing printer by running the "Printer Properties" dialog, or use rpcclient with the setdriver sub-command. @@ -2728,8 +2725,8 @@ dialog, or use rpcclient with the -What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver? +Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver You are interested in a comparison between the CUPS and the Adobe @@ -2743,7 +2740,9 @@ items which weigh in favor of the CUPS ones: no hassle with the question Where do I get the ADOBE*.* driver files from? -the Adobe drivers (on request of the printer PPD + +PJL + the Adobe drivers (on request of the printer PPD associated with them) often put a PJL header in front of the main PostScript part of the print file. Thus the printfile starts with <1B >%-12345X or @@ -2752,8 +2751,10 @@ of %!PS). This leads to the CUPS daemon auto-typing the incoming file as a print-ready file, not initiating a pass through the "pstops" filter (to speak more technically, it is not regarded as the generic MIME type +application/postscript application/postscript, but as the more special MIME type +application/cups.vnd-postscript application/cups.vnd-postscript), which therefore also leads to the page accounting in /var/log/cups/page_log not @@ -2801,42 +2802,33 @@ fully fledged CUPS IPP client for Windows NT/2K/XP to be released soon Run "cupsaddsmb" (quiet Mode) +cupsaddsmb +point and print + The cupsaddsmb command copies the needed files into your -[print$] share. Additionally, the PPD +[print$] share. Additionally, the PPD associated with this printer is copied from /etc/cups/ppd/ to -[print$]. There the files wait for convenient +[print$]. There the files wait for convenient Windows client installations via Point'n'Print. Before we can run the command successfully, we need to be sure that we can authenticate towards Samba. If you have a small network you are probably using user -level security (security = user). Probably your -root has already a Samba account. Otherwise, create it now, using -smbpasswd: +level security (securityuser). - - - # smbpasswd -a root - New SMB password: [type in password 'secret'] - Retype new SMB password: [type in password 'secret'] - - - Here is an example of a successfully run cupsaddsmb command. - - # cupsaddsmb -U root infotec_IS2027 - Password for root required to access localhost via SAMBA: [type in password 'secret'] - +&rootprompt;cupsaddsmb -U root infotec_IS2027 +Password for root required to access localhost via Samba: ['secret'] To share all printers and drivers, use the --a parameter instead of a printer name. Since + parameter instead of a printer name. Since cupsaddsmb "exports" the printer drivers to Samba, it should be obvious that it only works for queues with a CUPS driver associated. @@ -2845,9 +2837,11 @@ obvious that it only works for queues with a CUPS driver associated. Run "cupsaddsmb" with verbose Output +cupsaddsmb + Probably you want to see what's going on. Use the --v parameter to get a more verbose output. The + parameter to get a more verbose output. The output below was edited for better readability: all "\" at the end of a line indicate that I inserted an artificial line break plus some indentation here: @@ -2855,86 +2849,79 @@ indentation here: You will see the root password for the Samba account printed on -screen. If you use remote access, the password will go over the wire -unencrypted! +screen. +rpcclientadddriver +rpcclientsetdriver - - # cupsaddsmb -U root -v infotec_2105 - Password for root required to access localhost via SAMBA: - Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir W32X86;put \ - /var/spool/cups/tmp/3e98bf2d333b5 W32X86/infotec_2105.ppd;put \ - /usr/share/cups/drivers/cupsdrvr.dll W32X86/cupsdrvr.dll;put \ - /usr/share/cups/drivers/cupsui.dll W32X86/cupsui.dll;put \ - /usr/share/cups/drivers/cups.hlp W32X86/cups.hlp' - added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 - Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a] - NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86 - putting file /var/spool/cups/tmp/3e98bf2d333b5 as \W32X86/infotec_2105.ppd (2328.8 kb/s) \ - (average 2328.8 kb/s) - putting file /usr/share/cups/drivers/cupsdrvr.dll as \W32X86/cupsdrvr.dll (9374.3 kb/s) \ - (average 5206.6 kb/s) - putting file /usr/share/cups/drivers/cupsui.dll as \W32X86/cupsui.dll (8107.2 kb/s) \ - (average 5984.1 kb/s) - putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp (3475.0 kb/s) \ - (average 5884.7 kb/s) +&rootprompt;cupsaddsmb -U root -v infotec_2105 +Password for root required to access localhost via &example.server.samba;: +Running command: smbclient //localhost/print\$ -N -U'root%secret' \ + -c 'mkdir W32X86; \ + put /var/spool/cups/tmp/3e98bf2d333b5 W32X86/infotec_2105.ppd; \ + put /usr/share/cups/drivers/cupsdrvr.dll W32X86/cupsdrvr.dll; \ + put /usr/share/cups/drivers/cupsui.dll W32X86/cupsui.dll; \ + put /usr/share/cups/drivers/cups.hlp W32X86/cups.hlp' +added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 +Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a] +NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86 +putting file /var/spool/cups/tmp/3e98bf2d333b5 as \W32X86/infotec_2105.ppd +putting file /usr/share/cups/drivers/cupsdrvr.dll as \W32X86/cupsdrvr.dll +putting file /usr/share/cups/drivers/cupsui.dll as \W32X86/cupsui.dll +putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp - Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows NT x86" \ - "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \ - RAW:NULL"' - cmd = adddriver "Windows NT x86" "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll: \ - cups.hlp:NULL:RAW:NULL" - Printer Driver infotec_2105 successfully installed. +Running command: rpcclient localhost -N -U'root%secret' + -c 'adddriver "Windows NT x86" \ + "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \ + RAW:NULL"' +cmd = adddriver "Windows NT x86" \ + "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:RAW:NULL" +Printer Driver infotec_2105 successfully installed. - Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir WIN40;put \ - /var/spool/cups/tmp/3e98bf2d333b5 WIN40/infotec_2105.PPD; put \ - /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;put \ - /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV;put \ - /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP;put \ - /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD;put \ - /usr/share/cups/drivers/ICONLIB.DLL - WIN40/ICONLIB.DLL;put /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;' +Running command: smbclient //localhost/print\$ -N -U'root%secret' \ +-c 'mkdir WIN40; \ + put /var/spool/cups/tmp/3e98bf2d333b5 WIN40/infotec_2105.PPD; \ + put /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM; \ + put /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV; \ + put /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP; \ + put /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD; \ + put /usr/share/cups/drivers/ICONLIB.DLL WIN40/ICONLIB.DLL; \ + put /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;' added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 - Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a] + Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a] NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40 - putting file /var/spool/cups/tmp/3e98bf2d333b5 as \WIN40/infotec_2105.PPD (2328.8 kb/s) \ - (average 2328.8 kb/s) - putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM (9368.0 kb/s) \ - (average 6469.6 kb/s) - putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV (9958.2 kb/s) \ - (average 8404.3 kb/s) - putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP (8341.5 kb/s) \ - (average 8398.6 kb/s) - putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD (2195.9 kb/s) \ - (average 8254.3 kb/s) - putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL (8239.9 kb/s) \ - (average 8253.6 kb/s) - putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL (6222.2 kb/s) \ - (average 8188.5 kb/s) + putting file /var/spool/cups/tmp/3e98bf2d333b5 as \WIN40/infotec_2105.PPD + putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM + putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV + putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP + putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD + putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL + putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL - Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows 4.0" \ - "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP: \ - PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL, \ - ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"' + Running command: rpcclient localhost -N -U'root%secret' \ + -c 'adddriver "Windows 4.0" \ + "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP: \ + PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL, \ + ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"' cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL: \ - ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP, \ + ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP, \ PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL" Printer Driver infotec_2105 successfully installed. - Running command: rpcclient localhost -N -U'root%secret' \ - -c 'setdriver infotec_2105 infotec_2105' + Running command: rpcclient localhost -N -U'root%secret' \ + -c 'setdriver infotec_2105 infotec_2105' cmd = setdriver infotec_2105 infotec_2105 Successfully set infotec_2105 to driver infotec_2105. -If you look closely, you'll discover your root password was transfered +If you look closely, you'll discover your root password was transferred unencrypted over the wire, so beware! Also, if you look further her, you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in between. They occur, because the directories WIN40 and W32X86 already -existed in the [print$] driver download share +existed in the [print$] driver download share (from a previous driver installation). They are harmless here. @@ -2942,14 +2929,17 @@ existed in the [print$] driver download share Understanding cupsaddsmb +cupsaddsmb + What has happened? What did cupsaddsmb do? There are five stages of the procedure - -call the CUPS server via IPP and request the + + IPP + call the CUPS server via IPP and request the driver files and the PPD file for the named printer; store the files temporarily in the local @@ -2957,15 +2947,19 @@ TEMPDIR (as defined in cupsd.conf); connect via smbclient to the Samba server's - [print$] share and put the files into the + [print$] share and put the files into the share's WIN40 (for Win95/98/ME) and W32X86/ (for WinNT/2k/XP) sub directories; -connect via rpcclient to the Samba server and + +rpcclientadddriver + connect via rpcclient to the Samba server and execute the "adddriver" command with the correct parameters; -connect via rpcclient to the Samba server a second + +rpcclientsetdriver + connect via rpcclient to the Samba server a second time and execute the "setdriver" command. @@ -2979,14 +2973,12 @@ same host): - - # cupsaddsmb -H sambaserver -h cupsserver -v printername - +&rootprompt;cupsaddsmb -H sambaserver -h cupsserver -v printername -How to recognize if cupsaddsm completed successfully +How to recognize if cupsaddsmb completed successfully You must always check if the utility completed @@ -3010,7 +3002,7 @@ architecture...) These messages probably not easily recognized in the general -output. If you run cupsaddsmb with the -a +output. If you run cupsaddsmb with the parameter (which tries to prepare all active CUPS printer drivers for download), you might miss if individual printers drivers had problems to install properly. Here a redirection of the @@ -3028,6 +3020,8 @@ might occur. cupsaddsmb with a Samba PDC +cupsaddsmb + You can't get the standard cupsaddsmb command to run on a Samba PDC? You are asked for the password credential all over again and again and @@ -3036,11 +3030,9 @@ variations: - - # cupsaddsmb -U DOMAINNAME\\root -v printername - # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -v printername - # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -h cups-server -v printername - +&rootprompt;cupsaddsmb -U &example.workgroup;\\root -v printername +&rootprompt;cupsaddsmb -H &example.pdc.samba; -U &example.workgroup;\\root -v printername +&rootprompt;cupsaddsmb -H &example.pdc.samba; -U &example.workgroup;\\root -h cups-server -v printername @@ -3052,6 +3044,7 @@ variations: cupsaddsmb Flowchart +cupsaddsmb Here is a chart about the procedures, commandflows and dataflows of the "cupaddsmb" command. Note again: cupsaddsmb is @@ -3059,18 +3052,15 @@ not intended to, and does not work with, "raw" queues! -
    cupsaddsmb flowchart - - - - -
    + cupsaddsmb flowchart + 14small     Installing the PostScript Driver on a Client +point and print After cupsaddsmb completed, your driver is prepared for the clients to use. Here are the steps you must perform to download and install it @@ -3080,6 +3070,8 @@ server; +"Printers" folder + open the Printers share of Samba in Network Neighbourhood; @@ -3104,6 +3096,7 @@ dropdown list of available printers. +PPD cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher and Samba from 2.2.4. If it doesn't work, or if the automatic printer driver download to the clients doesn't succeed, you can still manually @@ -3113,9 +3106,7 @@ share for a UNC type of connection: - - net use lpt1: \\sambaserver\printershare /user:ntadmin - +&dosprompt;net use lpt1: \\sambaserver\printershare /user:ntadmin @@ -3190,16 +3181,25 @@ printer should be there. We are providing the driver now); copy all files to -[print$]: + [print$]     -run rpcclient adddriver + +rpcclientadddriver + run rpcclient adddriver (for each client architecture you want to support): -run rpcclient + +rpcclientsetdriver + run rpcclient setdriver. +rpcclientenumports +rpcclientenumprinters +rpcclientenumdrivers +rpcclientsetdriver +rpcclientadddriver We are going to do this now. First, read the man page on "rpcclient" to get a first idea. Look at all the printing related sub-commands. enumprinters, @@ -3265,7 +3265,7 @@ obtaining a list of installed printers and drivers.     -Understanding the rpcclient man Page +Understanding the rpcclient man page The exact format isn't made too clear by the man @@ -3275,12 +3275,12 @@ command and indicated the breaks with "\". Usually you would type the command in one line without the linebreaks: - +rpcclientadddriver + adddriver "Architecture" \ "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\ LanguageMonitorFile:DataType:ListOfFiles,Comma-separated" - @@ -3316,6 +3316,8 @@ now. Producing an Example by querying a Windows Box + rpcclientgetdriver + rpcclientgetprinter We could run rpcclient with a getdriver or a getprinter subcommand (in level 3 verbosity) against it. Just sit down at UNIX or @@ -3324,9 +3326,7 @@ following command: - - rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3' - +&rootprompt;rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3' @@ -3334,9 +3334,10 @@ From the result it should become clear which is which. Here is an example from my installation: + rpcclientgetdriver - -# rpcclient -U'Danka%xxxx' W2KSERVER -c'getdriver "DANKA InfoStream Virtual Printer" 3' +&rootprompt;rpcclient -U'Danka%xxxx' W2KSERVER \ + -c'getdriver "DANKA InfoStream Virtual Printer" 3' cmd = getdriver "DANKA InfoStream Virtual Printer" 3 [Windows NT x86] @@ -3379,17 +3380,18 @@ From the manpage (and from the quoted output of cupsaddsmb, above) it becomes clear that you need to have certain conditions in order to make the manual uploading and initializing of the driver files succeed. The two rpcclient +rpcclientadddriver subcommands (adddriver and setdriver) need to encounter the following pre-conditions to complete successfully: -you are connected as "printer admin", or root (note, +you are connected as printer admin, or root (note, that this is not the "Printer Operators" group in NT, but the printer admin group, as defined in -the [global] section of -smb.conf); +the [global] section of +&smb.conf;); copy all required driver files to \\sambaserver\print$\w32x86 and @@ -3402,13 +3404,16 @@ to escape the "$": smbclient //sambaserver/print\$ -U root); the user you're connecting as must be able to write to -the [print$] share and create +the [print$] share and create subdirectories; the printer you are going to setup for the Windows clients, needs to be installed in CUPS already; -the CUPS printer must be known to Samba, otherwise the + + rpcclientsetdriver + rpcclientenumprinters + the CUPS printer must be known to Samba, otherwise the setdriver subcommand fails with an NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by Samba you may use the enumprinters subcommand to @@ -3421,7 +3426,7 @@ Samba. -Manual Commandline Driver Installation in 15 little Steps +Manual Driver Installation in 15 Steps We are going to install a printer driver now by manually executing all @@ -3430,13 +3435,14 @@ first, we go through the procedure step by step, explaining every single action item as it comes up. - -First Step: Install the Printer on CUPS - - + + Manual Driver Installation installation -# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P /home/kurt/canonIR85.ppd + +Install the Printer on CUPS + +&rootprompt;lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P canonIR85.ppd @@ -3445,21 +3451,19 @@ to the CUPS system. The printer is accessed via a socket (a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root for this step - + - -Second Step (optional): Check if the Printer is recognized by +<step> +<title>(optional) Check if the Printer is recognized by Samba + rpcclientenumprinters - - # rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn - - flags:[0x800000] - name:[\\kde-bitshop\mysmbtstprn] - description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn] - comment:[mysmbtstprn] - +&rootprompt;rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn +flags:[0x800000] +name:[\\kde-bitshop\mysmbtstprn] +description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn] +comment:[mysmbtstprn] @@ -3471,32 +3475,35 @@ success. Note the "empty" field between the two commas in the already. You need to know root's Samba password (as set by the smbpasswd command) for this step and most of the following steps. Alternatively you can authenticate as one of the -users from the "write list" as defined in smb.conf for -[print$]. +users from the "write list" as defined in &smb.conf; for +[print$]. - + - -Third Step (optional): Check if Samba knows a Driver for the +<step> +<title>(optional) Check if Samba knows a Driver for the Printer + rpcclientgetprinter + rpcclientgetdriver - -# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver - drivername:[] - -# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv - servername:[\\kde-bitshop] - printername:[\\kde-bitshop\mysmbtstprn] - sharename:[mysmbtstprn] - portname:[Samba Printer Port] - drivername:[] - comment:[mysmbtstprn] - location:[] - sepfile:[] - printprocessor:[winprint] +&rootprompt;rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \ + | grep driver +drivername:[] + +&rootprompt;rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \ + | grep -C4 driv +servername:[\\kde-bitshop] +printername:[\\kde-bitshop\mysmbtstprn] +sharename:[mysmbtstprn] +portname:[Samba Printer Port] +drivername:[] +comment:[mysmbtstprn] +location:[] +sepfile:[] +printprocessor:[winprint] -# rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost +&rootprompt;rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost result was WERR_UNKNOWN_PRINTER_DRIVER @@ -3508,21 +3515,19 @@ attempt to connect to the printer at this stage will prompt the message along the lines: "The server has not the required printer driver installed".     - + - -Fourth Step: Put all required Driver Files into Samba's +<step> +<title>Put all required Driver Files into Samba's [print$] - -# smbclient //localhost/print\$ -U 'root%xxxx' \ - -c 'cd W32X86; \ - put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD; \ - put /usr/share/cups/drivers/cupsui.dll cupsui.dll; \ - put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \ - put /usr/share/cups/drivers/cups.hlp cups.hlp' - +&rootprompt;smbclient //localhost/print\$ -U 'root%xxxx' \ + -c 'cd W32X86; \ + put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD; \ + put /usr/share/cups/drivers/cupsui.dll cupsui.dll; \ + put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \ + put /usr/share/cups/drivers/cups.hlp cups.hlp' @@ -3530,49 +3535,45 @@ driver installed". line. Line-breaks and the line-end indicating "\" has been inserted for readability reasons.) This step is required for the next one to succeed. It makes the driver files physically -present in the [print$] share. However, clients +present in the [print$] share. However, clients would still not be able to install them, because Samba does not yet treat them as driver files. A client asking for the driver would still be presented with a "not installed here" message. - + - -Fifth Step: Verify where the Driver Files are now + +Verify where the Driver Files are now - -# ls -l /etc/samba/drivers/W32X86/ - total 669 - drwxr-sr-x 2 root ntadmin 532 May 25 23:08 2 - drwxr-sr-x 2 root ntadmin 670 May 16 03:15 3 - -rwxr--r-- 1 root ntadmin 14234 May 25 23:21 cups.hlp - -rwxr--r-- 1 root ntadmin 278380 May 25 23:21 cupsdrvr.dll - -rwxr--r-- 1 root ntadmin 215848 May 25 23:21 cupsui.dll - -rwxr--r-- 1 root ntadmin 169458 May 25 23:21 mysmbtstprn.PPD - +&rootprompt;ls -l /etc/samba/drivers/W32X86/ +total 669 +drwxr-sr-x 2 root ntadmin 532 May 25 23:08 2 +drwxr-sr-x 2 root ntadmin 670 May 16 03:15 3 +-rwxr--r-- 1 root ntadmin 14234 May 25 23:21 cups.hlp +-rwxr--r-- 1 root ntadmin 278380 May 25 23:21 cupsdrvr.dll +-rwxr--r-- 1 root ntadmin 215848 May 25 23:21 cupsui.dll +-rwxr--r-- 1 root ntadmin 169458 May 25 23:21 mysmbtstprn.PPD The driver files now are in the W32X86 architecture "root" of -[print$]. +[print$]. - + - -Sixth Step: Tell Samba that these are +<step> +<title>Tell Samba that these are <emphasis>Driver</emphasis> Files (<command>adddriver</command>) + rpcclientadddriver - -# rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \ - cupsdrvr.dll:mysmbtstprn.PPD: \ - cupsui.dll:cups.hlp:NULL:RAW:NULL" \ - localhost - - Printer Driver mydrivername successfully installed. - +&rootprompt;rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \ + cupsdrvr.dll:mysmbtstprn.PPD: \ + cupsui.dll:cups.hlp:NULL:RAW:NULL" \ + localhost +Printer Driver mydrivername successfully installed. @@ -3586,70 +3587,65 @@ the printername; however, in big installations you may use this driver for a number of printers which have obviously different names. So the name of the driver is not fixed. - + - -Seventh Step: Verify where the Driver Files are now + +Verify where the Driver Files are now - -# ls -l /etc/samba/drivers/W32X86/ - total 1 - drwxr-sr-x 2 root ntadmin 532 May 25 23:22 2 - drwxr-sr-x 2 root ntadmin 670 May 16 03:15 3 - - -# ls -l /etc/samba/drivers/W32X86/2 - total 5039 - [....] - -rwxr--r-- 1 root ntadmin 14234 May 25 23:21 cups.hlp - -rwxr--r-- 1 root ntadmin 278380 May 13 13:53 cupsdrvr.dll - -rwxr--r-- 1 root ntadmin 215848 May 13 13:53 cupsui.dll - -rwxr--r-- 1 root ntadmin 169458 May 25 23:21 mysmbtstprn.PPD - +&rootprompt;ls -l /etc/samba/drivers/W32X86/ +total 1 +drwxr-sr-x 2 root ntadmin 532 May 25 23:22 2 +drwxr-sr-x 2 root ntadmin 670 May 16 03:15 3 + +&rootprompt;ls -l /etc/samba/drivers/W32X86/2 +total 5039 +[....] +-rwxr--r-- 1 root ntadmin 14234 May 25 23:21 cups.hlp +-rwxr--r-- 1 root ntadmin 278380 May 13 13:53 cupsdrvr.dll +-rwxr--r-- 1 root ntadmin 215848 May 13 13:53 cupsui.dll +-rwxr--r-- 1 root ntadmin 169458 May 25 23:21 mysmbtstprn.PPD Notice how step 6 did also move the driver files to the appropriate subdirectory. Compare with the situation after step 5. - + - -Eighth Step (optional): Verify if Samba now recognizes the +<step> +<title>(optional) Verify if Samba now recognizes the Driver + rpcclientenumdrivers - -# rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost | grep -B2 -A5 mydrivername - - Printer Driver Info 3: - Version: [2] - Driver Name: [mydrivername] - Architecture: [Windows NT x86] - Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll] - Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD] - Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll] - Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp] - +&rootprompt;rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost \ + | grep -B2 -A5 mydrivername +Printer Driver Info 3: +Version: [2] +Driver Name: [mydrivername] +Architecture: [Windows NT x86] +Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll] +Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD] +Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll] +Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp] Remember, this command greps for the name you did choose for the driver in step Six. This command must succeed before you can proceed. - + - -Ninth Step: Tell Samba which Printer should use these Driver +<step> +<title>Tell Samba which Printer should use these Driver Files (<command>setdriver</command>) - - -# rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost - - Successfully set mysmbtstprn to driver mydrivername +rpcclientsetdriver + +&rootprompt;rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost +Successfully set mysmbtstprn to driver mydrivername @@ -3660,63 +3656,69 @@ setdriver command to succeed. The only pre-conditions are: enumdrivers must find the driver and enumprinters must find the printer. - + - -Tenth Step (optional): Verify if Samba has this Association +<step> +<title>(optional) Verify if Samba has this Association recognized +rpcclientgetprinter +rpcclientgetdriver +rpcclientenumprinters - -# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver - drivername:[mydrivername] +&rootprompt;rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \ + | grep driver +drivername:[mydrivername] -# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv - servername:[\\kde-bitshop] - printername:[\\kde-bitshop\mysmbtstprn] - sharename:[mysmbtstprn] - portname:[Done] - drivername:[mydrivername] - comment:[mysmbtstprn] - location:[] - sepfile:[] - printprocessor:[winprint] +&rootprompt;rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \ + | grep -C4 driv +servername:[\\kde-bitshop] +printername:[\\kde-bitshop\mysmbtstprn] +sharename:[mysmbtstprn] +portname:[Done] +drivername:[mydrivername] +comment:[mysmbtstprn] +location:[] +sepfile:[] +printprocessor:[winprint] -# rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost - [Windows NT x86] - Printer Driver Info 3: - Version: [2] - Driver Name: [mydrivername] - Architecture: [Windows NT x86] - Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll] - Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD] - Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll] - Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp] - Monitorname: [] - Defaultdatatype: [RAW] - Monitorname: [] - Defaultdatatype: [RAW] +&rootprompt;rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost +[Windows NT x86] +Printer Driver Info 3: + Version: [2] + Driver Name: [mydrivername] + Architecture: [Windows NT x86] + Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll] + Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD] + Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll] + Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp] + Monitorname: [] + Defaultdatatype: [RAW] + Monitorname: [] + Defaultdatatype: [RAW] -# rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn - name:[\\kde-bitshop\mysmbtstprn] - description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn] - comment:[mysmbtstprn] +&rootprompt;rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn + name:[\\kde-bitshop\mysmbtstprn] + description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn] + comment:[mysmbtstprn] +rpcclientenumprinters Compare these results with the ones from steps 2 and 3. Note that every single of these commands show the driver is installed. Even the enumprinters command now lists the driver on the "description" line. - + - -Eleventh Step (optional): Tickle the Driver into a correct +<step> +<title>(optional) Tickle the Driver into a correct Device Mode +"Printers" folder You certainly know how to install the driver on the client. In case you are not particularly familiar with Windows, here is a short recipe: browse the Network Neighbourhood, go to the Samba server, look @@ -3731,56 +3733,53 @@ folder, named something like "printersharename on Sambahostname". It is important that you execute this step as a Samba printer admin -(as defined in smb.conf). Here is another method +(as defined in &smb.conf;). Here is another method to do this on Windows XP. It uses a commandline, which you may type into the "DOS box" (type root's smbpassword when prompted): - - C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n \\sambacupsserver\mysmbtstprn" - +&dosprompt;runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n\ + \\sambacupsserver\mysmbtstprn" -Change any printer setting once (like "portrait" ---> "landscape"), click "Apply"; change the setting +Change any printer setting once (like changing "portrait" to + "landscape"), click Apply; change the setting back. - + - -Twelfth Step: Install the Printer on a Client +<step> +<title>Install the Printer on a Client ("Point'n'Print") - - - C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn" +point and print + +&dosprompt;rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn" If it doesn't work it could be a permission problem with the -[print$] share. +[print$] share. - + - + Thirteenth Step (optional): Print a Test Page - - C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn" - +&dosprompt;rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn" Then hit [TAB] 5 times, [ENTER] twice, [TAB] once and [ENTER] again and march to the printer. - + - + Fourteenth Step (recommended): Study the Test Page @@ -3789,18 +3788,17 @@ installations and you don't need to read a word. Just put it in a frame and bolt it to the wall with the heading "MY FIRST RPCCLIENT-INSTALLED PRINTER" - why not just throw it away! - + - + Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your Success - -# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd - +&rootprompt;echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd - + + @@ -3829,7 +3827,8 @@ a disappointing message like this one beneath? -It is not good enough that you +lpstat +It is not good enough that you can see the queue in CUPS, using the lpstat -p ir85wm command. A bug in most recent versions of Samba prevents the proper update of @@ -3840,26 +3839,24 @@ execute the setdriver command successfully, check if Samba "sees" the printer: +rpcclientenumprinters - -# rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep ir85wm +&rootprompt;rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep ir85wm printername:[ir85wm] - An alternative command could be this: +rpcclientgetprinter - -# rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' +&rootprompt;rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' cmd = getprinter ir85wm flags:[0x800000] name:[\\transmeta\ir85wm] description:[\\transmeta\ir85wm,ir85wm,DPD] comment:[CUPS PostScript-Treiber for WinNT/2K/XP] - @@ -3873,6 +3870,19 @@ to install drivers on remote Windows NT print servers too! The printing <filename>*.tdb</filename> Files +TDB +connections.tdbTDB +printing.tdbTDB +share_info.tdbTDB +ntdrivers.tdbTDB +unexpected.tdbTDB +brlock.tdbTDB +locking.tdbTDB +ntforms.tdbTDB +messages.tdbTDB +ntprinters.tdbTDB +sessionid.tdbTDB +secrets.tdbTDB Some mystery is associated with the series of files with a tdb-suffix appearing in every Samba installation. They are connections.tdb, @@ -3892,12 +3902,13 @@ tdb-suffix appearing in every Samba installation. They are Trivial DataBase Files +TDB A Windows NT (Print) Server keeps track of all information needed to serve its duty toward its clients by storing entries in the Windows "Registry". Client queries are answered by reading from the registry, Administrator or user configuration settings are saved by writing into -the Registry. Samba and Unix obviously don't have such a kind of +the Registry. Samba and UNIX obviously don't have such a kind of Registry. Samba instead keeps track of all client related information in a series of *.tdb files. (TDB = Trivial Data Base). These are often located in /var/lib/samba/ @@ -3946,6 +3957,9 @@ backup of the *.tdb files in time. Using <emphasis>tdbbackup</emphasis> +TDBbacking uptdbbackup +tdbbackup + Samba ships with a little utility which helps the root user of your system to back up your *.tdb files. If you run it @@ -3953,8 +3967,7 @@ with no argument, it prints a little usage message: - -# tdbbackup +&rootprompt;tdbbackup Usage: tdbbackup [options] <fname...> Version:3.0a @@ -3969,16 +3982,16 @@ Here is how I backed up my printing.tdb file: - -# ls - . browse.dat locking.tdb ntdrivers.tdb printing.tdb share_info.tdb - .. connections.tdb messages.tdb ntforms.tdb printing.tdbkp unexpected.tdb - brlock.tdb gmon.out namelist.debug ntprinters.tdb sessionid.tdb +&rootprompt;ls +. browse.dat locking.tdb ntdrivers.tdb printing.tdb +.. share_info.tdb connections.tdb messages.tdb ntforms.tdb +printing.tdbkp unexpected.tdb brlock.tdb gmon.out namelist.debug +ntprinters.tdb sessionid.tdb - kde-bitshop:/var/lock/samba # tdbbackup -s .bak printing.tdb +&rootprompt;tdbbackup -s .bak printing.tdb printing.tdb : 135 records - kde-bitshop:/var/lock/samba # ls -l printing.tdb* +&rootprompt;ls -l printing.tdb* -rw------- 1 root root 40960 May 2 03:44 printing.tdb -rw------- 1 root root 40960 May 2 03:44 printing.tdb.bak @@ -3989,23 +4002,25 @@ Here is how I backed up my printing.tdb file: CUPS Print Drivers from Linuxprinting.org +Linuxprinting.org + CUPS ships with good support for HP LaserJet type printers. You can install the generic driver as follows: - - -lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd +lpadmin + +&rootprompt;lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd -The -m switch will retrieve the +The switch will retrieve the laserjet.ppd from the standard repository for not-yet-installed-PPDs, which CUPS typically stores in /usr/share/cups/model. Alternatively, you may use --P /path/to/your.ppd. +. @@ -4014,7 +4029,7 @@ for every LaserJet-compatible model. It constitutes a sort of "least denominator" of all the models. If for some reason it is ruled out to you to pay for the commercially available ESP Print Pro drivers, your first move should be to consult the database on http://www.linuxprinting.org/printer_list.cgi. +noescape="1" url="http://www.linuxprinting.org/printer_list.cgi">http://www.linuxprinting.org/printer_list.cgi. Linuxprinting.org has excellent recommendations about which driver is best used for each printer. Its database is kept current by the tireless work of Till Kamppeter from MandrakeSoft, who is also the @@ -4022,11 +4037,12 @@ principal author of the foomatic-rip utility. +foomatic-rip The former "cupsomatic" concept is now be replaced by the new, much more powerful "foomatic-rip". foomatic-rip is the successor of cupsomatic. cupsomatic is no longer maintained. Here is the new URL to the Foomatic-3.0 database:http://www.linuxprinting.org/driver_list.cgi. +noescape="1" url="http://www.linuxprinting.org/driver_list.cgi">http://www.linuxprinting.org/driver_list.cgi. If you upgrade to foomatic-rip, don't forget to also upgrade to the new-style PPDs for your foomatic-driven printers. foomatic-rip will not work with PPDs generated for the old cupsomatic. The new-style @@ -4038,6 +4054,9 @@ provide the driver files for the Windows clients also! foomatic-rip and Foomatic explained +foomatic +foomatic-rip + Nowadays most Linux distros rely on the utilities of Linuxprinting.org to create their printing related software (which, BTW, works on all @@ -4104,6 +4123,8 @@ of the data. Foomatic's strange Name +foomatic + "Why the funny name?", you ask. When it really took off, around spring 2000, CUPS was far less popular than today, and most systems used LPD, @@ -4143,6 +4164,10 @@ Ghostscript filters. cupsomatic, pdqomatic, lpdomatic, directomatic +cupsomatic +CUPS-PPD +PPDCUPSCUPS-PPD + CUPS worked through a quickly-hacked up filter script named cupsomatic. @@ -4191,9 +4216,11 @@ configuration files.. -7.13.1.5.The <emphasis>Grand Unification</emphasis> +<title>The <emphasis>Grand Unification</emphasis> achieved... +foomatic-rip + This all has changed in Foomatic versions 2.9 (Beta) and released as "stable" 3.0. This has now achieved the convergence of all *omatic @@ -4261,7 +4288,7 @@ the work is currently done in three projects. These are: url="http://www-124.ibm.com/developerworks/oss/linux/projects/omni/">Omni -- a Free Software project by IBM which tries to convert their printer driver knowledge from good-ol' OS/2 times into a modern, modular, -universal driver architecture for Linux/Unix (still Beta). This +universal driver architecture for Linux/UNIX (still Beta). This currently supports 437 models. HPIJS -- @@ -4282,7 +4309,7 @@ platforms). This currently supports 522 models. Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and -commercial Unix +commercial UNIX Linuxprinting.org today is the one-stop "shop" to download printer @@ -4361,11 +4388,11 @@ Linuxprinting.org ensures you to get the latest driver/PPD files): Surf to http://www.linuxprinting.org/printer_list.cgi +noescape="1" url="http://www.linuxprinting.org/printer_list.cgi">http://www.linuxprinting.org/printer_list.cgi Check the complete list of printers in the database: -http://www.linuxprinting.org/printer_list.cgi?make=Anyone @@ -4378,7 +4405,7 @@ with this model (for all printers, there will always be first). In our case ("HP LaserJet 4 Plus"), we'll arrive here: -http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus @@ -4389,7 +4416,7 @@ visit them all, if you are not familiar with the Linuxprinting.org database. There is a link to the database page for the "ljet4": -http://www.linuxprinting.org/show_driver.cgi?driver=ljet4 On the driver's page, you'll find important and detailed information about how to use that driver within the various available @@ -4399,23 +4426,23 @@ spoolers. driver author or the driver. Important links are the ones which provide hints with -setup instructions for CUPS (http://www.linuxprinting.org/cups-doc.html), -PDQ (http://www.linuxprinting.org/pdq-doc.html), -LPD, LPRng and GNUlpr (http://www.linuxprinting.org/lpd-doc.html) -as well as PPR (http://www.linuxprinting.org/ppr-doc.html) -or "spooler-less" printing (http://www.linuxprinting.org/direct-doc.html ). You can view the PPD in your browser through this -link: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1 You can also (most importantly) -generate and download the PPD: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=0 @@ -4425,7 +4452,7 @@ for the user. Later you'll only need to choose resolution, paper size etc. from the web-based menu, or from the print dialog GUI, or from the commandline. -Should you have ended up on the driver's page (Should you have ended up on the driver's page (http://www.linuxprinting.org/show_driver.cgi?driver=ljet4), you can choose to use the "PPD-O-Matic" online PPD generator program. @@ -4461,19 +4488,17 @@ e.g.: - -lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd - +&rootprompt;lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd Note again this: for all the new-style "Foomatic-PPDs" from Linuxprinting.org, you also need a special "CUPS filter" named -"foomatic-rip".Get the latest version of "foomatic-rip" from: http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0 The foomatic-rip Perlscript itself also makes some -interesting reading (http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=1), because it is very well documented by Till's inline comments (even non-Perl hackers will learn quite a bit about printing by reading @@ -4538,6 +4563,8 @@ foomatic-rip). Page Accounting with CUPS + +CUPSPage Accounting Often there are questions regarding "print quotas" wherein Samba users (that is, Windows clients) should not be able to print beyond a @@ -4558,15 +4585,17 @@ period you want. Setting up Quotas +CUPSquotas This is an example command how root would set a print quota in CUPS, assuming an existing printer named "quotaprinter": - - - lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 -o job-page-limit=100 +lpadmin + +&rootprompt;lpadmin -p quotaprinter -o job-quota-period=604800 \ + -o job-k-limit=1024 -o job-page-limit=100 @@ -4596,7 +4625,7 @@ printer is a non-PostScript model, you need to let CUPS do the job to convert the file to a print-ready format for the target printer. This will be working for currently about 1,000 different printer models, see http://www.linuxprinting.org/printer_list.cgi). + url="http://www.linuxprinting.org/printer_list.cgi">the driver list at linuxprinting.org/. @@ -4621,6 +4650,7 @@ http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). It does +PJL to not write an PJL-header @@ -4644,6 +4674,7 @@ current from CUPS 1.1.16). The page_log File Syntax +page_log These are the items CUPS logs in the "page_log" for every single page of a job: @@ -4675,13 +4706,11 @@ format and included items: - - infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13 - infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13 - infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13 - infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13 - DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33 - +infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13 +infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13 +infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13 +infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13 +DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33 @@ -4712,7 +4741,7 @@ of 1000 and the job is aborted by the printer, the "page count" will still show the figure of 1000 for that job all quotas are the same for all users (no flexibility -to give the boss a higher quota than the clerk) no support for +to give the boss a higher quota than the clerk), no support for groups no means to read out the current balance or the @@ -4788,11 +4817,9 @@ away and re-directs it to go through Ghostscript. CUPS accepts this, because the associated CUPS-O-Matic-/Foomatic-PPD specifies: - - - *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic" - - + + *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic" + This line persuades CUPS to hand the file to cupsomatic, once it has @@ -4809,12 +4836,10 @@ mechanism. Another workaround in some situations would be to have in /etc/cups/mime.types entries as follows: - - - application/postscript application/vnd.cups-raw 0 - - application/vnd.cups-postscript application/vnd.cups-raw 0 - - - + + application/postscript application/vnd.cups-raw 0 - + application/vnd.cups-postscript application/vnd.cups-raw 0 - + This would prevent all Postscript files from being filtered (rather, @@ -4824,11 +4849,9 @@ want to print PS code on non-PS printers (provided they support ASCII text printing) an entry as follows could be useful: - - - */* application/vnd.cups-raw 0 - - - + + */* application/vnd.cups-raw 0 - + and would effectively send all files to the @@ -4839,11 +4862,9 @@ backend without further processing. Lastly, you could have the following entry: - - - application/vnd.cups-postscript application/vnd.cups-raw 0 my_PJL_stripping_filter - - + +application/vnd.cups-postscript application/vnd.cups-raw 0 my_PJL_stripping_filter + You will need to write a my_PJL_stripping_filter @@ -4873,10 +4894,9 @@ requested by marketing for the mailing, etc.). Samba print files pass through two "spool" directories. One is the -incoming directory managed by Samba, (set in the path = -/var/spool/samba directive in the -[printers] section of -smb.conf). The other is the spool directory of +incoming directory managed by Samba, (set in the path/var/spool/samba directive in the +[printers] section of +&smb.conf;). The other is the spool directory of your UNIX print subsystem. For CUPS it is normally /var/spool/cups/, as set by the cupsd.conf directive RequestRoot /var/spool/cups. @@ -4938,17 +4958,20 @@ things: a Samba-smbd which is compiled against "libcups" (Check on Linux by running "ldd `which smbd`") -a Samba-smb.conf setting of -"printing = cups" +a Samba-&smb.conf; setting of + printingcups -another Samba-smb.conf setting of -"printcap = cups" +another Samba-&smb.conf; setting of + printcapcups In this case all other manually set printing-related commands (like -"print command", "lpq command", "lprm command", "lppause command" or -"lpresume command") are ignored and they should normally have no +print command, +lpq command, +lprm command, +lppause command or +lpresume command) are ignored and they should normally have no influence what-so-ever on your printing. @@ -4957,23 +4980,14 @@ influence what-so-ever on your printing. Manual Configuration -If you want to do things manually, replace the "printing = -cups" by "printing = bsd". Then your manually set commands may work -(haven't tested this), and a "print command = lp -d %P %s; rm %s" +If you want to do things manually, replace the printingcups +by printingbsd. Then your manually set commands may work +(haven't tested this), and a print commandlp -d %P %s; rm %s" may do what you need. - -When <emphasis>not</emphasis> to use Samba to print to -CUPS - - -[TO BE DONE] - - - In Case of Trouble..... @@ -4984,10 +4998,8 @@ relevant to your problem): - - grep -v ^# /etc/cups/cupsd.conf | grep -v ^$ - grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;" - +&prompt;grep -v ^# /etc/cups/cupsd.conf | grep -v ^$ +&prompt;grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;" @@ -4999,35 +5011,9 @@ for experts (and you are expecting experts to read them, right? ;-) - -Where to find Documentation - - -[TO BE DONE] - - - - -How to ask for Help - - -[TO BE DONE] - - - - -Where to find Help - - -[TO BE DONE] - - -Appendix - - Printing <emphasis>from</emphasis> CUPS to Windows attached Printers @@ -5035,7 +5021,7 @@ Printers From time to time the question arises, how you can print to a Windows attached printer from Samba. Normally the local connection -"Windows host <--> printer" would be done by USB or parallel +from Windows host to printer would be done by USB or parallel cable, but this doesn't matter to Samba. From here only an SMB connection needs to be opened to the Windows host. Of course, this printer must be "shared" first. As you have learned by now, CUPS uses @@ -5049,27 +5035,25 @@ which file must exist and be executable: - - # ls -l /usr/lib/cups/backend/ - total 253 - drwxr-xr-x 3 root root 720 Apr 30 19:04 . - drwxr-xr-x 6 root root 125 Dec 19 17:13 .. - -rwxr-xr-x 1 root root 10692 Feb 16 21:29 canon - -rwxr-xr-x 1 root root 10692 Feb 16 21:29 epson - lrwxrwxrwx 1 root root 3 Apr 17 22:50 http -> ipp - -rwxr-xr-x 1 root root 17316 Apr 17 22:50 ipp - -rwxr-xr-x 1 root root 15420 Apr 20 17:01 lpd - -rwxr-xr-x 1 root root 8656 Apr 20 17:01 parallel - -rwxr-xr-x 1 root root 2162 Mar 31 23:15 pdfdistiller - lrwxrwxrwx 1 root root 25 Apr 30 19:04 ptal -> /usr/local/sbin/ptal-cups - -rwxr-xr-x 1 root root 6284 Apr 20 17:01 scsi - lrwxrwxrwx 1 root root 17 Apr 2 03:11 smb -> /usr/bin/smbspool - -rwxr-xr-x 1 root root 7912 Apr 20 17:01 socket - -rwxr-xr-x 1 root root 9012 Apr 20 17:01 usb - -# ls -l `which smbspool` - -rwxr-xr-x 1 root root 563245 Dec 28 14:49 /usr/bin/smbspool - +&rootprompt;ls -l /usr/lib/cups/backend/ +total 253 +drwxr-xr-x 3 root root 720 Apr 30 19:04 . +drwxr-xr-x 6 root root 125 Dec 19 17:13 .. +-rwxr-xr-x 1 root root 10692 Feb 16 21:29 canon +-rwxr-xr-x 1 root root 10692 Feb 16 21:29 epson +lrwxrwxrwx 1 root root 3 Apr 17 22:50 http -> ipp +-rwxr-xr-x 1 root root 17316 Apr 17 22:50 ipp +-rwxr-xr-x 1 root root 15420 Apr 20 17:01 lpd +-rwxr-xr-x 1 root root 8656 Apr 20 17:01 parallel +-rwxr-xr-x 1 root root 2162 Mar 31 23:15 pdfdistiller +lrwxrwxrwx 1 root root 25 Apr 30 19:04 ptal -> /usr/sbin/ptal-cups +-rwxr-xr-x 1 root root 6284 Apr 20 17:01 scsi +lrwxrwxrwx 1 root root 17 Apr 2 03:11 smb -> /usr/bin/smbspool +-rwxr-xr-x 1 root root 7912 Apr 20 17:01 socket +-rwxr-xr-x 1 root root 9012 Apr 20 17:01 usb + +&rootprompt;ls -l `which smbspool` +-rwxr-xr-x 1 root root 563245 Dec 28 14:49 /usr/bin/smbspool @@ -5077,9 +5061,7 @@ If this symlink doesn't exist, create it: - -# ln -s `which smbspool` /usr/lib/cups/backend/smb - +&rootprompt;ln -s `which smbspool` /usr/lib/cups/backend/smb @@ -5102,9 +5084,8 @@ To install a printer with the smb backend on CUPS, use this command: - -# lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename -P /path/to/PPD - +&rootprompt;lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename \ + -P /path/to/PPD @@ -5117,13 +5098,11 @@ for: you can include the required parameters as part of the smb:// device-URI. Like this: - - - smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename - smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename - smb://username:password@WINDOWSNETBIOSNAME/printersharename - - + + smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename + smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename + smb://username:password@WINDOWSNETBIOSNAME/printersharename + Note that the device-URI will be visible in the process list of the @@ -5137,121 +5116,26 @@ working netbios name resolution up and running. Note that this is a feature of CUPS and you don't necessarily need to have smbd running (but who wants that? :-). - + - + More CUPS filtering Chains The following diagrams reveal how CUPS handles print jobs. - -######################################################################### -# -# CUPS in and of itself has this (general) filter chain (CAPITAL -# letters are FILE-FORMATS or MIME types, other are filters (this is -# true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro): -# -# SOMETHNG-FILEFORMAT -# | -# V -# somethingtops -# | -# V -# APPLICATION/POSTSCRIPT -# | -# V -# pstops -# | -# V -# APPLICATION/VND.CUPS-POSTSCRIPT -# | -# V -# pstoraster # as shipped with CUPS, independent from any Ghostscipt -# | # installation on the system -# | (= "postscipt interpreter") -# V -# APPLICATION/VND.CUPS-RASTER -# | -# V -# rastertosomething (e.g. Gimp-Print filters may be plugged in here) -# | (= "raster driver") -# V -# SOMETHING-DEVICE-SPECIFIC -# | -# V -# backend -# -# -# ESP PrintPro has some enhanced "rastertosomething" filters as compared to -# CUPS, and also a somewhat improved "pstoraster" filter. -# -# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rastertosomething is noted. -# -######################################################################### - +cups1Filtering chain 1 - -######################################################################### -# -# This is how "cupsomatic" comes into play: -# ========================================= -# -# SOMETHNG-FILEFORMAT -# | -# V -# somethingtops -# | -# V -# APPLICATION/POSTSCRIPT -# | -# V -# pstops -# | -# V -# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+ -# | V -# V cupsomatic -# pstoraster (constructs complicated -# | (= "postscipt interpreter") Ghostscript commandline -# | to let the file be -# V processed by a -# APPLICATION/VND.CUPS-RASTER "-sDEVICE=s.th." -# | call...) -# V | -# rastertosomething V -# | (= "raster driver") +-------------------------+ -# | | Ghostscript at work.... | -# V | | -# SOMETHING-DEVICE-SPECIFIC *-------------------------+ -# | | -# V | -# backend <------------------------------------+ -# | -# V -# THE PRINTER -# -# -# Note, that cupsomatic "kidnaps" the printfile after the -# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it gh -# the CUPS-external, systemwide Ghostscript installation, bypassing the -# "pstoraster" filter (therefore also bypassing the CUPS-raster-drivers -# "rastertosomething", and hands the rasterized file directly to the CUPS -# backend... -# -# cupsomatic is not made by the CUPS developers. It is an independent -# contribution to printing development, made by people from -# Linuxprinting.org. (see also http://www.cups.org/cups-help.html) -# -# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -# CUPS and ESP PrintPro plug-in where rastertosomething is noted. -# -######################################################################### - +cups2Filtering chain with cupsomatic + + +Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to +CUPS and ESP PrintPro plug-in where rastertosomething is noted. + + + + - -Trouble Shooting Guidelines to fix typical Samba printing -Problems + + Common Errors - -This is a short description of how to debug printing problems -with Samba. This describes how to debug problems with printing from -a SMB client to a Samba server, not the other way around. - + + Win9x client can't install driver - -Win9x client can't install driver -For Win9x clients require the printer names to be 8 + For Win9x clients require the printer names to be 8 chars (or "8 plus 3 chars suffix") max; otherwise the driver files won't get transferred when you want to download them from -Samba. - -testparm -Run testparm: It will tell you if -smb.conf parameters are in the wrong -section. Many people have had the "printer admin" parameter in the -[printers] section and experienced -problems. "testparm" will tell you if it sees -this. - -"cupsaddsmb" keeps asking for a root password in a -neverending loop -Have you security = user? Have +Samba. + + + + + "cupsaddsmb" keeps asking for root password in + neverending loop + + Have you securityuser? Have you used smbpasswd to give root a Samba account? You can do 2 things: open another terminal and execute smbpasswd -a root to create the account, and continue with entering the password into the first terminal. Or break out of the loop by hitting ENTER twice (without trying to type a -password). +password). -"cupsaddsmb" gives "No PPD file for printer..." -message (but I swear there is one!) + - - -Have you enabled printer sharing on CUPS? This means: + + "cupsaddsmb" gives "No PPD file for printer..." + message while PPD file is present + + Have you enabled printer sharing on CUPS? This means: do you have a <Location /printers>....</Location> section in CUPS server's cupsd.conf which doesn't deny access to the host you run "cupsaddsmb" from? It could be an issue if you use cupsaddsmb remotely, or if you use it with a --h parameter: cupsaddsmb -H -sambaserver -h cupsserver -v printername. - -Is your + parameter: cupsaddsmb -H + sambaserver -h cupsserver -v printername. + +Is your "TempDir" directive in cupsd.conf set to a valid value and is it writeable? - - + -I can't connect client to Samba printer. -Use smbstatus to check which user + + + + Client can't connect to Samba printer + Use smbstatus to check which user you are from Samba's point of view. Do you have the privileges to -write into the [print$] -share? - -I can't reconnect to Samba under a new account -from Win2K/XP -Once you are connected as the "wrong" user (for -example as "nobody", which often occurs if you have map to -guest = bad user), Windows Explorer will not accept an +write into the [print$] +share? + + + + + Can't reconnect to Samba under new account + from Win2K/XP + Once you are connected as the "wrong" user (for +example as "nobody", which often occurs if you have +map to guestbad user), Windows Explorer will not accept an attempt to connect again as a different user. There won't be any byte transfered on the wire to Samba, but still you'll see a stupid error message which makes you think that Samba has denied access. Use @@ -5527,89 +5407,90 @@ indicating a renewed connection attempt? Shut all Explorer Windows. This makes Windows forget what it has cached in its memory as established connections. Then re-connect as the right user. Best method is to use a DOS terminal window and first -do net use z: \\SAMBAHOST\print$ /user:root. Check +do net use z: \\&example.server.samba;\print$ /user:root. Check with smbstatus that you are connected under a different account. Now open the "Printers" folder (on the Samba server in the Network Neighbourhood), right-click the printer in question and select -Connect... +Connect... -Avoid being connected to the Samba server as the -"wrong" user -You see per smbstatus that you are + + Avoid being connected to the Samba server as the + "wrong" user + + You see per smbstatus that you are connected as user "nobody"; while you wanted to be "root" or -"printeradmin"? This is probably due to map to guest = bad -user, which silently connects you under the guest account, +"printeradmin"? This is probably due to +map to guestbad user, which silently connects you under the guest account, when you gave (maybe by accident) an incorrect username. Remove -map to guest, if you want to prevent -this. +map to guest, if you want to prevent +this. + +Upgrading to CUPS drivers from Adobe drivers on + NT/2K/XP clients gives problems -Upgrading to CUPS drivers from Adobe drivers on -NT/2K/XP clients gives problems -First delete all "old" Adobe-using printers. Then + First delete all "old" Adobe-using printers. Then delete all "old" Adobe drivers. (On Win2K/XP, right-click in background of "Printers" folder, select "Server Properties...", select -tab "Drivers" and delete here). - -I can't use "cupsaddsmb"on a Samba server which is -a PDC -Do you use the "naked" root user name? Try to do it -this way: cupsaddsmb -U DOMAINNAME\\root -v -printername (note the two backslashes: the first one is -required to "escape" the second one). - -I deleted a printer on Win2K; but I still see -its driver -Deleting a printer on the client won't delete the +tab "Drivers" and delete here). + +Can't use "cupsaddsmb" on Samba server which is + a PDC +Do you use the "naked" root user name? Try to do it +this way: cupsaddsmb -U DOMAINNAME\\root -v +printername> (note the two backslashes: the first one is +required to "escape" the second one). + +Deleted Win2K printer driver is still shown +Deleting a printer on the client won't delete the driver too (to verify, right-click on the white background of the "Printers" folder, select "Server Properties" and click on the "Drivers" tab). These same old drivers will be re-used when you try to install a printer with the same name. If you want to update to a new driver, delete the old ones first. Deletion is only possible if no -other printer uses the same driver. +other printer uses the same driver. -Win2K/XP "Local Security -Policies" -Local Security Policies may not +Win2K/XP "Local Security + Policies" +Local Security Policies may not allow the installation of unsigned drivers. "Local Security Policies" may not allow the installation of printer drivers at -all. +all. -WinXP clients: "Administrator can not install -printers for all local users" -Windows XP handles SMB printers on a "per-user" basis. +WinXP clients: "Administrator can not install + printers for all local users" +Windows XP handles SMB printers on a "per-user" basis. This means every user needs to install the printer himself. To have a printer available for everybody, you might want to use the built-in IPP client capabilities of WinXP. Add a printer with the print path of http://cupsserver:631/printers/printername. Still looking into this one: maybe a "logon script" could automatically install printers for all -users. +users. -"Print Change Notify" functions on -NT-clients -For "print change notify" functions on NT++ clients, +"Print Change Notify" functions on + NT-clients +For "print change notify" functions on NT++ clients, these need to run the "Server" service first (re-named to File & Print Sharing for MS Networks in -XP). +XP). -WinXP-SP1 -WinXP-SP1 introduced a Point and Print +WinXP-SP1 +WinXP-SP1 introduced a Point and Print Restriction Policy (this restriction doesn't apply to "Administrator" or "Power User" groups of users). In Group Policy -Object Editor: go to User Configuration --> -Administrative Templates --> Control Panel --> +Object Editor: go to User Configuration, + Administrative Templates, Control Panel, Printers. The policy is automatically set to Enabled and the Users can only Point and Print to machines in their Forest . You probably need to change it to Disabled or Users can only Point and Print to these servers in order to make -driver downloads from Samba possible. +driver downloads from Samba possible. -I can't set and save default print options for all -users on Win2K/XP +Print options for all users can't be set on Win2K/XP -How are you doing it? I bet the wrong way (it is not +How are you doing it? I bet the wrong way (it is not very easy to find out, though). There are 3 different ways to bring you to a dialog that seems to set everything. All three dialogs look the same. Only one of them @@ -5687,16 +5568,16 @@ Do you see any difference? I don't either... However, only the last one, which you arrived at with steps "C.1.-6." will save any settings permanently and be the defaults for new users. If you want all clients to get the same defaults, you need to conduct these steps as -Administrator (printer admin in -smb.conf) before a client +Administrator (printer admin in +&smb.conf;) before a client downloads the driver (the clients can later set their own per-user defaults by following the procedures A. or B. -above). +above). -What are the most common blunders in driver -settings on Windows clients? -Don't use Optimize for +Most common blunders in driver + settings on Windows clients + Don't use Optimize for Speed: use Optimize for Portability instead (Adobe PS Driver) Don't use Page Independence: No: always @@ -5708,11 +5589,11 @@ printer (Adobe PS Driver). For TrueType Download Options choose Outline. Use PostScript Level 2, if you are having trouble with a non-PS printer, and if -there is a choice. +there is a choice. -I can't make cupsaddsmb work -with newly installed printer -Symptom: the last command of +<command>cupsaddsmb</command> does not work + with newly installed printer +Symptom: the last command of cupsaddsmb doesn't complete successfully: cmd = setdriver printername printername result was NT_STATUS_UNSUCCESSFUL then possibly the printer was not yet @@ -5721,29 +5602,29 @@ Neighbourhood? Did it show up in rpcclient hostname -c 'enumprinters'? Restart smbd (or send a kill -HUP to all processes listed by smbstatus and try -again. +again. -My permissions on +Permissions on <filename>/var/spool/samba/</filename> get reset after each -reboot</term> -<listitem><para>Have you by accident set the CUPS spool directory to +reboot +Have you by accident set the CUPS spool directory to the same location? (RequestRoot /var/spool/samba/ in cupsd.conf or the other way round: /var/spool/cups/ is set as -path in the [printers] +path> in the [printers] section). These must be different. Set RequestRoot /var/spool/cups/ in -cupsd.conf and path = -/var/spool/samba in the [printers] -section of smb.conf. Otherwise cupsd will +cupsd.conf and path +/var/spool/samba in the [printers] +section of &smb.conf;. Otherwise cupsd will sanitize permissions to its spool directory with each restart, and -printing will not work reliably. +printing will not work reliably. -My printers work fine: just the printer named "lp" +Printer named "lp" intermittently swallows jobs and spits out completely different -ones</term> -<listitem><para>It is a very bad idea to name any printer "lp". This -is the traditional Unix name for the default printer. CUPS may be set +ones +It is a very bad idea to name any printer "lp". This +is the traditional UNIX name for the default printer. CUPS may be set up to do an automatic creation of "Implicit Classes". This means, to group all printers with the same name to a pool of devices, and loadbalancing the jobs across them in a round-robin fashion. Chances @@ -5752,56 +5633,25 @@ receive his jobs and send your own to his device unwittingly. To have tight control over the printer names, set BrowseShortNames No. It will present any printer as "printername@cupshost" then, giving you a better control over what may happen in a large -networked environment. - -How do I "watch" my Samba server? -You can use tail -f -/var/log/samba/log.smbd (you may need a different path) to -see a live scrolling of all log messages. smbcontrol smbd -debuglevel tells you which verbosity goes into the -logs. smbcontrol smbd debug 3 sets the verbosity to -a quite high level (you can choose from 0 to 10 or 100). This works -"on the fly", without the need to restart the smbd daemon. Don't use -more than 3 initially; or you'll drown in an ocean of -messages. - -I can't use Samba from my WinXP Home box, while -access from WinXP Prof works flawlessly -You have our condolences! WinXP home has been -completely neutered by Microsoft as compared to WinXP Prof: you can -not log into a WinNT domain. It cannot join a Win NT domain as a -member server. While it is possible to access domain resources, users -don't have "single sign-on". They need to supply username and password -each time they connect to a resource. Logon scripts and roaming -profiles are not supported. It can serve file and print shares; but -only in "share-mode security" level. It can not use "user-mode -security" (what Windows 95/98/ME still can -do). - -Where do I find the Adobe PostScript driver files -I need for "cupsaddsmb"? -Use smbclient to connect to any +networked environment. + +Location of Adobe PostScript driver files necessary for "cupsaddsmb" +Use smbclient to connect to any Windows box with a shared PostScript printer: smbclient //windowsbox/print\$ -U guest. You can navigate to the W32X86/2 subdir to mget ADOBE* and other files or to WIN40/0 to do the same. -- Another option is to download the *.exe packaged -files from the Adobe website. - - +files from the Adobe website. - + + + An Overview of the CUPS Printing Processes - -
    CUPS Printing Overview - - - - -
    -     -     +CUPS Printing Overview + a_small + diff --git a/docs/docbook/projdoc/Compiling.xml b/docs/docbook/projdoc/Compiling.xml index 279be2fdb4..ccb2f46f3f 100644 --- a/docs/docbook/projdoc/Compiling.xml +++ b/docs/docbook/projdoc/Compiling.xml @@ -1,13 +1,13 @@ &author.jelmer; - Someone; Jerry perhaps? + &author.tridge; 22 May 2001 18 March 2003 -How to compile SAMBA +How to compile Samba You can obtain the samba source from the @@ -18,6 +18,8 @@ you can download samba from CVS or using rsync. Access Samba source code via CVS +CVS + Introduction @@ -31,7 +33,7 @@ detailed in this chapter. This chapter is a modified version of the instructions found at -http://samba.org/samba/cvs.html +http://samba.org/samba/cvs.html @@ -49,6 +51,8 @@ of accessing the CVS server on this host. Access via CVSweb +CVSweb + You can access the source code via your favourite WWW browser. This allows you to access the contents of @@ -59,7 +63,7 @@ listing between any two versions on the repository. Use the URL : http://samba.org/cgi-bin/cvsweb +noescape="1" url="http://samba.org/cgi-bin/cvsweb">http://samba.org/cgi-bin/cvsweb @@ -78,7 +82,7 @@ just a casual browser. To download the latest cvs source code, point your browser at the URL : -http://www.cyclic.com/. +http://www.cyclic.com/. and click on the 'How to get cvs' link. CVS is free software under the GNU GPL (as is Samba). Note that there are several graphical CVS clients which provide a graphical interface to the sometimes mundane CVS commands. @@ -167,11 +171,14 @@ on this system just substitute the correct package name Accessing the samba sources via rsync and ftp + rsync + ftp + pserver.samba.org also exports unpacked copies of most parts of the CVS - tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at - rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. - See the rsync homepage for more info on rsync. + tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at + rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. + See the rsync homepage for more info on rsync. @@ -197,17 +204,19 @@ With that said, go ahead and download the following files: -$ wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc -$ wget http://us1.samba.org/samba/ftp/samba-pubkey.asc +&prompt;wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc +&prompt;wget http://us1.samba.org/samba/ftp/samba-pubkey.asc + +GPG The first file is the PGP signature for the Samba source file; the other is the Samba public PGP key itself. Import the public PGP key with: - $ gpg --import samba-pubkey.asc +&prompt;gpg --import samba-pubkey.asc @@ -215,8 +224,8 @@ And verify the Samba source code integrity with: - $ gzip -d samba-2.2.8a.tar.gz - $ gpg --verify samba-2.2.8a.tar.asc +&prompt;gzip -d samba-2.2.8a.tar.gz +&prompt;gpg --verify samba-2.2.8a.tar.asc @@ -226,51 +235,58 @@ then all is well. The warnings about trust relationships can be ignored. An example of what you would not want to see would be: + gpg: BAD signature from "Samba Distribution Verification Key" - + + Building the Binaries - To do this, first run the program ./configure +configure + + + To do this, first run the program ./configure in the source directory. This should automatically configure Samba for your operating system. If you have unusual needs then you may wish to run - &rootprompt;./configure --help - +&rootprompt;./configure --help + first to see what special options you can enable. Then executing + +make - &rootprompt;make +&rootprompt;make will create the binaries. Once it's successfully compiled you can use - &rootprompt;make install +&rootprompt;make install to install the binaries and manual pages. You can separately install the binaries and/or man pages using - &rootprompt;make installbin - +&rootprompt;make installbin + and - &rootprompt;make installman - + &rootprompt;make installman + Note that if you are upgrading for a previous version of Samba you might like to know that the old versions of the binaries will be renamed with a ".old" extension. You can go back to the previous version with - &rootprompt;make revert - +&rootprompt;make revert + if you find this version a disaster! @@ -311,10 +327,10 @@ example of what you would not want to see would be: On Debian you need to install the following packages: - - libkrb5-dev - krb5-user - + + libkrb5-dev + krb5-user + @@ -323,11 +339,11 @@ example of what you would not want to see would be: On RedHat this means you should have at least: - - krb5-workstation (for kinit) - krb5-libs (for linking with) - krb5-devel (because you are compiling from source) - + + krb5-workstation (for kinit) + krb5-libs (for linking with) + krb5-devel (because you are compiling from source) + in addition to the standard development environment. @@ -344,11 +360,14 @@ example of what you would not want to see would be: Starting the &smbd; and &nmbd; + inetd + You must choose to start &smbd; and &nmbd; either as daemons or from inetd. Don't try to do both! Either you can put them in inetd.conf and have them started on demand - by inetd, or you can start them as + by inetd or xinetd, + or you can start them as daemons either from the command line or in /etc/rc.local. See the man pages for details on the command line options. Take particular care to read @@ -363,6 +382,8 @@ example of what you would not want to see would be: Starting from inetd.conf + inetd + The following will be different if you use NIS, NIS+ or LDAP to distribute services maps. @@ -388,7 +409,11 @@ example of what you would not want to see would be: The exact syntax of /etc/inetd.conf varies between unixes. Look at the other entries in inetd.conf - for a guide. + for a guide. + + xinetd + Some distributions use xinetd instead of inetd. Consult the + xinetd manual for configuration information. Some unixes already have entries like netbios_ns (note the underscore) in /etc/services. @@ -396,8 +421,9 @@ example of what you would not want to see would be: /etc/inetd.conf to make them consistent. + ifconfig On many systems you may need to use the - interfaces option in &smb.conf; to specify the IP + interfaces option in &smb.conf; to specify the IP address and netmask of your interfaces. Run ifconfig as root if you don't know what the broadcast is for your @@ -412,13 +438,19 @@ example of what you would not want to see would be: from inetd. Restart inetd, perhaps just send - it a HUP. If you have installed an earlier version of &nmbd; then - you may need to kill &nmbd; as well. + it a HUP. + + + &rootprompt;killall -HUP inetd + + Alternative: starting it as a daemon + daemon + To start the server as a daemon you should create a script something like this one, perhaps calling it startsmb. @@ -445,21 +477,4 @@ example of what you would not want to see would be: - -Common Errors - - -I'm using gcc 3 and I've compiled Samba-3 from the CVS and the -binaries are very large files (40 Mb and 20 Mb). I've the same result with - ? - - - - -The dwarf format used by GCC 3 for storing debugging symbols is very inefficient. -Strip the binaries, don't compile with -g or compile with -gstabs. - - - - diff --git a/docs/docbook/projdoc/DOMAIN_MEMBER.xml b/docs/docbook/projdoc/DOMAIN_MEMBER.xml index 0af934faab..8e0aa92861 100644 --- a/docs/docbook/projdoc/DOMAIN_MEMBER.xml +++ b/docs/docbook/projdoc/DOMAIN_MEMBER.xml @@ -4,8 +4,6 @@ &author.jht; &author.jeremy; &author.jerry; - - &author.tridge; &author.jelmer; @@ -24,7 +22,7 @@ This chapter covers background information pertaining to domain membership, Samba configuration for it, and MS Windows client procedures for joining a domain. Why is this necessary? Because both are areas in which there exists within the current MS Windows networking world and particularly in the -Unix/Linux networking and administration world, a considerable level of +UNIX/Linux networking and administration world, a considerable level of mis-information, incorrect understanding, and a lack of knowledge. Hopefully this chapter will fill the voids. @@ -33,8 +31,7 @@ this chapter will fill the voids. Features and Benefits -MS Windows workstations and servers that want to participate in domain -security need to +MS Windows workstations and servers that want to participate in domain security need to be made Domain members. Participating in Domain security is often called Single Sign On or SSO for short. This chapter describes the process that must be followed to make a workstation @@ -91,9 +88,11 @@ Domain membership has many advantages: - + MS Windows Workstation/Server Machine Trust Accounts +machine trust accounts + A machine trust account is an account that is used to authenticate a client machine @@ -126,14 +125,14 @@ as follows: A Domain Security Account (stored in the - passdb backend that has been configured in the + passdb backend that has been configured in the &smb.conf; file. The precise nature of the account information that is stored depends on the type of backend database that has been chosen. The older format of this data is the smbpasswd database - which contains the unix login ID, the Unix user identifier (UID), and the + which contains the UNIX login ID, the UNIX user identifier (UID), and the LanMan and NT encrypted passwords. There is also some other information in this file that we do not need to concern ourselves with here. @@ -146,25 +145,28 @@ as follows: - A corresponding Unix account, typically stored in + A corresponding UNIX account, typically stored in /etc/passwd. Work is in progress to allow a - simplified mode of operation that does not require Unix user accounts, but + simplified mode of operation that does not require UNIX user accounts, but this may not be a feature of the early releases of Samba-3.     +machine trust accountscreating + There are three ways to create machine trust accounts: - Manual creation from the Unix/Linux command line. Here, both the Samba and - corresponding Unix account are created by hand. + Manual creation from the UNIX/Linux command line. Here, both the Samba and + corresponding UNIX account are created by hand. + Server Manager Using the MS Windows NT4 Server Manager (either from an NT4 Domain member server, or using the Nexus toolkit available from the Microsoft web site. This tool can be run from any MS Windows machine so long as the user is @@ -174,7 +176,7 @@ There are three ways to create machine trust accounts: "On-the-fly" creation. The Samba machine trust account is automatically created by Samba at the time the client is joined to the domain. - (For security, this is the recommended method.) The corresponding Unix + (For security, this is the recommended method.) The corresponding UNIX account may be created automatically or manually. @@ -184,25 +186,35 @@ There are three ways to create machine trust accounts: The first step in manually creating a machine trust account is to manually -create the corresponding Unix account in /etc/passwd. +create the corresponding UNIX account in /etc/passwd. This can be done using vipw or another 'add user' command -that is normally used to create new Unix accounts. The following is an example for a Linux based Samba server: - +that is normally used to create new UNIX accounts. The following is an example for a Linux based Samba server: +useradd +vipw + - -&rootprompt;/usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" -s /bin/false machine_name$ + +&rootprompt;/usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" \ + -s /bin/false machine_name$ + &rootprompt;passwd -l machine_name$ + + +chpass On *BSD systems, this can be done using the chpass utility: -&rootprompt;chpass -a "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin" + +&rootprompt;chpass -a \ + "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin" + @@ -213,7 +225,7 @@ home directory. For example a machine named 'doppy' would have an -doppy$:x:505:501:machine_nickname:/dev/null:/bin/false +doppy$:x:505:100:machine_nickname:/dev/null:/bin/false @@ -226,10 +238,10 @@ this as a machine trust account. -Now that the corresponding Unix account has been created, the next step is to create +Now that the corresponding UNIX account has been created, the next step is to create the Samba account for the client containing the well-known initial -machine trust account password. This can be done using the smbpasswd(8) command +machine trust account password. This can be done using the +smbpasswd command as shown here: @@ -242,7 +254,7 @@ as shown here: where machine_name is the machine's NetBIOS name. The RID of the new machine account is generated from the UID of -the corresponding Unix account. +the corresponding UNIX account. @@ -251,6 +263,7 @@ the corresponding Unix account. Manually creating a machine trust account using this method is the equivalent of creating a machine trust account on a Windows NT PDC using + Server Manager the Server Manager. From the time at which the account is created to the time which the client joins the domain and changes the password, your domain is vulnerable to an intruder joining @@ -266,18 +279,23 @@ the corresponding Unix account. If the machine from which you are trying to manage the domain is an -MS Windows NT4 workstation +MS Windows NT4 workstation or MS Windows 200x / XP Professional then the tool of choice is the package called SRVTOOLS.EXE. -When executed in the target directory this will unpack -SrvMge.exe and UsrMgr.exe (both are -Domain Management tools for MS Windows NT4 workstation. +When executed in the target directory this will unpack SrvMge.exe +and UsrMgr.exe (both are domain management tools for MS Windows NT4 workstation). + + + +If your workstation is a Microsoft Windows 9x/Me family product + you should download the Nexus.exe package from the Microsoft web site. +When executed from the target directory this will unpack the same tools but for use on +this platform. -If your workstation is any other MS Windows product you should download the -Nexus.exe package from the Microsoft web site. When executed -from the target directory this will unpack the same tools but for use on -MS Windows 9x/Me/200x/XP. +Further information about these tools may be obtained from the following locations: + + @@ -327,10 +345,10 @@ simply to allow the Samba server to create them as needed when the client is joined to the domain. -Since each Samba machine trust account requires a corresponding Unix account, a method -for automatically creating the Unix account is usually supplied; this requires configuration of the -add machine script option in -smb.conf. This method is not required, however; corresponding Unix +Since each Samba machine trust account requires a corresponding UNIX account, a method +for automatically creating the UNIX account is usually supplied; this requires configuration of the +add machine script option in +&smb.conf;. This method is not required, however; corresponding UNIX accounts may also be created manually. @@ -339,11 +357,11 @@ accounts may also be created manually. Below is an example for a RedHat Linux system. - -[global] - # <...remainder of parameters...> - add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u - + +[global] +<...remainder of parameters...> +add machine script/usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u + @@ -352,7 +370,7 @@ Below is an example for a RedHat Linux system. Making an MS Windows Workstation or Server a Domain Member -The procedure for making an MS Windows workstation of server a member of the domain varies +The procedure for making an MS Windows workstation or server a member of the domain varies with the version of Windows: @@ -377,7 +395,7 @@ with the version of Windows: The name of the account that is used to create domain member machine accounts can be anything the network administrator may choose. If it is other than root then this is easily mapped to root using the file pointed to be the &smb.conf; parameter - username map = /etc/samba/smbusers. + username map/etc/samba/smbusers. @@ -413,7 +431,7 @@ with the version of Windows: Samba Joining a Samba client to a domain is documented in - the Domain Member Server section of this chapter chapter. + the domain member chapter. @@ -442,7 +460,7 @@ Server, etc. -Please refer to the Domain Control chapter +Please refer to the chapter on setting up a PDC for more information regarding how to create a domain machine account for a domain member server as well as for information regarding how to enable the Samba domain member machine to join the domain and @@ -457,7 +475,7 @@ to be fully trusted by it. NetBIOS name:SERV1 - Win2K/NT domain name:DOM + Win2K/NT domain name:&example.workgroup; Domain's PDC NetBIOS name:DOMPDC Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2 @@ -471,27 +489,26 @@ now use domain security. -Change (or add) your -security line in the [global] section + Change (or add) your + security line in the [global] section of your &smb.conf; to read: - -security = domain - + +securitydomain + -Next change the -workgroup line in the [global] +Next change the workgroup line in the [global] section to read: - -workgroup = DOM - + +workgroup&example.workgroup; + @@ -499,21 +516,20 @@ as this is the name of the domain we are joining. -You must also have the parameter -encrypt passwords set to yes +You must also have the parameter +encrypt passwords set to yes in order for your users to authenticate to the NT PDC. -Finally, add (or modify) a -password server line in the [global] +Finally, add (or modify) a password server line in the [global] section to read: - -password server = DOMPDC DOMBDC1 DOMBDC2 - + +password serverDOMPDC DOMBDC1 DOMBDC2 + @@ -531,9 +547,9 @@ set this line to be: - -password server = * - + +password server* + @@ -548,7 +564,7 @@ In order to actually join the domain, you must run this command: -root# net join -S DOMPDC -UAdministrator%password +&rootprompt;net rpc join -S DOMPDC -UAdministrator%password @@ -573,8 +589,8 @@ or Joined 'SERV1' to realm 'MYREALM' -in your terminal window. See the -net(8) man page for more details. +in your terminal window. See the +net man page for more details. @@ -602,7 +618,12 @@ as a shadow password file. Finally, restart your Samba daemons and get ready for -clients to begin using domain security! +clients to begin using domain security! The way you can restart your +samba daemons depends on your distribution, but in most cases running + + &rootprompt;/etc/init.d/samba restart + +does the job. @@ -612,20 +633,19 @@ clients to begin using domain security! Currently, domain security in Samba doesn't free you from -having to create local Unix users to represent the users attaching +having to create local UNIX users to represent the users attaching to your server. This means that if domain user DOM\fred attaches to your domain security Samba server, there needs -to be a local Unix user fred to represent that user in the Unix +to be a local UNIX user fred to represent that user in the UNIX filesystem. This is very similar to the older Samba security mode -security = server, +security = server, where Samba would pass through the authentication request to a Windows NT server in the same way as a Windows 95 or Windows 98 server would. -Please refer to the Winbind chapter -for information on a system to automatically -assign UNIX uids and gids to Windows NT Domain users and groups. + Please refer to the chapter on winbind for information on a system +to automatically assign UNIX uids and gids to Windows NT Domain users and groups. @@ -639,11 +659,11 @@ domain PDC to an account domain PDC). -In addition, with security = server every Samba +In addition, with securityserver every Samba daemon on a server has to keep a connection open to the authenticating server for as long as that daemon lasts. This can drain the connection resources on a Microsoft NT server and cause it to run -out of available connections. With security = domain, +out of available connections. With securitydomain, however, the Samba daemons connect to the PDC/BDC only for as long as is necessary to authenticate the user, and then drop the connection, thus conserving PDC connection resources. @@ -672,35 +692,40 @@ the NIS/NT Samba. Samba ADS Domain Membership +Active Directory +ADSActive Directory + +KDC +Kerberos This is a rough guide to setting up Samba 3.0 with Kerberos authentication against a Windows2000 KDC. A familiarity with Kerberos is assumed. -Setup your <filename>smb.conf</filename> +Setup your &smb.conf; You must use at least the following 3 options in &smb.conf;: - - realm = your.kerberos.REALM - security = ADS - encrypt passwords = yes - + +realmyour.kerberos.REALM +securityADS +encrypt passwordsyes + In case samba can't figure out your ads server using your realm name, use the -ads server option in smb.conf: - - ads server = your.kerberos.server - +ads server option in &smb.conf;: + +ads serveryour.kerberos.server + You do not need a smbpasswd file, and older clients will be authenticated as -if security = domain, although it won't do any harm and +if securitydomain, although it won't do any harm and allows you to have local users not in the domain. It is expected that the above required options will change soon when active directory integration will get better. @@ -716,15 +741,17 @@ The minimal configuration for krb5.conf is: - [libdefaults] - default_realm = YOUR.KERBEROS.REALM +[libdefaults] + default_realm = YOUR.KERBEROS.REALM [realms] - YOUR.KERBEROS.REALM = { - kdc = your.kerberos.server + YOUR.KERBEROS.REALM = { + kdc = your.kerberos.server } +kinit + Test your config by doing a kinit USERNAME@REALM and @@ -733,7 +760,8 @@ making sure that your password is accepted by the Win2000 KDC. The realm must be uppercase or you will get Cannot find KDC for -requested realm while getting initial credentials error. +requested realm while getting initial credentials error (Kerberos +is case-sensitive!). @@ -773,9 +801,9 @@ is only needed if you want Kerberos support for &smbd; and &winbindd;. As a user that has write permission on the Samba private directory (usually root) run: - - &rootprompt;net join -U Administrator%password - + +&rootprompt; net ads join -U Administrator%password + @@ -788,7 +816,7 @@ As a user that has write permission on the Samba private directory (make clean all install) after the Kerberos libs and headers are installed. - net join prompts for user name + net ads join prompts for user name You need to login to the domain using kinit USERNAME@REALM. USERNAME must be a user who has rights to add a machine @@ -821,10 +849,12 @@ server? Does it have an encoding type of DES-CBC-MD5 ? Testing with &smbclient; +smbclient + On your Samba server try to login to a Win2000 server or your Samba server using &smbclient; and Kerberos. Use &smbclient; as usual, but -specify the -k option to choose Kerberos authentication. +specify the option to choose Kerberos authentication. @@ -839,7 +869,7 @@ install, to create the right encoding types W2k doesn't seem to create the _kerberos._udp and _ldap._tcp in -their defaults DNS setup. Maybe fixed in service packs? +their defaults DNS setup. Maybe this will be fixed later in service packs. @@ -855,17 +885,17 @@ It is particularly interesting how often subscribers on the samba mailing list h after repeated failed attempts to add a machine account that it is necessary to "re-install" MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type of problem. The real solution is often very simple, and with understanding of how MS Windows -networking functions. easily overcome. +networking functions easy to overcome. Can Not Add Machine Back to Domain -Problem: A Windows workstation was reinstalled. The original domain machine + A Windows workstation was reinstalled. The original domain machine account was deleted and added immediately. The workstation will not join the domain if I use the same machine name. Attempts to add the machine fail with a message that the machine already -exists on the network - I know it doesn't. Why is this failing? +exists on the network - I know it doesn't. Why is this failing? @@ -880,15 +910,15 @@ the old account and then to add the machine with a new name. Adding Machine to Domain Fails -Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a + Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a message that, The machine could not be added at this time, there is a network problem. -Please try again later. Why? + Please try again later. Why? -You should check that there is an add machine script in your &smb.conf; +You should check that there is an add machine script in your &smb.conf; file. If there is not, please add one that is appropriate for your OS platform. If a script -has been defined you will need to debug it's operation. Increase the log level +has been defined you will need to debug it's operation. Increase the log level in the &smb.conf; file to level 10, then try to rejoin the domain. Check the logs to see which operation is failing. @@ -904,16 +934,16 @@ Possible causes include: Corrective Action: Fix it. Make sure that when run manually - that the script will add both the Unix system account _and_ the Samba SAM account. + that the script will add both the UNIX system account _and_ the Samba SAM account. - The machine could not be added to the Unix system accounts file /etc/passwd + The machine could not be added to the UNIX system accounts file /etc/passwd - Corrective Action: Check that the machine name is a legal Unix - system account name. ie: If the Unix utility useradd is called + Corrective Action: Check that the machine name is a legal UNIX + system account name. ie: If the UNIX utility useradd is called then make sure that the machine name you are trying to add can be added using this tool. Useradd on some systems will not allow any upper case characters nor will it allow spaces in the name. diff --git a/docs/docbook/projdoc/Diagnosis.xml b/docs/docbook/projdoc/Diagnosis.xml index 7e3656c0f3..76984f3076 100644 --- a/docs/docbook/projdoc/Diagnosis.xml +++ b/docs/docbook/projdoc/Diagnosis.xml @@ -52,14 +52,13 @@ You can add a tmp share like this by adding the following to &smb.conf;: - - -[tmp] - comment = temporary files - path = /tmp - read only = yes - - + + smb.conf with [tmp] share +[tmp] +commenttemporary files +path/tmp +read onlyyes + @@ -80,6 +79,8 @@ that the settings for your &smb.conf; file results in dns proxy = notestparm smb.conf. +log filesmonitoring + It is helpful to monitor the log files during testing by using the tail -F log_file_name in a separate @@ -102,6 +103,8 @@ don't forget to restart &smbd; and &nmbd;. Diagnosing your samba server +testparm + In the directory in which you store your &smb.conf; file, run the command @@ -175,6 +178,8 @@ state using netstat -a. +inetd +xinetdinetd Some Unix / Linux systems use xinetd in place of inetd. Check your system documentation for the location of the control file/s for your particular system implementation of @@ -197,11 +202,11 @@ a session request. The most common of these involve one or more of the following &smb.conf; file entries: - - hosts deny = ALL - hosts allow = xxx.xxx.xxx.xxx/yy - bind interfaces only = Yes - + +hosts denyALL +hosts allowxxx.xxx.xxx.xxx/yy +bind interfaces onlyYes + In the above, no allowance has been made for any session requests that @@ -209,22 +214,23 @@ will automatically translate to the loopback adapter address 127.0.0.1. To solve this problem change these lines to: - - hosts deny = ALL - hosts allow = xxx.xxx.xxx.xxx/yy 127. - + +hosts denyALL +hosts allowxxx.xxx.xxx.xxx/yy 127. + -Do not use the bind interfaces only parameter where you +Do not use the bind interfaces only parameter where you may wish to use the samba password change facility, or where &smbclient; may need to access a local service for name resolution or for local resource -connections. (Note: the bind interfaces only parameter deficiency +connections. (Note: the bind interfaces only parameter deficiency where it will not allow connections to the loopback address will be fixed soon). +inetd Another common cause of these two errors is having something already running on port 139, such as Samba (ie: &smbd; is running from inetd already) or @@ -299,13 +305,13 @@ messages from several hosts. If this doesn't give a similar result to the previous test then nmblookup isn't correctly getting your broadcast address through its automatic mechanism. In this case you should experiment with the -interfaces option in &smb.conf; to manually configure your IP +interfaces option in &smb.conf; to manually configure your IP address, broadcast and netmask. If your PC and server aren't on the same subnet then you will need to -use the -B option to set the broadcast address to that of the PCs +use the option to set the broadcast address to that of the PCs subnet. @@ -318,11 +324,13 @@ not correct. (Refer to TEST 3 notes above). +smbclient + Run the command smbclient //BIGSERVER/TMP. You should then be prompted for a password. You should use the password of the account you are logged into the unix box with. If you want to test with -another account then add the -U accountname option to the end of +another account then add the option to the end of the command line. eg: smbclient //bigserver/tmp -Ujohndoe @@ -353,26 +361,25 @@ If it says bad password then the likely causes are: - your valid users configuration is incorrect + your valid users configuration is incorrect - you have a mixed case password and you haven't enabled the password - level option at a high enough level + you have a mixed case password and you haven't enabled the password level option at a high enough level - the path = line in &smb.conf; is incorrect. Check it with &testparm; + the path line in &smb.conf; is incorrect. Check it with &testparm; - you enabled password encryption but didn't map unix to samba users + you enabled password encryption but didn't map unix to samba users. Run smbpasswd -a username. @@ -458,8 +465,7 @@ and other config lines in &smb.conf; are correct. It's also possible that the server can't work out what user name to -connect you as. To see if this is the problem add the line user = -username to the [tmp] section of +connect you as. To see if this is the problem add the line userusername to the [tmp] section of &smb.conf; where username is the username corresponding to the password you typed. If you find this fixes things you may need the username mapping option. @@ -467,7 +473,7 @@ fixes things you may need the username mapping option. It might also be the case that your client only sends encrypted passwords -and you have encrypt passwords = no in &smb.conf; +and you have encrypt passwordsno in &smb.conf; Turn it back on to fix. @@ -486,7 +492,7 @@ master browser for that workgroup. If you don't then the election process has failed. Wait a minute to see if it is just being slow then try again. If it still fails after that then look at the browsing options you have set in &smb.conf;. Make -sure you have preferred master = yes to ensure that +sure you have preferred masteryes to ensure that an election is held at startup. @@ -495,16 +501,16 @@ an election is held at startup. ->From file manager try to browse the server. Your samba server should +From file manager try to browse the server. Your samba server should appear in the browse list of your local workgroup (or the one you -specified in smb.conf). You should be able to double click on the name +specified in &smb.conf;). You should be able to double click on the name of the server and get a list of shares. If you get a "invalid password" error when you do then you are probably running WinNT and it is refusing to browse a server that has no encrypted password capability and is in user level security mode. In this case either set -security = server AND -password server = Windows_NT_Machine in your -&smb.conf; file, or make sure encrypted passwords is +securityserver AND +password serverWindows_NT_Machine in your +&smb.conf; file, or make sure encrypt passwords is set to "yes". @@ -512,13 +518,4 @@ set to "yes". - -Still having troubles? - -Read the chapter on -Analysing and Solving Problems. - - - - diff --git a/docs/docbook/projdoc/Further-Resources.xml b/docs/docbook/projdoc/Further-Resources.xml index 4294ffa38a..d8905cc659 100644 --- a/docs/docbook/projdoc/Further-Resources.xml +++ b/docs/docbook/projdoc/Further-Resources.xml @@ -1,7 +1,6 @@ &author.jelmer; - &author.dlechnyr; May 1, 2003 @@ -141,6 +140,13 @@ + + + W2K Samba deploy HOWTO + by Arnaud Loonstra + + + @@ -170,9 +176,4 @@ - - Books - - - diff --git a/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml b/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml index a13a43675b..076b870609 100644 --- a/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml +++ b/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml @@ -7,17 +7,20 @@ &author.jerry; &author.jht; -Mapping MS Windows and Unix Groups +Mapping MS Windows and UNIX Groups + +groupsmapping Starting with Samba-3, new group mapping functionality is available to create associations - between Windows group SIDs and UNIX groups. The groupmap subcommand + between Windows group SIDs and UNIX groups. The groupmap subcommand included with the &net; tool can be used to manage these associations. The first immediate reason to use the group mapping on a Samba PDC, is that + domain admin group the domain admin group has been removed and should no longer be specified in &smb.conf;. This parameter was used to give the listed users membership in the Domain Admins Windows group which gave local admin rights on their workstations @@ -30,33 +33,54 @@ Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to - arbitrarily associate them with Unix/Linux group accounts. + arbitrarily associate them with UNIX/Linux group accounts. +UID +GID - Group accounts can be managed using the MS Windows NT4 or MS Windows 200x MMC tools - so long as appropriate interface scripts have been provided to &smb.conf;. + Group accounts can be managed using the MS Windows NT4 or MS Windows 200x / XP Professional MMC tools. + Appropriate interface scripts should be provided in &smb.conf; if it is desired that UNIX / Linux system + accounts should be automatically created when these tools are used. In the absence of these scripts, and + so long as winbind is running, Samba accounts group accounts that are created using these tools will be + allocated UNIX UIDs/GIDs from the parameters set by the idmap uid/idmap gid settings + in the &smb.conf; file. + +
    IDMAP groups + + + + +
    + + groupadd + groupdel + Administrators should be aware that where &smb.conf; group interface scripts make - direct calls to the Unix/Linux system tools (eg: the shadow utilities, groupadd, - groupdel, groupmod) then the resulting Unix/Linux group names will be subject + direct calls to the UNIX/Linux system tools (eg: the shadow utilities, groupadd, + groupdel, groupmod) then the resulting UNIX/Linux group names will be subject to any limits imposed by these tools. If the tool does NOT allow upper case characters or space characters, then the creation of an MS Windows NT4 / 200x style group of - Engineering Managers will attempt to create an identically named - Unix/Linux group, an attempt that will of course fail! + Engineering Managers will attempt to create an identically named + UNIX/Linux group, an attempt that will of course fail! + + GID + SID + There are several possible work-arounds for the operating system tools limitation. One - method is to use a script that generates a name for the Unix/Linux system group that - fits the operating system limits, and that then just passes the Unix/Linux group id (GID) + method is to use a script that generates a name for the UNIX/Linux system group that + fits the operating system limits, and that then just passes the UNIX/Linux group id (GID) back to the calling Samba interface. This will provide a dynamic work-around solution. - Another work-around is to manually create a Unix/Linux group, then manually create the + Another work-around is to manually create a UNIX/Linux group, then manually create the MS Windows NT4 / 200x group on the Samba server and then use the net groupmap tool to connect the two to each other. @@ -74,6 +98,7 @@ local machine.     + Administrator The 'Administrator' user is a member of the 'Administrators' group, and thus inherits 'Administrators' group privileges. If a 'joe' user is created to be a member of the @@ -111,11 +136,12 @@ - - &rootprompt;net groupmap add ntgroup="Domain Admins" unixgroup=domadm - + +&rootprompt;net groupmap add ntgroup="Domain Admins" unixgroup=domadm + + "Domain Admins" group The quotes around "Domain Admins" are necessary due to the space in the group name. Also make sure to leave no whitespace surrounding the equal character (=). @@ -126,6 +152,7 @@ Now joe, john and mary are domain administrators! + groupsdomain It is possible to map any arbitrary UNIX group to any Windows NT4 / 200x group as well as making any UNIX group a Windows domain group. For example, if you wanted to include a @@ -134,15 +161,15 @@ - - &rootprompt;net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct - + +&rootprompt;net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct + Be aware that the RID parameter is a unsigned 32 bit integer that should normally start at 1000. However, this rid must not overlap with any RID assigned - to a user. Verifying this is done differently depending on on the passdb backend + to a user. Verifying this is done differently depending on the passdb backend you are using. Future versions of the tools may perform the verification automatically, but for now the burden is on you. @@ -156,13 +183,13 @@     - - &rootprompt; net groupmap list - System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin - Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin - Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser - Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest - + +&rootprompt; net groupmap list +System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin +Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin +Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser +Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest + @@ -185,7 +212,7 @@ Sample &smb.conf; add group script - A script to great complying group names for use by the Samba group interfaces: + A script to create complying group names for use by the Samba group interfaces: @@ -213,9 +240,9 @@ exit 0 The &smb.conf; entry for the above script would look like: - - add group script = /path_to_tool/smbgrpadd.sh %g - + +add group script/path_to_tool/smbgrpadd.sh %g +     @@ -224,8 +251,8 @@ exit 0 Script to configure Group Mapping - In our example we have created a Unix/Linux group called ntadmin. - Our script will create the additional groups Engineers, Marketoids, Gnomes: + In our example we have created a UNIX/Linux group called ntadmin. + Our script will create the additional groups Orks, Elves, Gnomes: @@ -245,13 +272,13 @@ net groupmap modify ntgroup="Print Operators" unixgroup=lp net groupmap modify ntgroup="Replicators" unixgroup=daemon net groupmap modify ntgroup="Power Users" unixgroup=sys -#groupadd Engineers -#groupadd Marketoids -#groupadd Gnomes +groupadd Orks +groupadd Elves +groupadd Gnomes -#net groupmap add ntgroup="Engineers" unixgroup=Engineers type=d -#net groupmap add ntgroup="Marketoids" unixgroup=Marketoids type=d -#net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d +net groupmap add ntgroup="Orks" unixgroup=Orks type=d +net groupmap add ntgroup="Elves" unixgroup=Elves type=d +net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d @@ -279,7 +306,7 @@ manually before putting them into active service. This is a common problem when the groupadd is called directly - by the Samba interface script for the add group script in + by the Samba interface script for the add group script in the &smb.conf; file. @@ -290,9 +317,9 @@ manually before putting them into active service. There are three possible work-arounds. Firstly, use only group names that comply - with the limitations of the Unix/Linux groupadd system tool. + with the limitations of the UNIX/Linux groupadd system tool. The second involves use of the script mentioned earlier in this chapter, and the - third option is to manually create a Unix/Linux group account that can substitute + third option is to manually create a UNIX/Linux group account that can substitute for the MS Windows group name, then use the procedure listed above to map that group to the MS Windows group. @@ -302,12 +329,40 @@ manually before putting them into active service. Adding MS Windows Groups to MS Windows Groups Fails + groupsnested + Samba-3 does NOT support nested groups from the MS Windows control environment. + + Adding <emphasis>Domain Users</emphasis> to the <emphasis>Power Users</emphasis> group + + + What must I do to add Domain Users to the Power Users group? + + + + The Power Users group is a group that is local to each Windows + 200x / XP Professional workstation. You can not add the Domain Users group to the Power Users + group automatically, this must be done on each workstation by logging in as the local workstation + administrator and then using click on Start / Control Panel / Users and Passwords + now click on the 'Advanced' tab, then on the 'Advanced' Button. + + +"Domain Users" group + + Now click on 'Groups', then double click on 'Power Users'. This will launch the panel to add users + or groups to the local machine 'Power Uses' group. Click on the 'Add' button, select the domain + from which the 'Domain Users' group is to be added, double click on the 'Domain Users' group, then + click on the 'Ok' button. Note: If a logon box is presented during this process please remember to + enter the connect as DOMAIN\UserName. ie: For the domain MIDEARTH and the user 'root' enter + MIDEARTH\root. + + + diff --git a/docs/docbook/projdoc/Integrating-with-Windows.xml b/docs/docbook/projdoc/Integrating-with-Windows.xml index 8d07b8a3fd..6beebfb892 100644 --- a/docs/docbook/projdoc/Integrating-with-Windows.xml +++ b/docs/docbook/projdoc/Integrating-with-Windows.xml @@ -7,6 +7,7 @@ Integrating MS Windows networks with Samba +NetBIOS This section deals with NetBIOS over TCP/IP name to IP address resolution. If your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this @@ -29,7 +30,7 @@ NetBIOS over TCP/IP then this section may help you to resolve networking problem Many MS Windows network administrators have never been exposed to basic TCP/IP -networking as it is implemented in a Unix/Linux operating system. Likewise, many Unix and +networking as it is implemented in a UNIX/Linux operating system. Likewise, many UNIX and Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP based networking (and may have no desire to be either). @@ -63,7 +64,9 @@ Name Service or WINS), TCP port 139 AND TCP port 445 (for actual file and print When NetBIOS over TCP/IP is disabled the use of DNS is essential. Most installations that disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS requires +DNSDynamic Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR). +DHCP Use of DHCP with ADS is recommended as a further means of maintaining central control over client workstation network configuration. @@ -71,7 +74,7 @@ over client workstation network configuration. -Name Resolution in a pure Unix/Linux world +Name Resolution in a pure UNIX/Linux world The key configuration files covered in this section are: @@ -91,10 +94,10 @@ The key configuration files covered in this section are: Contains a static list of IP addresses and names. eg: - - 127.0.0.1 localhost localhost.localdomain - 192.168.1.1 bigbox.caldera.com bigbox alias4box - + +127.0.0.1 localhost localhost.localdomain +192.168.1.1 bigbox.caldera.com bigbox alias4box + The purpose of /etc/hosts is to provide a @@ -111,6 +114,7 @@ Access Control address, or MAC address. IP addresses are currently numbers that are separated by a dot (or period). eg: 168.192.1.1. +MAC Addresses MAC Addresses use 48 bits (or 6 bytes) and are typically represented as two digit hexadecimal numbers separated by colons. eg: @@ -152,9 +156,10 @@ contain the MAC address and the primary IP address for each interface. +/etc/hosts The /etc/hosts file is foundational to all -Unix/Linux TCP/IP installations and as a minimum will contain +UNIX/Linux TCP/IP installations and as a minimum will contain the localhost and local network interface IP addresses and the primary names by which they are known within the local machine. This file helps to prime the pump so that a basic level of name @@ -195,6 +200,7 @@ This file tells the name resolution libraries: <filename>/etc/host.conf</filename> +/etc/host.conf /etc/host.conf is the primary means by which the setting in /etc/resolv.conf may be affected. It is a @@ -202,10 +208,10 @@ critical configuration file. This file controls the order by which name resolution may proceed. The typical structure is: - - order hosts,bind - multi on - + +order hosts,bind +multi on + then both addresses should be returned. Please refer to the @@ -220,34 +226,36 @@ man page for host.conf for further details. <filename>/etc/nsswitch.conf</filename> +/etc/nsswitch.conf + This file controls the actual name resolution targets. The file typically has resolver object specifications as follows: - - # /etc/nsswitch.conf - # - # Name Service Switch configuration file. - # + +# /etc/nsswitch.conf +# +# Name Service Switch configuration file. +# - passwd: compat - # Alternative entries for password authentication are: - # passwd: compat files nis ldap winbind - shadow: compat - group: compat +passwd: compat +# Alternative entries for password authentication are: +# passwd: compat files nis ldap winbind +shadow: compat +group: compat - hosts: files nis dns - # Alternative entries for host name resolution are: - # hosts: files dns nis nis+ hesiod db compat ldap wins - networks: nis files dns +hosts: files nis dns +# Alternative entries for host name resolution are: +# hosts: files dns nis nis+ hesiod db compat ldap wins +networks: nis files dns - ethers: nis files - protocols: nis files - rpc: nis files - services: nis files - +ethers: nis files +protocols: nis files +rpc: nis files +services: nis files + Of course, each of these mechanisms requires that the appropriate @@ -260,6 +268,8 @@ sent, TCP/IP networks are silent. All TCP/IP communications assumes a principal of speaking only when necessary. +libnss_wins.so + Starting with version 2.2.0 samba has Linux support for extensions to the name service switch infrastructure so that linux clients will @@ -301,21 +311,36 @@ the client/server. The following are typical NetBIOS name/service type registrations: - - Unique NetBIOS Names: - MACHINENAME<00> = Server Service is running on MACHINENAME - MACHINENAME<03> = Generic Machine Name (NetBIOS name) - MACHINENAME<20> = LanMan Server service is running on MACHINENAME - WORKGROUP<1b> = Domain Master Browser - - Group Names: - WORKGROUP<03> = Generic Name registered by all members of WORKGROUP - WORKGROUP<1c> = Domain Controllers / Netlogon Servers - WORKGROUP<1d> = Local Master Browsers - WORKGROUP<1e> = Internet Name Resolvers - - - + +Unique NetBIOS names + + + + +MACHINENAME<00>Server Service is running on MACHINENAME +MACHINENAME<03>Generic Machine Name (NetBIOS name) +MACHINENAME<20>LanMan Server service is running on MACHINENAME +WORKGROUP<1b>Domain Master Browser + + +
    + + +Group Names + + + + +WORKGROUP<03>Generic Name registered by all members of WORKGROUP +WORKGROUP<1c>Domain Controllers / Netlogon Servers +WORKGROUP<1d>Local Master Browsers +WORKGROUP<1e>Internet Name Resolvers + + +
    + + +NetBIOS It should be noted that all NetBIOS machines register their own names as per the above. This is in vast contrast to TCP/IP installations where traditionally the system administrator will @@ -323,6 +348,7 @@ determine in the /etc/hosts or in the DNS database what names are associated with each IP address. +NetBIOS One further point of clarification should be noted, the /etc/hosts file and the DNS records do not provide the NetBIOS name type information @@ -390,6 +416,8 @@ lookup will succeed, but the machine can not respond. This can be frustrating for users - but it is a characteristic of the protocol. +nbtstat +nmblookup The MS Windows utility that allows examination of the NetBIOS name cache is called "nbtstat". The Samba equivalent of this @@ -401,6 +429,7 @@ is called nmblookup. The LMHOSTS file +LMHOSTS This file is usually located in MS Windows NT 4.0 or 2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains @@ -413,84 +442,85 @@ to IP address mapping. It typically looks like: - - # Copyright (c) 1998 Microsoft Corp. - # - # This is a sample LMHOSTS file used by the Microsoft Wins Client (NetBIOS - # over TCP/IP) stack for Windows98 - # - # This file contains the mappings of IP addresses to NT computernames - # (NetBIOS) names. Each entry should be kept on an individual line. - # The IP address should be placed in the first column followed by the - # corresponding computername. The address and the computername - # should be separated by at least one space or tab. The "#" character - # is generally used to denote the start of a comment (see the exceptions - # below). - # - # This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts - # files and offers the following extensions: - # - # #PRE - # #DOM:<domain> - # #INCLUDE <filename> - # #BEGIN_ALTERNATE - # #END_ALTERNATE - # \0xnn (non-printing character support) - # - # Following any entry in the file with the characters "#PRE" will cause - # the entry to be preloaded into the name cache. By default, entries are - # not preloaded, but are parsed only after dynamic name resolution fails. - # - # Following an entry with the "#DOM:<domain>" tag will associate the - # entry with the domain specified by <domain>. This affects how the - # browser and logon services behave in TCP/IP environments. To preload - # the host name associated with #DOM entry, it is necessary to also add a - # #PRE to the line. The <domain> is always preloaded although it will not - # be shown when the name cache is viewed. - # - # Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT) - # software to seek the specified <filename> and parse it as if it were - # local. <filename> is generally a UNC-based name, allowing a - # centralized lmhosts file to be maintained on a server. - # It is ALWAYS necessary to provide a mapping for the IP address of the - # server prior to the #INCLUDE. This mapping must use the #PRE directive. - # In addition the share "public" in the example below must be in the - # LanManServer list of "NullSessionShares" in order for client machines to - # be able to read the lmhosts file successfully. This key is under - # \machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares - # in the registry. Simply add "public" to the list found there. - # - # The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE - # statements to be grouped together. Any single successful include - # will cause the group to succeed. - # - # Finally, non-printing characters can be embedded in mappings by - # first surrounding the NetBIOS name in quotations, then using the - # \0xnn notation to specify a hex value for a non-printing character. - # - # The following example illustrates all of these extensions: - # - # 102.54.94.97 rhino #PRE #DOM:networking #net group's DC - # 102.54.94.102 "appname \0x14" #special app server - # 102.54.94.123 popular #PRE #source server - # 102.54.94.117 localsrv #PRE #needed for the include - # - # #BEGIN_ALTERNATE - # #INCLUDE \\localsrv\public\lmhosts - # #INCLUDE \\rhino\public\lmhosts - # #END_ALTERNATE - # - # In the above example, the "appname" server contains a special - # character in its name, the "popular" and "localsrv" server names are - # preloaded, and the "rhino" server name is specified so it can be used - # to later #INCLUDE a centrally maintained lmhosts file if the "localsrv" - # system is unavailable. - # - # Note that the whole file is parsed including comments on each lookup, - # so keeping the number of comments to a minimum will improve performance. - # Therefore it is not advisable to simply add lmhosts file entries onto the - # end of this file. - + +# Copyright (c) 1998 Microsoft Corp. +# +# This is a sample LMHOSTS file used by the Microsoft Wins Client (NetBIOS +# over TCP/IP) stack for Windows98 +# +# This file contains the mappings of IP addresses to NT computernames +# (NetBIOS) names. Each entry should be kept on an individual line. +# The IP address should be placed in the first column followed by the +# corresponding computername. The address and the computername +# should be separated by at least one space or tab. The "#" character +# is generally used to denote the start of a comment (see the exceptions +# below). +# +# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts +# files and offers the following extensions: +# +# #PRE +# #DOM:<domain> +# #INCLUDE <filename> +# #BEGIN_ALTERNATE +# #END_ALTERNATE +# \0xnn (non-printing character support) +# +# Following any entry in the file with the characters "#PRE" will cause +# the entry to be preloaded into the name cache. By default, entries are +# not preloaded, but are parsed only after dynamic name resolution fails. +# +# Following an entry with the "#DOM:<domain>" tag will associate the +# entry with the domain specified by <domain>. This affects how the +# browser and logon services behave in TCP/IP environments. To preload +# the host name associated with #DOM entry, it is necessary to also add a +# #PRE to the line. The <domain> is always preloaded although it will not +# be shown when the name cache is viewed. +# +# Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT) +# software to seek the specified <filename> and parse it as if it were +# local. <filename> is generally a UNC-based name, allowing a +# centralized lmhosts file to be maintained on a server. +# It is ALWAYS necessary to provide a mapping for the IP address of the +# server prior to the #INCLUDE. This mapping must use the #PRE directive. +# In addition the share "public" in the example below must be in the +# LanManServer list of "NullSessionShares" in order for client machines to +# be able to read the lmhosts file successfully. This key is under +# \machine\system\currentcontrolset\services\lanmanserver\ +# parameters\nullsessionshares +# in the registry. Simply add "public" to the list found there. +# +# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE +# statements to be grouped together. Any single successful include +# will cause the group to succeed. +# +# Finally, non-printing characters can be embedded in mappings by +# first surrounding the NetBIOS name in quotations, then using the +# \0xnn notation to specify a hex value for a non-printing character. +# +# The following example illustrates all of these extensions: +# +# 102.54.94.97 rhino #PRE #DOM:networking #net group's DC +# 102.54.94.102 "appname \0x14" #special app server +# 102.54.94.123 popular #PRE #source server +# 102.54.94.117 localsrv #PRE #needed for the include +# +# #BEGIN_ALTERNATE +# #INCLUDE \\localsrv\public\lmhosts +# #INCLUDE \\rhino\public\lmhosts +# #END_ALTERNATE +# +# In the above example, the "appname" server contains a special +# character in its name, the "popular" and "localsrv" server names are +# preloaded, and the "rhino" server name is specified so it can be used +# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv" +# system is unavailable. +# +# Note that the whole file is parsed including comments on each lookup, +# so keeping the number of comments to a minimum will improve performance. +# Therefore it is not advisable to simply add lmhosts file entries onto the +# end of this file. + @@ -503,7 +533,7 @@ This file is usually located in MS Windows NT 4.0 or 2000 in the IP Address and the IP hostname in matched pairs. It can be used by the name resolution infrastructure in MS Windows, depending on how the TCP/IP environment is configured. This file is in -every way the equivalent of the Unix/Linux /etc/hosts file. +every way the equivalent of the UNIX/Linux /etc/hosts file. @@ -511,6 +541,8 @@ every way the equivalent of the Unix/Linux /etc/hosts file. DNS Lookup +DNS + This capability is configured in the TCP/IP setup area in the network configuration facility. If enabled, an elaborate name resolution sequence @@ -529,6 +561,8 @@ lookup is used. WINS Lookup +WINS + A WINS (Windows Internet Name Server) service is the equivalent of the rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores @@ -541,25 +575,28 @@ To configure Samba to be a WINS server the following parameter needs to be added to the &smb.conf; file: - - wins support = Yes - + +wins supportYes + To configure Samba to use a WINS server the following parameters are needed in the &smb.conf; file: - - wins support = No - wins server = xxx.xxx.xxx.xxx - + +wins supportNo +wins serverxxx.xxx.xxx.xxx + where xxx.xxx.xxx.xxx is the IP address of the WINS server. +For information about setting up Samba as a WINS server, read + the chapter on network browsing. +     @@ -573,11 +610,11 @@ carelessness. Of course, no one is every deliberately careless!     - My Boomerang Won't Come Back + Pinging works only in one way - Well, the real complaint said, "I can ping my samba server from Windows, but I can - not ping my Windows machine from the samba server." + I can ping my samba server from Windows, but I can + not ping my Windows machine from the samba server. @@ -614,9 +651,9 @@ carelessness. Of course, no one is every deliberately careless! Samba server name change problem - The name of the samba server was changed, samba was restarted, samba server can not be + The name of the samba server was changed, samba was restarted, samba server can not be pinged by new name from MS Windows NT4 Workstation, but it does still respond to ping using - the old name. Why? + the old name. Why? @@ -635,35 +672,35 @@ carelessness. Of course, no one is every deliberately careless! - - C:\temp\>nbtstat -n + +&dosprompt;nbtstat -n - NetBIOS Local Name Table + NetBIOS Local Name Table - Name Type Status - ------------------------------------------------ - SLACK <03> UNIQUE Registered - ADMINISTRATOR <03> UNIQUE Registered - SLACK <00> UNIQUE Registered - SARDON <00> GROUP Registered - SLACK <20> UNIQUE Registered - SLACK <1F> UNIQUE Registered + Name Type Status +------------------------------------------------ +&example.workstation.windows; <03> UNIQUE Registered +ADMINSTRATOR <03> UNIQUE Registered +&example.workstation.windows; <00> UNIQUE Registered +SARDON <00> GROUP Registered +&example.workstation.windows; <20> UNIQUE Registered +&example.workstation.windows; <1F> UNIQUE Registered - C:\Temp\>nbtstat -c +&dosprompt;nbtstat -c - NetBIOS Remote Cache Name Table + NetBIOS Remote Cache Name Table - Name Type Host Address Life [sec] - -------------------------------------------------------------- - FRODO <20> UNIQUE 192.168.1.1 240 + Name Type Host Address Life [sec] +-------------------------------------------------------------- +&example.server.samba; <20> UNIQUE 192.168.1.1 240 - C:\Temp\> - +&dosprompt; + - In the above example, FRODO is the Samba server and SLACK is the MS Windows NT4 Workstation. + In the above example, &example.server.samba; is the Samba server and &example.workstation.windows; is the MS Windows NT4 Workstation. The first listing shows the contents of the Local Name Table (i.e.: Identity information on the MS Windows workstation), the second shows the NetBIOS name in the NetBIOS name cache. The name cache contains the remote machines known to this workstation. diff --git a/docs/docbook/projdoc/InterdomainTrusts.xml b/docs/docbook/projdoc/InterdomainTrusts.xml index 31f9697bf3..04efc6fda6 100644 --- a/docs/docbook/projdoc/InterdomainTrusts.xml +++ b/docs/docbook/projdoc/InterdomainTrusts.xml @@ -2,17 +2,27 @@ &author.jht; &author.mimir; + &person.jelmer;drawing + + StephenLangasek + +
    vorlon@netexpress.net
    +     +     April 3, 2003     Interdomain Trust Relationships +Interdomain Trusts + Samba-3 supports NT4 style domain trust relationships. This is feature that many sites will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to adopt Active Directory or an LDAP based authentication back end. This section explains some background information regarding trust relationships and how to create them. It is now -possible for Samba-3 to NT4 trust (and vice versa), as well as Samba3 to Samba3 trusts. +possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba3-to-Samba3 +trusts. @@ -40,7 +50,7 @@ That was, after all, a key reason for the development and adoption of Microsoft MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure. The limitations of this architecture as it affects the scalability of MS Windows networking -in large organisations is well known. Additionally, the flat-name space that results from +in large organisations is well known. Additionally, the flat namespace that results from this design significantly impacts the delegation of administrative responsibilities in large and diverse organisations. @@ -74,6 +84,7 @@ transitive.     + New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is @@ -88,32 +99,37 @@ security domains in similar manner to MS Windows NT4 style domains. Native MS Windows NT4 Trusts Configuration -There are two steps to creating an interdomain trust relationship. +There are two steps to creating an interdomain trust relationship. To effect a two-way trust +relationship it is necessary for each domain administrator to create a trust account for the +other domain to use in verifying security credentials. + +Interdomain Trustscreating -NT4 as the Trusting Domain (ie. creating the trusted account) +Creating an NT4 Domain Trust For MS Windows NT4, all domain trust relationships are configured using the -Domain User Manager. To affect a two way trust relationship it is -necessary for each domain administrator to make available (for use by an external domain) it's -security resources. This is done from the Domain User Manager Policies entry on the menu bar. -From the Policy menu, select Trust Relationships, then -next to the lower box that is labelled Permitted to Trust this Domain are two -buttons, Add and Remove. The Add -button will open a panel in which needs to be entered the remote domain that will be able to assign -user rights to your domain. In addition it is necessary to enter a password -that is specific to this trust relationship. The password needs to be -typed twice (for standard confirmation). +Domain User Manager. This is done from the Domain User Manager Policies +entry on the menu bar. From the Policy menu, select +Trust Relationships. Next to the lower box labelled +Permitted to Trust this Domain are two buttons, Add +and Remove. The Add button will open a panel in which +to enter the name of the remote domain that will be able to assign access rights to users in +your domain. You will also need to enter a password for this trust relationship, which the +trusting domain will use when authenticating users from the trusted domain. +The password needs to be typed twice (for standard confirmation). + -NT4 as the Trusted Domain (ie. creating trusted account's password) +Completing an NT4 Domain Trust +Interdomain Trustscompleting A trust relationship will work only when the other (trusting) domain makes the appropriate connections with the trusted domain. To consummate the trust relationship the administrator will launch the Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the @@ -123,6 +139,92 @@ domain as well as the password assigned to that trust. + + +Inter-Domain Trust Facilities + +Interdomain TrustsFacilities + + +A two-way trust relationship is created when two one-way trusts are created, one in each direction. +Where a one-way trust has been established between two MS Windows NT4 domains (let's call them +DomA and DomB) the following facilities are created: + + +trusts1Trusts overview + + + + DomA (completes the trust connection) Trusts DomB + + + + DomA is the Trusting domain + + + + DomB is the Trusted domain (originates the trust account) + + + + Users in DomB can access resources in DomA + + + + Users in DomA can NOT access resources in DomB + + + + Global groups from DomB CAN be used in DomA + + + + Global groups from DomA can NOT be used in DomB + + + + DomB DOES appear in the logon dialog box on client workstations in DomA + + + + DomA does NOT appear in the logon dialog box on client workstations in DomB + + + + + + Users / Groups in a trusting domain can NOT be granted rights, permissions or access + to a trusted domain. + + + + The trusting domain CAN access and use accounts (Users / Global Groups) in the + trusted domain. + + + + Administrators of the trusted domain CAN be granted admininstrative rights in the + trusting domain. + + + + Users in a trusted domain CAN be given rights and privileges in the trusting + domain. + + + + Trusted domain Global Groups CAN be given rights and permissions in the trusting + domain. + + + + Global Groups from the trusted domain CAN be made members in Local Groups on + MS Windows domain member machines. + + + + + @@ -135,18 +237,19 @@ is in its early stage, so lot of things don't work yet. -Each of the procedures described below is treated as they were performed with Windows NT4 Server on -one end. The remote end could just as well be another Samba-3 domain. It can be clearly seen, after -reading this document, that combining Samba-specific parts of what's written below leads to trust -between domains in purely Samba environment. +Each of the procedures described below assumes the peer domain in the trust relationship is +controlled by a Windows NT4 server. However, the remote end could just as well be another +Samba-3 domain. It can be clearly seen, after reading this document, that combining +Samba-specific parts of what's written below leads to trust between domains in a purely Samba +environment. - -Samba-3 as the Trusting Domain + +Samba as the Trusted Domain -In order to set the Samba PDC to be the trusted party of the relationship first you need -to create special account for the domain that will be the trusting party. To do that, +In order to set the Samba PDC to be the trusted party of the relationship you first need +to create a special account for the domain that will be the trusting party. To do that, you can use the 'smbpasswd' utility. Creating the trusted domain account is very similar to creating a trusted machine account. Suppose, your domain is called SAMBA, and the remote domain is called RUMBA. The first step @@ -156,9 +259,9 @@ will be to issue this command from your favourite shell: &rootprompt; smbpasswd -a -i rumba - New SMB password: XXXXXXXX - Retype SMB password: XXXXXXXX - Added user rumba$ +New SMB password: XXXXXXXX +Retype SMB password: XXXXXXXX +Added user rumba$ where means to add a new account into the @@ -175,18 +278,20 @@ After issuing this command you'll be asked to enter the password for the account. You can use any password you want, but be aware that Windows NT will not change this password until 7 days following account creation. After the command returns successfully, you can look at the entry for the new account -(in the standard way depending on your configuration) and see that account's name is -really RUMBA$ and it has 'I' flag in the flags field. Now you're ready to confirm +(in the standard way as appropriate for your configuration) and see that account's name is +really RUMBA$ and it has the 'I' flag set in the flags field. Now you're ready to confirm the trust by establishing it from Windows NT Server. +User Manager + -Open User Manager for Domains and from menu -Policies select Trust Relationships.... -Right beside Trusted domains list box press the +Open User Manager for Domains and from the +Policies menu, select Trust Relationships.... +Right beside the Trusted domains list box press the Add... button. You will be prompted for the trusted domain name and the relationship password. Type in SAMBA, as this is -your domain name, and the password used at the time of account creation. +the name of the remote domain, and the password used at the time of account creation. Press OK and, if everything went without incident, you will see Trusted domain relationship successfully established message. @@ -194,7 +299,7 @@ established message. -Samba-3 as the Trusted Domain +Samba as the Trusting Domain This time activities are somewhat reversed. Again, we'll assume that your domain @@ -202,14 +307,16 @@ controlled by the Samba PDC is called SAMBA and NT-controlled domain is called R -The very first thing requirement is to add an account for the SAMBA domain on RUMBA's PDC. +The very first step is to add an account for the SAMBA domain on RUMBA's PDC. +User Manager + Launch the Domain User Manager, then from the menu select Policies, Trust Relationships. -Now, next to Trusted Domains box press the Add -button, and type in the name of the trusted domain (SAMBA) and password securing +Now, next to the Trusted Domains box press the Add +button, and type in the name of the trusted domain (SAMBA) and the password to use in securing the relationship. @@ -229,12 +336,12 @@ Using your favourite shell while being logged in as root, issue this command: You will be prompted for the password you just typed on your Windows NT4 Server box. -Do not worry if you see an error message that mentions a returned code of -NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the +Do not worry if you see an error message that mentions a return code of +NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the password you gave is correct and the NT4 Server says the account is ready for interdomain connection and not for ordinary -connection. After that, be patient it can take a while (especially -in large networks), you should see the Success message. +connection. After that, be patient; it can take a while (especially +in large networks), but eventually you should see the Success message. Congratulations! Your trust relationship has just been established. @@ -246,6 +353,34 @@ the secrets.tdb file. + +NT4-style Domain Trusts with Windows 2000 + +Although Domain User Manager is not present in Windows 2000, it is +also possible to establish an NT4-style trust relationship with a Windows 2000 domain +controller running in mixed mode as the trusting server. It should also be possible for +Samba to trust a Windows 2000 server, however, more testing is still needed in this area. + + + +After creating the interdomain trust account on the +Samba server as described above, open Active Directory Domains and +Trusts on the AD controller of the domain whose resources you wish Samba users +to have access to. Remember that since NT4-style trusts are not transitive, if you want +your users to have access to multiple mixed-mode domains in your AD forest, you will need to +repeat this process for each of those domains. With Active Directory Domains +and Trusts open, right-click on the name of the Active Directory domain that +will trust our Samba domain and choose Properties, then click on +the Trusts tab. In the upper part of the panel, you will see a list box +labelled Domains trusted by this domain:, and an +Add... button next to it. Press this button, and just as with NT4, you +will be prompted for the trusted domain name and the relationship password. Press OK, and +after a moment, Active Directory will respond with The trusted domain has +been added and the trust has been verified. Your Samba users can now be +granted acess to resources in the AD domain. + + + Common Errors @@ -255,39 +390,6 @@ or that suffer regular outages. Network stability and integrity are key concerns distributed trusted domains.     - - Tell me about Trust Relationships using Samba - - - Like many, I administer multiple LANs connected together using NT trust - relationships. This was implemented about 4 years ago. I now have the - occasion to consider performing this same task again, but this time, I - would like to implement it solely through samba - no Microsoft PDCs - anywhere. - - - - I have read documentation on samba.org regarding NT-style trust - relationships and am now wondering, can I do what I want to? I already - have successfully implemented 2 samba servers, but they are not PDCs. - They merely act as file servers. I seem to remember, and it appears to - be true (according to samba.org) that trust relationships are a - challenge. - - - - Please provide any helpful feedback that you may have. - - - - These are almost complete in Samba 3.0 snapshots. The main catch - is getting winbindd to be able to allocate UID/GIDs for trusted - users/groups. See the updated Samba HOWTO collection for more - details. - - - - diff --git a/docs/docbook/projdoc/NT4Migration.xml b/docs/docbook/projdoc/NT4Migration.xml index 8c2d0e19f3..36bafee2af 100644 --- a/docs/docbook/projdoc/NT4Migration.xml +++ b/docs/docbook/projdoc/NT4Migration.xml @@ -38,25 +38,24 @@ pressure to return to a Microsoft based platform solution at the first sign of t     -It is strongly advised that before attempting a migration to a Samba-3 controlled network -that every possible effort be made to gain all-round commitment to the change. Firstly, you -should know precisely why the change is important for the organisation. -Possible motivations to make a change include: +Before attempting a migration to a Samba-3 controlled network make every possible effort to +gain all-round commitment to the change. Know precisely why the change +is important for the organisation. Possible motivations to make a change include: - - Improve network manageability - Obtain better user level functionality - Reduce network operating costs - Reduce exposure caused by Microsoft withdrawal of NT4 support - Avoid MS License 6 implications - Reduce organisation's dependency on Microsoft - + + Improve network manageability + Obtain better user level functionality + Reduce network operating costs + Reduce exposure caused by Microsoft withdrawal of NT4 support + Avoid MS License 6 implications + Reduce organisation's dependency on Microsoft + -It is vital that it be well recognised that Samba-3 is NOT MS Windows NT4. Samba-3 offers -an alternative solution that is both different from MS Windows NT4 and that offers some -advantages compared with it. It should also be recognised that Samba-3 lacks many of the +Make sure that everyone knows that Samba-3 is NOT MS Windows NT4. Samba-3 offers +an alternative solution that is both different from MS Windows NT4 and that offers +advantages compared with it. Gain recognition that Samba-3 lacks many of the features that Microsoft has promoted as core values in migration from MS Windows NT4 to MS Windows 2000 and beyond (with or without Active Directory services). @@ -65,37 +64,37 @@ MS Windows 2000 and beyond (with or without Active Directory services). What are the features that Samba-3 can NOT provide? - - Active Directory Server - Group Policy Objects (in Active Directory) - Machine Policy objects - Logon Scripts in Active Directory - Software Application and Access Controls in Active Directory - + + Active Directory Server + Group Policy Objects (in Active Directory) + Machine Policy objects + Logon Scripts in Active Directory + Software Application and Access Controls in Active Directory + The features that Samba-3 DOES provide and that may be of compelling interest to your site includes: - - Lower Cost of Ownership - Global availability of support with no strings attached - Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system) - Creation of on-the-fly logon scripts - Creation of on-the-fly Policy Files - Greater Stability, Reliability, Performance and Availability - Manageability via an ssh connection - Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam) - Ability to implement a full single-sign-on architecture - Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand - + + Lower Cost of Ownership + Global availability of support with no strings attached + Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system) + Creation of on-the-fly logon scripts + Creation of on-the-fly Policy Files + Greater Stability, Reliability, Performance and Availability + Manageability via an ssh connection + Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam) + Ability to implement a full single-sign-on architecture + Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand + -Before migrating a network from MS Windows NT4 to Samba-3 it is vital that all necessary factors are -considered. Users should be educated about changes they may experience so that the change will be a -welcome one and not become an obstacle to the work they need to do. The following are some of the -factors that will go into a successful migration: +Before migrating a network from MS Windows NT4 to Samba-3 consider all necessary factors. Users +should be educated about changes they may experience so that the change will be a welcome one +and not become an obstacle to the work they need to do. The following are factors that will +help ensure a successful migration: @@ -106,26 +105,25 @@ Samba-3 can be configured as a domain controller, a back-up domain controller (p a secondary controller), a domain member, or as a stand-alone server. The Windows network security domain context should be sized and scoped before implementation. Particular attention needs to be paid to the location of the primary domain controller (PDC) as well as backup controllers (BDCs). -It should be noted that one way in which Samba-3 differs from Microsoft technology is that if one -chooses to use an LDAP authentication backend then the same database can be used by several different -domains. This means that in a complex organisation there can be a single LDAP database, that itself -can be distributed, that can simultaneously serve multiple domains (that can also be widely distributed). +One way in which Samba-3 differs from Microsoft technology is that if one chooses to use an LDAP +authentication backend then the same database can be used by several different domains. In a +complex organisation there can be a single LDAP database, which itself can be distributed (ie: Have +a master server and multiple slave servers) that can simultaneously serve multiple domains. -It is recommended that from a design perspective, the number of users per server, as well as the number -of servers, per domain should be scaled according to needs and should also consider server capacity -and network bandwidth. +From a design perspective, the number of users per server, as well as the number of servers, per +domain should be scaled taking into consideration server capacity and network bandwidth. -A physical network segment may house several domains, each of which may span multiple network segments. -Where domains span routed network segments it is most advisable to consider and test the performance -implications of the design and layout of a network. A Centrally located domain controller that is being -designed to serve multiple routed network segments may result in severe performance problems if the -response time (eg: ping timing) between the remote segment and the PDC is more than 100 ms. In situations -where the delay is too long it is highly recommended to locate a backup controller (BDC) to serve as -the local authentication and access control server. +A physical network segment may house several domains. Each may span multiple network segments. +Where domains span routed network segments, consider and test the performance implications of +the design and layout of a network. A Centrally located domain controller that is designed to +serve multiple routed network segments may result in severe performance problems. Check the +response time (eg: ping timing) between the remote segment and the PDC. If long (more than 100 ms) +locate a backup controller (BDC) on the remote segmanet to serve as the local authentication and +access control server. @@ -133,18 +131,17 @@ the local authentication and access control server. Server Share and Directory Layout -There are few cardinal rules to effective network design that can be broken with impunity. -The most important rule of effective network management is that simplicity is king in every -well controlled network. Every part of the infrastructure must be managed, the more complex -it is, the greater will be the demand of keeping systems secure and functional. +There are cardinal rules to effective network design. These can not be broken with impunity. +The most important rule: Simplicity is king in every well controlled network. Every part of +the infrastructure must be managed, the more complex it is, the greater will be the demand +of keeping systems secure and functional. -The nature of the data that must be stored needs to be born in mind when deciding how many -shares must be created. The physical disk space layout should also be taken into account -when designing where share points will be created. Keep in mind that all data needs to be -backed up, thus the simpler the disk layout the easier it will be to keep track of what must -be backed up to tape or other off-line storage medium. Always plan and implement for minimum +Keep in mind the nature of how data must be share. Physical disk space layout should be considered +carefully. Some data must be backed up. The simpler the disk layout the easier it will be to +keep track of backed needs. Identify what back media will be meet needs, consider backup to tape +, CD-ROM or (DVD-ROM), or other off-line storage medium. Plan and implement for minimum maintenance. Leave nothing to chance in your design, above all, do not leave backups to chance: Backup and test, validate every backup, create a disaster recovery plan and prove that it works. @@ -156,13 +153,14 @@ directories may substantially avoid file access complaints from samba share user -Many network administrators who are new to the game will attempt to use elaborate techniques -to set access controls, on files, directories, shares, as well as in share definitions. -There is the ever present danger that that administrator's successor will not understand the -complex mess that has been inherited. Remember, apparent job security through complex design -and implementation may ultimately cause loss of operations and downtime to users as the new -administrator learns to untangle your web. Keep access controls simple and effective and -make sure that users will never be interrupted by the stupidity of complexity. +Inexperienced network administrators often attempt elaborate techniques to set access +controls on files, directories, shares, as well as in share definitions. +Keep your design and implementation simple and document your design extensively. Have others +audit your documentation. Do not create a complex mess that your successor will not understand. +Remember, job security through complex design and implementation may cause loss of operations +and downtime to users as the new administrator learns to untangle your knots. Keep access +controls simple and effective and make sure that users will never be interrupted by stupid +complexity. @@ -170,16 +168,14 @@ make sure that users will never be interrupted by the stupidity of complexity. Logon Scripts -Please refer to the section of this document on Advanced Network Administration for information -regarding the network logon script options for Samba-3. Logon scripts can help to ensure that -all users gain share and printer connections they need. +Logon scripts can help to ensure that all users gain share and printer connections they need. -Logon scripts can be created on-the-fly so that all commands executed are specific to the -rights and privileges granted to the user. The preferred controls should be affected through +Logon scripts can be created 'on-the-fly' so that all commands executed are specific to the +rights and priviliges granted to the user. The preferred controls should be affected through group membership so that group information can be used to custom create a logon script using -the root preexec parameters to the NETLOGON share. +the root preexec parameters to the NETLOGON share. @@ -211,8 +207,8 @@ to be changed to the SID of the Samba-3 domain. It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before attempting to migrate user and group accounts it is STRONGLY advised to create in Samba-3 the -groups that are present on the MS Windows NT4 domain AND to connect these to -suitable Unix/Linux groups. Following this simple advice will mean that all user and group attributes +groups that are present on the MS Windows NT4 domain AND to map these to +suitable Unix/Linux groups. By following this simple advice all user and group attributes should migrate painlessly. @@ -232,7 +228,8 @@ You will have an NT4 PDC that has the users, groups, policies and profiles to be -Samba-3 set up as a DC with netlogon share, profile share, etc. +Samba-3 set up as a DC with netlogon share, profile share, etc. Configure the &smb.conf; file +to fucntion as a BDC. ie: domain master = No. @@ -240,23 +237,6 @@ Samba-3 set up as a DC with netlogon share, profile share, etc. Create a BDC account for the samba server using NT Server Manager Samba must NOT be running - - rpcclient NT4PDC -U Administrator%passwd - lsaquery - Note the SID returned - - - - net getsid -S NT4PDC -w DOMNAME -U Administrator%passwd - Note the SID - - - net getlocalsid - - Note the SID, now check that all three SIDS reported are the same! - - - net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd net rpc vampire -S NT4PDC -U administrator%passwd @@ -265,24 +245,33 @@ Samba-3 set up as a DC with netlogon share, profile share, etc. Note - did the users migrate? - initGrps.sh DOMNAME + + Now assign each of the UNIX groups to NT groups: + (Note: It may be useful to copy this text to a script called + initGroups.sh) + +#!/bin/bash +#### Keep this as a shell script for future re-use + +# First assign well known domain global groups +net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmins +net groupmap modify ntgroup="Domain Guests" unixgroup=nobody +net groupmap modify ntgroup="Domain Users" unixgroup=users + +# Now for our added domain global groups +net groupmap add ntgroup="Designers" unixgroup=designers type=d rid=3200 +net groupmap add ntgroup="Engineers" unixgroup=engineers type=d rid=3210 +net groupmap add ntgroup="QA Team" unixgroup=qateam type=d rid=3220 + + net groupmap list Now check that all groups are recognised - - net rpc vampire -S NT4PDC -U administrator%passwd - - pdbedit -Lv - - Note - check that all group membership has been migrated - - -Now it is time to migrate all the profiles, then migrate all policy files. -More later. +Now migrate all the profiles, then migrate all policy files. @@ -292,13 +281,14 @@ More later. Migration Options -Based on feedback from many sites as well as from actual installation and maintenance -experience sites that wish to migrate from MS Windows NT4 Domain Control to a Samba -based solution fit into three basic categories. +Sites that wish to migrate from MS Windows NT4 Domain Control to a Samba based solution +generally fit into three basic categories. The 3 Major Site Types + + Number of UsersDescription @@ -333,7 +323,7 @@ to Samba-3. -No matter what choice you make, the following rules will minimise down-stream problems: +Minimise down-stream problems by: @@ -354,8 +344,11 @@ No matter what choice you make, the following rules will minimise down-stream pr -
    Nature of the Conversion Choices +
    Nature of the Conversion Choices + + + SimpleUpgradedRedesign @@ -396,68 +389,103 @@ No matter what choice you make, the following rules will minimise down-stream pr -Samba Implementation Choices - - - -Authentication database back end - Winbind (external Samba or NT4/200x server) - Can use pam_mkhomedir.so to auto-create home dirs - External server could use Active Directory or NT4 Domain - -Database type - smbpasswd, tdbsam, ldapsam, mysqlsam - -Access Control Points - On the Share itself (Use NT4 Server Manager) - On the file system - Unix permissions on files and directories - Enable Posix ACLs in file system? - Through Samba share parameters - Not recommended - except as only resort - -Policies (migrate or create new ones) - Group Policy Editor (NT4) - Watch out for Tattoo effect - -User and Group Profiles - Platform specific so use platform tool to change from a Local - to a Roaming profile Can use new profiles tool to change SIDs - (NTUser.DAT) - -Logon Scripts (Know how they work) - -User and Group mapping to Unix/Linux - username map facility may be needed - Use 'net groupmap' to connect NT4 groups to Unix groups - Use pdbedit to set/change user configuration -NOTE: -If migrating to LDAP back end it may be easier to dump initial LDAP database -to LDIF, then edit, then reload into LDAP - - OS specific scripts / programs may be needed - Add / delete Users - Note OS limits on size of name (Linux 8 chars) - NT4 up to 254 chars - Add / delete machines - Applied only to domain members (note up to 16 chars) - Add / delete Groups - Note OS limits on size and nature - Linux limit is 16 char, - no spaces and no upper case chars (groupadd) - -Migration Tools - Domain Control (NT4 Style) - Profiles, Policies, Access Controls, Security - -Migration Tools - Samba: net, rpcclient, smbpasswd, pdbedit, profiles - Windows: NT4 Domain User Manager, Server Manager (NEXUS) - -Authentication - New SAM back end (smbpasswd, tdbsam, ldapsam, mysqlsam) - - +Samba-3 Implementation Choices + + + Authentication database/back end: + + Samba-3 can use an external authentication backend: + + + + + Winbind (external Samba or NT4/200x server) + External server could use Active Directory or NT4 Domain + Can use pam_mkhomedir.so to auto-create home dirs + + + + + Samba-3 can use a local authentication backend: + + smbpasswd, tdbsam, ldapsam, mysqlsam + + + + + + Access Control Points: + + On the Share itself - using Share ACLs + On the file system - using UNIX permissions on files and directories + Note: Can Enable Posix ACLs in file system also + Through Samba share parameters - Not recommended - except as last resort + + + + + Policies (migrate or create new ones): + + Using Group Policy Editor (NT4) + - Watch out for Tattoo effect + + + + + User and Group Profiles: + + Platform specific so use platform tool to change from a Local to a Roaming profile + Can use new profiles tool to change SIDs (NTUser.DAT) + + + + + Logon Scripts: + + Know how they work + + + + + User and Group mapping to Unix/Linux: + + username map facility may be needed + Use 'net groupmap' to connect NT4 groups to Unix groups + Use pdbedit to set/change user configuration + + + NOTE: When migrating to LDAP back, end it may be easier to dump initial + LDAP database to LDIF, then edit, then reload into LDAP + + + + + + + OS specific scripts/programs may be needed: + + Add/Delete Users: Note OS limits on size of name + (Linux 8 chars) NT4 up to 254 chars + Add/Delete Machines: Applied only to domain members + (Note: Machine names may be limited to 16 characters) + Use 'net groupmap' to connect NT4 groups to Unix groups + Add/Delete Groups: Note OS limits on size and nature. + Linux limit is 16 char, no spaces and no upper case chars (groupadd) + + + + + Migration Tools: + + Domain Control (NT4 Style) Profiles, Policies, Access Controls, Security + + Samba: net, rpcclient, smbpasswd, pdbedit, profiles + Windows: NT4 Domain User Manager, Server Manager (NEXUS) + + + + + diff --git a/docs/docbook/projdoc/NetworkBrowsing.xml b/docs/docbook/projdoc/NetworkBrowsing.xml index c87ede5906..2db154be33 100644 --- a/docs/docbook/projdoc/NetworkBrowsing.xml +++ b/docs/docbook/projdoc/NetworkBrowsing.xml @@ -1,6 +1,7 @@ &author.jht; + &author.jelmer; July 5, 1998 Updated: April 21, 2003 @@ -31,6 +32,8 @@ they were the best of times. The more we look back, them more we long for what w hope it never returns!. +NetBIOS + For many MS Windows network administrators, that statement sums up their feelings about NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle @@ -64,7 +67,7 @@ help Samba to affect stable WINS operations beyond the normal scope of MS WINS. Please note that WINS is exclusively a service that applies only to those systems that run NetBIOS over TCP/IP. MS Windows 200x / XP have the capacity to turn off -support for NetBIOS, in which case WINS is of no relevance. Samba-3 supports this also. +support for NetBIOS, in which case WINS is of no relevance. Samba supports this also. @@ -88,46 +91,43 @@ What seems so simple is in fact a very complex interaction of different technolo The technologies (or methods) employed in making all of this work includes: - - MS Windows machines register their presence to the network - Machines announce themselves to other machines on the network - One or more machine on the network collates the local announcements - The client machine finds the machine that has the collated list of machines - The client machine is able to resolve the machine names to IP addresses - The client machine is able to connect to a target machine - + + MS Windows machines register their presence to the network + Machines announce themselves to other machines on the network + One or more machine on the network collates the local announcements + The client machine finds the machine that has the collated list of machines + The client machine is able to resolve the machine names to IP addresses + The client machine is able to connect to a target machine + The Samba application that controls browse list management and name resolution is called nmbd. The configuration parameters involved in nmbd's operation are: - - - Browsing options: - ----------------- - * os level - lm announce - lm interval - * preferred master - * local master - * domain master - browse list - enhanced browsing - - Name Resolution Method: - ----------------------- - * name resolve order - - WINS options: - ------------- - dns proxy - wins proxy - * wins server - * wins support - wins hook - +Browsing options: os level(*), + lm announce, + lm interval, + preferred master(*), + local master(*), + domain master(*), + browse list, + enhanced browsing. + + +Name Resolution Method: + name resolve order(*). + + +WINS options: + dns proxy, + wins proxy, + wins server(*), + wins support(*), + wins hook. + +WINS For Samba, the WINS Server and WINS Support are mutually exclusive options. Those marked with an '*' are the only options that commonly MAY need to be modified. Even if not one of these @@ -156,11 +156,13 @@ affect browse list management. When running NetBIOS over TCP/IP, this uses UDP b UDP messages can be broadcast or unicast. +UDP + Normally, only unicast UDP messaging can be forwarded by routers. The -remote announce parameter to smb.conf helps to project browse announcements +remote announce parameter to smb.conf helps to project browse announcements to remote network segments via unicast UDP. Similarly, the -remote browse sync parameter of smb.conf +remote browse sync parameter of &smb.conf; implements browse list collation using unicast UDP. @@ -170,14 +172,15 @@ wherever possible nmbd should be configured on one (1) mach server. This makes it easy to manage the browsing environment. If each network segment is configured with it's own Samba WINS server, then the only way to get cross segment browsing to work is by using the -remote announce and the remote browse sync -parameters to your smb.conf file. +remote announce and the remote browse sync +parameters to your &smb.conf; file. +WINS If only one WINS server is used for an entire multi-segment network then -the use of the remote announce and the -remote browse sync parameters should NOT be necessary. +the use of the remote announce and the +remote browse sync parameters should NOT be necessary. @@ -192,7 +195,7 @@ Right now Samba WINS does not support MS-WINS replication. This means that when setting up Samba as a WINS server there must only be one nmbd configured as a WINS server on the network. Some sites have used multiple Samba WINS servers for redundancy (one server per subnet) and then used -remote browse sync and remote announce +remote browse sync and remote announce to affect browse list collation across all segments. Note that this means clients will only resolve local names, and must be configured to use DNS to resolve names on other subnets in order to resolve the IP addresses of the servers they can see @@ -213,6 +216,9 @@ minutes to stabilise, particularly across network segments. TCP/IP - without NetBIOS +NetBIOS +NetBIOS-less +DNS All TCP/IP using systems use various forms of host name resolution. The primary methods for TCP/IP hostname resolutions involves either a static file (/etc/hosts ) or DNS (the Domain Name System). DNS is the technology that makes @@ -253,6 +259,8 @@ it follows a defined path: +DNS + Windows 200x / XP can register it's host name with a Dynamic DNS server. You can force register with a Dynamic DNS server in Windows 200x / XP using: @@ -277,8 +285,10 @@ records that are needed for Active Directory. DNS and Active Directory +DNSActive Directory + -Occasionally we hear from Unix network administrators who want to use a Unix based Dynamic +Occasionally we hear from UNIX network administrators who want to use a UNIX based Dynamic DNS server in place of the Microsoft DNS server. While this might be desirable to some, the MS Windows 200x DNS server is auto-configured to work with Active Directory. It is possible to use BIND version 8 or 9, but it will almost certainly be necessary to create service records @@ -353,7 +363,7 @@ resolution to the local subnet, unless LMHOSTS is used to list all names and IP addresses. In such situations Samba provides a means by which the Samba server name may be forcibly injected into the browse list of a remote MS Windows network (using the -remote announce parameter). +remote announce parameter). @@ -391,14 +401,12 @@ inability to use the network services. Samba supports a feature that allows forced synchronisation -of browse lists across routed networks using the remote -browse sync parameter in the smb.conf file. +of browse lists across routed networks using the remote browse sync parameter in the &smb.conf; file. This causes Samba to contact the local master browser on a remote network and to request browse list synchronisation. This effectively bridges two networks that are separated by routers. The two remote networks may use either broadcast based name resolution or WINS -based name resolution, but it should be noted that the remote -browse sync parameter provides browse list synchronisation - and +based name resolution, but it should be noted that the remote browse sync parameter provides browse list synchronisation - and that is distinct from name to address resolution, in other words, for cross subnet browsing to function correctly it is essential that a name to address resolution mechanism be provided. @@ -406,7 +414,7 @@ This mechanism could be via DNS, /etc/hosts, and so on. - + Setting up WORKGROUP Browsing @@ -427,29 +435,31 @@ cross subnet browsing possible for a workgroup. In an WORKGROUP environment the domain master browser must be a Samba server, and there must only be one domain master browser per workgroup name. To set up a Samba server as a domain master browser, -set the following option in the [global] section +set the following option in the [global] section of the &smb.conf; file : - - domain master = yes - + +domain masteryes + -The domain master browser should also preferrably be the local master +The domain master browser should also preferably be the local master browser for its own subnet. In order to achieve this set the following -options in the [global] section of the &smb.conf; file : +options in the [global] section of the &smb.conf; file : - - domain master = yes - local master = yes - preferred master = yes - os level = 65 - + + Domain master browser smb.conf + [global] +domain masteryes +local masteryes +preferred masteryes +os level65 + @@ -464,17 +474,19 @@ workgroup. Any MS Windows NT/2K/XP/2003 machine should be able to do this, as will Windows 9x machines (although these tend to get rebooted more often, so it's not such a good idea to use these). To make a Samba server a local master browser -set the following options in the [global] section of the +set the following options in the [global] section of the &smb.conf; file : - - domain master = no - local master = yes - preferred master = yes - os level = 65 - + + Local master browser smb.conf + [global] +domain masterno +local masteryes +preferred masteryes +os level65 + @@ -484,9 +496,9 @@ master browser. -The local master parameter allows Samba to act as a -local master browser. The preferred master causes nmbd -to force a browser election on startup and the os level +The local master parameter allows Samba to act as a +local master browser. The preferred master causes nmbd +to force a browser election on startup and the os level parameter sets Samba high enough so that it should win any browser elections. @@ -494,17 +506,19 @@ parameter sets Samba high enough so that it should win any browser elections. If you have an NT machine on the subnet that you wish to be the local master browser then you can disable Samba from becoming a local master browser by setting the following -options in the [global] section of the +options in the [global] section of the &smb.conf; file : - - domain master = no - local master = no - preferred master = no - os level = 0 - + + smb.conf for not being a master browser + [global] +domain masterno +local masterno +preferred masterno +os level0 + @@ -526,22 +540,24 @@ with WINS instead of the PDC. For subnets other than the one containing the Windows NT PDC you may set up Samba servers as local master browsers as described. To make a Samba server a local master browser set -the following options in the [global] section +the following options in the [global] section of the &smb.conf; file : - - domain master = no - local master = yes - preferred master = yes - os level = 65 - + + Local master browser smb.conf + [global] +domain masterno +local masteryes +preferred masteryes +os level65 + If you wish to have a Samba server fight the election with machines -on the same subnet you may set the os level parameter +on the same subnet you may set the os level parameter to lower levels. By doing this you can tune the order of machines that will become local master browsers if they are running. For more details on this see the section @@ -554,17 +570,19 @@ If you have Windows NT machines that are members of the domain on all subnets, and you are sure they will always be running then you can disable Samba from taking part in browser elections and ever becoming a local master browser by setting following options -in the [global] section of the &smb.conf; +in the [global] section of the &smb.conf; file : - - domain master = no - local master = no - preferred master = no - os level = 0 - + + smb.conf for not being a master browser + [global] +domain masterno +local masterno +preferred masterno +os level0 + @@ -573,7 +591,7 @@ file : Forcing Samba to be the master -Who becomes the master browser is determined by an election +Who becomes the master browser is determined by an election process using broadcasts. Each election packet contains a number of parameters which determine what precedence (bias) a host should have in the election. By default Samba uses a very low precedence and thus loses @@ -581,14 +599,14 @@ elections to just about anyone else. -If you want Samba to win elections then just set the os level global +If you want Samba to win elections then just set the os level global option in &smb.conf; to a higher number. It defaults to 0. Using 34 would make it win all elections over every other system (except other samba systems!) -A os level of 2 would make it beat WfWg and Win95, but not MS Windows +A os level of 2 would make it beat WfWg and Win95, but not MS Windows NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32. @@ -596,18 +614,18 @@ NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32. If you want Samba to force an election on startup, then set the -preferred master global option in &smb.conf; to yes. Samba will +preferred master global option in &smb.conf; to yes. Samba will then have a slight advantage over other potential master browsers that are not preferred master browsers. Use this parameter with care, as if you have two hosts (whether they are Windows 95 or NT or -Samba) on the same local subnet both set with preferred master to +Samba) on the same local subnet both set with preferred master to yes, then periodically and continually they will force an election in order to become the local master browser. -If you want Samba to be a domain master browser, then it is -recommended that you also set preferred master to yes, because + If you want Samba to be a domain master browser, then it is +recommended that you also set preferred master to yes, because Samba will not become a domain master browser for the whole of your LAN or WAN if it is not also a local master browser on its own broadcast isolated subnet. @@ -631,7 +649,7 @@ the current domain master browser fail. The domain master is responsible for collating the browse lists of multiple subnets so that browsing can occur between subnets. You can -make Samba act as the domain master by setting domain master = yes +make Samba act as the domain master by setting domain masteryes in &smb.conf;. By default it will not be a domain master. @@ -649,8 +667,8 @@ browse lists. If you want Samba to be the domain master then I suggest you also set -the os level high enough to make sure it wins elections, and set -preferred master to yes, to get Samba to force an election on +the os level high enough to make sure it wins elections, and set +preferred master to yes, to get Samba to force an election on startup. @@ -720,30 +738,34 @@ that browsing and name lookups won't work. Samba now supports machines with multiple network interfaces. If you -have multiple interfaces then you will need to use the interfaces +have multiple interfaces then you will need to use the interfaces option in &smb.conf; to configure them. Use of the Remote Announce parameter -The remote announce parameter of -smb.conf can be used to forcibly ensure +The remote announce parameter of +&smb.conf; can be used to forcibly ensure that all the NetBIOS names on a network get announced to a remote network. -The syntax of the remote announce parameter is: - - remote announce = a.b.c.d [e.f.g.h] ... - +The syntax of the remote announce parameter is: + +remote announcea.b.c.d [e.f.g.h] ... + or - - remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ... - + +remote announcea.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ... + where: a.b.c.d and e.f.g.h -is either the LMB (Local Master Browser) IP address + + LMBLocal Master Browser +Local Master Browser + + is either the LMB (Local Master Browser) IP address or the broadcast address of the remote network. ie: the LMB is at 192.168.1.10, or the address could be given as 192.168.1.255 where the netmask @@ -774,19 +796,19 @@ name resolution problems and should be avoided. Use of the Remote Browse Sync parameter -The remote browse sync parameter of -smb.conf is used to announce to +The remote browse sync parameter of +&smb.conf; is used to announce to another LMB that it must synchronise its NetBIOS name list with our Samba LMB. It works ONLY if the Samba server that has this option is simultaneously the LMB on its network segment. -The syntax of the remote browse sync parameter is: +The syntax of the remote browse sync parameter is: - -remote browse sync = a.b.c.d - + +remote browse synca.b.c.d + where a.b.c.d is either the IP address of the remote LMB or else is the network broadcast address of the remote segment. @@ -850,18 +872,18 @@ errors. To configure Samba as a WINS server just add -wins support = yes to the smb.conf -file [globals] section. +wins supportyes to the &smb.conf; +file [global] section. To configure Samba to register with a WINS server just add -wins server = a.b.c.d to your &smb.conf; file [globals] section. +wins servera.b.c.d to your &smb.conf; file [global] section. -Never use both wins support = yes together -with wins server = a.b.c.d +Never use both wins supportyes together +with wins servera.b.c.d particularly not using it's own IP address. Specifying both will cause &nmbd; to refuse to start! @@ -873,13 +895,13 @@ Specifying both will cause &nmbd; to refuse to start! Either a Samba machine or a Windows NT Server machine may be set up as a WINS server. To set a Samba machine to be a WINS server you must add the following option to the &smb.conf; file on the selected machine : -in the [globals] section add the line +in the [global] section add the line - - wins support = yes - + +wins supportyes + @@ -890,13 +912,13 @@ least set the parameter to 'no' on all these machines. -Machines with wins support = yes will keep a list of +Machines with wins supportyes will keep a list of all NetBIOS names registered with them, acting as a DNS for NetBIOS names. You should set up only ONE WINS server. Do NOT set the -wins support = yes option on more than one Samba +wins supportyes option on more than one Samba server. @@ -910,7 +932,7 @@ participate in these replications. It is possible in the future that a Samba->Samba WINS replication protocol may be defined, in which case more than one Samba machine could be set up as a WINS server but currently only one Samba server should have the -wins support = yes parameter set. +wins supportyes parameter set. @@ -920,14 +942,14 @@ of this WINS server. If your WINS server is a Samba machine, fill in the Samba machine IP address in the Primary WINS Server field of the Control Panel->Network->Protocols->TCP->WINS Server dialogs in Windows 95 or Windows NT. To tell a Samba server the IP address -of the WINS server add the following line to the [global] section of +of the WINS server add the following line to the [global] section of all &smb.conf; files : - - wins server = <name or IP address> - + +wins server<name or IP address> + @@ -938,8 +960,8 @@ machine or its IP address. Note that this line MUST NOT BE SET in the &smb.conf; file of the Samba server acting as the WINS server itself. If you set both the -wins support = yes option and the -wins server = <name> option then +wins supportyes option and the +wins server<name> option then nmbd will fail to start. @@ -968,7 +990,7 @@ section of the documentation to provide usage and technical details. Static WINS Entries -Adding static entries to your Samba-3 WINS server is actually fairly easy. +Adding static entries to your Samba WINS server is actually fairly easy. All you have to do is add a line to wins.dat, typically located in /usr/local/samba/var/locks. @@ -1072,37 +1094,36 @@ of methods. The only ones that can provide NetBIOS name_type information are: - - WINS: the best tool! - LMHOSTS: is static and hard to maintain. - Broadcast: uses UDP and can not resolve names across remote segments. - + + WINS: the best tool! + LMHOSTS: is static and hard to maintain. + Broadcast: uses UDP and can not resolve names across remote segments. + Alternative means of name resolution includes: - -/etc/hosts: is static, hard to maintain, and lacks name_type info -DNS: is a good choice but lacks essential name_type info. - + +/etc/hosts: is static, hard to maintain, and lacks name_type info +DNS: is a good choice but lacks essential name_type info. + Many sites want to restrict DNS lookups and want to avoid broadcast name -resolution traffic. The name resolve order parameter is -of great help here. The syntax of the name resolve order -parameter is: - -name resolve order = wins lmhosts bcast host - +resolution traffic. The name resolve order parameter is of great help here. +The syntax of the name resolve order parameter is: + +name resolve orderwins lmhosts bcast host + or - -name resolve order = wins lmhosts (eliminates bcast and host) - + +name resolve orderwins lmhosts (eliminates bcast and host) + The default is: - -name resolve order = host lmhost wins bcast - -where "host" refers the the native methods used by the Unix system + +name resolve orderhost lmhost wins bcast + +where "host" refers to the native methods used by the UNIX system to implement the gethostbyname() function call. This is normally controlled by /etc/host.conf, /etc/nsswitch.conf and /etc/resolv.conf. @@ -1114,7 +1135,7 @@ controlled by /etc/host.conf, /etc/nsswitch.conf< SMB networking provides a mechanism by which clients can access a list -of machines in a network, a so-called browse list. This list +of machines in a network, a so-called browse list. This list contains machines that are ready to offer file and/or print services to other machines within the network. Thus it does not include machines which aren't currently able to do server tasks. The browse @@ -1176,7 +1197,7 @@ recommended that you use one and only one Samba server as your WINS server. To get browsing to work you need to run nmbd as usual, but will need -to use the workgroup option in &smb.conf; +to use the workgroup option in &smb.conf; to control what workgroup Samba becomes a part of. @@ -1184,7 +1205,7 @@ to control what workgroup Samba becomes a part of. Samba also has a useful option for a Samba server to offer itself for browsing on another subnet. It is recommended that this option is only used for 'unusual' purposes: announcements over the internet, for -example. See remote announce in the +example. See remote announce in the &smb.conf; man page. @@ -1207,7 +1228,7 @@ hit enter and filemanager should display the list of available shares. Some people find browsing fails because they don't have the global -guest account set to a valid account. Remember that the +guest account set to a valid account. Remember that the IPC$ connection that lists the shares is done as guest, and thus you must have a valid guest account. @@ -1268,28 +1289,10 @@ Samba is capable of cross subnet browsing when configured correctly. -Consider a network set up as follows : + Consider a network set up as in the diagram below. - - - - (DMB) - N1_A N1_B N1_C N1_D N1_E - | | | | | - ------------------------------------------------------- - | subnet 1 | - +---+ +---+ - |R1 | Router 1 Router 2 |R2 | - +---+ +---+ - | | - | subnet 2 subnet 3 | - -------------------------- ------------------------------------ - | | | | | | | | - N2_A N2_B N2_C N2_D N3_A N3_B N3_C N3_D - (WINS) - - +Cross subnet browsing examplebrowsing1 Consisting of 3 subnets (1, 2, 3) connected by two routers @@ -1388,14 +1391,19 @@ are done the browse lists look like :
    Browse subnet example 2 - + + + + SubnetBrowse MasterList - Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*) - Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) + Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +N2_A(*), N2_B(*), N2_C(*), N2_D(*) + Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*)Subnet3N3_DN3_A, N3_B, N3_C, N3_D @@ -1411,7 +1419,7 @@ subnet 3 will still only see the servers on their own subnet. -The same sequence of events that occured for N2_B now occurs +The same sequence of events that occurred for N2_B now occurs for the local master browser on subnet 3 (N3_D). When it synchronizes browse lists with the domain master browser (N1_A) it gets both the server entries on subnet 1, and those on @@ -1423,14 +1431,21 @@ the browse lists look like.
    Browse subnet example 3 + + + + SubnetBrowse MasterList - Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) - Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*) - Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*) + Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) + Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*) + Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)
    @@ -1455,14 +1470,24 @@ are removed or shut off) the browse lists will look like : Browse subnet example 4 + + + + SubnetBrowse MasterList - Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) - Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*) - Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*) + Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), +N3_C(*), N3_D(*) + Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), +N3_C(*), N3_D(*) + Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), +N2_C(*), N2_D(*)
    @@ -1544,8 +1569,23 @@ guest account for browsing in smbd. Check that your guest account is valid. -See also guest account in the &smb.conf; man page. +See also guest account in the &smb.conf; man page. + + + + I get an <errorname>Unable to browse the network</errorname> error + + This error can have multiple causes: + + + There is no local master browser. Configure &nmbd; + or any other machine to serve as local master browser. + You can not log onto the machine that is the local master + browser. Can you logon to it as guest user? + There is no IP connectivity to the local master browser. + Can you reach it by broadcast? + diff --git a/docs/docbook/projdoc/Other-Clients.xml b/docs/docbook/projdoc/Other-Clients.xml index d05c58c89d..968a584f9d 100644 --- a/docs/docbook/projdoc/Other-Clients.xml +++ b/docs/docbook/projdoc/Other-Clients.xml @@ -1,8 +1,7 @@ - &author.jmcd; &author.jelmer; - + &person.jmcd;OS/2 5 Mar 2001 @@ -14,7 +13,7 @@ Macintosh clients? -Yes. Thursby now has a CIFS Client / Server called DAVE + Yes. Thursby now has a CIFS Client / Server called DAVE @@ -36,29 +35,27 @@ the Macintosh. The two free implementations are What Samba offers MS Windows users, these packages offer to Macs. For more info on these packages, Samba, and Linux (and other UNIX-based systems) see -http://www.eats.com/linux_mac_win.html +http://www.eats.com/linux_mac_win.html +Newer versions of the Macintosh (Mac OS X) include Samba. + OS2 Client - How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba? + Configuring OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba - A more complete answer to this question can be - found on - http://carol.wins.uva.nl/~leeuw/samba/warp.html. - Basically, you need three components: - - The File and Print Client ('IBM Peer') - TCP/IP ('Internet support') - The "NetBIOS over TCP/IP" driver ('TCPBEUI') - + + The File and Print Client ('IBM Peer') + TCP/IP ('Internet support') + The "NetBIOS over TCP/IP" driver ('TCPBEUI') + Installing the first two together with the base operating system on a blank system is explained in the Warp manual. If Warp @@ -83,16 +80,14 @@ packages, Samba, and Linux (and other UNIX-based systems) see - How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba? + Configuring OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba You can use the free Microsoft LAN Manager 2.2c Client for OS/2 from - + ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/. - See - http://carol.wins.uva.nl/~leeuw/lanman.html for - more information on how to install and use this client. In + In a nutshell, edit the file \OS2VER in the root directory of the OS/2 boot partition and add the lines: @@ -105,24 +100,22 @@ packages, Samba, and Linux (and other UNIX-based systems) see before you install the client. Also, don't use the included NE2000 driver because it is buggy. Try the NE2000 or NS2000 driver from - + ftp://ftp.cdrom.com/pub/os2/network/ndis/ instead. - How do I get printer driver download working - for OS/2 clients? + Printer driver download for for OS/2 clients? - First, create a share called [PRINTDRV] that is + First, create a share called [PRINTDRV] that is world-readable. Copy your OS/2 driver files there. Note that the .EA_ files must still be separate, so you will need to use the original install files, and not copy an installed driver from an OS/2 system. Install the NT driver first for that printer. Then, - add to your &smb.conf; a parameter, os2 driver map = - filename. Then, in the file + add to your &smb.conf; a parameter, os2 driver mapfilename. Then, in the file specified by filename, map the name of the NT driver name to the OS/2 driver name as follows: @@ -148,7 +141,7 @@ packages, Samba, and Linux (and other UNIX-based systems) see Windows for Workgroups -Use latest TCP/IP stack from Microsoft +Latest TCP/IP stack from Microsoft Use the latest TCP/IP stack from Microsoft if you use Windows for Workgroups. @@ -194,7 +187,7 @@ Often WfWg will totally ignore a password you give it in a dialog box. -Configure WfW password handling + Configuring WfW password handling There is a program call admincfg.exe @@ -203,7 +196,7 @@ type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE. Then add an icon for it via the Program Manager New Menu. This program allows you to control how WFW handles passwords. ie disable Password Caching etc -for use with security = user +for use with securityuser @@ -211,7 +204,7 @@ for use with security = user Case handling of passwords -Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf(5) information on password level to specify what characters samba should try to uppercase when checking. +Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the &smb.conf; information on password level to specify what characters samba should try to uppercase when checking. @@ -230,8 +223,8 @@ It is presumably a WfWg bug. Speed improvement -Note that some people have found that setting DefaultRcvWindow in -the [MSTCP] section of the + Note that some people have found that setting DefaultRcvWindow in +the [MSTCP] section of the SYSTEM.INI file under WfWg to 3072 gives a big improvement. I don't know why. @@ -304,15 +297,15 @@ likely occur if it is not. In order to serve profiles successfully to Windows 2000 SP2 clients (when not operating as a PDC), Samba must have -nt acl support = no +nt acl supportno added to the file share which houses the roaming profiles. If this is not done, then the Windows 2000 SP2 client will complain about not being able to access the profile (Access Denied) and create multiple copies of it on disk (DOMAIN.user.001, DOMAIN.user.002, etc...). See the -smb.conf(5) man page +&smb.conf; man page for more details on this option. Also note that the -nt acl support parameter was formally a global parameter in +nt acl support parameter was formally a global parameter in releases prior to Samba 2.2.2. @@ -320,14 +313,15 @@ releases prior to Samba 2.2.2. The following is a minimal profile share: - - [profile] - path = /export/profile - create mask = 0600 - directory mask = 0700 - nt acl support = no - read only = no - + + Minimal profile share +[profile] +path/export/profile +create mask0600 +directory mask0700 +nt acl supportno +read onlyno + The reason for this bug is that the Win2k SP2 client copies @@ -339,7 +333,7 @@ for the access denied message. -By disabling the nt acl support parameter, Samba will send +By disabling the nt acl support parameter, Samba will send the Win2k client a response to the QuerySecurityDescriptor trans2 call which causes the client to set a default ACL for the profile. This default ACL includes @@ -356,7 +350,7 @@ create accounts on the Samba host for Domain users. Windows NT 3.1 If you have problems communicating across routers with Windows -NT 3.1 workstations, read this Microsoft Knowledge Base article. +NT 3.1 workstations, read this Microsoft Knowledge Base article. diff --git a/docs/docbook/projdoc/PAM-Authentication-And-Samba.xml b/docs/docbook/projdoc/PAM-Authentication-And-Samba.xml index 660efdd295..addd646057 100644 --- a/docs/docbook/projdoc/PAM-Authentication-And-Samba.xml +++ b/docs/docbook/projdoc/PAM-Authentication-And-Samba.xml @@ -14,7 +14,7 @@ This chapter you should help you to deploy winbind based authentication on any PAM enabled -Unix/Linux system. Winbind can be used to enable user level application access authentication +UNIX/Linux system. Winbind can be used to enable user level application access authentication from any MS Windows NT Domain, MS Windows 200x Active Directory based domain, or any Samba based domain environment. It will also help you to configure PAM based local host access controls that are appropriate to your Samba configuration. @@ -33,7 +33,7 @@ The use of Winbind require more than PAM configuration alone. Please refer to Features and Benefits -A number of Unix systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, +A number of UNIX systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication, authorization and resource control services. Prior to the introduction of PAM, a decision to use an alternative to the system password database (/etc/passwd) @@ -50,7 +50,7 @@ located in /etc/pam.d. -On PAM enabled Unix/Linux systems it is an easy matter to configure the system to use any +On PAM enabled UNIX/Linux systems it is an easy matter to configure the system to use any authentication backend, so long as the appropriate dynamically loadable library modules are available for it. The backend may be local to the system, or may be centralised on a remote server. @@ -61,15 +61,15 @@ PAM support modules are available for: - /etc/passwd- + /etc/passwd: - There are several PAM modules that interact with this standard Unix user + There are several PAM modules that interact with this standard UNIX user database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so and pam_userdb.so. - Kerberos- + Kerberos: The pam_krb5.so module allows the use of any Kerberos compliant server. This tool is used to access MIT Kerberos, Heimdal Kerberos, and potentially @@ -77,7 +77,7 @@ PAM support modules are available for: - LDAP- + LDAP: The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend server. Commonly used LDAP backend servers include: OpenLDAP v2.0 and v2.1, @@ -85,28 +85,28 @@ PAM support modules are available for: - NetWare Bindery- + NetWare Bindery: The pam_ncp_auth.so module allows authentication off any bindery enabled NetWare Core Protocol based server. - SMB Password- + SMB Password: This module, called pam_smbpass.so, will allow user authentication off the passdb backend that is configured in the Samba &smb.conf; file. - SMB Server- + SMB Server: The pam_smb_auth.so module is the original MS Windows networking authentication tool. This module has been somewhat outdated by the Winbind module. - Winbind- + Winbind: The pam_winbind.so module allows Samba to obtain authentication from any MS Windows Domain Controller. It can just as easily be used to authenticate @@ -114,7 +114,7 @@ PAM support modules are available for: - RADIUS- + RADIUS: There is a PAM RADIUS (Remote Access Dial-In User Service) authentication module. In most cases the administrator will need to locate the source code @@ -172,9 +172,9 @@ is located outside the default then the path must be specified as: - + auth required /other_path/pam_strange_module.so - + @@ -183,8 +183,7 @@ auth required /other_path/pam_strange_module.so The remaining information in this subsection was taken from the documentation of the Linux-PAM project. For more information on PAM, see - -http://ftp.kernel.org/pub/linux/libs/pam The Official Linux-PAM home page. +The Official Linux-PAM home page @@ -192,9 +191,9 @@ A general configuration line of the /etc/pam.conf file has the following form: - + service-name module-type control-flag module-path args - + @@ -204,7 +203,7 @@ Once we have explained the meaning of the above tokens, we will describe this me - service-name- + service-name: The name of the service associated with this entry. Frequently the service name is the conventional name of the given application. For example, `ftpd', `rlogind' and `su', etc. . @@ -214,10 +213,11 @@ Once we have explained the meaning of the above tokens, we will describe this me There is a special service-name, reserved for defining a default authentication mechanism. It has the name `OTHER' and may be specified in either lower or upper case characters. Note, when there is a module specified for a named service, the `OTHER' entries are ignored. - + + - module-type- + module-type: One of (currently) four types of module. The four types are as follows: @@ -250,10 +250,11 @@ Once we have explained the meaning of the above tokens, we will describe this me token associated with the user. Typically, there is one module for each `challenge/response' based authentication (auth) module-type. - + + - control-flag- + control-flag: The control-flag is used to indicate how the PAM library will react to the success or failure of the module it is associated with. Since modules can be stacked (modules of the same type execute in series, @@ -316,9 +317,9 @@ Once we have explained the meaning of the above tokens, we will describe this me consists of a series of value=action tokens: - - [value1=action1 value2=action2 ...] - + +[value1=action1 value2=action2 ...] + Here, value1 is one of the following return values: success; open_err; symbol_err; service_err; @@ -409,7 +410,7 @@ Once we have explained the meaning of the above tokens, we will describe this me - module-path- + module-path: The path-name of the dynamically loadable object file; the pluggable module itself. If the first character of the module path is `/', it is assumed to be a complete path. If this is not the case, the given module path is appended @@ -427,27 +428,28 @@ Once we have explained the meaning of the above tokens, we will describe this me Note, if you wish to include spaces in an argument, you should surround that argument with square brackets. For example: - + squid auth required pam_mysql.so user=passwd_query passwd=mada \ db=eminence [query=select user_name from internet_service where \ user_name='%u' and password=PASSWORD('%p') and \ service='web_proxy'] - + Note, when using this convention, you can include `[' characters inside the string, and if you wish to include a `]' character inside the string that will survive the argument parsing, you should use `\['. In other words: - + [..[..\]..] --> ..[..].. - + Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the side of caution) to make the authentication process fail. A corresponding error is written to the system log files with a call to syslog(3). - + + @@ -469,7 +471,7 @@ by commenting them out except the calls to pam_pwdb.so. PAM: original login config - + #%PAM-1.0 # The PAM configuration file for the `login' service # @@ -484,7 +486,7 @@ session required pam_pwdb.so # session optional pam_lastlog.so # password required pam_cracklib.so retry=3 password required pam_pwdb.so shadow md5 - + @@ -496,7 +498,7 @@ PAM allows use of replaceable modules. Those available on a sample system includ $/bin/ls /lib/security - + pam_access.so pam_ftp.so pam_limits.so pam_ncp_auth.so pam_rhosts_auth.so pam_stress.so pam_cracklib.so pam_group.so pam_listfile.so @@ -509,7 +511,7 @@ pam_env.so pam_ldap.so pam_motd.so pam_radius.so pam_smbpass.so pam_unix_acct.so pam_wheel.so pam_unix_auth.so pam_unix_passwd.so pam_userdb.so pam_warn.so pam_unix_session.so - + The following example for the login program replaces the use of @@ -522,7 +524,7 @@ hashes. This database is stored in either /usr/local/samba/private/smbpasswd, /etc/samba/smbpasswd, or in /etc/samba.d/smbpasswd, depending on the -Samba implementation for your Unix/Linux system. The +Samba implementation for your UNIX/Linux system. The pam_smbpass.so module is provided by Samba version 2.2.1 or later. It can be compiled by specifying the options when running Samba's @@ -532,7 +534,7 @@ in the source/pam_smbpass directory of the Samba source distribution. - + #%PAM-1.0 # The PAM configuration file for the `login' service # @@ -540,14 +542,14 @@ auth required pam_smbpass.so nodelay account required pam_smbpass.so nodelay session required pam_smbpass.so nodelay password required pam_smbpass.so nodelay - + The following is the PAM configuration file for a particular Linux system. The default condition uses pam_pwdb.so. - + #%PAM-1.0 # The PAM configuration file for the `samba' service # @@ -555,7 +557,7 @@ auth required pam_pwdb.so nullok nodelay shadow audit account required pam_pwdb.so audit nodelay session required pam_pwdb.so nodelay password required pam_pwdb.so shadow md5 - + In the following example the decision has been made to use the @@ -565,7 +567,7 @@ thus allow the smbpasswd passwords to be changed using the passwd program. - + #%PAM-1.0 # The PAM configuration file for the `samba' service # @@ -573,7 +575,7 @@ auth required pam_smbpass.so nodelay account required pam_pwdb.so audit nodelay session required pam_pwdb.so nodelay password required pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf - + PAM allows stacking of authentication mechanisms. It is also possible to pass information obtained within one PAM module through @@ -596,26 +598,25 @@ PAM documentation for further helpful information. smb.conf PAM Configuration -There is an option in smb.conf called obey pam restrictions. + There is an option in smb.conf called obey pam restrictions. The following is from the on-line help for this option in SWAT; -When Samba-3 is configured to enable PAM support (i.e. +When Samba is configured to enable PAM support (i.e. ), this parameter will control whether or not Samba should obey PAM's account and session management directives. The default behavior is to use PAM for clear text authentication only and to ignore any account or session management. Note that Samba always ignores PAM for authentication in the case of -encrypt passwords = yes. +encrypt passwordsyes. The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. -Default: obey pam restrictions = no +Default: obey pam restrictionsno @@ -624,7 +625,7 @@ password encryption. All operating systems depend on the provision of users credentials acceptable to the platform. -Unix requires the provision of a user identifier (UID) as well as a group identifier (GID). +UNIX requires the provision of a user identifier (UID) as well as a group identifier (GID). These are both simple integer type numbers that are obtained from a password backend such as /etc/passwd. @@ -683,6 +684,8 @@ Options recognized by this module are as follows: Options recognized by pam_smbpass + + debuglog more debugging infoauditlike debug, but also logs unknown usernames @@ -701,18 +704,17 @@ Options recognized by this module are as follows: -Thanks go to the following people: - - Andrew Morgan, for providing the Linux-PAM - framework, without which none of this would have happened + + Andrew Morgan, for providing the Linux-PAM + framework, without which none of this would have happened - Christian Gafton and Andrew Morgan again, for the - pam_pwdb module upon which pam_smbpass was originally based +Christian Gafton and Andrew Morgan again, for the + pam_pwdb module upon which pam_smbpass was originally based - Luke Leighton for being receptive to the idea, +Luke Leighton for being receptive to the idea, and for the occasional good-natured complaint about the project's status - that keep me working on it :) -. + that keep me working on it :) +. @@ -731,7 +733,7 @@ is changed. Useful when an expired password might be changed by an application (such as ssh). - + #%PAM-1.0 # password-sync # @@ -742,7 +744,7 @@ password requisite pam_cracklib.so retry=3 password requisite pam_unix.so shadow md5 use_authtok try_first_pass password required pam_smbpass.so nullok use_authtok try_first_pass session required pam_unix.so - + @@ -756,7 +758,7 @@ password migration takes place when users ftp in, login using ssh, pop their mail, etc. - + #%PAM-1.0 # password-migration # @@ -769,7 +771,7 @@ password requisite pam_cracklib.so retry=3 password requisite pam_unix.so shadow md5 use_authtok try_first_pass password optional pam_smbpass.so nullok use_authtok try_first_pass session required pam_unix.so - + @@ -778,10 +780,10 @@ session required pam_unix.so A sample PAM configuration for a 'mature' smbpasswd installation. private/smbpasswd is fully populated, and we consider it an error if -the smbpasswd doesn't exist or doesn't match the Unix password. +the smbpasswd doesn't exist or doesn't match the UNIX password. - + #%PAM-1.0 # password-mature # @@ -792,7 +794,7 @@ password requisite pam_cracklib.so retry=3 password requisite pam_unix.so shadow md5 use_authtok try_first_pass password required pam_smbpass.so use_authtok use_first_pass session required pam_unix.so - + @@ -804,7 +806,7 @@ pam_krb5. This could be useful on a Samba PDC that is also a member of a Kerberos realm. - + #%PAM-1.0 # kdc-pdc # @@ -816,7 +818,7 @@ password requisite pam_cracklib.so retry=3 password optional pam_smbpass.so nullok use_authtok try_first_pass password required pam_krb5.so use_authtok try_first_pass session required pam_krb5.so - + @@ -836,11 +838,13 @@ the Samba mailing list. pam_winbind problem - I have the following PAM configuration: + + I have the following PAM configuration: + - - + + auth required /lib/security/pam_securetty.so auth sufficient /lib/security/pam_winbind.so auth sufficient /lib/security/pam_unix.so use_first_pass nullok @@ -849,16 +853,18 @@ auth required /lib/security/pam_nologin.so account required /lib/security/pam_stack.so service=system-auth account required /lib/security/pam_winbind.so password required /lib/security/pam_stack.so service=system-auth - - + + + When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie". I've tried with user "scienceu+pitie" also. + - Answer: The problem may lie with your inclusion of pam_stack.so + The problem may lie with your inclusion of pam_stack.so service=system-auth. That file often contains a lot of stuff that may duplicate what you're already doing. Try commenting out the pam_stack lines for auth and account and see if things work. If they do, look at @@ -869,6 +875,59 @@ password required /lib/security/pam_stack.so service=system-auth + + Winbind is not resolving users and groups + + + + My smb.conf file is correctly configured. I have specified + idmap uid12000, + and idmap gid3000-3500 + and winbind is running. When I do the following it all works fine. + + + + +&rootprompt;wbinfo -u +MIDEARTH+maryo +MIDEARTH+jackb +MIDEARTH+ameds +... +MIDEARTH+root + +&rootprompt;wbinfo -g +MIDEARTH+Domain Users +MIDEARTH+Domain Admins +MIDEARTH+Domain Guests +... +MIDEARTH+Accounts + +&rootprompt;getent passwd +root:x:0:0:root:/root:/bin/bash +bin:x:1:1:bin:/bin:/bin/bash +... +maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false + + + + + But the following command just fails: + + +&rootprompt;chown 'maryo' a_file +chown: `maryo': invalid user + + +This is driving me nuts! What can be wrong? + + + + + Your system is likely running nscd, the name service + caching daemon. Shut it down, do NOT restart it! You will find your problem resolved. + + + diff --git a/docs/docbook/projdoc/PolicyMgmt.xml b/docs/docbook/projdoc/PolicyMgmt.xml index 12289df7c3..351c51d1c6 100644 --- a/docs/docbook/projdoc/PolicyMgmt.xml +++ b/docs/docbook/projdoc/PolicyMgmt.xml @@ -42,7 +42,7 @@ network client workstations. -A tool new to Samba-3 may become an important part of the future Samba Administrators' +A tool new to Samba may become an important part of the future Samba Administrators' arsenal. The editreg tool is described in this document. @@ -88,7 +88,7 @@ be a step forward, but improved functionality comes at a great price. Before embarking on the configuration of network and system policies it is highly advisable to read the documentation available from Microsoft's web site regarding -Implementing Profiles and Policies in Windows NT 4.0 from http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp available from Microsoft. +Implementing Profiles and Policies in Windows NT 4.0 available from Microsoft. There are a large number of documents in addition to this old one that should also be read and understood. Try searching on the Microsoft web site for "Group Policies". @@ -112,7 +112,7 @@ here is incomplete - you are warned. Use the Group Policy Editor to create a policy file that specifies the location of user profiles and/or the My Documents etc. Then save these settings in a file called Config.POL that needs to be placed in the - root of the [NETLOGON] share. If Win98 is configured to log onto + root of the [NETLOGON] share. If Win98 is configured to log onto the Samba Domain, it will automatically read this file and update the Win9x/Me registry of the machine as it logs on. @@ -293,7 +293,7 @@ here is incomplete - you are warned. Policies can define a specific user's settings or the settings for a group of users. The resulting policy file contains the registry settings for all users, groups, and computers that will be using -the policy file. Separate policy files for each user, group, or computer are not not necessary. +the policy file. Separate policy files for each user, group, or computer are not necessary. @@ -326,20 +326,27 @@ Common restrictions that are frequently used includes: - - Logon Hours - Password Aging - Permitted Logon from certain machines only - Account type (Local or Global) - User Rights - + + Logon Hours + Password Aging + Permitted Logon from certain machines only + Account type (Local or Global) + User Rights + Samba Editreg Toolset - Describe in detail the benefits of editreg and how to use it. + A new tool called editreg is under development. This tool can be used + to edit registry files (called NTUser.DAT) that are stored in user and group profiles. + NTConfig.POL files have the same structure as the NTUser.DAT file and can be editted using + this tool. editreg is being built with the intent to enable NTConfig.POL + files to be saved in text format and to permit the building of new NTConfig.POL files with + extended capabilities. It is proving difficult to realise this capability, so do not be surprised + if this feature does not materialise. Formal capabilities will be announced at the time that + this tool is released for production use. @@ -385,11 +392,11 @@ reboot and as part of the user logon: Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded and applied. The list may include GPOs that: - - Apply to the location of machines in a Directory - Apply only when settings have changed - Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc. - + + Apply to the location of machines in a Directory + Apply only when settings have changed + Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc. + No desktop user interface is presented until the above have been processed. @@ -408,12 +415,12 @@ reboot and as part of the user logon: An ordered list of User GPOs is obtained. The list contents depends on what is configured in respect of: - - Is user a domain member, thus subject to particular policies - Loopback enablement, and the state of the loopback policy (Merge or Replace) - Location of the Active Directory itself - Has the list of GPOs changed. No processing is needed if not changed. - + + Is user a domain member, thus subject to particular policies + Loopback enablement, and the state of the loopback policy (Merge or Replace) + Location of the Active Directory itself + Has the list of GPOs changed. No processing is needed if not changed. + @@ -446,13 +453,13 @@ collection demonstrates only basic issues. Policy Does Not Work -Question: We have created the config.pol file and put it in the NETLOGON share. + We have created the config.pol file and put it in the NETLOGON share. It has made no difference to our Win XP Pro machines, they just don't see it. IT worked fine with Win 98 but does not -work any longer since we upgraded to Win XP Pro. Any hints? +work any longer since we upgraded to Win XP Pro. Any hints? -ANSWER: Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based +Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based platforms. You need to use the NT4 Group Policy Editor to create a file called NTConfig.POL so that it is in the correct format for your MS Windows XP Pro clients. diff --git a/docs/docbook/projdoc/Portability.xml b/docs/docbook/projdoc/Portability.xml index 205d384843..50cc8b4c7c 100644 --- a/docs/docbook/projdoc/Portability.xml +++ b/docs/docbook/projdoc/Portability.xml @@ -45,17 +45,17 @@ Samba. -SCO Unix +SCO UNIX -If you run an old version of SCO Unix then you may need to get important +If you run an old version of SCO UNIX then you may need to get important TCP/IP patches for Samba to work correctly. Without the patch, you may encounter corrupt data transfers using samba. The patch you need is UOD385 Connection Drivers SLS. It is available from -SCO (ftp.sco.com, directory SLS, +SCO (ftp.sco.com, directory SLS, files uod385a.Z and uod385a.ltr.Z). @@ -125,8 +125,8 @@ after creating the above files you then assemble them using - $ as seteuid.s - $ as setegid.s +&prompt;as seteuid.s +&prompt;as setegid.s diff --git a/docs/docbook/projdoc/Problems.xml b/docs/docbook/projdoc/Problems.xml index 16e4c8ad54..46f3c002d2 100644 --- a/docs/docbook/projdoc/Problems.xml +++ b/docs/docbook/projdoc/Problems.xml @@ -3,13 +3,7 @@ &author.jerry; &author.jelmer; - - DavidBannon - - Samba Team -
    dbannon@samba.org
    -     -     + &author.dbannon; 8 Apr 2003     @@ -24,10 +18,20 @@ general SMB topics such as browsing.     Diagnostics tools +With SMB networking, it is often not immediately clear what +the cause is of a certain problem. Samba itself provides rather +useful information, but in some cases you might have to fall back +to using a sniffer. A sniffer is a program that +listens on your LAN, analyses the data sent on it and displays it +on the screen. + + +Debugging with Samba itself + One of the best diagnostic tools for debugging problems is Samba itself. You can use the for both &smbd; and &nmbd; to specify what -debug level at which to run. See the man pages on smbd, nmbd and +debug level at which to run. See the man pages on smbd, nmbd and smb.conf for more information on debugging options. The debug level can range from 1 (the default) to 10 (100 for debugging passwords). @@ -52,17 +56,44 @@ Some useful samba commands worth investigating: - $ testparm | more - $ smbclient -L //{netbios name of server} +&prompt;testparm | more +&prompt;smbclient -L //{netbios name of server} - + + + + + Tcpdump + +Tcpdump was the first +unix sniffer with SMB support. It is a command-line utility and +nowadays, it's SMB support is somewhat less then that of ethereal +and tethereal. + + + + + Ethereal + -An SMB enabled version of tcpdump is available from -http://www.tcpdup.org/. -Ethereal, another good packet sniffer for Unix and Win32 -hosts, can be downloaded from http://www.ethereal.com. - +Ethereal is a graphical +sniffer, available for both unix (Gtk) and Windows. Ethereal's +SMB support is very good. + +For details on the use of ethereal, read the well-written +ethereal User Guide. + + +Listen for data on ports 137, 138, 139 and 445. E.g. +use the filter port 137 or port 138 or port 139 or port 445. + +A console version of ethereal is available as well and is called +tethereal. + + + + +The Windows Network Monitor For tracing things on the Microsoft Windows NT, Network Monitor @@ -76,10 +107,8 @@ local subnet. Be aware that Ethereal can read and write netmon formatted files. - - - -Installing 'Network Monitor' on an NT Workstation or a Windows 9x box + +Installing 'Network Monitor' on an NT Workstation Installing netmon on an NT workstation requires a couple @@ -144,14 +173,18 @@ permissions as you deem appropriate for your site. You will need administrative rights on the NT box to run netmon. + + +Installing 'Network Monitor' on an 9x Workstation To install Netmon on a Windows 9x box install the network monitor agent from the Windows 9x CD (\admin\nettools\netmon). There is a readme file located with the netmon driver files on the CD if you need information on how to do this. Copy the files from a working Netmon installation. - - + + + @@ -159,15 +192,14 @@ Netmon installation. See how Scott Merrill simulates a BDC behavior at - + http://www.skippy.net/linux/smb-howto.html. FTP site for older SMB specs: - + ftp://ftp.microsoft.com/developr/drg/CIFS/ - @@ -176,14 +208,14 @@ Netmon installation. There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror +noescape="1" url="http://samba.org">http://samba.org, click on your nearest mirror and then click on Support and then click on Samba related mailing lists. For questions relating to Samba TNG go to -http://www.samba-tng.org/ +http://www.samba-tng.org/ It has been requested that you don't post questions about Samba-TNG to the main stream Samba lists. @@ -193,12 +225,12 @@ If you post a message to one of the lists please observe the following guide lin - Always remember that the developers are volunteers, they are +Always remember that the developers are volunteers, they are not paid and they never guarantee to produce a particular feature at a particular time. Any time lines are 'best guess' and nothing more. - Always mention what version of samba you are using and what +Always mention what version of samba you are using and what operating system its running under. You should probably list the relevant sections of your &smb.conf; file, at least the options in [global] that affect PDC support. @@ -244,10 +276,9 @@ smb.conf in their attach directory? To have your name removed from a samba mailing list, go to the same place you went to to get on it. Go to http://lists.samba.org, + noescape="1" url="http://lists.samba.org/">http://lists.samba.org, click on your nearest mirror and then click on Support and -then click on Samba related mailing lists. Or perhaps see -here +then click on Samba related mailing lists. diff --git a/docs/docbook/projdoc/ProfileMgmt.xml b/docs/docbook/projdoc/ProfileMgmt.xml index 58c6f34030..37ae2d41e8 100644 --- a/docs/docbook/projdoc/ProfileMgmt.xml +++ b/docs/docbook/projdoc/ProfileMgmt.xml @@ -73,15 +73,15 @@ following (for example): - - logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath - + +logon path\\profileserver\profileshare\profilepath\%U\moreprofilepath + This is typically implemented like: - - logon path = \\%L\Profiles\%u - + +logon path\\%L\Profiles\%u + where %L translates to the name of the Samba server and %u translates to the user name @@ -97,7 +97,7 @@ semantics of %L and %N, as well as %U and %u. MS Windows NT/2K clients at times do not disconnect a connection to a server -between logons. It is recommended to NOT use the homes +between logons. It is recommended to NOT use the homes meta-service name as part of the profile share path. @@ -107,7 +107,7 @@ meta-service name as part of the profile share path. Windows 9x / Me User Profiles - To support Windows 9x / Me clients, you must use the logon home parameter. Samba has + To support Windows 9x / Me clients, you must use the logon home parameter. Samba has now been fixed so that net use /home now works as well, and it, too, relies on the logon home parameter. @@ -115,11 +115,11 @@ on the logon home parameter. By using the logon home parameter, you are restricted to putting Win9x / Me profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your &smb.conf; file: +can use. If you set the following in the [global] section of your &smb.conf; file: - - logon home = \\%L\%U\.profiles - + +logon home\\%L\%U\.profiles + then your Windows 9x / Me clients will dutifully put their clients in a subdirectory @@ -130,7 +130,7 @@ of your home directory called .profiles (thus making them h Not only that, but net use /home will also work, because of a feature in Windows 9x / Me. It removes any directory stuff off the end of the home directory area and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for logon home. +specified \\%L\%U for logon home. @@ -139,13 +139,13 @@ specified \\%L\%U for logon home. You can support profiles for both Win9X and WinNT clients by setting both the -logon home and logon path parameters. For example: +logon home and logon path parameters. For example: - - logon home = \\%L\%u\.profiles - logon path = \\%L\profiles\%u - + +logon home\\%L\%u\.profiles +logon path\\%L\profiles\%u + @@ -166,10 +166,10 @@ There are three ways of doing this: Affect the following settings and ALL clients will be forced to use a local profile: - - logon home = - logon path = - + + logon home + logon path + @@ -178,6 +178,7 @@ There are three ways of doing this: By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This of course modifies registry settings. The full path to the option is: + Local Computer Policy\ Computer Configuration\ @@ -228,9 +229,9 @@ as are folders Start Menu, Desktop, Programs and Nethood. These directories and their contents will be merged with the local versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options preserve case = yes, short preserve case = yes and -case sensitive = no in order to maintain capital letters in shortcuts +taking the most recent from each. You will need to use the [global] +options preserve caseyes, short preserve caseyes and +case sensitiveno in order to maintain capital letters in shortcuts in any of the profile folders. @@ -281,13 +282,13 @@ supports it), user name and user's password. Once the user has been successfully validated, the Windows 9x / Me machine -will inform you that The user has not logged on before' and asks you - if you wish to save the user's preferences? Select yes. +will inform you that The user has not logged on before and asks you +Do you wish to save the user's preferences?. Select yes. Once the Windows 9x / Me client comes up with the desktop, you should be able -to examine the contents of the directory specified in the logon path +to examine the contents of the directory specified in the logon path on the samba server and verify that the Desktop, Start Menu, Programs and Nethood folders have been created. @@ -305,7 +306,7 @@ the newest folders and short-cuts from each set. If you have made the folders / files read-only on the samba server, then you will get errors from the Windows 9x / Me machine on logon and logout, as it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the Windows 9x / Me machine, check the Unix file +you have any errors reported by the Windows 9x / Me machine, check the UNIX file permissions and ownership rights on the profile directory contents, on the samba server. @@ -316,6 +317,25 @@ local desktop cache, as shown below. When this user then next logs in, they will be told that they are logging in "for the first time". + + + Before deleting the contents of the + directory listed in the ProfilePath (this is likely to be + c:\windows\profiles\username), ask them if they + have any important files stored on their desktop or in their start menu. + Delete the contents of the directory ProfilePath (making a backup if any + of the files are needed). + + + + This will have the effect of removing the local (read-only hidden + system file) user.DAT in their profile directory, as well as the + local "desktop", "nethood", "start menu" and "programs" folders. + + + + + @@ -342,23 +362,6 @@ they will be told that they are logging in "for the first time". [Exit the registry editor]. - - - Before deleting the contents of the - directory listed in the ProfilePath (this is likely to be - c:\windows\profiles\username), ask them if they - have any important files stored on their desktop or in their start menu. - Delete the contents of the directory ProfilePath (making a backup if any - of the files are needed). - - - - This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. - - - search for the user's .PWL password-caching file in the c:\windows @@ -374,7 +377,7 @@ they will be told that they are logging in "for the first time". - check the contents of the profile path (see logon path described + check the contents of the profile path (see logon path described above), and delete the user.DAT or user.MAN file for the user, making a backup if required. @@ -403,13 +406,13 @@ differences are with the equivalent samba trace. When a user first logs in to a Windows NT Workstation, the profile NTuser.DAT is created. The profile location can be now specified -through the logon path parameter. +through the logon path parameter. There is a parameter that is now available for use with NT Profiles: -logon drive. This should be set to H: or any other drive, and -should be used in conjunction with the new "logon home" parameter. +logon drive. This should be set to H: or any other drive, and +should be used in conjunction with the new logon home parameter. @@ -481,8 +484,7 @@ profile on the MS Windows workstation as follows: profile must be accessible. - You will need to log on if a logon box opens up. Eg: In the connect - as: MIDEARTH\root, password: mypassword. + You will need to log on if a logon box opens up. Eg: In the connect as: DOMAIN\root, password: mypassword. @@ -500,7 +502,7 @@ profile on the MS Windows workstation as follows: -Done. You now have a profile that can be edited using the samba-3.0.0 +Done. You now have a profile that can be edited using the samba profiles tool. @@ -511,8 +513,8 @@ storage of mail data. That keeps desktop profiles usable. - + Windows XP Service Pack 1 This is a security check new to Windows XP (or maybe only Windows XP service pack 1). It can be disabled via a group policy in @@ -562,7 +564,6 @@ On the XP workstation log in with an Administrator account. Reboot - @@ -582,9 +583,9 @@ on again with the newer version of MS Windows. If you then want to share the same Start Menu / Desktop with W9x/Me, you will -need to specify a common location for the profiles. The smb.conf parameters -that need to be common are logon path and -logon home. +need to specify a common location for the profiles. The &smb.conf; parameters +that need to be common are logon path and +logon home. @@ -659,12 +660,6 @@ Follow the above for every profile you need to migrate. You should obtain the SID of your NT4 domain. You can use smbpasswd to do this. Read the man page. - -With Samba-3.0.0 alpha code you can import all you NT4 domain accounts -using the net samsync method. This way you can retain your profile -settings as well as all your users. - - @@ -844,10 +839,10 @@ customisable per user depending on the profile settings chosen/created. When a new user first logs onto an MS Windows NT4 machine a new profile is created from: - - All Users settings - Default User settings (contains the default NTUser.DAT file) - + + All Users settings + Default User settings (contains the default NTUser.DAT file) + When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain @@ -903,8 +898,8 @@ also remain stored in the same way, unless the following registry key is created - HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\ - "DeleteRoamingCache"=dword:00000001 +HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\ +winlogon\"DeleteRoamingCache"=dword:00000001 In which case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be @@ -1013,7 +1008,7 @@ login name of the user. - This path translates, in Samba parlance, to the &smb.conf; [NETLOGON] share. The directory + This path translates, in Samba parlance, to the &smb.conf; [NETLOGON] share. The directory should be created at the root of this share and must be called Default Profile. @@ -1124,7 +1119,7 @@ You could also use: in which case the default folders will be stored in the server named SambaServer in the share called FolderShare under a directory that has the name of the MS Windows -user as seen by the Linux/Unix file system. +user as seen by the Linux/UNIX file system. @@ -1137,7 +1132,10 @@ MS Windows 200x/XP profiles may be Local or Roami A roaming profile will be cached locally unless the following registry key is created: -HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\"DeleteRoamingCache"=dword:00000001 + + +HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\ + winlogon\"DeleteRoamingCache"=dword:00000001 In which case, the local cache copy will be deleted on logout. @@ -1153,7 +1151,7 @@ The following are some typical errors/problems/questions that have been asked. -How does one set up roaming profiles for just one (or a few) user/s or group/s? +Setting up roaming profiles for just a few user's or group's? With samba-2.2.x the choice you have is to enable or disable roaming @@ -1171,8 +1169,8 @@ machine. -With samba-3.0.0 (soon to be released) you can have a global profile -setting in smb.conf _AND_ you can over-ride this by per-user settings +With samba-3 you can have a global profile +setting in &smb.conf; _AND_ you can over-ride this by per-user settings using the Domain User Manager (as with MS Windows NT4/ Win 2Kx). @@ -1181,11 +1179,11 @@ In any case, you can configure only one profile per user. That profile can be either: - - A profile unique to that user - A mandatory profile (one the user can not change) - A group profile (really should be mandatory ie:unchangable) - + + A profile unique to that user + A mandatory profile (one the user can not change) + A group profile (really should be mandatory ie:unchangable) + @@ -1193,66 +1191,69 @@ be either: Can NOT use Roaming Profiles +A user requested the following: - I dont want Roaming profile to be implemented, I just want to give users - local profiles only. -... - Please help me I am totally lost with this error from past two days I tried - everything and googled around quite a bit but of no help. Please help me. +I do not want Roaming profiles to be implemented. I want to give users a local profile alone. ... +Please help me I am totally lost with this error. For the past two days I tried everything, I googled +around but found no useful pointers. Please help me. -Your choices are: - +The choices are: + - Local profiles + Local profiles: - I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out + I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out - Roaming profiles + Roaming profiles: - - can use auto-delete on logout option - requires a registry key change on workstation - - - Your choices are: - - - - Personal Roaming profiles - - - should be preserved on a central server - - workstations 'cache' (store) a local copy - - used in case the profile can not be downloaded - at next logon - - - - - Group profiles - - loaded from a central place - - - - Mandatory profiles - - - can be personal or group - - can NOT be changed (except by an administrator - - - + As a user logs onto the network a centrally stored profile is copied to the workstation + to form a local profile. This local profile will persist (remain on the workstation disk) + unless a registry key is changed that will cause this profile to be automatically deleted + on logout. + +The Roaming Profile choices are: + + + Personal Roaming profiles + + These are typically stored in a profile share on a central (or conveniently located + local) server. + + + + Workstations 'cache' (store) a local copy of the profile. This cached copy is used when + the profile can not be downloaded at next logon. + + + + + Group profiles + These are loaded from a central profile server + + + + Mandatory profiles + + Mandatory profiles can be created for a user as well as for any group that a user + is a member of. Mandatory profiles can NOT be changed by ordinary users. Only the administrator + can change or reconfigure a mandatory profile. + + + + A WinNT4/2K/XP profile can vary in size from 130KB to off the scale. Outlook PST files are most often part of the profile and can be many GB in @@ -1271,56 +1272,53 @@ a problem free site. Microsoft's answer to the PST problem is to store all email in an MS -Exchange Server back-end. But this is another story ...! +Exchange Server back-end. This removes the need for a PST file. -So, having LOCAL profiles means: - - - If lots of users user each machine - lot's of local disk storage needed for local profiles - Every workstation the user logs into has it's own profile - can be very different from machine to machine - - -On the other hand, having roaming profiles means: - - The network administrator can control EVERY aspect of user profiles - With the use of mandatory profiles - a drastic reduction in network management overheads - User unhappiness about not being able to change their profiles soon fades as they get used to being able to work reliably - - +LOCAL profiles mean: + + If each machine is used my many users then much local disk storage is needed for local profiles + Every workstation the user logs into has it's own profile, these can be very different from machine to machine + + -I have managed and installed MANY NT/2K networks and have NEVER found one -where users who move from machine to machine are happy with local -profiles. In the long run local profiles bite them. +On the other hand, use of roaming profiles means: - + + The network administrator can control the desktop environment of all users. + Use of mandatory profiles drasitcally reduces network management overheads. + In the long run users will be experience fewer problems. + - + - Changing the default profile +Changing the default profile - -When the client tries to logon to the PDC it looks for a profile to download -where do I put this default profile. + +Question: + +When the client logs onto the domain controller it searches for a profile to download, +where do I put this default profile? -Firstly, your samba server need to be configured as a domain controller. +Firstly, the samba server needs to be configured as a domain controller. +This can be done by setting in &smb.conf;: - - server = user - os level = 32 (or more) - domain logons = Yes - + +securityuser +os level32 (or more) +domain logonsYes + -Plus you need to have a [netlogon] share that is world readable. +There must be an [netlogon] share that is world readable. It is a good idea to add a logon script to pre-set printer and drive connections. There is also a facility for automatically synchronizing the workstation time clock with that of the logon @@ -1329,23 +1327,26 @@ server (another good thing to do). To invoke auto-deletion of roaming profile from the local -workstation cache (disk storage) you need to use the Group Policy Editor +workstation cache (disk storage) use the Group Policy Editor to create a file called NTConfig.POL with the appropriate entries. This -file needs to be located in the netlogon share root directory. +file needs to be located in the netlogon share root directory. -Oh, of course the windows clients need to be members of the domain. -Workgroup machines do NOT do network logons - so they never see domain -profiles. +Windows clients need to be members of the domain. Workgroup machines do NOT use network logons so +they do not interoperate with domain profiles. -Secondly, for roaming profiles you need: - - logon path = \\%N\profiles\%U (with some such path) - logon drive = H: (Z: is the default) +For roaming profiles add to &smb.conf;: + - Plus you need a PROFILES share that is world writable. + + +logon path\\%N\profiles\%U +Default logon drive is Z: +logon driveH: +This requires a PROFILES share that is world writable. + diff --git a/docs/docbook/projdoc/SWAT.xml b/docs/docbook/projdoc/SWAT.xml index 1ea0789661..90994f65e0 100644 --- a/docs/docbook/projdoc/SWAT.xml +++ b/docs/docbook/projdoc/SWAT.xml @@ -40,7 +40,7 @@ and only non-default settings will be written to the file. SWAT should be installed to run via the network super daemon. Depending on which system -your Unix/Linux system has you will have either an inetd or +your UNIX/Linux system has you will have either an inetd or xinetd based system. @@ -132,11 +132,11 @@ Modifications to the swat setup are as following: generate certificate and private key - + &rootprompt;/usr/bin/openssl req -new -x509 -days 365 -nodes -config \ - /usr/share/doc/packages/stunnel/stunnel.cnf \ + /usr/share/doc/packages/stunnel/stunnel.cnf \ -out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem - + remove swat-entry from [x]inetd @@ -145,14 +145,14 @@ Modifications to the swat setup are as following: start stunnel - + &rootprompt;stunnel -p /etc/stunnel/stunnel.pem -d 901 \ -l /usr/local/samba/bin/swat swat - + -afterwords simply contact to swat by using the URL https://myhost:901, accept the certificate +afterwords simply contact to swat by using the URL https://myhost:901, accept the certificate and the SSL connection is up. @@ -171,8 +171,7 @@ document) as well as the O'Reilly book "Using Samba". Administrators who wish to validate their samba configuration may obtain useful information from the man pages for the diagnostic utilities. These are available from the SWAT home page also. One diagnostic tool that is NOT mentioned on this page, but that is particularly -useful is ethereal, available from -http://www.ethereal.com. +useful is ethereal. @@ -211,8 +210,8 @@ in smb.conf. There are three levels of exposure of the parameters: To switch to other than Basic editing ability click on either the -Advanced or the Developer dial, then click the -Commit Changes button. +Advanced or the Developer button. You may also +do this by clicking on the radio button, then click the Commit Changes button. diff --git a/docs/docbook/projdoc/Samba-BDC-HOWTO.xml b/docs/docbook/projdoc/Samba-BDC-HOWTO.xml index 52e53a51c7..9800c508d5 100644 --- a/docs/docbook/projdoc/Samba-BDC-HOWTO.xml +++ b/docs/docbook/projdoc/Samba-BDC-HOWTO.xml @@ -9,8 +9,7 @@ Before you continue reading in this section, please make sure that you are comfortable -with configuring a Samba Domain Controller as described in the -Domain Control chapter. +with configuring a Samba Domain Controller as described in chapter on setting up Samba as a PDC. @@ -20,19 +19,19 @@ with configuring a Samba Domain Controller as described in the This is one of the most difficult chapters to summarise. It does not matter what we say here for someone will still draw conclusions and / or approach the Samba-Team with expectations that are either not yet capable of being delivered, or that can be achieved far more -effectively using a totally different approach. Since this HOWTO is already so large and -extensive, we have taken the decision to provide sufficient (but not comprehensive) -information regarding Backup Domain Control. In the event that you should have a persistent -concern that is not addressed in this HOWTO document then please email +effectively using a totally different approach. In the event that you should have a persistent +concern that is not addressed in this book then please email John H Terpstra clearly setting out your requirements and / or question and we will do our best to provide a solution. Samba-3 is capable of acting as a Backup Domain Controller to another Samba Primary Domain -Controller. A Samba-3 PDC can operate with an LDAP Account backend. The Samba-3 BDC can -operate with a slave LDAP server for the Account backend. This effectively gives samba a high -degree of scalability. This is a very sweet (nice) solution for large organisations. +Controller. A Samba-3 PDC can operate with an LDAP Account backend. The LDAP backend can be +either a common master LDAP server, or a slave server. The use of a slave LDAP server has the +benefit that when the master is down clients may still be able to log onto the network. +This effectively gives samba a high degree of scalability iand is a very sweet (nice) solution +for large organisations. @@ -74,8 +73,9 @@ lets consider each possible option and look at the pro's and con's for each theo - Passdb Backend is tdbsam based, BDCs use cron based "net rpc vampire" to - suck down the Accounts database from the PDC + Passdb Backend is tdbsam based, BDCs use cron based net rpc vampire to + obtain the Accounts database from the PDC and place them into the Samba SAM. + net rpc vampire is a Samba function of the "net" command. @@ -225,19 +225,21 @@ Server Manager for Domains. Since version 2.2 Samba officially supports domain logons for all current Windows Clients, including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some -parameters in the [global]-section of the &smb.conf; have to be set: +parameters in the [global]-section of the &smb.conf; have to be set: - - workgroup = SAMBA - domain master = yes - domain logons = yes - + +Minimal smb.conf for being a PDC +workgroup&example.workgroup; +domain masteryes +domain logonsyes + -Several other things like a [homes] and a [netlogon] share also need to be set along with +Several other things like a [homes] and a +[netlogon] share also need to be set along with settings for the profile path, the users home drive, etc.. This will not be covered in this -chapter, for more information please refer to the chapter on Domain Control. +chapter, for more information please refer to the chapter about samba as a PDC. @@ -298,8 +300,8 @@ Several things have to be done: The domain SID has to be the same on the PDC and the BDC. This used to be stored in the file private/MACHINE.SID. This file is not created - anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is - stored in the file private/secrets.tdb. Simply copying the secrets.tdb + since Samba 2.2.5. Nowadays the domain SID is stored in the file + private/secrets.tdb. Simply copying the secrets.tdb from the PDC to the BDC does not work, as the BDC would generate a new SID for itself and override the domain SID with this new BDC SID. @@ -308,13 +310,13 @@ Several things have to be done: To retrieve the domain SID from the PDC or an existing BDC and store it in the secrets.tdb, execute: - - &rootprompt;net rpc getsid - + +&rootprompt;net rpc getsid + - The Unix user database has to be synchronized from the PDC to the + The UNIX user database has to be synchronized from the PDC to the BDC. This means that both the /etc/passwd and /etc/group have to be replicated from the PDC to the BDC. This can be done manually whenever changes are made, or the PDC is set up as a NIS master @@ -350,21 +352,38 @@ Several things have to be done: Finally, the BDC has to be found by the workstations. This can be done by setting: - - workgroup = SAMBA - domain master = no - domain logons = yes - + +Minimal setup for being a BDC +workgroup&example.workgroup; +domain masterno +domain logonsyes +idmap backendldapsam://slave-ldap.quenya.org + -in the [global]-section of the &smb.conf; of the BDC. This makes the BDC +In the [global]-section of the &smb.conf; of the BDC. This makes the BDC only register the name SAMBA<#1c> with the WINS server. This is no problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to -be registered by more than one machine. The parameter 'domain master = -no' forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS +be registered by more than one machine. The parameter +domain masterno +forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS name is reserved for the Primary Domain Controller. + +The idmap backend will redirect the winbindd utility to +use the LDAP database to resolve all UIDs and GIDs for UNIX accounts. + + + +Samba-3 has introduced a new ID mapping facility. One of the features of this facility is that it +allows greater flexibility in how user and group IDs are handled in respect of NT Domain User and Group +SIDs. One of the new facilities provides for explicitly ensuring that UNIX / Linux UID and GID values +will be consistent on the PDC, all BDCs and all Domain Member servers. The parameter that controls this +is called idmap backend. Please refer to the man page for &smb.conf; for more information +regarding it's behaviour. Do NOT set this parameter except where an LDAP backend (ldapsam) is in use. + + @@ -402,16 +421,11 @@ an slave LDAP server for each BDC, and a master LDAP server for the PDC. With version 2.2, no. The native NT4 SAM replication protocols have not yet been fully implemented. The Samba Team is working on understanding and implementing the protocols, -but this work has not been finished for version 2.2. - - - -With version 3.0, the work on both the replication protocols and a suitable storage -mechanism has progressed, and some form of NT4 BDC support is expected soon. +but this work has not been finished for Samba-3. -Can I get the benefits of a BDC with Samba? Yes. The main reason for implementing a +Can I get the benefits of a BDC with Samba? Yes, but only to a Samba PDC. The main reason for implementing a BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to service logon requests whenever the PDC is down. diff --git a/docs/docbook/projdoc/Samba-PDC-HOWTO.xml b/docs/docbook/projdoc/Samba-PDC-HOWTO.xml index f208e16d28..78a875792c 100644 --- a/docs/docbook/projdoc/Samba-PDC-HOWTO.xml +++ b/docs/docbook/projdoc/Samba-PDC-HOWTO.xml @@ -3,13 +3,7 @@ &author.jht; &author.jerry; - - DavidBannon - - Samba Team -
    dbannon@samba.org
    -     -     + &author.dbannon;     Domain Control @@ -26,12 +20,20 @@ that is already available. The reader is advised NOT to tackle this section without having first understood and mastered some basics. MS Windows networking is not particularly forgiving of -misconfiguration. Users of MS Windows networking are likely to complain bitterly -of persistent niggles that may be caused by broken network or system configuration. +misconfiguration. Users of MS Windows networking are likely to complain +of persistent niggles that may be caused by a broken network configuration. To a great many people however, MS Windows networking starts with a domain controller that in some magical way is expected to solve all ills. +
    An Example Domain + + + + +
    + + From the Samba mailing list one can readily identify many common networking issues. If you are not clear on the following subjects, then it will do much good to read the @@ -39,18 +41,18 @@ sections of this HOWTO that deal with it. These are the most common causes of MS networking problems: - - Basic TCP/IP configuration - NetBIOS name resolution - Authentication configuration - User and Group configuration - Basic File and Directory Permission Control in Unix/Linux - Understanding of how MS Windows clients interoperate in a network - environment - + + Basic TCP/IP configuration + NetBIOS name resolution + Authentication configuration + User and Group configuration + Basic File and Directory Permission Control in UNIX/Linux + Understanding of how MS Windows clients interoperate in a network + environment + -Do not be put off; on the surface of it MS Windows networking seems so simple that any fool +Do not be put off; on the surface of it MS Windows networking seems so simple that anyone can do it. In fact, it is not a good idea to set up an MS Windows network with inadequate training and preparation. But let's get our first indelible principle out of the way: It is perfectly OK to make mistakes! In the right place and at @@ -83,7 +85,12 @@ security protocols. -The benefits of Domain security are fully available to those sites that deploy a Samba PDC. +The benefits of Domain security are available to those sites that deploy a Samba PDC. +A Domain provides a unique network security identifier (SID). Domain user and group security +identifiers are comprised of the network SID plus a relative identifier (RID) that is unique to +the account. User and Group SIDs (the network SID plus the RID) can be used to create Access Control +Lists (ACLs) attached to network resources to provide organizational access control. UNIX systems +know only of local security identifiers. @@ -91,7 +98,7 @@ Network clients of an MS Windows Domain security environment must be Domain memb able to gain access to the advanced features provided. Domain membership involves more than just setting the workgroup name to the Domain name. It requires the creation of a Domain trust account for the workstation (called a machine account). Please refer to the chapter on -Domain Membership for more information. +setting up samba as a domain member for more information. @@ -106,8 +113,7 @@ The following functionalities are new to the Samba-3 release: Adding users via the User Manager for Domains. This can be done on any MS Windows client using the Nexus toolkit that is available from Microsoft's web site. - At some later date Samba-3 may get support for the use of the Microsoft Management - Console for user management. + Samba-3 supports the use of the Microsoft Management Console for user management. @@ -131,7 +137,9 @@ The following functionalities are NOT provided by Samba-3: SAM replication with Windows NT4 Domain Controllers - (i.e. a Samba PDC and a Windows NT BDC or vice versa) + (i.e. a Samba PDC and a Windows NT BDC or vice versa). This means samba + cannot operate as a BDC when the PDC is Microsoft-based or + replicate account data to Windows-BDC's. @@ -140,7 +148,9 @@ The following functionalities are NOT provided by Samba-3: Active Directory Domain Control ability that is at this time purely experimental AND that is certain to change as it becomes a fully supported feature some time - during the Samba-3 (or later) life cycle. + during the Samba-3 (or later) life cycle. However, Active Directory is + more then just SMB - it's also LDAP, Kerberos, DHCP and other protocols + (with proprietary extensions, of course). @@ -154,68 +164,18 @@ in Samba since approximately the Samba-1.9.15 series. Samba-3 has an implementation of group mapping between Windows NT groups -and Unix groups (this is really quite complicated to explain in a short space). This is -discussed more fully in the Group Mapping chapter. +and UNIX groups (this is really quite complicated to explain in a short space). This is +discussed more fully in the chapter on group mapping. Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store -user and machine trust account information in a suitable backend data store. With Samba-3 -there can be multiple back-ends for this including: +user and machine trust account information in a suitable backend data store. +Refer to the section on machine trust accounts. With Samba-3 there can be multiple +back-ends for this. A complete discussion of account database backends can be found in +the chapter on Account Information Databases. - - - - - smbpasswd - the plain ASCII file stored used by - earlier versions of Samba. This file configuration option requires - a Unix/Linux system account for EVERY entry (ie: both for user and for - machine accounts). This file will be located in the private - directory (default is /usr/local/samba/lib/private or on linux /etc/samba). - - - - tdbsam - a binary database backend that will be - stored in the private directory in a file called - passdb.tdb. The key benefit of this binary format - file is that it can store binary objects that can not be accommodated - in the traditional plain text smbpasswd file. These permit the extended - account controls that MS Windows NT4 and later also have. - - - - ldapsam - An LDAP based back-end. Permits the - LDAP server to be specified. eg: ldap://localhost or ldap://frodo.murphy.com. - Like the tdbsam, ldapsam permits the storing of extended account attributes - for control of things like: Permitted access times, password activation and - expiry, permitted points of access (workstation names), per user profile - location, and much more. - - - - ldapsam_compat - An LDAP back-end that maintains backwards - compatibility with the behaviour of samba-2.2.x. You should use this in the process - of migrating from samba-2.2.x to samba-3 if you do not want to rebuild your LDAP - database. - - - - -Read the chapter about Account Information Database for details -regarding the choices available and how to configure them. - - - -The new tdbsam and ldapsam account backends store substantially more information than -smbpasswd is capable of. The new backend database includes capacity to specify -per user settings for many parameters, over-riding global settings given in the -smb.conf file. eg: logon drive, logon home, logon path, etc. -Thus, with samba-3 it is possible to have a default system configuration for profiles, -and on a per user basis to over-ride this for those users who should not be subject -to the default configuration. - - @@ -238,23 +198,23 @@ there are three basic types of domain controllers: The Primary Domain Controller or PDC plays an important role in the MS -Windows NT4 and Windows 200x Domain Control architecture, but not in the manner that so many -expect. There is folk lore that dictates that because of it's role in the MS Windows -network, the PDC should be the most powerful and most capable machine in the network. +Windows NT4. In Windows 200x Domain Control architecture this role is held by domain controllers. +There is folk lore that dictates that because of it's role in the MS Windows +network, the domain controllers should be the most powerful and most capable machine in the network. As strange as it may seem to say this here, good over all network performance dictates that -the entire infrastructure needs to be balanced. It is advisable to invest more in the Backup -Domain Controllers and Stand-Alone (or Domain Member) servers than in the PDC. +the entire infrastructure needs to be balanced. It is advisable to invest more in Stand-Alone +(or Domain Member) servers than in the domain controllers. -In the case of MS Windows NT4 style domains, it is the PDC seeds the Domain Control database, -a part of the Windows registry called the SAM (Security Account Manager). It plays a key +In the case of MS Windows NT4 style domains, it is the PDC that initiates a new Domain Control database. +This forms a part of the Windows registry called the SAM (Security Account Manager). It plays a key part in NT4 type domain user authentication and in synchronisation of the domain authentication database with Backup Domain Controllers. -With MS Windows 200x Server based Active Directory domains, one domain controller seeds a potential +With MS Windows 200x Server based Active Directory domains, one domain controller initiates a potential hierarchy of domain controllers, each with their own area of delegated control. The master domain controller has the ability to override any down-stream controller, but a down-line controller has control only over it's down-line. With Samba-3 this functionality can be implemented using an @@ -264,9 +224,7 @@ LDAP based user and machine account back end. New to Samba-3 is the ability to use a back-end database that holds the same type of data as the NT4 style SAM (Security Account Manager) database (one of the registry files). -The Samba-3 SAM can be specified via the smb.conf file parameter -passwd backend and valid options include -smbpasswd, tdbsam, ldapsam, nisplussam, xmlsam, mysqlsam, guest. +See also the chapter on Account Information Databases. @@ -307,10 +265,20 @@ MS Windows 200x domain control protocols also. At this time any appearance that Samba-3 is capable of acting as an -ADS Domain Controller is limited and experimental in nature. +Domain Controller in native ADS mode is limited and experimental in nature. This functionality should not be used until the Samba-Team offers formal support for it. At such a time, the documentation will be revised to duly reflect all configuration and -management requirements. +management requirements. Samba can act as a NT4-style DC in a Windows 2000/XP +environment. However, there are certain compromises: + + + No machine policy files + No Group Policy Objects + No synchronously executed AD logon scripts + Can't use ANY Active Directory management tools to manage users and machines + Registry changes tattoo the main registry, while with AD they do NOT. ie: Leave permanent changes in effect + Without AD you can not peprform the function of exporting specific applications to specific users or groups + @@ -346,9 +314,8 @@ Domain it triggers a machine password change. When running a Domain all MS Windows NT / 200x / XP Professional clients should be configured as full Domain Members - IF A SECURE NETWORK IS WANTED. If the machine is NOT made a member of the -Domain, then it will operate like a workgroup (stand-alone) machine. Please refer the -Domain Membership chapter for information regarding - HOW to make your MS Windows clients Domain members. +Domain, then it will operate like a workgroup (stand-alone) machine. Please refer to +the chapter on domain membership for information regarding HOW to make your MS Windows clients Domain members. @@ -356,41 +323,41 @@ The following are necessary for configuring Samba-3 as an MS Windows NT4 style P NT4 / 200x / XP clients. - - Configuration of basic TCP/IP and MS Windows Networking - Correct designation of the Server Role (security = user) - Consistent configuration of Name Resolution (See chapter on Browsing and on - MS Windows network Integration) - Domain logons for Windows NT4 / 200x / XP Professional clients - Configuration of Roaming Profiles or explicit configuration to force local profile usage - Configuration of Network/System Policies - Adding and managing domain user accounts - Configuring MS Windows client machines to become domain members - + + Configuration of basic TCP/IP and MS Windows Networking + Correct designation of the Server Role (securityuser) + Consistent configuration of Name Resolution (See chapter on Network Browsing and on + Integrating Unix into Windows networks) + Domain logons for Windows NT4 / 200x / XP Professional clients + Configuration of Roaming Profiles or explicit configuration to force local profile usage + Configuration of Network/System Policies + Adding and managing domain user accounts + Configuring MS Windows client machines to become domain members + The following provisions are required to serve MS Windows 9x / Me Clients: - - Configuration of basic TCP/IP and MS Windows Networking - Correct designation of the Server Role (security = user) - Network Logon Configuration (Since Windows 9x / XP Home are not technically domain - members, they do not really participate in the security aspects of Domain logons as such) - Roaming Profile Configuration - Configuration of System Policy handling - Installation of the Network driver "Client for MS Windows Networks" and configuration - to log onto the domain - Placing Windows 9x / Me clients in user level security - if it is desired to allow - all client share access to be controlled according to domain user / group identities. - Adding and managing domain user accounts - + + Configuration of basic TCP/IP and MS Windows Networking + Correct designation of the Server Role (securityuser) + Network Logon Configuration (Since Windows 9x / XP Home are not technically domain + members, they do not really participate in the security aspects of Domain logons as such) + Roaming Profile Configuration + Configuration of System Policy handling + Installation of the Network driver "Client for MS Windows Networks" and configuration + to log onto the domain + Placing Windows 9x / Me clients in user level security - if it is desired to allow + all client share access to be controlled according to domain user / group identities. + Adding and managing domain user accounts + Roaming Profiles and System/Network policies are advanced network administration topics that are covered in the Profile Management and -Policy Management chapters of this document. However, these are not necessarily specific -to a Samba PDC as much as they are related to Windows NT networking concepts. +Policy Management chapters of this document. However, these are not +necessarily specific to a Samba PDC as much as they are related to Windows NT networking concepts. @@ -415,11 +382,13 @@ A Domain Controller is an SMB/CIFS server that:     + + For Samba to provide these is rather easy to configure. Each Samba Domain Controller must provide -the NETLOGON service which Samba calls the domain logons functionality +the NETLOGON service which Samba calls the domain logons functionality (after the name of the parameter in the &smb.conf; file). Additionally, one (1) server in a Samba-3 -Domain must advertise itself as the domain master browser. This causes the Primary Domain Controller +Domain must advertise itself as the domain master browserSee also the chapter about network browsing. This causes the Primary Domain Controller to claim domain specific NetBIOS name that identifies it as a domain master browser for its given domain/workgroup. Local master browsers in the same domain/workgroup on broadcast-isolated subnets then ask for a complete copy of the browse list for the whole wide area network. Browser clients @@ -435,101 +404,119 @@ instead of just the list for their broadcast-isolated subnet. The first step in creating a working Samba PDC is to understand the parameters necessary -in &smb.conf;. Here we attempt to explain the parameters that are covered in -the &smb.conf; man page. - - - -Here is an example &smb.conf; for acting as a PDC: - - - - [global] - ; Basic server settings - netbios name = POGO - workgroup = NARNIA - - ; User and Machine Account Backends - ; Choices are: tdbsam, smbpasswd, ldapsam, mysqlsam, xmlsam, guest - passdb backend = ldapsam, guest - - ; we should act as the domain and local master browser - os level = 64 - preferred master = yes - domain master = yes - local master = yes - - ; security settings (must user security = user) - security = user - - ; encrypted passwords are a requirement for a PDC (default = Yes) - encrypt passwords = yes - - ; support domain logons - domain logons = yes - - ; where to store user profiles? - logon path = \\%N\profiles\%u - - ; where is a user's home directory and where should it be mounted at? - logon drive = H: - logon home = \\homeserver\%u\winprofile - - ; specify a generic logon script for all users - ; this is a relative **DOS** path to the [netlogon] share - logon script = logon.cmd - - ; necessary share for domain controller - [netlogon] - path = /usr/local/samba/lib/netlogon - read only = yes - write list = ntadmin - - ; share for storing user profiles - [profiles] - path = /export/smb/ntprofile - read only = no - create mask = 0600 - directory mask = 0700 - +in &smb.conf;. An example &smb.conf; for acting as a PDC can be found in the example +for being a PDC. + + + + +smb.conf for being a PDC +[global] +netbios nameBELERIAND +workgroup&example.workgroup; +passdb backendldapsam, guest +os level33 +preferred masteryes +domain masteryes +local masteryes +securityuser +encrypt passwordsyes +domain logonsyes +logon path\\%N\profiles\%u +logon driveH: +logon home\\homeserver\%u\winprofile +logon scriptlogon.cmd + +[netlogon] +path/var/lib/samba/netlogon +read onlyyes +write listntadmin + +[profiles] +path/var/lib/samba/profiles +read onlyno +create mask0600 +directory mask0700 + + + + +The basic options shown above are explained as follows: + + + + passdb backend + + This contains all the user and group account information. Acceptable values for a PDC + are: smbpasswd, tdbsam, ldapsam. The 'guest' entry provides needed + default accounts. + + + Where is is intended to use backup domain controllers (BDCs) the only logical choice is + to use LDAP so that the passdb backend can be distributed. The tdbsam and smbpasswd files + can not effectively be distributed and therefore should not be used. + + + Domain Control Parameters + + The parameters os level, preferred master, domain master, security, + encrypt passwords, domain logons play a central role in assuring domain + control and network logon support. + + + The os level must be set at or above a value of 32. A domain controller + must be the domain master browser, must be set in user mode security, + must support Microsoft compatible encrypted passwords, and must provide the network logon + service (domain logons). Encrypted passwords must be enabled, for more details on how + to do this, refer to the chapter on account information databases. + + + Environment Parameters + + The parameters logon path, logon home, logon drive, logon script are + environment support settings that help to facilitate client logon operations and that help + to provide automated control facilities to ease network management overheads. Please refer + to the man page information for these parameters. + + + NETLOGON Share + + The NETLOGON share plays a central role in domain logon and domain membership support. + This share is provided on all Microsoft domain controllers. It is used to provide logon + scripts, to store Group Policy files (NTConfig.POL), as well as to locate other common + tools that may be needed for logon processing. This is an essential share on a domain controller. + + + PROFILE Share + + This share is used to store user desktop profiles. Eash user must have a directory at the root + of this share. This directory must be write enabled for the user and must be globally read enabled. + Samba-3 has a VFS module called 'fake_permissions' that may be installed on this share. This will + allow a Samba administrator to make the directory read only to everyone. Of course this is useful + only after the profile has been properly created. + + + The above parameters make for a full set of parameters that may define the server's mode -of operation. The following parameters are the essentials alone: - - - workgroup = NARNIA - domain logons = Yes - domain master = Yes - security = User - - -The additional parameters shown in the longer listing above just makes for a -more complete environment. - +of operation. The following &smb.conf; parameters are the essentials alone: + -There are a couple of points to emphasize in the above configuration. + +netbios nameBELERIAND +workgroup&example.workgroup; +domain logonsYes +domain masterYes +securityUser + - - - Encrypted passwords must be enabled. For more details on how - to do this, refer to Account Information Database chapter. - - - - The server must support domain logons and have a - [netlogon] share - - - - The server must be the domain master browser in order for Windows - client to locate the server as a DC. Please refer to the various - Network Browsing documentation included with this distribution for - details. - - + +The additional parameters shown in the longer listing above just makes for +more complete explanation. + @@ -537,12 +524,22 @@ There are a couple of points to emphasize in the above configuration. Samba ADS Domain Control -Samba-3 is not and can not act as an Active Directory Server. It can not truly function as +Samba-3 is not, and can not act as, an Active Directory Server. It can not truly function as an Active Directory Primary Domain Controller. The protocols for some of the functionality -the Active Directory Domain Controllers is have been partially implemented on an experimental -only basis. Please do NOT expect Samba-3 to support these protocols - nor should you depend -on any such functionality either now or in the future. The Samba-Team may well remove such -experimental features or may change their behaviour. +the Active Directory Domain Controllers has been partially implemented on an experimental +only basis. Please do NOT expect Samba-3 to support these protocols. Do not depend +on any such functionality either now or in the future. The Samba-Team may remove these +experimental features or may change their behaviour. This is mentioned for the benefit of those +who have discovered secret capabilities in samba-3 and who have asked when this functionality will be +completed. The answer is: Maybe or maybe never! + + + +To be sure: Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4 style +domain controllers have. Samba-3 does NOT have all the capabilities of Windows NT4, but it does have +a number of features that Windows NT4 domain contollers do not have. In short, Samba-3 is not NT4 and it +is not Windows Server 200x and it is not an Active Directory server. We hope this is plain and simple +enough for all to understand. @@ -551,7 +548,7 @@ experimental features or may change their behaviour. Domain and Network Logon Configuration -The subject of Network or Domain Logons is discussed here because it rightly forms +The subject of Network or Domain Logons is discussed here because it forms an integral part of the essential functionality that is provided by a Domain Controller. @@ -560,25 +557,26 @@ an integral part of the essential functionality that is provided by a Domain Con All Domain Controllers must run the netlogon service (domain logons -in Samba). One Domain Controller must be configured with domain master = Yes -(the Primary Domain Controller); on ALL Backup Domain Controllers domain master = No +in Samba). One Domain Controller must be configured with domain masterYes +(the Primary Domain Controller); on ALL Backup Domain Controllers domain masterNo must be set. Example Configuration - - [global] - domain logons = Yes - domain master = (Yes on PDC, No on BDCs) + + smb.conf for being a PDC + [global] +domain logonsYes +domain master(Yes on PDC, No on BDCs) - [netlogon] - comment = Network Logon Service - path = /var/lib/samba/netlogon - guest ok = Yes - browseable = No - +[netlogon] +commentNetwork Logon Service +path/var/lib/samba/netlogon +guest okYes +browseableNo + @@ -600,6 +598,8 @@ MS Windows XP Professional. Now that this has been said, please do NOT ask the mailing list, or email any of the Samba-Team members with your questions asking how to make this work. It can't be done. +If it can be done, then to do so would violate your software license agreement with +Microsoft, and we recommend that you do not do that. @@ -608,7 +608,7 @@ Samba-Team members with your questions asking how to make this work. It can't be The Special Case of Windows 9x / Me -A domain and a workgroup are exactly the same thing in terms of network +A domain and a workgroup are exactly the same in terms of network browsing. The difference is that a distributable authentication database is associated with a domain, for secure login access to a network. Also, different access rights can be granted to users if they @@ -635,7 +635,7 @@ which are the focus of this section. When an SMB client in a domain wishes to logon, it broadcasts requests for a logon server. The first one to reply gets the job, and validates its password using whatever mechanism the Samba administrator has installed. -It is possible (but very stupid) to create a domain where the user +It is possible (but ill advised ) to create a domain where the user database is not shared between servers, i.e. they are effectively workgroup servers advertising themselves as participating in a domain. This demonstrates how authentication is quite different from but closely @@ -727,7 +727,7 @@ The main difference between a PDC and a Windows 9x logon server configuration is Password encryption is not required for a Windows 9x logon server. But note that beginning with MS Windows 98 the default setting is that plain-text - password support has been disabled. It can be re-enabled with the registry + password support is disabled. It can be re-enabled with the registry changes that are documented in the chapter on Policies. @@ -741,6 +741,11 @@ A Samba PDC will act as a Windows 9x logon server; after all, it does provide th network logon services that MS Windows 9x / Me expect to find. + +Use of plain-text passwords is strongly discouraged. Where used they are easily detected +using a sniffer tool to examine network traffic. + + @@ -766,17 +771,18 @@ are two distinctly different functions), it is not a good idea to do so. You should remember that the DC must register the DOMAIN<#1b> NetBIOS name. This is the name used by Windows clients to locate the DC. Windows clients do not distinguish between the DC and the DMB. +A DMB is a Domain Master Browser - see Domain Master Browser. For this reason, it is very wise to configure the Samba DC as the DMB. Now back to the issue of configuring a Samba DC to use a mode other -than security = user. If a Samba host is configured to use +than securityuser. If a Samba host is configured to use another SMB server or DC in order to validate user connection requests, then it is a fact that some other machine on the network -(the password server) knows more about the user than the Samba host. +(the password server) knows more about the user than the Samba host. 99% of the time, this other host is a domain controller. Now -in order to operate in domain mode security, the workgroup parameter +in order to operate in domain mode security, the workgroup parameter must be set to the name of the Windows NT domain (which already has a domain controller). If the domain does NOT already have a Domain Controller then you do not yet have a Domain! @@ -785,7 +791,7 @@ then you do not yet have a Domain! Configuring a Samba box as a DC for a domain that already by definition has a PDC is asking for trouble. Therefore, you should always configure the Samba DC -to be the DMB for its domain and set security = user. +to be the DMB for its domain and set securityuser. This is the only officially supported mode of operation. @@ -794,10 +800,10 @@ This is the only officially supported mode of operation. -Common Problems and Errors +Common Errors -I cannot include a '$' in a machine name + '$' cannot be included in machine name A 'machine account', (typically) stored in /etc/passwd, takes the form of the machine name with a '$' appended. FreeBSD (and other BSD @@ -809,12 +815,19 @@ The problem is only in the program used to make the entry. Once made, it works p Create a user without the '$'. Then use vipw to edit the entry, adding the '$'. Or create the whole entry with vipw if you like; make sure you use a unique User ID! + + +The UNIX tool vipw is a common tool for directly editting the /etc/passwd file. + + -I get told "You already have a connection to the Domain...." + <title>Joining domain fails because of existing machine account + +I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account. +existing set.." when creating a machine trust account. This happens if you try to create a machine trust account from the @@ -824,7 +837,7 @@ will remove all network drive connections: - C:\WINNT\> net use * /d +&dosprompt;net use * /d @@ -838,10 +851,10 @@ does not matter what, reboot, and try again. The system can not log you on (C000019B).... -I joined the domain successfully but after upgrading +I joined the domain successfully but after upgrading to a newer version of the Samba code I get the message, The system can not log you on (C000019B), Please try again or consult your -system administrator when attempting to logon. +system administrator when attempting to logon. @@ -862,21 +875,27 @@ The reset or change the domain SID you can use the net command as follows: + +Workstation machine trust accounts work only with the Domain (or network) SID. If this SID changes +then domain members (workstations) will not be able to log onto the domain. The original Domain SID +can be recovered from the secrets.tdb file. The alternative is to visit each workstation to re-join +it to the domain. + + -The machine trust account for this computer either does not -exist or is not accessible. + The machine trust account not accessible -When I try to join the domain I get the message The machine account + When I try to join the domain I get the message The machine account for this computer either does not exist or is not accessible. What's -wrong? +wrong? This problem is caused by the PDC not having a suitable machine trust account. -If you are using the add machine script method to create +If you are using the add machine script method to create accounts then this would indicate that it has not worked. Ensure the domain admin user system is working. @@ -900,8 +919,10 @@ for both client and server. -When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled. + Account disabled + + When I attempt to login to a Samba Domain from a NT4/W2K workstation, + I get a message about my account being disabled. Enable the user accounts with smbpasswd -e username @@ -911,11 +932,41 @@ Enable the user accounts with smbpasswd -e username - Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable" + Domain Controller Unavailable + + Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable" + A domain controller has to announce on the network who it is. This usually takes a while. + + Can not log onto domain member workstation after joining domain + + After successfully joining the domain user logons fail with one of two messages: + + One to the effect that the domain controller can not be found, the other claiming that the + account does not exist in the domain or that the password is incorrect. + + This may be due to incompatible settings between + the Windows client and the Samba-3 server for schannel (secure channel) settings + or smb signing settings. Check your samba settings for + client schannel, server schannel, client signing, server signing by executing: + testparm -v | more and looking for the value of these parameters. + + + + Also use the Microsoft Management Console - Local Security Settings. This tool is available from the + Control Panel. The Policy settings are found in the Local Policies / Securty Options area and are prefixed by + Secure Channel: ..., and Digitally sign .... + + + + It is important that these be set consistently with the Samba-3 server settings. + + + + diff --git a/docs/docbook/projdoc/ServerType.xml b/docs/docbook/projdoc/ServerType.xml index c740fbefb1..32a5103150 100644 --- a/docs/docbook/projdoc/ServerType.xml +++ b/docs/docbook/projdoc/ServerType.xml @@ -21,9 +21,10 @@ and how these relate to MS Windows servers and clients. -Firstly we should recognise the question so often asked, "Why would I want to use Samba?" -So, in those chapters where the answer may be important you will see a section that highlights -features and benefits. These may be for or against Samba. +A question often asked is, "Why would I want to use Samba?" Most chapters contain a section +that highlights features and benefits. We hope that the information provided will help to +answer this question. Be warned though, we want to be fair and reasonable, so not all +features are positive towards Samba so the benefit may be on the side of our competition. @@ -45,7 +46,7 @@ a source of discomfort. Samba started out as a project that sought to provide interoperability for MS Windows 3.x -clients with a Unix server. It has grown up a lot since its humble beginnings and now provides +clients with a UNIX server. It has grown up a lot since its humble beginnings and now provides features and functionality fit for large scale deployment. It also has some warts. In sections like this one we will tell of both. @@ -97,24 +98,24 @@ different type of servers: Domain Controller - - Primary Domain Controller - Backup Domain Controller - ADS Domain Controller - + + Primary Domain Controller + Backup Domain Controller + ADS Domain Controller + Domain Member Server - - Active Directory Member Server - NT4 Style Domain Member Server - + + Active Directory Domain Server + NT4 Style Domain Domain Server + Stand Alone Server The chapters covering Domain Control, Backup Domain Control and Domain Membership provide -pertinent information regarding Samba-3 configuration for each of these server roles. +pertinent information regarding Samba configuration for each of these server roles. The reader is strongly encouraged to become intimately familiar with the information presented. @@ -125,7 +126,7 @@ presented. Samba Security Modes -In this section the function and purpose of Samba's security +In this section the function and purpose of Samba's security modes are described. An accurate understanding of how Samba implements each security mode as well as how to configure MS Windows clients for each mode will significantly reduce user complaints and administrator heartache. @@ -144,7 +145,7 @@ modes. They are documented in this chapter. -A SMB server tells the client at startup what security level + A SMB server tells the client at startup what security level it is running. There are two options: share level and user level. Which of these two the client receives affects the way the client then tries to authenticate itself. It does not directly affect @@ -158,7 +159,7 @@ available and whether an action is allowed. User Level Security -We will describe user level security first, as it's simpler. +We will describe user level security first, as it's simpler. In user level security, the client will send a session setup command directly after the protocol negotiation. This contains a username and password. The server can either accept or reject that @@ -193,9 +194,9 @@ authentication contexts in this way (WinDD is an example of an application that The &smb.conf; parameter that sets User Level Security is: - - security = user - + +securityuser + This is the default setting since samba-2.2.x. @@ -231,7 +232,7 @@ level security. They normally send a valid username but no password. Samba recor this username in a list of possible usernames. When the client then does a tree connection it also adds to this list the name of the share they try to connect to (useful for home directories) and any users -listed in the user = &smb.conf; line. The password is then checked +listed in the user &smb.conf; line. The password is then checked in turn against these possible usernames. If a match is found then the client is authenticated as that user. @@ -243,9 +244,9 @@ then the client is authenticated as that user. The &smb.conf; parameter that sets Share Level Security is: - - security = share - + +securityshare + Please note that there are reports that recent MS Windows clients do not like to work @@ -259,7 +260,7 @@ with share mode security servers. You are strongly discouraged from using share Domain Security Mode (User Level Security) -When Samba is operating in security = domain mode, +When Samba is operating in securitydomain mode, the Samba server has a domain security trust account (a machine account) and will cause all authentication requests to be passed through to the domain controllers. @@ -274,10 +275,10 @@ Samba as a Domain Member Server This method involves addition of the following parameters in the &smb.conf; file: - - security = domain - workgroup = "name_of_NT_domain" - + +securitydomain +workgroup&example.workgroup; + In order for this method to work, the Samba server needs to join the MS Windows NT @@ -289,31 +290,29 @@ security domain. This is done as follows: the Server Manager, add a machine account for the Samba server. - Next, on the Unix/Linux system execute: + Next, on the UNIX/Linux system execute: - &rootprompt;smbpasswd -j DOMAIN_NAME -r PDC_NAME (samba-2.x) - - &rootprompt;net join -U administrator%password (samba-3) + &rootprompt;net rpc join -U administrator%password -As of Samba-2.2.4 the Samba 2.2.x series can auto-join a Windows NT4 style Domain just -by executing: +Samba-2.2.4 and later can auto-join a Windows NT4 style Domain just by executing: -&rootprompt;smbpasswd -j DOMAIN_NAME -r PDC_NAME -U Administrator%password +&rootprompt;smbpasswd -j DOMAIN_NAME -r PDC_NAME \ + -U Administrator%password -As of Samba-3 the same can be done by executing: +Samba-3 can do the same by executing: -&rootprompt;net join -U Administrator%password +&rootprompt;net rpc join -U Administrator%password -It is not necessary with Samba-3 to specify the DOMAIN_NAME or the PDC_NAME as it -figures this out from the &smb.conf; file settings. +It is not necessary with Samba-3 to specify the DOMAIN_NAME or the +PDC_NAME as it figures this out from the &smb.conf; file settings. -Use of this mode of authentication does require there to be a standard Unix account +Use of this mode of authentication does require there to be a standard UNIX account for each user in order to assign a UID once the account has been authenticated by the remote Windows DC. This account can be blocked to prevent logons by clients other than MS Windows through means such as setting an invalid shell in the @@ -322,13 +321,11 @@ MS Windows through means such as setting an invalid shell in the An alternative to assigning UIDs to Windows users on a Samba member server is -presented in the Winbind Overview chapter -in this HOWTO collection. +presented in the chapter about winbind. -For more information of being a domain member, see the Domain -Member section of this Howto. + For more information of being a domain member, see the chapter about domain membership. @@ -339,41 +336,41 @@ Member section of this Howto. Both Samba 2.2 and 3.0 can join an Active Directory domain. This is -possible even if the domain is run in native mode. Active Directory in -native mode perfectly allows NT4-style domain members, contrary to +possible if the domain is run in native mode. Active Directory in +native mode perfectly allows NT4-style domain members. This is contrary to popular belief. The only thing that Active Directory in native mode prohibits is Backup Domain Controllers running NT4. -If you are running Active Directory starting with Samba 3.0 you can -however join as a native AD member. Why would you want to do that? +If you are using Active Directory, starting with Samba-3 you can +join as a native AD member. Why would you want to do that? Your security policy might prohibit the use of NT-compatible authentication protocols. All your machines are running Windows 2000 -and above and all use full Kerberos. In this case Samba as a NT4-style +and above and all use Kerberos. In this case Samba as a NT4-style domain would still require NT-compatible authentication data. Samba in -AD-member mode can accept Kerberos. +AD-member mode can accept Kerberos tickets. Example Configuration - - realm = your.kerberos.REALM - security = ADS - + +realmyour.kerberos.REALM +securityADS + - The following parameter may be required: +The following parameter may be required: - - ads server = your.kerberos.server - + +ads serveryour.kerberos.server + -Please refer to the Domain Membership and Active Directory -Membership sections for more information regarding this configuration option. +Please refer to the chapter on domain membership +for more information regarding this configuration option. @@ -388,23 +385,23 @@ as a domain member server. It is highly recommended NOT to use this feature. Ser security mode has many draw backs. The draw backs include: - - Potential Account Lockout on MS Windows NT4/200x password servers - Lack of assurance that the password server is the one specified - Does not work with Winbind, particularly needed when storing profiles remotely - This mode may open connections to the password server, and keep them open for extended periods. - Security on the Samba server breaks badly when the remote password server suddenly shuts down - With this mode there is NO security account in the domain that the password server belongs to for the Samba server. - + + Potential Account Lockout on MS Windows NT4/200x password servers + Lack of assurance that the password server is the one specified + Does not work with Winbind, particularly needed when storing profiles remotely + This mode may open connections to the password server, and keep them open for extended periods. + Security on the Samba server breaks badly when the remote password server suddenly shuts down + With this mode there is NO security account in the domain that the password server belongs to for the Samba server. + In server security mode the Samba server reports to the client that it is in user level security. The client then does a session setup as described earlier. The Samba server takes the username/password that the client sends and attempts to login to the -password server by sending exactly the same username/password that +password server by sending exactly the same username/password that it got from the client. If that server is in user level security and accepts the password, then Samba accepts the clients connection. This allows the Samba server to use another SMB -server as the password server. +server as the password server. @@ -415,10 +412,10 @@ passwords in encrypted form. Samba supports this type of encryption by default. -The parameter security = server means that Samba reports to clients that +The parameter securityserver means that Samba reports to clients that it is running in user mode but actually passes off all authentication requests to another user mode server. This requires an additional -parameter password server that points to the real authentication server. +parameter password server that points to the real authentication server. That real authentication server can be another Samba server or can be a Windows NT server, the later natively capable of encrypted password support. @@ -443,11 +440,11 @@ Using MS Windows NT as an authentication server This method involves the additions of the following parameters in the &smb.conf; file: - - encrypt passwords = Yes - security = server - password server = "NetBIOS_name_of_a_DC" - + +encrypt passwordsYes +securityserver +password server"NetBIOS_name_of_a_DC" + @@ -465,7 +462,7 @@ certain number of failed authentication attempts this will result in user lockou -Use of this mode of authentication does require there to be a standard Unix account +Use of this mode of authentication does require there to be a standard UNIX account for the user, though this account can be blocked to prevent logons by non-SMB/CIFS clients. @@ -475,7 +472,7 @@ for the user, though this account can be blocked to prevent logons by non-SMB/CI -Seamless Windows Network Integration +Password checking MS Windows clients may use encrypted passwords as part of a challenge/response @@ -532,25 +529,25 @@ upper casing usernames and password before transmitting them to the SMB server when using clear text authentication. - - password level = integer - username level = integer - + +password levelinteger +username levelinteger + By default Samba will lower case the username before attempting to lookup the user in the database of local system accounts. Because UNIX usernames conventionally -only contain lower-case characters, the username level parameter +only contain lower-case character, the username level parameter is rarely needed. However, passwords on UNIX systems often make use of mixed-case characters. This means that in order for a user on a Windows 9x client to connect to a Samba -server using clear text authentication, the password level +server using clear text authentication, the password level must be set to the maximum number of upper case letters which could -appear in a password. Note that the server OS uses the traditional DES version -of crypt(), a password level of 8 will result in case +appear in a password. Note that if the server OS uses the traditional DES version +of crypt(), a password level of 8 will result in case insensitive passwords as seen from Windows users. This will also result in longer login times as Samba has to compute the permutations of the password string and try them one by one until a match is located (or all combinations fail). @@ -586,7 +583,7 @@ to those for whom English is not their native tongue. To some the nature of the Samba security mode is very obvious, but entirely -wrong all the same. It is assumed that security = server means that Samba +wrong all the same. It is assumed that securityserver means that Samba will act as a server. Not so! See above - this setting means that Samba will try to use another SMB server as its source of user authentication alone. @@ -597,7 +594,7 @@ to use another SMB server as its source of user authentication alone. What makes Samba a Domain Controller? -The &smb.conf; parameter security = domain does NOT really make Samba behave +The &smb.conf; parameter securitydomain does NOT really make Samba behave as a Domain Controller! This setting means we want Samba to be a domain member! @@ -607,9 +604,9 @@ as a Domain Controller! This setting means we want Samba to be a domain member! What makes Samba a Domain Member? -Guess! So many others do. But whatever you do, do NOT think that security = user +Guess! So many others do. But whatever you do, do NOT think that securityuser makes Samba act as a domain member. Read the manufacturers manual before the warranty expires! See -the Domain Member section of this Howto for more information. +the chapter about domain membership for more information. @@ -619,16 +616,17 @@ the Domain Member section of this Howto for Constantly Losing Connections to Password Server + Why does server_validate() simply give up rather than re-establishing its connection to the password server? Though I am not fluent in the SMB protocol, perhaps the cluster server process passes along to its client workstation the session key it receives from the password server, which means the password hashes submitted by the client would not work on a subsequent -connection, whose session key would be different. So server_validate() must give up. +connection, whose session key would be different. So server_validate() must give up. -Indeed. That's why security = server is at best a nasty hack. Please use security = domain. -security = server mode is also known as pass-through authentication. + Indeed. That's why securityserver is at best a nasty hack. Please use securitydomain. +securityserver mode is also known as pass-through authentication. diff --git a/docs/docbook/projdoc/Speed.xml b/docs/docbook/projdoc/Speed.xml index 659cd6e31b..f462bb8a8a 100644 --- a/docs/docbook/projdoc/Speed.xml +++ b/docs/docbook/projdoc/Speed.xml @@ -63,7 +63,7 @@ line with the option, or in the &smb.conf; file. -The socket options section of the &smb.conf; manual page describes how +The socket options section of the &smb.conf; manual page describes how to set these and gives recommendations. @@ -76,7 +76,7 @@ much. The correct settings are very dependent on your local network. The socket option TCP_NODELAY is the one that seems to make the biggest single difference for most networks. Many people report that -adding socket options = TCP_NODELAY doubles the read +adding socket optionsTCP_NODELAY doubles the read performance of a Samba drive. The best explanation I have seen for this is that the Microsoft TCP/IP stack is slow in sending tcp ACKs. @@ -87,7 +87,7 @@ that the Microsoft TCP/IP stack is slow in sending tcp ACKs. Read size -The option read size affects the overlap of disk +The option read size affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger than this value then the server begins writing @@ -115,9 +115,9 @@ pointless and will cause you to allocate memory unnecessarily. Max xmit -At startup the client and server negotiate a maximum transmit size, + At startup the client and server negotiate a maximum transmit size, which limits the size of nearly all SMB commands. You can set the -maximum size that Samba will negotiate using the max xmit = option +maximum size that Samba will negotiate using the max xmit option in &smb.conf;. Note that this is the maximum size of SMB requests that Samba will accept, but not the maximum size that the *client* will accept. The client maximum receive size is sent to Samba by the client and Samba @@ -140,7 +140,7 @@ In most cases the default is the best option. Log level -If you set the log level (also known as debug level) higher than 2 +If you set the log level (also known as debug level) higher than 2 then you may suffer a large drop in performance. This is because the server flushes the log file after each operation, which can be very expensive. @@ -151,20 +151,20 @@ expensive. Read raw -The read raw operation is designed to be an optimised, low-latency +The read raw operation is designed to be an optimised, low-latency file read operation. A server may choose to not support it, -however. and Samba makes support for read raw optional, with it +however. and Samba makes support for read raw optional, with it being enabled by default. -In some cases clients don't handle read raw very well and actually +In some cases clients don't handle read raw very well and actually get lower performance using it than they get using the conventional read operations. -So you might like to try read raw = no and see what happens on your +So you might like to try read rawno and see what happens on your network. It might lower, raise or not affect your performance. Only testing can really tell. @@ -175,14 +175,14 @@ testing can really tell. Write raw -The write raw operation is designed to be an optimised, low-latency +The write raw operation is designed to be an optimised, low-latency file write operation. A server may choose to not support it, -however. and Samba makes support for write raw optional, with it +however. and Samba makes support for write raw optional, with it being enabled by default. -Some machines may find write raw slower than normal write, in which +Some machines may find write raw slower than normal write, in which case you may wish to change this option. @@ -193,7 +193,7 @@ case you may wish to change this option. Slow logins are almost always due to the password checking time. Using -the lowest practical password level will improve things. +the lowest practical password level will improve things. diff --git a/docs/docbook/projdoc/StandAloneServer.xml b/docs/docbook/projdoc/StandAloneServer.xml index 206b2f88ce..ec4f9f2693 100644 --- a/docs/docbook/projdoc/StandAloneServer.xml +++ b/docs/docbook/projdoc/StandAloneServer.xml @@ -69,9 +69,9 @@ the Samba server is NOT a member of a domain security context. Through the use of PAM (Pluggable Authentication Modules) and nsswitch -(the name service switcher) the source of authentication may reside on +(the name service switcher, which maintains the unix user database) the source of authentication may reside on another server. We would be inclined to call this the authentication server. -This means that the Samba server may use the local Unix/Linux system password database +This means that the Samba server may use the local UNIX/Linux system password database (/etc/passwd or /etc/shadow), may use a local smbpasswd file, or may use an LDAP back end, or even via PAM and Winbind another CIFS/SMB server @@ -89,7 +89,7 @@ attempt a high level of creativity and to introduce too much complexity in server and network design. - + Reference Documentation Server @@ -97,23 +97,23 @@ Configuration of a read-only data server that EVERYONE can access is very simple Here is the smb.conf file that will do this. Assume that all the reference documents are stored in the directory /export, that the documents are owned by a user other than nobody. No home directories are shared, that are no users in the /etc/passwd -Unix system database. This is a very simple system to administer. +UNIX system database. This is a very simple system to administer. - - # Global parameters - [global] - workgroup = MYGROUP - netbios name = REFDOCS - security = SHARE - passdb backend = guest - wins server = 192.168.1.1 - - [data] - comment = Data - path = /export - guest only = Yes - + +smb.conf for Reference Documentation Server + Global parameters +[global] +workgroup&example.workgroup; +netbios name&example.server.samba; +securitySHARE +passdb backendguest +wins server192.168.1.1 +[data] +commentData +path/export +guest onlyYes + In the above example the machine name is set to REFDOCS, the workgroup is set to the name @@ -125,7 +125,7 @@ we do use it. - + Central Print Serving @@ -141,7 +141,7 @@ on your system. The print spooling and processing system on our print server will be CUPS. - (Please refer to the CUPS Printing chapter for more information). + (Please refer to the chapter about CUPS for more information). @@ -166,13 +166,13 @@ the anonymous (guest) user, two things will be required: Enabling Anonymous Printing - The Unix/Linux system must have a guest account. + The UNIX/Linux system must have a guest account. The default for this is usually the account nobody. To find the correct name to use for your version of Samba do the following: - -$ testparm -s -v | grep "guest account" - + +&prompt;testparm -s -v | grep "guest account" + Then make sure that this account exists in your system password database (/etc/passwd). @@ -181,34 +181,36 @@ the anonymous (guest) user, two things will be required: The directory into which Samba will spool the file must have write access for the guest account. The following commands will ensure that this directory is available for use: - + &rootprompt;mkdir /var/spool/samba &rootprompt;chown nobody.nobody /var/spool/samba &rootprompt;chmod a+rwt /var/spool/samba - + - - # Global parameters - [global] - workgroup = MYGROUP - netbios name = PTRSVR1 - security = SHARE - passdb backend = guest - wins server = 192.168.1.1 - - [printers] - comment = All Printers - path = /var/spool/samba - printer admin = root - guest ok = Yes - printable = Yes - printing = cups - use client driver = Yes - browseable = No - + + smb.conf for anonymous printing + Global parameters +[global] +workgroup&example.workgroup; +netbios name&example.server.samba; +securitySHARE +passdb backendguest +wins server&example.server.wins; +printingcups +printcap namecups + +[printers] +commentAll Printers +path/var/spool/samba +printer adminroot +guest okYes +printableYes +use client driverYes +browseableNo + diff --git a/docs/docbook/projdoc/UNIX_INSTALL.xml b/docs/docbook/projdoc/UNIX_INSTALL.xml index e919ff8c57..6a38e60c0e 100644 --- a/docs/docbook/projdoc/UNIX_INSTALL.xml +++ b/docs/docbook/projdoc/UNIX_INSTALL.xml @@ -15,12 +15,12 @@ Binary packages of samba are included in almost any Linux or - Unix distribution. There are also some packages available at + UNIX distribution. There are also some packages available at the samba homepage. - If you need to compile samba from source, check the - appropriate appendix chapter. + If you need to compile samba from source, check + the chapter about compiling samba from scratch. If you have already installed samba, or if your operating system was pre-installed with samba, then you may not need to bother with this @@ -55,39 +55,39 @@ - - [global] - workgroup = MYGROUP - - [homes] - guest ok = no - read only = no - + + Simplest possible smb.conf file +[global] +workgroup&example.workgroup; + +[homes] +guest okno +read onlyno + This will allow connections by anyone with an account on the server, using either - their login name or "homes" as the service name. + their login name or homes" as the service name. (Note that the workgroup that Samba must also be set.) - Make sure you put the smb.conf file in the same place - you specified in the Makefile (the default is to - look for it in /usr/local/samba/lib/). + Make sure you put the &smb.conf; file in the correct place + (usually in /etc/samba). For more information about security settings for the - [homes] share please refer to the chapter - Securing Samba. + [homes] share please refer to + "Securing Samba". Test your config file with <command>testparm</command> - It's important that you test the validity of your smb.conf + It's important that you test the validity of your &smb.conf; file using the &testparm; program. If testparm runs OK then it will list the loaded services. If not it will give an error message. @@ -115,7 +115,7 @@ To launch SWAT just run your favorite web browser and - point it at http://localhost:901/. Replace + point it at http://localhost:901/. Replace localhost with the name of the computer you are running samba on if you are running samba on a different computer than your browser. @@ -134,8 +134,9 @@ Try listing the shares available on your server - $ smbclient -L - yourhostname + +&prompt;smbclient -L yourhostname + You should get back a list of shares available on your server. If you don't then something is incorrectly setup. @@ -153,51 +154,55 @@ Try connecting with the unix client - $ smbclient - //yourhostname/aservice + + +&prompt;smbclient //yourhostname/aservice + Typically the yourhostname would be the name of the host where you installed &smbd;. The aservice is any service you have defined in the &smb.conf; - file. Try your user name if you just have a [homes] + file. Try your user name if you just have a [homes] section in &smb.conf;. For example if your unix host is bambi and your login name is fred you would type: - $ smbclient //bambi/fred - + +&prompt;smbclient //bambi/fred + - Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client - - Try mounting disks. eg: + Try connecting from another SMB client - C:\WINDOWS\> net use d: \\servername\service - + Try mounting disks. from a DOS, Windows or OS/2 client, eg: + + +&dosprompt;net use d: \\servername\service + Try printing. eg: - C:\WINDOWS\> net use lpt1: - \\servername\spoolservice + + +&dosprompt;net use lpt1: \\servername\spoolservice + - C:\WINDOWS\> print filename - + +&dosprompt;print filename + What If Things Don't Work? - Then you might read the file chapter - Diagnosis and the - FAQ. If you are still stuck then try to follow - the Analysing and Solving Problems chapter + Then you might read the file chapter diagnosis + and the FAQ. If you are still stuck then refer to "Analysing and solving problems". Samba has been successfully installed at thousands of sites worldwide, - so maybe someone else has hit your problem and has overcome it. + so maybe someone else has hit your problem and has overcome it. @@ -209,55 +214,7 @@ The following questions and issues get raised on the samba mailing list over and -Why are so many smbd processes eating memory? - - - -Site that is running Samba on an AIX box. They are sharing out about 2 terabytes using samba. -Samba was installed using smitty and the binaries. We seem to be experiencing a memory problem -with this box. When I do a svmon -Pu the monitoring program shows that &smbd; has several -processes of smbd running: - - - - - -Is samba suppose to start this many different smbd processes? Or does it run as one smbd process? Also -is it normal for it to be taking up this much memory? - - - - - -Inuse * 4096 = amount of memory being used by this process - - Pid Command Inuse Pin Pgsp Virtual 64-bit Mthrd - 20950 smbd 33098 1906 181 5017 N N - 22262 smbd 9104 1906 5410 - 21060 smbd 9048 1906 181 5479 N N - 25972 smbd 8678 1906 181 5109 N N - 24524 smbd 8674 1906 181 5105 N N - 19262 smbd 8582 1906 181 5013 N N - 20722 smbd 8572 1906 181 5003 N N - 21454 smbd 8572 1906 181 5003 N N - 28946 smbd 8567 1906 181 4996 N N - 24076 smbd 8566 1906 181 4996 N N - 20138 smbd 8566 1906 181 4996 N N - 17608 smbd 8565 1906 181 4996 N N - 21820 smbd 8565 1906 181 4996 N N - 26940 smbd 8565 1906 181 4996 N N - 19884 smbd 8565 1906 181 4996 N N - 9912 smbd 8565 1906 181 4996 N N - 25800 smbd 8564 1906 181 4995 N N - 20452 smbd 8564 1906 181 4995 N N - 18592 smbd 8562 1906 181 4993 N N - 28216 smbd 8521 1906 181 4954 N N - 19110 smbd 8404 1906 181 4862 N N - - Total memory used: 841,592,832 bytes - - - + Large number of smbd processes Samba consists on three core programs: @@ -285,10 +242,27 @@ run in "split mode" (in which case there will be two instances). - I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs - Your loopback device isn't working correctly. Make sure it's running. + "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" + Your loopback device isn't working correctly. Make sure it's configured properly. The loopback device is an internal (virtual) network device with + the ip address 127.0.0.1. Read your OS documentation for details + on how to configure the loopback on your system. + + "<errorname>The network name cannot be found</errorname>" + + + This error can be caused by one of these misconfigurations: + + + + You specified an nonexisting path for the share in &smb.conf; + The user you are trying to access the share with does not + have sufficient permissions to access the path for the share. Both read (r) and access (x) should be possible. + The share you are trying to access does not exist. + + + diff --git a/docs/docbook/projdoc/VFS.xml b/docs/docbook/projdoc/VFS.xml index 67f1b39a99..c949055371 100644 --- a/docs/docbook/projdoc/VFS.xml +++ b/docs/docbook/projdoc/VFS.xml @@ -33,18 +33,19 @@ on different systems. They currently have been tested against GNU/Linux and IRI To use the VFS modules, create a share similar to the one below. The -important parameter is the vfs objects parameter where +important parameter is the vfs objects parameter where you can list one or more VFS modules by name. For example, to log all access to files and put deleted files in a recycle bin: - -[audit] - comment = Audited /data directory - path = /data - vfs objects = audit recycle - writeable = yes - browseable = yes - + + smb.conf with VFS modules + [audit] +commentAudited /data directory +path/data +vfs objectsaudit recycle +writeableyes +browseableyes + @@ -62,17 +63,18 @@ directory in the root directory of the samba installation (usually Some modules can be used twice for the same share. This can be done using a configuration similar to the one below. - -[test] - comment = VFS TEST - path = /data - writeable = yes - browseable = yes - vfs objects = example:example1 example example:test - example1: parameter = 1 - example: parameter = 5 - test: parameter = 7 - + + smb.conf with multiple VFS modules +[test] +commentVFS TEST +path/data +writeableyes +browseableyes +vfs objectsexample:example1 example example:test +example1: parameter1 +example: parameter5 +test: parameter7 + @@ -86,12 +88,12 @@ This can be done using a configuration similar to the one below. A simple module to audit file access to the syslog facility. The following operations are logged: - - share - connect/disconnect - directory opens/create/remove - file open/close/rename/unlink/chmod - + + share + connect/disconnect + directory opens/create/remove + file open/close/rename/unlink/chmod + @@ -107,7 +109,7 @@ This can be done using a configuration similar to the one below. The logging information that will be written to the smbd log file is controlled by - the log level parameter in smb.conf. The + the log level parameter in &smb.conf;. The following information will be recorded: @@ -144,49 +146,65 @@ This can be done using a configuration similar to the one below. A recycle-bin like module. When used any unlink call will be intercepted and files moved to the recycle - directory instead of being deleted. + directory instead of being deleted. This gives the same + effect as the "Recycle Bin" on Windows computers. Supported options: recycle:repository - FIXME + Relative path of the directory where deleted files should be moved to recycle:keeptree - FIXME + Specifies whether the directory structure should + be kept or if the files in the directory that is being + deleted should be kept seperately in the recycle bin. + recycle:versions - FIXME + If this option is set, two files + with the same name that are deleted will both + be kept in the recycle bin. Newer deleted versions + of a file will be called "Copy #x of filename". recycle:touch - FIXME + Specifies whether a file's access + date should be touched when the file is moved to + the recycle bin. recycle:maxsize - FIXME + Files that are larger than the number + of bytes specified by this parameter will + not be put into the recycle bin. recycle:exclude - FIXME + List of files that should not + be put into the recycle bin when deleted, but deleted + in the regular way. recycle:exclude_dir - FIXME + Contains a list of directories. When files from + these directories are deleted, they are not put into the + recycle bin, but deleted in the regular way. + recycle:noversions - FIXME + Opposite of recycle:versions. If both options are specified, this one takes precedence. @@ -202,10 +220,10 @@ This can be done using a configuration similar to the one below. Advantages compared to the old netatalk module: - - it doesn't care about creating of .AppleDouble forks, just keeps them in sync - if a share in &smb.conf; doesn't contain .AppleDouble item in hide or veto list, it will be added automatically - + + it doesn't care about creating of .AppleDouble forks, just keeps them in sync + if a share in &smb.conf; doesn't contain .AppleDouble item in hide or veto list, it will be added automatically + @@ -231,7 +249,7 @@ should be implied due to its presence here. DatabaseFS - URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php + URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php By Eric Lorimer. @@ -258,7 +276,7 @@ should be implied due to its presence here. vscan - URL: http://www.openantivirus.org/ + URL: http://www.openantivirus.org/ samba-vscan is a proof-of-concept module for Samba, which @@ -271,12 +289,4 @@ should be implied due to its presence here. - -Common Errors - - -There must be some gotchas we should record here! Jelmer??? - - - diff --git a/docs/docbook/projdoc/locking.xml b/docs/docbook/projdoc/locking.xml index 0e508f682a..17dc518226 100644 --- a/docs/docbook/projdoc/locking.xml +++ b/docs/docbook/projdoc/locking.xml @@ -62,7 +62,7 @@ that are specified when a file is open. -Record locking semantics under Unix are very different from record locking under +Record locking semantics under UNIX are very different from record locking under Windows. Versions of Samba before 2.2 have tried to use the native fcntl() unix system call to implement proper record locking between different Samba clients. This can not be fully correct due to several reasons. The simplest is the fact @@ -75,29 +75,29 @@ many more differences, too many to be listed here. Samba 2.2 and above implements record locking completely independent of the underlying unix system. If a byte range lock that the client requests happens -to fall into the range 0-2^31, Samba hands this request down to the Unix system. +to fall into the range 0-2^31, Samba hands this request down to the UNIX system. All other locks can not be seen by unix anyway. -Strictly a SMB server should check for locks before every read and write call on -a file. Unfortunately with the way fcntl() works this can be slow and may overstress +Strictly an SMB server should check for locks before every read and write call on +a file. Unfortunately with the way fcntl() works this can be slow and may over-stress the rpc.lockd. It is also almost always unnecessary as clients are supposed to independently make locking calls before reads and writes anyway if locking is important to them. By default Samba only makes locking calls when explicitly asked -to by a client, but if you set strict locking = yes then it +to by a client, but if you set strict lockingyes then it will make lock checking calls on every read and write. -You can also disable byte range locking completely using locking = no. +You can also disable byte range locking completely using lockingno. This is useful for those shares that don't support locking or don't need it (such as cdroms). In this case Samba fakes the return codes of locking calls to tell clients that everything is OK. -The second class of locking is the deny modes. These +The second class of locking is the deny modes. These are set by an application when it opens a file to determine what types of access should be allowed simultaneously with its open. A client may ask for DENY_NONE, DENY_READ, @@ -328,19 +328,19 @@ in a performance bottleneck. -Unix or NFS Client Accessed Files +UNIX or NFS Client Accessed Files -Local Unix and NFS clients access files without a mandatory +Local UNIX and NFS clients access files without a mandatory file locking mechanism. Thus, these client platforms are incapable of initiating an oplock break request from the server to a Windows client -that has a file cached. Local Unix or NFS file access can therefore +that has a file cached. Local UNIX or NFS file access can therefore write to a file that has been cached by a Windows client, which exposes the file to likely data corruption. -If files are shared between Windows clients, and either local Unix +If files are shared between Windows clients, and either local UNIX or NFS users, then turn opportunistic locking off. @@ -409,7 +409,7 @@ the share. Beware of Force User -Samba includes an &smb.conf; parameter called force user that changes +Samba includes an &smb.conf; parameter called force user that changes the user accessing a share from the incoming user to whatever user is defined by the smb.conf variable. If opportunistic locking is enabled on a share, the change in user access causes an oplock break to be sent @@ -426,7 +426,7 @@ Avoid the combination of the following: - force user in the &smb.conf; share configuration. + force user in the &smb.conf; share configuration. @@ -449,8 +449,8 @@ administrator to adjust various properties of the oplock mechanism to account for timing and usage levels. These parameters provide good versatility for implementing oplocks in environments where they would likely cause problems. The parameters are: -oplock break wait time, -oplock contention limit. +oplock break wait time, +oplock contention limit. @@ -514,7 +514,7 @@ enabled and disabled. Opportunistic Locking is a unique Windows file locking feature. It is not really file locking, but is included in most discussions of Windows -file locking, so is considered a defacto locking feature. +file locking, so is considered a de facto locking feature. Opportunistic Locking is actually part of the Windows client file caching mechanism. It is not a particularly robust or reliable feature when implemented on the variety of customized networks that exist in @@ -557,7 +557,7 @@ oplock aware at this time. Unless your system supports kernel oplocks, you should disable oplocks if you are -accessing the same files from both Unix/Linux and SMB clients. Regardless, oplocks should +accessing the same files from both UNIX/Linux and SMB clients. Regardless, oplocks should always be disabled if you are sharing a database file (e.g., Microsoft Access) between multiple clients, as any break the first client receives will affect synchronisation of the entire file (not just the single record), which will result in a noticeable performance @@ -594,11 +594,11 @@ You can disable oplocks on a per-share basis with the following: - -[acctdata] - oplocks = False - level2 oplocks = False - + +[acctdata] +oplocksFalse +level2 oplocksFalse + @@ -611,9 +611,9 @@ Alternately, you could disable oplocks on a per-file basis within the share: - - veto oplock files = /*.mdb/*.MDB/*.dbf/*.DBF/ - + +veto oplock files/*.mdb/*.MDB/*.dbf/*.DBF/ + @@ -641,10 +641,9 @@ basis in the &smb.conf; file. - -[global] -kernel oplocks = yes - + +kernel oplocksyes + The default is "no". @@ -663,17 +662,18 @@ enabled on a per-share basis, or globally for the entire server, in the -Example Veto OpLock Settings -[global] - veto oplock files = /filename.htm/*.txt/ + + Share with some files oplocked +[global] +veto oplock files/filename.htm/*.txt/ -[share_name] - veto oplock files = /*.exe/filename.ext/ - +[share_name] +veto oplock files/*.exe/filename.ext/ + -Oplock break wait time is an &smb.conf; parameter that adjusts the time + oplock break wait time is an &smb.conf; parameter that adjusts the time interval for Samba to reply to an oplock break request. Samba recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Wait Time can only be @@ -681,10 +681,9 @@ configured globally in the &smb.conf; file: - -[global] - oplock break wait time = 0 (default) - + +oplock break wait time 0 (default) + @@ -698,13 +697,13 @@ the entire server, in the &smb.conf; file: - -[global] - oplock break contention limit = 2 (default) + +[global] +oplock break contention limit 2 (default) -[share_name] - oplock break contention limit = 2 (default) - +[share_name] +oplock break contention limit 2 (default) + @@ -919,7 +918,7 @@ potentially cause loss of cached data. Persistent Data Corruption -If you have applied all of the settings discussed in this paper but data corruption problems +If you have applied all of the settings discussed in this chapter but data corruption problems and other symptoms persist, here are some additional things to check out: @@ -984,14 +983,16 @@ so far: locking.tdb error messages - - > We are seeing lots of errors in the samba logs like: - > - > tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic - > 0x4d6f4b61 at offset=36116 - > - > What do these mean? - + + We are seeing lots of errors in the samba logs like: + + +tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic + 0x4d6f4b61 at offset=36116 + + + What do these mean? + @@ -1000,6 +1001,25 @@ so far: + + Problems saving files in MS Office on Windows XP + + This is a bug in Windows XP. More information can be + found in Microsoft Knowledge Base article 812937. + + + + + + Long delays deleting files over network with XP SP1 + + It sometimes takes approximately 35 seconds to delete files over the network after XP SP1 has been applied + + This is a bug in Windows XP. More information can be + found in + Microsoft Knowledge Base article 811492. + + @@ -1019,22 +1039,22 @@ Section of the Microsoft MSDN Library on opportunistic locking: Opportunistic Locks, Microsoft Developer Network (MSDN), Windows Development > Windows Base Services > Files and I/O > SDK Documentation > File Storage > File Systems > About File Systems > Opportunistic Locks, Microsoft Corporation. -http://msdn.microsoft.com/library/en-us/fileio/storage_5yk3.asp +http://msdn.microsoft.com/library/en-us/fileio/storage_5yk3.asp Microsoft Knowledge Base Article Q224992 "Maintaining Transactional Integrity with OPLOCKS", -Microsoft Corporation, April 1999, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q224992. +Microsoft Corporation, April 1999, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q224992. Microsoft Knowledge Base Article Q296264 "Configuring Opportunistic Locking in Windows 2000", -Microsoft Corporation, April 2001, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296264. +Microsoft Corporation, April 2001, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296264. Microsoft Knowledge Base Article Q129202 "PC Ext: Explanation of Opportunistic Locking on Windows NT", - Microsoft Corporation, April 1995, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202. + Microsoft Corporation, April 1995, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202. diff --git a/docs/docbook/projdoc/msdfs_setup.xml b/docs/docbook/projdoc/msdfs_setup.xml index c21c9ec6bf..90259f6a51 100644 --- a/docs/docbook/projdoc/msdfs_setup.xml +++ b/docs/docbook/projdoc/msdfs_setup.xml @@ -27,23 +27,21 @@ - For information about DFS, refer to - - Microsoft documentation at http://www.microsoft.com/NTServer/nts/downloads/winfeatures/NTSDistrFile/AdminGuide.asp. + For information about DFS, refer to the +Microsoft documentation. - This document explains how to host a DFS tree on a Unix machine (for DFS-aware + This document explains how to host a DFS tree on a UNIX machine (for DFS-aware clients to browse) using Samba. - To enable SMB-based DFS for Samba, configure it with the --with-msdfs + To enable SMB-based DFS for Samba, configure it with the option. Once built, a Samba server can be made a DFS server by setting the global - boolean host msdfs - parameter in the smb.conf file. You designate a share as a DFS - root using the share level boolean - msdfs root parameter. A DFS root directory on Samba hosts DFS + boolean host msdfs + parameter in the &smb.conf; file. You designate a share as a DFS + root using the share level boolean msdfs root parameter. A DFS root directory on Samba hosts DFS links in the form of symbolic links that point to other servers. For example, a symbolic link junction->msdfs:storage1\share1 in the share directory acts as the DFS junction. When DFS-aware clients attempt to access the junction link, @@ -58,28 +56,28 @@ Here's an example of setting up a DFS tree on a Samba server. - -# The smb.conf file: -[global] - netbios name = SMOKEY - host msdfs = yes + + smb.conf with DFS configured +[global] +netbios name&example.server.samba; +host msdfs yes -[dfs] - path = /export/dfsroot - msdfs root = yes - +[dfs] +path/export/dfsroot +msdfs rootyes + - In the /export/dfsroot directory we set up our dfs links to + In the /export/dfsroot directory we set up our DFS links to other servers on the network. - - &rootprompt;cd /export/dfsroot - &rootprompt;chown root /export/dfsroot - &rootprompt;chmod 755 /export/dfsroot - &rootprompt;ln -s msdfs:storageA\\shareA linka - &rootprompt;ln -s msdfs:serverB\\share,serverC\\share linkb - + +&rootprompt;cd /export/dfsroot +&rootprompt;chown root /export/dfsroot +&rootprompt;chmod 755 /export/dfsroot +&rootprompt;ln -s msdfs:storageA\\shareA linka +&rootprompt;ln -s msdfs:serverB\\share,serverC\\share linkb + You should set up the permissions and ownership of the directory acting as the DFS root such that only designated @@ -99,9 +97,9 @@ Common Errors Windows clients need to be rebooted - if a previously mounted non-dfs share is made a dfs + if a previously mounted non-dfs share is made a DFS root or vice versa. A better way is to introduce a - new share and make it the dfs root. + new share and make it the DFS root.     Currently there's a restriction that msdfs diff --git a/docs/docbook/projdoc/passdb.xml b/docs/docbook/projdoc/passdb.xml index 3a33e9f1e7..0ee3fa709e 100644 --- a/docs/docbook/projdoc/passdb.xml +++ b/docs/docbook/projdoc/passdb.xml @@ -17,8 +17,8 @@ Account Information Databases -Samba-3 implements a new capability to work concurrently with multiple account backends. -The possible new combinations of password backends allows Samba-3 a degree of flexibility +Samba 3 implements a new capability to work concurrently with multiple account backends. +The possible new combinations of password backends allows Samba 3 a degree of flexibility and scalability that previously could be achieved only with MS Windows Active Directory. This chapter describes the new functionality and how to get the most out of it. @@ -26,10 +26,10 @@ This chapter describes the new functionality and how to get the most out of it. In the course of development of Samba-3, a number of requests were received to provide the ability to migrate MS Windows NT4 SAM accounts to Samba-3 without the need to provide -matching Unix/Linux accounts. We called this the Non Unix Accounts (NUA) +matching UNIX/Linux accounts. We called this the Non UNIX Accounts (NUA) capability. The intent was that an administrator could decide to use the tdbsam -backend and by simply specifying "passdb backend = tdbsam_nua, guest" -this would allow Samba-3 to implement a solution that did not use Unix accounts per se. Late +backend and by simply specifying passdb backendtdbsam_nua +this would allow Samba-3 to implement a solution that did not use UNIX accounts per se. Late in the development cycle, the team doing this work hit upon some obstacles that prevents this solution from being used. Given the delays with Samba-3 release a decision was made to NOT deliver this functionality until a better method of recognising NT Group SIDs from NT User @@ -37,7 +37,8 @@ SIDs could be found. This feature may thus return during the life cycle for the -Samba-3.0.0 does NOT support Non-Unix Account (NUA) operation. +Samba-3 does NOT support Non-UNIX Account (NUA) operation for user accounts. +Samba-3 does support NUA operation for machine accounts. @@ -48,12 +49,14 @@ Samba-3 provides for complete backwards compatibility with Samba-2.2.x functiona as follows: + + Backwards Compatibility Backends + -Backwards Compatibility Backends Plain Text: - This option uses nothing but the Unix/Linux /etc/passwd + This option uses nothing but the UNIX/Linux /etc/passwd style back end. On systems that have PAM (Pluggable Authentication Modules) support all PAM modules are supported. The behaviour is just as it was with Samba-2.2.x, and the protocol limitations imposed by MS Windows clients @@ -94,22 +97,18 @@ as follows: + + + + New Backends + Samba-3 introduces the following new password backend capabilities: - -New Backends - guest: - - - This is always required as the last backend specified. - It provides the ability to handle guest account requirements for access to - resources like IPC$ which is used for browsing. - - - + + tdbsam: @@ -186,17 +185,10 @@ Samba-3 introduces the following new password backend capabilities: - nisplussam: - - - The NIS+ based passdb backend. Takes name NIS domain as an - optional argument. Only works with Sun NIS+ servers. - - - - + + @@ -223,11 +215,19 @@ Samba-3 introduces the following new password backend capabilities: In addition to differently encrypted passwords, windows also stores certain data for each user that is not stored in a unix user database. e.g: workstations the user may logon from, the location where the users' profile is stored, and so on. Samba retrieves and stores this - information using a passdb backend. Commonly available backends are LDAP, plain text + information using a passdb backend. Commonly available backends are LDAP, plain text file, MySQL and nisplus. For more information, see the man page for &smb.conf; regarding the - passdb backend parameter. + passdb backend parameter. + +
    IDMAP + + + + +
    + Important Notes About Security @@ -263,12 +263,12 @@ Samba-3 introduces the following new password backend capabilities: although they may log onto a domain environment: - - MS DOS Network client 3.0 with the basic network redirector installed - Windows 95 with the network redirector update installed - Windows 98 [se] - Windows Me - + + MS DOS Network client 3.0 with the basic network redirector installed + Windows 95 with the network redirector update installed + Windows 98 [se] + Windows Me + @@ -281,13 +281,13 @@ Samba-3 introduces the following new password backend capabilities: The following versions of MS Windows fully support domain security protocols. - - Windows NT 3.5x - Windows NT 4.0 - Windows 2000 Professional - Windows 200x Server/Advanced Server - Windows XP Professional - + + Windows NT 3.5x + Windows NT 4.0 + Windows 2000 Professional + Windows 200x Server/Advanced Server + Windows XP Professional + All current release of Microsoft SMB/CIFS clients support authentication via the @@ -352,37 +352,63 @@ Samba-3 introduces the following new password backend capabilities: - Mapping User Identifiers between MS Windows and Unix + Mapping User Identifiers between MS Windows and UNIX - Every operation in Unix/Linux requires a user identifier (UID), just as in + Every operation in UNIX/Linux requires a user identifier (UID), just as in MS Windows NT4 / 200x this requires a Security Identifier (SID). Samba provides - two means for mapping an MS Windows user to a Unix/Linux UID. + two means for mapping an MS Windows user to a UNIX/Linux UID. Firstly, all Samba SAM (Security Account Manager database) accounts require - a Unix/Linux UID that the account will map to. As users are added to the account - information database, Samba-3 will call the add user script - interface to add the account to the Samba host OS. In essence, all accounts in + a UNIX/Linux UID that the account will map to. As users are added to the account + information database, Samba will call the add user script + interface to add the account to the Samba host OS. In essence all accounts in the local SAM require a local user account. - The second way to affect Windows SID to Unix UID mapping is via the + The second way to affect Windows SID to UNIX UID mapping is via the idmap uid, idmap gid parameters in &smb.conf;. Please refer to the man page for information about these parameters. These parameters are essential when mapping users from a remote SAM server. + + + Mapping Common UIDs/GIDs on Distributed Machines + + + Samba-3 has a special facility that makes it possible to maintain identical UIDs and GIDs + on all servers in a distributed network. A distributed network is one where there exists + a PDC, one or more BDCs and/or one or more domain member servers. Why is this important? + This is important if files are being shared over more than one protocol (eg: NFS) and where + users are copying files across UNIX/Linux systems using tools such as rsync. + + + + The special facility is enabled using a parameter called idmap backend. + The default setting for this parameter is an empty string. Administrators should NOT set this + parameter except when an LDAP based passdb backend is in use. An example of use is: + + + + +[global] +idmap backendldapsam://ldap-server.quenya.org:636 + + + +     - + Account Management Tools -Samba-3 provides two (2) tools for management of User and machine accounts. These tools are +Samba provides two (2) tools for management of User and machine accounts. These tools are called smbpasswd and pdbedit. A third tool is under development but is NOT expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK GUI tool that looks much like the MS Windows NT4 Domain User Manager - hopefully this will @@ -413,30 +439,30 @@ be announced in time for the Samba-3.0.1 release. smbpasswd can be used to: - - add user or machine accounts - delete user or machine accounts - enable user or machine accounts - disable user or machine accounts - set to NULL user passwords - manage interdomain trust accounts - + + add user or machine accounts + delete user or machine accounts + enable user or machine accounts + disable user or machine accounts + set to NULL user passwords + manage interdomain trust accounts + To run smbpasswd as a normal user just type: - - $ smbpasswd - Old SMB password: secret - + +&prompt;smbpasswd +Old SMB password: secret + For secret type old value here - or hit return if there was no old password - - New SMB Password: new secret - Repeat New SMB Password: new secret - + +New SMB Password: new secret +Repeat New SMB Password: new secret + @@ -477,11 +503,11 @@ be announced in time for the Samba-3.0.1 release. manage the passdb backend. pdbedit can be used to: - - add, remove or modify user accounts - listing user accounts - migrate user accounts - + + add, remove or modify user accounts + listing user accounts + migrate user accounts + The pdbedit tool is the only one that can manage the account @@ -500,31 +526,54 @@ be announced in time for the Samba-3.0.1 release. a tdbsam password backend. This listing was produced by running: - - $ pdbedit -Lv met - Unix username: met - NT username: - Account Flags: [UX ] - User SID: S-1-5-21-1449123459-1407424037-3116680435-2004 - Primary Group SID: S-1-5-21-1449123459-1407424037-3116680435-1201 - Full Name: Melissa E Terpstra - Home Directory: \\frodo\met\Win9Profile - HomeDir Drive: H: - Logon Script: scripts\logon.bat - Profile Path: \\frodo\Profiles\met - Domain: MIDEARTH - Account desc: - Workstations: melbelle - Munged dial: - Logon time: 0 - Logoff time: Mon, 18 Jan 2038 20:14:07 GMT - Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT - Password last set: Sat, 14 Dec 2002 14:37:03 GMT - Password can change: Sat, 14 Dec 2002 14:37:03 GMT - Password must change: Mon, 18 Jan 2038 20:14:07 GMT - - - + +&prompt;pdbedit -Lv met +UNIX username: met +NT username: +Account Flags: [UX ] +User SID: S-1-5-21-1449123459-1407424037-3116680435-2004 +Primary Group SID: S-1-5-21-1449123459-1407424037-3116680435-1201 +Full Name: Melissa E Terpstra +Home Directory: \\frodo\met\Win9Profile +HomeDir Drive: H: +Logon Script: scripts\logon.bat +Profile Path: \\frodo\Profiles\met +Domain: &example.workgroup; +Account desc: +Workstations: melbelle +Munged dial: +Logon time: 0 +Logoff time: Mon, 18 Jan 2038 20:14:07 GMT +Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT +Password last set: Sat, 14 Dec 2002 14:37:03 GMT +Password can change: Sat, 14 Dec 2002 14:37:03 GMT +Password must change: Mon, 18 Jan 2038 20:14:07 GMT + + + + The pdbedit tool allows migration of authentication (account) + databases from one backend to another. For example: To migrate accounts from an + old smbpasswd database to a tdbsam + backend: + + + + + Set the passdb backendtdbsam, smbpasswd. + + + + Execute: + +&rootprompt;pdbedit -i smbpassed -e tdbsam + + + + + Now remove the smbpasswd from the passdb backend + configuration in &smb.conf;. + + @@ -533,7 +582,7 @@ be announced in time for the Samba-3.0.1 release. Password Backends -Samba-3 offers the greatest flexibility in backend account database design of any SMB/CIFS server +Samba offers the greatest flexibility in backend account database design of any SMB/CIFS server technology available today. The flexibility is immediately obvious as one begins to explore this capability. @@ -544,11 +593,9 @@ backends of the same type. For example, to use two different tdbsam databases: - -[globals] - passdb backend = tdbsam:/etc/samba/passdb.tdb, \ - tdbsam:/etc/samba/old-passdb.tdb, guest - + +passdb backendtdbsam:/etc/samba/passdb.tdb, tdbsam:/etc/samba/old-passdb.tdb + @@ -570,8 +617,7 @@ backends of the same type. For example, to use two different tdbsam databases: smbpasswd - Encrypted Password Database - Traditionally, when configuring encrypt - passwords = yes in Samba's smb.conf file, user account + Traditionally, when configuring encrypt passwordsyes in Samba's &smb.conf; file, user account information such as username, LM/NT password hashes, password change times, and account flags have been stored in the smbpasswd(5) file. There are several disadvantages to this approach for sites with very large numbers of users (counted @@ -609,7 +655,7 @@ backends of the same type. For example, to use two different tdbsam databases: - Samba-3 provides an enhanced set of passdb backends that overcome the deficiencies + Samba provides an enhanced set of passdb backends that overcome the deficiencies of the smbpasswd plain text database. These are tdbsam, ldapsam, and xmlsam. Of these ldapsam will be of most interest to large corporate or enterprise sites. @@ -650,21 +696,14 @@ backends of the same type. For example, to use two different tdbsam databases: The second item can be accomplished by using LDAP NSS and PAM modules. LGPL versions of these libraries can be obtained from PADL Software - (http://www.padl.com/). More + (http://www.padl.com/). More information about the configuration of these packages may be found at "LDAP, System Administration; Gerald Carter, O'Reilly; Chapter 6: Replacing NIS". - Refer to + Refer to http://safari.oreilly.com/?XmlId=1-56592-491-6 for those who might wish to know more about configuration and administration of an OpenLDAP server. - - - This section is outdated for Samba-3 schema. Samba-3 introduces a new schema - that has not been documented at the time of this publication. - - - This document describes how to use an LDAP directory for storing Samba user account information traditionally stored in the smbpasswd(5) file. It is @@ -674,9 +713,9 @@ backends of the same type. For example, to use two different tdbsam databases: - OpenLDAP - http://www.openldap.org/ + OpenLDAP - http://www.openldap.org/ iPlanet Directory Server - - http://iplanet.netscape.com/directory + http://iplanet.netscape.com/directory     @@ -715,13 +754,15 @@ backends of the same type. For example, to use two different tdbsam databases: -objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY - DESC 'Samba Auxiliary Account' - MUST ( uid $ rid ) - MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $ - logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $ - displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $ - description $ userWorkstations $ primaryGroupID $ domain )) +objectclass ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY + DESC 'Samba 3.0 Auxiliary SAM Account' + MUST ( uid $ sambaSID ) + MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ + sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $ + sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $ + displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $ + sambaProfilePath $ description $ sambaUserWorkstations $ + sambaPrimaryGroupSID $ sambaDomainName )) @@ -730,7 +771,7 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY The OID's are owned by the Samba Team and as such is legal to be openly published. If you translate the schema to be used with Netscape DS, please submit the modified schema file as a patch to - jerry@samba.org. + jerry@samba.org. @@ -804,7 +845,7 @@ include /etc/openldap/schema/nis.schema - + # Indices to maintain ## required by OpenLDAP index objectclass eq @@ -826,7 +867,7 @@ index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub - + @@ -835,7 +876,7 @@ index default sub -./sbin/slapindex -f slapd.conf +&rootprompt;./sbin/slapindex -f slapd.conf @@ -861,35 +902,35 @@ index default sub - + # Organization for Samba Base -dn: dc=plainjoe,dc=org +dn: dc=quenya,dc=org objectclass: dcObject objectclass: organization -dc: plainjoe -o: Terpstra Org Network +dc: quenya +o: Quenya Org Network description: The Samba-3 Network LDAP Example # Organizational Role for Directory Management -dn: cn=Manager,dc=plainjoe,dc=org +dn: cn=Manager,dc=quenya,dc=org objectclass: organizationalRole cn: Manager description: Directory Manager # Setting up container for users -dn: ou=People,dc=plainjoe,dc=org +dn: ou=People,dc=quenya,dc=org objectclass: top objectclass: organizationalUnit ou: People # Setting up admin handle for People OU -dn: cn=admin,ou=People,dc=plainjoe,dc=org +dn: cn=admin,ou=People,dc=quenya,dc=org cn: admin objectclass: top objectclass: organizationalRole objectclass: simpleSecurityObject userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz - + @@ -903,7 +944,7 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz -$ slapadd -v -l initldap.dif +&prompt;slapadd -v -l initldap.dif @@ -916,9 +957,9 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz Before Samba can access the LDAP server you need to store the LDAP admin password into the Samba-3 secrets.tdb database by: - -&rootprompt; smbpasswd -w secret - + +&rootprompt;smbpasswd -w secret + @@ -933,19 +974,18 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz LDAP libraries are found. - - passdb backend = ldapsam:url - ldap ssl - ldap admin dn - ldap suffix - ldap filter - ldap machine suffix - ldap user suffix - ldap delete dn - ldap passwd sync - ldap trust ids - - + LDAP related smb.conf options: + passdb backendldapsam:url, + ldap ssl, + ldap admin dn, + ldap suffix, + ldap filter, + ldap machine suffix, + ldap user suffix, + ldap delete dn, + ldap passwd sync, + ldap trust ids. + These are described in the &smb.conf; man @@ -954,49 +994,48 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz - -## /usr/local/samba/lib/smb.conf -[global] - security = user - encrypt passwords = yes - - netbios name = TASHTEGO - workgroup = NARNIA - - # ldap related parameters - - # define the DN to use when binding to the directory servers - # The password for this DN is not stored in smb.conf. Rather it - # must be set by using 'smbpasswd -w secretpw' to store the - # passphrase in the secrets.tdb file. If the "ldap admin dn" values - # change, this password will need to be reset. - ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org" - - # Define the SSL option when connecting to the directory - # ('off', 'start tls', or 'on' (default)) - ldap ssl = start tls - - # syntax: passdb backend = ldapsam:ldap://server-name[:port] - passdb backend = ldapsam:ldap://funball.samba.org, guest - - # smbpasswd -x delete the entire dn-entry - ldap delete dn = no - - # the machine and user suffix added to the base suffix - # wrote WITHOUT quotes. NULL suffixes by default - ldap user suffix = ou=People - ldap machine suffix = ou=Systems - - # Trust unix account information in LDAP - # (see the smb.conf manpage for details) - ldap trust ids = Yes - - # specify the base DN to use when searching the directory - ldap suffix = "ou=people,dc=samba,dc=org" - - # generally the default ldap search filter is ok - # ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))" - + + Configuration with LDAP + [global] +securityuser +encrypt passwordsyes +netbios nameTASHTEGO +workgroupNARNIA + +ldap related parameters + +define the DN to use when binding to the directory servers +The password for this DN is not stored in smb.conf. Rather it +must be set by using 'smbpasswd -w secretpw' to store the +passphrase in the secrets.tdb file. If the "ldap admin dn" values +change, this password will need to be reset. +ldap admin dn"cn=Samba Manager,ou=people,dc=samba,dc=org" + +Define the SSL option when connecting to the directory +('off', 'start tls', or 'on' (default)) +ldap sslstart tls + +syntax: passdb backend = ldapsam:ldap://server-name[:port] +passdb backendldapsam:ldap://funball.samba.org + +smbpasswd -x delete the entire dn-entry +ldap delete dnno + +the machine and user suffix added to the base suffix +wrote WITHOUT quotes. NULL suffixes by default +ldap user suffixou=People +ldap machine suffixou=Systems + +Trust unix account information in LDAP + (see the smb.conf manpage for details) +ldap trust idsYes + + specify the base DN to use when searching the directory +ldap suffix"ou=people,dc=samba,dc=org" + + generally the default ldap search filter is ok +ldap filter"(&(uid=%u)(objectclass=sambaSamAccount))" + @@ -1013,8 +1052,8 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz Machines accounts are managed with the sambaSamAccount objectclass, just like users accounts. However, it's up to you to store those accounts in a different tree of your LDAP namespace: you should use - "ou=Groups,dc=plainjoe,dc=org" to store groups and - "ou=People,dc=plainjoe,dc=org" to store users. Just configure your + "ou=Groups,dc=quenya,dc=org" to store groups and + "ou=People,dc=quenya,dc=org" to store users. Just configure your NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration file). @@ -1052,13 +1091,13 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz - To remedy the first security issue, the ldap ssl &smb.conf; parameter defaults - to require an encrypted session (ldap ssl = on) using + To remedy the first security issue, the ldap ssl &smb.conf; parameter defaults + to require an encrypted session (ldap sslon) using the default port of 636 when contacting the directory server. When using an OpenLDAP server, it is possible to use the use the StartTLS LDAP extended operation in the place of LDAPS. In either case, you are strongly discouraged to disable this security - (ldap ssl = off). + (ldap ssloff). @@ -1077,7 +1116,7 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz ## allow the "ldap admin dn" access, but deny everyone else access to attrs=lmPassword,ntPassword - by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write + by dn="cn=Samba Admin,ou=people,dc=quenya,dc=org" write by * none @@ -1094,62 +1133,63 @@ access to attrs=lmPassword,ntPassword
    Attributes in the sambaSamAccount objectclass (LDAP) - + + + - lmPasswordthe LANMAN password 16-byte hash stored as a character - representation of a hexadecimal string. - ntPasswordthe NT password hash 16-byte stored as a character + sambaLMPasswordthe LANMAN password 16-byte hash stored as a character +representation of a hexadecimal string. + sambaNTPasswordthe NT password hash 16-byte stored as a character representation of a hexadecimal string. - pwdLastSetThe integer time in seconds since 1970 when the - lmPassword and ntPassword attributes were last set. + sambaPwdLastSetThe integer time in seconds since 1970 when the + sambaLMPassword and sambaNTPassword attributes were last set. - acctFlagsstring of 11 characters surrounded by square brackets [] + sambaAcctFlagsstring of 11 characters surrounded by square brackets [] representing account flags such as U (user), W(workstation), X(no password expiration), I(Domain trust account), H(Home dir required), S(Server trust account), and D(disabled). - logonTimeInteger value currently unused + sambaLogonTimeInteger value currently unused - logoffTimeInteger value currently unused + sambaLogoffTimeInteger value currently unused - kickoffTimeInteger value currently unused + sambaKickoffTimeInteger value currently unused - pwdCanChangeInteger value currently unused + sambaPwdCanChangeInteger value currently unused - pwdMustChangeInteger value currently unused + sambaPwdMustChangeInteger value currently unused - homeDrivespecifies the drive letter to which to map the - UNC path specified by homeDirectory. The drive letter must be specified in the form "X:" + sambaHomeDrivespecifies the drive letter to which to map the + UNC path specified by sambaHomePath. The drive letter must be specified in the form "X:" where X is the letter of the drive to map. Refer to the "logon drive" parameter in the smb.conf(5) man page for more information. - scriptPathThe scriptPath property specifies the path of + sambaLogonScriptThe sambaLogonScript property specifies the path of the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path - is relative to the netlogon share. Refer to the "logon script" parameter in the - smb.conf(5) man page for more information. + is relative to the netlogon share. Refer to the logon script parameter in the + &smb.conf; man page for more information. - profilePathspecifies a path to the user's profile. + sambaProfilePathspecifies a path to the user's profile. This value can be a null string, a local absolute path, or a UNC path. Refer to the - "logon path" parameter in the smb.conf(5) man page for more information. + logon path parameter in the &smb.conf; man page for more information. - smbHomeThe homeDirectory property specifies the path of - the home directory for the user. The string can be null. If homeDrive is set and specifies - a drive letter, homeDirectory should be a UNC path. The path must be a network - UNC path of the form \\server\share\directory. This value can be a null string. - Refer to the logon home parameter in the &smb.conf; man page for more information. + sambaHomePathThe sambaHomePath property specifies the path of +the home directory for the user. The string can be null. If sambaHomeDrive is set and specifies +a drive letter, sambaHomePath should be a UNC path. The path must be a network +UNC path of the form \\server\share\directory. This value can be a null string. +Refer to the logon home parameter in the &smb.conf; man page for more information. - userWorkstationcharacter string value currently unused. + sambaUserWorkstationscharacter string value currently unused. - ridthe integer representation of the user's relative identifier - (RID). + sambaSIDThe security identifier(SID) of the user. The windows equivalent of unix uid's. - primaryGroupIDthe relative identifier (RID) of the primary group + sambaPrimaryGroupSIDthe relative identifier (RID) of the primary group of the user. - domaindomain the user is part of. + sambaDomainNamedomain the user is part of.
    @@ -1161,22 +1201,22 @@ access to attrs=lmPassword,ntPassword are only stored with the sambaSamAccount entry if the values are non-default values: - - smbHome - scriptPath - logonPath - homeDrive - + + sambaHomePath + sambaLogonScript + sambaProfilePath + sambaHomeDrive + These attributes are only stored with the sambaSamAccount entry if the values are non-default values. For example, assume TASHTEGO has now been - configured as a PDC and that logon home = \\%L\%u was defined in + configured as a PDC and that logon home\\%L\%u was defined in its &smb.conf; file. When a user named "becky" logons to the domain, - the logon home string is expanded to \\TASHTEGO\becky. + the logon home string is expanded to \\TASHTEGO\becky. If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", this value is used. However, if this attribute does not exist, then the value - of the logon home parameter is used in its place. Samba + of the logon home parameter is used in its place. Samba will only write the attribute value to the directory entry if the value is something other than the default (e.g. \\MOBY\becky). @@ -1192,20 +1232,20 @@ access to attrs=lmPassword,ntPassword - dn: uid=guest2, ou=people,dc=plainjoe,dc=org - ntPassword: 878D8014606CDA29677A44EFA1353FC7 - pwdMustChange: 2147483647 - primaryGroupID: 1201 - lmPassword: 552902031BEDE9EFAAD3B435B51404EE - pwdLastSet: 1010179124 - logonTime: 0 + dn: uid=guest2, ou=people,dc=quenya,dc=org + sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7 + sambaPwdMustChange: 2147483647 + sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-513 + sambaNTPassword: 552902031BEDE9EFAAD3B435B51404EE + sambaPwdLastSet: 1010179124 + sambaLogonTime: 0 objectClass: sambaSamAccount uid: guest2 - kickoffTime: 2147483647 - acctFlags: [UX ] - logoffTime: 2147483647 - rid: 19006 - pwdCanChange: 0 + sambaKickoffTime: 2147483647 + sambaAcctFlags: [UX ] + sambaLogoffTime: 2147483647 + sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5006 + sambaPwdCanChange: 0 @@ -1216,14 +1256,14 @@ access to attrs=lmPassword,ntPassword - dn: uid=gcarter, ou=people,dc=plainjoe,dc=org - logonTime: 0 + dn: uid=gcarter, ou=people,dc=quenya,dc=org + sambaLogonTime: 0 displayName: Gerald Carter - lmPassword: 552902031BEDE9EFAAD3B435B51404EE - primaryGroupID: 1201 + sambaLMPassword: 552902031BEDE9EFAAD3B435B51404EE + sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-1201 objectClass: posixAccount objectClass: sambaSamAccount - acctFlags: [UX ] + sambaAcctFlags: [UX ] userPassword: {crypt}BpM2ej8Rkzogo uid: gcarter uidNumber: 9000 @@ -1231,13 +1271,13 @@ access to attrs=lmPassword,ntPassword loginShell: /bin/bash logoffTime: 2147483647 gidNumber: 100 - kickoffTime: 2147483647 - pwdLastSet: 1010179230 - rid: 19000 + sambaKickoffTime: 2147483647 + sambaPwdLastSet: 1010179230 + sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5004 homeDirectory: /home/tashtego/gcarter - pwdCanChange: 0 - pwdMustChange: 2147483647 - ntPassword: 878D8014606CDA29677A44EFA1353FC7 + sambaPwdCanChange: 0 + sambaPwdMustChange: 2147483647 + sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7 @@ -1251,7 +1291,7 @@ access to attrs=lmPassword,ntPassword using pam_ldap, this allows changing both unix and windows passwords at once. - The ldap passwd sync options can have the following values: + The ldap passwd sync options can have the following values: @@ -1268,12 +1308,11 @@ access to attrs=lmPassword,ntPassword only - Only update the LDAP password and let the LDAP server worry - about the other fields. This option is only available when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD. + Only update the LDAP password and let the LDAP server worry about the other fields. This option is only available on some LDAP servers. Only when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD - More information can be found in the smb.conf manpage. + More information can be found in the smb.conf manpage. @@ -1300,8 +1339,10 @@ access to attrs=lmPassword,ntPassword for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump contains the correct queries to create the required tables. Use the command : - $ mysql -uusername -hhostname -ppassword \ -databasename < /path/to/samba/examples/pdb/mysql/mysql.dump + +&prompt;mysql -uusername -hhostname -ppassword \ +databasename < /path/to/samba/examples/pdb/mysql/mysql.dump + @@ -1310,36 +1351,38 @@ access to attrs=lmPassword,ntPassword This plugin lacks some good documentation, but here is some short info: - Add a the following to the passdb backend variable in your &smb.conf;: - - passdb backend = [other-plugins] mysql:identifier [other-plugins] - + Add a the following to the passdb backend variable in your &smb.conf;: + +passdb backend[other-plugins] mysql:identifier [other-plugins] + The identifier can be any string you like, as long as it doesn't collide with the identifiers of other plugins or other instances of pdb_mysql. If you - specify multiple pdb_mysql.so entries in passdb backend, you also need to + specify multiple pdb_mysql.so entries in passdb backend, you also need to use different identifiers! - Additional options can be given through the &smb.conf; file in the [global] section. + Additional options can be given through the &smb.conf; file in the [global] section. Basic smb.conf options for MySQL passdb backend - + + + FieldContents - identifier:mysql hosthost name, defaults to 'localhost' - identifier:mysql password - identifier:mysql userdefaults to 'samba' - identifier:mysql databasedefaults to 'samba' - identifier:mysql portdefaults to 3306 - identifier:tableName of the table containing users + mysql hosthost name, defaults to 'localhost' + mysql password + mysql userdefaults to 'samba' + mysql databasedefaults to 'samba' + mysql portdefaults to 3306 + tableName of the table containing users
    @@ -1348,7 +1391,7 @@ access to attrs=lmPassword,ntPassword Since the password for the MySQL user is stored in the - &smb.conf; file, you should make the the &smb.conf; file + &smb.conf; file, you should make the &smb.conf; file readable only to the user that runs Samba This is considered a security bug and will be fixed soon. @@ -1359,40 +1402,43 @@ access to attrs=lmPassword,ntPassword MySQL field names for MySQL passdb backend - + + + + FieldTypeContents - identifier:logon time columnint(9) - identifier:logoff time columnint(9) - identifier:kickoff time columnint(9) - identifier:pass last set time columnint(9) - identifier:pass can change time columnint(9) - identifier:pass must change time columnint(9) - identifier:username columnvarchar(255)unix username - identifier:domain columnvarchar(255)NT domain user is part of - identifier:nt username columnvarchar(255)NT username - identifier:fullname columnvarchar(255)Full name of user - identifier:home dir columnvarchar(255)Unix homedir path - identifier:dir drive columnvarchar(2)Directory drive path (eg: 'H:') - identifier:logon script columnvarchar(255)Batch file to run on client side when logging on - identifier:profile path columnvarchar(255)Path of profile - identifier:acct desc columnvarchar(255)Some ASCII NT user data - identifier:workstations columnvarchar(255)Workstations user can logon to (or NULL for all) - identifier:unknown string columnvarchar(255)unknown string - identifier:munged dial columnvarchar(255)? - identifier:user sid columnvarchar(255)NT user SID - identifier:group sid columnvarchar(255)NT group ID - identifier:lanman pass columnvarchar(255)encrypted lanman password - identifier:nt pass columnvarchar(255)encrypted nt passwd - identifier:plain pass columnvarchar(255)plaintext password - identifier:acct control columnint(9)nt user data - identifier:unknown 3 columnint(9)unknown - identifier:logon divs columnint(9)? - identifier:hours len columnint(9)? - identifier:unknown 5 columnint(9)unknown - identifier:unknown 6 columnint(9)unknown + logon time columnint(9) + logoff time columnint(9) + kickoff time columnint(9) + pass last set time columnint(9) + pass can change time columnint(9) + pass must change time columnint(9) + username columnvarchar(255)unix username + domain columnvarchar(255)NT domain user is part of + nt username columnvarchar(255)NT username + fullname columnvarchar(255)Full name of user + home dir columnvarchar(255)UNIX homedir path + dir drive columnvarchar(2)Directory drive path (eg: 'H:') + logon script columnvarchar(255)Batch file to run on client side when logging on + profile path columnvarchar(255)Path of profile + acct desc columnvarchar(255)Some ASCII NT user data + workstations columnvarchar(255)Workstations user can logon to (or NULL for all) + unknown string columnvarchar(255)unknown string + munged dial columnvarchar(255)? + user sid columnvarchar(255)NT user SID + group sid columnvarchar(255)NT group ID + lanman pass columnvarchar(255)encrypted lanman password + nt pass columnvarchar(255)encrypted nt passwd + plain pass columnvarchar(255)plaintext password + acct control columnint(9)nt user data + unknown 3 columnint(9)unknown + logon divs columnint(9)? + hours len columnint(9)? + unknown 5 columnint(9)unknown + unknown 6 columnint(9)unknown
     @@ -1475,16 +1521,16 @@ access to attrs=lmPassword,ntPassword Common Errors - Users can not logon - Users not in Samba SAM + Users can not logon - - People forget to put their users in their backend and then complain Samba won't authorize them. - + I've installed samba, but now I can't log on with my unix account! + + Make sure your user has been added to the current samba passdb backend. Read the section Account Management Tools for details. - Users are being added to the wrong backend database + Users being added to wrong backend database A few complaints have been received from users that just moved to Samba-3. The following @@ -1493,12 +1539,12 @@ access to attrs=lmPassword,ntPassword - - [globals] - ... - passdb backend = smbpasswd, tdbsam, guest - ... - + + [global] + ... +passdb backendsmbpasswd, tdbsam +... + @@ -1507,12 +1553,12 @@ access to attrs=lmPassword,ntPassword - - [globals] - ... - passdb backend = tdbsam, smbpasswd, guest - ... - + + [globals] + ... +passdb backendtdbsam, smbpasswd + ... + @@ -1521,12 +1567,12 @@ access to attrs=lmPassword,ntPassword auth methods does not work - If you explicitly set an 'auth methods' parameter, guest must be specified as the first - entry on the line. Eg: auth methods = guest sam. + If you explicitly set an auth methods parameter, guest must be specified as the first + entry on the line. Eg: auth methodsguest sam. - This is the exact opposite of the requirement for the passdb backed + This is the exact opposite of the requirement for the passdb backend option, where it must be the LAST parameter on the line. diff --git a/docs/docbook/projdoc/printer_driver2.xml b/docs/docbook/projdoc/printer_driver2.xml index 11231e6c9a..0d0dbb0188 100644 --- a/docs/docbook/projdoc/printer_driver2.xml +++ b/docs/docbook/projdoc/printer_driver2.xml @@ -9,7 +9,7 @@ &author.jerry; - May 32, 2003 + May 31, 2003 Classical Printing Support @@ -24,7 +24,7 @@ consisting of Windows workstations.     -A Samba-3.0 print service may be run on a Standalone or a Domain +A Samba print service may be run on a Standalone or a Domain member server, side by side with file serving functions, or on a dedicated print server. It can be made as tight or as loosely secured as needs dictate. Configurations may be simple or complex. Available @@ -50,7 +50,7 @@ implemented by the more traditional UNIX (BSD- and System V-style) printing systems. Many things apply to CUPS, the newer Common UNIX Printing System, too; so if you use CUPS, you might be tempted to jump to the next chapter -- but you will certainly miss a few things if you -do so. Better read this chapter too. +do so. Better to read this chapter too. @@ -70,15 +70,15 @@ again. Samba's printing support always relies on the installed print -subsystem of the Unix OS it runs on. Samba is a "middleman". It takes +subsystem of the UNIX OS it runs on. Samba is a "middleman". It takes printfiles from Windows (or other SMB) clients and passes them to the real printing system for further processing. Therefore it needs to -"talk" to two sides: to the Windows print clients and to the Unix +"talk" to two sides: to the Windows print clients and to the UNIX printing system. Hence we must differentiate between the various client OS types each of which behave differently, as well as the various UNIX print subsystems, which themselves have different features and are accessed differently. This part of the Samba HOWTO -Collection deals with the "traditional" way of Unix printing first; +Collection deals with the "traditional" way of UNIX printing first; the next chapter covers in great detail the more modern Common UNIX Printing System (CUPS). @@ -98,7 +98,7 @@ stages: -Windows opens a connection to the printershare +Windows opens a connection to the printer share Samba must authenticate the user @@ -110,7 +110,7 @@ into Samba's spooling area     Samba invokes the print command to hand the file over to the UNIX print subsystem's spooling area -The Unix print subsystem processes the print +The UNIX print subsystem processes the print job The printfile may need to be explicitly deleted @@ -134,8 +134,8 @@ Service Level ("S") parameters. Service Level Parameters These may go into the -[global] section of -. In this case they define the default +[global] section of &smb.conf;. +In this case they define the default behaviour of all individual or service level shares (provided those don't have a different setting defined for the same parameter, thus overriding the global default). @@ -153,47 +153,40 @@ this (if you run it) and tell you so. Parameters Recommended for Use The following &smb.conf; parameters directly -related to printing are used in Samba-3. See also the +related to printing are used in Samba. See also the &smb.conf; man page for detailed explanations: - - List of printing related parameters in Samba-3 - -Global level parameters: -addprinter command (G) -deleteprinter command (G) -disable spoolss (G) -enumports command (G) -load printers (G) -lpq cache time (G) -os2 driver map (G) -printcap name (G), printcap (G) -show add printer wizard (G) -total print jobs (G) -use client driver (G) - - -Service level parameters: -hosts allow (S) -hosts deny (S) -lppause command (S) -lpq command (S) -lpresume command (S) -lprm command (S) -max print jobs (S) -min print space (S) -print command (S) -printable (S), print ok (S) -printer name (S), printer (S) -printer admin (S) -printing = [cups|bsd|lprng...] (S) -queuepause command (S) -queueresume command (S) -total print jobs (S) - +Global level parameters: addprinter command, +deleteprinter command, +disable spoolss, +enumports command, +load printers, +lpq cache time, +os2 driver map, +printcap name, printcap, +show add printer wizard, +total print jobs, +use client driver. + + +Service level parameters: hosts allow, +hosts deny, +lppause command, +lpq command, +lpresume command, +lprm command, +max print jobs, +min print space, +print command, +printable, print ok , +printer name, printer, +printer admin, +printing[cups|bsd|lprng...], +queuepause command, +queueresume command, +total print jobs. - Samba's printing support implements the Microsoft Remote Procedure @@ -204,110 +197,43 @@ follow further beneath. - -Parameters for Backwards Compatibility - - -Two new parameters that were added in Samba 2.2.2, are still present -in Samba-3.0. Both of these options are described in the -&smb.conf; man page and are disabled by -default. Use them with caution! - - - -disable spoolss(G) - This is -provided for better support of Samba 2.0.x backwards capability. It -will disable Samba's support for MS-RPC printing and yield identical -printing behaviour to Samba 2.0.x. - - -use client driver (G) - was provided -for using local printer drivers on Windows NT/2000 clients. It does -not apply to Windows 95/98/ME clients. - - - - -Parameters "for backward compatibility only", use with caution - - - -disable spoolss (G) - -use client driver (S) - - - - - - - -Parameters no longer in use - - -Samba users upgrading from 2.2.x to 3.0 need to be aware that some -previously available settings are no longer supported (as was -announced some time ago). Here is a list of them: - - - -"old" parameters, removed in Samba-3 - - -The following &smb.conf; parameters have been -deprecated already in Samba 2.2 and are now completely removed from -Samba-3. You cannot use them in new 3.0 installations: - - -printer driver file (G) -total print jobs (G) -postscript (S) -printer driver (S) -printer driver location (S) - - - - - -     -A simple Configuration to Print with Samba-3 +A simple Configuration to Print Here is a very simple example configuration for print related settings -in the file. If you compare it with your -own system's , you probably find some +in the file. If you compare it with your own system's , you probably find some additional parameters included there (as pre-configured by your OS vendor). Further below is a discussion and explanation of the parameters. Note, that this example doesn't use many parameters. However, in many environments these are enough to provide a valid - which enables all clients to print. +&smb.conf; file which enables all clients to print. - - [global] - printing = bsd - load printers = yes + + Simple configuration with BSD printing +[global] +printingbsd +load printersyes - [printers] - path = /var/spool/samba - printable = yes - public = yes - writable = no - +[printers] +path/var/spool/samba +printableyes +publicyes +writableno + -This is only an example configuration. Many settings, if not -explicitly set to a specific value, are used and set by Samba -implicitly to its own default, because these have been compiled in. -To see all settings, let root use the testparm -utility. testparm also gives warnings if you have -mis-configured certain things. Its complete output is easily 340 lines -and more. You may want to pipe it through a pager program. +This is only an example configuration. Samba assigns default values to all +configuration parameters. On the whole the defaults are conservative and +sensible. When a parameter is specified in the &smb.conf; file this overwrites +the default value. The testparm utility when run as root +is capable of reporting all setting, both default as well as &smb.conf; file +settings. Testparm gives warnings for all mis-configured +settings. The complete output is easily 340 lines and more, so you may want +to pipe it through a pager program. @@ -380,7 +306,7 @@ default behaviour. Don't forget about this point: it may be important in your future dealings with Samba. - testparm in Samba-3.0 behaves differently from 2.2.x: used + testparm in samba 3 behaves differently from 2.2.x: used without the "-v" switch it only shows you the settings actually written into ! To see the complete configuration used, add the "-v" parameter to testparm. @@ -394,15 +320,15 @@ configuration used, add the "-v" parameter to testparm. Should you need to troubleshoot at any stage, please always come back to this point first and verify if "testparm" shows the parameters you expect! To give you an example from personal experience as a warning, -try to just "comment out" the load printers" +try to just "comment out" the load printers" parameter. If your 2.2.x system behaves like mine, you'll see this: &rootprompt;grep "load printers" /etc/samba/smb.conf # load printers = Yes - # This setting is commented ooouuuuut!! - + # This setting is commented ooouuuuut!! + &rootprompt;testparm -v /etc/samba/smb.conf | egrep "(load printers)" load printers = Yes @@ -429,7 +355,7 @@ any more... at least not by this ;-) Only when setting the parameter explicitly to -"load printers = No" +"load printersNo" would Samba recognize my intentions. So my strong advice is: @@ -472,7 +398,7 @@ would be, if you used this minimalistic file as your real -&rootprompt; testparm -v /etc/samba/smb.conf-minimal | egrep "(print|lpq|spool|driver|ports|[)" +&rootprompt;testparm -v smb.conf-minimal | egrep "(print|lpq|spool|driver|ports|[)" Processing section "[printers]" WARNING: [printers] service MUST be printable! No path in service printers - using /tmp @@ -507,7 +433,7 @@ testparm issued 2 warnings: because we didn't specify the -[printers] section as printable, +[printers] section as printable, and because we didn't tell it which spool directory to @@ -516,8 +442,8 @@ use. -However, this was not fatal, and Samba-3.0 will default to values that -will work here. But, please!, don't rely on this and don't use this +However, this was not fatal, and samba will default to values that +will work here. Please, don't rely on this and don't use this example! This was only meant to make you careful to design and specify your setup to be what you really want it to be. The outcome on your system may vary for some parameters, since you may have a Samba built @@ -531,9 +457,10 @@ in a parameter value is retained verbatim. This means that a line consisting of, for example, - -printing = lprng #This defines LPRng as the printing system" - + +This defines LPRng as the printing system" +printinglprng + will regard the whole of the string after the "=" @@ -544,61 +471,52 @@ that will be ignored, and a default value used instead.] -Extended Sample Configuration to Print with Samba-3 +Extended Sample Configuration to Print -Here we show a more verbose example configuration for print related -settings in an . Below is a discussion + In the extended BSD configuration example we show a more verbose example configuration for print related + settings in BSD-printing style environment . Below is a discussion and explanation of the various parameters. We chose to use BSD-style printing here, because we guess it is still the most commonly used system on legacy Linux installations (new installs now predominantly have CUPS, which is discussed entirely in the next chapter of this document). Note, that this example explicitly names many parameters -which don't need to be stated because they are set by default. You -might be able to do with a leaner . - - -if you read access it with the Samba Web Administration Tool (SWAT), -and then write it to disk again, it will be optimized in a way such -that it doesn't contain any superfluous parameters and comments. SWAT -organizes the file for best performance. Remember that each smbd -re-reads the Samba configuration once a minute, and that each -connection spawns an smbd process of its own, so it is not a bad idea -to optimize the in environments with -hundreds or thousands of clients. - - - [global] - printing = bsd - load printers = yes - show add printer wizard = yes - printcap name = /etc/printcap - printer admin = @ntadmin, root - total print jobs = 100 - lpq cache time = 20 - use client driver = no - - [printers] - comment = All Printers - printable = yes - path = /var/spool/samba - browseable = no - guest ok = yes - public = yes - read only = yes - writable = no - - [my_printer_name] - comment = Printer with Restricted Access - path = /var/spool/samba_my_printer - printer admin = kurt - browseable = yes - printable = yes - writeable = no - hosts allow = 0.0.0.0 - hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60 - guest ok = no - +which don't need to be specified because they are set by default. You +might be able to do with a leaner &smb.conf; file. + + + Extended configuration with BSD printing + [global] +printingbsd +load printersyes +show add printer wizardyes +printcap name/etc/printcap +printer admin@ntadmin, root +total print jobs100 +lpq cache time20 +use client driverno + +[printers] +commentAll Printers +printableyes +path/var/spool/samba +browseableno +guest okyes +publicyes +read onlyyes +writableno + +[my_printer_name] +commentPrinter with Restricted Access +path/var/spool/samba_my_printer +printer adminkurt +browseableyes +printableyes +writeableno +hosts allow0.0.0.0 +hosts denyturbo_xp, 10.160.50.23, 10.160.51.60 +guest okno + This also is only an example configuration. You @@ -624,13 +542,13 @@ Following is a discussion of the settings from above shown example. The [global] Section -The [global] section is one of 4 special -sections (along with [[homes], -[printers] and -[print$]...) It contains all parameters which +The [global] section is one of 4 special +sections (along with [[homes], +[printers] and +[print$]...) It contains all parameters which apply to the server as a whole. It is the place for parameters which -have only a "global" meaning (G). It may also contain service level -parameters (S) which then define default settings for all other +have only a "global" meaning. It may also contain service level +parameters which then define default settings for all other sections and shares. This way you can simplify the configuration and avoid setting the same value repeatedly. (Within each individual section or share you may however override these globally set "share @@ -638,35 +556,34 @@ level" settings and specify other values). -printing = bsd +printingbsd this causes Samba to use default print commands applicable for the BSD (a.k.a. RFC 1179 style or LPR/LPD) printing system. In general, the "printing" parameter informs Samba about the print subsystem it should expect. Samba supports CUPS, LPD, LPRNG, SYSV, HPUX, AIX, QNX and PLP. Each of these systems defaults to a -different print command (and other queue control +different print command (and other queue control commands). -The printing parameter is +The printing parameter is normally a service level parameter. Since it is included here in the -[global] section, it will take effect for all -printer shares that are not defined differently. Samba-3.0 no longer +[global] section, it will take effect for all +printer shares that are not defined differently. Samba 3 no longer supports the SOFTQ printing system. -load printers = yes +load printersyes this tells Samba to create automatically all available printer shares. "Available" printer shares are discovered by scanning the printcap file. All created printer shares are also loaded for browsing. If you use this parameter, you do not need to specify separate shares for each printer. Each automatically created printer share will clone the configuration options found in the -[printers] section. (A load printers +[printers] section. (A load printers = no setting will allow you to specify each UNIX printer you want to share separately, leaving out some you don't want to be publicly visible and available). -show add printer wizard = -yes this setting is normally +show add printer wizardyes this setting is normally enabled by default (even if the parameter is not written into the ). It makes the Add Printer Wizard icon show up in the Printers folder of the Samba host's @@ -674,12 +591,12 @@ share listing (as shown in Network Neighbourhood or by the net view command). To disable it, you need to explicitly set it to no (commenting it out will not suffice!). The Add Printer Wizard lets you upload printer -drivers to the [print$] share and associate it +drivers to the [print$] share and associate it with a printer (if the respective queue exists there before the action), or exchange a printer's driver against any other previously uploaded driver. -total print jobs = 100 +total print jobs100 this setting sets the upper limit to 100 print jobs being active on the Samba server at any one time. Should a client submit a job which exceeds this number, a no more space @@ -688,7 +605,7 @@ Samba to the client. A setting of "0" (the default) means there is no limit at all! -printcap name = /etc/printcap +printcap name/etc/printcap this tells Samba where to look for a list of available printer names. (If you use CUPS, make sure that a printcap @@ -696,27 +613,27 @@ file is written: this is controlled by the "Printcap" directive of cupsd.conf). -printer admin = @ntadmin +printer admin@ntadmin members of the ntadmin group should be able to add drivers and set printer properties ("ntadmin" is only an example name, it needs to be a valid UNIX group name); root is implicitly always a -printer admin. The "@" sign precedes group names in +printer admin. The "@" sign precedes group names in . A printer admin can do anything to printers via the remote administration interfaces offered by MS-RPC -(see below). Note that the printer admin +(see below). Note that the printer admin parameter is normally a share level parameter, so you may associate different groups to different printer shares in larger installations, -if you use the printer admin parameter on the +if you use the printer admin parameter on the share levels). -lpq cache time = 20 +lpq cache time20 this controls the cache time for the results of the lpq command. It prevents the lpq command being called too often and reduces load on a heavily used print server. -use client driver = no +use client driverno if set to yes, this setting only takes effect for Win NT/2k/XP clients (and not for Win 95/98/ME). Its default value is No (or False). @@ -742,28 +659,28 @@ section as a general convenience shortcut to share all printers with minimal configuration. It is also a container for settings which should apply as default to all printers. (For more details see the &smb.conf; man page.) Settings inside this -container must be share level parameters (S). +container must be share level parameters. -comment = All printers - the comment is shown next to +commentAll printers + the comment is shown next to the share if a client queries the server, either via Network Neighbourhood or with the net view command to list available shares. -printable = yes +printableyes please note well, that the -[printers] service must be +[printers] service must be declared as printable. If you specify otherwise, smbd will refuse to load at startup. This parameter allows connected clients to open, write to and submit spool files into the -directory specified with the path parameter for +directory specified with the path parameter for this service. It is used by Samba to differentiate printer shares from file shares. -path = /var/spool/samba +path/var/spool/samba this must point to a directory used by Samba to spool incoming print files. It must not be the same as the spool directory specified in the configuration of your UNIX print @@ -771,21 +688,21 @@ subsystem! The path would typically point to a directory which is world writeable, with the "sticky" bit set to it. -browseable = no +browseableno this is always set to no if -printable = yes. It makes the -[printer] share itself invisible in the +printableyes. It makes the +[printer] share itself invisible in the list of available shares in a net view command or in the Explorer browse list. (Note that you will of course see the individual printers). -guest ok = yes +guest okyes if set to yes, then no password is required to connect to the printers service. Access will be granted with the -privileges of the guest account. On many systems the +privileges of the guest account. On many systems the guest account will map to a user named "nobody". This user is in the UNIX passwd file with an empty password, but with no valid UNIX login. (Note: on some systems the guest account might not have the @@ -798,9 +715,8 @@ command like -public = yes - this is a synonym for guest ok = -yes. Since we have guest ok = yes, +publicyes + this is a synonym for guest okyes. Since we have guest okyes, it really doesn't need to be here! (This leads to the interesting question: What, if I by accident have to contradictory settings for the same share? The answer is: the last one encountered by @@ -811,7 +727,7 @@ account" parameter with different usernames, and then run testparm to see which one is actually used by Samba.) -read only = yes +read onlyyes this normally (for other types of shares) prevents users creating or modifying files in the service's directory. However, in a "printable" service, it is always allowed to @@ -819,9 +735,9 @@ write to the directory (if user privileges allow the connection), but only via print spooling operations. "Normal" write operations are not allowed. -writeable = no +writeableno -synonym for read only = yes +synonym for read onlyyes @@ -831,7 +747,7 @@ synonym for read only = yes If a section appears in the , which is -tagged as printable = yes, Samba presents it as +tagged as printableyes, Samba presents it as a printer share to its clients. Note, that Win95/98/ME clients may have problems with connecting or loading printer drivers if the share name has more than 8 characters! Also be very careful if you give a @@ -843,54 +759,53 @@ the same name! -comment = Printer with Restricted Access +commentPrinter with Restricted Access the comment says it all. -path = /var/spool/samba_my_printer +path/var/spool/samba_my_printer here we set the spooling area for this printer to another directory than the default. It is not a requirement to set it differently, but the option is available. -printer admin = kurt +printer adminkurt the printer admin definition is different for this explicitly defined printer share from the general -[printers] share. It is not a requirement; we +[printers] share. It is not a requirement; we did it to show that it is possible if you want it. -browseable = yes +browseableyes we also made this printer browseable (so that the clients may conveniently find it when browsing the Network Neighbourhood). -printable = yes +printableyes see explanation in last subsection. -writeable = no +writeableno see explanation in last subsection. -hosts allow = 10.160.50.,10.160.51. +hosts allow10.160.50.,10.160.51. here we exercise a certain degree of access control -by using the hosts allow and hosts deny parameters. Note, that +by using the hosts allow and hosts deny parameters. Note, that this is not by any means a safe bet. It is not a way to secure your printers. This line accepts all clients from a certain subnet in a first evaluation of access control -hosts deny = turbo_xp,10.160.50.23,10.160.51.60 - +hosts denyturbo_xp,10.160.50.23,10.160.51.60 all listed hosts are not allowed here (even if they belong to the "allowed subnets"). As you can see, you could name IP addresses as well as NetBIOS hostnames here. -guest ok = no +guest okno this printer is not open for the guest account! @@ -902,11 +817,11 @@ here. In each section defining a printer (or in the -[printers] section), a print +[printers] section), a print command parameter may be defined. It sets a command to process the files which have been placed into the Samba print spool directory for that printer. (That spool directory was, if you -remember, set up with the path +remember, set up with the path parameter). Typically, this command will submit the spool file to the Samba host's print subsystem, using the suitable system print command. But there is no requirement that this needs to be the @@ -922,14 +837,14 @@ shortage of free space. -Default Print Commands for various Unix Print Subsystems +Default Print Commands for various UNIX Print Subsystems You learned earlier on, that Samba in most cases uses its built-in settings for many parameters if it can not find an explicitly stated one in its configuration file. The same is true for the -print command. The default print command varies -depending on the printing =... parameter +print command. The default print command varies +depending on the printing parameter setting. In the commands listed below, you will notice some parameters of the form %X where X is p, s, J etc. These letters stand for @@ -948,63 +863,63 @@ the special case of CUPS, which is discussed in the next chapter): -printing = bsd|aix|lprng|plp +printingbsd|aix|lprng|plp print command is lpr -r -P%p %s -printing = sysv|hpux +printingsysv|hpux print command is lp -c -P%p %s; rm %s - printing = qnx + printingqnx print command is lp -r -P%p -s %s -printing = bsd|aix|lprng|plp +printingbsd|aix|lprng|plp lpq command is lpq -P%p -printing = sysv|hpux +printingsysv|hpux lpq command is lpstat -o%p -printing = qnx +printingqnx lpq command is lpq -P%p -printing = bsd|aix|lprng|plp +printingbsd|aix|lprng|plp lprm command is lprm -P%p %j -printing = sysv|hpux +printingsysv|hpux lprm command is cancel %p-%j -printing = qnx +printingqnx lprm command is cancel %p-%j -printing = bsd|aix|lprng|plp +printingbsd|aix|lprng|plp lppause command is lp -i %p-%j -H hold -printing = sysv|hpux +printingsysv|hpux lppause command (...is empty) -printing = qnx +printingqnx lppause command (...is empty) -printing = bsd|aix|lprng|plp +printingbsd|aix|lprng|plp lpresume command is lp -i %p-%j -H resume -printing = sysv|hpux +printingsysv|hpux lpresume command (...is empty) -printing = qnx +printingqnx lpresume command (...is empty) @@ -1016,7 +931,7 @@ We excluded the special CUPS case here, because it is discussed in the next chapter. Just a short summary. For printing = CUPS: If SAMBA is compiled against libcups, it uses the CUPS API to submit jobs, etc. (It is a good idea also to set -printcap = cups in case your +printcapcups in case your cupsd.conf is set to write its autogenerated printcap file to an unusual place). Otherwise Samba maps to the System V printing commands with the -oraw option for printing, i.e. it uses @@ -1050,7 +965,7 @@ way you want them to work and not rely on any built-in defaults. After a print job has finished spooling to a service, the -print command will be used by Samba via a +print command will be used by Samba via a system() call to process the spool file. Usually the command specified will submit the spool file to the host's printing subsystem. But there is no requirement at all that this must @@ -1102,7 +1017,7 @@ command. In this case the job is sent to the default printer. -If specified in the [global] section, the print +If specified in the [global] section, the print command given will be used for any printable service that does not have its own print command specified. If there is neither a specified print command for a printable service nor a global print command, @@ -1115,7 +1030,7 @@ hard disk. Note that printing may fail on some UNIXes from the "nobody" account. If this happens, create an alternative guest account and supply it with the privilege to print. Set up this guest account in -the [global] section with the guest +the [global] section with the guest account parameter. @@ -1126,28 +1041,26 @@ expand the included environment variables as usual. (The syntax to include a UNIX environment variable $variable in or in the Samba print command is %$variable.) To give you a working -print command example, the following will log a +print command example, the following will log a print job to /tmp/print.log, print the file, then remove it. Note that ';' is the usual separator for commands in shell scripts: - -> /tmp/print.log; lpr -P %p %s; rm %s -]]> - + +print commandecho Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s + You may have to vary your own command considerably from this example depending on how you normally print files on your system. The default -for the print command parameter varies depending on the setting of -the printing parameter. Another example is: +for the print command parameter varies depending on the setting of +the printing parameter. Another example is: - - print command = /usr/local/samba/bin/myprintscript %p %s - + +print command/usr/local/samba/bin/myprintscript %p %s + @@ -1176,15 +1089,11 @@ The additional functionality provided by the new SPOOLSS support includes: Uploading of printer drivers via the Windows NT Add Printer Wizard (APW) or the -Imprints tool set (refer to http://imprints.sourceforge.net); +Imprints tool set. Support for the native MS-RPC printing calls such as -StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation -at http://msdn.microsoft.com/ -for more information on the Win32 printing API); + StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation for more information on the Win32 printing API); Support for NT Access Control Lists (ACL) on printer objects; @@ -1197,7 +1106,7 @@ files). -One other benefit of an update is this: Samba-3 is able to publish +One other benefit of an update is this: Samba 3 is able to publish all its printers in Active Directory (or LDAP)! @@ -1238,12 +1147,12 @@ possess a valid driver for the printer. This was fixed in Samba But it is a new option to install the printer -drivers into the [print$] share of the Samba +drivers into the [print$] share of the Samba server, and a big convenience too. Then all clients (including 95/98/ME) get the driver installed when they first connect to this printer share. The uploading or depositing of the driver into this -[print$] share, and the following binding of +[print$] share, and the following binding of this driver to an existing Samba printer share can be achieved by different means: @@ -1271,17 +1180,17 @@ does not use these uploaded drivers in any way to process spooled files. Drivers are utilized entirely by the clients, who download and install them via the "Point'n'Print" mechanism supported by Samba. The clients use these drivers to generate print files in the -format the printer (or the Unix print system) requires. Print files -received by Samba are handed over to the Unix printing system, which +format the printer (or the UNIX print system) requires. Print files +received by Samba are handed over to the UNIX printing system, which is responsible for all further processing, if needed. -The [printer$] Section is removed from Samba-3 +The [printer$] Section is removed from Samba 3 -<parameter>[print$]</parameter> vs. <parameter>[printer$]</parameter> +<smbconfsection>[print$]</smbconfsection> vs. <smbconfsection>[printer$]</smbconfsection> @@ -1289,7 +1198,7 @@ Versions of Samba prior to 2.2 made it possible to use a share named [printer$]. This name was taken from the same named service created by Windows 9x clients when a printer was shared by them. Windows 9x printer servers always have a -[printer$] service which provides read-only +[printer$] service which provides read-only access (with no password required) in order to support printer driver downloads. However, Samba's initial implementation allowed for a parameter named printer driver location to be @@ -1298,16 +1207,16 @@ files associated with that printer. Another parameter named printer driver provided a means of defining the printer driver name to be sent to the client. These parameters, including the printer driver file parameter, -are now removed and can not be used in installations of Samba-3.0. -Now the share name [print$] is used for the +are now removed and can not be used in installations of samba-3. +Now the share name [print$] is used for the location of downloadable printer drivers. It is taken from the -[print$] service created by Windows NT PCs when +[print$] service created by Windows NT PCs when a printer is shared by them. Windows NT print servers always have a -[print$] service which provides read-write +[print$] service which provides read-write access (in the context of its ACLs) in order to support printer driver down- and uploads. Don't fear -- this does not mean Windows 9x clients are thrown aside now. They can use Samba's -[print$] share support just fine. +[print$] share support just fine. @@ -1317,7 +1226,7 @@ clients are thrown aside now. They can use Samba's In order to support the up- and downloading of printer driver files, you must first configure a file share named -[print$]. The "public" name of this share is +[print$]. The "public" name of this share is hard coded in Samba's internals (because it is hard coded in the MS Windows clients too). It cannot be renamed since Windows clients are programmed to search for a service of exactly this name if they want @@ -1327,33 +1236,33 @@ to retrieve printer driver files. You should modify the server's file to add the global parameters and create the -[print$] file share (of course, some of the +[print$] file share (of course, some of the parameter values, such as 'path' are arbitrary and should be replaced with appropriate values for your site): - - [global] - ; members of the ntadmin group should be able to add drivers and set - ; printer properties. root is implicitly always a 'printer admin'. - printer admin = @ntadmin - [....] + + [print\$] example + [global] + members of the ntadmin group should be able to add drivers and set + printer properties. root is implicitly always a 'printer admin'. + printer admin@ntadmin + ... + [printers] + ... - [printers] - [....] - - [print$] - comment = Printer Driver Download Area - path = /etc/samba/drivers - browseable = yes - guest ok = yes - read only = yes - write list = @ntadmin, root - + [print$] +commentPrinter Driver Download Area +path/etc/samba/drivers +browseableyes +guest okyes +read onlyyes +write list@ntadmin, root + Of course, you also need to ensure that the directory named by the -path parameter exists on the Unix file system. +path parameter exists on the UNIX file system. @@ -1362,33 +1271,33 @@ Of course, you also need to ensure that the directory named by the Parameters in the [print$] Section -[print$] is a special section in +[print$] is a special section in . It contains settings relevant to potential printer driver download and local installation by clients. -comment = Printer Driver -Download Area + commentPrinter Driver + Download Area the comment appears next to the share name if it is listed in a share list (usually Windows clients won't see it often but it will also appear up in a smbclient -L sambaserver output). -path = /etc/samba/printers +path/etc/samba/printers this is the path to the location of the Windows driver file deposit from the UNIX point of view. -browseable = no - this makes the [print$] share +browseableno + this makes the [print$] share "invisible" in Network Neighbourhood to clients. However, you can still "mount" it from any client using the net use g:\\sambaserver\print$ command in a "DOS box" or the "Connect network drive" menu from Windows Explorer. -guest ok = yes +guest okyes this gives read only access to this share for all guest users. Access may be used to download and install printer drivers on clients. The requirement for guest ok = @@ -1404,19 +1313,19 @@ validated by the Domain Controller in order to logon to the Windows NT session), then guest access is not necessary. Of course, in a workgroup environment where you just want to be able to print without worrying about silly accounts and security, then configure the share -for guest access. You'll probably want to add map to guest -= Bad User in the [global] section +for guest access. You'll probably want to add map to guestBad User in the +[global] section as well. Make sure you understand what this parameter does before using it. -read only = yes +read onlyyes as we don't want everybody to upload driver files (or even change driver settings) we tagged this share as not writeable. -write list = @ntadmin,root -since the [print$] was made +write list@ntadmin,root +since the [print$] was made read only by the previous setting, we need to create a "write list" also. UNIX groups (denoted with a leading "@" character) and users listed here are allowed write access (as an exception to the general @@ -1425,7 +1334,7 @@ share. Normally you will want to only name administrative level user accounts in this setting. Check the file system permissions to make sure these accounts can copy files to the share. If this is a non-root account, then the account should also be mentioned in the global -printer admin parameter. See the +printer admin parameter. See the man page for more information on configuring file shares. @@ -1439,18 +1348,18 @@ configuring file shares. In order for a Windows NT print server to support the downloading of driver files by multiple client architectures, you must create several -subdirectories within the [print$] service -(i.e. the Unix directory named by the path +subdirectories within the [print$] service +(i.e. the UNIX directory named by the path parameter). These correspond to each of the supported client architectures. Samba follows this model as well. Just like the name of -the [print$] share itself, the subdirectories +the [print$] share itself, the subdirectories *must* be exactly the names listed below (you may leave out the subdirectories of architectures you don't want to support). Therefore, create a directory tree below the -[print$] share for each architecture you wish +[print$] share for each architecture you wish to support. @@ -1483,13 +1392,13 @@ named in the printer adminlist. Of course, the connected account must still possess access to add files to the subdirectories beneath -[print$]. Remember that all file shares are set +[print$]. Remember that all file shares are set to 'read only' by default. -Once you have created the required [print$] +Once you have created the required [print$] service and associated subdirectories, go to a Windows NT 4.0/2k/XP client workstation. Open Network Neighbourhood or My Network Places and browse for the Samba host. @@ -1504,7 +1413,7 @@ that matches the printer shares defined on your Samba host. Installing Drivers into [print$] -You have successfully created the [print$] +You have successfully created the [print$] share in ? And Samba has re-read its configuration? Good. But you are not yet ready to take off. The driver files need to be present in this share, @@ -1512,7 +1421,7 @@ too! So far it is still an empty share. Unfortunately, it is not enough to just copy the driver files over. They need to be set up too. And that is a bit tricky, to say the least. We will now discuss two alternative ways to install the drivers into -[print$]: +[print$]: @@ -1539,8 +1448,8 @@ entrance to this realm seems a little bit weird at first). The initial listing of printers in the Samba host's Printers folder accessed from a client's Explorer -will have no real printer driver assigned to them. By default, in -Samba-3 (as in 2.2.1 and later) this driver name is set to a NULL +will have no real printer driver assigned to them. By default +this driver name is set to a NULL string. This must be changed now. The local Add Printer Wizard, run from NT/2000/XP clients, will help us in this task. @@ -1585,7 +1494,7 @@ Once the APW is started, the procedure is exactly the same as the one you are familiar with in Windows (we assume here that you are familiar with the printer driver installations procedure on Windows NT). Make sure your connection is in fact setup as a user with -printer admin privileges (if in doubt, use +printer admin privileges (if in doubt, use smbstatus to check for this). If you wish to install printer drivers for client operating systems other than Windows NT x86, you will need to use the @@ -1594,7 +1503,7 @@ install printer drivers for client operating systems other than Assuming you have connected with an administrative (or root) account -(as named by the printer admin parameter), +(as named by the printer admin parameter), you will also be able to modify other printer properties such as ACLs and default device settings using this dialog. For the default device settings, please consider the advice given further below. @@ -1607,7 +1516,7 @@ settings, please consider the advice given further below. The second way to install printer drivers into -[print$] and set them up in a valid way can be +[print$] and set them up in a valid way can be done from the UNIX command line. This involves four distinct steps: @@ -1616,7 +1525,7 @@ done from the UNIX command line. This involves four distinct steps: and collecting the files together; deposit the driver files into the -[print$] share's correct subdirectories +[print$] share's correct subdirectories (possibly by using smbclient); running the rpcclient @@ -1692,35 +1601,35 @@ different spaces in between words: -&rootprompt;rpcclient -U'Danka%xxxx' -c 'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP - cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3 - - [Windows NT x86] - Printer Driver Info 3: - Version: [2] - Driver Name: [Heidelberg Digimaster 9110 (PS)] - Architecture: [Windows NT x86] - Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.DLL] - Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.ppd] - Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.DLL] - Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.HLP] +&rootprompt;rpcclient -U'Danka%xxxx' -c \ + 'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP +cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3 + +[Windows NT x86] +Printer Driver Info 3: + Version: [2] + Driver Name: [Heidelberg Digimaster 9110 (PS)] + Architecture: [Windows NT x86] + Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.DLL] + Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.ppd] + Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.DLL] + Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.HLP] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.DLL] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.INI] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1KMMin.DLL] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.dat] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.cat] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.def] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hre] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.vnd] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hlp] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de_reg.HLP] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01Aux.dll] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.NTF] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.DLL] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.INI] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1KMMin.DLL] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.dat] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.cat] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.def] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hre] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.vnd] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hlp] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de_reg.HLP] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01Aux.dll] + Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.NTF] - Monitorname: [] - Defaultdatatype: [] - + Monitorname: [] + Defaultdatatype: [] @@ -1738,7 +1647,7 @@ can also host the Win9x drivers, even if itself runs on Windows NT, -Since the [print$] share is usually accessible +Since the [print$] share is usually accessible through the Network Neighbourhood, you can also use the UNC notation from Windows Explorer to poke at it. The Win9x driver files will end up in subdirectory "0" of the "WIN40" directory. The full path to @@ -1763,7 +1672,7 @@ this. These type of drivers install into the "3" subdirectory. Now we need to collect all the driver files we identified. in our previous step. Where do we get them from? Well, why not retrieve them -from the very PC and the same [print$] share +from the very PC and the same [print$] share which we investigated in our last step to identify the files? We can use smbclient to do this. We will use the paths and names which were leaked to us by getdriver. The @@ -1774,15 +1683,15 @@ listing is edited to include linebreaks for readability: &rootprompt;smbclient //TURBO_XP/print\$ -U'Danka%xxxx' \ -c 'cd W32X86/2;mget HD*_de.* \ hd*ppd Hd*_de.* Hddm*dll HDN*Aux.DLL' - added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 - Got a positive name query response from 10.160.50.8 ( 10.160.50.8 ) - Domain=[DEVELOPMENT] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager] - Get file Hddm91c1_de.ABD? n - Get file Hddm91c1_de.def? y - getting file \W32X86\2\Hddm91c1_de.def of size 428 as Hddm91c1_de.def (22.0 kb/s) (average 22.0 kb/s) - Get file Hddm91c1_de.DLL? y - getting file \W32X86\2\Hddm91c1_de.DLL of size 876544 as Hddm91c1_de.DLL (737.3 kb/s) (average 737.3 kb/s) - [...] +added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 +Got a positive name query response from 10.160.50.8 ( 10.160.50.8 ) +Domain=[DEVELOPMENT] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager] +Get file Hddm91c1_de.ABD? n +Get file Hddm91c1_de.def? y +getting file \W32X86\2\Hddm91c1_de.def of size 428 as Hddm91c1_de.def +Get file Hddm91c1_de.DLL? y +getting file \W32X86\2\Hddm91c1_de.DLL of size 876544 as Hddm91c1_de.DLL +[...] @@ -1800,7 +1709,7 @@ architecture should you need to support Win95/98/XP clients. Remember, the files for these architectures are in the WIN40/0/ subdir. Once we are complete, we can run smbclient ... put to store the collected files on the Samba server's -[print$] share. +[print$] share. @@ -1809,11 +1718,11 @@ the collected files on the Samba server's So, now we are going to put the driver files into the -[print$] share. Remember, the UNIX path to this +[print$] share. Remember, the UNIX path to this share has been defined previously in your . You also have created subdirectories for the different Windows client types you want to support. Supposing -your [print$] share maps to the UNIX path +your [print$] share maps to the UNIX path /etc/samba/drivers/, your driver files should now go here: @@ -1834,11 +1743,12 @@ network. We specify the same files and paths as were leaked to us by running getdriver against the original Windows install. However, now we are going to store the files into a Samba/UNIX print server's -[print$] share... +[print$] share... -&rootprompt;smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c 'cd W32X86; put HDNIS01_de.DLL; \ + &rootprompt;smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c \ + 'cd W32X86; put HDNIS01_de.DLL; \ put Hddm91c1_de.ppd; put HDNIS01U_de.DLL; \ put HDNIS01U_de.HLP; put Hddm91c1_de.DLL; \ put Hddm91c1_de.INI; put Hddm91c1KMMin.DLL; \ @@ -1847,26 +1757,25 @@ store the files into a Samba/UNIX print server's put Hddm91c1_de.vnd; put Hddm91c1_de.hlp; \ put Hddm91c1_de_reg.HLP; put HDNIS01Aux.dll; \ put HDNIS01_de.NTF' - added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 - Got a positive name query response from 10.160.51.162 ( 10.160.51.162 ) - Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a] - putting file HDNIS01_de.DLL as \W32X86\HDNIS01_de.DLL (4465.5 kb/s) (average 4465.5 kb/s) - putting file Hddm91c1_de.ppd as \W32X86\Hddm91c1_de.ppd (12876.8 kb/s) (average 4638.9 kb/s) - putting file HDNIS01U_de.DLL as \W32X86\HDNIS01U_de.DLL (20249.8 kb/s) (average 5828.3 kb/s) - putting file HDNIS01U_de.HLP as \W32X86\HDNIS01U_de.HLP (9652.8 kb/s) (average 5899.8 kb/s) - putting file Hddm91c1_de.DLL as \W32X86\Hddm91c1_de.DLL (23777.7 kb/s) (average 10400.6 kb/s) - putting file Hddm91c1_de.INI as \W32X86\Hddm91c1_de.INI (98.6 kb/s) (average 10329.0 kb/s) - putting file Hddm91c1KMMin.DLL as \W32X86\Hddm91c1KMMin.DLL (22931.5 kb/s) (average 10501.7 kb/s) - putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (2462.8 kb/s) (average 10393.0 kb/s) - putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (4925.3 kb/s) (average 10356.3 kb/s) - putting file Hddm91c1_de.def as \W32X86\Hddm91c1_de.def (417.9 kb/s) (average 10290.1 kb/s) - putting file Hddm91c1_de.hre as \W32X86\Hddm91c1_de.hre (22571.3 kb/s) (average 11338.5 kb/s) - putting file Hddm91c1_de.vnd as \W32X86\Hddm91c1_de.vnd (3384.6 kb/s) (average 10754.3 kb/s) - putting file Hddm91c1_de.hlp as \W32X86\Hddm91c1_de.hlp (18406.8 kb/s) (average 10839.8 kb/s) - putting file Hddm91c1_de_reg.HLP as \W32X86\Hddm91c1_de_reg.HLP (20278.3 kb/s) (average 11386.3 kb/s) - putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll (14994.6 kb/s) (average 11405.2 kb/s) - putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF (23390.2 kb/s) (average 13170.8 kb/s) - +added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 +Got a positive name query response from 10.160.51.162 ( 10.160.51.162 ) +Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a] +putting file HDNIS01_de.DLL as \W32X86\HDNIS01_de.DLL +putting file Hddm91c1_de.ppd as \W32X86\Hddm91c1_de.ppd +putting file HDNIS01U_de.DLL as \W32X86\HDNIS01U_de.DLL +putting file HDNIS01U_de.HLP as \W32X86\HDNIS01U_de.HLP +putting file Hddm91c1_de.DLL as \W32X86\Hddm91c1_de.DLL +putting file Hddm91c1_de.INI as \W32X86\Hddm91c1_de.INI +putting file Hddm91c1KMMin.DLL as \W32X86\Hddm91c1KMMin.DLL +putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat +putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat +putting file Hddm91c1_de.def as \W32X86\Hddm91c1_de.def +putting file Hddm91c1_de.hre as \W32X86\Hddm91c1_de.hre +putting file Hddm91c1_de.vnd as \W32X86\Hddm91c1_de.vnd +putting file Hddm91c1_de.hlp as \W32X86\Hddm91c1_de.hlp +putting file Hddm91c1_de_reg.HLP as \W32X86\Hddm91c1_de_reg.HLP +putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll +putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF @@ -1893,42 +1802,42 @@ also and do this through a standard UNIX shell access too): -&rootprompt;smbclient //SAMBA-CUPS/print\$ -U 'root%xxxx' -c 'cd W32X86; pwd; dir; cd 2; pwd; dir' +&rootprompt;smbclient //SAMBA-CUPS/print\$ -U 'root%xxxx' \ + -c 'cd W32X86; pwd; dir; cd 2; pwd; dir' added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 - Got a positive name query response from 10.160.51.162 ( 10.160.51.162 ) - Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a] - - Current directory is \\SAMBA-CUPS\print$\W32X86\ - . D 0 Sun May 4 03:56:35 2003 - .. D 0 Thu Apr 10 23:47:40 2003 - 2 D 0 Sun May 4 03:56:18 2003 - HDNIS01Aux.dll A 15356 Sun May 4 03:58:59 2003 - Hddm91c1KMMin.DLL A 46966 Sun May 4 03:58:59 2003 - HDNIS01_de.DLL A 434400 Sun May 4 03:58:59 2003 - HDNIS01_de.NTF A 790404 Sun May 4 03:56:35 2003 - Hddm91c1_de.DLL A 876544 Sun May 4 03:58:59 2003 - Hddm91c1_de.INI A 101 Sun May 4 03:58:59 2003 - Hddm91c1_de.dat A 5044 Sun May 4 03:58:59 2003 - Hddm91c1_de.def A 428 Sun May 4 03:58:59 2003 - Hddm91c1_de.hlp A 37699 Sun May 4 03:58:59 2003 - Hddm91c1_de.hre A 323584 Sun May 4 03:58:59 2003 - Hddm91c1_de.ppd A 26373 Sun May 4 03:58:59 2003 - Hddm91c1_de.vnd A 45056 Sun May 4 03:58:59 2003 - HDNIS01U_de.DLL A 165888 Sun May 4 03:58:59 2003 - HDNIS01U_de.HLP A 19770 Sun May 4 03:58:59 2003 - Hddm91c1_de_reg.HLP A 228417 Sun May 4 03:58:59 2003 - 40976 blocks of size 262144. 709 blocks available - - Current directory is \\SAMBA-CUPS\print$\W32X86\2\ - . D 0 Sun May 4 03:56:18 2003 - .. D 0 Sun May 4 03:56:35 2003 - ADOBEPS5.DLL A 434400 Sat May 3 23:18:45 2003 - laserjet4.ppd A 9639 Thu Apr 24 01:05:32 2003 - ADOBEPSU.DLL A 109568 Sat May 3 23:18:45 2003 - ADOBEPSU.HLP A 18082 Sat May 3 23:18:45 2003 - PDFcreator2.PPD A 15746 Sun Apr 20 22:24:07 2003 - 40976 blocks of size 262144. 709 blocks available - +Got a positive name query response from 10.160.51.162 ( 10.160.51.162 ) +Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a] + +Current directory is \\SAMBA-CUPS\print$\W32X86\ +. D 0 Sun May 4 03:56:35 2003 +.. D 0 Thu Apr 10 23:47:40 2003 +2 D 0 Sun May 4 03:56:18 2003 +HDNIS01Aux.dll A 15356 Sun May 4 03:58:59 2003 +Hddm91c1KMMin.DLL A 46966 Sun May 4 03:58:59 2003 +HDNIS01_de.DLL A 434400 Sun May 4 03:58:59 2003 +HDNIS01_de.NTF A 790404 Sun May 4 03:56:35 2003 +Hddm91c1_de.DLL A 876544 Sun May 4 03:58:59 2003 +Hddm91c1_de.INI A 101 Sun May 4 03:58:59 2003 +Hddm91c1_de.dat A 5044 Sun May 4 03:58:59 2003 +Hddm91c1_de.def A 428 Sun May 4 03:58:59 2003 +Hddm91c1_de.hlp A 37699 Sun May 4 03:58:59 2003 +Hddm91c1_de.hre A 323584 Sun May 4 03:58:59 2003 +Hddm91c1_de.ppd A 26373 Sun May 4 03:58:59 2003 +Hddm91c1_de.vnd A 45056 Sun May 4 03:58:59 2003 +HDNIS01U_de.DLL A 165888 Sun May 4 03:58:59 2003 +HDNIS01U_de.HLP A 19770 Sun May 4 03:58:59 2003 +Hddm91c1_de_reg.HLP A 228417 Sun May 4 03:58:59 2003 + 40976 blocks of size 262144. 709 blocks available + +Current directory is \\SAMBA-CUPS\print$\W32X86\2\ +. D 0 Sun May 4 03:56:18 2003 +.. D 0 Sun May 4 03:56:35 2003 +ADOBEPS5.DLL A 434400 Sat May 3 23:18:45 2003 +laserjet4.ppd A 9639 Thu Apr 24 01:05:32 2003 +ADOBEPSU.DLL A 109568 Sat May 3 23:18:45 2003 +ADOBEPSU.HLP A 18082 Sat May 3 23:18:45 2003 +PDFcreator2.PPD A 15746 Sun Apr 20 22:24:07 2003 + 40976 blocks of size 262144. 709 blocks available @@ -1952,7 +1861,7 @@ driver files belong. So, next you must tell Samba about the special category of the files -you just uploaded into the [print$] share. This +you just uploaded into the [print$] share. This is done by the adddriver command. It will prompt Samba to register the driver files into its internal TDB database files. The following command and its output has been edited, @@ -1960,21 +1869,23 @@ again, for readability: -&rootprompt;rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL: \ - Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP: \ - NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ - Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ - Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ - HDNIS01Aux.dll,HDNIS01_de.NTF, \ - Hddm91c1_de_reg.HLP' SAMBA-CUPS - - cmd = adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL: \ - HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ - Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ - Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ - HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP" - - Printer Driver dm9110 successfully installed. + &rootprompt;rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" \ +"dm9110:HDNIS01_de.DLL: \ +Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP: \ + NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ + Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ + Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ + HDNIS01Aux.dll,HDNIS01_de.NTF, \ + Hddm91c1_de_reg.HLP' SAMBA-CUPS + +cmd = adddriver "Windows NT x86" \ +"dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL: \ + HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ + Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ + Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ + HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP" + +Printer Driver dm9110 successfully installed. @@ -2005,9 +1916,9 @@ subdirectory. You can check this again with -&rootprompt;smbclient //SAMBA-CUPS/print\$ -Uroot%xxxx -c 'cd W32X86;dir;pwd;cd 2;dir;pwd' +&rootprompt;smbclient //SAMBA-CUPS/print\$ -Uroot%xx -c 'cd W32X86;dir;pwd;cd 2;dir;pwd' added interface ip=10.160.51.162 bcast=10.160.51.255 nmask=255.255.252.0 - Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a] + Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a] Current directory is \\SAMBA-CUPS\print$\W32X86\ . D 0 Sun May 4 04:32:48 2003 @@ -2101,7 +2012,7 @@ host and "xxxx" represents the actual Samba password assigned to root: You will see a listing of all drivers Samba knows about. Your new one should be amongst them. But it is only listed under the [Windows NT -x86] heading, not under [Windows 4.0], +x86] heading, not under [Windows 4.0], since we didn't install that part. Or did *you*? -- You will see a listing of all drivers Samba knows about. Your new one should be amongst them. In our example it is named dm9110. Note that the 3rd column @@ -2125,13 +2036,13 @@ with a different driver name, it will work the same: &rootprompt;rpcclient -Uroot%xxxx \ - -c 'adddriver "Windows NT x86" \ - "myphantasydrivername:HDNIS01_de.DLL: \ - Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP: \ - NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ - Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ - Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ - HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP' SAMBA-CUPS + -c 'adddriver "Windows NT x86" \ + "myphantasydrivername:HDNIS01_de.DLL: \ + Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP: \ + NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ + Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ + Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ + HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP' SAMBA-CUPS cmd = adddriver "Windows NT x86" @@ -2151,7 +2062,7 @@ you are responsible yourself that you associate drivers to queues which make sense to the target printer). Note, that you can't run the rpcclient adddriver command repeatedly. Each run "consumes" the files you had put into the -[print$] share by moving them into the +[print$] share by moving them into the respective subdirectories. So you must precede an smbclient ... put command before each rpcclient ... adddriver" command. @@ -2159,7 +2070,7 @@ respective subdirectories. So you must precede an -La Grande Finale: Running <command>rpcclient</command> with +<title>Running <command>rpcclient</command> with <command>setdriver</command> @@ -2207,8 +2118,7 @@ signal to all running smbd processes to work around this: -"The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure) +Client Driver Install Procedure A famous philosopher said once: The Proof of the Pudding lies @@ -2227,7 +2137,7 @@ all further clients are easy to setup and shouldn't need further attention. What follows is a description for the recommended first procedure. You work now from a client workstation. First you should guarantee that your connection is not unwittingly mapped to -bad user "nobody". In a DOS box type: +bad user "nobody". In a DOS box type: net use \\SAMBA-SERVER\print$ /user:root @@ -2330,13 +2240,13 @@ This can be achieved by accessing the drivers remotely from an NT (or Be aware, that a valid Device Mode can only be initiated by a -printer admin, or root (the reason should be +printer admin, or root (the reason should be obvious). Device Modes can only correctly be set by executing the printer driver program itself. Since Samba can not execute this Win32 platform driver code, it sets this field initially to NULL (which is not a valid setting for clients to use). Fortunately, most drivers generate themselves the Printer Driver Data that is needed, when they -are uploaded to the [print$] share with the +are uploaded to the [print$] share with the help of the APW or rpcclient. @@ -2447,10 +2357,10 @@ or in the Run command... field from the After you installed the driver on the Samba server (in its -[print$] share, you should always make sure +[print$] share, you should always make sure that your first client installation completes correctly. Make it a habit for yourself to build that the very first connection from a client as -printer admin. This is to make sure that: +printer admin. This is to make sure that: @@ -2477,7 +2387,10 @@ To connect as root to a Samba printer, try this command from a Windows 2K/XP DOS box command prompt: -runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n \\SAMBA-SERVER\printername" + +&dosprompt;runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n + \\SAMBA-SERVER\printername" + @@ -2485,7 +2398,7 @@ You will be prompted for root's Samba-password; type it, wait a few seconds, click on Printing Defaults... and proceed to set the job options as should be used as defaults by all clients. Alternatively, instead of root you can name one other member -of the printer admins from the setting. +of the printer admin from the setting. @@ -2609,7 +2522,7 @@ either. However, only the last one, which you arrived at with steps C.1.-6. will permanently save any settings which will then become the defaults for new users. If you want all clients to have the same defaults, you need to conduct these steps as administrator -(printer admin in ) +(printer admin in ) before a client downloads the driver (the clients can later set their own per-user defaults by following the procedures A. @@ -2673,7 +2586,7 @@ clicking orgy alone, you need to think about a non-interactive script. If more than one printer is using the same driver, the rpcclient setdriver command can be used to set the driver associated with an installed queue. If the driver is uploaded -to [print$] once and registered with the +to [print$] once and registered with the printing TDBs, it can be used by multiple print queues. In this case you just need to repeat the setprinter subcommand of rpcclient for every queue (without the need to @@ -2715,7 +2628,8 @@ following is an example of how this could be accomplished: -&rootprompt;rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 "Heidelberg Digimaster 9110 (PS)"' +&rootprompt;rpcclient SAMBA-CUPS -U root%secret -c \ + 'setdriver dm9110 "Heidelberg Digimaster 9110 (PS)"' cmd = setdriver dm9110 Heidelberg Digimaster 9110 (PPD) Successfully set dm9110 to driver Heidelberg Digimaster 9110 (PS). @@ -2725,7 +2639,8 @@ following is an example of how this could be accomplished: cmd = enumprinters flags:[0x800000] name:[\\SAMBA-CUPS\dm9110] - description:[\\SAMBA-CUPS\dm9110,Heidelberg Digimaster 9110 (PS),110ppm HiVolume DANKA Stuttgart] + description:[\\SAMBA-CUPS\dm9110,Heidelberg Digimaster 9110 (PS),\ + 110ppm HiVolume DANKA Stuttgart] comment:[110ppm HiVolume DANKA Stuttgart] [....] @@ -2741,7 +2656,8 @@ following is an example of how this could be accomplished: cmd = enumprinters flags:[0x800000] name:[\\SAMBA-CUPS\dm9110] - description:[\\SAMBA-CUPS\dm9110,myphantasydrivername,110ppm HiVolume DANKA Stuttgart] + description:[\\SAMBA-CUPS\dm9110,myphantasydrivername,\ + 110ppm HiVolume DANKA Stuttgart] comment:[110ppm HiVolume DANKA Stuttgart] [....] @@ -2771,7 +2687,7 @@ if: ...the connected user is able to successfully execute an OpenPrinterEx(\\server) with administrative -privileges (i.e. root or printer admin). +privileges (i.e. root or printer admin). Try this from a Windows 2K/XP DOS box command prompt: @@ -2786,7 +2702,7 @@ and click on Printing Preferences... ... contains the setting -show add printer wizard = yes (the +show add printer wizardyes (the default). @@ -2796,7 +2712,7 @@ The APW can do various things: upload a new driver to the Samba -[print$] share; +[print$] share; associate an uploaded driver with an existing (but still "driverless") print queue; @@ -2805,8 +2721,8 @@ still "driverless") print queue; print queue with one that has been uploaded before; add an entirely new printer to the Samba host (only in -conjunction with a working add printer command; -a corresponding delete printer command for +conjunction with a working add printer command; +a corresponding delete printer command for removing entries from the Printers... folder may be provided too) @@ -2814,9 +2730,9 @@ may be provided too) The last one (add a new printer) requires more effort than the previous ones. In order to use the APW to successfully add a printer -to a Samba server, the add printer command must +to a Samba server, the add printer command must have a defined value. The program hook must successfully add the -printer to the Unix print system (i.e. to +printer to the UNIX print system (i.e. to /etc/printcap, /etc/cups/printers.conf or other appropriate files) and to if necessary. @@ -2828,10 +2744,8 @@ exist, smbd will execute the add printer command and reparse to the to attempt to locate the new printer share. If the share is still not defined, an error of Access Denied is -returned to the client. Note that the add printer -command is executed under the context of the connected -user, not necessarily a root account. A map to guest = bad -user may have connected you unwittingly under the wrong +returned to the client. Note that the add printer command is executed under the context of the connected +user, not necessarily a root account. A map to guestbad user may have connected you unwittingly under the wrong privilege; you should check it by using the smbstatus command. @@ -3068,7 +2982,7 @@ multiple ports as a form of load balancing or fail over. If you require that multiple ports be defined for some reason or another (My users and my Boss should not know that they are working with Samba), possesses a -enumports command which can be used to define +enumports command which can be used to define an external program that generates a listing of ports on a system. @@ -3094,7 +3008,7 @@ Settings" in the CUPS Printing part of this document. The Imprints tool set provides a UNIX equivalent of the Windows NT Add Printer Wizard. For complete information, please refer to the Imprints web site -athttp://imprints.sourceforge.net/ +at http://imprints.sourceforge.net/ as well as the documentation included with the imprints source distribution. This section will only provide a brief introduction to the features of Imprints. @@ -3298,14 +3212,6 @@ Here is a list of the used commandline parameters: - -I have tested this with a Samba 2.2.7a and a Samba-3alpha24 -installation and Windows XP Professional clients. Note that this -specific command set works with network print queues (installing -local print queues requires different parameters, but this is of no -interest here). - - Line 1 deletes a possibly existing previous network printer infotec2105-IPDS (which had used native @@ -3338,7 +3244,7 @@ on "sambacupsserver", and if the printer drivers have successfully been uploaded (via APW , smbclient/rpcclient or cupsaddsmb) into the -[print$] driver repository of Samba. Also, some +[print$] driver repository of Samba. Also, some Samba versions prior to version 3.0 required a re-start of smbd after the printer install and the driver upload, otherwise the script (or any other client driver download) would fail. @@ -3392,7 +3298,7 @@ create a new printer on Samba and the UNIX print subsystem! -Migration of "Classical" printing to Samba-3 +Migration of "Classical" printing to Samba The basic "NT-style" printer driver management has not changed @@ -3408,9 +3314,9 @@ possible scenarios for migration: You need to study and apply the new Windows NT printer -and driver support. Previously used parameters "printer -driver file", " printer driver" and -"printer driver location" are no longer +and driver support. Previously used parameters printer +driver file, printer driver and +printer driver location are no longer supported. If you want to take advantage of WinNT printer driver @@ -3418,19 +3324,18 @@ support you also need to migrate the Win9x/ME drivers to the new setup. An existing printers.def file -(the one specified in the now removed parameter printer -driver file = ...) will work no longer with Samba-3.0. In + (the one specified in the now removed parameter printer driver file) will work no longer with samba 3. In 3.0, smbd attempts to locate a Win9x/ME driver files for the printer -in [print$] and additional settings in the TDB +in [print$] and additional settings in the TDB and only there; if it fails it will not (as 2.2.x used to do) drop down to using a printers.def (and all associated parameters). The make_printerdef tool is removed and there is no backwards compatibility for this. You need to install a Windows 9x driver into the -[print$] share for a printer on your Samba +[print$] share for a printer on your Samba host. The driver files will be stored in the "WIN40/0" subdirectory of -[print$], and some other settings and info go +[print$], and some other settings and info go into the printing-related TDBs. If you want to migrate an existing @@ -3441,7 +3346,7 @@ rpcclient. See the Imprints installation client at: -http://imprints.sourceforge.net/ + http://imprints.sourceforge.net/ @@ -3459,18 +3364,13 @@ We will publish an update to this section shortly. -Common Errors and Problems - - -Here are a few typical errors and problems people have -encountered. You can avoid them. Read on. - +Common Errors I give my root password but I don't get access -Don't confuse the root password which is valid for the Unix system +Don't confuse the root password which is valid for the UNIX system (and in most cases stored in the form of a one-way hash in a file named /etc/shadow) with the password used to authenticate against Samba!. Samba doesn't know the UNIX password; for @@ -3484,7 +3384,7 @@ for root must be created first. This is often done with the My printjobs get spooled into the spooling directory, but then get lost -Don't use the existing Unix print system spool directory for the Samba +Don't use the existing UNIX print system spool directory for the Samba spool directory. It may seem convenient and a saving of space, but it only leads to problems. The two must be separate. diff --git a/docs/docbook/projdoc/samba-doc.xml b/docs/docbook/projdoc/samba-doc.xml index 91002c9133..a04ab6adee 100644 --- a/docs/docbook/projdoc/samba-doc.xml +++ b/docs/docbook/projdoc/samba-doc.xml @@ -39,23 +39,22 @@ application knowledge that is most to be desired by many Samba users and adminis - + + + + Legal Notice This documentation is distributed under the GNU General Public License (GPL) version 2. A copy of the license is included with the Samba source distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt + - + Attributions - &attributions; - - - - - + @@ -131,15 +130,16 @@ Samba has several features that you might want or might not want to use. The cha Troubleshooting + &Diagnosis; &problems; &BUGS; -Appendixes + Appendixes &Compiling; -&Portability; + &Portability; &Other-Clients; &SPEED; &DNS-DHCP-Configuration; diff --git a/docs/docbook/projdoc/securing-samba.xml b/docs/docbook/projdoc/securing-samba.xml index bed4e4ee56..d59b0f381e 100644 --- a/docs/docbook/projdoc/securing-samba.xml +++ b/docs/docbook/projdoc/securing-samba.xml @@ -49,8 +49,8 @@ Samba may be secured from connections that originate from outside the local netw done using host based protection (using samba's implementation of a technology known as "tcpwrappers", or it may be done be using interface based exclusion so that &smbd; will bind only to specifically permitted interfaces. It is also -possible to set specific share or resource based exclusions, eg: on the IPC$ -auto-share. The IPC$ share is used for browsing purposes as well as to establish +possible to set specific share or resource based exclusions, eg: on the [IPC$] +auto-share. The [IPC$] share is used for browsing purposes as well as to establish TCP/IP connections. @@ -85,16 +85,16 @@ before someone will find yet another vulnerability. - One of the simplest fixes in this case is to use the hosts allow and - hosts deny options in the Samba &smb.conf; configuration file to only + One of the simplest fixes in this case is to use the hosts allow and + hosts deny options in the Samba &smb.conf; configuration file to only allow access to your server from a specific range of hosts. An example might be: - - hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24 - hosts deny = 0.0.0.0/0 - + +hosts allow127.0.0.1 192.168.2.0/24 192.168.3.0/24 +hosts deny0.0.0.0/0 + The above will only allow SMB connections from 'localhost' (your own @@ -111,12 +111,12 @@ before someone will find yet another vulnerability. If you want to restrict access to your server to valid users only then the following - method may be of use. In the &smb.conf; [globals] section put: + method may be of use. In the &smb.conf; [global] section put: - - valid users = @smbusers, jacko - + +valid users@smbusers, jacko + What this does is, it restricts all server access to either the user jacko @@ -140,10 +140,10 @@ before someone will find yet another vulnerability. You can change this behaviour using options like the following: - - interfaces = eth* lo - bind interfaces only = yes - + +interfaceseth* lo +bind interfaces onlyyes + This tells Samba to only listen for connections on interfaces with a @@ -209,11 +209,11 @@ before someone will find yet another vulnerability. To do that you could use: - -[ipc$] - hosts allow = 192.168.115.0/24 127.0.0.1 - hosts deny = 0.0.0.0/0 - + +[ipc$] +hosts allow192.168.115.0/24 127.0.0.1 +hosts deny0.0.0.0/0 + this would tell Samba that IPC$ connections are not allowed from @@ -245,23 +245,30 @@ before someone will find yet another vulnerability. To configure NTLMv2 authentication the following registry keys are worth knowing about: - - + [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "lmcompatibilitylevel"=dword:00000003 + + + 0x3 - Send NTLMv2 response only. Clients will use NTLMv2 authentication, use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM and NTLMv2 authentication. + + + [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0] "NtlmMinClientSec"=dword:00080000 + + + 0x80000 - NTLMv2 session security. If either NtlmMinClientSec or NtlmMinServerSec is set to 0x80000, the connection will fail if NTLMv2 session security is not negotiated. - @@ -270,10 +277,10 @@ before someone will find yet another vulnerability. Upgrading Samba -Please check regularly on http://www.samba.org/ for updates and +Please check regularly on http://www.samba.org/ for updates and important announcements. Occasionally security releases are made and it is highly recommended to upgrade Samba when a security vulnerability -is discovered. +is discovered. Check with your OS vendor for OS specific upgrades. @@ -346,21 +353,21 @@ out to be a security problem request are totally convinced that the problem is w Samba does allow the setup you require when you have set the - only user = yes option on the share, is that you have not set the + only useryes option on the share, is that you have not set the valid users list for the share. Note that only user works in conjunction with the users= list, so to get the behavior you require, add the line : - - users = %S - + +users%S + this is equivalent to: - - valid users = %S - - to the definition of the [homes] share, as recommended in + +valid users%S + + to the definition of the [homes] share, as recommended in the &smb.conf; man page. diff --git a/docs/docbook/projdoc/unicode.xml b/docs/docbook/projdoc/unicode.xml index d24ec4b5cd..28d6f76cdf 100644 --- a/docs/docbook/projdoc/unicode.xml +++ b/docs/docbook/projdoc/unicode.xml @@ -25,9 +25,8 @@ origin. Of all the effort that has been brought to bear on providing native language support -for all computer users, the efforts of the Openi18n organisation is deserving of -special mention. For more information about Openi18n please refer to: -http://www.openi18n.org/. +for all computer users, the efforts of the Openi18n organisation is deserving of +special mention. @@ -62,17 +61,16 @@ store one character). -A standardised multibyte charset is unicode, info is available at -www.unicode.org. -A big advantage of using a multibyte charset is that you only need one; no -need to make sure two computers use the same charset when they are + A standardised multibyte charset is unicode. +A big advantage of using a multibyte charset is that you only need one; there +is no need to make sure two computers use the same charset when they are communicating. -Old windows clients used to use single-byte charsets, named +Old windows clients use single-byte charsets, named 'codepages' by Microsoft. However, there is no support for negotiating the charset to be used in the smb protocol. Thus, you -have to make sure you are using the same charset when talking to an old client. +have to make sure you are using the same charset when talking to an older client. Newer clients (Windows NT, 2K, XP) talk unicode over the wire. @@ -87,23 +85,23 @@ samba knows of three kinds of character sets: - unix charset + unix charset This is the charset used internally by your operating system. - The default is ASCII, which is fine for most - systems. + The default is UTF-8, which is fine for most + systems. The default in previous samba releases was ASCII. - display charset + display charset This is the charset samba will use to print messages on your screen. It should generally be the same as the unix charset. - dos charset + dos charset This is the charset samba uses when communicating with DOS and Windows 9x clients. It will talk unicode to all newer clients. The default depends on the charsets you have installed on your system. @@ -122,14 +120,10 @@ samba knows of three kinds of character sets: characters in filenames are usually not correct in the unix charset but only for the local charset used by the DOS/Windows clients. -The following script from Steve Langasek converts all -filenames from CP850 to the iso8859-15 charset. - - -#find /path/to/share -type f -exec bash -c 'CP="{}"; ISO=`echo -n "$CP" | iconv -f cp850 \ - -t iso8859-15`; if [ "$CP" != "$ISO" ]; then mv "$CP" "$ISO"; fi' \; - +Bjoern Jacke has written a utility named convm that can convert whole directory + structures to different charsets with one single command. + @@ -140,29 +134,41 @@ points of attention when setting it up: -You should set mangling method = -hash + You should set mangling methodhash There are various iconv() implementations around and not all of them work equally well. glibc2's iconv() has a critical problem in CP932. libiconv-1.8 works with CP932 but still has some problems and does not work with EUC-JP. -You should set dos charset = CP932, not +You should set dos charsetCP932, not Shift_JIS, SJIS... -Currently only unix charset = CP932 +Currently only unix charsetCP932 will work (but still has some problems...) because of iconv() issues. -unix charset = EUC-JP doesn't work well because of +unix charsetEUC-JP doesn't work well because of iconv() issues. -Currently Samba 3.0 does not support unix charset -= UTF8-MAC/CAP/HEX/JIS* +Currently Samba 3.0 does not support unix charsetUTF8-MAC/CAP/HEX/JIS* -More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html. +More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html. + + + + + Common errors + + + CP850.so can't be found + + Samba is complaining about a missing CP850.so file. + + CP850 is the default dos charset. The dos charset is used to convert data to the codepage used by your dos clients. If you don't have any dos clients, you can safely ignore this message. + CP850 should be supported by your local iconv implementation. Make sure you have all the required packages installed. If you compiled samba from source, make sure configure found iconv. +     diff --git a/docs/docbook/projdoc/upgrading-to-3.0.xml b/docs/docbook/projdoc/upgrading-to-3.0.xml index b4c0732a65..74af0cbb9e 100644 --- a/docs/docbook/projdoc/upgrading-to-3.0.xml +++ b/docs/docbook/projdoc/upgrading-to-3.0.xml @@ -1,63 +1,571 @@ &author.jelmer; - 25 October 2002 + &author.jht; + &author.jerry; + June 30, 2003 Upgrading from Samba-2.x to Samba-3.0.0 + -Charsets +New Features in Samba-3 -You might experience problems with special characters -when communicating with old DOS clients. Codepage -support has changed in samba 3.0. Read the chapter -Unicode support for details. + +Major new features: - + + + Active Directory support. This release is able to join a ADS realm + as a member server and authenticate users using LDAP/kerberos. + - -Obsolete configuration options + + Unicode support. Samba will now negotiate UNICODE on the wire and + internally there is now a much better infrastructure for multi-byte + and UNICODE character sets. + + + + New authentication system. The internal authentication system has + been almost completely rewritten. Most of the changes are internal, + but the new auth system is also very configurable. + + + + New filename mangling system. The filename mangling system has been + completely rewritten. An internal database now stores mangling maps + persistently. This needs lots of testing. + + + + New "net" command. A new "net" command has been added. It is + somewhat similar to the "net" command in windows. Eventually we + plan to replace a bunch of other utilities (such as smbpasswd) + with subcommands in "net", at the moment only a few things are + implemented. + + + + Samba now negotiates NT-style status32 codes on the wire. This + improves error handling a lot. + + + + Better Windows 2000/XP/2003 printing support including publishing + printer attributes in active directory + + + + New loadable RPC modules + + + + New dual-daemon winbindd support (-B) for better performance + + + + Support for migrating from a Windows NT 4.0 domain to a Samba + domain and maintaining user, group and domain SIDs + + + + Support for establishing trust relationships with Windows NT 4.0 + domain controllers + + + Initial support for a distributed Winbind architecture using + an LDAP directory for storing SID to uid/gid mappings + + + + Major updates to the Samba documentation tree. + + -In 3.0, the following configuration options have been removed. +Plus lots of other improvements! - -printer driver (replaced by new driver procedures) -printer driver file (replaced by new driver procedures) -printer driver location (replaced by new driver procedures) -use rhosts -postscript -client code page (replaced by dos charset) -vfs path -vfs options - -Password Backend +Configuration Parameter Changes -Effective with the release of samba-3 it is now imperative that the password backend -be correctly defined in smb.conf. +This section contains a brief listing of changes to smb.conf options +in the 3.0.0 release. Please refer to the smb.conf(5) man page for +complete descriptions of new or modified parameters. - -Those migrating from samba-2.x with plaintext password support need the following: -passdb backend = guest. - + +Removed Parameters - -Those migrating from samba-2.x with encrypted password support should add to smb.conf -passdb backend = smbpasswd, guest. - +(order alphabetically): - -LDAP using Samba-2.x systems can continue to operate with the following entry -passdb backend = ldapsam_compat, guest. - + + admin log + alternate permissions + character set + client codepage + code page directory + coding system + domain admin group + domain guest group + force unknown acl user + nt smb support + post script + printer driver + printer driver file + printer driver location + status + total print jobs + use rhosts + valid chars + vfs options + + + + + +New Parameters + +(new parameters have been grouped by function): + +Remote management + + + abort shutdown script + shutdown script + + +User and Group Account Management + + + add group script + add machine script + add user to group script + algorithmic rid base + delete group script + delete user from group script + passdb backend + set primary group script + + +Authentication + + + auth methods + ads server + realm + + +Protocol Options + + + client lanman auth + client NTLMv2 auth + client schannel + client signing + client use spnego + disable netbios + ntlm auth + paranoid server security + server schannel + smb ports + use spnego + + +File Service + + + get quota command + hide special files + hide unwriteable files + hostname lookups + kernel change notify + mangle prefix + msdfs proxy + set quota command + use sendfile + vfs objects + + +Printing + + + max reported print jobs + + + +UNICODE and Character Sets + + + display charset + dos charset + unicode + unix charset + + +SID to uid/gid Mappings + + + idmap backend + idmap gid + idmap only + idmap uid + + +LDAP + + + ldap delete dn + ldap group suffix + ldap idmap suffix + ldap machine suffix + ldap passwd sync + ldap trust ids + ldap user suffix + + +General Configuration + + + preload modules + privatedir + + + + + +Modified Parameters (changes in behavior): + + + encrypt passwords (enabled by default) + mangling method (set to 'hash2' by default) + passwd chat + passwd program + restrict anonymous (integer value) + security (new 'ads' value) + strict locking (enabled by default) + winbind cache time (increased to 5 minutes) + winbind uid (deprecated in favor of 'idmap uid') + winbind gid (deprecated in favor of 'idmap gid') + + + + + + + +New Functionality + + + Databases + + + This section contains brief descriptions of any new databases + introduced in Samba 3.0. Please remember to backup your existing + ${lock directory}/*tdb before upgrading to Samba 3.0. Samba will + upgrade databases as they are opened (if necessary), but downgrading + from 3.0 to 2.2 is an unsupported path. + + + + TDB File Descriptions + + + + + + + Name + Description + Backup? + + + + + account_policy + User policy settings + yes + + + gencache + Generic caching db + no + + + group_mapping + Mapping table from Windows groups/SID to unix groups + yes + + + idmap + new ID map table from SIDS to UNIX uids/gids + yes + + + namecache + Name resolution cache entries + no + + + netlogon_unigrp + Cache of universal group membership obtained when operating + as a member of a Windows domain + no + + + printing/*.tdb + Cached output from 'lpq command' created on a per print + service basis + no + + + + registry + Read-only samba registry skeleton that provides support for + exporting various db tables via the winreg RPCs + no + + + +
    + +     + + + Changes in Behavior + + + The following issues are known changes in behavior between Samba 2.2 and + Samba 3.0 that may affect certain installations of Samba. + + + + + When operating as a member of a Windows domain, Samba 2.2 would + map any users authenticated by the remote DC to the 'guest account' + if a uid could not be obtained via the getpwnam() call. Samba 3.0 + rejects the connection as NT_STATUS_LOGON_FAILURE. There is no + current work around to re-establish the 2.2 behavior. + + + + When adding machines to a Samba 2.2 controlled domain, the + 'add user script' was used to create the UNIX identity of the + machine trust account. Samba 3.0 introduces a new 'add machine + script' that must be specified for this purpose. Samba 3.0 will + not fall back to using the 'add user script' in the absence of + an 'add machine script' + + + + + + + Charsets + + + You might experience problems with special characters when communicating with old DOS + clients. Codepage support has changed in samba 3.0. Read the chapter + Unicode support for details. + + + + + + Passdb Backends and Authentication + + + There have been a few new changes that Samba administrators should be + aware of when moving to Samba 3.0. + + + + + Encrypted passwords have been enabled by default in order to + inter-operate better with out-of-the-box Windows client + installations. This does mean that either (a) a samba account + must be created for each user, or (b) 'encrypt passwords = no' + must be explicitly defined in smb.conf. + + + + Inclusion of new securityads option for integration + with an Active Directory domain using the native Windows + Kerberos 5 and LDAP protocols. + + + + + Samba 3.0 also includes the possibility of setting up chains + of authentication methods + (auth methods) and account + storage backends + (passdb backend). + Please refer to the &smb.conf; + man page and the chapter about account information databases for details. While both parameters assume sane default + values, it is likely that you will need to understand what the + values actually mean in order to ensure Samba operates correctly. + + + + Certain functions of the smbpasswd(8) tool have been split between the + new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8) + utility. See the respective man pages for details. + + + + + + Charsets + + + You might experience problems with special characters when communicating with old DOS + clients. Codepage support has changed in samba 3.0. Read the chapter + Unicode support for details. + + + + + + LDAP + + + This section outlines the new features affecting Samba / LDAP integration. + + + + New Schema + + + A new object class (sambaSamAccount) has been introduced to replace + the old sambaAccount. This change aids us in the renaming of attributes + to prevent clashes with attributes from other vendors. There is a + conversion script (examples/LDAP/convertSambaAccount) to modify and LDIF + file to the new schema. + + + + Example: + + + &prompt;ldapsearch .... -b "ou=people,dc=..." > old.ldif + &prompt;convertSambaAccount <DOM SID> old.ldif new.ldif + + + + The <DOM SID> can be obtained by running 'net getlocalsid <DOMAINNAME> + on the Samba PDC as root. + + + + The old sambaAccount schema may still be used by specifying the + "ldapsam_compat" passdb backend. However, the sambaAccount and + associated attributes have been moved to the historical section of + the schema file and must be uncommented before use if needed. + The 2.2 object class declaration for a sambaAccount has not changed + in the 3.0 samba.schema file. + + + + Other new object classes and their uses include: + + + + + sambaDomain - domain information used to allocate rids + for users and groups as necessary. The attributes are added + in 'ldap suffix' directory entry automatically if + an idmap uid/gid range has been set and the 'ldapsam' + passdb backend has been selected. + + + + sambaGroupMapping - an object representing the + relationship between a posixGroup and a Windows + group/SID. These entries are stored in the 'ldap + group suffix' and managed by the 'net groupmap' command. + + + + sambaUnixIdPool - created in the 'ldap idmap suffix' entry + automatically and contains the next available 'idmap uid' and + 'idmap gid' + + + + sambaIdmapEntry - object storing a mapping between a + SID and a UNIX uid/gid. These objects are created by the + idmap_ldap module as needed. + + + + + + + New Suffix for Searching + + + The following new smb.conf parameters have been added to aid in directing + certain LDAP queries when 'passdb backend = ldapsam://...' has been + specified. + + + + ldap suffix - used to search for user and computer accounts + ldap user suffix - used to store user accounts + ldap machine suffix - used to store machine trust accounts + ldap group suffix - location of posixGroup/sambaGroupMapping entries + ldap idmap suffix - location of sambaIdmapEntry objects + + + + If an 'ldap suffix' is defined, it will be appended to all of the + remaining sub-suffix parameters. In this case, the order of the suffix + listings in smb.conf is important. Always place the 'ldap suffix' first + in the list. + + + + Due to a limitation in Samba's smb.conf parsing, you should not surround + the DN's with quotation marks. + + + + + + IdMap LDAP support + + + Samba 3.0 supports an ldap backend for the idmap subsystem. The + following options would inform Samba that the idmap table should be + stored on the directory server onterose in the "ou=idmap,dc=plainjoe, + dc=org" partition. + + + + [global] + ... + idmap backendldap:ldap://onterose/ + ldap idmap suffixou=idmap,dc=plainjoe,dc=org + idmap uid40000-50000 + idmap gid40000-50000 + + + + This configuration allows winbind installations on multiple servers to + share a uid/gid number space, thus avoiding the interoperability problems + with NFS that were present in Samba 2.2. + + + + +     diff --git a/docs/docbook/projdoc/winbind.xml b/docs/docbook/projdoc/winbind.xml index 524f05ffa2..001b2f16c1 100644 --- a/docs/docbook/projdoc/winbind.xml +++ b/docs/docbook/projdoc/winbind.xml @@ -6,7 +6,7 @@ TimPotter Samba Team -
    tpot@samba.org
    +
    tpot@linuxcare.com.au
     &author.tridge; @@ -15,29 +15,87 @@
    getnag@rediffmail.com
     + Notes for Solaris + + JohnTrostel + + SNAP +
    jtrostel@snapserver.com
    +     +     + &author.jelmer; &author.jht; 27 June 2002 -Integrated Logon Support using Winbind +Winbind: Use of Domain Accounts Features and Benefits - Integration of UNIX and Microsoft Windows NT through - a unified logon has been considered a "holy grail" in heterogeneous - computing environments for a long time. We present - winbind, a component of the Samba suite - of programs as a solution to the unified logon problem. Winbind - uses a UNIX implementation - of Microsoft RPC calls, Pluggable Authentication Modules, and the Name - Service Switch to allow Windows NT domain users to appear and operate - as UNIX users on a UNIX machine. This paper describes the winbind - system, explaining the functionality it provides, how it is configured, - and how it works internally. + + Integration of UNIX and Microsoft Windows NT through a unified logon has + been considered a "holy grail" in heterogeneous computing environments for + a long time. + + + + There is one other facility without which UNIX and Microsoft Windows network + interoperability would suffer greatly. It is imperative that there be a + mechanism for sharing files across UNIX systems and to be able to assign + domain user and group ownerships with integrity. + + + + winbind is a component of the Samba suite of programs + solves the unified logon problem. Winbind uses a UNIX implementation of Microsoft + RPC calls, Pluggable Authentication Modules, and the Name Service Switch to + allow Windows NT domain users to appear and operate as UNIX users on a UNIX + machine. This chapter describes the winbind system, explaining the functionality + it provides, how it is configured, and how it works internally. + + + + Winbind provides three separate functions: + + + + + Authentication of user credentials (via PAM) + + + + Identity resolution (via NSS)` + + + + Windindd maintains a database called winbind_idmap.tdb in which it stores + mappings between UNIX UIDs / GIDs and NT SIDs. This mapping is used only + for users and groups that do not have a local UID/GID. It stored the UID/GID + allocated from the idmap uid/gid range that it has mapped to the NT SID. + If idmap backend has been specified as ldapsam:url + then instead of using a local mapping winbindd will obtain this information + from the LDAP database. + + + + + If winbindd is not running, then smbd (which calls winbindd) will fall back to + using purely local information from /etc/passwd and /etc/group and no dynamic + mapping will be used. + + + + + @@ -219,7 +277,7 @@ the C library looks in /etc/nsswitch.conf for a line which matches the service type being requested, for example the "passwd" service type is used when user or group names - are looked up. This config line species which implementations + are looked up. This config line specifies which implementations of that service should be tried and in what order. If the passwd config line is: @@ -323,36 +381,17 @@ passwd: files example Installation and Configuration - -Many thanks to John Trostel jtrostel@snapserver.com -for providing the HOWTO for this section. - - - -This HOWTO describes how to get winbind services up and running -to control access and authenticate users on your Linux box using -the winbind services which come with SAMBA 3.0. - - Introduction This section describes the procedures used to get winbind up and -running on a RedHat 7.1 system. Winbind is capable of providing access +running. Winbind is capable of providing access and authentication control for Windows Domain users through an NT or Win2K PDC for 'regular' services, such as telnet a nd ftp, as well for SAMBA services. - -This HOWTO has been written from a 'RedHat-centric' perspective, so if -you are using another distribution, you may have to modify the instructions -somewhat to fit the way your distribution works. - - - @@ -421,10 +460,8 @@ on your system. For recent RedHat systems (7.1, for instance), that means pam-0.74-22. For best results, it is helpful to also install the development packages in pam-devel-0.74-22. - - Testing Things Out @@ -433,7 +470,7 @@ Before starting, it is probably best to kill off all the SAMBA related daemons running on your server. Kill off all &smbd;, &nmbd;, and &winbindd; processes that may be running. To use PAM, you will want to make sure that you have the -standard PAM package (for RedHat) which supplies the /etc/pam.d +standard PAM package which supplies the /etc/pam.d directory structure, including the pam modules are used by pam-aware services, several pam libraries, and the /usr/doc and /usr/man entries for pam. Winbind built better @@ -441,33 +478,6 @@ in SAMBA if the pam-devel package was also installed. This package includes the header files needed to compile pam-aware applications. - -Configure and compile SAMBA - - -The configuration and compilation of SAMBA is pretty straightforward. -The first three steps may not be necessary depending upon -whether or not you have previously built the Samba binaries. - - - -&rootprompt;autoconf -&rootprompt;make clean -&rootprompt;rm config.cache -&rootprompt;./configure -&rootprompt;make -&rootprompt;make install - - - - -This will, by default, install SAMBA in /usr/local/samba. -See the main SAMBA documentation if you want to install SAMBA somewhere else. -It will also build the winbindd executable and libraries. - - - - Configure <filename>nsswitch.conf</filename> and the winbind libraries on Linux and Solaris @@ -576,22 +586,23 @@ the winbindd include the following entries in the [global] section: - -[global] - <...> - # separate domain and username with '+', like DOMAIN+username - winbind separator = + - # use uids from 10000 to 20000 for domain users - idmap uid = 10000-20000 - # use gids from 10000 to 20000 for domain groups - idmap gid = 10000-20000 - # allow enumeration of winbind users and groups - winbind enum users = yes - winbind enum groups = yes - # give winbind users a real shell (only needed if they have telnet access) - template homedir = /home/winnt/%D/%U - template shell = /bin/bash - + + smb.conf for winbind set-up +[global] +... + separate domain and username with '+', like DOMAIN+username +winbind separator+ + use uids from 10000 to 20000 for domain users +idmap uid10000-20000 + use gids from 10000 to 20000 for domain groups +winbind gid10000-20000 + allow enumeration of winbind users and groups +winbind enum usersyes +winbind enum groupsyes + give winbind users a real shell (only needed if they have telnet access) +template homedir/home/winnt/%D/%U +template shell/bin/bash + @@ -608,7 +619,7 @@ a domain user who has administrative privileges in the domain. -&rootprompt;/usr/local/samba/bin/net join -S PDC -U Administrator +&rootprompt;/usr/local/samba/bin/net rpc join -S PDC -U Administrator @@ -688,8 +699,7 @@ your PDC. For example, I get the following response: -Obviously, I have named my domain 'CEO' and my winbind -separator is '+'. + Obviously, I have named my domain 'CEO' and my winbind separator is '+'. @@ -982,7 +992,7 @@ have individual directories for the domain users already present on the server, or change the home directory template to a general directory for all domain users. These can be easily set using the &smb.conf; global entry -template homedir. +template homedir. @@ -1025,7 +1035,7 @@ same way. It now looks like this: In this case, I added the auth sufficient /lib/security/pam_winbind.so lines as before, but also added the required pam_securetty.so above it, to disallow root logins over the network. I also added a -sufficient /lib/security/pam_unix.so use_first_pass +sufficient /lib/security/pam_unix.so use_first_pass line after the winbind.so line to get rid of annoying double prompts for passwords. @@ -1144,7 +1154,7 @@ configured in the pam.conf. Winbind is currently only available for - the Linux, Solaris and IRIX operating systems, although ports to other operating + the Linux, Solaris, AIX and IRIX operating systems, although ports to other operating systems are certainly possible. For such ports to be feasible, we require the C library of the target operating system to support the Name Service Switch and Pluggable Authentication @@ -1163,6 +1173,25 @@ configured in the pam.conf. that may be been set for Windows NT users, this is instead up to the PDC to enforce. + + + NSCD Problem Warning + + + + + Do NOT under ANY circumstances run nscd on any system + on which winbind is running. + + + + If nscd is running on the UNIX/Linux system, then + even though NSSWITCH is correctly configured it will NOT be possible to resolve + domain users and groups for file and directory controls. + + +     + diff --git a/docs/docbook/sambadoc.dtd b/docs/docbook/sambadoc.dtd new file mode 100644 index 0000000000..63776534ae --- /dev/null +++ b/docs/docbook/sambadoc.dtd @@ -0,0 +1,25 @@ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/docbook/smbdotconf/base/netbiosaliases.xml b/docs/docbook/smbdotconf/base/netbiosaliases.xml index a62fb8f7d6..ac8ffaf2b9 100644 --- a/docs/docbook/smbdotconf/base/netbiosaliases.xml +++ b/docs/docbook/smbdotconf/base/netbiosaliases.xml @@ -3,7 +3,7 @@ advanced="1" wizard="1" developer="1" xmlns:samba="http://samba.org/common"> - This is a list of NetBIOS names that nmbd(8) will + This is a list of NetBIOS names that nmbd will advertise as additional names by which the Samba server is known. This allows one machine to appear in browse lists under multiple names. If a machine is acting as a browse server or logon server none of these names will be advertised as either browse server or logon diff --git a/docs/docbook/smbdotconf/domain/machinepasswordtimeout.xml b/docs/docbook/smbdotconf/domain/machinepasswordtimeout.xml index 06017fce59..7caf3058c9 100644 --- a/docs/docbook/smbdotconf/domain/machinepasswordtimeout.xml +++ b/docs/docbook/smbdotconf/domain/machinepasswordtimeout.xml @@ -5,8 +5,8 @@ If a Samba server is a member of a Windows NT Domain (see the security = domain) - parameter) then periodically a running - smbd(8) process will try and change the MACHINE ACCOUNT + parameter) then periodically a running smbd + process will try and change the MACHINE ACCOUNT PASSWORD stored in the TDB called private/secrets.tdb . This parameter specifies how often this password will be changed, in seconds. The default is one week (expressed in diff --git a/docs/docbook/smbdotconf/filename/mangleprefix.xml b/docs/docbook/smbdotconf/filename/mangleprefix.xml index cbd41f973d..eff1f2b8fe 100644 --- a/docs/docbook/smbdotconf/filename/mangleprefix.xml +++ b/docs/docbook/smbdotconf/filename/mangleprefix.xml @@ -9,6 +9,10 @@ hash and therefore more name collisions. The minimum value is 1 and the maximum value is 6. + + mangle prefix is effective only when mangling method is hash2. + + Default: mangle prefix = 1 Example: mangle prefix = 4 diff --git a/docs/docbook/smbdotconf/filename/manglingchar.xml b/docs/docbook/smbdotconf/filename/manglingchar.xml index 57c4fa2acd..de5f620fd9 100644 --- a/docs/docbook/smbdotconf/filename/manglingchar.xml +++ b/docs/docbook/smbdotconf/filename/manglingchar.xml @@ -5,7 +5,7 @@ This controls what character is used as the magic character in name mangling. The default is a '~' but this may interfere with some software. Use this option to set - it to whatever you prefer. + it to whatever you prefer. This is effective only when mangling method is hash. Default: mangling char = ~ diff --git a/docs/docbook/smbdotconf/ldap/ldapgroupsuffix.xml b/docs/docbook/smbdotconf/ldap/ldapgroupsuffix.xml new file mode 100644 index 0000000000..5e6b9cc886 --- /dev/null +++ b/docs/docbook/smbdotconf/ldap/ldapgroupsuffix.xml @@ -0,0 +1,14 @@ + + + This parameters specifies the suffix that is + used for groups when these are added to the LDAP directory. + If this parameter is unset, the value of ldap suffix will be used instead. + + Default: none + + Example: dc=samba,ou=Groups + + diff --git a/docs/docbook/smbdotconf/ldap/ldapidmapsuffix.xml b/docs/docbook/smbdotconf/ldap/ldapidmapsuffix.xml new file mode 100644 index 0000000000..f826183c33 --- /dev/null +++ b/docs/docbook/smbdotconf/ldap/ldapidmapsuffix.xml @@ -0,0 +1,15 @@ + + + This parameters specifies the suffix that is + used when storing idmap mappings. If this parameter + is unset, the value of ldap suffix + will be used instead. + + Default: none + + Example: dc=samba,ou=Idmap + + diff --git a/docs/docbook/smbdotconf/ldap/ldapusersuffix.xml b/docs/docbook/smbdotconf/ldap/ldapusersuffix.xml index 731fba3420..93d450b5e4 100644 --- a/docs/docbook/smbdotconf/ldap/ldapusersuffix.xml +++ b/docs/docbook/smbdotconf/ldap/ldapusersuffix.xml @@ -3,7 +3,8 @@ advanced="1" developer="1" xmlns:samba="http://samba.org/common"> - It specifies where users are added to the tree. + This parameter specifies where users are added to the tree. + If this parameter is not specified, the value from ldap suffix. Default: none diff --git a/docs/docbook/smbdotconf/locking/lockspincount.xml b/docs/docbook/smbdotconf/locking/lockspincount.xml index d308f5d845..eb5862699a 100644 --- a/docs/docbook/smbdotconf/locking/lockspincount.xml +++ b/docs/docbook/smbdotconf/locking/lockspincount.xml @@ -12,6 +12,6 @@ and FoxPro. - Default: lock spin count = 2 + Default: lock spin count = 3 diff --git a/docs/docbook/smbdotconf/logon/adduserscript.xml b/docs/docbook/smbdotconf/logon/adduserscript.xml index 34d3e7ea58..42f7b04563 100644 --- a/docs/docbook/smbdotconf/logon/adduserscript.xml +++ b/docs/docbook/smbdotconf/logon/adduserscript.xml @@ -11,7 +11,7 @@ created for all users accessing files on this server. For sites that use Windows NT account databases as their primary user database creating these users and keeping the user list in sync with the - Windows NT PDC is an onerous task. This option allows smbd to create the required UNIX users + Windows NT PDC is an onerous task. This option allows smbd to create the required UNIX users ON DEMAND when a user accesses the Samba server. In order to use this option, smbd diff --git a/docs/docbook/smbdotconf/logon/logonscript.xml b/docs/docbook/smbdotconf/logon/logonscript.xml index 65b6253c0c..a1e8e0c03b 100644 --- a/docs/docbook/smbdotconf/logon/logonscript.xml +++ b/docs/docbook/smbdotconf/logon/logonscript.xml @@ -22,8 +22,8 @@ suggested command would be to add NET TIME \\SERVER /SET /YES, to force every machine to synchronize clocks with the same time server. Another use would be to add NET USE - U: \\SERVER\UTILS for commonly used utilities, or - NET USE Q: \\SERVER\ISO9001_QA for example. + U: \\SERVER\UTILS for commonly used utilities, or + NET USE Q: \\SERVER\ISO9001_QA for example. Note that it is particularly important not to allow write access to the [netlogon] share, or to grant users write permission diff --git a/docs/docbook/smbdotconf/logon/shutdownscript.xml b/docs/docbook/smbdotconf/logon/shutdownscript.xml index 0eaffea747..8935714307 100644 --- a/docs/docbook/smbdotconf/logon/shutdownscript.xml +++ b/docs/docbook/smbdotconf/logon/shutdownscript.xml @@ -38,7 +38,7 @@ Default: None. - Example: abort shutdown script = /usr/local/samba/sbin/shutdown %m %t %r %f + Example: shutdown script = /usr/local/samba/sbin/shutdown %m %t %r %f Shutdown script example: diff --git a/docs/docbook/smbdotconf/misc/kernelchangenotify.xml b/docs/docbook/smbdotconf/misc/kernelchangenotify.xml new file mode 100644 index 0000000000..c6dc215b94 --- /dev/null +++ b/docs/docbook/smbdotconf/misc/kernelchangenotify.xml @@ -0,0 +1,17 @@ + + + This parameter specifies whether Samba should ask the + kernel for change notifications in directories so that + SMB clients can refresh whenever the data on the server changes. + + + This parameter is only usd when your kernel supports + change notification to user programs, using the F_NOTIFY fcntl. + + + Default: Yes + + diff --git a/docs/docbook/smbdotconf/misc/remoteannounce.xml b/docs/docbook/smbdotconf/misc/remoteannounce.xml index 019cc306a7..d03ea8b0e2 100644 --- a/docs/docbook/smbdotconf/misc/remoteannounce.xml +++ b/docs/docbook/smbdotconf/misc/remoteannounce.xml @@ -27,8 +27,7 @@ addresses of the remote networks, but can also be the IP addresses of known browse masters if your network config is that stable. - See the documentation file BROWSING - in the docs/ directory. + See . Default: remote announce = <empty string> diff --git a/docs/docbook/smbdotconf/printing/os2drivermap.xml b/docs/docbook/smbdotconf/printing/os2drivermap.xml index 478031c7b9..ffaa58fe2a 100644 --- a/docs/docbook/smbdotconf/printing/os2drivermap.xml +++ b/docs/docbook/smbdotconf/printing/os2drivermap.xml @@ -14,9 +14,8 @@ LaserJet 5L. The need for the file is due to the printer driver namespace - problem described in the Samba - Printing HOWTO. For more details on OS/2 clients, please - refer to the OS2-Client-HOWTO containing in the Samba documentation. + problem described in . For more details on OS/2 clients, please + refer to . Default: os2 driver map = <empty string> diff --git a/docs/docbook/smbdotconf/protocol/clientusespnego.xml b/docs/docbook/smbdotconf/protocol/clientusespnego.xml index df25fbfb20..ce187a36fa 100644 --- a/docs/docbook/smbdotconf/protocol/clientusespnego.xml +++ b/docs/docbook/smbdotconf/protocol/clientusespnego.xml @@ -6,6 +6,9 @@ This variable controls controls whether samba clients will try to use Simple and Protected NEGOciation (as specified by rfc2478) with WindowsXP and Windows2000 servers to agree upon an authentication mechanism. + SPNEGO client support for SMB Signing is currently broken, so + you might want to turn this option off when operating with + Windows 2003 domain controllers in particular. Default: client use spnego = yes diff --git a/docs/docbook/smbdotconf/protocol/nameresolveorder.xml b/docs/docbook/smbdotconf/protocol/nameresolveorder.xml index 4e88495489..45bc98843f 100644 --- a/docs/docbook/smbdotconf/protocol/nameresolveorder.xml +++ b/docs/docbook/smbdotconf/protocol/nameresolveorder.xml @@ -18,7 +18,7 @@ lmhosts : Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has no name type attached to the NetBIOS name (see the lmhosts(5) for details) then + noescape="1" url="lmhosts.5.html">lmhosts(5) for details) then any name type matches for lookup. diff --git a/docs/docbook/smbdotconf/protocol/profileacls.xml b/docs/docbook/smbdotconf/protocol/profileacls.xml index 6f2b3ec510..505f371809 100644 --- a/docs/docbook/smbdotconf/protocol/profileacls.xml +++ b/docs/docbook/smbdotconf/protocol/profileacls.xml @@ -10,7 +10,10 @@ Windows XP clients. New versions of Windows 2000 or Windows XP service packs do security ACL checking on the owner and ability to write of the profile directory stored on a local workstation when copied from a Samba - share. When not in domain mode with winbindd then the security info copied + share. + + +When not in domain mode with winbindd then the security info copied onto the local workstation has no meaning to the logged in user (SID) on that workstation so the profile storing fails. Adding this parameter onto a share used for profile storage changes two things about the @@ -19,15 +22,17 @@ BUILTIN\\Users respectively (SIDs S-1-5-32-544, S-1-5-32-545). Secondly it adds an ACE entry of "Full Control" to the SID BUILTIN\\Users to every returned ACL. This will allow any Windows 2000 or XP workstation - user to access the profile. Note that if you have multiple users logging + user to access the profile. + + Note that if you have multiple users logging on to a workstation then in order to prevent them from being able to access each others profiles you must remove the "Bypass traverse checking" advanced user right. This will prevent access to other users profile directories as the top level profile directory (named after the user) is created by the workstation profile code and has an ACL restricting entry to the directory tree to the owning user. - - + + Default: profile acls = no diff --git a/docs/docbook/smbdotconf/protocol/unixextensions.xml b/docs/docbook/smbdotconf/protocol/unixextensions.xml index 2f68b9605e..e62ca1a2d4 100644 --- a/docs/docbook/smbdotconf/protocol/unixextensions.xml +++ b/docs/docbook/smbdotconf/protocol/unixextensions.xml @@ -10,6 +10,6 @@ These extensions require a similarly enabled client, and are of no current use to Windows clients. - Default: unix extensions = no + Default: unix extensions = yes diff --git a/docs/docbook/smbdotconf/security/allowtrusteddomains.xml b/docs/docbook/smbdotconf/security/allowtrusteddomains.xml index 63363d2607..8354f8b8da 100644 --- a/docs/docbook/smbdotconf/security/allowtrusteddomains.xml +++ b/docs/docbook/smbdotconf/security/allowtrusteddomains.xml @@ -7,7 +7,7 @@ security option is set to server or domain. If it is set to no, then attempts to connect to a resource from - a domain or workgroup other than the one which smbd is running + a domain or workgroup other than the one which smbd is running in will fail, even if that domain is trusted by the remote server doing the authentication. diff --git a/docs/docbook/smbdotconf/security/clientntlmv2auth.xml b/docs/docbook/smbdotconf/security/clientntlmv2auth.xml index 0bf196488b..611ebcd094 100644 --- a/docs/docbook/smbdotconf/security/clientntlmv2auth.xml +++ b/docs/docbook/smbdotconf/security/clientntlmv2auth.xml @@ -13,6 +13,12 @@ (including NT4 < SP4, Win9x and Samba 2.2) are not compatible with NTLMv2. + Similarly, if enabled, NTLMv1, client lanman auth and client plaintext auth + authentication will be disabled. This also disables share-level + authentication. + If disabled, an NTLM response (and possibly a LANMAN response) will be sent by the client, depending on the value of client lanman auth. diff --git a/docs/docbook/smbdotconf/security/clientplaintextauth.xml b/docs/docbook/smbdotconf/security/clientplaintextauth.xml new file mode 100644 index 0000000000..ac90ef9fe5 --- /dev/null +++ b/docs/docbook/smbdotconf/security/clientplaintextauth.xml @@ -0,0 +1,12 @@ + + + Specifies whether a client should send a plaintext + password if the server does not support encrypted passwords. + + Default: client plaintext auth = yes + + + diff --git a/docs/docbook/smbdotconf/security/clientschannel.xml b/docs/docbook/smbdotconf/security/clientschannel.xml new file mode 100644 index 0000000000..f3ad682517 --- /dev/null +++ b/docs/docbook/smbdotconf/security/clientschannel.xml @@ -0,0 +1,19 @@ + + + + This controls whether the client offers or even + demands the use of the netlogon schannel. + client schannel = no does not + offer the schannel, server schannel = + auto offers the schannel but does not + enforce it, and server schannel = + yes denies access if the server is not + able to speak netlogon schannel. + + Default: client schannel = auto + Example: client schannel = yes + + diff --git a/docs/docbook/smbdotconf/security/clientsigning.xml b/docs/docbook/smbdotconf/security/clientsigning.xml new file mode 100644 index 0000000000..e006dc71ab --- /dev/null +++ b/docs/docbook/smbdotconf/security/clientsigning.xml @@ -0,0 +1,19 @@ + + + + This controls whether the client offers or requires + the server it talks to to use SMB signing. Possible values + are auto, mandatory + and disabled. + + + When set to auto, SMB signing is offered, but not enforced. + When set to mandatory, SMB signing is required and if set + to disabled, SMB signing is not offered either. + + Default: client signing = auto + + diff --git a/docs/docbook/smbdotconf/security/passdbbackend.xml b/docs/docbook/smbdotconf/security/passdbbackend.xml index 1a3a83946a..8c64299dd4 100644 --- a/docs/docbook/smbdotconf/security/passdbbackend.xml +++ b/docs/docbook/smbdotconf/security/passdbbackend.xml @@ -55,22 +55,15 @@ details. - - guest - - Very simple backend that only provides one user: the guest user. - Only maps the NT guest user to the guest account. - Required in pretty much all situations. - - Default: passdb backend = smbpasswd - Example: passdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd guest + Example: passdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd - Example: passdb backend = ldapsam:ldaps://ldap.example.com guest + Example: passdb backend = ldapsam:ldaps://ldap.example.com - Example: passdb backend = mysql:my_plugin_args tdbsam:/etc/samba/private/passdb.tdb guest + Example: passdb backend = mysql:my_plugin_args tdbsam diff --git a/docs/docbook/smbdotconf/security/passwdprogram.xml b/docs/docbook/smbdotconf/security/passwdprogram.xml index dbcc261ce4..db02670158 100644 --- a/docs/docbook/smbdotconf/security/passwdprogram.xml +++ b/docs/docbook/smbdotconf/security/passwdprogram.xml @@ -17,9 +17,8 @@ Note that if the unix password sync parameter is set to yes then this program is called AS ROOT - before the SMB password in the - smbpasswd5 - file is changed. If this UNIX password change fails, then + before the SMB password in the smbpasswd + file is changed. If this UNIX password change fails, then smbd will fail to change the SMB password also (this is by design). diff --git a/docs/docbook/smbdotconf/security/preloadmodules.xml b/docs/docbook/smbdotconf/security/preloadmodules.xml index 7b4e57cff1..101d9606fa 100644 --- a/docs/docbook/smbdotconf/security/preloadmodules.xml +++ b/docs/docbook/smbdotconf/security/preloadmodules.xml @@ -7,9 +7,6 @@ be loaded into smbd before a client connects. This improves the speed of smbd when reacting to new connections somewhat. - It is recommended to only use this option on heavy-performance - servers. - Default: preload modules = Example: preload modules = /usr/lib/samba/passdb/mysql.so+++ diff --git a/docs/docbook/smbdotconf/security/serversigning.xml b/docs/docbook/smbdotconf/security/serversigning.xml new file mode 100644 index 0000000000..5108918d84 --- /dev/null +++ b/docs/docbook/smbdotconf/security/serversigning.xml @@ -0,0 +1,19 @@ + + + + This controls whether the server offers or requires + the client it talks to to use SMB signing. Possible values + are auto, mandatory + and disabled. + + + When set to auto, SMB signing is offered, but not enforced. + When set to mandatory, SMB signing is required and if set + to disabled, SMB signing is not offered either. + + Default: client signing = False + + diff --git a/docs/docbook/smbdotconf/tuning/deadtime.xml b/docs/docbook/smbdotconf/tuning/deadtime.xml index cbbf751862..938f354b9a 100644 --- a/docs/docbook/smbdotconf/tuning/deadtime.xml +++ b/docs/docbook/smbdotconf/tuning/deadtime.xml @@ -1,4 +1,4 @@ - diff --git a/docs/docbook/smbdotconf/vfs/aclcompatibility.xml b/docs/docbook/smbdotconf/vfs/aclcompatibility.xml new file mode 100644 index 0000000000..ca3f39512d --- /dev/null +++ b/docs/docbook/smbdotconf/vfs/aclcompatibility.xml @@ -0,0 +1,17 @@ + + + This parameter specifies what OS ACL semantics should + be compatible with. Possible values are winnt for Windows NT 4, + win2k for Windows 2000 and above and auto. + If you specify auto, the value for this parameter + will be based upon the version of the client. There should + be no reason to change this parameter from the default. + + Default: acl compatibility = Auto + + Example: acl compatibility = win2k + + diff --git a/docs/docbook/smbdotconf/vfs/getquotacommand.xml b/docs/docbook/smbdotconf/vfs/getquotacommand.xml new file mode 100644 index 0000000000..93c9089519 --- /dev/null +++ b/docs/docbook/smbdotconf/vfs/getquotacommand.xml @@ -0,0 +1,52 @@ + + + The get quota command should only be used + whenever there is no operating system API available from the OS that + samba can use. + + This parameter should specify the path to a script that + queries the quota information for the specified + user/group for the partition that + the specified directory is on. + + Such a script should take 3 arguments: + + + directory + type of query + uid of user or gid of group + + + The type of query can be one of : + + + 1 - user quotas + 2 - user default quotas (uid = -1) + 3 - group quotas + 4 - group default quotas (gid = -1) + + + This script should print its output according to the following format: + + + Line 1 - quota flags (0 = no quotas, 1 = quotas enabled, 2 = quotas enabled and enforced) + Line 2 - number of currently used blocks + Line 3 - the softlimit number of blocks + Line 4 - the hardlimit number of blocks + Line 5 - currently used number of inodes + Line 6 - the softlimit number of inodes + Line 7 - the hardlimit number of inodes + Line 8(optional) - the number of bytes in a block(default is 1024) + + + See also the set quota command parameter. + + + Default: get quota command = + + Example: get quota command = /usr/local/sbin/query_quota + + diff --git a/docs/docbook/smbdotconf/vfs/hostmsdfs.xml b/docs/docbook/smbdotconf/vfs/hostmsdfs.xml index c843969e50..d2b64cc68f 100644 --- a/docs/docbook/smbdotconf/vfs/hostmsdfs.xml +++ b/docs/docbook/smbdotconf/vfs/hostmsdfs.xml @@ -3,16 +3,14 @@ advanced="1" developer="1" xmlns:samba="http://samba.org/common"> - This boolean parameter is only available - if Samba has been configured and compiled with the - --with-msdfs option. If set to yes, - Samba will act as a Dfs server, and allow Dfs-aware clients - to browse Dfs trees hosted on the server. + If set to yes, Samba will act as a Dfs + server, and allow Dfs-aware clients to browse Dfs trees hosted + on the server. See also the msdfs root share level parameter. For more information on setting up a Dfs tree on Samba, - refer to msdfs_setup.html. + refer to . Default: host msdfs = no diff --git a/docs/docbook/smbdotconf/vfs/msdfsroot.xml b/docs/docbook/smbdotconf/vfs/msdfsroot.xml index 35142ff037..059ffff9a0 100644 --- a/docs/docbook/smbdotconf/vfs/msdfsroot.xml +++ b/docs/docbook/smbdotconf/vfs/msdfsroot.xml @@ -2,16 +2,14 @@ context="S" xmlns:samba="http://samba.org/common"> - This boolean parameter is only available if - Samba is configured and compiled with the - --with-msdfs option. If set to yes, - Samba treats the share as a Dfs root and allows clients to browse - the distributed file system tree rooted at the share directory. - Dfs links are specified in the share directory by symbolic - links of the form msdfs:serverA\\shareA,serverB\\shareB - and so on. For more information on setting up a Dfs tree - on Samba, refer to "Hosting a Microsoft - Distributed File System tree on Samba" document. + If set to yes, Samba treats the + share as a Dfs root and allows clients to browse the + distributed file system tree rooted at the share directory. + Dfs links are specified in the share directory by symbolic + links of the form msdfs:serverA\\shareA,serverB\\shareB + and so on. For more information on setting up a Dfs tree on + Samba, refer to . See also host msdfs diff --git a/docs/docbook/smbdotconf/vfs/setquotacommand.xml b/docs/docbook/smbdotconf/vfs/setquotacommand.xml new file mode 100644 index 0000000000..b4b7303a0d --- /dev/null +++ b/docs/docbook/smbdotconf/vfs/setquotacommand.xml @@ -0,0 +1,42 @@ + + + The set quota command should only be used + whenever there is no operating system API available from the OS that + samba can use. + + This parameter should specify the path to a script that + can set quota for the specified arguments. + + The specified script should take the following arguments: + + + 1 - quota type + + 1 - user quotas + 2 - user default quotas (uid = -1) + 3 - group quotas + 4 - group default quotas (gid = -1) + + + 2 - id (uid for user, gid for group, -1 if N/A) + 3 - quota state (0 = disable, 1 = enable, 2 = enable and enforce) + 4 - block softlimit + 5 - block hardlimit + 6 - inode softlimit + 7 - inode hardlimit + 8(optional) - block size, defaults to 1024 + + + The script should output at least one line of data. + + See also the get quota command parameter. + + + Default: set quota command = + + Example: set quota command = /usr/local/sbin/set_quota + + diff --git a/docs/docbook/smbdotconf/winbind/idmapbackend.xml b/docs/docbook/smbdotconf/winbind/idmapbackend.xml new file mode 100644 index 0000000000..bc725b589f --- /dev/null +++ b/docs/docbook/smbdotconf/winbind/idmapbackend.xml @@ -0,0 +1,18 @@ + + + + The purpose of the idmap backend parameter is to allow idmap to NOT use the local idmap + tdb file to obtain SID to UID / GID mappings, but instead to obtain them from a common + LDAP backend. This way all domain members and controllers will have the same UID and GID + to SID mappings. This avoids the risk of UID / GID inconsistencies across UNIX / Linux + systems that are sharing information over protocols other than SMB/CIFS (ie: NFS). + + + Default: idmap backend = <empty string> + + Example: idmap backend = ldap:ldap://ldapslave.example.com + + diff --git a/docs/docbook/smbdotconf/winbind/winbindcachetime.xml b/docs/docbook/smbdotconf/winbind/winbindcachetime.xml index 3080adc7c8..cd063f8daa 100644 --- a/docs/docbook/smbdotconf/winbind/winbindcachetime.xml +++ b/docs/docbook/smbdotconf/winbind/winbindcachetime.xml @@ -9,6 +9,6 @@ user and group information before querying a Windows NT server again. - Default: winbind cache type = 15 + Default: winbind cache type = 300 diff --git a/docs/docbook/smbdotconf/wins/winsserver.xml b/docs/docbook/smbdotconf/wins/winsserver.xml index 12ee635acd..577a130ff1 100644 --- a/docs/docbook/smbdotconf/wins/winsserver.xml +++ b/docs/docbook/smbdotconf/wins/winsserver.xml @@ -21,7 +21,7 @@ to a WINS server if you have multiple subnets and wish cross-subnet browsing to work correctly. - See the documentation file Browsing in the samba howto collection. + See the . Default: not enabled diff --git a/docs/docbook/xslt/expand-sambadoc.xsl b/docs/docbook/xslt/expand-sambadoc.xsl new file mode 100644 index 0000000000..2749fdf3e9 --- /dev/null +++ b/docs/docbook/xslt/expand-sambadoc.xsl @@ -0,0 +1,304 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +<!DOCTYPE PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" + "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [ + + <!ENTITY % globalentities SYSTEM 'global.ent'> %globalentities; + ]> + + + + + + + + + + + + + + + + + + + + + + + = + + + + + + + + + + # + + + + + + + + + + + + + + + + + + + + + + + + + + + + none + + + + + + + = + + + + + + + + + + + + + + + + + + Warning: smbconfexample does not have title! + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + # + + + + + + + + + + + + + + + + + + + + + + latex + + + projdoc/imagefiles/ + + + + + + + + 50 + + + + 1 + + + + + + projdoc/imagefiles/.png + 50 + 1 + + + + + + + + + + + + + + + + + + + + + ( + + ) + + + + + + + + + + + + + + + + + + + preferred + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/docbook/xslt/generate-attributions.xsl b/docs/docbook/xslt/generate-attributions.xsl index c781a77cc4..29683b1921 100644 --- a/docs/docbook/xslt/generate-attributions.xsl +++ b/docs/docbook/xslt/generate-attributions.xsl @@ -12,38 +12,39 @@ - - - - - - - - - - - - - - + + + + + + - + - - + + - + + + + + + + < + + 1 + mailto: @@ -62,6 +63,8 @@ + + diff --git a/docs/docbook/xslt/html-common.xsl b/docs/docbook/xslt/html-common.xsl index ecb8a08662..dce900ef67 100644 --- a/docs/docbook/xslt/html-common.xsl +++ b/docs/docbook/xslt/html-common.xsl @@ -19,4 +19,7 @@ ..html + + + diff --git a/docs/docbook/xslt/latex.xsl b/docs/docbook/xslt/latex.xsl index 8fafd5d140..406a64b646 100644 --- a/docs/docbook/xslt/latex.xsl +++ b/docs/docbook/xslt/latex.xsl @@ -1,18 +1,21 @@ - - - + -xslt/latex/sambadoc -english,final,titlepage,parskip +en +sambadoc +english,final,titlepage,parskip,,pt +1 hyperfigures,hyperindex,citecolor=blue,urlcolor=blue default xslt/figures 1 1 + +{\bfseries } + english 1 @@ -31,5 +34,9 @@ + +{\bfseries } + + diff --git a/docs/docbook/xslt/latex/sambadoc.cls b/docs/docbook/xslt/latex/sambadoc.cls index 9f3caa5482..fcea11992f 100644 --- a/docs/docbook/xslt/latex/sambadoc.cls +++ b/docs/docbook/xslt/latex/sambadoc.cls @@ -2,7 +2,7 @@ %%-- RC Thesis %%--------------------------------------------------- \NeedsTeXFormat{LaTeX2e} -\ProvidesClass{xslt/latex/sambadoc} +\ProvidesClass{sambadoc} %%--------------------------------------------------- %%-- Load the base class and modify current macros. diff --git a/docs/faq/FAQ-ClientApp.html b/docs/faq/FAQ-ClientApp.html index 6e37fbcba5..6ba4b1d36c 100644 --- a/docs/faq/FAQ-ClientApp.html +++ b/docs/faq/FAQ-ClientApp.html @@ -1,4 +1,4 @@ -Chapter 3. Specific client application problems
    Chapter 3. Specific client application problems
    Prev   Next
    Prev Up Next
    Chapter 2. Compiling and installing Samba on a Unix host Home Chapter 4. Common errors
    diff --git a/docs/faq/FAQ-Install.html b/docs/faq/FAQ-Install.html index 0bb21ed543..c331922fdb 100644 --- a/docs/faq/FAQ-Install.html +++ b/docs/faq/FAQ-Install.html @@ -1,4 +1,4 @@ -Chapter 2. Compiling and installing Samba on a Unix host
    Chapter 2. Compiling and installing Samba on a Unix host
    Prev   Next

    Chapter 3. Specific client application problems

    Table of Contents

    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"
    How to use a Samba share as an administrative share for MS Office, etc.
    Microsoft Access database opening errors

    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"

    +Chapter 3. Specific client application problems

    Chapter 3. Specific client application problems
    Prev   Next

    Chapter 3. Specific client application problems

    Table of Contents

    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"
    How to use a Samba share as an administrative share for MS Office, etc.
    Microsoft Access database opening errors

    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"

    When installing MS Office on a Samba drive for which you have admin user permissions, ie. admin users = username, you will find the setup program unable to complete the installation. @@ -8,9 +8,9 @@ permissions The problem is that MS Office Setup checks that a file is rdonly by trying to open it for writing.

    Admin users can always open a file for writing, as they run as root. -You just have to install as a non-admin user and then use "chown -R" +You just have to install as a non-admin user and then use "chown -R" to fix the owner. -

    How to use a Samba share as an administrative share for MS Office, etc.

    +

    How to use a Samba share as an administrative share for MS Office, etc.

    Microsoft Office products can be installed as an administrative installation from which the application can either be run off the administratively installed product that resides on a shared resource, or from which that product can be @@ -36,7 +36,7 @@ set the following parameters on the share containing it: [MSOP95] path = /where_you_put_it comment = Your comment - volume = "The_CD_ROM_Label" + volume = "The_CD_ROM_Label" read only = yes available = yes share modes = no @@ -44,8 +44,8 @@ set the following parameters on the share containing it: browseable = yes public = yes

  • Now you are ready to run the setup program from the Microsoft Windows -workstation as follows: \\"Server_Name"\MSOP95\msoffice\setup -

    • Microsoft Access database opening errors

    +workstation as follows: \\"Server_Name"\MSOP95\msoffice\setup +

    Microsoft Access database opening errors

    Here are some notes on running MS-Access on a Samba drive from Stefan Kjellberg

    Opening a database in 'exclusive' mode does NOT work. Samba ignores r/w/share modes on file open.
    Make sure that you open the database as 'shared' and to 'lock modified records'
    Of course locking must be enabled for the particular share (smb.conf)

    Chapter 2. Compiling and installing Samba on a Unix host

    Table of Contents

    My client reports "cannot locate specified share name" or similar
    Why are my file's timestamps off by an hour, or by a few hours?

    My client reports "cannot locate specified share name" or similar

    +Chapter 2. Compiling and installing Samba on a Unix host

    Chapter 2. Compiling and installing Samba on a Unix host
    Prev   Next

    Chapter 2. Compiling and installing Samba on a Unix host

    Table of Contents

    My client reports "cannot locate specified share name" or similar
    Why are my file's timestamps off by an hour, or by a few hours?

    My client reports "cannot locate specified share name" or similar

    This message indicates that your client CAN locate the specified server, which is a good start, but that it cannot find a service of the name you gave. @@ -7,7 +7,7 @@ The first step is to check the exact name of the service you are trying to connect to (consult your system administrator). Assuming it exists and you specified it correctly (read your client's docs on how to specify a service name correctly), read on: -

    Many clients cannot accept or use service names longer than eight characters.
    Many clients cannot accept or use service names containing spaces.
    Some servers (not Samba though) are case sensitive with service names.
    Some clients force service names into upper case.

    Why are my file's timestamps off by an hour, or by a few hours?

    +

    Many clients cannot accept or use service names longer than eight characters.
    Many clients cannot accept or use service names containing spaces.
    Some servers (not Samba though) are case sensitive with service names.
    Some clients force service names into upper case.

    Why are my file's timestamps off by an hour, or by a few hours?

    This is from Paul Eggert eggert@twinsun.com.

    Most likely it's a problem with your time zone settings. @@ -19,7 +19,7 @@ namely, the number of seconds since 1970-01-01 00:00:00 Universal Time On the server side, Samba uses the Unix TZ variable to convert internal timestamps to and from local time. So on the server side, there are two things to get right. -

    The Unix system clock must have the correct Universal time. Use the shell command "sh -c 'TZ=UTC0 date'" to check this.
    The TZ environment variable must be set on the server before Samba is invoked. The details of this depend on the server OS, but typically you must edit a file whose name is /etc/TIMEZONE or /etc/default/init, or run the command `zic -l'.

    +

    The Unix system clock must have the correct Universal time. Use the shell command "sh -c 'TZ=UTC0 date'" to check this.
    The TZ environment variable must be set on the server before Samba is invoked. The details of this depend on the server OS, but typically you must edit a file whose name is /etc/TIMEZONE or /etc/default/init, or run the command `zic -l'.

    TZ must have the correct value.

    If possible, use geographical time zone settings (e.g. TZ='America/Los_Angeles' or perhaps diff --git a/docs/faq/FAQ-errors.html b/docs/faq/FAQ-errors.html index f0c4b9aa0c..45314a811c 100644 --- a/docs/faq/FAQ-errors.html +++ b/docs/faq/FAQ-errors.html @@ -1,20 +1,20 @@ -Chapter 4. Common errors

    Chapter 4. Common errors
    Prev   Next

    Chapter 4. Common errors

    Table of Contents

    Not listening for calling name
    System Error 1240
    smbclient ignores -N !
    The data on the CD-Drive I've shared seems to be corrupted!

    Not listening for calling name

    +Chapter 4. Common errors

    Chapter 4. Common errors
    Prev   Next

    Chapter 4. Common errors

    Table of Contents

    Not listening for calling name
    System Error 1240
    smbclient ignores -N !
    The data on the CD-Drive I've shared seems to be corrupted!

    Not listening for calling name

     Session request failed (131,129) with myname=HOBBES destname=CALVIN
 Not listening for calling name

    If you get this when talking to a Samba box then it means that your -global "hosts allow" or "hosts deny" settings are causing the Samba +global "hosts allow" or "hosts deny" settings are causing the Samba server to refuse the connection.

    -Look carefully at your "hosts allow" and "hosts deny" lines in the +Look carefully at your "hosts allow" and "hosts deny" lines in the global section of smb.conf.

    It can also be a problem with reverse DNS lookups not functioning correctly, leading to the remote host identity not being able to be confirmed, but that is less likely. -

    System Error 1240

    +

    System Error 1240

    System error 1240 means that the client is refusing to talk to a non-encrypting server. Microsoft changed WinNT in service pack 3 to refuse to connect to servers that do not support @@ -22,13 +22,13 @@ SMB password encryption.

    There are two main solutions:

    enable SMB password encryption in Samba. See the encryption part of the samba HOWTO Collection
    disable this behaviour in NT. See the section about -Windows NT in the chapter "Portability" of the samba HOWTO collection +Windows NT in the chapter "Portability" of the samba HOWTO collection

    -

    smbclient ignores -N !

    +

    smbclient ignores -N !

    “When getting the list of shares available on a host using the command smbclient -N -L the program always prompts for the password if the server is a Samba server. -It also ignores the "-N" argument when querying some (but not all) of our +It also ignores the "-N" argument when querying some (but not all) of our NT servers. ”

    @@ -42,7 +42,7 @@ This will set both the username and password to null, which is an anonymous login for SMB. Using -N would only set the password to null, and this is not accepted as an anonymous login for most SMB servers. -

    The data on the CD-Drive I've shared seems to be corrupted!

    +

    The data on the CD-Drive I've shared seems to be corrupted!

    Some OSes (notably Linux) default to auto detection of file type on cdroms and do cr/lf translation. This is a very bad idea when use with Samba. It causes all sorts of stuff ups. diff --git a/docs/faq/FAQ-features.html b/docs/faq/FAQ-features.html index 75faf8d9bc..5d20ba6fa0 100644 --- a/docs/faq/FAQ-features.html +++ b/docs/faq/FAQ-features.html @@ -1,7 +1,7 @@ -Chapter 5. Features

    Chapter 5. Features
    Prev   

    Chapter 5. Features

    Table of Contents

    How can I use samba as a fax server?
    Tools for printing faxes
    Making the fax-server
    Installing the client drivers
    Example smb.conf
    Samba doesn't work well together with DHCP!
    How can I assign NetBIOS names to clients with DHCP?
    How do I convert between unix and dos text formats?
    Does samba have wins replication support?

    How can I use samba as a fax server?

    Contributor: Gerhard Zuber

    Requirements: +Chapter 5. Features

    Chapter 5. Features
    Prev   

    Chapter 5. Features

    Table of Contents

    How can I use samba as a fax server?
    Tools for printing faxes
    Making the fax-server
    Installing the client drivers
    Example smb.conf
    Samba doesn't work well together with DHCP!
    How can I assign NetBIOS names to clients with DHCP?
    How do I convert between unix and dos text formats?
    Does samba have wins replication support?

    How can I use samba as a fax server?

    Contributor: Gerhard Zuber

    Requirements:

    UNIX box (Linux preferred) with SAMBA and a faxmodem
    ghostscript package
    mgetty+sendfax package
    pbm package (portable bitmap tools)

    First, install and configure the required packages. Be sure to read the mgetty+sendfax -manual carefully.

    Tools for printing faxes

    Your incomed faxes are in: +manual carefully.

    Tools for printing faxes

    Your incomed faxes are in: /var/spool/fax/incoming. Print it with:

     for i in *
 do
@@ -15,12 +15,12 @@ for printing to HP lasers.
 If you want to produce files for displaying and printing with Windows, use
 some tools from the pbm-package like the following command: g3cat $i | g3topbm - |  ppmtopcx - >$i.pcx
 and view it with your favourite Windows tool (maybe paintbrush)
-

    Making the fax-server

    fetch the file mgetty+sendfax/frontends/winword/faxfilter and place it in /usr/local/etc/mgetty+sendfax/(replace /usr/local/ with whatever place you installed mgetty+sendfax)

    prepare your faxspool file as mentioned in this file +

    Making the fax-server

    fetch the file mgetty+sendfax/frontends/winword/faxfilter and place it in /usr/local/etc/mgetty+sendfax/(replace /usr/local/ with whatever place you installed mgetty+sendfax)

    prepare your faxspool file as mentioned in this file edit fax/faxspool.in and reinstall or change the final /usr/local/bin/faxspool too. 

    -if [ "$user" = "root" -o "$user" = "fax" -o \
-     "$user" = "lp" -o "$user" = "daemon" -o "$user" = "bin" ]
+if [ "$user" = "root" -o "$user" = "fax" -o \
+     "$user" = "lp" -o "$user" = "daemon" -o "$user" = "bin" ]

    find the first line and change it to the second.

    make sure you have pbmtext (from the pbm-package). This is needed for creating the small header line on each page. @@ -33,8 +33,8 @@ lp3|fax:\ :sd=/usr/spool/lp3:\ :if=/usr/local/etc/mgetty+sendfax/faxfilter:sh:sf:mx#0:\ :lf=/usr/spool/lp3/fax-log: -

    Now, edit your smb.conf so you have a smb based printer named "fax"

    Installing the client drivers

    -Now you have a printer called "fax" which can be used via +

    Now, edit your smb.conf so you have a smb based printer named "fax"

    Installing the client drivers

    +Now you have a printer called "fax" which can be used via TCP/IP-printing (lpd-system) or via SAMBA (windows printing).

    On every system you are able to produce postscript-files you @@ -44,7 +44,7 @@ On Windows 3.1 95 and NT:

    Install a printer wich produces postscript output, e.g. apple laserwriter -

    Connect the "fax" to your printer.

    +

    Connect the "fax" to your printer.

    Now write your first fax. Use your favourite wordprocessor, write, winword, notepad or whatever you want, and start with the headerpage. @@ -72,7 +72,7 @@ uses the found number as the fax-destination-number. Now print your fax through the fax-printer and it will be queued for later transmission. Use faxrunq for sending the queue out. -

    Example smb.conf

    +

    Example smb.conf

     [global]
  printcap name = /etc/printcap
  print command = /usr/bin/lpr -r -P %p %s
@@ -88,7 +88,7 @@ queue out.
     create mode = 0700
     browseable = yes
     guest ok = no
-

    Samba doesn't work well together with DHCP!

    +

    Samba doesn't work well together with DHCP!

    We wish to help those folks who wish to use the ISC DHCP Server and provide sample configuration settings. Most operating systems today come ship with the ISC DHCP Server. ISC DHCP is available from: @@ -141,14 +141,14 @@ applied to the resulting DHCP offered settings UNLESS the DHCP server also sets a NetBIOS Scope. It may therefore be prudent to forcibly apply a NULL NetBIOS Scope from your DHCP server. The can be done in the dhcpd.conf file with the parameter: -option netbios-scope ""; +option netbios-scope "";

    While it is true that the Microsoft DHCP server that comes with Windows NT Server provides only a sub-set of rfc1533 functionality this is hardly an issue in those sites that already have a large investment and commitment to Unix systems and technologies. The current state of the art of the DHCP Server specification in covered in rfc2132. -

    How can I assign NetBIOS names to clients with DHCP?

    +

    How can I assign NetBIOS names to clients with DHCP?

    SMB network clients need to be configured so that all standard TCP/IP name to address resolution works correctly. Once this has been achieved the SMB environment provides additional tools and services that act as helper agents in @@ -163,13 +163,13 @@ This can be done, but needs a few NT registry hacks and you need to be able to speak UNICODE, which is of course no problem for a True Wizzard(tm) :) Instructions on how to do this (including a small util for less capable Wizzards) can be found at -

    http://www.unixtools.org/~nneul/sw/nt/dhcp-netbios-hostname.html

    How do I convert between unix and dos text formats?

    +

    http://www.unixtools.org/~nneul/sw/nt/dhcp-netbios-hostname.html

    How do I convert between unix and dos text formats?

    Jim barry has written an excellent drag-and-drop cr/lf converter for windows. Just drag your file onto the icon and it converts the file.

    The utilities unix2dos and dos2unix(in the mtools package) should do the job under unix. -

    Does samba have wins replication support?

    +

    Does samba have wins replication support?

    At the time of writing there is currently being worked on a wins replication implementation(wrepld).

    Prev Up 
    Chapter 4. Common errors Home 
    diff --git a/docs/faq/FAQ-general.html b/docs/faq/FAQ-general.html index 4019fb52c6..98b94c3011 100644 --- a/docs/faq/FAQ-general.html +++ b/docs/faq/FAQ-general.html @@ -1,6 +1,6 @@ -Chapter 1. General Information
    Chapter 1. General Information
    Prev   Next

    Chapter 1. General Information

    Table of Contents

    What do the version numbers mean?
    What platforms are supported?
    How do I subscribe to the Samba Mailing Lists?

    What do the version numbers mean?

    +Chapter 1. General Information

    Chapter 1. General Information
    Prev   Next

    Chapter 1. General Information

    Table of Contents

    What do the version numbers mean?
    What platforms are supported?
    How do I subscribe to the Samba Mailing Lists?

    What do the version numbers mean?

    It is not recommended that you run a version of Samba with the word -"alpha" in its name unless you know what you are doing and are willing +"alpha" in its name unless you know what you are doing and are willing to do some debugging. Many, many people just get the latest recommended stable release version and are happy. If you are brave, by all means take the plunge and help with the testing and development - @@ -15,10 +15,10 @@ number will not appear immediately and people should continue to use 1.9.15 for production systems (see next point.)Just after major changes are made the software is considered unstable, and a series of alpha releases are distributed, for example 1.9.16alpha1. These are for testing by those who know what they are -doing. The "alpha" in the filename will hopefully scare off those who +doing. The "alpha" in the filename will hopefully scare off those who are just looking for the latest version to install.When the release manager, currently Jerry, thinks that the alphas have stabilised to the point where he would recommend new users install it, he renames it to the -same version number without the alpha, for example 1.9.16.Inevitably bugs are found in the "stable" releases and minor patch +same version number without the alpha, for example 1.9.16.Inevitably bugs are found in the "stable" releases and minor patch levels are released which give us the pXX series, for example 1.9.16p2.

    So the progression goes: @@ -37,11 +37,11 @@ The above system means that whenever someone looks at the samba ftp site they will be able to grab the highest numbered release without an alpha in the name and be sure of getting the current recommended version. -

    What platforms are supported?

    +

    What platforms are supported?

    Many different platforms have run Samba successfully. The platforms most widely used and thus best tested are Linux and SunOS.

    At time of writing, there is support (or has been support for in earlier versions): -

    A/UX 3.0
    AIX
    Altos Series 386/1000
    Amiga
    Apollo Domain/OS sr10.3
    BSDI
    B.O.S. (Bull Operating System)
    Cray, Unicos 8.0
    Convex
    DGUX.
    DNIX.
    FreeBSD
    HP-UX
    Intergraph.
    Linux with/without shadow passwords and quota
    LYNX 2.3.0
    MachTen (a unix like system for Macintoshes)
    Motorola 88xxx/9xx range of machines
    NetBSD
    NEXTSTEP Release 2.X, 3.0 and greater (including OPENSTEP for Mach).
    OS/2 using EMX 0.9b
    OSF1
    QNX 4.22
    RiscIX.
    RISCOs 5.0B
    SEQUENT.
    SCO (including: 3.2v2, European dist., OpenServer 5)
    SGI.
    SMP_DC.OSx v1.1-94c079 on Pyramid S series
    SONY NEWS, NEWS-OS (4.2.x and 6.1.x)
    SUNOS 4
    SUNOS 5.2, 5.3, and 5.4 (Solaris 2.2, 2.3, and '2.4 and later')
    Sunsoft ISC SVR3V4
    SVR4
    System V with some berkely extensions (Motorola 88k R32V3.2).
    ULTRIX.
    UNIXWARE
    UXP/DS

    How do I subscribe to the Samba Mailing Lists?

    +

    A/UX 3.0
    AIX
    Altos Series 386/1000
    Amiga
    Apollo Domain/OS sr10.3
    BSDI
    B.O.S. (Bull Operating System)
    Cray, Unicos 8.0
    Convex
    DGUX.
    DNIX.
    FreeBSD
    HP-UX
    Intergraph.
    Linux with/without shadow passwords and quota
    LYNX 2.3.0
    MachTen (a unix like system for Macintoshes)
    Motorola 88xxx/9xx range of machines
    NetBSD
    NEXTSTEP Release 2.X, 3.0 and greater (including OPENSTEP for Mach).
    OS/2 using EMX 0.9b
    OSF1
    QNX 4.22
    RiscIX.
    RISCOs 5.0B
    SEQUENT.
    SCO (including: 3.2v2, European dist., OpenServer 5)
    SGI.
    SMP_DC.OSx v1.1-94c079 on Pyramid S series
    SONY NEWS, NEWS-OS (4.2.x and 6.1.x)
    SUNOS 4
    SUNOS 5.2, 5.3, and 5.4 (Solaris 2.2, 2.3, and '2.4 and later')
    Sunsoft ISC SVR3V4
    SVR4
    System V with some berkely extensions (Motorola 88k R32V3.2).
    ULTRIX.
    UNIXWARE
    UXP/DS

    How do I subscribe to the Samba Mailing Lists?

    Look at the samba mailing list page

    Prev Up Next
    Samba FAQ Home Chapter 2. Compiling and installing Samba on a Unix host
    diff --git a/docs/faq/samba-faq.html b/docs/faq/samba-faq.html index 368b4b6e41..832577fb64 100644 --- a/docs/faq/samba-faq.html +++ b/docs/faq/samba-faq.html @@ -1,4 +1,4 @@ -Samba FAQ
    Samba FAQ
       Next

    Samba FAQ

    Samba Team

    October 2002

    Dedication

    +Samba FAQ

    Samba FAQ
       Next

    Samba FAQ

    Samba Team

    October 2002

    Dedication

    This is the Frequently Asked Questions (FAQ) document for Samba, the free and very popular SMB server product. An SMB server allows file and printer connections from clients such as Windows, @@ -7,4 +7,4 @@ corrections to the samba documentation mailinglist at samba-doc@samba.org. This FAQ was based on the old Samba FAQ by Dan Shearer and Paul Blackman, and the old samba text documents which were mostly written by John Terpstra. -

    Table of Contents

    1. General Information
    What do the version numbers mean?
    What platforms are supported?
    How do I subscribe to the Samba Mailing Lists?
    2. Compiling and installing Samba on a Unix host
    My client reports "cannot locate specified share name" or similar
    Why are my file's timestamps off by an hour, or by a few hours?
    3. Specific client application problems
    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"
    How to use a Samba share as an administrative share for MS Office, etc.
    Microsoft Access database opening errors
    4. Common errors
    Not listening for calling name
    System Error 1240
    smbclient ignores -N !
    The data on the CD-Drive I've shared seems to be corrupted!
    5. Features
    How can I use samba as a fax server?
    Tools for printing faxes
    Making the fax-server
    Installing the client drivers
    Example smb.conf
    Samba doesn't work well together with DHCP!
    How can I assign NetBIOS names to clients with DHCP?
    How do I convert between unix and dos text formats?
    Does samba have wins replication support?
       Next
       Chapter 1. General Information
    +

    Table of Contents

    1. General Information
    What do the version numbers mean?
    What platforms are supported?
    How do I subscribe to the Samba Mailing Lists?
    2. Compiling and installing Samba on a Unix host
    My client reports "cannot locate specified share name" or similar
    Why are my file's timestamps off by an hour, or by a few hours?
    3. Specific client application problems
    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"
    How to use a Samba share as an administrative share for MS Office, etc.
    Microsoft Access database opening errors
    4. Common errors
    Not listening for calling name
    System Error 1240
    smbclient ignores -N !
    The data on the CD-Drive I've shared seems to be corrupted!
    5. Features
    How can I use samba as a fax server?
    Tools for printing faxes
    Making the fax-server
    Installing the client drivers
    Example smb.conf
    Samba doesn't work well together with DHCP!
    How can I assign NetBIOS names to clients with DHCP?
    How do I convert between unix and dos text formats?
    Does samba have wins replication support?
       Next
       Chapter 1. General Information
    diff --git a/docs/htmldocs/AccessControls.html b/docs/htmldocs/AccessControls.html index 044d347107..7330836f36 100644 --- a/docs/htmldocs/AccessControls.html +++ b/docs/htmldocs/AccessControls.html @@ -1,23 +1,20 @@ -Chapter 13. File, Directory and Share Access Controls
    Chapter 13. File, Directory and Share Access Controls
    Prev Part III. Advanced Configuration Next

    Chapter 13. File, Directory and Share Access Controls

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    May 10, 2003

    Table of Contents

    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with Unix File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and Unix Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute - mapping
    Common Errors
    Users can not write to a public share
    I have set force user and Samba still makes root the owner of all the files - I touch!

    +Chapter 13. File, Directory and Share Access Controls

    Chapter 13. File, Directory and Share Access Controls
    Prev Part III. Advanced Configuration Next

    Chapter 13. File, Directory and Share Access Controls

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    drawing
    The Samba Team

    May 10, 2003

    Table of Contents

    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask + parameters
    Interaction with the standard Samba file attribute mapping
    Common Errors
    Users can not write to a public share
    I have set force user but Samba still makes root the owner of all the files I touch!
    MS Word with Samba changes owner of file

    Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of resources shared via Samba do not behave in the manner they might expect. MS Windows network -administrators are often confused regarding network access controls and what is the best way to -provide users with the type of access they need while protecting resources from the consequences -of untoward access capabilities. +administrators are often confused regarding network access controls and how to +provide users with the access they need while protecting resources from unauthorised access.

    -Unix administrators frequently are not familiar with the MS Windows environment and in particular +Many UNIX administrators are unfamiliar with the MS Windows environment and in particular have difficulty in visualizing what the MS Windows user wishes to achieve in attempts to set file and directory access permissions.

    The problem lies in the differences in how file and directory permissions and controls work between the two environments. This difference is one that Samba can not completely hide, even -though it does try to make the chasm transparent. -

    +though it does try to bridge the chasm to a degree. +

    POSIX Access Control List technology has been available (along with Extended Attributes) -for Unix for many years, yet there is little evidence today of any significant use. This +for UNIX for many years, yet there is little evidence today of any significant use. This explains to some extent the slow adoption of ACLs into commercial Linux products. MS Windows administrators are astounded at this given that ACLs were a foundational capability of the now decade old MS Windows NT operating system. @@ -26,25 +23,24 @@ The purpose of this chapter is to present each of the points of control that are Samba-3 in the hope that this will help the network administrator to find the optimum method for delivering the best environment for MS Windows desktop users.

    -This is an opportune point to mention that it should be borne in mind that Samba was created to -provide a means of interoperability and interchange of data between two operating environments -that are quite different. It was never the intent to make Unix/Linux like MS Windows NT. Instead -the purpose was an is to provide a sufficient level of exchange of data between the two environments. -What is available today extends well beyond early plans and expectations, yet the gap continues to -shrink. -

    Features and Benefits

    +This is an opportune point to mention that Samba was created to provide a means of interoperability +and interchange of data between differing operating environments. Samba has no intent change +UNIX/Linux into a platform like MS Windows. Instead the purpose was and is to provide a sufficient +level of exchange of data between the two environments. What is available today extends well +beyond early plans and expectations, yet the gap continues to shrink. +

    Features and Benefits

    Samba offers a lot of flexibility in file system access management. These are the key access control facilities present in Samba today:

    Samba Access Control Facilities

    • - Unix File and Directory Permissions + UNIX File and Directory Permissions

      - Samba honours and implements Unix file system access controls. Users + Samba honours and implements UNIX file system access controls. Users who access a Samba server will do so as a particular MS Windows user. This information is passed to the Samba server as part of the logon or connection setup process. Samba uses this user identity to validate whether or not the user should be given access to file system resources (files and directories). This chapter provides an overview for those - to whom the Unix permissions and controls are a little strange or unknown. + to whom the UNIX permissions and controls are a little strange or unknown.

    • Samba Share Definitions

      @@ -63,22 +59,22 @@ shrink. easiest ways to affect access controls (restrictions) and can often do so with minimum invasiveness compared with other methods.

    • - MS Windows ACLs through Unix POSIX ACLs + MS Windows ACLs through UNIX POSIX ACLs

      - The use of POSIX ACLs on Unix/Linux is possible ONLY if the underlying + The use of POSIX ACLs on UNIX/Linux is possible ONLY if the underlying operating system supports them. If not, then this option will not be - available to you. Current Unix technology platforms have native support + available to you. Current UNIX technology platforms have native support for POSIX ACLs. There are patches for the Linux kernel that provide this also. Sadly, few Linux platforms ship today with native ACLs and Extended Attributes enabled. This chapter has pertinent information for users of platforms that support them. -

    File System Access Controls

    +

    File System Access Controls

    Perhaps the most important recognition to be made is the simple fact that MS Windows NT4 / 200x / XP -implement a totally divergent file system technology from what is provided in the Unix operating system +implement a totally divergent file system technology from what is provided in the UNIX operating system environment. Firstly we should consider what the most significant differences are, then we shall look at how Samba helps to bridge the differences. -

    MS Windows NTFS Comparison with Unix File Systems

    - Samba operates on top of the Unix file system. This means it is subject to Unix file system conventions +

    MS Windows NTFS Comparison with UNIX File Systems

    + Samba operates on top of the UNIX file system. This means it is subject to UNIX file system conventions and permissions. It also means that if the MS Windows networking environment requires file system behaviour that differs from unix file system behaviour then somehow Samba is responsible for emulating that in a transparent and consistent manner. @@ -88,128 +84,108 @@ at how Samba helps to bridge the differences. but for the greater part we will stay within the bounds of default behaviour. Those wishing to explore to depths of control ability should review the smb.conf man page.

    File System Feature Comparison

    Name Space

    - MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, Unix file names + MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, UNIX file names may be 1023 characters long. In MS Windows file extensions indicate particular file types, - in Unix this is not so rigorously observed as all names are considered arbitrary. + in UNIX this is not so rigorously observed as all names are considered arbitrary.

    - What MS Windows calls a Folder, Unix calls a directory, + What MS Windows calls a Folder, UNIX calls a directory.

    Case Sensitivity

    - MS Windows file names are generally Upper Case if made up of 8.3 (ie: 8 character file name + + MS Windows file names are generally upper case if made up of 8.3 (ie: 8 character file name and 3 character extension. If longer than 8.3 file names are Case Preserving, and Case Insensitive.

    - Unix file and directory names are Case Sensitive and Case Preserving. Samba implements the - MS Windows file name behaviour, but it does so as a user application. The Unix file system + UNIX file and directory names are case sensitive and case preserving. Samba implements the + MS Windows file name behaviour, but it does so as a user application. The UNIX file system provides no mechanism to perform case insensitive file name lookups. MS Windows does this by default. This means that Samba has to carry the processing overhead to provide features - that are NOT native to the Unix operating system environment. + that are NOT native to the UNIX operating system environment.

    - Consider the following, all are unique Unix names but one single MS Windows file name: + Consider the following, all are unique UNIX names but one single MS Windows file name: MYFILE.TXT MyFile.txt myfile.txt - So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in Unix + So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in UNIX they can. So what should Samba do if all three are present? Answer, the one that is lexically first will be accessible to MS Windows users, the others are invisible and unaccessible - any other solution would be suicidal.

    Directory Separators

    - MS Windows and DOS uses the back-slash '\' as a directory delimiter, Unix uses the forward-slash '/' + MS Windows and DOS uses the back-slash '\' as a directory delimiter, UNIX uses the forward-slash '/' as it's directory delimiter. This is transparently handled by Samba.

    Drive Identification

    MS Windows products support a notion of drive letters, like C: to represent - disk partitions. Unix has NO concept if separate identifiers for file partitions since each + disk partitions. UNIX has NO concept if separate identifiers for file partitions since each such file system is mounted to become part of the over-all directory tree. - The Unix directory tree begins at '/', just like the root of a DOS drive is specified like + The UNIX directory tree begins at '/', just like the root of a DOS drive is specified like C:\.

    File Naming Conventions

    - MS Windows generally never experiences file names that begin with a '.', while in Unix these + MS Windows generally never experiences file names that begin with a '.', while in UNIX these are commonly found in a user's home directory. Files that begin with a '.' are typically - either start up files for various Unix applications, or they may be files that contain + either start up files for various UNIX applications, or they may be files that contain start-up configuration data.

    Links and Short-Cuts

    + + + + MS Windows make use of "links and Short-Cuts" that are actually special types of files that will - redirect an attempt to execute the file to the real location of the file. Unix knows of file and directory + redirect an attempt to execute the file to the real location of the file. UNIX knows of file and directory links, but they are entirely different from what MS Windows users are used to.

    - Symbolic links are files in Unix that contain the actual location of the data (file OR directory). An + Symbolic links are files in UNIX that contain the actual location of the data (file OR directory). An operation (like read or write) will operate directly on the file referenced. Symbolic links are also referred to as 'soft links'. A hard link is something that MS Windows is NOT familiar with. It allows one physical file to be known simultaneously by more than one file name.

    There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort - in the process of becoming familiar with Unix/Linux. These are best left for a text that is dedicated to the - purpose of Unix/Linux training/education. -

    Managing Directories

    + in the process of becoming familiar with UNIX/Linux. These are best left for a text that is dedicated to the + purpose of UNIX/Linux training/education. +

    Managing Directories

    There are three basic operations for managing directories, create, delete, rename. -

    Table 13.1. Managing directories with unix and windows

    ActionMS Windows CommandUnix Command
    createmd foldermkdir folder
    deleterd folderrmdir folder
    renamerename oldname newnamemv oldname newname

    -

    File and Directory Access Control

    +

    Table 13.1. Managing directories with unix and windows

    ActionMS Windows CommandUNIX Command
    createmd foldermkdir folder
    deleterd folderrmdir folder
    renamerename oldname newnamemv oldname newname

    +

    File and Directory Access Control

    The network administrator is strongly advised to read foundational training manuals and reference materials - regarding file and directory permissions maintenance. Much can be achieved with the basic Unix permissions + regarding file and directory permissions maintenance. Much can be achieved with the basic UNIX permissions without having to resort to more complex facilities like POSIX Access Control Lists (ACLs) or Extended Attributes (EAs).

    - Unix/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. - A Unix file listing looks as follows:- + UNIX/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. + A UNIX file listing looks as follows:- - 

    -	jht@frodo:~/stuff> ls -la
-	total 632
-	drwxr-xr-x   13 jht   users      816 2003-05-12 22:56 .
-	drwxr-xr-x   37 jht   users     3800 2003-05-12 22:29 ..
-	d---------    2 jht   users       48 2003-05-12 22:29 muchado00
-	d--x--x--x    2 jht   users       48 2003-05-12 22:29 muchado01
-	dr-xr-xr-x    2 jht   users       48 2003-05-12 22:29 muchado02
-	drwxrwxrwx    2 jht   users       48 2003-05-12 22:29 muchado03
-	drw-rw-rw-    2 jht   users       48 2003-05-12 22:29 muchado04
-	d-w--w--w-    2 jht   users       48 2003-05-12 22:29 muchado05
-	dr--r--r--    2 jht   users       48 2003-05-12 22:29 muchado06
-	drwxrwxrwt    2 jht   users       48 2003-05-12 22:29 muchado07
-	drwsrwsrwx    2 jht   users       48 2003-05-12 22:29 muchado08
-	----------    1 jht   users     1242 2003-05-12 22:31 mydata00.lst
-	---x--x--x    1 jht   users     1674 2003-05-12 22:33 mydata01.lst
-	--w--w--w-    1 jht   users     7754 2003-05-12 22:33 mydata02.lst
-	--wx-wx-wx    1 jht   users   260179 2003-05-12 22:33 mydata03.lst
-	-r--r--r--    1 jht   users    21017 2003-05-12 22:32 mydata04.lst
-	-r-xr-xr-x    1 jht   users   206339 2003-05-12 22:32 mydata05.lst
-	-rw-rw-rw-    1 jht   users    41105 2003-05-12 22:32 mydata06.lst
-	-rwxrwxrwx    1 jht   users    19312 2003-05-12 22:32 mydata07.lst
-	jht@frodo:~/stuff>
-

    +

    +$ ls -la
+total 632
+drwxr-xr-x   13 maryo   gnomes      816 2003-05-12 22:56 .
+drwxrwxr-x   37 maryo   gnomes     3800 2003-05-12 22:29 ..
+dr-xr-xr-x    2 maryo   gnomes       48 2003-05-12 22:29 muchado02
+drwxrwxrwx    2 maryo   gnomes       48 2003-05-12 22:29 muchado03
+drw-rw-rw-    2 maryo   gnomes       48 2003-05-12 22:29 muchado04
+d-w--w--w-    2 maryo   gnomes       48 2003-05-12 22:29 muchado05
+dr--r--r--    2 maryo   gnomes       48 2003-05-12 22:29 muchado06
+drwsrwsrwx    2 maryo   gnomes       48 2003-05-12 22:29 muchado08
+----------    1 maryo   gnomes     1242 2003-05-12 22:31 mydata00.lst
+--w--w--w-    1 maryo   gnomes     7754 2003-05-12 22:33 mydata02.lst
+-r--r--r--    1 maryo   gnomes    21017 2003-05-12 22:32 mydata04.lst
+-rw-rw-rw-    1 maryo   gnomes    41105 2003-05-12 22:32 mydata06.lst
+$ 
+

    - The columns above represent (from left to right): permissions, no blocks used, owner, group, size (bytes), access date, access time, file name. -

    - The permissions field is made up of: - - 

    -	 JRV: Put this into a diagram of some sort
-	[ type  ] [ users ] [ group ] [ others ]   [File, Directory Permissions]
-	[ d | l ] [ r w x ] [ r w x ] [ r w x  ]
-	  |   |     | | |     | | |     | | |
-	  |   |     | | |     | | |     | | |-----> Can Execute, List files
-	  |   |     | | |     | | |     | |-------> Can Write,   Create files
-	  |   |     | | |     | | |     |---------> Can Read,    Read files
-	  |   |     | | |     | | |---------------> Can Execute, List files
-	  |   |     | | |     | |-----------------> Can Write,   Create files
-	  |   |     | | |     |-------------------> Can Read,    Read files
-	  |   |     | | |-------------------------> Can Execute, List files
-	  |   |     | |---------------------------> Can Write,   Create files
-	  |   |     |-----------------------------> Can Read,    Read files
-	  |   |-----------------------------------> Is a symbolic Link
-	  |---------------------------------------> Is a directory
-

    + The columns above represent (from left to right): permissions, number of hard links to file, owner, group, size (bytes), access date, access time, file name.

    + An overview of the permissions field can be found in the image below. +

    Figure 13.1. Overview of unix permissions field

    Overview of unix permissions field

    Any bit flag may be unset. An unset bit flag is the equivalent of 'Can NOT' and is represented as a '-' character. -

    Example 13.1. Example File

    +	
    Example 13.1. Example File
     		-rwxr-x---   Means: The owner (user) can read, write, execute
 		                    the group can read and execute
 		                    everyone else can NOT do anything with it
 		
    
 
 	
    
-	Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = Unix Domain Socket.
+	Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = UNIX Domain Socket.
 	
    
 	The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x),
 	execute  only  if  the  file  is a directory or already has execute permission for some user (X), set user or group ID on execution (s),
@@ -228,101 +204,101 @@ at how Samba helps to bridge the differences.
 	the (x) execute flags are not set files can not be listed (seen) in the directory by anyone. The group can read files in the
 	directory but can NOT create new files. NOTE: If files in the directory are set to be readable and writable for the group, then
 	group members will be able to write to (or delete) them.
-

    Share Definition Access Controls

    +

    Share Definition Access Controls

    The following parameters in the smb.conf file sections that define a share control or affect access controls. Before using any of the following options please refer to the man page for smb.conf. -

    User and Group Based Controls

    +

    User and Group Based Controls

    User and group based controls can prove very useful. In some situations it is distinctly desirable to affect all - file system operations as if a single user is doing this, the use of the force user and - force group behaviour will achieve this. In other situations it may be necessary to affect a + file system operations as if a single user is doing this, the use of the force user and + force group behaviour will achieve this. In other situations it may be necessary to affect a paranoia level of control to ensure that only particular authorised persons will be able to access a share or - it's contents, here the use of the valid users or the invalid users may + it's contents, here the use of the valid users or the invalid users may be most useful.

    As always, it is highly advisable to use the least difficult to maintain and the least ambiguous method for controlling access. Remember, that when you leave the scene someone else will need to provide assistance and if that person finds too great a mess, or if they do not understand what you have done then there is risk of Samba being removed and an alternative solution being adopted. -

    Table 13.2. User and Group Based Controls

    Control ParameterDescription - Action - Notes
    admin users

    +

    Table 13.2. User and Group Based Controls

    Control ParameterDescription - Action - Notes
    admin users

    List of users who will be granted administrative privileges on the share. They will do all file operations as the super-user (root). Any user in this list will be able to do anything they like on the share, irrespective of file permissions. -

    force group

    +

    force group

    Specifies a UNIX group name that will be assigned as the default primary group for all users connecting to this service. -

    force user

    +

    force user

    Specifies a UNIX user name that will be assigned as the default user for all users connecting to this service. This is useful for sharing files. Incorrect use can cause security problems. -

    guest ok

    +

    guest ok

    If this parameter is set for a service, then no password is required to connect to the service. Privileges will be those of the guest account. -

    invalid users

    +

    invalid users

    List of users that should not be allowed to login to this service. -

    only user

    +

    only user

    Controls whether connections with usernames not in the user list will be allowed. -

    read list

    +

    read list

    List of users that are given read-only access to a service. Users in this list will not be given write access, no matter what the read only option is set to. -

    username

    +

    username

    Refer to the smb.conf man page for more information - this is a complex and potentially misused parameter. -

    valid users

    +

    valid users

    List of users that should be allowed to login to this service. -

    write list

    +

    write list

    List of users that are given read-write access to a service. -

    File and Directory Permissions Based Controls

    +

    File and Directory Permissions Based Controls

    The following file and directory permission based controls, if misused, can result in considerable difficulty to diagnose the cause of mis-configuration. Use them sparingly and carefully. By gradually introducing each one by one undesirable side-effects may be detected. In the event of a problem, always comment all of them out and then gradually re-introduce them in a controlled fashion. -

    Table 13.3. File and Directory Permission Based Controls

    Control ParameterDescription - Action - Notes
    create mask

    +

    Table 13.3. File and Directory Permission Based Controls

    Control ParameterDescription - Action - Notes
    create mask

    Refer to the smb.conf man page. -

    directory mask

    +

    directory mask

    The octal modes used when converting DOS modes to UNIX modes when creating UNIX directories. See also: directory security mask. -

    dos filemode

    +

    dos filemode

    Enabling this parameter allows a user who has write access to the file to modify the permissions on it. -

    force create mode

    +

    force create mode

    This parameter specifies a set of UNIX mode bit permissions that will always be set on a file created by Samba. -

    force directory mode

    +

    force directory mode

    This parameter specifies a set of UNIX mode bit permissions that will always be set on a directory created by Samba. -

    force directory security mode

    +

    force directory security mode

    Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory -

    force security mode

    +

    force security mode

    Controls UNIX permission bits modified when a Windows NT client manipulates UNIX permissions. -

    hide unreadable

    +

    hide unreadable

    Prevents clients from seeing the existence of files that cannot be read. -

    hide unwriteable files

    +

    hide unwriteable files

    Prevents clients from seeing the existence of files that cannot be written to. Unwriteable directories are shown as usual. -

    nt acl support

    +

    nt acl support

    This parameter controls whether smbd will attempt to map UNIX permissions into Windows NT access control lists. -

    security mask

    +

    security mask

    Controls UNIX permission bits modified when a Windows NT client is manipulating the UNIX permissions on a file. -

    Miscellaneous Controls

    - The following are documented because of the prevalence of administrators creating inadvertant barriers to file +

    Miscellaneous Controls

    + The following are documented because of the prevalence of administrators creating inadvertent barriers to file access by not understanding the full implications of smb.conf file settings. -

    Table 13.4. Other Controls

    Control ParameterDescription - Action - Notes
    case sensitive, default case, short preserve case

    +

    Table 13.4. Other Controls

    Control ParameterDescription - Action - Notes
    case sensitive, default case, short preserve case

    This means that all file name lookup will be done in a case sensitive manner. Files will be created with the precise filename Samba received from the MS Windows client. -

    csc policy

    +

    csc policy

    Client Side Caching Policy - parallels MS Windows client side file caching capabilities. -

    dont descend

    +

    dont descend

    Allows to specify a comma-delimited list of directories that the server should always show as empty. -

    dos filetime resolution

    +

    dos filetime resolution

    This option is mainly used as a compatibility option for Visual C++ when used against Samba shares. -

    dos filetimes

    +

    dos filetimes

    DOS and Windows allows users to change file time stamps if they can write to the file. POSIX semantics prevent this. This options allows DOS and Windows behaviour. -

    fake oplocks

    +

    fake oplocks

    Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an oplock then the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. -

    hide dot files, hide files, veto files

    +

    hide dot files, hide files, veto files

    Note: MS Windows Explorer allows over-ride of files marked as hidden so they will still be visible. -

    read only

    +

    read only

    If this parameter is yes, then users of a service may not create or modify files in the service's directory. -

    veto files

    +

    veto files

    List of files and directories that are neither visible nor accessible. -

    Access Controls on Shares

    +

    Access Controls on Shares

    This section deals with how to configure Samba per share access control restrictions. By default, Samba sets no restrictions on the share itself. Restrictions on the share itself can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can @@ -339,9 +315,9 @@ Before using any of the following options please refer to the man page for /usr/local/samba/var. If the tdbdump utility has been compiled and installed on your system, then you can examine the contents of this file by: tdbdump share_info.tdb. -

    Share Permissions Management

    +

    Share Permissions Management

    The best tool for the task is platform dependant. Choose the best tool for your environment. -

    Windows NT4 Workstation/Server

    +

    Windows NT4 Workstation/Server

    The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below. @@ -351,9 +327,9 @@ Before using any of the following options please refer to the man page for

  • Now click on the share that you wish to manage, then click on the Properties tab, next click on the Permissions tab. Now you can add or change access control settings as you wish. -

    • Windows 200x/XP

    +

    Windows 200x/XP

    On MS Windows NT4/200x/XP system access control lists on the share itself are set using native - tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder, + tools, usually from file manager. For example, in Windows 200x: right click on the shared folder, then select Sharing, then click on Permissions. The default Windows NT4/200x permission allows Everyone Full Control on the Share.

    @@ -380,71 +356,70 @@ Before using any of the following options please refer to the man page for no access means that MaryK who is part of the group Everyone will have no access even if this user is given explicit full control access. -

    MS Windows Access Control Lists and Unix Interoperability

    Managing UNIX permissions Using NT Security Dialogs

    Windows NT clients can use their native security settings - dialog box to view and modify the underlying UNIX permissions.

    Note that this ability is careful not to compromise - the security of the UNIX host Samba is running on, and - still obeys all the file permission rules that a Samba - administrator can set.

    Note

    - All access to Unix/Linux system file via Samba is controlled at - the operating system file access control level. When trying to - figure out file access problems it is vitally important to identify - the identity of the Windows user as it is presented by Samba at - the point of file access. This can best be determined from the +

    MS Windows Access Control Lists and UNIX Interoperability

    Managing UNIX permissions Using NT Security Dialogs

    + Windows NT clients can use their native security settings dialog box to view and modify the + underlying UNIX permissions. +

    + Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and + still obeys all the file permission rules that a Samba administrator can set. +

    + Samba does not attempt to go beyond POSIX ACLs, so that the various finer-grained access control + options provided in Windows are actually ignore. +

    Note

    + All access to UNIX/Linux system files via Samba is controlled by the operating system file access controls. + When trying to figure out file access problems it is vitally important to find the identity of the Windows + user as it is presented by Samba at the point of file access. This can best be determined from the Samba log files. -

    Viewing File Security on a Samba Share

    From an NT4/2000/XP client, single-click with the right - mouse button on any file or directory in a Samba mounted - drive letter or UNC path. When the menu pops-up, click - on the Properties entry at the bottom of - the menu. This brings up the file properties dialog - box. Click on the tab Security and you - will see three buttons, Permissions, - Auditing, and Ownership. - The Auditing button will cause either - an error message A requested privilege is not held - by the client to appear if the user is not the - NT Administrator, or a dialog which is intended to allow an - Administrator to add auditing requirements to a file if the - user is logged on as the NT Administrator. This dialog is - non-functional with a Samba share at this time, as the only - useful button, the Add button will not currently - allow a list of users to be seen.

    Viewing file ownership

    Clicking on the Ownership button - brings up a dialog box telling you who owns the given file. The - owner name will be of the form :

    "SERVER\user (Long name)"

    Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database). Click on the - Close button to remove this dialog.

    If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone".

    The Take Ownership button will not allow - you to change the ownership of this file to yourself (clicking on - it will display a dialog box complaining that the user you are - currently logged onto the NT client cannot be found). The reason - for this is that changing the ownership of a file is a privileged - operation in UNIX, available only to the root - user. As clicking on this button causes NT to attempt to change - the ownership of a file to the current user logged into the NT - client this will not work with Samba at this time.

    There is an NT chown command that will work with Samba - and allow a user with Administrator privilege connected - to a Samba server as root to change the ownership of - files on both a local NTFS filesystem or remote mounted NTFS - or Samba drive. This is available as part of the Seclib - NT security library written by Jeremy Allison of - the Samba Team, available from the main Samba ftp site.

    Viewing File or Directory Permissions

    The third button is the Permissions - button. Clicking on this brings up a dialog box that shows both - the permissions and the UNIX owner of the file or directory. - The owner is displayed in the form :

    "SERVER\ +

    Viewing File Security on a Samba Share

    + From an NT4/2000/XP client, single-click with the right mouse button on any file or directory in a Samba + mounted drive letter or UNC path. When the menu pops-up, click on the Properties + entry at the bottom of the menu. This brings up the file properties dialog box. Click on the tab + Security and you will see three buttons, Permissions, + Auditing, and Ownership. The Auditing + button will cause either an error message A requested privilege is not held by the client + to appear if the user is not the NT Administrator, or a dialog which is intended to allow an Administrator + to add auditing requirements to a file if the user is logged on as the NT Administrator. This dialog is + non-functional with a Samba share at this time, as the only useful button, the Add + button will not currently allow a list of users to be seen. +

    Viewing file ownership

    + Clicking on the Ownership button brings up a dialog box telling you who owns + the given file. The owner name will be of the form: +

    + "SERVER\user (Long name)" +

    + Where SERVER is the NetBIOS name of the Samba server, user + is the user name of the UNIX user who owns the file, and (Long name) is the + descriptive string identifying the user (normally found in the GECOS field of the UNIX password database). + Click on the Close button to remove this dialog. +

    + If the parameter nt acl support is set to false + then the file owner will be shown as the NT user "Everyone". +

    + The Take Ownership button will not allow you to change the ownership of this file to + yourself (clicking on it will display a dialog box complaining that the user you are currently logged onto + the NT client cannot be found). The reason for this is that changing the ownership of a file is a privileged + operation in UNIX, available only to the root user. As clicking on this button causes + NT to attempt to change the ownership of a file to the current user logged into the NT client this will + not work with Samba at this time.

    + There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected + to a Samba server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS + or Samba drive. This is available as part of the Seclib NT security library written + by Jeremy Allison of the Samba-Team, available from the main Samba FTP site.

    Viewing File or Directory Permissions

    + The third button is the Permissions button. Clicking on this brings up a dialog box + that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed in the form: +

    "SERVER\ user - (Long name)"

    Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database).

    If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone" and the - permissions will be shown as NT "Full Control".

    The permissions field is displayed differently for files - and directories, so I'll describe the way file permissions - are displayed first.

    File Permissions

    The standard UNIX user/group/world triplet and + (Long name)"

    Where SERVER is the NetBIOS name of the Samba server, + user is the user name of the UNIX user who owns the file, and + (Long name) is the descriptive string identifying the user (normally found in the + GECOS field of the UNIX password database).

    + If the parameter nt acl support is set to false + then the file owner will be shown as the NT user "Everyone" and the permissions will be + shown as NT "Full Control". +

    + The permissions field is displayed differently for files and directories, so I'll describe the way file permissions + are displayed first. +

    File Permissions

    The standard UNIX user/group/world triplet and the corresponding "read", "write", "execute" permissions triplets are mapped by Samba into a three element NT ACL with the 'r', 'w', and 'x' bits mapped into the corresponding @@ -459,14 +434,14 @@ Before using any of the following options please refer to the man page for or full control then usually the permissions will be prefixed by the words "Special Access" in the NT display list.

    But what happens if the file has no permissions allowed - for a particular UNIX user group or world component ? In order + for a particular UNIX user group or world component? In order to allow "no permissions" to be seen and modified then Samba overloads the NT "Take Ownership" ACL attribute (which has no meaning in UNIX) and reports a component with no permissions as having the NT "O" bit set. This was chosen of course to make it look like a zero, meaning zero permissions. More details on the decision behind this will - be given below.

    Directory Permissions

    Directories on an NT NTFS file system have two + be given below.

    Directory Permissions

    Directories on an NT NTFS file system have two different sets of permissions. The first set of permissions is the ACL set on the directory itself, this is usually displayed in the first set of parentheses in the normal "RW" @@ -477,12 +452,12 @@ Before using any of the following options please refer to the man page for permissions that any file created within this directory would inherit.

    Samba synthesises these inherited permissions for NT by returning as an NT ACL the UNIX permission mode that a new file - created by Samba on this share would receive.

    Modifying file or directory permissions

    Modifying file and directory permissions is as simple + created by Samba on this share would receive.

    Modifying file or directory permissions

    Modifying file and directory permissions is as simple as changing the displayed permissions in the dialog box, and clicking the OK button. However, there are limitations that a user needs to be aware of, and also interactions with the standard Samba permission masks and mapping of DOS - attributes that need to also be taken into account.

    If the parameter nt acl support + attributes that need to also be taken into account.

    If the parameter nt acl support is set to false then any attempt to set security permissions will fail with an "Access Denied" message.

    The first thing to note is that the "Add" @@ -511,59 +486,56 @@ Before using any of the following options please refer to the man page for Remove button, or set the component to only have the special Take Ownership permission (displayed as "O" - ) highlighted.

    Interaction with the standard Samba create mask + ) highlighted.

    Interaction with the standard Samba create mask parameters

    There are four parameters to control interaction with the standard Samba create mask parameters. These are : -

    security mask
    force security mode
    directory security mask
    force directory security mode

    +

    • security mask

    • force security mode

    • directory security mask

    • force directory security mode

    Once a user clicks OK to apply the permissions Samba maps the given permissions into a user/group/world r/w/x triplet set, and then will check the changed permissions for a - file against the bits set in the - security mask parameter. Any bits that + file against the bits set in the + security mask parameter. Any bits that were changed that are not set to '1' in this parameter are left alone - in the file permissions.

    Essentially, zero bits in the security mask + in the file permissions.

    Essentially, zero bits in the security mask mask may be treated as a set of bits the user is not allowed to change, and one bits are those the user is allowed to change.

    If not set explicitly this parameter is set to the same value as - the create mask - parameter. To allow a user to modify all the + the create mask parameter. To allow a user to modify all the user/group/world permissions on a file, set this parameter to 0777.

    Next Samba checks the changed permissions for a file against - the bits set in the - force security mode parameter. Any bits + the bits set in the + force security mode parameter. Any bits that were changed that correspond to bits set to '1' in this parameter are forced to be set.

    Essentially, bits set in the force security mode parameter may be treated as a set of bits that, when modifying security on a file, the user has always set to be 'on'.

    If not set explicitly this parameter is set to the same value - as the force - create mode parameter. + as the force create mode parameter. To allow a user to modify all the user/group/world permissions on a file - with no restrictions set this parameter to 000.

    The security mask and force + with no restrictions set this parameter to 000.

    The security mask and force security mode parameters are applied to the change request in that order.

    For a directory Samba will perform the same operations as described above for a file except using the parameter directory security mask instead of security mask, and force directory security mode parameter instead of force security mode - .

    The directory security mask parameter + .

    The directory security mask parameter by default is set to the same value as the directory mask parameter and the force directory security mode parameter by default is set to the same value as - the force directory mode parameter.

    In this way Samba enforces the permission restrictions that + the force directory mode parameter.

    In this way Samba enforces the permission restrictions that an administrator can set on a Samba share, whilst still allowing users to modify the permission bits within that restriction.

    If you want to set up a share that allows users full control in modifying the permission bits on their files and directories and doesn't force any particular bits to be set 'on', then set the following parameters in the smb.conf file in that share specific section : -

    security mask = 0777
    force security mode = 0
    directory security mask = 0777
    force directory security mode = 0

    Interaction with the standard Samba file attribute - mapping

    Samba maps some of the DOS attribute bits (such as "read +

    security mask = 0777
    force security mode = 0
    directory security mask = 0777
    force directory security mode = 0

    Interaction with the standard Samba file attribute mapping

    Note

    Samba maps some of the DOS attribute bits (such as "read only") into the UNIX permissions of a file. This means there can be a conflict between the permission bits set via the security dialog and the permission bits set by the file attribute mapping. -

    One way this can show up is if a file has no UNIX read access +

    One way this can show up is if a file has no UNIX read access for the owner it will show up as "read only" in the standard file attributes tabbed dialog. Unfortunately this dialog is the same one that contains the security info in another tab.

    What this can mean is that if the owner changes the permissions @@ -575,10 +547,10 @@ Before using any of the following options please refer to the man page for OK to get back to the attributes dialog you should always hit Cancel rather than OK to ensure that your changes - are not overridden.

    Common Errors

    + are not overridden.

    Common Errors

    File, Directory and Share access problems are very common on the mailing list. The following are examples taken from the mailing list in recent times. -

    Users can not write to a public share

    +

    Users can not write to a public share

    “ We are facing some troubles with file / directory permissions. I can log on the domain as admin user(root), and there's a public share, on which everyone needs to have permission to create / modify files, but only @@ -587,74 +559,83 @@ are examples taken from the mailing list in recent times. ”

    There are many ways to solve this problem, here are a few hints: -

    Procedure 13.3. Example Solution:

    1. +

      1. Go to the top of the directory that is shared

      2. Set the ownership to what ever public owner and group you want - 

        -			find 'directory_name' -type d -exec chown user.group {}\;
-			find 'directory_name' -type d -exec chmod 6775 'directory_name'
-			find 'directory_name' -type f -exec chmod 0775 {} \;
-			find 'directory_name' -type f -exec chown user.group {}\;
-

        +

        +$ find 'directory_name' -type d -exec chown user.group {}\;
+$ find 'directory_name' -type d -exec chmod 6775 'directory_name'
+$ find 'directory_name' -type f -exec chmod 0775 {} \;
+$ find 'directory_name' -type f -exec chown user.group {}\;
+

        Note

        The above will set the 'sticky bit' on all directories. Read your - Unix/Linux man page on what that does. It causes the OS to assign + UNIX/Linux man page on what that does. It causes the OS to assign to all files created in the directories the ownership of the directory.

      3. Directory is: /foodbar - 

        -				$ chown jack.engr /foodbar
-

        -

        Note

        -

        This is the same as doing:

        - 

        -					$ chown jack /foodbar
-					$ chgrp engr /foodbar
-

        -

      4. Now do: +

        +$ chown jack.engr /foodbar
+

        +

        Note

        This is the same as doing:

        +$ chown jack /foodbar
+$ chgrp engr /foodbar
+

      5. Now do: - 

        -				$ chmod 6775 /foodbar
-				$ ls -al /foodbar/..
-

        +

        +$ chmod 6775 /foodbar
+$ ls -al /foodbar/..
+

        You should see: - 

        -				drwsrwsr-x  2 jack  engr    48 2003-02-04 09:55 foodbar
-

        +

        +drwsrwsr-x  2 jack  engr    48 2003-02-04 09:55 foodbar
+

      6. Now do: - 

        -				$ su - jill
-				$ cd /foodbar
-				$ touch Afile
-				$ ls -al
-

        +

        +$ su - jill
+$ cd /foodbar
+$ touch Afile
+$ ls -al
+

        You should see that the file Afile created by Jill will have ownership and permissions of Jack, as follows: - 

        -		-rw-r--r--  1 jack  engr     0 2003-02-04 09:57 Afile
-

        +

        +-rw-r--r--  1 jack  engr     0 2003-02-04 09:57 Afile
+

      7. Now in your smb.conf for the share add: - 

        -		force create mode = 0775
-		force directory mode = 6775
-

        +

        force create mode = 0775
        force direcrtory mode = 6775

        Note

        The above are only needed if your users are not members of the group you have used. ie: Within the OS do not have write permission on the directory.

        An alternative is to set in the smb.conf entry for the share: - 

        -		force user = jack
-		force group = engr
-

        -

    I have set force user and Samba still makes root the owner of all the files - I touch!

    - When you have a user in 'admin users', Samba will always do file operations for - this user as root, even if force user has been set. -

    Prev Up Next
    Chapter 12. Mapping MS Windows and Unix Groups Home Chapter 14. File and Record Locking
    +

    force user = jack
    force group = engr

    +

    I have set force user but Samba still makes root the owner of all the files I touch!

    + When you have a user in admin users, samba will always do file operations for + this user as root, even if force user has been set. +

    MS Word with Samba changes owner of file

    + Question: “When userB saves a word document that is owned by userA the updated file is now owned by userB. + Why is Samba doing this? How do I fix this?” +

    + Answer: Word does the following when you modify/change a Word document: Word Creates a NEW document with + a temporary name, Word then closes the old document and deletes it, Word then renames the new document to the original document name. + There is NO mechanism by which Samba CAN IN ANY WAY know that the new document really should be owned by the owners + of the original file. Samba has no way of knowing that the file will be renamed by MS Word. As far as Samba is able + to tell, the file that gets created is a NEW file, not one that the application (Word) is updating. +

    + There is a work-around to solve the permissions problem. That work-around involves understanding how you can manage file + system behaviour from within the smb.conf file, as well as understanding how Unix file systems work. Set on the directory + in which you are changing word documents: chmod g+s 'directory_name' This ensures that all files will + be created with the group that owns the directory. In smb.conf share declaration section set: +

    +

    force create mode = 0660
    force directory mode = 0770

    +

    + These two settings will ensure that all directories and files that get created in the share will be read/writable by the + owner and group set on the directory itself. +

    Prev Up Next
    Chapter 12. Mapping MS Windows and UNIX Groups Home Chapter 14. File and Record Locking
    diff --git a/docs/htmldocs/AdvancedNetworkManagement.html b/docs/htmldocs/AdvancedNetworkManagement.html index 296c684e24..1052f45e92 100644 --- a/docs/htmldocs/AdvancedNetworkManagement.html +++ b/docs/htmldocs/AdvancedNetworkManagement.html @@ -1,8 +1,8 @@ -Chapter 22. Advanced Network Management
    Chapter 22. Advanced Network Management
    Prev Part III. Advanced Configuration Next

    Chapter 22. Advanced Network Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors

    +Chapter 22. Advanced Network Management

    Chapter 22. Advanced Network Management
    Prev Part III. Advanced Configuration Next

    Chapter 22. Advanced Network Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors

    This section documents peripheral issues that are of great importance to network administrators who want to improve network resource access control, to automate the user environment, and to make their lives a little easier. -

    Features and Benefits

    +

    Features and Benefits

    Often the difference between a working network environment and a well appreciated one can best be measured by the little things that makes everything work more harmoniously. A key part of every network environment solution is the ability to remotely @@ -12,7 +12,7 @@ network operations.

    This chapter presents information on each of these area. They are placed here, and not in other chapters, for ease of reference. -

    Remote Server Administration

    +

    Remote Server Administration

    How do I get 'User Manager' and 'Server Manager'?

    Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains', @@ -26,12 +26,12 @@ Click here to download the archived file Windows NT 4.0 version of the 'User Manager for Domains' and 'Server Manager' are available from Microsoft via ftp from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE -

    Remote Desktop Management

    +

    Remote Desktop Management

    There are a number of possible remote desktop management solutions that range from free through costly. Do not let that put you off. Sometimes the most costly solutions is the most cost effective. In any case, you will need to draw your own conclusions as to which is the best tool in your network environment. -

    Remote Management from NoMachines.Com

    +

    Remote Management from NoMachines.Com

    The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003. It is presented in slightly edited form (with author details omitted for privacy reasons). The entire answer is reproduced below with some comments removed. @@ -119,7 +119,7 @@ is the best tool in your network environment. NoMachine are encouraging and offering help to OSS/Free Software implementations for such a frontend too, even if it means competition to them (they have written to this effect even to the LTSP, KDE and GNOME developer mailing lists) -

    Network Logon Script Magic

    +

    Network Logon Script Magic

    This section needs work. Volunteer contributions most welcome. Please send your patches or updates to John Terpstra.

    @@ -209,7 +209,7 @@ This is the genlogon.pl file:

    Those wishing to use more elaborate or capable logon processing system should check out the following sites: -

    http://www.craigelachie.org/rhacer/ntlogon
    http://www.kixtart.org
    http://support.microsoft.com/default.asp?scid=kb;en-us;189105

    Adding printers without user intervention

    +

    http://www.craigelachie.org/rhacer/ntlogon
    http://www.kixtart.org
    http://support.microsoft.com/default.asp?scid=kb;en-us;189105

    Adding printers without user intervention

    Printers may be added automatically during logon script processing through the use of: 

    @@ -217,8 +217,8 @@ Printers may be added automatically during logon script processing through the u

    See the documentation in the Microsoft knowledgebase article no: 189105. -

    Common Errors

    +

    Common Errors

    The information provided in this chapter has been reproduced from postings on the samba@samba.org mailing list. No implied endorsement or recommendation is offered. Administrators should conduct their own evaluation of alternatives and are encouraged to draw their own conclusions. -

    Prev Up Next
    Chapter 21. Integrated Logon Support using Winbind Home Chapter 23. System and Account Policies
    +

    Prev Up Next
    Chapter 21. Winbind: Use of Domain Accounts Home Chapter 23. System and Account Policies
    diff --git a/docs/htmldocs/Appendixes.html b/docs/htmldocs/Appendixes.html index 854437acde..6d77a0ba65 100644 --- a/docs/htmldocs/Appendixes.html +++ b/docs/htmldocs/Appendixes.html @@ -1,4 +1,3 @@ -Part VI. Appendixes
    Part VI. Appendixes
    Prev   Next

    Appendixes

    Table of Contents

    36. How to compile SAMBA
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    Common Errors
    37. Portability
    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
    How do I get printer driver download working - for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Books
    Prev Up Next
    Chapter 35. Reporting Bugs Home Chapter 36. How to compile SAMBA
    +Part VI. Appendixes
    Part VI. Appendixes
    Prev   Next

    Appendixes

    Table of Contents

    36. How to compile Samba
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    37. Portability
    HPUX
    SCO UNIX
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    Configuring OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba
    Configuring OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba
    Printer driver download for for OS/2 clients?
    Windows for Workgroups
    Latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configuring WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Prev Up Next
    Chapter 35. Reporting Bugs Home Chapter 36. How to compile Samba
    diff --git a/docs/htmldocs/Backup.html b/docs/htmldocs/Backup.html index 9fac452023..f19bd6d2b3 100644 --- a/docs/htmldocs/Backup.html +++ b/docs/htmldocs/Backup.html @@ -1,13 +1,11 @@ -Chapter 28. Samba Backup Techniques
    Chapter 28. Samba Backup Techniques
    Prev Part III. Advanced Configuration Next

    Chapter 28. Samba Backup Techniques

    John H. Terpstra

    Samba Team

    Table of Contents

    Note
    Features and Benefits

    Note

    +Chapter 28. Samba Backup Techniques

    Chapter 28. Samba Backup Techniques
    Prev Part III. Advanced Configuration Next

    Chapter 28. Samba Backup Techniques

    John H. Terpstra

    Samba Team

    Table of Contents

    Note
    Features and Benefits

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -If you have something to contribute for this section please email it to -jht@samba.org/ -

    Features and Benefits

    +

    Features and Benefits

    We need feedback from people who are backing up samba servers. We would like to know what software tools you are using to backup your samba server/s.

    In particular, if you have any success and / or failure stories you could share with other users this would be appreciated. -

    Prev Up Next
    Chapter 27. Unicode/Charsets Home Chapter 29. High Availability Options
    +

    Prev Up Next
    Chapter 27. Unicode/Charsets Home Chapter 29. High Availability Options
    diff --git a/docs/htmldocs/CUPS-printing.html b/docs/htmldocs/CUPS-printing.html index 46ca8e15f7..8bfe11405f 100644 --- a/docs/htmldocs/CUPS-printing.html +++ b/docs/htmldocs/CUPS-printing.html @@ -1,54 +1,59 @@ -Chapter 19. CUPS Printing Support in Samba 3.0
    Chapter 19. CUPS Printing Support in Samba 3.0
    Prev Part III. Advanced Configuration Next

    Chapter 19. CUPS Printing Support in Samba 3.0

    Kurt Pfeifle

    Danka Deutschland GmbH

    Ciprian Vizitiu

    drawings

    (3 June 2003)

    Table of Contents

    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for -CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for -application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download
    GDI on Windows -- PostScript on Unix
    Windows Drivers, GDI and EMF
    Unix Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and -native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print -Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many -Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel -Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for -cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Caveats to be considered
    What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsm completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the -Client
    Installing PostScript Driver Files manually (using -rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Commandline Driver Installation in 15 little Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    When not to use Samba to print to -CUPS
    In Case of Trouble.....
    Where to find Documentation
    How to ask for Help
    Where to find Help
    Appendix
    Printing from CUPS to Windows attached -Printers
    More CUPS filtering Chains
    Trouble Shooting Guidelines to fix typical Samba printing -Problems
    An Overview of the CUPS Printing Processes

    Introduction

    Features and Benefits

    - The Common Unix Print System (CUPS) has become very popular. All - big Linux distributions now ship it as their default printing - system. But to many it is still a very mystical tool. Normally it - "just works" (TM). People tend to regard it as a sort of "black box", - which they don't want to look into, as long as it works OK. But once +Chapter 19. CUPS Printing Support in Samba 3.0

    Chapter 19. CUPS Printing Support in Samba 3.0
    Prev Part III. Advanced Configuration Next

    Chapter 19. CUPS Printing Support in Samba 3.0

    Kurt Pfeifle

    Danka Deutschland GmbH

    Ciprian Vizitiu

    drawings

    Jelmer R. Vernooij

    drawings
    The Samba Team

    (3 June 2003)

    Table of Contents

    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for +CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for +application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and +native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many +Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel +Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Caveats to be considered
    Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsmb completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the +Client
    Installing PostScript Driver Files manually (using +rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    In Case of Trouble.....
    Printing from CUPS to Windows attached +Printers
    More CUPS filtering Chains
    Common Errors
    Win9x client can't install driver
    "cupsaddsmb" keeps asking for root password in + neverending loop
    "cupsaddsmb" gives "No PPD file for printer..." + message while PPD file is present
    Client can't connect to Samba printer
    Can't reconnect to Samba under new account + from Win2K/XP
    Avoid being connected to the Samba server as the + "wrong" user
    Upgrading to CUPS drivers from Adobe drivers on + NT/2K/XP clients gives problems
    Can't use "cupsaddsmb" on Samba server which is + a PDC
    Deleted Win2K printer driver is still shown
    Win2K/XP "Local Security + Policies"
    WinXP clients: "Administrator can not install + printers for all local users"
    "Print Change Notify" functions on + NT-clients
    WinXP-SP1
    Print options for all users can't be set on Win2K/XP
    Most common blunders in driver + settings on Windows clients
    cupsaddsmb does not work + with newly installed printer
    Permissions on +/var/spool/samba/ get reset after each +reboot
    Printer named "lp" +intermittently swallows jobs and spits out completely different +ones
    Location of Adobe PostScript driver files necessary for "cupsaddsmb"
    An Overview of the CUPS Printing Processes

    Introduction

    Features and Benefits

    + The Common UNIX Print System (CUPS) has become very popular. All + major Linux distributions now ship it as their default printing + system. To many it is still a very mystical tool. Mostly, it + "just works" (TM). People tend to regard it as a "black box" + which they don't want to look into, as long as it works. But once there is a little problem, they are in trouble to find out where to - start debugging it. Also, even the most recent and otherwise excellent - printed Samba documentation has only limited attention paid to CUPS - printing, leaving out important pieces or even writing plain wrong - things about it. This demands rectification. But before you dive into - this chapter, make sure that you don't forget to refer to the - "Classical Printing" chapter also. It contains a lot of information - that is relevant for CUPS too. + start debugging it. Refer to the "Classical Printing" chapter also, it + contains a lot of information that is relevant for CUPS.

    CUPS sports quite a few unique and powerful features. While their basic functions may be grasped quite easily, they are also new. Because they are different from other, more traditional printing systems, it is best to try and not apply any prior knowledge about - printing upon this new system. Rather try to start understand CUPS - from the beginning. This documentation will lead you here to a - complete understanding of CUPS, if you study all of the material - contained. But lets start with the most basic things first. Maybe this - is all you need for now. Then you can skip most of the other - paragraphs. -

    Overview

    + printing upon this new system. Rather, try to understand CUPS + from the beginning. This documentation will lead you to a + complete understanding of CUPS. Let's start with the most basic + things first. +

    Overview

    CUPS is more than just a print spooling system. It is a complete printer management system that complies with the new IPP (Internet Printing Protocol). IPP is an industry and IETF (Internet Engineering Task Force) standard for network printing. Many of its functions can be managed remotely (or locally) via a web browser (giving you a - platform-independent access to the CUPS print server). In addition it - has the traditional commandline and several more modern GUI interfaces + platform-independent access to the CUPS print server). Additionally, it + has the traditional command line and several more modern GUI interfaces (GUI interfaces developed by 3rd parties, like KDE's overwhelming KDEPrint).

    @@ -60,80 +65,53 @@ Problems

    An Overview of the C argue that CUPS is better! In any case, let us now move on to explore how one may configure CUPS for interfacing with MS Windows print clients via Samba. -

    Basic Configuration of CUPS support

    - Printing with CUPS in the most basic smb.conf - setup in Samba 3.0 (as was true for 2.2.x) only needs two - settings: printing = cups and printcap - = cups. CUPS itself doesn't need a printcap file - anymore. However, the cupsd.conf configuration - file knows two related directives: they control if such a file should - be automatically created and maintained by CUPS for the convenience of - third party applications (example: Printcap - /etc/printcap and PrintcapFormat - BSD). These legacy programs often require the existence of - printcap file containing printernames or they will refuse to - print. Make sure CUPS is set to generate and maintain a printcap! For - details see man cupsd.conf and other CUPS-related - documentation, like the wealth of documents on your CUPS server +

    Basic Configuration of CUPS support

    + Printing with CUPS in the most basic smb.conf setup in Samba 3.0 (as was true for 2.2.x) only needs two + settings: printing = cups and + printcap = cups. CUPS does not need a printcap file. + However, the cupsd.conf configuration file knows of two related directives that control + how such a file will be automatically created and maintained by CUPS for the convenience of third party + applications (example: Printcap /etc/printcap and PrintcapFormat BSD). + Legacy programs often require the existence of a printcap file containing printer names or they will refuse to + print. Make sure CUPS is set to generate and maintain a printcap file! For details see + man cupsd.conf and other CUPS-related documentation, like the wealth of documents on your CUPS server itself: http://localhost:631/documentation.html. -

    Linking of smbd with libcups.so

    - Samba has a very special relationship to CUPS. The reason is: Samba - can be compiled with CUPS library support. Most recent installations - have this support enabled, and per default CUPS linking is compiled +

    Linking of smbd with libcups.so

    + Samba has a very special relationship to CUPS. Samba can be compiled with CUPS library support. + Most recent installations have this support enabled. Per default CUPS linking is compiled into smbd and other Samba binaries. Of course, you can use CUPS even if Samba is not linked against libcups.so -- but there are some differences in required or supported configuration then.

    - If SAMBA is compiled against libcups, then printcap = - cups uses the CUPS API to list printers, submit jobs, - query queues, etc. Otherwise it maps to the System V commands with an - additional -oraw option for printing. On a Linux - system, you can use the ldd utility to find out - details (ldd may not be present on other OS platforms, or its function - may be embodied by a different command): - 

    -				transmeta:/home/kurt # ldd `which smbd`
-				libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000)
-				libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000)
-				libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000)
-				[....]
-

    - The line libcups.so.2 => /usr/lib/libcups.so.2 - (0x40123000) shows there is CUPS support compiled - into this version of Samba. If this is the case, and printing = cups - is set, then any otherwise manually set print command in - smb.conf is ignored. This is an - important point to remember! -

    Tip

    Should you require -- for any reason -- to set your own - print commands, you can still do this by setting printing = - sysv. However, you'll loose all the benefits from the - close CUPS/Samba integration. You are on your own then to manually - configure the rest of the printing system commands (most important: - print command; other commands are - lppause command, lpresume command, lpq command, lprm - command, queuepause command and queue resume - command).

    Simple smb.conf Settings for CUPS

    - To summarize, here is the simplest printing-related setup - for smb.conf to enable basic CUPS support: + When Samba is compiled against libcups, printcap = cups + uses the CUPS API to list printers, submit jobs, query queues, etc. Otherwise it maps to the System V + commands with an additional -oraw option for printing. On a Linux + system, you can use the ldd utility to find out details (ldd may not be present on + other OS platforms, or its function may be embodied by a different command): 

    -
-				[global]
-				load printers = yes
-				printing = cups
-				printcap name = cups
-
-				[printers]
-				comment = All Printers
-				path = /var/spool/samba
-				browseable = no
-				public = yes
-				guest ok = yes
-				writable = no
-				printable = yes
-				printer admin = root, @ntadmins
-
-

    +root# ldd `which smbd` +libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000) +libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000) +libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) +[....] +

    + The line libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) shows + there is CUPS support compiled into this version of Samba. If this is the case, and printing = cups + is set, then any otherwise manually set print command in smb.conf is ignored. + This is an important point to remember! +

    Tip

    Should it be necessary, for any reason, to set your own print commands, you can do this by setting + printing = sysv. However, you will loose all the benefits + of tight CUPS/Samba integration. When you do this you must manually configure the printing system commands + (most important: print command; other commands are + lppause command, + lpresume command, + lpq command, + lprm command, + queuepause command and + queue resume command).

    Simple smb.conf Settings for CUPS

    + To summarize, here is the simplest printing-related setup for smb.conf to enable basic CUPS support: +

    Example 19.1. Simplest printing-related smb.conf

    [global]
    load printers = yes
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    public = yes
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root, @ntadmins

    This is all you need for basic printing setup for CUPS. It will print all Graphic, Text, PDF and PostScript file submitted from Windows clients. However, most of your Windows users would not know how to @@ -148,67 +126,29 @@ Problems

    An Overview of the C printer is not a PostScript device, the print data stream is "binary", sensible only for the target printer. Read on to learn which problem this may cause and how to avoid it. -

    More complex smb.conf Settings for +

    More complex smb.conf Settings for CUPS

    Here is a slightly more complex printing-related setup for smb.conf. It enables general CUPS printing support for all printers, but defines one printer share which is set up differently. -

    -
- [global]
-         printing = cups
-         printcap name = cups
-         load printers = yes
-
- [printers]
-         comment = All Printers
-         path = /var/spool/samba
-         public = yes
-         guest ok = yes
-         writable = no
-         printable = yes
-         printer admin = root, @ntadmins
- 
- [special_printer]
-         comment = A special printer with his own settings
-         path = /var/spool/samba-special
-         printing = sysv
-         printcap = lpstat
-         print command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ;\
-                         echo "     `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ;\
-                         echo "     `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log :\
-                         rm %f
-         public = no
-         guest ok = no
-         writeable = no
-         printable = yes
-         printer admin = kurt
-         hosts deny = 0.0.0.0
-         hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60
-
-

    -This special share is only there for my testing purposes. It doesn't -even write the print job to a file. It just logs the job parameters -known to Samba into the /tmp/smbprn.log file and -deletes the jobfile. Moreover, the printer -admin of this share is "kurt" (not the "@ntadmins" group); -guest access is not allowed; the share isn't announced in Network -Neighbourhood (so you need to know it is there), and it is only -allowing access from three hosts. To prevent CUPS kicking in and -taking over the print jobs for that share, we need to set -printing = sysv and printcap = -lpstat. -

    Advanced Configuration

    -Before we dive into all the configuration options, let's clarify a few +

    Example 19.2. Overriding global CUPS settings for one printer

    [global]
    printing = cups
    printcap name = cups
    load printers = yes
    [printers]
    comment = All Printers
    path = /var/spool/samba
    public = yes
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root, @ntadmins
    [special_printer]
    comment = A special printer with his own settings
    path = /var/spool/samba-special
    printing = sysv
    printcap = lpstat
    print command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ; \
    echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; \
    echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log : rm %f
    public = no
    guest ok = no
    writeable = no
    printable = yes
    printer admin = kurt
    hosts deny = 0.0.0.0
    hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60

    +This special share is only there for testing purposes. It does not write the print job to a file. It just logs the job parameters +known to Samba into the /tmp/smbprn.log file and deletes the jobfile. Moreover, the +printer admin of this share is "kurt" (not the "@ntadmins" group); +guest access is not allowed; the share isn not published to the Network Neighbourhood (so you need to know it is there), and it only +allows access from only three hosts. To prevent CUPS kicking in and taking over the print jobs for that share, we need to set +printing = sysv and +printcap = lpstat. +

    Advanced Configuration

    +Before we delve into all the configuration options, let us clarify a few points. Network printing needs to be organized and setup correctly. Often this is not done correctly. Legacy systems -or small LANs in business environments often lack a clear design and -good housekeeping. -

    Central spooling vs. "Peer-to-Peer" printing

    +or small business LAN environments often lack design and good housekeeping. +

    Central spooling vs. "Peer-to-Peer" printing

    Many small office or home networks, as well as badly organized larger environments, allow each client a direct access to available network -printers. Generally, this is a bad idea. It often blocks one client's +printers. This is generally a bad idea. It often blocks one client's access to the printer when another client's job is printing. It also might freeze the first client's application while it is waiting to get rid of the job. Also, there are frequent complaints about various jobs @@ -217,18 +157,18 @@ is the usage of a "print server": it routes all jobs through one central system, which responds immediately, takes jobs from multiple concurrent clients at the same time and in turn transfers them to the printer(s) in the correct order. -

    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients

    -Most traditionally configured Unix print servers acting on behalf of +

    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients

    +Most traditionally configured UNIX print servers acting on behalf of Samba's Windows clients represented a really simple setup. Their only task was to manage the "raw" spooling of all jobs handed to them by Samba. This approach meant that the Windows clients were expected to -prepare the print job file in such a way that it became fit to be fed to -the printing device. Here a native (vendor-supplied) Windows printer +prepare the print job file that it s ready to be sent to the printing +device. Here a native (vendor-supplied) Windows printer driver for the target device needed to be installed on each and every client.

    -Of course you can setup CUPS, Samba and your Windows clients in the +It is possible to configure CUPS, Samba and your Windows clients in the same, traditional and simple way. When CUPS printers are configured for RAW print-through mode operation it is the responsibility of the Samba client to fully render the print job (file). The file must be @@ -236,21 +176,23 @@ sent in a format that is suitable for direct delivery to the printer. Clients need to run the vendor-provided drivers to do this. In this case CUPS will NOT do any print file format conversion work. -

    Driver Installation Methods on Windows Clients

    +

    Driver Installation Methods on Windows Clients

    The printer drivers on the Windows clients may be installed in two functionally different ways:

    • manually install the drivers locally on each client, one by one; this yields the old LanMan style printing; it uses a \\sambaserver\printershare -type of connection.

    • deposit and prepare the drivers (for later download) on +type of connection.

    • + + deposit and prepare the drivers (for later download) on the print server (Samba); this enables the clients to use -"Point'n'Print" to get drivers semi-automatically installed the +"Point and Print" to get drivers semi-automatically installed the first time they access the printer; with this method NT/2K/XP clients use the SPOOLSS/MS-RPC type printing calls.

    The second method is recommended for use over the first. -

    Explicitly enable "raw" printing for -application/octet-stream!

    +

    Explicitly enable "raw" printing for +application/octet-stream!

    If you use the first option (drivers are installed on the client side), there is one setting to take care of: CUPS needs to be told that it should allow "raw" printing of deliberate (binary) file @@ -263,16 +205,12 @@ be uncommented to allow RAW mode operation. In/etc/cups/mime.types make sure this line is present: 

    -
  application/octet-stream
-

    In /etc/cups/mime.convs, have this line: -

    -
+
      application/octet-stream   application/vnd.cups-raw   0   - 
-
 
    
 If these two files are not set up correctly for raw Windows client
 printing, you may encounter the dreaded Unable to
@@ -281,7 +219,7 @@ convert file 0 in your CUPS error_log file.
 mime.types file does not
 enforce "raw" printing, it only
 allows it.
-

    Background.  +

    Background.  CUPS being a more security-aware printing system than traditional ones does not by default allow a user to send deliberate (possibly binary) data to printing devices. This could be easily abused to launch a @@ -298,7 +236,7 @@ This is all you need to know to get the CUPS/Samba combo printing locally installed. If you are not interested in background information about more advanced CUPS/Samba printing, simply skip the remaining sections of this chapter. -

    Three familiar Methods for driver upload plus a new one

    +

    Three familiar Methods for driver upload plus a new one

    If you want to use the MS-RPC type printing, you must upload the drivers onto the Samba server first ([print$] share). For a discussion on how to deposit printer drivers on the @@ -306,23 +244,25 @@ Samba host (so that the Windows clients can download and use them via "Point'n'Print") please also refer to the previous chapter of this HOWTO Collection. There you will find a description or reference to three methods of preparing the client drivers on the Samba server: -

    • the GUI, "Add Printer Wizard" +

      • the GUI, "Add Printer Wizard" upload-from-a-Windows-client method;

      • the commandline, "smbclient/rpcclient" upload-from-a-UNIX-workstation -method;

      • the Imprints Toolset +method;

      • + + the Imprints Toolset method.

      These 3 methods apply to CUPS all the same. A new and more convenient way to load the Windows drivers into Samba is provided -provided if you use CUPS: -

      • the cupsaddsmb +if you use CUPS: +

        • the cupsaddsmb utility.

        cupsaddsmb is discussed in much detail further below. But we will first explore the CUPS filtering system and compare the Windows and UNIX printing architectures. -

    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download

    -Still reading on? Good. Let's go into more detail then. We now know +

    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download

    +Are you still following this? Good. Let's go into more detail then. We now know how to set up a "dump" printserver, that is, a server which is spooling printjobs "raw", leaving the print data untouched.

    @@ -343,13 +283,13 @@ server meeting these requirements, you'll first need to learn about how CUPS works and how you can enable its features.

    What follows is the comparison of some fundamental concepts for -Windows and Unix printing; then is the time for a description of the +Windows and UNIX printing; then is the time for a description of the CUPS filtering system, how it works and how you can tweak it. -

    GDI on Windows -- PostScript on Unix

    +

    GDI on Windows -- PostScript on UNIX

    Network printing is one of the most complicated and error-prone day-to-day tasks any user or an administrator may encounter. This is true for all OS platforms. And there are reasons for this. -

    +

    You can't expect for most file formats to just throw them towards printers and they get printed. There needs to be a file format conversion in between. The problem is: there is no common standard for @@ -361,7 +301,7 @@ into semi-official "standards", by being the most widely used PDLs many manufacturers who "roll their own" (their reasons may be unacceptable license fees for using printer-embedded PostScript interpreters, etc.). -

    Windows Drivers, GDI and EMF

    +

    Windows Drivers, GDI and EMF

    In Windows OS, the format conversion job is done by the printer drivers. On MS Windows OS platforms all application programmers have at their disposal a built-in API, the GDI (Graphical Device @@ -378,16 +318,17 @@ the GDI, produces often a file format called EMF (Enh MetaFile). The EMF is processed by the printer driver and converted to the printer-specific file format.

    Note

    + To the GDI foundation in MS Windows, Apple has chosen to put paper and screen output on a common foundation for their -(BSD-Unix-based, did you know??) Mac OS X and Darwin Operating -Systems.Their Core Graphic Engine uses a -PDF derivate for all display work. +(BSD-UNIX-based, did you know??) Mac OS X and Darwin Operating +Systems. Their Core Graphic Engine uses a +PDF derivative for all display work.

    -

    Figure 19.1. Windows Printing to a local Printer

    Windows Printing to a local Printer

    -

    Unix Printfile Conversion and GUI Basics

    -In Unix and Linux, there is no comparable layer built into the OS +

    Figure 19.1. Windows Printing to a local Printer

    Windows Printing to a local Printer

    +

    UNIX Printfile Conversion and GUI Basics

    +In UNIX and Linux, there is no comparable layer built into the OS kernel(s) or the X (screen display) server. Every application is responsible for itself to create its print output. Fortunately, most use PostScript. That gives at least some common ground. Unfortunately, @@ -406,7 +347,7 @@ ready for prime time.) You can see this unfavorable inheritance up to the present day by looking into the various "font" directories on your system; there are separate ones for fonts used for X display and fonts to be used on paper. -

    Background.  +

    Background.  The PostScript programming language is an "invention" by Adobe Inc., but its specifications have been published to the full. Its strength lies in its powerful abilities to describe graphical objects (fonts, @@ -422,9 +363,9 @@ form and you will be reading its PostScript code, the language instructions which need to be interpreted by a rasterizer. Rasterizers produce pixel images, which may be displayed on screen by a viewer program or on paper by a printer. -

    PostScript and Ghostscript

    -So, Unix is lacking a common ground for printing on paper and -displaying on screen. Despite this unfavorable legacy for Unix, basic +

    PostScript and Ghostscript

    +So, UNIX is lacking a common ground for printing on paper and +displaying on screen. Despite this unfavorable legacy for UNIX, basic printing is fairly easy: if you have PostScript printers at your disposal! The reason is: these devices have a built-in PostScript language "interpreter", also called a Raster Image @@ -434,33 +375,35 @@ spit out your printed pages. Their RIP is doing all the hard work of converting the PostScript drawing commands into a bitmap picture as you see it on paper, in a resolution as done by your printer. This is no different to PostScript printing of a file from a Windows origin. -

    Note

    Traditional Unix programs and printing systems -- while +

    Note

    + +Traditional UNIX programs and printing systems -- while using PostScript -- are largely not PPD-aware. PPDs are "PostScript Printer Description" files. They enable you to specify and control all options a printer supports: duplexing, stapling, punching... Therefore -Unix users for a long time couldn't choose many of the supported +UNIX users for a long time couldn't choose many of the supported device and job options, unlike Windows or Apple users. But now there -is CUPS.... ;-) +is CUPS....

    -

    Figure 19.2. Printing to a Postscript Printer

    Printing to a Postscript Printer

    -

    +

    Figure 19.2. Printing to a Postscript Printer

    Printing to a Postscript Printer

    +

    However, there are other types of printers out there. These don't know how to print PostScript. They use their own Page Description Language (PDL, often proprietary). To print to them is much -more demanding. Since your Unix applications mostly produce +more demanding. Since your UNIX applications mostly produce PostScript, and since these devices don't understand PostScript, you need to convert the printfiles to a format suitable for your printer on the host, before you can send it away. -

    Ghostscript -- the Software RIP for non-PostScript Printers

    +

    Ghostscript -- the Software RIP for non-PostScript Printers

    Here is where Ghostscript kicks in. Ghostscript is the traditional (and quite powerful) PostScript interpreter used on -Unix platforms. It is a RIP in software, capable to do a +UNIX platforms. It is a RIP in software, capable to do a lot of file format conversions, for a very broad spectrum of hardware devices as well as software file formats. Ghostscript technology and drivers is what enables PostScript printing to non-PostScript hardware.

    -

    Figure 19.3. Ghostscript as a RIP for non-postscript printers

    Ghostscript as a RIP for non-postscript printers

    +

    Figure 19.3. Ghostscript as a RIP for non-postscript printers

    Ghostscript as a RIP for non-postscript printers

    Tip

    Use the "gs -h" command to check for all built-in "devices" of your Ghostscript version. If you specify e.g. a parameter of @@ -473,12 +416,12 @@ intervals, now by artofcode LLC. They are initially put under the "AFPL" license, but re-released under the GNU GPL as soon as the next AFPL version appears. GNU Ghostscript is probably the version installed on most Samba systems. But it has got some -deficiencies. Therefore ESP Ghostscript was developed as an +deficiencies. Therefore ESP Ghostscript was developed as an enhancement over GNU Ghostscript, with lots of bug-fixes, additional devices and improvements. It is jointly maintained by developers from CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat and Debian. It includes the "cups" device (essential to print to non-PS printers from CUPS). -

    PostScript Printer Description (PPD) Specification

    +

    PostScript Printer Description (PPD) Specification

    While PostScript in essence is a Page Description Language (PDL) to represent the page layout in a device independent way, real world print jobs are @@ -504,15 +447,16 @@ user selections are somehow written (in the form of special PostScript, PJL, JCL or vendor-dependent commands) into the PostScript file created by the driver.

    Warning

    + A PostScript file that was created to contain device-specific commands for achieving a certain print job output (e.g. duplexed, stapled and punched) on a specific target machine, may not print as expected, or may not be printable at all on other models; it also may not be fit for further processing by software (e.g. by a PDF distilling program). -

    CUPS can use all Windows-formatted Vendor PPDs

    +

    CUPS can use all Windows-formatted Vendor PPDs

    CUPS can handle all spec-compliant PPDs as supplied by the manufacturers for their PostScript models. Even if a -Unix/Linux-illiterate vendor might not have mentioned our favorite +UNIX/Linux-illiterate vendor might not have mentioned our favorite OS in his manuals and brochures -- you can safely trust this: if you get hold of the Windows NT version of the PPD, you can use it unchanged in CUPS and thus access the full @@ -524,6 +468,8 @@ immediately. CUPS in all versions after 1.1.19 has a much more strict internal PPD parsing and checking code enabled; in case of printing trouble this online resource should be one of your first pitstops.

    Warning

    + + For real PostScript printers don't use the Foomatic or cupsomatic PPDs from Linuxprinting.org. With these devices the original @@ -536,7 +482,7 @@ your LAN has the PostScript driver installed, just use access the Windows directory where all printer driver files are stored. First look in the W32X86/2 subdir for the PPD you are seeking. -

    CUPS also uses PPDs for non-PostScript Printers

    +

    CUPS also uses PPDs for non-PostScript Printers

    CUPS also uses specially crafted PPDs to handle non-PostScript printers. These PPDs are usually not available from the vendors (and no, you can't just take the PPD of a Postscript printer with the same @@ -544,7 +490,7 @@ model name and hope it works for the non-PostScript version too). To understand how these PPDs work for non-PS printers we first need to dive deeply into the CUPS filtering and file format conversion architecture. Stay tuned. -

    The CUPS Filtering Architecture

    +

    The CUPS Filtering Architecture

    The core of the CUPS filtering system is based on Ghostscript. In addition to Ghostscript, CUPS uses some other filters of its own. You (or your OS vendor) may have @@ -570,23 +516,27 @@ Make sure your Ghostscript version has the "cups" device compiled in may encounter the dreaded Unable to convert file 0 in your CUPS error_log file. To have "cups" as a device in your Ghostscript, you either need to patch GNU -Ghostscript and re-compile or use ESP Ghostscript. The +Ghostscript and re-compile or use ESP Ghostscript. The superior alternative is ESP Ghostscript: it supports not just CUPS, but 300 other devices too (while GNU Ghostscript supports only about 180). Because of this broad output device support, ESP Ghostscript is the first choice for non-CUPS spoolers too. It is now recommended by Linuxprinting.org for all spoolers.

    + + CUPS printers may be setup to use external rendering paths. One of the most common ones is provided by the Foomatic/cupsomatic concept, from Linuxprinting.org. This uses the classical Ghostscript approach, doing everything in one step. It doesn't use the "cups" device, but one of the many others. However, even for Foomatic/cupsomatic usage, best results and + broadest printer model support is provided by ESP Ghostscript (more about cupsomatic/Foomatic, particularly the new version called now foomatic-rip, follows below). -

    MIME types and CUPS Filters

    +

    MIME types and CUPS Filters

    + CUPS reads the file /etc/cups/mime.types (and all other files carrying a *.types suffix in the same directory) upon startup. These files contain the MIME @@ -595,10 +545,10 @@ auto-typing routines. The rule syntax is explained in the man page for mime.types and in the comments section of the mime.types file itself. A simple rule reads like this: +

    + 

    -
  application/pdf         pdf string(0,%PDF)
-

    This means: if a filename has either a .pdf suffix, or if the magic @@ -607,9 +557,7 @@ beginning of the file itself (offset 0 from the start), then it is a PDF file (application/pdf). Another rule is this: 

    -
  application/postscript  ai eps ps string(0,%!) string(0,<04>%!)
-

    Its meaning: if the filename has one of the suffixes .ai, .eps, @@ -639,7 +587,7 @@ CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI and a lot of image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster, PNM, PBM, SGI-RGB and some more) and their associated MIME types with its filters. -

    MIME type Conversion Rules

    +

    MIME type Conversion Rules

    CUPS reads the file /etc/cups/mime.convs (and all other files named with a *.convs suffix in the same directory) upon startup. These files contain @@ -648,39 +596,31 @@ conversion filter which can produce the output from the input type and virtual costs associated with this conversion. One example line reads like this: 

    -
  application/pdf         application/postscript   33   pdftops
-

    This means that the pdftops filter will take application/pdf as input and produce application/postscript as output, the virtual cost of this operation is 33 CUPS-$. The next filter is more expensive, costing 66 CUPS-$: -

    -
+
      application/vnd.hp-HPGL application/postscript   66   hpgltops
-
 
    
 This is the hpgltops, which processes HP-GL
 plotter files to PostScript.
-
    -
+
      application/octet-stream
-
 
    
 Here are two more examples: 
-
    -
+
      application/x-shell     application/postscript   33    texttops
  text/plain              application/postscript   33    texttops
-
 
    
 The last two examples name the texttops filter
 to work on "text/plain" as well as on "application/x-shell". (Hint:
 this differentiation is needed for the syntax highlighting feature of
 "texttops").
-

    Filter Requirements

    +

    Filter Requirements

    There are many more combinations named in mime.convs. However, you are not limited to use the ones pre-defined there. You can plug in any filter you like into the CUPS framework. It must meet, or must be made @@ -696,13 +636,13 @@ filenames or stdin as input and write to printer job user title copies options [filename]

    Printer

    The name of the printer queue (normally this is the name of the filter being run)

    job

    The numeric job ID for the job being -printed

    Printer

    The string from the originating-user-name -attribute

    Printer

    The string from the job-name attribute

    Printer

    The numeric value from the number-copies -attribute

    Printer

    The job options

    Printer

    (Optionally) The print request file (if missing, +printed

    user

    The string from the originating-user-name +attribute

    title

    The string from the job-name attribute

    copies

    The numeric value from the number-copies +attribute

    options

    The job options

    filename

    (Optionally) The print request file (if missing, filters expected data fed through stdin). In most cases it is very easy to write a simple wrapper script around existing -filters to make them work with CUPS.

    Prefilters

    -As was said, PostScript is the central file format to any Unix based +filters to make them work with CUPS.

    Prefilters

    +As was said, PostScript is the central file format to any UNIX based printing system. From PostScript, CUPS generates raster data to feed non-PostScript printers.

    @@ -719,8 +659,8 @@ MIME type application/vnd.cups-postscript (not application/postscript), meaning it has the print options already embedded into the file.

    -

    Figure 19.4. Prefiltering in CUPS to form Postscript

    Prefiltering in CUPS to form Postscript

    -

    pstops

    +

    Figure 19.4. Prefiltering in CUPS to form Postscript

    Prefiltering in CUPS to form Postscript

    +

    pstops

    pstopsis the filter to convert application/postscript to application/vnd.cups-postscript. It was said @@ -728,7 +668,7 @@ above that this filter inserts all device-specific print options (commands to the printer to ask for the duplexing of output, or stapling an punching it, etc.) into the PostScript file.

    -

    Figure 19.5. Adding Device-specific Print Options

    Adding Device-specific Print Options

    +

    Figure 19.5. Adding Device-specific Print Options

    Adding Device-specific Print Options

    This is not all: other tasks performed by it are:

    • @@ -740,7 +680,7 @@ putting 2 or more logical pages on one sheet of paper (the so-called "number-up" function)

    • counting the pages of the job to insert the accounting information into the /var/log/cups/page_log -

    pstoraster

    +

    pstoraster

    pstoraster is at the core of the CUPS filtering system. It is responsible for the first stage of the rasterization process. Its input is of MIME type application/vnd.cups-postscript; @@ -749,20 +689,20 @@ yet meant to be printable. Its aim is to serve as a general purpose input format for more specialized raster drivers, that are able to generate device-specific printer data.

    -

    Figure 19.6. Postscript to intermediate Raster format

    Postscript to intermediate Raster format

    +

    Figure 19.6. Postscript to intermediate Raster format

    Postscript to intermediate Raster format

    CUPS raster is a generic raster format with powerful features. It is able to include per-page information, color profiles and more to be used by the following downstream raster drivers. Its MIME type is registered with IANA and its specification is of course completely open. It is designed to make it very easy and inexpensive for -manufacturers to develop Linux and Unix raster drivers for their +manufacturers to develop Linux and UNIX raster drivers for their printer models, should they choose to do so. CUPS always takes care for the first stage of rasterization so these vendors don't need to care about Ghostscript complications (in fact, there is currently more than one vendor financing the development of CUPS raster drivers).

    -

    Figure 19.7. CUPS-raster production using Ghostscript

    CUPS-raster production using Ghostscript

    +

    Figure 19.7. CUPS-raster production using Ghostscript

    CUPS-raster production using Ghostscript

    CUPS versions before version 1.1.15 were shipping a binary (or source code) standalone filter, named "pstoraster". pstoraster was derived @@ -776,7 +716,7 @@ integrated back into Ghostscript (now based on GNU Ghostscript version parameter. If your Ghostscript doesn't show a success on asking for gs -h |grep cups, you might not be able to print. Update your Ghostscript then! -

    imagetops and imagetoraster

    +

    imagetops and imagetoraster

    Above in the section about prefilters, we mentioned the prefilter that generates PostScript from image formats. The imagetoraster filter is used to convert directly from image to raster, without the @@ -784,13 +724,13 @@ intermediate PostScript stage. It is used more often than the above mentioned prefilters. Here is a summarizing flowchart of image file filtering:

    -

    Figure 19.8. Image format to CUPS-raster format conversion

    Image format to CUPS-raster format conversion

    -

    rasterto [printers specific]

    +

    Figure 19.8. Image format to CUPS-raster format conversion

    Image format to CUPS-raster format conversion

    +

    rasterto [printers specific]

    CUPS ships with quite some different raster drivers processing CUPS raster. On my system I find in /usr/lib/cups/filter/ these: -rastertoalps, rastertobj, rastertoepson, rastertoescp, -rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo, -rastertoescp, rastertohp and +rastertoalps, rastertobj, rastertoepson, rastertoescp, +rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo, +rastertoescp, rastertohp and rastertoprinter. Don't worry if you have less than this; some of these are installed by commercial add-ons to CUPS (like rastertoturboprint), others (like @@ -798,8 +738,8 @@ than this; some of these are installed by commercial add-ons to CUPS development projects (such as Gimp-Print) wanting to cooperate as closely as possible with CUPS.

    -

    Figure 19.9. Raster to Printer Specific formats

    Raster to Printer Specific formats

    -

    CUPS Backends

    +

    Figure 19.9. Raster to Printer Specific formats

    Raster to Printer Specific formats

    +

    CUPS Backends

    The last part of any CUPS filtering chain is a "backend". Backends are special programs that send the print-ready file to the final device. There is a separate backend program for any transfer @@ -854,7 +794,7 @@ This backend sends printfiles to printers shared by a Windows host. An example for CUPS device-URIs to use are: smb://workgroup/server/printersharename Or -Smb://server/printersharename +smb://server/printersharename or smb://username:password@workgroup/server/printersharename or @@ -880,13 +820,11 @@ printername). Not all of the mentioned backends may be present on your system or usable (depending on your hardware configuration). One test for all available CUPS backends is provided by the lpinfo -utility. Used with the -v parameter, it lists +utility. Used with the -v parameter, it lists all available backends: 

    -
- lpinfo -v
-
-

    cupsomatic/Foomatic -- how do they fit into the Picture?

    +$ lpinfo -v +

    cupsomatic/Foomatic -- how do they fit into the Picture?

    "cupsomatic" filters may be the most widely used on CUPS installations. You must be clear about the fact that these were not developed by the CUPS people. They are a "Third Party" add-on to @@ -900,9 +838,7 @@ Printer & Driver Database at Linuxprinting.org. You can recognize these PPDs from the line calling the cupsomatic filter: 

    -
  *cupsFilter: "application/vnd.cups-postscript  0  cupsomatic"
-

    This line you may find amongst the first 40 or so lines of the PPD file. If you have such a PPD installed, the printer shows up in the @@ -911,7 +847,7 @@ the driver description. cupsomatic is a Perl script that runs Ghostscript, with all the complicated commandline options auto-constructed from the selected PPD and commandline options give to the printjob. -

    +

    However, cupsomatic is now deprecated. Its PPDs (especially the first generation of them, still in heavy use out there) are not meeting the Adobe specifications. You might also suffer difficulties when you try @@ -936,11 +872,11 @@ print-options from page to page, in the middle of a job. And the best thing is: the new foomatic-rip now works seamlessly with all legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR etc.), providing for them access to use PPDs for their printing! -

    The Complete Picture

    +

    The Complete Picture

    If you want to see an overview over all the filters and how they relate to each other, the complete picture of the puzzle is at the end of this document. -

    mime.convs

    +

    mime.convs

    CUPS auto-constructs all possible filtering chain paths for any given MIME type, and every printer installed. But how does it decide in favor or against a specific alternative? (There may often be cases, @@ -957,7 +893,7 @@ cost. This is a very efficient way to limit the load of any CUPS server by setting an appropriate "FilterLimit" value. A FilterLimit of 200 allows roughly 1 job at a time, while a FilterLimit of 1000 allows approximately 5 jobs maximum at a time. -

    "Raw" printing

    +

    "Raw" printing

    You can tell CUPS to print (nearly) any file "raw". "Raw" means it will not be filtered. CUPS will send the file to the printer "as is" without bothering if the printer is able to digest it. Users need to @@ -966,9 +902,7 @@ printing can happen on any queue if the "-o raw" option is specified on the command line. You can also set up raw-only queues by simply not associating any PPD with it. This command: 

    -
- lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E
-
+$ lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E

    sets up a queue named "rawprinter", connected via the "socket" protocol (a.k.a. "HP JetDirect") to the device at IP address @@ -980,7 +914,7 @@ CUPS will automatically treat each job sent to a queue as a "raw" one, if it can't find a PPD associated with the queue. However, CUPS will only send known MIME types (as defined in its own mime.types file) and refuse others. -

    "application/octet-stream" printing

    +

    "application/octet-stream" printing

    Any MIME type with no rule in the /etc/cups/mime.types file is regarded as unknown or application/octet-stream and will not be @@ -989,9 +923,7 @@ you will probably have experienced the fact that printjobs originating from Windows clients were not printed. You may have found an error message in your CUPS logs like: 

    -
  Unable to convert file 0 to printable format for job
-

    To enable the printing of "application/octet-stream" files, edit these two files: @@ -1000,20 +932,16 @@ Both contain entries (at the end of the respective files) which must be uncommented to allow RAW mode operation for application/octet-stream. In /etc/cups/mime.types make sure this line is present: -

    -
+
      application/octet-stream
-
 
    
 This line (with no specific auto-typing rule set) makes all files
 not otherwise auto-typed a member of application/octet-stream. In
 /etc/cups/mime.convs, have this
 line: 
 
    -
  application/octet-stream   application/vnd.cups-raw   0   -
-
-
    
+

    This line tells CUPS to use the Null Filter (denoted as "-", doing... nothing at all) on application/octet-stream, and tag the result as @@ -1038,7 +966,7 @@ be one that is known to CUPS and an allowed one. The file recognizes MIME types. The file /etc/cups/mime.convs decides which file conversion filter(s) may be applied to which MIME types. -

    PostScript Printer Descriptions (PPDs) for non-PS Printers

    +

    PostScript Printer Descriptions (PPDs) for non-PS Printers

    Originally PPDs were meant to be used for PostScript printers only. Here, they help to send device-specific commands and settings to the RIP which processes the jobfile. CUPS has extended this @@ -1051,10 +979,8 @@ printers the Ghostscript RIP runs on the host computer.

    PPDs for a non-PS printer have a few lines that are unique to CUPS. The most important one looks similar to this: -

    -
+
      *cupsFilter: application/vnd.cups-raster  66   rastertoprinter
-
 
    
 It is the last piece in the CUPS filtering puzzle. This line tells the
 CUPS daemon to use as a last filter "rastertoprinter".  This filter
@@ -1070,24 +996,12 @@ CUPS by default ships only a few generic PPDs, but they are good for
 several hundred printer models. You may not be able to control
 different paper trays, or you may get larger margins than your
 specific model supports):
-
    deskjet.ppd
    older HP inkjet printers and compatible
-
    deskjet2.ppd
    newer HP inkjet printers and compatible
-
    dymo.ppd
    label printers
-
    epson9.ppd
    Epson 24pin impact printers and compatible
-
    epson24.ppd
    Epson 24pin impact printers and compatible
-
    okidata9.ppd
    Okidata 9pin impact printers and compatible
-
    okidat24.ppd
    Okidata 24pin impact printers and compatible
-
    stcolor.ppd
    older Epson Stylus Color printers
-
    stcolor2.ppd
    newer Epson Stylus Color printers
-
    stphoto.ppd
    older Epson Stylus Photo printers
-
    stphoto2.ppd
    newer Epson Stylus Photo printers
-
    laserjet.ppd
    all PCL printers. Further below is a discussion
-of several other driver/PPD-packages suitable fur use with CUPS.
-

    Difference between cupsomatic/foomatic-rip and -native CUPS printing

    +

    Table 19.1. PPD's shipped with CUPS

    PPD filePrinter type
    deskjet.ppdolder HP inkjet printers and compatible
    deskjet2.ppdnewer HP inkjet printers and compatible
    dymo.ppdlabel printers
    epson9.ppdEpson 24pin impact printers and compatible
    epson24.ppdEpson 24pin impact printers and compatible
    okidata9.ppdOkidata 9pin impact printers and compatible
    okidat24.ppdOkidata 24pin impact printers and compatible
    stcolor.ppdolder Epson Stylus Color printers
    stcolor2.ppdnewer Epson Stylus Color printers
    stphoto.ppdolder Epson Stylus Photo printers
    stphoto2.ppdnewer Epson Stylus Photo printers
    laserjet.ppdall PCL printers. Further below is a discussion of several other driver/PPD-packages suitable for use with CUPS.

    Difference between cupsomatic/foomatic-rip and +native CUPS printing

    Native CUPS rasterization works in two steps.

    • First is the "pstoraster" step. It uses the special "cups" + device from ESP Ghostscript 7.05.x as its tool

    • Second comes the "rasterdriver" step. It uses various @@ -1097,7 +1011,7 @@ Shareware/Non-Free, some are proprietary.

    Often this produces better quality (and has several more advantages) than other methods.

    -

    Figure 19.10. cupsomatic/foomatic processing versus Native CUPS

    cupsomatic/foomatic processing versus Native CUPS

    +

    Figure 19.10. cupsomatic/foomatic processing versus Native CUPS

    cupsomatic/foomatic processing versus Native CUPS

    One other method is the cupsomatic/foomatic-rip way. Note that cupsomatic is not made by the CUPS @@ -1111,6 +1025,8 @@ other (non-CUPS) spoolers. An upgrade to foomatic-rip is strongly advised, especially if you are upgrading to a recent version of CUPS too.

    + + Both the cupsomatic (old) and the foomatic-rip (new) methods from Linuxprinting.org use the traditional Ghostscript print file processing, doing everything in a single step. It therefore relies on @@ -1132,7 +1048,7 @@ installation: Therefore the printfile bypasses the "pstoraster" filter cupsomatic hands the rendered file directly to the CUPS backend. The flowchart above illustrates the difference between native CUPS rendering and the Foomatic/cupsomatic method. -

    Examples for filtering Chains

    +

    Examples for filtering Chains

    Here are a few examples of commonly occurring filtering chains to illustrate the workings of CUPS.

    @@ -1152,10 +1068,8 @@ PPD) into the new PostScript file; the file now is of PostScript MIME type application/vnd.cups-postscript;

  • the file goes to the socket backend, which transfers the job to the printers.

    • -The resulting filter chain therefore is: -

    -pdftops --> pstops --> socket
-

    + The resulting filter chain therefore is as drawn in the image below. +

    Figure 19.11. PDF to socket chain

    PDF to socket chain

    Assume your want to print the same filter to an USB-connected Epson Stylus Photo printer, installed with the CUPS stphoto2.ppd. The first few filtering stages @@ -1179,45 +1093,43 @@ does its work (as is indicated in the printer's PPD), creating the printer-specific raster data and embedding any user-selected print-options into the print data stream;

  • the file goes to the usb backend, which transfers the job to the printers.

    • -The resulting filter chain therefore is: -

    -pdftops --> pstops --> pstoraster --> rastertoepson --> usb
-

    Sources of CUPS drivers / PPDs

    + The resulting filter chain therefore is as drawn in the image below. +

    Figure 19.12. PDF to USB chain

    PDF to USB chain

    Sources of CUPS drivers / PPDs

    On the internet you can find now many thousand CUPS-PPD files (with their companion filters), in many national languages, supporting more than 1000 non-PostScript models. -

    • ESP -PrintPro (http://wwwl.easysw.com/printpro/) (commercial, +

      • ESP +PrintPro (commercial, non-Free) is packaged with more than 3000 PPDs, ready for successful use "out of the box" on Linux, Mac OS X, IBM-AIX, -HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital Unix and some +HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital UNIX and some more commercial Unices (it is written by the CUPS developers themselves and its sales help finance the further development of CUPS, as they feed their creators).

      • the Gimp-Print-Project -(http://gimp-print.sourceforge.net/) (GPL, Free Software) + (GPL, Free Software) provides around 140 PPDs (supporting nearly 400 printers, many driven to photo quality output), to be used alongside the Gimp-Print CUPS filters;

      • TurboPrint -(http://www.turboprint.com/) (Shareware, non-Free) supports + (Shareware, non-Free) supports roughly the same amount of printers in excellent quality;

      • OMNI -(http://www-124.ibm.com/developerworks/oss/linux/projects/omni/) + (LPGL, Free) is a package made by IBM, now containing support for more than 400 printers, stemming from the inheritance of IBM OS/2 Know-How ported over to Linux (CUPS support is in a Beta-stage at present);

      • HPIJS -(http://hpinkjet.sourceforge.net/) (BSD-style licenses, Free) + (BSD-style licenses, Free) supports around 150 of HP's own printers and is also providing excellent print quality now (currently available only via the Foomatic path);

      • Foomatic/cupsomatic -(http://www.linuxprinting.org/) (LPGL, Free) from + (LPGL, Free) from Linuxprinting.org are providing PPDs for practically every Ghostscript filter known to the world (including Omni, Gimp-Print and HPIJS).

      Note

      The cupsomatic/Foomatic trick from Linuxprinting.org works differently from the other drivers. This is explained elsewhere in this document. -

    Printing with Interface Scripts

    +

    Printing with Interface Scripts

    CUPS also supports the usage of "interface scripts" as known from System V AT&T printing systems. These are often used for PCL printers, from applications that generate PCL print jobs. Interface @@ -1230,61 +1142,60 @@ realm. On HP-UX platforms they are more often used. You can use any working interface script on CUPS too. Just install the printer with the -i option: 

    -
- lpadmin -p pclprinter -v socket://11.12.13.14:9100 -i /path/to/interface-script
-
+root# lpadmin -p pclprinter -v socket://11.12.13.14:9100 \
+  -i /path/to/interface-script

    Interface scripts might be the "unknown animal" to many. However, with CUPS they provide the most easy way to plug in your own custom-written filtering script or program into one specific print queue (some information about the traditional usage of interface scripts is to be found at http://playground.sun.com/printing/documentation/interface.html). -

    Network printing (purely Windows)

    +

    Network printing (purely Windows)

    Network printing covers a lot of ground. To understand what exactly goes on with Samba when it is printing on behalf of its Windows clients, let's first look at a "purely Windows" setup: Windows clients with a Windows NT print server. -

    From Windows Clients to an NT Print Server

    +

    From Windows Clients to an NT Print Server

    Windows clients printing to an NT-based print server have two options. They may -

    • execute the driver locally and render the GDI output +

      • execute the driver locally and render the GDI output (EMF) into the printer specific format on their own, or

      • send the GDI output (EMF) to the server, where the driver is executed to render the printer specific output.

      Both print paths are shown in the flowcharts below. -

    Driver Execution on the Client

    +

    Driver Execution on the Client

    In the first case the print server must spool the file as "raw", meaning it shouldn't touch the jobfile and try to convert it in any -way. This is what traditional Unix-based print server can do too; and +way. This is what traditional UNIX-based print server can do too; and at a better performance and more reliably than NT print server. This is what most Samba administrators probably are familiar with. One advantage of this setup is that this "spooling-only" print server may -be used even if no driver(s) for Unix are available it is sufficient +be used even if no driver(s) for UNIX are available it is sufficient to have the Windows client drivers available and installed on the clients.

    -

    Figure 19.11. Print Driver execution on the Client

    Print Driver execution on the Client

    -

    Driver Execution on the Server

    +

    Figure 19.13. Print Driver execution on the Client

    Print Driver execution on the Client

    +

    Driver Execution on the Server

    The other path executes the printer driver on the server. The clients transfers print files in EMF format to the server. The server uses the PostScript, PCL, ESC/P or other driver to convert the EMF file into -the printer-specific language. It is not possible for Unix to do the +the printer-specific language. It is not possible for UNIX to do the same. Currently there is no program or method to convert a Windows -client's GDI output on a Unix server into something a printer could +client's GDI output on a UNIX server into something a printer could understand.

    -

    Figure 19.12. Print Driver execution on the Server

    Print Driver execution on the Server

    +

    Figure 19.14. Print Driver execution on the Server

    Print Driver execution on the Server

    However, there is something similar possible with CUPS. Read on... -

    Network Printing (Windows clients -- UNIX/Samba Print +

    Network Printing (Windows clients -- UNIX/Samba Print Servers)

    Since UNIX print servers cannot execute the Win32 program code on their platform, the picture is somewhat different. However, this doesn't limit your options all that much. In the contrary, you may have a way here to implement printing features which are not possible otherwise. -

    From Windows Clients to a CUPS/Samba Print Server

    +

    From Windows Clients to a CUPS/Samba Print Server

    Here is a simple recipe showing how you can take advantage of CUPS powerful features for the benefit of your Windows network printing clients: @@ -1296,12 +1207,11 @@ printer is a non-PostScript model. It also requires that you have a "driver" on the CUPS server.

    Firstly, to enable CUPS based printing through Samba the -following options should be set in your smb.conf file [globals] +following options should be set in your smb.conf file [global] section: -

    • printing = CUPS

    • printcap = CUPS

    +

    • printing = cups

    • printcap = cups

    When these parameters are specified, all manually set print directives -(like print command =..., or lppause -command =...) in smb.conf (as well as +(like print command, or lppause command) in smb.conf (as well as in samba itself) will be ignored. Instead, Samba will directly interface with CUPS through it's application program interface (API) - as long as Samba has been compiled with CUPS library (libcups) @@ -1310,12 +1220,12 @@ other print commands are set up, then printing will use the System V AT&T command set, with the -oraw option automatically passing through (if you want your own defined print commands to work with a Samba that has CUPS support compiled in, -simply use printing = sysv). +simply use printing = sysv).

    -

    Figure 19.13. Printing via CUPS/samba server

    Printing via CUPS/samba server

    -

    Samba receiving Jobfiles and passing them to CUPS

    +

    Figure 19.15. Printing via CUPS/samba server

    Printing via CUPS/samba server

    +

    Samba receiving Jobfiles and passing them to CUPS

    Samba must use its own spool directory (it is set -by a line similar to path = /var/spool/samba, +by a line similar to path = /var/spool/samba, in the [printers] or [printername] section of smb.conf). Samba receives the job in its own @@ -1331,8 +1241,8 @@ A Windows user authenticates only to Samba (by whatever means is configured). If Samba runs on the same host as CUPS, you only need to allow "localhost" to print. If they run on different machines, you need to make sure the Samba host gets access to printing on CUPS. -

    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs

    +

    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs

    PPDs can control all print device options. They are usually provided by the manufacturer; if you own a PostScript printer, that is. PPD files (PostScript Printer Descriptions) are always a component of @@ -1351,7 +1261,7 @@ or see if you have lphelp on your system). There are also some different GUI frontends on Linux/UNIX, which can present PPD options to users. PPD options are normally meant to be evaluated by the PostScript RIP on the real PostScript printer. -

    PPDs for non-PS Printers on UNIX

    +

    PPDs for non-PS Printers on UNIX

    CUPS doesn't limit itself to "real" PostScript printers in its usage of PPDs. The CUPS developers have extended the scope of the PPD concept, to also describe available device and driver options for @@ -1368,7 +1278,7 @@ the supplied PostScript. Thus CUPS lets all its printers appear as PostScript devices to its clients, because it can act as a PostScript RIP for those printers, processing the received PostScript code into a proper raster print format. -

    PPDs for non-PS Printers on Windows

    +

    PPDs for non-PS Printers on Windows

    CUPS-PPDs can also be used on Windows-Clients, on top of a "core" PostScript driver (now recommended is the "CUPS PostScript Driver for WindowsNT/2K/XP"; you can also use the Adobe one, with @@ -1384,13 +1294,13 @@ which always remain unfiltered per definition;

  • enable clients to driver, even for many different target printers.

    • Using CUPS PPDs on Windows clients enables these to control all print job settings just as a UNIX client can do too. -

    Windows Terminal Servers (WTS) as CUPS Clients

    +

    Windows Terminal Servers (WTS) as CUPS Clients

    This setup may be of special interest to people experiencing major problems in WTS environments. WTS need often a multitude of non-PostScript drivers installed to run their clients' variety of different printer models. This often imposes the price of much increased instability. -

    Printer Drivers running in "Kernel Mode" cause many +

    Printer Drivers running in "Kernel Mode" cause many Problems

    The reason is that in Win NT printer drivers run in "Kernel Mode", this introduces a high risk for the stability of the system @@ -1404,10 +1314,10 @@ of Death" on a regular basis? PostScript drivers generally are very well tested. They are not known to cause any problems, even though they run in Kernel Mode too. This might be because there have so far only been 2 different PostScript -drivers the ones from Adobe and the one from Microsoft. Both are +drivers: the ones from Adobe and the one from Microsoft. Both are very well tested and are as stable as you ever can imagine on Windows. The CUPS driver is derived from the Microsoft one. -

    Workarounds impose Heavy Limitations

    +

    Workarounds impose Heavy Limitations

    In many cases, in an attempt to work around this problem, site administrators have resorted to restrict the allowed drivers installed on their WTS to one generic PCL- and one PostScript driver. This @@ -1415,7 +1325,7 @@ however restricts the clients in the amount of printer options available for them; often they can't get out more than simplex prints from one standard paper tray, while their devices could do much better, if driven by a different driver! ) -

    CUPS: a "Magical Stone"?

    +

    CUPS: a "Magical Stone"?

    Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very elegant way to overcome all these shortcomings. There are, depending on the version of Windows OS you use, up to 3 different PostScript @@ -1427,8 +1337,8 @@ is a certain price for this too: a CUPS server acting as a PostScript RIP for its clients requires more CPU and RAM than when just acting as a "raw spooling" device. Plus, this setup is not yet widely tested, although the first feedbacks look very promising. -

    PostScript Drivers with no major problems -- even in Kernel -Mode

    +

    PostScript Drivers with no major problems -- even in Kernel +Mode

    More recent printer drivers on W2K and XP don't run in Kernel mode (unlike Win NT) any more. However, both operating systems can still use the NT drivers, running in Kernel mode (you can roughly tell which @@ -1444,14 +1354,14 @@ development efforts. This is what the CUPS people have done. The license doesn't allow them to publish the whole of the source code. However, they have released the "diff" under the GPL, and if you are owner of an "MS DDK for Win NT", you can check the driver yourself. -

    Setting up CUPS for driver Download

    +

    Setting up CUPS for driver Download

    As we have said before: all previously known methods to prepare client printer drivers on the Samba server for download and "Point'n'Print" convenience of Windows workstations are working with CUPS too. These methods were described in the previous chapter. In reality, this is a pure Samba business, and only relates to the Samba/Win client relationship. -

    cupsaddsmb: the unknown Utility

    +

    cupsaddsmb: the unknown Utility

    The cupsaddsmb utility (shipped with all current CUPS versions) is an alternative method to transfer printer drivers into the Samba [print$] share. Remember, this share is where @@ -1476,53 +1386,26 @@ job-billing)

    However, currently only Windows NT, 2000, and XP are supported by the CUPS drivers. You will need to get the respective part of Adobe driver too if you need to support Windows 95, 98, and ME clients. -

    Prepare your smb.conf for -cupsaddsmb

    +

    Prepare your smb.conf for cupsaddsmb

    Prior to running cupsaddsmb, you need the following settings in smb.conf: -

    -
- [global]
-         load printers = yes
-         printing = cups
-         printcap name = cups
-
- [printers]
-         comment = All Printers
-         path = /var/spool/samba
-         browseable = no
-         public = yes
-         guest ok = yes           # setting depends on your requirements
-         writable = no
-         printable = yes
-         printer admin = root
-
- [print$]
-         comment = Printer Drivers
-         path = /etc/samba/drivers
-         browseable = yes
-         guest ok = no
-         read only = yes
-         write list = root  
-
-

    CUPS Package of "PostScript Driver for WinNT/2k/XP"

    -CUPS users may get the exactly same packages fromhttp://www.cups.org/software.html. +

    Example 19.3. smb.conf for cupsaddsmb usage

    [global]
    load printers = yes
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    public = yes
    # setting depends on your requirements
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root
    [print$]
    comment = Printer Drivers
    path = /etc/samba/drivers
    browseable = yes
    guest ok = no
    read only = yes
    write list = root

    CUPS Package of "PostScript Driver for WinNT/2k/XP"

    +CUPS users may get the exactly same packages from http://www.cups.org/software.html. It is a separate package from the CUPS base software files, tagged as -CUPS 1.1.x Windows NT/2k/XP Printer Driver for SAMBA +CUPS 1.1.x Windows NT/2k/XP Printer Driver for Samba (tar.gz, 192k). The filename to download is cups-samba-1.1.x.tar.gz. Upon untar-/unzip-ing, it will reveal these files: 

    -
-# tar xvzf cups-samba-1.1.19.tar.gz 
-
-   cups-samba.install
-   cups-samba.license
-   cups-samba.readme
-   cups-samba.remove
-   cups-samba.ss
-
+root# tar xvzf cups-samba-1.1.19.tar.gz
+cups-samba.install
+cups-samba.license
+cups-samba.readme
+cups-samba.remove
+cups-samba.ss

    + + These have been packaged with the ESP meta packager software "EPM". The *.install and *.remove files are simple shell scripts, which @@ -1532,26 +1415,20 @@ too). Then it puts the content into /usr/share/cups/drivers/. This content includes 3 files: 

    -
-# tar tv cups-samba.ss
-
-    cupsdrvr.dll
-    cupsui.dll
-    cups.hlp  
-
+root# tar tv cups-samba.ss
+cupsdrvr.dll
+cupsui.dll
+cups.hlp

    The cups-samba.install shell scripts is easy to handle: 

    -
-# ./cups-samba.install
-
-   [....]
-   Installing software...
-   Updating file permissions...
-   Running post-install commands...
-   Installation is complete.        
-
+root# ./cups-samba.install
+[....]
+Installing software...
+Updating file permissions...
+Running post-install commands...
+Installation is complete.

    The script should automatically put the driver files into the /usr/share/cups/drivers/ directory. @@ -1564,10 +1441,8 @@ copy/move the file (after running the ./cups-samba.install script) manually to the right place. 

    -
-   cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/
-
-

    +root# cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/ +

    This new CUPS PostScript driver is currently binary-only, but free of charge. No complete source code is provided (yet). The reason is this: it has been developed with the help of the Microsoft Driver @@ -1576,42 +1451,27 @@ Studio 6. Driver developers are not allowed to distribute the whole of the source code as Free Software. However, CUPS developers released the "diff" in source code under the GPL, so anybody with a license of Visual Studio and a DDK will be able to compile for him/herself. -

    Recognize the different Driver Files

    +

    Recognize the different Driver Files

    The CUPS drivers don't support the "older" Windows 95/98/ME, but only the Windows NT/2000/XP client: -

    -
- [Windows NT, 2000, and XP are supported by:]
-         cups.hlp
-         cupsdrvr.dll
-         cupsui.dll
-
-

    +

    Windows NT, 2000, and XP are supported by:

    +

    • cups.hlp

    • cupsdrvr.dll

    • cupsui.dll

    +

    Adobe drivers are available for the older Windows 95/98/ME as well as the Windows NT/2000/XP clients. The set of files is different for the different platforms. -

    -
- [Windows 95, 98, and Me are supported by:]
-         ADFONTS.MFM
-         ADOBEPS4.DRV
-         ADOBEPS4.HLP
-         DEFPRTR2.PPD
-         ICONLIB.DLL
-         PSMON.DLL
-
- [Windows NT, 2000, and XP are supported by:]
-         ADOBEPS5.DLL
-         ADOBEPSU.DLL
-         ADOBEPSU.HLP
+
    Windows 95, 98, and Me are supported by:
    
+	
    • ADFONTS.MFM
    • ADOBEPS4.DRV
    • ADOBEPS4.HLP
    • DEFPRTR2.PPD
    • ICONLIB.DLL
    • PSMON.DLL
    
+
    Windows NT, 2000, and XP are supported by:
    
+
    • ADOBEPS5.DLL
    • ADOBEPSU.DLL
    • ADOBEPSU.HLP
    
 
-

    Note

    +

    Note

    If both, the Adobe driver files and the CUPS driver files for the support of WinNT/2k/XP are present in , the Adobe ones will be ignored and the CUPS ones will be used. If you prefer -- for whatever reason -- to use Adobe-only drivers, move away the 3 CUPS driver files. The Win95/98/ME clients use the Adobe drivers in any case. -

    Acquiring the Adobe Driver Files

    +

    Acquiring the Adobe Driver Files

    Acquiring the Adobe driver files seems to be unexpectedly difficult for many users. They are not available on the Adobe website as single files and the self-extracting and/or self-installing Windows-exe is @@ -1624,12 +1484,12 @@ Generic PostScript printer. After this, the client's where you can get them with smbclient from the CUPS host. A more detailed description about this is in the next (the CUPS printing) chapter. -

    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"

    +

    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"

    Users of the ESP Print Pro software are able to install their "Samba Drivers" package for this purpose with no problem. Retrieve the driver files from the normal download area of the ESP Print Pro software -athttp://www.easysw.com/software.html. +at http://www.easysw.com/software.html. You need to locate the link labelled "SAMBA" amongst the Download Printer Drivers for ESP Print Pro 4.x area and download the package. Once installed, you can prepare any @@ -1640,7 +1500,7 @@ driver files; i.e. mainly setup the [print$] share, etc. The ESP Print Pro package includes the CUPS driver files as well as a (licensed) set of Adobe drivers for the Windows 95/98/ME client family. -

    Caveats to be considered

    +

    Caveats to be considered

    Once you have run the install script (and possibly manually moved the cups.hlp file to /usr/share/cups/drivers/), the driver is @@ -1651,6 +1511,7 @@ tree with WIN40 and "cupsaddsmb" (see also man cupsaddsmb for CUPS since release 1.1.16).

    Tip

    + You may need to put root into the smbpasswd file by running smbpasswd; this is especially important if you should run this whole procedure for the first time, and are not @@ -1672,6 +1533,7 @@ installations in the /usr/share/cups/drivers/ directory. The new cupsaddsmb (from 1.1.16) will automatically prefer "its own" drivers if it finds both.

  • + Should your Win clients have had the old ADOBE*.* files for the Adobe PostScript driver installed, the download and installation of the new CUPS PostScript driver for Windows NT/2k/XP @@ -1679,8 +1541,7 @@ will fail at first. You need to wipe the old driver from the clients first. It is not enough to "delete" the printer, as the driver files will still be kept by the clients and re-used if you try to re-install the printer. To really get rid of the Adobe driver files on the -clients, open the "Printers" folder (possibly via Start ---> Settings --> Control Panel --> Printers), +clients, open the "Printers" folder (possibly via Start, Settings, Control Panel, Printers), right-click onto the folder background and select Server Properties. When the new dialog opens, select the Drivers tab. On the list select the driver you @@ -1690,20 +1551,23 @@ which uses that particular driver. You need to "delete" all printers using this driver in the "Printers" folder first. You will need Administrator privileges to do this.

  • + Once you have successfully downloaded the CUPS PostScript driver to a client, you can easily switch all printers to this one by proceeding -as described elsewhere in the "Samba HOWTO Collection": either change +as described in the printing chapter: either change a driver for an existing printer by running the "Printer Properties" dialog, or use rpcclient with the setdriver sub-command.

    • -

    What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?

    +

    Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver

    You are interested in a comparison between the CUPS and the Adobe PostScript drivers? For our purposes these are the most important items which weigh in favor of the CUPS ones:

    • no hassle with the Adobe EULA

    • no hassle with the question “Where do I -get the ADOBE*.* driver files from?”

    • the Adobe drivers (on request of the printer PPD +get the ADOBE*.* driver files from?”

    • + + the Adobe drivers (on request of the printer PPD associated with them) often put a PJL header in front of the main PostScript part of the print file. Thus the printfile starts with <1B >%-12345X or @@ -1712,8 +1576,10 @@ of %!PS). This leads to the CUPS daemon auto-typing the incoming file as a print-ready file, not initiating a pass through the "pstops" filter (to speak more technically, it is not regarded as the generic MIME type + application/postscript, but as the more special MIME type + application/cups.vnd-postscript), which therefore also leads to the page accounting in /var/log/cups/page_log not @@ -1743,7 +1609,7 @@ not disturb any other applications as they will regard it as a comment and simply ignore it).

    • the CUPS PostScript driver will be the heart of the fully fledged CUPS IPP client for Windows NT/2K/XP to be released soon (probably alongside the first Beta release for CUPS -1.2).

    Run "cupsaddsmb" (quiet Mode)

    +1.2).

    Run "cupsaddsmb" (quiet Mode)

    The cupsaddsmb command copies the needed files into your [print$] share. Additionally, the PPD associated with this printer is copied from @@ -1752,124 +1618,111 @@ associated with this printer is copied from Windows client installations via Point'n'Print. Before we can run the command successfully, we need to be sure that we can authenticate towards Samba. If you have a small network you are probably using user -level security (security = user). Probably your -root has already a Samba account. Otherwise, create it now, using -smbpasswd: -

    -
- #  smbpasswd -a root 
- New SMB password: [type in password 'secret']
- Retype new SMB password: [type in password 'secret']
-
-

    +level security (security = user). +

    Here is an example of a successfully run cupsaddsmb command. 

    -
- #  cupsaddsmb -U root infotec_IS2027
- Password for root required to access localhost via SAMBA: [type in password 'secret']
-
+root# cupsaddsmb -U root infotec_IS2027
+Password for root required to access localhost via Samba: ['secret']

    To share all printers and drivers, use the --a parameter instead of a printer name. Since +-a parameter instead of a printer name. Since cupsaddsmb "exports" the printer drivers to Samba, it should be obvious that it only works for queues with a CUPS driver associated. -

    Run "cupsaddsmb" with verbose Output

    +

    Run "cupsaddsmb" with verbose Output

    Probably you want to see what's going on. Use the --v parameter to get a more verbose output. The +-v parameter to get a more verbose output. The output below was edited for better readability: all "\" at the end of a line indicate that I inserted an artificial line break plus some indentation here:

    Warning

    You will see the root password for the Samba account printed on -screen. If you use remote access, the password will go over the wire -unencrypted! -

    -
-  # cupsaddsmb -U root -v infotec_2105
-  Password for root required to access localhost via SAMBA:
-  Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir W32X86;put   \
-                   /var/spool/cups/tmp/3e98bf2d333b5 W32X86/infotec_2105.ppd;put           \
-                   /usr/share/cups/drivers/cupsdrvr.dll W32X86/cupsdrvr.dll;put            \
-                   /usr/share/cups/drivers/cupsui.dll W32X86/cupsui.dll;put                \
-                   /usr/share/cups/drivers/cups.hlp W32X86/cups.hlp'
-  added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
-  Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
-  NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86
-  putting file /var/spool/cups/tmp/3e98bf2d333b5 as \W32X86/infotec_2105.ppd (2328.8 kb/s) \
-               (average 2328.8 kb/s)
-  putting file /usr/share/cups/drivers/cupsdrvr.dll as \W32X86/cupsdrvr.dll (9374.3 kb/s)  \
-               (average 5206.6 kb/s)
-  putting file /usr/share/cups/drivers/cupsui.dll as \W32X86/cupsui.dll (8107.2 kb/s)      \
-               (average 5984.1 kb/s)
-  putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp (3475.0 kb/s)          \
-               (average 5884.7 kb/s)
+screen. 
+
    +root# cupsaddsmb -U root -v infotec_2105
+Password for root required to access localhost via GANDALF:
+Running command: smbclient //localhost/print\$ -N -U'root%secret' \
+    -c 'mkdir W32X86; \
+    put /var/spool/cups/tmp/3e98bf2d333b5 W32X86/infotec_2105.ppd; \
+	put /usr/share/cups/drivers/cupsdrvr.dll W32X86/cupsdrvr.dll; \
+    put /usr/share/cups/drivers/cupsui.dll W32X86/cupsui.dll; \
+    put /usr/share/cups/drivers/cups.hlp W32X86/cups.hlp'
+added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
+NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86
+putting file /var/spool/cups/tmp/3e98bf2d333b5 as \W32X86/infotec_2105.ppd
+putting file /usr/share/cups/drivers/cupsdrvr.dll as \W32X86/cupsdrvr.dll
+putting file /usr/share/cups/drivers/cupsui.dll as \W32X86/cupsui.dll
+putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp
   
-  Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows NT x86"   \
-                   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:   \
-                   RAW:NULL"'
-  cmd = adddriver "Windows NT x86" "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll: \
-                   cups.hlp:NULL:RAW:NULL"
-  Printer Driver infotec_2105 successfully installed.
+Running command: rpcclient localhost -N -U'root%secret' 
+   -c 'adddriver "Windows NT x86"   \
+   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:   \
+    RAW:NULL"'
+cmd = adddriver "Windows NT x86" \
+    "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:RAW:NULL"
+Printer Driver infotec_2105 successfully installed.
   
-  Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir WIN40;put    \
-                   /var/spool/cups/tmp/3e98bf2d333b5 WIN40/infotec_2105.PPD; put           \
-                   /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;put               \
-                   /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV;put             \
-                   /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP;put             \
-                   /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD;put             \
-                   /usr/share/cups/drivers/ICONLIB.DLL
-  WIN40/ICONLIB.DLL;put /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;'
+Running command: smbclient //localhost/print\$ -N -U'root%secret' \
+-c 'mkdir WIN40; \
+    put /var/spool/cups/tmp/3e98bf2d333b5 WIN40/infotec_2105.PPD; \
+	put /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;   \
+    put /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV; \
+    put /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP; \
+    put /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD; \
+	put /usr/share/cups/drivers/ICONLIB.DLL WIN40/ICONLIB.DLL; \
+	put /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;'
   added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
-  Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+  Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
   NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40
-  putting file /var/spool/cups/tmp/3e98bf2d333b5 as \WIN40/infotec_2105.PPD (2328.8 kb/s)  \
-               (average 2328.8 kb/s)
-  putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM (9368.0 kb/s)     \
-               (average 6469.6 kb/s)
-  putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV (9958.2 kb/s)   \
-               (average 8404.3 kb/s)
-  putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP (8341.5 kb/s)   \
-               (average 8398.6 kb/s)
-  putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD (2195.9 kb/s)   \
-               (average 8254.3 kb/s)
-  putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL (8239.9 kb/s)     \
-               (average 8253.6 kb/s)
-  putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL (6222.2 kb/s)         \
-               (average 8188.5 kb/s)
+  putting file /var/spool/cups/tmp/3e98bf2d333b5 as \WIN40/infotec_2105.PPD
+  putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM
+  putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV
+  putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP
+  putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD
+  putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL
+  putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL
   
-  Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows 4.0"      \
-                   "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP:          \
-                   PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL,     \
-                   ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
+  Running command: rpcclient localhost -N -U'root%secret' \
+   -c 'adddriver "Windows 4.0"      \
+   "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP: \
+   PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL, \
+    ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
   cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:          \
-                   ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,  \
+    ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,  \
                    PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"
   Printer Driver infotec_2105 successfully installed.
   
-  Running command: rpcclient localhost -N -U'root%secret'                                  \
-                             -c 'setdriver infotec_2105 infotec_2105'
+  Running command: rpcclient localhost -N -U'root%secret'  \
+   -c 'setdriver infotec_2105 infotec_2105'
   cmd = setdriver infotec_2105 infotec_2105
   Successfully set infotec_2105 to driver infotec_2105.

    -If you look closely, you'll discover your root password was transfered +If you look closely, you'll discover your root password was transferred unencrypted over the wire, so beware! Also, if you look further her, you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in between. They occur, because the directories WIN40 and W32X86 already existed in the [print$] driver download share (from a previous driver installation). They are harmless here. -

    Understanding cupsaddsmb

    +

    Understanding cupsaddsmb

    What has happened? What did cupsaddsmb do? There are five stages of the procedure -

    1. call the CUPS server via IPP and request the +

      1. + + call the CUPS server via IPP and request the driver files and the PPD file for the named printer;

      2. store the files temporarily in the local TEMPDIR (as defined in cupsd.conf);

      3. connect via smbclient to the Samba server's [print$] share and put the files into the share's WIN40 (for Win95/98/ME) and W32X86/ (for WinNT/2k/XP) sub - directories;

      4. connect via rpcclient to the Samba server and + directories;

      5. + + connect via rpcclient to the Samba server and execute the "adddriver" command with the correct -parameters;

      6. connect via rpcclient to the Samba server a second +parameters;

      7. + + connect via rpcclient to the Samba server a second time and execute the "setdriver" command.

      Note, that you can run the cupsaddsmb utility with parameters to specify one remote host as Samba host and a second remote host as CUPS @@ -1878,10 +1731,8 @@ good idea try it and see more clearly what is going on (though in real life most people will have their CUPS and Samba servers run on the same host): 

      -
- # cupsaddsmb -H sambaserver -h cupsserver -v printername
-
-

    How to recognize if cupsaddsm completed successfully

    +root# cupsaddsmb -H sambaserver -h cupsserver -v printername +

    How to recognize if cupsaddsmb completed successfully

    You must always check if the utility completed successfully in all fields. You need as a minimum these 3 messages amongst the output: @@ -1892,7 +1743,7 @@ installed. # (for the WIN40 == Win9x/ME architecture...)

  • Successfully set [printerXPZ] to driver [printerXYZ].

    • These messages probably not easily recognized in the general -output. If you run cupsaddsmb with the -a +output. If you run cupsaddsmb with the -a parameter (which tries to prepare all active CUPS printer drivers for download), you might miss if individual printers drivers had problems to install properly. Here a redirection of the @@ -1902,32 +1753,30 @@ It is impossible to see any diagnostic output if you don't run cupsaddsmb in verbose mode. Therefore we strongly recommend to not use the default quiet mode. It will hide any problems from you which might occur. -

    cupsaddsmb with a Samba PDC

    +

    cupsaddsmb with a Samba PDC

    You can't get the standard cupsaddsmb command to run on a Samba PDC? You are asked for the password credential all over again and again and the command just will not take off at all? Try one of these variations: 

    -
- # cupsaddsmb -U DOMAINNAME\\root -v printername
- # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -v printername
- # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -h cups-server -v printername
-
+root# cupsaddsmb -U MIDEARTH\\root -v printername
+root# cupsaddsmb -H SAURON -U MIDEARTH\\root -v printername
+root# cupsaddsmb -H SAURON -U MIDEARTH\\root -h cups-server -v printername

    (Note the two backslashes: the first one is required to "escape" the second one). -

    cupsaddsmb Flowchart

    +

    cupsaddsmb Flowchart

    Here is a chart about the procedures, commandflows and dataflows of the "cupaddsmb" command. Note again: cupsaddsmb is not intended to, and does not work with, "raw" queues!

    -

    Figure 19.14. cupsaddsmb flowchart

    cupsaddsmb flowchart

    -

    Installing the PostScript Driver on a Client

    +

    Figure 19.16. cupsaddsmb flowchart

    cupsaddsmb flowchart

    +

    Installing the PostScript Driver on a Client

    After cupsaddsmb completed, your driver is prepared for the clients to use. Here are the steps you must perform to download and install it via "Point'n'Print". From a Windows client, browse to the CUPS/Samba server; -

    • open the Printers +

      • open the Printers share of Samba in Network Neighbourhood;

      • right-click on the printer in question;

      • from the opening context-menu select Install... or @@ -1942,6 +1791,7 @@ an application like Winword, the new printer will appears in a \\SambaServer\PrinterName entry in the dropdown list of available printers.

        Note

        + cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher and Samba from 2.2.4. If it doesn't work, or if the automatic printer driver download to the clients doesn't succeed, you can still manually @@ -1949,16 +1799,14 @@ install the CUPS printer PPD on top of the Adobe PostScript driver on clients. Then point the client's printer queue to the Samba printer share for a UNC type of connection: 

        -
-  net use lpt1: \\sambaserver\printershare /user:ntadmin
-
+C:\> net use lpt1: \\sambaserver\printershare /user:ntadmin

        should you desire to use the CUPS networked PostScript RIP functions. (Note that user "ntadmin" needs to be a valid Samba user with the required privileges to access the printershare) This would set up the printer connection in the traditional LanMan way (not using MS-RPC). -

      Avoiding critical PostScript Driver Settings on the +

      Avoiding critical PostScript Driver Settings on the Client

      Soooo: printing works, but there are still problems. Most jobs print well, some don't print at all. Some jobs have problems with fonts, @@ -1984,7 +1832,7 @@ get a printout at all) (Adobe)

    • Sometimes you can choose : in case of problems try 2 instead of 3 (the latest ESP Ghostscript package handles Level 3 PostScript very well) (Adobe).

    • Say Yes to PostScript -Error Handler (Adobe)

    Installing PostScript Driver Files manually (using +Error Handler (Adobe)

    Installing PostScript Driver Files manually (using rpcclient)

    Of course you can run all the commands which are embedded into the cupsaddsmb convenience utility yourself, one by one, and hereby upload @@ -1992,9 +1840,18 @@ and prepare the driver files for future client downloads.

    1. prepare Samba (a CUPS printqueue with the name of the printer should be there. We are providing the driver now);

    2. copy all files to -[print$]:

    3. run rpcclient adddriver -(for each client architecture you want to support):

    4. run rpcclient + [print$]

    5. + + run rpcclient adddriver +(for each client architecture you want to support):

    6. + + run rpcclient setdriver.

    + + + + + We are going to do this now. First, read the man page on "rpcclient" to get a first idea. Look at all the printing related sub-commands. enumprinters, @@ -2005,7 +1862,7 @@ the MS-RPC protocol. You can use it to query (and command) a Win NT (or 2K/XP) PC too. MS-RPC is used by Windows clients, amongst other things, to benefit from the "Point'n'Print" features. Samba can now mimic this too. -

    A Check of the rpcclient man Page

    +

    A Check of the rpcclient man Page

    First let's have a little check of the rpcclient man page. Here are two relevant passages:

    @@ -2038,18 +1895,16 @@ printer driver associated with an installed printer. The printer driver must already be correctly installed on the print server.

    See also the enumprinters and enumdrivers commands for obtaining a list of installed printers and drivers. -

    Understanding the rpcclient man Page

    +

    Understanding the rpcclient man page

    The exact format isn't made too clear by the man page, since you have to deal with some parameters containing spaces. Here is a better description for it. We have line-broken the command and indicated the breaks with "\". Usually you would type the command in one line without the linebreaks: -

    -
+
      adddriver "Architecture" \
            "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\
            LanguageMonitorFile:DataType:ListOfFiles,Comma-separated"
-
 
    
 What the man pages denotes as a simple <config>
 keyword, does in reality consist of 8 colon-separated fields. The
@@ -2074,22 +1929,22 @@ box now, and access it from a UNIX workstation. We will query it
 with rpcclient to see what it tells us and
 try to understand the man page more clearly which we've read just
 now.
-

    Producing an Example by querying a Windows Box

    +

    Producing an Example by querying a Windows Box

    + + We could run rpcclient with a getdriver or a getprinter subcommand (in level 3 verbosity) against it. Just sit down at UNIX or Linux workstation with the Samba utilities installed. Then type the following command: 

    -
- rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3'
-
+root# rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3'

    From the result it should become clear which is which. Here is an example from my installation: -

    -
-# rpcclient -U'Danka%xxxx' W2KSERVER -c'getdriver "DANKA InfoStream Virtual Printer" 3'
+
    +root# rpcclient -U'Danka%xxxx' W2KSERVER \
+	-c'getdriver "DANKA InfoStream Virtual Printer" 3'
  cmd = getdriver "DANKA InfoStream Virtual Printer" 3
 
  [Windows NT x86]
@@ -2119,15 +1974,16 @@ Some printer drivers list additional files under the label
 ListOfFiles,Comma-separated. For the CUPS
 PostScript drivers we don't need any (nor would we for the Adobe
 PostScript driver): therefore the field will get a "NULL" entry.
-

    What is required for adddriver and setdriver to succeed

    +

    What is required for adddriver and setdriver to succeed

    From the manpage (and from the quoted output of cupsaddsmb, above) it becomes clear that you need to have certain conditions in order to make the manual uploading and initializing of the driver files succeed. The two rpcclient + subcommands (adddriver and setdriver) need to encounter the following pre-conditions to complete successfully: -

    • you are connected as "printer admin", or root (note, +

      • you are connected as printer admin, or root (note, that this is not the "Printer Operators" group in NT, but the printer admin group, as defined in the [global] section of @@ -2142,7 +1998,10 @@ to escape the "$": smbclient //sambaserver/print\$ root);

      • the user you're connecting as must be able to write to the [print$] share and create subdirectories;

      • the printer you are going to setup for the Windows -clients, needs to be installed in CUPS already;

      • the CUPS printer must be known to Samba, otherwise the +clients, needs to be installed in CUPS already;

      • + + + the CUPS printer must be known to Samba, otherwise the setdriver subcommand fails with an NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by Samba you may use the enumprinters subcommand to @@ -2150,30 +2009,25 @@ rpcclient. A long-standing bug prevented a proper update of the printer list until every smbd process had received a SIGHUP or was restarted. Remember this in case you've created the CUPS printer just shortly ago and encounter problems: try restarting -Samba.

    Manual Commandline Driver Installation in 15 little Steps

    +Samba.

    Manual Driver Installation in 15 Steps

    We are going to install a printer driver now by manually executing all required commands. As this may seem a rather complicated process at first, we go through the procedure step by step, explaining every single action item as it comes up. -

    First Step: Install the Printer on CUPS

    -
-# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P /home/kurt/canonIR85.ppd
-
+
    Procedure 19.1. Manual Driver Installation installation
    1. Install the Printer on CUPS
      +root# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P canonIR85.ppd
 
      
 This installs printer with the name mysmbtstprn
 to the CUPS system. The printer is accessed via a socket
 (a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root
 for this step
-
    Second Step (optional): Check if the Printer is recognized by
-Samba
    -
- # rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn
-
-        flags:[0x800000]
-        name:[\\kde-bitshop\mysmbtstprn]
-        description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn]
-        comment:[mysmbtstprn]
-
+
  • (optional) Check if the Printer is recognized by
+Samba
    +root# rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn
+flags:[0x800000]
+name:[\\kde-bitshop\mysmbtstprn]
+description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn]
+comment:[mysmbtstprn]
 
    
 This should show the printer in the list. If not, stop and re-start
 the Samba daemon (smbd), or send a HUP signal: kill -HUP
@@ -2185,24 +2039,25 @@ already. You need to know root's Samba password (as set by the
 following steps. Alternatively you can authenticate as one of the
 users from the "write list" as defined in smb.conf for
 [print$].
-
    • Third Step (optional): Check if Samba knows a Driver for the
-Printer
    -
-#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
-         drivername:[]
+
  • (optional) Check if Samba knows a Driver for the
+Printer
    +root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
+			| grep driver 
+drivername:[]
+
+root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
+	| grep -C4 driv
+servername:[\\kde-bitshop]
+printername:[\\kde-bitshop\mysmbtstprn]
+sharename:[mysmbtstprn]
+portname:[Samba Printer Port]
+drivername:[]
+comment:[mysmbtstprn]
+location:[]
+sepfile:[]
+printprocessor:[winprint]
  
-#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv
-        servername:[\\kde-bitshop]
-        printername:[\\kde-bitshop\mysmbtstprn]
-        sharename:[mysmbtstprn]
-        portname:[Samba Printer Port]
-        drivername:[]
-        comment:[mysmbtstprn]
-        location:[]
-        sepfile:[]
-        printprocessor:[winprint]
- 
-#  rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
+root# rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
  result was WERR_UNKNOWN_PRINTER_DRIVER
 
 
    
@@ -2211,16 +2066,14 @@ This step was done for the purpose of demonstrating this condition. An
 attempt to connect to the printer at this stage will prompt the
 message along the lines: "The server has not the required printer
 driver installed".
-
    • Fourth Step: Put all required Driver Files into Samba's
-[print$]
    -
-#  smbclient //localhost/print\$ -U 'root%xxxx'                        \ 
-                              -c 'cd W32X86;                                             \
-                                  put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD;     \
-                                  put /usr/share/cups/drivers/cupsui.dll cupsui.dll;     \
-                                  put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \
-                                  put /usr/share/cups/drivers/cups.hlp cups.hlp'
-
+
  • Put all required Driver Files into Samba's
+[print$]
    +root# smbclient //localhost/print\$ -U 'root%xxxx' \
+	-c 'cd W32X86; \
+	put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD; \ 
+	put /usr/share/cups/drivers/cupsui.dll cupsui.dll; \
+	put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \
+	put /usr/share/cups/drivers/cups.hlp cups.hlp'
 
    
 (Note that this command should be entered in one long single
 line. Line-breaks and the line-end indicating "\" has been inserted
@@ -2230,31 +2083,26 @@ present in the [print$] share. However, client
 would still not be able to install them, because Samba does not yet
 treat them as driver files. A client asking for the driver would still
 be presented with a "not installed here" message.
-
    • Fifth Step: Verify where the Driver Files are now
    -
-#  ls -l /etc/samba/drivers/W32X86/
- total 669
- drwxr-sr-x    2 root     ntadmin       532 May 25 23:08 2
- drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
- -rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
- -rwxr--r--    1 root     ntadmin    278380 May 25 23:21 cupsdrvr.dll
- -rwxr--r--    1 root     ntadmin    215848 May 25 23:21 cupsui.dll
- -rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
-
+
  • Verify where the Driver Files are now
    +root# ls -l /etc/samba/drivers/W32X86/
+total 669
+drwxr-sr-x    2 root     ntadmin       532 May 25 23:08 2
+drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
+-rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
+-rwxr--r--    1 root     ntadmin    278380 May 25 23:21 cupsdrvr.dll
+-rwxr--r--    1 root     ntadmin    215848 May 25 23:21 cupsui.dll
+-rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
 
    
 The driver files now are in the W32X86 architecture "root" of
 [print$].
-
    • Sixth Step: Tell Samba that these are
+
  • Tell Samba that these are
 Driver Files
-(adddriver)
    • -
-#  rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \
-                                          cupsdrvr.dll:mysmbtstprn.PPD:                  \
-                                          cupsui.dll:cups.hlp:NULL:RAW[:]NULL"             \
-                                          localhost
-
- Printer Driver mydrivername successfully installed.
-
+(adddriver)
    +root# rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \
+  cupsdrvr.dll:mysmbtstprn.PPD: \
+  cupsui.dll:cups.hlp:NULL:RAW:NULL" \
+  localhost
+Printer Driver mydrivername successfully installed.
 
    
 Note that your cannot repeat this step if it fails. It could fail even
 as a result of a simple typo. It will most likely have moved a part of
@@ -2265,49 +2113,41 @@ driver. It is normally a good idea to use the same name as is used for
 the printername; however, in big installations you may use this driver
 for a number of printers which have obviously different names. So the
 name of the driver is not fixed.
-
    Seventh Step: Verify where the Driver Files are now
    -
-#  ls -l /etc/samba/drivers/W32X86/
- total 1
- drwxr-sr-x    2 root     ntadmin       532 May 25 23:22 2
- drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
-
- 
-#  ls -l /etc/samba/drivers/W32X86/2
- total 5039
- [....]
- -rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
- -rwxr--r--    1 root     ntadmin    278380 May 13 13:53 cupsdrvr.dll
- -rwxr--r--    1 root     ntadmin    215848 May 13 13:53 cupsui.dll
- -rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
-
+
  • Verify where the Driver Files are now
    +root# ls -l /etc/samba/drivers/W32X86/
+total 1
+drwxr-sr-x    2 root     ntadmin       532 May 25 23:22 2
+drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
+
+root# ls -l /etc/samba/drivers/W32X86/2
+total 5039
+[....]
+-rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
+-rwxr--r--    1 root     ntadmin    278380 May 13 13:53 cupsdrvr.dll
+-rwxr--r--    1 root     ntadmin    215848 May 13 13:53 cupsui.dll
+-rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
 
    
 Notice how step 6 did also move the driver files to the appropriate
 subdirectory. Compare with the situation after step 5.
-
    • Eighth Step (optional): Verify if Samba now recognizes the
-Driver
    -
-#  rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost | grep -B2 -A5 mydrivername
-
- Printer Driver Info 3:
-        Version: [2]
-        Driver Name: [mydrivername]
-        Architecture: [Windows NT x86]
-        Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
-        Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
-        Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
-        Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
-
+
  • (optional) Verify if Samba now recognizes the
+Driver
    +root# rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost \
+	| grep -B2 -A5 mydrivername
+Printer Driver Info 3:
+Version: [2]
+Driver Name: [mydrivername]
+Architecture: [Windows NT x86]
+Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
+Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
+Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
+Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
 
    
 Remember, this command greps for the name you did choose for the
 driver in step Six. This command must succeed before you can proceed.
-
    • Ninth Step: Tell Samba which Printer should use these Driver
-Files (setdriver)
    -
-#  rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost
- 
- Successfully set mysmbtstprn to driver mydrivername
-
+
  • Tell Samba which Printer should use these Driver
+Files (setdriver)
    +root# rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost
+Successfully set mysmbtstprn to driver mydrivername
 
    
 Since you can bind any printername (=printqueue) to any driver, this
 is a very convenient way to setup many queues which use the same
@@ -2315,50 +2155,53 @@ driver. You don't need to repeat all the previous steps for the
 setdriver command to succeed. The only pre-conditions are:
 enumdrivers must find the driver and
 enumprinters must find the printer.
-
    • Tenth Step (optional): Verify if Samba has this Association
-recognized
    -
-#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
-       drivername:[mydrivername]
+
  • (optional) Verify if Samba has this Association
+recognized
    +root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
+  | grep driver
+drivername:[mydrivername]
  
-#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv
-       servername:[\\kde-bitshop]
-       printername:[\\kde-bitshop\mysmbtstprn]
-       sharename:[mysmbtstprn]
-       portname:[Done]
-       drivername:[mydrivername]
-       comment:[mysmbtstprn]
-       location:[]
-       sepfile:[]
-       printprocessor:[winprint]
+root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
+  | grep -C4 driv
+servername:[\\kde-bitshop]
+printername:[\\kde-bitshop\mysmbtstprn]
+sharename:[mysmbtstprn]
+portname:[Done]
+drivername:[mydrivername]
+comment:[mysmbtstprn]
+location:[]
+sepfile:[]
+printprocessor:[winprint]
  
-#  rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
- [Windows NT x86]
- Printer Driver Info 3:
-       Version: [2]
-       Driver Name: [mydrivername]
-       Architecture: [Windows NT x86]
-       Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
-       Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
-       Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
-       Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
-       Monitorname: []
-       Defaultdatatype: [RAW]
-       Monitorname: []
-       Defaultdatatype: [RAW]
+root# rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
+[Windows NT x86]
+Printer Driver Info 3:
+     Version: [2]
+     Driver Name: [mydrivername]
+     Architecture: [Windows NT x86]
+     Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
+     Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
+     Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
+     Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
+     Monitorname: []
+     Defaultdatatype: [RAW]
+     Monitorname: []
+     Defaultdatatype: [RAW]
  
-#  rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn
-       name:[\\kde-bitshop\mysmbtstprn]
-       description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn]
-       comment:[mysmbtstprn]
+root# rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn
+     name:[\\kde-bitshop\mysmbtstprn]
+     description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn]
+     comment:[mysmbtstprn]
 
 
    
+
 Compare these results with the ones from steps 2 and 3. Note that
 every single of these commands show the driver is installed.  Even
 the enumprinters command now lists the driver
 on the "description" line.
-
    • Eleventh Step (optional): Tickle the Driver into a correct
-Device Mode
    
+
  • (optional) Tickle the Driver into a correct
+Device Mode
    
+
 You certainly know how to install the driver on the client.  In case
 you are not particularly familiar with Windows, here is a short
 recipe: browse the Network Neighbourhood, go to the Samba server, look
@@ -2375,39 +2218,32 @@ It is important that you execute this step as a Samba printer admin
 to do this on Windows XP. It uses a commandline, which you may type
 into the "DOS box" (type root's smbpassword when prompted):
 
    -
- C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n \\sambacupsserver\mysmbtstprn"
-
+C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n\
+			\\sambacupsserver\mysmbtstprn"
 
    
-Change any printer setting once (like "portrait"
---> "landscape"), click "Apply"; change the setting
+Change any printer setting once (like changing "portrait" to
+	"landscape"), click Apply; change the setting
 back.
-
    • Twelfth Step: Install the Printer on a Client
-("Point'n'Print")
    -
- C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn"
-
+
  • Install the Printer on a Client
+("Point'n'Print")
    +C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn"
 
    
 If it doesn't work it could be a permission problem with the
 [print$] share.
-
    • Thirteenth Step (optional): Print a Test Page
    -
- C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn"
-
+
  • Thirteenth Step (optional): Print a Test Page
    +C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn"
 
    
 Then hit [TAB] 5 times, [ENTER] twice, [TAB] once and [ENTER] again
 and march to the printer.
-
    • Fourteenth Step (recommended): Study the Test Page
    
+
  • Fourteenth Step (recommended): Study the Test Page
    
 Hmmm.... just kidding! By now you know everything about printer
 installations and you don't need to read a word. Just put it in a
 frame and bolt it to the wall with the heading "MY FIRST
 RPCCLIENT-INSTALLED PRINTER" - why not just throw it away!
-
    • Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your
-Success
    -
-# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd     
-
-

    Troubleshooting revisited

    +

  • Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your +Success

    +root# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd
+

    • Troubleshooting revisited

    The setdriver command will fail, if in Samba's mind the queue is not already there. You had promising messages about the: 

    @@ -2422,7 +2258,8 @@ a disappointing message like this one beneath?
  result was NT_STATUS_UNSUCCESSFUL

    -It is not good enough that you + +It is not good enough that you can see the queue in CUPS, using the lpstat -p ir85wm command. A bug in most recent versions of Samba prevents the proper update of @@ -2431,26 +2268,35 @@ fails unless you re-start Samba or send a HUP to all smbd processes. To verify if this is the reason why Samba doesn't execute the setdriver command successfully, check if Samba "sees" the printer: -

    -
-# rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep  ir85wm
+
    +root# rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep  ir85wm
         printername:[ir85wm]
-
 
    
 An alternative command could be this: 
-
    -
-# rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' 
+
    +root# rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' 
         cmd = getprinter ir85wm
         flags:[0x800000]
         name:[\\transmeta\ir85wm]
         description:[\\transmeta\ir85wm,ir85wm,DPD]
         comment:[CUPS PostScript-Treiber for WinNT/2K/XP]
-
 
    
 BTW, you can use these commands, plus a few more, of course,
 to install drivers on remote Windows NT print servers too!
-

    The printing *.tdb Files

    +

    The printing *.tdb Files

    + + + + + + + + + + + + + Some mystery is associated with the series of files with a tdb-suffix appearing in every Samba installation. They are connections.tdb, @@ -2465,12 +2311,12 @@ tdb-suffix appearing in every Samba installation. They are ntprinters.tdb, sessionid.tdb and secrets.tdb. What is their purpose? -

    Trivial DataBase Files

    +

    Trivial DataBase Files

    A Windows NT (Print) Server keeps track of all information needed to serve its duty toward its clients by storing entries in the Windows "Registry". Client queries are answered by reading from the registry, Administrator or user configuration settings are saved by writing into -the Registry. Samba and Unix obviously don't have such a kind of +the Registry. Samba and UNIX obviously don't have such a kind of Registry. Samba instead keeps track of all client related information in a series of *.tdb files. (TDB = Trivial Data Base). These are often located in /var/lib/samba/ @@ -2478,7 +2324,7 @@ or /var/lock/samba/ . The printing related files are ntprinters.tdb, printing.tdb,ntforms.tdb and ntdrivers.tdb. -

    Binary Format

    +

    Binary Format

    *.tdb files are not human readable. They are written in a binary format. "Why not ASCII?", you may ask. "After all, ASCII configuration files are a good and proofed tradition on UNIX." @@ -2491,7 +2337,7 @@ same time. The file format of Samba's *.tdb files allows for this provision. Many smbd processes may write to the same *.tdb file at the same time. This wouldn't be possible with pure ASCII files. -

    Losing *.tdb Files

    +

    Losing *.tdb Files

    It is very important that all *.tdb files remain consistent over all write and read accesses. However, it may happen that these files do get corrupted. (A @@ -2501,13 +2347,12 @@ etc.). In cases of trouble, a deletion of the old printing-related *.tdb files may be the only option. You need to re-create all print related setup after that. Or you have made a backup of the *.tdb files in time. -

    Using tdbbackup

    +

    Using tdbbackup

    Samba ships with a little utility which helps the root user of your system to back up your *.tdb files. If you run it with no argument, it prints a little usage message: 

    -
-# tdbbackup
+root# tdbbackup
  Usage: tdbbackup [options] <fname...>
  
  Version:3.0a
@@ -2518,32 +2363,30 @@ with no argument, it prints a little usage message:

    Here is how I backed up my printing.tdb file: 

    -
-# ls 
- .           browse.dat       locking.tdb     ntdrivers.tdb   printing.tdb    share_info.tdb
- ..          connections.tdb  messages.tdb    ntforms.tdb     printing.tdbkp  unexpected.tdb
- brlock.tdb  gmon.out         namelist.debug  ntprinters.tdb  sessionid.tdb
+root# ls
+.              browse.dat       locking.tdb     ntdrivers.tdb   printing.tdb
+..             share_info.tdb   connections.tdb messages.tdb    ntforms.tdb
+printing.tdbkp unexpected.tdb   brlock.tdb      gmon.out        namelist.debug  
+ntprinters.tdb sessionid.tdb
  
- kde-bitshop:/var/lock/samba # tdbbackup -s .bak printing.tdb
+root# tdbbackup -s .bak printing.tdb
  printing.tdb : 135 records
  
- kde-bitshop:/var/lock/samba # ls -l printing.tdb*
+root# ls -l printing.tdb*
  -rw-------    1 root     root        40960 May  2 03:44 printing.tdb
  -rw-------    1 root     root        40960 May  2 03:44 printing.tdb.bak
 
-

    CUPS Print Drivers from Linuxprinting.org

    +

    CUPS Print Drivers from Linuxprinting.org

    CUPS ships with good support for HP LaserJet type printers. You can install the generic driver as follows: -

    -
-lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
-
+
    +root# lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
 
    
-The -m switch will retrieve the
+The -m switch will retrieve the
 laserjet.ppd from the standard repository for
 not-yet-installed-PPDs, which CUPS typically stores in
 /usr/share/cups/model. Alternatively, you may use
--P /path/to/your.ppd.
+-P /path/to/your.ppd.
 
    
 The generic laserjet.ppd however does not support every special option
 for every LaserJet-compatible model. It constitutes a sort of "least
@@ -2555,6 +2398,7 @@ best used for each printer. Its database is kept current by the
 tireless work of Till Kamppeter from MandrakeSoft, who is also the
 principal author of the foomatic-rip utility.
 
    Note
    
+
 The former "cupsomatic" concept is now be replaced by the new, much
 more powerful "foomatic-rip". foomatic-rip is the successor of
 cupsomatic. cupsomatic is no longer maintained. Here is the new URL
@@ -2565,7 +2409,7 @@ not work with PPDs generated for the old cupsomatic. The new-style
 PPDs are 100% compliant to the Adobe PPD specification. They are
 intended to be used by Samba and the cupsaddsmb utility also, to
 provide the driver files for the Windows clients also!
-
    foomatic-rip and Foomatic explained
    
+
    foomatic-rip and Foomatic explained
    
 Nowadays most Linux distros rely on the utilities of Linuxprinting.org
 to create their printing related software (which, BTW, works on all
 UNIXes and on Mac OS X or Darwin too). It is not known as well as it
@@ -2582,7 +2426,7 @@ its Foomatic<
 database. Currently there are 245 drivers
 in the database: many drivers support various models, and many models
 may be driven by different drivers; it's your choice!
-
    690 "perfect" Printers
    
+
    690 "perfect" Printers
    
 At present there are 690 devices dubbed as working "perfectly", 181
 "mostly", 96 "partially" and 46 are "Paperweights". Keeping in mind
 that most of these are non-PostScript models (PostScript printers are
@@ -2593,7 +2437,7 @@ doesn't also scan and copy and fax under GNU/Linux: then this is a
 truly astonishing achievement. Three years ago the number was not
 more than 500, and Linux or UNIX "printing" at the time wasn't
 anywhere near the quality it is today!
-
    How the "Printing HOWTO" started it all
    
+
    How the "Printing HOWTO" started it all
    
 A few years ago Grant Taylor
 started it all. The roots of today's Linuxprinting.org are in the
 first Linux Printing
@@ -2607,7 +2451,7 @@ hardware and driver zoo that made up Linux printing of the time. This
 database became the core component of today's Foomatic collection of
 tools and data. In the meantime it has moved to an XML representation
 of the data.
-
    Foomatic's strange Name
    
+
    Foomatic's strange Name
    
 "Why the funny name?", you ask. When it really took off, around spring
 2000, CUPS was far less popular than today, and most systems used LPD,
 LPRng or even PDQ to print. CUPS shipped with a few generic "drivers"
@@ -2630,7 +2474,7 @@ developments available for CUPS;
  • It made available a lot of addit
 to CUPS users (because often the "traditional" Ghostscript way of
 printing was the only one available);
  • It gave all the advanced CUPS options (web interface,
 GUI driver configurations) to users wanting (or needing) to use
-Ghostscript filters.
    • cupsomatic, pdqomatic, lpdomatic, directomatic
    
+Ghostscript filters.
    cupsomatic, pdqomatic, lpdomatic, directomatic
    
 CUPS worked through a quickly-hacked up filter script named cupsomatic.
 cupsomatic ran the printfile through Ghostscript, constructing
 automatically the rather complicated command line needed. It just
@@ -2664,8 +2508,8 @@ Foomatic up to versions 2.0.x required (ugly) Perl data structures
 attached the Linuxprinting.org PPDs for CUPS. It had a different
 "*omatic" script for every spooler, as well as different printer
 configuration files..
-
    7.13.1.5.The Grand Unification
-achieved...
    
+
    The Grand Unification
+achieved...
    
 This all has changed in Foomatic versions 2.9 (Beta) and released as
 "stable" 3.0. This has now achieved the convergence of all *omatic
 scripts: it is called the foomatic-rip.
@@ -2700,7 +2544,7 @@ sizes for many printers; and it will support printing on media drawn
 from different paper trays within the same job (in both cases: even
 where there is no support for this from Windows-based vendor printer
 drivers).
-
    Driver Development outside
    
+
    Driver Development outside
    
 Most driver development itself does not happen within
 Linuxprinting.org. Drivers are written by independent maintainers.
 Linuxprinting.org just pools all the information, and stores it in its
@@ -2713,7 +2557,7 @@ the work is currently done in three projects. These are:
 
    • Omni
 -- a Free Software project by IBM which tries to convert their printer
 driver knowledge from good-ol' OS/2 times into a modern, modular,
-universal driver architecture for Linux/Unix (still Beta).  This
+universal driver architecture for Linux/UNIX (still Beta).  This
 currently supports 437 models.
    • HPIJS --
 a Free Software project by HP to provide the support for their own
 range of models (very mature, printing in most cases is perfect and
@@ -2723,8 +2567,8 @@ effort, started by Michael Sweet (also lead developer for CUPS), now
 directed by Robert Krawitz, which has achieved an amazing level of
 photo print quality (many Epson users swear that its quality is
 better than the vendor drivers provided by Epson for the Microsoft
-platforms). This currently supports 522 models.
    Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and
-commercial Unix
    
+platforms). This currently supports 522 models.

    Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and +commercial UNIX

    Linuxprinting.org today is the one-stop "shop" to download printer drivers. Look for printer information and tutorials or solve printing problems in its popular forums. But @@ -2744,7 +2588,7 @@ of the Foomatic project. Till Kamppeter from MandrakeSoft is doing an excellent job in his spare time to maintain Linuxprinting.org and Foomatic. So if you use it often, please send him a note showing your appreciation. -

    Foomatic Database generated PPDs

    +

    Foomatic Database generated PPDs

    The Foomatic database is an amazing piece of ingenuity in itself. Not only does it keep the printer and driver information, but it is organized in a way that it can generate "PPD" files "on the fly" from @@ -2769,7 +2613,7 @@ GUI tools (like KDE's marvellous "gtklp", "xpp" and the CUPS web interface) read the PPD too and use this information to present the available settings to the user as an intuitive menu selection. -

    foomatic-rip and Foomatic-PPD Download and Installation

    +

    foomatic-rip and Foomatic-PPD Download and Installation

    Here are the steps to install a foomatic-rip driven "LaserJet 4 Plus" compatible printer in CUPS (note that recent distributions of SuSE, UnitedLinux and Mandrake may ship with a complete package of @@ -2783,11 +2627,11 @@ link.

  • You'll arrive at a page listing all drivers working with this model (for all printers, there will always be one recommended driver. Try this one first).

  • In our case ("HP LaserJet 4 Plus"), we'll arrive here: -http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus + http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus

  • The recommended driver is "ljet4".

  • There are several links provided here. You should visit them all, if you are not familiar with the Linuxprinting.org database.

  • There is a link to the database page for the "ljet4": -http://www.linuxprinting.org/show_driver.cgi?driver=ljet4 + http://www.linuxprinting.org/show_driver.cgi?driver=ljet4 On the driver's page, you'll find important and detailed information about how to use that driver within the various available spoolers.

  • Another link may lead you to the homepage of the @@ -2828,9 +2672,7 @@ the /usr/share/cups/model/ path and re-start cupsd).

  • Then install the printer with a suitable commandline, e.g.: 

    -
-lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd
-
+root# lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd

  • Note again this: for all the new-style "Foomatic-PPDs" from Linuxprinting.org, you also need a special "CUPS filter" named "foomatic-rip".Get the latest version of "foomatic-rip" from: http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0 @@ -2868,7 +2710,7 @@ the driver/model) contain support for a certain "device", representing the selected "driver" for your model (as shown by "gs -h")

  • foomatic-rip needs a new version of PPDs (PPD versions produced for cupsomatic don't work with -foomatic-rip).

    • Page Accounting with CUPS

    +foomatic-rip).

    Page Accounting with CUPS

    Often there are questions regarding "print quotas" wherein Samba users (that is, Windows clients) should not be able to print beyond a certain amount of pages or data volume per day, week or month. This @@ -2881,18 +2723,17 @@ Of course one could "hack" things with one's own scripts. But then there is CUPS. CUPS supports "quotas" which can be based on sizes of jobs or on the number of pages or both, and are spanning any time period you want. -

    Setting up Quotas

    +

    Setting up Quotas

    This is an example command how root would set a print quota in CUPS, assuming an existing printer named "quotaprinter": -

    -
-  lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 -o job-page-limit=100
-
+
    +root# lpadmin -p quotaprinter -o job-quota-period=604800 \
+	-o job-k-limit=1024 -o job-page-limit=100
 
    
 This would limit every single user to print 100 pages or 1024 KB of
 data (whichever comes first) within the last 604,800 seconds ( = 1
 week).
-

    Correct and incorrect Accounting

    +

    Correct and incorrect Accounting

    For CUPS to count correctly, the printfile needs to pass the CUPS "pstops" filter, otherwise it uses a "dummy" count of "1". Some printfiles don't pass it (eg: image files) but then those are mostly 1 @@ -2906,8 +2747,8 @@ driver there) to have the chance to get accounting done. If the printer is a non-PostScript model, you need to let CUPS do the job to convert the file to a print-ready format for the target printer. This will be working for currently about 1,000 different printer models, -see http://www.linuxprinting.org/printer_list.cgi). -

    Adobe and CUPS PostScript Drivers for Windows Clients

    +see the driver list at linuxprinting.org/. +

    Adobe and CUPS PostScript Drivers for Windows Clients

    Before CUPS-1.1.16 your only option was to use the Adobe PostScript Driver on the Windows clients. The output of this driver was not always passed through the "pstops" filter on the CUPS/Samba side, and @@ -2920,14 +2761,14 @@ From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver for Windows NT/2K/XP clients" (which is tagged in the download area of http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). It does not work for Win9x/ME clients. But it guarantees: -

    • to not write an PJL-header

    • to still read and support all PJL-options named in the +

      • to not write an PJL-header

      • to still read and support all PJL-options named in the driver PPD with its own means

      • that the file will pass through the "pstops" filter on the CUPS/Samba server

      • to page-count correctly the printfile

      You can read more about the setup of this combination in the manpage for "cupsaddsmb" (which is only present with CUPS installed, and only current from CUPS 1.1.16). -

    The page_log File Syntax

    +

    The page_log File Syntax

    These are the items CUPS logs in the "page_log" for every single page of a job:

    • Printer name

    • User name

    • Job ID

    • Time of printing

    • the page number

    • the number of copies

    • a billing information string @@ -2936,20 +2777,18 @@ single page of a job: Here is an extract of my CUPS server's page_log file to illustrate the format and included items: 

      -
-        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13
-        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13
-        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13
-        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13
-        DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33
-
+infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13
+infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13
+infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13
+infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13
+DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33

      This was job ID "401", printed on "infotec_IS2027" by user "kurt", a 64-page job printed in 3 copies and billed to "#marketing", sent from IP address 10.160.50.13. The next job had ID "402", was sent by user "boss" from IP address 10.160.51.33,printed from one page 440 copies and is set to be billed to "finance-dep". -

    Possible Shortcomings

    +

    Possible Shortcomings

    What flaws or shortcomings are there with this quota system?

    • the ones named above (wrongly logged job in case of printer hardware failure, etc.)

    • in reality, CUPS counts the job pages that are being @@ -2958,12 +2797,12 @@ processed in software (that is, going thr printing device. Thus if there is a jam while printing the 5th sheet out of 1000 and the job is aborted by the printer, the "page count" will still show the figure of 1000 for that job

    • all quotas are the same for all users (no flexibility -to give the boss a higher quota than the clerk) no support for +to give the boss a higher quota than the clerk), no support for groups

    • no means to read out the current balance or the "used-up" number of current quota

    • a user having used up 99 sheets of 100 quota will still be able to send and print a 1,000 sheet job

    • a user being denied a job because of a filled-up quota doesn't get a meaningful error message from CUPS other than -"client-error-not-possible".

    Future Developments

    +"client-error-not-possible".

    Future Developments

    This is the best system currently available, and there are huge improvements under development for CUPS 1.2:

    • page counting will go into the "backends" (these talk @@ -2971,9 +2810,9 @@ directly to the printer and will increase the count in sync with the actual printing process: thus a jam at the 5th sheet will lead to a stop in the counting)

    • quotas will be handled more flexibly

    • probably there will be support for users to inquire their "accounts" in advance

    • probably there will be support for some other tools -around this topic

    Other Accounting Tools

    +around this topic

    Other Accounting Tools

    PrintAnalyzer, pyKota, printbill, LogReport. -

    Additional Material

    +

    Additional Material

    A printer queue with no PPD associated to it is a "raw" printer and all files will go directly there as received by the spooler. The exceptions are file types "application/octet-stream" @@ -2994,10 +2833,8 @@ where "normally" the native CUPS "pstoraster" filter would k in. cupsomatic by-passes pstoraster, "kidnaps" the printfile from CUPS away and re-directs it to go through Ghostscript. CUPS accepts this, because the associated CUPS-O-Matic-/Foomatic-PPD specifies: -

    -
-   *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"
-
+
    +  *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"
 
    
 This line persuades CUPS to hand the file to cupsomatic, once it has
 successfully converted it to the MIME type
@@ -3009,30 +2846,24 @@ Jobs arriving from Windows which are auto-typed
 CUPS is widely configurable and flexible, even regarding its filtering
 mechanism. Another workaround in some situations would be to have in
 /etc/cups/mime.types entries as follows:
-
    -
-   application/postscript           application/vnd.cups-raw  0  -
-   application/vnd.cups-postscript  application/vnd.cups-raw  0  -
-
+
    + application/postscript           application/vnd.cups-raw  0  -
+ application/vnd.cups-postscript  application/vnd.cups-raw  0  -
 
    
 This would prevent all Postscript files from being filtered (rather,
 they will through the virtual nullfilter
 denoted with "-").  This could only be useful for PS printers. If you
 want to print PS code on non-PS printers (provided they support ASCII
 text printing) an entry as follows could be useful:
-
    -
-   */*           application/vnd.cups-raw  0  -
-
+
    + */*           application/vnd.cups-raw  0  -
 
    
 and would effectively send all files to the
 backend without further processing.
 
    
 Lastly, you could have the following entry:
-
    -
-   application/vnd.cups-postscript  application/vnd.cups-raw  0  my_PJL_stripping_filter
-
+
    +application/vnd.cups-postscript application/vnd.cups-raw 0 my_PJL_stripping_filter
 
    
 You will need to write a my_PJL_stripping_filter
 (could be a shellscript) that parses the PostScript and removes the
@@ -3051,16 +2882,15 @@ the jobs of hundreds of users on some big machine, where no user is
 allowed to have direct access (such as when the operators often need
 to load the proper paper type before running the 10,000 page job
 requested by marketing for the mailing, etc.).
-

    Auto-Deletion or Preservation of CUPS Spool Files

    +

    Auto-Deletion or Preservation of CUPS Spool Files

    Samba print files pass through two "spool" directories. One is the -incoming directory managed by Samba, (set in the path = -/var/spool/samba directive in the -[printers] section of +incoming directory managed by Samba, (set in the path = /var/spool/samba directive in the +[printers] section of smb.conf). The other is the spool directory of your UNIX print subsystem. For CUPS it is normally /var/spool/cups/, as set by the cupsd.conf directive RequestRoot /var/spool/cups. -

    CUPS Configuration Settings explained

    +

    CUPS Configuration Settings explained

    Some important parameter settings in the CUPS configuration file cupsd.conf are:

    PreserveJobHistory Yes

    @@ -3084,34 +2914,32 @@ maximum to 0 disables this functionality. The default setting is

    (There are also additional settings for "MaxJobsPerUser" and "MaxJobsPerPrinter"...) -

    Pre-conditions

    +

    Pre-conditions

    For everything to work as announced, you need to have three things:

    • a Samba-smbd which is compiled against "libcups" (Check on Linux by running "ldd `which smbd`")

    • a Samba-smb.conf setting of -"printing = cups"

    • another Samba-smb.conf setting of -"printcap = cups"

    Note

    + printing = cups

  • another Samba-smb.conf setting of + printcap = cups

    • Note

    In this case all other manually set printing-related commands (like -"print command", "lpq command", "lprm command", "lppause command" or -"lpresume command") are ignored and they should normally have no +print command, +lpq command, +lprm command, +lppause command or +lpresume command) are ignored and they should normally have no influence what-so-ever on your printing. -

    Manual Configuration

    -If you want to do things manually, replace the "printing = -cups" by "printing = bsd". Then your manually set commands may work -(haven't tested this), and a "print command = lp -d %P %s; rm %s" +

    Manual Configuration

    +If you want to do things manually, replace the printing = cups +by printing = bsd. Then your manually set commands may work +(haven't tested this), and a print command = lp -d %P %s; rm %s" may do what you need. -

    When not to use Samba to print to -CUPS

    -[TO BE DONE] -

    In Case of Trouble.....

    +

    In Case of Trouble.....

    If you have more problems, post the output of these commands to the CUPS or Samba mailing lists (choose the one which seems more relevant to your problem): 

    -
-   grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
-   grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"
-
+$ grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
+$ grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"

    (adapt paths as needed). These commands leave out the empty lines and lines with comments, providing the "naked settings" in a @@ -3119,18 +2947,12 @@ compact way. Don't forget to name the CUPS and Samba versions you are using! This saves bandwidth and makes for easier readability for experts (and you are expecting experts to read them, right? ;-) -

    Where to find Documentation

    -[TO BE DONE] -

    How to ask for Help

    -[TO BE DONE] -

    Where to find Help

    -[TO BE DONE] -

    Appendix

    Printing from CUPS to Windows attached -Printers

    +

    Printing from CUPS to Windows attached +Printers

    From time to time the question arises, how you can print to a Windows attached printer from Samba. Normally the local connection -"Windows host <--> printer" would be done by USB or parallel +from Windows host to printer would be done by USB or parallel cable, but this doesn't matter to Samba. From here only an SMB connection needs to be opened to the Windows host. Of course, this printer must be "shared" first. As you have learned by now, CUPS uses @@ -3142,33 +2964,29 @@ is in the CUPS backend directory. This resides usually in file there. It should be a symlink to smbspool which file must exist and be executable: 

    -
- # ls -l /usr/lib/cups/backend/   
- total 253
- drwxr-xr-x    3 root     root          720 Apr 30 19:04 .
- drwxr-xr-x    6 root     root          125 Dec 19 17:13 ..
- -rwxr-xr-x    1 root     root        10692 Feb 16 21:29 canon
- -rwxr-xr-x    1 root     root        10692 Feb 16 21:29 epson
- lrwxrwxrwx    1 root     root            3 Apr 17 22:50 http -> ipp
- -rwxr-xr-x    1 root     root        17316 Apr 17 22:50 ipp
- -rwxr-xr-x    1 root     root        15420 Apr 20 17:01 lpd
- -rwxr-xr-x    1 root     root         8656 Apr 20 17:01 parallel
- -rwxr-xr-x    1 root     root         2162 Mar 31 23:15 pdfdistiller
- lrwxrwxrwx    1 root     root           25 Apr 30 19:04 ptal -> /usr/local/sbin/ptal-cups
- -rwxr-xr-x    1 root     root         6284 Apr 20 17:01 scsi
- lrwxrwxrwx    1 root     root           17 Apr  2 03:11 smb -> /usr/bin/smbspool
- -rwxr-xr-x    1 root     root         7912 Apr 20 17:01 socket
- -rwxr-xr-x    1 root     root         9012 Apr 20 17:01 usb
-
-# ls -l `which smbspool`
- -rwxr-xr-x    1 root     root       563245 Dec 28 14:49 /usr/bin/smbspool
-
+root# ls -l /usr/lib/cups/backend/
+total 253
+drwxr-xr-x    3 root     root          720 Apr 30 19:04 .
+drwxr-xr-x    6 root     root          125 Dec 19 17:13 ..
+-rwxr-xr-x    1 root     root        10692 Feb 16 21:29 canon
+-rwxr-xr-x    1 root     root        10692 Feb 16 21:29 epson
+lrwxrwxrwx    1 root     root            3 Apr 17 22:50 http -> ipp
+-rwxr-xr-x    1 root     root        17316 Apr 17 22:50 ipp
+-rwxr-xr-x    1 root     root        15420 Apr 20 17:01 lpd
+-rwxr-xr-x    1 root     root         8656 Apr 20 17:01 parallel
+-rwxr-xr-x    1 root     root         2162 Mar 31 23:15 pdfdistiller
+lrwxrwxrwx    1 root     root           25 Apr 30 19:04 ptal -> /usr/sbin/ptal-cups
+-rwxr-xr-x    1 root     root         6284 Apr 20 17:01 scsi
+lrwxrwxrwx    1 root     root           17 Apr  2 03:11 smb -> /usr/bin/smbspool
+-rwxr-xr-x    1 root     root         7912 Apr 20 17:01 socket
+-rwxr-xr-x    1 root     root         9012 Apr 20 17:01 usb
+
+root# ls -l `which smbspool`
+-rwxr-xr-x    1 root     root       563245 Dec 28 14:49 /usr/bin/smbspool

    If this symlink doesn't exist, create it: 

    -
-# ln -s `which smbspool` /usr/lib/cups/backend/smb
-
+root# ln -s `which smbspool` /usr/lib/cups/backend/smb

    smbspool has been written by Mike Sweet from the CUPS folks. It is included and ships with Samba. It may also be used with print @@ -3185,9 +3003,8 @@ the Windows host, etc.

    To install a printer with the smb backend on CUPS, use this command: 

    -
-# lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename -P /path/to/PPD
-
+root# lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename \
+  -P /path/to/PPD

    The PPD must be able to direct CUPS to generate the print data for the target model. For PostScript printers just use @@ -3196,13 +3013,7 @@ what can you do if the printer is only accessible with a password? Or if the printer's host is part of another workgroup? This is provided for: you can include the required parameters as part of the smb:// device-URI. Like this: -

    -
- smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename 
- smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename
- smb://username:password@WINDOWSNETBIOSNAME/printersharename
-
-

    +

    • smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename

    • smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename

    • smb://username:password@WINDOWSNETBIOSNAME/printersharename

    Note that the device-URI will be visible in the process list of the Samba server (e.g. when someone uses the ps -aux command on Linux), even if the username and passwords are sanitized @@ -3213,337 +3024,41 @@ doesn't require a password! Printing will only work if you have a working netbios name resolution up and running. Note that this is a feature of CUPS and you don't necessarily need to have smbd running (but who wants that? :-). -

    More CUPS filtering Chains

    +

    More CUPS filtering Chains

    The following diagrams reveal how CUPS handles print jobs. -

    -#########################################################################
-#
-# CUPS in and of itself has this (general) filter chain (CAPITAL
-# letters are FILE-FORMATS or MIME types, other are filters (this is
-# true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro):
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      V
-#     somethingtops
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      V
-#     pstops
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT
-#      |
-#      V
-#     pstoraster   # as shipped with CUPS, independent from any Ghostscipt
-#      |           # installation on the system
-#      |  (= "postscipt interpreter")
-#      V
-# APPLICATION/VND.CUPS-RASTER
-#      |
-#      V
-#     rastertosomething  (e.g. Gimp-Print filters may be plugged in here)
-#      |   (= "raster driver")
-#      V
-# SOMETHING-DEVICE-SPECIFIC
-#      |
-#      V
-#     backend
-#
-#
-# ESP PrintPro has some enhanced "rastertosomething" filters as compared to
-# CUPS, and also a somewhat improved "pstoraster" filter.
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
-
    -#########################################################################
-#
-# This is how "cupsomatic" comes into play:
-# =========================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      V
-#    somethingtops
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      V
-#    pstops
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
-#      |                                          V
-#      V                                         cupsomatic
-#    pstoraster                                  (constructs complicated
-#      |  (= "postscipt interpreter")            Ghostscript commandline
-#      |                                         to let the file be
-#      V                                         processed by a
-# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
-#      |                                         call...)
-#      V                                          |
-#    rastertosomething                            V
-#      |    (= "raster driver")     +-------------------------+
-#      |                            | Ghostscript at work.... |
-#      V                            |                         |
-# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
-#      |                                          |
-#      V                                          |
-#    backend <------------------------------------+
-#      |
-#      V
-#    THE PRINTER
-#
-#
-# Note, that cupsomatic "kidnaps" the printfile after the
-# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it gh
-# the CUPS-external, systemwide Ghostscript installation, bypassing the
-# "pstoraster" filter (therefore also bypassing the CUPS-raster-drivers
-# "rastertosomething", and hands the rasterized file directly to the CUPS
-# backend...
-#
-# cupsomatic is not made by the CUPS developers. It is an independent
-# contribution to printing development, made by people from
-# Linuxprinting.org. (see also http://www.cups.org/cups-help.html)
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
-
    -#########################################################################
-#
-# And this is how it works for ESP PrintPro from 4.3:
-# ===================================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      V
-#     somethingtops
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      V
-#     pstops
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT
-#      |
-#      V
-#     gsrip
-#      |  (= "postscipt interpreter")
-#      V
-# APPLICATION/VND.CUPS-RASTER
-#      |
-#      V
-#     rastertosomething  (e.g. Gimp-Print filters may be plugged in here)
-#      |   (= "raster driver")
-#      V
-# SOMETHING-DEVICE-SPECIFIC
-#      |
-#      V
-#     backend
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
-
    -#########################################################################
-#
-# This is how "cupsomatic" would come into play with ESP PrintPro:
-# ================================================================
-#
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      V
-#    somethingtops
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      V
-#    pstops
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
-#      |                                          V
-#      V                                         cupsomatic
-#    gsrip                                       (constructs complicated
-#      |  (= "postscipt interpreter")            Ghostscript commandline
-#      |                                         to let the file be
-#      V                                         processed by a
-# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
-#      |                                         call...)
-#      V                                          |
-#    rastertosomething                            V
-#      |   (= "raster driver")      +-------------------------+
-#      |                            | Ghostscript at work.... |
-#      V                            |                         |
-# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
-#      |                                          |
-#      V                                          |
-#    backend <------------------------------------+
-#      |
-#      V
-#    THE PRINTER
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
-
    -#########################################################################
-#
-# And this is how it works for CUPS from 1.1.15:
-# ==============================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      V
-#     somethingtops
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      V
-#     pstops
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT-----+
-#                  +------------------v------------------------------+
-#                  | Ghostscript                                     |
-#                  | at work...                                      |
-#                  | (with                                           |
-#                  | "-sDEVICE=cups")                                |
-#                  |                                                 |
-#                  |         (= "postscipt interpreter")             |
-#                  |                                                 |
-#                  +------------------v------------------------------+
-#                                     |
-# APPLICATION/VND.CUPS-RASTER >-------+
-#      |
-#      V
-#     rastertosomething
-#      |   (= "raster driver")
-#      V
-# SOMETHING-DEVICE-SPECIFIC
-#      |
-#      V
-#     backend
-#
-#
-# NOTE: since version 1.1.15 CUPS "outsourced" the pstoraster process to
-#       Ghostscript. GNU Ghostscript needs to be patched to handle the
-#       CUPS requirement; ESP Ghostscript has this builtin. In any case,
-#       "gs -h" needs to show up a "cups" device. pstoraster is now a
-#       calling an appropriate "gs -sDEVICE=cups..." commandline to do
-#       the job. It will output "application/vnd.cup-raster", which will
-#       be finally processed by a CUPS raster driver "rastertosomething"
-#       Note the difference to "cupsomatic", which will not output
-#       CUPS-raster, but a final version of the printfile, ready to be
-#       sent to the printer. cupsomatic also doesn't use the "cups"
-#       devicemode in Ghostscript, but one of the classical devicemodes....
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
-
    -#########################################################################
-#
-# And this is how it works for CUPS from 1.1.15, with cupsomatic included:
-# ========================================================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      V
-#     somethingtops
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      V
-#     pstops
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT-----+
-#                  +------------------v------------------------------+
-#                  | Ghostscript        . Ghostscript at work....    |
-#                  | at work...         . (with "-sDEVICE=           |
-#                  | (with              .            s.th."          |
-#                  | "-sDEVICE=cups")   .                            |
-#                  |                    .                            |
-#                  | (CUPS standard)    .      (cupsomatic)          |
-#                  |                    .                            |
-#                  |          (= "postscript interpreter")           |
-#                  |                    .                            |
-#                  +------------------v--------------v---------------+
-#                                     |              |
-# APPLICATION/VND.CUPS-RASTER >-------+              |
-#      |                                             |
-#      V                                             |
-#     rastertosomething                              |
-#      |   (= "raster driver")                       |
-#      V                                             |
-# SOMETHING-DEVICE-SPECIFIC >------------------------+
-#      |
-#      V
-#     backend
-#
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-##########################################################################
-

    Trouble Shooting Guidelines to fix typical Samba printing -Problems

    -This is a short description of how to debug printing problems -with Samba. This describes how to debug problems with printing from -a SMB client to a Samba server, not the other way around. -

    Win9x client can't install driver

    For Win9x clients require the printer names to be 8 +

    Figure 19.17. Filtering chain 1

    Filtering chain 1

    Figure 19.18. Filtering chain with cupsomatic

    Filtering chain with cupsomatic

    Note

    +Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to +CUPS and ESP PrintPro plug-in where rastertosomething is noted. +

    Common Errors

    Win9x client can't install driver

    For Win9x clients require the printer names to be 8 chars (or "8 plus 3 chars suffix") max; otherwise the driver files won't get transferred when you want to download them from -Samba.

    testparm

    Run testparm: It will tell you if -smb.conf parameters are in the wrong -section. Many people have had the "printer admin" parameter in the -[printers] section and experienced -problems. "testparm" will tell you if it sees -this.

    "cupsaddsmb" keeps asking for a root password in a -neverending loop

    Have you security = user? Have +Samba.

    "cupsaddsmb" keeps asking for root password in + neverending loop

    Have you security = user? Have you used smbpasswd to give root a Samba account? You can do 2 things: open another terminal and execute smbpasswd -a root to create the account, and continue with entering the password into the first terminal. Or break out of the loop by hitting ENTER twice (without trying to type a -password).

    "cupsaddsmb" gives "No PPD file for printer..." -message (but I swear there is one!)

    • Have you enabled printer sharing on CUPS? This means: +password).

    "cupsaddsmb" gives "No PPD file for printer..." + message while PPD file is present

    Have you enabled printer sharing on CUPS? This means: do you have a <Location /printers>....</Location> section in CUPS server's cupsd.conf which doesn't deny access to the host you run "cupsaddsmb" from? It could be an issue if you use cupsaddsmb remotely, or if you use it with a --h parameter: cupsaddsmb -H -sambaserver -h cupsserver -v printername. -

  • Is your +-h parameter: cupsaddsmb -H + sambaserver -h cupsserver -v printername. +

    Is your "TempDir" directive in cupsd.conf set to a valid value and is it writeable? -

    • I can't connect client to Samba printer.

    Use smbstatus to check which user +

    Client can't connect to Samba printer

    Use smbstatus to check which user you are from Samba's point of view. Do you have the privileges to write into the [print$] -share?

    I can't reconnect to Samba under a new account -from Win2K/XP

    Once you are connected as the "wrong" user (for -example as "nobody", which often occurs if you have map to -guest = bad user), Windows Explorer will not accept an +share?

    Can't reconnect to Samba under new account + from Win2K/XP

    Once you are connected as the "wrong" user (for +example as "nobody", which often occurs if you have +map to guest = bad user), Windows Explorer will not accept an attempt to connect again as a different user. There won't be any byte transfered on the wire to Samba, but still you'll see a stupid error message which makes you think that Samba has denied access. Use @@ -3556,61 +3071,59 @@ indicating a renewed connection attempt? Shut all Explorer Windows. This makes Windows forget what it has cached in its memory as established connections. Then re-connect as the right user. Best method is to use a DOS terminal window and first -do net use z: \\SAMBAHOST\print$ /user:root. Check +do net use z: \\GANDALF\print$ /user:root. Check with smbstatus that you are connected under a different account. Now open the "Printers" folder (on the Samba server in the Network Neighbourhood), right-click the printer in question and select -Connect...

    Avoid being connected to the Samba server as the -"wrong" user

    You see per smbstatus that you are +Connect...

    Avoid being connected to the Samba server as the + "wrong" user

    You see per smbstatus that you are connected as user "nobody"; while you wanted to be "root" or -"printeradmin"? This is probably due to map to guest = bad -user, which silently connects you under the guest account, +"printeradmin"? This is probably due to +map to guest = bad user, which silently connects you under the guest account, when you gave (maybe by accident) an incorrect username. Remove -map to guest, if you want to prevent -this.

    Upgrading to CUPS drivers from Adobe drivers on -NT/2K/XP clients gives problems

    First delete all "old" Adobe-using printers. Then +map to guest, if you want to prevent +this.

    Upgrading to CUPS drivers from Adobe drivers on + NT/2K/XP clients gives problems

    First delete all "old" Adobe-using printers. Then delete all "old" Adobe drivers. (On Win2K/XP, right-click in background of "Printers" folder, select "Server Properties...", select -tab "Drivers" and delete here).

    I can't use "cupsaddsmb"on a Samba server which is -a PDC

    Do you use the "naked" root user name? Try to do it -this way: cupsaddsmb -U DOMAINNAME\\root -v -printername (note the two backslashes: the first one is -required to "escape" the second one).

    I deleted a printer on Win2K; but I still see -its driver

    Deleting a printer on the client won't delete the +tab "Drivers" and delete here).

    Can't use "cupsaddsmb" on Samba server which is + a PDC

    Do you use the "naked" root user name? Try to do it +this way: cupsaddsmb -U DOMAINNAME\\root -v +printername> (note the two backslashes: the first one is +required to "escape" the second one).

    Deleted Win2K printer driver is still shown

    Deleting a printer on the client won't delete the driver too (to verify, right-click on the white background of the "Printers" folder, select "Server Properties" and click on the "Drivers" tab). These same old drivers will be re-used when you try to install a printer with the same name. If you want to update to a new driver, delete the old ones first. Deletion is only possible if no -other printer uses the same driver.

    Win2K/XP "Local Security -Policies"

    Local Security Policies may not +other printer uses the same driver.

    Win2K/XP "Local Security + Policies"

    Local Security Policies may not allow the installation of unsigned drivers. "Local Security Policies" may not allow the installation of printer drivers at -all.

    WinXP clients: "Administrator can not install -printers for all local users"

    Windows XP handles SMB printers on a "per-user" basis. +all.

    WinXP clients: "Administrator can not install + printers for all local users"

    Windows XP handles SMB printers on a "per-user" basis. This means every user needs to install the printer himself. To have a printer available for everybody, you might want to use the built-in IPP client capabilities of WinXP. Add a printer with the print path of http://cupsserver:631/printers/printername. Still looking into this one: maybe a "logon script" could automatically install printers for all -users.

    "Print Change Notify" functions on -NT-clients

    For "print change notify" functions on NT++ clients, +users.

    "Print Change Notify" functions on + NT-clients

    For "print change notify" functions on NT++ clients, these need to run the "Server" service first (re-named to File & Print Sharing for MS Networks in -XP).

    WinXP-SP1

    WinXP-SP1 introduced a Point and Print +XP).

    WinXP-SP1

    WinXP-SP1 introduced a Point and Print Restriction Policy (this restriction doesn't apply to "Administrator" or "Power User" groups of users). In Group Policy -Object Editor: go to User Configuration --> -Administrative Templates --> Control Panel --> +Object Editor: go to User Configuration, + Administrative Templates, Control Panel, Printers. The policy is automatically set to Enabled and the Users can only Point and Print to machines in their Forest . You probably need to change it to Disabled or Users can only Point and Print to these servers in order to make -driver downloads from Samba possible.

    I can't set and save default print options for all -users on Win2K/XP

    How are you doing it? I bet the wrong way (it is not +driver downloads from Samba possible.

    Print options for all users can't be set on Win2K/XP

    How are you doing it? I bet the wrong way (it is not very easy to find out, though). There are 3 different ways to bring you to a dialog that seems to set everything. All three dialogs look the same. Only one of them @@ -3650,13 +3163,13 @@ Do you see any difference? I don't either... However, only the last one, which you arrived at with steps "C.1.-6." will save any settings permanently and be the defaults for new users. If you want all clients to get the same defaults, you need to conduct these steps as -Administrator (printer admin in +Administrator (printer admin in smb.conf) before a client downloads the driver (the clients can later set their own per-user defaults by following the procedures A. or B. -above).

    What are the most common blunders in driver -settings on Windows clients?

    Don't use Optimize for +above).

    Most common blunders in driver + settings on Windows clients

    Don't use Optimize for Speed: use Optimize for Portability instead (Adobe PS Driver) Don't use Page Independence: No: always @@ -3668,8 +3181,8 @@ printer (Adobe PS Driver). For TrueType Download Options choose Outline. Use PostScript Level 2, if you are having trouble with a non-PS printer, and if -there is a choice.

    I can't make cupsaddsmb work -with newly installed printer

    Symptom: the last command of +there is a choice.

    cupsaddsmb does not work + with newly installed printer

    Symptom: the last command of cupsaddsmb doesn't complete successfully: cmd = setdriver printername printername result was NT_STATUS_UNSUCCESSFUL then possibly the printer was not yet @@ -3678,23 +3191,23 @@ Neighbourhood? Did it show up in rpcclient hostname -c 'enumprinters'? Restart smbd (or send a kill -HUP to all processes listed by smbstatus and try -again.

    My permissions on +again.

    Permissions on /var/spool/samba/ get reset after each -reboot

    Have you by accident set the CUPS spool directory to +reboot

    Have you by accident set the CUPS spool directory to the same location? (RequestRoot /var/spool/samba/ in cupsd.conf or the other way round: /var/spool/cups/ is set as -path in the [printers] +path> in the [printers] section). These must be different. Set RequestRoot /var/spool/cups/ in -cupsd.conf and path = -/var/spool/samba in the [printers] +cupsd.conf and path = +/var/spool/samba in the [printers] section of smb.conf. Otherwise cupsd will sanitize permissions to its spool directory with each restart, and -printing will not work reliably.

    My printers work fine: just the printer named "lp" +printing will not work reliably.

    Printer named "lp" intermittently swallows jobs and spits out completely different -ones

    It is a very bad idea to name any printer "lp". This -is the traditional Unix name for the default printer. CUPS may be set +ones

    It is a very bad idea to name any printer "lp". This +is the traditional UNIX name for the default printer. CUPS may be set up to do an automatic creation of "Implicit Classes". This means, to group all printers with the same name to a pool of devices, and loadbalancing the jobs across them in a round-robin fashion. Chances @@ -3703,31 +3216,10 @@ receive his jobs and send your own to his device unwittingly. To have tight control over the printer names, set BrowseShortNames No. It will present any printer as "printername@cupshost" then, giving you a better control over what may happen in a large -networked environment.

    How do I "watch" my Samba server?

    You can use tail -f -/var/log/samba/log.smbd (you may need a different path) to -see a live scrolling of all log messages. smbcontrol smbd -debuglevel tells you which verbosity goes into the -logs. smbcontrol smbd debug 3 sets the verbosity to -a quite high level (you can choose from 0 to 10 or 100). This works -"on the fly", without the need to restart the smbd daemon. Don't use -more than 3 initially; or you'll drown in an ocean of -messages.

    I can't use Samba from my WinXP Home box, while -access from WinXP Prof works flawlessly

    You have our condolences! WinXP home has been -completely neutered by Microsoft as compared to WinXP Prof: you can -not log into a WinNT domain. It cannot join a Win NT domain as a -member server. While it is possible to access domain resources, users -don't have "single sign-on". They need to supply username and password -each time they connect to a resource. Logon scripts and roaming -profiles are not supported. It can serve file and print shares; but -only in "share-mode security" level. It can not use "user-mode -security" (what Windows 95/98/ME still can -do).

    Where do I find the Adobe PostScript driver files -I need for "cupsaddsmb"?

    Use smbclient to connect to any +networked environment.

    Location of Adobe PostScript driver files necessary for "cupsaddsmb"

    Use smbclient to connect to any Windows box with a shared PostScript printer: smbclient //windowsbox/print\$ -U guest. You can navigate to the W32X86/2 subdir to mget ADOBE* and other files or to WIN40/0 to do the same. -- Another option is to download the *.exe packaged -files from the Adobe website.

    An Overview of the CUPS Printing Processes

    -

    Figure 19.15. CUPS Printing Overview

    CUPS Printing Overview

    -

    Prev Up Next
    Chapter 18. Classical Printing Support Home Chapter 20. Stackable VFS modules
    +files from the Adobe website.

    An Overview of the CUPS Printing Processes

    Figure 19.19. CUPS Printing Overview

    CUPS Printing Overview
    Prev Up Next
    Chapter 18. Classical Printing Support Home Chapter 20. Stackable VFS modules
    diff --git a/docs/htmldocs/ClientConfig.html b/docs/htmldocs/ClientConfig.html index 395be92345..ab34354e2d 100644 --- a/docs/htmldocs/ClientConfig.html +++ b/docs/htmldocs/ClientConfig.html @@ -1,4 +1,4 @@ -Chapter 9. MS Windows Network Configuration Guide
    Chapter 9. MS Windows Network Configuration Guide
    Prev Part II. Server Configuration Basics Next

    Chapter 9. MS Windows Network Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +Chapter 9. MS Windows Network Configuration Guide

    Chapter 9. MS Windows Network Configuration Guide
    Prev Part II. Server Configuration Basics Next

    Chapter 9. MS Windows Network Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Prev Up Next
    Chapter 8. Stand-Alone Servers Home Part III. Advanced Configuration
    +

    Prev Up Next
    Chapter 8. Stand-Alone Servers Home Part III. Advanced Configuration
    diff --git a/docs/htmldocs/DNSDHCP.html b/docs/htmldocs/DNSDHCP.html index dadf6b989a..1472c1925b 100644 --- a/docs/htmldocs/DNSDHCP.html +++ b/docs/htmldocs/DNSDHCP.html @@ -1,4 +1,4 @@ -Chapter 40. DNS and DHCP Configuration Guide
    Chapter 40. DNS and DHCP Configuration Guide
    Prev Part VI. Appendixes Next

    Chapter 40. DNS and DHCP Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +Chapter 40. DNS and DHCP Configuration Guide

    Chapter 40. DNS and DHCP Configuration Guide
    Prev Part VI. Appendixes Next

    Chapter 40. DNS and DHCP Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Prev Up Next
    Chapter 39. Samba Performance Tuning Home Chapter 41. Further Resources
    +

    Prev Up Next
    Chapter 39. Samba Performance Tuning Home Chapter 41. Further Resources
    diff --git a/docs/htmldocs/FastStart.html b/docs/htmldocs/FastStart.html index dbb85dea6e..64c38702fd 100644 --- a/docs/htmldocs/FastStart.html +++ b/docs/htmldocs/FastStart.html @@ -1,4 +1,4 @@ -Chapter 3. Fast Start for the Impatient
    Chapter 3. Fast Start for the Impatient
    Prev Part I. General Installation Next

    Chapter 3. Fast Start for the Impatient

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +Chapter 3. Fast Start for the Impatient

    Chapter 3. Fast Start for the Impatient
    Prev Part I. General Installation Next

    Chapter 3. Fast Start for the Impatient

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Prev Up Next
    Chapter 2. How to Install and Test SAMBA Home Part II. Server Configuration Basics
    +

    Prev Up Next
    Chapter 2. How to Install and Test SAMBA Home Part II. Server Configuration Basics
    diff --git a/docs/htmldocs/Further-Resources.html b/docs/htmldocs/Further-Resources.html index 8030190ed4..8464c480c2 100644 --- a/docs/htmldocs/Further-Resources.html +++ b/docs/htmldocs/Further-Resources.html @@ -1,4 +1,4 @@ -Chapter 41. Further Resources
    Chapter 41. Further Resources
    Prev Part VI. Appendixes Next

    Chapter 41. Further Resources

    Jelmer R. Vernooij

    The Samba Team

    David Lechnyr

    Unofficial HOWTO

    May 1, 2003

    Table of Contents

    Websites
    Related updates from Microsoft
    Books

    Websites

    Prev Up Next
    Chapter 40. DNS and DHCP Configuration Guide Home Index
    diff --git a/docs/htmldocs/InterdomainTrusts.html b/docs/htmldocs/InterdomainTrusts.html index 8938b84c42..8422c52073 100644 --- a/docs/htmldocs/InterdomainTrusts.html +++ b/docs/htmldocs/InterdomainTrusts.html @@ -1,10 +1,11 @@ -Chapter 16. Interdomain Trust Relationships
    Chapter 16. Interdomain Trust Relationships
    Prev Part III. Advanced Configuration Next

    Chapter 16. Interdomain Trust Relationships

    John H. Terpstra

    Samba Team

    Rafal Szczesniak

    Samba Team

    April 3, 2003

    Table of Contents

    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    Common Errors
    Tell me about Trust Relationships using Samba

    +Chapter 16. Interdomain Trust Relationships

    Chapter 16. Interdomain Trust Relationships
    Prev Part III. Advanced Configuration Next

    Chapter 16. Interdomain Trust Relationships

    John H. Terpstra

    Samba Team

    Rafal Szczesniak

    Samba Team

    Jelmer R. Vernooij

    drawing
    The Samba Team

    Stephen Langasek

    April 3, 2003

    Table of Contents

    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-style Domain Trusts with Windows 2000
    Common Errors

    Samba-3 supports NT4 style domain trust relationships. This is feature that many sites will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to adopt Active Directory or an LDAP based authentication back end. This section explains some background information regarding trust relationships and how to create them. It is now -possible for Samba-3 to NT4 trust (and vice versa), as well as Samba3 to Samba3 trusts. -

    Features and Benefits

    +possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba3-to-Samba3 +trusts. +

    Features and Benefits

    Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4 style trust relationships. This imparts to Samba similar scalability as is possible with MS Windows NT4. @@ -14,10 +15,10 @@ database such as LDAP, and given it's ability to run in Primary as well as Backu modes, the administrator would be well advised to consider alternatives to the use of Interdomain trusts simply because by the very nature of how this works it is fragile. That was, after all, a key reason for the development and adoption of Microsoft Active Directory. -

    Trust Relationship Background

    +

    Trust Relationship Background

    MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure. The limitations of this architecture as it affects the scalability of MS Windows networking -in large organisations is well known. Additionally, the flat-name space that results from +in large organisations is well known. Additionally, the flat namespace that results from this design significantly impacts the delegation of administrative responsibilities in large and diverse organisations.

    @@ -43,45 +44,91 @@ relationship, and WHITE and BLUE have a trust relationship, then it holds that t implied trust between the RED and BLUE domains. ie: Relationships are explicit and not transitive.

    + New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is an inherent feature of ADS domains. Samba-3 implements MS Windows NT4 style Interdomain trusts and interoperates with MS Windows 200x ADS security domains in similar manner to MS Windows NT4 style domains. -

    Native MS Windows NT4 Trusts Configuration

    -There are two steps to creating an interdomain trust relationship. -

    NT4 as the Trusting Domain (ie. creating the trusted account)

    +

    Native MS Windows NT4 Trusts Configuration

    +There are two steps to creating an interdomain trust relationship. To effect a two-way trust +relationship it is necessary for each domain administrator to create a trust account for the +other domain to use in verifying security credentials. + + +

    Creating an NT4 Domain Trust

    For MS Windows NT4, all domain trust relationships are configured using the -Domain User Manager. To affect a two way trust relationship it is -necessary for each domain administrator to make available (for use by an external domain) it's -security resources. This is done from the Domain User Manager Policies entry on the menu bar. -From the Policy menu, select Trust Relationships, then -next to the lower box that is labelled Permitted to Trust this Domain are two -buttons, Add and Remove. The Add -button will open a panel in which needs to be entered the remote domain that will be able to assign -user rights to your domain. In addition it is necessary to enter a password -that is specific to this trust relationship. The password needs to be -typed twice (for standard confirmation). -

    NT4 as the Trusted Domain (ie. creating trusted account's password)

    +Domain User Manager. This is done from the Domain User Manager Policies +entry on the menu bar. From the Policy menu, select +Trust Relationships. Next to the lower box labelled +Permitted to Trust this Domain are two buttons, Add +and Remove. The Add button will open a panel in which +to enter the name of the remote domain that will be able to assign access rights to users in +your domain. You will also need to enter a password for this trust relationship, which the +trusting domain will use when authenticating users from the trusted domain. +The password needs to be typed twice (for standard confirmation). +

    Completing an NT4 Domain Trust

    + A trust relationship will work only when the other (trusting) domain makes the appropriate connections with the trusted domain. To consummate the trust relationship the administrator will launch the Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the Add button that is next to the box that is labelled Trusted Domains. A panel will open in which must be entered the name of the remote domain as well as the password assigned to that trust. -

    Configuring Samba NT-style Domain Trusts

    +

    Inter-Domain Trust Facilities

    +A two-way trust relationship is created when two one-way trusts are created, one in each direction. +Where a one-way trust has been established between two MS Windows NT4 domains (let's call them +DomA and DomB) the following facilities are created: +

    Figure 16.1. Trusts overview

    Trusts overview

    • + DomA (completes the trust connection) Trusts DomB +

    • + DomA is the Trusting domain +

    • + DomB is the Trusted domain (originates the trust account) +

    • + Users in DomB can access resources in DomA +

    • + Users in DomA can NOT access resources in DomB +

    • + Global groups from DomB CAN be used in DomA +

    • + Global groups from DomA can NOT be used in DomB +

    • + DomB DOES appear in the logon dialog box on client workstations in DomA +

    • + DomA does NOT appear in the logon dialog box on client workstations in DomB +

    • + Users / Groups in a trusting domain can NOT be granted rights, permissions or access + to a trusted domain. +

    • + The trusting domain CAN access and use accounts (Users / Global Groups) in the + trusted domain. +

    • + Administrators of the trusted domain CAN be granted admininstrative rights in the + trusting domain. +

    • + Users in a trusted domain CAN be given rights and privileges in the trusting + domain. +

    • + Trusted domain Global Groups CAN be given rights and permissions in the trusting + domain. +

    • + Global Groups from the trusted domain CAN be made members in Local Groups on + MS Windows domain member machines. +

    Configuring Samba NT-style Domain Trusts

    This description is meant to be a fairly short introduction about how to set up a Samba server so that it could participate in interdomain trust relationships. Trust relationship support in Samba is in its early stage, so lot of things don't work yet.

    -Each of the procedures described below is treated as they were performed with Windows NT4 Server on -one end. The remote end could just as well be another Samba-3 domain. It can be clearly seen, after -reading this document, that combining Samba-specific parts of what's written below leads to trust -between domains in purely Samba environment. -

    Samba-3 as the Trusting Domain

    -In order to set the Samba PDC to be the trusted party of the relationship first you need -to create special account for the domain that will be the trusting party. To do that, +Each of the procedures described below assumes the peer domain in the trust relationship is +controlled by a Windows NT4 server. However, the remote end could just as well be another +Samba-3 domain. It can be clearly seen, after reading this document, that combining +Samba-specific parts of what's written below leads to trust between domains in a purely Samba +environment. +

    Samba as the Trusted Domain

    +In order to set the Samba PDC to be the trusted party of the relationship you first need +to create a special account for the domain that will be the trusting party. To do that, you can use the 'smbpasswd' utility. Creating the trusted domain account is very similar to creating a trusted machine account. Suppose, your domain is called SAMBA, and the remote domain is called RUMBA. The first step @@ -89,9 +136,9 @@ will be to issue this command from your favourite shell: 

     root#  smbpasswd -a -i rumba
-	New SMB password: XXXXXXXX
-	Retype SMB password: XXXXXXXX
-	Added user rumba$
+New SMB password: XXXXXXXX
+Retype SMB password: XXXXXXXX
+Added user rumba$

    where -a means to add a new account into the @@ -104,29 +151,29 @@ After issuing this command you'll be asked to enter the password for the account. You can use any password you want, but be aware that Windows NT will not change this password until 7 days following account creation. After the command returns successfully, you can look at the entry for the new account -(in the standard way depending on your configuration) and see that account's name is -really RUMBA$ and it has 'I' flag in the flags field. Now you're ready to confirm +(in the standard way as appropriate for your configuration) and see that account's name is +really RUMBA$ and it has the 'I' flag set in the flags field. Now you're ready to confirm the trust by establishing it from Windows NT Server. -

    -Open User Manager for Domains and from menu -Policies select Trust Relationships.... -Right beside Trusted domains list box press the +

    +Open User Manager for Domains and from the +Policies menu, select Trust Relationships.... +Right beside the Trusted domains list box press the Add... button. You will be prompted for the trusted domain name and the relationship password. Type in SAMBA, as this is -your domain name, and the password used at the time of account creation. +the name of the remote domain, and the password used at the time of account creation. Press OK and, if everything went without incident, you will see Trusted domain relationship successfully established message. -

    Samba-3 as the Trusted Domain

    +

    Samba as the Trusting Domain

    This time activities are somewhat reversed. Again, we'll assume that your domain controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA.

    -The very first thing requirement is to add an account for the SAMBA domain on RUMBA's PDC. -

    +The very first step is to add an account for the SAMBA domain on RUMBA's PDC. +

    Launch the Domain User Manager, then from the menu select Policies, Trust Relationships. -Now, next to Trusted Domains box press the Add -button, and type in the name of the trusted domain (SAMBA) and password securing +Now, next to the Trusted Domains box press the Add +button, and type in the name of the trusted domain (SAMBA) and the password to use in securing the relationship.

    The password can be arbitrarily chosen. It is easy to change the password @@ -138,38 +185,39 @@ Using your favourite shell while being logged in as root, issue this command: root# net rpc trustdom establish rumba

    You will be prompted for the password you just typed on your Windows NT4 Server box. -Do not worry if you see an error message that mentions a returned code of -NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the +Do not worry if you see an error message that mentions a return code of +NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the password you gave is correct and the NT4 Server says the account is ready for interdomain connection and not for ordinary -connection. After that, be patient it can take a while (especially -in large networks), you should see the Success message. +connection. After that, be patient; it can take a while (especially +in large networks), but eventually you should see the Success message. Congratulations! Your trust relationship has just been established.

    Note

    Note that you have to run this command as root because you must have write access to the secrets.tdb file. -

    Common Errors

    +

    NT4-style Domain Trusts with Windows 2000

    +Although Domain User Manager is not present in Windows 2000, it is +also possible to establish an NT4-style trust relationship with a Windows 2000 domain +controller running in mixed mode as the trusting server. It should also be possible for +Samba to trust a Windows 2000 server, however, more testing is still needed in this area. +

    +After creating the interdomain trust account on the +Samba server as described above, open Active Directory Domains and +Trusts on the AD controller of the domain whose resources you wish Samba users +to have access to. Remember that since NT4-style trusts are not transitive, if you want +your users to have access to multiple mixed-mode domains in your AD forest, you will need to +repeat this process for each of those domains. With Active Directory Domains +and Trusts open, right-click on the name of the Active Directory domain that +will trust our Samba domain and choose Properties, then click on +the Trusts tab. In the upper part of the panel, you will see a list box +labelled Domains trusted by this domain:, and an +Add... button next to it. Press this button, and just as with NT4, you +will be prompted for the trusted domain name and the relationship password. Press OK, and +after a moment, Active Directory will respond with The trusted domain has +been added and the trust has been verified. Your Samba users can now be +granted acess to resources in the AD domain. +

    Common Errors

    Interdomain trust relationships should NOT be attempted on networks that are unstable or that suffer regular outages. Network stability and integrity are key concerns with distributed trusted domains. -

    Tell me about Trust Relationships using Samba

    - Like many, I administer multiple LANs connected together using NT trust - relationships. This was implemented about 4 years ago. I now have the - occasion to consider performing this same task again, but this time, I - would like to implement it solely through samba - no Microsoft PDCs - anywhere. -

    - I have read documentation on samba.org regarding NT-style trust - relationships and am now wondering, can I do what I want to? I already - have successfully implemented 2 samba servers, but they are not PDCs. - They merely act as file servers. I seem to remember, and it appears to - be true (according to samba.org) that trust relationships are a - challenge. -

    - Please provide any helpful feedback that you may have. -

    - These are almost complete in Samba 3.0 snapshots. The main catch - is getting winbindd to be able to allocate UID/GIDs for trusted - users/groups. See the updated Samba HOWTO collection for more - details. -

    Prev Up Next
    Chapter 15. Securing Samba Home Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    +

    Prev Up Next
    Chapter 15. Securing Samba Home Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    diff --git a/docs/htmldocs/IntroSMB.html b/docs/htmldocs/IntroSMB.html index f9c2539112..51a22f14fa 100644 --- a/docs/htmldocs/IntroSMB.html +++ b/docs/htmldocs/IntroSMB.html @@ -1,4 +1,4 @@ -Chapter 1. Introduction to Samba
    Chapter 1. Introduction to Samba
    Prev Part I. General Installation Next

    Chapter 1. Introduction to Samba

    David Lechnyr

    Unofficial HOWTO

    April 14, 2003

    Table of Contents

    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous

    “ +Chapter 1. Introduction to Samba

    Chapter 1. Introduction to Samba
    Prev Part I. General Installation Next

    Chapter 1. Introduction to Samba

    David Lechnyr

    Unofficial HOWTO

    April 14, 2003

    Table of Contents

    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous

    “ "If you understand what you're doing, you're not learning anything." -- Anonymous ”

    @@ -7,7 +7,7 @@ transport protocol. In fact, it can support any SMB/CIFS-enabled client. One of strengths is that you can use it to blend your mix of Windows and Linux machines together without requiring a separate Windows NT/2000/2003 Server. Samba is actively being developed by a global team of about 30 active programmers and was originally developed by Andrew Tridgell. -

    Background

    +

    Background

    Once long ago, there was a buzzword referred to as DCE/RPC. This stood for Distributed Computing Environment/Remote Procedure Calls and conceptually was a good idea. It was originally developed by Apollo/HP as NCA 1.0 (Network Computing Architecture) and only @@ -33,7 +33,7 @@ been dutifully waded through during the information-gathering stages of this pro are *still* many missing pieces... While often tedious, at least the way has been generously littered with occurrences of clapping hand to forehead and muttering 'crikey, what are they thinking? -

    Terminology

    • +

    Terminology

    • SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol.

    • CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently @@ -83,7 +83,7 @@ thinking? W3K: Acronym for Windows 2003 Server

    If you plan on getting help, make sure to subscribe to the Samba Mailing List (available at http://www.samba.org). -

    Related Projects

    +

    Related Projects

    There are currently two network filesystem client projects for Linux that are directly related to Samba: SMBFS and CIFS VFS. These are both available in the Linux kernel itself.

    • @@ -105,7 +105,7 @@ nothing to do with acting as a file and print server for SMB/CIFS clients. There are other Open Source CIFS client implementations, such as the jCIFS project which provides an SMB client toolkit written in Java. -

    SMB Methodology

    +

    SMB Methodology

    Traditionally, SMB uses UDP port 137 (NetBIOS name service, or netbios-ns), UDP port 138 (NetBIOS datagram service, or netbios-dgm), and TCP port 139 (NetBIOS session service, or netbios-ssn). Anyone looking at their network with a good @@ -137,7 +137,7 @@ up a single file. In general, SMB sessions are established in the following orde A good way to examine this process in depth is to try out SecurityFriday's SWB program. It allows you to walk through the establishment of a SMB/CIFS session step by step. -

    Epilogue

    “ +

    Epilogue

    “ What's fundamentally wrong is that nobody ever had any taste when they did it. Microsoft has been very much into making the user interface look good, but internally it's just a complete mess. And even people who program for Microsoft @@ -166,9 +166,9 @@ not the completely clueless user who probably sits there shivering thinking That's what's really irritating to me." ”

    -- Linus Torvalds, from an interview with BOOT Magazine, Sept 1998 -

    Miscellaneous

    +

    Miscellaneous

    This chapter is Copyright 2003 David Lechnyr (david at lechnyr dot com). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation. A copy of the license is available at http://www.gnu.org/licenses/fdl.txt. -

    Prev Up Next
    Part I. General Installation Home Chapter 2. How to Install and Test SAMBA
    +

    Prev Up Next
    Part I. General Installation Home Chapter 2. How to Install and Test SAMBA
    diff --git a/docs/htmldocs/NT4Migration.html b/docs/htmldocs/NT4Migration.html index 72c6269f0e..b561492644 100644 --- a/docs/htmldocs/NT4Migration.html +++ b/docs/htmldocs/NT4Migration.html @@ -1,7 +1,7 @@ -Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    Prev Part IV. Migration and Updating Next

    Chapter 31. Migration from NT4 PDC to Samba-3 PDC

    John H. Terpstra

    Samba Team

    April 3, 2003

    Table of Contents

    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices

    +Chapter 31. Migration from NT4 PDC to Samba-3 PDC

    Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    Prev Part IV. Migration and Updating Next

    Chapter 31. Migration from NT4 PDC to Samba-3 PDC

    John H. Terpstra

    Samba Team

    April 3, 2003

    Table of Contents

    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices

    This is a rough guide to assist those wishing to migrate from NT4 domain control to Samba-3 based domain control. -

    Planning and Getting Started

    +

    Planning and Getting Started

    In the IT world there is often a saying that all problems are encountered because of poor planning. The corollary to this saying is that not all problems can be anticipated and planned for. Then again, good planning will anticipate most show stopper type situations. @@ -9,65 +9,62 @@ and planned for. Then again, good planning will anticipate most show stopper typ Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control environment would do well to develop a detailed migration plan. So here are a few pointers to help migration get under way. -

    Objectives

    +

    Objectives

    The key objective for most organisations will be to make the migration from MS Windows NT4 to Samba-3 domain control as painless as possible. One of the challenges you may experience in your migration process may well be one of convincing management that the new environment should remain in place. Many who have introduced open source technologies have experienced pressure to return to a Microsoft based platform solution at the first sign of trouble.

    -It is strongly advised that before attempting a migration to a Samba-3 controlled network -that every possible effort be made to gain all-round commitment to the change. Firstly, you -should know precisely why the change is important for the organisation. -Possible motivations to make a change include: -

    Improve network manageability
    Obtain better user level functionality
    Reduce network operating costs
    Reduce exposure caused by Microsoft withdrawal of NT4 support
    Avoid MS License 6 implications
    Reduce organisation's dependency on Microsoft

    -It is vital that it be well recognised that Samba-3 is NOT MS Windows NT4. Samba-3 offers -an alternative solution that is both different from MS Windows NT4 and that offers some -advantages compared with it. It should also be recognised that Samba-3 lacks many of the +Before attempting a migration to a Samba-3 controlled network make every possible effort to +gain all-round commitment to the change. Know precisely why the change +is important for the organisation. Possible motivations to make a change include: +

    • Improve network manageability

    • Obtain better user level functionality

    • Reduce network operating costs

    • Reduce exposure caused by Microsoft withdrawal of NT4 support

    • Avoid MS License 6 implications

    • Reduce organisation's dependency on Microsoft

    +Make sure that everyone knows that Samba-3 is NOT MS Windows NT4. Samba-3 offers +an alternative solution that is both different from MS Windows NT4 and that offers +advantages compared with it. Gain recognition that Samba-3 lacks many of the features that Microsoft has promoted as core values in migration from MS Windows NT4 to MS Windows 2000 and beyond (with or without Active Directory services).

    What are the features that Samba-3 can NOT provide? -

    Active Directory Server
    Group Policy Objects (in Active Directory)
    Machine Policy objects
    Logon Scripts in Active Directory
    Software Application and Access Controls in Active Directory

    +

    • Active Directory Server

    • Group Policy Objects (in Active Directory)

    • Machine Policy objects

    • Logon Scripts in Active Directory

    • Software Application and Access Controls in Active Directory

    The features that Samba-3 DOES provide and that may be of compelling interest to your site includes: -

    Lower Cost of Ownership
    Global availability of support with no strings attached
    Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system)
    Creation of on-the-fly logon scripts
    Creation of on-the-fly Policy Files
    Greater Stability, Reliability, Performance and Availability
    Manageability via an ssh connection
    Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam)
    Ability to implement a full single-sign-on architecture
    Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand

    -Before migrating a network from MS Windows NT4 to Samba-3 it is vital that all necessary factors are -considered. Users should be educated about changes they may experience so that the change will be a -welcome one and not become an obstacle to the work they need to do. The following are some of the -factors that will go into a successful migration: -

    Domain Layout

    +

    • Lower Cost of Ownership

    • Global availability of support with no strings attached

    • Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system)

    • Creation of on-the-fly logon scripts

    • Creation of on-the-fly Policy Files

    • Greater Stability, Reliability, Performance and Availability

    • Manageability via an ssh connection

    • Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam)

    • Ability to implement a full single-sign-on architecture

    • Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand

    +Before migrating a network from MS Windows NT4 to Samba-3 consider all necessary factors. Users +should be educated about changes they may experience so that the change will be a welcome one +and not become an obstacle to the work they need to do. The following are factors that will +help ensure a successful migration: +

    Domain Layout

    Samba-3 can be configured as a domain controller, a back-up domain controller (probably best called a secondary controller), a domain member, or as a stand-alone server. The Windows network security domain context should be sized and scoped before implementation. Particular attention needs to be paid to the location of the primary domain controller (PDC) as well as backup controllers (BDCs). -It should be noted that one way in which Samba-3 differs from Microsoft technology is that if one -chooses to use an LDAP authentication backend then the same database can be used by several different -domains. This means that in a complex organisation there can be a single LDAP database, that itself -can be distributed, that can simultaneously serve multiple domains (that can also be widely distributed). +One way in which Samba-3 differs from Microsoft technology is that if one chooses to use an LDAP +authentication backend then the same database can be used by several different domains. In a +complex organisation there can be a single LDAP database, which itself can be distributed (ie: Have +a master server and multiple slave servers) that can simultaneously serve multiple domains.

    -It is recommended that from a design perspective, the number of users per server, as well as the number -of servers, per domain should be scaled according to needs and should also consider server capacity -and network bandwidth. +From a design perspective, the number of users per server, as well as the number of servers, per +domain should be scaled taking into consideration server capacity and network bandwidth.

    -A physical network segment may house several domains, each of which may span multiple network segments. -Where domains span routed network segments it is most advisable to consider and test the performance -implications of the design and layout of a network. A Centrally located domain controller that is being -designed to serve multiple routed network segments may result in severe performance problems if the -response time (eg: ping timing) between the remote segment and the PDC is more than 100 ms. In situations -where the delay is too long it is highly recommended to locate a backup controller (BDC) to serve as -the local authentication and access control server. -

    Server Share and Directory Layout

    -There are few cardinal rules to effective network design that can be broken with impunity. -The most important rule of effective network management is that simplicity is king in every -well controlled network. Every part of the infrastructure must be managed, the more complex -it is, the greater will be the demand of keeping systems secure and functional. +A physical network segment may house several domains. Each may span multiple network segments. +Where domains span routed network segments, consider and test the performance implications of +the design and layout of a network. A Centrally located domain controller that is designed to +serve multiple routed network segments may result in severe performance problems. Check the +response time (eg: ping timing) between the remote segment and the PDC. If long (more than 100 ms) +locate a backup controller (BDC) on the remote segmanet to serve as the local authentication and +access control server. +

    Server Share and Directory Layout

    +There are cardinal rules to effective network design. These can not be broken with impunity. +The most important rule: Simplicity is king in every well controlled network. Every part of +the infrastructure must be managed, the more complex it is, the greater will be the demand +of keeping systems secure and functional.

    -The nature of the data that must be stored needs to be born in mind when deciding how many -shares must be created. The physical disk space layout should also be taken into account -when designing where share points will be created. Keep in mind that all data needs to be -backed up, thus the simpler the disk layout the easier it will be to keep track of what must -be backed up to tape or other off-line storage medium. Always plan and implement for minimum +Keep in mind the nature of how data must be share. Physical disk space layout should be considered +carefully. Some data must be backed up. The simpler the disk layout the easier it will be to +keep track of backed needs. Identify what back media will be meet needs, consider backup to tape +, CD-ROM or (DVD-ROM), or other off-line storage medium. Plan and implement for minimum maintenance. Leave nothing to chance in your design, above all, do not leave backups to chance: Backup and test, validate every backup, create a disaster recovery plan and prove that it works.

    @@ -75,54 +72,70 @@ Users should be grouped according to data access control needs. File and directo is best controlled via group permissions and the use of the "sticky bit" on group controlled directories may substantially avoid file access complaints from samba share users.

    -Many network administrators who are new to the game will attempt to use elaborate techniques -to set access controls, on files, directories, shares, as well as in share definitions. -There is the ever present danger that that administrator's successor will not understand the -complex mess that has been inherited. Remember, apparent job security through complex design -and implementation may ultimately cause loss of operations and downtime to users as the new -administrator learns to untangle your web. Keep access controls simple and effective and -make sure that users will never be interrupted by the stupidity of complexity. -

    Logon Scripts

    -Please refer to the section of this document on Advanced Network Administration for information -regarding the network logon script options for Samba-3. Logon scripts can help to ensure that -all users gain share and printer connections they need. +Inexperienced network administrators often attempt elaborate techniques to set access +controls on files, directories, shares, as well as in share definitions. +Keep your design and implementation simple and document your design extensively. Have others +audit your documentation. Do not create a complex mess that your successor will not understand. +Remember, job security through complex design and implementation may cause loss of operations +and downtime to users as the new administrator learns to untangle your knots. Keep access +controls simple and effective and make sure that users will never be interrupted by stupid +complexity. +

    Logon Scripts

    +Logon scripts can help to ensure that all users gain share and printer connections they need.

    -Logon scripts can be created on-the-fly so that all commands executed are specific to the -rights and privileges granted to the user. The preferred controls should be affected through +Logon scripts can be created 'on-the-fly' so that all commands executed are specific to the +rights and priviliges granted to the user. The preferred controls should be affected through group membership so that group information can be used to custom create a logon script using -the root preexec parameters to the NETLOGON share. +the root preexec parameters to the NETLOGON share.

    Some sites prefer to use a tool such as kixstart to establish a controlled user environment. In any case you may wish to do a google search for logon script process controls. In particular, you may wish to explore the use of the Microsoft knowledgebase article KB189105 that deals with how to add printers without user intervention via the logon script process. -

    Profile Migration/Creation

    +

    Profile Migration/Creation

    User and Group Profiles may be migrated using the tools described in the section titled Desktop Profile Management.

    Profiles may also be managed using the Samba-3 tool profiles. This tool allows the MS Windows NT style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file to be changed to the SID of the Samba-3 domain. -

    User and Group Accounts

    +

    User and Group Accounts

    It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before attempting to migrate user and group accounts it is STRONGLY advised to create in Samba-3 the -groups that are present on the MS Windows NT4 domain AND to connect these to -suitable Unix/Linux groups. Following this simple advice will mean that all user and group attributes +groups that are present on the MS Windows NT4 domain AND to map these to +suitable Unix/Linux groups. By following this simple advice all user and group attributes should migrate painlessly. -

    Steps In Migration Process

    +

    Steps In Migration Process

    The approximate migration process is described below.

    • You will have an NT4 PDC that has the users, groups, policies and profiles to be migrated

    • -Samba-3 set up as a DC with netlogon share, profile share, etc. -

    Procedure 31.1. The Account Migration Process

    1. Create a BDC account for the samba server using NT Server Manager

      1. Samba must NOT be running

    2. rpcclient NT4PDC -U Administrator%passwd

      1. lsaquery

      2. Note the SID returned

    3. net getsid -S NT4PDC -w DOMNAME -U Administrator%passwd

      1. Note the SID

    4. net getlocalsid

      1. Note the SID, now check that all three SIDS reported are the same!

    5. net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd

    6. net rpc vampire -S NT4PDC -U administrator%passwd

    7. pdbedit -L

      1. Note - did the users migrate?

    8. initGrps.sh DOMNAME

    9. net groupmap list

      1. Now check that all groups are recognised

    10. net rpc vampire -S NT4PDC -U administrator%passwd

    11. pdbedit -Lv

      1. Note - check that all group membership has been migrated

    -Now it is time to migrate all the profiles, then migrate all policy files. -More later. -

    Migration Options

    -Based on feedback from many sites as well as from actual installation and maintenance -experience sites that wish to migrate from MS Windows NT4 Domain Control to a Samba -based solution fit into three basic categories. -

    Table 31.1. The 3 Major Site Types

    Number of UsersDescription
    < 50

    Want simple conversion with NO pain

    50 - 250

    Want new features, can manage some in-house complexity

    > 250

    Solution/Implementation MUST scale well, complex needs. Cross departmental decision process. Local expertise in most areas

    Planning for Success

    +Samba-3 set up as a DC with netlogon share, profile share, etc. Configure the smb.conf file +to fucntion as a BDC. ie: domain master = No. +

    Procedure 31.1. The Account Migration Process

    1. Create a BDC account for the samba server using NT Server Manager

      1. Samba must NOT be running

    2. net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd

    3. net rpc vampire -S NT4PDC -U administrator%passwd

    4. pdbedit -L

      1. Note - did the users migrate?

    5. + Now assign each of the UNIX groups to NT groups: + (Note: It may be useful to copy this text to a script called + initGroups.sh) + 

      +#!/bin/bash
+#### Keep this as a shell script for future re-use
+			
+# First assign well known domain global groups
+net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmins
+net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
+net groupmap modify ntgroup="Domain Users" unixgroup=users
+
+# Now for our added domain global groups
+net groupmap add ntgroup="Designers" unixgroup=designers type=d rid=3200
+net groupmap add ntgroup="Engineers" unixgroup=engineers type=d rid=3210
+net groupmap add ntgroup="QA Team"   unixgroup=qateam    type=d rid=3220
+

      +

    6. net groupmap list

      1. Now check that all groups are recognised

    +Now migrate all the profiles, then migrate all policy files. +

    Migration Options

    +Sites that wish to migrate from MS Windows NT4 Domain Control to a Samba based solution +generally fit into three basic categories. +

    Table 31.1. The 3 Major Site Types

    Number of UsersDescription
    < 50

    Want simple conversion with NO pain

    50 - 250

    Want new features, can manage some in-house complexity

    > 250

    Solution/Implementation MUST scale well, complex needs. Cross departmental decision process. Local expertise in most areas

    Planning for Success

    There are three basic choices for sites that intend to migrate from MS Windows NT4 to Samba-3.

    • @@ -132,7 +145,7 @@ to Samba-3.

    • Complete Redesign (completely new solution)

    -No matter what choice you make, the following rules will minimise down-stream problems: +Minimise down-stream problems by:

    • Take sufficient time

    • @@ -141,62 +154,25 @@ No matter what choice you make, the following rules will minimise down-stream pr Test ALL assumptions

    • Test full roll-out program, including workstation deployment -

    Table 31.2. Nature of the Conversion Choices

    SimpleUpgradedRedesign

    Make use of minimal OS specific features

    Translate NT4 features to new host OS features

    Decide:

    Suck all accounts from NT4 into Samba-3

    Copy and improve:

    Authentication Regime (database location and access)

    Make least number of operational changes

    Make progressive improvements

    Desktop Management Methods

    Take least amount of time to migrate

    Minimise user impact

    Better Control of Desktops / Users

    Live versus Isolated Conversion

    Maximise functionality

    Identify Needs for: Manageability, Scalability, Security, Availability

    Integrate Samba-3 then migrate while users are active, then Change of control (ie: swap out)

    Take advantage of lower maintenance opportunity

    Samba Implementation Choices

    -Authentication database back end
-	Winbind (external Samba or NT4/200x server)
-	Can use pam_mkhomedir.so to auto-create home dirs
-	External server could use Active Directory or NT4 Domain
-
-Database type
-	smbpasswd, tdbsam, ldapsam, mysqlsam
-
-Access Control Points
-	On the Share itself (Use NT4 Server Manager)
-	On the file system
-	Unix permissions on files and directories
-	Enable Posix ACLs in file system?
-	Through Samba share parameters
-		Not recommended - except as only resort
-
-Policies (migrate or create new ones)
-	Group Policy Editor (NT4)
-	Watch out for Tattoo effect
-
-User and Group Profiles
-	Platform specific so use platform tool to change from a Local
-	to a Roaming profile Can use new profiles tool to change SIDs
-	(NTUser.DAT)
-
-Logon Scripts (Know how they work)
-
-User and Group mapping to Unix/Linux
-	username map facility may be needed
-	Use 'net groupmap' to connect NT4 groups to Unix groups
-	Use pdbedit to set/change user configuration
-NOTE:
-If migrating to LDAP back end it may be easier to dump initial LDAP database
-to LDIF, then edit, then reload into LDAP
-
-	OS specific scripts / programs may be needed
-		Add / delete Users
-			Note OS limits on size of name (Linux 8 chars)
-				NT4 up to 254 chars
-		Add / delete machines
-			Applied only to domain members (note up to 16 chars)
-		Add / delete Groups
-			Note OS limits on size and nature
-				Linux limit is 16 char,
-				no spaces and no upper case chars (groupadd)
-
-Migration Tools
-	Domain Control (NT4 Style)
-	Profiles, Policies, Access Controls, Security
-
-Migration Tools
-	Samba: net, rpcclient, smbpasswd, pdbedit, profiles
-	Windows: NT4 Domain User Manager, Server Manager (NEXUS)
-
-Authentication
-	New SAM back end (smbpasswd, tdbsam, ldapsam, mysqlsam)
-

    -

    Prev Up Next
    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0 Home Chapter 32. SWAT - The Samba Web Administration Tool
    +

    Table 31.2. Nature of the Conversion Choices

    SimpleUpgradedRedesign

    Make use of minimal OS specific features

    Translate NT4 features to new host OS features

    Decide:

    Suck all accounts from NT4 into Samba-3

    Copy and improve:

    Authentication Regime (database location and access)

    Make least number of operational changes

    Make progressive improvements

    Desktop Management Methods

    Take least amount of time to migrate

    Minimise user impact

    Better Control of Desktops / Users

    Live versus Isolated Conversion

    Maximise functionality

    Identify Needs for: Manageability, Scalability, Security, Availability

    Integrate Samba-3 then migrate while users are active, then Change of control (ie: swap out)

    Take advantage of lower maintenance opportunity

    Samba-3 Implementation Choices

    Authentication database/back end:

    + Samba-3 can use an external authentication backend: +

    +

    • Winbind (external Samba or NT4/200x server)

    • External server could use Active Directory or NT4 Domain

    • Can use pam_mkhomedir.so to auto-create home dirs

    +

    + Samba-3 can use a local authentication backend: +

    • smbpasswd, tdbsam, ldapsam, mysqlsam

    +

    Access Control Points:

    • On the Share itself - using Share ACLs

    • On the file system - using UNIX permissions on files and directories

      Note: Can Enable Posix ACLs in file system also

    • Through Samba share parameters - Not recommended - except as last resort

    Policies (migrate or create new ones):

    • Using Group Policy Editor (NT4)

    • - Watch out for Tattoo effect

    User and Group Profiles:

    + Platform specific so use platform tool to change from a Local to a Roaming profile + Can use new profiles tool to change SIDs (NTUser.DAT) +

    Logon Scripts:

    + Know how they work +

    User and Group mapping to Unix/Linux:

    • username map facility may be needed

    • Use 'net groupmap' to connect NT4 groups to Unix groups

    • Use pdbedit to set/change user configuration

      + NOTE: When migrating to LDAP back, end it may be easier to dump initial + LDAP database to LDIF, then edit, then reload into LDAP +

    OS specific scripts/programs may be needed:

    • Add/Delete Users: Note OS limits on size of name + (Linux 8 chars) NT4 up to 254 chars

    • Add/Delete Machines: Applied only to domain members + (Note: Machine names may be limited to 16 characters)

    • Use 'net groupmap' to connect NT4 groups to Unix groups

    • Add/Delete Groups: Note OS limits on size and nature. + Linux limit is 16 char, no spaces and no upper case chars (groupadd)

    Migration Tools:

    + Domain Control (NT4 Style) Profiles, Policies, Access Controls, Security +

    • Samba: net, rpcclient, smbpasswd, pdbedit, profiles

    • Windows: NT4 Domain User Manager, Server Manager (NEXUS)

    +

    Prev Up Next
    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0 Home Chapter 32. SWAT - The Samba Web Administration Tool
    diff --git a/docs/htmldocs/NetworkBrowsing.html b/docs/htmldocs/NetworkBrowsing.html index eb4d9858ca..4507c0067f 100644 --- a/docs/htmldocs/NetworkBrowsing.html +++ b/docs/htmldocs/NetworkBrowsing.html @@ -1,4 +1,4 @@ -Chapter 10. Samba / MS Windows Network Browsing Guide
    Chapter 10. Samba / MS Windows Network Browsing Guide
    Prev Part III. Advanced Configuration Next

    Chapter 10. Samba / MS Windows Network Browsing Guide

    John H. Terpstra

    Samba Team

    July 5, 1998

    Updated: April 21, 2003

    Table of Contents

    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"

    +Chapter 10. Samba / MS Windows Network Browsing Guide

    Chapter 10. Samba / MS Windows Network Browsing Guide
    Prev Part III. Advanced Configuration Next

    Chapter 10. Samba / MS Windows Network Browsing Guide

    John H. Terpstra

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    July 5, 1998

    Updated: April 21, 2003

    Table of Contents

    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    I get an Unable to browse the network error

    This document contains detailed information as well as a fast track guide to implementing browsing across subnets and / or across workgroups (or domains). WINS is the best tool for resolution of NetBIOS names to IP addresses. WINS is @@ -9,11 +9,11 @@ over TCP/IP. Samba-3 and later also supports this mode of operation. When the use of NetBIOS over TCP/IP has been disabled then the primary means for resolution of MS Windows machine names is via DNS and Active Directory. The following information assumes that your site is running NetBIOS over TCP/IP. -

    Features and Benefits

    +

    Features and Benefits

    Someone once referred to the past in terms of: They were the worst of times, they were the best of times. The more we look back, them more we long for what was and hope it never returns!. -

    +

    For many MS Windows network administrators, that statement sums up their feelings about NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle nature was just par for the course. For those who never quite managed to tame its @@ -38,63 +38,55 @@ help Samba to affect stable WINS operations beyond the normal scope of MS WINS.

    Please note that WINS is exclusively a service that applies only to those systems that run NetBIOS over TCP/IP. MS Windows 200x / XP have the capacity to turn off -support for NetBIOS, in which case WINS is of no relevance. Samba-3 supports this also. +support for NetBIOS, in which case WINS is of no relevance. Samba supports this also.

    For those networks on which NetBIOS has been disabled (ie: WINS is NOT required) the use of DNS is necessary for host name resolution. -

    What is Browsing?

    +

    What is Browsing?

    To most people browsing means that they can see the MS Windows and Samba servers in the Network Neighborhood, and when the computer icon for a particular server is clicked, it opens up and shows the shares and printers available on the target server.

    What seems so simple is in fact a very complex interaction of different technologies. The technologies (or methods) employed in making all of this work includes: -

    MS Windows machines register their presence to the network
    Machines announce themselves to other machines on the network
    One or more machine on the network collates the local announcements
    The client machine finds the machine that has the collated list of machines
    The client machine is able to resolve the machine names to IP addresses
    The client machine is able to connect to a target machine

    +

    • MS Windows machines register their presence to the network

    • Machines announce themselves to other machines on the network

    • One or more machine on the network collates the local announcements

    • The client machine finds the machine that has the collated list of machines

    • The client machine is able to resolve the machine names to IP addresses

    • The client machine is able to connect to a target machine

    The Samba application that controls browse list management and name resolution is called nmbd. The configuration parameters involved in nmbd's operation are: -

    -		
-	Browsing options:
-	-----------------
-		* os level
-		  lm announce
-		  lm interval
-		* preferred master
-		* local master
-		* domain master
-		  browse list
-		  enhanced browsing
-
-	Name Resolution Method:
-	-----------------------
-		* name resolve order
-
-	WINS options:
-	-------------
-		  dns proxy
-		  wins proxy
-		* wins server
-		* wins support
-		  wins hook
-

    +

    Browsing options: os level(*), + lm announce, + lm interval, + preferred master(*), + local master(*), + domain master(*), + browse list, + enhanced browsing. +

    Name Resolution Method: + name resolve order(*). +

    WINS options: + dns proxy, + wins proxy, + wins server(*), + wins support(*), + wins hook. +

    For Samba, the WINS Server and WINS Support are mutually exclusive options. Those marked with an '*' are the only options that commonly MAY need to be modified. Even if not one of these parameters is set nmbd will still do it's job. -

    Discussion

    +

    Discussion

    Firstly, all MS Windows networking uses SMB (Server Message Block) based messaging. SMB messaging may be implemented with or without NetBIOS. MS Windows 200x supports NetBIOS over TCP/IP for backwards compatibility. Microsoft is intent on phasing out NetBIOS support. -

    NetBIOS over TCP/IP

    +

    NetBIOS over TCP/IP

    Samba implements NetBIOS, as does MS Windows NT / 200x / XP, by encapsulating it over TCP/IP. MS Windows products can do likewise. NetBIOS based networking uses broadcast messaging to affect browse list management. When running NetBIOS over TCP/IP, this uses UDP based messaging. UDP messages can be broadcast or unicast. -

    +

    Normally, only unicast UDP messaging can be forwarded by routers. The -remote announce parameter to smb.conf helps to project browse announcements +remote announce parameter to smb.conf helps to project browse announcements to remote network segments via unicast UDP. Similarly, the -remote browse sync parameter of smb.conf +remote browse sync parameter of smb.conf implements browse list collation using unicast UDP.

    Secondly, in those networks where Samba is the only SMB server technology, @@ -102,12 +94,13 @@ wherever possible nmbd should be configured on one (1) server. This makes it easy to manage the browsing environment. If each network segment is configured with it's own Samba WINS server, then the only way to get cross segment browsing to work is by using the -remote announce and the remote browse sync +remote announce and the remote browse sync parameters to your smb.conf file.

    + If only one WINS server is used for an entire multi-segment network then -the use of the remote announce and the -remote browse sync parameters should NOT be necessary. +the use of the remote announce and the +remote browse sync parameters should NOT be necessary.

    As of Samba 3 WINS replication is being worked on. The bulk of the code has been committed, but it still needs maturation. This is NOT a supported feature @@ -118,7 +111,7 @@ Right now Samba WINS does not support MS-WINS replication. This means that when setting up Samba as a WINS server there must only be one nmbd configured as a WINS server on the network. Some sites have used multiple Samba WINS servers for redundancy (one server per subnet) and then used -remote browse sync and remote announce +remote browse sync and remote announce to affect browse list collation across all segments. Note that this means clients will only resolve local names, and must be configured to use DNS to resolve names on other subnets in order to resolve the IP addresses of the servers they can see @@ -129,7 +122,10 @@ Lastly, take note that browse lists are a collection of unreliable broadcast messages that are repeated at intervals of not more than 15 minutes. This means that it will take time to establish a browse list and it can take up to 45 minutes to stabilise, particularly across network segments. -

    TCP/IP - without NetBIOS

    +

    TCP/IP - without NetBIOS

    + + + All TCP/IP using systems use various forms of host name resolution. The primary methods for TCP/IP hostname resolutions involves either a static file (/etc/hosts ) or DNS (the Domain Name System). DNS is the technology that makes @@ -152,7 +148,7 @@ it follows a defined path:

  • Looks up entries in LMHOSTS. It is located in C:\WinNT\System32\Drivers\etc. -

    • +

    Windows 200x / XP can register it's host name with a Dynamic DNS server. You can force register with a Dynamic DNS server in Windows 200x / XP using: ipconfig /registerdns @@ -165,8 +161,8 @@ consequently network services will be severely impaired. The use of Dynamic DNS is highly recommended with Active Directory, in which case the use of BIND9 is preferred for it's ability to adequately support the SRV (service) records that are needed for Active Directory. -

    DNS and Active Directory

    -Occasionally we hear from Unix network administrators who want to use a Unix based Dynamic +

    DNS and Active Directory

    +Occasionally we hear from UNIX network administrators who want to use a UNIX based Dynamic DNS server in place of the Microsoft DNS server. While this might be desirable to some, the MS Windows 200x DNS server is auto-configured to work with Active Directory. It is possible to use BIND version 8 or 9, but it will almost certainly be necessary to create service records @@ -187,7 +183,7 @@ The following are some of the default service records that Active Directory requ

  • _ldap._tcp.Site.gc.ms-dcs.DomainTree

    Used by MS Windows clients to locate site configuration dependent Global Catalog server. -

    • How Browsing Functions

    +

    How Browsing Functions

    MS Windows machines register their NetBIOS names (ie: the machine name for each service type in operation) on start up. The exact method by which this name registration @@ -201,7 +197,7 @@ resolution to the local subnet, unless LMHOSTS is used to list all names and IP addresses. In such situations Samba provides a means by which the Samba server name may be forcibly injected into the browse list of a remote MS Windows network (using the -remote announce parameter). +remote announce parameter).

    Where a WINS server is used, the MS Windows client will use UDP unicast to register with the WINS server. Such packets can be routed @@ -229,20 +225,18 @@ will annoy users because they will have to put up with protracted inability to use the network services.

    Samba supports a feature that allows forced synchronisation -of browse lists across routed networks using the remote -browse sync parameter in the smb.conf file. +of browse lists across routed networks using the remote browse sync parameter in the smb.conf file. This causes Samba to contact the local master browser on a remote network and to request browse list synchronisation. This effectively bridges two networks that are separated by routers. The two remote networks may use either broadcast based name resolution or WINS -based name resolution, but it should be noted that the remote -browse sync parameter provides browse list synchronisation - and +based name resolution, but it should be noted that the remote browse sync parameter provides browse list synchronisation - and that is distinct from name to address resolution, in other words, for cross subnet browsing to function correctly it is essential that a name to address resolution mechanism be provided. This mechanism could be via DNS, /etc/hosts, and so on. -

    Setting up WORKGROUP Browsing

    +

    Setting up WORKGROUP Browsing

    To set up cross subnet browsing on a network containing machines in up to be in a WORKGROUP, not an NT Domain you need to set up one Samba server to be the Domain Master Browser (note that this is *NOT* @@ -261,20 +255,13 @@ workgroup name. To set up a Samba server as a domain master browser, set the following option in the [global] section of the smb.conf file :

    -

    -	domain master = yes
-

    +

    domain master = yes

    -The domain master browser should also preferrably be the local master +The domain master browser should also preferably be the local master browser for its own subnet. In order to achieve this set the following options in the [global] section of the smb.conf file :

    -

    -	domain master = yes
-	local master = yes
-	preferred master = yes
-	os level = 65
-

    +

    Example 10.1. Domain master browser smb.conf

    [global]
    domain master = yes
    local master = yes
    preferred master = yes
    os level = 65

    The domain master browser may be the same machine as the WINS server, if you require. @@ -288,20 +275,15 @@ to use these). To make a Samba server a local master browser set the following options in the [global] section of the smb.conf file :

    -

    -	domain master = no
-	local master = yes
-	preferred master = yes
-	os level = 65
-

    +

    Example 10.2. Local master browser smb.conf

    [global]
    domain master = no
    local master = yes
    preferred master = yes
    os level = 65

    Do not do this for more than one Samba server on each subnet, or they will war with each other over which is to be the local master browser.

    -The local master parameter allows Samba to act as a -local master browser. The preferred master causes nmbd -to force a browser election on startup and the os level +The local master parameter allows Samba to act as a +local master browser. The preferred master causes nmbd +to force a browser election on startup and the os level parameter sets Samba high enough so that it should win any browser elections.

    If you have an NT machine on the subnet that you wish to @@ -310,13 +292,8 @@ becoming a local master browser by setting the following options in the [global] section of the smb.conf file :

    -

    -	domain master = no
-	local master = no
-	preferred master = no
-	os level = 0
-

    -

    Setting up DOMAIN Browsing

    +

    Example 10.3. smb.conf for not being a master browser

    [global]
    domain master = no
    local master = no
    preferred master = no
    os level = 0

    +

    Setting up DOMAIN Browsing

    If you are adding Samba servers to a Windows NT Domain then you must not set up a Samba server as a domain master browser. By default, a Windows NT Primary Domain Controller for a domain @@ -328,18 +305,13 @@ with WINS instead of the PDC. For subnets other than the one containing the Windows NT PDC you may set up Samba servers as local master browsers as described. To make a Samba server a local master browser set -the following options in the [global] section +the following options in the [global] section of the smb.conf file :

    -

    -	domain master = no
-	local master = yes
-	preferred master = yes
-	os level = 65
-

    +

    Example 10.4. Local master browser smb.conf

    [global]
    domain master = no
    local master = yes
    preferred master = yes
    os level = 65

    If you wish to have a Samba server fight the election with machines -on the same subnet you may set the os level parameter +on the same subnet you may set the os level parameter to lower levels. By doing this you can tune the order of machines that will become local master browsers if they are running. For more details on this see the section @@ -353,38 +325,33 @@ ever becoming a local master browser by setting following options in the [global] section of the smb.conf file :

    -

    -        domain master = no
-        local master = no
-        preferred master = no
-        os level = 0
-

    +

    Example 10.5. smb.conf for not being a master browser

    [global]
    domain master = no
    local master = no
    preferred master = no
    os level = 0

    Forcing Samba to be the master

    -Who becomes the master browser is determined by an election +Who becomes the master browser is determined by an election process using broadcasts. Each election packet contains a number of parameters which determine what precedence (bias) a host should have in the election. By default Samba uses a very low precedence and thus loses elections to just about anyone else.

    -If you want Samba to win elections then just set the os level global +If you want Samba to win elections then just set the os level global option in smb.conf to a higher number. It defaults to 0. Using 34 would make it win all elections over every other system (except other samba systems!)

    -A os level of 2 would make it beat WfWg and Win95, but not MS Windows +A os level of 2 would make it beat WfWg and Win95, but not MS Windows NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32.

    The maximum os level is 255

    If you want Samba to force an election on startup, then set the -preferred master global option in smb.conf to yes. Samba will +preferred master global option in smb.conf to yes. Samba will then have a slight advantage over other potential master browsers that are not preferred master browsers. Use this parameter with care, as if you have two hosts (whether they are Windows 95 or NT or -Samba) on the same local subnet both set with preferred master to +Samba) on the same local subnet both set with preferred master to yes, then periodically and continually they will force an election in order to become the local master browser.

    -If you want Samba to be a domain master browser, then it is -recommended that you also set preferred master to yes, because + If you want Samba to be a domain master browser, then it is +recommended that you also set preferred master to yes, because Samba will not become a domain master browser for the whole of your LAN or WAN if it is not also a local master browser on its own broadcast isolated subnet. @@ -396,10 +363,10 @@ attempt to become the domain master browser every 5 minutes. They will find that another Samba server is already the domain master browser and will fail. This provides automatic redundancy, should the current domain master browser fail. -

    Making Samba the domain master

    +

    Making Samba the domain master

    The domain master is responsible for collating the browse lists of multiple subnets so that browsing can occur between subnets. You can -make Samba act as the domain master by setting domain master = yes +make Samba act as the domain master by setting domain master = yes in smb.conf. By default it will not be a domain master.

    Note that you should not set Samba to be the domain master for a @@ -411,8 +378,8 @@ master browsers on other subnets and then contact them to synchronise browse lists.

    If you want Samba to be the domain master then I suggest you also set -the os level high enough to make sure it wins elections, and set -preferred master to yes, to get Samba to force an election on +the os level high enough to make sure it wins elections, and set +preferred master to yes, to get Samba to force an election on startup.

    Note that all your servers (including Samba) and clients should be @@ -438,31 +405,31 @@ If, however, both Samba and your clients are using a WINS server, then: resolve the NetBIOS name of that host. as long as that host has registered its NetBIOS name with the same WINS server, the user will be able to see that host. -

    Note about broadcast addresses

    +

    Note about broadcast addresses

    If your network uses a "0" based broadcast address (for example if it ends in a 0) then you will strike problems. Windows for Workgroups does not seem to support a 0's broadcast and you will probably find that browsing and name lookups won't work. -

    Multiple interfaces

    +

    Multiple interfaces

    Samba now supports machines with multiple network interfaces. If you -have multiple interfaces then you will need to use the interfaces +have multiple interfaces then you will need to use the interfaces option in smb.conf to configure them. -

    Use of the Remote Announce parameter

    -The remote announce parameter of +

    Use of the Remote Announce parameter

    +The remote announce parameter of smb.conf can be used to forcibly ensure that all the NetBIOS names on a network get announced to a remote network. -The syntax of the remote announce parameter is: -

    -	remote announce = a.b.c.d [e.f.g.h] ...
-

    +The syntax of the remote announce parameter is: +

    remote announce = a.b.c.d [e.f.g.h] ...

    or -

    -	remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...
-

    +

    remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...

    where:

    a.b.c.d and -e.f.g.h

    is either the LMB (Local Master Browser) IP address +e.f.g.h

    + + + + is either the LMB (Local Master Browser) IP address or the broadcast address of the remote network. ie: the LMB is at 192.168.1.10, or the address could be given as 192.168.1.255 where the netmask @@ -478,22 +445,20 @@ NetBIOS machine names will end up looking like they belong to that workgroup, this may cause name resolution problems and should be avoided.

    -

    Use of the Remote Browse Sync parameter

    -The remote browse sync parameter of +

    Use of the Remote Browse Sync parameter

    +The remote browse sync parameter of smb.conf is used to announce to another LMB that it must synchronise its NetBIOS name list with our Samba LMB. It works ONLY if the Samba server that has this option is simultaneously the LMB on its network segment.

    -The syntax of the remote browse sync parameter is: +The syntax of the remote browse sync parameter is: -

    -remote browse sync = a.b.c.d
-

    +

    remote browse sync = a.b.c.d

    where a.b.c.d is either the IP address of the remote LMB or else is the network broadcast address of the remote segment. -

    WINS - The Windows Internetworking Name Server

    +

    WINS - The Windows Internetworking Name Server

    Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly recommended. Every NetBIOS machine registers its name together with a name_type value for each of several types of service it has available. @@ -534,36 +499,34 @@ lookup attempts by other clients and will therefore cause workstation access errors.

    To configure Samba as a WINS server just add -wins support = yes to the smb.conf -file [globals] section. +wins support = yes to the smb.conf +file [global] section.

    To configure Samba to register with a WINS server just add -wins server = a.b.c.d to your smb.conf file [globals] section. +wins server = a.b.c.d to your smb.conf file [global] section.

    Important

    -Never use both wins support = yes together -with wins server = a.b.c.d +Never use both wins support = yes together +with wins server = a.b.c.d particularly not using it's own IP address. Specifying both will cause nmbd to refuse to start! -

    Setting up a WINS server

    +

    Setting up a WINS server

    Either a Samba machine or a Windows NT Server machine may be set up as a WINS server. To set a Samba machine to be a WINS server you must add the following option to the smb.conf file on the selected machine : -in the [globals] section add the line +in the [global] section add the line

    -

    -	wins support = yes
-

    +

    wins support = yes

    Versions of Samba prior to 1.9.17 had this parameter default to yes. If you have any older versions of Samba on your network it is strongly suggested you upgrade to a recent version, or at the very least set the parameter to 'no' on all these machines.

    -Machines with wins support = yes will keep a list of +Machines with wins support = yes will keep a list of all NetBIOS names registered with them, acting as a DNS for NetBIOS names.

    You should set up only ONE WINS server. Do NOT set the -wins support = yes option on more than one Samba +wins support = yes option on more than one Samba server.

    To set up a Windows NT Server as a WINS server you need to set up @@ -575,7 +538,7 @@ participate in these replications. It is possible in the future that a Samba->Samba WINS replication protocol may be defined, in which case more than one Samba machine could be set up as a WINS server but currently only one Samba server should have the -wins support = yes parameter set. +wins support = yes parameter set.

    After the WINS server has been configured you must ensure that all machines participating on the network are configured with the address @@ -586,17 +549,15 @@ in Windows 95 or Windows NT. To tell a Samba server the IP address of the WINS server add the following line to the [global] section of all smb.conf files :

    -

    -	wins server = <name or IP address>
-

    +

    wins server = <name or IP address>

    where <name or IP address> is either the DNS name of the WINS server machine or its IP address.

    Note that this line MUST NOT BE SET in the smb.conf file of the Samba server acting as the WINS server itself. If you set both the -wins support = yes option and the -wins server = <name> option then +wins support = yes option and the +wins server = <name> option then nmbd will fail to start.

    There are two possible scenarios for setting up cross subnet browsing. @@ -604,13 +565,13 @@ The first details setting up cross subnet browsing on a network containing Windows 95, Samba and Windows NT machines that are not configured as part of a Windows NT Domain. The second details setting up cross subnet browsing on networks that contain NT Domains. -

    WINS Replication

    +

    WINS Replication

    Samba-3 permits WINS replication through the use of the wrepld utility. This tool is not currently capable of being used as it is still in active development. As soon as this tool becomes moderately functional we will prepare man pages and enhance this section of the documentation to provide usage and technical details. -

    Static WINS Entries

    -Adding static entries to your Samba-3 WINS server is actually fairly easy. +

    Static WINS Entries

    +Adding static entries to your Samba WINS server is actually fairly easy. All you have to do is add a line to wins.dat, typically located in /usr/local/samba/var/locks.

    @@ -639,10 +600,10 @@ To make it static, all that has to be done is set the TTL to 0: Though this method works with early Samba-3 versions, there's a possibility that it may change in future versions if WINS replication is added. -

    Helpful Hints

    +

    Helpful Hints

    The following hints should be carefully considered as they are stumbling points for many new network administrators. -

    Windows Networking Protocols

    Warning

    +

    Windows Networking Protocols

    Warning

    Do NOT use more than one (1) protocol on MS Windows machines

    A very common cause of browsing problems results from installing more than @@ -672,34 +633,27 @@ differently from MS Windows NT4. Generally, where a server does NOT support the newer or extended protocol, these will fall back to the NT4 protocols.

    The safest rule of all to follow it this - USE ONLY ONE PROTOCOL! -

    Name Resolution Order

    +

    Name Resolution Order

    Resolution of NetBIOS names to IP addresses can take place using a number of methods. The only ones that can provide NetBIOS name_type information are: -

    WINS: the best tool!
    LMHOSTS: is static and hard to maintain.
    Broadcast: uses UDP and can not resolve names across remote segments.

    +

    • WINS: the best tool!

    • LMHOSTS: is static and hard to maintain.

    • Broadcast: uses UDP and can not resolve names across remote segments.

    Alternative means of name resolution includes: -

    /etc/hosts: is static, hard to maintain, and lacks name_type info
    DNS: is a good choice but lacks essential name_type info.

    +

    • /etc/hosts: is static, hard to maintain, and lacks name_type info

    • DNS: is a good choice but lacks essential name_type info.

    Many sites want to restrict DNS lookups and want to avoid broadcast name -resolution traffic. The name resolve order parameter is -of great help here. The syntax of the name resolve order -parameter is: -

    -name resolve order = wins lmhosts bcast host
-

    +resolution traffic. The name resolve order parameter is of great help here. +The syntax of the name resolve order parameter is: +

    name resolve order = wins lmhosts bcast host

    or -

    -name resolve order = wins lmhosts  	(eliminates bcast and host)
-

    +

    name resolve order = wins lmhosts (eliminates bcast and host)

    The default is: -

    -name resolve order = host lmhost wins bcast
-

    -where "host" refers the the native methods used by the Unix system +

    name resolve order = host lmhost wins bcast

    +where "host" refers to the native methods used by the UNIX system to implement the gethostbyname() function call. This is normally controlled by /etc/host.conf, /etc/nsswitch.conf and /etc/resolv.conf. -

    Technical Overview of browsing

    +

    Technical Overview of browsing

    SMB networking provides a mechanism by which clients can access a list -of machines in a network, a so-called browse list. This list +of machines in a network, a so-called browse list. This list contains machines that are ready to offer file and/or print services to other machines within the network. Thus it does not include machines which aren't currently able to do server tasks. The browse @@ -717,7 +671,7 @@ Where NetBIOS over TCP/IP is enabled use of a WINS server is highly recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. WINS allows remote segment clients to obtain NetBIOS name_type information that can NOT be provided by any other means of name resolution. -

    Browsing support in Samba

    +

    Browsing support in Samba

    Samba facilitates browsing. The browsing is supported by nmbd and is also controlled by options in the smb.conf file. Samba can act as a local browse master for a workgroup and the ability @@ -744,15 +698,15 @@ WINS server capabilities. In a Samba-only environment, it is recommended that you use one and only one Samba server as your WINS server.

    To get browsing to work you need to run nmbd as usual, but will need -to use the workgroup option in smb.conf +to use the workgroup option in smb.conf to control what workgroup Samba becomes a part of.

    Samba also has a useful option for a Samba server to offer itself for browsing on another subnet. It is recommended that this option is only used for 'unusual' purposes: announcements over the internet, for -example. See remote announce in the +example. See remote announce in the smb.conf man page. -

    Problem resolution

    +

    Problem resolution

    If something doesn't work then hopefully the log.nmbd file will help you track down the problem. Try a debug level of 2 or 3 for finding problems. Also note that the current browse list usually gets stored @@ -763,7 +717,7 @@ type the server name as \\SERVER in filemanager then hit enter and filemanager should display the list of available shares.

    Some people find browsing fails because they don't have the global -guest account set to a valid account. Remember that the +guest account set to a valid account. Remember that the IPC$ connection that lists the shares is done as guest, and thus you must have a valid guest account.

    @@ -777,7 +731,7 @@ server resources. The other big problem people have is that their broadcast address, netmask or IP address is wrong (specified with the "interfaces" option in smb.conf) -

    Browsing across subnets

    +

    Browsing across subnets

    Since the release of Samba 1.9.17(alpha1), Samba has supported the replication of browse lists across subnet boundaries. This section describes how to set this feature up in different settings. @@ -798,32 +752,14 @@ be they Windows 95, Windows NT, or Samba servers must have the IP address of a WINS server given to them by a DHCP server, or by manual configuration (for Win95 and WinNT, this is in the TCP/IP Properties, under Network settings) for Samba this is in the smb.conf file. -

    How does cross subnet browsing work ?

    +

    How does cross subnet browsing work ?

    Cross subnet browsing is a complicated dance, containing multiple moving parts. It has taken Microsoft several years to get the code that achieves this correct, and Samba lags behind in some areas. Samba is capable of cross subnet browsing when configured correctly.

    -Consider a network set up as follows : -

    - -

    -                                   (DMB)
-             N1_A      N1_B        N1_C       N1_D        N1_E
-              |          |           |          |           |
-          -------------------------------------------------------
-            |          subnet 1                       |
-          +---+                                      +---+
-          |R1 | Router 1                  Router 2   |R2 |
-          +---+                                      +---+
-            |                                          |
-            |  subnet 2              subnet 3          |
-  --------------------------       ------------------------------------
-  |     |     |      |               |        |         |           |
- N2_A  N2_B  N2_C   N2_D           N3_A     N3_B      N3_C        N3_D 
-                    (WINS)
-

    -

    + Consider a network set up as in the diagram below. +

    Figure 10.1. Cross subnet browsing example

    Cross subnet browsing example

    Consisting of 3 subnets (1, 2, 3) connected by two routers (R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume @@ -865,7 +801,7 @@ At this point the browse lists look as follows (these are the machines you would see in your network neighborhood if you looked in it on a particular network right now).

    -

    Table 10.1. Browse subnet example 1

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    +

    Table 10.1. Browse subnet example 1

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    Note that at this point all the subnets are separate, no machine is seen across any of the subnets. @@ -887,7 +823,9 @@ the MasterAnnouncement packet it schedules a synchronization request to the sender of that packet. After both synchronizations are done the browse lists look like :

    -

    Table 10.2. Browse subnet example 2

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    +

    Table 10.2. Browse subnet example 2

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +N2_A(*), N2_B(*), N2_C(*), N2_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    Servers with a (*) after them are non-authoritative names.

    @@ -895,14 +833,17 @@ At this point users looking in their network neighborhood on subnets 1 or 2 will see all the servers on both, users on subnet 3 will still only see the servers on their own subnet.

    -The same sequence of events that occured for N2_B now occurs +The same sequence of events that occurred for N2_B now occurs for the local master browser on subnet 3 (N3_D). When it synchronizes browse lists with the domain master browser (N1_A) it gets both the server entries on subnet 1, and those on subnet 2. After N3_D has synchronized with N1_C and vica-versa the browse lists look like.

    -

    Table 10.3. Browse subnet example 3

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)

    +

    Table 10.3. Browse subnet example 3

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)

    Servers with a (*) after them are non-authoritative names.

    @@ -915,7 +856,13 @@ with the domain master browser (N1_C) and will receive the missing server entries. Finally - and as a steady state (if no machines are removed or shut off) the browse lists will look like :

    -

    Table 10.4. Browse subnet example 4

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)

    +

    Table 10.4. Browse subnet example 4

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), +N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), +N3_C(*), N3_D(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), +N2_C(*), N2_D(*)

    Servers with a (*) after them are non-authoritative names.

    @@ -936,11 +883,11 @@ If either router R1 or R2 fails the following will occur: be able to access servers on its local subnet, by using subnet-isolated broadcast NetBIOS name resolution. The effects are similar to that of losing access to a DNS server. -

    Common Errors

    +

    Common Errors

    Many questions are asked on the mailing lists regarding browsing. The majority of browsing problems originate out of incorrect configuration of NetBIOS name resolution. Some are of particular note. -

    How can one flush the Samba NetBIOS name cache without restarting Samba?

    +

    How can one flush the Samba NetBIOS name cache without restarting Samba?

    Samba's nmbd process controls all browse list handling. Under normal circumstances it is safe to restart nmbd. This will effectively flush the Samba NetBIOS name cache and cause it to be rebuilt. Note that this does NOT make certain that a rogue machine name will not re-appear @@ -950,8 +897,11 @@ want to clear a rogue machine from the list then every machine on the network wi shut down and restarted at after all machines are down. Failing a complete restart, the only other thing you can do is wait until the entry times out and is then flushed from the list. This may take a long time on some networks (months). -

    My client reports "This server is not configured to list shared resources"

    +

    My client reports "This server is not configured to list shared resources"

    Your guest account is probably invalid for some reason. Samba uses the guest account for browsing in smbd. Check that your guest account is valid. -

    See also guest account in the smb.conf man page.

    Prev Up Next
    Part III. Advanced Configuration Home Chapter 11. Account Information Databases
    +

    See also guest account in the smb.conf man page.

    I get an Unable to browse the network error

    This error can have multiple causes:

    • There is no local master browser. Configure nmbd + or any other machine to serve as local master browser.

    • You can not log onto the machine that is the local master + browser. Can you logon to it as guest user?

    • There is no IP connectivity to the local master browser. + Can you reach it by broadcast?

    Prev Up Next
    Part III. Advanced Configuration Home Chapter 11. Account Information Databases
    diff --git a/docs/htmldocs/Other-Clients.html b/docs/htmldocs/Other-Clients.html index a5e7740cf0..dffa1122ac 100644 --- a/docs/htmldocs/Other-Clients.html +++ b/docs/htmldocs/Other-Clients.html @@ -1,8 +1,7 @@ -Chapter 38. Samba and other CIFS clients
    Chapter 38. Samba and other CIFS clients
    Prev Part VI. Appendixes Next

    Chapter 38. Samba and other CIFS clients

    Jim McDonough

    IBM

    Jelmer R. Vernooij

    The Samba Team

    5 Mar 2001

    Table of Contents

    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
    How do I get printer driver download working - for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1

    This chapter contains client-specific information.

    Macintosh clients?

    -Yes. Thursby now has a CIFS Client / Server called DAVE +Chapter 38. Samba and other CIFS clients

    Chapter 38. Samba and other CIFS clients
    Prev Part VI. Appendixes Next

    Chapter 38. Samba and other CIFS clients

    Jelmer R. Vernooij

    The Samba Team

    Jim McDonough

    OS/2
    IBM

    5 Mar 2001

    Table of Contents

    Macintosh clients?
    OS2 Client
    Configuring OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba
    Configuring OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba
    Printer driver download for for OS/2 clients?
    Windows for Workgroups
    Latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configuring WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1

    This chapter contains client-specific information.

    Macintosh clients?

    + Yes. Thursby now has a CIFS Client / Server called DAVE

    They test it against Windows 95, Windows NT and samba for compatibility issues. At the time of writing, DAVE was at version @@ -21,10 +20,8 @@ What Samba offers MS Windows users, these packages offer to Macs. For more info on these packages, Samba, and Linux (and other UNIX-based systems) see http://www.eats.com/linux_mac_win.html -

    OS2 Client

    How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?

    A more complete answer to this question can be - found on - http://carol.wins.uva.nl/~leeuw/samba/warp.html.

    Basically, you need three components:

    The File and Print Client ('IBM Peer')
    TCP/IP ('Internet support')
    The "NetBIOS over TCP/IP" driver ('TCPBEUI')

    Installing the first two together with the base operating +

    Newer versions of the Macintosh (Mac OS X) include Samba.

    OS2 Client

    Configuring OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba

    Basically, you need three components:

    • The File and Print Client ('IBM Peer')

    • TCP/IP ('Internet support')

    • The "NetBIOS over TCP/IP" driver ('TCPBEUI')

    Installing the first two together with the base operating system on a blank system is explained in the Warp manual. If Warp has already been installed, but you now want to install the networking support, use the "Selective Install for Networking" @@ -39,14 +36,12 @@ packages, Samba, and Linux (and other UNIX-based systems) see to the "Names List", or specify a WINS server ('NetBIOS Nameserver' in IBM and RFC terminology). For Warp Connect you may need to download an update for 'IBM Peer' to bring it on - the same level as Warp 4. See the webpage mentioned above.

    How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?

    You can use the free Microsoft LAN Manager 2.2c Client + the same level as Warp 4. See the webpage mentioned above.

    Configuring OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba

    You can use the free Microsoft LAN Manager 2.2c Client for OS/2 from ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/. - See - http://carol.wins.uva.nl/~leeuw/lanman.html for - more information on how to install and use this client. In + In a nutshell, edit the file \OS2VER in the root directory of the OS/2 boot partition and add the lines:

     		20=setup.exe
@@ -57,14 +52,12 @@ packages, Samba, and Linux (and other UNIX-based systems) see
 		or NS2000 driver from 
 		
  		ftp://ftp.cdrom.com/pub/os2/network/ndis/ instead.
-

    How do I get printer driver download working - for OS/2 clients?

    First, create a share called [PRINTDRV] that is +

    Printer driver download for for OS/2 clients?

    First, create a share called [PRINTDRV] that is world-readable. Copy your OS/2 driver files there. Note that the .EA_ files must still be separate, so you will need to use the original install files, and not copy an installed driver from an OS/2 system.

    Install the NT driver first for that printer. Then, - add to your smb.conf a parameter, os2 driver map = - filename. Then, in the file + add to your smb.conf a parameter, os2 driver map = filename. Then, in the file specified by filename, map the name of the NT driver name to the OS/2 driver name as follows:

    nt driver name = os2 driver name.device name, e.g.:

    @@ -74,7 +67,7 @@ packages, Samba, and Linux (and other UNIX-based systems) see you the driver is not available. On the second attempt, it will work. This is fixed simply by adding the device name to the mapping, after which it will work on the first attempt. -

    Windows for Workgroups

    Use latest TCP/IP stack from Microsoft

    Use the latest TCP/IP stack from Microsoft if you use Windows +

    Windows for Workgroups

    Latest TCP/IP stack from Microsoft

    Use the latest TCP/IP stack from Microsoft if you use Windows for Workgroups.

    The early TCP/IP stacks had lots of bugs.

    Microsoft has released an incremental upgrade to their TCP/IP 32-Bit @@ -89,7 +82,7 @@ fixed. New files include WINSOCK.DLL, TRACERT.EXE, NETSTAT.EXE, and NBTSTAT.EXE. -

    Delete .pwl files after password change

    +

    Delete .pwl files after password change

    WfWg does a lousy job with passwords. I find that if I change my password on either the unix box or the PC the safest thing to do is to delete the .pwl files in the windows directory. The PC will complain about not finding the files, but will soon get over it, allowing you to enter the new password. @@ -98,20 +91,20 @@ If you don't do this you may find that WfWg remembers and uses the old password, even if you told it a new one.

    Often WfWg will totally ignore a password you give it in a dialog box. -

    Configure WfW password handling

    +

    Configuring WfW password handling

    There is a program call admincfg.exe on the last disk (disk 8) of the WFW 3.11 disk set. To install it type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE. Then add an icon for it via the Program Manager New Menu. This program allows you to control how WFW handles passwords. ie disable Password Caching etc -for use with security = user -

    Case handling of passwords

    Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf(5) information on password level to specify what characters samba should try to uppercase when checking.

    Use TCP/IP as default protocol

    To support print queue reporting you may find +for use with security = user +

    Case handling of passwords

    Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf information on password level to specify what characters samba should try to uppercase when checking.

    Use TCP/IP as default protocol

    To support print queue reporting you may find that you have to use TCP/IP as the default protocol under WfWg. For some reason if you leave NetBEUI as the default it may break the print queue reporting on some systems. -It is presumably a WfWg bug.

    Speed improvement

    -Note that some people have found that setting DefaultRcvWindow in +It is presumably a WfWg bug.

    Speed improvement

    + Note that some people have found that setting DefaultRcvWindow in the [MSTCP] section of the SYSTEM.INI file under WfWg to 3072 gives a big improvement. I don't know why. @@ -121,7 +114,7 @@ performance with a large value (16384 or larger). Other people have reported that anything over 3072 slows things down enormously. One person even reported a speed drop of a factor of 30 when he went from 3072 to 8192. I don't know why. -

    Windows '95/'98

    +

    Windows '95/'98

    When using Windows 95 OEM SR2 the following updates are recommended where Samba is being used. Please NOTE that the above change will affect you once these updates have been installed. @@ -135,11 +128,11 @@ install the OLEUPD.EXE fix. This fix may stop your machine from hanging for an extended period when exiting Outlook and you may also notice a significant speedup when accessing network neighborhood services. -

    Speed improvement

    +

    Speed improvement

    Configure the win95 TCPIP registry settings to give better performance. I use a program called MTUSPEED.exe which I got off the net. There are various other utilities of this type freely available. -

    Windows 2000 Service Pack 2

    +

    Windows 2000 Service Pack 2

    There are several annoyances with Windows 2000 SP2. One of which only appears when using a Samba server to host user profiles to Windows 2000 SP2 clients in a Windows domain. This assumes @@ -148,26 +141,19 @@ likely occur if it is not.

    In order to serve profiles successfully to Windows 2000 SP2 clients (when not operating as a PDC), Samba must have -nt acl support = no +nt acl support = no added to the file share which houses the roaming profiles. If this is not done, then the Windows 2000 SP2 client will complain about not being able to access the profile (Access Denied) and create multiple copies of it on disk (DOMAIN.user.001, DOMAIN.user.002, etc...). See the -smb.conf(5) man page +smb.conf man page for more details on this option. Also note that the -nt acl support parameter was formally a global parameter in +nt acl support parameter was formally a global parameter in releases prior to Samba 2.2.2.

    The following is a minimal profile share: -

    -	[profile]
-		path = /export/profile
-		create mask = 0600
-		directory mask = 0700
-		nt acl support = no
-		read only = no
-

    +

    Example 38.1. Minimal profile share

    [profile]
    path = /export/profile
    create mask = 0600
    directory mask = 0700
    nt acl support = no
    read only = no

    The reason for this bug is that the Win2k SP2 client copies the security descriptor for the profile which contains the Samba server's SID, and not the domain SID. The client @@ -175,12 +161,12 @@ compares the SID for SAMBA\user and realizes it is different that the one assigned to DOMAIN\user. Hence the reason for the access denied message.

    -By disabling the nt acl support parameter, Samba will send +By disabling the nt acl support parameter, Samba will send the Win2k client a response to the QuerySecurityDescriptor trans2 call which causes the client to set a default ACL for the profile. This default ACL includes

    DOMAIN\user "Full Control">

    Note

    This bug does not occur when using winbind to -create accounts on the Samba host for Domain users.

    Windows NT 3.1

    If you have problems communicating across routers with Windows -NT 3.1 workstations, read this Microsoft Knowledge Base article. +create accounts on the Samba host for Domain users.

    Windows NT 3.1

    If you have problems communicating across routers with Windows +NT 3.1 workstations, read this Microsoft Knowledge Base article. -

    Prev Up Next
    Chapter 37. Portability Home Chapter 39. Samba Performance Tuning
    +

    Prev Up Next
    Chapter 37. Portability Home Chapter 39. Samba Performance Tuning
    diff --git a/docs/htmldocs/PolicyMgmt.html b/docs/htmldocs/PolicyMgmt.html index 775cd6cc16..754ca9b686 100644 --- a/docs/htmldocs/PolicyMgmt.html +++ b/docs/htmldocs/PolicyMgmt.html @@ -1,10 +1,10 @@ -Chapter 23. System and Account Policies
    Chapter 23. System and Account Policies
    Prev Part III. Advanced Configuration Next

    Chapter 23. System and Account Policies

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work

    +Chapter 23. System and Account Policies

    Chapter 23. System and Account Policies
    Prev Part III. Advanced Configuration Next

    Chapter 23. System and Account Policies

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work

    This chapter summarises the current state of knowledge derived from personal practice and knowledge from samba mailing list subscribers. Before reproduction of posted information effort has been made to validate the information provided. Where additional information was uncovered through this validation it is provided also. -

    Features and Benefits

    +

    Features and Benefits

    When MS Windows NT3.5 was introduced the hot new topic was the ability to implement Group Policies for users and group. Then along came MS Windows NT4 and a few sites started to adopt this capability. How do we know that? By way of the number of "booboos" @@ -23,9 +23,9 @@ the deployment in many sites. This chapter reviews techniques and methods that c be used to exploit opportunities for automation of control over user desktops and network client workstations.

    -A tool new to Samba-3 may become an important part of the future Samba Administrators' +A tool new to Samba may become an important part of the future Samba Administrators' arsenal. The editreg tool is described in this document. -

    Creating and Managing System Policies

    +

    Creating and Managing System Policies

    Under MS Windows platforms, particularly those following the release of MS Windows NT4 and MS Windows 95) it is possible to create a type of file that would be placed in the NETLOGON share of a domain controller. As the client logs onto the network @@ -54,13 +54,13 @@ be a step forward, but improved functionality comes at a great price. Before embarking on the configuration of network and system policies it is highly advisable to read the documentation available from Microsoft's web site regarding -Implementing Profiles and Policies in Windows NT 4.0 from http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp available from Microsoft. +Implementing Profiles and Policies in Windows NT 4.0 available from Microsoft. There are a large number of documents in addition to this old one that should also be read and understood. Try searching on the Microsoft web site for "Group Policies".

    What follows is a very brief discussion with some helpful notes. The information provided here is incomplete - you are warned. -

    Windows 9x/Me Policies

    +

    Windows 9x/Me Policies

    You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. It can be found on the Original full product Win98 installation CD under tools/reskit/netadmin/poledit. Install this using the @@ -86,7 +86,7 @@ here is incomplete - you are warned. grouppol.inf. Log off and on again a couple of times and see if Win98 picks up group policies. Unfortunately this needs to be done on every Win9x/Me machine that uses group policies. -

    Windows NT4 Style Policy Files

    +

    Windows NT4 Style Policy Files

    To create or edit ntconfig.pol you must use the NT Server Policy Editor, poledit.exe which is included with NT4 Server but not NT Workstation. There is a Policy Editor on a NT4 @@ -107,14 +107,14 @@ here is incomplete - you are warned. be extracted as well. It is also possible to downloaded the policy template files for Office97 and get a copy of the policy editor. Another possible location is with the Zero Administration Kit available for download from Microsoft. -

    Registry Spoiling

    +

    Registry Spoiling

    With NT4 style registry based policy changes, a large number of settings are not automatically reversed as the user logs off. Since the settings that were in the NTConfig.POL file were applied to the client machine registry and that apply to the hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known as tattooing. It can have serious consequences down-stream and the administrator must be extremely careful not to lock out the ability to manage the machine at a later date. -

    MS Windows 200x / XP Professional Policies

    +

    MS Windows 200x / XP Professional Policies

    Windows NT4 System policies allows setting of registry parameters specific to users, groups and computers (client workstations) that are members of the NT4 style domain. Such policy file will work with MS Windows 2000 / XP clients also. @@ -151,7 +151,7 @@ here is incomplete - you are warned. to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows the administrator to also set filters over the policy settings. No such equivalent capability exists with NT4 style policy files. -

    Administration of Win2K / XP Policies

    +

    Administration of Win2K / XP Policies

    Instead of using the tool called The System Policy Editor, commonly called Poledit (from the executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console (MMC) snap-in as follows:

    1. @@ -177,10 +177,10 @@ here is incomplete - you are warned. The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you use this powerful tool. Please refer to the resource kit manuals for specific usage information. -

    Managing Account/User Policies

    +

    Managing Account/User Policies

    Policies can define a specific user's settings or the settings for a group of users. The resulting policy file contains the registry settings for all users, groups, and computers that will be using -the policy file. Separate policy files for each user, group, or computer are not not necessary. +the policy file. Separate policy files for each user, group, or computer are not necessary.

    If you create a policy that will be automatically downloaded from validating domain controllers, you should name the file NTconfig.POL. As system administrator, you have the option of renaming the @@ -203,20 +203,27 @@ in a manner that works in conjunction with user profiles, the user management en MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied. Common restrictions that are frequently used includes:

    -

    Logon Hours
    Password Aging
    Permitted Logon from certain machines only
    Account type (Local or Global)
    User Rights

    -

    Samba Editreg Toolset

    - Describe in detail the benefits of editreg and how to use it. -

    Windows NT4/200x

    +

    • Logon Hours

    • Password Aging

    • Permitted Logon from certain machines only

    • Account type (Local or Global)

    • User Rights

    +

    Samba Editreg Toolset

    + A new tool called editreg is under development. This tool can be used + to edit registry files (called NTUser.DAT) that are stored in user and group profiles. + NTConfig.POL files have the same structure as the NTUser.DAT file and can be editted using + this tool. editreg is being built with the intent to enable NTConfig.POL + files to be saved in text format and to permit the building of new NTConfig.POL files with + extended capabilities. It is proving difficult to realise this capability, so do not be surprised + if this feature does not materialise. Formal capabilities will be announced at the time that + this tool is released for production use. +

    Windows NT4/200x

    The tools that may be used to configure these types of controls from the MS Windows environment are: The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). Under MS Windows 200x/XP this is done using the Microsoft Management Console (MMC) with appropriate "snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor. -

    Samba PDC

    +

    Samba PDC

    With a Samba Domain Controller, the new tools for managing of user account and policy information includes: smbpasswd, pdbedit, net, rpcclient. The administrator should read the man pages for these tools and become familiar with their use. -

    System Startup and Logon Processing Overview

    +

    System Startup and Logon Processing Overview

    The following attempts to document the order of processing of system and user policies following a system reboot and as part of the user logon:

    1. @@ -225,7 +232,7 @@ reboot and as part of the user logon:

    2. Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded and applied. The list may include GPOs that: -

      Apply to the location of machines in a Directory
      Apply only when settings have changed
      Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.

      +

      • Apply to the location of machines in a Directory

      • Apply only when settings have changed

      • Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.

      No desktop user interface is presented until the above have been processed.

    3. Execution of start-up scripts (hidden and synchronous by default). @@ -236,7 +243,7 @@ reboot and as part of the user logon:

    4. An ordered list of User GPOs is obtained. The list contents depends on what is configured in respect of: -

      Is user a domain member, thus subject to particular policies
      Loopback enablement, and the state of the loopback policy (Merge or Replace)
      Location of the Active Directory itself
      Has the list of GPOs changed. No processing is needed if not changed.

      +

      • Is user a domain member, thus subject to particular policies

      • Loopback enablement, and the state of the loopback policy (Merge or Replace)

      • Location of the Active Directory itself

      • Has the list of GPOs changed. No processing is needed if not changed.

    5. User Policies are applied from Active Directory. Note: There are several types.

    6. @@ -246,15 +253,15 @@ reboot and as part of the user logon:

    7. The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like and NT4 Domain) machine (system) policies are applied at start-up, User policies are applied at logon. -

    Common Errors

    +

    Common Errors

    Policy related problems can be very difficult to diagnose and even more difficult to rectify. The following collection demonstrates only basic issues. -

    Policy Does Not Work

    -Question: We have created the config.pol file and put it in the NETLOGON share. +

    Policy Does Not Work

    + “We have created the config.pol file and put it in the NETLOGON share. It has made no difference to our Win XP Pro machines, they just don't see it. IT worked fine with Win 98 but does not -work any longer since we upgraded to Win XP Pro. Any hints? +work any longer since we upgraded to Win XP Pro. Any hints?”

    -ANSWER: Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based +Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based platforms. You need to use the NT4 Group Policy Editor to create a file called NTConfig.POL so that it is in the correct format for your MS Windows XP Pro clients. -

    Prev Up Next
    Chapter 22. Advanced Network Management Home Chapter 24. Desktop Profile Management
    +

    Prev Up Next
    Chapter 22. Advanced Network Management Home Chapter 24. Desktop Profile Management
    diff --git a/docs/htmldocs/Portability.html b/docs/htmldocs/Portability.html index bb2c20ac9f..50d14207d0 100644 --- a/docs/htmldocs/Portability.html +++ b/docs/htmldocs/Portability.html @@ -1,6 +1,6 @@ -Chapter 37. Portability
    Chapter 37. Portability
    Prev Part VI. Appendixes Next

    Chapter 37. Portability

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9

    Samba works on a wide range of platforms but the interface all the +Chapter 37. Portability

    Chapter 37. Portability
    Prev Part VI. Appendixes Next

    Chapter 37. Portability

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    HPUX
    SCO UNIX
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9

    Samba works on a wide range of platforms but the interface all the platforms provide is not always compatible. This chapter contains -platform-specific information about compiling and using samba.

    HPUX

    +platform-specific information about compiling and using samba.

    HPUX

    HP's implementation of supplementary groups is, er, non-standard (for hysterical reasons). There are two group files, /etc/group and /etc/logingroup; the system maps UIDs to numbers using the former, but @@ -20,15 +20,15 @@ allowed range. On HPUX you must use gcc or the HP ANSI compiler. The free compiler that comes with HP-UX is not ANSI compliant and cannot compile Samba. -

    SCO Unix

    -If you run an old version of SCO Unix then you may need to get important +

    SCO UNIX

    +If you run an old version of SCO UNIX then you may need to get important TCP/IP patches for Samba to work correctly. Without the patch, you may encounter corrupt data transfers using samba.

    The patch you need is UOD385 Connection Drivers SLS. It is available from SCO (ftp.sco.com, directory SLS, files uod385a.Z and uod385a.ltr.Z). -

    DNIX

    +

    DNIX

    DNIX has a problem with seteuid() and setegid(). These routines are needed for Samba to work correctly, but they were left out of the DNIX C library for some reason. @@ -73,8 +73,8 @@ _seteuid:

    after creating the above files you then assemble them using 

    -	$ as seteuid.s
-	$ as setegid.s
+$ as seteuid.s
+$ as setegid.s

    that should produce the files seteuid.o and setegid.o @@ -87,7 +87,7 @@ LIBSM = setegid.o seteuid.o -ln You should then remove the line: 

     #define NO_EID
-

    from the DNIX section of includes.h

    RedHat Linux Rembrandt-II

    +

    from the DNIX section of includes.h

    RedHat Linux Rembrandt-II

    By default RedHat Rembrandt-II during installation adds an entry to /etc/hosts as follows: 

    @@ -101,10 +101,10 @@ is the master browse list holder and who is the master browser.
 
    
 Corrective Action:	Delete the entry after the word loopback
 	in the line starting 127.0.0.1
-

    AIX

    Sequential Read Ahead

    +

    AIX

    Sequential Read Ahead

    Disabling Sequential Read Ahead using vmtune -r 0 improves Samba performance significantly. -

    Solaris

    Locking improvements

    Some people have been experiencing problems with F_SETLKW64/fcntl +

    Solaris

    Locking improvements

    Some people have been experiencing problems with F_SETLKW64/fcntl when running Samba on Solaris. The built in file locking mechanism was not scalable. Performance would degrade to the point where processes would get into loops of trying to lock a file. It would try a lock, then fail, @@ -125,4 +125,4 @@ and rebuild samba. Nsswitch on Solaris 9 refuses to use the winbind nss module. This behavior is fixed by Sun in patch 113476-05 which as of March 2003 is not in any roll-up packages. -

    Prev Up Next
    Chapter 36. How to compile SAMBA Home Chapter 38. Samba and other CIFS clients
    +

    Prev Up Next
    Chapter 36. How to compile Samba Home Chapter 38. Samba and other CIFS clients
    diff --git a/docs/htmldocs/ProfileMgmt.html b/docs/htmldocs/ProfileMgmt.html index 0b9a40df62..765ae4b0c4 100644 --- a/docs/htmldocs/ProfileMgmt.html +++ b/docs/htmldocs/ProfileMgmt.html @@ -1,4 +1,4 @@ -Chapter 24. Desktop Profile Management
    Chapter 24. Desktop Profile Management
    Prev Part III. Advanced Configuration Next

    Chapter 24. Desktop Profile Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    How does one set up roaming profiles for just one (or a few) user/s or group/s?
    Can NOT use Roaming Profiles
    Changing the default profile

    Features and Benefits

    +Chapter 24. Desktop Profile Management

    Chapter 24. Desktop Profile Management
    Prev Part III. Advanced Configuration Next

    Chapter 24. Desktop Profile Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Setting up roaming profiles for just a few user's or group's?
    Can NOT use Roaming Profiles
    Changing the default profile

    Features and Benefits

    Roaming Profiles are feared by some, hated by a few, loved by many, and a Godsend for some administrators.

    @@ -11,7 +11,7 @@ problem to others. In particular, users of mobile computing tools, where often t be a sustained network connection, are often better served by purely Local Profiles. This chapter provides information to help the Samba administrator to deal with those situations also. -

    Roaming Profiles

    Warning

    +

    Roaming Profiles

    Warning

    Roaming profiles support is different for Win9x / Me and Windows NT4/200x.

    Before discussing how to configure roaming profiles, it is useful to see how @@ -24,21 +24,17 @@ profiles are restricted to being stored in the user's home directory.

    Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields, including a separate field for the location of the user's profiles. -

    Samba Configuration for Profile Handling

    +

    Samba Configuration for Profile Handling

    This section documents how to configure Samba for MS Windows client profile support. -

    NT4/200x User Profiles

    +

    NT4/200x User Profiles

    To support Windows NT4/200x clients, in the [global] section of smb.conf set the following (for example):

    -

    -	logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath
-

    +

    logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath

    This is typically implemented like: -

    -		logon path = \\%L\Profiles\%u
-

    +

    logon path = \\%L\Profiles\%u

    where %L translates to the name of the Samba server and %u translates to the user name

    The default for this option is \\%N\%U\profile, @@ -51,31 +47,26 @@ semantics of %L and %N, as well as %U and %u. MS Windows NT/2K clients at times do not disconnect a connection to a server between logons. It is recommended to NOT use the homes meta-service name as part of the profile share path. -

    Windows 9x / Me User Profiles

    - To support Windows 9x / Me clients, you must use the logon home parameter. Samba has +

    Windows 9x / Me User Profiles

    + To support Windows 9x / Me clients, you must use the logon home parameter. Samba has now been fixed so that net use /home now works as well, and it, too, relies on the logon home parameter.

    By using the logon home parameter, you are restricted to putting Win9x / Me profiles in the user's home directory. But wait! There is a trick you can use. If you set the following in the [global] section of your smb.conf file: -

    -	logon home = \\%L\%U\.profiles
-

    +

    logon home = \\%L\%U\.profiles

    then your Windows 9x / Me clients will dutifully put their clients in a subdirectory of your home directory called .profiles (thus making them hidden).

    Not only that, but net use /home will also work, because of a feature in Windows 9x / Me. It removes any directory stuff off the end of the home directory area and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for logon home. -

    Mixed Windows 9x / Me and Windows NT4/200x User Profiles

    +specified \\%L\%U for logon home. +

    Mixed Windows 9x / Me and Windows NT4/200x User Profiles

    You can support profiles for both Win9X and WinNT clients by setting both the -logon home and logon path parameters. For example: -

    -	logon home = \\%L\%u\.profiles
-	logon path = \\%L\profiles\%u
-

    Disabling Roaming Profile Support

    +logon home and logon path parameters. For example: +

    logon home = \\%L\%u\.profiles
    logon path = \\%L\profiles\%u

    Disabling Roaming Profile Support

    A question often asked is “How may I enforce use of local profiles?” or “How do I disable Roaming Profiles?”

    @@ -83,13 +74,11 @@ There are three ways of doing this:

    In smb.conf

    Affect the following settings and ALL clients will be forced to use a local profile: - 

    -			logon home =
-			logon path =
-

    +

    logon home
    logon path

    MS Windows Registry:

    By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This of course modifies registry settings. The full path to the option is: + 

     	Local Computer Policy\
 		Computer Configuration\
@@ -112,15 +101,15 @@ profiles.
 The specifics of how to convert a local profile to a roaming profile, or a roaming profile
 to a local one vary according to the version of MS Windows you are running. Consult the
 Microsoft MS Windows Resource Kit for your version of Windows for specific information.
-

    Windows Client Profile Configuration Information

    Windows 9x / Me Profile Setup

    +

    Windows Client Profile Configuration Information

    Windows 9x / Me Profile Setup

    When a user first logs in on Windows 9X, the file user.DAT is created, as are folders Start Menu, Desktop, Programs and Nethood. These directories and their contents will be merged with the local versions stored in c:\windows\profiles\username on subsequent logins, taking the most recent from each. You will need to use the [global] -options preserve case = yes, short preserve case = yes and -case sensitive = no in order to maintain capital letters in shortcuts +options preserve case = yes, short preserve case = yes and +case sensitive = no in order to maintain capital letters in shortcuts in any of the profile folders.

    The user.DAT file contains all the user's preferences. If you wish to @@ -153,11 +142,11 @@ domain and profiles downloaded from it, if that domain logon server supports it), user name and user's password.

    Once the user has been successfully validated, the Windows 9x / Me machine -will inform you that The user has not logged on before' and asks you - if you wish to save the user's preferences? Select yes. +will inform you that The user has not logged on before and asks you +Do you wish to save the user's preferences?. Select yes.

    Once the Windows 9x / Me client comes up with the desktop, you should be able -to examine the contents of the directory specified in the logon path +to examine the contents of the directory specified in the logon path on the samba server and verify that the Desktop, Start Menu, Programs and Nethood folders have been created.

    @@ -171,14 +160,14 @@ the newest folders and short-cuts from each set. If you have made the folders / files read-only on the samba server, then you will get errors from the Windows 9x / Me machine on logon and logout, as it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the Windows 9x / Me machine, check the Unix file +you have any errors reported by the Windows 9x / Me machine, check the UNIX file permissions and ownership rights on the profile directory contents, on the samba server.

    If you have problems creating user profiles, you can reset the user's local desktop cache, as shown below. When this user then next logs in, they will be told that they are logging in "for the first time". -

    Warning

    +

    Warning

    Before deleting the contents of the directory listed in the ProfilePath (this is likely to be c:\windows\profiles\username), ask them if they @@ -189,7 +178,7 @@ they will be told that they are logging in "for the first time". This will have the effect of removing the local (read-only hidden system file) user.DAT in their profile directory, as well as the local "desktop", "nethood", "start menu" and "programs" folders. -

    1. +

    1. instead of logging in under the [user, password, domain] dialog, press escape.

    2. @@ -206,7 +195,7 @@ they will be told that they are logging in "for the first time".

    3. log off the windows 9x / Me client.

    4. - check the contents of the profile path (see logon path described + check the contents of the profile path (see logon path described above), and delete the user.DAT or user.MAN file for the user, making a backup if required.

    @@ -218,14 +207,14 @@ If you have access to an Windows NT4/200x server, then first set up roaming prof and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine the example packet traces provided with Windows NT4/200x server, and see what the differences are with the equivalent samba trace. -

    Windows NT4 Workstation

    +

    Windows NT4 Workstation

    When a user first logs in to a Windows NT Workstation, the profile NTuser.DAT is created. The profile location can be now specified -through the logon path parameter. +through the logon path parameter.

    There is a parameter that is now available for use with NT Profiles: -logon drive. This should be set to H: or any other drive, and -should be used in conjunction with the new "logon home" parameter. +logon drive. This should be set to H: or any other drive, and +should be used in conjunction with the new logon home parameter.

    The entry for the NT4 profile is a _directory_ not a file. The NT help on profiles mentions that a directory is also created with a .PDS @@ -247,7 +236,7 @@ turns a profile into a mandatory one.

    The case of the profile is significant. The file must be called NTuser.DAT or, for a mandatory profile, NTuser.MAN. -

    Windows 2000/XP Professional

    +

    Windows 2000/XP Professional

    You must first convert the profile from a local profile to a domain profile on the MS Windows workstation as follows:

    1. @@ -266,8 +255,7 @@ profile on the MS Windows workstation as follows: Click on the 'Look in" area that lists the machine name, when you click here it will open up a selection box. Click on the domain to which the profile must be accessible. -

      Note

      You will need to log on if a logon box opens up. Eg: In the connect - as: MIDEARTH\root, password: mypassword.

    2. +

      Note

      You will need to log on if a logon box opens up. Eg: In the connect as: DOMAIN\root, password: mypassword.

    3. To make the profile capable of being used by anyone select 'Everyone'

    4. Click OK. The Selection box will close. @@ -275,12 +263,12 @@ profile on the MS Windows workstation as follows: Now click on the Ok button to create the profile in the path you nominated.

    -Done. You now have a profile that can be edited using the samba-3.0.0 +Done. You now have a profile that can be edited using the samba profiles tool.

    Note

    Under NT/2K the use of mandatory profiles forces the use of MS Exchange storage of mail data. That keeps desktop profiles usable. -

    Note

    1. +

    Procedure 24.2. Windows XP Service Pack 1

    1. This is a security check new to Windows XP (or maybe only Windows XP service pack 1). It can be disabled via a group policy in Active Directory. The policy is:

      Computer Configuration\Administrative Templates\System\User @@ -297,7 +285,7 @@ On the XP workstation log in with an Administrator account.

    2. Click: Start, Run

    3. Type: mmc

    4. Click: OK

    5. A Microsoft Management Console should appear.

    6. Click: File, Add/Remove Snap-in..., Add

    7. Double-Click: Group Policy

    8. Click: Finish, Close

    9. Click: OK

    10. In the "Console Root" window:

    11. Expand: Local Computer Policy, Computer Configuration, Administrative Templates, System, User Profiles

    12. Double-Click: Do not check for user ownership of Roaming Profile Folders

    13. Select: Enabled

    14. Click: OK

    15. Close the whole console. You do not need to save the settings (this refers to the console settings rather than the policies you have - changed).

    16. Reboot

    Sharing Profiles between W9x/Me and NT4/200x/XP workstations

    + changed).

  • Reboot

    • Sharing Profiles between W9x/Me and NT4/200x/XP workstations

    Sharing of desktop profiles between Windows versions is NOT recommended. Desktop profiles are an evolving phenomenon and profiles for later versions of MS Windows clients add features that may interfere with earlier versions @@ -308,18 +296,18 @@ version resulting in loss of profile information content when that user logs on again with the newer version of MS Windows.

    If you then want to share the same Start Menu / Desktop with W9x/Me, you will -need to specify a common location for the profiles. The smb.conf parameters -that need to be common are logon path and -logon home. +need to specify a common location for the profiles. The smb.conf parameters +that need to be common are logon path and +logon home.

    If you have this set up correctly, you will find separate user.DAT and NTuser.DAT files in the same profile directory. -

    Profile Migration from Windows NT4/200x Server to Samba

    +

    Profile Migration from Windows NT4/200x Server to Samba

    There is nothing to stop you specifying any path that you like for the location of users' profiles. Therefore, you could specify that the profile be stored on a samba server, or any other SMB server, as long as that SMB server supports encrypted passwords. -

    Windows NT4 Profile Management Tools

    +

    Windows NT4 Profile Management Tools

    Unfortunately, the Resource Kit information is specific to the version of MS Windows NT4/200x. The correct resource kit is required for each platform.

    @@ -336,17 +324,13 @@ domain is not a member of a trust relationship with your NT4 PDC.

    c:\temp\foobar

  • Click on the button Change in the Permitted to use box.

  • Click on the group 'Everyone' and then click OK. This closes the 'choose user' box.

  • Now click OK.

    • Follow the above for every profile you need to migrate. -

    Side bar Notes

    +

    Side bar Notes

    You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page.

    -With Samba-3.0.0 alpha code you can import all you NT4 domain accounts -using the net samsync method. This way you can retain your profile -settings as well as all your users. -

    moveuser.exe

    +this. Read the man page.

    moveuser.exe

    The W2K professional resource kit has moveuser.exe. moveuser.exe changes the security of a profile from one user to another. This allows the account domain to change, and/or the user name to change. -

    Get SID

    +

    Get SID

    You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 Resource Kit.

    @@ -359,7 +343,7 @@ users who have logged on to this computer. (To find the profile information for the user whose locally cached profile you want to move, find the SID for the user with the GetSID.exe utility.) Inside of the appropriate user's subkey, you will see a string value named ProfileImagePath. -

    Mandatory profiles

    +

    Mandatory profiles

    A Mandatory Profile is a profile that the user does NOT have the ability to overwrite. During the user's session it may be possible to change the desktop environment, but as the user logs out all changes made will be lost. If it is desired to NOT allow the @@ -375,7 +359,7 @@ file in the copied profile and rename it to NTUser.MAN.

    For MS Windows 9x / Me it is the User.DAT file that must be renamed to User.MAN to affect a mandatory profile. -

    Creating/Managing Group Profiles

    +

    Creating/Managing Group Profiles

    Most organisations are arranged into departments. There is a nice benefit in this fact since usually most users in a department will require the same desktop applications and the same desktop layout. MS Windows NT4/200x/XP will allow the @@ -390,14 +374,14 @@ the now modified profile.

    Note

    Be careful with group profiles, if the user who is a member of a group also has a personal profile, then the result will be a fusion (merge) of the two. -

    Default Profile for Windows Users

    +

    Chapter 7. NetBIOS in a Unix World

    Andrew Tridgell

    April 1995

    Table of Contents

    Introduction
    Usernames
    File Ownership
    Passwords
    Locking
    Deny Modes
    Trapdoor UIDs
    Port numbers
    Protocol Complexity

    Introduction

    This is a short document that describes some of the issues that confront a SMB implementation on unix, and how Samba copes with them. They may help people who are looking at unix<->PC @@ -879,7 +876,7 @@ interoperability.

    It was written to help out a person who was writing a paper on unix to PC connectivity. -

    Usernames

    +

    Usernames

    The SMB protocol has only a loose username concept. Early SMB protocols (such as CORE and COREPLUS) have no username concept at all. Even in later protocols clients often attempt operations @@ -890,20 +887,20 @@ Unix security is based around username/password pairs. A unix box should not allow clients to do any substantive operation without some sort of validation.

    -The problem mostly manifests itself when the unix server is in "share -level" security mode. This is the default mode as the alternative -"user level" security mode usually forces a client to connect to the +The problem mostly manifests itself when the unix server is in "share +level" security mode. This is the default mode as the alternative +"user level" security mode usually forces a client to connect to the server as the same user for each connected share, which is inconvenient in many sites.

    -In "share level" security the client normally gives a username in the -"session setup" protocol, but does not supply an accompanying -password. The client then connects to resources using the "tree -connect" protocol, and supplies a password. The problem is that the +In "share level" security the client normally gives a username in the +"session setup" protocol, but does not supply an accompanying +password. The client then connects to resources using the "tree +connect" protocol, and supplies a password. The problem is that the user on the PC types the username and the password in different contexts, unaware that they need to go together to give access to the server. The username is normally the one the user typed in when they -"logged onto" the PC (this assumes Windows for Workgroups). The +"logged onto" the PC (this assumes Windows for Workgroups). The password is the one they chose when connecting to the disk or printer.

    The user often chooses a totally different username for their login as @@ -916,9 +913,9 @@ in the vast majority of cases. The methods include username maps, the service%user syntax, the saving of session setup usernames for later validation and the derivation of the username from the service name (either directly or via the user= option). -

    File Ownership

    -The commonly used SMB protocols have no way of saying "you can't do -that because you don't own the file". They have, in fact, no concept +

    File Ownership

    +The commonly used SMB protocols have no way of saying "you can't do +that because you don't own the file". They have, in fact, no concept of file ownership at all.

    This brings up all sorts of interesting problems. For example, when @@ -928,13 +925,13 @@ receive the wrong date. This is because the utime() call under unix only succeeds for the owner of the file, or root, even if the file is world writeable. For security reasons Samba does all file operations as the validated user, not root, so the utime() fails. This can stuff -up shared development diectories as programs like "make" will not get +up shared development diectories as programs like "make" will not get file time comparisons right.

    There are several possible solutions to this problem, including username mapping, and forcing a specific username for particular shares. -

    Passwords

    +

    Passwords

    Many SMB clients uppercase passwords before sending them. I have no idea why they do this. Interestingly WfWg uppercases the password only if the server is running a protocol greater than COREPLUS, so @@ -943,20 +940,20 @@ obviously it isn't just the data entry routines that are to blame. Unix passwords are case sensitive. So if users use mixed case passwords they are in trouble.

    -Samba can try to cope with this by either using the "password level" +Samba can try to cope with this by either using the "password level" option which causes Samba to try the offered password with up to the -specified number of case changes, or by using the "password server" +specified number of case changes, or by using the "password server" option which allows Samba to do its validation via another machine (typically a WinNT server).

    Samba supports the password encryption method used by SMB clients. Note that the use of password encryption in Microsoft -networking leads to password hashes that are "plain text equivalent". +networking leads to password hashes that are "plain text equivalent". This means that it is *VERY* important to ensure that the Samba smbpasswd file containing these password hashes is only readable by the root user. See the documentation ENCRYPTION.txt for more details. -

    Locking

    +

    Locking

    Since samba 2.2, samba supports other types of locking as well. This section is outdated.

    @@ -981,14 +978,14 @@ a unix environment because few unix programs use byte range locking. The stress of huge numbers of lock requests from dos/windows clients can kill the daemon on some systems.

    -The second major problem is the "opportunistic locking" requested by +The second major problem is the "opportunistic locking" requested by some clients. If a client requests opportunistic locking then it is asking the server to notify it if anyone else tries to do something on the same file, at which time the client will say if it is willing to give up its lock. Unix has no simple way of implementing opportunistic locking, and currently Samba has no support for it. -

    Deny Modes

    -When a SMB client opens a file it asks for a particular "deny mode" to +

    Deny Modes

    +When a SMB client opens a file it asks for a particular "deny mode" to be placed on the file. These modes (DENY_NONE, DENY_READ, DENY_WRITE, DENY_ALL, DENY_FCB and DENY_DOS) specify what actions should be allowed by anyone else who tries to use the file at the same time. If @@ -1001,7 +998,7 @@ directory or a shared memory implementation. The lock file method is clumsy and consumes processing and file resources, the shared memory implementation is vastly prefered and is turned on by default for those systems that support it. -

    Trapdoor UIDs

    +

    Trapdoor UIDs

    A SMB session can run with several uids on the one socket. This happens when a user connects to two shares with different usernames. To cope with this the unix server needs to switch uids @@ -1009,11 +1006,11 @@ within the one process. On some unixes (such as SCO) this is not possible. This means that on those unixes the client is restricted to a single uid.

    -Note that you can also get the "trapdoor uid" message for other +Note that you can also get the "trapdoor uid" message for other reasons. Please see the FAQ for details. -

    Port numbers

    -There is a convention that clients on sockets use high "unprivilaged" -port numbers (>1000) and connect to servers on low "privilaged" port +

    Port numbers

    +There is a convention that clients on sockets use high "unprivilaged" +port numbers (>1000) and connect to servers on low "privilaged" port numbers. This is enforced in Unix as non-root users can't open a socket for listening on port numbers less than 1000.

    @@ -1034,13 +1031,13 @@ to any of these OSes unless they are running as root. The answer comes back, but it goes to port 137 which the unix user can't listen on. Interestingly WinNT3.1 got this right - it sends node status responses back to the source port in the request. -

    Protocol Complexity

    -There are many "protocol levels" in the SMB protocol. It seems that +

    Protocol Complexity

    +There are many "protocol levels" in the SMB protocol. It seems that each time new functionality was added to a Microsoft operating system, they added the equivalent functions in a new protocol level of the SMB -protocol to "externalise" the new capabilities. +protocol to "externalise" the new capabilities.

    -This means the protocol is very "rich", offering many ways of doing +This means the protocol is very "rich", offering many ways of doing each file operation. This means SMB servers need to be complex and large. It also means it is very difficult to make them bug free. It is not just Samba that suffers from this problem, other servers such as @@ -1048,19 +1045,19 @@ WinNT don't support every variation of every call and it has almost certainly been a headache for MS developers to support the myriad of SMB calls that are available.

    -There are about 65 "top level" operations in the SMB protocol (things +There are about 65 "top level" operations in the SMB protocol (things like SMBread and SMBwrite). Some of these include hundreds of sub-functions (SMBtrans has at least 120 sub-functions, like DosPrintQAdd and NetSessionEnum). All of them take several options that can change the way they work. Many take dozens of possible -"information levels" that change the structures that need to be -returned. Samba supports all but 2 of the "top level" functions. It +"information levels" that change the structures that need to be +returned. Samba supports all but 2 of the "top level" functions. It supports only 8 (so far) of the SMBtrans sub-functions. Even NT doesn't support them all.

    -Samba currently supports up to the "NT LM 0.12" protocol, which is the +Samba currently supports up to the "NT LM 0.12" protocol, which is the one preferred by Win95 and WinNT3.5. Luckily this protocol level has a -"capabilities" field which specifies which super-duper new-fangled +"capabilities" field which specifies which super-duper new-fangled options the server suports. This helps to make the implementation of this protocol level much easier.

    @@ -1105,13 +1102,13 @@ You'll notice that it produces a LOT of output. It is showing you the arguments to every system call that the program makes and the result. Very little happens in a program without a system call so you get lots of output. You'll also find that it produces a lot of -"preamble" stuff showing the loading of shared libraries etc. Ignore +"preamble" stuff showing the loading of shared libraries etc. Ignore this (unless its going wrong!)

    For example, the only line that really matters in the strace echo hello output is: 

    -write(1, "hello\n", 6)                  = 6
+write(1, "hello\n", 6)                  = 6

    all the rest is just setting up to run the program.

    Ok, now you're familiar with strace. To use it on Samba you need to strace the running smbd daemon. The way I tend ot use it is to first @@ -1121,10 +1118,10 @@ find which process ID that client is attached to, then as root I do stderr output from this command to a file for later perusal. For example, if I'm using a csh style shell:

    strace -f -p 3872 >& strace.out

    or with a sh style shell:

    strace -f -p 3872 > strace.out 2>&1

    -Note the "-f" option. This is only available on some systems, and +Note the "-f" option. This is only available on some systems, and allows you to trace not just the current process, but any children it forks. This is great for finding printing problems caused by the -"print command" being wrong. +"print command" being wrong.

    Once you are attached you then can do whatever it is on the client that is causing problems and you will capture all the system calls @@ -1135,20 +1132,20 @@ output for strings that I know will appear when the problem happens. For example, if I am having touble with permissions on a file I would search for that files name in the strace output and look at the surrounding lines. Another trick is to match up file descriptor -numbers and "follow" what happens to an open file until it is closed. +numbers and "follow" what happens to an open file until it is closed.

    Beyond this you will have to use your initiative. To give you an idea of what you are looking for here is a piece of strace output that shows that /dev/null is not world writeable, which causes printing to fail with Samba: 

    -[pid 28268] open("/dev/null", O_RDWR)   = -1 EACCES (Permission denied)
-[pid 28268] open("/dev/null", O_WRONLY) = -1 EACCES (Permission denied)
+[pid 28268] open("/dev/null", O_RDWR)   = -1 EACCES (Permission denied)
+[pid 28268] open("/dev/null", O_WRONLY) = -1 EACCES (Permission denied)

    The process is trying to first open /dev/null read-write then read-only. Both fail. This means /dev/null has incorrect permissions. -

    Chapter 9. Finding useful information on windows

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    Table of Contents

    Netlogon debugging output

    Netlogon debugging output

    1. stop netlogon service on PDC

    2. rename original netlogon.dll to netlogon.dll.original

    3. copy checked version of netlogon.dll to system32 directory

    4. set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DBFlag to 0x20000004

    5. start netlogon service on PDC

    Chapter 10. NT Domain RPC's

    Luke Leighton

    Duncan Stansfield

    01 November 97(version 0.0.24)

    Table of Contents

    Introduction
    Sources
    Credits
    Notes and Structures
    Notes
    Enumerations
    Structures
    MSRPC over Transact Named Pipe
    MSRPC Pipes
    Header
    Tail
    RPC Bind / Bind Ack
    NTLSA Transact Named Pipe
    LSA Open Policy
    LSA Query Info Policy
    LSA Enumerate Trusted Domains
    LSA Open Secret
    LSA Close
    LSA Lookup SIDS
    LSA Lookup Names
    NETLOGON rpc Transact Named Pipe
    LSA Request Challenge
    LSA Authenticate 2
    LSA Server Password Set
    LSA SAM Logon
    LSA SAM Logoff
    \\MAILSLOT\NET\NTLOGON
    Query for PDC
    SAM Logon
    SRVSVC Transact Named Pipe
    Net Share Enum
    Net Server Get Info
    Cryptographic side of NT Domain Authentication
    Definitions
    Protocol
    Comments
    SIDs and RIDs
    Well-known SIDs
    Well-known RIDS

    Introduction

    +

    Chapter 9. Finding useful information on windows

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    Table of Contents

    Netlogon debugging output

    Netlogon debugging output

    1. stop netlogon service on PDC

    2. rename original netlogon.dll to netlogon.dll.original

    3. copy checked version of netlogon.dll to system32 directory

    4. set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DBFlag to 0x20000004

    5. start netlogon service on PDC

    Chapter 10. NT Domain RPC's

    Luke Leighton

    Duncan Stansfield

    01 November 97(version 0.0.24)

    Table of Contents

    Introduction
    Sources
    Credits
    Notes and Structures
    Notes
    Enumerations
    Structures
    MSRPC over Transact Named Pipe
    MSRPC Pipes
    Header
    Tail
    RPC Bind / Bind Ack
    NTLSA Transact Named Pipe
    LSA Open Policy
    LSA Query Info Policy
    LSA Enumerate Trusted Domains
    LSA Open Secret
    LSA Close
    LSA Lookup SIDS
    LSA Lookup Names
    NETLOGON rpc Transact Named Pipe
    LSA Request Challenge
    LSA Authenticate 2
    LSA Server Password Set
    LSA SAM Logon
    LSA SAM Logoff
    \\MAILSLOT\NET\NTLOGON
    Query for PDC
    SAM Logon
    SRVSVC Transact Named Pipe
    Net Share Enum
    Net Server Get Info
    Cryptographic side of NT Domain Authentication
    Definitions
    Protocol
    Comments
    SIDs and RIDs
    Well-known SIDs
    Well-known RIDS

    Introduction

    This document contains information to provide an NT workstation with login services, without the need for an NT server. It is the sgml version of http://mailhost.cb1.com/~lkcl/cifsntdomain.txt, controlled by Luke.

    @@ -1181,7 +1178,7 @@ NT workstation, and enabling full debugging in NETLOGON. This is achieved by setting the following REG_SZ registry key to 0x1ffffff:

    HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

    Incorrect direct editing of the registry can cause your machine to fail. Then again, so can incorrect implementation of this -protocol. See "Liability:" above.

    +protocol. See "Liability:" above.

    Bear in mind that each packet over-the-wire will have its origin in an API call. Therefore, there are likely to be structures, enumerations and defines that are usefully documented elsewhere. @@ -1194,12 +1191,12 @@ Failure to return this error code will make the workstation report that it is already a member of the domain.

  • the cryptographic side of the NetrServerPasswordSet command, which would allow the workstation to change its password. This password is used to generate the long-term session key. [It is possible to reject this -command, and keep the default workstation password].

    • Sources

    cket Traces from Netmonitor (Service Pack 1 and above)
    ul Ashton and Luke Leighton's other "NT Domain" doc.
    FS documentation - cifs6.txt
    FS documentation - cifsrap2.txt

    Credits

    Paul Ashton: loads of work with Net Monitor; understanding the NT authentication system; reference implementation of the NT domain support on which this document is originally based.
    Duncan Stansfield: low-level analysis of MSRPC Pipes.
    Linus Nordberg: producing c-code from Paul's crypto spec.
    Windows Sourcer development team

    Notes and Structures

    Notes

    1. -In the SMB Transact pipes, some "Structures", described here, appear to be +command, and keep the default workstation password].

    Sources

    cket Traces from Netmonitor (Service Pack 1 and above)
    ul Ashton and Luke Leighton's other "NT Domain" doc.
    FS documentation - cifs6.txt
    FS documentation - cifsrap2.txt

    Credits

    Paul Ashton: loads of work with Net Monitor; understanding the NT authentication system; reference implementation of the NT domain support on which this document is originally based.
    Duncan Stansfield: low-level analysis of MSRPC Pipes.
    Linus Nordberg: producing c-code from Paul's crypto spec.
    Windows Sourcer development team

    Notes and Structures

    Notes

    1. +In the SMB Transact pipes, some "Structures", described here, appear to be 4-byte aligned with the SMB header, at their start. Exactly which -"Structures" need aligning is not precisely known or documented. +"Structures" need aligning is not precisely known or documented.

    2. -In the UDP NTLOGON Mailslots, some "Structures", described here, appear to be +In the UDP NTLOGON Mailslots, some "Structures", described here, appear to be 2-byte aligned with the start of the mailslot, at their start.

    3. Domain SID is of the format S-revision-version-auth1-auth2...authN. @@ -1222,15 +1219,15 @@ into or taken out of the SMB data stream. if the count is non-zero, then the pointer is also non-zero. immediately following the pointer is the count again, followed by an array of container sub-structures. the count appears a third time after the last sub-structure. -

    Enumerations

    MSRPC Header type

    command number in the msrpc packet header

    MSRPC_Request:

    0x00

    MSRPC_Response:

    0x02

    MSRPC_Bind:

    0x0B

    MSRPC_BindAck:

    0x0C

    MSRPC Packet info

    The meaning of these flags is undocumented

    FirstFrag:

    0x01

    LastFrag:

    0x02

    NotaFrag:

    0x04

    RecRespond:

    0x08

    NoMultiplex:

    0x10

    NotForIdemp:

    0x20

    NotforBcast:

    0x40

    NoUuid:

    0x80

    Structures

    VOID *

    sizeof VOID* is 32 bits.

    char

    sizeof char is 8 bits.

    UTIME

    UTIME is 32 bits, indicating time in seconds since 01jan1970. documented in cifs6.txt (section 3.5 page, page 30).

    NTTIME

    NTTIME is 64 bits. documented in cifs6.txt (section 3.5 page, page 30).

    DOM_SID (domain SID structure)

    UINT32

    num of sub-authorities in domain SID

    UINT8

    SID revision number

    UINT8

    num of sub-authorities in domain SID

    UINT8[6]

    6 bytes for domain SID - Identifier Authority.

    UINT16[n_subauths]

    domain SID sub-authorities

    Note: the domain SID is documented elsewhere. -

    STR (string)

    STR (string) is a char[] : a null-terminated string of ascii characters.

    UNIHDR (unicode string header)

    UINT16

    length of unicode string

    UINT16

    max length of unicode string

    UINT32

    4 - undocumented.

    UNIHDR2 (unicode string header plus buffer pointer)

    UNIHDR

    unicode string header

    VOID*

    undocumented buffer pointer

    UNISTR (unicode string)

    UINT16[]

    null-terminated string of unicode characters.

    NAME (length-indicated unicode string)

    UINT32

    length of unicode string

    UINT16[]

    null-terminated string of unicode characters.

    UNISTR2 (aligned unicode string)

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    max length of unicode string

    UINT32

    0 - undocumented

    UINT32

    length of unicode string

    UINT16[]

    string of uncode characters

    OBJ_ATTR (object attributes)

    UINT32

    0x18 - length (in bytes) including the length field.

    VOID*

    0 - root directory (pointer)

    VOID*

    0 - object name (pointer)

    UINT32

    0 - attributes (undocumented)

    VOID*

    0 - security descriptior (pointer)

    UINT32

    0 - security quality of service

    POL_HND (LSA policy handle)

    char[20]

    policy handle

    DOM_SID2 (domain SID structure, SIDS stored in unicode)

    UINT32

    5 - SID type

    UINT32

    0 - undocumented

    UNIHDR2

    domain SID unicode string header

    UNISTR

    domain SID unicode string

    Note: there is a conflict between the unicode string header and the unicode string itself as to which to use to indicate string length. this will need to be resolved.

    Note: the SID type indicates, for example, an alias; a well-known group etc. this is documented somewhere.

    DOM_RID (domain RID structure)

    UINT32

    5 - well-known SID. 1 - user SID (see ShowACLs)

    UINT32

    5 - undocumented

    UINT32

    domain RID

    UINT32

    0 - domain index out of above reference domains

    LOG_INFO (server, account, client structure)

    Note: logon server name starts with two '\' characters and is upper case.

    Note: account name is the logon client name from the LSA Request Challenge, with a $ on the end of it, in upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    account name unicode string

    UINT16

    sec_chan - security channel type

    UNISTR2

    logon client machine unicode string

    CLNT_SRV (server, client names structure)

    Note: logon server name starts with two '\' characters and is upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon client machine unicode string

    CREDS (credentials + time stamp)

    char[8]

    credentials

    UTIME

    time stamp

    CLNT_INFO2 (server, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will beused in subsequent credential checks. the presumed intention is to - maintain an authenticated request/response trail.

    CLNT_SRV

    client and server names

    UINT8[]

    ???? padding, for 4-byte alignment with SMB header.

    VOID*

    pointer to client credentials.

    CREDS

    client-calculated credentials + client time

    CLNT_INFO (server, account, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will be used in subsequent credential checks. the presumed intention is to maintain an authenticated request/response trail.

    LOG_INFO

    logon account info

    CREDS

    client-calculated credentials + client time

    ID_INFO_1 (id info structure, auth level 1)

    VOID*

    ptr_id_info_1

    UNIHDR

    domain name unicode header

    UINT32

    param control

    UINT64

    logon ID

    UNIHDR

    user name unicode header

    UNIHDR

    workgroup name unicode header

    char[16]

    arc4 LM OWF Password

    char[16]

    arc4 NT OWF Password

    UNISTR2

    domain name unicode string

    UNISTR2

    user name unicode string

    UNISTR2

    workstation name unicode string

    SAM_INFO (sam logon/logoff id info structure)

    Note: presumably, the return credentials is supposedly for the server to verify that the credential chain hasn't been compromised.

    CLNT_INFO2

    client identification/authentication info

    VOID*

    pointer to return credentials.

    CRED

    return credentials - ignored.

    UINT16

    logon level

    UINT16

    switch value

    +

    Enumerations

    MSRPC Header type

    command number in the msrpc packet header

    MSRPC_Request:

    0x00

    MSRPC_Response:

    0x02

    MSRPC_Bind:

    0x0B

    MSRPC_BindAck:

    0x0C

    MSRPC Packet info

    The meaning of these flags is undocumented

    FirstFrag:

    0x01

    LastFrag:

    0x02

    NotaFrag:

    0x04

    RecRespond:

    0x08

    NoMultiplex:

    0x10

    NotForIdemp:

    0x20

    NotforBcast:

    0x40

    NoUuid:

    0x80

    Structures

    VOID *

    sizeof VOID* is 32 bits.

    char

    sizeof char is 8 bits.

    UTIME

    UTIME is 32 bits, indicating time in seconds since 01jan1970. documented in cifs6.txt (section 3.5 page, page 30).

    NTTIME

    NTTIME is 64 bits. documented in cifs6.txt (section 3.5 page, page 30).

    DOM_SID (domain SID structure)

    UINT32

    num of sub-authorities in domain SID

    UINT8

    SID revision number

    UINT8

    num of sub-authorities in domain SID

    UINT8[6]

    6 bytes for domain SID - Identifier Authority.

    UINT16[n_subauths]

    domain SID sub-authorities

    Note: the domain SID is documented elsewhere. +

    STR (string)

    STR (string) is a char[] : a null-terminated string of ascii characters.

    UNIHDR (unicode string header)

    UINT16

    length of unicode string

    UINT16

    max length of unicode string

    UINT32

    4 - undocumented.

    UNIHDR2 (unicode string header plus buffer pointer)

    UNIHDR

    unicode string header

    VOID*

    undocumented buffer pointer

    UNISTR (unicode string)

    UINT16[]

    null-terminated string of unicode characters.

    NAME (length-indicated unicode string)

    UINT32

    length of unicode string

    UINT16[]

    null-terminated string of unicode characters.

    UNISTR2 (aligned unicode string)

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    max length of unicode string

    UINT32

    0 - undocumented

    UINT32

    length of unicode string

    UINT16[]

    string of uncode characters

    OBJ_ATTR (object attributes)

    UINT32

    0x18 - length (in bytes) including the length field.

    VOID*

    0 - root directory (pointer)

    VOID*

    0 - object name (pointer)

    UINT32

    0 - attributes (undocumented)

    VOID*

    0 - security descriptior (pointer)

    UINT32

    0 - security quality of service

    POL_HND (LSA policy handle)

    char[20]

    policy handle

    DOM_SID2 (domain SID structure, SIDS stored in unicode)

    UINT32

    5 - SID type

    UINT32

    0 - undocumented

    UNIHDR2

    domain SID unicode string header

    UNISTR

    domain SID unicode string

    Note: there is a conflict between the unicode string header and the unicode string itself as to which to use to indicate string length. this will need to be resolved.

    Note: the SID type indicates, for example, an alias; a well-known group etc. this is documented somewhere.

    DOM_RID (domain RID structure)

    UINT32

    5 - well-known SID. 1 - user SID (see ShowACLs)

    UINT32

    5 - undocumented

    UINT32

    domain RID

    UINT32

    0 - domain index out of above reference domains

    LOG_INFO (server, account, client structure)

    Note: logon server name starts with two '\' characters and is upper case.

    Note: account name is the logon client name from the LSA Request Challenge, with a $ on the end of it, in upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    account name unicode string

    UINT16

    sec_chan - security channel type

    UNISTR2

    logon client machine unicode string

    CLNT_SRV (server, client names structure)

    Note: logon server name starts with two '\' characters and is upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon client machine unicode string

    CREDS (credentials + time stamp)

    char[8]

    credentials

    UTIME

    time stamp

    CLNT_INFO2 (server, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will beused in subsequent credential checks. the presumed intention is to + maintain an authenticated request/response trail.

    CLNT_SRV

    client and server names

    UINT8[]

    ???? padding, for 4-byte alignment with SMB header.

    VOID*

    pointer to client credentials.

    CREDS

    client-calculated credentials + client time

    CLNT_INFO (server, account, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will be used in subsequent credential checks. the presumed intention is to maintain an authenticated request/response trail.

    LOG_INFO

    logon account info

    CREDS

    client-calculated credentials + client time

    ID_INFO_1 (id info structure, auth level 1)

    VOID*

    ptr_id_info_1

    UNIHDR

    domain name unicode header

    UINT32

    param control

    UINT64

    logon ID

    UNIHDR

    user name unicode header

    UNIHDR

    workgroup name unicode header

    char[16]

    arc4 LM OWF Password

    char[16]

    arc4 NT OWF Password

    UNISTR2

    domain name unicode string

    UNISTR2

    user name unicode string

    UNISTR2

    workstation name unicode string

    SAM_INFO (sam logon/logoff id info structure)

    Note: presumably, the return credentials is supposedly for the server to verify that the credential chain hasn't been compromised.

    CLNT_INFO2

    client identification/authentication info

    VOID*

    pointer to return credentials.

    CRED

    return credentials - ignored.

    UINT16

    logon level

    UINT16

    switch value

             switch (switch_value)
         case 1:
         {
             ID_INFO_1     id_info_1;
         }
-

    GID (group id info)

    UINT32

    group id

    UINT32

    user attributes (only used by NT 3.1 and 3.51)

    DOM_REF (domain reference info)

    VOID*

    undocumented buffer pointer.

    UINT32

    num referenced domains?

    VOID*

    undocumented domain name buffer pointer.

    UINT32

    32 - max number of entries

    UINT32

    4 - num referenced domains?

    UNIHDR2

    domain name unicode string header

    UNIHDR2[num_ref_doms-1]

    referenced domain unicode string headers

    UNISTR

    domain name unicode string

    DOM_SID[num_ref_doms]

    referenced domain SIDs

    DOM_INFO (domain info, levels 3 and 5 are the same))

    UINT8[]

    ??? padding to get 4-byte alignment with start of SMB header

    UINT16

    domain name string length * 2

    UINT16

    domain name string length * 2

    VOID*

    undocumented domain name string buffer pointer

    VOID*

    undocumented domain SID string buffer pointer

    UNISTR2

    domain name (unicode string)

    DOM_SID

    domain SID

    USER_INFO (user logon info)

    Note: it would be nice to know what the 16 byte user session key is for.

    NTTIME

    logon time

    NTTIME

    logoff time

    NTTIME

    kickoff time

    NTTIME

    password last set time

    NTTIME

    password can change time

    NTTIME

    password must change time

    UNIHDR

    username unicode string header

    UNIHDR

    user's full name unicode string header

    UNIHDR

    logon script unicode string header

    UNIHDR

    profile path unicode string header

    UNIHDR

    home directory unicode string header

    UNIHDR

    home directory drive unicode string header

    UINT16

    logon count

    UINT16

    bad password count

    UINT32

    User ID

    UINT32

    Group ID

    UINT32

    num groups

    VOID*

    undocumented buffer pointer to groups.

    UINT32

    user flags

    char[16]

    user session key

    UNIHDR

    logon server unicode string header

    UNIHDR

    logon domain unicode string header

    VOID*

    undocumented logon domain id pointer

    char[40]

    40 undocumented padding bytes. future expansion?

    UINT32

    0 - num_other_sids?

    VOID*

    NULL - undocumented pointer to other domain SIDs.

    UNISTR2

    username unicode string

    UNISTR2

    user's full name unicode string

    UNISTR2

    logon script unicode string

    UNISTR2

    profile path unicode string

    UNISTR2

    home directory unicode string

    UNISTR2

    home directory drive unicode string

    UINT32

    num groups

    GID[num_groups]

    group info

    UNISTR2

    logon server unicode string

    UNISTR2

    logon domain unicode string

    DOM_SID

    domain SID

    DOM_SID[num_sids]

    other domain SIDs?

    SH_INFO_1_PTR (pointers to level 1 share info strings)

    Note: see cifsrap2.txt section5, page 10.

    0 for shi1_type indicates a Disk.
    1 for shi1_type indicates a Print Queue.
    2 for shi1_type indicates a Device.
    3 for shi1_type indicates an IPC pipe.
    0x8000 0000 (top bit set in shi1_type) indicates a hidden share.
    VOID*

    shi1_netname - pointer to net name

    UINT32

    shi1_type - type of share. 0 - undocumented.

    VOID*

    shi1_remark - pointer to comment.

    SH_INFO_1_STR (level 1 share info strings)

    UNISTR2

    shi1_netname - unicode string of net name

    UNISTR2

    shi1_remark - unicode string of comment.

    SHARE_INFO_1_CTR

    share container with 0 entries:

    UINT32

    0 - EntriesRead

    UINT32

    0 - Buffer

    share container with > 0 entries:

    UINT32

    EntriesRead

    UINT32

    non-zero - Buffer

    UINT32

    EntriesRead

    SH_INFO_1_PTR[EntriesRead]

    share entry pointers

    SH_INFO_1_STR[EntriesRead]

    share entry strings

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    UINT32

    EntriesRead

    UINT32

    0 - padding

    SERVER_INFO_101

    Note: see cifs6.txt section 6.4 - the fields described therein will be of assistance here. for example, the type listed below is the same as fServerType, which is described in 6.4.1.

    SV_TYPE_WORKSTATION

    0x00000001 All workstations

    SV_TYPE_SERVER

    0x00000002 All servers

    SV_TYPE_SQLSERVER

    0x00000004 Any server running with SQL server

    SV_TYPE_DOMAIN_CTRL

    0x00000008 Primary domain controller

    SV_TYPE_DOMAIN_BAKCTRL

    0x00000010 Backup domain controller

    SV_TYPE_TIME_SOURCE

    0x00000020 Server running the timesource service

    SV_TYPE_AFP

    0x00000040 Apple File Protocol servers

    SV_TYPE_NOVELL

    0x00000080 Novell servers

    SV_TYPE_DOMAIN_MEMBER

    0x00000100 Domain Member

    SV_TYPE_PRINTQ_SERVER

    0x00000200 Server sharing print queue

    SV_TYPE_DIALIN_SERVER

    0x00000400 Server running dialin service.

    SV_TYPE_XENIX_SERVER

    0x00000800 Xenix server

    SV_TYPE_NT

    0x00001000 NT server

    SV_TYPE_WFW

    0x00002000 Server running Windows for

    SV_TYPE_SERVER_NT

    0x00008000 Windows NT non DC server

    SV_TYPE_POTENTIAL_BROWSER

    0x00010000 Server that can run the browser service

    SV_TYPE_BACKUP_BROWSER

    0x00020000 Backup browser server

    SV_TYPE_MASTER_BROWSER

    0x00040000 Master browser server

    SV_TYPE_DOMAIN_MASTER

    0x00080000 Domain Master Browser server

    SV_TYPE_LOCAL_LIST_ONLY

    0x40000000 Enumerate only entries marked "local"

    SV_TYPE_DOMAIN_ENUM

    0x80000000 Enumerate Domains. The pszServer and pszDomain parameters must be NULL.

    UINT32

    500 - platform_id

    VOID*

    pointer to name

    UINT32

    5 - major version

    UINT32

    4 - minor version

    UINT32

    type (SV_TYPE_... bit field)

    VOID*

    pointer to comment

    UNISTR2

    sv101_name - unicode string of server name

    UNISTR2

    sv_101_comment - unicode string of server comment.

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    MSRPC over Transact Named Pipe

    For details on the SMB Transact Named Pipe, see cifs6.txt

    MSRPC Pipes

    +

    GID (group id info)

    UINT32

    group id

    UINT32

    user attributes (only used by NT 3.1 and 3.51)

    DOM_REF (domain reference info)

    VOID*

    undocumented buffer pointer.

    UINT32

    num referenced domains?

    VOID*

    undocumented domain name buffer pointer.

    UINT32

    32 - max number of entries

    UINT32

    4 - num referenced domains?

    UNIHDR2

    domain name unicode string header

    UNIHDR2[num_ref_doms-1]

    referenced domain unicode string headers

    UNISTR

    domain name unicode string

    DOM_SID[num_ref_doms]

    referenced domain SIDs

    DOM_INFO (domain info, levels 3 and 5 are the same))

    UINT8[]

    ??? padding to get 4-byte alignment with start of SMB header

    UINT16

    domain name string length * 2

    UINT16

    domain name string length * 2

    VOID*

    undocumented domain name string buffer pointer

    VOID*

    undocumented domain SID string buffer pointer

    UNISTR2

    domain name (unicode string)

    DOM_SID

    domain SID

    USER_INFO (user logon info)

    Note: it would be nice to know what the 16 byte user session key is for.

    NTTIME

    logon time

    NTTIME

    logoff time

    NTTIME

    kickoff time

    NTTIME

    password last set time

    NTTIME

    password can change time

    NTTIME

    password must change time

    UNIHDR

    username unicode string header

    UNIHDR

    user's full name unicode string header

    UNIHDR

    logon script unicode string header

    UNIHDR

    profile path unicode string header

    UNIHDR

    home directory unicode string header

    UNIHDR

    home directory drive unicode string header

    UINT16

    logon count

    UINT16

    bad password count

    UINT32

    User ID

    UINT32

    Group ID

    UINT32

    num groups

    VOID*

    undocumented buffer pointer to groups.

    UINT32

    user flags

    char[16]

    user session key

    UNIHDR

    logon server unicode string header

    UNIHDR

    logon domain unicode string header

    VOID*

    undocumented logon domain id pointer

    char[40]

    40 undocumented padding bytes. future expansion?

    UINT32

    0 - num_other_sids?

    VOID*

    NULL - undocumented pointer to other domain SIDs.

    UNISTR2

    username unicode string

    UNISTR2

    user's full name unicode string

    UNISTR2

    logon script unicode string

    UNISTR2

    profile path unicode string

    UNISTR2

    home directory unicode string

    UNISTR2

    home directory drive unicode string

    UINT32

    num groups

    GID[num_groups]

    group info

    UNISTR2

    logon server unicode string

    UNISTR2

    logon domain unicode string

    DOM_SID

    domain SID

    DOM_SID[num_sids]

    other domain SIDs?

    SH_INFO_1_PTR (pointers to level 1 share info strings)

    Note: see cifsrap2.txt section5, page 10.

    0 for shi1_type indicates a Disk.
    1 for shi1_type indicates a Print Queue.
    2 for shi1_type indicates a Device.
    3 for shi1_type indicates an IPC pipe.
    0x8000 0000 (top bit set in shi1_type) indicates a hidden share.
    VOID*

    shi1_netname - pointer to net name

    UINT32

    shi1_type - type of share. 0 - undocumented.

    VOID*

    shi1_remark - pointer to comment.

    SH_INFO_1_STR (level 1 share info strings)

    UNISTR2

    shi1_netname - unicode string of net name

    UNISTR2

    shi1_remark - unicode string of comment.

    SHARE_INFO_1_CTR

    share container with 0 entries:

    UINT32

    0 - EntriesRead

    UINT32

    0 - Buffer

    share container with > 0 entries:

    UINT32

    EntriesRead

    UINT32

    non-zero - Buffer

    UINT32

    EntriesRead

    SH_INFO_1_PTR[EntriesRead]

    share entry pointers

    SH_INFO_1_STR[EntriesRead]

    share entry strings

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    UINT32

    EntriesRead

    UINT32

    0 - padding

    SERVER_INFO_101

    Note: see cifs6.txt section 6.4 - the fields described therein will be of assistance here. for example, the type listed below is the same as fServerType, which is described in 6.4.1.

    SV_TYPE_WORKSTATION

    0x00000001 All workstations

    SV_TYPE_SERVER

    0x00000002 All servers

    SV_TYPE_SQLSERVER

    0x00000004 Any server running with SQL server

    SV_TYPE_DOMAIN_CTRL

    0x00000008 Primary domain controller

    SV_TYPE_DOMAIN_BAKCTRL

    0x00000010 Backup domain controller

    SV_TYPE_TIME_SOURCE

    0x00000020 Server running the timesource service

    SV_TYPE_AFP

    0x00000040 Apple File Protocol servers

    SV_TYPE_NOVELL

    0x00000080 Novell servers

    SV_TYPE_DOMAIN_MEMBER

    0x00000100 Domain Member

    SV_TYPE_PRINTQ_SERVER

    0x00000200 Server sharing print queue

    SV_TYPE_DIALIN_SERVER

    0x00000400 Server running dialin service.

    SV_TYPE_XENIX_SERVER

    0x00000800 Xenix server

    SV_TYPE_NT

    0x00001000 NT server

    SV_TYPE_WFW

    0x00002000 Server running Windows for

    SV_TYPE_SERVER_NT

    0x00008000 Windows NT non DC server

    SV_TYPE_POTENTIAL_BROWSER

    0x00010000 Server that can run the browser service

    SV_TYPE_BACKUP_BROWSER

    0x00020000 Backup browser server

    SV_TYPE_MASTER_BROWSER

    0x00040000 Master browser server

    SV_TYPE_DOMAIN_MASTER

    0x00080000 Domain Master Browser server

    SV_TYPE_LOCAL_LIST_ONLY

    0x40000000 Enumerate only entries marked "local"

    SV_TYPE_DOMAIN_ENUM

    0x80000000 Enumerate Domains. The pszServer and pszDomain parameters must be NULL.

    UINT32

    500 - platform_id

    VOID*

    pointer to name

    UINT32

    5 - major version

    UINT32

    4 - minor version

    UINT32

    type (SV_TYPE_... bit field)

    VOID*

    pointer to comment

    UNISTR2

    sv101_name - unicode string of server name

    UNISTR2

    sv_101_comment - unicode string of server comment.

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    MSRPC over Transact Named Pipe

    For details on the SMB Transact Named Pipe, see cifs6.txt

    MSRPC Pipes

    The MSRPC is conducted over an SMB Transact Pipe with a name of \PIPE\. You must first obtain a 16 bit file handle, by sending a SMBopenX with the pipe name \PIPE\srvsvc for @@ -1269,21 +1266,21 @@ To be resolved: lkcl/01nov97 there appear to be two additional bytes after the null-terminated \PIPE\ name for the RPC pipe. Values seen so far are listed below:

             initial SMBopenX request:         RPC API command 0x26 params:
-        "\\PIPE\\lsarpc"                  0x65 0x63; 0x72 0x70; 0x44 0x65;
-        "\\PIPE\\srvsvc"                  0x73 0x76; 0x4E 0x00; 0x5C 0x43;
-

    Header

    [section to be rewritten, following receipt of work by Duncan Stansfield]

    Interesting note: if you set packed data representation to 0x0100 0000 -then all 4-byte and 2-byte word ordering is turned around!

    The start of each of the NTLSA and NETLOGON named pipes begins with:

    offset: 00

    Variable type: UINT8

    Variable data: 5 - RPC major version

    offset: 01

    Variable type: UINT8

    Variable data: 0 - RPC minor version

    offset: 02

    Variable type: UINT8

    Variable data: 2 - RPC response packet

    offset: 03

    Variable type: UINT8

    Variable data: 3 - (FirstFrag bit-wise or with LastFrag)

    offset: 04

    Variable type: UINT32

    Variable data: 0x1000 0000 - packed data representation

    offset: 08

    Variable type: UINT16

    Variable data: fragment length - data size (bytes) inc header and tail.

    offset: 0A

    Variable type: UINT16

    Variable data: 0 - authentication length

    offset: 0C

    Variable type: UINT32

    Variable data: call identifier. matches 12th UINT32 of incoming RPC data.

    offset: 10

    Variable type: UINT32

    Variable data: allocation hint - data size (bytes) minus header and tail.

    offset: 14

    Variable type: UINT16

    Variable data: 0 - presentation context identifier

    offset: 16

    Variable type: UINT8

    Variable data: 0 - cancel count

    offset: 17

    Variable type: UINT8

    Variable data: in replies: 0 - reserved; in requests: opnum - see #defines.

    offset: 18

    Variable type: ......

    Variable data: start of data (goes on for allocation_hint bytes)

    RPC_Packet for request, response, bind and bind acknowledgement

    UINT8 versionmaj

    reply same as request (0x05)

    UINT8 versionmin

    reply same as request (0x00)

    UINT8 type

    one of the MSRPC_Type enums

    UINT8 flags

    reply same as request (0x00 for Bind, 0x03 for Request)

    UINT32 representation

    reply same as request (0x00000010)

    UINT16 fraglength

    the length of the data section of the SMB trans packet

    UINT16 authlength

    UINT32 callid

    call identifier. (e.g. 0x00149594)

    * stub USE TvPacket

    the remainder of the packet depending on the "type"

    Interface identification

    the interfaces are numbered. as yet I haven't seen more than one interface used on the same pipe name srvsvc

    +        "\\PIPE\\lsarpc"                  0x65 0x63; 0x72 0x70; 0x44 0x65;
+        "\\PIPE\\srvsvc"                  0x73 0x76; 0x4E 0x00; 0x5C 0x43;
+

    Header

    [section to be rewritten, following receipt of work by Duncan Stansfield]

    Interesting note: if you set packed data representation to 0x0100 0000 +then all 4-byte and 2-byte word ordering is turned around!

    The start of each of the NTLSA and NETLOGON named pipes begins with:

    offset: 00

    Variable type: UINT8

    Variable data: 5 - RPC major version

    offset: 01

    Variable type: UINT8

    Variable data: 0 - RPC minor version

    offset: 02

    Variable type: UINT8

    Variable data: 2 - RPC response packet

    offset: 03

    Variable type: UINT8

    Variable data: 3 - (FirstFrag bit-wise or with LastFrag)

    offset: 04

    Variable type: UINT32

    Variable data: 0x1000 0000 - packed data representation

    offset: 08

    Variable type: UINT16

    Variable data: fragment length - data size (bytes) inc header and tail.

    offset: 0A

    Variable type: UINT16

    Variable data: 0 - authentication length

    offset: 0C

    Variable type: UINT32

    Variable data: call identifier. matches 12th UINT32 of incoming RPC data.

    offset: 10

    Variable type: UINT32

    Variable data: allocation hint - data size (bytes) minus header and tail.

    offset: 14

    Variable type: UINT16

    Variable data: 0 - presentation context identifier

    offset: 16

    Variable type: UINT8

    Variable data: 0 - cancel count

    offset: 17

    Variable type: UINT8

    Variable data: in replies: 0 - reserved; in requests: opnum - see #defines.

    offset: 18

    Variable type: ......

    Variable data: start of data (goes on for allocation_hint bytes)

    RPC_Packet for request, response, bind and bind acknowledgement

    UINT8 versionmaj

    reply same as request (0x05)

    UINT8 versionmin

    reply same as request (0x00)

    UINT8 type

    one of the MSRPC_Type enums

    UINT8 flags

    reply same as request (0x00 for Bind, 0x03 for Request)

    UINT32 representation

    reply same as request (0x00000010)

    UINT16 fraglength

    the length of the data section of the SMB trans packet

    UINT16 authlength

    UINT32 callid

    call identifier. (e.g. 0x00149594)

    * stub USE TvPacket

    the remainder of the packet depending on the "type"

    Interface identification

    the interfaces are numbered. as yet I haven't seen more than one interface used on the same pipe name srvsvc

     abstract (0x4B324FC8, 0x01D31670, 0x475A7812, 0x88E16EBF, 0x00000003)
 transfer (0x8A885D04, 0x11C91CEB, 0x0008E89F, 0x6048102B, 0x00000002)
-

    RPC_Iface RW

    UINT8 byte[16]

    16 bytes of number

    UINT32 version

    the interface number

    RPC_ReqBind RW

    the remainder of the packet after the header if "type" was Bind in the response header, "type" should be BindAck

    UINT16 maxtsize

    maximum transmission fragment size (0x1630)

    UINT16 maxrsize

    max receive fragment size (0x1630)

    UINT32 assocgid

    associated group id (0x0)

    UINT32 numelements

    the number of elements (0x1)

    UINT16 contextid

    presentation context identifier (0x0)

    UINT8 numsyntaxes

    the number of syntaxes (has always been 1?)(0x1)

    UINT8[]

    4-byte alignment padding, against SMB header

    * abstractint USE RPC_Iface

    num and vers. of interface client is using

    * transferint USE RPC_Iface

    num and vers. of interface to use for replies

    RPC_Address RW

    UINT16 length

    length of the string including null terminator

    * port USE string

    the string above in single byte, null terminated form

    RPC_ResBind RW

    the response to place after the header in the reply packet

    UINT16 maxtsize

    same as request

    UINT16 maxrsize

    same as request

    UINT32 assocgid

    zero

    * secondaddr USE RPC_Address

    the address string, as described earlier

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT8 numresults

    the number of results (0x01)

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT16 result

    result (0x00 = accept)

    UINT16 reason

    reason (0x00 = no reason specified)

    * transfersyntax USE RPC_Iface

    the transfer syntax from the request

    RPC_ReqNorm RW

    the remainder of the packet after the header for every other other request

    UINT32 allochint

    the size of the stub data in bytes

    UINT16 prescontext

    presentation context identifier (0x0)

    UINT16 opnum

    operation number (0x15)

    * stub USE TvPacket

    a packet dependent on the pipe name (probably the interface) and the op number)

    RPC_ResNorm RW

    UINT32 allochint

    # size of the stub data in bytes

    UINT16 prescontext

    # presentation context identifier (same as request)

    UINT8 cancelcount

    # cancel count? (0x0)

    UINT8 reserved

    # 0 - one byte padding

    * stub USE TvPacket

    # the remainder of the reply

    Tail

    The end of each of the NTLSA and NETLOGON named pipes ends with:

    ......

    end of data

    UINT32

    return code

    RPC Bind / Bind Ack

    +

    RPC_Iface RW

    UINT8 byte[16]

    16 bytes of number

    UINT32 version

    the interface number

    RPC_ReqBind RW

    the remainder of the packet after the header if "type" was Bind in the response header, "type" should be BindAck

    UINT16 maxtsize

    maximum transmission fragment size (0x1630)

    UINT16 maxrsize

    max receive fragment size (0x1630)

    UINT32 assocgid

    associated group id (0x0)

    UINT32 numelements

    the number of elements (0x1)

    UINT16 contextid

    presentation context identifier (0x0)

    UINT8 numsyntaxes

    the number of syntaxes (has always been 1?)(0x1)

    UINT8[]

    4-byte alignment padding, against SMB header

    * abstractint USE RPC_Iface

    num and vers. of interface client is using

    * transferint USE RPC_Iface

    num and vers. of interface to use for replies

    RPC_Address RW

    UINT16 length

    length of the string including null terminator

    * port USE string

    the string above in single byte, null terminated form

    RPC_ResBind RW

    the response to place after the header in the reply packet

    UINT16 maxtsize

    same as request

    UINT16 maxrsize

    same as request

    UINT32 assocgid

    zero

    * secondaddr USE RPC_Address

    the address string, as described earlier

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT8 numresults

    the number of results (0x01)

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT16 result

    result (0x00 = accept)

    UINT16 reason

    reason (0x00 = no reason specified)

    * transfersyntax USE RPC_Iface

    the transfer syntax from the request

    RPC_ReqNorm RW

    the remainder of the packet after the header for every other other request

    UINT32 allochint

    the size of the stub data in bytes

    UINT16 prescontext

    presentation context identifier (0x0)

    UINT16 opnum

    operation number (0x15)

    * stub USE TvPacket

    a packet dependent on the pipe name (probably the interface) and the op number)

    RPC_ResNorm RW

    UINT32 allochint

    # size of the stub data in bytes

    UINT16 prescontext

    # presentation context identifier (same as request)

    UINT8 cancelcount

    # cancel count? (0x0)

    UINT8 reserved

    # 0 - one byte padding

    * stub USE TvPacket

    # the remainder of the reply

    Tail

    The end of each of the NTLSA and NETLOGON named pipes ends with:

    ......

    end of data

    UINT32

    return code

    RPC Bind / Bind Ack

    RPC Binds are the process of associating an RPC pipe (e.g \PIPE\lsarpc) -with a "transfer syntax" (see RPC_Iface structure). The purpose for doing +with a "transfer syntax" (see RPC_Iface structure). The purpose for doing this is unknown.

    Note: The RPC_ResBind SMB Transact request is sent with two uint16 setup parameters. The first is 0x0026; the second is the file handle returned by the SMBopenX Transact response.

    Note: The RPC_ResBind members maxtsize, maxrsize and assocgid are the same in the response as the same members in the RPC_ReqBind. The RPC_ResBind member transfersyntax is the same in the response as the

    Note: The RPC_ResBind response member secondaddr contains the name of what is presumed to be the service behind the RPC pipe. The - mapping identified so far is:

    initial SMBopenX request:

    RPC_ResBind response:

    "\\PIPE\\srvsvc"

    "\\PIPE\\ntsvcs"

    "\\PIPE\\samr"

    "\\PIPE\\lsass"

    "\\PIPE\\lsarpc"

    "\\PIPE\\lsass"

    "\\PIPE\\wkssvc"

    "\\PIPE\\wksvcs"

    "\\PIPE\\NETLOGON"

    "\\PIPE\\NETLOGON"

    Note: The RPC_Packet fraglength member in both the Bind Request and Bind Acknowledgment must contain the length of the entire RPC data, including the RPC_Packet header.

    Request:

    RPC_Packet
    RPC_ReqBind

    Response:

    RPC_Packet
    RPC_ResBind

    NTLSA Transact Named Pipe

    The sequence of actions taken on this pipe are:

    Establish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    Open an RPC Pipe with the name "\\PIPE\\lsarpc". Store the file handle.
    Using the file handle, send a Set Named Pipe Handle state to 0x4300.
    Send an LSA Open Policy request. Store the Policy Handle.
    Using the Policy Handle, send LSA Query Info Policy requests, etc.
    Using the Policy Handle, send an LSA Close.
    Close the IPC$ share.

    Defines for this pipe, identifying the query are:

    LSA Open Policy:

    0x2c

    LSA Query Info Policy:

    0x07

    LSA Enumerate Trusted Domains:

    0x0d

    LSA Open Secret:

    0xff

    LSA Lookup SIDs:

    0xfe

    LSA Lookup Names:

    0xfd

    LSA Close:

    0x00

    LSA Open Policy

    Note: The policy handle can be anything you like.

    Request

    VOID*

    buffer pointer

    UNISTR2

    server name - unicode string starting with two '\'s

    OBJ_ATTR

    object attributes

    UINT32

    1 - desired access

    Response

    POL_HND

    LSA policy handle

    return

    0 - indicates success

    LSA Query Info Policy

    Note: The info class in response must be the same as that in the request.

    Request

    POL_HND

    LSA policy handle

    UINT16

    info class (also a policy handle?)

    Response

    VOID*

    undocumented buffer pointer

    UINT16

    info class (same as info class in request).

    +	mapping identified so far is:
    initial SMBopenX request:
    RPC_ResBind response:
    "\\PIPE\\srvsvc"
    "\\PIPE\\ntsvcs"
    "\\PIPE\\samr"
    "\\PIPE\\lsass"
    "\\PIPE\\lsarpc"
    "\\PIPE\\lsass"
    "\\PIPE\\wkssvc"
    "\\PIPE\\wksvcs"
    "\\PIPE\\NETLOGON"
    "\\PIPE\\NETLOGON"
    Note:	The RPC_Packet fraglength member in both the Bind Request and Bind Acknowledgment must contain the length of the entire RPC data, including the RPC_Packet header.
    Request:
    RPC_Packet
    RPC_ReqBind
    Response:
    RPC_Packet
    RPC_ResBind

    NTLSA Transact Named Pipe

    The sequence of actions taken on this pipe are:

    Establish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    Open an RPC Pipe with the name "\\PIPE\\lsarpc". Store the file handle.
    Using the file handle, send a Set Named Pipe Handle state to 0x4300.
    Send an LSA Open Policy request. Store the Policy Handle.
    Using the Policy Handle, send LSA Query Info Policy requests, etc.
    Using the Policy Handle, send an LSA Close.
    Close the IPC$ share.

    Defines for this pipe, identifying the query are:

    LSA Open Policy:

    0x2c

    LSA Query Info Policy:

    0x07

    LSA Enumerate Trusted Domains:

    0x0d

    LSA Open Secret:

    0xff

    LSA Lookup SIDs:

    0xfe

    LSA Lookup Names:

    0xfd

    LSA Close:

    0x00

    LSA Open Policy

    Note: The policy handle can be anything you like.

    Request

    VOID*

    buffer pointer

    UNISTR2

    server name - unicode string starting with two '\'s

    OBJ_ATTR

    object attributes

    UINT32

    1 - desired access

    Response

    POL_HND

    LSA policy handle

    return

    0 - indicates success

    LSA Query Info Policy

    Note: The info class in response must be the same as that in the request.

    Request

    POL_HND

    LSA policy handle

    UINT16

    info class (also a policy handle?)

    Response

    VOID*

    undocumented buffer pointer

    UINT16

    info class (same as info class in request).

     switch (info class)
 case 3:
 case 5:
@@ -1292,11 +1289,11 @@ DOM_INFO domain info, levels 3 and 5 (are the same).
 }
 
 return    0 - indicates success
-

    LSA Enumerate Trusted Domains

    Request

    no extra data

    Response

    UINT32

    0 - enumeration context

    UINT32

    0 - entries read

    UINT32

    0 - trust information

    return

    0x8000 001a - "no trusted domains" success code

    LSA Open Secret

    Request

    no extra data

    Response

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    return 0x0C00 0034 - "no such secret" success code

    LSA Close

    Request

    POL_HND

    policy handle to be closed

    Response

    POL_HND

    0s - closed policy handle (all zeros)

    return 0 - indicates success

    LSA Lookup SIDS

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    VOID*[num_entries] undocumented domain SID pointers to be looked up. -

    DOM_SID[num_entries] domain SIDs to be looked up.

    char[16]

    completely undocumented 16 bytes.

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_SID2[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    LSA Lookup Names

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    NAME[num_entries]

    names to be looked up.

    char[]

    undocumented bytes - falsely translated SID structure?

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_RID[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    NETLOGON rpc Transact Named Pipe

    The sequence of actions taken on this pipe are:

    tablish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    en an RPC Pipe with the name "\\PIPE\\NETLOGON". Store the file handle.
    ing the file handle, send a Set Named Pipe Handle state to 0x4300.
    eate Client Challenge. Send LSA Request Challenge. Store Server Challenge.
    lculate Session Key. Send an LSA Auth 2 Challenge. Store Auth2 Challenge.
    lc/Verify Client Creds. Send LSA Srv PW Set. Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logon . Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logoff. Calc/Verify Server Creds.
    ose the IPC$ share.

    Defines for this pipe, identifying the query are

    LSA Request Challenge:

    0x04

    LSA Server Password Set:

    0x06

    LSA SAM Logon:

    0x02

    LSA SAM Logoff:

    0x03

    LSA Auth 2:

    0x0f

    LSA Logon Control:

    0x0e

    LSA Request Challenge

    Note: logon server name starts with two '\' characters and is upper case.

    Note: logon client is the machine, not the user.

    Note: the initial LanManager password hash, against which the challenge is issued, is the machine name itself (lower case). there will becalls issued (LSA Server Password Set) which will change this, later. refusing these calls allows you to always deal with the same password (i.e the LM# of the machine name in lower case).

    Request

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    logon client unicode string

    char[8]

    client challenge

    Response

    char[8]

    server challenge

    return 0 - indicates success

    LSA Authenticate 2

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: neg_flags in the response is the same as that in the request.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    LOG_INFO

    client identification info

    char[8]

    client-calculated credentials

    UINT8[]

    padding to 4-byte align with start of SMB header.

    UINT32

    neg_flags - negotiated flags (usual value is 0x0000 01ff)

    Response

    char[8]

    server credentials.

    UINT32

    neg_flags - same as neg_flags in request.

    return 0 - indicates success. failure value unknown.

    LSA Server Password Set

    Note: the new password is suspected to be a DES encryption using the old password to generate the key.

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: the server credentials are constructed from the client-calculated credentials and the client time + 1 second.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    CLNT_INFO

    client identification/authentication info

    char[]

    new password - undocumented.

    Response

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success; 0xC000 006a indicates failure

    LSA SAM Logon

    +

    LSA Enumerate Trusted Domains

    Request

    no extra data

    Response

    UINT32

    0 - enumeration context

    UINT32

    0 - entries read

    UINT32

    0 - trust information

    return

    0x8000 001a - "no trusted domains" success code

    LSA Open Secret

    Request

    no extra data

    Response

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    return 0x0C00 0034 - "no such secret" success code

    LSA Close

    Request

    POL_HND

    policy handle to be closed

    Response

    POL_HND

    0s - closed policy handle (all zeros)

    return 0 - indicates success

    LSA Lookup SIDS

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    VOID*[num_entries] undocumented domain SID pointers to be looked up. +

    DOM_SID[num_entries] domain SIDs to be looked up.

    char[16]

    completely undocumented 16 bytes.

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_SID2[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    LSA Lookup Names

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    NAME[num_entries]

    names to be looked up.

    char[]

    undocumented bytes - falsely translated SID structure?

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_RID[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    NETLOGON rpc Transact Named Pipe

    The sequence of actions taken on this pipe are:

    tablish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    en an RPC Pipe with the name "\\PIPE\\NETLOGON". Store the file handle.
    ing the file handle, send a Set Named Pipe Handle state to 0x4300.
    eate Client Challenge. Send LSA Request Challenge. Store Server Challenge.
    lculate Session Key. Send an LSA Auth 2 Challenge. Store Auth2 Challenge.
    lc/Verify Client Creds. Send LSA Srv PW Set. Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logon . Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logoff. Calc/Verify Server Creds.
    ose the IPC$ share.

    Defines for this pipe, identifying the query are

    LSA Request Challenge:

    0x04

    LSA Server Password Set:

    0x06

    LSA SAM Logon:

    0x02

    LSA SAM Logoff:

    0x03

    LSA Auth 2:

    0x0f

    LSA Logon Control:

    0x0e

    LSA Request Challenge

    Note: logon server name starts with two '\' characters and is upper case.

    Note: logon client is the machine, not the user.

    Note: the initial LanManager password hash, against which the challenge is issued, is the machine name itself (lower case). there will becalls issued (LSA Server Password Set) which will change this, later. refusing these calls allows you to always deal with the same password (i.e the LM# of the machine name in lower case).

    Request

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    logon client unicode string

    char[8]

    client challenge

    Response

    char[8]

    server challenge

    return 0 - indicates success

    LSA Authenticate 2

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: neg_flags in the response is the same as that in the request.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    LOG_INFO

    client identification info

    char[8]

    client-calculated credentials

    UINT8[]

    padding to 4-byte align with start of SMB header.

    UINT32

    neg_flags - negotiated flags (usual value is 0x0000 01ff)

    Response

    char[8]

    server credentials.

    UINT32

    neg_flags - same as neg_flags in request.

    return 0 - indicates success. failure value unknown.

    LSA Server Password Set

    Note: the new password is suspected to be a DES encryption using the old password to generate the key.

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: the server credentials are constructed from the client-calculated credentials and the client time + 1 second.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    CLNT_INFO

    client identification/authentication info

    char[]

    new password - undocumented.

    Response

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success; 0xC000 006a indicates failure

    LSA SAM Logon

    Note: valid_user is True iff the username and password hash are valid for the requested domain. -

    Request

    SAM_INFO

    sam_id structure

    Response

    VOID*

    undocumented buffer pointer

    CREDS

    server credentials. server time stamp appears to be ignored.

    +
    Request
    SAM_INFO
    sam_id structure
    Response
    VOID*
    undocumented buffer pointer
    CREDS
    server credentials.  server time stamp appears to be ignored.
     if (valid_user)
 {
 	UINT16      3 - switch value indicating USER_INFO structure.
@@ -1316,16 +1313,16 @@ else
 
     return    0xC000 0064 - NT_STATUS_NO_SUCH_USER.
 }
-

    LSA SAM Logoff

    +

    LSA SAM Logoff

    Note: presumably, the SAM_INFO structure is validated, and a (currently undocumented) error code returned if the Logoff is invalid. -

    Request

    SAM_INFO

    sam_id structure

    Response

    VOID*

    undocumented buffer pointer

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success. undocumented failure indication.

    \\MAILSLOT\NET\NTLOGON

    +

    Request

    SAM_INFO

    sam_id structure

    Response

    VOID*

    undocumented buffer pointer

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success. undocumented failure indication.

    \\MAILSLOT\NET\NTLOGON

    Note: mailslots will contain a response mailslot, to which the response should be sent. the target NetBIOS name is REQUEST_NAME<20>, where REQUEST_NAME is the name of the machine that sent the request. -

    Query for PDC

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Request

    UINT16

    0x0007 - Query for PDC

    STR

    machine name

    STR

    response mailslot

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x000A - Respose to Query for PDC

    STR

    machine name (in uppercase)

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UNISTR

    domain name

    UINT32

    NTversion (same as received in request)

    UINT16

    LMNTtoken (same as received in request)

    UINT16

    LM20token (same as received in request)

    SAM Logon

    Note: machine name in response is preceded by two '\' characters.

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Note: user name in the response is presumably the same as that in the request.

    Request

    UINT16

    0x0012 - SAM Logon

    UINT16

    request count

    UNISTR

    machine name

    UNISTR

    user name

    STR

    response mailslot

    UINT32

    alloweable account

    UINT32

    domain SID size

    char[sid_size]

    domain SID, of sid_size bytes.

    UINT8[]

    ???? padding to 4? 2? -byte align with start of mailslot.

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x0013 - Response to SAM Logon

    UNISTR

    machine name

    UNISTR

    user name - workstation trust account

    UNISTR

    domain name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    SRVSVC Transact Named Pipe

    Defines for this pipe, identifying the query are:

    Net Share Enum

    0x0f

    Net Server Get Info

    0x15

    Net Share Enum

    Note: share level and switch value in the response are presumably the same as those in the request.

    Note: cifsrap2.txt (section 5) may be of limited assistance here.

    Request

    VOID*

    pointer (to server name?)

    UNISTR2

    server name

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info with 0 entries

    UINT32

    preferred maximum length (0xffff ffff)

    Response

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info (only added if share info ptr is non-zero)

    return 0 - indicates success

    Net Server Get Info

    Note: level is the same value as in the request.

    Request

    UNISTR2

    server name

    UINT32

    switch level

    Response

    UINT32

    switch level

    VOID*

    pointer to SERVER_INFO_101

    SERVER_INFO_101

    server info (only added if server info ptr is non-zero)

    return 0 - indicates success

    Cryptographic side of NT Domain Authentication

    Definitions

    Add(A1,A2)

    Intel byte ordered addition of corresponding 4 byte words in arrays A1 and A2

    E(K,D)

    DES ECB encryption of 8 byte data D using 7 byte key K

    lmowf()

    Lan man hash

    ntowf()

    NT hash

    PW

    md4(machine_password) == md4(lsadump $machine.acc) == +

    Query for PDC

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Request

    UINT16

    0x0007 - Query for PDC

    STR

    machine name

    STR

    response mailslot

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x000A - Respose to Query for PDC

    STR

    machine name (in uppercase)

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UNISTR

    domain name

    UINT32

    NTversion (same as received in request)

    UINT16

    LMNTtoken (same as received in request)

    UINT16

    LM20token (same as received in request)

    SAM Logon

    Note: machine name in response is preceded by two '\' characters.

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Note: user name in the response is presumably the same as that in the request.

    Request

    UINT16

    0x0012 - SAM Logon

    UINT16

    request count

    UNISTR

    machine name

    UNISTR

    user name

    STR

    response mailslot

    UINT32

    alloweable account

    UINT32

    domain SID size

    char[sid_size]

    domain SID, of sid_size bytes.

    UINT8[]

    ???? padding to 4? 2? -byte align with start of mailslot.

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x0013 - Response to SAM Logon

    UNISTR

    machine name

    UNISTR

    user name - workstation trust account

    UNISTR

    domain name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    SRVSVC Transact Named Pipe

    Defines for this pipe, identifying the query are:

    Net Share Enum

    0x0f

    Net Server Get Info

    0x15

    Net Share Enum

    Note: share level and switch value in the response are presumably the same as those in the request.

    Note: cifsrap2.txt (section 5) may be of limited assistance here.

    Request

    VOID*

    pointer (to server name?)

    UNISTR2

    server name

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info with 0 entries

    UINT32

    preferred maximum length (0xffff ffff)

    Response

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info (only added if share info ptr is non-zero)

    return 0 - indicates success

    Net Server Get Info

    Note: level is the same value as in the request.

    Request

    UNISTR2

    server name

    UINT32

    switch level

    Response

    UINT32

    switch level

    VOID*

    pointer to SERVER_INFO_101

    SERVER_INFO_101

    server info (only added if server info ptr is non-zero)

    return 0 - indicates success

    Cryptographic side of NT Domain Authentication

    Definitions

    Add(A1,A2)

    Intel byte ordered addition of corresponding 4 byte words in arrays A1 and A2

    E(K,D)

    DES ECB encryption of 8 byte data D using 7 byte key K

    lmowf()

    Lan man hash

    ntowf()

    NT hash

    PW

    md4(machine_password) == md4(lsadump $machine.acc) == pwdump(machine$) (initially) == md4(lmowf(unicode(machine))) -

    ARC4(K,Lk,D,Ld)

    ARC4 encryption of data D of length Ld with key K of length Lk

    v[m..n(,l)]

    subset of v from bytes m to n, optionally padded with zeroes to length l

    Cred(K,D)

    E(K[7..7,7],E(K[0..6],D)) computes a credential

    Time()

    4 byte current time

    Cc,Cs

    8 byte client and server challenges Rc,Rs: 8 byte client and server credentials

    Protocol

    +
    ARC4(K,Lk,D,Ld)
    ARC4 encryption of data D of length Ld with key K of length Lk
    v[m..n(,l)]
    subset of v from bytes m to n, optionally padded with zeroes to length l
    Cred(K,D)
    E(K[7..7,7],E(K[0..6],D)) computes a credential
    Time()
    4 byte current time
    Cc,Cs
    8 byte client and server challenges Rc,Rs: 8 byte client and server credentials

    Protocol

     C->S ReqChal,Cc
 S->C Cs
 
    @@ -1361,7 +1358,7 @@ S: Ts = Time()
 S->C Cred(Ks,Cred(Ks,Rc+Tc+1)),userinfo(logon script,UID,SIDs,etc)
 C: assert(Rs == Cred(Ks,Cred(Rc+Tc+1))
 C: Rc = Cred(Ks,Rc+Tc+1)
-

    Comments

    +

    Comments

    On first joining the domain the session key could be computed by anyone listening in on the network as the machine password has a well known value. Until the machine is rebooted it will use this session @@ -1382,30 +1379,30 @@ returned by the server. The password OWFs should NOT be sent over the network reversibly encrypted. They should be sent using ARC4(Ks,md4(owf)) with the server computing the same function using the owf values in the SAM. -

    SIDs and RIDs

    +

    SIDs and RIDs

    SIDs and RIDs are well documented elsewhere.

    A SID is an NT Security ID (see DOM_SID structure). They are of the form:

    revision-NN-SubAuth1-SubAuth2-SubAuth3...
    revision-0xNNNNNNNNNNNN-SubAuth1-SubAuth2-SubAuth3...

    currently, the SID revision is 1. The Sub-Authorities are known as Relative IDs (RIDs). -

    Well-known SIDs

    Universal well-known SIDs

    Null SID

    S-1-0-0

    World

    S-1-1-0

    Local

    S-1-2-0

    Creator Owner ID

    S-1-3-0

    Creator Group ID

    S-1-3-1

    Creator Owner Server ID

    S-1-3-2

    Creator Group Server ID

    S-1-3-3

    (Non-unique IDs)

    S-1-4

    NT well-known SIDs

    NT Authority

    S-1-5

    Dialup

    S-1-5-1

    Network

    S-1-5-2

    Batch

    S-1-5-3

    Interactive

    S-1-5-4

    Service

    S-1-5-6

    AnonymousLogon(aka null logon session)

    S-1-5-7

    Proxy

    S-1-5-8

    ServerLogon(aka domain controller account)

    S-1-5-8

    (Logon IDs)

    S-1-5-5-X-Y

    (NT non-unique IDs)

    S-1-5-0x15-...

    (Built-in domain)

    s-1-5-0x20

    Well-known RIDS

    +

    Well-known SIDs

    Universal well-known SIDs

    Null SID

    S-1-0-0

    World

    S-1-1-0

    Local

    S-1-2-0

    Creator Owner ID

    S-1-3-0

    Creator Group ID

    S-1-3-1

    Creator Owner Server ID

    S-1-3-2

    Creator Group Server ID

    S-1-3-3

    (Non-unique IDs)

    S-1-4

    NT well-known SIDs

    NT Authority

    S-1-5

    Dialup

    S-1-5-1

    Network

    S-1-5-2

    Batch

    S-1-5-3

    Interactive

    S-1-5-4

    Service

    S-1-5-6

    AnonymousLogon(aka null logon session)

    S-1-5-7

    Proxy

    S-1-5-8

    ServerLogon(aka domain controller account)

    S-1-5-8

    (Logon IDs)

    S-1-5-5-X-Y

    (NT non-unique IDs)

    S-1-5-0x15-...

    (Built-in domain)

    s-1-5-0x20

    Well-known RIDS

    A RID is a sub-authority value, as part of either a SID, or in the case of Group RIDs, part of the DOM_GID structure, in the USER_INFO_1 structure, in the LSA SAM Logon response. -

    Well-known RID users

    Groupname: DOMAIN_USER_RID_ADMIN

    ????: 0x0000

    RID: 01F4

    Groupname: DOMAIN_USER_RID_GUEST

    ????: 0x0000

    RID: 01F5

    Well-known RID groups

    Groupname: DOMAIN_GROUP_RID_ADMINS

    ????: 0x0000

    RID: 0200

    Groupname: DOMAIN_GROUP_RID_USERS

    ????: 0x0000

    RID: 0201

    Groupname: DOMAIN_GROUP_RID_GUESTS

    ????: 0x0000

    RID: 0202

    Well-known RID aliases

    Groupname: DOMAIN_ALIAS_RID_ADMINS

    ????: 0x0000

    RID: 0220

    Groupname: DOMAIN_ALIAS_RID_USERS

    ????: 0x0000

    RID: 0221

    Groupname: DOMAIN_ALIAS_RID_GUESTS

    ????: 0x0000

    RID: 0222

    Groupname: DOMAIN_ALIAS_RID_POWER_USERS

    ????: 0x0000

    RID: 0223

    Groupname: DOMAIN_ALIAS_RID_ACCOUNT_OPS

    ????: 0x0000

    RID: 0224

    Groupname: DOMAIN_ALIAS_RID_SYSTEM_OPS

    ????: 0x0000

    RID: 0225

    Groupname: DOMAIN_ALIAS_RID_PRINT_OPS

    ????: 0x0000

    RID: 0226

    Groupname: DOMAIN_ALIAS_RID_BACKUP_OPS

    ????: 0x0000

    RID: 0227

    Groupname: DOMAIN_ALIAS_RID_REPLICATOR

    ????: 0x0000

    RID: 0228

    Chapter 11. Samba Printing Internals

    Gerald Carter

    October 2002

    Table of Contents

    Abstract
    +

    Well-known RID users

    Groupname: DOMAIN_USER_RID_ADMIN

    ????: 0x0000

    RID: 01F4

    Groupname: DOMAIN_USER_RID_GUEST

    ????: 0x0000

    RID: 01F5

    Well-known RID groups

    Groupname: DOMAIN_GROUP_RID_ADMINS

    ????: 0x0000

    RID: 0200

    Groupname: DOMAIN_GROUP_RID_USERS

    ????: 0x0000

    RID: 0201

    Groupname: DOMAIN_GROUP_RID_GUESTS

    ????: 0x0000

    RID: 0202

    Well-known RID aliases

    Groupname: DOMAIN_ALIAS_RID_ADMINS

    ????: 0x0000

    RID: 0220

    Groupname: DOMAIN_ALIAS_RID_USERS

    ????: 0x0000

    RID: 0221

    Groupname: DOMAIN_ALIAS_RID_GUESTS

    ????: 0x0000

    RID: 0222

    Groupname: DOMAIN_ALIAS_RID_POWER_USERS

    ????: 0x0000

    RID: 0223

    Groupname: DOMAIN_ALIAS_RID_ACCOUNT_OPS

    ????: 0x0000

    RID: 0224

    Groupname: DOMAIN_ALIAS_RID_SYSTEM_OPS

    ????: 0x0000

    RID: 0225

    Groupname: DOMAIN_ALIAS_RID_PRINT_OPS

    ????: 0x0000

    RID: 0226

    Groupname: DOMAIN_ALIAS_RID_BACKUP_OPS

    ????: 0x0000

    RID: 0227

    Groupname: DOMAIN_ALIAS_RID_REPLICATOR

    ????: 0x0000

    RID: 0228

    Chapter 11. Samba Printing Internals

    Gerald Carter

    October 2002

    Table of Contents

    Abstract
    Printing Interface to Various Back ends -
    +
    Print Queue TDB's -
    +
    ChangeID and Client Caching of Printer Information -
    +
    Windows NT/2K Printer Change Notify -

    Abstract

    +

    Abstract

    The purpose of this document is to provide some insight into Samba's printing functionality and also to describe the semantics of certain features of Windows client printing. -

    +

    Printing Interface to Various Back ends

    Samba uses a table of function pointers to seven functions. The @@ -1416,10 +1413,10 @@ Currently there are only two printing back end implementations defined.

    • a generic set of functions for working with standard UNIX printing subsystems

    • a set of CUPS specific functions (this is only enabled if - the CUPS libraries were located at compile time).

    + the CUPS libraries were located at compile time).

    Print Queue TDB's

    -Samba provides periodic caching of the output from the "lpq command" +Samba provides periodic caching of the output from the "lpq command" for performance reasons. This cache time is configurable in seconds. Obviously the longer the cache time the less often smbd will be required to exec a copy of lpq. However, the accuracy of the print @@ -1439,7 +1436,7 @@ There are two ways in which a a print job can be entered into a print queue's TDB. The first is to submit the job from a Windows client which will insert the job information directly into the TDB. The second method is to have the print job picked up by executing the -"lpq command". +"lpq command". 

     /* included from printing.h */
 struct printjob {
@@ -1460,9 +1457,9 @@ struct printjob {
 };

    The current manifestation of the printjob structure contains a field -for the UNIX job id returned from the "lpq command" and a Windows job +for the UNIX job id returned from the "lpq command" and a Windows job ID (32-bit bounded by PRINT_MAX_JOBID). When a print job is returned -by the "lpq command" that does not match an existing job in the queue's +by the "lpq command" that does not match an existing job in the queue's TDB, a 32-bit job ID above the <*vance doesn't know what word is missing here*> is generating by adding UNIX_JOB_START to the id reported by lpq.

    @@ -1477,7 +1474,7 @@ steps ( refer to print.c:print_queue_update() ): stored in LOCK/printer_name. If so, then do not update the TDB.

  • Lock the mutex entry in the TDB and store our own pid. Check that this succeeded, else fail.

  • Store the updated time stamp for the new cache - listing

  • Retrieve the queue listing via "lpq command"

  • +	listing

  • Retrieve the queue listing via "lpq command"

  •  	foreach job in the queue
      	{
 		if the job is a UNIX job, create a new entry;
@@ -1492,7 +1489,7 @@ steps ( refer to print.c:print_queue_update() ):
 	}

  • Delete any jobs in the TDB that are not in the in the lpq listing

  • Store the print queue status in the TDB

  • update the cache time stamp again

    • Note that it is the contents of this TDB that is returned to Windows -clients and not the actual listing from the "lpq command". +clients and not the actual listing from the "lpq command".

    The NT_DEVICEMODE stored as part of the printjob structure is used to store a pointer to a non-default DeviceMode associated with the print @@ -1505,11 +1502,11 @@ and the job has the printer's device mode associated with it by default. Only non-default Device Mode are stored with print jobs in the print queue TDB. Otherwise, the Device Mode is obtained from the printer object when the client issues a GetJob(level == 2) request. -

    +

    ChangeID and Client Caching of Printer Information

    [To be filled in later] -

    +

    Windows NT/2K Printer Change Notify

    When working with Windows NT+ clients, it is possible for a @@ -1607,13 +1604,13 @@ handle for notification. Samba currently uses the snum of the printer for this which can break if the list of services has been modified since the notification handle was registered.

  • The size is either (a) the string length in UNICODE for strings, (b) the size in bytes of the security descriptor, or (c) 0 for -data values.

    • Chapter 12. Samba WINS Internals

    Gerald Carter

    October 2002

    Table of Contents

    WINS Failover

    WINS Failover

    +data values.

    Chapter 12. Samba WINS Internals

    Gerald Carter

    October 2002

    Table of Contents

    WINS Failover

    WINS Failover

    The current Samba codebase possesses the capability to use groups of WINS servers that share a common namespace for NetBIOS name registration and resolution. The formal parameter syntax is 

     	WINS_SERVER_PARAM 	= SERVER [ SEPARATOR SERVER_LIST ]
-	WINS_SERVER_PARAM 	= "wins server"
+	WINS_SERVER_PARAM 	= "wins server"
 	SERVER 			= ADDR[:TAG]
 	ADDR 			= ip_addr | fqdn
 	TAG 			= string
@@ -1626,7 +1623,7 @@ A simple example of a valid wins server setting is
 	wins server = 192.168.1.2 192.168.1.3

    In the event that no TAG is defined in for a SERVER in the list, smbd assigns a default -TAG of "*". A TAG is used to group servers of a shared NetBIOS namespace together. Upon +TAG of "*". A TAG is used to group servers of a shared NetBIOS namespace together. Upon startup, nmbd will attempt to register the netbios name value with one server in each tagged group.

    @@ -1637,7 +1634,7 @@ interface names in the tags is only by convention and is not a technical require wins server = 192.168.1.2:eth0 192.168.1.3:eth0 192.168.2.2:eth1

    Using this configuration, nmbd would attempt to register the server's NetBIOS name -with one WINS server in each group. Because the "eth0" group has two servers, the +with one WINS server in each group. Because the "eth0" group has two servers, the second server would only be used when a registration (or resolution) request to the first server in that group timed out.

    @@ -1649,7 +1646,7 @@ If a timeout occurs when querying a specific WINS server, that server is marked prevent further timeouts and the next server in the WINS group is contacted. Once marked as dead, Samba will not attempt to contact that server for name registration/resolution queries for a period of 10 minutes. -

    Chapter 13. The Upcoming SAM System

    Andrew Bartlett

    1 October 2002

    Table of Contents

    Security in the 'new SAM'
    Standalone from UNIX
    Handles and Races in the new SAM
    Layers
    Application
    SAM Interface
    SAM Modules
    SAM Modules
    Special Module: sam_passdb
    sam_ads
    Memory Management
    Testing

    Security in the 'new SAM'

    One of the biggest problems with passdb is it's implementation of +

    Chapter 13. The Upcoming SAM System

    Andrew Bartlett

    1 October 2002

    Table of Contents

    Security in the 'new SAM'
    Standalone from UNIX
    Handles and Races in the new SAM
    Layers
    Application
    SAM Interface
    SAM Modules
    SAM Modules
    Special Module: sam_passdb
    sam_ads
    Memory Management
    Testing

    Security in the 'new SAM'

    One of the biggest problems with passdb is it's implementation of 'security'. Access control is on a 'are you root at the moment' basis, and it has no concept of NT ACLs. Things like ldapsam had to add 'magic' 'are you root' checks.

    We took this very seriously when we started work, and the new structure @@ -1709,7 +1706,7 @@ actual data store (like the LDAP server).

    Finally, we have generic get_sec_desc() and set_sec_desc() routines to allow external ACL manipulation. These do lookups based on SID. -

    Standalone from UNIX

    +

    Standalone from UNIX

    One of the primary tenants of the 'new SAM' is that it would not attempt to deal with 'what unix id for that'. This would be left to the 'SMS' (Sid Mapping System') or SID farm, and probably administered via @@ -1719,7 +1716,7 @@ Accounts not preexisting in unix would be served up via winbind.

    This is an *optional* part, and my preferred end-game. We have a fare way to go before things like winbind up to it however. -

    Handles and Races in the new SAM

    +

    Handles and Races in the new SAM

    One of the things that the 'new SAM' work has tried to face is both compatibility with existing code, and a closer alignment to the SAMR interface. I consider SAMR to be a 'primary customer' to the this work, @@ -1744,11 +1741,11 @@ have *really* changed. 'conflicting' updates: Currently we don't deal with this (in passdb or the new sam stuff), but the design is sufficiently flexible to 'deny' a second update. I don't foresee locking records however. -

    Layers

    Application

    +

    Layers

    Application

    This is where smbd, samtest and whatever end-user replacement we have for pdbedit sits. They use only the SAM interface, and do not get 'special knowledge' of what is below them. -

    SAM Interface

    +

    SAM Interface

    This level 'owns' the various handle structures, the get/set routines on those structures and provides the public interface. The application layer may initialize a 'context' to be passed to all interface routines, @@ -1759,7 +1756,7 @@ abstraction to the modules below, and arrange for their initial loading.

    We could possibly add ACL checking at this layer, to avoid discrepancies in implementation modules. -

    SAM Modules

    +

    SAM Modules

    These do not communicate with the application directly, only by setting values in the handles, and receiving requests from the interface. These modules are responsible for translating values from the handle's @@ -1767,13 +1764,13 @@ modules are responsible for translating values from the handle's to 'know' things like it's own domain SID, domain name, and any other state attached to the SAM. Simpler modules may call back to some helper routine. -

    SAM Modules

    Special Module: sam_passdb

    +

    SAM Modules

    Special Module: sam_passdb

    In order for there to be a smooth transition, kai is writing a module that reads existing passdb backends, and translates them into SAM replies. (Also pulling data from the account policy DB etc). We also intend to write a module that does the reverse - gives the SAM a passdb interface. -

    sam_ads

    +

    sam_ads

    This is the first of the SAM modules to be committed to the tree - mainly because I needed to coordinate work with metze (who authored most of it). This module aims to use Samba's libads code to provide an @@ -1785,7 +1782,7 @@ the construction of an Samba AD DC.

    We also intend to construct a Samba 2.2/3.0 compatible ldap module, again using libads code. -

    Memory Management

    +

    Memory Management

    The 'new SAM' development effort also concerned itself with getting a sane implementation of memory management. It was decided that we would be (as much as possible) talloc based, using an 'internal talloc @@ -1814,7 +1811,7 @@ NT_USER_TOKEN *access_token, uint32 access_desired, const DOM_SID NTSTATUS sam_enum_accounts(const SAM_CONTEXT *context, const NT_USER_TOKEN *access_token, const DOM_SID *domainsid, uint16 acct_ctrl, int32 *account_count, SAM_ACCOUNT_ENUM **accounts) -

    Testing

    +

    Testing

    Testing is vital in any piece of software, and Samba is certainly no exception. In designing this new subsystem, we have taken care to ensure it is easily tested, independent of outside protocols. @@ -1843,13 +1840,13 @@ Because the 'new SAM' is NT ACL based, there will be a command to specify an arbitrary NT ACL, but for now it uses 'system' by default.

    Chapter 14. LanMan and NT Password Encryption

    Jeremy Allison

    Samba Team



    -

    19 Apr 1999

    Table of Contents

    Introduction
    How does it work?
    The smbpasswd file

    Introduction

    With the development of LanManager and Windows NT +

    19 Apr 1999

    Table of Contents

    Introduction
    How does it work?
    The smbpasswd file

    Introduction

    With the development of LanManager and Windows NT compatible password encryption for Samba, it is now able to validate user connections in exactly the same way as a LanManager or Windows NT server.

    This document describes how the SMB password encryption algorithm works and what issues there are in choosing whether you want to use it. You should read it carefully, especially - the part about security and the "PROS and CONS" section.

    How does it work?

    LanManager encryption is somewhat similar to UNIX + the part about security and the "PROS and CONS" section.

    How does it work?

    LanManager encryption is somewhat similar to UNIX password encryption. The server uses a file containing a hashed value of a user's password. This is created by taking the user's plaintext password, capitalising it, and either @@ -1857,7 +1854,7 @@ specify an arbitrary NT ACL, but for now it uses 'system' by default. This 14 byte value is used as two 56 bit DES keys to encrypt a 'magic' eight byte value, forming a 16 byte value which is stored by the server and client. Let this value be known as - the "hashed password".

    Windows NT encryption is a higher quality mechanism, + the "hashed password".

    Windows NT encryption is a higher quality mechanism, consisting of doing an MD4 hash on a Unicode version of the user's password. This also produces a 16 byte hash value that is non-reversible.

    When a client (LanManager, Windows for WorkGroups, Windows @@ -1866,11 +1863,11 @@ specify an arbitrary NT ACL, but for now it uses 'system' by default. protocol that the client and server will use. In the reply to this request the Samba server generates and appends an 8 byte, random value - this is stored in the Samba server after the reply is sent - and is known as the "challenge". The challenge is different for + and is known as the "challenge". The challenge is different for every client connection.

    The client then uses the hashed password (16 byte values described above), appended with 5 null bytes, as three 56 bit DES keys, each of which is used to encrypt the challenge 8 byte - value, forming a 24 byte value known as the "response".

    In the SMB call SMBsessionsetupX (when user level security + value, forming a 24 byte value known as the "response".

    In the SMB call SMBsessionsetupX (when user level security is selected) or the call SMBtconX (when share level security is selected), the 24 byte response is returned by the client to the Samba server. For Windows NT protocol levels the above calculation @@ -1886,7 +1883,7 @@ specify an arbitrary NT ACL, but for now it uses 'system' by default. know the correct password and is denied access.

    Note that the Samba server never knows or stores the cleartext of the user's password - just the 16 byte hashed values derived from it. Also note that the cleartext password or 16 byte hashed values - are never transmitted over the network - thus increasing security.

    The smbpasswd file

    In order for Samba to participate in the above protocol + are never transmitted over the network - thus increasing security.

    The smbpasswd file

    In order for Samba to participate in the above protocol it must be able to look up the 16 byte hashed values given a user name. Unfortunately, as the UNIX password value is also a one way hash function (ie. it is impossible to retrieve the cleartext of the user's @@ -1927,7 +1924,7 @@ username:uid:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: to 32 ascii hexadecimal digits (0-9, A-F). These are an ascii representation of the 16 byte hashed value of a user's password.

    To set a user to have no password (not recommended), edit the file using vi, and replace the first 11 characters with the ascii text - "NO PASSWORD" (minus the quotes).

    For example, to clear the password for user bob, his smbpasswd file + "NO PASSWORD" (minus the quotes).

    For example, to clear the password for user bob, his smbpasswd file entry would look like :

     bob:100:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
 	[U          ]:LCT-00000000:Bob's full name:/bobhome:/bobshell
@@ -1943,10 +1940,10 @@ bob:100:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
 	to enable this on your server.
    Note : This file should be protected very 
 	carefully. Anyone with access to this file can (with enough knowledge of 
 	the protocols) gain access to your SMB server. The file is thus more 
-	sensitive than a normal unix /etc/passwd file.

    Chapter 15. Modules

    Jelmer Vernooij

    Samba Team

    19 March 2003

    Table of Contents

    Advantages
    Loading modules
    Static modules
    Shared modules
    Writing modules
    Static/Shared selection in configure.in

    Advantages

    + sensitive than a normal unix /etc/passwd file.

    Chapter 15. Modules

    Jelmer Vernooij

    Samba Team

    19 March 2003

    Table of Contents

    Advantages
    Loading modules
    Static modules
    Shared modules
    Writing modules
    Static/Shared selection in configure.in

    Advantages

    The new modules system has the following advantages:

    Transparent loading of static and shared modules (no need -for a subsystem to know about modules)
    Simple selection between shared and static modules at configure time
    "preload modules" option for increasing performance for stable modules
    No nasty #define stuff anymore
    All backends are available as plugin now (including pdb_ldap and pdb_tdb)

    Loading modules

    +for a subsystem to know about modules)Simple selection between shared and static modules at configure time"preload modules" option for increasing performance for stable modulesNo nasty #define stuff anymoreAll backends are available as plugin now (including pdb_ldap and pdb_tdb)

    Loading modules

    Some subsystems in samba use different backends. These backends can be either statically linked in to samba or available as a plugin. A subsystem should have a function that allows a module to register itself. For example, @@ -1956,7 +1953,7 @@ NTSTATUS smb_register_passdb(int version, const char *name, pdb_init_function in

    This function will be called by the initialisation function of the module to register itself. -

    Static modules

    +

    Static modules

    The modules system compiles a list of initialisation functions for the static modules of each subsystem. This is a define. For example, it is here currently (from include/config.h): @@ -1966,7 +1963,7 @@ it is here currently (from include/config.h):

    These functions should be called before the subsystem is used. That should be done when the subsystem is initialised or first used. -

    Shared modules

    +

    Shared modules

    If a subsystem needs a certain backend, it should check if it has already been registered. If the backend hasn't been registered already, the subsystem should call smb_probe_module(char *subsystem, char *backend). @@ -1976,7 +1973,7 @@ is a slash, smb_probe_module() tries to load the module from the absolute path specified in 'backend'.

    After smb_probe_module() has been executed, the subsystem should check again if the module has been registered. -

    Writing modules

    +

    Writing modules

    Each module has an initialisation function. For modules that are included with samba this name is 'subsystem_backend_init'. For external modules (that will never be built-in, but only available as a module) this name is always 'init_module'. (In the case of modules included with samba, the configure system will add a #define subsystem_backend_init() init_module()). The prototype for these functions is: @@ -1987,11 +1984,11 @@ registration functions. The function should return NT_STATUS_OK on success and NT_STATUS_UNSUCCESSFUL or a more useful nt error code on failure.

    For example, pdb_ldap_init() contains: 

     NTSTATUS pdb_ldap_init(void)
 {
-smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam);
-smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_nua", pdb_init_ldapsam_nua);
+smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam);
+smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_nua", pdb_init_ldapsam_nua);
 	return NT_STATUS_OK;
 }
-

    Static/Shared selection in configure.in

    +

    Static/Shared selection in configure.in

    Some macros in configure.in generate the various defines and substs that are necessary for the system to work correct. All modules that should be built by default have to be added to the variable 'default_modules'. @@ -2001,22 +1998,24 @@ On the bottom of configure.in, SMB_MODULE() should be called for each module and SMB_SUBSYSTEM() for each subsystem.

    Syntax:

     SMB_MODULE(subsystem_backend, object files, plugin name, subsystem name, static_action, shared_action)
-SMB_SUBSYSTEM(subsystem)
-

    Also, make sure to add the correct directives to -Makefile.in. @SUBSYSTEM_STATIC@ -will be replaced with a list of objects files of the modules that need to -be linked in statically. @SUBSYSTEM_MODULES@ will +SMB_SUBSYSTEM(subsystem,depfile) +

    The depfile for a certain subsystem is the file that calls the +initialisation functions for the statically built in modules.

    +@SUBSYSTEM_MODULES@ in Makefile.in will be replaced with the names of the plugins to build.

    You must make sure all .c files that contain defines that can be changed by ./configure are rebuilded in the 'modules_clean' make target. Practically, this means all c files that contain static_init_subsystem; calls need to be rebuilded. -

    Chapter 16. RPC Pluggable Modules

    Anthony Liguori

    IBM

    Jelmer Vernooij

    Samba Team

    January 2003

    Table of Contents

    About
    General Overview

    About

    +

    Note

    +There currently also is a configure.in command called SMB_MODULE_PROVIVES(). +This is used for modules that register multiple things. It should not +be used as probing will most likely disappear in the future.

    Chapter 16. RPC Pluggable Modules

    Anthony Liguori

    IBM

    Jelmer Vernooij

    Samba Team

    January 2003

    Table of Contents

    About
    General Overview

    About

    This document describes how to make use the new RPC Pluggable Modules features of Samba 3.0. This architecture was added to increase the maintainability of Samba allowing RPC Pipes to be worked on separately from the main CVS branch. The RPM architecture will also allow third-party vendors to add functionality to Samba through plug-ins. -

    General Overview

    +

    General Overview

    When an RPC call is sent to smbd, smbd tries to load a shared library by the name librpc_<pipename>.so to handle the call if it doesn't know how to handle the call internally. For instance, LSA calls @@ -2033,7 +2032,7 @@ NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *s argument.

    clnt

    the Client name of the named pipe

    srv

    the Server name of the named pipe

    cmds

    a list of api_structs that map RPC ordinal numbers to function calls

    size

    the number of api_structs contained in cmds

    See rpc_server/srv_reg.c and rpc_server/srv_reg_nt.c for a small example of how to use this library. -

    Chapter 17. VFS Modules

    Alexander Bokovoy

    Stefan Metzmacher

    27 May 2003

    Table of Contents

    The Samba (Posix) VFS layer
    The general interface
    Possible VFS operation layers
    The Interaction between the Samba VFS subsystem and the modules
    Initialization and registration
    How the Modules handle per connection data
    Upgrading to the New VFS Interface
    Upgrading from 2.2.* and 3.0aplha modules
    Some Notes
    Implement TRANSPARENT functions
    Implement OPAQUE functions

    The Samba (Posix) VFS layer

    The general interface

    +

    Chapter 17. VFS Modules

    Alexander Bokovoy

    Stefan Metzmacher

    27 May 2003

    Table of Contents

    The Samba (Posix) VFS layer
    The general interface
    Possible VFS operation layers
    The Interaction between the Samba VFS subsystem and the modules
    Initialization and registration
    How the Modules handle per connection data
    Upgrading to the New VFS Interface
    Upgrading from 2.2.* and 3.0aplha modules
    Some Notes
    Implement TRANSPARENT functions
    Implement OPAQUE functions

    The Samba (Posix) VFS layer

    The general interface

    Each VFS operation has a vfs_op_type, a function pointer and a handle pointer in the struct vfs_ops and tree macros to make it easier to call the operations. (Take a look at include/vfs.h and include/vfs_macros.h.) @@ -2129,7 +2128,7 @@ DO NOT ACCESS conn->vfs.ops.* directly !!! (tofd), (fsp), (fromfd), (header), (offset), (count))) ... -

    Possible VFS operation layers

    +

    Possible VFS operation layers

    These values are used by the VFS subsystem when building the conn->vfs and conn->vfs_opaque structs for a connection with multiple VFS modules. Internally, Samba differentiates only opaque and transparent layers at this process. @@ -2158,7 +2157,7 @@ typedef enum _vfs_op_layer { SMB_VFS_LAYER_SCANNER /* - Checks data and possibly initiates additional */ /* file activity like logging to files _inside_ samba VFS */ } vfs_op_layer; -

    The Interaction between the Samba VFS subsystem and the modules

    Initialization and registration

    +

    The Interaction between the Samba VFS subsystem and the modules

    Initialization and registration

    As each Samba module a VFS module should have a 

    NTSTATUS vfs_example_init(void);

    function if it's staticly linked to samba or 

    NTSTATUS init_module(void);

    function if it's a shared module. @@ -2196,9 +2195,9 @@ static vfs_op_tuple example_op_tuples[] = { NTSTATUS init_module(void) { - return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "example", example_op_tuples); + return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "example", example_op_tuples); } -

    How the Modules handle per connection data

    Each VFS function has as first parameter a pointer to the modules vfs_handle_struct. +

    How the Modules handle per connection data

    Each VFS function has as first parameter a pointer to the modules vfs_handle_struct. 

     typedef struct vfs_handle_struct {
 	struct vfs_handle_struct  *next, *prev;
@@ -2208,7 +2207,7 @@ typedef struct vfs_handle_struct {
 	void *data;
 	void (*free_data)(void **data);
 } vfs_handle_struct;
-
    param

    this is the module parameter specified in the vfs objects parameter.

    e.g. for 'vfs objects = example:test' param would be "test".

    vfs_next

    This vfs_ops struct contains the information for calling the next module operations. +

    param

    this is the module parameter specified in the vfs objects parameter.

    e.g. for 'vfs objects = example:test' param would be "test".

    vfs_next

    This vfs_ops struct contains the information for calling the next module operations. Use the SMB_VFS_NEXT_* macros to call a next module operations and don't access handle->vfs_next.ops.* directly!

    conn

    This is a pointer back to the connection_struct to witch the handle belongs.

    data

    This is a pointer for holding module private data. You can alloc data with connection life time on the handle->conn->mem_ctx TALLOC_CTX. @@ -2218,14 +2217,14 @@ you can set this function pointer to NULL.

    Some useful MAC 

     #define SMB_VFS_HANDLE_GET_DATA(handle, datap, type, ret) { \
 	if (!(handle)||((datap=(type *)(handle)->data)==NULL)) { \
-		DEBUG(0,("%s() failed to get vfs_handle->data!\n",FUNCTION_MACRO)); \
+		DEBUG(0,("%s() failed to get vfs_handle->data!\n",FUNCTION_MACRO)); \
 		ret; \
 	} \
 }
 
 #define SMB_VFS_HANDLE_SET_DATA(handle, datap, free_fn, type, ret) { \
 	if (!(handle)) { \
-		DEBUG(0,("%s() failed to set handle->data!\n",FUNCTION_MACRO)); \
+		DEBUG(0,("%s() failed to set handle->data!\n",FUNCTION_MACRO)); \
 		ret; \
 	} else { \
 		if ((handle)->free_data) { \
@@ -2299,20 +2298,20 @@ you can set this function pointer to NULL.

    Some useful MAC (handle)->vfs_next.handles.sendfile,\ (tofd), (fsp), (fromfd), (header), (offset), (count))) ... -

    Upgrading to the New VFS Interface

    Upgrading from 2.2.* and 3.0aplha modules

    1. -Add "vfs_handle_struct *handle, " as first parameter to all vfs operation functions. +

    Upgrading to the New VFS Interface

    Upgrading from 2.2.* and 3.0aplha modules

    1. +Add "vfs_handle_struct *handle, " as first parameter to all vfs operation functions. e.g. example_connect(connection_struct *conn, const char *service, const char *user); -> example_connect(vfs_handle_struct *handle, connection_struct *conn, const char *service, const char *user);

    2. -Replace "default_vfs_ops." with "smb_vfs_next_". +Replace "default_vfs_ops." with "smb_vfs_next_". e.g. default_vfs_ops.connect(conn, service, user); -> smb_vfs_next_connect(conn, service, user);

    3. -Uppercase all "smb_vfs_next_*" functions. +Uppercase all "smb_vfs_next_*" functions. e.g. smb_vfs_next_connect(conn, service, user); -> SMB_VFS_NEXT_CONNECT(conn, service, user);

    4. -Add "handle, " as first parameter to all SMB_VFS_NEXT_*() calls. +Add "handle, " as first parameter to all SMB_VFS_NEXT_*() calls. e.g. SMB_VFS_NEXT_CONNECT(conn, service, user); -> SMB_VFS_NEXT_CONNECT(handle, conn, service, user);

    5. @@ -2412,7 +2411,7 @@ e.g. 

       NTSTATUS init_module(void)
 {
-	return smb_register_vfs(SMB_VFS_INTERFACE_VERSION,"example",example_op_tuples);
+	return smb_register_vfs(SMB_VFS_INTERFACE_VERSION,"example",example_op_tuples);
 }

    6. @@ -2448,14 +2447,14 @@ static int example_connect(vfs_handle_struct *handle, /* alloc our private data */ data = (struct example_privates *)talloc_zero(conn->mem_ctx, sizeof(struct example_privates)); if (!data) { - DEBUG(0,("talloc_zero() failed\n")); + DEBUG(0,("talloc_zero() failed\n")); return -1; } /* init out private data */ - data->some_string = talloc_strdup(conn->mem_ctx,"test"); + data->some_string = talloc_strdup(conn->mem_ctx,"test"); if (!data->some_string) { - DEBUG(0,("talloc_strdup() failed\n")); + DEBUG(0,("talloc_strdup() failed\n")); return -1; } @@ -2481,7 +2480,7 @@ static int example_close(vfs_handle_struct *handle, files_struct *fsp, int fd) SMB_VFS_HANDLE_GET_DATA(handle, data, struct example_privates, return -1); /* do something here...*/ - DEBUG(0,("some_string: %s\n",data->some_string)); + DEBUG(0,("some_string: %s\n",data->some_string)); return SMB_VFS_NEXT_CLOSE(handle, fsp, fd); } @@ -2495,7 +2494,7 @@ static void free_example_privates(void **datap) SAFE_FREE(data->some_string); SAFE_FREE(data); - datap = NULL; + *datap = NULL; return; } @@ -2509,14 +2508,14 @@ static int example_connect(vfs_handle_struct *handle, /* alloc our private data */ data = (struct example_privates *)malloc(sizeof(struct example_privates)); if (!data) { - DEBUG(0,("malloc() failed\n")); + DEBUG(0,("malloc() failed\n")); return -1; } /* init out private data */ - data->some_string = strdup(conn->mem_ctx,"test"); + data->some_string = strdup("test"); if (!data->some_string) { - DEBUG(0,("strdup() failed\n")); + DEBUG(0,("strdup() failed\n")); return -1; } @@ -2526,7 +2525,7 @@ static int example_connect(vfs_handle_struct *handle, * we need to specify a free_function because we used malloc() and strdup(). * (return -1 if something failed.) */ - SMB_VFS_HANDLE_SET_DATA(handle, data, NULL, struct example_privates, return -1); + SMB_VFS_HANDLE_SET_DATA(handle, data, free_example_privates, struct example_privates, return -1); return SMB_VFS_NEXT_CONNECT(handle,conn,service,user); } @@ -2541,7 +2540,7 @@ static int example_close(vfs_handle_struct *handle, files_struct *fsp, int fd) SMB_VFS_HANDLE_GET_DATA(handle, data, struct example_privates, return -1); /* do something here...*/ - DEBUG(0,("some_string: %s\n",data->some_string)); + DEBUG(0,("some_string: %s\n",data->some_string)); return SMB_VFS_NEXT_CLOSE(handle, fsp, fd); } @@ -2562,7 +2561,7 @@ for your module.

    7. Compiling & Testing...

      ./configure --enable-developer ...
      make
      Try to fix all compiler warnings
      make
      Testing, Testing, Testing ...

      -

    Some Notes

    Implement TRANSPARENT functions

    +

    Some Notes

    Implement TRANSPARENT functions

    Avoid writing functions like this: 

    @@ -2573,7 +2572,7 @@ static int example_close(vfs_handle_struct *handle, files_struct *fsp, int fd)

    Overload only the functions you really need to! -

    Implement OPAQUE functions

    +

    Implement OPAQUE functions

    If you want to just implement a better version of a default samba opaque function (e.g. like a disk_free() function for a special filesystem) @@ -2589,16 +2588,16 @@ e.g. for a readonly filesystem. static int example_rename(vfs_handle_struct *handle, connection_struct *conn, char *oldname, char *newname) { - DEBUG(10,("function rename() not allowed on vfs 'example'\n")); + DEBUG(10,("function rename() not allowed on vfs 'example'\n")); errno = ENOSYS; return -1; } -

    Chapter 18. Notes to packagers

    Jelmer Vernooij

    Table of Contents

    Versioning
    Modules

    Versioning

    Please, please update the version number in +

    Chapter 18. Notes to packagers

    Jelmer Vernooij

    Table of Contents

    Versioning
    Modules

    Versioning

    Please, please update the version number in source/include/version.h to include the versioning of your package. This makes it easier to distinguish standard samba builds from custom-build samba builds (distributions often patch packages). For example, a good version would be: 

     Version 2.999+3.0.alpha21-5 for Debian
-

    Modules

    Samba now has support for building parts of samba as plugins. This +

    Modules

    Samba now has support for building parts of samba as plugins. This makes it possible to, for example, put ldap or mysql support in a seperate package, thus making it possible to have a normal samba package not depending on ldap or mysql. To build as much parts of samba diff --git a/docs/htmldocs/Samba-HOWTO-Collection.html b/docs/htmldocs/Samba-HOWTO-Collection.html index 27faf25f17..566f0b4068 100644 --- a/docs/htmldocs/Samba-HOWTO-Collection.html +++ b/docs/htmldocs/Samba-HOWTO-Collection.html @@ -16,20 +16,13 @@ insignificant number of ideas for inclusion (if not content itself) has been obt from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. Please keep publishing your Unofficial HOWTOs - they are a source of inspiration and application knowledge that is most to be desired by many Samba users and administrators. -">

    SAMBA Project Documentation

    Edited by

    Jelmer R. Vernooij

    John H. Terpstra

    Gerald (Jerry) Carter

    -This documentation is distributed under the GNU General Public License (GPL) -version 2. A copy of the license is included with the Samba source -distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt -

    Attributions.  -

    Introduction to Samba
    How to Install and Test SAMBA
    Fast Start for the Impatient
    Server Types and Security Modes
    Domain Control
    Backup Domain Control
    Domain Membership
    Stand-Alone Servers
    MS Windows Network Configuration Guide
    Samba / MS Windows Network Browsing Guide
    Account Information Databases
    Mapping MS Windows and Unix Groups
    File, Directory and Share Access Controls
    File and Record Locking
    Securing Samba
    Interdomain Trust Relationships
    Hosting a Microsoft Distributed File System tree on Samba
    Classical Printing Support
    CUPS Printing Support in Samba 3.0
    Stackable VFS modules

    • Jelmer Vernooij <jelmer@samba.org>

    • John Terpstra <jht@samba.org>

    • Tim Potter

    • Simo Sorce (original vfs_skel README)

    • Alexander Bokovoy (original vfs_netatalk docs)

    • Stefan Metzmacher (Update for multiple modules)

    Integrated Logon Support using Winbind
    Advanced Network Management
    System and Account Policies
    Desktop Profile Management
    PAM based Distributed Authentication
    Integrating MS Windows networks with Samba
    Unicode/Charsets
    Samba Backup Techniques
    High Availability Options
    Upgrading from Samba-2.x to Samba-3.0.0
    Migration from NT4 PDC to Samba-3 PDC
    SWAT - The Samba Web Administration Tool
    The Samba checklist
    Analysing and solving samba problems
    Reporting Bugs
    How to compile SAMBA
    Portability
    Samba and other CIFS clients
    Samba Performance Tuning
    DNS and DHCP Configuration Guide
    Further Resources

    - -

    Monday April 21, 2003

    Abstract

    +">

    SAMBA Project Documentation

    Edited by

    Jelmer R. Vernooij

    John H. Terpstra

    Gerald (Jerry) Carter

    Monday April 21, 2003

    Abstract

    This book is a collection of HOWTOs added to Samba documentation over the years. Samba is always under development, and so is its' documentation. This release of the documentation represents a major revision or layout as well as contents. The most recent version of this document can be found at http://www.samba.org/ -on the "Documentation" page. Please send updates to +on the "Documentation" page. Please send updates to Jelmer Vernooij, John H. Terpstra or Gerald (Jerry) Carter. @@ -38,47 +31,53 @@ The Samba-Team would like to express sincere thanks to the many people who have or without their knowledge contributed to this update. The size and scope of this project would not have been possible without significant community contribution. A not insignificant number of ideas for inclusion (if not content itself) has been obtained -from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. +from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. Please keep publishing your Unofficial HOWTOs - they are a source of inspiration and application knowledge that is most to be desired by many Samba users and administrators. -

    Table of Contents

    I. General Installation
    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
    What If Things Don't Work?
    Common Errors
    Why are so many smbd processes eating memory?
    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs
    3. Fast Start for the Impatient
    Note
    II. Server Configuration Basics
    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Seamless Windows Network Integration
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not -exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    III. Advanced Configuration
    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    11. Account Information Databases
    Features and Benefits
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and Unix
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon - Users not in Samba SAM
    Users are being added to the wrong backend database
    auth methods does not work
    12. Mapping MS Windows and Unix Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with Unix File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and Unix Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute - mapping
    Common Errors
    Users can not write to a public share
    I have set force user and Samba still makes root the owner of all the files - I touch!
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    Common Errors
    Tell me about Trust Relationships using Samba
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    Parameters for Backwards Compatibility
    Parameters no longer in use
    A simple Configuration to Print with Samba-3
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print with Samba-3
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various Unix Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba-3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with -rpcclient
    "The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure)
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a -different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba-3
    Publishing Printer Information in Active Directory or LDAP
    Common Errors and Problems
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for -CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for -application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download
    GDI on Windows -- PostScript on Unix
    Windows Drivers, GDI and EMF
    Unix Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and -native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print -Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many -Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel -Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for -cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Caveats to be considered
    What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsm completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the -Client
    Installing PostScript Driver Files manually (using -rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Commandline Driver Installation in 15 little Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    When not to use Samba to print to -CUPS
    In Case of Trouble.....
    Where to find Documentation
    How to ask for Help
    Where to find Help
    Appendix
    Printing from CUPS to Windows attached -Printers
    More CUPS filtering Chains
    Trouble Shooting Guidelines to fix typical Samba printing -Problems
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    Common Errors
    21. Integrated Logon Support using Winbind
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    How does one set up roaming profiles for just one (or a few) user/s or group/s?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    My Boomerang Won't Come Back
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    IV. Migration and Updating
    30. Upgrading from Samba-2.x to Samba-3.0.0
    Charsets
    Obsolete configuration options
    Password Backend
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    V. Troubleshooting
    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    Still having troubles?
    34. Analysing and solving samba problems
    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches
    VI. Appendixes
    36. How to compile SAMBA
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    Common Errors
    37. Portability
    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
    How do I get printer driver download working - for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Books
    Index

    List of Figures

    19.1. Windows Printing to a local Printer
    19.2. Printing to a Postscript Printer
    19.3. Ghostscript as a RIP for non-postscript printers
    19.4. Prefiltering in CUPS to form Postscript
    19.5. Adding Device-specific Print Options
    19.6. Postscript to intermediate Raster format
    19.7. CUPS-raster production using Ghostscript
    19.8. Image format to CUPS-raster format conversion
    19.9. Raster to Printer Specific formats
    19.10. cupsomatic/foomatic processing versus Native CUPS
    19.11. Print Driver execution on the Client
    19.12. Print Driver execution on the Server
    19.13. Printing via CUPS/samba server
    19.14. cupsaddsmb flowchart
    19.15. CUPS Printing Overview

    List of Tables

    7.1. Assumptions
    10.1. Browse subnet example 1
    10.2. Browse subnet example 2
    10.3. Browse subnet example 3
    10.4. Browse subnet example 4
    11.1. Attributes in the sambaSamAccount objectclass (LDAP)
    11.2. Basic smb.conf options for MySQL passdb backend
    11.3. MySQL field names for MySQL passdb backend
    13.1. Managing directories with unix and windows
    13.2. User and Group Based Controls
    13.3. File and Directory Permission Based Controls
    13.4. Other Controls
    20.1. Extended Auditing Log Information
    24.1. User Shell Folder registry keys default values
    24.2. Defaults of profile settings registry keys
    24.3. Defaults of default user profile paths registry keys
    25.1. Options recognized by pam_smbpass
    31.1. The 3 Major Site Types
    31.2. Nature of the Conversion Choices

    List of Examples

    12.1. smbgrpadd.sh
    13.1. Example File

    General Installation

    Preparing Samba for Configuration

    This section of the Samba-HOWTO-Collection contains general info on how to install samba +

    Table of Contents

    Legal Notice
    Attributions
    I. General Installation
    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your + server
    Try connecting with the unix client
    Try connecting from another SMB client
    What If Things Don't Work?
    Common Errors
    Large number of smbd processes
    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
    "The network name cannot be found"
    3. Fast Start for the Impatient
    Note
    II. Server Configuration Basics
    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password checking
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    '$' cannot be included in machine name
    Joining domain fails because of existing machine account
    The system can not log you on (C000019B)....
    The machine trust account not accessible
    Account disabled
    Domain Controller Unavailable
    Can not log onto domain member workstation after joining domain
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    III. Advanced Configuration
    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    I get an Unable to browse the network error
    11. Account Information Databases
    Features and Benefits
    Backwards Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon
    Users being added to wrong backend database
    auth methods does not work
    12. Mapping MS Windows and UNIX Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users group
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask + parameters
    Interaction with the standard Samba file attribute mapping
    Common Errors
    Users can not write to a public share
    I have set force user but Samba still makes root the owner of all the files I touch!
    MS Word with Samba changes owner of file
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Problems saving files in MS Office on Windows XP
    Long delays deleting files over network with XP SP1
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-style Domain Trusts with Windows 2000
    Common Errors
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    A simple Configuration to Print
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various UNIX Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba 3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with +rpcclient
    Client Driver Install Procedure
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a +different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for +CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for +application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and +native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many +Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel +Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Caveats to be considered
    Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsmb completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the +Client
    Installing PostScript Driver Files manually (using +rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    In Case of Trouble.....
    Printing from CUPS to Windows attached +Printers
    More CUPS filtering Chains
    Common Errors
    Win9x client can't install driver
    "cupsaddsmb" keeps asking for root password in + neverending loop
    "cupsaddsmb" gives "No PPD file for printer..." + message while PPD file is present
    Client can't connect to Samba printer
    Can't reconnect to Samba under new account + from Win2K/XP
    Avoid being connected to the Samba server as the + "wrong" user
    Upgrading to CUPS drivers from Adobe drivers on + NT/2K/XP clients gives problems
    Can't use "cupsaddsmb" on Samba server which is + a PDC
    Deleted Win2K printer driver is still shown
    Win2K/XP "Local Security + Policies"
    WinXP clients: "Administrator can not install + printers for all local users"
    "Print Change Notify" functions on + NT-clients
    WinXP-SP1
    Print options for all users can't be set on Win2K/XP
    Most common blunders in driver + settings on Windows clients
    cupsaddsmb does not work + with newly installed printer
    Permissions on +/var/spool/samba/ get reset after each +reboot
    Printer named "lp" +intermittently swallows jobs and spits out completely different +ones
    Location of Adobe PostScript driver files necessary for "cupsaddsmb"
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    21. Winbind: Use of Domain Accounts
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Setting up roaming profiles for just a few user's or group's?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    Winbind is not resolving users and groups
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure UNIX/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging works only in one way
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    Common errors
    CP850.so can't be found
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    IV. Migration and Updating
    30. Upgrading from Samba-2.x to Samba-3.0.0
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (changes in behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    Charsets
    LDAP
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    V. Troubleshooting
    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    34. Analysing and solving samba problems
    Diagnostics tools
    Debugging with Samba itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches
    VI. Appendixes
    36. How to compile Samba
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    37. Portability
    HPUX
    SCO UNIX
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    Configuring OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba
    Configuring OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba
    Printer driver download for for OS/2 clients?
    Windows for Workgroups
    Latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configuring WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Index

    List of Figures

    5.1. An Example Domain
    10.1. Cross subnet browsing example
    11.1. IDMAP
    12.1. IDMAP groups
    13.1. Overview of unix permissions field
    16.1. Trusts overview
    19.1. Windows Printing to a local Printer
    19.2. Printing to a Postscript Printer
    19.3. Ghostscript as a RIP for non-postscript printers
    19.4. Prefiltering in CUPS to form Postscript
    19.5. Adding Device-specific Print Options
    19.6. Postscript to intermediate Raster format
    19.7. CUPS-raster production using Ghostscript
    19.8. Image format to CUPS-raster format conversion
    19.9. Raster to Printer Specific formats
    19.10. cupsomatic/foomatic processing versus Native CUPS
    19.11. PDF to socket chain
    19.12. PDF to USB chain
    19.13. Print Driver execution on the Client
    19.14. Print Driver execution on the Server
    19.15. Printing via CUPS/samba server
    19.16. cupsaddsmb flowchart
    19.17. Filtering chain 1
    19.18. Filtering chain with cupsomatic
    19.19. CUPS Printing Overview

    List of Tables

    7.1. Assumptions
    10.1. Browse subnet example 1
    10.2. Browse subnet example 2
    10.3. Browse subnet example 3
    10.4. Browse subnet example 4
    11.1. Attributes in the sambaSamAccount objectclass (LDAP)
    11.2. Basic smb.conf options for MySQL passdb backend
    11.3. MySQL field names for MySQL passdb backend
    13.1. Managing directories with unix and windows
    13.2. User and Group Based Controls
    13.3. File and Directory Permission Based Controls
    13.4. Other Controls
    19.1. PPD's shipped with CUPS
    20.1. Extended Auditing Log Information
    24.1. User Shell Folder registry keys default values
    24.2. Defaults of profile settings registry keys
    24.3. Defaults of default user profile paths registry keys
    25.1. Options recognized by pam_smbpass
    26.1. Unique NetBIOS names
    26.2. Group Names
    30.1. TDB File Descriptions
    31.1. The 3 Major Site Types
    31.2. Nature of the Conversion Choices

    List of Examples

    2.1. Simplest possible smb.conf file
    5.1. smb.conf for being a PDC
    5.2. smb.conf for being a PDC
    6.1. Minimal smb.conf for being a PDC
    6.2. Minimal setup for being a BDC
    8.1. smb.conf for Reference Documentation Server
    8.2. smb.conf for anonymous printing
    10.1. Domain master browser smb.conf
    10.2. Local master browser smb.conf
    10.3. smb.conf for not being a master browser
    10.4. Local master browser smb.conf
    10.5. smb.conf for not being a master browser
    11.1.
    11.2. Configuration with LDAP
    12.1. smbgrpadd.sh
    13.1. Example File
    14.1. Share with some files oplocked
    14.2.
    17.1. smb.conf with DFS configured
    18.1. Simple configuration with BSD printing
    18.2. Extended configuration with BSD printing
    18.3. [print\$] example
    19.1. Simplest printing-related smb.conf
    19.2. Overriding global CUPS settings for one printer
    19.3. smb.conf for cupsaddsmb usage
    20.1. smb.conf with VFS modules
    20.2. smb.conf with multiple VFS modules
    21.1. smb.conf for winbind set-up
    33.1. smb.conf with [tmp] share
    38.1. Minimal profile share

    Legal Notice

    +This documentation is distributed under the GNU General Public License (GPL) +version 2. A copy of the license is included with the Samba source +distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt +

    Attributions

    Introduction to Samba

    How to Install and Test SAMBA

    Fast Start for the Impatient

    Server Types and Security Modes

    Domain Control

    Backup Domain Control

    Domain Membership

    Stand-Alone Servers

    MS Windows Network Configuration Guide

    Samba / MS Windows Network Browsing Guide

    Account Information Databases

    Mapping MS Windows and UNIX Groups

    File, Directory and Share Access Controls

    File and Record Locking

    Securing Samba

    Interdomain Trust Relationships

    Hosting a Microsoft Distributed File System tree on Samba

    Classical Printing Support

    CUPS Printing Support in Samba 3.0

    Stackable VFS modules

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Tim Potter

    • Simo Sorce (original vfs_skel README)

    • Alexander Bokovoy (original vfs_netatalk docs)

    • Stefan Metzmacher (Update for multiple modules)

    Advanced Network Management

    System and Account Policies

    Desktop Profile Management

    PAM based Distributed Authentication

    Integrating MS Windows networks with Samba

    Unicode/Charsets

    Samba Backup Techniques

    High Availability Options

    Upgrading from Samba-2.x to Samba-3.0.0

    Migration from NT4 PDC to Samba-3 PDC

    SWAT - The Samba Web Administration Tool

    The Samba checklist

    Analysing and solving samba problems

    Reporting Bugs

    How to compile Samba

    Portability

    Samba and other CIFS clients

    Samba Performance Tuning

    DNS and DHCP Configuration Guide

    Further Resources

    General Installation

    Preparing Samba for Configuration

    This section of the Samba-HOWTO-Collection contains general info on how to install samba and how to configure the parts of samba you will most likely need. -PLEASE read this.

    Table of Contents

    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
    What If Things Don't Work?
    Common Errors
    Why are so many smbd processes eating memory?
    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs
    3. Fast Start for the Impatient
    Note

    Chapter 1. Introduction to Samba

    David Lechnyr

    Unofficial HOWTO

    April 14, 2003

    Table of Contents

    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous

    “ -"If you understand what you're doing, you're not learning anything." +PLEASE read this.

    Table of Contents

    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your + server
    Try connecting with the unix client
    Try connecting from another SMB client
    What If Things Don't Work?
    Common Errors
    Large number of smbd processes
    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
    "The network name cannot be found"
    3. Fast Start for the Impatient
    Note

    Chapter 1. Introduction to Samba

    David Lechnyr

    Unofficial HOWTO

    April 14, 2003

    Table of Contents

    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous

    “ +"If you understand what you're doing, you're not learning anything." -- Anonymous ”

    Samba is a file and print server for Windows-based clients using TCP/IP as the underlying @@ -86,7 +85,7 @@ transport protocol. In fact, it can support any SMB/CIFS-enabled client. One of strengths is that you can use it to blend your mix of Windows and Linux machines together without requiring a separate Windows NT/2000/2003 Server. Samba is actively being developed by a global team of about 30 active programmers and was originally developed by Andrew Tridgell. -

    Background

    +

    Background

    Once long ago, there was a buzzword referred to as DCE/RPC. This stood for Distributed Computing Environment/Remote Procedure Calls and conceptually was a good idea. It was originally developed by Apollo/HP as NCA 1.0 (Network Computing Architecture) and only @@ -94,12 +93,12 @@ ran over UDP. When there was a need to run it over TCP so that it would be compa with DECnet 3.0, it was redesigned, submitted to The Open Group, and officially became known as DCE/RPC. Microsoft came along and decided, rather than pay $20 per seat to license this technology, to reimplement DCE/RPC themselves as MSRPC. From this, the -concept continued in the form of SMB (Server Message Block, or the "what") using the -NetBIOS (Network Basic Input/Output System, or the "how") compatibility layer. You can +concept continued in the form of SMB (Server Message Block, or the "what") using the +NetBIOS (Network Basic Input/Output System, or the "how") compatibility layer. You can run SMB (i.e., transport) over several different protocols; many different implementations arose as a result, including NBIPX (NetBIOS over IPX, NwLnkNb, or NWNBLink) and NBT (NetBIOS over TCP/IP, or NetBT). As the years passed, NBT became the most common form -of implementation until the advance of "Direct-Hosted TCP" -- the Microsoft marketing +of implementation until the advance of "Direct-Hosted TCP" -- the Microsoft marketing term for eliminating NetBIOS entirely and running SMB by itself across TCP port 445 only. As of yet, direct-hosted TCP has yet to catch on.

    @@ -112,23 +111,23 @@ been dutifully waded through during the information-gathering stages of this pro are *still* many missing pieces... While often tedious, at least the way has been generously littered with occurrences of clapping hand to forehead and muttering 'crikey, what are they thinking? -

    Terminology

    • - SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol. +

    Terminology

    • + SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol.

    • - CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently - decided that SMB needed the word "Internet" in it, so they changed it to CIFS. + CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently + decided that SMB needed the word "Internet" in it, so they changed it to CIFS.

    • Direct-Hosted: A method of providing file/printer sharing services over port 445/tcp only using DNS for name resolution instead of WINS.

    • - IPC: Acronym for "Inter-Process Communication". A method to communicate specific + IPC: Acronym for "Inter-Process Communication". A method to communicate specific information between programs.

    • Marshalling: - A method of serializing (i.e., sequential ordering of) variable data suitable for transmission via a network connection or storing in a file. The source data can be re-created using a similar process called unmarshalling.

    • - NetBIOS: Acronym for "Network Basic Input/Output System". This is not a protocol; + NetBIOS: Acronym for "Network Basic Input/Output System". This is not a protocol; it is a method of communication across an existing protocol. This is a standard which was originally developed for IBM by Sytek in 1983. To exaggerate the analogy a bit, it can help to think of this in comparison your computer's BIOS -- it controls the @@ -139,15 +138,15 @@ thinking? brilliant people tend to interchange NetBIOS with terms like NetBEUI without a second thought; this will cause no end (and no doubt) of confusion.

    • - NetBEUI: Acronym for the "NetBIOS Extended User Interface". Unlike NetBIOS, NetBEUI + NetBEUI: Acronym for the "NetBIOS Extended User Interface". Unlike NetBIOS, NetBEUI is a protocol, not a standard. It is also not routable, so traffic on one side of a router will be unable to communicate with the other side. Understanding NetBEUI is not essential to deciphering SMB; however it helps to point out that it is not the same as NetBIOS and to improve your score in trivia at parties. NetBEUI was originally - referred to by Microsoft as "NBF", or "The Windows NT NetBEUI Frame protocol driver". + referred to by Microsoft as "NBF", or "The Windows NT NetBEUI Frame protocol driver". It is not often heard from these days.

    • - NBT: Acronym for "NetBIOS over TCP"; also known as "NetBT". Allows the continued use + NBT: Acronym for "NetBIOS over TCP"; also known as "NetBT". Allows the continued use of NetBIOS traffic proxied over TCP/IP. As a result, NetBIOS names are made to IP addresses and NetBIOS name types are conceptually equivalent to TCP/IP ports. This is how file and printer sharing are accomplished in Windows 95/98/ME. They @@ -162,7 +161,7 @@ thinking? W3K: Acronym for Windows 2003 Server

    If you plan on getting help, make sure to subscribe to the Samba Mailing List (available at http://www.samba.org). -

    Related Projects

    +

    Related Projects

    There are currently two network filesystem client projects for Linux that are directly related to Samba: SMBFS and CIFS VFS. These are both available in the Linux kernel itself.

    • @@ -184,21 +183,21 @@ nothing to do with acting as a file and print server for SMB/CIFS clients. There are other Open Source CIFS client implementations, such as the jCIFS project which provides an SMB client toolkit written in Java. -

    SMB Methodology

    +

    SMB Methodology

    Traditionally, SMB uses UDP port 137 (NetBIOS name service, or netbios-ns), UDP port 138 (NetBIOS datagram service, or netbios-dgm), and TCP port 139 (NetBIOS session service, or netbios-ssn). Anyone looking at their network with a good packet sniffer will be amazed at the amount of traffic generated by just opening up a single file. In general, SMB sessions are established in the following order:

    • - "TCP Connection" - establish 3-way handshake (connection) to port 139/tcp + "TCP Connection" - establish 3-way handshake (connection) to port 139/tcp or 445/tcp.

    • - "NetBIOS Session Request" - using the following "Calling Names": The local + "NetBIOS Session Request" - using the following "Calling Names": The local machine's NetBIOS name plus the 16th character 0x00; The server's NetBIOS name plus the 16th character 0x20

    • - "SMB Negotiate Protocol" - determine the protocol dialect to use, which will + "SMB Negotiate Protocol" - determine the protocol dialect to use, which will be one of the following: PC Network Program 1.0 (Core) - share level security mode only; Microsoft Networks 1.03 (Core Plus) - share level security mode only; Lanman1.0 (LAN Manager 1.0) - uses Challenge/Response @@ -216,7 +215,7 @@ up a single file. In general, SMB sessions are established in the following orde A good way to examine this process in depth is to try out SecurityFriday's SWB program. It allows you to walk through the establishment of a SMB/CIFS session step by step. -

    Epilogue

    “ +

    Epilogue

    “ What's fundamentally wrong is that nobody ever had any taste when they did it. Microsoft has been very much into making the user interface look good, but internally it's just a complete mess. And even people who program for Microsoft @@ -240,61 +239,52 @@ halts in the middle of something that shouldn't be strange. Normally it works fine and then once in a blue moon for some completely unknown reason, it's dead, and nobody knows why. Not Microsoft, not the experienced user and certainly not the completely clueless user who probably sits there shivering thinking -"What did I do wrong?" when they didn't do anything wrong at all. +"What did I do wrong?" when they didn't do anything wrong at all. ”

    “ -That's what's really irritating to me." +That's what's really irritating to me." ”

    -- Linus Torvalds, from an interview with BOOT Magazine, Sept 1998 -

    Miscellaneous

    +

    Miscellaneous

    This chapter is Copyright 2003 David Lechnyr (david at lechnyr dot com). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation. A copy of the license is available at http://www.gnu.org/licenses/fdl.txt. -

    Chapter 2. How to Install and Test SAMBA

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Karl Auer

    Table of Contents

    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
    What If Things Don't Work?
    Common Errors
    Why are so many smbd processes eating memory?
    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

    Obtaining and installing samba

    +

    Chapter 2. How to Install and Test SAMBA

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Karl Auer

    Table of Contents

    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your + server
    Try connecting with the unix client
    Try connecting from another SMB client
    What If Things Don't Work?
    Common Errors
    Large number of smbd processes
    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
    "The network name cannot be found"

    Obtaining and installing samba

    Binary packages of samba are included in almost any Linux or - Unix distribution. There are also some packages available at + UNIX distribution. There are also some packages available at the samba homepage. -

    If you need to compile samba from source, check the - appropriate appendix chapter.

    If you have already installed samba, or if your operating system +

    If you need to compile samba from source, check + the chapter about compiling samba from scratch.

    If you have already installed samba, or if your operating system was pre-installed with samba, then you may not need to bother with this chapter. On the other hand, you may want to read this chapter anyhow - for information about updating samba.

    Configuring samba (smb.conf)

    + for information about updating samba.

    Configuring samba (smb.conf)

    Samba's configuration is stored in the smb.conf file, that usually resides in /etc/samba/smb.conf or /usr/local/samba/lib/smb.conf. You can either edit this file yourself or do it using one of the many graphical tools that are available, such as the web-based interface swat, that is included with samba. -

    Example Configuration

    +

    Example Configuration

    There are sample configuration files in the examples subdirectory in the distribution. I suggest you read them carefully so you can see how the options go together in practice. See the man page for all the options.

    The simplest useful configuration file would be something like this:

    - 

    -	[global]
-		workgroup = MYGROUP
-
-	[homes]
-		guest ok = no
-		read only = no
-

    +

    Example 2.1. Simplest possible smb.conf file

    [global]
    workgroup = MIDEARTH
    [homes]
    guest ok = no
    read only = no

    This will allow connections by anyone with an account on the server, using either - their login name or "homes" as the service name. + their login name or homes" as the service name. (Note that the workgroup that Samba must also be set.)

    - Make sure you put the smb.conf file in the same place - you specified in the Makefile (the default is to - look for it in /usr/local/samba/lib/). + Make sure you put the smb.conf file in the correct place + (usually in /etc/samba).

    For more information about security settings for the - [homes] share please refer to the chapter - Securing Samba. -

    Test your config file with testparm

    + [homes] share please refer to + "Securing Samba". +

    Test your config file with testparm

    It's important that you test the validity of your smb.conf file using the testparm program. If testparm runs OK then it will list the loaded services. If not it will give an error message. @@ -302,7 +292,7 @@ Software Foundation. A copy of the license is available at http://www.gnu.org/li Make sure it runs OK and that the services look reasonable before proceeding.

    Always run testparm again when you change smb.conf! -

    SWAT

    +

    SWAT

    SWAT is a web-based interface that helps you configure samba. SWAT might not be available in the samba package on your platform, but in a separate package. Please read the swat manpage @@ -318,9 +308,10 @@ Software Foundation. A copy of the license is available at http://www.gnu.org/li machine but connecting from a remote machine leaves your connection open to password sniffing as passwords will be sent in the clear over the wire. -

    Try listing the shares available on your - server

    $ smbclient -L - yourhostname

    You should get back a list of shares available on +

    Try listing the shares available on your + server

    +$ smbclient -L yourhostname
+

    You should get back a list of shares available on your server. If you don't then something is incorrectly setup. Note that this method can also be used to see what shares are available on other LanManager clients (such as WfWg).

    If you choose user level security then you may find @@ -328,68 +319,31 @@ Software Foundation. A copy of the license is available at http://www.gnu.org/li See the smbclient man page for details. (you can force it to list the shares without a password by adding the option -U% to the command line. This will not work - with non-Samba servers)

    Try connecting with the unix client

    $ smbclient - //yourhostname/aservice

    Typically the yourhostname + with non-Samba servers)

    Try connecting with the unix client

    +

    +$ smbclient  //yourhostname/aservice
+

    Typically the yourhostname would be the name of the host where you installed smbd. The aservice is any service you have defined in the smb.conf file. Try your user name if you just have a [homes] section in smb.conf.

    For example if your unix host is bambi - and your login name is fred you would type:

    $ smbclient //bambi/fred -

    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client

    Try mounting disks. eg:

    C:\WINDOWS\> net use d: \\servername\service -

    Try printing. eg:

    C:\WINDOWS\> net use lpt1: - \\servername\spoolservice

    C:\WINDOWS\> print filename -

    What If Things Don't Work?

    Then you might read the file chapter - Diagnosis and the - FAQ. If you are still stuck then try to follow - the Analysing and Solving Problems chapter - Samba has been successfully installed at thousands of sites worldwide, - so maybe someone else has hit your problem and has overcome it.

    Common Errors

    -The following questions and issues get raised on the samba mailing list over and over again. -

    Why are so many smbd processes eating memory?

    -“ -Site that is running Samba on an AIX box. They are sharing out about 2 terabytes using samba. -Samba was installed using smitty and the binaries. We seem to be experiencing a memory problem -with this box. When I do a svmon -Pu the monitoring program shows that smbd has several -processes of smbd running: -” -

    - “ -Is samba suppose to start this many different smbd processes? Or does it run as one smbd process? Also -is it normal for it to be taking up this much memory? -” -

    + and your login name is fred you would type:

    +$ smbclient //bambi/fred
+

    Try connecting from another SMB client

    Try mounting disks. from a DOS, Windows or OS/2 client, eg:

    +C:\> net use d: \\servername\service
+

    Try printing. eg:

    -Inuse * 4096 = amount of memory being used by this process
-
-     Pid Command        Inuse      Pin     Pgsp  Virtual   64-bit    Mthrd
-   20950 smbd           33098     1906      181     5017        N        N
-   22262 smbd            9104     1906      5410
-   21060 smbd            9048     1906      181     5479        N        N
-   25972 smbd            8678     1906      181     5109        N        N
-   24524 smbd            8674     1906      181     5105        N        N
-   19262 smbd            8582     1906      181     5013        N        N
-   20722 smbd            8572     1906      181     5003        N        N
-   21454 smbd            8572     1906      181     5003        N        N
-   28946 smbd            8567     1906      181     4996        N        N
-   24076 smbd            8566     1906      181     4996        N        N
-   20138 smbd            8566     1906      181     4996        N        N
-   17608 smbd            8565     1906      181     4996        N        N
-   21820 smbd            8565     1906      181     4996        N        N
-   26940 smbd            8565     1906      181     4996        N        N
-   19884 smbd            8565     1906      181     4996        N        N
-    9912 smbd            8565     1906      181     4996        N        N
-   25800 smbd            8564     1906      181     4995        N        N
-   20452 smbd            8564     1906      181     4995        N        N
-   18592 smbd            8562     1906      181     4993        N        N
-   28216 smbd            8521     1906      181     4954        N        N
-   19110 smbd            8404     1906      181     4862        N        N
-
-   Total memory used:  841,592,832 bytes
+C:\> net use lpt1:	\\servername\spoolservice

    -

    +

    C:\> print filename
+

    What If Things Don't Work?

    Then you might read the file chapter diagnosis + and the FAQ. If you are still stuck then refer to "Analysing and solving problems". + Samba has been successfully installed at thousands of sites worldwide, + so maybe someone else has hit your problem and has overcome it.

    Common Errors

    +The following questions and issues get raised on the samba mailing list over and over again. +

    Large number of smbd processes

    Samba consists on three core programs: nmbd, smbd, winbindd. nmbd is the name server message daemon, smbd is the server message daemon, winbindd is the daemon that @@ -403,19 +357,20 @@ two (2) instances - one to handle the WINS requests. connection made. That is why you are seeing so many of them, one (1) per client connection.

    winbindd will run as one or two daemons, depending on whether or not it is being -run in "split mode" (in which case there will be two instances). -

    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

    Your loopback device isn't working correctly. Make sure it's running.

    Chapter 3. Fast Start for the Impatient

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +run in "split mode" (in which case there will be two instances). +

    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"

    Your loopback device isn't working correctly. Make sure it's configured properly. The loopback device is an internal (virtual) network device with + the ip address 127.0.0.1. Read your OS documentation for details + on how to configure the loopback on your system.

    "The network name cannot be found"

    + This error can be caused by one of these misconfigurations: +

    • You specified an nonexisting path for the share in smb.conf

    • The user you are trying to access the share with does not + have sufficient permissions to access the path for the share. Both read (r) and access (x) should be possible.

    • The share you are trying to access does not exist.

    Chapter 3. Fast Start for the Impatient

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Server Configuration Basics

    First Steps in Server Configuration

    +

    Server Configuration Basics

    First Steps in Server Configuration

    Samba can operate in various modes within SMB networks. This HOWTO section contains information on configuring samba to function as the type of server your network requires. Please read this section carefully. -

    Table of Contents

    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Seamless Windows Network Integration
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not -exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note

    Chapter 4. Server Types and Security Modes

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Seamless Windows Network Integration
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server

    +

    Table of Contents

    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password checking
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    '$' cannot be included in machine name
    Joining domain fails because of existing machine account
    The system can not log you on (C000019B)....
    The machine trust account not accessible
    Account disabled
    Domain Controller Unavailable
    Can not log onto domain member workstation after joining domain
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note

    Chapter 4. Server Types and Security Modes

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password checking
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server

    This chapter provides information regarding the types of server that Samba may be configured to be. A Microsoft network administrator who wishes to migrate to or to use Samba will want to know what, within a Samba context, terms familiar to MS Windows @@ -425,10 +380,11 @@ modes function BEFORE we get into the details of how to configure the server its The chapter provides an overview of the security modes of which Samba is capable and how these relate to MS Windows servers and clients.

    -Firstly we should recognise the question so often asked, "Why would I want to use Samba?" -So, in those chapters where the answer may be important you will see a section that highlights -features and benefits. These may be for or against Samba. -

    Features and Benefits

    +A question often asked is, "Why would I want to use Samba?" Most chapters contain a section +that highlights features and benefits. We hope that the information provided will help to +answer this question. Be warned though, we want to be fair and reasonable, so not all +features are positive towards Samba so the benefit may be on the side of our competition. +

    Features and Benefits

    Two men were walking down a dusty road, when one suddenly kicked up a small red stone. It hurt his toe and lodged in his sandal. He took the stone out and cursed it with a passion and fury fitting his anguish. The other looked at the stone and said, that is a garnet - I @@ -440,7 +396,7 @@ pleasure, but if you are forced upon it and have no time for its secrets then it a source of discomfort.

    Samba started out as a project that sought to provide interoperability for MS Windows 3.x -clients with a Unix server. It has grown up a lot since its humble beginnings and now provides +clients with a UNIX server. It has grown up a lot since its humble beginnings and now provides features and functionality fit for large scale deployment. It also has some warts. In sections like this one we will tell of both.

    @@ -464,14 +420,14 @@ So now, what are the benefits of features mentioned in this chapter? greater flexibility than MS Windows NT4 and in many cases a significantly higher utility than Active Directory domains with MS Windows 200x. -

    Server Types

    Administrators of Microsoft networks often refer to three -different type of servers:

    • Domain Controller

      Primary Domain Controller
      Backup Domain Controller
      ADS Domain Controller

    • Domain Member Server

      Active Directory Member Server
      NT4 Style Domain Member Server

    • Stand Alone Server

    +

    Server Types

    Administrators of Microsoft networks often refer to three +different type of servers:

    • Domain Controller

      • Primary Domain Controller

      • Backup Domain Controller

      • ADS Domain Controller

    • Domain Member Server

      • Active Directory Domain Server

      • NT4 Style Domain Domain Server

    • Stand Alone Server

    The chapters covering Domain Control, Backup Domain Control and Domain Membership provide -pertinent information regarding Samba-3 configuration for each of these server roles. +pertinent information regarding Samba configuration for each of these server roles. The reader is strongly encouraged to become intimately familiar with the information presented. -

    Samba Security Modes

    -In this section the function and purpose of Samba's security +

    Samba Security Modes

    +In this section the function and purpose of Samba's security modes are described. An accurate understanding of how Samba implements each security mode as well as how to configure MS Windows clients for each mode will significantly reduce user complaints and administrator heartache. @@ -486,7 +442,7 @@ ways that allow the security levels to be implemented. In actual fact, Samba imp ADS, and SERVER modes. They are documented in this chapter.

    -A SMB server tells the client at startup what security level + A SMB server tells the client at startup what security level it is running. There are two options: share level and user level. Which of these two the client receives affects the way the client then tries to authenticate itself. It does not directly affect @@ -494,8 +450,8 @@ the way the client then tries to authenticate itself. It does not directly affec but it fits in with the client/server approach of SMB. In SMB everything is initiated and controlled by the client, and the server can only tell the client what is available and whether an action is allowed. -

    User Level Security

    -We will describe user level security first, as it's simpler. +

    User Level Security

    +We will describe user level security first, as it's simpler. In user level security, the client will send a session setup command directly after the protocol negotiation. This contains a username and password. The server can either accept or reject that @@ -512,13 +468,11 @@ It is also possible for a client to send multiple ses requests. When the server responds, it gives the client a uid to use as an authentication tag for that username/password. The client can maintain multiple authentication contexts in this way (WinDD is an example of an application that does this). -

    Example Configuration

    +

    Example Configuration

    The smb.conf parameter that sets User Level Security is: -

    -	security = user
-

    +

    security = user

    This is the default setting since samba-2.2.x. -

    Share Level Security

    +

    Share Level Security

    Ok, now for share level security. In share level security, the client authenticates itself separately for each share. It will send a password along with each tree connection (share mount). It does not explicitly send a @@ -538,104 +492,92 @@ level security. They normally send a valid username but no password. Samba recor this username in a list of possible usernames. When the client then does a tree connection it also adds to this list the name of the share they try to connect to (useful for home directories) and any users -listed in the user = smb.conf line. The password is then checked +listed in the user smb.conf line. The password is then checked in turn against these possible usernames. If a match is found then the client is authenticated as that user. -

    Example Configuration

    +

    Example Configuration

    The smb.conf parameter that sets Share Level Security is: -

    -	security = share
-

    +

    security = share

    Please note that there are reports that recent MS Windows clients do not like to work with share mode security servers. You are strongly discouraged from using share level security. -

    Domain Security Mode (User Level Security)

    -When Samba is operating in security = domain mode, +

    Domain Security Mode (User Level Security)

    +When Samba is operating in security = domain mode, the Samba server has a domain security trust account (a machine account) and will cause all authentication requests to be passed through to the domain controllers. -

    Example Configuration

    +

    Example Configuration

    Samba as a Domain Member Server

    This method involves addition of the following parameters in the smb.conf file: -

    -        security = domain
-        workgroup = "name_of_NT_domain"
-

    +

    security = domain
    workgroup = MIDEARTH

    In order for this method to work, the Samba server needs to join the MS Windows NT security domain. This is done as follows:

    1. On the MS Windows NT domain controller, using the Server Manager, add a machine account for the Samba server. -

    2. Next, on the Unix/Linux system execute:

      root# smbpasswd -j DOMAIN_NAME -r PDC_NAME (samba-2.x)

      root# net join -U administrator%password (samba-3)

    Note

    -As of Samba-2.2.4 the Samba 2.2.x series can auto-join a Windows NT4 style Domain just -by executing: +

  • Next, on the UNIX/Linux system execute:

    root# net rpc join -U administrator%password

    • Note

    +Samba-2.2.4 and later can auto-join a Windows NT4 style Domain just by executing: 

    -root# smbpasswd -j DOMAIN_NAME -r PDC_NAME -U Administrator%password
+root# smbpasswd -j DOMAIN_NAME -r PDC_NAME \
+	 -U Administrator%password

    -As of Samba-3 the same can be done by executing: +Samba-3 can do the same by executing: 

    -root# net join -U Administrator%password
+root# net rpc join -U Administrator%password

    -It is not necessary with Samba-3 to specify the DOMAIN_NAME or the PDC_NAME as it -figures this out from the smb.conf file settings. +It is not necessary with Samba-3 to specify the DOMAIN_NAME or the +PDC_NAME as it figures this out from the smb.conf file settings.

    -Use of this mode of authentication does require there to be a standard Unix account -for each user in order to assign a uid once the account has been authenticated by +Use of this mode of authentication does require there to be a standard UNIX account +for each user in order to assign a UID once the account has been authenticated by the remote Windows DC. This account can be blocked to prevent logons by clients other than -MS Windows through things such as setting an invalid shell in the +MS Windows through means such as setting an invalid shell in the /etc/passwd entry.

    An alternative to assigning UIDs to Windows users on a Samba member server is -presented in the Winbind Overview chapter -in this HOWTO collection. +presented in the chapter about winbind.

    -For more information of being a domain member, see the Domain -Member section of this Howto. -

    ADS Security Mode (User Level Security)

    + For more information of being a domain member, see the chapter about domain membership. +

    ADS Security Mode (User Level Security)

    Both Samba 2.2 and 3.0 can join an Active Directory domain. This is -possible even if the domain is run in native mode. Active Directory in -native mode perfectly allows NT4-style domain members, contrary to +possible if the domain is run in native mode. Active Directory in +native mode perfectly allows NT4-style domain members. This is contrary to popular belief. The only thing that Active Directory in native mode prohibits is Backup Domain Controllers running NT4.

    -If you are running Active Directory starting with Samba 3.0 you can -however join as a native AD member. Why would you want to do that? +If you are using Active Directory, starting with Samba-3 you can +join as a native AD member. Why would you want to do that? Your security policy might prohibit the use of NT-compatible authentication protocols. All your machines are running Windows 2000 -and above and all use full Kerberos. In this case Samba as a NT4-style +and above and all use Kerberos. In this case Samba as a NT4-style domain would still require NT-compatible authentication data. Samba in -AD-member mode can accept Kerberos. -

    Example Configuration

    -	realm = your.kerberos.REALM
-	security = ADS
-

    - The following parameter may be required: -

    -	ads server = your.kerberos.server
-

    -Please refer to the Domain Membership and Active Directory -Membership sections for more information regarding this configuration option. -

    Server Security (User Level Security)

    +AD-member mode can accept Kerberos tickets. +

    Example Configuration

    realm = your.kerberos.REALM
    security = ADS

    +The following parameter may be required: +

    ads server = your.kerberos.server

    +Please refer to the chapter on domain membership +for more information regarding this configuration option. +

    Server Security (User Level Security)

    Server security mode is a left over from the time when Samba was not capable of acting as a domain member server. It is highly recommended NOT to use this feature. Server security mode has many draw backs. The draw backs include: -

    Potential Account Lockout on MS Windows NT4/200x password servers
    Lack of assurance that the password server is the one specified
    Does not work with Winbind, particularly needed when storing profiles remotely
    This mode may open connections to the password server, and keep them open for extended periods.
    Security on the Samba server breaks badly when the remote password server suddenly shuts down
    With this mode there is NO security account in the domain that the password server belongs to for the Samba server.

    +

    • Potential Account Lockout on MS Windows NT4/200x password servers

    • Lack of assurance that the password server is the one specified

    • Does not work with Winbind, particularly needed when storing profiles remotely

    • This mode may open connections to the password server, and keep them open for extended periods.

    • Security on the Samba server breaks badly when the remote password server suddenly shuts down

    • With this mode there is NO security account in the domain that the password server belongs to for the Samba server.

    In server security mode the Samba server reports to the client that it is in user level security. The client then does a session setup as described earlier. The Samba server takes the username/password that the client sends and attempts to login to the -password server by sending exactly the same username/password that +password server by sending exactly the same username/password that it got from the client. If that server is in user level security and accepts the password, then Samba accepts the clients connection. This allows the Samba server to use another SMB -server as the password server. +server as the password server.

    You should also note that at the very start of all this, where the server tells the client what security level it is in, it also tells the client if it supports encryption. If it does then it supplies the client with a random cryptkey. The client will then send all passwords in encrypted form. Samba supports this type of encryption by default.

    -The parameter security = server means that Samba reports to clients that +The parameter security = server means that Samba reports to clients that it is running in user mode but actually passes off all authentication requests to another user mode server. This requires an additional -parameter password server that points to the real authentication server. +parameter password server that points to the real authentication server. That real authentication server can be another Samba server or can be a Windows NT server, the later natively capable of encrypted password support.

    Note

    @@ -646,17 +588,13 @@ lookups because the choice of the target authentication server is arbitrary and be determined from a domain name. In essence, a Samba server that is in server security mode is operating in what used to be known as workgroup mode. -

    Example Configuration

    +

    Example Configuration

    Using MS Windows NT as an authentication server

    This method involves the additions of the following parameters in the smb.conf file: -

    -        encrypt passwords = Yes
-        security = server
-        password server = "NetBIOS_name_of_a_DC"
-

    -There are two ways of identifying whether or not a username and password pair was valid -or not. One uses the reply information provided as part of the authentication messaging +

    encrypt passwords = Yes
    security = server
    password server = "NetBIOS_name_of_a_DC"

    +There are two ways of identifying whether or not a username and password pair was valid. +One uses the reply information provided as part of the authentication messaging process, the other uses just an error code.

    The down-side of this mode of configuration is the fact that for security reasons Samba @@ -665,9 +603,9 @@ server fails to reject the username and password pair then an alternative mode o identification of validation is used. Where a site uses password lock out after a certain number of failed authentication attempts this will result in user lockouts.

    -Use of this mode of authentication does require there to be a standard Unix account +Use of this mode of authentication does require there to be a standard UNIX account for the user, though this account can be blocked to prevent logons by non-SMB/CIFS clients. -

    Seamless Windows Network Integration

    +

    Password checking

    MS Windows clients may use encrypted passwords as part of a challenge/response authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or clear text strings for simple password based authentication. It should be realized that with the SMB protocol, @@ -681,7 +619,7 @@ is encrypted in two ways:

  • The password is converted to upper case, and then padded or truncated to 14 bytes. This string is then appended with 5 bytes of NULL characters and split to - form two 56 bit DES keys to encrypt a "magic" 8 byte value. + form two 56 bit DES keys to encrypt a "magic" 8 byte value. The resulting 16 bytes form the LanMan hash.

    • MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0 @@ -704,29 +642,26 @@ is definitely not a good idea to re-enable plain text password support in such c The following parameters can be used to work around the issue of Windows 9x clients upper casing usernames and password before transmitting them to the SMB server when using clear text authentication. -

    -        password level = integer
-        username level = integer
-

    +

    password level = integer
    username level = integer

    By default Samba will lower case the username before attempting to lookup the user in the database of local system accounts. Because UNIX usernames conventionally -only contain lower case character, the username level parameter +only contain lower-case character, the username level parameter is rarely needed.

    -However, passwords on UNIX systems often make use of mixed case characters. +However, passwords on UNIX systems often make use of mixed-case characters. This means that in order for a user on a Windows 9x client to connect to a Samba -server using clear text authentication, the password level -must be set to the maximum number of upper case letter which could -appear is a password. Note that the server OS uses the traditional DES version -of crypt(), a password level of 8 will result in case +server using clear text authentication, the password level +must be set to the maximum number of upper case letters which could +appear in a password. Note that if the server OS uses the traditional DES version +of crypt(), a password level of 8 will result in case insensitive passwords as seen from Windows users. This will also result in longer login times as Samba has to compute the permutations of the password string and try them one by one until a match is located (or all combinations fail).

    -The best option to adopt is to enable support for encrypted passwords where ever +The best option to adopt is to enable support for encrypted passwords wherever Samba is used. Most attempts to apply the registry change to re-enable plain text passwords will eventually lead to user complaints and unhappiness. -

    Common Errors

    +

    Common Errors

    We all make mistakes. It is Ok to make mistakes, so long as they are made in the right places and at the right time. A mistake that causes lost productivity is seldom tolerated. A mistake made in a developmental test lab is expected. @@ -736,32 +671,29 @@ on the Samba mailing lists. Many of these are avoidable by doing you homework be a Samba implementation. Some are the result of misunderstanding of the English language. The English language has many turns of phrase that are potentially vague and may be highly confusing to those for whom English is not their native tongue. -

    What makes Samba a SERVER?

    +

    What makes Samba a SERVER?

    To some the nature of the Samba security mode is very obvious, but entirely -wrong all the same. It is assumed that security = server means that Samba +wrong all the same. It is assumed that security = server means that Samba will act as a server. Not so! See above - this setting means that Samba will try to use another SMB server as its source of user authentication alone. -

    What makes Samba a Domain Controller?

    -The smb.conf parameter security = domain does NOT really make Samba behave +

    What makes Samba a Domain Controller?

    +The smb.conf parameter security = domain does NOT really make Samba behave as a Domain Controller! This setting means we want Samba to be a domain member! -

    What makes Samba a Domain Member?

    -Guess! So many others do. But whatever you do, do NOT think that security = user +

    What makes Samba a Domain Member?

    +Guess! So many others do. But whatever you do, do NOT think that security = user makes Samba act as a domain member. Read the manufacturers manual before the warranty expires! See -the Domain Member section of this Howto for more information. -

    Constantly Losing Connections to Password Server

    +the chapter about domain membership for more information. +

    Constantly Losing Connections to Password Server

    + “ Why does server_validate() simply give up rather than re-establishing its connection to the password server? Though I am not fluent in the SMB protocol, perhaps the cluster server process passes along to its client workstation the session key it receives from the password server, which means the password hashes submitted by the client would not work on a subsequent -connection, whose session key would be different. So server_validate() must give up. -

    -Indeed. That's why security = server is at best a nasty hack. Please use security = domain. -security = server mode is also known as pass-through authentication. -

    Chapter 5. Domain Control

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    David Bannon

    Samba Team

    Table of Contents

    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not -exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

    The Essence of Learning:  +connection, whose session key would be different. So server_validate() must give up.” +

    + Indeed. That's why security = server is at best a nasty hack. Please use security = domain. +security = server mode is also known as pass-through authentication. +

    Chapter 5. Domain Control

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    David Bannon

    Samba Team

    Table of Contents

    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    '$' cannot be included in machine name
    Joining domain fails because of existing machine account
    The system can not log you on (C000019B)....
    The machine trust account not accessible
    Account disabled
    Domain Controller Unavailable
    Can not log onto domain member workstation after joining domain

    The Essence of Learning:  There are many who approach MS Windows networking with incredible misconceptions. That's OK, because it gives the rest of us plenty of opportunity to be of assistance. Those who really want help would be well advised to become familiar with information @@ -769,18 +701,18 @@ that is already available.

    The reader is advised NOT to tackle this section without having first understood and mastered some basics. MS Windows networking is not particularly forgiving of -misconfiguration. Users of MS Windows networking are likely to complain bitterly -of persistent niggles that may be caused by broken network or system configuration. +misconfiguration. Users of MS Windows networking are likely to complain +of persistent niggles that may be caused by a broken network configuration. To a great many people however, MS Windows networking starts with a domain controller that in some magical way is expected to solve all ills. -

    +

    Figure 5.1. An Example Domain

    An Example Domain

    From the Samba mailing list one can readily identify many common networking issues. If you are not clear on the following subjects, then it will do much good to read the sections of this HOWTO that deal with it. These are the most common causes of MS Windows networking problems: -

    Basic TCP/IP configuration
    NetBIOS name resolution
    Authentication configuration
    User and Group configuration
    Basic File and Directory Permission Control in Unix/Linux
    Understanding of how MS Windows clients interoperate in a network - environment

    -Do not be put off; on the surface of it MS Windows networking seems so simple that any fool +

    • Basic TCP/IP configuration

    • NetBIOS name resolution

    • Authentication configuration

    • User and Group configuration

    • Basic File and Directory Permission Control in UNIX/Linux

    • Understanding of how MS Windows clients interoperate in a network + environment

    +Do not be put off; on the surface of it MS Windows networking seems so simple that anyone can do it. In fact, it is not a good idea to set up an MS Windows network with inadequate training and preparation. But let's get our first indelible principle out of the way: It is perfectly OK to make mistakes! In the right place and at @@ -791,7 +723,7 @@ burden on an organisation. Where is the right place to make mistakes? Only out of harm's way! If you are going to make mistakes, then please do this on a test network, away from users and in such a way as to not inflict pain on others. Do your learning on a test network. -

    Features and Benefits

    +

    Features and Benefits

    What is the key benefit of Microsoft Domain security?

    In a word, Single Sign On, or SSO for short. To many, this is the holy @@ -802,13 +734,18 @@ and they will be able to log onto the network and access resources (shares, file as if they are sitting at their home (personal) workstation. This is a feature of the Domain security protocols.

    -The benefits of Domain security are fully available to those sites that deploy a Samba PDC. +The benefits of Domain security are available to those sites that deploy a Samba PDC. +A Domain provides a unique network security identifier (SID). Domain user and group security +identifiers are comprised of the network SID plus a relative identifier (RID) that is unique to +the account. User and Group SIDs (the network SID plus the RID) can be used to create Access Control +Lists (ACLs) attached to network resources to provide organizational access control. UNIX systems +know only of local security identifiers.

    Note

    Network clients of an MS Windows Domain security environment must be Domain members to be able to gain access to the advanced features provided. Domain membership involves more than just setting the workgroup name to the Domain name. It requires the creation of a Domain trust account for the workstation (called a machine account). Please refer to the chapter on -Domain Membership for more information. +setting up samba as a domain member for more information.

    The following functionalities are new to the Samba-3 release:

    • @@ -816,8 +753,7 @@ The following functionalities are new to the Samba-3 release:

    • Adding users via the User Manager for Domains. This can be done on any MS Windows client using the Nexus toolkit that is available from Microsoft's web site. - At some later date Samba-3 may get support for the use of the Microsoft Management - Console for user management. + Samba-3 supports the use of the Microsoft Management Console for user management.

    • Introduces replaceable and multiple user account (authentication) back ends. In the case where the back end is placed in an LDAP database, @@ -831,14 +767,18 @@ The following functionalities are new to the Samba-3 release: The following functionalities are NOT provided by Samba-3:

      • SAM replication with Windows NT4 Domain Controllers - (i.e. a Samba PDC and a Windows NT BDC or vice versa) + (i.e. a Samba PDC and a Windows NT BDC or vice versa). This means samba + cannot operate as a BDC when the PDC is Microsoft-based or + replicate account data to Windows-BDC's.

      • Acting as a Windows 2000 Domain Controller (i.e. Kerberos and Active Directory) - In point of fact, Samba-3 DOES have some Active Directory Domain Control ability that is at this time purely experimental AND that is certain to change as it becomes a fully supported feature some time - during the Samba-3 (or later) life cycle. + during the Samba-3 (or later) life cycle. However, Active Directory is + more then just SMB - it's also LDAP, Kerberos, DHCP and other protocols + (with proprietary extensions, of course).

      Windows 9x / Me / XP Home clients are not true members of a domain for reasons outlined in this chapter. The protocol for support of Windows 9x / Me style network (domain) logons @@ -847,67 +787,33 @@ for some time. These clients use the old LanMan Network Logon facilities that ar in Samba since approximately the Samba-1.9.15 series.

      Samba-3 has an implementation of group mapping between Windows NT groups -and Unix groups (this is really quite complicated to explain in a short space). This is -discussed more fully in the Group Mapping chapter. +and UNIX groups (this is really quite complicated to explain in a short space). This is +discussed more fully in the chapter on group mapping.

      Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store -user and machine trust account information in a suitable backend data store. With Samba-3 -there can be multiple back-ends for this including: -

      • - smbpasswd - the plain ASCII file stored used by - earlier versions of Samba. This file configuration option requires - a Unix/Linux system account for EVERY entry (ie: both for user and for - machine accounts). This file will be located in the private - directory (default is /usr/local/samba/lib/private or on linux /etc/samba). -

      • - tdbsam - a binary database backend that will be - stored in the private directory in a file called - passdb.tdb. The key benefit of this binary format - file is that it can store binary objects that can not be accommodated - in the traditional plain text smbpasswd file. These permit the extended - account controls that MS Windows NT4 and later also have. -

      • - ldapsam - An LDAP based back-end. Permits the - LDAP server to be specified. eg: ldap://localhost or ldap://frodo.murphy.com. - Like the tdbsam, ldapsam permits the storing of extended account attributes - for control of things like: Permitted access times, password activation and - expiry, permitted points of access (workstation names), per user profile - location, and much more. -

      • - ldapsam_compat - An LDAP back-end that maintains backwards - compatibility with the behaviour of samba-2.2.x. You should use this in the process - of migrating from samba-2.2.x to samba-3 if you do not want to rebuild your LDAP - database. -

      -Read the chapter about Account Information Database for details -regarding the choices available and how to configure them. -

      Note

      -The new tdbsam and ldapsam account backends store substantially more information than -smbpasswd is capable of. The new backend database includes capacity to specify -per user settings for many parameters, over-riding global settings given in the -smb.conf file. eg: logon drive, logon home, logon path, etc. -Thus, with samba-3 it is possible to have a default system configuration for profiles, -and on a per user basis to over-ride this for those users who should not be subject -to the default configuration. -

    Basics of Domain Control

    +user and machine trust account information in a suitable backend data store. +Refer to the section on machine trust accounts. With Samba-3 there can be multiple +back-ends for this. A complete discussion of account database backends can be found in +the chapter on Account Information Databases. +

    Basics of Domain Control

    Over the years, public perceptions of what Domain Control really is has taken on an almost mystical nature. Before we branch into a brief overview of Domain Control, there are three basic types of domain controllers: -

    Domain Controller Types

    • Primary Domain Controller

    • Backup Domain Controller

    • ADS Domain Controller

    +

    Domain Controller Types

    • Primary Domain Controller

    • Backup Domain Controller

    • ADS Domain Controller

    The Primary Domain Controller or PDC plays an important role in the MS -Windows NT4 and Windows 200x Domain Control architecture, but not in the manner that so many -expect. There is folk lore that dictates that because of it's role in the MS Windows -network, the PDC should be the most powerful and most capable machine in the network. +Windows NT4. In Windows 200x Domain Control architecture this role is held by domain controllers. +There is folk lore that dictates that because of it's role in the MS Windows +network, the domain controllers should be the most powerful and most capable machine in the network. As strange as it may seem to say this here, good over all network performance dictates that -the entire infrastructure needs to be balanced. It is advisable to invest more in the Backup -Domain Controllers and Stand-Alone (or Domain Member) servers than in the PDC. +the entire infrastructure needs to be balanced. It is advisable to invest more in Stand-Alone +(or Domain Member) servers than in the domain controllers.

    -In the case of MS Windows NT4 style domains, it is the PDC seeds the Domain Control database, -a part of the Windows registry called the SAM (Security Account Manager). It plays a key +In the case of MS Windows NT4 style domains, it is the PDC that initiates a new Domain Control database. +This forms a part of the Windows registry called the SAM (Security Account Manager). It plays a key part in NT4 type domain user authentication and in synchronisation of the domain authentication database with Backup Domain Controllers.

    -With MS Windows 200x Server based Active Directory domains, one domain controller seeds a potential +With MS Windows 200x Server based Active Directory domains, one domain controller initiates a potential hierarchy of domain controllers, each with their own area of delegated control. The master domain controller has the ability to override any down-stream controller, but a down-line controller has control only over it's down-line. With Samba-3 this functionality can be implemented using an @@ -915,9 +821,7 @@ LDAP based user and machine account back end.

    New to Samba-3 is the ability to use a back-end database that holds the same type of data as the NT4 style SAM (Security Account Manager) database (one of the registry files). -The Samba-3 SAM can be specified via the smb.conf file parameter -passwd backend and valid options include -smbpasswd, tdbsam, ldapsam, nisplussam, xmlsam, mysqlsam, guest. +[1]

    The Backup Domain Controller or BDC plays a key role in servicing network authentication requests. The BDC is biased to answer logon requests in preference to the PDC. @@ -941,11 +845,14 @@ excluding the SAM replication components. However, please be aware that Samba-3 MS Windows 200x domain control protocols also.

    At this time any appearance that Samba-3 is capable of acting as an -ADS Domain Controller is limited and experimental in nature. +Domain Controller in native ADS mode is limited and experimental in nature. This functionality should not be used until the Samba-Team offers formal support for it. At such a time, the documentation will be revised to duly reflect all configuration and -management requirements. -

    Preparing for Domain Control

    +management requirements. Samba can act as a NT4-style DC in a Windows 2000/XP +environment. However, there are certain compromises: + +

    • No machine policy files

    • No Group Policy Objects

    • No synchronously executed AD logon scripts

    • Can't use ANY Active Directory management tools to manage users and machines

    • Registry changes tattoo the main registry, while with AD they do NOT. ie: Leave permanent changes in effect

    • Without AD you can not peprform the function of exporting specific applications to specific users or groups

    +

    Preparing for Domain Control

    There are two ways that MS Windows machines may interact with each other, with other servers, and with Domain Controllers: Either as Stand-Alone systems, more commonly called Workgroup members, or as full participants in a security system, @@ -967,23 +874,22 @@ Domain it triggers a machine password change.

    Note

    When running a Domain all MS Windows NT / 200x / XP Professional clients should be configured as full Domain Members - IF A SECURE NETWORK IS WANTED. If the machine is NOT made a member of the -Domain, then it will operate like a workgroup (stand-alone) machine. Please refer the -Domain Membership chapter for information regarding - HOW to make your MS Windows clients Domain members. +Domain, then it will operate like a workgroup (stand-alone) machine. Please refer to +the chapter on domain membership for information regarding HOW to make your MS Windows clients Domain members.

    The following are necessary for configuring Samba-3 as an MS Windows NT4 style PDC for MS Windows NT4 / 200x / XP clients. -

    Configuration of basic TCP/IP and MS Windows Networking
    Correct designation of the Server Role (security = user)
    Consistent configuration of Name Resolution (See chapter on Browsing and on - MS Windows network Integration)
    Domain logons for Windows NT4 / 200x / XP Professional clients
    Configuration of Roaming Profiles or explicit configuration to force local profile usage
    Configuration of Network/System Policies
    Adding and managing domain user accounts
    Configuring MS Windows client machines to become domain members

    +

    • Configuration of basic TCP/IP and MS Windows Networking

    • Correct designation of the Server Role (security = user)

    • Consistent configuration of Name Resolution (See chapter on Network Browsing and on + Integrating Unix into Windows networks)

    • Domain logons for Windows NT4 / 200x / XP Professional clients

    • Configuration of Roaming Profiles or explicit configuration to force local profile usage

    • Configuration of Network/System Policies

    • Adding and managing domain user accounts

    • Configuring MS Windows client machines to become domain members

    The following provisions are required to serve MS Windows 9x / Me Clients: -

    Configuration of basic TCP/IP and MS Windows Networking
    Correct designation of the Server Role (security = user)
    Network Logon Configuration (Since Windows 9x / XP Home are not technically domain - members, they do not really participate in the security aspects of Domain logons as such)
    Roaming Profile Configuration
    Configuration of System Policy handling
    Installation of the Network driver "Client for MS Windows Networks" and configuration - to log onto the domain
    Placing Windows 9x / Me clients in user level security - if it is desired to allow - all client share access to be controlled according to domain user / group identities.
    Adding and managing domain user accounts

    Note

    +

    • Configuration of basic TCP/IP and MS Windows Networking

    • Correct designation of the Server Role (security = user)

    • Network Logon Configuration (Since Windows 9x / XP Home are not technically domain + members, they do not really participate in the security aspects of Domain logons as such)

    • Roaming Profile Configuration

    • Configuration of System Policy handling

    • Installation of the Network driver "Client for MS Windows Networks" and configuration + to log onto the domain

    • Placing Windows 9x / Me clients in user level security - if it is desired to allow + all client share access to be controlled according to domain user / group identities.

    • Adding and managing domain user accounts

    Note

    Roaming Profiles and System/Network policies are advanced network administration topics that are covered in the Profile Management and -Policy Management chapters of this document. However, these are not necessarily specific -to a Samba PDC as much as they are related to Windows NT networking concepts. +Policy Management chapters of this document. However, these are not +necessarily specific to a Samba PDC as much as they are related to Windows NT networking concepts.

    A Domain Controller is an SMB/CIFS server that:

    • @@ -998,120 +904,86 @@ A Domain Controller is an SMB/CIFS server that: Provides a share called NETLOGON

    For Samba to provide these is rather easy to configure. Each Samba Domain Controller must provide -the NETLOGON service which Samba calls the domain logons functionality +the NETLOGON service which Samba calls the domain logons functionality (after the name of the parameter in the smb.conf file). Additionally, one (1) server in a Samba-3 -Domain must advertise itself as the domain master browser. This causes the Primary Domain Controller +Domain must advertise itself as the domain master browser[2]. This causes the Primary Domain Controller to claim domain specific NetBIOS name that identifies it as a domain master browser for its given domain/workgroup. Local master browsers in the same domain/workgroup on broadcast-isolated subnets then ask for a complete copy of the browse list for the whole wide area network. Browser clients will then contact their local master browser, and will receive the domain-wide browse list, instead of just the list for their broadcast-isolated subnet. -

    Domain Control - Example Configuration

    +

    Domain Control - Example Configuration

    The first step in creating a working Samba PDC is to understand the parameters necessary -in smb.conf. Here we attempt to explain the parameters that are covered in -the smb.conf man page. -

    -Here is an example smb.conf for acting as a PDC: -

    -	[global]
-	    ; Basic server settings
-	    netbios name = POGO
-	    workgroup = NARNIA
-
-	    ; User and Machine Account Backends
-	    ; Choices are: tdbsam, smbpasswd, ldapsam, mysqlsam, xmlsam, guest
-	    passdb backend = ldapsam, guest
-
-	    ; we should act as the domain and local master browser
-	    os level = 64
-	    preferred master = yes
-	    domain master = yes
-	    local master = yes
-	    
-	    ; security settings (must user security = user)
-	    security = user
-	    
-	    ; encrypted passwords are a requirement for a PDC (default = Yes)
-	    encrypt passwords = yes
-	    
-	    ; support domain logons
-	    domain logons = yes
-	    
-	    ; where to store user profiles?
-	    logon path = \\%N\profiles\%u
-	    
-	    ; where is a user's home directory and where should it be mounted at?
-	    logon drive = H:
-	    logon home = \\homeserver\%u\winprofile
-	    
-	    ; specify a generic logon script for all users
-	    ; this is a relative **DOS** path to the [netlogon] share
-	    logon script = logon.cmd
-
-	; necessary share for domain controller
-	[netlogon]
-	    path = /usr/local/samba/lib/netlogon
-	    read only = yes
-	    write list = ntadmin
-	    
-	; share for storing user profiles
-	[profiles]
-	    path = /export/smb/ntprofile
-	    read only = no
-	    create mask = 0600
-	    directory mask = 0700
-

    Note

    +in smb.conf. An example smb.conf for acting as a PDC can be found in the example +for being a PDC. +

    +

    Example 5.1. smb.conf for being a PDC

    [global]
    netbios name = BELERIAND
    workgroup = MIDEARTH
    passdb backend = ldapsam, guest
    os level = 33
    preferred master = yes
    domain master = yes
    local master = yes
    security = user
    encrypt passwords = yes
    domain logons = yes
    logon path = \\%N\profiles\%u
    logon drive = H:
    logon home = \\homeserver\%u\winprofile
    logon script = logon.cmd
    [netlogon]
    path = /var/lib/samba/netlogon
    read only = yes
    write list = ntadmin
    [profiles]
    path = /var/lib/samba/profiles
    read only = no
    create mask = 0600
    directory mask = 0700

    +

    +The basic options shown above are explained as follows: +

    passdb backend

    + This contains all the user and group account information. Acceptable values for a PDC + are: smbpasswd, tdbsam, ldapsam. The 'guest' entry provides needed + default accounts.

    + Where is is intended to use backup domain controllers (BDCs) the only logical choice is + to use LDAP so that the passdb backend can be distributed. The tdbsam and smbpasswd files + can not effectively be distributed and therefore should not be used. +

    Domain Control Parameters

    + The parameters os level, preferred master, domain master, security, + encrypt passwords, domain logons play a central role in assuring domain + control and network logon support.

    + The os level must be set at or above a value of 32. A domain controller + must be the domain master browser, must be set in user mode security, + must support Microsoft compatible encrypted passwords, and must provide the network logon + service (domain logons). Encrypted passwords must be enabled, for more details on how + to do this, refer to the chapter on account information databases. +

    Environment Parameters

    + The parameters logon path, logon home, logon drive, logon script are + environment support settings that help to facilitate client logon operations and that help + to provide automated control facilities to ease network management overheads. Please refer + to the man page information for these parameters. +

    NETLOGON Share

    + The NETLOGON share plays a central role in domain logon and domain membership support. + This share is provided on all Microsoft domain controllers. It is used to provide logon + scripts, to store Group Policy files (NTConfig.POL), as well as to locate other common + tools that may be needed for logon processing. This is an essential share on a domain controller. +

    PROFILE Share

    + This share is used to store user desktop profiles. Eash user must have a directory at the root + of this share. This directory must be write enabled for the user and must be globally read enabled. + Samba-3 has a VFS module called 'fake_permissions' that may be installed on this share. This will + allow a Samba administrator to make the directory read only to everyone. Of course this is useful + only after the profile has been properly created. +

    Note

    The above parameters make for a full set of parameters that may define the server's mode -of operation. The following parameters are the essentials alone: - -

    -	workgroup = NARNIA
-	domain logons = Yes
-	domain master = Yes
-	security = User
-

    - -The additional parameters shown in the longer listing above just makes for a -more complete environment. -

    -There are a couple of points to emphasize in the above configuration. -

    • - Encrypted passwords must be enabled. For more details on how - to do this, refer to Account Information Database chapter. -

    • - The server must support domain logons and have a - [netlogon] share -

    • - The server must be the domain master browser in order for Windows - client to locate the server as a DC. Please refer to the various - Network Browsing documentation included with this distribution for - details. -

    Samba ADS Domain Control

    -Samba-3 is not and can not act as an Active Directory Server. It can not truly function as +of operation. The following smb.conf parameters are the essentials alone: +

    +

    netbios name = BELERIAND
    workgroup = MIDEARTH
    domain logons = Yes
    domain master = Yes
    security = User

    +

    +The additional parameters shown in the longer listing above just makes for +more complete explanation. +

    Samba ADS Domain Control

    +Samba-3 is not, and can not act as, an Active Directory Server. It can not truly function as an Active Directory Primary Domain Controller. The protocols for some of the functionality -the Active Directory Domain Controllers is have been partially implemented on an experimental -only basis. Please do NOT expect Samba-3 to support these protocols - nor should you depend -on any such functionality either now or in the future. The Samba-Team may well remove such -experimental features or may change their behaviour. -

    Domain and Network Logon Configuration

    -The subject of Network or Domain Logons is discussed here because it rightly forms +the Active Directory Domain Controllers has been partially implemented on an experimental +only basis. Please do NOT expect Samba-3 to support these protocols. Do not depend +on any such functionality either now or in the future. The Samba-Team may remove these +experimental features or may change their behaviour. This is mentioned for the benefit of those +who have discovered secret capabilities in samba-3 and who have asked when this functionality will be +completed. The answer is: Maybe or maybe never! +

    +To be sure: Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4 style +domain controllers have. Samba-3 does NOT have all the capabilities of Windows NT4, but it does have +a number of features that Windows NT4 domain contollers do not have. In short, Samba-3 is not NT4 and it +is not Windows Server 200x and it is not an Active Directory server. We hope this is plain and simple +enough for all to understand. +

    Domain and Network Logon Configuration

    +The subject of Network or Domain Logons is discussed here because it forms an integral part of the essential functionality that is provided by a Domain Controller. -

    Domain Network Logon Service

    +

    Domain Network Logon Service

    All Domain Controllers must run the netlogon service (domain logons -in Samba). One Domain Controller must be configured with domain master = Yes -(the Primary Domain Controller); on ALL Backup Domain Controllers domain master = No +in Samba). One Domain Controller must be configured with domain master = Yes +(the Primary Domain Controller); on ALL Backup Domain Controllers domain master = No must be set. -

    Example Configuration

    -	[global]
-		domain logons = Yes
-		domain master = (Yes on PDC, No on BDCs)
-
-	[netlogon]
-		comment = Network Logon Service
-		path = /var/lib/samba/netlogon
-		guest ok = Yes
-		browseable = No
-

    The Special Case of MS Windows XP Home Edition

    Note

    +

    Example Configuration

    Example 5.2. smb.conf for being a PDC

    [global]
    domain logons = Yes
    domain master = (Yes on PDC, No on BDCs)
    [netlogon]
    comment = Network Logon Service
    path = /var/lib/samba/netlogon
    guest ok = Yes
    browseable = No

    The Special Case of MS Windows XP Home Edition

    Note

    MS Windows XP Home Edition does not have the ability to join any type of Domain security facility. Unlike, MS Windows 9x / Me, MS Windows XP Home Edition also completely lacks the ability to log onto a network. @@ -1123,8 +995,10 @@ MS Windows XP Professional.

    Now that this has been said, please do NOT ask the mailing list, or email any of the Samba-Team members with your questions asking how to make this work. It can't be done. -

    The Special Case of Windows 9x / Me

    -A domain and a workgroup are exactly the same thing in terms of network +If it can be done, then to do so would violate your software license agreement with +Microsoft, and we recommend that you do not do that. +

    The Special Case of Windows 9x / Me

    +A domain and a workgroup are exactly the same in terms of network browsing. The difference is that a distributable authentication database is associated with a domain, for secure login access to a network. Also, different access rights can be granted to users if they @@ -1145,7 +1019,7 @@ which are the focus of this section. When an SMB client in a domain wishes to logon, it broadcasts requests for a logon server. The first one to reply gets the job, and validates its password using whatever mechanism the Samba administrator has installed. -It is possible (but very stupid) to create a domain where the user +It is possible (but ill advised ) to create a domain where the user database is not shared between servers, i.e. they are effectively workgroup servers advertising themselves as participating in a domain. This demonstrates how authentication is quite different from but closely @@ -1196,14 +1070,17 @@ The main difference between a PDC and a Windows 9x logon server configuration is

    • Password encryption is not required for a Windows 9x logon server. But note that beginning with MS Windows 98 the default setting is that plain-text - password support has been disabled. It can be re-enabled with the registry + password support is disabled. It can be re-enabled with the registry changes that are documented in the chapter on Policies.

    • Windows 9x/ME clients do not require and do not use machine trust accounts.

    A Samba PDC will act as a Windows 9x logon server; after all, it does provide the network logon services that MS Windows 9x / Me expect to find. -

    Security Mode and Master Browsers

    +

    Note

    +Use of plain-text passwords is strongly discouraged. Where used they are easily detected +using a sniffer tool to examine network traffic. +

    Security Mode and Master Browsers

    There are a few comments to make in order to tie up some loose ends. There has been much debate over the issue of whether or not it is ok to configure Samba as a Domain Controller in security @@ -1220,24 +1097,25 @@ are two distinctly different functions), it is not a good idea to do so. You should remember that the DC must register the DOMAIN<#1b> NetBIOS name. This is the name used by Windows clients to locate the DC. Windows clients do not distinguish between the DC and the DMB. +A DMB is a Domain Master Browser - see Domain Master Browser. For this reason, it is very wise to configure the Samba DC as the DMB.

    Now back to the issue of configuring a Samba DC to use a mode other -than security = user. If a Samba host is configured to use +than security = user. If a Samba host is configured to use another SMB server or DC in order to validate user connection requests, then it is a fact that some other machine on the network -(the password server) knows more about the user than the Samba host. +(the password server) knows more about the user than the Samba host. 99% of the time, this other host is a domain controller. Now -in order to operate in domain mode security, the workgroup parameter +in order to operate in domain mode security, the workgroup parameter must be set to the name of the Windows NT domain (which already has a domain controller). If the domain does NOT already have a Domain Controller then you do not yet have a Domain!

    Configuring a Samba box as a DC for a domain that already by definition has a PDC is asking for trouble. Therefore, you should always configure the Samba DC -to be the DMB for its domain and set security = user. +to be the DMB for its domain and set security = user. This is the only officially supported mode of operation. -

    Common Problems and Errors

    I cannot include a '$' in a machine name

    +

    Common Errors

    '$' cannot be included in machine name

    A 'machine account', (typically) stored in /etc/passwd, takes the form of the machine name with a '$' appended. FreeBSD (and other BSD systems?) won't create a user with a '$' in their name. @@ -1245,24 +1123,26 @@ systems?) won't create a user with a '$' in their name. The problem is only in the program used to make the entry. Once made, it works perfectly. Create a user without the '$'. Then use vipw to edit the entry, adding the '$'. Or create the whole entry with vipw if you like; make sure you use a unique User ID! -

    I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.

    +

    Note

    +The UNIX tool vipw is a common tool for directly editting the /etc/passwd file. +

    Joining domain fails because of existing machine account

    “I get told "You already have a connection to the Domain...." +or "Cannot join domain, the credentials supplied conflict with an +existing set.." when creating a machine trust account.”

    This happens if you try to create a machine trust account from the machine itself and already have a connection (e.g. mapped drive) to a share (or IPC$) on the Samba PDC. The following command will remove all network drive connections: 

    -	C:\WINNT\> net use * /d
+C:\> net use * /d

    Further, if the machine is already a 'member of a workgroup' that is the same name as the domain you are joining (bad idea) you will get this message. Change the workgroup name to something else, it does not matter what, reboot, and try again. -

    The system can not log you on (C000019B)....

    I joined the domain successfully but after upgrading +

    The system can not log you on (C000019B)....

    “I joined the domain successfully but after upgrading to a newer version of the Samba code I get the message, The system can not log you on (C000019B), Please try again or consult your -system administrator when attempting to logon. +system administrator when attempting to logon.”

    This occurs when the domain SID stored in the secrets.tdb database is changed. The most common cause of a change in domain SID is when @@ -1277,14 +1157,18 @@ The reset or change the domain SID you can use the net command as follows: root# net getlocalsid 'OLDNAME' root# net setlocalsid 'SID'

    -

    The machine trust account for this computer either does not -exist or is not accessible.

    -When I try to join the domain I get the message The machine account +

    +Workstation machine trust accounts work only with the Domain (or network) SID. If this SID changes +then domain members (workstations) will not be able to log onto the domain. The original Domain SID +can be recovered from the secrets.tdb file. The alternative is to visit each workstation to re-join +it to the domain. +

    The machine trust account not accessible

    + “When I try to join the domain I get the message The machine account for this computer either does not exist or is not accessible. What's -wrong? +wrong?”

    This problem is caused by the PDC not having a suitable machine trust account. -If you are using the add machine script method to create +If you are using the add machine script method to create accounts then this would indicate that it has not worked. Ensure the domain admin user system is working.

    @@ -1300,31 +1184,42 @@ Some people have also reported that inconsistent subnet masks between the Samba server and the NT client can cause this problem. Make sure that these are consistent for both client and server. -

    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.

    +

    Account disabled

    “When I attempt to login to a Samba Domain from a NT4/W2K workstation, + I get a message about my account being disabled.”

    Enable the user accounts with smbpasswd -e username , this is normally done as an account is created. -

    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

    +

    Domain Controller Unavailable

    “Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"”

    A domain controller has to announce on the network who it is. This usually takes a while. -

    Chapter 6. Backup Domain Control

    John H. Terpstra

    Samba Team

    Volker Lendecke

    Samba Team

    Table of Contents

    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?

    +

    Can not log onto domain member workstation after joining domain

    After successfully joining the domain user logons fail with one of two messages:

    One to the effect that the domain controller can not be found, the other claiming that the + account does not exist in the domain or that the password is incorrect.

    This may be due to incompatible settings between + the Windows client and the Samba-3 server for schannel (secure channel) settings + or smb signing settings. Check your samba settings for + client schannel, server schannel, client signing, server signing by executing: + testparm -v | more and looking for the value of these parameters. +

    + Also use the Microsoft Management Console - Local Security Settings. This tool is available from the + Control Panel. The Policy settings are found in the Local Policies / Securty Options area and are prefixed by + Secure Channel: ..., and Digitally sign .... +

    + It is important that these be set consistently with the Samba-3 server settings. +


    [1] See also the chapter on Account Information Databases.

    [2] See also the chapter about network browsing

    Chapter 6. Backup Domain Control

    John H. Terpstra

    Samba Team

    Volker Lendecke

    Samba Team

    Table of Contents

    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?

    Before you continue reading in this section, please make sure that you are comfortable -with configuring a Samba Domain Controller as described in the -Domain Control chapter. -

    Features And Benefits

    +with configuring a Samba Domain Controller as described in chapter on setting up Samba as a PDC. +

    Features And Benefits

    This is one of the most difficult chapters to summarise. It does not matter what we say here for someone will still draw conclusions and / or approach the Samba-Team with expectations that are either not yet capable of being delivered, or that can be achieved far more -effectively using a totally different approach. Since this HOWTO is already so large and -extensive, we have taken the decision to provide sufficient (but not comprehensive) -information regarding Backup Domain Control. In the event that you should have a persistent -concern that is not addressed in this HOWTO document then please email +effectively using a totally different approach. In the event that you should have a persistent +concern that is not addressed in this book then please email John H Terpstra clearly setting out your requirements and / or question and we will do our best to provide a solution.

    Samba-3 is capable of acting as a Backup Domain Controller to another Samba Primary Domain -Controller. A Samba-3 PDC can operate with an LDAP Account backend. The Samba-3 BDC can -operate with a slave LDAP server for the Account backend. This effectively gives samba a high -degree of scalability. This is a very sweet (nice) solution for large organisations. +Controller. A Samba-3 PDC can operate with an LDAP Account backend. The LDAP backend can be +either a common master LDAP server, or a slave server. The use of a slave LDAP server has the +benefit that when the master is down clients may still be able to log onto the network. +This effectively gives samba a high degree of scalability iand is a very sweet (nice) solution +for large organisations.

    While it is possible to run a Samba-3 BDC with non-LDAP backend, the administrator will need to figure out precisely what is the best way to replicate (copy / distribute) the @@ -1349,8 +1244,9 @@ lets consider each possible option and look at the pro's and con's for each theo

    Arguments Against: Complexity

  • - Passdb Backend is tdbsam based, BDCs use cron based "net rpc vampire" to - suck down the Accounts database from the PDC + Passdb Backend is tdbsam based, BDCs use cron based net rpc vampire to + obtain the Accounts database from the PDC and place them into the Samba SAM. + net rpc vampire is a Samba function of the "net" command.

    Arguments For: It would be a nice solution

    @@ -1371,7 +1267,7 @@ lets consider each possible option and look at the pro's and con's for each theo Arguments Against: All machine trust accounts and user accounts will be locally maintained. Domain users will NOT be able to roam from office to office. This is a broken and flawed solution. Do NOT do this. -

    • Essential Background Information

    +

    Essential Background Information

    A Domain Controller is a machine that is able to answer logon requests from network workstations. Microsoft LanManager and IBM LanServer were two early products that provided this capability. The technology has become known as the LanMan Netlogon service. @@ -1381,7 +1277,7 @@ and with it a new form of the network logon service that has extended functional This service became known as the NT NetLogon Service. The nature of this service has changed with the evolution of MS Windows NT and today provides a very complex array of services that are implemented over a complex spectrum of technologies. -

    MS Windows NT4 Style Domain Control

    +

    MS Windows NT4 Style Domain Control

    Whenever a user logs into a Windows NT4 / 200x / XP Professional Workstation, the workstation connects to a Domain Controller (authentication server) to validate the username and password that the user entered are valid. If the information entered @@ -1439,32 +1335,29 @@ one of the BDCs can be promoted to a PDC. If this happens while the original PDC line then it is automatically demoted to a BDC. This is an important aspect of Domain Controller management. The tool that is used to affect a promotion or a demotion is the Server Manager for Domains. -

    Example PDC Configuration

    +

    Example PDC Configuration

    Since version 2.2 Samba officially supports domain logons for all current Windows Clients, including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some parameters in the [global]-section of the smb.conf have to be set: -

    -	workgroup = SAMBA
-	domain master = yes
-	domain logons = yes
-

    -Several other things like a [homes] and a [netlogon] share also need to be set along with +

    Example 6.1. Minimal smb.conf for being a PDC

    workgroup = MIDEARTH
    domain master = yes
    domain logons = yes

    +Several other things like a [homes] and a +[netlogon] share also need to be set along with settings for the profile path, the users home drive, etc.. This will not be covered in this -chapter, for more information please refer to the chapter on Domain Control. -

    Active Directory Domain Control

    +chapter, for more information please refer to the chapter about samba as a PDC. +

    Active Directory Domain Control

    As of the release of MS Windows 2000 and Active Directory, this information is now stored in a directory that can be replicated and for which partial or full administrative control can be delegated. Samba-3 is NOT able to be a Domain Controller within an Active Directory tree, and it can not be an Active Directory server. This means that Samba-3 also can NOT act as a Backup Domain Controller to an Active Directory Domain Controller. -

    What qualifies a Domain Controller on the network?

    +

    What qualifies a Domain Controller on the network?

    Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS group name SAMBA<#1c> with the WINS server and/or by broadcast on the local network. The PDC also registers the unique NetBIOS name SAMBA<#1b> with the WINS server. The name type <#1b> name is normally reserved for the Domain Master Browser, a role that has nothing to do with anything related to authentication, but the Microsoft Domain implementation requires the domain master browser to be on the same machine as the PDC. -

    How does a Workstation find its domain controller?

    +

    How does a Workstation find its domain controller?

    An MS Windows NT4 / 200x / XP Professional workstation in the domain SAMBA that wants a local user to be authenticated has to find the domain controller for SAMBA. It does this by doing a NetBIOS name query for the group name SAMBA<#1c>. It assumes that each @@ -1472,22 +1365,22 @@ of the machines it gets back from the queries is a domain controller and can ans requests. To not open security holes both the workstation and the selected domain controller authenticate each other. After that the workstation sends the user's credentials (name and password) to the local Domain Controller, for validation. -

    Backup Domain Controller Configuration

    +

    Backup Domain Controller Configuration

    Several things have to be done:

    • The domain SID has to be the same on the PDC and the BDC. This used to be stored in the file private/MACHINE.SID. This file is not created - anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is - stored in the file private/secrets.tdb. Simply copying the secrets.tdb + since Samba 2.2.5. Nowadays the domain SID is stored in the file + private/secrets.tdb. Simply copying the secrets.tdb from the PDC to the BDC does not work, as the BDC would generate a new SID for itself and override the domain SID with this new BDC SID.

      To retrieve the domain SID from the PDC or an existing BDC and store it in the secrets.tdb, execute: 

      -	root# net rpc getsid
-

    • - The Unix user database has to be synchronized from the PDC to the +root# net rpc getsid +

    • + The UNIX user database has to be synchronized from the PDC to the BDC. This means that both the /etc/passwd and /etc/group have to be replicated from the PDC to the BDC. This can be done manually whenever changes are made, or the PDC is set up as a NIS master @@ -1507,23 +1400,30 @@ Several things have to be done: BDC. This can be done manually whenever login scripts are changed, or it can be done automatically together with the smbpasswd synchronization. -

    Example Configuration

    +

    Example Configuration

    Finally, the BDC has to be found by the workstations. This can be done by setting: -

    -	workgroup = SAMBA
-	domain master = no
-	domain logons = yes
-

    -in the [global]-section of the smb.conf of the BDC. This makes the BDC +

    Example 6.2. Minimal setup for being a BDC

    workgroup = MIDEARTH
    domain master = no
    domain logons = yes
    idmap backend = ldapsam://slave-ldap.quenya.org

    +In the [global]-section of the smb.conf of the BDC. This makes the BDC only register the name SAMBA<#1c> with the WINS server. This is no problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to -be registered by more than one machine. The parameter 'domain master = -no' forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS +be registered by more than one machine. The parameter +domain master = no +forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS name is reserved for the Primary Domain Controller. -

    Common Errors

    +

    +The idmap backend will redirect the winbindd utility to +use the LDAP database to resolve all UIDs and GIDs for UNIX accounts. +

    Note

    +Samba-3 has introduced a new ID mapping facility. One of the features of this facility is that it +allows greater flexibility in how user and group IDs are handled in respect of NT Domain User and Group +SIDs. One of the new facilities provides for explicitly ensuring that UNIX / Linux UID and GID values +will be consistent on the PDC, all BDCs and all Domain Member servers. The parameter that controls this +is called idmap backend. Please refer to the man page for smb.conf for more information +regarding it's behaviour. Do NOT set this parameter except where an LDAP backend (ldapsam) is in use. +

    Common Errors

    As this is a rather new area for Samba there are not many examples that we may refer to. Keep watching for updates to this section. -

    Machine Accounts keep expiring, what can I do?

    +

    Machine Accounts keep expiring, what can I do?

    This problem will occur when occur when the passdb (SAM) files are copied from a central server but the local Backup Domain Controllers. Local machine trust account password updates are not copied back to the central server. The newer machine account password is then over @@ -1534,18 +1434,15 @@ to proceed and the account expiry error will be reported.

    The solution: use a more robust passdb backend, such as the ldapsam backend, setting up an slave LDAP server for each BDC, and a master LDAP server for the PDC. -

    Can Samba be a Backup Domain Controller to an NT4 PDC?

    +

    Can Samba be a Backup Domain Controller to an NT4 PDC?

    With version 2.2, no. The native NT4 SAM replication protocols have not yet been fully implemented. The Samba Team is working on understanding and implementing the protocols, -but this work has not been finished for version 2.2. -

    -With version 3.0, the work on both the replication protocols and a suitable storage -mechanism has progressed, and some form of NT4 BDC support is expected soon. +but this work has not been finished for Samba-3.

    -Can I get the benefits of a BDC with Samba? Yes. The main reason for implementing a +Can I get the benefits of a BDC with Samba? Yes, but only to a Samba PDC. The main reason for implementing a BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to service logon requests whenever the PDC is down. -

    How do I replicate the smbpasswd file?

    +

    How do I replicate the smbpasswd file?

    Replication of the smbpasswd file is sensitive. It has to be done whenever changes to the SAM are made. Every user's password change is done in the smbpasswd file and has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary. @@ -1559,12 +1456,12 @@ to type a password. As said a few times before, use of this method is broken and flawed. Machine trust accounts will go out of sync, resulting in a very broken domain. This method is not recommended. Try using LDAP instead. -

    Can I do this all with LDAP?

    +

    Can I do this all with LDAP?

    The simple answer is YES. Samba's pdb_ldap code supports binding to a replica LDAP server, and will also follow referrals and rebind to the master if it ever needs to make a modification to the database. (Normally BDCs are read only, so this will not occur often). -

    Chapter 7. Domain Membership

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails

    +

    Chapter 7. Domain Membership

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails

    Domain Membership is a subject of vital concern, Samba must be able to participate as a member server in a Microsoft Domain security context, and Samba must be capable of providing Domain machine member trust accounts, @@ -1574,12 +1471,11 @@ This chapter covers background information pertaining to domain membership, Samba configuration for it, and MS Windows client procedures for joining a domain. Why is this necessary? Because both are areas in which there exists within the current MS Windows networking world and particularly in the -Unix/Linux networking and administration world, a considerable level of +UNIX/Linux networking and administration world, a considerable level of mis-information, incorrect understanding, and a lack of knowledge. Hopefully this chapter will fill the voids. -

    Features and Benefits

    -MS Windows workstations and servers that want to participate in domain -security need to +

    Features and Benefits

    +MS Windows workstations and servers that want to participate in domain security need to be made Domain members. Participating in Domain security is often called Single Sign On or SSO for short. This chapter describes the process that must be followed to make a workstation @@ -1614,11 +1510,11 @@ Domain membership has many advantages: client or server, other than the central Domain database (either NT4/Samba SAM style Domain, NT4 Domain that is back ended with an LDAP directory, or via an Active Directory infrastructure) -

    MS Windows Workstation/Server Machine Trust Accounts

    +

    MS Windows Workstation/Server Machine Trust Accounts

    A machine trust account is an account that is used to authenticate a client machine (rather than a user) to the Domain Controller server. In Windows terminology, -this is known as a "Computer Account." +this is known as a "Computer Account."

    The password of a machine trust account acts as the shared secret for secure communication with the Domain Controller. This is a security @@ -1639,12 +1535,12 @@ as follows:

    • A Domain Security Account (stored in the - passdb backend that has been configured in the + passdb backend that has been configured in the smb.conf file. The precise nature of the account information that is stored depends on the type of backend database that has been chosen.

      The older format of this data is the smbpasswd database - which contains the unix login ID, the Unix user identifier (UID), and the + which contains the UNIX login ID, the UNIX user identifier (UID), and the LanMan and NT encrypted passwords. There is also some other information in this file that we do not need to concern ourselves with here.

      @@ -1653,57 +1549,70 @@ as follows: older smbpasswd file did. The extra information enables new user account controls to be used.

    • - A corresponding Unix account, typically stored in + A corresponding UNIX account, typically stored in /etc/passwd. Work is in progress to allow a - simplified mode of operation that does not require Unix user accounts, but + simplified mode of operation that does not require UNIX user accounts, but this may not be a feature of the early releases of Samba-3.

    -

    +

    There are three ways to create machine trust accounts:

    • - Manual creation from the Unix/Linux command line. Here, both the Samba and - corresponding Unix account are created by hand. + Manual creation from the UNIX/Linux command line. Here, both the Samba and + corresponding UNIX account are created by hand.

    • + Using the MS Windows NT4 Server Manager (either from an NT4 Domain member server, or using the Nexus toolkit available from the Microsoft web site. This tool can be run from any MS Windows machine so long as the user is logged on as the administrator account.

    • - "On-the-fly" creation. The Samba machine trust account is automatically + "On-the-fly" creation. The Samba machine trust account is automatically created by Samba at the time the client is joined to the domain. - (For security, this is the recommended method.) The corresponding Unix + (For security, this is the recommended method.) The corresponding UNIX account may be created automatically or manually. -

    Manual Creation of Machine Trust Accounts

    +

    Manual Creation of Machine Trust Accounts

    The first step in manually creating a machine trust account is to manually -create the corresponding Unix account in /etc/passwd. +create the corresponding UNIX account in /etc/passwd. This can be done using vipw or another 'add user' command -that is normally used to create new Unix accounts. The following is an example for a Linux based Samba server: -

    -root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" -s /bin/false machine_name$ +that is normally used to create new UNIX accounts. The following is an example for a Linux based Samba server: + + + +

    +

    +root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" \
+   -s /bin/false machine_name$ 
+
 root# passwd -l machine_name$
+

    + On *BSD systems, this can be done using the chpass utility:

    -root# chpass -a "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin" +

    +root# chpass -a \
+  "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin"
+

    The /etc/passwd entry will list the machine name -with a "$" appended, won't have a password, will have a null shell and no +with a "$" appended, won't have a password, will have a null shell and no home directory. For example a machine named 'doppy' would have an /etc/passwd entry like this: 

    -doppy$:x:505:501:machine_nickname:/dev/null:/bin/false
+doppy$:x:505:100:machine_nickname:/dev/null:/bin/false

    Above, machine_nickname can be any descriptive name for the client, i.e., BasementComputer. machine_name absolutely must be the NetBIOS -name of the client to be joined to the domain. The "$" must be +name of the client to be joined to the domain. The "$" must be appended to the NetBIOS name of the client or Samba will not recognize this as a machine trust account.

    -Now that the corresponding Unix account has been created, the next step is to create +Now that the corresponding UNIX account has been created, the next step is to create the Samba account for the client containing the well-known initial -machine trust account password. This can be done using the smbpasswd(8) command +machine trust account password. This can be done using the +smbpasswd command as shown here: 

    @@ -1712,28 +1621,32 @@ as shown here:
 
    
 where machine_name is the machine's NetBIOS
 name.  The RID of the new machine account is generated from the UID of 
-the corresponding Unix account.
+the corresponding UNIX account.
 
    Join the client to the domain immediately
    
 	Manually creating a machine trust account using this method is the 
 	equivalent of creating a machine trust account on a Windows NT PDC using 
+	
 	the Server Manager.  From the time at which the 
 	account is created to the time which the client joins the domain and 
 	changes the password, your domain is vulnerable to an intruder joining 
 	your domain using a machine with the same NetBIOS name.  A PDC inherently 
 	trusts members of the domain and will serve out a large degree of user 
 	information to such clients.  You have been warned!
-

    Using NT4 Server Manager to Add Machine Accounts to the Domain

    +

    Using NT4 Server Manager to Add Machine Accounts to the Domain

    If the machine from which you are trying to manage the domain is an -MS Windows NT4 workstation +MS Windows NT4 workstation or MS Windows 200x / XP Professional then the tool of choice is the package called SRVTOOLS.EXE. -When executed in the target directory this will unpack -SrvMge.exe and UsrMgr.exe (both are -Domain Management tools for MS Windows NT4 workstation. +When executed in the target directory this will unpack SrvMge.exe +and UsrMgr.exe (both are domain management tools for MS Windows NT4 workstation). +

    +If your workstation is a Microsoft Windows 9x/Me family product + you should download the Nexus.exe package from the Microsoft web site. +When executed from the target directory this will unpack the same tools but for use on +this platform.

    -If your workstation is any other MS Windows product you should download the -Nexus.exe package from the Microsoft web site. When executed -from the target directory this will unpack the same tools but for use on -MS Windows 9x/Me/200x/XP. +Further information about these tools may be obtained from the following locations: +http://support.microsoft.com/default.aspx?scid=kb;en-us;173673 +http://support.microsoft.com/default.aspx?scid=kb;en-us;172540

    Launch the srvmgr.exe (Server Manager for Domains) and follow these steps:

    Procedure 7.1. Server Manager Account Machine Account Management

    1. @@ -1753,25 +1666,21 @@ Launch the srvmgr.exe (Server Manager for Domains) and fo Add NT Workstation of Server, then enter the machine name in the field provided, then click the Add button. -

    "On-the-Fly" Creation of Machine Trust Accounts

    +

    "On-the-Fly" Creation of Machine Trust Accounts

    The second (and recommended) way of creating machine trust accounts is simply to allow the Samba server to create them as needed when the client is joined to the domain. -

    Since each Samba machine trust account requires a corresponding Unix account, a method -for automatically creating the Unix account is usually supplied; this requires configuration of the -add machine script option in -smb.conf. This method is not required, however; corresponding Unix +

    Since each Samba machine trust account requires a corresponding UNIX account, a method +for automatically creating the UNIX account is usually supplied; this requires configuration of the +add machine script option in +smb.conf. This method is not required, however; corresponding UNIX accounts may also be created manually.

    Below is an example for a RedHat Linux system. -

    -[global]
-   # <...remainder of parameters...>
-   add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u 
-

    Making an MS Windows Workstation or Server a Domain Member

    +

    [global]
    # <...remainder of parameters...>
    add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u

    Making an MS Windows Workstation or Server a Domain Member

    The procedure for making an MS Windows workstation of server a member of the domain varies with the version of Windows: -

    Windows 200x XP Professional

    +

    Windows 200x XP Professional

    When the user elects to make the client a domain member, Windows 200x prompts for an account and password that has privileges to create machine accounts in the domain. A Samba administrative account (i.e., a Samba account that has root privileges on the @@ -1785,13 +1694,13 @@ with the version of Windows: The name of the account that is used to create domain member machine accounts can be anything the network administrator may choose. If it is other than root then this is easily mapped to root using the file pointed to be the smb.conf parameter - username map = /etc/samba/smbusers. + username map = /etc/samba/smbusers.

    The session key of the Samba administrative account acts as an encryption key for setting the password of the machine trust account. The machine trust account will be created on-the-fly, or updated if it already exists. -

    Windows NT4

    +

    Windows NT4

    If the machine trust account was created manually, on the Identification Changes menu enter the domain name, but do not check the box Create a Computer Account in the Domain. @@ -1804,8 +1713,8 @@ with the version of Windows: Domain. In this case, joining the domain proceeds as above for Windows 2000 (i.e., you must supply a Samba administrative account when prompted). -

    Samba

    Joining a Samba client to a domain is documented in - the Domain Member Server section of this chapter chapter. +

    Samba

    Joining a Samba client to a domain is documented in + the domain member chapter.

    Domain Member Server

    This mode of server operation involves the Samba machine being made a member of a domain security context. This means by definition that all user @@ -1821,46 +1730,38 @@ This can be LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory Server, etc.

    -Please refer to the Domain Control chapter +Please refer to the chapter on setting up a PDC for more information regarding how to create a domain machine account for a domain member server as well as for information regarding how to enable the Samba domain member machine to join the domain and to be fully trusted by it. -

    Joining an NT4 type Domain with Samba-3

    -

    Table 7.1. Assumptions

    NetBIOS name:SERV1
    Win2K/NT domain name:DOM
    Domain's PDC NetBIOS name:DOMPDC
    Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2

    +

    Joining an NT4 type Domain with Samba-3

    +

    Table 7.1. Assumptions

    NetBIOS name:SERV1
    Win2K/NT domain name:MIDEARTH
    Domain's PDC NetBIOS name:DOMPDC
    Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2

    First, you must edit your smb.conf file to tell Samba it should now use domain security.

    -Change (or add) your -security line in the [global] section + Change (or add) your + security line in the [global] section of your smb.conf to read:

    -

    -security = domain
-

    +

    security = domain

    -Next change the -workgroup line in the [global] +Next change the workgroup line in the [global] section to read:

    -

    -workgroup = DOM
-

    +

    workgroup = MIDEARTH

    as this is the name of the domain we are joining.

    -You must also have the parameter -encrypt passwords set to yes +You must also have the parameter +encrypt passwords set to yes in order for your users to authenticate to the NT PDC.

    -Finally, add (or modify) a -password server line in the [global] +Finally, add (or modify) a password server line in the [global] section to read:

    -

    -password server = DOMPDC DOMBDC1 DOMBDC2
-

    +

    password server = DOMPDC DOMBDC1 DOMBDC2

    These are the primary and backup domain controllers Samba will attempt to contact in order to authenticate users. Samba will @@ -1872,9 +1773,7 @@ Alternatively, if you want smbd to automatically determine the list of Domain controllers to use for authentication, you may set this line to be:

    -

    -password server = *
-

    +

    password server = *

    This method allows Samba to use exactly the same mechanism that NT does. This method either broadcasts or uses a WINS database in order to @@ -1883,7 +1782,7 @@ find domain controllers to authenticate against. In order to actually join the domain, you must run this command: 

    -root# net join -S DOMPDC -UAdministrator%password
+root# net rpc join -S DOMPDC -UAdministrator%password

    If the -S DOMPDC argument is not given then @@ -1900,8 +1799,8 @@ you will see the message: Joined domain DOM. or Joined 'SERV1' to realm 'MYREALM'

    -in your terminal window. See the -net(8) man page for more details. +in your terminal window. See the +net man page for more details.

    This process joins the server to the domain without having to create the machine trust account on the PDC beforehand. @@ -1919,21 +1818,25 @@ security for your system, and should be treated as carefully as a shadow password file.

    Finally, restart your Samba daemons and get ready for -clients to begin using domain security! -

    Why is this better than security = server?

    +clients to begin using domain security! The way you can restart your +samba daemons depends on your distribution, but in most cases running +

    +	root# /etc/init.d/samba restart
+

    +does the job. +

    Why is this better than security = server?

    Currently, domain security in Samba doesn't free you from -having to create local Unix users to represent the users attaching +having to create local UNIX users to represent the users attaching to your server. This means that if domain user DOM\fred attaches to your domain security Samba server, there needs -to be a local Unix user fred to represent that user in the Unix +to be a local UNIX user fred to represent that user in the UNIX filesystem. This is very similar to the older Samba security mode -security = server, +security = server, where Samba would pass through the authentication request to a Windows NT server in the same way as a Windows 95 or Windows 98 server would.

    -Please refer to the Winbind chapter -for information on a system to automatically -assign UNIX uids and gids to Windows NT Domain users and groups. + Please refer to the chapter on winbind for information on a system +to automatically assign UNIX uids and gids to Windows NT Domain users and groups.

    The advantage to domain-level security is that the authentication in domain-level security is passed down the authenticated @@ -1943,11 +1846,11 @@ exactly the same way NT servers do (i.e., you can add Samba servers into a resource domain and have the authentication passed on from a resource domain PDC to an account domain PDC).

    -In addition, with security = server every Samba +In addition, with security = server every Samba daemon on a server has to keep a connection open to the authenticating server for as long as that daemon lasts. This can drain the connection resources on a Microsoft NT server and cause it to run -out of available connections. With security = domain, +out of available connections. With security = domain, however, the Samba daemons connect to the PDC/BDC only for as long as is necessary to authenticate the user, and then drop the connection, thus conserving PDC connection resources. @@ -1961,41 +1864,39 @@ Much of the text of this document was first published in the Web magazine LinuxWorld as the article Doing the NIS/NT Samba. -

    Samba ADS Domain Membership

    +

    Samba ADS Domain Membership

    This is a rough guide to setting up Samba 3.0 with Kerberos authentication against a Windows2000 KDC. A familiarity with Kerberos is assumed. -

    Setup your smb.conf

    +

    Setup your smb.conf

    You must use at least the following 3 options in smb.conf: -

    -	realm = your.kerberos.REALM
-	security = ADS
-	encrypt passwords = yes
-

    +

    realm = your.kerberos.REALM
    security = ADS
    encrypt passwords = yes

    In case samba can't figure out your ads server using your realm name, use the -ads server option in smb.conf: -

    -	ads server = your.kerberos.server
-

    +ads server option in smb.conf: +

    ads server = your.kerberos.server

    Note

    You do not need a smbpasswd file, and older clients will be authenticated as -if security = domain, although it won't do any harm and +if security = domain, although it won't do any harm and allows you to have local users not in the domain. It is expected that the above required options will change soon when active directory integration will get better. -

    Setup your /etc/krb5.conf

    +

    Setup your /etc/krb5.conf

    The minimal configuration for krb5.conf is: 

    +[libdefaults]
+   default_realm = YOUR.KERBEROS.REALM
+
 	[realms]
-	    YOUR.KERBEROS.REALM = {
-		kdc = your.kerberos.server
+	YOUR.KERBEROS.REALM = {
+	kdc = your.kerberos.server
 	    }
-

    +

    Test your config by doing a kinit USERNAME@REALM and making sure that your password is accepted by the Win2000 KDC.

    Note

    The realm must be uppercase or you will get Cannot find KDC for -requested realm while getting initial credentials error. +requested realm while getting initial credentials error (Kerberos +is case-sensitive!).

    Note

    Time between the two servers must be synchronized. You will get a kinit(v5): Clock skew too great while getting initial credentials @@ -2020,60 +1921,60 @@ is only needed if you want Kerberos support for smbd

    Create the computer account

    As a user that has write permission on the Samba private directory (usually root) run: -

    -	root# net join -U Administrator%password
+
    +root#  net ads join -U Administrator%password
 
    
-
    Possible errors
    
+
    Possible errors
    
 
    ADS support not compiled in
    Samba must be reconfigured (remove config.cache) and recompiled
 	(make clean all install) after the Kerberos libs and headers are installed.
-	
    net join prompts for user name
    You need to login to the domain using kinit
+	
    net ads join prompts for user name
    You need to login to the domain using kinit
 	USERNAME@REALM.
 	USERNAME must be a user who has rights to add a machine
 	to the domain.  
    
 
    Test your server setup
    
 If the join was successful, you will see a new computer account with the
-NetBIOS name of your Samba server in Active Directory (in the "Computers"
+NetBIOS name of your Samba server in Active Directory (in the "Computers"
 folder under Users and Computers.
 
    
 On a Windows 2000 client try net use * \\server\share. You should
 be logged in with Kerberos without needing to know a password. If
 this fails then run klist tickets. Did you get a ticket for the
 server? Does it have an encoding type of DES-CBC-MD5 ? 
-
    Testing with smbclient
    
+
    Testing with smbclient
    
 On your Samba server try to login to a Win2000 server or your Samba
 server using smbclient and Kerberos. Use smbclient as usual, but
-specify the -k option to choose Kerberos authentication.
-
    Notes
    
+specify the -k option to choose Kerberos authentication.
+
    Notes
    
 You must change administrator password at least once after DC 
 install, to create the right encoding types
 
    
 W2k doesn't seem to create the _kerberos._udp and _ldap._tcp in
-their defaults DNS setup. Maybe fixed in service packs?
-

    Common Errors

    +their defaults DNS setup. Maybe this will be fixed later in service packs. +

    Common Errors

    In the process of adding / deleting / re-adding domain member machine accounts there are many traps for the unwary player and there are many “little” things that can go wrong. It is particularly interesting how often subscribers on the samba mailing list have concluded -after repeated failed attempts to add a machine account that it is necessary to "re-install" +after repeated failed attempts to add a machine account that it is necessary to "re-install" MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type of problem. The real solution is often very simple, and with understanding of how MS Windows -networking functions. easily overcome. -

    Can Not Add Machine Back to Domain

    -Problem: A Windows workstation was reinstalled. The original domain machine +networking functions easy to overcome. +

    Can Not Add Machine Back to Domain

    +“ A Windows workstation was reinstalled. The original domain machine account was deleted and added immediately. The workstation will not join the domain if I use the same machine name. Attempts to add the machine fail with a message that the machine already -exists on the network - I know it doesn't. Why is this failing? +exists on the network - I know it doesn't. Why is this failing?”

    The original name is still in the NetBIOS name cache and must expire after machine account deletion BEFORE adding that same name as a domain member again. The best advice is to delete the old account and then to add the machine with a new name. -

    Adding Machine to Domain Fails

    -Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a +

    Adding Machine to Domain Fails

    + “Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a message that, The machine could not be added at this time, there is a network problem. -Please try again later. Why? + Please try again later. Why?”

    -You should check that there is an add machine script in your smb.conf +You should check that there is an add machine script in your smb.conf file. If there is not, please add one that is appropriate for your OS platform. If a script -has been defined you will need to debug it's operation. Increase the log level +has been defined you will need to debug it's operation. Increase the log level in the smb.conf file to level 10, then try to rejoin the domain. Check the logs to see which operation is failing.

    @@ -2082,21 +1983,21 @@ Possible causes include: The script does not actually exist, or could not be located in the path specified.

    Corrective Action: Fix it. Make sure that when run manually - that the script will add both the Unix system account _and_ the Samba SAM account. + that the script will add both the UNIX system account _and_ the Samba SAM account.

  • - The machine could not be added to the Unix system accounts file /etc/passwd + The machine could not be added to the UNIX system accounts file /etc/passwd

    - Corrective Action: Check that the machine name is a legal Unix - system account name. ie: If the Unix utility useradd is called + Corrective Action: Check that the machine name is a legal UNIX + system account name. ie: If the UNIX utility useradd is called then make sure that the machine name you are trying to add can be added using this tool. Useradd on some systems will not allow any upper case characters nor will it allow spaces in the name. -

    • Chapter 8. Stand-Alone Servers

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors

    +

    Chapter 8. Stand-Alone Servers

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors

    Stand-Alone servers are independent of Domain Controllers on the network. They are NOT domain members and function more like workgroup servers. In many cases a stand-alone server is configured with a minimum of security control with the intent that all data served will be readily accessible to all users. -

    Features and Benefits

    +

    Features and Benefits

    Stand-Alone servers can be as secure or as insecure as needs dictate. They can have simple or complex configurations. Above all, despite the hoopla about Domain security they remain a very common installation. @@ -2113,7 +2014,7 @@ that are queued off a single central server. Everyone needs to be able to print to the printers, there is no need to affect any access controls and no files will be served from the print server. Again a share mode stand-alone server makes a great solution. -

    Background

    +

    Background

    The term stand-alone server means that the server will provide local authentication and access control for all resources that are available from it. In general this means that there will be a @@ -2135,50 +2036,37 @@ local or on a remote server, even if from the Samba protocol perspective the Samba server is NOT a member of a domain security context.

    Through the use of PAM (Pluggable Authentication Modules) and nsswitch -(the name service switcher) the source of authentication may reside on +(the name service switcher, which maintains the unix user database) the source of authentication may reside on another server. We would be inclined to call this the authentication server. -This means that the Samba server may use the local Unix/Linux system password database +This means that the Samba server may use the local UNIX/Linux system password database (/etc/passwd or /etc/shadow), may use a local smbpasswd file, or may use an LDAP back end, or even via PAM and Winbind another CIFS/SMB server for authentication. -

    Example Configuration

    +

    Example Configuration

    The following examples are designed to inspire simplicity. It is too easy to attempt a high level of creativity and to introduce too much complexity in server and network design. -

    Reference Documentation Server

    +

    Reference Documentation Server

    Configuration of a read-only data server that EVERYONE can access is very simple. Here is the smb.conf file that will do this. Assume that all the reference documents are stored in the directory /export, that the documents are owned by a user other than nobody. No home directories are shared, that are no users in the /etc/passwd -Unix system database. This is a very simple system to administer. -

    -	# Global parameters
-	[global]
-		workgroup = MYGROUP
-		netbios name = REFDOCS
-		security = SHARE
-		passdb backend = guest
-		wins server = 192.168.1.1
-
-	[data]
-		comment = Data
-		path = /export
-		guest only = Yes
-

    +UNIX system database. This is a very simple system to administer. +

    Example 8.1. smb.conf for Reference Documentation Server

    # Global parameters
    [global]
    workgroup = MIDEARTH
    netbios name = GANDALF
    security = SHARE
    passdb backend = guest
    wins server = 192.168.1.1
    [data]
    comment = Data
    path = /export
    guest only = Yes

    In the above example the machine name is set to REFDOCS, the workgroup is set to the name of the local workgroup so that the machine will appear in with systems users are familiar -with. The only password backend required is the "guest" backend so as to allow default +with. The only password backend required is the "guest" backend so as to allow default unprivileged account names to be used. Given that there is a WINS server on this network we do use it. -

    Central Print Serving

    +

    Central Print Serving

    Configuration of a simple print server is very simple if you have all the right tools on your system.

    Assumptions:

    1. The print server must require no administration

    2. The print spooling and processing system on our print server will be CUPS. - (Please refer to the CUPS Printing chapter for more information). + (Please refer to the chapter about CUPS for more information).

    3. All printers that the print server will service will be network printers. They will be correctly configured, by the administrator, @@ -2192,76 +2080,67 @@ In this example our print server will spool all incoming print jobs to Samba to the CUPS print processor. Since all incoming connections will be as the anonymous (guest) user, two things will be required:

      Enabling Anonymous Printing

      • - The Unix/Linux system must have a guest account. + The UNIX/Linux system must have a guest account. The default for this is usually the account nobody. To find the correct name to use for your version of Samba do the following: - 

        -$ testparm -s -v | grep "guest account"
-

        +

        +$ testparm -s -v | grep "guest account"
+

        Then make sure that this account exists in your system password database (/etc/passwd).

      • The directory into which Samba will spool the file must have write access for the guest account. The following commands will ensure that this directory is available for use: - 

        +
         root# mkdir /var/spool/samba
 root# chown nobody.nobody /var/spool/samba
 root# chmod a+rwt /var/spool/samba
-	
        
-

      -

      -	# Global parameters
-	[global]
-		workgroup = MYGROUP
-		netbios name = PTRSVR1
-		security = SHARE
-		passdb backend = guest
-		wins server = 192.168.1.1
-
-	[printers]
-		comment = All Printers
-		path = /var/spool/samba
-		printer admin = root
-		guest ok = Yes
-		printable = Yes
-		printing = cups
-		use client driver = Yes
-		browseable = No

      -

    Common Errors

    +

    +

    Example 8.2. smb.conf for anonymous printing

    # Global parameters
    [global]
    workgroup = MIDEARTH
    netbios name = GANDALF
    security = SHARE
    passdb backend = guest
    wins server = noldor
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    printer admin = root
    guest ok = Yes
    printable = Yes
    use client driver = Yes
    browseable = No

    +

    Common Errors

    The greatest mistake so often made is to make a network configuration too complex. It pays to use the simplest solution that will meet the needs of the moment. -

    Chapter 9. MS Windows Network Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +

    Chapter 9. MS Windows Network Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Advanced Configuration

    Valuable Nuts and Bolts Information

    +

    Advanced Configuration

    Valuable Nuts and Bolts Information

    Samba has several features that you might want or might not want to use. The chapters in this part each cover specific Samba features. -

    Table of Contents

    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    11. Account Information Databases
    Features and Benefits
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and Unix
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon - Users not in Samba SAM
    Users are being added to the wrong backend database
    auth methods does not work
    12. Mapping MS Windows and Unix Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with Unix File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and Unix Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute - mapping
    Common Errors
    Users can not write to a public share
    I have set force user and Samba still makes root the owner of all the files - I touch!
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    Common Errors
    Tell me about Trust Relationships using Samba
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    Parameters for Backwards Compatibility
    Parameters no longer in use
    A simple Configuration to Print with Samba-3
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print with Samba-3
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various Unix Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba-3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with -rpcclient
    "The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure)
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a -different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba-3
    Publishing Printer Information in Active Directory or LDAP
    Common Errors and Problems
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for -CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for -application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download
    GDI on Windows -- PostScript on Unix
    Windows Drivers, GDI and EMF
    Unix Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and -native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print -Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many -Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel -Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for -cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Caveats to be considered
    What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsm completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the -Client
    Installing PostScript Driver Files manually (using -rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Commandline Driver Installation in 15 little Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    When not to use Samba to print to -CUPS
    In Case of Trouble.....
    Where to find Documentation
    How to ask for Help
    Where to find Help
    Appendix
    Printing from CUPS to Windows attached -Printers
    More CUPS filtering Chains
    Trouble Shooting Guidelines to fix typical Samba printing -Problems
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    Common Errors
    21. Integrated Logon Support using Winbind
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    How does one set up roaming profiles for just one (or a few) user/s or group/s?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    My Boomerang Won't Come Back
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note

    Chapter 10. Samba / MS Windows Network Browsing Guide

    John H. Terpstra

    Samba Team

    July 5, 1998

    Updated: April 21, 2003

    Table of Contents

    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"

    +

    Table of Contents

    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    I get an Unable to browse the network error
    11. Account Information Databases
    Features and Benefits
    Backwards Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon
    Users being added to wrong backend database
    auth methods does not work
    12. Mapping MS Windows and UNIX Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users group
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask + parameters
    Interaction with the standard Samba file attribute mapping
    Common Errors
    Users can not write to a public share
    I have set force user but Samba still makes root the owner of all the files I touch!
    MS Word with Samba changes owner of file
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Problems saving files in MS Office on Windows XP
    Long delays deleting files over network with XP SP1
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-style Domain Trusts with Windows 2000
    Common Errors
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    A simple Configuration to Print
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various UNIX Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba 3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with +rpcclient
    Client Driver Install Procedure
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a +different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for +CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for +application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and +native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many +Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel +Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Caveats to be considered
    Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsmb completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the +Client
    Installing PostScript Driver Files manually (using +rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    In Case of Trouble.....
    Printing from CUPS to Windows attached +Printers
    More CUPS filtering Chains
    Common Errors
    Win9x client can't install driver
    "cupsaddsmb" keeps asking for root password in + neverending loop
    "cupsaddsmb" gives "No PPD file for printer..." + message while PPD file is present
    Client can't connect to Samba printer
    Can't reconnect to Samba under new account + from Win2K/XP
    Avoid being connected to the Samba server as the + "wrong" user
    Upgrading to CUPS drivers from Adobe drivers on + NT/2K/XP clients gives problems
    Can't use "cupsaddsmb" on Samba server which is + a PDC
    Deleted Win2K printer driver is still shown
    Win2K/XP "Local Security + Policies"
    WinXP clients: "Administrator can not install + printers for all local users"
    "Print Change Notify" functions on + NT-clients
    WinXP-SP1
    Print options for all users can't be set on Win2K/XP
    Most common blunders in driver + settings on Windows clients
    cupsaddsmb does not work + with newly installed printer
    Permissions on +/var/spool/samba/ get reset after each +reboot
    Printer named "lp" +intermittently swallows jobs and spits out completely different +ones
    Location of Adobe PostScript driver files necessary for "cupsaddsmb"
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    21. Winbind: Use of Domain Accounts
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Setting up roaming profiles for just a few user's or group's?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    Winbind is not resolving users and groups
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure UNIX/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging works only in one way
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    Common errors
    CP850.so can't be found
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note

    Chapter 10. Samba / MS Windows Network Browsing Guide

    John H. Terpstra

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    July 5, 1998

    Updated: April 21, 2003

    Table of Contents

    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    I get an Unable to browse the network error

    This document contains detailed information as well as a fast track guide to implementing browsing across subnets and / or across workgroups (or domains). WINS is the best tool for resolution of NetBIOS names to IP addresses. WINS is @@ -2272,11 +2151,11 @@ over TCP/IP. Samba-3 and later also supports this mode of operation. When the use of NetBIOS over TCP/IP has been disabled then the primary means for resolution of MS Windows machine names is via DNS and Active Directory. The following information assumes that your site is running NetBIOS over TCP/IP. -

    Features and Benefits

    +

    Features and Benefits

    Someone once referred to the past in terms of: They were the worst of times, they were the best of times. The more we look back, them more we long for what was and hope it never returns!. -

    +

    For many MS Windows network administrators, that statement sums up their feelings about NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle nature was just par for the course. For those who never quite managed to tame its @@ -2301,63 +2180,55 @@ help Samba to affect stable WINS operations beyond the normal scope of MS WINS.

    Please note that WINS is exclusively a service that applies only to those systems that run NetBIOS over TCP/IP. MS Windows 200x / XP have the capacity to turn off -support for NetBIOS, in which case WINS is of no relevance. Samba-3 supports this also. +support for NetBIOS, in which case WINS is of no relevance. Samba supports this also.

    For those networks on which NetBIOS has been disabled (ie: WINS is NOT required) the use of DNS is necessary for host name resolution. -

    What is Browsing?

    +

    What is Browsing?

    To most people browsing means that they can see the MS Windows and Samba servers in the Network Neighborhood, and when the computer icon for a particular server is clicked, it opens up and shows the shares and printers available on the target server.

    What seems so simple is in fact a very complex interaction of different technologies. The technologies (or methods) employed in making all of this work includes: -

    MS Windows machines register their presence to the network
    Machines announce themselves to other machines on the network
    One or more machine on the network collates the local announcements
    The client machine finds the machine that has the collated list of machines
    The client machine is able to resolve the machine names to IP addresses
    The client machine is able to connect to a target machine

    +

    • MS Windows machines register their presence to the network

    • Machines announce themselves to other machines on the network

    • One or more machine on the network collates the local announcements

    • The client machine finds the machine that has the collated list of machines

    • The client machine is able to resolve the machine names to IP addresses

    • The client machine is able to connect to a target machine

    The Samba application that controls browse list management and name resolution is called nmbd. The configuration parameters involved in nmbd's operation are: -

    -		
-	Browsing options:
-	-----------------
-		* os level
-		  lm announce
-		  lm interval
-		* preferred master
-		* local master
-		* domain master
-		  browse list
-		  enhanced browsing
-
-	Name Resolution Method:
-	-----------------------
-		* name resolve order
-
-	WINS options:
-	-------------
-		  dns proxy
-		  wins proxy
-		* wins server
-		* wins support
-		  wins hook
-

    +

    Browsing options: os level(*), + lm announce, + lm interval, + preferred master(*), + local master(*), + domain master(*), + browse list, + enhanced browsing. +

    Name Resolution Method: + name resolve order(*). +

    WINS options: + dns proxy, + wins proxy, + wins server(*), + wins support(*), + wins hook. +

    For Samba, the WINS Server and WINS Support are mutually exclusive options. Those marked with an '*' are the only options that commonly MAY need to be modified. Even if not one of these parameters is set nmbd will still do it's job. -

    Discussion

    +

    Discussion

    Firstly, all MS Windows networking uses SMB (Server Message Block) based messaging. SMB messaging may be implemented with or without NetBIOS. MS Windows 200x supports NetBIOS over TCP/IP for backwards compatibility. Microsoft is intent on phasing out NetBIOS support. -

    NetBIOS over TCP/IP

    +

    NetBIOS over TCP/IP

    Samba implements NetBIOS, as does MS Windows NT / 200x / XP, by encapsulating it over TCP/IP. MS Windows products can do likewise. NetBIOS based networking uses broadcast messaging to affect browse list management. When running NetBIOS over TCP/IP, this uses UDP based messaging. UDP messages can be broadcast or unicast. -

    +

    Normally, only unicast UDP messaging can be forwarded by routers. The -remote announce parameter to smb.conf helps to project browse announcements +remote announce parameter to smb.conf helps to project browse announcements to remote network segments via unicast UDP. Similarly, the -remote browse sync parameter of smb.conf +remote browse sync parameter of smb.conf implements browse list collation using unicast UDP.

    Secondly, in those networks where Samba is the only SMB server technology, @@ -2365,12 +2236,13 @@ wherever possible nmbd should be configured on one (1) server. This makes it easy to manage the browsing environment. If each network segment is configured with it's own Samba WINS server, then the only way to get cross segment browsing to work is by using the -remote announce and the remote browse sync +remote announce and the remote browse sync parameters to your smb.conf file.

    + If only one WINS server is used for an entire multi-segment network then -the use of the remote announce and the -remote browse sync parameters should NOT be necessary. +the use of the remote announce and the +remote browse sync parameters should NOT be necessary.

    As of Samba 3 WINS replication is being worked on. The bulk of the code has been committed, but it still needs maturation. This is NOT a supported feature @@ -2381,7 +2253,7 @@ Right now Samba WINS does not support MS-WINS replication. This means that when setting up Samba as a WINS server there must only be one nmbd configured as a WINS server on the network. Some sites have used multiple Samba WINS servers for redundancy (one server per subnet) and then used -remote browse sync and remote announce +remote browse sync and remote announce to affect browse list collation across all segments. Note that this means clients will only resolve local names, and must be configured to use DNS to resolve names on other subnets in order to resolve the IP addresses of the servers they can see @@ -2392,7 +2264,10 @@ Lastly, take note that browse lists are a collection of unreliable broadcast messages that are repeated at intervals of not more than 15 minutes. This means that it will take time to establish a browse list and it can take up to 45 minutes to stabilise, particularly across network segments. -

    TCP/IP - without NetBIOS

    +

    TCP/IP - without NetBIOS

    + + + All TCP/IP using systems use various forms of host name resolution. The primary methods for TCP/IP hostname resolutions involves either a static file (/etc/hosts ) or DNS (the Domain Name System). DNS is the technology that makes @@ -2415,7 +2290,7 @@ it follows a defined path:

  • Looks up entries in LMHOSTS. It is located in C:\WinNT\System32\Drivers\etc. -

    • +

    Windows 200x / XP can register it's host name with a Dynamic DNS server. You can force register with a Dynamic DNS server in Windows 200x / XP using: ipconfig /registerdns @@ -2428,8 +2303,8 @@ consequently network services will be severely impaired. The use of Dynamic DNS is highly recommended with Active Directory, in which case the use of BIND9 is preferred for it's ability to adequately support the SRV (service) records that are needed for Active Directory. -

    DNS and Active Directory

    -Occasionally we hear from Unix network administrators who want to use a Unix based Dynamic +

    DNS and Active Directory

    +Occasionally we hear from UNIX network administrators who want to use a UNIX based Dynamic DNS server in place of the Microsoft DNS server. While this might be desirable to some, the MS Windows 200x DNS server is auto-configured to work with Active Directory. It is possible to use BIND version 8 or 9, but it will almost certainly be necessary to create service records @@ -2450,7 +2325,7 @@ The following are some of the default service records that Active Directory requ

  • _ldap._tcp.Site.gc.ms-dcs.DomainTree

    Used by MS Windows clients to locate site configuration dependent Global Catalog server. -

    • How Browsing Functions

    +

    How Browsing Functions

    MS Windows machines register their NetBIOS names (ie: the machine name for each service type in operation) on start up. The exact method by which this name registration @@ -2464,7 +2339,7 @@ resolution to the local subnet, unless LMHOSTS is used to list all names and IP addresses. In such situations Samba provides a means by which the Samba server name may be forcibly injected into the browse list of a remote MS Windows network (using the -remote announce parameter). +remote announce parameter).

    Where a WINS server is used, the MS Windows client will use UDP unicast to register with the WINS server. Such packets can be routed @@ -2492,20 +2367,18 @@ will annoy users because they will have to put up with protracted inability to use the network services.

    Samba supports a feature that allows forced synchronisation -of browse lists across routed networks using the remote -browse sync parameter in the smb.conf file. +of browse lists across routed networks using the remote browse sync parameter in the smb.conf file. This causes Samba to contact the local master browser on a remote network and to request browse list synchronisation. This effectively bridges two networks that are separated by routers. The two remote networks may use either broadcast based name resolution or WINS -based name resolution, but it should be noted that the remote -browse sync parameter provides browse list synchronisation - and +based name resolution, but it should be noted that the remote browse sync parameter provides browse list synchronisation - and that is distinct from name to address resolution, in other words, for cross subnet browsing to function correctly it is essential that a name to address resolution mechanism be provided. This mechanism could be via DNS, /etc/hosts, and so on. -

    Setting up WORKGROUP Browsing

    +

    Setting up WORKGROUP Browsing

    To set up cross subnet browsing on a network containing machines in up to be in a WORKGROUP, not an NT Domain you need to set up one Samba server to be the Domain Master Browser (note that this is *NOT* @@ -2524,20 +2397,13 @@ workgroup name. To set up a Samba server as a domain master browser, set the following option in the [global] section of the smb.conf file :

    -

    -	domain master = yes
-

    +

    domain master = yes

    -The domain master browser should also preferrably be the local master +The domain master browser should also preferably be the local master browser for its own subnet. In order to achieve this set the following options in the [global] section of the smb.conf file :

    -

    -	domain master = yes
-	local master = yes
-	preferred master = yes
-	os level = 65
-

    +

    Example 10.1. Domain master browser smb.conf

    [global]
    domain master = yes
    local master = yes
    preferred master = yes
    os level = 65

    The domain master browser may be the same machine as the WINS server, if you require. @@ -2551,20 +2417,15 @@ to use these). To make a Samba server a local master browser set the following options in the [global] section of the smb.conf file :

    -

    -	domain master = no
-	local master = yes
-	preferred master = yes
-	os level = 65
-

    +

    Example 10.2. Local master browser smb.conf

    [global]
    domain master = no
    local master = yes
    preferred master = yes
    os level = 65

    Do not do this for more than one Samba server on each subnet, or they will war with each other over which is to be the local master browser.

    -The local master parameter allows Samba to act as a -local master browser. The preferred master causes nmbd -to force a browser election on startup and the os level +The local master parameter allows Samba to act as a +local master browser. The preferred master causes nmbd +to force a browser election on startup and the os level parameter sets Samba high enough so that it should win any browser elections.

    If you have an NT machine on the subnet that you wish to @@ -2573,13 +2434,8 @@ becoming a local master browser by setting the following options in the [global] section of the smb.conf file :

    -

    -	domain master = no
-	local master = no
-	preferred master = no
-	os level = 0
-

    -

    Setting up DOMAIN Browsing

    +

    Example 10.3. smb.conf for not being a master browser

    [global]
    domain master = no
    local master = no
    preferred master = no
    os level = 0

    +

    Setting up DOMAIN Browsing

    If you are adding Samba servers to a Windows NT Domain then you must not set up a Samba server as a domain master browser. By default, a Windows NT Primary Domain Controller for a domain @@ -2591,18 +2447,13 @@ with WINS instead of the PDC. For subnets other than the one containing the Windows NT PDC you may set up Samba servers as local master browsers as described. To make a Samba server a local master browser set -the following options in the [global] section +the following options in the [global] section of the smb.conf file :

    -

    -	domain master = no
-	local master = yes
-	preferred master = yes
-	os level = 65
-

    +

    Example 10.4. Local master browser smb.conf

    [global]
    domain master = no
    local master = yes
    preferred master = yes
    os level = 65

    If you wish to have a Samba server fight the election with machines -on the same subnet you may set the os level parameter +on the same subnet you may set the os level parameter to lower levels. By doing this you can tune the order of machines that will become local master browsers if they are running. For more details on this see the section @@ -2616,38 +2467,33 @@ ever becoming a local master browser by setting following options in the [global] section of the smb.conf file :

    -

    -        domain master = no
-        local master = no
-        preferred master = no
-        os level = 0
-

    +

    Example 10.5. smb.conf for not being a master browser

    [global]
    domain master = no
    local master = no
    preferred master = no
    os level = 0

    Forcing Samba to be the master

    -Who becomes the master browser is determined by an election +Who becomes the master browser is determined by an election process using broadcasts. Each election packet contains a number of parameters which determine what precedence (bias) a host should have in the election. By default Samba uses a very low precedence and thus loses elections to just about anyone else.

    -If you want Samba to win elections then just set the os level global +If you want Samba to win elections then just set the os level global option in smb.conf to a higher number. It defaults to 0. Using 34 would make it win all elections over every other system (except other samba systems!)

    -A os level of 2 would make it beat WfWg and Win95, but not MS Windows +A os level of 2 would make it beat WfWg and Win95, but not MS Windows NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32.

    The maximum os level is 255

    If you want Samba to force an election on startup, then set the -preferred master global option in smb.conf to yes. Samba will +preferred master global option in smb.conf to yes. Samba will then have a slight advantage over other potential master browsers that are not preferred master browsers. Use this parameter with care, as if you have two hosts (whether they are Windows 95 or NT or -Samba) on the same local subnet both set with preferred master to +Samba) on the same local subnet both set with preferred master to yes, then periodically and continually they will force an election in order to become the local master browser.

    -If you want Samba to be a domain master browser, then it is -recommended that you also set preferred master to yes, because + If you want Samba to be a domain master browser, then it is +recommended that you also set preferred master to yes, because Samba will not become a domain master browser for the whole of your LAN or WAN if it is not also a local master browser on its own broadcast isolated subnet. @@ -2659,10 +2505,10 @@ attempt to become the domain master browser every 5 minutes. They will find that another Samba server is already the domain master browser and will fail. This provides automatic redundancy, should the current domain master browser fail. -

    Making Samba the domain master

    +

    Making Samba the domain master

    The domain master is responsible for collating the browse lists of multiple subnets so that browsing can occur between subnets. You can -make Samba act as the domain master by setting domain master = yes +make Samba act as the domain master by setting domain master = yes in smb.conf. By default it will not be a domain master.

    Note that you should not set Samba to be the domain master for a @@ -2674,8 +2520,8 @@ master browsers on other subnets and then contact them to synchronise browse lists.

    If you want Samba to be the domain master then I suggest you also set -the os level high enough to make sure it wins elections, and set -preferred master to yes, to get Samba to force an election on +the os level high enough to make sure it wins elections, and set +preferred master to yes, to get Samba to force an election on startup.

    Note that all your servers (including Samba) and clients should be @@ -2701,31 +2547,31 @@ If, however, both Samba and your clients are using a WINS server, then: resolve the NetBIOS name of that host. as long as that host has registered its NetBIOS name with the same WINS server, the user will be able to see that host. -

    Note about broadcast addresses

    -If your network uses a "0" based broadcast address (for example if it +

    Note about broadcast addresses

    +If your network uses a "0" based broadcast address (for example if it ends in a 0) then you will strike problems. Windows for Workgroups does not seem to support a 0's broadcast and you will probably find that browsing and name lookups won't work. -

    Multiple interfaces

    +

    Multiple interfaces

    Samba now supports machines with multiple network interfaces. If you -have multiple interfaces then you will need to use the interfaces +have multiple interfaces then you will need to use the interfaces option in smb.conf to configure them. -

    Use of the Remote Announce parameter

    -The remote announce parameter of +

    Use of the Remote Announce parameter

    +The remote announce parameter of smb.conf can be used to forcibly ensure that all the NetBIOS names on a network get announced to a remote network. -The syntax of the remote announce parameter is: -

    -	remote announce = a.b.c.d [e.f.g.h] ...
-

    +The syntax of the remote announce parameter is: +

    remote announce = a.b.c.d [e.f.g.h] ...

    or -

    -	remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...
-

    +

    remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...

    where:

    a.b.c.d and -e.f.g.h

    is either the LMB (Local Master Browser) IP address +e.f.g.h

    + + + + is either the LMB (Local Master Browser) IP address or the broadcast address of the remote network. ie: the LMB is at 192.168.1.10, or the address could be given as 192.168.1.255 where the netmask @@ -2741,22 +2587,20 @@ NetBIOS machine names will end up looking like they belong to that workgroup, this may cause name resolution problems and should be avoided.

    -

    Use of the Remote Browse Sync parameter

    -The remote browse sync parameter of +

    Use of the Remote Browse Sync parameter

    +The remote browse sync parameter of smb.conf is used to announce to another LMB that it must synchronise its NetBIOS name list with our Samba LMB. It works ONLY if the Samba server that has this option is simultaneously the LMB on its network segment.

    -The syntax of the remote browse sync parameter is: +The syntax of the remote browse sync parameter is: -

    -remote browse sync = a.b.c.d
-

    +

    remote browse sync = a.b.c.d

    where a.b.c.d is either the IP address of the remote LMB or else is the network broadcast address of the remote segment. -

    WINS - The Windows Internetworking Name Server

    +

    WINS - The Windows Internetworking Name Server

    Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly recommended. Every NetBIOS machine registers its name together with a name_type value for each of several types of service it has available. @@ -2797,36 +2641,34 @@ lookup attempts by other clients and will therefore cause workstation access errors.

    To configure Samba as a WINS server just add -wins support = yes to the smb.conf -file [globals] section. +wins support = yes to the smb.conf +file [global] section.

    To configure Samba to register with a WINS server just add -wins server = a.b.c.d to your smb.conf file [globals] section. +wins server = a.b.c.d to your smb.conf file [global] section.

    Important

    -Never use both wins support = yes together -with wins server = a.b.c.d +Never use both wins support = yes together +with wins server = a.b.c.d particularly not using it's own IP address. Specifying both will cause nmbd to refuse to start! -

    Setting up a WINS server

    +

    Setting up a WINS server

    Either a Samba machine or a Windows NT Server machine may be set up as a WINS server. To set a Samba machine to be a WINS server you must add the following option to the smb.conf file on the selected machine : -in the [globals] section add the line +in the [global] section add the line

    -

    -	wins support = yes
-

    +

    wins support = yes

    Versions of Samba prior to 1.9.17 had this parameter default to yes. If you have any older versions of Samba on your network it is strongly suggested you upgrade to a recent version, or at the very least set the parameter to 'no' on all these machines.

    -Machines with wins support = yes will keep a list of +Machines with wins support = yes will keep a list of all NetBIOS names registered with them, acting as a DNS for NetBIOS names.

    You should set up only ONE WINS server. Do NOT set the -wins support = yes option on more than one Samba +wins support = yes option on more than one Samba server.

    To set up a Windows NT Server as a WINS server you need to set up @@ -2838,7 +2680,7 @@ participate in these replications. It is possible in the future that a Samba->Samba WINS replication protocol may be defined, in which case more than one Samba machine could be set up as a WINS server but currently only one Samba server should have the -wins support = yes parameter set. +wins support = yes parameter set.

    After the WINS server has been configured you must ensure that all machines participating on the network are configured with the address @@ -2849,17 +2691,15 @@ in Windows 95 or Windows NT. To tell a Samba server the IP address of the WINS server add the following line to the [global] section of all smb.conf files :

    -

    -	wins server = <name or IP address>
-

    +

    wins server = <name or IP address>

    where <name or IP address> is either the DNS name of the WINS server machine or its IP address.

    Note that this line MUST NOT BE SET in the smb.conf file of the Samba server acting as the WINS server itself. If you set both the -wins support = yes option and the -wins server = <name> option then +wins support = yes option and the +wins server = <name> option then nmbd will fail to start.

    There are two possible scenarios for setting up cross subnet browsing. @@ -2867,20 +2707,20 @@ The first details setting up cross subnet browsing on a network containing Windows 95, Samba and Windows NT machines that are not configured as part of a Windows NT Domain. The second details setting up cross subnet browsing on networks that contain NT Domains. -

    WINS Replication

    +

    WINS Replication

    Samba-3 permits WINS replication through the use of the wrepld utility. This tool is not currently capable of being used as it is still in active development. As soon as this tool becomes moderately functional we will prepare man pages and enhance this section of the documentation to provide usage and technical details. -

    Static WINS Entries

    -Adding static entries to your Samba-3 WINS server is actually fairly easy. +

    Static WINS Entries

    +Adding static entries to your Samba WINS server is actually fairly easy. All you have to do is add a line to wins.dat, typically located in /usr/local/samba/var/locks.

    Entries in wins.dat take the form of 

    -"NAME#TYPE" TTL ADDRESS+ FLAGS
+"NAME#TYPE" TTL ADDRESS+ FLAGS

    where NAME is the NetBIOS name, TYPE is the NetBIOS type, TTL is the @@ -2890,22 +2730,22 @@ flags for the registration.

    A typical dynamic entry looks like: 

    -"MADMAN#03" 1055298378 192.168.1.2 66R
+"MADMAN#03" 1055298378 192.168.1.2 66R

    To make it static, all that has to be done is set the TTL to 0: 

    -"MADMAN#03" 0 192.168.1.2 66R
+"MADMAN#03" 0 192.168.1.2 66R

    Though this method works with early Samba-3 versions, there's a possibility that it may change in future versions if WINS replication is added. -

    Helpful Hints

    +

    Helpful Hints

    The following hints should be carefully considered as they are stumbling points for many new network administrators. -

    Windows Networking Protocols

    Warning

    +

    Windows Networking Protocols

    Warning

    Do NOT use more than one (1) protocol on MS Windows machines

    A very common cause of browsing problems results from installing more than @@ -2917,7 +2757,7 @@ of precedence for winning this election process. A machine running Samba or Windows NT will be biased so that the most suitable machine will predictably win and thus retain it's role.

    -The election process is "fought out" so to speak over every NetBIOS network +The election process is "fought out" so to speak over every NetBIOS network interface. In the case of a Windows 9x machine that has both TCP/IP and IPX installed and has NetBIOS enabled over both protocols the election will be decided over both protocols. As often happens, if the Windows 9x machine is @@ -2935,34 +2775,27 @@ differently from MS Windows NT4. Generally, where a server does NOT support the newer or extended protocol, these will fall back to the NT4 protocols.

    The safest rule of all to follow it this - USE ONLY ONE PROTOCOL! -

    Name Resolution Order

    +

    Name Resolution Order

    Resolution of NetBIOS names to IP addresses can take place using a number of methods. The only ones that can provide NetBIOS name_type information are: -

    WINS: the best tool!
    LMHOSTS: is static and hard to maintain.
    Broadcast: uses UDP and can not resolve names across remote segments.

    +

    • WINS: the best tool!

    • LMHOSTS: is static and hard to maintain.

    • Broadcast: uses UDP and can not resolve names across remote segments.

    Alternative means of name resolution includes: -

    /etc/hosts: is static, hard to maintain, and lacks name_type info
    DNS: is a good choice but lacks essential name_type info.

    +

    • /etc/hosts: is static, hard to maintain, and lacks name_type info

    • DNS: is a good choice but lacks essential name_type info.

    Many sites want to restrict DNS lookups and want to avoid broadcast name -resolution traffic. The name resolve order parameter is -of great help here. The syntax of the name resolve order -parameter is: -

    -name resolve order = wins lmhosts bcast host
-

    +resolution traffic. The name resolve order parameter is of great help here. +The syntax of the name resolve order parameter is: +

    name resolve order = wins lmhosts bcast host

    or -

    -name resolve order = wins lmhosts  	(eliminates bcast and host)
-

    +

    name resolve order = wins lmhosts (eliminates bcast and host)

    The default is: -

    -name resolve order = host lmhost wins bcast
-

    -where "host" refers the the native methods used by the Unix system +

    name resolve order = host lmhost wins bcast

    +where "host" refers to the native methods used by the UNIX system to implement the gethostbyname() function call. This is normally controlled by /etc/host.conf, /etc/nsswitch.conf and /etc/resolv.conf. -

    Technical Overview of browsing

    +

    Technical Overview of browsing

    SMB networking provides a mechanism by which clients can access a list -of machines in a network, a so-called browse list. This list +of machines in a network, a so-called browse list. This list contains machines that are ready to offer file and/or print services to other machines within the network. Thus it does not include machines which aren't currently able to do server tasks. The browse @@ -2980,7 +2813,7 @@ Where NetBIOS over TCP/IP is enabled use of a WINS server is highly recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. WINS allows remote segment clients to obtain NetBIOS name_type information that can NOT be provided by any other means of name resolution. -

    Browsing support in Samba

    +

    Browsing support in Samba

    Samba facilitates browsing. The browsing is supported by nmbd and is also controlled by options in the smb.conf file. Samba can act as a local browse master for a workgroup and the ability @@ -3007,15 +2840,15 @@ WINS server capabilities. In a Samba-only environment, it is recommended that you use one and only one Samba server as your WINS server.

    To get browsing to work you need to run nmbd as usual, but will need -to use the workgroup option in smb.conf +to use the workgroup option in smb.conf to control what workgroup Samba becomes a part of.

    Samba also has a useful option for a Samba server to offer itself for browsing on another subnet. It is recommended that this option is only used for 'unusual' purposes: announcements over the internet, for -example. See remote announce in the +example. See remote announce in the smb.conf man page. -

    Problem resolution

    +

    Problem resolution

    If something doesn't work then hopefully the log.nmbd file will help you track down the problem. Try a debug level of 2 or 3 for finding problems. Also note that the current browse list usually gets stored @@ -3026,7 +2859,7 @@ type the server name as \\SERVER in filemanager then hit enter and filemanager should display the list of available shares.

    Some people find browsing fails because they don't have the global -guest account set to a valid account. Remember that the +guest account set to a valid account. Remember that the IPC$ connection that lists the shares is done as guest, and thus you must have a valid guest account.

    @@ -3038,9 +2871,9 @@ name of the currently logged in user to query the IPC$ share. MS Windows server resources.

    The other big problem people have is that their broadcast address, -netmask or IP address is wrong (specified with the "interfaces" option +netmask or IP address is wrong (specified with the "interfaces" option in smb.conf) -

    Browsing across subnets

    +

    Browsing across subnets

    Since the release of Samba 1.9.17(alpha1), Samba has supported the replication of browse lists across subnet boundaries. This section describes how to set this feature up in different settings. @@ -3061,32 +2894,14 @@ be they Windows 95, Windows NT, or Samba servers must have the IP address of a WINS server given to them by a DHCP server, or by manual configuration (for Win95 and WinNT, this is in the TCP/IP Properties, under Network settings) for Samba this is in the smb.conf file. -

    How does cross subnet browsing work ?

    +

    How does cross subnet browsing work ?

    Cross subnet browsing is a complicated dance, containing multiple moving parts. It has taken Microsoft several years to get the code that achieves this correct, and Samba lags behind in some areas. Samba is capable of cross subnet browsing when configured correctly.

    -Consider a network set up as follows : -

    - -

    -                                   (DMB)
-             N1_A      N1_B        N1_C       N1_D        N1_E
-              |          |           |          |           |
-          -------------------------------------------------------
-            |          subnet 1                       |
-          +---+                                      +---+
-          |R1 | Router 1                  Router 2   |R2 |
-          +---+                                      +---+
-            |                                          |
-            |  subnet 2              subnet 3          |
-  --------------------------       ------------------------------------
-  |     |     |      |               |        |         |           |
- N2_A  N2_B  N2_C   N2_D           N3_A     N3_B      N3_C        N3_D 
-                    (WINS)
-

    -

    + Consider a network set up as in the diagram below. +

    Figure 10.1. Cross subnet browsing example

    Cross subnet browsing example

    Consisting of 3 subnets (1, 2, 3) connected by two routers (R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume @@ -3128,7 +2943,7 @@ At this point the browse lists look as follows (these are the machines you would see in your network neighborhood if you looked in it on a particular network right now).

    -

    Table 10.1. Browse subnet example 1

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    +

    Table 10.1. Browse subnet example 1

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    Note that at this point all the subnets are separate, no machine is seen across any of the subnets. @@ -3150,7 +2965,9 @@ the MasterAnnouncement packet it schedules a synchronization request to the sender of that packet. After both synchronizations are done the browse lists look like :

    -

    Table 10.2. Browse subnet example 2

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    +

    Table 10.2. Browse subnet example 2

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +N2_A(*), N2_B(*), N2_C(*), N2_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    Servers with a (*) after them are non-authoritative names.

    @@ -3158,14 +2975,17 @@ At this point users looking in their network neighborhood on subnets 1 or 2 will see all the servers on both, users on subnet 3 will still only see the servers on their own subnet.

    -The same sequence of events that occured for N2_B now occurs +The same sequence of events that occurred for N2_B now occurs for the local master browser on subnet 3 (N3_D). When it synchronizes browse lists with the domain master browser (N1_A) it gets both the server entries on subnet 1, and those on subnet 2. After N3_D has synchronized with N1_C and vica-versa the browse lists look like.

    -

    Table 10.3. Browse subnet example 3

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)

    +

    Table 10.3. Browse subnet example 3

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)

    Servers with a (*) after them are non-authoritative names.

    @@ -3178,7 +2998,13 @@ with the domain master browser (N1_C) and will receive the missing server entries. Finally - and as a steady state (if no machines are removed or shut off) the browse lists will look like :

    -

    Table 10.4. Browse subnet example 4

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)

    +

    Table 10.4. Browse subnet example 4

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), +N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), +N3_C(*), N3_D(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), +N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), +N2_C(*), N2_D(*)

    Servers with a (*) after them are non-authoritative names.

    @@ -3199,11 +3025,11 @@ If either router R1 or R2 fails the following will occur: be able to access servers on its local subnet, by using subnet-isolated broadcast NetBIOS name resolution. The effects are similar to that of losing access to a DNS server. -

    Common Errors

    +

    Common Errors

    Many questions are asked on the mailing lists regarding browsing. The majority of browsing problems originate out of incorrect configuration of NetBIOS name resolution. Some are of particular note. -

    How can one flush the Samba NetBIOS name cache without restarting Samba?

    +

    How can one flush the Samba NetBIOS name cache without restarting Samba?

    Samba's nmbd process controls all browse list handling. Under normal circumstances it is safe to restart nmbd. This will effectively flush the Samba NetBIOS name cache and cause it to be rebuilt. Note that this does NOT make certain that a rogue machine name will not re-appear @@ -3213,33 +3039,37 @@ want to clear a rogue machine from the list then every machine on the network wi shut down and restarted at after all machines are down. Failing a complete restart, the only other thing you can do is wait until the entry times out and is then flushed from the list. This may take a long time on some networks (months). -

    My client reports "This server is not configured to list shared resources"

    +

    My client reports "This server is not configured to list shared resources"

    Your guest account is probably invalid for some reason. Samba uses the guest account for browsing in smbd. Check that your guest account is valid. -

    See also guest account in the smb.conf man page.

    Chapter 11. Account Information Databases

    Jelmer R. Vernooij

    The Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Jeremy Allison

    Samba Team

    John H. Terpstra

    Samba Team

    Olivier (lem) Lemaire

    IDEALX

    May 24, 2003

    Table of Contents

    Features and Benefits
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and Unix
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon - Users not in Samba SAM
    Users are being added to the wrong backend database
    auth methods does not work

    -Samba-3 implements a new capability to work concurrently with multiple account backends. -The possible new combinations of password backends allows Samba-3 a degree of flexibility +

    See also guest account in the smb.conf man page.

    I get an Unable to browse the network error

    This error can have multiple causes:

    • There is no local master browser. Configure nmbd + or any other machine to serve as local master browser.

    • You can not log onto the machine that is the local master + browser. Can you logon to it as guest user?

    • There is no IP connectivity to the local master browser. + Can you reach it by broadcast?

    Chapter 11. Account Information Databases

    Jelmer R. Vernooij

    The Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Jeremy Allison

    Samba Team

    John H. Terpstra

    Samba Team

    Olivier (lem) Lemaire

    IDEALX

    May 24, 2003

    Table of Contents

    Features and Benefits
    Backwards Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon
    Users being added to wrong backend database
    auth methods does not work

    +Samba 3 implements a new capability to work concurrently with multiple account backends. +The possible new combinations of password backends allows Samba 3 a degree of flexibility and scalability that previously could be achieved only with MS Windows Active Directory. This chapter describes the new functionality and how to get the most out of it.

    In the course of development of Samba-3, a number of requests were received to provide the ability to migrate MS Windows NT4 SAM accounts to Samba-3 without the need to provide -matching Unix/Linux accounts. We called this the Non Unix Accounts (NUA) +matching UNIX/Linux accounts. We called this the Non UNIX Accounts (NUA) capability. The intent was that an administrator could decide to use the tdbsam -backend and by simply specifying "passdb backend = tdbsam_nua, guest" -this would allow Samba-3 to implement a solution that did not use Unix accounts per se. Late +backend and by simply specifying passdb backend = tdbsam_nua +this would allow Samba-3 to implement a solution that did not use UNIX accounts per se. Late in the development cycle, the team doing this work hit upon some obstacles that prevents this solution from being used. Given the delays with Samba-3 release a decision was made to NOT deliver this functionality until a better method of recognising NT Group SIDs from NT User SIDs could be found. This feature may thus return during the life cycle for the Samba-3 series.

    Note

    -Samba-3.0.0 does NOT support Non-Unix Account (NUA) operation. -

    Features and Benefits

    +Samba-3 does NOT support Non-UNIX Account (NUA) operation for user accounts. +Samba-3 does support NUA operation for machine accounts. +

    Features and Benefits

    Samba-3 provides for complete backwards compatibility with Samba-2.2.x functionality as follows: -

    Backwards Compatibility Backends

    Plain Text:

    - This option uses nothing but the Unix/Linux /etc/passwd +

    Backwards Compatibility Backends

    Plain Text:

    + This option uses nothing but the UNIX/Linux /etc/passwd style back end. On systems that have PAM (Pluggable Authentication Modules) support all PAM modules are supported. The behaviour is just as it was with Samba-2.2.x, and the protocol limitations imposed by MS Windows clients @@ -3261,13 +3091,9 @@ as follows: This option is provided primarily as a migration tool, although there is no reason to force migration at this time. Note that this tool will eventually be deprecated. -

    +

    New Backends

    Samba-3 introduces the following new password backend capabilities: -

    New Backends

    guest:

    - This is always required as the last backend specified. - It provides the ability to handle guest account requirements for access to - resources like IPC$ which is used for browsing. -

    tdbsam:

    +

    tdbsam:

    This backend provides a rich database backend for local servers. This backend is NOT suitable for multiple domain controller (ie: PDC + one or more BDC) installations. @@ -3293,7 +3119,7 @@ Samba-3 introduces the following new password backend capabilities:

    The new LDAP implementation significantly expands the control abilities that were possible with prior versions of Samba. It is now possible to specify - "per user" profile settings, home directories, account access controls, and + "per user" profile settings, home directories, account access controls, and much more. Corporate sites will see that the Samba-Team has listened to their requests both for capability and to allow greater scalability.

    mysqlsam (MySQL based backend):

    @@ -3309,10 +3135,7 @@ Samba-3 introduces the following new password backend capabilities: The xmlsam option can be useful for account migration between database backends or backups. Use of this tool will allow the data to be edited before migration into another backend format. -

    nisplussam:

    - The NIS+ based passdb backend. Takes name NIS domain as an - optional argument. Only works with Sun NIS+ servers. -

    Technical Information

    +

    Technical Information

    Old windows clients send plain text passwords over the wire. Samba can check these passwords by crypting them and comparing them to the hash stored in the unix user database.

    @@ -3327,16 +3150,16 @@ Samba-3 introduces the following new password backend capabilities: In addition to differently encrypted passwords, windows also stores certain data for each user that is not stored in a unix user database. e.g: workstations the user may logon from, the location where the users' profile is stored, and so on. Samba retrieves and stores this - information using a passdb backend. Commonly available backends are LDAP, plain text + information using a passdb backend. Commonly available backends are LDAP, plain text file, MySQL and nisplus. For more information, see the man page for smb.conf regarding the - passdb backend parameter. -

    Important Notes About Security

    + passdb backend parameter. +

    Figure 11.1. IDMAP

    IDMAP

    Important Notes About Security

    The unix and SMB password encryption techniques seem similar on the surface. This similarity is, however, only skin deep. The unix scheme typically sends clear text passwords over the network when logging in. This is bad. The SMB encryption scheme never sends the cleartext password over the network but it does store the 16 byte hashed values on disk. This is also bad. Why? Because the 16 byte hashed values - are a "password equivalent". You cannot derive the user's password from them, but + are a "password equivalent". You cannot derive the user's password from them, but they could potentially be used in a modified client to gain access to a server. This would require considerable technical knowledge on behalf of the attacker but is perfectly possible. You should thus treat the data stored in whatever passdb @@ -3354,12 +3177,12 @@ Samba-3 introduces the following new password backend capabilities:

    The following versions of MS Windows do not support full domain security protocols, although they may log onto a domain environment: -

    MS DOS Network client 3.0 with the basic network redirector installed
    Windows 95 with the network redirector update installed
    Windows 98 [se]
    Windows Me

    Note

    +

    • MS DOS Network client 3.0 with the basic network redirector installed

    • Windows 95 with the network redirector update installed

    • Windows 98 [se]

    • Windows Me

    Note

    MS Windows XP Home does not have facilities to become a domain member and it can not participate in domain logons.

    The following versions of MS Windows fully support domain security protocols. -

    Windows NT 3.5x
    Windows NT 4.0
    Windows 2000 Professional
    Windows 200x Server/Advanced Server
    Windows XP Professional

    +

    • Windows NT 3.5x

    • Windows NT 4.0

    • Windows 2000 Professional

    • Windows 200x Server/Advanced Server

    • Windows XP Professional

    All current release of Microsoft SMB/CIFS clients support authentication via the SMB Challenge/Response mechanism described here. Enabling clear text authentication does not disable the ability of the client to participate in encrypted authentication. @@ -3372,7 +3195,7 @@ Samba-3 introduces the following new password backend capabilities: (broken) only the cached (encrypted) password will be sent to the resource server to affect a auto-reconnect. If the resource server does not support encrypted passwords the auto-reconnect will fail. USE OF ENCRYPTED PASSWORDS IS STRONGLY ADVISED. -

    Advantages of Encrypted Passwords

    • Plain text passwords are not passed across +

      Advantages of Encrypted Passwords

      • Plain text passwords are not passed across the network. Someone using a network sniffer cannot just record passwords going to the SMB server.

      • Plain text passwords are not stored anywhere in memory or on disk.

      • WinNT doesn't like talking to a server @@ -3383,32 +3206,44 @@ Samba-3 introduces the following new password backend capabilities: only things you can do to stop this is to use SMB encryption.

      • Encrypted password support allows automatic share (resource) reconnects.

      • Encrypted passwords are essential for PDC/BDC - operation.

      Advantages of non-encrypted passwords

      • Plain text passwords are not kept + operation.

      Advantages of non-encrypted passwords

      • Plain text passwords are not kept on disk, and are NOT cached in memory.

      • Uses same password file as other unix services such as login and ftp

      • Use of other services (such as telnet and ftp) which send plain text passwords over the net, so sending them for SMB - isn't such a big deal.

    Mapping User Identifiers between MS Windows and Unix

    - Every operation in Unix/Linux requires a user identifier (UID), just as in + isn't such a big deal.

    Mapping User Identifiers between MS Windows and UNIX

    + Every operation in UNIX/Linux requires a user identifier (UID), just as in MS Windows NT4 / 200x this requires a Security Identifier (SID). Samba provides - two means for mapping an MS Windows user to a Unix/Linux UID. + two means for mapping an MS Windows user to a UNIX/Linux UID.

    Firstly, all Samba SAM (Security Account Manager database) accounts require - a Unix/Linux UID that the account will map to. As users are added to the account - information database, Samba-3 will call the add user script - interface to add the account to the Samba host OS. In essence, all accounts in + a UNIX/Linux UID that the account will map to. As users are added to the account + information database, Samba will call the add user script + interface to add the account to the Samba host OS. In essence all accounts in the local SAM require a local user account.

    - The second way to affect Windows SID to Unix UID mapping is via the + The second way to affect Windows SID to UNIX UID mapping is via the idmap uid, idmap gid parameters in smb.conf. Please refer to the man page for information about these parameters. These parameters are essential when mapping users from a remote SAM server. -

    Account Management Tools

    -Samba-3 provides two (2) tools for management of User and machine accounts. These tools are +

    Mapping Common UIDs/GIDs on Distributed Machines

    + Samba-3 has a special facility that makes it possible to maintain identical UIDs and GIDs + on all servers in a distributed network. A distributed network is one where there exists + a PDC, one or more BDCs and/or one or more domain member servers. Why is this important? + This is important if files are being shared over more than one protocol (eg: NFS) and where + users are copying files across UNIX/Linux systems using tools such as rsync. +

    + The special facility is enabled using a parameter called idmap backend. + The default setting for this parameter is an empty string. Administrators should NOT set this + parameter except when an LDAP based passdb backend is in use. An example of use is: +

    +

    Example 11.1. 

    [global]
    idmap backend = ldapsam://ldap-server.quenya.org:636

    +

    Account Management Tools

    +Samba provides two (2) tools for management of User and machine accounts. These tools are called smbpasswd and pdbedit. A third tool is under development but is NOT expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK GUI tool that looks much like the MS Windows NT4 Domain User Manager - hopefully this will be announced in time for the Samba-3.0.1 release. -

    The smbpasswd Command

    +

    The smbpasswd Command

    The smbpasswd utility is a utility similar to the passwd or yppasswd programs. It maintains the two 32 byte password fields in the passdb backend. @@ -3422,19 +3257,19 @@ be announced in time for the Samba-3.0.1 release. if changing an NT Domain user's password).

    smbpasswd can be used to: -

    add user or machine accounts
    delete user or machine accounts
    enable user or machine accounts
    disable user or machine accounts
    set to NULL user passwords
    manage interdomain trust accounts

    +

    • add user or machine accounts

    • delete user or machine accounts

    • enable user or machine accounts

    • disable user or machine accounts

    • set to NULL user passwords

    • manage interdomain trust accounts

    To run smbpasswd as a normal user just type:

    - 

    -		$ smbpasswd
-		Old SMB password: secret
-

    +

    +$ smbpasswd
+Old SMB password: secret
+

    For secret type old value here - or hit return if there was no old password - 

    -		New SMB Password: new secret
-		Repeat New SMB Password: new secret
-

    +

    +New SMB Password: new secret
+Repeat New SMB Password: new secret
+

    If the old value does not match the current value stored for that user, or the two new values do not match each other, then the password will not be changed. @@ -3454,10 +3289,10 @@ be announced in time for the Samba-3.0.1 release.

    For more details on using smbpasswd refer to the man page (the definitive reference). -

    The pdbedit Command

    +

    The pdbedit Command

    pdbedit is a tool that can be used only by root. It is used to manage the passdb backend. pdbedit can be used to: -

    add, remove or modify user accounts
    listing user accounts
    migrate user accounts

    +

    • add, remove or modify user accounts

    • listing user accounts

    • migrate user accounts

    The pdbedit tool is the only one that can manage the account security and policy settings. It is capable of all operations that smbpasswd can do as well as a super set of them. @@ -3469,50 +3304,60 @@ be announced in time for the Samba-3.0.1 release. The following is an example of the user account information that is stored in a tdbsam password backend. This listing was produced by running: 

    -		$ pdbedit -Lv met
-		Unix username:        met
-		NT username:
-		Account Flags:        [UX         ]
-		User SID:             S-1-5-21-1449123459-1407424037-3116680435-2004
-		Primary Group SID:    S-1-5-21-1449123459-1407424037-3116680435-1201
-		Full Name:            Melissa E Terpstra
-		Home Directory:       \\frodo\met\Win9Profile
-		HomeDir Drive:        H:
-		Logon Script:         scripts\logon.bat
-		Profile Path:         \\frodo\Profiles\met
-		Domain:               MIDEARTH
-		Account desc:
-		Workstations:         melbelle
-		Munged dial:
-		Logon time:           0
-		Logoff time:          Mon, 18 Jan 2038 20:14:07 GMT
-		Kickoff time:         Mon, 18 Jan 2038 20:14:07 GMT
-		Password last set:    Sat, 14 Dec 2002 14:37:03 GMT
-		Password can change:  Sat, 14 Dec 2002 14:37:03 GMT
-		Password must change: Mon, 18 Jan 2038 20:14:07 GMT
-

    Password Backends

    -Samba-3 offers the greatest flexibility in backend account database design of any SMB/CIFS server +$ pdbedit -Lv met +UNIX username: met +NT username: +Account Flags: [UX ] +User SID: S-1-5-21-1449123459-1407424037-3116680435-2004 +Primary Group SID: S-1-5-21-1449123459-1407424037-3116680435-1201 +Full Name: Melissa E Terpstra +Home Directory: \\frodo\met\Win9Profile +HomeDir Drive: H: +Logon Script: scripts\logon.bat +Profile Path: \\frodo\Profiles\met +Domain: MIDEARTH +Account desc: +Workstations: melbelle +Munged dial: +Logon time: 0 +Logoff time: Mon, 18 Jan 2038 20:14:07 GMT +Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT +Password last set: Sat, 14 Dec 2002 14:37:03 GMT +Password can change: Sat, 14 Dec 2002 14:37:03 GMT +Password must change: Mon, 18 Jan 2038 20:14:07 GMT +

    + The pdbedit tool allows migration of authentication (account) + databases from one backend to another. For example: To migrate accounts from an + old smbpasswd database to a tdbsam + backend: +

    1. + Set the passdb backend = tdbsam, smbpasswd. +

    2. + Execute: +

      +root# pdbedit -i smbpassed -e tdbsam
+

      +

    3. + Now remove the smbpasswd from the passdb backend + configuration in smb.conf. +

    Password Backends

    +Samba offers the greatest flexibility in backend account database design of any SMB/CIFS server technology available today. The flexibility is immediately obvious as one begins to explore this capability.

    It is possible to specify not only multiple different password backends, but even multiple backends of the same type. For example, to use two different tdbsam databases:

    -

    -[globals]
-		passdb backend = tdbsam:/etc/samba/passdb.tdb, \
-		tdbsam:/etc/samba/old-passdb.tdb, guest
-

    -

    Plain Text

    +

    passdb backend = tdbsam:/etc/samba/passdb.tdb, tdbsam:/etc/samba/old-passdb.tdb

    +

    Plain Text

    Older versions of Samba retrieved user information from the unix user database and eventually some other fields from the file /etc/samba/smbpasswd or /etc/smbpasswd. When password encryption is disabled, no SMB specific data is stored at all. Instead all operations are conducted via the way that the Samba host OS will access its /etc/passwd database. eg: On Linux systems that is done via PAM. -

    smbpasswd - Encrypted Password Database

    - Traditionally, when configuring encrypt - passwords = yes in Samba's smb.conf file, user account +

    smbpasswd - Encrypted Password Database

    + Traditionally, when configuring encrypt passwords = yes in Samba's smb.conf file, user account information such as username, LM/NT password hashes, password change times, and account flags have been stored in the smbpasswd(5) file. There are several disadvantages to this approach for sites with very large numbers of users (counted @@ -3538,10 +3383,10 @@ backends of the same type. For example, to use two different tdbsam databases: is commonly referred to as the samdb interface (previously this was called the passdb API, and is still so named in the Samba CVS trees).

    - Samba-3 provides an enhanced set of passdb backends that overcome the deficiencies + Samba provides an enhanced set of passdb backends that overcome the deficiencies of the smbpasswd plain text database. These are tdbsam, ldapsam, and xmlsam. Of these ldapsam will be of most interest to large corporate or enterprise sites. -

    tdbsam

    Samba can store user and machine account data in a "TDB" (Trivial Database). +

    tdbsam

    Samba can store user and machine account data in a "TDB" (Trivial Database). Using this backend doesn't require any additional configuration. This backend is recommended for new installations that do not require LDAP.

    @@ -3549,7 +3394,7 @@ backends of the same type. For example, to use two different tdbsam databases: that have 250 or more users. Additionally, tdbsam is not capable of scaling for use in sites that require PDB/BDC implementations that requires replication of the account database. Clearly, for reason of scalability, the use of ldapsam should be encouraged. -

    ldapsam

    +

    ldapsam

    There are a few points to stress that the ldapsam does not provide. The LDAP support referred to in the this documentation does not include:

    • A means of retrieving user account information from @@ -3557,8 +3402,8 @@ backends of the same type. For example, to use two different tdbsam databases: The second item can be accomplished by using LDAP NSS and PAM modules. LGPL versions of these libraries can be obtained from PADL Software (http://www.padl.com/). More - information about the configuration of these packages may be found at "LDAP, - System Administration; Gerald Carter, O'Reilly; Chapter 6: Replacing NIS". + information about the configuration of these packages may be found at "LDAP, + System Administration; Gerald Carter, O'Reilly; Chapter 6: Replacing NIS". Refer to http://safari.oreilly.com/?XmlId=1-56592-491-6 for those who might wish to know more about configuration and administration of an OpenLDAP server. @@ -3572,28 +3417,30 @@ backends of the same type. For example, to use two different tdbsam databases: and has a working directory server already installed. For more information on LDAP architectures and Directories, please refer to the following sites.

      + http://iplanet.netscape.com/directory

    Two additional Samba resources which may prove to be helpful are

    • The Samba-PDC-LDAP-HOWTO maintained by Ignacio Coupeau.

    • The NT migration scripts from IDEALX that are geared to manage users and group in such a Samba-LDAP Domain Controller configuration. -

    Supported LDAP Servers

    +

    Supported LDAP Servers

    The LDAP ldapsam code has been developed and tested using the OpenLDAP 2.0 and 2.1 server and client libraries. The same code should work with Netscape's Directory Server and client SDK. However, there are bound to be compile errors and bugs. These should not be hard to fix. Please submit fixes via Bug reporting facility. -

    Schema and Relationship to the RFC 2307 posixAccount

    +

    Schema and Relationship to the RFC 2307 posixAccount

    Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: 

    -objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY
-    DESC 'Samba Auxiliary Account'
-    MUST ( uid $ rid )
-    MAY  ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
-           logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
-           displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
-           description $ userWorkstations $ primaryGroupID $ domain ))
+objectclass ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY
+    DESC 'Samba 3.0 Auxiliary SAM Account'
+    MUST ( uid $ sambaSID )
+    MAY  ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $
+          sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $
+          sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $
+          displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $
+          sambaProfilePath $ description $ sambaUserWorkstations $
+          sambaPrimaryGroupSID $ sambaDomainName ))

    The samba.schema file has been formatted for OpenLDAP 2.0/2.1. @@ -3617,7 +3464,7 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY and functioning correctly. This division of information makes it possible to store all Samba account information in LDAP, but still maintain UNIX account information in NIS while the network is transitioning to a full LDAP infrastructure. -

    OpenLDAP configuration

    +

    OpenLDAP configuration

    To include support for the sambaSamAccount object in an OpenLDAP directory server, first copy the samba.schema file to slapd's configuration directory. The samba.schema file can be found in the directory examples/LDAP @@ -3651,7 +3498,7 @@ include /etc/openldap/schema/nis.schema like in the following example, to speed up searches made on sambaSamAccount objectclasses (and possibly posixAccount and posixGroup as well).

    -

    +
     # Indices to maintain
 ## required by OpenLDAP
 index objectclass             eq
@@ -3678,7 +3525,7 @@ index   default               sub
 		Create the new index by executing:
 		
    
 
    -./sbin/slapindex -f slapd.conf
+root# ./sbin/slapindex -f slapd.conf
 
    
 
    
 		Remember to restart slapd after making these changes:
@@ -3686,34 +3533,34 @@ index   default               sub
 
     root# /etc/init.d/slapd restart
 
    
-

    Initialise the LDAP database

    +

    Initialise the LDAP database

    Before you can add accounts to the LDAP database you must create the account containers that they will be stored in. The following LDIF file should be modified to match your needs (ie: Your DNS entries, etc.).

    -

    +
     # Organization for Samba Base
-dn: dc=plainjoe,dc=org
+dn: dc=quenya,dc=org
 objectclass: dcObject
 objectclass: organization
-dc: plainjoe
-o: Terpstra Org Network
+dc: quenya
+o: Quenya Org Network
 description: The Samba-3 Network LDAP Example
 
 # Organizational Role for Directory Management
-dn: cn=Manager,dc=plainjoe,dc=org
+dn: cn=Manager,dc=quenya,dc=org
 objectclass: organizationalRole
 cn: Manager
 description: Directory Manager
 
 # Setting up container for users
-dn: ou=People,dc=plainjoe,dc=org
+dn: ou=People,dc=quenya,dc=org
 objectclass: top
 objectclass: organizationalUnit
 ou: People
 
 # Setting up admin handle for People OU
-dn: cn=admin,ou=People,dc=plainjoe,dc=org
+dn: cn=admin,ou=People,dc=quenya,dc=org
 cn: admin
 objectclass: top
 objectclass: organizationalRole
@@ -3735,70 +3582,39 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz
 		
    Note
    
 		Before Samba can access the LDAP server you need to store the LDAP admin password
 		into the Samba-3 secrets.tdb database by:
-		
    -root#  smbpasswd -w secret
-		
    
-

    Configuring Samba

    +

    +root# smbpasswd -w secret
+

    +

    Configuring Samba

    The following parameters are available in smb.conf only if your version of samba was built with LDAP support. Samba automatically builds with LDAP support if the LDAP libraries are found. -

    +

    LDAP related smb.conf options: + passdb backend = ldapsam:url, + ldap ssl, + ldap admin dn, + ldap suffix, + ldap filter, + ldap machine suffix, + ldap user suffix, + ldap delete dn, + ldap passwd sync, + ldap trust ids. +

    These are described in the smb.conf man page and so will not be repeated here. However, a sample smb.conf file for use with an LDAP directory could appear as

    -

    -## /usr/local/samba/lib/smb.conf
-[global]
-     security = user
-     encrypt passwords = yes
-
-     netbios name = TASHTEGO
-     workgroup = NARNIA
-
-     # ldap related parameters
-
-     # define the DN to use when binding to the directory servers
-     # The password for this DN is not stored in smb.conf.  Rather it
-     # must be set by using 'smbpasswd -w secretpw' to store the
-     # passphrase in the secrets.tdb file.  If the "ldap admin dn" values
-     # change, this password will need to be reset.
-     ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"
-
-     # Define the SSL option when connecting to the directory
-     # ('off', 'start tls', or 'on' (default))
-     ldap ssl = start tls
-
-     # syntax: passdb backend = ldapsam:ldap://server-name[:port]
-     passdb backend = ldapsam:ldap://funball.samba.org, guest
-
-     # smbpasswd -x delete the entire dn-entry
-     ldap delete dn = no
-
-     # the machine and user suffix added to the base suffix
-     # wrote WITHOUT quotes. NULL suffixes by default
-     ldap user suffix = ou=People
-     ldap machine suffix = ou=Systems
-
-     # Trust unix account information in LDAP
-     #  (see the smb.conf manpage for details)
-     ldap trust ids = Yes
-
-     # specify the base DN to use when searching the directory
-     ldap suffix = "ou=people,dc=samba,dc=org"
-
-     # generally the default ldap search filter is ok
-     # ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))"
-

    -

    Accounts and Groups management

    +

    Example 11.2. Configuration with LDAP

    [global]
    security = user
    encrypt passwords = yes
    netbios name = TASHTEGO
    workgroup = NARNIA
    # ldap related parameters
    # define the DN to use when binding to the directory servers
    # The password for this DN is not stored in smb.conf. Rather it
    # must be set by using 'smbpasswd -w secretpw' to store the
    # passphrase in the secrets.tdb file. If the "ldap admin dn" values
    # change, this password will need to be reset.
    ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"
    # Define the SSL option when connecting to the directory
    # ('off', 'start tls', or 'on' (default))
    ldap ssl = start tls
    # syntax: passdb backend = ldapsam:ldap://server-name[:port]
    passdb backend = ldapsam:ldap://funball.samba.org
    # smbpasswd -x delete the entire dn-entry
    ldap delete dn = no
    # the machine and user suffix added to the base suffix
    # wrote WITHOUT quotes. NULL suffixes by default
    ldap user suffix = ou=People
    ldap machine suffix = ou=Systems
    # Trust unix account information in LDAP
    # (see the smb.conf manpage for details)
    ldap trust ids = Yes
    # specify the base DN to use when searching the directory
    ldap suffix = "ou=people,dc=samba,dc=org"
    # generally the default ldap search filter is ok
    ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))"

    +

    Accounts and Groups management

    As users accounts are managed through the sambaSamAccount objectclass, you should modify your existing administration tools to deal with sambaSamAccount attributes.

    Machines accounts are managed with the sambaSamAccount objectclass, just like users accounts. However, it's up to you to store those accounts in a different tree of your LDAP namespace: you should use - "ou=Groups,dc=plainjoe,dc=org" to store groups and - "ou=People,dc=plainjoe,dc=org" to store users. Just configure your + "ou=Groups,dc=quenya,dc=org" to store groups and + "ou=People,dc=quenya,dc=org" to store users. Just configure your NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration file).

    @@ -3806,7 +3622,7 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz groups. This means that Samba makes use of the posixGroup objectclass. For now, there is no NT-like group system management (global and local groups). -

    Security and sambaSamAccount

    +

    Security and sambaSamAccount

    There are two important points to remember when discussing the security of sambaSamAccount entries in the directory.

    • Never retrieve the lmPassword or @@ -3817,13 +3633,13 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz on the details of LM/NT password hashes, refer to the Account Information Database section of this chapter.

      - To remedy the first security issue, the ldap ssl smb.conf parameter defaults - to require an encrypted session (ldap ssl = on) using + To remedy the first security issue, the ldap ssl smb.conf parameter defaults + to require an encrypted session (ldap ssl = on) using the default port of 636 when contacting the directory server. When using an OpenLDAP server, it is possible to use the use the StartTLS LDAP extended operation in the place of LDAPS. In either case, you are strongly discouraged to disable this security - (ldap ssl = off). + (ldap ssl = off).

      Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS extended operation. However, the OpenLDAP library still provides support for @@ -3834,86 +3650,85 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz following ACL in slapd.conf: 

      -## allow the "ldap admin dn" access, but deny everyone else
+## allow the "ldap admin dn" access, but deny everyone else
 access to attrs=lmPassword,ntPassword
-     by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write
+     by dn="cn=Samba Admin,ou=people,dc=quenya,dc=org" write
      by * none

      -

    LDAP special attributes for sambaSamAccounts

    +

    LDAP special attributes for sambaSamAccounts

    The sambaSamAccount objectclass is composed of the following attributes:

    -

    Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP)

    lmPasswordthe LANMAN password 16-byte hash stored as a character - representation of a hexadecimal string.
    ntPasswordthe NT password hash 16-byte stored as a character - representation of a hexadecimal string.
    pwdLastSetThe integer time in seconds since 1970 when the - lmPassword and ntPassword attributes were last set. -
    acctFlagsstring of 11 characters surrounded by square brackets [] +

    Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP)

    sambaLMPasswordthe LANMAN password 16-byte hash stored as a character +representation of a hexadecimal string.
    sambaNTPasswordthe NT password hash 16-byte stored as a character + representation of a hexadecimal string.
    sambaPwdLastSetThe integer time in seconds since 1970 when the + sambaLMPassword and sambaNTPassword attributes were last set. +
    sambaAcctFlagsstring of 11 characters surrounded by square brackets [] representing account flags such as U (user), W(workstation), X(no password expiration), I(Domain trust account), H(Home dir required), S(Server trust account), - and D(disabled).
    logonTimeInteger value currently unused
    logoffTimeInteger value currently unused
    kickoffTimeInteger value currently unused
    pwdCanChangeInteger value currently unused
    pwdMustChangeInteger value currently unused
    homeDrivespecifies the drive letter to which to map the - UNC path specified by homeDirectory. The drive letter must be specified in the form "X:" - where X is the letter of the drive to map. Refer to the "logon drive" parameter in the - smb.conf(5) man page for more information.
    scriptPathThe scriptPath property specifies the path of + and D(disabled).
    sambaLogonTimeInteger value currently unused
    sambaLogoffTimeInteger value currently unused
    sambaKickoffTimeInteger value currently unused
    sambaPwdCanChangeInteger value currently unused
    sambaPwdMustChangeInteger value currently unused
    sambaHomeDrivespecifies the drive letter to which to map the + UNC path specified by sambaHomePath. The drive letter must be specified in the form "X:" + where X is the letter of the drive to map. Refer to the "logon drive" parameter in the + smb.conf(5) man page for more information.
    sambaLogonScriptThe sambaLogonScript property specifies the path of the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path - is relative to the netlogon share. Refer to the "logon script" parameter in the - smb.conf(5) man page for more information.
    profilePathspecifies a path to the user's profile. + is relative to the netlogon share. Refer to the logon script parameter in the + smb.conf man page for more information.
    sambaProfilePathspecifies a path to the user's profile. This value can be a null string, a local absolute path, or a UNC path. Refer to the - "logon path" parameter in the smb.conf(5) man page for more information.
    smbHomeThe homeDirectory property specifies the path of - the home directory for the user. The string can be null. If homeDrive is set and specifies - a drive letter, homeDirectory should be a UNC path. The path must be a network - UNC path of the form \\server\share\directory. This value can be a null string. - Refer to the logon home parameter in the smb.conf man page for more information. -
    userWorkstationcharacter string value currently unused. -
    ridthe integer representation of the user's relative identifier - (RID).
    primaryGroupIDthe relative identifier (RID) of the primary group - of the user.
    domaindomain the user is part of.

    + logon path parameter in the smb.conf man page for more information.

    sambaHomePathThe sambaHomePath property specifies the path of +the home directory for the user. The string can be null. If sambaHomeDrive is set and specifies +a drive letter, sambaHomePath should be a UNC path. The path must be a network +UNC path of the form \\server\share\directory. This value can be a null string. +Refer to the logon home parameter in the smb.conf man page for more information. +
    sambaUserWorkstationscharacter string value currently unused. +
    sambaSIDThe security identifier(SID) of the user. The windows equivalent of unix uid's.
    sambaPrimaryGroupSIDthe relative identifier (RID) of the primary group + of the user.
    sambaDomainNamedomain the user is part of.

    The majority of these parameters are only used when Samba is acting as a PDC of a domain (refer to the Samba as a primary domain controller chapter for details on how to configure Samba as a Primary Domain Controller). The following four attributes are only stored with the sambaSamAccount entry if the values are non-default values: -

    smbHome
    scriptPath
    logonPath
    homeDrive

    +

    • sambaHomePath

    • sambaLogonScript

    • sambaProfilePath

    • sambaHomeDrive

    These attributes are only stored with the sambaSamAccount entry if the values are non-default values. For example, assume TASHTEGO has now been - configured as a PDC and that logon home = \\%L\%u was defined in - its smb.conf file. When a user named "becky" logons to the domain, - the logon home string is expanded to \\TASHTEGO\becky. - If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", + configured as a PDC and that logon home = \\%L\%u was defined in + its smb.conf file. When a user named "becky" logons to the domain, + the logon home string is expanded to \\TASHTEGO\becky. + If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", this value is used. However, if this attribute does not exist, then the value - of the logon home parameter is used in its place. Samba + of the logon home parameter is used in its place. Samba will only write the attribute value to the directory entry if the value is something other than the default (e.g. \\MOBY\becky). -

    Example LDIF Entries for a sambaSamAccount

    +

    Example LDIF Entries for a sambaSamAccount

    The following is a working LDIF with the inclusion of the posixAccount objectclass: 

    -	dn: uid=guest2, ou=people,dc=plainjoe,dc=org
-	ntPassword: 878D8014606CDA29677A44EFA1353FC7
-	pwdMustChange: 2147483647
-	primaryGroupID: 1201
-	lmPassword: 552902031BEDE9EFAAD3B435B51404EE
-	pwdLastSet: 1010179124
-	logonTime: 0
+	dn: uid=guest2, ou=people,dc=quenya,dc=org
+	sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7
+	sambaPwdMustChange: 2147483647
+	sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-513
+	sambaNTPassword: 552902031BEDE9EFAAD3B435B51404EE
+	sambaPwdLastSet: 1010179124
+	sambaLogonTime: 0
 	objectClass: sambaSamAccount
 	uid: guest2
-	kickoffTime: 2147483647
-	acctFlags: [UX         ]
-	logoffTime: 2147483647
-	rid: 19006
-	pwdCanChange: 0
+	sambaKickoffTime: 2147483647
+	sambaAcctFlags: [UX         ]
+	sambaLogoffTime: 2147483647
+	sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5006
+	sambaPwdCanChange: 0

    The following is an LDIF entry for using both the sambaSamAccount and posixAccount objectclasses: 

    -	dn: uid=gcarter, ou=people,dc=plainjoe,dc=org
-	logonTime: 0
+	dn: uid=gcarter, ou=people,dc=quenya,dc=org
+	sambaLogonTime: 0
 	displayName: Gerald Carter
-	lmPassword: 552902031BEDE9EFAAD3B435B51404EE
-	primaryGroupID: 1201
+	sambaLMPassword: 552902031BEDE9EFAAD3B435B51404EE
+	sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-1201
 	objectClass: posixAccount
 	objectClass: sambaSamAccount
-	acctFlags: [UX         ]
+	sambaAcctFlags: [UX         ]
 	userPassword: {crypt}BpM2ej8Rkzogo
 	uid: gcarter
 	uidNumber: 9000
@@ -3921,60 +3736,59 @@ access to attrs=lmPassword,ntPassword
 	loginShell: /bin/bash
 	logoffTime: 2147483647
 	gidNumber: 100
-	kickoffTime: 2147483647
-	pwdLastSet: 1010179230
-	rid: 19000
+	sambaKickoffTime: 2147483647
+	sambaPwdLastSet: 1010179230
+	sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5004
 	homeDirectory: /home/tashtego/gcarter
-	pwdCanChange: 0
-	pwdMustChange: 2147483647
-	ntPassword: 878D8014606CDA29677A44EFA1353FC7
+	sambaPwdCanChange: 0
+	sambaPwdMustChange: 2147483647
+	sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7

    -

    Password synchronisation

    +

    Password synchronisation

    Since version 3.0 samba can update the non-samba (LDAP) password stored with an account. When using pam_ldap, this allows changing both unix and windows passwords at once. -

    The ldap passwd sync options can have the following values:

    yes

    When the user changes his password, update +

    The ldap passwd sync options can have the following values:

    yes

    When the user changes his password, update ntPassword, lmPassword - and the password fields.

    no

    Only update ntPassword and lmPassword.

    only

    Only update the LDAP password and let the LDAP server worry - about the other fields. This option is only available when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD.

    More information can be found in the smb.conf manpage. -

    MySQL

    + and the password fields.

    no

    Only update ntPassword and lmPassword.

    only

    Only update the LDAP password and let the LDAP server worry about the other fields. This option is only available on some LDAP servers. [3]

    More information can be found in the smb.conf manpage. +

    MySQL

    Every so often someone will come along with a great new idea. Storing of user accounts in an SQL backend is one of them. Those who want to do this are in the best position to know what the specific benefits are to them. This may sound like a cop-out, but in truth we can not attempt to document every nitty little detail why certain things of marginal utility to the bulk of Samba users might make sense to the rest. In any case, the following instructions should help the determined SQL user to implement a working system. -

    Creating the database

    +

    Creating the database

    You either can set up your own table and specify the field names to pdb_mysql (see below for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump contains the correct queries to create the required tables. Use the command : - 

    $ mysql -uusername -hhostname -ppassword \
-databasename < /path/to/samba/examples/pdb/mysql/mysql.dump

    -

    Configuring

    This plugin lacks some good documentation, but here is some short info:

    Add a the following to the passdb backend variable in your smb.conf: - 

    -			passdb backend = [other-plugins] mysql:identifier [other-plugins]
-

    +

    +$ mysql -uusername -hhostname -ppassword \
+databasename < /path/to/samba/examples/pdb/mysql/mysql.dump
+

    +

    Configuring

    This plugin lacks some good documentation, but here is some short info:

    Add a the following to the passdb backend variable in your smb.conf: +

    passdb backend = [other-plugins] mysql:identifier [other-plugins]

    The identifier can be any string you like, as long as it doesn't collide with the identifiers of other plugins or other instances of pdb_mysql. If you - specify multiple pdb_mysql.so entries in passdb backend, you also need to + specify multiple pdb_mysql.so entries in passdb backend, you also need to use different identifiers!

    Additional options can be given through the smb.conf file in the [global] section.

    -

    Table 11.2. Basic smb.conf options for MySQL passdb backend

    FieldContents
    identifier:mysql hosthost name, defaults to 'localhost'
    identifier:mysql password 
    identifier:mysql userdefaults to 'samba'
    identifier:mysql databasedefaults to 'samba'
    identifier:mysql portdefaults to 3306
    identifier:tableName of the table containing users

    +

    Table 11.2. Basic smb.conf options for MySQL passdb backend

    FieldContents
    mysql hosthost name, defaults to 'localhost'
    mysql password 
    mysql userdefaults to 'samba'
    mysql databasedefaults to 'samba'
    mysql portdefaults to 3306
    tableName of the table containing users

    Warning

    Since the password for the MySQL user is stored in the - smb.conf file, you should make the the smb.conf file + smb.conf file, you should make the smb.conf file readable only to the user that runs Samba This is considered a security bug and will be fixed soon.

    Names of the columns in this table (I've added column types those columns should have first):

    -

    Table 11.3. MySQL field names for MySQL passdb backend

    FieldTypeContents
    identifier:logon time columnint(9) 
    identifier:logoff time columnint(9) 
    identifier:kickoff time columnint(9) 
    identifier:pass last set time columnint(9) 
    identifier:pass can change time columnint(9) 
    identifier:pass must change time columnint(9) 
    identifier:username columnvarchar(255)unix username
    identifier:domain columnvarchar(255)NT domain user is part of
    identifier:nt username columnvarchar(255)NT username
    identifier:fullname columnvarchar(255)Full name of user
    identifier:home dir columnvarchar(255)Unix homedir path
    identifier:dir drive columnvarchar(2)Directory drive path (eg: 'H:')
    identifier:logon script columnvarchar(255)Batch file to run on client side when logging on
    identifier:profile path columnvarchar(255)Path of profile
    identifier:acct desc columnvarchar(255)Some ASCII NT user data
    identifier:workstations columnvarchar(255)Workstations user can logon to (or NULL for all)
    identifier:unknown string columnvarchar(255)unknown string
    identifier:munged dial columnvarchar(255)?
    identifier:user sid columnvarchar(255)NT user SID
    identifier:group sid columnvarchar(255)NT group ID
    identifier:lanman pass columnvarchar(255)encrypted lanman password
    identifier:nt pass columnvarchar(255)encrypted nt passwd
    identifier:plain pass columnvarchar(255)plaintext password
    identifier:acct control columnint(9)nt user data
    identifier:unknown 3 columnint(9)unknown
    identifier:logon divs columnint(9)?
    identifier:hours len columnint(9)?
    identifier:unknown 5 columnint(9)unknown
    identifier:unknown 6 columnint(9)unknown

    +

    Table 11.3. MySQL field names for MySQL passdb backend

    FieldTypeContents
    logon time columnint(9) 
    logoff time columnint(9) 
    kickoff time columnint(9) 
    pass last set time columnint(9) 
    pass can change time columnint(9) 
    pass must change time columnint(9) 
    username columnvarchar(255)unix username
    domain columnvarchar(255)NT domain user is part of
    nt username columnvarchar(255)NT username
    fullname columnvarchar(255)Full name of user
    home dir columnvarchar(255)UNIX homedir path
    dir drive columnvarchar(2)Directory drive path (eg: 'H:')
    logon script columnvarchar(255)Batch file to run on client side when logging on
    profile path columnvarchar(255)Path of profile
    acct desc columnvarchar(255)Some ASCII NT user data
    workstations columnvarchar(255)Workstations user can logon to (or NULL for all)
    unknown string columnvarchar(255)unknown string
    munged dial columnvarchar(255)?
    user sid columnvarchar(255)NT user SID
    group sid columnvarchar(255)NT group ID
    lanman pass columnvarchar(255)encrypted lanman password
    nt pass columnvarchar(255)encrypted nt passwd
    plain pass columnvarchar(255)plaintext password
    acct control columnint(9)nt user data
    unknown 3 columnint(9)unknown
    logon divs columnint(9)?
    hours len columnint(9)?
    unknown 5 columnint(9)unknown
    unknown 6 columnint(9)unknown

    Eventually, you can put a colon (:) after the name of each column, which should specify the column to update when updating the table. You can also specify nothing behind the colon - then the data from the field will not be updated. -

    Using plaintext passwords or encrypted password

    +

    Using plaintext passwords or encrypted password

    I strongly discourage the use of plaintext passwords, however, you can use them:

    If you would like to use plaintext passwords, set @@ -3984,7 +3798,7 @@ access to attrs=lmPassword,ntPassword

    If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default. -

    Getting non-column data from the table

    +

    Getting non-column data from the table

    It is possible to have not all data in the database and making some 'constant'.

    For example, you can set 'identifier:fullname column' to : @@ -3999,80 +3813,73 @@ access to attrs=lmPassword,ntPassword

    To import data, use: $ pdbedit -i xml:filename -

    Common Errors

    Users can not logon - Users not in Samba SAM

    - People forget to put their users in their backend and then complain Samba won't authorize them. -

    Users are being added to the wrong backend database

    +

    Common Errors

    Users can not logon

    “I've installed samba, but now I can't log on with my unix account!”

    Make sure your user has been added to the current samba passdb backend. Read the section Account Management Tools for details.

    Users being added to wrong backend database

    A few complaints have been received from users that just moved to Samba-3. The following smb.conf file entries were causing problems, new accounts were being added to the old smbpasswd file, not to the tdbsam passdb.tdb file:

    - 

    -	[globals]
-		...
-		passdb backend = smbpasswd, tdbsam, guest
-		...
-

    +

    [global]
    ...
    passdb backend = smbpasswd, tdbsam
    ...

    Samba will add new accounts to the first entry in the passdb backend parameter entry. If you want to update to the tdbsam, then change the entry to:

    - 

    -	[globals]
-		...
-		passdb backend = tdbsam, smbpasswd, guest
-		...
-

    -

    auth methods does not work

    - If you explicitly set an 'auth methods' parameter, guest must be specified as the first - entry on the line. Eg: auth methods = guest sam. +

    [globals]
    ...
    passdb backend = tdbsam, smbpasswd
    ...

    +

    auth methods does not work

    + If you explicitly set an auth methods parameter, guest must be specified as the first + entry on the line. Eg: auth methods = guest sam.

    - This is the exact opposite of the requirement for the passdb backed + This is the exact opposite of the requirement for the passdb backend option, where it must be the LAST parameter on the line. -

    Chapter 12. Mapping MS Windows and Unix Groups

    Jean François Micouleau

    Gerald (Jerry) Carter

    Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails

    +


    [3] Only when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD

    Chapter 12. Mapping MS Windows and UNIX Groups

    Jean François Micouleau

    Gerald (Jerry) Carter

    Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users group

    Starting with Samba-3, new group mapping functionality is available to create associations - between Windows group SIDs and UNIX groups. The groupmap subcommand + between Windows group SIDs and UNIX groups. The groupmap subcommand included with the net tool can be used to manage these associations.

    Warning

    The first immediate reason to use the group mapping on a Samba PDC, is that + the domain admin group has been removed and should no longer be specified in smb.conf. This parameter was used to give the listed users membership in the Domain Admins Windows group which gave local admin rights on their workstations (in default configurations). -

    Features and Benefits

    +

    Features and Benefits

    Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to - arbitrarily associate them with Unix/Linux group accounts. -

    - Group accounts can be managed using the MS Windows NT4 or MS Windows 200x MMC tools - so long as appropriate interface scripts have been provided to smb.conf. -

    + arbitrarily associate them with UNIX/Linux group accounts. +

    + Group accounts can be managed using the MS Windows NT4 or MS Windows 200x / XP Professional MMC tools. + Appropriate interface scripts should be provided in smb.conf if it is desired that UNIX / Linux system + accounts should be automatically created when these tools are used. In the absence of these scripts, and + so long as winbind is running, Samba accounts group accounts that are created using these tools will be + allocated UNIX UIDs/GIDs from the parameters set by the idmap uid/idmap gid settings + in the smb.conf file. +

    Figure 12.1. IDMAP groups

    IDMAP groups

    Administrators should be aware that where smb.conf group interface scripts make - direct calls to the Unix/Linux system tools (eg: the shadow utilities, groupadd, - groupdel, groupmod) then the resulting Unix/Linux group names will be subject + direct calls to the UNIX/Linux system tools (eg: the shadow utilities, groupadd, + groupdel, groupmod) then the resulting UNIX/Linux group names will be subject to any limits imposed by these tools. If the tool does NOT allow upper case characters or space characters, then the creation of an MS Windows NT4 / 200x style group of - Engineering Managers will attempt to create an identically named - Unix/Linux group, an attempt that will of course fail! -

    + Engineering Managers will attempt to create an identically named + UNIX/Linux group, an attempt that will of course fail! +

    There are several possible work-arounds for the operating system tools limitation. One - method is to use a script that generates a name for the Unix/Linux system group that - fits the operating system limits, and that then just passes the Unix/Linux group id (GID) + method is to use a script that generates a name for the UNIX/Linux system group that + fits the operating system limits, and that then just passes the UNIX/Linux group id (GID) back to the calling Samba interface. This will provide a dynamic work-around solution.

    - Another work-around is to manually create a Unix/Linux group, then manually create the + Another work-around is to manually create a UNIX/Linux group, then manually create the MS Windows NT4 / 200x group on the Samba server and then use the net groupmap tool to connect the two to each other. -

    Discussion

    +

    Discussion

    When installing MS Windows NT4 / 200x on a computer, the installation program creates default users and groups, notably the Administrators group, and gives that group privileges necessary privileges to perform essential system tasks. eg: Ability to change the date and time or to kill (or close) any process running on the local machine. -

    +

    The 'Administrator' user is a member of the 'Administrators' group, and thus inherits 'Administrators' group privileges. If a 'joe' user is created to be a member of the 'Administrator' group, 'joe' has exactly the same rights as 'Administrator'.

    - When an MS Windows NT4 / W200x is made a domain member, the "Domain Admins" group of the + When an MS Windows NT4 / W200x is made a domain member, the "Domain Admins" group of the PDC is added to the local 'Administrators' group of the workstation. Every member of the 'Domain Administrators' group inherits the rights of the local 'Administrators' group when logging on the workstation. @@ -4087,58 +3894,58 @@ access to attrs=lmPassword,ntPassword domadm:x:502:joe,john,mary

  • - Map this domadm group to the "Domain Admins" group by running the command: + Map this domadm group to the "Domain Admins" group by running the command:

    - 

    -		root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm
-

    -

    - The quotes around "Domain Admins" are necessary due to the space in the group name. +

    +root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm
+

    +

    + The quotes around "Domain Admins" are necessary due to the space in the group name. Also make sure to leave no whitespace surrounding the equal character (=).

    • Now joe, john and mary are domain administrators! -

    +

    It is possible to map any arbitrary UNIX group to any Windows NT4 / 200x group as well as making any UNIX group a Windows domain group. For example, if you wanted to include a UNIX group (e.g. acct) in a ACL on a local file or printer on a domain member machine, you would flag that group as a domain group by running the following on the Samba PDC:

    - 

    -	root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct
-

    +

    +root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct
+

    Be aware that the RID parameter is a unsigned 32 bit integer that should normally start at 1000. However, this rid must not overlap with any RID assigned - to a user. Verifying this is done differently depending on on the passdb backend + to a user. Verifying this is done differently depending on the passdb backend you are using. Future versions of the tools may perform the verification automatically, but for now the burden is on you. -

    Example Configuration

    +

    Example Configuration

    You can list the various groups in the mapping database by executing net groupmap list. Here is an example:

    - 

    -		root#  net groupmap list
-		System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin
-		Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
-		Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
-		Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest
-

    +

    +root#  net groupmap list
+System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin
+Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
+Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
+Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest
+

    For complete details on net groupmap, refer to the net(8) man page. -

    Configuration Scripts

    +

    Configuration Scripts

    Everyone needs tools. Some of us like to create our own, others prefer to use canned tools (ie: prepared by someone else for general use). -

    Sample smb.conf add group script

    - A script to great complying group names for use by the Samba group interfaces: +

    Sample smb.conf add group script

    + A script to create complying group names for use by the Samba group interfaces:

    -

    Example 12.1. smbgrpadd.sh

    +
    Example 12.1. smbgrpadd.sh
     
 #!/bin/bash
 
 # Add the group using normal system groupadd tool.
 groupadd smbtmpgrp00
 
-thegid=`cat /etc/group | grep smbtmpgrp00 | cut -d ":" -f3`
+thegid=`cat /etc/group | grep smbtmpgrp00 | cut -d ":" -f3`
 
 # Now change the name to what we want for the MS Windows networking end
 cp /etc/group /etc/group.bak
@@ -4150,81 +3957,91 @@ exit 0
 
    
 
    
 		The smb.conf entry for the above script would look like:
-		
    -		add group script = /path_to_tool/smbgrpadd.sh %g
-		
    
-

    Script to configure Group Mapping

    - In our example we have created a Unix/Linux group called ntadmin. - Our script will create the additional groups Engineers, Marketoids, Gnomes: +

    add group script = /path_to_tool/smbgrpadd.sh %g

    +

    Script to configure Group Mapping

    + In our example we have created a UNIX/Linux group called ntadmin. + Our script will create the additional groups Orks, Elves, Gnomes: 

     #!/bin/bash
 
-net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin
-net groupmap modify ntgroup="Domain Users" unixgroup=users
-net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
-net groupmap modify ntgroup="Administrators" unixgroup=root
-net groupmap modify ntgroup="Users" unixgroup=users
-net groupmap modify ntgroup="Guests" unixgroup=nobody
-net groupmap modify ntgroup="System Operators" unixgroup=sys
-net groupmap modify ntgroup="Account Operators" unixgroup=root
-net groupmap modify ntgroup="Backup Operators" unixgroup=bin
-net groupmap modify ntgroup="Print Operators" unixgroup=lp
-net groupmap modify ntgroup="Replicators" unixgroup=daemon
-net groupmap modify ntgroup="Power Users" unixgroup=sys
+net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin
+net groupmap modify ntgroup="Domain Users" unixgroup=users
+net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
+net groupmap modify ntgroup="Administrators" unixgroup=root
+net groupmap modify ntgroup="Users" unixgroup=users
+net groupmap modify ntgroup="Guests" unixgroup=nobody
+net groupmap modify ntgroup="System Operators" unixgroup=sys
+net groupmap modify ntgroup="Account Operators" unixgroup=root
+net groupmap modify ntgroup="Backup Operators" unixgroup=bin
+net groupmap modify ntgroup="Print Operators" unixgroup=lp
+net groupmap modify ntgroup="Replicators" unixgroup=daemon
+net groupmap modify ntgroup="Power Users" unixgroup=sys
 
-#groupadd Engineers
-#groupadd Marketoids
-#groupadd Gnomes
+groupadd Orks
+groupadd Elves
+groupadd Gnomes
 
-#net groupmap add ntgroup="Engineers"  unixgroup=Engineers    type=d
-#net groupmap add ntgroup="Marketoids" unixgroup=Marketoids   type=d
-#net groupmap add ntgroup="Gnomes"     unixgroup=Gnomes       type=d
+net groupmap add ntgroup="Orks"       unixgroup=Orks         type=d
+net groupmap add ntgroup="Elves"      unixgroup=Elves        type=d
+net groupmap add ntgroup="Gnomes"     unixgroup=Gnomes       type=d

    Of course it is expected that the administrator will modify this to suit local needs. For information regarding the use of the net groupmap tool please refer to the man page. -

    Common Errors

    +

    Common Errors

    At this time there are many little surprises for the unwary administrator. In a real sense it is imperative that every step of automated control scripts must be carefully tested manually before putting them into active service. -

    Adding Groups Fails

    +

    Adding Groups Fails

    This is a common problem when the groupadd is called directly - by the Samba interface script for the add group script in + by the Samba interface script for the add group script in the smb.conf file.

    The most common cause of failure is an attempt to add an MS Windows group account that has either an upper case character and/or a space character in it.

    There are three possible work-arounds. Firstly, use only group names that comply - with the limitations of the Unix/Linux groupadd system tool. + with the limitations of the UNIX/Linux groupadd system tool. The second involves use of the script mentioned earlier in this chapter, and the - third option is to manually create a Unix/Linux group account that can substitute + third option is to manually create a UNIX/Linux group account that can substitute for the MS Windows group name, then use the procedure listed above to map that group to the MS Windows group. -

    Adding MS Windows Groups to MS Windows Groups Fails

    +

    Adding MS Windows Groups to MS Windows Groups Fails

    Samba-3 does NOT support nested groups from the MS Windows control environment. -

    Chapter 13. File, Directory and Share Access Controls

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    May 10, 2003

    Table of Contents

    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with Unix File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and Unix Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute - mapping
    Common Errors
    Users can not write to a public share
    I have set force user and Samba still makes root the owner of all the files - I touch!

    +

    Adding Domain Users to the Power Users group

    “ + What must I do to add Domain Users to the Power Users group? + ”

    + The Power Users group is a group that is local to each Windows + 200x / XP Professional workstation. You can not add the Domain Users group to the Power Users + group automatically, this must be done on each workstation by logging in as the local workstation + administrator and then using click on Start / Control Panel / Users and Passwords + now click on the 'Advanced' tab, then on the 'Advanced' Button. +

    + Now click on 'Groups', then double click on 'Power Users'. This will launch the panel to add users + or groups to the local machine 'Power Uses' group. Click on the 'Add' button, select the domain + from which the 'Domain Users' group is to be added, double click on the 'Domain Users' group, then + click on the 'Ok' button. Note: If a logon box is presented during this process please remember to + enter the connect as DOMAIN\UserName. ie: For the domain MIDEARTH and the user 'root' enter + MIDEARTH\root. +

    Chapter 13. File, Directory and Share Access Controls

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    drawing
    The Samba Team

    May 10, 2003

    Table of Contents

    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask + parameters
    Interaction with the standard Samba file attribute mapping
    Common Errors
    Users can not write to a public share
    I have set force user but Samba still makes root the owner of all the files I touch!
    MS Word with Samba changes owner of file

    Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of resources shared via Samba do not behave in the manner they might expect. MS Windows network -administrators are often confused regarding network access controls and what is the best way to -provide users with the type of access they need while protecting resources from the consequences -of untoward access capabilities. +administrators are often confused regarding network access controls and how to +provide users with the access they need while protecting resources from unauthorised access.

    -Unix administrators frequently are not familiar with the MS Windows environment and in particular +Many UNIX administrators are unfamiliar with the MS Windows environment and in particular have difficulty in visualizing what the MS Windows user wishes to achieve in attempts to set file and directory access permissions.

    The problem lies in the differences in how file and directory permissions and controls work between the two environments. This difference is one that Samba can not completely hide, even -though it does try to make the chasm transparent. -

    +though it does try to bridge the chasm to a degree. +

    POSIX Access Control List technology has been available (along with Extended Attributes) -for Unix for many years, yet there is little evidence today of any significant use. This +for UNIX for many years, yet there is little evidence today of any significant use. This explains to some extent the slow adoption of ACLs into commercial Linux products. MS Windows administrators are astounded at this given that ACLs were a foundational capability of the now decade old MS Windows NT operating system. @@ -4233,25 +4050,24 @@ The purpose of this chapter is to present each of the points of control that are Samba-3 in the hope that this will help the network administrator to find the optimum method for delivering the best environment for MS Windows desktop users.

    -This is an opportune point to mention that it should be borne in mind that Samba was created to -provide a means of interoperability and interchange of data between two operating environments -that are quite different. It was never the intent to make Unix/Linux like MS Windows NT. Instead -the purpose was an is to provide a sufficient level of exchange of data between the two environments. -What is available today extends well beyond early plans and expectations, yet the gap continues to -shrink. -

    Features and Benefits

    +This is an opportune point to mention that Samba was created to provide a means of interoperability +and interchange of data between differing operating environments. Samba has no intent change +UNIX/Linux into a platform like MS Windows. Instead the purpose was and is to provide a sufficient +level of exchange of data between the two environments. What is available today extends well +beyond early plans and expectations, yet the gap continues to shrink. +

    Features and Benefits

    Samba offers a lot of flexibility in file system access management. These are the key access control facilities present in Samba today:

    Samba Access Control Facilities

    • - Unix File and Directory Permissions + UNIX File and Directory Permissions

      - Samba honours and implements Unix file system access controls. Users + Samba honours and implements UNIX file system access controls. Users who access a Samba server will do so as a particular MS Windows user. This information is passed to the Samba server as part of the logon or connection setup process. Samba uses this user identity to validate whether or not the user should be given access to file system resources (files and directories). This chapter provides an overview for those - to whom the Unix permissions and controls are a little strange or unknown. + to whom the UNIX permissions and controls are a little strange or unknown.

    • Samba Share Definitions

      @@ -4270,22 +4086,22 @@ shrink. easiest ways to affect access controls (restrictions) and can often do so with minimum invasiveness compared with other methods.

    • - MS Windows ACLs through Unix POSIX ACLs + MS Windows ACLs through UNIX POSIX ACLs

      - The use of POSIX ACLs on Unix/Linux is possible ONLY if the underlying + The use of POSIX ACLs on UNIX/Linux is possible ONLY if the underlying operating system supports them. If not, then this option will not be - available to you. Current Unix technology platforms have native support + available to you. Current UNIX technology platforms have native support for POSIX ACLs. There are patches for the Linux kernel that provide this also. Sadly, few Linux platforms ship today with native ACLs and Extended Attributes enabled. This chapter has pertinent information for users of platforms that support them. -

    File System Access Controls

    +

    File System Access Controls

    Perhaps the most important recognition to be made is the simple fact that MS Windows NT4 / 200x / XP -implement a totally divergent file system technology from what is provided in the Unix operating system +implement a totally divergent file system technology from what is provided in the UNIX operating system environment. Firstly we should consider what the most significant differences are, then we shall look at how Samba helps to bridge the differences. -

    MS Windows NTFS Comparison with Unix File Systems

    - Samba operates on top of the Unix file system. This means it is subject to Unix file system conventions +

    MS Windows NTFS Comparison with UNIX File Systems

    + Samba operates on top of the UNIX file system. This means it is subject to UNIX file system conventions and permissions. It also means that if the MS Windows networking environment requires file system behaviour that differs from unix file system behaviour then somehow Samba is responsible for emulating that in a transparent and consistent manner. @@ -4295,128 +4111,108 @@ at how Samba helps to bridge the differences. but for the greater part we will stay within the bounds of default behaviour. Those wishing to explore to depths of control ability should review the smb.conf man page.

    File System Feature Comparison

    Name Space

    - MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, Unix file names + MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, UNIX file names may be 1023 characters long. In MS Windows file extensions indicate particular file types, - in Unix this is not so rigorously observed as all names are considered arbitrary. + in UNIX this is not so rigorously observed as all names are considered arbitrary.

    - What MS Windows calls a Folder, Unix calls a directory, + What MS Windows calls a Folder, UNIX calls a directory.

    Case Sensitivity

    - MS Windows file names are generally Upper Case if made up of 8.3 (ie: 8 character file name + + MS Windows file names are generally upper case if made up of 8.3 (ie: 8 character file name and 3 character extension. If longer than 8.3 file names are Case Preserving, and Case Insensitive.

    - Unix file and directory names are Case Sensitive and Case Preserving. Samba implements the - MS Windows file name behaviour, but it does so as a user application. The Unix file system + UNIX file and directory names are case sensitive and case preserving. Samba implements the + MS Windows file name behaviour, but it does so as a user application. The UNIX file system provides no mechanism to perform case insensitive file name lookups. MS Windows does this by default. This means that Samba has to carry the processing overhead to provide features - that are NOT native to the Unix operating system environment. + that are NOT native to the UNIX operating system environment.

    - Consider the following, all are unique Unix names but one single MS Windows file name: + Consider the following, all are unique UNIX names but one single MS Windows file name: MYFILE.TXT MyFile.txt myfile.txt - So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in Unix + So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in UNIX they can. So what should Samba do if all three are present? Answer, the one that is lexically first will be accessible to MS Windows users, the others are invisible and unaccessible - any other solution would be suicidal.

    Directory Separators

    - MS Windows and DOS uses the back-slash '\' as a directory delimiter, Unix uses the forward-slash '/' + MS Windows and DOS uses the back-slash '\' as a directory delimiter, UNIX uses the forward-slash '/' as it's directory delimiter. This is transparently handled by Samba.

    Drive Identification

    MS Windows products support a notion of drive letters, like C: to represent - disk partitions. Unix has NO concept if separate identifiers for file partitions since each + disk partitions. UNIX has NO concept if separate identifiers for file partitions since each such file system is mounted to become part of the over-all directory tree. - The Unix directory tree begins at '/', just like the root of a DOS drive is specified like + The UNIX directory tree begins at '/', just like the root of a DOS drive is specified like C:\.

    File Naming Conventions

    - MS Windows generally never experiences file names that begin with a '.', while in Unix these + MS Windows generally never experiences file names that begin with a '.', while in UNIX these are commonly found in a user's home directory. Files that begin with a '.' are typically - either start up files for various Unix applications, or they may be files that contain + either start up files for various UNIX applications, or they may be files that contain start-up configuration data.

    Links and Short-Cuts

    - MS Windows make use of "links and Short-Cuts" that are actually special types of files that will - redirect an attempt to execute the file to the real location of the file. Unix knows of file and directory + + + + + MS Windows make use of "links and Short-Cuts" that are actually special types of files that will + redirect an attempt to execute the file to the real location of the file. UNIX knows of file and directory links, but they are entirely different from what MS Windows users are used to.

    - Symbolic links are files in Unix that contain the actual location of the data (file OR directory). An + Symbolic links are files in UNIX that contain the actual location of the data (file OR directory). An operation (like read or write) will operate directly on the file referenced. Symbolic links are also referred to as 'soft links'. A hard link is something that MS Windows is NOT familiar with. It allows one physical file to be known simultaneously by more than one file name.

    There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort - in the process of becoming familiar with Unix/Linux. These are best left for a text that is dedicated to the - purpose of Unix/Linux training/education. -

    Managing Directories

    + in the process of becoming familiar with UNIX/Linux. These are best left for a text that is dedicated to the + purpose of UNIX/Linux training/education. +

    Managing Directories

    There are three basic operations for managing directories, create, delete, rename. -

    Table 13.1. Managing directories with unix and windows

    ActionMS Windows CommandUnix Command
    createmd foldermkdir folder
    deleterd folderrmdir folder
    renamerename oldname newnamemv oldname newname

    -

    File and Directory Access Control

    +

    Table 13.1. Managing directories with unix and windows

    ActionMS Windows CommandUNIX Command
    createmd foldermkdir folder
    deleterd folderrmdir folder
    renamerename oldname newnamemv oldname newname

    +

    File and Directory Access Control

    The network administrator is strongly advised to read foundational training manuals and reference materials - regarding file and directory permissions maintenance. Much can be achieved with the basic Unix permissions + regarding file and directory permissions maintenance. Much can be achieved with the basic UNIX permissions without having to resort to more complex facilities like POSIX Access Control Lists (ACLs) or Extended Attributes (EAs).

    - Unix/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. - A Unix file listing looks as follows:- + UNIX/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. + A UNIX file listing looks as follows:- - 

    -	jht@frodo:~/stuff> ls -la
-	total 632
-	drwxr-xr-x   13 jht   users      816 2003-05-12 22:56 .
-	drwxr-xr-x   37 jht   users     3800 2003-05-12 22:29 ..
-	d---------    2 jht   users       48 2003-05-12 22:29 muchado00
-	d--x--x--x    2 jht   users       48 2003-05-12 22:29 muchado01
-	dr-xr-xr-x    2 jht   users       48 2003-05-12 22:29 muchado02
-	drwxrwxrwx    2 jht   users       48 2003-05-12 22:29 muchado03
-	drw-rw-rw-    2 jht   users       48 2003-05-12 22:29 muchado04
-	d-w--w--w-    2 jht   users       48 2003-05-12 22:29 muchado05
-	dr--r--r--    2 jht   users       48 2003-05-12 22:29 muchado06
-	drwxrwxrwt    2 jht   users       48 2003-05-12 22:29 muchado07
-	drwsrwsrwx    2 jht   users       48 2003-05-12 22:29 muchado08
-	----------    1 jht   users     1242 2003-05-12 22:31 mydata00.lst
-	---x--x--x    1 jht   users     1674 2003-05-12 22:33 mydata01.lst
-	--w--w--w-    1 jht   users     7754 2003-05-12 22:33 mydata02.lst
-	--wx-wx-wx    1 jht   users   260179 2003-05-12 22:33 mydata03.lst
-	-r--r--r--    1 jht   users    21017 2003-05-12 22:32 mydata04.lst
-	-r-xr-xr-x    1 jht   users   206339 2003-05-12 22:32 mydata05.lst
-	-rw-rw-rw-    1 jht   users    41105 2003-05-12 22:32 mydata06.lst
-	-rwxrwxrwx    1 jht   users    19312 2003-05-12 22:32 mydata07.lst
-	jht@frodo:~/stuff>
-

    -

    - The columns above represent (from left to right): permissions, no blocks used, owner, group, size (bytes), access date, access time, file name. +

    +$ ls -la
+total 632
+drwxr-xr-x   13 maryo   gnomes      816 2003-05-12 22:56 .
+drwxrwxr-x   37 maryo   gnomes     3800 2003-05-12 22:29 ..
+dr-xr-xr-x    2 maryo   gnomes       48 2003-05-12 22:29 muchado02
+drwxrwxrwx    2 maryo   gnomes       48 2003-05-12 22:29 muchado03
+drw-rw-rw-    2 maryo   gnomes       48 2003-05-12 22:29 muchado04
+d-w--w--w-    2 maryo   gnomes       48 2003-05-12 22:29 muchado05
+dr--r--r--    2 maryo   gnomes       48 2003-05-12 22:29 muchado06
+drwsrwsrwx    2 maryo   gnomes       48 2003-05-12 22:29 muchado08
+----------    1 maryo   gnomes     1242 2003-05-12 22:31 mydata00.lst
+--w--w--w-    1 maryo   gnomes     7754 2003-05-12 22:33 mydata02.lst
+-r--r--r--    1 maryo   gnomes    21017 2003-05-12 22:32 mydata04.lst
+-rw-rw-rw-    1 maryo   gnomes    41105 2003-05-12 22:32 mydata06.lst
+$ 
+

    - The permissions field is made up of: - - 

    -	 JRV: Put this into a diagram of some sort
-	[ type  ] [ users ] [ group ] [ others ]   [File, Directory Permissions]
-	[ d | l ] [ r w x ] [ r w x ] [ r w x  ]
-	  |   |     | | |     | | |     | | |
-	  |   |     | | |     | | |     | | |-----> Can Execute, List files
-	  |   |     | | |     | | |     | |-------> Can Write,   Create files
-	  |   |     | | |     | | |     |---------> Can Read,    Read files
-	  |   |     | | |     | | |---------------> Can Execute, List files
-	  |   |     | | |     | |-----------------> Can Write,   Create files
-	  |   |     | | |     |-------------------> Can Read,    Read files
-	  |   |     | | |-------------------------> Can Execute, List files
-	  |   |     | |---------------------------> Can Write,   Create files
-	  |   |     |-----------------------------> Can Read,    Read files
-	  |   |-----------------------------------> Is a symbolic Link
-	  |---------------------------------------> Is a directory
-

    + The columns above represent (from left to right): permissions, number of hard links to file, owner, group, size (bytes), access date, access time, file name.

    + An overview of the permissions field can be found in the image below. +

    Figure 13.1. Overview of unix permissions field

    Overview of unix permissions field

    Any bit flag may be unset. An unset bit flag is the equivalent of 'Can NOT' and is represented as a '-' character. -

    Example 13.1. Example File

    +	
    Example 13.1. Example File
     		-rwxr-x---   Means: The owner (user) can read, write, execute
 		                    the group can read and execute
 		                    everyone else can NOT do anything with it
 		
    
 
 	
    
-	Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = Unix Domain Socket.
+	Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = UNIX Domain Socket.
 	
    
 	The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x),
 	execute  only  if  the  file  is a directory or already has execute permission for some user (X), set user or group ID on execution (s),
@@ -4435,101 +4231,101 @@ at how Samba helps to bridge the differences.
 	the (x) execute flags are not set files can not be listed (seen) in the directory by anyone. The group can read files in the
 	directory but can NOT create new files. NOTE: If files in the directory are set to be readable and writable for the group, then
 	group members will be able to write to (or delete) them.
-

    Share Definition Access Controls

    +

    Share Definition Access Controls

    The following parameters in the smb.conf file sections that define a share control or affect access controls. Before using any of the following options please refer to the man page for smb.conf. -

    User and Group Based Controls

    +

    User and Group Based Controls

    User and group based controls can prove very useful. In some situations it is distinctly desirable to affect all - file system operations as if a single user is doing this, the use of the force user and - force group behaviour will achieve this. In other situations it may be necessary to affect a + file system operations as if a single user is doing this, the use of the force user and + force group behaviour will achieve this. In other situations it may be necessary to affect a paranoia level of control to ensure that only particular authorised persons will be able to access a share or - it's contents, here the use of the valid users or the invalid users may + it's contents, here the use of the valid users or the invalid users may be most useful.

    As always, it is highly advisable to use the least difficult to maintain and the least ambiguous method for controlling access. Remember, that when you leave the scene someone else will need to provide assistance and if that person finds too great a mess, or if they do not understand what you have done then there is risk of Samba being removed and an alternative solution being adopted. -

    Table 13.2. User and Group Based Controls

    Control ParameterDescription - Action - Notes
    admin users

    +

    Table 13.2. User and Group Based Controls

    Control ParameterDescription - Action - Notes
    admin users

    List of users who will be granted administrative privileges on the share. They will do all file operations as the super-user (root). Any user in this list will be able to do anything they like on the share, irrespective of file permissions. -

    force group

    +

    force group

    Specifies a UNIX group name that will be assigned as the default primary group for all users connecting to this service. -

    force user

    +

    force user

    Specifies a UNIX user name that will be assigned as the default user for all users connecting to this service. This is useful for sharing files. Incorrect use can cause security problems. -

    guest ok

    +

    guest ok

    If this parameter is set for a service, then no password is required to connect to the service. Privileges will be those of the guest account. -

    invalid users

    +

    invalid users

    List of users that should not be allowed to login to this service. -

    only user

    +

    only user

    Controls whether connections with usernames not in the user list will be allowed. -

    read list

    +

    read list

    List of users that are given read-only access to a service. Users in this list will not be given write access, no matter what the read only option is set to. -

    username

    +

    username

    Refer to the smb.conf man page for more information - this is a complex and potentially misused parameter. -

    valid users

    +

    valid users

    List of users that should be allowed to login to this service. -

    write list

    +

    write list

    List of users that are given read-write access to a service. -

    File and Directory Permissions Based Controls

    +

    File and Directory Permissions Based Controls

    The following file and directory permission based controls, if misused, can result in considerable difficulty to diagnose the cause of mis-configuration. Use them sparingly and carefully. By gradually introducing each one by one undesirable side-effects may be detected. In the event of a problem, always comment all of them out and then gradually re-introduce them in a controlled fashion. -

    Table 13.3. File and Directory Permission Based Controls

    Control ParameterDescription - Action - Notes
    create mask

    +

    Table 13.3. File and Directory Permission Based Controls

    Control ParameterDescription - Action - Notes
    create mask

    Refer to the smb.conf man page. -

    directory mask

    +

    directory mask

    The octal modes used when converting DOS modes to UNIX modes when creating UNIX directories. See also: directory security mask. -

    dos filemode

    +

    dos filemode

    Enabling this parameter allows a user who has write access to the file to modify the permissions on it. -

    force create mode

    +

    force create mode

    This parameter specifies a set of UNIX mode bit permissions that will always be set on a file created by Samba. -

    force directory mode

    +

    force directory mode

    This parameter specifies a set of UNIX mode bit permissions that will always be set on a directory created by Samba. -

    force directory security mode

    +

    force directory security mode

    Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory -

    force security mode

    +

    force security mode

    Controls UNIX permission bits modified when a Windows NT client manipulates UNIX permissions. -

    hide unreadable

    +

    hide unreadable

    Prevents clients from seeing the existence of files that cannot be read. -

    hide unwriteable files

    +

    hide unwriteable files

    Prevents clients from seeing the existence of files that cannot be written to. Unwriteable directories are shown as usual. -

    nt acl support

    +

    nt acl support

    This parameter controls whether smbd will attempt to map UNIX permissions into Windows NT access control lists. -

    security mask

    +

    security mask

    Controls UNIX permission bits modified when a Windows NT client is manipulating the UNIX permissions on a file. -

    Miscellaneous Controls

    - The following are documented because of the prevalence of administrators creating inadvertant barriers to file +

    Miscellaneous Controls

    + The following are documented because of the prevalence of administrators creating inadvertent barriers to file access by not understanding the full implications of smb.conf file settings. -

    Table 13.4. Other Controls

    Control ParameterDescription - Action - Notes
    case sensitive, default case, short preserve case

    +

    Table 13.4. Other Controls

    Control ParameterDescription - Action - Notes
    case sensitive, default case, short preserve case

    This means that all file name lookup will be done in a case sensitive manner. Files will be created with the precise filename Samba received from the MS Windows client. -

    csc policy

    +

    csc policy

    Client Side Caching Policy - parallels MS Windows client side file caching capabilities. -

    dont descend

    +

    dont descend

    Allows to specify a comma-delimited list of directories that the server should always show as empty. -

    dos filetime resolution

    +

    dos filetime resolution

    This option is mainly used as a compatibility option for Visual C++ when used against Samba shares. -

    dos filetimes

    +

    dos filetimes

    DOS and Windows allows users to change file time stamps if they can write to the file. POSIX semantics prevent this. This options allows DOS and Windows behaviour. -

    fake oplocks

    +

    fake oplocks

    Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an oplock then the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. -

    hide dot files, hide files, veto files

    +

    hide dot files, hide files, veto files

    Note: MS Windows Explorer allows over-ride of files marked as hidden so they will still be visible. -

    read only

    +

    read only

    If this parameter is yes, then users of a service may not create or modify files in the service's directory. -

    veto files

    +

    veto files

    List of files and directories that are neither visible nor accessible. -

    Access Controls on Shares

    +

    Access Controls on Shares

    This section deals with how to configure Samba per share access control restrictions. By default, Samba sets no restrictions on the share itself. Restrictions on the share itself can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can @@ -4546,9 +4342,9 @@ Before using any of the following options please refer to the man page for /usr/local/samba/var. If the tdbdump utility has been compiled and installed on your system, then you can examine the contents of this file by: tdbdump share_info.tdb. -

    Share Permissions Management

    +

    Share Permissions Management

    The best tool for the task is platform dependant. Choose the best tool for your environment. -

    Windows NT4 Workstation/Server

    +

    Windows NT4 Workstation/Server

    The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below. @@ -4558,9 +4354,9 @@ Before using any of the following options please refer to the man page for

  • Now click on the share that you wish to manage, then click on the Properties tab, next click on the Permissions tab. Now you can add or change access control settings as you wish. -

    • Windows 200x/XP

    +

    Windows 200x/XP

    On MS Windows NT4/200x/XP system access control lists on the share itself are set using native - tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder, + tools, usually from file manager. For example, in Windows 200x: right click on the shared folder, then select Sharing, then click on Permissions. The default Windows NT4/200x permission allows Everyone Full Control on the Share.

    @@ -4587,72 +4383,71 @@ Before using any of the following options please refer to the man page for no access means that MaryK who is part of the group Everyone will have no access even if this user is given explicit full control access. -

    MS Windows Access Control Lists and Unix Interoperability

    Managing UNIX permissions Using NT Security Dialogs

    Windows NT clients can use their native security settings - dialog box to view and modify the underlying UNIX permissions.

    Note that this ability is careful not to compromise - the security of the UNIX host Samba is running on, and - still obeys all the file permission rules that a Samba - administrator can set.

    Note

    - All access to Unix/Linux system file via Samba is controlled at - the operating system file access control level. When trying to - figure out file access problems it is vitally important to identify - the identity of the Windows user as it is presented by Samba at - the point of file access. This can best be determined from the +

    MS Windows Access Control Lists and UNIX Interoperability

    Managing UNIX permissions Using NT Security Dialogs

    + Windows NT clients can use their native security settings dialog box to view and modify the + underlying UNIX permissions. +

    + Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and + still obeys all the file permission rules that a Samba administrator can set. +

    + Samba does not attempt to go beyond POSIX ACLs, so that the various finer-grained access control + options provided in Windows are actually ignore. +

    Note

    + All access to UNIX/Linux system files via Samba is controlled by the operating system file access controls. + When trying to figure out file access problems it is vitally important to find the identity of the Windows + user as it is presented by Samba at the point of file access. This can best be determined from the Samba log files. -

    Viewing File Security on a Samba Share

    From an NT4/2000/XP client, single-click with the right - mouse button on any file or directory in a Samba mounted - drive letter or UNC path. When the menu pops-up, click - on the Properties entry at the bottom of - the menu. This brings up the file properties dialog - box. Click on the tab Security and you - will see three buttons, Permissions, - Auditing, and Ownership. - The Auditing button will cause either - an error message A requested privilege is not held - by the client to appear if the user is not the - NT Administrator, or a dialog which is intended to allow an - Administrator to add auditing requirements to a file if the - user is logged on as the NT Administrator. This dialog is - non-functional with a Samba share at this time, as the only - useful button, the Add button will not currently - allow a list of users to be seen.

    Viewing file ownership

    Clicking on the Ownership button - brings up a dialog box telling you who owns the given file. The - owner name will be of the form :

    "SERVER\user (Long name)"

    Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database). Click on the - Close button to remove this dialog.

    If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone".

    The Take Ownership button will not allow - you to change the ownership of this file to yourself (clicking on - it will display a dialog box complaining that the user you are - currently logged onto the NT client cannot be found). The reason - for this is that changing the ownership of a file is a privileged - operation in UNIX, available only to the root - user. As clicking on this button causes NT to attempt to change - the ownership of a file to the current user logged into the NT - client this will not work with Samba at this time.

    There is an NT chown command that will work with Samba - and allow a user with Administrator privilege connected - to a Samba server as root to change the ownership of - files on both a local NTFS filesystem or remote mounted NTFS - or Samba drive. This is available as part of the Seclib - NT security library written by Jeremy Allison of - the Samba Team, available from the main Samba ftp site.

    Viewing File or Directory Permissions

    The third button is the Permissions - button. Clicking on this brings up a dialog box that shows both - the permissions and the UNIX owner of the file or directory. - The owner is displayed in the form :

    "SERVER\ +

    Viewing File Security on a Samba Share

    + From an NT4/2000/XP client, single-click with the right mouse button on any file or directory in a Samba + mounted drive letter or UNC path. When the menu pops-up, click on the Properties + entry at the bottom of the menu. This brings up the file properties dialog box. Click on the tab + Security and you will see three buttons, Permissions, + Auditing, and Ownership. The Auditing + button will cause either an error message A requested privilege is not held by the client + to appear if the user is not the NT Administrator, or a dialog which is intended to allow an Administrator + to add auditing requirements to a file if the user is logged on as the NT Administrator. This dialog is + non-functional with a Samba share at this time, as the only useful button, the Add + button will not currently allow a list of users to be seen. +

    Viewing file ownership

    + Clicking on the Ownership button brings up a dialog box telling you who owns + the given file. The owner name will be of the form: +

    + "SERVER\user (Long name)" +

    + Where SERVER is the NetBIOS name of the Samba server, user + is the user name of the UNIX user who owns the file, and (Long name) is the + descriptive string identifying the user (normally found in the GECOS field of the UNIX password database). + Click on the Close button to remove this dialog. +

    + If the parameter nt acl support is set to false + then the file owner will be shown as the NT user "Everyone". +

    + The Take Ownership button will not allow you to change the ownership of this file to + yourself (clicking on it will display a dialog box complaining that the user you are currently logged onto + the NT client cannot be found). The reason for this is that changing the ownership of a file is a privileged + operation in UNIX, available only to the root user. As clicking on this button causes + NT to attempt to change the ownership of a file to the current user logged into the NT client this will + not work with Samba at this time.

    + There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected + to a Samba server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS + or Samba drive. This is available as part of the Seclib NT security library written + by Jeremy Allison of the Samba-Team, available from the main Samba FTP site.

    Viewing File or Directory Permissions

    + The third button is the Permissions button. Clicking on this brings up a dialog box + that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed in the form: +

    "SERVER\ user - (Long name)"

    Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database).

    If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone" and the - permissions will be shown as NT "Full Control".

    The permissions field is displayed differently for files - and directories, so I'll describe the way file permissions - are displayed first.

    File Permissions

    The standard UNIX user/group/world triplet and - the corresponding "read", "write", "execute" permissions + (Long name)"

    Where SERVER is the NetBIOS name of the Samba server, + user is the user name of the UNIX user who owns the file, and + (Long name) is the descriptive string identifying the user (normally found in the + GECOS field of the UNIX password database).

    + If the parameter nt acl support is set to false + then the file owner will be shown as the NT user "Everyone" and the permissions will be + shown as NT "Full Control". +

    + The permissions field is displayed differently for files and directories, so I'll describe the way file permissions + are displayed first. +

    File Permissions

    The standard UNIX user/group/world triplet and + the corresponding "read", "write", "execute" permissions triplets are mapped by Samba into a three element NT ACL with the 'r', 'w', and 'x' bits mapped into the corresponding NT permissions. The UNIX world permissions are mapped into @@ -4663,20 +4458,20 @@ Before using any of the following options please refer to the man page for icon respectively followed by the list of permissions allowed for the UNIX user and group.

    As many UNIX permission sets don't map into common NT names such as read, - "change" or full control then + "change" or full control then usually the permissions will be prefixed by the words - "Special Access" in the NT display list.

    But what happens if the file has no permissions allowed - for a particular UNIX user group or world component ? In order - to allow "no permissions" to be seen and modified then Samba - overloads the NT "Take Ownership" ACL attribute + "Special Access" in the NT display list.

    But what happens if the file has no permissions allowed + for a particular UNIX user group or world component? In order + to allow "no permissions" to be seen and modified then Samba + overloads the NT "Take Ownership" ACL attribute (which has no meaning in UNIX) and reports a component with - no permissions as having the NT "O" bit set. + no permissions as having the NT "O" bit set. This was chosen of course to make it look like a zero, meaning zero permissions. More details on the decision behind this will - be given below.

    Directory Permissions

    Directories on an NT NTFS file system have two + be given below.

    Directory Permissions

    Directories on an NT NTFS file system have two different sets of permissions. The first set of permissions is the ACL set on the directory itself, this is usually displayed - in the first set of parentheses in the normal "RW" + in the first set of parentheses in the normal "RW" NT style. This first set of permissions is created by Samba in exactly the same way as normal file permissions are, described above, and is displayed in the same way.

    The second set of directory permissions has no real meaning @@ -4684,15 +4479,15 @@ Before using any of the following options please refer to the man page for permissions that any file created within this directory would inherit.

    Samba synthesises these inherited permissions for NT by returning as an NT ACL the UNIX permission mode that a new file - created by Samba on this share would receive.

    Modifying file or directory permissions

    Modifying file and directory permissions is as simple + created by Samba on this share would receive.

    Modifying file or directory permissions

    Modifying file and directory permissions is as simple as changing the displayed permissions in the dialog box, and clicking the OK button. However, there are limitations that a user needs to be aware of, and also interactions with the standard Samba permission masks and mapping of DOS - attributes that need to also be taken into account.

    If the parameter nt acl support + attributes that need to also be taken into account.

    If the parameter nt acl support is set to false then any attempt to set - security permissions will fail with an "Access Denied" - message.

    The first thing to note is that the "Add" + security permissions will fail with an "Access Denied" + message.

    The first thing to note is that the "Add" button will not return a list of users in Samba (it will give an error message of The remote procedure call failed and did not execute). This means that you can only @@ -4701,13 +4496,13 @@ Before using any of the following options please refer to the man page for

    If a permission triplet (either user, group, or world) is removed from the list of permissions in the NT dialog box, then when the OK button is pressed it will - be applied as "no permissions" on the UNIX side. If you then - view the permissions again the "no permissions" entry will appear - as the NT "O" flag, as described above. This + be applied as "no permissions" on the UNIX side. If you then + view the permissions again the "no permissions" entry will appear + as the NT "O" flag, as described above. This allows you to add permissions back to a file or directory once - you have removed them from a triplet component.

    As UNIX supports only the "r", "w" and "x" bits of - an NT ACL then if other NT security attributes such as "Delete - access" are selected then they will be ignored when applied on + you have removed them from a triplet component.

    As UNIX supports only the "r", "w" and "x" bits of + an NT ACL then if other NT security attributes such as "Delete + access" are selected then they will be ignored when applied on the Samba server.

    When setting permissions on a directory the second set of permissions (in the second set of parentheses) is by default applied to all files within that directory. If this @@ -4717,61 +4512,58 @@ Before using any of the following options please refer to the man page for Remove button, or set the component to only have the special Take - Ownership permission (displayed as "O" - ) highlighted.

    Interaction with the standard Samba create mask + Ownership permission (displayed as "O" + ) highlighted.

    Interaction with the standard Samba create mask parameters

    There are four parameters to control interaction with the standard Samba create mask parameters. These are : -

    security mask
    force security mode
    directory security mask
    force directory security mode

    +

    • security mask

    • force security mode

    • directory security mask

    • force directory security mode

    Once a user clicks OK to apply the permissions Samba maps the given permissions into a user/group/world r/w/x triplet set, and then will check the changed permissions for a - file against the bits set in the - security mask parameter. Any bits that + file against the bits set in the + security mask parameter. Any bits that were changed that are not set to '1' in this parameter are left alone - in the file permissions.

    Essentially, zero bits in the security mask + in the file permissions.

    Essentially, zero bits in the security mask mask may be treated as a set of bits the user is not allowed to change, and one bits are those the user is allowed to change.

    If not set explicitly this parameter is set to the same value as - the create mask - parameter. To allow a user to modify all the + the create mask parameter. To allow a user to modify all the user/group/world permissions on a file, set this parameter to 0777.

    Next Samba checks the changed permissions for a file against - the bits set in the - force security mode parameter. Any bits + the bits set in the + force security mode parameter. Any bits that were changed that correspond to bits set to '1' in this parameter are forced to be set.

    Essentially, bits set in the force security mode parameter may be treated as a set of bits that, when modifying security on a file, the user has always set to be 'on'.

    If not set explicitly this parameter is set to the same value - as the force - create mode parameter. + as the force create mode parameter. To allow a user to modify all the user/group/world permissions on a file - with no restrictions set this parameter to 000.

    The security mask and force + with no restrictions set this parameter to 000.

    The security mask and force security mode parameters are applied to the change request in that order.

    For a directory Samba will perform the same operations as described above for a file except using the parameter directory security mask instead of security mask, and force directory security mode parameter instead of force security mode - .

    The directory security mask parameter + .

    The directory security mask parameter by default is set to the same value as the directory mask parameter and the force directory security mode parameter by default is set to the same value as - the force directory mode parameter.

    In this way Samba enforces the permission restrictions that + the force directory mode parameter.

    In this way Samba enforces the permission restrictions that an administrator can set on a Samba share, whilst still allowing users to modify the permission bits within that restriction.

    If you want to set up a share that allows users full control in modifying the permission bits on their files and directories and doesn't force any particular bits to be set 'on', then set the following parameters in the smb.conf file in that share specific section : -

    security mask = 0777
    force security mode = 0
    directory security mask = 0777
    force directory security mode = 0

    Interaction with the standard Samba file attribute - mapping

    Samba maps some of the DOS attribute bits (such as "read - only") into the UNIX permissions of a file. This means there can +

    security mask = 0777
    force security mode = 0
    directory security mask = 0777
    force directory security mode = 0

    Interaction with the standard Samba file attribute mapping

    Note

    Samba maps some of the DOS attribute bits (such as "read + only") into the UNIX permissions of a file. This means there can be a conflict between the permission bits set via the security dialog and the permission bits set by the file attribute mapping. -

    One way this can show up is if a file has no UNIX read access - for the owner it will show up as "read only" in the standard +

    One way this can show up is if a file has no UNIX read access + for the owner it will show up as "read only" in the standard file attributes tabbed dialog. Unfortunately this dialog is the same one that contains the security info in another tab.

    What this can mean is that if the owner changes the permissions to allow themselves read access using the security dialog, clicks @@ -4782,10 +4574,10 @@ Before using any of the following options please refer to the man page for OK to get back to the attributes dialog you should always hit Cancel rather than OK to ensure that your changes - are not overridden.

    Common Errors

    + are not overridden.

    Common Errors

    File, Directory and Share access problems are very common on the mailing list. The following are examples taken from the mailing list in recent times. -

    Users can not write to a public share

    +

    Users can not write to a public share

    “ We are facing some troubles with file / directory permissions. I can log on the domain as admin user(root), and there's a public share, on which everyone needs to have permission to create / modify files, but only @@ -4794,80 +4586,89 @@ are examples taken from the mailing list in recent times. ”

    There are many ways to solve this problem, here are a few hints: -

    Procedure 13.3. Example Solution:

    1. +

      1. Go to the top of the directory that is shared

      2. Set the ownership to what ever public owner and group you want - 

        -			find 'directory_name' -type d -exec chown user.group {}\;
-			find 'directory_name' -type d -exec chmod 6775 'directory_name'
-			find 'directory_name' -type f -exec chmod 0775 {} \;
-			find 'directory_name' -type f -exec chown user.group {}\;
-

        +

        +$ find 'directory_name' -type d -exec chown user.group {}\;
+$ find 'directory_name' -type d -exec chmod 6775 'directory_name'
+$ find 'directory_name' -type f -exec chmod 0775 {} \;
+$ find 'directory_name' -type f -exec chown user.group {}\;
+

        Note

        The above will set the 'sticky bit' on all directories. Read your - Unix/Linux man page on what that does. It causes the OS to assign + UNIX/Linux man page on what that does. It causes the OS to assign to all files created in the directories the ownership of the directory.

      3. Directory is: /foodbar - 

        -				$ chown jack.engr /foodbar
-

        -

        Note

        -

        This is the same as doing:

        - 

        -					$ chown jack /foodbar
-					$ chgrp engr /foodbar
-

        -

      4. Now do: +

        +$ chown jack.engr /foodbar
+

        +

        Note

        This is the same as doing:

        +$ chown jack /foodbar
+$ chgrp engr /foodbar
+

      5. Now do: - 

        -				$ chmod 6775 /foodbar
-				$ ls -al /foodbar/..
-

        +

        +$ chmod 6775 /foodbar
+$ ls -al /foodbar/..
+

        You should see: - 

        -				drwsrwsr-x  2 jack  engr    48 2003-02-04 09:55 foodbar
-

        +

        +drwsrwsr-x  2 jack  engr    48 2003-02-04 09:55 foodbar
+

      6. Now do: - 

        -				$ su - jill
-				$ cd /foodbar
-				$ touch Afile
-				$ ls -al
-

        -

        +

        +$ su - jill
+$ cd /foodbar
+$ touch Afile
+$ ls -al
+

        +

        You should see that the file Afile created by Jill will have ownership and permissions of Jack, as follows: - 

        -		-rw-r--r--  1 jack  engr     0 2003-02-04 09:57 Afile
-

        +

        +-rw-r--r--  1 jack  engr     0 2003-02-04 09:57 Afile
+

      7. Now in your smb.conf for the share add: - 

        -		force create mode = 0775
-		force directory mode = 6775
-

        +

        force create mode = 0775
        force direcrtory mode = 6775

        Note

        The above are only needed if your users are not members of the group you have used. ie: Within the OS do not have write permission on the directory.

        An alternative is to set in the smb.conf entry for the share: - 

        -		force user = jack
-		force group = engr
-

        -

    I have set force user and Samba still makes root the owner of all the files - I touch!

    - When you have a user in 'admin users', Samba will always do file operations for - this user as root, even if force user has been set. -

    Chapter 14. File and Record Locking

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Eric Roseme

    HP Oplocks Usage Recommendations Whitepaper

    Table of Contents

    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Additional Reading

    +

    force user = jack
    force group = engr

    +

    I have set force user but Samba still makes root the owner of all the files I touch!

    + When you have a user in admin users, samba will always do file operations for + this user as root, even if force user has been set. +

    MS Word with Samba changes owner of file

    + Question: “When userB saves a word document that is owned by userA the updated file is now owned by userB. + Why is Samba doing this? How do I fix this?” +

    + Answer: Word does the following when you modify/change a Word document: Word Creates a NEW document with + a temporary name, Word then closes the old document and deletes it, Word then renames the new document to the original document name. + There is NO mechanism by which Samba CAN IN ANY WAY know that the new document really should be owned by the owners + of the original file. Samba has no way of knowing that the file will be renamed by MS Word. As far as Samba is able + to tell, the file that gets created is a NEW file, not one that the application (Word) is updating. +

    + There is a work-around to solve the permissions problem. That work-around involves understanding how you can manage file + system behaviour from within the smb.conf file, as well as understanding how Unix file systems work. Set on the directory + in which you are changing word documents: chmod g+s 'directory_name' This ensures that all files will + be created with the group that owns the directory. In smb.conf share declaration section set: +

    +

    force create mode = 0660
    force directory mode = 0770

    +

    + These two settings will ensure that all directories and files that get created in the share will be read/writable by the + owner and group set on the directory itself. +

    Chapter 14. File and Record Locking

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Eric Roseme

    HP Oplocks Usage Recommendations Whitepaper

    Table of Contents

    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Problems saving files in MS Office on Windows XP
    Long delays deleting files over network with XP SP1
    Additional Reading

    One area which causes trouble for many network administrators is locking. The extent of the problem is readily evident from searches over the internet. -

    Features and Benefits

    +

    Features and Benefits

    Samba provides all the same locking semantics that MS Windows clients expect and that MS Windows NT4 / 200x servers provide also.

    @@ -4889,13 +4690,13 @@ settings on the MS Windows client.

    Note

    Sometimes it is necessary to disable locking control settings BOTH on the Samba server as well as on each MS Windows client! -

    Discussion

    +

    Discussion

    There are two types of locking which need to be performed by a SMB server. The first is record locking which allows a client to lock a range of bytes in a open file. The second is the deny modes that are specified when a file is open.

    -Record locking semantics under Unix is very different from record locking under +Record locking semantics under UNIX are very different from record locking under Windows. Versions of Samba before 2.2 have tried to use the native fcntl() unix system call to implement proper record locking between different Samba clients. This can not be fully correct due to several reasons. The simplest is the fact @@ -4906,29 +4707,29 @@ many more differences, too many to be listed here.

    Samba 2.2 and above implements record locking completely independent of the underlying unix system. If a byte range lock that the client requests happens -to fall into the range 0-2^31, Samba hands this request down to the Unix system. +to fall into the range 0-2^31, Samba hands this request down to the UNIX system. All other locks can not be seen by unix anyway.

    -Strictly a SMB server should check for locks before every read and write call on -a file. Unfortunately with the way fcntl() works this can be slow and may overstress +Strictly an SMB server should check for locks before every read and write call on +a file. Unfortunately with the way fcntl() works this can be slow and may over-stress the rpc.lockd. It is also almost always unnecessary as clients are supposed to independently make locking calls before reads and writes anyway if locking is important to them. By default Samba only makes locking calls when explicitly asked -to by a client, but if you set strict locking = yes then it +to by a client, but if you set strict locking = yes then it will make lock checking calls on every read and write.

    -You can also disable by range locking completely using locking = no. +You can also disable byte range locking completely using locking = no. This is useful for those shares that don't support locking or don't need it (such as cdroms). In this case Samba fakes the return codes of locking calls to tell clients that everything is OK.

    -The second class of locking is the deny modes. These +The second class of locking is the deny modes. These are set by an application when it opens a file to determine what types of access should be allowed simultaneously with its open. A client may ask for DENY_NONE, DENY_READ, DENY_WRITE or DENY_ALL. There are also special compatibility modes called DENY_FCB and DENY_DOS. -

    Opportunistic Locking Overview

    +

    Opportunistic Locking Overview

    Opportunistic locking (Oplocks) is invoked by the Windows file system (as opposed to an API) via registry entries (on the server AND client) for the purpose of enhancing network performance when accessing a file @@ -4954,7 +4755,7 @@ other processes. operations on the cached local file.

    If a second process attempts to open the file, the open - is deferred while the redirector "breaks" the original + is deferred while the redirector "breaks" the original oplock. The oplock break signals the caching client to write the local file back to the server, flush the local locks, and discard read-ahead data. The break is @@ -4994,12 +4795,12 @@ The actual decision that a user or administrator should consider is whether it is sensible to share amongst multiple users data that will be cached locally on a client. In many cases the answer is no. Deciding when to cache or not cache data is the real question, and thus -"opportunistic locking" should be treated as a toggle for client-side -caching. Turn it "ON" when client-side caching is desirable and -reliable. Turn it "OFF" when client-side caching is redundant, +"opportunistic locking" should be treated as a toggle for client-side +caching. Turn it "ON" when client-side caching is desirable and +reliable. Turn it "OFF" when client-side caching is redundant, unreliable, or counter-productive.

    -Opportunistic locking is by default set to "on" by Samba on all +Opportunistic locking is by default set to "on" by Samba on all configured shares, so careful attention should be given to each case to determine if the potential benefit is worth the potential for delays. The following recommendations will help to characterize the environment @@ -5051,7 +4852,7 @@ In mission critical high availability environments, careful attention should be given to opportunistic locking. Ideally, comprehensive testing should be done with all affected applications with oplocks enabled and disabled. -

    Exclusively Accessed Shares

    +

    Exclusively Accessed Shares

    Opportunistic locking is most effective when it is confined to shares that are exclusively accessed by a single user, or by only one user at a time. Because the true value of opportunistic locking is the local @@ -5060,7 +4861,7 @@ mechanism will cause a delay.

    Home directories are the most obvious examples of where the performance benefit of opportunistic locking can be safely realized. -

    Multiple-Accessed Shares or Files

    +

    Multiple-Accessed Shares or Files

    As each additional user accesses a file in a share with opportunistic locking enabled, the potential for delays and resulting perceived poor performance increases. When multiple users are accessing a file on a @@ -5072,17 +4873,17 @@ of the caching user. As each additional client attempts to access a file with oplocks set, the potential performance improvement is negated and eventually results in a performance bottleneck. -

    Unix or NFS Client Accessed Files

    -Local Unix and NFS clients access files without a mandatory +

    UNIX or NFS Client Accessed Files

    +Local UNIX and NFS clients access files without a mandatory file locking mechanism. Thus, these client platforms are incapable of initiating an oplock break request from the server to a Windows client -that has a file cached. Local Unix or NFS file access can therefore +that has a file cached. Local UNIX or NFS file access can therefore write to a file that has been cached by a Windows client, which exposes the file to likely data corruption.

    -If files are shared between Windows clients, and either local Unix +If files are shared between Windows clients, and either local UNIX or NFS users, then turn opportunistic locking off. -

    Slow and/or Unreliable Networks

    +

    Slow and/or Unreliable Networks

    The biggest potential performance improvement for opportunistic locking occurs when the client-side caching of reads and writes delivers the most differential over sending those reads and writes over the wire. @@ -5097,7 +4898,7 @@ the most advantageous scenario to utilize opportunistic locking. If the network is slow, unreliable, or a WAN, then do not configure opportunistic locking if there is any chance of multiple users regularly opening the same file. -

    Multi-User Databases

    +

    Multi-User Databases

    Multi-user databases clearly pose a risk due to their very nature - they are typically heavily accessed by numerous users at random intervals. Placing a multi-user database on a share with opportunistic @@ -5105,7 +4906,7 @@ locking enabled will likely result in a locking management bottleneck on the Samba server. Whether the database application is developed in-house or a commercially available product, ensure that the share has opportunistic locking disabled. -

    PDM Data Shares

    +

    PDM Data Shares

    Process Data Management (PDM) applications such as IMAN, Enovia, and Clearcase, are increasing in usage with Windows client platforms, and therefore SMB data stores. PDM applications manage multi-user @@ -5118,8 +4919,8 @@ application and PDM server to negotiate and maintain. It is appropriate to eliminate the client OS from any caching tasks, and the server from any oplock management, by disabling opportunistic locking on the share. -

    Beware of Force User

    -Samba includes an smb.conf parameter called force user that changes +

    Beware of Force User

    +Samba includes an smb.conf parameter called force user that changes the user accessing a share from the incoming user to whatever user is defined by the smb.conf variable. If opportunistic locking is enabled on a share, the change in user access causes an oplock break to be sent @@ -5131,26 +4932,26 @@ to overcome the lost oplock break.

    Avoid the combination of the following:

    • - force user in the smb.conf share configuration. + force user in the smb.conf share configuration.

    • Slow or unreliable networks

    • Opportunistic Locking Enabled -

    Advanced Samba Opportunistic Locking Parameters

    +

    Advanced Samba Opportunistic Locking Parameters

    Samba provides opportunistic locking parameters that allow the administrator to adjust various properties of the oplock mechanism to account for timing and usage levels. These parameters provide good versatility for implementing oplocks in environments where they would likely cause problems. The parameters are: -oplock break wait time, -oplock contention limit. +oplock break wait time, +oplock contention limit.

    For most users, administrators, and environments, if these parameters are required, then the better option is to simply turn oplocks off. -The samba SWAT help text for both parameters reads "DO NOT CHANGE THIS -PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." +The samba SWAT help text for both parameters reads "DO NOT CHANGE THIS +PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." This is good advice. -

    Mission Critical High Availability

    +

    Mission Critical High Availability

    In mission critical high availability environments, data integrity is often a priority. Complex and expensive configurations are implemented to ensure that if a client loses connectivity with a file server, a @@ -5180,10 +4981,10 @@ In mission critical high availability environments, careful attention should be given to opportunistic locking. Ideally, comprehensive testing should be done with all affected applications with oplocks enabled and disabled. -

    Samba Opportunistic Locking Control

    +

    Samba Opportunistic Locking Control

    Opportunistic Locking is a unique Windows file locking feature. It is not really file locking, but is included in most discussions of Windows -file locking, so is considered a defacto locking feature. +file locking, so is considered a de facto locking feature. Opportunistic Locking is actually part of the Windows client file caching mechanism. It is not a particularly robust or reliable feature when implemented on the variety of customized networks that exist in @@ -5202,7 +5003,7 @@ file, the first client receives a break and must synchronise the file back to th This can give significant performance gains in some cases; some programs insist on synchronising the contents of the entire file back to the server for a single change.

    -Level1 Oplocks (aka just plain "oplocks") is another term for opportunistic locking. +Level1 Oplocks (aka just plain "oplocks") is another term for opportunistic locking.

    Level2 Oplocks provides opportunistic locking for a file that will be treated as read only. Typically this is used on files that are read-only or @@ -5214,7 +5015,7 @@ file locking with the under lying OS, SGI IRIX and Linux are the only two OS's t oplock aware at this time.

    Unless your system supports kernel oplocks, you should disable oplocks if you are -accessing the same files from both Unix/Linux and SMB clients. Regardless, oplocks should +accessing the same files from both UNIX/Linux and SMB clients. Regardless, oplocks should always be disabled if you are sharing a database file (e.g., Microsoft Access) between multiple clients, as any break the first client receives will affect synchronisation of the entire file (not just the single record), which will result in a noticeable performance @@ -5230,29 +5031,23 @@ of your client sending oplock breaks and will instead want to disable oplocks fo

    Another factor to consider is the perceived performance of file access. If oplocks provide no measurable speed benefit on your network, it might not be worth the hassle of dealing with them. -

    Example Configuration

    +

    Example Configuration

    In the following we examine two distinct aspects of Samba locking controls. -

    Disabling Oplocks

    +

    Disabling Oplocks

    You can disable oplocks on a per-share basis with the following:

    -

    -[acctdata]
-	oplocks = False
-	level2 oplocks = False
-

    +

    [acctdata]
    oplocks = False
    level2 oplocks = False

    The default oplock type is Level1. Level2 Oplocks are enabled on a per-share basis in the smb.conf file.

    Alternately, you could disable oplocks on a per-file basis within the share:

    -

    -	veto oplock files = /*.mdb/*.MDB/*.dbf/*.DBF/
-

    +

    veto oplock files = /*.mdb/*.MDB/*.dbf/*.DBF/

    If you are experiencing problems with oplocks as apparent from Samba's log entries, you may want to play it safe and disable oplocks and level2 oplocks. -

    Disabling Kernel OpLocks

    +

    Disabling Kernel OpLocks

    Kernel OpLocks is an smb.conf parameter that notifies Samba (if the UNIX kernel has the capability to send a Windows client an oplock break) when a UNIX process is attempting to open the file that is @@ -5265,11 +5060,8 @@ send an oplock break, then the kernel oplocks parameter enables Samba to send the oplock break. Kernel oplocks are enabled on a per-server basis in the smb.conf file.

    -

    -[global]
-kernel oplocks = yes
-

    -The default is "no". +

    kernel oplocks = yes

    +The default is "no".

    Veto OpLocks is an smb.conf parameter that identifies specific files for which Oplocks are disabled. When a Windows client opens a file that @@ -5283,41 +5075,26 @@ caching without the risk of data corruption. Veto Oplocks can be enabled on a per-share basis, or globally for the entire server, in the smb.conf file:

    -

    <title>Example Veto OpLock Settings</title>
-[global]
-        veto oplock files = /filename.htm/*.txt/
-
-[share_name]
-        veto oplock files = /*.exe/filename.ext/
-

    +

    Example 14.1. Share with some files oplocked

    [global]
    veto oplock files = /filename.htm/*.txt/
    [share_name]
    veto oplock files = /*.exe/filename.ext/

    -Oplock break wait time is an smb.conf parameter that adjusts the time + oplock break wait time is an smb.conf parameter that adjusts the time interval for Samba to reply to an oplock break request. Samba -recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND -UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Wait Time can only be +recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND +UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Wait Time can only be configured globally in the smb.conf file:

    -

    -[global]
-          oplock break wait time =  0 (default)
-

    +

    oplock break wait time = 0 (default)

    Oplock break contention limit is an smb.conf parameter that limits the response of the Samba server to grant an oplock if the configured number of contending clients reaches the limit specified by the -parameter. Samba recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU -HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break +parameter. Samba recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU +HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Contention Limit can be enable on a per-share basis, or globally for the entire server, in the smb.conf file:

    -

    -[global]
-          oplock break contention limit =  2 (default)
-
-[share_name]
-         oplock break contention limit =  2 (default)
-

    -

    MS Windows Opportunistic Locking and Caching Controls

    +

    Example 14.2. 

    [global]
    oplock break contention limit = 2 (default)
    [share_name]
    oplock break contention limit = 2 (default)

    +

    MS Windows Opportunistic Locking and Caching Controls

    There is a known issue when running applications (like Norton Anti-Virus) on a Windows 2000/ XP workstation computer that can affect any application attempting to access shared database files across a network. This is a result of a default setting configured in the Windows 2000/XP @@ -5409,7 +5186,7 @@ An illustration of how level II oplocks work: station holds any oplock on the file. Because the workstations can have no cached writes or locks at this point, they need not respond to the break-to-none advisory; all they need do is invalidate locally cashed read-ahead data. -

    Workstation Service Entries

    +

    Workstation Service Entries

     	\HKEY_LOCAL_MACHINE\System\
 		CurrentControlSet\Services\LanmanWorkstation\Parameters
 
@@ -5418,7 +5195,7 @@ An illustration of how level II oplocks work:

    Indicates whether the redirector should use opportunistic-locking (oplock) performance enhancement. This parameter should be disabled only to isolate problems. -

    Server Service Entries

    +

    Server Service Entries

     	\HKEY_LOCAL_MACHINE\System\
 		CurrentControlSet\Services\LanmanServer\Parameters
 
@@ -5447,8 +5224,8 @@ the server disables raw I/O and opportunistic locking for this connection.
 Specifies the time that the server waits for a client to respond to an oplock break
 request. Smaller values can allow detection of crashed clients more quickly but can
 potentially cause loss of cached data.
-

    Persistent Data Corruption

    -If you have applied all of the settings discussed in this paper but data corruption problems +

    Persistent Data Corruption

    +If you have applied all of the settings discussed in this chapter but data corruption problems and other symptoms persist, here are some additional things to check out:

    We have credible reports from developers that faulty network hardware, such as a single @@ -5458,7 +5235,7 @@ rebuild the data files in question. This involves creating a new data file with same definition as the file to be rebuilt and transferring the data from the old file to the new one. There are several known methods for doing this that can be found in our Knowledge Base. -

    Common Errors

    +

    Common Errors

    In some sites locking problems surface as soon as a server is installed, in other sites locking problems may not surface for a long time. Almost without exception, when a locking problem does surface it will cause embarrassment and potential data corruption. @@ -5488,18 +5265,23 @@ so far: report on https://bugzilla.samba.org without delay. Make sure that you give as much information as you possibly can to help isolate the cause and to allow reproduction of the problem (an essential step in problem isolation and correction). -

    locking.tdb error messages

    - 

    -	> We are seeing lots of errors in the samba logs like:
-	>
-	>    tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic
-	> 0x4d6f4b61 at offset=36116
-	>
-	> What do these mean?
-

    +

    locking.tdb error messages

    + “ + We are seeing lots of errors in the samba logs like: +” +

    +tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic
+ 0x4d6f4b61 at offset=36116
+

    +“ + What do these mean? + ”

    Corrupted tdb. Stop all instances of smbd, delete locking.tdb, restart smbd. -

    Additional Reading

    +

    Problems saving files in MS Office on Windows XP

    This is a bug in Windows XP. More information can be + found in Microsoft Knowledge Base article 812937.

    Long delays deleting files over network with XP SP1

    “It sometimes takes approximately 35 seconds to delete files over the network after XP SP1 has been applied”

    This is a bug in Windows XP. More information can be + found in + Microsoft Knowledge Base article 811492.

    Additional Reading

    You may want to check for an updated version of this white paper on our Web site from time to time. Many of our white papers are updated as information changes. For those papers, the Last Edited date is always at the top of the paper. @@ -5511,27 +5293,27 @@ Windows Base Services > Files and I/O > SDK Documentation > File Storag > About File Systems > Opportunistic Locks, Microsoft Corporation. http://msdn.microsoft.com/library/en-us/fileio/storage_5yk3.asp

    -Microsoft Knowledge Base Article Q224992 "Maintaining Transactional Integrity with OPLOCKS", +Microsoft Knowledge Base Article Q224992 "Maintaining Transactional Integrity with OPLOCKS", Microsoft Corporation, April 1999, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q224992.

    -Microsoft Knowledge Base Article Q296264 "Configuring Opportunistic Locking in Windows 2000", +Microsoft Knowledge Base Article Q296264 "Configuring Opportunistic Locking in Windows 2000", Microsoft Corporation, April 2001, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296264.

    -Microsoft Knowledge Base Article Q129202 "PC Ext: Explanation of Opportunistic Locking on Windows NT", +Microsoft Knowledge Base Article Q129202 "PC Ext: Explanation of Opportunistic Locking on Windows NT", Microsoft Corporation, April 1995, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202. -

    Chapter 15. Securing Samba

    Andrew Tridgell

    Samba Team

    John H. Terpstra

    Samba Team

    May 26, 2003

    Table of Contents

    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?

    Introduction

    +

    Chapter 15. Securing Samba

    Andrew Tridgell

    Samba Team

    John H. Terpstra

    Samba Team

    May 26, 2003

    Table of Contents

    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?

    Introduction

    This note was attached to the Samba 2.2.8 release notes as it contained an important security fix. The information contained here applies to Samba installations in general.

    -A new apprentice reported for duty to the Chief Engineer of a boiler house. He said, "Here I am, -if you will show me the boiler I'll start working on it." Then engineer replied, "You're leaning -on it!" +A new apprentice reported for duty to the Chief Engineer of a boiler house. He said, "Here I am, +if you will show me the boiler I'll start working on it." Then engineer replied, "You're leaning +on it!"

    Security concerns are just like that: You need to know a little about the subject to appreciate how obvious most of it really is. The challenge for most of us is to discover that first morsel of knowledge with which we may unlock the secrets of the masters. -

    Features and Benefits

    +

    Features and Benefits

    There are three level at which security principals must be observed in order to render a site at least moderately secure. These are: the perimeter firewall, the configuration of the host server that is running Samba, and Samba itself. @@ -5541,60 +5323,52 @@ the latest protocols to permit more secure MS Windows file and print operations.

    Samba may be secured from connections that originate from outside the local network. This may be done using host based protection (using samba's implementation of a technology -known as "tcpwrappers", or it may be done be using interface based exclusion +known as "tcpwrappers", or it may be done be using interface based exclusion so that smbd will bind only to specifically permitted interfaces. It is also -possible to set specific share or resource based exclusions, eg: on the IPC$ -auto-share. The IPC$ share is used for browsing purposes as well as to establish +possible to set specific share or resource based exclusions, eg: on the [IPC$] +auto-share. The [IPC$] share is used for browsing purposes as well as to establish TCP/IP connections.

    Another method by which Samba may be secured is by way of setting Access Control Entries in an Access Control List on the shares themselves. This is discussed in the chapter on File, Directory and Share Access Control. -

    Technical Discussion of Protective Measures and Issues

    +

    Technical Discussion of Protective Measures and Issues

    The key challenge of security is the fact that protective measures suffice at best only to close the door on known exploits and breach techniques. Never assume that because you have followed these few measures that the Samba server is now an impenetrable fortress! Given the history of information systems so far, it is only a matter of time before someone will find yet another vulnerability. -

    Using host based protection

    +

    Using host based protection

    In many installations of Samba the greatest threat comes for outside your immediate network. By default Samba will accept connections from any host, which means that if you run an insecure version of Samba on a host that is directly connected to the Internet you can be especially vulnerable.

    - One of the simplest fixes in this case is to use the hosts allow and - hosts deny options in the Samba smb.conf configuration file to only + One of the simplest fixes in this case is to use the hosts allow and + hosts deny options in the Samba smb.conf configuration file to only allow access to your server from a specific range of hosts. An example might be: - 

    -		hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
-		hosts deny = 0.0.0.0/0
-

    +

    hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
    hosts deny = 0.0.0.0/0

    The above will only allow SMB connections from 'localhost' (your own computer) and from the two private networks 192.168.2 and 192.168.3. All other connections will be refused as soon as the client sends its first packet. The refusal will be marked as a not listening on called name error. -

    User based protection

    +

    User based protection

    If you want to restrict access to your server to valid users only then the following - method may be of use. In the smb.conf [globals] section put: - 

    -		valid users = @smbusers, jacko
-

    + method may be of use. In the smb.conf [global] section put: +

    valid users = @smbusers, jacko

    What this does is, it restricts all server access to either the user jacko or to members of the system group smbusers. -

    Using interface protection

    +

    Using interface protection

    By default Samba will accept connections on any network interface that it finds on your system. That means if you have a ISDN line or a PPP connection to the Internet then Samba will accept connections on those links. This may not be what you want.

    You can change this behaviour using options like the following: - 

    -		interfaces = eth* lo
-		bind interfaces only = yes
-

    +

    interfaces = eth* lo
    bind interfaces only = yes

    This tells Samba to only listen for connections on interfaces with a name starting with 'eth' such as eth0, eth1, plus on the loopback interface called 'lo'. The name you will need to use depends on what @@ -5606,7 +5380,7 @@ before someone will find yet another vulnerability. connection refused reply. In that case no Samba code is run at all as the operating system has been told not to pass connections from that interface to any samba process. -

    Using a firewall

    +

    Using a firewall

    Many people use a firewall to deny access to services that they don't want exposed outside their network. This can be a very good idea, although I would recommend using it in conjunction with the above @@ -5619,7 +5393,7 @@ before someone will find yet another vulnerability. The last one is important as many older firewall setups may not be aware of it, given that this port was only added to the protocol in recent years. -

    Using a IPC$ share deny

    +

    Using a IPC$ share deny

    If the above methods are not suitable, then you could also place a more specific deny on the IPC$ share that is used in the recently discovered security hole. This allows you to offer access to other @@ -5627,11 +5401,7 @@ before someone will find yet another vulnerability. hosts.

    To do that you could use: - 

    -[ipc$]
-	hosts allow = 192.168.115.0/24 127.0.0.1
-	hosts deny = 0.0.0.0/0
-

    +

    [ipc$]
    hosts allow = 192.168.115.0/24 127.0.0.1
    hosts deny = 0.0.0.0/0

    this would tell Samba that IPC$ connections are not allowed from anywhere but the two listed places (localhost and a local subnet). Connections to other shares would still be allowed. As the @@ -5646,42 +5416,44 @@ before someone will find yet another vulnerability.

    This is not recommended unless you cannot use one of the other methods listed above for some reason. -

    NTLMv2 Security

    +

    NTLMv2 Security

    To configure NTLMv2 authentication the following registry keys are worth knowing about:

    - 

    +		
     		[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
-		"lmcompatibilitylevel"=dword:00000003
-
+		"lmcompatibilitylevel"=dword:00000003
+		
    
+	
    
 		0x3 - Send NTLMv2 response only. Clients will use NTLMv2 authentication,
 		use NTLMv2 session security if the server supports it. Domain
 		controllers accept LM, NTLM and NTLMv2 authentication.
-
+	
    
+		
     		[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
-		"NtlmMinClientSec"=dword:00080000
-
+		"NtlmMinClientSec"=dword:00080000
+		
    
+	
    
 		0x80000 - NTLMv2 session security. If either NtlmMinClientSec or
 		NtlmMinServerSec is set to 0x80000, the connection will fail if NTLMv2
 		session security is not negotiated.
-

    -

    Upgrading Samba

    +

    Upgrading Samba

    Please check regularly on http://www.samba.org/ for updates and important announcements. Occasionally security releases are made and it is highly recommended to upgrade Samba when a security vulnerability -is discovered. -

    Common Errors

    +is discovered. Check with your OS vendor for OS specific upgrades. +

    Common Errors

    If all of samba and host platform configuration were really as intuitive as one might like then this section would not be necessary. Security issues are often vexing for a support person to resolve, not because of the complexity of the problem, but for reason that most administrators who post what turns out to be a security problem request are totally convinced that the problem is with Samba. -

    Smbclient works on localhost, but the network is dead

    +

    Smbclient works on localhost, but the network is dead

    This is a very common problem. Red Hat Linux (as do others) will install a default firewall. With the default firewall in place only traffic on the loopback adapter (IP address 127.0.0.1) will be allowed through the firewall.

    The solution is either to remove the firewall (stop it) or to modify the firewall script to allow SMB networking traffic through. See section above in this chapter. -

    Why can users access home directories of other users?

    +

    Why can users access home directories of other users?

    “ We are unable to keep individual users from mapping to any other user's home directory once they have supplied a valid password! They only need @@ -5710,27 +5482,24 @@ out to be a security problem request are totally convinced that the problem is w the policies and permissions he or she desires.

    Samba does allow the setup you require when you have set the - only user = yes option on the share, is that you have not set the + only user = yes option on the share, is that you have not set the valid users list for the share.

    Note that only user works in conjunction with the users= list, so to get the behavior you require, add the line : - 

    -	users = %S
-

    +

    users = %S

    this is equivalent to: - 

    -	valid users = %S
-

    +

    valid users = %S

    to the definition of the [homes] share, as recommended in the smb.conf man page. -

    Chapter 16. Interdomain Trust Relationships

    John H. Terpstra

    Samba Team

    Rafal Szczesniak

    Samba Team

    April 3, 2003

    Table of Contents

    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    Common Errors
    Tell me about Trust Relationships using Samba

    +

    Chapter 16. Interdomain Trust Relationships

    John H. Terpstra

    Samba Team

    Rafal Szczesniak

    Samba Team

    Jelmer R. Vernooij

    drawing
    The Samba Team

    Stephen Langasek

    April 3, 2003

    Table of Contents

    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-style Domain Trusts with Windows 2000
    Common Errors

    Samba-3 supports NT4 style domain trust relationships. This is feature that many sites will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to adopt Active Directory or an LDAP based authentication back end. This section explains some background information regarding trust relationships and how to create them. It is now -possible for Samba-3 to NT4 trust (and vice versa), as well as Samba3 to Samba3 trusts. -

    Features and Benefits

    +possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba3-to-Samba3 +trusts. +

    Features and Benefits

    Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4 style trust relationships. This imparts to Samba similar scalability as is possible with MS Windows NT4. @@ -5740,10 +5509,10 @@ database such as LDAP, and given it's ability to run in Primary as well as Backu modes, the administrator would be well advised to consider alternatives to the use of Interdomain trusts simply because by the very nature of how this works it is fragile. That was, after all, a key reason for the development and adoption of Microsoft Active Directory. -

    Trust Relationship Background

    +

    Trust Relationship Background

    MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure. The limitations of this architecture as it affects the scalability of MS Windows networking -in large organisations is well known. Additionally, the flat-name space that results from +in large organisations is well known. Additionally, the flat namespace that results from this design significantly impacts the delegation of administrative responsibilities in large and diverse organisations.

    @@ -5769,45 +5538,91 @@ relationship, and WHITE and BLUE have a trust relationship, then it holds that t implied trust between the RED and BLUE domains. ie: Relationships are explicit and not transitive.

    + New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is an inherent feature of ADS domains. Samba-3 implements MS Windows NT4 style Interdomain trusts and interoperates with MS Windows 200x ADS security domains in similar manner to MS Windows NT4 style domains. -

    Native MS Windows NT4 Trusts Configuration

    -There are two steps to creating an interdomain trust relationship. -

    NT4 as the Trusting Domain (ie. creating the trusted account)

    +

    Native MS Windows NT4 Trusts Configuration

    +There are two steps to creating an interdomain trust relationship. To effect a two-way trust +relationship it is necessary for each domain administrator to create a trust account for the +other domain to use in verifying security credentials. + + +

    Creating an NT4 Domain Trust

    For MS Windows NT4, all domain trust relationships are configured using the -Domain User Manager. To affect a two way trust relationship it is -necessary for each domain administrator to make available (for use by an external domain) it's -security resources. This is done from the Domain User Manager Policies entry on the menu bar. -From the Policy menu, select Trust Relationships, then -next to the lower box that is labelled Permitted to Trust this Domain are two -buttons, Add and Remove. The Add -button will open a panel in which needs to be entered the remote domain that will be able to assign -user rights to your domain. In addition it is necessary to enter a password -that is specific to this trust relationship. The password needs to be -typed twice (for standard confirmation). -

    NT4 as the Trusted Domain (ie. creating trusted account's password)

    +Domain User Manager. This is done from the Domain User Manager Policies +entry on the menu bar. From the Policy menu, select +Trust Relationships. Next to the lower box labelled +Permitted to Trust this Domain are two buttons, Add +and Remove. The Add button will open a panel in which +to enter the name of the remote domain that will be able to assign access rights to users in +your domain. You will also need to enter a password for this trust relationship, which the +trusting domain will use when authenticating users from the trusted domain. +The password needs to be typed twice (for standard confirmation). +

    Completing an NT4 Domain Trust

    + A trust relationship will work only when the other (trusting) domain makes the appropriate connections with the trusted domain. To consummate the trust relationship the administrator will launch the Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the Add button that is next to the box that is labelled Trusted Domains. A panel will open in which must be entered the name of the remote domain as well as the password assigned to that trust. -

    Configuring Samba NT-style Domain Trusts

    +

    Inter-Domain Trust Facilities

    +A two-way trust relationship is created when two one-way trusts are created, one in each direction. +Where a one-way trust has been established between two MS Windows NT4 domains (let's call them +DomA and DomB) the following facilities are created: +

    Figure 16.1. Trusts overview

    Trusts overview

    • + DomA (completes the trust connection) Trusts DomB +

    • + DomA is the Trusting domain +

    • + DomB is the Trusted domain (originates the trust account) +

    • + Users in DomB can access resources in DomA +

    • + Users in DomA can NOT access resources in DomB +

    • + Global groups from DomB CAN be used in DomA +

    • + Global groups from DomA can NOT be used in DomB +

    • + DomB DOES appear in the logon dialog box on client workstations in DomA +

    • + DomA does NOT appear in the logon dialog box on client workstations in DomB +

    • + Users / Groups in a trusting domain can NOT be granted rights, permissions or access + to a trusted domain. +

    • + The trusting domain CAN access and use accounts (Users / Global Groups) in the + trusted domain. +

    • + Administrators of the trusted domain CAN be granted admininstrative rights in the + trusting domain. +

    • + Users in a trusted domain CAN be given rights and privileges in the trusting + domain. +

    • + Trusted domain Global Groups CAN be given rights and permissions in the trusting + domain. +

    • + Global Groups from the trusted domain CAN be made members in Local Groups on + MS Windows domain member machines. +

    Configuring Samba NT-style Domain Trusts

    This description is meant to be a fairly short introduction about how to set up a Samba server so that it could participate in interdomain trust relationships. Trust relationship support in Samba is in its early stage, so lot of things don't work yet.

    -Each of the procedures described below is treated as they were performed with Windows NT4 Server on -one end. The remote end could just as well be another Samba-3 domain. It can be clearly seen, after -reading this document, that combining Samba-specific parts of what's written below leads to trust -between domains in purely Samba environment. -

    Samba-3 as the Trusting Domain

    -In order to set the Samba PDC to be the trusted party of the relationship first you need -to create special account for the domain that will be the trusting party. To do that, +Each of the procedures described below assumes the peer domain in the trust relationship is +controlled by a Windows NT4 server. However, the remote end could just as well be another +Samba-3 domain. It can be clearly seen, after reading this document, that combining +Samba-specific parts of what's written below leads to trust between domains in a purely Samba +environment. +

    Samba as the Trusted Domain

    +In order to set the Samba PDC to be the trusted party of the relationship you first need +to create a special account for the domain that will be the trusting party. To do that, you can use the 'smbpasswd' utility. Creating the trusted domain account is very similar to creating a trusted machine account. Suppose, your domain is called SAMBA, and the remote domain is called RUMBA. The first step @@ -5815,9 +5630,9 @@ will be to issue this command from your favourite shell: 

     root#  smbpasswd -a -i rumba
-	New SMB password: XXXXXXXX
-	Retype SMB password: XXXXXXXX
-	Added user rumba$
+New SMB password: XXXXXXXX
+Retype SMB password: XXXXXXXX
+Added user rumba$

    where -a means to add a new account into the @@ -5830,29 +5645,29 @@ After issuing this command you'll be asked to enter the password for the account. You can use any password you want, but be aware that Windows NT will not change this password until 7 days following account creation. After the command returns successfully, you can look at the entry for the new account -(in the standard way depending on your configuration) and see that account's name is -really RUMBA$ and it has 'I' flag in the flags field. Now you're ready to confirm +(in the standard way as appropriate for your configuration) and see that account's name is +really RUMBA$ and it has the 'I' flag set in the flags field. Now you're ready to confirm the trust by establishing it from Windows NT Server. -

    -Open User Manager for Domains and from menu -Policies select Trust Relationships.... -Right beside Trusted domains list box press the +

    +Open User Manager for Domains and from the +Policies menu, select Trust Relationships.... +Right beside the Trusted domains list box press the Add... button. You will be prompted for the trusted domain name and the relationship password. Type in SAMBA, as this is -your domain name, and the password used at the time of account creation. +the name of the remote domain, and the password used at the time of account creation. Press OK and, if everything went without incident, you will see Trusted domain relationship successfully established message. -

    Samba-3 as the Trusted Domain

    +

    Samba as the Trusting Domain

    This time activities are somewhat reversed. Again, we'll assume that your domain controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA.

    -The very first thing requirement is to add an account for the SAMBA domain on RUMBA's PDC. -

    +The very first step is to add an account for the SAMBA domain on RUMBA's PDC. +

    Launch the Domain User Manager, then from the menu select Policies, Trust Relationships. -Now, next to Trusted Domains box press the Add -button, and type in the name of the trusted domain (SAMBA) and password securing +Now, next to the Trusted Domains box press the Add +button, and type in the name of the trusted domain (SAMBA) and the password to use in securing the relationship.

    The password can be arbitrarily chosen. It is easy to change the password @@ -5864,61 +5679,60 @@ Using your favourite shell while being logged in as root, issue this command: root# net rpc trustdom establish rumba

    You will be prompted for the password you just typed on your Windows NT4 Server box. -Do not worry if you see an error message that mentions a returned code of -NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the +Do not worry if you see an error message that mentions a return code of +NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the password you gave is correct and the NT4 Server says the account is ready for interdomain connection and not for ordinary -connection. After that, be patient it can take a while (especially -in large networks), you should see the Success message. +connection. After that, be patient; it can take a while (especially +in large networks), but eventually you should see the Success message. Congratulations! Your trust relationship has just been established.

    Note

    Note that you have to run this command as root because you must have write access to the secrets.tdb file. -

    Common Errors

    +

    NT4-style Domain Trusts with Windows 2000

    +Although Domain User Manager is not present in Windows 2000, it is +also possible to establish an NT4-style trust relationship with a Windows 2000 domain +controller running in mixed mode as the trusting server. It should also be possible for +Samba to trust a Windows 2000 server, however, more testing is still needed in this area. +

    +After creating the interdomain trust account on the +Samba server as described above, open Active Directory Domains and +Trusts on the AD controller of the domain whose resources you wish Samba users +to have access to. Remember that since NT4-style trusts are not transitive, if you want +your users to have access to multiple mixed-mode domains in your AD forest, you will need to +repeat this process for each of those domains. With Active Directory Domains +and Trusts open, right-click on the name of the Active Directory domain that +will trust our Samba domain and choose Properties, then click on +the Trusts tab. In the upper part of the panel, you will see a list box +labelled Domains trusted by this domain:, and an +Add... button next to it. Press this button, and just as with NT4, you +will be prompted for the trusted domain name and the relationship password. Press OK, and +after a moment, Active Directory will respond with The trusted domain has +been added and the trust has been verified. Your Samba users can now be +granted acess to resources in the AD domain. +

    Common Errors

    Interdomain trust relationships should NOT be attempted on networks that are unstable or that suffer regular outages. Network stability and integrity are key concerns with distributed trusted domains. -

    Tell me about Trust Relationships using Samba

    - Like many, I administer multiple LANs connected together using NT trust - relationships. This was implemented about 4 years ago. I now have the - occasion to consider performing this same task again, but this time, I - would like to implement it solely through samba - no Microsoft PDCs - anywhere. -

    - I have read documentation on samba.org regarding NT-style trust - relationships and am now wondering, can I do what I want to? I already - have successfully implemented 2 samba servers, but they are not PDCs. - They merely act as file servers. I seem to remember, and it appears to - be true (according to samba.org) that trust relationships are a - challenge. -

    - Please provide any helpful feedback that you may have. -

    - These are almost complete in Samba 3.0 snapshots. The main catch - is getting winbindd to be able to allocate UID/GIDs for trusted - users/groups. See the updated Samba HOWTO collection for more - details. -

    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba

    Shirish Kalele

    Samba Team & Veritas Software


    +

    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba

    Shirish Kalele

    Samba Team & Veritas Software



    -

    12 Jul 2000

    Table of Contents

    Features and Benefits
    Common Errors

    Features and Benefits

    +

    12 Jul 2000

    Table of Contents

    Features and Benefits
    Common Errors

    Features and Benefits

    The Distributed File System (or DFS) provides a means of separating the logical view of files and directories that users see from the actual physical locations of these resources on the network. It allows for higher availability, smoother storage expansion, load balancing etc.

    - For information about DFS, refer to - - Microsoft documentation at http://www.microsoft.com/NTServer/nts/downloads/winfeatures/NTSDistrFile/AdminGuide.asp. + For information about DFS, refer to the +Microsoft documentation.

    - This document explains how to host a DFS tree on a Unix machine (for DFS-aware + This document explains how to host a DFS tree on a UNIX machine (for DFS-aware clients to browse) using Samba.

    - To enable SMB-based DFS for Samba, configure it with the --with-msdfs + To enable SMB-based DFS for Samba, configure it with the --with-msdfs option. Once built, a Samba server can be made a DFS server by setting the global - boolean host msdfs - parameter in the smb.conf file. You designate a share as a DFS - root using the share level boolean - msdfs root parameter. A DFS root directory on Samba hosts DFS + boolean host msdfs + parameter in the smb.conf file. You designate a share as a DFS + root using the share level boolean msdfs root parameter. A DFS root directory on Samba hosts DFS links in the form of symbolic links that point to other servers. For example, a symbolic link junction->msdfs:storage1\share1 in the share directory acts as the DFS junction. When DFS-aware clients attempt to access the junction link, @@ -5927,23 +5741,14 @@ distributed trusted domains. DFS trees on Samba work with all DFS-aware clients ranging from Windows 95 to 200x.

    Here's an example of setting up a DFS tree on a Samba server. - 

    -# The smb.conf file:
-[global]
-	netbios name = SMOKEY
-	host msdfs   = yes
-
-[dfs]
-	path = /export/dfsroot
-	msdfs root = yes
-

    In the /export/dfsroot directory we set up our dfs links to +

    Example 17.1. smb.conf with DFS configured

    [global]
    netbios name = GANDALF
    host msdfs = yes
    [dfs]
    path = /export/dfsroot
    msdfs root = yes

    In the /export/dfsroot directory we set up our DFS links to other servers on the network.

    -	root# cd /export/dfsroot
-	root# chown root /export/dfsroot
-	root# chmod 755 /export/dfsroot
-	root# ln -s msdfs:storageA\\shareA linka
-	root# ln -s msdfs:serverB\\share,serverC\\share linkb
-

    You should set up the permissions and ownership of +root# cd /export/dfsroot +root# chown root /export/dfsroot +root# chmod 755 /export/dfsroot +root# ln -s msdfs:storageA\\shareA linka +root# ln -s msdfs:serverB\\share,serverC\\share linkb +

    You should set up the permissions and ownership of the directory acting as the DFS root such that only designated users can create, delete or modify the msdfs links. Also note that symlink names should be all lowercase. This limitation exists @@ -5952,22 +5757,21 @@ distributed trusted domains. network shares you want, and start Samba.

    Users on DFS-aware clients can now browse the DFS tree on the Samba server at \\samba\dfs. Accessing links linka or linkb (which appear as directories to the client) - takes users directly to the appropriate shares on the network.

    Common Errors

    • Windows clients need to be rebooted - if a previously mounted non-dfs share is made a dfs + takes users directly to the appropriate shares on the network.

    Common Errors

    • Windows clients need to be rebooted + if a previously mounted non-dfs share is made a DFS root or vice versa. A better way is to introduce a - new share and make it the dfs root.

    • Currently there's a restriction that msdfs + new share and make it the DFS root.

    • Currently there's a restriction that msdfs symlink names should all be lowercase.

    • For security purposes, the directory acting as the root of the DFS tree should have ownership and permissions set so that only designated users can - modify the symbolic links in the directory.

    Chapter 18. Classical Printing Support

    Kurt Pfeifle

    Danka Deutschland GmbH

    Gerald (Jerry) Carter

    Samba Team

    May 32, 2003

    Table of Contents

    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    Parameters for Backwards Compatibility
    Parameters no longer in use
    A simple Configuration to Print with Samba-3
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print with Samba-3
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various Unix Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba-3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with -rpcclient
    "The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure)
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a -different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba-3
    Publishing Printer Information in Active Directory or LDAP
    Common Errors and Problems
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost

    Features and Benefits

    + modify the symbolic links in the directory.

    Chapter 18. Classical Printing Support

    Kurt Pfeifle

    Danka Deutschland GmbH

    Gerald (Jerry) Carter

    Samba Team

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    A simple Configuration to Print
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various UNIX Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba 3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with +rpcclient
    Client Driver Install Procedure
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a +different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost

    Features and Benefits

    Printing is often a mission-critical service for the users. Samba can provide this service reliably and seamlessly for a client network consisting of Windows workstations.

    -A Samba-3.0 print service may be run on a Standalone or a Domain +A Samba print service may be run on a Standalone or a Domain member server, side by side with file serving functions, or on a dedicated print server. It can be made as tight or as loosely secured as needs dictate. Configurations may be simple or complex. Available @@ -5975,10 +5779,10 @@ authentication schemes are essentially the same as described for file services in previous chapters. Overall, Samba's printing support is now able to replace an NT or Windows 2000 print server full-square, with additional benefits in many cases. Clients may download and -install drivers and printers through their familiar "Point'n'Print" -mechanism. Printer installations executed by "Logon Scripts" are no +install drivers and printers through their familiar "Point'n'Print" +mechanism. Printer installations executed by "Logon Scripts" are no problem. Administrators can upload and manage drivers to be used by -clients through the familiar "Add Printer Wizard". As an additional +clients through the familiar "Add Printer Wizard". As an additional benefit, driver and printer management may be run from the command line or through scripts, making it more efficient in case of large numbers of printers. If a central accounting of print jobs (tracking every @@ -5991,24 +5795,24 @@ implemented by the more traditional UNIX (BSD- and System V-style) printing systems. Many things apply to CUPS, the newer Common UNIX Printing System, too; so if you use CUPS, you might be tempted to jump to the next chapter -- but you will certainly miss a few things if you -do so. Better read this chapter too. +do so. Better to read this chapter too.

    Note

    Most of the given examples have been verified on Windows XP Professional clients. Where this document describes the responses to commands given, bear in mind that Windows 2000 clients are very similar, but may differ in details. Windows NT is somewhat different again. -

    Technical Introduction

    +

    Technical Introduction

    Samba's printing support always relies on the installed print -subsystem of the Unix OS it runs on. Samba is a "middleman". It takes +subsystem of the UNIX OS it runs on. Samba is a "middleman". It takes printfiles from Windows (or other SMB) clients and passes them to the real printing system for further processing. Therefore it needs to -"talk" to two sides: to the Windows print clients and to the Unix +"talk" to two sides: to the Windows print clients and to the UNIX printing system. Hence we must differentiate between the various client OS types each of which behave differently, as well as the various UNIX print subsystems, which themselves have different features and are accessed differently. This part of the Samba HOWTO -Collection deals with the "traditional" way of Unix printing first; +Collection deals with the "traditional" way of UNIX printing first; the next chapter covers in great detail the more modern Common UNIX Printing System (CUPS). @@ -6016,113 +5820,104 @@ the next chapter covers in great detail the more modern

    Important

    CUPS users, be warned: don't just jump on to the next chapter. You might miss important information contained only here!

    -

    What happens if you send a Job from a Client

    +

    What happens if you send a Job from a Client

    To successfully print a job from a Windows client via a Samba print server to a UNIX printer, there are 6 (potentially 7) stages: -

    1. Windows opens a connection to the printershare

    2. Samba must authenticate the user

    3. Windows sends a copy of the printfile over the network +

      1. Windows opens a connection to the printer share

      2. Samba must authenticate the user

      3. Windows sends a copy of the printfile over the network into Samba's spooling area

      4. Windows closes the connection again

      5. Samba invokes the print command to hand the file over -to the UNIX print subsystem's spooling area

      6. The Unix print subsystem processes the print +to the UNIX print subsystem's spooling area

      7. The UNIX print subsystem processes the print job

      8. The printfile may need to be explicitly deleted -from the Samba spooling area.

    Printing Related Configuration Parameters

    +from the Samba spooling area.

    Printing Related Configuration Parameters

    There are a number of configuration parameters in controlling Samba's printing behaviour. Please also refer to the man page for smb.conf to acquire an overview about these. As with other parameters, there are -Global Level (tagged with a "G" in the listings) and -Service Level ("S") parameters. +Global Level (tagged with a "G" in the listings) and +Service Level ("S") parameters.

    Service Level Parameters

    These may go into the -[global] section of -. In this case they define the default +[global] section of smb.conf. +In this case they define the default behaviour of all individual or service level shares (provided those don't have a different setting defined for the same parameter, thus overriding the global default).

    Global Parameters

    These may not go into individual -shares. If they go in by error, the "testparm" utility can discover -this (if you run it) and tell you so.

    Parameters Recommended for Use

    The following smb.conf parameters directly -related to printing are used in Samba-3. See also the +shares. If they go in by error, the "testparm" utility can discover +this (if you run it) and tell you so.

    Parameters Recommended for Use

    The following smb.conf parameters directly +related to printing are used in Samba. See also the smb.conf man page for detailed explanations: -

    List of printing related parameters in Samba-3.  -

    Global level parameters:

    • addprinter command (G)

    • deleteprinter command (G)

    • disable spoolss (G)

    • enumports command (G)

    • load printers (G)

    • lpq cache time (G)

    • os2 driver map (G)

    • printcap name (G), printcap (G)

    • show add printer wizard (G)

    • total print jobs (G)

    • use client driver (G)

    - -

    Service level parameters:

    • hosts allow (S)

    • hosts deny (S)

    • lppause command (S)

    • lpq command (S)

    • lpresume command (S)

    • lprm command (S)

    • max print jobs (S)

    • min print space (S)

    • print command (S)

    • printable (S), print ok (S)

    • printer name (S), printer (S)

    • printer admin (S)

    • printing = [cups|bsd|lprng...] (S)

    • queuepause command (S)

    • queueresume command (S)

    • total print jobs (S)

    +

    Global level parameters: addprinter command, +deleteprinter command, +disable spoolss, +enumports command, +load printers, +lpq cache time, +os2 driver map, +printcap name, printcap, +show add printer wizard, +total print jobs, +use client driver. +

    Service level parameters: hosts allow, +hosts deny, +lppause command, +lpq command, +lpresume command, +lprm command, +max print jobs, +min print space, +print command, +printable, print ok , +printer name, printer, +printer admin, +printing = [cups|bsd|lprng...], +queuepause command, +queueresume command, +total print jobs.

    Samba's printing support implements the Microsoft Remote Procedure Calls (MS-RPC) methods for printing. These are used by Windows NT (and -later) print servers. The old "LanMan" protocol is still supported as +later) print servers. The old "LanMan" protocol is still supported as a fallback resort, and for older clients to use. More details will follow further beneath. -

    Parameters for Backwards Compatibility

    -Two new parameters that were added in Samba 2.2.2, are still present -in Samba-3.0. Both of these options are described in the -smb.conf man page and are disabled by -default. Use them with caution! -

    disable spoolss(G)

    This is -provided for better support of Samba 2.0.x backwards capability. It -will disable Samba's support for MS-RPC printing and yield identical -printing behaviour to Samba 2.0.x.

    use client driver (G)

    was provided -for using local printer drivers on Windows NT/2000 clients. It does -not apply to Windows 95/98/ME clients.

    Parameters "for backward compatibility only", use with caution.  -

    • disable spoolss (G)

    • use client driver (S)

    -

    Parameters no longer in use

    -Samba users upgrading from 2.2.x to 3.0 need to be aware that some -previously available settings are no longer supported (as was -announced some time ago). Here is a list of them: -

    "old" parameters, removed in Samba-3.  -The following smb.conf parameters have been -deprecated already in Samba 2.2 and are now completely removed from -Samba-3. You cannot use them in new 3.0 installations: - -

    • printer driver file (G)

    • total print jobs (G)

    • postscript (S)

    • printer driver (S)

    • printer driver location (S)

    -

    A simple Configuration to Print with Samba-3

    +

    A simple Configuration to Print

    Here is a very simple example configuration for print related settings -in the file. If you compare it with your -own system's , you probably find some +in the file. If you compare it with your own system's , you probably find some additional parameters included there (as pre-configured by your OS vendor). Further below is a discussion and explanation of the parameters. Note, that this example doesn't use many parameters. However, in many environments these are enough to provide a valid - which enables all clients to print. -

    - [global]
-         printing = bsd
-         load printers = yes
-
- [printers]
-         path = /var/spool/samba
-         printable = yes
-         public = yes
-         writable = no
-

    -This is only an example configuration. Many settings, if not -explicitly set to a specific value, are used and set by Samba -implicitly to its own default, because these have been compiled in. -To see all settings, let root use the testparm -utility. testparm also gives warnings if you have -mis-configured certain things. Its complete output is easily 340 lines -and more. You may want to pipe it through a pager program. +smb.conf file which enables all clients to print. +

    Example 18.1. Simple configuration with BSD printing

    [global]
    printing = bsd
    load printers = yes
    [printers]
    path = /var/spool/samba
    printable = yes
    public = yes
    writable = no

    +This is only an example configuration. Samba assigns default values to all +configuration parameters. On the whole the defaults are conservative and +sensible. When a parameter is specified in the smb.conf file this overwrites +the default value. The testparm utility when run as root +is capable of reporting all setting, both default as well as smb.conf file +settings. Testparm gives warnings for all mis-configured +settings. The complete output is easily 340 lines and more, so you may want +to pipe it through a pager program.

    The syntax for the configuration file is easy to grasp. You should know that is not very picky about its syntax. It has been explained elsewhere in this document. A short -reminder: It even tolerates some spelling errors (like "browsable" -instead of "browseable"). Most spelling is case-insensitive. Also, you -can use "Yes|No" or "True|False" for boolean settings. Lists of names +reminder: It even tolerates some spelling errors (like "browsable" +instead of "browseable"). Most spelling is case-insensitive. Also, you +can use "Yes|No" or "True|False" for boolean settings. Lists of names may be separated by commas, spaces or tabs. -

    Verification of "Settings in Use" with testparm

    +

    Verification of "Settings in Use" with testparm

    To see all (or at least most) printing related settings in Samba, including the implicitly used ones, try the command outlined below -(hit "ENTER" twice!). It greps for all occurrences of "lp", "print", -"spool", "driver", "ports" and "[" in testparm's output and gives you +(hit "ENTER" twice!). It greps for all occurrences of "lp", "print", +"spool", "driver", "ports" and "[" in testparm's output and gives you a nice overview about the running smbd's print configuration. (Note that this command does not show individually created printer shares, or the spooling paths in each case). Here is the output of my Samba setup, with exactly the same settings in as shown above: 

    -root# testparm -v | egrep "(lp|print|spool|driver|ports|\[)"
+root# testparm -v | egrep "(lp|print|spool|driver|ports|\[)"
  Load smb config files from /etc/samba/smb.conf.simpleprinting
- Processing section "[homes]"
- Processing section "[printers]"
+ Processing section "[homes]"
+ Processing section "[printers]"
  
  [global]
         smb ports = 445 139
@@ -6159,21 +5954,21 @@ as shown above:
 You can easily verify which settings were implicitly added by Samba's
 default behaviour. Don't forget about this point: it may
 be important in your future dealings with Samba.
-
    Note
     testparm in Samba-3.0 behaves differently from 2.2.x: used
-without the "-v" switch it only shows you the settings actually
+
    Note
     testparm in samba 3 behaves differently from 2.2.x: used
+without the "-v" switch it only shows you the settings actually
 written into ! To see the complete
-configuration used, add the "-v" parameter to testparm.
    A little Experiment to warn you
    
+configuration used, add the "-v" parameter to testparm.

    A little Experiment to warn you

    Should you need to troubleshoot at any stage, please always come back -to this point first and verify if "testparm" shows the parameters you +to this point first and verify if "testparm" shows the parameters you expect! To give you an example from personal experience as a warning, -try to just "comment out" the load printers" +try to just "comment out" the load printers" parameter. If your 2.2.x system behaves like mine, you'll see this: 

    -root# grep "load printers" /etc/samba/smb.conf
+root# grep "load printers" /etc/samba/smb.conf
  #      load printers = Yes
-        # This setting is commented ooouuuuut!!
-
-root# testparm -v /etc/samba/smb.conf | egrep "(load printers)"
+ # This setting is commented ooouuuuut!!
+ 
+root# testparm -v /etc/samba/smb.conf | egrep "(load printers)"
         load printers = Yes

    @@ -6182,20 +5977,20 @@ prevent Samba from publishing my printers, it still did! Oh Boy -- it cost me quite some time to find out the reason. But I am not fooled any more... at least not by this ;-) 

    -root# grep -A1 "load printers" /etc/samba/smb.conf
+root# grep -A1 "load printers" /etc/samba/smb.conf
         load printers = No
         # This setting is what I mean!!
  #      load printers = Yes
         # This setting is commented ooouuuuut!!
 
-root# testparm -v smb.conf.simpleprinting | egrep "(load printers)"
+root# testparm -v smb.conf.simpleprinting | egrep "(load printers)"
         load printers = No

    Only when setting the parameter explicitly to -"load printers = No" +"load printers = No" would Samba recognize my intentions. So my strong advice is: -

    • Never rely on "commented out" parameters!

    • Always set it up explicitly as you intend it to +

      • Never rely on "commented out" parameters!

      • Always set it up explicitly as you intend it to behave.

      • Use testparm to uncover hidden settings which might not reflect your intentions.

      You can have a working Samba print configuration with this @@ -6219,8 +6014,8 @@ ask testparm what the Samba print configuration would be, if you used this minimalistic file as your real : 

      -root#  testparm -v /etc/samba/smb.conf-minimal | egrep "(print|lpq|spool|driver|ports|[)"
- Processing section "[printers]"
+root# testparm -v smb.conf-minimal | egrep "(print|lpq|spool|driver|ports|[)"
+ Processing section "[printers]"
  WARNING: [printers] service MUST be printable!
  No path in service printers - using /tmp
 
@@ -6252,8 +6047,8 @@ testparm issued 2 warnings:
 [printers] section as printable,
 and

    • because we didn't tell it which spool directory to use.

    -However, this was not fatal, and Samba-3.0 will default to values that -will work here. But, please!, don't rely on this and don't use this +However, this was not fatal, and samba will default to values that +will work here. Please, don't rely on this and don't use this example! This was only meant to make you careful to design and specify your setup to be what you really want it to be. The outcome on your system may vary for some parameters, since you may have a Samba built @@ -6265,61 +6060,20 @@ comment sign at the front). At first I regarded this as a bug in my Samba version(s). But the man page states: “Internal whitespace in a parameter value is retained verbatim.” This means that a line consisting of, for example, -

    -printing = lprng     #This defines LPRng as the printing system"
-

    -will regard the whole of the string after the "=" +

    # This defines LPRng as the printing system"
    printing = lprng

    +will regard the whole of the string after the "=" sign as the value you want to define. And this is an invalid value that will be ignored, and a default value used instead.] -

    Extended Sample Configuration to Print with Samba-3

    -Here we show a more verbose example configuration for print related -settings in an . Below is a discussion +

    Extended Sample Configuration to Print

    + In the extended BSD configuration example we show a more verbose example configuration for print related + settings in BSD-printing style environment . Below is a discussion and explanation of the various parameters. We chose to use BSD-style printing here, because we guess it is still the most commonly used system on legacy Linux installations (new installs now predominantly have CUPS, which is discussed entirely in the next chapter of this document). Note, that this example explicitly names many parameters -which don't need to be stated because they are set by default. You -might be able to do with a leaner .

    Tip

    -if you read access it with the Samba Web Administration Tool (SWAT), -and then write it to disk again, it will be optimized in a way such -that it doesn't contain any superfluous parameters and comments. SWAT -organizes the file for best performance. Remember that each smbd -re-reads the Samba configuration once a minute, and that each -connection spawns an smbd process of its own, so it is not a bad idea -to optimize the in environments with -hundreds or thousands of clients.

    - [global]
-         printing = bsd
-         load printers = yes
-         show add printer wizard = yes
-         printcap name = /etc/printcap
-         printer admin = @ntadmin, root
-         total print jobs = 100
-         lpq cache time = 20
-         use client driver = no
-
- [printers]
-         comment = All Printers
-         printable = yes
-         path = /var/spool/samba
-         browseable = no
-         guest ok = yes
-         public = yes
-         read only = yes
-         writable = no       
-
- [my_printer_name]
-         comment = Printer with Restricted Access
-         path = /var/spool/samba_my_printer
-         printer admin = kurt
-         browseable = yes
-         printable = yes
-         writeable = no
-         hosts allow = 0.0.0.0
-         hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60
-         guest ok = no
-

    +which don't need to be specified because they are set by default. You +might be able to do with a leaner smb.conf file.

    Example 18.2. Extended configuration with BSD printing

    [global]
    printing = bsd
    load printers = yes
    show add printer wizard = yes
    printcap name = /etc/printcap
    printer admin = @ntadmin, root
    total print jobs = 100
    lpq cache time = 20
    use client driver = no
    [printers]
    comment = All Printers
    printable = yes
    path = /var/spool/samba
    browseable = no
    guest ok = yes
    public = yes
    read only = yes
    writable = no
    [my_printer_name]
    comment = Printer with Restricted Access
    path = /var/spool/samba_my_printer
    printer admin = kurt
    browseable = yes
    printable = yes
    writeable = no
    hosts allow = 0.0.0.0
    hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60
    guest ok = no

    This also is only an example configuration. You may not find all the settings in your own (as pre-configured by your OS @@ -6329,32 +6083,32 @@ default, because these have been compiled in. To see all settings, let root use the testparm utility. testparm also gives warnings if you have mis-configured certain things.. -

    Detailed Explanation of the Example's Settings

    +

    Detailed Explanation of the Example's Settings

    Following is a discussion of the settings from above shown example. -

    The [global] Section

    +

    The [global] Section

    The [global] section is one of 4 special sections (along with [[homes], [printers] and [print$]...) It contains all parameters which apply to the server as a whole. It is the place for parameters which -have only a "global" meaning (G). It may also contain service level -parameters (S) which then define default settings for all other +have only a "global" meaning. It may also contain service level +parameters which then define default settings for all other sections and shares. This way you can simplify the configuration and avoid setting the same value repeatedly. (Within each individual -section or share you may however override these globally set "share -level" settings and specify other values). -

    printing = bsd

    this causes Samba to use default print commands +section or share you may however override these globally set "share +level" settings and specify other values). +

    printing = bsd

    this causes Samba to use default print commands applicable for the BSD (a.k.a. RFC 1179 style or LPR/LPD) printing -system. In general, the "printing" parameter informs Samba about the +system. In general, the "printing" parameter informs Samba about the print subsystem it should expect. Samba supports CUPS, LPD, LPRNG, SYSV, HPUX, AIX, QNX and PLP. Each of these systems defaults to a -different print command (and other queue control -commands).

    Caution

    The printing parameter is +different print command (and other queue control +commands).

    Caution

    The printing parameter is normally a service level parameter. Since it is included here in the [global] section, it will take effect for all -printer shares that are not defined differently. Samba-3.0 no longer -supports the SOFTQ printing system.

    load printers = yes

    this tells Samba to create automatically all -available printer shares. "Available" printer shares are discovered by +printer shares that are not defined differently. Samba 3 no longer +supports the SOFTQ printing system.

    load printers = yes

    this tells Samba to create automatically all +available printer shares. "Available" printer shares are discovered by scanning the printcap file. All created printer shares are also loaded for browsing. If you use this parameter, you do not need to specify separate shares for each printer. Each automatically created printer @@ -6362,8 +6116,7 @@ share will clone the configuration options found in the [printers] section. (A load printers = no setting will allow you to specify each UNIX printer you want to share separately, leaving out some you don't want to be -publicly visible and available).

    show add printer wizard = -yes

    this setting is normally +publicly visible and available).

    show add printer wizard = yes

    this setting is normally enabled by default (even if the parameter is not written into the ). It makes the Add Printer Wizard icon show up in the Printers folder of the Samba host's @@ -6374,38 +6127,38 @@ will not suffice!). The Add Printer Wizard lets you upload printer drivers to the [print$] share and associate it with a printer (if the respective queue exists there before the action), or exchange a printer's driver against any other previously -uploaded driver.

    total print jobs = 100

    this setting sets the upper limit to 100 print jobs +uploaded driver.

    total print jobs = 100

    this setting sets the upper limit to 100 print jobs being active on the Samba server at any one time. Should a client submit a job which exceeds this number, a “no more space available on server” type of error message will be returned by -Samba to the client. A setting of "0" (the default) means there is +Samba to the client. A setting of "0" (the default) means there is no limit at all! -

    printcap name = /etc/printcap

    this tells Samba where to look for a list of +

    printcap name = /etc/printcap

    this tells Samba where to look for a list of available printer names. (If you use CUPS, make sure that a printcap -file is written: this is controlled by the "Printcap" directive of +file is written: this is controlled by the "Printcap" directive of cupsd.conf). -

    printer admin = @ntadmin

    members of the ntadmin group should be able to add -drivers and set printer properties ("ntadmin" is only an example name, +

    printer admin = @ntadmin

    members of the ntadmin group should be able to add +drivers and set printer properties ("ntadmin" is only an example name, it needs to be a valid UNIX group name); root is implicitly always a -printer admin. The "@" sign precedes group names in +printer admin. The "@" sign precedes group names in . A printer admin can do anything to printers via the remote administration interfaces offered by MS-RPC -(see below). Note that the printer admin +(see below). Note that the printer admin parameter is normally a share level parameter, so you may associate different groups to different printer shares in larger installations, -if you use the printer admin parameter on the +if you use the printer admin parameter on the share levels). -

    lpq cache time = 20

    this controls the cache time for the results of the +

    lpq cache time = 20

    this controls the cache time for the results of the lpq command. It prevents the lpq command being called too often and reduces load on a heavily used print server. -

    use client driver = no

    if set to yes, this setting only +

    use client driver = no

    if set to yes, this setting only takes effect for Win NT/2k/XP clients (and not for Win 95/98/ME). Its default value is No (or False). It must not be enabled on print shares (with a yes or true setting) which have valid drivers installed on the Samba server! For more detailed explanations see the man page of smb.conf. -

    The [printers] Section

    +

    The [printers] Section

    This is the second special section. If a section with this name appears in the smb.conf, users are able to connect to any printer specified in the Samba host's printcap file, @@ -6415,59 +6168,58 @@ section as a general convenience shortcut to share all printers with minimal configuration. It is also a container for settings which should apply as default to all printers. (For more details see the smb.conf man page.) Settings inside this -container must be share level parameters (S). -

    comment = All printers

    the comment is shown next to +container must be share level parameters. +

    comment = All printers

    the comment is shown next to the share if a client queries the server, either via Network Neighbourhood or with the net view command to list available shares. -

    printable = yes

    please note well, that the +

    printable = yes

    please note well, that the [printers] service must be declared as printable. If you specify otherwise, smbd will refuse to load at startup. This parameter allows connected clients to open, write to and submit spool files into the -directory specified with the path parameter for +directory specified with the path parameter for this service. It is used by Samba to differentiate printer shares from -file shares.

    path = /var/spool/samba

    this must point to a directory used by Samba to spool +file shares.

    path = /var/spool/samba

    this must point to a directory used by Samba to spool incoming print files. It must not be the same as the spool directory specified in the configuration of your UNIX print subsystem! The path would typically point to a directory -which is world writeable, with the "sticky" bit set to it. -

    browseable = no

    this is always set to no if -printable = yes. It makes the +which is world writeable, with the "sticky" bit set to it. +

    browseable = no

    this is always set to no if +printable = yes. It makes the [printer] share itself invisible in the list of available shares in a net view command or in the Explorer browse list. (Note that you will of course see the individual printers). -

    guest ok = yes

    +

    guest ok = yes

    if set to yes, then no password is required to connect to the printers service. Access will be granted with the -privileges of the guest account. On many systems the -guest account will map to a user named "nobody". This user is in the UNIX +privileges of the guest account. On many systems the +guest account will map to a user named "nobody". This user is in the UNIX passwd file with an empty password, but with no valid UNIX login. (Note: on some systems the guest account might not have the privilege to be able to print. Test this by logging in as your guest user using su - guest and run a system print command like -

    lpr -P printername /etc/motd

    public = yes

    this is a synonym for guest ok = -yes. Since we have guest ok = yes, +

    lpr -P printername /etc/motd

    public = yes

    this is a synonym for guest ok = yes. Since we have guest ok = yes, it really doesn't need to be here! (This leads to the interesting question: “What, if I by accident have to contradictory settings for the same share?” The answer is: the last one encountered by -Samba wins. The "winner" is shown by testparm. Testparm doesn't +Samba wins. The "winner" is shown by testparm. Testparm doesn't complain about different settings of the same parameter for the same -share! You can test this by setting up multiple lines for the "guest -account" parameter with different usernames, and then run testparm to +share! You can test this by setting up multiple lines for the "guest +account" parameter with different usernames, and then run testparm to see which one is actually used by Samba.) -

    read only = yes

    this normally (for other types of shares) prevents +

    read only = yes

    this normally (for other types of shares) prevents users creating or modifying files in the service's directory. However, -in a "printable" service, it is always allowed to +in a "printable" service, it is always allowed to write to the directory (if user privileges allow the connection), but -only via print spooling operations. "Normal" write operations are not -allowed.

    writeable = no

    -synonym for read only = yes -

    Any [my_printer_name] Section

    +only via print spooling operations. "Normal" write operations are not +allowed.

    writeable = no

    +synonym for read only = yes +

    Any [my_printer_name] Section

    If a section appears in the , which is -tagged as printable = yes, Samba presents it as +tagged as printable = yes, Samba presents it as a printer share to its clients. Note, that Win95/98/ME clients may have problems with connecting or loading printer drivers if the share name has more than 8 characters! Also be very careful if you give a @@ -6476,66 +6228,65 @@ client's connection request to a certain sharename, Samba always tries to find file shares with that name first; if it finds one, it will connect to this and will never ultimately connect to a printer with the same name! -

    comment = Printer with Restricted Access

    the comment says it all. -

    path = /var/spool/samba_my_printer

    here we set the spooling area for this printer to +

    comment = Printer with Restricted Access

    the comment says it all. +

    path = /var/spool/samba_my_printer

    here we set the spooling area for this printer to another directory than the default. It is not a requirement to set it differently, but the option is available. -

    printer admin = kurt

    the printer admin definition is different for this +

    printer admin = kurt

    the printer admin definition is different for this explicitly defined printer share from the general [printers] share. It is not a requirement; we did it to show that it is possible if you want it. -

    browseable = yes

    we also made this printer browseable (so that the +

    browseable = yes

    we also made this printer browseable (so that the clients may conveniently find it when browsing the Network Neighbourhood). -

    printable = yes

    see explanation in last subsection. -

    writeable = no

    see explanation in last subsection. -

    hosts allow = 10.160.50.,10.160.51.

    here we exercise a certain degree of access control -by using the hosts allow and hosts deny parameters. Note, that +

    printable = yes

    see explanation in last subsection. +

    writeable = no

    see explanation in last subsection. +

    hosts allow = 10.160.50.,10.160.51.

    here we exercise a certain degree of access control +by using the hosts allow and hosts deny parameters. Note, that this is not by any means a safe bet. It is not a way to secure your printers. This line accepts all clients from a certain subnet in a first evaluation of access control -

    hosts deny = turbo_xp,10.160.50.23,10.160.51.60 -

    all listed hosts are not allowed here (even if they -belong to the "allowed subnets"). As you can see, you could name IP +

    hosts deny = turbo_xp,10.160.50.23,10.160.51.60

    all listed hosts are not allowed here (even if they +belong to the "allowed subnets"). As you can see, you could name IP addresses as well as NetBIOS hostnames here. -

    guest ok = no

    this printer is not open for the guest account! -

    Print Commands

    +

    guest ok = no

    this printer is not open for the guest account! +

    Print Commands

    In each section defining a printer (or in the [printers] section), a print command parameter may be defined. It sets a command to process the files which have been placed into the Samba print spool directory for that printer. (That spool directory was, if you -remember, set up with the path +remember, set up with the path parameter). Typically, this command will submit the spool file to the Samba host's print subsystem, using the suitable system print command. But there is no requirement that this needs to be the case. For debugging purposes or some other reason you may want to do -something completely different than "print" the file. An example is a +something completely different than "print" the file. An example is a command that just copies the print file to a temporary location for further investigation when you need to debug printing. If you craft your own print commands (or even develop print command shell scripts), make sure you pay attention to the need to remove the files from the Samba spool directory. Otherwise your hard disk may soon suffer from shortage of free space. -

    Default Print Commands for various Unix Print Subsystems

    +

    Default Print Commands for various UNIX Print Subsystems

    You learned earlier on, that Samba in most cases uses its built-in settings for many parameters if it can not find an explicitly stated one in its configuration file. The same is true for the -print command. The default print command varies -depending on the printing =... parameter +print command. The default print command varies +depending on the printing parameter setting. In the commands listed below, you will notice some parameters of the form %X where X is p, s, J etc. These letters stand for -"printername", "spoolfile" and "job ID" respectively. They are +"printername", "spoolfile" and "job ID" respectively. They are explained in more detail further below. Here is an overview (excluding the special case of CUPS, which is discussed in the next chapter): -

    If this setting is active......this is used in lieu of an explicit command:
    printing = bsd|aix|lprng|plpprint command is lpr -r -P%p %s
    printing = sysv|hpuxprint command is lp -c -P%p %s; rm %s
    printing = qnxprint command is lp -r -P%p -s %s
    printing = bsd|aix|lprng|plplpq command is lpq -P%p
    printing = sysv|hpuxlpq command is lpstat -o%p
    printing = qnxlpq command is lpq -P%p
    printing = bsd|aix|lprng|plplprm command is lprm -P%p %j
    printing = sysv|hpuxlprm command is cancel %p-%j
    printing = qnxlprm command is cancel %p-%j
    printing = bsd|aix|lprng|plplppause command is lp -i %p-%j -H hold
    printing = sysv|hpuxlppause command (...is empty)
    printing = qnxlppause command (...is empty)
    printing = bsd|aix|lprng|plplpresume command is lp -i %p-%j -H resume
    printing = sysv|hpuxlpresume command (...is empty)
    printing = qnxlpresume command (...is empty)

    +

    If this setting is active......this is used in lieu of an explicit command:
    printing = bsd|aix|lprng|plpprint command is lpr -r -P%p %s
    printing = sysv|hpuxprint command is lp -c -P%p %s; rm %s
    printing = qnxprint command is lp -r -P%p -s %s
    printing = bsd|aix|lprng|plplpq command is lpq -P%p
    printing = sysv|hpuxlpq command is lpstat -o%p
    printing = qnxlpq command is lpq -P%p
    printing = bsd|aix|lprng|plplprm command is lprm -P%p %j
    printing = sysv|hpuxlprm command is cancel %p-%j
    printing = qnxlprm command is cancel %p-%j
    printing = bsd|aix|lprng|plplppause command is lp -i %p-%j -H hold
    printing = sysv|hpuxlppause command (...is empty)
    printing = qnxlppause command (...is empty)
    printing = bsd|aix|lprng|plplpresume command is lp -i %p-%j -H resume
    printing = sysv|hpuxlpresume command (...is empty)
    printing = qnxlpresume command (...is empty)

    We excluded the special CUPS case here, because it is discussed in the next chapter. Just a short summary. For printing = CUPS: If SAMBA is compiled against libcups, it uses the CUPS API to submit jobs, etc. (It is a good idea also to set -printcap = cups in case your +printcap = cups in case your cupsd.conf is set to write its autogenerated printcap file to an unusual place). Otherwise Samba maps to the System V printing commands with the -oraw option for printing, i.e. it uses @@ -6546,7 +6297,7 @@ manually set print command will be ignored! Having listed the above mappings here, you should note that there used to be a bug in recent 2.2.x versions which prevented the mapping from taking effect. It lead to the -"bsd|aix|lprng|plp" settings taking effect for all other systems, for +"bsd|aix|lprng|plp" settings taking effect for all other systems, for the most important commands (the print command, the lpq command and the lprm command). The lppause command and the @@ -6558,9 +6309,9 @@ check which command takes effect. Then check that this command is adequate and actually works for your installed print subsystem. It is always a good idea to explicitly set up your configuration files the way you want them to work and not rely on any built-in defaults. -

    Setting up your own Print Commands

    +

    Setting up your own Print Commands

    After a print job has finished spooling to a service, the -print command will be used by Samba via a +print command will be used by Samba via a system() call to process the spool file. Usually the command specified will submit the spool file to the host's printing subsystem. But there is no requirement at all that this must @@ -6571,7 +6322,7 @@ processed.

    There is no difficulty with using your own customized print commands with the traditional printing systems. However, if you don't wish to -"roll your own", you should be well informed about the default +"roll your own", you should be well informed about the default built-in commands that Samba uses for each printing subsystem (see the table above). In all the commands listed in the last paragraphs you see parameters of the form %X These are @@ -6601,7 +6352,7 @@ spool files will be created but not processed! And (most importantly): print files will not be removed, so they will start filling your Samba hard disk.

    -Note that printing may fail on some UNIXes from the "nobody" +Note that printing may fail on some UNIXes from the "nobody" account. If this happens, create an alternative guest account and supply it with the privilege to print. Set up this guest account in the [global] section with the guest @@ -6613,22 +6364,16 @@ expand the included environment variables as usual. (The syntax to include a UNIX environment variable $variable in or in the Samba print command is %$variable.) To give you a working -print command example, the following will log a +print command example, the following will log a print job to /tmp/print.log, print the file, then remove it. Note that ';' is the usual separator for commands in shell scripts: -

    -
- print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s
-
-

    +

    print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s

    You may have to vary your own command considerably from this example depending on how you normally print files on your system. The default -for the print command parameter varies depending on the setting of -the printing parameter. Another example is: -

    - print command = /usr/local/samba/bin/myprintscript %p %s
-

    Innovations in Samba Printing since 2.2

    +for the print command parameter varies depending on the setting of +the printing parameter. Another example is: +

    print command = /usr/local/samba/bin/myprintscript %p %s

    Innovations in Samba Printing since 2.2

    Before version 2.2.0, Samba's print server support for Windows clients was limited to the level of LanMan printing calls. This is the same protocol level as Windows 9x PCs offer when @@ -6643,16 +6388,14 @@ The additional functionality provided by the new SPOOLSS support includes: 95/98/NT/2000 clients upon demand (Point'n'Print);

  • Uploading of printer drivers via the Windows NT Add Printer Wizard (APW) or the -Imprints tool set (refer to http://imprints.sourceforge.net); +Imprints tool set.

  • Support for the native MS-RPC printing calls such as -StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation -at http://msdn.microsoft.com/ -for more information on the Win32 printing API);

  • Support for NT Access Control + StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation for more information on the Win32 printing API);

  • Support for NT Access Control Lists (ACL) on printer objects;

  • Improved support for printer queue manipulation through the use of internal databases for spooled job information (implemented by various *.tdb files).

    • -One other benefit of an update is this: Samba-3 is able to publish +One other benefit of an update is this: Samba 3 is able to publish all its printers in Active Directory (or LDAP)!

    One slight difference is here: it is possible on a Windows NT print @@ -6666,10 +6409,10 @@ rather they can print directly to any printer on another Windows NT host using MS-RPC. This of course assumes that the printing client has the necessary privileges on the remote host serving the printer. The default permissions assigned by Windows NT to a printer gives the -"Print" permissions to the well-known Everyone -group. (The older clients of type Win9x can only print to "shared" +"Print" permissions to the well-known Everyone +group. (The older clients of type Win9x can only print to "shared" printers). -

    Client Drivers on Samba Server for Point'n'Print

    +

    Client Drivers on Samba Server for Point'n'Print

    There is still confusion about what all this means: Is it or is it not a requirement for printer drivers to be installed on a Samba host in order to support printing from Windows clients? The @@ -6702,12 +6445,12 @@ etc.).

    Please take additional note of the following fact: Samba does not use these uploaded drivers in any way to process spooled files. Drivers are utilized entirely by the clients, who -download and install them via the "Point'n'Print" mechanism supported +download and install them via the "Point'n'Print" mechanism supported by Samba. The clients use these drivers to generate print files in the -format the printer (or the Unix print system) requires. Print files -received by Samba are handed over to the Unix printing system, which +format the printer (or the UNIX print system) requires. Print files +received by Samba are handed over to the UNIX printing system, which is responsible for all further processing, if needed. -

    The [printer$] Section is removed from Samba-3

    +

    The [printer$] Section is removed from Samba 3

    [print$] vs. [printer$] .  Versions of Samba prior to 2.2 made it possible to use a share @@ -6723,7 +6466,7 @@ files associated with that printer. Another parameter named printer driver provided a means of defining the printer driver name to be sent to the client. These parameters, including the printer driver file parameter, -are now removed and can not be used in installations of Samba-3.0. +are now removed and can not be used in installations of samba-3. Now the share name [print$] is used for the location of downloadable printer drivers. It is taken from the [print$] service created by Windows NT PCs when @@ -6733,10 +6476,10 @@ access (in the context of its ACLs) in order to support printer driver down- and uploads. Don't fear -- this does not mean Windows 9x clients are thrown aside now. They can use Samba's [print$] share support just fine. -

    Creating the [print$] Share

    +

    Creating the [print$] Share

    In order to support the up- and downloading of printer driver files, you must first configure a file share named -[print$]. The "public" name of this share is +[print$]. The "public" name of this share is hard coded in Samba's internals (because it is hard coded in the MS Windows clients too). It cannot be renamed since Windows clients are programmed to search for a service of exactly this name if they want @@ -6747,42 +6490,25 @@ add the global parameters and create the [print$] file share (of course, some of the parameter values, such as 'path' are arbitrary and should be replaced with appropriate values for your site): -

    - [global]
-      ; members of the ntadmin group should be able to add drivers and set
-      ; printer properties. root is implicitly always a 'printer admin'.
-      printer admin = @ntadmin
-      [....]
-
- [printers]
-      [....]
-
- [print$]
-      comment = Printer Driver Download Area
-      path = /etc/samba/drivers
-      browseable = yes
-      guest ok = yes
-      read only = yes
-      write list = @ntadmin, root
-

    +

    Example 18.3. [print\$] example

    [global]
    # members of the ntadmin group should be able to add drivers and set
    # printer properties. root is implicitly always a 'printer admin'.
    printer admin = @ntadmin
    ...
    [printers]
    ...
    [print$]
    comment = Printer Driver Download Area
    path = /etc/samba/drivers
    browseable = yes
    guest ok = yes
    read only = yes
    write list = @ntadmin, root

    Of course, you also need to ensure that the directory named by the -path parameter exists on the Unix file system. -

    Parameters in the [print$] Section

    +path parameter exists on the UNIX file system. +

    Parameters in the [print$] Section

    [print$] is a special section in . It contains settings relevant to potential printer driver download and local installation by clients. -

    comment = Printer Driver -Download Area

    the comment appears next to the share name if it is +

    comment = Printer Driver + Download Area

    the comment appears next to the share name if it is listed in a share list (usually Windows clients won't see it often but it will also appear up in a smbclient -L sambaserver - output).

    path = /etc/samba/printers

    this is the path to the location of the Windows + output).

    path = /etc/samba/printers

    this is the path to the location of the Windows driver file deposit from the UNIX point of -view.

    browseable = no

    this makes the [print$] share -"invisible" in Network Neighbourhood to clients. However, you can -still "mount" it from any client using the net use -g:\\sambaserver\print$ command in a "DOS box" or the -"Connect network drive" menu from Windows -Explorer.

    guest ok = yes

    this gives read only access to this share for all +view.

    browseable = no

    this makes the [print$] share +"invisible" in Network Neighbourhood to clients. However, you can +still "mount" it from any client using the net use +g:\\sambaserver\print$ command in a "DOS box" or the +"Connect network drive" menu from Windows +Explorer.

    guest ok = yes

    this gives read only access to this share for all guest users. Access may be used to download and install printer drivers on clients. The requirement for guest ok = yes depends upon how your site is configured. If users @@ -6795,28 +6521,28 @@ validated by the Domain Controller in order to logon to the Windows NT session), then guest access is not necessary. Of course, in a workgroup environment where you just want to be able to print without worrying about silly accounts and security, then configure the share -for guest access. You'll probably want to add map to guest -= Bad User in the [global] section +for guest access. You'll probably want to add map to guest = Bad User in the +[global] section as well. Make sure you understand what this parameter does before using it. -

    read only = yes

    as we don't want everybody to upload driver files (or +

    read only = yes

    as we don't want everybody to upload driver files (or even change driver settings) we tagged this share as not -writeable.

    write list = @ntadmin,root

    since the [print$] was made -read only by the previous setting, we need to create a "write list" -also. UNIX groups (denoted with a leading "@" character) and users +writeable.

    write list = @ntadmin,root

    since the [print$] was made +read only by the previous setting, we need to create a "write list" +also. UNIX groups (denoted with a leading "@" character) and users listed here are allowed write access (as an exception to the general -public's "read-only" access), which they need to update files on the +public's "read-only" access), which they need to update files on the share. Normally you will want to only name administrative level user accounts in this setting. Check the file system permissions to make sure these accounts can copy files to the share. If this is a non-root account, then the account should also be mentioned in the global -printer admin parameter. See the +printer admin parameter. See the man page for more information on -configuring file shares.

    Subdirectory Structure in [print$]

    +configuring file shares.

    Subdirectory Structure in [print$]

    In order for a Windows NT print server to support the downloading of driver files by multiple client architectures, you must create several subdirectories within the [print$] service -(i.e. the Unix directory named by the path +(i.e. the UNIX directory named by the path parameter). These correspond to each of the supported client architectures. Samba follows this model as well. Just like the name of the [print$] share itself, the subdirectories @@ -6828,11 +6554,11 @@ Therefore, create a directory tree below the to support. 

     [print$]--+--
-          |--W32X86           # serves drivers to "Windows NT x86"
-          |--WIN40            # serves drivers to "Windows 95/98"
-          |--W32ALPHA         # serves drivers to "Windows NT Alpha_AXP"
-          |--W32MIPS          # serves drivers to "Windows NT R4000"
-          |--W32PPC           # serves drivers to "Windows NT PowerPC"
+          |--W32X86           # serves drivers to "Windows NT x86"
+          |--WIN40            # serves drivers to "Windows 95/98"
+          |--W32ALPHA         # serves drivers to "Windows NT Alpha_AXP"
+          |--W32MIPS          # serves drivers to "Windows NT R4000"
+          |--W32PPC           # serves drivers to "Windows NT PowerPC"

    Required permissions

    In order to add a new driver to your Samba host, one of two conditions must hold true: @@ -6851,7 +6577,7 @@ client workstation. Open Network Neighbourhood or Once you have located the server, navigate to its Printers and Faxes folder. You should see an initial listing of printers that matches the printer shares defined on your Samba host. -

    Installing Drivers into [print$]

    +

    Installing Drivers into [print$]

    You have successfully created the [print$] share in ? And Samba has re-read its configuration? Good. But you are not yet ready to take off. The @@ -6869,11 +6595,11 @@ Properties and Add Printer Wizard

    The latter option is probably the easier one (even if the only entrance to this realm seems a little bit weird at first). -

    Setting Drivers for existing Printers with a Client GUI

    +

    Setting Drivers for existing Printers with a Client GUI

    The initial listing of printers in the Samba host's Printers folder accessed from a client's Explorer -will have no real printer driver assigned to them. By default, in -Samba-3 (as in 2.2.1 and later) this driver name is set to a NULL +will have no real printer driver assigned to them. By default +this driver name is set to a NULL string. This must be changed now. The local Add Printer Wizard, run from NT/2000/XP clients, will help us in this task. @@ -6904,18 +6630,18 @@ Once the APW is started, the procedure is exactly the same as the one you are familiar with in Windows (we assume here that you are familiar with the printer driver installations procedure on Windows NT). Make sure your connection is in fact setup as a user with -printer admin privileges (if in doubt, use +printer admin privileges (if in doubt, use smbstatus to check for this). If you wish to install printer drivers for client operating systems other than Windows NT x86, you will need to use the Sharing tab of the printer properties dialog.

    Assuming you have connected with an administrative (or root) account -(as named by the printer admin parameter), +(as named by the printer admin parameter), you will also be able to modify other printer properties such as ACLs and default device settings using this dialog. For the default device settings, please consider the advice given further below. -

    Setting Drivers for existing Printers with +

    Setting Drivers for existing Printers with rpcclient

    The second way to install printer drivers into [print$] and set them up in a valid way can be @@ -6930,7 +6656,7 @@ time with the setdriver subcommand.

    We will provide detailed hints for each of these steps in the next few paragraphs. -

    Identifying the Driver Files

    +

    Identifying the Driver Files

    To find out about the driver files, you have two options: you could investigate the driver CD which comes with your printer. Study the *.inf file on the CD, if it is contained. This @@ -6978,35 +6704,35 @@ create scripts to automate the procedure for a large number of printers and drivers. Note the different quotes used to overcome the different spaces in between words: 

    -root# rpcclient -U'Danka%xxxx' -c 'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP
-  cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3
-
-  [Windows NT x86]
-  Printer Driver Info 3:
-          Version: [2]
-          Driver Name: [Heidelberg Digimaster 9110 (PS)]
-          Architecture: [Windows NT x86]
-          Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.DLL]
-          Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.ppd]
-          Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.DLL]
-          Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.HLP]
+root# rpcclient -U'Danka%xxxx' -c \
+	'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP
+cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3
+
+[Windows NT x86]
+Printer Driver Info 3:
+  Version: [2]
+  Driver Name: [Heidelberg Digimaster 9110 (PS)]
+  Architecture: [Windows NT x86]
+  Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.DLL]
+  Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.ppd]
+  Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.DLL]
+  Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.HLP]
   
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.DLL]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.INI]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1KMMin.DLL]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.dat]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.cat]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.def]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hre]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.vnd]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hlp]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de_reg.HLP]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01Aux.dll]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.NTF]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.DLL]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.INI]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1KMMin.DLL]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.dat]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.cat]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.def]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hre]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.vnd]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hlp]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de_reg.HLP]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01Aux.dll]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.NTF]
   
-          Monitorname: []
-          Defaultdatatype: []
-
+  Monitorname: []
+  Defaultdatatype: []

    You may notice, that this driver has quite a big number of Dependentfiles (I know worse cases however). Also, @@ -7023,17 +6749,17 @@ can also host the Win9x drivers, even if itself runs on Windows NT, Since the [print$] share is usually accessible through the Network Neighbourhood, you can also use the UNC notation from Windows Explorer to poke at it. The Win9x driver files will end -up in subdirectory "0" of the "WIN40" directory. The full path to +up in subdirectory "0" of the "WIN40" directory. The full path to access them will be \\WINDOWSHOST\print$\WIN40\0\.

    Note

    more recent drivers on Windows 2000 and Windows XP are -installed into the "3" subdirectory instead of the "2". The version 2 +installed into the "3" subdirectory instead of the "2". The version 2 of drivers, as used in Windows NT, were running in Kernel Mode. Windows 2000 changed this. While it still can use the Kernel Mode drivers (if this is enabled by the Admin), its native mode for printer drivers is User Mode execution. This requires drivers designed for -this. These type of drivers install into the "3" subdirectory. -

    Collecting the Driver Files from a Windows Host's +this. These type of drivers install into the "3" subdirectory. +

    Collecting the Driver Files from a Windows Host's [print$] Share

    Now we need to collect all the driver files we identified. in our previous step. Where do we get them from? Well, why not retrieve them @@ -7046,15 +6772,15 @@ listing is edited to include linebreaks for readability: root# smbclient //TURBO_XP/print\$ -U'Danka%xxxx' \ -c 'cd W32X86/2;mget HD*_de.* \ hd*ppd Hd*_de.* Hddm*dll HDN*Aux.DLL' - added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 - Got a positive name query response from 10.160.50.8 ( 10.160.50.8 ) - Domain=[DEVELOPMENT] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager] - Get file Hddm91c1_de.ABD? n - Get file Hddm91c1_de.def? y - getting file \W32X86\2\Hddm91c1_de.def of size 428 as Hddm91c1_de.def (22.0 kb/s) (average 22.0 kb/s) - Get file Hddm91c1_de.DLL? y - getting file \W32X86\2\Hddm91c1_de.DLL of size 876544 as Hddm91c1_de.DLL (737.3 kb/s) (average 737.3 kb/s) - [...] +added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 +Got a positive name query response from 10.160.50.8 ( 10.160.50.8 ) +Domain=[DEVELOPMENT] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager] +Get file Hddm91c1_de.ABD? n +Get file Hddm91c1_de.def? y +getting file \W32X86\2\Hddm91c1_de.def of size 428 as Hddm91c1_de.def +Get file Hddm91c1_de.DLL? y +getting file \W32X86\2\Hddm91c1_de.DLL of size 876544 as Hddm91c1_de.DLL +[...]

    After this command is complete, the files are in our current local @@ -7069,7 +6795,7 @@ files for these architectures are in the WIN40/0/ subdir. Once we are complete, we can run smbclient ... put to store the collected files on the Samba server's [print$] share. -

    Depositing the Driver Files into [print$]

    +

    Depositing the Driver Files into [print$]

    So, now we are going to put the driver files into the [print$] share. Remember, the UNIX path to this share has been defined previously in your @@ -7080,9 +6806,9 @@ your [print$] share maps to the UNIX path go here:

    • for all Windows NT, 2000 and XP clients into /etc/samba/drivers/W32X86/ but -*not*(yet) into the "2" subdir!

    • for all Windows 95, 98 and ME clients into +*not*(yet) into the "2" subdir!

    • for all Windows 95, 98 and ME clients into /etc/samba/drivers/WIN40/ -- but *not* -(yet) into the "0" subdir!

    +(yet) into the "0" subdir!

    We again use smbclient to transfer the driver files across the network. We specify the same files and paths as were leaked to us by running getdriver against the original @@ -7090,7 +6816,8 @@ running getdriver against the original store the files into a Samba/UNIX print server's [print$] share... 

    -root# smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c 'cd W32X86; put HDNIS01_de.DLL; \
+		root# smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c \
+ 'cd W32X86; put HDNIS01_de.DLL; \
   put Hddm91c1_de.ppd; put HDNIS01U_de.DLL;        \
   put HDNIS01U_de.HLP; put Hddm91c1_de.DLL;        \
   put Hddm91c1_de.INI; put Hddm91c1KMMin.DLL;      \
@@ -7099,78 +6826,77 @@ store the files into a Samba/UNIX print s
   put Hddm91c1_de.vnd; put Hddm91c1_de.hlp;        \
   put Hddm91c1_de_reg.HLP; put HDNIS01Aux.dll;     \
   put HDNIS01_de.NTF'
- added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
- Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
- Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
- putting file HDNIS01_de.DLL as \W32X86\HDNIS01_de.DLL (4465.5 kb/s) (average 4465.5 kb/s)
- putting file Hddm91c1_de.ppd as \W32X86\Hddm91c1_de.ppd (12876.8 kb/s) (average 4638.9 kb/s)
- putting file HDNIS01U_de.DLL as \W32X86\HDNIS01U_de.DLL (20249.8 kb/s) (average 5828.3 kb/s)
- putting file HDNIS01U_de.HLP as \W32X86\HDNIS01U_de.HLP (9652.8 kb/s) (average 5899.8 kb/s)
- putting file Hddm91c1_de.DLL as \W32X86\Hddm91c1_de.DLL (23777.7 kb/s) (average 10400.6 kb/s)
- putting file Hddm91c1_de.INI as \W32X86\Hddm91c1_de.INI (98.6 kb/s) (average 10329.0 kb/s)
- putting file Hddm91c1KMMin.DLL as \W32X86\Hddm91c1KMMin.DLL (22931.5 kb/s) (average 10501.7 kb/s)
- putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (2462.8 kb/s) (average 10393.0 kb/s)
- putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (4925.3 kb/s) (average 10356.3 kb/s)
- putting file Hddm91c1_de.def as \W32X86\Hddm91c1_de.def (417.9 kb/s) (average 10290.1 kb/s)
- putting file Hddm91c1_de.hre as \W32X86\Hddm91c1_de.hre (22571.3 kb/s) (average 11338.5 kb/s)
- putting file Hddm91c1_de.vnd as \W32X86\Hddm91c1_de.vnd (3384.6 kb/s) (average 10754.3 kb/s)
- putting file Hddm91c1_de.hlp as \W32X86\Hddm91c1_de.hlp (18406.8 kb/s) (average 10839.8 kb/s)
- putting file Hddm91c1_de_reg.HLP as \W32X86\Hddm91c1_de_reg.HLP (20278.3 kb/s) (average 11386.3 kb/s)
- putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll (14994.6 kb/s) (average 11405.2 kb/s)
- putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF (23390.2 kb/s) (average 13170.8 kb/s)
-
+added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
+Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
+putting file HDNIS01_de.DLL as \W32X86\HDNIS01_de.DLL
+putting file Hddm91c1_de.ppd as \W32X86\Hddm91c1_de.ppd
+putting file HDNIS01U_de.DLL as \W32X86\HDNIS01U_de.DLL
+putting file HDNIS01U_de.HLP as \W32X86\HDNIS01U_de.HLP
+putting file Hddm91c1_de.DLL as \W32X86\Hddm91c1_de.DLL
+putting file Hddm91c1_de.INI as \W32X86\Hddm91c1_de.INI
+putting file Hddm91c1KMMin.DLL as \W32X86\Hddm91c1KMMin.DLL
+putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat
+putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat
+putting file Hddm91c1_de.def as \W32X86\Hddm91c1_de.def
+putting file Hddm91c1_de.hre as \W32X86\Hddm91c1_de.hre
+putting file Hddm91c1_de.vnd as \W32X86\Hddm91c1_de.vnd
+putting file Hddm91c1_de.hlp as \W32X86\Hddm91c1_de.hlp
+putting file Hddm91c1_de_reg.HLP as \W32X86\Hddm91c1_de_reg.HLP
+putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll
+putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF

    Phewww -- that was a lot of typing! Most drivers are a lot smaller -- many only having 3 generic PostScript driver files plus 1 PPD. Note, -that while we did retrieve the files from the "2" subdirectory of the -"W32X86" directory from the Windows box, we don't +that while we did retrieve the files from the "2" subdirectory of the +"W32X86" directory from the Windows box, we don't put them (for now) in this same subdirectory of the Samba box! This re-location will automatically be done by the adddriver command which we will run shortly (and don't forget to also put the files for the Win95/98/ME architecture into the WIN40/ subdirectory should you need them). -

    Check if the Driver Files are there (with smbclient)

    +

    Check if the Driver Files are there (with smbclient)

    For now we verify that our files are there. This can be done with smbclient too (but of course you can log in via SSH also and do this through a standard UNIX shell access too): 

    -root# smbclient //SAMBA-CUPS/print\$ -U 'root%xxxx' -c 'cd W32X86; pwd; dir; cd 2; pwd; dir'
+root# smbclient //SAMBA-CUPS/print\$ -U 'root%xxxx' \
+	-c 'cd W32X86; pwd; dir; cd 2; pwd; dir'
  added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
- Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
- Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
-
-  Current directory is \\SAMBA-CUPS\print$\W32X86\
-  .                                   D        0  Sun May  4 03:56:35 2003
-  ..                                  D        0  Thu Apr 10 23:47:40 2003
-  2                                   D        0  Sun May  4 03:56:18 2003
-  HDNIS01Aux.dll                      A    15356  Sun May  4 03:58:59 2003
-  Hddm91c1KMMin.DLL                   A    46966  Sun May  4 03:58:59 2003
-  HDNIS01_de.DLL                      A   434400  Sun May  4 03:58:59 2003
-  HDNIS01_de.NTF                      A   790404  Sun May  4 03:56:35 2003
-  Hddm91c1_de.DLL                     A   876544  Sun May  4 03:58:59 2003
-  Hddm91c1_de.INI                     A      101  Sun May  4 03:58:59 2003
-  Hddm91c1_de.dat                     A     5044  Sun May  4 03:58:59 2003
-  Hddm91c1_de.def                     A      428  Sun May  4 03:58:59 2003
-  Hddm91c1_de.hlp                     A    37699  Sun May  4 03:58:59 2003
-  Hddm91c1_de.hre                     A   323584  Sun May  4 03:58:59 2003
-  Hddm91c1_de.ppd                     A    26373  Sun May  4 03:58:59 2003
-  Hddm91c1_de.vnd                     A    45056  Sun May  4 03:58:59 2003
-  HDNIS01U_de.DLL                     A   165888  Sun May  4 03:58:59 2003
-  HDNIS01U_de.HLP                     A    19770  Sun May  4 03:58:59 2003
-  Hddm91c1_de_reg.HLP                 A   228417  Sun May  4 03:58:59 2003
-                40976 blocks of size 262144. 709 blocks available
-
-  Current directory is \\SAMBA-CUPS\print$\W32X86\2\
-  .                                   D        0  Sun May  4 03:56:18 2003
-  ..                                  D        0  Sun May  4 03:56:35 2003
-  ADOBEPS5.DLL                        A   434400  Sat May  3 23:18:45 2003
-  laserjet4.ppd                       A     9639  Thu Apr 24 01:05:32 2003
-  ADOBEPSU.DLL                        A   109568  Sat May  3 23:18:45 2003
-  ADOBEPSU.HLP                        A    18082  Sat May  3 23:18:45 2003
-  PDFcreator2.PPD                     A    15746  Sun Apr 20 22:24:07 2003
-                40976 blocks of size 262144. 709 blocks available
-
+Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
+Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
+
+Current directory is \\SAMBA-CUPS\print$\W32X86\
+.                                   D        0  Sun May  4 03:56:35 2003
+..                                  D        0  Thu Apr 10 23:47:40 2003
+2                                   D        0  Sun May  4 03:56:18 2003
+HDNIS01Aux.dll                      A    15356  Sun May  4 03:58:59 2003
+Hddm91c1KMMin.DLL                   A    46966  Sun May  4 03:58:59 2003
+HDNIS01_de.DLL                      A   434400  Sun May  4 03:58:59 2003
+HDNIS01_de.NTF                      A   790404  Sun May  4 03:56:35 2003
+Hddm91c1_de.DLL                     A   876544  Sun May  4 03:58:59 2003
+Hddm91c1_de.INI                     A      101  Sun May  4 03:58:59 2003
+Hddm91c1_de.dat                     A     5044  Sun May  4 03:58:59 2003
+Hddm91c1_de.def                     A      428  Sun May  4 03:58:59 2003
+Hddm91c1_de.hlp                     A    37699  Sun May  4 03:58:59 2003
+Hddm91c1_de.hre                     A   323584  Sun May  4 03:58:59 2003
+Hddm91c1_de.ppd                     A    26373  Sun May  4 03:58:59 2003
+Hddm91c1_de.vnd                     A    45056  Sun May  4 03:58:59 2003
+HDNIS01U_de.DLL                     A   165888  Sun May  4 03:58:59 2003
+HDNIS01U_de.HLP                     A    19770  Sun May  4 03:58:59 2003
+Hddm91c1_de_reg.HLP                 A   228417  Sun May  4 03:58:59 2003
+              40976 blocks of size 262144. 709 blocks available
+
+Current directory is \\SAMBA-CUPS\print$\W32X86\2\
+.                                   D        0  Sun May  4 03:56:18 2003
+..                                  D        0  Sun May  4 03:56:35 2003
+ADOBEPS5.DLL                        A   434400  Sat May  3 23:18:45 2003
+laserjet4.ppd                       A     9639  Thu Apr 24 01:05:32 2003
+ADOBEPSU.DLL                        A   109568  Sat May  3 23:18:45 2003
+ADOBEPSU.HLP                        A    18082  Sat May  3 23:18:45 2003
+PDFcreator2.PPD                     A    15746  Sun Apr 20 22:24:07 2003
+              40976 blocks of size 262144. 709 blocks available

    Notice that there are already driver files present in the 2 subdir (probably from a previous @@ -7183,7 +6909,7 @@ Point'n'Print. The reason is: Samba doesn't know yet that these files are something special, namely printer driver files and it doesn't know yet to which print queue(s) these driver files belong. -

    Running rpcclient with +

    Running rpcclient with adddriver

    So, next you must tell Samba about the special category of the files you just uploaded into the [print$] share. This @@ -7192,21 +6918,23 @@ prompt Samba to register the driver files into its internal TDB database files. The following command and its output has been edited, again, for readability: 

    -root# rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL: \
-  Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
-  NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
-  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
-  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
-  HDNIS01Aux.dll,HDNIS01_de.NTF,                     \
-  Hddm91c1_de_reg.HLP' SAMBA-CUPS
+		root# rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" \
+"dm9110:HDNIS01_de.DLL: \
+Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
+ NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
+ Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
+ Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+ HDNIS01Aux.dll,HDNIS01_de.NTF,                     \
+ Hddm91c1_de_reg.HLP' SAMBA-CUPS
 
- cmd = adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:    \
-  HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
-  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,          \
-  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,        \
-  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
+cmd = adddriver "Windows NT x86" \
+"dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:    \
+ HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
+ Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,          \
+ Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,        \
+ HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
 
- Printer Driver dm9110 successfully installed.
+Printer Driver dm9110 successfully installed.

    After this step the driver should be recognized by Samba on the print @@ -7218,7 +6946,7 @@ files successfully, but render the driver unworkable. So take care! Hints about the syntax of the adddriver command are in the man page. The CUPS printing chapter of this HOWTO collection provides a more detailed description, if you should need it. -

    Check how Driver Files have been moved after +

    Check how Driver Files have been moved after adddriver finished

    One indication for Samba's recognition of the files as driver files is the successfully installed message. @@ -7227,9 +6955,9 @@ Another one is the fact, that our files have been moved by the subdirectory. You can check this again with smbclient: 

    -root# smbclient //SAMBA-CUPS/print\$ -Uroot%xxxx -c 'cd W32X86;dir;pwd;cd 2;dir;pwd'
+root# smbclient //SAMBA-CUPS/print\$ -Uroot%xx -c 'cd W32X86;dir;pwd;cd 2;dir;pwd'
  added interface ip=10.160.51.162 bcast=10.160.51.255 nmask=255.255.252.0
- Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+ Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
 
   Current directory is \\SAMBA-CUPS\print$\W32X86\
   .                                   D        0  Sun May  4 04:32:48 2003
@@ -7266,7 +6994,7 @@ subdirectory. You can check this again with

    Another verification is that the timestamp of the printing TDB files is now updated (and possibly their filesize has increased). -

    Check if the Driver is recognized by Samba

    +

    Check if the Driver is recognized by Samba

    Now the driver should be registered with Samba. We can easily verify this, and will do so in a moment. However, this driver is not yet associated with a particular @@ -7291,13 +7019,13 @@ right-click the white background (with no printer highlighted). Select Drivers tab you will see the new driver listed now. This view enables you to also inspect the list of files belonging to that driver (this doesn't work on Windows NT, but only on -Windows 2000 and Windows XP. WinNT doesn't provide the "Drivers" +Windows 2000 and Windows XP. WinNT doesn't provide the "Drivers" tab).. An alternative, much quicker method for Windows 2000/XP to start this dialog is by typing into a DOS box (you must of course adapt the name to your Samba server instead of SAMBA-CUPS):

    rundll32 printui.dll,PrintUIEntry /s /t2 /n\\SAMBA-CUPS

  • from a UNIX prompt run this command (or a variant thereof), where SAMBA-CUPS is the name of the Samba -host and "xxxx" represents the actual Samba password assigned to root: +host and "xxxx" represents the actual Samba password assigned to root:

    rpcclient -U'root%xxxx' -c 'enumdrivers' SAMBA-CUPS

    You will see a listing of all drivers Samba knows about. Your new one should be amongst them. But it is only listed under the [Windows NT @@ -7310,27 +7038,27 @@ time. Our new driver only shows up for Windows NT 4.0 or 2000. To have it present for Windows 95, 98 and ME you'll have to repeat the whole procedure with the WIN40 architecture and subdirectory. -

    • A side note: you are not bound to specific driver names

    +

    A side note: you are not bound to specific driver names

    You can name the driver as you like. If you repeat the adddriver step, with the same files as before, but with a different driver name, it will work the same: 

     root# rpcclient -Uroot%xxxx                                        \
-      -c 'adddriver "Windows NT x86"                     \
-      "myphantasydrivername:HDNIS01_de.DLL:              \
-      Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
-      NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
-      Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
-      Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
-      HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP' SAMBA-CUPS
+  -c 'adddriver "Windows NT x86"                     \
+  "myphantasydrivername:HDNIS01_de.DLL:              \
+  Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
+  NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
+  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
+  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP' SAMBA-CUPS
   
 
- cmd = adddriver "Windows NT x86" 
-                 "myphantasydrivername:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:\
+ cmd = adddriver "Windows NT x86" 
+                 "myphantasydrivername:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:\
                   HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,           \
                   Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,                    \
                   Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,                  \
-                  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
+                  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
 
  Printer Driver myphantasydrivername successfully installed.
 
@@ -7339,16 +7067,16 @@ You will also be able to bind that driver to any print queue (however,
 you are responsible yourself that you associate drivers to queues
 which make sense to the target printer). Note, that you can't run the
 rpcclient adddriver command
-repeatedly. Each run "consumes" the files you had put into the
+repeatedly. Each run "consumes" the files you had put into the
 [print$] share by moving them into the
 respective subdirectories. So you must precede an
 smbclient ... put command before each
-rpcclient ...  adddriver" command.
-

    La Grande Finale: Running rpcclient with +rpcclient ... adddriver" command. +

    Running rpcclient with setdriver

    Samba still needs to know which printer's driver this is. It needs to create a mapping of the driver to a printer, and -store this info in its "memory", the TDB files. The rpcclient +store this info in its "memory", the TDB files. The rpcclient setdriver command achieves exactly this: 

     root# rpcclient -U'root%xxxx' -c 'setdriver dm9110 myphantasydrivername' SAMBA-CUPS
@@ -7364,8 +7092,8 @@ name I intended:

    The syntax of the command is rpcclient -U'root%sambapassword' -c 'setdriver -"printername" -"drivername' +"printername" +"drivername' SAMBA-Hostname . -- Now we have done *most* of the work. But not yet all....

    Note

    @@ -7374,26 +7102,25 @@ known to Samba already. A bug in 2.2.x prevented Samba from recognizing freshly installed printers. You had to restart Samba, or at least send a HUP signal to all running smbd processes to work around this: -kill -HUP `pidof smbd`.

    "The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure)

    +kill -HUP `pidof smbd`.

    Client Driver Install Procedure

    A famous philosopher said once: “The Proof of the Pudding lies in the Eating”. The proof for our setup lies in the printing. So let's install the printer driver onto the client PCs. This is not as straightforward as it may seem. Read on. -

    The first Client Driver Installation

    +

    The first Client Driver Installation

    Especially important is the installation onto the first client PC (for each architectural platform separately). Once this is done correctly, all further clients are easy to setup and shouldn't need further attention. What follows is a description for the recommended first procedure. You work now from a client workstation. First you should guarantee that your connection is not unwittingly mapped to -bad user "nobody". In a DOS box type: +bad user "nobody". In a DOS box type:

    net use \\SAMBA-SERVER\print$ /user:root

    Replace root, if needed, by another valid printer admin user as given in the definition. Should you already be connected as a different user, you'll get an error message. There is no easy way to get rid of that connection, because -Windows doesn't seem to know a concept of "logging off" from a share +Windows doesn't seem to know a concept of "logging off" from a share connection (don't confuse this with logging off from the local workstation; that is a different matter). You can try to close all Windows file explorer and Internet Explorer @@ -7414,16 +7141,16 @@ samba-server) should now have appeared in your -- Printers and Faxes).

    Most likely you are now tempted to try and print a test page. After -all, you now can open the printer properties and on the "General" tab, +all, you now can open the printer properties and on the "General" tab, there is a button offering to do just that. But chances are that you get an error message saying Unable to print Test Page. The reason might be that there is not yet a -valid Device Mode set for the driver, or that the "Printer Driver -Data" set is still incomplete. +valid Device Mode set for the driver, or that the "Printer Driver +Data" set is still incomplete.

    -You must now make sure that a valid "Device Mode" is set for the +You must now make sure that a valid "Device Mode" is set for the driver. Don't fear -- we will explain now what that means. -

    IMPORTANT! Setting Device Modes on new Printers

    +

    IMPORTANT! Setting Device Modes on new Printers

    In order for a printer to be truly usable by a Windows NT/2K/XP client, it must possess:

    • a valid Device Mode generated by @@ -7450,7 +7177,7 @@ This can be achieved by accessing the drivers remotely from an NT (or 2k/XP) client, as is discussed in the next paragraphs.

      Be aware, that a valid Device Mode can only be initiated by a -printer admin, or root (the reason should be +printer admin, or root (the reason should be obvious). Device Modes can only correctly be set by executing the printer driver program itself. Since Samba can not execute this Win32 platform driver code, it sets this field initially to NULL (which is @@ -7460,9 +7187,9 @@ are uploaded to the [print$] share with the help of the APW or rpcclient.

      The generation and setting of a first valid Device Mode however -requires some "tickling" from a client, to set it on the Samba +requires some "tickling" from a client, to set it on the Samba server. The easiest means of doing so is to simply change the page -orientation on the server's printer. This "executes" enough of the +orientation on the server's printer. This "executes" enough of the printer driver program on the client for the desired effect to happen, and feeds back the new Device Mode to our Samba server. You can use the native Windows NT/2K/XP printer properties page from a Window client @@ -7474,7 +7201,7 @@ followed the last section's description)

    • At the bottom of the con Connect... entry further above, you need to click that one first to achieve the driver installation as shown in the last section)

    • Go to the Advanced tab; click on -Printing Defaults...

    • Change the "Portrait" page setting to "Landscape" (and +Printing Defaults...

    • Change the "Portrait" page setting to "Landscape" (and back)

    • (Oh, and make sure to apply changes between swapping the page orientation to cause the change to actually take effect...).

    • While you're at it, you may optionally also want to @@ -7495,7 +7222,7 @@ properties. Others may crash the client's spooler service. So use this parameter with caution. It is always better to have the client generate a valid device mode for the printer and store it on the server for you. -

    Further Client Driver Install Procedures

    +

    Further Client Driver Install Procedures

    Every further driver may be done by any user, along the lines described above: Browse network, open printers folder on Samba server, right-click printer and choose Connect.... Once @@ -7515,12 +7242,12 @@ rundll32 shell32.dll,Control_RunDLL MAIN.CPL @2 You can enter the commands either inside a DOS box window or in the Run command... field from the Start menu. -

    Always make first Client Connection as root or "printer admin"

    +

    Always make first Client Connection as root or "printer admin"

    After you installed the driver on the Samba server (in its [print$] share, you should always make sure that your first client installation completes correctly. Make it a habit for yourself to build that the very first connection from a client as -printer admin. This is to make sure that: +printer admin. This is to make sure that:

    • a first valid Device Mode is really initialized (see above for more explanation details), and that

    • the default print settings of your printer for all @@ -7534,30 +7261,33 @@ set to Letter, when you are all using

      To connect as root to a Samba printer, try this command from a Windows 2K/XP DOS box command prompt: -

      runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n \\SAMBA-SERVER\printername" +

      +C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n 
+	\\SAMBA-SERVER\printername"
+

      You will be prompted for root's Samba-password; type it, wait a few seconds, click on Printing Defaults... and proceed to set the job options as should be used as defaults by all clients. Alternatively, instead of root you can name one other member -of the printer admins from the setting. +of the printer admin from the setting.

      Now all the other users downloading and installing the driver the same way (called Point'n'Print) will have the same defaults set for them. If you miss this step you'll get a lot of helpdesk calls from your users. But maybe you like to talk to people.... ;-) -

    Other Gotchas

    +

    Other Gotchas

    Your driver is installed. It is ready for Point'n'Print installation by the clients now. You may have tried to download and use it onto your first client machine now. But wait... let's make you acquainted first with a few tips and tricks you may find useful. For -example, suppose you didn't manage to "set the defaults" on the +example, suppose you didn't manage to "set the defaults" on the printer, as advised in the preceding paragraphs? And your users complain about various issues (such as “We need to set the paper size for each job from Letter to A4 and it won't store it!”) -

    Setting Default Print Options for the Client Drivers

    +

    Setting Default Print Options for the Client Drivers

    The last sentence might be viewed with mixed feelings by some users and admins. They have struggled for hours and hours and couldn't arrive at a point were their settings seemed to be saved. It is not their @@ -7565,8 +7295,8 @@ fault. The confusing thing is this: in the multi-tabbed dialog that pops up when you right-click the printer name and select Properties..., you can arrive at two identically looking dialogs, each claiming that they help you to set printer options, -in three different ways. Here is the definite answer to the "Samba -Default Driver Setting FAQ": +in three different ways. Here is the definite answer to the "Samba +Default Driver Setting FAQ":

    “I can't set and save default print options for all users on Win2K/XP! Why not?”  How are you doing it? I bet the wrong way.... (it is not very @@ -7578,7 +7308,7 @@ dialogs look the same. Only one of them Administrator to do this for all users. Here is how I reproduce it in on XP Professional: -

    1. The first "wrong" way: +

      1. The first "wrong" way:

        1. Open the Printers folder.

        2. Right-click on the printer @@ -7586,7 +7316,7 @@ folder.

        3. Right-click on the printer select in context menu Printing Preferences...

        4. Look at this dialog closely and remember what it looks like.

        -

      2. The second "wrong" way: +

      3. The second "wrong" way:

        1. Open the Printers folder.

        2. Right-click on the printer (remoteprinter on @@ -7595,16 +7325,16 @@ cupshost) and select in the context menu tab

        3. Click on the button Printing Preferences...

        4. A new dialog opens. Keep this dialog open and go back to the parent dialog.

        -

      4. The third, the "correct" way: (should you do +

      5. The third, the "correct" way: (should you do this from the beginning, just carry out steps 1. and 2. from second -"way" above) +"way" above)

        1. Click on the Advanced -tab. (Hmmm... if everything is "Grayed Out", then you are not logged +tab. (Hmmm... if everything is "Grayed Out", then you are not logged in as a user with enough privileges).

        2. Click on the Printing Defaults... button.

        3. On any of the two new tabs, click on the Advanced... button.

        4. A new dialog opens. Compare this one to the other, -identical looking one from "B.5" or A.3".

        +identical looking one from "B.5" or A.3".

    Do you see any difference in the two settings dialogs? I don't @@ -7612,24 +7342,24 @@ either. However, only the last one, which you arrived at with steps C.1.-6. will permanently save any settings which will then become the defaults for new users. If you want all clients to have the same defaults, you need to conduct these steps as administrator -(printer admin in ) +(printer admin in ) before a client downloads the driver (the clients can later set their own per-user defaults by following the procedures A. or B. above...). (This is new: Windows 2000 and Windows XP allow per-user default settings and the ones the administrator gives them, before they set up their own). -The "parents" of the identically looking dialogs have a slight +The "parents" of the identically looking dialogs have a slight difference in their window names: one is called Default Print Values for Printer Foo on Server -Bar" (which is the one you need) and the other is -called "Print Settings for Printer Foo on Server -Bar". The last one is the one you arrive at when you +Bar" (which is the one you need) and the other is +called "Print Settings for Printer Foo on Server +Bar". The last one is the one you arrive at when you right-click on the printer and select Print Settings.... This is the one what you were taught to use back in the days of Windows NT! So it is only natural to try the same way with Win2k or WinXP. You wouldn't dream -that there is now a different "clicking path" to arrive at an +that there is now a different "clicking path" to arrive at an identically looking, but functionally different dialog to set defaults for all users!

    Tip

    Try (on Win2000 and WinXP) to run this command (as a user @@ -7644,9 +7374,9 @@ rundll32 printui.dll,PrintUIEntry /p /t0 /n\\SAMBA-SE

    to see the tab with the Printing Preferences... button (the one which doesn't set system-wide defaults). You can -start the commands from inside a DOS box" or from the Start +start the commands from inside a DOS box" or from the Start -- Run... menu. -

    Supporting large Numbers of Printers

    +

    Supporting large Numbers of Printers

    One issue that has arisen during the recent development phase of Samba is the need to support driver downloads for 100's of printers. Using Windows NT APW here is somewhat awkward (to say the least). If you @@ -7696,7 +7426,8 @@ following is an example of how this could be accomplished: 

    -root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 "Heidelberg Digimaster 9110 (PS)"'
+root# rpcclient SAMBA-CUPS -U root%secret -c \
+  'setdriver dm9110 "Heidelberg Digimaster 9110 (PS)"'
  cmd = setdriver dm9110 Heidelberg Digimaster 9110 (PPD)
  Successfully set dm9110 to driver Heidelberg Digimaster 9110 (PS).

    @@ -7706,7 +7437,8 @@ following is an example of how this could be accomplished: cmd = enumprinters flags:[0x800000] name:[\\SAMBA-CUPS\dm9110] - description:[\\SAMBA-CUPS\dm9110,Heidelberg Digimaster 9110 (PS),110ppm HiVolume DANKA Stuttgart] + description:[\\SAMBA-CUPS\dm9110,Heidelberg Digimaster 9110 (PS),\ + 110ppm HiVolume DANKA Stuttgart] comment:[110ppm HiVolume DANKA Stuttgart] [....]

    @@ -7722,18 +7454,19 @@ following is an example of how this could be accomplished: cmd = enumprinters flags:[0x800000] name:[\\SAMBA-CUPS\dm9110] - description:[\\SAMBA-CUPS\dm9110,myphantasydrivername,110ppm HiVolume DANKA Stuttgart] + description:[\\SAMBA-CUPS\dm9110,myphantasydrivername,\ + 110ppm HiVolume DANKA Stuttgart] comment:[110ppm HiVolume DANKA Stuttgart] [....]

    It may be not easy to recognize: but the first call to -enumprinters showed the "dm9110" printer with an +enumprinters showed the "dm9110" printer with an empty string where the driver should have been listed (between the 2 -commas in the "description" field). After the +commas in the "description" field). After the setdriver command succeeded, all is well. (The CUPS Printing chapter has more info about the installation of printer drivers with the help of rpcclient). -

    Adding new Printers with the Windows NT APW

    +

    Adding new Printers with the Windows NT APW

    By default, Samba exhibits all printer shares defined in smb.conf in the Printers... folder. Also located in this folder @@ -7741,29 +7474,29 @@ is the Windows NT Add Printer Wizard icon. The APW will be shown only if:

    • ...the connected user is able to successfully execute an OpenPrinterEx(\\server) with administrative -privileges (i.e. root or printer admin). +privileges (i.e. root or printer admin).

      Tip

      Try this from a Windows 2K/XP DOS box command prompt:

      runas /netonly /user:root rundll32 printui.dll,PrintUIEntry /p /t0 /n \\SAMBA-SERVER\printersharename

      and click on Printing Preferences...

    • ... contains the setting -show add printer wizard = yes (the +show add printer wizard = yes (the default).

    The APW can do various things:

    • upload a new driver to the Samba [print$] share;

    • associate an uploaded driver with an existing (but -still "driverless") print queue;

    • exchange the currently used driver for an existing +still "driverless") print queue;

    • exchange the currently used driver for an existing print queue with one that has been uploaded before;

    • add an entirely new printer to the Samba host (only in -conjunction with a working add printer command; -a corresponding delete printer command for +conjunction with a working add printer command; +a corresponding delete printer command for removing entries from the Printers... folder may be provided too)

    The last one (add a new printer) requires more effort than the previous ones. In order to use the APW to successfully add a printer -to a Samba server, the add printer command must +to a Samba server, the add printer command must have a defined value. The program hook must successfully add the -printer to the Unix print system (i.e. to +printer to the UNIX print system (i.e. to /etc/printcap, /etc/cups/printers.conf or other appropriate files) and to if necessary. @@ -7773,13 +7506,11 @@ exist, smbd will execute the add printer command and reparse to the to attempt to locate the new printer share. If the share is still not defined, an error of Access Denied is -returned to the client. Note that the add printer -command is executed under the context of the connected -user, not necessarily a root account. A map to guest = bad -user may have connected you unwittingly under the wrong +returned to the client. Note that the add printer command is executed under the context of the connected +user, not necessarily a root account. A map to guest = bad user may have connected you unwittingly under the wrong privilege; you should check it by using the smbstatus command. -

    Weird Error Message Cannot connect under a +

    Weird Error Message Cannot connect under a different Name

    Once you are connected with the wrong credentials, there is no means to reverse the situation other than to close all Explorer windows, and @@ -7789,7 +7520,7 @@ perhaps reboot. connections to a server or a shared resource by the same user utilizing the several user names are not allowed. Disconnect all previous connections to the server, resp. the shared resource, and try -again.

  • Every attempt to "connect a network drive" to +again.

  • Every attempt to "connect a network drive" to \\SAMBASERVER\\print$ to z: is countered by the pertinacious message. This network folder is currently connected under different credentials (username and password). @@ -7809,20 +7540,20 @@ message. You close all Explorer Windows and start it again. You try to connect - and this times it works! Windows seems to cache connection info somewhere and doesn't keep it up to date (if you are unlucky you might need to reboot to get rid of the error message). -

    • Be careful when assembling Driver Files

    +

    Be careful when assembling Driver Files

    You need to be very careful when you take notes about the files and belonging to a particular driver. Don't confuse the files for driver -version "0" (for Win95/98/ME, going into -[print$]/WIN/0/), driver version "2" (Kernel Mode +version "0" (for Win95/98/ME, going into +[print$]/WIN/0/), driver version "2" (Kernel Mode driver for WinNT, going into [print$]/W32X86/2/ may be used on Win2K/XP too), and driver version -"3" (non-Kernel Mode driver going into +"3" (non-Kernel Mode driver going into [print$]/W32X86/3/ can not be used on WinNT). Very often these different driver versions contain files carrying the same name; but still the files are very different! Also, if you look at them from the Windows Explorer (they reside in %WINDOWS%\system32\spool\drivers\W32X86\) you -will probably see names in capital letters, while an "enumdrivers" +will probably see names in capital letters, while an "enumdrivers" command from Samba would show mixed or lower case letters. So it is easy to confuse them. If you install them manually using rpcclient and subcommands, you may even succeed @@ -7895,7 +7626,7 @@ reasons: Defaultdatatype: []

    -If we write the "version 2" files and the "version 3" files +If we write the "version 2" files and the "version 3" files into different text files and compare the result, we see this picture: 

    @@ -7933,7 +7664,7 @@ comparison:
 
     root# for i in cns3g.hlp cns3gui.dll cns3g.dll; do                  \
            smbclient //10.160.50.8/print\$ -U 'Administrator%xxxx' \
-           -c "cd W32X86/3; dir $i; cd .. ; cd 2; dir $i";      \
+           -c "cd W32X86/3; dir $i; cd .. ; cd 2; dir $i";      \
 		   done
 
   CNS3G.HLP               A   122981  Thu May 30 02:31:00 2002
@@ -7950,39 +7681,39 @@ In my example were even more differences than shown here.  Conclusion:
 you must be very careful to select the correct driver files for each
 driver version. Don't rely on the names alone. Don't interchange files
 belonging to different driver versions.
-

    Samba and Printer Ports

    +

    Samba and Printer Ports

    Windows NT/2000 print servers associate a port with each printer. These normally take the form of LPT1:, COM1:, FILE:, etc. Samba must also support the concept of ports associated with a printer. By -default, only one printer port, named "Samba Printer Port", exists on -a system. Samba does not really need such a "port" in order to print; +default, only one printer port, named "Samba Printer Port", exists on +a system. Samba does not really need such a "port" in order to print; it rather is a requirement of Windows clients. They insist on being told about an available port when they request this info, otherwise they throw an error message at you. So Samba fakes the port information to keep the Windows clients happy.

    -Note that Samba does not support the concept of "Printer Pooling" +Note that Samba does not support the concept of "Printer Pooling" internally either. Printer Pooling assigns a logical printer to multiple ports as a form of load balancing or fail over.

    If you require that multiple ports be defined for some reason or another (“My users and my Boss should not know that they are working with Samba”), possesses a -enumports command which can be used to define +enumports command which can be used to define an external program that generates a listing of ports on a system. -

    Avoiding the most common Misconfigurations of the Client Driver

    +

    Avoiding the most common Misconfigurations of the Client Driver

    So - printing works, but there are still problems. Most jobs print well, some don't print at all. Some jobs have problems with fonts, which don't look good at all. Some jobs print fast, and some are dead-slow. We can't cover it all; but we want to encourage you to read -the little paragraph about "Avoiding the wrong PostScript Driver -Settings" in the CUPS Printing part of this document. -

    The Imprints Toolset

    +the little paragraph about "Avoiding the wrong PostScript Driver +Settings" in the CUPS Printing part of this document. +

    The Imprints Toolset

    The Imprints tool set provides a UNIX equivalent of the Windows NT Add Printer Wizard. For complete information, please refer to the Imprints web site -athttp://imprints.sourceforge.net/ +at http://imprints.sourceforge.net/ as well as the documentation included with the imprints source distribution. This section will only provide a brief introduction to the features of Imprints. @@ -7995,20 +7726,20 @@ coordinate your efforts on the samba-technical mailing list. The toolset is still in usable form; but only for a series of older printer models, where there are prepared packages to use. Packages for more up to date print devices are needed if Imprints should have a -future.

    What is Imprints?

    +future.

    What is Imprints?

    Imprints is a collection of tools for supporting these goals:

    • Providing a central repository information regarding Windows NT and 95/98 printer driver packages

    • Providing the tools necessary for creating the Imprints printer driver packages.

    • Providing an installation client which will obtain printer drivers from a central internet (or intranet) Imprints Server repository and install them on remote Samba and Windows NT4 print -servers.

    Creating Printer Driver Packages

    +servers.

    Creating Printer Driver Packages

    The process of creating printer driver packages is beyond the scope of this document (refer to Imprints.txt also included with the Samba distribution for more information). In short, an Imprints driver package is a gzipped tarball containing the driver files, related INF files, and a control file needed by the installation client. -

    The Imprints Server

    +

    The Imprints Server

    The Imprints server is really a database server that may be queried via standard HTTP mechanisms. Each printer entry in the database has an associated URL for the actual downloading of the package. Each @@ -8016,7 +7747,7 @@ package is digitally signed via GnuPG which can be used to verify that package downloaded is actually the one referred in the Imprints database. It is strongly recommended that this security check not be disabled. -

    The Installation Client

    +

    The Installation Client

    More information regarding the Imprints installation client is available in the Imprints-Client-HOWTO.ps file included with the imprints source package. @@ -8037,9 +7768,9 @@ wrapped around smbclient and rpcclient

  • rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer

    • One of the problems encountered when implementing the Imprints tool set was the name space issues between various supported client -architectures. For example, Windows NT includes a driver named "Apple -LaserWriter II NTX v51.8" and Windows 95 calls its version of this -driver "Apple LaserWriter II NTX" +architectures. For example, Windows NT includes a driver named "Apple +LaserWriter II NTX v51.8" and Windows 95 calls its version of this +driver "Apple LaserWriter II NTX"

    The problem is how to know what client drivers have been uploaded for a printer. An astute reader will remember that the Windows NT Printer @@ -8057,7 +7788,7 @@ if is has not already been installed? The way of sidestepping this limitation is to require that all Imprints printer driver packages include both the Intel Windows NT and 95/98 printer drivers and that NT driver is installed first. -

    Add Network Printers at Logon without User Interaction

    +

    Add Network Printers at Logon without User Interaction

    The following MS Knowledge Base article may be of some help if you need to handle Windows 2000 clients: How to Add Printers with No User Interaction in Windows 2000. ( http://support.microsoft.com/default.aspx?scid=kb;en-us;189105 @@ -8067,7 +7798,7 @@ The ideas sketched out below are inspired by this article. It describes a commandline method which can be applied to install network and local printers and their drivers. This is most useful if integrated in Logon Scripts. You can see what options are -available by typing in a command prompt ("DOS box") this: +available by typing in a command prompt ("DOS box") this:

    rundll32 printui.dll,PrintUIEntry /?

    A window pops up which shows you all of the commandline switches available. An extensive list of examples is also provided. This is @@ -8077,22 +7808,16 @@ what a client logon script might contain, with a short explanation of what the lines actually do (it works if 2k/XP Windows clients access printers via Samba, but works for Windows-based print servers too): 

    -rundll32 printui.dll,PrintUIEntry /dn /n "\\sambacupsserver\infotec2105-IPDS" /q
-rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\infotec2105-PS"
-rundll32 printui.dll,PrintUIEntry /y /n "\\sambacupsserver\infotec2105-PS"
+rundll32 printui.dll,PrintUIEntry /dn /n "\\sambacupsserver\infotec2105-IPDS" /q
+rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\infotec2105-PS"
+rundll32 printui.dll,PrintUIEntry /y /n "\\sambacupsserver\infotec2105-PS"

    Here is a list of the used commandline parameters: -

    /dn

    deletes a network printer

    /q

    quiet modus

    /n

    names a printer

    /in

    adds a network printer connection

    /y

    sets printer as default printer

    -I have tested this with a Samba 2.2.7a and a Samba-3alpha24 -installation and Windows XP Professional clients. Note that this -specific command set works with network print queues (installing -local print queues requires different parameters, but this is of no -interest here). -

    • Line 1 deletes a possibly existing previous network +

      /dn

      deletes a network printer

      /q

      quiet modus

      /n

      names a printer

      /in

      adds a network printer connection

      /y

      sets printer as default printer

      • Line 1 deletes a possibly existing previous network printer infotec2105-IPDS (which had used native Windows drivers with LPRng that were removed from the server which was converted to CUPS). The /q at the end eliminates -"Confirm" or error dialog boxes popping up. They should not be +"Confirm" or error dialog boxes popping up. They should not be presented to the user logging on.

      • Line 2 adds the new printer infotec2105-PS (which actually is same physical device but is now run by the new CUPS printing system and associated @@ -8108,7 +7833,7 @@ default printer). The default printer selection may of course be different for different users.

      Note that the second line only works if the printer infotec2105-PS has an already working print queue -on "sambacupsserver", and if the printer drivers have successfully been +on "sambacupsserver", and if the printer drivers have successfully been uploaded (via APW , smbclient/rpcclient or cupsaddsmb) into the @@ -8124,7 +7849,7 @@ every time a user logs in; it's really quick anyway (1 to 2 seconds).

      The additional benefits for this are:

      • It puts in place any printer default setup changes -automatically at every user logon.

      • It allows for "roaming" users' login into the domain from +automatically at every user logon.

      • It allows for "roaming" users' login into the domain from different workstations.

      Since network printers are installed per user this much simplifies the process of keeping the installation up-to-date. The extra few seconds @@ -8132,7 +7857,7 @@ at logon time will not really be noticeable. Printers can be centrally added, changed, and deleted at will on the server with no user intervention required on the clients (you just need to keep the logon scripts up to date). -

    The addprinter command

    +

    The addprinter command

    The addprinter command can be configured to be a shell script or program executed by Samba. It is triggered by running the APW from a client against the Samba print server. The APW asks the @@ -8144,25 +7869,24 @@ on legacy systems, or execute the lpadmin command on more modern systems) and create the associated share in , then the APW will in effect really create a new printer on Samba and the UNIX print subsystem! -

    Migration of "Classical" printing to Samba-3

    -The basic "NT-style" printer driver management has not changed +

    Migration of "Classical" printing to Samba

    +The basic "NT-style" printer driver management has not changed considerably in 3.0 over the 2.2.x releases (apart from many small improvements). Here migration should be quite easy, especially if you followed previous advice to stop using deprecated parameters in your setup. For migrations from an existing 2.0.x setup, or if you -continued "Win9x-style" printing in your Samba 2.2 installations, it +continued "Win9x-style" printing in your Samba 2.2 installations, it is more of an effort. Please read the appropriate release notes and the HOWTO Collection for 2.2. You can follow several paths. Here are possible scenarios for migration:

    • You need to study and apply the new Windows NT printer -and driver support. Previously used parameters "printer -driver file", " printer driver" and -"printer driver location" are no longer +and driver support. Previously used parameters printer +driver file, printer driver and +printer driver location are no longer supported.

    • If you want to take advantage of WinNT printer driver support you also need to migrate the Win9x/ME drivers to the new setup.

    • An existing printers.def file -(the one specified in the now removed parameter printer -driver file = ...) will work no longer with Samba-3.0. In + (the one specified in the now removed parameter printer driver file) will work no longer with samba 3. In 3.0, smbd attempts to locate a Win9x/ME driver files for the printer in [print$] and additional settings in the TDB and only there; if it fails it will not (as 2.2.x @@ -8170,7 +7894,7 @@ used to do) drop down to using a printers.def (and all associated parameters). The make_printerdef tool is removed and there is no backwards compatibility for this.

    • You need to install a Windows 9x driver into the [print$] share for a printer on your Samba -host. The driver files will be stored in the "WIN40/0" subdirectory of +host. The driver files will be stored in the "WIN40/0" subdirectory of [print$], and some other settings and info go into the printing-related TDBs.

    • If you want to migrate an existing printers.def file into the new setup, the current @@ -8178,162 +7902,137 @@ only solution is to use the Windows NT APW to install the NT drivers and the 9x drivers. This can be scripted using smbclient and rpcclient. See the Imprints installation client at:

      -http://imprints.sourceforge.net/ + http://imprints.sourceforge.net/

      for an example. See also the discussion of rpcclient usage in the -"CUPS Printing" section.

    Publishing Printer Information in Active Directory or LDAP

    +"CUPS Printing" section.

    Publishing Printer Information in Active Directory or LDAP

    We will publish an update to this section shortly. -

    Common Errors and Problems

    -Here are a few typical errors and problems people have -encountered. You can avoid them. Read on. -

    I give my root password but I don't get access

    -Don't confuse the root password which is valid for the Unix system +

    Common Errors

    I give my root password but I don't get access

    +Don't confuse the root password which is valid for the UNIX system (and in most cases stored in the form of a one-way hash in a file named /etc/shadow) with the password used to authenticate against Samba!. Samba doesn't know the UNIX password; for root to access Samba resources via Samba-type access, a Samba account for root must be created first. This is often done with the smbpasswd command. -

    My printjobs get spooled into the spooling directory, but then get lost

    -Don't use the existing Unix print system spool directory for the Samba +

    My printjobs get spooled into the spooling directory, but then get lost

    +Don't use the existing UNIX print system spool directory for the Samba spool directory. It may seem convenient and a saving of space, but it only leads to problems. The two must be separate. -

    Chapter 19. CUPS Printing Support in Samba 3.0

    Kurt Pfeifle

    Danka Deutschland GmbH

    Ciprian Vizitiu

    drawings

    (3 June 2003)

    Table of Contents

    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for -CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for -application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download
    GDI on Windows -- PostScript on Unix
    Windows Drivers, GDI and EMF
    Unix Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and -native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print -Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many -Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel -Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for -cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Caveats to be considered
    What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsm completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the -Client
    Installing PostScript Driver Files manually (using -rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Commandline Driver Installation in 15 little Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    When not to use Samba to print to -CUPS
    In Case of Trouble.....
    Where to find Documentation
    How to ask for Help
    Where to find Help
    Appendix
    Printing from CUPS to Windows attached -Printers
    More CUPS filtering Chains
    Trouble Shooting Guidelines to fix typical Samba printing -Problems
    An Overview of the CUPS Printing Processes

    Introduction

    Features and Benefits

    - The Common Unix Print System (CUPS) has become very popular. All - big Linux distributions now ship it as their default printing - system. But to many it is still a very mystical tool. Normally it - "just works" (TM). People tend to regard it as a sort of "black box", - which they don't want to look into, as long as it works OK. But once +

    Chapter 19. CUPS Printing Support in Samba 3.0

    Kurt Pfeifle

    Danka Deutschland GmbH

    Ciprian Vizitiu

    drawings

    Jelmer R. Vernooij

    drawings
    The Samba Team

    (3 June 2003)

    Table of Contents

    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for +CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for +application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and +native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many +Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel +Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Caveats to be considered
    Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsmb completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the +Client
    Installing PostScript Driver Files manually (using +rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    In Case of Trouble.....
    Printing from CUPS to Windows attached +Printers
    More CUPS filtering Chains
    Common Errors
    Win9x client can't install driver
    "cupsaddsmb" keeps asking for root password in + neverending loop
    "cupsaddsmb" gives "No PPD file for printer..." + message while PPD file is present
    Client can't connect to Samba printer
    Can't reconnect to Samba under new account + from Win2K/XP
    Avoid being connected to the Samba server as the + "wrong" user
    Upgrading to CUPS drivers from Adobe drivers on + NT/2K/XP clients gives problems
    Can't use "cupsaddsmb" on Samba server which is + a PDC
    Deleted Win2K printer driver is still shown
    Win2K/XP "Local Security + Policies"
    WinXP clients: "Administrator can not install + printers for all local users"
    "Print Change Notify" functions on + NT-clients
    WinXP-SP1
    Print options for all users can't be set on Win2K/XP
    Most common blunders in driver + settings on Windows clients
    cupsaddsmb does not work + with newly installed printer
    Permissions on +/var/spool/samba/ get reset after each +reboot
    Printer named "lp" +intermittently swallows jobs and spits out completely different +ones
    Location of Adobe PostScript driver files necessary for "cupsaddsmb"
    An Overview of the CUPS Printing Processes

    Introduction

    Features and Benefits

    + The Common UNIX Print System (CUPS) has become very popular. All + major Linux distributions now ship it as their default printing + system. To many it is still a very mystical tool. Mostly, it + "just works" (TM). People tend to regard it as a "black box" + which they don't want to look into, as long as it works. But once there is a little problem, they are in trouble to find out where to - start debugging it. Also, even the most recent and otherwise excellent - printed Samba documentation has only limited attention paid to CUPS - printing, leaving out important pieces or even writing plain wrong - things about it. This demands rectification. But before you dive into - this chapter, make sure that you don't forget to refer to the - "Classical Printing" chapter also. It contains a lot of information - that is relevant for CUPS too. + start debugging it. Refer to the "Classical Printing" chapter also, it + contains a lot of information that is relevant for CUPS.

    CUPS sports quite a few unique and powerful features. While their basic functions may be grasped quite easily, they are also new. Because they are different from other, more traditional printing systems, it is best to try and not apply any prior knowledge about - printing upon this new system. Rather try to start understand CUPS - from the beginning. This documentation will lead you here to a - complete understanding of CUPS, if you study all of the material - contained. But lets start with the most basic things first. Maybe this - is all you need for now. Then you can skip most of the other - paragraphs. -

    Overview

    + printing upon this new system. Rather, try to understand CUPS + from the beginning. This documentation will lead you to a + complete understanding of CUPS. Let's start with the most basic + things first. +

    Overview

    CUPS is more than just a print spooling system. It is a complete printer management system that complies with the new IPP (Internet Printing Protocol). IPP is an industry and IETF (Internet Engineering Task Force) standard for network printing. Many of its functions can be managed remotely (or locally) via a web browser (giving you a - platform-independent access to the CUPS print server). In addition it - has the traditional commandline and several more modern GUI interfaces + platform-independent access to the CUPS print server). Additionally, it + has the traditional command line and several more modern GUI interfaces (GUI interfaces developed by 3rd parties, like KDE's overwhelming KDEPrint).

    - CUPS allows creation of "raw" printers (ie: NO print file - format translation) as well as "smart" printers (i.e. CUPS does + CUPS allows creation of "raw" printers (ie: NO print file + format translation) as well as "smart" printers (i.e. CUPS does file format conversion as required for the printer). In many ways this gives CUPS similar capabilities to the MS Windows print monitoring system. Of course, if you are a CUPS advocate, you would argue that CUPS is better! In any case, let us now move on to explore how one may configure CUPS for interfacing with MS Windows print clients via Samba. -

    Basic Configuration of CUPS support

    - Printing with CUPS in the most basic smb.conf - setup in Samba 3.0 (as was true for 2.2.x) only needs two - settings: printing = cups and printcap - = cups. CUPS itself doesn't need a printcap file - anymore. However, the cupsd.conf configuration - file knows two related directives: they control if such a file should - be automatically created and maintained by CUPS for the convenience of - third party applications (example: Printcap - /etc/printcap and PrintcapFormat - BSD). These legacy programs often require the existence of - printcap file containing printernames or they will refuse to - print. Make sure CUPS is set to generate and maintain a printcap! For - details see man cupsd.conf and other CUPS-related - documentation, like the wealth of documents on your CUPS server +

    Basic Configuration of CUPS support

    + Printing with CUPS in the most basic smb.conf setup in Samba 3.0 (as was true for 2.2.x) only needs two + settings: printing = cups and + printcap = cups. CUPS does not need a printcap file. + However, the cupsd.conf configuration file knows of two related directives that control + how such a file will be automatically created and maintained by CUPS for the convenience of third party + applications (example: Printcap /etc/printcap and PrintcapFormat BSD). + Legacy programs often require the existence of a printcap file containing printer names or they will refuse to + print. Make sure CUPS is set to generate and maintain a printcap file! For details see + man cupsd.conf and other CUPS-related documentation, like the wealth of documents on your CUPS server itself: http://localhost:631/documentation.html. -

    Linking of smbd with libcups.so

    - Samba has a very special relationship to CUPS. The reason is: Samba - can be compiled with CUPS library support. Most recent installations - have this support enabled, and per default CUPS linking is compiled +

    Linking of smbd with libcups.so

    + Samba has a very special relationship to CUPS. Samba can be compiled with CUPS library support. + Most recent installations have this support enabled. Per default CUPS linking is compiled into smbd and other Samba binaries. Of course, you can use CUPS even if Samba is not linked against libcups.so -- but there are some differences in required or supported configuration then.

    - If SAMBA is compiled against libcups, then printcap = - cups uses the CUPS API to list printers, submit jobs, - query queues, etc. Otherwise it maps to the System V commands with an - additional -oraw option for printing. On a Linux - system, you can use the ldd utility to find out - details (ldd may not be present on other OS platforms, or its function - may be embodied by a different command): + When Samba is compiled against libcups, printcap = cups + uses the CUPS API to list printers, submit jobs, query queues, etc. Otherwise it maps to the System V + commands with an additional -oraw option for printing. On a Linux + system, you can use the ldd utility to find out details (ldd may not be present on + other OS platforms, or its function may be embodied by a different command): 

    -				transmeta:/home/kurt # ldd `which smbd`
-				libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000)
-				libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000)
-				libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000)
-				[....]
-

    - The line libcups.so.2 => /usr/lib/libcups.so.2 - (0x40123000) shows there is CUPS support compiled - into this version of Samba. If this is the case, and printing = cups - is set, then any otherwise manually set print command in - smb.conf is ignored. This is an - important point to remember! -

    Tip

    Should you require -- for any reason -- to set your own - print commands, you can still do this by setting printing = - sysv. However, you'll loose all the benefits from the - close CUPS/Samba integration. You are on your own then to manually - configure the rest of the printing system commands (most important: - print command; other commands are - lppause command, lpresume command, lpq command, lprm - command, queuepause command and queue resume - command).

    Simple smb.conf Settings for CUPS

    - To summarize, here is the simplest printing-related setup - for smb.conf to enable basic CUPS support: - 

    -
-				[global]
-				load printers = yes
-				printing = cups
-				printcap name = cups
-
-				[printers]
-				comment = All Printers
-				path = /var/spool/samba
-				browseable = no
-				public = yes
-				guest ok = yes
-				writable = no
-				printable = yes
-				printer admin = root, @ntadmins
-
-

    +root# ldd `which smbd` +libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000) +libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000) +libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) +[....] +

    + The line libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) shows + there is CUPS support compiled into this version of Samba. If this is the case, and printing = cups + is set, then any otherwise manually set print command in smb.conf is ignored. + This is an important point to remember! +

    Tip

    Should it be necessary, for any reason, to set your own print commands, you can do this by setting + printing = sysv. However, you will loose all the benefits + of tight CUPS/Samba integration. When you do this you must manually configure the printing system commands + (most important: print command; other commands are + lppause command, + lpresume command, + lpq command, + lprm command, + queuepause command and + queue resume command).

    Simple smb.conf Settings for CUPS

    + To summarize, here is the simplest printing-related setup for smb.conf to enable basic CUPS support: +

    Example 19.1. Simplest printing-related smb.conf

    [global]
    load printers = yes
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    public = yes
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root, @ntadmins

    This is all you need for basic printing setup for CUPS. It will print all Graphic, Text, PDF and PostScript file submitted from Windows clients. However, most of your Windows users would not know how to @@ -8343,92 +8042,54 @@ Problems

    An Overview of the CUPS Printing Proce driver. Your users also very rarely send files from the command line. Unlike UNIX clients, they hardly submit graphic, text or PDF formatted files directly to the spooler. They nearly exclusively print - from GUI applications, with a "printer driver" hooked in between the + from GUI applications, with a "printer driver" hooked in between the applications native format and the print data stream. If the backend - printer is not a PostScript device, the print data stream is "binary", + printer is not a PostScript device, the print data stream is "binary", sensible only for the target printer. Read on to learn which problem this may cause and how to avoid it. -

    More complex smb.conf Settings for +

    More complex smb.conf Settings for CUPS

    Here is a slightly more complex printing-related setup for smb.conf. It enables general CUPS printing support for all printers, but defines one printer share which is set up differently. -

    -
- [global]
-         printing = cups
-         printcap name = cups
-         load printers = yes
-
- [printers]
-         comment = All Printers
-         path = /var/spool/samba
-         public = yes
-         guest ok = yes
-         writable = no
-         printable = yes
-         printer admin = root, @ntadmins
- 
- [special_printer]
-         comment = A special printer with his own settings
-         path = /var/spool/samba-special
-         printing = sysv
-         printcap = lpstat
-         print command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ;\
-                         echo "     `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ;\
-                         echo "     `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log :\
-                         rm %f
-         public = no
-         guest ok = no
-         writeable = no
-         printable = yes
-         printer admin = kurt
-         hosts deny = 0.0.0.0
-         hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60
-
-

    -This special share is only there for my testing purposes. It doesn't -even write the print job to a file. It just logs the job parameters -known to Samba into the /tmp/smbprn.log file and -deletes the jobfile. Moreover, the printer -admin of this share is "kurt" (not the "@ntadmins" group); -guest access is not allowed; the share isn't announced in Network -Neighbourhood (so you need to know it is there), and it is only -allowing access from three hosts. To prevent CUPS kicking in and -taking over the print jobs for that share, we need to set -printing = sysv and printcap = -lpstat. -

    Advanced Configuration

    -Before we dive into all the configuration options, let's clarify a few +

    Example 19.2. Overriding global CUPS settings for one printer

    [global]
    printing = cups
    printcap name = cups
    load printers = yes
    [printers]
    comment = All Printers
    path = /var/spool/samba
    public = yes
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root, @ntadmins
    [special_printer]
    comment = A special printer with his own settings
    path = /var/spool/samba-special
    printing = sysv
    printcap = lpstat
    print command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ; \
    echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; \
    echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log : rm %f
    public = no
    guest ok = no
    writeable = no
    printable = yes
    printer admin = kurt
    hosts deny = 0.0.0.0
    hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60

    +This special share is only there for testing purposes. It does not write the print job to a file. It just logs the job parameters +known to Samba into the /tmp/smbprn.log file and deletes the jobfile. Moreover, the +printer admin of this share is "kurt" (not the "@ntadmins" group); +guest access is not allowed; the share isn not published to the Network Neighbourhood (so you need to know it is there), and it only +allows access from only three hosts. To prevent CUPS kicking in and taking over the print jobs for that share, we need to set +printing = sysv and +printcap = lpstat. +

    Advanced Configuration

    +Before we delve into all the configuration options, let us clarify a few points. Network printing needs to be organized and setup correctly. Often this is not done correctly. Legacy systems -or small LANs in business environments often lack a clear design and -good housekeeping. -

    Central spooling vs. "Peer-to-Peer" printing

    +or small business LAN environments often lack design and good housekeeping. +

    Central spooling vs. "Peer-to-Peer" printing

    Many small office or home networks, as well as badly organized larger environments, allow each client a direct access to available network -printers. Generally, this is a bad idea. It often blocks one client's +printers. This is generally a bad idea. It often blocks one client's access to the printer when another client's job is printing. It also might freeze the first client's application while it is waiting to get rid of the job. Also, there are frequent complaints about various jobs being printed with their pages mixed with each other. A better concept -is the usage of a "print server": it routes all jobs through one +is the usage of a "print server": it routes all jobs through one central system, which responds immediately, takes jobs from multiple concurrent clients at the same time and in turn transfers them to the printer(s) in the correct order. -

    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients

    -Most traditionally configured Unix print servers acting on behalf of +

    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients

    +Most traditionally configured UNIX print servers acting on behalf of Samba's Windows clients represented a really simple setup. Their only -task was to manage the "raw" spooling of all jobs handed to them by +task was to manage the "raw" spooling of all jobs handed to them by Samba. This approach meant that the Windows clients were expected to -prepare the print job file in such a way that it became fit to be fed to -the printing device. Here a native (vendor-supplied) Windows printer +prepare the print job file that it s ready to be sent to the printing +device. Here a native (vendor-supplied) Windows printer driver for the target device needed to be installed on each and every client.

    -Of course you can setup CUPS, Samba and your Windows clients in the +It is possible to configure CUPS, Samba and your Windows clients in the same, traditional and simple way. When CUPS printers are configured for RAW print-through mode operation it is the responsibility of the Samba client to fully render the print job (file). The file must be @@ -8436,24 +8097,26 @@ sent in a format that is suitable for direct delivery to the printer. Clients need to run the vendor-provided drivers to do this. In this case CUPS will NOT do any print file format conversion work. -

    Driver Installation Methods on Windows Clients

    +

    Driver Installation Methods on Windows Clients

    The printer drivers on the Windows clients may be installed in two functionally different ways:

    • manually install the drivers locally on each client, one by one; this yields the old LanMan style printing; it uses a \\sambaserver\printershare -type of connection.

    • deposit and prepare the drivers (for later download) on +type of connection.

    • + + deposit and prepare the drivers (for later download) on the print server (Samba); this enables the clients to use -"Point'n'Print" to get drivers semi-automatically installed the +"Point and Print" to get drivers semi-automatically installed the first time they access the printer; with this method NT/2K/XP clients use the SPOOLSS/MS-RPC type printing calls.

    The second method is recommended for use over the first. -

    Explicitly enable "raw" printing for -application/octet-stream!

    +

    Explicitly enable "raw" printing for +application/octet-stream!

    If you use the first option (drivers are installed on the client side), there is one setting to take care of: CUPS needs to be told -that it should allow "raw" printing of deliberate (binary) file +that it should allow "raw" printing of deliberate (binary) file formats. The CUPS files that need to be correctly set for RAW mode printers to work are:

    • /etc/cups/mime.types @@ -8463,68 +8126,66 @@ be uncommented to allow RAW mode operation. In/etc/cups/mime.types make sure this line is present: 

      -
  application/octet-stream
-

      In /etc/cups/mime.convs, have this line: -

      -
+
        application/octet-stream   application/vnd.cups-raw   0   - 
-
 
      
 If these two files are not set up correctly for raw Windows client
 printing, you may encounter the dreaded Unable to
 convert file 0 in your CUPS error_log file. 
 
      Note
      editing the mime.convs and the
 mime.types file does not
-enforce "raw" printing, it only
+enforce "raw" printing, it only
 allows it.
-
      Background. 
+

    Background.  CUPS being a more security-aware printing system than traditional ones does not by default allow a user to send deliberate (possibly binary) data to printing devices. This could be easily abused to launch a -"Denial of Service" attack on your printer(s), causing at the least -the loss of a lot of paper and ink. "Unknown" data are tagged by CUPS +"Denial of Service" attack on your printer(s), causing at the least +the loss of a lot of paper and ink. "Unknown" data are tagged by CUPS as MIME type: application/octet-stream and not allowed to go to the printer. By default, you can only send other -(known) MIME types "raw". Sending data "raw" means that CUPS does not +(known) MIME types "raw". Sending data "raw" means that CUPS does not try to convert them and passes them to the printer untouched (see next chapter for even more background explanations).

    This is all you need to know to get the CUPS/Samba combo printing -"raw" files prepared by Windows clients, which have vendor drivers +"raw" files prepared by Windows clients, which have vendor drivers locally installed. If you are not interested in background information about more advanced CUPS/Samba printing, simply skip the remaining sections of this chapter. -

    Three familiar Methods for driver upload plus a new one

    +

    Three familiar Methods for driver upload plus a new one

    If you want to use the MS-RPC type printing, you must upload the drivers onto the Samba server first ([print$] share). For a discussion on how to deposit printer drivers on the Samba host (so that the Windows clients can download and use them via -"Point'n'Print") please also refer to the previous chapter of this +"Point'n'Print") please also refer to the previous chapter of this HOWTO Collection. There you will find a description or reference to three methods of preparing the client drivers on the Samba server: -

    • the GUI, "Add Printer Wizard" +

      • the GUI, "Add Printer Wizard" upload-from-a-Windows-client -method;

      • the commandline, "smbclient/rpcclient" +method;

      • the commandline, "smbclient/rpcclient" upload-from-a-UNIX-workstation -method;

      • the Imprints Toolset +method;

      • + + the Imprints Toolset method.

      These 3 methods apply to CUPS all the same. A new and more convenient way to load the Windows drivers into Samba is provided -provided if you use CUPS: -

      • the cupsaddsmb +if you use CUPS: +

        • the cupsaddsmb utility.

        cupsaddsmb is discussed in much detail further below. But we will first explore the CUPS filtering system and compare the Windows and UNIX printing architectures. -

    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download

    -Still reading on? Good. Let's go into more detail then. We now know -how to set up a "dump" printserver, that is, a server which is spooling -printjobs "raw", leaving the print data untouched. +

    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download

    +Are you still following this? Good. Let's go into more detail then. We now know +how to set up a "dump" printserver, that is, a server which is spooling +printjobs "raw", leaving the print data untouched.

    Possibly you need to setup CUPS in a more smart way. The reasons could be manifold: @@ -8535,33 +8196,33 @@ peaks in printing? Which departments prints how much?

  • Maybe you are asked to setup a print quota system: users should not be able to print more jobs, once they have surpassed a given limit per period?

  • Maybe your previous network printing setup is a mess -and shall be re-organized from a clean beginning?

  • Maybe you have experiencing too many "Blue Screens", -originating from poorly debugged printer drivers running in NT "kernel -mode"?

    • +and shall be re-organized from a clean beginning?

  • Maybe you have experiencing too many "Blue Screens", +originating from poorly debugged printer drivers running in NT "kernel +mode"?

    • These goals cannot be achieved by a raw print server. To build a server meeting these requirements, you'll first need to learn about how CUPS works and how you can enable its features.

    What follows is the comparison of some fundamental concepts for -Windows and Unix printing; then is the time for a description of the +Windows and UNIX printing; then is the time for a description of the CUPS filtering system, how it works and how you can tweak it. -

    GDI on Windows -- PostScript on Unix

    +

    GDI on Windows -- PostScript on UNIX

    Network printing is one of the most complicated and error-prone day-to-day tasks any user or an administrator may encounter. This is true for all OS platforms. And there are reasons for this. -

    +

    You can't expect for most file formats to just throw them towards printers and they get printed. There needs to be a file format conversion in between. The problem is: there is no common standard for print file formats across all manufacturers and printer types. While PostScript (trademark held by Adobe), and, to an extent, PCL (trademark held by HP), have developed -into semi-official "standards", by being the most widely used PDLs +into semi-official "standards", by being the most widely used PDLs (Page Description Languages), there are still -many manufacturers who "roll their own" (their reasons may be +many manufacturers who "roll their own" (their reasons may be unacceptable license fees for using printer-embedded PostScript interpreters, etc.). -

    Windows Drivers, GDI and EMF

    +

    Windows Drivers, GDI and EMF

    In Windows OS, the format conversion job is done by the printer drivers. On MS Windows OS platforms all application programmers have at their disposal a built-in API, the GDI (Graphical Device @@ -8571,23 +8232,24 @@ all Windows programs, to draw pictures, fonts and documents on screen as well as on paper (=print). Therefore printer driver developers can standardize on a well-defined GDI output for their own driver -input. Achieving WYSIWYG ("What You See Is What You Get") is +input. Achieving WYSIWYG ("What You See Is What You Get") is relatively easy, because the on-screen graphic primitives, as well as the on-paper drawn objects, come from one common source. This source, the GDI, produces often a file format called EMF (Enhanced MetaFile). The EMF is processed by the printer driver and converted to the printer-specific file format.

    Note

    + To the GDI foundation in MS Windows, Apple has chosen to put paper and screen output on a common foundation for their -(BSD-Unix-based, did you know??) Mac OS X and Darwin Operating -Systems.Their Core Graphic Engine uses a -PDF derivate for all display work. +(BSD-UNIX-based, did you know??) Mac OS X and Darwin Operating +Systems. Their Core Graphic Engine uses a +PDF derivative for all display work.

    -

    Figure 19.1. Windows Printing to a local Printer

    Windows Printing to a local Printer

    -

    Unix Printfile Conversion and GUI Basics

    -In Unix and Linux, there is no comparable layer built into the OS +

    Figure 19.1. Windows Printing to a local Printer

    Windows Printing to a local Printer

    +

    UNIX Printfile Conversion and GUI Basics

    +In UNIX and Linux, there is no comparable layer built into the OS kernel(s) or the X (screen display) server. Every application is responsible for itself to create its print output. Fortunately, most use PostScript. That gives at least some common ground. Unfortunately, @@ -8597,17 +8259,17 @@ the same document is displayed on screen and how it is presented on paper. WYSIWYG is more difficult to achieve. This goes back to the time decades ago, when the predecessors of X.org, designing the UNIX foundations and protocols for Graphical User -Interfaces refused to take over responsibility for "paper output" +Interfaces refused to take over responsibility for "paper output" also, as some had demanded at the time, and restricted itself to -"on-screen only". (For some years now, the "Xprint" project has been +"on-screen only". (For some years now, the "Xprint" project has been under development, attempting to build printing support into the X framework, including a PostScript and a PCL driver, but it is not yet ready for prime time.) You can see this unfavorable inheritance up to -the present day by looking into the various "font" directories on your +the present day by looking into the various "font" directories on your system; there are separate ones for fonts used for X display and fonts to be used on paper. -

    Background.  -The PostScript programming language is an "invention" by Adobe Inc., +

    Background.  +The PostScript programming language is an "invention" by Adobe Inc., but its specifications have been published to the full. Its strength lies in its powerful abilities to describe graphical objects (fonts, shapes, patterns, lines, curves, dots...), their attributes (color, @@ -8616,69 +8278,71 @@ shift...) them. Because of its open specification, anybody with the skill can start writing his own implementation of a PostScript interpreter and use it to display PostScript files on screen or on paper. Most graphical output devices are based on the concept of -"raster images" or "pixels" (one notable exception are pen +"raster images" or "pixels" (one notable exception are pen plotters). Of course, you can look at a PostScript file in its textual form and you will be reading its PostScript code, the language instructions which need to be interpreted by a rasterizer. Rasterizers produce pixel images, which may be displayed on screen by a viewer program or on paper by a printer. -

    PostScript and Ghostscript

    -So, Unix is lacking a common ground for printing on paper and -displaying on screen. Despite this unfavorable legacy for Unix, basic +

    PostScript and Ghostscript

    +So, UNIX is lacking a common ground for printing on paper and +displaying on screen. Despite this unfavorable legacy for UNIX, basic printing is fairly easy: if you have PostScript printers at your disposal! The reason is: these devices have a built-in PostScript -language "interpreter", also called a Raster Image +language "interpreter", also called a Raster Image Processor (RIP), (which makes them more expensive than other types of printers); throw PostScript towards them, and they will spit out your printed pages. Their RIP is doing all the hard work of converting the PostScript drawing commands into a bitmap picture as you see it on paper, in a resolution as done by your printer. This is no different to PostScript printing of a file from a Windows origin. -

    Note

    Traditional Unix programs and printing systems -- while -using PostScript -- are largely not PPD-aware. PPDs are "PostScript -Printer Description" files. They enable you to specify and control all +

    Note

    + +Traditional UNIX programs and printing systems -- while +using PostScript -- are largely not PPD-aware. PPDs are "PostScript +Printer Description" files. They enable you to specify and control all options a printer supports: duplexing, stapling, punching... Therefore -Unix users for a long time couldn't choose many of the supported +UNIX users for a long time couldn't choose many of the supported device and job options, unlike Windows or Apple users. But now there -is CUPS.... ;-) +is CUPS....

    -

    Figure 19.2. Printing to a Postscript Printer

    Printing to a Postscript Printer

    -

    +

    Figure 19.2. Printing to a Postscript Printer

    Printing to a Postscript Printer

    +

    However, there are other types of printers out there. These don't know how to print PostScript. They use their own Page Description Language (PDL, often proprietary). To print to them is much -more demanding. Since your Unix applications mostly produce +more demanding. Since your UNIX applications mostly produce PostScript, and since these devices don't understand PostScript, you need to convert the printfiles to a format suitable for your printer on the host, before you can send it away. -

    Ghostscript -- the Software RIP for non-PostScript Printers

    +

    Ghostscript -- the Software RIP for non-PostScript Printers

    Here is where Ghostscript kicks in. Ghostscript is the traditional (and quite powerful) PostScript interpreter used on -Unix platforms. It is a RIP in software, capable to do a +UNIX platforms. It is a RIP in software, capable to do a lot of file format conversions, for a very broad spectrum of hardware devices as well as software file formats. Ghostscript technology and drivers is what enables PostScript printing to non-PostScript hardware.

    -

    Figure 19.3. Ghostscript as a RIP for non-postscript printers

    Ghostscript as a RIP for non-postscript printers

    +

    Figure 19.3. Ghostscript as a RIP for non-postscript printers

    Ghostscript as a RIP for non-postscript printers

    Tip

    -Use the "gs -h" command to check for all built-in "devices" of your +Use the "gs -h" command to check for all built-in "devices" of your Ghostscript version. If you specify e.g. a parameter of -sDEVICE=png256 on your Ghostscript command line, you are asking Ghostscript to convert the input into a PNG -file. Naming a "device" on the commandline is the most important +file. Naming a "device" on the commandline is the most important single parameter to tell Ghostscript how exactly it should render the input. New Ghostscript versions are released at fairly regular intervals, now by artofcode LLC. They are initially put under the -"AFPL" license, but re-released under the GNU GPL as soon as the next +"AFPL" license, but re-released under the GNU GPL as soon as the next AFPL version appears. GNU Ghostscript is probably the version installed on most Samba systems. But it has got some -deficiencies. Therefore ESP Ghostscript was developed as an +deficiencies. Therefore ESP Ghostscript was developed as an enhancement over GNU Ghostscript, with lots of bug-fixes, additional devices and improvements. It is jointly maintained by developers from CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat and Debian. It includes -the "cups" device (essential to print to non-PS printers from CUPS). -

    PostScript Printer Description (PPD) Specification

    +the "cups" device (essential to print to non-PS printers from CUPS). +

    PostScript Printer Description (PPD) Specification

    While PostScript in essence is a Page Description Language (PDL) to represent the page layout in a device independent way, real world print jobs are @@ -8704,15 +8368,16 @@ user selections are somehow written (in the form of special PostScript, PJL, JCL or vendor-dependent commands) into the PostScript file created by the driver.

    Warning

    + A PostScript file that was created to contain device-specific commands for achieving a certain print job output (e.g. duplexed, stapled and punched) on a specific target machine, may not print as expected, or may not be printable at all on other models; it also may not be fit for further processing by software (e.g. by a PDF distilling program). -

    CUPS can use all Windows-formatted Vendor PPDs

    +

    CUPS can use all Windows-formatted Vendor PPDs

    CUPS can handle all spec-compliant PPDs as supplied by the manufacturers for their PostScript models. Even if a -Unix/Linux-illiterate vendor might not have mentioned our favorite +UNIX/Linux-illiterate vendor might not have mentioned our favorite OS in his manuals and brochures -- you can safely trust this: if you get hold of the Windows NT version of the PPD, you can use it unchanged in CUPS and thus access the full @@ -8724,6 +8389,8 @@ immediately. CUPS in all versions after 1.1.19 has a much more strict internal PPD parsing and checking code enabled; in case of printing trouble this online resource should be one of your first pitstops.

    Warning

    + + For real PostScript printers don't use the Foomatic or cupsomatic PPDs from Linuxprinting.org. With these devices the original @@ -8736,7 +8403,7 @@ your LAN has the PostScript driver installed, just use access the Windows directory where all printer driver files are stored. First look in the W32X86/2 subdir for the PPD you are seeking. -

    CUPS also uses PPDs for non-PostScript Printers

    +

    CUPS also uses PPDs for non-PostScript Printers

    CUPS also uses specially crafted PPDs to handle non-PostScript printers. These PPDs are usually not available from the vendors (and no, you can't just take the PPD of a Postscript printer with the same @@ -8744,7 +8411,7 @@ model name and hope it works for the non-PostScript version too). To understand how these PPDs work for non-PS printers we first need to dive deeply into the CUPS filtering and file format conversion architecture. Stay tuned. -

    The CUPS Filtering Architecture

    +

    The CUPS Filtering Architecture

    The core of the CUPS filtering system is based on Ghostscript. In addition to Ghostscript, CUPS uses some other filters of its own. You (or your OS vendor) may have @@ -8760,33 +8427,37 @@ given input data format.

    If CUPS rasterizes a PostScript file natively to a bitmap, this is done in 2 stages: -

    • the first stage uses a Ghostscript device named "cups" +

      • the first stage uses a Ghostscript device named "cups" (this is since version 1.1.15) and produces a generic raster format -called "CUPS raster". -

      • the second stage uses a "raster driver" which converts +called "CUPS raster". +

      • the second stage uses a "raster driver" which converts the generic CUPS raster to a device specific raster.

      -Make sure your Ghostscript version has the "cups" device compiled in +Make sure your Ghostscript version has the "cups" device compiled in (check with gs -h | grep cups). Otherwise you may encounter the dreaded Unable to convert file -0 in your CUPS error_log file. To have "cups" as a +0 in your CUPS error_log file. To have "cups" as a device in your Ghostscript, you either need to patch GNU -Ghostscript and re-compile or use ESP Ghostscript. The +Ghostscript and re-compile or use ESP Ghostscript. The superior alternative is ESP Ghostscript: it supports not just CUPS, but 300 other devices too (while GNU Ghostscript supports only about 180). Because of this broad output device support, ESP Ghostscript is the first choice for non-CUPS spoolers too. It is now recommended by Linuxprinting.org for all spoolers.

      + + CUPS printers may be setup to use external rendering paths. One of the most common ones is provided by the Foomatic/cupsomatic concept, from Linuxprinting.org. This uses the classical Ghostscript approach, doing everything in one -step. It doesn't use the "cups" device, but one of the many +step. It doesn't use the "cups" device, but one of the many others. However, even for Foomatic/cupsomatic usage, best results and + broadest printer model support is provided by ESP Ghostscript (more about cupsomatic/Foomatic, particularly the new version called now foomatic-rip, follows below). -

      MIME types and CUPS Filters

      +

      MIME types and CUPS Filters

      + CUPS reads the file /etc/cups/mime.types (and all other files carrying a *.types suffix in the same directory) upon startup. These files contain the MIME @@ -8795,10 +8466,10 @@ auto-typing routines. The rule syntax is explained in the man page for mime.types and in the comments section of the mime.types file itself. A simple rule reads like this: +

      + 

      -
  application/pdf         pdf string(0,%PDF)
-

      This means: if a filename has either a .pdf suffix, or if the magic @@ -8807,9 +8478,7 @@ beginning of the file itself (offset 0 from the start), then it is a PDF file (application/pdf). Another rule is this: 

      -
  application/postscript  ai eps ps string(0,%!) string(0,<04>%!)
-

      Its meaning: if the filename has one of the suffixes .ai, .eps, @@ -8839,7 +8508,7 @@ CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI and a lot of image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster, PNM, PBM, SGI-RGB and some more) and their associated MIME types with its filters. -

      MIME type Conversion Rules

      +

      MIME type Conversion Rules

      CUPS reads the file /etc/cups/mime.convs (and all other files named with a *.convs suffix in the same directory) upon startup. These files contain @@ -8848,39 +8517,31 @@ conversion filter which can produce the output from the input type and virtual costs associated with this conversion. One example line reads like this: 

      -
  application/pdf         application/postscript   33   pdftops
-

      This means that the pdftops filter will take application/pdf as input and produce application/postscript as output, the virtual cost of this operation is 33 CUPS-$. The next filter is more expensive, costing 66 CUPS-$: -

      -
+
        application/vnd.hp-HPGL application/postscript   66   hpgltops
-
 
      
 This is the hpgltops, which processes HP-GL
 plotter files to PostScript.
-
      -
+
        application/octet-stream
-
 
      
 Here are two more examples: 
-
      -
+
        application/x-shell     application/postscript   33    texttops
  text/plain              application/postscript   33    texttops
-
 
      
 The last two examples name the texttops filter
-to work on "text/plain" as well as on "application/x-shell". (Hint:
+to work on "text/plain" as well as on "application/x-shell". (Hint:
 this differentiation is needed for the syntax highlighting feature of
-"texttops").
-

      Filter Requirements

      +"texttops"). +

      Filter Requirements

      There are many more combinations named in mime.convs. However, you are not limited to use the ones pre-defined there. You can plug in any filter you like into the CUPS framework. It must meet, or must be made @@ -8890,24 +8551,24 @@ needs, and put in the right lines in mime.types and mime.convs, then it will work seamlessly inside CUPS!

      Tip

      -The mentioned "CUPS requirements" for filters are simple. Take +The mentioned "CUPS requirements" for filters are simple. Take filenames or stdin as input and write to stdout. They should take these 5 or 6 arguments: printer job user title copies options [filename]

      Printer

      The name of the printer queue (normally this is the name of the filter being run)

      job

      The numeric job ID for the job being -printed

      Printer

      The string from the originating-user-name -attribute

      Printer

      The string from the job-name attribute

      Printer

      The numeric value from the number-copies -attribute

      Printer

      The job options

      Printer

      (Optionally) The print request file (if missing, +printed

      user

      The string from the originating-user-name +attribute

      title

      The string from the job-name attribute

      copies

      The numeric value from the number-copies +attribute

      options

      The job options

      filename

      (Optionally) The print request file (if missing, filters expected data fed through stdin). In most cases it is very easy to write a simple wrapper script around existing -filters to make them work with CUPS.

      Prefilters

      -As was said, PostScript is the central file format to any Unix based +filters to make them work with CUPS.

    Prefilters

    +As was said, PostScript is the central file format to any UNIX based printing system. From PostScript, CUPS generates raster data to feed non-PostScript printers.

    But what is happening if you send one of the supported non-PS formats -to print? Then CUPS runs "pre-filters" on these input formats to +to print? Then CUPS runs "pre-filters" on these input formats to generate PostScript first. There are pre-filters to create PS from ASCII text, PDF, DVI or HP-GL. The outcome of these filters is always of MIME type application/postscript (meaning that @@ -8919,8 +8580,8 @@ MIME type application/vnd.cups-postscript (not application/postscript), meaning it has the print options already embedded into the file.

    -

    Figure 19.4. Prefiltering in CUPS to form Postscript

    Prefiltering in CUPS to form Postscript

    -

    pstops

    +

    Figure 19.4. Prefiltering in CUPS to form Postscript

    Prefiltering in CUPS to form Postscript

    +

    pstops

    pstopsis the filter to convert application/postscript to application/vnd.cups-postscript. It was said @@ -8928,19 +8589,19 @@ above that this filter inserts all device-specific print options (commands to the printer to ask for the duplexing of output, or stapling an punching it, etc.) into the PostScript file.

    -

    Figure 19.5. Adding Device-specific Print Options

    Adding Device-specific Print Options

    +

    Figure 19.5. Adding Device-specific Print Options

    Adding Device-specific Print Options

    This is not all: other tasks performed by it are:

    • selecting the range of pages to be printed (if you choose to -print only pages "3, 6, 8-11, 16, 19-21", or only the odd numbered +print only pages "3, 6, 8-11, 16, 19-21", or only the odd numbered ones)

    • putting 2 or more logical pages on one sheet of paper (the -so-called "number-up" function) +so-called "number-up" function)

    • counting the pages of the job to insert the accounting information into the /var/log/cups/page_log -

    pstoraster

    +

    pstoraster

    pstoraster is at the core of the CUPS filtering system. It is responsible for the first stage of the rasterization process. Its input is of MIME type application/vnd.cups-postscript; @@ -8949,34 +8610,34 @@ yet meant to be printable. Its aim is to serve as a general purpose input format for more specialized raster drivers, that are able to generate device-specific printer data.

    -

    Figure 19.6. Postscript to intermediate Raster format

    Postscript to intermediate Raster format

    +

    Figure 19.6. Postscript to intermediate Raster format

    Postscript to intermediate Raster format

    CUPS raster is a generic raster format with powerful features. It is able to include per-page information, color profiles and more to be used by the following downstream raster drivers. Its MIME type is registered with IANA and its specification is of course completely open. It is designed to make it very easy and inexpensive for -manufacturers to develop Linux and Unix raster drivers for their +manufacturers to develop Linux and UNIX raster drivers for their printer models, should they choose to do so. CUPS always takes care for the first stage of rasterization so these vendors don't need to care about Ghostscript complications (in fact, there is currently more than one vendor financing the development of CUPS raster drivers).

    -

    Figure 19.7. CUPS-raster production using Ghostscript

    CUPS-raster production using Ghostscript

    +

    Figure 19.7. CUPS-raster production using Ghostscript

    CUPS-raster production using Ghostscript

    CUPS versions before version 1.1.15 were shipping a binary (or source -code) standalone filter, named "pstoraster". pstoraster was derived +code) standalone filter, named "pstoraster". pstoraster was derived from GNU Ghostscript 5.50, and could be installed besides and in addition to any GNU or AFPL Ghostscript package without conflicting.

    From version 1.1.15, this has changed. The functions for this has been integrated back into Ghostscript (now based on GNU Ghostscript version -7.05). The "pstoraster" filter is now a simple shell script calling +7.05). The "pstoraster" filter is now a simple shell script calling gs with the -sDEVICE=cups parameter. If your Ghostscript doesn't show a success on asking for gs -h |grep cups, you might not be able to print. Update your Ghostscript then! -

    imagetops and imagetoraster

    +

    imagetops and imagetoraster

    Above in the section about prefilters, we mentioned the prefilter that generates PostScript from image formats. The imagetoraster filter is used to convert directly from image to raster, without the @@ -8984,13 +8645,13 @@ intermediate PostScript stage. It is used more often than the above mentioned prefilters. Here is a summarizing flowchart of image file filtering:

    -

    Figure 19.8. Image format to CUPS-raster format conversion

    Image format to CUPS-raster format conversion

    -

    rasterto [printers specific]

    +

    Figure 19.8. Image format to CUPS-raster format conversion

    Image format to CUPS-raster format conversion

    +

    rasterto [printers specific]

    CUPS ships with quite some different raster drivers processing CUPS raster. On my system I find in /usr/lib/cups/filter/ these: -rastertoalps, rastertobj, rastertoepson, rastertoescp, -rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo, -rastertoescp, rastertohp and +rastertoalps, rastertobj, rastertoepson, rastertoescp, +rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo, +rastertoescp, rastertohp and rastertoprinter. Don't worry if you have less than this; some of these are installed by commercial add-ons to CUPS (like rastertoturboprint), others (like @@ -8998,13 +8659,13 @@ than this; some of these are installed by commercial add-ons to CUPS development projects (such as Gimp-Print) wanting to cooperate as closely as possible with CUPS.

    -

    Figure 19.9. Raster to Printer Specific formats

    Raster to Printer Specific formats

    -

    CUPS Backends

    -The last part of any CUPS filtering chain is a "backend". Backends +

    Figure 19.9. Raster to Printer Specific formats

    Raster to Printer Specific formats

    +

    CUPS Backends

    +The last part of any CUPS filtering chain is a "backend". Backends are special programs that send the print-ready file to the final device. There is a separate backend program for any transfer -"protocol" of sending printjobs over the network, or for every local -interface. Every CUPS printqueue needs to have a CUPS "device-URI" +"protocol" of sending printjobs over the network, or for every local +interface. Every CUPS printqueue needs to have a CUPS "device-URI" associated with it. The device URI is the way to encode the backend used to send the job to its destination. Network device-URIs are using two slashes in their syntax, local device URIs only one, as you can @@ -9031,8 +8692,8 @@ This backend sends printfiles to LPR/LPD connected network printers. An example for the CUPS device-URI to use is: lpd://remote_host_name/remote_queue_name

    AppSocket/HP JetDirect

    -This backend sends printfiles to AppSocket (a.k.a. "HP -JetDirect") connected network printers. An example for the CUPS +This backend sends printfiles to AppSocket (a.k.a. "HP +JetDirect") connected network printers. An example for the CUPS device-URI to use is: socket://10.11.12.13:9100

    ipp

    @@ -9054,7 +8715,7 @@ This backend sends printfiles to printers shared by a Windows host. An example for CUPS device-URIs to use are: smb://workgroup/server/printersharename Or -Smb://server/printersharename +smb://server/printersharename or smb://username:password@workgroup/server/printersharename or @@ -9067,11 +8728,11 @@ root user create it: ln -s `which smbspool`

    It is easy to write your own backends as Shell or Perl scripts, if you need any modification or extension to the CUPS print system. One -reason could be that you want to create "special" printers which send -the printjobs as email (through a "mailto:/" backend), convert them to -PDF (through a "pdfgen:/" backend) or dump them to "/dev/null" (In +reason could be that you want to create "special" printers which send +the printjobs as email (through a "mailto:/" backend), convert them to +PDF (through a "pdfgen:/" backend) or dump them to "/dev/null" (In fact I have the system-wide default printer set up to be connected to -a "devnull:/" backend: there are just too many people sending jobs +a "devnull:/" backend: there are just too many people sending jobs without specifying a printer, or scripts and programs which don't name a printer. The system-wide default deletes the job and sends a polite mail back to the $USER asking him to always specify a correct @@ -9080,29 +8741,25 @@ printername). Not all of the mentioned backends may be present on your system or usable (depending on your hardware configuration). One test for all available CUPS backends is provided by the lpinfo -utility. Used with the -v parameter, it lists +utility. Used with the -v parameter, it lists all available backends: 

    -
- lpinfo -v
-
-

    cupsomatic/Foomatic -- how do they fit into the Picture?

    -"cupsomatic" filters may be the most widely used on CUPS +$ lpinfo -v +

    cupsomatic/Foomatic -- how do they fit into the Picture?

    +"cupsomatic" filters may be the most widely used on CUPS installations. You must be clear about the fact that these were not -developed by the CUPS people. They are a "Third Party" add-on to +developed by the CUPS people. They are a "Third Party" add-on to CUPS. They utilize the traditional Ghostscript devices to render jobs for CUPS. When troubleshooting, you should know about the difference. Here the whole rendering process is done in one stage, -inside Ghostscript, using an appropriate "device" for the target -printer. cupsomatic uses PPDs which are generated from the "Foomatic" +inside Ghostscript, using an appropriate "device" for the target +printer. cupsomatic uses PPDs which are generated from the "Foomatic" Printer & Driver Database at Linuxprinting.org.

    You can recognize these PPDs from the line calling the cupsomatic filter: 

    -
- *cupsFilter: "application/vnd.cups-postscript  0  cupsomatic"
-
+ *cupsFilter: "application/vnd.cups-postscript  0  cupsomatic"

    This line you may find amongst the first 40 or so lines of the PPD file. If you have such a PPD installed, the printer shows up in the @@ -9111,18 +8768,18 @@ the driver description. cupsomatic is a Perl script that runs Ghostscript, with all the complicated commandline options auto-constructed from the selected PPD and commandline options give to the printjob. -

    +

    However, cupsomatic is now deprecated. Its PPDs (especially the first generation of them, still in heavy use out there) are not meeting the Adobe specifications. You might also suffer difficulties when you try -to download them with "Point'n'Print" to Windows clients. A better, +to download them with "Point'n'Print" to Windows clients. A better, and more powerful successor is now in a very stable Beta-version available: it is called foomatic-rip. To use foomatic-rip as a filter with CUPS, you need the new-type PPDs. These have a similar, but different line: 

     
- *cupsFilter: "application/vnd.cups-postscript  0  foomatic-rip"
+ *cupsFilter: "application/vnd.cups-postscript  0  foomatic-rip"

    The PPD generating engine at Linuxprinting.org has been revamped. @@ -9136,11 +8793,11 @@ print-options from page to page, in the middle of a job. And the best thing is: the new foomatic-rip now works seamlessly with all legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR etc.), providing for them access to use PPDs for their printing! -

    The Complete Picture

    +

    The Complete Picture

    If you want to see an overview over all the filters and how they relate to each other, the complete picture of the puzzle is at the end of this document. -

    mime.convs

    +

    mime.convs

    CUPS auto-constructs all possible filtering chain paths for any given MIME type, and every printer installed. But how does it decide in favor or against a specific alternative? (There may often be cases, @@ -9148,39 +8805,37 @@ where there is a choice of two or more possible filtering chains for the same target printer). Simple: you may have noticed the figures in the 3rd column of the mime.convs file. They represent virtual costs assigned to this filter. Every possible filtering chain will sum up to -a total "filter cost". CUPS decides for the most "inexpensive" route. +a total "filter cost". CUPS decides for the most "inexpensive" route.

    Tip

    The setting of FilterLimit 1000 in cupsd.conf will not allow more filters to run concurrently than will consume a total of 1000 virtual filter cost. This is a very efficient way to limit the load of any CUPS -server by setting an appropriate "FilterLimit" value. A FilterLimit of +server by setting an appropriate "FilterLimit" value. A FilterLimit of 200 allows roughly 1 job at a time, while a FilterLimit of 1000 allows approximately 5 jobs maximum at a time. -

    "Raw" printing

    -You can tell CUPS to print (nearly) any file "raw". "Raw" means it -will not be filtered. CUPS will send the file to the printer "as is" +

    "Raw" printing

    +You can tell CUPS to print (nearly) any file "raw". "Raw" means it +will not be filtered. CUPS will send the file to the printer "as is" without bothering if the printer is able to digest it. Users need to take care themselves that they send sensible data formats only. Raw -printing can happen on any queue if the "-o raw" option is specified +printing can happen on any queue if the "-o raw" option is specified on the command line. You can also set up raw-only queues by simply not associating any PPD with it. This command: 

    -
- lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E
-
+$ lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E

    -sets up a queue named "rawprinter", connected via the "socket" -protocol (a.k.a. "HP JetDirect") to the device at IP address +sets up a queue named "rawprinter", connected via the "socket" +protocol (a.k.a. "HP JetDirect") to the device at IP address 11.12.1.3.14, using port 9100. (If you had added a PPD with -P /path/to/PPD to this command line, you would -have installed a "normal" printqueue. +have installed a "normal" printqueue.

    -CUPS will automatically treat each job sent to a queue as a "raw" one, +CUPS will automatically treat each job sent to a queue as a "raw" one, if it can't find a PPD associated with the queue. However, CUPS will only send known MIME types (as defined in its own mime.types file) and refuse others. -

    "application/octet-stream" printing

    +

    "application/octet-stream" printing

    Any MIME type with no rule in the /etc/cups/mime.types file is regarded as unknown or application/octet-stream and will not be @@ -9189,56 +8844,50 @@ you will probably have experienced the fact that printjobs originating from Windows clients were not printed. You may have found an error message in your CUPS logs like: 

    -
  Unable to convert file 0 to printable format for job
-

    -To enable the printing of "application/octet-stream" files, edit +To enable the printing of "application/octet-stream" files, edit these two files:

    • /etc/cups/mime.convs

    • /etc/cups/mime.types

    Both contain entries (at the end of the respective files) which must be uncommented to allow RAW mode operation for application/octet-stream. In /etc/cups/mime.types make sure this line is present: -

    -
+
      application/octet-stream
-
 
    
 This line (with no specific auto-typing rule set) makes all files
 not otherwise auto-typed a member of application/octet-stream. In
 /etc/cups/mime.convs, have this
 line: 
 
    -
  application/octet-stream   application/vnd.cups-raw   0   -
-
-
    
+

    This line tells CUPS to use the Null Filter -(denoted as "-", doing... nothing at all) on +(denoted as "-", doing... nothing at all) on application/octet-stream, and tag the result as application/vnd.cups-raw. This last one is always a green light to the CUPS scheduler to now hand the file over -to the "backend" connecting to the printer and sending it over. +to the "backend" connecting to the printer and sending it over.

    Note

    Editing the mime.convs and the mime.types file does not -enforce "raw" printing, it only +enforce "raw" printing, it only allows it.

    Background.  CUPS being a more security-aware printing system than traditional ones does not by default allow one to send deliberate (possibly binary) data to printing devices. (This could be easily abused to launch a Denial of Service attack on your printer(s), causing at least the loss -of a lot of paper and ink...) "Unknown" data are regarded by CUPS +of a lot of paper and ink...) "Unknown" data are regarded by CUPS as MIME type application/octet-stream. While you -can send data "raw", the MIME type for these must +can send data "raw", the MIME type for these must be one that is known to CUPS and an allowed one. The file -/etc/cups/mime.types defines the "rules" how CUPS +/etc/cups/mime.types defines the "rules" how CUPS recognizes MIME types. The file /etc/cups/mime.convs decides which file conversion filter(s) may be applied to which MIME types. -

    PostScript Printer Descriptions (PPDs) for non-PS Printers

    +

    PostScript Printer Descriptions (PPDs) for non-PS Printers

    Originally PPDs were meant to be used for PostScript printers only. Here, they help to send device-specific commands and settings to the RIP which processes the jobfile. CUPS has extended this @@ -9251,18 +8900,16 @@ printers the Ghostscript RIP runs on the host computer.

    PPDs for a non-PS printer have a few lines that are unique to CUPS. The most important one looks similar to this: -

    -
+
      *cupsFilter: application/vnd.cups-raster  66   rastertoprinter
-
 
    
 It is the last piece in the CUPS filtering puzzle. This line tells the
-CUPS daemon to use as a last filter "rastertoprinter".  This filter
-should be served as input an "application/vnd.cups-raster" MIME type
+CUPS daemon to use as a last filter "rastertoprinter".  This filter
+should be served as input an "application/vnd.cups-raster" MIME type
 file. Therefore CUPS should auto-construct a filtering chain, which
 delivers as its last output the specified MIME type. This is then
-taken as input to the specified "rastertoprinter" filter. After this
-the last filter has done its work ("rastertoprinter" is a Gimp-Print
+taken as input to the specified "rastertoprinter" filter. After this
+the last filter has done its work ("rastertoprinter" is a Gimp-Print
 filter), the file should go to the backend, which sends it to the
 output device.
 
    
@@ -9270,34 +8917,22 @@ CUPS by default ships only a few generic PPDs, but they are good for
 several hundred printer models. You may not be able to control
 different paper trays, or you may get larger margins than your
 specific model supports):
-
    deskjet.ppd
    older HP inkjet printers and compatible
-
    deskjet2.ppd
    newer HP inkjet printers and compatible
-
    dymo.ppd
    label printers
-
    epson9.ppd
    Epson 24pin impact printers and compatible
-
    epson24.ppd
    Epson 24pin impact printers and compatible
-
    okidata9.ppd
    Okidata 9pin impact printers and compatible
-
    okidat24.ppd
    Okidata 24pin impact printers and compatible
-
    stcolor.ppd
    older Epson Stylus Color printers
-
    stcolor2.ppd
    newer Epson Stylus Color printers
-
    stphoto.ppd
    older Epson Stylus Photo printers
-
    stphoto2.ppd
    newer Epson Stylus Photo printers
-
    laserjet.ppd
    all PCL printers. Further below is a discussion
-of several other driver/PPD-packages suitable fur use with CUPS.
-

    Difference between cupsomatic/foomatic-rip and -native CUPS printing

    +

    Table 19.1. PPD's shipped with CUPS

    PPD filePrinter type
    deskjet.ppdolder HP inkjet printers and compatible
    deskjet2.ppdnewer HP inkjet printers and compatible
    dymo.ppdlabel printers
    epson9.ppdEpson 24pin impact printers and compatible
    epson24.ppdEpson 24pin impact printers and compatible
    okidata9.ppdOkidata 9pin impact printers and compatible
    okidat24.ppdOkidata 24pin impact printers and compatible
    stcolor.ppdolder Epson Stylus Color printers
    stcolor2.ppdnewer Epson Stylus Color printers
    stphoto.ppdolder Epson Stylus Photo printers
    stphoto2.ppdnewer Epson Stylus Photo printers
    laserjet.ppdall PCL printers. Further below is a discussion of several other driver/PPD-packages suitable for use with CUPS.

    Difference between cupsomatic/foomatic-rip and +native CUPS printing

    Native CUPS rasterization works in two steps.

    • -First is the "pstoraster" step. It uses the special "cups" +First is the "pstoraster" step. It uses the special "cups" + device from ESP Ghostscript 7.05.x as its tool

    • -Second comes the "rasterdriver" step. It uses various +Second comes the "rasterdriver" step. It uses various device-specific filters; there are several vendors who provide good quality filters for this step, some are Free Software, some are Shareware/Non-Free, some are proprietary.

    Often this produces better quality (and has several more advantages) than other methods.

    -

    Figure 19.10. cupsomatic/foomatic processing versus Native CUPS

    cupsomatic/foomatic processing versus Native CUPS

    +

    Figure 19.10. cupsomatic/foomatic processing versus Native CUPS

    cupsomatic/foomatic processing versus Native CUPS

    One other method is the cupsomatic/foomatic-rip way. Note that cupsomatic is not made by the CUPS @@ -9311,6 +8946,8 @@ other (non-CUPS) spoolers. An upgrade to foomatic-rip is strongly advised, especially if you are upgrading to a recent version of CUPS too.

    + + Both the cupsomatic (old) and the foomatic-rip (new) methods from Linuxprinting.org use the traditional Ghostscript print file processing, doing everything in a single step. It therefore relies on @@ -9323,22 +8960,22 @@ Of course, you can use both methods side by side on one system (and even for one printer, if you set up different queues), and find out which works best for you.

    -cupsomatic "kidnaps" the printfile after the +cupsomatic "kidnaps" the printfile after the application/vnd.cups-postscript stage and deviates it through the CUPS-external, system wide Ghostscript -installation: Therefore the printfile bypasses the "pstoraster" filter +installation: Therefore the printfile bypasses the "pstoraster" filter (and thus also bypasses the CUPS-raster-drivers -"rastertosomething"). After Ghostscript finished its rasterization, +"rastertosomething"). After Ghostscript finished its rasterization, cupsomatic hands the rendered file directly to the CUPS backend. The flowchart above illustrates the difference between native CUPS rendering and the Foomatic/cupsomatic method. -

    Examples for filtering Chains

    +

    Examples for filtering Chains

    Here are a few examples of commonly occurring filtering chains to illustrate the workings of CUPS.

    Assume you want to print a PDF file to a HP JetDirect-connected PostScript printer, but you want to print the pages 3-5, 7, 11-13 -only, and you want to print them "2-up" and "duplex": +only, and you want to print them "2-up" and "duplex":

    • your print options (page selection as required, 2-up, duplex) are passed to CUPS on the commandline;

    • the (complete) PDF file is sent to CUPS and autotyped as application/pdf;

    • the file therefore first must pass the @@ -9346,16 +8983,14 @@ duplex) are passed to CUPS on the commandline;

    • the (complete) PDF MIME type application/postscript (a preview here would still show all pages of the original PDF);

    • the file then passes the pstops filter which applies the commandline options: it selects the pages -2-5, 7 and 11-13, creates and imposed layout "2 pages on 1 sheet" and -inserts the correct "duplex" command (as is defined in the printer's +2-5, 7 and 11-13, creates and imposed layout "2 pages on 1 sheet" and +inserts the correct "duplex" command (as is defined in the printer's PPD) into the new PostScript file; the file now is of PostScript MIME type application/vnd.cups-postscript;

    • the file goes to the socket backend, which transfers the job to the printers.

    -The resulting filter chain therefore is: -

    -pdftops --> pstops --> socket
-

    + The resulting filter chain therefore is as drawn in the image below. +

    Figure 19.11. PDF to socket chain

    PDF to socket chain

    Assume your want to print the same filter to an USB-connected Epson Stylus Photo printer, installed with the CUPS stphoto2.ppd. The first few filtering stages @@ -9365,10 +9000,10 @@ duplex) are passed to CUPS on the commandline;

  • the (complete) PDF application/pdf;

  • the file therefore first must pass the pdftops pre-filter, which produces PostScript MIME type application/postscript (a preview here -would still show all pages of the original PDF);

  • the file then passes the "pstops" filter which applies +would still show all pages of the original PDF);

  • the file then passes the "pstops" filter which applies the commandline options: it selects the pages 2-5, 7 and 11-13, -creates and imposed layout "2 pages on 1 sheet" and inserts the -correct "duplex" command... (OOoops -- this printer and his PPD +creates and imposed layout "2 pages on 1 sheet" and inserts the +correct "duplex" command... (OOoops -- this printer and his PPD don't support duplex printing at all -- this option will be ignored then) into the new PostScript file; the file now is of PostScript MIME type @@ -9379,46 +9014,44 @@ does its work (as is indicated in the printer's PPD), creating the printer-specific raster data and embedding any user-selected print-options into the print data stream;

  • the file goes to the usb backend, which transfers the job to the printers.

    • -The resulting filter chain therefore is: -

    -pdftops --> pstops --> pstoraster --> rastertoepson --> usb
-

    Sources of CUPS drivers / PPDs

    + The resulting filter chain therefore is as drawn in the image below. +

    Figure 19.12. PDF to USB chain

    PDF to USB chain

    Sources of CUPS drivers / PPDs

    On the internet you can find now many thousand CUPS-PPD files (with their companion filters), in many national languages, supporting more than 1000 non-PostScript models. -

    • ESP -PrintPro (http://wwwl.easysw.com/printpro/) (commercial, +

      • ESP +PrintPro (commercial, non-Free) is packaged with more than 3000 PPDs, ready for -successful use "out of the box" on Linux, Mac OS X, IBM-AIX, -HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital Unix and some +successful use "out of the box" on Linux, Mac OS X, IBM-AIX, +HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital UNIX and some more commercial Unices (it is written by the CUPS developers themselves and its sales help finance the further development of CUPS, as they feed their creators).

      • the Gimp-Print-Project -(http://gimp-print.sourceforge.net/) (GPL, Free Software) + (GPL, Free Software) provides around 140 PPDs (supporting nearly 400 printers, many driven to photo quality output), to be used alongside the Gimp-Print CUPS filters;

      • TurboPrint -(http://www.turboprint.com/) (Shareware, non-Free) supports + (Shareware, non-Free) supports roughly the same amount of printers in excellent quality;

      • OMNI -(http://www-124.ibm.com/developerworks/oss/linux/projects/omni/) + (LPGL, Free) is a package made by IBM, now containing support for more than 400 printers, stemming from the inheritance of IBM OS/2 Know-How ported over to Linux (CUPS support is in a Beta-stage at present);

      • HPIJS -(http://hpinkjet.sourceforge.net/) (BSD-style licenses, Free) + (BSD-style licenses, Free) supports around 150 of HP's own printers and is also providing excellent print quality now (currently available only via the Foomatic path);

      • Foomatic/cupsomatic -(http://www.linuxprinting.org/) (LPGL, Free) from + (LPGL, Free) from Linuxprinting.org are providing PPDs for practically every Ghostscript filter known to the world (including Omni, Gimp-Print and HPIJS).

      Note

      The cupsomatic/Foomatic trick from Linuxprinting.org works differently from the other drivers. This is explained elsewhere in this document. -

    Printing with Interface Scripts

    -CUPS also supports the usage of "interface scripts" as known from +

    Printing with Interface Scripts

    +CUPS also supports the usage of "interface scripts" as known from System V AT&T printing systems. These are often used for PCL printers, from applications that generate PCL print jobs. Interface scripts are specific to printer models. They have a similar role as @@ -9430,61 +9063,60 @@ realm. On HP-UX platforms they are more often used. You can use any working interface script on CUPS too. Just install the printer with the -i option: 

    -
- lpadmin -p pclprinter -v socket://11.12.13.14:9100 -i /path/to/interface-script
-
+root# lpadmin -p pclprinter -v socket://11.12.13.14:9100 \
+  -i /path/to/interface-script

    -Interface scripts might be the "unknown animal" to many. However, +Interface scripts might be the "unknown animal" to many. However, with CUPS they provide the most easy way to plug in your own custom-written filtering script or program into one specific print queue (some information about the traditional usage of interface scripts is to be found at http://playground.sun.com/printing/documentation/interface.html). -

    Network printing (purely Windows)

    +

    Network printing (purely Windows)

    Network printing covers a lot of ground. To understand what exactly goes on with Samba when it is printing on behalf of its Windows -clients, let's first look at a "purely Windows" setup: Windows clients +clients, let's first look at a "purely Windows" setup: Windows clients with a Windows NT print server. -

    From Windows Clients to an NT Print Server

    +

    From Windows Clients to an NT Print Server

    Windows clients printing to an NT-based print server have two options. They may -

    • execute the driver locally and render the GDI output +

      • execute the driver locally and render the GDI output (EMF) into the printer specific format on their own, or

      • send the GDI output (EMF) to the server, where the driver is executed to render the printer specific output.

      Both print paths are shown in the flowcharts below. -

    Driver Execution on the Client

    -In the first case the print server must spool the file as "raw", +

    Driver Execution on the Client

    +In the first case the print server must spool the file as "raw", meaning it shouldn't touch the jobfile and try to convert it in any -way. This is what traditional Unix-based print server can do too; and +way. This is what traditional UNIX-based print server can do too; and at a better performance and more reliably than NT print server. This is what most Samba administrators probably are familiar with. One -advantage of this setup is that this "spooling-only" print server may -be used even if no driver(s) for Unix are available it is sufficient +advantage of this setup is that this "spooling-only" print server may +be used even if no driver(s) for UNIX are available it is sufficient to have the Windows client drivers available and installed on the clients.

    -

    Figure 19.11. Print Driver execution on the Client

    Print Driver execution on the Client

    -

    Driver Execution on the Server

    +

    Figure 19.13. Print Driver execution on the Client

    Print Driver execution on the Client

    +

    Driver Execution on the Server

    The other path executes the printer driver on the server. The clients transfers print files in EMF format to the server. The server uses the PostScript, PCL, ESC/P or other driver to convert the EMF file into -the printer-specific language. It is not possible for Unix to do the +the printer-specific language. It is not possible for UNIX to do the same. Currently there is no program or method to convert a Windows -client's GDI output on a Unix server into something a printer could +client's GDI output on a UNIX server into something a printer could understand.

    -

    Figure 19.12. Print Driver execution on the Server

    Print Driver execution on the Server

    +

    Figure 19.14. Print Driver execution on the Server

    Print Driver execution on the Server

    However, there is something similar possible with CUPS. Read on... -

    Network Printing (Windows clients -- UNIX/Samba Print +

    Network Printing (Windows clients -- UNIX/Samba Print Servers)

    Since UNIX print servers cannot execute the Win32 program code on their platform, the picture is somewhat different. However, this doesn't limit your options all that much. In the contrary, you may have a way here to implement printing features which are not possible otherwise. -

    From Windows Clients to a CUPS/Samba Print Server

    +

    From Windows Clients to a CUPS/Samba Print Server

    Here is a simple recipe showing how you can take advantage of CUPS powerful features for the benefit of your Windows network printing clients: @@ -9493,15 +9125,14 @@ server.

  • Let the CUPS server render the PostScript into device specific raster format.

    • This requires the clients to use a PostScript driver (even if the printer is a non-PostScript model. It also requires that you have a -"driver" on the CUPS server. +"driver" on the CUPS server.

    Firstly, to enable CUPS based printing through Samba the -following options should be set in your smb.conf file [globals] +following options should be set in your smb.conf file [global] section: -

    • printing = CUPS

    • printcap = CUPS

    +

    • printing = cups

    • printcap = cups

    When these parameters are specified, all manually set print directives -(like print command =..., or lppause -command =...) in smb.conf (as well as +(like print command, or lppause command) in smb.conf (as well as in samba itself) will be ignored. Instead, Samba will directly interface with CUPS through it's application program interface (API) - as long as Samba has been compiled with CUPS library (libcups) @@ -9510,12 +9141,12 @@ other print commands are set up, then printing will use the System V AT&T command set, with the -oraw option automatically passing through (if you want your own defined print commands to work with a Samba that has CUPS support compiled in, -simply use printing = sysv). +simply use printing = sysv).

    -

    Figure 19.13. Printing via CUPS/samba server

    Printing via CUPS/samba server

    -

    Samba receiving Jobfiles and passing them to CUPS

    +

    Figure 19.15. Printing via CUPS/samba server

    Printing via CUPS/samba server

    +

    Samba receiving Jobfiles and passing them to CUPS

    Samba must use its own spool directory (it is set -by a line similar to path = /var/spool/samba, +by a line similar to path = /var/spool/samba, in the [printers] or [printername] section of smb.conf). Samba receives the job in its own @@ -9525,14 +9156,14 @@ directive, in a line that defaults to RequestRoot /var/spool/cups). CUPS checks the access rights of its spool dir and resets it to healthy values with every re-start. We have seen quite some people who had used a common spooling space for Samba -and CUPS, and were struggling for weeks with this "problem". +and CUPS, and were struggling for weeks with this "problem".

    A Windows user authenticates only to Samba (by whatever means is configured). If Samba runs on the same host as CUPS, you only need to -allow "localhost" to print. If they run on different machines, you +allow "localhost" to print. If they run on different machines, you need to make sure the Samba host gets access to printing on CUPS. -

    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs

    +

    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs

    PPDs can control all print device options. They are usually provided by the manufacturer; if you own a PostScript printer, that is. PPD files (PostScript Printer Descriptions) are always a component of @@ -9540,7 +9171,7 @@ PostScript printer drivers on MS Windows or Apple Mac OS systems. They are ASCII files containing user-selectable print options, mapped to appropriate PostScript, PCL or PJL commands for the target printer. Printer driver GUI dialogs translate these options -"on-the-fly" into buttons and drop-down lists for the user to select. +"on-the-fly" into buttons and drop-down lists for the user to select.

    CUPS can load, without any conversions, the PPD file from any Windows (NT is recommended) PostScript driver and handle the options. There is @@ -9551,8 +9182,8 @@ or see if you have lphelp on your system). There are also some different GUI frontends on Linux/UNIX, which can present PPD options to users. PPD options are normally meant to be evaluated by the PostScript RIP on the real PostScript printer. -

    PPDs for non-PS Printers on UNIX

    -CUPS doesn't limit itself to "real" PostScript printers in its usage +

    PPDs for non-PS Printers on UNIX

    +CUPS doesn't limit itself to "real" PostScript printers in its usage of PPDs. The CUPS developers have extended the scope of the PPD concept, to also describe available device and driver options for non-PostScript printers through CUPS-PPDs. @@ -9568,10 +9199,10 @@ the supplied PostScript. Thus CUPS lets all its printers appear as PostScript devices to its clients, because it can act as a PostScript RIP for those printers, processing the received PostScript code into a proper raster print format. -

    PPDs for non-PS Printers on Windows

    +

    PPDs for non-PS Printers on Windows

    CUPS-PPDs can also be used on Windows-Clients, on top of a -"core" PostScript driver (now recommended is the "CUPS PostScript -Driver for WindowsNT/2K/XP"; you can also use the Adobe one, with +"core" PostScript driver (now recommended is the "CUPS PostScript +Driver for WindowsNT/2K/XP"; you can also use the Adobe one, with limitations). This feature enables CUPS to do a few tricks no other spooler can do:

    • act as a networked PostScript RIP (Raster Image @@ -9579,35 +9210,35 @@ Processor), handling printfiles from all client platforms in a uniform way;

    • act as a central accounting and billing server, since all files are passed through the pstops filter and are therefore logged in the CUPS page_log file. -NOTE: this can not happen with "raw" print jobs, +NOTE: this can not happen with "raw" print jobs, which always remain unfiltered per definition;

    • enable clients to consolidate on a single PostScript driver, even for many different target printers.

    Using CUPS PPDs on Windows clients enables these to control all print job settings just as a UNIX client can do too. -

    Windows Terminal Servers (WTS) as CUPS Clients

    +

    Windows Terminal Servers (WTS) as CUPS Clients

    This setup may be of special interest to people experiencing major problems in WTS environments. WTS need often a multitude of non-PostScript drivers installed to run their clients' variety of different printer models. This often imposes the price of much increased instability. -

    Printer Drivers running in "Kernel Mode" cause many +

    Printer Drivers running in "Kernel Mode" cause many Problems

    -The reason is that in Win NT printer drivers run in "Kernel -Mode", this introduces a high risk for the stability of the system +The reason is that in Win NT printer drivers run in "Kernel +Mode", this introduces a high risk for the stability of the system if the driver is not really stable and well-tested. And there are a lot of bad drivers out there! Especially notorious is the example of the PCL printer driver that had an additional sound module running, to notify users via soundcard of their finished jobs. Do I -need to say that this one was also reliably causing "Blue Screens -of Death" on a regular basis? +need to say that this one was also reliably causing "Blue Screens +of Death" on a regular basis?

    PostScript drivers generally are very well tested. They are not known to cause any problems, even though they run in Kernel Mode too. This might be because there have so far only been 2 different PostScript -drivers the ones from Adobe and the one from Microsoft. Both are +drivers: the ones from Adobe and the one from Microsoft. Both are very well tested and are as stable as you ever can imagine on Windows. The CUPS driver is derived from the Microsoft one. -

    Workarounds impose Heavy Limitations

    +

    Workarounds impose Heavy Limitations

    In many cases, in an attempt to work around this problem, site administrators have resorted to restrict the allowed drivers installed on their WTS to one generic PCL- and one PostScript driver. This @@ -9615,7 +9246,7 @@ however restricts the clients in the amount of printer options available for them; often they can't get out more than simplex prints from one standard paper tray, while their devices could do much better, if driven by a different driver! ) -

    CUPS: a "Magical Stone"?

    +

    CUPS: a "Magical Stone"?

    Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very elegant way to overcome all these shortcomings. There are, depending on the version of Windows OS you use, up to 3 different PostScript @@ -9625,14 +9256,14 @@ used with many different PPDs). The clients will be able to (again) chose paper trays, duplex printing and other settings. However, there is a certain price for this too: a CUPS server acting as a PostScript RIP for its clients requires more CPU and RAM than when just acting as -a "raw spooling" device. Plus, this setup is not yet widely tested, +a "raw spooling" device. Plus, this setup is not yet widely tested, although the first feedbacks look very promising. -

    PostScript Drivers with no major problems -- even in Kernel -Mode

    +

    PostScript Drivers with no major problems -- even in Kernel +Mode

    More recent printer drivers on W2K and XP don't run in Kernel mode (unlike Win NT) any more. However, both operating systems can still use the NT drivers, running in Kernel mode (you can roughly tell which -is which as the drivers in subdirectory "2" of "W32X86" are "old" +is which as the drivers in subdirectory "2" of "W32X86" are "old" ones). As was said before, the Adobe as well as the Microsoft PostScript drivers are not known to cause any stability problems. The CUPS driver is derived from the Microsoft one. There is a simple @@ -9642,16 +9273,16 @@ includes the source code of the Microsoft driver, and licensees of Visual Studio are allowed to use and modify it for their own driver development efforts. This is what the CUPS people have done. The license doesn't allow them to publish the whole of the source code. -However, they have released the "diff" under the GPL, and if you are -owner of an "MS DDK for Win NT", you can check the driver yourself. -

    Setting up CUPS for driver Download

    +However, they have released the "diff" under the GPL, and if you are +owner of an "MS DDK for Win NT", you can check the driver yourself. +

    Setting up CUPS for driver Download

    As we have said before: all previously known methods to prepare client -printer drivers on the Samba server for download and "Point'n'Print" +printer drivers on the Samba server for download and "Point'n'Print" convenience of Windows workstations are working with CUPS too. These methods were described in the previous chapter. In reality, this is a pure Samba business, and only relates to the Samba/Win client relationship. -

    cupsaddsmb: the unknown Utility

    +

    cupsaddsmb: the unknown Utility

    The cupsaddsmb utility (shipped with all current CUPS versions) is an alternative method to transfer printer drivers into the Samba [print$] share. Remember, this share is where @@ -9676,82 +9307,49 @@ job-billing)

    However, currently only Windows NT, 2000, and XP are supported by the CUPS drivers. You will need to get the respective part of Adobe driver too if you need to support Windows 95, 98, and ME clients. -

    Prepare your smb.conf for -cupsaddsmb

    +

    Prepare your smb.conf for cupsaddsmb

    Prior to running cupsaddsmb, you need the following settings in smb.conf: -

    -
- [global]
-         load printers = yes
-         printing = cups
-         printcap name = cups
-
- [printers]
-         comment = All Printers
-         path = /var/spool/samba
-         browseable = no
-         public = yes
-         guest ok = yes           # setting depends on your requirements
-         writable = no
-         printable = yes
-         printer admin = root
-
- [print$]
-         comment = Printer Drivers
-         path = /etc/samba/drivers
-         browseable = yes
-         guest ok = no
-         read only = yes
-         write list = root  
-
-

    CUPS Package of "PostScript Driver for WinNT/2k/XP"

    -CUPS users may get the exactly same packages fromhttp://www.cups.org/software.html. +

    Example 19.3. smb.conf for cupsaddsmb usage

    [global]
    load printers = yes
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    public = yes
    # setting depends on your requirements
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root
    [print$]
    comment = Printer Drivers
    path = /etc/samba/drivers
    browseable = yes
    guest ok = no
    read only = yes
    write list = root

    CUPS Package of "PostScript Driver for WinNT/2k/XP"

    +CUPS users may get the exactly same packages from http://www.cups.org/software.html. It is a separate package from the CUPS base software files, tagged as -CUPS 1.1.x Windows NT/2k/XP Printer Driver for SAMBA +CUPS 1.1.x Windows NT/2k/XP Printer Driver for Samba (tar.gz, 192k). The filename to download is cups-samba-1.1.x.tar.gz. Upon untar-/unzip-ing, it will reveal these files: 

    -
-# tar xvzf cups-samba-1.1.19.tar.gz 
-
-   cups-samba.install
-   cups-samba.license
-   cups-samba.readme
-   cups-samba.remove
-   cups-samba.ss
-
-

    +root# tar xvzf cups-samba-1.1.19.tar.gz +cups-samba.install +cups-samba.license +cups-samba.readme +cups-samba.remove +cups-samba.ss +

    + + These have been packaged with the ESP meta packager software -"EPM". The *.install and +"EPM". The *.install and *.remove files are simple shell scripts, which untars the *.ss (the *.ss is -nothing else but a tar-archive, which can be untar-ed by "tar" +nothing else but a tar-archive, which can be untar-ed by "tar" too). Then it puts the content into /usr/share/cups/drivers/. This content includes 3 files: 

    -
-# tar tv cups-samba.ss
-
-    cupsdrvr.dll
-    cupsui.dll
-    cups.hlp  
-
+root# tar tv cups-samba.ss
+cupsdrvr.dll
+cupsui.dll
+cups.hlp

    The cups-samba.install shell scripts is easy to handle: 

    -
-# ./cups-samba.install
-
-   [....]
-   Installing software...
-   Updating file permissions...
-   Running post-install commands...
-   Installation is complete.        
-
+root# ./cups-samba.install
+[....]
+Installing software...
+Updating file permissions...
+Running post-install commands...
+Installation is complete.

    The script should automatically put the driver files into the /usr/share/cups/drivers/ directory. @@ -9764,54 +9362,37 @@ copy/move the file (after running the ./cups-samba.install script) manually to the right place. 

    -
-   cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/
-
-

    +root# cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/ +

    This new CUPS PostScript driver is currently binary-only, but free of charge. No complete source code is provided (yet). The reason is this: it has been developed with the help of the Microsoft Driver Developer Kit (DDK) and compiled with Microsoft Visual Studio 6. Driver developers are not allowed to distribute the whole of the source code as Free Software. However, CUPS developers released -the "diff" in source code under the GPL, so anybody with a license of +the "diff" in source code under the GPL, so anybody with a license of Visual Studio and a DDK will be able to compile for him/herself. -

    Recognize the different Driver Files

    -The CUPS drivers don't support the "older" Windows 95/98/ME, but only +

    Recognize the different Driver Files

    +The CUPS drivers don't support the "older" Windows 95/98/ME, but only the Windows NT/2000/XP client: -

    -
- [Windows NT, 2000, and XP are supported by:]
-         cups.hlp
-         cupsdrvr.dll
-         cupsui.dll
-
-

    +

    Windows NT, 2000, and XP are supported by:

    +

    • cups.hlp

    • cupsdrvr.dll

    • cupsui.dll

    +

    Adobe drivers are available for the older Windows 95/98/ME as well as the Windows NT/2000/XP clients. The set of files is different for the different platforms. -

    +
    Windows 95, 98, and Me are supported by:
    
+	
    • ADFONTS.MFM
    • ADOBEPS4.DRV
    • ADOBEPS4.HLP
    • DEFPRTR2.PPD
    • ICONLIB.DLL
    • PSMON.DLL
    
+
    Windows NT, 2000, and XP are supported by:
    
+
    • ADOBEPS5.DLL
    • ADOBEPSU.DLL
    • ADOBEPSU.HLP
    
 
- [Windows 95, 98, and Me are supported by:]
-         ADFONTS.MFM
-         ADOBEPS4.DRV
-         ADOBEPS4.HLP
-         DEFPRTR2.PPD
-         ICONLIB.DLL
-         PSMON.DLL
-
- [Windows NT, 2000, and XP are supported by:]
-         ADOBEPS5.DLL
-         ADOBEPSU.DLL
-         ADOBEPSU.HLP
-
-

    Note

    +

    Note

    If both, the Adobe driver files and the CUPS driver files for the support of WinNT/2k/XP are present in , the Adobe ones will be ignored and the CUPS ones will be used. If you prefer -- for whatever reason -- to use Adobe-only drivers, move away the 3 CUPS driver files. The Win95/98/ME clients use the Adobe drivers in any case. -

    Acquiring the Adobe Driver Files

    +

    Acquiring the Adobe Driver Files

    Acquiring the Adobe driver files seems to be unexpectedly difficult for many users. They are not available on the Adobe website as single files and the self-extracting and/or self-installing Windows-exe is @@ -9824,13 +9405,13 @@ Generic PostScript printer. After this, the client's where you can get them with smbclient from the CUPS host. A more detailed description about this is in the next (the CUPS printing) chapter. -

    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"

    -Users of the ESP Print Pro software are able to install their "Samba -Drivers" package for this purpose with no problem. Retrieve the driver +

    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"

    +Users of the ESP Print Pro software are able to install their "Samba +Drivers" package for this purpose with no problem. Retrieve the driver files from the normal download area of the ESP Print Pro software -athttp://www.easysw.com/software.html. -You need to locate the link labelled "SAMBA" amongst the +at http://www.easysw.com/software.html. +You need to locate the link labelled "SAMBA" amongst the Download Printer Drivers for ESP Print Pro 4.x area and download the package. Once installed, you can prepare any driver by simply highlighting the printer in the Printer Manager GUI @@ -9840,7 +9421,7 @@ driver files; i.e. mainly setup the [print$] share, etc. The ESP Print Pro package includes the CUPS driver files as well as a (licensed) set of Adobe drivers for the Windows 95/98/ME client family. -

    Caveats to be considered

    +

    Caveats to be considered

    Once you have run the install script (and possibly manually moved the cups.hlp file to /usr/share/cups/drivers/), the driver is @@ -9848,9 +9429,10 @@ ready to be put into Samba's [print$] share (w /etc/samba/drivers/ and contains a subdir tree with WIN40 and W32X86 branches): You do this by running -"cupsaddsmb" (see also man cupsaddsmb for +"cupsaddsmb" (see also man cupsaddsmb for CUPS since release 1.1.16).

    Tip

    + You may need to put root into the smbpasswd file by running smbpasswd; this is especially important if you should run this whole procedure for the first time, and are not @@ -9870,62 +9452,67 @@ It is not harmful if you still have the ADOBE*.* driver files from previous installations in the /usr/share/cups/drivers/ directory. The new cupsaddsmb (from 1.1.16) will -automatically prefer "its own" drivers if it finds both. +automatically prefer "its own" drivers if it finds both.

  • + Should your Win clients have had the old ADOBE*.* files for the Adobe PostScript driver installed, the download and installation of the new CUPS PostScript driver for Windows NT/2k/XP will fail at first. You need to wipe the old driver from the clients -first. It is not enough to "delete" the printer, as the driver files +first. It is not enough to "delete" the printer, as the driver files will still be kept by the clients and re-used if you try to re-install the printer. To really get rid of the Adobe driver files on the -clients, open the "Printers" folder (possibly via Start ---> Settings --> Control Panel --> Printers), +clients, open the "Printers" folder (possibly via Start, Settings, Control Panel, Printers), right-click onto the folder background and select Server Properties. When the new dialog opens, select the Drivers tab. On the list select the driver you want to delete and click on the Delete button. This will only work if there is not one single printer left -which uses that particular driver. You need to "delete" all printers -using this driver in the "Printers" folder first. You will need +which uses that particular driver. You need to "delete" all printers +using this driver in the "Printers" folder first. You will need Administrator privileges to do this.

  • + Once you have successfully downloaded the CUPS PostScript driver to a client, you can easily switch all printers to this one by proceeding -as described elsewhere in the "Samba HOWTO Collection": either change -a driver for an existing printer by running the "Printer Properties" +as described in the printing chapter: either change +a driver for an existing printer by running the "Printer Properties" dialog, or use rpcclient with the setdriver sub-command.

    • -

    What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?

    +

    Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver

    You are interested in a comparison between the CUPS and the Adobe PostScript drivers? For our purposes these are the most important items which weigh in favor of the CUPS ones:

    • no hassle with the Adobe EULA

    • no hassle with the question “Where do I -get the ADOBE*.* driver files from?”

    • the Adobe drivers (on request of the printer PPD +get the ADOBE*.* driver files from?”

    • + + the Adobe drivers (on request of the printer PPD associated with them) often put a PJL header in front of the main PostScript part of the print file. Thus the printfile starts with <1B >%-12345X or <escape>%-12345X instead of %!PS). This leads to the CUPS daemon auto-typing the incoming file as a print-ready file, -not initiating a pass through the "pstops" filter (to speak more +not initiating a pass through the "pstops" filter (to speak more technically, it is not regarded as the generic MIME type + application/postscript, but as the more special MIME type + application/cups.vnd-postscript), which therefore also leads to the page accounting in /var/log/cups/page_log not receiving the exact number of pages; instead the dummy page number -of "1" is logged in a standard setup)

    • the Adobe driver has more options to "mis-configure" the +of "1" is logged in a standard setup)

    • the Adobe driver has more options to "mis-configure" the PostScript generated by it (like setting it inadvertently to Optimize for Speed, instead of Optimize for Portability, which could lead to CUPS being unable to process it)

    • the CUPS PostScript driver output sent by Windows clients to the CUPS server will be guaranteed to be auto-typed always as generic MIME type application/postscript, -thusly passing through the CUPS "pstops" filter and logging the +thusly passing through the CUPS "pstops" filter and logging the correct number of pages in the page_log for accounting and quota purposes

    • the CUPS PostScript driver supports the sending of additional standard (IPP) print options by Win NT/2k/XP clients. Such @@ -9943,7 +9530,7 @@ not disturb any other applications as they will regard it as a comment and simply ignore it).

    • the CUPS PostScript driver will be the heart of the fully fledged CUPS IPP client for Windows NT/2K/XP to be released soon (probably alongside the first Beta release for CUPS -1.2).

    Run "cupsaddsmb" (quiet Mode)

    +1.2).

    Run "cupsaddsmb" (quiet Mode)

    The cupsaddsmb command copies the needed files into your [print$] share. Additionally, the PPD associated with this printer is copied from @@ -9952,125 +9539,112 @@ associated with this printer is copied from Windows client installations via Point'n'Print. Before we can run the command successfully, we need to be sure that we can authenticate towards Samba. If you have a small network you are probably using user -level security (security = user). Probably your -root has already a Samba account. Otherwise, create it now, using -smbpasswd: -

    -
- #  smbpasswd -a root 
- New SMB password: [type in password 'secret']
- Retype new SMB password: [type in password 'secret']
-
-

    +level security (security = user). +

    Here is an example of a successfully run cupsaddsmb command. 

    -
- #  cupsaddsmb -U root infotec_IS2027
- Password for root required to access localhost via SAMBA: [type in password 'secret']
-
+root# cupsaddsmb -U root infotec_IS2027
+Password for root required to access localhost via Samba: ['secret']

    To share all printers and drivers, use the --a parameter instead of a printer name. Since -cupsaddsmb "exports" the printer drivers to Samba, it should be +-a parameter instead of a printer name. Since +cupsaddsmb "exports" the printer drivers to Samba, it should be obvious that it only works for queues with a CUPS driver associated. -

    Run "cupsaddsmb" with verbose Output

    +

    Run "cupsaddsmb" with verbose Output

    Probably you want to see what's going on. Use the --v parameter to get a more verbose output. The -output below was edited for better readability: all "\" at the end of +-v parameter to get a more verbose output. The +output below was edited for better readability: all "\" at the end of a line indicate that I inserted an artificial line break plus some indentation here:

    Warning

    You will see the root password for the Samba account printed on -screen. If you use remote access, the password will go over the wire -unencrypted! -

    -
-  # cupsaddsmb -U root -v infotec_2105
-  Password for root required to access localhost via SAMBA:
-  Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir W32X86;put   \
-                   /var/spool/cups/tmp/3e98bf2d333b5 W32X86/infotec_2105.ppd;put           \
-                   /usr/share/cups/drivers/cupsdrvr.dll W32X86/cupsdrvr.dll;put            \
-                   /usr/share/cups/drivers/cupsui.dll W32X86/cupsui.dll;put                \
-                   /usr/share/cups/drivers/cups.hlp W32X86/cups.hlp'
-  added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
-  Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
-  NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86
-  putting file /var/spool/cups/tmp/3e98bf2d333b5 as \W32X86/infotec_2105.ppd (2328.8 kb/s) \
-               (average 2328.8 kb/s)
-  putting file /usr/share/cups/drivers/cupsdrvr.dll as \W32X86/cupsdrvr.dll (9374.3 kb/s)  \
-               (average 5206.6 kb/s)
-  putting file /usr/share/cups/drivers/cupsui.dll as \W32X86/cupsui.dll (8107.2 kb/s)      \
-               (average 5984.1 kb/s)
-  putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp (3475.0 kb/s)          \
-               (average 5884.7 kb/s)
+screen. 
+
    +root# cupsaddsmb -U root -v infotec_2105
+Password for root required to access localhost via GANDALF:
+Running command: smbclient //localhost/print\$ -N -U'root%secret' \
+    -c 'mkdir W32X86; \
+    put /var/spool/cups/tmp/3e98bf2d333b5 W32X86/infotec_2105.ppd; \
+	put /usr/share/cups/drivers/cupsdrvr.dll W32X86/cupsdrvr.dll; \
+    put /usr/share/cups/drivers/cupsui.dll W32X86/cupsui.dll; \
+    put /usr/share/cups/drivers/cups.hlp W32X86/cups.hlp'
+added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
+NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86
+putting file /var/spool/cups/tmp/3e98bf2d333b5 as \W32X86/infotec_2105.ppd
+putting file /usr/share/cups/drivers/cupsdrvr.dll as \W32X86/cupsdrvr.dll
+putting file /usr/share/cups/drivers/cupsui.dll as \W32X86/cupsui.dll
+putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp
   
-  Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows NT x86"   \
-                   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:   \
-                   RAW:NULL"'
-  cmd = adddriver "Windows NT x86" "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll: \
-                   cups.hlp:NULL:RAW:NULL"
-  Printer Driver infotec_2105 successfully installed.
+Running command: rpcclient localhost -N -U'root%secret' 
+   -c 'adddriver "Windows NT x86"   \
+   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:   \
+    RAW:NULL"'
+cmd = adddriver "Windows NT x86" \
+    "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:RAW:NULL"
+Printer Driver infotec_2105 successfully installed.
   
-  Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir WIN40;put    \
-                   /var/spool/cups/tmp/3e98bf2d333b5 WIN40/infotec_2105.PPD; put           \
-                   /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;put               \
-                   /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV;put             \
-                   /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP;put             \
-                   /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD;put             \
-                   /usr/share/cups/drivers/ICONLIB.DLL
-  WIN40/ICONLIB.DLL;put /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;'
+Running command: smbclient //localhost/print\$ -N -U'root%secret' \
+-c 'mkdir WIN40; \
+    put /var/spool/cups/tmp/3e98bf2d333b5 WIN40/infotec_2105.PPD; \
+	put /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;   \
+    put /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV; \
+    put /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP; \
+    put /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD; \
+	put /usr/share/cups/drivers/ICONLIB.DLL WIN40/ICONLIB.DLL; \
+	put /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;'
   added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
-  Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+  Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
   NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40
-  putting file /var/spool/cups/tmp/3e98bf2d333b5 as \WIN40/infotec_2105.PPD (2328.8 kb/s)  \
-               (average 2328.8 kb/s)
-  putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM (9368.0 kb/s)     \
-               (average 6469.6 kb/s)
-  putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV (9958.2 kb/s)   \
-               (average 8404.3 kb/s)
-  putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP (8341.5 kb/s)   \
-               (average 8398.6 kb/s)
-  putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD (2195.9 kb/s)   \
-               (average 8254.3 kb/s)
-  putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL (8239.9 kb/s)     \
-               (average 8253.6 kb/s)
-  putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL (6222.2 kb/s)         \
-               (average 8188.5 kb/s)
+  putting file /var/spool/cups/tmp/3e98bf2d333b5 as \WIN40/infotec_2105.PPD
+  putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM
+  putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV
+  putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP
+  putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD
+  putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL
+  putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL
   
-  Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows 4.0"      \
-                   "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP:          \
-                   PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL,     \
-                   ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
-  cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:          \
-                   ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,  \
-                   PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"
+  Running command: rpcclient localhost -N -U'root%secret' \
+   -c 'adddriver "Windows 4.0"      \
+   "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP: \
+   PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL, \
+    ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
+  cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:          \
+    ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,  \
+                   PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"
   Printer Driver infotec_2105 successfully installed.
   
-  Running command: rpcclient localhost -N -U'root%secret'                                  \
-                             -c 'setdriver infotec_2105 infotec_2105'
+  Running command: rpcclient localhost -N -U'root%secret'  \
+   -c 'setdriver infotec_2105 infotec_2105'
   cmd = setdriver infotec_2105 infotec_2105
   Successfully set infotec_2105 to driver infotec_2105.

    -If you look closely, you'll discover your root password was transfered +If you look closely, you'll discover your root password was transferred unencrypted over the wire, so beware! Also, if you look further her, you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in between. They occur, because the directories WIN40 and W32X86 already existed in the [print$] driver download share (from a previous driver installation). They are harmless here. -

    Understanding cupsaddsmb

    +

    Understanding cupsaddsmb

    What has happened? What did cupsaddsmb do? There are five stages of the procedure -

    1. call the CUPS server via IPP and request the +

      1. + + call the CUPS server via IPP and request the driver files and the PPD file for the named printer;

      2. store the files temporarily in the local TEMPDIR (as defined in cupsd.conf);

      3. connect via smbclient to the Samba server's [print$] share and put the files into the share's WIN40 (for Win95/98/ME) and W32X86/ (for WinNT/2k/XP) sub - directories;

      4. connect via rpcclient to the Samba server and -execute the "adddriver" command with the correct -parameters;

      5. connect via rpcclient to the Samba server a second -time and execute the "setdriver" command.

      + directories;

    2. + + connect via rpcclient to the Samba server and +execute the "adddriver" command with the correct +parameters;

    3. + + connect via rpcclient to the Samba server a second +time and execute the "setdriver" command.

    Note, that you can run the cupsaddsmb utility with parameters to specify one remote host as Samba host and a second remote host as CUPS host. Especially if you want to get a deeper understanding, it is a @@ -10078,10 +9652,8 @@ good idea try it and see more clearly what is going on (though in real life most people will have their CUPS and Samba servers run on the same host): 

    -
- # cupsaddsmb -H sambaserver -h cupsserver -v printername
-
-

    How to recognize if cupsaddsm completed successfully

    +root# cupsaddsmb -H sambaserver -h cupsserver -v printername +

    How to recognize if cupsaddsmb completed successfully

    You must always check if the utility completed successfully in all fields. You need as a minimum these 3 messages amongst the output: @@ -10092,7 +9664,7 @@ installed. # (for the WIN40 == Win9x/ME architecture...)

  • Successfully set [printerXPZ] to driver [printerXYZ].

    • These messages probably not easily recognized in the general -output. If you run cupsaddsmb with the -a +output. If you run cupsaddsmb with the -a parameter (which tries to prepare all active CUPS printer drivers for download), you might miss if individual printers drivers had problems to install properly. Here a redirection of the @@ -10102,46 +9674,45 @@ It is impossible to see any diagnostic output if you don't run cupsaddsmb in verbose mode. Therefore we strongly recommend to not use the default quiet mode. It will hide any problems from you which might occur. -

    cupsaddsmb with a Samba PDC

    +

    cupsaddsmb with a Samba PDC

    You can't get the standard cupsaddsmb command to run on a Samba PDC? You are asked for the password credential all over again and again and the command just will not take off at all? Try one of these variations: 

    -
- # cupsaddsmb -U DOMAINNAME\\root -v printername
- # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -v printername
- # cupsaddsmb -H SAMBA-PDC -U DOMAINNAME\\root -h cups-server -v printername
-
+root# cupsaddsmb -U MIDEARTH\\root -v printername
+root# cupsaddsmb -H SAURON -U MIDEARTH\\root -v printername
+root# cupsaddsmb -H SAURON -U MIDEARTH\\root -h cups-server -v printername

    (Note the two backslashes: the first one is required to -"escape" the second one). -

    cupsaddsmb Flowchart

    +"escape" the second one). +

    cupsaddsmb Flowchart

    Here is a chart about the procedures, commandflows and -dataflows of the "cupaddsmb" command. Note again: cupsaddsmb is -not intended to, and does not work with, "raw" queues! +dataflows of the "cupaddsmb" command. Note again: cupsaddsmb is +not intended to, and does not work with, "raw" queues!

    -

    Figure 19.14. cupsaddsmb flowchart

    cupsaddsmb flowchart

    -

    Installing the PostScript Driver on a Client

    +

    Figure 19.16. cupsaddsmb flowchart

    cupsaddsmb flowchart

    +

    Installing the PostScript Driver on a Client

    After cupsaddsmb completed, your driver is prepared for the clients to use. Here are the steps you must perform to download and install it -via "Point'n'Print". From a Windows client, browse to the CUPS/Samba +via "Point'n'Print". From a Windows client, browse to the CUPS/Samba server; -

    • open the Printers +

      • open the Printers share of Samba in Network Neighbourhood;

      • right-click on the printer in question;

      • from the opening context-menu select Install... or Connect... (depending on the Windows version you use).

      After a few seconds, there should be a new printer in your -client's local "Printers" folder: On Windows +client's local "Printers" folder: On Windows XP it will follow a naming convention of PrinterName on -SambaServer. (In my current case it is "infotec_2105 on -kde-bitshop"). If you want to test it and send your first job from +SambaServer. (In my current case it is "infotec_2105 on +kde-bitshop"). If you want to test it and send your first job from an application like Winword, the new printer will appears in a \\SambaServer\PrinterName entry in the dropdown list of available printers.

      Note

      + cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher and Samba from 2.2.4. If it doesn't work, or if the automatic printer driver download to the clients doesn't succeed, you can still manually @@ -10149,16 +9720,14 @@ install the CUPS printer PPD on top of the Adobe PostScript driver on clients. Then point the client's printer queue to the Samba printer share for a UNC type of connection: 

      -
-  net use lpt1: \\sambaserver\printershare /user:ntadmin
-
+C:\> net use lpt1: \\sambaserver\printershare /user:ntadmin

      should you desire to use the CUPS networked PostScript RIP -functions. (Note that user "ntadmin" needs to be a valid Samba user +functions. (Note that user "ntadmin" needs to be a valid Samba user with the required privileges to access the printershare) This would set up the printer connection in the traditional LanMan way (not using MS-RPC). -

    Avoiding critical PostScript Driver Settings on the +

    Avoiding critical PostScript Driver Settings on the Client

    Soooo: printing works, but there are still problems. Most jobs print well, some don't print at all. Some jobs have problems with fonts, @@ -10184,7 +9753,7 @@ get a printout at all) (Adobe)

  • Sometimes you can choose : in case of problems try 2 instead of 3 (the latest ESP Ghostscript package handles Level 3 PostScript very well) (Adobe).

  • Say Yes to PostScript -Error Handler (Adobe)

    • Installing PostScript Driver Files manually (using +Error Handler (Adobe)

    Installing PostScript Driver Files manually (using rpcclient)

    Of course you can run all the commands which are embedded into the cupsaddsmb convenience utility yourself, one by one, and hereby upload @@ -10192,10 +9761,19 @@ and prepare the driver files for future client downloads.

    1. prepare Samba (a CUPS printqueue with the name of the printer should be there. We are providing the driver now);

    2. copy all files to -[print$]:

    3. run rpcclient adddriver -(for each client architecture you want to support):

    4. run rpcclient + [print$]

    5. + + run rpcclient adddriver +(for each client architecture you want to support):

    6. + + run rpcclient setdriver.

    -We are going to do this now. First, read the man page on "rpcclient" + + + + + +We are going to do this now. First, read the man page on "rpcclient" to get a first idea. Look at all the printing related sub-commands. enumprinters, enumdrivers, enumports, @@ -10203,9 +9781,9 @@ sub-commands. enumprinters, the most interesting ones. rpcclient implements an important part of the MS-RPC protocol. You can use it to query (and command) a Win NT (or 2K/XP) PC too. MS-RPC is used by Windows clients, amongst other -things, to benefit from the "Point'n'Print" features. Samba can now +things, to benefit from the "Point'n'Print" features. Samba can now mimic this too. -

    A Check of the rpcclient man Page

    +

    A Check of the rpcclient man Page

    First let's have a little check of the rpcclient man page. Here are two relevant passages:

    @@ -10225,9 +9803,9 @@ Help File Name:\ Language Monitor Name:\ Default Data Type:\ Comma Separated list of Files -

    Any empty fields should be enter as the string "NULL".

    Samba does not need to support the concept of Print Monitors +

    Any empty fields should be enter as the string "NULL".

    Samba does not need to support the concept of Print Monitors since these only apply to local printers whose driver can make use of -a bi-directional link for communication. This field should be "NULL". +a bi-directional link for communication. This field should be "NULL". On a remote NT print server, the Print Monitor for a driver must already be installed prior to adding the driver or else the RPC will fail @@ -10238,34 +9816,32 @@ printer driver associated with an installed printer. The printer driver must already be correctly installed on the print server.

    See also the enumprinters and enumdrivers commands for obtaining a list of installed printers and drivers. -

    Understanding the rpcclient man Page

    +

    Understanding the rpcclient man page

    The exact format isn't made too clear by the man page, since you have to deal with some parameters containing spaces. Here is a better description for it. We have line-broken the -command and indicated the breaks with "\". Usually you would type the +command and indicated the breaks with "\". Usually you would type the command in one line without the linebreaks: -

    -
- adddriver "Architecture" \
-           "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\
-           LanguageMonitorFile:DataType:ListOfFiles,Comma-separated"
-
+
    + adddriver "Architecture" \
+           "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\
+           LanguageMonitorFile:DataType:ListOfFiles,Comma-separated"
 
    
 What the man pages denotes as a simple <config>
 keyword, does in reality consist of 8 colon-separated fields. The
 last field may take multiple (in some, very insane, cases, even
 20 different additional files. This might sound confusing at first.
-Note, that what the man pages names the "LongPrinterName" in
-reality should rather be called the "Driver Name". You can name it
+Note, that what the man pages names the "LongPrinterName" in
+reality should rather be called the "Driver Name". You can name it
 anything you want, as long as you use this name later in the
 rpcclient ... setdriver command. For
 practical reasons, many name the driver the same as the
 printer.
 
    
 True: it isn't simple at all. I hear you asking:
-How do I know which files are "Driver
-File", "Data File", "Config File", "Help File" and "Language
-Monitor File" in each case? -- For an answer you may
+How do I know which files are "Driver
+File", "Data File", "Config File", "Help File" and "Language
+Monitor File" in each case? -- For an answer you may
 want to have a look at how a Windows NT box with a shared printer
 presents the files to us. Remember, that this whole procedure has
 to be developed by the Samba Team by overhearing the traffic caused
@@ -10274,23 +9850,23 @@ box now, and access it from a UNIX workstation. We will query it
 with rpcclient to see what it tells us and
 try to understand the man page more clearly which we've read just
 now.
-

    Producing an Example by querying a Windows Box

    +

    Producing an Example by querying a Windows Box

    + + We could run rpcclient with a getdriver or a getprinter subcommand (in level 3 verbosity) against it. Just sit down at UNIX or Linux workstation with the Samba utilities installed. Then type the following command: 

    -
- rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3'
-
+root# rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3'

    From the result it should become clear which is which. Here is an example from my installation: -

    -
-# rpcclient -U'Danka%xxxx' W2KSERVER -c'getdriver "DANKA InfoStream Virtual Printer" 3'
- cmd = getdriver "DANKA InfoStream Virtual Printer" 3
+
    +root# rpcclient -U'Danka%xxxx' W2KSERVER \
+	-c'getdriver "DANKA InfoStream Virtual Printer" 3'
+ cmd = getdriver "DANKA InfoStream Virtual Printer" 3
 
  [Windows NT x86]
  Printer Driver Info 3:
@@ -10315,34 +9891,38 @@ example from my installation:
 
 
    
 Some printer drivers list additional files under the label
-"Dependentfiles": these would go into the last field
+"Dependentfiles": these would go into the last field
 ListOfFiles,Comma-separated. For the CUPS
 PostScript drivers we don't need any (nor would we for the Adobe
-PostScript driver): therefore the field will get a "NULL" entry.
-

    What is required for adddriver and setdriver to succeed

    +PostScript driver): therefore the field will get a "NULL" entry. +

    What is required for adddriver and setdriver to succeed

    From the manpage (and from the quoted output of cupsaddsmb, above) it becomes clear that you need to have certain conditions in order to make the manual uploading and initializing of the driver files succeed. The two rpcclient + subcommands (adddriver and setdriver) need to encounter the following pre-conditions to complete successfully: -

    • you are connected as "printer admin", or root (note, -that this is not the "Printer Operators" group in +

      • you are connected as printer admin, or root (note, +that this is not the "Printer Operators" group in NT, but the printer admin group, as defined in the [global] section of smb.conf);

      • copy all required driver files to \\sambaserver\print$\w32x86 and \\sambaserver\print$\win40 as appropriate. They -will end up in the "0" respective "2" subdirectories later -- for now +will end up in the "0" respective "2" subdirectories later -- for now don't put them there, they'll be automatically used by the adddriver subcommand.! (if you use -"smbclient" to put the driver files into the share, note that you need -to escape the "$": smbclient //sambaserver/print\$ -U +"smbclient" to put the driver files into the share, note that you need +to escape the "$": smbclient //sambaserver/print\$ -U root);

      • the user you're connecting as must be able to write to the [print$] share and create subdirectories;

      • the printer you are going to setup for the Windows -clients, needs to be installed in CUPS already;

      • the CUPS printer must be known to Samba, otherwise the +clients, needs to be installed in CUPS already;

      • + + + the CUPS printer must be known to Samba, otherwise the setdriver subcommand fails with an NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by Samba you may use the enumprinters subcommand to @@ -10350,164 +9930,145 @@ rpcclient. A long-standing bug prevented a proper update of the printer list until every smbd process had received a SIGHUP or was restarted. Remember this in case you've created the CUPS printer just shortly ago and encounter problems: try restarting -Samba.

    Manual Commandline Driver Installation in 15 little Steps

    +Samba.

    Manual Driver Installation in 15 Steps

    We are going to install a printer driver now by manually executing all required commands. As this may seem a rather complicated process at first, we go through the procedure step by step, explaining every single action item as it comes up. -

    First Step: Install the Printer on CUPS

    -
-# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P /home/kurt/canonIR85.ppd
-
+
    Procedure 19.1. Manual Driver Installation installation
    1. Install the Printer on CUPS
      +root# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P canonIR85.ppd
 
      
 This installs printer with the name mysmbtstprn
 to the CUPS system. The printer is accessed via a socket
 (a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root
 for this step
-
    Second Step (optional): Check if the Printer is recognized by
-Samba
    -
- # rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn
-
-        flags:[0x800000]
-        name:[\\kde-bitshop\mysmbtstprn]
-        description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn]
-        comment:[mysmbtstprn]
-
+
  • (optional) Check if the Printer is recognized by
+Samba
    +root# rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn
+flags:[0x800000]
+name:[\\kde-bitshop\mysmbtstprn]
+description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn]
+comment:[mysmbtstprn]
 
    
 This should show the printer in the list. If not, stop and re-start
 the Samba daemon (smbd), or send a HUP signal: kill -HUP
 `pidof smbd`. Check again.  Troubleshoot and repeat until
-success. Note the "empty" field between the two commas in the
-"description" line. Here would the driver name appear if there was one
+success. Note the "empty" field between the two commas in the
+"description" line. Here would the driver name appear if there was one
 already. You need to know root's Samba password (as set by the
 smbpasswd command) for this step and most of the
 following steps. Alternatively you can authenticate as one of the
-users from the "write list" as defined in smb.conf for
+users from the "write list" as defined in smb.conf for
 [print$].
-
    • Third Step (optional): Check if Samba knows a Driver for the
-Printer
    -
-#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
-         drivername:[]
+
  • (optional) Check if Samba knows a Driver for the
+Printer
    +root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
+			| grep driver 
+drivername:[]
+
+root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
+	| grep -C4 driv
+servername:[\\kde-bitshop]
+printername:[\\kde-bitshop\mysmbtstprn]
+sharename:[mysmbtstprn]
+portname:[Samba Printer Port]
+drivername:[]
+comment:[mysmbtstprn]
+location:[]
+sepfile:[]
+printprocessor:[winprint]
  
-#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv
-        servername:[\\kde-bitshop]
-        printername:[\\kde-bitshop\mysmbtstprn]
-        sharename:[mysmbtstprn]
-        portname:[Samba Printer Port]
-        drivername:[]
-        comment:[mysmbtstprn]
-        location:[]
-        sepfile:[]
-        printprocessor:[winprint]
- 
-#  rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
+root# rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
  result was WERR_UNKNOWN_PRINTER_DRIVER
 
 
    
 Neither method of the three commands shown above should show a driver.
 This step was done for the purpose of demonstrating this condition. An
 attempt to connect to the printer at this stage will prompt the
-message along the lines: "The server has not the required printer
-driver installed".
-
    • Fourth Step: Put all required Driver Files into Samba's
-[print$]
    -
-#  smbclient //localhost/print\$ -U 'root%xxxx'                        \ 
-                              -c 'cd W32X86;                                             \
-                                  put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD;     \
-                                  put /usr/share/cups/drivers/cupsui.dll cupsui.dll;     \
-                                  put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \
-                                  put /usr/share/cups/drivers/cups.hlp cups.hlp'
-
+message along the lines: "The server has not the required printer
+driver installed".
+
  • Put all required Driver Files into Samba's
+[print$]
    +root# smbclient //localhost/print\$ -U 'root%xxxx' \
+	-c 'cd W32X86; \
+	put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD; \ 
+	put /usr/share/cups/drivers/cupsui.dll cupsui.dll; \
+	put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \
+	put /usr/share/cups/drivers/cups.hlp cups.hlp'
 
    
 (Note that this command should be entered in one long single
-line. Line-breaks and the line-end indicating "\" has been inserted
+line. Line-breaks and the line-end indicating "\" has been inserted
 for readability reasons.) This step is required
 for the next one to succeed. It makes the driver files physically
 present in the [print$] share. However, clients
 would still not be able to install them, because Samba does not yet
 treat them as driver files. A client asking for the driver would still
-be presented with a "not installed here" message.
-
    • Fifth Step: Verify where the Driver Files are now
    -
-#  ls -l /etc/samba/drivers/W32X86/
- total 669
- drwxr-sr-x    2 root     ntadmin       532 May 25 23:08 2
- drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
- -rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
- -rwxr--r--    1 root     ntadmin    278380 May 25 23:21 cupsdrvr.dll
- -rwxr--r--    1 root     ntadmin    215848 May 25 23:21 cupsui.dll
- -rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
-
-
    
-The driver files now are in the W32X86 architecture "root" of
+be presented with a "not installed here" message.
+
  • Verify where the Driver Files are now
    +root# ls -l /etc/samba/drivers/W32X86/
+total 669
+drwxr-sr-x    2 root     ntadmin       532 May 25 23:08 2
+drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
+-rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
+-rwxr--r--    1 root     ntadmin    278380 May 25 23:21 cupsdrvr.dll
+-rwxr--r--    1 root     ntadmin    215848 May 25 23:21 cupsui.dll
+-rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
+
    
+The driver files now are in the W32X86 architecture "root" of
 [print$].
-
    • Sixth Step: Tell Samba that these are
+
  • Tell Samba that these are
 Driver Files
-(adddriver)
    • -
-#  rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \
-                                          cupsdrvr.dll:mysmbtstprn.PPD:                  \
-                                          cupsui.dll:cups.hlp:NULL:RAW[:]NULL"             \
-                                          localhost
-
- Printer Driver mydrivername successfully installed.
-
+(adddriver)
    +root# rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \
+  cupsdrvr.dll:mysmbtstprn.PPD: \
+  cupsui.dll:cups.hlp:NULL:RAW:NULL" \
+  localhost
+Printer Driver mydrivername successfully installed.
 
    
 Note that your cannot repeat this step if it fails. It could fail even
 as a result of a simple typo. It will most likely have moved a part of
-the driver files into the "2" subdirectory. If this step fails, you
+the driver files into the "2" subdirectory. If this step fails, you
 need to go back to the fourth step and repeat it, before you can try
 this one again. In this step you need to choose a name for your
 driver. It is normally a good idea to use the same name as is used for
 the printername; however, in big installations you may use this driver
 for a number of printers which have obviously different names. So the
 name of the driver is not fixed.
-
    Seventh Step: Verify where the Driver Files are now
    -
-#  ls -l /etc/samba/drivers/W32X86/
- total 1
- drwxr-sr-x    2 root     ntadmin       532 May 25 23:22 2
- drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
-
- 
-#  ls -l /etc/samba/drivers/W32X86/2
- total 5039
- [....]
- -rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
- -rwxr--r--    1 root     ntadmin    278380 May 13 13:53 cupsdrvr.dll
- -rwxr--r--    1 root     ntadmin    215848 May 13 13:53 cupsui.dll
- -rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
-
+
  • Verify where the Driver Files are now
    +root# ls -l /etc/samba/drivers/W32X86/
+total 1
+drwxr-sr-x    2 root     ntadmin       532 May 25 23:22 2
+drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
+
+root# ls -l /etc/samba/drivers/W32X86/2
+total 5039
+[....]
+-rwxr--r--    1 root     ntadmin     14234 May 25 23:21 cups.hlp
+-rwxr--r--    1 root     ntadmin    278380 May 13 13:53 cupsdrvr.dll
+-rwxr--r--    1 root     ntadmin    215848 May 13 13:53 cupsui.dll
+-rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
 
    
 Notice how step 6 did also move the driver files to the appropriate
 subdirectory. Compare with the situation after step 5.
-
    • Eighth Step (optional): Verify if Samba now recognizes the
-Driver
    -
-#  rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost | grep -B2 -A5 mydrivername
-
- Printer Driver Info 3:
-        Version: [2]
-        Driver Name: [mydrivername]
-        Architecture: [Windows NT x86]
-        Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
-        Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
-        Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
-        Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
-
+
  • (optional) Verify if Samba now recognizes the
+Driver
    +root# rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost \
+	| grep -B2 -A5 mydrivername
+Printer Driver Info 3:
+Version: [2]
+Driver Name: [mydrivername]
+Architecture: [Windows NT x86]
+Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
+Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
+Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
+Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
 
    
 Remember, this command greps for the name you did choose for the
 driver in step Six. This command must succeed before you can proceed.
-
    • Ninth Step: Tell Samba which Printer should use these Driver
-Files (setdriver)
    -
-#  rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost
- 
- Successfully set mysmbtstprn to driver mydrivername
-
+
  • Tell Samba which Printer should use these Driver
+Files (setdriver)
    +root# rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost
+Successfully set mysmbtstprn to driver mydrivername
 
    
 Since you can bind any printername (=printqueue) to any driver, this
 is a very convenient way to setup many queues which use the same
@@ -10515,99 +10076,95 @@ driver. You don't need to repeat all the previous steps for the
 setdriver command to succeed. The only pre-conditions are:
 enumdrivers must find the driver and
 enumprinters must find the printer.
-
    • Tenth Step (optional): Verify if Samba has this Association
-recognized
    -
-#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
-       drivername:[mydrivername]
+
  • (optional) Verify if Samba has this Association
+recognized
    +root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
+  | grep driver
+drivername:[mydrivername]
  
-#  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep -C4 driv
-       servername:[\\kde-bitshop]
-       printername:[\\kde-bitshop\mysmbtstprn]
-       sharename:[mysmbtstprn]
-       portname:[Done]
-       drivername:[mydrivername]
-       comment:[mysmbtstprn]
-       location:[]
-       sepfile:[]
-       printprocessor:[winprint]
+root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
+  | grep -C4 driv
+servername:[\\kde-bitshop]
+printername:[\\kde-bitshop\mysmbtstprn]
+sharename:[mysmbtstprn]
+portname:[Done]
+drivername:[mydrivername]
+comment:[mysmbtstprn]
+location:[]
+sepfile:[]
+printprocessor:[winprint]
  
-#  rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
- [Windows NT x86]
- Printer Driver Info 3:
-       Version: [2]
-       Driver Name: [mydrivername]
-       Architecture: [Windows NT x86]
-       Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
-       Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
-       Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
-       Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
-       Monitorname: []
-       Defaultdatatype: [RAW]
-       Monitorname: []
-       Defaultdatatype: [RAW]
+root# rpcclient -U root%xxxx -c 'getdriver mysmbtstprn' localhost
+[Windows NT x86]
+Printer Driver Info 3:
+     Version: [2]
+     Driver Name: [mydrivername]
+     Architecture: [Windows NT x86]
+     Driver Path: [\\kde-bitshop\print$\W32X86\2\cupsdrvr.dll]
+     Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
+     Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
+     Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
+     Monitorname: []
+     Defaultdatatype: [RAW]
+     Monitorname: []
+     Defaultdatatype: [RAW]
  
-#  rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn
-       name:[\\kde-bitshop\mysmbtstprn]
-       description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn]
-       comment:[mysmbtstprn]
+root# rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn
+     name:[\\kde-bitshop\mysmbtstprn]
+     description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn]
+     comment:[mysmbtstprn]
 
 
    
+
 Compare these results with the ones from steps 2 and 3. Note that
 every single of these commands show the driver is installed.  Even
 the enumprinters command now lists the driver
-on the "description" line.
-
    • Eleventh Step (optional): Tickle the Driver into a correct
-Device Mode
    
+on the "description" line.
+
  • (optional) Tickle the Driver into a correct
+Device Mode
    
+
 You certainly know how to install the driver on the client.  In case
 you are not particularly familiar with Windows, here is a short
 recipe: browse the Network Neighbourhood, go to the Samba server, look
 for the shares. You should see all shared Samba printers.
 Double-click on the one in question. The driver should get
 installed, and the network connection set up. An alternative way is to
-open the "Printers (and Faxes)" folder, right-click on the printer in
-question and select "Connect" or "Install". As a result, a new printer
-should have appeared in your client's local "Printers (and Faxes)"
-folder, named something like "printersharename on Sambahostname".
+open the "Printers (and Faxes)" folder, right-click on the printer in
+question and select "Connect" or "Install". As a result, a new printer
+should have appeared in your client's local "Printers (and Faxes)"
+folder, named something like "printersharename on Sambahostname".
 
    
 It is important that you execute this step as a Samba printer admin
 (as defined in smb.conf). Here is another method
 to do this on Windows XP. It uses a commandline, which you may type
-into the "DOS box" (type root's smbpassword when prompted):
+into the "DOS box" (type root's smbpassword when prompted):
 
    -
- C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n \\sambacupsserver\mysmbtstprn"
-
+C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n\
+			\\sambacupsserver\mysmbtstprn"
 
    
-Change any printer setting once (like "portrait"
---> "landscape"), click "Apply"; change the setting
+Change any printer setting once (like changing "portrait" to
+	"landscape"), click Apply; change the setting
 back.
-
    • Twelfth Step: Install the Printer on a Client
-("Point'n'Print")
    -
- C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn"
-
+
  • Install the Printer on a Client
+("Point'n'Print")
    +C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn"
 
    
 If it doesn't work it could be a permission problem with the
 [print$] share.
-
    • Thirteenth Step (optional): Print a Test Page
    -
- C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn"
-
+
  • Thirteenth Step (optional): Print a Test Page
    +C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn"
 
    
 Then hit [TAB] 5 times, [ENTER] twice, [TAB] once and [ENTER] again
 and march to the printer.
-
    • Fourteenth Step (recommended): Study the Test Page
    
+
  • Fourteenth Step (recommended): Study the Test Page
    
 Hmmm.... just kidding! By now you know everything about printer
 installations and you don't need to read a word. Just put it in a
-frame and bolt it to the wall with the heading "MY FIRST
-RPCCLIENT-INSTALLED PRINTER" - why not just throw it away!
-
    • Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your
-Success
    -
-# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd     
-
-

    Troubleshooting revisited

    +frame and bolt it to the wall with the heading "MY FIRST +RPCCLIENT-INSTALLED PRINTER" - why not just throw it away! +

  • Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your +Success

    +root# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd
+

    • Troubleshooting revisited

    The setdriver command will fail, if in Samba's mind the queue is not already there. You had promising messages about the: 

    @@ -10615,42 +10172,52 @@ already there. You had promising messages about the:
  Printer Driver ABC successfully installed.

    -after the "adddriver" parts of the procedure? But you are also seeing +after the "adddriver" parts of the procedure? But you are also seeing a disappointing message like this one beneath? 

     
  result was NT_STATUS_UNSUCCESSFUL

    -It is not good enough that you + +It is not good enough that you can see the queue in CUPS, using the lpstat -p ir85wm command. A bug in most recent versions of Samba prevents the proper update of the queuelist. The recognition of newly installed CUPS printers fails unless you re-start Samba or send a HUP to all smbd processes. To verify if this is the reason why Samba doesn't -execute the setdriver command successfully, check if Samba "sees" +execute the setdriver command successfully, check if Samba "sees" the printer: -

    -
-# rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep  ir85wm
+
    +root# rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep  ir85wm
         printername:[ir85wm]
-
 
    
 An alternative command could be this: 
-
    -
-# rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' 
+
    +root# rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' 
         cmd = getprinter ir85wm
         flags:[0x800000]
         name:[\\transmeta\ir85wm]
         description:[\\transmeta\ir85wm,ir85wm,DPD]
         comment:[CUPS PostScript-Treiber for WinNT/2K/XP]
-
 
    
 BTW, you can use these commands, plus a few more, of course,
 to install drivers on remote Windows NT print servers too!
-

    The printing *.tdb Files

    +

    The printing *.tdb Files

    + + + + + + + + + + + + + Some mystery is associated with the series of files with a tdb-suffix appearing in every Samba installation. They are connections.tdb, @@ -10665,12 +10232,12 @@ tdb-suffix appearing in every Samba installation. They are ntprinters.tdb, sessionid.tdb and secrets.tdb. What is their purpose? -

    Trivial DataBase Files

    +

    Trivial DataBase Files

    A Windows NT (Print) Server keeps track of all information needed to serve its duty toward its clients by storing entries in the Windows -"Registry". Client queries are answered by reading from the registry, +"Registry". Client queries are answered by reading from the registry, Administrator or user configuration settings are saved by writing into -the Registry. Samba and Unix obviously don't have such a kind of +the Registry. Samba and UNIX obviously don't have such a kind of Registry. Samba instead keeps track of all client related information in a series of *.tdb files. (TDB = Trivial Data Base). These are often located in /var/lib/samba/ @@ -10678,10 +10245,10 @@ or /var/lock/samba/ . The printing related files are ntprinters.tdb, printing.tdb,ntforms.tdb and ntdrivers.tdb. -

    Binary Format

    +

    Binary Format

    *.tdb files are not human readable. They are -written in a binary format. "Why not ASCII?", you may ask. "After all, -ASCII configuration files are a good and proofed tradition on UNIX." +written in a binary format. "Why not ASCII?", you may ask. "After all, +ASCII configuration files are a good and proofed tradition on UNIX." -- The reason for this design decision by the Samba Team is mainly performance. Samba needs to be fast; it runs a separate smbd process for each client connection, in some @@ -10691,7 +10258,7 @@ same time. The file format of Samba's *.tdb files allows for this provision. Many smbd processes may write to the same *.tdb file at the same time. This wouldn't be possible with pure ASCII files. -

    Losing *.tdb Files

    +

    Losing *.tdb Files

    It is very important that all *.tdb files remain consistent over all write and read accesses. However, it may happen that these files do get corrupted. (A @@ -10701,13 +10268,12 @@ etc.). In cases of trouble, a deletion of the old printing-related *.tdb files may be the only option. You need to re-create all print related setup after that. Or you have made a backup of the *.tdb files in time. -

    Using tdbbackup

    +

    Using tdbbackup

    Samba ships with a little utility which helps the root user of your system to back up your *.tdb files. If you run it with no argument, it prints a little usage message: 

    -
-# tdbbackup
+root# tdbbackup
  Usage: tdbbackup [options] <fname...>
  
  Version:3.0a
@@ -10718,36 +10284,34 @@ with no argument, it prints a little usage message:

    Here is how I backed up my printing.tdb file: 

    -
-# ls 
- .           browse.dat       locking.tdb     ntdrivers.tdb   printing.tdb    share_info.tdb
- ..          connections.tdb  messages.tdb    ntforms.tdb     printing.tdbkp  unexpected.tdb
- brlock.tdb  gmon.out         namelist.debug  ntprinters.tdb  sessionid.tdb
+root# ls
+.              browse.dat       locking.tdb     ntdrivers.tdb   printing.tdb
+..             share_info.tdb   connections.tdb messages.tdb    ntforms.tdb
+printing.tdbkp unexpected.tdb   brlock.tdb      gmon.out        namelist.debug  
+ntprinters.tdb sessionid.tdb
  
- kde-bitshop:/var/lock/samba # tdbbackup -s .bak printing.tdb
+root# tdbbackup -s .bak printing.tdb
  printing.tdb : 135 records
  
- kde-bitshop:/var/lock/samba # ls -l printing.tdb*
+root# ls -l printing.tdb*
  -rw-------    1 root     root        40960 May  2 03:44 printing.tdb
  -rw-------    1 root     root        40960 May  2 03:44 printing.tdb.bak
 
-

    CUPS Print Drivers from Linuxprinting.org

    +

    CUPS Print Drivers from Linuxprinting.org

    CUPS ships with good support for HP LaserJet type printers. You can install the generic driver as follows: -

    -
-lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
-
+
    +root# lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
 
    
-The -m switch will retrieve the
+The -m switch will retrieve the
 laserjet.ppd from the standard repository for
 not-yet-installed-PPDs, which CUPS typically stores in
 /usr/share/cups/model. Alternatively, you may use
--P /path/to/your.ppd.
+-P /path/to/your.ppd.
 
    
 The generic laserjet.ppd however does not support every special option
-for every LaserJet-compatible model. It constitutes a sort of "least
-denominator" of all the models. If for some reason it is ruled out to
+for every LaserJet-compatible model. It constitutes a sort of "least
+denominator" of all the models. If for some reason it is ruled out to
 you to pay for the commercially available ESP Print Pro drivers, your
 first move should be to consult the database on http://www.linuxprinting.org/printer_list.cgi.
 Linuxprinting.org has excellent recommendations about which driver is
@@ -10755,8 +10319,9 @@ best used for each printer. Its database is kept current by the
 tireless work of Till Kamppeter from MandrakeSoft, who is also the
 principal author of the foomatic-rip utility.
 
    Note
    
-The former "cupsomatic" concept is now be replaced by the new, much
-more powerful "foomatic-rip". foomatic-rip is the successor of
+
+The former "cupsomatic" concept is now be replaced by the new, much
+more powerful "foomatic-rip". foomatic-rip is the successor of
 cupsomatic. cupsomatic is no longer maintained. Here is the new URL
 to the Foomatic-3.0 database:http://www.linuxprinting.org/driver_list.cgi.
 If you upgrade to foomatic-rip, don't forget to also upgrade to the
@@ -10765,7 +10330,7 @@ not work with PPDs generated for the old cupsomatic. The new-style
 PPDs are 100% compliant to the Adobe PPD specification. They are
 intended to be used by Samba and the cupsaddsmb utility also, to
 provide the driver files for the Windows clients also!
-
    foomatic-rip and Foomatic explained
    
+
    foomatic-rip and Foomatic explained
    
 Nowadays most Linux distros rely on the utilities of Linuxprinting.org
 to create their printing related software (which, BTW, works on all
 UNIXes and on Mac OS X or Darwin too). It is not known as well as it
@@ -10782,63 +10347,63 @@ its Foomatic<
 database. Currently there are 245 drivers
 in the database: many drivers support various models, and many models
 may be driven by different drivers; it's your choice!
-
    690 "perfect" Printers
    
-At present there are 690 devices dubbed as working "perfectly", 181
-"mostly", 96 "partially" and 46 are "Paperweights". Keeping in mind
+
    690 "perfect" Printers
    
+At present there are 690 devices dubbed as working "perfectly", 181
+"mostly", 96 "partially" and 46 are "Paperweights". Keeping in mind
 that most of these are non-PostScript models (PostScript printers are
 automatically supported supported by CUPS to perfection, by using
 their own manufacturer-provided Windows-PPD...), and that a
-multifunctional device never qualifies as working "perfectly" if it
+multifunctional device never qualifies as working "perfectly" if it
 doesn't also scan and copy and fax under GNU/Linux: then this is a
 truly astonishing achievement. Three years ago the number was not
-more than 500, and Linux or UNIX "printing" at the time wasn't
+more than 500, and Linux or UNIX "printing" at the time wasn't
 anywhere near the quality it is today!
-
    How the "Printing HOWTO" started it all
    
+
    How the "Printing HOWTO" started it all
    
 A few years ago Grant Taylor
 started it all. The roots of today's Linuxprinting.org are in the
 first Linux Printing
 HOWTO which he authored. As a side-project to this document,
 which served many Linux users and admins to guide their first steps in
 this complicated and delicate setup (to a scientist, printing is
-"applying a structured deposition of distinct patterns of ink or toner
-particles on paper substrates" ;-), he started to
+"applying a structured deposition of distinct patterns of ink or toner
+particles on paper substrates" ;-), he started to
 build in a little Postgres database with information about the
 hardware and driver zoo that made up Linux printing of the time. This
 database became the core component of today's Foomatic collection of
 tools and data. In the meantime it has moved to an XML representation
 of the data.
-
    Foomatic's strange Name
    
-"Why the funny name?", you ask. When it really took off, around spring
+
    Foomatic's strange Name
    
+"Why the funny name?", you ask. When it really took off, around spring
 2000, CUPS was far less popular than today, and most systems used LPD,
-LPRng or even PDQ to print. CUPS shipped with a few generic "drivers"
+LPRng or even PDQ to print. CUPS shipped with a few generic "drivers"
 (good for a few hundred different printer models). These didn't
 support many device-specific options. CUPS also shipped with its own
-built-in rasterization filter ("pstoraster", derived from
+built-in rasterization filter ("pstoraster", derived from
 Ghostscript). On the other hand, CUPS provided brilliant support for
 controlling all printer options through
-standardized and well-defined "PPD files" (PostScript Printers
+standardized and well-defined "PPD files" (PostScript Printers
 Description files). Plus, CUPS was designed to be easily extensible.
 
    
 Grant already had in his database a respectable compilation
-of facts about a many more printers, and the Ghostscript "drivers"
+of facts about a many more printers, and the Ghostscript "drivers"
 they run with. His idea, to generate PPDs from the database info
 and use them to make standard Ghostscript filters work within CUPS,
-proved to work very well. It also "killed several birds with one
-stone":
+proved to work very well. It also "killed several birds with one
+stone":
 
    • It made all current and future Ghostscript filter
 developments available for CUPS;
    • It made available a lot of additional printer models
-to CUPS users (because often the "traditional" Ghostscript way of
+to CUPS users (because often the "traditional" Ghostscript way of
 printing was the only one available);
    • It gave all the advanced CUPS options (web interface,
 GUI driver configurations) to users wanting (or needing) to use
-Ghostscript filters.
    cupsomatic, pdqomatic, lpdomatic, directomatic
    
+Ghostscript filters.
    cupsomatic, pdqomatic, lpdomatic, directomatic
    
 CUPS worked through a quickly-hacked up filter script named cupsomatic.
 cupsomatic ran the printfile through Ghostscript, constructing
 automatically the rather complicated command line needed. It just
 required to be copied into the CUPS system to make it work. To
-"configure" the way cupsomatic controls the Ghostscript rendering
+"configure" the way cupsomatic controls the Ghostscript rendering
 process, it needs a CUPS-PPD. This PPD is generated directly from the
 contents of the database. For CUPS and the respective printer/filter
-combo another Perl script named "CUPS-O-Matic" did the PPD
+combo another Perl script named "CUPS-O-Matic" did the PPD
 generation. After that was working, Grant implemented within a few
 days a similar thing for two other spoolers. Names chosen for the
 config-generator scripts were PDQ-O-Matic
@@ -10856,25 +10421,25 @@ printers. He also developed the support for other spoolers, like
 PPR (via ppromatic),
 GNUlpr and
 LPRng (both via an extended
-lpdomatic) and "spoolerless" printing (directomatic)....
+lpdomatic) and "spoolerless" printing (directomatic)....
 
    
-So, to answer your question: "Foomatic" is the general name for all
-the overlapping code and data behind the "*omatic" scripts.... --
+So, to answer your question: "Foomatic" is the general name for all
+the overlapping code and data behind the "*omatic" scripts.... --
 Foomatic up to versions 2.0.x required (ugly) Perl data structures
 attached the Linuxprinting.org PPDs for CUPS. It had a different
-"*omatic" script for every spooler, as well as different printer
+"*omatic" script for every spooler, as well as different printer
 configuration files..
-
    7.13.1.5.The Grand Unification
-achieved...
    
+
    The Grand Unification
+achieved...
    
 This all has changed in Foomatic versions 2.9 (Beta) and released as
-"stable" 3.0. This has now achieved the convergence of all *omatic
+"stable" 3.0. This has now achieved the convergence of all *omatic
 scripts: it is called the foomatic-rip.
 This single script is the unification of the previously different
 spooler-specific *omatic scripts. foomatic-rip is used by all the
 different spoolers alike. Because foomatic-rip can read PPDs (both the
 original PostScript printer PPDs and the Linuxprinting.org-generated
 ones), all of a sudden all supported spoolers can have the power of
-PPDs at their disposal; users only need to plug "foomatic-rip" into
+PPDs at their disposal; users only need to plug "foomatic-rip" into
 their system.... For users there is improved media type and source
 support; paper sizes and trays are easier to configure.
 
    
@@ -10900,7 +10465,7 @@ sizes for many printers; and it will support printing on media drawn
 from different paper trays within the same job (in both cases: even
 where there is no support for this from Windows-based vendor printer
 drivers).
-
    Driver Development outside
    
+
    Driver Development outside
    
 Most driver development itself does not happen within
 Linuxprinting.org. Drivers are written by independent maintainers.
 Linuxprinting.org just pools all the information, and stores it in its
@@ -10913,7 +10478,7 @@ the work is currently done in three projects. These are:
 
    • Omni
 -- a Free Software project by IBM which tries to convert their printer
 driver knowledge from good-ol' OS/2 times into a modern, modular,
-universal driver architecture for Linux/Unix (still Beta).  This
+universal driver architecture for Linux/UNIX (still Beta).  This
 currently supports 437 models.
    • HPIJS --
 a Free Software project by HP to provide the support for their own
 range of models (very mature, printing in most cases is perfect and
@@ -10923,9 +10488,9 @@ effort, started by Michael Sweet (also lead developer for CUPS), now
 directed by Robert Krawitz, which has achieved an amazing level of
 photo print quality (many Epson users swear that its quality is
 better than the vendor drivers provided by Epson for the Microsoft
-platforms). This currently supports 522 models.
    Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and
-commercial Unix
    
-Linuxprinting.org today is the one-stop "shop" to download printer
+platforms). This currently supports 522 models.
    Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and
+commercial UNIX
    
+Linuxprinting.org today is the one-stop "shop" to download printer
 drivers. Look for printer information and tutorials
 or solve printing problems in its popular forums.  But
 it's not just for GNU/Linux: users and admins of commercial UNIX
@@ -10944,17 +10509,17 @@ of the Foomatic project.
 Till Kamppeter from MandrakeSoft is doing an excellent job in his
 spare time to maintain Linuxprinting.org and Foomatic. So if you use
 it often, please send him a note showing your appreciation.
-

    Foomatic Database generated PPDs

    +

    Foomatic Database generated PPDs

    The Foomatic database is an amazing piece of ingenuity in itself. Not only does it keep the printer and driver information, but it is -organized in a way that it can generate "PPD" files "on the fly" from +organized in a way that it can generate "PPD" files "on the fly" from its internal XML-based datasets. While these PPDs are modelled to the -Adobe specification of "PostScript Printer Descriptions" (PPDs), the +Adobe specification of "PostScript Printer Descriptions" (PPDs), the Linuxprinting.org/Foomatic-PPDs don't normally drive PostScript printers: they are used to describe all the bells and whistles you could ring or blow on an Epson Stylus inkjet, or a HP Photosmart or -what-have-you. The main "trick" is one little additional line, not -envisaged by the PPD specification, starting with the "*cupsFilter" +what-have-you. The main "trick" is one little additional line, not +envisaged by the PPD specification, starting with the "*cupsFilter" keyword: it tells the CUPS daemon how to proceed with the PostScript print file (old-style Foomatic-PPDs named the cupsomatic filter script, while the new-style @@ -10965,12 +10530,12 @@ filter or internal device setting it should ask from Ghostscript to convert the PostScript printjob into a raster format ready for the target device. This usage of PPDs to describe the options of non-PS printers was the invention of the CUPS developers. The rest is easy: -GUI tools (like KDE's marvellous "kprinter", -or the GNOME "gtklp", "xpp" and the CUPS +GUI tools (like KDE's marvellous "kprinter", +or the GNOME "gtklp", "xpp" and the CUPS web interface) read the PPD too and use this information to present the available settings to the user as an intuitive menu selection. -

    foomatic-rip and Foomatic-PPD Download and Installation

    -Here are the steps to install a foomatic-rip driven "LaserJet 4 Plus" +

    foomatic-rip and Foomatic-PPD Download and Installation

    +Here are the steps to install a foomatic-rip driven "LaserJet 4 Plus" compatible printer in CUPS (note that recent distributions of SuSE, UnitedLinux and Mandrake may ship with a complete package of Foomatic-PPDs plus the foomatic-rip utility. going directly to @@ -10982,12 +10547,12 @@ Linuxprinting.org ensures you to get the latest driver/PPD files): link.

  • You'll arrive at a page listing all drivers working with this model (for all printers, there will always be one recommended driver. Try this one -first).

  • In our case ("HP LaserJet 4 Plus"), we'll arrive here: -http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus -

  • The recommended driver is "ljet4".

  • There are several links provided here. You should +first).

  • In our case ("HP LaserJet 4 Plus"), we'll arrive here: + http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus +

  • The recommended driver is "ljet4".

  • There are several links provided here. You should visit them all, if you are not familiar with the Linuxprinting.org -database.

  • There is a link to the database page for the "ljet4": -http://www.linuxprinting.org/show_driver.cgi?driver=ljet4 +database.

  • There is a link to the database page for the "ljet4": + http://www.linuxprinting.org/show_driver.cgi?driver=ljet4 On the driver's page, you'll find important and detailed information about how to use that driver within the various available spoolers.

  • Another link may lead you to the homepage of the @@ -10996,7 +10561,7 @@ setup instructions for CUPS (http://www.linuxprinting.org/pdq-doc.html), LPD, LPRng and GNUlpr (http://www.linuxprinting.org/lpd-doc.html) as well as PPR (http://www.linuxprinting.org/ppr-doc.html) -or "spooler-less" printing (http://www.linuxprinting.org/direct-doc.html +or "spooler-less" printing (http://www.linuxprinting.org/direct-doc.html ).

  • You can view the PPD in your browser through this link: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1

  • You can also (most importantly) @@ -11006,18 +10571,18 @@ model and the driver; this is, once installed, working transparently for the user. Later you'll only need to choose resolution, paper size etc. from the web-based menu, or from the print dialog GUI, or from the commandline.

  • Should you have ended up on the driver's page (http://www.linuxprinting.org/show_driver.cgi?driver=ljet4), -you can choose to use the "PPD-O-Matic" online PPD generator -program.

  • Select the exact model and check either "download" or -"display PPD file" and click on "Generate PPD file".

  • If you save the PPD file from the browser view, please -don't use "cut'n'past" (since it could possibly damage line endings -and tabs, which makes the PPD likely to fail its duty), but use "Save -as..." in your browser's menu. (Best is to use the "download" option +you can choose to use the "PPD-O-Matic" online PPD generator +program.

  • Select the exact model and check either "download" or +"display PPD file" and click on "Generate PPD file".

  • If you save the PPD file from the browser view, please +don't use "cut'n'past" (since it could possibly damage line endings +and tabs, which makes the PPD likely to fail its duty), but use "Save +as..." in your browser's menu. (Best is to use the "download" option from the web page directly).

  • Another very interesting part on each driver page is the Show execution details button. If you select your printer model and click that button, you will get displayed a complete Ghostscript command line, enumerating all options available for that driver/printermodel combo. This is a great way to -"Learn Ghostscript By Doing". It is also an excellent "cheat sheet" +"Learn Ghostscript By Doing". It is also an excellent "cheat sheet" for all experienced users who need to re-construct a good command line for that damn printing script, but can't remember the exact syntax. ;-)

  • Some time during your visit to Linuxprinting.org, save @@ -11028,12 +10593,10 @@ the /usr/share/cups/model/ path and re-start cupsd).

  • Then install the printer with a suitable commandline, e.g.: 

    -
-lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd
-
-

  • Note again this: for all the new-style "Foomatic-PPDs" -from Linuxprinting.org, you also need a special "CUPS filter" named -"foomatic-rip".Get the latest version of "foomatic-rip" from: http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0 +root# lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd +

  • Note again this: for all the new-style "Foomatic-PPDs" +from Linuxprinting.org, you also need a special "CUPS filter" named +"foomatic-rip".Get the latest version of "foomatic-rip" from: http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0

  • The foomatic-rip Perlscript itself also makes some interesting reading (http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=1), because it is very well documented by Till's inline comments (even @@ -11041,8 +10604,8 @@ non-Perl hackers will learn quite a bit about printing by reading it... ;-)

  • Save foomatic-rip either directly in /usr/lib/cups/filter/foomatic-rip or somewhere in your $PATH (and don't forget to make it world-executable). Again, -don't save by "copy'n'paste" but use the appropriate link, or the -"Save as..." menu item in your browser.

  • If you save foomatic-rip in your $PATH, create a symlink: +don't save by "copy'n'paste" but use the appropriate link, or the +"Save as..." menu item in your browser.

  • If you save foomatic-rip in your $PATH, create a symlink: cd /usr/lib/cups/filter/ ; ln -s `which foomatic-rip`. For CUPS to discover this new available filter at startup, you need to re-start @@ -11058,18 +10621,18 @@ data should look like and which printer commands to embed into the data stream.

    You need: -

    • A "foomatic+something" PPD -- but it this not enough +

      • A "foomatic+something" PPD -- but it this not enough to print with CUPS (it is only one important -component)

      • The "foomatic-rip" filter script (Perl) in +component)

      • The "foomatic-rip" filter script (Perl) in /usr/lib/cups/filters/

      • Perl to make foomatic-rip run

      • Ghostscript (because it is doing the main work, controlled by the PPD/foomatic-rip combo) to produce the raster data fit for your printermodel's consumption

      • Ghostscript must (depending on -the driver/model) contain support for a certain "device", representing -the selected "driver" for your model (as shown by "gs --h")

      • foomatic-rip needs a new version of PPDs (PPD versions +the driver/model) contain support for a certain "device", representing +the selected "driver" for your model (as shown by "gs +-h")

      • foomatic-rip needs a new version of PPDs (PPD versions produced for cupsomatic don't work with -foomatic-rip).

    • Page Accounting with CUPS

    -Often there are questions regarding "print quotas" wherein Samba users +foomatic-rip).

    Page Accounting with CUPS

    +Often there are questions regarding "print quotas" wherein Samba users (that is, Windows clients) should not be able to print beyond a certain amount of pages or data volume per day, week or month. This feature is dependent on the real print subsystem you're using. @@ -11077,58 +10640,57 @@ Samba's part is always to receive the job files from the clients (filtered or unfiltered) and hand it over to this printing subsystem.

    -Of course one could "hack" things with one's own scripts. But then -there is CUPS. CUPS supports "quotas" which can be based on sizes of +Of course one could "hack" things with one's own scripts. But then +there is CUPS. CUPS supports "quotas" which can be based on sizes of jobs or on the number of pages or both, and are spanning any time period you want. -

    Setting up Quotas

    +

    Setting up Quotas

    This is an example command how root would set a print quota in CUPS, -assuming an existing printer named "quotaprinter": -

    -
-  lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 -o job-page-limit=100
-
+assuming an existing printer named "quotaprinter":
+
    +root# lpadmin -p quotaprinter -o job-quota-period=604800 \
+	-o job-k-limit=1024 -o job-page-limit=100
 
    
 This would limit every single user to print 100 pages or 1024 KB of
 data (whichever comes first) within the last 604,800 seconds ( = 1
 week).
-

    Correct and incorrect Accounting

    +

    Correct and incorrect Accounting

    For CUPS to count correctly, the printfile needs to pass the CUPS -"pstops" filter, otherwise it uses a "dummy" count of "1". Some +"pstops" filter, otherwise it uses a "dummy" count of "1". Some printfiles don't pass it (eg: image files) but then those are mostly 1 page jobs anyway. This also means that proprietary drivers for the target printer running on the client computers and CUPS/Samba, which -then spool these files as "raw" (i.e. leaving them untouched, not -filtering them), will be counted as "1-pagers" too! +then spool these files as "raw" (i.e. leaving them untouched, not +filtering them), will be counted as "1-pagers" too!

    You need to send PostScript from the clients (i.e. run a PostScript driver there) to have the chance to get accounting done. If the printer is a non-PostScript model, you need to let CUPS do the job to convert the file to a print-ready format for the target printer. This will be working for currently about 1,000 different printer models, -see http://www.linuxprinting.org/printer_list.cgi). -

    Adobe and CUPS PostScript Drivers for Windows Clients

    +see the driver list at linuxprinting.org/. +

    Adobe and CUPS PostScript Drivers for Windows Clients

    Before CUPS-1.1.16 your only option was to use the Adobe PostScript Driver on the Windows clients. The output of this driver was not -always passed through the "pstops" filter on the CUPS/Samba side, and +always passed through the "pstops" filter on the CUPS/Samba side, and therefore was not counted correctly (the reason is that it often, -depending on the "PPD" being used, wrote a "PJL"-header in front of +depending on the "PPD" being used, wrote a "PJL"-header in front of the real PostScript which caused CUPS to skip pstops and go directly -to the "pstoraster" stage). +to the "pstoraster" stage).

    -From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver for -Windows NT/2K/XP clients" (which is tagged in the download area of -http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). It does +From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver for +Windows NT/2K/XP clients" (which is tagged in the download area of +http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). It does not work for Win9x/ME clients. But it guarantees: -

    • to not write an PJL-header

    • to still read and support all PJL-options named in the -driver PPD with its own means

    • that the file will pass through the "pstops" filter +

      • to not write an PJL-header

      • to still read and support all PJL-options named in the +driver PPD with its own means

      • that the file will pass through the "pstops" filter on the CUPS/Samba server

      • to page-count correctly the printfile

      You can read more about the setup of this combination in the manpage -for "cupsaddsmb" (which is only present with CUPS installed, and only +for "cupsaddsmb" (which is only present with CUPS installed, and only current from CUPS 1.1.16). -

    The page_log File Syntax

    -These are the items CUPS logs in the "page_log" for every +

    The page_log File Syntax

    +These are the items CUPS logs in the "page_log" for every single page of a job:

    • Printer name

    • User name

    • Job ID

    • Time of printing

    • the page number

    • the number of copies

    • a billing information string (optional)

    • the host which sent the job (included since version @@ -11136,103 +10698,93 @@ single page of a job: Here is an extract of my CUPS server's page_log file to illustrate the format and included items: 

      -
-        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13
-        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13
-        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13
-        infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13
-        DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33
-
-

      -This was job ID "401", printed on "infotec_IS2027" by user "kurt", a -64-page job printed in 3 copies and billed to "#marketing", sent -from IP address 10.160.50.13. The next job had ID "402", was sent by -user "boss" from IP address 10.160.51.33,printed from one page 440 -copies and is set to be billed to "finance-dep". -

    Possible Shortcomings

    +infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13 +infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13 +infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13 +infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13 +DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33 +

    +This was job ID "401", printed on "infotec_IS2027" by user "kurt", a +64-page job printed in 3 copies and billed to "#marketing", sent +from IP address 10.160.50.13. The next job had ID "402", was sent by +user "boss" from IP address 10.160.51.33,printed from one page 440 +copies and is set to be billed to "finance-dep". +

    Possible Shortcomings

    What flaws or shortcomings are there with this quota system?

    • the ones named above (wrongly logged job in case of printer hardware failure, etc.)

    • in reality, CUPS counts the job pages that are being processed in software (that is, going through the -"RIP") rather than the physical sheets successfully leaving the +"RIP") rather than the physical sheets successfully leaving the printing device. Thus if there is a jam while printing the 5th sheet out -of 1000 and the job is aborted by the printer, the "page count" will +of 1000 and the job is aborted by the printer, the "page count" will still show the figure of 1000 for that job

    • all quotas are the same for all users (no flexibility -to give the boss a higher quota than the clerk) no support for +to give the boss a higher quota than the clerk), no support for groups

    • no means to read out the current balance or the -"used-up" number of current quota

    • a user having used up 99 sheets of 100 quota will +"used-up" number of current quota

    • a user having used up 99 sheets of 100 quota will still be able to send and print a 1,000 sheet job

    • a user being denied a job because of a filled-up quota doesn't get a meaningful error message from CUPS other than -"client-error-not-possible".

    Future Developments

    +"client-error-not-possible".

    Future Developments

    This is the best system currently available, and there are huge improvements under development for CUPS 1.2: -

    • page counting will go into the "backends" (these talk +

      • page counting will go into the "backends" (these talk directly to the printer and will increase the count in sync with the actual printing process: thus a jam at the 5th sheet will lead to a stop in the counting)

      • quotas will be handled more flexibly

      • probably there will be support for users to inquire -their "accounts" in advance

      • probably there will be support for some other tools -around this topic

    Other Accounting Tools

    +their "accounts" in advance

  • probably there will be support for some other tools +around this topic

    • Other Accounting Tools

    PrintAnalyzer, pyKota, printbill, LogReport. -

    Additional Material

    +

    Additional Material

    A printer queue with no PPD associated to it is a -"raw" printer and all files will go directly there as received by the -spooler. The exceptions are file types "application/octet-stream" -which need "passthrough feature" enabled. "Raw" queues don't do any +"raw" printer and all files will go directly there as received by the +spooler. The exceptions are file types "application/octet-stream" +which need "passthrough feature" enabled. "Raw" queues don't do any filtering at all, they hand the file directly to the CUPS backend. This backend is responsible for the sending of the data to the device -(as in the "device URI" notation: lpd://, socket://, +(as in the "device URI" notation: lpd://, socket://, smb://, ipp://, http://, parallel:/, serial:/, usb:/ etc.)

    -"cupsomatic"/Foomatic are not native CUPS drivers +"cupsomatic"/Foomatic are not native CUPS drivers and they don't ship with CUPS. They are a Third Party add-on, developed at Linuxprinting.org. As such, they are a brilliant hack to make all models (driven by Ghostscript drivers/filters in traditional spoolers) also work via CUPS, with the same (good or bad!) quality as -in these other spoolers. "cupsomatic" is only a vehicle to execute a +in these other spoolers. "cupsomatic" is only a vehicle to execute a ghostscript commandline at that stage in the CUPS filtering chain, -where "normally" the native CUPS "pstoraster" filter would kick -in. cupsomatic by-passes pstoraster, "kidnaps" the printfile from CUPS +where "normally" the native CUPS "pstoraster" filter would kick +in. cupsomatic by-passes pstoraster, "kidnaps" the printfile from CUPS away and re-directs it to go through Ghostscript. CUPS accepts this, because the associated CUPS-O-Matic-/Foomatic-PPD specifies: -

    -
-   *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"
-
+
    +  *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"
 
    
 This line persuades CUPS to hand the file to cupsomatic, once it has
 successfully converted it to the MIME type
-"application/vnd.cups-postscript". This conversion will not happen for
+"application/vnd.cups-postscript". This conversion will not happen for
 Jobs arriving from Windows which are auto-typed
-"application/octet-stream", with the according changes in
+"application/octet-stream", with the according changes in
 /etc/cups/mime.types in place.
 
    
 CUPS is widely configurable and flexible, even regarding its filtering
 mechanism. Another workaround in some situations would be to have in
 /etc/cups/mime.types entries as follows:
-
    -
-   application/postscript           application/vnd.cups-raw  0  -
-   application/vnd.cups-postscript  application/vnd.cups-raw  0  -
-
+
    + application/postscript           application/vnd.cups-raw  0  -
+ application/vnd.cups-postscript  application/vnd.cups-raw  0  -
 
    
 This would prevent all Postscript files from being filtered (rather,
 they will through the virtual nullfilter
-denoted with "-").  This could only be useful for PS printers. If you
+denoted with "-").  This could only be useful for PS printers. If you
 want to print PS code on non-PS printers (provided they support ASCII
 text printing) an entry as follows could be useful:
-
    -
-   */*           application/vnd.cups-raw  0  -
-
+
    + */*           application/vnd.cups-raw  0  -
 
    
 and would effectively send all files to the
 backend without further processing.
 
    
 Lastly, you could have the following entry:
-
    -
-   application/vnd.cups-postscript  application/vnd.cups-raw  0  my_PJL_stripping_filter
-
+
    +application/vnd.cups-postscript application/vnd.cups-raw 0 my_PJL_stripping_filter
 
    
 You will need to write a my_PJL_stripping_filter
 (could be a shellscript) that parses the PostScript and removes the
@@ -11241,39 +10793,38 @@ unwanted PJL. This would need to conform to CUPS filter design
 username, jobtitle, copies, print options and possibly the
 filename). It would be installed as world executable into
 /usr/lib/cups/filters/ and will be called by CUPS
-if it encounters a MIME type "application/vnd.cups-postscript".
+if it encounters a MIME type "application/vnd.cups-postscript".
 
    
 CUPS can handle -o job-hold-until=indefinite.
-This keeps the job in the queue "on hold". It will only be printed
+This keeps the job in the queue "on hold". It will only be printed
 upon manual release by the printer operator. This is a requirement in
-many "central reproduction departments", where a few operators manage
+many "central reproduction departments", where a few operators manage
 the jobs of hundreds of users on some big machine, where no user is
 allowed to have direct access (such as when the operators often need
 to load the proper paper type before running the 10,000 page job
 requested by marketing for the mailing, etc.).
-

    Auto-Deletion or Preservation of CUPS Spool Files

    -Samba print files pass through two "spool" directories. One is the -incoming directory managed by Samba, (set in the path = -/var/spool/samba directive in the -[printers] section of +

    Auto-Deletion or Preservation of CUPS Spool Files

    +Samba print files pass through two "spool" directories. One is the +incoming directory managed by Samba, (set in the path = /var/spool/samba directive in the +[printers] section of smb.conf). The other is the spool directory of your UNIX print subsystem. For CUPS it is normally /var/spool/cups/, as set by the cupsd.conf directive RequestRoot /var/spool/cups. -

    CUPS Configuration Settings explained

    +

    CUPS Configuration Settings explained

    Some important parameter settings in the CUPS configuration file cupsd.conf are:

    PreserveJobHistory Yes

    This keeps some details of jobs in cupsd's mind (well it keeps the -"c12345", "c12346" etc. files in the CUPS spool directory, which do a +"c12345", "c12346" etc. files in the CUPS spool directory, which do a similar job as the old-fashioned BSD-LPD control files). This is set -to "Yes" as a default. +to "Yes" as a default.

    PreserveJobFiles Yes

    This keeps the job files themselves in cupsd's mind -(well it keeps the "d12345", "d12346" etc. files in the CUPS spool -directory...). This is set to "No" as the CUPS +(well it keeps the "d12345", "d12346" etc. files in the CUPS spool +directory...). This is set to "No" as the CUPS default. -

    "MaxJobs 500"

    +

    "MaxJobs 500"

    This directive controls the maximum number of jobs that are kept in memory. Once the number of jobs reaches the limit, the oldest completed job is automatically purged from the system to @@ -11282,468 +10833,153 @@ pending or active then the new job will be rejected. Setting the maximum to 0 disables this functionality. The default setting is 0.

    -(There are also additional settings for "MaxJobsPerUser" and -"MaxJobsPerPrinter"...) -

    Pre-conditions

    +(There are also additional settings for "MaxJobsPerUser" and +"MaxJobsPerPrinter"...) +

    Pre-conditions

    For everything to work as announced, you need to have three things: -

    • a Samba-smbd which is compiled against "libcups" (Check -on Linux by running "ldd `which smbd`")

    • a Samba-smb.conf setting of -"printing = cups"

    • another Samba-smb.conf setting of -"printcap = cups"

    Note

    +

    • a Samba-smbd which is compiled against "libcups" (Check +on Linux by running "ldd `which smbd`")

    • a Samba-smb.conf setting of + printing = cups

    • another Samba-smb.conf setting of + printcap = cups

    Note

    In this case all other manually set printing-related commands (like -"print command", "lpq command", "lprm command", "lppause command" or -"lpresume command") are ignored and they should normally have no +print command, +lpq command, +lprm command, +lppause command or +lpresume command) are ignored and they should normally have no influence what-so-ever on your printing. -

    Manual Configuration

    -If you want to do things manually, replace the "printing = -cups" by "printing = bsd". Then your manually set commands may work -(haven't tested this), and a "print command = lp -d %P %s; rm %s" +

    Manual Configuration

    +If you want to do things manually, replace the printing = cups +by printing = bsd. Then your manually set commands may work +(haven't tested this), and a print command = lp -d %P %s; rm %s" may do what you need. -

    When not to use Samba to print to -CUPS

    -[TO BE DONE] -

    In Case of Trouble.....

    +

    In Case of Trouble.....

    If you have more problems, post the output of these commands to the CUPS or Samba mailing lists (choose the one which seems more relevant to your problem): 

    -
-   grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
-   grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"
-
+$ grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
+$ grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"

    (adapt paths as needed). These commands leave out the empty -lines and lines with comments, providing the "naked settings" in a +lines and lines with comments, providing the "naked settings" in a compact way. Don't forget to name the CUPS and Samba versions you are using! This saves bandwidth and makes for easier readability for experts (and you are expecting experts to read them, right? ;-) -

    Where to find Documentation

    -[TO BE DONE] -

    How to ask for Help

    -[TO BE DONE] -

    Where to find Help

    -[TO BE DONE] -

    Appendix

    Printing from CUPS to Windows attached -Printers

    +

    Printing from CUPS to Windows attached +Printers

    From time to time the question arises, how you can print to a Windows attached printer from Samba. Normally the local connection -"Windows host <--> printer" would be done by USB or parallel +from Windows host to printer would be done by USB or parallel cable, but this doesn't matter to Samba. From here only an SMB connection needs to be opened to the Windows host. Of course, this -printer must be "shared" first. As you have learned by now, CUPS uses +printer must be "shared" first. As you have learned by now, CUPS uses backends to talk to printers and other servers. To talk to Windows shared printers you need to use the smb (surprise, surprise!) backend. Check if this is in the CUPS backend directory. This resides usually in -/usr/lib/cups/backend/. You need to find a "smb" +/usr/lib/cups/backend/. You need to find a "smb" file there. It should be a symlink to smbspool which file must exist and be executable: 

    -
- # ls -l /usr/lib/cups/backend/   
- total 253
- drwxr-xr-x    3 root     root          720 Apr 30 19:04 .
- drwxr-xr-x    6 root     root          125 Dec 19 17:13 ..
- -rwxr-xr-x    1 root     root        10692 Feb 16 21:29 canon
- -rwxr-xr-x    1 root     root        10692 Feb 16 21:29 epson
- lrwxrwxrwx    1 root     root            3 Apr 17 22:50 http -> ipp
- -rwxr-xr-x    1 root     root        17316 Apr 17 22:50 ipp
- -rwxr-xr-x    1 root     root        15420 Apr 20 17:01 lpd
- -rwxr-xr-x    1 root     root         8656 Apr 20 17:01 parallel
- -rwxr-xr-x    1 root     root         2162 Mar 31 23:15 pdfdistiller
- lrwxrwxrwx    1 root     root           25 Apr 30 19:04 ptal -> /usr/local/sbin/ptal-cups
- -rwxr-xr-x    1 root     root         6284 Apr 20 17:01 scsi
- lrwxrwxrwx    1 root     root           17 Apr  2 03:11 smb -> /usr/bin/smbspool
- -rwxr-xr-x    1 root     root         7912 Apr 20 17:01 socket
- -rwxr-xr-x    1 root     root         9012 Apr 20 17:01 usb
-
-# ls -l `which smbspool`
- -rwxr-xr-x    1 root     root       563245 Dec 28 14:49 /usr/bin/smbspool
-
+root# ls -l /usr/lib/cups/backend/
+total 253
+drwxr-xr-x    3 root     root          720 Apr 30 19:04 .
+drwxr-xr-x    6 root     root          125 Dec 19 17:13 ..
+-rwxr-xr-x    1 root     root        10692 Feb 16 21:29 canon
+-rwxr-xr-x    1 root     root        10692 Feb 16 21:29 epson
+lrwxrwxrwx    1 root     root            3 Apr 17 22:50 http -> ipp
+-rwxr-xr-x    1 root     root        17316 Apr 17 22:50 ipp
+-rwxr-xr-x    1 root     root        15420 Apr 20 17:01 lpd
+-rwxr-xr-x    1 root     root         8656 Apr 20 17:01 parallel
+-rwxr-xr-x    1 root     root         2162 Mar 31 23:15 pdfdistiller
+lrwxrwxrwx    1 root     root           25 Apr 30 19:04 ptal -> /usr/sbin/ptal-cups
+-rwxr-xr-x    1 root     root         6284 Apr 20 17:01 scsi
+lrwxrwxrwx    1 root     root           17 Apr  2 03:11 smb -> /usr/bin/smbspool
+-rwxr-xr-x    1 root     root         7912 Apr 20 17:01 socket
+-rwxr-xr-x    1 root     root         9012 Apr 20 17:01 usb
+
+root# ls -l `which smbspool`
+-rwxr-xr-x    1 root     root       563245 Dec 28 14:49 /usr/bin/smbspool

    If this symlink doesn't exist, create it: 

    -
-# ln -s `which smbspool` /usr/lib/cups/backend/smb
-
+root# ln -s `which smbspool` /usr/lib/cups/backend/smb

    smbspool has been written by Mike Sweet from the CUPS folks. It is included and ships with Samba. It may also be used with print subsystems other than CUPS, to spool jobs to Windows printer shares. To -set up printer "winprinter" on CUPS, you need to have a "driver" for -it. Essentially this means to convert the print data on the CUPS/Samba -host to a format that the printer can digest (the Windows host is -unable to convert any files you may send). This also means you should -be able to print to the printer if it were hooked directly at your -Samba/CUPS host. For troubleshooting purposes, this is what you -should do, to determine if that part of the process chain is in -order. Then proceed to fix the network connection/authentication to -the Windows host, etc. -

    -To install a printer with the smb backend on CUPS, use this command: -

    -
-# lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename -P /path/to/PPD
-
-

    -The PPD must be able to direct CUPS to generate -the print data for the target model. For PostScript printers just use -the PPD that would be used with the Windows NT PostScript driver. But -what can you do if the printer is only accessible with a password? Or -if the printer's host is part of another workgroup? This is provided -for: you can include the required parameters as part of the -smb:// device-URI. Like this: -

    -
- smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename 
- smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename
- smb://username:password@WINDOWSNETBIOSNAME/printersharename
-
-

    -Note that the device-URI will be visible in the process list of the -Samba server (e.g. when someone uses the ps -aux -command on Linux), even if the username and passwords are sanitized -before they get written into the log files. So this is an inherently -insecure option. However it is the only one. Don't use it if you want -to protect your passwords. Better share the printer in a way that -doesn't require a password! Printing will only work if you have a -working netbios name resolution up and running. Note that this is a -feature of CUPS and you don't necessarily need to have smbd running -(but who wants that? :-). -

    More CUPS filtering Chains

    -The following diagrams reveal how CUPS handles print jobs. -

    -#########################################################################
-#
-# CUPS in and of itself has this (general) filter chain (CAPITAL
-# letters are FILE-FORMATS or MIME types, other are filters (this is
-# true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro):
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      V
-#     somethingtops
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      V
-#     pstops
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT
-#      |
-#      V
-#     pstoraster   # as shipped with CUPS, independent from any Ghostscipt
-#      |           # installation on the system
-#      |  (= "postscipt interpreter")
-#      V
-# APPLICATION/VND.CUPS-RASTER
-#      |
-#      V
-#     rastertosomething  (e.g. Gimp-Print filters may be plugged in here)
-#      |   (= "raster driver")
-#      V
-# SOMETHING-DEVICE-SPECIFIC
-#      |
-#      V
-#     backend
-#
-#
-# ESP PrintPro has some enhanced "rastertosomething" filters as compared to
-# CUPS, and also a somewhat improved "pstoraster" filter.
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
-
    -#########################################################################
-#
-# This is how "cupsomatic" comes into play:
-# =========================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      V
-#    somethingtops
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      V
-#    pstops
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
-#      |                                          V
-#      V                                         cupsomatic
-#    pstoraster                                  (constructs complicated
-#      |  (= "postscipt interpreter")            Ghostscript commandline
-#      |                                         to let the file be
-#      V                                         processed by a
-# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
-#      |                                         call...)
-#      V                                          |
-#    rastertosomething                            V
-#      |    (= "raster driver")     +-------------------------+
-#      |                            | Ghostscript at work.... |
-#      V                            |                         |
-# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
-#      |                                          |
-#      V                                          |
-#    backend <------------------------------------+
-#      |
-#      V
-#    THE PRINTER
-#
-#
-# Note, that cupsomatic "kidnaps" the printfile after the
-# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it gh
-# the CUPS-external, systemwide Ghostscript installation, bypassing the
-# "pstoraster" filter (therefore also bypassing the CUPS-raster-drivers
-# "rastertosomething", and hands the rasterized file directly to the CUPS
-# backend...
-#
-# cupsomatic is not made by the CUPS developers. It is an independent
-# contribution to printing development, made by people from
-# Linuxprinting.org. (see also http://www.cups.org/cups-help.html)
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
-
    -#########################################################################
-#
-# And this is how it works for ESP PrintPro from 4.3:
-# ===================================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      V
-#     somethingtops
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      V
-#     pstops
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT
-#      |
-#      V
-#     gsrip
-#      |  (= "postscipt interpreter")
-#      V
-# APPLICATION/VND.CUPS-RASTER
-#      |
-#      V
-#     rastertosomething  (e.g. Gimp-Print filters may be plugged in here)
-#      |   (= "raster driver")
-#      V
-# SOMETHING-DEVICE-SPECIFIC
-#      |
-#      V
-#     backend
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
-
    -#########################################################################
-#
-# This is how "cupsomatic" would come into play with ESP PrintPro:
-# ================================================================
-#
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      V
-#    somethingtops
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      V
-#    pstops
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
-#      |                                          V
-#      V                                         cupsomatic
-#    gsrip                                       (constructs complicated
-#      |  (= "postscipt interpreter")            Ghostscript commandline
-#      |                                         to let the file be
-#      V                                         processed by a
-# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
-#      |                                         call...)
-#      V                                          |
-#    rastertosomething                            V
-#      |   (= "raster driver")      +-------------------------+
-#      |                            | Ghostscript at work.... |
-#      V                            |                         |
-# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
-#      |                                          |
-#      V                                          |
-#    backend <------------------------------------+
-#      |
-#      V
-#    THE PRINTER
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
-
    -#########################################################################
-#
-# And this is how it works for CUPS from 1.1.15:
-# ==============================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      V
-#     somethingtops
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      V
-#     pstops
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT-----+
-#                  +------------------v------------------------------+
-#                  | Ghostscript                                     |
-#                  | at work...                                      |
-#                  | (with                                           |
-#                  | "-sDEVICE=cups")                                |
-#                  |                                                 |
-#                  |         (= "postscipt interpreter")             |
-#                  |                                                 |
-#                  +------------------v------------------------------+
-#                                     |
-# APPLICATION/VND.CUPS-RASTER >-------+
-#      |
-#      V
-#     rastertosomething
-#      |   (= "raster driver")
-#      V
-# SOMETHING-DEVICE-SPECIFIC
-#      |
-#      V
-#     backend
-#
-#
-# NOTE: since version 1.1.15 CUPS "outsourced" the pstoraster process to
-#       Ghostscript. GNU Ghostscript needs to be patched to handle the
-#       CUPS requirement; ESP Ghostscript has this builtin. In any case,
-#       "gs -h" needs to show up a "cups" device. pstoraster is now a
-#       calling an appropriate "gs -sDEVICE=cups..." commandline to do
-#       the job. It will output "application/vnd.cup-raster", which will
-#       be finally processed by a CUPS raster driver "rastertosomething"
-#       Note the difference to "cupsomatic", which will not output
-#       CUPS-raster, but a final version of the printfile, ready to be
-#       sent to the printer. cupsomatic also doesn't use the "cups"
-#       devicemode in Ghostscript, but one of the classical devicemodes....
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
-
    -#########################################################################
-#
-# And this is how it works for CUPS from 1.1.15, with cupsomatic included:
-# ========================================================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      V
-#     somethingtops
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      V
-#     pstops
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT-----+
-#                  +------------------v------------------------------+
-#                  | Ghostscript        . Ghostscript at work....    |
-#                  | at work...         . (with "-sDEVICE=           |
-#                  | (with              .            s.th."          |
-#                  | "-sDEVICE=cups")   .                            |
-#                  |                    .                            |
-#                  | (CUPS standard)    .      (cupsomatic)          |
-#                  |                    .                            |
-#                  |          (= "postscript interpreter")           |
-#                  |                    .                            |
-#                  +------------------v--------------v---------------+
-#                                     |              |
-# APPLICATION/VND.CUPS-RASTER >-------+              |
-#      |                                             |
-#      V                                             |
-#     rastertosomething                              |
-#      |   (= "raster driver")                       |
-#      V                                             |
-# SOMETHING-DEVICE-SPECIFIC >------------------------+
-#      |
-#      V
-#     backend
-#
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-##########################################################################
-

    Trouble Shooting Guidelines to fix typical Samba printing -Problems

    -This is a short description of how to debug printing problems -with Samba. This describes how to debug problems with printing from -a SMB client to a Samba server, not the other way around. -

    Win9x client can't install driver

    For Win9x clients require the printer names to be 8 -chars (or "8 plus 3 chars suffix") max; otherwise the driver files +set up printer "winprinter" on CUPS, you need to have a "driver" for +it. Essentially this means to convert the print data on the CUPS/Samba +host to a format that the printer can digest (the Windows host is +unable to convert any files you may send). This also means you should +be able to print to the printer if it were hooked directly at your +Samba/CUPS host. For troubleshooting purposes, this is what you +should do, to determine if that part of the process chain is in +order. Then proceed to fix the network connection/authentication to +the Windows host, etc. +

    +To install a printer with the smb backend on CUPS, use this command: +

    +root# lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename \
+  -P /path/to/PPD
+

    +The PPD must be able to direct CUPS to generate +the print data for the target model. For PostScript printers just use +the PPD that would be used with the Windows NT PostScript driver. But +what can you do if the printer is only accessible with a password? Or +if the printer's host is part of another workgroup? This is provided +for: you can include the required parameters as part of the +smb:// device-URI. Like this: +

    • smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename

    • smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename

    • smb://username:password@WINDOWSNETBIOSNAME/printersharename

    +Note that the device-URI will be visible in the process list of the +Samba server (e.g. when someone uses the ps -aux +command on Linux), even if the username and passwords are sanitized +before they get written into the log files. So this is an inherently +insecure option. However it is the only one. Don't use it if you want +to protect your passwords. Better share the printer in a way that +doesn't require a password! Printing will only work if you have a +working netbios name resolution up and running. Note that this is a +feature of CUPS and you don't necessarily need to have smbd running +(but who wants that? :-). +

    More CUPS filtering Chains

    +The following diagrams reveal how CUPS handles print jobs. +

    Figure 19.17. Filtering chain 1

    Filtering chain 1

    Figure 19.18. Filtering chain with cupsomatic

    Filtering chain with cupsomatic

    Note

    +Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to +CUPS and ESP PrintPro plug-in where rastertosomething is noted. +

    Common Errors

    Win9x client can't install driver

    For Win9x clients require the printer names to be 8 +chars (or "8 plus 3 chars suffix") max; otherwise the driver files won't get transferred when you want to download them from -Samba.

    testparm

    Run testparm: It will tell you if -smb.conf parameters are in the wrong -section. Many people have had the "printer admin" parameter in the -[printers] section and experienced -problems. "testparm" will tell you if it sees -this.

    "cupsaddsmb" keeps asking for a root password in a -neverending loop

    Have you security = user? Have +Samba.

    "cupsaddsmb" keeps asking for root password in + neverending loop

    Have you security = user? Have you used smbpasswd to give root a Samba account? You can do 2 things: open another terminal and execute smbpasswd -a root to create the account, and continue with entering the password into the first terminal. Or break out of the loop by hitting ENTER twice (without trying to type a -password).

    "cupsaddsmb" gives "No PPD file for printer..." -message (but I swear there is one!)

    • Have you enabled printer sharing on CUPS? This means: +password).

    "cupsaddsmb" gives "No PPD file for printer..." + message while PPD file is present

    Have you enabled printer sharing on CUPS? This means: do you have a <Location /printers>....</Location> section in CUPS server's cupsd.conf which doesn't deny access to -the host you run "cupsaddsmb" from? It could be +the host you run "cupsaddsmb" from? It could be an issue if you use cupsaddsmb remotely, or if you use it with a --h parameter: cupsaddsmb -H -sambaserver -h cupsserver -v printername. -

  • Is your -"TempDir" directive in +-h parameter: cupsaddsmb -H + sambaserver -h cupsserver -v printername. +

    Is your +"TempDir" directive in cupsd.conf set to a valid value and is it writeable? -

    • I can't connect client to Samba printer.

    Use smbstatus to check which user +

    Client can't connect to Samba printer

    Use smbstatus to check which user you are from Samba's point of view. Do you have the privileges to write into the [print$] -share?

    I can't reconnect to Samba under a new account -from Win2K/XP

    Once you are connected as the "wrong" user (for -example as "nobody", which often occurs if you have map to -guest = bad user), Windows Explorer will not accept an +share?

    Can't reconnect to Samba under new account + from Win2K/XP

    Once you are connected as the "wrong" user (for +example as "nobody", which often occurs if you have +map to guest = bad user), Windows Explorer will not accept an attempt to connect again as a different user. There won't be any byte transfered on the wire to Samba, but still you'll see a stupid error message which makes you think that Samba has denied access. Use @@ -11751,73 +10987,71 @@ message which makes you think that Samba has denied access. Use PIDs. You still can't re-connect and get the dreaded You can't connect with a second account from the same machine message, as soon as you are trying? And you -don't see any single byte arriving at Samba (see logs; use "ethereal") +don't see any single byte arriving at Samba (see logs; use "ethereal") indicating a renewed connection attempt? Shut all Explorer Windows. This makes Windows forget what it has cached in its memory as established connections. Then re-connect as the right user. Best method is to use a DOS terminal window and first -do net use z: \\SAMBAHOST\print$ /user:root. Check +do net use z: \\GANDALF\print$ /user:root. Check with smbstatus that you are connected under a -different account. Now open the "Printers" folder (on the Samba server +different account. Now open the "Printers" folder (on the Samba server in the Network Neighbourhood), right-click the printer in question and select -Connect...

    Avoid being connected to the Samba server as the -"wrong" user

    You see per smbstatus that you are -connected as user "nobody"; while you wanted to be "root" or -"printeradmin"? This is probably due to map to guest = bad -user, which silently connects you under the guest account, +Connect...

    Avoid being connected to the Samba server as the + "wrong" user

    You see per smbstatus that you are +connected as user "nobody"; while you wanted to be "root" or +"printeradmin"? This is probably due to +map to guest = bad user, which silently connects you under the guest account, when you gave (maybe by accident) an incorrect username. Remove -map to guest, if you want to prevent -this.

    Upgrading to CUPS drivers from Adobe drivers on -NT/2K/XP clients gives problems

    First delete all "old" Adobe-using printers. Then -delete all "old" Adobe drivers. (On Win2K/XP, right-click in -background of "Printers" folder, select "Server Properties...", select -tab "Drivers" and delete here).

    I can't use "cupsaddsmb"on a Samba server which is -a PDC

    Do you use the "naked" root user name? Try to do it -this way: cupsaddsmb -U DOMAINNAME\\root -v -printername (note the two backslashes: the first one is -required to "escape" the second one).

    I deleted a printer on Win2K; but I still see -its driver

    Deleting a printer on the client won't delete the +map to guest, if you want to prevent +this.

    Upgrading to CUPS drivers from Adobe drivers on + NT/2K/XP clients gives problems

    First delete all "old" Adobe-using printers. Then +delete all "old" Adobe drivers. (On Win2K/XP, right-click in +background of "Printers" folder, select "Server Properties...", select +tab "Drivers" and delete here).

    Can't use "cupsaddsmb" on Samba server which is + a PDC

    Do you use the "naked" root user name? Try to do it +this way: cupsaddsmb -U DOMAINNAME\\root -v +printername> (note the two backslashes: the first one is +required to "escape" the second one).

    Deleted Win2K printer driver is still shown

    Deleting a printer on the client won't delete the driver too (to verify, right-click on the white background of the -"Printers" folder, select "Server Properties" and click on the -"Drivers" tab). These same old drivers will be re-used when you try to +"Printers" folder, select "Server Properties" and click on the +"Drivers" tab). These same old drivers will be re-used when you try to install a printer with the same name. If you want to update to a new driver, delete the old ones first. Deletion is only possible if no -other printer uses the same driver.

    Win2K/XP "Local Security -Policies"

    Local Security Policies may not -allow the installation of unsigned drivers. "Local Security Policies" +other printer uses the same driver.

    Win2K/XP "Local Security + Policies"

    Local Security Policies may not +allow the installation of unsigned drivers. "Local Security Policies" may not allow the installation of printer drivers at -all.

    WinXP clients: "Administrator can not install -printers for all local users"

    Windows XP handles SMB printers on a "per-user" basis. +all.

    WinXP clients: "Administrator can not install + printers for all local users"

    Windows XP handles SMB printers on a "per-user" basis. This means every user needs to install the printer himself. To have a printer available for everybody, you might want to use the built-in IPP client capabilities of WinXP. Add a printer with the print path of http://cupsserver:631/printers/printername. -Still looking into this one: maybe a "logon script" could +Still looking into this one: maybe a "logon script" could automatically install printers for all -users.

    "Print Change Notify" functions on -NT-clients

    For "print change notify" functions on NT++ clients, -these need to run the "Server" service first (re-named to +users.

    "Print Change Notify" functions on + NT-clients

    For "print change notify" functions on NT++ clients, +these need to run the "Server" service first (re-named to File & Print Sharing for MS Networks in -XP).

    WinXP-SP1

    WinXP-SP1 introduced a Point and Print +XP).

    WinXP-SP1

    WinXP-SP1 introduced a Point and Print Restriction Policy (this restriction doesn't apply to -"Administrator" or "Power User" groups of users). In Group Policy -Object Editor: go to User Configuration --> -Administrative Templates --> Control Panel --> +"Administrator" or "Power User" groups of users). In Group Policy +Object Editor: go to User Configuration, + Administrative Templates, Control Panel, Printers. The policy is automatically set to Enabled and the Users can only Point and Print to machines in their Forest . You probably need to change it to Disabled or Users can only Point and Print to these servers in order to make -driver downloads from Samba possible.

    I can't set and save default print options for all -users on Win2K/XP

    How are you doing it? I bet the wrong way (it is not +driver downloads from Samba possible.

    Print options for all users can't be set on Win2K/XP

    How are you doing it? I bet the wrong way (it is not very easy to find out, though). There are 3 different ways to bring you to a dialog that seems to set everything. All three dialogs look the same. Only one of them does what you intend. You need to be Administrator or Print Administrator to do this for all users. Here is how I do in on XP: -

    1. The first "wrong" way: +

      1. The first "wrong" way:

        1. Open the Printers folder.

        2. Right-click on the printer @@ -11825,7 +11059,7 @@ folder.

        3. Right-click on the printer select in context menu Printing Preferences...

        4. Look at this dialog closely and remember what it looks like.

        -

      2. The second "wrong" way: +

      3. The second "wrong" way:

        1. Open the Printers folder.

        2. Right-click on the printer (remoteprinter on @@ -11834,29 +11068,29 @@ cupshost) and select in the context menu tab

        3. Click on the button Printing Preferences...

        4. A new dialog opens. Keep this dialog open and go back to the parent dialog.

        -

      4. The third, the "correct" way: (should you do +

      5. The third, the "correct" way: (should you do this from the beginning, just carry out steps 1. and 2. from second -"way" above) +"way" above)

        1. Click on the Advanced -tab. (Hmmm... if everything is "Grayed Out", then you are not logged +tab. (Hmmm... if everything is "Grayed Out", then you are not logged in as a user with enough privileges).

        2. Click on the Printing Defaults... button.

        3. On any of the two new tabs, click on the Advanced... button.

        4. A new dialog opens. Compare this one to the other, -identical looking one from "B.5" or A.3".

        +identical looking one from "B.5" or A.3".

    Do you see any difference? I don't either... However, only the last -one, which you arrived at with steps "C.1.-6." will save any settings +one, which you arrived at with steps "C.1.-6." will save any settings permanently and be the defaults for new users. If you want all clients to get the same defaults, you need to conduct these steps as -Administrator (printer admin in +Administrator (printer admin in smb.conf) before a client downloads the driver (the clients can later set their own per-user defaults by following the procedures A. or B. -above).

    What are the most common blunders in driver -settings on Windows clients?

    Don't use Optimize for +above).

    Most common blunders in driver + settings on Windows clients

    Don't use Optimize for Speed: use Optimize for Portability instead (Adobe PS Driver) Don't use Page Independence: No: always @@ -11868,91 +11102,63 @@ printer (Adobe PS Driver). For TrueType Download Options choose Outline. Use PostScript Level 2, if you are having trouble with a non-PS printer, and if -there is a choice.

    I can't make cupsaddsmb work -with newly installed printer

    Symptom: the last command of +there is a choice.

    cupsaddsmb does not work + with newly installed printer

    Symptom: the last command of cupsaddsmb doesn't complete successfully: cmd = setdriver printername printername result was NT_STATUS_UNSUCCESSFUL then possibly the printer was not yet -"recognized" by Samba. Did it show up in Network +"recognized" by Samba. Did it show up in Network Neighbourhood? Did it show up in rpcclient hostname -c 'enumprinters'? Restart smbd (or send a kill -HUP to all processes listed by smbstatus and try -again.

    My permissions on +again.

    Permissions on /var/spool/samba/ get reset after each -reboot

    Have you by accident set the CUPS spool directory to +reboot

    Have you by accident set the CUPS spool directory to the same location? (RequestRoot /var/spool/samba/ in cupsd.conf or the other way round: /var/spool/cups/ is set as -path in the [printers] +path> in the [printers] section). These must be different. Set RequestRoot /var/spool/cups/ in -cupsd.conf and path = -/var/spool/samba in the [printers] +cupsd.conf and path = +/var/spool/samba in the [printers] section of smb.conf. Otherwise cupsd will sanitize permissions to its spool directory with each restart, and -printing will not work reliably.

    My printers work fine: just the printer named "lp" +printing will not work reliably.

    Printer named "lp" intermittently swallows jobs and spits out completely different -ones

    It is a very bad idea to name any printer "lp". This -is the traditional Unix name for the default printer. CUPS may be set -up to do an automatic creation of "Implicit Classes". This means, to +ones

    It is a very bad idea to name any printer "lp". This +is the traditional UNIX name for the default printer. CUPS may be set +up to do an automatic creation of "Implicit Classes". This means, to group all printers with the same name to a pool of devices, and loadbalancing the jobs across them in a round-robin fashion. Chances -are high that someone else has an "lp" named printer too. You may +are high that someone else has an "lp" named printer too. You may receive his jobs and send your own to his device unwittingly. To have tight control over the printer names, set BrowseShortNames -No. It will present any printer as "printername@cupshost" +No. It will present any printer as "printername@cupshost" then, giving you a better control over what may happen in a large -networked environment.

    How do I "watch" my Samba server?

    You can use tail -f -/var/log/samba/log.smbd (you may need a different path) to -see a live scrolling of all log messages. smbcontrol smbd -debuglevel tells you which verbosity goes into the -logs. smbcontrol smbd debug 3 sets the verbosity to -a quite high level (you can choose from 0 to 10 or 100). This works -"on the fly", without the need to restart the smbd daemon. Don't use -more than 3 initially; or you'll drown in an ocean of -messages.

    I can't use Samba from my WinXP Home box, while -access from WinXP Prof works flawlessly

    You have our condolences! WinXP home has been -completely neutered by Microsoft as compared to WinXP Prof: you can -not log into a WinNT domain. It cannot join a Win NT domain as a -member server. While it is possible to access domain resources, users -don't have "single sign-on". They need to supply username and password -each time they connect to a resource. Logon scripts and roaming -profiles are not supported. It can serve file and print shares; but -only in "share-mode security" level. It can not use "user-mode -security" (what Windows 95/98/ME still can -do).

    Where do I find the Adobe PostScript driver files -I need for "cupsaddsmb"?

    Use smbclient to connect to any +networked environment.

    Location of Adobe PostScript driver files necessary for "cupsaddsmb"

    Use smbclient to connect to any Windows box with a shared PostScript printer: smbclient //windowsbox/print\$ -U guest. You can navigate to the W32X86/2 subdir to mget ADOBE* and other files or to WIN40/0 to do the same. -- Another option is to download the *.exe packaged -files from the Adobe website.

    An Overview of the CUPS Printing Processes

    -

    Figure 19.15. CUPS Printing Overview

    CUPS Printing Overview

    -

    Chapter 20. Stackable VFS modules

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Tim Potter

    Simo Sorce

    original vfs_skel README

    Alexander Bokovoy

    original vfs_netatalk docs

    Stefan Metzmacher

    Update for multiple modules

    Table of Contents

    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    Common Errors

    Features and Benefits

    +files from the Adobe website.

    An Overview of the CUPS Printing Processes

    Figure 19.19. CUPS Printing Overview

    CUPS Printing Overview

    Chapter 20. Stackable VFS modules

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Tim Potter

    Simo Sorce

    original vfs_skel README

    Alexander Bokovoy

    original vfs_netatalk docs

    Stefan Metzmacher

    Update for multiple modules

    Table of Contents

    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan

    Features and Benefits

    Since Samba-3, there is support for stackable VFS(Virtual File System) modules. Samba passes each request to access the unix file system thru the loaded VFS modules. This chapter covers all the modules that come with the samba source and references to some external modules. -

    Discussion

    +

    Discussion

    If not supplied with your platform distribution binary Samba package you may have problems to compile these modules, as shared libraries are compiled and linked in different ways on different systems. They currently have been tested against GNU/Linux and IRIX.

    To use the VFS modules, create a share similar to the one below. The -important parameter is the vfs objects parameter where +important parameter is the vfs objects parameter where you can list one or more VFS modules by name. For example, to log all access to files and put deleted files in a recycle bin: -

    -[audit]
-        comment = Audited /data directory
-        path = /data
-        vfs objects = audit recycle
-        writeable = yes
-        browseable = yes
-

    +

    Example 20.1. smb.conf with VFS modules

    [audit]
    comment = Audited /data directory
    path = /data
    vfs objects = audit recycle
    writeable = yes
    browseable = yes

    The modules are used in the order in which they are specified.

    @@ -11964,46 +11170,52 @@ directory in the root directory of the samba installation (usually Some modules can be used twice for the same share. This can be done using a configuration similar to the one below. -

    -[test]
-        comment = VFS TEST
-        path = /data
-        writeable = yes
-        browseable = yes
-        vfs objects = example:example1 example example:test
-		example1: parameter = 1
-		example:  parameter = 5
-		test:	  parameter = 7
-

    -

    Included modules

    audit

    +

    Example 20.2. smb.conf with multiple VFS modules

    [test]
    comment = VFS TEST
    path = /data
    writeable = yes
    browseable = yes
    vfs objects = example:example1 example example:test
    example1: parameter = 1
    example: parameter = 5
    test: parameter = 7

    +

    Included modules

    audit

    A simple module to audit file access to the syslog facility. The following operations are logged: -

    share
    connect/disconnect
    directory opens/create/remove
    file open/close/rename/unlink/chmod

    -

    extd_audit

    +

    • share

    • connect/disconnect

    • directory opens/create/remove

    • file open/close/rename/unlink/chmod

    +

    extd_audit

    This module is identical with the audit module above except that it sends audit logs to both syslog as well as the smbd log file/s. The loglevel for this module is set in the smb.conf file.

    The logging information that will be written to the smbd log file is controlled by - the log level parameter in smb.conf. The + the log level parameter in smb.conf. The following information will be recorded: -

    Table 20.1. Extended Auditing Log Information

    Log LevelLog Details - File and Directory Operations
    0Creation / Deletion
    1Create / Delete / Rename / Permission Changes
    2Create / Delete / Rename / Perm Change / Open / Close

    fake_perms

    +

    Table 20.1. Extended Auditing Log Information

    Log LevelLog Details - File and Directory Operations
    0Creation / Deletion
    1Create / Delete / Rename / Permission Changes
    2Create / Delete / Rename / Perm Change / Open / Close

    fake_perms

    This module was created to allow Roaming Profile files and directories to be set (on the Samba server under Unix) as read only. This module will if installed on the Profiles share will report to the client that the Profile files and directories are writable. This satisfies the client even though the files will never be overwritten as the client logs out or shuts down. -

    recycle

    +

    recycle

    A recycle-bin like module. When used any unlink call will be intercepted and files moved to the recycle - directory instead of being deleted. + directory instead of being deleted. This gives the same + effect as the "Recycle Bin" on Windows computers.

    Supported options: -

    recycle:repository

    FIXME

    recycle:keeptree

    FIXME

    recycle:versions

    FIXME

    recycle:touch

    FIXME

    recycle:maxsize

    FIXME

    recycle:exclude

    FIXME

    recycle:exclude_dir

    FIXME

    recycle:noversions

    FIXME

    -

    netatalk

    +

    recycle:repository

    Relative path of the directory where deleted files should be moved to

    recycle:keeptree

    Specifies whether the directory structure should + be kept or if the files in the directory that is being + deleted should be kept seperately in the recycle bin. +

    recycle:versions

    If this option is set, two files + with the same name that are deleted will both + be kept in the recycle bin. Newer deleted versions + of a file will be called "Copy #x of filename".

    recycle:touch

    Specifies whether a file's access + date should be touched when the file is moved to + the recycle bin.

    recycle:maxsize

    Files that are larger than the number + of bytes specified by this parameter will + not be put into the recycle bin.

    recycle:exclude

    List of files that should not + be put into the recycle bin when deleted, but deleted + in the regular way.

    recycle:exclude_dir

    Contains a list of directories. When files from + these directories are deleted, they are not put into the + recycle bin, but deleted in the regular way. +

    recycle:noversions

    Opposite of recycle:versions. If both options are specified, this one takes precedence.

    +

    netatalk

    A netatalk module, that will ease co-existence of samba and netatalk file sharing services.

    Advantages compared to the old netatalk module: -

    it doesn't care about creating of .AppleDouble forks, just keeps them in sync
    if a share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically

    -

    VFS modules available elsewhere

    +

    • it doesn't care about creating of .AppleDouble forks, just keeps them in sync

    • if a share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically

    +

    VFS modules available elsewhere

    This section contains a listing of various other VFS modules that have been posted but don't currently reside in the Samba CVS tree for one reason or another (e.g. it is easy for the maintainer @@ -12011,14 +11223,14 @@ to have his or her own CVS tree).

    No statements about the stability or functionality of any module should be implied due to its presence here. -

    DatabaseFS

    +

    DatabaseFS

    URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php

    By Eric Lorimer.

    I have created a VFS module which implements a fairly complete read-only filesystem. It presents information from a database as a filesystem in a modular and generic way to allow different databases to be used (originally designed for organizing MP3s under directories such as - "Artists," "Song Keywords," etc... I have since applied it to a student + "Artists," "Song Keywords," etc... I have since applied it to a student roster database very easily). The directory structure is stored in the database itself and the module makes no assumptions about the database structure beyond the table it requires to run. @@ -12026,25 +11238,47 @@ should be implied due to its presence here. Any feedback would be appreciated: comments, suggestions, patches, etc... If nothing else, hopefully it might prove useful for someone else who wishes to create a virtual filesystem. -

    vscan

    URL: http://www.openantivirus.org/

    +

    vscan

    URL: http://www.openantivirus.org/

    samba-vscan is a proof-of-concept module for Samba, which uses the VFS (virtual file system) features of Samba 2.2.x/3.0 alphaX. Of course, Samba has to be compiled with VFS support. samba-vscan supports various virus scanners and is maintained by Rainer Link. -

    Common Errors

    -There must be some gotchas we should record here! Jelmer??? -

    Chapter 21. Integrated Logon Support using Winbind

    Tim Potter

    Samba Team

    Andrew Tridgell

    Samba Team

    Naag Mummaneni

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    27 June 2002

    Table of Contents

    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors

    Features and Benefits

    Integration of UNIX and Microsoft Windows NT through - a unified logon has been considered a "holy grail" in heterogeneous - computing environments for a long time. We present - winbind, a component of the Samba suite - of programs as a solution to the unified logon problem. Winbind - uses a UNIX implementation - of Microsoft RPC calls, Pluggable Authentication Modules, and the Name - Service Switch to allow Windows NT domain users to appear and operate - as UNIX users on a UNIX machine. This paper describes the winbind - system, explaining the functionality it provides, how it is configured, - and how it works internally.

    Introduction

    It is well known that UNIX and Microsoft Windows NT have +

    Chapter 21. Winbind: Use of Domain Accounts

    Tim Potter

    Samba Team

    Andrew Tridgell

    Samba Team

    Naag Mummaneni

    Notes for Solaris

    John Trostel

    SNAP

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    27 June 2002

    Table of Contents

    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning

    Features and Benefits

    + Integration of UNIX and Microsoft Windows NT through a unified logon has + been considered a "holy grail" in heterogeneous computing environments for + a long time. +

    + There is one other facility without which UNIX and Microsoft Windows network + interoperability would suffer greatly. It is imperative that there be a + mechanism for sharing files across UNIX systems and to be able to assign + domain user and group ownerships with integrity. +

    + winbind is a component of the Samba suite of programs + solves the unified logon problem. Winbind uses a UNIX implementation of Microsoft + RPC calls, Pluggable Authentication Modules, and the Name Service Switch to + allow Windows NT domain users to appear and operate as UNIX users on a UNIX + machine. This chapter describes the winbind system, explaining the functionality + it provides, how it is configured, and how it works internally. +

    + Winbind provides three separate functions: +

    • + Authentication of user credentials (via PAM) +

    • + Identity resolution (via NSS)` +

    • + Windindd maintains a database called winbind_idmap.tdb in which it stores + mappings between UNIX UIDs / GIDs and NT SIDs. This mapping is used only + for users and groups that do not have a local UID/GID. It stored the UID/GID + allocated from the idmap uid/gid range that it has mapped to the NT SID. + If idmap backend has been specified as ldapsam:url + then instead of using a local mapping winbindd will obtain this information + from the LDAP database. +

    Note

    + If winbindd is not running, then smbd (which calls winbindd) will fall back to + using purely local information from /etc/passwd and /etc/group and no dynamic + mapping will be used. +

    Introduction

    It is well known that UNIX and Microsoft Windows NT have different models for representing user and group information and use different technologies for implementing them. This fact has made it difficult to integrate the two systems in a satisfactory @@ -12065,7 +11299,7 @@ There must be some gotchas we should record here! Jelmer??? tasks for the system administrator when maintaining users and groups on either system. The winbind system provides a simple and elegant solution to all three components of the unified logon - problem.

    What Winbind Provides

    Winbind unifies UNIX and Windows NT account management by + problem.

    What Winbind Provides

    Winbind unifies UNIX and Windows NT account management by allowing a UNIX box to become a full member of a NT domain. Once this is done the UNIX box will see NT users and groups as if they were native UNIX users and groups, allowing the NT domain @@ -12078,7 +11312,7 @@ There must be some gotchas we should record here! Jelmer??? (via the NSS name resolution modules in the C library) this redirection to the NT domain controller is completely transparent.

    Users on the UNIX machine can then use NT user and group - names as they would use "native" UNIX names. They can chown files + names as they would use "native" UNIX names. They can chown files so that they are owned by NT domain users or even login to the UNIX machine and run a UNIX X-Window session as a domain user.

    The only obvious indication that Winbind is being used is that user and group names take the form DOMAIN\user and @@ -12089,7 +11323,7 @@ There must be some gotchas we should record here! Jelmer??? to provide authentication via a NT domain to any PAM enabled applications. This capability solves the problem of synchronizing passwords between systems since all passwords are stored in a single - location (on the domain controller).

    Target Uses

    Winbind is targeted at organizations that have an + location (on the domain controller).

    Target Uses

    Winbind is targeted at organizations that have an existing NT based domain infrastructure into which they wish to put UNIX workstations or servers. Winbind will allow these organizations to deploy UNIX workstations without having to @@ -12099,12 +11333,12 @@ There must be some gotchas we should record here! Jelmer??? be used is as a central part of UNIX based appliances. Appliances that provide file and print services to Microsoft based networks will be able to use Winbind to provide seamless integration of - the appliance into the domain.

    How Winbind Works

    The winbind system is designed around a client/server + the appliance into the domain.

    How Winbind Works

    The winbind system is designed around a client/server architecture. A long running winbindd daemon listens on a UNIX domain socket waiting for requests to arrive. These requests are generated by the NSS and PAM clients and processed sequentially.

    The technologies used to implement winbind are described - in detail below.

    Microsoft Remote Procedure Calls

    Over the last few years, efforts have been underway + in detail below.

    Microsoft Remote Procedure Calls

    Over the last few years, efforts have been underway by various Samba Team members to decode various aspects of the Microsoft Remote Procedure Call (MSRPC) system. This system is used for most network related operations between @@ -12117,7 +11351,7 @@ There must be some gotchas we should record here! Jelmer??? users or groups. Other MSRPC calls can be used to authenticate NT domain users and to change user passwords. By directly querying a Windows PDC for user and group information, winbind maps the - NT account information onto UNIX user and group names.

    Microsoft Active Directory Services

    + NT account information onto UNIX user and group names.

    Microsoft Active Directory Services

    Since late 2001, Samba has gained the ability to interact with Microsoft Windows 2000 using its 'Native Mode' protocols, rather than the NT4 RPC services. @@ -12126,7 +11360,7 @@ There must be some gotchas we should record here! Jelmer??? same way as a Win2k client would, and in so doing provide a much more efficient and effective winbind implementation. -

    Name Service Switch

    The Name Service Switch, or NSS, is a feature that is +

    Name Service Switch

    The Name Service Switch, or NSS, is a feature that is present in many UNIX operating systems. It allows system information such as hostnames, mail aliases and user information to be resolved from different sources. For example, a standalone @@ -12147,8 +11381,8 @@ There must be some gotchas we should record here! Jelmer??? When a UNIX application makes a request to do a lookup the C library looks in /etc/nsswitch.conf for a line which matches the service type being requested, for - example the "passwd" service type is used when user or group names - are looked up. This config line species which implementations + example the "passwd" service type is used when user or group names + are looked up. This config line specifies which implementations of that service should be tried and in what order. If the passwd config line is:

     passwd: files example
@@ -12161,9 +11395,9 @@ passwd: files example
 		result to the application.
    This NSS interface provides a very easy way for Winbind 
 		to hook into the operating system. All that needs to be done 
 		is to put libnss_winbind.so in /lib/ 
-		then add "winbind" into /etc/nsswitch.conf at 
+		then add "winbind" into /etc/nsswitch.conf at 
 		the appropriate place. The C library will then call Winbind to 
-		resolve user and group names.

    Pluggable Authentication Modules

    Pluggable Authentication Modules, also known as PAM, + resolve user and group names.

    Pluggable Authentication Modules

    Pluggable Authentication Modules, also known as PAM, is a system for abstracting authentication and authorization technologies. With a PAM module it is possible to specify different authentication methods for different system applications without @@ -12188,7 +11422,7 @@ passwd: files example is copied to /lib/security/ and the PAM control files for relevant services are updated to allow authentication via winbind. See the PAM documentation - for more details.

    User and Group ID Allocation

    When a user or group is created under Windows NT + for more details.

    User and Group ID Allocation

    When a user or group is created under Windows NT is it allocated a numerical relative identifier (RID). This is slightly different to UNIX which has a range of numbers that are used to identify users, and the same range in which to identify @@ -12201,7 +11435,7 @@ passwd: files example time, winbind will have mapped all Windows NT users and groups to UNIX user ids and group ids.

    The results of this mapping are stored persistently in an ID mapping database held in a tdb database). This ensures that - RIDs are mapped to UNIX IDs in a consistent way.

    Result Caching

    An active system can generate a lot of user and group + RIDs are mapped to UNIX IDs in a consistent way.

    Result Caching

    An active system can generate a lot of user and group name lookups. To reduce the network cost of these lookups winbind uses a caching scheme based on the SAM sequence number supplied by NT domain controllers. User or group information returned @@ -12212,23 +11446,12 @@ passwd: files example the PDC and compared against the sequence number of the cached entry. If the sequence numbers do not match, then the cached information is discarded and up to date information is requested directly - from the PDC.

    Installation and Configuration

    -Many thanks to John Trostel jtrostel@snapserver.com -for providing the HOWTO for this section. -

    -This HOWTO describes how to get winbind services up and running -to control access and authenticate users on your Linux box using -the winbind services which come with SAMBA 3.0. -

    Introduction

    + from the PDC.

    Installation and Configuration

    Introduction

    This section describes the procedures used to get winbind up and -running on a RedHat 7.1 system. Winbind is capable of providing access +running. Winbind is capable of providing access and authentication control for Windows Domain users through an NT or Win2K PDC for 'regular' services, such as telnet a nd ftp, as well for SAMBA services. -

    -This HOWTO has been written from a 'RedHat-centric' perspective, so if -you are using another distribution, you may have to modify the instructions -somewhat to fit the way your distribution works.

    • Why should I to this?

      This allows the SAMBA administrator to rely on the @@ -12244,7 +11467,7 @@ somewhat to fit the way your distribution works. SAMBA server, this HOWTO is for you. That said, I am no NT or PAM expert, so you may find a better or easier way to accomplish these tasks. -

    Requirements

    +

    Requirements

    If you have a Samba configuration file that you are currently using... BACK IT UP! If your system already uses PAM, back up the /etc/pam.d directory @@ -12271,33 +11494,18 @@ winbind modules, you should have at least the pam libraries resident on your system. For recent RedHat systems (7.1, for instance), that means pam-0.74-22. For best results, it is helpful to also install the development packages in pam-devel-0.74-22. -

    Testing Things Out

    +

    Testing Things Out

    Before starting, it is probably best to kill off all the SAMBA related daemons running on your server. Kill off all smbd, nmbd, and winbindd processes that may be running. To use PAM, you will want to make sure that you have the -standard PAM package (for RedHat) which supplies the /etc/pam.d +standard PAM package which supplies the /etc/pam.d directory structure, including the pam modules are used by pam-aware services, several pam libraries, and the /usr/doc and /usr/man entries for pam. Winbind built better in SAMBA if the pam-devel package was also installed. This package includes the header files needed to compile pam-aware applications. -

    Configure and compile SAMBA

    -The configuration and compilation of SAMBA is pretty straightforward. -The first three steps may not be necessary depending upon -whether or not you have previously built the Samba binaries. -

    -root# autoconf
-root# make clean
-root# rm config.cache
-root# ./configure
-root# make
-root# make install
-

    -This will, by default, install SAMBA in /usr/local/samba. -See the main SAMBA documentation if you want to install SAMBA somewhere else. -It will also build the winbindd executable and libraries. -

    Configure nsswitch.conf and the +

    Configure nsswitch.conf and the winbind libraries on Linux and Solaris

    The libraries needed to run the winbindd daemon through nsswitch need to be copied to their proper locations, so @@ -12332,7 +11540,7 @@ is faster (and you don't need to reboot) if you do it manually:

    This makes libnss_winbind available to winbindd and echos back a check to you. -

    NSS Winbind on AIX

    (This section is only for those running AIX)

    +

    NSS Winbind on AIX

    (This section is only for those running AIX)

    The winbind AIX identification module gets built as libnss_winbind.so in the nsswitch directory of the samba source. This file can be copied to /usr/lib/security, and the AIX naming convention would indicate that it @@ -12347,45 +11555,30 @@ supports identification, but there have been success reports using the standard winbind pam module for authentication. Use caution configuring loadable authentication modules as it is possible to make it impossible to logon to the system. More information about the AIX authentication -module API can be found at "Kernel Extensions and Device Support -Programming Concepts for AIX": +module API can be found at "Kernel Extensions and Device Support +Programming Concepts for AIX": Chapter 18. Loadable Authentication Module Programming Interface and more information on administering the modules at -"System Management Guide: Operating System and Devices". -

    Configure smb.conf

    +"System Management Guide: Operating System and Devices". +

    Configure smb.conf

    Several parameters are needed in the smb.conf file to control the behavior of winbindd. Configure smb.conf These are described in more detail in the winbindd(8) man page. My smb.conf file was modified to include the following entries in the [global] section: -

    -[global]
-     <...>
-     # separate domain and username with '+', like DOMAIN+username
-     winbind separator = +
-     # use uids from 10000 to 20000 for domain users
-     idmap uid = 10000-20000
-     # use gids from 10000 to 20000 for domain groups
-     idmap gid = 10000-20000
-     # allow enumeration of winbind users and groups
-     winbind enum users = yes
-     winbind enum groups = yes
-     # give winbind users a real shell (only needed if they have telnet access)
-     template homedir = /home/winnt/%D/%U
-     template shell = /bin/bash
-

    Join the SAMBA server to the PDC domain

    +

    Example 21.1. smb.conf for winbind set-up

    [global]
    ...
    # separate domain and username with '+', like DOMAIN+username
    winbind separator = +
    # use uids from 10000 to 20000 for domain users
    idmap uid = 10000-20000
    # use gids from 10000 to 20000 for domain groups
    winbind gid = 10000-20000
    # allow enumeration of winbind users and groups
    winbind enum users = yes
    winbind enum groups = yes
    # give winbind users a real shell (only needed if they have telnet access)
    template homedir = /home/winnt/%D/%U
    template shell = /bin/bash

    Join the SAMBA server to the PDC domain

    Enter the following command to make the SAMBA server join the PDC domain, where DOMAIN is the name of your Windows domain and Administrator is a domain user who has administrative privileges in the domain.

    -root# /usr/local/samba/bin/net join -S PDC -U Administrator +root# /usr/local/samba/bin/net rpc join -S PDC -U Administrator

    -The proper response to the command should be: "Joined the domain -DOMAIN" where DOMAIN +The proper response to the command should be: "Joined the domain +DOMAIN" where DOMAIN is your DOMAIN name. -

    Start up the winbindd daemon and test it!

    +

    Start up the winbindd daemon and test it!

    Eventually, you will want to modify your smb startup script to automatically invoke the winbindd daemon when the other parts of SAMBA start, but it is possible to test out just the winbind @@ -12427,8 +11620,7 @@ your PDC. For example, I get the following response: CEO+krbtgt CEO+TsInternetUser

    -Obviously, I have named my domain 'CEO' and my winbind -separator is '+'. + Obviously, I have named my domain 'CEO' and my winbind separator is '+'.

    You can do the same sort of thing to get group information from the PDC: @@ -12457,7 +11649,7 @@ directories and default shells. The same thing can be done for groups with the command

    root# getent group -

    Fix the init.d startup scripts

    Linux

    +

    Fix the init.d startup scripts

    Linux

    The winbindd daemon needs to start up after the smbd and nmbd daemons are running. To accomplish this task, you need to modify the startup scripts of your system. @@ -12469,18 +11661,18 @@ startup script starts up smbd, 

     stop() {
-        KIND="SMB"
-        echo -n $"Shutting down $KIND services: "
+        KIND="SMB"
+        echo -n $"Shutting down $KIND services: "
         killproc smbd
         RETVAL=$?
         echo
-        KIND="NMB"
-        echo -n $"Shutting down $KIND services: "
+        KIND="NMB"
+        echo -n $"Shutting down $KIND services: "
         killproc nmbd
         RETVAL2=$?
         echo
-        KIND="Winbind"
-        echo -n $"Shutting down $KIND services: "
+        KIND="Winbind"
+        echo -n $"Shutting down $KIND services: "
         killproc winbindd
         RETVAL3=$?
         [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && \
 		 rm -f /var/lock/subsys/smb
-        echo ""
+        echo ""
         return $RETVAL
 }
-
    Solaris

    Winbind doesn't work on Solaris 9, see the Portability chapter for details.

    On Solaris, you need to modify the +

    Solaris

    Winbind doesn't work on Solaris 9, see the Portability chapter for details.

    On Solaris, you need to modify the /etc/init.d/samba.server startup script. It usually only starts smbd and nmbd but should now start winbindd too. If you have samba installed in /usr/local/samba/bin, @@ -12542,12 +11734,12 @@ the file could contains something like this: pid=`/usr/bin/ps -e | /usr/bin/grep -w $1 | /usr/bin/sed -e 's/^ *//' -e 's/ .*//'` - [ "$pid" != "" ] && kill $pid + [ "$pid" != "" ] && kill $pid } # Start/stop processes required for samba server - case "$1" in + case "$1" in 'start') # @@ -12572,7 +11764,7 @@ the file could contains something like this: ;; *) - echo "Usage: /etc/init.d/samba.server { start | stop }" + echo "Usage: /etc/init.d/samba.server { start | stop }" ;; esac

    @@ -12586,11 +11778,11 @@ in the script above with: 

     	/usr/local/samba/bin/winbindd -B

    -

    Restarting

    +

    Restarting

    If you restart the smbd, nmbd, and winbindd daemons at this point, you should be able to connect to the samba server as a domain member just as if you were a local user. -

    Configure Winbind and PAM

    +

    Configure Winbind and PAM

    If you have made it this far, you know that winbindd and samba are working together. If you want to use winbind to provide authentication for other services, keep reading. The pam configuration files need to be altered in @@ -12610,7 +11802,7 @@ your other pam security modules. On my RedHat system, this was the modules reside in /usr/lib/security.

    root# cp ../samba/source/nsswitch/pam_winbind.so /lib/security -

    Linux/FreeBSD-specific PAM configuration

    +

    Linux/FreeBSD-specific PAM configuration

    The /etc/pam.d/samba file does not need to be changed. I just left this file as it was: 

    @@ -12637,7 +11829,7 @@ have individual directories for the domain users already present on
 the server, or change the home directory template to a general
 directory for all domain users.  These can be easily set using 
 the smb.conf global entry 
-template homedir.
+template homedir.
 
    
 The /etc/pam.d/ftp file can be changed 
 to allow winbind ftp access in a manner similar to the
@@ -12670,10 +11862,10 @@ same way.  It now looks like this:
 In this case, I added the 
    auth sufficient /lib/security/pam_winbind.so
     
 lines as before, but also added the 
    required pam_securetty.so
    
 above it, to disallow root logins over the network.  I also added a 
-sufficient /lib/security/pam_unix.so use_first_pass
+
    sufficient /lib/security/pam_unix.so use_first_pass
    
 line after the winbind.so line to get rid of annoying 
 double prompts for passwords.
-
    Solaris-specific configuration

    +

    Solaris-specific configuration

    The /etc/pam.conf needs to be changed. I changed this file so that my Domain users can logon both locally as well as telnet.The following are the changes that I made.You can customize the pam.conf file as per your requirements,but @@ -12681,7 +11873,7 @@ be sure of those changes because in the worst case it will leave your system nearly impossible to boot. 

     	#
-	#ident	"@(#)pam.conf	1.14	99/09/16 SMI"
+	#ident	"@(#)pam.conf	1.14	99/09/16 SMI"
 	#
 	# Copyright (c) 1996-1999, Sun Microsystems, Inc.
 	# All Rights Reserved.
@@ -12745,15 +11937,15 @@ annoying double prompts for passwords.
 
    
 Now restart your Samba and try connecting through your application that you
 configured in the pam.conf.
-

    Conclusion

    The winbind system, through the use of the Name Service +

    Conclusion

    The winbind system, through the use of the Name Service Switch, Pluggable Authentication Modules, and appropriate Microsoft RPC calls have allowed us to provide seamless integration of Microsoft Windows NT domain users on a UNIX system. The result is a great reduction in the administrative - cost of running a mixed UNIX and NT network.

    Common Errors

    Winbind has a number of limitations in its current + cost of running a mixed UNIX and NT network.

    Common Errors

    Winbind has a number of limitations in its current released version that we hope to overcome in future releases:

    • Winbind is currently only available for - the Linux, Solaris and IRIX operating systems, although ports to other operating + the Linux, Solaris, AIX and IRIX operating systems, although ports to other operating systems are certainly possible. For such ports to be feasible, we require the C library of the target operating system to support the Name Service Switch and Pluggable Authentication @@ -12765,11 +11957,18 @@ configured in the pam.conf. containing this information is corrupted or destroyed.

    • Currently the winbind PAM module does not take into account possible workstation and logon time restrictions that may be been set for Windows NT users, this is - instead up to the PDC to enforce.

    Chapter 22. Advanced Network Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors

    + instead up to the PDC to enforce.

    NSCD Problem Warning

    Note

    + Do NOT under ANY circumstances run nscd on any system + on which winbind is running. +

    + If nscd is running on the UNIX/Linux system, then + even though NSSWITCH is correctly configured it will NOT be possible to resolve + domain users and groups for file and directory controls. +

    Chapter 22. Advanced Network Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors

    This section documents peripheral issues that are of great importance to network administrators who want to improve network resource access control, to automate the user environment, and to make their lives a little easier. -

    Features and Benefits

    +

    Features and Benefits

    Often the difference between a working network environment and a well appreciated one can best be measured by the little things that makes everything work more harmoniously. A key part of every network environment solution is the ability to remotely @@ -12779,7 +11978,7 @@ network operations.

    This chapter presents information on each of these area. They are placed here, and not in other chapters, for ease of reference. -

    Remote Server Administration

    +

    Remote Server Administration

    How do I get 'User Manager' and 'Server Manager'?

    Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains', @@ -12793,12 +11992,12 @@ Click here to download the archived file Windows NT 4.0 version of the 'User Manager for Domains' and 'Server Manager' are available from Microsoft via ftp from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE -

    Remote Desktop Management

    +

    Remote Desktop Management

    There are a number of possible remote desktop management solutions that range from free through costly. Do not let that put you off. Sometimes the most costly solutions is the most cost effective. In any case, you will need to draw your own conclusions as to which is the best tool in your network environment. -

    Remote Management from NoMachines.Com

    +

    Remote Management from NoMachines.Com

    The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003. It is presented in slightly edited form (with author details omitted for privacy reasons). The entire answer is reproduced below with some comments removed. @@ -12817,7 +12016,7 @@ is the best tool in your network environment. > Any ideas/experience would be appreciated :)

    - Answer provided: Check out the new offer from NoMachine, "NX" software: + Answer provided: Check out the new offer from NoMachine, "NX" software: http://www.nomachine.com/.

    It implements a very easy-to-use interface to the remote X protocol as @@ -12830,18 +12029,18 @@ is the best tool in your network environment.

    I could test drive their (public) RedHat machine in Italy, over a loaded internet connection, with enabled thumbnail previews in KDE konqueror - which popped up immediately on "mouse-over". From inside that (remote X) + which popped up immediately on "mouse-over". From inside that (remote X) session I started a rdesktop session on another, a Windows XP machine. To test the performance, I played Pinball. I am proud to announce here that my score was 631750 points at first try...

    - NX performs better on my local LAN than any of the other "pure" + NX performs better on my local LAN than any of the other "pure" connection methods I am using from time to time: TightVNC, rdesktop or remote X. It is even faster than a direct crosslink connection between two nodes.

    I even got sound playing from the remote X app to my local boxes, and - had a working "copy'n'paste" from an NX window (running a KDE session + had a working "copy'n'paste" from an NX window (running a KDE session in Italy) to my Mozilla mailing agent... These guys are certainly doing something right!

    @@ -12886,7 +12085,7 @@ is the best tool in your network environment. NoMachine are encouraging and offering help to OSS/Free Software implementations for such a frontend too, even if it means competition to them (they have written to this effect even to the LTSP, KDE and GNOME developer mailing lists) -

    Network Logon Script Magic

    +

    Network Logon Script Magic

    This section needs work. Volunteer contributions most welcome. Please send your patches or updates to John Terpstra.

    @@ -12928,31 +12127,31 @@ This is the genlogon.pl file: # Log client connection #($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time); ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time); - open LOG, ">>/var/log/samba/netlogon.log"; - print LOG "$mon/$mday/$year $hour:$min:$sec - User $ARGV[0] logged into $ARGV[1]\n"; + open LOG, ">>/var/log/samba/netlogon.log"; + print LOG "$mon/$mday/$year $hour:$min:$sec - User $ARGV[0] logged into $ARGV[1]\n"; close LOG; # Start generating logon script - open LOGON, ">/shared/netlogon/$ARGV[0].bat"; - print LOGON "\@ECHO OFF\r\n"; + open LOGON, ">/shared/netlogon/$ARGV[0].bat"; + print LOGON "\@ECHO OFF\r\n"; # Connect shares just use by Software Development group - if ($ARGV[1] eq "SOFTDEV" || $ARGV[0] eq "softdev") + if ($ARGV[1] eq "SOFTDEV" || $ARGV[0] eq "softdev") { - print LOGON "NET USE M: \\\\$ARGV[2]\\SOURCE\r\n"; + print LOGON "NET USE M: \\\\$ARGV[2]\\SOURCE\r\n"; } # Connect shares just use by Technical Support staff - if ($ARGV[1] eq "SUPPORT" || $ARGV[0] eq "support") + if ($ARGV[1] eq "SUPPORT" || $ARGV[0] eq "support") { - print LOGON "NET USE S: \\\\$ARGV[2]\\SUPPORT\r\n"; + print LOGON "NET USE S: \\\\$ARGV[2]\\SUPPORT\r\n"; } # Connect shares just used by Administration staff - If ($ARGV[1] eq "ADMIN" || $ARGV[0] eq "admin") + If ($ARGV[1] eq "ADMIN" || $ARGV[0] eq "admin") { - print LOGON "NET USE L: \\\\$ARGV[2]\\ADMIN\r\n"; - print LOGON "NET USE K: \\\\$ARGV[2]\\MKTING\r\n"; + print LOGON "NET USE L: \\\\$ARGV[2]\\ADMIN\r\n"; + print LOGON "NET USE K: \\\\$ARGV[2]\\MKTING\r\n"; } # Now connect Printers. We handle just two or three users a little @@ -12962,13 +12161,13 @@ This is the genlogon.pl file: if ($ARGV[0] eq 'jim' || $ARGV[0] eq 'yvonne') { - print LOGON "NET USE LPT2: \\\\$ARGV[2]\\LJET3\r\n"; - print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n"; + print LOGON "NET USE LPT2: \\\\$ARGV[2]\\LJET3\r\n"; + print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n"; } else { - print LOGON "NET USE LPT1: \\\\$ARGV[2]\\LJET3\r\n"; - print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n"; + print LOGON "NET USE LPT1: \\\\$ARGV[2]\\LJET3\r\n"; + print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n"; } # All done! Close the output file. @@ -12976,7 +12175,7 @@ This is the genlogon.pl file:

    Those wishing to use more elaborate or capable logon processing system should check out the following sites: -

    http://www.craigelachie.org/rhacer/ntlogon
    http://www.kixtart.org
    http://support.microsoft.com/default.asp?scid=kb;en-us;189105

    Adding printers without user intervention

    +

    http://www.craigelachie.org/rhacer/ntlogon
    http://www.kixtart.org
    http://support.microsoft.com/default.asp?scid=kb;en-us;189105

    Adding printers without user intervention

    Printers may be added automatically during logon script processing through the use of: 

    @@ -12984,20 +12183,20 @@ Printers may be added automatically during logon script processing through the u

    See the documentation in the Microsoft knowledgebase article no: 189105. -

    Common Errors

    +

    Common Errors

    The information provided in this chapter has been reproduced from postings on the samba@samba.org mailing list. No implied endorsement or recommendation is offered. Administrators should conduct their own evaluation of alternatives and are encouraged to draw their own conclusions. -

    Chapter 23. System and Account Policies

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work

    +

    Chapter 23. System and Account Policies

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work

    This chapter summarises the current state of knowledge derived from personal practice and knowledge from samba mailing list subscribers. Before reproduction of posted information effort has been made to validate the information provided. Where additional information was uncovered through this validation it is provided also. -

    Features and Benefits

    +

    Features and Benefits

    When MS Windows NT3.5 was introduced the hot new topic was the ability to implement Group Policies for users and group. Then along came MS Windows NT4 and a few sites -started to adopt this capability. How do we know that? By way of the number of "booboos" +started to adopt this capability. How do we know that? By way of the number of "booboos" (or mistakes) administrators made and then requested help to resolve.

    By the time that MS Windows 2000 and Active Directory was released, administrators @@ -13013,9 +12212,9 @@ the deployment in many sites. This chapter reviews techniques and methods that c be used to exploit opportunities for automation of control over user desktops and network client workstations.

    -A tool new to Samba-3 may become an important part of the future Samba Administrators' +A tool new to Samba may become an important part of the future Samba Administrators' arsenal. The editreg tool is described in this document. -

    Creating and Managing System Policies

    +

    Creating and Managing System Policies

    Under MS Windows platforms, particularly those following the release of MS Windows NT4 and MS Windows 95) it is possible to create a type of file that would be placed in the NETLOGON share of a domain controller. As the client logs onto the network @@ -13044,13 +12243,13 @@ be a step forward, but improved functionality comes at a great price. Before embarking on the configuration of network and system policies it is highly advisable to read the documentation available from Microsoft's web site regarding -Implementing Profiles and Policies in Windows NT 4.0 from http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp available from Microsoft. +Implementing Profiles and Policies in Windows NT 4.0 available from Microsoft. There are a large number of documents in addition to this old one that should also -be read and understood. Try searching on the Microsoft web site for "Group Policies". +be read and understood. Try searching on the Microsoft web site for "Group Policies".

    What follows is a very brief discussion with some helpful notes. The information provided here is incomplete - you are warned. -

    Windows 9x/Me Policies

    +

    Windows 9x/Me Policies

    You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. It can be found on the Original full product Win98 installation CD under tools/reskit/netadmin/poledit. Install this using the @@ -13076,7 +12275,7 @@ here is incomplete - you are warned. grouppol.inf. Log off and on again a couple of times and see if Win98 picks up group policies. Unfortunately this needs to be done on every Win9x/Me machine that uses group policies. -

    Windows NT4 Style Policy Files

    +

    Windows NT4 Style Policy Files

    To create or edit ntconfig.pol you must use the NT Server Policy Editor, poledit.exe which is included with NT4 Server but not NT Workstation. There is a Policy Editor on a NT4 @@ -13097,14 +12296,14 @@ here is incomplete - you are warned. be extracted as well. It is also possible to downloaded the policy template files for Office97 and get a copy of the policy editor. Another possible location is with the Zero Administration Kit available for download from Microsoft. -

    Registry Spoiling

    +

    Registry Spoiling

    With NT4 style registry based policy changes, a large number of settings are not automatically reversed as the user logs off. Since the settings that were in the NTConfig.POL file were applied to the client machine registry and that apply to the hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known as tattooing. It can have serious consequences down-stream and the administrator must be extremely careful not to lock out the ability to manage the machine at a later date. -

    MS Windows 200x / XP Professional Policies

    +

    MS Windows 200x / XP Professional Policies

    Windows NT4 System policies allows setting of registry parameters specific to users, groups and computers (client workstations) that are members of the NT4 style domain. Such policy file will work with MS Windows 2000 / XP clients also. @@ -13141,7 +12340,7 @@ here is incomplete - you are warned. to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows the administrator to also set filters over the policy settings. No such equivalent capability exists with NT4 style policy files. -

    Administration of Win2K / XP Policies

    +

    Administration of Win2K / XP Policies

    Instead of using the tool called The System Policy Editor, commonly called Poledit (from the executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console (MMC) snap-in as follows:

    1. @@ -13167,10 +12366,10 @@ here is incomplete - you are warned. The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you use this powerful tool. Please refer to the resource kit manuals for specific usage information. -

    Managing Account/User Policies

    +

    Managing Account/User Policies

    Policies can define a specific user's settings or the settings for a group of users. The resulting policy file contains the registry settings for all users, groups, and computers that will be using -the policy file. Separate policy files for each user, group, or computer are not not necessary. +the policy file. Separate policy files for each user, group, or computer are not necessary.

    If you create a policy that will be automatically downloaded from validating domain controllers, you should name the file NTconfig.POL. As system administrator, you have the option of renaming the @@ -13193,20 +12392,27 @@ in a manner that works in conjunction with user profiles, the user management en MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied. Common restrictions that are frequently used includes:

    -

    Logon Hours
    Password Aging
    Permitted Logon from certain machines only
    Account type (Local or Global)
    User Rights

    -

    Samba Editreg Toolset

    - Describe in detail the benefits of editreg and how to use it. -

    Windows NT4/200x

    +

    • Logon Hours

    • Password Aging

    • Permitted Logon from certain machines only

    • Account type (Local or Global)

    • User Rights

    +

    Samba Editreg Toolset

    + A new tool called editreg is under development. This tool can be used + to edit registry files (called NTUser.DAT) that are stored in user and group profiles. + NTConfig.POL files have the same structure as the NTUser.DAT file and can be editted using + this tool. editreg is being built with the intent to enable NTConfig.POL + files to be saved in text format and to permit the building of new NTConfig.POL files with + extended capabilities. It is proving difficult to realise this capability, so do not be surprised + if this feature does not materialise. Formal capabilities will be announced at the time that + this tool is released for production use. +

    Windows NT4/200x

    The tools that may be used to configure these types of controls from the MS Windows environment are: The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). Under MS Windows 200x/XP this is done using the Microsoft Management Console (MMC) with appropriate - "snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor. -

    Samba PDC

    + "snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor. +

    Samba PDC

    With a Samba Domain Controller, the new tools for managing of user account and policy information includes: smbpasswd, pdbedit, net, rpcclient. The administrator should read the man pages for these tools and become familiar with their use. -

    System Startup and Logon Processing Overview

    +

    System Startup and Logon Processing Overview

    The following attempts to document the order of processing of system and user policies following a system reboot and as part of the user logon:

    1. @@ -13215,7 +12421,7 @@ reboot and as part of the user logon:

    2. Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded and applied. The list may include GPOs that: -

      Apply to the location of machines in a Directory
      Apply only when settings have changed
      Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.

      +

      • Apply to the location of machines in a Directory

      • Apply only when settings have changed

      • Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.

      No desktop user interface is presented until the above have been processed.

    3. Execution of start-up scripts (hidden and synchronous by default). @@ -13226,7 +12432,7 @@ reboot and as part of the user logon:

    4. An ordered list of User GPOs is obtained. The list contents depends on what is configured in respect of: -

      Is user a domain member, thus subject to particular policies
      Loopback enablement, and the state of the loopback policy (Merge or Replace)
      Location of the Active Directory itself
      Has the list of GPOs changed. No processing is needed if not changed.

      +

      • Is user a domain member, thus subject to particular policies

      • Loopback enablement, and the state of the loopback policy (Merge or Replace)

      • Location of the Active Directory itself

      • Has the list of GPOs changed. No processing is needed if not changed.

    5. User Policies are applied from Active Directory. Note: There are several types.

    6. @@ -13236,18 +12442,18 @@ reboot and as part of the user logon:

    7. The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like and NT4 Domain) machine (system) policies are applied at start-up, User policies are applied at logon. -

    Common Errors

    +

    Common Errors

    Policy related problems can be very difficult to diagnose and even more difficult to rectify. The following collection demonstrates only basic issues. -

    Policy Does Not Work

    -Question: We have created the config.pol file and put it in the NETLOGON share. +

    Policy Does Not Work

    + “We have created the config.pol file and put it in the NETLOGON share. It has made no difference to our Win XP Pro machines, they just don't see it. IT worked fine with Win 98 but does not -work any longer since we upgraded to Win XP Pro. Any hints? +work any longer since we upgraded to Win XP Pro. Any hints?”

    -ANSWER: Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based +Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based platforms. You need to use the NT4 Group Policy Editor to create a file called NTConfig.POL so that it is in the correct format for your MS Windows XP Pro clients. -

    Chapter 24. Desktop Profile Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    How does one set up roaming profiles for just one (or a few) user/s or group/s?
    Can NOT use Roaming Profiles
    Changing the default profile

    Features and Benefits

    +

    Chapter 24. Desktop Profile Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Setting up roaming profiles for just a few user's or group's?
    Can NOT use Roaming Profiles
    Changing the default profile

    Features and Benefits

    Roaming Profiles are feared by some, hated by a few, loved by many, and a Godsend for some administrators.

    @@ -13260,7 +12466,7 @@ problem to others. In particular, users of mobile computing tools, where often t be a sustained network connection, are often better served by purely Local Profiles. This chapter provides information to help the Samba administrator to deal with those situations also. -

    Roaming Profiles

    Warning

    +

    Roaming Profiles

    Warning

    Roaming profiles support is different for Win9x / Me and Windows NT4/200x.

    Before discussing how to configure roaming profiles, it is useful to see how @@ -13273,21 +12479,17 @@ profiles are restricted to being stored in the user's home directory.

    Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields, including a separate field for the location of the user's profiles. -

    Samba Configuration for Profile Handling

    +

    Samba Configuration for Profile Handling

    This section documents how to configure Samba for MS Windows client profile support. -

    NT4/200x User Profiles

    +

    NT4/200x User Profiles

    To support Windows NT4/200x clients, in the [global] section of smb.conf set the following (for example):

    -

    -	logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath
-

    +

    logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath

    This is typically implemented like: -

    -		logon path = \\%L\Profiles\%u
-

    +

    logon path = \\%L\Profiles\%u

    where %L translates to the name of the Samba server and %u translates to the user name

    The default for this option is \\%N\%U\profile, @@ -13300,31 +12502,26 @@ semantics of %L and %N, as well as %U and %u. MS Windows NT/2K clients at times do not disconnect a connection to a server between logons. It is recommended to NOT use the homes meta-service name as part of the profile share path. -

    Windows 9x / Me User Profiles

    - To support Windows 9x / Me clients, you must use the logon home parameter. Samba has +

    Windows 9x / Me User Profiles

    + To support Windows 9x / Me clients, you must use the logon home parameter. Samba has now been fixed so that net use /home now works as well, and it, too, relies on the logon home parameter.

    By using the logon home parameter, you are restricted to putting Win9x / Me profiles in the user's home directory. But wait! There is a trick you can use. If you set the following in the [global] section of your smb.conf file: -

    -	logon home = \\%L\%U\.profiles
-

    +

    logon home = \\%L\%U\.profiles

    then your Windows 9x / Me clients will dutifully put their clients in a subdirectory of your home directory called .profiles (thus making them hidden).

    Not only that, but net use /home will also work, because of a feature in Windows 9x / Me. It removes any directory stuff off the end of the home directory area and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for logon home. -

    Mixed Windows 9x / Me and Windows NT4/200x User Profiles

    +specified \\%L\%U for logon home. +

    Mixed Windows 9x / Me and Windows NT4/200x User Profiles

    You can support profiles for both Win9X and WinNT clients by setting both the -logon home and logon path parameters. For example: -

    -	logon home = \\%L\%u\.profiles
-	logon path = \\%L\profiles\%u
-

    Disabling Roaming Profile Support

    +logon home and logon path parameters. For example: +

    logon home = \\%L\%u\.profiles
    logon path = \\%L\profiles\%u

    Disabling Roaming Profile Support

    A question often asked is “How may I enforce use of local profiles?” or “How do I disable Roaming Profiles?”

    @@ -13332,13 +12529,11 @@ There are three ways of doing this:

    In smb.conf

    Affect the following settings and ALL clients will be forced to use a local profile: - 

    -			logon home =
-			logon path =
-

    +

    logon home
    logon path

    MS Windows Registry:

    By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This of course modifies registry settings. The full path to the option is: + 

     	Local Computer Policy\
 		Computer Configuration\
@@ -13361,15 +12556,15 @@ profiles.
 The specifics of how to convert a local profile to a roaming profile, or a roaming profile
 to a local one vary according to the version of MS Windows you are running. Consult the
 Microsoft MS Windows Resource Kit for your version of Windows for specific information.
-

    Windows Client Profile Configuration Information

    Windows 9x / Me Profile Setup

    +

    Windows Client Profile Configuration Information

    Windows 9x / Me Profile Setup

    When a user first logs in on Windows 9X, the file user.DAT is created, as are folders Start Menu, Desktop, Programs and Nethood. These directories and their contents will be merged with the local versions stored in c:\windows\profiles\username on subsequent logins, taking the most recent from each. You will need to use the [global] -options preserve case = yes, short preserve case = yes and -case sensitive = no in order to maintain capital letters in shortcuts +options preserve case = yes, short preserve case = yes and +case sensitive = no in order to maintain capital letters in shortcuts in any of the profile folders.

    The user.DAT file contains all the user's preferences. If you wish to @@ -13402,11 +12597,11 @@ domain and profiles downloaded from it, if that domain logon server supports it), user name and user's password.

    Once the user has been successfully validated, the Windows 9x / Me machine -will inform you that The user has not logged on before' and asks you - if you wish to save the user's preferences? Select yes. +will inform you that The user has not logged on before and asks you +Do you wish to save the user's preferences?. Select yes.

    Once the Windows 9x / Me client comes up with the desktop, you should be able -to examine the contents of the directory specified in the logon path +to examine the contents of the directory specified in the logon path on the samba server and verify that the Desktop, Start Menu, Programs and Nethood folders have been created.

    @@ -13420,14 +12615,14 @@ the newest folders and short-cuts from each set. If you have made the folders / files read-only on the samba server, then you will get errors from the Windows 9x / Me machine on logon and logout, as it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the Windows 9x / Me machine, check the Unix file +you have any errors reported by the Windows 9x / Me machine, check the UNIX file permissions and ownership rights on the profile directory contents, on the samba server.

    If you have problems creating user profiles, you can reset the user's local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time". -

    Warning

    +they will be told that they are logging in "for the first time". +

    Warning

    Before deleting the contents of the directory listed in the ProfilePath (this is likely to be c:\windows\profiles\username), ask them if they @@ -13437,8 +12632,8 @@ they will be told that they are logging in "for the first time".

    This will have the effect of removing the local (read-only hidden system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. -

    1. + local "desktop", "nethood", "start menu" and "programs" folders. +

    1. instead of logging in under the [user, password, domain] dialog, press escape.

    2. @@ -13455,7 +12650,7 @@ they will be told that they are logging in "for the first time".

    3. log off the windows 9x / Me client.

    4. - check the contents of the profile path (see logon path described + check the contents of the profile path (see logon path described above), and delete the user.DAT or user.MAN file for the user, making a backup if required.

    @@ -13467,14 +12662,14 @@ If you have access to an Windows NT4/200x server, then first set up roaming prof and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine the example packet traces provided with Windows NT4/200x server, and see what the differences are with the equivalent samba trace. -

    Windows NT4 Workstation

    +

    Windows NT4 Workstation

    When a user first logs in to a Windows NT Workstation, the profile NTuser.DAT is created. The profile location can be now specified -through the logon path parameter. +through the logon path parameter.

    There is a parameter that is now available for use with NT Profiles: -logon drive. This should be set to H: or any other drive, and -should be used in conjunction with the new "logon home" parameter. +logon drive. This should be set to H: or any other drive, and +should be used in conjunction with the new logon home parameter.

    The entry for the NT4 profile is a _directory_ not a file. The NT help on profiles mentions that a directory is also created with a .PDS @@ -13496,7 +12691,7 @@ turns a profile into a mandatory one.

    The case of the profile is significant. The file must be called NTuser.DAT or, for a mandatory profile, NTuser.MAN. -

    Windows 2000/XP Professional

    +

    Windows 2000/XP Professional

    You must first convert the profile from a local profile to a domain profile on the MS Windows workstation as follows:

    1. @@ -13512,11 +12707,10 @@ profile on the MS Windows workstation as follows:

    2. In the Permitted to use box, click on the Change button.

    3. - Click on the 'Look in" area that lists the machine name, when you click + Click on the 'Look in" area that lists the machine name, when you click here it will open up a selection box. Click on the domain to which the profile must be accessible. -

      Note

      You will need to log on if a logon box opens up. Eg: In the connect - as: MIDEARTH\root, password: mypassword.

    4. +

      Note

      You will need to log on if a logon box opens up. Eg: In the connect as: DOMAIN\root, password: mypassword.

    5. To make the profile capable of being used by anyone select 'Everyone'

    6. Click OK. The Selection box will close. @@ -13524,12 +12718,12 @@ profile on the MS Windows workstation as follows: Now click on the Ok button to create the profile in the path you nominated.

    -Done. You now have a profile that can be edited using the samba-3.0.0 +Done. You now have a profile that can be edited using the samba profiles tool.

    Note

    Under NT/2K the use of mandatory profiles forces the use of MS Exchange storage of mail data. That keeps desktop profiles usable. -

    Note

    1. +

    Procedure 24.2. Windows XP Service Pack 1

    1. This is a security check new to Windows XP (or maybe only Windows XP service pack 1). It can be disabled via a group policy in Active Directory. The policy is:

      Computer Configuration\Administrative Templates\System\User @@ -13543,10 +12737,10 @@ the following (N.B. I don't know for sure that this will work in the same way as a domain group policy):

    2. On the XP workstation log in with an Administrator account. -

    3. Click: Start, Run

    4. Type: mmc

    5. Click: OK

    6. A Microsoft Management Console should appear.

    7. Click: File, Add/Remove Snap-in..., Add

    8. Double-Click: Group Policy

    9. Click: Finish, Close

    10. Click: OK

    11. In the "Console Root" window:

    12. Expand: Local Computer Policy, Computer Configuration, +

    13. Click: Start, Run

    14. Type: mmc

    15. Click: OK

    16. A Microsoft Management Console should appear.

    17. Click: File, Add/Remove Snap-in..., Add

    18. Double-Click: Group Policy

    19. Click: Finish, Close

    20. Click: OK

    21. In the "Console Root" window:

    22. Expand: Local Computer Policy, Computer Configuration, Administrative Templates, System, User Profiles

    23. Double-Click: Do not check for user ownership of Roaming Profile Folders

    24. Select: Enabled

    25. Click: OK

    26. Close the whole console. You do not need to save the settings (this refers to the console settings rather than the policies you have - changed).

    27. Reboot

    Sharing Profiles between W9x/Me and NT4/200x/XP workstations

    + changed).

  • Reboot

    • Sharing Profiles between W9x/Me and NT4/200x/XP workstations

    Sharing of desktop profiles between Windows versions is NOT recommended. Desktop profiles are an evolving phenomenon and profiles for later versions of MS Windows clients add features that may interfere with earlier versions @@ -13557,18 +12751,18 @@ version resulting in loss of profile information content when that user logs on again with the newer version of MS Windows.

    If you then want to share the same Start Menu / Desktop with W9x/Me, you will -need to specify a common location for the profiles. The smb.conf parameters -that need to be common are logon path and -logon home. +need to specify a common location for the profiles. The smb.conf parameters +that need to be common are logon path and +logon home.

    If you have this set up correctly, you will find separate user.DAT and NTuser.DAT files in the same profile directory. -

    Profile Migration from Windows NT4/200x Server to Samba

    +

    Profile Migration from Windows NT4/200x Server to Samba

    There is nothing to stop you specifying any path that you like for the location of users' profiles. Therefore, you could specify that the profile be stored on a samba server, or any other SMB server, as long as that SMB server supports encrypted passwords. -

    Windows NT4 Profile Management Tools

    +

    Windows NT4 Profile Management Tools

    Unfortunately, the Resource Kit information is specific to the version of MS Windows NT4/200x. The correct resource kit is required for each platform.

    @@ -13578,24 +12772,20 @@ On your NT4 Domain Controller, right click on My Computer< select the tab labelled User Profiles.

  • Select a user profile you want to migrate and click on it. -

    Note

    I am using the term "migrate" loosely. You can copy a profile to +

    Note

    I am using the term "migrate" loosely. You can copy a profile to create a group profile. You can give the user 'Everyone' rights to the profile you copy this to. That is what you need to do, since your samba domain is not a member of a trust relationship with your NT4 PDC.

  • Click the Copy To button.

  • In the box labelled Copy Profile to add your new path, eg: c:\temp\foobar

  • Click on the button Change in the Permitted to use box.

  • Click on the group 'Everyone' and then click OK. This closes the 'choose user' box.

  • Now click OK.

    • Follow the above for every profile you need to migrate. -

    Side bar Notes

    +

    Side bar Notes

    You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page.

    -With Samba-3.0.0 alpha code you can import all you NT4 domain accounts -using the net samsync method. This way you can retain your profile -settings as well as all your users. -

    moveuser.exe

    +this. Read the man page.

    moveuser.exe

    The W2K professional resource kit has moveuser.exe. moveuser.exe changes the security of a profile from one user to another. This allows the account domain to change, and/or the user name to change. -

    Get SID

    +

    Get SID

    You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 Resource Kit.

    @@ -13608,7 +12798,7 @@ users who have logged on to this computer. (To find the profile information for the user whose locally cached profile you want to move, find the SID for the user with the GetSID.exe utility.) Inside of the appropriate user's subkey, you will see a string value named ProfileImagePath. -

    Mandatory profiles

    +

    Mandatory profiles

    A Mandatory Profile is a profile that the user does NOT have the ability to overwrite. During the user's session it may be possible to change the desktop environment, but as the user logs out all changes made will be lost. If it is desired to NOT allow the @@ -13624,7 +12814,7 @@ file in the copied profile and rename it to NTUser.MAN.

    For MS Windows 9x / Me it is the User.DAT file that must be renamed to User.MAN to affect a mandatory profile. -

    Creating/Managing Group Profiles

    +

    Creating/Managing Group Profiles

    Most organisations are arranged into departments. There is a nice benefit in this fact since usually most users in a department will require the same desktop applications and the same desktop layout. MS Windows NT4/200x/XP will allow the @@ -13634,19 +12824,19 @@ profile is assigned access rights for the user group that needs to be given acce to the group profile.

    The next step is rather important. Please note: Instead of assigning a group profile -to users (ie: Using User Manager) on a "per user" basis, the group itself is assigned +to users (ie: Using User Manager) on a "per user" basis, the group itself is assigned the now modified profile.

    Note

    Be careful with group profiles, if the user who is a member of a group also has a personal profile, then the result will be a fusion (merge) of the two. -

    Default Profile for Windows Users

    +

    Default Profile for Windows Users

    MS Windows 9x / Me and NT4/200x/XP will use a default profile for any user for whom a profile does not already exist. Armed with a knowledge of where the default profile is located on the Windows workstation, and knowing which registry keys affect the path from which the default profile is created, it is possible to modify the default profile to one that has been optimised for the site. This has significant administrative advantages. -

    MS Windows 9x/Me

    +

    MS Windows 9x/Me

    To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System Policy Editor or change the registry directly.

    @@ -13657,8 +12847,8 @@ select User Profiles, click on the enable box. Do

    To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive HKEY_LOCAL_MACHINE\Network\Logon. Now add a DWORD type key with the name -"User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0. -

    How User Profiles Are Handled in Windows 9x / Me?

    +"User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0. +

    How User Profiles Are Handled in Windows 9x / Me?

    When a user logs on to a Windows 9x / Me machine, the local profile path, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList, is checked for an existing entry for that user: @@ -13674,7 +12864,7 @@ If a User Profile is not found in either location, the Default User Profile from machine is used and is copied to a newly created folder for the logged on user. At log off, any changes that the user made are written to the user's local profile. If the user has a roaming profile, the changes are written to the user's profile on the server. -

    MS Windows NT4 Workstation

    +

    MS Windows NT4 Workstation

    On MS Windows NT4 the default user profile is obtained from the location %SystemRoot%\Profiles which in a default installation will translate to C:\WinNT\Profiles. Under this directory on a clean install there will be @@ -13685,7 +12875,7 @@ system users. The Default User directory contains menu customisable per user depending on the profile settings chosen/created.

    When a new user first logs onto an MS Windows NT4 machine a new profile is created from: -

    All Users settings
    Default User settings (contains the default NTUser.DAT file)

    +

    • All Users settings

    • Default User settings (contains the default NTUser.DAT file)

    When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain the following steps are followed in respect of profile handling:

    1. @@ -13717,8 +12907,8 @@ will stored in the %SystemRoot%\Profiles\%USERNAME% lo also remain stored in the same way, unless the following registry key is created: 

      -	HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\
-	"DeleteRoamingCache"=dword:00000001
+HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
+winlogon\"DeleteRoamingCache"=dword:00000001

      In which case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be @@ -13737,7 +12927,7 @@ are controlled by entries on Windows NT4 is:

      The above hive key contains a list of automatically managed folders. The default entries are:

      -

      Table 24.1. User Shell Folder registry keys default values

      NameDefault Value
      AppData%USERPROFILE%\Application Data
      Desktop%USERPROFILE%\Desktop
      Favorites%USERPROFILE%\Favorites
      NetHood%USERPROFILE%\NetHood
      PrintHood%USERPROFILE%\PrintHood
      Programs%USERPROFILE%\Start Menu\Programs
      Recent%USERPROFILE%\Recent
      SendTo%USERPROFILE%\SendTo
      Start Menu %USERPROFILE%\Start Menu
      Startup%USERPROFILE%\Start Menu\Programs\Startup

      +

      Table 24.1. User Shell Folder registry keys default values

      NameDefault Value
      AppData%USERPROFILE%\Application Data
      Desktop%USERPROFILE%\Desktop
      Favorites%USERPROFILE%\Favorites
      NetHood%USERPROFILE%\NetHood
      PrintHood%USERPROFILE%\PrintHood
      Programs%USERPROFILE%\Start Menu\Programs
      Recent%USERPROFILE%\Recent
      SendTo%USERPROFILE%\SendTo
      Start Menu %USERPROFILE%\Start Menu
      Startup%USERPROFILE%\Start Menu\Programs\Startup

      The registry key that contains the location of the default profile settings is:

      @@ -13745,8 +12935,8 @@ The registry key that contains the location of the default profile settings is:

      The default entries are: -

      Table 24.2. Defaults of profile settings registry keys

      Common Desktop%SystemRoot%\Profiles\All Users\Desktop
      Common Programs%SystemRoot%\Profiles\All Users\Programs
      Common Start Menu%SystemRoot%\Profiles\All Users\Start Menu
      Common Startup%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup

      -

    MS Windows 200x/XP

    Note

    +

    Table 24.2. Defaults of profile settings registry keys

    Common Desktop%SystemRoot%\Profiles\All Users\Desktop
    Common Programs%SystemRoot%\Profiles\All Users\Programs
    Common Start Menu%SystemRoot%\Profiles\All Users\Start Menu
    Common Startup%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup

    +

    MS Windows 200x/XP

    Note

    MS Windows XP Home Edition does use default per user profiles, but can not participate in domain security, can not log onto an NT/ADS style domain, and thus can obtain the profile only from itself. While there are benefits in doing this the beauty of those MS Windows @@ -13795,9 +12985,9 @@ are controlled by entries on Windows 200x/XP is:

    The above hive key contains a list of automatically managed folders. The default entries are:

    -

    Table 24.3. Defaults of default user profile paths registry keys

    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Cache%USERPROFILE%\Local Settings\Temporary Internet Files
    Cookies%USERPROFILE%\Cookies
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    History%USERPROFILE%\Local Settings\History
    Local AppData%USERPROFILE%\Local Settings\Application Data
    Local Settings%USERPROFILE%\Local Settings
    My Pictures%USERPROFILE%\My Documents\My Pictures
    NetHood%USERPROFILE%\NetHood
    Personal%USERPROFILE%\My Documents
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu%USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup
    Templates%USERPROFILE%\Templates

    +

    Table 24.3. Defaults of default user profile paths registry keys

    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Cache%USERPROFILE%\Local Settings\Temporary Internet Files
    Cookies%USERPROFILE%\Cookies
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    History%USERPROFILE%\Local Settings\History
    Local AppData%USERPROFILE%\Local Settings\Application Data
    Local Settings%USERPROFILE%\Local Settings
    My Pictures%USERPROFILE%\My Documents\My Pictures
    NetHood%USERPROFILE%\NetHood
    Personal%USERPROFILE%\My Documents
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu%USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup
    Templates%USERPROFILE%\Templates

    -There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all +There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all the others are of type REG_EXPAND_SZ.

    It makes a huge difference to the speed of handling roaming user profiles if all the folders are @@ -13811,18 +13001,21 @@ You could also use:

    \\SambaServer\FolderShare\%USERNAME%

    in which case the default folders will be stored in the server named SambaServer in the share called FolderShare under a directory that has the name of the MS Windows -user as seen by the Linux/Unix file system. +user as seen by the Linux/UNIX file system.

    Please note that once you have created a default profile share, you MUST migrate a user's profile (default or custom) to it.

    MS Windows 200x/XP profiles may be Local or Roaming. A roaming profile will be cached locally unless the following registry key is created: -

    HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\"DeleteRoamingCache"=dword:00000001

    +

    +

    +HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
+	winlogon\"DeleteRoamingCache"=dword:00000001

    In which case, the local cache copy will be deleted on logout. -

    Common Errors

    +

    Common Errors

    The following are some typical errors/problems/questions that have been asked. -

    How does one set up roaming profiles for just one (or a few) user/s or group/s?

    +

    Setting up roaming profiles for just a few user's or group's?

    With samba-2.2.x the choice you have is to enable or disable roaming profiles support. It is a global only setting. The default is to have roaming profiles and the default path will locate them in the user's home @@ -13834,42 +13027,40 @@ those machines on which roaming profile support is NOT wanted it is then necessary to disable roaming profile handling in the registry of each such machine.

    -With samba-3.0.0 (soon to be released) you can have a global profile -setting in smb.conf _AND_ you can over-ride this by per-user settings +With samba-3 you can have a global profile +setting in smb.conf _AND_ you can over-ride this by per-user settings using the Domain User Manager (as with MS Windows NT4/ Win 2Kx).

    In any case, you can configure only one profile per user. That profile can be either: -

    A profile unique to that user
    A mandatory profile (one the user can not change)
    A group profile (really should be mandatory ie:unchangable)

    Can NOT use Roaming Profiles

    +

    • A profile unique to that user

    • A mandatory profile (one the user can not change)

    • A group profile (really should be mandatory ie:unchangable)

    Can NOT use Roaming Profiles

    +A user requested the following: “ - I dont want Roaming profile to be implemented, I just want to give users - local profiles only. -... - Please help me I am totally lost with this error from past two days I tried - everything and googled around quite a bit but of no help. Please help me. +I do not want Roaming profiles to be implemented. I want to give users a local profile alone. ... +Please help me I am totally lost with this error. For the past two days I tried everything, I googled +around but found no useful pointers. Please help me. ”

    -Your choices are: - - -

    Local profiles

    - I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out -

    Roaming profiles

    -

    can use auto-delete on logout option
    requires a registry key change on workstation

    - - Your choices are: - -

    Personal Roaming profiles

    - - should be preserved on a central server - - workstations 'cache' (store) a local copy - - used in case the profile can not be downloaded - at next logon -

    Group profiles

    - loaded from a central place

    Mandatory profiles

    - - can be personal or group - - can NOT be changed (except by an administrator -

    +The choices are: +

    Local profiles:

    + I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out +

    Roaming profiles:

    + As a user logs onto the network a centrally stored profile is copied to the workstation + to form a local profile. This local profile will persist (remain on the workstation disk) + unless a registry key is changed that will cause this profile to be automatically deleted + on logout. +

    +The Roaming Profile choices are: +

    Personal Roaming profiles

    + These are typically stored in a profile share on a central (or conveniently located + local) server. +

    + Workstations 'cache' (store) a local copy of the profile. This cached copy is used when + the profile can not be downloaded at next logon. +

    Group profiles

    These are loaded from a central profile server

    Mandatory profiles

    + Mandatory profiles can be created for a user as well as for any group that a user + is a member of. Mandatory profiles can NOT be changed by ordinary users. Only the administrator + can change or reconfigure a mandatory profile.

    - -

    A WinNT4/2K/XP profile can vary in size from 130KB to off the scale. Outlook PST files are most often part of the profile and can be many GB in size. On average (in a well controlled environment) roaming profile size of @@ -13883,52 +13074,39 @@ controls of how they can be changed as well as good discipline make up for a problem free site.

    Microsoft's answer to the PST problem is to store all email in an MS -Exchange Server back-end. But this is another story ...! -

    -So, having LOCAL profiles means: - -

    If lots of users user each machine - lot's of local disk storage needed for local profiles
    Every workstation the user logs into has it's own profile - can be very different from machine to machine

    - -On the other hand, having roaming profiles means: -

    The network administrator can control EVERY aspect of user profiles
    With the use of mandatory profiles - a drastic reduction in network management overheads
    User unhappiness about not being able to change their profiles soon fades as they get used to being able to work reliably

    - +Exchange Server back-end. This removes the need for a PST file.

    -I have managed and installed MANY NT/2K networks and have NEVER found one -where users who move from machine to machine are happy with local -profiles. In the long run local profiles bite them. -

    Changing the default profile

    “ -When the client tries to logon to the PDC it looks for a profile to download -where do I put this default profile. +LOCAL profiles mean: +

    • If each machine is used my many users then much local disk storage is needed for local profiles

    • Every workstation the user logs into has it's own profile, these can be very different from machine to machine

    +On the other hand, use of roaming profiles means: +

    • The network administrator can control the desktop environment of all users.

    • Use of mandatory profiles drasitcally reduces network management overheads.

    • In the long run users will be experience fewer problems.

    Changing the default profile

    +Question: +“ +When the client logs onto the domain controller it searches for a profile to download, +where do I put this default profile? ”

    -Firstly, your samba server need to be configured as a domain controller. -

    -	server = user
-    os level = 32 (or more)
-	domain logons = Yes
-

    -Plus you need to have a [netlogon] share that is world readable. +Firstly, the samba server needs to be configured as a domain controller. +This can be done by setting in smb.conf: +

    security = user
    os level = 32 (or more)
    domain logons = Yes

    +There must be an [netlogon] share that is world readable. It is a good idea to add a logon script to pre-set printer and drive connections. There is also a facility for automatically synchronizing the workstation time clock with that of the logon server (another good thing to do).

    Note

    To invoke auto-deletion of roaming profile from the local -workstation cache (disk storage) you need to use the Group Policy Editor +workstation cache (disk storage) use the Group Policy Editor to create a file called NTConfig.POL with the appropriate entries. This file needs to be located in the netlogon share root directory.

    -Oh, of course the windows clients need to be members of the domain. -Workgroup machines do NOT do network logons - so they never see domain -profiles. +Windows clients need to be members of the domain. Workgroup machines do NOT use network logons so +they do not interoperate with domain profiles.

    -Secondly, for roaming profiles you need: - - logon path = \\%N\profiles\%U (with some such path) - logon drive = H: (Z: is the default) - - Plus you need a PROFILES share that is world writable. -

    Chapter 25. PAM based Distributed Authentication

    John H. Terpstra

    Samba Team

    Stephen Langasek

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem

    +For roaming profiles add to smb.conf: +

    +

    logon path = \\%N\profiles\%U
    # Default logon drive is Z:
    logon drive = H:
    # This requires a PROFILES share that is world writable.

    +

    Chapter 25. PAM based Distributed Authentication

    John H. Terpstra

    Samba Team

    Stephen Langasek

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    Winbind is not resolving users and groups

    This chapter you should help you to deploy winbind based authentication on any PAM enabled -Unix/Linux system. Winbind can be used to enable user level application access authentication +UNIX/Linux system. Winbind can be used to enable user level application access authentication from any MS Windows NT Domain, MS Windows 200x Active Directory based domain, or any Samba based domain environment. It will also help you to configure PAM based local host access controls that are appropriate to your Samba configuration. @@ -13936,9 +13114,9 @@ controls that are appropriate to your Samba configuration. In addition to knowing how to configure winbind into PAM, you will learn generic PAM management possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage.

    Note

    -The use of Winbind require more than PAM configuration alone. Please refer to the Winbind chapter. -

    Features and Benefits

    -A number of Unix systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, +The use of Winbind require more than PAM configuration alone. Please refer to the Winbind chapter. +

    Features and Benefits

    +A number of UNIX systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication, authorization and resource control services. Prior to the introduction of PAM, a decision to use an alternative to the system password database (/etc/passwd) @@ -13951,38 +13129,38 @@ authentication/authorization infrastructure. PAM is configured either through o /etc/pam.conf (Solaris), or by editing individual files that are located in /etc/pam.d.

    -On PAM enabled Unix/Linux systems it is an easy matter to configure the system to use any +On PAM enabled UNIX/Linux systems it is an easy matter to configure the system to use any authentication backend, so long as the appropriate dynamically loadable library modules are available for it. The backend may be local to the system, or may be centralised on a remote server.

    PAM support modules are available for: -

    /etc/passwd

    -

    - There are several PAM modules that interact with this standard Unix user +

    /etc/passwd:

    + There are several PAM modules that interact with this standard UNIX user database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so and pam_userdb.so. -

    Kerberos

    -

    +

    Kerberos:

    The pam_krb5.so module allows the use of any Kerberos compliant server. This tool is used to access MIT Kerberos, Heimdal Kerberos, and potentially Microsoft Active Directory (if enabled). -

    LDAP

    -

    +

    LDAP:

    The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend server. Commonly used LDAP backend servers include: OpenLDAP v2.0 and v2.1, Sun ONE iDentity server, Novell eDirectory server, Microsoft Active Directory. -

    NetWare Bindery

    -

    +

    NetWare Bindery:

    The pam_ncp_auth.so module allows authentication off any bindery enabled NetWare Core Protocol based server. -

    SMB Password

    -

    +

    SMB Password:

    This module, called pam_smbpass.so, will allow user authentication off the passdb backend that is configured in the Samba smb.conf file. -

    SMB Server

    -

    +

    SMB Server:

    The pam_smb_auth.so module is the original MS Windows networking authentication tool. This module has been somewhat outdated by the Winbind module. -

    Winbind

    -

    +

    Winbind:

    The pam_winbind.so module allows Samba to obtain authentication from any MS Windows Domain Controller. It can just as easily be used to authenticate users for access to any PAM enabled application. -

    RADIUS

    -

    +

    RADIUS:

    There is a PAM RADIUS (Remote Access Dial-In User Service) authentication module. In most cases the administrator will need to locate the source code for this tool and compile and install it themselves. RADIUS protocols are @@ -13995,12 +13173,12 @@ of distributed samba domain controllers that can provide wide are network bandwi efficient authentication services for PAM capable systems. In effect, this allows the deployment of centrally managed and maintained distributed authentication from a single user account database. -

    Technical Discussion

    +

    Technical Discussion

    PAM is designed to provide the system administrator with a great deal of flexibility in configuration of the privilege granting applications of their system. The local configuration of system security controlled by PAM is contained in one of two places: either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory. -

    PAM Configuration Syntax

    +

    PAM Configuration Syntax

    In this section we discuss the correct syntax of and generic options respected by entries to these files. PAM specific tokens in the configuration file are case insensitive. The module paths, however, are case sensitive since they indicate a file's name and reflect the case dependence of typical file-systems. @@ -14015,32 +13193,31 @@ default location then it is not necessary to specify the path. In the case of Linux, the default location is /lib/security. If the module is located outside the default then the path must be specified as:

    -

    +
     auth  required  /other_path/pam_strange_module.so
 
    
-
    Anatomy of /etc/pam.d Entries
    
+
    Anatomy of /etc/pam.d Entries
    
 The remaining information in this subsection was taken from the documentation of the Linux-PAM
 project. For more information on PAM, see 
-
-http://ftp.kernel.org/pub/linux/libs/pam The Official Linux-PAM home page.
+The Official Linux-PAM home page
 
    
 A general configuration line of the /etc/pam.conf file has the following form:
 
    
-
    +
     service-name   module-type   control-flag   module-path   args
 
    
 
    
 Below, we explain the meaning of each of these tokens. The second (and more recently adopted)
 way of configuring Linux-PAM is via the contents of the /etc/pam.d/ directory.
 Once we have explained the meaning of the above tokens, we will describe this method.
-
    service-name
    -
    
+
    service-name:
    
 		The name of the service associated with this entry. Frequently the service name is the conventional
 		name of the given application. For example, `ftpd', `rlogind' and `su', etc. .
 		
    
 		There is a special service-name, reserved for defining a default authentication mechanism. It has
 		the name `OTHER' and may be specified in either lower or upper case characters. Note, when there
 		is a module specified for a named service, the `OTHER' entries are ignored.
-		
    module-type
    -
    
+		
    module-type:
    
 		One of (currently) four types of module. The four types are as follows:
 		
    • 
 			auth: this module type provides two aspects of authenticating the user.
@@ -14062,7 +13239,7 @@ Once we have explained the meaning of the above tokens, we will describe this me
 			password: this last module type is required for updating the authentication
 			token associated with the user. Typically, there is one module for each `challenge/response'
 			based authentication (auth) module-type.
-			
    control-flag
    -
    
+			
    control-flag:
    
 		The control-flag is used to indicate how the PAM library will react to the success or failure of the
 		module it is associated with. Since modules can be stacked (modules of the same type execute in series,
 		one after another), the control-flags determine the relative importance of each module. The application
@@ -14106,9 +13283,9 @@ Once we have explained the meaning of the above tokens, we will describe this me
 		The more elaborate (newer) syntax is much more specific and gives the administrator a great deal of control
 		over how the user is authenticated. This form of the control flag is delimited with square brackets and
 		consists of a series of value=action tokens:
-		
    -		[value1=action1 value2=action2 ...]
-		
    
+		
    +[value1=action1 value2=action2 ...]
+
    
 		Here, value1 is one of the following return values: success; open_err; symbol_err; service_err;
 		system_err; buf_err; perm_denied; auth_err; cred_insufficient; authinfo_unavail; user_unknown; maxtries;
 		new_authtok_reqd; acct_expired; session_err; cred_unavail; cred_expired; cred_err; no_module_data; conv_err;
@@ -14163,7 +13340,7 @@ Once we have explained the meaning of the above tokens, we will describe this me
 		[ ... value=action ... ] control syntax, it is possible for an application to be configured
 		to support binary prompts with compliant clients, but to gracefully fall over into an alternative authentication
 		mode for older, legacy, applications.
-		
    module-path
    -
    
+		
    module-path:
    
 		The path-name of the dynamically loadable object file; the pluggable module itself. If the first character of the
 		module path is `/', it is assumed to be a complete path. If this is not the case, the given module path is appended
 		to the default module path: /lib/security (but see the notes above).
@@ -14174,7 +13351,7 @@ Once we have explained the meaning of the above tokens, we will describe this me
 		to syslog(3). For a list of generic options see the next section.
 		
    
 		Note, if you wish to include spaces in an argument, you should surround that argument with square brackets. For example:
-		
    +		
     squid auth required pam_mysql.so user=passwd_query passwd=mada \
         db=eminence [query=select user_name from internet_service where \
                      user_name='%u' and password=PASSWORD('%p') and \
@@ -14182,19 +13359,19 @@ squid auth required pam_mysql.so user=passwd_query passwd=mada \
 
    
 		Note, when using this convention, you can include `[' characters inside the string, and if you wish to include a `]'
 		character inside the string that will survive the argument parsing, you should use `\['. In other words:
-		
    +		
     [..[..\]..]    -->   ..[..]..
 
    
 		Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the
 		side of caution) to make the authentication process fail. A corresponding error is written to the system log files
 		with a call to syslog(3). 
-		
    Example System Configurations
    
+

    Example System Configurations

    The following is an example /etc/pam.d/login configuration file. This example had all options been uncommented is probably not usable as it stacks many conditions before allowing successful completion of the login process. Essentially all conditions can be disabled by commenting them out except the calls to pam_pwdb.so. -

    PAM: original login config

    +
    PAM: original login config
     #%PAM-1.0
 # The PAM configuration file for the `login' service
 #
@@ -14209,10 +13386,10 @@ session      required    pam_pwdb.so
 # session    optional    pam_lastlog.so
 # password   required    pam_cracklib.so retry=3
 password     required    pam_pwdb.so shadow md5
-
    PAM: login using pam_smbpass
    
+

    PAM: login using pam_smbpass

    PAM allows use of replaceable modules. Those available on a sample system include:

    $/bin/ls /lib/security -

    +
     pam_access.so    pam_ftp.so          pam_limits.so     
 pam_ncp_auth.so  pam_rhosts_auth.so  pam_stress.so     
 pam_cracklib.so  pam_group.so        pam_listfile.so   
@@ -14236,7 +13413,7 @@ hashes. This database is stored in either
 /usr/local/samba/private/smbpasswd, 
 /etc/samba/smbpasswd, or in 
 /etc/samba.d/smbpasswd, depending on the 
-Samba implementation for your Unix/Linux system. The 
+Samba implementation for your UNIX/Linux system. The 
 pam_smbpass.so module is provided by 
 Samba version 2.2.1 or later. It can be compiled by specifying the 
 --with-pam_smbpass options when running Samba's
@@ -14244,7 +13421,7 @@ Samba version 2.2.1 or later. It can be compiled by specifying the
 on the pam_smbpass module, see the documentation
 in the source/pam_smbpass directory of the Samba 
 source distribution.
-
    +
     #%PAM-1.0
 # The PAM configuration file for the `login' service
 #
@@ -14255,7 +13432,7 @@ password    required    pam_smbpass.so nodelay
 
    
 The following is the PAM configuration file for a particular 
 Linux system. The default condition uses pam_pwdb.so.
-
    +
     #%PAM-1.0
 # The PAM configuration file for the `samba' service
 #
@@ -14269,7 +13446,7 @@ smbpasswd database even for basic samba authentication. Such a
 decision could also be made for the passwd program and would 
 thus allow the smbpasswd passwords to be changed using the passwd 
 program.
-
    +
     #%PAM-1.0
 # The PAM configuration file for the `samba' service
 #
@@ -14288,24 +13465,24 @@ authentication to be configured in a single central file. The
 on the basis that it allows for easier administration. As with all issues in 
 life though, every decision makes trade-offs, so you may want examine the 
 PAM documentation for further helpful information.
-

    smb.conf PAM Configuration

    -There is an option in smb.conf called obey pam restrictions. +

    smb.conf PAM Configuration

    + There is an option in smb.conf called obey pam restrictions. The following is from the on-line help for this option in SWAT;

    -When Samba-3 is configured to enable PAM support (i.e. +When Samba is configured to enable PAM support (i.e. --with-pam), this parameter will control whether or not Samba should obey PAM's account and session management directives. The default behavior is to use PAM for clear text authentication only and to ignore any account or session management. Note that Samba always ignores PAM for authentication in the case of -encrypt passwords = yes. +encrypt passwords = yes. The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. -

    Default: obey pam restrictions = no

    Remote CIFS Authentication using winbindd.so

    +

    Default: obey pam restrictions = no

    Remote CIFS Authentication using winbindd.so

    All operating systems depend on the provision of users credentials acceptable to the platform. -Unix requires the provision of a user identifier (UID) as well as a group identifier (GID). +UNIX requires the provision of a user identifier (UID) as well as a group identifier (GID). These are both simple integer type numbers that are obtained from a password backend such as /etc/passwd.

    @@ -14329,7 +13506,7 @@ Microsoft Active Directory Service (ADS) in so far as reduction of wide area net The rid to unix id database is the only location where the user and group mappings are stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd to determine which user and group ids correspond to Windows NT user and group rids. -

    Password Synchronization using pam_smbpass.so

    +

    Password Synchronization using pam_smbpass.so

    pam_smbpass is a PAM module which can be used on conforming systems to keep the smbpasswd (Samba password) database in sync with the unix password file. PAM (Pluggable Authentication Modules) is an API supported @@ -14342,24 +13519,23 @@ concerned about the presence of suid root binaries on your system, it is recommended that you use pam_winbind instead.

    Options recognized by this module are as follows: -

    Table 25.1. Options recognized by pam_smbpass

    debuglog more debugging info
    auditlike debug, but also logs unknown usernames
    use_first_passdon't prompt the user for passwords; take them from PAM_ items instead
    try_first_passtry to get the password from a previous PAM module, fall back to prompting the user
    use_authtoklike try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only)
    not_set_passdon't make passwords used by this module available to other modules.
    nodelaydon't insert ~1 second delays on authentication failure.
    nulloknull passwords are allowed.
    nonullnull passwords are not allowed. Used to override the Samba configuration.
    migrateonly meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication.
    smbconf=filespecify an alternate path to the smb.conf file.

    +

    Table 25.1. Options recognized by pam_smbpass

    debuglog more debugging info
    auditlike debug, but also logs unknown usernames
    use_first_passdon't prompt the user for passwords; take them from PAM_ items instead
    try_first_passtry to get the password from a previous PAM module, fall back to prompting the user
    use_authtoklike try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only)
    not_set_passdon't make passwords used by this module available to other modules.
    nodelaydon't insert ~1 second delays on authentication failure.
    nulloknull passwords are allowed.
    nonullnull passwords are not allowed. Used to override the Samba configuration.
    migrateonly meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication.
    smbconf=filespecify an alternate path to the smb.conf file.

    -Thanks go to the following people: -

    Andrew Morgan, for providing the Linux-PAM - framework, without which none of this would have happened
    Christian Gafton and Andrew Morgan again, for the - pam_pwdb module upon which pam_smbpass was originally based
    Luke Leighton for being receptive to the idea, +

    • Andrew Morgan, for providing the Linux-PAM + framework, without which none of this would have happened

    • Christian Gafton and Andrew Morgan again, for the + pam_pwdb module upon which pam_smbpass was originally based

    • Luke Leighton for being receptive to the idea, and for the occasional good-natured complaint about the project's status - that keep me working on it :)

    . + that keep me working on it :)

    .

    The following are examples of the use of pam_smbpass.so in the format of Linux /etc/pam.d/ files structure. Those wishing to implement this tool on other platforms will need to adapt this appropriately. -

    Password Synchronisation Configuration

    +

    Password Synchronisation Configuration

    A sample PAM configuration that shows the use of pam_smbpass to make sure private/smbpasswd is kept in sync when /etc/passwd (/etc/shadow) is changed. Useful when an expired password might be changed by an application (such as ssh). -

    +
     #%PAM-1.0
 # password-sync
 #
@@ -14370,13 +13546,13 @@ password   requisite    pam_cracklib.so retry=3
 password   requisite    pam_unix.so shadow md5 use_authtok try_first_pass
 password   required     pam_smbpass.so nullok use_authtok try_first_pass
 session    required     pam_unix.so
-

    Password Migration Configuration

    +

    Password Migration Configuration

    A sample PAM configuration that shows the use of pam_smbpass to migrate from plaintext to encrypted passwords for Samba. Unlike other methods, this can be used for users who have never connected to Samba shares: password migration takes place when users ftp in, login using ssh, pop their mail, etc. -

    +
     #%PAM-1.0
 # password-migration
 #
@@ -14389,11 +13565,11 @@ password   requisite   pam_cracklib.so retry=3
 password   requisite   pam_unix.so shadow md5 use_authtok try_first_pass
 password   optional    pam_smbpass.so nullok use_authtok try_first_pass
 session    required    pam_unix.so
-

    Mature Password Configuration

    +

    Mature Password Configuration

    A sample PAM configuration for a 'mature' smbpasswd installation. private/smbpasswd is fully populated, and we consider it an error if -the smbpasswd doesn't exist or doesn't match the Unix password. -

    +the smbpasswd doesn't exist or doesn't match the UNIX password.
+
     #%PAM-1.0
 # password-mature
 #
@@ -14404,11 +13580,11 @@ password   requisite    pam_cracklib.so retry=3
 password   requisite    pam_unix.so shadow md5 use_authtok try_first_pass
 password   required     pam_smbpass.so use_authtok use_first_pass
 session    required     pam_unix.so
-

    Kerberos Password Integration Configuration

    +

    Kerberos Password Integration Configuration

    A sample PAM configuration that shows pam_smbpass used together with pam_krb5. This could be useful on a Samba PDC that is also a member of a Kerberos realm. -

    +
     #%PAM-1.0
 # kdc-pdc
 #
@@ -14420,13 +13596,15 @@ password   requisite   pam_cracklib.so retry=3
 password   optional    pam_smbpass.so nullok use_authtok try_first_pass
 password   required    pam_krb5.so use_authtok try_first_pass
 session    required    pam_krb5.so
-

    Common Errors

    +

    Common Errors

    PAM can be a very fickle and sensitive to configuration glitches. Here we look at a few cases from the Samba mailing list. -

    pam_winbind problem

    - I have the following PAM configuration: +

    pam_winbind problem

    + “ + I have the following PAM configuration: + ”

    -

    +
     auth required /lib/security/pam_securetty.so
 auth sufficient /lib/security/pam_winbind.so
 auth sufficient /lib/security/pam_unix.so use_first_pass nullok
@@ -14436,18 +13614,61 @@ account required /lib/security/pam_stack.so service=system-auth
 account required /lib/security/pam_winbind.so
 password required /lib/security/pam_stack.so service=system-auth
 
    
-
    
-	When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie".
-	I've tried with user "scienceu+pitie" also.
 	
    
-	Answer: The problem may lie with your inclusion of pam_stack.so
+		“
+	When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie".
+	I've tried with user "scienceu+pitie" also.
+”
+	
    
+		The problem may lie with your inclusion of pam_stack.so
 	service=system-auth. That file often contains a lot of stuff that may
 	duplicate what you're already doing. Try commenting out the pam_stack lines
 	for auth and account and see if things work. If they do, look at
 	/etc/pam.d/system-auth and copy only what you need from it into your
 	/etc/pam.d/login file.  Alternatively, if you want all services to use
 	winbind, you can put the winbind-specific stuff in /etc/pam.d/system-auth.
-

    Chapter 26. Integrating MS Windows networks with Samba

    John H. Terpstra

    Samba Team

    (Jan 01 2001)

    Table of Contents

    Features and Benefits
    Background Information
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    My Boomerang Won't Come Back
    Very Slow Network Connections
    Samba server name change problem

    +

    Winbind is not resolving users and groups

    + “ + My smb.conf file is correctly configured. I have specified + idmap uid = 12000, + and idmap gid = 3000-3500 + and winbind is running. When I do the following it all works fine. +” + 

    +root# wbinfo -u
+MIDEARTH+maryo
+MIDEARTH+jackb
+MIDEARTH+ameds
+...
+MIDEARTH+root
+
+root# wbinfo -g
+MIDEARTH+Domain Users
+MIDEARTH+Domain Admins
+MIDEARTH+Domain Guests
+...
+MIDEARTH+Accounts
+
+root# getent passwd
+root:x:0:0:root:/root:/bin/bash
+bin:x:1:1:bin:/bin:/bin/bash
+...
+maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false
+

    + “ + But the following command just fails: +” +

    +root# chown 'maryo' a_file
+chown: `maryo': invalid user
+

    +“ +This is driving me nuts! What can be wrong? +” +

    + Your system is likely running nscd, the name service + caching daemon. Shut it down, do NOT restart it! You will find your problem resolved. +

    Chapter 26. Integrating MS Windows networks with Samba

    John H. Terpstra

    Samba Team

    (Jan 01 2001)

    Table of Contents

    Features and Benefits
    Background Information
    Name Resolution in a pure UNIX/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging works only in one way
    Very Slow Network Connections
    Samba server name change problem

    This section deals with NetBIOS over TCP/IP name to IP address resolution. If your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this section does not apply to your installation. If your installation involves use of @@ -14458,15 +13679,15 @@ NetBIOS over TCP/IP then this section may help you to resolve networking problem to NOT run NetBEUI at all. Note also that there is NO such thing as NetBEUI over TCP/IP - the existence of such a protocol is a complete and utter mis-apprehension. -

    Features and Benefits

    +

    Features and Benefits

    Many MS Windows network administrators have never been exposed to basic TCP/IP -networking as it is implemented in a Unix/Linux operating system. Likewise, many Unix and +networking as it is implemented in a UNIX/Linux operating system. Likewise, many UNIX and Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP based networking (and may have no desire to be either).

    This chapter gives a short introduction to the basics of how a name can be resolved to it's IP address for each operating system environment. -

    Background Information

    +

    Background Information

    Since the introduction of MS Windows 2000 it is possible to run MS Windows networking without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over @@ -14479,17 +13700,19 @@ Name Service or WINS), TCP port 139 AND TCP port 445 (for actual file and print

    When NetBIOS over TCP/IP is disabled the use of DNS is essential. Most installations that disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS requires + Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR). + Use of DHCP with ADS is recommended as a further means of maintaining central control over client workstation network configuration. -

    Name Resolution in a pure Unix/Linux world

    +

    Name Resolution in a pure UNIX/Linux world

    The key configuration files covered in this section are: -

    • /etc/hosts

    • /etc/resolv.conf

    • /etc/host.conf

    • /etc/nsswitch.conf

    /etc/hosts

    -Contains a static list of IP Addresses and names. +

    • /etc/hosts

    • /etc/resolv.conf

    • /etc/host.conf

    • /etc/nsswitch.conf

    /etc/hosts

    +Contains a static list of IP addresses and names. eg: -

    -	127.0.0.1	localhost localhost.localdomain
-	192.168.1.1	bigbox.caldera.com	bigbox	alias4box
+
    +127.0.0.1	localhost localhost.localdomain
+192.168.1.1	bigbox.caldera.com	bigbox	alias4box
 
    
 The purpose of /etc/hosts is to provide a 
 name resolution mechanism so that uses do not need to remember 
@@ -14497,10 +13720,10 @@ IP addresses.
 
    
 Network packets that are sent over the physical network transport 
 layer communicate not via IP addresses but rather using the Media 
-Access Control address, or MAC address. IP Addresses are currently 
+Access Control address, or MAC address. IP addresses are currently 
 32 bits in length and are typically presented as four (4) decimal 
 numbers that are separated by a dot (or period). eg: 168.192.1.1.
-
    
+
    
 MAC Addresses use 48 bits (or 6 bytes) and are typically represented 
 as two digit hexadecimal numbers separated by colons. eg: 
 40:8e:0a:12:34:56
@@ -14517,8 +13740,8 @@ be assigned per MAC address. One address must be the primary IP address,
 this is the address that will be returned in the ARP reply.
 
    
 When a user or a process wants to communicate with another machine 
-the protocol implementation ensures that the "machine name" or "host 
-name" is resolved to an IP address in a manner that is controlled 
+the protocol implementation ensures that the "machine name" or "host 
+name" is resolved to an IP address in a manner that is controlled 
 by the TCP/IP configuration control files. The file 
 /etc/hosts is one such file.
 
    
@@ -14533,15 +13756,15 @@ MAC addresses only; their own unique address and the address
 ff:ff:ff:ff:ff:ff. The reply packet from an ARP request will 
 contain the MAC address and the primary IP address for each 
 interface.
-
    
+
    
 The /etc/hosts file is foundational to all 
-Unix/Linux TCP/IP installations and as a minimum will contain 
+UNIX/Linux TCP/IP installations and as a minimum will contain 
 the localhost and local network interface IP addresses and the 
 primary names by which they are known within the local machine. 
 This file helps to prime the pump so that a basic level of name 
 resolution can exist before any other method of name resolution 
 becomes available.
-

    /etc/resolv.conf

    +

    /etc/resolv.conf

    This file tells the name resolution libraries:

    • The name of the domain to which the machine belongs @@ -14551,41 +13774,41 @@ This file tells the name resolution libraries:

    • The name or IP address of available Domain Name Servers that may be asked to perform name to address translation lookups -

    /etc/host.conf

    +

    /etc/host.conf

    /etc/host.conf is the primary means by which the setting in /etc/resolv.conf may be affected. It is a critical configuration file. This file controls the order by which name resolution may proceed. The typical structure is: -

    -	order hosts,bind
-	multi on
+
    +order hosts,bind
+multi on
 
    
 then both addresses should be returned. Please refer to the 
 man page for host.conf for further details.
-

    /etc/nsswitch.conf

    +

    /etc/nsswitch.conf

    This file controls the actual name resolution targets. The file typically has resolver object specifications as follows: -

    -	# /etc/nsswitch.conf
-	#
-	# Name Service Switch configuration file.
-	#
+
    +# /etc/nsswitch.conf
+#
+# Name Service Switch configuration file.
+#
 
-	passwd:		compat
-	# Alternative entries for password authentication are:
-	# passwd:	compat files nis ldap winbind
-	shadow:		compat
-	group:		compat
+passwd:		compat
+# Alternative entries for password authentication are:
+# passwd:	compat files nis ldap winbind
+shadow:		compat
+group:		compat
 
-	hosts:		files nis dns
-	# Alternative entries for host name resolution are:
-	# hosts:	files dns nis nis+ hesiod db compat ldap wins
-	networks:	nis files dns
+hosts:		files nis dns
+# Alternative entries for host name resolution are:
+# hosts:	files dns nis nis+ hesiod db compat ldap wins
+networks:	nis files dns
 
-	ethers:		nis files
-	protocols:	nis files
-	rpc:		nis files
-	services:	nis files
+ethers:		nis files
+protocols:	nis files
+rpc:		nis files
+services:	nis files
 
    
 Of course, each of these mechanisms requires that the appropriate 
 facilities and/or services are correctly configured.
@@ -14593,27 +13816,27 @@ facilities and/or services are correctly configured.
 It should be noted that unless a network request/message must be 
 sent, TCP/IP networks are silent. All TCP/IP communications assumes a 
 principal of speaking only when necessary.
-
    
+
    
 Starting with version 2.2.0 samba has Linux support for extensions to 
 the name service switch infrastructure so that linux clients will 
 be able to obtain resolution of MS Windows NetBIOS names to IP 
 Addresses. To gain this functionality Samba needs to be compiled 
-with appropriate arguments to the make command (ie: make 
+with appropriate arguments to the make command (i.e.: make 
 nsswitch/libnss_wins.so). The resulting library should 
 then be installed in the /lib directory and 
-the "wins" parameter needs to be added to the "hosts:" line in 
+the "wins" parameter needs to be added to the "hosts:" line in 
 the /etc/nsswitch.conf file. At this point it 
-will be possible to ping any MS Windows machine by it's NetBIOS 
+will be possible to ping any MS Windows machine by its NetBIOS 
 machine name, so long as that machine is within the workgroup to 
 which both the samba machine and the MS Windows machine belong.
-

    Name resolution as used within MS Windows networking

    +

    Name resolution as used within MS Windows networking

    MS Windows networking is predicated about the name each machine is given. This name is known variously (and inconsistently) as -the "computer name", "machine name", "networking name", "netbios name", -"SMB name". All terms mean the same thing with the exception of -"netbios name" which can apply also to the name of the workgroup or the -domain name. The terms "workgroup" and "domain" are really just a -simply name with which the machine is associated. All NetBIOS names +the "computer name", "machine name", "networking name", "netbios name", +or "SMB name". All terms mean the same thing with the exception of +"netbios name" which can apply also to the name of the workgroup or the +domain name. The terms "workgroup" and "domain" are really just a +simple name with which the machine is associated. All NetBIOS names are exactly 16 characters in length. The 16th character is reserved. It is used to store a one byte value that indicates service level information for the NetBIOS name that is registered. A NetBIOS machine @@ -14621,25 +13844,14 @@ name is therefore registered for each service type that is provided by the client/server.

    The following are typical NetBIOS name/service type registrations: -

    -	Unique NetBIOS Names:
-		MACHINENAME<00>	= Server Service is running on MACHINENAME
-		MACHINENAME<03> = Generic Machine Name (NetBIOS name)
-		MACHINENAME<20> = LanMan Server service is running on MACHINENAME
-		WORKGROUP<1b> = Domain Master Browser
-
-	Group Names:
-		WORKGROUP<03> = Generic Name registered by all members of WORKGROUP
-		WORKGROUP<1c> = Domain Controllers / Netlogon Servers
-		WORKGROUP<1d> = Local Master Browsers
-		WORKGROUP<1e> = Internet Name Resolvers
-

    +

    Table 26.1. Unique NetBIOS names

    MACHINENAME<00>Server Service is running on MACHINENAME
    MACHINENAME<03>Generic Machine Name (NetBIOS name)
    MACHINENAME<20>LanMan Server service is running on MACHINENAME
    WORKGROUP<1b>Domain Master Browser

    Table 26.2. Group Names

    WORKGROUP<03>Generic Name registered by all members of WORKGROUP
    WORKGROUP<1c>Domain Controllers / Netlogon Servers
    WORKGROUP<1d>Local Master Browsers
    WORKGROUP<1e>Internet Name Resolvers

    + It should be noted that all NetBIOS machines register their own names as per the above. This is in vast contrast to TCP/IP installations where traditionally the system administrator will determine in the /etc/hosts or in the DNS database what names are associated with each IP address. -

    +

    One further point of clarification should be noted, the /etc/hosts file and the DNS records do not provide the NetBIOS name type information that MS Windows clients depend on to locate the type of service that may @@ -14648,12 +13860,12 @@ wants to locate a domain logon server. It finds this service and the IP address of a server that provides it by performing a lookup (via a NetBIOS broadcast) for enumeration of all machines that have registered the name type *<1c>. A logon request is then sent to each -IP address that is returned in the enumerated list of IP addresses. Which -ever machine first replies then ends up providing the logon services. +IP address that is returned in the enumerated list of IP addresses. +Whichever machine first replies then ends up providing the logon services.

    -The name "workgroup" or "domain" really can be confusing since these +The name "workgroup" or "domain" really can be confusing since these have the added significance of indicating what is the security -architecture of the MS Windows network. The term "workgroup" indicates +architecture of the MS Windows network. The term "workgroup" indicates that the primary nature of the network environment is that of a peer-to-peer design. In a WORKGROUP all machines are responsible for their own security, and generally such security is limited to use of @@ -14677,7 +13889,7 @@ NBT or NetBT, the NetBIOS over TCP/IP. MS Windows machines use a complex array of name resolution mechanisms. Since we are primarily concerned with TCP/IP this demonstration is limited to this area. -

    The NetBIOS Name Cache

    +

    The NetBIOS Name Cache

    All MS Windows machines employ an in memory buffer in which is stored the NetBIOS names and IP addresses for all external machines that that machine has communicated with over the @@ -14691,11 +13903,11 @@ an attempt to exchange a message with that machine will be subject to time-out delays. i.e.: Its name is in the cache, so a name resolution lookup will succeed, but the machine can not respond. This can be frustrating for users - but it is a characteristic of the protocol. -

    +

    The MS Windows utility that allows examination of the NetBIOS -name cache is called "nbtstat". The Samba equivalent of this +name cache is called "nbtstat". The Samba equivalent of this is called nmblookup. -

    The LMHOSTS file

    +

    The LMHOSTS file

    This file is usually located in MS Windows NT 4.0 or 2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address and the machine name in matched pairs. The @@ -14703,102 +13915,103 @@ the IP Address and the machine name in matched pairs. The to IP address mapping.

    It typically looks like: -

    -	# Copyright (c) 1998 Microsoft Corp.
-	#
-	# This is a sample LMHOSTS file used by the Microsoft Wins Client (NetBIOS
-	# over TCP/IP) stack for Windows98
-	#
-	# This file contains the mappings of IP addresses to NT computernames
-	# (NetBIOS) names.  Each entry should be kept on an individual line.
-	# The IP address should be placed in the first column followed by the
-	# corresponding computername. The address and the computername
-	# should be separated by at least one space or tab. The "#" character
-	# is generally used to denote the start of a comment (see the exceptions
-	# below).
-	#
-	# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
-	# files and offers the following extensions:
-	#
-	#      #PRE
-	#      #DOM:<domain>
-	#      #INCLUDE <filename>
-	#      #BEGIN_ALTERNATE
-	#      #END_ALTERNATE
-	#      \0xnn (non-printing character support)
-	#
-	# Following any entry in the file with the characters "#PRE" will cause
-	# the entry to be preloaded into the name cache. By default, entries are
-	# not preloaded, but are parsed only after dynamic name resolution fails.
-	#
-	# Following an entry with the "#DOM:<domain>" tag will associate the
-	# entry with the domain specified by <domain>. This affects how the
-	# browser and logon services behave in TCP/IP environments. To preload
-	# the host name associated with #DOM entry, it is necessary to also add a
-	# #PRE to the line. The <domain> is always preloaded although it will not
-	# be shown when the name cache is viewed.
-	#
-	# Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT)
-	# software to seek the specified <filename> and parse it as if it were
-	# local. <filename> is generally a UNC-based name, allowing a
-	# centralized lmhosts file to be maintained on a server.
-	# It is ALWAYS necessary to provide a mapping for the IP address of the
-	# server prior to the #INCLUDE. This mapping must use the #PRE directive.
-	# In addition the share "public" in the example below must be in the
-	# LanManServer list of "NullSessionShares" in order for client machines to
-	# be able to read the lmhosts file successfully. This key is under
-	# \machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares
-	# in the registry. Simply add "public" to the list found there.
-	#
-	# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
-	# statements to be grouped together. Any single successful include
-	# will cause the group to succeed.
-	#
-	# Finally, non-printing characters can be embedded in mappings by
-	# first surrounding the NetBIOS name in quotations, then using the
-	# \0xnn notation to specify a hex value for a non-printing character.
-	#
-	# The following example illustrates all of these extensions:
-	#
-	# 102.54.94.97     rhino         #PRE #DOM:networking  #net group's DC
-	# 102.54.94.102    "appname  \0x14"                    #special app server
-	# 102.54.94.123    popular            #PRE             #source server
-	# 102.54.94.117    localsrv           #PRE             #needed for the include
-	#
-	# #BEGIN_ALTERNATE
-	# #INCLUDE \\localsrv\public\lmhosts
-	# #INCLUDE \\rhino\public\lmhosts
-	# #END_ALTERNATE
-	#
-	# In the above example, the "appname" server contains a special
-	# character in its name, the "popular" and "localsrv" server names are
-	# preloaded, and the "rhino" server name is specified so it can be used
-	# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
-	# system is unavailable.
-	#
-	# Note that the whole file is parsed including comments on each lookup,
-	# so keeping the number of comments to a minimum will improve performance.
-	# Therefore it is not advisable to simply add lmhosts file entries onto the
-	# end of this file.
-

    HOSTS file

    +

    +# Copyright (c) 1998 Microsoft Corp.
+#
+# This is a sample LMHOSTS file used by the Microsoft Wins Client (NetBIOS
+# over TCP/IP) stack for Windows98
+#
+# This file contains the mappings of IP addresses to NT computernames
+# (NetBIOS) names.  Each entry should be kept on an individual line.
+# The IP address should be placed in the first column followed by the
+# corresponding computername. The address and the computername
+# should be separated by at least one space or tab. The "#" character
+# is generally used to denote the start of a comment (see the exceptions
+# below).
+#
+# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
+# files and offers the following extensions:
+#
+#      #PRE
+#      #DOM:<domain>
+#      #INCLUDE <filename>
+#      #BEGIN_ALTERNATE
+#      #END_ALTERNATE
+#      \0xnn (non-printing character support)
+#
+# Following any entry in the file with the characters "#PRE" will cause
+# the entry to be preloaded into the name cache. By default, entries are
+# not preloaded, but are parsed only after dynamic name resolution fails.
+#
+# Following an entry with the "#DOM:<domain>" tag will associate the
+# entry with the domain specified by <domain>. This affects how the
+# browser and logon services behave in TCP/IP environments. To preload
+# the host name associated with #DOM entry, it is necessary to also add a
+# #PRE to the line. The <domain> is always preloaded although it will not
+# be shown when the name cache is viewed.
+#
+# Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT)
+# software to seek the specified <filename> and parse it as if it were
+# local. <filename> is generally a UNC-based name, allowing a
+# centralized lmhosts file to be maintained on a server.
+# It is ALWAYS necessary to provide a mapping for the IP address of the
+# server prior to the #INCLUDE. This mapping must use the #PRE directive.
+# In addition the share "public" in the example below must be in the
+# LanManServer list of "NullSessionShares" in order for client machines to
+# be able to read the lmhosts file successfully. This key is under
+# \machine\system\currentcontrolset\services\lanmanserver\
+# parameters\nullsessionshares
+# in the registry. Simply add "public" to the list found there.
+#
+# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
+# statements to be grouped together. Any single successful include
+# will cause the group to succeed.
+#
+# Finally, non-printing characters can be embedded in mappings by
+# first surrounding the NetBIOS name in quotations, then using the
+# \0xnn notation to specify a hex value for a non-printing character.
+#
+# The following example illustrates all of these extensions:
+#
+# 102.54.94.97     rhino         #PRE #DOM:networking  #net group's DC
+# 102.54.94.102    "appname  \0x14"                    #special app server
+# 102.54.94.123    popular            #PRE             #source server
+# 102.54.94.117    localsrv           #PRE             #needed for the include
+#
+# #BEGIN_ALTERNATE
+# #INCLUDE \\localsrv\public\lmhosts
+# #INCLUDE \\rhino\public\lmhosts
+# #END_ALTERNATE
+#
+# In the above example, the "appname" server contains a special
+# character in its name, the "popular" and "localsrv" server names are
+# preloaded, and the "rhino" server name is specified so it can be used
+# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
+# system is unavailable.
+#
+# Note that the whole file is parsed including comments on each lookup,
+# so keeping the number of comments to a minimum will improve performance.
+# Therefore it is not advisable to simply add lmhosts file entries onto the
+# end of this file.
+

    HOSTS file

    This file is usually located in MS Windows NT 4.0 or 2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address and the IP hostname in matched pairs. It can be used by the name resolution infrastructure in MS Windows, depending on how the TCP/IP environment is configured. This file is in -every way the equivalent of the Unix/Linux /etc/hosts file. -

    DNS Lookup

    +every way the equivalent of the UNIX/Linux /etc/hosts file. +

    DNS Lookup

    This capability is configured in the TCP/IP setup area in the network -configuration facility. If enabled an elaborate name resolution sequence -is followed the precise nature of which is dependant on what the NetBIOS -Node Type parameter is configured to. A Node Type of 0 means use -NetBIOS broadcast (over UDP broadcast) is first used if the name +configuration facility. If enabled, an elaborate name resolution sequence +is followed the precise nature of which is dependant on how the NetBIOS +Node Type parameter is configured. A Node Type of 0 means that +NetBIOS broadcast (over UDP broadcast) is used if the name that is the subject of a name lookup is not found in the NetBIOS name cache. If that fails then DNS, HOSTS and LMHOSTS are checked. If set to Node Type 8, then a NetBIOS Unicast (over UDP Unicast) is sent to the WINS Server to obtain a lookup before DNS, HOSTS, LMHOSTS, or broadcast lookup is used. -

    WINS Lookup

    +

    WINS Lookup

    A WINS (Windows Internet Name Server) service is the equivalent of the rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores the names and IP addresses that are registered by a Windows client @@ -14806,24 +14019,20 @@ if the TCP/IP setup has been given at least one WINS Server IP Address.

    To configure Samba to be a WINS server the following parameter needs to be added to the smb.conf file: -

    -	wins support = Yes
-

    +

    wins support = Yes

    To configure Samba to use a WINS server the following parameters are needed in the smb.conf file: -

    -	wins support = No
-	wins server = xxx.xxx.xxx.xxx
-

    +

    wins support = No
    wins server = xxx.xxx.xxx.xxx

    where xxx.xxx.xxx.xxx is the IP address of the WINS server. -

    Common Errors

    +

    For information about setting up Samba as a WINS server, read + the chapter on network browsing.

    Common Errors

    TCP/IP network configuration problems find every network administrator sooner or later. The cause can be anything from keyboard mishaps, forgetfulness, simple mistakes, and carelessness. Of course, no one is every deliberately careless! -

    My Boomerang Won't Come Back

    - Well, the real complaint said, "I can ping my samba server from Windows, but I can - not ping my Windows machine from the samba server." +

    Pinging works only in one way

    + “I can ping my samba server from Windows, but I can + not ping my Windows machine from the samba server.”

    The Windows machine was at IP Address 192.168.1.2 with netmask 255.255.255.0, the Samba server (Linux) was at IP Address 192.168.1.130 with netmask 255.255.255.128. @@ -14831,49 +14040,49 @@ carelessness. Of course, no one is every deliberately careless!

    Due to inconsistent netmasks, the Windows machine was on network 192.168.1.0/24, while the Samba server was on network 192.168.1.128/25 - logically a different network. -

    Very Slow Network Connections

    +

    Very Slow Network Connections

    A common causes of slow network response includes: -

    • Client is configured to use DNS and DNS server is down

    • Client is configured to use remote DNS server, but remote connection is down

    • Client is configured to use a WINS server, but there is no WINS server

    • Client is NOT configured to use a WINS server, but there is a WINS server

    • Firewall is filtering our DNS or WINS traffic

    Samba server name change problem

    - The name of the samba server was changed, samba was restarted, samba server can not be +

    • Client is configured to use DNS and DNS server is down

    • Client is configured to use remote DNS server, but remote connection is down

    • Client is configured to use a WINS server, but there is no WINS server

    • Client is NOT configured to use a WINS server, but there is a WINS server

    • Firewall is filtering our DNS or WINS traffic

    Samba server name change problem

    + “The name of the samba server was changed, samba was restarted, samba server can not be pinged by new name from MS Windows NT4 Workstation, but it does still respond to ping using - the old name. Why? + the old name. Why?”

    From this description three (3) things are rather obvious:

    • WINS is NOT in use, only broadcast based name resolution is used

    • The samba server was renamed and restarted within the last 10-15 minutes

    • The old samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation

    To find what names are present in the NetBIOS name cache on the MS Windows NT4 machine, open a cmd shell, then:

    - 

    -	C:\temp\>nbtstat -n
+
    +C:\> nbtstat -n
 
-	              NetBIOS Local Name Table
+              NetBIOS Local Name Table
 
-	   Name                 Type          Status
-	------------------------------------------------
-	SLACK            <03>  UNIQUE      Registered
-	ADMINISTRATOR    <03>  UNIQUE      Registered
-	SLACK            <00>  UNIQUE      Registered
-	SARDON           <00>  GROUP       Registered
-	SLACK            <20>  UNIQUE      Registered
-	SLACK            <1F>  UNIQUE      Registered
+   Name                 Type          Status
+------------------------------------------------
+FRODO            <03>  UNIQUE      Registered
+ADMINSTRATOR     <03>  UNIQUE      Registered
+FRODO            <00>  UNIQUE      Registered
+SARDON           <00>  GROUP       Registered
+FRODO            <20>  UNIQUE      Registered
+FRODO            <1F>  UNIQUE      Registered
 
 
-	C:\Temp\>nbtstat -c
+C:\> nbtstat -c
 
-	             NetBIOS Remote Cache Name Table
+             NetBIOS Remote Cache Name Table
 
-	   Name                 Type       Host Address     Life [sec]
-	--------------------------------------------------------------
-	FRODO            <20>  UNIQUE      192.168.1.1          240
+   Name                 Type       Host Address     Life [sec]
+--------------------------------------------------------------
+GANDALF	<20>  UNIQUE      192.168.1.1          240
 
-	C:\Temp\>
-	
    
+C:\> 
+

    - In the above example, FRODO is the Samba server and SLACK is the MS Windows NT4 Workstation. - The first listing shows the contents of the Local Name Table (ie: Identity information on + In the above example, GANDALF is the Samba server and FRODO is the MS Windows NT4 Workstation. + The first listing shows the contents of the Local Name Table (i.e.: Identity information on the MS Windows workstation), the second shows the NetBIOS name in the NetBIOS name cache. The name cache contains the remote machines known to this workstation. -

    Chapter 27. Unicode/Charsets

    Jelmer R. Vernooij

    The Samba Team

    TAKAHASHI Motonobu

    25 March 2003

    Table of Contents

    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets

    Features and Benefits

    +

    Chapter 27. Unicode/Charsets

    Jelmer R. Vernooij

    The Samba Team

    TAKAHASHI Motonobu

    25 March 2003

    Table of Contents

    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    Common errors
    CP850.so can't be found

    Features and Benefits

    Every industry eventually matures. One of the great areas of maturation is in the focus that has been given over the past decade to make it possible for anyone anywhere to use a computer. It has not always been that way, in fact, not so long @@ -14881,14 +14090,13 @@ ago it was common for software to be written for exclusive use in the country of origin.

    Of all the effort that has been brought to bear on providing native language support -for all computer users, the efforts of the Openi18n organisation is deserving of -special mention. For more information about Openi18n please refer to: -http://www.openi18n.org/. +for all computer users, the efforts of the Openi18n organisation is deserving of +special mention.

    Samba-2.x supported a single locale through a mechanism called codepages. Samba-3 is destined to become a truly trans-global file and printer sharing platform. -

    What are charsets and unicode?

    +

    What are charsets and unicode?

    Computers communicate in numbers. In texts, each number will be translated to a corresponding letter. The meaning that will be assigned to a certain number depends on the character set(charset) @@ -14905,84 +14113,233 @@ is more then all possible characters one could think of. They are called multibyte charsets (because they use more then one byte to store one character).

    -A standardised multibyte charset is unicode, info is available at -www.unicode.org. -A big advantage of using a multibyte charset is that you only need one; no -need to make sure two computers use the same charset when they are + A standardised multibyte charset is unicode. +A big advantage of using a multibyte charset is that you only need one; there +is no need to make sure two computers use the same charset when they are communicating. -

    Old windows clients used to use single-byte charsets, named +

    Old windows clients use single-byte charsets, named 'codepages' by Microsoft. However, there is no support for negotiating the charset to be used in the smb protocol. Thus, you -have to make sure you are using the same charset when talking to an old client. +have to make sure you are using the same charset when talking to an older client. Newer clients (Windows NT, 2K, XP) talk unicode over the wire. -

    Samba and charsets

    +

    Samba and charsets

    As of samba 3.0, samba can (and will) talk unicode over the wire. Internally, samba knows of three kinds of character sets: -

    unix charset

    +

    unix charset

    This is the charset used internally by your operating system. - The default is ASCII, which is fine for most - systems. -

    display charset

    This is the charset samba will use to print messages + The default is UTF-8, which is fine for most + systems. The default in previous samba releases was ASCII. +

    display charset

    This is the charset samba will use to print messages on your screen. It should generally be the same as the unix charset. -

    dos charset

    This is the charset samba uses when communicating with +

    dos charset

    This is the charset samba uses when communicating with DOS and Windows 9x clients. It will talk unicode to all newer clients. The default depends on the charsets you have installed on your system. - Run testparm -v | grep "dos charset" to see + Run testparm -v | grep "dos charset" to see what the default is on your system. -

    Conversion from old names

    Because previous samba versions did not do any charset conversion, +

    Conversion from old names

    Because previous samba versions did not do any charset conversion, characters in filenames are usually not correct in the unix charset but only -for the local charset used by the DOS/Windows clients.

    The following script from Steve Langasek converts all -filenames from CP850 to the iso8859-15 charset.

    -#find /path/to/share -type f -exec bash -c 'CP="{}"; ISO=`echo -n "$CP" | iconv -f cp850 \ - -t iso8859-15`; if [ "$CP" != "$ISO" ]; then mv "$CP" "$ISO"; fi' \; - -

    Japanese charsets

    Samba doesn't work correctly with Japanese charsets yet. Here are -points of attention when setting it up:

    • You should set mangling method = -hash

    • There are various iconv() implementations around and not +for the local charset used by the DOS/Windows clients.

      Bjoern Jacke has written a utility named convm that can convert whole directory + structures to different charsets with one single command. +

    Japanese charsets

    Samba doesn't work correctly with Japanese charsets yet. Here are +points of attention when setting it up:

    • You should set mangling method = hash

    • There are various iconv() implementations around and not all of them work equally well. glibc2's iconv() has a critical problem in CP932. libiconv-1.8 works with CP932 but still has some problems and -does not work with EUC-JP.

    • You should set dos charset = CP932, not -Shift_JIS, SJIS...

    • Currently only unix charset = CP932 +does not work with EUC-JP.

    • You should set dos charset = CP932, not +Shift_JIS, SJIS...

    • Currently only unix charset = CP932 will work (but still has some problems...) because of iconv() issues. -unix charset = EUC-JP doesn't work well because of -iconv() issues.

    • Currently Samba 3.0 does not support unix charset -= UTF8-MAC/CAP/HEX/JIS*

    More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

    Chapter 28. Samba Backup Techniques

    John H. Terpstra

    Samba Team

    Table of Contents

    Note
    Features and Benefits

    Note

    +unix charset = EUC-JP doesn't work well because of +iconv() issues.

  • Currently Samba 3.0 does not support unix charset = UTF8-MAC/CAP/HEX/JIS*

    • More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

    Common errors

    CP850.so can't be found

    “Samba is complaining about a missing CP850.so file”.

    CP850 is the default dos charset. The dos charset is used to convert data to the codepage used by your dos clients. If you don't have any dos clients, you can safely ignore this message.

    CP850 should be supported by your local iconv implementation. Make sure you have all the required packages installed. If you compiled samba from source, make sure configure found iconv.

    Chapter 28. Samba Backup Techniques

    John H. Terpstra

    Samba Team

    Table of Contents

    Note
    Features and Benefits

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -If you have something to contribute for this section please email it to -jht@samba.org/ -

    Features and Benefits

    +

    Features and Benefits

    We need feedback from people who are backing up samba servers. We would like to know what software tools you are using to backup your samba server/s.

    In particular, if you have any success and / or failure stories you could share with other users this would be appreciated. -

    Chapter 29. High Availability Options

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +

    Chapter 29. High Availability Options

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Migration and Updating

    Table of Contents

    30. Upgrading from Samba-2.x to Samba-3.0.0
    Charsets
    Obsolete configuration options
    Password Backend
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0

    Jelmer R. Vernooij

    The Samba Team

    25 October 2002

    Table of Contents

    Charsets
    Obsolete configuration options
    Password Backend

    Charsets

    You might experience problems with special characters -when communicating with old DOS clients. Codepage -support has changed in samba 3.0. Read the chapter -Unicode support for details. -

    Obsolete configuration options

    -In 3.0, the following configuration options have been removed. -

    printer driver (replaced by new driver procedures)
    printer driver file (replaced by new driver procedures)
    printer driver location (replaced by new driver procedures)
    use rhosts
    postscript
    client code page (replaced by dos charset)
    vfs path
    vfs options

    Password Backend

    -Effective with the release of samba-3 it is now imperative that the password backend -be correctly defined in smb.conf. -

    -Those migrating from samba-2.x with plaintext password support need the following: -passdb backend = guest. -

    -Those migrating from samba-2.x with encrypted password support should add to smb.conf -passdb backend = smbpasswd, guest. -

    -LDAP using Samba-2.x systems can continue to operate with the following entry -passdb backend = ldapsam_compat, guest. -

    Chapter 31. Migration from NT4 PDC to Samba-3 PDC

    John H. Terpstra

    Samba Team

    April 3, 2003

    Table of Contents

    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices

    +

    Migration and Updating

    Table of Contents

    30. Upgrading from Samba-2.x to Samba-3.0.0
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (changes in behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    Charsets
    LDAP
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    June 30, 2003

    Table of Contents

    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (changes in behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    Charsets
    LDAP

    New Features in Samba-3

    +Major new features: +

    1. + Active Directory support. This release is able to join a ADS realm + as a member server and authenticate users using LDAP/kerberos. +

    2. + Unicode support. Samba will now negotiate UNICODE on the wire and + internally there is now a much better infrastructure for multi-byte + and UNICODE character sets. +

    3. + New authentication system. The internal authentication system has + been almost completely rewritten. Most of the changes are internal, + but the new auth system is also very configurable. +

    4. + New filename mangling system. The filename mangling system has been + completely rewritten. An internal database now stores mangling maps + persistently. This needs lots of testing. +

    5. + New "net" command. A new "net" command has been added. It is + somewhat similar to the "net" command in windows. Eventually we + plan to replace a bunch of other utilities (such as smbpasswd) + with subcommands in "net", at the moment only a few things are + implemented. +

    6. + Samba now negotiates NT-style status32 codes on the wire. This + improves error handling a lot. +

    7. + Better Windows 2000/XP/2003 printing support including publishing + printer attributes in active directory +

    8. + New loadable RPC modules +

    9. + New dual-daemon winbindd support (-B) for better performance +

    10. + Support for migrating from a Windows NT 4.0 domain to a Samba + domain and maintaining user, group and domain SIDs +

    11. + Support for establishing trust relationships with Windows NT 4.0 + domain controllers +

    12. + Initial support for a distributed Winbind architecture using + an LDAP directory for storing SID to uid/gid mappings +

    13. + Major updates to the Samba documentation tree. +

    +Plus lots of other improvements! +

    Configuration Parameter Changes

    +This section contains a brief listing of changes to smb.conf options +in the 3.0.0 release. Please refer to the smb.conf(5) man page for +complete descriptions of new or modified parameters. +

    Removed Parameters

    (order alphabetically):

    • admin log

    • alternate permissions

    • character set

    • client codepage

    • code page directory

    • coding system

    • domain admin group

    • domain guest group

    • force unknown acl user

    • nt smb support

    • post script

    • printer driver

    • printer driver file

    • printer driver location

    • status

    • total print jobs

    • use rhosts

    • valid chars

    • vfs options

    New Parameters

    (new parameters have been grouped by function):

    Remote management

    • abort shutdown script

    • shutdown script

    User and Group Account Management

    • add group script

    • add machine script

    • add user to group script

    • algorithmic rid base

    • delete group script

    • delete user from group script

    • passdb backend

    • set primary group script

    Authentication

    • auth methods

    • ads server

    • realm

    Protocol Options

    • client lanman auth

    • client NTLMv2 auth

    • client schannel

    • client signing

    • client use spnego

    • disable netbios

    • ntlm auth

    • paranoid server security

    • server schannel

    • smb ports

    • use spnego

    File Service

    • get quota command

    • hide special files

    • hide unwriteable files

    • hostname lookups

    • kernel change notify

    • mangle prefix

    • msdfs proxy

    • set quota command

    • use sendfile

    • vfs objects

    Printing

    • max reported print jobs

    UNICODE and Character Sets

    • display charset

    • dos charset

    • unicode

    • unix charset

    SID to uid/gid Mappings

    • idmap backend

    • idmap gid

    • idmap only

    • idmap uid

    LDAP

    • ldap delete dn

    • ldap group suffix

    • ldap idmap suffix

    • ldap machine suffix

    • ldap passwd sync

    • ldap trust ids

    • ldap user suffix

    General Configuration

    • preload modules

    • privatedir

    Modified Parameters (changes in behavior):

    • encrypt passwords (enabled by default)

    • mangling method (set to 'hash2' by default)

    • passwd chat

    • passwd program

    • restrict anonymous (integer value)

    • security (new 'ads' value)

    • strict locking (enabled by default)

    • winbind cache time (increased to 5 minutes)

    • winbind uid (deprecated in favor of 'idmap uid')

    • winbind gid (deprecated in favor of 'idmap gid')

    New Functionality

    Databases

    + This section contains brief descriptions of any new databases + introduced in Samba 3.0. Please remember to backup your existing + ${lock directory}/*tdb before upgrading to Samba 3.0. Samba will + upgrade databases as they are opened (if necessary), but downgrading + from 3.0 to 2.2 is an unsupported path. +

    Table 30.1. TDB File Descriptions

    NameDescriptionBackup?
    account_policyUser policy settingsyes
    gencacheGeneric caching dbno
    group_mapping

    Mapping table from Windows groups/SID to unix groups

    		yes
    idmap

    new ID map table from SIDS to UNIX uids/gids

    		yes
    namecacheName resolution cache entriesno
    netlogon_unigrp

    Cache of universal group membership obtained when operating + as a member of a Windows domain

    		no
    printing/*.tdb

    Cached output from 'lpq command' created on a per print + service basis

    		no
    registry

    Read-only samba registry skeleton that provides support for + exporting various db tables via the winreg RPCs

    		no

    Changes in Behavior

    + The following issues are known changes in behavior between Samba 2.2 and + Samba 3.0 that may affect certain installations of Samba. +

    1. + When operating as a member of a Windows domain, Samba 2.2 would + map any users authenticated by the remote DC to the 'guest account' + if a uid could not be obtained via the getpwnam() call. Samba 3.0 + rejects the connection as NT_STATUS_LOGON_FAILURE. There is no + current work around to re-establish the 2.2 behavior. +

    2. + When adding machines to a Samba 2.2 controlled domain, the + 'add user script' was used to create the UNIX identity of the + machine trust account. Samba 3.0 introduces a new 'add machine + script' that must be specified for this purpose. Samba 3.0 will + not fall back to using the 'add user script' in the absence of + an 'add machine script' +

    Charsets

    + You might experience problems with special characters when communicating with old DOS + clients. Codepage support has changed in samba 3.0. Read the chapter + Unicode support for details. +

    Passdb Backends and Authentication

    + There have been a few new changes that Samba administrators should be + aware of when moving to Samba 3.0. +

    1. + Encrypted passwords have been enabled by default in order to + inter-operate better with out-of-the-box Windows client + installations. This does mean that either (a) a samba account + must be created for each user, or (b) 'encrypt passwords = no' + must be explicitly defined in smb.conf. +

    2. + Inclusion of new security = ads option for integration + with an Active Directory domain using the native Windows + Kerberos 5 and LDAP protocols. +

    + Samba 3.0 also includes the possibility of setting up chains + of authentication methods + (auth methods) and account + storage backends + (passdb backend). + Please refer to the smb.conf + man page and the chapter about account information databases for details. While both parameters assume sane default + values, it is likely that you will need to understand what the + values actually mean in order to ensure Samba operates correctly. +

    + Certain functions of the smbpasswd(8) tool have been split between the + new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8) + utility. See the respective man pages for details. +

    Charsets

    + You might experience problems with special characters when communicating with old DOS + clients. Codepage support has changed in samba 3.0. Read the chapter + Unicode support for details. +

    LDAP

    + This section outlines the new features affecting Samba / LDAP integration. +

    New Schema

    + A new object class (sambaSamAccount) has been introduced to replace + the old sambaAccount. This change aids us in the renaming of attributes + to prevent clashes with attributes from other vendors. There is a + conversion script (examples/LDAP/convertSambaAccount) to modify and LDIF + file to the new schema. +

    + Example: + 

    +		$ ldapsearch .... -b "ou=people,dc=..." > old.ldif
+		$ convertSambaAccount <DOM SID> old.ldif new.ldif
+

    + The <DOM SID> can be obtained by running 'net getlocalsid <DOMAINNAME> + on the Samba PDC as root. +

    + The old sambaAccount schema may still be used by specifying the + "ldapsam_compat" passdb backend. However, the sambaAccount and + associated attributes have been moved to the historical section of + the schema file and must be uncommented before use if needed. + The 2.2 object class declaration for a sambaAccount has not changed + in the 3.0 samba.schema file. +

    + Other new object classes and their uses include: +

    • + sambaDomain - domain information used to allocate rids + for users and groups as necessary. The attributes are added + in 'ldap suffix' directory entry automatically if + an idmap uid/gid range has been set and the 'ldapsam' + passdb backend has been selected. +

    • + sambaGroupMapping - an object representing the + relationship between a posixGroup and a Windows + group/SID. These entries are stored in the 'ldap + group suffix' and managed by the 'net groupmap' command. +

    • + sambaUnixIdPool - created in the 'ldap idmap suffix' entry + automatically and contains the next available 'idmap uid' and + 'idmap gid' +

    • + sambaIdmapEntry - object storing a mapping between a + SID and a UNIX uid/gid. These objects are created by the + idmap_ldap module as needed. +

    New Suffix for Searching

    + The following new smb.conf parameters have been added to aid in directing + certain LDAP queries when 'passdb backend = ldapsam://...' has been + specified. +

    • ldap suffix - used to search for user and computer accounts

    • ldap user suffix - used to store user accounts

    • ldap machine suffix - used to store machine trust accounts

    • ldap group suffix - location of posixGroup/sambaGroupMapping entries

    • ldap idmap suffix - location of sambaIdmapEntry objects

    + If an 'ldap suffix' is defined, it will be appended to all of the + remaining sub-suffix parameters. In this case, the order of the suffix + listings in smb.conf is important. Always place the 'ldap suffix' first + in the list. +

    + Due to a limitation in Samba's smb.conf parsing, you should not surround + the DN's with quotation marks. +

    IdMap LDAP support

    + Samba 3.0 supports an ldap backend for the idmap subsystem. The + following options would inform Samba that the idmap table should be + stored on the directory server onterose in the "ou=idmap,dc=plainjoe, + dc=org" partition. +

    [global]
    ...
    idmap backend = ldap:ldap://onterose/
    ldap idmap suffix = ou=idmap,dc=plainjoe,dc=org
    idmap uid = 40000-50000
    idmap gid = 40000-50000

    + This configuration allows winbind installations on multiple servers to + share a uid/gid number space, thus avoiding the interoperability problems + with NFS that were present in Samba 2.2. +

    Chapter 31. Migration from NT4 PDC to Samba-3 PDC

    John H. Terpstra

    Samba Team

    April 3, 2003

    Table of Contents

    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices

    This is a rough guide to assist those wishing to migrate from NT4 domain control to Samba-3 based domain control. -

    Planning and Getting Started

    +

    Planning and Getting Started

    In the IT world there is often a saying that all problems are encountered because of poor planning. The corollary to this saying is that not all problems can be anticipated and planned for. Then again, good planning will anticipate most show stopper type situations. @@ -14990,120 +14347,133 @@ and planned for. Then again, good planning will anticipate most show stopper typ Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control environment would do well to develop a detailed migration plan. So here are a few pointers to help migration get under way. -

    Objectives

    +

    Objectives

    The key objective for most organisations will be to make the migration from MS Windows NT4 to Samba-3 domain control as painless as possible. One of the challenges you may experience in your migration process may well be one of convincing management that the new environment should remain in place. Many who have introduced open source technologies have experienced pressure to return to a Microsoft based platform solution at the first sign of trouble.

    -It is strongly advised that before attempting a migration to a Samba-3 controlled network -that every possible effort be made to gain all-round commitment to the change. Firstly, you -should know precisely why the change is important for the organisation. -Possible motivations to make a change include: -

    Improve network manageability
    Obtain better user level functionality
    Reduce network operating costs
    Reduce exposure caused by Microsoft withdrawal of NT4 support
    Avoid MS License 6 implications
    Reduce organisation's dependency on Microsoft

    -It is vital that it be well recognised that Samba-3 is NOT MS Windows NT4. Samba-3 offers -an alternative solution that is both different from MS Windows NT4 and that offers some -advantages compared with it. It should also be recognised that Samba-3 lacks many of the +Before attempting a migration to a Samba-3 controlled network make every possible effort to +gain all-round commitment to the change. Know precisely why the change +is important for the organisation. Possible motivations to make a change include: +

    • Improve network manageability

    • Obtain better user level functionality

    • Reduce network operating costs

    • Reduce exposure caused by Microsoft withdrawal of NT4 support

    • Avoid MS License 6 implications

    • Reduce organisation's dependency on Microsoft

    +Make sure that everyone knows that Samba-3 is NOT MS Windows NT4. Samba-3 offers +an alternative solution that is both different from MS Windows NT4 and that offers +advantages compared with it. Gain recognition that Samba-3 lacks many of the features that Microsoft has promoted as core values in migration from MS Windows NT4 to MS Windows 2000 and beyond (with or without Active Directory services).

    What are the features that Samba-3 can NOT provide? -

    Active Directory Server
    Group Policy Objects (in Active Directory)
    Machine Policy objects
    Logon Scripts in Active Directory
    Software Application and Access Controls in Active Directory

    +

    • Active Directory Server

    • Group Policy Objects (in Active Directory)

    • Machine Policy objects

    • Logon Scripts in Active Directory

    • Software Application and Access Controls in Active Directory

    The features that Samba-3 DOES provide and that may be of compelling interest to your site includes: -

    Lower Cost of Ownership
    Global availability of support with no strings attached
    Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system)
    Creation of on-the-fly logon scripts
    Creation of on-the-fly Policy Files
    Greater Stability, Reliability, Performance and Availability
    Manageability via an ssh connection
    Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam)
    Ability to implement a full single-sign-on architecture
    Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand

    -Before migrating a network from MS Windows NT4 to Samba-3 it is vital that all necessary factors are -considered. Users should be educated about changes they may experience so that the change will be a -welcome one and not become an obstacle to the work they need to do. The following are some of the -factors that will go into a successful migration: -

    Domain Layout

    +

    • Lower Cost of Ownership

    • Global availability of support with no strings attached

    • Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system)

    • Creation of on-the-fly logon scripts

    • Creation of on-the-fly Policy Files

    • Greater Stability, Reliability, Performance and Availability

    • Manageability via an ssh connection

    • Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam)

    • Ability to implement a full single-sign-on architecture

    • Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand

    +Before migrating a network from MS Windows NT4 to Samba-3 consider all necessary factors. Users +should be educated about changes they may experience so that the change will be a welcome one +and not become an obstacle to the work they need to do. The following are factors that will +help ensure a successful migration: +

    Domain Layout

    Samba-3 can be configured as a domain controller, a back-up domain controller (probably best called a secondary controller), a domain member, or as a stand-alone server. The Windows network security domain context should be sized and scoped before implementation. Particular attention needs to be paid to the location of the primary domain controller (PDC) as well as backup controllers (BDCs). -It should be noted that one way in which Samba-3 differs from Microsoft technology is that if one -chooses to use an LDAP authentication backend then the same database can be used by several different -domains. This means that in a complex organisation there can be a single LDAP database, that itself -can be distributed, that can simultaneously serve multiple domains (that can also be widely distributed). -

    -It is recommended that from a design perspective, the number of users per server, as well as the number -of servers, per domain should be scaled according to needs and should also consider server capacity -and network bandwidth. -

    -A physical network segment may house several domains, each of which may span multiple network segments. -Where domains span routed network segments it is most advisable to consider and test the performance -implications of the design and layout of a network. A Centrally located domain controller that is being -designed to serve multiple routed network segments may result in severe performance problems if the -response time (eg: ping timing) between the remote segment and the PDC is more than 100 ms. In situations -where the delay is too long it is highly recommended to locate a backup controller (BDC) to serve as -the local authentication and access control server. -

    Server Share and Directory Layout

    -There are few cardinal rules to effective network design that can be broken with impunity. -The most important rule of effective network management is that simplicity is king in every -well controlled network. Every part of the infrastructure must be managed, the more complex -it is, the greater will be the demand of keeping systems secure and functional. -

    -The nature of the data that must be stored needs to be born in mind when deciding how many -shares must be created. The physical disk space layout should also be taken into account -when designing where share points will be created. Keep in mind that all data needs to be -backed up, thus the simpler the disk layout the easier it will be to keep track of what must -be backed up to tape or other off-line storage medium. Always plan and implement for minimum +One way in which Samba-3 differs from Microsoft technology is that if one chooses to use an LDAP +authentication backend then the same database can be used by several different domains. In a +complex organisation there can be a single LDAP database, which itself can be distributed (ie: Have +a master server and multiple slave servers) that can simultaneously serve multiple domains. +

    +From a design perspective, the number of users per server, as well as the number of servers, per +domain should be scaled taking into consideration server capacity and network bandwidth. +

    +A physical network segment may house several domains. Each may span multiple network segments. +Where domains span routed network segments, consider and test the performance implications of +the design and layout of a network. A Centrally located domain controller that is designed to +serve multiple routed network segments may result in severe performance problems. Check the +response time (eg: ping timing) between the remote segment and the PDC. If long (more than 100 ms) +locate a backup controller (BDC) on the remote segmanet to serve as the local authentication and +access control server. +

    Server Share and Directory Layout

    +There are cardinal rules to effective network design. These can not be broken with impunity. +The most important rule: Simplicity is king in every well controlled network. Every part of +the infrastructure must be managed, the more complex it is, the greater will be the demand +of keeping systems secure and functional. +

    +Keep in mind the nature of how data must be share. Physical disk space layout should be considered +carefully. Some data must be backed up. The simpler the disk layout the easier it will be to +keep track of backed needs. Identify what back media will be meet needs, consider backup to tape +, CD-ROM or (DVD-ROM), or other off-line storage medium. Plan and implement for minimum maintenance. Leave nothing to chance in your design, above all, do not leave backups to chance: Backup and test, validate every backup, create a disaster recovery plan and prove that it works.

    Users should be grouped according to data access control needs. File and directory access -is best controlled via group permissions and the use of the "sticky bit" on group controlled +is best controlled via group permissions and the use of the "sticky bit" on group controlled directories may substantially avoid file access complaints from samba share users.

    -Many network administrators who are new to the game will attempt to use elaborate techniques -to set access controls, on files, directories, shares, as well as in share definitions. -There is the ever present danger that that administrator's successor will not understand the -complex mess that has been inherited. Remember, apparent job security through complex design -and implementation may ultimately cause loss of operations and downtime to users as the new -administrator learns to untangle your web. Keep access controls simple and effective and -make sure that users will never be interrupted by the stupidity of complexity. -

    Logon Scripts

    -Please refer to the section of this document on Advanced Network Administration for information -regarding the network logon script options for Samba-3. Logon scripts can help to ensure that -all users gain share and printer connections they need. -

    -Logon scripts can be created on-the-fly so that all commands executed are specific to the -rights and privileges granted to the user. The preferred controls should be affected through +Inexperienced network administrators often attempt elaborate techniques to set access +controls on files, directories, shares, as well as in share definitions. +Keep your design and implementation simple and document your design extensively. Have others +audit your documentation. Do not create a complex mess that your successor will not understand. +Remember, job security through complex design and implementation may cause loss of operations +and downtime to users as the new administrator learns to untangle your knots. Keep access +controls simple and effective and make sure that users will never be interrupted by stupid +complexity. +

    Logon Scripts

    +Logon scripts can help to ensure that all users gain share and printer connections they need. +

    +Logon scripts can be created 'on-the-fly' so that all commands executed are specific to the +rights and priviliges granted to the user. The preferred controls should be affected through group membership so that group information can be used to custom create a logon script using -the root preexec parameters to the NETLOGON share. +the root preexec parameters to the NETLOGON share.

    Some sites prefer to use a tool such as kixstart to establish a controlled user environment. In any case you may wish to do a google search for logon script process controls. In particular, you may wish to explore the use of the Microsoft knowledgebase article KB189105 that deals with how to add printers without user intervention via the logon script process. -

    Profile Migration/Creation

    +

    Profile Migration/Creation

    User and Group Profiles may be migrated using the tools described in the section titled Desktop Profile Management.

    Profiles may also be managed using the Samba-3 tool profiles. This tool allows the MS Windows NT style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file to be changed to the SID of the Samba-3 domain. -

    User and Group Accounts

    +

    User and Group Accounts

    It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before attempting to migrate user and group accounts it is STRONGLY advised to create in Samba-3 the -groups that are present on the MS Windows NT4 domain AND to connect these to -suitable Unix/Linux groups. Following this simple advice will mean that all user and group attributes +groups that are present on the MS Windows NT4 domain AND to map these to +suitable Unix/Linux groups. By following this simple advice all user and group attributes should migrate painlessly. -

    Steps In Migration Process

    +

    Steps In Migration Process

    The approximate migration process is described below.

    • You will have an NT4 PDC that has the users, groups, policies and profiles to be migrated

    • -Samba-3 set up as a DC with netlogon share, profile share, etc. -

    Procedure 31.1. The Account Migration Process

    1. Create a BDC account for the samba server using NT Server Manager

      1. Samba must NOT be running

    2. rpcclient NT4PDC -U Administrator%passwd

      1. lsaquery

      2. Note the SID returned

    3. net getsid -S NT4PDC -w DOMNAME -U Administrator%passwd

      1. Note the SID

    4. net getlocalsid

      1. Note the SID, now check that all three SIDS reported are the same!

    5. net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd

    6. net rpc vampire -S NT4PDC -U administrator%passwd

    7. pdbedit -L

      1. Note - did the users migrate?

    8. initGrps.sh DOMNAME

    9. net groupmap list

      1. Now check that all groups are recognised

    10. net rpc vampire -S NT4PDC -U administrator%passwd

    11. pdbedit -Lv

      1. Note - check that all group membership has been migrated

    -Now it is time to migrate all the profiles, then migrate all policy files. -More later. -

    Migration Options

    -Based on feedback from many sites as well as from actual installation and maintenance -experience sites that wish to migrate from MS Windows NT4 Domain Control to a Samba -based solution fit into three basic categories. -

    Table 31.1. The 3 Major Site Types

    Number of UsersDescription
    < 50

    Want simple conversion with NO pain

    50 - 250

    Want new features, can manage some in-house complexity

    > 250

    Solution/Implementation MUST scale well, complex needs. Cross departmental decision process. Local expertise in most areas

    Planning for Success

    +Samba-3 set up as a DC with netlogon share, profile share, etc. Configure the smb.conf file +to fucntion as a BDC. ie: domain master = No. +

    Procedure 31.1. The Account Migration Process

    1. Create a BDC account for the samba server using NT Server Manager

      1. Samba must NOT be running

    2. net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd

    3. net rpc vampire -S NT4PDC -U administrator%passwd

    4. pdbedit -L

      1. Note - did the users migrate?

    5. + Now assign each of the UNIX groups to NT groups: + (Note: It may be useful to copy this text to a script called + initGroups.sh) + 

      +#!/bin/bash
+#### Keep this as a shell script for future re-use
+			
+# First assign well known domain global groups
+net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmins
+net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
+net groupmap modify ntgroup="Domain Users" unixgroup=users
+
+# Now for our added domain global groups
+net groupmap add ntgroup="Designers" unixgroup=designers type=d rid=3200
+net groupmap add ntgroup="Engineers" unixgroup=engineers type=d rid=3210
+net groupmap add ntgroup="QA Team"   unixgroup=qateam    type=d rid=3220
+

      +

    6. net groupmap list

      1. Now check that all groups are recognised

    +Now migrate all the profiles, then migrate all policy files. +

    Migration Options

    +Sites that wish to migrate from MS Windows NT4 Domain Control to a Samba based solution +generally fit into three basic categories. +

    Table 31.1. The 3 Major Site Types

    Number of UsersDescription
    < 50

    Want simple conversion with NO pain

    50 - 250

    Want new features, can manage some in-house complexity

    > 250

    Solution/Implementation MUST scale well, complex needs. Cross departmental decision process. Local expertise in most areas

    Planning for Success

    There are three basic choices for sites that intend to migrate from MS Windows NT4 to Samba-3.

    • @@ -15113,7 +14483,7 @@ to Samba-3.

    • Complete Redesign (completely new solution)

    -No matter what choice you make, the following rules will minimise down-stream problems: +Minimise down-stream problems by:

    • Take sufficient time

    • @@ -15122,65 +14492,28 @@ No matter what choice you make, the following rules will minimise down-stream pr Test ALL assumptions

    • Test full roll-out program, including workstation deployment -

    Table 31.2. Nature of the Conversion Choices

    SimpleUpgradedRedesign

    Make use of minimal OS specific features

    Translate NT4 features to new host OS features

    Decide:

    Suck all accounts from NT4 into Samba-3

    Copy and improve:

    Authentication Regime (database location and access)

    Make least number of operational changes

    Make progressive improvements

    Desktop Management Methods

    Take least amount of time to migrate

    Minimise user impact

    Better Control of Desktops / Users

    Live versus Isolated Conversion

    Maximise functionality

    Identify Needs for: Manageability, Scalability, Security, Availability

    Integrate Samba-3 then migrate while users are active, then Change of control (ie: swap out)

    Take advantage of lower maintenance opportunity

    Samba Implementation Choices

    -Authentication database back end
-	Winbind (external Samba or NT4/200x server)
-	Can use pam_mkhomedir.so to auto-create home dirs
-	External server could use Active Directory or NT4 Domain
-
-Database type
-	smbpasswd, tdbsam, ldapsam, mysqlsam
-
-Access Control Points
-	On the Share itself (Use NT4 Server Manager)
-	On the file system
-	Unix permissions on files and directories
-	Enable Posix ACLs in file system?
-	Through Samba share parameters
-		Not recommended - except as only resort
-
-Policies (migrate or create new ones)
-	Group Policy Editor (NT4)
-	Watch out for Tattoo effect
-
-User and Group Profiles
-	Platform specific so use platform tool to change from a Local
-	to a Roaming profile Can use new profiles tool to change SIDs
-	(NTUser.DAT)
-
-Logon Scripts (Know how they work)
-
-User and Group mapping to Unix/Linux
-	username map facility may be needed
-	Use 'net groupmap' to connect NT4 groups to Unix groups
-	Use pdbedit to set/change user configuration
-NOTE:
-If migrating to LDAP back end it may be easier to dump initial LDAP database
-to LDIF, then edit, then reload into LDAP
-
-	OS specific scripts / programs may be needed
-		Add / delete Users
-			Note OS limits on size of name (Linux 8 chars)
-				NT4 up to 254 chars
-		Add / delete machines
-			Applied only to domain members (note up to 16 chars)
-		Add / delete Groups
-			Note OS limits on size and nature
-				Linux limit is 16 char,
-				no spaces and no upper case chars (groupadd)
-
-Migration Tools
-	Domain Control (NT4 Style)
-	Profiles, Policies, Access Controls, Security
-
-Migration Tools
-	Samba: net, rpcclient, smbpasswd, pdbedit, profiles
-	Windows: NT4 Domain User Manager, Server Manager (NEXUS)
-
-Authentication
-	New SAM back end (smbpasswd, tdbsam, ldapsam, mysqlsam)
-

    -

    Chapter 32. SWAT - The Samba Web Administration Tool

    John H. Terpstra

    Samba Team

    April 21, 2003

    Table of Contents

    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    +

    Table 31.2. Nature of the Conversion Choices

    SimpleUpgradedRedesign

    Make use of minimal OS specific features

    Translate NT4 features to new host OS features

    Decide:

    Suck all accounts from NT4 into Samba-3

    Copy and improve:

    Authentication Regime (database location and access)

    Make least number of operational changes

    Make progressive improvements

    Desktop Management Methods

    Take least amount of time to migrate

    Minimise user impact

    Better Control of Desktops / Users

    Live versus Isolated Conversion

    Maximise functionality

    Identify Needs for: Manageability, Scalability, Security, Availability

    Integrate Samba-3 then migrate while users are active, then Change of control (ie: swap out)

    Take advantage of lower maintenance opportunity

    Samba-3 Implementation Choices

    Authentication database/back end:

    + Samba-3 can use an external authentication backend: +

    +

    • Winbind (external Samba or NT4/200x server)

    • External server could use Active Directory or NT4 Domain

    • Can use pam_mkhomedir.so to auto-create home dirs

    +

    + Samba-3 can use a local authentication backend: +

    • smbpasswd, tdbsam, ldapsam, mysqlsam

    +

    Access Control Points:

    • On the Share itself - using Share ACLs

    • On the file system - using UNIX permissions on files and directories

      Note: Can Enable Posix ACLs in file system also

    • Through Samba share parameters - Not recommended - except as last resort

    Policies (migrate or create new ones):

    • Using Group Policy Editor (NT4)

    • - Watch out for Tattoo effect

    User and Group Profiles:

    + Platform specific so use platform tool to change from a Local to a Roaming profile + Can use new profiles tool to change SIDs (NTUser.DAT) +

    Logon Scripts:

    + Know how they work +

    User and Group mapping to Unix/Linux:

    • username map facility may be needed

    • Use 'net groupmap' to connect NT4 groups to Unix groups

    • Use pdbedit to set/change user configuration

      + NOTE: When migrating to LDAP back, end it may be easier to dump initial + LDAP database to LDIF, then edit, then reload into LDAP +

    OS specific scripts/programs may be needed:

    • Add/Delete Users: Note OS limits on size of name + (Linux 8 chars) NT4 up to 254 chars

    • Add/Delete Machines: Applied only to domain members + (Note: Machine names may be limited to 16 characters)

    • Use 'net groupmap' to connect NT4 groups to Unix groups

    • Add/Delete Groups: Note OS limits on size and nature. + Linux limit is 16 char, no spaces and no upper case chars (groupadd)

    Migration Tools:

    + Domain Control (NT4 Style) Profiles, Policies, Access Controls, Security +

    • Samba: net, rpcclient, smbpasswd, pdbedit, profiles

    • Windows: NT4 Domain User Manager, Server Manager (NEXUS)

    +

    Chapter 32. SWAT - The Samba Web Administration Tool

    John H. Terpstra

    Samba Team

    April 21, 2003

    Table of Contents

    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    There are many and varied opinions regarding the usefulness or otherwise of SWAT. No matter how hard one tries to produce the perfect configuration tool it remains an object of personal taste. SWAT is a tool that will allow web based configuration @@ -15188,7 +14521,7 @@ of samba. It has a wizard that may help to get samba configured quickly, it has sensitive help on each smb.conf parameter, it provides for monitoring of current state of connection information, and it allows network wide MS Windows network password management. -

    Features and Benefits

    +

    Features and Benefits

    There are network administrators who believe that it is a good idea to write systems documentation inside configuration files, for them SWAT will aways be a nasty tool. SWAT does not store the configuration file in any intermediate form, rather, it stores only the @@ -15200,9 +14533,9 @@ internal ordering. So before using SWAT please be warned - SWAT will completely replace your smb.conf with a fully optimised file that has been stripped of all comments you might have placed there and only non-default settings will be written to the file. -

    Enabling SWAT for use

    +

    Enabling SWAT for use

    SWAT should be installed to run via the network super daemon. Depending on which system -your Unix/Linux system has you will have either an inetd or +your UNIX/Linux system has you will have either an inetd or xinetd based system.

    The nature and location of the network super-daemon varies with the operating system @@ -15254,7 +14587,7 @@ So long as you log onto SWAT as the user rootHOME, GLOBALS, SHARES, PRINTERS, WIZARD, STATUS, VIEW, PASSWORD. -

    Securing SWAT through SSL

    +

    Securing SWAT through SSL

    Lots of people have asked about how to setup SWAT with SSL to allow for secure remote administration of Samba. Here is a method that works, courtesy of Markus Krieger

    @@ -15264,38 +14597,37 @@ Modifications to the swat setup are as following:

  • generate certificate and private key - 

    +
     root# /usr/bin/openssl req -new -x509 -days 365 -nodes -config \
- 	/usr/share/doc/packages/stunnel/stunnel.cnf \
+	/usr/share/doc/packages/stunnel/stunnel.cnf \
 	-out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem
-

  • +

  • remove swat-entry from [x]inetd

  • start stunnel - 

    +
     root# stunnel -p /etc/stunnel/stunnel.pem -d 901 \
 	 -l /usr/local/samba/bin/swat swat 
-

    • +

    afterwords simply contact to swat by using the URL https://myhost:901, accept the certificate and the SSL connection is up. -

    The SWAT Home Page

    +

    The SWAT Home Page

    The SWAT title page provides access to the latest Samba documentation. The manual page for each samba component is accessible from this page as are the Samba-HOWTO-Collection (this -document) as well as the O'Reilly book "Using Samba". +document) as well as the O'Reilly book "Using Samba".

    Administrators who wish to validate their samba configuration may obtain useful information from the man pages for the diagnostic utilities. These are available from the SWAT home page also. One diagnostic tool that is NOT mentioned on this page, but that is particularly -useful is ethereal, available from -http://www.ethereal.com. +useful is ethereal.

    Warning

    SWAT can be configured to run in demo mode. This is NOT recommended as it runs SWAT without authentication and with full administrative ability. ie: Allows changes to smb.conf as well as general operation with root privileges. The option that creates this ability is the -a flag to swat. Do not use this in any production environment. -

    Global Settings

    +

    Global Settings

    The Globals button will expose a page that allows configuration of the global parameters in smb.conf. There are three levels of exposure of the parameters:

    • @@ -15308,8 +14640,8 @@ in smb.conf. There are three levels of exposure of the parameters: will want to tamper with.

    To switch to other than Basic editing ability click on either the -Advanced or the Developer dial, then click the -Commit Changes button. +Advanced or the Developer button. You may also +do this by clicking on the radio button, then click the Commit Changes button.

    After making any changes to configuration parameters make sure that you click on the Commit Changes button before moving to another area otherwise @@ -15317,7 +14649,7 @@ your changes will be immediately lost.

    Note

    SWAT has context sensitive help. To find out what each parameter is for simply click the Help link to the left of the configuration parameter. -

    Share Settings

    +

    Share Settings

    To affect a currently configured share, simply click on the pull down button between the Choose Share and the Delete Share buttons, select the share you wish to operate on, then to edit the settings click on the @@ -15327,7 +14659,7 @@ select the share you wish to operate on, then to edit the settings click on the To create a new share, next to the button labelled Create Share enter into the text field the name of the share to be created, then click on the Create Share button. -

    Printers Settings

    +

    Printers Settings

    To affect a currently configured printer, simply click on the pull down button between the Choose Printer and the Delete Printer buttons, select the printer you wish to operate on, then to edit the settings click on the @@ -15337,7 +14669,7 @@ select the printer you wish to operate on, then to edit the settings click on th To create a new printer, next to the button labelled Create Printer enter into the text field the name of the share to be created, then click on the Create Printer button. -

    The SWAT Wizard

    +

    The SWAT Wizard

    The purpose if the SWAT Wizard is to help the Microsoft knowledgeable network administrator to configure Samba with a minimum of effort.

    @@ -15353,7 +14685,7 @@ Finally, there are a limited set of options that will determine what type of ser will be configured for, whether it will be a WINS server, participate as a WINS client, or operate with no WINS support. By clicking on one button you can elect to expose (or not) user home directories. -

    The Status Page

    +

    The Status Page

    The status page serves a limited purpose. Firstly, it allows control of the samba daemons. The key daemons that create the samba server environment are: smbd, nmbd, winbindd.

    @@ -15364,11 +14696,11 @@ conditions with minimal effort.

    Lastly, the Status page may be used to terminate specific smbd client connections in order to free files that may be locked. -

    The View Page

    +

    The View Page

    This page allows the administrator to view the optimised smb.conf file and, if you are particularly masochistic, will permit you also to see all possible global configuration parameters and their settings. -

    The Password Change Page

    +

    The Password Change Page

    The Password Change page is a popular tool. This tool allows the creation, deletion, deactivation and reactivation of MS Windows networking users on the local machine. Alternatively, you can use this tool to change a local password for a user account. @@ -15379,7 +14711,7 @@ required.

    One popular use for this tool is to change user passwords across a range of remote MS Windows servers. -

    Troubleshooting

    Table of Contents

    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    Still having troubles?
    34. Analysing and solving samba problems
    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Chapter 33. The Samba checklist

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Wed Jan 15

    Table of Contents

    Introduction
    Assumptions
    The tests
    Still having troubles?

    Introduction

    +

    Troubleshooting

    Table of Contents

    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    34. Analysing and solving samba problems
    Diagnostics tools
    Debugging with Samba itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Chapter 33. The Samba checklist

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Wed Jan 15

    Table of Contents

    Introduction
    Assumptions
    The tests

    Introduction

    This file contains a list of tests you can perform to validate your Samba server. It also tells you what the likely cause of the problem is if it fails any one of these steps. If it passes all these tests @@ -15391,10 +14723,10 @@ the earlier tests. However, do not stop at the first error as there have been some instances when continuing with the tests has helped to solve a problem.

    -If you send one of the samba mailing lists an email saying "it doesn't work" +If you send one of the samba mailing lists an email saying "it doesn't work" and you have not followed this test procedure then you should not be surprised if your email is ignored. -

    Assumptions

    +

    Assumptions

    In all of the tests it is assumed you have a Samba server called BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP.

    @@ -15404,14 +14736,7 @@ It is also assumed you know the name of an available share in your smb.conf. I will assume this share is called tmp. You can add a tmp share like this by adding the following to smb.conf: -

    -
-[tmp]
- comment = temporary files 
- path = /tmp
- read only = yes
-
-

    +

    Example 33.1. smb.conf with [tmp] share

    [tmp]
    comment = temporary files
    path = /tmp
    read only = yes

    Note

    These tests assume version 3.0 or later of the samba suite. Some commands shown did not exist in earlier versions. @@ -15424,7 +14749,7 @@ file points to name servers that really do exist. Also, if you do not have DNS server access for name resolution please check that the settings for your smb.conf file results in dns proxy = no. The best way to check this is with testparm smb.conf. -

    +

    It is helpful to monitor the log files during testing by using the tail -F log_file_name in a separate terminal console (use ctrl-alt-F1 through F6 or multiple terminals in X). @@ -15435,7 +14760,7 @@ depending on how or if you specified logging in your smb.co

    If you make changes to your smb.conf file while going through these test, don't forget to restart smbd and nmbd. -

    The tests

    Procedure 33.1. Diagnosing your samba server

    1. +

    The tests

    Procedure 33.1. Diagnosing your samba server

    1. In the directory in which you store your smb.conf file, run the command testparm smb.conf. If it reports any errors then your smb.conf configuration file is faulty. @@ -15448,7 +14773,7 @@ Run the command ping BIGSERVER from the PC and the unix box. If you don't get a valid response then your TCP/IP software is not correctly installed.

      -Note that you will need to start a "dos prompt" window on the PC to +Note that you will need to start a "dos prompt" window on the PC to run ping.

      If you get a message saying host not found or similar then your DNS @@ -15468,7 +14793,7 @@ This is a common problem that is often overlooked. Run the command smbclient -L BIGSERVER on the unix box. You should get a list of available shares back.

      -If you get a error message containing the string "Bad password" then +If you get a error message containing the string "Bad password" then you probably have either an incorrect hosts allow, hosts deny or valid users line in your smb.conf, or your guest account is not @@ -15481,13 +14806,15 @@ that file incorrectly. If you installed it as a daemon then check that it is running, and check that the netbios-ssn port is in a LISTEN state using netstat -a.

      Note

      + + Some Unix / Linux systems use xinetd in place of inetd. Check your system documentation for the location of the control file/s for your particular system implementation of this network super daemon.

      If you get a session request failed then the server refused the -connection. If it says "Your server software is being unfriendly" then +connection. If it says "Your server software is being unfriendly" then its probably because you have invalid command line parameters to smbd, or a similar fatal problem with the initial startup of smbd. Also check your config file (smb.conf) for syntax errors with testparm @@ -15497,26 +14824,20 @@ files exist. There are a number of reasons for which smbd may refuse or decline a session request. The most common of these involve one or more of the following smb.conf file entries: -

      -	hosts deny = ALL
-	hosts allow = xxx.xxx.xxx.xxx/yy
-	bind interfaces only = Yes
-

      +

      hosts deny = ALL
      hosts allow = xxx.xxx.xxx.xxx/yy
      bind interfaces only = Yes

      In the above, no allowance has been made for any session requests that will automatically translate to the loopback adapter address 127.0.0.1. To solve this problem change these lines to: -

      -	hosts deny = ALL
-	hosts allow = xxx.xxx.xxx.xxx/yy 127.
-

      -Do not use the bind interfaces only parameter where you +

      hosts deny = ALL
      hosts allow = xxx.xxx.xxx.xxx/yy 127.

      +Do not use the bind interfaces only parameter where you may wish to use the samba password change facility, or where smbclient may need to access a local service for name resolution or for local resource -connections. (Note: the bind interfaces only parameter deficiency +connections. (Note: the bind interfaces only parameter deficiency where it will not allow connections to the loopback address will be fixed soon).

      + Another common cause of these two errors is having something already running on port 139, such as Samba (ie: smbd is running from inetd already) or @@ -15559,20 +14880,20 @@ messages from several hosts. If this doesn't give a similar result to the previous test then nmblookup isn't correctly getting your broadcast address through its automatic mechanism. In this case you should experiment with the -interfaces option in smb.conf to manually configure your IP +interfaces option in smb.conf to manually configure your IP address, broadcast and netmask.

      If your PC and server aren't on the same subnet then you will need to -use the -B option to set the broadcast address to that of the PCs +use the -B option to set the broadcast address to that of the PCs subnet.

      This test will probably fail if your subnet mask and broadcast address are not correct. (Refer to TEST 3 notes above). -

    2. +

    3. Run the command smbclient //BIGSERVER/TMP. You should then be prompted for a password. You should use the password of the account you are logged into the unix box with. If you want to test with -another account then add the -U accountname option to the end of +another account then add the -U accountname option to the end of the command line. eg: smbclient //bigserver/tmp -Ujohndoe

      Note

      @@ -15582,21 +14903,20 @@ as follows:

      Once you enter the password you should get the smb> prompt. If you don't then look at the error message. If it says invalid network -name then the service "tmp" is not correctly setup in your smb.conf. +name then the service "tmp" is not correctly setup in your smb.conf.

      If it says bad password then the likely causes are:

      1. you have shadow passwords (or some other password system) but didn't compile in support for them in smbd

      2. - your valid users configuration is incorrect + your valid users configuration is incorrect

      3. - you have a mixed case password and you haven't enabled the password - level option at a high enough level + you have a mixed case password and you haven't enabled the password level option at a high enough level

      4. - the path = line in smb.conf is incorrect. Check it with testparm + the path line in smb.conf is incorrect. Check it with testparm

      5. - you enabled password encryption but didn't map unix to samba users + you enabled password encryption but didn't map unix to samba users. Run 

        smbpasswd -a username

        .

      Once connected you should be able to use the commands dir get put etc. @@ -15605,7 +14925,7 @@ especially check that the amount of free disk space shown is correct when you type dir.

    4. On the PC, type the command net view \\BIGSERVER. You will -need to do this from within a "dos prompt" window. You should get back a +need to do this from within a "dos prompt" window. You should get back a list of available shares on the server.

      If you get a network name not found or similar error then netbios @@ -15646,14 +14966,13 @@ installed or your smb.conf is incorrect. make sure your hosts and other config lines in smb.conf are correct.

      It's also possible that the server can't work out what user name to -connect you as. To see if this is the problem add the line user = -username to the [tmp] section of +connect you as. To see if this is the problem add the line user = username to the [tmp] section of smb.conf where username is the username corresponding to the password you typed. If you find this fixes things you may need the username mapping option.

      It might also be the case that your client only sends encrypted passwords -and you have encrypt passwords = no in smb.conf +and you have encrypt passwords = no in smb.conf Turn it back on to fix.

    5. Run the command nmblookup -M testgroup where @@ -15664,30 +14983,33 @@ master browser for that workgroup. If you don't then the election process has failed. Wait a minute to see if it is just being slow then try again. If it still fails after that then look at the browsing options you have set in smb.conf. Make -sure you have preferred master = yes to ensure that +sure you have preferred master = yes to ensure that an election is held at startup.

    6. ->From file manager try to browse the server. Your samba server should +From file manager try to browse the server. Your samba server should appear in the browse list of your local workgroup (or the one you -specified in smb.conf). You should be able to double click on the name -of the server and get a list of shares. If you get a "invalid -password" error when you do then you are probably running WinNT and it +specified in smb.conf). You should be able to double click on the name +of the server and get a list of shares. If you get a "invalid +password" error when you do then you are probably running WinNT and it is refusing to browse a server that has no encrypted password capability and is in user level security mode. In this case either set -security = server AND -password server = Windows_NT_Machine in your -smb.conf file, or make sure encrypted passwords is -set to "yes". -

    Still having troubles?

    Read the chapter on -Analysing and Solving Problems. -

    Chapter 34. Analysing and solving samba problems

    Gerald (Jerry) Carter

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    David Bannon

    Samba Team

    8 Apr 2003

    Table of Contents

    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists

    +security = server AND +password server = Windows_NT_Machine in your +smb.conf file, or make sure encrypt passwords is +set to "yes". +

    Chapter 34. Analysing and solving samba problems

    Gerald (Jerry) Carter

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    David Bannon

    Samba Team

    8 Apr 2003

    Table of Contents

    Diagnostics tools
    Debugging with Samba itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists

    There are many sources of information available in the form of mailing lists, RFC's and documentation. The docs that come with the samba distribution contain very good explanations of -general SMB topics such as browsing.

    Diagnostics tools

    +general SMB topics such as browsing.

    Diagnostics tools

    With SMB networking, it is often not immediately clear what +the cause is of a certain problem. Samba itself provides rather +useful information, but in some cases you might have to fall back +to using a sniffer. A sniffer is a program that +listens on your LAN, analyses the data sent on it and displays it +on the screen.

    Debugging with Samba itself

    One of the best diagnostic tools for debugging problems is Samba itself. You can use the -d option for both smbd and nmbd to specify what -debug level at which to run. See the man pages on smbd, nmbd and +debug level at which to run. See the man pages on smbd, nmbd and smb.conf for more information on debugging options. The debug level can range from 1 (the default) to 10 (100 for debugging passwords).

    @@ -15706,14 +15028,19 @@ typing in your password, you can attach gdb and continue.

    Some useful samba commands worth investigating: 

    -	$ testparm | more
-	$ smbclient -L //{netbios name of server}
-

    -An SMB enabled version of tcpdump is available from -http://www.tcpdup.org/. -Ethereal, another good packet sniffer for Unix and Win32 -hosts, can be downloaded from http://www.ethereal.com. -

    +$ testparm | more +$ smbclient -L //{netbios name of server} +

    Tcpdump

    Tcpdump was the first +unix sniffer with SMB support. It is a command-line utility and +nowadays, it's SMB support is somewhat less then that of ethereal +and tethereal.

    Ethereal

    +Ethereal is a graphical +sniffer, available for both unix (Gtk) and Windows. Ethereal's +SMB support is very good.

    For details on the use of ethereal, read the well-written +ethereal User Guide.

    +Listen for data on ports 137, 138, 139 and 445. E.g. +use the filter port 137 or port 138 or port 139 or port 445.

    A console version of ethereal is available as well and is called +tethereal.

    The Windows Network Monitor

    For tracing things on the Microsoft Windows NT, Network Monitor (aka. netmon) is available on the Microsoft Developer Network CD's, the Windows NT Server install CD and the SMS CD's. The version of @@ -15723,7 +15050,7 @@ The version on the NT Server install CD will only allow monitoring of network traffic directed to the local NT box and broadcasts on the local subnet. Be aware that Ethereal can read and write netmon formatted files. -

    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box

    +

    Installing 'Network Monitor' on an NT Workstation

    Installing netmon on an NT workstation requires a couple of steps. The following are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 4.0, on Microsoft Windows NT @@ -15756,17 +15083,17 @@ Now copy the files from the NT Server in %SYSTEMROOT%\Syste to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set permissions as you deem appropriate for your site. You will need administrative rights on the NT box to run netmon. -

    +

    Installing 'Network Monitor' on an 9x Workstation

    To install Netmon on a Windows 9x box install the network monitor agent from the Windows 9x CD (\admin\nettools\netmon). There is a readme file located with the netmon driver files on the CD if you need information on how to do this. Copy the files from a working Netmon installation. -

    Useful URLs

    • See how Scott Merrill simulates a BDC behavior at +

    Useful URLs

    Getting help from the mailing lists

    + ftp://ftp.microsoft.com/developr/drg/CIFS/

    Getting help from the mailing lists

    There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror and then click on Support and then click on Samba related mailing lists. @@ -15776,10 +15103,10 @@ For questions relating to Samba TNG go to It has been requested that you don't post questions about Samba-TNG to the main stream Samba lists.

    If you post a message to one of the lists please observe the following guide lines : -

    • Always remember that the developers are volunteers, they are +

      • Always remember that the developers are volunteers, they are not paid and they never guarantee to produce a particular feature at a particular time. Any time lines are 'best guess' and nothing more. -

      • Always mention what version of samba you are using and what +

      • Always mention what version of samba you are using and what operating system its running under. You should probably list the relevant sections of your smb.conf file, at least the options in [global] that affect PDC support.

      • In addition to the version, if you obtained Samba via @@ -15800,15 +15127,14 @@ error messages.

      • (Possibly) If you have a complete netmon trace ( the pipe to the error ) you can send the *.CAP file as well.

      • Please think carefully before attaching a document to an email. Consider pasting the relevant parts into the body of the message. The samba mailing lists go to a huge number of people, do they all need a copy of your -smb.conf in their attach directory?

    How to get off the mailing lists

    To have your name removed from a samba mailing list, go to the +smb.conf in their attach directory?

    How to get off the mailing lists

    To have your name removed from a samba mailing list, go to the same place you went to to get on it. Go to http://lists.samba.org, click on your nearest mirror and then click on Support and -then click on Samba related mailing lists. Or perhaps see -here +then click on Samba related mailing lists.

    Please don't post messages to the list asking to be removed, you will just be referred to the above address (unless that process failed in some way...) -

    Chapter 35. Reporting Bugs

    Jelmer R. Vernooij

    The Samba Team

    Someone; Tridge or Karl Auer perhaps?

    27 June 1997

    Table of Contents

    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Introduction

    Please report bugs using +

    Chapter 35. Reporting Bugs

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    27 June 1997

    Table of Contents

    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Introduction

    Please report bugs using bugzilla.

    Please take the time to read this file before you submit a bug report. Also, please see if it has changed between releases, as we @@ -15818,7 +15144,7 @@ Please also do as much as you can yourself to help track down the bug. Samba is maintained by a dedicated group of people who volunteer their time, skills and efforts. We receive far more mail about it than we can possibly answer, so you have a much higher chance of an answer -and a fix if you send us a "developer friendly" bug report that lets +and a fix if you send us a "developer friendly" bug report that lets us fix it fast.

    Do not assume that if you post the bug to the comp.protocols.smb @@ -15830,7 +15156,7 @@ that list that may be able to help you. You may also like to look though the recent mailing list archives, which are conveniently accessible on the Samba web pages at http://samba.org/samba/. -

    General info

    +

    General info

    Before submitting a bug report check your config for silly errors. Look in your log files for obvious messages that tell you that you've misconfigured something and run testparm to test your config @@ -15842,42 +15168,38 @@ This is very important. If you include part of a log file with your bug report then be sure to annotate it with exactly what you were doing on the client at the time, and exactly what the results were. -

    Debug levels

    +

    Debug levels

    If the bug has anything to do with Samba behaving incorrectly as a server (like refusing to open a file) then the log files will probably be very useful. Depending on the problem a log level of between 3 and 10 showing the problem may be appropriate. A higher level gives more detail, but may use too much disk space.

    -To set the debug level use the log level in your +To set the debug level use the log level in your smb.conf. You may also find it useful to set the log level higher for just one machine and keep separate logs for each machine. -To do this use: -

    -log level = 10
-log file = /usr/local/samba/lib/log.%m
-include = /usr/local/samba/lib/smb.conf.%m
-

    +To do this add the following lines to your main smb.conf file: +

    log level = 10
    log file = /usr/local/samba/lib/log.%m
    include = /usr/local/samba/lib/smb.conf.%m

    then create a file /usr/local/samba/lib/smb.conf.machine where machine is the name of the client you wish to debug. In that file put any smb.conf commands you want, for example -log level may be useful. This also allows you to +log level may be useful. This also allows you to experiment with different security systems, protocol levels etc on just one machine.

    -The smb.conf entry log level -is synonymous with the parameter debuglevel that has +The smb.conf entry log level +is synonymous with the parameter debuglevel that has been used in older versions of Samba and is being retained for backwards compatibility of smb.conf files.

    -As the log level value is increased you will record +As the log level value is increased you will record a significantly increasing level of debugging information. For most debugging operations you may not need a setting higher than 3. Nearly all bugs can be tracked at a setting of 10, but be prepared for a VERY large volume of log data. -

    Internal errors

    +

    Internal errors

    If you get a INTERNAL ERROR message in your log files it means that Samba got an unexpected signal while running. It is probably a segmentation fault and almost certainly means a bug in Samba (unless @@ -15890,13 +15212,13 @@ include it in your bug report.

    You should also detail how to reproduce the problem, if possible. Please make this reasonably detailed. -

    +

    You may also find that a core file appeared in a corefiles subdirectory of the directory where you keep your samba log files. This file is the most useful tool for tracking down the bug. To use it you do this: -

    -	$ gdb smbd core
+
    +$ gdb smbd core
 
    
 adding appropriate paths to smbd and core so gdb can find them. If you
 don't have gdb then try dbx. Then within the debugger
@@ -15910,7 +15232,7 @@ disassemble the routine that called it) and try to work out exactly
 where the problem is by looking at the surrounding code. Even if you
 don't know assembly, including this info in the bug report can be
 useful. 
-

    Attaching to a running process

    +

    Attaching to a running process

    Unfortunately some unixes (in particular some recent linux kernels) refuse to dump a core file if the task has changed uid (which smbd does often). To debug with this sort of system you could try to attach @@ -15920,34 +15242,33 @@ to the running process using Then use c to continue and try to cause the core dump using the client. The debugger should catch the fault and tell you where it occurred. -

    Patches

    +

    Patches

    The best sort of bug report is one that includes a fix! If you send us patches please use diff -u format if your version of diff supports it, otherwise use diff -c4. Make sure you do the diff against a clean version of the source and let me know exactly what version you used. -

    Appendixes

    Table of Contents

    36. How to compile SAMBA
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    Common Errors
    37. Portability
    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
    How do I get printer driver download working - for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Books

    Chapter 36. How to compile SAMBA

    Jelmer R. Vernooij

    The Samba Team

    Someone; Jerry perhaps?

    22 May 2001

    18 March 2003

    Table of Contents

    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    Common Errors

    +

    Appendixes

    Table of Contents

    36. How to compile Samba
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    37. Portability
    HPUX
    SCO UNIX
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    Configuring OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba
    Configuring OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba
    Printer driver download for for OS/2 clients?
    Windows for Workgroups
    Latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configuring WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft

    Chapter 36. How to compile Samba

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    22 May 2001

    18 March 2003

    Table of Contents

    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon

    You can obtain the samba source from the samba website. To obtain a development version, you can download samba from CVS or using rsync. -

    Access Samba source code via CVS

    Introduction

    +

    Access Samba source code via CVS

    Introduction

    Samba is developed in an open environment. Developers use CVS -(Concurrent Versioning System) to "checkin" (also known as -"commit") new source code. Samba's various CVS branches can +(Concurrent Versioning System) to "checkin" (also known as +"commit") new source code. Samba's various CVS branches can be accessed via anonymous CVS using the instructions detailed in this chapter.

    This chapter is a modified version of the instructions found at http://samba.org/samba/cvs.html -

    CVS Access to samba.org

    +

    CVS Access to samba.org

    The machine samba.org runs a publicly accessible CVS repository for access to the source code of several packages, including samba, rsync, distcc, ccache and jitterbug. There are two main ways of accessing the CVS server on this host. -

    Access via CVSweb

    +

    Access via CVSweb

    You can access the source code via your favourite WWW browser. This allows you to access the contents of individual files in the repository and also to look at the revision @@ -15955,7 +15276,7 @@ history and commit logs of individual files. You can also ask for a diff listing between any two versions on the repository.

    Use the URL : http://samba.org/cgi-bin/cvsweb -

    Access via cvs

    +

    Access via cvs

    You can also access the source code via a normal cvs client. This gives you much more control over what you can do with the repository and allows you to checkout whole source trees @@ -15995,7 +15316,7 @@ on this system just substitute the correct package name

    CVS branches other then HEAD can be obtained by using the -r and defining a tag name. A list of branch tag names - can be found on the "Development" page of the samba web site. A common + can be found on the "Development" page of the samba web site. A common request is to obtain the latest 3.0 release code. This could be done by using the following command:

    @@ -16005,7 +15326,7 @@ on this system just substitute the correct package name the following command from within the samba directory:

    cvs update -d -P -

    Accessing the samba sources via rsync and ftp

    +

    Accessing the samba sources via rsync and ftp

    pserver.samba.org also exports unpacked copies of most parts of the CVS tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. @@ -16014,7 +15335,7 @@ on this system just substitute the correct package name The disadvantage of the unpacked trees is that they do not support automatic merging of local changes like CVS does. rsync access is most convenient for an initial install. -

    Verifying Samba's PGP signature

    +

    Verifying Samba's PGP signature

    In these days of insecurity, it's strongly recommended that you verify the PGP signature for any source file before installing it. Even if you're not downloading from a mirror site, verifying PGP signatures should be a @@ -16022,39 +15343,43 @@ standard reflex.

    With that said, go ahead and download the following files: 

    -$  wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc
-$  wget http://us1.samba.org/samba/ftp/samba-pubkey.asc
+$ wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc
+$ wget http://us1.samba.org/samba/ftp/samba-pubkey.asc

    + The first file is the PGP signature for the Samba source file; the other is the Samba public PGP key itself. Import the public PGP key with: 

    -	$ gpg --import samba-pubkey.asc
+$ gpg --import samba-pubkey.asc

    And verify the Samba source code integrity with: 

    -	$ gzip -d samba-2.2.8a.tar.gz
-	$ gpg --verify samba-2.2.8a.tar.asc
+$ gzip -d samba-2.2.8a.tar.gz
+$ gpg --verify samba-2.2.8a.tar.asc

    -If you receive a message like, "Good signature from Samba Distribution -Verification Key..." +If you receive a message like, "Good signature from Samba Distribution +Verification Key..." then all is well. The warnings about trust relationships can be ignored. An example of what you would not want to see would be: -

    - gpg: BAD signature from "Samba Distribution Verification Key" -

    Building the Binaries

    To do this, first run the program ./configure +

    + + gpg: BAD signature from "Samba Distribution Verification Key" + +

    Building the Binaries

    + To do this, first run the program ./configure in the source directory. This should automatically configure Samba for your operating system. If you have unusual - needs then you may wish to run

    root# ./configure --help -

    first to see what special options you can enable. - Then executing

    root# make

    will create the binaries. Once it's successfully - compiled you can use

    root# make install

    to install the binaries and manual pages. You can - separately install the binaries and/or man pages using

    root# make installbin -

    and

    root# make installman -

    Note that if you are upgrading for a previous version + needs then you may wish to run

    root# ./configure --help
+

    first to see what special options you can enable. + Then executing

    root# make

    will create the binaries. Once it's successfully + compiled you can use 

    root# make install

    to install the binaries and manual pages. You can + separately install the binaries and/or man pages using

    root# make installbin
+

    and

    root# make installman
+

    Note that if you are upgrading for a previous version of Samba you might like to know that the old versions of - the binaries will be renamed with a ".old" extension. You - can go back to the previous version with

    root# make revert -

    if you find this version a disaster!

    Compiling samba with Active Directory support

    In order to compile samba with ADS support, you need to have installed + the binaries will be renamed with a ".old" extension. You + can go back to the previous version with

    root# make revert
+

    if you find this version a disaster!

    Compiling samba with Active Directory support

    In order to compile samba with ADS support, you need to have installed on your system:

    • the MIT kerberos development libraries (either install from the sources or use a package). The Heimdal libraries will not work.

    • the OpenLDAP development libraries.

    If your kerberos libraries are in a non-standard location then @@ -16066,16 +15391,17 @@ example of what you would not want to see would be: #define HAVE_LDAP 1

    If it doesn't then configure did not find your krb5 libraries or your ldap libraries. Look in config.log to figure - out why and fix it.

    Installing the required packages for Debian

    On Debian you need to install the following packages:

    -

    libkrb5-dev
    krb5-user

    -

    Installing the required packages for RedHat

    On RedHat this means you should have at least:

    -

    krb5-workstation (for kinit)
    krb5-libs (for linking with)
    krb5-devel (because you are compiling from source)

    + out why and fix it.

    Installing the required packages for Debian

    On Debian you need to install the following packages:

    +

    • libkrb5-dev

    • krb5-user

    +

    Installing the required packages for RedHat

    On RedHat this means you should have at least:

    +

    • krb5-workstation (for kinit)

    • krb5-libs (for linking with)

    • krb5-devel (because you are compiling from source)

    in addition to the standard development environment.

    Note that these are not standard on a RedHat install, and you may need - to get them off CD2.

    Starting the smbd and nmbd

    You must choose to start smbd and nmbd either + to get them off CD2.

    Starting the smbd and nmbd

    You must choose to start smbd and nmbd either as daemons or from inetd. Don't try to do both! Either you can put them in inetd.conf and have them started on demand - by inetd, or you can start them as + by inetd or xinetd, + or you can start them as daemons either from the command line or in /etc/rc.local. See the man pages for details on the command line options. Take particular care to read @@ -16083,7 +15409,7 @@ example of what you would not want to see would be: Samba. In many cases you must be root.

    The main advantage of starting smbd and nmbd using the recommended daemon method is that they will respond slightly more quickly to an initial connection - request.

    Starting from inetd.conf

    Note

    The following will be different if + request.

    Starting from inetd.conf

    Note

    The following will be different if you use NIS, NIS+ or LDAP to distribute services maps.

    Look at your /etc/services. What is defined at port 139/tcp. If nothing is defined then add a line like this:

    netbios-ssn     139/tcp

    similarly for 137/udp you should have an entry like:

    netbios-ns	137/udp

    Next edit your /etc/inetd.conf @@ -16092,12 +15418,13 @@ example of what you would not want to see would be: netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd

    The exact syntax of /etc/inetd.conf varies between unixes. Look at the other entries in inetd.conf - for a guide.

    Note

    Some unixes already have entries like netbios_ns + for a guide.

    Some distributions use xinetd instead of inetd. Consult the + xinetd manual for configuration information.

    Note

    Some unixes already have entries like netbios_ns (note the underscore) in /etc/services. You must either edit /etc/services or /etc/inetd.conf to make them consistent. -

    Note

    On many systems you may need to use the - interfaces option in smb.conf to specify the IP +

    Note

    On many systems you may need to use the + interfaces option in smb.conf to specify the IP address and netmask of your interfaces. Run ifconfig as root if you don't know what the broadcast is for your @@ -16108,8 +15435,9 @@ example of what you would not want to see would be: This means you shouldn't use spaces between the options and arguments, or you should use a script, and start the script from inetd.

    Restart inetd, perhaps just send - it a HUP. If you have installed an earlier version of nmbd then - you may need to kill nmbd as well.

    Alternative: starting it as a daemon

    To start the server as a daemon you should create + it a HUP. 

    +			root# killall -HUP inetd
+

    Alternative: starting it as a daemon

    To start the server as a daemon you should create a script something like this one, perhaps calling it startsmb.

     		#!/bin/sh
@@ -16121,17 +15449,9 @@ example of what you would not want to see would be:
 		
    To kill it send a kill signal to the processes 
 			nmbd and smbd.
    Note
    If you use the SVR4 style init system then 
 		you may like to look at the examples/svr4-startup
-		script to make Samba fit into that system.

    Common Errors

    “ -I'm using gcc 3 and I've compiled Samba-3 from the CVS and the -binaries are very large files (40 Mb and 20 Mb). I've the same result with ---enable-shared ? -” -

    -The dwarf format used by GCC 3 for storing debugging symbols is very inefficient. -Strip the binaries, don't compile with -g or compile with -gstabs. -

    Chapter 37. Portability

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9

    Samba works on a wide range of platforms but the interface all the + script to make Samba fit into that system.

    Chapter 37. Portability

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    HPUX
    SCO UNIX
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9

    Samba works on a wide range of platforms but the interface all the platforms provide is not always compatible. This chapter contains -platform-specific information about compiling and using samba.

    HPUX

    +platform-specific information about compiling and using samba.

    HPUX

    HP's implementation of supplementary groups is, er, non-standard (for hysterical reasons). There are two group files, /etc/group and /etc/logingroup; the system maps UIDs to numbers using the former, but @@ -16151,15 +15471,15 @@ allowed range. On HPUX you must use gcc or the HP ANSI compiler. The free compiler that comes with HP-UX is not ANSI compliant and cannot compile Samba. -

    SCO Unix

    -If you run an old version of SCO Unix then you may need to get important +

    SCO UNIX

    +If you run an old version of SCO UNIX then you may need to get important TCP/IP patches for Samba to work correctly. Without the patch, you may encounter corrupt data transfers using samba.

    The patch you need is UOD385 Connection Drivers SLS. It is available from SCO (ftp.sco.com, directory SLS, files uod385a.Z and uod385a.ltr.Z). -

    DNIX

    +

    DNIX

    DNIX has a problem with seteuid() and setegid(). These routines are needed for Samba to work correctly, but they were left out of the DNIX C library for some reason. @@ -16204,8 +15524,8 @@ _seteuid:

    after creating the above files you then assemble them using 

    -	$ as seteuid.s
-	$ as setegid.s
+$ as seteuid.s
+$ as setegid.s

    that should produce the files seteuid.o and setegid.o @@ -16218,11 +15538,11 @@ LIBSM = setegid.o seteuid.o -ln You should then remove the line: 

     #define NO_EID
-

    from the DNIX section of includes.h

    RedHat Linux Rembrandt-II

    +

    from the DNIX section of includes.h

    RedHat Linux Rembrandt-II

    By default RedHat Rembrandt-II during installation adds an entry to /etc/hosts as follows: 

    -	127.0.0.1 loopback "hostname"."domainname"
+	127.0.0.1 loopback "hostname"."domainname"

    This causes Samba to loop back onto the loopback interface. @@ -16232,10 +15552,10 @@ is the master browse list holder and who is the master browser.

    Corrective Action: Delete the entry after the word loopback in the line starting 127.0.0.1 -

    AIX

    Sequential Read Ahead

    +

    AIX

    Sequential Read Ahead

    Disabling Sequential Read Ahead using vmtune -r 0 improves Samba performance significantly. -

    Solaris

    Locking improvements

    Some people have been experiencing problems with F_SETLKW64/fcntl +

    Solaris

    Locking improvements

    Some people have been experiencing problems with F_SETLKW64/fcntl when running Samba on Solaris. The built in file locking mechanism was not scalable. Performance would degrade to the point where processes would get into loops of trying to lock a file. It would try a lock, then fail, @@ -16256,11 +15576,10 @@ and rebuild samba. Nsswitch on Solaris 9 refuses to use the winbind nss module. This behavior is fixed by Sun in patch 113476-05 which as of March 2003 is not in any roll-up packages. -

    Chapter 38. Samba and other CIFS clients

    Jim McDonough

    IBM

    Jelmer R. Vernooij

    The Samba Team

    5 Mar 2001

    Table of Contents

    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
    How do I get printer driver download working - for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1

    This chapter contains client-specific information.

    Macintosh clients?

    -Yes. Thursby now has a CIFS Client / Server called DAVE +

    Chapter 38. Samba and other CIFS clients

    Jelmer R. Vernooij

    The Samba Team

    Jim McDonough

    OS/2
    IBM

    5 Mar 2001

    Table of Contents

    Macintosh clients?
    OS2 Client
    Configuring OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba
    Configuring OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba
    Printer driver download for for OS/2 clients?
    Windows for Workgroups
    Latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configuring WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1

    This chapter contains client-specific information.

    Macintosh clients?

    + Yes. Thursby now has a CIFS Client / Server called DAVE

    They test it against Windows 95, Windows NT and samba for compatibility issues. At the time of writing, DAVE was at version @@ -16279,32 +15598,28 @@ What Samba offers MS Windows users, these packages offer to Macs. For more info on these packages, Samba, and Linux (and other UNIX-based systems) see http://www.eats.com/linux_mac_win.html -

    OS2 Client

    How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?

    A more complete answer to this question can be - found on - http://carol.wins.uva.nl/~leeuw/samba/warp.html.

    Basically, you need three components:

    The File and Print Client ('IBM Peer')
    TCP/IP ('Internet support')
    The "NetBIOS over TCP/IP" driver ('TCPBEUI')

    Installing the first two together with the base operating +

    Newer versions of the Macintosh (Mac OS X) include Samba.

    OS2 Client

    Configuring OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba

    Basically, you need three components:

    • The File and Print Client ('IBM Peer')

    • TCP/IP ('Internet support')

    • The "NetBIOS over TCP/IP" driver ('TCPBEUI')

    Installing the first two together with the base operating system on a blank system is explained in the Warp manual. If Warp has already been installed, but you now want to install the - networking support, use the "Selective Install for Networking" - object in the "System Setup" folder.

    Adding the "NetBIOS over TCP/IP" driver is not described + networking support, use the "Selective Install for Networking" + object in the "System Setup" folder.

    Adding the "NetBIOS over TCP/IP" driver is not described in the manual and just barely in the online documentation. Start - MPTS.EXE, click on OK, click on "Configure LAPS" and click - on "IBM OS/2 NETBIOS OVER TCP/IP" in 'Protocols'. This line + MPTS.EXE, click on OK, click on "Configure LAPS" and click + on "IBM OS/2 NETBIOS OVER TCP/IP" in 'Protocols'. This line is then moved to 'Current Configuration'. Select that line, - click on "Change number" and increase it from 0 to 1. Save this + click on "Change number" and increase it from 0 to 1. Save this configuration.

    If the Samba server(s) is not on your local subnet, you can optionally add IP names and addresses of these servers - to the "Names List", or specify a WINS server ('NetBIOS + to the "Names List", or specify a WINS server ('NetBIOS Nameserver' in IBM and RFC terminology). For Warp Connect you may need to download an update for 'IBM Peer' to bring it on - the same level as Warp 4. See the webpage mentioned above.

    How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?

    You can use the free Microsoft LAN Manager 2.2c Client + the same level as Warp 4. See the webpage mentioned above.

    Configuring OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba

    You can use the free Microsoft LAN Manager 2.2c Client for OS/2 from ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/. - See - http://carol.wins.uva.nl/~leeuw/lanman.html for - more information on how to install and use this client. In + In a nutshell, edit the file \OS2VER in the root directory of the OS/2 boot partition and add the lines:

     		20=setup.exe
@@ -16315,14 +15630,12 @@ packages, Samba, and Linux (and other UNIX-based systems) see
 		or NS2000 driver from 
 		
  		ftp://ftp.cdrom.com/pub/os2/network/ndis/ instead.
-

    How do I get printer driver download working - for OS/2 clients?

    First, create a share called [PRINTDRV] that is +

    Printer driver download for for OS/2 clients?

    First, create a share called [PRINTDRV] that is world-readable. Copy your OS/2 driver files there. Note that the .EA_ files must still be separate, so you will need to use the original install files, and not copy an installed driver from an OS/2 system.

    Install the NT driver first for that printer. Then, - add to your smb.conf a parameter, os2 driver map = - filename. Then, in the file + add to your smb.conf a parameter, os2 driver map = filename. Then, in the file specified by filename, map the name of the NT driver name to the OS/2 driver name as follows:

    nt driver name = os2 driver name.device name, e.g.:

    @@ -16332,7 +15645,7 @@ packages, Samba, and Linux (and other UNIX-based systems) see you the driver is not available. On the second attempt, it will work. This is fixed simply by adding the device name to the mapping, after which it will work on the first attempt. -

    Windows for Workgroups

    Use latest TCP/IP stack from Microsoft

    Use the latest TCP/IP stack from Microsoft if you use Windows +

    Windows for Workgroups

    Latest TCP/IP stack from Microsoft

    Use the latest TCP/IP stack from Microsoft if you use Windows for Workgroups.

    The early TCP/IP stacks had lots of bugs.

    Microsoft has released an incremental upgrade to their TCP/IP 32-Bit @@ -16347,7 +15660,7 @@ fixed. New files include WINSOCK.DLL, TRACERT.EXE, NETSTAT.EXE, and NBTSTAT.EXE. -

    Delete .pwl files after password change

    +

    Delete .pwl files after password change

    WfWg does a lousy job with passwords. I find that if I change my password on either the unix box or the PC the safest thing to do is to delete the .pwl files in the windows directory. The PC will complain about not finding the files, but will soon get over it, allowing you to enter the new password. @@ -16356,20 +15669,20 @@ If you don't do this you may find that WfWg remembers and uses the old password, even if you told it a new one.

    Often WfWg will totally ignore a password you give it in a dialog box. -

    Configure WfW password handling

    +

    Configuring WfW password handling

    There is a program call admincfg.exe on the last disk (disk 8) of the WFW 3.11 disk set. To install it type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE. Then add an icon for it via the Program Manager New Menu. This program allows you to control how WFW handles passwords. ie disable Password Caching etc -for use with security = user -

    Case handling of passwords

    Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf(5) information on password level to specify what characters samba should try to uppercase when checking.

    Use TCP/IP as default protocol

    To support print queue reporting you may find +for use with security = user +

    Case handling of passwords

    Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf information on password level to specify what characters samba should try to uppercase when checking.

    Use TCP/IP as default protocol

    To support print queue reporting you may find that you have to use TCP/IP as the default protocol under WfWg. For some reason if you leave NetBEUI as the default it may break the print queue reporting on some systems. -It is presumably a WfWg bug.

    Speed improvement

    -Note that some people have found that setting DefaultRcvWindow in +It is presumably a WfWg bug.

    Speed improvement

    + Note that some people have found that setting DefaultRcvWindow in the [MSTCP] section of the SYSTEM.INI file under WfWg to 3072 gives a big improvement. I don't know why. @@ -16379,7 +15692,7 @@ performance with a large value (16384 or larger). Other people have reported that anything over 3072 slows things down enormously. One person even reported a speed drop of a factor of 30 when he went from 3072 to 8192. I don't know why. -

    Windows '95/'98

    +

    Windows '95/'98

    When using Windows 95 OEM SR2 the following updates are recommended where Samba is being used. Please NOTE that the above change will affect you once these updates have been installed. @@ -16393,11 +15706,11 @@ install the OLEUPD.EXE fix. This fix may stop your machine from hanging for an extended period when exiting Outlook and you may also notice a significant speedup when accessing network neighborhood services. -

    Speed improvement

    +

    Speed improvement

    Configure the win95 TCPIP registry settings to give better performance. I use a program called MTUSPEED.exe which I got off the net. There are various other utilities of this type freely available. -

    Windows 2000 Service Pack 2

    +

    Windows 2000 Service Pack 2

    There are several annoyances with Windows 2000 SP2. One of which only appears when using a Samba server to host user profiles to Windows 2000 SP2 clients in a Windows domain. This assumes @@ -16406,26 +15719,19 @@ likely occur if it is not.

    In order to serve profiles successfully to Windows 2000 SP2 clients (when not operating as a PDC), Samba must have -nt acl support = no +nt acl support = no added to the file share which houses the roaming profiles. If this is not done, then the Windows 2000 SP2 client will complain about not being able to access the profile (Access Denied) and create multiple copies of it on disk (DOMAIN.user.001, DOMAIN.user.002, etc...). See the -smb.conf(5) man page +smb.conf man page for more details on this option. Also note that the -nt acl support parameter was formally a global parameter in +nt acl support parameter was formally a global parameter in releases prior to Samba 2.2.2.

    The following is a minimal profile share: -

    -	[profile]
-		path = /export/profile
-		create mask = 0600
-		directory mask = 0700
-		nt acl support = no
-		read only = no
-

    +

    Example 38.1. Minimal profile share

    [profile]
    path = /export/profile
    create mask = 0600
    directory mask = 0700
    nt acl support = no
    read only = no

    The reason for this bug is that the Win2k SP2 client copies the security descriptor for the profile which contains the Samba server's SID, and not the domain SID. The client @@ -16433,15 +15739,15 @@ compares the SID for SAMBA\user and realizes it is different that the one assigned to DOMAIN\user. Hence the reason for the access denied message.

    -By disabling the nt acl support parameter, Samba will send +By disabling the nt acl support parameter, Samba will send the Win2k client a response to the QuerySecurityDescriptor trans2 call which causes the client to set a default ACL for the profile. This default ACL includes -

    DOMAIN\user "Full Control">

    Note

    This bug does not occur when using winbind to -create accounts on the Samba host for Domain users.

    Windows NT 3.1

    If you have problems communicating across routers with Windows -NT 3.1 workstations, read this Microsoft Knowledge Base article. +

    DOMAIN\user "Full Control">

    Note

    This bug does not occur when using winbind to +create accounts on the Samba host for Domain users.

    Windows NT 3.1

    If you have problems communicating across routers with Windows +NT 3.1 workstations, read this Microsoft Knowledge Base article. -

    Chapter 39. Samba Performance Tuning

    Paul Cochrane

    Dundee Limb Fitting Centre

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files

    Comparisons

    +

    Chapter 39. Samba Performance Tuning

    Paul Cochrane

    Dundee Limb Fitting Centre

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files

    Comparisons

    The Samba server uses TCP to talk to the client. Thus if you are trying to see if it performs well you should really compare it to programs that use the same protocol. The most readily available @@ -16463,14 +15769,14 @@ suspect the biggest factor is not Samba vs some other system but the hardware and drivers used on the various systems. Given similar hardware Samba should certainly be competitive in speed with other systems. -

    Socket options

    +

    Socket options

    There are a number of socket options that can greatly affect the performance of a TCP based server like Samba.

    The socket options that Samba uses are settable both on the command line with the -O option, or in the smb.conf file.

    -The socket options section of the smb.conf manual page describes how +The socket options section of the smb.conf manual page describes how to set these and gives recommendations.

    Getting the socket options right can make a big difference to your @@ -16479,11 +15785,11 @@ much. The correct settings are very dependent on your local network.

    The socket option TCP_NODELAY is the one that seems to make the biggest single difference for most networks. Many people report that -adding socket options = TCP_NODELAY doubles the read +adding socket options = TCP_NODELAY doubles the read performance of a Samba drive. The best explanation I have seen for this is that the Microsoft TCP/IP stack is slow in sending tcp ACKs. -

    Read size

    -The option read size affects the overlap of disk +

    Read size

    +The option read size affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger than this value then the server begins writing @@ -16499,10 +15805,10 @@ The default value is 16384, but very little experimentation has been done yet to determine the optimal value, and it is likely that the best value will vary greatly between systems anyway. A value over 65536 is pointless and will cause you to allocate memory unnecessarily. -

    Max xmit

    -At startup the client and server negotiate a maximum transmit size, +

    Max xmit

    + At startup the client and server negotiate a maximum transmit size, which limits the size of nearly all SMB commands. You can set the -maximum size that Samba will negotiate using the max xmit = option +maximum size that Samba will negotiate using the max xmit option in smb.conf. Note that this is the maximum size of SMB requests that Samba will accept, but not the maximum size that the *client* will accept. The client maximum receive size is sent to Samba by the client and Samba @@ -16513,41 +15819,41 @@ clients may perform better with a smaller transmit unit. Trying values of less than 2048 is likely to cause severe problems.

    In most cases the default is the best option. -

    Log level

    -If you set the log level (also known as debug level) higher than 2 +

    Log level

    +If you set the log level (also known as debug level) higher than 2 then you may suffer a large drop in performance. This is because the server flushes the log file after each operation, which can be very expensive. -

    Read raw

    -The read raw operation is designed to be an optimised, low-latency +

    Read raw

    +The read raw operation is designed to be an optimised, low-latency file read operation. A server may choose to not support it, -however. and Samba makes support for read raw optional, with it +however. and Samba makes support for read raw optional, with it being enabled by default.

    -In some cases clients don't handle read raw very well and actually +In some cases clients don't handle read raw very well and actually get lower performance using it than they get using the conventional read operations.

    -So you might like to try read raw = no and see what happens on your +So you might like to try read raw = no and see what happens on your network. It might lower, raise or not affect your performance. Only testing can really tell. -

    Write raw

    -The write raw operation is designed to be an optimised, low-latency +

    Write raw

    +The write raw operation is designed to be an optimised, low-latency file write operation. A server may choose to not support it, -however. and Samba makes support for write raw optional, with it +however. and Samba makes support for write raw optional, with it being enabled by default.

    -Some machines may find write raw slower than normal write, in which +Some machines may find write raw slower than normal write, in which case you may wish to change this option. -

    Slow Logins

    +

    Slow Logins

    Slow logins are almost always due to the password checking time. Using -the lowest practical password level will improve things. -

    Client tuning

    +the lowest practical password level will improve things. +

    Client tuning

    Often a speed problem can be traced to the client. The client (for example Windows for Workgroups) can often be tuned for better TCP performance. Check the sections on the various clients in Samba and Other Clients. -

    Samba performance problem due changing kernel

    +

    Samba performance problem due changing kernel

    Hi everyone. I am running Gentoo on my server and samba 2.2.8a. Recently I changed kernel version from linux-2.4.19-gentoo-r10 to linux-2.4.20-wolk4.0s. And now I have performance issue with samba. Ok @@ -16562,7 +15868,7 @@ Grab mii-tool and check the duplex settings on the NIC. My guess is that it is a link layer issue, not an application layer problem. Also run ifconfig and verify that the framing error, collisions, etc... look normal for ethernet. -

    Corrupt tdb Files

    +

    Corrupt tdb Files

    Well today it happened, Our first major problem using samba. Our samba PDC server has been hosting 3 TB of data to our 500+ users [Windows NT/XP] for the last 3 years using samba, no problem. @@ -16580,12 +15886,12 @@ Q2) What I also would like to mention is that the service latency seems a lot lower then before the locks cleanup, any ideas on keeping it top notch?

    A2) Yes! Same answer as for Q1! -

    Chapter 40. DNS and DHCP Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +

    Chapter 40. DNS and DHCP Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Chapter 41. Further Resources

    Jelmer R. Vernooij

    The Samba Team

    David Lechnyr

    Unofficial HOWTO

    May 1, 2003

    Table of Contents

    Websites
    Related updates from Microsoft
    Books

    Websites

    • +

    Chapter 41. Further Resources

    Jelmer R. Vernooij

    The Samba Team

    May 1, 2003

    Table of Contents

    Websites
    Related updates from Microsoft

    Websites

    Related updates from Microsoft

    Related updates from Microsoft

    Books

    Index

    +

    Index

    Symbols

    "Domain Admins" group, Discussion
    "Domain Users" group, Adding Domain Users to the Power Users group
    "Printers" folder, Caveats to be considered, Installing the PostScript Driver on a Client, Manual Driver Installation in 15 Steps
    "raw" printing, CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    /etc/host.conf, /etc/host.conf
    /etc/hosts, /etc/hosts
    /etc/nsswitch.conf, /etc/nsswitch.conf
    8.3
    file names, MS Windows NTFS Comparison with UNIX File Systems

    A

    ACLs, File, Directory and Share Access Controls
    Active Directory, Samba ADS Domain Membership
    add group script, Adding Groups Fails
    add machine script, The machine trust account not accessible, Adding Machine to Domain Fails
    add printer command, Adding new Printers with the Windows NT APW
    add printer wizard, Three familiar Methods for driver upload plus a new one
    add user script, Mapping User Identifiers between MS Windows and UNIX
    addprinter command, Parameters Recommended for Use
    admin users, User and Group Based Controls, I have set force user but Samba still makes root the owner of all the files I touch!
    Administrator, Discussion
    ADS (see Active Directory)
    ads server, Setup your smb.conf
    application/cups.vnd-postscript, Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver
    application/octet-stream, Explicitly enable "raw" printing for +application/octet-stream!, MIME type Conversion Rules, "application/octet-stream" printing
    application/pdf, MIME types and CUPS Filters
    application/postscript, Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver
    application/vnd.cups-raster, PostScript Printer Descriptions (PPDs) for non-PS Printers
    application/vnd.cups-raw, Explicitly enable "raw" printing for +application/octet-stream!
    auth methods, auth methods does not work, Passdb Backends and Authentication

    B

    bind interfaces only, The tests
    brlock.tdb, The printing *.tdb Files
    (see also TDB)
    browse list, What is Browsing?, Technical Overview of browsing
    browseable, The [printers] Section, Any [my_printer_name] Section, Parameters in the [print$] Section

    C

    case sensitive, Miscellaneous Controls, Windows 9x / Me Profile Setup
    chpass, Manual Creation of Machine Trust Accounts
    comment, The [printers] Section, Any [my_printer_name] Section, Parameters in the [print$] Section
    configure, Building the Binaries
    connections.tdb, The printing *.tdb Files
    (see also TDB)
    core files, Internal errors
    create mask, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask + parameters
    csc policy, Miscellaneous Controls
    CUPS
    Page Accounting, Page Accounting with CUPS
    quotas, Setting up Quotas
    CUPS-PPD, cupsomatic, pdqomatic, lpdomatic, directomatic
    cupsaddsmb, Three familiar Methods for driver upload plus a new one, cupsaddsmb: the unknown Utility, Caveats to be considered, Run "cupsaddsmb" (quiet Mode), Run "cupsaddsmb" with verbose Output, Understanding cupsaddsmb, cupsaddsmb with a Samba PDC, cupsaddsmb Flowchart
    cupsomatic, CUPS can use all Windows-formatted Vendor PPDs, The CUPS Filtering Architecture, cupsomatic/Foomatic -- how do they fit into the Picture?, Difference between cupsomatic/foomatic-rip and +native CUPS printing, cupsomatic, pdqomatic, lpdomatic, directomatic
    CVS, Access Samba source code via CVS
    web, Access via CVSweb

    D

    daemon, Alternative: starting it as a daemon
    DDK, PostScript Drivers with no major problems -- even in Kernel +Mode, CUPS Package of "PostScript Driver for WinNT/2k/XP"
    debug, Internal errors
    debug level, Debugging with Samba itself, Log level
    debuglevel, Debug levels
    default case, Miscellaneous Controls
    delete printer command, Adding new Printers with the Windows NT APW
    deleteprinter command, Parameters Recommended for Use
    DHCP, Background Information
    diff, Patches
    directory mask, File and Directory Permissions Based Controls
    directory security mask, Interaction with the standard Samba create mask + parameters
    disable spoolss, Parameters Recommended for Use
    display charset, Samba and charsets
    DNS, TCP/IP - without NetBIOS, DNS Lookup
    Active Directory, DNS and Active Directory
    Dynamic, Background Information
    dns proxy, What is Browsing?
    domain admin group, Mapping MS Windows and UNIX Groups
    domain logons, Preparing for Domain Control
    domain master, Domain Network Logon Service, Example Configuration, What is Browsing?, Making Samba the domain master
    dont descend, Miscellaneous Controls
    dos charset, Samba and charsets, Japanese charsets, CP850.so can't be found
    dos filemode, File and Directory Permissions Based Controls
    dos filetime resolution, Miscellaneous Controls
    dos filetimes, Miscellaneous Controls

    E

    EMF, Windows Drivers, GDI and EMF, From Windows Clients to an NT Print Server, Driver Execution on the Server
    encrypt passwords, Joining an NT4 type Domain with Samba-3, smbpasswd - Encrypted Password Database, smb.conf PAM Configuration, The tests
    enhanced browsing, What is Browsing?
    enumports command, Parameters Recommended for Use, Samba and Printer Ports
    EPM (see ESP meta packager)
    ESC/P, Driver Execution on the Server
    ESP
    Ghostscript, The CUPS Filtering Architecture, Difference between cupsomatic/foomatic-rip and +native CUPS printing
    meta packager, CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Print Pro, Sources of CUPS drivers / PPDs, ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Extended Attributes, File, Directory and Share Access Controls

    F

    fake oplocks, Miscellaneous Controls
    File System, File System Access Controls
    foomatic, CUPS can use all Windows-formatted Vendor PPDs, The CUPS Filtering Architecture, cupsomatic/Foomatic -- how do they fit into the Picture?, Difference between cupsomatic/foomatic-rip and +native CUPS printing, foomatic-rip and Foomatic explained, Foomatic's strange Name
    foomatic-rip, Difference between cupsomatic/foomatic-rip and +native CUPS printing, CUPS Print Drivers from Linuxprinting.org, foomatic-rip and Foomatic explained, The Grand Unification +achieved...
    force create mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask + parameters
    force directory mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask + parameters
    force directory security mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask + parameters
    force group, User and Group Based Controls
    force security mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask + parameters
    force user, User and Group Based Controls, I have set force user but Samba still makes root the owner of all the files I touch!, Beware of Force User
    ftp, Accessing the samba sources via rsync and ftp

    G

    gdb, Internal errors
    GDI, GDI on Windows -- PostScript on UNIX, Windows Drivers, GDI and EMF, From Windows Clients to an NT Print Server, Driver Execution on the Server
    GhostScript, PostScript and Ghostscript, Ghostscript -- the Software RIP for non-PostScript Printers
    (see also PostScript)
    Ghostscript
    ESP (see ESP GhostScript)
    GID, Features and Benefits
    GPG, Verifying Samba's PGP signature
    groupadd, Features and Benefits
    groupdel, Features and Benefits
    groups
    domain, Discussion
    mapping, Mapping MS Windows and UNIX Groups
    nested, Adding MS Windows Groups to MS Windows Groups Fails
    guest account, Problem resolution, My client reports "This server is not configured to list shared resources", The [printers] Section
    guest ok, User and Group Based Controls, The [printers] Section, Any [my_printer_name] Section, Parameters in the [print$] Section

    H

    hide dot files, Miscellaneous Controls
    hide files, Miscellaneous Controls
    hide unreadable, File and Directory Permissions Based Controls
    hide unwriteable files, File and Directory Permissions Based Controls
    host msdfs, Features and Benefits
    hosts allow, Using host based protection, Parameters Recommended for Use, Any [my_printer_name] Section
    hosts deny, Using host based protection, Parameters Recommended for Use, Any [my_printer_name] Section

    I

    idmap gid, Features and Benefits, Winbind is not resolving users and groups
    idmap uid, Features and Benefits, Winbind is not resolving users and groups
    ifconfig, Starting from inetd.conf
    imprints, Three familiar Methods for driver upload plus a new one
    inetd, The tests, Starting the smbd and nmbd, Starting from inetd.conf
    Interdomain Trusts, Interdomain Trust Relationships
    completing, Completing an NT4 Domain Trust
    creating, Native MS Windows NT4 Trusts Configuration
    Facilities, Inter-Domain Trust Facilities
    interfaces, Multiple interfaces, The tests, Starting from inetd.conf
    invalid users, User and Group Based Controls
    IPP, Understanding cupsaddsmb

    K

    KDC, Samba ADS Domain Membership
    Kerberos, Samba ADS Domain Membership
    kinit, Setup your /etc/krb5.conf

    L

    ldap admin dn, Configuring Samba
    ldap delete dn, Configuring Samba
    ldap filter, Configuring Samba
    ldap machine suffix, Configuring Samba
    ldap passwd sync, Configuring Samba, Password synchronisation
    ldap ssl, Configuring Samba, Security and sambaSamAccount
    ldap suffix, Configuring Samba
    ldap trust ids, Configuring Samba
    ldap user suffix, Configuring Samba
    libnss_wins.so, /etc/nsswitch.conf
    Links
    hard, MS Windows NTFS Comparison with UNIX File Systems
    soft, MS Windows NTFS Comparison with UNIX File Systems
    Linuxprinting.org, CUPS Print Drivers from Linuxprinting.org
    lm announce, What is Browsing?
    lm interval, What is Browsing?
    LMB (see Local Master Browser)
    LMHOSTS, The LMHOSTS file
    load printers, Parameters Recommended for Use, A little Experiment to warn you, The [global] Section
    local master, What is Browsing?, Setting up WORKGROUP Browsing
    Local Master Browser, Use of the Remote Announce parameter
    locking, Discussion
    locking.tdb, The printing *.tdb Files
    (see also TDB)
    log files
    monitoring, Assumptions
    log level, Adding Machine to Domain Fails, extd_audit, Debug levels
    logon drive, Windows NT4 Workstation
    logon home, LDAP special attributes for sambaSamAccounts, Windows 9x / Me User Profiles, Mixed Windows 9x / Me and Windows NT4/200x User Profiles, Windows NT4 Workstation, Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    logon path, LDAP special attributes for sambaSamAccounts, Mixed Windows 9x / Me and Windows NT4/200x User Profiles, Windows 9x / Me Profile Setup, Windows NT4 Workstation, Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    logon script, LDAP special attributes for sambaSamAccounts
    lpadmin, CUPS Print Drivers from Linuxprinting.org, Setting up Quotas
    lppause command, Parameters Recommended for Use, Linking of smbd with libcups.so, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions
    lpq cache time, Parameters Recommended for Use, The [global] Section
    lpq command, Parameters Recommended for Use, Linking of smbd with libcups.so, Pre-conditions
    lpresume command, Parameters Recommended for Use, Linking of smbd with libcups.so, Pre-conditions
    lprm command, Parameters Recommended for Use, Linking of smbd with libcups.so, Pre-conditions
    lpstat, Troubleshooting revisited

    M

    MAC Addresses, /etc/hosts
    machine trust accounts, MS Windows Workstation/Server Machine Trust Accounts
    creating, MS Windows Workstation/Server Machine Trust Accounts
    make, Building the Binaries
    mangling method, Japanese charsets
    map to guest, Parameters in the [print$] Section, Adding new Printers with the Windows NT APW, Can't reconnect to Samba under new account + from Win2K/XP, Avoid being connected to the Samba server as the + "wrong" user
    max print jobs, Parameters Recommended for Use
    max xmit, Max xmit
    messages.tdb, The printing *.tdb Files
    (see also TDB)
    MIME, MIME types and CUPS Filters, MIME type Conversion Rules, Filter Requirements, "application/octet-stream" printing
    min print space, Parameters Recommended for Use
    msdfs root, Features and Benefits

    N

    name resolve order, What is Browsing?
    nbtstat, The NetBIOS Name Cache
    NetBIOS, Features and Benefits, TCP/IP - without NetBIOS, Integrating MS Windows networks with Samba, Name resolution as used within MS Windows networking
    NetBIOS-less, TCP/IP - without NetBIOS
    nmblookup, The NetBIOS Name Cache
    nt acl support, File and Directory Permissions Based Controls, Viewing file ownership, Viewing File or Directory Permissions, Modifying file or directory permissions, Windows 2000 Service Pack 2
    ntdrivers.tdb, The printing *.tdb Files
    (see also TDB)
    ntforms.tdb, The printing *.tdb Files
    (see also TDB)
    NTFS, File System Access Controls
    ntprinters.tdb, The printing *.tdb Files
    (see also TDB)

    O

    obey pam restrictions, smb.conf PAM Configuration
    only user, User and Group Based Controls, Why can users access home directories of other users?
    oplock break wait time, Advanced Samba Opportunistic Locking Parameters, Disabling Kernel OpLocks
    oplock contention limit, Advanced Samba Opportunistic Locking Parameters
    os level, What is Browsing?, Setting up WORKGROUP Browsing, Setting up DOMAIN Browsing, Forcing Samba to be the master, Making Samba the domain master
    os2 driver map, Parameters Recommended for Use, Printer driver download for for OS/2 clients?

    P

    page_log, The page_log File Syntax
    passdb backend, MS Windows Workstation/Server Machine Trust Accounts, Account Information Databases, Technical Information, The pdbedit Command, Configuring Samba, Configuring, Users can not logon, auth methods does not work, Passdb Backends and Authentication
    password level, Password checking, The tests, Case handling of passwords, Slow Logins
    password server, Server Security (User Level Security), Security Mode and Master Browsers, Joining an NT4 type Domain with Samba-3, The tests
    patch, Patches
    path, "The network name cannot be found", The [printers] Section, Any [my_printer_name] Section, Print Commands, Creating the [print$] Share, Parameters in the [print$] Section, Subdirectory Structure in [print$], Samba receiving Jobfiles and passing them to CUPS, Auto-Deletion or Preservation of CUPS Spool Files, Permissions on +/var/spool/samba/ get reset after each +reboot, The tests
    PCL, GDI on Windows -- PostScript on UNIX, UNIX Printfile Conversion and GUI Basics, Driver Execution on the Server, Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PDF, Windows Drivers, GDI and EMF, PostScript Printer Description (PPD) Specification
    pdf, MIME type Conversion Rules
    PDL, GDI on Windows -- PostScript on UNIX, PostScript and Ghostscript
    PJL, Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs, Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver, Adobe and CUPS PostScript Drivers for Windows Clients
    point and print, Driver Installation Methods on Windows Clients, Three familiar Methods for driver upload plus a new one, cupsomatic/Foomatic -- how do they fit into the Picture?, Run "cupsaddsmb" (quiet Mode), Installing the PostScript Driver on a Client, Manual Driver Installation in 15 Steps
    PostScript, Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download, GDI on Windows -- PostScript on UNIX, UNIX Printfile Conversion and GUI Basics, PostScript and Ghostscript, Prefilters, Driver Execution on the Server, Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs, CUPS: a "Magical Stone"?, CUPS Package of "PostScript Driver for WinNT/2k/XP"
    (see also Ghostscript)
    RIP, PostScript and Ghostscript
    PPD, PostScript and Ghostscript, PostScript Printer Description (PPD) Specification, PostScript Printer Descriptions (PPDs) for non-PS Printers, PPDs for non-PS Printers on UNIX, PPDs for non-PS Printers on Windows, CUPS: a "Magical Stone"?, Installing the PostScript Driver on a Client
    CUPS (see CUPS-PPD)
    preferred master, What is Browsing?, Setting up WORKGROUP Browsing, Forcing Samba to be the master, Making Samba the domain master, The tests
    preserve case, Windows 9x / Me Profile Setup
    print command, Parameters Recommended for Use, The [global] Section, Default Print Commands for various UNIX Print Subsystems, Setting up your own Print Commands, Linking of smbd with libcups.so, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions, Manual Configuration
    print ok , Parameters Recommended for Use
    printable, Parameters Recommended for Use, The [printers] Section, Any [my_printer_name] Section
    printcap, Parameters Recommended for Use, Default Print Commands for various UNIX Print Subsystems, Basic Configuration of CUPS support, Linking of smbd with libcups.so, More complex smb.conf Settings for +CUPS, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions
    printcap name, Parameters Recommended for Use, The [global] Section
    printer, Parameters Recommended for Use
    printer admin, Parameters Recommended for Use, The [global] Section, Any [my_printer_name] Section, Parameters in the [print$] Section, Setting Drivers for existing Printers with a Client GUI, IMPORTANT! Setting Device Modes on new Printers, Always make first Client Connection as root or "printer admin", Setting Default Print Options for the Client Drivers, Adding new Printers with the Windows NT APW, More complex smb.conf Settings for +CUPS, What is required for adddriver and setdriver to succeed, Print options for all users can't be set on Win2K/XP
    printer name, Parameters Recommended for Use
    printing, Parameters Recommended for Use, The [global] Section, Default Print Commands for various UNIX Print Subsystems, Setting up your own Print Commands, Basic Configuration of CUPS support, Linking of smbd with libcups.so, More complex smb.conf Settings for +CUPS, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions, Manual Configuration
    printing.tdb, The printing *.tdb Files
    (see also TDB)
    PrintPro (see ESP Print Pro)
    public, The [printers] Section

    Q

    queue resume command, Linking of smbd with libcups.so
    queuepause command, Parameters Recommended for Use, Linking of smbd with libcups.so
    queueresume command, Parameters Recommended for Use

    R

    read list, User and Group Based Controls
    read only, Miscellaneous Controls, The [printers] Section, Parameters in the [print$] Section
    read raw, Read raw
    read size, Read size
    remote announce, NetBIOS over TCP/IP, How Browsing Functions, Use of the Remote Announce parameter, Browsing support in Samba
    remote browse sync, NetBIOS over TCP/IP, How Browsing Functions, Use of the Remote Browse Sync parameter
    root preexec, Logon Scripts
    rpcclient
    adddriver, Run "cupsaddsmb" with verbose Output, Understanding cupsaddsmb, Installing PostScript Driver Files manually (using +rpcclient), Understanding the rpcclient man page, What is required for adddriver and setdriver to succeed, Manual Driver Installation in 15 Steps
    enumdrivers, Installing PostScript Driver Files manually (using +rpcclient), Manual Driver Installation in 15 Steps
    enumports, Installing PostScript Driver Files manually (using +rpcclient)
    enumprinters, Installing PostScript Driver Files manually (using +rpcclient), What is required for adddriver and setdriver to succeed, Manual Driver Installation in 15 Steps, Troubleshooting revisited
    getdriver, Producing an Example by querying a Windows Box, Manual Driver Installation in 15 Steps
    getprinter, Producing an Example by querying a Windows Box, Manual Driver Installation in 15 Steps, Troubleshooting revisited
    setdriver, Caveats to be considered, Run "cupsaddsmb" with verbose Output, Understanding cupsaddsmb, Installing PostScript Driver Files manually (using +rpcclient), What is required for adddriver and setdriver to succeed, Manual Driver Installation in 15 Steps
    rsync, Accessing the samba sources via rsync and ftp

    S

    secrets.tdb, The printing *.tdb Files
    (see also TDB)
    security, Samba Security Modes, Domain Security Mode (User Level Security), Server Security (User Level Security), What makes Samba a SERVER?, What makes Samba a Domain Controller?, What makes Samba a Domain Member?, Constantly Losing Connections to Password Server, Preparing for Domain Control, Security Mode and Master Browsers, Joining an NT4 type Domain with Samba-3, Why is this better than security = server?, Setup your smb.conf, Run "cupsaddsmb" (quiet Mode), "cupsaddsmb" keeps asking for root password in + neverending loop, Passdb Backends and Authentication, The tests, Configuring WfW password handling
    security mask, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask + parameters
    Server Manager, MS Windows Workstation/Server Machine Trust Accounts, Manual Creation of Machine Trust Accounts
    sessionid.tdb, The printing *.tdb Files
    (see also TDB)
    share_info.tdb, The printing *.tdb Files
    (see also TDB)
    short preserve case, Miscellaneous Controls, Windows 9x / Me Profile Setup
    Short-Cuts, MS Windows NTFS Comparison with UNIX File Systems
    show add printer wizard, Parameters Recommended for Use, The [global] Section, Adding new Printers with the Windows NT APW
    SID, Features and Benefits
    Single Sign On, Caveats to be considered
    smbclient, Testing with smbclient, The tests
    socket options, Socket options
    spooling
    central, Central spooling vs. "Peer-to-Peer" printing
    peer-to-peer, Central spooling vs. "Peer-to-Peer" printing
    spooling-only, CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    strict locking, Discussion

    T

    TDB, The printing *.tdb Files, Trivial DataBase Files
    backing up (see tdbbackup)
    tdbbackup, Using tdbbackup
    template homedir, Linux/FreeBSD-specific PAM configuration
    testparm, The tests
    text/plain, MIME type Conversion Rules
    total print jobs, Parameters Recommended for Use, The [global] Section

    U

    UDP, NetBIOS over TCP/IP
    UID, Features and Benefits
    unexpected.tdb, The printing *.tdb Files
    (see also TDB)
    unix charset, Samba and charsets, Japanese charsets
    use client driver, Parameters Recommended for Use, The [global] Section
    user, Share Level Security, The tests
    User Manager, Samba as the Trusted Domain, Samba as the Trusting Domain
    useradd, Manual Creation of Machine Trust Accounts
    username, User and Group Based Controls
    username level, Password checking
    username map, Windows 200x XP Professional

    V

    valid users, User and Group Based Controls, The tests
    veto files, Miscellaneous Controls
    vfs objects, Discussion
    vipw, Manual Creation of Machine Trust Accounts

    W

    winbind separator, Start up the winbindd daemon and test it!
    WINS, What is Browsing?, NetBIOS over TCP/IP, WINS Lookup
    wins hook, What is Browsing?
    wins proxy, What is Browsing?
    wins server, What is Browsing?, WINS - The Windows Internetworking Name Server, Setting up a WINS server
    wins support, What is Browsing?, WINS - The Windows Internetworking Name Server, Setting up a WINS server
    workgroup, Security Mode and Master Browsers, Joining an NT4 type Domain with Samba-3, Browsing support in Samba
    write list, User and Group Based Controls, Parameters in the [print$] Section
    write raw, Write raw
    writeable, The [printers] Section, Any [my_printer_name] Section
    WYSIWYG, Windows Drivers, GDI and EMF

    X

    X Window System, UNIX Printfile Conversion and GUI Basics
    xinetd, Starting from inetd.conf (see inetd)
    Xprint, UNIX Printfile Conversion and GUI Basics
    diff --git a/docs/htmldocs/SambaHA.html b/docs/htmldocs/SambaHA.html index ba82f6ad0f..39ab6b91d8 100644 --- a/docs/htmldocs/SambaHA.html +++ b/docs/htmldocs/SambaHA.html @@ -1,4 +1,4 @@ -Chapter 29. High Availability Options
    Chapter 29. High Availability Options
    Prev Part III. Advanced Configuration Next

    Chapter 29. High Availability Options

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +Chapter 29. High Availability Options

    Chapter 29. High Availability Options
    Prev Part III. Advanced Configuration Next

    Chapter 29. High Availability Options

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Prev Up Next
    Chapter 28. Samba Backup Techniques Home Part IV. Migration and Updating
    +

    Prev Up Next
    Chapter 28. Samba Backup Techniques Home Part IV. Migration and Updating
    diff --git a/docs/htmldocs/ServerType.html b/docs/htmldocs/ServerType.html index 01f03662ae..7b5b7117a6 100644 --- a/docs/htmldocs/ServerType.html +++ b/docs/htmldocs/ServerType.html @@ -1,4 +1,4 @@ -Chapter 4. Server Types and Security Modes
    Chapter 4. Server Types and Security Modes
    Prev Part II. Server Configuration Basics Next

    Chapter 4. Server Types and Security Modes

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Seamless Windows Network Integration
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server

    +Chapter 4. Server Types and Security Modes

    Chapter 4. Server Types and Security Modes
    Prev Part II. Server Configuration Basics Next

    Chapter 4. Server Types and Security Modes

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password checking
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server

    This chapter provides information regarding the types of server that Samba may be configured to be. A Microsoft network administrator who wishes to migrate to or to use Samba will want to know what, within a Samba context, terms familiar to MS Windows @@ -8,10 +8,11 @@ modes function BEFORE we get into the details of how to configure the server its The chapter provides an overview of the security modes of which Samba is capable and how these relate to MS Windows servers and clients.

    -Firstly we should recognise the question so often asked, "Why would I want to use Samba?" -So, in those chapters where the answer may be important you will see a section that highlights -features and benefits. These may be for or against Samba. -

    Features and Benefits

    +A question often asked is, "Why would I want to use Samba?" Most chapters contain a section +that highlights features and benefits. We hope that the information provided will help to +answer this question. Be warned though, we want to be fair and reasonable, so not all +features are positive towards Samba so the benefit may be on the side of our competition. +

    Features and Benefits

    Two men were walking down a dusty road, when one suddenly kicked up a small red stone. It hurt his toe and lodged in his sandal. He took the stone out and cursed it with a passion and fury fitting his anguish. The other looked at the stone and said, that is a garnet - I @@ -23,7 +24,7 @@ pleasure, but if you are forced upon it and have no time for its secrets then it a source of discomfort.

    Samba started out as a project that sought to provide interoperability for MS Windows 3.x -clients with a Unix server. It has grown up a lot since its humble beginnings and now provides +clients with a UNIX server. It has grown up a lot since its humble beginnings and now provides features and functionality fit for large scale deployment. It also has some warts. In sections like this one we will tell of both.

    @@ -47,14 +48,14 @@ So now, what are the benefits of features mentioned in this chapter? greater flexibility than MS Windows NT4 and in many cases a significantly higher utility than Active Directory domains with MS Windows 200x. -

    Server Types

    Administrators of Microsoft networks often refer to three -different type of servers:

    • Domain Controller

      Primary Domain Controller
      Backup Domain Controller
      ADS Domain Controller

    • Domain Member Server

      Active Directory Member Server
      NT4 Style Domain Member Server

    • Stand Alone Server

    +

    Server Types

    Administrators of Microsoft networks often refer to three +different type of servers:

    • Domain Controller

      • Primary Domain Controller

      • Backup Domain Controller

      • ADS Domain Controller

    • Domain Member Server

      • Active Directory Domain Server

      • NT4 Style Domain Domain Server

    • Stand Alone Server

    The chapters covering Domain Control, Backup Domain Control and Domain Membership provide -pertinent information regarding Samba-3 configuration for each of these server roles. +pertinent information regarding Samba configuration for each of these server roles. The reader is strongly encouraged to become intimately familiar with the information presented. -

    Samba Security Modes

    -In this section the function and purpose of Samba's security +

    Samba Security Modes

    +In this section the function and purpose of Samba's security modes are described. An accurate understanding of how Samba implements each security mode as well as how to configure MS Windows clients for each mode will significantly reduce user complaints and administrator heartache. @@ -69,7 +70,7 @@ ways that allow the security levels to be implemented. In actual fact, Samba imp ADS, and SERVER modes. They are documented in this chapter.

    -A SMB server tells the client at startup what security level + A SMB server tells the client at startup what security level it is running. There are two options: share level and user level. Which of these two the client receives affects the way the client then tries to authenticate itself. It does not directly affect @@ -77,8 +78,8 @@ the way the client then tries to authenticate itself. It does not directly affec but it fits in with the client/server approach of SMB. In SMB everything is initiated and controlled by the client, and the server can only tell the client what is available and whether an action is allowed. -

    User Level Security

    -We will describe user level security first, as it's simpler. +

    User Level Security

    +We will describe user level security first, as it's simpler. In user level security, the client will send a session setup command directly after the protocol negotiation. This contains a username and password. The server can either accept or reject that @@ -95,13 +96,11 @@ It is also possible for a client to send multiple ses requests. When the server responds, it gives the client a uid to use as an authentication tag for that username/password. The client can maintain multiple authentication contexts in this way (WinDD is an example of an application that does this). -

    Example Configuration

    +

    Example Configuration

    The smb.conf parameter that sets User Level Security is: -

    -	security = user
-

    +

    security = user

    This is the default setting since samba-2.2.x. -

    Share Level Security

    +

    Share Level Security

    Ok, now for share level security. In share level security, the client authenticates itself separately for each share. It will send a password along with each tree connection (share mount). It does not explicitly send a @@ -121,104 +120,92 @@ level security. They normally send a valid username but no password. Samba recor this username in a list of possible usernames. When the client then does a tree connection it also adds to this list the name of the share they try to connect to (useful for home directories) and any users -listed in the user = smb.conf line. The password is then checked +listed in the user smb.conf line. The password is then checked in turn against these possible usernames. If a match is found then the client is authenticated as that user. -

    Example Configuration

    +

    Example Configuration

    The smb.conf parameter that sets Share Level Security is: -

    -	security = share
-

    +

    security = share

    Please note that there are reports that recent MS Windows clients do not like to work with share mode security servers. You are strongly discouraged from using share level security. -

    Domain Security Mode (User Level Security)

    -When Samba is operating in security = domain mode, +

    Domain Security Mode (User Level Security)

    +When Samba is operating in security = domain mode, the Samba server has a domain security trust account (a machine account) and will cause all authentication requests to be passed through to the domain controllers. -

    Example Configuration

    +

    Example Configuration

    Samba as a Domain Member Server

    This method involves addition of the following parameters in the smb.conf file: -

    -        security = domain
-        workgroup = "name_of_NT_domain"
-

    +

    security = domain
    workgroup = MIDEARTH

    In order for this method to work, the Samba server needs to join the MS Windows NT security domain. This is done as follows:

    1. On the MS Windows NT domain controller, using the Server Manager, add a machine account for the Samba server. -

    2. Next, on the Unix/Linux system execute:

      root# smbpasswd -j DOMAIN_NAME -r PDC_NAME (samba-2.x)

      root# net join -U administrator%password (samba-3)

    Note

    -As of Samba-2.2.4 the Samba 2.2.x series can auto-join a Windows NT4 style Domain just -by executing: +

  • Next, on the UNIX/Linux system execute:

    root# net rpc join -U administrator%password

    • Note

    +Samba-2.2.4 and later can auto-join a Windows NT4 style Domain just by executing: 

    -root# smbpasswd -j DOMAIN_NAME -r PDC_NAME -U Administrator%password
+root# smbpasswd -j DOMAIN_NAME -r PDC_NAME \
+	 -U Administrator%password

    -As of Samba-3 the same can be done by executing: +Samba-3 can do the same by executing: 

    -root# net join -U Administrator%password
+root# net rpc join -U Administrator%password

    -It is not necessary with Samba-3 to specify the DOMAIN_NAME or the PDC_NAME as it -figures this out from the smb.conf file settings. +It is not necessary with Samba-3 to specify the DOMAIN_NAME or the +PDC_NAME as it figures this out from the smb.conf file settings.

    -Use of this mode of authentication does require there to be a standard Unix account -for each user in order to assign a uid once the account has been authenticated by +Use of this mode of authentication does require there to be a standard UNIX account +for each user in order to assign a UID once the account has been authenticated by the remote Windows DC. This account can be blocked to prevent logons by clients other than -MS Windows through things such as setting an invalid shell in the +MS Windows through means such as setting an invalid shell in the /etc/passwd entry.

    An alternative to assigning UIDs to Windows users on a Samba member server is -presented in the Winbind Overview chapter -in this HOWTO collection. +presented in the chapter about winbind.

    -For more information of being a domain member, see the Domain -Member section of this Howto. -

    ADS Security Mode (User Level Security)

    + For more information of being a domain member, see the chapter about domain membership. +

    ADS Security Mode (User Level Security)

    Both Samba 2.2 and 3.0 can join an Active Directory domain. This is -possible even if the domain is run in native mode. Active Directory in -native mode perfectly allows NT4-style domain members, contrary to +possible if the domain is run in native mode. Active Directory in +native mode perfectly allows NT4-style domain members. This is contrary to popular belief. The only thing that Active Directory in native mode prohibits is Backup Domain Controllers running NT4.

    -If you are running Active Directory starting with Samba 3.0 you can -however join as a native AD member. Why would you want to do that? +If you are using Active Directory, starting with Samba-3 you can +join as a native AD member. Why would you want to do that? Your security policy might prohibit the use of NT-compatible authentication protocols. All your machines are running Windows 2000 -and above and all use full Kerberos. In this case Samba as a NT4-style +and above and all use Kerberos. In this case Samba as a NT4-style domain would still require NT-compatible authentication data. Samba in -AD-member mode can accept Kerberos. -

    Example Configuration

    -	realm = your.kerberos.REALM
-	security = ADS
-

    - The following parameter may be required: -

    -	ads server = your.kerberos.server
-

    -Please refer to the Domain Membership and Active Directory -Membership sections for more information regarding this configuration option. -

    Server Security (User Level Security)

    +AD-member mode can accept Kerberos tickets. +

    Example Configuration

    realm = your.kerberos.REALM
    security = ADS

    +The following parameter may be required: +

    ads server = your.kerberos.server

    +Please refer to the chapter on domain membership +for more information regarding this configuration option. +

    Server Security (User Level Security)

    Server security mode is a left over from the time when Samba was not capable of acting as a domain member server. It is highly recommended NOT to use this feature. Server security mode has many draw backs. The draw backs include: -

    Potential Account Lockout on MS Windows NT4/200x password servers
    Lack of assurance that the password server is the one specified
    Does not work with Winbind, particularly needed when storing profiles remotely
    This mode may open connections to the password server, and keep them open for extended periods.
    Security on the Samba server breaks badly when the remote password server suddenly shuts down
    With this mode there is NO security account in the domain that the password server belongs to for the Samba server.

    +

    • Potential Account Lockout on MS Windows NT4/200x password servers

    • Lack of assurance that the password server is the one specified

    • Does not work with Winbind, particularly needed when storing profiles remotely

    • This mode may open connections to the password server, and keep them open for extended periods.

    • Security on the Samba server breaks badly when the remote password server suddenly shuts down

    • With this mode there is NO security account in the domain that the password server belongs to for the Samba server.

    In server security mode the Samba server reports to the client that it is in user level security. The client then does a session setup as described earlier. The Samba server takes the username/password that the client sends and attempts to login to the -password server by sending exactly the same username/password that +password server by sending exactly the same username/password that it got from the client. If that server is in user level security and accepts the password, then Samba accepts the clients connection. This allows the Samba server to use another SMB -server as the password server. +server as the password server.

    You should also note that at the very start of all this, where the server tells the client what security level it is in, it also tells the client if it supports encryption. If it does then it supplies the client with a random cryptkey. The client will then send all passwords in encrypted form. Samba supports this type of encryption by default.

    -The parameter security = server means that Samba reports to clients that +The parameter security = server means that Samba reports to clients that it is running in user mode but actually passes off all authentication requests to another user mode server. This requires an additional -parameter password server that points to the real authentication server. +parameter password server that points to the real authentication server. That real authentication server can be another Samba server or can be a Windows NT server, the later natively capable of encrypted password support.

    Note

    @@ -229,17 +216,13 @@ lookups because the choice of the target authentication server is arbitrary and be determined from a domain name. In essence, a Samba server that is in server security mode is operating in what used to be known as workgroup mode. -

    Example Configuration

    +

    Example Configuration

    Using MS Windows NT as an authentication server

    This method involves the additions of the following parameters in the smb.conf file: -

    -        encrypt passwords = Yes
-        security = server
-        password server = "NetBIOS_name_of_a_DC"
-

    -There are two ways of identifying whether or not a username and password pair was valid -or not. One uses the reply information provided as part of the authentication messaging +

    encrypt passwords = Yes
    security = server
    password server = "NetBIOS_name_of_a_DC"

    +There are two ways of identifying whether or not a username and password pair was valid. +One uses the reply information provided as part of the authentication messaging process, the other uses just an error code.

    The down-side of this mode of configuration is the fact that for security reasons Samba @@ -248,9 +231,9 @@ server fails to reject the username and password pair then an alternative mode o identification of validation is used. Where a site uses password lock out after a certain number of failed authentication attempts this will result in user lockouts.

    -Use of this mode of authentication does require there to be a standard Unix account +Use of this mode of authentication does require there to be a standard UNIX account for the user, though this account can be blocked to prevent logons by non-SMB/CIFS clients. -

    Seamless Windows Network Integration

    +

    Password checking

    MS Windows clients may use encrypted passwords as part of a challenge/response authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or clear text strings for simple password based authentication. It should be realized that with the SMB protocol, @@ -287,29 +270,26 @@ is definitely not a good idea to re-enable plain text password support in such c The following parameters can be used to work around the issue of Windows 9x clients upper casing usernames and password before transmitting them to the SMB server when using clear text authentication. -

    -        password level = integer
-        username level = integer
-

    +

    password level = integer
    username level = integer

    By default Samba will lower case the username before attempting to lookup the user in the database of local system accounts. Because UNIX usernames conventionally -only contain lower case character, the username level parameter +only contain lower-case character, the username level parameter is rarely needed.

    -However, passwords on UNIX systems often make use of mixed case characters. +However, passwords on UNIX systems often make use of mixed-case characters. This means that in order for a user on a Windows 9x client to connect to a Samba -server using clear text authentication, the password level -must be set to the maximum number of upper case letter which could -appear is a password. Note that the server OS uses the traditional DES version -of crypt(), a password level of 8 will result in case +server using clear text authentication, the password level +must be set to the maximum number of upper case letters which could +appear in a password. Note that if the server OS uses the traditional DES version +of crypt(), a password level of 8 will result in case insensitive passwords as seen from Windows users. This will also result in longer login times as Samba has to compute the permutations of the password string and try them one by one until a match is located (or all combinations fail).

    -The best option to adopt is to enable support for encrypted passwords where ever +The best option to adopt is to enable support for encrypted passwords wherever Samba is used. Most attempts to apply the registry change to re-enable plain text passwords will eventually lead to user complaints and unhappiness. -

    Common Errors

    +

    Common Errors

    We all make mistakes. It is Ok to make mistakes, so long as they are made in the right places and at the right time. A mistake that causes lost productivity is seldom tolerated. A mistake made in a developmental test lab is expected. @@ -319,25 +299,26 @@ on the Samba mailing lists. Many of these are avoidable by doing you homework be a Samba implementation. Some are the result of misunderstanding of the English language. The English language has many turns of phrase that are potentially vague and may be highly confusing to those for whom English is not their native tongue. -

    What makes Samba a SERVER?

    +

    What makes Samba a SERVER?

    To some the nature of the Samba security mode is very obvious, but entirely -wrong all the same. It is assumed that security = server means that Samba +wrong all the same. It is assumed that security = server means that Samba will act as a server. Not so! See above - this setting means that Samba will try to use another SMB server as its source of user authentication alone. -

    What makes Samba a Domain Controller?

    -The smb.conf parameter security = domain does NOT really make Samba behave +

    What makes Samba a Domain Controller?

    +The smb.conf parameter security = domain does NOT really make Samba behave as a Domain Controller! This setting means we want Samba to be a domain member! -

    What makes Samba a Domain Member?

    -Guess! So many others do. But whatever you do, do NOT think that security = user +

    What makes Samba a Domain Member?

    +Guess! So many others do. But whatever you do, do NOT think that security = user makes Samba act as a domain member. Read the manufacturers manual before the warranty expires! See -the Domain Member section of this Howto for more information. -

    Constantly Losing Connections to Password Server

    +the chapter about domain membership for more information. +

    Constantly Losing Connections to Password Server

    + “ Why does server_validate() simply give up rather than re-establishing its connection to the password server? Though I am not fluent in the SMB protocol, perhaps the cluster server process passes along to its client workstation the session key it receives from the password server, which means the password hashes submitted by the client would not work on a subsequent -connection, whose session key would be different. So server_validate() must give up. +connection, whose session key would be different. So server_validate() must give up.”

    -Indeed. That's why security = server is at best a nasty hack. Please use security = domain. -security = server mode is also known as pass-through authentication. -

    Prev Up Next
    Part II. Server Configuration Basics Home Chapter 5. Domain Control
    + Indeed. That's why security = server is at best a nasty hack. Please use security = domain. +security = server mode is also known as pass-through authentication. +

    Prev Up Next
    Part II. Server Configuration Basics Home Chapter 5. Domain Control
    diff --git a/docs/htmldocs/StandAloneServer.html b/docs/htmldocs/StandAloneServer.html index a3bdf439af..f85fdfe3fc 100644 --- a/docs/htmldocs/StandAloneServer.html +++ b/docs/htmldocs/StandAloneServer.html @@ -1,9 +1,9 @@ -Chapter 8. Stand-Alone Servers
    Chapter 8. Stand-Alone Servers
    Prev Part II. Server Configuration Basics Next

    Chapter 8. Stand-Alone Servers

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors

    +Chapter 8. Stand-Alone Servers

    Chapter 8. Stand-Alone Servers
    Prev Part II. Server Configuration Basics Next

    Chapter 8. Stand-Alone Servers

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors

    Stand-Alone servers are independent of Domain Controllers on the network. They are NOT domain members and function more like workgroup servers. In many cases a stand-alone server is configured with a minimum of security control with the intent that all data served will be readily accessible to all users. -

    Features and Benefits

    +

    Features and Benefits

    Stand-Alone servers can be as secure or as insecure as needs dictate. They can have simple or complex configurations. Above all, despite the hoopla about Domain security they remain a very common installation. @@ -20,7 +20,7 @@ that are queued off a single central server. Everyone needs to be able to print to the printers, there is no need to affect any access controls and no files will be served from the print server. Again a share mode stand-alone server makes a great solution. -

    Background

    +

    Background

    The term stand-alone server means that the server will provide local authentication and access control for all resources that are available from it. In general this means that there will be a @@ -42,50 +42,37 @@ local or on a remote server, even if from the Samba protocol perspective the Samba server is NOT a member of a domain security context.

    Through the use of PAM (Pluggable Authentication Modules) and nsswitch -(the name service switcher) the source of authentication may reside on +(the name service switcher, which maintains the unix user database) the source of authentication may reside on another server. We would be inclined to call this the authentication server. -This means that the Samba server may use the local Unix/Linux system password database +This means that the Samba server may use the local UNIX/Linux system password database (/etc/passwd or /etc/shadow), may use a local smbpasswd file, or may use an LDAP back end, or even via PAM and Winbind another CIFS/SMB server for authentication. -

    Example Configuration

    +

    Example Configuration

    The following examples are designed to inspire simplicity. It is too easy to attempt a high level of creativity and to introduce too much complexity in server and network design. -

    Reference Documentation Server

    +

    Reference Documentation Server

    Configuration of a read-only data server that EVERYONE can access is very simple. Here is the smb.conf file that will do this. Assume that all the reference documents are stored in the directory /export, that the documents are owned by a user other than nobody. No home directories are shared, that are no users in the /etc/passwd -Unix system database. This is a very simple system to administer. -

    -	# Global parameters
-	[global]
-		workgroup = MYGROUP
-		netbios name = REFDOCS
-		security = SHARE
-		passdb backend = guest
-		wins server = 192.168.1.1
-
-	[data]
-		comment = Data
-		path = /export
-		guest only = Yes
-

    +UNIX system database. This is a very simple system to administer. +

    Example 8.1. smb.conf for Reference Documentation Server

    # Global parameters
    [global]
    workgroup = MIDEARTH
    netbios name = GANDALF
    security = SHARE
    passdb backend = guest
    wins server = 192.168.1.1
    [data]
    comment = Data
    path = /export
    guest only = Yes

    In the above example the machine name is set to REFDOCS, the workgroup is set to the name of the local workgroup so that the machine will appear in with systems users are familiar with. The only password backend required is the "guest" backend so as to allow default unprivileged account names to be used. Given that there is a WINS server on this network we do use it. -

    Central Print Serving

    +

    Central Print Serving

    Configuration of a simple print server is very simple if you have all the right tools on your system.

    Assumptions:

    1. The print server must require no administration

    2. The print spooling and processing system on our print server will be CUPS. - (Please refer to the CUPS Printing chapter for more information). + (Please refer to the chapter about CUPS for more information).

    3. All printers that the print server will service will be network printers. They will be correctly configured, by the administrator, @@ -99,45 +86,27 @@ In this example our print server will spool all incoming print jobs to Samba to the CUPS print processor. Since all incoming connections will be as the anonymous (guest) user, two things will be required:

      Enabling Anonymous Printing

      • - The Unix/Linux system must have a guest account. + The UNIX/Linux system must have a guest account. The default for this is usually the account nobody. To find the correct name to use for your version of Samba do the following: - 

        +
         $ testparm -s -v | grep "guest account"
-	
        
+

        Then make sure that this account exists in your system password database (/etc/passwd).

      • The directory into which Samba will spool the file must have write access for the guest account. The following commands will ensure that this directory is available for use: - 

        +
         root# mkdir /var/spool/samba
 root# chown nobody.nobody /var/spool/samba
 root# chmod a+rwt /var/spool/samba
-	
        
-

      -

      -	# Global parameters
-	[global]
-		workgroup = MYGROUP
-		netbios name = PTRSVR1
-		security = SHARE
-		passdb backend = guest
-		wins server = 192.168.1.1
-
-	[printers]
-		comment = All Printers
-		path = /var/spool/samba
-		printer admin = root
-		guest ok = Yes
-		printable = Yes
-		printing = cups
-		use client driver = Yes
-		browseable = No

      -

    Common Errors

    +

    +

    Example 8.2. smb.conf for anonymous printing

    # Global parameters
    [global]
    workgroup = MIDEARTH
    netbios name = GANDALF
    security = SHARE
    passdb backend = guest
    wins server = noldor
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    printer admin = root
    guest ok = Yes
    printable = Yes
    use client driver = Yes
    browseable = No

    +

    Common Errors

    The greatest mistake so often made is to make a network configuration too complex. It pays to use the simplest solution that will meet the needs of the moment. -

    Prev Up Next
    Chapter 7. Domain Membership Home Chapter 9. MS Windows Network Configuration Guide
    +

    Prev Up Next
    Chapter 7. Domain Membership Home Chapter 9. MS Windows Network Configuration Guide
    diff --git a/docs/htmldocs/VFS.html b/docs/htmldocs/VFS.html index 6b520d792a..ffa767e6c9 100644 --- a/docs/htmldocs/VFS.html +++ b/docs/htmldocs/VFS.html @@ -1,26 +1,19 @@ -Chapter 20. Stackable VFS modules
    Chapter 20. Stackable VFS modules
    Prev Part III. Advanced Configuration Next

    Chapter 20. Stackable VFS modules

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Tim Potter

    Simo Sorce

    original vfs_skel README

    Alexander Bokovoy

    original vfs_netatalk docs

    Stefan Metzmacher

    Update for multiple modules

    Table of Contents

    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    Common Errors

    Features and Benefits

    +Chapter 20. Stackable VFS modules

    Chapter 20. Stackable VFS modules
    Prev Part III. Advanced Configuration Next

    Chapter 20. Stackable VFS modules

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Tim Potter

    Simo Sorce

    original vfs_skel README

    Alexander Bokovoy

    original vfs_netatalk docs

    Stefan Metzmacher

    Update for multiple modules

    Table of Contents

    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan

    Features and Benefits

    Since Samba-3, there is support for stackable VFS(Virtual File System) modules. Samba passes each request to access the unix file system thru the loaded VFS modules. This chapter covers all the modules that come with the samba source and references to some external modules. -

    Discussion

    +

    Discussion

    If not supplied with your platform distribution binary Samba package you may have problems to compile these modules, as shared libraries are compiled and linked in different ways on different systems. They currently have been tested against GNU/Linux and IRIX.

    To use the VFS modules, create a share similar to the one below. The -important parameter is the vfs objects parameter where +important parameter is the vfs objects parameter where you can list one or more VFS modules by name. For example, to log all access to files and put deleted files in a recycle bin: -

    -[audit]
-        comment = Audited /data directory
-        path = /data
-        vfs objects = audit recycle
-        writeable = yes
-        browseable = yes
-

    +

    Example 20.1. smb.conf with VFS modules

    [audit]
    comment = Audited /data directory
    path = /data
    vfs objects = audit recycle
    writeable = yes
    browseable = yes

    The modules are used in the order in which they are specified.

    @@ -32,46 +25,52 @@ directory in the root directory of the samba installation (usually Some modules can be used twice for the same share. This can be done using a configuration similar to the one below. -

    -[test]
-        comment = VFS TEST
-        path = /data
-        writeable = yes
-        browseable = yes
-        vfs objects = example:example1 example example:test
-		example1: parameter = 1
-		example:  parameter = 5
-		test:	  parameter = 7
-

    -

    Included modules

    audit

    +

    Example 20.2. smb.conf with multiple VFS modules

    [test]
    comment = VFS TEST
    path = /data
    writeable = yes
    browseable = yes
    vfs objects = example:example1 example example:test
    example1: parameter = 1
    example: parameter = 5
    test: parameter = 7

    +

    Included modules

    audit

    A simple module to audit file access to the syslog facility. The following operations are logged: -

    share
    connect/disconnect
    directory opens/create/remove
    file open/close/rename/unlink/chmod

    -

    extd_audit

    +

    • share

    • connect/disconnect

    • directory opens/create/remove

    • file open/close/rename/unlink/chmod

    +

    extd_audit

    This module is identical with the audit module above except that it sends audit logs to both syslog as well as the smbd log file/s. The loglevel for this module is set in the smb.conf file.

    The logging information that will be written to the smbd log file is controlled by - the log level parameter in smb.conf. The + the log level parameter in smb.conf. The following information will be recorded: -

    Table 20.1. Extended Auditing Log Information

    Log LevelLog Details - File and Directory Operations
    0Creation / Deletion
    1Create / Delete / Rename / Permission Changes
    2Create / Delete / Rename / Perm Change / Open / Close

    fake_perms

    +

    Table 20.1. Extended Auditing Log Information

    Log LevelLog Details - File and Directory Operations
    0Creation / Deletion
    1Create / Delete / Rename / Permission Changes
    2Create / Delete / Rename / Perm Change / Open / Close

    fake_perms

    This module was created to allow Roaming Profile files and directories to be set (on the Samba server under Unix) as read only. This module will if installed on the Profiles share will report to the client that the Profile files and directories are writable. This satisfies the client even though the files will never be overwritten as the client logs out or shuts down. -

    recycle

    +

    recycle

    A recycle-bin like module. When used any unlink call will be intercepted and files moved to the recycle - directory instead of being deleted. + directory instead of being deleted. This gives the same + effect as the "Recycle Bin" on Windows computers.

    Supported options: -

    recycle:repository

    FIXME

    recycle:keeptree

    FIXME

    recycle:versions

    FIXME

    recycle:touch

    FIXME

    recycle:maxsize

    FIXME

    recycle:exclude

    FIXME

    recycle:exclude_dir

    FIXME

    recycle:noversions

    FIXME

    -

    netatalk

    +

    recycle:repository

    Relative path of the directory where deleted files should be moved to

    recycle:keeptree

    Specifies whether the directory structure should + be kept or if the files in the directory that is being + deleted should be kept seperately in the recycle bin. +

    recycle:versions

    If this option is set, two files + with the same name that are deleted will both + be kept in the recycle bin. Newer deleted versions + of a file will be called "Copy #x of filename".

    recycle:touch

    Specifies whether a file's access + date should be touched when the file is moved to + the recycle bin.

    recycle:maxsize

    Files that are larger than the number + of bytes specified by this parameter will + not be put into the recycle bin.

    recycle:exclude

    List of files that should not + be put into the recycle bin when deleted, but deleted + in the regular way.

    recycle:exclude_dir

    Contains a list of directories. When files from + these directories are deleted, they are not put into the + recycle bin, but deleted in the regular way. +

    recycle:noversions

    Opposite of recycle:versions. If both options are specified, this one takes precedence.

    +

    netatalk

    A netatalk module, that will ease co-existence of samba and netatalk file sharing services.

    Advantages compared to the old netatalk module: -

    it doesn't care about creating of .AppleDouble forks, just keeps them in sync
    if a share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically

    -

    VFS modules available elsewhere

    +

    • it doesn't care about creating of .AppleDouble forks, just keeps them in sync

    • if a share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically

    +

    VFS modules available elsewhere

    This section contains a listing of various other VFS modules that have been posted but don't currently reside in the Samba CVS tree for one reason or another (e.g. it is easy for the maintainer @@ -79,7 +78,7 @@ to have his or her own CVS tree).

    No statements about the stability or functionality of any module should be implied due to its presence here. -

    DatabaseFS

    +

    DatabaseFS

    URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php

    By Eric Lorimer.

    I have created a VFS module which implements a fairly complete read-only @@ -94,12 +93,10 @@ should be implied due to its presence here. Any feedback would be appreciated: comments, suggestions, patches, etc... If nothing else, hopefully it might prove useful for someone else who wishes to create a virtual filesystem. -

    vscan

    URL: http://www.openantivirus.org/

    +

    vscan

    URL: http://www.openantivirus.org/

    samba-vscan is a proof-of-concept module for Samba, which uses the VFS (virtual file system) features of Samba 2.2.x/3.0 alphaX. Of course, Samba has to be compiled with VFS support. samba-vscan supports various virus scanners and is maintained by Rainer Link. -

    Common Errors

    -There must be some gotchas we should record here! Jelmer??? -

    Prev Up Next
    Chapter 19. CUPS Printing Support in Samba 3.0 Home Chapter 21. Integrated Logon Support using Winbind
    +

    Prev Up Next
    Chapter 19. CUPS Printing Support in Samba 3.0 Home Chapter 21. Winbind: Use of Domain Accounts
    diff --git a/docs/htmldocs/bugreport.html b/docs/htmldocs/bugreport.html index 9ae4797d31..49eb2117ca 100644 --- a/docs/htmldocs/bugreport.html +++ b/docs/htmldocs/bugreport.html @@ -1,4 +1,4 @@ -Chapter 35. Reporting Bugs
    Chapter 35. Reporting Bugs
    Prev Part V. Troubleshooting Next

    Chapter 35. Reporting Bugs

    Jelmer R. Vernooij

    The Samba Team

    Someone; Tridge or Karl Auer perhaps?

    27 June 1997

    Table of Contents

    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Introduction

    Please report bugs using +Chapter 35. Reporting Bugs

    Chapter 35. Reporting Bugs
    Prev Part V. Troubleshooting Next

    Chapter 35. Reporting Bugs

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    27 June 1997

    Table of Contents

    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Introduction

    Please report bugs using bugzilla.

    Please take the time to read this file before you submit a bug report. Also, please see if it has changed between releases, as we @@ -20,7 +20,7 @@ that list that may be able to help you. You may also like to look though the recent mailing list archives, which are conveniently accessible on the Samba web pages at http://samba.org/samba/. -

    General info

    +

    General info

    Before submitting a bug report check your config for silly errors. Look in your log files for obvious messages that tell you that you've misconfigured something and run testparm to test your config @@ -32,42 +32,38 @@ This is very important. If you include part of a log file with your bug report then be sure to annotate it with exactly what you were doing on the client at the time, and exactly what the results were. -

    Debug levels

    +

    Debug levels

    If the bug has anything to do with Samba behaving incorrectly as a server (like refusing to open a file) then the log files will probably be very useful. Depending on the problem a log level of between 3 and 10 showing the problem may be appropriate. A higher level gives more detail, but may use too much disk space.

    -To set the debug level use the log level in your +To set the debug level use the log level in your smb.conf. You may also find it useful to set the log level higher for just one machine and keep separate logs for each machine. -To do this use: -

    -log level = 10
-log file = /usr/local/samba/lib/log.%m
-include = /usr/local/samba/lib/smb.conf.%m
-

    +To do this add the following lines to your main smb.conf file: +

    log level = 10
    log file = /usr/local/samba/lib/log.%m
    include = /usr/local/samba/lib/smb.conf.%m

    then create a file /usr/local/samba/lib/smb.conf.machine where machine is the name of the client you wish to debug. In that file put any smb.conf commands you want, for example -log level may be useful. This also allows you to +log level may be useful. This also allows you to experiment with different security systems, protocol levels etc on just one machine.

    -The smb.conf entry log level -is synonymous with the parameter debuglevel that has +The smb.conf entry log level +is synonymous with the parameter debuglevel that has been used in older versions of Samba and is being retained for backwards compatibility of smb.conf files.

    -As the log level value is increased you will record +As the log level value is increased you will record a significantly increasing level of debugging information. For most debugging operations you may not need a setting higher than 3. Nearly all bugs can be tracked at a setting of 10, but be prepared for a VERY large volume of log data. -

    Internal errors

    +

    Internal errors

    If you get a INTERNAL ERROR message in your log files it means that Samba got an unexpected signal while running. It is probably a segmentation fault and almost certainly means a bug in Samba (unless @@ -80,13 +76,13 @@ include it in your bug report.

    You should also detail how to reproduce the problem, if possible. Please make this reasonably detailed. -

    +

    You may also find that a core file appeared in a corefiles subdirectory of the directory where you keep your samba log files. This file is the most useful tool for tracking down the bug. To use it you do this: -

    -	$ gdb smbd core
+
    +$ gdb smbd core
 
    
 adding appropriate paths to smbd and core so gdb can find them. If you
 don't have gdb then try dbx. Then within the debugger
@@ -100,7 +96,7 @@ disassemble the routine that called it) and try to work out exactly
 where the problem is by looking at the surrounding code. Even if you
 don't know assembly, including this info in the bug report can be
 useful. 
-

    Attaching to a running process

    +

    Attaching to a running process

    Unfortunately some unixes (in particular some recent linux kernels) refuse to dump a core file if the task has changed uid (which smbd does often). To debug with this sort of system you could try to attach @@ -110,10 +106,10 @@ to the running process using Then use c to continue and try to cause the core dump using the client. The debugger should catch the fault and tell you where it occurred. -

    Patches

    +

    Patches

    The best sort of bug report is one that includes a fix! If you send us patches please use diff -u format if your version of diff supports it, otherwise use diff -c4. Make sure you do the diff against a clean version of the source and let me know exactly what version you used. -

    Prev Up Next
    Chapter 34. Analysing and solving samba problems Home Part VI. Appendixes
    +

    Prev Up Next
    Chapter 34. Analysing and solving samba problems Home Part VI. Appendixes
    diff --git a/docs/htmldocs/compiling.html b/docs/htmldocs/compiling.html index d8b85602d9..95cdb0f581 100644 --- a/docs/htmldocs/compiling.html +++ b/docs/htmldocs/compiling.html @@ -1,8 +1,8 @@ -Chapter 36. How to compile SAMBA
    Chapter 36. How to compile SAMBA
    Prev Part VI. Appendixes Next

    Chapter 36. How to compile SAMBA

    Jelmer R. Vernooij

    The Samba Team

    Someone; Jerry perhaps?

    22 May 2001

    18 March 2003

    Table of Contents

    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    Common Errors

    +Chapter 36. How to compile Samba

    Chapter 36. How to compile Samba
    Prev Part VI. Appendixes Next

    Chapter 36. How to compile Samba

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    22 May 2001

    18 March 2003

    Table of Contents

    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon

    You can obtain the samba source from the samba website. To obtain a development version, you can download samba from CVS or using rsync. -

    Access Samba source code via CVS

    Introduction

    +

    Access Samba source code via CVS

    Introduction

    Samba is developed in an open environment. Developers use CVS (Concurrent Versioning System) to "checkin" (also known as "commit") new source code. Samba's various CVS branches can @@ -11,12 +11,12 @@ detailed in this chapter.

    This chapter is a modified version of the instructions found at http://samba.org/samba/cvs.html -

    CVS Access to samba.org

    +

    CVS Access to samba.org

    The machine samba.org runs a publicly accessible CVS repository for access to the source code of several packages, including samba, rsync, distcc, ccache and jitterbug. There are two main ways of accessing the CVS server on this host. -

    Access via CVSweb

    +

    Access via CVSweb

    You can access the source code via your favourite WWW browser. This allows you to access the contents of individual files in the repository and also to look at the revision @@ -24,7 +24,7 @@ history and commit logs of individual files. You can also ask for a diff listing between any two versions on the repository.

    Use the URL : http://samba.org/cgi-bin/cvsweb -

    Access via cvs

    +

    Access via cvs

    You can also access the source code via a normal cvs client. This gives you much more control over what you can do with the repository and allows you to checkout whole source trees @@ -74,7 +74,7 @@ on this system just substitute the correct package name the following command from within the samba directory:

    cvs update -d -P -

    Accessing the samba sources via rsync and ftp

    +

    Accessing the samba sources via rsync and ftp

    pserver.samba.org also exports unpacked copies of most parts of the CVS tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. @@ -83,7 +83,7 @@ on this system just substitute the correct package name The disadvantage of the unpacked trees is that they do not support automatic merging of local changes like CVS does. rsync access is most convenient for an initial install. -

    Verifying Samba's PGP signature

    +

    Verifying Samba's PGP signature

    In these days of insecurity, it's strongly recommended that you verify the PGP signature for any source file before installing it. Even if you're not downloading from a mirror site, verifying PGP signatures should be a @@ -91,39 +91,43 @@ standard reflex.

    With that said, go ahead and download the following files: 

    -$  wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc
-$  wget http://us1.samba.org/samba/ftp/samba-pubkey.asc
+$ wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc
+$ wget http://us1.samba.org/samba/ftp/samba-pubkey.asc

    + The first file is the PGP signature for the Samba source file; the other is the Samba public PGP key itself. Import the public PGP key with: 

    -	$ gpg --import samba-pubkey.asc
+$ gpg --import samba-pubkey.asc

    And verify the Samba source code integrity with: 

    -	$ gzip -d samba-2.2.8a.tar.gz
-	$ gpg --verify samba-2.2.8a.tar.asc
+$ gzip -d samba-2.2.8a.tar.gz
+$ gpg --verify samba-2.2.8a.tar.asc

    If you receive a message like, "Good signature from Samba Distribution Verification Key..." then all is well. The warnings about trust relationships can be ignored. An example of what you would not want to see would be: -

    +

    + gpg: BAD signature from "Samba Distribution Verification Key" -

    Building the Binaries

    To do this, first run the program ./configure + +

    Building the Binaries

    + To do this, first run the program ./configure in the source directory. This should automatically configure Samba for your operating system. If you have unusual - needs then you may wish to run

    root# ./configure --help -

    first to see what special options you can enable. - Then executing

    root# make

    will create the binaries. Once it's successfully - compiled you can use

    root# make install

    to install the binaries and manual pages. You can - separately install the binaries and/or man pages using

    root# make installbin -

    and

    root# make installman -

    Note that if you are upgrading for a previous version + needs then you may wish to run

    root# ./configure --help
+

    first to see what special options you can enable. + Then executing

    root# make

    will create the binaries. Once it's successfully + compiled you can use 

    root# make install

    to install the binaries and manual pages. You can + separately install the binaries and/or man pages using

    root# make installbin
+

    and

    root# make installman
+

    Note that if you are upgrading for a previous version of Samba you might like to know that the old versions of the binaries will be renamed with a ".old" extension. You - can go back to the previous version with

    root# make revert -

    if you find this version a disaster!

    Compiling samba with Active Directory support

    In order to compile samba with ADS support, you need to have installed + can go back to the previous version with

    root# make revert
+

    if you find this version a disaster!

    Compiling samba with Active Directory support

    In order to compile samba with ADS support, you need to have installed on your system:

    • the MIT kerberos development libraries (either install from the sources or use a package). The Heimdal libraries will not work.

    • the OpenLDAP development libraries.

    If your kerberos libraries are in a non-standard location then @@ -135,16 +139,17 @@ example of what you would not want to see would be: #define HAVE_LDAP 1

    If it doesn't then configure did not find your krb5 libraries or your ldap libraries. Look in config.log to figure - out why and fix it.

    Installing the required packages for Debian

    On Debian you need to install the following packages:

    -

    libkrb5-dev
    krb5-user

    -

    Installing the required packages for RedHat

    On RedHat this means you should have at least:

    -

    krb5-workstation (for kinit)
    krb5-libs (for linking with)
    krb5-devel (because you are compiling from source)

    + out why and fix it.

    Installing the required packages for Debian

    On Debian you need to install the following packages:

    +

    • libkrb5-dev

    • krb5-user

    +

    Installing the required packages for RedHat

    On RedHat this means you should have at least:

    +

    • krb5-workstation (for kinit)

    • krb5-libs (for linking with)

    • krb5-devel (because you are compiling from source)

    in addition to the standard development environment.

    Note that these are not standard on a RedHat install, and you may need - to get them off CD2.

    Starting the smbd and nmbd

    You must choose to start smbd and nmbd either + to get them off CD2.

    Starting the smbd and nmbd

    You must choose to start smbd and nmbd either as daemons or from inetd. Don't try to do both! Either you can put them in inetd.conf and have them started on demand - by inetd, or you can start them as + by inetd or xinetd, + or you can start them as daemons either from the command line or in /etc/rc.local. See the man pages for details on the command line options. Take particular care to read @@ -152,7 +157,7 @@ example of what you would not want to see would be: Samba. In many cases you must be root.

    The main advantage of starting smbd and nmbd using the recommended daemon method is that they will respond slightly more quickly to an initial connection - request.

    Starting from inetd.conf

    Note

    The following will be different if + request.

    Starting from inetd.conf

    Note

    The following will be different if you use NIS, NIS+ or LDAP to distribute services maps.

    Look at your /etc/services. What is defined at port 139/tcp. If nothing is defined then add a line like this:

    netbios-ssn     139/tcp

    similarly for 137/udp you should have an entry like:

    netbios-ns	137/udp

    Next edit your /etc/inetd.conf @@ -161,12 +166,13 @@ example of what you would not want to see would be: netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd

    The exact syntax of /etc/inetd.conf varies between unixes. Look at the other entries in inetd.conf - for a guide.

    Note

    Some unixes already have entries like netbios_ns + for a guide.

    Some distributions use xinetd instead of inetd. Consult the + xinetd manual for configuration information.

    Note

    Some unixes already have entries like netbios_ns (note the underscore) in /etc/services. You must either edit /etc/services or /etc/inetd.conf to make them consistent. -

    Note

    On many systems you may need to use the - interfaces option in smb.conf to specify the IP +

    Note

    On many systems you may need to use the + interfaces option in smb.conf to specify the IP address and netmask of your interfaces. Run ifconfig as root if you don't know what the broadcast is for your @@ -177,8 +183,9 @@ example of what you would not want to see would be: This means you shouldn't use spaces between the options and arguments, or you should use a script, and start the script from inetd.

    Restart inetd, perhaps just send - it a HUP. If you have installed an earlier version of nmbd then - you may need to kill nmbd as well.

    Alternative: starting it as a daemon

    To start the server as a daemon you should create + it a HUP. 

    +			root# killall -HUP inetd
+

    Alternative: starting it as a daemon

    To start the server as a daemon you should create a script something like this one, perhaps calling it startsmb.

     		#!/bin/sh
@@ -190,12 +197,4 @@ example of what you would not want to see would be:
 		
    To kill it send a kill signal to the processes 
 			nmbd and smbd.
    Note
    If you use the SVR4 style init system then 
 		you may like to look at the examples/svr4-startup
-		script to make Samba fit into that system.

    Common Errors

    “ -I'm using gcc 3 and I've compiled Samba-3 from the CVS and the -binaries are very large files (40 Mb and 20 Mb). I've the same result with ---enable-shared ? -” -

    -The dwarf format used by GCC 3 for storing debugging symbols is very inefficient. -Strip the binaries, don't compile with -g or compile with -gstabs. -

    Prev Up Next
    Part VI. Appendixes Home Chapter 37. Portability
    + script to make Samba fit into that system.

    Prev Up Next
    Part VI. Appendixes Home Chapter 37. Portability
    diff --git a/docs/htmldocs/diagnosis.html b/docs/htmldocs/diagnosis.html index ff3099ac72..ea84661d30 100644 --- a/docs/htmldocs/diagnosis.html +++ b/docs/htmldocs/diagnosis.html @@ -1,4 +1,4 @@ -Chapter 33. The Samba checklist
    Chapter 33. The Samba checklist
    Prev Part V. Troubleshooting Next

    Chapter 33. The Samba checklist

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Wed Jan 15

    Table of Contents

    Introduction
    Assumptions
    The tests
    Still having troubles?

    Introduction

    +Chapter 33. The Samba checklist

    Chapter 33. The Samba checklist
    Prev Part V. Troubleshooting Next

    Chapter 33. The Samba checklist

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Wed Jan 15

    Table of Contents

    Introduction
    Assumptions
    The tests

    Introduction

    This file contains a list of tests you can perform to validate your Samba server. It also tells you what the likely cause of the problem is if it fails any one of these steps. If it passes all these tests @@ -13,7 +13,7 @@ to solve a problem. If you send one of the samba mailing lists an email saying "it doesn't work" and you have not followed this test procedure then you should not be surprised if your email is ignored. -

    Assumptions

    +

    Assumptions

    In all of the tests it is assumed you have a Samba server called BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP.

    @@ -23,14 +23,7 @@ It is also assumed you know the name of an available share in your smb.conf. I will assume this share is called tmp. You can add a tmp share like this by adding the following to smb.conf: -

    -
-[tmp]
- comment = temporary files 
- path = /tmp
- read only = yes
-
-

    +

    Example 33.1. smb.conf with [tmp] share

    [tmp]
    comment = temporary files
    path = /tmp
    read only = yes

    Note

    These tests assume version 3.0 or later of the samba suite. Some commands shown did not exist in earlier versions. @@ -43,7 +36,7 @@ file points to name servers that really do exist. Also, if you do not have DNS server access for name resolution please check that the settings for your smb.conf file results in dns proxy = no. The best way to check this is with testparm smb.conf. -

    +

    It is helpful to monitor the log files during testing by using the tail -F log_file_name in a separate terminal console (use ctrl-alt-F1 through F6 or multiple terminals in X). @@ -54,7 +47,7 @@ depending on how or if you specified logging in your smb.co

    If you make changes to your smb.conf file while going through these test, don't forget to restart smbd and nmbd. -

    The tests

    Procedure 33.1. Diagnosing your samba server

    1. +

    The tests

    Procedure 33.1. Diagnosing your samba server

    1. In the directory in which you store your smb.conf file, run the command testparm smb.conf. If it reports any errors then your smb.conf configuration file is faulty. @@ -100,6 +93,8 @@ that file incorrectly. If you installed it as a daemon then check that it is running, and check that the netbios-ssn port is in a LISTEN state using netstat -a.

      Note

      + + Some Unix / Linux systems use xinetd in place of inetd. Check your system documentation for the location of the control file/s for your particular system implementation of @@ -116,26 +111,20 @@ files exist. There are a number of reasons for which smbd may refuse or decline a session request. The most common of these involve one or more of the following smb.conf file entries: -

      -	hosts deny = ALL
-	hosts allow = xxx.xxx.xxx.xxx/yy
-	bind interfaces only = Yes
-

      +

      hosts deny = ALL
      hosts allow = xxx.xxx.xxx.xxx/yy
      bind interfaces only = Yes

      In the above, no allowance has been made for any session requests that will automatically translate to the loopback adapter address 127.0.0.1. To solve this problem change these lines to: -

      -	hosts deny = ALL
-	hosts allow = xxx.xxx.xxx.xxx/yy 127.
-

      -Do not use the bind interfaces only parameter where you +

      hosts deny = ALL
      hosts allow = xxx.xxx.xxx.xxx/yy 127.

      +Do not use the bind interfaces only parameter where you may wish to use the samba password change facility, or where smbclient may need to access a local service for name resolution or for local resource -connections. (Note: the bind interfaces only parameter deficiency +connections. (Note: the bind interfaces only parameter deficiency where it will not allow connections to the loopback address will be fixed soon).

      + Another common cause of these two errors is having something already running on port 139, such as Samba (ie: smbd is running from inetd already) or @@ -178,20 +167,20 @@ messages from several hosts. If this doesn't give a similar result to the previous test then nmblookup isn't correctly getting your broadcast address through its automatic mechanism. In this case you should experiment with the -interfaces option in smb.conf to manually configure your IP +interfaces option in smb.conf to manually configure your IP address, broadcast and netmask.

      If your PC and server aren't on the same subnet then you will need to -use the -B option to set the broadcast address to that of the PCs +use the -B option to set the broadcast address to that of the PCs subnet.

      This test will probably fail if your subnet mask and broadcast address are not correct. (Refer to TEST 3 notes above). -

    2. +

    3. Run the command smbclient //BIGSERVER/TMP. You should then be prompted for a password. You should use the password of the account you are logged into the unix box with. If you want to test with -another account then add the -U accountname option to the end of +another account then add the -U accountname option to the end of the command line. eg: smbclient //bigserver/tmp -Ujohndoe

      Note

      @@ -208,14 +197,13 @@ If it says bad password then the likely causes ar you have shadow passwords (or some other password system) but didn't compile in support for them in smbd

    4. - your valid users configuration is incorrect + your valid users configuration is incorrect

    5. - you have a mixed case password and you haven't enabled the password - level option at a high enough level + you have a mixed case password and you haven't enabled the password level option at a high enough level

    6. - the path = line in smb.conf is incorrect. Check it with testparm + the path line in smb.conf is incorrect. Check it with testparm

    7. - you enabled password encryption but didn't map unix to samba users + you enabled password encryption but didn't map unix to samba users. Run 

      smbpasswd -a username

      .

    Once connected you should be able to use the commands dir get put etc. @@ -265,14 +253,13 @@ installed or your smb.conf is incorrect. make sure your hosts and other config lines in smb.conf are correct.

    It's also possible that the server can't work out what user name to -connect you as. To see if this is the problem add the line user = -username to the [tmp] section of +connect you as. To see if this is the problem add the line user = username to the [tmp] section of smb.conf where username is the username corresponding to the password you typed. If you find this fixes things you may need the username mapping option.

    It might also be the case that your client only sends encrypted passwords -and you have encrypt passwords = no in smb.conf +and you have encrypt passwords = no in smb.conf Turn it back on to fix.

  • Run the command nmblookup -M testgroup where @@ -283,20 +270,18 @@ master browser for that workgroup. If you don't then the election process has failed. Wait a minute to see if it is just being slow then try again. If it still fails after that then look at the browsing options you have set in smb.conf. Make -sure you have preferred master = yes to ensure that +sure you have preferred master = yes to ensure that an election is held at startup.

  • ->From file manager try to browse the server. Your samba server should +From file manager try to browse the server. Your samba server should appear in the browse list of your local workgroup (or the one you -specified in smb.conf). You should be able to double click on the name +specified in smb.conf). You should be able to double click on the name of the server and get a list of shares. If you get a "invalid password" error when you do then you are probably running WinNT and it is refusing to browse a server that has no encrypted password capability and is in user level security mode. In this case either set -security = server AND -password server = Windows_NT_Machine in your -smb.conf file, or make sure encrypted passwords is +security = server AND +password server = Windows_NT_Machine in your +smb.conf file, or make sure encrypt passwords is set to "yes". -

    • Still having troubles?

    Read the chapter on -Analysing and Solving Problems. -

    Prev Up Next
    Part V. Troubleshooting Home Chapter 34. Analysing and solving samba problems
    +

    Prev Up Next
    Part V. Troubleshooting Home Chapter 34. Analysing and solving samba problems
    diff --git a/docs/htmldocs/domain-member.html b/docs/htmldocs/domain-member.html index 59040dfebc..313c6e0fc7 100644 --- a/docs/htmldocs/domain-member.html +++ b/docs/htmldocs/domain-member.html @@ -1,4 +1,4 @@ -Chapter 7. Domain Membership
    Chapter 7. Domain Membership
    Prev Part II. Server Configuration Basics Next

    Chapter 7. Domain Membership

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails

    +Chapter 7. Domain Membership

    Chapter 7. Domain Membership
    Prev Part II. Server Configuration Basics Next

    Chapter 7. Domain Membership

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    I can't join a Windows 2003 PDC

    Domain Membership is a subject of vital concern, Samba must be able to participate as a member server in a Microsoft Domain security context, and Samba must be capable of providing Domain machine member trust accounts, @@ -8,12 +8,11 @@ This chapter covers background information pertaining to domain membership, Samba configuration for it, and MS Windows client procedures for joining a domain. Why is this necessary? Because both are areas in which there exists within the current MS Windows networking world and particularly in the -Unix/Linux networking and administration world, a considerable level of +UNIX/Linux networking and administration world, a considerable level of mis-information, incorrect understanding, and a lack of knowledge. Hopefully this chapter will fill the voids. -

    Features and Benefits

    -MS Windows workstations and servers that want to participate in domain -security need to +

    Features and Benefits

    +MS Windows workstations and servers that want to participate in domain security need to be made Domain members. Participating in Domain security is often called Single Sign On or SSO for short. This chapter describes the process that must be followed to make a workstation @@ -48,7 +47,7 @@ Domain membership has many advantages: client or server, other than the central Domain database (either NT4/Samba SAM style Domain, NT4 Domain that is back ended with an LDAP directory, or via an Active Directory infrastructure) -

    MS Windows Workstation/Server Machine Trust Accounts

    +

    MS Windows Workstation/Server Machine Trust Accounts

    A machine trust account is an account that is used to authenticate a client machine (rather than a user) to the Domain Controller server. In Windows terminology, @@ -73,12 +72,12 @@ as follows:

    • A Domain Security Account (stored in the - passdb backend that has been configured in the + passdb backend that has been configured in the smb.conf file. The precise nature of the account information that is stored depends on the type of backend database that has been chosen.

      The older format of this data is the smbpasswd database - which contains the unix login ID, the Unix user identifier (UID), and the + which contains the UNIX login ID, the UNIX user identifier (UID), and the LanMan and NT encrypted passwords. There is also some other information in this file that we do not need to concern ourselves with here.

      @@ -87,17 +86,18 @@ as follows: older smbpasswd file did. The extra information enables new user account controls to be used.

    • - A corresponding Unix account, typically stored in + A corresponding UNIX account, typically stored in /etc/passwd. Work is in progress to allow a - simplified mode of operation that does not require Unix user accounts, but + simplified mode of operation that does not require UNIX user accounts, but this may not be a feature of the early releases of Samba-3.

    -

    +

    There are three ways to create machine trust accounts:

    • - Manual creation from the Unix/Linux command line. Here, both the Samba and - corresponding Unix account are created by hand. + Manual creation from the UNIX/Linux command line. Here, both the Samba and + corresponding UNIX account are created by hand.

    • + Using the MS Windows NT4 Server Manager (either from an NT4 Domain member server, or using the Nexus toolkit available from the Microsoft web site. This tool can be run from any MS Windows machine so long as the user is @@ -105,28 +105,39 @@ There are three ways to create machine trust accounts:

    • "On-the-fly" creation. The Samba machine trust account is automatically created by Samba at the time the client is joined to the domain. - (For security, this is the recommended method.) The corresponding Unix + (For security, this is the recommended method.) The corresponding UNIX account may be created automatically or manually. -

    Manual Creation of Machine Trust Accounts

    +

    Manual Creation of Machine Trust Accounts

    The first step in manually creating a machine trust account is to manually -create the corresponding Unix account in /etc/passwd. +create the corresponding UNIX account in /etc/passwd. This can be done using vipw or another 'add user' command -that is normally used to create new Unix accounts. The following is an example for a Linux based Samba server: -

    -root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" -s /bin/false machine_name$ +that is normally used to create new UNIX accounts. The following is an example for a Linux based Samba server: + + + +

    +

    +root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" \
+   -s /bin/false machine_name$ 
+
 root# passwd -l machine_name$
+

    + On *BSD systems, this can be done using the chpass utility:

    -root# chpass -a "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin" +

    +root# chpass -a \
+  "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin"
+

    The /etc/passwd entry will list the machine name with a "$" appended, won't have a password, will have a null shell and no home directory. For example a machine named 'doppy' would have an /etc/passwd entry like this: 

    -doppy$:x:505:501:machine_nickname:/dev/null:/bin/false
+doppy$:x:505:100:machine_nickname:/dev/null:/bin/false

    Above, machine_nickname can be any descriptive name for the client, i.e., BasementComputer. @@ -135,9 +146,10 @@ name of the client to be joined to the domain. The "$" must be appended to the NetBIOS name of the client or Samba will not recognize this as a machine trust account.

    -Now that the corresponding Unix account has been created, the next step is to create +Now that the corresponding UNIX account has been created, the next step is to create the Samba account for the client containing the well-known initial -machine trust account password. This can be done using the smbpasswd(8) command +machine trust account password. This can be done using the +smbpasswd command as shown here: 

    @@ -146,28 +158,32 @@ as shown here:
 
    
 where machine_name is the machine's NetBIOS
 name.  The RID of the new machine account is generated from the UID of 
-the corresponding Unix account.
+the corresponding UNIX account.
 
    Join the client to the domain immediately
    
 	Manually creating a machine trust account using this method is the 
 	equivalent of creating a machine trust account on a Windows NT PDC using 
+	
 	the Server Manager.  From the time at which the 
 	account is created to the time which the client joins the domain and 
 	changes the password, your domain is vulnerable to an intruder joining 
 	your domain using a machine with the same NetBIOS name.  A PDC inherently 
 	trusts members of the domain and will serve out a large degree of user 
 	information to such clients.  You have been warned!
-

    Using NT4 Server Manager to Add Machine Accounts to the Domain

    +

    Using NT4 Server Manager to Add Machine Accounts to the Domain

    If the machine from which you are trying to manage the domain is an -MS Windows NT4 workstation +MS Windows NT4 workstation or MS Windows 200x / XP Professional then the tool of choice is the package called SRVTOOLS.EXE. -When executed in the target directory this will unpack -SrvMge.exe and UsrMgr.exe (both are -Domain Management tools for MS Windows NT4 workstation. +When executed in the target directory this will unpack SrvMge.exe +and UsrMgr.exe (both are domain management tools for MS Windows NT4 workstation). +

    +If your workstation is a Microsoft Windows 9x/Me family product + you should download the Nexus.exe package from the Microsoft web site. +When executed from the target directory this will unpack the same tools but for use on +this platform.

    -If your workstation is any other MS Windows product you should download the -Nexus.exe package from the Microsoft web site. When executed -from the target directory this will unpack the same tools but for use on -MS Windows 9x/Me/200x/XP. +Further information about these tools may be obtained from the following locations: +http://support.microsoft.com/default.aspx?scid=kb;en-us;173673 +http://support.microsoft.com/default.aspx?scid=kb;en-us;172540

    Launch the srvmgr.exe (Server Manager for Domains) and follow these steps:

    Procedure 7.1. Server Manager Account Machine Account Management

    1. @@ -187,25 +203,21 @@ Launch the srvmgr.exe (Server Manager for Domains) and fo Add NT Workstation of Server, then enter the machine name in the field provided, then click the Add button. -

    "On-the-Fly" Creation of Machine Trust Accounts

    +

    "On-the-Fly" Creation of Machine Trust Accounts

    The second (and recommended) way of creating machine trust accounts is simply to allow the Samba server to create them as needed when the client is joined to the domain. -

    Since each Samba machine trust account requires a corresponding Unix account, a method -for automatically creating the Unix account is usually supplied; this requires configuration of the -add machine script option in -smb.conf. This method is not required, however; corresponding Unix +

    Since each Samba machine trust account requires a corresponding UNIX account, a method +for automatically creating the UNIX account is usually supplied; this requires configuration of the +add machine script option in +smb.conf. This method is not required, however; corresponding UNIX accounts may also be created manually.

    Below is an example for a RedHat Linux system. -

    -[global]
-   # <...remainder of parameters...>
-   add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u 
-

    Making an MS Windows Workstation or Server a Domain Member

    +

    [global]
    # <...remainder of parameters...>
    add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u

    Making an MS Windows Workstation or Server a Domain Member

    The procedure for making an MS Windows workstation of server a member of the domain varies with the version of Windows: -

    Windows 200x XP Professional

    +

    Windows 200x XP Professional

    When the user elects to make the client a domain member, Windows 200x prompts for an account and password that has privileges to create machine accounts in the domain. A Samba administrative account (i.e., a Samba account that has root privileges on the @@ -219,13 +231,13 @@ with the version of Windows: The name of the account that is used to create domain member machine accounts can be anything the network administrator may choose. If it is other than root then this is easily mapped to root using the file pointed to be the smb.conf parameter - username map = /etc/samba/smbusers. + username map = /etc/samba/smbusers.

    The session key of the Samba administrative account acts as an encryption key for setting the password of the machine trust account. The machine trust account will be created on-the-fly, or updated if it already exists. -

    Windows NT4

    +

    Windows NT4

    If the machine trust account was created manually, on the Identification Changes menu enter the domain name, but do not check the box Create a Computer Account in the Domain. @@ -238,8 +250,8 @@ with the version of Windows: Domain. In this case, joining the domain proceeds as above for Windows 2000 (i.e., you must supply a Samba administrative account when prompted). -

    Samba

    Joining a Samba client to a domain is documented in - the Domain Member Server section of this chapter chapter. +

    Samba

    Joining a Samba client to a domain is documented in + the domain member chapter.

    Domain Member Server

    This mode of server operation involves the Samba machine being made a member of a domain security context. This means by definition that all user @@ -255,46 +267,38 @@ This can be LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory Server, etc.

    -Please refer to the Domain Control chapter +Please refer to the chapter on setting up a PDC for more information regarding how to create a domain machine account for a domain member server as well as for information regarding how to enable the Samba domain member machine to join the domain and to be fully trusted by it. -

    Joining an NT4 type Domain with Samba-3

    -

    Table 7.1. Assumptions

    NetBIOS name:SERV1
    Win2K/NT domain name:DOM
    Domain's PDC NetBIOS name:DOMPDC
    Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2

    +

    Joining an NT4 type Domain with Samba-3

    +

    Table 7.1. Assumptions

    NetBIOS name:SERV1
    Win2K/NT domain name:MIDEARTH
    Domain's PDC NetBIOS name:DOMPDC
    Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2

    First, you must edit your smb.conf file to tell Samba it should now use domain security.

    -Change (or add) your -security line in the [global] section + Change (or add) your + security line in the [global] section of your smb.conf to read:

    -

    -security = domain
-

    +

    security = domain

    -Next change the -workgroup line in the [global] +Next change the workgroup line in the [global] section to read:

    -

    -workgroup = DOM
-

    +

    workgroup = MIDEARTH

    as this is the name of the domain we are joining.

    -You must also have the parameter -encrypt passwords set to yes +You must also have the parameter +encrypt passwords set to yes in order for your users to authenticate to the NT PDC.

    -Finally, add (or modify) a -password server line in the [global] +Finally, add (or modify) a password server line in the [global] section to read:

    -

    -password server = DOMPDC DOMBDC1 DOMBDC2
-

    +

    password server = DOMPDC DOMBDC1 DOMBDC2

    These are the primary and backup domain controllers Samba will attempt to contact in order to authenticate users. Samba will @@ -306,9 +310,7 @@ Alternatively, if you want smbd to automatically determine the list of Domain controllers to use for authentication, you may set this line to be:

    -

    -password server = *
-

    +

    password server = *

    This method allows Samba to use exactly the same mechanism that NT does. This method either broadcasts or uses a WINS database in order to @@ -317,7 +319,7 @@ find domain controllers to authenticate against. In order to actually join the domain, you must run this command: 

    -root# net join -S DOMPDC -UAdministrator%password
+root# net rpc join -S DOMPDC -UAdministrator%password

    If the -S DOMPDC argument is not given then @@ -334,8 +336,8 @@ you will see the message: Joined domain DOM. or Joined 'SERV1' to realm 'MYREALM'

    -in your terminal window. See the -net(8) man page for more details. +in your terminal window. See the +net man page for more details.

    This process joins the server to the domain without having to create the machine trust account on the PDC beforehand. @@ -353,21 +355,25 @@ security for your system, and should be treated as carefully as a shadow password file.

    Finally, restart your Samba daemons and get ready for -clients to begin using domain security! -

    Why is this better than security = server?

    +clients to begin using domain security! The way you can restart your +samba daemons depends on your distribution, but in most cases running +

    +	root# /etc/init.d/samba restart
+

    +does the job. +

    Why is this better than security = server?

    Currently, domain security in Samba doesn't free you from -having to create local Unix users to represent the users attaching +having to create local UNIX users to represent the users attaching to your server. This means that if domain user DOM\fred attaches to your domain security Samba server, there needs -to be a local Unix user fred to represent that user in the Unix +to be a local UNIX user fred to represent that user in the UNIX filesystem. This is very similar to the older Samba security mode -security = server, +security = server, where Samba would pass through the authentication request to a Windows NT server in the same way as a Windows 95 or Windows 98 server would.

    -Please refer to the Winbind chapter -for information on a system to automatically -assign UNIX uids and gids to Windows NT Domain users and groups. + Please refer to the chapter on winbind for information on a system +to automatically assign UNIX uids and gids to Windows NT Domain users and groups.

    The advantage to domain-level security is that the authentication in domain-level security is passed down the authenticated @@ -377,11 +383,11 @@ exactly the same way NT servers do (i.e., you can add Samba servers into a resource domain and have the authentication passed on from a resource domain PDC to an account domain PDC).

    -In addition, with security = server every Samba +In addition, with security = server every Samba daemon on a server has to keep a connection open to the authenticating server for as long as that daemon lasts. This can drain the connection resources on a Microsoft NT server and cause it to run -out of available connections. With security = domain, +out of available connections. With security = domain, however, the Samba daemons connect to the PDC/BDC only for as long as is necessary to authenticate the user, and then drop the connection, thus conserving PDC connection resources. @@ -395,41 +401,39 @@ Much of the text of this document was first published in the Web magazine LinuxWorld as the article Doing the NIS/NT Samba. -

    Samba ADS Domain Membership

    +

    Samba ADS Domain Membership

    This is a rough guide to setting up Samba 3.0 with Kerberos authentication against a Windows2000 KDC. A familiarity with Kerberos is assumed. -

    Setup your smb.conf

    +

    Setup your smb.conf

    You must use at least the following 3 options in smb.conf: -

    -	realm = your.kerberos.REALM
-	security = ADS
-	encrypt passwords = yes
-

    +

    realm = your.kerberos.REALM
    security = ADS
    encrypt passwords = yes

    In case samba can't figure out your ads server using your realm name, use the -ads server option in smb.conf: -

    -	ads server = your.kerberos.server
-

    +ads server option in smb.conf: +

    ads server = your.kerberos.server

    Note

    You do not need a smbpasswd file, and older clients will be authenticated as -if security = domain, although it won't do any harm and +if security = domain, although it won't do any harm and allows you to have local users not in the domain. It is expected that the above required options will change soon when active directory integration will get better. -

    Setup your /etc/krb5.conf

    +

    Setup your /etc/krb5.conf

    The minimal configuration for krb5.conf is: 

    +[libdefaults]
+   default_realm = YOUR.KERBEROS.REALM
+
 	[realms]
-	    YOUR.KERBEROS.REALM = {
-		kdc = your.kerberos.server
+	YOUR.KERBEROS.REALM = {
+	kdc = your.kerberos.server
 	    }
-

    +

    Test your config by doing a kinit USERNAME@REALM and making sure that your password is accepted by the Win2000 KDC.

    Note

    The realm must be uppercase or you will get Cannot find KDC for -requested realm while getting initial credentials error. +requested realm while getting initial credentials error (Kerberos +is case-sensitive!).

    Note

    Time between the two servers must be synchronized. You will get a kinit(v5): Clock skew too great while getting initial credentials @@ -454,13 +458,13 @@ is only needed if you want Kerberos support for smbd

    Create the computer account

    As a user that has write permission on the Samba private directory (usually root) run: -

    -	root# net join -U Administrator%password
+
    +root#  net ads join -U Administrator%password
 
    
-
    Possible errors
    
+
    Possible errors
    
 
    ADS support not compiled in
    Samba must be reconfigured (remove config.cache) and recompiled
 	(make clean all install) after the Kerberos libs and headers are installed.
-	
    net join prompts for user name
    You need to login to the domain using kinit
+	
    net ads join prompts for user name
    You need to login to the domain using kinit
 	USERNAME@REALM.
 	USERNAME must be a user who has rights to add a machine
 	to the domain.  
    
@@ -473,41 +477,41 @@ On a Windows 2000 client try net use * \\server\shareklist tickets. Did you get a ticket for the
 server? Does it have an encoding type of DES-CBC-MD5 ? 
-
    Testing with smbclient
    
+
    Testing with smbclient
    
 On your Samba server try to login to a Win2000 server or your Samba
 server using smbclient and Kerberos. Use smbclient as usual, but
-specify the -k option to choose Kerberos authentication.
-
    Notes
    
+specify the -k option to choose Kerberos authentication.
+
    Notes
    
 You must change administrator password at least once after DC 
 install, to create the right encoding types
 
    
 W2k doesn't seem to create the _kerberos._udp and _ldap._tcp in
-their defaults DNS setup. Maybe fixed in service packs?
-
    Common Errors
    
+their defaults DNS setup. Maybe this will be fixed later in service packs.
+

    Common Errors

    In the process of adding / deleting / re-adding domain member machine accounts there are many traps for the unwary player and there are many “little” things that can go wrong. It is particularly interesting how often subscribers on the samba mailing list have concluded after repeated failed attempts to add a machine account that it is necessary to "re-install" MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type of problem. The real solution is often very simple, and with understanding of how MS Windows -networking functions. easily overcome. -

    Can Not Add Machine Back to Domain

    -Problem: A Windows workstation was reinstalled. The original domain machine +networking functions easy to overcome. +

    Can Not Add Machine Back to Domain

    +“ A Windows workstation was reinstalled. The original domain machine account was deleted and added immediately. The workstation will not join the domain if I use the same machine name. Attempts to add the machine fail with a message that the machine already -exists on the network - I know it doesn't. Why is this failing? +exists on the network - I know it doesn't. Why is this failing?”

    The original name is still in the NetBIOS name cache and must expire after machine account deletion BEFORE adding that same name as a domain member again. The best advice is to delete the old account and then to add the machine with a new name. -

    Adding Machine to Domain Fails

    -Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a +

    Adding Machine to Domain Fails

    + “Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a message that, The machine could not be added at this time, there is a network problem. -Please try again later. Why? + Please try again later. Why?”

    -You should check that there is an add machine script in your smb.conf +You should check that there is an add machine script in your smb.conf file. If there is not, please add one that is appropriate for your OS platform. If a script -has been defined you will need to debug it's operation. Increase the log level +has been defined you will need to debug it's operation. Increase the log level in the smb.conf file to level 10, then try to rejoin the domain. Check the logs to see which operation is failing.

    @@ -516,13 +520,15 @@ Possible causes include: The script does not actually exist, or could not be located in the path specified.

    Corrective Action: Fix it. Make sure that when run manually - that the script will add both the Unix system account _and_ the Samba SAM account. + that the script will add both the UNIX system account _and_ the Samba SAM account.

  • - The machine could not be added to the Unix system accounts file /etc/passwd + The machine could not be added to the UNIX system accounts file /etc/passwd

    - Corrective Action: Check that the machine name is a legal Unix - system account name. ie: If the Unix utility useradd is called + Corrective Action: Check that the machine name is a legal UNIX + system account name. ie: If the UNIX utility useradd is called then make sure that the machine name you are trying to add can be added using this tool. Useradd on some systems will not allow any upper case characters nor will it allow spaces in the name. -

    • Prev Up Next
    Chapter 6. Backup Domain Control Home Chapter 8. Stand-Alone Servers
    +

    I can't join a Windows 2003 PDC

    Windows 2003 requires SMB signing. Client side SMB signing has + only been implemented partially in Samba 3.0. Set client use spnego = no when communicating + with a windows 2003 server.

    Prev Up Next
    Chapter 6. Backup Domain Control Home Chapter 8. Stand-Alone Servers
    diff --git a/docs/htmldocs/groupmapping.html b/docs/htmldocs/groupmapping.html index 39fb34ce62..39d317e8cf 100644 --- a/docs/htmldocs/groupmapping.html +++ b/docs/htmldocs/groupmapping.html @@ -1,43 +1,48 @@ -Chapter 12. Mapping MS Windows and Unix Groups
    Chapter 12. Mapping MS Windows and Unix Groups
    Prev Part III. Advanced Configuration Next

    Chapter 12. Mapping MS Windows and Unix Groups

    Jean François Micouleau

    Gerald (Jerry) Carter

    Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails

    +Chapter 12. Mapping MS Windows and UNIX Groups

    Chapter 12. Mapping MS Windows and UNIX Groups
    Prev Part III. Advanced Configuration Next

    Chapter 12. Mapping MS Windows and UNIX Groups

    Jean François Micouleau

    Gerald (Jerry) Carter

    Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users group

    Starting with Samba-3, new group mapping functionality is available to create associations - between Windows group SIDs and UNIX groups. The groupmap subcommand + between Windows group SIDs and UNIX groups. The groupmap subcommand included with the net tool can be used to manage these associations.

    Warning

    The first immediate reason to use the group mapping on a Samba PDC, is that + the domain admin group has been removed and should no longer be specified in smb.conf. This parameter was used to give the listed users membership in the Domain Admins Windows group which gave local admin rights on their workstations (in default configurations). -

    Features and Benefits

    +

    Features and Benefits

    Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to - arbitrarily associate them with Unix/Linux group accounts. -

    - Group accounts can be managed using the MS Windows NT4 or MS Windows 200x MMC tools - so long as appropriate interface scripts have been provided to smb.conf. -

    + arbitrarily associate them with UNIX/Linux group accounts. +

    + Group accounts can be managed using the MS Windows NT4 or MS Windows 200x / XP Professional MMC tools. + Appropriate interface scripts should be provided in smb.conf if it is desired that UNIX / Linux system + accounts should be automatically created when these tools are used. In the absence of these scripts, and + so long as winbind is running, Samba accounts group accounts that are created using these tools will be + allocated UNIX UIDs/GIDs from the parameters set by the idmap uid/idmap gid settings + in the smb.conf file. +

    Figure 12.1. IDMAP groups

    IDMAP groups

    Administrators should be aware that where smb.conf group interface scripts make - direct calls to the Unix/Linux system tools (eg: the shadow utilities, groupadd, - groupdel, groupmod) then the resulting Unix/Linux group names will be subject + direct calls to the UNIX/Linux system tools (eg: the shadow utilities, groupadd, + groupdel, groupmod) then the resulting UNIX/Linux group names will be subject to any limits imposed by these tools. If the tool does NOT allow upper case characters or space characters, then the creation of an MS Windows NT4 / 200x style group of - Engineering Managers will attempt to create an identically named - Unix/Linux group, an attempt that will of course fail! -

    + Engineering Managers will attempt to create an identically named + UNIX/Linux group, an attempt that will of course fail! +

    There are several possible work-arounds for the operating system tools limitation. One - method is to use a script that generates a name for the Unix/Linux system group that - fits the operating system limits, and that then just passes the Unix/Linux group id (GID) + method is to use a script that generates a name for the UNIX/Linux system group that + fits the operating system limits, and that then just passes the UNIX/Linux group id (GID) back to the calling Samba interface. This will provide a dynamic work-around solution.

    - Another work-around is to manually create a Unix/Linux group, then manually create the + Another work-around is to manually create a UNIX/Linux group, then manually create the MS Windows NT4 / 200x group on the Samba server and then use the net groupmap tool to connect the two to each other. -

    Discussion

    +

    Discussion

    When installing MS Windows NT4 / 200x on a computer, the installation program creates default users and groups, notably the Administrators group, and gives that group privileges necessary privileges to perform essential system tasks. eg: Ability to change the date and time or to kill (or close) any process running on the local machine. -

    +

    The 'Administrator' user is a member of the 'Administrators' group, and thus inherits 'Administrators' group privileges. If a 'joe' user is created to be a member of the 'Administrator' group, 'joe' has exactly the same rights as 'Administrator'. @@ -59,49 +64,49 @@

  • Map this domadm group to the "Domain Admins" group by running the command:

    - 

    -		root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm
-

    -

    +

    +root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm
+

    +

    The quotes around "Domain Admins" are necessary due to the space in the group name. Also make sure to leave no whitespace surrounding the equal character (=).

    • Now joe, john and mary are domain administrators! -

    +

    It is possible to map any arbitrary UNIX group to any Windows NT4 / 200x group as well as making any UNIX group a Windows domain group. For example, if you wanted to include a UNIX group (e.g. acct) in a ACL on a local file or printer on a domain member machine, you would flag that group as a domain group by running the following on the Samba PDC:

    - 

    -	root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct
-

    +

    +root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct
+

    Be aware that the RID parameter is a unsigned 32 bit integer that should normally start at 1000. However, this rid must not overlap with any RID assigned - to a user. Verifying this is done differently depending on on the passdb backend + to a user. Verifying this is done differently depending on the passdb backend you are using. Future versions of the tools may perform the verification automatically, but for now the burden is on you. -

    Example Configuration

    +

    Example Configuration

    You can list the various groups in the mapping database by executing net groupmap list. Here is an example:

    - 

    -		root#  net groupmap list
-		System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin
-		Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
-		Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
-		Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest
-

    +

    +root#  net groupmap list
+System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin
+Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
+Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
+Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest
+

    For complete details on net groupmap, refer to the net(8) man page. -

    Configuration Scripts

    +

    Configuration Scripts

    Everyone needs tools. Some of us like to create our own, others prefer to use canned tools (ie: prepared by someone else for general use). -

    Sample smb.conf add group script

    - A script to great complying group names for use by the Samba group interfaces: +

    Sample smb.conf add group script

    + A script to create complying group names for use by the Samba group interfaces:

    -

    Example 12.1. smbgrpadd.sh

    +
    Example 12.1. smbgrpadd.sh
     
 #!/bin/bash
 
@@ -120,12 +125,10 @@ exit 0
 
    
 
    
 		The smb.conf entry for the above script would look like:
-		
    -		add group script = /path_to_tool/smbgrpadd.sh %g
-		
    
-

    Script to configure Group Mapping

    - In our example we have created a Unix/Linux group called ntadmin. - Our script will create the additional groups Engineers, Marketoids, Gnomes: +

    add group script = /path_to_tool/smbgrpadd.sh %g

    +

    Script to configure Group Mapping

    + In our example we have created a UNIX/Linux group called ntadmin. + Our script will create the additional groups Orks, Elves, Gnomes: 

     #!/bin/bash
@@ -143,36 +146,51 @@ net groupmap modify ntgroup="Print Operators" unixgroup=lp
 net groupmap modify ntgroup="Replicators" unixgroup=daemon
 net groupmap modify ntgroup="Power Users" unixgroup=sys
 
-#groupadd Engineers
-#groupadd Marketoids
-#groupadd Gnomes
+groupadd Orks
+groupadd Elves
+groupadd Gnomes
 
-#net groupmap add ntgroup="Engineers"  unixgroup=Engineers    type=d
-#net groupmap add ntgroup="Marketoids" unixgroup=Marketoids   type=d
-#net groupmap add ntgroup="Gnomes"     unixgroup=Gnomes       type=d
+net groupmap add ntgroup="Orks"       unixgroup=Orks         type=d
+net groupmap add ntgroup="Elves"      unixgroup=Elves        type=d
+net groupmap add ntgroup="Gnomes"     unixgroup=Gnomes       type=d

    Of course it is expected that the administrator will modify this to suit local needs. For information regarding the use of the net groupmap tool please refer to the man page. -

    Common Errors

    +

    Common Errors

    At this time there are many little surprises for the unwary administrator. In a real sense it is imperative that every step of automated control scripts must be carefully tested manually before putting them into active service. -

    Adding Groups Fails

    +

    Adding Groups Fails

    This is a common problem when the groupadd is called directly - by the Samba interface script for the add group script in + by the Samba interface script for the add group script in the smb.conf file.

    The most common cause of failure is an attempt to add an MS Windows group account that has either an upper case character and/or a space character in it.

    There are three possible work-arounds. Firstly, use only group names that comply - with the limitations of the Unix/Linux groupadd system tool. + with the limitations of the UNIX/Linux groupadd system tool. The second involves use of the script mentioned earlier in this chapter, and the - third option is to manually create a Unix/Linux group account that can substitute + third option is to manually create a UNIX/Linux group account that can substitute for the MS Windows group name, then use the procedure listed above to map that group to the MS Windows group. -

    Adding MS Windows Groups to MS Windows Groups Fails

    +

    Adding MS Windows Groups to MS Windows Groups Fails

    Samba-3 does NOT support nested groups from the MS Windows control environment. -

    Prev Up Next
    Chapter 11. Account Information Databases Home Chapter 13. File, Directory and Share Access Controls
    +

    Adding Domain Users to the Power Users group

    “ + What must I do to add Domain Users to the Power Users group? + ”

    + The Power Users group is a group that is local to each Windows + 200x / XP Professional workstation. You can not add the Domain Users group to the Power Users + group automatically, this must be done on each workstation by logging in as the local workstation + administrator and then using click on Start / Control Panel / Users and Passwords + now click on the 'Advanced' tab, then on the 'Advanced' Button. +

    + Now click on 'Groups', then double click on 'Power Users'. This will launch the panel to add users + or groups to the local machine 'Power Uses' group. Click on the 'Add' button, select the domain + from which the 'Domain Users' group is to be added, double click on the 'Domain Users' group, then + click on the 'Ok' button. Note: If a logon box is presented during this process please remember to + enter the connect as DOMAIN\UserName. ie: For the domain MIDEARTH and the user 'root' enter + MIDEARTH\root. +

    Prev Up Next
    Chapter 11. Account Information Databases Home Chapter 13. File, Directory and Share Access Controls
    diff --git a/docs/htmldocs/install.html b/docs/htmldocs/install.html index 154b9705e1..02264c558d 100644 --- a/docs/htmldocs/install.html +++ b/docs/htmldocs/install.html @@ -1,48 +1,39 @@ -Chapter 2. How to Install and Test SAMBA
    Chapter 2. How to Install and Test SAMBA
    Prev Part I. General Installation Next

    Chapter 2. How to Install and Test SAMBA

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Karl Auer

    Table of Contents

    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
    What If Things Don't Work?
    Common Errors
    Why are so many smbd processes eating memory?
    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

    Obtaining and installing samba

    +Chapter 2. How to Install and Test SAMBA

    Chapter 2. How to Install and Test SAMBA
    Prev Part I. General Installation Next

    Chapter 2. How to Install and Test SAMBA

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Karl Auer

    Table of Contents

    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your + server
    Try connecting with the unix client
    Try connecting from another SMB client
    What If Things Don't Work?
    Common Errors
    Large number of smbd processes
    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
    "The network name cannot be found"

    Obtaining and installing samba

    Binary packages of samba are included in almost any Linux or - Unix distribution. There are also some packages available at + UNIX distribution. There are also some packages available at the samba homepage. -

    If you need to compile samba from source, check the - appropriate appendix chapter.

    If you have already installed samba, or if your operating system +

    If you need to compile samba from source, check + the chapter about compiling samba from scratch.

    If you have already installed samba, or if your operating system was pre-installed with samba, then you may not need to bother with this chapter. On the other hand, you may want to read this chapter anyhow - for information about updating samba.

    Configuring samba (smb.conf)

    + for information about updating samba.

    Configuring samba (smb.conf)

    Samba's configuration is stored in the smb.conf file, that usually resides in /etc/samba/smb.conf or /usr/local/samba/lib/smb.conf. You can either edit this file yourself or do it using one of the many graphical tools that are available, such as the web-based interface swat, that is included with samba. -

    Example Configuration

    +

    Example Configuration

    There are sample configuration files in the examples subdirectory in the distribution. I suggest you read them carefully so you can see how the options go together in practice. See the man page for all the options.

    The simplest useful configuration file would be something like this:

    - 

    -	[global]
-		workgroup = MYGROUP
-
-	[homes]
-		guest ok = no
-		read only = no
-

    +

    Example 2.1. Simplest possible smb.conf file

    [global]
    workgroup = MIDEARTH
    [homes]
    guest ok = no
    read only = no

    This will allow connections by anyone with an account on the server, using either - their login name or "homes" as the service name. + their login name or homes" as the service name. (Note that the workgroup that Samba must also be set.)

    - Make sure you put the smb.conf file in the same place - you specified in the Makefile (the default is to - look for it in /usr/local/samba/lib/). + Make sure you put the smb.conf file in the correct place + (usually in /etc/samba).

    For more information about security settings for the - [homes] share please refer to the chapter - Securing Samba. -

    Test your config file with testparm

    + [homes] share please refer to + "Securing Samba". +

    Test your config file with testparm

    It's important that you test the validity of your smb.conf file using the testparm program. If testparm runs OK then it will list the loaded services. If not it will give an error message. @@ -50,7 +41,7 @@ Make sure it runs OK and that the services look reasonable before proceeding.

    Always run testparm again when you change smb.conf! -

    SWAT

    +

    SWAT

    SWAT is a web-based interface that helps you configure samba. SWAT might not be available in the samba package on your platform, but in a separate package. Please read the swat manpage @@ -66,9 +57,10 @@ machine but connecting from a remote machine leaves your connection open to password sniffing as passwords will be sent in the clear over the wire. -

    Try listing the shares available on your - server

    $ smbclient -L - yourhostname

    You should get back a list of shares available on +

    Try listing the shares available on your + server

    +$ smbclient -L yourhostname
+

    You should get back a list of shares available on your server. If you don't then something is incorrectly setup. Note that this method can also be used to see what shares are available on other LanManager clients (such as WfWg).

    If you choose user level security then you may find @@ -76,68 +68,31 @@ See the smbclient man page for details. (you can force it to list the shares without a password by adding the option -U% to the command line. This will not work - with non-Samba servers)

    Try connecting with the unix client

    $ smbclient - //yourhostname/aservice

    Typically the yourhostname + with non-Samba servers)

    Try connecting with the unix client

    +

    +$ smbclient  //yourhostname/aservice
+

    Typically the yourhostname would be the name of the host where you installed smbd. The aservice is any service you have defined in the smb.conf file. Try your user name if you just have a [homes] section in smb.conf.

    For example if your unix host is bambi - and your login name is fred you would type:

    $ smbclient //bambi/fred -

    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client

    Try mounting disks. eg:

    C:\WINDOWS\> net use d: \\servername\service -

    Try printing. eg:

    C:\WINDOWS\> net use lpt1: - \\servername\spoolservice

    C:\WINDOWS\> print filename -

    What If Things Don't Work?

    Then you might read the file chapter - Diagnosis and the - FAQ. If you are still stuck then try to follow - the Analysing and Solving Problems chapter - Samba has been successfully installed at thousands of sites worldwide, - so maybe someone else has hit your problem and has overcome it.

    Common Errors

    -The following questions and issues get raised on the samba mailing list over and over again. -

    Why are so many smbd processes eating memory?

    -“ -Site that is running Samba on an AIX box. They are sharing out about 2 terabytes using samba. -Samba was installed using smitty and the binaries. We seem to be experiencing a memory problem -with this box. When I do a svmon -Pu the monitoring program shows that smbd has several -processes of smbd running: -” -

    - “ -Is samba suppose to start this many different smbd processes? Or does it run as one smbd process? Also -is it normal for it to be taking up this much memory? -” -

    + and your login name is fred you would type:

    +$ smbclient //bambi/fred
+

    Try connecting from another SMB client

    Try mounting disks. from a DOS, Windows or OS/2 client, eg:

    +C:\> net use d: \\servername\service
+

    Try printing. eg:

    -Inuse * 4096 = amount of memory being used by this process
-
-     Pid Command        Inuse      Pin     Pgsp  Virtual   64-bit    Mthrd
-   20950 smbd           33098     1906      181     5017        N        N
-   22262 smbd            9104     1906      5410
-   21060 smbd            9048     1906      181     5479        N        N
-   25972 smbd            8678     1906      181     5109        N        N
-   24524 smbd            8674     1906      181     5105        N        N
-   19262 smbd            8582     1906      181     5013        N        N
-   20722 smbd            8572     1906      181     5003        N        N
-   21454 smbd            8572     1906      181     5003        N        N
-   28946 smbd            8567     1906      181     4996        N        N
-   24076 smbd            8566     1906      181     4996        N        N
-   20138 smbd            8566     1906      181     4996        N        N
-   17608 smbd            8565     1906      181     4996        N        N
-   21820 smbd            8565     1906      181     4996        N        N
-   26940 smbd            8565     1906      181     4996        N        N
-   19884 smbd            8565     1906      181     4996        N        N
-    9912 smbd            8565     1906      181     4996        N        N
-   25800 smbd            8564     1906      181     4995        N        N
-   20452 smbd            8564     1906      181     4995        N        N
-   18592 smbd            8562     1906      181     4993        N        N
-   28216 smbd            8521     1906      181     4954        N        N
-   19110 smbd            8404     1906      181     4862        N        N
-
-   Total memory used:  841,592,832 bytes
+C:\> net use lpt1:	\\servername\spoolservice

    -

    +

    C:\> print filename
+

    What If Things Don't Work?

    Then you might read the file chapter diagnosis + and the FAQ. If you are still stuck then refer to "Analysing and solving problems". + Samba has been successfully installed at thousands of sites worldwide, + so maybe someone else has hit your problem and has overcome it.

    Common Errors

    +The following questions and issues get raised on the samba mailing list over and over again. +

    Large number of smbd processes

    Samba consists on three core programs: nmbd, smbd, winbindd. nmbd is the name server message daemon, smbd is the server message daemon, winbindd is the daemon that @@ -152,4 +107,9 @@ connection made. That is why you are seeing so many of them, one (1) per client

    winbindd will run as one or two daemons, depending on whether or not it is being run in "split mode" (in which case there will be two instances). -

    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs

    Your loopback device isn't working correctly. Make sure it's running.

    Prev Up Next
    Chapter 1. Introduction to Samba Home Chapter 3. Fast Start for the Impatient
    +

    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"

    Your loopback device isn't working correctly. Make sure it's configured properly. The loopback device is an internal (virtual) network device with + the ip address 127.0.0.1. Read your OS documentation for details + on how to configure the loopback on your system.

    "The network name cannot be found"

    + This error can be caused by one of these misconfigurations: +

    • You specified an nonexisting path for the share in smb.conf

    • The user you are trying to access the share with does not + have sufficient permissions to access the path for the share. Both read (r) and access (x) should be possible.

    • The share you are trying to access does not exist.

    Prev Up Next
    Chapter 1. Introduction to Samba Home Chapter 3. Fast Start for the Impatient
    diff --git a/docs/htmldocs/integrate-ms-networks.html b/docs/htmldocs/integrate-ms-networks.html index 083aeed9f3..73971d2a72 100644 --- a/docs/htmldocs/integrate-ms-networks.html +++ b/docs/htmldocs/integrate-ms-networks.html @@ -1,4 +1,4 @@ -Chapter 26. Integrating MS Windows networks with Samba
    Chapter 26. Integrating MS Windows networks with Samba
    Prev Part III. Advanced Configuration Next

    Chapter 26. Integrating MS Windows networks with Samba

    John H. Terpstra

    Samba Team

    (Jan 01 2001)

    Table of Contents

    Features and Benefits
    Background Information
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    My Boomerang Won't Come Back
    Very Slow Network Connections
    Samba server name change problem

    +Chapter 26. Integrating MS Windows networks with Samba

    Chapter 26. Integrating MS Windows networks with Samba
    Prev Part III. Advanced Configuration Next

    Chapter 26. Integrating MS Windows networks with Samba

    John H. Terpstra

    Samba Team

    (Jan 01 2001)

    Table of Contents

    Features and Benefits
    Background Information
    Name Resolution in a pure UNIX/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging works only in one way
    Very Slow Network Connections
    Samba server name change problem

    This section deals with NetBIOS over TCP/IP name to IP address resolution. If your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this section does not apply to your installation. If your installation involves use of @@ -9,15 +9,15 @@ NetBIOS over TCP/IP then this section may help you to resolve networking problem to NOT run NetBEUI at all. Note also that there is NO such thing as NetBEUI over TCP/IP - the existence of such a protocol is a complete and utter mis-apprehension. -

    Features and Benefits

    +

    Features and Benefits

    Many MS Windows network administrators have never been exposed to basic TCP/IP -networking as it is implemented in a Unix/Linux operating system. Likewise, many Unix and +networking as it is implemented in a UNIX/Linux operating system. Likewise, many UNIX and Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP based networking (and may have no desire to be either).

    This chapter gives a short introduction to the basics of how a name can be resolved to it's IP address for each operating system environment. -

    Background Information

    +

    Background Information

    Since the introduction of MS Windows 2000 it is possible to run MS Windows networking without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over @@ -30,17 +30,19 @@ Name Service or WINS), TCP port 139 AND TCP port 445 (for actual file and print

    When NetBIOS over TCP/IP is disabled the use of DNS is essential. Most installations that disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS requires + Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR). + Use of DHCP with ADS is recommended as a further means of maintaining central control over client workstation network configuration. -

    Name Resolution in a pure Unix/Linux world

    +

    Name Resolution in a pure UNIX/Linux world

    The key configuration files covered in this section are: -

    • /etc/hosts

    • /etc/resolv.conf

    • /etc/host.conf

    • /etc/nsswitch.conf

    /etc/hosts

    -Contains a static list of IP Addresses and names. +

    • /etc/hosts

    • /etc/resolv.conf

    • /etc/host.conf

    • /etc/nsswitch.conf

    /etc/hosts

    +Contains a static list of IP addresses and names. eg: -

    -	127.0.0.1	localhost localhost.localdomain
-	192.168.1.1	bigbox.caldera.com	bigbox	alias4box
+
    +127.0.0.1	localhost localhost.localdomain
+192.168.1.1	bigbox.caldera.com	bigbox	alias4box
 
    
 The purpose of /etc/hosts is to provide a 
 name resolution mechanism so that uses do not need to remember 
@@ -48,10 +50,10 @@ IP addresses.
 
    
 Network packets that are sent over the physical network transport 
 layer communicate not via IP addresses but rather using the Media 
-Access Control address, or MAC address. IP Addresses are currently 
+Access Control address, or MAC address. IP addresses are currently 
 32 bits in length and are typically presented as four (4) decimal 
 numbers that are separated by a dot (or period). eg: 168.192.1.1.
-
    
+
    
 MAC Addresses use 48 bits (or 6 bytes) and are typically represented 
 as two digit hexadecimal numbers separated by colons. eg: 
 40:8e:0a:12:34:56
@@ -84,15 +86,15 @@ MAC addresses only; their own unique address and the address
 ff:ff:ff:ff:ff:ff. The reply packet from an ARP request will 
 contain the MAC address and the primary IP address for each 
 interface.
-
    
+
    
 The /etc/hosts file is foundational to all 
-Unix/Linux TCP/IP installations and as a minimum will contain 
+UNIX/Linux TCP/IP installations and as a minimum will contain 
 the localhost and local network interface IP addresses and the 
 primary names by which they are known within the local machine. 
 This file helps to prime the pump so that a basic level of name 
 resolution can exist before any other method of name resolution 
 becomes available.
-

    /etc/resolv.conf

    +

    /etc/resolv.conf

    This file tells the name resolution libraries:

    • The name of the domain to which the machine belongs @@ -102,41 +104,41 @@ This file tells the name resolution libraries:

    • The name or IP address of available Domain Name Servers that may be asked to perform name to address translation lookups -

    /etc/host.conf

    +

    /etc/host.conf

    /etc/host.conf is the primary means by which the setting in /etc/resolv.conf may be affected. It is a critical configuration file. This file controls the order by which name resolution may proceed. The typical structure is: -

    -	order hosts,bind
-	multi on
+
    +order hosts,bind
+multi on
 
    
 then both addresses should be returned. Please refer to the 
 man page for host.conf for further details.
-

    /etc/nsswitch.conf

    +

    /etc/nsswitch.conf

    This file controls the actual name resolution targets. The file typically has resolver object specifications as follows: -

    -	# /etc/nsswitch.conf
-	#
-	# Name Service Switch configuration file.
-	#
+
    +# /etc/nsswitch.conf
+#
+# Name Service Switch configuration file.
+#
 
-	passwd:		compat
-	# Alternative entries for password authentication are:
-	# passwd:	compat files nis ldap winbind
-	shadow:		compat
-	group:		compat
+passwd:		compat
+# Alternative entries for password authentication are:
+# passwd:	compat files nis ldap winbind
+shadow:		compat
+group:		compat
 
-	hosts:		files nis dns
-	# Alternative entries for host name resolution are:
-	# hosts:	files dns nis nis+ hesiod db compat ldap wins
-	networks:	nis files dns
+hosts:		files nis dns
+# Alternative entries for host name resolution are:
+# hosts:	files dns nis nis+ hesiod db compat ldap wins
+networks:	nis files dns
 
-	ethers:		nis files
-	protocols:	nis files
-	rpc:		nis files
-	services:	nis files
+ethers:		nis files
+protocols:	nis files
+rpc:		nis files
+services:	nis files
 
    
 Of course, each of these mechanisms requires that the appropriate 
 facilities and/or services are correctly configured.
@@ -144,27 +146,27 @@ facilities and/or services are correctly configured.
 It should be noted that unless a network request/message must be 
 sent, TCP/IP networks are silent. All TCP/IP communications assumes a 
 principal of speaking only when necessary.
-
    
+
    
 Starting with version 2.2.0 samba has Linux support for extensions to 
 the name service switch infrastructure so that linux clients will 
 be able to obtain resolution of MS Windows NetBIOS names to IP 
 Addresses. To gain this functionality Samba needs to be compiled 
-with appropriate arguments to the make command (ie: make 
+with appropriate arguments to the make command (i.e.: make 
 nsswitch/libnss_wins.so). The resulting library should 
 then be installed in the /lib directory and 
 the "wins" parameter needs to be added to the "hosts:" line in 
 the /etc/nsswitch.conf file. At this point it 
-will be possible to ping any MS Windows machine by it's NetBIOS 
+will be possible to ping any MS Windows machine by its NetBIOS 
 machine name, so long as that machine is within the workgroup to 
 which both the samba machine and the MS Windows machine belong.
-

    Name resolution as used within MS Windows networking

    +

    Name resolution as used within MS Windows networking

    MS Windows networking is predicated about the name each machine is given. This name is known variously (and inconsistently) as the "computer name", "machine name", "networking name", "netbios name", -"SMB name". All terms mean the same thing with the exception of +or "SMB name". All terms mean the same thing with the exception of "netbios name" which can apply also to the name of the workgroup or the domain name. The terms "workgroup" and "domain" are really just a -simply name with which the machine is associated. All NetBIOS names +simple name with which the machine is associated. All NetBIOS names are exactly 16 characters in length. The 16th character is reserved. It is used to store a one byte value that indicates service level information for the NetBIOS name that is registered. A NetBIOS machine @@ -172,25 +174,14 @@ name is therefore registered for each service type that is provided by the client/server.

    The following are typical NetBIOS name/service type registrations: -

    -	Unique NetBIOS Names:
-		MACHINENAME<00>	= Server Service is running on MACHINENAME
-		MACHINENAME<03> = Generic Machine Name (NetBIOS name)
-		MACHINENAME<20> = LanMan Server service is running on MACHINENAME
-		WORKGROUP<1b> = Domain Master Browser
-
-	Group Names:
-		WORKGROUP<03> = Generic Name registered by all members of WORKGROUP
-		WORKGROUP<1c> = Domain Controllers / Netlogon Servers
-		WORKGROUP<1d> = Local Master Browsers
-		WORKGROUP<1e> = Internet Name Resolvers
-

    +

    Table 26.1. Unique NetBIOS names

    MACHINENAME<00>Server Service is running on MACHINENAME
    MACHINENAME<03>Generic Machine Name (NetBIOS name)
    MACHINENAME<20>LanMan Server service is running on MACHINENAME
    WORKGROUP<1b>Domain Master Browser

    Table 26.2. Group Names

    WORKGROUP<03>Generic Name registered by all members of WORKGROUP
    WORKGROUP<1c>Domain Controllers / Netlogon Servers
    WORKGROUP<1d>Local Master Browsers
    WORKGROUP<1e>Internet Name Resolvers

    + It should be noted that all NetBIOS machines register their own names as per the above. This is in vast contrast to TCP/IP installations where traditionally the system administrator will determine in the /etc/hosts or in the DNS database what names are associated with each IP address. -

    +

    One further point of clarification should be noted, the /etc/hosts file and the DNS records do not provide the NetBIOS name type information that MS Windows clients depend on to locate the type of service that may @@ -199,8 +190,8 @@ wants to locate a domain logon server. It finds this service and the IP address of a server that provides it by performing a lookup (via a NetBIOS broadcast) for enumeration of all machines that have registered the name type *<1c>. A logon request is then sent to each -IP address that is returned in the enumerated list of IP addresses. Which -ever machine first replies then ends up providing the logon services. +IP address that is returned in the enumerated list of IP addresses. +Whichever machine first replies then ends up providing the logon services.

    The name "workgroup" or "domain" really can be confusing since these have the added significance of indicating what is the security @@ -228,7 +219,7 @@ NBT or NetBT, the NetBIOS over TCP/IP. MS Windows machines use a complex array of name resolution mechanisms. Since we are primarily concerned with TCP/IP this demonstration is limited to this area. -

    The NetBIOS Name Cache

    +

    The NetBIOS Name Cache

    All MS Windows machines employ an in memory buffer in which is stored the NetBIOS names and IP addresses for all external machines that that machine has communicated with over the @@ -242,11 +233,11 @@ an attempt to exchange a message with that machine will be subject to time-out delays. i.e.: Its name is in the cache, so a name resolution lookup will succeed, but the machine can not respond. This can be frustrating for users - but it is a characteristic of the protocol. -

    +

    The MS Windows utility that allows examination of the NetBIOS name cache is called "nbtstat". The Samba equivalent of this is called nmblookup. -

    The LMHOSTS file

    +

    The LMHOSTS file

    This file is usually located in MS Windows NT 4.0 or 2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address and the machine name in matched pairs. The @@ -254,102 +245,103 @@ the IP Address and the machine name in matched pairs. The to IP address mapping.

    It typically looks like: -

    -	# Copyright (c) 1998 Microsoft Corp.
-	#
-	# This is a sample LMHOSTS file used by the Microsoft Wins Client (NetBIOS
-	# over TCP/IP) stack for Windows98
-	#
-	# This file contains the mappings of IP addresses to NT computernames
-	# (NetBIOS) names.  Each entry should be kept on an individual line.
-	# The IP address should be placed in the first column followed by the
-	# corresponding computername. The address and the computername
-	# should be separated by at least one space or tab. The "#" character
-	# is generally used to denote the start of a comment (see the exceptions
-	# below).
-	#
-	# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
-	# files and offers the following extensions:
-	#
-	#      #PRE
-	#      #DOM:<domain>
-	#      #INCLUDE <filename>
-	#      #BEGIN_ALTERNATE
-	#      #END_ALTERNATE
-	#      \0xnn (non-printing character support)
-	#
-	# Following any entry in the file with the characters "#PRE" will cause
-	# the entry to be preloaded into the name cache. By default, entries are
-	# not preloaded, but are parsed only after dynamic name resolution fails.
-	#
-	# Following an entry with the "#DOM:<domain>" tag will associate the
-	# entry with the domain specified by <domain>. This affects how the
-	# browser and logon services behave in TCP/IP environments. To preload
-	# the host name associated with #DOM entry, it is necessary to also add a
-	# #PRE to the line. The <domain> is always preloaded although it will not
-	# be shown when the name cache is viewed.
-	#
-	# Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT)
-	# software to seek the specified <filename> and parse it as if it were
-	# local. <filename> is generally a UNC-based name, allowing a
-	# centralized lmhosts file to be maintained on a server.
-	# It is ALWAYS necessary to provide a mapping for the IP address of the
-	# server prior to the #INCLUDE. This mapping must use the #PRE directive.
-	# In addition the share "public" in the example below must be in the
-	# LanManServer list of "NullSessionShares" in order for client machines to
-	# be able to read the lmhosts file successfully. This key is under
-	# \machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares
-	# in the registry. Simply add "public" to the list found there.
-	#
-	# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
-	# statements to be grouped together. Any single successful include
-	# will cause the group to succeed.
-	#
-	# Finally, non-printing characters can be embedded in mappings by
-	# first surrounding the NetBIOS name in quotations, then using the
-	# \0xnn notation to specify a hex value for a non-printing character.
-	#
-	# The following example illustrates all of these extensions:
-	#
-	# 102.54.94.97     rhino         #PRE #DOM:networking  #net group's DC
-	# 102.54.94.102    "appname  \0x14"                    #special app server
-	# 102.54.94.123    popular            #PRE             #source server
-	# 102.54.94.117    localsrv           #PRE             #needed for the include
-	#
-	# #BEGIN_ALTERNATE
-	# #INCLUDE \\localsrv\public\lmhosts
-	# #INCLUDE \\rhino\public\lmhosts
-	# #END_ALTERNATE
-	#
-	# In the above example, the "appname" server contains a special
-	# character in its name, the "popular" and "localsrv" server names are
-	# preloaded, and the "rhino" server name is specified so it can be used
-	# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
-	# system is unavailable.
-	#
-	# Note that the whole file is parsed including comments on each lookup,
-	# so keeping the number of comments to a minimum will improve performance.
-	# Therefore it is not advisable to simply add lmhosts file entries onto the
-	# end of this file.
-

    HOSTS file

    +

    +# Copyright (c) 1998 Microsoft Corp.
+#
+# This is a sample LMHOSTS file used by the Microsoft Wins Client (NetBIOS
+# over TCP/IP) stack for Windows98
+#
+# This file contains the mappings of IP addresses to NT computernames
+# (NetBIOS) names.  Each entry should be kept on an individual line.
+# The IP address should be placed in the first column followed by the
+# corresponding computername. The address and the computername
+# should be separated by at least one space or tab. The "#" character
+# is generally used to denote the start of a comment (see the exceptions
+# below).
+#
+# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
+# files and offers the following extensions:
+#
+#      #PRE
+#      #DOM:<domain>
+#      #INCLUDE <filename>
+#      #BEGIN_ALTERNATE
+#      #END_ALTERNATE
+#      \0xnn (non-printing character support)
+#
+# Following any entry in the file with the characters "#PRE" will cause
+# the entry to be preloaded into the name cache. By default, entries are
+# not preloaded, but are parsed only after dynamic name resolution fails.
+#
+# Following an entry with the "#DOM:<domain>" tag will associate the
+# entry with the domain specified by <domain>. This affects how the
+# browser and logon services behave in TCP/IP environments. To preload
+# the host name associated with #DOM entry, it is necessary to also add a
+# #PRE to the line. The <domain> is always preloaded although it will not
+# be shown when the name cache is viewed.
+#
+# Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT)
+# software to seek the specified <filename> and parse it as if it were
+# local. <filename> is generally a UNC-based name, allowing a
+# centralized lmhosts file to be maintained on a server.
+# It is ALWAYS necessary to provide a mapping for the IP address of the
+# server prior to the #INCLUDE. This mapping must use the #PRE directive.
+# In addition the share "public" in the example below must be in the
+# LanManServer list of "NullSessionShares" in order for client machines to
+# be able to read the lmhosts file successfully. This key is under
+# \machine\system\currentcontrolset\services\lanmanserver\
+# parameters\nullsessionshares
+# in the registry. Simply add "public" to the list found there.
+#
+# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
+# statements to be grouped together. Any single successful include
+# will cause the group to succeed.
+#
+# Finally, non-printing characters can be embedded in mappings by
+# first surrounding the NetBIOS name in quotations, then using the
+# \0xnn notation to specify a hex value for a non-printing character.
+#
+# The following example illustrates all of these extensions:
+#
+# 102.54.94.97     rhino         #PRE #DOM:networking  #net group's DC
+# 102.54.94.102    "appname  \0x14"                    #special app server
+# 102.54.94.123    popular            #PRE             #source server
+# 102.54.94.117    localsrv           #PRE             #needed for the include
+#
+# #BEGIN_ALTERNATE
+# #INCLUDE \\localsrv\public\lmhosts
+# #INCLUDE \\rhino\public\lmhosts
+# #END_ALTERNATE
+#
+# In the above example, the "appname" server contains a special
+# character in its name, the "popular" and "localsrv" server names are
+# preloaded, and the "rhino" server name is specified so it can be used
+# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
+# system is unavailable.
+#
+# Note that the whole file is parsed including comments on each lookup,
+# so keeping the number of comments to a minimum will improve performance.
+# Therefore it is not advisable to simply add lmhosts file entries onto the
+# end of this file.
+

    HOSTS file

    This file is usually located in MS Windows NT 4.0 or 2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address and the IP hostname in matched pairs. It can be used by the name resolution infrastructure in MS Windows, depending on how the TCP/IP environment is configured. This file is in -every way the equivalent of the Unix/Linux /etc/hosts file. -

    DNS Lookup

    +every way the equivalent of the UNIX/Linux /etc/hosts file. +

    DNS Lookup

    This capability is configured in the TCP/IP setup area in the network -configuration facility. If enabled an elaborate name resolution sequence -is followed the precise nature of which is dependant on what the NetBIOS -Node Type parameter is configured to. A Node Type of 0 means use -NetBIOS broadcast (over UDP broadcast) is first used if the name +configuration facility. If enabled, an elaborate name resolution sequence +is followed the precise nature of which is dependant on how the NetBIOS +Node Type parameter is configured. A Node Type of 0 means that +NetBIOS broadcast (over UDP broadcast) is used if the name that is the subject of a name lookup is not found in the NetBIOS name cache. If that fails then DNS, HOSTS and LMHOSTS are checked. If set to Node Type 8, then a NetBIOS Unicast (over UDP Unicast) is sent to the WINS Server to obtain a lookup before DNS, HOSTS, LMHOSTS, or broadcast lookup is used. -

    WINS Lookup

    +

    WINS Lookup

    A WINS (Windows Internet Name Server) service is the equivalent of the rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores the names and IP addresses that are registered by a Windows client @@ -357,24 +349,20 @@ if the TCP/IP setup has been given at least one WINS Server IP Address.

    To configure Samba to be a WINS server the following parameter needs to be added to the smb.conf file: -

    -	wins support = Yes
-

    +

    wins support = Yes

    To configure Samba to use a WINS server the following parameters are needed in the smb.conf file: -

    -	wins support = No
-	wins server = xxx.xxx.xxx.xxx
-

    +

    wins support = No
    wins server = xxx.xxx.xxx.xxx

    where xxx.xxx.xxx.xxx is the IP address of the WINS server. -

    Common Errors

    +

    For information about setting up Samba as a WINS server, read + the chapter on network browsing.

    Common Errors

    TCP/IP network configuration problems find every network administrator sooner or later. The cause can be anything from keyboard mishaps, forgetfulness, simple mistakes, and carelessness. Of course, no one is every deliberately careless! -

    My Boomerang Won't Come Back

    - Well, the real complaint said, "I can ping my samba server from Windows, but I can - not ping my Windows machine from the samba server." +

    Pinging works only in one way

    + “I can ping my samba server from Windows, but I can + not ping my Windows machine from the samba server.”

    The Windows machine was at IP Address 192.168.1.2 with netmask 255.255.255.0, the Samba server (Linux) was at IP Address 192.168.1.130 with netmask 255.255.255.128. @@ -382,46 +370,46 @@ carelessness. Of course, no one is every deliberately careless!

    Due to inconsistent netmasks, the Windows machine was on network 192.168.1.0/24, while the Samba server was on network 192.168.1.128/25 - logically a different network. -

    Very Slow Network Connections

    +

    Very Slow Network Connections

    A common causes of slow network response includes: -

    • Client is configured to use DNS and DNS server is down

    • Client is configured to use remote DNS server, but remote connection is down

    • Client is configured to use a WINS server, but there is no WINS server

    • Client is NOT configured to use a WINS server, but there is a WINS server

    • Firewall is filtering our DNS or WINS traffic

    Samba server name change problem

    - The name of the samba server was changed, samba was restarted, samba server can not be +

    • Client is configured to use DNS and DNS server is down

    • Client is configured to use remote DNS server, but remote connection is down

    • Client is configured to use a WINS server, but there is no WINS server

    • Client is NOT configured to use a WINS server, but there is a WINS server

    • Firewall is filtering our DNS or WINS traffic

    Samba server name change problem

    + “The name of the samba server was changed, samba was restarted, samba server can not be pinged by new name from MS Windows NT4 Workstation, but it does still respond to ping using - the old name. Why? + the old name. Why?”

    From this description three (3) things are rather obvious:

    • WINS is NOT in use, only broadcast based name resolution is used

    • The samba server was renamed and restarted within the last 10-15 minutes

    • The old samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation

    To find what names are present in the NetBIOS name cache on the MS Windows NT4 machine, open a cmd shell, then:

    - 

    -	C:\temp\>nbtstat -n
+
    +C:\> nbtstat -n
 
-	              NetBIOS Local Name Table
+              NetBIOS Local Name Table
 
-	   Name                 Type          Status
-	------------------------------------------------
-	SLACK            <03>  UNIQUE      Registered
-	ADMINISTRATOR    <03>  UNIQUE      Registered
-	SLACK            <00>  UNIQUE      Registered
-	SARDON           <00>  GROUP       Registered
-	SLACK            <20>  UNIQUE      Registered
-	SLACK            <1F>  UNIQUE      Registered
+   Name                 Type          Status
+------------------------------------------------
+FRODO            <03>  UNIQUE      Registered
+ADMINSTRATOR     <03>  UNIQUE      Registered
+FRODO            <00>  UNIQUE      Registered
+SARDON           <00>  GROUP       Registered
+FRODO            <20>  UNIQUE      Registered
+FRODO            <1F>  UNIQUE      Registered
 
 
-	C:\Temp\>nbtstat -c
+C:\> nbtstat -c
 
-	             NetBIOS Remote Cache Name Table
+             NetBIOS Remote Cache Name Table
 
-	   Name                 Type       Host Address     Life [sec]
-	--------------------------------------------------------------
-	FRODO            <20>  UNIQUE      192.168.1.1          240
+   Name                 Type       Host Address     Life [sec]
+--------------------------------------------------------------
+GANDALF	<20>  UNIQUE      192.168.1.1          240
 
-	C:\Temp\>
-	
    
+C:\> 
+

    - In the above example, FRODO is the Samba server and SLACK is the MS Windows NT4 Workstation. - The first listing shows the contents of the Local Name Table (ie: Identity information on + In the above example, GANDALF is the Samba server and FRODO is the MS Windows NT4 Workstation. + The first listing shows the contents of the Local Name Table (i.e.: Identity information on the MS Windows workstation), the second shows the NetBIOS name in the NetBIOS name cache. The name cache contains the remote machines known to this workstation. -

    Prev Up Next
    Chapter 25. PAM based Distributed Authentication Home Chapter 27. Unicode/Charsets
    +

    Prev Up Next
    Chapter 25. PAM based Distributed Authentication Home Chapter 27. Unicode/Charsets
    diff --git a/docs/htmldocs/introduction.html b/docs/htmldocs/introduction.html index 94419cff04..10cb806270 100644 --- a/docs/htmldocs/introduction.html +++ b/docs/htmldocs/introduction.html @@ -1,5 +1,4 @@ -Part I. General Installation
    Part I. General Installation
    Prev   Next

    General Installation

    Preparing Samba for Configuration

    This section of the Samba-HOWTO-Collection contains general info on how to install samba +Part I. General Installation

    Part I. General Installation
    Prev   Next

    General Installation

    Preparing Samba for Configuration

    This section of the Samba-HOWTO-Collection contains general info on how to install samba and how to configure the parts of samba you will most likely need. -PLEASE read this.

    Table of Contents

    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
    What If Things Don't Work?
    Common Errors
    Why are so many smbd processes eating memory?
    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs
    3. Fast Start for the Impatient
    Note
    Prev Up Next
    SAMBA Project Documentation Home Chapter 1. Introduction to Samba
    +PLEASE read this.

    Table of Contents

    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your + server
    Try connecting with the unix client
    Try connecting from another SMB client
    What If Things Don't Work?
    Common Errors
    Large number of smbd processes
    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
    "The network name cannot be found"
    3. Fast Start for the Impatient
    Note
    Prev Up Next
    Attributions Home Chapter 1. Introduction to Samba
    diff --git a/docs/htmldocs/ix01.html b/docs/htmldocs/ix01.html index 4f706aed70..6e09e98de4 100644 --- a/docs/htmldocs/ix01.html +++ b/docs/htmldocs/ix01.html @@ -1 +1,39 @@ -Index
    Index
    Prev   

    Index

    Prev Up 
    Chapter 41. Further Resources Home 
    +Index
    Index
    Prev   

    Index

    Symbols

    "Domain Admins" group, Discussion
    "Domain Users" group, Adding Domain Users to the Power Users group
    "Printers" folder, Caveats to be considered, Installing the PostScript Driver on a Client, Manual Driver Installation in 15 Steps
    "raw" printing, CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    /etc/host.conf, /etc/host.conf
    /etc/hosts, /etc/hosts
    /etc/nsswitch.conf, /etc/nsswitch.conf
    8.3
    file names, MS Windows NTFS Comparison with UNIX File Systems

    A

    ACLs, File, Directory and Share Access Controls
    Active Directory, Samba ADS Domain Membership
    add group script, Adding Groups Fails
    add machine script, The machine trust account not accessible, Adding Machine to Domain Fails
    add printer command, Adding new Printers with the Windows NT APW
    add printer wizard, Three familiar Methods for driver upload plus a new one
    add user script, Mapping User Identifiers between MS Windows and UNIX
    addprinter command, Parameters Recommended for Use
    admin users, User and Group Based Controls, I have set force user but Samba still makes root the owner of all the files I touch!
    Administrator, Discussion
    ADS (see Active Directory)
    ads server, Setup your smb.conf
    application/cups.vnd-postscript, Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver
    application/octet-stream, Explicitly enable "raw" printing for +application/octet-stream!, MIME type Conversion Rules, "application/octet-stream" printing
    application/pdf, MIME types and CUPS Filters
    application/postscript, Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver
    application/vnd.cups-raster, PostScript Printer Descriptions (PPDs) for non-PS Printers
    application/vnd.cups-raw, Explicitly enable "raw" printing for +application/octet-stream!
    auth methods, auth methods does not work, Passdb Backends and Authentication

    B

    bind interfaces only, The tests
    brlock.tdb, The printing *.tdb Files
    (see also TDB)
    browse list, What is Browsing?, Technical Overview of browsing
    browseable, The [printers] Section, Any [my_printer_name] Section, Parameters in the [print$] Section

    C

    case sensitive, Miscellaneous Controls, Windows 9x / Me Profile Setup
    chpass, Manual Creation of Machine Trust Accounts
    client use spnego, I can't join a Windows 2003 PDC
    comment, The [printers] Section, Any [my_printer_name] Section, Parameters in the [print$] Section
    configure, Building the Binaries
    connections.tdb, The printing *.tdb Files
    (see also TDB)
    core files, Internal errors
    create mask, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask + parameters
    csc policy, Miscellaneous Controls
    CUPS
    Page Accounting, Page Accounting with CUPS
    quotas, Setting up Quotas
    CUPS-PPD, cupsomatic, pdqomatic, lpdomatic, directomatic
    cupsaddsmb, Three familiar Methods for driver upload plus a new one, cupsaddsmb: the unknown Utility, Caveats to be considered, Run "cupsaddsmb" (quiet Mode), Run "cupsaddsmb" with verbose Output, Understanding cupsaddsmb, cupsaddsmb with a Samba PDC, cupsaddsmb Flowchart
    cupsomatic, CUPS can use all Windows-formatted Vendor PPDs, The CUPS Filtering Architecture, cupsomatic/Foomatic -- how do they fit into the Picture?, Difference between cupsomatic/foomatic-rip and +native CUPS printing, cupsomatic, pdqomatic, lpdomatic, directomatic
    CVS, Access Samba source code via CVS
    web, Access via CVSweb

    D

    daemon, Alternative: starting it as a daemon
    DDK, PostScript Drivers with no major problems -- even in Kernel +Mode, CUPS Package of "PostScript Driver for WinNT/2k/XP"
    debug, Internal errors
    debug level, Debugging with Samba itself, Log level
    debuglevel, Debug levels
    default case, Miscellaneous Controls
    delete printer command, Adding new Printers with the Windows NT APW
    deleteprinter command, Parameters Recommended for Use
    DHCP, Background Information
    diff, Patches
    directory mask, File and Directory Permissions Based Controls
    directory security mask, Interaction with the standard Samba create mask + parameters
    disable spoolss, Parameters Recommended for Use
    display charset, Samba and charsets
    DNS, TCP/IP - without NetBIOS, DNS Lookup
    Active Directory, DNS and Active Directory
    Dynamic, Background Information
    dns proxy, What is Browsing?
    domain admin group, Mapping MS Windows and UNIX Groups
    domain logons, Preparing for Domain Control
    domain master, Domain Network Logon Service, Example Configuration, What is Browsing?, Making Samba the domain master
    dont descend, Miscellaneous Controls
    dos charset, Samba and charsets, Japanese charsets, CP850.so can't be found
    dos filemode, File and Directory Permissions Based Controls
    dos filetime resolution, Miscellaneous Controls
    dos filetimes, Miscellaneous Controls

    E

    EMF, Windows Drivers, GDI and EMF, From Windows Clients to an NT Print Server, Driver Execution on the Server
    encrypt passwords, Joining an NT4 type Domain with Samba-3, smbpasswd - Encrypted Password Database, smb.conf PAM Configuration, The tests
    enhanced browsing, What is Browsing?
    enumports command, Parameters Recommended for Use, Samba and Printer Ports
    EPM (see ESP meta packager)
    ESC/P, Driver Execution on the Server
    ESP
    Ghostscript, The CUPS Filtering Architecture, Difference between cupsomatic/foomatic-rip and +native CUPS printing
    meta packager, CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Print Pro, Sources of CUPS drivers / PPDs, ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Extended Attributes, File, Directory and Share Access Controls

    F

    fake oplocks, Miscellaneous Controls
    File System, File System Access Controls
    foomatic, CUPS can use all Windows-formatted Vendor PPDs, The CUPS Filtering Architecture, cupsomatic/Foomatic -- how do they fit into the Picture?, Difference between cupsomatic/foomatic-rip and +native CUPS printing, foomatic-rip and Foomatic explained, Foomatic's strange Name
    foomatic-rip, Difference between cupsomatic/foomatic-rip and +native CUPS printing, CUPS Print Drivers from Linuxprinting.org, foomatic-rip and Foomatic explained, The Grand Unification +achieved...
    force create mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask + parameters
    force directory mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask + parameters
    force directory security mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask + parameters
    force group, User and Group Based Controls
    force security mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask + parameters
    force user, User and Group Based Controls, I have set force user but Samba still makes root the owner of all the files I touch!, Beware of Force User
    ftp, Accessing the samba sources via rsync and ftp

    G

    gdb, Internal errors
    GDI, GDI on Windows -- PostScript on UNIX, Windows Drivers, GDI and EMF, From Windows Clients to an NT Print Server, Driver Execution on the Server
    GhostScript, PostScript and Ghostscript, Ghostscript -- the Software RIP for non-PostScript Printers
    (see also PostScript)
    Ghostscript
    ESP (see ESP GhostScript)
    GID, Features and Benefits
    GPG, Verifying Samba's PGP signature
    groupadd, Features and Benefits
    groupdel, Features and Benefits
    groups
    domain, Discussion
    mapping, Mapping MS Windows and UNIX Groups
    nested, Adding MS Windows Groups to MS Windows Groups Fails
    guest account, Problem resolution, My client reports "This server is not configured to list shared resources", The [printers] Section
    guest ok, User and Group Based Controls, The [printers] Section, Any [my_printer_name] Section, Parameters in the [print$] Section

    H

    hide dot files, Miscellaneous Controls
    hide files, Miscellaneous Controls
    hide unreadable, File and Directory Permissions Based Controls
    hide unwriteable files, File and Directory Permissions Based Controls
    host msdfs, Features and Benefits
    hosts allow, Using host based protection, Parameters Recommended for Use, Any [my_printer_name] Section
    hosts deny, Using host based protection, Parameters Recommended for Use, Any [my_printer_name] Section

    I

    idmap gid, Features and Benefits, Winbind is not resolving users and groups
    idmap uid, Features and Benefits, Winbind is not resolving users and groups
    ifconfig, Starting from inetd.conf
    imprints, Three familiar Methods for driver upload plus a new one
    inetd, The tests, Starting the smbd and nmbd, Starting from inetd.conf
    Interdomain Trusts, Interdomain Trust Relationships
    completing, Completing an NT4 Domain Trust
    creating, Native MS Windows NT4 Trusts Configuration
    Facilities, Inter-Domain Trust Facilities
    interfaces, Multiple interfaces, The tests, Starting from inetd.conf
    invalid users, User and Group Based Controls
    IPP, Understanding cupsaddsmb

    K

    KDC, Samba ADS Domain Membership
    Kerberos, Samba ADS Domain Membership
    kinit, Setup your /etc/krb5.conf

    L

    ldap admin dn, Configuring Samba
    ldap delete dn, Configuring Samba
    ldap filter, Configuring Samba
    ldap machine suffix, Configuring Samba
    ldap passwd sync, Configuring Samba, Password synchronisation
    ldap ssl, Configuring Samba, Security and sambaSamAccount
    ldap suffix, Configuring Samba
    ldap trust ids, Configuring Samba
    ldap user suffix, Configuring Samba
    libnss_wins.so, /etc/nsswitch.conf
    Links
    hard, MS Windows NTFS Comparison with UNIX File Systems
    soft, MS Windows NTFS Comparison with UNIX File Systems
    Linuxprinting.org, CUPS Print Drivers from Linuxprinting.org
    lm announce, What is Browsing?
    lm interval, What is Browsing?
    LMB (see Local Master Browser)
    LMHOSTS, The LMHOSTS file
    load printers, Parameters Recommended for Use, A little Experiment to warn you, The [global] Section
    local master, What is Browsing?, Setting up WORKGROUP Browsing
    Local Master Browser, Use of the Remote Announce parameter
    locking, Discussion
    locking.tdb, The printing *.tdb Files
    (see also TDB)
    log files
    monitoring, Assumptions
    log level, Adding Machine to Domain Fails, extd_audit, Debug levels
    logon drive, Windows NT4 Workstation
    logon home, LDAP special attributes for sambaSamAccounts, Windows 9x / Me User Profiles, Mixed Windows 9x / Me and Windows NT4/200x User Profiles, Windows NT4 Workstation, Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    logon path, LDAP special attributes for sambaSamAccounts, Mixed Windows 9x / Me and Windows NT4/200x User Profiles, Windows 9x / Me Profile Setup, Windows NT4 Workstation, Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    logon script, LDAP special attributes for sambaSamAccounts
    lpadmin, CUPS Print Drivers from Linuxprinting.org, Setting up Quotas
    lppause command, Parameters Recommended for Use, Linking of smbd with libcups.so, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions
    lpq cache time, Parameters Recommended for Use, The [global] Section
    lpq command, Parameters Recommended for Use, Linking of smbd with libcups.so, Pre-conditions
    lpresume command, Parameters Recommended for Use, Linking of smbd with libcups.so, Pre-conditions
    lprm command, Parameters Recommended for Use, Linking of smbd with libcups.so, Pre-conditions
    lpstat, Troubleshooting revisited

    M

    MAC Addresses, /etc/hosts
    machine trust accounts, MS Windows Workstation/Server Machine Trust Accounts
    creating, MS Windows Workstation/Server Machine Trust Accounts
    make, Building the Binaries
    mangling method, Japanese charsets
    map to guest, Parameters in the [print$] Section, Adding new Printers with the Windows NT APW, Can't reconnect to Samba under new account + from Win2K/XP, Avoid being connected to the Samba server as the + "wrong" user
    max print jobs, Parameters Recommended for Use
    max xmit, Max xmit
    messages.tdb, The printing *.tdb Files
    (see also TDB)
    MIME, MIME types and CUPS Filters, MIME type Conversion Rules, Filter Requirements, "application/octet-stream" printing
    min print space, Parameters Recommended for Use
    msdfs root, Features and Benefits

    N

    name resolve order, What is Browsing?
    nbtstat, The NetBIOS Name Cache
    NetBIOS, Features and Benefits, TCP/IP - without NetBIOS, Integrating MS Windows networks with Samba, Name resolution as used within MS Windows networking
    NetBIOS-less, TCP/IP - without NetBIOS
    nmblookup, The NetBIOS Name Cache
    nt acl support, File and Directory Permissions Based Controls, Viewing file ownership, Viewing File or Directory Permissions, Modifying file or directory permissions, Windows 2000 Service Pack 2
    ntdrivers.tdb, The printing *.tdb Files
    (see also TDB)
    ntforms.tdb, The printing *.tdb Files
    (see also TDB)
    NTFS, File System Access Controls
    ntprinters.tdb, The printing *.tdb Files
    (see also TDB)

    O

    obey pam restrictions, smb.conf PAM Configuration
    only user, User and Group Based Controls, Why can users access home directories of other users?
    oplock break wait time, Advanced Samba Opportunistic Locking Parameters, Disabling Kernel OpLocks
    oplock contention limit, Advanced Samba Opportunistic Locking Parameters
    os level, What is Browsing?, Setting up WORKGROUP Browsing, Setting up DOMAIN Browsing, Forcing Samba to be the master, Making Samba the domain master
    os2 driver map, Parameters Recommended for Use, Printer driver download for for OS/2 clients?

    P

    page_log, The page_log File Syntax
    passdb backend, MS Windows Workstation/Server Machine Trust Accounts, Account Information Databases, Technical Information, The pdbedit Command, Configuring Samba, Configuring, Users can not logon, auth methods does not work, Passdb Backends and Authentication
    password level, Password checking, The tests, Case handling of passwords, Slow Logins
    password server, Server Security (User Level Security), Security Mode and Master Browsers, Joining an NT4 type Domain with Samba-3, The tests
    patch, Patches
    path, "The network name cannot be found", The [printers] Section, Any [my_printer_name] Section, Print Commands, Creating the [print$] Share, Parameters in the [print$] Section, Subdirectory Structure in [print$], Samba receiving Jobfiles and passing them to CUPS, Auto-Deletion or Preservation of CUPS Spool Files, Permissions on +/var/spool/samba/ get reset after each +reboot, The tests
    PCL, GDI on Windows -- PostScript on UNIX, UNIX Printfile Conversion and GUI Basics, Driver Execution on the Server, Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PDF, Windows Drivers, GDI and EMF, PostScript Printer Description (PPD) Specification
    pdf, MIME type Conversion Rules
    PDL, GDI on Windows -- PostScript on UNIX, PostScript and Ghostscript
    PJL, Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs, Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver, Adobe and CUPS PostScript Drivers for Windows Clients
    point and print, Driver Installation Methods on Windows Clients, Three familiar Methods for driver upload plus a new one, cupsomatic/Foomatic -- how do they fit into the Picture?, Run "cupsaddsmb" (quiet Mode), Installing the PostScript Driver on a Client, Manual Driver Installation in 15 Steps
    PostScript, Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download, GDI on Windows -- PostScript on UNIX, UNIX Printfile Conversion and GUI Basics, PostScript and Ghostscript, Prefilters, Driver Execution on the Server, Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs, CUPS: a "Magical Stone"?, CUPS Package of "PostScript Driver for WinNT/2k/XP"
    (see also Ghostscript)
    RIP, PostScript and Ghostscript
    PPD, PostScript and Ghostscript, PostScript Printer Description (PPD) Specification, PostScript Printer Descriptions (PPDs) for non-PS Printers, PPDs for non-PS Printers on UNIX, PPDs for non-PS Printers on Windows, CUPS: a "Magical Stone"?, Installing the PostScript Driver on a Client
    CUPS (see CUPS-PPD)
    preferred master, What is Browsing?, Setting up WORKGROUP Browsing, Forcing Samba to be the master, Making Samba the domain master, The tests
    preserve case, Windows 9x / Me Profile Setup
    print command, Parameters Recommended for Use, The [global] Section, Default Print Commands for various UNIX Print Subsystems, Setting up your own Print Commands, Linking of smbd with libcups.so, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions, Manual Configuration
    print ok , Parameters Recommended for Use
    printable, Parameters Recommended for Use, The [printers] Section, Any [my_printer_name] Section
    printcap, Parameters Recommended for Use, Default Print Commands for various UNIX Print Subsystems, Basic Configuration of CUPS support, Linking of smbd with libcups.so, More complex smb.conf Settings for +CUPS, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions
    printcap name, Parameters Recommended for Use, The [global] Section
    printer, Parameters Recommended for Use
    printer admin, Parameters Recommended for Use, The [global] Section, Any [my_printer_name] Section, Parameters in the [print$] Section, Setting Drivers for existing Printers with a Client GUI, IMPORTANT! Setting Device Modes on new Printers, Always make first Client Connection as root or "printer admin", Setting Default Print Options for the Client Drivers, Adding new Printers with the Windows NT APW, More complex smb.conf Settings for +CUPS, What is required for adddriver and setdriver to succeed, Print options for all users can't be set on Win2K/XP
    printer name, Parameters Recommended for Use
    printing, Parameters Recommended for Use, The [global] Section, Default Print Commands for various UNIX Print Subsystems, Setting up your own Print Commands, Basic Configuration of CUPS support, Linking of smbd with libcups.so, More complex smb.conf Settings for +CUPS, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions, Manual Configuration
    printing.tdb, The printing *.tdb Files
    (see also TDB)
    PrintPro (see ESP Print Pro)
    public, The [printers] Section

    Q

    queue resume command, Linking of smbd with libcups.so
    queuepause command, Parameters Recommended for Use, Linking of smbd with libcups.so
    queueresume command, Parameters Recommended for Use

    R

    read list, User and Group Based Controls
    read only, Miscellaneous Controls, The [printers] Section, Parameters in the [print$] Section
    read raw, Read raw
    read size, Read size
    remote announce, NetBIOS over TCP/IP, How Browsing Functions, Use of the Remote Announce parameter, Browsing support in Samba
    remote browse sync, NetBIOS over TCP/IP, How Browsing Functions, Use of the Remote Browse Sync parameter
    root preexec, Logon Scripts
    rpcclient
    adddriver, Run "cupsaddsmb" with verbose Output, Understanding cupsaddsmb, Installing PostScript Driver Files manually (using +rpcclient), Understanding the rpcclient man page, What is required for adddriver and setdriver to succeed, Manual Driver Installation in 15 Steps
    enumdrivers, Installing PostScript Driver Files manually (using +rpcclient), Manual Driver Installation in 15 Steps
    enumports, Installing PostScript Driver Files manually (using +rpcclient)
    enumprinters, Installing PostScript Driver Files manually (using +rpcclient), What is required for adddriver and setdriver to succeed, Manual Driver Installation in 15 Steps, Troubleshooting revisited
    getdriver, Producing an Example by querying a Windows Box, Manual Driver Installation in 15 Steps
    getprinter, Producing an Example by querying a Windows Box, Manual Driver Installation in 15 Steps, Troubleshooting revisited
    setdriver, Caveats to be considered, Run "cupsaddsmb" with verbose Output, Understanding cupsaddsmb, Installing PostScript Driver Files manually (using +rpcclient), What is required for adddriver and setdriver to succeed, Manual Driver Installation in 15 Steps
    rsync, Accessing the samba sources via rsync and ftp

    S

    secrets.tdb, The printing *.tdb Files
    (see also TDB)
    security, Samba Security Modes, Domain Security Mode (User Level Security), Server Security (User Level Security), What makes Samba a SERVER?, What makes Samba a Domain Controller?, What makes Samba a Domain Member?, Constantly Losing Connections to Password Server, Preparing for Domain Control, Security Mode and Master Browsers, Joining an NT4 type Domain with Samba-3, Why is this better than security = server?, Setup your smb.conf, Run "cupsaddsmb" (quiet Mode), "cupsaddsmb" keeps asking for root password in + neverending loop, Passdb Backends and Authentication, The tests, Configuring WfW password handling
    security mask, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask + parameters
    Server Manager, MS Windows Workstation/Server Machine Trust Accounts, Manual Creation of Machine Trust Accounts
    sessionid.tdb, The printing *.tdb Files
    (see also TDB)
    share_info.tdb, The printing *.tdb Files
    (see also TDB)
    short preserve case, Miscellaneous Controls, Windows 9x / Me Profile Setup
    Short-Cuts, MS Windows NTFS Comparison with UNIX File Systems
    show add printer wizard, Parameters Recommended for Use, The [global] Section, Adding new Printers with the Windows NT APW
    SID, Features and Benefits
    Single Sign On, Caveats to be considered
    smbclient, Testing with smbclient, The tests
    socket options, Socket options
    spooling
    central, Central spooling vs. "Peer-to-Peer" printing
    peer-to-peer, Central spooling vs. "Peer-to-Peer" printing
    spooling-only, CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    strict locking, Discussion

    T

    TDB, The printing *.tdb Files, Trivial DataBase Files
    backing up (see tdbbackup)
    tdbbackup, Using tdbbackup
    template homedir, Linux/FreeBSD-specific PAM configuration
    testparm, The tests
    text/plain, MIME type Conversion Rules
    total print jobs, Parameters Recommended for Use, The [global] Section

    U

    UDP, NetBIOS over TCP/IP
    UID, Features and Benefits
    unexpected.tdb, The printing *.tdb Files
    (see also TDB)
    unix charset, Samba and charsets, Japanese charsets
    use client driver, Parameters Recommended for Use, The [global] Section
    user, Share Level Security, The tests
    User Manager, Samba as the Trusted Domain, Samba as the Trusting Domain
    useradd, Manual Creation of Machine Trust Accounts
    username, User and Group Based Controls
    username level, Password checking
    username map, Windows 200x XP Professional

    V

    valid users, User and Group Based Controls, The tests
    veto files, Miscellaneous Controls
    vfs objects, Discussion
    vipw, Manual Creation of Machine Trust Accounts

    W

    winbind separator, Start up the winbindd daemon and test it!
    WINS, What is Browsing?, NetBIOS over TCP/IP, WINS Lookup
    wins hook, What is Browsing?
    wins proxy, What is Browsing?
    wins server, What is Browsing?, WINS - The Windows Internetworking Name Server, Setting up a WINS server
    wins support, What is Browsing?, WINS - The Windows Internetworking Name Server, Setting up a WINS server
    workgroup, Security Mode and Master Browsers, Joining an NT4 type Domain with Samba-3, Browsing support in Samba
    write list, User and Group Based Controls, Parameters in the [print$] Section
    write raw, Write raw
    writeable, The [printers] Section, Any [my_printer_name] Section
    WYSIWYG, Windows Drivers, GDI and EMF

    X

    X Window System, UNIX Printfile Conversion and GUI Basics
    xinetd, Starting from inetd.conf (see inetd)
    Xprint, UNIX Printfile Conversion and GUI Basics
    Prev Up 
    Chapter 41. Further Resources Home 
    diff --git a/docs/htmldocs/lmhosts.5.html b/docs/htmldocs/lmhosts.5.html index b96ddf8ddb..f0a1d02172 100644 --- a/docs/htmldocs/lmhosts.5.html +++ b/docs/htmldocs/lmhosts.5.html @@ -18,10 +18,10 @@ 192.9.200.20 NTSERVER#20 192.9.200.21 SAMBASERVER

    Contains three IP to NetBIOS name mappings. The first - and third will be returned for any queries for the names "TESTPC" - and "SAMBASERVER" respectively, whatever the type component of - the NetBIOS name requested.

    The second mapping will be returned only when the "0x20" name - type for a name "NTSERVER" is queried. Any other name type will not + and third will be returned for any queries for the names "TESTPC" + and "SAMBASERVER" respectively, whatever the type component of + the NetBIOS name requested.

    The second mapping will be returned only when the "0x20" name + type for a name "NTSERVER" is queried. Any other name type will not be resolved.

    The default location of the lmhosts file is in the same directory as the smb.conf(5) file.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    smbclient(1), smb.conf(5), and smbpasswd(8)

    AUTHOR

    The original Samba software and related utilities diff --git a/docs/htmldocs/locking.html b/docs/htmldocs/locking.html index a128cac7ce..07228df19d 100644 --- a/docs/htmldocs/locking.html +++ b/docs/htmldocs/locking.html @@ -1,7 +1,7 @@ -Chapter 14. File and Record Locking

    Chapter 14. File and Record Locking
    Prev Part III. Advanced Configuration Next

    Chapter 14. File and Record Locking

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Eric Roseme

    HP Oplocks Usage Recommendations Whitepaper

    Table of Contents

    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Additional Reading

    +Chapter 14. File and Record Locking

    Chapter 14. File and Record Locking
    Prev Part III. Advanced Configuration Next

    Chapter 14. File and Record Locking

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Eric Roseme

    HP Oplocks Usage Recommendations Whitepaper

    Table of Contents

    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Problems saving files in MS Office on Windows XP
    Long delays deleting files over network with XP SP1
    Additional Reading

    One area which causes trouble for many network administrators is locking. The extent of the problem is readily evident from searches over the internet. -

    Features and Benefits

    +

    Features and Benefits

    Samba provides all the same locking semantics that MS Windows clients expect and that MS Windows NT4 / 200x servers provide also.

    @@ -23,13 +23,13 @@ settings on the MS Windows client.

    Note

    Sometimes it is necessary to disable locking control settings BOTH on the Samba server as well as on each MS Windows client! -

    Discussion

    +

    Discussion

    There are two types of locking which need to be performed by a SMB server. The first is record locking which allows a client to lock a range of bytes in a open file. The second is the deny modes that are specified when a file is open.

    -Record locking semantics under Unix is very different from record locking under +Record locking semantics under UNIX are very different from record locking under Windows. Versions of Samba before 2.2 have tried to use the native fcntl() unix system call to implement proper record locking between different Samba clients. This can not be fully correct due to several reasons. The simplest is the fact @@ -40,29 +40,29 @@ many more differences, too many to be listed here.

    Samba 2.2 and above implements record locking completely independent of the underlying unix system. If a byte range lock that the client requests happens -to fall into the range 0-2^31, Samba hands this request down to the Unix system. +to fall into the range 0-2^31, Samba hands this request down to the UNIX system. All other locks can not be seen by unix anyway.

    -Strictly a SMB server should check for locks before every read and write call on -a file. Unfortunately with the way fcntl() works this can be slow and may overstress +Strictly an SMB server should check for locks before every read and write call on +a file. Unfortunately with the way fcntl() works this can be slow and may over-stress the rpc.lockd. It is also almost always unnecessary as clients are supposed to independently make locking calls before reads and writes anyway if locking is important to them. By default Samba only makes locking calls when explicitly asked -to by a client, but if you set strict locking = yes then it +to by a client, but if you set strict locking = yes then it will make lock checking calls on every read and write.

    -You can also disable by range locking completely using locking = no. +You can also disable byte range locking completely using locking = no. This is useful for those shares that don't support locking or don't need it (such as cdroms). In this case Samba fakes the return codes of locking calls to tell clients that everything is OK.

    -The second class of locking is the deny modes. These +The second class of locking is the deny modes. These are set by an application when it opens a file to determine what types of access should be allowed simultaneously with its open. A client may ask for DENY_NONE, DENY_READ, DENY_WRITE or DENY_ALL. There are also special compatibility modes called DENY_FCB and DENY_DOS. -

    Opportunistic Locking Overview

    +

    Opportunistic Locking Overview

    Opportunistic locking (Oplocks) is invoked by the Windows file system (as opposed to an API) via registry entries (on the server AND client) for the purpose of enhancing network performance when accessing a file @@ -185,7 +185,7 @@ In mission critical high availability environments, careful attention should be given to opportunistic locking. Ideally, comprehensive testing should be done with all affected applications with oplocks enabled and disabled. -

    Exclusively Accessed Shares

    +

    Exclusively Accessed Shares

    Opportunistic locking is most effective when it is confined to shares that are exclusively accessed by a single user, or by only one user at a time. Because the true value of opportunistic locking is the local @@ -194,7 +194,7 @@ mechanism will cause a delay.

    Home directories are the most obvious examples of where the performance benefit of opportunistic locking can be safely realized. -

    Multiple-Accessed Shares or Files

    +

    Multiple-Accessed Shares or Files

    As each additional user accesses a file in a share with opportunistic locking enabled, the potential for delays and resulting perceived poor performance increases. When multiple users are accessing a file on a @@ -206,17 +206,17 @@ of the caching user. As each additional client attempts to access a file with oplocks set, the potential performance improvement is negated and eventually results in a performance bottleneck. -

    Unix or NFS Client Accessed Files

    -Local Unix and NFS clients access files without a mandatory +

    UNIX or NFS Client Accessed Files

    +Local UNIX and NFS clients access files without a mandatory file locking mechanism. Thus, these client platforms are incapable of initiating an oplock break request from the server to a Windows client -that has a file cached. Local Unix or NFS file access can therefore +that has a file cached. Local UNIX or NFS file access can therefore write to a file that has been cached by a Windows client, which exposes the file to likely data corruption.

    -If files are shared between Windows clients, and either local Unix +If files are shared between Windows clients, and either local UNIX or NFS users, then turn opportunistic locking off. -

    Slow and/or Unreliable Networks

    +

    Slow and/or Unreliable Networks

    The biggest potential performance improvement for opportunistic locking occurs when the client-side caching of reads and writes delivers the most differential over sending those reads and writes over the wire. @@ -231,7 +231,7 @@ the most advantageous scenario to utilize opportunistic locking. If the network is slow, unreliable, or a WAN, then do not configure opportunistic locking if there is any chance of multiple users regularly opening the same file. -

    Multi-User Databases

    +

    Multi-User Databases

    Multi-user databases clearly pose a risk due to their very nature - they are typically heavily accessed by numerous users at random intervals. Placing a multi-user database on a share with opportunistic @@ -239,7 +239,7 @@ locking enabled will likely result in a locking management bottleneck on the Samba server. Whether the database application is developed in-house or a commercially available product, ensure that the share has opportunistic locking disabled. -

    PDM Data Shares

    +

    PDM Data Shares

    Process Data Management (PDM) applications such as IMAN, Enovia, and Clearcase, are increasing in usage with Windows client platforms, and therefore SMB data stores. PDM applications manage multi-user @@ -252,8 +252,8 @@ application and PDM server to negotiate and maintain. It is appropriate to eliminate the client OS from any caching tasks, and the server from any oplock management, by disabling opportunistic locking on the share. -

    Beware of Force User

    -Samba includes an smb.conf parameter called force user that changes +

    Beware of Force User

    +Samba includes an smb.conf parameter called force user that changes the user accessing a share from the incoming user to whatever user is defined by the smb.conf variable. If opportunistic locking is enabled on a share, the change in user access causes an oplock break to be sent @@ -265,26 +265,26 @@ to overcome the lost oplock break.

    Avoid the combination of the following:

    • - force user in the smb.conf share configuration. + force user in the smb.conf share configuration.

    • Slow or unreliable networks

    • Opportunistic Locking Enabled -

    Advanced Samba Opportunistic Locking Parameters

    +

    Advanced Samba Opportunistic Locking Parameters

    Samba provides opportunistic locking parameters that allow the administrator to adjust various properties of the oplock mechanism to account for timing and usage levels. These parameters provide good versatility for implementing oplocks in environments where they would likely cause problems. The parameters are: -oplock break wait time, -oplock contention limit. +oplock break wait time, +oplock contention limit.

    For most users, administrators, and environments, if these parameters are required, then the better option is to simply turn oplocks off. The samba SWAT help text for both parameters reads "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." This is good advice. -

    Mission Critical High Availability

    +

    Mission Critical High Availability

    In mission critical high availability environments, data integrity is often a priority. Complex and expensive configurations are implemented to ensure that if a client loses connectivity with a file server, a @@ -314,10 +314,10 @@ In mission critical high availability environments, careful attention should be given to opportunistic locking. Ideally, comprehensive testing should be done with all affected applications with oplocks enabled and disabled. -

    Samba Opportunistic Locking Control

    +

    Samba Opportunistic Locking Control

    Opportunistic Locking is a unique Windows file locking feature. It is not really file locking, but is included in most discussions of Windows -file locking, so is considered a defacto locking feature. +file locking, so is considered a de facto locking feature. Opportunistic Locking is actually part of the Windows client file caching mechanism. It is not a particularly robust or reliable feature when implemented on the variety of customized networks that exist in @@ -348,7 +348,7 @@ file locking with the under lying OS, SGI IRIX and Linux are the only two OS's t oplock aware at this time.

    Unless your system supports kernel oplocks, you should disable oplocks if you are -accessing the same files from both Unix/Linux and SMB clients. Regardless, oplocks should +accessing the same files from both UNIX/Linux and SMB clients. Regardless, oplocks should always be disabled if you are sharing a database file (e.g., Microsoft Access) between multiple clients, as any break the first client receives will affect synchronisation of the entire file (not just the single record), which will result in a noticeable performance @@ -364,29 +364,23 @@ of your client sending oplock breaks and will instead want to disable oplocks fo

    Another factor to consider is the perceived performance of file access. If oplocks provide no measurable speed benefit on your network, it might not be worth the hassle of dealing with them. -

    Example Configuration

    +

    Example Configuration

    In the following we examine two distinct aspects of Samba locking controls. -

    Disabling Oplocks

    +

    Disabling Oplocks

    You can disable oplocks on a per-share basis with the following:

    -

    -[acctdata]
-	oplocks = False
-	level2 oplocks = False
-

    +

    [acctdata]
    oplocks = False
    level2 oplocks = False

    The default oplock type is Level1. Level2 Oplocks are enabled on a per-share basis in the smb.conf file.

    Alternately, you could disable oplocks on a per-file basis within the share:

    -

    -	veto oplock files = /*.mdb/*.MDB/*.dbf/*.DBF/
-

    +

    veto oplock files = /*.mdb/*.MDB/*.dbf/*.DBF/

    If you are experiencing problems with oplocks as apparent from Samba's log entries, you may want to play it safe and disable oplocks and level2 oplocks. -

    Disabling Kernel OpLocks

    +

    Disabling Kernel OpLocks

    Kernel OpLocks is an smb.conf parameter that notifies Samba (if the UNIX kernel has the capability to send a Windows client an oplock break) when a UNIX process is attempting to open the file that is @@ -399,10 +393,7 @@ send an oplock break, then the kernel oplocks parameter enables Samba to send the oplock break. Kernel oplocks are enabled on a per-server basis in the smb.conf file.

    -

    -[global]
-kernel oplocks = yes
-

    +

    kernel oplocks = yes

    The default is "no".

    Veto OpLocks is an smb.conf parameter that identifies specific files for @@ -417,24 +408,15 @@ caching without the risk of data corruption. Veto Oplocks can be enabled on a per-share basis, or globally for the entire server, in the smb.conf file:

    -

    <title>Example Veto OpLock Settings</title>
-[global]
-        veto oplock files = /filename.htm/*.txt/
-
-[share_name]
-        veto oplock files = /*.exe/filename.ext/
-

    +

    Example 14.1. Share with some files oplocked

    [global]
    veto oplock files = /filename.htm/*.txt/
    [share_name]
    veto oplock files = /*.exe/filename.ext/

    -Oplock break wait time is an smb.conf parameter that adjusts the time + oplock break wait time is an smb.conf parameter that adjusts the time interval for Samba to reply to an oplock break request. Samba recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Wait Time can only be configured globally in the smb.conf file:

    -

    -[global]
-          oplock break wait time =  0 (default)
-

    +

    oplock break wait time = 0 (default)

    Oplock break contention limit is an smb.conf parameter that limits the response of the Samba server to grant an oplock if the configured @@ -444,14 +426,8 @@ HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Contention Limit can be enable on a per-share basis, or globally for the entire server, in the smb.conf file:

    -

    -[global]
-          oplock break contention limit =  2 (default)
-
-[share_name]
-         oplock break contention limit =  2 (default)
-

    -

    MS Windows Opportunistic Locking and Caching Controls

    +

    Example 14.2. 

    [global]
    oplock break contention limit = 2 (default)
    [share_name]
    oplock break contention limit = 2 (default)

    +

    MS Windows Opportunistic Locking and Caching Controls

    There is a known issue when running applications (like Norton Anti-Virus) on a Windows 2000/ XP workstation computer that can affect any application attempting to access shared database files across a network. This is a result of a default setting configured in the Windows 2000/XP @@ -543,7 +519,7 @@ An illustration of how level II oplocks work: station holds any oplock on the file. Because the workstations can have no cached writes or locks at this point, they need not respond to the break-to-none advisory; all they need do is invalidate locally cashed read-ahead data. -

    Workstation Service Entries

    +

    Workstation Service Entries

     	\HKEY_LOCAL_MACHINE\System\
 		CurrentControlSet\Services\LanmanWorkstation\Parameters
 
@@ -552,7 +528,7 @@ An illustration of how level II oplocks work:

    Indicates whether the redirector should use opportunistic-locking (oplock) performance enhancement. This parameter should be disabled only to isolate problems. -

    Server Service Entries

    +

    Server Service Entries

     	\HKEY_LOCAL_MACHINE\System\
 		CurrentControlSet\Services\LanmanServer\Parameters
 
@@ -581,8 +557,8 @@ the server disables raw I/O and opportunistic locking for this connection.
 Specifies the time that the server waits for a client to respond to an oplock break
 request. Smaller values can allow detection of crashed clients more quickly but can
 potentially cause loss of cached data.
-

    Persistent Data Corruption

    -If you have applied all of the settings discussed in this paper but data corruption problems +

    Persistent Data Corruption

    +If you have applied all of the settings discussed in this chapter but data corruption problems and other symptoms persist, here are some additional things to check out:

    We have credible reports from developers that faulty network hardware, such as a single @@ -592,7 +568,7 @@ rebuild the data files in question. This involves creating a new data file with same definition as the file to be rebuilt and transferring the data from the old file to the new one. There are several known methods for doing this that can be found in our Knowledge Base. -

    Common Errors

    +

    Common Errors

    In some sites locking problems surface as soon as a server is installed, in other sites locking problems may not surface for a long time. Almost without exception, when a locking problem does surface it will cause embarrassment and potential data corruption. @@ -622,18 +598,23 @@ so far: report on https://bugzilla.samba.org without delay. Make sure that you give as much information as you possibly can to help isolate the cause and to allow reproduction of the problem (an essential step in problem isolation and correction). -

    locking.tdb error messages

    - 

    -	> We are seeing lots of errors in the samba logs like:
-	>
-	>    tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic
-	> 0x4d6f4b61 at offset=36116
-	>
-	> What do these mean?
-

    +

    locking.tdb error messages

    + “ + We are seeing lots of errors in the samba logs like: +” +

    +tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic
+ 0x4d6f4b61 at offset=36116
+

    +“ + What do these mean? + ”

    Corrupted tdb. Stop all instances of smbd, delete locking.tdb, restart smbd. -

    Additional Reading

    +

    Problems saving files in MS Office on Windows XP

    This is a bug in Windows XP. More information can be + found in Microsoft Knowledge Base article 812937.

    Long delays deleting files over network with XP SP1

    “It sometimes takes approximately 35 seconds to delete files over the network after XP SP1 has been applied”

    This is a bug in Windows XP. More information can be + found in + Microsoft Knowledge Base article 811492.

    Additional Reading

    You may want to check for an updated version of this white paper on our Web site from time to time. Many of our white papers are updated as information changes. For those papers, the Last Edited date is always at the top of the paper. @@ -653,4 +634,4 @@ Microsoft Corporation, April 2001, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202. -

    Prev Up Next
    Chapter 13. File, Directory and Share Access Controls Home Chapter 15. Securing Samba
    +

    Prev Up Next
    Chapter 13. File, Directory and Share Access Controls Home Chapter 15. Securing Samba
    diff --git a/docs/htmldocs/log2pcap.1.html b/docs/htmldocs/log2pcap.1.html new file mode 100644 index 0000000000..c84bbdbb4d --- /dev/null +++ b/docs/htmldocs/log2pcap.1.html @@ -0,0 +1,29 @@ +log2pcap

    Name

    log2pcap — Extract network traces from Samba log files

    Synopsis

    log2pcap [-h] [-q] [logfile] [pcap_file]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    log2pcap reads in a + samba log file and generates a pcap file (readable + by most sniffers, such as ethereal or tcpdump) based on the packet + dumps in the log file.

    The log file must have a log level + of at least 5 to get the SMB header/parameters + right, 10 to get the first 512 data bytes of the + packet and 50 to get the whole packet. +

    OPTIONS

    -h

    If this parameter is + specified the output file will be a + hex dump, in a format that is readable + by the text2pcap utility.

    -q

    Be quiet. No warning messages about missing + or incomplete data will be given.

    logfile

    + Samba log file. log2pcap will try to read the log from stdin + if the log file is not specified. +

    pcap_file

    + Name of the output file to write the pcap (or hexdump) data to. + If this argument is not specified, output data will be written + to stdout. +

    -h|--help

    Print a summary of command line options. +

    EXAMPLES

    Extract all network traffic from all samba log files:

    +	$ cat /var/log/* | log2pcap > trace.pcap
+

    Convert to pcap using text2pcap:

    +	$ log2pcap -h samba.log | text2pcap -T 139,139 - trace.pcap
+

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    BUGS

    Only SMB data is extracted from the samba logs, no LDAP, + NetBIOS lookup or other data.

    The generated TCP and IP headers don't contain a valid + checksum.

    SEE ALSO

    text2pcap(1), ethereal(1)

    AUTHOR

    The original Samba software and related utilities + were created by Andrew Tridgell. Samba is now developed + by the Samba Team as an Open Source project similar + to the way the Linux kernel is developed.

    This manpage was written by Jelmer Vernooij.

    diff --git a/docs/htmldocs/migration.html b/docs/htmldocs/migration.html index b8027a62ea..36b6edb0b1 100644 --- a/docs/htmldocs/migration.html +++ b/docs/htmldocs/migration.html @@ -1 +1 @@ -Part IV. Migration and Updating
    Part IV. Migration and Updating
    Prev   Next

    Migration and Updating

    Table of Contents

    30. Upgrading from Samba-2.x to Samba-3.0.0
    Charsets
    Obsolete configuration options
    Password Backend
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    Prev Up Next
    Chapter 29. High Availability Options Home Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    +Part IV. Migration and Updating
    Part IV. Migration and Updating
    Prev   Next

    Migration and Updating

    Table of Contents

    30. Upgrading from Samba-2.x to Samba-3.0.0
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (changes in behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    Charsets
    LDAP
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    Prev Up Next
    Chapter 29. High Availability Options Home Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    diff --git a/docs/htmldocs/mount.cifs.8.html b/docs/htmldocs/mount.cifs.8.html new file mode 100644 index 0000000000..766e00fd11 --- /dev/null +++ b/docs/htmldocs/mount.cifs.8.html @@ -0,0 +1,103 @@ +mount.cifs

    Name

    mount.cifs — mount using the Common Internet File System (CIFS)

    Synopsis

    mount.cifs {service} {mount-point} [-o options]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    mount.cifs mounts a Linux CIFS filesystem. It +is usually invoked indirectly by +the mount(8) command when using the +"-t cifs" option. This command only works in Linux, and the kernel must +support the cifs filesystem. The CIFS protocol is the successor to the +SMB protocol and is supported by most Windows servers and many other +commercial servers and Network Attached Storage appliances as well as +by the popular Open Source server Samba. +

    + The mount.cifs utility attaches the UNC name (exported network resource) to + the local directory mount-point. It is possible to set the mode for mount.cifs to +setuid root to allow non-root users to mount shares to directories for which they +have write permission. +

    + Options to mount.cifs are specified as a comma-separated +list of key=value pairs. It is possible to send options other +than those listed here, assuming that cifs supports them. If +you get mount failures, check your kernel log for errors on +unknown options. +

    mount.cifs is a daemon. After mounting it keeps running until + the mounted resource is unmounted (usually via the umount utility) +

    OPTIONS

    username=arg

    specifies the username to connect as. If + this is not given, then the environment variable USER is used. This option can also take the +form "user%password" or "user/workgroup" or +"user/workgroup%password" to allow the password and workgroup +to be specified as part of the username. +

    password=arg

    specifies the CIFS password. If this +option is not given then the environment variable +PASSWD is used. If it can find +no password mount.cifs will prompt +for a passeword, unless the guest option is +given. +

    Note that password which contain the arguement delimiter +character (i.e. a comma ',') will failed to be parsed correctly +on the command line. However, the same password defined +in the PASSWD environment variable or a credentials file (see +below) will be read correctly. +

    credentials=filename

    + specifies a file that contains a username + and/or password. The format of the file is: + 

    +.nf
+		username = value
+		password = value
+.fi
+

    +This is preferred over having passwords in plaintext in a +shared file, such as /etc/fstab. Be sure to protect any +credentials file properly. +

    uid=arg

    sets the uid that will own all files on + the mounted filesystem. + It may be specified as either a username or a numeric uid. + This parameter is ignored when the target server supports + the CIFS Unix extensions.

    gid=arg

    sets the gid that will own all files on +the mounted filesystem. +It may be specified as either a groupname or a numeric +gid. This parameter is ignored when the target server supports +the CIFS Unix extensions. +

    port=arg

    sets the port number on the server to attempt to contact to negotiate +CIFS support. If the CIFS server is not listening on this port or +if it is not specified, the default ports will be tried i.e. +port 445 is tried and if no response then port 139 is tried. +

    file_mode=arg

    If the server does not support the CIFS Unix extensions this + overrides default file mode which will be used locally.

    dir_mode=arg

    If the server does not support the CIFS Unix extensions this + overrides the default mode for directories.

    ip=arg

    sets the destination host or IP address.

    domain=arg

    sets the domain (workgroup) of the user

    guest

    don't prompt for a password

    ro

    mount read-only

    rw

    mount read-write

    rsize

    default network read size

    wsize

    default network write size

    ENVIRONMENT VARIABLES

    + The variable USER may contain the username of the +person using the client. This information is used only if the +protocol level is high enough to support session-level +passwords. The variable can be used to set both username and +password by using the format username%password. +

    + The variable PASSWD may contain the password of the +person using the client. This information is used only if the +protocol level is high enough to support session-level +passwords. +

    + The variable PASSWD_FILE may contain the pathname +of a file to read the password from. A single line of input is +read and used as the password. +

    NOTES

    This command may be used only by root.

    CONFIGURATION

    +The primary mechanism for making configuration changes and for reading +debug information for the cifs vfs is via the Linux /proc filesystem. +In the directory /proc/fs/cifs are various configuration files and +pseudo files which can display debug information. For more +information see the kernel file fs/cifs/README +

    BUGS

    Passwords and other options containing , can not be handled. +For passwords an alternative way of passing them is in a credentials +file or in the PASSWD environment.

    The credentials file does not handle usernames or passwords with + leading space.

    +Note that the typical response to a bug report is suggestion +to try the latest version first. So please try doing that first, +and always include which versions you use of relevant software +when reporting bugs (minimum: samba, kernel, distribution) +

    VERSION

    This man page is correct for version 3.0 of + the Samba suite.

    SEE ALSO

    + Documentation/filesystems/cifs.txt and fs/cifs/README in the linux kernel + source tree may contain additional options and information. +

    AUTHOR

    Steve French

    The syntax and manpage were loosely based on that of smbmount. It + was converted to Docbook/XML by Jelmer Vernooij.

    The current maintainer of the Linux cifs vfs and the userspace + tool mount.cifs is Steve French. + The SAMBA Mailing list + is the preferred place to ask questions regarding these programs. +

    diff --git a/docs/htmldocs/msdfs.html b/docs/htmldocs/msdfs.html index d01b8f4c5d..9fdf906ed0 100644 --- a/docs/htmldocs/msdfs.html +++ b/docs/htmldocs/msdfs.html @@ -1,24 +1,22 @@ -Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    Prev Part III. Advanced Configuration Next

    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba

    Shirish Kalele

    Samba Team & Veritas Software


    +Chapter 17. Hosting a Microsoft Distributed File System tree on Samba

    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    Prev Part III. Advanced Configuration Next

    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba

    Shirish Kalele

    Samba Team & Veritas Software



    -

    12 Jul 2000

    Table of Contents

    Features and Benefits
    Common Errors

    Features and Benefits

    +

    12 Jul 2000

    Table of Contents

    Features and Benefits
    Common Errors

    Features and Benefits

    The Distributed File System (or DFS) provides a means of separating the logical view of files and directories that users see from the actual physical locations of these resources on the network. It allows for higher availability, smoother storage expansion, load balancing etc.

    - For information about DFS, refer to - - Microsoft documentation at http://www.microsoft.com/NTServer/nts/downloads/winfeatures/NTSDistrFile/AdminGuide.asp. + For information about DFS, refer to the +Microsoft documentation.

    - This document explains how to host a DFS tree on a Unix machine (for DFS-aware + This document explains how to host a DFS tree on a UNIX machine (for DFS-aware clients to browse) using Samba.

    - To enable SMB-based DFS for Samba, configure it with the --with-msdfs + To enable SMB-based DFS for Samba, configure it with the --with-msdfs option. Once built, a Samba server can be made a DFS server by setting the global - boolean host msdfs - parameter in the smb.conf file. You designate a share as a DFS - root using the share level boolean - msdfs root parameter. A DFS root directory on Samba hosts DFS + boolean host msdfs + parameter in the smb.conf file. You designate a share as a DFS + root using the share level boolean msdfs root parameter. A DFS root directory on Samba hosts DFS links in the form of symbolic links that point to other servers. For example, a symbolic link junction->msdfs:storage1\share1 in the share directory acts as the DFS junction. When DFS-aware clients attempt to access the junction link, @@ -27,23 +25,14 @@ DFS trees on Samba work with all DFS-aware clients ranging from Windows 95 to 200x.

    Here's an example of setting up a DFS tree on a Samba server. - 

    -# The smb.conf file:
-[global]
-	netbios name = SMOKEY
-	host msdfs   = yes
-
-[dfs]
-	path = /export/dfsroot
-	msdfs root = yes
-

    In the /export/dfsroot directory we set up our dfs links to +

    Example 17.1. smb.conf with DFS configured

    [global]
    netbios name = GANDALF
    host msdfs = yes
    [dfs]
    path = /export/dfsroot
    msdfs root = yes

    In the /export/dfsroot directory we set up our DFS links to other servers on the network.

    -	root# cd /export/dfsroot
-	root# chown root /export/dfsroot
-	root# chmod 755 /export/dfsroot
-	root# ln -s msdfs:storageA\\shareA linka
-	root# ln -s msdfs:serverB\\share,serverC\\share linkb
-

    You should set up the permissions and ownership of +root# cd /export/dfsroot +root# chown root /export/dfsroot +root# chmod 755 /export/dfsroot +root# ln -s msdfs:storageA\\shareA linka +root# ln -s msdfs:serverB\\share,serverC\\share linkb +

    You should set up the permissions and ownership of the directory acting as the DFS root such that only designated users can create, delete or modify the msdfs links. Also note that symlink names should be all lowercase. This limitation exists @@ -52,11 +41,11 @@ network shares you want, and start Samba.

    Users on DFS-aware clients can now browse the DFS tree on the Samba server at \\samba\dfs. Accessing links linka or linkb (which appear as directories to the client) - takes users directly to the appropriate shares on the network.

    Common Errors

    • Windows clients need to be rebooted - if a previously mounted non-dfs share is made a dfs + takes users directly to the appropriate shares on the network.

    Common Errors

    • Windows clients need to be rebooted + if a previously mounted non-dfs share is made a DFS root or vice versa. A better way is to introduce a - new share and make it the dfs root.

    • Currently there's a restriction that msdfs + new share and make it the DFS root.

    • Currently there's a restriction that msdfs symlink names should all be lowercase.

    • For security purposes, the directory acting as the root of the DFS tree should have ownership and permissions set so that only designated users can - modify the symbolic links in the directory.

    Prev Up Next
    Chapter 16. Interdomain Trust Relationships Home Chapter 18. Classical Printing Support
    + modify the symbolic links in the directory.

    Prev Up Next
    Chapter 16. Interdomain Trust Relationships Home Chapter 18. Classical Printing Support
    diff --git a/docs/htmldocs/net.8.html b/docs/htmldocs/net.8.html index 13e4be81be..a98700e42f 100644 --- a/docs/htmldocs/net.8.html +++ b/docs/htmldocs/net.8.html @@ -24,16 +24,15 @@ Defaults to trying 445 first, then 139.

    -n <primary NetBIOS name>

    This option allows you to override the NetBIOS name that Samba uses for itself. This is identical -to setting the NetBIOS -name parameter in the smb.conf(5) file. However, a command +to setting the netbios name parameter in the smb.conf file. +However, a command line setting will take precedence over settings in -smb.conf(5).

    -s <configuration file>

    The file specified contains the +smb.conf.

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

    -S server

    Name of target server. You should specify either @@ -54,12 +53,18 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

    COMMANDS

    TIME

    The NET TIME command allows you to view the time on a remote server +override the log level parameter +in the smb.conf file.

    COMMANDS

    CHANGESECRETPW

    This command allows the Samba machine account password to be set from an external application +to a machine account password that has already been stored in Active Directory. DO NOT USE this command +unless you know exactly what you are doing. The use of this command requires that the force flag (-f) +be used also. There will be NO command prompt. Whatever information is piped into stdin, either by +typing at the command line or otherwise, will be stored as the literal machine password. Do NOT use +this without care and attention as it will overwrite a legitimate machine password without warning. +YOU HAVE BEEN WARNED. +

    TIME

    The NET TIME command allows you to view the time on a remote server or synchronise the time on the local server with the time on the remote server.

    TIME

    Without any options, the NET TIME command displays the time on the remote server. -

    TIME SYSTEM

    Displays the time on the remote server in a format ready for /bin/date

    TIME SET

    Tries to set the date and time of the local server to that on +

    TIME SYSTEM

    Displays the time on the remote server in a format ready for /bin/date

    TIME SET

    Tries to set the date and time of the local server to that on the remote server using /bin/date.

    TIME ZONE

    Displays the timezone in hours from GMT on the remote computer.

    [RPC|ADS] JOIN [TYPE] [-U username[%password]] [options]

    Join a domain. If the account already exists on the server, and [TYPE] is MEMBER, the machine will attempt to join automatically. @@ -104,8 +109,8 @@ can be controlled using 'NET CACHE'.

    All the timeout parameters support th List all current items in the cache.

    CACHE FLUSH

    Remove all the current items from the cache.

    GETLOCALSID [DOMAIN]

    Print the SID of the specified domain, or if the parameter is omitted, the SID of the domain the local server is in.

    SETLOCALSID S-1-5-21-x-y-z

    Sets domain sid for the local server to the specified SID.

    GROUPMAP

    Manage the mappings between Windows group SIDs and UNIX groups. -Parameters take the for "parameter=value". Common options include:

    • unixgroup - Name of the UNIX group

    • ntgroup - Name of the Windows NT group (must be - resolvable to a SID

    • rid - Unsigned 32-bit integer

    • sid - Full SID in the form of "S-1-..."

    • type - Type of the group; either 'domain', 'local', +Parameters take the for "parameter=value". Common options include:

      • unixgroup - Name of the UNIX group

      • ntgroup - Name of the Windows NT group (must be + resolvable to a SID

      • rid - Unsigned 32-bit integer

      • sid - Full SID in the form of "S-1-..."

      • type - Type of the group; either 'domain', 'local', or 'builtin'

      • comment - Freeform text description of the group

      GROUPMAP ADD

      Add a new group mapping entry

      net groupmap add {rid=int|sid=string} unixgroup=string [type={domain|local|builtin}] [ntgroup=string] [comment=string]

      GROUPMAP DELETE

      Delete a group mapping entry

      net groupmap delete {ntgroup=string|sid=SID}

      GROUPMAP MODIFY

      Update en existing group entry

      net groupmap modify {ntgroup=string|sid=SID} [unixgroup=string] [comment=string] [type={domain|local}

      GROUPMAP LIST

      List existing group mapping entries

      net groupmap list [verbose] [ntgroup=string] [sid=SID]

    MAXRID

    Prints out the highest RID currently in use on the local server (by the active 'passdb backend').

    RPC INFO

    Print information about the domain of the remote server, @@ -131,7 +136,7 @@ local server. Can only be run an a BDC.

    GETSID

    Fetch domain SID and store it in the local secrets.tdb.

    ADS LEAVE

    Make the remote host leave the domain it is part of.

    ADS STATUS

    Print out status of machine account of the local machine in ADS. Prints out quite some debug info. Aimed at developers, regular users should use NET ADS TESTJOIN.

    ADS PRINTER

    ADS PRINTER INFO [PRINTER] [SERVER]

    -Lookup info for PRINTER on SERVER. The printer name defaults to "*", the +Lookup info for PRINTER on SERVER. The printer name defaults to "*", the server name defaults to the local host.

    ADS PRINTER PUBLISH PRINTER

    Publish specified printer using ADS.

    ADS PRINTER REMOVE PRINTER

    Remove specified printer from ADS directory.

    ADS SEARCH EXPRESSION ATTRIBUTES...

    Perform a raw LDAP search on a ADS server and dump the results. The expression is a standard LDAP search expression, and the attributes are a list of LDAP fields to show in the results.

    Example: net ads search '(objectCategory=group)' sAMAccountName diff --git a/docs/htmldocs/nmbd.8.html b/docs/htmldocs/nmbd.8.html index c282bde89d..f3e514fa77 100644 --- a/docs/htmldocs/nmbd.8.html +++ b/docs/htmldocs/nmbd.8.html @@ -4,12 +4,12 @@ those produced by SMB/CIFS clients such as Windows 95/98/ME, Windows NT, Windows 2000, Windows XP and LanManager clients. It also participates in the browsing protocols which make up the - Windows "Network Neighborhood" view.

    SMB/CIFS clients, when they start up, may wish to + Windows "Network Neighborhood" view.

    SMB/CIFS clients, when they start up, may wish to locate an SMB/CIFS server. That is, they wish to know what IP number a specified host is using.

    Amongst other services, nmbd will listen for such requests, and if its own NetBIOS name is specified it will respond with the IP number of the host it - is running on. Its "own NetBIOS name" is by + is running on. Its "own NetBIOS name" is by default the primary DNS name of the host it is running on, but this can be overridden with the -n option (see OPTIONS below). Thus nmbd will @@ -42,7 +42,7 @@

    -S

    If specified, this parameter causes nmbd to log to standard output rather than a file.

    -i

    If this parameter is specified it causes the - server to run "interactively", not as a daemon, even if the + server to run "interactively", not as a daemon, even if the server is executed on the command line of a shell. Setting this parameter negates the implicit daemon mode when run from the command line. nmbd also logs to standard @@ -51,8 +51,7 @@

    -H <filename>

    NetBIOS lmhosts file. The lmhosts file is a list of NetBIOS names to IP addresses that is loaded by the nmbd server and used via the name - resolution mechanism name resolve - order described in smb.conf(5) to resolve any + resolution mechanism name resolve order described in smb.conf(5) to resolve any NetBIOS name queries needed by the server. Note that the contents of this file are NOT used by nmbd to answer any name queries. @@ -67,8 +66,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -82,10 +80,9 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +override the log level parameter +in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -p <UDP port number>

    UDP port number is a positive integer value. This option changes the default UDP port number (normally 137) @@ -94,29 +91,26 @@ never removed by the client. won't need help!

    FILES

    /etc/inetd.conf

    If the server is to be run by the inetd meta-daemon, this file must contain suitable startup information for the - meta-daemon. See the install document - for details. + meta-daemon.

    /etc/rc

    or whatever initialization script your system uses).

    If running the server as a daemon at startup, this file will need to contain an appropriate startup - sequence for the server. See the "How to Install and Test SAMBA" document - for details.

    /etc/services

    If running the server via the + sequence for the server.

    /etc/services

    If running the server via the meta-daemon inetd, this file must contain a mapping of service name (e.g., netbios-ssn) to service port (e.g., 139) and protocol type (e.g., tcp). - See the "How to Install and Test SAMBA" - document for details.

    /usr/local/samba/lib/smb.conf

    This is the default location of +

    /usr/local/samba/lib/smb.conf

    This is the default location of the smb.conf(5) server configuration file. Other common places that systems install this file are /usr/samba/lib/smb.conf and /etc/samba/smb.conf.

    When run as a WINS server (see the - wins support + wins support parameter in the smb.conf(5) man page), nmbd will store the WINS database in the file wins.dat in the var/locks directory configured under wherever Samba was configured to install itself.

    If nmbd is acting as a - browse master (see the local master + browse master (see the local master parameter in the smb.conf(5) man page, nmbd will store the browsing database in the file browse.dat in the var/locks directory diff --git a/docs/htmldocs/nmblookup.1.html b/docs/htmldocs/nmblookup.1.html index 46c17ce706..10131752b3 100644 --- a/docs/htmldocs/nmblookup.1.html +++ b/docs/htmldocs/nmblookup.1.html @@ -6,9 +6,9 @@ are done over UDP.

    OPTIONS

    -M

    Searches for a master browser by looking up the NetBIOS name name with a type of 0x1d. If - name is "-" then it does a lookup on the special name + name is "-" then it does a lookup on the special name __MSBROWSE__. Please note that in order to - use the name "-", you need to make sure "-" isn't parsed as an + use the name "-", you need to make sure "-" isn't parsed as an argument, e.g. use : nmblookup -M -- -.

    -R

    Set the recursion desired bit in the packet to do a recursive lookup. This is used when sending a name @@ -28,10 +28,10 @@

    -A

    Interpret name as an IP Address and do a node status query on this address.

    -n <primary NetBIOS name>

    This option allows you to override the NetBIOS name that Samba uses for itself. This is identical -to setting the NetBIOS -name parameter in the smb.conf(5) file. However, a command +to setting the netbios name parameter in the smb.conf file. +However, a command line setting will take precedence over settings in -smb.conf(5).

    -i <scope>

    This specifies a NetBIOS scope that +smb.conf.

    -i <scope>

    This specifies a NetBIOS scope that nmblookup will use to communicate with when generating NetBIOS names. For details on the use of NetBIOS scopes, see rfc1001.txt and rfc1002.txt. NetBIOS scopes are @@ -43,7 +43,7 @@ smb.conf. If the domain specified is the same as the servers NetBIOS name, it causes the client to log on using the servers local SAM (as opposed to the Domain SAM).

    -O socket options

    TCP socket options to set on the client socket. See the socket options parameter in -the smb.conf(5) manual page for the list of valid +the smb.conf manual page for the list of valid options.

    -h|--help

    Print a summary of command line options.

    -B <broadcast address>

    Send the query to the given broadcast address. Without this option the default behavior of nmblookup is to send the @@ -59,8 +59,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -74,10 +73,9 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +override the log level parameter +in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -T

    This causes any IP addresses found in the lookup to be looked up via a reverse DNS lookup into a diff --git a/docs/htmldocs/ntlm_auth.1.html b/docs/htmldocs/ntlm_auth.1.html index d2ee979d4d..27dfee1a0f 100644 --- a/docs/htmldocs/ntlm_auth.1.html +++ b/docs/htmldocs/ntlm_auth.1.html @@ -17,8 +17,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -32,10 +31,9 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +override the log level parameter +in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -h|--help

    Print a summary of command line options.

    VERSION

    This man page is correct for version 3.0 of the Samba diff --git a/docs/htmldocs/optional.html b/docs/htmldocs/optional.html index 1c300521bc..bd76a344f8 100644 --- a/docs/htmldocs/optional.html +++ b/docs/htmldocs/optional.html @@ -1,26 +1,35 @@ -Part III. Advanced Configuration

    Part III. Advanced Configuration
    Prev   Next

    Advanced Configuration

    Valuable Nuts and Bolts Information

    +Part III. Advanced Configuration

    Part III. Advanced Configuration
    Prev   Next

    Advanced Configuration

    Valuable Nuts and Bolts Information

    Samba has several features that you might want or might not want to use. The chapters in this part each cover specific Samba features. -

    Table of Contents

    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    11. Account Information Databases
    Features and Benefits
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and Unix
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon - Users not in Samba SAM
    Users are being added to the wrong backend database
    auth methods does not work
    12. Mapping MS Windows and Unix Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with Unix File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and Unix Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute - mapping
    Common Errors
    Users can not write to a public share
    I have set force user and Samba still makes root the owner of all the files - I touch!
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    Common Errors
    Tell me about Trust Relationships using Samba
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    Parameters for Backwards Compatibility
    Parameters no longer in use
    A simple Configuration to Print with Samba-3
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print with Samba-3
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various Unix Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba-3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with -rpcclient
    "The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure)
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a -different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba-3
    Publishing Printer Information in Active Directory or LDAP
    Common Errors and Problems
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for -CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for -application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download
    GDI on Windows -- PostScript on Unix
    Windows Drivers, GDI and EMF
    Unix Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and -native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print -Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many -Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel -Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for -cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Caveats to be considered
    What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsm completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the -Client
    Installing PostScript Driver Files manually (using -rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Commandline Driver Installation in 15 little Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    When not to use Samba to print to -CUPS
    In Case of Trouble.....
    Where to find Documentation
    How to ask for Help
    Where to find Help
    Appendix
    Printing from CUPS to Windows attached -Printers
    More CUPS filtering Chains
    Trouble Shooting Guidelines to fix typical Samba printing -Problems
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    Common Errors
    21. Integrated Logon Support using Winbind
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    How does one set up roaming profiles for just one (or a few) user/s or group/s?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    My Boomerang Won't Come Back
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    Prev Up Next
    Chapter 9. MS Windows Network Configuration Guide Home Chapter 10. Samba / MS Windows Network Browsing Guide
    +

    Table of Contents

    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    I get an Unable to browse the network error
    11. Account Information Databases
    Features and Benefits
    Backwards Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon
    Users being added to wrong backend database
    auth methods does not work
    12. Mapping MS Windows and UNIX Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users group
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask + parameters
    Interaction with the standard Samba file attribute mapping
    Common Errors
    Users can not write to a public share
    I have set force user but Samba still makes root the owner of all the files I touch!
    MS Word with Samba changes owner of file
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Problems saving files in MS Office on Windows XP
    Long delays deleting files over network with XP SP1
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-style Domain Trusts with Windows 2000
    Common Errors
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    A simple Configuration to Print
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various UNIX Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba 3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with +rpcclient
    Client Driver Install Procedure
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a +different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for +CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for +application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and +native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many +Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel +Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Caveats to be considered
    Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsmb completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the +Client
    Installing PostScript Driver Files manually (using +rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    In Case of Trouble.....
    Printing from CUPS to Windows attached +Printers
    More CUPS filtering Chains
    Common Errors
    Win9x client can't install driver
    "cupsaddsmb" keeps asking for root password in + neverending loop
    "cupsaddsmb" gives "No PPD file for printer..." + message while PPD file is present
    Client can't connect to Samba printer
    Can't reconnect to Samba under new account + from Win2K/XP
    Avoid being connected to the Samba server as the + "wrong" user
    Upgrading to CUPS drivers from Adobe drivers on + NT/2K/XP clients gives problems
    Can't use "cupsaddsmb" on Samba server which is + a PDC
    Deleted Win2K printer driver is still shown
    Win2K/XP "Local Security + Policies"
    WinXP clients: "Administrator can not install + printers for all local users"
    "Print Change Notify" functions on + NT-clients
    WinXP-SP1
    Print options for all users can't be set on Win2K/XP
    Most common blunders in driver + settings on Windows clients
    cupsaddsmb does not work + with newly installed printer
    Permissions on +/var/spool/samba/ get reset after each +reboot
    Printer named "lp" +intermittently swallows jobs and spits out completely different +ones
    Location of Adobe PostScript driver files necessary for "cupsaddsmb"
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    21. Winbind: Use of Domain Accounts
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Setting up roaming profiles for just a few user's or group's?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    Winbind is not resolving users and groups
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure UNIX/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging works only in one way
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    Common errors
    CP850.so can't be found
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    Prev Up Next
    Chapter 9. MS Windows Network Configuration Guide Home Chapter 10. Samba / MS Windows Network Browsing Guide
    diff --git a/docs/htmldocs/pam.html b/docs/htmldocs/pam.html index a0221b57e0..8edbdb26ca 100644 --- a/docs/htmldocs/pam.html +++ b/docs/htmldocs/pam.html @@ -1,6 +1,6 @@ -Chapter 25. PAM based Distributed Authentication
    Chapter 25. PAM based Distributed Authentication
    Prev Part III. Advanced Configuration Next

    Chapter 25. PAM based Distributed Authentication

    John H. Terpstra

    Samba Team

    Stephen Langasek

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem

    +Chapter 25. PAM based Distributed Authentication

    Chapter 25. PAM based Distributed Authentication
    Prev Part III. Advanced Configuration Next

    Chapter 25. PAM based Distributed Authentication

    John H. Terpstra

    Samba Team

    Stephen Langasek

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    Winbind is not resolving users and groups

    This chapter you should help you to deploy winbind based authentication on any PAM enabled -Unix/Linux system. Winbind can be used to enable user level application access authentication +UNIX/Linux system. Winbind can be used to enable user level application access authentication from any MS Windows NT Domain, MS Windows 200x Active Directory based domain, or any Samba based domain environment. It will also help you to configure PAM based local host access controls that are appropriate to your Samba configuration. @@ -8,9 +8,9 @@ controls that are appropriate to your Samba configuration. In addition to knowing how to configure winbind into PAM, you will learn generic PAM management possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage.

    Note

    -The use of Winbind require more than PAM configuration alone. Please refer to the Winbind chapter. -

    Features and Benefits

    -A number of Unix systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, +The use of Winbind require more than PAM configuration alone. Please refer to the Winbind chapter. +

    Features and Benefits

    +A number of UNIX systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication, authorization and resource control services. Prior to the introduction of PAM, a decision to use an alternative to the system password database (/etc/passwd) @@ -23,38 +23,38 @@ authentication/authorization infrastructure. PAM is configured either through o /etc/pam.conf (Solaris), or by editing individual files that are located in /etc/pam.d.

    -On PAM enabled Unix/Linux systems it is an easy matter to configure the system to use any +On PAM enabled UNIX/Linux systems it is an easy matter to configure the system to use any authentication backend, so long as the appropriate dynamically loadable library modules are available for it. The backend may be local to the system, or may be centralised on a remote server.

    PAM support modules are available for: -

    /etc/passwd

    -

    - There are several PAM modules that interact with this standard Unix user +

    /etc/passwd:

    + There are several PAM modules that interact with this standard UNIX user database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so and pam_userdb.so. -

    Kerberos

    -

    +

    Kerberos:

    The pam_krb5.so module allows the use of any Kerberos compliant server. This tool is used to access MIT Kerberos, Heimdal Kerberos, and potentially Microsoft Active Directory (if enabled). -

    LDAP

    -

    +

    LDAP:

    The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend server. Commonly used LDAP backend servers include: OpenLDAP v2.0 and v2.1, Sun ONE iDentity server, Novell eDirectory server, Microsoft Active Directory. -

    NetWare Bindery

    -

    +

    NetWare Bindery:

    The pam_ncp_auth.so module allows authentication off any bindery enabled NetWare Core Protocol based server. -

    SMB Password

    -

    +

    SMB Password:

    This module, called pam_smbpass.so, will allow user authentication off the passdb backend that is configured in the Samba smb.conf file. -

    SMB Server

    -

    +

    SMB Server:

    The pam_smb_auth.so module is the original MS Windows networking authentication tool. This module has been somewhat outdated by the Winbind module. -

    Winbind

    -

    +

    Winbind:

    The pam_winbind.so module allows Samba to obtain authentication from any MS Windows Domain Controller. It can just as easily be used to authenticate users for access to any PAM enabled application. -

    RADIUS

    -

    +

    RADIUS:

    There is a PAM RADIUS (Remote Access Dial-In User Service) authentication module. In most cases the administrator will need to locate the source code for this tool and compile and install it themselves. RADIUS protocols are @@ -67,12 +67,12 @@ of distributed samba domain controllers that can provide wide are network bandwi efficient authentication services for PAM capable systems. In effect, this allows the deployment of centrally managed and maintained distributed authentication from a single user account database. -

    Technical Discussion

    +

    Technical Discussion

    PAM is designed to provide the system administrator with a great deal of flexibility in configuration of the privilege granting applications of their system. The local configuration of system security controlled by PAM is contained in one of two places: either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory. -

    PAM Configuration Syntax

    +

    PAM Configuration Syntax

    In this section we discuss the correct syntax of and generic options respected by entries to these files. PAM specific tokens in the configuration file are case insensitive. The module paths, however, are case sensitive since they indicate a file's name and reflect the case dependence of typical file-systems. @@ -87,32 +87,31 @@ default location then it is not necessary to specify the path. In the case of Linux, the default location is /lib/security. If the module is located outside the default then the path must be specified as:

    -

    +
     auth  required  /other_path/pam_strange_module.so
 
    
-
    Anatomy of /etc/pam.d Entries
    
+
    Anatomy of /etc/pam.d Entries
    
 The remaining information in this subsection was taken from the documentation of the Linux-PAM
 project. For more information on PAM, see 
-
-http://ftp.kernel.org/pub/linux/libs/pam The Official Linux-PAM home page.
+The Official Linux-PAM home page
 
    
 A general configuration line of the /etc/pam.conf file has the following form:
 
    
-
    +
     service-name   module-type   control-flag   module-path   args
 
    
 
    
 Below, we explain the meaning of each of these tokens. The second (and more recently adopted)
 way of configuring Linux-PAM is via the contents of the /etc/pam.d/ directory.
 Once we have explained the meaning of the above tokens, we will describe this method.
-
    service-name
    -
    
+
    service-name:
    
 		The name of the service associated with this entry. Frequently the service name is the conventional
 		name of the given application. For example, `ftpd', `rlogind' and `su', etc. .
 		
    
 		There is a special service-name, reserved for defining a default authentication mechanism. It has
 		the name `OTHER' and may be specified in either lower or upper case characters. Note, when there
 		is a module specified for a named service, the `OTHER' entries are ignored.
-		
    module-type
    -
    
+		
    module-type:
    
 		One of (currently) four types of module. The four types are as follows:
 		
    • 
 			auth: this module type provides two aspects of authenticating the user.
@@ -134,7 +133,7 @@ Once we have explained the meaning of the above tokens, we will describe this me
 			password: this last module type is required for updating the authentication
 			token associated with the user. Typically, there is one module for each `challenge/response'
 			based authentication (auth) module-type.
-			
    control-flag
    -
    
+			
    control-flag:
    
 		The control-flag is used to indicate how the PAM library will react to the success or failure of the
 		module it is associated with. Since modules can be stacked (modules of the same type execute in series,
 		one after another), the control-flags determine the relative importance of each module. The application
@@ -178,9 +177,9 @@ Once we have explained the meaning of the above tokens, we will describe this me
 		The more elaborate (newer) syntax is much more specific and gives the administrator a great deal of control
 		over how the user is authenticated. This form of the control flag is delimited with square brackets and
 		consists of a series of value=action tokens:
-		
    -		[value1=action1 value2=action2 ...]
-		
    
+		
    +[value1=action1 value2=action2 ...]
+
    
 		Here, value1 is one of the following return values: success; open_err; symbol_err; service_err;
 		system_err; buf_err; perm_denied; auth_err; cred_insufficient; authinfo_unavail; user_unknown; maxtries;
 		new_authtok_reqd; acct_expired; session_err; cred_unavail; cred_expired; cred_err; no_module_data; conv_err;
@@ -235,7 +234,7 @@ Once we have explained the meaning of the above tokens, we will describe this me
 		[ ... value=action ... ] control syntax, it is possible for an application to be configured
 		to support binary prompts with compliant clients, but to gracefully fall over into an alternative authentication
 		mode for older, legacy, applications.
-		
    module-path
    -
    
+		
    module-path:
    
 		The path-name of the dynamically loadable object file; the pluggable module itself. If the first character of the
 		module path is `/', it is assumed to be a complete path. If this is not the case, the given module path is appended
 		to the default module path: /lib/security (but see the notes above).
@@ -246,7 +245,7 @@ Once we have explained the meaning of the above tokens, we will describe this me
 		to syslog(3). For a list of generic options see the next section.
 		
    
 		Note, if you wish to include spaces in an argument, you should surround that argument with square brackets. For example:
-		
    +		
     squid auth required pam_mysql.so user=passwd_query passwd=mada \
         db=eminence [query=select user_name from internet_service where \
                      user_name='%u' and password=PASSWORD('%p') and \
@@ -254,19 +253,19 @@ squid auth required pam_mysql.so user=passwd_query passwd=mada \
 
    
 		Note, when using this convention, you can include `[' characters inside the string, and if you wish to include a `]'
 		character inside the string that will survive the argument parsing, you should use `\['. In other words:
-		
    +		
     [..[..\]..]    -->   ..[..]..
 
    
 		Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the
 		side of caution) to make the authentication process fail. A corresponding error is written to the system log files
 		with a call to syslog(3). 
-		
    Example System Configurations
    
+

    Example System Configurations

    The following is an example /etc/pam.d/login configuration file. This example had all options been uncommented is probably not usable as it stacks many conditions before allowing successful completion of the login process. Essentially all conditions can be disabled by commenting them out except the calls to pam_pwdb.so. -

    PAM: original login config

    +
    PAM: original login config
     #%PAM-1.0
 # The PAM configuration file for the `login' service
 #
@@ -281,10 +280,10 @@ session      required    pam_pwdb.so
 # session    optional    pam_lastlog.so
 # password   required    pam_cracklib.so retry=3
 password     required    pam_pwdb.so shadow md5
-
    PAM: login using pam_smbpass
    
+

    PAM: login using pam_smbpass

    PAM allows use of replaceable modules. Those available on a sample system include:

    $/bin/ls /lib/security -

    +
     pam_access.so    pam_ftp.so          pam_limits.so     
 pam_ncp_auth.so  pam_rhosts_auth.so  pam_stress.so     
 pam_cracklib.so  pam_group.so        pam_listfile.so   
@@ -308,7 +307,7 @@ hashes. This database is stored in either
 /usr/local/samba/private/smbpasswd, 
 /etc/samba/smbpasswd, or in 
 /etc/samba.d/smbpasswd, depending on the 
-Samba implementation for your Unix/Linux system. The 
+Samba implementation for your UNIX/Linux system. The 
 pam_smbpass.so module is provided by 
 Samba version 2.2.1 or later. It can be compiled by specifying the 
 --with-pam_smbpass options when running Samba's
@@ -316,7 +315,7 @@ Samba version 2.2.1 or later. It can be compiled by specifying the
 on the pam_smbpass module, see the documentation
 in the source/pam_smbpass directory of the Samba 
 source distribution.
-
    +
     #%PAM-1.0
 # The PAM configuration file for the `login' service
 #
@@ -327,7 +326,7 @@ password    required    pam_smbpass.so nodelay
 
    
 The following is the PAM configuration file for a particular 
 Linux system. The default condition uses pam_pwdb.so.
-
    +
     #%PAM-1.0
 # The PAM configuration file for the `samba' service
 #
@@ -341,7 +340,7 @@ smbpasswd database even for basic samba authentication. Such a
 decision could also be made for the passwd program and would 
 thus allow the smbpasswd passwords to be changed using the passwd 
 program.
-
    +
     #%PAM-1.0
 # The PAM configuration file for the `samba' service
 #
@@ -360,24 +359,24 @@ authentication to be configured in a single central file. The
 on the basis that it allows for easier administration. As with all issues in 
 life though, every decision makes trade-offs, so you may want examine the 
 PAM documentation for further helpful information.
-

    smb.conf PAM Configuration

    -There is an option in smb.conf called obey pam restrictions. +

    smb.conf PAM Configuration

    + There is an option in smb.conf called obey pam restrictions. The following is from the on-line help for this option in SWAT;

    -When Samba-3 is configured to enable PAM support (i.e. +When Samba is configured to enable PAM support (i.e. --with-pam), this parameter will control whether or not Samba should obey PAM's account and session management directives. The default behavior is to use PAM for clear text authentication only and to ignore any account or session management. Note that Samba always ignores PAM for authentication in the case of -encrypt passwords = yes. +encrypt passwords = yes. The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. -

    Default: obey pam restrictions = no

    Remote CIFS Authentication using winbindd.so

    +

    Default: obey pam restrictions = no

    Remote CIFS Authentication using winbindd.so

    All operating systems depend on the provision of users credentials acceptable to the platform. -Unix requires the provision of a user identifier (UID) as well as a group identifier (GID). +UNIX requires the provision of a user identifier (UID) as well as a group identifier (GID). These are both simple integer type numbers that are obtained from a password backend such as /etc/passwd.

    @@ -401,7 +400,7 @@ Microsoft Active Directory Service (ADS) in so far as reduction of wide area net The rid to unix id database is the only location where the user and group mappings are stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd to determine which user and group ids correspond to Windows NT user and group rids. -

    Password Synchronization using pam_smbpass.so

    +

    Password Synchronization using pam_smbpass.so

    pam_smbpass is a PAM module which can be used on conforming systems to keep the smbpasswd (Samba password) database in sync with the unix password file. PAM (Pluggable Authentication Modules) is an API supported @@ -414,24 +413,23 @@ concerned about the presence of suid root binaries on your system, it is recommended that you use pam_winbind instead.

    Options recognized by this module are as follows: -

    Table 25.1. Options recognized by pam_smbpass

    debuglog more debugging info
    auditlike debug, but also logs unknown usernames
    use_first_passdon't prompt the user for passwords; take them from PAM_ items instead
    try_first_passtry to get the password from a previous PAM module, fall back to prompting the user
    use_authtoklike try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only)
    not_set_passdon't make passwords used by this module available to other modules.
    nodelaydon't insert ~1 second delays on authentication failure.
    nulloknull passwords are allowed.
    nonullnull passwords are not allowed. Used to override the Samba configuration.
    migrateonly meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication.
    smbconf=filespecify an alternate path to the smb.conf file.

    +

    Table 25.1. Options recognized by pam_smbpass

    debuglog more debugging info
    auditlike debug, but also logs unknown usernames
    use_first_passdon't prompt the user for passwords; take them from PAM_ items instead
    try_first_passtry to get the password from a previous PAM module, fall back to prompting the user
    use_authtoklike try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only)
    not_set_passdon't make passwords used by this module available to other modules.
    nodelaydon't insert ~1 second delays on authentication failure.
    nulloknull passwords are allowed.
    nonullnull passwords are not allowed. Used to override the Samba configuration.
    migrateonly meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication.
    smbconf=filespecify an alternate path to the smb.conf file.

    -Thanks go to the following people: -

    Andrew Morgan, for providing the Linux-PAM - framework, without which none of this would have happened
    Christian Gafton and Andrew Morgan again, for the - pam_pwdb module upon which pam_smbpass was originally based
    Luke Leighton for being receptive to the idea, +

    • Andrew Morgan, for providing the Linux-PAM + framework, without which none of this would have happened

    • Christian Gafton and Andrew Morgan again, for the + pam_pwdb module upon which pam_smbpass was originally based

    • Luke Leighton for being receptive to the idea, and for the occasional good-natured complaint about the project's status - that keep me working on it :)

    . + that keep me working on it :)

    .

    The following are examples of the use of pam_smbpass.so in the format of Linux /etc/pam.d/ files structure. Those wishing to implement this tool on other platforms will need to adapt this appropriately. -

    Password Synchronisation Configuration

    +

    Password Synchronisation Configuration

    A sample PAM configuration that shows the use of pam_smbpass to make sure private/smbpasswd is kept in sync when /etc/passwd (/etc/shadow) is changed. Useful when an expired password might be changed by an application (such as ssh). -

    +
     #%PAM-1.0
 # password-sync
 #
@@ -442,13 +440,13 @@ password   requisite    pam_cracklib.so retry=3
 password   requisite    pam_unix.so shadow md5 use_authtok try_first_pass
 password   required     pam_smbpass.so nullok use_authtok try_first_pass
 session    required     pam_unix.so
-

    Password Migration Configuration

    +

    Password Migration Configuration

    A sample PAM configuration that shows the use of pam_smbpass to migrate from plaintext to encrypted passwords for Samba. Unlike other methods, this can be used for users who have never connected to Samba shares: password migration takes place when users ftp in, login using ssh, pop their mail, etc. -

    +
     #%PAM-1.0
 # password-migration
 #
@@ -461,11 +459,11 @@ password   requisite   pam_cracklib.so retry=3
 password   requisite   pam_unix.so shadow md5 use_authtok try_first_pass
 password   optional    pam_smbpass.so nullok use_authtok try_first_pass
 session    required    pam_unix.so
-

    Mature Password Configuration

    +

    Mature Password Configuration

    A sample PAM configuration for a 'mature' smbpasswd installation. private/smbpasswd is fully populated, and we consider it an error if -the smbpasswd doesn't exist or doesn't match the Unix password. -

    +the smbpasswd doesn't exist or doesn't match the UNIX password.
+
     #%PAM-1.0
 # password-mature
 #
@@ -476,11 +474,11 @@ password   requisite    pam_cracklib.so retry=3
 password   requisite    pam_unix.so shadow md5 use_authtok try_first_pass
 password   required     pam_smbpass.so use_authtok use_first_pass
 session    required     pam_unix.so
-

    Kerberos Password Integration Configuration

    +

    Kerberos Password Integration Configuration

    A sample PAM configuration that shows pam_smbpass used together with pam_krb5. This could be useful on a Samba PDC that is also a member of a Kerberos realm. -

    +
     #%PAM-1.0
 # kdc-pdc
 #
@@ -492,13 +490,15 @@ password   requisite   pam_cracklib.so retry=3
 password   optional    pam_smbpass.so nullok use_authtok try_first_pass
 password   required    pam_krb5.so use_authtok try_first_pass
 session    required    pam_krb5.so
-

    Common Errors

    +

    Common Errors

    PAM can be a very fickle and sensitive to configuration glitches. Here we look at a few cases from the Samba mailing list. -

    pam_winbind problem

    - I have the following PAM configuration: +

    pam_winbind problem

    + “ + I have the following PAM configuration: + ”

    -

    +
     auth required /lib/security/pam_securetty.so
 auth sufficient /lib/security/pam_winbind.so
 auth sufficient /lib/security/pam_unix.so use_first_pass nullok
@@ -508,15 +508,58 @@ account required /lib/security/pam_stack.so service=system-auth
 account required /lib/security/pam_winbind.so
 password required /lib/security/pam_stack.so service=system-auth
 
    
-
    
+	
    
+		“
 	When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie".
 	I've tried with user "scienceu+pitie" also.
+”
 	
    
-	Answer: The problem may lie with your inclusion of pam_stack.so
+		The problem may lie with your inclusion of pam_stack.so
 	service=system-auth. That file often contains a lot of stuff that may
 	duplicate what you're already doing. Try commenting out the pam_stack lines
 	for auth and account and see if things work. If they do, look at
 	/etc/pam.d/system-auth and copy only what you need from it into your
 	/etc/pam.d/login file.  Alternatively, if you want all services to use
 	winbind, you can put the winbind-specific stuff in /etc/pam.d/system-auth.
-
    Prev Up Next
    Chapter 24. Desktop Profile Management Home Chapter 26. Integrating MS Windows networks with Samba
    +

    Winbind is not resolving users and groups

    + “ + My smb.conf file is correctly configured. I have specified + idmap uid = 12000, + and idmap gid = 3000-3500 + and winbind is running. When I do the following it all works fine. +” + 

    +root# wbinfo -u
+MIDEARTH+maryo
+MIDEARTH+jackb
+MIDEARTH+ameds
+...
+MIDEARTH+root
+
+root# wbinfo -g
+MIDEARTH+Domain Users
+MIDEARTH+Domain Admins
+MIDEARTH+Domain Guests
+...
+MIDEARTH+Accounts
+
+root# getent passwd
+root:x:0:0:root:/root:/bin/bash
+bin:x:1:1:bin:/bin:/bin/bash
+...
+maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false
+

    + “ + But the following command just fails: +” +

    +root# chown 'maryo' a_file
+chown: `maryo': invalid user
+

    +“ +This is driving me nuts! What can be wrong? +” +

    + Your system is likely running nscd, the name service + caching daemon. Shut it down, do NOT restart it! You will find your problem resolved. +

    Prev Up Next
    Chapter 24. Desktop Profile Management Home Chapter 26. Integrating MS Windows networks with Samba
    diff --git a/docs/htmldocs/passdb.html b/docs/htmldocs/passdb.html index 2c68f50c87..4d5432fd70 100644 --- a/docs/htmldocs/passdb.html +++ b/docs/htmldocs/passdb.html @@ -1,26 +1,27 @@ -Chapter 11. Account Information Databases
    Chapter 11. Account Information Databases
    Prev Part III. Advanced Configuration Next

    Chapter 11. Account Information Databases

    Jelmer R. Vernooij

    The Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Jeremy Allison

    Samba Team

    John H. Terpstra

    Samba Team

    Olivier (lem) Lemaire

    IDEALX

    May 24, 2003

    Table of Contents

    Features and Benefits
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and Unix
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon - Users not in Samba SAM
    Users are being added to the wrong backend database
    auth methods does not work

    -Samba-3 implements a new capability to work concurrently with multiple account backends. -The possible new combinations of password backends allows Samba-3 a degree of flexibility +Chapter 11. Account Information Databases

    Chapter 11. Account Information Databases
    Prev Part III. Advanced Configuration Next

    Chapter 11. Account Information Databases

    Jelmer R. Vernooij

    The Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Jeremy Allison

    Samba Team

    John H. Terpstra

    Samba Team

    Olivier (lem) Lemaire

    IDEALX

    May 24, 2003

    Table of Contents

    Features and Benefits
    Backwards Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon
    Users being added to wrong backend database
    auth methods does not work

    +Samba 3 implements a new capability to work concurrently with multiple account backends. +The possible new combinations of password backends allows Samba 3 a degree of flexibility and scalability that previously could be achieved only with MS Windows Active Directory. This chapter describes the new functionality and how to get the most out of it.

    In the course of development of Samba-3, a number of requests were received to provide the ability to migrate MS Windows NT4 SAM accounts to Samba-3 without the need to provide -matching Unix/Linux accounts. We called this the Non Unix Accounts (NUA) +matching UNIX/Linux accounts. We called this the Non UNIX Accounts (NUA) capability. The intent was that an administrator could decide to use the tdbsam -backend and by simply specifying "passdb backend = tdbsam_nua, guest" -this would allow Samba-3 to implement a solution that did not use Unix accounts per se. Late +backend and by simply specifying passdb backend = tdbsam_nua +this would allow Samba-3 to implement a solution that did not use UNIX accounts per se. Late in the development cycle, the team doing this work hit upon some obstacles that prevents this solution from being used. Given the delays with Samba-3 release a decision was made to NOT deliver this functionality until a better method of recognising NT Group SIDs from NT User SIDs could be found. This feature may thus return during the life cycle for the Samba-3 series.

    Note

    -Samba-3.0.0 does NOT support Non-Unix Account (NUA) operation. -

    Features and Benefits

    +Samba-3 does NOT support Non-UNIX Account (NUA) operation for user accounts. +Samba-3 does support NUA operation for machine accounts. +

    Features and Benefits

    Samba-3 provides for complete backwards compatibility with Samba-2.2.x functionality as follows: -

    Backwards Compatibility Backends

    Plain Text:

    - This option uses nothing but the Unix/Linux /etc/passwd +

    Backwards Compatibility Backends

    Plain Text:

    + This option uses nothing but the UNIX/Linux /etc/passwd style back end. On systems that have PAM (Pluggable Authentication Modules) support all PAM modules are supported. The behaviour is just as it was with Samba-2.2.x, and the protocol limitations imposed by MS Windows clients @@ -42,13 +43,9 @@ as follows: This option is provided primarily as a migration tool, although there is no reason to force migration at this time. Note that this tool will eventually be deprecated. -

    +

    New Backends

    Samba-3 introduces the following new password backend capabilities: -

    New Backends

    guest:

    - This is always required as the last backend specified. - It provides the ability to handle guest account requirements for access to - resources like IPC$ which is used for browsing. -

    tdbsam:

    +

    tdbsam:

    This backend provides a rich database backend for local servers. This backend is NOT suitable for multiple domain controller (ie: PDC + one or more BDC) installations. @@ -90,10 +87,7 @@ Samba-3 introduces the following new password backend capabilities: The xmlsam option can be useful for account migration between database backends or backups. Use of this tool will allow the data to be edited before migration into another backend format. -

    nisplussam:

    - The NIS+ based passdb backend. Takes name NIS domain as an - optional argument. Only works with Sun NIS+ servers. -

    Technical Information

    +

    Technical Information

    Old windows clients send plain text passwords over the wire. Samba can check these passwords by crypting them and comparing them to the hash stored in the unix user database.

    @@ -108,10 +102,10 @@ Samba-3 introduces the following new password backend capabilities: In addition to differently encrypted passwords, windows also stores certain data for each user that is not stored in a unix user database. e.g: workstations the user may logon from, the location where the users' profile is stored, and so on. Samba retrieves and stores this - information using a passdb backend. Commonly available backends are LDAP, plain text + information using a passdb backend. Commonly available backends are LDAP, plain text file, MySQL and nisplus. For more information, see the man page for smb.conf regarding the - passdb backend parameter. -

    Important Notes About Security

    + passdb backend parameter. +

    Figure 11.1. IDMAP

    IDMAP

    Important Notes About Security

    The unix and SMB password encryption techniques seem similar on the surface. This similarity is, however, only skin deep. The unix scheme typically sends clear text passwords over the network when logging in. This is bad. The SMB encryption scheme @@ -135,12 +129,12 @@ Samba-3 introduces the following new password backend capabilities:

    The following versions of MS Windows do not support full domain security protocols, although they may log onto a domain environment: -

    MS DOS Network client 3.0 with the basic network redirector installed
    Windows 95 with the network redirector update installed
    Windows 98 [se]
    Windows Me

    Note

    +

    • MS DOS Network client 3.0 with the basic network redirector installed

    • Windows 95 with the network redirector update installed

    • Windows 98 [se]

    • Windows Me

    Note

    MS Windows XP Home does not have facilities to become a domain member and it can not participate in domain logons.

    The following versions of MS Windows fully support domain security protocols. -

    Windows NT 3.5x
    Windows NT 4.0
    Windows 2000 Professional
    Windows 200x Server/Advanced Server
    Windows XP Professional

    +

    • Windows NT 3.5x

    • Windows NT 4.0

    • Windows 2000 Professional

    • Windows 200x Server/Advanced Server

    • Windows XP Professional

    All current release of Microsoft SMB/CIFS clients support authentication via the SMB Challenge/Response mechanism described here. Enabling clear text authentication does not disable the ability of the client to participate in encrypted authentication. @@ -153,7 +147,7 @@ Samba-3 introduces the following new password backend capabilities: (broken) only the cached (encrypted) password will be sent to the resource server to affect a auto-reconnect. If the resource server does not support encrypted passwords the auto-reconnect will fail. USE OF ENCRYPTED PASSWORDS IS STRONGLY ADVISED. -

    Advantages of Encrypted Passwords

    • Plain text passwords are not passed across +

      Advantages of Encrypted Passwords

      • Plain text passwords are not passed across the network. Someone using a network sniffer cannot just record passwords going to the SMB server.

      • Plain text passwords are not stored anywhere in memory or on disk.

      • WinNT doesn't like talking to a server @@ -164,32 +158,44 @@ Samba-3 introduces the following new password backend capabilities: only things you can do to stop this is to use SMB encryption.

      • Encrypted password support allows automatic share (resource) reconnects.

      • Encrypted passwords are essential for PDC/BDC - operation.

      Advantages of non-encrypted passwords

      • Plain text passwords are not kept + operation.

      Advantages of non-encrypted passwords

      • Plain text passwords are not kept on disk, and are NOT cached in memory.

      • Uses same password file as other unix services such as login and ftp

      • Use of other services (such as telnet and ftp) which send plain text passwords over the net, so sending them for SMB - isn't such a big deal.

    Mapping User Identifiers between MS Windows and Unix

    - Every operation in Unix/Linux requires a user identifier (UID), just as in + isn't such a big deal.

    Mapping User Identifiers between MS Windows and UNIX

    + Every operation in UNIX/Linux requires a user identifier (UID), just as in MS Windows NT4 / 200x this requires a Security Identifier (SID). Samba provides - two means for mapping an MS Windows user to a Unix/Linux UID. + two means for mapping an MS Windows user to a UNIX/Linux UID.

    Firstly, all Samba SAM (Security Account Manager database) accounts require - a Unix/Linux UID that the account will map to. As users are added to the account - information database, Samba-3 will call the add user script - interface to add the account to the Samba host OS. In essence, all accounts in + a UNIX/Linux UID that the account will map to. As users are added to the account + information database, Samba will call the add user script + interface to add the account to the Samba host OS. In essence all accounts in the local SAM require a local user account.

    - The second way to affect Windows SID to Unix UID mapping is via the + The second way to affect Windows SID to UNIX UID mapping is via the idmap uid, idmap gid parameters in smb.conf. Please refer to the man page for information about these parameters. These parameters are essential when mapping users from a remote SAM server. -

    Account Management Tools

    -Samba-3 provides two (2) tools for management of User and machine accounts. These tools are +

    Mapping Common UIDs/GIDs on Distributed Machines

    + Samba-3 has a special facility that makes it possible to maintain identical UIDs and GIDs + on all servers in a distributed network. A distributed network is one where there exists + a PDC, one or more BDCs and/or one or more domain member servers. Why is this important? + This is important if files are being shared over more than one protocol (eg: NFS) and where + users are copying files across UNIX/Linux systems using tools such as rsync. +

    + The special facility is enabled using a parameter called idmap backend. + The default setting for this parameter is an empty string. Administrators should NOT set this + parameter except when an LDAP based passdb backend is in use. An example of use is: +

    +

    Example 11.1. 

    [global]
    idmap backend = ldapsam://ldap-server.quenya.org:636

    +

    Account Management Tools

    +Samba provides two (2) tools for management of User and machine accounts. These tools are called smbpasswd and pdbedit. A third tool is under development but is NOT expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK GUI tool that looks much like the MS Windows NT4 Domain User Manager - hopefully this will be announced in time for the Samba-3.0.1 release. -

    The smbpasswd Command

    +

    The smbpasswd Command

    The smbpasswd utility is a utility similar to the passwd or yppasswd programs. It maintains the two 32 byte password fields in the passdb backend. @@ -203,19 +209,19 @@ be announced in time for the Samba-3.0.1 release. if changing an NT Domain user's password).

    smbpasswd can be used to: -

    add user or machine accounts
    delete user or machine accounts
    enable user or machine accounts
    disable user or machine accounts
    set to NULL user passwords
    manage interdomain trust accounts

    +

    • add user or machine accounts

    • delete user or machine accounts

    • enable user or machine accounts

    • disable user or machine accounts

    • set to NULL user passwords

    • manage interdomain trust accounts

    To run smbpasswd as a normal user just type:

    - 

    -		$ smbpasswd
-		Old SMB password: secret
-

    +

    +$ smbpasswd
+Old SMB password: secret
+

    For secret type old value here - or hit return if there was no old password - 

    -		New SMB Password: new secret
-		Repeat New SMB Password: new secret
-

    +

    +New SMB Password: new secret
+Repeat New SMB Password: new secret
+

    If the old value does not match the current value stored for that user, or the two new values do not match each other, then the password will not be changed. @@ -235,10 +241,10 @@ be announced in time for the Samba-3.0.1 release.

    For more details on using smbpasswd refer to the man page (the definitive reference). -

    The pdbedit Command

    +

    The pdbedit Command

    pdbedit is a tool that can be used only by root. It is used to manage the passdb backend. pdbedit can be used to: -

    add, remove or modify user accounts
    listing user accounts
    migrate user accounts

    +

    • add, remove or modify user accounts

    • listing user accounts

    • migrate user accounts

    The pdbedit tool is the only one that can manage the account security and policy settings. It is capable of all operations that smbpasswd can do as well as a super set of them. @@ -250,50 +256,60 @@ be announced in time for the Samba-3.0.1 release. The following is an example of the user account information that is stored in a tdbsam password backend. This listing was produced by running: 

    -		$ pdbedit -Lv met
-		Unix username:        met
-		NT username:
-		Account Flags:        [UX         ]
-		User SID:             S-1-5-21-1449123459-1407424037-3116680435-2004
-		Primary Group SID:    S-1-5-21-1449123459-1407424037-3116680435-1201
-		Full Name:            Melissa E Terpstra
-		Home Directory:       \\frodo\met\Win9Profile
-		HomeDir Drive:        H:
-		Logon Script:         scripts\logon.bat
-		Profile Path:         \\frodo\Profiles\met
-		Domain:               MIDEARTH
-		Account desc:
-		Workstations:         melbelle
-		Munged dial:
-		Logon time:           0
-		Logoff time:          Mon, 18 Jan 2038 20:14:07 GMT
-		Kickoff time:         Mon, 18 Jan 2038 20:14:07 GMT
-		Password last set:    Sat, 14 Dec 2002 14:37:03 GMT
-		Password can change:  Sat, 14 Dec 2002 14:37:03 GMT
-		Password must change: Mon, 18 Jan 2038 20:14:07 GMT
-

    Password Backends

    -Samba-3 offers the greatest flexibility in backend account database design of any SMB/CIFS server +$ pdbedit -Lv met +UNIX username: met +NT username: +Account Flags: [UX ] +User SID: S-1-5-21-1449123459-1407424037-3116680435-2004 +Primary Group SID: S-1-5-21-1449123459-1407424037-3116680435-1201 +Full Name: Melissa E Terpstra +Home Directory: \\frodo\met\Win9Profile +HomeDir Drive: H: +Logon Script: scripts\logon.bat +Profile Path: \\frodo\Profiles\met +Domain: MIDEARTH +Account desc: +Workstations: melbelle +Munged dial: +Logon time: 0 +Logoff time: Mon, 18 Jan 2038 20:14:07 GMT +Kickoff time: Mon, 18 Jan 2038 20:14:07 GMT +Password last set: Sat, 14 Dec 2002 14:37:03 GMT +Password can change: Sat, 14 Dec 2002 14:37:03 GMT +Password must change: Mon, 18 Jan 2038 20:14:07 GMT +

    + The pdbedit tool allows migration of authentication (account) + databases from one backend to another. For example: To migrate accounts from an + old smbpasswd database to a tdbsam + backend: +

    1. + Set the passdb backend = tdbsam, smbpasswd. +

    2. + Execute: +

      +root# pdbedit -i smbpassed -e tdbsam
+

      +

    3. + Now remove the smbpasswd from the passdb backend + configuration in smb.conf. +

    Password Backends

    +Samba offers the greatest flexibility in backend account database design of any SMB/CIFS server technology available today. The flexibility is immediately obvious as one begins to explore this capability.

    It is possible to specify not only multiple different password backends, but even multiple backends of the same type. For example, to use two different tdbsam databases:

    -

    -[globals]
-		passdb backend = tdbsam:/etc/samba/passdb.tdb, \
-		tdbsam:/etc/samba/old-passdb.tdb, guest
-

    -

    Plain Text

    +

    passdb backend = tdbsam:/etc/samba/passdb.tdb, tdbsam:/etc/samba/old-passdb.tdb

    +

    Plain Text

    Older versions of Samba retrieved user information from the unix user database and eventually some other fields from the file /etc/samba/smbpasswd or /etc/smbpasswd. When password encryption is disabled, no SMB specific data is stored at all. Instead all operations are conducted via the way that the Samba host OS will access its /etc/passwd database. eg: On Linux systems that is done via PAM. -

    smbpasswd - Encrypted Password Database

    - Traditionally, when configuring encrypt - passwords = yes in Samba's smb.conf file, user account +

    smbpasswd - Encrypted Password Database

    + Traditionally, when configuring encrypt passwords = yes in Samba's smb.conf file, user account information such as username, LM/NT password hashes, password change times, and account flags have been stored in the smbpasswd(5) file. There are several disadvantages to this approach for sites with very large numbers of users (counted @@ -319,10 +335,10 @@ backends of the same type. For example, to use two different tdbsam databases: is commonly referred to as the samdb interface (previously this was called the passdb API, and is still so named in the Samba CVS trees).

    - Samba-3 provides an enhanced set of passdb backends that overcome the deficiencies + Samba provides an enhanced set of passdb backends that overcome the deficiencies of the smbpasswd plain text database. These are tdbsam, ldapsam, and xmlsam. Of these ldapsam will be of most interest to large corporate or enterprise sites. -

    tdbsam

    Samba can store user and machine account data in a "TDB" (Trivial Database). +

    tdbsam

    Samba can store user and machine account data in a "TDB" (Trivial Database). Using this backend doesn't require any additional configuration. This backend is recommended for new installations that do not require LDAP.

    @@ -330,7 +346,7 @@ backends of the same type. For example, to use two different tdbsam databases: that have 250 or more users. Additionally, tdbsam is not capable of scaling for use in sites that require PDB/BDC implementations that requires replication of the account database. Clearly, for reason of scalability, the use of ldapsam should be encouraged. -

    ldapsam

    +

    ldapsam

    There are a few points to stress that the ldapsam does not provide. The LDAP support referred to in the this documentation does not include:

    Two additional Samba resources which may prove to be helpful are

    • The Samba-PDC-LDAP-HOWTO maintained by Ignacio Coupeau.

    • The NT migration scripts from IDEALX that are geared to manage users and group in such a Samba-LDAP Domain Controller configuration. -

    Supported LDAP Servers

    +

    Supported LDAP Servers

    The LDAP ldapsam code has been developed and tested using the OpenLDAP 2.0 and 2.1 server and client libraries. The same code should work with Netscape's Directory Server and client SDK. However, there are bound to be compile errors and bugs. These should not be hard to fix. Please submit fixes via Bug reporting facility. -

    Schema and Relationship to the RFC 2307 posixAccount

    +

    Schema and Relationship to the RFC 2307 posixAccount

    Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: 

    -objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY
-    DESC 'Samba Auxiliary Account'
-    MUST ( uid $ rid )
-    MAY  ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
-           logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
-           displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
-           description $ userWorkstations $ primaryGroupID $ domain ))
+objectclass ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY
+    DESC 'Samba 3.0 Auxiliary SAM Account'
+    MUST ( uid $ sambaSID )
+    MAY  ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $
+          sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $
+          sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $
+          displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $
+          sambaProfilePath $ description $ sambaUserWorkstations $
+          sambaPrimaryGroupSID $ sambaDomainName ))

    The samba.schema file has been formatted for OpenLDAP 2.0/2.1. @@ -398,7 +416,7 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY and functioning correctly. This division of information makes it possible to store all Samba account information in LDAP, but still maintain UNIX account information in NIS while the network is transitioning to a full LDAP infrastructure. -

    OpenLDAP configuration

    +

    OpenLDAP configuration

    To include support for the sambaSamAccount object in an OpenLDAP directory server, first copy the samba.schema file to slapd's configuration directory. The samba.schema file can be found in the directory examples/LDAP @@ -432,7 +450,7 @@ include /etc/openldap/schema/nis.schema like in the following example, to speed up searches made on sambaSamAccount objectclasses (and possibly posixAccount and posixGroup as well).

    -

    +
     # Indices to maintain
 ## required by OpenLDAP
 index objectclass             eq
@@ -459,7 +477,7 @@ index   default               sub
 		Create the new index by executing:
 		
    
 
    -./sbin/slapindex -f slapd.conf
+root# ./sbin/slapindex -f slapd.conf
 
    
 
    
 		Remember to restart slapd after making these changes:
@@ -467,34 +485,34 @@ index   default               sub
 
     root# /etc/init.d/slapd restart
 
    
-

    Initialise the LDAP database

    +

    Initialise the LDAP database

    Before you can add accounts to the LDAP database you must create the account containers that they will be stored in. The following LDIF file should be modified to match your needs (ie: Your DNS entries, etc.).

    -

    +
     # Organization for Samba Base
-dn: dc=plainjoe,dc=org
+dn: dc=quenya,dc=org
 objectclass: dcObject
 objectclass: organization
-dc: plainjoe
-o: Terpstra Org Network
+dc: quenya
+o: Quenya Org Network
 description: The Samba-3 Network LDAP Example
 
 # Organizational Role for Directory Management
-dn: cn=Manager,dc=plainjoe,dc=org
+dn: cn=Manager,dc=quenya,dc=org
 objectclass: organizationalRole
 cn: Manager
 description: Directory Manager
 
 # Setting up container for users
-dn: ou=People,dc=plainjoe,dc=org
+dn: ou=People,dc=quenya,dc=org
 objectclass: top
 objectclass: organizationalUnit
 ou: People
 
 # Setting up admin handle for People OU
-dn: cn=admin,ou=People,dc=plainjoe,dc=org
+dn: cn=admin,ou=People,dc=quenya,dc=org
 cn: admin
 objectclass: top
 objectclass: organizationalRole
@@ -516,70 +534,39 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz
 		
    Note
    
 		Before Samba can access the LDAP server you need to store the LDAP admin password
 		into the Samba-3 secrets.tdb database by:
-		
    -root#  smbpasswd -w secret
-		
    
-

    Configuring Samba

    +

    +root# smbpasswd -w secret
+

    +

    Configuring Samba

    The following parameters are available in smb.conf only if your version of samba was built with LDAP support. Samba automatically builds with LDAP support if the LDAP libraries are found. -

    +

    LDAP related smb.conf options: + passdb backend = ldapsam:url, + ldap ssl, + ldap admin dn, + ldap suffix, + ldap filter, + ldap machine suffix, + ldap user suffix, + ldap delete dn, + ldap passwd sync, + ldap trust ids. +

    These are described in the smb.conf man page and so will not be repeated here. However, a sample smb.conf file for use with an LDAP directory could appear as

    -

    -## /usr/local/samba/lib/smb.conf
-[global]
-     security = user
-     encrypt passwords = yes
-
-     netbios name = TASHTEGO
-     workgroup = NARNIA
-
-     # ldap related parameters
-
-     # define the DN to use when binding to the directory servers
-     # The password for this DN is not stored in smb.conf.  Rather it
-     # must be set by using 'smbpasswd -w secretpw' to store the
-     # passphrase in the secrets.tdb file.  If the "ldap admin dn" values
-     # change, this password will need to be reset.
-     ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"
-
-     # Define the SSL option when connecting to the directory
-     # ('off', 'start tls', or 'on' (default))
-     ldap ssl = start tls
-
-     # syntax: passdb backend = ldapsam:ldap://server-name[:port]
-     passdb backend = ldapsam:ldap://funball.samba.org, guest
-
-     # smbpasswd -x delete the entire dn-entry
-     ldap delete dn = no
-
-     # the machine and user suffix added to the base suffix
-     # wrote WITHOUT quotes. NULL suffixes by default
-     ldap user suffix = ou=People
-     ldap machine suffix = ou=Systems
-
-     # Trust unix account information in LDAP
-     #  (see the smb.conf manpage for details)
-     ldap trust ids = Yes
-
-     # specify the base DN to use when searching the directory
-     ldap suffix = "ou=people,dc=samba,dc=org"
-
-     # generally the default ldap search filter is ok
-     # ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))"
-

    -

    Accounts and Groups management

    +

    Example 11.2. Configuration with LDAP

    [global]
    security = user
    encrypt passwords = yes
    netbios name = TASHTEGO
    workgroup = NARNIA
    # ldap related parameters
    # define the DN to use when binding to the directory servers
    # The password for this DN is not stored in smb.conf. Rather it
    # must be set by using 'smbpasswd -w secretpw' to store the
    # passphrase in the secrets.tdb file. If the "ldap admin dn" values
    # change, this password will need to be reset.
    ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"
    # Define the SSL option when connecting to the directory
    # ('off', 'start tls', or 'on' (default))
    ldap ssl = start tls
    # syntax: passdb backend = ldapsam:ldap://server-name[:port]
    passdb backend = ldapsam:ldap://funball.samba.org
    # smbpasswd -x delete the entire dn-entry
    ldap delete dn = no
    # the machine and user suffix added to the base suffix
    # wrote WITHOUT quotes. NULL suffixes by default
    ldap user suffix = ou=People
    ldap machine suffix = ou=Systems
    # Trust unix account information in LDAP
    # (see the smb.conf manpage for details)
    ldap trust ids = Yes
    # specify the base DN to use when searching the directory
    ldap suffix = "ou=people,dc=samba,dc=org"
    # generally the default ldap search filter is ok
    ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))"

    +

    Accounts and Groups management

    As users accounts are managed through the sambaSamAccount objectclass, you should modify your existing administration tools to deal with sambaSamAccount attributes.

    Machines accounts are managed with the sambaSamAccount objectclass, just like users accounts. However, it's up to you to store those accounts in a different tree of your LDAP namespace: you should use - "ou=Groups,dc=plainjoe,dc=org" to store groups and - "ou=People,dc=plainjoe,dc=org" to store users. Just configure your + "ou=Groups,dc=quenya,dc=org" to store groups and + "ou=People,dc=quenya,dc=org" to store users. Just configure your NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration file).

    @@ -587,7 +574,7 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz groups. This means that Samba makes use of the posixGroup objectclass. For now, there is no NT-like group system management (global and local groups). -

    Security and sambaSamAccount

    +

    Security and sambaSamAccount

    There are two important points to remember when discussing the security of sambaSamAccount entries in the directory.

    • Never retrieve the lmPassword or @@ -598,13 +585,13 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz on the details of LM/NT password hashes, refer to the Account Information Database section of this chapter.

      - To remedy the first security issue, the ldap ssl smb.conf parameter defaults - to require an encrypted session (ldap ssl = on) using + To remedy the first security issue, the ldap ssl smb.conf parameter defaults + to require an encrypted session (ldap ssl = on) using the default port of 636 when contacting the directory server. When using an OpenLDAP server, it is possible to use the use the StartTLS LDAP extended operation in the place of LDAPS. In either case, you are strongly discouraged to disable this security - (ldap ssl = off). + (ldap ssl = off).

      Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS extended operation. However, the OpenLDAP library still provides support for @@ -617,84 +604,83 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz 

       ## allow the "ldap admin dn" access, but deny everyone else
 access to attrs=lmPassword,ntPassword
-     by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write
+     by dn="cn=Samba Admin,ou=people,dc=quenya,dc=org" write
      by * none

      -

    LDAP special attributes for sambaSamAccounts

    +

    LDAP special attributes for sambaSamAccounts

    The sambaSamAccount objectclass is composed of the following attributes:

    -

    Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP)

    lmPasswordthe LANMAN password 16-byte hash stored as a character - representation of a hexadecimal string.
    ntPasswordthe NT password hash 16-byte stored as a character - representation of a hexadecimal string.
    pwdLastSetThe integer time in seconds since 1970 when the - lmPassword and ntPassword attributes were last set. -
    acctFlagsstring of 11 characters surrounded by square brackets [] +

    Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP)

    sambaLMPasswordthe LANMAN password 16-byte hash stored as a character +representation of a hexadecimal string.
    sambaNTPasswordthe NT password hash 16-byte stored as a character + representation of a hexadecimal string.
    sambaPwdLastSetThe integer time in seconds since 1970 when the + sambaLMPassword and sambaNTPassword attributes were last set. +
    sambaAcctFlagsstring of 11 characters surrounded by square brackets [] representing account flags such as U (user), W(workstation), X(no password expiration), I(Domain trust account), H(Home dir required), S(Server trust account), - and D(disabled).
    logonTimeInteger value currently unused
    logoffTimeInteger value currently unused
    kickoffTimeInteger value currently unused
    pwdCanChangeInteger value currently unused
    pwdMustChangeInteger value currently unused
    homeDrivespecifies the drive letter to which to map the - UNC path specified by homeDirectory. The drive letter must be specified in the form "X:" + and D(disabled).
    sambaLogonTimeInteger value currently unused
    sambaLogoffTimeInteger value currently unused
    sambaKickoffTimeInteger value currently unused
    sambaPwdCanChangeInteger value currently unused
    sambaPwdMustChangeInteger value currently unused
    sambaHomeDrivespecifies the drive letter to which to map the + UNC path specified by sambaHomePath. The drive letter must be specified in the form "X:" where X is the letter of the drive to map. Refer to the "logon drive" parameter in the - smb.conf(5) man page for more information.
    scriptPathThe scriptPath property specifies the path of + smb.conf(5) man page for more information.
    sambaLogonScriptThe sambaLogonScript property specifies the path of the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path - is relative to the netlogon share. Refer to the "logon script" parameter in the - smb.conf(5) man page for more information.
    profilePathspecifies a path to the user's profile. + is relative to the netlogon share. Refer to the logon script parameter in the + smb.conf man page for more information.
    sambaProfilePathspecifies a path to the user's profile. This value can be a null string, a local absolute path, or a UNC path. Refer to the - "logon path" parameter in the smb.conf(5) man page for more information.
    smbHomeThe homeDirectory property specifies the path of - the home directory for the user. The string can be null. If homeDrive is set and specifies - a drive letter, homeDirectory should be a UNC path. The path must be a network - UNC path of the form \\server\share\directory. This value can be a null string. - Refer to the logon home parameter in the smb.conf man page for more information. -
    userWorkstationcharacter string value currently unused. -
    ridthe integer representation of the user's relative identifier - (RID).
    primaryGroupIDthe relative identifier (RID) of the primary group - of the user.
    domaindomain the user is part of.

    + logon path parameter in the smb.conf man page for more information.

    sambaHomePathThe sambaHomePath property specifies the path of +the home directory for the user. The string can be null. If sambaHomeDrive is set and specifies +a drive letter, sambaHomePath should be a UNC path. The path must be a network +UNC path of the form \\server\share\directory. This value can be a null string. +Refer to the logon home parameter in the smb.conf man page for more information. +
    sambaUserWorkstationscharacter string value currently unused. +
    sambaSIDThe security identifier(SID) of the user. The windows equivalent of unix uid's.
    sambaPrimaryGroupSIDthe relative identifier (RID) of the primary group + of the user.
    sambaDomainNamedomain the user is part of.

    The majority of these parameters are only used when Samba is acting as a PDC of a domain (refer to the Samba as a primary domain controller chapter for details on how to configure Samba as a Primary Domain Controller). The following four attributes are only stored with the sambaSamAccount entry if the values are non-default values: -

    smbHome
    scriptPath
    logonPath
    homeDrive

    +

    • sambaHomePath

    • sambaLogonScript

    • sambaProfilePath

    • sambaHomeDrive

    These attributes are only stored with the sambaSamAccount entry if the values are non-default values. For example, assume TASHTEGO has now been - configured as a PDC and that logon home = \\%L\%u was defined in + configured as a PDC and that logon home = \\%L\%u was defined in its smb.conf file. When a user named "becky" logons to the domain, - the logon home string is expanded to \\TASHTEGO\becky. + the logon home string is expanded to \\TASHTEGO\becky. If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", this value is used. However, if this attribute does not exist, then the value - of the logon home parameter is used in its place. Samba + of the logon home parameter is used in its place. Samba will only write the attribute value to the directory entry if the value is something other than the default (e.g. \\MOBY\becky). -

    Example LDIF Entries for a sambaSamAccount

    +

    Example LDIF Entries for a sambaSamAccount

    The following is a working LDIF with the inclusion of the posixAccount objectclass: 

    -	dn: uid=guest2, ou=people,dc=plainjoe,dc=org
-	ntPassword: 878D8014606CDA29677A44EFA1353FC7
-	pwdMustChange: 2147483647
-	primaryGroupID: 1201
-	lmPassword: 552902031BEDE9EFAAD3B435B51404EE
-	pwdLastSet: 1010179124
-	logonTime: 0
+	dn: uid=guest2, ou=people,dc=quenya,dc=org
+	sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7
+	sambaPwdMustChange: 2147483647
+	sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-513
+	sambaNTPassword: 552902031BEDE9EFAAD3B435B51404EE
+	sambaPwdLastSet: 1010179124
+	sambaLogonTime: 0
 	objectClass: sambaSamAccount
 	uid: guest2
-	kickoffTime: 2147483647
-	acctFlags: [UX         ]
-	logoffTime: 2147483647
-	rid: 19006
-	pwdCanChange: 0
+	sambaKickoffTime: 2147483647
+	sambaAcctFlags: [UX         ]
+	sambaLogoffTime: 2147483647
+	sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5006
+	sambaPwdCanChange: 0

    The following is an LDIF entry for using both the sambaSamAccount and posixAccount objectclasses: 

    -	dn: uid=gcarter, ou=people,dc=plainjoe,dc=org
-	logonTime: 0
+	dn: uid=gcarter, ou=people,dc=quenya,dc=org
+	sambaLogonTime: 0
 	displayName: Gerald Carter
-	lmPassword: 552902031BEDE9EFAAD3B435B51404EE
-	primaryGroupID: 1201
+	sambaLMPassword: 552902031BEDE9EFAAD3B435B51404EE
+	sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-1201
 	objectClass: posixAccount
 	objectClass: sambaSamAccount
-	acctFlags: [UX         ]
+	sambaAcctFlags: [UX         ]
 	userPassword: {crypt}BpM2ej8Rkzogo
 	uid: gcarter
 	uidNumber: 9000
@@ -702,60 +688,59 @@ access to attrs=lmPassword,ntPassword
 	loginShell: /bin/bash
 	logoffTime: 2147483647
 	gidNumber: 100
-	kickoffTime: 2147483647
-	pwdLastSet: 1010179230
-	rid: 19000
+	sambaKickoffTime: 2147483647
+	sambaPwdLastSet: 1010179230
+	sambaSID: S-1-5-21-2447931902-1787058256-3961074038-5004
 	homeDirectory: /home/tashtego/gcarter
-	pwdCanChange: 0
-	pwdMustChange: 2147483647
-	ntPassword: 878D8014606CDA29677A44EFA1353FC7
+	sambaPwdCanChange: 0
+	sambaPwdMustChange: 2147483647
+	sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7

    -

    Password synchronisation

    +

    Password synchronisation

    Since version 3.0 samba can update the non-samba (LDAP) password stored with an account. When using pam_ldap, this allows changing both unix and windows passwords at once. -

    The ldap passwd sync options can have the following values:

    yes

    When the user changes his password, update +

    The ldap passwd sync options can have the following values:

    yes

    When the user changes his password, update ntPassword, lmPassword - and the password fields.

    no

    Only update ntPassword and lmPassword.

    only

    Only update the LDAP password and let the LDAP server worry - about the other fields. This option is only available when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD.

    More information can be found in the smb.conf manpage. -

    MySQL

    + and the password fields.

    no

    Only update ntPassword and lmPassword.

    only

    Only update the LDAP password and let the LDAP server worry about the other fields. This option is only available on some LDAP servers. [3]

    More information can be found in the smb.conf manpage. +

    MySQL

    Every so often someone will come along with a great new idea. Storing of user accounts in an SQL backend is one of them. Those who want to do this are in the best position to know what the specific benefits are to them. This may sound like a cop-out, but in truth we can not attempt to document every nitty little detail why certain things of marginal utility to the bulk of Samba users might make sense to the rest. In any case, the following instructions should help the determined SQL user to implement a working system. -

    Creating the database

    +

    Creating the database

    You either can set up your own table and specify the field names to pdb_mysql (see below for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump contains the correct queries to create the required tables. Use the command : - 

    $ mysql -uusername -hhostname -ppassword \
-databasename < /path/to/samba/examples/pdb/mysql/mysql.dump

    -

    Configuring

    This plugin lacks some good documentation, but here is some short info:

    Add a the following to the passdb backend variable in your smb.conf: - 

    -			passdb backend = [other-plugins] mysql:identifier [other-plugins]
-

    +

    +$ mysql -uusername -hhostname -ppassword \
+databasename < /path/to/samba/examples/pdb/mysql/mysql.dump
+

    +

    Configuring

    This plugin lacks some good documentation, but here is some short info:

    Add a the following to the passdb backend variable in your smb.conf: +

    passdb backend = [other-plugins] mysql:identifier [other-plugins]

    The identifier can be any string you like, as long as it doesn't collide with the identifiers of other plugins or other instances of pdb_mysql. If you - specify multiple pdb_mysql.so entries in passdb backend, you also need to + specify multiple pdb_mysql.so entries in passdb backend, you also need to use different identifiers!

    Additional options can be given through the smb.conf file in the [global] section.

    -

    Table 11.2. Basic smb.conf options for MySQL passdb backend

    FieldContents
    identifier:mysql hosthost name, defaults to 'localhost'
    identifier:mysql password 
    identifier:mysql userdefaults to 'samba'
    identifier:mysql databasedefaults to 'samba'
    identifier:mysql portdefaults to 3306
    identifier:tableName of the table containing users

    +

    Table 11.2. Basic smb.conf options for MySQL passdb backend

    FieldContents
    mysql hosthost name, defaults to 'localhost'
    mysql password 
    mysql userdefaults to 'samba'
    mysql databasedefaults to 'samba'
    mysql portdefaults to 3306
    tableName of the table containing users

    Warning

    Since the password for the MySQL user is stored in the - smb.conf file, you should make the the smb.conf file + smb.conf file, you should make the smb.conf file readable only to the user that runs Samba This is considered a security bug and will be fixed soon.

    Names of the columns in this table (I've added column types those columns should have first):

    -

    Table 11.3. MySQL field names for MySQL passdb backend

    FieldTypeContents
    identifier:logon time columnint(9) 
    identifier:logoff time columnint(9) 
    identifier:kickoff time columnint(9) 
    identifier:pass last set time columnint(9) 
    identifier:pass can change time columnint(9) 
    identifier:pass must change time columnint(9) 
    identifier:username columnvarchar(255)unix username
    identifier:domain columnvarchar(255)NT domain user is part of
    identifier:nt username columnvarchar(255)NT username
    identifier:fullname columnvarchar(255)Full name of user
    identifier:home dir columnvarchar(255)Unix homedir path
    identifier:dir drive columnvarchar(2)Directory drive path (eg: 'H:')
    identifier:logon script columnvarchar(255)Batch file to run on client side when logging on
    identifier:profile path columnvarchar(255)Path of profile
    identifier:acct desc columnvarchar(255)Some ASCII NT user data
    identifier:workstations columnvarchar(255)Workstations user can logon to (or NULL for all)
    identifier:unknown string columnvarchar(255)unknown string
    identifier:munged dial columnvarchar(255)?
    identifier:user sid columnvarchar(255)NT user SID
    identifier:group sid columnvarchar(255)NT group ID
    identifier:lanman pass columnvarchar(255)encrypted lanman password
    identifier:nt pass columnvarchar(255)encrypted nt passwd
    identifier:plain pass columnvarchar(255)plaintext password
    identifier:acct control columnint(9)nt user data
    identifier:unknown 3 columnint(9)unknown
    identifier:logon divs columnint(9)?
    identifier:hours len columnint(9)?
    identifier:unknown 5 columnint(9)unknown
    identifier:unknown 6 columnint(9)unknown

    +

    Table 11.3. MySQL field names for MySQL passdb backend

    FieldTypeContents
    logon time columnint(9) 
    logoff time columnint(9) 
    kickoff time columnint(9) 
    pass last set time columnint(9) 
    pass can change time columnint(9) 
    pass must change time columnint(9) 
    username columnvarchar(255)unix username
    domain columnvarchar(255)NT domain user is part of
    nt username columnvarchar(255)NT username
    fullname columnvarchar(255)Full name of user
    home dir columnvarchar(255)UNIX homedir path
    dir drive columnvarchar(2)Directory drive path (eg: 'H:')
    logon script columnvarchar(255)Batch file to run on client side when logging on
    profile path columnvarchar(255)Path of profile
    acct desc columnvarchar(255)Some ASCII NT user data
    workstations columnvarchar(255)Workstations user can logon to (or NULL for all)
    unknown string columnvarchar(255)unknown string
    munged dial columnvarchar(255)?
    user sid columnvarchar(255)NT user SID
    group sid columnvarchar(255)NT group ID
    lanman pass columnvarchar(255)encrypted lanman password
    nt pass columnvarchar(255)encrypted nt passwd
    plain pass columnvarchar(255)plaintext password
    acct control columnint(9)nt user data
    unknown 3 columnint(9)unknown
    logon divs columnint(9)?
    hours len columnint(9)?
    unknown 5 columnint(9)unknown
    unknown 6 columnint(9)unknown

    Eventually, you can put a colon (:) after the name of each column, which should specify the column to update when updating the table. You can also specify nothing behind the colon - then the data from the field will not be updated. -

    Using plaintext passwords or encrypted password

    +

    Using plaintext passwords or encrypted password

    I strongly discourage the use of plaintext passwords, however, you can use them:

    If you would like to use plaintext passwords, set @@ -765,7 +750,7 @@ access to attrs=lmPassword,ntPassword

    If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default. -

    Getting non-column data from the table

    +

    Getting non-column data from the table

    It is possible to have not all data in the database and making some 'constant'.

    For example, you can set 'identifier:fullname column' to : @@ -780,33 +765,21 @@ access to attrs=lmPassword,ntPassword

    To import data, use: $ pdbedit -i xml:filename -

    Common Errors

    Users can not logon - Users not in Samba SAM

    - People forget to put their users in their backend and then complain Samba won't authorize them. -

    Users are being added to the wrong backend database

    +

    Common Errors

    Users can not logon

    “I've installed samba, but now I can't log on with my unix account!”

    Make sure your user has been added to the current samba passdb backend. Read the section Account Management Tools for details.

    Users being added to wrong backend database

    A few complaints have been received from users that just moved to Samba-3. The following smb.conf file entries were causing problems, new accounts were being added to the old smbpasswd file, not to the tdbsam passdb.tdb file:

    - 

    -	[globals]
-		...
-		passdb backend = smbpasswd, tdbsam, guest
-		...
-

    +

    [global]
    ...
    passdb backend = smbpasswd, tdbsam
    ...

    Samba will add new accounts to the first entry in the passdb backend parameter entry. If you want to update to the tdbsam, then change the entry to:

    - 

    -	[globals]
-		...
-		passdb backend = tdbsam, smbpasswd, guest
-		...
-

    -

    auth methods does not work

    - If you explicitly set an 'auth methods' parameter, guest must be specified as the first - entry on the line. Eg: auth methods = guest sam. +

    [globals]
    ...
    passdb backend = tdbsam, smbpasswd
    ...

    +

    auth methods does not work

    + If you explicitly set an auth methods parameter, guest must be specified as the first + entry on the line. Eg: auth methods = guest sam.

    - This is the exact opposite of the requirement for the passdb backed + This is the exact opposite of the requirement for the passdb backend option, where it must be the LAST parameter on the line. -

    Prev Up Next
    Chapter 10. Samba / MS Windows Network Browsing Guide Home Chapter 12. Mapping MS Windows and Unix Groups
    +


    [3] Only when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD

    Prev Up Next
    Chapter 10. Samba / MS Windows Network Browsing Guide Home Chapter 12. Mapping MS Windows and UNIX Groups
    diff --git a/docs/htmldocs/pdbedit.8.html b/docs/htmldocs/pdbedit.8.html index 368a6911b7..39a901923f 100644 --- a/docs/htmldocs/pdbedit.8.html +++ b/docs/htmldocs/pdbedit.8.html @@ -1,4 +1,4 @@ -pdbedit

    Name

    pdbedit — manage the SAM database

    Synopsis

    pdbedit [-L] [-v] [-w] [-u username] [-f fullname] [-h homedir] [-D drive] [-S script] [-p profile] [-a] [-m] [-x] [-i passdb-backend] [-e passdb-backend] [-b passdb-backend] [-g] [-d debuglevel] [-s configfile] [-P account-policy] [-C value]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The pdbedit program is used to manage the users accounts +pdbedit

    Name

    pdbedit — manage the SAM database

    Synopsis

    pdbedit [-L] [-v] [-w] [-u username] [-f fullname] [-h homedir] [-D drive] [-S script] [-p profile] [-a] [-m] [-r] [-x] [-i passdb-backend] [-e passdb-backend] [-b passdb-backend] [-g] [-d debuglevel] [-s configfile] [-P account-policy] [-C value] [-c account-control]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The pdbedit program is used to manage the users accounts stored in the sam database and can only be run by root.

    The pdbedit tool uses the passdb modular interface and is independent from the kind of users database used (currently there are smbpasswd, ldap, nis+ and tdb based and more can be added @@ -31,7 +31,7 @@ Home Directory: \\BERSERKER\samba HomeDir Drive: Logon Script: Profile Path: \\BERSERKER\profile -

    -w

    This option sets the "smbpasswd" listing format. +

    -w

    This option sets the "smbpasswd" listing format. It will make pdbedit list the users in the database, printing out the account fields in a format compatible with the smbpasswd file format. (see the @@ -44,18 +44,18 @@ samba:45:0F2B255F7B67A7A9AAD3B435B51404EE:BC281CE3F53B6A5146629CD4751D3490:[UX operations and optional in list operations.

    -f fullname

    This option can be used while adding or modifing a user account. It will specify the user's full - name.

    Example: -f "Simo Sorce"

    -h homedir

    This option can be used while adding or + name.

    Example: -f "Simo Sorce"

    -h homedir

    This option can be used while adding or modifing a user account. It will specify the user's home - directory network path.

    Example: -h "\\\\BERSERKER\\sorce" + directory network path.

    Example: -h "\\\\BERSERKER\\sorce"

    -D drive

    This option can be used while adding or modifing a user account. It will specify the windows drive - letter to be used to map the home directory.

    Example: -d "H:" + letter to be used to map the home directory.

    Example: -d "H:"

    -S script

    This option can be used while adding or modifing a user account. It will specify the user's logon - script path.

    Example: -s "\\\\BERSERKER\\netlogon\\sorce.bat" + script path.

    Example: -s "\\\\BERSERKER\\netlogon\\sorce.bat"

    -p profile

    This option can be used while adding or modifing a user account. It will specify the user's profile - directory.

    Example: -p "\\\\BERSERKER\\netlogon" + directory.

    Example: -p "\\\\BERSERKER\\netlogon"

    -G SID|rid

    This option can be used while adding or modifying a user account. It will specify the users' new primary group SID (Security Identifier) or @@ -65,7 +65,7 @@ samba:45:0F2B255F7B67A7A9AAD3B435B51404EE:BC281CE3F53B6A5146629CD4751D3490:[UX rid.

    Example: -U S-1-5-21-2447931902-1787058256-3961074038-5004

    -c account-control

    This option can be used while adding or modifying a user account. It will specify the users' account control property. Possible flags that can be set are: N, D, H, L, X. -

    Example: -c "[X ]"

    -a

    This option is used to add a user into the +

    Example: -c "[X ]"

    -a

    This option is used to add a user into the database. This command needs a user name specified with the -u switch. When adding a new user, pdbedit will also ask for the password to be used.

    Example: pdbedit -a -u sorce @@ -94,12 +94,12 @@ retype new password applies to the group mapping instead of the user database.

    This option will ease migration from one passdb backend to another and will ease backing up.

    -b passdb-backend

    Use a different default passdb backend.

    Example: pdbedit -b xml:/root/pdb-backup.xml -l

    -P account-policy

    Display an account policy

    Valid policies are: minimum password age, reset count minutes, disconnect time, user must logon to change password, password history, lockout duration, min password length, - maximum password age and bad lockout attempt.

    Example: pdbedit -P "bad lockout attempt"

    +		maximum password age and bad lockout attempt.
    Example: pdbedit -P "bad lockout attempt"
     account policy value for bad lockout attempt is 0
    -C account-policy-value

    Sets an account policy to a specified value. This option may only be used in conjunction with the -P option. -

    Example: pdbedit -P "bad lockout attempt" -C 3

    +		
    Example: pdbedit -P "bad lockout attempt" -C 3
     account policy value for bad lockout attempt was 0
 account policy value for bad lockout attempt is now 3
    -h|--help

    Print a summary of command line options. @@ -109,8 +109,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -124,10 +123,9 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +override the log level parameter +in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    NOTES

    This command may be used only by root.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    smbpasswd(5), samba(7)

    AUTHOR

    The original Samba software and related utilities diff --git a/docs/htmldocs/pr01.html b/docs/htmldocs/pr01.html new file mode 100644 index 0000000000..193564ca32 --- /dev/null +++ b/docs/htmldocs/pr01.html @@ -0,0 +1,5 @@ +Legal Notice

    Legal Notice
    Prev   Next

    Legal Notice

    +This documentation is distributed under the GNU General Public License (GPL) +version 2. A copy of the license is included with the Samba source +distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt +

    Prev Up Next
    SAMBA Project Documentation Home Attributions
    diff --git a/docs/htmldocs/pr02.html b/docs/htmldocs/pr02.html new file mode 100644 index 0000000000..08a02a7142 --- /dev/null +++ b/docs/htmldocs/pr02.html @@ -0,0 +1 @@ +Attributions
    Attributions
    Prev   Next

    Attributions

    Introduction to Samba

    How to Install and Test SAMBA

    Fast Start for the Impatient

    Server Types and Security Modes

    Domain Control

    Backup Domain Control

    Domain Membership

    Stand-Alone Servers

    MS Windows Network Configuration Guide

    Samba / MS Windows Network Browsing Guide

    Account Information Databases

    Mapping MS Windows and UNIX Groups

    File, Directory and Share Access Controls

    File and Record Locking

    Securing Samba

    Interdomain Trust Relationships

    Hosting a Microsoft Distributed File System tree on Samba

    Classical Printing Support

    CUPS Printing Support in Samba 3.0

    Stackable VFS modules

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Tim Potter

    • Simo Sorce (original vfs_skel README)

    • Alexander Bokovoy (original vfs_netatalk docs)

    • Stefan Metzmacher (Update for multiple modules)

    Advanced Network Management

    System and Account Policies

    Desktop Profile Management

    PAM based Distributed Authentication

    Integrating MS Windows networks with Samba

    Unicode/Charsets

    Samba Backup Techniques

    High Availability Options

    Upgrading from Samba-2.x to Samba-3.0.0

    Migration from NT4 PDC to Samba-3 PDC

    SWAT - The Samba Web Administration Tool

    The Samba checklist

    Analysing and solving samba problems

    Reporting Bugs

    How to compile Samba

    Portability

    Samba and other CIFS clients

    Samba Performance Tuning

    DNS and DHCP Configuration Guide

    Further Resources

    Prev Up Next
    Legal Notice Home Part I. General Installation
    diff --git a/docs/htmldocs/printing.html b/docs/htmldocs/printing.html index 089bba6e0f..2b0abb56e6 100644 --- a/docs/htmldocs/printing.html +++ b/docs/htmldocs/printing.html @@ -1,12 +1,11 @@ -Chapter 18. Classical Printing Support
    Chapter 18. Classical Printing Support
    Prev Part III. Advanced Configuration Next

    Chapter 18. Classical Printing Support

    Kurt Pfeifle

    Danka Deutschland GmbH

    Gerald (Jerry) Carter

    Samba Team

    May 32, 2003

    Table of Contents

    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    Parameters for Backwards Compatibility
    Parameters no longer in use
    A simple Configuration to Print with Samba-3
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print with Samba-3
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various Unix Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba-3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with -rpcclient
    "The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure)
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a -different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba-3
    Publishing Printer Information in Active Directory or LDAP
    Common Errors and Problems
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost

    Features and Benefits

    +Chapter 18. Classical Printing Support

    Chapter 18. Classical Printing Support
    Prev Part III. Advanced Configuration Next

    Chapter 18. Classical Printing Support

    Kurt Pfeifle

    Danka Deutschland GmbH

    Gerald (Jerry) Carter

    Samba Team

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    A simple Configuration to Print
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various UNIX Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba 3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with +rpcclient
    Client Driver Install Procedure
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a +different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost

    Features and Benefits

    Printing is often a mission-critical service for the users. Samba can provide this service reliably and seamlessly for a client network consisting of Windows workstations.

    -A Samba-3.0 print service may be run on a Standalone or a Domain +A Samba print service may be run on a Standalone or a Domain member server, side by side with file serving functions, or on a dedicated print server. It can be made as tight or as loosely secured as needs dictate. Configurations may be simple or complex. Available @@ -30,24 +29,24 @@ implemented by the more traditional UNIX (BSD- and System V-style) printing systems. Many things apply to CUPS, the newer Common UNIX Printing System, too; so if you use CUPS, you might be tempted to jump to the next chapter -- but you will certainly miss a few things if you -do so. Better read this chapter too. +do so. Better to read this chapter too.

    Note

    Most of the given examples have been verified on Windows XP Professional clients. Where this document describes the responses to commands given, bear in mind that Windows 2000 clients are very similar, but may differ in details. Windows NT is somewhat different again. -

    Technical Introduction

    +

    Technical Introduction

    Samba's printing support always relies on the installed print -subsystem of the Unix OS it runs on. Samba is a "middleman". It takes +subsystem of the UNIX OS it runs on. Samba is a "middleman". It takes printfiles from Windows (or other SMB) clients and passes them to the real printing system for further processing. Therefore it needs to -"talk" to two sides: to the Windows print clients and to the Unix +"talk" to two sides: to the Windows print clients and to the UNIX printing system. Hence we must differentiate between the various client OS types each of which behave differently, as well as the various UNIX print subsystems, which themselves have different features and are accessed differently. This part of the Samba HOWTO -Collection deals with the "traditional" way of Unix printing first; +Collection deals with the "traditional" way of UNIX printing first; the next chapter covers in great detail the more modern Common UNIX Printing System (CUPS). @@ -55,15 +54,15 @@ the next chapter covers in great detail the more modern

    Important

    CUPS users, be warned: don't just jump on to the next chapter. You might miss important information contained only here!

    -

    What happens if you send a Job from a Client

    +

    What happens if you send a Job from a Client

    To successfully print a job from a Windows client via a Samba print server to a UNIX printer, there are 6 (potentially 7) stages: -

    1. Windows opens a connection to the printershare

    2. Samba must authenticate the user

    3. Windows sends a copy of the printfile over the network +

      1. Windows opens a connection to the printer share

      2. Samba must authenticate the user

      3. Windows sends a copy of the printfile over the network into Samba's spooling area

      4. Windows closes the connection again

      5. Samba invokes the print command to hand the file over -to the UNIX print subsystem's spooling area

      6. The Unix print subsystem processes the print +to the UNIX print subsystem's spooling area

      7. The UNIX print subsystem processes the print job

      8. The printfile may need to be explicitly deleted -from the Samba spooling area.

    Printing Related Configuration Parameters

    +from the Samba spooling area.

    Printing Related Configuration Parameters

    There are a number of configuration parameters in controlling Samba's printing behaviour. Please also refer to the man page for smb.conf to @@ -71,74 +70,65 @@ acquire an overview about these. As with other parameters, there are Global Level (tagged with a "G" in the listings) and Service Level ("S") parameters.

    Service Level Parameters

    These may go into the -[global] section of -. In this case they define the default +[global] section of smb.conf. +In this case they define the default behaviour of all individual or service level shares (provided those don't have a different setting defined for the same parameter, thus overriding the global default).

    Global Parameters

    These may not go into individual shares. If they go in by error, the "testparm" utility can discover -this (if you run it) and tell you so.

    Parameters Recommended for Use

    The following smb.conf parameters directly -related to printing are used in Samba-3. See also the +this (if you run it) and tell you so.

    Parameters Recommended for Use

    The following smb.conf parameters directly +related to printing are used in Samba. See also the smb.conf man page for detailed explanations: -

    List of printing related parameters in Samba-3.  -

    Global level parameters:

    • addprinter command (G)

    • deleteprinter command (G)

    • disable spoolss (G)

    • enumports command (G)

    • load printers (G)

    • lpq cache time (G)

    • os2 driver map (G)

    • printcap name (G), printcap (G)

    • show add printer wizard (G)

    • total print jobs (G)

    • use client driver (G)

    - -

    Service level parameters:

    • hosts allow (S)

    • hosts deny (S)

    • lppause command (S)

    • lpq command (S)

    • lpresume command (S)

    • lprm command (S)

    • max print jobs (S)

    • min print space (S)

    • print command (S)

    • printable (S), print ok (S)

    • printer name (S), printer (S)

    • printer admin (S)

    • printing = [cups|bsd|lprng...] (S)

    • queuepause command (S)

    • queueresume command (S)

    • total print jobs (S)

    +

    Global level parameters: addprinter command, +deleteprinter command, +disable spoolss, +enumports command, +load printers, +lpq cache time, +os2 driver map, +printcap name, printcap, +show add printer wizard, +total print jobs, +use client driver. +

    Service level parameters: hosts allow, +hosts deny, +lppause command, +lpq command, +lpresume command, +lprm command, +max print jobs, +min print space, +print command, +printable, print ok , +printer name, printer, +printer admin, +printing = [cups|bsd|lprng...], +queuepause command, +queueresume command, +total print jobs.

    Samba's printing support implements the Microsoft Remote Procedure Calls (MS-RPC) methods for printing. These are used by Windows NT (and later) print servers. The old "LanMan" protocol is still supported as a fallback resort, and for older clients to use. More details will follow further beneath. -

    Parameters for Backwards Compatibility

    -Two new parameters that were added in Samba 2.2.2, are still present -in Samba-3.0. Both of these options are described in the -smb.conf man page and are disabled by -default. Use them with caution! -

    disable spoolss(G)

    This is -provided for better support of Samba 2.0.x backwards capability. It -will disable Samba's support for MS-RPC printing and yield identical -printing behaviour to Samba 2.0.x.

    use client driver (G)

    was provided -for using local printer drivers on Windows NT/2000 clients. It does -not apply to Windows 95/98/ME clients.

    Parameters "for backward compatibility only", use with caution.  -

    • disable spoolss (G)

    • use client driver (S)

    -

    Parameters no longer in use

    -Samba users upgrading from 2.2.x to 3.0 need to be aware that some -previously available settings are no longer supported (as was -announced some time ago). Here is a list of them: -

    "old" parameters, removed in Samba-3.  -The following smb.conf parameters have been -deprecated already in Samba 2.2 and are now completely removed from -Samba-3. You cannot use them in new 3.0 installations: - -

    • printer driver file (G)

    • total print jobs (G)

    • postscript (S)

    • printer driver (S)

    • printer driver location (S)

    -

    A simple Configuration to Print with Samba-3

    +

    A simple Configuration to Print

    Here is a very simple example configuration for print related settings -in the file. If you compare it with your -own system's , you probably find some +in the file. If you compare it with your own system's , you probably find some additional parameters included there (as pre-configured by your OS vendor). Further below is a discussion and explanation of the parameters. Note, that this example doesn't use many parameters. However, in many environments these are enough to provide a valid - which enables all clients to print. -

    - [global]
-         printing = bsd
-         load printers = yes
-
- [printers]
-         path = /var/spool/samba
-         printable = yes
-         public = yes
-         writable = no
-

    -This is only an example configuration. Many settings, if not -explicitly set to a specific value, are used and set by Samba -implicitly to its own default, because these have been compiled in. -To see all settings, let root use the testparm -utility. testparm also gives warnings if you have -mis-configured certain things. Its complete output is easily 340 lines -and more. You may want to pipe it through a pager program. +smb.conf file which enables all clients to print. +

    Example 18.1. Simple configuration with BSD printing

    [global]
    printing = bsd
    load printers = yes
    [printers]
    path = /var/spool/samba
    printable = yes
    public = yes
    writable = no

    +This is only an example configuration. Samba assigns default values to all +configuration parameters. On the whole the defaults are conservative and +sensible. When a parameter is specified in the smb.conf file this overwrites +the default value. The testparm utility when run as root +is capable of reporting all setting, both default as well as smb.conf file +settings. Testparm gives warnings for all mis-configured +settings. The complete output is easily 340 lines and more, so you may want +to pipe it through a pager program.

    The syntax for the configuration file is easy to grasp. You should know that is not very picky about its @@ -147,7 +137,7 @@ reminder: It even tolerates some spelling errors (like "browsable" instead of "browseable"). Most spelling is case-insensitive. Also, you can use "Yes|No" or "True|False" for boolean settings. Lists of names may be separated by commas, spaces or tabs. -

    Verification of "Settings in Use" with testparm

    +

    Verification of "Settings in Use" with testparm

    To see all (or at least most) printing related settings in Samba, including the implicitly used ones, try the command outlined below (hit "ENTER" twice!). It greps for all occurrences of "lp", "print", @@ -198,20 +188,20 @@ as shown above: You can easily verify which settings were implicitly added by Samba's default behaviour. Don't forget about this point: it may be important in your future dealings with Samba. -

    Note

    testparm in Samba-3.0 behaves differently from 2.2.x: used +

    Note

    testparm in samba 3 behaves differently from 2.2.x: used without the "-v" switch it only shows you the settings actually written into ! To see the complete -configuration used, add the "-v" parameter to testparm.

    A little Experiment to warn you

    +configuration used, add the "-v" parameter to testparm.

    A little Experiment to warn you

    Should you need to troubleshoot at any stage, please always come back to this point first and verify if "testparm" shows the parameters you expect! To give you an example from personal experience as a warning, -try to just "comment out" the load printers" +try to just "comment out" the load printers" parameter. If your 2.2.x system behaves like mine, you'll see this: 

     root# grep "load printers" /etc/samba/smb.conf
  #      load printers = Yes
-        # This setting is commented ooouuuuut!!
-
+ # This setting is commented ooouuuuut!!
+ 
 root# testparm -v /etc/samba/smb.conf | egrep "(load printers)"
         load printers = Yes
 
@@ -232,7 +222,7 @@ any more... at least not by this ;-)

    Only when setting the parameter explicitly to -"load printers = No" +"load printers = No" would Samba recognize my intentions. So my strong advice is:

    • Never rely on "commented out" parameters!

    • Always set it up explicitly as you intend it to behave.

    • Use testparm to uncover hidden @@ -258,7 +248,7 @@ ask testparm what the Samba print configuration would be, if you used this minimalistic file as your real : 

      -root#  testparm -v /etc/samba/smb.conf-minimal | egrep "(print|lpq|spool|driver|ports|[)"
+root# testparm -v smb.conf-minimal | egrep "(print|lpq|spool|driver|ports|[)"
  Processing section "[printers]"
  WARNING: [printers] service MUST be printable!
  No path in service printers - using /tmp
@@ -291,8 +281,8 @@ testparm issued 2 warnings:
 [printers] section as printable,
 and

    • because we didn't tell it which spool directory to use.

    -However, this was not fatal, and Samba-3.0 will default to values that -will work here. But, please!, don't rely on this and don't use this +However, this was not fatal, and samba will default to values that +will work here. Please, don't rely on this and don't use this example! This was only meant to make you careful to design and specify your setup to be what you really want it to be. The outcome on your system may vary for some parameters, since you may have a Samba built @@ -304,61 +294,20 @@ comment sign at the front). At first I regarded this as a bug in my Samba version(s). But the man page states: “Internal whitespace in a parameter value is retained verbatim.” This means that a line consisting of, for example, -

    -printing = lprng     #This defines LPRng as the printing system"
-

    +

    # This defines LPRng as the printing system"
    printing = lprng

    will regard the whole of the string after the "=" sign as the value you want to define. And this is an invalid value that will be ignored, and a default value used instead.] -

    Extended Sample Configuration to Print with Samba-3

    -Here we show a more verbose example configuration for print related -settings in an . Below is a discussion +

    Extended Sample Configuration to Print

    + In the extended BSD configuration example we show a more verbose example configuration for print related + settings in BSD-printing style environment . Below is a discussion and explanation of the various parameters. We chose to use BSD-style printing here, because we guess it is still the most commonly used system on legacy Linux installations (new installs now predominantly have CUPS, which is discussed entirely in the next chapter of this document). Note, that this example explicitly names many parameters -which don't need to be stated because they are set by default. You -might be able to do with a leaner .

    Tip

    -if you read access it with the Samba Web Administration Tool (SWAT), -and then write it to disk again, it will be optimized in a way such -that it doesn't contain any superfluous parameters and comments. SWAT -organizes the file for best performance. Remember that each smbd -re-reads the Samba configuration once a minute, and that each -connection spawns an smbd process of its own, so it is not a bad idea -to optimize the in environments with -hundreds or thousands of clients.

    - [global]
-         printing = bsd
-         load printers = yes
-         show add printer wizard = yes
-         printcap name = /etc/printcap
-         printer admin = @ntadmin, root
-         total print jobs = 100
-         lpq cache time = 20
-         use client driver = no
-
- [printers]
-         comment = All Printers
-         printable = yes
-         path = /var/spool/samba
-         browseable = no
-         guest ok = yes
-         public = yes
-         read only = yes
-         writable = no       
-
- [my_printer_name]
-         comment = Printer with Restricted Access
-         path = /var/spool/samba_my_printer
-         printer admin = kurt
-         browseable = yes
-         printable = yes
-         writeable = no
-         hosts allow = 0.0.0.0
-         hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60
-         guest ok = no
-

    +which don't need to be specified because they are set by default. You +might be able to do with a leaner smb.conf file.

    Example 18.2. Extended configuration with BSD printing

    [global]
    printing = bsd
    load printers = yes
    show add printer wizard = yes
    printcap name = /etc/printcap
    printer admin = @ntadmin, root
    total print jobs = 100
    lpq cache time = 20
    use client driver = no
    [printers]
    comment = All Printers
    printable = yes
    path = /var/spool/samba
    browseable = no
    guest ok = yes
    public = yes
    read only = yes
    writable = no
    [my_printer_name]
    comment = Printer with Restricted Access
    path = /var/spool/samba_my_printer
    printer admin = kurt
    browseable = yes
    printable = yes
    writeable = no
    hosts allow = 0.0.0.0
    hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60
    guest ok = no

    This also is only an example configuration. You may not find all the settings in your own (as pre-configured by your OS @@ -368,31 +317,31 @@ default, because these have been compiled in. To see all settings, let root use the testparm utility. testparm also gives warnings if you have mis-configured certain things.. -

    Detailed Explanation of the Example's Settings

    +

    Detailed Explanation of the Example's Settings

    Following is a discussion of the settings from above shown example. -

    The [global] Section

    +

    The [global] Section

    The [global] section is one of 4 special sections (along with [[homes], [printers] and [print$]...) It contains all parameters which apply to the server as a whole. It is the place for parameters which -have only a "global" meaning (G). It may also contain service level -parameters (S) which then define default settings for all other +have only a "global" meaning. It may also contain service level +parameters which then define default settings for all other sections and shares. This way you can simplify the configuration and avoid setting the same value repeatedly. (Within each individual section or share you may however override these globally set "share level" settings and specify other values). -

    printing = bsd

    this causes Samba to use default print commands +

    printing = bsd

    this causes Samba to use default print commands applicable for the BSD (a.k.a. RFC 1179 style or LPR/LPD) printing system. In general, the "printing" parameter informs Samba about the print subsystem it should expect. Samba supports CUPS, LPD, LPRNG, SYSV, HPUX, AIX, QNX and PLP. Each of these systems defaults to a -different print command (and other queue control -commands).

    Caution

    The printing parameter is +different print command (and other queue control +commands).

    Caution

    The printing parameter is normally a service level parameter. Since it is included here in the [global] section, it will take effect for all -printer shares that are not defined differently. Samba-3.0 no longer -supports the SOFTQ printing system.

    load printers = yes

    this tells Samba to create automatically all +printer shares that are not defined differently. Samba 3 no longer +supports the SOFTQ printing system.

    load printers = yes

    this tells Samba to create automatically all available printer shares. "Available" printer shares are discovered by scanning the printcap file. All created printer shares are also loaded for browsing. If you use this parameter, you do not need to specify @@ -401,8 +350,7 @@ share will clone the configuration options found in the [printers] section. (A load printers = no setting will allow you to specify each UNIX printer you want to share separately, leaving out some you don't want to be -publicly visible and available).

    show add printer wizard = -yes

    this setting is normally +publicly visible and available).

    show add printer wizard = yes

    this setting is normally enabled by default (even if the parameter is not written into the ). It makes the Add Printer Wizard icon show up in the Printers folder of the Samba host's @@ -413,38 +361,38 @@ will not suffice!). The Add Printer Wizard lets you upload printer drivers to the [print$] share and associate it with a printer (if the respective queue exists there before the action), or exchange a printer's driver against any other previously -uploaded driver.

    total print jobs = 100

    this setting sets the upper limit to 100 print jobs +uploaded driver.

    total print jobs = 100

    this setting sets the upper limit to 100 print jobs being active on the Samba server at any one time. Should a client submit a job which exceeds this number, a “no more space available on server” type of error message will be returned by Samba to the client. A setting of "0" (the default) means there is no limit at all! -

    printcap name = /etc/printcap

    this tells Samba where to look for a list of +

    printcap name = /etc/printcap

    this tells Samba where to look for a list of available printer names. (If you use CUPS, make sure that a printcap file is written: this is controlled by the "Printcap" directive of cupsd.conf). -

    printer admin = @ntadmin

    members of the ntadmin group should be able to add +

    printer admin = @ntadmin

    members of the ntadmin group should be able to add drivers and set printer properties ("ntadmin" is only an example name, it needs to be a valid UNIX group name); root is implicitly always a -printer admin. The "@" sign precedes group names in +printer admin. The "@" sign precedes group names in . A printer admin can do anything to printers via the remote administration interfaces offered by MS-RPC -(see below). Note that the printer admin +(see below). Note that the printer admin parameter is normally a share level parameter, so you may associate different groups to different printer shares in larger installations, -if you use the printer admin parameter on the +if you use the printer admin parameter on the share levels). -

    lpq cache time = 20

    this controls the cache time for the results of the +

    lpq cache time = 20

    this controls the cache time for the results of the lpq command. It prevents the lpq command being called too often and reduces load on a heavily used print server. -

    use client driver = no

    if set to yes, this setting only +

    use client driver = no

    if set to yes, this setting only takes effect for Win NT/2k/XP clients (and not for Win 95/98/ME). Its default value is No (or False). It must not be enabled on print shares (with a yes or true setting) which have valid drivers installed on the Samba server! For more detailed explanations see the man page of smb.conf. -

    The [printers] Section

    +

    The [printers] Section

    This is the second special section. If a section with this name appears in the smb.conf, users are able to connect to any printer specified in the Samba host's printcap file, @@ -454,41 +402,40 @@ section as a general convenience shortcut to share all printers with minimal configuration. It is also a container for settings which should apply as default to all printers. (For more details see the smb.conf man page.) Settings inside this -container must be share level parameters (S). -

    comment = All printers

    the comment is shown next to +container must be share level parameters. +

    comment = All printers

    the comment is shown next to the share if a client queries the server, either via Network Neighbourhood or with the net view command to list available shares. -

    printable = yes

    please note well, that the +

    printable = yes

    please note well, that the [printers] service must be declared as printable. If you specify otherwise, smbd will refuse to load at startup. This parameter allows connected clients to open, write to and submit spool files into the -directory specified with the path parameter for +directory specified with the path parameter for this service. It is used by Samba to differentiate printer shares from -file shares.

    path = /var/spool/samba

    this must point to a directory used by Samba to spool +file shares.

    path = /var/spool/samba

    this must point to a directory used by Samba to spool incoming print files. It must not be the same as the spool directory specified in the configuration of your UNIX print subsystem! The path would typically point to a directory which is world writeable, with the "sticky" bit set to it. -

    browseable = no

    this is always set to no if -printable = yes. It makes the +

    browseable = no

    this is always set to no if +printable = yes. It makes the [printer] share itself invisible in the list of available shares in a net view command or in the Explorer browse list. (Note that you will of course see the individual printers). -

    guest ok = yes

    +

    guest ok = yes

    if set to yes, then no password is required to connect to the printers service. Access will be granted with the -privileges of the guest account. On many systems the +privileges of the guest account. On many systems the guest account will map to a user named "nobody". This user is in the UNIX passwd file with an empty password, but with no valid UNIX login. (Note: on some systems the guest account might not have the privilege to be able to print. Test this by logging in as your guest user using su - guest and run a system print command like -

    lpr -P printername /etc/motd

    public = yes

    this is a synonym for guest ok = -yes. Since we have guest ok = yes, +

    lpr -P printername /etc/motd

    public = yes

    this is a synonym for guest ok = yes. Since we have guest ok = yes, it really doesn't need to be here! (This leads to the interesting question: “What, if I by accident have to contradictory settings for the same share?” The answer is: the last one encountered by @@ -497,16 +444,16 @@ complain about different settings of the same parameter for the same share! You can test this by setting up multiple lines for the "guest account" parameter with different usernames, and then run testparm to see which one is actually used by Samba.) -

    read only = yes

    this normally (for other types of shares) prevents +

    read only = yes

    this normally (for other types of shares) prevents users creating or modifying files in the service's directory. However, in a "printable" service, it is always allowed to write to the directory (if user privileges allow the connection), but only via print spooling operations. "Normal" write operations are not -allowed.

    writeable = no

    -synonym for read only = yes -

    Any [my_printer_name] Section

    +allowed.

    writeable = no

    +synonym for read only = yes +

    Any [my_printer_name] Section

    If a section appears in the , which is -tagged as printable = yes, Samba presents it as +tagged as printable = yes, Samba presents it as a printer share to its clients. Note, that Win95/98/ME clients may have problems with connecting or loading printer drivers if the share name has more than 8 characters! Also be very careful if you give a @@ -515,37 +462,36 @@ client's connection request to a certain sharename, Samba always tries to find file shares with that name first; if it finds one, it will connect to this and will never ultimately connect to a printer with the same name! -

    comment = Printer with Restricted Access

    the comment says it all. -

    path = /var/spool/samba_my_printer

    here we set the spooling area for this printer to +

    comment = Printer with Restricted Access

    the comment says it all. +

    path = /var/spool/samba_my_printer

    here we set the spooling area for this printer to another directory than the default. It is not a requirement to set it differently, but the option is available. -

    printer admin = kurt

    the printer admin definition is different for this +

    printer admin = kurt

    the printer admin definition is different for this explicitly defined printer share from the general [printers] share. It is not a requirement; we did it to show that it is possible if you want it. -

    browseable = yes

    we also made this printer browseable (so that the +

    browseable = yes

    we also made this printer browseable (so that the clients may conveniently find it when browsing the Network Neighbourhood). -

    printable = yes

    see explanation in last subsection. -

    writeable = no

    see explanation in last subsection. -

    hosts allow = 10.160.50.,10.160.51.

    here we exercise a certain degree of access control -by using the hosts allow and hosts deny parameters. Note, that +

    printable = yes

    see explanation in last subsection. +

    writeable = no

    see explanation in last subsection. +

    hosts allow = 10.160.50.,10.160.51.

    here we exercise a certain degree of access control +by using the hosts allow and hosts deny parameters. Note, that this is not by any means a safe bet. It is not a way to secure your printers. This line accepts all clients from a certain subnet in a first evaluation of access control -

    hosts deny = turbo_xp,10.160.50.23,10.160.51.60 -

    all listed hosts are not allowed here (even if they +

    hosts deny = turbo_xp,10.160.50.23,10.160.51.60

    all listed hosts are not allowed here (even if they belong to the "allowed subnets"). As you can see, you could name IP addresses as well as NetBIOS hostnames here. -

    guest ok = no

    this printer is not open for the guest account! -

    Print Commands

    +

    guest ok = no

    this printer is not open for the guest account! +

    Print Commands

    In each section defining a printer (or in the [printers] section), a print command parameter may be defined. It sets a command to process the files which have been placed into the Samba print spool directory for that printer. (That spool directory was, if you -remember, set up with the path +remember, set up with the path parameter). Typically, this command will submit the spool file to the Samba host's print subsystem, using the suitable system print command. But there is no requirement that this needs to be the @@ -557,24 +503,24 @@ your own print commands (or even develop print command shell scripts), make sure you pay attention to the need to remove the files from the Samba spool directory. Otherwise your hard disk may soon suffer from shortage of free space. -

    Default Print Commands for various Unix Print Subsystems

    +

    Default Print Commands for various UNIX Print Subsystems

    You learned earlier on, that Samba in most cases uses its built-in settings for many parameters if it can not find an explicitly stated one in its configuration file. The same is true for the -print command. The default print command varies -depending on the printing =... parameter +print command. The default print command varies +depending on the printing parameter setting. In the commands listed below, you will notice some parameters of the form %X where X is p, s, J etc. These letters stand for "printername", "spoolfile" and "job ID" respectively. They are explained in more detail further below. Here is an overview (excluding the special case of CUPS, which is discussed in the next chapter): -

    If this setting is active......this is used in lieu of an explicit command:
    printing = bsd|aix|lprng|plpprint command is lpr -r -P%p %s
    printing = sysv|hpuxprint command is lp -c -P%p %s; rm %s
    printing = qnxprint command is lp -r -P%p -s %s
    printing = bsd|aix|lprng|plplpq command is lpq -P%p
    printing = sysv|hpuxlpq command is lpstat -o%p
    printing = qnxlpq command is lpq -P%p
    printing = bsd|aix|lprng|plplprm command is lprm -P%p %j
    printing = sysv|hpuxlprm command is cancel %p-%j
    printing = qnxlprm command is cancel %p-%j
    printing = bsd|aix|lprng|plplppause command is lp -i %p-%j -H hold
    printing = sysv|hpuxlppause command (...is empty)
    printing = qnxlppause command (...is empty)
    printing = bsd|aix|lprng|plplpresume command is lp -i %p-%j -H resume
    printing = sysv|hpuxlpresume command (...is empty)
    printing = qnxlpresume command (...is empty)

    +

    If this setting is active......this is used in lieu of an explicit command:
    printing = bsd|aix|lprng|plpprint command is lpr -r -P%p %s
    printing = sysv|hpuxprint command is lp -c -P%p %s; rm %s
    printing = qnxprint command is lp -r -P%p -s %s
    printing = bsd|aix|lprng|plplpq command is lpq -P%p
    printing = sysv|hpuxlpq command is lpstat -o%p
    printing = qnxlpq command is lpq -P%p
    printing = bsd|aix|lprng|plplprm command is lprm -P%p %j
    printing = sysv|hpuxlprm command is cancel %p-%j
    printing = qnxlprm command is cancel %p-%j
    printing = bsd|aix|lprng|plplppause command is lp -i %p-%j -H hold
    printing = sysv|hpuxlppause command (...is empty)
    printing = qnxlppause command (...is empty)
    printing = bsd|aix|lprng|plplpresume command is lp -i %p-%j -H resume
    printing = sysv|hpuxlpresume command (...is empty)
    printing = qnxlpresume command (...is empty)

    We excluded the special CUPS case here, because it is discussed in the next chapter. Just a short summary. For printing = CUPS: If SAMBA is compiled against libcups, it uses the CUPS API to submit jobs, etc. (It is a good idea also to set -printcap = cups in case your +printcap = cups in case your cupsd.conf is set to write its autogenerated printcap file to an unusual place). Otherwise Samba maps to the System V printing commands with the -oraw option for printing, i.e. it uses @@ -597,9 +543,9 @@ check which command takes effect. Then check that this command is adequate and actually works for your installed print subsystem. It is always a good idea to explicitly set up your configuration files the way you want them to work and not rely on any built-in defaults. -

    Setting up your own Print Commands

    +

    Setting up your own Print Commands

    After a print job has finished spooling to a service, the -print command will be used by Samba via a +print command will be used by Samba via a system() call to process the spool file. Usually the command specified will submit the spool file to the host's printing subsystem. But there is no requirement at all that this must @@ -652,22 +598,16 @@ expand the included environment variables as usual. (The syntax to include a UNIX environment variable $variable in or in the Samba print command is %$variable.) To give you a working -print command example, the following will log a +print command example, the following will log a print job to /tmp/print.log, print the file, then remove it. Note that ';' is the usual separator for commands in shell scripts: -

    -
- print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s
-
-

    +

    print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s

    You may have to vary your own command considerably from this example depending on how you normally print files on your system. The default -for the print command parameter varies depending on the setting of -the printing parameter. Another example is: -

    - print command = /usr/local/samba/bin/myprintscript %p %s
-

    Innovations in Samba Printing since 2.2

    +for the print command parameter varies depending on the setting of +the printing parameter. Another example is: +

    print command = /usr/local/samba/bin/myprintscript %p %s

    Innovations in Samba Printing since 2.2

    Before version 2.2.0, Samba's print server support for Windows clients was limited to the level of LanMan printing calls. This is the same protocol level as Windows 9x PCs offer when @@ -682,16 +622,14 @@ The additional functionality provided by the new SPOOLSS support includes: 95/98/NT/2000 clients upon demand (Point'n'Print);

  • Uploading of printer drivers via the Windows NT Add Printer Wizard (APW) or the -Imprints tool set (refer to http://imprints.sourceforge.net); +Imprints tool set.

  • Support for the native MS-RPC printing calls such as -StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation -at http://msdn.microsoft.com/ -for more information on the Win32 printing API);

  • Support for NT Access Control + StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation for more information on the Win32 printing API);

  • Support for NT Access Control Lists (ACL) on printer objects;

  • Improved support for printer queue manipulation through the use of internal databases for spooled job information (implemented by various *.tdb files).

    • -One other benefit of an update is this: Samba-3 is able to publish +One other benefit of an update is this: Samba 3 is able to publish all its printers in Active Directory (or LDAP)!

    One slight difference is here: it is possible on a Windows NT print @@ -708,7 +646,7 @@ default permissions assigned by Windows NT to a printer gives the "Print" permissions to the well-known Everyone group. (The older clients of type Win9x can only print to "shared" printers). -

    Client Drivers on Samba Server for Point'n'Print

    +

    Client Drivers on Samba Server for Point'n'Print

    There is still confusion about what all this means: Is it or is it not a requirement for printer drivers to be installed on a Samba host in order to support printing from Windows clients? The @@ -743,10 +681,10 @@ does not use these uploaded drivers in any way to process spooled files. Drivers are utilized entirely by the clients, who download and install them via the "Point'n'Print" mechanism supported by Samba. The clients use these drivers to generate print files in the -format the printer (or the Unix print system) requires. Print files -received by Samba are handed over to the Unix printing system, which +format the printer (or the UNIX print system) requires. Print files +received by Samba are handed over to the UNIX printing system, which is responsible for all further processing, if needed. -

    The [printer$] Section is removed from Samba-3

    +

    The [printer$] Section is removed from Samba 3

    [print$] vs. [printer$] .  Versions of Samba prior to 2.2 made it possible to use a share @@ -762,7 +700,7 @@ files associated with that printer. Another parameter named printer driver provided a means of defining the printer driver name to be sent to the client. These parameters, including the printer driver file parameter, -are now removed and can not be used in installations of Samba-3.0. +are now removed and can not be used in installations of samba-3. Now the share name [print$] is used for the location of downloadable printer drivers. It is taken from the [print$] service created by Windows NT PCs when @@ -772,7 +710,7 @@ access (in the context of its ACLs) in order to support printer driver down- and uploads. Don't fear -- this does not mean Windows 9x clients are thrown aside now. They can use Samba's [print$] share support just fine. -

    Creating the [print$] Share

    +

    Creating the [print$] Share

    In order to support the up- and downloading of printer driver files, you must first configure a file share named [print$]. The "public" name of this share is @@ -786,42 +724,25 @@ add the global parameters and create the [print$] file share (of course, some of the parameter values, such as 'path' are arbitrary and should be replaced with appropriate values for your site): -

    - [global]
-      ; members of the ntadmin group should be able to add drivers and set
-      ; printer properties. root is implicitly always a 'printer admin'.
-      printer admin = @ntadmin
-      [....]
-
- [printers]
-      [....]
-
- [print$]
-      comment = Printer Driver Download Area
-      path = /etc/samba/drivers
-      browseable = yes
-      guest ok = yes
-      read only = yes
-      write list = @ntadmin, root
-

    +

    Example 18.3. [print\$] example

    [global]
    # members of the ntadmin group should be able to add drivers and set
    # printer properties. root is implicitly always a 'printer admin'.
    printer admin = @ntadmin
    ...
    [printers]
    ...
    [print$]
    comment = Printer Driver Download Area
    path = /etc/samba/drivers
    browseable = yes
    guest ok = yes
    read only = yes
    write list = @ntadmin, root

    Of course, you also need to ensure that the directory named by the -path parameter exists on the Unix file system. -

    Parameters in the [print$] Section

    +path parameter exists on the UNIX file system. +

    Parameters in the [print$] Section

    [print$] is a special section in . It contains settings relevant to potential printer driver download and local installation by clients. -

    comment = Printer Driver -Download Area

    the comment appears next to the share name if it is +

    comment = Printer Driver + Download Area

    the comment appears next to the share name if it is listed in a share list (usually Windows clients won't see it often but it will also appear up in a smbclient -L sambaserver - output).

    path = /etc/samba/printers

    this is the path to the location of the Windows + output).

    path = /etc/samba/printers

    this is the path to the location of the Windows driver file deposit from the UNIX point of -view.

    browseable = no

    this makes the [print$] share +view.

    browseable = no

    this makes the [print$] share "invisible" in Network Neighbourhood to clients. However, you can still "mount" it from any client using the net use g:\\sambaserver\print$ command in a "DOS box" or the "Connect network drive" menu from Windows -Explorer.

    guest ok = yes

    this gives read only access to this share for all +Explorer.

    guest ok = yes

    this gives read only access to this share for all guest users. Access may be used to download and install printer drivers on clients. The requirement for guest ok = yes depends upon how your site is configured. If users @@ -834,13 +755,13 @@ validated by the Domain Controller in order to logon to the Windows NT session), then guest access is not necessary. Of course, in a workgroup environment where you just want to be able to print without worrying about silly accounts and security, then configure the share -for guest access. You'll probably want to add map to guest -= Bad User in the [global] section +for guest access. You'll probably want to add map to guest = Bad User in the +[global] section as well. Make sure you understand what this parameter does before using it. -

    read only = yes

    as we don't want everybody to upload driver files (or +

    read only = yes

    as we don't want everybody to upload driver files (or even change driver settings) we tagged this share as not -writeable.

    write list = @ntadmin,root

    since the [print$] was made +writeable.

    write list = @ntadmin,root

    since the [print$] was made read only by the previous setting, we need to create a "write list" also. UNIX groups (denoted with a leading "@" character) and users listed here are allowed write access (as an exception to the general @@ -849,13 +770,13 @@ share. Normally you will want to only name administrative level user accounts in this setting. Check the file system permissions to make sure these accounts can copy files to the share. If this is a non-root account, then the account should also be mentioned in the global -printer admin parameter. See the +printer admin parameter. See the man page for more information on -configuring file shares.

    Subdirectory Structure in [print$]

    +configuring file shares.

    Subdirectory Structure in [print$]

    In order for a Windows NT print server to support the downloading of driver files by multiple client architectures, you must create several subdirectories within the [print$] service -(i.e. the Unix directory named by the path +(i.e. the UNIX directory named by the path parameter). These correspond to each of the supported client architectures. Samba follows this model as well. Just like the name of the [print$] share itself, the subdirectories @@ -890,7 +811,7 @@ client workstation. Open Network Neighbourhood or Once you have located the server, navigate to its Printers and Faxes folder. You should see an initial listing of printers that matches the printer shares defined on your Samba host. -

    Installing Drivers into [print$]

    +

    Installing Drivers into [print$]

    You have successfully created the [print$] share in ? And Samba has re-read its configuration? Good. But you are not yet ready to take off. The @@ -908,11 +829,11 @@ Properties and Add Printer Wizard

    The latter option is probably the easier one (even if the only entrance to this realm seems a little bit weird at first). -

    Setting Drivers for existing Printers with a Client GUI

    +

    Setting Drivers for existing Printers with a Client GUI

    The initial listing of printers in the Samba host's Printers folder accessed from a client's Explorer -will have no real printer driver assigned to them. By default, in -Samba-3 (as in 2.2.1 and later) this driver name is set to a NULL +will have no real printer driver assigned to them. By default +this driver name is set to a NULL string. This must be changed now. The local Add Printer Wizard, run from NT/2000/XP clients, will help us in this task. @@ -943,18 +864,18 @@ Once the APW is started, the procedure is exactly the same as the one you are familiar with in Windows (we assume here that you are familiar with the printer driver installations procedure on Windows NT). Make sure your connection is in fact setup as a user with -printer admin privileges (if in doubt, use +printer admin privileges (if in doubt, use smbstatus to check for this). If you wish to install printer drivers for client operating systems other than Windows NT x86, you will need to use the Sharing tab of the printer properties dialog.

    Assuming you have connected with an administrative (or root) account -(as named by the printer admin parameter), +(as named by the printer admin parameter), you will also be able to modify other printer properties such as ACLs and default device settings using this dialog. For the default device settings, please consider the advice given further below. -

    Setting Drivers for existing Printers with +

    Setting Drivers for existing Printers with rpcclient

    The second way to install printer drivers into [print$] and set them up in a valid way can be @@ -969,7 +890,7 @@ time with the setdriver subcommand.

    We will provide detailed hints for each of these steps in the next few paragraphs. -

    Identifying the Driver Files

    +

    Identifying the Driver Files

    To find out about the driver files, you have two options: you could investigate the driver CD which comes with your printer. Study the *.inf file on the CD, if it is contained. This @@ -1017,35 +938,35 @@ create scripts to automate the procedure for a large number of printers and drivers. Note the different quotes used to overcome the different spaces in between words: 

    -root# rpcclient -U'Danka%xxxx' -c 'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP
-  cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3
+root# rpcclient -U'Danka%xxxx' -c \
+	'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP
+cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3
 
-  [Windows NT x86]
-  Printer Driver Info 3:
-          Version: [2]
-          Driver Name: [Heidelberg Digimaster 9110 (PS)]
-          Architecture: [Windows NT x86]
-          Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.DLL]
-          Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.ppd]
-          Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.DLL]
-          Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.HLP]
+[Windows NT x86]
+Printer Driver Info 3:
+  Version: [2]
+  Driver Name: [Heidelberg Digimaster 9110 (PS)]
+  Architecture: [Windows NT x86]
+  Driver Path: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.DLL]
+  Datafile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.ppd]
+  Configfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.DLL]
+  Helpfile: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01U_de.HLP]
   
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.DLL]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.INI]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1KMMin.DLL]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.dat]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.cat]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.def]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hre]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.vnd]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hlp]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de_reg.HLP]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01Aux.dll]
-          Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.NTF]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.DLL]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.INI]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1KMMin.DLL]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.dat]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.cat]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.def]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hre]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.vnd]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hlp]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de_reg.HLP]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01Aux.dll]
+  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.NTF]
   
-          Monitorname: []
-          Defaultdatatype: []
-
+  Monitorname: []
+  Defaultdatatype: []

    You may notice, that this driver has quite a big number of Dependentfiles (I know worse cases however). Also, @@ -1072,7 +993,7 @@ Windows 2000 changed this. While it still can use the Kernel Mode drivers (if this is enabled by the Admin), its native mode for printer drivers is User Mode execution. This requires drivers designed for this. These type of drivers install into the "3" subdirectory. -

    Collecting the Driver Files from a Windows Host's +

    Collecting the Driver Files from a Windows Host's [print$] Share

    Now we need to collect all the driver files we identified. in our previous step. Where do we get them from? Well, why not retrieve them @@ -1085,15 +1006,15 @@ listing is edited to include linebreaks for readability: root# smbclient //TURBO_XP/print\$ -U'Danka%xxxx' \ -c 'cd W32X86/2;mget HD*_de.* \ hd*ppd Hd*_de.* Hddm*dll HDN*Aux.DLL' - added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 - Got a positive name query response from 10.160.50.8 ( 10.160.50.8 ) - Domain=[DEVELOPMENT] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager] - Get file Hddm91c1_de.ABD? n - Get file Hddm91c1_de.def? y - getting file \W32X86\2\Hddm91c1_de.def of size 428 as Hddm91c1_de.def (22.0 kb/s) (average 22.0 kb/s) - Get file Hddm91c1_de.DLL? y - getting file \W32X86\2\Hddm91c1_de.DLL of size 876544 as Hddm91c1_de.DLL (737.3 kb/s) (average 737.3 kb/s) - [...] +added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 +Got a positive name query response from 10.160.50.8 ( 10.160.50.8 ) +Domain=[DEVELOPMENT] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager] +Get file Hddm91c1_de.ABD? n +Get file Hddm91c1_de.def? y +getting file \W32X86\2\Hddm91c1_de.def of size 428 as Hddm91c1_de.def +Get file Hddm91c1_de.DLL? y +getting file \W32X86\2\Hddm91c1_de.DLL of size 876544 as Hddm91c1_de.DLL +[...]

    After this command is complete, the files are in our current local @@ -1108,7 +1029,7 @@ files for these architectures are in the WIN40/0/ subdir. Once we are complete, we can run smbclient ... put to store the collected files on the Samba server's [print$] share. -

    Depositing the Driver Files into [print$]

    +

    Depositing the Driver Files into [print$]

    So, now we are going to put the driver files into the [print$] share. Remember, the UNIX path to this share has been defined previously in your @@ -1129,7 +1050,8 @@ running getdriver against the original store the files into a Samba/UNIX print server's [print$] share... 

    -root# smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c 'cd W32X86; put HDNIS01_de.DLL; \
+		root# smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c \
+ 'cd W32X86; put HDNIS01_de.DLL; \
   put Hddm91c1_de.ppd; put HDNIS01U_de.DLL;        \
   put HDNIS01U_de.HLP; put Hddm91c1_de.DLL;        \
   put Hddm91c1_de.INI; put Hddm91c1KMMin.DLL;      \
@@ -1138,26 +1060,25 @@ store the files into a Samba/UNIX print s
   put Hddm91c1_de.vnd; put Hddm91c1_de.hlp;        \
   put Hddm91c1_de_reg.HLP; put HDNIS01Aux.dll;     \
   put HDNIS01_de.NTF'
- added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
- Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
- Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
- putting file HDNIS01_de.DLL as \W32X86\HDNIS01_de.DLL (4465.5 kb/s) (average 4465.5 kb/s)
- putting file Hddm91c1_de.ppd as \W32X86\Hddm91c1_de.ppd (12876.8 kb/s) (average 4638.9 kb/s)
- putting file HDNIS01U_de.DLL as \W32X86\HDNIS01U_de.DLL (20249.8 kb/s) (average 5828.3 kb/s)
- putting file HDNIS01U_de.HLP as \W32X86\HDNIS01U_de.HLP (9652.8 kb/s) (average 5899.8 kb/s)
- putting file Hddm91c1_de.DLL as \W32X86\Hddm91c1_de.DLL (23777.7 kb/s) (average 10400.6 kb/s)
- putting file Hddm91c1_de.INI as \W32X86\Hddm91c1_de.INI (98.6 kb/s) (average 10329.0 kb/s)
- putting file Hddm91c1KMMin.DLL as \W32X86\Hddm91c1KMMin.DLL (22931.5 kb/s) (average 10501.7 kb/s)
- putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (2462.8 kb/s) (average 10393.0 kb/s)
- putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat (4925.3 kb/s) (average 10356.3 kb/s)
- putting file Hddm91c1_de.def as \W32X86\Hddm91c1_de.def (417.9 kb/s) (average 10290.1 kb/s)
- putting file Hddm91c1_de.hre as \W32X86\Hddm91c1_de.hre (22571.3 kb/s) (average 11338.5 kb/s)
- putting file Hddm91c1_de.vnd as \W32X86\Hddm91c1_de.vnd (3384.6 kb/s) (average 10754.3 kb/s)
- putting file Hddm91c1_de.hlp as \W32X86\Hddm91c1_de.hlp (18406.8 kb/s) (average 10839.8 kb/s)
- putting file Hddm91c1_de_reg.HLP as \W32X86\Hddm91c1_de_reg.HLP (20278.3 kb/s) (average 11386.3 kb/s)
- putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll (14994.6 kb/s) (average 11405.2 kb/s)
- putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF (23390.2 kb/s) (average 13170.8 kb/s)
-
+added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
+Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
+Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
+putting file HDNIS01_de.DLL as \W32X86\HDNIS01_de.DLL
+putting file Hddm91c1_de.ppd as \W32X86\Hddm91c1_de.ppd
+putting file HDNIS01U_de.DLL as \W32X86\HDNIS01U_de.DLL
+putting file HDNIS01U_de.HLP as \W32X86\HDNIS01U_de.HLP
+putting file Hddm91c1_de.DLL as \W32X86\Hddm91c1_de.DLL
+putting file Hddm91c1_de.INI as \W32X86\Hddm91c1_de.INI
+putting file Hddm91c1KMMin.DLL as \W32X86\Hddm91c1KMMin.DLL
+putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat
+putting file Hddm91c1_de.dat as \W32X86\Hddm91c1_de.dat
+putting file Hddm91c1_de.def as \W32X86\Hddm91c1_de.def
+putting file Hddm91c1_de.hre as \W32X86\Hddm91c1_de.hre
+putting file Hddm91c1_de.vnd as \W32X86\Hddm91c1_de.vnd
+putting file Hddm91c1_de.hlp as \W32X86\Hddm91c1_de.hlp
+putting file Hddm91c1_de_reg.HLP as \W32X86\Hddm91c1_de_reg.HLP
+putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll
+putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF

    Phewww -- that was a lot of typing! Most drivers are a lot smaller -- many only having 3 generic PostScript driver files plus 1 PPD. Note, @@ -1169,47 +1090,47 @@ re-location will automatically be done by the don't forget to also put the files for the Win95/98/ME architecture into the WIN40/ subdirectory should you need them). -

    Check if the Driver Files are there (with smbclient)

    +

    Check if the Driver Files are there (with smbclient)

    For now we verify that our files are there. This can be done with smbclient too (but of course you can log in via SSH also and do this through a standard UNIX shell access too): 

    -root# smbclient //SAMBA-CUPS/print\$ -U 'root%xxxx' -c 'cd W32X86; pwd; dir; cd 2; pwd; dir'
+root# smbclient //SAMBA-CUPS/print\$ -U 'root%xxxx' \
+	-c 'cd W32X86; pwd; dir; cd 2; pwd; dir'
  added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
- Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
- Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
+Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
 
-  Current directory is \\SAMBA-CUPS\print$\W32X86\
-  .                                   D        0  Sun May  4 03:56:35 2003
-  ..                                  D        0  Thu Apr 10 23:47:40 2003
-  2                                   D        0  Sun May  4 03:56:18 2003
-  HDNIS01Aux.dll                      A    15356  Sun May  4 03:58:59 2003
-  Hddm91c1KMMin.DLL                   A    46966  Sun May  4 03:58:59 2003
-  HDNIS01_de.DLL                      A   434400  Sun May  4 03:58:59 2003
-  HDNIS01_de.NTF                      A   790404  Sun May  4 03:56:35 2003
-  Hddm91c1_de.DLL                     A   876544  Sun May  4 03:58:59 2003
-  Hddm91c1_de.INI                     A      101  Sun May  4 03:58:59 2003
-  Hddm91c1_de.dat                     A     5044  Sun May  4 03:58:59 2003
-  Hddm91c1_de.def                     A      428  Sun May  4 03:58:59 2003
-  Hddm91c1_de.hlp                     A    37699  Sun May  4 03:58:59 2003
-  Hddm91c1_de.hre                     A   323584  Sun May  4 03:58:59 2003
-  Hddm91c1_de.ppd                     A    26373  Sun May  4 03:58:59 2003
-  Hddm91c1_de.vnd                     A    45056  Sun May  4 03:58:59 2003
-  HDNIS01U_de.DLL                     A   165888  Sun May  4 03:58:59 2003
-  HDNIS01U_de.HLP                     A    19770  Sun May  4 03:58:59 2003
-  Hddm91c1_de_reg.HLP                 A   228417  Sun May  4 03:58:59 2003
-                40976 blocks of size 262144. 709 blocks available
-
-  Current directory is \\SAMBA-CUPS\print$\W32X86\2\
-  .                                   D        0  Sun May  4 03:56:18 2003
-  ..                                  D        0  Sun May  4 03:56:35 2003
-  ADOBEPS5.DLL                        A   434400  Sat May  3 23:18:45 2003
-  laserjet4.ppd                       A     9639  Thu Apr 24 01:05:32 2003
-  ADOBEPSU.DLL                        A   109568  Sat May  3 23:18:45 2003
-  ADOBEPSU.HLP                        A    18082  Sat May  3 23:18:45 2003
-  PDFcreator2.PPD                     A    15746  Sun Apr 20 22:24:07 2003
-                40976 blocks of size 262144. 709 blocks available
+Current directory is \\SAMBA-CUPS\print$\W32X86\
+.                                   D        0  Sun May  4 03:56:35 2003
+..                                  D        0  Thu Apr 10 23:47:40 2003
+2                                   D        0  Sun May  4 03:56:18 2003
+HDNIS01Aux.dll                      A    15356  Sun May  4 03:58:59 2003
+Hddm91c1KMMin.DLL                   A    46966  Sun May  4 03:58:59 2003
+HDNIS01_de.DLL                      A   434400  Sun May  4 03:58:59 2003
+HDNIS01_de.NTF                      A   790404  Sun May  4 03:56:35 2003
+Hddm91c1_de.DLL                     A   876544  Sun May  4 03:58:59 2003
+Hddm91c1_de.INI                     A      101  Sun May  4 03:58:59 2003
+Hddm91c1_de.dat                     A     5044  Sun May  4 03:58:59 2003
+Hddm91c1_de.def                     A      428  Sun May  4 03:58:59 2003
+Hddm91c1_de.hlp                     A    37699  Sun May  4 03:58:59 2003
+Hddm91c1_de.hre                     A   323584  Sun May  4 03:58:59 2003
+Hddm91c1_de.ppd                     A    26373  Sun May  4 03:58:59 2003
+Hddm91c1_de.vnd                     A    45056  Sun May  4 03:58:59 2003
+HDNIS01U_de.DLL                     A   165888  Sun May  4 03:58:59 2003
+HDNIS01U_de.HLP                     A    19770  Sun May  4 03:58:59 2003
+Hddm91c1_de_reg.HLP                 A   228417  Sun May  4 03:58:59 2003
+              40976 blocks of size 262144. 709 blocks available
 
+Current directory is \\SAMBA-CUPS\print$\W32X86\2\
+.                                   D        0  Sun May  4 03:56:18 2003
+..                                  D        0  Sun May  4 03:56:35 2003
+ADOBEPS5.DLL                        A   434400  Sat May  3 23:18:45 2003
+laserjet4.ppd                       A     9639  Thu Apr 24 01:05:32 2003
+ADOBEPSU.DLL                        A   109568  Sat May  3 23:18:45 2003
+ADOBEPSU.HLP                        A    18082  Sat May  3 23:18:45 2003
+PDFcreator2.PPD                     A    15746  Sun Apr 20 22:24:07 2003
+              40976 blocks of size 262144. 709 blocks available

    Notice that there are already driver files present in the 2 subdir (probably from a previous @@ -1222,7 +1143,7 @@ Point'n'Print. The reason is: Samba doesn't know yet that these files are something special, namely printer driver files and it doesn't know yet to which print queue(s) these driver files belong. -

    Running rpcclient with +

    Running rpcclient with adddriver

    So, next you must tell Samba about the special category of the files you just uploaded into the [print$] share. This @@ -1231,21 +1152,23 @@ prompt Samba to register the driver files into its internal TDB database files. The following command and its output has been edited, again, for readability: 

    -root# rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL: \
-  Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
-  NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
-  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
-  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
-  HDNIS01Aux.dll,HDNIS01_de.NTF,                     \
-  Hddm91c1_de_reg.HLP' SAMBA-CUPS
+		root# rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" \
+"dm9110:HDNIS01_de.DLL: \
+Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
+ NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
+ Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
+ Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+ HDNIS01Aux.dll,HDNIS01_de.NTF,                     \
+ Hddm91c1_de_reg.HLP' SAMBA-CUPS
 
- cmd = adddriver "Windows NT x86" "dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:    \
-  HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
-  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,          \
-  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,        \
-  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
+cmd = adddriver "Windows NT x86" \
+"dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:    \
+ HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
+ Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,          \
+ Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,        \
+ HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
 
- Printer Driver dm9110 successfully installed.
+Printer Driver dm9110 successfully installed.

    After this step the driver should be recognized by Samba on the print @@ -1257,7 +1180,7 @@ files successfully, but render the driver unworkable. So take care! Hints about the syntax of the adddriver command are in the man page. The CUPS printing chapter of this HOWTO collection provides a more detailed description, if you should need it. -

    Check how Driver Files have been moved after +

    Check how Driver Files have been moved after adddriver finished

    One indication for Samba's recognition of the files as driver files is the successfully installed message. @@ -1266,9 +1189,9 @@ Another one is the fact, that our files have been moved by the subdirectory. You can check this again with smbclient: 

    -root# smbclient //SAMBA-CUPS/print\$ -Uroot%xxxx -c 'cd W32X86;dir;pwd;cd 2;dir;pwd'
+root# smbclient //SAMBA-CUPS/print\$ -Uroot%xx -c 'cd W32X86;dir;pwd;cd 2;dir;pwd'
  added interface ip=10.160.51.162 bcast=10.160.51.255 nmask=255.255.252.0
- Domain=[CUPS-PRINT] OS=[Unix] Server=[Samba 2.2.7a]
+ Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
 
   Current directory is \\SAMBA-CUPS\print$\W32X86\
   .                                   D        0  Sun May  4 04:32:48 2003
@@ -1305,7 +1228,7 @@ subdirectory. You can check this again with

    Another verification is that the timestamp of the printing TDB files is now updated (and possibly their filesize has increased). -

    Check if the Driver is recognized by Samba

    +

    Check if the Driver is recognized by Samba

    Now the driver should be registered with Samba. We can easily verify this, and will do so in a moment. However, this driver is not yet associated with a particular @@ -1349,19 +1272,19 @@ time. Our new driver only shows up for Windows NT 4.0 or 2000. To have it present for Windows 95, 98 and ME you'll have to repeat the whole procedure with the WIN40 architecture and subdirectory. -

    A side note: you are not bound to specific driver names

    +

    A side note: you are not bound to specific driver names

    You can name the driver as you like. If you repeat the adddriver step, with the same files as before, but with a different driver name, it will work the same: 

     root# rpcclient -Uroot%xxxx                                        \
-      -c 'adddriver "Windows NT x86"                     \
-      "myphantasydrivername:HDNIS01_de.DLL:              \
-      Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
-      NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
-      Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
-      Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
-      HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP' SAMBA-CUPS
+  -c 'adddriver "Windows NT x86"                     \
+  "myphantasydrivername:HDNIS01_de.DLL:              \
+  Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
+  NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
+  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
+  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP' SAMBA-CUPS
   
 
  cmd = adddriver "Windows NT x86" 
@@ -1383,7 +1306,7 @@ repeatedly. Each run "consumes" the files you had put into the
 respective subdirectories. So you must precede an
 smbclient ... put command before each
 rpcclient ...  adddriver" command.
-

    La Grande Finale: Running rpcclient with +

    Running rpcclient with setdriver

    Samba still needs to know which printer's driver this is. It needs to create a mapping of the driver to a printer, and @@ -1413,20 +1336,19 @@ known to Samba already. A bug in 2.2.x prevented Samba from recognizing freshly installed printers. You had to restart Samba, or at least send a HUP signal to all running smbd processes to work around this: -kill -HUP `pidof smbd`.

    "The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure)

    +kill -HUP `pidof smbd`.

    Client Driver Install Procedure

    A famous philosopher said once: “The Proof of the Pudding lies in the Eating”. The proof for our setup lies in the printing. So let's install the printer driver onto the client PCs. This is not as straightforward as it may seem. Read on. -

    The first Client Driver Installation

    +

    The first Client Driver Installation

    Especially important is the installation onto the first client PC (for each architectural platform separately). Once this is done correctly, all further clients are easy to setup and shouldn't need further attention. What follows is a description for the recommended first procedure. You work now from a client workstation. First you should guarantee that your connection is not unwittingly mapped to -bad user "nobody". In a DOS box type: +bad user "nobody". In a DOS box type:

    net use \\SAMBA-SERVER\print$ /user:root

    Replace root, if needed, by another valid printer admin user as given in the definition. @@ -1462,7 +1384,7 @@ Data" set is still incomplete.

    You must now make sure that a valid "Device Mode" is set for the driver. Don't fear -- we will explain now what that means. -

    IMPORTANT! Setting Device Modes on new Printers

    +

    IMPORTANT! Setting Device Modes on new Printers

    In order for a printer to be truly usable by a Windows NT/2K/XP client, it must possess:

    • a valid Device Mode generated by @@ -1489,7 +1411,7 @@ This can be achieved by accessing the drivers remotely from an NT (or 2k/XP) client, as is discussed in the next paragraphs.

      Be aware, that a valid Device Mode can only be initiated by a -printer admin, or root (the reason should be +printer admin, or root (the reason should be obvious). Device Modes can only correctly be set by executing the printer driver program itself. Since Samba can not execute this Win32 platform driver code, it sets this field initially to NULL (which is @@ -1534,7 +1456,7 @@ properties. Others may crash the client's spooler service. So use this parameter with caution. It is always better to have the client generate a valid device mode for the printer and store it on the server for you. -

    Further Client Driver Install Procedures

    +

    Further Client Driver Install Procedures

    Every further driver may be done by any user, along the lines described above: Browse network, open printers folder on Samba server, right-click printer and choose Connect.... Once @@ -1554,12 +1476,12 @@ rundll32 shell32.dll,Control_RunDLL MAIN.CPL @2 You can enter the commands either inside a DOS box window or in the Run command... field from the Start menu. -

    Always make first Client Connection as root or "printer admin"

    +

    Always make first Client Connection as root or "printer admin"

    After you installed the driver on the Samba server (in its [print$] share, you should always make sure that your first client installation completes correctly. Make it a habit for yourself to build that the very first connection from a client as -printer admin. This is to make sure that: +printer admin. This is to make sure that:

    • a first valid Device Mode is really initialized (see above for more explanation details), and that

    • the default print settings of your printer for all @@ -1573,20 +1495,23 @@ set to Letter, when you are all using

      To connect as root to a Samba printer, try this command from a Windows 2K/XP DOS box command prompt: -

      runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n \\SAMBA-SERVER\printername" +

      +C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n 
+	\\SAMBA-SERVER\printername"
+

      You will be prompted for root's Samba-password; type it, wait a few seconds, click on Printing Defaults... and proceed to set the job options as should be used as defaults by all clients. Alternatively, instead of root you can name one other member -of the printer admins from the setting. +of the printer admin from the setting.

      Now all the other users downloading and installing the driver the same way (called Point'n'Print) will have the same defaults set for them. If you miss this step you'll get a lot of helpdesk calls from your users. But maybe you like to talk to people.... ;-) -

    Other Gotchas

    +

    Other Gotchas

    Your driver is installed. It is ready for Point'n'Print installation by the clients now. You may have tried to download and use it @@ -1596,7 +1521,7 @@ example, suppose you didn't manage to "set the defaults" on the printer, as advised in the preceding paragraphs? And your users complain about various issues (such as “We need to set the paper size for each job from Letter to A4 and it won't store it!”) -

    Setting Default Print Options for the Client Drivers

    +

    Setting Default Print Options for the Client Drivers

    The last sentence might be viewed with mixed feelings by some users and admins. They have struggled for hours and hours and couldn't arrive at a point were their settings seemed to be saved. It is not their @@ -1651,7 +1576,7 @@ either. However, only the last one, which you arrived at with steps C.1.-6. will permanently save any settings which will then become the defaults for new users. If you want all clients to have the same defaults, you need to conduct these steps as administrator -(printer admin in ) +(printer admin in ) before a client downloads the driver (the clients can later set their own per-user defaults by following the procedures A. @@ -1685,7 +1610,7 @@ to see the tab with the Printing Preferences... button (the one which doesn't set system-wide defaults). You can start the commands from inside a DOS box" or from the Start -- Run... menu. -

    Supporting large Numbers of Printers

    +

    Supporting large Numbers of Printers

    One issue that has arisen during the recent development phase of Samba is the need to support driver downloads for 100's of printers. Using Windows NT APW here is somewhat awkward (to say the least). If you @@ -1735,7 +1660,8 @@ following is an example of how this could be accomplished: 

    -root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 "Heidelberg Digimaster 9110 (PS)"'
+root# rpcclient SAMBA-CUPS -U root%secret -c \
+  'setdriver dm9110 "Heidelberg Digimaster 9110 (PS)"'
  cmd = setdriver dm9110 Heidelberg Digimaster 9110 (PPD)
  Successfully set dm9110 to driver Heidelberg Digimaster 9110 (PS).

    @@ -1745,7 +1671,8 @@ following is an example of how this could be accomplished: cmd = enumprinters flags:[0x800000] name:[\\SAMBA-CUPS\dm9110] - description:[\\SAMBA-CUPS\dm9110,Heidelberg Digimaster 9110 (PS),110ppm HiVolume DANKA Stuttgart] + description:[\\SAMBA-CUPS\dm9110,Heidelberg Digimaster 9110 (PS),\ + 110ppm HiVolume DANKA Stuttgart] comment:[110ppm HiVolume DANKA Stuttgart] [....]

    @@ -1761,7 +1688,8 @@ following is an example of how this could be accomplished: cmd = enumprinters flags:[0x800000] name:[\\SAMBA-CUPS\dm9110] - description:[\\SAMBA-CUPS\dm9110,myphantasydrivername,110ppm HiVolume DANKA Stuttgart] + description:[\\SAMBA-CUPS\dm9110,myphantasydrivername,\ + 110ppm HiVolume DANKA Stuttgart] comment:[110ppm HiVolume DANKA Stuttgart] [....]

    @@ -1772,7 +1700,7 @@ commas in the "description" field). After the setdriver command succeeded, all is well. (The CUPS Printing chapter has more info about the installation of printer drivers with the help of rpcclient). -

    Adding new Printers with the Windows NT APW

    +

    Adding new Printers with the Windows NT APW

    By default, Samba exhibits all printer shares defined in smb.conf in the Printers... folder. Also located in this folder @@ -1780,29 +1708,29 @@ is the Windows NT Add Printer Wizard icon. The APW will be shown only if:

    • ...the connected user is able to successfully execute an OpenPrinterEx(\\server) with administrative -privileges (i.e. root or printer admin). +privileges (i.e. root or printer admin).

      Tip

      Try this from a Windows 2K/XP DOS box command prompt:

      runas /netonly /user:root rundll32 printui.dll,PrintUIEntry /p /t0 /n \\SAMBA-SERVER\printersharename

      and click on Printing Preferences...

    • ... contains the setting -show add printer wizard = yes (the +show add printer wizard = yes (the default).

    The APW can do various things:

    • upload a new driver to the Samba [print$] share;

    • associate an uploaded driver with an existing (but still "driverless") print queue;

    • exchange the currently used driver for an existing print queue with one that has been uploaded before;

    • add an entirely new printer to the Samba host (only in -conjunction with a working add printer command; -a corresponding delete printer command for +conjunction with a working add printer command; +a corresponding delete printer command for removing entries from the Printers... folder may be provided too)

    The last one (add a new printer) requires more effort than the previous ones. In order to use the APW to successfully add a printer -to a Samba server, the add printer command must +to a Samba server, the add printer command must have a defined value. The program hook must successfully add the -printer to the Unix print system (i.e. to +printer to the UNIX print system (i.e. to /etc/printcap, /etc/cups/printers.conf or other appropriate files) and to if necessary. @@ -1812,13 +1740,11 @@ exist, smbd will execute the add printer command and reparse to the to attempt to locate the new printer share. If the share is still not defined, an error of Access Denied is -returned to the client. Note that the add printer -command is executed under the context of the connected -user, not necessarily a root account. A map to guest = bad -user may have connected you unwittingly under the wrong +returned to the client. Note that the add printer command is executed under the context of the connected +user, not necessarily a root account. A map to guest = bad user may have connected you unwittingly under the wrong privilege; you should check it by using the smbstatus command. -

    Weird Error Message Cannot connect under a +

    Weird Error Message Cannot connect under a different Name

    Once you are connected with the wrong credentials, there is no means to reverse the situation other than to close all Explorer windows, and @@ -1848,7 +1774,7 @@ message. You close all Explorer Windows and start it again. You try to connect - and this times it works! Windows seems to cache connection info somewhere and doesn't keep it up to date (if you are unlucky you might need to reboot to get rid of the error message). -

    Be careful when assembling Driver Files

    +

    Be careful when assembling Driver Files

    You need to be very careful when you take notes about the files and belonging to a particular driver. Don't confuse the files for driver version "0" (for Win95/98/ME, going into @@ -1989,7 +1915,7 @@ In my example were even more differences than shown here. Conclusion: you must be very careful to select the correct driver files for each driver version. Don't rely on the names alone. Don't interchange files belonging to different driver versions. -

    Samba and Printer Ports

    +

    Samba and Printer Ports

    Windows NT/2000 print servers associate a port with each printer. These normally take the form of LPT1:, COM1:, FILE:, etc. Samba @@ -2008,20 +1934,20 @@ multiple ports as a form of load balancing or fail over. If you require that multiple ports be defined for some reason or another (“My users and my Boss should not know that they are working with Samba”), possesses a -enumports command which can be used to define +enumports command which can be used to define an external program that generates a listing of ports on a system. -

    Avoiding the most common Misconfigurations of the Client Driver

    +

    Avoiding the most common Misconfigurations of the Client Driver

    So - printing works, but there are still problems. Most jobs print well, some don't print at all. Some jobs have problems with fonts, which don't look good at all. Some jobs print fast, and some are dead-slow. We can't cover it all; but we want to encourage you to read the little paragraph about "Avoiding the wrong PostScript Driver Settings" in the CUPS Printing part of this document. -

    The Imprints Toolset

    +

    The Imprints Toolset

    The Imprints tool set provides a UNIX equivalent of the Windows NT Add Printer Wizard. For complete information, please refer to the Imprints web site -athttp://imprints.sourceforge.net/ +at http://imprints.sourceforge.net/ as well as the documentation included with the imprints source distribution. This section will only provide a brief introduction to the features of Imprints. @@ -2034,20 +1960,20 @@ coordinate your efforts on the samba-technical mailing list. The toolset is still in usable form; but only for a series of older printer models, where there are prepared packages to use. Packages for more up to date print devices are needed if Imprints should have a -future.

    What is Imprints?

    +future.

    What is Imprints?

    Imprints is a collection of tools for supporting these goals:

    • Providing a central repository information regarding Windows NT and 95/98 printer driver packages

    • Providing the tools necessary for creating the Imprints printer driver packages.

    • Providing an installation client which will obtain printer drivers from a central internet (or intranet) Imprints Server repository and install them on remote Samba and Windows NT4 print -servers.

    Creating Printer Driver Packages

    +servers.

    Creating Printer Driver Packages

    The process of creating printer driver packages is beyond the scope of this document (refer to Imprints.txt also included with the Samba distribution for more information). In short, an Imprints driver package is a gzipped tarball containing the driver files, related INF files, and a control file needed by the installation client. -

    The Imprints Server

    +

    The Imprints Server

    The Imprints server is really a database server that may be queried via standard HTTP mechanisms. Each printer entry in the database has an associated URL for the actual downloading of the package. Each @@ -2055,7 +1981,7 @@ package is digitally signed via GnuPG which can be used to verify that package downloaded is actually the one referred in the Imprints database. It is strongly recommended that this security check not be disabled. -

    The Installation Client

    +

    The Installation Client

    More information regarding the Imprints installation client is available in the Imprints-Client-HOWTO.ps file included with the imprints source package. @@ -2096,7 +2022,7 @@ if is has not already been installed? The way of sidestepping this limitation is to require that all Imprints printer driver packages include both the Intel Windows NT and 95/98 printer drivers and that NT driver is installed first. -

    Add Network Printers at Logon without User Interaction

    +

    Add Network Printers at Logon without User Interaction

    The following MS Knowledge Base article may be of some help if you need to handle Windows 2000 clients: How to Add Printers with No User Interaction in Windows 2000. ( http://support.microsoft.com/default.aspx?scid=kb;en-us;189105 @@ -2121,13 +2047,7 @@ printers via Samba, but works for Windows-based print servers too): rundll32 printui.dll,PrintUIEntry /y /n "\\sambacupsserver\infotec2105-PS"

    Here is a list of the used commandline parameters: -

    /dn

    deletes a network printer

    /q

    quiet modus

    /n

    names a printer

    /in

    adds a network printer connection

    /y

    sets printer as default printer

    -I have tested this with a Samba 2.2.7a and a Samba-3alpha24 -installation and Windows XP Professional clients. Note that this -specific command set works with network print queues (installing -local print queues requires different parameters, but this is of no -interest here). -

    • Line 1 deletes a possibly existing previous network +

      /dn

      deletes a network printer

      /q

      quiet modus

      /n

      names a printer

      /in

      adds a network printer connection

      /y

      sets printer as default printer

      • Line 1 deletes a possibly existing previous network printer infotec2105-IPDS (which had used native Windows drivers with LPRng that were removed from the server which was converted to CUPS). The /q at the end eliminates @@ -2171,7 +2091,7 @@ at logon time will not really be noticeable. Printers can be centrally added, changed, and deleted at will on the server with no user intervention required on the clients (you just need to keep the logon scripts up to date). -

      The addprinter command

      +

      The addprinter command

      The addprinter command can be configured to be a shell script or program executed by Samba. It is triggered by running the APW from a client against the Samba print server. The APW asks the @@ -2183,7 +2103,7 @@ on legacy systems, or execute the lpadmin command on more modern systems) and create the associated share in , then the APW will in effect really create a new printer on Samba and the UNIX print subsystem! -

      Migration of "Classical" printing to Samba-3

      +

      Migration of "Classical" printing to Samba

      The basic "NT-style" printer driver management has not changed considerably in 3.0 over the 2.2.x releases (apart from many small improvements). Here migration should be quite easy, especially if you @@ -2194,14 +2114,13 @@ is more of an effort. Please read the appropriate release notes and the HOWTO Collection for 2.2. You can follow several paths. Here are possible scenarios for migration:

      • You need to study and apply the new Windows NT printer -and driver support. Previously used parameters "printer -driver file", " printer driver" and -"printer driver location" are no longer +and driver support. Previously used parameters printer +driver file, printer driver and +printer driver location are no longer supported.

      • If you want to take advantage of WinNT printer driver support you also need to migrate the Win9x/ME drivers to the new setup.

      • An existing printers.def file -(the one specified in the now removed parameter printer -driver file = ...) will work no longer with Samba-3.0. In + (the one specified in the now removed parameter printer driver file) will work no longer with samba 3. In 3.0, smbd attempts to locate a Win9x/ME driver files for the printer in [print$] and additional settings in the TDB and only there; if it fails it will not (as 2.2.x @@ -2217,24 +2136,21 @@ only solution is to use the Windows NT APW to install the NT drivers and the 9x drivers. This can be scripted using smbclient and rpcclient. See the Imprints installation client at:

        -http://imprints.sourceforge.net/ + http://imprints.sourceforge.net/

        for an example. See also the discussion of rpcclient usage in the -"CUPS Printing" section.

      Publishing Printer Information in Active Directory or LDAP

      +"CUPS Printing" section.

    Publishing Printer Information in Active Directory or LDAP

    We will publish an update to this section shortly. -

    Common Errors and Problems

    -Here are a few typical errors and problems people have -encountered. You can avoid them. Read on. -

    I give my root password but I don't get access

    -Don't confuse the root password which is valid for the Unix system +

    Common Errors

    I give my root password but I don't get access

    +Don't confuse the root password which is valid for the UNIX system (and in most cases stored in the form of a one-way hash in a file named /etc/shadow) with the password used to authenticate against Samba!. Samba doesn't know the UNIX password; for root to access Samba resources via Samba-type access, a Samba account for root must be created first. This is often done with the smbpasswd command. -

    My printjobs get spooled into the spooling directory, but then get lost

    -Don't use the existing Unix print system spool directory for the Samba +

    My printjobs get spooled into the spooling directory, but then get lost

    +Don't use the existing UNIX print system spool directory for the Samba spool directory. It may seem convenient and a saving of space, but it only leads to problems. The two must be separate. -

    Prev Up Next
    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba Home Chapter 19. CUPS Printing Support in Samba 3.0
    +

    Prev Up Next
    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba Home Chapter 19. CUPS Printing Support in Samba 3.0
    diff --git a/docs/htmldocs/problems.html b/docs/htmldocs/problems.html index 6628a7d8fe..24ddc7c02c 100644 --- a/docs/htmldocs/problems.html +++ b/docs/htmldocs/problems.html @@ -1,11 +1,16 @@ -Chapter 34. Analysing and solving samba problems
    Chapter 34. Analysing and solving samba problems
    Prev Part V. Troubleshooting Next

    Chapter 34. Analysing and solving samba problems

    Gerald (Jerry) Carter

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    David Bannon

    Samba Team

    8 Apr 2003

    Table of Contents

    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists

    +Chapter 34. Analysing and solving samba problems

    Chapter 34. Analysing and solving samba problems
    Prev Part V. Troubleshooting Next

    Chapter 34. Analysing and solving samba problems

    Gerald (Jerry) Carter

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    David Bannon

    Samba Team

    8 Apr 2003

    Table of Contents

    Diagnostics tools
    Debugging with Samba itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists

    There are many sources of information available in the form of mailing lists, RFC's and documentation. The docs that come with the samba distribution contain very good explanations of -general SMB topics such as browsing.

    Diagnostics tools

    +general SMB topics such as browsing.

    Diagnostics tools

    With SMB networking, it is often not immediately clear what +the cause is of a certain problem. Samba itself provides rather +useful information, but in some cases you might have to fall back +to using a sniffer. A sniffer is a program that +listens on your LAN, analyses the data sent on it and displays it +on the screen.

    Debugging with Samba itself

    One of the best diagnostic tools for debugging problems is Samba itself. You can use the -d option for both smbd and nmbd to specify what -debug level at which to run. See the man pages on smbd, nmbd and +debug level at which to run. See the man pages on smbd, nmbd and smb.conf for more information on debugging options. The debug level can range from 1 (the default) to 10 (100 for debugging passwords).

    @@ -24,14 +29,19 @@ typing in your password, you can attach gdb and continue.

    Some useful samba commands worth investigating: 

    -	$ testparm | more
-	$ smbclient -L //{netbios name of server}
-

    -An SMB enabled version of tcpdump is available from -http://www.tcpdup.org/. -Ethereal, another good packet sniffer for Unix and Win32 -hosts, can be downloaded from http://www.ethereal.com. -

    +$ testparm | more +$ smbclient -L //{netbios name of server} +

    Tcpdump

    Tcpdump was the first +unix sniffer with SMB support. It is a command-line utility and +nowadays, it's SMB support is somewhat less then that of ethereal +and tethereal.

    Ethereal

    +Ethereal is a graphical +sniffer, available for both unix (Gtk) and Windows. Ethereal's +SMB support is very good.

    For details on the use of ethereal, read the well-written +ethereal User Guide.

    +Listen for data on ports 137, 138, 139 and 445. E.g. +use the filter port 137 or port 138 or port 139 or port 445.

    A console version of ethereal is available as well and is called +tethereal.

    The Windows Network Monitor

    For tracing things on the Microsoft Windows NT, Network Monitor (aka. netmon) is available on the Microsoft Developer Network CD's, the Windows NT Server install CD and the SMS CD's. The version of @@ -41,7 +51,7 @@ The version on the NT Server install CD will only allow monitoring of network traffic directed to the local NT box and broadcasts on the local subnet. Be aware that Ethereal can read and write netmon formatted files. -

    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box

    +

    Installing 'Network Monitor' on an NT Workstation

    Installing netmon on an NT workstation requires a couple of steps. The following are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 4.0, on Microsoft Windows NT @@ -74,17 +84,17 @@ Now copy the files from the NT Server in %SYSTEMROOT%\Syste to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set permissions as you deem appropriate for your site. You will need administrative rights on the NT box to run netmon. -

    +

    Installing 'Network Monitor' on an 9x Workstation

    To install Netmon on a Windows 9x box install the network monitor agent from the Windows 9x CD (\admin\nettools\netmon). There is a readme file located with the netmon driver files on the CD if you need information on how to do this. Copy the files from a working Netmon installation. -

    Useful URLs

    • See how Scott Merrill simulates a BDC behavior at +

    Useful URLs

    Getting help from the mailing lists

    + ftp://ftp.microsoft.com/developr/drg/CIFS/

    Getting help from the mailing lists

    There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror and then click on Support and then click on Samba related mailing lists. @@ -94,10 +104,10 @@ For questions relating to Samba TNG go to It has been requested that you don't post questions about Samba-TNG to the main stream Samba lists.

    If you post a message to one of the lists please observe the following guide lines : -

    • Always remember that the developers are volunteers, they are +

      • Always remember that the developers are volunteers, they are not paid and they never guarantee to produce a particular feature at a particular time. Any time lines are 'best guess' and nothing more. -

      • Always mention what version of samba you are using and what +

      • Always mention what version of samba you are using and what operating system its running under. You should probably list the relevant sections of your smb.conf file, at least the options in [global] that affect PDC support.

      • In addition to the version, if you obtained Samba via @@ -118,12 +128,11 @@ error messages.

      • (Possibly) If you have a complete netmon trace ( the pipe to the error ) you can send the *.CAP file as well.

      • Please think carefully before attaching a document to an email. Consider pasting the relevant parts into the body of the message. The samba mailing lists go to a huge number of people, do they all need a copy of your -smb.conf in their attach directory?

    How to get off the mailing lists

    To have your name removed from a samba mailing list, go to the +smb.conf in their attach directory?

    How to get off the mailing lists

    To have your name removed from a samba mailing list, go to the same place you went to to get on it. Go to http://lists.samba.org, click on your nearest mirror and then click on Support and -then click on Samba related mailing lists. Or perhaps see -here +then click on Samba related mailing lists.

    Please don't post messages to the list asking to be removed, you will just be referred to the above address (unless that process failed in some way...) -

    Prev Up Next
    Chapter 33. The Samba checklist Home Chapter 35. Reporting Bugs
    +

    Prev Up Next
    Chapter 33. The Samba checklist Home Chapter 35. Reporting Bugs
    diff --git a/docs/htmldocs/rpcclient.1.html b/docs/htmldocs/rpcclient.1.html index 47c4d914a5..e1ff391cbc 100644 --- a/docs/htmldocs/rpcclient.1.html +++ b/docs/htmldocs/rpcclient.1.html @@ -5,10 +5,9 @@ have now written scripts around it to manage Windows NT clients from their UNIX workstation.

    OPTIONS

    server

    NetBIOS name of Server to which to connect. The server can be any SMB/CIFS server. The name is - resolved using the - name resolve order line from smb.conf(5).

    -c|--command='command string'

    execute semicolon separated commands (listed + resolved using the name resolve order line from smb.conf(5).

    -c|--command='command string'

    execute semicolon separated commands (listed below))

    -I IP-address

    IP address is the address of the server to connect to. - It should be specified in standard "a.b.c.d" notation.

    Normally the client would attempt to locate a named + It should be specified in standard "a.b.c.d" notation.

    Normally the client would attempt to locate a named SMB/CIFS server by looking it up via the NetBIOS name resolution mechanism described above in the name resolve order parameter above. Using this parameter will force the client @@ -22,8 +21,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -37,10 +35,9 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +override the log level parameter +in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -N

    If specified, this parameter suppresses the normal password prompt from the client to the user. This is useful when @@ -73,10 +70,10 @@ via the ps command. To be safe always allow rpcclient to prompt for a password and type it in directly.

    -n <primary NetBIOS name>

    This option allows you to override the NetBIOS name that Samba uses for itself. This is identical -to setting the NetBIOS -name parameter in the smb.conf(5) file. However, a command +to setting the netbios name parameter in the smb.conf file. +However, a command line setting will take precedence over settings in -smb.conf(5).

    -i <scope>

    This specifies a NetBIOS scope that +smb.conf.

    -i <scope>

    This specifies a NetBIOS scope that nmblookup will use to communicate with when generating NetBIOS names. For details on the use of NetBIOS scopes, see rfc1001.txt and rfc1002.txt. NetBIOS scopes are @@ -88,7 +85,7 @@ smb.conf. If the domain specified is the same as the servers NetBIOS name, it causes the client to log on using the servers local SAM (as opposed to the Domain SAM).

    -O socket options

    TCP socket options to set on the client socket. See the socket options parameter in -the smb.conf(5) manual page for the list of valid +the smb.conf manual page for the list of valid options.

    -h|--help

    Print a summary of command line options.

    COMMANDS

    LSARPC

    lsaquery

    Query info policy

    lookupsids

    Resolve a list of SIDs to usernames. @@ -111,10 +108,10 @@ Help File Name:\ Language Monitor Name:\ Default Data Type:\ Comma Separated list of Files -

    Any empty fields should be enter as the string "NULL".

    Samba does not need to support the concept of Print Monitors +

    Any empty fields should be enter as the string "NULL".

    Samba does not need to support the concept of Print Monitors since these only apply to local printers whose driver can make use of a bi-directional link for communication. This field should - be "NULL". On a remote NT print server, the Print Monitor for a + be "NULL". On a remote NT print server, the Print Monitor for a driver must already be installed prior to adding the driver or else the RPC will fail.

    addprinter <printername> <sharename> <drivername> <port>

    @@ -158,9 +155,9 @@ Comma Separated list of Files Execute a GetPrinterDriverDirectory() RPC to retrieve the SMB share name and subdirectory for storing printer driver files for a given architecture. Possible - values for arch are "Windows 4.0" - (for Windows 95/98), "Windows NT x86", "Windows NT PowerPC", "Windows - Alpha_AXP", and "Windows NT R4000".

    getprinter <printername>

    Retrieve the current printer information. This command + values for arch are "Windows 4.0" + (for Windows 95/98), "Windows NT x86", "Windows NT PowerPC", "Windows + Alpha_AXP", and "Windows NT R4000".

    getprinter <printername>

    Retrieve the current printer information. This command corresponds to the GetPrinter() MS Platform SDK function.

    getprintprocdir

    Get print processor diff --git a/docs/htmldocs/samba-bdc.html b/docs/htmldocs/samba-bdc.html index 4c2045642d..c3be7504e2 100644 --- a/docs/htmldocs/samba-bdc.html +++ b/docs/htmldocs/samba-bdc.html @@ -1,22 +1,21 @@ -Chapter 6. Backup Domain Control

    Chapter 6. Backup Domain Control
    Prev Part II. Server Configuration Basics Next

    Chapter 6. Backup Domain Control

    John H. Terpstra

    Samba Team

    Volker Lendecke

    Samba Team

    Table of Contents

    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?

    +Chapter 6. Backup Domain Control

    Chapter 6. Backup Domain Control
    Prev Part II. Server Configuration Basics Next

    Chapter 6. Backup Domain Control

    John H. Terpstra

    Samba Team

    Volker Lendecke

    Samba Team

    Table of Contents

    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?

    Before you continue reading in this section, please make sure that you are comfortable -with configuring a Samba Domain Controller as described in the -Domain Control chapter. -

    Features And Benefits

    +with configuring a Samba Domain Controller as described in chapter on setting up Samba as a PDC. +

    Features And Benefits

    This is one of the most difficult chapters to summarise. It does not matter what we say here for someone will still draw conclusions and / or approach the Samba-Team with expectations that are either not yet capable of being delivered, or that can be achieved far more -effectively using a totally different approach. Since this HOWTO is already so large and -extensive, we have taken the decision to provide sufficient (but not comprehensive) -information regarding Backup Domain Control. In the event that you should have a persistent -concern that is not addressed in this HOWTO document then please email +effectively using a totally different approach. In the event that you should have a persistent +concern that is not addressed in this book then please email John H Terpstra clearly setting out your requirements and / or question and we will do our best to provide a solution.

    Samba-3 is capable of acting as a Backup Domain Controller to another Samba Primary Domain -Controller. A Samba-3 PDC can operate with an LDAP Account backend. The Samba-3 BDC can -operate with a slave LDAP server for the Account backend. This effectively gives samba a high -degree of scalability. This is a very sweet (nice) solution for large organisations. +Controller. A Samba-3 PDC can operate with an LDAP Account backend. The LDAP backend can be +either a common master LDAP server, or a slave server. The use of a slave LDAP server has the +benefit that when the master is down clients may still be able to log onto the network. +This effectively gives samba a high degree of scalability iand is a very sweet (nice) solution +for large organisations.

    While it is possible to run a Samba-3 BDC with non-LDAP backend, the administrator will need to figure out precisely what is the best way to replicate (copy / distribute) the @@ -41,8 +40,9 @@ lets consider each possible option and look at the pro's and con's for each theo

    Arguments Against: Complexity

  • - Passdb Backend is tdbsam based, BDCs use cron based "net rpc vampire" to - suck down the Accounts database from the PDC + Passdb Backend is tdbsam based, BDCs use cron based net rpc vampire to + obtain the Accounts database from the PDC and place them into the Samba SAM. + net rpc vampire is a Samba function of the "net" command.

    Arguments For: It would be a nice solution

    @@ -63,7 +63,7 @@ lets consider each possible option and look at the pro's and con's for each theo Arguments Against: All machine trust accounts and user accounts will be locally maintained. Domain users will NOT be able to roam from office to office. This is a broken and flawed solution. Do NOT do this. -

    • Essential Background Information

    +

    Essential Background Information

    A Domain Controller is a machine that is able to answer logon requests from network workstations. Microsoft LanManager and IBM LanServer were two early products that provided this capability. The technology has become known as the LanMan Netlogon service. @@ -73,7 +73,7 @@ and with it a new form of the network logon service that has extended functional This service became known as the NT NetLogon Service. The nature of this service has changed with the evolution of MS Windows NT and today provides a very complex array of services that are implemented over a complex spectrum of technologies. -

    MS Windows NT4 Style Domain Control

    +

    MS Windows NT4 Style Domain Control

    Whenever a user logs into a Windows NT4 / 200x / XP Professional Workstation, the workstation connects to a Domain Controller (authentication server) to validate the username and password that the user entered are valid. If the information entered @@ -131,32 +131,29 @@ one of the BDCs can be promoted to a PDC. If this happens while the original PDC line then it is automatically demoted to a BDC. This is an important aspect of Domain Controller management. The tool that is used to affect a promotion or a demotion is the Server Manager for Domains. -

    Example PDC Configuration

    +

    Example PDC Configuration

    Since version 2.2 Samba officially supports domain logons for all current Windows Clients, including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some parameters in the [global]-section of the smb.conf have to be set: -

    -	workgroup = SAMBA
-	domain master = yes
-	domain logons = yes
-

    -Several other things like a [homes] and a [netlogon] share also need to be set along with +

    Example 6.1. Minimal smb.conf for being a PDC

    workgroup = MIDEARTH
    domain master = yes
    domain logons = yes

    +Several other things like a [homes] and a +[netlogon] share also need to be set along with settings for the profile path, the users home drive, etc.. This will not be covered in this -chapter, for more information please refer to the chapter on Domain Control. -

    Active Directory Domain Control

    +chapter, for more information please refer to the chapter about samba as a PDC. +

    Active Directory Domain Control

    As of the release of MS Windows 2000 and Active Directory, this information is now stored in a directory that can be replicated and for which partial or full administrative control can be delegated. Samba-3 is NOT able to be a Domain Controller within an Active Directory tree, and it can not be an Active Directory server. This means that Samba-3 also can NOT act as a Backup Domain Controller to an Active Directory Domain Controller. -

    What qualifies a Domain Controller on the network?

    +

    What qualifies a Domain Controller on the network?

    Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS group name SAMBA<#1c> with the WINS server and/or by broadcast on the local network. The PDC also registers the unique NetBIOS name SAMBA<#1b> with the WINS server. The name type <#1b> name is normally reserved for the Domain Master Browser, a role that has nothing to do with anything related to authentication, but the Microsoft Domain implementation requires the domain master browser to be on the same machine as the PDC. -

    How does a Workstation find its domain controller?

    +

    How does a Workstation find its domain controller?

    An MS Windows NT4 / 200x / XP Professional workstation in the domain SAMBA that wants a local user to be authenticated has to find the domain controller for SAMBA. It does this by doing a NetBIOS name query for the group name SAMBA<#1c>. It assumes that each @@ -164,22 +161,22 @@ of the machines it gets back from the queries is a domain controller and can ans requests. To not open security holes both the workstation and the selected domain controller authenticate each other. After that the workstation sends the user's credentials (name and password) to the local Domain Controller, for validation. -

    Backup Domain Controller Configuration

    +

    Backup Domain Controller Configuration

    Several things have to be done:

    • The domain SID has to be the same on the PDC and the BDC. This used to be stored in the file private/MACHINE.SID. This file is not created - anymore since Samba 2.2.5 or even earlier. Nowadays the domain SID is - stored in the file private/secrets.tdb. Simply copying the secrets.tdb + since Samba 2.2.5. Nowadays the domain SID is stored in the file + private/secrets.tdb. Simply copying the secrets.tdb from the PDC to the BDC does not work, as the BDC would generate a new SID for itself and override the domain SID with this new BDC SID.

      To retrieve the domain SID from the PDC or an existing BDC and store it in the secrets.tdb, execute: 

      -	root# net rpc getsid
-

    • - The Unix user database has to be synchronized from the PDC to the +root# net rpc getsid +

    • + The UNIX user database has to be synchronized from the PDC to the BDC. This means that both the /etc/passwd and /etc/group have to be replicated from the PDC to the BDC. This can be done manually whenever changes are made, or the PDC is set up as a NIS master @@ -199,23 +196,30 @@ Several things have to be done: BDC. This can be done manually whenever login scripts are changed, or it can be done automatically together with the smbpasswd synchronization. -

    Example Configuration

    +

    Example Configuration

    Finally, the BDC has to be found by the workstations. This can be done by setting: -

    -	workgroup = SAMBA
-	domain master = no
-	domain logons = yes
-

    -in the [global]-section of the smb.conf of the BDC. This makes the BDC +

    Example 6.2. Minimal setup for being a BDC

    workgroup = MIDEARTH
    domain master = no
    domain logons = yes
    idmap backend = ldapsam://slave-ldap.quenya.org

    +In the [global]-section of the smb.conf of the BDC. This makes the BDC only register the name SAMBA<#1c> with the WINS server. This is no problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to -be registered by more than one machine. The parameter 'domain master = -no' forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS +be registered by more than one machine. The parameter +domain master = no +forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS name is reserved for the Primary Domain Controller. -

    Common Errors

    +

    +The idmap backend will redirect the winbindd utility to +use the LDAP database to resolve all UIDs and GIDs for UNIX accounts. +

    Note

    +Samba-3 has introduced a new ID mapping facility. One of the features of this facility is that it +allows greater flexibility in how user and group IDs are handled in respect of NT Domain User and Group +SIDs. One of the new facilities provides for explicitly ensuring that UNIX / Linux UID and GID values +will be consistent on the PDC, all BDCs and all Domain Member servers. The parameter that controls this +is called idmap backend. Please refer to the man page for smb.conf for more information +regarding it's behaviour. Do NOT set this parameter except where an LDAP backend (ldapsam) is in use. +

    Common Errors

    As this is a rather new area for Samba there are not many examples that we may refer to. Keep watching for updates to this section. -

    Machine Accounts keep expiring, what can I do?

    +

    Machine Accounts keep expiring, what can I do?

    This problem will occur when occur when the passdb (SAM) files are copied from a central server but the local Backup Domain Controllers. Local machine trust account password updates are not copied back to the central server. The newer machine account password is then over @@ -226,18 +230,15 @@ to proceed and the account expiry error will be reported.

    The solution: use a more robust passdb backend, such as the ldapsam backend, setting up an slave LDAP server for each BDC, and a master LDAP server for the PDC. -

    Can Samba be a Backup Domain Controller to an NT4 PDC?

    +

    Can Samba be a Backup Domain Controller to an NT4 PDC?

    With version 2.2, no. The native NT4 SAM replication protocols have not yet been fully implemented. The Samba Team is working on understanding and implementing the protocols, -but this work has not been finished for version 2.2. -

    -With version 3.0, the work on both the replication protocols and a suitable storage -mechanism has progressed, and some form of NT4 BDC support is expected soon. +but this work has not been finished for Samba-3.

    -Can I get the benefits of a BDC with Samba? Yes. The main reason for implementing a +Can I get the benefits of a BDC with Samba? Yes, but only to a Samba PDC. The main reason for implementing a BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to service logon requests whenever the PDC is down. -

    How do I replicate the smbpasswd file?

    +

    How do I replicate the smbpasswd file?

    Replication of the smbpasswd file is sensitive. It has to be done whenever changes to the SAM are made. Every user's password change is done in the smbpasswd file and has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary. @@ -251,9 +252,9 @@ to type a password. As said a few times before, use of this method is broken and flawed. Machine trust accounts will go out of sync, resulting in a very broken domain. This method is not recommended. Try using LDAP instead. -

    Can I do this all with LDAP?

    +

    Can I do this all with LDAP?

    The simple answer is YES. Samba's pdb_ldap code supports binding to a replica LDAP server, and will also follow referrals and rebind to the master if it ever needs to make a modification to the database. (Normally BDCs are read only, so this will not occur often). -

    Prev Up Next
    Chapter 5. Domain Control Home Chapter 7. Domain Membership
    +

    Prev Up Next
    Chapter 5. Domain Control Home Chapter 7. Domain Membership
    diff --git a/docs/htmldocs/samba-doc.html b/docs/htmldocs/samba-doc.html new file mode 100644 index 0000000000..f5dfd49888 --- /dev/null +++ b/docs/htmldocs/samba-doc.html @@ -0,0 +1,72 @@ +SAMBA Project Documentation
    SAMBA Project Documentation
       Next

    SAMBA Project Documentation

    Edited by

    Jelmer R. Vernooij

    John H. Terpstra

    Gerald (Jerry) Carter

    Monday April 21, 2003

    Abstract

    +This book is a collection of HOWTOs added to Samba documentation over the years. +Samba is always under development, and so is its' documentation. This release of the +documentation represents a major revision or layout as well as contents. +The most recent version of this document can be found at +http://www.samba.org/ +on the "Documentation" page. Please send updates to +Jelmer Vernooij, +John H. Terpstra or +Gerald (Jerry) Carter. +

    +The Samba-Team would like to express sincere thanks to the many people who have with +or without their knowledge contributed to this update. The size and scope of this +project would not have been possible without significant community contribution. A not +insignificant number of ideas for inclusion (if not content itself) has been obtained +from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. +Please keep publishing your Unofficial HOWTOs - they are a source of inspiration and +application knowledge that is most to be desired by many Samba users and administrators. +

    Table of Contents

    Legal Notice
    Attributions
    I. General Installation
    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your + server
    Try connecting with the unix client
    Try connecting from another SMB client
    What If Things Don't Work?
    Common Errors
    Large number of smbd processes
    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
    "The network name cannot be found"
    3. Fast Start for the Impatient
    Note
    II. Server Configuration Basics
    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password checking
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    '$' cannot be included in machine name
    Joining domain fails because of existing machine account
    The system can not log you on (C000019B)....
    The machine trust account not accessible
    Account disabled
    Domain Controller Unavailable
    Can not log onto domain member workstation after joining domain
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    I can't join a Windows 2003 PDC
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    III. Advanced Configuration
    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    I get an Unable to browse the network error
    11. Account Information Databases
    Features and Benefits
    Backwards Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon
    Users being added to wrong backend database
    auth methods does not work
    12. Mapping MS Windows and UNIX Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users group
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask + parameters
    Interaction with the standard Samba file attribute mapping
    Common Errors
    Users can not write to a public share
    I have set force user but Samba still makes root the owner of all the files I touch!
    MS Word with Samba changes owner of file
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Problems saving files in MS Office on Windows XP
    Long delays deleting files over network with XP SP1
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-style Domain Trusts with Windows 2000
    Common Errors
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    A simple Configuration to Print
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various UNIX Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba 3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with +rpcclient
    Client Driver Install Procedure
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a +different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for +CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for +application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and +native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many +Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel +Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
    Caveats to be considered
    Benefits of using "CUPS PostScript Driver for +Windows NT/2k/XP" instead of Adobe Driver
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsmb completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the +Client
    Installing PostScript Driver Files manually (using +rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    In Case of Trouble.....
    Printing from CUPS to Windows attached +Printers
    More CUPS filtering Chains
    Common Errors
    Win9x client can't install driver
    "cupsaddsmb" keeps asking for root password in + neverending loop
    "cupsaddsmb" gives "No PPD file for printer..." + message while PPD file is present
    Client can't connect to Samba printer
    Can't reconnect to Samba under new account + from Win2K/XP
    Avoid being connected to the Samba server as the + "wrong" user
    Upgrading to CUPS drivers from Adobe drivers on + NT/2K/XP clients gives problems
    Can't use "cupsaddsmb" on Samba server which is + a PDC
    Deleted Win2K printer driver is still shown
    Win2K/XP "Local Security + Policies"
    WinXP clients: "Administrator can not install + printers for all local users"
    "Print Change Notify" functions on + NT-clients
    WinXP-SP1
    Print options for all users can't be set on Win2K/XP
    Most common blunders in driver + settings on Windows clients
    cupsaddsmb does not work + with newly installed printer
    Permissions on +/var/spool/samba/ get reset after each +reboot
    Printer named "lp" +intermittently swallows jobs and spits out completely different +ones
    Location of Adobe PostScript driver files necessary for "cupsaddsmb"
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    21. Winbind: Use of Domain Accounts
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Setting up roaming profiles for just a few user's or group's?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    Winbind is not resolving users and groups
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure UNIX/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging works only in one way
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    Common errors
    CP850.so can't be found
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    IV. Migration and Updating
    30. Upgrading from Samba-2.x to Samba-3.0.0
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (changes in behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    Charsets
    LDAP
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    V. Troubleshooting
    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    34. Analysing and solving samba problems
    Diagnostics tools
    Debugging with Samba itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches
    VI. Appendixes
    36. How to compile Samba
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    37. Portability
    HPUX
    SCO UNIX
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    Configuring OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba
    Configuring OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba
    Printer driver download for for OS/2 clients?
    Windows for Workgroups
    Latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configuring WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Index

    List of Figures

    5.1. An Example Domain
    10.1. Cross subnet browsing example
    11.1. IDMAP
    12.1. IDMAP groups
    13.1. Overview of unix permissions field
    16.1. Trusts overview
    19.1. Windows Printing to a local Printer
    19.2. Printing to a Postscript Printer
    19.3. Ghostscript as a RIP for non-postscript printers
    19.4. Prefiltering in CUPS to form Postscript
    19.5. Adding Device-specific Print Options
    19.6. Postscript to intermediate Raster format
    19.7. CUPS-raster production using Ghostscript
    19.8. Image format to CUPS-raster format conversion
    19.9. Raster to Printer Specific formats
    19.10. cupsomatic/foomatic processing versus Native CUPS
    19.11. PDF to socket chain
    19.12. PDF to USB chain
    19.13. Print Driver execution on the Client
    19.14. Print Driver execution on the Server
    19.15. Printing via CUPS/samba server
    19.16. cupsaddsmb flowchart
    19.17. Filtering chain 1
    19.18. Filtering chain with cupsomatic
    19.19. CUPS Printing Overview

    List of Tables

    7.1. Assumptions
    10.1. Browse subnet example 1
    10.2. Browse subnet example 2
    10.3. Browse subnet example 3
    10.4. Browse subnet example 4
    11.1. Attributes in the sambaSamAccount objectclass (LDAP)
    11.2. Basic smb.conf options for MySQL passdb backend
    11.3. MySQL field names for MySQL passdb backend
    13.1. Managing directories with unix and windows
    13.2. User and Group Based Controls
    13.3. File and Directory Permission Based Controls
    13.4. Other Controls
    19.1. PPD's shipped with CUPS
    20.1. Extended Auditing Log Information
    24.1. User Shell Folder registry keys default values
    24.2. Defaults of profile settings registry keys
    24.3. Defaults of default user profile paths registry keys
    25.1. Options recognized by pam_smbpass
    26.1. Unique NetBIOS names
    26.2. Group Names
    30.1. TDB File Descriptions
    31.1. The 3 Major Site Types
    31.2. Nature of the Conversion Choices

    List of Examples

    2.1. Simplest possible smb.conf file
    5.1. smb.conf for being a PDC
    5.2. smb.conf for being a PDC
    6.1. Minimal smb.conf for being a PDC
    6.2. Minimal setup for being a BDC
    8.1. smb.conf for Reference Documentation Server
    8.2. smb.conf for anonymous printing
    10.1. Domain master browser smb.conf
    10.2. Local master browser smb.conf
    10.3. smb.conf for not being a master browser
    10.4. Local master browser smb.conf
    10.5. smb.conf for not being a master browser
    11.1.
    11.2. Configuration with LDAP
    12.1. smbgrpadd.sh
    13.1. Example File
    14.1. Share with some files oplocked
    14.2.
    17.1. smb.conf with DFS configured
    18.1. Simple configuration with BSD printing
    18.2. Extended configuration with BSD printing
    18.3. [print\$] example
    19.1. Simplest printing-related smb.conf
    19.2. Overriding global CUPS settings for one printer
    19.3. smb.conf for cupsaddsmb usage
    20.1. smb.conf with VFS modules
    20.2. smb.conf with multiple VFS modules
    21.1. smb.conf for winbind set-up
    33.1. smb.conf with [tmp] share
    38.1. Minimal profile share
       Next
       Legal Notice
    diff --git a/docs/htmldocs/samba-pdc.html b/docs/htmldocs/samba-pdc.html index 930315b3f5..aab2d4207c 100644 --- a/docs/htmldocs/samba-pdc.html +++ b/docs/htmldocs/samba-pdc.html @@ -1,8 +1,4 @@ -Chapter 5. Domain Control
    Chapter 5. Domain Control
    Prev Part II. Server Configuration Basics Next

    Chapter 5. Domain Control

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    David Bannon

    Samba Team

    Table of Contents

    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not -exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

    The Essence of Learning:  +Chapter 5. Domain Control

    Chapter 5. Domain Control
    Prev Part II. Server Configuration Basics Next

    Chapter 5. Domain Control

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    David Bannon

    Samba Team

    Table of Contents

    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    '$' cannot be included in machine name
    Joining domain fails because of existing machine account
    The system can not log you on (C000019B)....
    The machine trust account not accessible
    Account disabled
    Domain Controller Unavailable
    Can not log onto domain member workstation after joining domain

    The Essence of Learning:  There are many who approach MS Windows networking with incredible misconceptions. That's OK, because it gives the rest of us plenty of opportunity to be of assistance. Those who really want help would be well advised to become familiar with information @@ -10,18 +6,18 @@ that is already available.

    The reader is advised NOT to tackle this section without having first understood and mastered some basics. MS Windows networking is not particularly forgiving of -misconfiguration. Users of MS Windows networking are likely to complain bitterly -of persistent niggles that may be caused by broken network or system configuration. +misconfiguration. Users of MS Windows networking are likely to complain +of persistent niggles that may be caused by a broken network configuration. To a great many people however, MS Windows networking starts with a domain controller that in some magical way is expected to solve all ills. -

    +

    Figure 5.1. An Example Domain

    An Example Domain

    From the Samba mailing list one can readily identify many common networking issues. If you are not clear on the following subjects, then it will do much good to read the sections of this HOWTO that deal with it. These are the most common causes of MS Windows networking problems: -

    Basic TCP/IP configuration
    NetBIOS name resolution
    Authentication configuration
    User and Group configuration
    Basic File and Directory Permission Control in Unix/Linux
    Understanding of how MS Windows clients interoperate in a network - environment

    -Do not be put off; on the surface of it MS Windows networking seems so simple that any fool +

    • Basic TCP/IP configuration

    • NetBIOS name resolution

    • Authentication configuration

    • User and Group configuration

    • Basic File and Directory Permission Control in UNIX/Linux

    • Understanding of how MS Windows clients interoperate in a network + environment

    +Do not be put off; on the surface of it MS Windows networking seems so simple that anyone can do it. In fact, it is not a good idea to set up an MS Windows network with inadequate training and preparation. But let's get our first indelible principle out of the way: It is perfectly OK to make mistakes! In the right place and at @@ -32,7 +28,7 @@ burden on an organisation. Where is the right place to make mistakes? Only out of harm's way! If you are going to make mistakes, then please do this on a test network, away from users and in such a way as to not inflict pain on others. Do your learning on a test network. -

    Features and Benefits

    +

    Features and Benefits

    What is the key benefit of Microsoft Domain security?

    In a word, Single Sign On, or SSO for short. To many, this is the holy @@ -43,13 +39,18 @@ and they will be able to log onto the network and access resources (shares, file as if they are sitting at their home (personal) workstation. This is a feature of the Domain security protocols.

    -The benefits of Domain security are fully available to those sites that deploy a Samba PDC. +The benefits of Domain security are available to those sites that deploy a Samba PDC. +A Domain provides a unique network security identifier (SID). Domain user and group security +identifiers are comprised of the network SID plus a relative identifier (RID) that is unique to +the account. User and Group SIDs (the network SID plus the RID) can be used to create Access Control +Lists (ACLs) attached to network resources to provide organizational access control. UNIX systems +know only of local security identifiers.

    Note

    Network clients of an MS Windows Domain security environment must be Domain members to be able to gain access to the advanced features provided. Domain membership involves more than just setting the workgroup name to the Domain name. It requires the creation of a Domain trust account for the workstation (called a machine account). Please refer to the chapter on -Domain Membership for more information. +setting up samba as a domain member for more information.

    The following functionalities are new to the Samba-3 release:

    • @@ -57,8 +58,7 @@ The following functionalities are new to the Samba-3 release:

    • Adding users via the User Manager for Domains. This can be done on any MS Windows client using the Nexus toolkit that is available from Microsoft's web site. - At some later date Samba-3 may get support for the use of the Microsoft Management - Console for user management. + Samba-3 supports the use of the Microsoft Management Console for user management.

    • Introduces replaceable and multiple user account (authentication) back ends. In the case where the back end is placed in an LDAP database, @@ -72,14 +72,18 @@ The following functionalities are new to the Samba-3 release: The following functionalities are NOT provided by Samba-3:

      • SAM replication with Windows NT4 Domain Controllers - (i.e. a Samba PDC and a Windows NT BDC or vice versa) + (i.e. a Samba PDC and a Windows NT BDC or vice versa). This means samba + cannot operate as a BDC when the PDC is Microsoft-based or + replicate account data to Windows-BDC's.

      • Acting as a Windows 2000 Domain Controller (i.e. Kerberos and Active Directory) - In point of fact, Samba-3 DOES have some Active Directory Domain Control ability that is at this time purely experimental AND that is certain to change as it becomes a fully supported feature some time - during the Samba-3 (or later) life cycle. + during the Samba-3 (or later) life cycle. However, Active Directory is + more then just SMB - it's also LDAP, Kerberos, DHCP and other protocols + (with proprietary extensions, of course).

      Windows 9x / Me / XP Home clients are not true members of a domain for reasons outlined in this chapter. The protocol for support of Windows 9x / Me style network (domain) logons @@ -88,67 +92,33 @@ for some time. These clients use the old LanMan Network Logon facilities that ar in Samba since approximately the Samba-1.9.15 series.

      Samba-3 has an implementation of group mapping between Windows NT groups -and Unix groups (this is really quite complicated to explain in a short space). This is -discussed more fully in the Group Mapping chapter. +and UNIX groups (this is really quite complicated to explain in a short space). This is +discussed more fully in the chapter on group mapping.

      Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store -user and machine trust account information in a suitable backend data store. With Samba-3 -there can be multiple back-ends for this including: -

      • - smbpasswd - the plain ASCII file stored used by - earlier versions of Samba. This file configuration option requires - a Unix/Linux system account for EVERY entry (ie: both for user and for - machine accounts). This file will be located in the private - directory (default is /usr/local/samba/lib/private or on linux /etc/samba). -

      • - tdbsam - a binary database backend that will be - stored in the private directory in a file called - passdb.tdb. The key benefit of this binary format - file is that it can store binary objects that can not be accommodated - in the traditional plain text smbpasswd file. These permit the extended - account controls that MS Windows NT4 and later also have. -

      • - ldapsam - An LDAP based back-end. Permits the - LDAP server to be specified. eg: ldap://localhost or ldap://frodo.murphy.com. - Like the tdbsam, ldapsam permits the storing of extended account attributes - for control of things like: Permitted access times, password activation and - expiry, permitted points of access (workstation names), per user profile - location, and much more. -

      • - ldapsam_compat - An LDAP back-end that maintains backwards - compatibility with the behaviour of samba-2.2.x. You should use this in the process - of migrating from samba-2.2.x to samba-3 if you do not want to rebuild your LDAP - database. -

      -Read the chapter about Account Information Database for details -regarding the choices available and how to configure them. -

      Note

      -The new tdbsam and ldapsam account backends store substantially more information than -smbpasswd is capable of. The new backend database includes capacity to specify -per user settings for many parameters, over-riding global settings given in the -smb.conf file. eg: logon drive, logon home, logon path, etc. -Thus, with samba-3 it is possible to have a default system configuration for profiles, -and on a per user basis to over-ride this for those users who should not be subject -to the default configuration. -

    Basics of Domain Control

    +user and machine trust account information in a suitable backend data store. +Refer to the section on machine trust accounts. With Samba-3 there can be multiple +back-ends for this. A complete discussion of account database backends can be found in +the chapter on Account Information Databases. +

    Basics of Domain Control

    Over the years, public perceptions of what Domain Control really is has taken on an almost mystical nature. Before we branch into a brief overview of Domain Control, there are three basic types of domain controllers: -

    Domain Controller Types

    • Primary Domain Controller

    • Backup Domain Controller

    • ADS Domain Controller

    +

    Domain Controller Types

    • Primary Domain Controller

    • Backup Domain Controller

    • ADS Domain Controller

    The Primary Domain Controller or PDC plays an important role in the MS -Windows NT4 and Windows 200x Domain Control architecture, but not in the manner that so many -expect. There is folk lore that dictates that because of it's role in the MS Windows -network, the PDC should be the most powerful and most capable machine in the network. +Windows NT4. In Windows 200x Domain Control architecture this role is held by domain controllers. +There is folk lore that dictates that because of it's role in the MS Windows +network, the domain controllers should be the most powerful and most capable machine in the network. As strange as it may seem to say this here, good over all network performance dictates that -the entire infrastructure needs to be balanced. It is advisable to invest more in the Backup -Domain Controllers and Stand-Alone (or Domain Member) servers than in the PDC. +the entire infrastructure needs to be balanced. It is advisable to invest more in Stand-Alone +(or Domain Member) servers than in the domain controllers.

    -In the case of MS Windows NT4 style domains, it is the PDC seeds the Domain Control database, -a part of the Windows registry called the SAM (Security Account Manager). It plays a key +In the case of MS Windows NT4 style domains, it is the PDC that initiates a new Domain Control database. +This forms a part of the Windows registry called the SAM (Security Account Manager). It plays a key part in NT4 type domain user authentication and in synchronisation of the domain authentication database with Backup Domain Controllers.

    -With MS Windows 200x Server based Active Directory domains, one domain controller seeds a potential +With MS Windows 200x Server based Active Directory domains, one domain controller initiates a potential hierarchy of domain controllers, each with their own area of delegated control. The master domain controller has the ability to override any down-stream controller, but a down-line controller has control only over it's down-line. With Samba-3 this functionality can be implemented using an @@ -156,9 +126,7 @@ LDAP based user and machine account back end.

    New to Samba-3 is the ability to use a back-end database that holds the same type of data as the NT4 style SAM (Security Account Manager) database (one of the registry files). -The Samba-3 SAM can be specified via the smb.conf file parameter -passwd backend and valid options include -smbpasswd, tdbsam, ldapsam, nisplussam, xmlsam, mysqlsam, guest. +[1]

    The Backup Domain Controller or BDC plays a key role in servicing network authentication requests. The BDC is biased to answer logon requests in preference to the PDC. @@ -182,11 +150,14 @@ excluding the SAM replication components. However, please be aware that Samba-3 MS Windows 200x domain control protocols also.

    At this time any appearance that Samba-3 is capable of acting as an -ADS Domain Controller is limited and experimental in nature. +Domain Controller in native ADS mode is limited and experimental in nature. This functionality should not be used until the Samba-Team offers formal support for it. At such a time, the documentation will be revised to duly reflect all configuration and -management requirements. -

    Preparing for Domain Control

    +management requirements. Samba can act as a NT4-style DC in a Windows 2000/XP +environment. However, there are certain compromises: + +

    • No machine policy files

    • No Group Policy Objects

    • No synchronously executed AD logon scripts

    • Can't use ANY Active Directory management tools to manage users and machines

    • Registry changes tattoo the main registry, while with AD they do NOT. ie: Leave permanent changes in effect

    • Without AD you can not peprform the function of exporting specific applications to specific users or groups

    +

    Preparing for Domain Control

    There are two ways that MS Windows machines may interact with each other, with other servers, and with Domain Controllers: Either as Stand-Alone systems, more commonly called Workgroup members, or as full participants in a security system, @@ -208,23 +179,22 @@ Domain it triggers a machine password change.

    Note

    When running a Domain all MS Windows NT / 200x / XP Professional clients should be configured as full Domain Members - IF A SECURE NETWORK IS WANTED. If the machine is NOT made a member of the -Domain, then it will operate like a workgroup (stand-alone) machine. Please refer the -Domain Membership chapter for information regarding - HOW to make your MS Windows clients Domain members. +Domain, then it will operate like a workgroup (stand-alone) machine. Please refer to +the chapter on domain membership for information regarding HOW to make your MS Windows clients Domain members.

    The following are necessary for configuring Samba-3 as an MS Windows NT4 style PDC for MS Windows NT4 / 200x / XP clients. -

    Configuration of basic TCP/IP and MS Windows Networking
    Correct designation of the Server Role (security = user)
    Consistent configuration of Name Resolution (See chapter on Browsing and on - MS Windows network Integration)
    Domain logons for Windows NT4 / 200x / XP Professional clients
    Configuration of Roaming Profiles or explicit configuration to force local profile usage
    Configuration of Network/System Policies
    Adding and managing domain user accounts
    Configuring MS Windows client machines to become domain members

    +

    • Configuration of basic TCP/IP and MS Windows Networking

    • Correct designation of the Server Role (security = user)

    • Consistent configuration of Name Resolution (See chapter on Network Browsing and on + Integrating Unix into Windows networks)

    • Domain logons for Windows NT4 / 200x / XP Professional clients

    • Configuration of Roaming Profiles or explicit configuration to force local profile usage

    • Configuration of Network/System Policies

    • Adding and managing domain user accounts

    • Configuring MS Windows client machines to become domain members

    The following provisions are required to serve MS Windows 9x / Me Clients: -

    Configuration of basic TCP/IP and MS Windows Networking
    Correct designation of the Server Role (security = user)
    Network Logon Configuration (Since Windows 9x / XP Home are not technically domain - members, they do not really participate in the security aspects of Domain logons as such)
    Roaming Profile Configuration
    Configuration of System Policy handling
    Installation of the Network driver "Client for MS Windows Networks" and configuration - to log onto the domain
    Placing Windows 9x / Me clients in user level security - if it is desired to allow - all client share access to be controlled according to domain user / group identities.
    Adding and managing domain user accounts

    Note

    +

    • Configuration of basic TCP/IP and MS Windows Networking

    • Correct designation of the Server Role (security = user)

    • Network Logon Configuration (Since Windows 9x / XP Home are not technically domain + members, they do not really participate in the security aspects of Domain logons as such)

    • Roaming Profile Configuration

    • Configuration of System Policy handling

    • Installation of the Network driver "Client for MS Windows Networks" and configuration + to log onto the domain

    • Placing Windows 9x / Me clients in user level security - if it is desired to allow + all client share access to be controlled according to domain user / group identities.

    • Adding and managing domain user accounts

    Note

    Roaming Profiles and System/Network policies are advanced network administration topics that are covered in the Profile Management and -Policy Management chapters of this document. However, these are not necessarily specific -to a Samba PDC as much as they are related to Windows NT networking concepts. +Policy Management chapters of this document. However, these are not +necessarily specific to a Samba PDC as much as they are related to Windows NT networking concepts.

    A Domain Controller is an SMB/CIFS server that:

    • @@ -239,120 +209,86 @@ A Domain Controller is an SMB/CIFS server that: Provides a share called NETLOGON

    For Samba to provide these is rather easy to configure. Each Samba Domain Controller must provide -the NETLOGON service which Samba calls the domain logons functionality +the NETLOGON service which Samba calls the domain logons functionality (after the name of the parameter in the smb.conf file). Additionally, one (1) server in a Samba-3 -Domain must advertise itself as the domain master browser. This causes the Primary Domain Controller +Domain must advertise itself as the domain master browser[2]. This causes the Primary Domain Controller to claim domain specific NetBIOS name that identifies it as a domain master browser for its given domain/workgroup. Local master browsers in the same domain/workgroup on broadcast-isolated subnets then ask for a complete copy of the browse list for the whole wide area network. Browser clients will then contact their local master browser, and will receive the domain-wide browse list, instead of just the list for their broadcast-isolated subnet. -

    Domain Control - Example Configuration

    +

    Domain Control - Example Configuration

    The first step in creating a working Samba PDC is to understand the parameters necessary -in smb.conf. Here we attempt to explain the parameters that are covered in -the smb.conf man page. -

    -Here is an example smb.conf for acting as a PDC: -

    -	[global]
-	    ; Basic server settings
-	    netbios name = POGO
-	    workgroup = NARNIA
-
-	    ; User and Machine Account Backends
-	    ; Choices are: tdbsam, smbpasswd, ldapsam, mysqlsam, xmlsam, guest
-	    passdb backend = ldapsam, guest
-
-	    ; we should act as the domain and local master browser
-	    os level = 64
-	    preferred master = yes
-	    domain master = yes
-	    local master = yes
-	    
-	    ; security settings (must user security = user)
-	    security = user
-	    
-	    ; encrypted passwords are a requirement for a PDC (default = Yes)
-	    encrypt passwords = yes
-	    
-	    ; support domain logons
-	    domain logons = yes
-	    
-	    ; where to store user profiles?
-	    logon path = \\%N\profiles\%u
-	    
-	    ; where is a user's home directory and where should it be mounted at?
-	    logon drive = H:
-	    logon home = \\homeserver\%u\winprofile
-	    
-	    ; specify a generic logon script for all users
-	    ; this is a relative **DOS** path to the [netlogon] share
-	    logon script = logon.cmd
-
-	; necessary share for domain controller
-	[netlogon]
-	    path = /usr/local/samba/lib/netlogon
-	    read only = yes
-	    write list = ntadmin
-	    
-	; share for storing user profiles
-	[profiles]
-	    path = /export/smb/ntprofile
-	    read only = no
-	    create mask = 0600
-	    directory mask = 0700
-

    Note

    +in smb.conf. An example smb.conf for acting as a PDC can be found in the example +for being a PDC. +

    +

    Example 5.1. smb.conf for being a PDC

    [global]
    netbios name = BELERIAND
    workgroup = MIDEARTH
    passdb backend = ldapsam, guest
    os level = 33
    preferred master = yes
    domain master = yes
    local master = yes
    security = user
    encrypt passwords = yes
    domain logons = yes
    logon path = \\%N\profiles\%u
    logon drive = H:
    logon home = \\homeserver\%u\winprofile
    logon script = logon.cmd
    [netlogon]
    path = /var/lib/samba/netlogon
    read only = yes
    write list = ntadmin
    [profiles]
    path = /var/lib/samba/profiles
    read only = no
    create mask = 0600
    directory mask = 0700

    +

    +The basic options shown above are explained as follows: +

    passdb backend

    + This contains all the user and group account information. Acceptable values for a PDC + are: smbpasswd, tdbsam, ldapsam. The 'guest' entry provides needed + default accounts.

    + Where is is intended to use backup domain controllers (BDCs) the only logical choice is + to use LDAP so that the passdb backend can be distributed. The tdbsam and smbpasswd files + can not effectively be distributed and therefore should not be used. +

    Domain Control Parameters

    + The parameters os level, preferred master, domain master, security, + encrypt passwords, domain logons play a central role in assuring domain + control and network logon support.

    + The os level must be set at or above a value of 32. A domain controller + must be the domain master browser, must be set in user mode security, + must support Microsoft compatible encrypted passwords, and must provide the network logon + service (domain logons). Encrypted passwords must be enabled, for more details on how + to do this, refer to the chapter on account information databases. +

    Environment Parameters

    + The parameters logon path, logon home, logon drive, logon script are + environment support settings that help to facilitate client logon operations and that help + to provide automated control facilities to ease network management overheads. Please refer + to the man page information for these parameters. +

    NETLOGON Share

    + The NETLOGON share plays a central role in domain logon and domain membership support. + This share is provided on all Microsoft domain controllers. It is used to provide logon + scripts, to store Group Policy files (NTConfig.POL), as well as to locate other common + tools that may be needed for logon processing. This is an essential share on a domain controller. +

    PROFILE Share

    + This share is used to store user desktop profiles. Eash user must have a directory at the root + of this share. This directory must be write enabled for the user and must be globally read enabled. + Samba-3 has a VFS module called 'fake_permissions' that may be installed on this share. This will + allow a Samba administrator to make the directory read only to everyone. Of course this is useful + only after the profile has been properly created. +

    Note

    The above parameters make for a full set of parameters that may define the server's mode -of operation. The following parameters are the essentials alone: - -

    -	workgroup = NARNIA
-	domain logons = Yes
-	domain master = Yes
-	security = User
-

    - -The additional parameters shown in the longer listing above just makes for a -more complete environment. -

    -There are a couple of points to emphasize in the above configuration. -

    • - Encrypted passwords must be enabled. For more details on how - to do this, refer to Account Information Database chapter. -

    • - The server must support domain logons and have a - [netlogon] share -

    • - The server must be the domain master browser in order for Windows - client to locate the server as a DC. Please refer to the various - Network Browsing documentation included with this distribution for - details. -

    Samba ADS Domain Control

    -Samba-3 is not and can not act as an Active Directory Server. It can not truly function as +of operation. The following smb.conf parameters are the essentials alone: +

    +

    netbios name = BELERIAND
    workgroup = MIDEARTH
    domain logons = Yes
    domain master = Yes
    security = User

    +

    +The additional parameters shown in the longer listing above just makes for +more complete explanation. +

    Samba ADS Domain Control

    +Samba-3 is not, and can not act as, an Active Directory Server. It can not truly function as an Active Directory Primary Domain Controller. The protocols for some of the functionality -the Active Directory Domain Controllers is have been partially implemented on an experimental -only basis. Please do NOT expect Samba-3 to support these protocols - nor should you depend -on any such functionality either now or in the future. The Samba-Team may well remove such -experimental features or may change their behaviour. -

    Domain and Network Logon Configuration

    -The subject of Network or Domain Logons is discussed here because it rightly forms +the Active Directory Domain Controllers has been partially implemented on an experimental +only basis. Please do NOT expect Samba-3 to support these protocols. Do not depend +on any such functionality either now or in the future. The Samba-Team may remove these +experimental features or may change their behaviour. This is mentioned for the benefit of those +who have discovered secret capabilities in samba-3 and who have asked when this functionality will be +completed. The answer is: Maybe or maybe never! +

    +To be sure: Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4 style +domain controllers have. Samba-3 does NOT have all the capabilities of Windows NT4, but it does have +a number of features that Windows NT4 domain contollers do not have. In short, Samba-3 is not NT4 and it +is not Windows Server 200x and it is not an Active Directory server. We hope this is plain and simple +enough for all to understand. +

    Domain and Network Logon Configuration

    +The subject of Network or Domain Logons is discussed here because it forms an integral part of the essential functionality that is provided by a Domain Controller. -

    Domain Network Logon Service

    +

    Domain Network Logon Service

    All Domain Controllers must run the netlogon service (domain logons -in Samba). One Domain Controller must be configured with domain master = Yes -(the Primary Domain Controller); on ALL Backup Domain Controllers domain master = No +in Samba). One Domain Controller must be configured with domain master = Yes +(the Primary Domain Controller); on ALL Backup Domain Controllers domain master = No must be set. -

    Example Configuration

    -	[global]
-		domain logons = Yes
-		domain master = (Yes on PDC, No on BDCs)
-
-	[netlogon]
-		comment = Network Logon Service
-		path = /var/lib/samba/netlogon
-		guest ok = Yes
-		browseable = No
-

    The Special Case of MS Windows XP Home Edition

    Note

    +

    Example Configuration

    Example 5.2. smb.conf for being a PDC

    [global]
    domain logons = Yes
    domain master = (Yes on PDC, No on BDCs)
    [netlogon]
    comment = Network Logon Service
    path = /var/lib/samba/netlogon
    guest ok = Yes
    browseable = No

    The Special Case of MS Windows XP Home Edition

    Note

    MS Windows XP Home Edition does not have the ability to join any type of Domain security facility. Unlike, MS Windows 9x / Me, MS Windows XP Home Edition also completely lacks the ability to log onto a network. @@ -364,8 +300,10 @@ MS Windows XP Professional.

    Now that this has been said, please do NOT ask the mailing list, or email any of the Samba-Team members with your questions asking how to make this work. It can't be done. -

    The Special Case of Windows 9x / Me

    -A domain and a workgroup are exactly the same thing in terms of network +If it can be done, then to do so would violate your software license agreement with +Microsoft, and we recommend that you do not do that. +

    The Special Case of Windows 9x / Me

    +A domain and a workgroup are exactly the same in terms of network browsing. The difference is that a distributable authentication database is associated with a domain, for secure login access to a network. Also, different access rights can be granted to users if they @@ -386,7 +324,7 @@ which are the focus of this section. When an SMB client in a domain wishes to logon, it broadcasts requests for a logon server. The first one to reply gets the job, and validates its password using whatever mechanism the Samba administrator has installed. -It is possible (but very stupid) to create a domain where the user +It is possible (but ill advised ) to create a domain where the user database is not shared between servers, i.e. they are effectively workgroup servers advertising themselves as participating in a domain. This demonstrates how authentication is quite different from but closely @@ -437,14 +375,17 @@ The main difference between a PDC and a Windows 9x logon server configuration is

    • Password encryption is not required for a Windows 9x logon server. But note that beginning with MS Windows 98 the default setting is that plain-text - password support has been disabled. It can be re-enabled with the registry + password support is disabled. It can be re-enabled with the registry changes that are documented in the chapter on Policies.

    • Windows 9x/ME clients do not require and do not use machine trust accounts.

    A Samba PDC will act as a Windows 9x logon server; after all, it does provide the network logon services that MS Windows 9x / Me expect to find. -

    Security Mode and Master Browsers

    +

    Note

    +Use of plain-text passwords is strongly discouraged. Where used they are easily detected +using a sniffer tool to examine network traffic. +

    Security Mode and Master Browsers

    There are a few comments to make in order to tie up some loose ends. There has been much debate over the issue of whether or not it is ok to configure Samba as a Domain Controller in security @@ -461,24 +402,25 @@ are two distinctly different functions), it is not a good idea to do so. You should remember that the DC must register the DOMAIN<#1b> NetBIOS name. This is the name used by Windows clients to locate the DC. Windows clients do not distinguish between the DC and the DMB. +A DMB is a Domain Master Browser - see Domain Master Browser. For this reason, it is very wise to configure the Samba DC as the DMB.

    Now back to the issue of configuring a Samba DC to use a mode other -than security = user. If a Samba host is configured to use +than security = user. If a Samba host is configured to use another SMB server or DC in order to validate user connection requests, then it is a fact that some other machine on the network -(the password server) knows more about the user than the Samba host. +(the password server) knows more about the user than the Samba host. 99% of the time, this other host is a domain controller. Now -in order to operate in domain mode security, the workgroup parameter +in order to operate in domain mode security, the workgroup parameter must be set to the name of the Windows NT domain (which already has a domain controller). If the domain does NOT already have a Domain Controller then you do not yet have a Domain!

    Configuring a Samba box as a DC for a domain that already by definition has a PDC is asking for trouble. Therefore, you should always configure the Samba DC -to be the DMB for its domain and set security = user. +to be the DMB for its domain and set security = user. This is the only officially supported mode of operation. -

    Common Problems and Errors

    I cannot include a '$' in a machine name

    +

    Common Errors

    '$' cannot be included in machine name

    A 'machine account', (typically) stored in /etc/passwd, takes the form of the machine name with a '$' appended. FreeBSD (and other BSD systems?) won't create a user with a '$' in their name. @@ -486,24 +428,26 @@ systems?) won't create a user with a '$' in their name. The problem is only in the program used to make the entry. Once made, it works perfectly. Create a user without the '$'. Then use vipw to edit the entry, adding the '$'. Or create the whole entry with vipw if you like; make sure you use a unique User ID! -

    I get told "You already have a connection to the Domain...." +

    Note

    +The UNIX tool vipw is a common tool for directly editting the /etc/passwd file. +

    Joining domain fails because of existing machine account

    “I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.

    +existing set.." when creating a machine trust account.”

    This happens if you try to create a machine trust account from the machine itself and already have a connection (e.g. mapped drive) to a share (or IPC$) on the Samba PDC. The following command will remove all network drive connections: 

    -	C:\WINNT\> net use * /d
+C:\> net use * /d

    Further, if the machine is already a 'member of a workgroup' that is the same name as the domain you are joining (bad idea) you will get this message. Change the workgroup name to something else, it does not matter what, reboot, and try again. -

    The system can not log you on (C000019B)....

    I joined the domain successfully but after upgrading +

    The system can not log you on (C000019B)....

    “I joined the domain successfully but after upgrading to a newer version of the Samba code I get the message, The system can not log you on (C000019B), Please try again or consult your -system administrator when attempting to logon. +system administrator when attempting to logon.”

    This occurs when the domain SID stored in the secrets.tdb database is changed. The most common cause of a change in domain SID is when @@ -518,14 +462,18 @@ The reset or change the domain SID you can use the net command as follows: root# net getlocalsid 'OLDNAME' root# net setlocalsid 'SID'

    -

    The machine trust account for this computer either does not -exist or is not accessible.

    -When I try to join the domain I get the message The machine account +

    +Workstation machine trust accounts work only with the Domain (or network) SID. If this SID changes +then domain members (workstations) will not be able to log onto the domain. The original Domain SID +can be recovered from the secrets.tdb file. The alternative is to visit each workstation to re-join +it to the domain. +

    The machine trust account not accessible

    + “When I try to join the domain I get the message The machine account for this computer either does not exist or is not accessible. What's -wrong? +wrong?”

    This problem is caused by the PDC not having a suitable machine trust account. -If you are using the add machine script method to create +If you are using the add machine script method to create accounts then this would indicate that it has not worked. Ensure the domain admin user system is working.

    @@ -541,10 +489,22 @@ Some people have also reported that inconsistent subnet masks between the Samba server and the NT client can cause this problem. Make sure that these are consistent for both client and server. -

    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.

    +

    Account disabled

    “When I attempt to login to a Samba Domain from a NT4/W2K workstation, + I get a message about my account being disabled.”

    Enable the user accounts with smbpasswd -e username , this is normally done as an account is created. -

    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"

    +

    Domain Controller Unavailable

    “Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"”

    A domain controller has to announce on the network who it is. This usually takes a while. -

    Prev Up Next
    Chapter 4. Server Types and Security Modes Home Chapter 6. Backup Domain Control
    +

    Can not log onto domain member workstation after joining domain

    After successfully joining the domain user logons fail with one of two messages:

    One to the effect that the domain controller can not be found, the other claiming that the + account does not exist in the domain or that the password is incorrect.

    This may be due to incompatible settings between + the Windows client and the Samba-3 server for schannel (secure channel) settings + or smb signing settings. Check your samba settings for + client schannel, server schannel, client signing, server signing by executing: + testparm -v | more and looking for the value of these parameters. +

    + Also use the Microsoft Management Console - Local Security Settings. This tool is available from the + Control Panel. The Policy settings are found in the Local Policies / Securty Options area and are prefixed by + Secure Channel: ..., and Digitally sign .... +

    + It is important that these be set consistently with the Samba-3 server settings. +


    [1] See also the chapter on Account Information Databases.

    [2] See also the chapter about network browsing

    Prev Up Next
    Chapter 4. Server Types and Security Modes Home Chapter 6. Backup Domain Control
    diff --git a/docs/htmldocs/samba.7.html b/docs/htmldocs/samba.7.html index 222bdee995..a0e5b8937c 100644 --- a/docs/htmldocs/samba.7.html +++ b/docs/htmldocs/samba.7.html @@ -57,7 +57,9 @@

    profiles(1)

    profiles is a command-line utility that can be used to replace all occurences of a certain SID with another SID. -

    vfstest(1)

    vfstest is a utility +

    log2pcap(1)

    log2pcap is a utility + for generating pcap trace files from Samba log + files.

    vfstest(1)

    vfstest is a utility that can be used to test vfs modules.

    ntlm_auth(1)

    ntlm_auth is a helper-utility for external programs wanting to do NTLM-authentication.

    smbmount(8), smbumount(8), smbmount(8)

    smbmount,smbmnt and smbmnt are commands that can be used to diff --git a/docs/htmldocs/samba.css b/docs/htmldocs/samba.css new file mode 100644 index 0000000000..3d926e8e74 --- /dev/null +++ b/docs/htmldocs/samba.css @@ -0,0 +1,80 @@ +BODY { + font-family: helvetica, arial, lucida sans, sans-serif; + background-color: white; +} + +H1, H2, H3 { + color: blue; + font-size: 120%; + padding: 2px; + margin-top: 0px; +} + +H1 { + background-color: #EEEEFF; + color: blue; +} + +H2 { + background-color: #DDDDFF; + color: blue; +} + +H3 { + background-color: #CCCCFF; + color: blue; +} + +H4 { + color: blue; +} + +TR.qandadiv TD { + padding-top: 1em; +} + +DIV.navhead { + font-size: 80%; +} + +A:link { + color: #36F; +} + +A:visited { + color: #96C; +} + +A:active { + color: #F63; +} + +TR.question { + color: #33C; + font-weight: bold; +} + +TR.question TD { + padding-top: 1em; +} + +DIV.variablelist { + padding-left: 2em; + color: #33C; +} + +P { + color: black; +} + +DIV.note, DIV.warning, DIV.caution, DIV.tip, DIV.important { + border: dashed 1px; + background-color: #EEEEFF; + width: 40em; +} + +PRE.programlisting, PRE.screen { + border: #630 1px dashed; + color: #630; +} + diff --git a/docs/htmldocs/securing-samba.html b/docs/htmldocs/securing-samba.html index a790816d02..492780765e 100644 --- a/docs/htmldocs/securing-samba.html +++ b/docs/htmldocs/securing-samba.html @@ -1,4 +1,4 @@ -Chapter 15. Securing Samba

    Chapter 15. Securing Samba
    Prev Part III. Advanced Configuration Next

    Chapter 15. Securing Samba

    Andrew Tridgell

    Samba Team

    John H. Terpstra

    Samba Team

    May 26, 2003

    Table of Contents

    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?

    Introduction

    +Chapter 15. Securing Samba

    Chapter 15. Securing Samba
    Prev Part III. Advanced Configuration Next

    Chapter 15. Securing Samba

    Andrew Tridgell

    Samba Team

    John H. Terpstra

    Samba Team

    May 26, 2003

    Table of Contents

    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?

    Introduction

    This note was attached to the Samba 2.2.8 release notes as it contained an important security fix. The information contained here applies to Samba installations in general. @@ -10,7 +10,7 @@ on it!" Security concerns are just like that: You need to know a little about the subject to appreciate how obvious most of it really is. The challenge for most of us is to discover that first morsel of knowledge with which we may unlock the secrets of the masters. -

    Features and Benefits

    +

    Features and Benefits

    There are three level at which security principals must be observed in order to render a site at least moderately secure. These are: the perimeter firewall, the configuration of the host server that is running Samba, and Samba itself. @@ -22,58 +22,50 @@ Samba may be secured from connections that originate from outside the local netw done using host based protection (using samba's implementation of a technology known as "tcpwrappers", or it may be done be using interface based exclusion so that smbd will bind only to specifically permitted interfaces. It is also -possible to set specific share or resource based exclusions, eg: on the IPC$ -auto-share. The IPC$ share is used for browsing purposes as well as to establish +possible to set specific share or resource based exclusions, eg: on the [IPC$] +auto-share. The [IPC$] share is used for browsing purposes as well as to establish TCP/IP connections.

    Another method by which Samba may be secured is by way of setting Access Control Entries in an Access Control List on the shares themselves. This is discussed in the chapter on File, Directory and Share Access Control. -

    Technical Discussion of Protective Measures and Issues

    +

    Technical Discussion of Protective Measures and Issues

    The key challenge of security is the fact that protective measures suffice at best only to close the door on known exploits and breach techniques. Never assume that because you have followed these few measures that the Samba server is now an impenetrable fortress! Given the history of information systems so far, it is only a matter of time before someone will find yet another vulnerability. -

    Using host based protection

    +

    Using host based protection

    In many installations of Samba the greatest threat comes for outside your immediate network. By default Samba will accept connections from any host, which means that if you run an insecure version of Samba on a host that is directly connected to the Internet you can be especially vulnerable.

    - One of the simplest fixes in this case is to use the hosts allow and - hosts deny options in the Samba smb.conf configuration file to only + One of the simplest fixes in this case is to use the hosts allow and + hosts deny options in the Samba smb.conf configuration file to only allow access to your server from a specific range of hosts. An example might be: - 

    -		hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
-		hosts deny = 0.0.0.0/0
-

    +

    hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
    hosts deny = 0.0.0.0/0

    The above will only allow SMB connections from 'localhost' (your own computer) and from the two private networks 192.168.2 and 192.168.3. All other connections will be refused as soon as the client sends its first packet. The refusal will be marked as a not listening on called name error. -

    User based protection

    +

    User based protection

    If you want to restrict access to your server to valid users only then the following - method may be of use. In the smb.conf [globals] section put: - 

    -		valid users = @smbusers, jacko
-

    + method may be of use. In the smb.conf [global] section put: +

    valid users = @smbusers, jacko

    What this does is, it restricts all server access to either the user jacko or to members of the system group smbusers. -

    Using interface protection

    +

    Using interface protection

    By default Samba will accept connections on any network interface that it finds on your system. That means if you have a ISDN line or a PPP connection to the Internet then Samba will accept connections on those links. This may not be what you want.

    You can change this behaviour using options like the following: - 

    -		interfaces = eth* lo
-		bind interfaces only = yes
-

    +

    interfaces = eth* lo
    bind interfaces only = yes

    This tells Samba to only listen for connections on interfaces with a name starting with 'eth' such as eth0, eth1, plus on the loopback interface called 'lo'. The name you will need to use depends on what @@ -85,7 +77,7 @@ before someone will find yet another vulnerability. connection refused reply. In that case no Samba code is run at all as the operating system has been told not to pass connections from that interface to any samba process. -

    Using a firewall

    +

    Using a firewall

    Many people use a firewall to deny access to services that they don't want exposed outside their network. This can be a very good idea, although I would recommend using it in conjunction with the above @@ -98,7 +90,7 @@ before someone will find yet another vulnerability. The last one is important as many older firewall setups may not be aware of it, given that this port was only added to the protocol in recent years. -

    Using a IPC$ share deny

    +

    Using a IPC$ share deny

    If the above methods are not suitable, then you could also place a more specific deny on the IPC$ share that is used in the recently discovered security hole. This allows you to offer access to other @@ -106,11 +98,7 @@ before someone will find yet another vulnerability. hosts.

    To do that you could use: - 

    -[ipc$]
-	hosts allow = 192.168.115.0/24 127.0.0.1
-	hosts deny = 0.0.0.0/0
-

    +

    [ipc$]
    hosts allow = 192.168.115.0/24 127.0.0.1
    hosts deny = 0.0.0.0/0

    this would tell Samba that IPC$ connections are not allowed from anywhere but the two listed places (localhost and a local subnet). Connections to other shares would still be allowed. As the @@ -125,42 +113,44 @@ before someone will find yet another vulnerability.

    This is not recommended unless you cannot use one of the other methods listed above for some reason. -

    NTLMv2 Security

    +

    NTLMv2 Security

    To configure NTLMv2 authentication the following registry keys are worth knowing about:

    - 

    +		
     		[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
 		"lmcompatibilitylevel"=dword:00000003
-
+		
    
+	
    
 		0x3 - Send NTLMv2 response only. Clients will use NTLMv2 authentication,
 		use NTLMv2 session security if the server supports it. Domain
 		controllers accept LM, NTLM and NTLMv2 authentication.
-
+	
    
+		
     		[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
 		"NtlmMinClientSec"=dword:00080000
-
+		
    
+	
    
 		0x80000 - NTLMv2 session security. If either NtlmMinClientSec or
 		NtlmMinServerSec is set to 0x80000, the connection will fail if NTLMv2
 		session security is not negotiated.
-

    -

    Upgrading Samba

    +

    Upgrading Samba

    Please check regularly on http://www.samba.org/ for updates and important announcements. Occasionally security releases are made and it is highly recommended to upgrade Samba when a security vulnerability -is discovered. -

    Common Errors

    +is discovered. Check with your OS vendor for OS specific upgrades. +

    Common Errors

    If all of samba and host platform configuration were really as intuitive as one might like then this section would not be necessary. Security issues are often vexing for a support person to resolve, not because of the complexity of the problem, but for reason that most administrators who post what turns out to be a security problem request are totally convinced that the problem is with Samba. -

    Smbclient works on localhost, but the network is dead

    +

    Smbclient works on localhost, but the network is dead

    This is a very common problem. Red Hat Linux (as do others) will install a default firewall. With the default firewall in place only traffic on the loopback adapter (IP address 127.0.0.1) will be allowed through the firewall.

    The solution is either to remove the firewall (stop it) or to modify the firewall script to allow SMB networking traffic through. See section above in this chapter. -

    Why can users access home directories of other users?

    +

    Why can users access home directories of other users?

    “ We are unable to keep individual users from mapping to any other user's home directory once they have supplied a valid password! They only need @@ -189,18 +179,14 @@ out to be a security problem request are totally convinced that the problem is w the policies and permissions he or she desires.

    Samba does allow the setup you require when you have set the - only user = yes option on the share, is that you have not set the + only user = yes option on the share, is that you have not set the valid users list for the share.

    Note that only user works in conjunction with the users= list, so to get the behavior you require, add the line : - 

    -	users = %S
-

    +

    users = %S

    this is equivalent to: - 

    -	valid users = %S
-

    +

    valid users = %S

    to the definition of the [homes] share, as recommended in the smb.conf man page. -

    Prev Up Next
    Chapter 14. File and Record Locking Home Chapter 16. Interdomain Trust Relationships
    +

    Prev Up Next
    Chapter 14. File and Record Locking Home Chapter 16. Interdomain Trust Relationships
    diff --git a/docs/htmldocs/smb.conf.5.html b/docs/htmldocs/smb.conf.5.html index f22afa5884..b6eb609bb0 100644 --- a/docs/htmldocs/smb.conf.5.html +++ b/docs/htmldocs/smb.conf.5.html @@ -21,7 +21,7 @@ values, but is preserved in string values. Some items such as create modes are numeric.

    SECTION DESCRIPTIONS

    Each section in the configuration file (except for the [global] section) describes a shared resource (known - as a "share"). The section name is the name of the + as a "share"). The section name is the name of the shared resource and the parameters within the section define the shares attributes.

    There are three special sections, [global], [homes] and [printers], which are @@ -38,14 +38,14 @@ privileges in this case.

    Sections other than guest services will require a password to access them. The client provides the username. As older clients only provide passwords and not usernames, you may specify a list - of usernames to check against the password using the "user =" + of usernames to check against the password using the "user =" option in the share definition. For modern clients such as Windows 95/98/ME/NT/2000, this should not be necessary.

    Note that the access rights granted by the server are masked by the access rights granted to the specified or guest UNIX user by the host system. The server does not grant more access than the host system grants.

    The following sample section defines a file space share. The user has write access to the path /home/bar. - The share is accessed via the share name "foo":

    +	The share is accessed via the share name "foo":
     
 [foo]
 	path = /home/bar
@@ -83,7 +83,7 @@
 		for your PCs than for UNIX access.
    This is a fast and simple way to give a large number 
 		of clients access to their home directories with a minimum 
 		of fuss.
    A similar process occurs if the requested section 
-		name is "homes", except that the share name is not 
+		name is "homes", except that the share name is not 
 		changed to that of the requesting user. This method of using
 		the [homes] section works well if different users share 
 		a client PC.
    The [homes] section can specify all the parameters 
@@ -147,8 +147,8 @@ alias|alias|alias|alias...
 		components (if there are more than one) are separated by vertical 
 		bar symbols ('|').
    Note
    On SYSV systems which use lpstat to determine what 
 		printers are defined on the system you may be able to use
-		"printcap name = lpstat" to automatically obtain a list 
-		of printers. See the "printcap name" option 
+		"printcap name = lpstat" to automatically obtain a list 
+		of printers. See the "printcap name" option 
 		for more details.

    PARAMETERS

    parameters define the specific attributes of sections.

    Some parameters are specific to the [global] section (e.g., security). Some parameters are usable in all sections (e.g., create mode). All others @@ -164,16 +164,16 @@ alias|alias|alias|alias... not create best bedfellows, but at least you can find them! Where there are synonyms, the preferred synonym is described, others refer to the preferred synonym.

    VARIABLE SUBSTITUTIONS

    Many of the strings that are settable in the config file - can take substitutions. For example the option "path = - /tmp/%u" would be interpreted as "path = - /tmp/john" if the user connected with the username john.

    These substitutions are mostly noted in the descriptions below, + can take substitutions. For example the option "path = + /tmp/%u" would be interpreted as "path = + /tmp/john" if the user connected with the username john.

    These substitutions are mostly noted in the descriptions below, but there are some general substitutions which apply whenever they might be relevant. These are:

    %U

    session user name (the user name that the client wanted, not necessarily the same as the one they got).

    %G

    primary group name of %U.

    %h

    the Internet hostname that Samba is running on.

    %m

    the NetBIOS name of the client machine (very useful).

    %L

    the NetBIOS name of the server. This allows you to change your config based on what the client calls you. Your - server can have a "dual personality".

    Note that this parameter is not available when Samba listens + server can have a "dual personality".

    Note that this parameter is not available when Samba listens on port 445, as clients no longer send this information

    %M

    the Internet name of the client machine.

    %R

    the selected protocol level after protocol negotiation. It can be one of CORE, COREPLUS, @@ -182,7 +182,7 @@ alias|alias|alias|alias... machine. Only some are recognized, and those may not be 100% reliable. It currently recognizes Samba, WfWg, Win95, WinNT and Win2k. Anything else will be known as - "UNKNOWN". If it gets it wrong then sending a level + "UNKNOWN". If it gets it wrong then sending a level 3 log to samba@samba.org should allow it to be fixed.

    %I

    The IP address of the client machine.

    %T

    the current date and time.

    %D

    Name of the domain or workgroup of the current user.

    %$(envvar)

    The value of the environment variable envar.

    The following substitutes apply only to some configuration options(only those @@ -193,33 +193,33 @@ alias|alias|alias|alias... not compiled Samba with the --with-automount option then this value will be the same as %L.

    %p

    the path of the service's home directory, obtained from your NIS auto.map entry. The NIS auto.map entry - is split up as "%N:%p".

    There are some quite creative things that can be done - with these substitutions and other smb.conf options.

    NAME MANGLING

    Samba supports "name mangling" so that DOS and + is split up as "%N:%p".

    There are some quite creative things that can be done + with these substitutions and other smb.conf options.

    NAME MANGLING

    Samba supports "name mangling" so that DOS and Windows clients can use files that don't conform to the 8.3 format. It can also be set to adjust the case of 8.3 format filenames.

    There are several options that control the way mangling is performed, and they are grouped here rather than listed separately. For the defaults look at the output of the testparm program.

    All of these options can be set separately for each service (or globally, of course).

    The options are:

    mangle case = yes/no

    controls if names that have characters that - aren't of the "default" case are mangled. For example, - if this is yes then a name like "Mail" would be mangled. + aren't of the "default" case are mangled. For example, + if this is yes then a name like "Mail" would be mangled. Default no.

    case sensitive = yes/no

    controls whether filenames are case sensitive. If they aren't then Samba must do a filename search and match on passed names. Default no.

    default case = upper/lower

    controls what the default case is for new filenames. Default lower.

    preserve case = yes/no

    controls if new files are created with the case that the client passes, or if they are forced to be the - "default" case. Default yes. + "default" case. Default yes.

    short preserve case = yes/no

    controls if new files which conform to 8.3 syntax, that is all in upper case and of suitable length, are created - upper case, or if they are forced to be the "default" - case. This option can be use with "preserve case = yes" + upper case, or if they are forced to be the "default" + case. This option can be use with "preserve case = yes" to permit long filenames to retain their case, while short names are lowercased. Default yes.

    By default, Samba 3.0 has the same semantics as a Windows NT server, in that it is case insensitive but case preserving.

    NOTE ABOUT USERNAME/PASSWORD VALIDATION

    There are a number of ways in which a user can connect to a service. The server uses the following steps in determining if it will allow a connection to a specified service. If all the steps fail, then the connection request is rejected. However, if one of the - steps succeeds, then the following steps are not checked.

    If the service is marked "guest only = yes" and the - server is running with share-level security ("security = share") + steps succeeds, then the following steps are not checked.

    If the service is marked "guest only = yes" and the + server is running with share-level security ("security = share") then steps 1 to 5 are skipped.

    1. If the client has passed a username/password pair and that username/password pair is validated by the UNIX system's password programs then the connection is made as that @@ -232,23 +232,28 @@ alias|alias|alias|alias... they match then the connection is allowed as the corresponding user.

    2. If the client has previously validated a username/password pair with the server and the client has passed - the validation token then that username is used.

    3. If a "user = " field is given in the + the validation token then that username is used.

    4. If a "user = " field is given in the smb.conf file for the service and the client has supplied a password, and that password matches (according to the UNIX system's password checking) with one of the usernames - from the "user =" field then the connection is made as - the username in the "user =" line. If one - of the username in the "user =" list begins with a + from the "user =" field then the connection is made as + the username in the "user =" line. If one + of the username in the "user =" list begins with a '@' then that name expands to a list of names in the group of the same name.

    5. If the service is a guest service then a - connection is made as the username given in the "guest - account =" for the service, irrespective of the + connection is made as the username given in the "guest + account =" for the service, irrespective of the supplied password.

    COMPLETE LIST OF GLOBAL PARAMETERS

    Here is a list of all global parameters. See the section of - each parameter for details. Note that some are synonyms.

    COMPLETE LIST OF SERVICE PARAMETERS

    Here is a list of all service parameters. See the section on - each parameter for details. Note that some are synonyms.

    EXPLANATION OF EACH PARAMETER

    abort shutdown script (G)

    This parameter only exists in the HEAD cvs branch + each parameter for details. Note that some are synonyms.

    COMPLETE LIST OF SERVICE PARAMETERS

    Here is a list of all service parameters. See the section on + each parameter for details. Note that some are synonyms.

    EXPLANATION OF EACH PARAMETER

    abort shutdown script (G)

    This parameter only exists in the HEAD cvs branch This a full path name to a script called by smbd(8) that should stop a shutdown procedure issued by the - shutdown script.

    This command will be run as user.

    Default: None.

    Example: abort shutdown script = /sbin/shutdown -c

    add group script (G)

    This is the full pathname to a script that will be run + shutdown script.

    This command will be run as user.

    Default: None.

    Example: abort shutdown script = /sbin/shutdown -c

    acl compatibility (S)

    This parameter specifies what OS ACL semantics should + be compatible with. Possible values are winnt for Windows NT 4, + win2k for Windows 2000 and above and auto. + If you specify auto, the value for this parameter + will be based upon the version of the client. There should + be no reason to change this parameter from the default.

    Default: acl compatibility = Auto

    Example: acl compatibility = win2k

    add group script (G)

    This is the full pathname to a script that will be run AS ROOT by smbd(8) when a new group is requested. It will expand any %g to the group name passed. This script is only useful for installations using the Windows NT @@ -264,7 +269,7 @@ alias|alias|alias|alias... machines -c Machine -d /dev/null -s /bin/false %u

    addprinter command (G)

    With the introduction of MS-RPC based printing support for Windows NT/2000 clients in Samba 2.2, The MS Add Printer Wizard (APW) icon is now also available in the - "Printers..." folder displayed a share listing. The APW + "Printers..." folder displayed a share listing. The APW allows for printers to be add remotely to a Samba or Windows NT/2000 print server.

    For a Samba host this means that the printer must be physically added to the underlying printing system. The add @@ -275,15 +280,15 @@ alias|alias|alias|alias... shared by smbd(8).

    The addprinter command is automatically invoked with the following parameter (in order):

    • printer name

    • share name

    • port name

    • driver name

    • location

    • Windows 9x driver location

    All parameters are filled in from the PRINTER_INFO_2 structure sent - by the Windows NT/2000 client with one exception. The "Windows 9x - driver location" parameter is included for backwards compatibility + by the Windows NT/2000 client with one exception. The "Windows 9x + driver location" parameter is included for backwards compatibility only. The remaining fields in the structure are generated from answers to the APW questions.

    Once the addprinter command has been executed, smbd will reparse the smb.conf to determine if the share defined by the APW exists. If the sharename is still invalid, then smbd will return an ACCESS_DENIED error to the client.

    - The "add printer command" program can output a single line of text, + The "add printer command" program can output a single line of text, which Samba will set as the port the new printer is connected to. If this line isn't output, Samba won't reload its printer shares.

    See also @@ -322,7 +327,7 @@ alias|alias|alias|alias... created for all users accessing files on this server. For sites that use Windows NT account databases as their primary user database creating these users and keeping the user list in sync with the - Windows NT PDC is an onerous task. This option allows smbd to create the required UNIX users + Windows NT PDC is an onerous task. This option allows smbd to create the required UNIX users ON DEMAND when a user accesses the Samba server.

    In order to use this option, smbd(8) must NOT be set to security = share and add user script must be set to a full pathname for a script that will create a UNIX @@ -367,7 +372,7 @@ alias|alias|alias|alias... security option is set to server or domain. If it is set to no, then attempts to connect to a resource from - a domain or workgroup other than the one which smbd is running + a domain or workgroup other than the one which smbd is running in will fail, even if that domain is trusted by the remote server doing the authentication.

    This is useful if you only want your Samba server to serve resources to users in the domain it is a member of. As @@ -378,8 +383,8 @@ alias|alias|alias|alias... Samba server even if they do not have an account in DOMA. This can make implementing a security boundary difficult.

    Default: allow trusted domains = yes

    announce as (G)

    This specifies what type of server nmbd(8) will announce itself as, to a network neighborhood browse list. By default this is set to Windows NT. The valid options - are : "NT Server" (which can also be written as "NT"), - "NT Workstation", "Win95" or "WfW" meaning Windows NT Server, + are : "NT Server" (which can also be written as "NT"), + "NT Workstation", "Win95" or "WfW" meaning Windows NT Server, Windows NT Workstation, Windows 95 and Windows for Workgroups respectively. Do not change this parameter unless you have a specific need to stop Samba appearing as an NT server as this @@ -402,7 +407,7 @@ alias|alias|alias|alias... method of authentication for remote domain users; deprecated in favour of winbind method), trustdomain (authenticate trusted users by contacting the remote DC directly from smbd; deprecated in favour of winbind method).

    Default: auth methods = <empty string>

    Example: auth methods = guest sam winbind

    auto services (G)

    This is a synonym for the - preload.

    available (S)

    This parameter lets you "turn off" a service. If + preload.

    available (S)

    This parameter lets you "turn off" a service. If available = no, then ALL attempts to connect to the service will fail. Such failures are logged.

    Default: available = yes

    bind interfaces only (G)

    This global parameter allows the Samba admin @@ -410,7 +415,7 @@ alias|alias|alias|alias... affects file service smbd(8) and name service nmbd(8) in a slightly different ways.

    For name service it causes nmbd to bind to ports 137 and 138 on the interfaces listed in the interfaces parameter. nmbd also - binds to the "all addresses" interface (0.0.0.0) + binds to the "all addresses" interface (0.0.0.0) on ports 137 and 138 for the purposes of reading broadcast messages. If this option is not set then nmbd will service name requests on all of these sockets. If bind interfaces @@ -447,7 +452,7 @@ alias|alias|alias|alias... 127.0.0.1 to determine if they are running. Not adding 127.0.0.1 will cause smbd and nmbd to always show - "not running" even if they really are. This can prevent + "not running" even if they really are. This can prevent swat from starting/stopping/restarting smbd and nmbd.

    Default: bind interfaces only = no

    blocking locks (S)

    This parameter controls the behavior of smbd(8) when given a request by a client @@ -474,7 +479,7 @@ alias|alias|alias|alias... a client doing a NetServerEnum call. Normally set to yes. You should never need to change this.

    Default: browse list = yes

    case sensitive (S)

    See the discussion in the section NAME MANGLING.

    Default: case sensitive = no

    casesignames (S)

    Synonym for case sensitive.

    change notify timeout (G)

    This SMB allows a client to tell a server to - "watch" a particular directory for any changes and only reply to + "watch" a particular directory for any changes and only reply to the SMB request when a change has occurred. Such constant scanning of a directory is expensive under UNIX, hence an smbd(8) daemon only performs such a scan on each requested directory once every change notify @@ -499,17 +504,49 @@ alias|alias|alias|alias... with the new share.

    This parameter is only used modify existing file shares definitions. To modify - printer shares, use the "Printers..." folder as seen when browsing the Samba host. + printer shares, use the "Printers..." folder as seen when browsing the Samba host.

    See also add share command, delete share command. -

    Default: none

    Example: change share command = /usr/local/bin/addshare

    client use spnego (G)

    This variable controls controls whether samba clients will try +

    Default: none

    Example: change share command = /usr/local/bin/addshare

    client lanman auth (G)

    This parameter determines whether or not smbclient(8) and other samba client + tools will attempt to authenticate itself to servers using the + weaker LANMAN password hash. If disabled, only server which support NT + password hashes (e.g. Windows NT/2000, Samba, etc... but not + Windows 95/98) will be able to be connected from the Samba client.

    The LANMAN encrypted response is easily broken, due to it's + case-insensitive nature, and the choice of algorithm. Clients + without Windows 95/98 servers are advised to disable + this option.

    Disabling this option will also disable the client plaintext auth option

    Likewise, if the client ntlmv2 + auth parameter is enabled, then only NTLMv2 logins will be + attempted. Not all servers support NTLMv2, and most will require + special configuration to us it.

    Default : client lanman auth = yes

    client ntlmv2 auth (G)

    This parameter determines whether or not smbclient(8) will attempt to + authenticate itself to servers using the NTLMv2 encrypted password + response.

    If enabled, only an NTLMv2 and LMv2 response (both much more + secure than earlier versions) will be sent. Many servers + (including NT4 < SP4, Win9x and Samba 2.2) are not compatible with + NTLMv2.

    If disabled, an NTLM response (and possibly a LANMAN response) + will be sent by the client, depending on the value of client lanman auth.

    Note that some sites (particularly + those following 'best practice' security polices) only allow NTLMv2 + responses, and not the weaker LM or NTLM.

    Default : client ntlmv2 auth = no

    client plaintext auth (G)

    Specifies whether a client should send a plaintext + password if the server does not support encrypted passwords.

    Default: client plaintext auth = yes

    client schannel (G)

    This controls whether the client offers or even + demands the use of the netlogon schannel. + client schannel = no does not + offer the schannel, server schannel = + auto offers the schannel but does not + enforce it, and server schannel = + yes denies access if the server is not + able to speak netlogon schannel.

    Default: client schannel = auto

    Example: client schannel = yes

    client signing (G)

    This controls whether the client offers or requires + the server it talks to to use SMB signing. Possible values + are auto, mandatory + and disabled. +

    When set to auto, SMB signing is offered, but not enforced. + When set to mandatory, SMB signing is required and if set + to disabled, SMB signing is not offered either.

    Default: client signing = auto

    client use spnego (G)

    This variable controls controls whether samba clients will try to use Simple and Protected NEGOciation (as specified by rfc2478) with WindowsXP and Windows2000 servers to agree upon an authentication mechanism. - SPNEGO client support with Sign and Seal is currently broken, so - you might want to turn this option off when doing joins to - Windows 2003 domains. + SPNEGO client support for SMB Signing is currently broken, so + you might want to turn this option off when operating with + Windows 2003 domain controllers in particular.

    Default: client use spnego = yes

    comment (S)

    This is a text field that is seen next to a share when a client does a queries the server, either via the network neighborhood or via net view to list what shares @@ -523,7 +560,7 @@ alias|alias|alias|alias... the new config file.

    This option takes the usual substitutions, which can be very useful.

    If the config file doesn't exist then it won't be loaded (allowing you to special case the config files of just a few - clients).

    Example: config file = /usr/local/samba/lib/smb.conf.%m

    copy (S)

    This parameter allows you to "clone" service + clients).

    Example: config file = /usr/local/samba/lib/smb.conf.%m

    copy (S)

    This parameter allows you to "clone" service entries. The specified service is simply duplicated under the current service's name. Any parameters specified in the current section will override those in the section being copied.

    This feature lets you set up a 'template' service and @@ -556,7 +593,7 @@ alias|alias|alias|alias... policy, and specifies how clients capable of offline caching will cache the files in the share. The valid values are: manual, documents, programs, disable.

    These values correspond to those used on Windows servers.

    For example, shares containing roaming profiles can have - offline caching disabled using csc policy = disable.

    Default: csc policy = manual

    Example: csc policy = programs

    dead time (G)

    The value of the parameter (a decimal integer) + offline caching disabled using csc policy = disable.

    Default: csc policy = manual

    Example: csc policy = programs

    deadtime (G)

    The value of the parameter (a decimal integer) represents the number of minutes of inactivity before a connection is considered dead, and it is disconnected. The deadtime only takes effect if the number of open files is zero.

    This is useful to stop a server's resources being @@ -569,7 +606,7 @@ alias|alias|alias|alias... boolean parameter adds microsecond resolution to the timestamp message header when turned on.

    Note that the parameter debug timestamp must be on for this to have an - effect.

    Default: debug hires timestamp = no

    debug level (G)

    Synonym for + effect.

    Default: debug hires timestamp = no

    debuglevel (G)

    Synonym for log level.

    debug pid (G)

    When using only one log file for more then one forked smbd(8)-process there may be hard to follow which process outputs which message. This boolean parameter @@ -619,8 +656,8 @@ alias|alias|alias|alias... read-only service.

    Also note that the apparent service name will be changed to equal that of the requested service, this is very useful as it allows you to use macros like %S to make - a wildcard service.

    Note also that any "_" characters in the name of the service - used in the default service will get mapped to a "/". This allows for + a wildcard service.

    Note also that any "_" characters in the name of the service + used in the default service will get mapped to a "/". This allows for interesting things.

    Example:

     [global]
 	default service = pub
@@ -641,7 +678,7 @@ alias|alias|alias|alias...
     from the print system and from smb.conf.
     
    The deleteprinter command is 
     automatically called with only one parameter: 
-    "printer name".
    Once the deleteprinter command has 
+    "printer name".
    Once the deleteprinter command has 
     been executed, smbd will reparse the 
     smb.conf to associated printer no longer exists.  
     If the sharename is still valid, then smbd
@@ -703,8 +740,8 @@ alias|alias|alias|alias...
 	should only be used on systems where a problem occurs with the
 	internal disk space calculations. This has been known to happen
 	with Ultrix, but may occur with other operating systems. The
-	symptom that was seen was an error of "Abort Retry
-	Ignore" at the end of each directory listing.
    This setting allows the replacement of the internal routines to
+	symptom that was seen was an error of "Abort Retry
+	Ignore" at the end of each directory listing.
    This setting allows the replacement of the internal routines to
 	calculate the total disk space and amount available with an external
 	routine. The example below gives a possible script that might fulfill
 	this function.
    The external program will be passed a single parameter indicating 
@@ -718,10 +755,10 @@ alias|alias|alias|alias...
 	determining the disk capacity and remaining space will be used.
 	
    Example: dfree command = /usr/local/samba/bin/dfree
    Where the script dfree (which must be made executable) could be:
     
 #!/bin/sh
-df $1 | tail -1 | awk '{print $2" "$4}'
+df $1 | tail -1 | awk '{print $2" "$4}'
 
    or perhaps (on Sys V based systems):
     
 #!/bin/sh
-/usr/bin/df -k $1 | tail -1 | awk '{print $3" "$5}'
+/usr/bin/df -k $1 | tail -1 | awk '{print $3" "$5}'
 
    Note that you may have to replace the command names with full path names on some systems.
    directory (S)

    Synonym for path.

    directory mask (S)

    This parameter is the octal modes which are used when converting DOS modes to UNIX modes when creating UNIX directories.

    When a directory is created, the necessary permissions are @@ -756,7 +793,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' meaning a user is allowed to modify all the user/group/world permissions on a directory.

    Note that users who can access the Samba server through other means can easily bypass this restriction, - so it is primarily useful for standalone "appliance" systems. + so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will probably want to leave it as the default of 0777.

    See also the force directory security mode, @@ -820,7 +857,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' of interest to clients or are infinitely deep (recursive). This parameter allows you to specify a comma-delimited list of directories that the server should always show as empty.

    Note that Samba can be very fussy about the exact format - of the "dont descend" entries. For example you may need + of the "dont descend" entries. For example you may need ./proc instead of just /proc. Experimentation is the best policy :-)

    Default: none (i.e., all directories are OK to descend)

    Example: dont descend = /proc,/dev

    dos charset (G)

    DOS SMB clients assume the server has @@ -857,11 +894,18 @@ df $1 | tail -1 | awk '{print $2" "$4}' timestamp on a file if the user smbd is acting on behalf of is not the file owner. Setting this option to yes allows DOS semantics and smbd(8) will change the file - timestamp as DOS requires.

    Default: dos filetimes = no

    encrypt passwords (G)

    This boolean controls whether encrypted passwords + timestamp as DOS requires.

    Default: dos filetimes = no

    enable rid algorithm (G)

    This option is used to control whether or not smbd in Samba 3.0 should fallback + to the algorithm used by Samba 2.2 to generate user and group RIDs. The longterm + development goal is to remove the algorithmic mappings of RIDs altogether, but + this has proved to be difficult. This parameter is mainly provided so that + developers can turn the algorithm on and off and see what breaks. This parameter + should not be disabled by non-developers because certain features in Samba will fail + to work without it. +

    Default: enable rid algorithm = <yes>

    encrypt passwords (G)

    This boolean controls whether encrypted passwords will be negotiated with the client. Note that Windows NT 4.0 SP3 and above and also Windows 98 will by default expect encrypted passwords unless a registry entry is changed. To use encrypted passwords in - Samba see the chapter "User Database" in the Samba HOWTO Collection.

    In order for encrypted passwords to work correctly + Samba see the chapter "User Database" in the Samba HOWTO Collection.

    In order for encrypted passwords to work correctly smbd(8) must either have access to a local smbpasswd(5) file (see the smbpasswd(8) program for information on how to set up and maintain this file), or set the security = [server|domain|ads] parameter which @@ -877,16 +921,16 @@ df $1 | tail -1 | awk '{print $2" "$4}' workgroups not disappearing from browse lists. Due to the restrictions of the browse protocols these enhancements can cause a empty workgroup to stay around forever which can be annoying.

    In general you should leave this option enabled as it makes - cross-subnet browse propagation much more reliable.

    Default: enhanced browsing = yes

    enumports command (G)

    The concept of a "port" is fairly foreign + cross-subnet browse propagation much more reliable.

    Default: enhanced browsing = yes

    enumports command (G)

    The concept of a "port" is fairly foreign to UNIX hosts. Under Windows NT/2000 print servers, a port is associated with a port monitor and generally takes the form of a local port (i.e. LPT1:, COM1:, FILE:) or a remote port (i.e. LPD Port Monitor, etc...). By default, Samba has only one - port defined--"Samba Printer Port". Under + port defined--"Samba Printer Port". Under Windows NT/2000, all printers must have a valid port name. If you wish to have a list of ports displayed (smbd does not use a port name for anything) other than - the default "Samba Printer Port", you + the default "Samba Printer Port", you can define enumports command to point to a program which should generate a list of ports, one per line, to standard output. This listing will then be used in response @@ -968,7 +1012,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' allows a user to modify all the user/group/world permissions on a directory without restrictions.

    Note that users who can access the Samba server through other means can easily bypass this restriction, - so it is primarily useful for standalone "appliance" systems. + so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will probably want to leave it set as 0000.

    See also the directory security mask, @@ -1005,7 +1049,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' and allows a user to modify all the user/group/world permissions on a file, with no restrictions.

    Note that users who can access the Samba server through other means can easily bypass this restriction, - so it is primarily useful for standalone "appliance" systems. + so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will probably want to leave this set to 0000.

    See also the force directory security mode, @@ -1017,7 +1061,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' as using it incorrectly can cause security problems.

    This user name only gets used once a connection is established. Thus clients still need to connect as a valid user and supply a valid password. Once connected, all file operations will be performed - as the "forced user", no matter what username the client connected + as the "forced user", no matter what username the client connected as. This can be very useful.

    In Samba 2.0.5 and above this parameter also causes the primary group of the forced user to be used as the primary group for all file activity. Prior to 2.0.5 the primary group was left @@ -1027,7 +1071,13 @@ df $1 | tail -1 | awk '{print $2" "$4}' for a share. The default type is NTFS for compatibility with Windows NT but this can be changed to other strings such as Samba or FAT - if required.

    Default: fstype = NTFS

    Example: fstype = Samba

    getwd cache (G)

    This is a tuning option. When this is enabled a + if required.

    Default: fstype = NTFS

    Example: fstype = Samba

    get quota command (G)

    The get quota command should only be used + whenever there is no operating system API available from the OS that + samba can use.

    This parameter should specify the path to a script that + queries the quota information for the specified + user/group for the partition that + the specified directory is on.

    Such a script should take 3 arguments:

    • directory

    • type of query

    • uid of user or gid of group

    The type of query can be one of :

    • 1 - user quotas

    • 2 - user default quotas (uid = -1)

    • 3 - group quotas

    • 4 - group default quotas (gid = -1)

    This script should print its output according to the following format:

    • Line 1 - quota flags (0 = no quotas, 1 = quotas enabled, 2 = quotas enabled and enforced)

    • Line 2 - number of currently used blocks

    • Line 3 - the softlimit number of blocks

    • Line 4 - the hardlimit number of blocks

    • Line 5 - currently used number of inodes

    • Line 6 - the softlimit number of inodes

    • Line 7 - the hardlimit number of inodes

    • Line 8(optional) - the number of bytes in a block(default is 1024)

    See also the set quota command parameter. +

    Default: get quota command =

    Example: get quota command = /usr/local/sbin/query_quota

    getwd cache (G)

    This is a tuning option. When this is enabled a caching algorithm will be used to reduce the time taken for getwd() calls. This can have a significant impact on performance, especially when the wide links @@ -1037,17 +1087,17 @@ df $1 | tail -1 | awk '{print $2" "$4}' guest ok (see below). Whatever privileges this user has will be available to any client connecting to the guest service. Typically this user will exist in the password file, but will not - have a valid login. The user account "ftp" is often a good choice + have a valid login. The user account "ftp" is often a good choice for this parameter. If a username is specified in a given service, the specified username overrides this one. -

    One some systems the default guest account "nobody" may not +

    One some systems the default guest account "nobody" may not be able to print. Use another account in this case. You should test this by trying to log in as your guest user (perhaps by using the su - command) and trying to print using the system print command such as lpr(1) or lp(1).

    This parameter does not accept % macros, because many parts of the system require this value to be - constant for correct operation.

    Default: specified at compile time, usually "nobody"

    Example: guest account = ftp

    guest ok (S)

    If this parameter is yes for + constant for correct operation.

    Default: specified at compile time, usually "nobody"

    Example: guest account = ftp

    guest ok (S)

    If this parameter is yes for a service, then no password is required to connect to the service. Privileges will be those of the guest account.

    This paramater nullifies the benifits of setting @@ -1102,7 +1152,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' to browse Dfs trees hosted on the server.

    See also the msdfs root share level parameter. For more information on setting up a Dfs tree on Samba, - refer to msdfs_setup.html. + refer to ???.

    Default: host msdfs = no

    hostname lookups (G)

    Specifies whether samba should use (expensive) hostname lookups or use the ip addresses instead. An example place where hostname lookups are currently used is when checking @@ -1122,7 +1172,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' hosts deny option.

    You can also specify hosts by network/netmask pairs and by netgroup names if your system supports netgroups. The EXCEPT keyword can also be used to limit a - wildcard list. The following examples may provide some help:

    Example 1: allow all IPs in 150.203.*.*; except one

    hosts allow = 150.203. EXCEPT 150.203.6.66

    Example 2: allow hosts that match the given network/netmask

    hosts allow = 150.203.15.0/255.255.255.0

    Example 3: allow a couple of hosts

    hosts allow = lapland, arvidsjaur

    Example 4: allow only hosts in NIS netgroup "foonet", but + wildcard list. The following examples may provide some help:

    Example 1: allow all IPs in 150.203.*.*; except one

    hosts allow = 150.203. EXCEPT 150.203.6.66

    Example 2: allow hosts that match the given network/netmask

    hosts allow = 150.203.15.0/255.255.255.0

    Example 3: allow a couple of hosts

    hosts allow = lapland, arvidsjaur

    Example 4: allow only hosts in NIS netgroup "foonet", but deny access from one particular host

    hosts allow = @foonet

    hosts deny = pirate

    Note

    Note that access still requires suitable user-level passwords.

    See testparm(1) for a way of testing your host access to see if it does what you expect.

    Default: none (i.e., all hosts permitted access)

    Example: allow hosts = 150.203.5. myhost.mynet.edu.au

    hosts deny (S)

    The opposite of hosts allow - hosts listed here are NOT permitted access to @@ -1142,7 +1192,13 @@ df $1 | tail -1 | awk '{print $2" "$4}' hosts equiv option be only used if you really know what you are doing, or perhaps on a home network where you trust your spouse and kids. And only if you really trust - them :-).

    Default: no host equivalences

    Example: hosts equiv = /etc/hosts.equiv

    idmap gid (G)

    The idmap gid parameter specifies the range of group ids that are allocated for + them :-).

    Default: no host equivalences

    Example: hosts equiv = /etc/hosts.equiv

    idmap backend (G)

    + The purpose of the idmap backend parameter is to allow idmap to NOT use the local idmap + tdb file to obtain SID to UID / GID mappings, but instead to obtain them from a common + LDAP backend. This way all domain members and controllers will have the same UID and GID + to SID mappings. This avoids the risk of UID / GID inconsistencies across UNIX / Linux + systems that are sharing information over protocols other than SMB/CIFS (ie: NFS). +

    Default: idmap backend = <empty string>

    Example: idmap backend = ldap:ldap://ldapslave.example.com

    idmap gid (G)

    The idmap gid parameter specifies the range of group ids that are allocated for the purpose of mapping UNX groups to NT group SIDs. This range of group ids should have no existing local or NIS groups within it as strange conflicts can occur otherwise.

    The availability of an idmap gid range is essential for correct operation of all group mapping.

    Default: idmap gid = <empty string>

    Example: idmap gid = 10000-20000

    idmap uid (G)

    The idmap uid parameter specifies the range of user ids that are allocated for use @@ -1185,11 +1241,11 @@ df $1 | tail -1 | awk '{print $2" "$4}' interfaces except 127.0.0.1 that are broadcast capable.

    The option takes a list of interface strings. Each string can be in any of the following forms:

    • a network interface name (such as eth0). This may include shell-like wildcards so eth* will match - any interface starting with the substring "eth"

    • an IP address. In this case the netmask is + any interface starting with the substring "eth"

    • an IP address. In this case the netmask is determined from the list of interfaces obtained from the - kernel

    • an IP/mask pair.

    • a broadcast/mask pair.

    The "mask" parameters can either be a bit length (such + kernel

  • an IP/mask pair.

  • a broadcast/mask pair.

    • The "mask" parameters can either be a bit length (such as 24 for a C class network) or a full netmask in dotted - decimal form.

    The "IP" parameters above can either be a full dotted + decimal form.

    The "IP" parameters above can either be a full dotted decimal IP address or a hostname which will be looked up via the OS's normal hostname resolution mechanisms.

    For example, the following line:

    interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0

    would configure three network interfaces corresponding to the eth0 device and IP addresses 192.168.2.10 and 192.168.3.10. @@ -1218,7 +1274,12 @@ df $1 | tail -1 | awk '{print $2" "$4}' a client is still present and responding.

    Keepalives should, in general, not be needed if the socket being used has the SO_KEEPALIVE attribute set on it (see socket options). - Basically you should only use this option if you strike difficulties.

    Default: keepalive = 300

    Example: keepalive = 600

    kernel oplocks (G)

    For UNIXes that support kernel based + Basically you should only use this option if you strike difficulties.

    Default: keepalive = 300

    Example: keepalive = 600

    kernel change notify (G)

    This parameter specifies whether Samba should ask the + kernel for change notifications in directories so that + SMB clients can refresh whenever the data on the server changes. +

    This parameter is only usd when your kernel supports + change notification to user programs, using the F_NOTIFY fcntl. +

    Default: Yes

    kernel oplocks (G)

    For UNIXes that support kernel based oplocks (currently only IRIX and the Linux 2.4 kernel), this parameter allows the use of them to be turned on or off.

    Kernel oplocks support allows Samba oplocks @@ -1263,7 +1324,12 @@ df $1 | tail -1 | awk '{print $2" "$4}' The default is to match the login name with the uid attribute for all entries matching the sambaAccount objectclass. Note that this filter should only return one entry. -

    Default: ldap filter = (&(uid=%u)(objectclass=sambaAccount))

    ldap machine suffix (G)

    It specifies where machines should be added to the ldap tree.

    Default: none

    ldap passwd sync (G)

    This option is used to define whether +

    Default: ldap filter = (&(uid=%u)(objectclass=sambaAccount))

    ldap group suffix (G)

    This parameters specifies the suffix that is + used for groups when these are added to the LDAP directory. + If this parameter is unset, the value of ldap suffix will be used instead.

    Default: none

    Example: dc=samba,ou=Groups

    ldap idmap suffix (G)

    This parameters specifies the suffix that is + used when storing idmap mappings. If this parameter + is unset, the value of ldap suffix + will be used instead.

    Default: none

    Example: dc=samba,ou=Idmap

    ldap machine suffix (G)

    It specifies where machines should be added to the ldap tree.

    Default: none

    ldap passwd sync (G)

    This option is used to define whether or not Samba should sync the LDAP password with the NT and LM hashes for normal accounts (NOT for workstation, server or domain trusts) on a password @@ -1295,16 +1361,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' tree. Can be overriden by ldap user suffix and ldap machine suffix. It also used as the base dn for all ldap - searches.

    Default: none

    ldap trust ids (G)

    Normally, Samba validates each entry in the LDAP server - against getpwnam(). This allows LDAP to be used for Samba with - the unix system using NIS (for example) and also ensures that - Samba does not present accounts that do not otherwise exist. -

    This option is used to disable this functionality, and - instead to rely on the presence of the appropriate attributes - in LDAP directly, which can result in a significant performance - boost in some situations. Setting this option to yes effectivly - assumes that the local machine is running nss_ldap against the same LDAP - server.

    Default: ldap trust ids = No

    ldap user suffix (G)

    It specifies where users are added to the tree.

    Default: none

    level2 oplocks (S)

    This parameter controls whether Samba supports + searches.

    Default: none

    ldap user suffix (G)

    This parameter specifies where users are added to the tree. + If this parameter is not specified, the value from ldap suffix.

    Default: none

    level2 oplocks (S)

    This parameter controls whether Samba supports level2 (read-only) oplocks on a share.

    Level2, or read-only oplocks allow Windows NT clients that have an oplock on a file to downgrade from a read-write oplock to a read-only oplock once a second client opens the file (instead @@ -1315,7 +1373,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' for many accesses of files that are not commonly written (such as application .EXE files).

    Once one of the clients which have a read-only oplock writes to the file all clients are notified (no reply is needed - or waited for) and told to break their oplocks to "none" and + or waited for) and told to break their oplocks to "none" and delete any read-ahead caches.

    It is recommended that this parameter be turned on to speed access to shared executables.

    For more discussions on level2 oplocks see the CIFS spec.

    Currently, if kernel oplocks are supported then level2 oplocks are @@ -1376,7 +1434,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' in case the lock could later be aquired. This behavior is used to support PC database formats such as MS Access and FoxPro. -

    Default: lock spin count = 2

    lock spin time (G)

    The time in microseconds that smbd should +

    Default: lock spin count = 3

    lock spin time (G)

    The time in microseconds that smbd should pause before attempting to gain a failed lock. See lock spin count for more details.

    Default: lock spin time = 10

    log file (G)

    This option allows you to override the name @@ -1407,14 +1465,14 @@ df $1 | tail -1 | awk '{print $2" "$4}' logon home. This broke net use /home but allowed profiles outside the home directory. The current implementation is correct, and can be used for profiles if you use the above trick.

    This option is only useful if Samba is set up as a logon - server.

    Default: logon home = "\\%N\%U"

    Example: logon home = "\\remote_smb_server\%U"

    logon path (G)

    This parameter specifies the home directory + server.

    Default: logon home = "\\%N\%U"

    Example: logon home = "\\remote_smb_server\%U"

    logon path (G)

    This parameter specifies the home directory where roaming profiles (NTuser.dat etc files for Windows NT) are stored. Contrary to previous versions of these manual pages, it has nothing to do with Win 9X roaming profiles. To find out how to handle roaming profiles for Win 9X system, see the logon home parameter.

    This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine. It also - specifies the directory from which the "Application Data", + specifies the directory from which the "Application Data", (desktop, start menu, network neighborhood, programs and other folders, and their contents, are loaded and displayed on @@ -1443,8 +1501,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' suggested command would be to add NET TIME \\SERVER /SET /YES, to force every machine to synchronize clocks with the same time server. Another use would be to add NET USE - U: \\SERVER\UTILS for commonly used utilities, or - NET USE Q: \\SERVER\ISO9001_QA for example.

    Note that it is particularly important not to allow write + U: \\SERVER\UTILS for commonly used utilities, or 

    +	NET USE Q: \\SERVER\ISO9001_QA

    for example.

    Note that it is particularly important not to allow write access to the [netlogon] share, or to grant users write permission on the batch files in a secure environment, as this would allow the batch files to be arbitrarily modified and security to be @@ -1519,8 +1577,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' parameter.

    Default: depends on the setting of printing

    Example 1: lprm command = /usr/bin/lprm -P%p %j

    Example 2: lprm command = /usr/bin/cancel %p-%j

    machine password timeout (G)

    If a Samba server is a member of a Windows NT Domain (see the security = domain) - parameter) then periodically a running - smbd(8) process will try and change the MACHINE ACCOUNT + parameter) then periodically a running smbd + process will try and change the MACHINE ACCOUNT PASSWORD stored in the TDB called private/secrets.tdb . This parameter specifies how often this password will be changed, in seconds. The default is one week (expressed in @@ -1552,12 +1610,12 @@ df $1 | tail -1 | awk '{print $2" "$4}' you would use:

    mangled map = (*.html *.htm)

    One very useful case is to remove the annoying ;1 off the ends of filenames on some CDROMs (only visible under some UNIXes). To do this use a map of (*;1 *;).

    Default: no mangled map

    Example: mangled map = (*;1 *;)

    mangled names (S)

    This controls whether non-DOS names under UNIX - should be mapped to DOS-compatible names ("mangled") and made visible, + should be mapped to DOS-compatible names ("mangled") and made visible, or whether non-DOS names should simply be ignored.

    See the section on NAME MANGLING for details on how to control the mangling process.

    If mangling is used then the mangling algorithm is as follows:

    • The first (up to) five alphanumeric characters before the rightmost dot of the filename are preserved, forced to upper case, and appear as the first (up to) five characters - of the mangled name.

    • A tilde "~" is appended to the first part of the mangled + of the mangled name.

    • A tilde "~" is appended to the first part of the mangled name, followed by a two-character unique sequence, based on the original root name (i.e., the original filename minus its final extension). The final extension is included in the hash calculation @@ -1569,9 +1627,9 @@ df $1 | tail -1 | awk '{print $2" "$4}' extension of the mangled name. The final extension is defined as that part of the original filename after the rightmost dot. If there are no dots in the filename, the mangled name will have no extension (except - in the case of "hidden files" - see below).

    • Files whose UNIX name begins with a dot will be + in the case of "hidden files" - see below).

    • Files whose UNIX name begins with a dot will be presented as DOS hidden files. The mangled name will be created as - for other filenames, but with the leading dot removed and "___" as + for other filenames, but with the leading dot removed and "___" as its extension regardless of actual original extension (that's three underscores).

    The two-digit hash value consists of upper case alphanumeric characters.

    This algorithm can cause name collisions only if files in a directory share the same first five alphanumeric characters. @@ -1579,7 +1637,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' copied between UNIX directories from Windows/DOS while retaining the long UNIX filename. UNIX files can be renamed to a new extension from Windows/DOS and will retain the same basename. Mangled names - do not change between sessions.

    Default: mangled names = yes

    mangling stack (G)

    This parameter controls the number of mangled names + do not change between sessions.

    Default: mangled names = yes

    mangled stack (G)

    This parameter controls the number of mangled names that should be cached in the Samba server smbd(8).

    This stack is a list of recently mangled base names (extensions are only maintained if they are longer than 3 characters or contains upper case characters).

    The larger this value, the more likely it is that mangled @@ -1587,17 +1645,19 @@ df $1 | tail -1 | awk '{print $2" "$4}' However, large stack sizes will slow most directory accesses. Smaller stacks save memory in the server (each stack element costs 256 bytes).

    It is not possible to absolutely guarantee correct long - filenames, so be prepared for some surprises!

    Default: mangled stack = 50

    Example: mangled stack = 100

    mangling prefix (G)

    controls the number of prefix + filenames, so be prepared for some surprises!

    Default: mangled stack = 50

    Example: mangled stack = 100

    mangle prefix (G)

    controls the number of prefix characters from the original name used when generating the mangled names. A larger value will give a weaker hash and therefore more name collisions. The minimum - value is 1 and the maximum value is 6.

    Default: mangle prefix = 1

    Example: mangle prefix = 4

    mangling char (S)

    This controls what character is used as + value is 1 and the maximum value is 6.

    + mangle prefix is effective only when mangling method is hash2. +

    Default: mangle prefix = 1

    Example: mangle prefix = 4

    mangling char (S)

    This controls what character is used as the magic character in name mangling. The default is a '~' but this may interfere with some software. Use this option to set - it to whatever you prefer.

    Default: mangling char = ~

    Example: mangling char = ^

    mangling method (G)

    controls the algorithm used for the generating - the mangled names. Can take two different values, "hash" and - "hash2". "hash" is the default and is the algorithm that has been - used in Samba for many years. "hash2" is a newer and considered + it to whatever you prefer. This is effective only when mangling method is hash.

    Default: mangling char = ~

    Example: mangling char = ^

    mangling method (G)

    controls the algorithm used for the generating + the mangled names. Can take two different values, "hash" and + "hash2". "hash" is the default and is the algorithm that has been + used in Samba for many years. "hash2" is a newer and considered a better algorithm (generates less collisions) in the names. However, many Win32 applications store the mangled names and so changing to the new algorithm must not be done @@ -1638,18 +1698,18 @@ df $1 | tail -1 | awk '{print $2" "$4}' with an invalid password are treated as a guest login and mapped into the guest account. Note that this can cause problems as it means that any user incorrectly typing - their password will be silently logged on as "guest" - and + their password will be silently logged on as "guest" - and will not know the reason they cannot access files they think they should - there will have been no message given to them that they got their password wrong. Helpdesk services will hate you if you set the map to - guest parameter this way :-).

    Note that this parameter is needed to set up "Guest" + guest parameter this way :-).

    Note that this parameter is needed to set up "Guest" share services when using security modes other than share. This is because in these modes the name of the resource being requested is not sent to the server until after the server has successfully authenticated the client so the server cannot make authentication decisions at the correct time (connection - to the share) for "Guest" shares.

    For people familiar with the older Samba releases, this + to the share) for "Guest" shares.

    For people familiar with the older Samba releases, this parameter maps to the old compile-time setting of the GUEST_SESSSETUP value in local.h.

    Default: map to guest = Never

    Example: map to guest = Bad User

    max connections (S)

    This option allows the number of simultaneous connections to a service to be limited. If max connections is greater than 0 then connections @@ -1679,8 +1739,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' by the UNIX per-process file descriptor limit rather than this parameter so you should never need to touch this parameter.

    Default: max open files = 10000

    max print jobs (S)

    This parameter limits the maximum number of jobs allowable in a Samba printer queue at any given moment. - If this number is exceeded, smbd(8) will remote "Out of Space" to the client. - See all total + If this number is exceeded, smbd(8) will remote "Out of Space" to the client. + See all total print jobs.

    Default: max print jobs = 1000

    Example: max print jobs = 5000

    max protocol (G)

    The value of the parameter (a string) is the highest protocol level that will be supported by the server.

    Possible values are :

    • CORE: Earliest version. No @@ -1697,7 +1757,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' A value of zero means there is no limit on the number of print jobs reported. - See all total + See all total print jobs and max print jobs parameters.

      Default: max reported print jobs = 0

      Example: max reported print jobs = 1000

    max smbd processes (G)

    This parameter limits the maximum number of smbd(8) processes concurrently running on a system and is intended @@ -1779,16 +1839,15 @@ df $1 | tail -1 | awk '{print $2" "$4}' Dfs links are specified in the share directory by symbolic links of the form msdfs:serverA\\shareA,serverB\\shareB and so on. For more information on setting up a Dfs tree - on Samba, refer to "Hosting a Microsoft - Distributed File System tree on Samba" document.

    See also host msdfs

    Default: msdfs root = no

    name cache timeout (G)

    Specifies the number of seconds it takes before + on Samba, refer to ???.

    See also host msdfs

    Default: msdfs root = no

    name cache timeout (G)

    Specifies the number of seconds it takes before entries in samba's hostname resolve cache time out. If the timeout is set to 0. the caching is disabled.

    Default: name cache timeout = 660

    Example: name cache timeout = 0

    name resolve order (G)

    This option is used by the programs in the Samba suite to determine what naming services to use and in what order to resolve host names to IP addresses. Its main purpose to is to control how netbios name resolution is performed. The option takes a space - separated string of name resolution options.

    The options are: "lmhosts", "host", - "wins" and "bcast". They cause names to be + separated string of name resolution options.

    The options are: "lmhosts", "host", + "wins" and "bcast". They cause names to be resolved as follows:

    • lmhosts : Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has no name type attached to the NetBIOS name (see the lmhosts(5) for details) then @@ -1811,7 +1870,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' first, followed by a broadcast attempt, followed by a normal system hostname lookup.

      When Samba is functioning in ADS security mode (security = ads) it is advised to use following settings for name resolve order:

      name resolve order = wins bcast

      DC lookups will still be done via DNS, but fallbacks to netbios names will - not inundate your DNS servers with needless querys for DOMAIN<0x1c> lookups.

    netbios aliases (G)

    This is a list of NetBIOS names that nmbd(8) will + not inundate your DNS servers with needless querys for DOMAIN<0x1c> lookups.

    netbios aliases (G)

    This is a list of NetBIOS names that nmbd will advertise as additional names by which the Samba server is known. This allows one machine to appear in browse lists under multiple names. If a machine is acting as a browse server or logon server none of these names will be advertised as either browse server or logon @@ -1842,16 +1901,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' homedir map and return the server listed there.

    Note that for this option to work there must be a working NIS system and the Samba server with this option must also - be a logon server.

    Default: nis homedir = no

    non unix account range (G)

    The non unix account range parameter specifies - the range of 'user ids' that are allocated by the various 'non unix - account' passdb backends. These backends allow - the storage of passwords for users who don't exist in /etc/passwd. - This is most often used for machine account creation. - This range of ids should have no existing local or NIS users within - it as strange conflicts can occur otherwise.

    Note

    These userids never appear on the system and Samba will never - 'become' these users. They are used only to ensure that the algorithmic - RID mapping does not conflict with normal users. -

    Default: non unix account range = <empty string>

    Example: non unix account range = 10000-20000

    nt acl support (S)

    This boolean parameter controls whether smbd(8) will attempt to map + be a logon server.

    Default: nis homedir = no

    nt acl support (S)

    This boolean parameter controls whether smbd(8) will attempt to map UNIX permissions into Windows NT access control lists. This parameter was formally a global parameter in releases prior to 2.2.2.

    Default: nt acl support = yes

    ntlm auth (G)

    This parameter determines whether or not smbd(8) will attempt to @@ -1926,9 +1976,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' names to OS/2 printer driver names. The format is:

    <nt driver name> = <os2 driver name>.<device name>

    For example, a valid entry using the HP LaserJet 5 printer driver would appear as HP LaserJet 5L = LASERJET.HP LaserJet 5L.

    The need for the file is due to the printer driver namespace - problem described in the Samba - Printing HOWTO. For more details on OS/2 clients, please - refer to the OS2-Client-HOWTO containing in the Samba documentation.

    Default: os2 driver map = <empty string>

    os level (G)

    This integer value controls what level Samba + problem described in ???. For more details on OS/2 clients, please + refer to ???.

    Default: os2 driver map = <empty string>

    os level (G)

    This integer value controls what level Samba advertises itself as for browse elections. The value of this parameter determines whether nmbd(8) has a chance of becoming a local master browser for the @@ -1947,7 +1996,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' passwd chat parameter for most setups.

    Default: pam password change = no

    panic action (G)

    This is a Samba developer option that allows a system command to be called when either smbd(8) or smbd(8) crashes. This is usually used to - draw attention to the fact that a problem occurred.

    Default: panic action = <empty string>

    Example: panic action = "/bin/sleep 90000"

    paranoid server security (G)

    Some version of NT 4.x allow non-guest + draw attention to the fact that a problem occurred.

    Default: panic action = <empty string>

    Example: panic action = "/bin/sleep 90000"

    paranoid server security (G)

    Some version of NT 4.x allow non-guest users with a bad passowrd. When this option is enabled, samba will not use a broken NT 4.x server as password server, but instead complain to the logs and exit. @@ -1978,12 +2027,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' The MySQL based passdb backend. Takes an identifier as argument. Read the Samba HOWTO Collection for configuration details. -

  • guest - - Very simple backend that only provides one user: the guest user. - Only maps the NT guest user to the guest account. - Required in pretty much all situations.

    • -

    Default: passdb backend = smbpasswd

    Example: passdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd guest

    Example: passdb backend = ldapsam:ldaps://ldap.example.com guest

    Example: passdb backend = mysql:my_plugin_args tdbsam:/etc/samba/private/passdb.tdb guest

    passwd chat (G)

    This string controls the "chat" +

    Default: passdb backend = smbpasswd

    Example: passdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd

    Example: passdb backend = ldapsam:ldaps://ldap.example.com

    Example: passdb backend = mysql:my_plugin_args tdbsam

    passwd chat (G)

    This string controls the "chat" conversation that takes places between smbd(8) and the local password changing program to change the user's password. The string describes a sequence of response-receive pairs that smbd(8) uses to determine what to send to the @@ -2005,7 +2050,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' give line-feed, carriage-return, tab and space. The chat sequence string can also contain a '*' which matches any sequence of characters. Double quotes can be used to collect strings with spaces in them into a single string.

    If the send string in any part of the chat sequence is a full - stop ".", then no string is sent. Similarly, if the + stop ".", then no string is sent. Similarly, if the expect string is a full stop then no string is expected.

    If the pam password change parameter is set to yes, the chat pairs may be matched in any order, and success is determined by the PAM result, @@ -2015,9 +2060,9 @@ df $1 | tail -1 | awk '{print $2" "$4}' passwd program , passwd chat debug and pam password change.

    Default: passwd chat = *new*password* %n\\n - *new*password* %n\\n *changed*

    Example: passwd chat = "*Enter OLD password*" %o\\n - "*Enter NEW password*" %n\\n "*Reenter NEW password*" %n\\n - "*Password changed*"

    passwd chat debug (G)

    This boolean specifies if the passwd chat script + *new*password* %n\\n *changed*

    Example: passwd chat = "*Enter OLD password*" %o\\n + "*Enter NEW password*" %n\\n "*Reenter NEW password*" %n\\n + "*Password changed*"

    passwd chat debug (G)

    This boolean specifies if the passwd chat script parameter is run in debug mode. In this mode the strings passed to and received from the passwd chat are printed in the smbd(8) log with a @@ -2041,8 +2086,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' it.

    Note that if the unix password sync parameter is set to yes then this program is called AS ROOT - before the SMB password in the smbpasswd(5) - file is changed. If this UNIX password change fails, then + before the SMB password in the smbpasswd + file is changed. If this UNIX password change fails, then smbd will fail to change the SMB password also (this is by design).

    If the unix password sync parameter is set this parameter MUST USE ABSOLUTE PATHS @@ -2057,10 +2102,10 @@ df $1 | tail -1 | awk '{print $2" "$4}' family of operating systems. These clients upper case clear text passwords even when NT LM 0.12 selected by the protocol negotiation request/response.

    This parameter defines the maximum number of characters - that may be upper case in passwords.

    For example, say the password given was "FRED". If + that may be upper case in passwords.

    For example, say the password given was "FRED". If password level is set to 1, the following combinations - would be tried if "FRED" failed:

    "Fred", "fred", "fRed", "frEd","freD"

    If password level was set to 2, - the following combinations would also be tried:

    "FRed", "FrEd", "FreD", "fREd", "fReD", "frED", ..

    And so on.

    The higher value this parameter is set to the more likely + would be tried if "FRED" failed:

    "Fred", "fred", "fRed", "frEd","freD"

    If password level was set to 2, + the following combinations would also be tried:

    "FRed", "FrEd", "FreD", "fREd", "fReD", "frED", ..

    And so on.

    The higher value this parameter is set to the more likely it is that a mixed case password will be matched against a single case password. However, you should be aware that use of this parameter reduces security and increases the time taken to @@ -2080,7 +2125,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' parameter name resolve order and so may resolved by any method and order described in that parameter.

    The password server must be a machine capable of using - the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in + the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in user level security mode.

    Note

    Using a password server means your UNIX box (running Samba) is only as secure as your password server. DO NOT CHOOSE A PASSWORD SERVER THAT YOU DON'T COMPLETELY TRUST. @@ -2145,11 +2190,11 @@ df $1 | tail -1 | awk '{print $2" "$4}' whenever the service is disconnected. It takes the usual substitutions. The command may be run as the root on some systems.

    An interesting example may be to unmount server - resources:

    postexec = /etc/umount /cdrom

    See also preexec.

    Default: none (no command executed)

    Example: postexec = echo \"%u disconnected from %S from %m (%I)\" >> /tmp/log

    preexec (S)

    This option specifies a command to be run whenever + resources:

    postexec = /etc/umount /cdrom

    See also preexec.

    Default: none (no command executed)

    Example: postexec = echo \"%u disconnected from %S from %m (%I)\" >> /tmp/log

    preexec (S)

    This option specifies a command to be run whenever the service is connected to. It takes the usual substitutions.

    An interesting example is to send the users a welcome message every time they log in. Maybe a message of the day? Here - is an example:

    preexec = csh -c 'echo \"Welcome to %S!\" | /usr/local/samba/bin/smbclient -M %m -I %I' &

    Of course, this could get annoying after a while :-)

    See also preexec close and postexec - .

    Default: none (no command executed)

    Example: preexec = echo \"%u connected to %S from %m (%I)\" >> /tmp/log

    preexec close (S)

    This boolean option controls whether a non-zero + is an example:

    preexec = csh -c 'echo \"Welcome to %S!\" | /usr/local/samba/bin/smbclient -M %m -I %I' &

    Of course, this could get annoying after a while :-)

    See also preexec close and postexec + .

    Default: none (no command executed)

    Example: preexec = echo \"%u connected to %S from %m (%I)\" >> /tmp/log

    preexec close (S)

    This boolean option controls whether a non-zero return code from preexec should close the service being connected to.

    Default: preexec close = no

    prefered master (G)

    Synonym for preferred master for people who cannot spell :-).

    preferred master (G)

    This boolean parameter controls if @@ -2171,8 +2216,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' printcap file loaded then the load printers option is easier.

    Default: no preloaded services

    Example: preload = fred lp colorlp

    preload modules (G)

    This is a list of paths to modules that should be loaded into smbd before a client connects. This improves - the speed of smbd when reacting to new connections somewhat.

    It is recommended to only use this option on heavy-performance - servers.

    Default: preload modules =

    Example: preload modules = /usr/lib/samba/passdb/mysql.so+++

    preserve case (S)

    This controls if new filenames are created + the speed of smbd when reacting to new connections somewhat.

    Default: preload modules =

    Example: preload modules = /usr/lib/samba/passdb/mysql.so+++

    preserve case (S)

    This controls if new filenames are created with the case that the client passes, or if they are forced to be the default case .

    Default: preserve case = yes

    See the section on NAME MANGLING for a fuller discussion.

    printable (S)

    If this parameter is yes, then @@ -2189,7 +2233,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' . This should be supplemented by an addtional setting printing = cups in the [global] section. printcap name = cups will use the - "dummy" printcap created by CUPS, as specified in your CUPS + "dummy" printcap created by CUPS, as specified in your CUPS configuration file.

    On System V systems that use lpstat to list available printers you can use printcap name = lpstat @@ -2272,7 +2316,30 @@ print5|My Printer 5 printable.

    private dir (G)

    This parameters defines the directory smbd will use for storing such files as smbpasswd and secrets.tdb. -

    Default :private dir = ${prefix}/private

    protocol (G)

    Synonym for +

    Default :private dir = ${prefix}/private

    profile acls (S)

    This boolean parameter controls whether smbd(8) + This boolean parameter was added to fix the problems that people have been + having with storing user profiles on Samba shares from Windows 2000 or + Windows XP clients. New versions of Windows 2000 or Windows XP service + packs do security ACL checking on the owner and ability to write of the + profile directory stored on a local workstation when copied from a Samba + share. +

    When not in domain mode with winbindd then the security info copied + onto the local workstation has no meaning to the logged in user (SID) on + that workstation so the profile storing fails. Adding this parameter + onto a share used for profile storage changes two things about the + returned Windows ACL. Firstly it changes the owner and group owner + of all reported files and directories to be BUILTIN\\Administrators, + BUILTIN\\Users respectively (SIDs S-1-5-32-544, S-1-5-32-545). Secondly + it adds an ACE entry of "Full Control" to the SID BUILTIN\\Users to + every returned ACL. This will allow any Windows 2000 or XP workstation + user to access the profile.

    Note that if you have multiple users logging + on to a workstation then in order to prevent them from being able to access + each others profiles you must remove the "Bypass traverse checking" advanced + user right. This will prevent access to other users profile directories as + the top level profile directory (named after the user) is created by the + workstation profile code and has an ACL restricting entry to the directory + tree to the owning user. +

    Default: profile acls = no

    protocol (G)

    Synonym for max protocol.

    public (S)

    Synonym for guest ok.

    queuepause command (S)

    This parameter specifies the command to be executed on the server host in order to pause the printer queue.

    This command should be a program or script which takes @@ -2297,8 +2364,8 @@ print5|My Printer 5 path in the command as the PATH may not be available to the server.

    Default: depends on the setting of printing

    Example: queuepause command = enable %p

    read bmpx (G)

    This boolean parameter controls whether - smbd(8) will support the "Read - Block Multiplex" SMB. This is now rarely used and defaults to + smbd(8) will support the "Read + Block Multiplex" SMB. This is now rarely used and defaults to no. You should never need to set this parameter.

    Default: read bmpx = no

    read list (S)

    This is a list of users that are given read-only access to a service. If the connecting user is in this list then @@ -2349,8 +2416,7 @@ print5|My Printer 5 the workgroup parameter is used instead.

    The IP addresses you choose would normally be the broadcast addresses of the remote networks, but can also be the IP addresses - of known browse masters if your network config is that stable.

    See the documentation file BROWSING - in the docs/ directory.

    Default: remote announce = <empty string>

    remote browse sync (G)

    This option allows you to setup nmbd(8) to periodically request + of known browse masters if your network config is that stable.

    See ???.

    Default: remote announce = <empty string>

    remote browse sync (G)

    This option allows you to setup nmbd(8) to periodically request synchronization of browse lists with the master browser of a Samba server that is on a remote segment. This option will allow you to gain browse lists for multiple workgroups across routed networks. This @@ -2384,20 +2450,20 @@ print5|My Printer 5 by setting guest ok = yes on any share.

    Default: restrict anonymous = 0

    root (G)

    Synonym for - root directory". + root directory".

    root dir (G)

    Synonym for - root directory". + root directory".

    root directory (G)

    The server will chroot() (i.e. Change its root directory) to this directory on startup. This is not strictly necessary for secure operation. Even without it the server will deny access to files not in one of the service entries. It may also check for, and deny access to, soft links to other - parts of the filesystem, or attempts to use ".." in file names + parts of the filesystem, or attempts to use ".." in file names to access other directories (depending on the setting of the wide links parameter).

    Adding a root directory entry other - than "/" adds an extra level of security, but at a price. It + than "/" adds an extra level of security, but at a price. It absolutely ensures that no access is given to files not in the sub-tree specified in the root directory option, including some files needed for @@ -2421,7 +2487,7 @@ print5|My Printer 5 preexec and preexec close.

    Default: root preexec close = no

    security (G)

    This option affects how clients respond to Samba and is one of the most important settings in the - smb.conf file.

    The option sets the "security mode bit" in replies to + smb.conf file.

    The option sets the "security mode bit" in replies to protocol negotiations with smbd(8) to turn share level security on or off. Clients decide based on this bit whether (and how) to transfer user and password information to the server.

    The default is security = user, as this is @@ -2432,8 +2498,8 @@ print5|My Printer 5 security = share mainly because that was the only option at one stage.

    There is a bug in WfWg that has relevance to this setting. When in user or server level security a WfWg client - will totally ignore the password you type in the "connect - drive" dialog box. This makes it very difficult (if not impossible) + will totally ignore the password you type in the "connect + drive" dialog box. This makes it very difficult (if not impossible) to connect to a Samba service as anyone except the user that you are logged into WfWg as.

    If your PCs use usernames that are the same as their usernames on the UNIX machine then you will want to use @@ -2487,7 +2553,7 @@ print5|My Printer 5 in share-level security as to which UNIX username will eventually be used in granting access.

    See also the section NOTE ABOUT USERNAME/PASSWORD VALIDATION.

    SECURITY = USER

    This is the default security setting in Samba 3.0. - With user-level security a client must first "log-on" with a + With user-level security a client must first "log-on" with a valid username and password (which can be mapped using the username map parameter). Encrypted passwords (see the @@ -2536,7 +2602,7 @@ print5|My Printer 5 does not support them. However note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, it must have a valid smbpasswd file to check - users against. See the chapter about the User Database in the Samba HOWTO Collection for details on how to set this up.

    Note this mode of operation has + users against. See the chapter about the User Database in the Samba HOWTO Collection for details on how to set this up.

    Note

    This mode of operation has significant pitfalls, due to the fact that is activly initiates a man-in-the-middle attack on the remote SMB server. In particular, this mode of operation can cause significant resource consuption on @@ -2544,11 +2610,11 @@ print5|My Printer 5 of the user's session. Furthermore, if this connection is lost, there is no way to reestablish it, and futher authenticaions to the Samba server may fail. (From a single client, till it disconnects). -

    Note that from the client's point of +

    Note

    From the client's point of view security = server is the same as security = user. It only affects how the server deals with the authentication, it does - not in any way affect what the client sees.

    Note that the name of the resource being + not in any way affect what the client sees.

    Note that the name of the resource being requested is not sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing @@ -2558,6 +2624,13 @@ print5|My Printer 5 parameter for details on doing this.

    See also the section NOTE ABOUT USERNAME/PASSWORD VALIDATION.

    See also the password server parameter and the + encrypted passwords parameter.

    SECURITY = ADS

    In this mode, Samba will act as a domain member in an ADS realm. To operate + in this mode, the machine running Samba will need to have Kerberos installed + and configured and Samba will need to be joined to the ADS realm using the + net utility.

    Note that this mode does NOT make Samba operate as a Active Directory Domain + Controller.

    Read the chapter about Domain Membership in the HOWTO for details.

    See also the ads server + parameter, the realm + paramter and the encrypted passwords parameter.

    Default: security = USER

    Example: security = DOMAIN

    security mask (S)

    This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a file using the native NT security @@ -2570,7 +2643,7 @@ print5|My Printer 5

    Note that users who can access the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone - "appliance" systems. Administrators of most normal systems will + "appliance" systems. Administrators of most normal systems will probably want to leave it set to 0777.

    See also the force directory security mode, directory @@ -2586,7 +2659,13 @@ print5|My Printer 5 for Windows NT4 before SP4.

    Please note that with this set to no you will have to apply the WindowsXP requireSignOrSeal-Registry patch found in - the docs/Registry subdirectory.

    Default: server schannel = auto

    Example: server schannel = yes

    server string (G)

    This controls what string will show up in the printer comment box in print + the docs/Registry subdirectory.

    Default: server schannel = auto

    Example: server schannel = yes

    server signing (G)

    This controls whether the server offers or requires + the client it talks to to use SMB signing. Possible values + are auto, mandatory + and disabled. +

    When set to auto, SMB signing is offered, but not enforced. + When set to mandatory, SMB signing is required and if set + to disabled, SMB signing is not offered either.

    Default: client signing = False

    server string (G)

    This controls what string will show up in the printer comment box in print manager and next to the IPC connection in net view. It can be any string that you wish to show to your users.

    It also sets what will appear in browse lists next to the machine name.

    A %v will be replaced with the Samba @@ -2604,7 +2683,13 @@ print5|My Printer 5 vampire. %u will be replaced with the user whose primary group is to be set. %g will be replaced with the group to - set.

    Default: No default value

    Example: set primary group script = /usr/sbin/usermod -g '%g' '%u'

    share modes (S)

    This enables or disables the honoring of + set.

    Default: No default value

    Example: set primary group script = /usr/sbin/usermod -g '%g' '%u'

    set quota command (G)

    The set quota command should only be used + whenever there is no operating system API available from the OS that + samba can use.

    This parameter should specify the path to a script that + can set quota for the specified arguments.

    The specified script should take the following arguments:

    • 1 - quota type +

      • 1 - user quotas

      • 2 - user default quotas (uid = -1)

      • 3 - group quotas

      • 4 - group default quotas (gid = -1)

      +

    • 2 - id (uid for user, gid for group, -1 if N/A)

    • 3 - quota state (0 = disable, 1 = enable, 2 = enable and enforce)

    • 4 - block softlimit

    • 5 - block hardlimit

    • 6 - inode softlimit

    • 7 - inode hardlimit

    • 8(optional) - block size, defaults to 1024

    The script should output at least one line of data.

    See also the get quota command parameter. +

    Default: set quota command =

    Example: set quota command = /usr/local/sbin/set_quota

    share modes (S)

    This enables or disables the honoring of the share modes during a file open. These modes are used by clients to gain exclusive read or write access to a file.

    These open modes are not directly supported by UNIX, so @@ -2622,7 +2707,7 @@ print5|My Printer 5 . This option can be use with preserve case = yes to permit long filenames to retain their case, while short names are lowered.

    See the section on NAME MANGLING.

    Default: short preserve case = yes

    show add printer wizard (G)

    With the introduction of MS-RPC based printing support - for Windows NT/2000 client in Samba 2.2, a "Printers..." folder will + for Windows NT/2000 client in Samba 2.2, a "Printers..." folder will appear on Samba hosts in the share listing. Normally this folder will contain an icon for the MS Add Printer Wizard (APW). However, it is possible to disable this feature regardless of the level of privilege @@ -2648,13 +2733,13 @@ print5|My Printer 5 switch -r. It means reboot after shutdown for NT.

  • %f will be substituted with the switch -f. It means force the shutdown - even if applications do not respond for NT.

    • Default: None.

    Example: abort shutdown script = /usr/local/samba/sbin/shutdown %m %t %r %f

    Shutdown script example: + even if applications do not respond for NT.

    Default: None.

    Example: shutdown script = /usr/local/samba/sbin/shutdown %m %t %r %f

    Shutdown script example: 

     #!/bin/bash
 		
 $time=0
-let "time/60"
-let "time++"
+let "time/60"
+let "time++"
 
 /sbin/shutdown $3 $4 +$time $1 &

    @@ -2675,7 +2760,7 @@ Shutdown does not return so we need to launch it in background. suggest you read the appropriate documentation for your operating system first (perhaps man setsockopt will help).

    You may find that on some systems Samba will say - "Unknown socket option" when you supply an option. This means you + "Unknown socket option" when you supply an option. This means you either incorrectly typed it or you need to add an include file to includes.h for your OS. If the latter is the case please send the patch to @@ -2690,15 +2775,13 @@ Shutdown does not return so we need to launch it in background. might be:

    socket options = IPTOS_LOWDELAY

    If you have a local network then you could try:

    socket options = IPTOS_LOWDELAY TCP_NODELAY

    If you are on a wide area network then perhaps try setting IPTOS_THROUGHPUT.

    Note that several of the options may cause your Samba server to fail completely. Use these options with caution!

    Default: socket options = TCP_NODELAY

    Example: socket options = IPTOS_LOWDELAY

    source environment (G)

    This parameter causes Samba to set environment - variables as per the content of the file named.

    If the value of this parameter starts with a "|" character + variables as per the content of the file named.

    If the value of this parameter starts with a "|" character then Samba will treat that value as a pipe command to open and will set the environment variables from the output of the pipe.

    The contents of the file or the output of the pipe should be formatted as the output of the standard Unix env(1) command. This is of the form:

    Example environment entry:

    SAMBA_NETBIOS_NAME = myhostname

    Default: No default value

    Examples: source environment = |/etc/smb.conf.sh

    Example: source environment = /usr/local/smb_env_vars

    stat cache (G)

    This parameter determines if smbd(8) will use a cache in order to speed up case insensitive name mappings. You should never need - to change this parameter.

    Default: stat cache = yes

    stat cache size (G)

    This parameter determines the number of - entries in the stat cache. You should - never need to change this parameter.

    Default: stat cache size = 50

    strict allocate (S)

    This is a boolean that controls the handling of + to change this parameter.

    Default: stat cache = yes

    strict allocate (S)

    This is a boolean that controls the handling of disk space allocation in the server. When this is set to yes the server will change from UNIX behaviour of not committing real disk storage blocks when a file is extended to the Windows behaviour @@ -2755,23 +2838,17 @@ Shutdown does not return so we need to launch it in background. string %D is present it is substituted with the user's Windows NT domain name. If the string %U is present it - is substituted with the user's Windows NT user name.

    Default: template homedir = /home/%D/%U

    template shell (G)

    When filling out the user information for a Windows NT + is substituted with the user's Windows NT user name.

    Default: template homedir = /home/%D/%U

    template primary group (G)

    This option defines the default primary group for + each user created by winbindd(8)'s local account management + functions (similar to the 'add user script'). +

    Default: template primary group = nobody

    template shell (G)

    When filling out the user information for a Windows NT user, the winbindd(8) daemon uses this parameter to fill in the login shell for that user.

    Default: template shell = /bin/false

    time offset (G)

    This parameter is a setting in minutes to add to the normal GMT to local time conversion. This is useful if you are serving a lot of PCs that have incorrect daylight saving time handling.

    Default: time offset = 0

    Example: time offset = 60

    time server (G)

    This parameter determines if nmbd(8) advertises itself as a time server to Windows clients.

    Default: time server = no

    timestamp logs (G)

    Synonym for - debug timestamp.

    total print jobs (G)

    This parameter accepts an integer value which defines - a limit on the maximum number of print jobs that will be accepted - system wide at any given time. If a print job is submitted - by a client which will exceed this number, then smbd(8) will return an - error indicating that no space is available on the server. The - default value of 0 means that no such limit exists. This parameter - can be used to prevent a server from exceeding its capacity and is - designed as a printing throttle. See also - max print jobs. -

    Default: total print jobs = 0

    Example: total print jobs = 5000

    unicode (G)

    Specifies whether Samba should try + debug timestamp.

    unicode (G)

    Specifies whether Samba should try to use unicode on the wire by default. Note: This does NOT mean that samba will assume that the unix machine uses unicode!

    Default: unicode = yes

    unix charset (G)

    Specifies the charset the unix machine @@ -2782,7 +2859,7 @@ Shutdown does not return so we need to launch it in background. These extensions enable Samba to better serve UNIX CIFS clients by supporting features such as symbolic links, hard links, etc... These extensions require a similarly enabled client, and are of - no current use to Windows clients.

    Default: unix extensions = no

    unix password sync (G)

    This boolean parameter controls whether Samba + no current use to Windows clients.

    Default: unix extensions = yes

    unix password sync (G)

    This boolean parameter controls whether Samba attempts to synchronize the UNIX password with the SMB password when the encrypted SMB password in the smbpasswd file is changed. If this is set to yes the program specified in the passwd @@ -2826,7 +2903,7 @@ Shutdown does not return so we need to launch it in background. logged on user. If the user possesses local administator rights but not root privilegde on the Samba host (often the case), the OpenPrinterEx() call will fail. The result is that the client will - now display an "Access Denied; Unable to connect" message + now display an "Access Denied; Unable to connect" message in the printer queue window (even though jobs may successfully be printed).

    If this parameter is enabled for a printer, then any attempt to open the printer with the PRINTER_ACCESS_ADMINISTER right is mapped @@ -2910,8 +2987,8 @@ Shutdown does not return so we need to launch it in background. to the UNIX name sys you would use:

    sys = @system

    You can have as many mappings as you like in a username map file.

    If your system supports the NIS NETGROUP option then the netgroup database is checked before the /etc/group database for matching groups.

    You can map Windows usernames that have spaces in them - by using double quotes around the name. For example:

    tridge = "Andrew Tridgell"

    would map the windows username "Andrew Tridgell" to the - unix username "tridge".

    The following example would map mary and fred to the + by using double quotes around the name. For example:

    tridge = "Andrew Tridgell"

    would map the windows username "Andrew Tridgell" to the + unix username "tridge".

    The following example would map mary and fred to the unix user sys, and map the rest to guest. Note the use of the '!' to tell Samba to stop processing if it gets a match on that line.

    @@ -3032,7 +3109,13 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/
 	that Samba has to  do in order to perform the link checks.
    Default: wide links = yes
    winbind cache time (G)

    This parameter specifies the number of seconds the winbindd(8) daemon will cache user and group information before querying a Windows NT server - again.

    Default: winbind cache type = 15

    winbind enum groups (G)

    On large installations using winbindd(8) it may be necessary to suppress + again.

    Default: winbind cache type = 300

    winbind enable local accounts (G)

    This parameter controls whether or not winbindd + will act as a stand in replacement for the various account + management hooks in smb.conf (e.g. 'add user script'). + If enabled, winbindd will support the creation of local + users and groups as another source of UNIX account information + available via getpwnam() or getgrgid(), etc... +

    Default: winbind enable local accounts = yes

    winbind enum groups (G)

    On large installations using winbindd(8) it may be necessary to suppress the enumeration of groups through the setgrent(), getgrent() and endgrent() group of system calls. If @@ -3060,10 +3143,16 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ and nss_winbind.so modules for UNIX services.

    Please note that setting this parameter to + causes problems with group membership at least on glibc systems, as the character + - is used as a special character for NIS in /etc/group.

    Default: winbind separator = '\'

    Example: winbind separator = +

    winbind uid (G)

    This parameter is now an alias for idmap uid

    The winbind gid parameter specifies the range of user ids that are allocated by the + is used as a special character for NIS in /etc/group.

    Default: winbind separator = '\'

    Example: winbind separator = +

    winbind trusted domains only (G)

    This parameter is designed to allow Samba servers that + are members of a Samba controlled domain to use UNIX accounts + distributed vi NIS, rsync, or LDAP as the uid's for winbindd users + in the hosts primary domain. Therefore, the user 'SAMBA\user1' would + be mapped to the account 'user1' in /etc/passwd instead of allocating + a new uid for him or her. +

    Default: winbind trusted domains only = <no>

    winbind uid (G)

    This parameter is now an alias for idmap uid

    The winbind gid parameter specifies the range of user ids that are allocated by the winbindd(8) daemon. This range of ids should have no existing local or NIS users within it as strange - conflicts can occur otherwise.

    Default: winbind uid = <empty string>

    Example: winbind uid = 10000-20000

    winbind used default domain (G)

    This parameter specifies whether the + conflicts can occur otherwise.

    Default: winbind uid = <empty string>

    Example: winbind uid = 10000-20000

    winbind use default domain (G)

    This parameter specifies whether the winbindd(8) daemon should operate on users without domain component in their username. Users without a domain component are treated as is part of the winbindd server's own @@ -3075,11 +3164,11 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ dynamic update of external name resolution databases such as dynamic DNS.

    The wins hook parameter specifies the name of a script or executable that will be called as follows:

    wins_hook operation name nametype ttl IP_list

    • The first argument is the operation and is - one of "add", "delete", or - "refresh". In most cases the operation + one of "add", "delete", or + "refresh". In most cases the operation can be ignored as the rest of the parameters provide sufficient information. Note that - "refresh" may sometimes be called when + "refresh" may sometimes be called when the name has not previously been added, in that case it should be treated as an add.

    • The second argument is the NetBIOS name. If the name is not a legal name then the wins hook is not called. @@ -3090,7 +3179,7 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ addresses currently registered for that name. If this list is empty then the name should be deleted.

    An example script that calls the BIND dynamic DNS update program nsupdate is provided in the examples - directory of the Samba source code.

    wins partner (G)

    A space separated list of partners' IP addresses for + directory of the Samba source code.

    wins partners (G)

    A space separated list of partners' IP addresses for WINS replication. WINS partners are always defined as push/pull partners as defining only one way WINS replication is unreliable. WINS replication is currently experimental and unreliable between @@ -3106,7 +3195,7 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ seperated from the ip address by a colon.

    Note

    You need to set up Samba to point to a WINS server if you have multiple subnets and wish cross-subnet - browsing to work correctly.

    See the documentation file Browsing in the samba howto collection.

    Default: not enabled

    Example: wins server = mary:192.9.200.1 fred:192.168.3.199 mary:192.168.2.61

    For this example when querying a certain name, 192.19.200.1 will + browsing to work correctly.

    See the ???.

    Default: not enabled

    Example: wins server = mary:192.9.200.1 fred:192.168.3.199 mary:192.168.2.61

    For this example when querying a certain name, 192.19.200.1 will be asked first and if that doesn't respond 192.168.2.61. If either of those doesn't know the name 192.168.3.199 will be queried.

    Example: wins server = 192.9.200.1 192.168.2.61

    wins support (G)

    This boolean controls if the nmbd(8) process in Samba will act as a WINS server. You should diff --git a/docs/htmldocs/smbcacls.1.html b/docs/htmldocs/smbcacls.1.html index d7c5fed1b5..1c3cc5a2d3 100644 --- a/docs/htmldocs/smbcacls.1.html +++ b/docs/htmldocs/smbcacls.1.html @@ -10,10 +10,10 @@ only the ones specified on the command line. All other ACLs are erased. Note that the ACL specified must contain at least a revision, type, owner and group for the call to succeed.

    -U username

    Specifies a username used to connect to the - specified service. The username may be of the form "username" in + specified service. The username may be of the form "username" in which case the user is prompted to enter in a password and the workgroup specified in the smb.conf(5) file is - used, or "username%password" or "DOMAIN\username%password" and the + used, or "username%password" or "DOMAIN\username%password" and the password and workgroup names are used as provided.

    -C name

    The owner of a file or directory can be changed to the name given using the -C option. The name can be a sid in the form S-1-x-y-z or a name resolved @@ -34,8 +34,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -49,10 +48,9 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +override the log level parameter +in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    ACL FORMAT

    The format of an ACL is one or more ACL entries separated by either commas or newlines. An ACL entry is one of the following: 

     
diff --git a/docs/htmldocs/smbclient.1.html b/docs/htmldocs/smbclient.1.html
index ecb85d6e85..1ee5fd26da 100644
--- a/docs/htmldocs/smbclient.1.html
+++ b/docs/htmldocs/smbclient.1.html
@@ -84,12 +84,7 @@
 		messages. 
    -p port
    This number is the TCP port number that will be used 
 		when making connections to the server. The standard (well-known)
 		TCP port number for an SMB/CIFS server is 139, which is the 
-		default. 
    -l logfilename
    If specified, logfilename specifies a base filename 
-		into which operational data from the running client will be 
-		logged. 
    The default base name is specified at compile time.
    The base name is used to generate actual log file names.
-		For example, if the name specified was "log", the debug file 
-		would be log.client.
    The log file generated is never removed by the client. 		
-		
    -h|--help
    Print a summary of command line options.
+		default. 
    -h|--help
    Print a summary of command line options.
 
    -I IP-address
    IP address is the address of the server to connect to. 
 		It should be specified in standard "a.b.c.d" notation. 
    Normally the client would attempt to locate a named 
 		SMB/CIFS server by looking it up via the NetBIOS name resolution 
@@ -126,8 +121,7 @@ configuration details required by the server.  The
 information in this file includes server-specific
 information such as what printcap file to use, as well 
 as descriptions of all the services that the server is 
-to provide. See 
-smb.conf(5) for more information.
+to provide. See smb.conf for more information.
 The default configuration file name is determined at 
 compile time.
    -d|--debug=debuglevel
    debuglevel is an integer 
 from 0 to 10.  The default value if this parameter is 
@@ -141,9 +135,8 @@ amounts of log data, and should only be used when
 investigating a problem. Levels above 3 are designed for 
 use only by developers and generate HUGE amounts of log
 data, most of which is extremely cryptic.
    Note that specifying this parameter here will 
-override the log
-level parameter in the 
-smb.conf(5) file.
    -l|--logfile=logbasename
    File name for log/debug files. The extension
+override the log level parameter
+in the smb.conf file.
    -l|--logfile=logbasename
    File name for log/debug files. The extension
 ".client" will be appended. The log file is
 never removed by the client.
 
    -N
    If specified, this parameter suppresses the normal
@@ -177,10 +170,10 @@ via the ps command.  To be safe always allow
 rpcclient to prompt for a password and type
 it in directly. 
    -n <primary NetBIOS name>
    This option allows you to override
 the NetBIOS name that Samba uses for itself. This is identical
-to setting the NetBIOS
-name parameter in the smb.conf(5) file.  However, a command
+to setting the netbios name parameter in the smb.conf file. 
+However, a command
 line setting will take precedence over settings in
-smb.conf(5).
    -i <scope>
    This specifies a NetBIOS scope that
+smb.conf.
    -i <scope>
    This specifies a NetBIOS scope that
 nmblookup will use to communicate with when
 generating NetBIOS names. For details on the use of NetBIOS
 scopes, see rfc1001.txt and rfc1002.txt. NetBIOS scopes are
@@ -192,7 +185,7 @@ smb.conf.  If the domain specified is the same as the servers
 NetBIOS name, it causes the client to log on using the servers local 
 SAM (as opposed to the Domain SAM). 
    -O socket options
    TCP socket options to set on the client
 socket. See the socket options parameter in
-the smb.conf(5) manual page for the list of valid
+the smb.conf manual page for the list of valid
 options. 
    -T tar options
    smbclient may be used to create tar(1)
 		 compatible backups of all the files on an SMB/CIFS
 		share. The secondary tar flags that can be given to this option 
diff --git a/docs/htmldocs/smbcontrol.1.html b/docs/htmldocs/smbcontrol.1.html
index 21344b9ade..e7ccd27f26 100644
--- a/docs/htmldocs/smbcontrol.1.html
+++ b/docs/htmldocs/smbcontrol.1.html
@@ -5,8 +5,7 @@ configuration details required by the server.  The
 information in this file includes server-specific
 information such as what printcap file to use, as well 
 as descriptions of all the services that the server is 
-to provide. See 
-smb.conf(5) for more information.
+to provide. See smb.conf for more information.
 The default configuration file name is determined at 
 compile time.
    -i
    Run interactively. Individual commands 
 		of the form destination message-type parameters can be entered 
@@ -58,7 +57,9 @@ compile time.
    -i
    Run interactiv
 	talloc(pool) memory usage by the specified daemon/process. Available 
 	for both smbd and nmbd.
    drvupgrade
    Force clients of printers using specified driver 
 	to update their local version of the driver. Can only be 
-	sent to smbd.

    VERSION

    This man page is correct for version 3.0 of + sent to smbd.

    reload-config

    Force daemon to reload smb.conf configuration file. Can be sent + to smbd, nmbd, or winbindd. +

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    SEE ALSO

    nmbd(8) and smbd(8).

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar diff --git a/docs/htmldocs/smbcquotas.1.html b/docs/htmldocs/smbcquotas.1.html index 468edd1d61..59dcd106ed 100644 --- a/docs/htmldocs/smbcquotas.1.html +++ b/docs/htmldocs/smbcquotas.1.html @@ -14,8 +14,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -29,9 +28,8 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +override the log level parameter +in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension ".client" will be appended. The log file is never removed by the client.

    -N

    If specified, this parameter suppresses the normal diff --git a/docs/htmldocs/smbd.8.html b/docs/htmldocs/smbd.8.html index 5b71bd7196..291ddbc0f6 100644 --- a/docs/htmldocs/smbd.8.html +++ b/docs/htmldocs/smbd.8.html @@ -54,8 +54,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -69,9 +68,8 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +override the log level parameter +in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension ".client" will be appended. The log file is never removed by the client.

    -h|--help

    Print a summary of command line options. @@ -82,7 +80,8 @@ never removed by the client. file will be created for informational and debug messages from the running server. The log file generated is never removed by the server although - its size may be controlled by the max log size + its size may be controlled by the + max log size option in the smb.conf(5) file. Beware: If the directory specified does not exist, smbd will log to the default debug log location defined at compile time. @@ -104,18 +103,15 @@ never removed by the client. in the above situation.

    FILES

    /etc/inetd.conf

    If the server is to be run by the inetd meta-daemon, this file must contain suitable startup information for the - meta-daemon. See the "How to Install and Test SAMBA" - document for details. + meta-daemon.

    /etc/rc

    or whatever initialization script your system uses).

    If running the server as a daemon at startup, this file will need to contain an appropriate startup - sequence for the server. See the "How to Install and Test SAMBA" - document for details.

    /etc/services

    If running the server via the + sequence for the server.

    /etc/services

    If running the server via the meta-daemon inetd, this file must contain a mapping of service name (e.g., netbios-ssn) to service port (e.g., 139) and protocol type (e.g., tcp). - See the "How to Install and Test SAMBA" - document for details.

    /usr/local/samba/lib/smb.conf

    This is the default location of the smb.conf(5) server configuration file. Other common places that systems +

    /usr/local/samba/lib/smb.conf

    This is the default location of the smb.conf(5) server configuration file. Other common places that systems install this file are /usr/samba/lib/smb.conf and /etc/samba/smb.conf.

    This file describes all the services the server is to make available to clients. See smb.conf(5) for more information.

    LIMITATIONS

    On some systems smbd cannot change uid back @@ -131,8 +127,7 @@ never removed by the client. is not specific to the server, however.

    Default Profile for Windows Users

    MS Windows 9x / Me and NT4/200x/XP will use a default profile for any user for whom a profile does not already exist. Armed with a knowledge of where the default profile is located on the Windows workstation, and knowing which registry keys affect the path from which the default profile is created, it is possible to modify the default profile to one that has been optimised for the site. This has significant administrative advantages. -

    MS Windows 9x/Me

    +

    MS Windows 9x/Me

    To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System Policy Editor or change the registry directly.

    @@ -409,7 +393,7 @@ select User Profiles, click on the enable box. Do To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive HKEY_LOCAL_MACHINE\Network\Logon. Now add a DWORD type key with the name "User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0. -

    How User Profiles Are Handled in Windows 9x / Me?

    +

    How User Profiles Are Handled in Windows 9x / Me?

    When a user logs on to a Windows 9x / Me machine, the local profile path, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList, is checked for an existing entry for that user: @@ -425,7 +409,7 @@ If a User Profile is not found in either location, the Default User Profile from machine is used and is copied to a newly created folder for the logged on user. At log off, any changes that the user made are written to the user's local profile. If the user has a roaming profile, the changes are written to the user's profile on the server. -

    MS Windows NT4 Workstation

    +

    MS Windows NT4 Workstation

    On MS Windows NT4 the default user profile is obtained from the location %SystemRoot%\Profiles which in a default installation will translate to C:\WinNT\Profiles. Under this directory on a clean install there will be @@ -436,7 +420,7 @@ system users. The Default User directory contains menu customisable per user depending on the profile settings chosen/created.

    When a new user first logs onto an MS Windows NT4 machine a new profile is created from: -

    All Users settings
    Default User settings (contains the default NTUser.DAT file)

    +

    • All Users settings

    • Default User settings (contains the default NTUser.DAT file)

    When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain the following steps are followed in respect of profile handling:

    1. @@ -468,8 +452,8 @@ will stored in the %SystemRoot%\Profiles\%USERNAME% lo also remain stored in the same way, unless the following registry key is created: 

      -	HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\
-	"DeleteRoamingCache"=dword:00000001
+HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
+winlogon\"DeleteRoamingCache"=dword:00000001

      In which case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be @@ -488,7 +472,7 @@ are controlled by entries on Windows NT4 is:

      The above hive key contains a list of automatically managed folders. The default entries are:

      -

      Table 24.1. User Shell Folder registry keys default values

      NameDefault Value
      AppData%USERPROFILE%\Application Data
      Desktop%USERPROFILE%\Desktop
      Favorites%USERPROFILE%\Favorites
      NetHood%USERPROFILE%\NetHood
      PrintHood%USERPROFILE%\PrintHood
      Programs%USERPROFILE%\Start Menu\Programs
      Recent%USERPROFILE%\Recent
      SendTo%USERPROFILE%\SendTo
      Start Menu %USERPROFILE%\Start Menu
      Startup%USERPROFILE%\Start Menu\Programs\Startup

      +

      Table 24.1. User Shell Folder registry keys default values

      NameDefault Value
      AppData%USERPROFILE%\Application Data
      Desktop%USERPROFILE%\Desktop
      Favorites%USERPROFILE%\Favorites
      NetHood%USERPROFILE%\NetHood
      PrintHood%USERPROFILE%\PrintHood
      Programs%USERPROFILE%\Start Menu\Programs
      Recent%USERPROFILE%\Recent
      SendTo%USERPROFILE%\SendTo
      Start Menu %USERPROFILE%\Start Menu
      Startup%USERPROFILE%\Start Menu\Programs\Startup

      The registry key that contains the location of the default profile settings is:

      @@ -496,8 +480,8 @@ The registry key that contains the location of the default profile settings is:

      The default entries are: -

      Table 24.2. Defaults of profile settings registry keys

      Common Desktop%SystemRoot%\Profiles\All Users\Desktop
      Common Programs%SystemRoot%\Profiles\All Users\Programs
      Common Start Menu%SystemRoot%\Profiles\All Users\Start Menu
      Common Startup%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup

      -

    MS Windows 200x/XP

    Note

    +

    Table 24.2. Defaults of profile settings registry keys

    Common Desktop%SystemRoot%\Profiles\All Users\Desktop
    Common Programs%SystemRoot%\Profiles\All Users\Programs
    Common Start Menu%SystemRoot%\Profiles\All Users\Start Menu
    Common Startup%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup

    +

    MS Windows 200x/XP

    Note

    MS Windows XP Home Edition does use default per user profiles, but can not participate in domain security, can not log onto an NT/ADS style domain, and thus can obtain the profile only from itself. While there are benefits in doing this the beauty of those MS Windows @@ -546,7 +530,7 @@ are controlled by entries on Windows 200x/XP is:

    The above hive key contains a list of automatically managed folders. The default entries are:

    -

    Table 24.3. Defaults of default user profile paths registry keys

    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Cache%USERPROFILE%\Local Settings\Temporary Internet Files
    Cookies%USERPROFILE%\Cookies
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    History%USERPROFILE%\Local Settings\History
    Local AppData%USERPROFILE%\Local Settings\Application Data
    Local Settings%USERPROFILE%\Local Settings
    My Pictures%USERPROFILE%\My Documents\My Pictures
    NetHood%USERPROFILE%\NetHood
    Personal%USERPROFILE%\My Documents
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu%USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup
    Templates%USERPROFILE%\Templates

    +

    Table 24.3. Defaults of default user profile paths registry keys

    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Cache%USERPROFILE%\Local Settings\Temporary Internet Files
    Cookies%USERPROFILE%\Cookies
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    History%USERPROFILE%\Local Settings\History
    Local AppData%USERPROFILE%\Local Settings\Application Data
    Local Settings%USERPROFILE%\Local Settings
    My Pictures%USERPROFILE%\My Documents\My Pictures
    NetHood%USERPROFILE%\NetHood
    Personal%USERPROFILE%\My Documents
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu%USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup
    Templates%USERPROFILE%\Templates

    There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all the others are of type REG_EXPAND_SZ. @@ -562,18 +546,21 @@ You could also use:

    \\SambaServer\FolderShare\%USERNAME%

    in which case the default folders will be stored in the server named SambaServer in the share called FolderShare under a directory that has the name of the MS Windows -user as seen by the Linux/Unix file system. +user as seen by the Linux/UNIX file system.

    Please note that once you have created a default profile share, you MUST migrate a user's profile (default or custom) to it.

    MS Windows 200x/XP profiles may be Local or Roaming. A roaming profile will be cached locally unless the following registry key is created: -

    HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\"DeleteRoamingCache"=dword:00000001

    +

    +

    +HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
+	winlogon\"DeleteRoamingCache"=dword:00000001

    In which case, the local cache copy will be deleted on logout. -

    Common Errors

    +

    Common Errors

    The following are some typical errors/problems/questions that have been asked. -

    How does one set up roaming profiles for just one (or a few) user/s or group/s?

    +

    Setting up roaming profiles for just a few user's or group's?

    With samba-2.2.x the choice you have is to enable or disable roaming profiles support. It is a global only setting. The default is to have roaming profiles and the default path will locate them in the user's home @@ -585,42 +572,40 @@ those machines on which roaming profile support is NOT wanted it is then necessary to disable roaming profile handling in the registry of each such machine.

    -With samba-3.0.0 (soon to be released) you can have a global profile -setting in smb.conf _AND_ you can over-ride this by per-user settings +With samba-3 you can have a global profile +setting in smb.conf _AND_ you can over-ride this by per-user settings using the Domain User Manager (as with MS Windows NT4/ Win 2Kx).

    In any case, you can configure only one profile per user. That profile can be either: -

    A profile unique to that user
    A mandatory profile (one the user can not change)
    A group profile (really should be mandatory ie:unchangable)

    Can NOT use Roaming Profiles

    +

    • A profile unique to that user

    • A mandatory profile (one the user can not change)

    • A group profile (really should be mandatory ie:unchangable)

    Can NOT use Roaming Profiles

    +A user requested the following: “ - I dont want Roaming profile to be implemented, I just want to give users - local profiles only. -... - Please help me I am totally lost with this error from past two days I tried - everything and googled around quite a bit but of no help. Please help me. +I do not want Roaming profiles to be implemented. I want to give users a local profile alone. ... +Please help me I am totally lost with this error. For the past two days I tried everything, I googled +around but found no useful pointers. Please help me. ”

    -Your choices are: - - -

    Local profiles

    - I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out -

    Roaming profiles

    -

    can use auto-delete on logout option
    requires a registry key change on workstation

    - - Your choices are: - -

    Personal Roaming profiles

    - - should be preserved on a central server - - workstations 'cache' (store) a local copy - - used in case the profile can not be downloaded - at next logon -

    Group profiles

    - loaded from a central place

    Mandatory profiles

    - - can be personal or group - - can NOT be changed (except by an administrator -

    +The choices are: +

    Local profiles:

    + I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out +

    Roaming profiles:

    + As a user logs onto the network a centrally stored profile is copied to the workstation + to form a local profile. This local profile will persist (remain on the workstation disk) + unless a registry key is changed that will cause this profile to be automatically deleted + on logout. +

    +The Roaming Profile choices are: +

    Personal Roaming profiles

    + These are typically stored in a profile share on a central (or conveniently located + local) server. +

    + Workstations 'cache' (store) a local copy of the profile. This cached copy is used when + the profile can not be downloaded at next logon. +

    Group profiles

    These are loaded from a central profile server

    Mandatory profiles

    + Mandatory profiles can be created for a user as well as for any group that a user + is a member of. Mandatory profiles can NOT be changed by ordinary users. Only the administrator + can change or reconfigure a mandatory profile.

    - -

    A WinNT4/2K/XP profile can vary in size from 130KB to off the scale. Outlook PST files are most often part of the profile and can be many GB in size. On average (in a well controlled environment) roaming profile size of @@ -634,47 +619,34 @@ controls of how they can be changed as well as good discipline make up for a problem free site.

    Microsoft's answer to the PST problem is to store all email in an MS -Exchange Server back-end. But this is another story ...! -

    -So, having LOCAL profiles means: - -

    If lots of users user each machine - lot's of local disk storage needed for local profiles
    Every workstation the user logs into has it's own profile - can be very different from machine to machine

    - -On the other hand, having roaming profiles means: -

    The network administrator can control EVERY aspect of user profiles
    With the use of mandatory profiles - a drastic reduction in network management overheads
    User unhappiness about not being able to change their profiles soon fades as they get used to being able to work reliably

    - +Exchange Server back-end. This removes the need for a PST file.

    -I have managed and installed MANY NT/2K networks and have NEVER found one -where users who move from machine to machine are happy with local -profiles. In the long run local profiles bite them. -

    Changing the default profile

    “ -When the client tries to logon to the PDC it looks for a profile to download -where do I put this default profile. +LOCAL profiles mean: +

    • If each machine is used my many users then much local disk storage is needed for local profiles

    • Every workstation the user logs into has it's own profile, these can be very different from machine to machine

    +On the other hand, use of roaming profiles means: +

    • The network administrator can control the desktop environment of all users.

    • Use of mandatory profiles drasitcally reduces network management overheads.

    • In the long run users will be experience fewer problems.

    Changing the default profile

    +Question: +“ +When the client logs onto the domain controller it searches for a profile to download, +where do I put this default profile? ”

    -Firstly, your samba server need to be configured as a domain controller. -

    -	server = user
-    os level = 32 (or more)
-	domain logons = Yes
-

    -Plus you need to have a [netlogon] share that is world readable. +Firstly, the samba server needs to be configured as a domain controller. +This can be done by setting in smb.conf: +

    security = user
    os level = 32 (or more)
    domain logons = Yes

    +There must be an [netlogon] share that is world readable. It is a good idea to add a logon script to pre-set printer and drive connections. There is also a facility for automatically synchronizing the workstation time clock with that of the logon server (another good thing to do).

    Note

    To invoke auto-deletion of roaming profile from the local -workstation cache (disk storage) you need to use the Group Policy Editor +workstation cache (disk storage) use the Group Policy Editor to create a file called NTConfig.POL with the appropriate entries. This file needs to be located in the netlogon share root directory.

    -Oh, of course the windows clients need to be members of the domain. -Workgroup machines do NOT do network logons - so they never see domain -profiles. +Windows clients need to be members of the domain. Workgroup machines do NOT use network logons so +they do not interoperate with domain profiles.

    -Secondly, for roaming profiles you need: - - logon path = \\%N\profiles\%U (with some such path) - logon drive = H: (Z: is the default) - - Plus you need a PROFILES share that is world writable. -

    Prev Up Next
    Chapter 23. System and Account Policies Home Chapter 25. PAM based Distributed Authentication
    +For roaming profiles add to smb.conf: +

    +

    logon path = \\%N\profiles\%U
    # Default logon drive is Z:
    logon drive = H:
    # This requires a PROFILES share that is world writable.

    +

    Prev Up Next
    Chapter 23. System and Account Policies Home Chapter 25. PAM based Distributed Authentication
    diff --git a/docs/htmldocs/SWAT.html b/docs/htmldocs/SWAT.html index b4067d75d8..30df1ed778 100644 --- a/docs/htmldocs/SWAT.html +++ b/docs/htmldocs/SWAT.html @@ -1,4 +1,4 @@ -Chapter 32. SWAT - The Samba Web Administration Tool
    Chapter 32. SWAT - The Samba Web Administration Tool
    Prev Part IV. Migration and Updating Next

    Chapter 32. SWAT - The Samba Web Administration Tool

    John H. Terpstra

    Samba Team

    April 21, 2003

    Table of Contents

    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    +Chapter 32. SWAT - The Samba Web Administration Tool

    Chapter 32. SWAT - The Samba Web Administration Tool
    Prev Part IV. Migration and Updating Next

    Chapter 32. SWAT - The Samba Web Administration Tool

    John H. Terpstra

    Samba Team

    April 21, 2003

    Table of Contents

    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    There are many and varied opinions regarding the usefulness or otherwise of SWAT. No matter how hard one tries to produce the perfect configuration tool it remains an object of personal taste. SWAT is a tool that will allow web based configuration @@ -6,7 +6,7 @@ of samba. It has a wizard that may help to get samba configured quickly, it has sensitive help on each smb.conf parameter, it provides for monitoring of current state of connection information, and it allows network wide MS Windows network password management. -

    Features and Benefits

    +

    Features and Benefits

    There are network administrators who believe that it is a good idea to write systems documentation inside configuration files, for them SWAT will aways be a nasty tool. SWAT does not store the configuration file in any intermediate form, rather, it stores only the @@ -18,9 +18,9 @@ internal ordering. So before using SWAT please be warned - SWAT will completely replace your smb.conf with a fully optimised file that has been stripped of all comments you might have placed there and only non-default settings will be written to the file. -

    Enabling SWAT for use

    +

    Enabling SWAT for use

    SWAT should be installed to run via the network super daemon. Depending on which system -your Unix/Linux system has you will have either an inetd or +your UNIX/Linux system has you will have either an inetd or xinetd based system.

    The nature and location of the network super-daemon varies with the operating system @@ -72,7 +72,7 @@ So long as you log onto SWAT as the user rootHOME, GLOBALS, SHARES, PRINTERS, WIZARD, STATUS, VIEW, PASSWORD. -

    Securing SWAT through SSL

    +

    Securing SWAT through SSL

    Lots of people have asked about how to setup SWAT with SSL to allow for secure remote administration of Samba. Here is a method that works, courtesy of Markus Krieger

    @@ -82,22 +82,22 @@ Modifications to the swat setup are as following:

  • generate certificate and private key - 

    +
     root# /usr/bin/openssl req -new -x509 -days 365 -nodes -config \
- 	/usr/share/doc/packages/stunnel/stunnel.cnf \
+	/usr/share/doc/packages/stunnel/stunnel.cnf \
 	-out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem
-

  • +

  • remove swat-entry from [x]inetd

  • start stunnel - 

    +
     root# stunnel -p /etc/stunnel/stunnel.pem -d 901 \
 	 -l /usr/local/samba/bin/swat swat 
-

    • +

    afterwords simply contact to swat by using the URL https://myhost:901, accept the certificate and the SSL connection is up. -

    The SWAT Home Page

    +

    The SWAT Home Page

    The SWAT title page provides access to the latest Samba documentation. The manual page for each samba component is accessible from this page as are the Samba-HOWTO-Collection (this document) as well as the O'Reilly book "Using Samba". @@ -105,15 +105,14 @@ document) as well as the O'Reilly book "Using Samba". Administrators who wish to validate their samba configuration may obtain useful information from the man pages for the diagnostic utilities. These are available from the SWAT home page also. One diagnostic tool that is NOT mentioned on this page, but that is particularly -useful is ethereal, available from -http://www.ethereal.com. +useful is ethereal.

    Warning

    SWAT can be configured to run in demo mode. This is NOT recommended as it runs SWAT without authentication and with full administrative ability. ie: Allows changes to smb.conf as well as general operation with root privileges. The option that creates this ability is the -a flag to swat. Do not use this in any production environment. -

    Global Settings

    +

    Global Settings

    The Globals button will expose a page that allows configuration of the global parameters in smb.conf. There are three levels of exposure of the parameters:

    • @@ -126,8 +125,8 @@ in smb.conf. There are three levels of exposure of the parameters: will want to tamper with.

    To switch to other than Basic editing ability click on either the -Advanced or the Developer dial, then click the -Commit Changes button. +Advanced or the Developer button. You may also +do this by clicking on the radio button, then click the Commit Changes button.

    After making any changes to configuration parameters make sure that you click on the Commit Changes button before moving to another area otherwise @@ -135,7 +134,7 @@ your changes will be immediately lost.

    Note

    SWAT has context sensitive help. To find out what each parameter is for simply click the Help link to the left of the configuration parameter. -

    Share Settings

    +

    Share Settings

    To affect a currently configured share, simply click on the pull down button between the Choose Share and the Delete Share buttons, select the share you wish to operate on, then to edit the settings click on the @@ -145,7 +144,7 @@ select the share you wish to operate on, then to edit the settings click on the To create a new share, next to the button labelled Create Share enter into the text field the name of the share to be created, then click on the Create Share button. -

    Printers Settings

    +

    Printers Settings

    To affect a currently configured printer, simply click on the pull down button between the Choose Printer and the Delete Printer buttons, select the printer you wish to operate on, then to edit the settings click on the @@ -155,7 +154,7 @@ select the printer you wish to operate on, then to edit the settings click on th To create a new printer, next to the button labelled Create Printer enter into the text field the name of the share to be created, then click on the Create Printer button. -

    The SWAT Wizard

    +

    The SWAT Wizard

    The purpose if the SWAT Wizard is to help the Microsoft knowledgeable network administrator to configure Samba with a minimum of effort.

    @@ -171,7 +170,7 @@ Finally, there are a limited set of options that will determine what type of ser will be configured for, whether it will be a WINS server, participate as a WINS client, or operate with no WINS support. By clicking on one button you can elect to expose (or not) user home directories. -

    The Status Page

    +

    The Status Page

    The status page serves a limited purpose. Firstly, it allows control of the samba daemons. The key daemons that create the samba server environment are: smbd, nmbd, winbindd.

    @@ -182,11 +181,11 @@ conditions with minimal effort.

    Lastly, the Status page may be used to terminate specific smbd client connections in order to free files that may be locked. -

    The View Page

    +

    The View Page

    This page allows the administrator to view the optimised smb.conf file and, if you are particularly masochistic, will permit you also to see all possible global configuration parameters and their settings. -

    The Password Change Page

    +

    The Password Change Page

    The Password Change page is a popular tool. This tool allows the creation, deletion, deactivation and reactivation of MS Windows networking users on the local machine. Alternatively, you can use this tool to change a local password for a user account. @@ -197,4 +196,4 @@ required.

    One popular use for this tool is to change user passwords across a range of remote MS Windows servers. -

    Prev Up Next
    Chapter 31. Migration from NT4 PDC to Samba-3 PDC Home Part V. Troubleshooting
    +

    Prev Up Next
    Chapter 31. Migration from NT4 PDC to Samba-3 PDC Home Part V. Troubleshooting
    diff --git a/docs/htmldocs/Samba-Developers-Guide.html b/docs/htmldocs/Samba-Developers-Guide.html index 603c87d574..97e48f3e27 100644 --- a/docs/htmldocs/Samba-Developers-Guide.html +++ b/docs/htmldocs/Samba-Developers-Guide.html @@ -12,10 +12,7 @@ Please send updates to Jelmer Vernooij. This documentation is distributed under the GNU General Public License (GPL) version 2. A copy of the license is included with the Samba source distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt -">

    SAMBA Developers Guide

    SAMBA Team

    Attributions.  -

    Definition of NetBIOS Protocol and Name Resolution Modes

    • Luke Leighton

    Samba Architecture

    • Dan Shearer

    The samba DEBUG system

    • Chris Hertel

    Coding Suggestions

    • Steve French

    • Simo Sorce

    • Andrew Bartlett

    • Tim Potter

    • Martin Pool

    Samba Internals
    The smb.conf file

    • Chris Hertel

    NetBIOS in a Unix World

    • Andrew Tridgell

    Tracing samba system calls

    • Andrew Tridgell

    Finding useful information on windows
    NT Domain RPC's
    Samba Printing Internals

    • Gerald Carter

    Samba WINS Internals

    • Gerald Carter

    The Upcoming SAM System

    • Andrew Bartlett

    LanMan and NT Password Encryption
    Modules
    RPC Pluggable Modules
    VFS Modules
    Notes to packagers

    • Jelmer Vernooij

    Contributing code

    - -

    Abstract

    +">

    SAMBA Developers Guide

    Abstract

    Last Update : Fri Jun 6 00:45:54 CEST 2003

    This book is a collection of documents that might be useful for @@ -29,15 +26,15 @@ Please send updates to Jelmer Ve This documentation is distributed under the GNU General Public License (GPL) version 2. A copy of the license is included with the Samba source distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt -

    Table of Contents

    1. Definition of NetBIOS Protocol and Name Resolution Modes
    NETBIOS
    BROADCAST NetBIOS
    NBNS NetBIOS
    2. Samba Architecture
    Introduction
    Multithreading and Samba
    Threading smbd
    Threading nmbd
    nbmd Design
    3. The samba DEBUG system
    New Output Syntax
    The DEBUG() Macro
    The DEBUGADD() Macro
    The DEBUGLVL() Macro
    New Functions
    dbgtext()
    dbghdr()
    format_debug_text()
    4. Coding Suggestions
    5. Samba Internals
    Character Handling
    The new functions
    Macros in byteorder.h
    CVAL(buf,pos)
    PVAL(buf,pos)
    SCVAL(buf,pos,val)
    SVAL(buf,pos)
    IVAL(buf,pos)
    SVALS(buf,pos)
    IVALS(buf,pos)
    SSVAL(buf,pos,val)
    SIVAL(buf,pos,val)
    SSVALS(buf,pos,val)
    SIVALS(buf,pos,val)
    RSVAL(buf,pos)
    RIVAL(buf,pos)
    RSSVAL(buf,pos,val)
    RSIVAL(buf,pos,val)
    LAN Manager Samba API
    Parameters
    Return value
    Code character table
    6. The smb.conf file
    Lexical Analysis
    Handling of Whitespace
    Handling of Line Continuation
    Line Continuation Quirks
    Syntax
    About params.c
    7. NetBIOS in a Unix World
    Introduction
    Usernames
    File Ownership
    Passwords
    Locking
    Deny Modes
    Trapdoor UIDs
    Port numbers
    Protocol Complexity
    8. Tracing samba system calls
    9. Finding useful information on windows
    Netlogon debugging output
    10. NT Domain RPC's
    Introduction
    Sources
    Credits
    Notes and Structures
    Notes
    Enumerations
    Structures
    MSRPC over Transact Named Pipe
    MSRPC Pipes
    Header
    Tail
    RPC Bind / Bind Ack
    NTLSA Transact Named Pipe
    LSA Open Policy
    LSA Query Info Policy
    LSA Enumerate Trusted Domains
    LSA Open Secret
    LSA Close
    LSA Lookup SIDS
    LSA Lookup Names
    NETLOGON rpc Transact Named Pipe
    LSA Request Challenge
    LSA Authenticate 2
    LSA Server Password Set
    LSA SAM Logon
    LSA SAM Logoff
    \\MAILSLOT\NET\NTLOGON
    Query for PDC
    SAM Logon
    SRVSVC Transact Named Pipe
    Net Share Enum
    Net Server Get Info
    Cryptographic side of NT Domain Authentication
    Definitions
    Protocol
    Comments
    SIDs and RIDs
    Well-known SIDs
    Well-known RIDS
    11. Samba Printing Internals
    Abstract
    +

    Table of Contents

    Attributions
    1. Definition of NetBIOS Protocol and Name Resolution Modes
    NETBIOS
    BROADCAST NetBIOS
    NBNS NetBIOS
    2. Samba Architecture
    Introduction
    Multithreading and Samba
    Threading smbd
    Threading nmbd
    nbmd Design
    3. The samba DEBUG system
    New Output Syntax
    The DEBUG() Macro
    The DEBUGADD() Macro
    The DEBUGLVL() Macro
    New Functions
    dbgtext()
    dbghdr()
    format_debug_text()
    4. Coding Suggestions
    5. Samba Internals
    Character Handling
    The new functions
    Macros in byteorder.h
    CVAL(buf,pos)
    PVAL(buf,pos)
    SCVAL(buf,pos,val)
    SVAL(buf,pos)
    IVAL(buf,pos)
    SVALS(buf,pos)
    IVALS(buf,pos)
    SSVAL(buf,pos,val)
    SIVAL(buf,pos,val)
    SSVALS(buf,pos,val)
    SIVALS(buf,pos,val)
    RSVAL(buf,pos)
    RIVAL(buf,pos)
    RSSVAL(buf,pos,val)
    RSIVAL(buf,pos,val)
    LAN Manager Samba API
    Parameters
    Return value
    Code character table
    6. The smb.conf file
    Lexical Analysis
    Handling of Whitespace
    Handling of Line Continuation
    Line Continuation Quirks
    Syntax
    About params.c
    7. NetBIOS in a Unix World
    Introduction
    Usernames
    File Ownership
    Passwords
    Locking
    Deny Modes
    Trapdoor UIDs
    Port numbers
    Protocol Complexity
    8. Tracing samba system calls
    9. Finding useful information on windows
    Netlogon debugging output
    10. NT Domain RPC's
    Introduction
    Sources
    Credits
    Notes and Structures
    Notes
    Enumerations
    Structures
    MSRPC over Transact Named Pipe
    MSRPC Pipes
    Header
    Tail
    RPC Bind / Bind Ack
    NTLSA Transact Named Pipe
    LSA Open Policy
    LSA Query Info Policy
    LSA Enumerate Trusted Domains
    LSA Open Secret
    LSA Close
    LSA Lookup SIDS
    LSA Lookup Names
    NETLOGON rpc Transact Named Pipe
    LSA Request Challenge
    LSA Authenticate 2
    LSA Server Password Set
    LSA SAM Logon
    LSA SAM Logoff
    \\MAILSLOT\NET\NTLOGON
    Query for PDC
    SAM Logon
    SRVSVC Transact Named Pipe
    Net Share Enum
    Net Server Get Info
    Cryptographic side of NT Domain Authentication
    Definitions
    Protocol
    Comments
    SIDs and RIDs
    Well-known SIDs
    Well-known RIDS
    11. Samba Printing Internals
    Abstract
    Printing Interface to Various Back ends -
    +
    Print Queue TDB's -
    +
    ChangeID and Client Caching of Printer Information -
    +
    Windows NT/2K Printer Change Notify -
    12. Samba WINS Internals
    WINS Failover
    13. The Upcoming SAM System
    Security in the 'new SAM'
    Standalone from UNIX
    Handles and Races in the new SAM
    Layers
    Application
    SAM Interface
    SAM Modules
    SAM Modules
    Special Module: sam_passdb
    sam_ads
    Memory Management
    Testing
    14. LanMan and NT Password Encryption
    Introduction
    How does it work?
    The smbpasswd file
    15. Modules
    Advantages
    Loading modules
    Static modules
    Shared modules
    Writing modules
    Static/Shared selection in configure.in
    16. RPC Pluggable Modules
    About
    General Overview
    17. VFS Modules
    The Samba (Posix) VFS layer
    The general interface
    Possible VFS operation layers
    The Interaction between the Samba VFS subsystem and the modules
    Initialization and registration
    How the Modules handle per connection data
    Upgrading to the New VFS Interface
    Upgrading from 2.2.* and 3.0aplha modules
    Some Notes
    Implement TRANSPARENT functions
    Implement OPAQUE functions
    18. Notes to packagers
    Versioning
    Modules
    19. Contributing code

    Chapter 1. Definition of NetBIOS Protocol and Name Resolution Modes

    Luke Leighton

    12 June 1997

    Table of Contents

    NETBIOS
    BROADCAST NetBIOS
    NBNS NetBIOS

    NETBIOS

    +

    12. Samba WINS Internals
    WINS Failover
    13. The Upcoming SAM System
    Security in the 'new SAM'
    Standalone from UNIX
    Handles and Races in the new SAM
    Layers
    Application
    SAM Interface
    SAM Modules
    SAM Modules
    Special Module: sam_passdb
    sam_ads
    Memory Management
    Testing
    14. LanMan and NT Password Encryption
    Introduction
    How does it work?
    The smbpasswd file
    15. Modules
    Advantages
    Loading modules
    Static modules
    Shared modules
    Writing modules
    Static/Shared selection in configure.in
    16. RPC Pluggable Modules
    About
    General Overview
    17. VFS Modules
    The Samba (Posix) VFS layer
    The general interface
    Possible VFS operation layers
    The Interaction between the Samba VFS subsystem and the modules
    Initialization and registration
    How the Modules handle per connection data
    Upgrading to the New VFS Interface
    Upgrading from 2.2.* and 3.0aplha modules
    Some Notes
    Implement TRANSPARENT functions
    Implement OPAQUE functions
    18. Notes to packagers
    Versioning
    Modules
    19. Contributing code

    Attributions

    Definition of NetBIOS Protocol and Name Resolution Modes

    • Luke Leighton

    Samba Architecture

    • Dan Shearer

    The samba DEBUG system

    • Chris Hertel

    Coding Suggestions

    • Steve French

    • Simo Sorce

    • Andrew Bartlett

    • Tim Potter

    • Martin Pool

    Samba Internals

    The smb.conf file

    • Chris Hertel

    NetBIOS in a Unix World

    • Andrew Tridgell

    Tracing samba system calls

    • Andrew Tridgell

    Finding useful information on windows

    NT Domain RPC's

    Samba Printing Internals

    • Gerald Carter

    Samba WINS Internals

    • Gerald Carter

    The Upcoming SAM System

    • Andrew Bartlett

    LanMan and NT Password Encryption

    Modules

    RPC Pluggable Modules

    VFS Modules

    Notes to packagers

    • Jelmer Vernooij

    Contributing code

    Chapter 1. Definition of NetBIOS Protocol and Name Resolution Modes

    Luke Leighton

    12 June 1997

    Table of Contents

    NETBIOS
    BROADCAST NetBIOS
    NBNS NetBIOS

    NETBIOS

    NetBIOS runs over the following tranports: TCP/IP; NetBEUI and IPX/SPX. Samba only uses NetBIOS over TCP/IP. For details on the TCP/IP NetBIOS Session Service NetBIOS Datagram Service, and NetBIOS Names, see @@ -78,7 +75,7 @@ NetBIOS names are either UNIQUE or GROUP. Only one application can claim a UNIQUE NetBIOS name on a network.

    There are two kinds of NetBIOS Name resolution: Broadcast and Point-to-Point. -

    BROADCAST NetBIOS

    +

    BROADCAST NetBIOS

    Clients can claim names, and therefore offer services on successfully claimed names, on their broadcast-isolated subnet. One way to get NetBIOS services (such as browsing: see ftp.microsoft.com/drg/developr/CIFS/browdiff.txt; and @@ -90,7 +87,7 @@ find that some of your hosts spend 95 percent of their time dealing with broadcast traffic. [If you have IPX/SPX on your LAN or WAN, you will find that this is already happening: a packet analyzer will show, roughly every twelve minutes, great swathes of broadcast traffic!]. -

    NBNS NetBIOS

    +

    NBNS NetBIOS

    rfc1001.txt describes, amongst other things, the implementation and use of, a 'NetBIOS Name Service'. NT/AS offers 'Windows Internet Name Service' which is fully rfc1001/2 compliant, but has had to take specific action @@ -131,7 +128,7 @@ WINS Clients therefore claim names from the WINS server. If the WINS server allows them to register a name, the client's NetBIOS session service can then offer services on this name. Other WINS clients will then contact the WINS server to resolve a NetBIOS name. -

    Chapter 2. Samba Architecture

    Dan Shearer

    November 1997

    Table of Contents

    Introduction
    Multithreading and Samba
    Threading smbd
    Threading nmbd
    nbmd Design

    Introduction

    +

    Chapter 2. Samba Architecture

    Dan Shearer

    November 1997

    Table of Contents

    Introduction
    Multithreading and Samba
    Threading smbd
    Threading nmbd
    nbmd Design

    Introduction

    This document gives a general overview of how Samba works internally. The Samba Team has tried to come up with a model which is the best possible compromise between elegance, portability, security @@ -142,7 +139,7 @@ It also tries to answer some of the frequently asked questions such as:

    1. Is Samba secure when running on Unix? The xyz platform? What about the root priveliges issue? -

    2. Pros and cons of multithreading in various parts of Samba

    3. Why not have a separate process for name resolution, WINS, and browsing?

    Multithreading and Samba

    +

  • Pros and cons of multithreading in various parts of Samba

  • Why not have a separate process for name resolution, WINS, and browsing?

    • Multithreading and Samba

    People sometimes tout threads as a uniformly good thing. They are very nice in their place but are quite inappropriate for smbd. nmbd is another matter, and multi-threading it would be very nice. @@ -159,7 +156,7 @@ smbd multi-threaded. Multi-threading would actually make Samba much slower, less scalable, less portable and much less robust. The fact that we use a separate process for each connection is one of Samba's biggest advantages. -

    Threading smbd

    +

    Threading smbd

    A few problems that would arise from a threaded smbd are:

    1. It's not only to create threads instead of processes, but you @@ -184,7 +181,7 @@ A few problems that would arise from a threaded smbd are:

    2. we couldn't use the system locking calls as the locking context of fcntl() is a process, not a thread. -

    Threading nmbd

    +

    Threading nmbd

    This would be ideal, but gets sunk by portability requirements.

    Andrew tried to write a test threads library for nmbd that used only @@ -211,7 +208,7 @@ packet that arrives. Having a pool of processes is possible but is nasty to program cleanly due to the enormous amount of shared data (in complex structures) between the processes. We can't rely on each platform having a shared memory system. -

    nbmd Design

    +

    nbmd Design

    Originally Andrew used recursion to simulate a multi-threaded environment, which use the stack enormously and made for really confusing debugging sessions. Luke Leighton rewrote it to use a @@ -228,11 +225,11 @@ a single process.

    Then Jeremy rewrote nmbd. The packet data in nmbd isn't what's on the wire. It's a nice format that is very amenable to processing but still -keeps the idea of a distinct packet. See "struct packet_struct" in +keeps the idea of a distinct packet. See "struct packet_struct" in nameserv.h. It has all the detail but none of the on-the-wire mess. This makes it ideal for using in disk or memory-based databases for browsing and WINS support. -

    Chapter 3. The samba DEBUG system

    Chris Hertel

    July 1998

    Table of Contents

    New Output Syntax
    The DEBUG() Macro
    The DEBUGADD() Macro
    The DEBUGLVL() Macro
    New Functions
    dbgtext()
    dbghdr()
    format_debug_text()

    New Output Syntax

    +

    Chapter 3. The samba DEBUG system

    Chris Hertel

    July 1998

    Table of Contents

    New Output Syntax
    The DEBUG() Macro
    The DEBUGADD() Macro
    The DEBUGLVL() Macro
    New Functions
    dbgtext()
    dbghdr()
    format_debug_text()

    New Output Syntax

    The syntax of a debugging log file is represented as: 

       >debugfile< :== { >debugmsg< }
@@ -285,16 +282,16 @@ by a newline.
 Note that in the above example the function names are not listed on
 the header line. That's because the example above was generated on an
 SGI Indy, and the SGI compiler doesn't support the __FUNCTION__ macro.
-

    The DEBUG() Macro

    +

    The DEBUG() Macro

    Use of the DEBUG() macro is unchanged. DEBUG() takes two parameters. The first is the message level, the second is the body of a function call to the Debug1() function.

    That's confusing.

    Here's an example which may help a bit. If you would write

    -printf( "This is a %s message.\n", "debug" );
+printf( "This is a %s message.\n", "debug" );

    to send the output to stdout, then you would write 

    -DEBUG( 0, ( "This is a %s message.\n", "debug" ) );
+DEBUG( 0, ( "This is a %s message.\n", "debug" ) );

    to send the output to the debug file. All of the normal printf() formatting escapes work. @@ -319,12 +316,12 @@ DEBUG() is called, the new input is simply appended. DEBUG() has been used to write partial lines. Here's a simple (dumb) example of the kind of thing I'm talking about: 

    -    DEBUG( 0, ("The test returned " ) );
+    DEBUG( 0, ("The test returned " ) );
     if( test() )
-      DEBUG(0, ("True") );
+      DEBUG(0, ("True") );
     else
-      DEBUG(0, ("False") );
-    DEBUG(0, (".\n") );
+      DEBUG(0, ("False") );
+    DEBUG(0, (".\n") );

    Without the format buffer, the output (assuming test() returned true) would look like this: @@ -336,35 +333,35 @@ would look like this: [1998/07/30 16:00:51, 0] file.c:function(261) .

    Which isn't much use. The format buffer kludge fixes this problem. -

    The DEBUGADD() Macro

    +

    The DEBUGADD() Macro

    In addition to the kludgey solution to the broken line problem described above, there is a clean solution. The DEBUGADD() macro never generates a header. It will append new text to the current debug message even if the format buffer is empty. The syntax of the DEBUGADD() macro is the same as that of the DEBUG() macro. 

    -    DEBUG( 0, ("This is the first line.\n" ) );
-    DEBUGADD( 0, ("This is the second line.\nThis is the third line.\n" ) );
+    DEBUG( 0, ("This is the first line.\n" ) );
+    DEBUGADD( 0, ("This is the second line.\nThis is the third line.\n" ) );

    Produces

         [1998/07/30 16:00:51, 0] file.c:function(512)
       This is the first line.
       This is the second line.
       This is the third line.
-

    The DEBUGLVL() Macro

    +

    The DEBUGLVL() Macro

    One of the problems with the DEBUG() macro was that DEBUG() lines tended to get a bit long. Consider this example from nmbd_sendannounce.c: 

    -  DEBUG(3,("send_local_master_announcement: type %x for name %s on subnet %s for workgroup %s\n",
+  DEBUG(3,("send_local_master_announcement: type %x for name %s on subnet %s for workgroup %s\n",
             type, global_myname, subrec->subnet_name, work->work_group));

    One solution to this is to break it down using DEBUG() and DEBUGADD(), as follows: 

    -  DEBUG( 3, ( "send_local_master_announcement: " ) );
-  DEBUGADD( 3, ( "type %x for name %s ", type, global_myname ) );
-  DEBUGADD( 3, ( "on subnet %s ", subrec->subnet_name ) );
-  DEBUGADD( 3, ( "for workgroup %s\n", work->work_group ) );
+  DEBUG( 3, ( "send_local_master_announcement: " ) );
+  DEBUGADD( 3, ( "type %x for name %s ", type, global_myname ) );
+  DEBUGADD( 3, ( "on subnet %s ", subrec->subnet_name ) );
+  DEBUGADD( 3, ( "for workgroup %s\n", work->work_group ) );

    A similar, but arguably nicer approach is to use the DEBUGLVL() macro. This macro returns True if the message level is less than or equal to @@ -372,10 +369,10 @@ the global DEBUGLEVEL value, so: 

       if( DEBUGLVL( 3 ) )
     {
-    dbgtext( "send_local_master_announcement: " );
-    dbgtext( "type %x for name %s ", type, global_myname );
-    dbgtext( "on subnet %s ", subrec->subnet_name );
-    dbgtext( "for workgroup %s\n", work->work_group );
+    dbgtext( "send_local_master_announcement: " );
+    dbgtext( "type %x for name %s ", type, global_myname );
+    dbgtext( "on subnet %s ", subrec->subnet_name );
+    dbgtext( "for workgroup %s\n", work->work_group );
     }

    (The dbgtext() function is explained below.)

    There are a few advantages to this scheme:

    1. The test is performed only once. @@ -385,7 +382,7 @@ within the DEBUGLVL() block.

    2. Processing that is only relevant to debug output can be contained within the DEBUGLVL() block. -

    New Functions

    dbgtext()

    +

    New Functions

    dbgtext()

    This function prints debug message text to the debug file (and possibly to syslog) via the format buffer. The function uses a variable argument list just like printf() or Debug1(). The @@ -394,7 +391,7 @@ and then passed to format_debug_text(). If you use DEBUGLVL() you will probably print the body of the message using dbgtext(). -

    dbghdr()

    +

    dbghdr()

    This is the function that writes a debug message header. Headers are not processed via the format buffer. Also note that if the format buffer is not empty, a call to dbghdr() will not @@ -402,7 +399,7 @@ produce any output. See the comments in dbghdr() for more info.

    It is not likely that this function will be called directly. It is used by DEBUG() and DEBUGADD(). -

    format_debug_text()

    +

    format_debug_text()

    This is a static function in debug.c. It stores the output text for the body of the message in a buffer until it encounters a newline. When the newline character is found, the buffer is @@ -484,7 +481,7 @@ Here are some other suggestions: reason: consistency

  • don't explicitly extern functions (they are autogenerated by - "make proto" into proto.h) + "make proto" into proto.h) reason: consistency

  • use endian safe macros when unpacking SMBs (see byteorder.h and @@ -553,7 +550,7 @@ The suggestions above are simply that, suggestions, but the information may help in reducing the routine rework done on new code. The preceeding list is expected to change routinely as new support routines and macros are added. -

    • Chapter 5. Samba Internals

    8 May 1996

    Table of Contents

    Character Handling
    The new functions
    Macros in byteorder.h
    CVAL(buf,pos)
    PVAL(buf,pos)
    SCVAL(buf,pos,val)
    SVAL(buf,pos)
    IVAL(buf,pos)
    SVALS(buf,pos)
    IVALS(buf,pos)
    SSVAL(buf,pos,val)
    SIVAL(buf,pos,val)
    SSVALS(buf,pos,val)
    SIVALS(buf,pos,val)
    RSVAL(buf,pos)
    RIVAL(buf,pos)
    RSSVAL(buf,pos,val)
    RSIVAL(buf,pos,val)
    LAN Manager Samba API
    Parameters
    Return value
    Code character table

    Character Handling

    +

    Chapter 5. Samba Internals

    8 May 1996

    Table of Contents

    Character Handling
    The new functions
    Macros in byteorder.h
    CVAL(buf,pos)
    PVAL(buf,pos)
    SCVAL(buf,pos,val)
    SVAL(buf,pos)
    IVAL(buf,pos)
    SVALS(buf,pos)
    IVALS(buf,pos)
    SSVAL(buf,pos,val)
    SIVAL(buf,pos,val)
    SSVALS(buf,pos,val)
    SIVALS(buf,pos,val)
    RSVAL(buf,pos)
    RIVAL(buf,pos)
    RSSVAL(buf,pos,val)
    RSIVAL(buf,pos,val)
    LAN Manager Samba API
    Parameters
    Return value
    Code character table

    Character Handling

    This section describes character set handling in Samba, as implemented in Samba 3.0 and above

    @@ -563,12 +560,12 @@ strings to/from DOS codepages. The problem is that there was no way of telling if a particular char* is in dos codepage or unix codepage. This led to a nightmare of code that tried to cope with particular cases without handlingt the general case. -

    The new functions

    +

    The new functions

    The new system works like this:

    1. - all char* strings inside Samba are "unix" strings. These are - multi-byte strings that are in the charset defined by the "unix - charset" option in smb.conf. + all char* strings inside Samba are "unix" strings. These are + multi-byte strings that are in the charset defined by the "unix + charset" option in smb.conf.

    2. there is no single fixed character set for unix strings, but any character set that is used does need the following properties: @@ -621,32 +618,32 @@ The new system works like this: like strchr_m(). I know this is very slow, and we will eventually speed it up but right now we want this stuff correct not fast.

    3. - all lp_ functions now return unix strings. The magic "DOS" flag on + all lp_ functions now return unix strings. The magic "DOS" flag on parameters is gone.

    4. all vfs functions take unix strings. Don't convert when passing to them -

    Macros in byteorder.h

    +

    Macros in byteorder.h

    This section describes the macros defined in byteorder.h. These macros are used extensively in the Samba code. -

    CVAL(buf,pos)

    +

    CVAL(buf,pos)

    returns the byte at offset pos within buffer buf as an unsigned character. -

    PVAL(buf,pos)

    returns the value of CVAL(buf,pos) cast to type unsigned integer.

    SCVAL(buf,pos,val)

    sets the byte at offset pos within buffer buf to value val.

    SVAL(buf,pos)

    +

    PVAL(buf,pos)

    returns the value of CVAL(buf,pos) cast to type unsigned integer.

    SCVAL(buf,pos,val)

    sets the byte at offset pos within buffer buf to value val.

    SVAL(buf,pos)

    returns the value of the unsigned short (16 bit) little-endian integer at offset pos within buffer buf. An integer of this type is sometimes - refered to as "USHORT". -

    IVAL(buf,pos)

    returns the value of the unsigned 32 bit little-endian integer at offset -pos within buffer buf.

    SVALS(buf,pos)

    returns the value of the signed short (16 bit) little-endian integer at -offset pos within buffer buf.

    IVALS(buf,pos)

    returns the value of the signed 32 bit little-endian integer at offset pos -within buffer buf.

    SSVAL(buf,pos,val)

    sets the unsigned short (16 bit) little-endian integer at offset pos within -buffer buf to value val.

    SIVAL(buf,pos,val)

    sets the unsigned 32 bit little-endian integer at offset pos within buffer -buf to the value val.

    SSVALS(buf,pos,val)

    sets the short (16 bit) signed little-endian integer at offset pos within -buffer buf to the value val.

    SIVALS(buf,pos,val)

    sets the signed 32 bit little-endian integer at offset pos withing buffer -buf to the value val.

    RSVAL(buf,pos)

    returns the value of the unsigned short (16 bit) big-endian integer at -offset pos within buffer buf.

    RIVAL(buf,pos)

    returns the value of the unsigned 32 bit big-endian integer at offset -pos within buffer buf.

    RSSVAL(buf,pos,val)

    sets the value of the unsigned short (16 bit) big-endian integer at + refered to as "USHORT". +

    IVAL(buf,pos)

    returns the value of the unsigned 32 bit little-endian integer at offset +pos within buffer buf.

    SVALS(buf,pos)

    returns the value of the signed short (16 bit) little-endian integer at +offset pos within buffer buf.

    IVALS(buf,pos)

    returns the value of the signed 32 bit little-endian integer at offset pos +within buffer buf.

    SSVAL(buf,pos,val)

    sets the unsigned short (16 bit) little-endian integer at offset pos within +buffer buf to value val.

    SIVAL(buf,pos,val)

    sets the unsigned 32 bit little-endian integer at offset pos within buffer +buf to the value val.

    SSVALS(buf,pos,val)

    sets the short (16 bit) signed little-endian integer at offset pos within +buffer buf to the value val.

    SIVALS(buf,pos,val)

    sets the signed 32 bit little-endian integer at offset pos withing buffer +buf to the value val.

    RSVAL(buf,pos)

    returns the value of the unsigned short (16 bit) big-endian integer at +offset pos within buffer buf.

    RIVAL(buf,pos)

    returns the value of the unsigned 32 bit big-endian integer at offset +pos within buffer buf.

    RSSVAL(buf,pos,val)

    sets the value of the unsigned short (16 bit) big-endian integer at offset pos within buffer buf to value val. -refered to as "USHORT".

    RSIVAL(buf,pos,val)

    sets the value of the unsigned 32 bit big-endian integer at offset -pos within buffer buf to value val.

    LAN Manager Samba API

    +refered to as "USHORT".

    RSIVAL(buf,pos,val)

    sets the value of the unsigned 32 bit big-endian integer at offset +pos within buffer buf to value val.

    LAN Manager Samba API

    This section describes the functions need to make a LAN Manager RPC call. This information had been obtained by examining the Samba code and the LAN Manager 2.0 API documentation. It should not be considered entirely @@ -659,7 +656,7 @@ call_api(int prcnt, int drcnt, int mprcnt, int mdrcnt,

    This function is defined in client.c. It uses an SMB transaction to call a remote api. -

    Parameters

    The parameters are as follows:

    1. +

      Parameters

      The parameters are as follows:

      1. prcnt: the number of bytes of parameters begin sent.

      2. drcnt: the number of bytes of data begin sent. @@ -692,8 +689,8 @@ in the manual, not the data which is actually passed. An ASCIIZ string describing the data structure which ought to be returned.

      3. Any parameters which appear in the function call, as defined in the LAN -Manager API documentation, after the "Server" and up to and including the -"uLevel" parameters. +Manager API documentation, after the "Server" and up to and including the +"uLevel" parameters.

      4. An unsigned 16 bit integer which gives the size in bytes of the buffer we will use to receive the returned array of data structures. Presumably this @@ -704,7 +701,7 @@ substructures apply, this string is of zero length.

      The code in client.c always calls call_api() with no data. It is unclear when a non-zero length data buffer would be sent. -

      Return value

      +

      Return value

      The returned parameters (pointed to by rparam), in their order of appearance are:

      1. An unsigned 16 bit integer which contains the API function's return code. @@ -721,9 +718,9 @@ It is also possible that this may sometimes be the number of bytes returned.

      When call_api() returns, rparam points to the returned parameters. The first if these is the result code. It will be zero if the API call -suceeded. This value by be read with "SVAL(rparam,0)". +suceeded. This value by be read with "SVAL(rparam,0)".

      -The second parameter may be read as "SVAL(rparam,2)". It is a 16 bit offset +The second parameter may be read as "SVAL(rparam,2)". It is a 16 bit offset which indicates what the base address of the returned data buffer was when it was built on the server. It should be used to correct pointer before use. @@ -732,10 +729,10 @@ The returned data buffer contains the array of returned data structures. Note that all pointers must be adjusted before use. The function fix_char_ptr() in client.c can be used for this purpose.

      -The third parameter (which may be read as "SVAL(rparam,4)") has something to +The third parameter (which may be read as "SVAL(rparam,4)") has something to do with indicating the amount of data returned or possibly the amount of data which can be returned if enough buffer space is allowed. -

    Code character table

    +

    Code character table

    Certain data structures are described by means of ASCIIz strings containing code characters. These are the code characters:

    1. @@ -758,7 +755,7 @@ r pointer to returned data buffer??? L length in bytes of returned data buffer???

    2. h number of bytes of information available??? -

    Chapter 6. The smb.conf file

    Chris Hertel

    November 1997

    Table of Contents

    Lexical Analysis
    Handling of Whitespace
    Handling of Line Continuation
    Line Continuation Quirks
    Syntax
    About params.c

    Lexical Analysis

    +

    Chapter 6. The smb.conf file

    Chris Hertel

    November 1997

    Table of Contents

    Lexical Analysis
    Handling of Whitespace
    Handling of Line Continuation
    Line Continuation Quirks
    Syntax
    About params.c

    Lexical Analysis

    Basically, the file is processed on a line by line basis. There are four types of lines that are recognized by the lexical analyzer (params.c): @@ -785,7 +782,7 @@ ignores them. The latter two line types are scanned for These are the only tokens passed to the parameter loader (loadparm.c). Parameter names and values are divided from one another by an equal sign: '='. -

    Handling of Whitespace

    +

    Handling of Whitespace

    Whitespace is defined as all characters recognized by the isspace() function (see ctype(3C)) except for the newline character ('\n') The newline is excluded because it identifies the end of the line. @@ -800,7 +797,7 @@ the exception of carriage return characters ('\r'), all of which are removed.

  • Leading and trailing whitespace is removed from names and values. -

    • Handling of Line Continuation

    +

    Handling of Line Continuation

    Long section header and parameter lines may be extended across multiple lines by use of the backslash character ('\\'). Line continuation is ignored for blank and comment lines. @@ -823,7 +820,7 @@ line, plus the four preceeding the word 'with' in the second line. Line continuation characters are ignored on blank lines and at the end of comments. They are *only* recognized within section and parameter lines. -

    Line Continuation Quirks

    Note the following example:

    +

    Line Continuation Quirks

    Note the following example:

     	param name = parameter value string \
     \
     with line continuation.
@@ -847,7 +844,7 @@ terminating character, and the rest of the line is ignored.  The lines

    are read as

     	[section name]
     param name = value
-

    Syntax

    The syntax of the smb.conf file is as follows:

    +

    Syntax

    The syntax of the smb.conf file is as follows:

       <file>            :==  { <section> } EOF
   <section>         :==  <section header> { <parameter line> }
   <section header>  :==  '[' NAME ']'
@@ -866,12 +863,12 @@ terminating character, and the rest of the line is ignored.  The lines
 	A parameter line is divided into a NAME and a VALUE.  The *first*
 	equal sign on the line separates the NAME from the VALUE.  The
 	VALUE is terminated by a newline character (NL = '\n').
-

    About params.c

    +

    About params.c

    The parsing of the config file is a bit unusual if you are used to lex, yacc, bison, etc. Both lexical analysis (scanning) and parsing are performed by params.c. Values are loaded via callbacks to loadparm.c. -

    Chapter 7. NetBIOS in a Unix World

    Andrew Tridgell

    April 1995

    Table of Contents

    Introduction
    Usernames
    File Ownership
    Passwords
    Locking
    Deny Modes
    Trapdoor UIDs
    Port numbers
    Protocol Complexity

    Introduction

    +

    SAx‘~˜\p¹yN.|À^Ç’3ªý¢bœÍEÜ#)ã¨Ç–3æ>å¼\Gqö‚ÃÂkS,Û}Ü^(zår˜¼úåàUƒ¦ÒëD­/ÅÄ¥—ë¾øa~¤qZ‡GïÒ‘È"KUgÃØËeZ eÖ”Bu<äL^ÑHz±_pXøíXHu\O§tRjjJ¦DoZ>Š²^ˆép7ˆââÎ ? oÙ d’m ¶óDEš…‰Îtra}M¦¬Ôž»]ÜÙaá‡ÓÛöÂr†ý°´ƒW.Š…k-/¨\Šrȇ²)³18'^›Hâ'ˇu¤…$œ3!S LpŸíØ ¸_Æu,kÛÏ‘ ªïûÒaáÏÑgkÿÃ%–t!a’y!FÜRÓ´ei¸„ÓL¡‹/8,üút½ó†#Ád¤Ðf!¨v à8&p»>Û ¯·þÂ9Õ®†“ Б0ñèñ‡Œ$×ÉaáçÊ…§°@F2>õþ’ ®öÿORAòq{! hÎ"ò …Ëi\¸ø‚ÃÂϦgò‘b•-rm ü#d5˜áB¼!Ö}íê.šèQnVâÿGóL|Á‘NÂ1è"2z>$‰‡?Žý0Õ¹h\øÁXP:yð®ÈæÀ¤ñ2qÑë’ˆ².W½½ìU&)ÓA˜¥YBœ\øIXP9i{˜·šŒVM}h²Dø‰×&êñw“ÓN™\3 1Œ)"¿L1¦'jyÆ¢èuÒdÒea±0$M '*š¦ŒA[Úü õÚ + ?Œ¢a“¾á¼—ø8ù’JNulJ-uZJÊun`º’´ZDǹϤZþð•Úä}öq{au ªÆ1,„êyAFÇo§ú'ÆB©µøÃX‡&BN†ÜL½ªAG&MÚ!¯C–ÚÕ­iúԈشҘtHÆ¡-ÔÆÂôS1)£›\  ¥ª˜ÝÉáêâÎ?G.»Ï²à«” uB†Rµ™=o{Ma¢115`K˜OjÏúñXøäú cÈEQû½)8U“ÌãÀÔTŽ£[á‡b¡6×r)t² ~+3b!d‚•x£“:B¹ dOi™/¿ Ÿ]! †>b‚0´èHCŸs^På‚…N.ü@©Â^é)]Õ%í ¿zA,TC7ZÓÅÁŒÌLú¤¢Éô«±ðt>RèQÞOáÔó>Ž%ëýpikòí…?^û²-µWhS*Íý`(;‰zQc’¡œéÀ!q-2#DjsM¦á§‡*Æx÷9 ù<m‚Ky¢½Ážqßdøù‘ÏKþ2tIX>e¾‡þËë”ñºÆ˜€±8Š›±d,iA38fBCZb~/½£Ÿêfàÿ5[Éóæy.¾ðsìß=‹Ú ¡è¨ŸZß¹ÀyD˜jRãt„kë#ü­Fu¶³&‡†\;þIx¬^;·žl;\àN…—qX¸‡…Ä1ÿGí… 0„ÏÕ/ôøÓ×!†ù[c-1Äðk2$XE€q†ŽþV,rÔG•¼*¾T’ÙÁ€¹c<¹Ö†Î1Æ îôq ¶êpr‰#VqX¸Gʯó\Gz®–ç\.Xí“´5..î!Ó»š¼„¿—rÁ(©g ez- &-}›Î»Òî[Ó¯• Uÿ1óu:×’Tß}h˜Æ»‹ÌÂÕ;;,ÜÓ‘H*E›~ —ra¦·°àW ™pã=9û7´ýêïÄ­¿ðw±p¿ÆT`qZŽ‰§O¡á){!×\Hf:É%?c ´4&0‘iû~#ùÕu¤æ½¤ö?ï¢úòç=Tœÿ¼ƒÂ'Èr&ÁמÆ]¯¹|ø¹A©}õðÜù”^‘?lȽ•rÀ !Kÿg{aÔsC$kdgFáÝQôŸDr*t íkÞ;NÍø÷ÌÐlO‘Ü^»|ÿ}žôúϾ®~¶—ý÷YNÿìëâçðßöz%bù_åB…IÁ=o˜¦ #%qV]3l÷›R¢aˆFí•ßæyÅ»—Ò1}ŠzüÁ×*ñuñ³½ž¥_ðƒ¯+êÖW¯»~Þ ,³ÿ2û7g4ÏÙlÿ[©ºEþ\Päçm/ø¹AÞádzÿn²|»²˜Ô]:~\Hâë ;Æð[ÉŠÅ YúÚß›œ—5ñeHÕxe˜}àâ×®²&öœ†ìèYê‡eÕÜŠET멽PÊë ÛB¬¨RYcRÁ¨„oúšyCNä}Q•RN1íÛÆ=NGŸ  æW¿þZ?R±ÜÒÔYVj°˜É'[]/7²)J¹®" 1¹{’Ž¾ ã”M5ù'qgÊ)cÆgB”Ÿ˜Ê.©ÔQ-yÉÞïj¦iZÜãÿs”€ÝÅÂ)îLþIÜy)Aobèã­ïzy¼'š-j.S™©gýŸêšœt7¾ küÉø§ëÚ>$Âézâ/¸ \Œ}MýÅ$>ÞÒ‘B“ ÇQ´º‹…ïŠ/8zY,ü¿yª­¸1õ×qÙ½O=QâÆí.…üpG·o‹;;úv,Ð……3¹z_âÛi¼›EX‰7~xÈÐɅצæÿÃÂgû`|‰½pVßÖxê…í…èkÚ—îb;á {Ju£ÊTØÞð:¤ÝÔ=6ûrŒéaŒ”´Þë#ÒÙ'9µÊÏà²aGŽì­QÀw–“†m'*þ_xc朷Ÿ²ˆMù´)¾ ‡•w šF§Œ,¹|®·¯Úwï¦Iï5+~ }É8;0SÃ’[‚ÑS2\Ä ¦¯†ü '5×ÀRšã~ã™Ò³}žºÁPê$¥R,0Óâ»üÏtèeiþýÒ’O­E²xQžç>y·\¸˜÷ÛKÖ¯îø‹ZÞ<’—e 5¿Í>ê^—zjêfýÈJ©¦S¶~Û¨ªF6R¯F˜îÕ„kܾX÷XB®@¨µåD‚mÙ¸)–a$J¦hµÖŒÛâs{œ§}¬††«Á{°9ûòív—IRÀÂ6ÛPn1RšX4J +¼ªd†^©¡µ½=¬NW‡Ûƒ{!Í9L3_N/ˆ’ +LÏ(ëwË…nÇÓ~_uçð¦‰óHš ÕÊPîò5Ô¹PWûüŠšÑÙ/Þ°_eݶ@±²ÄîÑýÀæŸJæ†ÂÇŪ;t\Ê°“Ró@"$_à;…}æ²H€ºbÌÚ‚M vÝ›™ži3SRŽÑAÚ9g‚¿iz®_±r!Œ“š&Z¬ßóDCº˜VjÆsÌ ÇÁíÍÚo%)X{n77pÅNüã™ì{L0õÔ’ÖŸ°j s|…Àý0™$ž&0yá_øµ¶ð€¦-Ãè šäLº!Vœ+qÔFGD÷‹§#øjëLŒ? Ø9$Õ!ÌþcÎí×¥T˜Ì07s˜Üýa)‘_EK/ò¸0Û¤j>‡›ª6˜ŸÛ ›Ê‹+‰¬³®(uH™ÑËd¤´raÒc€œ+²hM>Þ‡•å Ìž¯æuxÉØmrБ̤Ì’”1 +3R+A¤eWX`øvq¦$/VÌWÂdö“´ÁPÞ,ê +äÿл!L§”|JGÒ¼Ê>"ööЄùÊFˆ¾/‡ÖÀ4â±çíîbz]ö _ ¹k󮜧CEýÐx²ö‡IIoFiÂÔEž>L2ÍÝmf,¿"(6¾á9‹iWv–·U©C,DXüá[o;‰zG©ä¼‰`.‡4¦•‘ã ¶iN·a!_‚C +ì\H Ì‘U[úðÑ<~mG×C·¢MÃ[ŠA¤*Ùu$xÀ~bEò¼wÔ‘Òµ b)Wµå`!fëu:1È_®ÿ,´ŸŒ/ì…ârÁ~i+(-°Ž=ØÓs¥s«!j¥åÑÖŠ{îe;ññس +¦íÁ3/$üoÏЖCâ£î}×A^5¾Ðã¤ÚõÂo9°0NÔí(ìuËÈ:än|ÿ€˜=êxÈíÄž‘¬\˜ðW¹ÀËK½4FÊÚ Ó 1JêÍ^áÄP˜Ï0nØjämEÆ¥ðkÛ° +›šûØÚX442د ø0›Ý¶–({Óñ‚8ËÂSïÓѤì†>Téÿ¡…Ógã ã’x’úO6\Êï˜GâüßÓõ[Œƒ«ÀX™ º¿Éi†_KîÝñ©6í|ü,b“ 0Õ‘¤Á'ЙB{¶B¨òlû°„¼íS}Ù ˱é o€™™³Á×Ø÷}"’ÂÓŒê^4ÓÐÕÌØ›Žä Y ˜ E+à ý¥߬Jð0Õm/뢪&Ñ^¨ ­S¤ÙŽMRÝÙ¢Ç!P¹<!˜XhOœç`Ö`¡C&¼Û–}ªÙÐ/ "¸,Á©ŽOa‚êB%.ÂÌCW´ ôé?ß+Ǧ>F#îOˆŸÄýT|!$¢Tˆ/T'««‡§_µ¯i,ä‚ ôì<”é²ÕqÃEL‡ùží|ªý/d[”O +Îà˜Qj… ÂÁs«ÀÔ‹ŸqÆÕËÆÚúˆ”DGNÀœ#— XöÀ€BÒДXú‰í€¥”¥RbM¹j:-e l{#ÃPqkC©>ärõæHMëI€lFå*Q¼˜$ÉÈ95Õl_öê YʹMŸüHèŠâ7´Æ¨Eº–i⬾%ÊdØÎg…HäøÐmáæI:ãMfZÀ'Ë$|¢È&%ˆÀy(PÙfø«&õø‘>Ÿ4.¢¯?wn2ÖÏðõ$”—xŒéªb­ÎbcÉéSE‘”LXGœäÓöð½'BêV5íÙ£{`C¡Ö÷’Ƴµ0…ÂÖiܤ0Á #ßZL¡oŠÂ_pݹƒrúÖe°øÅzº*°b*µ:÷²iÞ)~cµ?ÁiðcŠþWð \k\íݘye‚óÕ蟅¦S¯‹pj4[!Xs ­îðÚ·÷¨ð½íÐÃ]†›!WZ•ož°¡%ÞGQŸ>P"óoåÂsX ¸NÛ?웧hŠ…¯ì·ž¦Væàc·ßŸòW‹mÿèîg…×”}Oß¼·%–¸3'ˆµx»~™9öŽéB)â^žž^¤ËXòÿÕ«Ù=º½†þ/qg’$Éô {a• Åçó‘ž·öù—¨ŠJüÀ¸³ îȵ­x;z¾ŸAõžÖKÏÎr5rÆÊÿ×ÁŸ<º=Õýó8iÿ¿Ê?ÿOGçµËMþ±~ÕGÆÑϤo(^Þ^(¾ª~á#ó;uÌáè5°ðQ¹pžW”ÆSw ‡ñþ-/N¦èn±Gÿ ÿÎ^Ȇl8(-þÙt(ßdT4ooªš]Ñg[´bD÷øÿyeYßb/\…Úf0*b×ê!ÅÊý¸ée'÷œ™?ìuTëîvÿGÆ»³X¥*ïºiklÅèXãÏÑ×Ä>"ÆtÏÓ> QÐ23©¦3‰‹^Ê^å}rÖ‘;;ïÏÝøg£6"£}˜`AŽõL7>ÁU9“¢dÕYs2Åî†\íÿßÅÂ÷ÄÚ3ÖÄò 9)‡t0ä_*“DSƒ%š‹¾ymZ%é›Nûˆ'OF\p1D~5=ëD-×ÆÉ…i/øÑ•®“äg& å¦)EouCj¢EŠTæCl¨h0ÛµVïÑÿ\pXøN{aeÂ^H®½ ×öìDú‰e†ùÐb¶WbñÔ0ñ®Þyµ“ ’2!Dù-öÂ-ðÉ`*t4aŠp)4¦§àRz¤ÏÄÈz» ./sÌø/õ 7ù]¤)/Ê]î?H¸VË·Ø 7òŠ83ª¢i(•¯ÛFЂ𫌋øBŒÝª[tB%ã˜W‹[\ÿŠë/8zY{!É›4Š^=qXñvܹÒ\0‘˜yLL/•×5™}/nõÍACb24F“¬Ê²k8ÔÊ=aGÏR?ø7W·º$чOEæs¹Ýh¤M¢ÉÔuSlÍð/yó&›òÚ70e^aPûmØ.=îq:ú”\Чչ¼ž;L_“³ýŒÞ·ý¯øOkÜR$ŽÞf›¢¾Û(ÈkÛÓª]^š¿} Ó_sÇÏÙ +þÈiu¿~Ë®kü9ê46‡ú‰j…vüÙ#½öãêAýÂëÖµ9ú?éQ|ái,|¨*&ÿ`-Qû_Φ îúT]ÜÙaáƒÔ| ™ÆBnWžÊ»ùØ9=éìË[–èè‘Ý=ÜIºKOlÃuŠ™vx^Ž²EOuG°æO¶}YS\ò|!ö×ÓëìßÛ4¸øÂWaAŒë|wcÜÍ“Èδ묻#˜¢ýQrùó6í厕CÏÑ^ÌEÈÊJ+8¯)ÀŸKªÖŸ#Íç”UÙl2œ‰8l÷ïÿ=CéïÂÂ÷õÙæÜ8ú6j?Ÿƒñëèût$‡…勞èôÛ¨fœS‡…?G)èS¾û^„9rXpäÈaÁ‘#‡G¯N úãþ%eÛæîk8#¬ñtñ…¿GΧz .¾ðg±àbm×XprÁÉGN.8,8rXøÛTqæý¾ TÕ÷ø„›–þ&ùysp pí4taF¸¢T2ÃßaGV¸ò ‡ )ÒŽçŽÌ¯FšÜ³ƒÁS¥“ W¢òð ÏSór8Ù®÷¶Ì/¹Ò¹“ U=Àá¾D¶—(šl>\¯s} L[H\¥"wt87²ë²]× )Aí`ð_& <™ãÂ:vyª —•up8¹ÅsM½Ž*‚µ¥MiìZË5þ]‡Í¶³ ;þ­Âã‘ê}}<îtÈn§Ìî´#ªú°óõÈéHŽÞCQ÷%lÜ”/ØL8¹ð“3Ò7]ùcçµ¢ùŠq”¼[™Z—}ÿ=e«N.|'ÅRÊò[®ÜñÍïê|…ç†pÉÍâ.†°®mpXø{ì·Åüà’¾²Ð$%ÍžœïïÆÎ¥¥y4™´¤Ýû;Þ|_ÜÙaáobá&¥šQ9¤¾¦TÓënDr*t ë{÷0ß·þ‚ÃÂwcá…ò‘(E'èRêÂ$ímŠ<‘NÝKeü!šäbHYß‘Kä‘Žä°àäÂ7[ò¢2fÒ>šwF1~#&Þ>agØ6ú¼j˜}mz~æxd;Ãu™ô?'-{GÿµoêiUÉ·ð}Æš Z¡žäÐAeOç«cÆóÈsÃn˜þypÕx¥”SLû2Æ;ùïiøŽ‹þ^xiÖ¼¼1¿÷ ÝwC/çÃS¡á¦¼Ñú´ÔÄxCäÃ0ãð±Ô¢lHÉòo‰L‚‡‹£ÿF’럶L1‘lçÅXù£÷D\R©£Zò’ñ}±NÃñß%û××ü+FºøaXPaWb®OéÓù2¾p'v0—©ŒÌÔ³¾xw|á€ò¯ç®Qòðf/UGŸ%ÀÂO“ %h5­|È¥Ýy +=¯M4LÍôû©êØBüßc„D²:tXø_°¿-<°°çoaûè–½0 )„÷8F]Ø Ù U‹K!³ÇvFp·]`!µÿ dbŒk;G.|ŸOµ·¦ÿ"ñÞ§×5òVx¤ñ½ñÃwfëÚþ5F²-¾Ð ß#¾ ÏèýÏPýå©…6îüÏu$’X(ȉ8Îý>¹ðqg•\à¶ö>ÄäÉr!!¼ð#rAþs,ŒE,t…cÜ?'.ô…™àËÛ¶oð0/µ¹4‰×2·Ø£ÁkÉ……øp]±8±ð]r¡âü›jÿýèÌvV »]jjN;vû½óÛmò}ؼ1Wî¡¥Þ¿}úµ½k¢+\æï|ª(2'¾M.|£ûTž8Óc¼,=ç‘ñzPŽªréC“2ÎRcfÎË{ +“’'±‡·ˆ…ŽóØŒtÁð°÷·qMÂ8Þkû×3t ÚY 1¾@Ò#¦¡Ÿù*çNGfMð2–F°€ê0ÓÝ,ÙÐ[“N'ýˆU|ˆM©³LÆJÄÆP¡t®¸œû!ñuY±§ ˆ¾ #a¥ Q.ìˆ +˜Ó‡d’~Ó0½/&úºˆÆÞ«&ÞÎ Ìêú1â¦i¥Éx3꼑‘7Œ +@*Ô*”Áëba!éâü©Q.\¤X×2™m–¦®=­zf|Úž. ÙÝÕÁQt74hûÇð8.ëP§³ÛÙCHÁ>ØÈjmâäå°°…o” ª(Šoªý?ÝvFªµH\ Øo”ÈA¿¹`±àO"ƒýþÖÝ…Û«¨O™ˆ+À‚‡Ç7†·´AáeX°™¦’.é”.ÇŒøîÅqœ} }§\hµÖý·`¡=Å[=™`Hj¬^`´1±Ä$:ôäbR0àþêèa½è{±¶ +Û¼°¾I†¸ÆT‚aPi± O5ØÄ­VfÇÌ õ°öÿ‘OõŸ¦Ï¹\½?_°-$7¶d’ 0ºqt­.CÍó&0¦™ìá7ÁtÏvÞÕþ÷šI›Hs†}òÍЀÈÁ˜f‚‡!L>óYä`BB2Žø?¹²|‘Æ[&1ÒÙç4Þ3¥ñ*·/vï*OíäÂëÆUÕ¥NºÌNÿŽŒ”QA‡¶î’ÅÞS¹IQçû0ÀǶ(:I1îL0&‘&¥².F¬ïÄÝ|/ªy®ªÀóó÷Ç)AºN¬SûÆöÇ’\‘Ÿ"¾nðvUתòÈ‹­·Ë_Œì/ä ó^²ˆúQqç§iúš’Ôƛީ#…“7—ñœ࿸¬’ýtÎ}Û¶¥5ƒ1¾A×7H‚ì©,ûvνK³9œ¢¬ËÊÙ{ó²m¯†.ã`ô5,<’égоvžêÇíŒ/é!ù¨öŸsÎ.±@–$Žç<¶Ÿ<Ÿ»`wH8ÇQžgþ»„1¼•É†…ŽÚSEÁŸ7ôc)$Mú œºQ—>U2eq•–/#‹ 9NÈ °7¾– €xã„{æ9ÁûU–&þq©b¸ÎzµíbyWfxÍÛH»Ÿõï9þ¼Gl$~œe? /_ðÚ¯éÜ>SŠÔ¼Ûo|Ž`…Ù2g5Ç {tóXV=á]XØÏÝ0{Û]ó|” $ÈVöí(Ž³õb0ø^Ü°ÍûŸ±ùV2 8ç<ûåráUÈg)³Ë‡ ¿Hõœ¡Íœq–RÔOŠ¸Œ°Ùa­Uu¬‰A…`¾Q4*ãa `ynãÜ£Ô‹ªÖ²kpdþ§±ÁYå‰zPê+Ë´Y¯f‹"Ï‹òª]/ßùä!òxkûHsÛ®³OÚ ã„7àä¿¡hˆ†{#aÚq?d¦Únˆ g¥ÞMëMó —£Ó5¶sÁ5I çeI‡Ò˜Dó8ã:UCÇÙ3ã\b¤±Õ7âÀ[ÂÕY&À»¸/ÛfówÈ…<ËRÿD‰êÏNÈŒ‹ýsÎ IY-ˆïZ¯¦0$Ç™’ FÈæq~ ða\øG”èT{¦S“djs”Ð(aCã½¹ß7õ{Vñ£o´36lëj7œY±c\Qñ»"¢Y–i<“ رAÕ%;ß' = Ðâß… ÜBâgÖüX‡"^‡ÇÌËÉVÃqÞÇÜbœŽ~ÙÔJ”*þ\¢`Fùír!ù6Û9ÉösXÖåØ´^/¶ì ÀBƒEüÌä¿7½snâS/°(›@µJ†…"x ªÍ¢§-ç£KçãÁÍý]ëóøÉ­>{áÅ×ÛÝëqïÄÂrk¨ÌNûa`§ø 7–‡GTw•M.¤—oò›o8¹ðB>ÕŽß²gû5Îä¨1™Lê· +~*ì¹ñ`t.(“CbùNÃù"îLüÖ²S^úV*œ‹³•??……qɪÇ¢Š”dÄŽ©ç +‡¹g1Ü” ö Ô’.ÙØv&#øÿ­ˆÚõ[÷ä‚mp6ŽwçãË„ç^;î|;ˆ®X˜µíè’FŒ«wŽÓˆÞ÷%èB`8Ç1ç*z/.âΡõêTÕ’¤E§çªÄ + ð¨æƒ +4¦íÞ>Mlo¸ëJº'àîQ0ÌÑî¼1Ó,øo¹ÌîÃe}kÓ:X,V.$Eî70HàX<ôLZ©Æ +Ææ|¼ÀèäÂi• h2¯™þà¿×W;h Ù¬öÂ4x¡\2ž^çí¼ÞyD>¢ö’(ë-› $ÂÙ;ÎX¸>„x-\¬‹Þ-’ ,1­º,Þ(K÷hûâðNÖÓÊÇ$éºÖš0e×uG˃ŒÞ6LÖE;–‡…Ã’pZ߬^£$ã'Æ­\0³ÎÔ,ŸK,Týcžf f¯IÏ+–!2k&+“çõÕ´z.cÕ¸ƒ[Ö'ð&&}Äv¾ɳgÇáæF:ù§NiM3zXÓñ“rø•Ÿoa<`Ö½¿ ÿÞÞ›ãlX‡9ð|e£q·ëá#ñð€õPØ#…a‡wQšá»9\ì%ÊVŸ‘ çü{Ök›¼[ú`(˜Ñª# Ù4»éÁA“ ä °®r¡ +¶sV]¤ãÁ•ÂûzwåBØ©úÄëN@@3(ÏŽQ @}¶{ðh‰CçkÔ.Ï£õã’cdüp,`*;°<e.Ÿ½y^ìÕL~Š\ø>ºÝ7/†9À˜ÄM/}ë\öÍ«¸Í­ˆxXÚQ°vÇãBðw¦ô°0’Y³MÈí€ìr0naaõÙ³­O&z>ëúI?Œm3>f«ÛÌ6«¤Š†0ºŽóÊê6™}+C¥Dñ<[¹€*a‡_Ë8Zi³kãÛ 6;°€AIÄv”¿Œóéµã átO×9í¢·^3-·O>½~w“¾#¬ %hßÊÑüœ)íløÀ^d$vNEõ"N¦ë%žÂ ¹ökl'çMÃ'ËÂY%~ê{ù‰ÛØu€qÉë{Ù +HЭˆªŽõ˜E ¬¨ÈW½1öàX¯²øÊrÂBÖæpѲ̂OzsÿbÜùåèˆ;±ÎÕ[³Ûg°0««jËHÚd¨¤ÄG<<'¦³^¸x[Ü9Úd\†þ ®Â€6ÖMöº³åb̳€#ƒ1´^U6ûni$áêGò +’c°ôÆõØ0‰íÅ×ø bÁ;ó’Äëº×p$ý¤¸ó;üDñ×äô½b<`Á*7´šÏa¡8 ;/ÕÊ[‡L Ðdªƒ‚^aíµU—Æ'°àír;`jãMÕ!;±0ÏÇ¡(€8£<² Bv&ÌÑ<8µäö¼óþU’Ú¸ù*ÖV, ˜ÀÏ6½HÕø3r¡AúžþèeË‹úõ±qêûK¼«¶-ã3,sþ•X˜3ßO?^Ó°‹`[g϶ËÂ!@ÃÏz™ÖLög˜')@)no`ÁºiA‚ìý¨ès]¥ÅÂÑö*Á¶§üHBˆïñ#Ŭ>DÊšºÁÿÔáïÛ;ëug}^wаþü¸¦>œlêËÁšÝÆâ)Ÿêš4:G_¦#Ù<ÕþøSvÙ1ÿ;Ü9úóCåÐ +ˆË}×/œ'ƒ½AU\P¢ÎÕfáÞP›‹ú Öâ8\d\².J§qçÕ5Õí|¥#9ÅÊÑ„z×k­<÷Úñ…DS³õq‰t‚M€Ñj£‹ÉÃô‹Ñö3²Ù¥¶oF*/?QÓ¦õ‡ÁfQã`>F ñdŠ­ò"½àb¹îŒo—« y…ü í… ˆ¢(ß^‡Rà<ïn$Kt(]ØðPÅÞýYöª–)ÊgÑ Bã¦îÉ#6¢m}Ä‚UAd­“ðèÃ=“ ö Ii}Âk>Õ*²èÅ°ðÚqç™rFvõ±Í©ê‘SKŒ€yØ=5í±€´xd€;ÇþÊ!Ò£6} Ë6lÇZ÷#Ø¢`{¿ ‘{”h'Tå³qçÍvοT.\•µq—Œ—> eJò¹íæjóîq5Ž‡t¢=°€Òø²æF^–AîïU«5éðKH¦ÝE+ÖÔÇb°NÂûùH+hâ¤T˜³µzn-5­?N.¼Äú ¯äí®±ð•¶sŸbV0y·ùè¬e×ÔËã2;T¶åd›Ý÷´³« ^q‹hˆ[¯¾Ö«ÐZŸP@ UŽÎ¢ [„!Ç]4-d/OvrÁš Q‰ GŠË>Ú>ý*ÊttráP!¤ä§ø‚õ#U_‰… Îv4W—Þ­ëG‡f–i·Ü¼°k÷²úX˳ÖñŒI•Yq\¦Ž’FA•e›mŸ°08g5:Й;cáÒxC.„ÖëU›é¶üÈÞÝêGê^¬gÆ3rÁ–t;ö¿L}UjkC]½»Usš;-‡n$AØiô̧:/)ÌÌÛk!o„ÐÛ?Y *Ô’Ðv=uȈV<;[| çs0)omù`bŸ°€5®ŽÙXëÞH®å‚÷YÍö6КCbcmŸ-rñ…WŒµ-½&÷ +oÚ’ˆ-ÇÉ®Õä¢;š§»XÛ…ºÁùᕘÃ-3c7?ÎÑÚˆ7¹pw^SœòìÌÒÁvù±«ÛO7‡ w°#8¸¯ò ›r%ìÚ²òÎ)žÃÍôzXpqç/ÀÂ6áßJ«ý©mƒÈÊ‚57úFöÍ–îå#íÇô¢<˜¯ÅPXR– '?TtS.XŸèšÊ±ïjPXÛdè`EÈ÷÷Xغ@Åó¦®å˘–[¹Ï8ùg4·óTWQ<|ˆ ïwŽ½tíZ<îcm›wu_MI·Á±õƹɳOÎüºÇºÐŸ+¼²,Çþ÷ýHø5ÚIñ: Ãf³Ô'd—[óáVW¶qÿ3:ÒVä%üòç0^7Ó¾™§æñ.3oK'©²ÓÊ6Ø8tàúË6áè­Ÿn=\Ç.КN› àçÊçS}#¾p¨ý®;1n…Ð[â¾µh¯ëÂø<•çM,,X+p£^bËù¹ã·¿Y¿0N]päçC–E¶oçn¶3Hˆ% +ª¶?}H°Öиs5ï_$é»*ÈqçŸ)Þˆ;/[KG,V9gÏ0Y‹6±:’ªl¼ðanµ4ÏbaCÀjä½d5ølßQ¿° +%¸õ}«Ž3ûÚÆÚÐá;¦Øsï#ÓQ[;“ ãÚZãLi$xîÜmqç,\ÜùA>ÒQ0äY5í¦Â1ôm—ùPϵiL]t^L?ϻұg°°»ÚÙ@Ö§ZUï냱vfÝ´¤ëpà¦DY,ØŒýlo3±Ž:Ò^¸Ùâìl>¡>LZ 1ÌËâäÂïÃÂÙú +3Æž–â¬îÉk‘­ +aNÃí¨[Ÿu~ ƒY-«AŠæAšY¦î’÷õÁØêÚVo3]Ž†v¶·:”UȈMÁ8eòaÉç¡ÖnKÇ‹BkĪqX‘½3e§®~?W.dRÈÒ±ÿ¹)Êso›°fêäÖq8MÑ–‘œ¨+àF'Öǘb¦éª£„ÏËÛ8l»Ú6ÐäuÛ@YÞ%¾$[º¶šåØÿo­!8¯í;ì<Xô†Ä|Õ ÉxìÍ·“Ú¹¡ÝPOì±¾uÞVkÇ‹Ÿ+¥TãØÿA|aeÏ-o­²yÔØ ~-<Ëöù>‡i³y2›ñcó{Nµ4Ïaá¸èA³¡{}0Ö‚þµ&Ìç«Æ4GžgKˆ°ó Ñ®r³”¢¯m‹¶™Ö1€qj[ø½©^˜²‡Î[c³Ð]|áWcØ(Øjsìê¾…e+Ð +.úÁ!U'8$éäYv +"?……­9Ë~ UNäqýÂ-/±¾¤ÜjI0õWkú“’ðÞ0©.ßÔ¦p“~ˆöµp¢:h€+NðV¬º7® `J–Ζ¢pqç_Žûô³cÝÍ¡æà2"†KKÓy¶wâÖú…·«§É2[_Í®ÂØvߨk»éqEó#l›–Tå[2’ÍGš ØÎŵ‡vËbá¼ ÂaB‡Ýmû™ÙÅIª}êyvì¼lû#9¹ð‹±`'kÐPÈíkÙ©vr? Ïǃ0Õm‡3wPRb¹BðV¡‹]°ÍVµ­¢”¥äázmq5¯NÍ+- «{æÊ–9ƒjÏ•] 3’<z˜ò±5È$c€µ×ÄÜ’]HŒ!ø\¶Ô‚Œ[~Ðáٮ+yŒŸ{Y~œ\P˜oà8ÿü;©²9¸^Ç“4ɫή¦Ófy2ݪ9À@ð ¾´«hzþr±ò-fÓåþÛE_dL½|> ”ŽÏS›§wk6&)¾V‡?ˆ1‹©­¶’7›âwLT¼ k1Í© ¢³V«ã’ÏgUp(4%‹ŸW‡CýÓ¡ÄǽñçÉ…NJÙ;öìSÝ%®‘É·K2áý%Êñ ltaWW¾ÌÈŸ[º|«jÛßn6Z—΃·ŽÐpÁ$¦Ã¢ÒÛ›»c»hÐtyIôìþ×Þµ(ÆÉ*aPQX.º +¸°ïÿ–g7Ýlú7—¦MÛMò­—AšÌç {›î«½Ýúl^ø·¤Æþ.ÜT¿¦™áÛD¡Ÿ+ŸVÑ‹JÃHø_×_ü·Ãç·®Æÿ¤ò°ÿB-ÿ@©váSææÕòÛKÈ[™””8ì3Éñí0ÜË­Sç©þR)§å®\ø‚û- e"@õ—laòǧì ãO´ yýÂTÕÿa ɘsåÂ:4ŒëÅ0šÅå¼Ê-É8Qè®ð¸m2ï»å>à +Ù7Z†_øÌøB-¿ÍCJj¼:7(÷öº”wÌ…÷ÛÉžn-› C$¥:í)þ´žu¦…ºÆ+þþ¢Gg§TK)Ròà‚S'ä°EvÕZïSbYËBÀc‹Æ•Øãm!a:­Ï Fµ • £YÐÄêÙ GæÙrî€ iS‹èh’‹l¶h‡¾ï÷eC½Š 0'yY½t™/B¡zãĪ]øP9ÃkGW.|YÇyP#ÕN¶jÃ’w]³]`œ$‘À]Êý› ™È¹ñ‹¹Hè_4Wä/£Gg-Ü\rr¼Ï.4cÍ›÷b)F/+¾nÉw™ ›šNŠv!ŽLéÅ%àB´=BeCSMd>hA®VbŒ!^¡Ä‹Ð~/ü‚¸s-¿ §ÌÐpË ?ìÂÚÄ“h·Ì…ÕÐc*ÈÌ%Ö§ˆâå¼È°s!²ue§òwþ8jÜù }¤8ÑÙI:FÙš›]X Wr.Ð’es&Jã „Üfè6œ{?eWéº0ZãΟå#U»ð•}gÊí ZŽSTxÀ…<ºœ™çs›ä?Häi·Úz’4ó‹†þ·’ã$¤å±5V¼©r¡ÎÁøãÆT™Hô²ÌŬÕMÉvtpÝì–,ÙKæB€ƒ¤QDT/À›' +ZΥ̾éëökûƒÃÎÓ8¶• _ç$A¯y¡Qºç3N¾ƒi.¥äjÒ: Žh°Šêì7M¿k{Ë>žæ\×þ×øŸUè(Þ3é.‚‰»°ýhº^/T.ü¥–¡{ó¶>a;íÙ†þ‡ô©qçÊ…ß®Å4½\Ó ?ü¤ßùýÞß½cY\(õ<(¼hCµ • ¿› +¨£¨{ÜÇ!míËÌMÓwö˜@Ýþó¹îãÑ÷Û…¼1é\5ÿyß™-+«\xý¼ë|(q­’5SsaœÈëožN&zq´‰¾»OŧöÌ8yˆ#2°æV«ú¸ýÛõ'Ž=Õ~û‰™£áÛèE<üõÞb–ècµÕ1Õ¼ŠqvEòN ÙÊ‘` +Ê,ir&ÙÛef"tê†p¸OåFxQËmŸkðÓ…d.”3xßj"Ü‹\! …ó:ìÏÐ{>Áçpˆ`¨’ +«?w®ñ…:ãT¸!&Ý“Qˆ•bk¹p ì‚fS&¤K´çô¤¢kH¯{.E«7Ǹ$ ÂÄ]Æ®³R\(n¸t… x RL³µ÷dh¬¢¥ê$eóÝÁZ9a'$è@„\4‹ÑÒ† ôf™\æV†wÇ*jÜùcT˜<Il:¯ÖÅZx;*b¸<©WoYäI‰Ñúqjl|×Àñ-f¬Ñi,/ßФ.££ˆCbä~ÑÙÉ‘nE\PÚú¦÷òâ"jã2*±ç¥i¢rˆÇ•Á‰áñ½’í¦Ä…¨+EFšdG?bªT}¤pa1¦ñ'ä™1` „ÔgôˆÀÊÓÚÆ&3sw%Â4-q›àXÙó•H:¨&Ám£¤Ì7×ÞwÈ÷&©l2Lr'¨^ç ŠÈhé\oƼ™{ž°tK5‹ BPsBPñÕùÁPå´rWp–¤›«]ø» êœí7 eNœsàüžô"“ 3uæâLÄ™NÔhD8W¸ ûˆˆ A[¹I¦g'gËiŽ rfj£½oG•‚!™ z•`ÌYp° q@"å~HÕtýŽÙº©ãÁrpºè$œ ‚¡AŠ`™·w„Šç÷Ú…~]׺~á!Ÿ—ÎV.¼BIÛÇ6sa¶ ¢uç"ÍÎ…èÛv» ›Â A*\ bÑÄãd˜.ะ^Uއܪ³]™ à5VÅ“#¼®†nRÚ8‰{2 ~¡5›œv.p]ã 5¾ð{¸ øÕŒ¾EÞj*9øHi†÷ünà˜ÂñéÚD—="° kìõ& V,OÈÞÀŸš(™S]d»piü47ÑÎCöå4ѵië[=¨…‰tE¾5Zë؃üåJ¹ +\.!³]X<2À4èˆäŒòù@R;W.ü:.,Qpôl…„÷´ðB¨ úÎ`ò’}/}”\HJÊûxÂàÃ( „¸ Ú<ã:«ÖÅ.\f…TËyQ lW" UÇ¡ +œ¡Ýc®xŽ7`àNRAåj[á¹ñbœç˜D.å2ð ŸGíª]¨\øudÀ­]‡SßÅÓº >.Hct¢èh³,ˆâ~mØF¶åMì.–m4µ ø?Ú÷©†Ó!4SþgÛ¥í{ÚOyO0¸S´¬M›ì,§©Yíxd-o·€f[ÇÝþ¨°n8š´´æÁø”À3”Ê…W-ƒÖzߊ–Üì鉎¸™.¹Š4Þãm4Gãv2 Ó2a(”ƒò®çeÊåðIžÒN%­Ã~tè÷>»)bøp»•Þ=š³èwÇÆXí;?Œ#Õ’$öMo1qô×äÛÆ=ßÞ[3eäaÖê[ã ²òˆR;µÛ4ofy੺óŽmF +§{¸m;p˜Úi»Ã0eñ©-ÕLm/ˆA ¸‹ßaG€©TÓê"–ÑâZ‘©‹áôñô‹ø s5ÄÛC¼-¿!ˆO}©fjŽj²X³ã_Ø4­åõ‚ð(éñÄŒÞ_ð>¯lã€ë nFœsv.¨ hÙ`.€Ëfq·ßÄ£9b¹‡¸¼«f9ÐO€—û"¶c^Ž?”p¹»»¿¯æTnÏ‹Á³vçÆßð(®s¤Ñ•FXæ`ø¼#S-¯•izŽ¿î ?%ÓÚ·Ù…oJü.¬wZ¸ÜaÖÂÄ%ÞÅæ¢Ô»ƒ ݸ0Ø\hŽ-LAqþ¦ÄöÙR?pA?p¡=¸Ðþ'Ôèkù§Šú » ?Ï.Ì?oî(õš]`ï· Ï©dNÊG]v¯_ÿÌ×ùo¶ >’)ø=»àÞfô›ìBuáÿ®¬QÁ¿ü÷'€ã }FÀ…¬ÌRŬ¼`¯â¾àa<â7$ vÉâQ©¾`/˜ÅùîsG;nOï +ª¦ˆeÔ€"S +Z‘©ƒñõNür‡¹”gAk†‚¹ñ7Dp97â àt‡<ŠÿE> +stream +xÚ`ŸÿÁÁÁéééÒÒÒ±±±fffîîº›››ËËËVVVÙÙÙ£££FFF666µµµ&&&ñññùùù‚‚‚­­­õõõýýýŒŒŒ“““uuuçççÞÞÞ©©©åååÿÿÿ >Œendstream +endobj +5585 0 obj << +/D [5583 0 R /XYZ 85.039 781.388 null] >> endobj -1714 0 obj << -/D [5503 0 R /XYZ 85.039 620.561 null] +5586 0 obj << +/D [5583 0 R /XYZ 85.039 758.673 null] >> endobj -5506 0 obj << -/D [5503 0 R /XYZ 85.039 591.157 null] +5587 0 obj << +/D [5583 0 R /XYZ 85.039 758.673 null] >> endobj -1718 0 obj << -/D [5503 0 R /XYZ 85.039 508.814 null] +5588 0 obj << +/D [5583 0 R /XYZ 244.345 534.01 null] >> endobj -5507 0 obj << -/D [5503 0 R /XYZ 85.039 489.942 null] +1482 0 obj << +/D [5583 0 R /XYZ 85.039 484.068 null] >> endobj -1722 0 obj << -/D [5503 0 R /XYZ 85.039 363.859 null] +5589 0 obj << +/D [5583 0 R /XYZ 85.039 463.739 null] >> endobj -5508 0 obj << -/D [5503 0 R /XYZ 85.039 342.966 null] +1486 0 obj << +/D [5583 0 R /XYZ 85.039 380.931 null] >> endobj -1726 0 obj << -/D [5503 0 R /XYZ 85.039 205.961 null] +5590 0 obj << +/D [5583 0 R /XYZ 85.039 345.521 null] >> endobj -5509 0 obj << -/D [5503 0 R /XYZ 85.039 184.765 null] +1490 0 obj << +/D [5583 0 R /XYZ 85.039 235.673 null] >> endobj -5502 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R /F66 3242 0 R >> -/ProcSet [ /PDF /Text ] +5591 0 obj << +/D [5583 0 R /XYZ 85.039 203.858 null] >> endobj -5512 0 obj << -/Length 2305 +5582 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R >> +/XObject << /Im18 5570 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] +>> endobj +5596 0 obj << +/Length 2012 /Filter /FlateDecode >> stream -xÚ½X[Û6~Ÿ_a´/rÑ’¨ë`±@Ú¦Íd“ì4qX¤A![´­IÔRÒxæßï¹P¶ìñL -lƒŽÉÃÃÃsçGù3þù³4žÌfIê ™¦³u}åͶ°òë•o9\ËâNx~\^-~‰Ã™ï‰ÌËfËÍQN$ÂHΖÅW秷¯o—o>Í])¥ãgbî&Iêüôåvî;Ÿ™zûéæãòæã¯8 è;_nqùŸŸæ©t–Ìtóñ¸üúïy&…7ÿ¶|wõfyÐô h•¡šÿ½úúÍ›`Ò»+OÈ,íaì –ë+ÐSD¡´óêêóÕoQ¼Îx×%¯Œ.X–ÑËž‹}Æòà¹V}‘EzÎ÷!ý`–Džˆ¼\2 -ö†àµ(òœ/LÊf ¶Ç‰Ó«U¾¾Úç<¦ÂO²—u:òN~4‰æA§ cèô9¯çAê¬rÐÁ œnîúεjáO‡Déì‘X¼ß1WÎô -ùú¾R<£¬ˆq$Î#3ïwHY#Ånß©j"½ß)&=wAÝótèžkx¦7üûˆÚj<ÊL4~ìzU[qšWÀ’Ó©wVùÜåúc6ߊ3¸´øEN½„"OzÄ÷ƒ€è0Ó‰Ke ‚$°L¿{~ˆ>!½;ˆq†Î N6œó£ò0s‡†©ì0Jÿ}ÙÏ}rÐÍ¿¹Ù¢½5 -R Šè_Ù=ÿ¶†òˆ–:–”ó -GƒCÔÝžÙZJ­hÞÁw®/8ÂáGXP~L¦~ D§);‹D$'îý‚r¯ÏyiúU·}©›îOÿ¶iòZ !þ>F)H„UŠbþ¥L¼×p~NËPg!ÔÙô(¼Kσ|*;–IyF#°’,œ$@Ä»,k7l6åä_ŒÕ[•15q0Uܲ>Í%÷Þjp¯L¹y´'ëÂÊøÝ‹<£º^K(7ü»ÖÆ mëþ… scÈ0yâü·ÊØ蕇y§1ö{&Þ0m5f?¬¨‚iÿ–‡õX¢gùƒ Ól!ÝáwÅË”×êbjØ!kMS£êÎs‚—±õ% ¸Ôè}§D‘÷Ôý`ƒ^ß•tòÊÆ¡é S‚3;¦ùpµ¦lú#›îîv¹Q”ÍFEz!H%<Ý4jMigEBLÆäè&"›~£MÝMt™ž{×ÚC£Z¨ŠgN^´jrÖ¶ÖÐØ&h!ä|Uv½(ÔjØZž¦§ÃŽv#±%Aïòä¤I‰ÜÊ]•}·Óíõâ>7 Ý_P±²:¹ÕS~¸Twfïò6z¾ÕDãUBÑãaÀbèe±Ç òGëÝ€ ž¼×Ýðÿ:“rHði”ÈqÀ„ç€MB!ÃxŠ¤—‰øM$–I˜!–C ÇÎ-*Äàäg3‚(Hº1˜ectÍ漢 í\zŽ¡6Ò{À&=—tgûÎö9»¼X¤pϼhבçy|wrÒYc sL  êžÄxÛîxmk¡ý-&üÔ0¡V WjÓó¶ дáñÛ[f~Ÿ»2ï”åê±›>òVìÖIâ è1¶ÍŽ0ÁtÔç߈ €¸5ÝÑ O`‡½µûáEeØ© ‰¹U Ü>k¾ -:ðžncÁ„ÅM¢Æ{¸Ôß½“{§jó¢m¸:m©òN™ÿ¨>l«a,Ü{›Ï¹É«JU׋BÝ/ªÖ–€ûÆþÖ§DÛ.À“+†Yâ½úÒqQóšÇä!éMÚ1m_VÌèðžî:ÅNÁµa-.>5ßbh|±…w¢g"E ¥åÝà)º>‘Oã®Ï KnŠ3Ål–u% „G^³™†QvƒÐ1tÒi°yDN h©z·làpzáÒ“ëgòÊ+¼n|Dâç2åÒC9æ*ãt̼ -“ã‘Ù8óHe É0s’£ÃCgt;/ÖCÛ- U—"x-Ø^™E"‹Oí}]Á­ˆÕ÷å@ßa]¡z^=AÙsr²ÍŸÎâ&rÙ-ãðE›S€½^ŒÏq,û‚õ³p¢ e¡Œ’IÍÁµ›% C.ÛW¢˜ZFðµ' Žv^/ôØ3¸É‚L4™žE0DmìÓè'‚(xÄÍŒj]æStKÏ4Ýðim}²Ÿ¢05›t:fzw¨(—’F×àH¬­½6²”_,l ^ :Îœ›žyϱµ•=½ñ9"³ŒÞ/ÀEkÜyaF@øýîðÊÊ;»T¨FCoÊ{òÉw,„ùÊgâºÜ3kÛ÷UEÍØ› ;ëÐêÑ•š_`<3Šƒ<ú±´a D¥äá"ÜNŽ¢j”LÒtBÄàä#2?S`l#(~ÍÊÔʬÇ;Œ´›(åïç U^Vîƒó•u`è¥Î›Ï·8HœÛñzÊPU\"ŠæñÉ]ÒaG âãó™à;ÁÊ4›¤í¸ 0 z¤*˜iÅIÊk½fâY‚¿Õ‹É–½ ¤ËW”–´p˾qAæ‰4¶¸ éfk>MÆÈì¹ iÈKHÃò Ow}°v±ßïEE0hsÚlÐÿAX½-Ï5”‰ø&9Ñð ,çz~Ž8•cß[aè;ïw Ø<ñsLJBîà›Ù¶/ ÑUesÈ ¢^s§ÏîÊ~‘€P7þmbâ_” ñÁÓàÉÅ,9ûP@šÜK8=G-@*íæÕ¤5Ú͇OTkþžÁXå‡ïN0k' ~htèjKöÐ7_{øÓ'é’EöaÝRÿ 9[é³”9zè«ñúÉBû¥ ¶’GÌáòb{¬Øýœ°&ï˜ÀM,t–%w±ÐùG^ÛËIõ‡›è*ך·}ÈÉû((¿;´vüÚª7øý(ô=p<ÝEÄ_v—EÕi¾1Ç’ÃñèG‹èS!]/ˆ/jSÚÂMm¿|±é0ØX¤]CZ¬Ý1¥ý(1ÐR• HæiÈhàâcA?…Âÿ¬ÿ_úR|xpêLå3ßS£ ?ê‚þ -Âè\ßH¦"JåS…ÿ@Þ–endstream +xÚµYK“Û6¾ëW°r¢„ð8U©­‰ñ¸²^e"Ÿ’h‰ö¨,dŠã¬ÿývãAñí­Íl¹F$€Fw£ñáëÍ +ÿXb¡"OŒeDX›l š|‚‘Ÿ,HdA$kÉü´Y¬^+0Jrš'›W=ŠH%’Íî÷ôÅ›ÛõæÕý2B¤,'ËÌ›¾x¿^²ô7ß»¾¿{·¹{÷3¶$t²ôý‡ÿu¿´"Ýx¡»w×áÛþtë[‚Ð埛·‹W›ÆÓÆð*G7¿,~ÿ“&;XÒÛ%"·É_ðN ƒáãü$JŠÐ>,~[üÚ¨òc2ñ³Æ¢%2N‰á|hÎä&˜=sb`Ž&ŸÅ˜%®‰`ìä†HÍÛ"}QŒ=øŒ"É—„(êúãÓyhL† w=ÊHläqxuwdyòòž%Wç2Æ4± ׬áð ubI¿A¥C‡†·ÿPE øaý}bšŽJªa6[Ñ ÜqNÖšä}à-ö5£¯÷Ÿžª@c +-z³zÍTkÌ¢vÆÉßôÝåaãFÜmÜ‹2÷:vúšÐÜݱøTzH&DºoââÌ;‹ÃÍj½ÿºBTÕ­oh˜þãCŠv?2¦èbxΈÕb1-™IÄD\Ú¹X +šVÅÁÅgÈ>ÜòYÓQf`» ®ˆºcÜC‡[›~ómô`p¯w~ø +’¸‘UØnxEJ7–Ç£êĺ¨ð‘È@wéÞˆp¤5Ó©(P ÂLgà੪c’çcÜš€1”=â[„NA¨9Pš$—TÕˆI€¡d¹bäƒZ/*çupHK‡ó$²&^=¬«Ì4²‚Œã¢í·`€( +\ éaÎd”Øì"Š(TÇh #À‚##;„Ž]®Az–“Y§ ×BŸƒvuí±ûÃíìØfV³Ó9uU¦KºørçÇ…ý1À­EcÌóˆ”ÈaŽÀ Q%!¥)õ„ÔÅytÙ÷ñäd*6…)Ì(ÚÎcê*3© ƒëƒ„š]토‚ìNŬÍ(30Ú•"VÙŽÕMM€ÊsTT}ꃊxàó—õýêL@/MAž üÔ2ÍcérÆ_¨òT}öç +롘oÜÞŒòÔ5"e"â0zæsæYÚUúm¶ƒ.Ï£u Uê¡X(]”TŠiiÔ:-7«UUOuÙßO(Æ ¾€Êî$”ýw-A¸™¨£®¬¥l¸ï‚AzHF!\òÃéR<š¨çñËiúŽW"'´½z,Ž%†Íå²aè$Ü“h.ŸÅŨkÞI <,´é8ùå)‚ä)bªã¤PDåæyœ º¾ã¤°ÄšA '¸‹i¸ÅòY꺊L2WA[·ç³ãü“ã¯í祀¨Ô«7ع†>­Ó·î Õ/ñº*·ôÁåV!æü‹"}»E[ÆmÛCOrJL“Žu«y%º±!¹0†<€³põ~ñ‹°ŽòÚ‹¸Ë<©Ï@Ö*Ox³ÆA“¾õ’/‘o²POOSHúmŠª®¤ùƒû.).&Š>i.5zs%Uë%zçŽJqÓq»ÖÃ>w­À—˜…¿Þ,Ü@+Ã[Ÿ9ÝÔ“¶ó1¶‘@qÝ´³àKÑX7×@©°Í€`=ÐÁÄMÎ&/ IªÒYœ_e¦dЧ=ìõHv¦fÖZXäfˆiÇ\ÈÍz&7ëAnÖßÉÍ:äfxÞ­×øbBR®›l¬C6vÀ1!k3rñÐÝ.˶4Ÿê¦\¬üÔÖ·˜èvõµYN“ÕÚ$dicm»þ{Õ¿…À©h“å¥ÌC"—Ò†k- +gÀ Šî¡XØ.ªr¸6v“øÏß,ç@Êþ$ü©¹§àª¡ù1Z>.,ß| ÷ѽèùSŒ¥Ä)ÄɧÞF¬&!œX©k‰æêo¥˜¨*»êûø¦áÜÙhW³}:_n)Kè3¹TÍ»…Ÿåºn…¯á[Þªw£öƒ—©ÊÌ@Íís¸Uͺ/Œ ¦í|!ÃêGÃN=‡wAÓ¬sÒQ-o»7STÀF(nfÉö*2ɵAÄÕ§u=µ€Â9S^ o©÷••j› +÷jÃ_jÜw>Ãúwj¥Ø0ænð|³Ù¬ýü¦ûø`dö~£”ç™M¼ù‚Ò'Z†ð}áúêF0þÿ<‚žšŒõ<Ÿ¦¥ VL”­ŠsÂYôw‚KÞ÷ê'€:ü×xendstream endobj -5511 0 obj << +5595 0 obj << /Type /Page -/Contents 5512 0 R -/Resources 5510 0 R +/Contents 5596 0 R +/Resources 5594 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5487 0 R -/Annots [ 5516 0 R ] +/Parent 5592 0 R >> endobj -5516 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 87.442 371.033 99.435] -/Subtype/Link/A<> ->> endobj -5513 0 obj << -/D [5511 0 R /XYZ 85.039 781.388 null] ->> endobj -1730 0 obj << -/D [5511 0 R /XYZ 85.039 761.463 null] ->> endobj -5514 0 obj << -/D [5511 0 R /XYZ 85.039 741.134 null] ->> endobj -1734 0 obj << -/D [5511 0 R /XYZ 85.039 327.573 null] ->> endobj -5515 0 obj << -/D [5511 0 R /XYZ 85.039 296.048 null] ->> endobj -5510 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -5519 0 obj << -/Length 3894 -/Filter /FlateDecode ->> -stream -xÚ¥koÛFò»…*à -(i’»|¥ŸÒ¤IÜK_¢ Úâ@K´Ì õIÙñýú›×.—’lP—³³³³³ó¦¢IÑ$O‚P“,•ç“Åú,œ¬`æÍY$¾ øÎÏó³óשžDaP„Åd~=ÐI¨É|ù‡÷òí‹Ëù/g¾RÊ‹Š`ægYî½ü|9‹¼O ½üxñ~~ñþ ¾iFÞçKœþðq–+oÎHï‡é¿ýü‚ßTÎþšÿzöËÜrjy® -dóÛÙ…“%é׳0PE>¹ƒqD0½>>ƒD+yoÎ>ýË’â9=áU§¤¢ã4ˆ3$AçOo§’"HŠôäváÄ -ä™~­ - ú˜ŽEq ¢xâ': Ò<µ—•Å“( -Š$ÁËŠ¢,H‹x’Åq ñþà¶ÞoA¼ý̼êP®=ô4ŽæäÛ$ -B]Šqœ1`8Î/ÖÑäÕ8Œ˜eº¾C˜˜rG³¢$ -MÒ"ÕÒÄìüf†|úI’x×0ÜÎâÜk×Ä}‹`íMûÌtۮ˾^Lyb±Ý,q×3 îø¹!*wür5óãÌlÑòn‘·k`T.h¼Ä9ˆ°èž‘ø˜5!Ý*¨QB,oª;œý1#XÝæ‚—øI˜{k` 3›%aáíˆ ‚Þá6´/Î_ï^2åÓû0¹%š%ÞbMTý¶†—Ý ¯H ïÚ ¡,`nÇèôð<Í»fåèö –‰³cqÏ|]¤ÞöšŸ4(rÜl®¢câf´'>7Ì<›-¾¬ä„Dq]Ö£“x¬zS-ƒ̽åE(³Tn3M¼þ¦â ŸÆÇwŒÕo –HƯg$lGHHW€2Æ’¤[^ᣣ]ŸÚŠÆÀ NRÐÚä^¥yƒ¥Zq’t|ÇwŽ­ö²Ú Uè]€ÆÄEFƒ’ÞóË~·BÅ.—¾ÇxA|4ôZa6:iræ*<jcM¤ÛdiJk0Sбͳß"\Šª»ªäVnyŒ”šÎ6¯ÚrÉ:¢4±5¬»à d¤-]/îH ³——¯ºcpmÌÙCÞ³ê%Ê n_6Œ¾cBh"½õt¹Î¼§½"U7 ¿‘y¢ TÂþÇú§¯¬Á~Ž ’Žë«Xƒ=oªÖÞPµD¨2;£³Ã»1B\±miðt†Èú|Äg꣸3ﾩxÍ°qi$rÊ›Eaø ‰›°«Ú552¹éŠ—LOt!8xAJtElŃnÇ`"UÿFzL“7ÃŒ'R–qÔxZâ0ïà²Ù?Áh/— Á†d—°ãRv„îÍu3Ö”pÓ¦r >‹f蜂EçC”5iù²#õ¸âù}_75] -YÖ7Ý-+)Œ‰ŽYfUÜÞÖÆh@xŶHˆ;–c)t†Aûm¨aý—z³ä -˜‹¦¶"êV66ýpä³(€À:q²£¿‘laFà›p]ñ÷2@phN*x†A&â $ÓI:$âq8Êí8LÀÇ©(<ðIq, -0ýɃ‚'6aŽB.{Pti敤#0x=C<Á©W}ß5%âoDíN§âI˜Aî–<~š‡ÃˆúÌit^i–˜L•ò4PJRZ2§ûc‚†Š®¾Ç7å½Ó‚I´ï YBäk·‚ló:T™{†åb Ô;„íÉ]65Âj£©„Œ¡,‹í>ßQ‚-ËÞ{²lŠ¼BtËÏg,e/ôÖEÔtG±bÇÞ‰"ùÚ xЪ"K~é¶×½ˆ&÷ʶbèŸaÞÝÀÅðM7UÞÏó/?ò,ûõökǯxz•¤`D >¿¿ø½¢I IžhŒø[¹`À‡OüüáÛö„sxU¶w5.„„¯— ì¡V¦*ó.0Ö9É ãá†â •ì\V—2OZP³´–E‰ÒÛ=…Ù¼žȬXöe?^‰nŽ!4+tK~ÜR.ÞÞ3êà£O¹ð}‡ÞN§±wMz1`7÷ Ç[-¼!n_S}¡á–ì­1"܉u~8MnRˆÃÕГ¨”Þs±,{ 6°Šòu˜_ÌGŠæ‚qžêðWT¡Í~Çg$eŠÊ„”,moκä©5§KkqRÍ•³˜ -,©x(Ui€±C¬­„Û¶´v`ßw}µëD 91˜Õ;*ßPg¾ÎP˱ހšü!JžS£¾;qD4"Guå¾³Á͉ ÂUÝ9éÓ¦×:ïå¼Ð–^V|ÜJ–]9<Ò|9DEÚçŽÁ÷¶",tY÷é¸ÌuÅ„4/DßžëQÁÃàTw07Öé±²,yÒøGBdŸKIOmŽc¬9±´pe-èãaÆn@¤&:Ì•O•P‚í;èÇq䦤!ó€åÐq Ó™$ #>»@‚óÄîCq2ÚÝõè[FÖ Á³8šg §j: Þ*ý¿‚‚÷+]÷-Ä£B KéQÃ6ñx½¶¦[2=ƹfu¤˜:a[ØîiGÎdäÈ(ÎH­2ê]—¢2ctÝù'sIaˆ ‡Â•8Má®(è,A·;ÉÄÉ´B6”JÆÈÔ-yº)Ñè™1~7°8#“À·{a`I¯ÎÏOŠ¦¥Ô@Ì«úÔi7ä¥_$‡J|²C5äò0ãŠì,ÈTü„…lßA?‘iÐD–F‚#‹ø€Ÿ8ÖAec~,Åà<ÎEçµê¾Ê«’[.hyâ½Dµi[Ç¥¡°Ø+‘'Î#s߇MŽ, -gÇ¥g°çû&òë„™:mG^¯€ÄÿqœÇyÑJù/F™Œ×FéPîÜ“\Ÿ‹ÿ‰¡fnÛzQýð@q¤bÄ:{´8rpl©wT)¨þòè¨Ô£bO^Z„\ËM±¸Ãƒ^s:`ú2Sž¾të@ÓHêb>„‚¬xüƒ‘ƒópeQ¾˜aâ¤ÕäG¹ß\ÙxT¤Ø óÆ$ݸsó!a`3Ì[vUÒµ¦)tW’Æ-™\)sTHÚ~­©¸‚¹énÈø(3g±¡³¡Qù{Q1…©)=©˜4ÓEzÂÕOwÄz_cbŠÈØóLmú‰§Sµ¦—TÕ™ôwø€·µº! uSÓóƒkþçúéDHÝ>×õFö±Õn'¶Eâd·]5b(•ôöT$#NÔ§wb{nBÙ¯ûÅÄú\„÷Étq¹-)KmP¥d©c q‚4JªÏÇ -‡”éÜ3òiŒ² -š:r\¶p!ŸBèø”/?_~Âô±à~azænl¦¾ÀôHBÜwt#8<¬ü h>D‘ÓÂg¸w2 -UëïZZq[›N!ùBùàÐ/‹<Ÿkº Èí%ѧŠ9N©3*Šãˆ -Ë#nÙô52±ß,$½*ÆXV·õ‚z±Øw£Qü¶/ñ¸šlÐJyš>„)Üô„@4œø)‘&æ’v¨¥¸Ì~ÖŸ,X±º×¹¨Å‚ªç\º^:—YÛ„ -ž’Ò8çnzùÇûu8-¯}óþó¹Ûwz>ó³$v.Z6#} Ëmˇ¥L·{£¾¸=VLuw#â9ŠPn©6È}-ûa.ŠÍhPçùmz¡õ˜°5ª#µ‚€U©vê[ÚC‘*ˆ#mûq¿PÛëm[:$eˆŒI¢M$’¾#h(ièõd—;QZ§ãªg5•:¹µ‹aP¯+ó]ƒ˜Û<eÁ61§wN¤^7rBCûÛžô¼6ßw(ú÷ã‚_ZZKNI -ûƒE¡œÎÃa?‚ü.IÓðKØËîVqà %…ó¥ÜK=Š—,GûùŒ`¾ý€]ß/s„ì ëK¤E d4Ƈce8MýDØÁy8Uˆ4$ÙY$©dp „ä;NëX‹Ë¶ãWTßâ©@*™¥òDÑ$ؾƒ~‚³šÈÙúŽiS`rŽ?f)ù# -˜4k÷¨~J@ a>fí°~œÇŠ“<ȲdÄÜœ”ÐÀK-<Áuaž%ý®bk¥Ø£>`a€Ï~èÞÙs<Q¿ãbwÿÝ ÒœtNÙ]ß:77$™íÃaÈæ‹0ú<„)h\ÿÆAšÃ*?]ÿ2¶ï ŸªÇ4‘½ƒÏÀÜåQ¿…y‹Зù‡£«- Nô˜ÕëœÇTaäñ˜A§CŒÜÉqBt³m‡&ld¾¾¿è‡]mã—O-)úa„÷Ÿ!â2i@Ú¨ÅWZ„ô9ͽÒ%;Á…É·ÖN5^^¸\«,—_R´¶»ˆ0§ê„7«bü:|î$sÏŠáËÌ–Ëumz>'g^í9;â7P²ºå!ª™íKõÂR?j› yâû¬ áqž9ß’M -Ë_fâ<å@‡H|ëö1ÙGÕS›&1fKKézl~R‹üêEˆÉ·kkÆs#¾ä8œ–æô«¥{.Òa,$…d9®{+I–‰ZúSX¨Çì๬­ìˆTeZí=dëÔÏrÔ›¯hùÉ}c›(„Ö¶}½høÓ“òÌ®4cÒBÙÌþ -N¢í¸¤…Ãœ¿†èèþ$¥ …t¶Ÿ|I‚ó àYX¢|(~…Í“ :ðdƒ“Í2Ñ9È­š>=e)÷`Zòƒ?­÷ÔuÌ2S4‘ W­ûE<£/8Ô¢äF»¬ __Ј?ú†ao -÷s›µY6¤5™|Ýj—ö‹áCõ$Ç­ÿw¨êðÔ*5…ƒÂ_pÙ_på°c¸kÏj¬Ì¦ZE8iŒJLB—RB‡n n}n¾Ï‹H¥¦!´(×É=ÔÔâ“}~øg‰ü­•ÚlG« W|+Hâ8ˆ#à ÷ÓC~•I®Žþ¢ccendstream +5580 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 575 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5601 0 R] +/Length 36251 +/Filter /FlateDecode +>> +stream +xÚì]‡‚£8 Ó;¦0üÿ_®$ ™š™ÍÌX{»—B èùI²,ͳ-Ìóüa‰ .XàÒÈn °Á‚°ËÈ. 6Xࡹ UBß`á"9çÌÜ…?‹à †Œ¨§oxÁð‚‘Ïa!¼yñ;xÁ`á/GN>²[ëÙ0Šz ¼<÷_ÅC53k±’’Z‚Mkõ^?µH§Žþ߸åZn6‡ÉભÛÙQ/ݳ½¼ÂO\+méµ¥phŸúÿ8yQŸä׿0."ï¤Î—Âp%3¼`äó¼àñ,d9g6[ÒÙïó%N8 –è­z z-ÔN-WJz–#÷;¸že뎤¥Xî\¾m)úðD§a½ú&ÈöÐT—"hÓ€ç—3ðÒð‚‘Oc¡-´øÉ÷¸5ϾÏöX°g&üIJêG ¤KÑÛ)…aÜâd·M!x…Ozßaƒ…³ +ö¶p¤BíØl°ÐÃC/D !’΄Wò¡«ì^ÛËi„Œìj´^Ɇ¿x¢£&¡á#[³ÿC6R€E’2H:Æé ¹è•I#ü°PnTSa^Ð|w g½W,„>¼Ú0Ì•8¤ÒÈ =üå2Z±Ë^YGņFPûm}>@ð`û¡ñŒ<ˆ*ž’zõ>Ø‹O!Íù ýŠ›³ ™-o·¼ð2”YT”Ù÷Ò^°‰rqe’Ëö¶¬õ«º×X˜_ˆ›^0Xx§Xmò“?G¤ÊƒÈïð³Ì/ãî^½iŒ:é!7(ÝE,dâp´/d;ïX‚xÁÄ‘Œ<*Žä‘Æ°|Ιòì,Dm;±']ô"Ï‹àO6Þy‹ûF‹êmyÁëñO‹GŠz|íl±pnàÀ©¦ x°ÀV",ØÊ\ÊèÈTDSFŸ–ÚFòáÄ /ù,/\¬¥®±°Ä‘\Š#Jìy”„…„";6 æ‹i¿å•>Û¡AÅée2ßÄ‘Å‘¼9 À;@,8 + ³Õ† )ísZãH*?—^0òi,ˆàê}qGÎçÁê”~–ÔÍâDQÄa³t5‚îø ö­äÁݤš€“D6:I×t‚#Kq±‹<ž ŸúèRkÉø FGÊï`!$“ië/¨±ùâ/À¨Ÿl½‡Q[íôv!ÙøÅí9¹€…\,1æ‚…ózˆ‰° âHì“þB† þí1¼^¬¥T6RG˜ˆd³Æ‘æ+^&.X1#Bœ.ËÞGº`a.„q$—ì1Û7XȸŽáÂ÷ÅâH¬mœ8M’Ä‚¿iì4Ù<‘$Cü6¬Þ=öÙp쪣W¥ÁÂ^¢½ÆØZgG Š× +Y]c!ßZPj*K„lFk³‰á|Ý}^È»ì>Ð7QÓÛn•{RŒãª¢–ôé p¾7ØH¯ðBéXÓ0¸(uÿÃwù~„åTãÕŒ¯o°å¿÷=Þ7"^÷Li/ƒ(÷o³EëyOó_WXðõ†æ|Ѓ· ¦9¥ÃÒ/hd¿Ï ©ìïc@X°…^ Éãô2û—ƒ7ôž/¥—-q¤ûúþ"/´ñ˜öJh5áÿÇB]liÍiìöíP“h /ìdñž&´2´ÆAËùÆ_ˆ–"š. Œ1‰îé™B?9¦] +ðB Ö‡Ú/¾s¼bÁézÜFZùÊ<걋3Z”9 ¡}„˜]×@Pâºiö±€˜|\¼Ü÷bÁ÷ñrŽÑŽ9( ®XÓßk¦jØv*ZXn ‡¼,ÕY¨mî®#^iµ]ß6-i`Y†úŸeÇE1×'ÀÊ‹®†Ëëà/„œ¼²Ä Ýv±˜ ¶ÒD«zýoŠ$a¡L‡ÅJívëlä øÓµB‰óÿ°ð•¼‰ýZ­H¶¿ \û¿Î4ýª)§C^ȬABÉ\Æ ƒýô¼P¶m[µïsô;™îÞLúüq^øµ#Ãb ×9†½=\«ü_Xx+/|Dœ+Ýﯰa°ð6Îxq ±”¾Û©ô"¹KÎØó®†a`¾Ä@!Å>Nau=ñ›ñgÁBŽ,ÍDPV È;¾h3|n±0ÁAŽN‡%ÓHb†¬#JÍ ·ÄsÄ mý6O r­t·–Á>ci¾ÃPƒ‹ÉKî0X묳ܿur¦'WÔƒGpÏ8²tæ‰×à¿SHs—rÛhC:ä09WhOé¢n\ü6¡‹¡¤[Üϲw7ÁÚDŽlÿ^,<<ŽTc*ï3ZÎÀhìšбãô_}ØrXSûZبëµXž;ß±‘/ðµ_¨ëà‰¿ $V2¡óp¦x!€ñØíÅÑœÑ /t4‘VO¯M°±¼³b”U‹ +EµåsÒ]÷9Mä´clª©Ý}–¸ÃŽya“5¥'­=†ç™=]]  a÷k‚KÂMð{30¾b~¡Lû€K¿ƒŸ«¢‘BH1/°Æ†?0&‹(„ôÆyÅB$q³J¿À综@XHt +1Žáëžm± ‚E €Œñ|0É€8œÄ?Ïoà5uðh©Â¸LÔM[w¢[”oŸïz5¯­±; +Ž´€H(ix¡ÍThwÚdкVöÚdIEß\Ëþ í:äSg°ðvL—û|Yè_ÚNÓƒ‘XÀ¨0€3å;W>ÙA•ŠuŽíp™­ þ‘Ý`!<öø=!C¯° èJ8M¡ü…°,Ëü8õ + jTÿÈ,a¡ ¦%IÃÖʇºµ,ÁZüÒ[,Ä/S;©¥éÄÝÙlŠ¦X!ÌИZô{?~€…Vã°F³\[ý›•þ{âH ×<’hä°FZª¢/úÓGJU=Ô5ĸ¬V,œ¯WP]âHÞUIÜ‹#Q™>Ä‚v’£xA¼KxÍ •J¯˜Êaaý¤øÖ‡ +Ü£Ò|×Mì ÉÊÖNµTOÕjKå:¥r¸µÅå¦á/L*GЭÓflÛÆY¨g—•z‹…ÒZÐwc¬²õ:Ý¥ü,<–ÆeZ €!>Yç³4®âHÌ'ÿÕZœg¦xaQãñ­q¤»1U@¤KX`üäÁVÅ6Žô^èÈhp“ðƒXPj–8¶Nƒ +ª1¥}®µ …­NÿÛæ÷©I>¼€Å’k‹f; ^nWØ-[fé uº| ¡2«À±Xo¶¶ÉþÛ,ú/ò;Y±êI?»Œ•ºÙ + +É~ØÕ¶þv†¢YŽ0lçù˜£æ¸7ö掬˜–§RËR8«§ç0ž£ :“=(zÍd´ÁBUÔ´ˆÆFx¾ÔØ}2g­6iÑAΔdÝngŒ{{fçøͼ~Øu^°p“È­ÔïÀê"Í­7.«Æ­á_]Ô ×Ùƒ*}ĵò»XpŽ£d*3÷#–¡ÁÂ×I½Ï@K>I8ÂÂGR}ì[@k8Nk0rÓ7ú|7)P9ß—ÏËcÒ¬¶ÅÒ5´aÖ„ë¿æ=³gîi›Ÿß¥…qÿÙjW¼ FÖCËY•îÞÉò=n'é*ÛI­)¹èªs ×Xpo7ͯ†íò^–, û[ª¹Â‚>Ð †ÀÜÚJÆ¿†…gæ…w®ïa®°àÞÃÂXo‹%Õ‹ŒW^÷a0†•Ë,5ì+,YíJÇW7»ÔÖXxÌM›aÿ + ê7-Ìhì®Íÿ\½X³Æóu^¨±p k–…ÖÃwøŸ!áî õQiHJ ¹ TñÂA°K_Ã],h;®4ÏýkâH?ÝbÜc᾿°ç…•öXx»§Á²ñ§¼Ê½«\Nw`×¼‚rþž‹ü¼ðü7ý0Ž4Å‘Þ„…eªù•“¶cMêx×XØF® ºêt9Ý1u÷E,h«Ì1 ø4bêCnQð³YBœÎÂ=^–Ì.jTyÍìœÝuŸnÙÊË÷²Oh©‡çê u²¤e²¸÷—õ@c¯å©þ굪ôk«QêBå.êP¹S>—EùV^Xæì×m¤c^°^tæüê쳌†å7¼p´¯ÊG:0¦^ÁBym•«à£XX&Å°—ç uövÉ…ž!ÆÌ—šz®ÏvûÔRçNà>%_ÞjÙ3¦•F›i·}ÓòN.«,Õð<ä[úb-ÕÞÞô²ZÖ¹Ô²Ç/ÞÊ Kþ`Fbt÷RaáÞB7TD\>C©Jî–anx!9:ÂÞ¸¹»Þù,¨(îÐ|š¨ùäz˜`ç.ͽ( zõG±ÁBëǸOŸ¨}ºy’:©ŒöI—}¦YUêŽè 爒7,)z»'Ž‡l( %PXhàSŽ]Ò§6ÇÌ#8‘5xf/=ÑCŸöšîW»ºæ…Û©Û5Ý^´gqÍ ÇfaÖ9´–g·*áØF:´æ•N[;^ø(\ƒ…Ïc!Ò ¥€ ãUNªâ…HåNdÂ+<¾]Ã}&)Ô…„ˆ@åÌ•°b[¹Ešl +ìôÕ>«^'ôÕ"éF¨…¤p^Êr)½É‚]ÔÇ [DêâRP+·àn)‡{yª¯›ýé1ŽNÚ“;ì#²‹ôÐw>Ê*ºZþQ^ 5{ÿ­ªÓ¯Š#-z} ¤–…/š•úHfd¿Lb)®Ó’²šÂUþ“Œ¸Tû„°Oqü&}j ªmœÉ^ËôÔ`ï7ò¬:M%b@,„~péÓ†‰Ú ØÍ–– åXlÜ@’7òÂ’TÚ| î/äéjñg=%MÉcªÇXx /¨õ« ä…TÏ•çI¡æ°U'ïV©ÖŶ¼pdÀ/”¢Hhut$FY“ý9®Ú7-ïä¤Ê3QŠŠÝbÒÆó7¼àÂÿméPAÜLx m2Jï¼ ´gzCiêc,Xûe2l‹×OVjØrâx®í©þ¬¿ÐéþB’X`ûûè/œH¿5/!gå­Xpùýe0x°±fn†â…>ä.ÚýçQã ÷(ƒ­Á_Ю W+=‡Í¦wÍ}'F,Ä`ûä\º°ù À +8‘•œ=̵¥mÓF²SX¸îO}Ÿ–E¯ÏGÝá…ƒ +½x‹tc¶®¯»‡…Ã8ÒŽ2>Ê Ù4™8ÒcãHØ… ›d‘*Í y‰¨ª %§EÛ} ¹J¬x¡§}`ø/‘Sk £N + ‰^ÑßÁ6Ø á3ñÂ9¸”Qu‰#ñãHņ̃g¬-RÖèžÃp[C/è>„…¡YòW¯[cá8¦ªÌ)gþ/èt$3¿ð^À¶ã5Eÿ©a¬¦‡ö` ç"ÛeÁ‚ +³ª}TÁj¸lÓ>Ä  ¨ãTÀ“L$ÀB[« +%-R°£ÈÃ5Ìtç|ù + Þ‰°PÀæªdJA'RkT ØT+:-Xð{#/èaüõÕA×[:ÈöS ´™Ö rƒAsÞ—s}”´ÛqÄðîz_*aŸˆ6;ÝÎZ‰|Á}ŸPàzþ3œÀ®8Î1/¸ ·ÖæDö"é‚Ì®˜6qõû/Ì•¥—ÇÕ4„™.Ãøª¿ ±p;êN¡·þ­=å­wþî¯ñtÿd!ŒoËÙ>½£‡EÈî}~XJ½ÏÇËiz!ôª7ñ¦¤E}ÜÑ×ò¤®åd—UØa>ÆÓZÛºÞ»3¿ bªWþjØYîZYì ûq»Ñk~6ø8/,õ,‡Mãˆ9TadwÊÿ¾o][5èwy5ËÚ¯ÀÙ-I»‰0Ý]¿Pnzò,ˤ× —%—Î à#ÛW=|Üaߊäs¼0çqíÖ×?èo&r??ÆÞ÷¹ß¿ìf½îw^Üãöö-a¬ü,ÌùˆíÐê+Fw:oÝL—ó®wf]²ÅÀniƒK»”WX˜«më)wW¬^cÁÅË8À^C½™¹ŽñƒëÅaå¸û šœöOææ=}}¤–KE\Fá˺ôQ®z¤o ~ñ–”/ñ©][®ò¨;à€nía¼¥™,ìÏyx´<Ö ñµÕèØ´Ëê³®X˜™m¡AEUrÓïs.i7k¼s ›^‡1~0ÝN'— Ø¥Ùü7åéyAw*9᪆±@„›Ê;³ø¥Róoã}¦ÑŽÓÄÂî¯èýÞ <2%w)Æ¡c$qÓ²«]½ï¬ÖêØ7Iñ¸Môv¿¾¸Qy§~ü¤ìÏÖ{z,*oˆùŒ_4(fM8çMØÆi^caî:y“¦iQé$1¾pe„Þ-¾­h€ÏÚÍîoå…ÕyIÑßÊÈìåç^X6ÿZ% ûêS˜8Òçdgz@yŽùt¨Ç“(g›Ÿ±ÍÉj8­X° `WI!±ÇÈÕ‹QP +mçãÛ˜h‚S”wó·ɖŒ^˜©Þ/tóíHc!£4Ø.ækA †%5XÈl?*¤›µ'Ì™ D“wˆ“ZF#®4MËчMc)ƒ³ûnáÛ±P,,l,}\Ç,¨4•³˜]ä2ÿ—´oÂG2Èq•ÏL•Áª™ +5YQ§ü…Š*¥Òƒ·bü˜¿`xÁÄ‘þ#\ÇôI¬š¤° x#ƒ(¸>¬Õ†\ö§S ôB¶ÎÙÃõ … <ŠRƘ3Ð*è“¡#£Ä‘ /^øXÕîÜÈE»ã[cÚbIçE6PäøQxBGaPq¤¥R†¥s\"Éð‚ÁÂóJéë•qžL5äáh,L}Ñ÷ͬ|gµ2¶ó¬þExd)DM¼†”ÝŽc›UŠ& /ùIq¤œ løK5'å–öq¤³•Z:ç¾óM) "ò"ª_œOé=,^0¼ðÄbIh2»@åí¥—çƒù†öX€MŠ™J굑”ŒóÎÓ°©ß‚üv±ÀŸá#? L×Ú‹@I;¶¾ô8úÎμL^±là`9@øø׎@¿!ȱö 8‰>ÇC^ø>麙åË,˱'"ÍS²KýL|ß(ùÐøÈÌgn³™Ù¦o»G²‹(ˆÔ*«¶<;;çs{¢‚Å’gº…ž8³ûtΊ 8³±‹ªñ‚`¢ÖA.pn›µ<†¾ú–ú~ˆåmOêm@}j|]ÿV¥ &Ø~¦úŽP‚^?‚‘¿£(ÍùX8Eìd‰Ô½Â`á‰yÁ¨ùÕOÇ5 (ÀR¥´²,Ö ‚+7ô`aWêMÝñÅÕ"‚”`:G6 S³®íyy¡Kcøóã¨1§§ÆYxŠSªgà›ž‚.Þ¬{DX¼Ñ¾d†Yà$4|$°R¸Þ`áYyáwˆ%*R÷‰f>¯X(E1bÊp."l¹Xðz½ö(O%"uØ«Ä°àÛ¬Š¤5w\8yyÆ-ÎÙ^±Α šì,EÒfÌIömÙöpÞJD]Þø˜wñ8Ë'JpÆÚ@å¨<&€ªÐØH†¾P<®œ+Å¡ºÕÖF"u´¥S*A‹µõN8oZKù¡á$}ÌBž©ðúöQ/ /^IJÇ„=â³ê¾aÏ%bÚ€Ýöëbg‹;¯,2Ø-4¼`xá % +¦ûG‚ƒ]x¡ŸÏ"Ÿ'Î2Å ic£,å4 ü ä`!¦$ÊHzg±ó//”Øé#¢až¶n¦žæ›è©–"TavæœÒ]kãLú¡±‘ /|i¬fÁhjfƒÎïxÌ Ùó¨åƽ8R »Õ;!Õ }9úK†esÍ Øné‚…²°b!¢þ| °pZÈg vj)…`ÆF2¼ð¥¼à+,ÔØŽÒåž*U¼¡6¹Ê4ÞbrÎbYPËÖDå’ ‘G2ÉÛª[vÅ jw¾bkgdØq §žd|3I öͪ1ÏÅn|+yhl$à _)=Ï5B?”¹ò‚‡-b<Ÿ-¼PñBèû´ +!/!}>Ó´Då7þbá ªø 3qG.|Ó('Áã],ã=ð"ã;^øRQ]„ÉÝûÄž÷¼€œ"Õ~¦ärJ•d‹;[`¦AyÓ öej9X<-M×V”^ó lZ|%·²‰N¤š¸ê{\"iüà _)-ÍœP;ôžU;§@Í/P»¾c¦&Uªt$)´OËà“¿¤ €îsŽGs|dá•x°%Tøà;#•4‘‘Šx¶„|¿àg _pÞìÜ7hf¾_؈=   /|­óìc^j·5,ñÞæø/5™é-+CõMX–YVUUVfË#È›_¢2ÓHŸÇ¶N:S‡Èƒ]¶EWA‹Òìðà¬I;/áLaYéÖPacU –¶{wÁ›dxákÅ•Ÿlû–ŠVa!ýø!pËÚTðø$ÉÁ0¼ðå·ôS=h’ž,«Ïa¡~bŸÉâº#ž7,^øjqøgˆÁ“\aÀñ?q˜ëE÷ÐQOK“§jxá«oêgš]…ùÒ¿èSõ-CrSîùlxÁð‚‘ËÓ7X0¼`D‘‡±‘ /1¼`xÁˆÁ‚á# ¯ñB•ù£RaÇ ¸¦Öüù£$7Ø°¤4*ñ‡ÿ,l¢jUkäKf `Ĉ#FŒ1bĈ#FŒ1bĈ#FŒ1bĈ‘? éùt>Îñó]YrÂ+bóŒŒ|Drm±ñ\>í•ù¥Ⱦ﩯Æó]YÐ÷žÁ‚‘oÓ8¬:<'¬¥Îµ# ¥á#߇…ržÏOŒà F¾Íwæ¾ÏŸqô ¤À+ëÍ32ò=ÒûØz‰O{e'óŒŒ|0ÖIцì¯l”¢b¦’ˆ‘w(ÍqqÏ|©Ê^®@ZIñ¤‹áÊJóx¼C¦µ‡ñ!œçsvjæùä¿8¶¶RTÏùÃZ!Ì’a#ïêY‹/bð•ƒÍÇ^Æ‚Oªq­á#À‚þ +°PðügÚH­4¼`ä2ºOØ‚;¯“pÎÓÞ+TëÖ*¼35˦ÞK,d”Çã<‡VZKé¥À ÛIùãxÁø F6RÊ3)…ÎŒú›„µ\½ +¼Gð™/䤜eì\úØŒ²“ÞÌEyæÒ?Ï')¸'dp_ã~‚¿ÀòШÃßÆ‚@,dÒ§öÙØV›Í%ê²™-ì:ÖHjHŸsTz6á"W6ÒIzá\q9ÞÁ‚ضO¬çQ¹¿à½ÐíŽØã7Œ ýü,œ/|$³ûºÒóuÈ+ö,¤bœÈø¢ +W,Ô Ü“Í[x!ì™°pá…èÞõßG¼qíÃI´FÓž_r©y!DSÇ÷Üà!?ð}øFÝ3-¾3ãç¹ïiaáü‚RïBÚǧÈv¼§Ïà ;!kß Òä­ýo#ixáÇØHä/Ìc/$J%@‚Ä ’5ŽÔ¡?äÒsÁvb,ð—±pã/„áÌ2tÒó¥ùw^•ËÄ|Òë0ûj—{ç/Øi97IžôC6çVaQl¬9÷ELWSÖ½U¥øC§(¸îÑ“EŠÿ?õ.ŽûMÂ’ØYÍПbú]vÑOðMãËÚVo-üÜŽói0Lñt’‘4"üçD åbIWc!²‰©NÂéìóÆÓ /ôü¼ÐGáõM ʼn„ôÑ0iÁó–>î^ð‘Ó£MfùLûûü´‘zH)ƒÑÇáG%W¾Áχ´$©ôè3¼-m¬ßr0-{Yà*¹„VË9Þü&›=µý‰VÑÁQ#Ÿ¸F÷žM)¾þ‚%\R žUNÎA +þdFZ2-c§DÏXxóŽò·óB Bð4€zை<éçóÈ¥WDÒg3 ¤_p‘ªNÒK1²+,𸂟çÛ6‡ŸÓȨËáU2ç¾L¼ŠÐ/ŠÚìÎT~’Ó$oX"àâáj½“‰ Á}&øË-YÌU ã +nUP•Fç<)Šb4º÷tÒËÞ*|ÀÂÈÅ)|^ÍŽäç¤à(g>RÄ^ȸh$"€x!‘Aý>^@wÜGh¤ß¢^8ó‰r\ò‘èy3(©Œ$ŸO Í],d;,„¾ìp¶¢§½’SEY‰Êw’¨/%`!–1v/@ÝB”/òäµd#[¤Ý Þ;)8èt@?®¤2rÏç!‚ëK½´2£ƒ}zÚöi’lŒ`î4cÁ`0I8ŸÝ@ÉÎèÝs‚ÁŽ[Õì>ìâFù²¬qF¥~Ìv²ð’§ÊÈÙ-iëÝ]ÖµKú2| /øœ1Á‘“§‚X˜³!@ô¥šaB^€êH ”pŸó¯YpÓÞòBƒÎS´`ýá|š<ÉàåÐÕZ€K­j dÐYj€H‡ÃŒß),œ—ýÎpã8ÿÙPÕÞFÊÁ_Øa!"ðNÈ y °PK¯)Nmêƒ|ÍR ^Øaa’Á3T÷€Â§#aáœãØŽùž"…DFç˜áÇ@fÍ9ð“/x¸ßØeðÖ`á¯bAn§š|²‘Ê R†ž ã ˜Ø )Ö Þ¥Ó´¾22ÿ2/¤š °lŒE*Ÿ’¿@qf×WþB&èÇ%ÒÕXPÓ“=lY›¼†°ÐIŽç*¸mxáOóBû/¤9iIWÎ)›YX`Ü'ßY~e¼å5^À3¼€YgeÆ‘È›cœyIdÑÂÊyăÂM_[Du1›G"å·2‚ÔÜ^^ø»’í± ØÌQKQh)A:ù,i÷8¾uâõôÅ5ªWü…gàE/U`A¨ù…ŽKîÓ„B#‘ñ<|+pš…°Ð¨}©ì@8¯Ìe@Ú³Á‚ñ”X ñÓ #Gg4Áã¾›«Ú ¼iÀYeñ©Ÿœ giD}̾ —W“–s—‚¿’Çh¨U1\ôh S3;qX湓66A3w¦)!mn’¤œÃfrd¯.¥ƒá>ãlÕ3{r- 1Çr0 Q× Þ‰&6k¬ôšØjIó]ñ÷ìÍë\ ++'‡‹]üx “¤¶îƺUP?OúH¥Ñ\mM»Oï–ºØó‹’ u”GoÍy{(/¼(Icqnrì~'|ðöî¬Ðœ0’csÚ&ºÝ†‰Ý š÷Ãçy|e?à”ô\¼ 2“¸™#û­XŽm;Ž'ƒCÕëÐRiOº¶£|›ëýÓdû™%OŸç…¹JϧÚù.sú=+îòÆn +üRa¾*_ªJ™ÈÙ’?­Ò©•Õk ×f |…¸ ak¶ØQyÅ^ÆB.ž5n’™µÿF/(,€­Æ€ €˜¨z!…×a*ðKG5šf”¸A;³ÈÂüÒ(`³¹BrŒÂÃæwL›R<ë²®ç]‰mä¿ðB#d‡Ñü¢ð(u$¼Âíu"é÷yÆ{ÒdjmM/ƒ“rÁ/ÃϺ6à FÁJ,ë„i˜¶ôÑ@iqiÂœD6ø @Ìp!Šðc²‚<‚N:s^éõ Î/³Ø/û ,Œ_¼>ç]¼ ÌâK#ó&ŽT0ž? þ¾ìí‹ïŒ±Ó-O8¯Š%V…ŒÓ”“âTó3ìþV¡ÿ®€éÛl$à FˆÎç3Α.j> ÏæŸÇ PgAÙ9z£ì â»îÐÊ•·cÁð‚‘'õ”‚Ò2ßçÌ©}¬ˆDX°<µ fhê¢/Œrª^ ½õv,€íÆmïûAbxÁÈ“ðÂ¥ ª«V¤x`ýO8ŸƒêÎÚ¢‰)?ˆÜŸæ /HE+Ö‹Xãp…sÏï—i5¼`ä[±À/¼0 +,‡«6sò\¢ˆ¥bÉ ˜PRiÌë¿ðB€„Raiën³'à…ñÊFÂÈæA7ÿ †Œ\óŒÿÜš|TìHFÓK?”‚{#¶*÷{ +@Àë )à•ò`¸G,ˆsBM)zöFßy”óüÏý¡ª§­zlä{±Poçì"(€ÔN^ø*ö¢qfÎ9ò²ŒY +_«9Š¢âÍ8^0ò8ñß0°Þò‚¶§À•àú_éü†ŒöHH#¼WH뉱`Öþy ›C¬œÈ +Éwv¨õs‰ÖT.«Jã‡läi.;J©¸»`^0òC±€¶OC-˜pá'b!¦®“QBÁPäØa#ži Â(x:$ØÂá#/HÀ1ƒ:è~µb—c¦`8Q‘ÚG œ8öiÛ»ïÍ^0òCy–ÙÄ –ÆñÂYØ +½÷â%Out})E÷,PŸs]t/¯rà Fž ´š¿íOîñ‚%×Uûb Y8‡¶w¯}÷ }sÉ©ƒ§ +Ò^0ò¬þrÀYŒ;^H.¼P€k¢Ëˆ7ÊFjhÍg§j,½†…@ïá¡"ÞŸú;… /y,È>°DÞÖ_Xm¤cª‰ô-‹úG©î´¾Œ’‰¿-ŽDÕæB”-ñÈàýÇJ†Œ¼l#Á+F MhÐL°©¦@ý DZY±@;' m¨‘±˜Þä;c´—:Ç3n÷k«^0ò2/°V¥S³RýËèï¬ÿ-;ü8sú6W ÎÃÖ±ïºÁ{,øÔ6“5–J’ÜúŸÞ³á#¯ûÎÇòdM®¶ Ö¾ùܦà8ðÿXRÒð‚‘—$©-¹Š³ØH%ù]K•\Oû”pà FžG\ï‘Qε˜÷Zø% ’yŸ|ñë…^0ò’.X(VÞÞàcüÕƒ'áÿÇ¥ž†Œ|§ô + +|Y(ð®×ùÝVÖÿŒ$^0òÒ ÂÂÚð6àÏÓô>3¼`äۉᲶÁ",´ F¾SbÄÂeî©xáûl$vø«Ã<\^0£)@|©Ê§j›©{¢>žßÇ Etè°`;àÒ çŽ{FQþ€¤ò×M}¾+ŠåùÇFš5ç¾O%Ç¢ü bxÒµ<ßÈ ÇX`M9WƒFFFOþ‚Øç'½°ñB“ ¢²Sv“¢HÉô“¾ˆ•Â§Å.X°\¹‘â$|gµ,®°Í|Òu2jϽeœ#ÿ,£©·Ôˆ§Ø+\ݱD’[Lâõ}my˜‹ÒQ®^6¥LfìÆR´ÒÇÿG F~4/(,8ÂƪeæáÂŽHžñ5ÀóÊÆ_ü sN&‰IYŸ+‘`=‘¦l¤ôÆÖ{VÇʈá…÷ò€:Þz¶¢›1ǃÏ#½…ÆB‹o=)â™ñÞ%‹¿€¨´¥‰&ù%¼Ð Q=^õù|æ²qÔ2ðhñ#´Œ +Ï›ؾ^hðûÑxÐF~¿Õß(¿2ÕSª25 YÇÒ©Å|ògâ…öG2X0ò;xŠ¬…ÝIHVДc[–sª|€Þ_ñõ’¥² ŠyË  F~/ º»Ø Ón™/[Õµ—MÓâëüB$ü`kÈ /ù]¼`I¿ X°äζ9à!Á/\°Q`)¨u^ÙÁiøœSi5ä…Lr;7X0ò+x!÷¥0ÐÛH <€AÃñ.Têà3!ü•T; +¦Zd_ʾSѦaÁ +Œüy9= /ÌåD1ÃÒxŠµP©,à)S=;ží\2u­P`÷èR—'$‡"J²"¡}’œ½‚ùÛòyƒâA¼ðŸ¥bFþ°„™ž…þ?Œüi)€…_à Fþ´äÁBe°`äð§ý…Êð‚à †Œᑼ0Ãp¦ôîQ-înŠ(:­íËëî`sƒ#?RݹNÜ™êˆ#¬; Á¹ýí¹Ú½;^n°`ägú ©tçCŽ”——©6 FžÑ_°ƒÄÒ'5N¹~§ôÏŽ/ÅÅ’Iu´;Øe=˜K° „äµ/â`AÕHRPø&ƒÉ +çÉw¸,Ê ž?†{f|U,ùO¼p è|’pÐcÉ"N"L)e’þÒ¤qáKÖ3óÅ×\¦³-¼4>Ëb¶¹<;sÇEtrÔˆ? +ߊ=a‘W$¨q,E§heŘœ¿€…°lÛql«24jüü‡ÌWbÏw:ç °ƒºê,x©•¸Ö‹µè;6ÂbÐþfªAô¸Ô§ ¢•¬N”˜Úªµÿ M6ÒâHáx$m[eOQ§2ÌìÔ²¦º®§iJbû+&x–~sfxáQ¼0ͪw©§t Ì~&9šGXë(DY»K W4“ªFz?­.¾3(z\pÚ(T¥"³ +ø¬ãHŽ¢ƒV?Â_`–[ß +(ÞdY©Ó•ÿ÷¡ÙÉäºëºÃ0¥ÍÃ/‰%.ûÝÏ~a}±¿àùƒ½KZ¼9÷2 %¹¿€…e=ÀBäžÏ5i¾¯hÊŒJ‹ñ øxOú3ŪÀxxe#Ñ‚è“Èã;3k¨”pp§Ôù†¹vfM§´±5¸Ë‹ÀUY郯(Lð| YÜý,,|9/(,x,ÄLuÚ,T}ß{Óê/Ì{,ÌMRø2`„…1Òú–­ÆBÈ´+‰ŽQÀ~â…+m»Ö½¡þò'=Zç[E íz8¼4¸"û¡æðö£X;ëÜá ½ +Erd+/\Å‘+Ô¸:äþl»%moÚ%1|’•v5ÎÜ>Ñá•Dø‚ùQ¼àN/K]mïÔÐv ”fp× pIêõ>Ò* ?ƒ…,…+3¼pŒpnKÄ?—+/\Å‘fÚt ˆ’§ëbD²S”âÉt#À3ðƒŒËVcx·³êäXˆò‚{-õEõ\ç Ýè¬õEl&}z×Ï%z…Ç`? Ÿá…Îà¾Å_Hq²ø$ƒáÄysÁBxÀ  üÑàáŒ8§sO!ÉÏsIy9Ø¥/ŠÁ½/4/X¼õO½àã<×28…ŸÇ‚Ò¯$ÝýͳêÅX¯‡øëX•éVm}n·N»–±0 YÈZ;©]}EÎ/}çù Œ®ÞðÂÞÏ+Ðf{TšÖ ‚3pC~šPUÓzDŠaÆ.{Æz‚Ÿm^G˜a÷Y.ÉÝÀïá¤1…Xq½30BDTb»Ýäav[Xµ-üW~ ®á…_„……¥Q¶Jm}ÕDá±®rŒ@+xϼù©¼ðÿ×/< î÷ñžÏÕÎêwòB6½4ôÇ +(ÏЊÅðÂýMõ`,¼È ‹oí&_4·zÈ ûÒÈ?’áVOÕ3`áïú ãüãå¼0ÛÊ‹¾ÈH:ä"£zº“!”«K®ÇgÀ‚á…ß„…—ya.iƒú«fŸy!~Ån#ÏÚmž ×_øꡈ±ïÇÂ+¼ ý؃%ÌÇƱ»ì%ŠU›5‡›òBúò5u8àž]˜0ëðlvÓæ/Zš°ÑË—½n:Úê7^ØÁéËy!Šv§¿ ¯ð‚vUoœgÖ¤V=¸SâÜ1¡Âʶ&WmVO‰]m_ƒ(ÚIb’v{Ê{6Ò\am’h`f§ëÙnrøl:Bd´Ôe«üà¾HÇýu©„»6¶àx.mÜíîQèàFÓæêퟒ®ú#üæûÛûÙñä°ð +/Ìñp€…¬I×½di –ÓÞ"Óz“j +›Méxù…ñÙ]Ž¡RŽ–$7Ç}qR#l³œ…á-îâiwMõ^}ñŠ‡ºœ™½Ì^»N`„Ö€ç¶÷×…ïsÛêM†lö7÷š. ,CòS°ð^_Î Ýn¬‹åw`á^Ó[‰9“ë^gºÉ57ä©{s–{ÆÙ¤ÙGŠÞµ¼&Këë³~²+ËkÊYzÉÒ#—%ÖïÇiŸ) h¨®í·ÉÏá…GØHæ…ÖjǾˆqlJÇ®HCÛA± “bÀV ½ì1I£zŠVIeõó©H²Çaá^P`©w6±s-ë5‡¯’½‰ž'Ãf£5ÕoXçíîb!×ÜøîS¹$Œ`^ëz27ÍwX¨§¼6'\…jIVns§ñ`á)ý…Dz\ +œIf^ñ {D¶21­ñáù+ ´„‡°€­Ù­òNb$×ÁÒõh=5;¥ßÄ ÊtßjŠ=è¥Í˜ÇîÅþÞiÔÔílBwG óÝÅΰÚ赕6¯F?cÍAg]deº5;¡F(8UΪ&Qƒü1/І“—©!À¹½{f~áX …üÌ'ÚB,t¡‘l ¡Ï‡3ˆ,ÖõB’Ÿ?qóßÇ :£žÚ+;Ù½ÊÖS&Ê&¹»$ÛêjB¬R×fß;‹ÊX:L›em“åŒ/Í´‹žî~†R~7ݽEîè–ÀSxŸnƒg + ;kñ/Ï/< z=h +oÁB(|(,0®‹g H‹cð¤ß< /ò‚NÍs/ã}§Ê«ç_&{Åà ±’2ê¡{ÐñÞÆppí3ÐýjÊ:î‡G®ÎòÛ46¸¾s ®§ÍÅøçóÂÎ/h^ˆd©Ë¿\°­Xˆ2*XT.ËþÁn)>Ñ}î¼Ð:Éâ%¯?|Iºyü šÕ”"cýz¼Oþ8¯ñ‚ŠÛ´Ú3uŽjÂèX—u]S9~‹ªjiº~ˆ÷xá&Œ*³o³°Éð±€Åx0³{¼0{ŸpÅŠXáû^”‚â…*ÛJÕŽ“¬ë‹7ûŠHº‹>ÛZ)ÜXü·‹Cm+všÍº™g7Óh. V|c-´ÝíºOTÕz]¡ze2½Æ îíš åWŸ9öºG`á¸F} ªOÛ)¦Ô½»æS}µX Ä ·CõuÆÕKE(Â&©o&Ð,;?ð´¦æœ3üK{éĪ;¼p°¤ºT·æB¢†G\`‘yÅ áÅwF^(9ˆéÁY2 +)–4#,ø1VPŠ…ú°ÌæS×jç+ø0Š¥Gg{ëW é+« ^.BÁZ;µ¦kz4ìæÔ1Ž.ªBb;¬Þ.”>æ…úHÓ«D©?ë/|/œìÈÃa&TÑÈ |鄼 (anú¾YÚG=)£*¹ž×ã˜åˆ‡`á•úHõ΃ìvø‘Õ¾ØSËÜñä¼}½8Q˜5‰å;zpw¶¼¶Î^ 'hÞªÞÆ ‡ d!nVN^x ŠOìÝðìXx¥nÞ´+Rg÷3H•N¹V¾1\è‰}o*N–£ƒÕ‘ê BSvå"¿ºÎMÇ‘Ê·ñÂú;|¢Æø O†…äC™{wx᨜*ë–]Þ/ïÍFìÞqÍr‡)qÚðƒ¼°šKM‚€kZS¼hmåoÁÂÁfá,\pyUvÀð“`ácSþwxÁº–$Ic»Ë‡þ—å¯KwÙÚnb7Uþ1^¸XKq²DZk·½Ò]ö,lv‡âûf cü…‡c¡´¿Ñèù…’±|ó‡JÕ½æÜDm†3:»Än¬o]-ˆy1Ó°Š—\¥4Ü)ù«©qéßÉS=ÆÂ&†~´¼{]Û»±pña;kïòâô@Ò°òÂêÔ{bÐa¤7b!|#/8÷-ºØø ²ÆѸxGí÷zM~OÓUw°ÚOðùKÊèÎp{5[ñî­_¸0¼ðý¼PA¯”4„ÿµC÷Xx8/l¯2Ì[\‚¼ƒƒ;5¯òB²™aÚDzÂ/á…c,X¿ƒžÐ_x ¿¾ðÚ Ô’ÏOòÂKX¸3Gæ]j¹Ã6 Ú¼À ¬±8µ^š; “íìwø>á­¼àÜýýƒcxựЬõ"±ÇáWaá=¼ Mó±0Ý$Z[³:›TŸ[^`Ó0¼¶’^EQëîe§øsþÂsk_’û/û øѹêˆN=Ë—)¨¥9ú;TomiéÀ銅{»|/¼\¹(^,w7:kK‡ËÈzÀ VýêQBøê™8Û~ÂûxáÐÿÈ(ÅÌ/<„FOQ”˜xÚastÒ —KmÒß|ø"ÆT’« lØ y†]zf1~’= ïâ…—æÕøú’N²ÊVív.ç;ð^Hÿ[oc½UfÄá¼s;VìµÐë|¤£ßÑ]YÙ_øìN$ŸÒ³ðC°¸—LØë|îÅ)ýO×m¢4Ž¤ÇâBz*æRÒÇöT¢O,jíÉ>N#á< ïâ…ý€üž Ó¢œÓ¾ÜËAÉv聾ïçuVï~>R˜ “•è2`ïã…à +²:!¶5¼ðy^M)  ÁvV³% °pAO'uçò\6û¨Yû»Ù¸uLëqµgJëF< ï╧zܳJ Ö«ùòѾ]^eÈð‚^°ùRu$뤵U•|=v¯^Ë€½“¦öómRšŒ¿ðQÍÎsµª9çè9ª$.ç/dÊÊ2×½pAí'Å=ù ;ßyé§ÞƒS]æ%ÿHšÏñ‚Žàêi¼Í‰nR¬ËrÓs5´ð²¢:}¥ÞñE­ÓáN¿‚çr²÷ñÂÏ(wasˆŸ‰…ÿÌ u;ϱCáLK4u@Ç{°wð;.ôjK53GÞh®±€ZŒìé]„ý,¼‹–¤íô®ù¤Å¨hu Õ},èsLw;×êR~e½·®mm}/¦šëŒu}÷þ^çÏð‚ía·ó ~47dì;„…¤íÆ.Ërí.$‹Ut `Áj»nÌ*ö,¼‹–ío‡B½^a‰±¨Š‰ WÆøSä^35¿½É8]BOå±Õf$Žt âù͸¡ç~žÂ_`ÜW*4/8 Øg"‚Pë/¨ XMžÄ”4ЃH…÷ñ‚Ž$¹×‹7Ãx7¼•nˆA¯A[ϧ†î«!}ÔGõacéν.Ù¤+Ò\ë$Û/C{'/Ü\|x[qü3­¡ÿ¬¿ %"EË ºÆ4X› Q•ÞÔÍ[Œú]õ˜,®ûê$¦¤ C–/gËÊÓz¨»ÕSaÙ:Kª_½·`tÜ!½$×åËÖtÖ÷ò®”ð\]Àܹi‰Wÿ‡ê©–˜w“(ðð®W'¼Ím“3áÃehi‹ 8ã¯.½Ñ»Þk·ýÔ³ÞN>Ë XÅ·ÖÝÕ˜fK)#w‡ìôÏ)Ö%ïÂÜžn ih¹µ•Xµ}èÝKb+|ÇN'ÓZU¾¾²ªsÈ¥’¹­u÷²á»y­´xdômëЇÑs®•$Ö34ýA¼ðòi^˜ódYMS[©ãàR³úÀ¦`º<6ñH•*ë!}§Çí¥Éö‹Ñ¶e‘°Â˜{©ÎQ×]ÐKkY^ ÀÁÜ>UÛ©.EÞí/_ìÂáÖRQ7uõ»u•ûeíŸÑ_(’ôtXx//`Õ^÷²”ymÏÊ^òø²â™¶;Öãø¢ôÛé2¬v¯"Á`Ý>ˆr):Ië´—kš6+‡Þ9ïL¹uAùåpõue¦M‘úÇL3ä â4 ¦ë8WeZ”’-Í vÛMW}Íò‹:íò7ÂÎrkt¸uz4ÕîûMo“SñÞyç|ÜW±Ü¹ïÒä秄“žÄ_x>,LØvl˜Þiëfq=,6KM6Lzd?b“ÀÕ´¡íŠ‡µmr5OÍkØ›FH0nrÏRÕg[7‡|œŽ»ªÝök[¦@²d9ýÄä`š?´ÝõêÓ¢†î`!NÓ8ãwû}mŒYª˜èwè”MœXÚFš°4pwp¢ÊI±•Ž‡¹:JÞáWt²T¬;GX®x6eÔÀÁºýÑlü¡©s‹oAÚ]ÛH؃Êöѵ'Nwü['ÑWÿSyá Ÿ‰‰±ll@6iÑ÷6ëp»6»¿cyοõþ¶ÝtUþ*düU'ûD„s;5²ªkì®}é'†Œ•Œ±ŸR}Z^`ìÇbá×J|§ÀÞo‘gõ¢÷W ³Gƒ…¯ÇÂQÚë/‘gåß{ïõ‡Êk,|ÌFú¼ð[°àIÇ`Á`áéy!tŠ“ +ÉÄEOB;aî©ÃéÕÞÝ„äXÒŸH¥ýˆv;´r¥‰Y\ Ùœ •÷ÒÖý€&Qž¶íÐ'lf±/‹NŸ,éYý… +Û +ʈa**HÐâ(^HÙÏ“À†åKªÝÜùø½Ç/”Ô¾Üoq¹?¾ô;<^o²ìÖ +_9ÔÇð¼ìa°`xá)yÁ“^Ûb^¶+½*dÂG¢85äIóeÿÆöŒ6$,ô2êª*ÿ ¶«")‚®ñEŽ]Ÿ“ÒÆ­^Ór˜ÇHNÌ–Ež»Ò3Xø2,LÆ_ø rj4UöN%h1.KöhÁ~A ËGqV¦ªXätß³È@Q\—€}ÏSxYcÛsÀA4·z‘C¤ü —>ç‰c°`l¤çä…qYo¨;ÕõhÕZ$°_ùYè|ýp>»(Ñ_eäžÏêxí9[釸x¡YwóçŠV²Qå Ü®âÒï?–þb°`âHßà/ØK´sR=Fp5šŠúºa¹ÆÂY¿ò‚½¼‹ 9bak {Ý ±€LÒ-X˜É£ƒƒ…çä…NñBצ /x ü¶Ƕk^ˆ+x;v!b¡“µ3ïʕȲçˆ/»µ{,„aØ ‘ä­Á‚±‘žÒ_`Ä=Œ÷¹ å`CaáDÅ*>-þ‰\íHû DY“ŸmyÁ^˜Ôn°Í/œ~}dÖÍ`ÁðÂwÄ‘"piYè±^ŒËù=]ïÂï0âªÕ°X5x@K +ç"Y0\õ̶¼`/d‚wsû½á…vKd‚+.*ƒ…¯Àæp»Æ_øl.9xµåÌÀ~ñ%.ç׳ÄýB˪¨Tà† èSm¸¾DëŠбÀÝ*ølX°`I2½¸/.ó ”¶éº®éØoý}ß3ïŒ=™TxæÔnŠ/½«K\kS±¤J'+ÆQÝFc'w¬šV¨t8iÇ6*ÛìÆbš}¦ol gÚ÷z2X0òLþƒ…?/f]›Á‚‘‡ù ¹Á‚à †ŒÁð‚à †Œáí¼0§ Â:63÷~Æ\î ^àÑŠžê¬+5X8Õ:¡œUŒ´Lû(*ÒKoáT€œ,:wê²yNhûÁª Œ</x2ÒXðD§9ÝÛ=ó¥<_r³ötw¶úR5æÁ2ô°".ýEÑ3!|.©­[„“q¤¦CÑ»ð™$ ž~ÇÝ} /l°PªQ9/t?rÀBFXÈ—ÖQlÛDªZý1ii‡…s¶ßWçh1;,PgOÀC,ÐÕ‡ê~?/¬ð}tP\ÀuŽ'ø§9ôï´O5˜¡ÓIÉ¥"ÿø°^ Í9Ÿ»Ó ý.ͺ[(’/,­²¬Çã¼|áég§øöÒ{öþB˜D‚ó¢›-0i|Z¤Ö`‡r{ý‰ ~Æš‚!ã¯m¤¦%©Ôg¸Ç‚¯°À|éRèhl­æ…|ÅBÉ?×zZ,`Æ{&¤®ò‘sd=jÞ[KM’a€ÙŽ¹\µn\~ÈY<¬€%KøëÜ!öF×j8V?þBdÅ÷Ž…–¿ ÑÍ~ý>Šâ+ü…Ô¾>¼AömyZmH”ÛKõó,4¸¶ÇDœÍ8‡X`!c'É«=/Ø+wü +,œ}j¦ZúÂÆõ¬)þ3I¹Ü ‰‹À…7ç,ßmŒ×Ãn¯ìã ÕˆàÞ=U„ߊêáw—¤œqïÔâ¨yV·ñÁþ‚GëP+Æ‹‹¿€¾3ø êh©±^_T Ø [AX‰e|bKdðb¥ið¹ÏtD¼úÎÜ9qE!¿ ¡o!ð¹.å‰ /½Pã$ð&.ÍP/Ï•TWZe9 aÙ–kW+UWuSª3,«V™·lÎÔ×ðm®v±äRÎ>Ì+uؾÊÕiÖ!SÁéàe¦ÎÕ÷³Þ!ÏÃ< ³J—tÍaÛàÒZŽ‡_((c[.ØŽ§¾Ï·fu¨®p5¸óå7e¸Cžå¬ßáçžvÊ3:ófwOb‚gÅíÇû úqнb)ß¹ -9.jceözœ›õàÈ z)gA[„qÏ¥Òü ð^’Ù¥x!ÒkBO¿)¦Z#ÊKé'dð4"æW8jô½ž†›=J', YsÎü€EACG€o-_€™£uµRhƒŸ ¯‚ý" -0¢Yõð*è/¤¨2i€»bÓ<|Á½2ÇÓLs¤J9ÀGш#mó +¦p<ˆ´á§HÀY@%;xÁ=¾ò€çìÙ"ÅœÀÐsxÀéAO*žµð–q°â^!¥„ópþµ^ØDaIŸulÀ1w?ñÕÛ£ ¨å¨vïC´aŒÐû÷2¥àŒ÷{,ä:Ž„Xp¥P‘ÒÓBSšyó‘m¬‘q–-ò¶p²ñ„4€…£%–A(“Œ ‰ˆ²ù °½ã|(eûi±@†ðBFwð$Ó¿‘”ó¸ [Uc7ŽË‚Ù° dZŽôH,¸Û¸n„¥ø¸ÉÓ€à—Û Vµá…2ÃaÞó h†òÞC9ï°àbÓl„Ž/+Òöaæ}2´vNqæ¬X€‘?Ö¥àñ_°p¢”-‡§=.Xˆ•ßù H áÀ‹¿€¼P¨_|Öõà$äVÒ(»¯§S¶¢‡2õ\ªŽ©– ¼›p°X.ø‚Oï~……ÇòÂœ[Q@óžá°Nð•ç(ž©;n笂~ëà6ðAdiÿ!ö¢À£¾•á4l—™w°•·NÑÍù2Yž‹qNðÀÖôûx¡[ý¼BÏÝŽ"øÊ;ˆ#-ó  ÔüLQìŽÓDîÌjv‘vG{_`k—:ôÎɧl@á!RŸøGŠomy¡Uã¸g¸`Á´!<áQ/XhI}ÙGÒ¾¡å‡ÊÀ÷ˆT”Œ‡N¢ÂðÍâ/Ð^g™•*fÀ +§XÍofuJw-w…°È{ƒ…e÷ šÌú…çÆ£çC¼ÐH„W¼0Ÿ£â…ˆÚÄ5M»ê7–LèÇÂãàXyXñÔË¢œËZóNÊ–mA{€² h[4`Àƒuëes‹¬²Ä‘ü$óDæ!ùg‚ª>Ü AíD·b!V5>ñ%9,€òÛs~FµdIC5vÙ<úèO!ά"/ÀQ¬kp?ØÜúË4z+$Œ’6ZឈYØrŽÆ3úòô³V`ÅÝF‡Töå\\·XC¨v聾s–¢—Ü`á¹cª½š_@ÛÄèa¢g.©ÄOñ‚Ž#­©‰“*ÎÙ“­Y¿à ÆäX²ä.ÀX[.:éû"ƒŠQ.Öé 9ìÂÉ[°€)ÁÃÜØ^zX,šNƒX`>Uô‰ç Π¢•¨¾ç !æm‚ºÃÁ‘*ü0ðÀàú`v!<8ELàÅœÎj­q$š[B·»åËn •ò‘*¥mz‡ã^_°²‘TL•ŽP0•[Å’ø}~è2Xø:±1ÈŸp}†ÝwhaZh/&˜‘ºÂ·s|bà.JúEgB+²Öˆ!ø ¶ç{ô¤ÂÔ #é7a!\rl /<;>7m’ƒ ­ÒêÞŠ…|‹…üò#VŸÅÂÞ-8‹nL}¤'ÇÂø©j¾N²xÇÍÛ –°Y2ð÷îò5R6w2ËXó©\ôëÝ“x6¼ðC°`ä»Àgüƒ#† ŒìxÁÌ/h,¤F /^ ,Dç“‘¿,…4¼@r’Fþ¼˜˜*Ie7FþºŒ†Œy”Ëa°`Ĉá#F /1rƒn°`Ĉá#FŒ¿`Ĉ±‘Œ16’#†Œ1¼`ÄÈ;xÁ6wÁÈ{‹¸Aä¿ Â`ÁÈû%ÆŠeª™á# §9Ì~—mxÁÈÇ°pþuÊcxÁȇ±À~دç…òÜ÷ü1á²Çb!šê³á…Ÿ%™.am~$Ô]ýU¾sùë±P Y ƒg°ðPiúˆKîõ&¦ú“¤X‹4–“QàÇJ/O¿ëý~©’ØÆ`á °P,ü8©Ãè  ÝF,pß  ž2/ð¥"Çh¯Á‹Rþ…¹6[Fu Œô?°¾ñ³¿„žgQ›¡ÔU̓Ú{x ®«®+™åE}ÊÞt“}Gsà «‡Ç”zðt+OOwWÞ{m4Lj“_ƒ…2P“sx©:o9Ò¿ÔÂÅ–§Ëž÷–ûÓÛ O[$³ÝÔܱÂÙã4•û>{ßAt#ò lΓ®Sl¦¾Á<—³ŒmÛv,γ™qm7½¥—‚ýð9oã/|’Dø„¹"[ZdœÞÜÜãÞÃRY*#$Ì2öi,2Ö»áõ&‘ÖÜéì€@Ž— a^[¯‚©ŽVܼbÚbbŸl\jxáá’q°BGÈ3*“B·KoͲZô+owµ™Ö4›x!¬ô.a©v†‡¾hé†T"Ç2ÀK·Á¸áÓ'±`K®~%«ã^P-JyžGÌ~ESiÊ. |\0ž¸EƦÂkñî—sÕÃÛnLÙ\º†ž 'Ž:ëù§ˆÙcs×V`ß ÛãœG8âÅ‘àüܪGËy±Ž‚ù‰ Å3ƒ'Î]8Èä Ñw¤’ðÍjcùƒøòN&„_Bij#ø©ø×Þu06‹ó`0Ëì `øÿÿò$Ù2›6Iß^kÝw÷¥ Ã`=Ö°F ç°0ž˜gr¡Ð‡$ØÇÚ‹›=Ò x=Áañ¤—ç>HÔ^Â|F Þ—"ìBl½`‹Òž‹93ráÕ”•x3>÷<¡uÜ÷ù2"<&Q:E„­”zéÛé(ËjiAA†ïÄ +†PÎE_Ên™BiµÀe< ²d0Õ¾Íbég°ŽŠ.w a&†.a°óኟ ƒ^ðϱ@raŽcë@ Vt`ï°€†V#†Eõv¶¨oô<àAƒŠ¸7¨6Ï÷"1ráÕÔœyA‘-!Þ?¡â jT À5š›×ÆàŽdA04”½€“Ã|Ù.¡(ˆ¥f8-|ÿCj›>”­+}åîäD_” §q|$ÚT*‹j:øðǬïÁ›ðŒ-œE06hD“žT{ᥟ±Œ¥"‡?­çW1ƒ…×RrÖñ~”ÙR" +Pm¨8¨ü ÍH_6YÁz\ùÕRKºB@a¾åÄ„ŸÁ)ààðá¡ù>Ñha°R ÐÚ·ôK¿ÿ¢\èN^Ê™\ÈÇÃaŽ²íçvÆM/ïWdBÙIèƒÅ(l€º¢#ì…•R Á›läÓF.¼š¬3±`âKâ„V<¿kP/‘¤sIŸ„¶,=ån:€^BXP>UON­Ô§ð£ûþ‡HE´ð‘lè.VéûþôE¹I_‹ëÀܽv…G{8^¯í€Ž· 2……*”~8Œ4ý!¨+¢\ÈÊ“‡<•éi,¹ðn,̲âB¯Š•ëKÑfr¨ú¾ŸÒ W¢ >¦ßc¡ƒ5nçS¹PÉ`êáŸ"Eýú;t¤‘l9E´GìÉô){aY­oÔùáÙjý¸‡£IÁ«×ïpØ@9Ó­:Ò>ý¥'Q¢ä‚O‚“Å=̱ÁÂב:É”KµigôÚ’4þª¶Epò‹9âË*ˆqú3¹À}šà”o‚Ÿâ£0–D=Oat}Ô'Ù-V›Ì ý_·ÃB/q‡qaën*k3½”5`á@o×Æ·ñ^Æ,\ø‘X˜Îl[Ôùi}¯Évn`Þ:ZÃ]x—nO®¹_W©’'ùžÙ`žŒ‘­Ñþ›§•ùLÜ¿D÷o°pÀ fËc ÿ#,Üá%÷r︒¢Iù=,œ<ƒs­:‡Ó¢§W? ïbXƒ…w¼Ô4#¹Ð­yê 0[Š:ü8*,°ê(é=ƬZ³šÙ1垥<Õ¿êÛHc¡¨²@ + \'C3ßN¥îCY†ÎÂêÀ÷½æåXàVà±…j˜ãùjï=ö¢Ð÷Tõø ·ÍáQ{ÏÉýgüÖ|ÉKé(#jià¼Ãhí¡÷n Ò`áßb¡Æìt†ëª%TÂúâ– u kdt²ôJ)B˜^8.Ôi |UF Ïá»ÐÐøV(ƒbû±<Ð3LžJwàpZœ@­àðƒß+,Ę#+Ùó\q¥Iaþ›òZE›ç°ËrðV i„ «CïÀóéAéç!òÙ²”ÁäðìãÒrÁÏ£0¾X”Î++ƒ…†…\]STà$zÔ(†™…iË1[‘üåÀexœÞ‹®!êüAÈ ¨Bs …|!ðz!½g¬ñ¥ï±\+?Ú pØ J!öÏæ‚’Ždá``üõ‹±0ɲÅK„:™/-e z”]Ö,”ÙMp¶¥ŒAÎ +Àëk)/¼? O‰bI¤_,¹Àüµþ!ú‘t¹¤p¨g•$Ú K;ç숅L¬X¨ìce™Ô ÄB„$pÈ),¨Ëîå¬0+ö‰ŸÄÚ7jD¹ÈXU¥éËt$K9€AylÞá£\(EµÍ]NŠgžb˜2[íΔJ„o96rágÚ JGj #¹€:0vŠ³&Ò îREíÂìa5ø.t¤p¹¢#@Š¦æ¨ÑÅâpUHbÅ‚ Øä*M:|rfI. +µeøbÛž/ÃD§‹©!Ü:ÑlXˆu=%[¬r¡£×æJ‘­rƒÈR¯Ò¹0¹ðí…˜ÖÆ$¹€:ÒL °ØzR;ÅÇU‘°0KUõÁuh“ •ÀE2&Šp†Õ"y€£©Ô\)«Õvæª_(D¥O²†ðsaÒ‰kîÊg}ªÂ $>A$Ë1ÐqtÄBæK/KÀ‡Â¬f‰3H\M,éäG²¤8ÄTnïErÁ`á ‚!î µ½€raeì6QTXˆ¥è +ä²+­/Ê Ì87—å¼~\‰ç“ùTá¼Câ!ÚR ‘y4‚ÙorÎ?æ\O:‡»*kÚ%WUþ§öAe,“Ÿ²Æ¦ ^»n)çh礞.¥×(U«ë•6®Y Ë¥C3&.ñ<@iBUü¬É`áå”á4 à Ý† ÄÁÂM TÊgJÁÚpíÍAr› ;v„­®Í¾N÷¨Lk„Ó5‹á +ÒÆ¿DŽn%¬ ƒ~zÜ«“XT`•1O¹¦/4E [^…¬XXFN üÃvHî0Ú2gÝ®¼;×»ïSdê'Ö·x.Ùœœ—2ƒ…©ùV,,¼m&¦Š€bLN[Ú÷0“)DGHT_xÕL[†:nam£êLû‰­švý}êU0«Z¶\Á˪>ðUª&ÖsŠõá9{a`¨ìÿ¤Ô׿‚¾ü1²O"õ~À)Ã’*’,üb¹ð#({5îçì…â”~÷“ `äÂ/¥Â›~6–Òæ Œ\x‘Í’-? ‹Á‚‘ ¿ƒÞŠn°`äÂO’-ìŸaÁ]·Í²ùª®Çã‘,¹ð}æ÷ø¯°àl¾Ööz?æËÔ`Á`á»è£|ç7bÁ? \0ämä‚ÁÂË5!¾Ð¾K×ìkVц`!RÛáO­Âó“¾ÒïÃÂ$Tlx–.• ,°oÍ™î¾ÎÖqë^sVe  ÏjBîAúíbûBŠ¸ž¹˜]ê,½/…-|Æäì¾cÂ?V߆…œ"©ÒAˆ B‰[0$l¼žS2Q„™‡Á­•'D‰Š\DÇ  ž¢P”yÇFéEQ‡ï)”]û"ÍfÄmêËþ,'Œ{õó}õ°·aAr5¥£\ ŽäI/‰Y/ Ù®<,h/D¢´’\ŽØ¶Í\Q6  ÏõKäFe3õ×í½IÙ Bå€!ܧÛãY#ë[Î*³£,T”,ËJQïBYð_ kõ|¢ ~zïÏ`á¯ËÕ +ƒ {,FáËP+]sÿYV,^¹æÚƒ\°(95¤^·`!‘‡1`ÿÄQùË ­ªTS¤KPY‘µ"0X0Xx + jïeòü’R!J™nt^[ èê`20&†å{ä‚êfª2­ °] #À1¤äbíE‚YålKý£Žç0Ji°`°ðƒ8˜Å+¢ÓžC5Y(ßYZ1Päð+XÞ‰…@Pg;ÀÂ(g5† ¡ÔÜäBæ(Þ眗eL¹°êHM]¼D*üÜÆf¢ƒŒ„KÕF²Š,›ÅòÓ`ì'«,,,ÔŠœ!û‰ª}c¥†&«+±˜Ù$½åûä‚My‚óȨ€`KÿÅz‚ŽÞw¦Ây`,PÁ¨`ó¯`¦¿g/ ë´Îƒ8/—~wðEƒko˜3ún.Ê^™{rß%TægÊp¤- ©+U=æ@b†8a¡ñe~žôFOŸª‘ Ï‘ê!Íæ ú~m¤‚ §.ç^àŸ~ˆ}ÄÙ!ú&,,³*Pf‡A^¹Èà=IUÔl*Ycfªº6Ç.Ù1_ Œ\ø'ô>,"ùdä‚¡‡UàÉ`Áȃ…¥ƒ#þ?T¿ ‹mqƒ# þ¹`È`ÁÈCOÑü(ú}ãiMéøi¶ãñÍS8_ªç   ½ ó•¦(Íç… +/oísÏ2²e°`°ðÓ±à„—Bý ±0ѵÑ,,üp,h-f­«LyÌ k7jlg½USÎR¶²õÇNù¢±p<…Sm}­I ÀØ€ýè°÷P–Q{ÛŽw"j\”±ŒºM&ÄâŽìt€J ô/œ‚Ý¡sY-ª1º²Uq€§ƒ_üv,”f¯íµÔi(<²‰©°`³je'þ×vÕñ’°(—[—óˆr…°wa¨úJƒ½`¯§DË@sŠ p5–à©YÎüG±mä‚¡=µ¥ÂÂ#-¤ðÈ„°€-a!Píª… °fu9Ïéà T`8@Q¢Oé ì OͲ…Ï.¿ Æ^x1 ;¹€ìíÑÎúA•©†ÞÑœ2–PŸŽŠÎ *é÷&]t3ŸÏ±ÀýçVX²C#‚{ >©"£ÜË…Û¢R-0Vbƒsæ•Å ­ZÍ«gë#`¸ÖÇÚèH†> ï1'’ÆB´Ét!%¹ÀsØ:@éæǟЙ„-®)šÐÏ +ßá'8e´èÀ# +ЫZeŒ<§÷‰g;Dÿ¨7rá ®$)u9ì(†¥Þ¡zÙÄ®ín* XèŽÂȱ´1j² ª*~³îP¯s†m«»t…npžÓúFÑ]2y;ùlf¨'Ò_?mF.¼G0<¨“`+raÁT“ê)šõ »œ£É‘ Þ::žˆ5Q¯NSý±™:¥Egê²oŒNQSëjb ´=˜ßX¿ÖŒ\x¥âu¬Ó‰§'è 3'ÙÎfáõ½n[* þ`fÄÈ…_@ñðìM^a^ãcX0/á—3«‘ † } Æ^0dÈÈC†Œ\0dÈÈC†Œ\0dÈÈC†Œ\0dÈÈC†  2X0dÈ`Á¡†…ª7dèGÑÄÿÚ õöUÄ?‡…úBAÚ í÷N|µk°ðu,d߀…"Ö|_ul7ýÔNSß8›¨8WGž’ õ5{aåîù”y¤qG+qš¦ïû¦qbw®ý9,Xñ9YÖQû¶¾B} ƒ0XøÙX(¬<íM»Ì¶¶Ø‹äpûÔOýñÀÝvÏ›X:éŒÐ(¦¯]kï8â­c­¸š>…ºîÏ|«Œ±¬j"Ë­¿A2Ð+1XøÑX` +õŸ»f²H«®ý"¹PÏW äv•L§KF¥TÙçwª4Jïâñ Ó-¿Á*~¬Â`á/c!ÒlU_Û/ˆôÊ\·¯’ íu‹ÅÑì¸?¥˜ëK ®º·;ßúí&nK‘fÖw· þ0&Å„n|ÕóÍý³•¾Q.гjulׯÉ!~w£æ>ÔJÇB}[£j•Öå& ? Óû±ÀÕ[»·xT1ä¼÷8¾A.ËèLëY!wý4ˆWòäÂj]?ªs,üF,4šÕonÂ1 –9{¯\XZ²MvT¤¸Ü™º…›ð‡±pG.,½~ÊÔ`á¯b!ÓºA|›¯[¥Kïé=rA]u>î1ô¨žy–ö/§V£ÈÆÂ=¹é»÷  ŽÖºïùOÔÆÀn}~\ÐjÊQkÆ «ý„{çúá•üc¹°>åu•‹3V¤iš±ûœÌñ¨âÆAaNÎÐÑx‘þ–`Ÿ„½ŽwÃW±®Ç±>*#ï‘ ë9щúv[.0kÄ­è¹z ww#¢›XÈ&;±fKmÖEý­Éz·îè &=aÖ¬ªª”–ÚªˆÎ/RôŽ¥î4ÕFOé,üÙÞÂiÿŠ·baÕ’ïòS;cé.¬úMr¡O]9¤#ÝÆ)·#Çnú–=Œ…»rAù¥.±:…É*kƒø’kÚ‰`ø +Ð÷üÂ(ÛE›œ›¤ÑìêиÜT—ŽZ¿ð4†ÁÔ%ì¤ ï• ŠÜûQi¼MÙÍþír¡˜ëÎx˜>– \N§LšÙñ<º¡»Éù…Šèì0àÖø¸C،Ǹ'ŠÂ:¹Í”Ì'‘¸5 ©áçÞ>8 ^x³îÐÏõ˜ü5,¼U.ðä|Ho’ δ»÷~ÎåB«VåÓáñd¼/Ža[§Š[j]FÓŸ°‰·ÇÓî|Ûu¯œÛœc^xZu›?†ñV¹ Ãzž>‹…wÈÍú;-E³±×`áž\P@<óJ9[˜”;"¹[ˆì¼_£Š-< +9†nOr¡ÞÉ…Ý‹™ôúkhTm_¼×âö +VöÇ°ð^I/ð™Ÿo— Ú/´[2W; Í{‹\л(§¾e0ŽÚd9ñ<_ ákØÔƒÓàaëf½FL3kÛcúg{ÈI{¬1£ON,×½Œ_×rvÇk…7Z ^ˆµuði%ä=rA™Ê'Ë3Ut§)žÅÂm¹P$õå–ã~M…ÖÞyÖ긩ýn¸¶ùã-mšöìî7Y–eLûT‹ iÓžô–½ú&0¥•…Ú¹™IÀ%†ÖV ïÕ‘š7Ú¾O.l+ó^TÄã1í̵»eÏ`á¦\˜V%g¯ú0mMŸ¹´š²_׬ÕB®={%gû kôa\]¾¼zÇík¤ ‹†Èz‡ý5,¼W.œ{nþ¡\àѵ`Ô÷œ±¶œ¾à¯ÅOm‘Ö'ã]cBÒk×ÚS]ç³Í®aAu¦úë(úÝ%5\Îzþ¯ØmûArA{nœOcáÕrMkÖÛÙïErâe«Ô%»ÿ¬|Pü[;§yD¦ÉE«vZ ¿äÓ‹ ‡ê,ž–¬šËû·F‹ßÂ’…õ|¾XÐ÷»lŠ ®ó»B8~\ˆÜ/í¿V.ðl²ã•ã/…¼9÷Wâ~–nbŸÆ•üÒ}‚éÙw‚÷½¦?ÒÅŽ?:tù20'ÏJ¢ììû{Kz–¸êHÖ/kMóƒäBtɱo– 3Á{ÂZx¸¯»–¸¢®Î|áåÇ׸ú4ÎêœnpI†N£ñ`ßx¶ãÓS8í%ÆÓfJÙãŸ`éåŸÝRê¶_Ö­–dù“XÀ÷تCt<Úç±ðD å©ßˆŠQ|à3¯"kv/ðàÎQñY,Ü®TÇçÆËÚÞŽ®®9Å‚²?Ž¿Ä‚²H®UÂQ»GÓ{Ý{qþ&š |)ñ¿Ö›åÂçu¤wÔGº–p½Ý±êÑkïž.åãÜðç±€Õ2cûõìΰ°:À’ö³XpÜ›¶j¹Ùx• ýßÄBV®m|Dÿã°ðL}¤›ãGŠ#EXöX!µÕ|Â;ßQȻͶ-ÚCL¯F\_Ç‚z7ö““üÖ{°ù XHV±0½ ö#aªïµÐb€«YΣ~!žÚ1FÇ—ÚãÙâ'¦è~ß.£Ê"Õnü@ ,ç`>4NlÕ«öXYy·#¨áÀ‚r¹±}TbÉ*V1ñW±° + óûüH½2Þ>›wøTmaçdÊ ~j?·Æ ¬¦K­ì’ZóÅ?›ƒþê^[‹_Ì÷”3^5vűE{ß›lÛ?}–Œ'vølENÏ>Ä‚ŽÊ«Çkt6«±ð¿Š…V|ªéç°~-‰+,ÌÙW°ð¢|¬Ì©O£äªÙ=ó˜Öî\Ü” ê +0ÔÇèê‹Û4ɬ¼]õ¼š^D’oÕ6ïèZçñSXè?,x¼¡wÅÂòW±°äˆoyÖ8ÕOF½éíÒ{AÃ:úSù Ÿ$]`reê ++mh½ƒÑêè‹ñÆŠÛXã%—ŸÛ t๓ µ¥Sqs…æc,¬Ž#ƒ… +]IÉ;±?ÄŸ¼=u´hKî„"÷íXàkvAº“q§¬d} 0*¯¾Qáß´ ¡ÜML4îµ+ôT”Mdí ‚¸©À‚;Þ¦ƒÁÂJó+HËíÏ6ÛÚzŽOúà|ÈÖ*aî4ªá“Xcµjû掑Ÿl^• ÅraST®ÁޒȨ¿EIßübḲTM| +wŸÿvCGªû69©Áºr¼poá*´*ócÒ‘¬cEvUÒáNš˜N˜;a¾ObÁã·v÷`Úï7c+÷¢ÕX(Ö²+«ê-[ ¤AÓnN)ÅÔ×·pd¿‘¾K“º‚…úÑTMƒ…eñ½å­XèÇ2Š×€äže|frj,´_Ç‚Cùòw÷‹yçΚKÚœ9wb¶+­[¹ñÙ¬hÌÏ[Ãéx¤[“˜‚¶´Eüíö?.° rFƒ…íß‹m<ßßÛ×…óÆ~g¶~ NR]¢zB.|¼÷¡Ø¹—×ÖÔõµ2šÕÕ4›#îyѲƉµ»éÈûX(î×È4Xx+]ÖͳÝóÈ£‹ì7U›ûŸ*×ùéÚùI,¬%"ù=,¸ŸÂ¼6{Õ’Ò+¦ÔS4~äE;^u—×p¹ïüøšÁÂ7`A'ÞSEt®ãþ'}{®¹¢{} ºŽö½ãu”¿ý(n8|ÝON´ëSMÆBö›‡ƒ7ïç;÷:Ÿ% ÷ä–•²ù¨XÕ8‘uÅâRªÔñž—XhÆ›íTx'Øž,|ÖBÛ7« 7«Þ|±ÆßïŠIÏÊ ­Ö¸o†¢¦‡‚<$¶\ë}¡(]ÀÒ¾©R­Xh)4ã + U™ðù +ו^ƒ'•KJŒ\øF,l nô°ìëúJ—ÀÆïT Hçs»ñ+XXóo—º,ÑCçÔÁ8bÊŽÌx#„W?ÜQ.X7HsV{ª/–çVí…µæso°ðXH畯³ÛP8Ÿ/-Mê«ò½Ð.û±_žÁÂÚ=«¾á×Âç¡VžökÏûµiÓ=¹e\Õ|eJ_>Wt–æÐ\nKèRã…PqÎ\ ß‚…µ$Ö×­²Ä|ÒºhâújðÚW°p¬ +äZö>¬›Mq½F5?TàÃzªl}tf²imU3êó\äSPÕaWI³_!ªUájøå„ìXß`á›°°YƒX«1š +†]À‹iK8«¡uêò«c»iÛªm;Ú’Î.ÿbóú#ç¹sìôm›¦Õ„ÍÉ×»<˜üqm{<»`¿vÞAÕ§©Ïê¾Úë‘G¹ÊúK—Ķy×ôÝžX pµc_]šh è™f·b/éJt ªÐÊÙ³'1ž¨·ècû*óÔ»‚Ek£Ž]Œ&{ °Bº'e‘Ô¥ÝãLÕþ¸Îö…ù¼*Q©S\*›ê–Õ£eÆNkãu8tª­öZ x¿ ¬;)µ•ša뫇U¨A¤÷ѼªŸ ÿcXÈËiéîfWL¡W¶oÄBíj5Rpr½‹<¶®®½Ü¶Ü“”å}øþµT±/ÅlOñ¾RØYU#w~´šÍ}yú5.iu¨M›„ƒÕóÚ‹À³ªÛÔn×½]ß„»²±{m|ѸÅÏO΢cÍùúx l=Ÿ- žœË¿“â!òX@Á|­éÍMr³AY4Ö7Š»\Û­øZþ‹Ü)/Ÿ©ö@¿¶ÕO|N­ÁFÈ˽Œx9|Ñørh U¯t•ÆªÞ‚êMV»ºÿu‰Óá~+ s×wçÀú]¯»õå¼6Þ'”ýurëS­û‘ WB1Òx}!.ÙDº˜ŽƒŠNÆoCÄ-càeö?o¬Z7ø9y ØšÓÝ[_ô^ùíra +„ç•°Ëx9È@Hoeé…2€ÙhD9À§"ÒO i#Cœ‡²L߃˜“tjì(¶, íg ‚~¬ÃTpNÇꜨéoÖ´¨Z¢¯”2àYÕë‘a Nú¹Ë¤Þzºï¿cj€íTíž®o°†~kt>ì4|^žC/"Žá5\¯ ÃÚ¦¡êgC¡r•úÜ«UÄéåMéoÅ‚']X‹ŽXM–fÂ-Ô„ßO±,ÌpÔ‘,‰1ËÃò.,¬³Ê€>綢SsɸKö顽à¶üñ›~æØk/‘ÿ¶ª/a!ôÆÂH«~"I?òý¥A¤,ímgKöˆ þÝX0dè{±àó“í¬ä®÷¹ò|ÈKŒŸœû‘Š2_x. †~UùhØ°àÒ_žzž×œˆÎ±°t"k„m°`è—a¡‘þ©\@,truZ[£º˜•ì°È(÷ƒC¿ ¬¤z/Á "…€ \zÒ™0G,LÒósƒC¿ °òvs'X`¾˜mÇà +aƒ˜LJ_@oêõ^[ ed°`è×aa±})ýP¨x$WÕÓnC¬2ïòEUSõÁ:è}°²CÑÒ©Ïõo3X0ô3±°Ž±‚/¬`ô/Qå¬ImdÓwY_-í`ÙO–”4X0ôC±ði¢m7ƒC ƒ/»Å`ÁÁÂÒ•OBÁ`ÁÐoÑ‘žîÐc°`è·Ø  †   ýf,pf°`È`µÿü`°`È`aÁH»Ü`ÁÁP¬±UÌ`ÁÐ_ÆB.¤ÙÒ‡B–f°`èïbaöe™sæË0‡™Á‚¡?®#嘧ƺo2  ýX,°’= ,úÛX(T´÷}f°`èOc!UÕŽxésƒC ºÄK+ÃÅ`ÁПÅB‚IjâÎáÙăCÿg,ØR ¼(E‡Ò¯  ý],ðK¦FAYúC»,ü_(³¦¥lmàõŽÃn÷Ë’:‘žFf;ÅÂœ•¶Úô¯«ÛFÕ’F·ÚUsÖÍ{EwJ©´ö‹íÖ+Ìãæ jЮúmõd ^@ƒHO +5¡¬”¢]2áam+©=ã–î©„Ô´úË3ïeKÞAÎ`o^/‘u)Îô­Þõ4Ö›×ÅKßUâ]¹^.ÚK,|;,ß-µ#{¡AT”øÎ¥}RáXÃuªEU¯.… ¼ám éÁùå*<¸JŠ`J#êatY)„—K-m)=¸ð¦¢ù¤cIß(}”˜ÀBØðÃT9˜@‚ÅÀ ~ƒåLR?”êD\þQ.X Nt#ëXÙΞ¢U!ˆáŒŠ:ÐØÀGä`CF´Ó:#o9k¿CVbTNv·‡›i)àaü%ÊÜŸšÚ #˜"àxÝí…ÊXŽEJ‰-‘=eUYÁ •lk—¿²±â;dW£4¦1ù²-²üX`tpãÝ› Ó¬$æ +áýx>©q¬ðWQ ‘Âk’Ç\m9žY”}ˆÄ«¦¹ÚgÌ`áûÍ…P½Èö€ÌËN.Ì‹è *ëÄdoŠ<9x\ô`¨ž,Ù¾Š‰Ýöñ™¬¶I~øÈÂA¥,tĦކ…‘¾é{©… m/„’·„¸îA+v Þ'õ­&`j^–œ´z@ꀰbA©€ñPrÂÐÞŒÒcØBîˆ ¶ž­ÕúöpI`}¡ì‹zM1_¦Lè°;G6§X°Hbˆò†;`q<,Ñ&„åû´-I3sƒ…·+õ"û +Ø£>ÛÉ…šZêùá‚XhA˜ˆØÞÔN–|ºS˜Ú>(í0Ï'vk2€úê!¿Ây`§¯Õ+3b!<Ö]‡0(•\@È f«DV†p²C\v‹’hÓ°ñ—Q¨\ùTà+maW;¹pP†ïÈA +¼˜-Qä øÀ_¦Ü @]*t­à0iÛyP'dÃÖpì‰Ð¿Ã‚+kžÇPÊëÝëC|7‘,ã¦éÄzòŽúð¤s[¹ð X hÀœÓ^.¸T1½Œ–«ö‚ö#…²‘);ú¸eU¦†|¯z ¾¸:®ðÁhÉÅ&DÆÐS@›“KëûÙ&âýçXHPè KÌ—AžôLÙ ºÉ`†ƒÊd… d8êÔãƒhjà V”ýU=„-ƒ…·ÓHúbV½ì 1uN"¹ ”ž ÿ´ëÄÓ&‚¥¶§RÉ€¼œðÉ-…­½9H0±–3H¥cˆ. Yr<…±ùTé%#HƒI”±Š ȸMG>ÕNŒ©ÇÓ*âE©xˆà|ÙÉ… ð$j«DYÖ Â‡»‹£{(ûäG*-K´)I'w~¤ +G,»hÛv‚wX…Çl~t…ñ(€Ë7¹àùË%8g6ºª"ÄóV9˜¢…"„9<Ÿ¬Jij>P‰¾ç¾àh;·Sã°ŒŽô-¤:êQ—í„Ô P`e婾šPMA,¬Ž$1mkZÏ•JV9ˆ ÿHÚwiÓ­va‡_E5¬Ó^‰<€;l8Å£½6KÕ×bxœŸª.N¥}(S!¢ ‡PK¦ S”9xqG$öªœ´sGÙÎÈQ)e—„†»kpîÀÕ÷¾S"B4JP$$%Þu:jó¹Œa˜C²² æR8b€Î¬þ,É jD~á—%\ÀÏ´/«ž C1(Ý-Æ’9B•l†CX8Ðu ÝêJ3XøJ‰“±›’n¥„“xSÅ·?Õ/¹Ìñ?«©—5`hóUó*ÒZo¢†¤–n~òÖq2¸&G=†¥’¦QƒWcpSÇN‘|Âéx–rìãÔrÕlj5*tV Ö‘èës5¨‚NU#d¶Í蹊LŸK·Z2Ûñ×Ýb«NQøcôè«›ÁãE©º$¯0R—^WOŒ5êF™v©&X( o,´ÞF¦÷A’Z=ù‘tÙÕÖòJ˜ts@¤LH„ו,|u7Ü~ϲA¹A Õ*>aÁú‡ŽXx‘ÍU¦Ëu{nh^ j%&×Y¹Ø®¶DPÕªÊÁ7©=|] ßµÛöL†¶”Z ÊÆBùS°ð¢ÂEó‘ ¯`A×ÁPþ9ôW•ð¢P.$«,8€E¯>;s6ÐÅ”ŽDÒ&(¹ÁÂwQ_>ÑW˜å X;ñŒÄ™‡ qhÿK, ñk®åË,€Ö£ZÖú°Ä÷Äú-É…ªTÌÎ̸©‰ؤ°àíŒ× Ò ßÆOÕïaýõñÝpÜw>b! Ê.Épw,}+îÐGçÉÐZ°†Ü£0Ŧôç$„O d/ÀA‡­†Az±Á‚¡ÿmñHû‘=¹¿&횢úª‘@¥¨E›ôI:Ø赚‘ííEÅ#MbÀ†é ‰î Ë,ú‘X`é^\²fMåÎì¨W¯&%7’£ÿ¦ŸÐ¹–‘‹ Ýbh/غNÕ¤ †þ—XxMâSöŒÁ‚¡_‹…V,2X ›Û³?‡…$K ú!”Eÿ2ÇÓ¡Eeñ°Ðù† ý( +ÿÙ~ 7*ª¡ÿõiz3ŒkèRZܯϙy'†þ¨\ˆOJÏz¾‘ †þq¾°4[?Û—:ŸÃS¡Á:Ñ(2óÒ ýJêLŸÃ:µoûòPöR„v'd/ [ wËâ:iì,)zóÖ ýFòdéž îÒ÷çVFX.Ç÷¼RÆKW +ÏÂr™CNå›QakÞš¡ß‰ŒÙ¨ÖF˜ö", fDå5°V@/ªÞYr8&2¯ÌЯÅ•¬¤zh¨)õ((—Ÿ²9 X.&˨œÌ +óÊ ýZ,¨\¶@×CC¹bz‚ªµ€¥-‰ÅTÖÜJãb5ô[)¤âaX0§’ ¢Þ°@¥1Ãa¼¼¹P«¡ß+P¸”³™¬ö‚œ÷XˆTW°>f †~5¼EU#ÜË… ¨MØÍdáØ"l(Í3ô{± †˜š® Ê^(ÜÕve€egEgùhZ{ÁÐoÆÂè!•Sp-«€u˜ÆŸå€¢,,Nƒ…•\£#ú½X0 —† ,2d°`ÈÐý³endstream endobj -5518 0 obj << -/Type /Page -/Contents 5519 0 R -/Resources 5517 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5487 0 R -/Annots [ 5521 0 R 5522 0 R 5524 0 R 5525 0 R 5526 0 R 5529 0 R 5530 0 R ] ->> endobj -5521 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [412.789 653.385 454.872 665.378] -/Subtype/Link/A<> ->> endobj -5522 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [155.951 639.836 369.851 651.829] -/Subtype/Link/A<> ->> endobj -5524 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [421.617 405.262 475.382 416.951] -/Subtype/Link/A<> ->> endobj -5525 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [179.03 364.614 225.113 376.304] -/Subtype/Link/A<> ->> endobj -5526 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [375.968 364.614 430.714 376.304] -/Subtype/Link/A<> ->> endobj -5529 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [191.321 143.854 256.005 155.543] -/Subtype/Link/A<> ->> endobj -5530 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [181.685 130.305 300.65 141.994] -/Subtype/Link/A<> ->> endobj -5520 0 obj << -/D [5518 0 R /XYZ 85.039 781.388 null] ->> endobj -1738 0 obj << -/D [5518 0 R /XYZ 85.039 519.568 null] ->> endobj -5523 0 obj << -/D [5518 0 R /XYZ 85.039 500.899 null] ->> endobj -1742 0 obj << -/D [5518 0 R /XYZ 85.039 323.247 null] +5601 0 obj << +/Length 107 +/Filter /FlateDecode +>> +stream +xÚ`Ÿÿ£££ÊÊÊùùù•••fff:::GGGýýýVVV»»»¬¬¬³³³ìììõõõ}}}ððð&&&éé阘˜ÑÑÑää䃃ƒÙÙÙ‹‹‹rrr’’’ÞÞÞ™™™ÿÿÿ¹¡<Žendstream +endobj +5597 0 obj << +/D [5595 0 R /XYZ 85.039 781.388 null] >> endobj -5527 0 obj << -/D [5518 0 R /XYZ 85.039 302.652 null] +5598 0 obj << +/D [5595 0 R /XYZ 85.039 758.673 null] >> endobj -1746 0 obj << -/D [5518 0 R /XYZ 85.039 178.994 null] +5599 0 obj << +/D [5595 0 R /XYZ 85.039 758.673 null] >> endobj -5528 0 obj << -/D [5518 0 R /XYZ 85.039 158.399 null] +5600 0 obj << +/D [5595 0 R /XYZ 230.943 420.51 null] >> endobj -5517 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> -/XObject << /Im1 3957 0 R >> -/ProcSet [ /PDF /Text ] +5594 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R >> +/XObject << /Im19 5580 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5533 0 obj << -/Length 4219 -/Filter /FlateDecode ->> -stream -xÚ¥ksÛ6ò»…G_JÝX,Á7{nÒ¦MÒ&©›8Óδý@‹´Å %:$•Ôwþö|ÈêÌM&¸X‹Ýž€¨Kþ¨Ë4r½ »LRåiz¹Ý_x—÷ÐóâB ÆFP6η7_ÿ‡—Ês3/»¼¹æ‰Ü0 -.oŠßï^>»¾ùþÝz£2w½I’ÔùîÃõZ9ïzýîÕÛ›Wo_àW@å|¸ÆîŸß­ÓÀ¹a¤Wo‡îgo¾}Æ_ë­ÿ¼ùñâûC©¡¨ÊÌO¿ÿé]°¥/<7ÈÒË/Ðö\Ýû  ÓÂ@¾ë‹÷¿˜©¸/¼äQK\‰‚ÔÒ`ÎYlQÊwå_&‘çF^H|Ù6m {H´öërÖ?qšCyXû©ÓcŸç4wüÛ7Л:l>_Ú#4¾êxüÈ¥†GÓLy_A÷VfGHS .±¹í«æ°09 ®eÂüPp-×ç ³(ŠW2¬ßXhßÓœ9“Œ«%Ê´QÈ¿Œö[õ,Ç]Þqƒ0øÿ) #1(ÙW |ç·7¯¹£-™K -Z­Â«òniO€E{Âiv%ÏcöpBM@%£øŒÊ8$[ß[’­—º*T´WÀ‡Ã ȼ0! - ÿÝÉÛ¯ 9'𣜾eFÞ— {›ïËS${±ë©ìi’œÓê§ ˆ'&’W¿î›ë (½q…ÎÝÚ‡ƒÕ{@–² ÿµºèß#ö7GFÈI>aë©:¿Êd0 w£*ào[æu­WüÈ‹6x*©ó¶! -ÆìZøáž?}Ïó®ô , ˜?Ëœ/Hi§œ;¤½Å¶çÔš®®cÀ²uìX#'^6zæ¨9³¨»ÂŽ”S0Ò¾¡ý÷<žÚ,m–{¡ä¨A¨ùˆøúúù•n½Ãía³ZK>$ÌÅùn¯ŸÃl¿°Æó -áEFÎw8Þ6½Dn°z`ûC+ÈQüRÁÞ©•óÌwša_|/ô´Õf'ˆœž»¶bªÛnÅüáEÞ½HZ MtGÛ´*¿pƒ”R¤¯Äöþ#Ú~+£Ê?ÛÁ„z °·Ç²e˜ØeY€4ˆÈ¨ vnvbc¿¨pùÃW2ewDmÁé{kZ4†X~®¶Dõ¦Œ<â -…cª]„6‡Nh ž‹:¯; *„ƒÖ€/h¼ãcŠ†E%b"B:ø¸.ù¢ÊXpß-)rƢʵbaƒlî7­t 6à 6Š-«„©›E1ì‹Üÿ:B§f?"÷ Ü!{TÁÁ§±#‹½ÑƒÇŠP£¢õ–†#ŒŒ -®ãï~‡üjŽ÷;þîúœŽTÞFФ>ÐGþ?ôÉr‚RÕõ¦(Qò›3€·BC–‡>D™k>7+ Œ¼kò ]ÿ~ÛVDÔ’ùÑŽÏþscž·Fc$zÀ€t±4g—,\è Iõ±»bsÂ&[fœÆ< '¼?L[}Dñ£Ì &z*Ä#’þÂëÇ8·´} -4´è,õ¢]›@ WðA~à‹Gþ 'Sp¤ÁÕ®êP@ƒ³çÚ&Ñpþ‘`È6,Œ\^0„—xÞ‡` Çb°„¿ä·|¶dò[6nG6nÖz#‡[ÝØ{yî9¸ÍÒ‰õ%Réôef‰„j€kŸqÍU£4„±*h:íUDÓd’GÆiÉ]0ô‹^¿C$ÎKä)¢UE™%â0t_Ê6ï—¢WÊGžãYŠ’F£õ^QLËñ,´N&â% g{l)„2.,ŠÅÒCUôØ%ÆÂq/ më—œBDžG4n“EV7{YªB8ÕÃUÁi …=t>ÚyTGÖ[9ÿ<%¹sœ…tZréŒäž\P$7[oIröz$9Söy!Ë NQýÔDhÀ ŽÜ'GŽþO -E5“È—V - |0;†“å1CLDæ‰Ã,ÁAoÎ~¡$g‘)̱kîz+ïó“˜ ½Ÿ$Ϊ'gXTñæõŠ1NGyÔMæFR/°‹1Õ!ÔW”7ÔŽ×Ó6ÛÍ¡ÖƒZâ7†§/ -]ßWgo@zBñéœâ=µ V¼éz‹Šg­Gv‚îû|(Â0„lFñ>»f„®“ÉØÍ…¼÷Ü‚ü…c‹Ž‡ ¶ à–‘DL¬YCØQ¢»É<2:^ñxÛÕ‹Á¶ÍABÍûc›oBDQLÊê¬ð.˜¨5Æx¬*–þ R¯“R÷–E…íû鬡•Ì3œ]³·êiÁtšØ±íN•¥BßýxºÆcáœ.K…J¹i”LËR¡”¥¶Ç‡ŽëQk -Ì°ôô@Uªâ9ç=•Ïª-õÅN-çÇtNJ+yN)H”§Ù˜‚‰4Ιu'3ẨNXl>š:@ÃGâ²Ì ’ÄöëL;€¨ŽvŸ- Bl§erJîqRBB9,Œ™Ç¿ÐûÚˆ®§<€“>µ0Ä c{}›/AD”à¹â "°ßDz3·w`Ga_SÁ³HêgK)­²÷Tl‘»DØÙ¾@pí{§HRr„ër$EX1ÆÌáèPÝJÝ–nÄùTšÛ¾é©]L‘´/¦èÒÎDapLOÕ·Ám„RM#§&g†­î¸g …J(T²H#¹VíùƒX[æíÕTÊ~š¸¨ÿ¡?ä¿'õM7ö\Þ“‘ô›Šjd@ÜOùÞ¾íÙõŒ­Dà†^8¦h¢wçiB‚8uãL(éú¼e#Ž’²14DžØ*¸Hñè¦rT°ñ£ïq]¾ W•ß朣ÊCÙdà¨ÈïyúDWo°ïPRµ°GF*/ÔpQÆΠ`È-C§,ôC7R äœ ä…½ÀÊñŒ¸Ó7\.§¸jÈìÐÿc]jJd2QŒIš -UpÎP’E®F#R(~=™Ù W†[,m3ïìÛ{É_X¬`¯² W¸õÛÎ\¬‚}+©Sÿ]I.t×CÀ#ô…¶Y[ÈKOÕÍxznäÃÎUä*ÿ\†«±7ú7's’y†æ úi~837SÙ˜†Ùádœ3+Of•7úØ̳{/„Œøon]Ÿ^2#.ÿýéº~â&êÉí -Ê™ÕßU^2Z`Î%9lðÅ—„šCø,VعcÃ¥$“+@{üöhI6ýc¶<<ÁˆÂÈyIãR©m“›…|,ç±ü.D?–Ê÷ÍÑ<ùˆ¹,Œðƒý^¾éÝÑ}••ÿ“Ž“á Ïxä"ÈÔz mÅ$øZ‡FL+ôfÓ§ze¨¯ÔKJ•áKC…ÂvFšÀ,•pë ãw}®æÖÂubà¹þbA þ2_ÿ¯ÿú1\Inœ(ªE>¤îJÓ‚›òÃÙ¾þ/"3‚ÿ‡Ó¨endstream +5604 0 obj << +/Length 2486 +/Filter /FlateDecode +>> +stream +xÚ­Y[oã¶~ϯ0‚ÇV´xÑ-OÝnwÛ8»9‰ƒóШl+±º’åJrÒüû3R[Éyè"€E‡äÌð› 9óáOÎâ@ø:™E±:Žg›òŸ=ÂÈOÒrx–Åðü°ºX~ +™ôEâ'³ÕC¿N L g«í¯ó?¿¿Y}¼]xZë¹LÄ‹¢xþáþf!çwL½¹½þ¼ºþüö åüþ‡¿Ü.b=_1Óõç~øý¿xÏ=-üÅï«_.>®:I;@ªÅüëâ×ßýÙTúåÂ:‰gÏÐö…„áòäѶ_\Ü]ü§[ŠÇÌŒgMYÅqxÊ‘RçÛEId·Ó'Ûé³íü™'Af=µ“ +…–10$F˜P YNYÑö 3²Ìþš‰À'ºû’„Q”ÀF‘"ŠcèÄ¡^^—ÊŸýXd³^8OÊPÄAh„‚†C@Î`øhß:ã‹Düæ~ +?òô¤dŠŽ*ðAšpJ¥3{»)^?‡ePž¬‹2|Êu˜‰ „ Š²ü$ƒÁ¬P _¡EÿêTV‚YUt¨qaÒNÙc‹!y¬™Ú_¡ójÆè}^g›¶ª_±™¿C²blà$%äµ»°o"¡¦(×IÚyÉ´q`˸¸9aÀi{Å'4¾BîjQ † —×ðuäçT‚%$zCU«†¼ÑpÑCÿ0 x5…ˆ‚Žo½ÄêfiÍ¢Àœí·äÀ%vÖ°QQ ·ÓÀJåN2 \‚àÔ…G|Øh ˆ·Tkוo^¸Gå*|Ÿë›ƒ£‹ 4§0ÏgD„õðìHHZ8¤€óïvÎÄö &Rm ߎD–ÚtG’ZðÀc÷÷cqpàÈ„}æöºÊ×+ÙmB˜7i›WV'Ùßm‡¿Æ9Î0¾O¶¡/ú6ÆwÜÆ0¤Àì—†—*!†& Œ±Ïx°]ãßTÇUH8]ëë¼YÚrË›x(¬²®íXºM!”iŸËæÀkmœ.iq9¡öIª[àÝwN8 +†’Ð^Áð€©G6@®a +æŸÕÚNOí7ã IÎgŒiTkrÕÇÀ+_øÛêjyÉ£§Q‚†qíz88sE2ØÌÖvR–<‚yˆx“ó?M˜`(J¤¾|Âç’oç[¼e=vð Ét`^—Œ‡ é° +Rå;mç%s‘ßá^ËþN¹$<‹â’ÇPÄë=·xSzg Â5¯cÃb܇ÅÀ2qP`’½ç|;ó¶ÙCz$ëÃ$?<½Á`Žþ¶œ§´„é=;p4{§Ô¦íœÕ·Ñ8R^à²×Ý©N¹üÒ-:aè+¼ÁcÂËè=VIk»ïŸhñÆ +ÉÙœå O.ɤ%K\Š©ZlP_S‰ðÈYw Àcç9§S­Ží ƒŽv^È’<žò´óòÇf¸Êæ°QP´{¥ƒIçC‘ŠY®ÁœL;~˜P¥#›N+ª °Ç¥­øš4‹7 +/-£þi†Ëý¬¤ µ°oqÿLB¨=°d@+²ÑKYÃ+¶ni6/·;qËÑm‡FùÃÖ® +Î]@(Ó¼àÖ<¼‹EëpÃïîï>ùÖ.J}íÎ DÞåå„-ÜÓ^ZPýMeÉKô ,$Ns€Ñ¤Æ‡;“'àJà¾Ã§ºHøöMö3V8*™‹‚Õ9PCƒKsvcL‚ƒ{]2å[Í`Zê^“’k«$ž*ý(!‘{þŽŠ2$ £.RYú±I×…•–êÞÌf/rt:ƒ×ÖxH£»Ì–#‚Q>W|¤;V47µÖ`Óz‘oæ_ö–¿ÍìS.õÜ+¶ÉÎÔà`@ÜÉ‹ÍXØÉ£×B$LƯǤ+­±I 2ë)ߎÉH, ø H8Î!ç7|ŽbWžøÚi½¯š¨=;ah¾#ºG­"ïñPÆÜ7]‡Bttá Wnr%hxü,JmºÖÂCÞ19où[ä Å5?™•=cʬÈ2T[£ë¡R€£E¨ùè»…¨±¨¸í=½òŸ&¨•U2ý:n ô^ǵˆu2ý(%”t² ÊèSy‹n–gÿ×òŽ€endstream endobj -5532 0 obj << +5603 0 obj << /Type /Page -/Contents 5533 0 R -/Resources 5531 0 R +/Contents 5604 0 R +/Resources 5602 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5548 0 R -/Annots [ 5537 0 R 5538 0 R 5539 0 R 5540 0 R 5541 0 R 5542 0 R 5543 0 R 5544 0 R 5545 0 R 5546 0 R 5547 0 R ] ->> endobj -5537 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [417.299 388.145 472.685 399.835] -/Subtype/Link/A<> ->> endobj -5538 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [365.076 279.146 434.644 292.047] -/Subtype/Link/A<> ->> endobj -5539 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 265.596 179.218 278.498] -/Subtype/Link/A<> ->> endobj -5540 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [286.484 239.104 364.4 250.793] -/Subtype/Link/A<> ->> endobj -5541 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [323.843 225.555 392.533 237.244] -/Subtype/Link/A<> ->> endobj -5542 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [339.529 211.4 370.915 224.301] -/Subtype/Link/A<> +/Parent 5592 0 R >> endobj -5543 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [403.684 211.4 428.706 224.301] -/Subtype/Link/A<> ->> endobj -5544 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [407.442 184.301 432.313 197.203] -/Subtype/Link/A<> ->> endobj -5545 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 170.752 151.596 183.654] -/Subtype/Link/A<> ->> endobj -5546 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [176.334 170.752 212.114 183.654] -/Subtype/Link/A<> ->> endobj -5547 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [115.558 157.203 176.975 170.104] -/Subtype/Link/A<> ->> endobj -5534 0 obj << -/D [5532 0 R /XYZ 85.039 781.388 null] ->> endobj -1750 0 obj << -/D [5532 0 R /XYZ 85.039 719.568 null] +5581 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 369 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5609 0 R] +/Length 24902 +/Filter /FlateDecode +>> +stream +xÚì]‡b«: e˜a¦3Ãÿÿå•l d6IÉêÅ}ﶥ Öñ‘dI†©…ÂbûûÿýŸÎP2¹µ­ýÇï±PJjv[ÛÚÚ8_òB2x[ÛÚÙŒ˜`!7v[ÛÚÙÈnÃÂÖ¶¦°ÐoXØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ>üO{ßßÆsk¯åß'ÄóbýÏôÇví*Ç'øÛòIìÅ1ü£zä߇ ÿáoí¿æ?Ž{+¨:[[VOâs"Ó[ØúË:=A9h=~õ»Ø#äò#x¾e9™êÝU{t©Yg›º3Ü8&/¡´M¿¼¾lI’ äá·Î®N•DI×vmköFÙ·l<¡Kœé³ÄQ9úR­mÛȺ$”žŸ:4ö¨ÜÝŒ†Ø´»3÷m§—Ö Ð@6,|/øį’ÜîÌeëìúh0ã,Wl­ £L¬T†{,4æùÖ¨§iœ“o²+Ó¼=ú€ç%¹Q‚cÛ6Í+7ÎSÛ‰Ÿ+ª~æý††¯âB,;mÏÈŒ–$>”°ò',ù RóJë’´ìÉ 8ƒäì§Ú4ëã_caÂzä“g"¡¯ÒÆÚ°ðM¼@‚ö¢ÜØvDÎc\â… ÎX€–Ø!9‚By¥G%Y Ã6xK§K7,|/ÄVn¨`:/&âÜñîáß:á…0ýQ(sç@&Éx—éÏÝö–8ñ:X€ÇHú'6<Æ…¯â0mÛY2l´‹¡uvbÏàXÊé ¼^Ò‘Ðþ]4{!¬]²d†8œþAcþo÷=j‡ÜŽ…£»êÖîYÆz +à5àí7,|/Äa2Nº]šGè %„ô½åtéÝ ò”ņÑa°aá‹x¬æn²“+?Þ/F/J“iNxÁƒ*—1ÙYU2)CI8ß„´Éd'ô`;õ¨‹oÆB‡à>l±·«òéƹó bÂÐë(tpÔåø±iúº†çË· \ü0(Êßåê3QL¢4QQyZ’M¢ŸÊ ÞszÅ«èe4·³ ŸhúñH—±pð÷É^Èͳ3?©º2rœ ßý ½^Z±—:’÷í´®²Q4­øÐû$GÁŒyÚíÆçó£?2`± ~lµ©}xñöÀ›­µÀÌŽŠ/Ý#ÓŸÜoÇ~ãö)&QöI–Ÿ¬¼c,´å2{£í7‰~&/L‹ vrÇœó?Ò®=ôóϱ|mÚYýÃ^”Ÿ°@¦E¾ÅTG£¨‚šž€Y}·Dœ)ÔýTÙÓ絛žcxãgÕŸljÁŸL#³SÁXpù)ðj2aa©IÞÚóxaôߘÞ#XXk}a‚äÞ±KÌdÖZ»²ÈCpø q?º‹Û,^@a\oË(t EU6Éä¼ 1­@Ú ºœÀ‰"süœ­–ÊIX–Õh¥ð#|i¸Úºq•ÍãDe¢?ÙíÒ')Õ‰|išØYZmæÂsyaœÞÒð)¼p«½`˜ÇôÉÞøìl†Òé½{«`\Á‚Šó ¦{,ìÚi%:)‰7…ñ‘`TÛÛvìÀì÷ +°dˆ>i:¤]R$Ž½i}¡÷p…@Ca"<°–Çë{}9…¹LÉdÒ+nHª02|¶LÑçòB<CUyá®x$2…-}¨di6ªÉ1o#ËÚy÷ðçí“Þ²æé¾ÍgT“qM;9ÐHbkÔ¥:‹,“/æjß«’åÚùÙug¿30’EMß3GM—Ûc¡K*txÄܼHOæ…ÉsW˜ÀÊqª^ÍaØ䀲ì#ë2Áò̧wbÁÌíöàËÆ\¥ÙYd'Á"w\o8tøÇÑØýÈ#´íäÀJ´Í0ž‰G"ÙWxðIm£tÉ8»ì±;:HÌ7'Ò“yatw´w•jø]þB¼l0=‡öìË?Ì/‹­3®M°TóÌ"7’Ä…69I§ëÉ¥‹Ûúzúx‘o"‚ ¹öćN© â4‰/ñ‚ß·ÝA âÌ ÙÁzÊŒ…¤ÝØàU¼0baŸ8ðl?R«Âæ¯ M½sžu¿kûŒÛ2/Ã~­Ü €…Ü“ ÅìO»=6LÆ+%X8ä<ŠÙ±fè_âß²ÏGŽªY7*k3ž?»ñÂy,ØÉýIŽ¿Éw£æÖ-…rw¬@Å}˜¤g¼ýmÞÞ†Ÿ±€õe–WžÊ€{Êc·š§“&’ÉÌÃÜ}Ëêɾß)/ŒæÙreoú¤6HFgѼžx›¿Œ~‡…5ë`œÍÀ÷cßé€:NVxíÄŠ…ÎNóð8“Ä9)éž® ãrµ™Dþ2Ìô°Jë)/Lìr:Û1†NXÈÍ ¯·vO±n¯ælpV¸}[¡²tKúÙyH~ƒ…¹Zås÷º_'GÏÛÚ+çÖ µžðÂl59VpôeEºÈf§œ3‚Í\xùúBúœõ…3öÂaSÑ`TþuÏKË1A&Ûno_h…%:>¤Ÿg_Æš¤ÎÉòÑIL—nêÇž*Ñ­Œ‡4Ÿ1˜LbgöA ̼ ­>>Äó /LžÙd†æ¾5ùbcÄB—lq¯ã…yÝÙyQ<Ò‘Î’ee…‰27ø~ØaÈB²÷;áÇâ$=©6& ,j¨D1µ¹Ä.Œ°åùš±Uµm§ +|ªfóJ„ïwöa)J\ü#¯y!Î’K–ˬºY ^hÛm­ùu¼0Å#ýHÿ7Ô¾¼î¼(v4¦9rûR2Êr`§ær™úœQbá@¦ü9 ×Ï¥Wöå9sý€°’NÞ¨zù²Dÿ /ŒÎ¨«ÚâºmÔ×ñ‚oÑ7×Ó%ûÞ‹÷ÃWùrö&,„ç°ð“Ztáê^4­SG`ï‘¢%ù©ÛJ ~²W ‰_ž®~tiÎW<á…Ó@î Ä ½.Ù{}á9.S»²âiû"FHÿ„nÑÅü·Ì¹¼ï7Q±ÙýX@G×Ä Ç„HvÇ«Ýh1$Žò‚â§Msû¸n·sq}aÂBw²øJ6,¼‹vS^ÛÕà<ÏÎq}8Çt.Žz azd‘ÿ”×vÐÊÄB.ï[àé ¹5/ðBöæº| –G™Æ}»¨v¬’6 +H¡Å89xMêZ‚Ý|èíÝG›žð‚Ö‘Ú4¹Øì~ÛxaN첯xë‰^8ƒ•¦ä~Fƒ¢Ûkwñqš<±í®¹hЙNINlŸØÎvó@Ï›ô¬ì@KŠ'ý«KT_; šqJ??tgX’|Q¶;ïvÊ úe·öO*nXx /ŒrÝ^1ž'[ÙÏ™Y’K‚=­à™ä! d(»¾ê:-Z©ðÿÄY_ýî:|Òõ¢ ¦UB3I«1 B?ÃŒrÆ»EzËÉò}ˆáXøòÔ¤u»®ëɆ…Ïã…½ þb€ïÊõ”ûî“q¶ó®~ÀÞãë.,Ì˳ƒ4'§­eóÉ%™º’׆t§E¶gšL¬øÀ¸?ŒÍ_Ã"ö‚Ä»Ð.æ9ã˜æ<çŒ3rXcÃÂËyafv±@Ҕõ—¨‰ë/Ü“q°¨3s—½°›rÚ~*_ñ£ÿýZŽç¼ÙI·'†)D®56qówÞ“ZˆÞà]p¨0‘xÜÑ>íŸå…éòɹÈ+«G‡Ù°ð>^ØÅ£²Ð\ØõÉßµÇÅ…çºèìG&7úBðïó#MJÙŽwÆR~vöC¸Î5,Ìåp±pýžW%G,øV”ÙIs|{o4cFƒáLœêè:M]Ž# +Jþ†…·ñŒ¿}µ ª×žÃðSR&…aÏBù¸Æ u_µòÄç:ú‘Ê_`aG¢tNñ<ªš|² ?ÕÑÔXð­ã2l“œUî¦Ð‰3qªÙH¨Ç2ŽÁ~Êu–l~¤7ò‚ïO;œ/Š«)|'# Çãxì1Ä3¸öÁ¯÷ñÂŽL ÀöYWÕÌ?…ª^¯ƒ1]fïù™ÔÁKim|ól‰ËQÒî­s¼0ÕûÈeòñÚ]¼aá}¼0ÏyfÒZ'5n½É0—Í ¨‰s¼gƒOF鲎û½X°ò}šÂɾÏq`›·E×^ǾÖÆ´9Ö%,ÌÜ8jmcVô±ó`,ra³ÆˆsQ-|šDŽ‚±§ÏipÃÂ{xa¡8'öQpƨM[¹-Gov´yÕ/Ñ@â>š‚¢—–õXØW²“ÊZFVcìjôåçÙ/k “ÀžwM$‡ªœw8!Load"2b#?àÅi®ýHéñ:æ\Kæ iÊý$›½ðN^Àzˆs’´ôqiIÎy ×Ó’jrèfò&.1í¼´boÜ0¶²<9^~½ß^8¨c§]¸›ªy$0§¨»ýíUs)Ç~òævË;âwsÞ¸¤2ØØÏdòLªÛlpgXðÀÓÚÕä"cjÖœ¼)~56?Ò[yaék7»<7Œê-ÇLçê¹ÇVìžK`TS;‹œÀq* Ôœ?q`×ÞË ó†9zÝ+oKÇ kfíåòç]™¬!9Õ=š|Iñ¨üÙ¹3VòŠã`Q7•¶›ê‚wyfy$ƯØ5›â{+£­ª¬Ur>ïÕÛ6%ÖÆTìò£w¶aá]¼€EÜ÷!5-î¸ÜuvÚì“îíîØ¡CúEN’ãXépQýó@Rïå……Í>…Ç¥ÍÁÚ¤º}çË{TM!­ÖNÈÞ<*£0tB, ™ì3/& ÁŸÂ¾»4)«*Š@ØÇr»½Caoäi>–/Ž'ÓÃÌá“|M„>ÕÍÛ°ðz^Pµˆ–n]Û.ÃÍÒ“ +ʼ½’Wog‡Ÿ¸›”v”BÕ³ö…WŽ7}þ^5óŠO + §úJs æÅ\`)z§›TÏ^ Õ‰qQa¯^vöÁídQGiûx¹;O.fÉ—çr‘Ip1±¾ËÛ£uÛ°°ó£tÿe®sÜ’ÿ3æäÓqo¸¹ÈãqAx_w¥™“¬£ü\¶O—d±âŠ]*@>)óî‡: ÞÈ ˆ›Ð>³¹˜™s>“ôU’œE»dw wvˆ­ÊN»³»‚TÁ=µÂºîr¬©& EÛÄ*“s¯ Öów2û®bÇ<}ú¼ —t5%^.’û±Óžà]ËÝÞt¾³¹Û°ðz^À!ÚUùQj#¦å_.Pჹˆ¶ÅÁ'ì4-ýð°Q¥Áò{°€Ù2']ÂãLëÆ’ª^’â]Ǭ€ çع.[–Ž¾$/J—7¼‚ & ïè' ûœŒ¸<ÈäéÀÒ2vŒ|ûyA£™p£·nY§IÝcUç2±7^x/(Ñó£1å†AWò wפŽ\€ÀÚEúK•Úyç6¶ÎÛº³&" !j»éÐ%¸AfÅ·J©t)áìŠL«U=kÁÆ™òLÌHï×éz•~ê½Ý.VÂa.(§×…ùmiìOúÒîÐüêZsHßë³ý'ÕK;Ú»0S;–Þ Z—õ–B Ç ¬[*¼“8îǨO\(›…i›ñ¼ Á]Ï@âÝÔ%o@î¹Æ¸‡2¹Ž·øè,_„ ôM+}çžú¢Ÿ>ÀSýs=ºÅSà]üÕWUïƒé§DOK[{/èAÒëlD/¸Ý4wO¸ùw¶û»´Ê-oºßܷ˧^*tðã·öN^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^Ø°°µ6,lmÃÂÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ ÿoó·nß{kã…¿9—‘ïc•™ØðàˆAv;Ï+ÀÕãùIî¼;\œþ%‘óør·/^ÓóŸ+÷$Þxá/6¯lãÞëÆÆUžùÄI¸ï]CÌßuøk;íäëL[Kö«@!Lœ8<¿MXLz$%¹PÉÿâÆÜı­Õj{œyN×ØñÆ ,f” ÆøDHA•iVI7öA*ÍÌŒ,nñz—'™Í…O‚ î™52A£ÃÍJ![ø -Ì1Ð^hei„L˜™ ÂcÃ…ÍF¶^Édî„’êk&œYE#y“å¨Ïy”¥¹žWcÁEkº¼ô,ÁÚ @4nþÃ;CHÄ‚„g„SÍÒå‘ÑÈ´é},à19KÓ>•9<¨m%§Ð?i÷6wM+`¬5á‰ñ­ˆ¼qqùÙ7^øfËäÿm+™y^+â=/H‡Á€÷Ì.GóA5¦eÀ eTÄ(žC’ñÀ0zîl†b(%L­ý¤ˆSZõú=`!,Œ€ P¼Xo‘lê°ÐÉÊ p=¯g.qimÔ£†áÊÀ,TÚÚ+*i)XÒÜX4ð"Œøx¦aÉth¥Y{ž;bÁf+<jŸ‹ì‡7%Oõ¹»ã|7 & u‘[¢ï/ÒÁBx†F†ÃàÐÎë9j¤OeË`'d2€®Ý=ë:Øxá«Í…Rñ‚mÁ$‹´#aâ…>—Ìׂg m(mÆí´ãJF1œ0;Ç;Ö( ‹÷T¦UVf2õö\û]–-ˆ9°ªä”÷êp[FF,€h‹€ŽÞë³9 ˆ4@Žì4–E‘"r=ø=¶X…·J61ÀO¤“F:ù‘ÓP§ßå‚E¨ÿ>bƒJaVV¸ƒW๠;Ü÷AT¦²)2)ì20<´ +˜ìË2+[ÙÅ î Ïe¤@\/ü-,”8¿/$5Ì­Œ…ŽdDJk…¦öbËãDÈŸpAo‰<Ÿ%ˆ*!%Ç/º¯éM@ì$S<¼åȲx" ÷ØX°4áÄhJ¨³©7a0m¯a^ +†¾~h”Ì›&ho'¨¦/X¹êTi{“*«<%JéH¬÷ˆ§vQÉ#Yn˜ÈvùÏíïâûÏ@7ô"$BêxO‹€ë‡5Þ +ÑŒ“/ü5,Œ¼¥æÇ=/ž 1³km/PcYÈ[ñŠhè`R2”0Þ@ÈÌ«Â +fŸ*B„Ú!qElqàÑpÀ‚RÍ8' ,øðÇôÚ†8ÓOX0”€0CcÕ™½;FÎ-¦‰/(Y`!®8 ÜŸAëáRÖÄ éØÓbè3©í4Ð*Øú½MT`£x5‰ÀΧ1ò‚%<<•¢®¬mèI²ñ³ 4òH{ÊP÷¼³A šyÁ‹½i·à…ÈÀõˆœÙž:ûLÀœm×±aáæÓžŽ„ˆCÐãÁ˜`h%p ˆ…1¡E@Ð]cÄ(A ±Ám ©ŽXPöhF¥áƒ±A뙢žBrÂmô/€AQ~‘"|QÃz¼¨Õ-ˆAB{A ;Œ1+i‰01X FŒê”×s£.fn€g¯eZÙqá$`i^€>˜ÞÆ Ë´#y!1@uƒ,y&EÉ|Oó‚(3læè¢ eîôLj/5Ÿö=¢çp˜“´n­FïÀp£pW"dJ@.sô(å>üèSmeU˜²Ùù9h%’’T-dXš=òBÀ™Cà3 ”½!+áš¹;˜ÏÁ.G,P^áÄ õ8êöð ®åg`¡ƒãC¯”í¬{ +à³ IÑ°M‹Ø²K ™Â_î“R¢½/˜"€ãxAZj}Þ=¿ò¼ñÂ7ÐÂAïF,€t3P­ÅÞæ¦+so^†ÖÍö´ú³Cbt4‚"8¨ø(W^©~{Ö‘z +õáærø4#ø#“n cxZç© àÏ`90ã©Âe–aKÙ8¨¯TR_ÝP³1œá¤ZáG¼ýÞ^Ч +z¾,ï\ÔþÝÞˆÔÜeh/0è\ )¼¡;­ /ø>•Lpë]øIrP Á‚(ë\ÂQi¾æB˜8&µñÂ7c!“™ç÷(}‰ZvT4à×¾ÊzŸDBýªYšæŸ„¦iùF‹ÞS0‚› µ+ÜbØsºÄ¬z߷ʲ#J;)wAX`QkG>ªî©c·¸6çÀø&eÛ.quz:ÛßUfde!˜´xÍL‚0 |ü×ÊLe¨O ªäúÖoW)-x¤²™Ú$é%™˜VTî|Ö8m[BOã ƒŽ;Øù~ׄñ +ÝŠ{èFh"ŽiÂ;¨ÚÄÄÍS«²W¬È«ókm/|±’ÔsPvh¨p‡]?ÅÊ3ÿ!Ž½xa/àŸ<}ýè +,`Møãqý“7¹’üà&}À<&OÑüØé;¨ uÙŸI@„,®©ºÓÃßâ9ž\klzÍc<5ÆÍöüxºèt,šXé„cÿðÐ>¸;·WÅ?Æúóó'‰þ ?¥® +æ¿{>,|ã…¯&†NFñ£8ÊA÷÷ è ƒ®~ýñ§æ-R‚Xø}rCa¼ÇÆ Ž ;÷Åe­ +õÞ¥Ý xòÁžÕ¦žfñ{°Úño±€+é.²ñÂwƒÁ·ÿh?…­Þ–/°Ï‹×IzÀ‹¼Ffƒué*/|;ÿè ŸûÓÞ¶Ãî*7&[¾óÖ¶öH6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖâk[û/ñ7^ØÚÖÎñ[ÛÚÿÚä ã[ÛÚÛ˜Øc¡.¶¶µÿ·Å°µ­mmk[ÛÚÖ¶¶µ­mmk[ÛÚÖ¶¶µ­mmk[û¬Ø«_ÒI½õûY'åËßM¾{t¼4ødá)òèA¡ârms¸4×ïh"ù‹%³†[Zo†•Âø\áÁ*äÏ@A•´\•Š„sÁ»•ûºÒ•ì¥ï}7|9þ[ǤÍÇ +O$`P\ão PÉœ@Jgř̕<ˆ¹¬Ví¨Å%fp_øn&]¿‘âÓI™®l?U»ÆAI?«wQ@a‡ÚÇŠØ¢Ò^—Ú-ÜÔe¨LëW½¼e= ‰õ¡ôº[{^Yª™L‹¡`Ò®ÿ@dk5ìíŠÈ5e¬©%Áüœkáp^õjˆ+øV*h¿§9LÝÔ¶ž*åºQþˆ¡†#LRM®ƒ!¤XU·7˜ãçéë”Ó˜ÉrÈpGò÷ù5$w`¾âågJOŒn˜,’¿D +Ú}î®;ÛŽ—\™×3À|©½Ü†·|§½P€¹‚›Ÿ}ªô˜’Á¢Ãiw‡”tU†ás•òµêÉ¥peúb}nùVIÌáUr^}ªô”ð†˜Ò%ÿD«˜‰6éºz®Y¸«¿!›ë…ö¶Ô5@Sz§$Ö4G£îc¥'¡à!ø+`èGm|ÝKzbm ¦6™Òí_©£€½w½ Œ¯‘ù§jähKÙÒý;ëmÊí³6¶{þ í7P}¹R,¼7OóÙ:y¶²£äÝš’dþêoèËóôõb‘®lNÝß,þ¹ö36÷¬·Í’ËÖVÅ+ÎÖW$ý7³€¿73ƒÃdøÁÂÓ»Ï@{_£ë;,;ÉÖ÷̓!’½z¨ÙÛ‡Úá>C1Yý!,Äëǽxî3Üm¡|¹ÑaüÝÓ²)YüÁÒIþ!0Ôtuï½AŸ†òõqÂýûc‚Ò϶Ÿ«ÞC°¾÷ž¬Ÿ1('Þ«Ùäí>þÂýlû9ý;ëÏZ¿ww«OÏÜjdób‡ûøøA'Ï>XxP­øKÅíªõ³e2)Ö×s öú˜þ÷ûøCùÑö³÷ÙX½»=!<8—týé"àÜyñ«±¸|wjï¬ú]Å*çÁÂÂî žúŒ…ë™Ã÷;“Z)>YÚþ§œI±XÝØ}ŽïÙ–òÕÁÎûuñÙjþÁQ„L¸ruíÃy†Bóð ÷îš»Ï^Ó2>Ü×u¿±»ú¢NõŒ µHeóbÉôèÛãnzÁ?9ÚÁ{eFú Z²~(Ús|ÏâåI$õûkR8R~²3É’[µã¡¶¾÷¾hä•£×;“vL¾;÷8‘î'cdŸ8u7Ñ=!Í}FÜó<«àã7?º’zVÿœõÅ@íÑ3Ä‚ÿŸ$~¸3É–â­?¯=á–ü ®qÃUe“^ÚÀöys—ó~EíZ‹Åßr&Ù’¯í½wž™TÓ—ƒ¡~ÿ´Ü3ùÉÕ­ ÷OÙÏż÷Í3ªÅü™=ï–Dç³#“|þ§2{ŒtugRÜ5û.,8ÏÀVä…ä¦ÖçðB|MØ®C~-,8Œ…¬ÉÄ‚E«ÔMÃB4ðrëÖ…vCĤH€jøÍÂ}zÃT$õ­XˆòºÕR!\»Àå!h[9—.|ªsá0œV5¦ëFËx–Š4JDZlj«û8˜ðù&À ÁD Ã}¤pU£é7Y›l»t]g¨àÞ— ð™h…+Úœ’Áƒ>¹H31]Ú?ŒÔÁ§ês|x¼ö$í‡ÌUd5úÄ´LD^¿ZGrh” +{ˆa|qD†Â†÷‘CCcë¡Iwê!à´úÃu¤H2ÎiíJš dýRŠëó†êaB.›”3k0ƒ±?âç +©p.«Hò4e8×7xY Ü+Àt T­%ØpÏ~Ä‚Ááæ®!¤›»Xã8”~x#:LºoÎvƒ'¥äÍÚ¼àB¹ÓÁkip Û`%®xžÝH†í6poÖ?Á^ððᬺïL8@9•Ì¨àH¢öƒžCãè¾Ü^(ñ¶ M¯Á­•øàŽ0 >n‹ MƒÛ_ꇨ?œ")#Ã+•CœBÿTbN†EÝÅp|­‡Óâ›u$SŠž /áK6ìÐÙMxŽ’…¢Û‚& PÚ’Ïø™˜,ØQ}tA-¢¨©çÜÓ:RŽ}ÜP=ÎCÃ8‡…ß,¶QÙ»˜ó—KaŽÀgrÀJGªÆ>õC*S!&Bê¡ñ–ì\|&/`ïûÐê]ÊDÎSxR+ãÇÆ0 ˜üúZM¸5¶[xÁT!9œ`œ&p‹§•‡NZpÑ^‘­ÖÖö½È 8®$,†š4+èc¤úˆXð`¾1Œ‚J«PÃÐÇt$óÄŠþ1 Ðí,b„ÏÅQ'ð(&j£Ègº÷Š¼`¨7ïPqï‹Ê4¬ñát„§œåÃ;¯ÂÞÆ‚ÞÕ}Hy +àôk…=4@~¡v14Ê Z«È(–÷píôPO;vuŽµ#9ê÷9clÞêù:”¿ÏJWW-A}¡¨V ÀpºúbÚW0Á˜y é¾²EŸRB†YƒºÕ D¸ÜávÔ¿åu10œ¸Ú†¢" ®To~l "|”h]^ˆ¹ +ê,ZõðÕ` )YGPÚCœ–õÃ[»cP耰^Š=4¶«ÅÇAñéÔP:û¡ +ŽÇÒýÐ|(/ ÁírvÏ„—ï±Ðƒ’Ú¤i’ì +…… ì;°`KF›NÅj89ålo’F¦ØS;Þ¸¨È~ƂŸhìã}c³a¨†"è#´Ü¶ …°â5Vä4´^ššê¼±QÚäv X€/ÂG ׶ > P“äŠGM*$ /T`y©‡'ª;Åô/ÇBS$5SÔ# ŠÛXPC“ؾ¡B Mñá¼P ¥Ó$0–èK²à QN=mŠ†eapûÔ§ú@µ/87z“(yò@HjБ”lfΉú*ôýRij…Ír¥#)בSÆ…Äßñ‚‚ž1,Ô‘µ˜=DëHxJŸYš?´&rUí©”e½ÖÌŽ’6õÈV…ÓÖ¡ƒç…X¨™šúR× †¦.e¢°`hyTñqäný±¼Æ©£ª ICàaZ„‡Àã½äqñÔ@zT„*¦5‡ÇwaîèU¸w÷¸ ^SíòÆ0I°Ã!A›œbˆ»Œ…ßñ‚²šqT±dª©žš2\k«ÕC Ú”i^žâGjÕ­ µ_EYs¹CËØB¬PIóq×uQïÞˆµk†ÆÀƒr€À*Üмðéë ‘ ŒsêŠÞn(™ërc>­Awr)gáPœ†S_÷©‚ÜÖ¸·ë +Ô ¨`£ë‘U舣‚§†za·`AëqR÷±íû(_È 9—,ǘ\)›þ *-¨Ä ð8áò(|ñ!,ØRE%¹ðí|YË'ò‚Ã$ÆEõ ¼§è:R 7†w˜ ‰ÒŸ†…z—`Z‡ä$óݼ`2I;ÜÒ#¡’Y+a¡N%§½'¤HŽ*¨>„ÊÒ¨Ì=‹ž­#äîi*’+YcXð–òƒÍŠ^Æ ¥n…µzÓæ°DéG`¡ƒcÎÐî¿Þ^à¶o9:~¹ÝÃ:’y¥¦’æ`»«Çì…TɨOüÜvŸ‡m/PŒžloБ2xxÂhŒ¡¬ôãt$ÌøTGõ_i/`å…LoqKÜ=\ÌÝC,¨"jÈö} ¼pL*ƒ0˲ªx/ ½0L‰])ËùQ^k;—…Tî–ùÎâ#°PÃð¨Hh ÑZä;!/ 2-ô)/0ßy.ìÿK,¸îhF;pÑ1ßùQ?RÓŽ¥aáP.visŸŒO§c;2 ñQ¢—caLldH±¯Ìwþ …ªÙ¡Íèt‘.ÿ¥~¤ F†É½Å¯±ï±Ðƒ)ÃÑ/yÁÑ{á¸Ò2v>!õ+yÁ3aeÀ“¤Î»°Bgc~1ù^hTz»3þhÂëIŠ‰È·aA+|Ê=#ŽjÁý’Råz>T#åkL}‹Ïî áÊþ©X¨™Ð¯Þ`/`6m¨'‚ƒ°†Ï±r½cõí,¿Žl’˜ñwʇµ°À¹S‡Òµêž¬?†[Ò ·Ï,MÁ«³~¤çaÁ‚§€Ñnæ^’^5Ò™l½ÚeUa´»|/ä2Œ-ÆÃÐCá7Æ#…r¬ÕÈ%õÖÂBíb¡Ÿ.-y4ü ;!E]'h'œõl=“ +&e`PÉÅÁÍ_Ç !.®\2~øî> –Žr8ŠÏaØÍ7òÂPbÚ*I]z2ã>Ž…$˜15ªí¯±0ÔÎÈ~äœÀgòÂ`¥Xz¹¤n¾ô‹¼Žj³1¡¹KÍáó°0d­ÅçhkÓ?§Ú­¿A¦ý¤ü…þÕïæòÄ' ÏWòÂ5«mÃÂe,x®coXxÄÆ /lXØxás±`lXØì… Ã[6W]ÏFýD,´·ì¾èÂ3°€;\¾QüôáBc!~â| +jãç¬î §ü^pXõT,ÜÀ sîÅ‚uÇÙ%ã—sF{v¬Ö8}2/„‡ÑÏáùäŒ`m,ô§èXòÓ§;O5œ?Ä á>Cà]¼Ý{ßû°`JÖ\<ߺPÊ{jå¢~2/T]Ìñ\ ³ÎÜãÇá:Üù×ôñ¢·ðÂÓ±`_Ñ +v?É¸ËžÍ ÅAäavA\›Â3ÉÁ Ãuð»|/„–a¦¥ÒøŠ,µ­‡y!Ìs œ(É+5”ÄÌ;Å Ê´3nåË΃R:V¦&C«Â-áÊܬ‡ IÔ¡ÚLíþ×XˆKZ–˜„’§&ƹFVŸ”^娾§-^2(ñVžÕ›¹h,¬m/x%éó/N¢Â´wqd Ne”9>hÐH¼o]åXä:neêÔµy!HeaYã½Â¡Žz'™ºg0mÞ!Zœ*ÎÒ 4 H’á «+·yi u&EéMXø2^ .f#– þÀ³ÇxÁ£S.2æ&KÜD©âð#C#sܹͺ &vBÈÀ‘JÆm\¼¶]b0æv <Ãü5TbÌ™a¨®óh¨’‡ø2zÜ8 árõ20}b§©Ú´Ž´âHƒ&Â8¾û!â”mC%ÕÝÊÕ‹õð±1C0”ðS>òB½¢$à}˜Áp2Ç$ †›„…RíÒfŽ#£Ò8 2S*\è nipµÕ <;øR^ ²éˆçC̘ãY …Á#X Òôc5’§~ð¸ëx`u*™cœù·èH=§–WáB*?$”%ŒµúTŠj‡‘å=˜½˜õÜþ + æîTÅMøl““ï„L£í…žaßS`Å=\·÷,·äZ_G +@þ=‚©Ü¡dUG 5’:÷Ðôlyp»Šø™:ƒWaÿ,x&ýBLX¨™LBz–y;ìàÕò =³¼ˆc‚Š¤a„Ûœ›–•Â°Òí‹oåµY"ëRM6Aj9`aÜõÉ¢TaÅJ%žN^¤êH;^ê^hÕ\Òªí_2„˜5¤XO>P–(Uö´ÇÅoí/”`NŸâLP`˜oa©x•nÈè Bà†tÖl/4rM,`&B¯ö–Δµlé³Õ½0߹׃"È$ÝÛ kba@Öl6÷ ßIõM‘`rz‰D—âÁ´­B*Á½õ–ö—åxº–Ž>™RôÑ‘p7Ð4O™´bW²´êu¬j©’Óéª?`Am¤ ïGÓ Ë&Å£@õ°Ði©w³Žà ®]`5œÁ¨ºœâ˜³iÜ©¾\Ã`’˜°:5Ã¥½°žà¨ÈLRû¬ƒziy“ˆïLsxÁ\z{ÏÎÚXÀ»jçÆU÷À7Ts·Ð®fÜmZn g¢xÀƒ—E¾ØvÖXÈd€f>Œ˜>š†6MŽv¦#Û Hã@éWçŒPû ®Ð>Åÿñ#¼Š +T„KáóJ×¢¿Ã‚­0ÚW8¯u ûÒLñ„…ñr9_`ŒzPŽqiAŒö‚·"/´#"¥l£OµQ} #LIáýÒ4,¤ÏÂ&Î:’1bÁÖ¬Y³tœô g»AÏNêM OÕSû^âVžä‹yºZBcµaæ`˜ý#:ÒnN¸2`ZñmÎTIÜ ÖKÕTWŽPû ºtF‰Xð¸Ù!·¤lXð‚ÞdSÏH¿âÜ$“2ÜÐœ;õ¨#ÍúÀXuB š-qŽ©#ŠÝ˜ì…5± Ëݸ0i,ô#7M¼0­1ÔpÆÓxu$%ÀZOJíÝ÷L¸úžtD)"G°aÉ ñ—óUbs€Ö s.lçìV,Ôª4掇Z¯Õ3J# T½-­Ýu,88CÖ“®,PyÁ‘nÒÜü~}2žO±)—X•fPI,‚•«]vƒZèF«‰šUyÔ˜&’ JGÚó‚³´ëáζÍð<IÝ[½I[îu$tcÏ25™% ªà•¹ñ ^HF^øf{Jn› D6e"Yý/€Ìp3ÀgmIq¼\™f I%\xÎ…ý êS®TX°¥šz›^œPè&~ëGBÁÆÛÄ\Úa.ÉöX€>7Y +ï‡Û­,Àë¡YÇXñ^¬l¥ÚÂwšs÷¼PJQ(ŠÎ0q=àz)N +f*Ñ^PuÉà¹Ø³­jÏgžÃXÛÃd/ Í &z”¦5ýïãѨU…yЇû!äåݼ JQj74fÅDy]þ´A¹ÂªªöpðS,UáB½^KÊqÄ-E7hÜ9˜#n0üžÆ`Øau Ú*|ÀRºúö]¥ÛÁ_©‰ÐÃC ïû ^ pu +/-D‚«ìõ…{ù «•ácãÈ„üYöB ’@j^¡æ¬Œå€'îXÇÕÁ,³ÜàÊ·ëq¥…(ãÂVÞ½ 7‚ž Ïo´vÖèô|æÚ3îçt7ZÞôÃøvÁNÙ¨ŽgùÃX@w¼zôßáõ<Õ©b4Fð²ý)›<ƒ¡/7Øón©|,M¬±â’w«Uˆe ?Òª>Õ|°Ôè;ð¯¡~R_øøB=ý‚÷ó6ÆhŠ]«7cè·Q–5Œ¯!V¬ÇZ¿@ìxW|«éZlx¤æ £»%6O½WïŽ@ì»u$ãa)ª ÁÖæ硤Žõ±pë€7÷†Í’Öð#= écX¥µž…&‚G'czoݵ¶±P¼ ÖXø2©·žÿ ŽËÍX°Ì;Äõ>,xŽã?Ž£âVä#Ø=†…·ðB7báëjH> Çsró„ŽÞ‡…•fÇwGÛ¼‹nm_Ç Æ»Ñúð|g÷ÏÔÁH(m„t)|[kÐMuIÖPš®'G\”rÕQçE¯¦Ç[2 w<ªd÷ºVA\Éqt>qò ðÝpõ†‚?€…FNmµ‰<š/¹b- CLåþ‹^Áç)ߦMÖ(<1›ºÇþ7ì¦ÇëM<îtÉ5U퀯Ù[8OoDsêBø‘Ò3¿¡ìO(IæúS_;^r]ÍbB˜óºwCG&Ú½mtŠqªbj>lÍÿ†+ÉÐo›­8‡OÔ¹®¡›ŒÊÂëU”üÃCŸ1­¬×òWsõ+xnÕ2wÕú—ÆT`Ö¿|¨Ù;ÍV‡¬µ€¨iý™•e¿îNŸÁ›Ê&o_+‰¯f¢Ó–b>×K“ýkaR>’u/Y>Cjkúrz¯xôÖÑÁZ¬‚îºúõû-†µW6á’l}Zßñ—KE ŸR$ùžÖ½Ô]pw³ÞkO­Ïs«ûÏÛ§H­x½TÐ×—ö>ãgÏ»B …½úË6šgHmùúÈz».\§ÕGKi[ÛÚÖ¶¶µ­mmk[ÛÚÖ¶¶µ­mmk[ÛÚÖ¶¶µ­mmk[ûúVxVÞªá[ŽÔoÃø›þ6óoÆü~3ô™ûƒµqî”ËÍ;hã=›qá ^|ƒÆïæðSÅIWês‹ ë³k‹MD_ÖZÎy…å9ï0&ŠcXݾåX3R+ öp0…A†ßL}0Åøcõm K6áA +éªãÁ«izøáE+1︥úƇ­Ñ÷8984w¼Pk| +Å<韣¶ò=jÙ…ƒá¹ƒÞÉã•‹ƒí&¢/k‰NÏ‹ô–r˜®\a¹V^g™Ê‹±tþ fÁ\fïƤwþ8Xú ø!“ȃf.s•åÖÉAŠ>Ø];èòŸ±°ÿÖÿ©Nºb;o«Â:›ÊŠe¬Þ‡ÍzÇOÿŸÛ ¾ã8ÏÍý¿ü*ÄÐ)rľ^ŒPÉ]= ‹’=tÊÑ‹X(¥°·Cåý¶î=ˆÍSì„\-W¡ÆB ° @kÒ´}½0¥JÚe9{î6¬`ò=ÄN¡’*çÝxAè2<<ü5òïÀB¨bÚzø—E U#îêmªýHÆIá†7ž‡¡SÉ-Ï´/dªò½Ã­š;´R1ô + .÷`ìt÷xA°>A²ž„[ùÔ Ná§V±PiP`_ˆÆB9ñÂu©ÍšmF +»udSšªŸKÛ¸×^(Ü)W@Z´ð]Ùỹܨ^¡i˜AUA8–F·ð‚+ÍÌlvÎa!„G=ã $¶ï Û_?:`õúÆûز.»×Ðæƈj–÷ÌèxÌ’ š Lpi‚C”5â¦iâG{6iq#JÕ½Îa@^3±SñÌ ’U +ýKÚbì^õ$,xŒõν7’®W¤èC†`°%)2ÀG!xP8\ÙÎG!ä§bp9ç—ã“pÚ0)üK¾»«ö¼n[åJšÁ è1¨\õ|™äf´\í÷`ÆgNjs®=+?ñïÃý)¤¾ÃW¬b5ÇÏÖ±÷¨›wKVï`Ž2mÔ>óÆút¶ä«äþz;ÊR +"’²Ý!/ Ž¤„? ëÊTçß`[Ý°_Û~$­# ‰h¼=±K^0`VD•9u–©óÝ'a#‰â&.NJ̼Væ Ü®ÁXÊtÊn÷©®‘ïìq[Oð½‡Çš5cWaÁÂé§@页RÔã[ÿ Á9½Ž…×Úv:Ũ”¼®B–¼[V²©÷o» ¾íÝúZ¤d«0iÓ-¼–*µ‡FXic«±›¦-Z Ú>Iƒ±0ÎEÉ à±À®óÂ\1¢Ç'¥ÞÚ(× µS±Ðð³ä}Ë.#ð^µë6Ì)cT¤‡ÆänÞhÞ¹‚…]xÖ§ŒƒÕ°³ŒÈ)è¡Ao„žnQîÄ7ba8U×ÕÝ‚tLÍ–Úv®Š)‡„cI. ‰Ín*æiú¿Æ‚¢'t΀‰lƒ¿0Å ¸¯-tÍiÕ½~(¡Ÿ‰¸IGª=/^Íß݈[fÀKX htª»€êÆE^(nâ ¤†¹\ªÑË2òÂØy! ‘Â'"œ-F‚Š5Þ«/ÔóæG?Ò9Ÿª3bÁ,À‚}cM.4])ÐI"ùMÚ ˜#—½‡÷¬;gZÉ0,L£÷¥R#cÂŒŽÂ¿Aêº8 $wÝd·‚øܱî\©ƒºEÛ«L‡Y‚ßÁØx6­T÷¨êñú™Äëe¿ÀBÀÄ–9yç±pÕ^(@ES©’ œÈUArºÄOÁ*¼Šgqõä#/à¦Çv÷ñSI† +0,íF˜Ö^îõ©N¼@a +ÎA1±q­€í†…nô w~Í|/X¯Ív¼—ê”™×63y ŒSJ]&Óø®ÿ ?Ù :UR9$ú2U`¼Öò%; êªuJt»%Þ¼€:àÊêÑœi‘kB­?0`æJ§ñÉð€™Ã}e;c­Æ~Ôus¶ÂðܧšÜ˜a}G+J“uxaÈy¿ºø0o®ò‹6·CÃ`ËxÌ^8ô=Õ}‚Â×,DtÈ…¨ÄNìlwÛú¿¦lÕ®Áš&¡š? ¹3›_ÇB•¥qŽ4¶p¥B[ËVH”:½q1±.®T5¹/Aе‡þ–Üÿ[ãT Ö¬.šûopw5ÓÖÔq_?h/ÌX;oœßËi3`P+Skp1¾@Ì´?òB12&”sž3º p1S#Ç]¸4ïó#yÓ;Hœ/àOžÆÂmFÉý/Ìiˆýí§ÁñÑõ…[xa¾eð£5\Ÿïj±’Oµ¼g`a?|æT‹rï{aéGÊG\áÂL(]ý˜´,\*ÄÁLû/¸²Œª,<õœv8â…:Ü©ãtør‚…ÓOcá1^¸ÛäPÔ(i£[©Ë˜‹°;£ÍDt¬ÕtA#˜pÑ ¯su š«Y¨A5^ó8Déü[ÝæZ­Ì(ܳñUWN Ì&Hå©©ž½Ÿ*©½©)UýM¼ß`Á¼7Žõ ®õÀCݳè?Ù doþa*Å°C½«P hŸçÀDñB}/Œ1Õ8¿*óÁÖöB>òXêŒK׸ŽƒR_ö#i,x3/à¶Åè*Ïo__`wñB5ÒÆG#ðMÃ%Ⱥuæ:Z„ /TPÊñÕl¹NXqÞ®™ýšÜñÒB?w!™…’xêÃcï˜*IË]*ÔŠ­|ªTûГaZ×ÆãXð¹HoBÈxù†³¶Šàm–ø"ìšIî°¸d:W$9æJrµld¹R¤)“QèÆïà…,ÉóÜ®¦Žh]ÕÁ™¦Oðd-¦ðåÓôz rÿs¼ u$¯’Hó&[±¢Êƒv;/T2ÁЬPpð]žÕ8³0¬3y¦LÁÓ ¡Z«ªfŽ"j8ØkN´]˜$røÝsŽŸô^p@Eß@¿akvª"†ÛŸZö‚{ºw5<)†©âBj®õ×o”»Þ‘AÍ%Ó€ÃóDZàÜU–ÊêfÛy©â‚ÐBKwJO:wÕ^¨»dÌ•Äqñ;*܉ +F lju€’ÙÝa/ËOuãûºÝ§º˜qÑÅ8U8\vOñ#Uãè›ð—tü«Ï“KX8vŸW,ÂÉiôsâãÒ °0.rõù^ã¥)¨‘£ÍD¹]9‡…bÿTª§†4Ê·@Îî°¦®EÕ#ï,T¹L2o¨«&EŸ}‘0¼’8)¨s†­¢á¬Æ°–=&ºÕUš¢Û¤®fçÉ9JÑÝE‘ž=Õ⸾Ý^¸ÅÕrîàù !0 Y õâèútø¯çͯ'ž³¾°ÄŸz°°!¶ÔöF=»! +Äa;ä…½×í·¼0«åtw/.ðÂbu„ùØ}¬ÚÑLZ³zi:Ä\+Ùýqyþ;°¸ÒmbG°†JÒÏç®#a¶eU.\ü"èË™$Œ»ú ƒ>)–¦.Êå´¾0JÈ ÉAµÉßñÂ`P¸eâªh‚LªŽˆLGÎd ;':½DS½(ºŠzªF[öÊ4A7} ºfÇoÆÂ^à“½àJ;Ê9¯•Ìô9·3Š†ÃŠ>Õï¶ÂĶ/y=D %RæɹZaÕA"@„¾!Ž™‰:û1ÑYa•®Ð¥å¶Q»µ‰ùígêÔ–'óYwðBEOj…Ñ¥¦V¤xK¡‹ÆžØÐiêp§Þ¥ª¯èåÒK^*ê²ñ€"”lær¸#ä=X\ìFé2†aÞ…ªÞg¹*í™b97,Ê„Û9pâ® b +ùÔ%›½ð£CTöu]xí/nzWîq¸ÐY[Q¨¢ÞjolõPM¥­Š8žâåÂHKº1¿;+8¼¦á𿻆¤q8,±3Þ²PÝ0¼b¨óY[šº¬ƒh_ÄžJåÁ…ÞáEé /ܳ}U¥-ŒÉ¯âdO"x·zªW° ' Ê ¿$esx`§æ=,qÕ´{h/’:}<¿%K}­Üÿ%™¸§({î‚ŠúûH—' +ȳ +Ã3ê°àò¡” h¹¨êÞW¡ìûµ¿Ûà0Xeö^ÆÂÝ‘&Ö/Òï ëØwá_……ï¶:°Žû‹XØŽä£éYJi†AÅËsÄöæþì~m?µwï×öò¶­/\ô#%oΔ@”Ê¥éªS¹ÒÜWx¡®Rš‡¿¾Cýk,œç…¢L×l_ß½OÄŸ]_Htl@àZf3¹ç†§ë¼ú˼êd¥æw³rH¯Xµmõ/„Lû‡~§ÀDô‡ÇÛu]ë|¾Ú^p:Óô.bÁòFkBÕ6óÆ â;ÒÜkãÊî}y!à¬ì‰“þò]y]ØnÉý?÷nB.ªžÍ/ó]þƒ|@îÿe/ÜâGš°PkGxÁoïGǽß^ãN"TSÙM¾Ài[¾ÁWhëÅ2ôdêPM¥J5©É°í×V³q=ÀÕï‡è•f¸U±ïÞ¼} ¹Ô=¬ˆ¥rˆq ßµ×ù_^_ð°½Â¡NÞ®È?äGr樷– EF9c)€ÌpÁ¹‰©u c Ãú·¤œøE.gnY‰ÚÊKg y g`TÉq9Ði½ÁË°’:Æ­¦mwÂX£Ø†îaÊbèV§Ý«°{U=¤j;¡¥éÿ +¾Ú^ðú¾¯oÅ‚'xRÒ{¶x~¨žª½ÌYM%Ýù)Þ“J˜Ä\¸<ó#ÆÉa•ò GÇ”ÔRÉ6–+#>oÇ?8þà>žé2X;•¿kÔ7RTÞײ$—zßl+â߶l¬–# cx(“”Ü­ÿ /|±½`K~1NÕÞozVi½Hm¤AïØ53ns7/,…­vÕÔ¬·²tµ^=1[*æS(Ujó©=êôǘî Àë<œãB=üV{6{âÚ³1£) ·y;½ë)æö©\X)oaSÅp°qo³G.øÞâ6ŽJð³C°fccŸ¹õù„çÓY0;‚x$ZÐ3¯" î S‚rŠ&¼8äbÄÖÖšªïÍ=Õäý#°˜ÍxJG`h×t/q!G÷47ÚÖšÎÆ Ù³1h{;ÂGƒµý¸×Úóš8Ã~â·¶/;‚¸Ð¡]q¼Ä…üòl=a¹Ü›¸ §¸0Õ.¤z6÷Ä{6m5Å…ý&‡ýê Šžì@"ª­§bˆpÍ):‡þ,ÅÙ„Br’_=‘Zšž£WÚ~ÜRP•D!.<ÈKM/ÓãÛoe·øý·Âµ 0è†h xS=s ^Êý/Æ»w8ßQc>ÍÙ(¦z&“àèðbe{ÝUüÊ8zhendstream +endobj +5609 0 obj << +/Length 107 +/Filter /FlateDecode +>> +stream +xÚ`ŸÿõõõšššÛÛÛ‹‹‹éééËËËIIIñññçççXXXÓÓÓºººíí탃ƒsss'''¤¤¤{{{ùùù«««³³³üüüiii‘‘‘•••999áááåååÿÿÿ=Œ=±endstream +endobj +5605 0 obj << +/D [5603 0 R /XYZ 85.039 781.388 null] >> endobj -5535 0 obj << -/D [5532 0 R /XYZ 85.039 698.974 null] +5606 0 obj << +/D [5603 0 R /XYZ 85.039 758.673 null] >> endobj -1754 0 obj << -/D [5532 0 R /XYZ 85.039 422.679 null] +5607 0 obj << +/D [5603 0 R /XYZ 85.039 758.673 null] >> endobj -5536 0 obj << -/D [5532 0 R /XYZ 85.039 402.691 null] +5608 0 obj << +/D [5603 0 R /XYZ 265.428 523.51 null] >> endobj -5531 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F14 2895 0 R >> -/ProcSet [ /PDF /Text ] +5602 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F35 2976 0 R >> +/XObject << /Im20 5581 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5551 0 obj << -/Length 3972 -/Filter /FlateDecode ->> -stream -xÚ¥]sÛÆñ]¿‚õL'PÇ„>Ý';v'µ£Zòô!ÉD@l дš?ßýºÃ©d: ݽ»½½ý>ø þüE¹žÊIê»*M«Í…·XæÍ…/K!YZ4/o.žý‡ ßs3/[ÜÜóDn©ÅMñ«óý/®n^¸\*¥?s/—I’:ß¼ºôk†^}xûþæíû7øÐw>^!ú——©rn˜èíûýâÝËü¦\ïò÷›Ÿ.^ßN ÀU†l~¹øõwoQÀ–~ºð\•¥‹=<{®èÍðéF¡’÷úâúâßf*Æ… 5'M±„eAt^r±ï†±2’ “9ñÃî-adfÆ°Oª&J`&òšã &ÁÈX^0öêêO&ŠÓ-Ï{£f€n»j 4yÍÈ+d¹í‡kK›L*QñÖËNH1L¾’uÈ™zɶ"ÚÕ¿x4îüNÜÉl´úÚmq5é xŸ²Ë‡’Üc„žI6Ø£g} -køžvê!)0’åüÓïðØŠ²(ùÚÊQuƒž²àIN#[å2Š-G‡Ê^ræäŒdUbfÒ="©©˜ NE–ô˜ü«'YwLVTZUdÂÞ¸ÒEš8»ÞègÏK“ÄÈda‚¦ÔÅ·¡å…¶8ÁnÍ/Ol[B³[ê «í&¡S¢ójÏì›ÙV©ô¡JRbŽþ˜EdWÔ;¤‹,«$q”£%>ROyñ ‹ØjÇ@¥OÜ°iWtF<Jý#”C²æ°Åõ»UÉ뀂rÒÇEì(×ÕÍl¾¯þKk÷œjCÀ´qèrr2%¦ŠÏ’T¨DÚ2|Õ6èÑvƲ9üK¤°×~Q÷-„JÅÏû‰óž†ìùå Û»{_´àk´l»¢œ¬qÍt¨¤W¤¥ðR°Ž”=»Aßùn`„É äU£‡R.QËX<˜!‡o턽C?t»Õ@§Á¦£bò*â¤áeÓvèKSÌÇïô@Þj‡/ˆ·”QüST0k+c‘-a,1¶\<Ú6Á²m ;Y %¹AtœQ -*’M\’pØ4ïØžØ,“{z¸! Úä¬ÂôBN$7ÁEËs®+Ã4¼±ÀCSîµ;HÎ?½6%:ìç˜a Á LPÃßÉ9H ‡9ÃG­É¢£îè°QÓ£”Ì1"v–cJI4#Ø} üBÞ<2z÷«iˆL¢Ïç5«íS2â XQœ@Y=’Ajê¥E~œœÎy6P·:ç)¯ÇI.&˜ñGõÓœçìp&äìoàjÁÚß6”ÃPWì hpnún -²} ê¨¬Aš9ŸŒOÆ<>M­‚oCËd:Jó[Î?=ûZ ¤‚øÀÁNhį´mp&H8=¹PÐÚ¸a{)4ªf†$;’/Ô‹)Hjä$y¬ˆâåH='çÉŒ¬”^Hn›µìž%ÏžºA2y?”Úû£¢BÅ®—,¢ÐsƒàDMÁ$K‹f¦¤ dd&ÂuÛrVƒ¤H(L󣱯4˜-‚‘d7Pl¬0cD‡rϹ£x…á›á·c¶_›ºsÈYnî%­Á…,C¦EÉ>¢n·›I…A̲·…©ÝÌWv"iÆÓ|“SX–€v*€žÏµUé*–šü#ìñ«Ie/8Fí/ÜZ¥ óŽ’îD£äaÑàÃÉ"h‡ ƒßÜC–.õ7ejƒ,ZažO+[Ùu!f§8ó*uTQ1”4ü–{Ê‹š2h†¸¥û!š˜ ¦nzn@ ‡ZQžƒ8K® W”—ˆx}‰ÇÏHŸ¢ìl­‰3¢Û¨t[s%ÅøHÒ¬²ŒÕÍ¡ ¥<*oÖvzÀ¼°gÕ»X3˜ø‡iJ8/,RŽË8†XÚÐ[Âõ'¯Œ®„~¬ñ`]IÅLs¼_í_± —Ó=ódœl>Œ:•%IX§“‰òeWî¤Åg|Úã„w ¸˜:¦¨“JO¨¹·2q²j;R'ô‘4¸eÊQûS -EÇå#g 5G *õAéPÌqæÜP2Å9È9¨J G¿Ìå¯Xu±ÞvcrN—üà{Þß'TT4U9õÆÂD’é$GpÊGéÝÉ3£ KV‹á_B³D¼(ZãHƒtR©² BX;Ó­Ö#$•©Ñâ39ÁF -§ËM“2"ú®Ì‡±ØèH¿f&!aÒtA,”.+Òæ²Å}EE{»Øu¬.x¬*œÖÏGC@Zk ¥UÇbµëdgÚ’¿å£“qV…œÐ2j#VJûÀm7ÖºvaMõ¶ -3± ¬¸=‚SÔg˜©í¦Ã2 §¦ÆÑ á)—€ßˆ¡¢ª1Ÿ¹’ܳ$º;*†7BrÊI…é¡Dp¬U˜"¹bŠ±¤Ï·\¼}M<Þ 6˜¨oÅ«Õh¢ZÖêuÓ©†‰%eÐ^÷6mW¯ÔØ PÒ Àf†TÉóš ¬³U8ïõH#-|ùɽà¼æZÞZ=yX@8,xº#ot/0ã(66&ŒÞ`×êÔÕ‡J”ë§ÉÙ«‹æôÕŠá7Ž¯nb¹ºyÅ}ú¯œš$Ϋò+çW¸{È -{*ÊSœÆB†ç/i,šÓ—4X~$ ç¢ï ‡áÒñʤOd©KMÉ»8­Þúša`ßQËe…Õ¨ k‘vÐ%:kc)>â·õ@œ†UY{GZ²ïªaS"Ô]gÍyS”–7o¤w9îŽÔè’òj¬²1þa/ôOµVq:ŸBòNËü(y陈ïzÔØ G`Õ°mmrÉÚžÎ8òØ$Ü•='/œÑDºÎ@t5®È‡‹eNZ¸½“BÝÊdyA~ ÄþH–È\€©û–g°z‚UaÅ°ÐJªñù8$x]ïFšÙæ¦ÎŠdêu—úªD»J/>$)(Xþ gx¥û¨ô6v¸p’ƒ -·£Kšˆ|,¥£@S—kÎ¥øžaö¡ëô -áý×ñØ…En?›4`ß0ÅÙv.{gr¯ÝŠ“UÔµ¨pþ¹âê7’ô!¶Ò‡äd%t‡ö/ ©ýo&CÖ\Am)´àÚ±k ’Î!`O­µî3¿ÑÝi*i6õ.xÐNµ+ })"âè§8Þt¥@ÉÀyBºõIϼb?…f ùÃÍ}Ù—º3\>?ꈿ Båfj>Dhš¥EÄž7œ\,¦t±¨‰8lûÉq×!„ÀqnAü²"‚§óí_eÜN9âj„Êæê—MSqÇn="¡ydÅÄs“PMVü]h@­Q_zt„øvÝÞQŠGê Ü`„øœƒ³eœ¹Vô}çíËw Üßsgoã5tùG@’+€ß•}¯3™õàbï$¦)·™|×Òi©oe%ûÁN>Ÿ ÔeeBÇ ^Ö­ -ÝÌlëïí9¿\? øi¨Lí„ãF߆o9Ók<ôl艰g(ãõ¨}“w¥V‡‰²ù\n}°·0ˆøŠeüêa£ÑÕ ’po 9lfÎîÛ³(‘êƒÑÙ²#Áèb öÇx¡ë§`¿º ¢ÇüÑß/ÉàP%3ÛÓr)ëÞ=åü4•öÏ;‹è´sÐD8‡3 þEçpÄÕœs°¹úñêíO×Gl¡MgÉyAÍ#K&¡›úédÉ?09θI’r -aŽ·dœqrÏk.ù·%'9ŸtÛ‚¦ÑŸ¼bJÓäËtà »(ЯBæ[$Ù‰ò¦#Ýæ†JYÉ#[z£¿kq5i›væ3(ü‰oÓ½ã^{Ïp4«ÿ‰”¹\Û=µ>9(oÍ·UÔÅ×Q¡+] -‘üÚíÒ;ÛÃÒ÷Rú†•g³¿™œ¦ÛGÝ·|媜/;ºN¯è ÄÀ9@Wrs»"¢3Ýcžµgú00ÎøáøÊBjÂÓf®—©G z$:cÐBô˜AŸ^ð¯ô!W³mqõ¦Úlul¹²SØCN³Ð3ÿ¼l„æ.2@Ù„ ´ñŒ¯)¡À8¶qÀõí6pÉZrqï+þž„>LÁÊ'ïäÛ•d4u Ç­2J 6ê+,$»Þ›˜_L††du/Ñéjj#Úh”|¯en†3WÐX5›ÎÔŠºA‚Ïò¬õUd)>%xÕÖg¾#Ød9ðü8”.%u¹`äϾQçÖ&uàpˆ¸û{K4}ÁHŸõUÓ/‘*oæJÎÉE0{ §1‰ªDå@Þç&ÓG¨ÝìcÈ—I]œÃð,6¦PCÈkª;°c‡oÓXÒóu–æ!ïxñá>—e¨>µ^Õ÷¬Û´aà - [ÚxAÀOTå¦qÕ -ɉ®’nµã¤¦CÁ@ÓŸ€±¯·zc­,s×vë½3Wf¶˜š#"/RÓå Üô¦6û%+zT+‹ú³¾6 -¦0ifB)Ó¬—Õ½,Ï f¯ÜáŸÙú¿¾Ü6ý0¨3RuâÚøv_ó‚bÂôßH¥à5Õ1ÃÿÍ]M¥endstream +5612 0 obj << +/Length 2976 +/Filter /FlateDecode +>> +stream +xÚ­ksÛ6ò»…Ï®ÔMÈ|³_nœ¤ytr©š¨Óé´ý‹”Ć’ŠëÜŸ¿}„l:½™»ÉÄÄ‹ÅîbŸº ៺,Ò ŒË˼PA\—ëýEx¹…•WJ0|Añœg«‹§/ÓìR…A–—«ÍD' ’4¾\U¿zÏ__/Wß½_øq{ª ~žÞóŸ– å}àÙåû7ïVoÞ½B(Iåý´ÄåÞ/ŠØ[1Ò›wÓòõ¿ž]3áâ÷Õ÷ß­,§–àªD6?]üú{xYHß_„A\—·0Ëû à3H“XàöâÃÅ–¯%—¼kN+ÃÉÊ(ýºæ2$Yl5Áª +Ê4u5—†A&¤9 ™ -¨wá§iè­OÇ¡ÛÃŒ›õÓ—‹8ô:PüÝã ³Ìû7~ro×-båÝ2P-|E¨°>î¨ïú-TÉÈHÍaìx4îj,8l=žpG_ÿó1M'yª¿}Â!ÙaøÐjTĉ~Å¢²TÊ»vÊ‚˜m£±&†`4,ü$ ½½^D…wÇX7 ” ,QZeÆ{ÒÂ02tÛT¼¤<¤ydz'& + Së¼0,¨–Ã0ê¶aܸ¢,QÞ/‹"ñºïÝ/¢|¢8ΰ·nkÝ£ZA[¾BS*I~X9¢»‰'1`¼ÑkwV[ fƼ]ð)¬'šL¼ò*øVúÏ„ÙvG:’¦Pö,VE«÷8xŽ8V€xd™ºc[£©‚·®v†ü£è^6kþ\­v rV1¸Ä£4NŒtèÕœR*äÙÇI€"Z+~åf†ÎN2åƦÅ;ú"Ê¡­‚” `x¨®¹HÝ2Ê+€v`,¤Óu߉5Zš4GîAt!¶ ?C¬¾>TuÏã?púf``ÓõÌ0ŽÁ,˜õg+•àµ}‡†tÓšù•Þ߇í  s'Þ8§–uŒàÇC‡«·åg&F' ÓãŠ×€«Å$ˆ±¦Q¿qä½®{Á3JÄñ-b ܵ2ƒâ^QÃÍaËçûŽ¶zC÷p4’š½¥¢K©hÈói\p[ƒä‰JpQ R Æ+bŠýoÀkÄ’Ö3ië–7h9CñÆûŽþ6zzWŽÛÀFBÂÓêyŒÇìdϨûm-ÞÏ䋨t¢Øœ¸0Ž2ï4ðµ3Déñ…Vù€ ŠÝál*ËÛúP÷ @Åà†ÄÚ3À‘W/)p±IQ Ô£ðJ}È;ôw^~A×üÙ‰;´úBúFrP}(ë[$ZÐ}üydcAX,;èpjk•åAÙ7þ‚õE[9kº:ô5qÝmñZ›/5W +e8i€ R'}’D9·dEÎÔZk™ð3(„ +'¥EY€?¿÷.“Pϲ_šY˜ +æÃ÷-o‰Ý-~¬Š@XÄAç´õxÊ˦ëþ[ ú+0â¶YùÝáéçC †ĨƮà«ÊŠP¾—W3lúiG…œÈYB8™ )¥æ dþÄSnÅ;HÔPsJ&…Ú ób–Œß2›„øØÇ:†)¼êAV7g4"2Û勉ž ¡Ñ’Ð{³q9®wĵ1f$3œ&ïR”ÅàÖ4cÒS4Â*ÁœXIðIf/º®ÁS¾À³l8•€Í•¬œŽø¥ ›8ƒã³´ŒS pcwñ1ôÚdDB•À‰å!Nè£w2¥ÄT7Ý"UÞ£f@Qö¸½¯º™ ΀Q丘t‚a•n¨œˆ‚wžSîÖ6³%ucé‘HbÁXBŲÉY,|5–L¼åz÷^²G§Æ*踓Ülœ•óEfâ¢rƒªDªhn]]xkfìHád­G1Ž™,Àˆ{MÉÔF¤¨(½Îˆ=0¬Qä±ó‰˜û“©N(öGE1Å:Ü`ó7Œ¹rlëst±n#4ø:K¨iËÒ4>DGv32º1×u†?º77:aÿµ¸–«ŸÏê\Ð}%D2ã~&‡Fàsx÷Q’rlJ!€­QQvf%` ¸Nx3¼ a„Èâ¦ß drù"…3mk8GÜñ«bÂW ’7q.JbHÍ\â™:I‹þx7F2ij!•“p&ª jÑ®H®ÃÃjWsÃÀF\>Äa,-Eˆ¾•¡x^›6ƇNpöÄV=Rñ&›xp]u7¦_À-®"È‘W”9uI \ó”·ñf»£ gP·ƒéVC‰„hÈSAÊ UÓvjIsõƒjRlìvWcq¦N”`ìïdÐñ·b³8´\Çcc€ ‰ÜAœZ¿ä+ +eà¼Éo–Ž _¹ä3ïgZ©Øü jxzÝ65㣂Rz×¼p3)t­•`€ÉBöH¤¾ïúzFf¾ >ˆ£Ü‰±(/&ÅÒq‰?°æ{Æh$Îå¥gš?ðWóçÜïêP÷áy5ÓxVÚŸúÍ~ ;gB”jA^Ý´vV>ÐJ‚uøqª±)tÞOVy”Q4“¬|ªcs¥X‰ÉYxpÖŠl•sT« ÏÏ´lkcŠg:é³9ܘi©ÙˆccKadzÁ'ÎoÌÀ~Æ݃G(\Ðí¶ë¹ÝÙ››™‡YíèÁ -ŽZ‡TM©ó()¶yú¬OÃÈe²?4æáöü´Ü,”q Lw'ˆy¼Nâˆï­ÎX?ã»Q´UŽ]/íJ‰?SCgÛV˜vc”ï–ë¸×¼ Í”zK(aúð=òþ”Q=PÄ’™ +¨G(T­l¡†¼àäSÖû)콦fÚœ˜çqûPH=ãÔT\!$ÙÔAéTLßòæ¹´\$g-n£ÀÔõgž"Ù~õ¾•ÇJ,îã85ÉFÜàá“¡nõZPœ°*lØÑŒ2ÊCèmóѤd˜y»|O’‹E?ûðÂKmÈ^_¾øÑŒðã=ë‘£¸¶l¾¤ÅRórùxoF–‹êµ¼ÛÊëÙ$ûÓüÛŒXrO#ÐY¦$éþöÈOK +_RõÕŸ–œGVSª ²<=ÿYMÉÏj+ós×sI¢õhÿZ'.®ç˜SyÿsΣ¿{Á'ñ†oQQî¼EEyÈ®æwW^&£ÉÍ/U5øü‰ßέê8x|n0Gyä.ö²ºH8†È•­QC·b„í™s%EŽltné!Ãå¯Ö&øcl˜;#ãò8ïÖ/Üë̶3öÇ–ñDm:›E—8>EÀ˜úå §^nÄ"õhÐeÁvàÃ=ÞcOˆº>í¥þ±‡8 ¢rÎà?Ëñ?ýmm*‰ƒ".çM*¢ R†Ô[”$÷ùMã"€ºò!Ãÿ!Û„endstream endobj -5550 0 obj << +5611 0 obj << /Type /Page -/Contents 5551 0 R -/Resources 5549 0 R +/Contents 5612 0 R +/Resources 5610 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5548 0 R -/Annots [ 5554 0 R 5555 0 R 5556 0 R 5557 0 R 5558 0 R 5560 0 R 5561 0 R 5562 0 R ] +/Parent 5592 0 R >> endobj -5554 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [465.465 713.243 512.306 725.538] -/Subtype/Link/A<> +5613 0 obj << +/D [5611 0 R /XYZ 85.039 781.388 null] >> endobj -5555 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 699.694 126.672 711.383] -/Subtype/Link/A<> +1494 0 obj << +/D [5611 0 R /XYZ 85.039 761.463 null] >> endobj -5556 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [362.259 564.202 455.161 575.891] -/Subtype/Link/A<> +5614 0 obj << +/D [5611 0 R /XYZ 85.039 740.47 null] >> endobj -5557 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [449.589 550.652 512.306 562.342] -/Subtype/Link/A<> +1498 0 obj << +/D [5611 0 R /XYZ 85.039 145.051 null] >> endobj -5558 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 537.103 137.066 548.793] -/Subtype/Link/A<> +5615 0 obj << +/D [5611 0 R /XYZ 85.039 110.305 null] >> endobj -5560 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 240.82 167.248 252.509] -/Subtype/Link/A<> +5610 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5561 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 186.623 171.793 198.313] -/Subtype/Link/A<> +5618 0 obj << +/Length 3048 +/Filter /FlateDecode +>> +stream +xÚ¥YYoÛH~÷¯„–"šMvóÈË"猃IÖ›8X,fç¡-Q'<’²Çÿ~êj’²dÏ.‚ fÕÕuõWÕ-5 àŸš¥Æ¢l–¤ÊÒt¶ª.‚Ùf~ºPB±’å„æõÍÅå{ÏTàgA6»ÙŒ|Œ¯M4»Yÿê½ùùÕõͻϋeEžÊüÅ2IRïÍ×ë…ò¾ðèõç«O7WŸ~ž†Aå}½Æé~^¤‘wÃDWŸÆéW_¿â^ä‹ßn>\¼»$d©2óûů¿³5¨ôá"ð£,ÝC;ðLW §ot$ýòâËÅ¿V<§g¼êœUÅ4ËBó¼åbåë8,¬ò3c¦–3oM––ÆmUF3&ð*èUŽc«¦¾ëžÒ\x<+ËHC²(sÆ‹*ö£˜øõ|¥Ãȳ‡¾Y®Kå55ÈÑa«o¡uXõ’Ï–Ð-±­½ýb¦^Ó]ã·eÎ3ÿ ”.û¼ÅÁzËc«E˜x;°EíÖC§ßuÜÛ4-7l½3ï;Ûân›ä¸EÍR~¼úøŽ[=N=°ù Ó ®VÞšçãZÔâm +¦Z*ôkFÊïq:âNÐíz[¢¢´t p’Žcïõ¡gÔ£A…nXˆ»ÀPÈ֎ǪXçŽ97÷$Ù×}íMäì/cü¡!T8ñrrT¦Æ˜á-Z½&»N ÷”Þ€WLp³ËÛœi+’àœQšMï¯q¯Ø»å-ñoâÑƶ£ùî*žz÷̧û[Ür‹Ž¿–ùq04K>P5ž&ÇÞ#MÃhüVœ¾C |8$¡øCSlÔ@¸,‹CǶßåÜ ûÚÊibÛmÞÿeÔ€]H ÷5ªØI Bþ7XþÜ|»gÑ`wêìÆ0@·dÚ«4~ÁfY3•3)ΣzÛô[vSPX=¢ŒZY¾jÊC%hâÇ„UA"ç> ‰Ó[‘þÔ†L„*(í¼Ì*·9™0gÛ0ÁêÓö(3À ­š›–tŶ&mˆÖð ÚaWÙèUYx&£Ô{ÍÉ9`|Fá}KZŒŒÊ!¾ˆÂE•–†˜ø¾¼ÃNw¨¸šìYOÃÃrV뛞ô…æÜ!"wW,X?G´Æ™)b¸fÇép³P È+0$·æ$vþÇÞUTB@D°`΋ÛæгKÏ$˜8ˆ}“„ÿCnU˜eÌÙÜŠæ@{$OçhZn9òc>CJÓY L¯±ž¤×,ðµÊf&‹|*ŽÎbÿX?Gi?¤|?û>S~ ‘-QLÚ$ô¨ \^UJÍÞ6 Þl"¡°]Ž|9禓œ«ÂÌ33q +E‚;?bYê1”öýW0FçRÎûÃ既œf‰§‚ àžyüTPLvk<†Ø-¹…l›žùZŒç²a€¥‘Š:­Èâµã¥xq˜ª€úL¬Ã~Ãþm›×} '0ŒCQËç;÷®D ‘`@ª 8R¸oQbˆ)Ý¡¬–ORRN€¯è ­;“"òƳEœåláÑ +°3¥˜p_+\ž­ r`s†À©â„d¥8‰Ò +&Jö 9X…vÙXD´4`g!'²øÍWhÓ±‡‰nƉE÷.S $$[a&0…Í=!º±áOA5@~F³9E”ÛŽ qAÁÖ¶<䄪‰‡%¸ +¼÷ƒßdÉ/T¦ÒhÏ$¤¬Ñ=Ø8Ž0†/Å»5‡í®|à¾âå¿7·ã²Þ5iª—´ô»†™¡y‹2tOµcx$1ñ–Ba„-.e¹ŠˆEöl@WàýQT`GÖ¦ûgoeQe†Rƒpè]“¡º¨HžÀÕ™ñ•Žglû¤D8VA2[âºì‡á; üDeÏ^3t¢ü41Ï^y´Îü LŽ¯<‘\yæŸí"RìW Á˹ˆ‚Ÿƒ®¦`?Ÿ§´Žý$Ÿ—p¤yò"¤•öÓ”¯³ÿÁ+)•i*õV¶æx¿äÖl¸ÜâU*W>Ý[zÁZ»v Üb4•X'ò:[»ƒ­q5`å¼¥’ðžk¶õyšƒÉJjÇ>ˆ©à=¶°„¤ÆP¶³HG…O¾¦£žqñqzž˜6Æ“ŠnÍ=‡pÚÄÌ2—ñ†Ç¦ó{.¯¸N\CÚ9}HPtsnÜTí5xÁB +–¼:g(â‰~s*Äã+ÎÂßò•Å¢MÍ5 +µåÒª¾ýBNè#+|dF[™7¸”jÕ@" Ȉ½ýæÊxX Ž—P…àŒ–GUkçHµ'š}à­º¡¦“½Å/xõ·YÛÞò4Ünº„5]èÅ ÀÉí±'aÅÓÓæ Vi§VÙI™Tš€uôl@ß1¾¡óýà‘F…äHœò%ŒÍ— 7Ðj–py.|÷}áxù@÷ämXîíG2Q|ÉN«†\QÙZˆJ +¡\ÊqÀÍ8©Á +¬XÙ5Übã÷§£Ã^”°C\6u)‰Â÷C~È%w Æ»¢Ú»<ã*6Ê#üÀB7a–¦€Û½»¶`"«'\èqí-·‡ª ¬LE/rU„ÜÁÕ€(ë—¨Ïåûh +” ŽüX^‹þدÜÛu…(v–×ümí=œøšN!ßñ·kVßòþåå%äú`+¥_f +1‘½ã]ÕÓ»Jñƒ„¨Ü¿Â0¥b>'1†dµ­\ „`:¬g@ ò¾cèÌ_¿j©>_ówTR1gµØžwüöC—GF,¨pɾmvB9MMÉ3˜,&Ão¾E—Àœÿ|Ísòþm1\ªWýœòÆIœòd_u0ylºßx† H¯®ùk‘t-WõŽÇÄ5>úŸÒ à:t Yæ®Ó­0Bß዇ŽH“« Ož92Àz}­×üŽ‘QIŸëë·ÜÔß±ïãpâ{H{~’Æ /* +Ñ…Ê/Ýèˆ.÷¶ß]öÍ%„ýãþ4 χ™^d4º?0¢Å3•Cƒêyòÿ žµŠBy” +…øÑ ,˜>Þ!d”¹Z¹©Óép.åB>È“Hvyi)Š€#üŠ¹ñé62Éñ+2`u\Þ3Î1\0•‰€¦os + #iÈòpËm—zäM—r\ÓNü!X“4¬ÉÜÌüÏa¤ò(Ú8Öœ@BØCñõ÷ž‡ÒÉ1&q ãÎÜF¨“œ¦•+/¸3äœ@±Ô”#ïgyÑuY™}Ú¢ˆAâl ÇI +-h¸¨ÇùÎ6:•ïA5|„z½ÆÅG¯×.H{“êÓtÈû1~ûîÆÍ@Ê…„<îû%GïJÃ+ŸÔ§‘Ñéµ(ß\<ç¡yòþ àþ™øøþ ÝýÁî÷tTW¶wº6õ%Õ䀛y¿ì0«ÿûn·2?ŠŸÿ©lBóäÝB)8²Šï¯\’Ö™ã;ìIiz8z”»q –šíA +>¸BR@èLžqö’såêruØw—ÃÛî‘û;^;¸^XuÂ?ßÚv= <äoeÍùV?€ÈöMËØkÒã$>'ykµ0ô¬¸\fFa;Ç?¶:çJ¥~¦‚ç ÙÆ<Æ¿Xî@fòÓÈѲQ‘÷š,Äøxë°ÜAl<¾sãCì¡Ž°Ð0y|„äX;ƒIEX³ÔôS»SkŠfglzTw·ü¾´Î7–b¢Á¯ûc΂ÙcÛ¤òPßÜÚ[¾ÐØŽ1z’ÉÒÐ;zM¦kÖ€qãï餶†öƮ佬ßQv ¦ |D•Ê)¶…üd垶6$`uáÿM¤k¶¤üL±* ù½A~ ¡$Í¿s¹ƒÓóÌÑ]q-?ÚŒåþ_ÿ:CðYÄ7øæmKóY(xËÅ•ÝÊB÷£Âè¡>~T€é²Ùvg4/ .._>ZQåÁ9È‚ÿÌå‡~.U"?²ó¸gÂÏÉ‚R‡Ú<–×D©oÒèTà?íÉ%endstream +endobj +5617 0 obj << +/Type /Page +/Contents 5618 0 R +/Resources 5616 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5592 0 R >> endobj -5562 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 145.369 195.687 158.271] -/Subtype/Link/A<> +5619 0 obj << +/D [5617 0 R /XYZ 85.039 781.388 null] >> endobj -5552 0 obj << -/D [5550 0 R /XYZ 85.039 781.388 null] +1502 0 obj << +/D [5617 0 R /XYZ 85.039 761.463 null] >> endobj -1758 0 obj << -/D [5550 0 R /XYZ 85.039 761.463 null] +5620 0 obj << +/D [5617 0 R /XYZ 85.039 743.459 null] >> endobj -5553 0 obj << -/D [5550 0 R /XYZ 85.039 743.459 null] +1506 0 obj << +/D [5617 0 R /XYZ 85.039 471.875 null] >> endobj -1762 0 obj << -/D [5550 0 R /XYZ 85.039 373.187 null] +5621 0 obj << +/D [5617 0 R /XYZ 85.039 439.657 null] >> endobj -5559 0 obj << -/D [5550 0 R /XYZ 85.039 353.199 null] +1510 0 obj << +/D [5617 0 R /XYZ 85.039 174.126 null] >> endobj -5549 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R >> +5622 0 obj << +/D [5617 0 R /XYZ 85.039 139.322 null] +>> endobj +5616 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F62 4047 0 R /F58 3360 0 R >> +/XObject << /Im11 5348 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5565 0 obj << -/Length 4092 -/Filter /FlateDecode ->> -stream -xÚ¥ÙrÛFò]_ÁÒK -08ýæX¾ZKÞuU’Ú‚HB šVöç·¯$H¥²å²0GOOOOßCoæÂ?o–„Ž«ÒYœxŽJ’Ù|}æÎV0óæÌ[@ìÌ·g—¯£`æ¹N꦳Ûe't‚PÍn¿X/ß¾¸¾}õùÂVJY^ê\ØqœX/¿\_xÖ ^~÷ñöÝÇ7Ø `г¾\ãô§Ï‰²nèÝÇ~úŇ_pO9îÅo·?½º5”€ªÉüãì—ßÜÙŽôÓ™ë¨4™í í:L¯Ï€N' ”ô˳›³T<ÌxÕW4„ 'Kýð4ç"Ï "e8ç»Îyžï(ÏŸÅ¡ë„n@¬œžr༞ß µ^_(ת/”g5¶gm×0Û>^D‘u…#4·ÃVUÂ\-ôôíE - º14Ìe¥žzKƒ»®n±[ÿåa¨¹µ4¨†øÍyæÎÜpû+ÏeŽ-ð^€¶‡Jé@ózçDûœià¥_ªâû±‹T‘“†O°¶‡!Özák½ÈQò¾¨.üÄÚß7ð§á~‡$U+§n໺°}8 0̆©{áÇÖ#GVÑÊô=ˆÛu•Ûx²¶«7 uÞbAê͹,À75nºÓцœÔêr\Ý0ªÒT|Ã2 a$#ð}ë="Íq6w°!<|\¼Ðeè2ø:늺â1¸E¹Äáø -Ä3Jf±ë;‰çñ¥àD³ˆÏƒëÑÐöüð~öq"•^MW7Èà ±ëDa:¦aO04Ì;Ç“¤áhçZxB¼­ñj4ÏU’Ž¸WT,%4Ž·VßÁß’ngÝò8 ”0¹k5,]ÔXfÍþñ‚8tb°ªÅúôA÷qâA—$åÛõC7qüä${äô¦{xpO‡ÒViè¤(¹üqÛ »1ðéíÀM¬ª–Ñß‘ÖV:H:5ÞÀèÇ/—Cu~†2õv¨%ˆJšÖe‹5ÝžLÕË}¨D9žÌ¢$uüÈâ4´=?äÇ>N±ˆ$.†Ø96 -4‹ fñã;ìeªÛǶÓÒµgxeoLîþ1Èiµ­ŒP`<öàYƒÂ¦Ú@kU³¥äš´û¼!ÒÈ£ÀìΖÜËâ†í$Š|7¶d¨c Ti ÝÁ…ø†®'îƒíôÄuŒ1âIÙ«Ÿn˜ú¯üyCÙZ¨ªÃÚdLÕ~„ 0§‰ àr"¼À5÷YÛówÛÞgk2‘!÷rG¦%g-óÓî2e- Ù¸U9GS ñôåë‰a -†aºƒ&ÿc›‹ŸX0›ŒŒa2b‚«ò‘[™Àæ;†Û™‹ÎZ6rî¡úÿeì±lù‘ËÄãÈkŒÙO×èÃæ<ð-#Ê¥u¯EkÍ¢è®ÐˆÄŠºÆÉKÏ\Ì›*Ϻ{Ü,­ßâ• -7©0æ`N Å€çÑL&æ×®kºÙ4Œ‹¤S¢$_dÈß}&B{GœÉeÑÅb¨L0LÚm©œ8ë¯nèîî‘5¾B¹Ž™áH¢Ññ÷»Ò•sXì¡uôCV¶Œb¼GYŠ- -÷º¢¨¶ gP oP'îHç1Fc¾ÀJ‚ÉÐ`oÙ CÁV^­ˆE|ðF w\öà`lníÍ« 6߉k}ÞxÖÛ¬Ã1ð¨/ëʘ yj‚0ÊÜU~GÑ|ÅËÙúÇ©UƒŠ6(xaZÿB-ÍI#êÆ®òm×dÈé¢Ó̇¥I‚ -0ô’ÝñċëYÕÄ´‘icjñJ' KŒ…¡õ{>gÙò8BÚxíþqøtB vØ Óh2¡š“ȉ¼ø(Zän ô‹­i²ƒÜEØ'ã±ôR&D¾d(ï(^¨ÝM½ëKÆ_’¿c\Žr†ßü;£²CaÖý^ß1H! ÷dQ'd°Ýd¸-…K^zºfFs͆ºŸ‘Zvlùaâ=Ùû-x=\K1ü¹™fÅp¬TžaFÃ3f2ì‰uS3`±ä/ÙQˆ ¥à  sêƒÎtyõL”Â$1ÈO IÆ7'ž¬úzàï}ŒÔ5è½vžeÂDm×ëmÃðˆ|ÃgÎç%žÎa*ä9!ÈÇ@Ìÿ¾Ò ^zi<³M5çïë1ÈãÇ -¾®û'KA8y,ú€[v\ȇöŠ>ɸècã_m½t½üÝ]F—Iÿ*¯ò&ãp º××Wí‘¢J ©ÛIÊ{˜ã‰Bà…NsÀzKáH„'‘P¦åzγè£1SÎZ­0Hv¾d÷#ÈÖxÝŸ&‚¹M‘c´ b—|„• œîCˆíÈŸD}.MëòrI¦l?ä˜bâxÔs,Ð^_aQ TûW× J´«šÎa:ŒTˆ¹ž,ËMfHÖuÐE¿Ž@_?¼·b³àQ&Nõ»aAÌó ôDÆ”²7GËZâp„0eÇ9Î|IŠÈé,Ð3,x˜Âø@ /µÎ¼ cŽ*ðLÈŸ¹×pŠ/~‹Jd{£ÓœMÇ ×ƒdˆD%Àpk”˜xгÎU*¡_µv„|FR!Ìå^éä^«Ë‘F£ ¢B§f!`ñAcü‡Ž{ -r)©=MSÄ®³~ÜöšüAÛÝ ²,œíåpϹl)+\˜âC ׺sÞoÍ! 8ï¶ÿÀô‡s¡P(•’Djq*ЕSI&'l…H:Y„TVTù3ÎbqM9ÎpÝâ[Ñf+cÓÄdyØfåXblµ-—(s^ æj½fÜÒû¦Ób‚ä -yÉ£`Ð>ÿ­G^mÚ×E9eYA¹‘3±·òHf»nXе P f;-“j ¯J§á1(Z–¯Y€¿<ÁR¢ JÊÕ$✳ªøœR«Ó˜šó„gÞt 6ÔÖC+3ð >xQ4KTR_Ø’Ìã} ž23à˜+ÈuÜî—¯£hœ¤+ h¨ÆºÝ´7è¸H:Iª!5¹ƒ‡—Ø™ZôÉîzßiQBÚò<ñÁt!.tÈ÷G×-ÖE_DW_ôçh’C<¦I]Öèÿ…Ix)›©ÓÅN$æt¡GªêB¤VèÊJtxj,·´½QÖI!æ ß_;öW8M¢ß>ýŽ¬Á -ÁþØj—-u'®¡)âüýš‹ÁÎ’ËÌô’(É ’C -ëMÁå•Ž‘±/–8n®p|9-òˆAIU|©¯•hè·í-:ÝÕ„Ä(B(°”ç¾>.´MYÖ-,÷‡Öƒ”[~ `™“Ê!ˆm*).ÀZ¾&\ÐÖù·•qIÄd¬-êøÛ?YnKz. $äzàyª ãaÑ‘j)§^€«±it¢=°˜qªŽ’aˆ_áÐÍqô•è¡š{7Y+Å‚Ô2Ïœ2¥/‘ÊoC˜C’ÀÚ¯rYhnÿ›ä5Ð¥wØU«L¹É©„ƒ?,q³†ƒò,ŒMƒ| ]}À’hÓœà£ò 8À\Ñ M!ñ¬Í(„”‰j¦w× -m~{îo¨¯ÃóÓ°g¶A:L¾8"ˆÓ@àú7žÚTÝO‘çŸdËÔíï*Ó‰è+|ùrÚGô!KÛ—wŒ9?ò ;"çÈ3ìIöð ÏŽ?Ãò3D 27?}xuP+LR'qÁ7¥‰%ѼÒÐö|¢¢°‡“xµêÐ5m¸ãû¡ãï°ÿ9½ë掭<×:§w(üÙ²«oÄ‘[0q/ñæÌ/™Üá[׌~È–%cc!~ š<[ŒXšˆ”EÌ{*ØSÂm¦ArXÕó¬BˆwÇP…LæñÀC€÷iP#Æé—7]·y~y¹Û휒žæz“ãR(uòæ?%èµ3_q$œÛu£S¬QAWŒ GM›eøÏòüý€yð–ã$*= úzéL¹ŽÏúãéA4ª¸)%@‚ÿ°å[endstream +5625 0 obj << +/Length 2407 +/Filter /FlateDecode +>> +stream +xÚ¥Y[sÛ¶~÷¯à艚‰ ¼÷-i“w&iNâLzú@‰´Å‰tIÊŸ_ö +²d§MÇc—Åb±—o° 4ü˜ O”ŽŠ ËŠòàŸŽp5P$ûáHÓHÙȼèÛ 16žöŒ6*ÖÑÄÕ[gO÷3:Uy’¿¸¡£9ÛñÄ^ÆX{²ã²I«Ëõ•NG^îš©H¡b†ç”h¢èe%i^P‚}S /lxT“/+ÁÛñe%ƒ<¢G’Ö¤Œ`a3e3ˆÔH+³÷¿éÆ øP–²§vìß%ø9 ֤̱oœ8žÁ!‡4À€&q¼n+¤ÀÀIq^œì'&"ÖÍnS;Þ +)ìd˜Õû¸W³žÛ,$±“p‡íý ²¬˜1wö‡|¬Ý?ršZdD8Áo¹ÝvQ¨% fÌcŒúôznŒ ›/bkÂÇtUs·“côósÒ aÃa‚“‘9hkwþuìë’äÄ ¡³ðšÑxi°7Ñ®—ÄiŒ´7KìâdhlXaÃ]ùU”Š½Á-ëEøqÓ þyゼmZ±&ÀJ308Ý÷ ,¢¿XOðÝÇÕ”8•÷.;8+`ð¯¡2Š·°‘ ImÍô»Cƒ. h¶žø’£ ­y®ÜÝÂéf¹qq¿¶k—} 9“^E$G^‚ëÄð]”ÇÚnäµQuh†ZÖ¡ÖY†ÌÉJäó6¬É™WlÆþ‚u\ºùîlžÇqxÝ2Ÿåä˜  ôSoJêºPÅDDá8pG õ½caˆjú¡­ +¶è˃Lkù.¾åL©ïLÖÝÛZHíõv;ps*Æq¿ûÁ2ÂÑ^€Ö2Ç1 ª+á6öà ;I’„ïPÛ‘ ùDÈĨ\§²ºrFCù:F†ŠÅ(Eö¡Ä ŒaÁ„¸ oVjN€`´„|WŽòÝnŵ¡F½p¢P¶ˆD Öþf‚!‘¨Æ?Ã=2~Ù }+ Æs#.Ç\ð”wÒvÉÚìÄÃ~+µ •Ã¥ÃèBQþíÃLž…Bâ.ˆkLMgdT5x¸§]”b[J AjÂVäõ(ÊíC›èÑ1ù]_‹á©KQt·! t’½8–MNaROš ãm"Âd]í©(ìq4æt_ò0$8pY””·SWqȼ;†þvGâp¶*ikÎ}tÆ3®º@„XOv 2ÚçåªhßSÑ![öD1ÏQq˜§¢ð¾“ì5Jž© +#+“Fá®~‘èäâ] ¤Ê +•Çϳ¡EØp‹¨í.Sjm®";•„i žÈ—'ºNŦ,DŸ†ÊЧã°¤òé¨cò©|°}¬~ߧ˜¸êxÊÕ¯š“5EzêGºM5]e9Òëö–\§_ ôŸœ+JT +54“ÎúëfªPg¼Ã=-%4vXi‹²Å‰ëTKr¼µÝ>^-±ÔH£R„cx¸$›Vy戛ñÌécp§ÁÑþß[1 Œ†SM/ß@žëgužïÛó«yÌ þ ÀÔR_ïúnÏñÃ5]~4ÈB2Œ”Eîî “3Á2|È¿:¹²ÄZÊpéM6e·[”rdÇä„ë¦g‚܃8‡“âlÇÃã¦lY”±/+bÍؘ › ܪ:w™£.Õ›ØXI “ª¾¥zs;žßeŽ× M%Mr ‚¯”ø÷¦‚}­YM7Y„5 G\Gë†f…„<»"…–ý£ÜÞ„_9–þ–Ù…7ç‡éæÄ×H½©Ü¸¢CjN,tf‘|å¢w¨957,Üyî(W{w}¦k!š­ã/.)å)÷M-ùóSÝ6ÎJøsËßÏNvô’‡fRÀáÊqÄĘCbdò–¿ô†C×2¸gĤ‡'¥ ð+f³.÷« bru?È£$NuÃÀ+Y¾ÌI¿íÆçn)»péî¶<40´É¶_•RlÜê¦Ù—ö«”9£`ëR?ø-›¹P@£¯ïÊ~²³ð]¡Ò‚ë¿RH(*aðÌH¿ôçO*ØŽ8ØâPOp-Ê žà:–¬,i@ z-‰ñ‘œŸ‡äczýÛ(R'પF6­wÕÇÑÑÛfÖï/¯3žßxöt¶3<î9¡twȾùß´äš÷0Â&Ãq&alá"©É?ªÖô6èszTÞ߃lUÕ릪¥sØ4SÞÙ»ିz²Cïà³!P“UróìÚìJ~¡ªçˆÙP¸»× d|‚—×y_:èŠS#ÁÙs'e‹çJ}¸é^z…_–îýÃdªaâHåQqùE7±øNÔ†Ó§òº¬œ ü’êYŒendstream endobj -5564 0 obj << +5624 0 obj << /Type /Page -/Contents 5565 0 R -/Resources 5563 0 R +/Contents 5625 0 R +/Resources 5623 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5548 0 R -/Annots [ 5568 0 R 5569 0 R 5570 0 R 5571 0 R 5573 0 R 5574 0 R 5576 0 R ] +/Parent 5592 0 R >> endobj -5568 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [229.571 699.694 271.655 711.383] -/Subtype/Link/A<> +5626 0 obj << +/D [5624 0 R /XYZ 85.039 781.388 null] >> endobj -5569 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [474.768 699.694 509.276 711.383] -/Subtype/Link/A<> +5623 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F62 4047 0 R >> +/XObject << /Im1 4096 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5570 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [382.128 685.538 512.306 698.44] -/Subtype/Link/A<> +5629 0 obj << +/Length 3312 +/Filter /FlateDecode +>> +stream +xÚÍ[[sÛ6~÷¯Ðäe©!.ÉÎìCš[ÝiRoâ>ì´} %ÚfM“ªHÅ›üú=€¤,Qv³ÜYOf"8888øÎËYÿä,‰D¨ÓYœH¡“d¶¼= gWÐòîD:Š…#Y h¾??yñ6²3Š4Lgç—=ŸH˜HÏÎW¿¯~xyvþæã|¡µd*æ‹8N‚W¿œÍeð‰kÏ>ž~8?ýð¿ TÊà—3lþùã<ÑÁ9~è›_¾ÿþ%iÎ?ÿñäÍy'i'H•¢˜žüú{8[Á”~< …N“Ù”C!¡ùöä‘Ñî»<ùtòÏŽ·™÷:¤O±€™¥*:®9+…±ºÓœ‚V)Ò(j. +EÒ°ŒÌVÂÿ‹( +ƒ³¹–AÝ´Ÿ–›bÝ‚l ž6ó… +(T-–ò 7½Î „ê5Ö¶Xª«†Û~ £»ž½Æ¶JP#¹í²Æq“ª®b´ŸÜ›áX͘þM,"ù€FzÒ÷±$­Ð–òóÆ-®Š*+¡P~qÒ0ài4üq7WI£dH›så-IšUØÖrU[Ão’ówÀÊíU´+n½¬7\8î5µµˆ[\€¹ôÌÖ$³G…Pe]¡_Á°|Vêà‡|C’=Ÿ/L¨ƒö:w3¸fQaJ¼X$ ®Y¤j…Šý-$B.%¬òÏÅ’º.š5OeéÁð[(Í’‡¢ºúö6&4Ešô!ƒ–•¢m ¬»r¨#lA™ÍÇÓ3.Ü¡ÄÅr®bhH5I@ƒå ³ô¬ Õsù£¾pÒ•9j&Òè >1dœ¹Nù¿¦Üæ4 š4.S€(éÝ OµóÂÚà…Û01y–׎˜`•Üð3ÈÑ"øûÐè@¶‡«Ô2Å¥g®0x³K:ŠGÍÜGU;6nÔ/üµrËgqàåQÑ>? Š ?G Ê¶ N6Š‚yF†0ÐpUÆ5MËÈ64Â×êÐFëáLz°Æn³]O§“9N< ü6¸aËúªX‚­RKË訿ƒÅM"·äØ@KNr•9;#ª*œmm €ˆæ½ÆDÃEè‹bâÏ>ªfC?ô‚ÿx‡ô¶MOÏNû1\p^Ü¥Ží )œc0Ž +¥9 †½¡àXèÁðç^½:.ð°Pàa˜¬h@wÖ¦0»},˜ª–I€Åçç‹à–`¹´L@ãÇòG$@õ Úé¶([oäÀ{i%{“‚N5›·ûj Îþhˆ4¨/™ãAqˆñî¦Â–LFæý?ž²-Ò¶l+×zÀWx–) G.-ëÛ5"¦íÔ-|_‹"=)´óz0[’ Àø†E—ÃÜ\wõ…ù¸¾—~îwü]’f;ôkFâuÖº79¶ÚíŸ[÷IÞ ˆ]2%¸–0† +{nÖaPÜr€¨Qж†CU¾o\¥³×çF@q-Ĺ(É•pvÆ¢8G@~/Þêa„ääÖ…Ö.v YïÏÉ+ :=r¨å>òÉ4#ˆl//wì!Jùe”:¹ ÀþK>Ô³@…Ïb±¼BïJ%¿VX¾Ã5¯77<æ!cF×÷u]3þyPO«'D m‘ìãšÈ^~`ÃZWÞ»×ÎÛâêEFH.0¬Ês&à?»LR(oìâ‡_uh ój;`h=Øëì†kž„Ë'5:—–RŸËŒìÔ…þæºX÷ƒÃÍÑe\±—Mp•WùÆy­#¿Õ|îfîÝ•î6sP›mzÝ\¹Jÿ¯˜’÷”2œYS–ŒYÊ\¥æQ…›ÜõØÅò¼uäeƒ[ŽÐÿš'¤BؼÆÁm†`Cñ¿åHâ_N F\¸ô?xo£#£1ikWrÝŠóÔMÞa*×ÙÀ‡lxœvÃÛƒ†v».{‚ú/”§$㵂«Ü¹Kü ÜÂæÕ1=RòUQ5cI…ÐΫ|dŒš÷Jì÷âÜe»æÉÕ›nw€FõÝȱ‡¶)djÿÜ)Ncwî¤ï;é½s'œHSuèðDjàeððDD±RÜÿíŽ[”„L(LHÛPÈÈtç-V Ò%Oå‰P—çsØ¥f¥K…tBGxò@²Yab{íéò‘*3Œ¿/¤£Ùrg˜ûœúLýoMgâQˆtftW´×ìΆ™Û=IM‹D”tOb­¡p%dh…µö1ž‡šYª…ä£Óo?“ìÒ·1.Ô'.\r–±Ë¤;Å©ìaD¤©Pz¦u Œ¤SõkDéBãž%*/‘³óo—Ô3;.ª 5à"Ý##,7‡å3Ø,a£ü5Mw¡-©JÌÝÉñ½à&hÅÑ€ãô°y¥ €è­ÝcsóGÞŠ5ŸM’‹[ïžõë}LPÈù„6»’ÖåjxÄ&ÿÃÿRü¼ù÷¶>®Þ?»Óý©(¸cSœ9ì:.8GƒÍsßMú´`Fà äl”°°ÓÖ!8ŒÔa£…›ž÷¸9&©6À5ŽvD­òá­Á.p 8¿ˆÞ¤^”ãp™bÊÿ/3QXQ©ÉôZ‘Ä3…¾ÆðYÛê‹?TªE¼Gñ2à>^ŽÊj ´#^†Ò–ÙààÝ¥‰#›#«?ÉžpŒQq,´¶£1&µ°ˆ‰œ¿å릮ÒÇ8Šß)þ˜”ZKȯÕ@Ì7Ý9Sí6ʬÙ°¯à@±ü–“!hŠ#þb’™?áð¢¬ÞyU°‹ˆñ“+w¯ +3Ê< +4=ë)@sLÐ4Iÿ¿°™bîO6&fd«>6‚=·BiB>í®o +ºÿl³Ç¹›ŽûÀ9"ªV©ˆ¡8”õçL!V +¯yºæS šléδFïÔð\«òˆ©où•SY>íÍÓ~ÊÁIÃf<ÕÇA£SÈ…â]Ð<ÒÝôì§@Í1aµ²"¥!{iïÃœ { é °ãm&ÇÏxÊNGHÌÈ«¥ÔÒ™R‘°| Ñ´ì®KºI&·=÷)ðsLV%°gM†Âîï¡ß ä»>ñ=P¹íOÑ_ÑÌö ”I§˜âSH“Kf")‚”ÂZu!êaˆôü§€È1iuxÆÈ4÷À~ù/ä^v3’)&ù„à Ø1'b„)d‹X‡‘5Ýɵõƒðè9O€Žcb"8ÒÐîÈùX‚wgx]ûÀGÂcŠI>a"cÌÕh’b°"Ñ"¶qz†U?ì>¼§È1IudD +ÛÖ¡¨ßâ>Îö]ˆŽCdŠy>eŒØHÄceàB’*l*™ºs«¦{ë@'úá¤ç?NŽI+­¥ v(nVº³5ôte÷ÓA!øaæ[¼òÞÒë~Š¨õðlI¯{ïÜöÉï©Ý+‚ŸvÏH›Âc‘.â501Ù¹¬‡Æþ­‹pE #{ÁÏkÿB_â^åþžr[´ýµ»{|àc$?æ…JiéÞH»·Ñ>ÅjM/•H£ƒ·Øøx¸É) ÊÆòè_Hm…6êèß]H‰'7z÷ï.¬û»‹×ôè¡Vá3üKÀ—ý’Æg#ø™WÜŠë[¾ +X¾¸¬éÞ±«Xà;]¢ãM–µAÕ¿oûìFpÏZ q¼ñ­cQ]¼=a"¢ÄWFO3þ'±0ŠðˆÓ?`5»·³óæªøÊÒcÑ[{å„w(þ½kiÙùqL÷¦Í×{XÈLCé§ú((u +2Z$zäÖw¡¤—õ£L|_ÞH£†õ¾Àÿ?\ÿ endstream +endobj +5628 0 obj << +/Type /Page +/Contents 5629 0 R +/Resources 5627 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5635 0 R >> endobj -5571 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [323.743 672.595 408.715 684.285] -/Subtype/Link/A<> +5630 0 obj << +/D [5628 0 R /XYZ 85.039 781.388 null] >> endobj -5573 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [458.132 208.512 509.276 221.413] -/Subtype/Link/A<> +1514 0 obj << +/D [5628 0 R /XYZ 85.039 761.463 null] >> endobj -5574 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [188.809 194.963 226.257 207.864] -/Subtype/Link/A<> +5631 0 obj << +/D [5628 0 R /XYZ 85.039 740.47 null] >> endobj -5576 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [175.286 61.174 435.003 73.167] -/Subtype/Link/A<> +5632 0 obj << +/D [5628 0 R /XYZ 85.039 367.73 null] >> endobj -5566 0 obj << -/D [5564 0 R /XYZ 85.039 781.388 null] +5633 0 obj << +/D [5628 0 R /XYZ 278.924 373.703 null] >> endobj -1766 0 obj << -/D [5564 0 R /XYZ 85.039 761.463 null] ->> endobj -5567 0 obj << -/D [5564 0 R /XYZ 85.039 729.909 null] ->> endobj -1770 0 obj << -/D [5564 0 R /XYZ 85.039 444.64 null] ->> endobj -5572 0 obj << -/D [5564 0 R /XYZ 85.039 426.901 null] ->> endobj -1774 0 obj << -/D [5564 0 R /XYZ 85.039 156.323 null] +1518 0 obj << +/D [5628 0 R /XYZ 85.039 136.342 null] >> endobj -5575 0 obj << -/D [5564 0 R /XYZ 85.039 133.005 null] +5634 0 obj << +/D [5628 0 R /XYZ 85.039 101.538 null] >> endobj -5563 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F66 3242 0 R /F14 2895 0 R /F35 2880 0 R >> -/XObject << /Im1 3957 0 R >> +5627 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5579 0 obj << -/Length 4353 -/Filter /FlateDecode ->> -stream -xÚ­;ko䶵ßý+ŒùÐZõL\lv{7¤‰»ë|(Ú"gdºšÑTÒÄëûëïyQ¢žc´E°Š<ä!Ï›Çîµÿ¹×q \G±«t_oWÎõŒ|¸rb#  æûû«Ûÿ ýk×Q‰“\ß?vëÊôõýîoëw?¼½»ÿÓ§›Özí&êfEñúݯw7îú3÷Þ}úøóýÇŸ?à—îú×;þåÓM¬×÷ ôñçnø퟿Ë_Z97ÿ¸ÿñêO÷íNÛ=À®Üæ¿®þöçzGúñÊQ:‰¯Ÿ¡í(†W°OøZ¾‹«ÏWi—â1ÿšgMQÅ÷BåEÐÐŽŠcÆu=¥]H8*pü–t®M:׋U…×i÷wdžÇsµ¯\}m­5FÈ c|O'*ˆƒ¾wûl{ãEë/7ÏóÖÍha[¯·åáfã®OÐSdØj2*òºáVùÈ¿§ -€òãPUóüúŽfY™ºK›ôúÓ̾UG‰¸þYq zˆOÖ© ôèØÚ>öpM<ö¾iNßÞÞ>??«"?ž¿žªüØäÇ'…ºÞx@©PGHWà†„¦”ÕÓ-eÕoHµ}Êÿç~ɾ{{|)Ùè(ž§ânW‡* ‚Ékó`—ÈmÏ2/yZùNx—è/ukÍóÒß$/Yøî÷Y•±ÖÄ03“»Þ6,Ñ/È!å¹â¯C L¯wYÁßéqÇm‘oò /VñW¸; -â¶/jt8!Uä$Dúerv@ ä Kä\BhÈ9Ä7IN ß_Q–g8ë›(ä%ñ:­HÐ~Gâ D%É:mdˆ?QZÓ'C6©t×O‹„+¸½ƒf%+‘ÄBß3]Oõ…$÷‰×}ÆûÃP ÔÑìñKf†ÀkŒø±ïïNàÄcYÉÎÌîm-±!AszFûp×ß0UÛäÞüs^f)h·)þï¥æÑÚI"X©Ð¦¯+ vËaQ> -Lï<Ðù¡ -Ô"íp - w™°ç®w ¼?0r¾€åŠýuõbN ”b&–#ùHûºB¹³<ÆžŠ‚x™‡- y6@xx¡ððßÛø>Š 6®¸M„Mk±2È-«îxè'è®~Ìò¹ý‚â\¯\Àžï#£Â=³XDZYÌÌs‡Ìã®Ç¶&Ž(çþÁçm@hз5ƒ5_cküX¹;²5õ¾|þM Ù`ÉãùðÝw൰¥Õoþow@žáé|–ƒ½…!X?gÚ´x‰ –Q¿Îü„A Â êR`.qZ»Ò<£ MòY‡ìÞX†ö¶Áy!Ý”w¦ËH¯­ø¸+]ÿ4À 4üÕ¼túžrÝ kaÆ0—¶€Íl€l’`2cª€…GÚì• mRÔ´X[2!_j!%^"Äï9kDé¤-CE¨4^>J= Ó²Sž š¡ar7< -fý [) -Tþ®C瑇ÅgàÔì·T6Fä1=ää¤r¹Ï9Z.ÖÇ7~b#„:é«m”ØV*>a•Ù }ouž\@àw™: ~ K ±„ÐpÄß$KXø„'Œë.^|j|~bqçKCêìe -Š:÷­bï<ø`gÀsM$ AÖ`üŸYã¯&‚€XyÁ€¬ AC<úk¾*€; £iż"z™›ßx˜¹ t\åƒs1uafcoLCØé€c€p7¿ uM„±½Ä_ïZÅöÆøh ±p (VŽ×ÊRëR¶îºÞø‰7/aúReÅŽÚÆCåGIMÊbk{!xï7¬c¡½Ëš4/lÅ äU>¢ÜV„„+'秳óVže¹=«™PüFžÃß3ò—†~b¾T Ç.t¶óš¹‹•Lùý&å——l>& ètäYl-/Ò‡¢sBk‹>Á”íQ«zVI¡£b7XVм’0@”Ä"BQ#|SJÂÆ÷öX²Ô#…Ø„bø­)^Ø Yºã–¥Á#¾G'nÝ{lïKö²[•å£LØKÇÐpÃXz¦eJù,ÍÕÓ´nýi‡}îžüHyá…àÑZ¸'ºtOKÍ= ñMÞ“…ïãáĬ‰gíÕïÙsßXT,ªQæØIÁ -)üzÞs8¾çO¼¥ÊxLdœ¿ï쨙g‡ŽØÁYõω{h+µq¸ªó¶A… ˜ƒ5k‹ +ÿî×»ÏlP(Ú6 -T”Àh­"7º`@ ôÆáš‹ÍÄö|ªÙSß•[µoÅÈEwC먿Ía¶Q`F›ëqÀp%æ¸6\º{ÿ—ybùA¤ÂØ%± ô2±†kˆÅ&ECLî$}“2&ãi÷¯e*j×U1,@üî†Óñ«ÙX@&v°Ò€Š?ݽÿFÂT I?Q†£O²@Ý?ÿZœª%J»Êà°·ÓJ3ôhÏJ÷ל¡4ø &Ä f]œv¯$´ªÐ½DèhÐd-ôÏó¹Õ×mœ_KF€èßåF;M´Ò±îïtÞè {¬I„&m× Bdzãf¦+.·8‰†ÄÁò•$îIÃŽ3k”0Q€,Y7“W%z õ^ ±^û°W'œ‰çfcM˜”d3jb×—‰¿ªÅ²°T´uÓKùÖ¤ÕWã÷6! ý“—6Ö‹½þ!æ/O GÇé{ÿƒ5/*ï]^eÛ¦“q‚#O…I?"˜’7ô”Ÿø×à0«`&JM3q aˆÖ_@Œ”Ìz.~¨$º•°€æ=tÁsYD(žËß”çbã3ioR£œ+”$âïÈDÄ\σg%Rï¹ t÷Ö€ =°ÇòÌ‘|e½vUåùio‚Ӽߎ³j¡Òþ€Ôó*\ GDè«ðÁš¯ M1¢`â}ÊèðpÈ›|; -Rÿ YŹTâ0Âýnõ0ãA¤GÓŒ®_™^ô=XËÓøR€.ñe·Ö<_ñMò¥…¯åKßM:¾ô=guÉ-ÔgŠBð…{ò)?¼x1 -`@fǬJñu•VCw;“h{6/E™Ê˜‰np:3ÿ˜U#WynÒ'Æ<« -ôˆ.}V¬i±ªxÚU¡ö{Œ9­aÿSV -lî™Ïõ©H@'±ò¼™¨ØqUäE¯cXûÄ“‹ k€.0¬µÖ,ÃŽðM1¬“âŽÓjGló«Ö‘|‰4?ÖÜKOtØè¢f·—¯INÔÈÑXøLÒ¿ŽÄôù;¬`ù›µïÄ3!áä”Sb|g2LÿãÄ=Ó&QSû¬þùDó¸Í¤«TÂÙ²À´œâƒøH†*=Ö§´}9`Ú€ˆÒ(%. Ì„ÇÚ>g…Å-®šîÁ‰à©6ì¢È)ÖcF”Œ$Ë¿T“±«%iuuYàâx/˜Ü‹Ãõ)=Éû§dA`:ÿ?™˜5ìFÞl‚HS`]a}™£a»sº±LcÃé\NáÁr‡ŒýZÂqÞ%‚0—š¹'ə٠$×szŽ.ŸàÖ}´ÞKÉßw[Õ~oI©O9¤ôÄÃ;ã3Î8HZ;”Ä\–ëhA®è’\/!4r=Ä7)×¾Ïò’ÂéV” 6Á†¯ì{I\v%ýl„9Ÿø·<”², ¨PðûRøFžûOmiÁ¤çÆ£CÏ;î <:~ßoï¯øÏ.(ðƒÿJÒ^»¡J.äì;˜©”}o+àûº»4ßösù“m’Z®ÉÊó› žÛŽ½4V¨ÞïÞo~iSõš Ô,üø Y‰|9w+ÒÄ‹ð8$FùÉï©J³’åʼnŠõ…ÐÚ—,tA²ŠdðMI–ïsVpÙG3¶†$ _Ó­ µóÒRî$†MBÈÜ¢oKì°+ËÉž;ëÕŽ¼#yv|5ŽÉgã0ºSÁU.CkîšÇ›"“‰‚z¬Š¹¢Š÷@wÏ¿«Õ3æËX2b -ƒ««[\ó\Am¤õ.耸@€.qÁBÃC|“\`áûˆg=[bî{šAØu ºÛH(óZØöËžÐÆ£­µz.Álz‘‘Æ…(8¾i¶çkÁ÷Š—\‚7x™oNiݬ&X5w“³¤#p–p½P"òWè‰>LÖ¸p"µÇ:E8²KüLó[»‹¥a«æn.ì Ñå|0ÛÆFÛ?Ç¢Âp‡ô Q™æ»–ƒÒ²ÿø\EÎsh“®Ï®”ËoøIôQs{GÄâ+×hfíÆëzƒ„%ø­@WŸûW]i­”Z1½-º¾]Þ_ƒ+–Yœ+•)äJQ½DL·ò}V僋 -0œcä0òÆþP§LQÒÑó'ñÝÁM}GJwµ”ìð=ˆ¦çk…nÒ6ÜOYÝ8`rÖ­çpfȾn™“‹Ì„¨Ø½÷-•uê}–5+nsEqy3.B"¿m“€çXÙ)o Ô7–:ë8Y?s ´cL¾‹¥Pz«lÃǺ©ÎƉo(e˜§²}’‰Í|S¿ÜcÂØTldüÁÜؘ;bËôÀ¼IC½Ç® In…%@"x´õg‰ö·í6ÞHO•±< ú™ ÝÕ–¡1ÊÄïÆÚ›ÞHúµ+ºþ£y|š|ëãÂfÃäBž4o¡ Ð µˆP,Ôß”…²ñ}¦JtH›Ü´È©ŒÂKN[jˆ¸A—)€$n­:£Ö½O’ÿ ?áò×Öµ¼^³4«Kô—Ïäj*Ê&¸å„L˜nÅ}õÀ­£LDh§Í* å_íȧ¬¿à|ìYÞø Û±~©†v•& Ùí)mö·My{xÙ˜rêÓi7aÿðVÂÐÌC,ìïŠ>¨þ…XõÑÊùáÕEÂo¢š¶ŸuÏVgÖýÄzüÇS:öMÕjl<5èÚgʼn»¨4*¶¼?h¿Ã}´bk©‘àÑœ³š­ºL·™ñ“®9ꮹ·tÐ¥p7¥Ï&(ß¿åÛs]ÝÖû´Ê¨æöP‚=¹"¼‡náOd÷ƒ¿ jŸ6d*D)ÀêF±ïÄ•Ÿ/ïJ”Ÿ\ªÂkaŠ»æRm×6SÚ5@6YÙÕ!»ßg¼[iîÔüUÌ\Ê5C§üS›¨1çج¸”\Ýž©'õíÌßajGy“9Oø×>¬üû¢Ùþ]ª¯U¬g§çÑKï ç–ß?Öã ÿ?ËlÀÆendstream +5639 0 obj << +/Length 2425 +/Filter /FlateDecode +>> +stream +xÚ­XÝoÛ8Ï_aôIjE$E}ì=µ{m/‹Ý4ÛfŸv÷A±[8Ùr%¹iù"%ÛjŠb‘Î g†¿™¡ZD𧙠#“/ÒL…&ËëÝU´ØÀʇ+%+!YMhÞÞ_]¿·ÉBEaå‹ûÇ‘ ck÷åŸÁÏÿzswÿîÓreŒ T.Wiš?ÿq·TÁgž½ûts{sûG1Lªà;\þøi™™àž‰nnÇå7¿½}Ã#FË¿ï¹zwï5õ:€V9ªùåêÏ¿£E Gúå* +Mž-žà; +,ï®@ÏÐÆFÆÍÕç«ß=+^‹¼kÎ*Žbe¢0Ëâ—-g£ÐF±·\¬&–S‘ +ãÈ,šî¯H¥ç§SQf6[L˜]t4•JT:4JŸH|_w`Þ~¹RÁ°\ÅÆu¿I0l+þxuð-ü]u¯xƒ èh«‚ásì+\ðÜ`'1Lƒþ°\é4 åu]4Lÿjã#úW¼©¬¾ÖkÑâE·;¼û|Ç›>Àä¶íÒaÝըꀻ¬z*§c¦adÃoW¨?þÖCÏ!5´ O´Í÷+ÊÁºÉË®i^pµýÐÕ/]}&qÞÕ‰Ÿ«u»/Án™ÖíÎ{†ìkøxÕ‰wÙ[*èJøêê¯K0{¨úÖÐØàô,§ÃÊÑ…JEœMðui“ èjtÞQ¤‘[‰hÕ3ŸI8€]b ^óv5,Їê?–+kÇ â•Š·]5Œr +9kdˆ {Ø_¶Â?¶qð´m™æ@q‡„_ë²â¹ ý/yî ‹¦ô™çFí;aûˆÌ:^¶õ(ïÔêhÙ×|Z o!Ž6¿G ì½¬"R¶¤Áþê×s¶ÀkD›0ú áBP‹…]°;õ *¸¾mÑ@+üÁqÐU4ÿš/Ò”ÛŸ˜á!º–ìWù@ŸQóÔ·‡:5„¥Q–’rÑDƒ8…’—ë~ÊT _»0FÊš¯°7O|A$°SÃ_‘ +ò7ÓlpÜŽ1AX×ð°Xª(9²÷H>›Švo5Qº´p¿D#¾v´*§èÃïÀNbRÈPê2¡¥y* Íœ%4s‘ÐÐóõ–è0Dg:Ì“’sRÌî‘dñeÙƒæÝ/i˜¦9J5ÍØØ s«×7;­ÿlA±Åï,S€e +>ŒÕ¡6©Ç²$Yd R‚Pf¢˜Ê£³0ÕVÀ|HÆ>GÐ8 ­M:OaÓ܉.U¶¬Æ=¬ƒžâé)_Îœ›#…zFUŽ¢²ä †“,Ô¹9¸á§seµÖ¡UùŒ²^9Gr®Ü‰”3>(k}<À­,†z}ý(`E£‹K$÷§¯÷ÐÓøï]N–ëw LŽ]Uwv²8MÂ(±/¸ÁŸÐä*Œt‚~“l6N!†!›ÍÝ„ÿ¥´ó©ZCh¢tÞ–B¤-ø›ËÙ{¹õ¹ö2ÞåEæyª\QJ¥€€\=‰#‡*ÑS/«ÈOÈak½¢Äy˜‰,¥£0I”0b´GÐ~Fx†¤œ¨,¸mÑ›ÑhàHužõAÁŠÏè qŸeN̾æTÉÃ$r$»¢™Kƒ:„ó1–#‘å,ÄWØ„I‚Qô¿b, (ºšöÀXÞõXa˜œ+ŒDÊSøEl¥1°Ù—Õ¤† l¯˜™ê‘5Ž˜fëVöcñ‡¿t'ê=*=Ðeð꤬Žâ$ Œ1;ç)Oåx”É©O“îDAbÖ ™¬ëZüÊ +¿ym@pRöÙ0â__ ‡¢a_^ÀK +ùj? Ù56Šo.t¡ø4E¡^MÈéz˜¨9ã‰'ÛÃá§ë맧§Ý\ãÇ +-l«æn‡]s‰i~ªÞy³%4Jà9'É +"ÇFi0é+¸P)(Öš&ˆŠO\ÅWØR µüÙP´\„©1TqªY’W)bK^.öò±+Äø+•§Yúo/´å1HÜ0Ö@‡E7–#¨í†ªÄ ,o^ßJW&û©ü£ÁÃtÕžùvÕ¡)Ö¢Åe˜>p¥4ƒ6„:Anù£‡ªz½¢PÃ(ÀÐ,ÎdKˆålP6J爚K}¨-‘ÅÊÄ|¡ñ,;ϬªMEx ¾2]=u5OZ¨|ù—ššhJaàq–·×¥Û_` gpl‘©¥IxæÑàHjÂÇ–ƒ&5¡2§1³sB* J[“ÌæOÃÎÁˆ»+ €O “0óƒø—þd_=LfZáåShõ+¥ <öñ‚EçÇÛq™÷Mº;Ü\Ç¥Löýð9/zWíË)ˆQ½DgëG•ä¸ó¼O9>úª`rR +>豩Òà*6²â„ø¢–=ÂÓ™TiÖ/Z9M5€Ï¢SrnãŸyfZ zôEÊñÙcf.T°Dæן³3~8|æ7†œAˆW ã›Áƒ¥0À‰/œ&U·?…3}~ú9Tûˆ˜Û£oñ*¼€ù…‘€Þ/àƒžrM¦¥ž`TÌf{ ÎÝøFè ·ô{©2¦¼(–ÄÅV$µûq®>}Û1 ¿ß”<¨¦Ox0ƒFwÉŠ¡øâUœ2Ï¥ÿNÒ?>Ñ/"`›™><:¨uÏNnÖôèfI‰’4!ä^"¢=.½¨'wj):ˆšåÚîßc7>)ïú§Üã$¥~ï} ªeÏ÷ÛbÿO¿›¸ùÒÝjjåtAè8;×ך,´™¹Tø¿RýXoendstream endobj -5578 0 obj << +5638 0 obj << /Type /Page -/Contents 5579 0 R -/Resources 5577 0 R +/Contents 5639 0 R +/Resources 5637 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5548 0 R -/Annots [ 5581 0 R 5582 0 R 5583 0 R 5584 0 R 5585 0 R 5586 0 R 5587 0 R 5588 0 R 5589 0 R 5590 0 R 5591 0 R 5592 0 R 5593 0 R 5594 0 R 5595 0 R 5596 0 R 5597 0 R 5598 0 R 5599 0 R 5600 0 R 5601 0 R 5602 0 R 5603 0 R ] +/Parent 5635 0 R +/Annots [ 5644 0 R ] >> endobj -5581 0 obj << +5636 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 546 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5645 0 R] +/Length 38179 +/Filter /FlateDecode +>> +stream +xÚì]‰b²0 .¥å,g¹ûþoù§otþÓmD7  æë—4iªõ&I¨Ó%Zg!l¾¨±ž—»»ûçŸ3óaœL‡¹¢Ú´ão‰lUŠ ÚVýiÛ¶3Š0?¦ðhô¨ƒGÔLÀc8ín3»“Åa <6óaå|Ÿvß= +ªµ?fv3 +Wχ™Ý£ãÃÄââüÅî»G¸(íÀc<ŸÅ;ÞÝÑÓã°Ø/ƒÝY;=J8ŒÀÙâé³PÒ*Ù£M>IäÿÅkb:¹€…jVê––3@K³YKwXØié õ ır[,äÇXfíŒæG~Pj¶PîR°0+µy4»Ç3âyw¼ÀB9†¦ÖÍ£œ?ËŒØKÀj»ÐÝùϼ`ºÃæÓa»Ý/f. +Ëi÷f>‹ù ËÃøâÑvÏÌa 0qtØÄ >JŠÿŒ…]w¸ÉñðÚÆ ŸÈ ÿWQ™PÊÙ°p*ÙÐuņ…¿Å y’eÙö5_” Æ bû6,lò¾ó&6^ØdÃÂÆ §þÂæ:Ÿ-œsoÃÂßâF„ê60œŠ nXø[¼°Å.ca‹/ü=^söÎ&g¼°Å7^ØäŒòcù† Hd<!ùµàÏ7]íÆ ¿ b‰…Üâ#ñ}îõô¿iYÒ‡¥ë ®[úèy8ôæºûVþè5ÆÁÂ8ëO¥t…¤l‚æ FIPÓÈ{ÍGCztn»— (ýg;+d.­E ÿ6/lr]Xˆ÷‚ML_;¯t—Íä~Ì ˜Ÿ¸AôäŒ. +±ÐG͇3Èwþ,K^˜Õ5b_6Rc ˜…”Å–·Œ@J×¾ +ÊçÔ5k±…nà~:6^ø,øáb’U\N*}5±Ñ‡vJzüt?ì3ã÷‚ç`ÏÝDO1·ÚF2¨q7^øŠ¥[] ß ‹ÖKi’‚ÿ‘ÆðJ6U•^¤vvëgååüycÜ ‘™gÆ/Ùò‚íÆ77 Ù‰u]Z%å_ætÑIÀ5 ÎΟ›Ö.ž ¶ÜúIó —aý”žæ…ð TSÊQ÷5tèV'Kû¼"°[ †¼aðl‘ ŠOÉ„kPvjÆ‚4¬·ª-¬à’Ì”Lˆë·8ÌÌÚWæ3Ådhæ)Ѓ°É¸bå—³J.ðÂ, +â…:f(ŒÜÒ-c~æ½çÒ‹KØTúžÜ‘ „ ·¸<é÷X8gšŽ;¾Íú02­ÅÛŸ?7µåà¼c [BsjÞ™¯[ÂSãsHn Ñá +{„BƒnvÏÿ,/PNî“š3 +Ï~“¾Æ­éÙ‚V²6N˜INðmÜjSÓ: 8×~['ÂÏ7ºÞufC cí ÖÐÎFRFÅ91¾³K(1%H­KÒ‚©å‚²—µxlm·ì©~ÂÐ Rýױᢨïù §¶ õKvƒ q#ï ^ä6¦sÌC4Óu÷Ñ´ ±˜’¶Å³«‡~>Y&Íg +L<ÎÙ>—«=]ƒoFJ¡a´# |ŽÌww–|×bÜì/#p“?Ë Æ}úÓ;¶üî@  7¿|%€ffcw°õþ°3ñtMa¬¥è€,/”ægσ=jx+Hí|çAÙn²ê,J‘˜z¿‰(=_Ó´e×a¨)n=|ÁkO¡ ðÊW‰KþØjI/Ù^§ƒ»‹/FÃYÛvÛÂ|ÆÂ>ˆ=a!+Íæ{.ˆ<>“‹¦”K½¹MC/t{çÜóüï,jf•·W8Mñ"¬^&–¾$Q; †¡kN„Ãûì•q‡¿íÂ1P¥U5ä=xÃ`öc‘å ¾0J¡N°ÖM›ÏXB”}XµéŒp-À¯V¬Qž®jÀþÂ*Á%¤B;^Pà=`=.ØH ^‡ñäÎñb°„l´¸9XOV?cè”4Þ„…EBÇ´÷uoºþ½Át&ÓÚ œ¸DVÙåqÜ.6ðýÆæ7%7-’S,åæ…¯A€{`ŠÒy÷i¼°ëÓbÒ*ÓiOãHB : ¥`Ñ-xÊJˆP»¦ 5<êºç˜8®³iR Y@ƒ¬…"0åâs +s5úºj,” \gðà0$ âÑQpÖ•ü,Lø ;f´ ìŽÌŠ|«ü»ÀÝæÚM C¶1;nšôýhõõ}?]±œ”¼ +–_e…éL=´F=ä˜8Ë`ÁŒ‘ÇQëã|$\“ýG!—Ü=¸é²'.£Ï7^xÒÂò<:»Ó“ü³÷ö2¾âÌø €={”!ÉL|À¬ÿÀ»ðŽÑ£ý—g½;3â‘Åéí òéŽùüL#/FŒ£˜äL{PŸ¼ Ù%ZØ™NÉxÛ_½·P5m‘Ž‡bùÅq¤™B\ëUðËiá&Kã­—EûÖ,€Œ[‡í„,ý$Ë+tÙ6Žtpê(¥¿¦VXB‚WµäǾÛ_È'uŸM$Ïâ‚Œ·NÇäpørè•Ù£ŽšövN„IÜŽ½>;ÁÃ蟉•;DZ,¸wâÐ,±,ò§ø2‚·ÅÌH¾jM É< _ÔÒåøÂaf[2ò9[Ì%Wžvß“ª= +1Da~™Àb‰‚ànhé-ô§^ ÚóÂòDg¼°D«Í÷ØY~[Üy›×v â Q¼¿™\j«¯;o¡?Ï’8 NvüâKfòÐÙÇgë2r›…;Û”á,IyÓ°#»å .Ò×yá8¤½ ìm¼°Íw~€‚…ì†ãwCôVѼã6l·Ëö°yl蜬SÍã9V1y%:Roï:rò+&,мpœ<••Ûmã…à…óim‡xšu /¸Öè`ª—>ºà _à…Š‡±»›ìG¾öåQ2KGiKgþÂQì:·nP²ñÂÆ 7±@”pN°Ð,§<ƒE<9怓ÞíY³¡±É|/ì/Ãó£]D -Ƥèu,[A'¼p<ðçÞxÁüÌeoX8óÂ3,ð… t”p´ìa‡‹ø<Ö³·ªLa‹d /ìÎÍx¹ðÒ½u-f}ô£(ã /œæºúÁž*6^Øä–ÜÍG:ÂB¼iÌñ]žÝrl¨ "Ÿ­ã…™üÃ̶‹¨»Ž…Ó¸óNúAXØæ;nvÞ6‚pÒk%ËÔ¢ù gxŠ‡­â † aᘚKX/lò(/Ð{¼_µ‘vp8Œ•î³—¼›byü‚¢Oá öe^8™kñÓl¤Þ"&}÷1,œiè¸ÏÁ;ìǸœœá]¸lÉ Ð È¥A"¯ª/÷èÆ »Çmšh£ž³¯…Ñ­÷.Žîx—‹e½?%]ðü aŠi¯½ª.úò=Â’•¼pW÷˜ëŽl¼°Å®¹«kæ;ŸZÞ'ªä_-9ÌÿcÁ .MwÞµ?^9SXƾ‰Lßå…-CØ?“xåÞ= +z +ï¬ò +ºÔÿË-¾p «æ;/8 8›§œïÉ„¢Ð?ª»3µ—œóBïºA·H:Ÿm¦³5n¶†ŽiJ.ü–É ½Ñý£¦¹Ç]ÊÁÛxa-/ÜÄÂ…¹™6Õv?¼išãP±5N²è?Áy¼&“Ú!«£j}ý.#ï>/sŽ¥§ñp†Ç ±™¦’ϵ稙ð‘çÚ¤]3ûýd¦`FbM͇ÌvBrpiŸÃ¾'“Ò7^XÍ 7ƒ¶Æ?1@fÍìOëÞMÃNÉ9¦î¹9-´c8:S¸ëðïóÂQűqáµØäB}8Nx‘ÖáI¡D餪CšãZ þàsÄÐnEä×:„ª¦Ÿbá„XÇua&ƒ-¿æÎq† gC2i]7ø “u³P¦< ö&§ÑþÄ¢ò*:[OA´œ‹”÷Ó<¡ù-vÒÚx”{Ç_XÌ6²eÿöW<ºW¼öOæ…@…IGWXm$G‡m…º¶@£}S¬"M6RÙÆ£ìQC‹£ÈÑQ‹“Z›®¯’l¤]·» Èi +q¿ð|@ñ&Ó%by’Íš>MŽÂ>ÙM”°³Gx™ÏtÔX¿nÉÀs>ïX¥™Û©×%Ê“äƒçxžú ¾J™T·\ÙšA1oGk9q’ÈܬibýC&Y–™‚à/hS,eW“n“—b!™*L€3†|[¨boÉØy˜AsØÖs “}¬mœËO”óÈÆ8‡lÑùx7Q"XPN2ÕˆùHåܘmLõ”Œøˆ1o×=pÝœŠ[–%ý\,œò‚/¿íÓ[ÚšNjÊ×Åðç‘$ÁDXðuPib«P”Jˆ¾Ìl|ítÕ¦æÏ`áÎTXóÄÌùŸ{PKYî·MºÝì—ÚÉç|ð}MÆÍ~Ež]Óbþ‚–¿?É”¹±¼`ÝšùïxõwÖϵ.ñ‚gªùÊW®åS¾.V`A×$=àÇ·¼PC7!è^ƒà |ù¢ØÔü1,䦗{¯Ã̹Û,V–Š–JÅ¢ÅD5“dÑwÏ[ö%¿x¹ÜÙ(ýÉ< <\ži9;¸z‚€Ó #ß—d +ŽÇ«¦ÊI_¯•ü­¼ ¨©DÁQ(D¯‘û{^ÐU¡ H!©ÁRW¶Z—î&^ˆÚxbé"™ºƒýw>·xÀhYð‚©þx¿DÂè—võ³–?þRÏ–Fšf>øG!/•'rfÊ<ºû‰~ùL¶µ2–‡‹vK÷ `ô¸K,HÝGîtñ‰Ò³xºŒÏu ÏyAdš BÒÒƒ(Ò>¡ö]Ühå8HE›F•f°]LvéP˜U t¤ˆ#ŽBuLmcª— žãõMvÒ*§2‘Èãž×_àœšUj¹‡ÎK­Ò±ïåñœ·Lš9÷zvù×ÉÆéLË­gW™/Þ™± f¼Tn&“}?²TÉ–Ê<[v*”À;¹ý35Hû©ØµãÈ›;³lªFTv?NýÚæµ]ÆÂñúοAøõÉ¡?D^›tŒÞâÎkxaÃÂGòÂ×¾³T¦6^x·H·Æup,÷;òTI¶)ÿ)Bº ßte­JÝ¿Âäÿ^GŽ×oºþ½€lXø.,ø:lqÐ- }&¥£ìòÅuç/Hy|»/‘•òäö”ħ·§Ä2õãÅí) 7þ¬ ¸aáû°ÀÁ$]Ü.ŠjÅmQö>?¨Ãm¾?'íµÛÅûÙÆýFÔã÷öìåêvN¯Æü£> NѵÞ4r=K¾¸Í¢ 2?˦ÛN¨•ý«ýÝ=·/èaÿévYØ©Ðév¾ß­Èù·ù¾³QŽ»Wã8ÝODöóÝ ²÷ýسŠ˜çû{oöê{trG'÷+Ò7-Û°ðÑXè;ðΪû¹ÑN^û™ãg°xÿ.,„)â?|Lõÿxf5ÆAþ›±=³F‰/ß…ä‡aHò'(¾¡žê§ÅÚ^Œ…gxÁ¤¦ü²øÂÏ—o‰/ün,<Ë jçÙH¯Îö«yá,´/üI^/l¼°ñ‚¦CUá_…ø^Hâ(ò7,ü-^¸Gq<êÌÎÈ›y'~¦û8fšÅq¯ß,MÃc?×(Ž©Ù]j:ínßœw‡×~ä½ Ñ_Øxá«’S +jiÔ¶µND —‚Û¶×nkHÚÀxƒÖ í¦mËAï`wÏ잉VdûÝSct ?ÈFÚ°°ñÂR¸R `!H@íqÒƤOÐø¶Ô ¨}E™Ó*”Ô¤l[w¿»@fw/”੶c+ë|€´aaã…¥ø Ã(¸Dnã³¾l¢Qú‹$oOzAÊÞmb9ÆiÙÏ[æÝaKÙÌo²°±¯ÝšˆxÃÂ&Ë ç¡wn¨êJJ©%¥¬áß8²ùõüoÿæô¯ß¿ivŸßÜ홓¸oÁÂþB¤©»aáoñÂÍX[vžI÷¼0ßqüw`Aý‚øBþ)C}ù·›)Ãú¿Çnå`°ñ¥"Wþ `#}Z|ÁuuÑÙ™_5<¤‘öœÔr·ièc@¦Âpz|Æ ô±v‡ÓÕæfÝÙ\³Ÿ“l‚ýç?˜wáz¼Üì6ßÅ ôzÜ™;Ä¥¯„ÂÚr#Ÿ€…Ïâ)¸m94Ô] Îœ2¿šÛbݨÛâ?ô¸rôZ¤ ]'?NZiVÍx«s]IHðôcâÂõx¹Ùè»xázÜÙøÎô•6R×…?Å_ø0^( +ejÆŽ +uUëX˜:W‰#°N¿_غÌÖ â Qñ1µ-M5±d®”ó(f:GÔ‡Ý^šæ’\¢ÜD‹ŒÚyQ§ÊòBì`tÅÁÀ ,$UKb£šðDç'Ó#±ãØT-1)”£œŒôâÏ·¿ ‰á…D„UÀf^ :Å}§m$‹í¸ÐÏ"3”ìOuCUÔ;3qìT‡`ÁßBÑ +0±ÅmkÛÿ ŠÔd‡…Â|µ“˜ýAïpf愶¿Bj´Û‹…j2ëg,¸¦˜{h¿k•ÀûâÖì'EWMôX‹¶Ê be­Z8Ÿu˜sVðBawv©µì÷í¼`|çìqSˆöŒÉ‘±^;,Ę¯ä…|ÃÂÑGÔ`AwÉö¼ý‡/b!u*“Df»òÌôèý¾Fx-ÀÚ¯¨,»D§<‹í€þ…86-À'Ÿ°Šî*=cÁˆ()º|‡°®L µ¡ˆ‚;ƒ5r[Á„‡:Ã$a’YËÌ3׌ZV•të+¯wsø 3£T½áà Ä,Çæ1s1 ‰ÞÎ ¡jkúÄh‘3ÔewSÊç|ç×Îñ~ÊFÊ‘ç¡Á‚±Ñ ¢vÐc;c!É <Å…nTÚ4Mjó[2UôÚk,ˆ0SÈUqè€cŒí·*Ÿmª•ˆcpX‡Öåð)‹…XEœTa¡|Zø`i!Uð¼kcSa§'Æé0ÇÏX@@^þBŒAϱ7(VƒÉ%ìjh¼Ьϫ))³nk^¬WT(öåe +sU{©ê{UÙáh»nSîtà*Àe£Ý" ÿ=¾PuÝ•ù 9EûΉŽcÀÁ(U!³¥`f”Ê•6ÒÛy~Ô|焸:©\u¾–&ÖVj^ä:í¨.]0â‰ãRÏ¡ÐZÐ"Ð L̈R]¯é7cqÒ:ÍEå˜*R‘é¸Ðå@_NŠ4Žà¨Ð£S2A&è–“úç²ö›)îħÀíÂö¢ÄUäOËJte­K΄t­UrÖäʼc[ŒÝg†wy¸®Ú2±6,*ó +ÁEßñÞ[çµ%» ,RˆR3‚ùÈM#t€‰²•¼ðXø ø‚ë¬þFò\÷Æ¢A-×óÒUG?¯}e†’ÌcWè£õ²|Þ#ßg[,³?.%`LÇ,žæ6iÂíNÏ&ÖœN1=äóC¾k"?´tØþué7Ån¬ï<µÿ(hCF™aœD¢˜a¥Ú1ƒ\[ÂøżðŒôaqçýPÊI•cíªðVÀb2Á»á¿¡÷ì»Ã·/vŽ÷xsÜùQß™º¢§ÉPPpê6à®[ö{^ˆý•¼ðþq¤OËGòHùñSc”ÐèÆ—ÌÁàÿ¯ FgHäá‡/vöùÿ±â…g° =ð‰Ü¶–¤¤H¥‰ÍÜ>øÎïðüg°°ÕGú@ùß¼@qQ¤—±Àâ2”gZåœcE„ƒäsãH¯åõDM}³¤#Ú°ðaXxkÜùaßYzñˆhWSÆ#_!IrŒ½•Xx­ïüìúþ/ÜB‚ôÐÃXàªæ©Ÿ[2ö!qgµaaã…/ +oŸˆµÉ¨#]$¯ä#%+±°ñÂ&Å ÏÍ_`1z9OU­ÍSÝxa“7ðBÇQxeî?®Väæ)>¥×Âpë}ç·ó‚)ÅŸ’îÚâ-›¼A̺<ÿ 7×ñ\á;3¿>-Yé^>Š…kçµ}/Lñ…VmòAÒ:o‹/äÉx/IÊ,m½Ý +T’§7Fy<’´rú‚®__x &î–›|”øú¿ó•¸3'êÎO)½±i‘dÈëÙˆìâk½ ëy£Yï¡%äJÿÜ<µYèKØâÎ Ð"…hª”(³® uJž•B©B.ê#ÿXPÏò¦ D¨îÊÜÿîNMÖ‹V–*Å]eÔ¿¯ºÎÊS5 +ž‰õqçú¥ BMÒ¶¯DEmAE“w]Ru£ŠÖ#W•QÜul?¦jÓÔWñÂÛ±°É&a OÒR!G™#i28PÐUHÅld€ÞÇ‹`ÛJ5/ŒÛ/¹É×Ä뜛68%MjàBeŸú”‹Î‘xœ®BŒÅ‡´¤«}ç6ù(¹ë;ÓAX!j#–¶1c][S +fž':¤ŠÑWéN2¬†uñ…6ù0 Û¶¾=ŽäuJTÂŒ# °‘/T´ï”r„PU/‹;S¼À2ù28øOå`PJ³w|é9ãØ—›ö½Ã%¸>÷?ó|ï^îQÈGÔKÊ}ϺÈ&mã a(YO‘Ïsÿcµf.Ûš¡ý–¼Füwm… ôè×"”"ïø=§m×ÎyÚäµÂÚ/ÍýŸ ]˜ŠH»ú`‹7Žó¶{ÄVtö£2Ê°rôõ¾Ï3µFíãß_HD!=ÑlŠù±qçË>-‹Üð•E$Wš=…Q^ñ*+¡xYo‹;'ïŠomò^x~¾³<É8ºµ]zi€V¢³^õù¸‚óðaoä…ŠûÊÝó]¼\óïaõ·Ë‰¡¾GçlãÖ¬‘û*Z³øîÏá…Áü ñ¦˜ïðÓºvŸ´‘$¸(è­$WìQ,01U¹}‘Ǽ÷xÑù$ôÿ_½”ÛgÎÈ “M1?MîøΩ¢2IiƦ9=t””íÖö¤’9îöñÏÖnbA_ø!êŸ6*c*UoòY’y¡wÛw–]ÚÔYïا¾;ÊÞE¨‰0ö%óqQ£dÀîašèêé0 +w膅M¾&áݹÿ’#±A¸SÒ3$<Þ«“ºt:éy觞÷ï_%LoX¸)#zI3YrÇø3÷,û‘XX9Ž„„Ÿ°Ú`A"âym™$ŽOú¨_Ž#±x‹!}(¾‘sÂÒ $Y¼f¾Xµ÷òz÷,ð Ón^räC]‚Òuã˾sŸâxÍ„gÑË1ËkƒàÅMY)2ð'×_øû°¨ü3±ÀÕn>Tç,éV¯¹n´÷£K“‹ÎT Fœ(y#¾°®nžÅ ½ZŒ¬Ÿ°Ô”&ê 2 +þS°ðÎymcE¼6Ky)v™Æmë›Èý8w®±ÏQŠSiÖø`:„7rÍ㛈fî¸: +õô‡Â¸NØ·æ:+ú6ëΆ..A¹Q]ªeM?#œÓ¬1\AXðëˆ7ð*ÄD ²1”ƒ NXCr»`*y5ö£Oʼº_X· A™»™¹ ¼m²ÑIKGjÞÓŠÌrýc°ðÆùÎäQBòZ"¤ªŽ'uש(]…uÑ)RCŒ•§:®HÒ´Aâ +·X7­c­©x¤pt¦:³´xÑ©'ê¨h= +ͦ*ÒN[Ǥ†ýpÜ‘„Ãa&ÝØWAï–ª)UZRðkÒ6‘(u!"óS¢ˆ¢k•¢›±ÐºRµ«hGNË/pÕ¦+j…ÑTu!"À_Ž ="¢Ãñú…}Ÿœ€!Šgw&~ª•!ú-¼€L0±è<³`ll$¦€J•›…¤ú 1Ë&"ÔYœsEµY'R¬™Í%,2›ªˆ]ÁäÚ+íj%´íÚif•ŸPQ³N'‘7«oÝöqíp£Ò3Ö/¨¹0¯ˆŽ§ÃèdÎÌ¢å)9`îæug–‡k½ŸÁ kë汸n“^šzþÈUÙH2/¨Ýãü 0¦Nã©ŽÉH}üÖÄL=×ÌðkxÁ,ÙÙ¬k  HÁ í¢Ðfmg=âέ ë–F§©"¼ã5sº˜…ණj¯èHSãx”"s£&a':§kS»>¨ùÖ‰"ižLÓv­bx!2Ïåì/sî‹Ûuj…ª1 ŒfÂ5?ÿ0,\áϹ3÷ÿP:ÏL•&¸ÆB&ó«“¢âÎÐf}ð¦ÓS,´åÍ$Î-—ÑpMýž_$˜<3C#%yÖDP®zn–"„˜•a¹¨Ÿ”: kG à… l“2Š²tÎI7XÐEêøCEBÛ[Ç¢B5aÁ‰“Úu˜;'.£Úžè$Ïb,:j´Ÿ¢ Å 3/,$\V`žás,˜U +ÇÂBn´ôšÿøêÎ’;!»æd;ŽÿŠ÷„XYûTúŽSéÏñ(/ “³Ò&¨è)䵈‚Í®ka—\6Ý¿×ƨ£Ð džB ïÄà:ÌXHUfF~D™NÑ`ÁpCØF™5|: >ˆ±žŒfK'Üa¡îŒÏÀÌþ¸ã`.‰Á¬¨kZ·?”0,™Å²:qŠÀ`?åMIžHÙîo#ò—Œ'¼@ŸËjýT,ääq,ˆt Œ‰.èH.•“DªÆ*ÐÆF—7蔫‰ãÂ>½rFpZSp¬w¼`Ü =¶ ¦žV,wUÚ8­›@³•¯»-jkO8.!t‡®ªÀ)°1B;©ÅTßSƒ ©Q§ È8NYˆs,0ââ£ü…[_q±¦¶ð™Æß°¥^ƒ…_Î ¹xÜ_ðˬx5‘«,™ö´Ó3_ʱ÷4š’š£Fnêv]²±òéÜL-åö¦”xà±mÖ©ÃƳC·MœiêÏu_6~nâj4îÃy9JH›óê°´!½,Ja8sGÁùà—ä‡ôaN³Ð¿ ù$yf½¶Û« w÷m¤„Q³Šj"¯nëx!“ÙÔýý¼à}Íêö¯”Ößódµã”ˆ Ǭ%ýY_}ž_Ѻð™µHn­ävÉw>å"G‰¡ÐˆUÑ/ðÊ©°6ÕŠg°`×kû)¼€œ¯]*¾œƒÁæf‹Õ +žT04Ꜯû(‰:˜tW¼…£5ª¾:Ý“Åât-’s,t»Ôä® «EöVðÂ(Rp+-Rí;ãX0cªoŠ/<Î :ÿZ3¡7›} õÇ.„²Ï +¾Þˆ/ç`ô|7ÁÿYéûÓÀó(AfäC×*ðÀÐä!Ïžâ…ÈÌ€¨:MHÙç…œçcáMñ…Çya“aázÜytSŸŠ§’‚3ö,œÏ_8ÂLëØÑ ­ÓûJ]ò­Vð‚kà;ÝW¢­|±Æm,¼/î¼aá]ÂnÇ›–mS¯IÛv!} ’˜ßÁBfªÒƒC÷Z:N.å¥%VðBlþœ./iî WËKžøÇò|+l!ôÖí?ËÍhåÿ‘äúí?I>ßô8UÚ¿·Y¦ŒÞÊhæ&Àžªòž6”Øß¹/dÐ¥Qbg™›ª?ÆêÂ,˜Â%ŽU0)Wa! Òô7,]7XŸ!-Z?†¨‹eW€œPOXp˜SC1 hÙXUŽk÷¨vy0 !E1T‘öïõ@<ÙURqØh%<ÚU °HìeW\Áñ s“¥¿ÃwfaW…±@ÛÆø I¥ÀAµ® +£½µ“›µš’!Wæþûm‚ï ®²[E¯vCâ·Ø56“êÅšk×Ç‘ +ÕàÖ~(Jb¸ 2åw†œÇ´V¤¬”÷ç°ÀUƒœÖ÷ák*+9]FÖÊñ£Z€Y*›ejºŠºµµ¾Ì8CѺ’ ’䢲™©{g`H:ÀÜ8oÀ Êc¤ ð[™j’u ¾¦ÔQ:h?ǻʒ+þ*]WCÒ¤°ª{±ˆ[qg¿«J7Ñv +Ó¡š™º"ðW9M¢eíTQ¾b)q»"ž³esyš˜2Ñð¾Ó^zì |Ý8RÇ‘ÿ[ÀwU +xêtÝ]QÕuÍÚ'1ú+Ûñ`xÎjâé¼°›}OB±ÓU½Ž§(|-œÁ1*á ©Î;l +¤S`ûÌá?ç{bDˆ+ãHyÒ÷+“+Ü·ž¼Ï ñ,<$ß‘ôKâ “‰Íecò£øN>§Åï;™ËQòÝÐJ~R1%Éöÿ3ðí«ü4‚Tv?É=þêú vÁþ˜w?FèW`á[ò‘~G|a¢U»â¿êd¦®”PÊè}Q7âÎ}½f]Ë i\´Þ½}Ï×_Øxá›l¤.ý¯«ä&W*,±û“’ó^w¦±™ÿ)îñ‚ä©‹6^øSòkòTõ9=r[÷î>·s¶sSè`÷ü(‘Ðä˜Pnó4C/ýÐÌñûŸZ+l“· #Åq^Fo†Bo]ž*Û˜Ž_Â%¾Ø­gû¼óœgT8ØQˆ*5T*4Ë] mšsê?à/ .=݉±Gˆ«WE×â<ܯ°aa“ÿŠ¶Æ_¸S+ ¥Œ¥ˆšœ³†K Ñ<3ŽDÉ J”Éð3 G†Ç‘n”âßä· +ŸH/ÿê,~ÄFú¢ï<›efÍÉ(³K²ŠñÊôÄUë/ØU:‡Ú&âëÎIÄué6íø[bâ _žûÏü¼ y܉/øª +be­Å‚4Kì¼ZüšøB#Hí‘ÐW£ —¦énñ…MNzâëkÚfÜ_9¦º + +jÎ"ר-3½êÌœž_Ü +^ð7ªžQ˜ ŒË0ü¸ó&ëy\Ÿû¿Î_«°Ðó>»…¨ÅA×™u +ÌÆÊ}Â_`bÐÈ) +€ j\çI/lrÎ 7Ö_ ¯ãp*îÖÙæn‰üƒ-ð…­+ÞœvGHNoš×°ç…¹<ùÃX8å…èJ3·Zß°°ÉzñÍâ##«Z²ºUqæ«g½h+6v-éiÑ*–à$aÛt$m'íî n•O9ìž ³{¯y涧sÿ–ýäëÒšÃ:q.ßí-üeXxc|Á©tv_’{·ïÜÜrûw_’å³ãÃôíšq““/ïGåà´ýûòÿšXÛkå¯óÂVÄì=rc-’?…÷òÂ&ï ý<,ŒmúJ,<3¯-ª®Ø°ð·$Aê?mÅJ™½ò²6)gÃÂ&›lXØd“¥t[a¦M6Ù°°ÉÇIN¥þ–Ðι¶váŸþZ”jɆ…¿%챶„>%'Ë°åÙsÍÜúÔÙã ÕV€ã=òšùÎÏþêJ‰gn'k>Õ†Rø&/¼/î\m¼ðyt<|Xxq¶ŽgýD3!¹¹ÖùÆ /|/þïúηåæ0þ;×åÙ°ð&É‚4-ó……õë;?…œsîmXØdã…·Ê°aaÃÂñ†…M> &™¬¶äZ†ÞZ^ ÌNÉ®äæ}, +²iƆ+ÜQCißQ$þ +/DBU¨K¢¾aa“û’Deé’ï,UJË6ЄX¡çy!>­[?T^^tc!º·Í_Ø°ð&1ñ…S˜F]ªIåiš'4Ëžã…®2#£1o1Khžegaæ›X`oSÝ°ð&±ñ…Oâ…Ætâ8Õ¾hEª±RNò/ ¤G"]*°µ"ÎÂÌwã *‹roò?¾Úû¼@>‘PÎS¡(>³àVòÂ`4:¢(ó !ý(âaÁÐeAŽj|×]µo9íï¿;ã +^ø$,HU³²uá_«@¶Ú_`à/ÄÊÓ\°GýË Duóí÷N´ï8í¯¿Ã÷Úßáõa¼J¬:ÒèZ9¢Ê¾0ŽÔ(á¨XwÊQéã¾sç8q(û~É Á6y½$u{§@dnr ?iL•Iž;@’£ü ñ…8Ö S¡ÎG.ŸŒ/‡ÉñÛ%)Äø†ÓþzÉð=^ø¸øBßâ°P·®z/”Ê ;çã­ÂÂ[~3ÑoXø/X@? ÚªáfEÊ•qg·ªŠ[úL,H–`!)Ûаñ +ù¶|¤w`soPaè£My¿ŸLuØÁBvjÑdÉS¼pzXžåb!G oÀ«Z+ÂÛˆáÛy9DT2Ž4œ„ÃrÇ}Šºàd€ôâÀòý¹<ïÀB¨,jº)ï·óÂ'ÅN3€rÿ¹|$r2†šøÉsñ…7ØH´°´€6Zø~^Ÿw. ×—.¢$)᪙+ ¹_`/Ò¡¡kx¥El°8ÔÔeZ÷eæg:q‹E¸(“µqç·øÎÈC³ÑÂæ¬p×bª«ZW5€CPÒèTð‡`âä+x¡˜´.UQ©8¥Öõ“^ð¾È84/ÒOæ…‘b8óæ-¼Å_ø ^0 D' +Û:Y\$1ÉLBq³\\.ô¨‚û¼fvL¼US^…?!Œ+®‘o’Wùœ þ‘þCOÚb£…wðBEeüþ<ÕØ`ü"ºÎQa"|T–¸¡²–QÑv]×÷y›ù‘NãµN×E‘B±È2BKË}™0ÍÏ»ßGêû~|O¬bå±Muÿn|Áb¡,QÅRw¸­ž±èA˜·ù}^(vXàp™¦¨€&,äRØæÇŽ;3oPxO|á3°0ªXçðÒ¸Ï Sí À®4x]Pådˆîó‚6UU>VƒÜ ¹2éæšò6ÒˆÚ5M£x¦”¯z ÑÏÇÂÏ™ï,³qÔ’Ùü ÛÅ›~L¡oÏP‚’u¼ÀúPã +]‚”.rSâëRíÜ>ß•² Víƒæh°‡õÍÔONï#¼Pk•dží÷Ó©ûfÖ3©Cº<Ù„F|m(g…ÓQ`4Q̇€6^xÃ8Ò ©íîy§pöè8’Él2s^‚WÃUÙcãH§X`amYá$ƒÌúÀ*-{˜NµŠY*h\»O?QÀñ.,6×Ð\óvX8ÛÌb;¼°îüà ÈGa!›°Pï4)÷ÑøBØ’ªSø ©Î¡¥>žx!¡k±ð0ä ,ô¶oMÏôÐjˆÛ_å3†jOa£Òvå鉉/{«ìå£X˜NØ4§1jf¹f˜`›Ù´ÜoM¼@ÙÓ®ðÓ;Œ~Nu›5ãHDtÉçñBmÿsã1ü(/Ô +c\ÁG·sØdë÷“¿PWÄcªsä 9׳ÑXñ%¶jû%^YšîM 4™H' ±&-á\W¼ç«X [¯qNȇϓñIìÜF»y ›JŽF¶‡!ËÆ´>ö¨_4Ó{Qcw=F²{±>nÀ¿ú`õŠ/,y·\g™NÕü´Û¿Ë ‰üŸ©J_¾Ocå™IÑ“qçÉ[¸Eb¨›»vË—xa¤AmÉà*/€±/ÇÂhCÁþ8)yИ˜´ L7î2œ-eØ4»hxOh0¦``ÿàÉîk`¨œš¿€T^†°[Ò°±çp?#XýãΆ2¥ˆéNtªÈä_ØpZª$QBà YÕ:¤-žŒ;Oê\Š‘^ùsŽÃ×xºõŽ &µ‚ÓZ’È7#¬ã£6²}kŒ»iz;?¼%šŠ§¨DíZOHzÅ"â‡'¾’Ðë׋°y¹÷¥¬c“ú|›¤éÆ Ob! ™ÉžàF5Øãg]îò‚7ÅåXÌxǾÍý&àÏæ#±øj—kRIÙñ… 6’Ýi²‘¤‘5åI:Þ”xú(&¿?MÙ>PÒœ¼Ù¾ô$ïÃÓÊÉv“²LO’H8[`¡‰ƒ9‚ø!÷–ôl>’f:`!ºh³œ)ÝWx<ã`ç;Ïê ú룞­´·¯a”6XœPz¶»nÒ´ Lì{—H2}k î¶M±E¸ À¼§ ’[¸Ê~Š6µI¢b/ÍüÉ'^À¶©à²iù‘¼@ÁÚs·ù gáxÊ=ØHÆo¼>²¿ îª1Õ9”6Ѥãõã<\Ä‚™51õßÍ.cÜB®v9yþ;ï§P—f¤Šßñ 9ˆsϼjJsÞÛ ´—[Çfvâöó9&^HMŒÞmpšö?Ä_xo|¿‘ºõñ…Þ=tÙÿ‡äIÛq(ölÈuÝ4%ïÍ´ž5Xˆ—ë§È…s‡>Ÿ,$»×nÑî¼hoš5å<ˆI{ v“”4ZŽ©Nµ1¡ÇiçxÁœS ÄœŠýá½X¸xX09Á7SÎÍj5$šúè~|!/Ä‹\ Æ̤E†É Ò…›6eö7Çêç|¤4ŠÊÃÍM§ Ât7¢Ê"Ó½§‡„ØÙ›8¸ìøàó¥‚Ïñ…Ý0mc¾‘ý”œ¨¦Ï>c! ÍõÊO‰Î}8/`ò”tÇø¦ÝsÍ4ë±ÐB¯â…Ô?Ê ›3ï}¨™¿ÐÍB¨±{X°ù¯Í|Û;ÉÍnI¢"=Évµ¼ÆºÈv(÷@R‚…4Ó°ÑQÜyÊ—Z6#mc +FÎòò³bÔÎ .,Ó€ò‚{’YmÇišòÈÔçAz4äc&ó\w®Ï_€æw<`¦E€[¼°àå”ïáËEFÓî$ÒÌ=ÊGšÒ:š¥#ÀÌð€¿“,ò±¼”åûêæ}®d•Ó ÇXx-/\žqsìe2‰Â¨ÆM³@C9ʇ°Š#oq5• qsºà…)Õ·›}½¨pÄ vÇô¨²Dû!a‹…Ø|Ð/|®Åf,ã+yáLiÓ::p_…±‹Ó=ÀëÎu,,¤6œlì$û +GáÉ<êq—rÎl‘ ßúÖ–L}j¢iB4—ÞXò‚ô&—Gö 9ÄÊ'^(<ùÃxá­ñ…ÆÂQÜÙŽ#5zá8’ÑÙ½˜$7â]c£´ž•Íì=L“rú¸\ÌŠâ~ïÕ¡?IdѺáy³¦š÷ã(2³¬§WkÐÈiÀlº:7÷D^ÌS§#÷ys§ð`¼ÇB6^ø}¼0ö+ÇTùªym`úì}Ü&önV|1£M½¿‹‹™à2ÿB<S•¬Ÿ u$OyÇ™5š +L¼`qÍÁºªë(Ü-yaú î +»ó ÷itã…ŸÈ SÜù,oô±ËI«o`á|^ÛNn$=fªu;õ ‚#Qlž(z/—}¹tAÜÙFÚE¥›eõ °–8»À þU7=ÚcÁ•ãOã‡jÃÂÙ.p}’ty`„…Qˆ&CÆÂyªkƒ•×ò‘ŽÔÕË;¯ÏYJgõ_.baœæœ$AH^§å\`câ–úÀ „±MÁ8ŒAÍçˆâi’ß¹Ô&ñ±X¸_ÈA>LCÿ…åÑÓ–“<Õ‹æ²7vSö-wÏWi¦ÈÔJ,0ߌ{6ç¡=ZÎÉ×ÆFJ/ÛHËvçèu¬;æ¥s¸"-°I±í{÷ç¬?½šSî–¼0OçˆâsñäÏå…O[æe££Âý:zk4—ºp[ùkÊÄ™Ò9Ó”žáe9&» Sÿ‰vIý2¸•ßù8‰ñé›EdÍ¢»±ï!ã‡,â g£WÁ"Þ~4Ž4Ū{v.ûøÂOä…”á•XHDðe,ÌÚy©®ŠÍiØ»íišó‘ÿt¡¥«xÁìîªÏý±ɵ1Õ“Ü<æ/K +ì^7 ·0XÕg^»â«°™Ç³óÊ‹ãH§ŽÛù8/üb^˜Ô›ô,ê;;±õ"OáSt¬{u»‹é¥'Wïü–˃•—s¶§y ·;«bvÔ9¾`†ZÑ‚¢ý8é1/ظZz²ÚhzÓ|ÎŸÊ ¹)M¾ñÂÙQqùË:Qºt--øtaƒLã+gê(Óå Ѿ³-œajÒäÀ혿0©ú¾n^oF‰ÒF^ª™¨†ñ’üäìIï(î<ý±OŽ‹Úå?Ø_`êóâ À §õT¥·K½<±¦âœ-:ôÓ(Ó”îéîÒ\W`¹aéI*Þä÷^«ize.Ïb$v0^z4P§¸@]»åѽͼ`>êIæ÷‘Ÿîšá©‚³ŸË 6¾o¼p3¾°÷¦Äÿý{óô³E-»ô´¢°î4ï7uÙj,ì:óÀ“ˆ¦É™×ò|®Îk›F„¬eµ3nŸ+<Äw±Bvâèø ,Ðå.Àºïe?Ø_øĸóò‚ šÒ}\·Óøžáä[.Œ™ÙUmšÈ³ó ëy4ŸDr5vÈkÒÒœm*3N ]-u} 3-Y5"軙ɒMspv}ÿd›3’w‘ëyR‚µ‘š~+š¦+î”7b(Î÷£y!Ùxá/˜ýfžgù!ç~ì +m/—`˜'ħØÍÄ„hšö»ƒZƒ…yjŒ™ÅS—vŠƒñwõ*×ca¤‹ðóœ=‘†v ªÝt9?2ù‚4öFFå<%nöáç³ ŽK“2N55qäõŒàñ¢–ÚÆ ¿‹ˆÎqÍùô˦1«¹5Í…5丫ѤvbÂ.×í0(´ ‹“™à0´³oµ¸ÆdMã[`ÜØv± ”E©É÷ ps8l.–ŒÍ츹¨þ.@ÔÔî²$ñ:,˜vuÝŸ Ç7ÖšºQ7oŠ*LƸéòø¬_Ä +–ßÔå¡ÚŸ³Æ瑦ã²b@û™H3~\žêw^»v¡-›XÛI©y2­:Ú©‰üãr¼Ð37ÁŠµAXï—®mb>[|;i¼7óFÓK „ff§YxÔÎ5s›Órˆà›ÀÖ]1š1.§É@pʦ —Îxi?UíîÑZ6ó®iSòåZ]ApJìÆ ?˜¦Ìi„¢iŠrxmÎÙÉ‹'‡Á7køœìÕÛ›ïÿzf +¾¥Í\é÷ŽvÙìÖ‰¯=šu¸÷l]a×$Z^mmaSÉ“bKÈ3ÁåþuÑ{¥ù”ƃ^îjÜxáwð‚]ºëòZç£)³nfܪß%GF/ÏLfß…ƒ)ênZU=ïV…ÉåI¥„ [”ƒ— +É_<å´|úÉ®>å'.±~Ÿ2p}Ê|ã…óq$å\ÁÂ&?R¶øÂËâ ›ü|,Üá¹ÅVÅ7Ùxá-¼@^‰ån¼°ÉOå…È}¥”ò6Yà ´êœb›û† ·iÊß6Îã=Sù°ñø¥üâp/†å¥Q®uï=y?8¾ð)òÛ± G¿Ÿ—"4&ü0GL˜!ys¼â©Å8¡½þ4Ê`ç‘É/DŸP_lÏt|áOcÒŒÒï9/Å­Z3%!«Û(ÇŽô1¡‘P9’++…Í_uúxë%‘®:Vréa„ÈÙt£±:+=%¥SÓç~¼&+æ™K/ü8,Dõñ<ËÿH œ„´k+SzÌ,ðXÑS-(M[1†Êd²Fv]) +MY?JjV…ÎŒn±Ì>˜wMSÔ¾œ72Ê2*i©z^ÂA°IÎ{dA;Ž¥'Í+6ïÛx7Ú6™„#ÍIJ0Ý5m"—æÜ©í(æ³ÛÍ4³ÍÍç`µe¶?)\H,¦Ù/ü0,ȱk•jŸìì¸ë"“QœÑR(Wcèè:6²Š1c63+[â!¨YêE>JÐM¿¨)ûiÎl¨†r”Ql6²8r«e®@ÜE”×ð‚õÍ0#êÚº/9ëÓ +ûL–QZ¥½„ ]S¥¬äQ<¾i·jÎæ¦1§Q)¥çJî–æŒÅEL Kwa÷Á53Lª"¤AÛ…”ch˜†e4„Y5Ðu¼ ÏC[Íù³¯¥tÝè-X ëç.ñ?Ÿª'%eNGJ«J¸À €…F æu5ð‚ðù¼6 Z;¥‘ðU m“øÊ)Ä@1ˆDD]ë&UÛ +çEë`Ò/ȦEž ƒê(ìݵ¸'mD™TjpTLÕU-f¬kbPsp¬H%„G+U8­Å«ìŠ‡²˜ŒQK0} ¡¬éC›–Ø1×Y% +Gy)Nj.¯TŠDI líºøÂÛÆTNŽ¯7÷žk¥ÿÀø(h¥ǪÁÿCò­þU˜0.ü ‚ƒòà"#o­¿`×eÖ%éé€3Sp4%²+’Üoc†¦zõ¨))’®JrWEë垊"1m‰Ìy Œ¢ó$‘ˆ|Á“¬£C˜†íˆøÚõI·~îµ~ØúzTæK`¿dļp€ ˆŒÚ0—ã–kî›™¯`tÅÕH'•–\’•ØH¹ãP¸‚8‚#38?~^›'WßÏÖk{®™âã À Cßú ¼:âIà®xàôÊ`aäbÄ8sÜÀø ~ÒÛõkU‘‹ P*Ç¥Òú ÇSn^äáÎi ¿Û(.À'`95FiÝ9ÊOõ"® xeËŠÒ4œŒY#ØÐ%‘B )¿n{¸2ó%d€Tøš>ñtñIáxB‘š¡Î!Ûš´ysz8B€yäµ.#Â\^)¸|ÆÛˆ}~Ü™TÈãÞƒwtú™X›>ÑŒGªOäð@ÒïÀB¤@@UIZÕRͼÐGÄ(56¢sMHiúh°£J1JƒN¸*ÌlÐp^Ô3TG¤È»†ÛxÃŒ1‚¦,È9G¡©BÈba,xh…)ãÊ'M ‹@ŒÅ‚”YALá&MÒc æX_TUd°€Á1ðBÖ¤zÀ‚èÌì% eFÅÚ’~>/<»Ö9:óë×w~_ÜyÄAß±Œh°o°`A¼=/ cûç ûÉx²ëük|mÒ%fðµ+rÍ;OzÈ:áŠé^ I×eæИ0Ê·¼Ðc1æ¡S*V`¡í{…"LhGä„䘱«Â?ÁðØ6~Ñð‡< ž÷$„æ…Á×HÕi‘h€R’eIÓÂQ­§%!}k*ðØyG¨F/…ÁÂÁFºÃ o­ö,N×wþXèx•ïÀ‚¤Ð“ÊïqM ‡“¡þ ð¢]çµñ[e£Çt­à÷i‡¡-Áwî°pÆ^Õ¶Æ|[ÕN[Ѫ­Š65¾s-†¬´6¸±µ<á¤"2n;|çAaG'Á`Pg¦ÀWf¢¬Dð5°­vŠÚ®Æ_ 5! ^ab#Ô`«®6W +€o¡bsRBÆÒðmö¾ó^ÈÍ ¤üGa!8Á7ýX0µøßwþ›Bmõ@eã²1Y_û4J%ª{cÄüzDvÍì!"•Kkú8wÆ!õ«®8Ṧ^Õù~Ê:»‘¤qjÉÂzô1¢^{2^u.ǽLÏBH»3Ù˜ØÆ캉£ÔÌlÐŒ™X–‰cIót̬Ìuò2ÖÇ*,:Ÿb”™`V6×”¤ÔLpëR³1…׶=Û³/(e™ «Ë)fOjsãTJ “c/í8©´ š+Êl0m~g8Ûm¶Ü »L/›"qÌ^š=Áô1ÀÊš,Î;_ÄB_9¸ôÁu:þ^𧮹y¨ú Wr0Øú}m€ztn¸õ¬šÆü 2þ#EâaOŠ)(/$ĉ‡6ÐöÁ€}žzc0}‘ +üË#FŠ)¿ &7o=‰Lõhø-e´ž4ìÊÿÛÀÒ%eù²+u7%ûB|Áó¸ß+_³¨‰3ý/¼é[éº-gþ-B‹ªª?ËF*ÍÔÀ/ÇÁe-Ø“qçÄ÷}¾aa“÷ÚH©Ä},é/äàƒ:üùŒ÷Ɇ… û>™Þ橵ùHwÚÙ°°ÉÇcឬÎGº-6ù\,ÄáÉö’?Å ÑÉaII7,lrW’0ôù‡älw'4‘wåS¼@Òã×Y'ÿµw%Š­ª@TTÜpCÜ"ÿÿ—oLbö¤M_Û[¦ï¾´Qq›Ã™†áeß¹êûÀaáoÉ_¡Å ݘ @†¦S¥xŽDØj=Ìæ ÙvDh"«uÙ<ƒ_p1Õ?&?e|aéÔŠ”ónnºDëxòÚ\‡>ç ÚU‡ Ð]^È(oáÖ*^5%Ô$;Ö–Ú›…ݪºò,àcqXp¼ð Xhè®NF_÷ëôè*B¥Ö¼kZ%*ÓÉ(óBÈsà°®ZQO¤Ñ‘‚Æ-g%¡Âçž–kêîÅ‚ã…¿íNÿáɪ ô<™i9ç‡õ8ïÆ‘Î'€ÐB¸š2d`!‹Ž(çR šÏ´Ã‚“ŒÍâP M?ÇÆ„©ÑpÄ"aË€—Ña¼ìþø‹kl§ö<ãÕíÀsÁMkó N~.ž—ÿ# kwÇ K‰Ýïª!ùÔÍûα6‡…o’ò§Íýÿ¼ðã  ß$ì÷ÕÙþ /4â,ŒŽþ/üœùÎ~Qõð!|ÌµÈ ñÁË&Ò×:ë¼.~Ž¤Ÿìj4ý0ÛøÄl;J;O‹6iÇ NnÙH?ƒZMHíÆõ½—œhÆw’w:WÙ˜=Ç -‘8T+šz”Ußâ¸D¤¦\RU +žî Í<æ…$ø‘”ËÀÉW<ÙƒÊuïûÕϘ¿°“íN{„`¾éQ—d×èd\î)ï9^è§SJ¦”J¬›‡iÕ5DZ\FM²) ")Š„Ú%Ëþo¿ç´ÿ¼Œ¿¨žjç…Î*Xhpd!Q3Ö‹÷9[zÖ³çx!‘sŽ0 +±žªÅ(}báS×ZŠ"~ öò¦úŠ6®âãwÔüAX8˜êÖ gíæ˜\xÆOÄ‘|ªc>ƒÄ;\#Uª~-Ž´bÁù ÿT¿ µÅ‚Ç RAùUåSü´¿`×wþ,ì/\5V.Þ‡¼°_Žê$뢩_ÊÁø&^~×rµëZæt÷ç…ðÏä#ËÏä…Ö.›Ñ:Õýÿy!¤`;¸<Õ CÍßíüïÀ.Žõx'_Á Zñ]PÐÔÿ©¼`/oú–7Ò;Íý^øV¡´÷_–žœó‚š>ÒŒú™X(9Ђç4÷;xá;Åç(ôÅÿ89½'F>ÔÊù°ÅÁ‚ƱsŠûçx¡¸¹xñ¿‹UË›µÒüL,>:Zø{¼ðƒQÊ@¾i|¡ß¹çÿ-¼À:BÚÆ=¨óÇÂGEÏ°PƧâyÞò`9--<ØqyíÜaxådx¾yaîM}!/|ëøÂÆ•ñ…¨JÏ$‚<*ïég i•<}Öãš)ÙÅÉÖÓ½m. /œ…-¾sÜùcáʸs4\™7˜A>ßÃìò,â »2l,HÞRþ¶‰‚ø½SÇ o䣞›n:Ý«çíg\Ë ²çNY¤Ã9† b€ïŠ7J^ž Ž>Î W± ó£HXxÈå6/¤éð/ÔrÒ3,äY²‘BZô=Í3wÞ:´”:^8CUIç‘]šY]Á™åßÖQfÕ3ÍoÙ-u˜‰žB_p ædgÚÚ̉çc® ¶âxÁÉÓr g*œ£zÞ¶7žÈØc!½ãRè5 _À N>‡Í°˜QZ|údOð Aè°ð'xov_’ø+± c$)ޅǼ òЧ$Ç ¿CÚ7'ï# ¿ ̸ Þ;°ð/èäúU8,|žê òŸä;˱µ+ê¼Gjlùë¹nõ®ëÚç°Ðéáû:dfý/J"ýi“˱:Ö7¿xq–dÑ|6«3ê™À/v(û&²áü¥û’Ÿðo¾…ô Íœàˆßš“ù4ðTØ1Š! äaÄúP&N–^=‹°³kîmGHd­—¯6ýüðÃÆœœRZ¿¯3È Ñ—ç‰Ýw¾†…bƒ…8±cÆîÚ öã àXÀW”à ò/ÇÎþ Þ} ý…hã]¥évX:Ž=½H¶ÛRé[8|·õ±Ü|›áÖpÁ¤I’ß‹…_Ç UYûÆy]ÙÈ#¢^žøö/yP`ÄBïÓ'p_3î¼ÁB± Î™þ×Y[¥ËªaÕ5»X¨g3†¿ÑQ«òƒýÿ¡Ú•ÈÛÖÿÙöŠÊî‰'[±Ðdæ«ãþÁ²9a*Y±cw¼ð?ŠèFÞŽþ›Z+!#ÝK|Œ¡oË™ס0IJø¯´ùH{‹N2žIìʼnD^q2gQ˜Ô;ø%¼‡kM±­ßžIIŠ¶¾Ãñ°ù€…íÈQÞ@(®`Á eŸ:^zØ^ïÿ^~q>’¨ÆÏ,<-Çé³Y;×r¶M¤g•U?Óƒ¦,œtÔç¼p“ÄÝ¥¸Í —‡Ò`;±­á|ê ÅG,èÞÐá,Ì—ÊÎŽ©áÖ_(ÿ,<æ…gó(¿Aò‘,=Ö?5‹»‰¢(~f^¨‘<„ô­Þá…ÓÄ0°Ry‡ÒèìØX‘Äðm¼àyã;^Ø<ÀB6l½˜JWƪÿé1/0Bi÷Sï4áücäîÆáS7ޚ˃öúáGievì¨ÍøÂÉl Á;ÃBÜá…"³’Øhir7È!Ø'‹Í˜>Ú-âRÜÂ\„¨? Žn[ë ïà i¸¿~ö¼6F>TÒã*ûä‰oÎw–GÉó"óNjy#/œdw]ø ó9ö†úÝ8Rc£¥òêËlêpö¢$‡¬“1ïÃCé:ŒäÑ\ß‚õ··÷rŒxÕï™I÷x¡üÙóÙô:âê³¾Þqgq”‹¢eÈ Å]^˜_à…mLU`聯/³\'{%­ ÷̇¼ +`YÄâeŽ?Ç1fà ÿ~ÿ|çׇݪñóFß+ùHw±pΠˇxÁ`ò˜ÎÏϲ5õá +ŸoxΞw{‡cbÝ «-u)öôˆ~~ ð Ùk·Ü~þ~nÍý ç¼°|lÐÿÜáXä>³`Dž0q¤Í.ÌËòàŽ=$î]b¡¸"óá² yAäR?;J½2ì6OŸ–Xµzö¼ùGñ‚9> o®“­e‘E‹5Ø éY÷Ç¢BÚTÀC‹þÂíyyˆ~ƒ¼0ì^óûÞÛÏâ…}œuß´Ù×Q}¶Ëe÷'âÄì(®`Á‚oæÜý!^ø"vcõÔhAöŽ4¦·bá¼°Ow:\“FS6ÜšoÊLáz¶Ó˜jzo0ÍñÂÏÃôî §AŽô·ûÓxA‡Fùå~¼ ÖN#K6>jçR4õmGæšäˆ“,\d5¡©é•ÂŽÁ:^øq’¨‡j.Ú±ëúOã…½•TlHàtrMxŒ…ÎRž•‰Œ4N°^Ž,c¿ÕüC¼PW}ü†L܇ãgåÇÆån<–‰îÇñÂ>þ?Å‚ÅŠ·W÷Óì§øh -'áÙ‹,*Ã8Cñ×ü…ßSOužFygsLßè5ÃøÂYÿ{c^ÛlRÄ /lÕtÞŒ‘YØ,§8Úwÿå L v; +¸l†¯Ý¸óôo^i1ÒwNIz¥Æ{x§M&“Ý™ã9m©ùl¶„·Ž6ÄG“èà[h“b´¿;çmÿ0ëüdV§·Óã/üÔ»¹5¢ü† íoæ$’IRÜ­ ³ZIö­ÚÑ·ØN9óŠ5wb½Fa'%¥YÍÎËÓÍà„°y¯I’ë“ÛœÖw-“`»«wþ¡©«óøÙ{ؾ•³wì)nÖ„ñ6éæÀÎ)-@©1•uñ¦mu Ï‹\š©û§`Ídzõ ŒQdgÌÉbž”³ˆBBùô{²Ó=>^jcýN¯yßqƒü_yaß9¯»ßÄ‚Pj+¿ÄëŠ ¦ÄW¡6NÁzvzt°Ÿ7lÒ\½=‡Ä{³h­(³ŽO×úKã WÒ-²„»1=ƒnöÑYäb½¶a¨îc!‡=N`É@»öëµáñÃiž*–E:Œøι™*gã7ÙÍ“ ‰Ó{ªx=Æ¢ ݯ•Wû +K¨Ç‰ìB°]&[+2–&ÿî°–\áÙ×I2«¯ÞÁ?Î ¿Oü±«Ï¼æ/šx†…%¹?Ñ΃=N¸Àcöó ðwv¾û&“ZÄIæŽÑòw¾~_fÓþ4MœàAy‘ͦKcÑÉ%°Èl†íç‹ŠO–yÛ³›–òäd×íüë¼ðûä$‹»ùܬèW°ðS¥Ajo>ºù|WñÏ.ÒôO®Ë³IÀ+ɘ~Ùy~ œ¼‰šº®ÝÄ Ë[ض–Z  ‹BªÔôëÀÀv〦â_´ Æµñ'ÿ8/üÒõ…?¶"ÉWyC×Æœüã¼ðk×w.”z[5nÇ Ž~//hœÝ}]ãŽ/ü"‰Þ¸bÉ%¸©ÃÂßâ‘IÖ8,œ‰Y±ïOaAdz¶#ÓsRê%Ö,3U3š(‚_M©ïµ°þG´…E¢Ž.ÊIAã—c—Ñ•pˆ÷ñ‘ãiÿÉñ…ÿ F¾ ü†R¾•'çôn tJàù*„Æ2rü•s®ìZÃÅG +JF*ôÎácU-èÅ”A®DÉ»ÝÇ{µ.{–~:ðT¬Nþ¯Rò”=GÁÇT§P·Œ‹hŒÄamÞn8éÚ·û/›‹‘*E|üÎìÁÙâòüèh™ÝÀÂÕ³ŸW@/üR,âyÄÿßOÛvZû;š îÐAÀ ¼E"˜bá¨E…âyUàÂÙÑŒ¶ÔoûørG(|[å-i….ªžLb¡¬„ž'²›µð Ù11©ë3hˆÚÍ}ÚAÇ=ìbœ±Uôž' +[âKI!ìšÀ&­ã¶‰aûÛs8»Í:œ‡žF ì㋸‡Sw¥ŽzpýrÇ Ÿ3ŸA¾  ”ÓÿŽc¬ø~'ž*Àò‚Ê9(1•¼‰Æ‹c[ï>¦ÓÜÄ„GÆ¡à¾N”ŸL:ïʶ4%R zý„úz§¤ãa¬Â˜Š· ¡MÇóœ÷ºW’Ñ@O<”Mõ%‡Þ¡ÊtCýh$¹¯bMhÞŽ­5ŸhîÑ@±„ÈFZôjŽ©,¸¥ OQß›h§t†Mt¶Ó“¼ÀüvWýÒ8Òj #œ’ïÁM +ú¿c¡Ä +~Ÿ]Òxåj¦«]‚X „j ùÝš8ë©5¼)¹ ªa¶Ú&,ÈLÆo RÅÀê +<ôtÀk=÷%.ïO:"¢á9œºlŠ_`c:s ÅL•¨rÈ‹LSƒ…~m†¸" ɘ!þ2ž5^bV‰¡)À>tˆÖTõ‰eXÇ ž_p1ÕK,|ÛøÂý…àÿ>«‡éûš.èxeyaö‰¦Ibü…cÞø ‚÷LEM!DŒ¢àX¦mÌ>¥ãN“ +W±ˆ´Ö‰?,øÖt/+ÂÕ„þBCs‰ÚW("|pá-J%Á ³}g:þ´õ†š ]ûªÓí¨ür¦\É]²'NßO默Ã>9¯Ÿã…RýÖ±¶¯å…ow®™˜øÿ±,t~ŸknyaœcPTÐLmâœè;é+S3ïKÏ;,ä©)¯w“FO¢T±ÅBoyÁ§8b¦4`©ÅZK Á`!çº÷Ñ{ϧ\g£Á‚Ñdë;¸kÌ*k#% +üî~‡Ðâ<öý6ÂHãD² D?œB ñúy^ Ž~/€ñ §e3,H=éÞ_ðÐèG,œðÂû¬ÀÂsN zw”é˜Çz6pÈAEþ4HÆZJÍ ÜñÂÏá…ïÁ‚1i@çqÒÍÊ  ‹=¨OŽXà(6Ÿ¹Â>¨8f$ôByÚ§­—³pº#ˆE&p"†6¶8¾¾³ná0âyÞ‡`œ¢G2¨‰Roµ‘ÖÝ1F'×O<ËŒ4uüÄÃp÷~s˜<6Qäÿtw6K×Ýñ3€‹ÂÃp÷xý’×ÃÂõ^"Ø=8îþ—° “ziÓ1vÕ}Z “í—õ…ä©L•ºÝ{õOðB¶zÏ|Næq¬ÖOIœà3ZWmbÇϾîÖÝ:ƒ:›:@à3·»«í'ÕÇÃp÷tý ÖÃâõ°õÝÜc|î6»ûyìíaÞ12¼÷~ö»û›O¸—wÏÖOïX@s^ok»ÿ),èúùœ»†ÙR}÷ŽhýpŸOɳõ )Oð [¥îÏ°ÀJŸ×°®»o°®Ú‰Ÿàñ›Ã¶J}Ž…ñø¹Wê-ü+Xˆmëx{åÞ*õF¹õöA´eÅBþ#°Ðíä äY^åN7¼0\òBý$/L·ya…/ä…ñ./œca?¸âxá/ȼ¬úSÝç…Z]ç…þL¹W)Üca\-Šu÷mÿy^`kÞç…[6’ãÇ F–¡ªPçãªÂüCÁg´~âÁEU %V­*¬ƒ»ÿœ‡ãîÛà +{î¶?L®‡a¤b†Íɺ;z±Qo?ñ,ázØú)»ûzXŸlvϪÁÇ8R¾îžÚ³ÔëaÞz–l=,[ƒÝ«Å~Àmujwg©½‡Ía¸ûwaÁñÂwñÂï©~yÎ6,üßÄDjö çýךÞ/| £ú–Ÿñ›Îû¯ÿü˼ðÕXÈr™ƒPš;y¿È¼¨~™8ßى‡‡'  Nœ8,8,8qXpXpònYŠ¤§¬ˆœüqñptvhá°àäOËd  f‡']bC ©vXpòçëQóð_¼³Ã‚“—=†àßD¹Ã‚“פ5SM/8q’¸ñ'NŒ4²ü7oÌñ‚'«ñGÝ3pòÃdè¾Cv\í:'N~HMGú¢uâäÉ8}WMg#9ùYBœ8qXpâÄaÁ‰“‚…¦ßµ\µ]ËÜpòÇy¡µó2Z÷œüu,à2ã¨<÷œüy¡Z«é;qò×± ¨£' F¤]uʼn“?…†ŽŽœ8, ¤.ˆäÄaÁ+ÝÓwâ°àĉÂ' Nœü;XhDÓü_×…çjÜëqò±°DIKãY,Î`äš#\â†}³Ú;‘y^Â[Ъãõ\Iæ‰G&ÎÚ]˜x†Ì}ýB€!žF8UüXQ ©•!•Ùi¿xÒ!¹rX‚²õ/MƒíˆÌ‹è²$`™Èý¹àdyö •u ÎÛ•Eòžú³xcéׂdpšÀ%ìþ +,°”3ØÈDõ©Ê·° Ñ çÚ$§hh~»Ë #ñ çÍAá½ A:ÿX~–Ü {i«xC¾Ñà8½…Üpà…຤wE³ÍÉVô »‹…«­¦ñ°€çÿx!uXøXðŒv¦`ydQe‰´ËðDeÒ›Xˆî`a°`8v½,·'CW!K’\8\Úm,X½Á¸17æxágÊ]¯Ð .T&ö>kÚ¤É,¾jŽï.ÍÅxA–a¸þW–‹—Éô´©Â¨qV®_4l=Yv i±o·\f/Î-Ÿ”ïÀ‚ã…Ÿ)Qw'¨Á8ÍÏ¿›úÏbaY͘-ëÂègò^ÈÏÀÌlSGŸwŠO÷0ß…°pZ2¤“9^øwEò}ºF®ŸøÿØÌ8R–l³Oó,›%•gú £ŸÞ˼žca=ÁþkÔûs¨óô®•t «Kñ,8^ø™Ò4¶¬êi/ªiš +íUÕD­óiꢲ§HôÓ䇠ƒ]û>M‚B÷iGZ¦Y?u_¾Š…#)r9ÿº–[ ~ž.± gcÎX° ‰f”¸¶Çm½¾Š‘¿C/ü\éy$8ïs_eKÇ›´¿#oÌYG„TyݪÌã­NÇÌFÒG“¯¹Êh8$R×& ÜÅ‚Q©áÊ"¢ÑÖpù /è&?š3ìšZ[„ÜÖ•«X0 ¢7`ÁñÂOµ‘š†ƒ PD BcñP׿Ž¶Úá“"7x!4‰!‰Ø$׃Nô`78wæŒÐæ9’Ã$7×bÆÏxa)C 7óï/Ð}MHfŠ!`£™¯JO•Ñ˜…Ké]Åh[1ίa! n†pX)ôëq¤X°ÖЋƒd7l$Ô¯Ÿ³Áfì¡x8í9B¹aFœÊ°}F ÞN耯‰óŠøÁ¤‹Yu ÑÀ× ¥ Ä(Oö™¦V]õIïa!žz!Inf EœÛ4Ô-Ü…W¤Ãv&Bž•O`á\òe†vNPˆÖßÞ÷Îó>€›ÒÊlÜ󂥊 ì–OŠÉ£©ŸÛùá&«8Y‹7XHÒÓ½$‹þ‡™u¿ÁW3=—ºÑ"lÌ ®ñKØV °%͘1…tÉK=36b¢^¸æ3/Ï_Ä3!Îú¼`ŒŸõëÖ¹g§ðÀÝć «ca3]ÎÊf>œ`^vJ“¨+¿Oö¤›ðŠ$2Ò•. ¤+ +mãa’Hv XRJº4EÙÑuv•~yiÒÚ¯ˆšf-*®x¤s‹…¾TêÊŸTÜÍ̇½.ÔèÃA¹_Ô€…r§xeß  ¾|™j“ôV^¸6éæÊL'ypŒ³9{ˆyøYäOûß H§Cë‡,Fƒ…Y˜´ñ(XÝn.‚«?Ÿ»¼¨îëþËe +ú&¦j (1ç"œK1æl$¢òLuºWkù ÝXÔ Çþ¸ b‹‘DéX4„ÌO4€B½lOý¨®§zÞõ‚7û —“1OƨN²ž£|–s™){GbG)çxtý †ÅÉ1 Ъéí bçNÚ\f;•Gk/>w&š#¼Ë§ÍX[9.O\1€³w¡Â‚ ðž>‡hX+låxæ¸ú:Œ{".¬«=š(8&nÈ"*µ´ÇB´ÇðÂD’0Rå ¼Un°€¼°;òB’QYÆÆÎƽüE,$›8á½Èï]éQ>ÒC±s æZ«í w°pËaY°ª«Qa)¼°·½Õ=òàlfP6œ„?à ò’ôb2†w®›7™SpÅ…Kæ¶ÝÏ–÷µØ€ó”;p…[j†ÝðBKë=ò˜LawoìŒ{ Æ“»aK{q(¶^ã5-G^9`é,4âšÉT½X#OamÂ¥\CVeãQn5rnã=^Í#qž¯k° /%ØØHâi,Ìg¡ëÅöp‹ªø S¯'èÏS¢S“…ÔúΊRkŸ`ÀÔc$Ô Iu>îBÂ=BºP`TYjW]¡äkX`·gÔJY„Çwyeâ™MùžŸÆ‚WòjÄÈD½×xaëìÌûRIì•&·£8Ä‘ÚHˆòtÙÚHž¨/~ÄC^€Cӳ؜w1ŒŽM&ƒ}¡ËÎÓ6ÅŒj“RT£é¼ÀïÂ>µ©cè[Õ̤5kö‘KsК‡¢a47º¯aAßNHš ƒ—›~›ÝˆC±§±Uéõ2u‡eSžˆ¸ƒ3_Ϊocs~¶¶÷q|ãý·ªGÔlÆ.ÛbáN¢Ö=^ˆ‡‹ +ÞÕymÂÄÑ‚ÛÌìd/è/¼CÎk»ž(™ļ:¸žižðżpË÷îØô·±î/j>ØX‡G^Ø„þQ¨ÅVzMœMvƒ» ¼÷xÁ»L·‹nÍwKž>ÖþSR 'FC­‡àÚnYwPܲü<ÌhÛµp9Éô,®çvÛ”8ý4 ¿\›QÝË—½…Mš‘Atvi@‰c°ìDC°¦d¬OòT½< yy/k%?æ…+óX7s<žD™MV_àæóܦ\Ý +.DþþIÖ4û<¬¥ž××;݃ÚZ»¹f±ÍÇX°þEr#¶[¾†ï8BV\¤ÎÔMô.âbž>¿Pd‘^¨(ì,sï!/ £uJµ›Œ%—gÍ>°Æ~½Gœg našz9/y¦Ë4f.ç<‚§ý+Kò¨ÑõÌ +370Îç®Ã5=Ìá—2_]W³õÂ,ªgh²ÄdcÊ´Hðí0σíY5/cÁtÕ'éÎö Öâ*ƒk6Cœž¯{"Ž_ò7q*ýLU%ûµn}náí¿ºˆ7gb;¯ÍÄ·l˜ê$-O˜®À¹Ç Öºô.îÚbáb–v4ü˼0(¢vMH(å‰øDU ÿ*íSøðáŸÔ¥¾‰ñ€á;Ø—pbfòð‘̧”Î.ùD()õDÔ”sRBÇVïFh¾ãDå:á\I~m_Æ‚uõÒÓèŽHlÅ_q2°ÉÉ?Z%{ 6dšFWÂïÁku0B›…1®îDûlE›5šsQJéXBãd¾³õ:¶“N´vë@Ýã…Õ‹ +7fÐ f?YžAúŸõ•iit X0:3ÝSèìácŒº(Tí{ª(U¢cÐnè¥5Ú_©zV½Ö;3¼Œ“IP%|Ñ€…aŒu2Æ Îƒ×LÅœ$QžŽÚðe,4‰¸ÑÏÒNÉݾ2IJ7åãYf¿š_ÁÂ> ¿­*&Áý-[ˆÅVm™mÖuäëbÚ¶w:­Ò;- ¸ÈNë`ÃfÄÍô×Øô'ónñÂjm±ƒ¶Apš§º±6£ôAeåßíc‚P=ãô‚rÌå‚Ö3Ôa_ -ym2ˆDTM*ô8X9T&ª6þ¤ºlO-¢À/ ã7”#<¬€ +Š•“¸®¡ŠjiJ«¾ó v[¸j½×ý…ûò,žË°ôâb Ö{—J<È"ŠÍÌ„Ânmí¦§Æm¦y²o(¸Þ57^nò‚ÀæN²[-RW Š%Ùçv—'¬–™øÐÌ.ÚäØ¥óI¾÷ÁmMÙÀ–\Æ6ƒÍdŸ»¼°rJn¦%ÔÞéO{ŽÜ3‰ªbÉÞS#ù§ +&MáBW­ë1 ¦·X àÜ„”êœNí°@kpóš*X0­CgƒÒfô91˜ÐzD,ä{,d ~Ûö1bA/XXóëX8LB¶©<V¶z7+êìkMœ¸Ïå`Dk;¦~Ö­°»£Ëšñz˜Õ¶*×æ ËmAÇq–§lJ¶ŽÉZ{"È“¬0™±Ãª¶gõ‘Œ;¾7¶öÕñe±/ì‘qŸìi*8O—Ÿ‘”I½HÕýÿÝé ¨{3KUŒq`°,ð=j^a¾v‰X^ˆæ v:]à¯aå…¬)štŒr„/ÁÈ:Å‚‰´hƒ— €-r_w^_dv¾òMšÊÉáî"#Ïæ#Åò|ýPÒ{=ãr}VÄ6‘‡YnKm¡œ1±œŒ6³b_2Æ~›þ}[7Ï`j?h¼¤{àÃm÷yÍ°õzl=ý“qç57ïПÿðÌž™wQ¯<©òˆ0îÙÁFZ±0€µ3ŽØðB ',› +þ”åÜØŽù8„M +nJÊ—à%ç\jj±Ð[,h¾+•FZ8A4úQª²`ÁVÅJÓséG5e`§ýDék秳Úòù.€æáLLW{ºœÈöóFÍÕcQ".°ñ„þú0XÃNÃÐ!¦ÉV{ó]xùñ ÍQ8€Ÿ`AÂqùözö33Ðu|2éáZ–ãíÃ/Å?€±øS XOº)­á© x\/ t(:íùSŸ s<Û€ÁúiÈs=÷]g½AQí¼&˜vö¯Rùm/Hf¨p:“¸Ã¬3ø.k'6'Ðœ6ÒÆe“}*P-âáN29¯1ªÎ8ˆŸÉSK”?>ÛI»[‰½9]À—{V‡8§â­~ìvžNÜzŒæZÜÔ¶—± þ,8qòãEDÌaÁ‰“O‹Ã‚',„ĉ•É=‚¿+c§iv“##wâï¾|g#mƒŸÔwÁù N ÜaÁaÁ‰ã‡‡Ç NœüoX(GòÅ ‹fiDðµEF¾Jî•®©è‹Xȉ®§/ðø/ù ¢2ýPqÌȼ•7U|dæ\Ét‘;,| ë‚Ðu‰ýºñ¯aÅ‚MŸÙÔˆ†a–©hj{ÀzœÀ=­µY¡Ñ¤Ðíwåû–+ø—l¤p4+nL‡jB ½QŽrÚ½Þ:£‘ö[‡…×± :¥p¹uÉ9ÏuD” ðï„Æ•VrŸ+RjGqáÝ+ÎÍ´=Ž‹PŒ›ü¡@e›®ãŠz:£Jù W°«±XhLß“)‹\âš~MÝèz±=Jhj¶×õ¶Ï¥é„é‚ìÃl‡d+„@0³JL1GÛ4ìb¶Ù¿îa!àqè+«¡ÔÒMu=Ñ íÂHUŘ×RÅñH¼H¥šðh†ëTÇÖ‘ +˜äµOF™§VÀ› 4öx¯y«cþ¶É_ÿ/ô*°Xh§1£#õw85žé ƒÇª¸Ô¢mG¹ÛéŒÛy^=Ǿ'‚þŒÑ~‚nªÐC×™î&Á>¨Á¥ÂUǦ‘gU«üA<Lð™j±ƒî)sX¸‡A%öS)ÎÝIèÍ^6© N׎c²CXTÎ]=®¿B§,½‡ß´Èð Fë«ÀKÅ™°¦ü‡ôÞf$ýKþB8Êž-`¡§³ðiX¨È£Àc¦i•Œ²Æ…“¤ìÚˆÛé¿J˜? Ò†ØùcvTWc_Êq´1OõDË…ôX¤e7é‰xáçgeÅuV™ï;,ÜÃBhÈ‚^ɲDÆ9¡{,dÊLc¤^Œïá_‡:û5å˜3ùö +qA*Ìæ†v­ÆÓÉÙHW°hBô”j¾‹’bLbx¶D.œ¦Í‹!­¦àÿv|\oWaF±°ÄX¶­SÀƒ7çùP«Y+¸Àz7Rb×3=’–øb<åa„3èÖˆ«[©"ef€,t3’:S¼ÀB¨ ªxî°p]:šE¡S‹V1^8@Èà7 ‚Nü…d̵ÁWØòpo¢SUFpÜÀEÀ=ðæqÐÆ_°Xà]Ãhïü…«XÀ…7S¢–¸¨“Nhç3Tº#†©5bajW˜Ê)Ë.Á•mäÈZ‹…Êb¡À¡’dÆåò>4¼PãœJ@)¾BY\hÖ+æ°pUÚqT#ôGè½EXËŒcIQð9 vEžY¾nŠ8ðÂqýx¼7x#´ßSÜ#¡i¤Ò LÙ¨6µÎ_¸…f‚ÿ÷<†° ‰Ïøk:.:ƒï pÎ,À"2Ãúž– +ÒÕ ßáJ˜h#Y^ˆ9±ê¡{ Cê p•Ñ_às=,I„6ôsp2á°pUêTu¶…!B,ü æWXiÖDx¦Q‰u)ĺ¨J:ܾġ=?Ø‚Á@ÆèbàÔx³Kì¹ñ…«1UiLPø¿=J¦EšîƒªNÈMx[´‘€ &k%UëÑE”ó–™Z¦9EFÖ!ÐÍS;p&Ž•y»1÷;vŠ“Åå"¬¹8Ò?"ÿSGÃü¿ñL¥1 3& êCßcÆ.Mdz–Ÿ™ÍìyÛ¿˜}™éŸL3ulJU5f¹'133¾àÅë²Q¸ T3Ç¿¸²Ã¿ê/8qXpþ‚‡g#9qXpXpâ°àl$'ïÄ‚jw‘jØþWEñw´òžkù¦“ü—þSÎz">éG„¿vQ/žfT/îÏ ý´Œê àµÐ¯>þžVƒLôÃ6R6¾¶Öê«’äµÕÜ™ +Þ@“ﱑ–O•>Vòñ+²²ñ;V? ¨ø6’Û}çðÿÁ—dþDß‚…A9,ü›X(3/¨ïÀBÅk‡…7bA¾áq8^ø©r¼ðãxá=þÂç–‡q¼à°ðïØH‹ã…7óBnH?9Î +1°®àë¹÷û +þÙ""˜Ù°Öû¨"‡ç/¼ÊáÊÚà xÝRœ¤ª6˜Ú<ÒÊG¼0ŸZð J-zéûÝØö½]ñ”ñb³õWïÏbÁù _Ç Áxeê ›ÔDÆó'fæ}¡Ðz¶˜Òçxaù¼bÍ [Ä·½ë&ÓÚy§ÌÖ*YTfr̳NÿY,8áËxAÐŽâÛn43et}¿Ä ¹ÖX (Á×ÅN‰À?@i¡¹‚|Ö_ »‰X,ød"NÌáª2iÆ%"8¥ðIG;Qó¢#ݵB§©Ã‚óÞÎ ‰Z8hÖ<õœãÔZŸr¿ÖbA±f­R}­›€«®,LÕTꜫ)ÖíH ÝUŸõˆ?«±P`Ñ3¬ß!éÚëDpÊ ,¢ž;OJ•uX"°ËÞ…†5Í¡QS ‡…?ç/´“náõy#™‹1×TE3<©…ªV¢LtŽ”¯å˜/tgËÇ@;Ûñ:æ9kÈ­y¡Õ©ª „$Ex$jH8ÓnÅB#–, þ‚"h3yœ½ ÷ÊCe:F“wc¡± XÜÿv~Ô?â/ˆççnŸóÂCÍÃj®ípñÝ5^`зcåS×  käã¬Y¾Sc'<0ÐÁVŠñáÍÑ¢¦ÑN¢ `ÂLŸ~0}È ­=ÅS¿õýHãŠ+…çB,”à¼ô€•”#åpòesç ,Ä*>úCì` +ßÇB{õò +ßA11àWJ±ßH°úN;_ÅB'ùQÁëLЯñÍ-—z1ív‘ÙTvöQëó¨w·ÎuÊ 9<_h±›Ì3ô§¹ÆfM¼Å¼ƒšGWï"°ßMã:¥-{È ùïhÜBSƒ+öÄ*Âê¬u1ö ÀB/ªP©%E…·OÇ"¸ˆ…'Jé=ä5^MM1#/´¼ YÉ}‹…ŠÃƒSmü…bÌtÛ µÌoðÙ¶y£“¤š¹jýx´½‡1«§°P%ÛÛ¸ÀBÇ ýꉲ%Ÿ}ßSÒ\ÁBH;) eZ^åýØëš);…5dØ,pRAcñì¿:€sÇF’\ÌãTõ>':ÛªoGÿƒþBdŸœ x™œ‡ÞèiE°,¶œÂG‡”—µêà\ª÷y¡à¾ 8B™èc©Æ˜pd‡½XIg1Ñ!÷Ç +žS®{|Ö}  °q‚µNØ=^ &=gÚ=t@˜'Sg»›bÁÆ|ˆy)Âz/ÏçXØ™:aÕÚE{4ÀoئJð &‰Q\KSE½Re†åõðÅ×±`­ºžW@QLÏÜ‹ó/ʦ›9L<]'ùü rĪY2ÆV_ü±ü˜¿°–žXž;hO¼7òvU³Ç‚ŸñåææaËû¼` +F©¡  :à»É<ÅŒ +¯{mGiÐWÍ. +ÁegߊcaÁÒR;"€Bñœ<®¤«áU%3ò‚Wà ½¾Æ MK t +MÇ <©P•O< ø%»Á +€ãÚY =›Òºi2Z^ÁB¦dÙh`äÉ4Õ„X³j1õM¶¼pЖš§fˆ'R"átÌ#œMÀ@T×<¦å„ªïv‚k.žð$ožÆÂ!³Xh •/¦94È¡ßó±X¨,ìŸwxÁçƒg÷Ž•Át[©¸Ä²ð Kªõízcðè /ÀÓÇäEhì}^ðíCö©§(å;´@!gÝô +¤G Âß¼xNyÂù8u§(ÖöÜä ì…|$S"kë/6×çhVˆ×œŽXÀ†€¨@EzÝ¡&zíDÇ Õ8MàžˆkXÀŽ.ñÍ3ƒ~^Œ©¨ie\},„}•¸y M19µrÄy$ÃUAª‘ï<óêGA·wƒpFŽ;‰d šÃ~‹¥C' ‚TtYhÒÓ©ÆÚoðæâÇþðÂ2îrYq +pèsyÇFzà/l¤ ›ÃÒšŸ-Ø*Ðﲉær06’¹éŽÜç…¦íÚ°¤Ò1ÍTÄpFшP‰COíW#%¨Ì¢‡ƒüð‘¿ÀêU»<{ >¥!\K¿y¶RÛ¿±"œ)¥†º±eÞÄ’­ötîøªcð¯>|ÿ(\`!¤´Êv8Ä=€p±0÷<—²ˆ®úÎ%ç>ü‡ö½’‚‡¦nvS>Ÿîóô¬,«8€/P”톯·q¤%ñ•Š~4XG·ü… ìïÂb­É¶»Yt~I‰¿€%¼ ET«Í>æOù ån¡jÀ|Ò¡þ¨¿°òÅfã±ÚUdD’€|£7‚½v;ò ŽÔxìÚ²æÙ0étòÐFòk@Ô]-O§6þÂ0 =çíxº\Ͻ|$oáû#¹y!¯,T¢>†”‹ÒÈî»O`¡D`š°ìµ€Þya¢ÆVœÑ_ˆsã7åWyA—=Q;}qÛö1ÃÒ´ð¸|ÚùäZsïþ(b³€a¥¬¿`-Øs,äÆ\…¿;ÓëçHš®ß÷ °tè®mý$Ÿ$­ˆöÙù `w +n¯ùI!0•+ ™¸·æÃC!¶—ÙÛæÐ÷l|,ß¾KôÁwîlW¸b¶wyAžÑÕ|Ç”|(4y9€˜b·?¾®Â¿`ZÔð(ŽT™±² g™€Âª>;Dì7Z絉}M-Ÿ_]½*«?Î >ç—+lõ‡"N"²‹“U#Ói“ºô!^PýĽPMC§&à éèC%ÁFB‹vRÕ¤(&VÁÔS­zÄ våŸÂeøÁàs“j>l‘9ñ í9¼÷âÚ@3¥ÿ(/Z`ê‘XƒE´Ð‰¢ÂÇ}+ Ž:¸*Qømê´ÃMM| ²Åð~´ëŠyhr|öy×ÆyRW%«JLJl=-ïš¿PŽb`FǾòÞ3¼QƺAyP´c¢k¢‚¼R-ØHÕ0L*»‚pÙdÞÂ&AUô`M””F¯ÚHû7X(„& ê +Ž’Œ³öUµ¸RŽã+MjyÂ_P ò‚ `>ÀÂCÁO‡ª,˜æâ1Mvˆ£lÌ«>2ÕC{ÍB8ñäØæ9á3öUƒ +^hS£¸Xî·!õrÊ9´Sƒ‹“ Û¬±%ÒëÒ 92ža€íe`¬Í„sâ=wž¦¦® ¹yçþ ©ö°†„ÇøØ­..åCtM×¹"x†¼¥IôQ^FÇÕKì„ÞMèD ÀÖæœzÝì¤1œ SõjÊö ñDZ ë·Ÿó ø«¹™ƒ!öûŠZ<ÎÁ8îÜœ}s‰…++.ÿ>„âêæ™ñ…WäƒùHMýRñüó|¤[¡“ý÷âZó]ã…ÝÈAìHW.ýc ±@wfi=‰ã¦“µ ü¦°-¤ °K›)¨o­©û˜fEÛÀV¢u™óšTÚ,DÀß›&b7òB#» L‘ CzüxF3‹O`á qóÞ,ÿ_žªY])#h#)¥ø B)ß-x0]ßwcmü‹…«‰ º'~_QÙ,îOø ¾ò}¿=†@•\ JÄBÍÛBæÅl± &î¾åž«/ÈSý-XpóÞ‚…›þ‚XˆF·G:Ÿ¶ÒÅu¼àü…‡¼ðõòd}¤’;,8á[yáÀÂs¼ Ö`gÉœ¿ð·yákÅù Î_ø=¼à°àüÇ ÿ¨ü€àäÙ—öŸp‚ ÂiþÊîN´ù´¨é ÈalßÑ̃ÚŽé´ê½üßåeåøá“îÔÇ„íþ_Üü6ò¶f¾å,ÿϵÿHiõ킹Fendstream +endobj +5645 0 obj << +/Length 107 +/Filter /FlateDecode +>> +stream +xÚ`ŸÿÛÛÛDDDwww™™™555ñññíííËËËÓÓÓ'''»»»•••ÃÃꪪ³³³ùùùèèè‹‹‹õõõýýýkkk¡¡¡]]]ƒƒƒ’’’QQQááácccåååÿÿÿzÔ;¹endstream +endobj +5644 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [378.225 747.083 512.306 759.076] -/Subtype/Link/A<> +/Rect [276.16 226.708 473.376 239.609] +/Subtype/Link/A<> >> endobj -5582 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 733.534 323.852 745.527] -/Subtype/Link/A<> +5640 0 obj << +/D [5638 0 R /XYZ 85.039 781.388 null] >> endobj -5583 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [386.739 679.034 512.306 691.936] -/Subtype/Link/A<> +5641 0 obj << +/D [5638 0 R /XYZ 85.039 635.199 null] >> endobj -5584 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 665.788 404.531 677.781] -/Subtype/Link/A<> +5642 0 obj << +/D [5638 0 R /XYZ 85.039 635.199 null] >> endobj -5585 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [377.256 611.592 512.306 623.584] -/Subtype/Link/A<> +5643 0 obj << +/D [5638 0 R /XYZ 222.519 310.929 null] >> endobj -5586 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 598.042 323.852 610.035] -/Subtype/Link/A<> +5637 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F66 4190 0 R /F62 4047 0 R /F58 3360 0 R /F35 2976 0 R >> +/XObject << /Im21 5636 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5587 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [174.8 529.993 417.833 542.895] -/Subtype/Link/A<> +5649 0 obj << +/Length 2801 +/Filter /FlateDecode +>> +stream +xÚíÉŽÛ:òÞ_aø22)¢(jÉœ²/@2ý’Îé½wPÛê¶&¶åHr:=_?µ%Ëöf9ÚYª*Ö^¥ˆYÿÄ,SA(óYš‰@fÙl¹½ +g÷pòöJh_ƒøÌ‹›«§oT2a‡ùìæ®Ç£‚XÉÙÍêwïå»ç×7¯?/|)¥'ò`á§iæ½üz½ÞÞ½þüþÓÍûOoñ)†Má}½Æã|^dÒ»a ÷Ÿúãç_<ç'„‹?o>\½¾±œZ€«Ùü~õûŸálWúp2Ïf°ÇÛ+à3P±ÔÏ›«/W¿YT|Ïø­)©(™*“ÇbjB,* T“X–‡}[o‹®ZÂETêÍ¿Up±Õ®ØÃO»ð…7ǃÄëÖ°Q2оA Ý"ʼîPÄ›þ¨¸ëÊƼQ¢L@5™ÃC$â@ˆØFòÅ~¿Ò*ò +¤Õ!ÞW»§?v«¹óak¿P°ßvxÒÂó²©ö#\P(DQ¢‘·]qoØÚ­˜©³*¼HªèJF ¨f¾LT A¾@qç„£šqòõ›úï×ÎV‰kv„ẟ ‚bß·fë—xÀê7E èý‰çÇ"J½²Ñ¯Ì u5Ø3ÝÁwo«è²„½ÚÝÏC! –‘÷œ-6Êsï-œ’&ðu´± +žŽð‚hóU».W¸•i´|ƼUÿ"å€Êe¨~…0ëÕ¶Òo˜[ÒÛånZÔHµžèmµjJ2‹}ìqBˆ3V« +ŽÔxã¶X¢Ž¿á q·ÏDŽ„PtAEÎP(ß%þA>‹¦cDÅ-ð•"HŠ* l¸_m6këV.gú>@GÒic<Ù¡;j0¦RvHæÈh0ÂFŽÕU=ýœïX2(XC£a½sgÓ„:Y8Dð7‹,ÆÐhYoO‰'¼j×:J‹ôXvëšXYNÇþ$‰)2Ëc ìNE£ÁÚ€Ä$ß +R— +€)‘‚• +½×ðð³Øî7äBIâÝÕ zèŠIê™ðL¡Œ”d@/×EµkOñ-Ó ƒÀz–ïæd¢IB¹]ïØ8¨ Ä[˜p…küI½;£§~.í…¨¾Ãß„¤ÞnëÝæ‘wX_´¿<4:ÜA„f,&(Q²Ò{½Uãõi‹<~+”ÓæÐv Ù/­õ‚ì°n¾1úž¯c«Ó™ 0GQ„´ñè9‡:4©­¶wCð%Ü~ B§VÞAöðwÏ6ìœüsý +ÞðÚ„÷E öîš?”Ý«Ê:ß²óé§Þíú- F„™8k»/},sR6ð ;ߺáuŽE3º¦¥šÝL¥OLS¦ätoóœJ_=á³ô ï”xIæάOØÛ#Wΰ;æ%ëyÊ™XÂ0±e‚óȧ˜07Ø1˜òzŽáæ€Ün¸€ÕüÙ S‘²Džõ1†|,n­Š ¥E„õ§cz"L‚ J°s ÌÅau%¢2ú€¢*E›lPâ(cÏ5:›„ŠK«OÜàzcÓ8ôjÑòoS~? Ž†PƨY(ÞAûþiEjÙ”?1·k ø +.l•±âgÒu¢3q^ëƒk]¸Ž¬wÉI`[PVÙTÖ_þ~BÃ1”â‘HÎjØ9­atIÃçZ )NjØ¥Ø{bLÚÓQ¸7ó®ÔÇêÕ^èzi£_¬ZþmKk˜kÞta6;¨Ð®îtŠ‘¾4GíTg‘AgE—; ê&VwýC* Xk'Õª¸9«ÖæŒZ5ÐEµž!Ø«uDqZ­E«Ö4(+UhÿÔUèGöbÈ_mÇN÷`1L(H¤icK h-tõ¾ÐTQ¢ ¨MW¾­glY‡îŸ)¼×)žø¤7¹J ø°´½p©Ó]ë‹9¤è¿××üøþãkî ±mMµAém-*–)ƒ”Až¤Ñ©4ÍßDg ¥”Ƹ©ÁÂ[…Žl~Tåî±Ü÷¸‚9lVüZÛAÕ®—k]ôÓSa¶÷¢[~ 0ܲm î5Õ}Å].¢ë äLœô]|Áq,È¿a˜‹nsšZï5CrÓNÓ“³>©¾ÒŠb4÷¯0Ñô…Š2Æ„/öXXoO¹AE¶UúÐô‰àÃÐäa‡&7`kÆZË#³yŒ»ª\n§j*ò ·Ï ÂCšQt|v”§Í Y&ä$"VA)·ãÖV„É6¢J“ +·4õR¢)ÚCÒ¥N§òeSö-äªÚ²»Õƒt¾)N}'Lí1töG+ExËŠ)1c%dë²ìæcrvþR6~÷TuИNÀòxºä#ÓÇ0™œÓª¡2Wœ,a{U¢ÊmAÀy¢SkŒ¹ÔÏÖñÿ¦Ñan½~¥s4#0åîÍÎiÃðì¸þ?¾¸3ÿÃRˆóú dèçƒð¸3±†ª–..1ÄP1ÑrÀ6bݳ_ºBÑò3_ŒÓ@ÊK‚7H£øl s`NG:t)Ô#hcݘâd°s)i±d Üs>µþér}0i%‡h—™h×Ö(îå·rJÄRinj„éÑÕ&ú°®(iëЇl4…uØ;7¶†=}…Ö·.ãC‹¶·m c›Ó"¨ò —\ߘá‘ÍÁíaÓ¹£¦ã˜ ›t'œ¿ i;#1džë/[;Kð¼¢MÇ4nºFÆ!¡üˆ€a ‘ò>jîg¼ø옉öðc3ã›Iµå¾–zŠGICûüˆÁ8 ƒ,J]¬×ÀœgkŒ Ù:5““!¶6Ùñ™4Oõ9ú #>È` ò<šâL=‹‘ã0ˆå ÝCâÇ)ô ™}Ÿ*¤}óK *ˆ´Y*Ú‰á±0‡Oßo¡ÙyU[³ßÏd Ê’ îÔ·òI2Ë MHaL_‰"LØP`Øš’²ÄHpÑá& }¹Qq4u£#½™w|ç%æ"rcõ3²ñ¦º?ågô™Nˆ‰7‹rMŽ,2äïdüöæ®aŽøšû’³Ó6Œ'œM¨±5£H0zWuö}ÒEó,ÙYÉöƒ%´+€ ÓÉ&§À¯øÏ>6Ú%€»0=?áil'¼ãÍ8Œœ > çn¸CãWøÎÝèd­QÞbKOýh>Û¸Šÿ~Åf\jí¨Æ]šïh¦šBØ×<ß×o~áê‚çÀ¼u½®µš‘öd¡õd¢,r¾ÜaGå”p˜¹ªŽ2–ùÀ6ð{{úÕÕQ@½ùÔ…yÜg-Œ†Zqxv'é6ÙKÛQxOE×çð*OËà`W NØljѨáÔHS@îVâlÙÓƒœ®z4Ì¥¢ç 5[óŒÈM–<¹_ÃÌ“5m^œV÷ §u«a.éö 5«Û¹IÝ:ä~1Çßø‚4‰/|â3 §ªa.)ô 5«Ð¹I…:ä~ 0 0ÿÏL(é£|ºòÒRýïT^1ý2ŸöEп^P–Qœù5ÿìˆáù§, endstream +endobj +5648 0 obj << +/Type /Page +/Contents 5649 0 R +/Resources 5647 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5635 0 R +/Annots [ 5652 0 R ] >> endobj -5588 0 obj << +5646 0 obj << +/Type /XObject +/Subtype /Image +/Width 364 +/Height 29 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 1604 +/Filter /FlateDecode +>> +stream +xÚíœ[(|_ÇÝÇ%ÿC3(ù¿HM¨yPD(×ò/)2áD®#— r-òƒ—x˜äaÔi"…òBQnå~-wƒßõßušÆ™iÆœ3Î1k=hÏž9{í³>k¾gí3öùóIËËË;==Å8 4´ï™“““ŸŸßÄĆé8ˆm;°±”¥ÄRRRÎ/¦ƒ¤ˆ99°±—¥îîîð×ÛÛ{xxøããÃöœG: ÒR„:HÊÐþv0c;KÏÏÏóóóI[&“}ûªŠt¸LI±­ù_³š¥¤­V«ƒ‚‚े‡‡R©ÔëõÜ™'Ò±’B ±ÃÈ···r¹ÜÙÙ:ccc76603 $…bêÝl0Ú‘µZ­D"~WWW…BñüüŒ™ù è )Ôöî}óá᡺ºÚÅÅÞŠŠÒét˜™|§ƒ¤PCÌ¿û¯ fjä•••èèhêçÊÊÊûû{ÌLþÒARvÐjäµµ5±XìååÅ£,eÉõËËKkk«››¸‰D3“§t8EêG¼ÛSCâããðd¹“¥Ä677¥R)qT\\|}}ýã™É±â þjSSµ§†øúúr*W#Yhnn&{‚>>>ZZZ‚‚‚<==333IAÅ`ñ`£†tvvžœœ<>>666ÊårÒßÛÛ[__qqñöö¶¾¾NlèÂÈ]]]>Œóðð T*Ì» ÓjµÃÝÝÝ®®.¾g)Þ‘‘ò£l³³³ jˆå1ä~ÑavV´4E¡©©©ªªêöööðð°  ÀßØØØÖÖiÃ8ð18>_TTÄ©:„j_^^BáAÚ‘‘‘WWW_?fFCBCCáI.j"‘ȼ ÕÑÑQêò÷ ²ôàà %%…8MKK;::bPC,!¸ð‹³³¢  ) +Ѐ+õW|pá~zz¢:ÃÃÃïîîHŠnjÈûû»››iCtÛ* quu¥Ò‹Ê” FGÅÄÄÌÍÍñ:Ká|‡‡‡½½½ÉF°ÉÉIfgbU ¹À…_t˜mMQ€~£Ý‚઎½½=ÃNòeÎÎÎÜÔзÒ†«µd3£!†§ÇRÚ CðšwA j3`Àß,ÝÞÞ–ÉdÄW~~þùù9ã3±*†\àÂ/:lÌÊ(€¦(Ch4¥¥¥ÁÁÁÕÕUªÊ•³³3ÚÙ2²aÙF Y[[ÓëõP)uwwçääþÒÒÒ……˜”|°d£ÕX÷MMMQ§P[[ÛÓÓ,úŒÖÝ´.†††ö÷÷ßÞÞæçç% ³N +ÎÔÃü@«V«Yš‰U1ä~ÑavV´4E¡ªªª¦¦–9ÇÇÇä.彬¬Œšs[[¨ +ˆ Ô²²²hYÿ”†$%% ¡Póñ$ýpRÙÙÙÐ/‹ûûûi5dvv6""ÂÅÅ…¬ÎÌÜÿ§uQRR=P¤I¥ÒååeÞeéÆÆFll,),år9µÚeIC,!¸ð‹³³¢  ) + )ðyè„/ˆŒáWìõõ599y``€,6ÇÇÇÃÃÃASSS§§§Xsd-Ã’±êÂ’,µeoí° +…V²08\h´Z-Û™ÉF 탞t~ðN/G 5Ä’È0µ«K§ÓEEEÁ[ þÕÕÕÔå5„¿tPC £ê˜O€4[ös}ùþþ¾²²’<¤"::zeeÅZFH‡›t>Ò×PF#‰ Ö¹­­­†?ZY«óH‡kt”c>ÒÐXÍÒëëëââbòR*•nnn~c4¤Ãe:HŠ=RŽl$-gff„B!4J¥²ñYhHÍ1ï2%&&îìì`LšµYêãã322bøoÿhH ÍÂ,MOO7µ3 éü>û«Ñ•endstream +endobj +5652 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [456.688 529.993 512.306 542.895] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [322.255 312.671 401.824 324.36] +/Subtype /Link +/A << /S /GoTo /D (pdftosocket) >> >> endobj -5589 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 516.444 312.896 529.346] -/Subtype/Link/A<> +5650 0 obj << +/D [5648 0 R /XYZ 85.039 781.388 null] >> endobj -5590 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [450.04 516.444 512.306 529.346] -/Subtype/Link/A<> +1522 0 obj << +/D [5648 0 R /XYZ 85.039 664.909 null] >> endobj -5591 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 502.895 312.896 515.797] -/Subtype/Link/A<> +5651 0 obj << +/D [5648 0 R /XYZ 85.039 630.769 null] >> endobj -5592 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [392.387 502.895 512.306 515.797] -/Subtype/Link/A<> +5653 0 obj << +/D [5648 0 R /XYZ 85.039 299.226 null] >> endobj -5593 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 489.346 186.642 502.247] -/Subtype/Link/A<> +5654 0 obj << +/D [5648 0 R /XYZ 85.039 299.226 null] >> endobj -5594 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [311.286 489.346 512.306 502.247] -/Subtype/Link/A<> +5655 0 obj << +/D [5648 0 R /XYZ 300.398 228.091 null] >> endobj -5595 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 475.797 163.49 488.698] -/Subtype/Link/A<> +5647 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F41 2994 0 R /F66 4190 0 R /F62 4047 0 R >> +/XObject << /Im22 5646 0 R >> +/ProcSet [ /PDF /Text /ImageC ] >> endobj -5596 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [405.345 462.55 512.306 474.543] -/Subtype/Link/A<> +5659 0 obj << +/Length 3096 +/Filter /FlateDecode +>> +stream +xÚ¥YoÛFóÝ¿BÈK) b¸Ë»}Šs8jãXm @¿>Ð-³¡D…¤âýóß»äò…¢0 .wggfgç¦ÅÌ?1‹|ÛqãY Û¢Ùzwá̶°ru!ÄB, ˜Ë»‹Wïý`&;vâÙÝc‹Ç·=ßÝmþ´Þ|x½º{÷y¾p]×±=_„ad½¹_Í…u˳«ÏËOwËOWøæÁ¤°îW¸|óy¹Ö-?µË¯¯/_ó›k;ó¿î~½xw×pÚð\ÅÈæ׋?ÿrf8Ò¯ŽíÆÑìÆŽ-`yw|Ú¾çª÷üâöâ÷¯y3Þ5& ±p;Š¼iÉùŽí;^#9O’Ž°=Çi ÝÿöO'œÀŽühf Ô0ŠÂ7) +i»Bv(ÖO ÝD:H݃·_ƒ¸YÖ'"ëT¾¦•P/IKuÑ _ð&Dš×SÉ“ÏOÙz.#ë‰÷'¸éÃOFPU—¯q¾Øí’ý†àöjžèÕY±¯~ž/|á[YÍ$˜Ó<¥u…RY-Þ^Ü9º  ±$[M\¾%þK…±òD²˜ …D´1gešÔiŸLÀ †;8 °U0W´èYy‚2ø?űæ /$?‡ {E›7¦æ†Òú…æR!Ïöú"Ò²V(ð†rXe©Ä„¢ó¬›ãôà;Ý¡t>ÌÛ6˜´ïÆpµ¾sƒV[úÈÒWï‚ þá$â¬â—CI‡Ç­Ó’ç´¬pÜÂ:ƒÕ[fgSìš+æ|>ÒõE‰´T\7L›Gôé„&e¼‘ý¶p­ž¨R9ÿáGË9¼Ô0;Ös–ç½Û(½è¦,©ÂdòµÀH„bÞWÌE3Z*šÅDÛÚµ‘ ,£Öp$¨jÖŽãʸøQhÇb:Û5`N[Š:g*S[éS5“bãQ]ö¨äN!¦m Ë9ƒÁ0W0ØIGKÛ‹|eÇêaÌEv¬=íCBï—¹¦CÚþ’‰A>Lš÷ö¤È—I“À=¶Ù³bÏSiþ]<˜ »3vuº²•%¸‘‚£ÅÆÂÙ»{R[JM¬:RÚNj‹x6“œÅ'h¤&mÑ¢yä´ˆ‘gJ¸‰:Ŧ$%„c?+ ¬´=¥€PbK®ÒíHxß¼Tng<øl¨‡†^àCõèãì«G¶ãXC#¾åmVe2è9P ÊÐdpX8*˜i¶ú˜-û”QBˆÁ'*Þ´Ž+^·WñºƒŠÝ”ÍrŒçP¹PTÆväù&@‹ µ2û:ƒâ’æõ“øó%˜£¯6¸±BÓ«¯–;éÎÞÀÖìwÃÎ#aKXXx€x×J,f`Yð‹÷èxÔðÜК2 åÜ=ÁIÛH×CŒipozÏÂØÄ\HãÞú˜‘÷ÙöHšQDȱ°Ù2Ö^äçâ;®Gñ¿­º+˜]uïaBrP` ë½ò'ª"á=—ð>!LƒÉŠ1 ¾ží„£Š‹ÿÖÀá(„Ó9àÃFTVÁ +°\lZZ ¬¤°()¸=ß)€C‡Ò×w¬ÛâX®¹r!Eë›ûÕ-ÏlÊìø[ž~Ås«ÕÛê„!»¤&œf¹…Þ®Æ#B(Bbùó&¯m¢Hຉû´æÕ|`Ðu¢öè¤rÃ@TٲߣwÊ0‹‰)‹"R+N‰BX „Ôµ¼Æœ7†7£µ>g€¢Ã/DžR±U¨ +¥:\c‚ã§}#•® +*»&å·=¥>€(Éy"§P»=‚çx«‚rE ®W +J’›X¸k"±›(:ÂqE£Ø/ÆêxÜË©6†”MšÁS^†p–3ªlÀœÎº4й¬k‚ áây¢Üª3öê¤kÀÖhjf²õõe…¦âZ+#mAí)‹Ã“SÒ0gx‰\¤è‰ÈwtÏ«Éf(+ϨÔB ±Å²×:þk¯2%`Õìsp7ËcÕ%Wúe·a V})­ +L­‚i—µ +¦Ù’*EröÍy,JNíBˆØ"6{_Õq½Ö%9˜Üã‘[]žCÒ +ä¼À±^Pû§Ð•áS[!®rŸ‹6 lÏÏyãw`É‹ëNI{n¸×0¼äçò¸Ö{½Ô V‹{=¾Eöö‹ÛDRfÕ˜Yß^Áâ’°,?WøÖî’¯ü~‡ŸðâŽG ±õ6ÛâÖdø"°î?-ÿ``r\8¨TƒÔÀÔÊuÖlÇëÏÖMÕS¨9™îÙªXÏTŒÕµJü‡GzÐþÉk[‡®'uHñU×´ýUyaÔ¦º.€ ­ûÜ©r’áÕrÓ¶ŒTãd•äzý)ͼªüëžv¬µL<Ý°„Áã‘œâõr‘Ãô[SÜàõ‡:/¨HÍøA¿†‡WÁâe·6ÄÊa?¦½tjŒlnÔ!fÍ‘ÔE©‹'´ÆSþU@ 'CÒ¿0§ý«:ç_§6UmŸâ¨ë4)¶%j‡¦ ªÛ%yÚo3ðÚ]ŒHú*ÛÌ8_¶ýív‚x½¿õí¬ëAZîB~L߇†™fQº-Ü w!¾s…Œ|$'㣳v[eIyò¶x¬9ÇŸ¤LÙ‹ãÊ¡$ß÷ Õmƒ†â¡/ rU†žÃúŒùV!å±,ÂhJAI¯cû4)Ñ~0·Š"ËCï/£¢ˆ!_¶| 2ú9YD9è\{ Õ(Æij)lO…~ûz¤o Y­[S0AŽµîª ß”ÄÈ!ÅÎ#L^ì·U¶I½'5@UYŒX¿ìÙ˜•ÓS=äMµ§°£á„Ó fÂÐYC>Mð_&J}¶Æ­Ý`‹âê^É—P¬z¾nžä@})'¤aΰz¶'eOB¾ƒžû ìåÓ›¤±*tæ±*ö •‘¹©ô(Œ›>ãU<ˆµ}ÊÑû‡ªñKàIšá-ÙÇ&²„œ¹ x¯åÅ‹T„ʾ“s"ó ¨ndKÌó¼ýºÒªå×#%ÊFN©b‚œNÙ[ÓŠ¨`ÎéáijÿR {Ñ,à7ÿGŠ¶;Þ«>˜xÜRm³œï×jíÁáØ<¸A‹~%yõ·yó%™âù‡¦€ÜA­ýdãr©À§T¼üüÈgACú> +ð–[ç?ŒœªE¬D]Ý'ü¸$êd¡¿RH¢¶J.R%*Ë)ûuÑŽ÷§§ÿ©?Õ8¿{Â×b¯T +Í JFúƒÿzòAoüÈ2üñð¢(endstream +endobj +5658 0 obj << +/Type /Page +/Contents 5659 0 R +/Resources 5657 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5635 0 R +/Annots [ 5661 0 R 5666 0 R 5667 0 R 5668 0 R 5669 0 R ] >> endobj -5597 0 obj << +5656 0 obj << +/Type /XObject +/Subtype /Image +/Width 370 +/Height 99 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 3132 +/Filter /FlateDecode +>> +stream +xÚí]HÝÇs}Y5zstÍÝM±kEJòBð&¥¤ |nK/ +‘ìMñåÂ\ŤÐBoÂ(/üÓ „xa é…(† ^D`‚æ…¥æKùîªÏÿÇ30,îî<³»sÜçû¹ˆÙÙ™sæœï™Ïž£îôÏ?@J®]»öãÇôÒ@*öíÛwðàÁ/^ +Žjùªb[Ž´´´ññq¤³‡ÓARÎ’Ú§bØ[ú788øéÓ§[[[žßHGÂthº"I:HÊYRÜþ£*ƒõ¸ššÊÊÊⶓ““ÝþäE:rNI [E…ëk¦ã–Û~ÿþ}xx8½ °X,V«U>׉t>>â«0 Ü69äСCâJ쬲¹¹éççÇmÓ¹Ý%«øúúò§ÐdŒ/ÊY§OŸ¦³Nž<ÙÑÑ¡èqKí}úôipp0÷•·ÖÖVi¯Ä¥>”C.ÊJÇ «°H ×ݼy3!!”À¿+¦ +î^<¼‘¼kò[DD·Mâ—~V±ý¢(Ë»”Š"9 WÁA³5J944T¹ãöëׯÉÉÉ\]YYYSSS’_‰K}(‡\”•ŽVa‘qüøñÊÊÊáááééiZïìxW¸ +šÿüüùÓ½êJn•ÁÁA«ÕJs§šššÌÌLn~~~ww7]3ÉóÁƒ­Bk½×¯_óí*..®­­]YY¡Å㎕£Ã*ÇÆÆ666>|ø­ÄqK¢–rŸ)4G}ÿþ=£+q©勲Òo)ØVòñãGª‚ì×ÒÒ¿+¦ŠŠŠŠ††RF×yùòe/Z%55U«Õêt:º*’!·ŸÖ€W®\¡ý‡~òä‰C«´··FFíà~Êí°ŠÜÜ\ÚCÓ¶ÄÄľ¾>ÅÛ¡¡!³ÙÌM5óòòøU3#«ˆïC9䢬tÄ[…E +¶UÐY&“‰V:GŽ©ªªâßS-ÊHDƒDšžžþæÍ9¬€Á´ +1ãÖ“o±9,–FHII EO…ÓGWW—‡×é•>Üè‘Ž+ =¬â긕öûk½½½±±±ô}FñX°ŠrÓU„­¢¶'m +[O¾¹f_òâââ­[·¸‡xÄÅÅõ÷÷»šÒ‘g:HJØ*xÞ&#{wvvêõzÚCkÛòòrÛ_‰/ éÈ3$å,©£*†é¸½~ý:÷211qxxØÒŽœÓARì’öãöíÛ·:Ž6´Zm]]‡ÏDH`Ür¤¤¤ŒŒŒ OžÛýû÷755Ù~y Ü·.\pö4€tpáï ¤òA>ÿc5`Ϭàdò—?€½d•ÑÀ*1Vaw<VU° +VÀ*° +VÀ*X`¬€U° +¬€U»ÏŸ?ÜþŸ’œYE @ª}ÀÞfuu5--Mªç¥—CQuèsÔ –sçÎq7~HHÈŽG¦ÄÅʼn/ŠÞq:È•LU@)¨P,¡¡¡_¾|‘ªX*Š +„R€X$ ”P,P +@B±@) Å¥$ ”P,P +@B±@) Å¥$ ”P,P +@B±@)°FÂoÐÈ_,P +¬éîî>uê”Jf,AAAP +¬•B7šÁ`PÏRJ€µRè.‹ŽŽVC{¹=A)°VŠz¬BlmmA)0U +÷FõXÀT)yyy###° +ÄW#¡Rh90::ÊÈ*_û4„ìS1*…ö°³Ê>À8MÀbÄUŽC{¥ì‚UŽ6iF#­öP)¼Uè­4)))AFÃHDµ­v¦Þ*n@bAFÃHD­P +±¼¼üÁE, ¬‚1ŒDTÛja¥¸‰VÁF"êl5 ¥À*ÃH„õeȶՌ”«À*HDVa§¯XŽrd~ÏÂ*HDAVaªXVU<ŠüËþþþ¤¤$N—Í¿ÛÕÕuöìÙÀÀÀ‹/ÎÍÍy½Õ¬•â¶Uh»­­Íd2Qr{ŒF#õ½4›Í===ÎúÙþQ©]eeeááátú¥K—fggí«°?kuu5??ÿ¯)((X[[ãÎ(­¡¡.R«Õfddðá: Î +§B^½zOÇŸ8qb``VUø—QQQ$õõõoß¾UWWóïZ,–ÉÉIE?¦Ù»­¥[€ŽIMMÝÞÞftn[¥´´”¿gy¨ëêëëcbb„ûÙöÚ_UU5??¿´´TXX˜““ã°Šgݹs§®®nyy™Î¢ÔîÝ»÷Ÿ¥=|øÂ¥Sî߿χëð +N…ܾ}›Ž¤ãŸ={fûÌ=XV¡Ï²æææ³ÛƒÿþæÝVÓÇ. ~îoeiÒ"7«8;’Äâãã#²Ÿ ƒÁ°°°Àm“C:$œGdd$©ƒÛ¦òõz½øÒffføp^¡³Âm !çøúúÂ*° +ÿ²³³óôéÓ4*Nž<ÙÑÑa0Í üüü¼Þê]‹$V™˜˜¸yófBBÝ­âû™ ~¶]ÝðF¶ +•ÉÏߨ—ø°Ä”¶¹¹Éïð +.pI°Šz¬¢Ñhh²êldÒü¶µµ544ÔþÝÅÅEþÊ»­f-I¬rüøñÊÊÊáááééiêðÿìgÛŸQ?ÿüùSÌ'‚íYüƒæ$4»_O§ \¡³ÂaX…  ¦¦¦ÑÑQZ,óµ466ŽÑ~º§øoøÒ»Ÿ>}²Z­t_¼{÷îÆ2i5S±Hb•?R×MMMµ´´÷sTTÔëׯyETTT444ÐÍK‡ ^¾|Ùa;Î*..®­­]YY¡•ˆí>J£—t…´>ª©©ÉÌ̸Bg…Ã*° +100O3ØcÇŽ½|ù’¯%77W§ÓÑþÄÄľ¾>~òL7W`` -ÆËËËiž,ŸV³‹$Vioo7™L´p8räHUU•p?ÓÁF£‘¦‘Ü=¨ŸIDƒ–NéééoÞ¼qV…íYÎ~M#PZjjªV«¥ë!óÐäDà +~«À*{©ÕŒÄ¢’¿­e}ñ° +¬¢ÐV³ ¬‚1¼‡ï/µ=ãÔ½q(,–ïß¿Ó2!ÚÂÂÂÄ[O¦•6MÀÚ*xÒ©çbaýÔ&€çÖ*5?ïÔ½s&Î*‘‘‘£.299‰Œ¼•&2Á¡XØ=  N±À*iÅ«¤ËóçÏa€„bÑh4° +@Z±À*ÉÅ«¤‹ÉdBWx…ÿ|_àYendstream +endobj +5661 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 449.001 512.306 460.994] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [322.255 554.709 401.824 566.398] +/Subtype /Link +/A << /S /GoTo /D (pdftoepsonusb) >> >> endobj -5598 0 obj << +5666 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 437.876 146.308 446.535] -/Subtype/Link/A<> +/Rect [111.316 269.847 180.062 282.749] +/Subtype/Link/A<> >> endobj -5599 0 obj << +5667 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [470.223 421.6 512.306 434.501] -/Subtype/Link/A<> +/Rect [131.434 188.552 232.166 201.454] +/Subtype/Link/A<> >> endobj -5600 0 obj << +5668 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 408.354 512.306 420.346] -/Subtype/Link/A<> +/Rect [111.316 134.355 171.288 147.257] +/Subtype/Link/A<> >> endobj -5601 0 obj << +5669 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 396.191 215.035 405.888] -/Subtype/Link/A<> +/Rect [111.316 93.708 147.857 106.609] +/Subtype/Link/A<> >> endobj -5602 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [367.133 326.755 512.306 339.657] -/Subtype/Link/A<> +5660 0 obj << +/D [5658 0 R /XYZ 85.039 781.388 null] >> endobj -5603 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 313.206 323.852 326.108] -/Subtype/Link/A<> +5662 0 obj << +/D [5658 0 R /XYZ 85.039 540.961 null] >> endobj -5580 0 obj << -/D [5578 0 R /XYZ 85.039 781.388 null] +5663 0 obj << +/D [5658 0 R /XYZ 85.039 540.961 null] >> endobj -5577 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R >> -/ProcSet [ /PDF /Text ] +5664 0 obj << +/D [5658 0 R /XYZ 303.989 420.414 null] >> endobj -5606 0 obj << -/Length 3715 -/Filter /FlateDecode ->> -stream -xÚ¥ZyÛÆÿ?… 5…®(Þ¤…“8ŽƒÔÞÚE \‘»bL‰4+Û~ù¾k†#‘’P ¬æxs½ù½sèÎøsgIh;þz'®í'Él³»qfOÐóæÆŠ¥, šoîoVßGÁÌuìµ³žÝ?ó„vú³ûìëÛ^ÝÝ¿þ°Xú¾o¹k{±ŒãÄúöç»…k}äÖ»oßÝ¿}÷k4ºÖÏwØýþÃ"ñ­{&zûnè~õ·o^qÍ·Åo÷?Þ¼¾×;Õ{€]­q›Ÿo~ùÍ™ep¤oÛ_'³”Û…îÝ ìÓ_êåÍÇ›¿ë©¸/˜ñ¨)®„~b‡‰?f‹lqý5P…³ØóíÀ‰ˆ/ef»b¿X†^h-kþ-Ó6o~Ï» .ûVº¾ðo6iYæåËU–Y•µ#ݯå÷N‘uÛUW­vÏ˺)ö]ÞØuòÈu=Ûw½Y¯í8ZOMÑ, ":škÞ¸ë%vGz&<Ú¯ŽVôÛõ//È$ãõ¦Xi®÷®êòÅÒó"+}J‘¥X추˜èZ/+kÇz¬¡*¡«Td2tŸvÙv /±žKjŽ­ù÷‹$°*¨$VµK»b³D2„çÝwíœÇ>6P­v<â'Ø·¶ú?jhl°’XîeÿdWHøt‹Ì3É^|†g$«úÅ2ˆCØ`[a vô9.˜gÒÅ?t. ¬GÝ›E=s­\„{ð¤‚ù0]º£2ßü·.ÇÃö”öº!^4”ë¹ý&¸…!ÓŽ&†ó“7´Mœ¤Â[ñá÷XvÄRdMQϹÿ±©v/O1ä%±½†¢Ð̹ "ìhž„âƒ'E½4ÈÇ¢y:'n~ÛuõËÕêp8Øe±‡‹DAâë{Z=V¼gϦc/Ý ±}P‚æé׫¬:ìË*ÍìÍSñ×Ç¢Ì÷Àö¯ÕX8o6ê?·ÛêðõH…ùIdû ?#»ëy“ÒâÅí.¯^‘`/´ÃØ»"ÁBtM‚‡¹ÎKðéz“l¬wORÆÁ"ÖPDè(("ÚÃ$U¶›4w]Kˆ,¹Îb„ÓîÒO4ŒðÊM-¯!ë²Ì2 %s-^:OÕäiV ô<1ý¯N8ºµ vmÏ]sè,<õˆYGð<Ó€'ÃÏ÷];òáw ¸ÿ#<'ÄÛ# já:±ƒ8˜F‡Ð, ¢ xœÌÄp Ý[Ô¾õ`è¼´Çûöb€" vHßc]ÔÏ3·8¤,¹–1Ä>=Ü(ÀÕ4jY¤y Àå{¥ÃÊò…Lµ}IÿeF«VÆ’Ð"Rò/}{žtO:qy§Û2It¥¡{ñ»·é ?Q·ì -<zHež6{.~ƃg$I¹ñ7ÜIó±ê‡&m®`ï„{#ŒÀ2ÉžYúŠÎ¶Á ‚Àúj‰WtÎËÄ>h˜‹:Ê :¯£ÑuqAÑQ£õ¦t”¹ÞÇy¡nÒwëºédº¼ gDnšb‹ÙäDÛ•ÏÜ̇óœúŽlZÚĪo›UY<¬6}Ý®@rÁ¶kÉ&%I3fíÙAäË à‚°âˆ\ðe?°K©ÄÃ6oÐÎGkÜü&Ú=¡`ßîÐ/zEúÜ„HO÷W2ø‹Žkìø¤©«øwPÍ´žô’ÈÒ 2[æ°¼÷ÀZr›=¡–^‘ûçZ·ÈO”t¬à|'°ÚçÔ÷-ÜPžoªšª/hL¶]>²^fèYê\5ž¼!,¤5 OU“9"¿›AvƒÞ'ZÈ à}a4cîk|¦´)›³Äiõ’À^XQ~©u' ¢äÂ%Ƹ=l:ðû¬°º±íÆWBƒè‚° -Ñ5a½´ ÖÓõ&…ÕXï-ºž7¸ÕXi$Øóükî†çZNx?±Ñï#ú6?Ü2Õtd's§²è3M^R€pxÉ"F¦C1 Ýdìs¬o(î8^áJ-~ôîËŽoûX¬e&A_Ï*‰ÿþ ‡`äT¸æ[nF–ø9ædøP«p°á í‚ö<Þ;ÙßúÙC€_ž,¡ÌãoV°÷V ÷!´Ý¶ »æ‘Ï{DJЭ+(úx(s¦ÂV°â–ó¶ õ–v, $]ŠLëúZt®ìs%a7Ž&piŽfù¡IZ&w-DD ¾ÚÀû½Âj»À1‚>mÕd2$\¤nR‘Гr•µ Ïd:mܳýÁâíͤtO¸Ö¥Àö–É%”„{X*öK9 CÀD»ß ò|d­èÂdRCB³r›Ðl°Gƒ´hCpíTñ™¥{ˆ¨+n0×iòV1¥ì”ÃŽäiUm÷qÖYöø{õ à“OY”Ë -"ðØå <…G,ѵy.ùKÒ‡QåMÇ…žÃwŒŒi”v˜‹˜(sâ cb}«"œiˆl¨6‘)@ùyž8m¾ßðZ¥@{@ÂÍ,½;ÃuJnÙ#Ìw(¯â­g2«S>mÎ3Á,X„ñ–1J[êõrò<¤’62VŽi¶O´©öm×ôÄó€]Üi“îÛ:Õž>zbHG\o¸<¸>·œûà½C¬ßßKµA¶ÅŸºÔ—•Rl±õ´«6xìDz0>HYˆBôØ3ÜIÈ™-,hQ"3ý”KFâ7h\hÚ²[Àcò?žäŽžL6-Wت˜u¢^„rC)÷CIƒ2î+Ež>™G å„ÊDMËJ -‡-óFm¹ÅÔƒ¹88 -ƒ"Ŭ´¶øG@ÿ@HÎ3í+y‰¦ÒÇ…‘ïEb¼cÄ-Oh½’±SvcHؽ<çbù‘g»W¡漃%4Wü«K«‰{uºØ”we,†¹÷d}’Ãû‹R;Ý–ƒÄ9SQ&ÿ;ÎÀþ‡›PâɧNØáÇ_1üPÚWÒ$¢ ÷Ú?m…ªâߣÔ*µ°Ã’zZËJ!N»poûò™½šÈtÈBÇv"W…Lû|Âññ0ð*ª*v¢Í›.ÕÛp©T½X²KÁ²ï‡°´wÑxÑ5|\ZPät½I„ëQB%é(¿<Îõ"Hùë8Fú$½Çt¡£²d3Póâì7ŠÏ8Ë*oWgÙï¹vG¾Ìþèû…èû/-¨ØºÞ$ûõ4›Ž¼Wv L-{. /ÞnOŒ=Ç)'¶×Ñ5N D8%D×8uiAÅ©Óõ&9e¬÷µ~Åì4¥ .bNœ6ãf -!¤Ì#x,”÷à´1´*›‚=»TÅ’ò(šO4‚«Ä:‚oMEΙòkZç"q> ×d>öÔWcù+¾!)4XÃJ ú(ð[7l¦³ÞX0C¥m$”L‘è”Vd˜}¨ ¼u\dç -G9$œÁÌ8ê´æŽCZ>§Œ+’¢×ïêNÞ’Î@ÒK;‰®<†Dç!©ˆ®@òâ‚ÉÑzS4×;É ;Û‰§;g7e« †’£Í`¦@fD¤èG/äG;/0P|âA®v*\(DH­á †.ÕŒíÚ¬µ©äy— 8c"ä`H9:[&>02:Bô<Ë¿›|Ž¡û:žlRì«Š­œU_v‰¤òRò¯äBë<#@ÊáæܨB,#†ósR ­±]¥8Øl¤’A¢iͧvB`—Ûù%Á Ûsã+8ˆ.à\ˆ®áüÒ‚ -ç§ëMâÜXïrlí΄a—>pé)#pù± ÃÃJÓˆW†ÌØ)ô\aïÌ‘4J((® _Æk&|ª)u+2: N±Œ(~©±Ëê_IC²§cŸùÌÅ[:ÞÅOv ºzÛ"ºÁ ¾xkvðݵ ‹%˜èÞ0uïG1ºþ¸7|ðê÷$<úEzê©Œ ”@šÞ¸›"œøâÆ š H©Gø‚Ï…ïµIÉ‚ÄH«pÖ`m©°?ðë3F"¬.º‚^ Z&jhÈÑjˆóãЗøÜW]ŠŸ‚`?½²øÇ”ílÊ}ƒïÐÈ2”Ø’á䆢ú8ä´ƒL'ðý,bY¨¼˜ð82tNO·|òA”õã)N>ˆ§²üqt[ŸŒqEýI. ûRþ164„ÌUoä3‘Žä2æÌDú¤RVÔÓŒó=§!뜀¥µÂ ÷˜tÂ&Ãra¦Æñ`+Ö$ Tç²Àq8þ i8)¿;±P[ÊØ.£0€˜E¾ÂÙlRÎ=å¦{Ð9JöôLZˆ€ýo­ŠþB »~GAxPÍñ8q$åSÞÌu7zš1ØkÐz‚‰J¿Ì’åﶷ*ï9@ÝHÜÖÔ¼7ÁÃi&ù4£+v¹úŠƒNšE|™‰×-Ò‹’¨:çYøà©M¾Ê:39Òÿõm­6ò¨æi7ô<úü‰÷‚,ôÆ^±úw´áÿuv¦îendstream +1526 0 obj << +/D [5658 0 R /XYZ 85.039 376.727 null] +>> endobj +5665 0 obj << +/D [5658 0 R /XYZ 85.039 341.317 null] +>> endobj +5657 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F66 4190 0 R /F62 4047 0 R /F20 2961 0 R >> +/XObject << /Im23 5656 0 R >> +/ProcSet [ /PDF /Text /ImageC ] +>> endobj +5672 0 obj << +/Length 2843 +/Filter /FlateDecode +>> +stream +xÚ¥YYsÛÈ~ׯ`)UY°j Î`p:O¾-—VV,:Njw $±ÂA dýûô<½É–ËÐÓÓÓÓÓ_C=RðOBÏV&¡¶MŽ’âB–0òþB ÇDX&žW³‹é;ÏieG*Í[9žízf4›ÿj½þðòvööóxbŒ±td'AZ¯¿ÜŽµuÇÔÛÏW7³«›÷øåQ[_nqøÓçqh¬3]Ýl‡_þòê%[Ÿ}¼x;ë5íu­"TóÛů¿«Ñ¶ôñBÙ& +GOð®l ÃÅèi{®‘ïüâî⟽(sG<ë˜U:Ž‰Qvºç-ç)ÛSno9W,§•¶]eFšî7¥ƒýÝiåÛ¡ŽÂöDÛƒÎ<„„z)#ŸZiíØF;‡jio¨–p Õúp{õñî@/7°GŸÓkÒñü`IOÛ‘Žö,á©Wwo&M;vë\ OÁBÏʳÞ´U­Á—”þþ £Q`½CªaˆxR£yZ³Yu=ž8¡U!CÛà€oÅøQmPÜœYµ§ø¥ZàÓ…ýÃàOQ¡§’GÖ89+Ç ´MkáˆË9f!o*48Mdû*àE´SQ¡„ÇlžÁ{¹dÿ§|OÒúÊÀ‡”Á!ÒÛU kcE„ŸwÒ ¸žãÚ?¨X·,‡9CxÜJp¨é¨Ôÿr‹}€%N&@½…ÅxoÝÊ©¾¸! ošx™2ª, ]nëšÞekÀÕ$ wx)«ŠØ‡a¹ƒB€êânÀw÷Ü´iÁ¼ÿbÒKê4þ>ã¯a'i!I-Í3m$u |„¼÷˜jRŽâ|çºw§eC –k"Øz‡üZ`ŽÃ˜û^_óû°ÆÛÅ%¤×÷·Á—ˆ©²…ºâN%e1Ò éP`Èe³^`ÜŠŽ§–>bƒ?ªûAˆÀžW]õËgåºÞÞYq$ƒ¸<—]ƒ4I0’¹À›ðd̳ȷ[Z3­à 1‡ C«•Óg[I‹éž%Ų`Vdy,ÈnyÇ ºõu¥î8ˆ ·”ë›ön[6ìw7ÍÐ(}á’2Wyà‘Q 4®»êttg•ÈR xyËŽ{+ö‚Óo›´LR’2<`¨rVµò;«Nö¸Wñ.0§š5æ˜Þ´u]f+[ðSŽ±6}ŸVóÈ*–<’à +Puà i?yF¾Ý?Ðdɤwà6ÎdÚ:x”¬Ó’sûuìÏÒÐÈh_¬Jå@2£l߶ýκ™„_õÒ±N¯IÓ”Ë"Ú„ÃcDŽ,äDárËÉáû~!̺æ|Ÿ™Í]ÆC'¯âW:d¿æz}óép˜y!ª~^ê~'_þ-PÚoÔC¬ú¡¶Ez´gúMQL•P«E›–ü +VcÚSÆú†æjÃô$îz?‰eÏt…øCŸ%–Ç ŒìUÿ¤‰¬²½¦‚V +:Ñëã¦i{Ñ¢LK‰/?cê‚÷bzÏS—Õ)—SyD50ÍÎ ëF!HôA6Êœḏ×gÚFá¨ÖÔPVå æ4CNh˜ Ýýà|mß4£®ªöo°Adzòutº°sí¾ˆ´R<ü›6.Y†]¡CÓÀ6ˆgºŽÛÕ´­¦YWÆLª`ŽìrÒÉ!Õ¹$ß²t¨T©GÛ( ´"[®:¸{‘ußOãh/—;ø‘‹Oš³Œ5žø¥Ì«x˜Ä#!Ø Ç8Æú Ä…¤Ũ \J8˜*5”íƒ&:è•Ócu=ÏÁ¢ ¨Ø%ñ˳ҸQøEéR (ÍÂ$Âó†{pü– ,ϪMÍ_¼J +U1ÁžÈÊí¶Äñݾ—îš{œ²:)¢yŸËÉVÉNÄX¦Çê1¾ÍK“I¸lµßð.)xK–nR~Å>½áû¡¢Ó +.¡€éæžÑ¿‘(˜®|ž.¦&L +.p "÷1JŠ[#ÅmŒúòk7&ÃÇâ$y’—Á“:fŠiYJ·W_NhGA4r<ßTð£û-áž Ø©؉&û2QUÛ®!$¬óøyYW›rn7›ÒNªbJ1$+—Óy…=_Ù’¥·È·Wm‘ôadÐâ悔!/<Êî„}IráuòrÅ1÷l¯´eé»;×6«·½’£B;ý®»ó1,¸‘uCçÞŽ  gl@ þÔÖôÆb$€p½v½áë8IøØó}Íää1T Ä†®êNlKyÔÍžÝ×–çd¨þõƒîpRº£ïR0 G** g »‡§äUË߈$ ñÞø>ÂàOCXð0_Ùƒ”–.Ü‘ô´ŠEFú=NèV„Uœm¡UIqÃqßî úÓ½hó´ÓÖ•G0—a3¡ŸÃ²¹|†—ÂqI8«8_p“P-DõHÀù•l6ïs“<“_jÿŒ•§íO2(ÍSÝ´üÓl +\,>=cf¸Äиé»´Ž¬}Ét.¹ZºðzqÄ +_i«sÎr·3P˜ ’íè—z›u3“bi7t¥I뮯ãâøjµãÛçAÛsœ¼‘Á_”ã0«--2ï`5_û1(¿ö(3úÄÇpì5žX‚ €Ã8Щ¢…o +3~ß^õÐ=ïô1­OmT”<»Õ-ÏIû>ÀøÏŸã°iþTÅ]›áÁó†.E&÷1õ§~µ’žPBÓv{xú¥I +¨î•ðþ’êHME9ªüXUH©sÜzFÙÎÑÿÙ³ÿÒÈý @©šÔsÛÑ.xÎaÔö Tÿ¡9Tø¿ï›„™endstream endobj -5605 0 obj << +5671 0 obj << /Type /Page -/Contents 5606 0 R -/Resources 5604 0 R +/Contents 5672 0 R +/Resources 5670 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5548 0 R -/Annots [ 5608 0 R 5609 0 R 5610 0 R 5611 0 R 5612 0 R ] +/Parent 5635 0 R +/Annots [ 5674 0 R 5675 0 R 5677 0 R ] >> endobj -5608 0 obj << +5674 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [286.952 649.25 512.306 661.243] -/Subtype/Link/A<> +/Rect [111.316 746.78 148.718 759.682] +/Subtype/Link/A<> >> endobj -5609 0 obj << +5675 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 635.701 387.349 647.694] -/Subtype/Link/A<> +/Rect [111.316 706.133 218.725 719.034] +/Subtype/Link/A<> >> endobj -5610 0 obj << +5677 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [470.223 621.849 512.306 634.751] -/Subtype/Link/A<> +/Rect [127.983 252.984 490.789 265.885] +/Subtype/Link/A<> >> endobj -5611 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 608.603 512.306 620.595] -/Subtype/Link/A<> +5673 0 obj << +/D [5671 0 R /XYZ 85.039 781.388 null] >> endobj -5612 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 594.751 146.308 607.652] -/Subtype/Link/A<> +1530 0 obj << +/D [5671 0 R /XYZ 85.039 550.012 null] >> endobj -5607 0 obj << -/D [5605 0 R /XYZ 85.039 781.388 null] +5676 0 obj << +/D [5671 0 R /XYZ 85.039 517.795 null] >> endobj -1778 0 obj << -/D [5605 0 R /XYZ 85.039 207.502 null] +1534 0 obj << +/D [5671 0 R /XYZ 85.039 237.54 null] >> endobj -5613 0 obj << -/D [5605 0 R /XYZ 85.039 178.704 null] +5678 0 obj << +/D [5671 0 R /XYZ 85.039 194.396 null] >> endobj -5604 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F14 2895 0 R /F15 2876 0 R /F56 2890 0 R /F66 3242 0 R /F20 2865 0 R >> +1538 0 obj << +/D [5671 0 R /XYZ 85.039 126.4 null] +>> endobj +5679 0 obj << +/D [5671 0 R /XYZ 85.039 93.979 null] +>> endobj +5670 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F62 4047 0 R /F35 2976 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5616 0 obj << -/Length 3359 +5684 0 obj << +/Length 2104 /Filter /FlateDecode >> stream -xÚ¥ZëÛÆÿ~ÅU_J&»|È?âÔNã^|g¤E<‘'1¦H…¤|¾þõ×’”DJ -#Ñ>fgggfg~;©x*ßó*ÐZ¸Ö]ÞuEµ†£‡‘µßñïÏûºKÛ9-ø±£¢ä¼\ É¥‚‘E{¹tÂC ×ý¦hao_Yü«­´â~þ-ÝîÊœ;«¥­¬z»M«Œ6p”z©#ë‰ûM½´¡WwÌäi©c«Þ—@% ZäwÜI™jÓMQ-ubÉÄŸ¨‘Gä÷z!+[b´‡¡-6€JYkÔ(ÂVhA>|-ÿV´¢hèíš%­麼á±*Ýæ7´ÿX¬7ÁE‹—¸ÉÍ;ïP£p7pÏ ½ö-wi¶EÙXöŽ™-ð¤Mi¦æß?ê›fí]Þuö]èú±ëž}±Ëb[tß)Wû§³»t÷.Kz`{\ÑEÒhdzí‡h-0ê´Ìx ‡Ü¸GJøŠJË›gjA¥H”c7"{°…žïjþ+œGP>ž™[^^ÓªÀâÃáä¯eæ‘g²ýg~s÷iS,Ñ)AìM.‚‘Ørâ±'¬jòÜ ÃÌo®ò#nÜÛþ©è6Kq;èR'ç%eÚvÜë¼€q²ö[Rͪ†kAyƒÀeßI¤äqºDŸÁm™{$ÙêÜ=ÑÌÇŸ ÙAüÑÞÔK<»áÀDÇ!ˆo84ŠjÅ$tò•Ì¿Z­ê}E7jFüØw\W ™SA8‘§HüwËØ'/ñ¢#fH=èe8‚"‰‹á0G+4²¯+Ÿ‘ÆÄÓ漬¿è¸R‘g”2Uå´Ò˜FÌ^; -A4bø -vmWïÚCTmE^LDªÚ¸<-E\PÇ¿ÃÍ¢øs쌬Š¶ßnñ:.ê"·Èƒ»³P 0¿Ö]½• ,õÔF`¦åù¬ÆûWá„*KÛÑ´‘½>_¿î†¤€û=>.;âá|ýtà[{öAl -©p/czÑA`¥Dhok¾Ä¸žy©pÃØ­?0Q=´ÜIé˜ÏtSÖ¸ªDÅY×´MÙÖ¼fK‚¤Õ0Gâ¥"+¸š•H”IøpÈÚwÜW/\Â{À[€N¼Cîs-PŸ>1’Y›Óm•— CÉüU4ÁÙÑž¼þp¢Y ŧÀ2Ôöˆœ–7…° ]±®Û½¼¹yzzrÊ¢Ú£× -$§nÖ7òtùw o)gµ.Ž…ô"€]t(äö34'¢€¿cN æÁ²GÑÀòˆf,û®r\‚eOÀò« oŽÇ‚1H~CŽ;îÜ"\6¡PàòÛ¦øJ;Pc痢ʨÿdÐTZoJÂUÇcÓgö’؉. ìÍ<Âöb×ña¿&÷ã ‚©YÇ k•e+þ…8™ðÔpâ%^ê캂‡¼()›kŽ6H0@Y‡þFÚ¯(dõÉ%~^®]ÇoG€ªD$Õ|G-ÿB1!ëK¤ü€7 —¯¹Ô %AÊcùJY=Ÿ#F@ŠØE” -|-„éD"Dš^AHC0GÓ’Ç ¥Êäq |‘M({ï×ÓÏ'NÍï£w„SnÐÇt -O8@VsÜcopç”c È­‰¾YŽhJ{v$VysäQ°†wË_Ðà×›I¨Â`UC\&‹tå žF`2ˆŒ=ÖÇK2Ž÷xÝw]z¯àoýØå -P2ËwìxäàRÊ¡9,[ÜÞ¾]p“³DΠúû6ψ!xTSwƒ\©Yúáï {âHœd -ߣòƒïkÁf=^‡ô.üíOìûCJKž¼E=Îß x"çDL#«%ç6¿dQº´0B¼(‰îx ÷¦Þ±P’Þö@±®OŸ}YA¯q1èó€yk-ä±MÚŽ*oRjé2÷©` -!S‘ !@rô¢Ð…E×ÇX¡ì… ‚©°hÜYÉ[:{zs† AcÁúÑatZKØ—²-4ÀCKàçЛØ?Wºúx£¼ùç-,LÎŧHiÌ<Æpˆpið>]¯Íõ¢ñ%?®qJÂ0¶3–ªÂ]êThÓFžZÔ£ŠünÈ7)n@’'gµïýá3¯o¦Š³$ÕœB{Ѳ]k“ZF!‡Ø”ŠØ^ÿ§?| O~rê/Ë ´zO°áYï;¦Èå-×GÃp”µAâôAN‚Úu7QCU±ĉxɬɸÐø…¢Gòíæ§ïy`ôœbÇÅg‚jï@!¯kz\NßõžÊ©àH.½œ‡ÚG<3zH8"bH0þÚ£tì„QØs’RMt²£ç;Ê;¿!“œîw K/eû™pÀéŸ×MÑÉ“Ú”ó!†Ú/çt'ñÝKºˆÎèBˆ.éâ܆FÇûMêb´c&ŒzTbÀ&¾¯¸5i€`¿“ -KÓÉ,^^YƒêB\Fɤå1üÞa­–Œ£GÉ_‡•*á„Pà-·û‡W·á¢k§ -›KØp\ƒO«vÖnÀ=×»`·èŒÝ„è’ÝÎmhìv¼ß¤ÝFûõXSÖ8¯Òô1 ¯I=Ù7T› TG™±O‹}Ú¥zc»8dÛ#p¡O«ß ‡!5¶R¦c@ÙŒ> LFÅ‘þyÃŒˆæ cˆ.æì†b˜“ý¦ 3ÞÏúRÆmöý—Gñ¦AS«¡lróápªJÎy;t€Ó/<ku\¦Å.,ÑÆÖ–±¥ƒZƒdCm -y}Öò¶ÐÁèm‹ñË–dÈ¢Jå–3]Qèe¯m_Èæò8Žõ e`{’´i–µý¶è…Ê;ù&Ç£RN÷”?<qœªF¹T*MåDÉ8hióAZEÕû}Z–G%\O™§8PÖ¿ˆÕjßœgÂj„‡HA[œÀT~êRIÌôû[éÐQþ@`D3_sPÊý} ó¥æp¿‘bÃN¾£Œ%Ñ*pT0p¸ø§ž“øÁäF؆—=bv*³]`:–¹¬×ü ~W”˾8r÷\±½¾Í鎜ÿË”d¾z‘øŽÔ.@U¦®@X¡ÉOã/ ‰­)´ÍèyËp ÃOÃï„<íÓ_œ°,ÿƒt4ýç)¶ád÷¬&Šc:rbNRË÷ƒÇZ‚>®5ð…ðäÇ/Û2ŸÀ¿Iì$J ínô‡=’„Ô°Žé(&¡¾ù«Ëð˜K#ÄâHŸÏ"Í|š 9äÜn’BŽ7›Ê £Íngþtdî¼!¨J_€3Íüy…æÂyÏí&ç=Þlê¼£Í>·cHQq è\…:pAÞ 0a ™?°Ð\8ð¹ÝäÀÇ›Mx´Ùªñâ{ñí\áÕuôdqþã ùý‰ÚP°öœx®@hí@,YPnècy‡Àé¼Sÿ ò:aendstream +xÚ¥XÝoÛ6÷_!ôe2P«¢(JÔöÔ¦i›bͲÆŬ}P,'Ñ [™$7ë¿û¢,KŽ7¬“ÇãÝñøã}Hy!ü)Ïš Ô™—Zhk½Õfzw°òv¦„c!,‹Ï«åìÅ“x* ²0ó–·{9&ˆö–ÅþÙ»—WËóó…ÖÚWY0_¤©õÏ>]Í•ÍÔ«—Ë‹Ë·8‹¨üOW¸üËǹÕþ’™..÷Ë/?¼zÉ3„ó/Ë÷³óeoioX•¡™Íþøzéý, tf½G‡‚åÍ ì L¬e^Í®g¿ö¢x-öx×1¯8Ž…kãÓž3a`¸÷\¬žS¡ +âP{Ž ]÷9Téøt*Lk¬76Qèx&•jTQ Ut qý÷z¾Pþj×Áoœ¿»w˸hJ˜|GÖ'®ɱ_ÕóVyU}cJ¾-xЬa¤¸÷ÿ- __°ðz“îþ3åshÂó0#Å»Ë-jïj1&²¼n˜Ö>€e)«_•àÍx…î'-^[Fg¾­që™òŽ±Voù× ’çtZœƒÌÇ-ž3aÿ 3¸‡ä4(ö<'@!Lÿ +Š +÷ i<ŠÆ–<€Ækw›ý½Þá<ìðc=½@ÜZóZG÷„e¯FUó/Nù÷ëfítÉ   >&•-ÿP[ˆøšWÆÍSŒáƒM¦ „V„ð­äÞûã*? ™ÀD©¦hÚ”$¿ªÁ]$o¨C(9¹²ey9ž¹WŒ jD-é7b ?Xcz&”ºÂîË›NdÞ°ùðFaýåO€5‰m`õé6à!èD°ª‚̘AìO" ±ßÒÙ!Ü'ØAÔ7&ô_7åWòn’úç¯áÂJzjIÂOÈè,º0$žUøîÖÛî)›E×I›÷]Mÿûèòîˆ?6µÃp¬ i9¡û&gJ^¸$KÆ”m×ä]-ï*Ö ?œú&G\ÑYpeÜ曲*st àщéîÑh,¿ Ì5 "M_ç&@uù¬Ô·¼¿»§3\¾ón÷À ¥ØÒMiè”]¿4óŸQ}aé•Â[­à…-wÕ·gÈ1 éÓÁ–6¹ƒ?L,<Ùí‘› +`x÷–×Ë[^ÙÖ½úvq á ¹¦7zýð{Ÿï?§%WAàø·’Þ g(I[«êPRѧeE¾ä²bü‹8÷%eºØš#WÕûqXä¹è} ·}*Ošr J¦Eš¥ÒXèQc¡':º“èXæŠÈEP§)“q¢‡,cVì² ;Aï/ªx¢»_²0M3P”FD‰2 ›¹å›(ö^×`™÷ë TTP**è8 t¢úÜ™$€ÿ:uS¨!¿ZAb-'¬ T›ÂY0@J©cgš¬²g1ØÄVDÂu$ÍxSÞíÓ–:N¥ÑœQæOle4á†ÇöFIÄ‘=fooŸã™Øw g, Õ]M +Á×ÓÖ +ÉûÂ78ÀŽ»îÙþÁŒŽñ,Pæ¤ëû#i£€'ßÇA˜¦ÇŽ È…!Sß×XsIRu²tCß!tO•›‘†GšƒrSÿÏróš}{Ž¿}§ì¤Ñ{ž'ëÍú:­ KŒ=DïšQƒ³„[(¶RkL¶¼Ð¹ÃZÆÁò“ðܼ—±ƒÛ%' ø.ŽŒ3+áj„ëpn db8°Éû {»oµúõÈEcÏÅ +-sÇøút+ ÆjWC7éê7g"!3\7:žq$öÌÑ ¸¯­n»ëUS¢Ÿ;lú³ÄÇïSg¸ççç,â¿g½¸âY-‚¡ùs:† lßpú©Y×A•ìNp¬ØêpH‚çÞààÀ¯H|*‰+Hî±Â·ÈjRÉH›+•ýŠwTtÁw;(£°ÚŠbÿ¢R½EXzt¬HJ¢¶u’(1# ¢Ý‚c.>È°š)»‡ÃÓ‘˜|³Žxál‡þi,üX7êÐ ¾ÛH•¬Ã„Ë6XÜŠÃC¬Œë»†KUb¡[ ¥Ø^wÜ‚ãy +‘+û¦í sþùð^ô¹håg„k{hY¯ûˆ‚Œõ®Ã;Ú‰T +Ta줓㎔`O¸/~ôM¡v‡¢·vçÊ(ÊÇ.¯ê]UðW‡ÝðCJ_TQ­ÕßM”aƽ“Øàâù¹K^ëFrWÙ>{ÔܲR,¤ò펙Ú:€\ì’î˜6´åTvÈöXº¯-gŸ®®9àì#7ÂûÒV‚§J<Bmp<ù‰Ï¿+ùõ©"†ÊIgÇ3…‰¢ RÎtid¢±½FÛÀX=5øÀÓŠ©endstream endobj -5615 0 obj << +5683 0 obj << /Type /Page -/Contents 5616 0 R -/Resources 5614 0 R +/Contents 5684 0 R +/Resources 5682 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5548 0 R -/Annots [ 5620 0 R ] ->> endobj -5620 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 426.515 371.033 439.417] -/Subtype/Link/A<> ->> endobj -5617 0 obj << -/D [5615 0 R /XYZ 85.039 781.388 null] +/Parent 5635 0 R >> endobj -1782 0 obj << -/D [5615 0 R /XYZ 85.039 761.463 null] +5680 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 299 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5691 0 R] +/Length 22110 +/Filter /FlateDecode +>> +stream +xÚì]‰bã( åò>1¶ñÿÿ—+á$M;m·¹ÚtÆt&q|ëñ$!Dgör¿¢…¿¡Äú‰wÿË w{¹_Q7a©g~6þ×cÁÀ ÜË}Šs$¾ ÏûlæÀ‚*c¶—ÛK,ÉíX°Ïù.âZýXˆý^îRùIM l—â{É a7bÁ>é³ÅjÇÂ^¾^š{èHOúll煽켰óÂ^v^Øya/;/ì¼°—v^ØËÎ ;/ìXØyaç… ;/ì¼°cá_á…æ^ò»óÂ^ž†mŒž£W»›îí^Ñrþ‹Î„ëeç… /TŽhî”<ß]·ov*_ϸ³Ö¹hç… /Tnò~v,Ê,š&×ËB›/³$¡h?“|êŒ÷™Ùˆ!*ŠmÍ¢ +V5iÖà™Âgã´Ýxš¦Ûyáúæ0És8E™çôPoù0$/åðÞèÙ¶G¿”ïžHæýeW®s(ÉÛÛOrö‘âÜDù_èCyar•Ú¥(ÖêT:ž×)®\µ5Þ®8«OîLuÀFî @ò|ÒºÅ.Ã7¤ìî˜ç}8ï¼ð5àkyt‡IÃP¹Ó;XöÑÞÛÚ.¼¸wTâóù•’…ñVä ÿÔ +šÅ†‡Ê=Ê  +³ã"?¡(¹Û}üÉÝÌ=XG5T®ÃKP2&d«4CY8Ìz®êPï3¬6iÈX³óÂMX˜Q/R;=µêE 54>+ˆ¬¸¤ˆ»÷UØür,n曀œ­íþ ¡Ôö]´âqUù`^ ZwP#·Ù ',Œð€vÛr~¼`‚SVIÞáJ 4ªÅa§€ZÑ¥ƒS‡ÒW]šWýíUù`{áD¦É&ÂçXˆßÃBŠ˜IÂ*éH5hdYš»dƒ™žª"ߤAî~¤Û°`\’8}x"£ç&ñZM®eÈ /:’® 7GÓáHßRXv$Ùp4Áù4иƟ#ñB ‘ zâ¦u$PžagØæTt¦#A# ÛtsЪq8ïðô~¤¢ø‰¶ᙓ³Š+b0ÛqÚ- ™ý9ر"КŠMÓäaaç…/bAn]vx‘Ìb:‡e$‘ XÉ7«-¼ ©ÜfÛt°ÿ¨°[ k]H¯R; ¯ŒCï°¥Ù ûvV0Kºd}…Á ²±:R@¤1Ù|p6NÔ¦½=³½ ¦/¨­ÍJÆ›œ®Ï»Rl6K‰Â{&á• [€ +ƒm7­v^¸‘"eŒYN/rMGuh»6ᜡÅæd<¬;b3¨´[³5 @lgŠËñá¶+Ž«”fãx·Ë¹íLˆžâC£œ¼²Ô ´Ë7!Ûé(ÿŠŒÞ8bD˜Ù{`᡼ÊÿÛÅFn)|ö úêeŠ>9ÊvÓÓí(Üýxž£tËä /2Öì¼pÐaÑåÛ‹,µv°ö/:š +Ða’×XÉ9aÁž°Ðã¡ìp[`שÛƒŒ,`”¿ˆm$/^ÜUô 4Êø†…ƒv-÷ í žO?=/üpÙyá«X¨AÝφÔZ³î,£,P´6êH‚¨Dd‡ª¯Qåç.¨H^tVijk_Ù /ò'XPJ6¯xá ©ÓrQOÏ ?\v^øª¬ (çû5°E =o/Á„]Ý‘*æ£í Wî6 êìQ¯ª5›­îÏ`65Ú­}ñ3êó‹Ðãùfò`2ð©òí[nv¸_xpÆÃýî¼°óÂb0¦‘‰bŒéx0ÅòÎèñÌ‘ä³%rjšþ29ÇB—}\é.?:XÓÙ´Gî@ÛÙEfM÷â)IÆïOs²©‡1(¿õ˜áòæ+MµÅU!¶ܶ¬ŸÆè í…)•Eïûz£"Yªÿí*i†ÁçÅÞ⨨w^øKÎ[ä†;D°Ý•¨K#×vîý0SP-õÿw¡7„ñ^òñêØyá_(`‘€=nïÐ}W^°JPW.i„G¿ƒ·$‚_.Wn°›{Ø3ô ÁNb{1{ñ55œ{šJ~¦ È°R%χUÿQŒKMÜ,$q¼9šþ¡ÒgE±Ü#4ãž¼ÀTçÅE¶Y¸VUÄ 14%‘·¤nL×[:´(›ræ„MÄ5W ®V)ƒÝþD‘Q *y£µâ¹ïµ2ö½5ð™Ñ’ùÈÂó–¼6,øÖàtmì3X?ì¼°—å…Å{ÄGƤ0IîÚÞuÒ¹i7{nREŠÎ½8&"çÌ´†®¡H±Ðºt[B:Ž¼€=öpÖÚéXŒyÁÂä5œÉ€°GpvX¡íæƒ+à+B mÎìÊöòS¼Pœdv€¥¦S¦,Jó´¥3©L4Ø;+†ø +BBŸJ¶„j¼ÀŽ™€…FY_¾ƒ…ì€6*37šÍy¶3uã踶6Ýya/?É Ã)X±€b\€lâÎT$µ£%rššÃˆ¢µqtrÃŽÈ#/ÌÔ-> ‘&¯±€Á“=2ÊaHÂÉÆ#hT f-…Üya/?É õi,GÚ’†ƒ0ÆÄMsg±¨‘RZ0ÐCêS ‹½08Æ©÷„€âXÐ ëÜq9Ûl‚ +°8ðÜ•ÏŒP¹S” QŽ¬¼ñxç…½ü$/4Ü• ì¶,[›öépÜya/?Æ ë›ï ÊÎ {ù9^ð)è=ÂêÌ7vÎ_t H˜ÒhJ´ÑZ›ùƒÆ|Ô1&žL|«A'Êt\ë‘Y-½Ÿu²þópÄI';/ìå9x!r3ÚF¨ÍÕiäêõÌÙÓ(¢›Þ+C|ñÏÙ:F÷Öµ8èã0bðótó+Czç…½ü /4Ê`’‚½blè}D×*mp|  y/„@é -DlyŸgxúˆ…0(°€½i€Öá8 +°0„=óbÀ$|Y…< †Q§¬–×áâ;/ìå'í­¼%ëg—`8Ç :òHiȇtˆÚŽÅy† H_aA9"Æ ~Q§^ëÉa¾Þ‡ã|‡¹Ñ×Æ9’ûˆ`ßݲóÂ^žƒ@Ô#¥s7j'WáØÕXbq…"ý D†$LÎ&…›SÈû‚Òº¬8`{’Ì.+ЕúÖ~ÌVëÊÉUõ4 bDo4|‘öò4¼9íF¦8È=bsŒ^ˆ@îOXˆ !(´8´HmISQèå Œ{ÀB¾¥Á‘ ÄÀIZÍ]’À½wŽ.·Dõ¯£øv^ø¼ô¬‰¡¼TOü¾?ƒõ!´Kľ‰o/óéѧÜA‚5ŸìÔ|v¼8=KÓ_ٸߛ0ÝÅ4„Ù†eƒXXॅ4#ˆ¡5Þ½ô±ãLÂ(,Ó,àÀ¸ +X€Ö½Pjõ£6ÆlKg–Â%‚f ,Qãƪ˜$bÁî¼ðµ’)¥oƒÄ?shˆá¡–Ê)Lˆ«yCÕ;.è«ÃŒ#U|v7/˨>î~mÕ‡3Ô`¹Ž¬G‘Öú:ÔÞ½A;ÒŠD€3^X 6Ü[{!sz™]Û±9žUJÕpˆ l¼0„Æ-#!fžZ¬R×Rà… ´"ãè覄t°_£~Äœî¼ð¿o]aŠSÅ¡á:xcìKUÙC, ØsÄ(Ç%¾•Ø?*3ýrfíˆOo,Ž)“*’¸“ý؇؅a-§|ÕI1îž©U3¶°EMÞ`@âSÄt«ºý—¦Dt þÌBCšœø#WI˘õJSEjX±5“ÒÊé80*[á šëHê{Ž+sö’äjç… +´"€+šÈ¹ºŽX”³$ñ,’2a³k8¤ð”h„‹(ÊŒBð<¥°ÐãûjOÁ12’9œ ~÷QìÜ£Æe‘à!,ïa¹¡[ì= W= $í'7ÂåÒ¯ë#PÊêù$EI¡I¼ÐD¾ ‰Ò_m’âÆ6d0î)\."…ºîµß6Ý3E +o#õÙaT¿ óðÈs«#@ó1™d¨ÐPEìð[¶ýÅ!õ$ó ÖE“ôá4dN£ ê)šyÜyáÿ¢>¤OÊ•˜x.!Öôú5<Ÿ®MqD`¡¡P™ÂnY‡5sNE Ç·Æ_Æ‘ ¼ÓÓã„Â2‹ÊpÄ!,Û°,0­ªÙÔÙ¦ Ë#¨Å%æ!U*ÎåÔâ¥PÃÖ[¼>bâ­Yá%:ív;жv rD–2 ‘èó?È ?]Ê—®ç>T‘€wAò³É‚F‹òŒŒpXãªT¹~PnÆJdî¤w,pЉl®A&µ3 «ÚÚÀ9^° ìœ3`€6‹éÒ; ìŽÄi3:§†),ã÷†…—1Ἣ.iݲÂaÚÔÁ™Ü†á*d›ý°Ðpg'‚?‡±ñKOLR`Ú #I¢ó~OÁ ?î$»éÿJ½eÅD €‹™J AÏ]°C¥z‹ÎÇâØBÌ>\œ W !é 8MFä¿ò=ˆwtXF·H0¼–»€…ćÄXÖ- ¬Ô®Hð”ú˜Pº4Á´’½ã!ßd QLF¼éH«­:ÇkLL¢õ¯ñÂîGú‚CuËŠ­ó(‰q xTÁ· CZÐ1)¯íëÔõ,€Òª A,Ä ã™Ð…§É /0ŸùÏÂøÄè°,8Ù.xÈ”rW kH^ùpq¼”9¦€Œ„DµŽlS1õF*vÄBì¾Ù¥“e}/4L|î$†ŸîsTvÂá47bÆfE™¼NIë.¿óÂGºóï-ôÆ ¯±2jbßcÞÞ/ ”'Ã:EOX8ôR,à0ô0i‡=¦ ÿÓ/lXÀæ^ºE+¼ °P#/ h¥ ÷ù€€Â£î¼@1Ç1hB1¦ŒŒ4(Z3œ|>ù‘@¿ +U¹ééxAº·“9W*yý“Ò÷ÇTÛø#‘*0¸,Ž6Ô¯anÃó|«íG`ÞyáÃÞù í+^ètðmJŽy±1.’oXX/x° }ÜmlH}ÂHCíÆ ¼þÄ’°€ËpéÐeŽièÁüžµ{ÁBŠ.Q¤£Ô‘†·}ªv|F`D´³yf঻/ ~ño»\Ÿƒââ­»x|máÃOY¼ç ä·üßî‹B;ÝX7ö,W92~¶óÂeõýEœÏ#Ξ$Є-´VÕ1·HÎœ¹F¿xC•iš#Àb¯áš¹Òèo%5ß2³M +¾  cÀ öÈTá;hÆzÀöµµ°Üphڭ惎䰲[ØHpÃ]çµ"r;“\ꀅ¶Iô:áÝb`ÜI³!ð ÛÊ5Ì‚,Ãã­OÇ ¬©± ò%ÖXŠ¢]ÛÉÇvÀ©"[P 묷b06Á¡ z˜³:q +C=mX@M+n%ÂÜ…Uu.ã‡I;/|¹,Ðò +v8N_7( aMðaçCÁÜ4Pôo·v&MŠAsE—9¯²Isæl*l ¢ §`‡=b†‰qY¸H,·»Q;Å/vƒkáÆ  ú!½.£(ÑìèƒGÃéå¹¢ »Ùàaaóâ×Ä>/Ô@›{슦Ð^À[+ÅÜ`Ž)€þ´‡}Dä°+Ín W~F$$[i +çÌ› €çRì¼ðaáænó$ÇúRfJ®FßçKn¶ù¯¦+Ð?”jœòU;£l†QÐ@U¢2¦/é¿JL–±½ÅFd#ug8-ý+ŸYõAŸûÎ ¡÷º¦¾üê–®¿{UDÄ ,Û]wüƒy¡E2Ø2Lom÷¸aSé‹àujœ@ï8µóÆ MÎŽöB¼ÐµULÝø({q|cÉ>èZÙyá“÷.~ô®zùkÛö‡óm²s1F.]xAK"/Ä€ ¸Ø#/LÛÙ€âÀ¥f,E{as¬8¥s—¢)™—e³ó‚ßË]úp{!„œb‚ùV¹šy8 à[ìéìp¾y´Â"ÂàºÓäó`B6°3àu¯Þ^yç”%NƒÝà䩘q»û üdç…½<Éd~¶ÂO†ùÁ“ûLSŸr>ÙÊ‹–èJ÷½)|§…/L~¤/x1r¢Ñë–kB0Äh<¥7'|–p>*Íè[#½ÞýH{yv^xs©þKoåtÐËNÝs'•R¼Ù¯y£lÆ Ùya/Oà —ú0á6¿Ø¿0ªÒï¼°—ßÄ ÿ_äR½\X†ÆBí¼°—ßÊ ÷.;/ìå×òÂËÎ {Ùya煽켰óÂ^v^Øya/;/ì¼°—v^ر°óÂÎ ;v^ØyaÇÂÎ ;/ìXØyaç… ;/ì¼°caç…Ÿç9UO_² ;/|/DN)EžûŸÚ±°óÂ7ðBäR?uaÓŽ…¾‡òg}ÙŽ…¾ƒ’ëÒrîXØyaç… ;/üå¼ ØÊ8ž¿Ù±°óÂóó‚Ì’G•;‰(IòeÇÂÎ ÏÏ ýð¸–(L‹– Þv,ì¼ðü¼°> 숅zر°óÂóóÂñ1FïÉ ÍãzEÎò¶‰Y?ªØäGäåQ¼Ð[ý­¥ø½¼Ð ‡{aqò¨Žnò2³sŠ?¨œåŠ¦éÃJô]¼9¿±`ûßÊ ·”÷±àxUUEˆWºïg{ÖãÂ\÷ ZéÏ®2º‡ý]¼ð;yË//< í£î÷LJ…›…õ ­J—‡üåœ/ü<þ]^è¾AJ¿‡Z"Sbmv^øxá;¤ô›xôåúˆÂþÄÂãxaùq,ü^h(ÏýïÀÂðB_? +%Ó|照ㅻûTw^¸+/ôy¡¹ú ÉÎ _Æ|”ÃïÀÂßÄ _µÆÍád«‰ñ~ç¾Ä _ó#ÅMXâØÏŸ[HåŸó…þ%ö‚l>ä…ºz\lö÷Äy’ä;/<%/ˆŠ[m}Õò±XÒ¶ñ½•²ã&óñÜñüïäZø dòQ%4-xz±ó¼PÖð·Ö¡”ÇU°ZN#e½&KbŠZE¾0±Œš¥qs^þöB5?ý À‚ˆ›@èMõTE7‡]ßnøsPż׀£cþ‰·'þ‚ª_È =…¿•Ò„Ò^0””ž¶Êú^~¤†Op Ú5x]x=zQWe™î¼JþZ{!êú…”D +^gÆ•Rü}dK¾æocÒ‘¤*:í+ Y"ê䣤üâSÌóe¼ 5ðŠbBÆÀ ñ¬åaÇ:ËäxApÐ]+ÀB°0ðU‹\u]×æ1¹ ¿Ì$¢¿‘•» +^F—Ô‰}Jx¦¶§LÞ>l¤èyAºÖÛKùrüúŧÐú2^©ËÈHݼ¤ÃìÉê˜-C:'«KÉ[í>,"E0V^o/4f¤ž° 8Åj‰.ÃÂoó#ýI /ä¤'‘7[»ËÉPŸÎ¼È(É»,`aêàA)6ÃŒÍúZÌSü.Þç…† £ÝúT“Ë<4p|RtxŠ~œ3áã”U]ðL3"ªçÐüdsdõe¼P'jáSâ*!YO +9ä]-2_rÛör &­efG*ë<* +Z^ïGJUU9*aѹÁ7– •ZØ×u¤ß׿G!/ÈA¤‚!~­bíHgÔà[e:¢á­]æGî™!™›TéYiŸ|™|.“° (ð2ˆÑ”NÌUÜ„§½âÚ¸ÔSÎg5û…« +k2e/ã…²Ÿh–D®C…ªªWĵ³-\A™²P¤`³²œD°J©HÞпÚ.K}7”|ÐQ¢oIÛÁ‹¢ü‹ûþ †¿€[í}$´,и' ãÆúNõ v™P¨p_pÐøkTl‡Ê¾ø:/l¥p=o(œŒùI5‰› ©mƒ‚‘;Ù»1\Ör &By kà&è[,ü¿‰•ŒEÎNÕÈ]ÊRϬiZ—‹Ü- N v’Z‹ŽDt-Q<Ò¨1öÐ,/öäˆ`ÑwòŸ—û xa«RMبoÐFš>ë`AU½A{aT¾0Á]âY5QX_À ± dÒ~%sÕV¡íœ«"o %6Z¸«w!/¨0t ^—°à‚Ž$•RîòÕEá= *Ë5a3r­Ö^Íùèìu¼P°Í«ä€,of^"bÎÓ•è%s¶±ó^(Ë ã‘¾Ù^Ðs-£Kcg$ˈ5RP•5ÀßßÊ o;Ÿÿ^ðõÌ × ‹(ë¢å¦ËЪqÓÀ¾™õ”\ ŸzhóU×ñÂ`°ðÑ·À+‰½† Ÿr®3;0 Ð¨à˜ +~S¼‹pG‘á¶(®à…:1CðÕTç5+º¸šqya×r1œw++ª×¼ å“ó‚vDAËåk‡]¤€à…·ßl/¼%†¿†‹o–PÕÿl·5=ñ^Í]„'=;]³]äy!>CÜgqªåù4ø¡Í‡ÿríWY†èŒòÕÁ’å]*ŸÛ^(¤Ä¨™s ž_øæX¸|üÂë>†¿‡Þ¯3sñåž+Nõ$èo°Ê:|–çHHZåö ~¤&ªjŠ®¶ XÓÙý°pÅø…|ý[yáÏ’N7Ié/¿°!Á¹AÖˆ)þäÏoä…æ„Œÿ:ÕOt/°à^caæõ7óÂëÁø9/Ü(¥?Ì çñÚðë=Àl‘ÝæÈX¥KÖ—užrl¹#lðrüX`!O°YðƒÂÇbÀ´ÄûòÙá#¤÷e +* P¯É@þû¥ÁP¬‘Å'ïØEöÂJôh?Rì ‹Aq ®×–ˆ†n”Ò?x!Þî£aï¾4Á$†tc H,^VŠw²í‰BÀöÊN¿Ê"»ËÚC†°¡é^¬Ó€O´kƒÝêˆÐè]ÀNñ˜g¸äYcì-#ðè1;K°£$ŠiÔ«&%±ß¹nàðt-ú‘OX¸¤M=ÖM¨EÁ¶JÅåºl¾™|Ÿÿ­¼[cŒþS/Zõz^hŒ + +r¡^g/µÙ…$”ÆÛÎÛˆR½îù^({ƒÎ,„žÞà GÅó„èí>ÐÃC@7xr3Cc!R6ˆ«xa%-5ËT’‚êUé.U‘ŒGRJk•5#hPÓÐ/QýÚàN+ž´áã"¾Í^ËQ¢htë30§‚®tóÊfÆb ç6¼aѵ©6ÓA]vfƒ[¦y·5‘f]?„Âõ+塽d©Ê#×ÃÛ›JE™j׈ ‘ÊdDÒ«y¡Õ­ox +Xàz31AGjmˆFòV™- {F8àûJT~µ x± S·,®ê{332³•t½*Ðd¡…KÁ².ß}>­xþ¼yiûÚªã­N„¥ßÀ ž¯"rq3/¨Z$j{£¨9½ØôG¡Èïv涅áÁ™SÜmN³Ö}½uºœ2ÕØ™IÉgÏ;ÐbUkæà9“l¶×Ú ¤ˆHˆ{Õi ÈÎ<É0å X)‘×£•ê 3¸CquÿÂTÂðiFOrg»Îº´"¥,u>Õñ•HWjÈm¾"‘·û‘šüd1D7òB­!î ÛÚÙMq¬X .õ£7׎ YcÔºùá0rNE¥/ ›pyõ¶ ³Lćñ»eGB5i…ëÛ«y¡kHÞµž«Û²ðÂ`ôÜ!Þ¥€…ØØaŒnå…¸R°P×f‘ZfÎBi“‚ÞG÷ö‡Nw7ô—«x²h‰}9,!R%r<’Š‹U…­¨×>Çö› +•ÎqˆM«xð‹^Å |£AÃT4k°ëÄ+j0b;óã¡«a¬|[à–±}5/ô3Ž­¶ƒ\Óºî +V÷f”´gŽ3»–WçGJÆ¢ÉÉÛ1!CäÅ ÓhŸHhц˜¶…gl²vø?,|Ö¦â’ÁeéÒ©¸ëR©<Œ)84S Æk‡z0P-˜|#Å]ÛÏæn½G¿³8Y ué†þ…wxáп-áÙçú0âÚS(Ûà³á¢iQ/ÀBƒ©*»Òe#YyìAeKÌrI®î_xS™â¤]‡víÏâ/!îÓ|ª%öªE¦âžµ¤TÊÿ èûÌ);+î_inà}jLœFø¬U½pàTØè&ÝLß‘N«å^èPp臎{M¸VùÍ¥Ÿ@vmµRÏVä…¤:ìúX^8s%mÄpu¿óX¼ðè0ΡÂD5ÆÐðl•'Ûy»DÒÙj;†Žéc°pòDqª%–óˆíc€vBöÊÿÃ'¼€Jš©‚HÍƤF%‘eá nŸ«"äRQ/É öŽˆÍp Œ„&èæ^èÆ OÍ|¸Ë3^»6å…?ˆaS½žî…¸È³Ý R#1ðŽªÕ…åÔ ünxšs†ÛkEYeµjsôÁÙìÄS],µDûxvèpˆ)áA¯=¨–òÂì….N{°½ðGçúļð™œåˆOüH|9üŸ‹ÞÊ e}/€vRKË…¶wŠ#N{”C¼àG¾ÆÖ0h²{2ÇdbÑ-öÂ¥çA/¯,)–Ó02VëX04ì¶ÀØ<î_ZÑ‘B€¿ƒ˜~ íß˜Æ 7ï{ªÛ*koà…jÚÀƒþ±pÑH§> ëtO­x /°LÓò ¼ð¡½ÀZ°`u³‚!kk^~ª*Ï 1nÌ’w°}õ1ÖZŸ@ ®o°>)Ѭ®ˆW»Óø…æÔ£‡3ÕÝ Óÿ  Œ«L| ¤;Ì +>¾iMú¾C‚Û™\Ï /='Øe2Ro¶ýZWa +¬*ÊÆŽ7òB,äÍsT†n›õŒ¿ãÖõ².OfôyóhZåMgít³ V`"ŒOØÜïk"<ÉÆâCgô½ó©¦äšéšî5®íÌ•ÔÜ ô£X›S©Š¿ ¨,M‰Õˆ³…YÂY¹@ŸnSâ—i s=/`BÖÓ ­ð%HMkèßÒñi Üx¡¯iÒË>¡r­kQYo#ØpB6* +pÞž$YåožßùªÙï5®M$Ç¢þ^˜ßíSm^‰(ñ߆…nÖJ~ÄA)!dlül áŽt¢#DYækM”†gæ„Xé‹!-®æ…0C9†’FhÊ bá8‚‘·ðB¹Z͕ɸ"£pãÊÖ…)KVh À‚!ª•2‡æ‘üUyóîPî7Þ¹>Y 7mzÊ-#º¤dö[òø+y!C׊!ólçNx3â`b;›°`»¹K7wù ¼P®\ WYbx\‘œf.…g`½ +ƒF7ÓÉe @HÍGqIߘ7ï mêò?JËòý¼àe~"y=/  ÷ƒ³¡eÂmë w¾rPŸB…×[ìöâ'üÖÍc± 1^hñªð‰YŒãÞ5B6CÕ7ŽÔРüõyªhWNÞäGÚrg+mà°P¤ÄׄrÄf¥G½l"ÍM¼@f!´‰EAê(‘}ª&Æuƒaz ”ÅFG®ªûÜ òùy!æÿ#iZ#/œÒ1$G9ˆ“äj^Àù[z§¢0 ÇÂÿ!õ¥RMäZPTªMD]ê§á$ REÅB·%r,´t$ÂÓ"'/FN •­·ûSØJèMý ñç:Òˆ½¥¦ X¨OÔßÆ c̬fñÈ×ÞâLMA˜58fa\žèx +Ï‚óDZç·Z{Ò¡›wÒ@­â«&Äíã¨Oò¥êZ^° ç%8GZ‹jeË‚¨Øl¦D ÐyR½rZ×> ó6/b×e/±À\Â6PA²Ÿ•f™¢e âv^8ÙÎp!=Û¿ÂÂDÄM¼À[Æ´– xÁò!¢ªŠAù#AîÁ^èe¬uî2šDSR?ýü ØLõmfMYÝI/[ ·ï'4ªÆÃÈÜY[|C³ÖEü`^xI+œÓB4ÓÕ:ö£÷Þ÷ XèÜÔÕJÅÐîjÓ‡$ú‘˜R«rm;ùC±€™¯QÚÁH¥¡éIºþ%ð‚1^€ ncf hÜ H‰¸‰‚ÄM”À_!Ü Êýì„…í…°ÒÎ +ïÄÚ¹Š±ÎñàX©ƒ›$çTv*ªŸ~þ…La¨6Y2G¦Þ:š4¸ºßÚãÙ½U½à†æ¤{´½pJ+,—æ¤õ_«#áøÆò F:FN O•;Ä­‚½Ð­•›‡«Œ–= @ØÏÏHî[e}E81e[ÃÀ^XvûÁ„Y>íáÿ/DaâJ…’J‡äo•*~¤ö6?êH¬à ª€kR0¹¸-I„sÕI™£ò”ý?ÒŒ£¿A­sS˜Ñ½'%$Ô^»(æ¾mÔ˜:‹È÷P?Ò1Ô7ûÂ"h‹{”}é;ƒÀh®€‹æ$ºµsþ%!ÛšÓÃömù°0×a¹õóŸ%Á’ØíÏB×>Ö@¼|ÒÃÿ5^½X†"Â…âÐMåOIò"UßÖ¿€½ =¨s=]ë$ËeOë8?ÌRXRÚ¹¬{°©*¯×ö­ö‚>¤JÃý@§Œ+ FCÃë0´jËëgÇ`ΩèÑ~¤SZá1\ïGjÀ8ecÕøt¬ý2F  Ú<Âñ½óÑ2ˆÇŒv3JeÒÚéJ7Ò“Æ©.ü =zƒ_èwaÙõö¿–Øá– æ8ÛyY×Û< ¥”õ•ãÚ¾•°ÕG,àLÈ †} +¯5'Ë!#`ÁÌ£Jè4~tÿÂËÔ…GWÒ }$ãûóŠ÷)¹ÖcôXøb®ìüÆÕ’Ÿ©Râ±¼àå‘LA)/,$N a1Yö ~ÃKs®ëÓÕ*DƒŽUL¯=:û@嵎+çŠwN‹…й‰ b3ζ«› ‘‹þâÔŸæ…É)Œ=Í·BÆFS§—•®=/âZ¦-qª–ÔR¦IK€%€3H%dâÒE½é~ŽþŽÉμµ#£Nà¤.Ú¼Q2æ—\0ÙüX^‰{^Î |¶rZ8OŽÀ÷('KWífê§kA=U*n$C¾aA-©rthÄÅBŽÉ-1ú¥é ž“Rä\jÍÓóÂ4d)e=ã5ny=€0µýJ +F{ÉÖȪDkV®Âw¼¬ T#°'²E½ŽW}{0-â(Dñ7¯üJØÇPWxu([O–Ù<˜Ή!¾‚°èºáع¬]>8eÆõ0­£§S˜(2äU]kà…“G"FŒÍ˜wùäãbaA,L‡‘–<òf8Ú _ÀÂÛ =“².kÒŠ:¶|-ë|tå®5°E$.ÒœÕrÈ[†5òBÃ÷ð/îÓ #jUFc¶mÕ6åßœæ´b¸œlQuJq<Ïä3Ð{Ô€‘ª`AD8»Š‹ŽSp„ï ;ŠÇc!A–Üö8i±J‚í,R¼‘ #ýïè©Ÿç…ÐKPÊV-õàªHeŒª‚‘~Íy’[Ufn¨sU^P†ö–ÐÔ¥ýú‘¸nDœ«8ˈÒÆ3Q¼°ï§ lbŽw™Eu¦-˜M†§Ícyáe†&WÙ x¨Ò[Ë”ô­Ó•ã´© NRÒYØ»:bA aÜ;ÐiΈ…üš¨Ó»„Sœ+57Û á~j^Ó¡— ^­â¤“õŒ™Á)ëœ'¢ÀšH%kCñÖÈ( á„,ŒU°ç³ŒãpÛ†Õ(j‘[ 0èXïS¼7:æB„¼®Q%Q¸@½ pH:ý`{!@àøFúKya<Ê`®œ&ð£r¤@\Œ`ÓIîÀXv8ØqX3î¡Kõe×¼Ô§ºez™Õ-Îe_´]W×ö”fí~f^({Úƒ.¢,Âþ…dX°/-ŠJÙ/Y¾²Öe9Ø4Ä(Q2EC/׺Ýñü$~$ÎÇs?wí©­z€æåpíºÙFóHÔ³;²M]Êì…X¸†Έ!Ê/ä…ÁÛÕ\ÌzÒTœðQ€jÍn—;¨kK|g˜´?Ò8¹µÕ–‰ó¤Ré#±°’OÿÂSðBÝC–¥Qˆ@Í«Lá2IÏ-á²Oa!K×Ó®¥Œª"Kd0³a‰N’ô-Ø7ôºýÖx¤Qýßwäç7w>«ßš§ø`4”a¦ç&¿ ?Á 2Rèu¶”Ô ÞÀQ¹óT/u‚{p¢×㮵•Ñ˜£.AÑ°„dŒUÎ2ìt˜Ø“k»Èqÿ¿p½'/xÝï(z½• sôbÇÛØ€y¬ÅoÅÂOð‚ŒÜ°ö}áfT.ãHi1¹óÁÍu⦚ö´¯»¦‰+ëµêÙìSërËÙ O5Þù¢kôÍ5X¸’N®¤{<uÊZâKÜur@ŒüZ,ü/äja ë«*wY\–ljå[,¨ACál×A0}¢ +Q®²WVDóZžxaϳ}+é.¼àp +:m“³åÎÀiùÎ —ð +¸d“K+ºÁ~ƒ…HQžçÉi× (DO  …=ÅLXE"Wˆ/üp/£7ÁiÄU„‰^çt®132üõ?Ê WÒ}xAÍÖ8·f§jÚyáb^ÐÝÜf}\¨Ðñ°ðFG:ñ¶k½‚µ°T\­`eË0q‘@‰sJžÂ^dŒòeË\›¬‹šAixÕϺº.Ç"î…«yÁÇáîÁ }ˆã&)˜ /XØyáB{!Gw\)—â\#™¡Jxy˜¥ y!Ø 5êH¨|X準"B#:‹±k›¸ =[\KžÂ“<4('¡M©¸ÏÕ,BzÄBÛ³,s…XM:@£¾+ØãyÁÓún¼@òÓj¤AYs¶óÂå~¤TnÙŽïcQ‚:&l}k;¶]ÁLâ8^\. ‰bÁ +@ `¡f­sßÍ ïÚ Ûô#ÒtˤØÄÀ ô5*!p $SdƉ¾:ÒqИ*¥54®™âZñúá¼€3TÝÓ^À'SP28Ò±ÐÄñ¯ÃÂÙ ›€¯˜9ÛÎœçMå¸6ºc…F x„Y€’#lÊ{4±¥Làs6¤`2ôe]÷ö±EÑrRg'üÁ $dƒ‚š.pl Nà[Ú« “òÖ»ôñ¼Ð`*£;ñÂá…¡Ù*‡Ó†©šŠZñÛ°ð#¼´GC¹îG­»^Öy7[k 9„ 5mg +æ„w-Yjµ°¯ZfZ· +ëeàÔILŸŽGŠ9Jz·ú3,¼å…Œ …Âi#©Š;§³ÚWŽ¡XõÎ}I²ÇóBHA^Xõ|Êe¯ ÑfÖ5ªad†ü:,üLNõUºà:J>‰è>íú^ŠáŸ¶Ä žõ u"WýX€ãG^V!¿!EoÓ DF ßÁ h1<8Ÿj¯oO4üOðÂ'ÙõµƒžÀt¬ÊH™,Åô¹ëªª˜|:Ë­t…¥É351¥óTeÞð%%6Ìöu,ÜÄ >—î;¿CöùN(oç­úLòåÓÍ¿ ì©%Œ4Ø ìÐ9Y-©Ão5ÊrœŸöÃQ’ ~µ °`óïàÏèߘgûoá…:_^çG­?ݖʧžßYįmÌ×)…¥ŠÃ#ãÓøÇOÊxá–9mÿZ,ü4/”ÇÿÐ8–Ûæ0;IM[º Ü9XÛ¶{Y÷z‘O<_Û›²¼q”Öê"ýä¼àÅcUU–ö|džn¾¶ 17ÂKº†~Ò— ŸD¨ .áÕÆ–Ãö¦–A©>xTYvodü[xÁÄ1ã˱†Rg{èÐ}ìTÈÅͦ-'÷Î _ã…’Ye¤æ$–Ô€ýRÂ2"²TPÍ¥ÎeÏ9éAGé)&à†Cyxÿdó/Ä–RùXke&–G¥9ñ ï1Š,^´„(cLgœpBL-0Λñ\à¡©¯~oñçä…CR´ã¶3g…Œ&âF¯ÃjóˆÁ~ºMÎ6P•Œ,¸!Rz´DQJt4(Û“Ô²s ‚·V¥’€ŽTJ£Ù“Íï<’\f.ʤ’©Äw 8Ϧá8­÷9Yb@;³œ®¤«kk¤$q¦æìB½Ðb)#續¸eTE2,º@@’2ÄÂÎ ðF\/²os)³;Ør¶X%m"'»Ä¹Õ-ì^Ãïz•´Õv‘k‘ÊÇ»ÉçŠGj0ù´·:>TiÃ[Á­<ó¸%#  +É(S&š\º,•[#E=¯<·ù²¸.~¿î)yAmý Iä8wjúÃi{À`ÀéÜæت^P;/|Ö:–kÍä€]Æu "1$[2ÙË- vØ>%îþF–OÄñ!GÎÈac¡sžJ‚´#äŒ#×&ĤB¤RâIFA^ÆüëJªä·ø‘ÂÔçP°D,ä>ß å:lj·B/Ãå9?þe^x7ÚèýSÌöŸ1?n/l¼ µ8úD¤µ1±¶ ¸U"<Ùxß1Ë…oÍa‡Æç}­¢ß §’;ý ©ù‡ãT/)uòGlÞÏÇ#u„ŠÅ Í 1}g3ˆ…‰€L‹fr€B{ÕÆq7'ŽêœI/R·È °ðüðrž0Ú_…ß6ÿ‡1Û?ïGª5á¤!=n,Ô +øÆL8“g*¤y º¶ªœj {e5ÞaoW­¯É×u¤gá…0sõÎ ?Ç ïÏ¿ðãñHÉ‚ó:3qÒ©·ÿaJQäø®©ð"¶Î…øphyöįㅫà³óÂyá ǵ=®<)/$ã4‰¯­Æ6{F,ì¼p7{á{±ðó¼0½©j¾‰×̪Þy᡼°çÙ~/j0n„DS€‰¸Á9G2×máÙ>®Îëé2ÔqY„ñz1®ÅŸ¨¾r¯&_µ®ç…g˜¯íoã…œ;gϸæ!™&½ïHæ2 ÎpL¦êG✮sç\ëîTç#Œž¡¤ÃÃ1 %#Vñø¼‘úJö¤v^x"^H”gGJ¡·Ø…6"4šÚõƒsUëH“83X×RíôÒ+UÍ® +Á“àvi}`)Îï¶ûJëÎ »½ðD¼0bJ' Š§ói{@¡tÜg[Tv)è*;¨§ `Òºî ·µž(1a°*W‹7r…‹ž »iç…Ï.yÌFWxu¼BZ§I¢ï:¬áÞ\a=ÀþŠEšÞñ`Ñ…Ÿˆ…î­Ý½<v^Øí…OJ‡ˆ¥Ç«cåÎ Þ‰"ЮgÛ ~2,¤°µËó4o`AŒFgó|ÉAGzŠ^}‰;/ìöÂñÂâø’)—4ÇáÍ8¦söÜñæ•ÍfWë0#ZGaÿ5Ça|°hU‰#”ò.`Atš k}®'L°IŸ »i·>ó¨V*L¼“£Âêÿà;r”Á‡àJF\­t“`eJ)…»0Tq"G1MjÄ—Q3E ÏÕîGÚyáwñÆ$ F‡œê1f} ¡ç‡yÆyâ™Ä`í:Ä™„Û:Ä“ÄQ$ÜØ݇{únµî¼°Û OÌ *“Kž »iç…o/Â|©ÕÝyaï_øëy¡ùÚp·v{á¯ç…/–p^YîñHÿ˜½ðœXxŸ*…¸·¼PÒ¨¾ 5–çÌ›'å·`án¼ 过…ÓÄâk¼`øt B–„øK¼ S¥sv)(–þ)í…”ÌýuõÕü/àLYÿ¨Á˜Õ[^xy«ñÙU´s· a ØårzŒõ/”õya˜™SG¡'{†Ò±W'z‡øX€Æw¾”ðyº Ñ°px’\‚¡œ¹åÑNÏÏèž ÃBäæ©r³xU¨KOËìl£Á̺¯œ˜t$–ûáU^ý°9›| uO:Ï Ñs"ò¶ÀiÉ-îM½»Z}zL@Cq Pžñ½µ7>ÛéŽõ¯ë CS+^Åxú+Zg¿‹ÑñÓòRÕ×b!nZ×¾w³åá<•Ñ^Åðõ~ÀÂ÷„Œ¯NDÈù£…?xáãXÜð§^êä¬Öæ—çùóïð<6º !Ý'åêµ- ¤¸áѺÓå60ðAüKXPœ¼•ç<Ï6ꀄõÚk'pçš4?ƒ ‹Ïÿš< !•ì/RÏ<‹g牛?íÔq[¥½o/ÐÏF¢„癓ËÞ:Ô—ú0.a~Ï^Š¿É^xyÄ‚y>$< eÕu]›Ñt w\ª/WùÄ´lH¸Ä‘TöÓlm—{U?ò©~¿éb$€~„õ5ößéS=ù‘¤zN$Qƒ<ˆ™4ˆtžƒ Íņ…¾™U’«ö¤O…¿‰þ­qm?È a:® »n´íqþ”ÞE©k¨ëY¹Àõ~Ʀ‰LBE‚´¾ââé±°óÂn/\\bœŠw +š^0$Ž˜¸"ƒ-ÇÈÄÖ/•û‚ Þî~¤Ý^ø+y!;ð‚é/PÜ[×'Â'†yAL5‘õù±°û‘v{á +{¡C{¡e™‹¼á}mxS¨D´ªÖ¦ۼՋجdˆ¿™¿”fç…~Ÿi4èGÒgœëáKS/­"(€b¨·Ö·ÆЖ$‰pLÇò °°Û »½pÅÁ¤û@Ðm8+Ý\D}‚uÝPÌ-Æb +Ó–3,ãÍ/ÀÂîGÚyኆñD¾ê¢íEƒ9v^Øû~/øÚʨý*"҉߀…Ý^Øyá*WÒ%Ò}å}î¼°Ç#ý^ø–²óÂÎ Ï Íôv—dxuIšú¨º„ „{¾ÎR¢Ùí…Ý^¸üóÖä­È«KNÆgü‚ +žZ€0}ôËöŸŽ)ŒÍ²û‘¾òwd#Ê¢äèyüMö4¢ðwÈÿPCÛ[ñ& ý R Ú7­mh/ã“i¦y~9ºÁ£­EÌWQögòLÜŒ…óñÓ`F†;ñÂOd>K}šþüð‰½ë?_m¤te}gï‹…o°ôäÛÊ(Mmn ¾!6ñ½UÆjpÈmKTBÝ)>ék!*BHÑ4öptÊI˜GYÉ ®téä°k®i+g›[±Ðä*Ó%öµ…{óý°Àk(ûdaTä¶Bð›ãÏ°p /4ðF›ÑÛ;Ùw{á–T‡ºÞ.z̬>r4bÕXó‹xAΕ%„7Œ´uá’‰‡›<œÓTi_8Ÿ:T€¬YÑEmó6Ona•£žàÑ€7ÊÉEµ1”’çÊÂå3V¨¤ádÌî 7\±(Õú”pnJ_ErXÍÕâ{XC8wã2žL‹Xˆë§â…'ˆGZxã‹Â’YBÃÉM¨øœ¨9* ¬ã&ý=¼€±Öh2 NTx EXÀ»˜'‘(Œ¯`Ú]5Æø’§ ùâU¹'U0*ÂpOc12C44ó,b"|©›y!siƒ)ÀÚ¶)Uå…Aœ.L:Ë„1*ë©üýxá`¢´b¡"ÔÉÎ çe„&¨%·¡u?(¬y6ó>7¨#YS.*ÿE¼ü­vª˜ÝÔ€ʵàÉ€ (H Z1Q¥? Ù,'Ð8z0 AÁšCôjÌa‡‚C%aÊ>ë?k.â… ùJ¾m}å†%íBÞà‚2'Ñ癫ü½x¡á:†AˆkߪTZR>/<½€œ D‚)ÐÁÒš@" X.‹"Þý*^À hS,а0)Iq"ÎT »Ž=æ:Ë/4êòò€…ÌxŽ• ‚³0Ĝƌ˜+½lør'^ÀáBˆ…ÎcwAÂd[ÒPM¸vÓýx!€y©E +Á¤šnå…²¼K&Œçð#™þƒb`»%5ŒwAD,$hnééWñ‚ X)‘Þ54¾-Hg®’^e¾± ±Ð6ÄŠØ,hð',Œp4mHëæÈ … ÇdžßŽXAQC†XØxhÙÄ®¸/> +!âfSýâ WU7ò‚”}/å—Äýó´ôOÑ¿ ¡ +uµñ‚½ ¨£9òBðX~/ –ÚÏL4Ñh6Ph_ ‰@PáK¿`¡ÃÑÿ`¦^•Öšg,4 Žåšòbú$皘µ¹ ò‚…ÑôŒXIáÞÎt$7Ïf7ÞÑ^8øn/••kMåm¼À͉Ž¾LµìsZ>»½Ph׸ÕÚÍ8踂‚Б¬p˯á…&§>Ù®—Ø‹´J…ïá˜~šúj5©†>ñý›ÜUH™Fƒ õÝ,ÕÀ(õ8ás5x4öX‹e`4N=´ l¨ÒØ7‘¼G_¨¥™Æ÷]øHñ&â`É–áe0’‡´ï9á|´V|‚½ëüH›½À5²/7ñ›œ®&¢"¹â%˜7¸ “Oáÿ>¶_¸6®øzü [êòã‘""|ozX¼,ô¼‰[žù5óKêEeí=Ö¿# YD}ÇÜ’_Ç…‹mß¾^šIèR`‡á¸À’çý¸gï^p­t| /ÈÈÍqSee-iÒƒ®DÃwOÃTn}-“°¶_“º%$¥\û¾OÞNø¼ÐØÉß½I ¹Ï¾¨ü~È ¬PTb®í¥^-Q$c o‰âQÏ3&Sž¬~-°V+/¿O´‚­,Å4Tìã‘"ž/NµÎ£»fþ·âTã™]GJ9«”v.J_r5ÙÊxælV µŠ&Î yG"©IB5‘ƒ³Ã›i|ž%)ù.,}~çŸä…kˇ¼[ŽÕ^²žŒBÖj¦®B‘©¨WÅ꺞FjJÔ ÄÈY..M].ê}¼óðBÚ¿ ?Ë ¬%+ü’ù¨Œ­RkzR-kR ¤œÑZØšJ6ò2u/©ûcr·ß6~!.Þ¨Öyú;x!"É/ÁÂzYýü0/ÈÔe¢–±!”±\ ð +ÖHÖÐljY¿¦@ €…–ËÜer¥i¬QÿòüHìmøJdä¯à…ÜE¿ Ã…sx}d¾`ùÿ0¼ær^(k­²$išDuá–Ä^¨eB\ÎÀ>ˆdáòÀ …ŠJÎûºSÉà¢'å…xÁMq¾0ßô"‚/Šwk +2$Ö>MµÙP™9HY/è”h»_Á ùa^¹&íæ‰ù2‹ÚO•w]2H1 ,³¨‘ùD6W¼ýº˜+ö@,àhˆfó— +¬Rìð )\q1 ±€F‘ý×ÞÙ°7ª2aDEbŒ(*ÿÿ_¾3¤{v÷=Ûm³Ö»ezõjjÓø7ÃPìäBußüô­V¤äã\Xjp×rÝ47§Ñô‘šÆ›æÒ€ .„£j‚£KÓ,JIÁS3É…ø ”98æ_g´wÆ1ÖX‡ÉZÃÎÍ’Ö3ÃdAD?GêØÁû°±X^K¿{2.¨Ä…Þ*Rð5óPQm>¦¹ucð×@CäI0›‹+q¹æ0-ŒŒ¸¶÷Žjc”œ +¥H›[EB:µŠT#T~ÆM`o­(m~“Tü7ó΀z¤Åe½^Áih.7z»\(ÅÉœbø~^ËöÖܪ‘¾ü~Âx¤Þ˜¾qÂxðÿ}óþD¯ð`ÓÀ#(I}….à¢.Q×\‰VÉ~Tk· Ž[¬¯=ÁSrû1Æií’cT6Å¢N TŠñ±Ó˜e•R<‹sÑâ-ù(-`ob Q“>RE=[)™JKd˜¤ÌôËæeØœ˜7º“ w'ïV-VÆÖ†7_‘ÖÒuà¿Ë:+{½ú8°›}„ôâþó>­œdðíèË44èæòò®ËõœñH«’8ЂóþÒXö&`x[¥µf檮ñJ˜–Øv`Œ@d&é­qUÀk±2çâ‚øæ/ˆÙ2Å*˜ +…zxE-`T«¬'³Qá¬ÚEF,4Íþ(-´Û|éWßg}yÅhXªZ^¶]O×]ü.bþ\¨ o~½qÁ|™£2à$ñŽ¸Ç ‚‡»¶××2|™õ +oP 7W`6jbgZRŽjÃTQ,[>95—ŠNI #F•Í÷¤ÔŸ‰ A™Áo\`Së†já¢dÒô‘ ûnï·s=#!„©:J Ѫ´¹<œØQ0Etƒ€í†Ý{%p‰•PÍ=Ro6µ©>·Æ0uLK¼.¶.âÂ%ô i+~ÓGú2ù‘ +\Èåj\ Ö™T· 4ŠP(Üv…WvJŽÐZÝ”Ä5c¨…F‰ÏÁúÏ3°[™¸àB¯&L½}ï#ßc…–X pÌ}PåQZàœ×NU¬ñ¼—ƒ2ȸJo²¬O%°Ÿ õ²TÐ;‚ËJÉöK¥eÒ|.ë"_º‰lâ—çB¬IgYS“©#÷õ„Äí¡”zÏ:‹ó‡ Àcµ”JÌtÌcû•´ ^ÓíÙ¸ »WSÄH¶k’ñPqu ¾38IË´¯äÄâ@.†ÍÓf òØÖ>ª¾÷k¡&+4ëc,1÷´&‚[•i‘))*Æá®À…»¿°ÀeIÔB¡: ¯Q =hÁ8=N¤_•ü¯¹p†x$9×Pz´ž¡†´¸¤ã¶Z¬´í\¯±Ä œ®u n)"¯0F0ã÷ä?ÅüÂm²Ð÷ï¢ð^K½^ 7ë +ú “®r0õ2Æ›5VÌ"òÚŽ¸ºÛGç%ˆSe¸@ŠºÃš6*g€ÉËæÊV£t¬RiÝÍ…ñÅ÷F-”¸t¸'^¸Zhðj'Õ_þl)çÙþ§Á`ôSÌ/üÚîÃJÿª¹7Ja˜ 硨ºG:«”ü[Ö ÂØ·u mS/¯¢ÅÂ#o›]\_æV– >G+;§$ üW¢9ñcPªh”_… ‡Ä#Õ¯æeÿqªVy£þåüs†ƒ,ôp-¼œíÆv„½ƒ tzÙq"eΟ7 ÃiEÐ_ëúkßfa‡½.ÚϧºLúaQOÝŸ¤…J‘f‡ržíõŽ°œgûZ(Äž–/çÙ> ÕÂÂÌü°Ã©Çjag-Íy¶Ïâ/| +.´ß;!e÷vdùyv›êÌZÈy¶30Ì‘÷MLêíGëþ/éuË.'ÖBæBöqUGÑ…º/Ãfe”6Ìe¼Žb¨d5ºˆ|líWô+â0AR€7F!:{MyÔ2²¿ð7paQמã7]åE«ÌÀL)a]·9Ë\Á‰bÓ¸Áaëb Á¨6jÅÜ-ZÆÏ«…<Ž”ý…GúHªIÑÙƒ>8œÏUE7SO \TÕòc\ö‘$íY§TíFÏ«…Ì…Ì…G¹P§ìÀB5\ Ŷ)©wÝXû{¹À¿6“ícLíç9ë½m_C Ù>.~¯Nl쯻!D‘üýAßnW³`g¾=ó×sá1£ºendstream +endobj +5691 0 obj << +/Length 105 +/Filter /FlateDecode +>> +stream +xÚÁ¡@P[˜Àª¬ K¢(Š¢(þª‰¢*Jw‚ ‚óßC•RÖZãsNJiïsöÞ;çæœÂ£Öº÷nŒcÜ{)¥RJBˆ¢Öú}cL)e­åœ‡Zk€÷Þð<Ùendstream +endobj +5685 0 obj << +/D [5683 0 R /XYZ 85.039 781.388 null] >> endobj -5618 0 obj << -/D [5615 0 R /XYZ 85.039 741.134 null] +1542 0 obj << +/D [5683 0 R /XYZ 85.039 648.834 null] >> endobj -1786 0 obj << -/D [5615 0 R /XYZ 85.039 597.546 null] +5686 0 obj << +/D [5683 0 R /XYZ 85.039 616.413 null] >> endobj -5619 0 obj << -/D [5615 0 R /XYZ 85.039 576.955 null] +5687 0 obj << +/D [5683 0 R /XYZ 85.039 506.824 null] >> endobj -1790 0 obj << -/D [5615 0 R /XYZ 85.039 412.246 null] +5688 0 obj << +/D [5683 0 R /XYZ 85.039 506.824 null] >> endobj -5621 0 obj << -/D [5615 0 R /XYZ 85.039 391.656 null] +5689 0 obj << +/D [5683 0 R /XYZ 262.428 306.66 null] >> endobj -1794 0 obj << -/D [5615 0 R /XYZ 85.039 126.125 null] +1546 0 obj << +/D [5683 0 R /XYZ 85.039 262.972 null] >> endobj -5622 0 obj << -/D [5615 0 R /XYZ 85.039 105.535 null] +5690 0 obj << +/D [5683 0 R /XYZ 85.039 228.43 null] >> endobj -5614 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F14 2895 0 R >> -/ProcSet [ /PDF /Text ] +5682 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F66 4190 0 R /F62 4047 0 R >> +/XObject << /Im24 5680 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5625 0 obj << -/Length 3106 +5694 0 obj << +/Length 2214 /Filter /FlateDecode >> stream -xÚÍZ[Û6~Ÿ_a¸õ`cE$u—EÚ4íhv6™bÒ`!Û²­Ä¶IÎtþýž IѶ.‹Í.°órÈC~çÊ£ˆ‰Ä$ =_¥“8žJ’ÉrãO60óóÐsM2wh~x¼yù& -&Â÷R?<®Û}B/Õäqõaöã/¯zw;WJÍDêÝÎã8™ýøû혽çчw÷oïßþŒ½Åì÷œþÛ»ÛDÍ™èþm;ýê·^qOyþíÇÇ_o~z´'µg€S¥xÌ/7>ú“\é×ßSi2y‚¶ï ˜ÞßÀ9½0Pº¿»yów»Ï^Õ…J #OÆÐP¾—$A'ÒSBt¡ï…~`¡.tB&^GC„Øýá‹øòzBžPg¯k†LrÍ/tù©Ô “ðŒßc±Ï×rͨ+€»8ÜÊdÖÐæB -PLZœzqôo„0!¨;€ÍÍ^sg³k¹©@y"L,G¼ô®ÜðAaTx ASj(È -N5И)#êÈŸ­QXÕ>k,` !FXb¬ "Ô)ˆ®Ì­O–E““QÕw¸öåå;½D$„•©Hï³.›|ùÏû÷Ò—ñí<”áìó©j¸ø‚¤|ùêX½”¾¯î„'“»@ñÔ_|áû¹­©õÌwû¬úœ7dÊ4 ˆG<Á0èf>_)üœDþG'±àþ7¢þŽ|ËQ^›â·¬nò*Âç%‹²®ÍQd÷Q”º“²WU‚@ï´.øŸù*?žŸ²gź|f‚sð¯Ødef×ù¸%#Ñ]‚KÉtç9A)g÷¯y` -¸M_`;dKÓ‘šC‚«“)ü?Hÿt²è…ØE1S‚XëGFå$v[J,ð¬”Æ!Ú#ÌJ‹¨ÙrÆcOE£“KJ%˜¿@çT6™³ñ³I !åøk_Nˆ|ÕHNîõçä†h$'d¨sò+~]9¹ËÏ&jàsŒ±0Ú€ü!Û[ÝFÛgå/Q(&F2ÌÀŸªò°Acxæ1È7t¥´7•Úfµa»æÑcEÞ-»â¥[r˜«'d™Bc”Vù‹ûÏÚÞzO©Ô‡ ”ËÎ!ê—!‘Ý C-»+~]²sù!œAÙ®hØ'Á ÜuÀ{Q0µ5$ãàu²×8œX À6I -imà$]°dhžØɪvöˆl~†“ÿÒiyz‹ûl¶\<¾0€/'z™eNÙ‹œ ‰»Õ.‘Xµý -íµ¨RKw° ny<£Ðzd”hÃþðØ[´…ÍKÄHAß!êW C4¢@ƒ µ]ñëR —ß¡äüžsò%õyÒn™~ -¡7—Øk/@Vj—˜ç.[’eºèh²Vãxðup2f¾šŸèAÀöóBl*ìgÕu9[ž*ršÝ€öôÉ2Jàñ0R€wˆd©‰Æd9ÄÐÈò’_§,~&‘ûÖ„ÞVGû‚•î¡p3Mñ7Oœó3¯æqÄz[$h­{O…v´¶q{ö‹v²…®“b§)yOøAÆ3l»©o‡LõÛD¼°1à*Žºeñ>É‹D2"ù–h@òšhLòC ä/ùuJÞá‡XøÁ¬5 JÊÔeŠ4«Ö6±`c^2@œñ?Lôbý5k™‘Îàz²9CÍ¡y§Å*hs4]¢p\6ò-ÛíêÃ÷ ÓlHJ~`˜stÊ|âõ‰4©ã9SUÆOïužhë\êÀÁ=Sèo è/γVã¿L ™ÚèQ85§9J»VóCÙÌüâ«k¬ô-$ˆ,Jä`=À¡é/Zˆ4±ßØlÕ"ÒU‹7XšÀäþ¥ì(Šg¯ó¯ù®<îóCÓW¬)~¾ƒ‡shú‹"N< ·‹Ÿ%j[h8«ÕNñ¨~®¹ÐªÅNü"n˜—³R\óøz†³Œ’ ¡§Lþë6T[ìà¼~£{ÅþX9ouÖ7ûôCŠí×™„À£V¸—ŸâÜ ´U9áÉ»>ß#‚ÄñÈŠpˆú}!ñ=ƒ µï¹â×å{\~\A üë·´}ýú ƈSmJþÕO ݳI*ÐN}õä’ðae¼Ú”Ií“–-_/j²ÝgžGú¢Êé4F‡ˆ¢ƒÕYá´KäT „ä‘诧UžÕ6›vjо„‚÷ ÚüÚzÚaÉä\…Ã)w“Œ¯€™}¶ãé®w%’vînçåܤÿ&›‡];nɯX´šæÌpx§noõ4¦n¨áÀÎî\8‡n½*U ?öB9Rftˆ,GYÎCc9—ü:-Çágdm!ݵÞ2¶ÿ)€ÜÎ|òÝ—U~Vvb\éB,U^ÖÒôã¥iFàâ¦ÑºdÖ–ÃŒ¿\p -‰AÁÖÛûÒQG_:ðA§¦—„Ù•~¹À¸u×°Ñù“gI}45RÁ|ˆe¡MÙ<—剣€qQ¼Œéó ‡-û?ïQâ{ÉD[š~iš qÓ"ºdÖ%"‡Ù•ˆ.¿48ãLÃ;Eä¾ÅëÒT-¨øcª‹mÇ.ßÙoô|7Ÿ¯›š€*–=Y‘ò=ÙYŽ†¿ì,¿é¿K¶Ÿ”—¨žšv(¥'…9 â*CuyÞP%€¾º>ð¿¦ü¼-endstream +xÚ¥X[Û¶~÷¯úR¨R¤nÎCš6‹v»'ë Hó •e[ˆl9’œí¢þÌ…”äë>AÖäp83œËÇ¡”'áŸò’PHzq¢„N/ßN¤·†•_'ÊrÌ,ËlÄóÓbòêmyJŠT¦Þb5È … µ·X~òß¼{}¿øåýt¦µöU*¦³8Nü7î§Ê`êýûùÝb~÷+Î •ÿá—ÿ|?M´¿`¦ùÝ°üúŸ^óL 9ý¼ømòË¢·´·¬JÑ̯“OŸ¥·„#ý6‘B§‰÷c),o'`§¶ójò0ùo/Š×ŒÇ».yÅqÌ)â 8W§±U§OÔé3uÒ›)°Y_ÒDB«ÂT˜(³œ²¢ïÁfdñ¾z"”Dw¿da§ (ˆ¤ L’Ô-¿šoƒÐû¹˼Á¸™R‘H Â4 \D‘à/$€–†²#ŒCÁ1þ’¡Ìà:”J"‘&„ý—Žtæo·e6ìa‚QžÈEÞ–ëCS@Î$”„Ê -¯Þªp´-JD† 7üxjlAl pçÆöÆ9–S㎴œÈA]÷ ät¹›‰ßq²ÿÜ”@ú†0Zù “‹¿i–:ÜPï˜ê~» P [%Eû›Ós‰ÈÜðy*Itº2¾xdÈØYý»2ü‡|„¤»<¡LD ÀÀ*$›‰FÀcÒLæ´‘1 MhRÿ½VtS­ü§©–~š/àª(ï—»®Ü­y†Éú±Ü-kf†}-/䆤Øu#Ú?øûîæÿ{õm3ž#v5Ȇ;`DÀ3à’N¡b‘jFFŒG·½TîHq$dzÓ3Ëyº9)F‰8Y/™•ƒêªÇQàïÒ)­M¾£Tl¹tÂd\q\ +2µµ“OCåg»]üÝ…JÓFÀvfrº`¥ÝÆ  Y#ëêu“mÙî¼Æ_É9¬¤MQ6v_Ó¬[Õ¸‹ª~€…4èË·îñä9™{Àà3ÛP$ F ’—WbèMè·õ–ì~ÚdX³Æ%å_RivSÁŽ„ 4qì¿«qöÔ{Ñç¸5fSœd”Ãg#Îv÷ýT.Àž¥Ü–Vã3 +© Ïjñ|ÈW ‘ŒlÇ“.û2eËoÓ0ÂEL±lmÉõŠÑm¼Íf «®kå¯H*f?OK$ÖÕ¼).TÖ# ¶™owº ˜’+NZw¦¾M`à\²+Z›âpý1µhÊ›ñ '“¶­™®;‹`íWâ¤F(mnÆÄCñ7j|kH%ŒÔ½ nU|Ö'Jè<ḥÐñœi<Ê8¥ ]QÁ‘Æß ëÏqÿÄ%uì‘K˜ÐöÑYÚ‡ E¢íò¦ÜêÑOuØ$‚}ïYè+žbøn{~à¹áyËô¢ço(<¢ñ²çG/zþ%¯ÐR_Käü¢q °•qW£x‡ïÅÜ *÷臻Ãfé$~+Ý+¬Ý•˜ãorkDÖvc£V(­Ùfàî!˜á5 ¥ð$Â/6xË"Ø×C9†$rëÒÏ §½ú8눩æßCKÌ„8¿|H^ž?%Œ}n1P±uÌ/WÎÛøq[XØÝ|Š^5F¡ÞÍ®X@M×Q·¦¨‘Ponã“U­ÝEžg¡MѺ„ɺcð{±çønI=ƒm¼¾»þtz!{«!¼2Mìë²áë +ÎŒ'{ÆïÐÛ)ùÂM¢!]³GºÅ’Øi‚Eì42Ú_,y­ïpRß>N€­Û4„óë ÏáâF<§Ý¼­?ŒWuU¹ëÐ;Pë}WR¸Zž·®;ª•E²$nŸž…j& ëjh ¡í­y½³·”½»\?õi]ÕdwõyììØkŽ +E·/œÏuØsL/ÁÞ-…=ìj¼{cã‚¢kÆ6¯ÿ±×ÌaOÉtÅA¯àÛÐ?â¹áËô¢n(|p¢ñ²FÇ>ȳýÈšÁÓ|ß^Rn?nlœé0DèlhC㶧ö>Ûræ &{M?ŒÏq½Xâ{,Röéb¶Ü(Q«g&¶T +¨dÔ;1eÉ(Å/ÉcÜm™q·*ûV“¤}ýJ^“Ý åY›êæBÝU˜*ûìàÐD#ín»µý-T5}` 5ûVÀá¸Ní“úV^£v-©i,Ð'8sÔ¥è”gô´ÄW-umQ ˜îÅ|O®cw‚zŒ1Öt‰4Å¿G^¥p»f ݹžJªcYÒû#€C¢ÅÑ¡7Ïðë‡Ñ€˜ÄÃ`Œ#ÂÐhI@÷}Ë2òxÕ7 ™ESæÛ7õÚ%r÷×&ö™ë*ýûú~îÜû3+ßê©jÆìÑYù1(ɱ.—©¿qôÑ»¡ØñšM‡}iñ—PìéaÔÇIU>ºg?Í9gYð¨8­í ³%ȲO¡¿yD±öç+Þ~ÍÒ»?Lyä'œ-ç+MyåY ÿ9þÕ'Èá[š‰¾ò-- (g #õ©½¡ND˜èsƒÿƒÌÝæendstream endobj -5624 0 obj << +5693 0 obj << /Type /Page -/Contents 5625 0 R -/Resources 5623 0 R +/Contents 5694 0 R +/Resources 5692 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5629 0 R +/Parent 5701 0 R >> endobj -5626 0 obj << -/D [5624 0 R /XYZ 85.039 781.388 null] +5681 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 299 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5702 0 R] +/Length 23606 +/Filter /FlateDecode +>> +stream +xÚì]‰bã( c0¾ÀøÂ'üÿ_®„4í´³IštÚ³;ãø¶O¹:Úûmõ÷µéßzL”û¿¥ w´÷¹ó‰Òë11ó×`A9'ökûþ¥Ç$ø_„YµG{Ûr'Ç»±ðï<ÑUþeXhýÑÞ¶â3¼ðï<ÑöÀÂ…ßcaþWÓð·aa>DÿÀÂ…ƒ>ÄÂgì… /¼p`áà… ^8°p`áà…Ã^8°pðÂÁ ^8°p`áà… Ï™ÑÁ­ †yþÞVó0¿YÏç_]ã^­1k§,¼ðcì…Q*íÍ"ðML›Ó[óëV)®gù«×•Ë·’ÞÔ—ßx¿Ò®^ø!¼0:Wx.B¯Õµc}ÿÎÙ'úR¸ìD ø'+O¢¸C„;uI°ygáà»ltaÞ.^ˆ4ÿw±pðŸÆBçœë¼›XgßÝ*qÿ`¿ÏiinS|{†–…´.åNÚéäL¦ÜOÉβô–BY@À´Ø•"†Bª d=-Xsð‡­MÓžIґ׬É^ÈyM@ŸÒtÀÅ°ºKßX—7ö˜)4òËåtïl«†tüyX n‘ªl{hƒ[>ÀÂ¥Ö5AÆ eÔá5ÌYö2 Ü]Fš•ÎÉ< +‹‘ÔÁO9,4nò™+¶U.Ú/_E/üFŸuDcq;Agšº³"뇋=u)¾áºw´„Ÿoh6ÄNQýFt~ ¦êx¿õóì…ÎŹëÕΠÉHgk7í ØÔ¼é>d?Ù°}m½ RÉåkRixWývKͺ„ÝNÏÈ0ÆmXCœ"©ËƒrVÂ^ø@Ÿ…'4ÃS ì EM_žÂÌàBOjÑŸ=ˆm¯ÂÂ’S¹½¥sÓùô j·ÙŒ$Ôs´‹ßðBzöm +öÂT'f×}ø%3|à/IEg•ç±TÛ£Œ±(`žî2Û “: ¿íXþa,\Á Ž•fn7ÜÆðò½tõÐÿx©b#Ž8@b­Ó&¯wXTuÞœ°`²¢ÈÂî&îoêÁ“:üTõy‘]bÐoýXUwq‰r1ÇYˆ´&qÁ#‹³ ®¬â]9®I_4;dҲ貾ýÆX¨á&‘]_ñÂ8M1©§º½°Nv{ƒ¾ca~……Ñ©:(µ yäÓ¤½ÄÂ*Ùé.¦ÊȶÙücáÿï8 =e;¶ ­–ÙE÷‘û” ±VÙþw)ƒîF:Þe%0 xÃBâã–ŒrD#‹oÇæÊ y÷Ø°`¦  Š9—l:ßÁš|;hü‚ÿmømòû N]}k,@‡"O¼ >°ì…Mü °À6Iæ/§7ð( &<1Iñ + ø”ÂkU©´ÛË¥/ü/XêFµ›ŽäÌžÁ’Ë·”º¾qý®©€€Ÿ°PiéÆð>îXhœXWµm;¹&‹ Ý^%*®$/° ¬Ø^0ùš`““ýäÐëâ€?/\9l-ûŽtŽ·e°^b^;§oÂÂWÚ d1ì–Ýè—ò}Ä,Ó t߶^æ0ŽD±›€OB\Üèœ &Ší 7ŠY²#æ ’eÔš2Q›íˆíÁ ¿Åí]!ËédW™1¦=gËäâ4­¡óåg,X<Ã>>Ñàrº q†EÂ[¶”Jì +ìéØ…±aQ‘¥Ùk³ø ½_÷år·^°ùhÛawöyá¡ííÌô•æžÜ.ÿ&/hP2² ½ŠÃ;ï/lb;JIè¤/xá ñ»X€}ÅÒK»[sláù¶/Xˆ[~®²o±ãrû1–ÝÔר;ü#XøÊöOò‚Ťb¤Üt¤ÆÉ´%âbL(wØ­nWDßã…ÚYCv Œáv¶› ?¸b<圊lï‰|Qg¬{™÷ù ›í0¹mö^©náÚ,Xx/,¨­ø“½`“îrv4 “ ÛÃ&}ѶzA;:,¯,X³ÁÈÐpV¶ÛÔ å¸ÔÈE°•Rn1/„_`a9aád;÷çe8w ˆdW¤ph+ÝGµ‰6¼\o¿pðÂ{M—Oá_RnÂcªl|!^â`çZ–{ßÛo ¤ÄÑrBR,}SlËsom}¯è¡GoÊ}®“Lv©_Œ¿¦|™´[Ëæt9}K?êr3ùødó`|—ñ¾#v ¥ÓDضóŸå…òeê×Ä=GUœ^Ð9×yqV£é÷·A¦ñÀÂM¼ð³›¡*pÿ9Xˆ/æí “¼²±ï_ì³Çñd|Åþo9võ…›xᇷ:¨tÿ9X`6ørƒã@i‚"kzóá$áµÎ‚¶Ã6TÔn ­ñC ߣ! +—´áj¸ß[½m·hàë,üC¼šB_ö‘¿ Ò^H¸ õ›|Ã:j+,иEí¡¥³I#3Œ-Ä—b‘Vľ]¬…µO„•t»EÀNfbŒÑ¡¢B°Ò 9c*õÚJ±Xø·xáŽögy!É:]8e”äL¶¹³$v"*¶±·])µ©¥2Ô‰2sÊ'.×n!Ôu™“y³Ý‡HKW´ŠêÇÄk]X^»id 貌؅ñ°w÷Ê©zM.%è<Dšõ_®ž$ï™°×ÎóŒ·ú|ÿL, óhã²E²ÈQ/$|‰ƒjŸž¼*@ +­«cæ*Š£s¹[s§GÑå5xYdÖf%Ø F.~ÈJáúÌ9Õ¯pø>^±ðæë á½” +ŽÄ§ÀÃú£t®wW^¿ëÖgð6í;z{”W_mòo`aEçkVJXèbìùñ÷¶×-ÎZJup”O™oœ‚UI‚.]“s%bÁ³eUè.V<Ðûž:»P:.’_ä>à èÞ«¥TžfÒüeØ";y€åŽN šü×È%¯=cŸ“¯ÂŸ´(ºpYÇfá˜ß°0ñÄvÇÂâʵn(u›G›÷Jã#èž’rÍ |n¡¢3 îW»:)(TI Û÷u°«{á1¼°âÜ—Âþ3‡GeI‘¾óYOê"æ+h±Ágz Îy‰ÈÒ¶Oò2An’åÓê)Ï£à„ ­xärœvWT›ÑÑ5`¡>Ðð l![¿… +vι> äùû#U"9°ð“x!ß°q³ÀíûXH‚÷\Çò IêDYL5A;ïÿ°Pâš6)ìX¨p9†e{ ;ðÈ '­5ò%lëÇò«¨ƒ ߟvi< ýŠ¾ëòTÚÌÎ !†±(AG:cA›±îv,h§vß°€SM+zt¿ð†áú9ßu$ ¬ÐRÂú…ê–Lß ŸoæÀÂòBƒ²|Îþ‚iIÂü‚XX0…I°qÔë“mçÂ1á“l¶w‚îàY¿)ùmK³X18Ö 6^PÈ lÏzbo +ˆHO%Ðp_øߎžšõƒHЭ‘Eo‡ý^BDýšXx(/ ãã“›v<ÁC‰Ê$øhÏeãÛi)¶ç´Ö‹Ål8h~Ö<^l?Ã×÷'>²¶EÀ¯K¸œ¶·4ßÁá` Ð1÷lJÒ–5‡:ãS㶬¦†“§8$RM‹ðv¾yü¢<‘ô·×Ÿ¿%Ç‹£Ê žÊÇ=‡õVkÑØ%9Íçv­uë[­g>p>hóy,üA^Xkc’¯³.d· fWaæÂþ ‘éE˜[ä‰&õiR%ª3ãA%Mp.Ÿ$sÖkØ€$ îÐECÜ3¹eÜL’*,|–¶T&jÙ͇šp*!ä¾òQñÒJü7üd,$ Q.z”lÄ +·ÙcÒœ\+᪨K1®0V^ÑfÂü †08Y£t ãpÂ9F@¯„';(œ…±N@gB Jøi:°ði^ðMó'/=­Ë~ëÒ çfo°Ä9ÿɼ «²à„‰WT‹Óµ+ÇEìXˆˆj¨Ôõ˜Pƒ“]¼1dâhVV…ƒ á6,KlÀ¹O ZW®_…cX ÖÞªä\º%Ó>Í qûƒöBä¥hŠYoY¥Â%t®+ὤBk­Åxîgóž!lfØÄl·®y,L¿lXÐÙ©ƒ&pànrŸéÏ^8iì§l-ç…÷Fü _Ní>%oåžæ¶‘ÿ}‹V©öoÁ‚ÐåpM¤å¹œ #p²6?ztLe +z8G"©×`ÿ²ÆYún1-`;;À^;/8VUa6í¶X$`AŽš9<¸”½)å…ÏòB•u˜ë¶Š†$š#ÒF+(=]g€É1ç©î†45 (ì°2<²1 ik†ƒ…$`aÒ¸kí¢WEÚ·öusCŠap$À”·°û®)‘Žûw$Yš´‰"Ï#Ý&á÷5ëLT} p~c à€Ø×ðg¨ mTq ªeDÌ€gYSøk†6üÛLïe¸÷.YqèuØ·š?ínEóšk~`ás¼1çÈòä§RGƒcæ©K·)æÖ‡,àŸ"¡ €cc4„Õê0ewr^®§XhÀ·Œ­L*‡Å0n ±PcxÜöè·ztÒÏpJ;7 Wp8lNM¸êÊË lùÜQ^ø³Y¸¼a 2OpäÚºsš¶ Ý)0ò@ÒÚïXèÃÒ%X%©)@š©H‰ÂK‘<Ö쳧àMÌ49WþËá):¡«(ËiP~§ý²W¾Ù 0¬v8 6Ò­3suÃ,`Ëèx`áɼ°nU© tKtšº¼Äñ펹5>õó}ˆ‰>Ý]cÉêÍM ›½0¹fØ“QJ”t=zßajlËŽèë»Tnª€•êdÀTÚ€‚€£m(²8°ðüvð‚ßêï$ åžôW1 j‹1œA0Ÿd±€%¬0çü´wþ“TÊö„…AÚø¥’q”)Õ5ÀÒÃýw,`yƶj@'^XsЛD·ñ‚g‰BÚÕøÓ¼ð•ö©bù{•Ë?Üårè͹Å?œçc„ÔbpL>ÌÐBùt3ÿ^tá÷aü‡±pG/¦QL뀅iÇÂä˜$!87©éO²¸ñBл”[¢ØIG‚í¬r5[¢7T¿\W†âo`;_b«ÿ 9Û %œ+Ɇ런`]DCã'éHý¼Ú]q™_F¾YØ?“Lƒ©ÔЗ §ø¸”ð4±Jú6ˆ!§ÿÐ-ôUÉ)^xyúNQ òZž±Ða ?WäN]b¡@—¢¡Mdøœ%ë©súÄ è¢½øU.§²K ý±ãmLõ„æxçdy’ñÜÙœñ2“Â,„ضÔX'”üQ:R½;¾GåÕ¹Àíåk£`TåX½¨vi6 //IÌ8””N@sÓ„~Úãÿôú'ÊÌ?‹…{´ÛÕ:YHê'œJKqlÛØПèÖ=ÝÞÿĸÐ`Y5xE õiké–\6+ìVãÏ+æ”!rŸ.K%¢† Å3„ý±S°œ±s&&ÂÀ—¹”sp 3c|ÄAtÜ´-¤-~ /˜iÉKG:ÚØ2)Ö:ç~ ¬*[Ÿå™=MF¦v)_ѤXŠn´¢p‹E&É Gb˜u‡º¡)†•6ƒ(Ö(P1=—€]^*xeC©–’ûˆ*‹I¨Ê+,~±4S÷d/ÜÔˆöðe²åalÛlý'$¨ªü¤³†$¹dÏ5?†Ï6Ñ-x‡íF ×4µÚ»#\5åwÞ„#â82î[rî7[2o¸8÷° ¢Ã¦šN릻ý{¡tbqnmp˜yr] Ýã(™ ~©ò4oŸJ)œâ˜ÝE`>ÉQO,‚ŸÒ —ÈQ!f)@{$‘“–Áq,hFk‰XX÷J˜QD)x6À«KÈÂP2Ùi6šÀ1¹–\#{ðÂc§øüªî>ƒÈXç¢Obá‹x¡’lÆœ‘™³Ú0"Ð2Žj¡•éâÔ©(‰ÎI5FÏ®È SšmXÍYºhrIÜ^·9 +ˆݱÍÐE#(’† Æ£Äd®®œÊº´½‹Cz"?xáË›¡¢DXuÀµ`Ì~X_†…`ñ÷ˆ…Ç"Ôò@4•"Ì´œ‚19[pŒø± Xà ³Ñnau_cP‘¶I0ùÞÎ &ņsêüHA§ªÑÈVOp2!3Ìkb`7΄ùW±ðÇGÃþ4ͧøu¼€Ú ½ÀBÆã¬ë£º6è—ÊCò(#Bʃr9À2BÛ¹”Ë^x«Áq70»äºñ †leÁ/²œºë­’EqÈêêØå]\V4”¸ËOµÑ^ø´¶Ü´¿úWŸÝºƒÿõËã{oD=ørÏüÒ›_îþ!¤^ý¶®ülZ|g{GÄÜŽ…hÀ(´s·Ôrñˆ…æ\ï1wLc>çU!9§œjæÍí£qì…rÂCø %|ªü‹»P +Š—”±u‘¢É] Ȩ•Ôc%ƒÝÖÃ^x‚ÂaBÿºz1Í(Â/5kKö«ûüȬïe_üÔŸ\»Kùq‡\¾(F­}ÉKIdr¾ji¦l©—*ÅrçÍBNõÇ{Å–ÎÇ°"Ý/¿ÌŽ~]Ï—ÉO8ç¨NÁ<_€ 2<*M`¬g^â6ùa±È|ë'Ö¥·,ç>¢ %–?%÷©b +ŽÔVSLÚÚü³Xx(/';÷«õº—Û 9a苃5}'Ï3Nj—®¸L‡~rCò¥øØ&..Ò4N'a6B´ß f2:ÉQãûšŸŽä]Qüt0<ñË/.¥¼>¥Ã¿Ê < ÞØè&q|S5TY˜&ê²]F'xEUdÆ S4çàh’ž“dÞ¦…ÆÈ„£iÔ’G’ŠjW7§î)ÊVôJêÈš¬k:æà#v1#™“p’¦#&Í*ºoè¯Á—·WmøFþHIöñ5ÖOˆJ^?ýòÖdvbÝ*‹¨Ógƒ­6±P×m,lhïó “¨:'‘µ8o¬1=˜:`a‘\/˜Ä‚†Û…£wãT,t¶#–lôïÃƘ«K/p¦6Ì´b¾UÁö‚ÐpŽÈBõŽÎÛ8¨Çô ^èúøI­5FÙ2fíòeÿ…Âóba>‡‹tÃóÂgÚ»¼08ÕI+܇×_°/Ò…ØSu$Lí÷¤¶¼âV~% ÅòwX0ɉªä‹yáÓXø…>Y÷ïêÖÉß`Á|Ìs±¥É3Z¤–×¼0},ø!2o‡’~./ä_óH£oÀ  ƒ<È^Èô3·êò‚þí8Rºž-óÓyá«°ððÂX­ÏhÃk,´ßIGÂ,èþÍPÒñ‚!]בO`áŸæ…gÛ _ƒ…oÆ ¿ÃWÍ/Dóü©1Õƒ^x,/ø¡{C _5¿ðèyçƒÞÚ ]x¼sÞ«ž†ƒþ‡|R½Jz>/œ}0ô#ç^xà f î^:Ô÷«Õ/ü/\ÃpÁ º’g^×Eh£ðdìÒƒžh/ÄÖ`A¬Q’YÑLB)ê`-XªÖ”¼ð 1œç‚WÒ)~áy. [ÒÐö´pðÂsxAÅžSQ©&DÂV ÀŸ·ʼê>RÌî`Ôþêâô^0q—4>™B;kók|m?¥÷Ù 3‹|ÆVŸ9»Ž9ֹƎÉ*Z~*Rfu¢û²(¦¬ +¿ë¬¾ +ߟ.†’ˆÿ¹qm`¡g=„Ñ[iy¥cÛ o‹eKûy^಴Â[2xœ629\y³ ½VIü¢§ÙÃæDêˆù^ù\PKݘÓíºœ-ƒ‘nAÙ¯ZÊÂ'üjŠ»TÕo‘ñíyáÅbàÉð×ñBí&‰å;Ë®JÓï+=¢·@÷n…åy‹š*oŽm+ŠŠéK5bóúó퇥÷Ù  <¶ö±P/µÏi7ÙLó[±¹’M+²6®´®ôØ­|VÃÊ©Ò+|ÂÿÛªÊ /^I˜æ/ã…”eŒW2ü¶²ÄG¤Ž½oòä?"Iž H%ÆGñ¡Æ5¾+òìC,Üh/ج, û·)Ë•}šE•°u½¨%õk‘X5Áû:¤xQ9|#vÉU~/l:RåS§{xó{)f_ƒŽÙ–ÞÊ Õ*’%Ö¬à êÌ®´EŸë¦˜”êۆɼ"T©I=a¢&/¼X &™ÿ6^h3Ýøfïùgî-“J+¦cË •¥ï¤X„ŒP^G¦(঑ÔJú^ðdÖ«·Š`3^É< +k‰ö<é\öft¢®]ìW4ðk/ëFQèÒmCßs9¼Æ^0›íl•W>v)7¥\s¶¶ÕSì…Z†"¨Ã+3û¸²z/xòB ü/ã…,P)]ív³œÄTÖÃÃf×ìL—Ü[ë:Æè¤XÜ0>„6EiãîÅ„eFL°ŠËŸ,‚ñq¿êuN-Ëâ‹Ò|¯½à[qKa•ëæ "§y=£›Z°‡RMg§N©E¸(úIãH%KÒ$Þ_ôßNê†GñÂE†$²v!/d(¾+!¢ðªÄñ¡…À Ë„Ã<ª(ˆÀ =¤ Ÿ”Í©Ôä…³½ 6,¤¡Ô-ˆÈㄵº(õpQžG©+›¸it؉Þ9ŽwÝ< ë +âÛ¶CUr8ðbaܱ ëºîë5WúIãH¥—*yÕSÕð¡!hØ Ô•ü³¼°ò_ˆ^ÄßÇ Sø¢ +‚,æØ­²É/Ðï;àDeX5°vë#yá„…/àVQz×àíœye%“§ÁV¡lÎòûì…Ûµ¼ÀŠ9,€üÏ/Œ;/˜Æe@ÁJ窪žÄ  íVÐD®D*º¸lX\Þ~–Vr&†SGSÅ2ùëxÁ§ŒÕÍÄdx¡”I]‰·®N* <ÐÔA^{Ù¤VÀ»æH÷@^p[ïšÌ$Èê9b*„Gt‚Kè˜-Aø3IK,]hY¹¸»yá XXW™·bA…^û¾tt¥2Ï]ûÓxA–S‰Õ±´}*õŠ ðØ©ýgyá%ß<9÷'ý_È pT0AAP +èˆ5j*Kà*¨öÝÖŠÞOðf&!,ñ™6¡Ýš?Œ²"Ç–xŒ~×½!5 &^´Ðq¤'¸„ºÕ5·¨¦EÔÖHdí›äÿÏÿ S¦·Yè"Ñ:.uVàr6œ®Umm£‡¦~Ö¼ó$•RZR‘¬Ö͆åL®Ÿ·Æ_‰!ù í… ýñ‹¾ ´íøùï}ü·óGóøyXæ¶/láá´ÜjüqÕ-N@뵚Aw†yxí¥ôX^(ĉf)¾P΢ î:,üvéÂh>C÷Wò»MÜåÍ÷ÍüTÇ\ž«R?Ü^¨Öº(Š2ÑßÃOµ|… ^xÄ8RGÞ¢"úKyá½áê»ò¹~+^@$¸ ,|†Ú,½uï m’IW´ß#~á|ß8ê9M܆…ÈMŸGzE äŸã…ûÚ7â…qÏdÔû¯)[œìz`ÞƒÎÀãu÷‡ðO×ã¢?Ãyt58ÓÇcxñ¼'Jbè_HߤJRé¤<Įքå;ªÐ΃Jï—[<šâÓ8B‰£qv®À¶ÃeNÕzØüÏü™Ú×ñÎ!/ðùbÿÕú›zó{xÁÌÛåò÷C6Zô-ZßrÿâI —õÑ…íç1™Ü°{Û‡wç"Ñ`Áhÿ“à`rãa=þAg$O§ýÇæVAß×.̱T¬èέ ¬«†zY+M]ãõ „Œ#Yõɉ›¼'ïd}ýsý‘¸ùY$‰·y‰GòB抙+kÀ!)ÃÞËúei9<Ÿ^`Iôº'#ؤÍFÓuqmç4Zmô^˜/°|Ì ¹+6Å݉ڢ%¾„R,`gƒÔ+±àxep×Ni‹^Ú +D$†ÿ‹»‹–Ì·Ëä ÙÖÛÉQ¦‹Xš¼Ùf‚qÿ}ÇM)ÄòÛéz^hOSjç£}(3©ùN{‘+›j.¤Òõ4¬:§@Ba= d«Gó\Õ*Ë$ËdÏŽaDßvؽf{%¿)Ê÷Mïç…—B$>Õw#Iö2£KOAµ ·Û +°‘³m å`Wåœ,ö[.žÏ ¯º¤_µOƒ»Ï˜_xÿäðÐ1e߯rmþÇxºÞ^(cOà/¤Ju.êïÁýú|ªƒ~ãÿB´~†ŸjÆ03‹À*œÙKaq +¿e)ï3“ˆ…À ³Ü6ý/¼Ã<ÞïlΓx½Ÿ‹›p ƒñ\ï‚6FÛ‚ÓêõfOå…µU„Å©±v„°zX }æ{!ÔWaár®áMŽŒªº"‘äí¼Ð0ä…ú‹HO²ãÞn¼P FŸ²¼½`!lZ}‚|u&†(“‡Ÿê“yáX¸Ö^X +V§‰鈲0)ã'ñ^øÒø… ” £–ŠÇ²Ã©ÑÄYoÕÚR I·Òž^É®#yÜ´qÑgxᥦ-ÿ)1ž/\à Ka@³ž·ŽAÃŽßÀ¾Êvþ}«ž¿¡wí(˜’“˜X»˜UÁº§$n1êÀªÞæì÷M?à ~M_F[þ)^07ç½ÿ,/´Õ–ÿ ýÇÛÍ+Û€M<Êa]«¯Á‚¿ -b!é°_,‘”¹ UG~/éä ¼°yæ˜(¤9mÓÔx\EÁÐÊX{ÒÏŸÛ(}ßô3¼ðb1ü}ñ ľz¬ob>baß÷X¤ÙT>‡(˜³’¡“v,Ÿm7Tú$øm³t¦ÃyAå4†%žeœŠgö¼ÍïБt¢~«9át´~r\Ûë×Zܸûµ¼à«>¿Ð÷ÿ×'ö1®ç…ĽJ2úJäEþîÌ“oå´¨§ðB&ÐjÑG;­Œp6\…£¾q ®Óûøƒì…81ÓêyM|OüÁ ôÝ7a^aá#-7òB +—•ÛE² ®5~bŒMž[+…r¢Ö6|÷‘‘䠄‡ñyWÇÏà…0Sª¨Á=ô„DUZ…X˜ƒß6Àpzœ½ðžúg;fªtK™°rQ‹TÕj%²Yå4±5b-‹ì[0_)SïZÒß¿þ‰æOòB+•×tjÔ’% ¾ã¶PŠN)¹J;`¡YÂTH³¨‚ / Cö"3be»²ind6d8mɲ´éP°QÇn5Œ’‘Õ£¬u'b@°yJ~¤ AlÑ ,#ú|Á + €… g”Âä0]žÊ ¼ó·c¡Zm[ê2_»Ò4Ž`üi+¨§¬,²ŽDgNåZ°Õ¯,Ç ¤7ÿó{ûX^8Ãý¼¹É¯Î1TV€uJ8 ¨OÁæ×ÒáO‰ïñÓ~/„ Wy …eignËÇ·Ú«oIp+ßu%›‡vROG¢xèEõÐcDM$HÈ S]×xè÷†ÿïµnàôßbAw®ngÊÖ!q)<.Ð…ÆžJÊ—t²Ù°Ð :’™eE^0ñž–t'/ØßÇ%€©µ>˜ü6|?/ä®A,t! ‡b¢’̯R‚,bºÍp?€…drk±óÔE_Ç í†±€ ¼c®ˆ +3J2!I½¹SÑð«âÏš_Òp²¸¨½ÈzêÅ…½X0Ïä…{±Ð豉Œ€eE\¡EÙoUÛˆL4baÔZZ?Î^Øs3˜}ûÍÛi^.Ý<†vb¸ŸA+4(zŽnµbNrÃ䬶±° \Š$Ò-–¹âëx!`°„Õ«N;¾aAs¡2Z|†ÝiV0»Ä<‹BŽï³í,&Ÿ£:°pz¡å'xáYXI/v^ɜȮ–É`„m‡‰-ABÛ™óØuvñÜÄÍÃ샣 5(“yT,6ò¦·v©y‚Ï0-LPH +‹>—¼¶6_ &Ãý¼€XX1(gÇ‚Q²h¤ä Mr‹"Ödxvl•®(Ë)ý^8ëHÀ eÛKtov^и/\Ô²‚W¢ˆ\côò;~ŽBêO%jl V"N†€çs¯BR¾/¬ZÙ± 3—Ήëzק¹[´& -gÄØ‚ hM+’ÒM³4&M]\HYFBÁÒTµK;Ô*»=St¹Ê|)¢Tû^ØjÚÞÏ ¥‹‘NXˆµ[Yk…¹=(0¯½£FÀYJ:| /0p¦²h2T*¶ðàÄ<«Ê×rQø¢aó¼×ð!Ö§Ù s” +Ìd¤€.Üè°MkŸÚýŽV™ÞÏ O‹wž'ÐJ +ŒºDCºt覗–èaÙJTÄæBеҽbz\½¶PfUÐçãçy’zŒ§ÃU!·0b+¹,³,8'‹ï-¼°¥ ¿Ÿ:W/€Dƒ1ª°cR²Qn¯&«Á´†ÿ;2¾-í—ðÎã‡éyô•%p!$CУ/ÈL·ÂWü½M“­’Îø§ñ‚ÏÿoÄ WþòB5²fx5÷¶7íyå|±ªÂºnçÜzà…»s,-†Cn tµLÆ _oÚ$9ÀrjhËæ!¼’‹ÜÏ † 3”µñYYù¤ŒüšÓ(‚O.FÙ–1ɱ ‚sÚßëÈö£ýTµHÿgø?ó÷óÂóâçRUgÇìS]óªê;vVëîÑ]=´.O(4r —E:°ø3S{@ +y©ˆ‹ YÉð^éa>1ï\¾˜H2vïˆÑCxáÑXø¤?Rÿ~£÷W`áëó`T$'‚S—K¦ïõÙ¾ŽF¬ewÆ‚˜q§(„a0Ví6X‚µ¼8†Êvb| /`Þ°OÌ;ïG§ÕÎåæáXø[ã®yR_k/ì<Õ»2¯ýÌøÔeÑÂÂR85KžË²T¨h¤§ ªÆ‰B ÐE¤-¥mà ˜#á3~ªé»0Zãè±Òø9^؃9ùG¿<›о– zxÇ[Ýð~ÅÈ…‚ô¶nÛ}ó èVƒd%@¨cmÌDs’Ř\d7 Æ:¡9öù¥ýcæ‚ý»ŽyüBƒÏ?[„°ºf/JY,dÑÒÔÇÓUXøÎqmÇ‚ŽÌ™P·"O°r!D­_!Ö'»Š¢êó΄‘wGD +q«ØÜÄ Þ¤é¼aÊ·FÔG-ßÞÊ:]›»°p'/¬hºŽ6ñ"Sà_Z–Ô©voþ׬ý'yA'ÎuKõÚ6è2h+Ët}²—@ª¼¶¸èŠˆxx„?RY¼s»+»5ùV^…æÆS”!]ûU>V¬H~};`ž]z"õô>,ÜÉ Ó‚“n\aÚÉz”9<ÐJ‹k2Óü¨xçG`A&¦5½K´&šâÈú²h&ìlrF@OêFø‰¬#F·‘Št+¬’ý#xá"×e¯‘›Åæ6^@K÷V,,Mlßñ³C/ŒÎ±,*{-¸Õ…¡ðwaá>^0X‚n§$‰á,À´d¦ÅqéU]1ãñ¯ñB겡jóšI–¯:’Ñ¡v²\%]u;&ëÐà:]/Jöt¬L$zq¬~Rý…_†soÆÜЊýôJU¨<Ò,Âf>cNÄ© •‘¦ÖóR©’û†6 íhì3›ä*ŸñÐõ,ÜÇ ƒÐžKz2žç Œº¢šá¿f/$2^I·H’¸ž4®Ö¬Ð‹+¥ˆž[Š±Õ‘¤$“q ºgoUȆXFR9‘ê¼ÕÓTgú}å;£4~Ý#èþeÓ÷îoç…[Ç‘J—sÞÀÁ Ã9åñs‰+ÎåsÒ–:ÆEw +u¤ÜaHËa—›K“|‚"x·012·a! c¼ð–0:[Æ<ZsÊV¦’j$³µs5'¥p²æµ\µnºÚu\«¼e”lVÖÌŸ± +œH–¿D6‚°$ôþºÇŸt- KÑ +)ˆj‘åü ^(#“ +‰G´<18Éi=£¸’¢ 7)3Eƒ¿û‘ækƲ/âOÄÇ='×\Æ¿çôÂ[bùJG#Š;›ÓQøiŸ{,ð}mõy{ål·åt­äÈ 4¼ìLjvh7œ±@ÐgO÷Âü ^¸÷uº‹ä™XoƽþHõÇæM~]gñOÙ ··jµ¥~„Ÿê ‹V,Í`o–<`aB)å93xÄU&tÃB…TøþÏŒ#ÝÙÊK,ô·9²~ÎOõã©åùª^ýŸã…§åœÿ?^ÈOÎØÌúQªÒ2Í™H8u eÀ„-%C>Ô&•d¨$ÎêŸÃ zîÞ÷¨¿ð|{¡šÛyžƒ§v5 zF h~°æVÝ6E*À-Ã0ê¶|¶ú¥˜Ï¼œ°GJk€?…{Å¢b ¢ µ¡ÔY•[ø©Áú$“^eL±ò3ïßqfø¶¼ð™vÔ_x:/è±Ì¡M`kÒS›ƒeÜ•—tQ‘°EžwÛÂÔ胀Ò ½Â>´©* NõWø#I~'6‚ öíö¾8t ¸ªåÅÂÁ ÏÄÂ:Uä¹Ý1QÖVNmæR}™ +œçy1FÛ¦r¨,êBæZ‚¡3÷BÚÉa˜4VÈúŠ|ª„u¿›?Á „áø½BPõèpTß1ËŠ…ƒžÊ ‘ëýÌá/WŒ´ske•ÉWXèdú¼Ó¦²¯ääg_J2SµÏ\é'éŠYñÏ |å߈sÔ2„Õ;—çìäȱÇbáà…gÚ À ý\þ=×·˜C²Ñ™L^ñ–(èó¦šY¢[’U+`Ÿ¤kV¸dXÅ×ðÂÿˆÍá Jh…k´Ä£ßšîÊÓ¼ð]xaZ )]š¹€=è_xAQ0 +¦ó¦É܃2PD|È6·¹v]ÍV%nç¾ÕðÚ†Yº`¿Q²Ïu¾n›?à 82¬\“lÞF¤ˆ‰ƒ~½mžÚSÛoVB¥å†Ð¹Þ7Í«jNKx3eÛ¸3iˆ]T³*u…¾•(Öëb%Ž¡¿Œ"Þ,¯³mç[M¯ä±ù3¼ )]œ«bGχ=xáñÂJÚÄM4èÄ…Œò$zÇ^hµÖ•Þ7E =ë.wIꂳö\:RƒµQºìV^À*^ɺõÊD´F‚­^¼Þتt«éõÝyA†è Ìû,,¼ðl{Á`î£je9¯ª6–V]1ýzç…¸ ébN›±ì†j&®ØÒêUk¡Ú‰¡ë*»•¶üÊ‹òE¸¬ó£¿ÎRrr¯7éçØ}wy7¯Kü¦“¹Î£ïÁ ,°2ht$NsðÂã·§vÑ…ë«*ebH\B ­c´©ö+~¯N›j° Ƶš\Êc—•P—ñ DÎõ7òBx™bÁ ä›±`Þ`ÁZnà?Ï[rYû˜Q+{Ÿ0EeîS)õ&µêŸ´|È«Ý„¼füd;›¶} ^x®½ ÷°ýª*À.`¶›) ©µÆ 6L6Ìð»ÈºÓ¦ºL…|Iºb*Öl ŒQËXßÄ ‹˜¦r‘I{.‡ù TbÞ&[ŒoD«0ÃdÏYŽ Õ³}£—å{ðÂÞqeÒ)…ÜÐ5`=²IKÅ‚…ƒž‰…j%§ÒåÕ@š¾C7ԱöºEôo_;ò²é Ó¸!Cȧ—Åé:¬›÷éãz^X$:à­`í…$MM¨`DK6u{zUv[ºáoÀ ërN ÚYÆôÓ^`(Ń…ƒži/T—© «=ijHVéd÷BݾV—Y#+­w7íÓÒþÛöq«½ªþ†Ï)yk/œBÓ¸H}G…+^a¡P߀^µ×™Kù¤ÌC°pðÂsyáãF¾ÀOõ\›(=Oêb/ê÷mg,¼²µ1¢­’1¬’q‡r_|^ø-e|>ÑðÁ ß:~áy¶Å ­’}VË…{¡°®×ªóú,ïSg„ŒSAÍÂ’Ô*“Ë,µ¬JßÅÂwóS}@ÏyðÂâ­o éÑŸà…üL¼L`)ðgöT’}z¬‹‰u¾Tã…]­|e•°€„A5‡»‰óïÍ S=xá¹öÂ{Ò&ÿ'í—>Ý̓ê;óWÙ§C¦°Ëï"Þ‹ð« ü^0íÖ̳±pð—óÂLÅk[˜§ŒêM„çéSõÃCê;¿Q²ßdŽä¬¿Zl¾˜Rüµ™~6^ø*,„ð4zL 9T§$Zë]•´Þ~Ü6„_Ãð«ÎØX=‚þ§óMÈÕbóż¡+´áÙX8xá«°@³ØzÐuME©T¯+BA7VëTƳEÙnîsIYð‹j†¡.¬ê1Íç…ψÍóBâöÉ>ÝRâ$ø:!‰™ÉŠ+ÈÆ$*šƒ~Š½PU‚šÌ) P(ÜÒS—T‚õ=Sk)ó1“4^DÕË7„ˆ ê–|l©ÐçÎï›/æ…Ä tR0h9G¡uÖùS‰)âc'ä'‹¼ð•¼0l˜$[¹Â¼bÓZŒÞÔlídÊ•j9‘e% K‚‰¶¹ Lé=/ºêá¼ð&§ÏPêëÅæËy!´°àêT¸¬t½ž(1ÖÑ4Òˆ‹2éôg±pðÂaAG2µ”%¥jAÄõ*J®K«#‘L*Ƶ`‚DÑ.ø@©…±*̯÷:@úA¼PÒ7ò6c^`%4Ì +Ž%H]Þ;¹vg  Lƒ! ìîwvðÂWó(I¹è,]rOŪ‰˜ˆ`E\°° ™íë:N†D&¬1V·>C,¬ÿ…ßòB’× ¯Q×àÇœ ¾m0L7å]^·aƒ<õ_áCbAó™5 Pf“Œ™²p=p~ºÈ‰'­ý´' &ÕØE~PÖSFÂTÕBA–Ÿ0SKr”˜œ„l‘\öbÑO›Œðb ï¯åê( Uûgy!çÆI ð€ÇÒ-Óâb_;F™«}¼aáà…Ÿb/@+³aÍc­ãi­Ö)›j§®H‡˜6mGmŽ9µIÑ¡sëdm2è¸qo'Û®çÌ écæé®e4²¥93…õÅϳ: +äMs‰‰š€5Å"c +ŠBˆ—¦?Æ [eì€[0])Xp1lSXGe©½¡KuðÂOáèá¡—oq~mÞ¾èaª¶Â”‘°n¹%ñ{ȉkØxè©î_^¨ˆ{Ú4±+‹E°0³ÌXf‹À €……Ò¼L|Ã*rJ‹Æ‹üO#[ +ýÿöÆÌÉŸäQAž/ü¤³m‹x¾Û)— 3`œ°DAá¶YÆ‘)ÖI† 2×úPª¤^½f¬—P±8K¾/üjD?¾¼ðòlWcü ?ÕUÒ´ÍÚž„¨†×›¡H,Ȭ“Mj7ˆë¤kקVVxÿ1¦ž§)¬y ŠH? /|o,¬•®>á§a¸´÷Ói ½dž`ùð¦Æd©Ÿ„¢m9‘¯•a1Ý‚C2)ìÚ_º}ÿq^xb;xá_¨¿ð®ÎÁÃleÍß8f¼¿ëÏŠ_07`áà…ïm/< .ÏûЯ煮|ƒ&~­ÃEK›«±pðÂ_Î OÀÂ×óBï^[-d¹Ú-•J}-^øñXøkxoµ`[Ã5S€qÐÓL‹IÓ¶u¾ÅmLíÐg;lÏC²äžº »ƒž7_VIë®èƒ^øN¼ +ç–ѷŠPœÙ²Õç,ö ë§&Sõ%sr©édá3ádî#f±RIîSfÊ1ñŸíeOqMö¤ƒ{áñÂ(]I«¸t*”‰Ë ”#ëHã\]8f:§ê +²¸%[¥¬©«ƒóEíøœ +WÀ¢³¯R@å×8*¼pðÂ7â…g5,ü‘¬Ýw+ˆtKå„ÑC•¹ª%ëšÃrì°´y ·.À–(ŒM +#ØEî½M× ñà…Ã^øF¼@Ñ9·t“—§» äž­€A ›'ê$¤¡ï]ƒš1ÉÌêD +°È·òðÓ®¯AâÁ /|#^È1¹«_°€ÒÞ1æ¢ÍU8 ~×,dðkž¦Yj`a~µt4M’D¿x‹…ƒ{ágñBæDK7ò³×QŠÁÍ ÆTê&nA ‚Ο$N¬)VVÍ Së#£Èxnn©Omo“\‰…ƒ^ø¼`jéœÈàvN +?˜ÏeçRGBŠE.&B›z’RŠú‚Eâèñk%ÂLp‚|Œ’Ç8Òa/ü,^ð~N;8žÎOþáLÂr:÷6áÓû5]áÒè¼ö izÞ1 a_⨿ /¼ð=xáI­wݵX8xá°¾ /<£ñ…úk±pðÂÁ 3/˜Á_…ƒ{áoæ…«oêà…oƒ…[j2¼ð,|o^ ä¹Xø6öB•&¡!$Û®®ã…qü +±¹›xÔ~g,|/´d á·òB)éÃÞî +—0®ß”æÒ-éð.:,´Ù]Ç “³VGVBF¢Ä 5ÿ¾Xø"^Ȥà õ+± NK%ìõ(4X×`ß?Ï/XXïÇ9 ÑÕ•­àN1%Ò¯y0¬ÃŸ†—CéÙ¾Êa.±·=ð½™_\þ.Z‰SÂWaáÄ 8›V·ß _Ä k²Ü%ÃKK\:|Ðr¦÷¥,? Bd™=ùõyÞœßÉh¸«iÀÂúr˜úÔñªÿ×2Ü©Mª_s¨¦Š\l½.êÕIeyZÜŽB»‡½7ŽOm±g›ëÓ®€}ÍSI]¶ïÁðú¾#¾’è.'/š{õM¾ÿ“Û[ó,XôÓºæÜo®íÚå®añê{+~Å‚õ†^núË…ÿú¼¦‡ñ>µÉ}x¶+Ê›ëSäßæ…µ]Ÿ[S^~{ÝvÚȆGÇúêXXÚ¶ïžçuk÷ñµýOƒ'ÚŸïÊúÚÖïw:EÕ¯XX«­òìÖ¦ºâòœ½´oŸy/ÀSË_.wõ¶PK8ÓÏ^uqºÒp}6áÿ4/„®áòu’ü¿½€ú/‹R´Î,`°ÈWFgùñü½àƒÜ\Ø íµÊ•©ºö­ÁPU +mç—ùk{aKxEÖ,ògàììµtsºC:ÒUÝÉ„AÉ~ÇɆ¯ä…µ‡­¹|Ié5ãHô<z³&Á.51_7ŽTÜ6ŽÄ¦q~o ©ÁBÙucª ÍLÕ?ð©Õuô q$°¶í÷œvûó qýÌB¦ßh~a¨ón~‚A·óüz|éc,ô%ù±¹{~aÈïA‚1_„…cÞù[Ì/Ü4ñüñüÂWèáŸà…»^+¡¿/ŸULЄ¥ùþÇÃéðGúZ^¸KK³ÿswuïéö<ôýç9xáðSýZ^¸KNXëõª³ æC–!ç ‹Îù5|[+Om׌xAip,¨Öû°pð·°^ø¨å«©¨…Q¸Š¥ž¥d榽¥>—°¢öZv>Œr>xáà…¿Ž wv½eãœ23A–çXKËÓ ËÌå’˜Þ‘Vv©\=‘ä>,¼pØ ß™8dëqc¡+vŸÄE™+’³Ou¸B9:sq–ûZ˜û°pðÂÁ ß™Zûöx¿tIÐerŽè…d7Ã<ÖzŠqœb2k«`ñу{á/ä¼€/Jådç²úÕºµã¾Sí䎼‚*³õN,¼pðÂ÷¶r´ŠKU+±VJ™I^H½¨ª¥*Ø .j©Ô`Þõwbáà…Ã^øÖãH¥Âq$Ë@)òëÂØB¼†o(@1¦òB¡×,ÅbŸÉ½X8xáà…oÍ ¨<½àãÀ=èwí°7d4¡dIËuÈ26ßF˜{±pðÂa/|k^ð9{áZç’±“¿ /¼ð­yÁWTGŵXèXÎïÆÂÁ ‡½ð½yám¥Ýß7sïM¼pð·ç…/º©ƒ{á{ð‚éßnÒ5¯:ª1óÝMùd¸çÍpnæ~mŸm~_qþà…ƒ.„E½5yë×/§W>7äϨ x.ä6,ÜÊ ³È^îñ·p_EtØ ß‚ºwîFÇQ4Ï¿ Ï° ‹…ÿö#c)çZ˜Ðf¶Íâ Ç/z>mr +¯Âëioƒ{›ÅòV¬|[Åõv¤™?”ù’ŸEýv†ü¾7x /ÄeQEìãÄ7ÉíXø'xa]~ÍdÀ•Š—.eÃ=Xx/ØÞ—Ó"Eªt¸µðˆ"§£'T*j}¶ø„– M眉Ú_ ^ Æ&Ø®ÞöÎ \¤¤ZMBâF±`*ñ¦¨5äÄѺI±À´%¨×¥pR¥éLL’áco“(Èäé¼`˜\ 軫èãx᯲ŠðF·ËâûÕ¹úÙ$ØÅóöð—…W2î„0+ªÉu½ðT ?RÊ• ™\üä|æl‡u9)¶uX½Ët ‹ öfÖ§®¬jUjéZÆ’TRèuk]ÊÎVÆå…°@—EÈëe•ðgù¯½3ÑrUÂ0ÐB‹Ñ¼ÿ[Þ*ìîÉd:é¸m˾8ÇqKVl-õóUIEÁ¬°BŒ‚DIX„P° D–ç£ï÷Ý0q%Œ]âÂÏX`.”M# ã2½-šïfÁ¨jR²ãªñù\` …3 Ÿ‡å6C-(Ô”nêB/A pad;bñ¸Ó¹ÐgYŽÝ.Æ "÷„n8¸ó-| åã(š Ú;Ç Èê žûÙj*ŸÁîÖ i2NžŽ3\—ZqØiî~ß܉ -Ô'ÔïÛݸðâ…A0±–ZV˜Ñ DÈf–eÒœXæ®#êc¸ZØs¬»;ÓsÍÛþM Ë€sŸö¬åc'ÙýS`k°‚¡rRÔ¸|´ÑGâÐáÇÜÔ³}:lpBìn.Z€Î€®ò Â… µ`ѹ+ópÖ‰ZTÃ!Ï|¤»pOÊÈMÔt i8¼(°ÒVAÒÝý¸°îoZà¢xˆZ˜#F .Ó´òWáÂý)eVì6Bü¢U,úHCäB Ÿ(ˆIQ ¦•Öî"Ó‚¶ð¿íz¯j¾F a™ræ!\°Q SPªË|¿¦øA `ŸDùé.¼Å Q ÚŸ ï%óí\x„æÌ +±WóŸÌÒSýÖ»ºŽ •ˆ:=ƒ+Þççâ«DêQf¥ÙŒšgsÁ”$d`Ûºƒ©ú‚·"O'7Á¯Mý@¦àŠóÇ%áz®²ÁÇý0EŸÏ„„Bˆ.3Ãÿ†ÃáÅ0ã,@ø5ÛЃm2}o.°}±0±õ*&$poâd8¸úX¥VvÒò.ü£ Ò~Þ±Wä‚®¤ê{%¾RKhÇ÷î\Nû}m×Í•ÌôËÝM\Ðl +ÓÉ„ ^µgjê•›Þ9BeiÿüûH×5¤WöŽÙ _â‚™9ŽžˆïÁáXìøTs{[…ŸiÐò¸™ÙË…:, høçI»GÆ c{7Ž‡)j2°u‚ï³#ø1µ .Á_‹;ù²ÓÝ29—IwÓó…–ÞÕ_aOènÙ]'qøyªååK2@,Øo—÷WtAGraÎ=ºG:«œ£L²U;ÚÀûÐíùÜ1Œ°Vœ¶EíÒ +Ï +²Ãò0V°ÜÎ7=wÖ–ÜW /§ªËéÎOyª‡ia¬ý¤c=÷²"½4ŤÄX[½µ’¬¬"­,‰ß‡²÷•¦¬$µtƒ·U©oËGrî¾f“æw~I.ܨ…ã¸0R]nÖªåzTV‹•óžu…Ì6Qo‚:2IJäÀÇ\.[)ýZøbìþÖñ î¡S$.<)^˜{Ý{7 „f·YåD>Ï+sŽõ™,„:»U-‘•žs™¦vXîÏaôAã~No\òçr¡ðÙ‘Z¸ÈõÂÿ˸ÐÙðNóZµò.r´Ð326‚ªÙ±¢‚*›¢üâØ ©–Áª…ûq¡ý©(¯VÙS¹P¾÷—3æ™ÆóoÏ3fl›p™¨dìÎû¡M\Çõ×´p.P{$ÈÚ`¦ö§öªùëÄ N×¾_–Õ×|eY7ø\_¸ éO›®Y¦sŸ#ôñÂ.H,ÎaÆM\( ´  sˆ»ÍU.Ìxx® ¼Äûõn.]˜*Xç°„{öÏÝ\  òý©\xÓBW3ÌÇžl/dkoë­›w wÛ†q«ë+÷¶ŽYÛªüŠ®çÂV Kàø#L.,C±·«%–ÃÇû¬²°UŸÍÕx*¯0Sû3~¡_‡ ®ëjœ¾±î4Ù¥€w§rˆ£Áⵕ¸¡•ø¤fb…î“Ã$˜Íø>ÒgϬPb1µP¬²Še ë‚…ÆüÍ÷5­ØYhr†Õ݉ØywÔc< —þ’ïlqBÀ¢*¡»­,æ‰Fj·aõÅL½3B¹Ü«PÊV7×:¹_ã‚ÃŒì~ÃN–9S‚¹®q¨¤ª µÚA¼®«yª÷½Žc˜€‹#Žr·w™È@ uÝä1“;œv¶sÛV¨…´Ð…e¿ÐÂÑ\ÐB¬¤÷mŒ®Ã¯#-€DY“Á"l‡+‹)Úî.@Ÿ"åʹ¨qþ“Ž2Q Å,Bô>÷¹ç\Èì3-Ü/0&ØeʺFQãèê^AA•al¨q /Å…çŒ_Àž³§8Zl’®>k!ÔÐWð”B9 ¶Æç m–˜_IE.¨æ¹\È°@‰õc†—EРзÃixªÐIÊq*öÞgNæ ðXØ9Eû.,]èZ0¼“Z„Ðà–3…ÝG2^x2Öö,×¢î¡ÏxÓB‰ÝF%á““-pasªFZƒ·Ý×Ì‘‹4˞ˈáBõîì#Ñ01K\¢µ–QàBßâüm«¤.»`™ŒÁ…FNGv::䌎pá ºŽÙM3½a-ØGrá²×ïäæÑáZX@ \UDÖE×¢æļۑŸ@Ú[~»^¦s3ÇIž9å—àOŒÕ©‚þ ‡‹Æ‚Ãú9Ž}"æ¢g¸:?U¼Ôs=w¶­«¢‚Hy¬ú‰L1K{Îȸ¹àÜ….ò|a¦› jŒU +pVv‡÷¤³.ÔX/_qï¹p>Ôz¯”øJàB…ÄŸª1ÕSý¬q;<õùÂ/ö +ŽíêçŸv¬ øâ©øêsç8¼â-¬—h63ÁÄ?ãÍ_æq\˜/wΙ±žÇ¹0@¨E•\K–'.ÜÒ +ú¡Ù<;OµdBˆÿz±-tҔߠ…¯>w.è—}꛹н=ÇÃPcLتÏðÒÁdœ‚¾ %$_R¼pKû° +è ä©Îå‡ÿÈ×¹oÊG:±á¶ãIõTS=Õ×i·å#Ýj®©žjª³ý{Ûn11¾\¯…4~!qá5¹P²÷[âãŒc(þ]å‚ïÕq\¸Y iþ…Ä…ßß!yv¼ÈÏë¿ýüT°ݵZH\H\xM.T ¹aêëÜ̵o¦0µô4†nÈêjª†ºŸÊvn¥« SÀæ5l¦lmuP}âBŠ¾ +ÙƬõëf=ÍJik±óL2µö^ÕBÍœIÑ:¦j%æ\Š>ÔŒZY†U +EB#ø•ZH\H\xU.ÌX"3¢ɱHc0²"~ `ì:Œ2²61ç'¨<ì-üN7oc™ÌB’+µ¸â…æB«@f ÀBÓÈBC«Îàà¬ÍÀbëëºÙeh£ w²¼R ‰ ‰ //ü …Qî”Ò6›0¢ÆÒá8bµ EMiS¢›ÔýE îj-$.¤xáU¹ 9>Ð]Q cœk$ä$jaÅ ÇN¨ÀÛN8T/VX]†ËDD™_®ÔBâBâ‹rÁk1>ñͲÊSYûi‘œ½o +Ê\ü¸’m¹‚ج¸Ú‹AÒÐÄ4ª^nWjái\˜ä/ÇîãøÑC´ð‹Ky·xŒó#ÿ™ ë‘Zâi¹éá:”§`rŠã±m³·ÎˆŠÞ¶.pü8dµ­AkKݘyµ47¡ˆÒSm¸R ÿåÂ^TG´õ7>’R«þ@JW çù˜ ÒÔ~í#µGí‚z¨šÇíø¿ÊQqámoGø¼<ÕösÇÁЫǹÀ§ì¨ö˪ÿî¨=X;?ð0þµ{fÉm“y6–Ï¿çs¸• ©Ý-^øîí +.d¯~,ÃG\Hín\HZxçí_¼ÙÄ…¤…C´ ýË7‘¸´p€8ù?h‰ )^8@ ÿ-q!q!iá] ‰ I I ‰ I I ‰ )^HZH\H\HZH\HZHZH\HZHZH\HñBÒBâBâBÒBâBÒBÒBÒÂkhá¯9£ÛwÓO¦çxá¯9£ã7Ó‚ßmj?7v þ¢3ê¿™Rû°Ý …¿©}#-XÉRû°}U ÍßuF÷ÿ{ÇØèendstream +endobj +5702 0 obj << +/Length 107 +/Filter /FlateDecode +>> +stream +xÚ`ŸÿÛÛÛeeeÊÊÊ%%%¢¢¢ùùù444¼¼¼ÃÃó³³sssyyy„„„AAAìììèèèýýý“““ªªªõõõÑÑÑ›››TTTðððÕÕÕ‹‹‹òòòKKKåååÿÿÿ +<endstream +endobj +5695 0 obj << +/D [5693 0 R /XYZ 85.039 781.388 null] >> endobj -1798 0 obj << -/D [5624 0 R /XYZ 85.039 466.717 null] +5696 0 obj << +/D [5693 0 R /XYZ 85.039 758.673 null] >> endobj -5627 0 obj << -/D [5624 0 R /XYZ 85.039 445.52 null] +5697 0 obj << +/D [5693 0 R /XYZ 85.039 758.673 null] >> endobj -1802 0 obj << -/D [5624 0 R /XYZ 85.039 210.682 null] +5698 0 obj << +/D [5693 0 R /XYZ 261.943 558.51 null] >> endobj -5628 0 obj << -/D [5624 0 R /XYZ 85.039 189.486 null] +1550 0 obj << +/D [5693 0 R /XYZ 85.039 508.568 null] >> endobj -5623 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R >> -/ProcSet [ /PDF /Text ] +5699 0 obj << +/D [5693 0 R /XYZ 85.039 465.286 null] >> endobj -5632 0 obj << -/Length 2824 +1554 0 obj << +/D [5693 0 R /XYZ 85.039 397.29 null] +>> endobj +5700 0 obj << +/D [5693 0 R /XYZ 85.039 361.88 null] +>> endobj +5692 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> +/XObject << /Im25 5681 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] +>> endobj +5706 0 obj << +/Length 2350 /Filter /FlateDecode >> stream -xÚ¥YY“ÛF~Ÿ_¡ÕËR.‹â}øm’ØÞñú˜Ë•‡$-‘#±†"e²åñì¯_\Íâì$[.û@whàÐrgüsgIh;~:‹×ö“d¶=\9³̼¾r…b)$ËÍOë«Õ«(˜¹Ž:él}ßïÚAèÏÖÙoÖÏÿº¾]¿¼[,}ß·ÜÔ^,ã8±~þt»p­³= 1놃kî˜õRfo8±¨^béë -Úª|úoŽìâÄs¾®ãÂK­§×Z=ç[=Â\#«6¸AYöÔoëÝ]~\,a²ÆM´}I Уü@ ž¦Ó~#ÑP ( íÐ;퇨ø µ®QŽ,+‰¢®TÉ -§4KX¼¸3›~»ÍeuG±k»IHÜ]#c®uhÍÇ>Ÿ`Œø’FxÖc¶üÃF£­Áƒbà÷¬j¦Û‘ë ¹å/|Œjñˆ¶¦ûÙ ŠŒ'tÍßBË·ewçBvç—%P•l¥ÐJnÿî¸A™“Mƒ»ùŽ%>6ÀÿØÑx–¡“X»š¿nÝä[dTãVO<®÷yƒzqR’‡„*/¾ '$ -Œn°Ó-mªV¬þÆàk™ƒ¹¤Qj­÷9¯¡‰¯0Á›ÑxÈ1ùì¦ß‘¤ë»š>Òþ´ Ë팞«#úOYl•l¼’Û s½¤+Ò±u¥{XþØâ {îV9Mg؃ :ÊÕ’ÄM}Úíyâ>WúÔä²-!Gß”y’NlÍïºËõ<ßú Ó§ü”¸gΈá¢¸ôðëÃÍàщîôKP‡SJ ½Á‹0ìoÈ5ìž‘qGÓ¥Àš¡ª¡›~¶º|âA½ $¥¦Y×Å,ì X)Ðal=ÁT]ÿù%­÷hÿAN-ñÀ2óMnÌJläÅ5h^8 H Œœ8Hd|:)çë{žC!öB—)­du-³ƒ]²üK±•öïNè(a üRŅìÏ,ó¼Ðútw3çr/&ù‚1ÅÿÐ"ßÀNyÌ^¬Vx‡°¸­·¹ô›¾S}g¯õ wT*—²ý×2/_t{æM¡úî©…#¦¢[|3—¹&¯²A=®9&±c/«d{:¶õ„'êùêÕ" ,öJ3„qý @öÀú°Cd=Á˜çØ„f!QxÍ[¼9êGlù€Ì5-¸bcä.†º®Ð%±×î‹#·LìI£²“1ìÒi}xÙz´© H‹3ŠûkœÛ0gÑ"+Ù²®àŠßAûùÀjÅLh5oóƒHj¾s - ÌÕΦôa,F1ó–¶&D’Oî GÎ`JÿHžMÃi ¥|(ÏïîN”äxð=?˜ í$ÌaûÀÆ’™cË–W¡[f”hôª¨„…Ns®õ­÷ Šl›u"|mbEh¨Ñ:ÎÝóÝÐ…âÒœþÄccÝ%Y1êò2Ubv€” Êá¸÷÷RÜëy.tawŒêé(_ÒC]ìê.£¶èÀºáï†Øýsé9¤D¤âBlì\RCËxU a½€uP”ž›Ü|õ¥Êl$YI‰à£š³‡?½aÍ'"þ2‚ˆïËñ ¯Dû¤ÐSåÜ” M{R]ÚþÝ:„)˜I‘¡`«ƒ\q•2RFÖ°‰y×ÕV(јðKî.‡-âóCƒhѧ’+3N0Xä1h‘3ôøØt%rÆ|&æÿµ|aj½»A{x)㪠-çá’ДI‡lŠ”3ÐabD^J¼chO@o=ê9>¸ Þ -SãÞ“œs^3çÃ,d”Bs{Uq\ñÕØxSoxC,µ(£„¸ÎPâüJ8…B…,zÜ}þCK(½¡ÆI×˳2Ô”ˆŠ5×E«NsR„b:!e«›\Qš P~)n/7‡žÏðQ7\Ûp8Á ®\UµËWŠjÊGS‡œ”³ä¤ï+ô±Õ¡8ä¶~:rMzöÒ’À"WQ2 T¥b»åc˜ ©öT -=Žó”8g9…yhƒ1®ìNTÍ<ÃÞR½æ_¥æ{Î&›²=¤jòjºz7 g):2˜ -ÁHrଡ ÄUÑìs—“·¥ªÏy¼Äï³·r:RT{‰'i€h} (Xm¡OŒÀ¦ŒÅQÞâTš• ÿ1G~Ÿ<¿{5t™¼[Ø‘´ÿ—îviV ï,ç@ÛÆ–”|™ê²ì¼åB!{† ?ÂúêéɈШG‰Ž|§Üæ‡Á„Vþ•þlŒñ‚èÛû  ànF¦éᛑšbÛ·´¬c%¯7ÏyD×t6=ÜtYd0JÝòÌ …¢žÂ=Ì,#_2Æ'a›5%3—Mü<.Q¶är¢L};MS‚ŸðÝ‘ÓuSNM('æ%5ËÙɺ8æ9¡5§,eŽ %ž×Õñ%P ’VwPQÀjɬx¦Ï¬îO|18J1i9kvFñ]ÒÜÊá7÷¬4½Ðq¨´'6 Ø$u$5Æà§\óâÌ‘2FSãŒÉC`rk2¼®ìE‚ºâÙŠdëÒ¶çc+®D³ 4ºF~è*34\§É6ª¥À>üyǯ1—¤Òæ† ñF$É¿N•TÃtC¯Ô¿>=fÒwà"Í“L]€Žo£ÛõX‰Ó§n²\ü @b'~¶zö7Ðç{à @GaË÷¾-¡ŒÀà ¾R¶•"|Û=gS/`^b'yÞRƵ&‚uhûy)<ê²H½QKsXleôêJ tAEsÿžbµæòS6«î‘=ç—rÆ)PƒÀvÓqœy Å ˆMržÞo|Ì ²bo¿åþž~Ú‹!Œ”„ohiìÄÍÓ‹ ?IùŽíMþ\ÿ™éÿëwÓîg-0—Ä¿ð#bèy¶ç^PI^|Ëoè'v yÆðÿ¼‘©endstream +xÚ¥XKoã8¾çW}XÈ@¬ˆ½f1‡Lgz6 t7ñìzú ØJ¬mYrD)±~ëAJ²­ä2“Å"Yõ±ž³þÄ, ý@¥³8¾J’ÙzwÌž`å· a9–e1âùeuqõ)Œf"ðÓ ­‡sB_‡j¶Ú|ó>þëz¹úõn¾PJy"õç‹8N¼,ç»gêòîöëêöëo8Ó@ÞK\þýnž(oÅL·_‡åë/¿\óLùÁüûêóů«^Ò^*E1Ÿ/¾}fPéóEà«4™½Â8ð,ï.@N?ÔÊÎË‹û‹÷Gñšžñ®)TB•øa¢Îaá,aà‡&XÖõn¾Þ´)Ê|3_è õ^‹v‹#ÂçžG¦Ûïç {uÓó%PeâeŒí®â‘9‘T3©n·yÃC¼¡)ª¹L½–)k¼¸Þí²jkˆ"ð²Æ93dÈ-w·nE¶yur0Ó‹êÉ)Q´ÄgŒ!LIçÎОƒ`?É(•úA +xûýÁ´ùÅK½ÿ0󪈦e½&CùÇ +¶¤àB¥½B¨…ˆ-ÊH”xÇ‚ A²9@ýÊÔUl‹ºâiÖá”ÏÎHeB2#uÌ³Ï ]V à<¸îž¶„É"Iý”#óWøŒ*”Þ­;ž¼¢8™y¼Üð¬ÆÙ+ÞX1a“ÿ]ñc’‰ ußÐ ŽqF@1\P  ÿ¾Ò=Í+c£Œ—ï³2<Ø)¬(4¡1§GŽ †Œ Í9a´Û±•„ÓŽÎ_T—<0ÅnXã¸cë%M1Œ-¬™~¶ûïà6¼Þ&þ±#Jµ¯âøÜœŠ¡ÌT¿u¯‚ÒÌ!¬µ%“Ɔ*Á~ÅßË•ìÄQ,Þ­T%E¤„Uðôý>MªdÈæoû€‹„º!  ;r¢`A×_çj_ØߣØû\?`,sÃ\Ûl„ FgŠÌH{båHvVó1.lMÇƾ”ñûš N¤ÅЗÂòŽÂ^;aïTd(-åZ%À[Ú2¦ H÷†c,ÕŽK^ØËë¶n¼½ ºµgÚ#ûB'(þOɘT6õÌÅ®(³†™kÁ¡>£ô“Ÿyíêe†\”\MÈzä2—œV#A¡t”J +TVGœœP +{ßÆ©0oÌw&× ³~;©jØQ‹lGãïÌÇšSmÑ¢j{Uµ˜Ô¼Îê¯ëêqN +°bè£ä ›>(/Ÿ7,–-”hüßúÙ­# ‡­å=.PF›h¹©‚Ìì³5ž` >"¡&r 9P`ߪ¾a©™@Žƒƒi[‚,/ «\KùþÀ ˆþr•‹#k`ý™£ðh/9RWKWt¾{UaÕ0d¦™iê[.BOP¹£x†3ºœtkï¬^T߈c±†õI±É¹*iìÇ5’$é4¬+éÎå—!ž;ÇbŽäÚš+sâënoœÁ[£HUðm&ØôÃLèî\EÊËÍ5‹`˜ÖPÅbeçdïä(ƒ„S£#"¿s’¡á ÇÐÐw™4Ûš9·yV‚`^Àê—@ÌïÚ'éåãì)x›n\˜6kZ)LþœƒGZ•·®°û'\†À è¹#q­®©íŒŸ&¯÷¥%¼n¹AÃ1]´áC:ãJuô¿Œ\SWSö_ö†?ráG +b@»§p5.)ÑwŒÎï.y8&S³‘7ùyQnÚ¦{z< +¾MÙFQùa¸|‡ÀÀÅëí–|FöM•9éöÁwÉÚ¾Ävr ¦†GÁ«6˜ k†—†²¿AØiç¬ÖE¨¡7ks»«®J6œ´5ïÅaœbrY çt+;í‘AÑ"§‚Ï^QØ_n­* +ùB?¡¼M¾qn ߲߳§o…'4¸§šòO2!m àoÙε@‚í·æ˜Å|Ô†‰£ró’W†6&€ÎGUÞ÷ÂF#<¦,Ý;àiJŽ8ë¬Ýøa¼G}@Å(þØK`&tÉ®rBðï¦ÜØ¡}ÌsvE°-å$ŽÑ¶?´‚Iß»6’Dƒ_îzØ'¥‚»³Á'}½ ŽS5ìÜ֦內¼µÖž­9};w·ì›!gönCJbý©ïíTÄÂWà|ïU˜#ž¾–†êZG£ +ShìAµ«¥,£uê}µ…›‚¨4WñõúP/‘ zÞ¯÷)cßrY|w “åOÌg³7?!O‰åÏIIø½‡6½ÇÿãŸ5‘¼j-kgk|c ‡$½üTIn£Q +'ÃM/Uö«£PÉåûýE]Þ˜·–—±|áçÍ>‰|a{>t¯ÃMé•@Ê­ÙªŠi¿ñøä»L‚ßo^Šµml‡ïO6âáë¥Â[õáî`tÆ ›:Óõ_¤ú+jÎip׆|è}¹ã¾ÌĸÆ_›0=fë¶ë“&þ‰i2Æ/ŽçN9¸^ªlÔ®x‚¾“jxLd°ÉYWÇnÒ_tÉŸ4Ûmf¹ +ƒéZ†e&Ñû+–çWý&7äº ÛøiúÂÁÂÓg”ü1Žp›ŠÍʬ1sÛ\]²’ýúªmŤŽÐ°†ä#4Þ²¡Hʨ1ö˜Šù¿pq‡Ã?©ØÜ0ôŽÍqMÞJWÜiï Vw8øÝî6øµ•JgjQ¨ÁÔ R¿Ñ¾L§¿'XPþÖ÷„Þ µò•Nû`(%tÆN|êSyÝ7ú3ÿÇæ(endstream endobj -5631 0 obj << +5705 0 obj << /Type /Page -/Contents 5632 0 R -/Resources 5630 0 R +/Contents 5706 0 R +/Resources 5704 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5629 0 R +/Parent 5701 0 R >> endobj -5633 0 obj << -/D [5631 0 R /XYZ 85.039 781.388 null] +5703 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 425 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5713 0 R] +/Length 23871 +/Filter /FlateDecode +>> +stream +xÚì]‹b«(EAQA|?€ÿÿ—;ƒ&}Ü>’4mÓ¬ìÞ$MŒåpæ ÃŒ÷{ÛÛ÷´d®÷‹°·½a+†ýìmo¦ýìmo¡Mb¿{Û6žî×`o{Û‰ao{{N ÅîJÚÛÞBkø~ ö¶7lÙkWR}·m¿Y{ûÞV¼T -½Û6î7koß«^ƒQý}¶ÖEûÍÚÛ÷¶©|{§§™¨ {û涌 ËŽ…½}{;d Âåû­ÚÛw¸ÅŸÀÂÎ {ûŽÆB}˜¾¡ا‹i“ {»ËÆ›×XHÒ,¹}ãhå4c’¼°Êv½°·ûiIQ¾ÆBñÇ)1°™¼Ÿ¯À®öö­>B`™ÿÁBýmX(²l¼ ;/ìí±PlÁHõTÿøÂa× {»7¡pœsn¦õm× {ûVb8òÁSß¿[,ìzaoßÚ†ÃñÅx÷XPQTííÊv‹qäðw~s–)9J‡äþ±@ÝÞ®læ·üÝŸ_D bø)í|å\è»÷éßÄBûwþYR³Ë—Šá|ªåu>U—[§ŠÃÞ.n…¼¢¿øó«3±pâß4/°ðê$ X˜¯œkC^»Ä»¦Ý + êOæ–KÏÅÂiÎyó)mXÈ—EÜü¿&‡C4©XŠ«±Pîû +wáÍx¡ù‹??? aœmž°à‹8º}‹ÑYÅáE~…ô‚Ìöž}ß Ãccá4Ç¥µ¿ïõ ;/ü2/¨ç…ü–æž×/ì¼ðÛ¼ðèX(>£r¬ï ;/ìzá±ð¤Šå¾×;ï¼ð˼ æGÇB™žˆa× ;/ü¯yÁ/Ëöâ0ìzaç…°0<<N³ÌÉ´ë…>°‘ŸüxÄûœízaç…/ÚHIÄtV‰•}´=x?µmÛç§ úå´}W‡»J³x U›Û-´öЦeÕ†¸Î(ìd¹§6º’扶³)v½°óÂ×°PÃm¢NâðÊñ¸b=xå”t.t{â¨qê˜Ç·¦d{e¥Î¬}’9µ¢¥r®óslÝBJå¶í™sâfXðÓñ·MÇÌó³ÝõÂÎ ïÚHçø‘"G’šÑâˆ~ÄBš Já°O¥ð=†¼ejc€°!1JèòÕ Äë ÆÍðkÖ¨4ØŠo‡…Óœ3?žXBW/Ô~».Ë#.˳þ’ÕÛC]®wã͸òº¼$|ŽUþó…äÝßÿçy…ø',è` ¹´,”a Ù?%. u¶ÛŽP¹H®_å(­¥Vú¨S}ؤw©”ÉÍ°ðT¢j:v û¸z¡UŒN&庤(Ê6Çå>ÆåÔZýö +ïÓ°^ü×­ÕGœ¤RŠV/o˜VËëíæÕ«]©ê[.ÝÏú‘Ì“åòœº`#uaXÓÊ9}4E:{¼>#.PY/¥€˜|½(Dª’ …û¦E|Ý §Ú…ü8ÇðÀz8×úDmW&‡Á‰=yF + a®œ¬ázc_åæÍ~™ºþ‚#N2s²o·Ö›×VîA­]52ß³¤ûgýH³LØÁ³¼ Û>t·š—Y¡OWE·Û‹’× Üc4QF§ ]͢ʊ6,¤ËlÃiÌ°‰uì†~¤ÌüÞ±ðe^ põü¤Ô:Þ0*{ œ…®«à>J‰ÃBÖ…O’j,Hµ]¤œTñ†…:&ͧU ÿ2ø,°ˆøØ»ÁÁ)<ë¹Û÷œváG¤]Ó“µo'WWK|s5w$ZǦ$&yQ}Ñcð³~¤FD +¹X{=ôécŸ—ÀùŠ¸ð2=õÙoRðd­UŠ‡ï5ÆQ®Nzî\Î79§Cœ‹…ì8µp¬UõÀó ÄQåcgW,À2ñ3·Ï*—yXoÒöăã–+'8RÀB¢‘¬‹u¯¹§ âh…­£Òéú9`Œ+Waí‘vµ4 ìÙá­Å®êl¾Ü¯#¨$‹ãtçê#F….ò'í¼ú¹=ȉÈËírÜÄd—aaR+ÈÿÅ‚ €þ"½þ‰umõ=`áT¢*¤‡¹ ù:šöÁ&>ÈÍG¨Ôrõ¶ §}³>˜S4¾ü_× sšðtÄDkI»øy¨!=`þÀíÓ2 |Y§púcºvî9ÎEº™ cÜÑðñ´mÛtO;åéSÁà%ݶ?¤áGLðt|ï‡x³aÝù’6pÜ¿lGÀÝ#O~eýBn¬5/&cûzÊf>]žƒÙUþ:Nµ k¼Ÿ×a!ZGúÍs´‘4 Ûk㢚ñ5cÀÿ2‰+UµŠ~qÌü•um½£F¾˜™,M÷JªžR§ %™qä÷±p +Fæk±P¬c>Y9¿Ú.jç8`¡¦ŽZºZNÌ×kçÿ[œjD•²ãwò+¼PaÉUÊÓãP’ÈùØva^R;vdYì%lUjK߯t‘§Q•­s“C·ÎB¶ýŠÆhÝãí±pR u‘]‰.Ñ_äz±ŽX0 dÕy9­©#‰;\sˆÿëú…ìëðÿ?Æ¥N+¨ N•l5¤NGö«ÐRéñæ:Ý­;¤’+ÿ€ Ãû“0ëTó¨¤ òg'é÷`©OÌ×ú‘"çÚVn>˜ØÙà Ýq^§t Jc×aa_¿ð·üHNÒ¯n +ªš5:iÃÂ!9zŒOÖrƒÎˆ~*ç-.ÒªàæÇð â÷´xÝJ¤\Î/ÂBýׯñLüª[§+´^ØIèY縈š®·‘öõ ÅTbñ0è40ÜÚ+˜Ëà:ÈËèä·(›H†X댦k°Ê–=—©|ÝÐ*c¨?è’^zÙO1ÃÕóÎuÓœíl}YfµOxr$Ÿ­—¼¾ ;/ü½pìTõ¶&¦<ò¿XˆÑéb‚¿ ÿ,Zm¤Íg0«m)ƒQ<ɧ€ómXðÓ±$ÉÁîëw^¸锫]yá„…5C´NzÁØu2&uzsÁP¹ švÓŸc$x*7ë{°pJ&è¾Þyç…[ðÂØžf˻՗š¬ë÷ó6ÙÞáÄ]dMkM·Zê£6k€îè‚-Ú-Ò/×:IJ×Uô}X¨O•röõÎ;/ÜÄt?íB,øåèÛ¹T/¼½¢·þ.,ì¼ðWüH þP^……’J¥hûr¸&ÿÚ•"újøö®î€þXX†«°)G©z‚.ýçšÉ/W—ÚõÂßÒ  õ1v9h,2¬è]¢¹ëpø׬i‡XDdµ½"§Ö¼uG6÷B‘Ïí%“n»^ø}^¸ÄĘO O‘w‚Œïg°_c/Íìd[“Ûùû±pt%]Ž…{}4u[ì1[]Ëa²=„_ÕÖ…Eª^XØf]WiÜ1¯×ÝÕq>Z{mVžØ6ÂÕûøÕ¡š×ÔXø‚ÏøN².jÞÜËm'ü áƒ:áÊþ"/œ÷žãØu~!Lt±¯×Â< ÑQ;ú‚¨}Ä*|§_üŒõµhuÇڸ地%†!6gl-Á³´,ª"U}BÄ_Œ^ù²×d:…íÝ ~,Ÿª‹5¤Z®-‘v6•ïhLK€ÍÃê¢!˜o K‘„­<˜­ +X,†Í”.SµeõÀ~I[Å +š{A ü[ÌœÞÚNÂöµ6`w0\-À–JõveÌŽe]R`v½Âæi駀![³.ˆMÐ_Øp¨ºS˜ _°ð´bA0“ø‰VpŽËïñÂÿ$i@¦Çʧšà vÕKwHœ3=ú#ˆ£½ui!;Éi€…¸˜8‚Ó"­“•qÑD>Ú%˜R1vÎ:˜­½×ÀàˆB¯N¯÷,8 Mµ­íãÊuÌ)\««ÜÅ3­‘ÅÖƒ€MÀò ©R-ú§*'ØÌ„zÅB³2­Ka?ù/òÂÿ ~æU!$ü]õ‚©ƒ_w +XȃåÎÖ!6wö  Ó28J#yÆj +j®}rþ†”“G,TÁ5Іiè‘Øá‰G4áBïü˜&‡àâw̼~Õ8Ž¹AÐ&¢ªf›‚½Ÿ<—²”*ñiœðC™+Wæ &rµª\*w¬ YñPzaX±Àú*OÖú0+F¸>UÈî4Î}dq³a¡qÊZ*L’Ž}ýYގбŸx!Ý°°& Vˆ…8|d]½¦9A|…Õ‹&á«Ð·µD"=¶¡›ÖTy\õl’ Ðõ˜¬XÈ)g2Ø÷_ºßˆGz¿×›e¾Ê÷' à£2ù,øá¡êµ^ÐÛbÃì_,)˜…Ô~Uø±ÀÍ’bªû¦ãŠŒ ìæ,¬01á­W¼°a¡”ú4ÎQ&ã|šeÉ ø-ø4Ã*dq»€Yçå‘8f¢GÒ_áBß»U¹üw¢¸¶Á}W§ÿŠ!.[O_Ÿþ8þî·váUzAšc‰ÿ//0g¶ü–¸ØVžô#ðtìë`¾‘ÚêiPTб9i·tö€4̼]GG¡~Ƴ +9b!QË1 +[´Ž2'…t=q.;baQÁ–‹Üå3 ¿±®M»÷Æòø­_°&¶ˆÞˆËÁñ¬‹_¿×þ¬^›‘˜Rd½öMŒIaøäÁ窭º±#&³*Â$LÍÃsvñ½*|¡zL)\mII:Lp“@Ÿha_ìw„Ï™j|¤",ì)°‘ð0±¤ív¿RèˆZÕ9~ +;æ1 |yxƒ°š"X@ @ÆÎ:¿Q‡öi1s³ ;lÿ‚)¶Dƒ¶™´m½Ð£÷m±ÈèC@3g– ¾Î%\PKBb‹™bb­ÔsM‚ÁÞ×À„“X•Õ“oX¤M£•Œa:ý¿bášù…ÌŸSÌ@Wó2¼‘`•hŽé?šð*áu‚«†¡Áæð'o’aÍã˜ð€ÅAà4Ãúù¶;Ø.ËÂ^ñ­ˆ¤åi^78žº&ÈÙâ·†Á?Kf²­JÒ2ã&¿˜ÔÛ®—`"•ïÅ@ß“)vV+U§Jjg„B_B‘¹–¾Ë"WªŒ’â ,žÎœ6á'ÀÂa…«péREµëØ~4FöIŽ)ª•* •­¥Ùÿ —Î;ß(•AÄ.ZÁÝÁÀ~Ñ—³:¢¾ÒDúq½@±–‘ª--æÒÎ-RU±Ë0Õ‹qCîF4“RWÕs)SÂ+ÕV÷v*•Ç_’^‘­ÿ§ýHXyÙk•Q ±ëÀh¤­ãRµ@ôÐ××ÎFy#PIÉ#žjt•«6@,$RQK+ô¢UnB, ˜nuøba_¿p=’˜¬Êjª°ŒBÙ8úä‚C.`x!‚Î ÿ0˜Hš 8a9ÖC?ÔJe Ý*Û,^ĵèsnÚ¡8a¡ì‹…¸øŠ…}ýµí§ýH ¬r~”Ê:Vb@X­X@Õ¸ÌM5küÐŽ°;ú-ö½&ç)²]/ìí×üHwÖv½°·_Ó ;v½ðð¼p[7ñŽ…]/<./î}6¼¹^1ûØ·d¾Î²P+ÙžÏl°í'5zv½°·oÐ û‘=QN™çÀ2õq‘Ë7œ²3ìA9ÉνÑ8­Mì®ööüð‰‰Q¬î½Uœ–R°Öb`£îµÓW9I×Ý-¬/>^ô¼ë…½}/|ˆ…D,ô]ú*ò³&ò«ŒN‰mëÌfúÒçCì°¥Ú’Á§¬ ÁÂF­á%rÍžQ¸)&Gâðà‰Mè±µlö |ÓÄ°c ¿ìzao÷¤fcj]Ç +_E¨[:ŒÆÀø(QJS×ÕŠ’5ËAá”v´ìÁ,:±ÐŽ1ŒòÌå…~”½(ÚZš, +#úÊA…oŽN1éf8 ªÜõÂÞ~”>ö#å8°'u`ñ&¶nŠ]½ $¾1Øbêפì`ѹ®ÚŒ!Ø*Ç¥¸rZ×äêçé-Ї€GpQÇ‚ËO&W*1-Æ/5»^ØÛñB=?…žÙH™I bá€KH0W^À³™Q†,`Ò¼Ô‘n[½³òB:r\“¥¯ìÿ ó´gø•Ò1­°3 X±Ðv!¦o× {»#?R +=³wí2J*œ©«#ÂrGÅÖæNUkÖ©8c®8V¾ XX{, ‰Ñ¦¨^"Q†ê¶K›ÎÌM•‹yëÒ¾I\zFA,`Ö¤êÃN»^ØÛOû‘è‚¢…{©¬tÅÆ ˆ¥¤Sc£¤Q¡ãÎÔ)Èý[XXVèéCÐ ¸ôGJ^cñíK¾Y¬¼TjZïzaowäGòºe–w°ÇGCº,)÷PÒéìÓ¦ˆ\O’â›Ð²4½ÒõŽR/¶…ÿS¨5ç^ä<ÉÓ¼Š2,ØãJ¦2Åä†6)¯ÁžâªûŸù‘v½pçzÁW¿t{¢×€ïzao?íGò5å÷UÏiïzao?Î —¯…½Ñïóÿ3,ìzáôÂðþ®öv{^Pûú…óŸ]/<>/ìX8§ö‰¾1Ë-°°óÂ]ë… hÍ–þYõ:îzá÷ya_×vNëAVåÅÐÆ~XëÍõø”çÞgQ±baªú0¹N*~Ív½°óŸÀ–•©qš«R»Ö– ¹£•1˜£ÎÉÙÇð ½Æ\ÚõÂè…Ýôy›ÁºµÕ¤\8H +]4ÔeX®†­?˜3Sët)å\(½ë…?É »錆ñ‡™t™—ŽÃ?á•VnÁÔ€[±Ví¾q´p´ï•ºÂéô¶^HÊohOgW2ó ý0¢ïÎı^°‡L©]‘ËvÖ[çBÃm4Œ¡%.g«& ¦7Áæ.l­á.M,Œ×F¸:®ÔÅqë7ŒÖ¢Å¿€à… F ÿ0;`gÁ@"®ßD5cMmÛ>¾ oê…Œ*©nþ¿=%sÒZzãÿŸª5{‘GßÐÆ{× Í3±˜*œ‘LdD ‘ÅfáY‡‘m8mÁù`ãLÝÆ:l͸ÈZܺ3ç©8?„­i”ÁÖð nMpÞð_±‘ZÄß° ðvS°. ç”Ø° ëØ™LQ@wwÅ!ÞÔ \‘êæM«S_ÍTtûazz*Šž:€Þÿû·ãß €-<,/_-ï~"^oùÆWÖ‡§m’ß°‘Ji|¢€`ž[G-¦“-¥Û´q”:U`¥Øó“|ª¸ZnßW£§¾ÊU|ûýÏOXK]147nË?·ðÞx¡~»_‹–+¶þ,ÀuuÕ&ð¯Ä¾×ñÜN­ßGýB^Êü”:öz‡š‹Ÿ°}žñB®\ܸ•ÚÞ¹)¦Í›Ýûæm-zôÓXÞL…Ÿ’£‰ôõö¦^àß1ûÿ/äîpó^‘éoã…<‡~ø ,ðBŽ¿oÞºÚ…›ÙÛâAyá°pw~¤äGXAÌýò+X‡·|gãíÌùwôÂÎ ×óÂZ´:) |ù™ö+ó ?ЖnÍ ,ÔAìôÙX¸™釰Pþ.Ò0™„ê˜3Kq¾$Õ7Yù·ë…›ó‚ Eà—é§y!7ÃÏhçäw±PaN@ +ONMp oÒŸþzaue ‹/òBItkÓ¹e,‡6ñœ” cdñ11é7û‘Rö#X£~ cKÃ\º¹KYW.º>ç…:ù^H0¬“,ãðßimvÞß²>†yž›åµ5Íßè8Csºãü*^èíÔ»1u,nm¦ +N 'ÖUMßìGú)í<±æ—±@0IG륂Œ™ïoà Ÿè®G”ßhKWêÿשµ^דÞ9ˆ‰¨¯T˜Ù=v–Ižå¨_Ž´ïñ‚XŒ‚ýÓèeïy÷ÖÌZ{œˆmÈ$.ç…’‚kÒT“[¯‰×i®º¸w&»v¾(ÓÊ¥µ£ÇèF¼ð±^X\,[蜶‹˜{“äéz“ÛWÈŒÿɹö6/0Û)OäX@;~~8sÚ›æçð‚X¨MóȪ‘ó¬Ä8^–|)öK†¯ÞÆO‹hY7⣛ùå¼.KSš F3ˤ“„‘vÑí£øT];wA/š«',ü„^Èd +|@ vìÖx>Lyæ§(‡n7”)>ÙvŠ0¬QÀ×rL×–ÅÙú,^ˆuª=Ù~Ô„`„O æÊ:Fyѳã, ÁÄn=«`G¢g¹=“¨Ix2»*)ˆîADŒÅY.i¼tŒ¥ zÝŽ<ŠHŸF"ŠáËÀy¤p/Ô&FnØ°àµÖp.%œsmÚo÷#䇴sýÛXÐã8àõÇœøëðþŒ^è–8›Üê²â>’R¥•Ä4œÞkí⤬C|¯(_,µX=ÃžÇ |â3`LõEøBQmU6)É,ÀQKàÂÂS©5fùT¨)³–4kc™TÅ™¼`JÎ#Í +¾¤9ìH«.R²"’•fL2*£(#”kgˆ"‹q¯”èyz!•Sã ½+|blg7ßÏ ‘ýí|Ðóïë…`S¸–sÒÇv缞Æ/e’:g~¡u0èƒmêÈÙL'€dä©­m¼µYæ†%Àui¢@)¸1Éù~$¡i?º{l\ªÑtðË,ó”Áõc^ö`„kÜ$‚Þ¶Èü<^°ÊXªtÆL™L*jÁKóvImVFS®Æä¡"A,Pž¤rUïð#ù©+fΤîckÚMÍX¸Ñº6þCÚ™ü®v®ŽÕ…„EŸªx ÑËÚ< Ûÿ®ù…€ C$4KcÙBOŒem±€‹^ø¥¤ôÙÔUŸË «€–MÓÌ ðBæKYÌEI|Òj¤ZÁ Ë•˜2ƨˆa/´çê4Ùã…Û*B¶“T¶âÜè$VÊäu+a›23ºD,VŠE¦…úT;ßݺ¶ÿ‰v>´GÛ¸¬ŒÁÕþEÛBZ^©¯aá ^(€êý2¤jŽ5B[°% ð&ümÛ€ÛáKuj cŸ`á5/õB¿%`að5%Üš>E^¨Ðò® ÃÌhGѲbá\½ “2ãBؾD,dS¦ôýD*£ªJB `!kW, rLÕ5~¤ë°°k絊%_ÇÂ'ó Ô`7]“Ö* X´4<°‡I© köFF—ò ‹@kÄB¶aA’Q¡vg/„ +b–u*ñÜÎ…\€ÒsõB13b—,UykOÔbtf{ŸPª´e„X 43t);)R5òŸâ…aaªþÚù}'{õµèí³â‘ÀÊРf¥O]™P¦oQÙ’PuŒúJöDˆŠzé4è/Ð [:y¡A,”ÔjKõÆ ~Äu¡M¢¥–M" }©?ò#ñu΀‚ê'Y®¬‘UB땵2ÍZe¤–!¸VÔ¨®ýÞ¼XÃò¼p#?RLÿÚùÛÚyñH¢Ã(Ç¡§ö5Œ Q‘‚ZÖ¸„ X¤±Çr1¹Ä¢Ÿ›ÎŸÏ CšcY‘øºà%–Í(f¿tU³ýgÓ[uâ>ªr€YWÓÄÏ›wÎÓãZ×FBð±os.†8æißÃðÏ£6xZ1æü†6ì¤bg‡NëÚÄò˜#=<(®Gªí…Wâ÷â‘øÑÚYÆOOÞæYX#Ìño¾¾gL6Bˆì@̶X,»ûum?§šýš”EZ¤éüX¸&NÕÆWcáŽãT!Gäðln•S«á!þÅ‚¿7?Rg*F)µ9Hí\ç©Ó߃…ë×/ˆòj,Üóú…áÄ&3Ã4…r8ÙHA3>=”ˆ…—ï½ÚâÕÃÛïo6Òg›}¾EÐ΢Q¶%®ËÒ§Z8ŠÙyŠoâ…ÿ×ú^–eÆ_ÛNÿf‚€Öª0Qb@b°Ökjà¬4 3Ì–5RåtIŸZD !‚%1f¤7 û-Ç-b‡átiˆKÒVÑ<`F£±0¡Ö‚}T8àµ=îäV‚±‡ðPb+ÛÖâ4SH¾®ádJœaÉеÌm†1kƒÈ:WùF}#ÄÔ¿‡…mš­'©ÅßYªá:Ö½µ†FŒ²«}ž¯Š–´môÚSZw‡/óB÷ÁU'ßSvê×3–*‰'åR ¸†DG!Ñ®Íóîö‘ `]£m%šVп“þ€p& ‘NÏm‚ÉHðçÅèÔ‹ðCè½e;cèT‰3C°ÅØ'ë¾ÃùÁ +{/ö(Ñ.ˆ\šUÕø€WsÚá¡jŒò^{µf|€}ä蒈Ž0GæD  ‹È xîZQ|'/€v 8mÊf}Ö(UÄ0#EmµN'…SÚ:òýz8k¬Ò¯`“˜è˼"w‚™ þÝkç¬Åü,÷²8]’T®à%-u-Êd‘ULݦëZŸK~²lD4HQ +ù zåþ@R.ÎR;c’<Ÿro\ æÈ¡êo„uéJ"»þ¦œ¯Âäð¢¤2CTÀOYg•!¸¸Žª4ŒŠÂó(q_\v°[‡éäJY’àx5«éߤâgð`%‚GÐU17ða<,¼™0ühX¦á…ÿ©`Gíüæ×þUUÕMßéUM~ &Ëʲ,$¾VtÀˆ$ÆcŒÙ&® +y&ÕÕ»?_/¬­ãžHV¬Ë °FðœJYùRKi—ëxÁà:c ±”2ÆÉ·h±RÁÛ\7Ò¹,¤p¨ÞsÆûì:^`å"8Õ1Jw¬±#ÏZSVp¨ªœ¨Uí‹•g)yקzoó Ùa;çlõ?¤vÞô‚k–(êyÑK§˜]˜¹x,ð/`á2^€+ФrÌ:™õ´öÄ&2.UËs99mëkxAP>‚V29ÈOŠ &sÚîÆuoù‘°Y÷ eÕ.Ð ªªZI¬R0µ ôƒcWK]ôj¨T”Rz•^€uÀx‘J„$°¯ÉK=ªöP:ê6,PÐ #¨ì¢{g¡÷y¼@û–9͹E^°œ§`fòI²”¨br×ó·oGo¤Ï^¦6¸™ÄÇwŒ *«–P9 Á Ú:3º^¤r#|†|а‘ãvB4ª/ï6f;&Éwaá^ˆqta8öv–Ü Õµ¯YêCíè}O©WÍ;ëÎ6õ£.}a)Îìv C,e‘NR½þjRx6ûU}aÞ™XJm &‰9‰ƒé²…ç”Ò®œÌ(®ã…šsœcβµ8=ÒuRû2Ãùd¤íuþ0áË7a¡’ï䜧º.ë çߢ +ú=Ÿºê¨=Œ.…s¶$ãsÏ|žÒ¸‡¦»®‰coîO4cöëXø–vUÕ\*â$ÄuùTÚ.D]Î+ë‰+j9ÚäJĺ6dIå!5¼4¬”ÕÂÜ÷ðÂ;zm¤–0j—–I¤R"…¯ªÄ脧VIg‚Âk]E.Z&À¡ W½¹Ã_æ…êå +.ÑŸ—·6UŸo·×_øzžíI Ÿ™ãFrs¥±d4˜$Qc¬t-ÖQOYªÿ¯ô­~$Ì‚Öm÷õÞŒûi†¹x§ֺjQXË0ëP:©4’ƒH[Þ júU½ÐºXèÝy)¶ë5Ç×ôÂcð s Ÿxa„ÞžŽñ©©MlebÓw¸ ×ðBfCB(5äÏU&å|Ä‚Ihì3šjí½Õ™Jaƒï±‘º·çðÌUO +º:…Ñpè¼,M›š±°¼’Á/²\•|ô­Xè1ÏøÓ!œ†Îl–”Zjy"i<ÆTx+ËI}[^àiû"Ïò?Rd™1Éb´6œG1S^&§Hƒ”fF×%ÄÂ…?¤ø,ÌÝ;Ä m¶Î(HÓRÃ;ÅZJJ¦Z¡•aVæe% “)€‰O.Í%– é·µó÷×kŠ.‰vQæä+1.³Fö®õ‘ë}%±# Íòš>cn˜0Fñ +>¬\W;9-ϺËr eúŠ^O9…û—¿¢UoûÔá®Óëx!‘0lRÌ@ŸÁF¡Xiç,Ÿ9¼•Ðô2^àae3üCß‘XcÖð‰‡IUÎË^‹l]ÿœ•‰Õå¶.:l¿~ýŒù‘–Iíë"ä0E^,|‰¾µ,Å˹¤‹‡3Šäe®üÛÕåyoï·Œâ|b¦å‚çÚTB „iælÉ"£Ó²è1¿øÉJ“‹‚EoúÖ†CùÝXqBá?.çËHi…ór€‡…(Ý»20NR'cUÛkøK:]¿ + +È>_ú¹^@ëiQ‘Ø/FƾŽIßø$JIeUViGÞqá +f¨×Õ[šÎá…ÔÖ!éÊGx”‹XؾJ>@oð‚ˆ‰yÓæ|è‹ljY;A¨à‰Ç…ài´Õ/ð¹hzVY W•[¬ùTE„åâÏÄ#½›7/{Ê}ÀCžñ ûŽÂù–ý ðn™ÅjÈÖÍÄoiç ñÈ‘SJªQJ—RÀBÏ¥ªÒ€…`¡í{蔕³íXß·éëu üs^ø\/  Ër-sø%Q+ÇDIV Å¢VžÙ˜¨%R}L‰‡K<\Ç lºŠNó4 €"³ ba†Û|àû—²JÂiW SK«¦…êXÓEPu°}–͵긦1SEihÇàê#l)§ÂÙJ«Bü™x¤Û¬÷ç‘œÅ/¯_€KÛÒÍâ4˜§Àh’. Í®oàÚW ­hÁ"bä¤ÃÕÜ餥S‰7§Õ57ÏÍä×~]/,ˆE‚m–XV+èµ­ÝŽ}Ôàíìxº¼¸Ú”`¶à +=€–`rŸ„D—|ƒ\À–2:Ÿ0Š€ó¥54ª‰lÄ ûØ’†Œ&`Á÷4+T*5£œ!CkOE¹Èö¦(hÈì¯äSn”+l?öµ ó÷kçô1!ëÒ±uZAÃ?èÎ=(ûBU K1†Íõ™vJ¡”$Ø+}0žÊL¡³B%¨ª€ŸOÏVœÇ $ÄÉõ8$¥T:ôZ"í¥ò|]|F~8^=¿ ð»•E?T‚Ù´cZ›°ªSL¢—¸:Ÿ0Ö(œO9ùÈu8sЈBˆ„#/À¨ÑRÞ‡÷ @`2Õe)(hnôAøB«ì¯äS-È{9\øùÙèUŸÄl»Ÿ˜wž°4M} +:ÅW5ÇšTðPsèn‡±Æ×n×ë̃ù†Ê :j¶Ì×ðŒÛµJœ‡…Oy° ¦a˜—<•HP:2JQE­–¦™Ê«yAàœâI/¨¢‘©ö1b‡âê|^à…ŠŘY¯è\;cÑ€Á$D:/”±†Ô8ŽÅÔùTÚ ¬ܲSª~€…»Ó õ;ã8yòMŸaaž?ƒ‹˜Ûß©uþµyHõ©‰tŽ^p˜/2ä®hÝÀ¨m_oX¨$êý˜«Ü/2e£êÊ«y¡Æüc-3ø¯Æ}2øˆ·aºTùù¼ Êʲ5Ç©ÀPæè°4늯7 4ßñ#½S£ +±hJ©ÊGÐE"–Tš¥¡ úp%ÊëÖ*:ee‹¢*Z l¾¥Š7áÅÿ Îiwd>œ(hsÙ¼óf5áºjq}ÂG±®tDka}ç´mò\lÞ¿)×ïb¡60:[¶TLªs¶ÊN³UE©%o]¾DÀÀ£ÊÁd. HDrâ¢éÿ•g{¹¯8ÕáÃõJñGÿ÷âTïÅFÊÞµ‘j«“„вµeï!ÒªK¸e ŸBq–„`‚ G¢ÝHè;96ç~yL,ÜÛú…ú#»îõBÇ#‰§¬yWaáé¿ZA,§µf]#ãLض3`• “Lk@Èg,%ÎHCì{Q»Q;Ÿo#ý×/ˆl<$Ë[þI¦òF +ˆ?àGª?à–a®Ö&1Æ.ƒŒR1çÖ”Iä&¶4ñIU *åR?÷œYñ×êµý¬^Hз<µŒUð<¶-i»3Û||8 w°~A,UÊàºß"¥¯êù¿9ïŸFòž^`žb1:ÉcU-Ôæ•ëÕe¸6’ ‹¤Šƒb)q9aªT•[™1ú/<*.Ô ÁêÍ:à.̯pð‹ë}NË;æ‘•kÄj¹N +¡U5V6“K›x×;Vü\è˜ý½üHïiçDY,õð’ Ckt,†¶àÂêÖT "¾ð‚VÀF:Ê"mÈ”EÕ{y¶í£Ö¨ºH/,´Áäþ8(ZwçÄ …TþƒÊö¿Ï bn59ð¡‹‹Ö©'"kL:©´é~ zEG³Úà ÉŽÔ·j烊p…Y4ô‘á+D¾e5zÌ‚Fæ|›qÿñSž½W5Š…‹x¡£Þ÷k";ÎCžaœvæ±Éú^yAK¥C£¤¦! RÖË-Õür5“´Lš¤rTKºe"þ÷üHçÆ©žÒX’]’=òÿ¡Ïå¦C[Ÿ`žö “:dˆ¬Ê|§¼U²©¹$ƒj=;µžW[‰˜ea’ûT:WÀ—'q–TÿõZ碸Îõ¼ël—„AGƒTÊnX˜Õx«â^y!3†‹’ÙFE™ 8f-]ª+/ÌX£Äº¨’Óÿ ´ÏT°Kc¶_ŠcÁÿï¼p‘^@,ôªöI3ôÔ÷ © ¸¬ýNy¡4&[ ƒŠøŠž»Íg]^H ´«º®©äÀÓ€þ÷xáŒ3Wð,⟠îÂÏ`Øç°<ȆU;û£v^Ôx·¼ÐÉC½H$˜- b‘vHxåÒ€°‘2 S%AU«t‘éô#}XßY¼õdzœÚ]\÷¸H|*Äh§]/ø5 v¬tk…ëëHßZ9Ÿª/¿W^‹¡­¥Ksƒ¢Ì¸¶ za˜¤é%åÈ …+8¥ñô#½o㾦˜ǧ5j;ü¦¹í“)=¾·º›î°FÕ=é…"l9µÚCÈçDNºe¸ü¿µ÷;¿ †¸í>D³Xò50obR\À{3³Vm´p0D5|¬þÉ·þüHÉûËo´µE™›¹,Ì”uÖ!²ÈZ6ÌzKcEã”,¼‚– Ór›÷sŽ?ì¼óEz!Ñﮥ²¸ßùL³¾ …§ø +‘•«c}UͲmÔÛº–?§B­ó·W¶QY JÏ”•fh`Y$I'õ,¸¨j”fj%ïUÛQ0Ç:ún8Ò´]oûÞò ö³”›OõNüHïÖkã‘.¤Ú§ŠRÎ)ãI{0ù «ÚT¾¥%>ÉÝÄ(¯Ó÷ö&¦‡S½pýBþ^A¶"; w›OõOÇ©ÖïžzÒ° ü<Ö Å  ò2Ó×-iÊÅìbb9é;ÕÄ(ÇÇIJçÙþýõ ßìGÊ*y˜¦qâ“”–/²mÓð!,d‹¬J‹¼ÐÈ(ËF—2ÀBAßÍÀëÇÄÂÿ­þÂ=òÂëµý£ux¡ªìƒ?µ£ì-N¨ rÚNª«òV +M'Á$Xx¯ÊÏãú‘öú ³®mÉ×R!ýøºf'o•vé䔀t˜­¤ ¡ffJRÚÕ½"å*%f ö„…Pô{´s=Üv^x½°ÖkƒRíôr1’È&L{0ÃçðÀEÍzx5ðTD¦Ú/&L… RxO !ëÁéë ¶guyr~3,$–5wƒ…]/<ŒÉYY– —Î)Ö¼ä±f<Ú–´ò*ëç[ɺ§^ìƒVJÉ<ènø/UX¿ÞÄF¢NééN°°ë…?Ä )i?ü`%x¦–á`é.¤©ˆkű¥Eç\Õ\Ó,}z=Óõ\w½°óÂE~$®Ðúis¡©Š¿ˆHåâ¢5 +â9z?(÷­­ªï ;/ü?Räæúƒ–MÙj ’ÌËüL<‡±A˧y;XéßÖ<}ÚH2N÷í±U¡1çtuM“òù·dÙõÂÎ —ØHš~ø1–˜´3pÂœ¤Jž"Šx+Áäg<‹í¿Ì Šöà Õ6½sy•ëbÍòPÀ{·Ð NVÂßEÛõÂŸÑ \uKçhuó˜vÊ–1Ï0+ëU˜"ÅÊŽòr«ÇµVÞ)³%!6_s"„ ð­rŠø&l$Ù¤•$Ñ)3ÈMëµÕTöw‚„]/ü!?R+“7(ŸÕ¤, "Š±Í³ª.’NóŽÆŒ\4­F¿kŠ¹}f Ò"b,Né+²4&í¡[Ò¸cí ZÅ&NóD¼.RuŸjÄ÷ù….æúYñ½ì™ì,4‹ Z:Õ„i- u +sˆRFå|†©¾¡ +³$i•D1£­£:V <i¢tºÐ©öõ ;/ü®)ýÌ<¯_Ŧ6"TÅæe/—Vk2*’ID͸Ì/w£Ÿò¤¥žÉ%I‹n‹ E«†2Âw³],èÌú¢ºmý XØõÂ_ñ#ùI$pü¼^[ÀBËclêÔ,ÑÖÍ1]xC',Ý›i³G ô‚˜¬´ý’b!¢²†¿3Ä‚£I1!'ÀÂ3^Í’¼Ç#í¼ðK~$®>«[ßÄ/±0,ÌXcL1b^4^§jÆB\ =“‰ÒÎ'")Æé Q0¥1~[ó ”óA‘…¾Â& +yd,ì¼p÷z!ÿ|«ä¥4£„Aœ©tYↀ9÷®(gP fñ‘åL—žQÐØå"û–¢jéÕXæ.äøÒFMÄ »^ø#~$ûi©îë‚tšCÆ`T%ãlå…‘ki@Ï’Ù–±3¹´>®¤¡vÙx¡WÒ¨6[¨ìÄKíìw½°óÂ/òÂÁ—ÐB°‘øÓÜqZµñœ‰)_ÄBÄm¼1U-–n‹*1öm +’·ÕÀGØhŽxKó>çBŒUÁÿ~¤]/ü ?R«’Ï6鞯¾,tÏåCHm°†[ðS*Lx°¬I‡¯²cLQ¿½7ÄòezÙ䑱°ó½û‘>\x•C’§”ü+¿·Ò[¼Æ«]=ºvÞyáÎýHÅ9£ÓËüH¸@çFíÅ®À~_Ãå÷Ùf·óÂÐ g¥üƒÄÁ×,\xoW_Ôθ4èN[ºóÂÝû‘²5‡í'­\~¦}Q;‹fnî´e;/Ü=/äêAü¾XëüžÛÎ wïG2úŒäG° Fyxd,ì¼p×~¤éóÉ…pB? +bj‡v^ø%?ù|rá_íü}í‹Úyç…®ÆB¦ôY{ú)í\>4v^¸g?RìΚòŸÒÎÉCcaç…{æCýaAÌôÈXØyáŽýHg?c#‰ƒžw^ØyáWüHŸ®ùÿiíüÅ5ž;/ì¼p¥TKvæžê];ï¼ðÐzargfÉiçÇö©î¼p¿~$r®‰ôbíÿw屇žkÛyányA|’-ïÇõ‚8¬%v^Øyá‡ýH‘[î û¼óÎ ¿ãGJ,={OÉ®w^x`?ÒèξT/ò#í¼°ó£é"Ï®Òѽ_ys× ;/ü}?ÒÙ“ p>ð/dñÈXØyáNy!½dTÊ~F. _¬u¾óÂÎ ×ø‘ì%Gø)í¼Ç©î¼ðó~$îºówÚy÷©î¼ð¨~¤ &¼¯ÔÏÌ;Ï•xd,ì¼p—z¡¶ì‚ñâgæ|íÿÎ wéG:œ·æÿØ~jçcç„Ùyá.y–÷£~¤×Î;/Ü£I¸KL¤Ÿš_Øçw^øy?Ò™kþO›ËŸÑÎÕåI†¿†…îÑtarv>þмóE9ç§rç…¾Š…Eå—íégô‚†Kj‘ ÅÃÂÎ wèGº ,o;¡PFçô ²ð€W"<𧇷6䯶~µÍ³­/ÒÎõXþ-,ì¼p¼PKvÙŽ²8‚žšâCÃCÑ ‹˜ªyY† +®ÇðÐÁçbQ„%w:œ0¨`Ã1[O ÂÖaÃ(ÇáC‡­/ó©.ãÎ ;/|Í4¹ ­‹H鲬[Äfe]IQ&©šËrPyRrÚ%¥]]f”Ôe¢M[S^&‘Zà.¸u‘”MØZVIYZ†ZØ°¢n•I,Åe~¤C¶óÂÎ _ò#š\¶£’ãmLð¡ÄK]Ÿ|†ÖV°mÂCÂÖ§m¶Wõ‹­ËÓ“ÓÖ ¿Ð§Ê›?……îÎÄUwßÝæl,Ôiö—°°óÂÝé…ø’°¼»Æ‚^õ&1Ük[v^¸C?RM­,ÔÓ ‡Xm•»ÓÿäÎ wÈ ÅÝ8\ƒÑL/¯›Nï³µóÂú‘ˆòƒ…¤¨_`¡½ÓŸ«îÐ$ÉaÁÓ‹ëFî ;/|/”É™XxÃFÊÕòHX¨‹dç…ÿ3/°êøjì.Å‚5þ‘°àÅð//$Ùw´u°Í²äZ,ì¼ð ¼p8]Df.ô#]´æÿ/`!yF /”Åô ­ÀÉúæ0Mcr%v^¸/dqJÈâKx*³ç–ä~¢2¾Œ"5<üÔ¼æ…lþŽ³xN'>eWbaç…ñÂà(1táNÚ˜õ^Qm\>JÙ_äGª)ó†…zzÍ Ùôgµ| ;/܈—{OÛ3ëÊã"Mc<1—ù‘ +wx,$â8T-¯yá±°dÙaç…ßæ÷^ëLM¨k4ûA,Àÿ½±¤>×F"*y,眳ÓÃ÷óáÐø+±°óÂxa@_¨f™: /Ôê„…˜4ÎÄÂâˆ,øùhÎÍñ—|ª;/ÜL/D>“݆â…ú?Rç–ÇÁBv¬¼X¦õOñ—°°óÂÍxªKñ’:§“ üH`ráíÜûÒ v^øé…¼ŠjŸ`È>¨Å „ùàË<¯Ï÷# =ÊãÔByø1^(˲¾ ;/ÜŠÜÅWî?‘þ‘°à‡£Å7.?Ä Ãaš×εí¼p#^XÌp9^ÚH‰$……rÜÆèrú!^Øçî"érj~…Ñ…?LJµþÀüÂ>ïü>/ñ ñHçÛH/Fž‹×üß=’c¯és^¿#4oþò\ÛïñBr3÷á¼ Š&?à ×`á/,ß1Nü.üÄŸÃÆ Éw„æMä œk›ë+±ps^ÀxÜWRþm^H,i¾r§ØÜxkš/ gðŸøum‡~œcà³ÿÿ­_ J)™¿:Pù„…§«HÒW¢!—p”S[ó„…ÔM\r¡]5½T)ø÷´W÷ìP/-ÕzvVÑ8WŽEñóY™¿l‘t4ÿzœvÏþ’õbÁÏGÅPðÿ/X&©»çÁ(¾5èh§·dϯÂB#˜:î¨Uýñ%qmÿ¢Ñ€7s^q?1»ÞŸWÿÿ“Nç·®ùïÅnóˆ…“•Oÿ;^`x[_ê…H=xÏhÀ‚)eWž:åd¹ OΩš_,¦MÚacH™~Ž^p¶e®ŸŠ±(Æq{œ m^¶Y:Û|½§ÒÓÃ…%Úþ +|q´§ÄÿÏxaNó<]Îð#ÕRuצÛ)ezËôʧÊÓEÆÏô"£½pñì¿ä-½p{?ÒÁʼn…1 £ßó`¼=¿PG·ZÙû|~áµOµ‹8?Û£*†-÷YüÆüBbécaáh kUÕc¹çGúÉyç×1œ_4ÕƱ‰ß™wŽþÄâ…³±PÎO|°u®†Þ5-IýÝ|ª™ªŠNµ AuªîÚFzt^øKùT[ùPñHKñúÅ v½°óÂ{6Ò‹‘gréu;J-µô'þ7ó%ÚyÌ^îv^8ËFº¼fá±UŽýHÓî’úÎ^眵ªö|ªÿ/^ˆtû9º WIÕ¥©.ªuþ´’ NùÎ ÿ?^H#²®èyXx5ò\;RT?”Ui¾ŒÖàÔ ¦þ¼ÐK_7¾Ão”âS,¼Îƒaè•Xø™ªâó…¼PÛÙjUí¼ðâ…H*뀅ˆJ³\äG²…ÍuX¸O^À¤µ­éav^ø?ñ'´ÉU XHUÊ[Ê/ñ#áåÑ×aá>y!Ä ­£GH¿óÂÿJ/€R(ò‚f^)~j#]™OõnyÁ7ÇTÉ˲óÂÿM/œ°`©6Ú¤baº*Æýò©Ix±óÂÿŠz +ÖQà…Ö×'íx¦ šÕWaá^yá©v!.ÍßyáÿåGB^@½«´¬>.²óV]žÔÍ×`á^yÁûñ¥ +Ä°óÂÿK/X_Hœ8“2½Ð„7 º wË Oµ çyç…ÿ/$¥¯3Ÿà^>Kàöf}gc‹’âH ÓÎ {<Ò%6XXóX¸_^xÊÕµU_Ž…;æ…§ZUƒø˜JªœRNÖýúK#éœz·6Wÿ9FÝÎ Ž—W;¿k^xª]˜Œc!SŠ1ëìûcA&évhߪwg23Ò¾ÆBñq%¼îl]ÛÖ.Ïpß¼à›æ¤…ÈÇXÀ_.]v²¹á²Š‘u +2v²âá@5šõ,ʘ´ë’ê¢;ÄGGOQt }¸Ä™vö°óÂßY×vÂss1&Ÿkõ /Ð$™Tè-µsɵ›éDèzDíV³rVNêí2èÅj]HÜúáÖ B’NâÕÄpíÎ Ì„†@ÿX¼°#ùOçÁFÂÌ¢a›ÑéLÐdq4×Bƒ£Yñ:· W/r¤u±bÁ,<`aã-œgòÖ#ÉÎ M/`×Î.ÅÂ]óÃ&>ö#• œÍ6Üw˜9¬éÓHHˆëC'_oERú,²k‚çöi•8Ù¤ßú5U(ìj]ízáïù‘pøM/ÅÂ}ó‚‡óxáI)Å®Â|¤hý×Iʨ³I ˆõV´*E’¥{8™$V,¬çuâèéz«âM¤î•ü¥9ª>™w~Žèèiä‚kt’&›Ö—Ü©œ»Hõ]‡úÂÑ´uýs,l¼P[gÆU«%ešþœéò¾}÷¼€¯?ç…Rڧ߃r ápI«”Ú^‚¢F—QÒc’òµvG]ÁëuR‚¨|ëÅëü‚UV9ì³E~h$í¼pŸ~$ô·TbáÎyÁó´þœ<>2'ãá8Ñã$Å6‹]O ¬y±†'ǺeÙZ6”Êd<^aQˆþœ }‡ôB,Ü;/¬%I~:NUž=Fì¼p¯z¬Ûñ±xaÍ<ÿÓqª=I.ÁÂÎ ÷çGº8Ày¼ÐV'›âÝ(‡6ÿ&^¨G±¯kÛyá +^ðýES çñB~ôÔæm¿‰|vØ×;ï¼p¹éÒ4ÃñÂXTýৢ‹³Š¾Z<£8úgiÔû¡êá@YÜVp&EßÙj†¿—¨¾5/„ZU—òÂÒ·m_M¯zSõÏ-—›`aç…;ô#¡z6aá}^02êmÒ+⎵­IpPÎÊTƒìsÕ”åŒúˆÆ•‹S™xbnÏ ¨.å…b­ôú²ËØ~ìüõ';/Ü­)m¿ /Š±äví5ñjô™äAŒ4p«+{˜zšå¼]Ø:Z•Ð"“ÅÍõÞ¦òR^(œYšÖ§ÚrÈÒàOMWÒj_¬)‹ëÞéõ:fé1‰ñ´4©¸ ;/Ü¥^ðå%e;>â 6&•õ b!2+¸o¥±Æ”µVr +\÷¾jsú z!”$¹˜4Fé…‰³Ögví³Fjw ÌpkhÆ`“Ó:äRùqž¶þŠÉ_–àC^¨/,Ô +”`!ðÂ, Ì{1ÐÅ ™^èÁâ0ííýHá>ñ‹yFÝ‚GœZ×3Øõn[gRTU¦ çcÀÂS/™r†”—baç…ûäP‡Ûð‚êˆ-[ê «áîŽ*)´öWmQ$¢ÕìºÔ:žÊ®Ç¸+³oáÏ/5ìÇ 4_±@^èãÊk\jºÆÝeJƱtÙŠqaÝyá^ýHþ¢ñ‚f„L¾€N¥¾ç^TIÝcßá=ô©‘°>ñ!y5øˆµÕèßUÎ_æ…‹kÎŽÇ Šc<ö ø´a!Za†|³ Î>î¼pÇ~$ŒKÎÎÇÂ~¤ /x9ÒÈ/xq1žÆr,ÂBvÄB¾b!‘²öq¾ÚHò +,ì¼pŸ~$œb¨ÎÇÂû¼@.ì¶ÔÉ7ñÂ>Uó/¨ÛÖofð^µšR*£¶Î²=™»p9ÔÎ ÷¬ÐSr ^H.Í0“}t¡¿Š…ËxahŸŽ“¶›“9^ÓÂÄmâ‹6hªº2mø•¹1!5€OÚª¾ ;/Ü©é’4×Ʃ&y4.Éxq¦Ÿæ…Ÿk;/Ü7/”g¢—¯ýaºZ$¿üBÿ,/ü0v^¸W?ÖAÌÎíÛñB¢Y•8¿°-zÙyaç…»ö#ášßè\,\Ä RQ2+5½h¤Þyaç…_ñ#ùó§.ä…Ì°Ò´‹LZ› {AÆÊv^ø½p~¢¤Kõ‚&Þô‹,­é{k/¹Ð;/ì¼ð~$ ЫÎÄBr ¸1„‘ nÈÎ ;/ü/œ›àb^` µ¬½ÄFÚyaç…ßñ#áÏ)ÎÃÂe¼Àˆ×•Él3¬“Øyaç…_ò#è”9 —ñBYú2ñYí뢨/ºÐ;/ì¼ð;~¤ssüüH;/ì¼ðE, g­Îúù‘v^ØyáK~$”¹ö,,ì¼°ó£ó‚/ÎÉð/$é…¡wå臗ÇÅÎ ;/Ü‹éÌoñBÌ.Ä êþe®{n;/ì¼p'~$ÞüèÁ×5O|¶da "cEŒàøW'Kø&çˆ^â}Z“]‹¶É_•ÔÜyaç…ßó#á+ÎÀÂ?¼k_kc‹Þ0L‚y’ +][0¦Yx|n´éü µ!É ’Žxx›Æ~1šéÔ—tÚyaç…{Ñ Þ[sþáC±Œ ;ûT.²É”ÅÐ ¬ñQ{²t®¨*¯sÅ™I2ÚsUãeŸÄÖVNx§HµóÂÎ ÷âG:+À¼`+Ÿà"~žwLÖ$Š åý³“4Ýð_{ç¢Ø¨ +„aD¼ˆðþoyí¶Ý=»Í¥iš¶ówÓ­1ÆÎïÇŒ1—T¨<ÝEê3>úUÇÞ/¢t’¦á0Øv\@.<ΘÉð/\/4´Š+eù xElÎFºýDÎtÕº4óør—§¹õXÆFðÂê„:î^{äráQêH){væ¤ø_ÛHU,`Í¡´ÈöµÒ`ªždúh›TŽX™å¥ï¥ædãÂê ak­³ÿ·‘ È…O¬#3Ìð_¸0ØÈ}…ìXMiDÊã6ëDºw^¾¯1SŽ¦Q#=µfU¦gÆ¥6’)òÐÂú_îŒ\@.|b)³þ¤þÇ…‚º4išñ%õÃσ½k“šD[¯<¹ÍhfˆyS¦)ÄÁT¦‰ÇÕDT¡¹€\xœ|! ‰*.æBìß »ñí«-%Ž–«"r¹ð8u$8‘Ÿ +½¿]wù[}”owù39i×(óÿ¥ñÈä§ráäØO¹ð3êH§ÇørýTxD/ ¾ŽÛÓã÷â‚P¤|{q­â//4:¨þðh^@.||¢¯~ãcÉQO7ÿÔÛN­3ØŽÌC®ÙžœÙ~O.:ÍÏÙËÇòráñëHpØTÐñ•¾ém¢Ùë~ýÕO U# r!vÕ[b:«î¡V÷U•U°ßäº7Ðvÿ?ßÌ@+\@.\VG:¥áNù´çÎïÏ xÁ½y„¿>2 ÿýÿ´¾ù½“¬2åËS¯¾%šóÞ–säÂÕ‘N×\ïTGzgMõy~g©éÛo {u»)÷ÞÄe†–âó“Æ©î÷¸e1ÓUäyùùå^8Í…•>·ê¦·:‰±¹ðam¤S^¸Óõ…›ÕT³ç×ùõX8ÆÙØiÅËQ7ô÷I‹%q€½bûdn± Ùå^8Í…õ¥ÿ|ÿÖeCÏnÀ…ÁyP&Ü´~þŸèÛç Á…î^}0ŒÓ|¿³2.¹¬ +΂¯Ë`;’ï.¢¡Û2š*ãqÎ¥ÉkðBuÔaoyMy‹zíÇò/œÁ]ÄléYïóØ´l‘Yê¥O³DòŒ0ØowŽNqÁê~ìûYuQg{áûב¾N›ÎÁÑÉ¢môzUtÕiÎs­©é¦íĪ] ñÑ…¢ 6y„°Ÿ²0Dª=¼Dœï…s¸PG­¬ õLi[:J<å¥R¾°ÊºG¢™Õcº{äý\°{ŒñŽ/4MÅ ? Y`irçF§‡‹ŠÆ<°²„üªÑÛ9ÒøÐ7$¨^{!+i˜¢áÜl^ycOßxÀ àgÚ§6RŠëRUFû]éÎE›cþF\ØîÓËòH”×ÃwæÂêHߎ 9Dy£h®)Íál ^Hó™oùÂ>Õ9pa‰SppV*#<ß½°Mþl«Í 2¶gÁy6&]U¥#Ú9§[“Øãljf°Ìën‘/0M=uæ¼`*%Áõ7æ‚F.üà }:<ÊZ)nÀ x¡|ñBL^Áñä….l^ éòÇæq™ÎàB/d»z8Uçyžu峜±¾¯¬» ˜jÛ67>hì!$Œïá‚,Ku¤/Ç… +ÚHñ1½Bš‡;qÁ®"ØW\ ëÞFš;õš u,…h²'/Œ7çáBž»«›_^`Žk½÷7₊‘PÆX?_ÏYÛ¶§I!1_x(.LéøÂQN=D®<¨ >ng~ +*ÕER§à‚äi±ÛÁÒn©Dÿa\t_:?:%K*ŸÛHÞ·LÝ6_8l\SÀåÝÕ\k NMR¨Ë¿EýÓ‚Õ(^-bé³¹`|Êë~Š¾ùy^øW¾à¼c±Ö2uö3tx²¼5m9|ì¨Ãl¼œ x_ÛçÂ//˜á«¸P¤#7Ä5(ðŠƒzÞ G“¼àÀ#uÖT›æ0Þœ U'ïàƒXÊ#äêÊ"pAAÄò*ŽyA¼ÕFÊ©I‡qÈ~¶·#é¢6ÖžRØØ¿½€\ø¾\8<µ‘ÜF‚{l^Ð6ÝÿéÀ °’±ÀÀ3€@‰Öb÷BuÁ^žË¦ŠÂo©9?˜Êv½Îj°Èøtž¼P¤?)ñ&a@v{#Ýÿ=¹€u¤«v}]šƒºU³ +¢.~IGŽPEXŸŠšL)|pªUqΩu/8ºçrJ™H7^Â{wŽÒ1MÜ’Ç‘R;Å,õ§D ù»¹ ôXNzŒ¿{¡«)àÀ¼øv\À:Ò¹¿iâë‹Ï}8¾.9>­àÏßö±¸¾°6>Ý—ÿ\ç4üÜ Êžö:l{nÒ<Äiøx?p¦(òÚ~?.`é*‘púÎßì’ƒ{Ùugé¯,í4š_{Á—„µt¥!Ùo›pÝaë¶(%æ ?• þųÓ}€ê<^è…³û#5cßï7ëH(g¹ðE¹ð1^Àq¶±Ž„\@.` ¹€\À:r¹€ùr¹€u$är¹€\@.` ¹€\À:r¹€u$äróärëHÈär¹€\À:r¹€u$ärëHÈäæ ÈäÖ‘ ŸÄ…õ‚ÐÕíßE. >‚ ³¸¹ÚW\ž°[ÙW^‡F”·ý2XGú¡\Ðᾞ½ÐXúrÏŸ¢m~keþñëH÷‰˜õGqÁTÙ¨0÷úLŇXÙ=z)ػȅŸÄ…¯.¾~€&ñàùBEÕ}D—ÄÔYŽ{°:’á÷¯ù•”!PÊ…; ¹€zØ:Ò×ñr¹ð±u$äráësá§y¹€\@/  o·‘?Ì Èär¹€\xÛ XGB. "Ö‘Í #û +ÝŒ ëWüôÅ÷ä‚®gÔŪoæ…ìøõ>ýqüž\@]©yá«ê;r…^¸§— sºRÇü¦¯ûñ×oÇL‚Q÷­¿ô +…\@¡ (r…B. PÈ +¹€B!P(ä +…\@¡ (r…B. PÈ +¹€B!P(ä +…\@¡Ð 1C/ îì—?¦,zu_9ý˜RÚÿDz‘> +stream +xÚ`Ÿÿxxx«««£££555hhhøøøºººíííñññ´´´ÂÂÂééé&&&õõõ“““üüüÚÚÚƒƒƒ›››‹‹‹ÞÞÞÉÉÉÒÒÒ×××[[[PPPAAAÌÌÌåååÿÿÿÄ=endstream +endobj +5707 0 obj << +/D [5705 0 R /XYZ 85.039 781.388 null] >> endobj -1806 0 obj << -/D [5631 0 R /XYZ 85.039 761.463 null] +5708 0 obj << +/D [5705 0 R /XYZ 85.039 692.384 null] >> endobj -5634 0 obj << -/D [5631 0 R /XYZ 85.039 741.134 null] +5709 0 obj << +/D [5705 0 R /XYZ 85.039 692.384 null] >> endobj -1810 0 obj << -/D [5631 0 R /XYZ 85.039 711.349 null] +5710 0 obj << +/D [5705 0 R /XYZ 270.549 428.615 null] >> endobj -5635 0 obj << -/D [5631 0 R /XYZ 85.039 684.734 null] +1558 0 obj << +/D [5705 0 R /XYZ 85.039 384.321 null] >> endobj -5630 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R >> -/ProcSet [ /PDF /Text ] +5711 0 obj << +/D [5705 0 R /XYZ 85.039 350.181 null] >> endobj -5638 0 obj << -/Length 3694 -/Filter /FlateDecode ->> -stream -xÚ­kÛ6òûþŠ…¿œ ÔZ‘õ8 Ò´i4é^v\Ñ­lk×jeÉ•älößw$EÛ²SÜAVÔp4çM‹ëþ‰ëL‡‘ʯÓL„*Ë®WÛ«èúf¾½caPÎW÷W7¯’øZDaå×÷#ÆZ]߯ -^~÷âöþ›÷ó…R*y8_¤i¼üp;ÁCoß¿~wÿúÝ·øPnqú‡÷óL÷ŒôúÝ8ýâíW/øM…Ñü—û7WßÜ;NÀUŽlþyõÓ/Ñõ¶ôæ* -Už]?Á8 -Lo¯€ÏPÇʼ×WwWÿq¤x.¾æ¯¦¤¢UêLŠEiO,BæaœÇשTa%$—b·««U1Tmsó±Y‡«ý®_ìÚ~èW]µæ éh«+žÌtdžÛç_oß|ÿk?À§»ªyüõ¡ª‡²CÑܼ>+‹$”)ð«0Q)qò#J¹ÝÏRË)ȸ® ‚¦,´æé¡eèSW % ^%Iü \’ƒŒpíóñI-Â$M¯“4Óäoœ’ -U¬'Ïhai-GRƒZHéVD¾@d'Œ¥:LñÏ0fh}†1˜Œ@'|Æðáv(øŽ=3«$蜎ÿf-­ËÌ*‡ |ì3ûs$â3ÊعÔF ~E]µûÚhÒYàtˆ=nsû%•  B‹€ñ$c›bàN]O_ôÈ^¥¡òzZ3—ƒ!+uÜÎae°´»‹™(é hæFÏuÐY&¶-"œ3¯ÄΛ’ûf.s°™â÷€5”D"Fí -ç׮̗„ -Öû3k5v­ÒØÈâ`…À§ÚnëÏit w´Ûè`›t(*"ØnšÂžÌ}õØ (¡ÃØ"¨¨~ý<Ïâà <’,èwUVv׶ÐÛ}ÏP'UóA[úô¡Á]ER²L>4³âïj—‹jmÞ÷öàË1¿˜Øèïí·Y µÝ|«(Xµ»ªìÍË®cëÁsˆ€eH‘Àöün÷…ãr ŠAKWK– ÌD|܈båK+â§I±DÍ„ÓN@´¯ÍJ‡TœÊã41ÖE]—fù¢÷÷©i›O¤ªSÈyÙO%)RŠ¥á&–@’¥Ü²%F ( ©Œ)Þìû–7Nn8Vô7,TáÍ|U4†‹§ -ƒC,yG)/±ºµÁ^âž…´– ÕƒyÖfóPFêàŒËü…1*T' øgo_¿…e¾á—VØYé"h%?ÆN<æþ8ÙA %ÿj´öØáÌBâÎÄçw"“$X Ð@F¼ÿÓ˜˜%¡P6$.ÐŒóÕx±iñ“õbß Uý%ºŠf]¢¢56¤cSç#3H(¬‡ QÈÜMÅûIüáÝMOS-ýÁS¿é‹í’°'Ó ª…!jüoÐ%ûŸg-MÂ$J ‘ŸL4Œÿ…ãüeªíA6̵WzãQ†+ÔðÓÄUCÛ¼µß.ÃUÛþ–oÈ–ßU=äv`ïìhÒàÇy>É%5”ÅE¦,Î S‡-:¨»±Mè3$vG ?ªÔs¤,ùm]}™)ôŠøtÅAå¶êA¸Wz¯ÿ5b@ÔÅVäë#©mRRƒ>±í<÷®üðÁ¬¹âˆÔ);P#.©„T±¦2¦g+|MfŒy"ºWÈSýäg*£d\ïx*™ðþM5ÊŠ_óÄz¬ý8RpG —}ÚT+dwc0Û3E$”7}µ­êME$ ÐÍâ,óƒ¶Fºx(úMÕ6~½ Ø_Ý}½øþök~±NÖÔÕ± ü-Û<BM:¶«2Ï1s| €¤gtsÀ ýljK‡=›uùPP;lÏ™ÌÓŠ–ËFæ!72‹4ad.=¶&§, ü3V9²8'Z˜Ô{-L¥ù±…©,uƬ€w ¡„ÄùA_ÖÍiœs†üÐäÌ4g¹kK×79„X“ËÌM‘w 6§­‘À`†:9Ú[²vö5Ç´9}ÜJ5¤8ñô¢ÀŒéi}ÆôôQÞ`RuÐÌ0K@Z’Ä~Ò਌šö¤ßŠËkj"¾kg<²šÌ[ÀA -öw•[Câ,ÒÏ(÷ˆtA¹ r?{[|2ŠÝsù§£hvÂC…©—y08'<fàŠ!™;àÕYfG½’ñfNýù„ 1p¾ú©¢ÔÎx¿excÛJ]ú:˜)ì ž ;2KXƒèŽf -jb”xg4\ça*³îÊØÍÖ\þ°GõÇT)–\}ùVÊr½wÀ’¢ZMynÏ^ºrìmù¦ëS­! hH¹0Š@vü¦‰Â U»ÝÕåP®Ï\“„•ÐqmùÅ1˜C*ðlú8v®åµ˜¸õl8Ó™¢jËÚV}dÎ8n¨'™c_° 'vóúëù‚Òa2‘Ùûp§kø5<åÄŽÓ¤8è‡ÊÒð:¿ämÑIZÐSf„ÃzÍÑÊ.?™uQò8xr+ÙûŸÔ•¿—®£[ºúh¾HÀ‹ÝYØ0pÒÄ”“Ž·`5l2\öÑ|Ë϶ÕKŠ4ic|,b: ê왺‹’ì¢æ‹ jM É$þÃÝÐ"¡ÑíMWÄ6úIël#>ß„P…!žZeî¢øž»¼RJÌ„m„K ¾¸î[3³¦ÍÀöÌjR•Ï±ç¨v†ÙÞÇ• kà²ûл®ÿ̬`ï: Ý+©Ð­‹³ˆ{ëu¸Ên6Æš3V›*¾ÜmôpÎב"V¡‡e¤4e$d:‹•)’;c¾ë<ӺȒC9_ -)C-¹ÿù -•…l[™Ôí¦{6¶›Kwv&Æò-) -ôÃP[4dÊ£b–x;Œ¶éB/MInÊQŒm¼´çÀí’sÁÁ¬‚ˆà´ê³[‹t˜ŸùE”ÅYxH,¤øèŠ.IGÉÜÒ§'+ª8„ -çâ‚ŒrºÞá•mêL¬‡MYåµ$={m¯ÖŒàÕ)øJA]™º ‚Lå_íJ(ŠÇ¢j0 !Ö¬®˜˜—sÎx --ú妤ˆ÷ƒPCñù½³¢ý'†,Í­Ž;sãÀäÔÃÌ(øÍ/³”ù5‰¿ÉßfSöi1ÍÂ,Ë/Ÿôˆsþ  ÎgÎùÒj昛:eo1Se‡<щcþÝÔ<Œulñ¬7W¡¤Sd¿Ñ?"ÄÔ£†y¯å7;'øDƒÓ»,w‡r^ìŒò©_XÊýh¥)™+MËa¸ódŸÒæ¤øSÆÙÿ,~/Šzâ»Ì+¼éC¨•½o‡gº‚äòSò€ÿleÿ×ï'Ç© -3uF•5D),/¸c©õ1¿öw–' ÿF£&endstream +1562 0 obj << +/D [5705 0 R /XYZ 85.039 171.355 null] +>> endobj +5712 0 obj << +/D [5705 0 R /XYZ 85.039 110.469 null] +>> endobj +5704 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F66 4190 0 R /F62 4047 0 R /F20 2961 0 R >> +/XObject << /Im26 5703 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] +>> endobj +5716 0 obj << +/Length 3158 +/Filter /FlateDecode +>> +stream +xÚ­Z[sÛ¸~÷¯Ðø¥T'¢y¿dŸ¼Înª4õªŽ<ÉÌvh‘–¸K‘*IÅëßsI”Ü™v2ÀÁÁÁÁ¹|°;qàŸ;IBÛñÓIœ¸¶Ÿ$“ÕöÊ™¬aäã•+3!™4?.¯n~£‰ëØ©“N–ÏŸÐB²Ìµîþv»Xþô0ù¾o¹©=ÅqbÝ=.¦®õ…{óûåüþ#~ÐéZ þåašøÖ’‰æ÷Ãðí?~¼å/ßv¦¿-?]ý´Ô’j@ªÅü÷Õ¯¿9“¶ôéʱý4™¼@Û±]Þ^œvøò]]}¹ú§fÅcÁ„gi%ô;LüSµ¸áˆZBÇ€Ô’µÅtæ%ŽuûånŽ-kÎßÿrܶX~»Öª©§0Úge Ýe½†î8µöÌw­vÆ¿U±ê³§JxîZ"¥yÜÓì §/äÑá„wП:Ö6Ûí¡E\ræÝ7< Ç` šÛ–Y/ÜÈ·éú/«¶$¶Âkq÷Ï3sQo)m´i§³À,<ÐOŸ¹½ÂÅší6«s–'ðc뚊¸ßÒÈÚuÑs›Åà]-RèY c«…ÌΉð;ö©®óa¬ÌªfÝÉmVwíMî +–G«¬ÙÕuSÏú Þfpháë5* +Ã:D}š}ß+ÅcW†íœ‰sÖ +@¡_ð«FϪʮ—yϨœ¤Æν:ÐB ÊÂ]Q‘l«ÞVò{±í¤,?ø8Ÿ¥Ö +Ä¡FÕd(fâY/%­Òì{ÍHů2‡mR4LË—H\w2›Î)É?p-»’þç¶ÙŽ0þJFž³ÐbtˆÐ¹_òxÙñoË[¢­“J‡0Á9²³=y`-ŠÎ[!ân}HÐÞðÊhõ{¦‘€=g-7E+c¥943þyÑ«áñ¸yS<÷07Dv„2÷ Ý™¢­ÆX9xÁ¾…fÕ£¿£sù±o§I0t³±x[‘“I”Ó¡óÀÊp™ˆ,LbGžyœ‘c'øXî-‘ÐpµCãÛëKZ“ïxËhß“©JT¶FY»|æßWòÙ= µgCÜaù+´òMë" jÎœHþLì‘û« +–}±E rdœyAh{`¤Á¤Rn{œ©©Qu ·ºf«Ü¾(¥À‘ûì®…vÂØ弃DÏ”IEÙ*íáJŒ¿Ÿñ\i|ÿçÍãýüÛ;æð²ACL`÷DFáûwmÁ*3—Sá–_òÿ^v¢`†¯0ò(K/4ƒ0€‘)EøVM™z›UÕ+S²6²AOð1Ð1ºÀâû4 A˜!åæLú$ €¦m„ÔŒÖ@¾¶¸Ò|q¨:a^[ûÿ.øC²ÜµZë½D×²Ï Ê0íÈ‹.¢cƒ†ÂŽ£®¢UiÆží±™NlXÒEõ‡Ž>?ÖyAΟúå¤(¶j +6çĔŽ¿Hðû÷¤%h|;·áâN4ÉY<‹à×u"Pøs +ZVѱqºÖ_PÙq>¶ +,HgÙKzæÙd7ÐyÍí±ÃƒîC<Ø ¿šù”„š eë‚IYj±ø@Y¬f¹‘±;¤Ôµ thdÁA§šA\B· +繧ñʇ£$¢?ur'`AŽc=…2nw³5gì#Á[*"í­ÐÉôȃøa9qm˜Â‘ðWÎç}2—yCHe•=Q!Â#yñ½\)ª:.„¾ÒÓ î‰bCXÁøè{5 KÈwˆ¹áÈüEí€Xï´£š0_¸‘ß·åצC3œ±Zº1Ü»Ü „ ÀÕÔ/”%Àwh $ées€œõªÚÓ)ÑK9(p+û +CÙ«tYO G•R8{Ätiñ#ˆG¦\¨D31ý>Ìœ¦¨g‰£¸e%úÃœ•ÇrŽ…ù§¬ã(J° ¬hd tü$E(A{¦!ýg2TÏ>½"»Ž9BügŠ¶`“+óÈøÁ= m²9Á yÙs1¡òK@ðBåˆÀjÀþ[5›JŠÓc­$Á&ë;ª&sÞòÇõT"ß"aÌßÒK›fÅs×4%k‡Âãš‹qËñŸ3l˜pÚÎL×ýS.±Œ¨¥8É sHzMxäqEù|H➯‚ˆKM +ÇîàÊ-@à‹gùú‚ ˜”™sÿ_Wû +©?£ÕÝ8„ZsCô1&ð‚„Õ[ Ͼ¨ªNš’³±}tQˆ£û é^;öŽ-¿l4BßœÎ)Ú±0Ýí81­ÔžÑzà#p}ëÂw—Ñ80Ô×ÜOE8ÈHJ~›õ‘bÜ7Hß‘ +wƒéåLx)‚r£0åD”kà%‘ +±7±ê;æEÞ‰ Ì„†2xœÆÓ˜ï{(d­tÈÀX†î!7–:íÈ †Ž¤ah¬ªR€qGÀ6!L͇"‚-öuAŒU(O¦Åº”6¢Ô€‹xçÀÉg ÓM‡:eÌ,Õ´ +Ò$¸ÊEyÏ|‚·–̤3y`éÁÑS‚¤ÜÿœÁ¥+ÉÔ0˜w=‡7K™)˜¶¤Ö6ët.!µ”P‰x›õçÀ®¿žwù*Ø 9 vý .{&Úõþh÷+™qNó^ºs{.îe 9‹w}/´c'ð®†/*1$ÚjS].²¥3„ñ! ä<ÚýW +ôr ®#Þw„šB¬0uõ´^ŽŸX=ËÒ¼Ôõªi‹kîz#ÅÑ­)var®åJòÔm$í7Ûí” ‚( ÒÁ }=\úŘåC÷SøæKOhÈIÜ‘v÷Ëïï7ß×?pDÐ÷8ƒOr ‚Íq#òéÆnófÅI‚—>÷0]â…ðm)Ñ^˜ f‹œXð&R>«cP"vkÕáí½J-•ÄìëГ7ü ¯â…}Ë‘/ªdr-¤ +%AWÇaãIS"uVÞH7ïϸ‘vÝÈ !7 +\óÎÈqmÈHš_DºñÉõ£/&T4'+º‡—Žží»ÞÁŠœMšP6Á_þÑx©gûB]µè`  ã ŠÊ5À =(ÿ`0n¹{¾•*4ᇋÓ,Ò´V µùPmlÌ;»5O5³“ù\„c|±NÛBÛ¬NSÿ‰%9TY/é Óy†F$ÃìéáI#j¤ ídhvx¥öÃ9ƒqÛãÂÄ ¹`0Bô¦Á\Xp0˜£Ç ÆX‘ Æ Ø`<Ö‹'IZTÙf•Œ­VÍžû(ž¯¥›+fŸÞƒÊªROyØ%WpöÞñË@W¥¼¬ÎçIS¸îéd j¢]ÖuC=⟔ÈÔUpc×õÍnüq¸cS¯å‚Ü×ËyI` O`å°)É8riÖký¸ˆ××5³Ñ@¢0,ŽîÐ?ŽN×ÐÁÄs;Žã·Ÿt}Û‹ÇtgŠ×Ì`vj~àÛ°QAÕ¬Ypíq\(ž¾ø‰Eêzûþ—åOïGîÀñêÌUD½ªêQü —È5kÏíMF §':~pð"Î=|¡lé.çåúô¦“}øwdÿ¤@­yÍŒ®_QáG,^;A•×Ó¥V(¢·bÅ¥u¬8^q4V˜+5äqqGÀFÕ3à¡Fà‰¾°ãÀO@/§—hnxáýÈZ¯«â"‚:}ÐädæEf}¯b¹*¡áUøð›†ñž€‰ßãOcÆQA©^VbrE0PÛIØ;|‘§pN¤Þ-Ûû‚íÝ“Ç`;Thä⧈êl ò"¹R†_õ—mSq‡Ž¨Ð>¼rÀönsLí%¤Ë2¿k4)32ÈFôƒ/:Fmw”ƒ ô5¼âãéž-Ï{Üvá?/ú?ýá‹v9„‰ÆþCϳ=WÉ‚›ôÂðX^õ2'ÿ¯±Ì+endstream endobj -5637 0 obj << +5715 0 obj << /Type /Page -/Contents 5638 0 R -/Resources 5636 0 R +/Contents 5716 0 R +/Resources 5714 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5629 0 R +/Parent 5701 0 R +/Annots [ 5718 0 R ] >> endobj -5639 0 obj << -/D [5637 0 R /XYZ 85.039 781.388 null] +5718 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [117.472 665.485 291.281 678.387] +/Subtype/Link/A<> >> endobj -1814 0 obj << -/D [5637 0 R /XYZ 85.039 511.561 null] +5717 0 obj << +/D [5715 0 R /XYZ 85.039 781.388 null] >> endobj -5640 0 obj << -/D [5637 0 R /XYZ 85.039 482.763 null] +1566 0 obj << +/D [5715 0 R /XYZ 85.039 597.626 null] >> endobj -1818 0 obj << -/D [5637 0 R /XYZ 85.039 400.118 null] +5719 0 obj << +/D [5715 0 R /XYZ 85.039 565.205 null] >> endobj -5641 0 obj << -/D [5637 0 R /XYZ 85.039 379.224 null] +1570 0 obj << +/D [5715 0 R /XYZ 85.039 385.228 null] >> endobj -1822 0 obj << -/D [5637 0 R /XYZ 85.039 154.341 null] ->> endobj -5642 0 obj << -/D [5637 0 R /XYZ 85.039 136.075 null] +5720 0 obj << +/D [5715 0 R /XYZ 85.039 352.807 null] >> endobj -5636 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F14 2895 0 R >> +5714 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F58 3360 0 R /F62 4047 0 R /F20 2961 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5645 0 obj << -/Length 1956 +5723 0 obj << +/Length 3344 /Filter /FlateDecode >> stream -xÚ¥XëÛ6 ÿž¿ÂË6Ìfõ°l¯†>×°ë­Í°]8±/1Û©íÜí€ýñ#EùuMÒvCq•DSÅÇT¸ãÃ?îDóeì„g2Šœu1ó |ùyÆ-‡gY¼Ï“åìâ…V÷YìÇÎòf0Hg™¾uŸ¾||½|þzáI)]³…†‘ûô÷ëwßõúõåÕòòêg\) r÷÷küüêõ"’î’˜.¯†Ï}ò˜V’ù‹wË_fÏ—½¦½ UŒj~˜½}ç;)\é—™Ïd9w0÷‡ÏÅ ôd’v½›½™ýÖ‹¢oÊ¡]Ǭ¢„f"ÄIÀ"}ú8Ä,ˆõÑã|Çã¾Ï´Ô'å˜]>È¡YÇ>•ãq.˜äÂñ´T,ªwV(ÎYè,ÎC¦cá„B0…þo]U`Þváq7{h׎]똅F¤óÁáÌWq,‰e47ú÷2„‹Ë‚;Ï*PÔ™èJb½A®Q•G£¸âf± -kÁˆª^– ODÛnAå¼Á…v×I“9ÙíhRµÛ¬¦i‘”`†O÷D@fs_\ì"rkV¶y¹ñêl—ôÖH‰g]¸Að%mˆø§ø»ü=n7V3ŽÄÈ!›ÎIp^’0Åå1óï*…;ßíQ û™Äˆ)®1Š+JzÀ´GÝÍ1…ìLâÚ­"„Û›ù|t:&k­VPTCˆÌÏ(Ó9€ÓΤ³¡eÌ7e5"Áe;>ÜHsðÏ=ÍÌYèÎê°K(neè[îÞlQÖmF à0h‘—ú<8t§¢™×þÀvg6µ’šÊ3<·%¸·*i¼G‹T(Ã~èüØWnØà Q!gì(ëþG#Rð8t¼}þ;²x"˜’0ú 0à¾k°wäë>…? í+¸idœ˜Î5ƒHÀö ðÝ_!ËH>©µû´BG¨Í¡NLåèÜòdk_0Éóê <Á&¬zA$YÌ©þ\Þ@Jˆ½¡7aþG×Bò‰Ød$|n+S;¶ è–üÜ E›d=€DÊÅlS˜${ŒÇ/¸Îìþ­Ì÷)¸×}ø‘†õa4ùs¢¬õž…Ýh²c»?NU“ÎM}Uîr›•¨œìî]Óª»DŸAJ©‘c - q ìž8îŒÄú=­ü¶&ío –ßYA-AG‹ÐiÖÛ¼»(âÚ.ôÉh‰+9 - #R*Žµ4„i@•€^‡5@ûöÚŽæìG´¨ Ñ ¾íŒt kä$¤Q2Ú(’pQv“¥ìDX2b"PgÃzÄÓgbRéIXc¡V¢ÏºNÅîÆÙR‡-M0œqÄ`&o’4]%ÓÏû…ô]Š°¡A{sê>p¶Χéˆçtšª8b¶ïx»|Eö|òœÆg¯®ž¿;¡€ -£_O*0â9mP¥% ùc‘5è¥5çSÌêÎ‚Õ ËE,ܺ2eq…Y”1†ðÇNù¿;嬺Ï{ɘ¨°™9Àš -Lé¥"MDW¶#a_W+XíLØID,n–»¦%&ÓUÙ Õ¡EŒ:´tdu3eá@bJ,´#ì°È:‘¨‡ößÈ«ä<Æ+ÜÁ,¦e’ï:øÃœÝÙžð¥!Ä¡5¢”éLU5}É—ȸµ²)K}@¾Æc¶ÄCüÖ.ÄQTµPú®»óí"Ðn2Ƥ¶šàCß4@ÿP­ú}‚ßxã‹râåú`%¡ w•"àÞ»¥ñ¯¯i¼ÈÚõ”ŽÆü—²uUÞЗh8²õ›#fþÄ MR¬’‹¦X}æçæ=šÓÅ'áíiêMÌÅ)ºÑ™ ÆP²7õY3&í¶¡UbÇúf)ËŸCù›„&pv¡ià½kÞñÃ.›f *é‚wE\¸™Ù·7 |Wœa™u:a)Â]¨tº1¹gï:6ü]ÞbÐE~¯™mT1ž0'eÜÅŽQ/OÍaÚCÁAÕ*zw¤´îJ9ÇnaÓ̉š—´-¡¥=јtmK?ÒMa·µÞ†Qè>3 óå¹Áìª7™]BÌ‚* .=Á»m› œ˜j3EVÂÉ(Á‘ƒì_7yU6Dé‘Íl«­¤C÷úŠ ½Üæ–·1ý É°¤yù.OM+GÄÄv8/¬å?MSã¦ÂW#`}–4]ëj˜-¹Î’4A dê¢éþ¿ SiSKˆ(b‚*²p ׄ]X&{×}ç÷ѧ±XÄQ17 tåszÞn¶&Ê~:réGžyË/d"ÝÓàd!ñœ~>¥(×]îrû|€n¦Î¦Í>!L£§1ñ­ms‘•mÒæ'_Ý!gµxN—]!ð—$þå}Š€·JŸ/ü#žÓöâ1gaMí%¬½^VØÄÝM-!ËÝ÷4¿zÃÂâ¥AKzßךG±ùñîœÖ#žÓvãðƧÚÛÞ°ü¼Ï»{ãpj6ùyaö2Û4´aZOƒÏ Îd¨¿Ü@Òg">v>üQ.ÿ¯Ÿ=‡®T²HÆÇ/Á;]ð -"ÐõÅg <Æ?Vø_¿3$¬endstream +xÚ¥ËrÛFò®¯Px1X%b1xÃ{HÙ²7vl9ZK.¥*É"  ŠQåç·_3IP>l¹lÎôô4zzú=VçüQçq`;^rÅÊöâø|Y9ç+XùéL ÆBP#œ··gÿúOž+ÇNœäüöa Ø~àßf¿Y—Þ\ß¾ÿ:_xžg©Äž/¢(¶.¿]Ï•uÃÐ믿Ü~üòÎ|*ëÛ5.ÿòu{Ö-#}ü2,¿¹zû†gžíÌÿ¸ýùìý­áÔð\%Èæ_g¿ýáœgp¤ŸÏÛKâóŒ[Áru|Úïɼ<»9û¯!Åkþ9ïš’ŠÆXÀÉ7xYr¡²ýÐ3’saÕ·=?K.pìÀñIrHÄø‰uWÔY3÷”µ›/”ÕÁÙÓ(+o«$R#<-yá&oŸòv„ù»8w·7ð£Y©, ×ÀË)åuÏ;OˆÕíDE/tÀ¡ƒª`BE”k‡«Èíº ~\«Ëûí‡ÊªÒ¹YÏ<¹Ÿ/`’3RóÀÀùÜðÊÇ õÜM¬>G`‹g¢õ¼½oi£i*«ÙR)ä ò÷œbp‘×K ¨¬#g‹ ´þHÓ2÷·Í½Pæå<°¾ÂçAœÅÖS\5õ… ²[(Т€dQÑ~ÂêçrF´™0°î`~‹s å{‰Uç„›ÁÌwP* +Ž\ó,åŸ +e¸E¶ú¢Çß,ÇE2$ lt®ñ›M×£‘8[T‡MÏ”2ä¸xš“D:&BB!‘Õ´,sáEŒ¿í¶æÏôëŽL°eY°úîÕøø~B皃hSy8xýŽÏ7îxVVüî(/o…/nˆ3† Ö#¬jèî2}÷eg##>Ëo:Mšd†Ô‹jP¨¦Ëµý°/ßÂ{.–4 [~{»DY¯…Tm„¨YH;}[ŒÐõ)êKQrÒ؇‹ž6º0Œm¥^öË#ã]” Z£ }׎|wä]”¥ÐÅŽuM×ÍÆObð®-žè¶q—YõŠ'âsp8ûľ¦ÎÅý\¡9¤jÊš1Ò2Ýv, œUiýÌ#t?´»¹/q½:åwBß±ýï‰`À9éwB'¶pæìw[mž’7x$±r¼GMI{ž²x§_nyáHk^;2úÊV„†Ä†!ʯ6ŠÊ¤¯ôwvp k­Y׈ۥQYXOù‡T}µfªmÑ=N˜Üy1/5÷‘Mߌ1Â"i=ü’phCduÏ{ۊ׊‡Šc÷ÁfAëtX®›žƒ¹”¨Ïc~Rí_”Ö“Ø¡Ùåe¹èÅËçÚzàZo4 +pÑêmf0!ˆ’¸±ÒÕû4ãAFÆ1fŸ jÞlI>´>ôú9ÏzßÌBSù̴ଠ‘k¶o+„Jœ0ŽBiµ)µ”ÃV¯‘®/?ó€ýÒH¶§‚š?Öç㣯é¤qr…ßnÏŠž­)°´k¶¨ªÏ´—Ýê{IØåƒjs¼­õÑ}6¼'GrÏ<ÝêèÁ§"¾“iš¶Ã'I± (‚àÓ'»u.Xšï;{â ï—HYñǵŒáÑV€÷²NŒ¥ZíqÁøšÐE(›œ)í—ò*˜¤e'tZ1kÌNîµJ:D“TÀ|ö¶ÜÊMÃìfÙæ’°¢E’öÅwyÚ¯gúëü›ê­¶ø ØQbqŸvE÷£†»‘íˆ4qÙÑå(B•¹/¬HLuÞ¦ø Òf€²AAF/ÈÖVɳ>g &Ó ¢pÃtHCJ ‡ÀǺA»Z(5üËŠ1hïJÉ)>óä8'»˜Ð‡|0jüDŸX“I“Ó b1Êgž .†ŸôIðµqä8òˆb!c‹iP à÷³X¯ÐWKjÓ!í• pŠŠCDXke}MÚªƒŽi<~`µ ¦ššnFBSŽ,—(š"¥^l­Cúk×(ò†ï÷fœõ›~Ø=(Ókt‘Ž º°ŠÁo²f8=ÌÅßû{y°·ïªX¶MY¨œÞ6ýš7ŠëÜøó±©ì )0Æ]£Àå eƬá߃F@$FöC¯ë‚¸óŽjçÂ>]Ðy”<‚[7A~¿m6ÄzoßÒ~àãRSqÚOzàñüðe÷?Â9éþ]ø oÏý{âþ/¿Áäúæµô5ÙÝÏñ+T‰U±4]Ѿ¡.i>ûñ¿nìÙ^øra„sÒ¯»2·û­£ž‰Ÿ$Ô“ƒŸ‰|ÁÇ‘›î2ð1éËuW`N3")mÜuÍß]0cÓŽDõåàWÒ¾=‡Y9 ÊW©ÖúM51_Õqȇ6ºC#£ð*ß/„ßáF3ì´6’ zjÈØ’ýZB»wĨ\ˆl¯ºPTlX –$.ѵðƒÌჸCpXš€3lwAí!#®4É=;é*%æ÷¦N!DIá&{L€k…†7Ì:Ý„#Ävc4ëof`ÃcbPw4ˆÔ#4R§N‡³Ú¾ë–Ç*– ²È¹ÏÈ>‘l˜Ê× }ºŽ‡)þHÍÛ>•"a›!³ÌB¹ +ˆ\ÑÉDjt,TDS¼Ä}úµ qk{Õ.¥ËA8Ýçm˜üõ#?ÂœêÏ.ku +ä„ÔVÒú‘˜µ6ÿkKÙ†É*1F·X9èÏSÝÙä¯o®xЯ©Ä€ÑnË»kÛNgè ó®d,<¤<± +íØñ“÷Dš’…4ã5㶟ŒWÊíc'z]Ò×%Ë‘>d/úåSÉ£¤©ì±‹Ö$vÅð2$I®ð5<Ó©”ÏjÜ¢ç<ÀîcÛ Ý‡Üì½OÉÆu£Ø·JÑ«GÆõËþvQ¬xÔåwË;UŒïTòðÇSqJÞ¡–Â[Ùõêû(Åö:ÜX‹b,Ge6ØDÒ|6¥¸ Ƹ¦«> endobj -5646 0 obj << -/D [5644 0 R /XYZ 85.039 781.388 null] +5724 0 obj << +/D [5722 0 R /XYZ 85.039 781.388 null] >> endobj -1826 0 obj << -/D [5644 0 R /XYZ 85.039 613.806 null] +1574 0 obj << +/D [5722 0 R /XYZ 85.039 761.463 null] >> endobj -5647 0 obj << -/D [5644 0 R /XYZ 85.039 595.137 null] +5725 0 obj << +/D [5722 0 R /XYZ 85.039 736.114 null] >> endobj -1830 0 obj << -/D [5644 0 R /XYZ 85.039 538.254 null] +1578 0 obj << +/D [5722 0 R /XYZ 85.039 668.118 null] >> endobj -5648 0 obj << -/D [5644 0 R /XYZ 85.039 508.85 null] +5726 0 obj << +/D [5722 0 R /XYZ 85.039 633.372 null] >> endobj -1834 0 obj << -/D [5644 0 R /XYZ 85.039 478.924 null] +1582 0 obj << +/D [5722 0 R /XYZ 85.039 444.292 null] >> endobj -5649 0 obj << -/D [5644 0 R /XYZ 85.039 452.915 null] +5727 0 obj << +/D [5722 0 R /XYZ 85.039 407.425 null] >> endobj -1838 0 obj << -/D [5644 0 R /XYZ 85.039 252.806 null] +1586 0 obj << +/D [5722 0 R /XYZ 85.039 310.462 null] >> endobj -5650 0 obj << -/D [5644 0 R /XYZ 85.039 234.54 null] +5728 0 obj << +/D [5722 0 R /XYZ 85.039 276.323 null] >> endobj -1842 0 obj << -/D [5644 0 R /XYZ 85.039 202.998 null] +1590 0 obj << +/D [5722 0 R /XYZ 85.039 139.318 null] >> endobj -5651 0 obj << -/D [5644 0 R /XYZ 85.039 182.408 null] +5729 0 obj << +/D [5722 0 R /XYZ 85.039 104.572 null] >> endobj -1846 0 obj << -/D [5644 0 R /XYZ 85.039 153.191 null] +5721 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5652 0 obj << -/D [5644 0 R /XYZ 85.039 132.6 null] +5732 0 obj << +/Length 3028 +/Filter /FlateDecode +>> +stream +xÚ¥ÛrÛ¸õÝ_áñt&Ԍż³}Ê®³YojW•îv²y EÊæš"U’Š×ýúž@È¢”‡NÆ#àà炃scÔ¹ÿÔy¹^'©rƒ4=_mμóXùp¦c.(s ç‡åÙÛŸ¢ø\ynæeçËõxNä†Qp¾,¾8?þün±|ÿi6‚ÀQ™;›'Iêüøy1SÎCŸ®o—×·pP9Ÿ¸üO³4p–Œt};.¿»ùáÏ×›}]þrö~i85<W²ùŸ³/_½óDúåÌsƒ,=†±ç*XÞœŸn2¯ÏîÎþiŽâµðœwMi% +R7JƒCµ¨hB-‘çF^Hji›²ÿÝ‹è# A¢äñ}çyæ'N.“>¯ +ÝÏæ/gså¬Aþ¶+/q!t†Ç’1Þ­AÂ9Ÿà)o¬gø··8HpS­º¶o×O¸¯í‡»UWÖVÀŒ»êÚ ›y'G4­`=5È$"=#å¯ô5W¨ÎŒäZ@Bg…ùð{• ÍÜüÂZ@VóûªFfkqÛÜ ‰¸éA‘—8K’*Š,;Ü¢ƒ±0èƒ+&ŽèE©…+x µÝµ^5ê‚ñ µâS@Vâ±]s´îWó‚K3¥iŠ‘SõzÉq-vúj³­5jìt´7ïÛ†·®ÛNXƒ+¢þW°¤4Ý#‡[oîóêê#À꼫ò[µ„+:›¥®Û-ìÜÐMÐ ¼çc5 ±¾"þk%ìÜ.Ç£Ÿ5}Иã#¯Œ\ã­-|D²Ç  ÿm æUë;âÈÉþe#£!]X+ÏȶâЩIFEˆLœ¦=cÁmÖ¿ª~—×<¾Ñ¢jEZUͪÞúúdï  c¾zÜ×­´ #KÀHP”ûÔÆñ):4 Ûx»K¾ë%…† ¥ã†QBäK ‹0ô¤‰Vµ ÉÅ:ÃÎ&!¯¥`œµŽÃ]_ʾF˜ Ëié‹ +%ya„jàu2€ßªdØâéÏ OŸè„&Jc¬ÙÏÈR`ówOÄž4&ÐÇ“\ê·‚xú÷ù‘Ì)ˆÅ•ÈŠM‰³e›l·µ¬â!9²¬™D *‘_<0y+6Š¦×¨le¯/ëÐÏk­mÂŒËØsŸ^êlÑîîëªä9 á‰ãÅ#ZbÜËØ E,`¶í +h¥¯0uŒÕ£\AäüÌWe.g4Æ@Ã/LèQž°¨ Îî4F]æ£7xÅÓEQá^ðÊ®)F×y€ûoêï—S~M2|§ZsþðBmÇY?°Æ›²cx+Èyÿ7c–Âìÿ`ð+^¯`Þ’ß½¸œ ¶Ò§‰CqVˆóÄ+b{á~|Ý;«3ïº^»Grž8H\“ž£ù›…C‰Š«¡„±•¨Ä^â&AJŠ„” eaæÜ•Åb’û8-ÿ«¹c·¶ngG·à¤)e|E ÏMÝæÅ1 ¼ÐÍÂïH0âMµ¢8sÓ ! 0· +ÓDÜ÷m!¤Û¼‡ +€Ãœ "l)|¨Œ±²“—€Nt××/¼ò„ +Ûb{*Ê ÆÇÕ³ÇǦ1ä2åÖ¸`€¯êÊDaC¯bo§_î;tšæèv2÷Ò/öbÈ7¨™{rl„fŽÙO–ÒPŒ?eKÕ®E^0œ .8…~ß4omÑñ“A™.˜ÖªmÆ«h@`rD©DL8³ …nµÙ3×äƒÚîI¿‰!'›l›ž÷âû>”[ï¢Ñ|=8©ÈuFÚ€=ÎSܸs“›ÂŽM9ì_!C¶Õ JÁ8u¾g_ðÙ”2ŠÉ%=¼wí¾‘;9Ôø‹|;”psÝðA]™×•d %r ˆÇý¬’+v!]/x´£ö€‡@îzÒg$Ï¥qŽôHÈa6hò8êÊ:J!Dáiôks‡$Rç>ËI#8f +4!uçtSŸUµ&•¡À\s|‘RP¾%'݆…cŸr3T‘qðšÜÐOlǧ¬Ñ¢ÈsV»mŸE¿ÁK¥l;Ñ 6Oðà¥+~æz@Q‰!¥ xÀ—#R„i$ƒ“RX8G_ù®ŸrɹH"iFzBk–o…1pq¨ŒQÌ£ŒÞºɆ +Þ oÐÈ%•]×Y7ÊiÀåq%&iè­ë•d;Q¦K|Át4Ø~ÃïÛä°>áP ª°ºÜ[[éD¨|~|[_I°à ÊE˜ ´<Ó.4T/¾Øçþå+Ó2šÌ;WÅià|*7¥}&ŤD¯„‡ýýÄ•¬Ì2+I— +¶dÂ{íÈvä9s(Þï´­¤ʉ…JÓ–kŸ1óÝ8ÒWXþ™¯¦ÄôðÀ¾ í50X +¨óBjìôÚ¼óA ]ŠþãÀõ|e{ó&ß”’~TRYUCÏj@èz ï5O+¶ícõ“Z¡1 up +ƒÉ á¯Ë²=/n¶úT&Òç÷ºwkî†:b‚RWâÙv£ÔdÒ°ÐWuHú¡F"Q^øD$äDÔ 4_–YÏ'v/+Ÿ±"òW̱†¼sþ‹LæHêsMµ”𘱎áÔ€ +ÆmÇ´¾ã]cïkßáüH ƒKhÓJah%,=æ‚–óœÀn/” +?kþÍ ¾­fJ-hTº©Ó9šbâ…'s4 ‡r´PÙOßSn œFBªð’×ô”»)¼¹S5ÎÅ}g£|7PþÅJ2í~'9]Ûé'$%ipGMŠGëmµºåÝÇŠZù @óè,Œv'Ù=ç¿Sm”¹±ŸVíˆsBµ‚ô]Õž 8ªöÅiÕZO¨öžÒPÓmÚjc3…•ô¬¶FØù¦WRKeÕŠoãŒ;öRóû£:|7òNá³pNèX¾«ãG¿¢8­c‹b%ÝÞžœç°¦áéØÌ•4t05H—/aKOŽx ÷<¾^,d3j{è**•¥ðM¹^Ú™/ØÖ••?è;Õ|K¹í^•î€€—>§\ÌÜùa%cLŽ›S^P×,%®2!ÄùI¡Ós½”kÙŸ­>þ¾½äXø“RòºÐÓÕ=Œš0¡ïÜ./yÑ÷> endobj -5643 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> -/XObject << /Im1 3957 0 R >> +5733 0 obj << +/D [5731 0 R /XYZ 85.039 781.388 null] +>> endobj +1594 0 obj << +/D [5731 0 R /XYZ 85.039 637.099 null] +>> endobj +5734 0 obj << +/D [5731 0 R /XYZ 85.039 594.146 null] +>> endobj +1598 0 obj << +/D [5731 0 R /XYZ 85.039 511.197 null] +>> endobj +5735 0 obj << +/D [5731 0 R /XYZ 85.039 477.057 null] +>> endobj +1602 0 obj << +/D [5731 0 R /XYZ 85.039 146.508 null] +>> endobj +5736 0 obj << +/D [5731 0 R /XYZ 85.039 109.641 null] +>> endobj +5730 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5655 0 obj << -/Length 2594 +5739 0 obj << +/Length 1779 /Filter /FlateDecode >> stream -xÚ½kÛÆñûý -õú!`Q»ËåëP°]'q;WßA‘%Q{©p©Ê‡þù΋©ãÝ^Qø`îÎÎî^ãòO¦IàÝ2ÒÛ÷§å—ï^½äYà«éo·?^¼¹í8íx®Rdó‹_~S“ˆôã…òƒ4™a¬| Ë» àÓm óíÅÍÅߺ£xÍNxטVZŒH–šðiÍEÚ·QÐiÎÀªõ¡æ´6~ Í$•*Kªƒ3Ia¡M=W{û=H­¼¼ÄɪM|~Lzû±¶cü(`Vù‰ -žf6ˆüTë³ÚOÃpÀ¬ ýXì,ÌjO#Ç¡ò®kd°lW}æ£Ø[×ÕŽG¯?øú†'MÅߟ w…»ªi ½£cxÖ4Ùr“¯x‡—M^»ÇÄ7oMú´„'’P‡=Gî$T¡¯Ã”$ünšX˜·*õšb—ÃH+âܪ¤Ù€ 9ãýqÈ -Ó \UÉÀ¬†IAðܽ˜I¼M5…ÿŒpãêÀ//+y²§­%®7(=ÜÀ¨Ç¸I"?cYÖe([àÃFȘœ(9pÂ#*|jbO„ÃÃ&àÊW:7ßé˜>Sy=ÂzS” -Ñu= Š|È›î;¼›l‡'.2ð¨(Ž½÷U½Ë¶ÛûVɤmímAÿ€¶Ì¶<'u¦A¢|9T=¬^þ\àROVmHÄŠÍ$Lé>S1Üpæê/#l'¾MBYÿ×È ­¬;fÓSÏP™—¢t*LXé–òÈN²Å;‘DÞÔ£¥p²ªÊ¼Ö=?bô|…ãØ«j†í”Õ ×ÖÌ[†/³Å6ß ÒÔ[¦¨‚7t\¦AŠÏ]ù¬íÀir9—.4|VTÁé¡\j Ð&¯‘é0`ó¡¥q‚®€Çܼî6bäJÐÊV|å™XïICHbÏÜ—S @†A:¿ÛT®Á²ü«ka¨: ÝøN¿Ž‚ªÎ„Ñù…Xèíð²Ú3v,ã®KZÙÁòÕ%cüª´í(#cV'ÞK¡ÓÅĤHäŸÍ¸%UQ@"M0Qv—,û äCã»}ÃðŽÑÜÝ÷ÞŸ ^LC ±¼ËË•ñþY‹=P™Â’U²íLÄ>Cõ9^ÌJ1dÕt!«fˆã Ë];²^™¤-™ ýÿŒ „Š9f×݆ô%AñqŽ:í#F™÷‚¨êGÏVÔƒ#¯ Û÷ã¡ZCíG¡­ºÝb,‚ß@’Á(¿ªP¹CW¼.ÝæHyŽˆ-mÄËÄàçh®(õÞ6¼ä6^Uz$bKñ„î>®e‚r¿ÛÒ£x'§U#š1ðFÅQ|ò=·¯ªíˆ.,dªÅ;nŠ%ÚwÃ'‹°-Û"óÏ…“aF/5Û@ÈꉌÅC7É?“–‡&[«) _5¹XH‚ˆ¶ýÔe :þζü}Üôçw#m1a0öWõñs=Ã?@+åŒ]W†ø¨Py±Q¼ü - èôJYú_C&zŠ ø+/ÿ¯/ßøJ ‡þÙ9ýkpQE©a„ïò…PÎŒ¾2Bt™•Uùÿ"–ïÝr‹´èï ´¢àdÄÎJ::æ*ƒmšf/>õ- ¨ßž-d´2=EüB*´¼±€›(ټݯžE -ŠH/‰ÂèË”ö”¦æÛg“3:Gy—µ×L6˜àJËÝدÖ+E¬Ÿá/acløòµÞw‘¤uBT6s·(Ê9bÌ0 =[‘Iì—î–®!õŸ‰Þz'Òx¢{ªn í#’£Èý‡æYÇ©6_!q¾y6±T} ±ƒ[ðs&¯’‰}•¦O½J¿ã{ºétFšùÎ#þŽƒ¬F±ç‚I„g{eÓ' s–„¾NÌà‘}»æ&^WaïÒ.71q¾cN·%E¼ üF -OÀ§Äàã-9¹—¤'krÍØ£?“!s\Š‚ÝS -~"#OÂ#ɘ(ys{ÊcXÆŠ:R˜Q+¢«âI.jYXïXPVˤ­ÍpÖÃÅs¸Ëûã”ö7Œ²F%QÏ -–)WÏy+9Á09ž+ƃ“åØAoŒ î°p÷®!¶wÂÉ°ÅHsø RÅ8ÕÞUˆ]>ž¶ý/.«²oW¶^ÃkYÙ6á¨^AÇÖHuÏm¡»Ñ¸â bR§ D¤ÛMË ßvÚB—;+ÇŽëW³0m«Ù‡Ò‚X¬\“h2~— ª[iMAXç½¹„ÀXŸ† ýÐvé%sdàмbR«¢»ÝËf{ÏÀLN!k†¢{eü^àhŽ{º_ÌAZ0¨ZÕcѪ&]-ºÆ.(ùjÚßcL¬¼="Õò,µ½§»zØþ+ä{¤«áN=F˜tŸûÒ&J!ÒQ]ƒèš3 á]!Í¢°æs8$ …}&þ‡“ªÅØäCÙN~`™3Á]ˆ S&ŠY(ñÚyU¯Nј¼Óˆ¾ÝC!hýãISd܈#"à}øÌCº¸VÂ[LÓPÓÚ,‡KVž<¢ fö<;4=¢è‚¨~þˆpÆð -”?þs—šˆG<ë‡ÐîG3Hh’à‘ßÌBl=ê–´† ãs~à ñÃ$xÈð¿OnŽendstream +xÚ¥ko›Hð»…•»¸ +k–Ý5Pé>ô‘»k¥æ|‰£ž”öÃÚ&6 +pÜö×ßÌ΂Á&éK‘Â23;ïæCþø0TÌÑ09a8\lÞp˜¿ÜR¸–ÄmѼœ ƪÉ{,ò¢áìîÀG1©Äp¶¼u^ýýb:»¸¹B‡GläA輺™Ž¸sMÐéÕ›Ëٛ˿ðM;7SDÿs5 +…3#¢7—ô‹w/_Л`ÞèãìíàbÖhÚèZE¨æ§ÁíGo¸“Þ<&¢p¸‡³Ç8 7Г))ì{:¸üÛ°"œÒ­>¯Ô®ï±À÷OÅQ`ʼn#qâDœ7t9è,ú$q/b\LÀÿLªMqültã‘dhÝ@qæE‡qÕ +YMUaÌ.>ƒ“õfärg §4&gCôàøóc§ûAÄd[¢Nô©ižÖç˜êSnF~àÌQô•Ê38ÝQ^Üå;ÔµD¼^Âiiov×àVñ±òÒ‘²WùÓ€[Ú§ˆÇƒaÀ%‹Bil¸]¥ùÝš~Dù&ؘ +‘Á¦9èlE#Š$ù‘SŨpAšcþ ’/#?t ®ìaµÅ È tªŽÙŠnÙËÆèmç²:¹»Ð[º‘éMÜ‘_{Ú^÷ƒ&P·öÀŽd@Ùgñ"7ùµ1$dnGÈ‹3@Ó~ŸôØ®Qêºcðøa¤”£ñʸ¤”•þ‡NžŽKmóbÓÃrŽs4hoê×ǃþX‹¸nWy†©ý¥uK~#Ub¢M“²ëV2ÃeõÈL—œ³Pò¾é‚q†‘Êmࣶ‹|õä +$ˆ)¢1­ß, nôf³‰ dj21V7sSÀö£”Û¼Lqû™N⵸7ULÀüŽžg›—Õõ¢À¸bo+½6†S ºËGÂsìË{Óý/‘j6öïÇÿMÏñ«lÁÓFhNç]ÍGJ&a 2{ß10ä‡Ñ‹ùk ¦¾4fɬâŠÕ:¦ƒÉâÏzQ¥–¤¤}Ä¢·z×ïMk_ņ¯+8ª÷ÈJ!'ê²QϘ‰ˆbe)®Z×Ôn‹ÜX,ÚóD“×Uµ}>ï÷{#²dy±—ù]µ×EÌÖÕ&=VL ð©ò»Šù¿¦9Q§€cN¨3+ªÇ:|î–Âw’’žšÔ;°GêBc¡"ðàê ¸ÚƵ·Í‹ (î²v®K 3ÑÏ‘¾¢>ýÙ dƒÎKÛ¯ ÐçY•^­ `Iì´i(ðÁvšíÕk圔‘ÃÍšŠ·ñð™€ïÍøXæÞS{rk­vxIÕ‚TÓºDm/O²ª.µ×Д›²£ÖÅëʻ֛ùHaŠ›×žò*]°Õ×s€v‘@Nu×_°‰'­AÐ/d ð§e¿”Æ_il÷2x¯rz.i ˜–L %»?JÕ^‘ÝzíÑ.9¢ÜNÎ8ÃOFÚ£6ÀðfK]ÚŒ]ßÙÙIŽþq‘õ >ûšlÝçÇêœú{RÑs_÷±4­·“ÃÀÔV­ëÉZÚ!fln€ÏÉu’„æ-›jºEžW°DAŸ6º™Ã燯wtÂúD€ùh$th2±ohHY’••NÓ§‰Òdge|:f[48?7ñÓ|Šx“?|ƒ¦,{R¨ë‡Ù:.mÑúJk³æBàkŸ#pNû¤]xà,© ,Ð~]ŠˆÜ'sªã„\.®§ÜÄ•&P?—‚Èžê +xùì7­wg˜v²ÙÚŸ1S‰ +ÃIgV±g¬¨SÄ= À&ï®ä¡ñ”ø®â•U/ÙÔÀ ¨ÉL#] §\4ía[a÷òÏÙ¯iãk"3UaK¥$~÷ª^Ò·€U ZFk1‰}f¹Á›¯dO*•–~¾3n5gM ÖÕ…Õ¨ÙRÏû¶´ubZþšÚ×Bgt˜×Ÿø²£Í˜Ö™!& ±Cwê gôVÙÝû®AÐHfwfÄ!±Û ú}W•örÝü&!¬çö Ànà† iœ›`¼+‹q¹ÖM>Œ[Íïh©³'ÌÖIÙúb>Š-«HÑÝËØ~‡ BS—þÉVU=7*[ì§=eY<l™¦-wó£þ•ÙšûK+s³ ‚A¡ˆYO|Ÿù¼Ö÷Uxº ÁÊŠS…ÿ›Ýùendstream endobj -5654 0 obj << +5738 0 obj << /Type /Page -/Contents 5655 0 R -/Resources 5653 0 R +/Contents 5739 0 R +/Resources 5737 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5629 0 R +/Parent 5701 0 R +/Annots [ 5744 0 R ] >> endobj -5656 0 obj << -/D [5654 0 R /XYZ 85.039 781.388 null] +5744 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [345.558 341.001 536.549 352.994] +/Subtype/Link/A<> >> endobj -1850 0 obj << -/D [5654 0 R /XYZ 85.039 761.463 null] +5740 0 obj << +/D [5738 0 R /XYZ 85.039 781.388 null] >> endobj -5657 0 obj << -/D [5654 0 R /XYZ 85.039 736.911 null] +5741 0 obj << +/D [5738 0 R /XYZ 279.478 764.647 null] >> endobj -1854 0 obj << -/D [5654 0 R /XYZ 85.039 736.911 null] +5742 0 obj << +/D [5738 0 R /XYZ 85.039 411.841 null] >> endobj -5658 0 obj << -/D [5654 0 R /XYZ 85.039 716.383 null] +1606 0 obj << +/D [5738 0 R /XYZ 85.039 389.525 null] >> endobj -5653 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F11 2898 0 R /F35 2880 0 R >> +5743 0 obj << +/D [5738 0 R /XYZ 85.039 368.531 null] +>> endobj +5737 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5661 0 obj << -/Length 2118 +5747 0 obj << +/Length 2029 /Filter /FlateDecode >> stream -xÚµX[sÛ¶~ׯP§¡fJ˜ xýrj;v¢Ö–TKiÚ>À"-±¥H…¤ì¦Óß½€YrOfÎI2‰€Åb±7|» :ðWǾpT4 ÇR¨ñx¸ÚœáVÞ ¤á° ‹Ýã¹\Îno(9ÑpùØÉñ…ç«á2þźz1_^ßl¥”%#1²Ãpl]}˜¤µ`êü~2]N¦ïpæQZæ¸<»•µd¦É´[¾¸»¼à™Îè·åƒëe«i«h¡šŸ¿üæ c0é‡#T4>ÃØ–·ÐSøž2ól°üÔŠâ5oÈ»NyÅWcáÕ±[¤ßs‹”®PÒ†¾#|Ç#¿ÔÛUo|Lól+FîØzÙÒª˜¾)ªú;&H®WMnÄÛuŒHæýeä¦yUë,ã‰æŸ] ¤9žP'%Óè¨èõæ…B®l‘ù z…³?ð?R†×*rf¸B"GÖh¼I–“p¼j˜oÒŠ'«b»Å55>G«ÎnTßqvc¤§„çºdä·#Ûw}+Ûéx ¶ÐÄÞñïsšïÊ4'ãˆþÄ¿Õöáüììãdúvöq1½^^Nf‹éÅÝõ™á®6ºLr½M̶9ÿžít½9«‹³ùü-kwÖcå–à%Ï …ãø† vî«ÁcÂ@°ïUàYú!±cŸ[0=NK¦KkU3 ®Û‚%Ô†iäI©k#Šcƒ~†ð†Xך×ñˆ²ÙÐ;Zã¦5''¥¦8"åAnn Ò=N2€Ï[7”¬%§ÂO„D_¬Êt7b{•oá°l¶bâï@ÜW†c_%<0ië[˜~.N·6|ÏtÀ=3}ZIOŒYò ø2ôìTõ‘\c“…Îm1_ZÐÏõ#kºÄßñM°uW39&?µ—§èY—8ß³ùÈJw5І°2×&¡õ™M2R9þx>öÈTr -^Þ|¤¥ÿyö™GzE$å\ú{²„…’Kz–ûd8áŠCaÒ´§zÆ´-ð´ø?geÍJfJA'åF=—Ê.¾@nñ¦â |f«¡ì(Ó ±0òt^4"q?ÑŒ`^–Å!m<¸ èˆê…Ü’ø”ÆœøD”ɬs¼­ó•ãtaÁIŠhF” C£©Žì̆q™|Úw—4æ}äÄR"&&Ûö+þv¶Ã„l‡=u7¨éB- -¥4@ÂØwnT(,|œÂÉSºJlðû‰`ñ·Mm0Ow[AW¾wàšºñ*úçX!_„nx€“g÷?¾»Ÿ}˜4G„¥ÀÝ-‘á|§«ê¹(ãï¿šÜ/“öÂϾc÷ÀúiÙî9>;ow;1 t¨ ñ`ÚsŠõÜs¼»ü”ViS -pŽE™èò#nÃ/‹Äû YZ™£1¡xO'g¡¹øk^â2^2p•œ 'z_ßIÄ2(ˆüÁ¸_@˜ XR±MŠO’aƒ¾ÏÚ¤öû5Tz¾ˆ‚¦:î7Œ,[ïÿ<áràmë-tÔÈhìVðø"çsnxö‚ÊúO…¬&›h¸¶p{³Soc›>¶Œ¤ð!çûž Uà¾×WÈT:§6,ý«EØÛFZšúk¸AÏÌÑ^š<—i]£ê81x_ðÌÔxeeÅš)¿:ÒË’ -BåC·hùR£ZÊÝõù1øÐmÈ{:&#}B&s²¬šzÆZ`RmO‹Ïôë½évÑÄ~EdAï.UH26`ÍÂÚdN„<"y!tUà¢üMÍtî p»!P -z•'Ôè®å Ñcǘ@´¨Û¶Êƒºaä”<; 3,”1ú6„öâ’cT÷Êî@Ô0÷MuÇ/ë5rÓ½†_Í?¬÷ˆj¸ÙÁQÓ Vùv%JnËÎ'l£ÒÞùú”Õ}œ³(ô,¢µXM[FzbBɨ{KлÃuza’mQ¦rB«XèÂDälò9õ‘ʲ5¯æI­JZTfN<ŽÊ„±†*1æˆàØT¾®(Ÿç8Dpà­ZGs/ó²•Ð¼ð˜èz_6ŽiVà·÷îuÌ»‡7t>hâÇi KyÒïÊ45“äSàÌ›h&FÎÉÜÝPš´…¾¶¢çƒKÌOµ¾Ùk&!–£g÷µy+nŠæÑû4÷mU¯Õ6m–o۪╷¹ò¡#ø/ßz<ô vaUŠ±§{P+Ï~0&#¡-ÁÏ Òr |Ǻ+Fªž°} {t«8YÉZäØhšV¯ií¹Â…†é_µîx^ÿ  \%¢PµFò¡{–1 ¶ÀLHõÚBã沇“Ú¼î7½ÏÈcL5+š>+dIï“ÂŽr¨…< ü^›ƒ£æ¹OWx­h¡®’ÌŒ7ˆÁ8àˉ#Ìc~ðf˜–L|L³ö;Á -BŸw¼WóÉòâöu•²¤æ´)Ígƒ›Éíµ}3»¿»X… #ÿnrwm”ú¼KªïÌ*”³ò… Öª§wgEZ½®P]îÍ™»2±¥€¿þ¡¯î Å“'8 `±:dé<Þzúza¾‰Ì±á—:òü¤B'bK;³»ëåûé;ýÄn:m’p{ÿþ—µŸO¯¹~êÆ|–¯ëbW}©|ÿKÄ£ óùíäêb9™MÏæ³Årqu?™ 3vÕW×ÿçé[‘¶ 9…|Žp£S¸ÿøˆÿé3k‹žðD«è4xú. «ltA“\üRßæsì‘ÂÿO‰˜Bendstream +xÚ¥X[sÛ6~÷¯àd–š‰ €$xÉ[Z'©ÛÆume³3Ù<Ð$mq–"T’²Çûë÷\Šºy;Ýd‚ÀÁ¹~çB)OÂ_å¥ZÈ0ó’T‰0M½b}!½G8ùt¡,ÅÜ’Ì'4?,/uì))2™yˇ-"zËò›ÿãOïo–ngó0 }•‰Ù¥ÖDüeSæÃHúP£Ú¸ÚTݺîûÚ´ýÁ=+åvÛ¶ã½é‡¹S•v +³^ƒ#Î\¶*‚dÓ2=ºÕÞÛ4ÕP‰Wp8˜GQì÷zº«Áé›·4ca¶MÉ[ùv0kX€ÜÞÚl1®Ìd@jË°$^O³ å(wLþ/©¢†©J@ÒºE*Œ>R N¥rîù®ò£:¹Û"gG·@Ìt5 íú…Õ6ë®"çÇÁL÷2K#_œ©QˆD¦¢ (ÌR}²  D ùžeC—$°á•¥Þç2ÖÒtŠ“]ш#O)‘¡E”‡‘½ã Lätÿ:S*ñó®E àLuWT²õþ;2aÿ“5Y°3Œ6Wëл4 «7QײOø’ºjZtT-Ú‹¢HÄ2 }/·Û8–ŠXgs|ÜoßBˆ“-‰ll«v`*èw¸JáF¼å(ö"g‹5‰D­ìîPñå”Ø:DãýŽ·ÍÕ1¦êv0çá b‹=vˆÕP¥>¦ÿ¨jÉ{æžiùÐw‹~÷3¼O6cy ¾„°6Ì䥚Y6ÿæMVÅ ¢Pn+Ì°ª{ðwE>I3¼ð²X›'P2HcvZjç »Ö2à²À¾Â]” ånƤ­Áu¡@N‘…€–Ôv(äx9mzXaI‡Ç=9I·Þ‰Ê1Ò®5íaL"•¡kN…‹J½@YÅÚ@©åòÇBJµç‹-F„ªµ*r‡]£pÑÕ«—›É–G…%Ê´PQìM²ø¯—¬:J&Þ|œ5þz•Ú«/Áë3Ii‘DÁaß-6üt`e *ÇáäFª?1ºÔ=wŠ¶zæ'<ÿ†`N 1ܹØH3í^‹à­z6¶¢bÛ¥ÅD\Ÿ»'¨åxú2§è#”j#QBur­†€‘MŘÅø,P2˜ýXÑD›ù×Æ ShÜîâPHÉÞl»ñ–%Ðæ¸~I¯1UðÜte<¡YeUò&æä MˆÙ1À”Ú?wUÞ[£à][^ wôº1K¤_LMeÌR@"BQaK[>.ìåÊÆHcÕyVXéepZÀиáÕ¼lR!öæÔ}—|FC‹gTƒc¸3ˆýK“]WOºÕPABwòKM!;ÆœÒZÄ‘«è½ËË_€–ËE$SšPa‘Œ«ÇÈÙƒgê¶(`ÅW>£3GH2L-”xþºßâ€kDï°¥ÙÅðNŒA‹S²Ì—ª•Suꓲšúž¦!|†~nq‰ëÖ ¸|8wêÜ ’ýÐÕ÷Ô0íuŠ ]?¯L³cŒÑ£û|p‡¢>Ó6'p»°UA¼»[U?bju•Ý½³Ž +¨—%£!Ф1”‰ÿ“ϪéØ© =óˆKF¨Ï Õz,ÔÉnÒl GF ëÝ´‹DoÊ:`ø†ßê–)0YÇ6ÀGÓœ…WÛzÕ8#2þtóë[ÇŒwrš–_8ïvÎ{áSH¬ÓçühêÂV³qö9W(Û 8üázøY–·v&Óœ˜´x®ÝçÞXèÊ}SíÛ”(vóÁt¼ *³¦1fµs†S¸y87›*aœ¼ú»Ã„†šÎã¬l‰`8:ãþ¢2è§8XD,­¥[æ±Å<þ dó@…+Nü²¦Ò Âª«hƘè’?ª¨!ÝÇš>jû3æ¨4A¾j΄†gé½YéDD:Ú}áéÀMÅárôiFžÖ¡$$™öï_éi¼äêm:»éЉäoLSNãõ†I¾ÖNHË9Ó‹,]`ü𖩸˜ðÚ5Ó# _©í–\žR.©ý1‚¯—‹@J¹øç ªps=iåïܽ Æ"ú2:P1z½|Ë\¥]RµÇ…“àê^ ˜b*oF_U¥KLÖwgžÆ"QÙ«ñÞ‘P¸#µ7Ö*ÁHhi¸S©äP˜’±H¡¾"Í‘ŠÛï‰*¡ +¦âx¦ã¤Ó&jøº ^µp¤8o “ü/û΋ÍÛ—uÒº,4®Ä0?uXìOn'l ¥NúþqËù¿~M=Spž Ž`dWNT?ÐÙ¡¾îWÇ#…ÿ 2v)’endstream endobj -5660 0 obj << +5746 0 obj << /Type /Page -/Contents 5661 0 R -/Resources 5659 0 R +/Contents 5747 0 R +/Resources 5745 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5629 0 R +/Parent 5750 0 R >> endobj -5662 0 obj << -/D [5660 0 R /XYZ 85.039 781.388 null] +5748 0 obj << +/D [5746 0 R /XYZ 85.039 781.388 null] >> endobj -1858 0 obj << -/D [5660 0 R /XYZ 85.039 355.788 null] +1610 0 obj << +/D [5746 0 R /XYZ 85.039 216.367 null] >> endobj -5663 0 obj << -/D [5660 0 R /XYZ 85.039 335.198 null] +5749 0 obj << +/D [5746 0 R /XYZ 85.039 182.227 null] >> endobj -5659 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R /F20 2865 0 R >> +5745 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F41 2994 0 R >> +/XObject << /Im3 4353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5666 0 obj << -/Length 958 +5753 0 obj << +/Length 2208 /Filter /FlateDecode >> stream -xÚµW[s›8~çW0î ž]T„,:“×Å)Ʀ†æ¥Û‚©aÊmÔã™þø= !S;É6%ÒÑá;ß¹èËüaÙ H#¦<30"†!©¤É;X¹–0—P¹ˆÚ“yëI¯—Ó‰Œ5dj¦ì};ê¡hB‰ìm¿(‹÷sdz6c•¢`ÕÙÌPŸ1V\6ëlì•g¯®›· Lbå³Ó,¯7cƒ(²WÇåùÍÛ9{#Hõ>H–' - €Êl`þ+}ùªÉ[0郤!bòÆ°œJ€Ñ áï‰äJŸ„*¶6‘Ù®!V(15ÈCZíÑ‚±ŽÖåÕÕ&-/¯ÀL5ågƒ”©¸ù–ùËÚíðš>Õ©RTu^úU–cÓm(Ìû{VQ\á–½ìã:b# Þý› ãl!ܲšM|+ó”+ÉlpåU]qQ÷¡Ð T:;ˆ³ªö“įãž(K1¶$c‡æýôäô2Œ<%E*Soºìø„"7]|ñ?üz6™^ÜÆÆ_¥b4ŽãÄÿðy2Rþ=Nî®n¦W7±À ò?Opúön”ÊDW7ÝôÙõû3î!G_§¿\LÛ¶{€]¥¸Ío'_¾Jo~;‘¤‰÷ +m)L?ŸÀ>EÛ/NîO~oYñ\àñªCZi(ÆFŠ$ †5JÊ Õ\ Í)©D סêþ’*ÞE§d$’0ñf{š=‰*t%*-ŒÒ[ç›—õ& ‹E ”îu,tl£Lb"<[”#˜ð3ø«¿ê*ÿ>Ò‰ŸUkÓþ¬²“3þ> +#–³dlg–Ð.+&¯Ÿ2n”Å"³cä+ X”ÈàuÍkÒð4MN¯/°§ü™}%Ñ£1ð.¬øõ_`†ÛdfHi n¦§ZJyú'ŽM²%¢aSÖJ‘g+\U¯‘ŽpþùâɤÁ¬æY.ñ«ÑvA‘­y0·_ŸÃŒ¡VУóffF°]³„ÿkÝ juV/Kœ}&t¢ö“)CÙU(rOÃwÌ#MlcŠ¢Æ5‹B*²&6Ö”õBÖ/«šv²`ÐÈöí¿=72 +R%zðŽ84ýw¤!:vG†¶wdWâÁ;âJ<;¿D˜·7Ó{Š¸¾¼îëµø‡f¯%:Šw@`‡wGâa¼ŽÄ³óÛ÷ä­qŸ»‘RÊÿ_è0ן„ƒ š~Ð Ñ1ÐC[л‚v%º ý4é% ãa°ÍXKtì€ÀìŽÄÃ`‰çôrÂÑöN Ä=9ïÃ(¡äÍfKtó€ÀóŽÄ؉Wno>]½g®üóOŸúðª2ƒa¸-ÉZ¦9 +¶_Z‡u[Üa¨¸ fL×·7̃!ýPh¸™Úˆ€r78ü9±U%(n0>tÂ’‡ „TÑ žš~E7DÇ4=$°Uõ®Äƒºv%v~#$gÙ{¬‰T »‡f¯%:Šw@`‡wGâa¼ŽÄïça¼&MErä94ýx¢cx‡¶xw%ÄëJtñöÇ'"fot¤øP˜{‡‹ÌA1 û‹Z%·òm>­z5º?ÙX!Ò0D°©`4@¶íM 8kJnwqZjh¤t=¼ož2HSÃ$N›vß¡¢Ó«gå—°MÏÙ©e;vø²Y×,r±8ôŒŠ 'SìÍ!ëúr:õøª É q­W5ú¬ü»Í§‰¤ÍØq~Óèçp¢eEë=·l¹“m-µ%,É‹V[ëÝÌ9á*¤ª™Š†ýªü1V&C]‚e ¸ê+)JÄ¡óÂ2l1°ÎV5ƒ‡oࣿV’-ød]4L»ªÀ~¹¢2EFþkŽµ.} =Z‚üqÅeSÜI[0ÝŒB“qµŸqÃ÷ ±(8ôV¶³H³¶Ü©ÊŠâÀ¿‚æ’'ßo¹ŽL-ølÉ&þ?<Ü):¯ òW)l/˜¨¨‹6^—«­õ¤¬’Û´œs5¦üq¹*Þ€Û>RŠCá;¶üs‰ãàHØ‚T¬Rë G“m•ááF“ÔÙ9²8d,ªÊ¤Pv àðtu2’Ω4ÎÛÒKYGÎ~ÛÂóŒ2‚›³æÐN'ŽR˜{cºùŒm)v}Gi¶ +"ÏqG?áÜЃ*{c\—þ´ÇÕRÄG¢”™ªÖ9ié¸QK¤Rȯ~S)l“¯ì†pœæß6y•¯AQQdmÚb{Ô Û&ÏIÍìipþ2§×“uOàQi¡y89whöc^Ã'2í“oN;N¥=©Úv%зg£}Š©˜¾{ IíµÈhúÙÕ%·xmVÍYýÁ©dFGÒÉâÙ.ðI$šoŠšûËÒÊ£ç8‹:åû¥¿Ò^K¼1*Â'K€¯ûWzU"ë8éyÁ2qê£ÿ@ +Ö 4¶t£ÂöÃ:¯í¾K!!m„rîdž*Êò¦’hJ·I‚½Þ@ÈJ,–ãìG]Íæ5³±üÉ'Ÿ’2P ?Šá»Ò˜$bd[׳¢°‹Fž­JVf?ð-5ô”…_ + 5·³½aO“5ñ[”Dæä|‰,%Uøzf¤?A[”³‡bdWšÎÁãòÖüX?¸|É–HÎ{¸'„4/6 ':5,fu{‰tÕ'‹Âž‹}%Þu¬ý +Ë™¶‘ñ`ÂrJK„A¾²àÙ’¨3ˆeL 1 2å®S¶ïy8U¢šÏPcßI÷0ÇÁsoô`»½Íý ɯž°™¿d(›ðÍíšÙ*«òù~T˜yÖõý¼Ê_854:e¸9Ý6³°V8—tg  K‹ëWüåûkºÇUzW5þ#t‡ÙÓuU¦tÎp¶xÇÓë6ÖW–q{_ ýÑêWuj„4µjÿ,¼°û£]ò ÖGᕪ?§cÌ€r'îë$n÷ ã¨ÇØÊÿϚ翸R~ùÊ,·a!ÙS‰†^ØEŒt¥ÚgyjŠ»©%Ïgfð +WÒr[JǬÞ‡OÌûjz… ŽJyÛÏÈ3ÉÎÈ<¿$ùlàÆJ”îÐ <ÿ0dO`{*Îx„\{YukY .™Þ°×fÃóÖÎ/¨äœÏ]ìÏxCå¦9Àv ôDökéí9Mü¸Z›ƒÃû +à¡yŽ¯òÖÆ:í¥0xëÚô…NSO )…>˜ˆÀ–øS?mu F$¦§µZ5{A„:Úû½-4‰³¿át_hEendstream endobj -5665 0 obj << +5752 0 obj << /Type /Page -/Contents 5666 0 R -/Resources 5664 0 R +/Contents 5753 0 R +/Resources 5751 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5668 0 R +/Parent 5750 0 R >> endobj -5667 0 obj << -/D [5665 0 R /XYZ 85.039 781.388 null] +5754 0 obj << +/D [5752 0 R /XYZ 85.039 781.388 null] >> endobj -5664 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +1614 0 obj << +/D [5752 0 R /XYZ 85.039 220.091 null] +>> endobj +5755 0 obj << +/D [5752 0 R /XYZ 85.039 187.873 null] +>> endobj +5751 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5671 0 obj << -/Length 1039 +5758 0 obj << +/Length 2488 /Filter /FlateDecode >> stream -xÚµW[wÚ8~çWø°/°„eÙ`r¶”Bâž\póÒíƒÁ|bl¯-JÙ“¿’%››MK7qNºŒf¾ùfF¤¨ì)¦UÜU:&‚Ø4•ùº¦*K6sWCRHp óÁ©µ†m]A*ìª]ÅYìõP7°âx_ýûží &M€1n .l‚NÇlô¿ØMÔ˜ŠQ{bktÇ{:D/6ŸOš&n8BÈí§{z¢‡¡Úüæ|ª œi¡êr˜ÿÔ¾~S¹ô©¦BÜ5•-k«±éuᄆŽe?¨MkŸ UbNWĪ2V lBÃÄç´`〄4ˆ‘¦t ªžñòsj㥠4dhFcî„ðoÕ@Ü%¦ n¾{$þÄÄ55[W*¤!Um$nJIB£4ZºòÃe ½£òÕ‹ŒsL„ÙWß7GTzDÇKüï$©gð€Öf#ï@Õ÷î‚/9–¡÷n¥4'~LÅ€+·QòÌø€¢÷r™“B%bž¬þLíAßZý&Ð;lþÏßõª$,Æõ¡›¹ógzë_à¾Ë°.±V¹Yi²ê-qªlu%룈’Ѥ«<ÂóMÌ2Ô¥þ\æÛ³ï…nœÖsA"qâ‡tá²ë.Š¤ä"•6ë=Û~°ú=ÇZO£m:S`§Î´?±i%¥î2Wœóî‘ï¾KI*z¾„»\UÛ*°f6Ȇ0téqºce´Þú©Hy?d(‚€1…rÍl»iš•îÏS‰Z•N1² -ŽxA³å YDIîhF•fön•@T~ZšØÛÄÁvS¿9!tÅZé‰ ±Êÿ—xf9ãù ™Ó`'D%تÉÄ7Ž«2ô4}‰7ŒdÖn¿Ù® Qž9$ˆbF—Ü·,z¬Î ó{$f8IH/`ŠBšø³ Ï‹c2²’(Â&­®™²›*°1‰âœàE­+Ãùà‡›¹~%K¸Ï£”œeЊÒø¶ÕÚn·SÈ´x¬HÃ]•'Zõn1v·²Vüu lŽæ$¥x²‰Vij[4qâÛMè ³ -H÷ÐÿYÊ;›de*Åa&y-ß)ÛÃðÖS[n\äa 6KàËXmyÑæúÑ|’cÄûi¾Ê(½Ö—«Ö1lãöÛèþµp÷rV5é13«h{¼ ó[œcûÙÅ`dYžµtˆo+óýýõßup ­‡Ápendstream +xÚ¥Yëoã6ÿž¿Â8ˆiQ$õh?m7¹½ج/ñ"-¶ûA±åXXYr%yÝô¯¿y’üH®¸"HÄÇp8œÇo†Œùð#G±¾JFQ,…ŠãÑbsážaæÃ…´K2Ðü4¿˜þË„#é‹ÄOFóUÏÇmÔh¾üâ½ÿ÷»Ùüæ~ Qx`¥Â’Ø·!“@LX ××!€Ñ†à Y>“·L‡ÛÁHâ¡žC@vu;]W{\Qäð 7‰ " F%A:­Ž0ø·¤×`_vÕÜ@_®rBÀ¸—aÿ‚Ž°DŠ®’ÀIÄ.MçÂ-YIɃ€µdˆ°‹"û°‹9X"D…QA’ ýÀû„Ì.Þa%™„Õ—U.½+ Hï·C£#õ„£!B¶e€ƒ~J±õÂ%Aeø0ô„¸i§i7T9vO‘?¯ þP´’|Ïî”Ù9(Ä6m§cìÂwG:é<&°aðgò¨²4eû>ßrÃÚ‚ÚMƺY´gÜ+BC*fcÞü±%óט)"Ù{âŒ'@düÈ®]0mXæaÒVFò#xƒAu{ŸV<»¨vµ³¤]à,gÃ-*:P\™eKvÊHðEm¥è9¤£?ÕN[äYµ[4LQе¡ Á‘­;µYÞ˜dŽvb’ÂîÁðæ g ¸Ë?"Žh/¹³ñ6i^C·ÊÚÝö-gù²xÁ?¾?Ð2­\óá®0dÞ¼]`q™hoN†“-°}XЈË)ÐÞ‡ æå¢@Û-1jðçŸØî*X¤< +!BtÚðXj¿{Ü+ÃBb8šžQÀo¾ñ‹¼²éâf$×À<Ör™L¾ï¦z"lÏxhI°74 †,#‘¦‹@|¤`¶f 3MâéǦ^yæ²4öWé&ûÆÚ¯†ÒTé7 ÃÍ«u² |sX'G¶N~Ÿ~ÏÒ¶áJ˜\8$‡W|4è`a\•lpàe†aòŠÄv§7%îi^-e’Â%I|ëA`ìG„ÚA®¢J‚@‘¥v%“: áøI6`‚~ËÕ=¡¥å’;®Ždd²ˆŽ3N ;ææù^ÑÉ´t‚Xáé 'ÛFP2غ=za Y`xºkêi³†àVNO¡ÄmŠž~u&6†š8D¸WÎLH‡Yº´r’tå Σ²vV[}Ú©xqñÝZÿ´<{xJž:í[xb2Tþž’%Ìšé*,¨[’¶dÓ¢Óm/s§²¬%UM›Ó“xn¦C-qpÑ•¨øP©s¥¡hæO³cU,éBÄm—D2¦ {Æ™2ÍháÃçÂÇ[Xu‡«´&oªX@ÃïÄ:“–¥P¾ËÊ*ø%Ffá^ƒÊXʧš +ºZ­oÑg~ÀMb¬¹"‚s,í-IÛ@Ê­"ž\=‡¯Ñ#Ë’jÄgž¾\ìÐ,NΉ…Ž‹á&].›Î8—Œ–hø.Ë[TM‹¦âAµÞîqä´³áºM{¼­å­PÌSU$”2¡+G<°p Ô’ +#‚“SÚXѤ£2Dí½†àZce"ÿÂÊħ söa]Ô‡Œ1ó,Zån1¹>âÓ!0ØMЂCàPrFâ -Ar(Í7¤9`ãÑñ,‘Š¡Ã~dë$QL2h“Ðýah`z»‘rt]x£„–ïdÀ˜sÄA‰#3Ò¾Ö¡z·…Šf“:ÿ„N™¹{–JìóŒÒAËíšït•íòÉÒqí†à½u›6Í~À’Ë7¦zl\ïÐ…Ê¢‚Üs»IYÛù!0Þ[v/tá½÷ƒcC*á%?ÚÊüKku„ô§~ÌñêÛ‚¯Ùö÷ÏEžTZ"ÑfËçGÙë6µWD\—¯˜¤¿&A§YW»bÉm—j±í¶M¼ýº"…@s‹`o¼èª±]m§é1a vÔ¼–>•/‚äÜe~Yž¿õ‹Î)4Ô*9ï&D ,x~Pܱ¼Ê5«Sÿ ýS/endstream endobj -5670 0 obj << +5757 0 obj << /Type /Page -/Contents 5671 0 R -/Resources 5669 0 R +/Contents 5758 0 R +/Resources 5756 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5668 0 R +/Parent 5750 0 R +/Annots [ 5761 0 R ] >> endobj -5672 0 obj << -/D [5670 0 R /XYZ 85.039 781.388 null] +5761 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [192.75 685.841 395.195 697.834] +/Subtype/Link/A<> >> endobj -5669 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +5759 0 obj << +/D [5757 0 R /XYZ 85.039 781.388 null] +>> endobj +1618 0 obj << +/D [5757 0 R /XYZ 85.039 761.463 null] +>> endobj +5760 0 obj << +/D [5757 0 R /XYZ 85.039 740.47 null] +>> endobj +1622 0 obj << +/D [5757 0 R /XYZ 85.039 589.974 null] +>> endobj +5762 0 obj << +/D [5757 0 R /XYZ 85.039 558.159 null] +>> endobj +5756 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F58 3360 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R >> +/XObject << /Im11 5348 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5675 0 obj << -/Length 903 -/Filter /FlateDecode ->> -stream -xÚµWQ“š0~çW0ö§“4!D¡3÷`-^¹é)z/m8¤Ê -ìMgîÇw!³´í]q”„Ý,ß~»É®T%ð¡ªÉ1a–:6)f¦©†[…¨k\*Tj ©‚tÞøÊ«ÙÈP)Á±Tÿ룎 ÎTõI›¾›¸¾½"ƘF-´¦„ÌPŪ.V8317Ùï´0~@ ¥:fTWÇœ`NŒš—C¤t®­‹<Î*À ¢Õû¬FÎ('ÚÃQ÷Ïðs1D– ²´(‹0ÎJ1we”gy¿P£'¬ÝÊx#ªŒL\÷½3øÎbþêfþC„<´œxUìN¡ûÃw=Êj¯ó ´eZ¤Û¨ÜÄ»õ—^cé2ÞfÈÍÁ?1ÿ'°ª“mðC n#qÏ’ýz­NÄ}åÑN*†ù˜ÿ°À'&«<þÞÁ,ÿg«õÞâÚößA~£·ö3µ‘çÚSgæLÿ¯·AxíV]8{ñ;ýº›ð`'é¬â$Fi¹iˆaù -¹A^þ@³ÃÀT<&ñÔ÷÷ùmZ›¬ ¬Ÿ•i{#C•xGo·=W j;nž>5¾¯"-†ÉU§„Ä·KËh…;t<{®«±m0> +stream +xÚ¥koÛFò»…Î@Q*¨h.—ËGïp…ójS4‰/qÐm£%Z""“ +IÅÍ¿¿yí’”h¹‡ÂH´ÙÙÙyÏ.Õ,€?5Kèl–¤Ê×i:[Þ³5Ì|¦b! ‹ÌÓ볋—&ž©ÀÏ‚lv}Ûã1~dôìzõ›÷ì‡Ë«ëïæ ­µ§2¾H’Ô{öáj®¼÷Í”DY¦dÐ&êûSÑÀÅ«;5{^™³žRù!*Pû& '9¬ÂÌŠ§Œo’ÄF¥ÅShBÎ,žFù‡‡PFùÐ8@u¼ŸÀ<²Ÿ‰ý,JFûý\VóE(/ûóâõ n.·eQu-wîçaâÕÕ×Ìä~d¦^óGî—݆{ݦ`Àg`ÑÕ{î\ႺíÞ/›r×#[5%t>“ø°³8Š½—ýÈ T1…›Å€¾ei“‰}!à= ùzÅ#4Û•[Ú²ÁUs‡ÿ¤«y— ‘‘mæÒ¼ËçoŸ¾xâ?áÙU3ågÂÔ´<–ËïŽÈ-è x¢zßn¿ '8–§èF >) ¢Óú3zX,r'|PNîgõçô~¢?Ãý^ËtxeË¿U-ÈÅœ˜rw»Q Ü-ü¦™u¬Ä¶ÜÝäÈc„&UÂÆ@Ð[¾Æ +‚×ü¨hKBÈ-ÂÔwÜé,&Ôés ¢B¨Ô+«¶Ë·Ûµ³¬+Í<4œí¬^ÀØžm.Ú ŸÏ*×År¿k/FJbÕë‚Q¬J¼ìXÁEG±Î¼ëÁUqÄ‚û3 ŒIÇýräŪ½Cœ7¼b$3“‹ƒuÿ{`‚ž-D6þbVؽ{´ò}Wßå]¹~|á!áámÑpÿ¼Dhè$äÐÐÎyp‚8 òG,˜®áiÊŽ- %Y­Z6À›ùõ¤ÛQ:ACè++^ƒv·Ý«oæ H6$Œ$!YûXŶ5ž—ãšJÚeeÍ­cT9Z1Î^}Ë0‚TYû²G0œöÙ€¥““, IàÁòVbu@X+¦¶åoò]„/~¹b(±4˜F^çå–‡óŽQ#Ò‹€íý:O#t›Çܯ +" \–p «ÙëÜù,3ò,âS3P¹Àã©àH ·oqWöœ:ë KŽüW*± •XÙXzEUï×q£õñç«‚wWœc^Ù$"·C²íœ3‰Â¤OiŠqÞÛá! +ô8< Z¶ÚÎ5­n–¸qAªKSÐûr@&JV'-ÇçÊ+aqcøÙ·NF‰áPbìÜéš/Ò¨Ý2‰K2nƒhÃÎÆŸ²êyCš‚Æ¥Ú³8lÔa»ÖÌñ¤Jë[&p í’Ì9–ÇÂèˆï¡îÝ +Γ1 ó/<âß‚¯Þ1^»`–áºó«‘B´ç v‹ÎNNêö7kMøÛòŽ?•äáVÅ~BÕ¹hð*aæ5Шcã½/º®¬Ö­tŸÕU×Ô($“²+Ì«b+“W‡Bj'BµJR?6a¬•¬¦y½é”8lËåGÜ ¸"%ýFy+Ì ' +Nž*ƒº62C?w“[÷üqMƾGªãÐùSl³²nûŒeŠCA Ų,*ö"°úª©Ûá3w¥àñÑáä‘N *°†¨·Ý tNícM¾›(í2ßÖk†qZ2ᣧ‘CÙ?”´œªXZåRÈã³A™(+Žçä §h×1d–ö.¿ŒïmÕ£§Æ¶liÇ´§BúÄ9bh÷92tîY¥$Å);\á\':Õ@v6í†âØé4ëŠõklç\Ñ„ÚqAÈîŠ)F„~ à ¦üG¡Êr$¤0¸¡ðÛK dBëT  „Yc-n ñ£ì‹" +2äÜKƆxóÎeX®Ô.?—Ûbí*¾AQÏù"5ÝYÕÃu8?LN×=ÌÃåƒÀàI¢«‡S›ÙâáäfR; 6{[- Ž}"a(¢Q°2Óî—¤›|sÒrAN’®V”U‹Î­xÊé€IɱIÆ·9à9ÈŒq}},æ\üç“vÊÂj å7\öÒÚ v‰×ÊåÓrùu*ÃÄ‘õ»w\3@'ž(!—A ›åõëk +)KI®É¸Ö ›Û0~`’«¢åʧ”t’îœèá@)Bù)pv_% +%ÎSÍZ® ß ôÃB/àÇ +rˆSn̘„¡‡yKÒ”u4겇4Òx¤¹æ4e‡˜²oÁUÃÒ-­²±öh)9¨ª­Ör‚œgŽÜV:(ÂŒhŠ#!MXKhˆR×84L ¾Ìé¶4œª²j€CRè#GI̦‡Y¤@èBÜå.ß`?ëëmÀ9¸–¤0C LÚÐC²´\b Àêl"0GÆÏlŠvl&è òMlïV'vT©ÄA[t’£LlÉ`js…v³XÖäÏïòj5ŸpÁ¤¦*Šgƒ+ÿ¿ñ€€¯ +2±…{ùø[¯!Œ‡êä³’?êÕ™æ^*FÚOacºÛÏ€>¼sI12÷´¨ +[êw’ÇPñEÉÆÐÙœ?û@®7F× òº^{>ÈÁ4›Plo#tÀ·€žo#ø*‚ +ƒ$l +Yè*®jä«1]—ä±ð¬â6Ÿ³¿“€3áE„ çÀžÓ<À°1ÇOu¡1~0­¿RKAˆm(X…èlÁj!cáˆ×‘6Š“’ÐÏ]N„·’ª”Tµ_:¡õºRĨAPÔžˆ·®VvZh8¨qhâ‡%rÎppíó^…ÞKJ¥¦C莓"È“Ûe%)¾KVy‹•}"‘pí?C‹]4@ð—~•(½Ð×HGg·*é9·•ÜiÞ¶¼)~CïMSߎˆUD™w¾sÜ®]_"~ÛÒ½ ÷L€ìÄ[­V¤Ÿäþ]ÝÜê +΀èîŠßÍ!kÃ$¦ÇmÂZíÁ°Ýë¼Þ¼àž¹²-Bc µBƒ7ŒØyýêõ‹©ã‰°Ü íÅK32B¨Ï’Tô/ßí¶€“ad,?ÍÅnn(l—ÖÑ«² +B°«Ìøf«CïFœb”…|‚Ìzhpz)Î=Ê´ãeï’· Iǃ©ÞƒÛ´vêPø¾aýø©ðs ØŸ1SWÞBÊ`¼IÓæà*`|~6„c@a­ÝÎò`EÑèú˜“b|­ÞoHƒîQIÀ¶ó-†(lmæÏ/–!_oòc›¶wùº§Pbâ²Þ³aYsÄ)¾x:Tðal]ßÅç¼¹ØÖxì5ð Ïܲ×G_Ö™¤¯ô,I úëÇkm탛›¬´Õ¢ÇÅßhŽ>c !õO-0H³;!ú Œhü>Žæf¦gþÒ(Ÿ­G ³Øña âÏ|)K‰·{º¥“þµ˜o{`½t˜E$r'ÿÄ*9¡‹ +ú4#ëïÕq¯!»c%§YôD$Tœ>½_$ûï\sÝ þnëõZ¼É±—°eX.ŸËu|;“[Í~FWt¤ ”Mç¬óÂÉþñžëkV—÷FÚOõI(ªP¨,-ô\©¬N}“êc‚ÿäÆsendstream endobj -5674 0 obj << +5764 0 obj << /Type /Page -/Contents 5675 0 R -/Resources 5673 0 R +/Contents 5765 0 R +/Resources 5763 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5668 0 R +/Parent 5750 0 R +/Annots [ 5771 0 R ] >> endobj -5676 0 obj << -/D [5674 0 R /XYZ 85.039 781.388 null] +5771 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [213.858 394.054 306.485 405.743] +/Subtype /Link +/A << /S /GoTo /D (printing) >> >> endobj -5673 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +5766 0 obj << +/D [5764 0 R /XYZ 85.039 781.388 null] +>> endobj +5767 0 obj << +/D [5764 0 R /XYZ 129.675 730.534 null] +>> endobj +5768 0 obj << +/D [5764 0 R /XYZ 129.675 699.907 null] +>> endobj +5769 0 obj << +/D [5764 0 R /XYZ 129.675 641.057 null] +>> endobj +5770 0 obj << +/D [5764 0 R /XYZ 129.675 442.472 null] +>> endobj +1626 0 obj << +/D [5764 0 R /XYZ 85.039 327.41 null] +>> endobj +5772 0 obj << +/D [5764 0 R /XYZ 85.039 282.905 null] +>> endobj +5763 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F38 2997 0 R /F58 3360 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5679 0 obj << -/Length 808 +5775 0 obj << +/Length 3438 /Filter /FlateDecode >> stream -xÚµVQSâ0~ï¯èx/í9‰IÓÐÖ9o¦bÑ: -=}ñ|@@é´×V™›ñÇ_Ò´€Z@,„.…cl¨E"³ˆË7PƒjaçÒcgÜypâ]ûM„×ô[~S¦ÅùßÁª±/ç( J)Ái/:0 TLV ]× -ÑJÆÀiw½þãp:X€Œõ°Ö¡©å(Ø™'™Â“©N´Î±§ÝaÞ¡œžF“i4ÍåºWy–Å“¡œÅùh˜Ê)I è¥ù_ЊÆù0Í$ù7Ù8z,åÙSz*9KZ¯ð³aQ‘ùáë^”î =AËU2~zÑT.fVi2íeM Ðù(š>HrTâ›Æùp7…¨¢íjTºMÄúÝ›|‘þ»UXyl²×¡ų’P&À,NKÞ}\ûâ€îÓx"gò®6z´ÕØÎ!Y"x…hù^«Ó½tYm²úŠ5ÊP$S'Ù.®ð«;èÁ…ßt™ßi…Í®°W -áF’mƒŸ~Dï[ü×í(r,YWø“«Þ_'Ÿ?UF m/e5ÅYžõÓ(áÙŒ““^6ïê-¥>„PìtVÆey£¨{³(‰WƒZ²µ2ùªõŸ’lOVHÜ°Ú´›[ØìNñ@ -XG¥¹¤Hâ–OyLÒ!ÿ/m7ìÍZkLÓ¯9̵g¶2íºnXôSBàç=ºÚgfMÑX¤ÄòYÈír1H£çê ¶³¾KÚe¥*Ü®:žú®’ h8u ÿI3ÿÕpλlþŒÚÄ™w“x¹›¤† \aØ9ð·x«ÆôàH¦²½endstream +xÚ¥ZmÛ6þ¾¿ÂȈ|¨µ¢¨×÷!éõÚí!é^ÖAHƒmim5²¤è%Û½_óBR²-;Ec‰rÈáÌ3ÏP+ü'Ièz2]ĉpe’,¶‡o±ƒžo„–Xi‘ÕDæõúæöa´ž›zébý8κA(ëìƒóýO¯î×?¼[®¤”ŽHÝå*Žçû÷÷Káa«¢.Ü@:„nз˫¼§—7wo~Ðz¦ÓÌÄŸÄn˜˜`QMS¡:p ¸Íšl|K‡Ôm ÌÍDžçCZ ¦‘‡x‰KºòÙÄnªQ]W˜øéaú}[£-vûIS~×M××M÷‚Û5`—½QUÆe½ÛMƒÔ:$<x×xR-ÝöÜÇ–:ׯ©å@0š´Q»¼ã¦¢â&ô£sG@Á³€“ G0ãPØxë¶&Ð:%š8q#ù!‹1dˆI·#x¨lÀN‚i:bZª˜bD{–£ÅѾ˜$6ÂâriƒvÄl0t¹n&y¢ô‘‚`Ðü{™¯¥X` ¥’C ‰ƒYú$Á…:iÙÍVc`g&((R}€Ø?ú¼Â3Åóö!ü+n·Kò- ‡Ö®ÈrDZÍ©K3h†íoÑV{ýzT4ACUkÁ¬è8R7üÎÅÒ3¿ÔàH­noС:Q=-í<+]O›u +šÜSAZáÉ"ÂŽÙ$¹B“}3ZsZp.N‰–MùoWšRÏŽ»ÚU|·„¯ý5´ ¢ÐMãëäw"smŒÐ×ÐæšB‹6§gÑfªÑÒ)éä7€¼N~0åÌ-6óc©ÅóMÙcU:Ù )Ž"ÄÁ +–í™À:¡‰‰igøc?Æ'dÄô0^ŒÖ팿ýJ1Þ/¾Gä÷ŸL~ݺÁo:†ŠX,sÕÙµ€4‡0ãmÅM$DCêÂèBŸÃ UI¹uGCŠLÛ&74 …0¸Û®ç—×ÌH¿®‡žï“qc¼ï¯ŽÕ½}áú2ºîÞ£ 9›½ÂMQ›½Ÿ—iäg6‘ºàŒ ¯æÃÐsÞ HQ„²àa5€qtx_¸Á«€(&³}Š¼ç×7HX<'³\àÂêGÝ ¾þua"s*fž"Æç¯ ë½®:,Å7ËØpqÂ%÷á@ðB²uS˜ÒÕMoæ©rëÉ£óxöö#'yª}fÝ57LKªo>r#9Ôžª œ +´ÐyuBçÀ“KŽÏ¹ë*.ÿžœ"®Z¿ŽM¢é1Ûù)¤"›øÔï‹Ž•¢ööœ„Œ¬¡ª2ã¦Gº]=ðËmÞ“Èí–8 -àvd3¸Ÿ[–ÄÅßØɤ™óÑeÐYƒØ[üG6Òpô$ý“6l㛺¢Ÿ1gï@âg”Á°¢-Ù”ίTëgtŽ`@ºÇ„æ)HỾg‡ÓQ“OÐñ¥P¬‹™‹¶ëKy?±4nûuþÈ™ †>ée‘>ÂÝŠ§jùvˆž™éecèÄgÒ |¯ÄålÇ€u$G£²(]œ¢œoJ“ aŠœ¶æúEWVÄïàe:Ñ–V  †‘°Ã#Èí·ŸÆÅœY²ŽÛ1)§ð„èDÎÝ#Oiâ‰^öjzŽ8XqGGFQ%U<çžPå½ÕMû#í89²Ž6Ÿ~A3}lèÆ º`Rdéû¼2Ks Î9ÛA×µšlÉ€PÓŽ·pÕ£Œtþf´Úp°é·æÇDèqk?åfÙ…aVúŠ”†þ¡€A_9Hf_šÍ†?ŒŸK„Nï´” ðwŒu¾B²K½šÏ)ÊÙ.×r +Þ°üÊÊO¦­ëþ/pâ@km†Ùðûê=ÿ¢?ÕcÝçÛÿÜ=øžÏ" àS”Å)þghsÈWm®ÐåñWm·9nŸËz«Ê}Ýé×øð õ?xÙåÛ6ï_~œ©Ž÷·Æ/×Yi|úsW_d5s1‚EB¨ù”(‚\`¯oÚ¥MBy‹&Úø¬ôœêÃÃÌ"´‹á FxX)Ù¨Vòñšš&w^¹Ò +¸|‹É¥`ô…´‚L‡ÉNÆÎ×´Z㘳õm $v/9þdxœÍEì¼`ÿ¶W¹ø}‚È gðä(Ïä-·]°r5&‘ 4}‰Ph É~‰6îm]‰¯#ׄ±5ÝÐ~¡Ï8ƒ™Ï %J›IêÊ0faáèÓ¸†‹˜>äÆL&ÿaDë{$雊jün3÷¡^10=±„K† è/É4CiO,àk{e.²Ï8†rÉçýIé }1I-¾Ð$Å _p¶Å²>ÏM!¯ú—wîj¾Ï…GâHá¼ïòÓßY}aÁÓhõ…a¥(µËµ^Åïúo4üÓXØŒ_–è^€.øú×qË5_¬ÇøÁxÉF‡×ÈÔ–¥Îø$Â6 ¯….þð0^™GæÛX4½@é úZ€µ¡ /’ƒPè ‰>DˆyTÌû±pcin«ÇÝ<ªÊÈ|R}ÁKVz;½Ùf^éÅreЃײ¨LŽÕ×uÿÄJÿ5 +Ê@ „ó“„®Á§Ö¼3Ƭ?±Ô‰]꺼8¿TB"BÚu¶ßÐU–Òd§)5mÁ.†€ƒ¡”04ÓUü9Z+Û¿øîR!ç¹~:Hð?oëÿú««±”•€0é|4†¾ïú¬ÍèGòt½¡LÜ0‘ç þVºX(endstream endobj -5678 0 obj << +5774 0 obj << /Type /Page -/Contents 5679 0 R -/Resources 5677 0 R +/Contents 5775 0 R +/Resources 5773 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5668 0 R +/Parent 5750 0 R >> endobj -5680 0 obj << -/D [5678 0 R /XYZ 85.039 781.388 null] +5776 0 obj << +/D [5774 0 R /XYZ 85.039 781.388 null] >> endobj -5677 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +1630 0 obj << +/D [5774 0 R /XYZ 85.039 421.236 null] +>> endobj +5777 0 obj << +/D [5774 0 R /XYZ 85.039 386.433 null] +>> endobj +1634 0 obj << +/D [5774 0 R /XYZ 85.039 136.833 null] +>> endobj +5778 0 obj << +/D [5774 0 R /XYZ 85.039 102.087 null] +>> endobj +5773 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5683 0 obj << -/Length 1211 +5781 0 obj << +/Length 1349 /Filter /FlateDecode >> stream -xÚµX[sÚ8~çWx؇%ÓX±, ¸;ÙšJ§/8yéöÁ±E¬­±\Ëa&?~eK² B'­˜Œu=úÎw.’5ƒÿ 6°€l­?€ š¿jÚ· œ¡Ë)zmηuuÛëjжakî²’c®…47øÚ¹ù4tÜÑüBGu  .ô~й¹w.`g!zùdêN¦ã¼Õå°sïäóùÅu\1i2­†‡w†¢…€qñÍýܹ%ÒGeç0´¾~3´€«ô¹ed´g^7äëÇ ¬.’í¨µhýSŠc]M¬jbÅB` Ð!-ȪÑ¡ 4µ¾eËè¼ü‘ãæBt˜ïaŸèÓ-ÓêLgî轨2ûXT78e„Æ¢ÿY¢Îù]ˆZ›®3Fשƒ¶èÉB¹:aM=–áT¶SêcÆä,Zc),¨×·:㲌ù)I2 f§÷²R ‰Žã Y|Õþ^æ‡8Ø ½8ˆp…´‘‘E¥cŠ¬IŠW8Îþ=£…sOè)4!‘µÇ5‰2KU&’N/ÞŠŠï1|yGûIÊÑÃöQYHŸEmHùÒ>þ:ar]€7ÄÇ Ù: -m¬y'0ù^‘øIi"¿ ·p’/“üVÈÙÇÑÃäftƒH<>]­rsïjÐ{—þõ}TœJòŸI‰÷Êd-{ÛXD|/ã®|µ‰ÀQèBõö¥\?¬É8êšÊ·–$ælw[¹ÚãvÇ5?ªÑ¤d£êm1QFW˜ûMüÔ>¡ÿ”fx/Ò²\â—q«x,ŒOW\sÿ˜¦ÒæÙm§ƒBrw©¼;ÛQ·`¦!}Ðå~zHIœ-I„/U”yÁö ’Ca<w§ïŠÆ©ôŽŠ 4b¥Ÿaÿ)¥¬Ù>­2vŽCµ¢\@⃬°ÏU¾~À‡yŒq7êÁšËÎ#4¹ä9Ù|LV‰îä|¨`•^šûšDÂ!HODi ;^šmõ[ž³¸ùD÷¿†eD仜ï®ÓGZˆäý°)ͤåîe-ä8©4H­ŸtÅâ3‡…ë‘S ýœ•áœ{âýª¢dwè¡þï‘}Þé=T´V‡Žú–çQ9’¦ßåØ’¦û)j™ÒUý¸WYƒdas0ñËB´pðþ8ºë_T^ãĪoº˜ÝÜOÓ±~;ù2ºÍï†î…–Ñy91öв -ø=Äq1…òfeœ#¦½s+k‹\­~vûÆ«R bœ=[A¯’ Ëøyà¥Øº H¯Ê'V©¦”Ä¥<¼èRžÓðÅ[0‹ïù»¡•6o«½\­µzs’vºŒã M"ÑÎÂe[ñMãi.{8-Ÿ/³Í‡,—^DD@—uŠ„J@«=;‰O¼dñæ'i>ñ’·xA°…Å/”q8˜ŠAଵ(”¼¯Ã>žƒeE:!žRïÔ§þ:#IaHæŽë³é²KŽª†šD‰O®“f]F,@Qè¤/]<ô'ÓX²¢‡Î"êÞã>;óþú@·¦Ýû™5øΦS?ÁFuïYY#$È@wx¡4–ý8µ{ölú8:¿¹¼°­ÞíåãÅh8L#–Ø¡óRœ’Ä㌉“Öw³8ù¹q>u]}²BÈ|ø_Ê`'-CT²ù ˜{'s ìÓQ ù¼ÞÈXŽ·Ió`9ƒ’uÜ>­•ÉÒåke©ï*êâëAmQć‹êMç'w‹È‹ß™Î–M¿Ú î»HßyöOøDéðáë”S¨³ñug퉎5;eˆj ›ôîrÖ“ÝÕ Y­è2ÿïoàÎN‚ŽgcaÁNÆI^å¨:}Nõ­æNÛç*ïÌóUü\󤙾¶’ËøϱôyXªtö©×¿Ü†‰Øíº5÷?êÂû¶¯^ÿjdÙSp{uËCqä³Ï3x”Ñùåxª‚þäm˜ ýÀ>\ˆú6×B`úýË«ñÄžÈÄ÷<O?ÂÍhp1²†ƒsÐyŽ| ãéíÈ*‹/ˆg§»’éÿ|gaB~i!¾«ÞŽxe©=ù‡÷óʹ¯‚ò,GÀ+W€:@ŽçxˆEAø‘ðŒX­UÄ-ž½ófßJQÅãY6°T8ªh†úW8E²Y÷r†T«ƒèŠw U†bnÞŽøg „Û± ׺/ÈšZÖ)@†RUøéU”Ãendstream endobj -5682 0 obj << +5780 0 obj << /Type /Page -/Contents 5683 0 R -/Resources 5681 0 R +/Contents 5781 0 R +/Resources 5779 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5668 0 R +/Parent 5750 0 R >> endobj -5684 0 obj << -/D [5682 0 R /XYZ 85.039 781.388 null] +5782 0 obj << +/D [5780 0 R /XYZ 85.039 781.388 null] >> endobj -5681 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +5779 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F15 2972 0 R >> +/XObject << /Im3 4353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5687 0 obj << -/Length 3363 +5785 0 obj << +/Length 2450 /Filter /FlateDecode >> stream -xÚ­koÛÈñ»…ªˆ„ž6\.Ÿiï—ÄI|m7V®-Ò| %Ê&"‘:’Šbà~|çµ|H”Ü¢u€p³³³óÞYé‘ÿô(ò•câQie¢h´Ø\8£;˜y}¡b& ³ÌóùÅÓW7ÒŽŠx4_µx|åùf4_~š¼xóÓõüòÃtfŒ™èXMgaM^|¼žêÉ ^¸z7¿z÷{ êÉÇkœ~ÿa™Éœ®ÞµÓ?½}þ÷Œr¦Ÿç?_\ÎJ€ªÉüõâÓgg´„#ý|á(G£=´¥azst*ß3Ò__Ü\ü­AÅsÞˆW qÅ7‘ò#sÌãwØ¢µ«ŒvG¡ï(ßñˆ/¿‡hß™ü2¹&pýÉoxÀ:Ó¸il\œ+“ªN˺¨ŠMZßgùÝt¦}Àvjaþ&ÿr|çûéÌáðë]¶L,ËÓŠ‡j -­öpÍ7îÖSXù°Íœ¬i²¹Mxz‹Ó(1Dݲ6öB¢äx»N7Õ)ÎèP±¦…!Þè!ŸäÅ¡rÚr~Jà¹ÑÄ~þTxª{8FQÖ<²d>éIµÀÿKäǶÆÿ‹œ!Š~ÃÉ}1…Þž‘S´<½Ýð÷¶´W´Ls´+»y*Ïl“ª"g‹c´bÙ‰”Õá$O!Tr`]vwZ Æí!O¼À(ê³<±0G<éZ¨•ã÷Xò¦¯Ýn+I²#‰¼·ãçEßv9j1“ïù³kbMù#$ü5õ÷0aØѸaíªt9ྴ©ÈÑû˜B̸ݒ„ªýrÀ€cy‹»+˜˜»¬ÝG) º :Q#aŠJ‹‘áý(>jìêžñý &x7ö8¹Lrî,q¯ØŸ¸ü!«†‹G…ï­b“qE’÷B7ÕM%‡H^¯6ˆÒÚ9¶Óo"•:Š¡£œÈ?ÅJr<™%üEÁtQpxfuY@¬Æ¼‹(M$ÙD´Ú ¥Œyfb¹SÓê¢Éä!%ßÉ:¾{à|j} Mõ· œiIUJA+®SH$g Ìoʪð¦°øêdM9ø̇›êû’×Ü–V6É)vµ4V=ü†lm+K­•ÀéA]7–C—Ð~Ç%;D‚š¸Ï‚ -3Gbƒn÷«ËY?pÉ›Ø2-CÇ›ð‡Âñª²ÌÂ\ò¤/vcGEÆœ÷Å Ó¾Ø ûâ;JEmÚŽvüÎzZè\_¿d8Þ:mݳ¶îY.øÈ™šºƒü”_U%w©ÅC99\ŒÛ;ÎO5¾ŽÙ/tä*Ï;RZ˜ÓE` (çv“xr¸ÙP8élvE…§&†PY -ò9j—„QÌ/©ž7fPºL•)™kݤý8Ã^hÀ€|šºïe´˜RÎu¬cþûó¢žÃ«™:ªµ;tÏÃîשïO(‘Ì–Í\:Ö;!Ëæï8•Éy­Â»N¤‚¨×Ø—Y&öÅãቄMû>„}>aëNØ,‰ä¨ - ~7O¶ÃUõ¼î>Ñð›æ‹U›¡å ÝGªkpûØ?K½…9¢¾'!£c†aúÕàÅÈQAàöïE]kÑŸÕ»jHþ‘rB¯{Ïtü¶hË•ï ÏtC—Ý’[½{¶ Xc·_LNl²¹¢ÒÖ8ƒè°Æù¤âaNô‹¬)¡brºâõ_³t—ÏŸ¼±´a*#›ìŠÌÈ1}ͽ»KeO+ã=—Rm‹éE‹é8×útP/ûÃg¾`ø¸†kOñ#¯  3.@Ã㥶ŠtyÈ—i¿BDÎ#ÝËØ/¾µ•% 2À' ÷/Oÿq}Tîñ|å¡œ9£…9:c¿Ü®Ê€ªvÏø>ŸÊ+•{: vPåš4+ŒâÃ4 Ya ˆEÒ5Ò‹Âæ"îEऻÕØ1ujB<€w¯•}~ú-ÙlׂÁbçôÉšMÉÚòaLùƒT$é& ¦Gô«:ͥɉ-‚ÍŽ+;z\ñL“èxV`§_öEH~fÙòtÍ $ŽßíRÌþ°ù=OÞbusã-h÷‚%žŸ6„ŒËohë¢$yøÖ‰µVlÑC"6’ãÓXѤ6$"hÈU(/tÀ‡5µèͶæ1ŠSð%l’’KÔ”5wIf—W‚Ž»˜#e>Rj ÎíÚ·Qð5Dºyï*eLôÐSØtÊ ±l(©÷ñ¹†"§1a|⽉ޚˆâ7~›¬Øg¥]ËÒÃæ?¥º”ÃOÑ5£¨8£°Õï0²ŠòÄÖ¿-P*èþT5Ê› IiYŠÆcocKâ"ÑŸG —{‘0æú±Uó³ϨȜ(û®«\miAA¸w\íàeüo(•/2endstream +xÚµkOãHò;¿"ÇÞ G"ÛmÇ6§Ó +ØÉB±ÒÌèdbÖ8vÖv`ù÷[ö#$öîÞÍi4¸»ººººÞÕ‘þÉçSùדByÞ`±Ü3O°òÓžÔ#2jáœÎ÷Ž.œñ@šÂ7ýÁü±¡ãÛQƒyøÙøðñd6?¿Ž”R†ôÅp亞ñán6”Æ-Cg7“é|2ý g6¥q7Ãå뛡§Œ9#M¦ÍòÉÕé Ï”0‡_çŸöÎç5§5À•lþº÷ù«9áJŸöL¡|oð +cSHX^îŸÂ±•ž'{·{?פxÍð®]Rq”'Om‹E9-±øcaûöÀUcá;‰åf¦qú49–c,²å2HÃcžå«Å"‰£´äi’-‚ä9+ôt4Õß»ƒ<ËÊÑ"Ê~‘ÊFy áZî`$‘Ÿ-å Ã0_¢œçû÷qf¯Ïlaîƒd¥c6´L¦Ã|ïÇécVF‹ÿXÒtŽOήOÏg·¶8»ù÷q{EÌfgÇÓ»ËËåãåìø—懳۫ë©8ƒ=7'÷¤ß“>lS=¬7þ¡NÎ.®§ó[ququxv~1»™ßXDpòázz99E*û´y$%±½±}± ùˆñçOÈ’àUh´­¥‚¬lÈõ¿ÝpàÖAà<¾éµÞ÷OÉŽEç»B­MíæqZV‚:k ­Í CŠõbÅã:IÞ*œ¢ ’$ +Ee7–+LðÉÿ+mʤǗŠ¨ {¯Ò†h³j‘svÕ_"ºÃn·Ä»h•»N$]Èv8cÏpà*®_bò8YcÏxZž‘­q₼á Óo<©I€ðýÍjÇA’0V„˜!üÿ _mÚÒЀé»FVòtî|%¼-ßÐ[J­jýâø6à8IÄ\]äÚë +FúŒQ9gíV9ºÆ®s/bR'òê +}»Ü>ò½I!¬¡ñfî@ðzM+dàgÛEueR‘öoeÜMß9ò½#¨Ñš }s¦NµAqsÔÚRª ¤Óù‘õíè—ÙÆnº5Þ­J.qÍ UNQÑi‡¶+Üo‡ N·j¼¾Ým‡=§5vØw\m‡­ój;T¦Å…†wbõªUâ©“×P«ô¥¨ñÅ3ІK–ŒÀ®$bÊÚ®pýƲ^—ÑUiìãÛU;mì3|• T¬wÓ„Š¦1uœ ‰­wÁE–ç\6—:ñ“©D,‚|Эh¯o÷?:·pº­q§[Ñ=§5Šî;®Vtë¼FÑÒÑI\ÚÝZ$bhH*Á¶¢¥S)ºÉíÒ®—H¶pvÈà2^jJAâî¢v96:S§-ï32¤üÝ6'°FÑF1ÚRÈPtµNÏrØ ‚@çr™•tWÊ…ðúLµ¨k6OjìCÍ”24_ë¤è¶Jù^U•j€‡…uÇíë­3‰©ÿ{ãݯ1Y+¬®($ÖvX]¬`Êäl€E´[Åô"Æ覉ei¤ù‹ˆLV6¬!—YQÙ=àŶs´tÎïöøM& 16t ó:l.3Ò¡ïï SðªÍÛ퓨+ß8¯d¹q߀^ •ïÒ3nntäW¯hµûœ}ðû•œ‡Ü}kâù“YÓuu‡E5ãˆô˜¼clÄþ<é70új”ºòÑHe®5†‹šŽöƒÊUÈà]a®G‹$ +òDozeëÄíÚ@ã)£þö‰gYÊä0ý•Ïôùô¬÷è%n^©t(Õ»ùe£:Š–µ*²U]Û`lj.©t@%4íUŽ±ÎÀZé”±µ5Á¸myU:®K]B¢ÜÖºZÌê’´)k‹€ì.jzPͺîñù‰xã/¸«­ÄXqÄ×õôû¼î£¡‰æ·÷ú‰:X>°V=Bž› ðþ®ø÷jH:: èðw¶wðŸõð?ý8Ø´ôJxª£Et,KX²â…z•±³õÚ¦DÜbøw'• endstream endobj -5686 0 obj << +5784 0 obj << /Type /Page -/Contents 5687 0 R -/Resources 5685 0 R +/Contents 5785 0 R +/Resources 5783 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5668 0 R +/Parent 5793 0 R >> endobj -5688 0 obj << -/D [5686 0 R /XYZ 85.039 781.388 null] +5786 0 obj << +/D [5784 0 R /XYZ 85.039 781.388 null] >> endobj -1862 0 obj << -/D [5686 0 R /XYZ 85.039 545.55 null] +1638 0 obj << +/D [5784 0 R /XYZ 85.039 444.99 null] >> endobj -5689 0 obj << -/D [5686 0 R /XYZ 85.039 510.609 null] +5787 0 obj << +/D [5784 0 R /XYZ 85.039 410.85 null] >> endobj -5685 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F14 2895 0 R /F11 2898 0 R /F66 3242 0 R >> -/ProcSet [ /PDF /Text ] +5788 0 obj << +/D [5784 0 R /XYZ 85.039 380.966 null] >> endobj -5692 0 obj << -/Length 4718 -/Filter /FlateDecode ->> -stream -xÚ¥[ësÛÈ‘ÿî¿BÅJ] ÊÆ`/oÝ¥¼–½qv-+–\»©$ "ƒ­èîŸO¿f œª«­5çјGO?~Ý3Rü§.ÒÈtv‘¤Ê×iz±Ú½.6Ðóã %K!YŽh~¸{ñò]l.TàgAvq÷0Œù&Òwë¿yoþôúæîí§Ë¥ÖÚS™¹L’Ô{óùæRy·ÜzóéýõÝûë±f QyŸo°ûã§ËT{wLôþzè~ýá‡×\Ó~pù»?¿x{çVêÖ«Êp™¿½øÛ?‚‹5léÏ/_géÅ#”_A÷î¬ÓŒ–zõâöÅ_ÜPÜg.ø«9®D:õ£TŸ²EE#¶(Ut‘D†øÒå›âri‚À{Ü–«Ë0õ¶°¥,óvù¬A§ò:¦x†æ€ý©×oËxð…©ûmÞs “ï.ÃĻǹŢŒ²†2ŠŸ—TZóù -++ž²Ãá˜bç@•Yüò]¶¤UìgI -\ Íì.uèÝw}Þ:¦ž0`iÉ— -9šÑG}ëÊo…kÞô󅛚– ùª/¿ -;Lkl꺀¶¦î`‰™Š½ŸÊ -¶Sqw¿å=bùæý•¥ù+Êò‡ìú²ªdæ¼þ}ÏŶX`|˦U;Ž×À³0ÑÞ¦è±`ÜœX^·öãÜq{ÍüÐc~d±ŸªL˜÷W\YFv9Tä}r屄9¨”óOW@ÿZšV«æP åCÛì¸ÔoéÔ.–2í!ÉÛL´ËW LÅÌ%Ê% ܤö;Øk¤I¬BPÁŽųÆêÐìd–…/ØÑ·O(õæÀyÊLñ™|±nðXc1”ò Ÿ¤ª.EFA yÝã»'êž p¬mK¨}%5ÚH*‘ë‚”z÷9WÿDAW°PCÕlh-ßC5 ¼C'c. -`x[äÕ>QL[Ö(%éVÞóž¹GFo‹ºxD©/ÖÜ@¤´q8|,/g$…È£Œíiy»}ÿG<ÓлÝâØ#T(íXxû¯=jJÓ-7üBX7øÁ£U{ãEº„Çö›~¡Íàîø[Ûc‚æ’f`™ÚÉÍiR‰šªÁDÁÄ«\ŒÁšû`ð­ìŠñåé‰iì·í ÏÑúUeçƘª´XŽ$Hy—b‰Ò)ïòä z7×Ìl­lAÉÚÐ ‚ŒN‚Å·…yŽ½¨ÖI?í§ 1X‘ÖÜNì‡_´’Óq¸žóÏÕGt¢°–܈ë¨óŠ‰Ç-Ÿ×b—â©UOü7ëýßeÚ®Ÿ1aè«Ô÷Ô?(ã§i,uÁRa|&ckÄ*d"ï_ñ0ÉPèÈOãÈSÏMÂAXŠ[FÊûÓG„w3#‚ŸNThGœ0 b9°G~–,"`¡úßñR_¢ÛW-žLè5s ÊB?Îì(tîÚ{3ø8n­úÌôÆ•ùýj”úAh§éGªœ†}†ÑDPÇÎ$ë89µ;=Y$ B©«+kåSþY£ŒŒh–R$Œ(À3]† ÃhWŒö®¤Í}¦S@³Ó¢¾¿¶ä`“ø/x‚‡­þLÙ©B¢Õ&$ƒr‚Šœ $lìÜð_™kù[Ò!;L1£. -Ä3Háÿ5Ú=å=6í§×E¹ÙÞ_F -™£n*ã?ë™ÃTJJtº©ïЦ„À4(ÀF(£Å/è°oy¹x…Ý@Íšأd¤ßöT;ñ(è§ÉNp™Meíßéî3ãëØJê,¸³Uïûþ1&W Ø[”&~Ò=¥-ÍrDDP: &L -}`Š ç~ýµ)×,8÷¸q¯`O‹’Í8ªn2¦q2ø{òõPì-nö+ñšòŽ…mKrimSoÜ€†àx³F'¤•ÏmÖÒœlv"Æ(ªÉf– C5ÂE¡öFúÔΖ(‚³§†e)Æ"À̆xÎä€Èëc‹H,Ã7p/mÁ…yÓB$ÿ¬B-õusOûgˆXqñ=¶€f,©Š™ùFå#{±æáðÀ±ÿžF“/­@VÄO k/q[cÁD'¡·`'`5‹€ýàb»â1d‚Ø€CÐɆ,Í}õÄ øí¡`¢ž=>wùžûI>áws4ÃÕÿækÍåÃ`·ÐL¤á(Œ<µˆp7À+‰gÎ… ¬N’‘ŸÂC-v–j¬ @³™ná@„&¡%|^ξÃד79Ö¬ÑÅÐnï¨õéÞÊ2¶ß Þǯò³¸xU®eÁc’ú%ü³rȱu Îêp 19©ØûD:µkP¢ÜꀌΜ --’tÂÜuyåÓ¼m‚ò™JàÒOMÑÞ¡NžLhÎÀÌR`ú9û -¿±J¿a_¢gì«áÌŸ÷{gSíÊßP¢æ–+붳)öò­äŽk¯×Äx1Í'ä …ŽHxtw/ß^þz#滢TEÝ å†·BjûKMv§p×3&2˜×ÑÏ2ÆÒœ0fêÑ'ñ…É´Ä|$ïJK(`†KUô”‡€ÐÒå'Œ·hªõ‚‹¯×bè8ñàà=Y• ÓL-e3àƒ;V¹Ø%ƒx¹¨ -«ÆnâѬdé¨ù5ÅmVÁÈøí˦A3%2$óÒÚÐÐD$´KüÈÇ•²C:!“TJÄTU’ö ôÕ°Ò‚ĸoƒ_6A@0x¢ÅÍ” î¶pl5"ºê|þfq[´²-I>Ò¬{öm_à—Åw‚ä,1ƒˆ£K(€S¸jwÜ7ÆNxxþØŽy´Hg•ÖD¡ìóJ;":¯´–7úžuJrJlçÄ¿ ¡7¾#ϲæ8ÜÛý¢Ë™á¤xÒ~¢„üΖ»Ên $ÞÍÕ›l¤b_©øÙ=[š“=O±Q¨ý,‹&{¾B¿Ž3IPΓ\¾Ê <³Q~c=‚05¾QcHD¨!AԆ̌p‹´Wçœ%äú¢´ö‰)9„Çœ×Ëžëý–ƒ|#îµñΫ¹P `àBîÕaßÁyu;ÇÀ[~Æ_å]}ü€éq\È{(A½~ýá­à¸q¬š89 -­§sr‰)Z»4.ÄÔ0‚™¨×ò+ ýÞêdY÷ì]ç’ŒÀá$žO£é%Á!‘ :C -bÃ}ÎPWåÝÄv¯ûá(èË(‰.ßá© eÜSŒó,)`‚ße;$mejÆh@·`D¶ÊG0[DEö1›Â) ߸ÄF4õófAg©Bÿ¬Y7 –hdØ@­':>¸S²Ï=‡õS &?üé{.ßİȘ˜XgWçÂ)±6e/†aí†ÿz7Ô£œÑs·4'ŸÆ(iêFO6~e¤s°šoIàgêg¹ wŒ¿r’G§¾‰¦·»ÌG[$Unêßs[Ž0AH¥Ø âIyœ|1"1 -×P;¨>¿ƒ_=<‰ã “Lò,´Ç©üŽ2ô”e&ãm×tΟúPrË&„< -f]44?à@„èP£‘CµÚÃ,n]~iðÌÐ~ì™–ËØÎá 3+N· ΀V’Úã…^ó»[Œ÷ÈÒÂidÖO@Mº¶…˾FâPÈäc ñ ~r–<–œ„†@›Ûb)^D¾Ü5w Ñ4÷äI"åìQ„¬†ÝŽšsÛ‘Ÿžß$²u5Jãmì k5§È°¯!¬|•þÈ- -+ã›?¦ =øEËVr÷Å´/çñâƒê§ÒO8ó¥ÇXG±«fä7'›5EÚ †³ÆDÞÕh<—ñ"óOÖ˜"cmÓ( pWÒm‚rŠì43©‘ÏðÚG¾'à,2Ðz„?daßี5e=E Î;¼KÕßð Žæ·À4ȵ_‘#š‡ÒË_±xÃ6› âϲet€·ß«C PF›CË :m¬Vã „YìGÚ<·Kr¼é-î2Öã üìÐÉ -ÿÁ5š8„5RÓô¢âÆ\"Y“n6 ‹iM‹JvÊ@€b¯Fè‡Ð;›É6&îZÃTù±™æY)F’«)r¹fdH!$£,{WnjòÈÐ0ŒûbвÅÏìø€Êž€dG`ÀRPÜ^á’åYäIR…+ ²¸<ÚVíF&¦ðìPü¬ÎHº>µ¨ÿéV$Tê%Ý\Ug¥« -Ìš’ÖÕƒÏƃ"E~;M‰jzðAáÔ@%%bZào^’ZrŒ¿£4Hu¼ñ£ä:¡ÇÓ­Ž>M½½âªóû)·pB{Ë î¸g8iF‡u öKºÎÂ÷x½wÃå1~¦z¾'ìUVåòqšüe-欓ÏM”ÕZŸZ/z¥O>´  -,:"“ºáØr柉’£ ‚ ™o{Š›ö¯Ð¾$Np¨£´ ÿ*ÖŠ:ö.>î^îÛçå0ÈȯØëd¹´Iý8›ªä-=3!;€§ro -š/î± ´Ë®¹¼2V>¡ý‹Sï$o8¯c@?«fÃÐ:òº•‹ô÷ý‚û9ÔÅm.ªœÞ£4;pü†”çÉ-Ç%Q)$c$_ÍÈå©õ§£uEPW7½6>ëgøl£¿‘2÷3–ˆÒŒ7x ’'ßæõF"áë¦/žäòðáPóƒ¶ñ6åÆiðå(÷}(ƒ1Özvé–ædéG—y‰%ÑdéïP«èý9ºüâ&¾d¢à‹^0Ä°140 ¦z L³÷ªcž+ -&± µôYdn¼ö`“Ì6`ã(ÔœF‹ñ7„¡öÝVqKØz ¯…PkgLOßÌ>ðµ»?}WÚè"J½ÿŸ͢˜qÇí6Ú6ÜÆöÈ?ÜrÃuÑ?òýÖ—YT›¦>ù2o)|ùõƹç´Ã~’}C9Í3ºÁ4ÇlÉ€Ñ(O," —ѳ‹’ãEm^ûJM×€²óßòÄdñä¹IkŸaßZÙàÜPšlî8†¾Þ4thÂfz'Š…›ÖfÓ°ö ã‘¢ëÛrÅ(Ú¤Š¼áìÅÓÜá*Szô2$°6[°Yæ§&žhW[8ƒê¦ -ÁM®ysEG·Ø’ï÷b‹CôÜÖe ^ïˆM%,P/ê~€’‡¿ 6\r¶hù»Ïƒå]p‹¤“öWÑ‹ã#ôÕ9!<2øïQRöǶ‘¬‚†nð 0ÌyâúGðR€ƒþ9z¹Kíoé&,ýöGÞ¦áÑæ5 °u±Ÿ; ]r6$­h躗2á!ÉÿÉ‘©Iê\ùöQÚÿÌMú™±og^Ó‹ †cD!ÅG6M*g„¾2Ó\ûÝe\ßí+y„!ˆãæV–>u2tfIIÏyzÎøW6²D·]Õù~dôÎpcƒ¡™'&èT8<ž‹À9ÞñúY ×™è§ñ›‹ç |ÜîU…™—‚¥Ê2°”“Óoéü-¾>óz ŒKìžâ‘öãÍå=>šÈ÷ÀÅ@¥/BÆ@5¿µm¨\IÐbd°ÈÓÄêØiÄJ.é•}â-£Û‹×˜˜€AKy)ñ§ÇòÔ´l¡.Ý›¯)ÅÌz ¾DÝ3%|M1QsÏOsŸ¸­.\âSI€¿üü× ­b¾-ƒ_6M3RG K6asUvß:(P½ÀTÓÎûh•±™%½¡Íšá<Œ},ˆÑw/ç.ð&ÒÂðä Ðw<é¸(aN/ ’TtäÃéAËÚ&!m :<Ú>É+JZ† w]5ô i¥ù݆ü¥Íô¹$_ìÍdGgðµüøÇpÖu‰ÿ×_è¸?K2ÌÛÿïCe×‚Ì ãè䥈ü%ÏÉ‚ÿ ‚ÉBendstream -endobj -5691 0 obj << -/Type /Page -/Contents 5692 0 R -/Resources 5690 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5694 0 R +5789 0 obj << +/D [5784 0 R /XYZ 85.039 340.319 null] >> endobj -5693 0 obj << -/D [5691 0 R /XYZ 85.039 781.388 null] +5790 0 obj << +/D [5784 0 R /XYZ 85.039 312.614 null] >> endobj -5690 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R /F74 4586 0 R /F20 2865 0 R /F14 2895 0 R /F11 2898 0 R >> +5791 0 obj << +/D [5784 0 R /XYZ 85.039 271.967 null] +>> endobj +5792 0 obj << +/D [5784 0 R /XYZ 85.039 231.925 null] +>> endobj +5783 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5697 0 obj << -/Length 4731 -/Filter /FlateDecode ->> -stream -xÚí[ÝoÜ8’Ï_aøe»4-Rß'™™dwÆñÆfsó ·d·.êV¤Ž×÷×_}‘’Üjy°»À½‚¸%±Ä*‹U¿*Rú̃ú, •ç§gq¢•Ÿ$gëí+ïìZ~|¥…b%$«ÍÛÛW?DÁ™öTê¥g·÷}?¡ -Bÿì6ÿuñîÃåõí÷Ÿ—+ß÷:UËU'‹w_®—zqÃO¯?¼ºýxõ#ÞðP/¾\có§ÏËÄ_Ü2ÑÇ«¾ùòç·—|ç+oùÛí_^}ë$u2€T)Šùû«_óÎrÒ_^yÊO“³G¸ö”†æí+S…/÷Õ«›Ws]q[pÆoMi%ðµŠMx¶ò=•$Á$ö"•„ ¨.ôTèNuƨNk£|mÎ,êî# 2Šël÷§/ãE £/ä:Ûåò0ûVðU^Üg‡JÚ÷K_/šr'·õ¾+ë]Ë]Þ×Kß[4ÒQ½VÜpX®4siøŠžÖ;¦ü¥„–ùëÅß±ñú¹êƒ0ÛHÏ=Ö˜ÐiC‡m‘Q&JFÚøP/M²x\®ŒñYƒ2òõ>¯( L„1*J|P;Î]Joæ5ÉýÀ–Tvß-WA’záþz‰±/½èøI·áÎÑ›ھøˆ|²%?ñƒÿòB{î˜/[¾ÜÕÒÕ7|§häb’µr×Õ¶Ð\ú†Ñ½Q6ÀEÃ¥b¡oE6˜Ú‚F솚5$w²ðù'êøòÊå!ÙbOŒãIO-S³D ¨„,þ>ð«b¦BÁø2.8ô¬ª…šDÏ:D4˜WãÇ*@f”µ-–!ŒeÛ2áÈ`]yž%´bµý$É„YõGõ&‹Ëªbƒ3–k)äþº¡ЄR¯@;!tä“ÇcYª…®¿NÈl´ -#ßÊ,ódR0ŠlK¼P4XvŸPÎê‰9×»ž®¾‡ß$…w‹í„Ú•Ö0ÈIbJyÆWÆ·Ê{ÜÀL+7‰È£dK(v¹Øöô·–`W‚rÑbJðôÈÖpZ­i%8¼¹Ì·4eKsÕ%Ô 7Úß놧‹mqâ5œŸþ5Ë(—_žío ¸2¢ò`ú*n>°4¼itÄœESð+e;±r6Ö½P´áeœ[KçŽãÆZ~ÿ~ýæ¹Ô~ªÂ$<‹¢H3„dÕÓû?¤*Á„å»<â&Jû³¬˜bžX÷@bät»߇Ž g¢gvþhõ ->ñÜ9EëDŽµaûÁ'ÇzZF¡Y ˆ&¤Œ!ÒÇ‘ë ÅÔGìâDê˜åÆ$/0K|•ÄFfŸö}”ر«†U:±HPybdí]cø-š©5•hëTîk ÁyѨ“*«Ñ§¦Ù©°'šQ¡!_sJ…sܬ -g™Y˜}.6´âWëª\£Ù|E& ¯§$!…ÂE -È…ÃW(K™0ÞNúEaÚ:Þ†ƒ -iG^wÏΆoÐWxÌ2ðÒÅúmûÖ¾Àžnbª´ U…Ò?…c‡\—)ªbmÃ<ñÙq†± -ãd~Öµø^$ÿg¶S!èȪJB%è®yÀ÷ŒÙðr·æÈ ¹öS€Ó3þ ÕÍX”¡lþ)‹šãf-j–™µ¨³ŸjŠ<õWvE™ƒo$Æ‘5KŒJ°XW5‰J°X†Á'çë¦àp½EtØXo ‚nLòoeE¶È¬üºä¸85 Â4QAÌGŠÑ„b"žïzBż=+f¹I°˜g&†1dæÂEË  ¨ò_a¨òªYã6NK41f¹‰qÎ3ã2û¿Ža ‰:(`^…=ÑŒ -…h.bÌr³*œefU8`öÿc˜°È*³kÌ õŸâ‚¶bjÐ0B’H¥±³2Jbö4ð¦+9‹˜´¢ P&Ž_°¢žhÆŠ„h.JÌr³V4ËÌZÑ€Ù;²„lôWÏ.ÆHÙÅCª±ñcbMz* -µMù²»“jô=›ä5öD3j"dœRã7«ÆYfVf3j¤X38t]½›ÐjŠýGáK¨c¥ãôöD3"”-<¥Ñ9nV£³Ì¬FÌ.1-7h?òE^f£˜ÔÇåId×Rz®-Š=S:„ƒtTâáâ ¶Õ㸃ur;ØöPó/ÎUf*uXÛŽm5Â'Ÿš¹ŠÑqÂìj&'ÁMzÊKæ±MO3 mLhl?d…'Í+6³œÄbœÖ8vRv“¿ÆÂ’v* -ÀÏž¯ë¦±õ¸uwÎ/ŒäI\(„¡£Ê™Èc ¦Âü«–›ï 3m­"ŠTZ¨T²ãz×뉩ù}HlXg­A’’q´]±Àª©¾Œ€°‘š#.Î…Á‡º¦žµ½Œ±s \¨£HxbAcÉ7M^ÈpD§´%šƒ|³ÜdAÏ3“=d6p‘&¡ÒŒ?¥jÖt°c -ò»D¯—ý£-‘ ÄГOEXùi:ˆ:\Á5£¡}Øn·œsÀz-Ê{eT4E;ØØ*/ -l -\žÿØð\mÎo:àPÎÙâVÚ‹,ˆqIÐU§¥F6(÷EûQ…ÈC!FTÊ[™eƷΚGiUÞ7ƒÂúN -æüˆ!á7tŽUñ@-ÚßɈøáé=g€=ÑŒ -Ñ`žåf p–™5À³ꌃò{ŠÇ„zÈguƒ`üL íÆšâ¹€§ulŒÉ^ÐqO4£c!šƒ“³Ü¬Žg™Y˜}Ú¹ŠD€'Ñôý34Ôq1_ìÝ. ©0òme§gm«}Ž3¨2Ë’šHb ƒè%÷Ñ{‚ãÉ SeüðÏž—¨8y!+Í̞͡ØYnvöf™ÙÙ0#Ìæ’©À›¨~!€ù}Wo÷në1µ›ÞÚ žÖ¶µVƒi48ḹ\PU¹Î$ƒ«ÉNåqL¯wĽ Åçoíì†çb‡â /•®ØMC&àô€¾ؼG‹„Hß»æÀ—­µ‚[²»~j!˜‡;ˆì€ž)î¡Æ¼‡ -oä4|ڥė},hÈþ¿a·qQʼnP-î2WÂÓå»Ðu•9 àª(„úqþn3¡«ÁÐŽ: $’ѳŽKŠ pe¡P¨îÒ¨ÔòðêœK»SH -O1ò›”ù¤÷ -–¤è:Ž±ÒûÀºP0 -ÕÙ®›˜×WÒ× ‚Øm±µ‡£1eÔ yï¸mŽþxK»d&âl/&vÉb£qBñ} ‡5Tëöìà o¸AW몃†´a¿E'ÁFn+”ï輘×sÓhÒ%4x•õp‡u'm›¢uÛ»@aœà 7âö®u‚„<Œwº-w„‰:ÖVºš¯)xíû}ÍÇsE)¬õ7,IFûœtÉ;ŠÔŽÑèÀVjÚíZ×»û)â·EÖχ§6T`C° ¼ã„»¦ñS{ïž -R; Í5¡)îí“Ÿå¼’wUå‚{´K×ù`å5ü*¦'I$ø ìÇ=Ì>Çà:û²;€7½¡üŒÚM\§Ú‘:|Ϩ8´pEÊ_«%m7r~Ä÷)çeºt¬£ãäQ…T%±ƒ@Ös¢£ÆeWU,RiO‘D€ÚÔä -ÖlÔw&aÒJý@¥‘år9Ìu¨¼ÔÖ¢êf²åGöüÀÛÉ>YD1¾ƒ9ÞAŽö!f@ ˆN²D(Ä/tzN)Ñq&¥¢hA‹r#7Ûººu•Ü­=²t‡óv T”c]¨KiÌÁ8‹f|´ -f™cp+ç¦ìÙ'ª çtpêQÚÖK¶Ý®ýîè,T -HÇ gÕbiŽÔ2iž-óGjyoã-Û,@y“&#›E÷>a±JÝÉOû®D]•ÿƒk1á°!î’À›½àHù3•‹&Уužo°DnN°6¡‚Ôâ$ëZx^×6*u”Ü•¤c®YhXZF –ol]:ÈÖF -¹ès.óÚô2!ð¹á¶÷ öýÍíÔ5„vؙⱗHQ0ÒìûëxɉÁ)döv¥]g´ä-íò‚u -RçD¥A¨¿¢(69:ÈÓܺ~Ã8”ë³ó[^8ª‚ï ÞL”c!r8…ý!éþ±Œ£é³F ÌHÅQ<Œ0¨ïŸQ­k·ûG’Õ÷RzJÓ…=ÿ™B¶IÛ-Ã) Ç®•ÒyQ"Ž×s/ÅlGØþ ÂÕížV¼–-xþñžÇè´`¡²É3u´TßUxRme`Ù3j4‘ + ]oäô‘+VL­?€#´nü}Í‘Š²T7,Œ"£¤"DõZÓ–›„Àýƒ d¤}Ã)û‰àÒàX -v÷+ÆB+~‡šmœË?À®â4©æ‡eœˆ50ÐÄôv q¼AÍtù$ŽŒÔC-ì*7||òIŽªN ÆYpDéò†ƒHqr)B]äÏNUób…|/ÑõìÈ-ÍÑÈÇÐÒõØKF#¿y²Ù"æ]½XVR«Tc¢ÜÙ•ƒ ûã3GôêV‡èUÈôÃQIШÄw« ôh«€è1@£K÷ŽŽ—Lì©Ð­±¼î3ÜV¦)BöUÑɵ‡5›OÛZÇv¨*á› ±t(Ϲ°õ–¶PôâÏøc¸ÑbÌɸ¹Ä ’ZHoð“…48öé%ç X·+š]†è~Ÿj›BËš­\ §œœÏBOÚ“ÝòÍÕísƒñ &$€Ê`ùG/«™I<ý¥ÂÊvµêû:6+?Ä2¦¶üȪnу_Ò‡_nŽ¤èÿˆ|ÜÓ¼xiBG÷â}¹ºùòîÝ÷èeo~ÀC~B]êÑ>ƒš€ñ?ƒÀ\iaGÝ–w²ºM(jx±o8 wÇñ…†q?qÐ/ï+tü“óëòà¼ßÿ«v„gy¹œs»Mñú&ÛâÝ]†QEö,sfWJg­=^æ>uS2¨=·—“I-Dh/¶ñŠs˜•dÒ6TË£CØ_ù¤÷UQ>l¨*Pðñ†¡h(¦P€!YÃÇR 8^2^#A'ó€2ÛÑôÑr‡¬H ž›=Î8›uE«²àeÉPiS;GÍ+®Öø›,þĤ‡-Â#yÉéF'ˆ%ÆA3DÀöSk=U®Rþ;žÏì⺬AYÀ§¶ƒƒ9?B¼E© 6³ðÒ’M9:<7äò³¯e%Â÷¢Åê×ë©~¨B‡V FR™Ã‹qW‚Ô¨½*ÛN,–îÅZ'$ƒˆd܉&‰0ôî0™øOÎ09ÑÙèì!#PsBàc¬_øªj@tBX"äç'ŽHlXE³-qÎÛþã¨zª*‡û\®Jxñ-k.Ú}]Wm¶½Ë.ø…1k¢ŽûäÁ~µQÂ}ÀußÙâC‘­7¶ýŽäªùow2 #Õ€ÂçtciŽtó¬~(MŸïõºù0*h_j° zóÀ)T§cÌÊQ½ÌÇål\.MNùF -ÂdvÔ.þš±|Åi÷¡‘sruÃ.œ:¨ŸuÄõømÁµéÊe\KÄ’#Ì0¬ÜXó6ùçâ÷ƒ³í> Û©ƒ.ß–a´ g"–æžY²O¿Àz‚q.zd[!ÇÈ®¢ÁÝaÖJM£oÒðACç;è«ž7S’À¬i£í¥º˜Ìï"ëH!”$Q?£xC0'‰ùØkxh¿šI¢~Oh~–Æ݈Úߤ[9NSRÃè*òüÁ·oÓ&«(´¾p{àÊýÄçQ1ÄDã -¶VQ.÷µœÝë"‰»YÜØ‘²ßÿ1k±²ð#P±I‡þnhS+x …¼Å–3¶wœ[:¸à7Ní`18v_ÇÍÚ$ÿI`§›]°×ÇWþc²á¶ …6ÊH¶ÿöÛÓáú˜pQÞ™˜Ó¿õ}®û(9ð!lžÈ¥Bc”ÑV:’EÏå ýD…=þ_`/tendstream +5797 0 obj << +/Length 2451 +/Filter /FlateDecode +>> +stream +xÚÍYYsÛF~ׯà* V™# f‡«R)År"fËŠV¢ËNl?@HaMJ+ÿúícp"˜ªøeK%aŽžîžž¯É‘ ?ráªh„R¨0Í×'îh 3¿žHK1±$“Íϳ“³_Œ?’®ˆÜh4[t|ŒÐFfÉ'çÍåùõìíÍx¢”rd$Æ“ 7ï¯ÇÒ¹åÑë›éÕlzõ+ö4 Jçý5Nÿ~3•3c¢éU7}þîçsî)ᎿÌ~;y;k5mu­"TóáäÓw”À–~;q…ŠÂÑ´]!az}z +£•í¯NnOþݲâ9=âU‡¬ÒPL`g‘gŽ[ΗBûªµœ³RDÆô-g\a\M––`YØ®ôÀjƸÎe1V®ó[÷§.ø[¦ób™gßRîf°`ÁÍùvSÅIR­ï°ï;ób½Y¥ušðtµÏÖI§‚FµØ®Vð}²¨… ¢ã{ìhhÒ@‡ô…òi‹à[H +{´ZÙ#Ùz‹êÕL¶ÃÒó…ëiK¯žÆ^èÄøç¹O¼H:sìܧ𠜯8ä6Âf}Ï@J”Qg«¬¦å<ß³vÉb`­´"›-pÉjõܱ͹ƒ'^9Ÿ]©ÓURÁùi8¹f»4—§dù„{±Õ7æXfkT%­qÿ¹@DÄ!ò"Úx³ Ð)µ~ÁŸµÕ4^ÚS&WŠ‰{Ü—4_óxÃWÛz½mýz ~à‰L =š—hˆB¡Õò!Ä‹}aÒõEÀ8&­¡y!nP¼HIoGÞu™åuZ‚Éß¹(ÑÚM7ËÐ/È<éØ ’ötóÇ®6}ÝŽ‡% +4“†×ñ=xT$wöàI×°Æ€NÖÓ B+T 8„{5o‹QŠîw“´ÁDp0éHÙ8âÀD€µqÉ:h+­8)O|PÞÇÐçÁäï‚ñÕìÌC±ÿ‚öÙÇk†²§ D;PŽKöجNçõ¶L…Àå•'ÜÀ?ŽÃŽf‡–†l:ŒÃ#Ò:î‰;ŒÃž¼‡Æ ú8Än{`dðšÂÏØxà!Ó U_Å¿GËëøVe ŒÑ©€q{B›àñMŒ|9‹§mþBw€á'Å…Õ< +:´’âAá—,—»ô`)ÉÚÚÊ&‹ΩE Ûl^gh«7ú·VknsuS®”<•pÈ£e¥ÕqQ4“”†aŠv†g¶*â½òÖJ~kq›R\`äêYt-ïY,”6Mm5¦rˆk"Ý…8Ÿå ©“ágKÇ£}õII\•Ð`§8Ž¡íãÄ.Âw«tm'ÉE¬8Œ~«UŸpƒN€T ¾r.Ó2åE1Ó–i’ÑÁ¡ú`î"çñbqMk:.÷ž2–® >^m¸Õ¡ëD4v¼zþf×÷y•ì˜T×e¤ˆg5«É-‰ +÷8ìv5Å‹éˆÐªƒPøpøëû›ÄÓá<¦}áË` -r ·,õ^6lB¹Š g¨®6óuï¹BKÐÛ7 Ž$Û_cª­Ñh{»l¨¡  ºŽFsu)&éµIùnO4p6]ËÑEjŽzšZ¶“_N:á^Içà Bk v&Óš¯ˆYeo‘kÆbQUÀ·ãôé’Á@€Á‘üÌISPåS¯!Ñ0ân˦ Þ î°†K‹üŸI7ñÖº7·mî´€¹è mæÑÆ ñ•7ºBI².¨Ÿ¤t3˜^ÊtAÁ…| j’' š–¼ªË"_ÚâšÌ±æD”'¼†ìßœ24¶@*I°‘4 –˜½†gp«YZðÝu¡ºžZ«õ|7K:¯$}æö†¶ÕÄŸöú§I…²XsgÇáŸî³ù=79H.ï;‘¬Ì|¾-_ø,TXBjÔs¿ïmèÐÒ F“öÕ廀ùÀ;Z¡©\CúGße”)î¾Ë(û.Ó>´0äÁœÅÙAèsÛYÉ#¾s}7jsèã÷ëÍàk‹-ñeªÿÜBéb·¹e™ÚìÈ…ÈN”ãÒ&3Øeã}1N´5 Ï™uœ[rò +LW[[TaŠ²ß˜EÜrCLd3ˆ/o~âÎŽÆTö4¹°úJžj…Ù{À±ü')…ÇœôÉÍ äG à!«¦œÝ3Jù^ÄÏ8Ø(Úfy;µŒ9Û¹ìsÉî06s;ÆUîž…`æ?èúUͳ֣a˜Ã a¿ÚT‰(>»RY©u«ãO/#à ÍV>³+ÓCOS,vŸzº£Ç±ñÁÂYL ºÈ«×\ê©>¦@ˆV·¯weQÔp3žÙyjÄþä=ßM/ÞžßÌ.?K¥ñ—XŠGþnøî›ÇëôÀñqÉßÛó÷7¿_ý¿‹½ï¸Mª´äëý°>{¾ÜØ= í°Ò¿*êUYÍu2†t ¿âÇÏjWö:õó‰n©è™²¬ê.–™-‘¹Ú{Øv5gÂe^meœ2ÓylË<ìœ60³ø7oß“VòCE 4ºy1Œ=šÁèMO¤ö¢·ŽÞ¿¬Š±Â»ºí}ŒŸ²Rî­Ê?þУ ÔCøÙ’?ˆÚ38f¡}ÐŽËš»ñ½hê+b£Cƒ/œ¶ù–»¥3¤Ãx…·R +Û•8Š _· ƒUV…«j˜¸ŽPL!¹ˆ ì)'‹~Á†zßÚMp(œ*z8ëØ’§¹âÐjkOl—5“e±íŽÙ[[ÞVa~uñªwÓ±ƒ [,}ÁH[Ï*¿6÷'Ú±eqZÆí%Õ¢ÿaÛÈkÕ?†Ò½+?íÀ/ç»þ“Õ"ÂH¨€h> endobj -5698 0 obj << -/D [5696 0 R /XYZ 85.039 781.388 null] ->> endobj -5699 0 obj << -/D [5696 0 R /XYZ 85.039 679.769 null] ->> endobj -5700 0 obj << -/D [5696 0 R /XYZ 85.039 664.099 null] ->> endobj -5701 0 obj << -/D [5696 0 R /XYZ 85.039 650.55 null] ->> endobj -5702 0 obj << -/D [5696 0 R /XYZ 85.039 623.451 null] ->> endobj -5703 0 obj << -/D [5696 0 R /XYZ 85.039 609.902 null] +/Parent 5793 0 R >> endobj -5704 0 obj << -/D [5696 0 R /XYZ 85.039 596.353 null] +5798 0 obj << +/D [5796 0 R /XYZ 85.039 781.388 null] >> endobj -5705 0 obj << -/D [5696 0 R /XYZ 85.039 582.804 null] +1642 0 obj << +/D [5796 0 R /XYZ 85.039 761.463 null] >> endobj -5706 0 obj << -/D [5696 0 R /XYZ 85.039 555.705 null] +5799 0 obj << +/D [5796 0 R /XYZ 85.039 741.134 null] >> endobj -5707 0 obj << -/D [5696 0 R /XYZ 85.039 544.277 null] +5800 0 obj << +/D [5796 0 R /XYZ 85.039 697.701 null] >> endobj -5708 0 obj << -/D [5696 0 R /XYZ 85.039 528.607 null] +5801 0 obj << +/D [5796 0 R /XYZ 85.039 656.447 null] >> endobj -5709 0 obj << -/D [5696 0 R /XYZ 85.039 501.508 null] +5802 0 obj << +/D [5796 0 R /XYZ 85.039 615.8 null] >> endobj -5710 0 obj << -/D [5696 0 R /XYZ 85.039 473.804 null] +1646 0 obj << +/D [5796 0 R /XYZ 85.039 370.916 null] >> endobj -5711 0 obj << -/D [5696 0 R /XYZ 85.039 446.706 null] +5803 0 obj << +/D [5796 0 R /XYZ 85.039 338.699 null] >> endobj -5712 0 obj << -/D [5696 0 R /XYZ 85.039 433.762 null] +1650 0 obj << +/D [5796 0 R /XYZ 85.039 154.463 null] >> endobj -5713 0 obj << -/D [5696 0 R /XYZ 85.039 420.213 null] +5804 0 obj << +/D [5796 0 R /XYZ 85.039 120.323 null] >> endobj -5695 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F56 2890 0 R >> +5795 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5717 0 obj << -/Length 3357 -/Filter /FlateDecode ->> -stream -xÚ¥ZësÛÆÿ®¿‚Õt&`Æ;͇VvœD™ZVcyœN’ ‘H@€@Éjÿùîëð )5Žg ànoooo¿]ÊŸyðÏŸÅÆõt2‹bßÕq<[ï.¼Ùf¾½ð…b!$‹Í뻋å7a0ó=7ñ’ÙÝýÀǸѳ»ì'çÍwW·wo˜/´ÖŽŸ¸óEÅΛ·sßùÀ£·?\ßÜ]ß|‹_ úÎÇ[œ~ÿÃ<ÖÎ]ß ÓWï^_ñ—v½ù/wß_¼½ë%íe©ó÷‹Ÿ~ñféû ÏÕI<{„wÏõazwrº&Ðò]^|¸øGϊ炯:§£c×ÄúT-¾©Å× P™Yd<×xéå§=¤)ª¹Š^óù¾Û_æ •xNKŸë®¨+¨ïñœËoô˜o¸Q˜€$È°Ý­Üu] ÝdÿÀ¸± Ü@ =ç=nºÍ›Ç¢Å­rÞfï˜Ù·<e)2¥U3]ñ¯Ñ‚=³k®A{ì˜h蔾sOˆï[öÇÁÙôPvTh<‹¦^Qd9s”û´Ýr6•‡¾vÞlÓj.÷ŠrkÈ0©\°†,³-6¤½„%H;nÙ6r<—mΫ‰¬åQ´'|Šcñ+›Î’1ë_*¹jÔ´;>ˆ¡süAL}àLÈf*¾)²7Ðun ÏÆ•¨ÞÂð½W8®£»¢¬L‡ã/Œ8(ºDÃ5üÐ[ÎTÊC¶Å\Éá$(âŽ7p%Ÿ–œ±N¼!̺° Lø&kÎà š'’ÀÌ¡ákO*š†–> Y,± -\ô^…E˜|M„¬ ž@¹­›î–µÌü¦¦X¥œëÑÊþü¥H"ä¢väô¤CüÖÑoX‰qœLž—S£ÂƒümĶuÛ]2%DÞê¿nŠ‡Ísßöâ™1?VŒÍ:6T¹•÷hcESeŸžâq› -êƒ5~ÐEï÷6d£ûÒ8{2c-†çh.i³Éù«êÓ:݃EW¸{6Br …è¯Æ%»‘ªŸE])ÝÄ^F]#¢çQ—%B|W# yüQóóšË%ƒn½ˆ´œò!Ý­R8yóÀ7þ×cÁU’¸!„ˆ—·4'‚OŠö"×è`"øt”DLÊ—`ÛÆ,’>–ߤX™È u$…B—H‡foBgqÏÏåÃ< àR—e½Y¶‰´€ƒ_.yÀñ1´œ–" ƒüŽ#äÏžñzû ¢ˆ¬¼?ªÜÆß -Ñ°¨©8@8˜O²¼ø#­ÛSØsŸ0úá“ý?ç”ea£.ro{ìP—¥õ2$ÃÜI«0кZfvÚtÃAÈ=£Ý©s5…Ž vÌ@aÎG»ó|xÍrLɈÂx€\ùTÉ~è‘%È=æeI(;E ,¶îÁ…·ü9…®;ê¶èl ƒX¸á,— 7 i5OJ]£NHçT°°¢ý!MèȜю‚&ù¢ÀÑçPüÛŠW2J @´Ç0ð>:3#Ðñ‘V@œ"ÃÃÇïxE'ë)‘êPÆ)%"Ë’‡&–Ö¥f)ǺéÊ@ìD„Ý ’ Lzü ƒÆ®Š|#>@y¾ç¡Õc«%ÐÎÝVÊdcƒnË+.±½€Kèòp|Ê<ý%¤™ÀÄ I}.ÏhO¦ø>òLdQŸÉ ¶§<€¹Ä˜á šÀÕ«HÐÆÓèÚ)ÃG‚~ÆKœ¯)|! ­¬ÞÕMny~3h4@^[tz*@–¯¤Êlxv€I_ ‡uYÓC%ZŒJÍ딨øv³ñ˜b`¹ÒÔãpp.o‰v½0y9oˆžÏ[–ˆ -T>î:­¾"™:ùQ‚Šœ{²)Ê^C¡ý‰ÿ# -~ËŒ¾#¤¶X°3RÿùUNÊ ]Cm!µý°É)çÛ†ÔvÔÇ…hŒ)eà™QëåHJ\ß÷_Ô£¥9ÑãQÌP®‘ J\£Ž²hŸÀ[F«j#œ­©¦©Ë¼bÃhÿ„a[éѼ>õNoâËj€RØTA*ÆÆÓVÈ“Ýüˆ!~­l1|Þ¡Í/8¸(7™ÖòX¡Ó{.n„Q 2ýniŸI‘;Wª€`t¥Kóì0ùƒ31'ÂשµlCY_Ø«0G ßԲlj›;þÊê]Jû7Øn9,°‘4ê"®Œ¨ÊÀï'þj Ç–+1òŽ--{ì( (=°ÔJF‘ ò|¢È_æÌƶ äU˜ï%£)+ëšOO¢’Þ§aFì‡2–$W#¨ÓÖ‡f\ sÖvhû$Þ¯ï£'pئèç‘KîÜΡ#Áš¶ØT Z‡ ð!Ø­ŸxYç ½+./ñÙöµË¾÷Ù£Û!›Jz±4bÀl)w‘%MÉèQPŸgè—{O¼ÆÖ– ¦m!3¡mËðåÃCR{2+^äü½Þ`~D¢{éd|g¦Nw}S™ -»û±%&È9?j3ÕEÓtyFJ¸Ó4ëq¢™X$sÅ-P×òIÛín¯mHáLÎþ¯¨•v®IVIVA<,*~^¶Û!\,vœ³œ'Yľˆm,ª¢~2LÀùy4”ÝP½5 ÷±$óVر*™æÞÙc¯†sg戗IË€Õš˜e/ß½5v”ðJž[[hñ•#þz&çëÈw}õ_~!=Ÿó- ¼Í›ül¥J¿dGÝÿ+Šò5&rÏ&í[̾uÛ}X7¶ë±ü5Ńý`°g`.{TC$ÀŒOE¹\~OXömšeínuyR -cZÖžyQ/–æD/“n<˜ŒõD/Ûs•.Hå»æ|O -‘²|ŒØöLaB׋}[c¡Æ a€>,®;³!^‡¶@k°0²n†È%Æ¢þÌ#Ò6³``ìzÏÜRȤ»+ö’Lr®÷„‰ûŒBä<P c"g¹|ĈH•7æÛ18„Ñå´1ö#Ï BÑbuF®ÐU‘’ù?ó¶‹ø Í!oÏÝ Ü¬FÃÏqP.ˆGÑ?*·Å&•Žb.­°Ïyåô§×…Ò‘%É4fhõc.Õ¹Ÿ`“Qg¥=HÅS {‰ÔNG'"Ð,Ùmr¬À<ÍŽûõû×oA²/Ïìc7ÈjTZúTÁñnór…Øœ'…‘× 2ý™9q•o9~º¾ ¼¥wÞÆÁ?×ã^‘àz -T§¦è´•ß4ðºŒrþ g@{Å‘ŸDÇïš,›~ÇO[ØFüó‰GEXÈá¯øÓ[04‘O§Tàz½~éæŸó3gÓÚŒ¢=c‘ßæ`ƒRàÑ.ñQ¤¡d§ýåðÊœÚÍÅaÆÚVéÄwesA̼o«œùƒÇPå˜ÿxcDÓ'ßMuI¾ë‡1Iæ'.þ͆ïX‰Ã=^UÐßS6€ Ž‚åÜùáRÛ& ùù ->Þ|¼ý é…‘HgÏC(‰ÆkŠëÛâ©OÔµ…àúÜA!…«âºyfVtþýQH¯L°÷X?SL¥Àg’™ö\Åw¬Âè¤v•?a¢‘Àÿ2†&endstream +5807 0 obj << +/Length 1851 +/Filter /FlateDecode +>> +stream +xÚ¥XKoÛ8¾ûW¹TVŒHŠÕ=¥éË6õ6.²@Ûƒjˉ¶¶äÊJ²ý÷;á¶çP´°øÎ g¾y0Ü‹à÷Œb‘L½Äp&ñ›IäÝÂλ w¡# 4¯æ“ó·J{§Ø…HPjS$—L£ Á^èȉA¨TäOaRîšl½†AQÞ‚ñtâ7w9 fä~µk®u±mhíu]<ä5«’¾}.ɺ€ŸÝQ6O¤ J +óÌÕzšc,8"Ñke¯v±jZ¹¨\ ÀÑ#Cˆ,wDâ#N°^m¶ë¼É—à‰Øÿ…P©îk¢XÖx“\ëØÂr±Cbî#ó:ßfu¾$y+X¨œl2 *'­mÉ$HýÆqh*¢¹oÕÌÁ)qªü÷yíŽgí ch ›|»CÛZ˜ ˆÈ½Nÿ Jøö²ë%(Âj^¯@QŒ»ˆzàTá©Ç5®Àjv=+Ñzĵp`¡‰ãú€†Êh|6³JtÓå ,Hµ›žá¹ñß&öëÊÉψÛMQ: 0hC«8n/ÖE^âbn:G"#³˜ÂÚÒÙ +ž+œçX3BF$;çÝ=_ÿùt…Ë“ÈíI,pc>.‡\G²eCyž'‡Âx%C™SÒZ’Cq{qÂ9¤"¨8q•ƒ¡ÑÙ(pF„®Ä ŽÇŠq%\jŸ›¼Þ”€X@3ŽnwG ÆÕŠ¾×efgðÂɽÊ‹6 ˜úG»XÜÞ¹<›Ü¿C„‘ýE<åž‚ʆŸôÏ€æiµDÏyè”ÀÎE‡G}4”h3™¡ )…àŠ­bÎNU¹pm{ˆ¥ËWhí sôÏû|×Uù¤õ –GFž¶^OsÂzŽèYëØ[ï@â¸õWL.2â-¸íØb"¼´6ÁZ¹ ]‘ÝÚ +ò_nÚ|m|L¨iêRôÚ®/š‘pï1  ÅÁÔfJ¨²”ÿcc‘3“¶‘9y„)têQÛ^]Ve™ +åóÃŽ‚kGä²½Ò^ØC:/ð÷ÖÙ¥¤–`áƨ¯Tl€”‰õ^¢¥œY[ãà©—]-ÂÉ=åXìf™c•0‘`GÛ’± +ž(ÛU$Ú_å4 .‹ªì:>,ÜFwNÆŠìHï*¬}ë%qúNŽ§=ǶlÏ<ÍhÁºMWðt0ë«Ò‹ÝˆÛ¤PLF-Ö•uZU.£†àØuÐÊ%"uÎfµíÇH™zwæ,^/óú%à + +êÇ’¬ D§s õC7ÖÁË®L +èþ™Á[˜†¾…­ä0"Æë¶ö"qF;e¶i¡‚« Šò:©WXø)¤ûcC©áѳ_C®2Œ.aòL„Z[–9x +,•Ùynkr^‹ÇÐvÖ²]…¶xŸ:]l…ÿEãÅ}]w=©íCœÕ’„Å6§õp^d®¥Ü&ÖPRjêù`~fbEYe6ÌCÒxiÂdlžHc/€°eö¼Fò_Â!ÿñV^AðH‘Ú‹Úÿ±ÌCÔ§¢ÐÀÞõŒ¢^â±?]á h5ÕåÌ%F»BM<ò¶§´Æq߬\Ò`—·£AÈHô±uÛ5Äæ_´ãwÚës6ldÖ oí¡²íÖ¾1™ÃQ0ûá7¹à¦‹âGÄ€mt±Á‡Gj—'®Ä¬‚ƒ±¸G¶.:`„BmöÌ0Ïá™Â‰Î›{EpmÿˆCØ,W·ðÂR@¼· ¢ë®û¸ÿö8–£9S‰îÅŒ…‰fRË.ø†)ÅÆ …A*çûaàB»þµß±uÅê¥íÂÉ0.Í8ªuAŽ]ˆIˆ )ÖÂpí¸l¯ƒîÞ]ì©ÇcÄD:þðvø­‡w×èÄ’™ŽGÂ~š·ºØ ÓGMŽ’†)üƒÊ¡ÂÿÓ› endstream endobj -5716 0 obj << +5806 0 obj << /Type /Page -/Contents 5717 0 R -/Resources 5715 0 R +/Contents 5807 0 R +/Resources 5805 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5694 0 R ->> endobj -5718 0 obj << -/D [5716 0 R /XYZ 85.039 781.388 null] +/Parent 5793 0 R >> endobj -1866 0 obj << -/D [5716 0 R /XYZ 85.039 288.115 null] +5794 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 667 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5813 0 R] +/Length 44246 +/Filter /FlateDecode +>> +stream +xÚì] C¤,FDPP@EDýÿÿòtëê½êúØ6+殶EEž†uM’äöRà‹JŘäHÉ«îƒÿh—Š1ÉçÍ',$ù¼°$IÂB’$ I’$,$I’°$IÂB’$_…Ѧ"N’°"ùœŠ8ÉÙÄ/óR:T(®æX<`ND*ù$gKù“ÎDäÃîHs ¼“ +Že*ø$§“–ö7¹ÏO=K‰OåžäŒ¼PÞä>D_þÈ8JPHò›yá %©Ð“üf^È/XèiÈS¡'I¼P@i)Iâ…uÕ´:¾–M*ù$¿š†åPš;L$Iòkí…ƒhšvNòÛí…‹ýŒR¹'ùrÉÝCÉ¿‚úÄ +IÎ }(Ó«x¡¾G‹}ÿ,Ù=tŠ‘ä"•~ ã«x¡Ëîô)þnWë{^дNµä[Ù -+•\×±í[æóQªÒ¯Š*¿Z]Š5méZß÷šy£›|uÒj»6ªä£‹çxAÓ%•y’sÊs¼øx±bN¤Å“u¡¡Õ¼&$z·ò†à€±_ ®à˜Â.A„nëÌ\?Í )€X’ïÇ ‹µžW +C‡Õr7ÒMp°1ˆÚè” ^ÃÕ¬s0‡EO›•ðÜó² ÙÚÐñ)^¸ŸkÓ}*ù$ß…´Ú’®#-Ö[KeF A¼Þ ­ œ­‚«µS§p¾m¾×BÕS¼Ð_ 0¶’$ù.¼°D,䀠›>±#5í”ÒÅH-`¡,ô=P£ðz‡®´ÒíÓöÂ.Ó§iJ¹€oºâîôg.û+9/þÄ™z›¯h"ÿpù÷ôÊ– m×õ±€AG^°žBB­Ú{,”Š[öwXPœlñø¤½°K÷yŠ÷Q‰{CWÀ×ÏŸ^ãÿç6“½©ðϬ'üѦ¬ðW´©5%†w<@Î;MÛÅ <²íËÑ2°@lNxQbЀ¼å€XÀý†Ñ<ó¬'ÐNBG ›¼Év,ˆ²ÌwÍd,|)"D:Ó›ÇXØ?î±0ªý]ó¬/ö»‰qŒ÷é¨ÈöÛ®¦,÷<ìqîj÷ò9ËÌïã½³ýÞyf`AØòySŠÿ½Ôž\–{&Y¿í§½Ü+«ÍÜ‘9d+÷‡ƒ:jØ}æn/‘#w±Úý áͳ=9Ï÷ÇQt„ßæruÞlpFqÜÎïä×­dðöÇ‹Ž*溞~%)/UÿOeÏó¹ò”Ø–O5›ÛY,ÙšŒQe[ɼN¾“qÍbÐyŸqhsLàõ[r$”ðÁÕÚsáÀ Îد¹—ð q̃‡¬ `ÅÃeõ„9o òdÔpä›Ïð‰Üjâ5À›5æÅãÑøL8[NèŸh<Š8çR? d +¼°RµVœ ÄÝÀup=Cp%jãYðn3Âñ6®#là\̉\Bhø£ýE" Õñw€L¦¨äRš!½V7Å®å—ÇÕíZ`DCCçQ­œb‘uëÆá ùxt13PŽ±KQåø-FΡü^bá=Ç ÃuwչㅙÞ`·ž8ëQÑÅÕ¤8@£œ¡ºñÞŒž±m/ÔäêÁó.àôjoßC $‚q(–Ž‹œÓ®Ï`†(÷ +:ÀZ++"ƒÏ ØQî ·  Cb8®ã{Ãg ç(` Ÿ$uEEõZlµ?bCñ¥‹=°€…À䢅ÃgÀñ}àï^ Z¼!;WuÔÀé˜y~ÃÛ2ßo\QøXá2'ÅŸIД=É›CA&¾%¡ªðXïVØCz ;(š‚âÂB¹ãq~IÅ¢X…ò!ð(=$À^O¿ÑnLBøÃ/Ï{¿ë37õS Tþ­ŠX¾÷wX¨¢Ö«©¬éÎj²\Øš²26qhÈ>2•ƒú$\Û<‡3¡ÁÄX@Cß­ƒr¶m.bažç;, ti<\“™¼UÐx¢5ÑÆw„{_nká~~œ©hèÜxͧÞF ùšïØ\Q ×£…¶\ÞÕ†Û¶-^Y%?´?h¶¦¹ÇB¯ž¨€µkU <‡¡º-,©U®ŠÁ5¼‹·ŽBC¶÷™³¨Nî'ì~u”T$ë¼—\½Û Û¢h‘Åb)r‘>[”¡ØbÙ-` ÚtŠ÷þÆËÙoê§ZÝäf{³‰ð»ÃBlM m¡‘ó×4N¡íÚˆÞîíT†SJ²¨$õ(Æqò9ï/cjpøÿöB ‰Ôí™Ó¨SA3,Ë ÝqÛrU$ÞÁÛS:åãá‰×9æšÑ&Ö9uvyô=A÷MÍŽ8Fæ†~Û™¤YÅ ÷Ðp»]ЊÂþÄMF·üâˆÙdü¢ÅÃû@Ñâõeà V <2‰º ðÂŒ-¹¤PÇÕåm€2¾Ó EÐìï”·õäqðèroü}ñÞ”²b½ò"¼G‰ïf`WBË’ÖÓ,l Ñ|ŽŠn>*N¥Š‚;bKˆÖ Ù¾ÓzåããH¦¬¡W帴æX¨ŽÛ¶šVY>V×Ô´é ¶Mšý\È» )aâ3QŸ”P9èžš_Å/X(âî Ìi} i `/G†“e ÕH3³ANॉã:ùÆ ˜\Üg®ÝªÉòâŒéþ–†µþƒ…•¸ZnkÆ]Ä‚ˆLOSeBiË®ƒ|Šu›”[â…WÚ ·ýÿ +ZÆþkÛ÷,V ›ë]ꨌ¼^´ÑnPP™ J¯#4h4Å~:‹JòÎ)‘¢.4>4žóBµ÷ÒaŒ*ƒÛ>â…ý¶tWÌÁ8ØJÂ"ÅäÑ~ÍQuÁ‚âÑd¨â=ñ m©Š{^ãènÉ}|°îTGž`†.~WÊ÷‡ŠpÔèöé ØŠ’ßcá £‹>#Ž·žàXl㣙Œ›?¼bVšíb’ÄÁçˆÐU iM¼ðúœO—…všG# q䤢XWОÁÜTˆMëÔ•&¯C¦h¥ã8¢‚Ëô#^ ‹æäÑ8ÒÞ49ºX·HÕTå”ô‡¶Û·‰X äþ¶ Ê÷ ÁØ‘µ@ÛhPÑn:°àilÔSÝA‹ìšéÇü Ðò¦îÐÅaª D/Ñ`…‡ÆNU—€ÃÀ}ÅŠ*ãñ]FŠá!눤ÇS%wv®¸{Ë;^¸Ã‚k[Âk,PŠYTØúˆÀB|'PÛö‰(?MCOnz.ñÂk¥¨ƒzïQP:¶!xË\¡PCÑéú.Z„!è©\Å€Bµ­Em^¨cÙåùP.¨{ýUM†ÙšfÈ: ¡Î´^{P©DûxÐÝ'}ÜvBa(ªqÍj4«hC4C÷߃Ëzÿ]@ƒ[mõPÅ(ºxötWÒpü©Qè‡:û)„,N TÙø{¦« +¨†du<ŸÞ?l‘¯vz<Ú,æ u…:ø¢cC±öñ²è?©Q¹¶Upã-^½gÊp’S+*(¾¦‹/ —–ó~ïßÇ .?-/üO:úc2]†—®3¶H§5ÉxaySˆ£ü ±P%,ü iUÉGxÁÒð¦ó¿ M÷ÃV–WìÊó)K@ø/ JßB _É I’|&/XJßF I~(/„}&3ñB’_Ï Ç|û[\O’üL^@—Ä I~;/ôZó †1ñB’_o/¼µ£O¼ä‡òÂÛ;ú„…$?•ÖÄ I/$^H’x!ñB’Í US¾Gpý–ëzœ°äìXàüAdŒ7}Óe”—©¬“œ\„¿‹ŒññëN"mqžä§J2’$IXH’$a!I’„…$I’$IXH’$a!I’„…$I’$IXH’$a!I’ïˆo’$9Ÿ8‡qã[švK’ätÂ6<¹ÛÞRšTìINŠŸ°$IÂB’$ I’$,$I’°$IÂB’$ I’$,$I’°$IÂB’$ I’$,$I’°$IÂB’$ I’$,$I’°$IÂB’$ I’$,$I’°p÷T ðëéCÏ8.J’ä‡aA2¹É§± ãÿ¿Ä˜„…ÓŠ4ò¨¹ø7ôe„ý9°ð‚˜õ¡]º'‚ÕÌPÿÕèeVŠ©ê:—ÞùàÇftlkmüfÛ­íht^Þ6…— /‰èÀ- ‚9á¡ÙÔ%óBH?qScŸÃ÷ÍYA²ÛòyYg‚HMïtP°5§´2¾C@Ý’,ywQ™‘¨[™°ð‚8ÅÒœÕf˜ÑAc&T"bè  sÍ\@²]P¾À¤é–ªò©íM w÷…âËZá¨Æây…„^aî4ÕYÏçØ­Å~ÍÝ"‰Û3Ç^Ž Ìy!)ä8ØÞW<`Rx„_6„gŒÍÀ]M¢]>p„xɃç:kšF¦Æw2q/„Cð]ı@r·*:.d¹šÛHñå4ØS¨3Ÿ SÝõ†Ýhb‚³zš3ó;±°IÇœ!sË›•ñ¥äãÚ£µkÁ³›…ŽPž/y^£‚ªµ¯òzÉ%PGj{g£èÈbÇ/™¿ðB€ºÎwtì)R…‹­ÏdªcßGpÛSN1~àÛÞ¶#ç¸ù­XˆXPx“¡™8 ½ @Mä,óšŒ|”®ÇmÍqåsL…SbÁ´›|FT÷¼@ Á¼2F¡K#¥X¹&k¨rpBOKPzûM1¡ÅóFKwƒ!ÂScZº(ÌØ˶^D¼Ñ\DÄBa¼"íV,œ»„…Óš Ä€!ÐŽ®»·x]WÛ¬ó¬Ç¼ˆ£ä‚¬£QM¨OÆ#ÔâñH@–Û[0þy± É,¹#íÞˆW”­-^568xƒBzÔ@å<'³ù¬öBëe®©…ÿÎ1^­­`˹ÉGÚ»Ùv0Ò´,Š¬è)0¾Æ5mbB ù«±¼OÌfëkL°Î0 ˆO³…H±Ñc ÚL"Œp¥¶˜4ÓvFb`„4¶çµÈè\dÝ'20F͇¢™AÕÀà ¨¾à•Ëð± -¦]žñJB‚çüb,l›µÌºq’™LÎlª—­µ#€ŽÄnƪžf9Æš,Aá”bL)ERº>éàB»ö/7ßyGO[D1ïóžcNL›¾èhf\O1ElÄ¿ q¶Þ¸½ 1NÆÁ%Ã$»ø`Ä°§ƒqÆͤáÔ³‚akÊ"Ö—³Mc¡Ê “»4„¢lÚ½5È-+­ÜÌX6L¶cl˜m<ËØ2ƒšoCaÉO5ɧW¸1÷#ý¤¼×ƒÝbË.‡â™‡ãÒþûr†LXH’ä–¦MÂB’$gÁBô9Iò@ÞÝWÈTv2¬×Ë̽ íT%y(ïu70Y*»ÉÂÑsSòÍXcYKÿîÿÑêSèNýú’ü`\µüÐ+&¼þÆB'm’{!ïõÅbN„…Ä ‰/$^øòÂËv,$^H¼ðueçNe;'^H¼x!ñBâ…d/$^H¼°x!ñ™äcó RâA°ëa!ñBâ…¯+»Í;·#îÚ6ñBâ…QxðGb&Äõ ½»/$^øJ%I~¤àQQR}=,$^H¼ð•¶³ûHÁ׫ჿ/$^øBZèÕ»÷ìcŽà¡J¼xág” ï·™©ãrçd/$^ø…7Ú\ÝŽ£[v5,$^H¼ð=mçíÁ^»‰/|{qî<Õ˜x!ñŠQÃIö»O¼xá«mg$σ…Ä ‰¾PZ{žjL¼xáKKOž ‰/|¥íìO„…Ä gåÆ>fVþ¹žmÏäô¿[¼ó~xP3t,Ù ÿâ…}«»H|?þØÚg†ñÿw‹?_Þ²ý “ì½ö/só™lçÄ çä&ë¡úÀ¶¿ÌUõ²_/mÝVÕ9ýÿ¦!—Ç‘YÿjÊ è½;Pl×Z~xáóBôÂDP;N8Æœ„¶ F@×I±ƒßqkT·“1ÆûX‘ÆÅM“Ž„‘£vÝ<çåû¶3nßDè¸èîG®Ò8‘Í£ƒ¿‰jÎÿäiFìÙï{×8ã…”B Ædt¡ê½SfŒ ‰Nj/øyšQn†0ÈVÒê±è{ø"B“¦Õ5SåL_v¶qçlú˜Ð4•žC"öÛ¼,èP°ú07FÚ¾À-Ü"´ª 3Y©»QmM£‚öÁ½Ù:¤<ä4 MÙÈÙ5sPfSMWÛ±®Z抺μŚ¿›LšwNXø§½`ʬ,YÀ×#í}F›ž’¿à#©ñL0k ¸Ë…Ó&áÈÌŽ $ôeYBÍùH(BT‹šÏ„6£Àw¹EO!§ Š‘¢mÇâ*Ã|²dϺãx®âÕüUc„ãYµ(1|”^Ú¾³{7Ý’ì…„…Ž#é …ŽyV´;ÊuÄ A¹Ôr&N¨­Æ2oø†ð&&l +æ×›¡_×0{ ]­šl8äy‡7/ݻǑ¦ß3Žôêá¶ËiOœ}ŸtÕòFãH±CÓf&¿ã¾II´âõ¾„¾Y =6áBδÑÈè± í» î÷$G•÷í?ãüdÇËÝâ£1xјyÀB¼¨Ðºq—rb¨uØØ +h°Ðå mDOF¼€?6]ø‹æ^=.xièOŒýÝ'µûiXø×¼sÄ‚Üš;^àÖ̦1í%S„jD²¦i$4sæÈ‚ºœì `Eøûñ$R‰  ÇCO+³š’K‰›žZÀB¥ñæbáÈ©ÜH,xÀáÝX‡ ™P€…%ÞìC Ne;&/0YwSõëÈ 1Kf–Îýÿï’dìלw­‰{{ylÎìåë±ðW·ðO^°”¹Âò‰–%rÅ Ò­–aÉ_ ƒ\ÀØÅŠòBt¼€sÆ?X<Í ~FPmJÚ•|\+n;ÑðqÀíÀQ9R¸ b¡n¹^Gïð‚‡ÛBë52©•''2ž2!žîSã™R^ ŸÉ 1RA»¬8"çà‘áçÁ»û#V¨0HË òòÑÀ4$¬ûfârÄýW:06hß×s]O­kø¬@Áx%˜-Øy± ÕÁ×ÑV¶3Â4wDPÛÇß…3úi<0&†±x•W³ÿ8l}ˆXááe#ÑÒ¾4ax†˜k>€o»Ù‰*äŠÎ1' 9Hˆ:13ØÎ$8¹ä™ï‰ÌA[céªúï†ÏŠ¿;½¿ o ÊÂX°oÀ ›Gó–›BƒÛT![•µ}:0ÙT¨¬4 ¿Bø, õì} +¹­ö»¬:î< znÜžY-¾ ‡µæK :†×¼®kŒ7À‚0ÊÑìcüÌ9(°ØYÅr‹UÆ4o6Q-ùyaƒ²é ÃLÖ[kÍÊøe,(A[6Ð-š¦ ³vo.ÐÕK“•£gíŸÖ$¡?÷Ö²x˜5¥5£”M?º?xÌÊÌ°vÜâä/–E9õ…‹_à'fÎdÖ&žÂ¶±‰f+Ëö#A 7£ÿ^¿ -þ{ˆÖOOt8Œ!å|Xü7àPFˬ¾ º‹•·|²ÃW7à@ð–ÅÁ½ÙC‡h½j-´Î`¢eÆëÝ<Ü;€”ùb%‰I‚â0‹X{Zj"òÜR-H‡å­i¦Ò1ÐãuÑlY&eÖlÎjÝBCSCã-"ÿëÁ^á§ÊŒ—†ßRz8;’)ÔÇ>¼ÿŽGØEMØ 5 +ß¡Ý~öƒ0æþøž«9®€Ÿ»#ätŸx\3z'1üÍ*®3>v’ù¨#Hï ¯ Úû8Qèàã˜pŒÊÑ~ÃÚíSˆ1+øqnŸ#<~Ÿi ÊÊ7´_KR`±ÐRP:© +sn*;Ôù:ðÏ« ³ãÃÚòPÒl-Æh¶Ãª‰CX®u´ô˜E_íÕ¹óÂrÖc¯‰yË'AºžsZtóÎ1Ä1æt>0|}†9'…\ÓAQú?Oˆ·ù©š¦~—ÁÄdWÈ«çz5­óïƒ +õú.cÝ<+W Ch +>¶Ó¼d^éiž€U=÷Ž2<:5×%1F)©ú¥VF‚&«ä™xá0‹y+¥k±rÐpF ¤Š«’rÔ€V„§À<«3Ú˜]§¥xaè¼Ç`…!³£.31f`o¾ À 5žºšc£y7-[G:EõVòfÍ€-xá½ÃA¹ ÁòlÕ ±~{+/<*ø—ëêÙI+fþgy>Ý“þ+Éöo,@5+Å[¯xˆ®hßPèxÖ·35˜1­*Þy¢sèP>Í4 $Ž8B»Žö%TKî›Ì;,(–#Ö°` ŒW>ëí>Ï kÕ\ÐÆ „„U3G[4Ðh`!÷==›¯¾zŽoç……LB!tüD%ØÎ<_^Óe©)>9T£Ü±@ZŽ– +ãŒUµåq|`{?/lÿS¶ÿss»ç Ðì/³mû€)¾’Ü2ÿÂrD£ÁCŽÓe¦àUFU.æ:'xlµ \æ*¶™ ÐêÁðn•`aŸC‰€À Tɾ”'ã™QkZà:Wt°46òU«ãt²"ÐgðœÃ {nW…íÎ ˆã…¼uqÌ0º /ŽÞyaF”wãj3¨Ú€ÅG1óiš†bžsw‡ÜòÒz¶©@±û W\×ç£hŠŒM™¼hADVBrÁ™Z¢ì‹)öò,½þ•š>èF2Ð +JºeúiQã2B÷!3a2:D%J(Ë Ð¹Ëóƒ€*œÓðÆ”¢BžŒ˜©âàœè((D€…8‚=gÔ`4#Þ„¾ä †ê ÁÙ“Á“hxäеÁ{ÍIû~°kÚ €…8*<¨lÄB^=(Gk‹²[`S!v` +­UW¹jj2>Æ />Z«3s‘Ñä›gN‚¡iLƒ· Öäá£ÊøW_>qiù¸¾«¼)y Ѷl1(Ï™Ëж5m¹P=-P®„S“ô +›‘jáUb‘/t"ïP1ZÍÉÞñ6þHÌgCæ˜Ë”µm ÕxfFU‚QèÆŒ6º>nvs£Î¬…ªƒJwí1pgÛF]îX™}­ñ¼#Å“íÀ; +1bÁD‡Ç“Šò¶¤h¦ô¨y¦ƒÁ¸Ãzƒî±BpM^ˆX° +ŒÈÆ°LI7ÑyÁø,]¦<6FCª‘¶›;>ˆŒŸ„Ì_EŒ —wô‡ž–r  b¨=#(ª5ím@.¢À`¨%Iˆ-i¿ð¬¡A`\4xÒ<óKv.^ØÁoâÍœ” ÿY¿÷ñÎìþöfžsfŸ@tr÷‹gÿ¸ƒ‹Ü]ƒq_½:˜õk5TfåªVÅ'ÕÕ`¥l‡©ã£)+ 'š¬ë)Ç¡ÒÌ´Ãÿ‚kòæPP4J9a]áFƒvÃ0ó1ã®Æ¢“@€ÈèàªÎà ÄŠìÿm%‹ Š\FÃJt– e¢hÈ„T"ª at6R[Y—ßÅ G€;p•# ^Ô¬…¤ð¸ßÞO••=§‹Ý«‰ï·»KÄ‚8&Ù¼ÛW×ä@Þ ‘¸x¢‰³l§á˜wŸi/ð©àXYe-ÙíZÓð2ÃÀ Ö@]¤á¬²Áù +ù¯¯ˆ§öåiwÿ¦£‹´£3ûˆ@»OEŒ­`XP¥³6®pÚÚ}šŽ@QÛÍ0†;c=‹×¾i/¸›¯_ýî'ß52øü_¬7ýåƒaÊùu€†Ø{TùðèÚlÒ™YÜ…Áø, Бˆå”sŠ:¼™–Þwä nq²éÙ“£¬Ço)ÙáéÌ|HXðòîËî½]³ÿ†ÿ`š^fÙ«ñ¶¼`Ûøìö§¼•f v.,Äý× 7?É Ì6îí v^À6b!‹Ž×’=¨I–÷–5¶XEß÷¼u ¢"§0žßº§é_^‰ÍÀö”ï¬Æ[òBös›iðó½&c¨{£¯°½c'ÃÂ+Ÿçi^#G{«ó‡2 ÏͶŠêÈ Ø#dG®Ût¤¸Âgû†Xø÷¢PgÞ[·äiã… Áî Àxïå>þMÙÇ?'¼‘xY£#I ¼x•°ø%úHGO”ýP¼ +Ôð˜ c~VÞ°å»ÿ‹ UîÞ%yœ_ý+Õo”R¢ÍÛÎZ¤Æ`MA²ívå‚UÏa rš]©¡ð`"Ôû‘÷gXi̲æ$æãÍy«s ²Yæn4í0ÏZ¶ƒªëLÍÕhHèfeäØÍuÏLYÏ®›æeŒ~)s -‹®)®ÐS(@G$åí†e©þ/='¾Jú…ê'RuÜž’’òáRâ\Ç®%D»ÒHfZ¶˜í+ÌÄ/ºMËäæ|†•QÌ}hOÛkcáV¼¶Ž± ÓPG^¯5G"ð¡¢ã|"Mtö„vUŽ=Ó¬çÝD»œ`ðXR\¼‰]Sö„Ln↮b 7“·N,XˆÖäÅ®Œ¦¤<’wûSÞ[˜‘DN€âwòB§Í8'˜` +:Éh·ý65ùÈC«µ§Í:‡Qž×Hv£ˆ® T™²Éx:t—Qµ‚ehpW@²ÅSt€ÝÍ©p+ƒÁ5œ4åÿþ58deóŽe=Ïþ>ÐïP¨›ÏÓüبNÇÕ˜íb;²ˆ|Bt‹ÀES •8+2ÝD,¸Ï3œªŠBeåî½#=܆ðeKxæ^1ŽôjšÑô Ë‘€1t–6òÙæW"éVöB9ƑʈW‚Q}o{¯(`aÊw¿gà>f¸‹þÚ`6 4óˆ´¼’ Õ ¬Å´ô= U,l¢¾É*ó3<ÕvU,<ãƒá ûPxjÞù·Œ#ñ}~açYž£ýBy hãZô|ÇBœ‡–!°‹QåfÎqã{8µret'ó5‡Ç.AZ áÀ‚S7ŠNn».è“ÚÝïÂþ¦Eñëì…‹Œ{Շƚ•…c2+Ûmd»[j\`g‘R6l£Ój¹¹Íµeæd¯;Vµ; × {ÓiÚÏo>®¡³`WÆBÚÓö×îËsÔ»Ü<®‡ßìn=ù~H2yYÓ¾>ªû:wöàêKÂý{ÜÀÈÛ02FÏ'ðÂ3æ.û‹6¤{ÕÞBþ¯:ÿØ®vObïÍ;UláoOõöneRb^˜íÚXx=/°M_–iý©6ªç ‘ú¯ƒ²É$û?h’Mykòƒ;!0Û¿}8Oöê—îËîeâÞ|$Ž¹šöb»:^Ï 2N×lj49Î#;4f÷㼸r^’/nåÅÉó’,}¨¼¯‚{¹âWY)·±?ç³Y±ËMîŽþè8vçXjbð†7k ¿3Î6»â*ê¡›ô©UtTûíúXx=/8=;gZøéé(kA»Ëä½l¡i›#ÚE<Ál`I¹8ÊÄñ]Æ êH›‡J8Òíéq “E±«¡ð^Â{Ęg½¡ i¸èÈ5Õm;2¹¨5ñŒxg¿OV8i +úv_˜#ÊÙ/äè9J/ï9Y]Êþq8 ˜Ãu`P”æràâNð'ª`º±kj´›Ÿæ¼/øz="¨t¢" igqã&B¦–Í4aSõLæÑi8­q•ý<£ùi†dë +ø;ay6Õ{Â0“ièÚ¹C¤sŬ éÌVÕx¨*DêÖ(Sšy!HÕ$@&pã8›ÃXWÃef p¢vN4Óæí=Ô©lç[ú©‹ŽÅѦ\›NÆ0&ðÓš¬p °f ™eÑyÌfÖ±¶µÅ½ÍÆÆ#¡½yÔ0WÐà_ØLê¼ \d´k;lÚ[Š‰ÛšT†ë ǵ×HHCûv¾@о»¨*Hp„:®"F9¢rÄu†¥¤Q´)xåf’exq˜èó²¶pGÅ Eë Ó¡¤ZòÚj^Æ€K„g ¯ +J +ÅájÈŠ¾#2ƒs¿–áu$Ó‚kt_•AáÚdaÔfŽnÂú0…1&µ÷Š´1¡"`n5LB½fÛ¾’œÆ®ãZ)Þ—´-iæM¿-!õêš2n¢øV¡\ô´äHCGÒ…¼ã­9tåN”´ƒG j­ºðçYT¯"bAå $ -¿î{Ä7¬rÉ—Ü“N–E9q€J¶ÎØ Ôõt€GØ#“.Ï T/™8Ú¼CGz*žêÏçãciÕbŠND²å³€F £ +xŒÿ¡:$ZÒTœI¤ :¬=Í4›@KAõ +Öã@‡±e·Æ|ÝnÛ¾”DÖšèJÀB\Ç„C +š§ßܱ  µ0 …¾ÒÁ¡.»ó€öBšª˜+Aú=ÆœÆÃŽ…ÞmxrXg4v=Á’ÞµÐïÄML*ÎI ð=æº!ž‚+°Ø œïxF3™Ü Y”ï°Ñï›w–ªëTvì©a@¹ÝRŽ9°j¯#sO‰n…¦x²b s]Ǥ#ÔT€ ®k®¡#Ý·¦¼e˜ax¤—‚Þ„ èãvPÎ EOe ¯éêY¼ #¹u ¬Cy®h9ømâ#.EÇY^p 4÷¼þ?G]†­@$[+„%ṉÐâÁ`ÝÆ8CýÐF,ðÎ2ɸ—À!ùL$`AÑÂ{ÝKo"/¬5ƒ9¤îp 1û©=“í|#?USq¼DÛy/1SÂoèLÄBa B#Ž•Só~ !„¹ÑÜJ?£‹îHŽ5lr¼]Ô0°›ë—:Œ›ðBôÅ…¾}.ë¸l£Ê0êk\l0õ¼Å]ãh/t +Ï ]Ê…ôdó]À¦Í®}Àª£CGð\§ñ’£åàå[< LŠk:,Q;/¸÷i(í£«ØŒC•ƒW\±Ð{ÂõÀÀ‰ªp6b¸Ó{°À~é¼s´,ȨòX^¢ie¼v1&ï&½ +‚ºj]ëPÒb5¡‰mÅ•O9ô «X² ˜A·R’ÜH_öü» /˜²‹k>fš¸×lf²*zw)ÊŠÓ$¨Ît¤FtM ó¨uTajTw`èN¤apxj:HGx‰ º7 ¯·Kf¶©ô +õ~"h‚/ÐõF¥™HÐC™UÖëɘ¡÷m wr¶.¡ó +Hå]<“ÉšªwDr»ê~mìúÖM×µ±8SŠ ÌÔ|!x« ²èâ9|`÷öàJÓyáƒ#x!ÜƦG,ZÓÆÜ^°°¹êFëwv?m³m_Ì Û@ÄxPNb˜%)=‹í1Ñ÷Áãâ,Z£f_N^à&þ0q˃5µrƒ„Üì“ûå1„ŠÀÓý‘|Ì×HÁöF Äü\<u$çâ›ßc»éÅÛ¡`†ëíãÉŒÛoà ãR˜b)ö¸Z©­Û2 jÚ[èvƒ®Gh0RV¤]#‹¹rˆnJ™3WV‡_,ºöX`bünÛWóÂ}Ô ããHxI(þö]ð÷§±ˆ#isËw'Åtô$Ó±í ç–'bÂ_"3³mŸlfOŸø*Ûy¾ší,­ðû‡Úoí» yô̹= +†‡îlÄMû"HÚC_Ä1g¶‡¾0»c¨ñûhN kþlÕz TîÁoŸ‡…ëú©þç2»hü+€Ôuv8+ÆÝ#kÏ0ÄŒØ*JAïã ¯fŸ‰…§ú—8õ-ºÀGJÖÿ{±Ï‡BIçu·òS}‡!zé0ÍíÆ™ü«¸sÉ‹»B+øø›g‹Ä³±x¯Œ„ØÇ O¡üúXø_ ´Û9ÅXþo³ä›­_hí8Žö ûB¶è\Þ2ìã{E<Ý3|o^p%mÖú,X¸¢JÀœì ÿØ8ÒC}Ø4ŸÊ ²)$³¥…÷Gýécž8EkÁ> _Á ‹"? ûö6Ùû»–'°ð™¼à+âü)áëwäüw£Éèë"Í|3{¡Œã-ä4¡6ä5ûÄ jý~á3yÁ çœÅ¾%§ë ;·Á %ÁÖlŸ…/ˆƒa5mN3Žäªú¤~ªŸÇ Lê¹ ®6?]mGNóŸÐœ¢Ÿvá¶OÇÂÍyÞ¬¤ö4 +ª9nà ÌL!L~"z÷`æ:[çɾªª.3ìÚâ«g×7w^0w!ÖΆ³ÆSýL{ÁÅ=GZ‚¥¾»†os!*ëÕ_YrM_ݾ¿/Dùâ<§Q•oi/Öó|©9’+Œª2G‚+8èÚB_\à»ñ‚» C›°ð…ãHqÃ%¸Û”½/zuœã« z=R¿/œGGb®¿Î^¸¿ö>ûk,?³ƒÏˆB^[Þ°©ú÷³NÄ fªØoGú¤ç—ô™¹qW·Ùv,|½p¢€Æî¬ñT?Ÿ.Mø}W=±„/nê϶×ùÉy¡IöÂixÝÅŠ?”^+­mí»¿#/œg©mO„…›ñÂ}(Z¯I+÷¥9Ni÷0|íŸx¶Ú^ÀäS¸1? ¿œ®¹Æóñ‹Qi÷ð·f,[¹G·s-6‰kÀbuí¾¼¼ËÏ XÎíû0ÀÝ|ÜÔŠÿ8,üv^0zb¿nIõBPãË]]Í8؆óX‚Ì…× C=c”Ÿd¶Û² êµ&-¤€„uæni +VÄhÏÝji'[^µ[M ÔØ×¹¸±¬ ßn~Óg…mgy’õv¼ÐàÍl¼Óˆù›z°0×+∠RÔ5$Äå ÈÅ]xåð$F\ˆÇè܈{R'ïñ +7ô7}N0?Í£<ö»ùL^ȸ-ð‘~à.b¡,,댄): V´ˆ¡œ'ÔÒ…yT<ˆ‘G,Œ|®ÔìçaÁ4×÷¤ú·`ŠN$á<2˜›Ù ¨Ø;/¸ /Ô¸)iU"îæ=áÀBÝTtvxðèU—W +WnûqXؤ¿½äµÂ'ù[Ìÿ†>m)ã“L¨E:ÌÔy7Í®á3tü1½›œëj8¶Tp˜ê6†° £ëCëjÎÃi×Á} »½@%†%ù‡ãÍçÚ m+ÍýŽ“ÇGDp›5÷éñÇm£1íñí8Ù´­;mÜŒaá+†ôOåtÞbúL{[ó§½?húG¤ðÿ'°Xؘ‹X›ýÐBû†¼ðïÅÏi¤Œ±ßƒýy> ß„˜óq7ç#¾ùæ]c˜ˆ8u9xácXø±òãxI5£P:SN‘&åU=×µn™)k”ù-XÐ ¿|Eë!P•W°ÐâyE|YfŠ\CÑ4_6¤.ndzçâà†q1 Åô.}{,$^øí¼ãsŸÏäÀÃaE$ëDÇŠ¬y¾ìA÷¤ÕC7dTkƦQefX[Ú˜°É6kôȾ;/ür^`áسo£ë"6à‚ 5]F#âŠ*i1B@Ÿ1ñ=åœ ço5 ™S^šïŽ…Ä ¿œàu.áÜü^ˆ:G«9ÅKÜ’Â)^¬“¹^ ®J:±†b^ +ª ¡kéÐ~ójM¼x¹ ˜¨0;xQ‚ñ˜¬D0mÓ¹šÖKÅQOGçIíqvI°|tß ‰~:Ü?æ}Ç7Ã|OâÂÆH¾€½`¤ñ² ½ˆ{tì{7*ðZÓjš¦RAŽ~Âqí ¡/ð·ŸÎK¼ðó±Àzy#¹ñ¥•–_ÒÁHEµ@ÄEWƒpÁØ@Áfv1k‡¡ï\=ê"ºLÁù7³Y š,ÿ XH¼ðñzÍô²þâÀÆ[g–øGô ?V¹D“󽉀ŽÄ Àv&Û>2Xhi€bÂÈÇÄ g×:ÿkèßgS5ا¡ï*e$+Ëã +ÓêªköbŠ©ê 3}5nŒ‘Ae¦Àˆ £iû–},$^øÑXó/16wØœ÷8÷á™w^þò8äâ™rG×ñÛÅý0˜ûönK‰~8bṲ́:K¼°àÁX©Ê/$,˜‚׎¥*K¼ðë± %ÆmZÆ“x!aaóU©â/$,Dc¡s©¾/$,€±@’±x!a! |K鉢±Ð§ZK¼ð…X¸,{t1¾Óþy‰Sø‚²"?cy½kh—f/|!X[Ž¬QZõ£“™VºÏÜ¡±<…qRW¼bFŽ’±xá+± G^zB9¥¼Ïkÿˆq$˜]FyÙƒën?®íQÒ!Z?Ú¬ë*Ïhò½H¼ðõXÀˆY‹¸HŽv¡û’ylͱ WËÙ¸wÇ:»1K‘OPH¼p +{cNJ°à÷æØ¥(£½Øʱœ¨.hŸ7´˜xUŽ[‹ËŒVª'¤å:¿˜%ÿÒâi1FClPq +Ú”ñÑ(ú±?[¿™ÿe÷ÊÆÏÞ€…eò8³?ß®4á VIi8õ6¼àÔß³8¬­Ÿ'w7tÎôáùø9l¬Ûæ‰ÍM_‰“‡è§Z2gÃÿá]OpeâÞ¹D9S ¬"5>Cx¾»·+ÉÛ粘óí°p‘ž¤U·âæÐ’ï.˜@òq#c¼7i@ò>äV'Æì÷Ô:± P„Ùb·Ì\tà„/ÇñÍw¡%ÖĘ¹dújR´ª"Z\Xgl ­ÓÆlÇ©{t·Ÿ6äŸfÚXNŒ„Baæ4kq˜xíáZÐB^W\¿ Æ7á1úOŒæ*šfnÅ ¬ÅZ[fåÆMÒôe7ù%äEJouV×Ö03„ÁIÙVH9QÏB¢^´ œ©VŽŠ5½Ž{"Ù FéH7ÐÎöãR³lž¤ì›nÎÜ)Óú"ä]6C®ð[ÏÄ5œ˜+C'%ü®¬#õº6ªåÚë¦v-øèD>BBMÖuÔÌgó2æˆ578'¦3DAë0Å“*7§¡Ò(ÇíxÁ4¤Àƒw$> D1ÚÈ` |›FŠ!› cŸO‹†öÝp¹P»v¸àåZV²$fÄÌp´–T¯5vNE$¯˜½ Å4èÕæ\`_ÄÂÈÕ:’žOë4ß÷Œiˆ˜fÆõŽ”>¡ zhnÆ Ò¢ÂH2ãi­hÝ(jA÷KçÛ-›A—8°0ßa!—–÷Ë,qéIÒ6€_rSã +^H@·¤t¶±Æv‡GdMŸ9Ñð ÷Þ4 ×>¯±9°ÐóÖ0¸ãàÖÞkÀBé@!•t‚L~ã•`nk2œÁµ.+àYó¸÷̆eäÄÁ^ÈÝñ‚tN$ +·ãS‚BêÛ” Õ‡ˆ!C)4‘kÅ3ºÐ^bc-i¯ñ(&:.sCZ_ñVÔ¨‡#›Šf"h£ CÚêLñ A;dzBÎÏ„ù€ !Âòn!±›?°àá{ÜWp? §˜¸cXð\—Tå%3=¾š›ø(d0‚ôúQä§7Ìl}¼Zò»íË“äsxÁϳ“×Þ€¦–nx=øH0ÂC†4®[8‹Ü|ëòe*Ï"7-û˜˜…—ޫ +ÙbÜ Ð!8DáÜ",Â4ÎS¢„óá £Ø”Œ‚nQ»x$¸†Ài|‡Ø$äÊk¯–ő׾•¢„ˆµ/yëÒG)Æ’m ßB>0cùv{¡ŒÓ\Ìnls…nÌh­•c7:*õ(2Zöe\ɘéÌ3i Í3Û6p‘4½¶Fnª7Ö×8Smìáu#šFnl,[Û²vl™µ¡FÓl3›Òz÷Võªo6Ÿbl·ÍºÛzÔ%äÔ‚s]«K'™o† :òv<nyÉ¡4R¥äÛÕˆÿ]’°pV‘~Ÿò:\Y tÚÄYþ‹Ǿb?[^¦éß>ŽdöwGdã “ŒAK6{ Ö +Xfßu…"MtkW^NˆûWÀEÔþýœvÜLƬ¶ãÇÐÏÙq'¶ÇV‰'Æ\ÙÃI0yì„aŽßû‘Ëæn~œu¹m¼öÏyì{NªåBÝv¸8š¦j‹¥žë*3ÒNpàÎyר*nLªêz^†ÍdÕáópe?U9ίZ¢ètõ<™17 þÌ6`ÂÂI¡`qœšýȳù¶%j5(Þ3SSæ⹉éàÀ…ƒ˜¯.C®½~ᵎ–æ?¶(Š¦HXHòÆjqˆ€RÔÐ~㥉‹ûlIoF^o¼YEÆnß4`iʸ?£p~¢Å,\wýÂ+5LгâL¯• IÞD ÕZV_ØÈ n [\=%<Ÿ Ÿãàü¡³ø:@ºÙ±÷4û,^¸ÎÐÖÔÎ:÷;ïÔà½0$ œ# F4ÆÀˆ)½q'æY`Jy°,a!É›ÄÏØäyI•'u. +y´ À4…æÞçÂáGê ^:) ìjuÎ8f Í™NJ #æ!ÐÚyMIÀZ4éH ßÞp¡}‹{ [? èH14Ðÿ4¤öÂN¼°ðÝ%FK1‘&:×ódÅ?;P…zI®€…;{! À^ˆ˜#± º—¶·ûbß¼†ÖgÞ‘5aá[èHèH»½À÷ ?Ÿ{D£‡:’)8z!ÜôïQe4}Z¿äCµÔâJ¼°cxá>’–?ܸHŒ·Ûcy°w¤LXHòU»BN6Ëú ²8>7×?Sõ/Œ!  Òi„LXHò¡jÒÆÛßì­øødQjÏÿkÇŠ/ßÇ3.¶¨LXHòbP•|b糦~Ø´åËÒ)ö´Í'ºœ”¾‰ ˜™h0&a!ÉghHˆÿn[gÁÂÆ€æ³Í@',ü I¿Âô4Xع…“ù&%,ü ‰¾jËaá2ÍÎ$€qû»¦æ{Õv%Í÷ÂÂ>]ûS‰ Ýzó›ºÔ~¯ª!i:¼nßµ3a!Î@côXúRáüö÷Ô"5à+ªÞ_·FæTXfÐ?JñW +åäÖ·äç^ë÷Ý4$†¸}ÝøäÉ°°Å™ÿˆh1/¼ù:q`/ÈßÒ>&0\KDEËW–æÙ°°=´!Å4ó_h:˯°]ÆI+S+¾Ž†4Òùµ}Ÿ ßÃrž}éÓ|͘ªoè,Ò`Òu*a÷Ú~åÄXð ÇÙ“Ô×Ì/8ýtPô$Ÿ¨! ‘¾Zoþ@‰zÚü.èù5†*ª®Ð†bœ•íÛcÁÛ¯öOz ÒµÖxe¸ofà/ ðxj~@¾ ÔRZ$ûù£"'oð~>+\†¿ØVø'¤1Fƒa5)Í& 0³'BB‡”E¿½‰/ŒÅ¼5©5¬öÜ[4¤ÓbÁgÛ¯ï_Âsˆ4ÙÊ ¦ÈÅà6(\)uìXmœ^î{†9—×äÆ°+8ai0éch oš¶<'\ÆñÆØ_ÂB Dµ +_ƒ6']à!XxÑòHB7ú^3£Ôˆ©6oƒ/_;]šä™ +j¡;aß  +ÛÔåyÁ̼k¬0¸÷ª€°w®Ü· ××<¬3–y ¦|câIöó‡h¡âã›ÔÌ3b!¦§Ð^¶XÅ)™ÄÕR¯K˜P>SBviß­w͸‰¬3yó„5í“gÒû[‘zŲγcÁ5ü,N/b¡µ~ì+Z9¼4„ X´žë!š nˆ#¤¬±‰XļYß‘Ñ%ÙÏïÓrüF*>DCÉY¢%½„×óBøuB׸í DÄ çñè€c¸©±‡Ô|&Ž½£:1ß’ýü¾šs¯vÉ;/€ˆ=Koø¢½0bÒ=^®×@«u·îº"7ÐÁUØU¼È8Ék>²÷”ErÆx¯†ôÚE 'ÆBL=O€u$°ð)¥¤•xY5íó.@÷§ +EÛS-2Î9 ¢§d{G£†ë’3Æ»4¤Œ†7k¥'Â(éyXá_óÎŽee&åfíÖŽƒøwlÀE9PúËb³P®Åûº†ú¹Íˆ“¼ToþíÒÙ°àJ~†)¶Wb!:_ÄÎgßq>þlâx¸oÎçÄAîwFøúWDÜ$Ot!ê径¢èT1’Þï§*3Õ^CÓ729c¼GCZÞ1}ª8=GöTõþŸmy¥Þ<:c¤Á¤7kH£ùÖXˆ¶‚;Wx†øHÀ÷ULzS‰½sÆþ¸Ý1-6sø0ÍòÛÂEò`a^Ó ÎÚ)i_?‚ýüÁ‚2ŸKM‰aF£txá¥ÆwÜä±GuB\:VøËÅú‰k“Œ‡h)Æor_¬dàè 5¤†~$^ÿ X¨I Ò·Eëtv4n´š¿/ŒÜ¤+Ž/Ý\[Ä…úR‡¯^ðÓ7 ÂWFþã+ZŸ×ÝæT{TAM#ó±Îš¼Èó&´®©CU8¥º Ç*”yǧPµÒõsèv†p*̽4m*ëJ]Õ]cL6IHè¬ktµœŽHŒå* ç±àúe¨…Æ”4®Z0íÎU^DçÖ3çS¼€”PpJ)ô2SÜ0 +Ïsã G +œØ(cü7Ží)·²='¢a5}¬7–Gª0Þ”P4Æ*@„bP›\Gqàu®)B{ pš +â3GyG9ÂÁû:@B€„ ìÉ°Àüü±)É—Æ‘ÚTD<ᢨ˜¹¯©.0ÊÎzÚ×QGù ; +º ö .^PVi¶*úX–3›ŸlïBßÑþcãB)ïE?åk‡}àLà°Z^L´XnµZ×:Neˆ€™Pv ã:⦣#ty›!å@í:òøqº‰p1Pý¡Òy që¾ú‘l4¨[G:¬š›9ˆ|âV¨q®×þT |ƒ¦{aNxA ¯º?R òÌ'Ât„ÌÃJPoá:€¾*qUÂâ¬ÃÌÄ gS@»¢aÂÉä÷éê'¾†u‰]h§ñé†;^·Ÿù{y!Þ ˜)­šÄÈ50¨¬+CÿðLç¨#qÝñ9Ìu3àÍG,¼ð<®D@Àøz §½8Ûž¶12Æh>ð:(¬>¸¬èPtØÝc¡,8Ë3‚ÕXíUØnYG§Ž7YÖ° +·L,„ÌëÂ3Hh'¼MC2ˆkû<,Ȭó¦¢6b¸¬Ñì]b¤ªDPPED}ÿ·¼‰Î´ÝÝîn»é™öšsv~qª|| „$;kdCæ¦Úyg™éÆ+Èï}íåØ´C[|¡¹»‡Ëïr°Ÿÿ}D“˜(-Õ˜XXEÀ‚,ŒÀ ¢q%ßÀd Š)ÃÌmàK jGÃÆNYéj!ú¬z Ë qøp˜Á?cÁQ1ImW,W‰²Qe6«¦EU5X•Š$ ºSfÃï'UeùJ>f—ë<öoϹôšyY"5Ð¥9Kl›‰ ¤‹ # J1ÑëÊ  8c'NŠØ4[YÇzæs‹ *w›Ÿ«íû8‘=`ÀmøÀ4Öµw›ó ÞúQnÞÃ?ëýˆa;ï-ö[×ÖH(ÈÙã{H ýLȧ‚GzP`I}xjþoþH!šè0¢ƒÔpõæ¢30.ÉhBÀ€êXºWqñXŠ‰ßÉŸò± Cúˆ~"s¸Ü‰á9Ìîy±Ã…TÔ½$=–CÍãCî¡>CyÝk<œËFüèÒ[°°ýê4!_¾ýRE~'×âÄÂæÏX?Ý“¸ä½ /:Æ'ô½C13ß ÷Iy[ºË)/Ä9Ž“¾‘[aÁ¹=ÙëM¼{^ôeKÏgïÝ#oEj÷ÀÂfï!a`þ>-UÙÜ"À ý[­a!4Cئ×Ããš¼{ßj¼”5ϳ¶åuFÂX-IS +^„¯¹%uê‹û¬ëˆ¿ßöwÖ7aA:²d5·sÊìÖP“ÓeèEÌSùv¼Â—‹ëñíEô|tòhÃÄžÁ´Ûâ )œIŒ1Ìlóå±`«æ;ó—J©Oº’øë®øºÔ›°`¼ª³jÎ$¥ÒÈ0ÒÜI`꣧8ãç#êP9Ã,•!§[Øì6æ#à×þsjŒqJø ІÏ10¯¦\˜™-;=Š~î§â;`Au«¾½¬-Ó™þ’ùñS®³–büÛ Y‹[aÁ\JÞŽ„sž›’qUG[8ã¾ÀÄLpVâ\u±å„%¹UŒ³>«˜"¼ ¡Jr/ÐP")7N«bÏØ6ÁÕäJ” VͤXÝ7Б¤ºËe°¾È¶›Ïq5‹o™C +Í­°»2Ë•Ÿ™s©¯U±ÊO¢ DQ¯&Ì­Þ+Ú°<„gs–s‹n%‹IÔ[E´eÍ$ÆuàˆÚ{Vx‘àO(௰­Ø0äç€;*[%Rñ°`Ù]æcãľȼõ§ìa7ž±¿O<Š›`A†¹×mÊÁ:ï6_wDØNÙ¬$Úñªcp0ÊûzáÂÏ‚4RµT³È±ùÀÂQà ѱà[Î|Фí +ݳŽé Æ§¨sÎD¾>¶»ñÂ×XÙ7Åg¸žeÐÍþÞYnÆ Ò“\/S MRªÈ #ð‚òºL€…¹Þ96SÎS¹™¸b#Q)¥ +º~0ëx•ñ½Àd4`Áè¹*„ˆ…… xÁèev…LEJñëcÁ²åXˆÓ×ÀŒ äþ¼ oªv^ Æ{VÇ¥[×4wÊ%2NÊ"$òB±JÕž­ƒ ©_ o+–­ùì º9XÞ‰­«¯ `Á‘&‚¼ZÕöjÔÏXXX ”PÑÌõü-°p^pTM}…ðªòœ–Ü(Ò[‚ߊd UÖ0•Ö4b]¨v^ˆ Õlh¢KЂ˜(fµ$F©"‹"š'WÜ… +˜ÍD×j„¿ÍnÙˆxA"J¦'‘¬!ERŒ©âèH÷àWT WË2}j¸¿í,õü¶à ·â¹•El:‡ü@†à’èÐ }ëÜÔäeKfë@9Zò²Ž!EãÌ;†š—ôì¶Ã²¹¡E¹¹œµ¤²–ÞÕå†Íô“ôKòqjb÷MÖÚîÁ ®?vƦ¯àîÎ^˜‹êM¹Ý<Øé{àßtÒ¢‹n÷K…o1H %P#Æh´ƒŒbö-kaïÓ{l* +‚Z29 +œ‚þFïÍ@s+8)ã@Ex8^ŽÞ±P] ®îl/¸\¤·9ÝÌ^@O¡ã¯zùúS…í'Ö_*] àÝŒdüMP1¬¾…oÞ}ì…P º/[mg#ï{òÖði·ã…ýÂ?ù2oûC:ïâ ÿ»jæˆL>yyîWú©Þ›¼¿ç<’Ô ° §í·øÃ}Dt÷æ¹÷ÛñÂþdGÿó÷WþÔ_†ô°?ìê´ØŠ‘?¯œ:¹W v„œ1ø˜¼„âsã³ßêQÏzÿ9K¯7ãã~¿ðô¾%)xª×uÖ§%¦? fßY‹CHˆ/C©ÏJÞ…ï®!©7›M7å°hÉËþz¥~Ùk(·†þxg]ÃTz1Š…žðl柲هš+’›ˆµ}ðI±F„•z$Š]1(WiŒ)‘ùSŒÇ[ñ‚¡E]ü®^ñ.åߌL4;±ºúr¢”€ mÚ¶­4®ïºúzßäVà³’¶ïu'ïk;ã¿7gZ¸)/èŠüÈ ¾ÖÄœì^Ü÷éìOf=h·]ι‘.b˜N×FŒŽrXGÀN|u…ê(çºQ eUdœŠŽÓ4Ì¢±l¦ó4šQ•9'špNâãcá™tÅÛ£Éî¾ Q+OÙ®^|Ÿ¿uÅòZ€»ñnl£‹º½‚%M¸œ·oмúÛDp??!Šl6±DTç.;87VFx0žáz s½æmÆí©¼'3ÄîÞ 7å=WÙ©U€)›f©Šàoü”"/¡êŠÒ­ óVs £µ”j´Œ`s}UÆÕÜdÓalŸW—7¶ª3ÍĘZÖA9gš1Ðeâ ¬•«yþëñV¼;>3ãÆÜ:¸qy=Ïšqt2÷Áñd0D­³tÄÍÆ#…Jãî <ŽÈÞb:öZ;¨rÇBœS„rçr18üÚŽµ¹=Î5.Ï÷aS/js8.ö‚fÙp¢†:°€ÕÇ]mÝü^×Üìho3nW鎶³£ï™X¾1/üÔû`ŒÞ±c| £·ÊÃ(šVÌ?îÅuzìÔ¢ UMbñ𪄷ԑ.ÆAtpb­ÊN5„$EìÆf®æ`¢kúbjà€I…±I¨š'Õ•0¸ZÖŒ4§fûB¼`ê¥/¡S +Õê‚)Á­M•Ó,T“qÅñ€sjèFàh ¨Úé‚€ÎXÆа &]&º¹O€ã¡-PáTh¥Î™IzÎÅàáã-4Äp,„Ë+ç¢éEtèqã•+˜€–6¨Þñ¢‚§1q×àÏËz8ï ÌØÇÞºïƼð3¼BEÇ°”e<Ù}1¹—¿Äû K6³ CGô:‰ìH^j³PöÕœemOÄ2‹+ÕMj ÆΊÃ™Úô,R›0›Îú¶Ú±0ióI‘'o6„‘#rÕ Î;T•^Š +HMDQ«*ðÒö¢ïE=’.°rƒ/µ˜‹Vå:qÇ*ÛˆžŠªÉ¯”+ò¬R¾fã|¬Õboj>Ûš ­ >Maבúî0u•`iÀ) +i8ñ0I¬®ú–ùHˆe¥mU]ˆ²oswï¬!½'4Ø'ñô׊,w£j¶Ÿ)¹(c­(!qÓ+ÀÉõjD¹ÓVµqË4n|Ðg:«Õ(æum…‡®x…Ì|BfR5.VÄ‚gͧ­Jßn}A‚f®x›ƒ3BÿžµšÖZÔëÂÐ^ö“~ì'ÑÖ"õ>öjh¡R *¡WƒcE!†¦UU6šcB·1èNT… £j‘—¡ŸV0ÑÚ†ó^¤Æ£ŽX0â.fõ¬öG•›ê6Ñ®H]4žåpñ¶]ÁÜ­L±;úlcà‹÷hÉ·çSXi ¦¹páÉÊ Æ-xHÃö0gd4X×ÄЗ!Ö®cÝ.)‹`;ƒÁÆ»hY§CÛ2 EŸxˆð|X•ýL«:®‰‘p@R§¶ hQY Ã}!W¹üXøi}ÁÑŠ«´-Œ,  âL(ð s¼Ò  ¢e[‰!+f@ó\UMÁ¼‰3é9Ì`"UMýqFˆ ŽµØk‘ È¢¡bÀ’©SI'ÕÁ­Hô@ª] ªD»â ŽŠ"©“S,_D lðLB¥Ê„†4T…ö‘ÞŒ\$L#qŠGtD”òÀBt˜uÄpÕq‘7·‹”z7£.öïõB¹5/dÛè1&ι᧠+s\¿qy½y+-ÝãÃŒVŽ^Ú´¥¼÷¨VÕ…q2Òz÷ <ëÉuŒWœCÌ ‹áö/Ñ×TÇã¡Œp.ÖÀzŸèÃzS$W$2Ó¯];m]òe }g†n&Mp-IS×Ä!‘L€Š>ä˜.*4 Üæq!©8 +®(™v"dpjm:<Á—5ܸX&È6‘‘šËIÎ/„/¸±%©ºbƒê¶¤Æµ%æÚ¨È\z;wð{ÙÎf{§†tk^uÒ‘5÷eœB^lÉ.q7q™ç(v,ø¾GîðpáZéÐ÷¶ãÛþºæ©èRvÍ ºú¼2ŸTï¶þHA£ oˆÝ}á“A¿ÜˆÞ¿1EÀoÚÀ!¨|‰£ôA +½ Ë@›1pºkgð8½…a#è¸]ÚÏ¿>\¸À%!˜ÄnƒoR{TqûÏ3·[,¾/HÐ>Þ›„⦼`ênx9`ÚuÔàZ[ý•‚Èÿ—¼p)ßäæûëà,]Ë‚ÇûÜØn3,ÿRçÏ—øؽ Ë}ìè×S|ÿ97ôSuñGÝ™cÔùÆP¸%/Ü^a›è =®[î¡%™ÉÖyS^øÿ”Ûñ‚Ã-Nò·[sÿ“ÖÅW×?õ´ÃS5„çéÉûá.ä£ÿ^þ¶¼pbá#¼à +ÒM…/ãjèô‡ÙW\cÎJO?øÙÇG·o¾Ý òü‹ùl†ðX8yá1xQûª§08ÉpÙòz8–IgB˜SGÑý_t—#{c‚n’uðÍ¡·0:øƽjpG!NLì%Ø’ Ø.|2óÕ•¹ ¥Ú³7—eÀê¸ÔÓÄçê_Aþ '/</HÙ«ÉS_‹:lÍ@q fØ7!H_çmƒÛ:<­¥¡T†b*Üå|2y^4y Gê‰ËÅd  )hN'xÄŽ¶Ø&õM»ù¡wÒí°ÏÊ|ÄÓ$¥ý€±në¡F§— ãBõÁ‡B->äCëo®Ï€mOî±*zò—æi‰P-€QL5º…×´§QŒ) ¹fîtâºT\TÇÎÔ’M\©…… +N@g=Ñ…Y1ÑdèZ„ásD¯ î-×””(u®ã»_wÇ ‘>K +ÞjÝÂÅö­#‘À¡a6ÎBÎç·Ïõã¦î.¶óÉ _Ú^žõŽèÀ·=W|—å‹Ý{|sÕÌX0ª[ûùr$kàѸN…Y䎑•pÌ(¼¶Ì%(Øÿ%ÊLsY +…X²E^éŒpP–b'Š¬R8!81À >ß lƆ šÌNò;ìÓwY=yá‹Û –±Ï¬\’¨KE:\/BÏëy,$î0ßrRiÀ1ŽÐ(Ù0(£§=s–øJHFÔ²T‚&:1+I°MW)y«sѯ“ªYJ®¬Ùb‰ñkŘˆÖ-«• V]°àx¯%+k6VÝ©ÛÃ}l瓾8/XV8>åØ…‡nhóX/JQ‡£ÿhÀ°®‘ vîPTJåf?â`Ô¸‰bYàXÀ,†m†Ñ=vŸ¥å ô4°M¬Ë4 5&–s IŠ±a³N²+/@u»cÁ‰ӰpŸ8'/|q^ØXv^èx¶$Oźaìè¨íjUÓ3ª hA)ÖŸ`¡Å—qçd ¤†E¹µžF‚=H—$ÍtîvÇèP¬\×nqcÖǸ– +Ð@i‚+®T<óBØ`¡Õ¼C×[Û¹÷ŠtòÂ×ç… µUô£°Gõ»U 0m϶ _šŽêøõHɈžø +LDk‚D72l!{â²q6ÁÍ•”鞢baPyÊ’H3*EÉżqU7¢šÕíS^˜f0ç<Ò‰…_x¡M‘ûƇq*idSN¸“Gÿn°.ï­©Ë–fkËÃ^€#ec-¤£½¬ iêÂCã<¶àŠÂ@‘pŠÊ‚ö[‘ÛŒPÙºƒ¿˜º{¡/‹ o; šQ”M;Å15B?ÛSG¡f]vùìÜûØÎ'/|m^ØÓø:ƒ;ѵTîa»öÅ/Ü۶ߗß0upˆÇ²X}ÁdÂvY‰3¸]0Ä}gá±4gö_1ê-ž°7µÇ´uh;ë€4a¶}¬ªÁ™îˆÖ颹T¿}¯½ËÎ~ÅÓéËòÂ?ýê±Ï¿˜×Ž¼»ß4{8$×uÿåò/ÈZ ïþkN^x ^ø©[?ň•N^ƒÌ^a` <iÜ‹è?ÿ¬w_.ãþ ´oŸ%BÊY ñî½'/</Œ»Ró$>ŸL‰—(*-¶¬|x®°Wÿ×}—?î‰ø\¹K¾6é›Êwçó;yáaxÁPîéâÍ%@¸tI•îE\J]rsrÓ” 7x×ü2³ƒå–·á² H^ÃŒËÇOæyŸm ¼²ºÁÂÉ  ¶ƒ²ýH/Í: D4€¸i½ÅÁ`ÍT K"±>;ÏZ‘Çá °Œ¥s F…ÇßEuÛYFúöä…/Ì ã2r1›…±=k—ã]V”3K>¶¸}¿4Ó@X&¡úT¶•ö&ß±•6VÖG cm¤eÅŠ0^‡Ç¾y9½C£óOˆâ´¾*/` º$šµª>;‘Îõ"È4cþë²C¡XÞ(ElÄ/˜Ì‹u-K’ÁQÕFÚJÔTð¹à¤IÌ?ò®¿ÇZ­‹š¾wwëÉ à Ž²­U€°åŸ±Ð2“Õ‚.L¯‹dY5O+Ÿ3 !½c04Ù1·ª[5›ã`·Z´UEmGÖ>41Èq¼‹æJ¥9×¾2/ØAy[1•è…ZâŒý2k]/L£-óYÛlš¶:’˜bíÆ8:gç°ÀìžSó汕$ó8´uòÂ#ñ`a£¸Œ€½cÇH~ÂB6÷Ã2*¿cAŽTçDŒ€6XðºÞÈâÁÓ¶9÷HX8yáqx¡Å] Ô³¯öBg“ŠUºbÁ873«fÎã¡#Õªu‹B,V¢ö³(ævQ•¼¤y\Z(zù@X8yáAæ‘òdsžòÄù<š á¤Î&L2»² ®*³A –€ñ\X®d  +ÉÔ;Su±â¤"C>{ +ÎÙôÐ ÏqÝùaÖ@nÆ ˜ò·“Fþì(uñ(À4nÇ ¨ dŽ‚KØŸKã¿q úÒ¾„vZ~,ü4/ÑPdq£9ß]òg£çÐfîæÌóHPÓzL¿…Ó}0vwlfÏuúÐÉ}ü‘þS^pMÛüfÆBÚ®»¤Åüp³ýôb^~Lôbhy$JÚƒ¹¶Åî±uýk?Ö5ó²·/m9×´ìËÏ w;¤K¿ä¯vDM-Ù]E_bA‘h=`¤à¢‡ú¢©•‡“4ÆE>”í|^Ð3IIc†HùœdòxÅä<9ñòȉofÓ%‡0*^¦9BÏ/˜¼&ªŒ½È¡9Ý) f¤&óI‚Ú å–øšèÛŒITþÀÂ"ºB,Ÿª$ßËOUÒ¦éæ_äØþá,þÖÃ#aá&¼—y©ö”ÖQL<õAÂë¸'a¡‘œZ w9›K³ÄÁÑKC1ßžC/wyX.÷³ÁPKH°2÷ÞzÔ¼ v¿ŠÝr '’]t¤u.k5©Ïœ<¹mœí—÷9¸?šG̯/-®¾½àú¦orÆU“Àö«¬Ã ;SlñÕ#/X9ƒ…WgØs,ï•bá +DW#v3%ï*¨+FKQÌPΉ"1aª©á[(X^C…Ù{²{§aˆË i±s]Ù/£#©Roÿ¿r¯ýÎÿí<z‚QQÙQ—‹)WEœT/츀¶UÌdŠ)³4‡íW,˜‘Õ+}Ïh¨„-™7\E·\ÍØ8²Ò‹“øñ)“ªÜ@7‚n¿'m{‚vòS§ïÆ ÿrŸ8ÿí<Ø ÐŸ íY5O-A fRÖ•§p釩ª"‚Vs¦çj+ý +6—· }™4Ø ¬̵Ç& ZPdK†IMø¬ÙàEš+E¼ÊÃn/¼ä-7ùu°ðÿÍ ÿÑ®‰;óÂ¥?0\$i ÀÁ¥ä¶3b¥”ª±šõX8üì/¼à¹"ËŽ ýXˆœ9D pQÀBËfrA\$g»a€Žf Ÿ½ôqòÂ÷±‹›bºÕ©²`v-Ô$ò ú;òÂÆɺÒ$Ÿ°]yÁ"QXˆ’ #5-wë lEô:+gj:Œ Øs¸š}êu]À9°€¼°7óõ°ðÎ n*å·³ž±. ç%#[â%Oí[3R²¤/X(Õä0%yÁž¤Ëv,¸BU%“óÅHUZ hW"EÀèH1.3v*LIéÕxð×– YI6}òÂײ«d¾Ýº3þa¾ñƲašÀJ°CÙ8gÚrض&÷½ ù„%umL];?5æ˜SÍ[¿5µ¦‡½P—íAÓšº¢±.‡·bs´ŠÂÔl=œM\qè1\í÷ #MHm„¢‘ÙÉ §</`ä s„Ù‘—×`p×âôçÃGî±y<ë(Α—wÇïÀ(<Þßö8AGæ +„kwa$÷æ£ÛCýì:¬ÜÞXðOgO^¸¹íüUüq©ÅlˆòVâ¹µŸª´äí[ë¤'˜ÿyÿŠýûZ1hLGj€çO^ø*Ã+O]æ¿.§KŸÿ¡Kû=¥Êo*¼5@ÈÍxAþ!æ‚üí,§½N/ÿišùw \Ÿ.|œ¾Ï$YûéÚçÉ BWý2l£êì.ÝF^_âTFyq?¼¦ã½DýÀe©Ñm{_ÈwQþ­‹Þ”ž.ôÊõŒü…à.Mºkàfé^ á|‰^uMgþ›go5ôt’Ò}~Ä«“>rïÊ_ó;‡žÙ€Çö€a¨Î¥6†#BfØPûŽæ ÓƒëLlO·Eƒ‰Øå?Ó8п³¬Ô˜ÕkÂgðB˜Ê®ûŸªO}ž~d=9îÞGv¾lÇ #ÔüB•X$e…!“¡j^ëL‰uWWÎë¦lçÏf†“>"æ×Þ§«4•ÎxRo‰±.йRM®ü˜/ô´$6ã:Ʀ` ±FjŒC•œ¥<@5V_uœã¹a„°ÉíB&÷ ¼pø©b&Hw$|”{ªI Ðt£üb1{¤Û“FÂ[¶,¸¾0²ê@¢£ÕI³WÚÑÐOúˆv3« áh«ühWb£Ow·®½"ÅŽ“—¢™H©¾Îuç_g`HÓ(•Þ–ª¯ŸëÇÄšYÙ$æ†UY§ºîÝ̆R´RåºFU6jŽ„µh7Á&.ÒĪÈÑÛi*õ'£ôf~ªeUV¡¦íHǶE­¨˜ +è÷õÔCwµÆ6ÝSNNu9ÒÀ ?Õpø©ßóÍL ½(ÇPO”/noØ×¹‘¾°®€FMN‹ÆJh¼¹t&'UÛ¦‰„“¾/üBöf$>°)#e˜rH*ú,KUÆÙh( "d…¨Õ­ÊÅ)Vžåµ˜lžÛ!ž—R k#òu"ŽÍëZÛyCÙŸ"!ÜÌOµ®kJ… g3g>$5«¤K1«Ùïkm’±¤šuQŒˆºxÝOÕxΓh²VÍŒ›Nð>)ÑAêg”§¨;î’ªTÊ!àÞ®[ˆÌ¨Ú± Ågïï=yá÷.,¿Ø ¡ONWœŠZ\1QRAÅ­\ÀÝJD›\ Ð]°ï2otÇFæ°1Z%X¯{®”êŒh³VŒzÚ³1ƉÉãnöáæ‘0¥v-– t–Ì«ŽªzmI/úµN‡ŸêÌ6 6W1«ÉòÒã\8šQMÙÆ–Mô£µÆ»QÚ‘Ñþr6Ô¢X©¢ƒè­Ý^bÁ«I;óé[ÝO^øÐ<Òò3bWFè‰*–² +°(Ù¶Ú׋hfžÅB èAQ0š³™{e—óÚ7„åª*6¾l +°  lç¬äÐjÿ)¼píÏçÃúæE‰>Ú˜’þê§Ê9õýTåÆëÏœsÁ­(z1ºÀËZÐ8²:ð¾W[·m'µíJÕ$Ø%ÿ…£×É ÃÏ ú@[RÄõ¢q‹@,èlFη° Of]©š‚âAÈXˆìRèB ¡b¹hB'@Gzæ•CKÐÑå,šÏà…íÉOµÆü«¿CÖÉ:?üTy; “ýÕOLlsñSÝ6ß$•QBÕ~fs,àÈàU-UųR Ó0Œæc=° w›y!~9,œëÎ?÷"ʽE‰x³•ŒTi¡<×]p¢ƒŽ„¡AFç1\ˆ½‰øDg°'øÒD8i®ºÚMi*BØâl⤚ÛOä…`Õ¬AÇ%F·ª…mi÷S%‰ ÛËa³»€°2tðÚYÕ‚íìqÃæU•ÖUµb9üTu£¨devµá„V7ðÊs0’Û‚ŽÖuH8’qg$6Mpcà š²<²ï«þn¼`ÆQ¾gpdsC{<1éKêr»M—¥×OÇ~}|ãºí¯Kž®žî¶9J†ê—=ž×Uåc–I^W‘w|‰é­ÍõËv õqql8â쫯/±p,õ^„|/l6·Ð½û¾@g¼º¥QÚB­ô€ê¢ƒô^îÿjzÙû'm£¿ìýw¦nG€vÞ5£ÈáSn½Å´£Åh:slTîeˆ…&³9ƨJú¼p Ù#‚À*‚4—Åô§gkž–ë÷°!R^ƒŽ8ŽÙhÃ<ÀJfd…•ƒn¯©Ç"è“{§9B‰\Vü¡.h¢rò¹Q\Å‘0êؽù{,껩{ßþCé½€y[?Õýá5zý⎕±}}Mî1ö[y}žnÔYBÜÀÑz>~ÇqÚ^}X¸ÂŽ.òÐŽÙh‡G·À˜ZØ.×} ^À¥“ ôEŒôjgcÂ@d;¼®¬ß`ì Ç#q.§Þmc‹<Ã"ö\ÁÝ·x×[ÆztºdŽåc>ú-lpùÔzì”ͲIŒ{£AZÐ^aPÊMÆ4‹ÑËï¸i|ï­»ßDá­ýT °òk®¡%)†´ 9 {דËH‰ML ’j÷õyÁ UºcÏ8[b%x±Àw´ùb7‡0:"縀jrøzçÌ SžApúx¡r)qÅG`é$HžŠm†šeV/T9c’£)ÊÒfáÃY÷8ˆÁkY€2 U»¬ƒFyÉ ­=uÐ5X¦êæQ»¿é~çK‹ò5«lâµLÙájՙͿ,î£M</`žª˜«¦uTM.úBÔY5Æ…Äر˜u`0É}Kl–˜†ë¨fÝŠ]G"$0f©¼ès•o¼è]åJ¦áظb +j^ÁØêE®Ó²Ûš³¤uºU㺨°ˆÚ ¶5"oŤK\Š¿ùªþwŒƒñb~ø²XDÅTî^äGLJ§&䔩ïÖ¼@« +Œ÷H`Fy®æç bIb[œ9¶î*Æ ëë¬L¹(âÅ^ ıIRZÑÌ[P#éPÄN2„œUº¤†ájÍ>su=$ÅF°•áa¹*eU+õÀdØXaŠ®RÜÝôÏøH’؉rµŠÙ‡îùöB+%†öˆôAE¡eÉD:xcäh’thØB+ØLö¡>– wÉÆÔ…Mb\Œ@OÊ ° üÆ{ª)•)9Ç*ÀC!xJiŠ®3†¬Õ1£¢©K›jÆíåbƒ ÇŠApЧnÌ ¦iï3‚ÉÂÂýó/¸Z‘¬Wl<±ðw^Sµ®%ë]×e­IX[å1-×+‰Å5qô×ÅØ"‰"ê2mbX­˜®:Òé,º±lŽÕ•Šë ^ÈÔÏrÑ®k×ö)ƒ«aÀµJŒYV‹"%¸¾@,V!Z‘¯TåèâÆoÌ ¯¬;ߊpä¿`áò/ÄBÌ/¶Xø+/¸B‘…uqf QŦØ&,ÃhîâÌxH >¡ç‰ •(AG’Ðõ  ÓWä `t¤fS¤æ0¨W cÉ0v0IvÁêUÀh8Êð ÝIØ.X Ø"I•³b·^j¸O$p3–ïwÝÿ¤¼-_[D§O,üpõþgŸ<(‘×@˜uâpˆ¯{îý˜ßHþîËýÿ•ø Ÿ"÷Èã) ,¼{Êë3óxJ·ˆAŸXø /XL¸âòѼ˜f±þšØÌ{¿Û&§£Ýü++U2©Ó?Õ@ßøñ•êG‹Úÿ$sÚ=\*`ÐEyïù§æñ”q­>±ðG^ˆk¹·Õ€ýÖÕû|Hhy¬ˆÛC”ûæ%0)Í+û´Bý"B©Ü.N.ði½ú%ݔӾÏ|TE­þƒTÐ2¿½«ÜÔ Ê›÷báó;C 'þÄ °Àòã—ÈMw,€Á»¶,&žé}vÙ#fœÈ¢ÆÍ&jtàZ‡KïoÁN+x·…]“£é ¸gV¶øEcîT§ã¾‘ÁxQ`÷MÙg{±Hø³n¾îlò91AÒœ¿ Ÿ™ßÙyƤ9±ð^p5é“릖–‹ÉÕUYâ +Û4·Î²¸@ÊV±¢.¬jãØ¥À¶ªöØ8¡Q^¶mYõÎC*ú<š¹¢¦K>äy»6«¾Å¼ƒHÞvó$ŠZLÕ’ò´·Ç{ lmÍâÛ ûõrŃ9±ð{^–zꚢ¡ˆ¢ÚBT“` ^V(u=Ö^J‰ñgçʨÆ)Þr;5,bw7ypLt¥è¥PsÁ›Bð‰1;`8‘þøz±tˆBšATžƒV†¼ÀζOžé»Ï4;X ïÏûɼ¿²Ù½_N,ü~ ³wîжM—,›™Î*àåÖ’máÈ ¬ù¼îX€÷Ç.ª–;zÇõâ”e±bZ b¡Xs5ZfÁ^8¾ØıM‹¡HEME½Ö¢‡ÿ³ÏßåîBD¡õ¿`áSya¿â÷Úî~Ïýθ§ +À‰®V—.i.Xè;¡”í–„˜ÑuuÛÓu1´*WMÜ £ójÄÿ‘F7²‘U£–rQ´Ê»&ÞÀÅ>÷Ù˜¢¿ÇÀø5x”¹R4ñÄÂoyáÅÃq7p­wÛ9êÝSûrÍXpªŸÍé×9D¥qŵÂØR™î8XÖò0*?2¿wøý 'YÖ1ë¢ËE eq92†?ç3íg\w¾‡Ÿêáà÷ôÎ"ß—¢|Ý€£ ÏJ5¢öL½o×­420ä©*†0ˆ|†A^!p‚d,ÏÕ´]y»ÿ8ªbW, `*cæìaÅ0ªÅ•ˆ…R*÷ç&Š¿?`á+ð®‹2`å W^'_ËÈa8ѵRc§T"¡bLëmƒkVkµ€½ [Б†@¹R(°¢aL©ôž&l¤/TŽj‘#¢a×/qPŒ0Ð$¼«D[3ÅY_+h£Õµh>s ºÏ¬âWáÌâ¬Ø÷ñYý°½0 +Õå¯i&£‡{M·@k饷yýÂÐôûJ´·2ŽE6'‹ã¨ÉYXék › o "ûüÔxùÚAÆ™;{‡±ð¸îl L—=jDÚûä´ý2¼ƒU\fú›HÆ»õ_O¬\ .’.^›×æÍžßn÷G2/çßö¨-GlkÀ–ãhlhý™Û.‘C?£½%yý„À&‚<‚øc{°hIŽígN«:@¥üæôÑlNßEÔþÜ¥yx T7ÒÓmc›¿uSTËož»üL_â{íwþB¼€“^ŠÁßã!؇Îݱ ~“¼ñè*oR«Í0R†K$Éç÷«‚îÐãÏðÉ VÞs=è>q0¾/¼:æÿÐ^`/äˆRÿ4›$¯ª{g±tU8N= ˆW_øÁByjéw[/H:Ìl¶¾ãÄÒ}vþ)^Ø#¸|1€ý¯çn¬ÌF!x^ìÏÙ ÚãeºQõAÊP°ü’Úrû!Kåñ@Ú&ÀxS²ªòÇ{ Öt5š§Ü–¡Ç øÍå5)æ­ +­R…=¦Üø£ïf;!^8׎nóHK_ú‘¹ˆ‘3Gå1óßê=¦)üƒÏ˜ >8ã‚•q¦ }Ö›"`!<ÿ²ˆÎ½‹˜Ä7AKÐ.´¡fdp×Ö ³·†^&nš'­: W¿[<7•òÿÝ^8±ð¼¾°…— +¹Ë’óÖU‚ø‚ðYôù‚Yûhª]˜ÝpžòØUœÐÄ9†ÀÆ0IœybÀ ‰<â®.+ÎkÏÅ<.%á½®—ÄÛY6]ÅRž3Ñ…†`„Z¡n‡­B5[Å“š#ã„—~¯ç-C•Ìÿù<Ò‰…ë ?Ú°pwY1 Ú«Æ3Rst¦æË FRéÀÊ\M9áˆ4ÌÜ·øô e³]]D²BõPv€Îç['zh“v"ï÷–¶RTµ".)JEå ‹¥HSb~ØãþŒËEÔ“,ˆb^Ò¿›ù|Ú '^òÂOwWÕ`BôžÉmªªm-„ïÕØ3èÀM3ˆžp½Vjªs»ÿ€ÉŠ^gœ€F¥5!GÏu=³Y/,ü?*¥êjQ¯% ëÂж„Ö&ù“ÖJ”u¾gô‰MYd)²%Ëb÷Þ-b€…“¾$/üŒ…ÑûQÎÌô§ã6ö"ßTKRÆgŒ„D#“wüH>aú +ˆWEÐ3;ÔŽÐpL ì 1ŽÌÇ*ø-meŠ`,D€Cµ·V—l3±T‚ç‡×·S…Ó$aÀ1̾ §ûaán>Û'/|^ÈYrŒ ìZå4úÓ1ìÒ¹ž¹j2Âc°ÝHˆ– föªtt’RµØÎÀ ÃŽáàÔ“|/_¹6jB, /p`!+y¾³ˆ…¶Ö½T`!cÝ +¶sTe¶Vdç…ûÌ÷l®¬îb/4¢ÿpÒÉ Å 9ºÏaÔrä¤'y±¾]¨®HÊ/ÄÄûFL®*4á´d}‰ök&à†sR¸þÊ Ý(x¿`:Ë\7Â^°Ðáþª& +° #*_j0U¯‰¢‹j:´àM5!V,÷™W ÷Á‚ôŒ½Ûýóä…dzèH¤³¢5†8­ëÙºšÆUmÜb˯õR—s¦Jçy£Ì®x*-©˜jµ#èÜ펽%,g³bµ†/¡ v(]’«Á"h µBi361UAkCÖ°.VŠ“.T‰±Òá<ÒZÝi“ÏB)*fýàûO,üž‚Ô9»¹°çõzÊ݇Z…Õÿa_˜s›…êø˜àÍ:m»°=ç3À5^ìU<ËØ-ËÒ»‹ßSkÒÊà·½5,ÛíŽvºS@ì;MP…A¼7ÃñÉ Æ G‡½¬ËóX¾HVùœÊò¨vTÅŒƒ˜ÚÊç>«×ltòEòÃÇ^¶ö?O­¡i õ÷é´÷ +±+õü^óùä…Çã…[˜¤?w\úï.pÒðï>ÙsdXæ;åå1–ñ÷E…9yáñxáê„3ð>ݟΡ7Åî§çðíØ;Š‡MØ{…9œž ®»Vs?æ©}Uc¹ú©¾¨‰‰PnÚn¹›–T‹÷=—“¾ /Èí—±]´¦Em6Ó× Óu‡íŠo9fys´ß"z°5"–BI_èý8×MA‹yW¥´¸|qÝ`La}%w?·?]‰:¾ '/</ì©ÈÍa\2Ùcæl^„ç‚Ã` éwŽ +eem¯gyèÔÌÝ8‰nT‹ná+÷ab3ãÞîÇsR©*v€›”[j¯—¸ü¾ËOÁO– ñøä<£”x³[æc:ÎóMIÔ{L†“œÍ½³ÖæÖÉm^çá Óžƒ¾ƒ` çû4O eš&euÅT \vÈë¤*WÇ–,Óš¸1l^sÑlðÍò:äªVÝŠq”<¡¬<üîàš˜ä\u 3Á§+UÀ…0—:Pü6ØSeù1gÔŒ˜s}ÄóÌ£nEq£ ï0N^x8^ˆ­ª÷Œ‹†2¡J%Äl¹Pc eØ’:vÁ…©úZÐÀKÒ­3w¹žM®&•ŽXtlN0'a¯|M7Ú9àq¾d5qs?aìíP@ó.…˜ð:é¢ÿ„~JIãRF®”HS9å®äŠS?íß7HËPÝ3§mèßc2œ¼ðh¼`FUú…Õ‚ô9O[¡ÏZ× +Ú‹Ö@A-ÚZô–”—}o§Ö«ºK‘WÚ™Ná¾ÜÝ_8iˆ˜4®UsEôÀW³ÑՃѓ¨õ°D{±Ø,kÕŽb1‰å…h/1»W^Ñz®"ƒ#ªËEçK‘×ÌÍbª¡+×¼þw;ÚMÝ=³r£ÉÞ…“ŠbÇBÝD4+ó²(,íˆ(Å‚4 +Ö‹AJ½,=ƒ™«&8Y´¬ŒR7¢uÕ\$-%ፊALªÞ‚~#u‹[„À:8V/@ÿªª’¥ §í.¼¤#*ÕαêÀÂe/•‹VäÌB6Þl™R +ñ¾Ï†°7¯`œ¼ðh¼+†Fi.z]ˆ”ÒÜzÂHňÑ÷‚XÏJuWÝ"´iY4¨Fl4`bd—º-` 6¨BSÑgÙ<·Âƒæ4õÌš€Çe׉¡Pï 7›Œ>‘öØð造ñ|çÍÚ K¶0èûŒ"/p'CKë?y_cL ôÖ­õ'/</„VÙ,g½è#X¹kÖÂHïÖzÇÂ¨èš E=dkõäFmrÎpW ñ°.Ë:&Ñd 'Á³]gåsÄBJT™ãM™@¡Yƒž¶n¢?àº6…UƒfåŠÂþëüàÊ OkF* å”ÊÆ+/¸¶+| »ç}â`¼Ð’º7Gï=yáÑxšc%#ÐC˜E™DS‹²c¢±‚ûYtP@™¹®-KÃÄhÀîmcXD9 Pûá ÌŠNƒõAQpVá3KšH÷ãÍ<Ç'6í ;¦š ›(jV£ÓgQ`TŒP&J¢êe ìåfæÀ:/+Õþó\˜ÜwJšôÖTP'/<Ü<’Ë+Ry»Pc|GRc̯S¦DmI4‰”Ï»kÜÐÁ¨«ôŽ!ÐjNsjú +ÆýÐ@[xVpð–ê­óîr|x‡cƒq œ=RD:ã<•£3IГJ¾ ½¦DúàüLÊi;ÓLæ¸àT$×wÓç¼zcFÏ“0ÄcÐ`Þ¢ƒjÄ]9ûkt[ÔÆè¤æ/ã¯îö§»ž7³Ç§tnwZh8ì›{°]‡®Jûñ̽|¬f?*L Ê%¤^³ŸGgõ̽.ã~Y<ô¡•ãp÷@ƾ1•òÉ Ç ÛË@w¿IGþ{‹óõ#/²§ËW®òã‰?4ñÃõ^Ë…þAã×Ü?À=˜ }xN^x0^ø¿ºyþþY¥¥dl3oÂÂÉ Ç ÿ?÷.Ü!§í¯&C.ÈL†“N^ø/Åô­¼¿;“Dß‚…“N^øïÄ}F —7˜ ÿÈ “6§\%|ˆþ9É)o–˜ÎÂ_ÃôÿÆ Ážrù!^`ËRÿÝû¿2 Rþ­y?/¸Q`RáS®òï*£´3;åsD(þ·*œšwbAÚ²:åIæù#Ùþä)Ÿ“%cã +·AýE¶wba“§ú£|ÈOó”Oç îæX8唯'±åǧ?O,œò D—ÿpøÄÂ)ßs!Hy÷yX—…¯úí)åù¤HLŒ¯š@°:«ææ}0ªÏo\Í«IŠ1£ž‘æ쀅 7:üºLëŠÁ~íA L†.û$,HŸŠ”wË+Ù½àmæ_î¥Ì×ÎS²'3<Œ*a #\tá)LîáÀà_ìÔæ®±Ë.uÍów|}Šu¼Hó`c3¨Ãç`ÁŒªQ4ñ ã>шofÅ­¶S.Ã="¾;JŒîXÖ±ê~9Ny÷à9(™e¥².äÔ;i7O·8æR—ÌS9µ{—p’æ˜f×ïõ¬ÏÑ[Ž{AÀóG£<ÃØÇú^à5·‰GÙ¦¹ÆwiɃíRêÃŽ…!-£ ÅœZçò%•£çbšÒÀ¶“EB£ÚQÇb çjÊF+¹JºPÐDÊá ]Ýå„ñ1 Œ³)›pᶋqJa‚‚A·\ñGã\->f2¼ [á‹@HVŠÄE­“JŠY¢f®¨WÛ$sÖ+BÄ9›™¨h÷'H‘˜… ­ÁŒ…YÅ0Á(ØX+?‰VO,ÌæS_`!8ÀÂÈè$ìJU®ªãK@M¿f¼j…Yõ`qT»[uk§Ü‡qzL+'Võ'axÁ±´QµX5…V•‚f(7àLTÌLbÞ ‡Ÿ¼SôÄÂc͵ä\‘¤è>eÅ”,¼  ¤b‹ÆÐcŠyБ&1WªÙ]Ê• +´¯TFÎ(è 2,o‹‹q ,$æ±RÄëA0±X®8WÕÆ,b¡à0Ec%˜šc/ÔxΧ>˜Qr>8·•¤»±ŒzL°^t/³ Ÿè‚OM7„ÌÈ…Wcì;èú±iÃæ6(ð±˜svЄøb¼ æÃù‚J³¹±ÈáVÕ…µÞŽð +jë¤Ë¡Ž”#µg÷{°Î‚ÑÀŽÀc.Ê,¦x“Qº=JØ~øˆCvÄÀaÚ\<4öØ_/ >ÉÈyãô"SГö³?6k5ýëÄê;}óp1øÝ>Ùß$¼@ÙჱÿÛ«Ûó +Ÿ:ÒÐ/ß^ø©øw¡Ë>ù™Ê#“ö<à-®a—AFÜ·¥#J]€£M†ø)X8å”Ï•Ð0L4çîÃHK#öXV)ãð%xÂçMÜBGષ>±pÊ—’Xb00i…-ãSÇ®wcˆ°®+Þz1/­.£Ü;Ç™5'NùŽXP¹ ¶~Íj…;ÐÍ(šU¯µè½ò™Î8|ÎbF1'Q-*}bá”o'ºd¼Š¡"ÊSAê-l˜X°Ðj'ÌáXÐœûÝKUŽ‹ÿí9JN,œò•x-,PÖ‰1öL0R8ã\áç¬tã®#©†ª=+×>s‰݉…S¾j‘w¤¹‹.o¹¨[ÆR.ª¦eXHÕ¼ÔúÀÂ1ëåü?åÖ:±pʃcA2¥¡v˜CКu}Je.š,+E¡sÔ‘¢Ãô¿Zº¨Å÷+X8å›Ù *´Œ›° )©šÀ>Ð`/c8³ù¡m±RÔ¸kjôF'Nùn¼°”5b ¥PL\ìCÛ9`ŠªÊ«#8¤ñ\0…©¯÷oWïžX=±pÊC‹¡ý&êòÆšÐwe³ï㔶A:0}oXF6eW_ý/ó{M† §<80¡£ƒ7yøH]\H_Œàä“÷‘„£Ï½ù|1N,œò-EÆY¼3.Ɖ…S¾)ŸXõΉÕ §|W«›Š%žX8åÃ"Špbá”S6é’È݉…SNÙܨÈ;6¹X8åkIí{&VO,œòå]9JN,œòMÃÙ›³œX8å»› o]e8±pÊ·–wlr;±pÊ÷Ö’Bz«ûö‰…S¾·ÏÞh2œX8å»kIoÍQrbá”ï.º{ÛÄꉅS¾½Éàˆ²î-X8ÃÿžòÍÅYñ–‰UÃ)§|sÉzÑe­×SNùþÒ zÞ„SNAa,;oÂ)§€x•Î›pÊ)(…hÏ›pÊ)(¥²çM8匱ó&œr +J-¦ó&œr +Ê$Šó&œr + +Qî¼ §œ?oÂ)§ ôçÄê)§\M†sbõ”SP2~úbœr(ÌÙõEgúe§Èô_{‘^õ7èF£¨ÎnpʺÖ 3Â]BÕüåãðW£²%kõS7ÊÊñ4Nù¢Ât_&г™ÎËÝ_×d'¾zÿc‘ù’ŽÐéœX=¤âÀ =ë\®Ë(ËqèÎ-' °Ð0>¬ÅÀ˜Ölö9çó—žó±Ð¶@x†^Îûµ|û‚&#gG8e¥l­•&u¦àÿ Ò%]«Ø:ˆ¶åY_¨¢j*Ô‚'ÕªlÔÔò5š¤úIÑLð6‰Ø‹EÁ›púbœ‚c"·%Y—.W:ªbùJE±–leRCdyÏTìºM,QïÛg@Dž/¤¤ŸWѬNÐøE7‹u¢>»Â)sC†µ!_5bÁbµh`ƒŽ-Y––¹L-ÖW ¡‚=\ì…”€Iá†Îô…±°’Ócõ”uªHX7ú@ ± çmçŒA—ïXÕŒœé¯ì“ñ xƒö;î ±¾0J¥Ï®ð/9N"­@Å µj 0:Õ£`…ÒXkÓ8ï3­…jÁd 0¢ÒF4ÙÁ ™¨¾fìˆN1/NÉ8ήwi]uÊ7âÖ‘Äub¬ÚmV,ݪqí¡`Œç™Àñµ¯Ö®[]bÀšäk$㺰¯©xwâ\|>å7É^¾=•ê_?ýT)ûš}ªS'N9åÄÂ)§œ:Ò)§œ¼pÊ)¿ÃÂ9tÊ)Îõ…Ï”œ+ÆÎÿäÿîŽöBFÑ7ÖÐfVOÃo}_Ô}O3x‘—Š–zºþàü$>_Ç×à³5·ãÕrÌó9Éç£ýÍùù}džBÌÕ)"‚Ü‘2…*W-Ì*9«fµ¬!%&é¼à‰r]/YÅ2öj\š’¯ä•€¯S¿².]] á + +KRùúù¿¯A¡ÂIŽ"„ÜÑ^ÐL”öËŒý·Z¡ñã¥ë0+y†>^ÚìXŒnßf(õîIæuÿž™ýÇüB†•Lóp¹PJPgÍÔ×;g@».>’¹½Çi³ÐA_.¬åQ¥4ÍÇÏqn/Šaßâô±ÐŸöÙã¿+/°N4€…HžN_¡W«^b—ûðXæÝÊz8&T¿B0¹–ðeB^HŠ nך ݬ“}_·×Åý©èWJ5kFhF|S qäJTÙ:@«õÚÎl÷¬l—½€®-W|辧k2¿&¢Ñk£W÷Ý xòÂóÂMíÍê…eTèFìÃ_‹o^ U5Wz½tg¼*+¨hôÀt¡ŠHÊ\QÜT¼¬ŠµèsA³4d¼ûù‡6éN!È2VgbÖÊAs¢!82ïE¿NjÄ£7o½(uð'Ão¸4VqU¹2ækQh1ÅNÜ '/üÿðB ¨…nˆíhññ{Q Ó4d?V^Ðã‘M t÷,®Y>uµÈL™FÅÞ 6@é—½ÙÏÖL[` hI³€--"á> $‚Nuå"jÜ¿^+W« *‘O/–T²X”¢ZqB´ÈX~òÂi/Ü„Š•ŠEŽ´¯%v»í…ÂêŠïZÙ#)xÎçå U +V"ëX15¼‚…fwÞ^.Âʵ%Š»µ-ËwªšçÒì†o².PP•nz±ec`J÷Í[¤íñ‚ä´N^¸ /€ò?á@¿A-fß»óÂ+XÈñƒèg4.Š¼`p‡¯|³B/~ ê[FÑi^ÕZåkTmÆo +ÐT×@ŸÃî‰ áîÁZÝð2¸C [Ù|`aÈÅŠ×9tÚ ·ˆXÈ`Á*¶Ì"­ÏóH ÷6+éž±ÐGÆ[FV©R§šA “Î#íXz˜…EjÕ ô>_Äïá¬eP™u\€½ &(RâL'ºN™‚ÆÕ…  ØN8ëñWîX˜öÅ}u¤“þoxaÀµ¶ºDa!é0r´zC‰¦s‚Á¹yVPüê+²Hâç4¬zJmeÝ® hûð/t¤U«˜Ó”­yú_{W£Ø6«CA`bË8Ø8ø“÷Ë+á¤ëöuÛýî]Ót5[ÓÛøO‡#ö_ñC·ÅPgEp×Y|¤s¨#51n¢êR“Wçþm¬®© ß.¸°q*Ûˆ œL—*†ötðÂa/|Š¢¶·ÇyNð9dìà…¯Â ÀÂðvý?^ø*öÂG‚äs\æÁ /åà…Ã^HmÙþlœr˜þ]wÞ˾ÿ¯vl\ry‚»y² /|i^@‹ÕÏ$Ãü»³ ÿ_º§ZtžÀ³OWÿà…/m/è C:¹~Îýu£ÒÜ ®H…;‘dŒ=wÜué˜: +—W>”Ž ä®+›‚¾]G®èˆCºf\Û˜e»»4ý¢zÞûÔÓÞžØcŸ«ÆIõ Û68%½ºò»¥wÚynøWÜc‰ãà…/Í íŠ4BVÔÆ&ÆSEj N©Tߦ†>cR5ÊÙg´Ésn+B®0¢û<Õ©aÁ„4p[²1'žofTqSUÚ 9t…`L5±3ʉ×3u)j@ì’3ú§¤õ0^p|á-Ïz¸²pßmùm±vLÓo°¾%¸†×•þ¥©Ó«ÞO^x¤½…—Îê; —$‘p$É>ÍP6¦'1[ÁžA¡óR¥ +TêyùÌ +Π׉+°p©_º3[j1M$É+ ~HEŽòÙâZÈX°;XîkŽ +ºƒƒýWž­V +}Â2Íè>˜* ¶2xa—wù]àsýÛ,ÜàÒW{W(_Ur<»›)¯öÛÁ GêQxz]ëWÂIíF/ BÃÉPHN‹à’hÇöB ðÞ¢b? ‰³IÃä7#Åú +ÐÄ% ‰VêÔL4'Sò» ­ð6útXë}Îâ{áÀâ½QŒ]uXyo)oñBG(ÚAd+“*–´ÆØ ¤ÔÝ•½±%‘°0(Ò"[~º×Ñœ­8S@s꾧­ãÐ_FµtWV9´úÅe1Õ‘öÝ>xáaó §V›¦ÀJTì4W±,¶ #BÖ1(GXhíÚ¶LyÝxêðsE¿èWV°ôÊGRªT@ßGÎèö ž=®mxÍ ×õfjÛlœ Í #¶T_<ðñ¿i/À”¶0iŽgí"uZs¶HJ L-;Ò†Ä++D%qƒ=ç¤Ã ©£p +–Eƒ%v[¦³›ÊæÙÝÊ +ÚŒhZI¤¡ +ãG\#/´/ܼð0^¨ˆú£÷ÈžzÉiµc!HzÙ <8T™e+Ùq”5†¢ÊX «£.“½X‹µþ 5cÁœÙÑ”ãæ“åYgø + ÌApa=Ègý™ébƒ¼UoŠìµ6Ì i dƒ©"µ/&æ/ì9 Ni +Ò"›5&KÊ-’êÏMúÓ¯ŒÅA®È)Ǣݟõ#tË R“"ª3+¤ œV!ù<ÎM¯Áé…ˆ²;xáQöBk¶ +ŠÒTðò ¡1zKÂ;mh– §.Š ·¤ùò[$ˆžºÆ×XÐ7,`m!Ddgï[RÒ`|¯°àMÜÈ(pf³˜e^šµ"1Û±63 ?šZ(±®±Ñ}Æݳõ™y1EvªÕVê9VvDUÙ{°4ón/( SÊWÖÙ(‹7,œx]‡nØTÛs„BjD¼åÚôku^j3=+/Læ1óÎE˜H)&7Ë뙺¤Þ…ìæFN¤Ð’Òß×ÍL¿ØKti'V“óË’¬Öί*n­‘–+ë4—J¹©9‘Þ|‚›£R3¹Z.ƒL9ªùÿBÄ|0/¤ÈyóúœUöÎ 5IüÀ:Ò®ôçF ÉæGÉ뤮¦¤ Ì:+‚…ÈË> ùQ(:HAd)Ýx— ŠGb^H»·šYu8xáoÁBŸDá}{Þ9p'á­;/T<ô†¤Ö‘L +"Å‘MT“Ôj —ÛЮ z—Z£ 4ÝxÁ›L œG„êA¨ùÎ Œ…z4º@˜í…žöÔЗ¤…¿ÔOõÓd¿x›.M&7R¯EVîƵ=YÌI•¾¤›»”Ky/Â-x`ãJòœHC¬]Ö"I 튤\ž•àyÚ¶¦†©™¦žY•¤éÔ¦]ãT}™fR3¿æ˜ê3ð›™]Þ³Ìã³°ßý‘tàÙ‡£<Û8Ò÷¸È#ú½KþOäZo~;8>€~–Ô’ôGCšŠCàŸoé;,ì’©mö>ø¿Ëú[@9ñ4ÿðS}f^xw,¨Jæ’‚ÃM\…®r"HiÐyØ@œ8±¼¾9’Uš]ì¤Ö„—Þ[ð£`_¢AÀº Q©É¶l<5kÇAhqérÔHqNŽ¨®ñ•fà4TXÒæð¬–[MÐ)jŽ*PÉnÛ ë5gªTÛ#Øãg¼P«ú»8jÿû[¹–ò‘pû·WJ7šÎOâóñx{aC×Ò]1TF&½ÈÄ:ÔÅdV6µÚ}(£‚²Âka<‰<Ùõ[0ÚW8w`ûăÃéd2¢„ªVilFÜúyàq20m/òæ8JRu!t° ­à*˜7h=–Ê”ìRPû%´=ÁgÕ´õÝ_ÒOxAA+^»Eõ⎌¦ÿwXÓ" +§±3ä¿´ÑÍú9Fý?ŽÔËT“À³o´n¥¹$ŽëuÓ‘PÑkO@brdÇ£bÿ3öLÍ[a%•jô8«!Õ›RusÒ>Yq5ÓR_XGÚ ¦íó†t[Z^â@rÃ9»<â>U( »cè…g¡Áq ä{5+vIï?Kñ^PØîí÷¥a¶Ù¥ü/é'Á0tT„ŸY%ꟿjôM¼0ï©úuS +‚hÓôî±çu4Û-N#~¼ÙÎ7{¡ r1Á沑>³(¯…Ž ÇOJ›á@cyä£dKÒs8hX#;t‘Ö¼½ãð¬Ñs@¾ ãaûbÇÂîµ0p0°¯zL»‚ ™›ìÊÜÄ»¯eø™½P5UYlVˆ1¹MXéSY­ô„Žî´°5©Œzr•Õk—†Uh[«Í ]Ò³"ŒÓgà°á׋Õ!ž{!ªTz•BµŠšb艋(Iu¬˜N6j\Ù‚ž·˜W´»‘¥×3H'Ì—¼l‚Oᇠ쩺j"uI=®|Ñt6¾Ž" +Á1ÍŸ-x½®'>Ç-¤“Lßx™NXÂBý‚Ž\˜nÇBÃh®d}¡_5æÔQ“Z”¼µ?ˆrOêÌ:Ó-l&:G= á@ÄšžÈ™ÖfV¹™IR¿"àÜ¿ÑDIÛ,=öì‰qЦ¹¢¢H¡ ÀçTÑ„‘TKÓŸ^k¡Ó„MA}àÖÒ³hÌ<¡,ÌÄe~Zn Rf*1¯©Xai ©¯nŽ|qSIö^À¥7‘Ì6¢Ù«ÂÊqé;dØ­'\ÕÐpõjÚpÓ9ĺÿ’¼ H9*ïqCÂMm{œF¡Uæzû8^²c½äšzl².`2kì¼ MK;ÕYGjèÀ”}Fªí6œJŒ ^cÁûÝÉZDžÌÝo]•ØÑ)¸9Mo¤…°Ð“ºdIQ5ËW(?„rOL³À°&¤mÍ +ý'£K£~™Zìá–u¦>Cb·Q™ ¨[Wpm1u©ñ‰ãŠ‚cÈ–˜{À¥±—¥®1vª¾Ç¼Š=>ÄÊ@;¥¸]LYeëPñ[~5+:u!åM©€9ý+½1z5=1ë‚ò:¨š[#Î^øA«kœ<è”j¨âe Šˆ_“˜á·*­ÄUŸ zͦS •£§,+iÒ1{_^É𳩣}&[óVÛæPyÔƾÆ+«O+<2ÝjGzÒû_ìgãñýD–ñœ¶ÖRV-*ÅCUvm:±ì; y+ígÝñBÊkœ”¬é1èfìÆX€¬B^¶*Ç4`ä‡È«òèqš%¹¸z*Â$»>/,H‡Ì#sw,ðƒ6׆´Aâúl‡|ȪtËÝÑ¢û¹ u…cŒÔpbG¿*‹p½!Ø¥æçÿŠ²‹œÚÚÒ€4’Öê“FR•bö¾ÂLûíJ¿˜ Q|I^øqØM-¿ÜeZ¬ÕOwØÿò»“þ¾ŸúçÐ^U¼u¶×¿:B-{Í9~É „“®¯±y)óöŠŒEÖ~"c€T(nÏÅšdyÆZLù¯·'çYGj1÷Ã=Ž=õüp-ÙØ’Ò— 6͸¢WÐã¨32/ôEHÝÇSjð•)Ç`$"f± +X;^Ä+ùlƒÛWƈcnìt«øҼ𥾹–ý~òIoëW¼ÐšMR§ooX°™*¶é…ö¦Ñ“’˜yaæ©ÄšžÔzAŸÁršHßß6èGl{ÀM[qÁ4®ºÆª¨°öP6¸¥l(O†è$WØ»ß.õî¾ó‚l­ÉÈF¿V_Kc%É”ÖC8C”NŽ”Oû +’Àž‚­q Å ¾¨½ð>z—LŸ³üÚ^¼V™5½Æ¦–„4´¤íl©%-éÂ_ò¶©â +ÛN)6IÆ:Ï_¹üÒ^À7µ´74À7Ô¹]ñ:ûsŸ÷ÉŠošuʯÃúmð{Íô›Õ‹†©Þ˜R¨_ï¤Ô/õä°~Íù…¹,˦ì‹ó®ÁÿÖ¯Ò«¥î¥x{!J÷ûõ)òáÎA¿äø¿ßÅ™LXk£®~Ÿ>S‡pÏá3øp^Æ]ý?¾•ê%d÷Éë7néí&«ß†¼Û‰O õõO TeYüãž/Ï„…ó“¸Ï>Þ^¨Éì"Î Zq>ñîÊÑÚîÝ–ºì¼[ßýÝ*–ËmsJ» 6_ö± wöóÞ·.ó nÇ.¯«·m¯Nó.~·Pcóý†Õ\³È#M9iºz¥“\ÞËô>üTŸ¨|„½À3Dd>­ÆTùTj³“¤´Å\Z9Ä8§B íÑKv[Å'KcÊÅ¢YkIõkZVÄ@f[ fg ¡…Y—$§JOŽÍ÷T‰ÈÏë5 ºFC-Ÿl…·…Æå,VSHÍ»ˆ>5p%òiªÍèw꺎xªOT~\¿€ÂBk¼jîÄËNZÒÁ ÏË þa¼À¶sc s…{d¯>r¶YÉ‘P5lÖz¥HñŠ¿l>ÛÄ;§$§ +¯s­€µæ˜'án;çN]s¿^¬f‡‡,M‡«µ›sh©”(Bc¡Ô$ìº?Ñ—:áqPZŠ¦È]ƒ^Ø=cæ5-tÚsæ• +sᾬ³«ÃÀžFì­2¸WXàI#R•²gëÀQ­NÐï©Ê÷ }mÏœíܸ¡'Ù†Ý^Șá8«e9râtWœˆ v, pf^`,´¦KŽi«xª¨Õéà…ƒÞ À¼PÌZØ,j é3ZçÁOgÇû-'séÙ]Yd/#¬c01E¼’½`¡tìlÜ¿èH™l kBAÆÇ~Þø’@TAIíQ+M`—å;’ÖÒšþš±ÐKM¦GKF¯¹c¹ƒ^x`‘•ôÑyåú4Z±u»½à…W©Éþò¬«§K%V™¿ypœŸ¶LãZŽ«}›ºµ§VT±É™ÒsŽòtOÞ‹èB™J:6ßSã*Ác¦´;í0{±’iý••¹S;,ü¥¥Mm“ºŠX‰®§h9æäÁ /<°ôâË=þƒ¾8/üT0¾^8xáÍR_¾Üã?xáà…ÿ¾(õ‹jž%àêÁ /°8®=§<ðß²ó9!‹Œv6µ–C‰5ÂÏÚ8ÿ, +®j~%ìóúcdѱ¼¯ü§‹6vXóÖ`@Ô,’Ø8“ƒIHŒ–€àà…çå…÷÷SUP&0œçœÌv†=¶cf%yÒ-ÐUT9º‚và+¨÷ŒlŒ¤MZ¡æØøa€Äþ|Mjs +u³0¥eâ4– »A9šÚø‘Z)ój–¬_Ø碽e¬Œ"µæÊ=9ŠJÔ/¼ð{ÁÆ^hç=')¾Ù ÷•hªÞ·ùó + „Œ…ä¸c7®$ˆ0DÓø=8ÄŽB0lK¸´;ÉX˜Œ =+æ¡i÷\µ¨}î† E9¼½°wߊ¸Û ‡·Q㆙^øʼ@",&+´L7^xÁ‚$§Èý$‹x—åuÇB«‡q,jŽCµÂ0EÈÓß± Ò…Ð,©U²-´93° =gIM»·w6#n¼± ·ö¶.!ÆjÝvÅø° è/|i^¸ ‘…¡þ˜Ì[Rh¾aôVØÇyº´â /ä˜Ú#ŽôWÞÔìq†{¼a¡ Í’:؉sy“Å¡°!HҜΠNäÍX kü¾°Ð>f ð !c!/À^ºê«ñ‚zæTz°®ÍÞ0&¥ ¼\Ù«4/_è´»ÕªÈüšöO:'Ý« ’MQrPE lár6«ž¶aNL@umj`KºÅH°€ž¶uÍQ<9ø|Ôq_ÝÏlÀMV¬-åLËQVéëHJ”zü_,"êóÁ /}‰ï²ÿ¨qáH9÷h9Mï4Š†ênÿ¹çìúá¾ÛPž÷è¼áºk3CÏ&ð5)¾”œT¡ŠÊȨµAZ+Rzúú\dÿ ¶“OFî¼0äDµ° +ýxA÷ + µžt~J4uÀrÖôÝ^ ,p”J•sñÍc] +T;8 ^Ž¿gc:{áÆiŠÃ^x¶"_r/Ho]:x¯“=œL$Ð%Iì@ökJ+,¬á$ö U…ªÙ×%ˆU Ø‹­#Îh›w,\y'7Ï6²M‹6÷¯B§ÆÜ°pI¥j3µ°Ëê´c”+ ´SI&F "û–y½Osð“¥ÎKþ5ç)Ÿœ¦bÏã!-9Ôsšçw˜¤x¼½P"gúh……d¶SZ_¼½AÝÝ£†5rfÖ,a ÃbÁ"Ï/h¢’f—â4Ò‘¢½‰t;/t¤€õˆ7SO5)f^àSsþná¦"©h íˆ*ÄG?ŒƒþQ!¬>)4¶Z9­ 6¤GçßÄ š]Qÿù÷ó KÁ@ç¢Nó$5¾¦¸æiÉ{Hö aŸÖaTŠ÷ÏóÎu§R+^Z›iuËn©Šå6»\ŸØYuyiuÞçóO‘³,¯ÝTÇT×T£ìÒtðÂ¥6Q•¦ÆÊ’¨ú–Cν‘36=¯j¹¨øç{-ý)ã6ÖÂÈ¿âµ¼ðF™úªÕ¼lË°rËÉ:„$›ä +TvåßüÚ^xÓ^À PÉÌ Š± ³IsM„÷³y´ü¼ÏÄ Ö-»Ðää<«KkŸÖêo~í/¼©#µÑŽ©ó5ý$§ƒ™7KjêÆ–“ÓDÿçG9Ï JÍy1‡2œ»ì1Ôñ’džf»Ìyˆ‡°À‰5CøQ9ϧ:]ÕßöÚ^x£\àc’<ž6µè¨ï°Öjͱ/|þ´®6ô‡Ï¼°)8­RBWi‰B?m…ƒþ`YâÇ`áñ¼Í™ñHßëì£.ÙJᘂO"ÔÆ¦Þ d1t›c‰­ìUqÅ’õFÛ¼ðÊÑÿãyƒµ0rü– O[£’@Û«Œ²th± BB—„Ý6cÔ•üÛÞúÁ OT>`ý§¬ÕÙÕAª+0[ª#0F^ëö=¤YוájѼp”¿ˆ8ˆu5/hŽVn×HZ•Jsf,¸tÂæ{IñpóV’•ó•¼p”¿Ç^°É\FqPx° +ô¤W"‚ÅèJkÂEÚ,éJ °$•jÃ*bÑàêÁ%ë‰UÔo×ñ¼p”OÀ ¢Šù±¶K‰Ó–+R8ɹ“jêùaâ„çN¦"ö<×æÄÚåŒçÄ%mŸ$í¤£|~{!Oýà…ƒ¸TÕñÔ^8x‹:úÁ /åà…ƒŽrðÂÁ Gù%/˜æ)ã¯ÅXøX,åyÊ1Âù‘e‘ÍQž¦ÉGŽr”£å(G9ÊQŽr”£å(G9ÊQŽr”£üûR ™Ò¨û”f!ãkßøþ·1‰ú*yÿCÝx:žéQ>gQHÒxâ©Äa+^mñ¿M}0AjÃ÷U Êã™å“öQV«TÅ4Ôj<· ‡CïÆÂâÜœÎ]Jý‹*ÛÛ •*Ý•ƒŸ‰®m©’gWÖ©1ápM>Ê'-RƒóŠór@XQ¤3ŠÕè$QD”œtêP +±™œ—øÚš²Õ)Æ䌺®"BšŒ8”¤£|Vƒê)¶WÓÕXŽ¦%áN^¨$ sFÔ3,bj'Tms¾zO> +stream +xÚ`ŸÿVVVÌÌÌ777úúúGGGÓÓÓææ溺º&&&ôôôsssÃÃÃèèè«««£££ââ⌌Œ³³³ëëë›››ÝÝÝØØØ“““îîîñññkkkbbb{{{ÿÿÿååå=c?^endstream +endobj +5808 0 obj << +/D [5806 0 R /XYZ 85.039 781.388 null] >> endobj -5719 0 obj << -/D [5716 0 R /XYZ 85.039 264.798 null] +5809 0 obj << +/D [5806 0 R /XYZ 85.039 758.673 null] >> endobj -5715 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F56 2890 0 R /F74 4586 0 R >> -/ProcSet [ /PDF /Text ] +5810 0 obj << +/D [5806 0 R /XYZ 85.039 758.673 null] >> endobj -5722 0 obj << -/Length 513 +5811 0 obj << +/D [5806 0 R /XYZ 296.792 374.51 null] +>> endobj +1654 0 obj << +/D [5806 0 R /XYZ 85.039 324.568 null] +>> endobj +5812 0 obj << +/D [5806 0 R /XYZ 85.039 304.239 null] +>> endobj +5805 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R >> +/XObject << /Im27 5794 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] +>> endobj +5816 0 obj << +/Length 3043 /Filter /FlateDecode >> stream -xÚ¥SMoÛ0 ½ûWðh¬ˆúÖniÚt.°,MÝS×CЦAzAÝlûû£¬Äölc‡ lS|$É'N‚ÓŒKÖ!“ÎÁS•pØ“ç:Á"?Aòæ¢LfK£9óÜCùÒåÑLi åóCºø<_—W›,—R¦èY–[ëÒÅý:Ãô.ž®7Ū,V×ÁRtˆéý:¸¿n2'Ó2‚ŠUçž¹˜GK2ž=–7ÉUÙ2m9+h¾'ž©¥›„3éü¢ÎÜUB<™Vòd¿%wÉm›*úĨ©©œ¹Fƽ—³tËÉA99*Ç!Gâ,¦* AcGKÿ=çˆÎ•kš‚× gx‡® ­õTÈŠæD[ vÏŠ -%\ˆÜŽ€J0©°€Õà˜7&ì_Ë j@tÌÅýãšoé…Ã=¡LhÎÑäpª­Q{缋i(hÓÓà oà°|Ýÿ¨w¤×HÐ*³eàÙFQ´–ÿiÈUHÒÖÆ\»ÑŸ CnTä µŠj»ßE1¿êj{Œr?âw‘åá:„Ë’×Û㮎ç}ìSÀ¾gÂ¥?ÃkW¼’9èAÒ†q™wÛ‹´†IA»Ö '»%¥’b–¿^”ESÄt qÿy[Í*IrôÓ;Ñ‚ô‚h5ÔrX‰0n8<-Ó¤èêþ ÿ-;endstream +xÚ¥ZYoãF~÷¯ö%1l’Íà ,àØ“‰ƒÄ£µ‡ É-Ò3©!)Ï:¿~ëj²%QšÍƒ1û¨îª®®¯Ž¶Õ̃j–h× ÒYœ(7H’ÙjsáÍ^`æý…Š…,,šo/¾ùNG3幩—ΟÇ}´ê`ö˜ÿê\µ||w?_Aà¨Ô/â8q®^ΕóÀ£ËûÛ»ÇÛ»÷Ø aP9?/qúÃý< œG&º½§¯~úöŠ{ëÍüáâÝã é H•¢˜Ÿ.~ýÝ›åp¤.<7H“Ùgh{®‚éÍÈéê0~uñpñïa+ž g¼jJ+†nâ'ÿ;P–öô$;o¶P>,ÑáÉ}h•ûpËïï3ÜU¤´ë{ÑpWQ8SÊMµÆ»J=7T 'ßwC¼=¸«»”ÛÏÊ)µ*Ô‘NÝ$Q¸ãìÓL¹^˜¦“Xm’~< |s»Q³›ÄœY’ʶ k_’T%–U)?u£XÏ" ŽbuµÛvYâæÝ~š/BO;Ÿ±]V0^á@ä4uõÆ­vŽÇ‚éªÌ ùdÆ?ÏýÄiðGûQFÊ~Í­ëŸrùÀ{¿Òê¶+›š” ÿ´ð¡ ¸½†Eå˺.r«sT(Ý0 ŸágDzd‹@…Î34ÛfÃ'];ä„AâÜ>ãTà”=“äÍ|¬‹®þJFà@ñp å|£É R”²]õšõ(M’îúf“õåŠG¶s?uÚ²î Yš£KQï’ÓÖ¤ù&'­Ü:ú4qúF¾ë‚«ª,ê¾ãÎp³ &ºÝjE¦I¼s>Y"½Ñîd¯¬ÆFìÐúÞ˜N‘¦é2v¨î + ÇKäÂä8[Uâ#°Ž¥éT[Ri‰;öƒB<ßY.o°8h(øí›-Ï4Ï2`”î…Îj¦û…[“¡%¨ëVm¹íy ¸Å·öÖ¾³b‹Fý‘„ÎãÚºlI¡ ³7ü‹‰[Â{0Zï¿øÚ7‡¬ÏÐâ¸r>íŠ]Á$x¡ô]Ëúèló”1¥Ù¡ç¥¾Ó­32+¡~6¦‰Ä¡ÊïÝ5÷Hò†[£($C}â4i¡©ksòU ½<ôaaª]F3Ë-þ '‹ž\yñl1D‡ÿßó[;toŒ®>Ž®:N\?æàzù› +ÂÍÚ×N]ôÜØu7ªm¯.¹‰tø¿Ã{éŠ »[¾¸‘VÖ|«Û˺Ïò \:hœ±-˜L¸Q‘ݺÙUm0µŠÐÉȶ0@à©A\qˆ‡SÌ >ò3lߘúž²œôÇ9Ãpþ?°ó$ÂØ^I„ʺ^dÉêœÇºf3.º Ø$š5yªt¦Š³Wäzx‹Y-ÉF„œ±Á¬cX‰f™Dq8¼éxœÓO v^ZæÚ£fÞ˜ÒòÞ`ƒ+ãȉgËßÂܧr0²j6Ûª`‡iíUTå†Ì<ëeŸc%PΟ&ûÙ2MU™>HS*Cp¦þËm?u¶…žsÏg.$zIB‘Œü{÷4Ýóú<2\É+²YÃLÉV‹Íº‘@Â>£L9Cô'\Ô_HNbèý ‹ð1Éo (vЙû£¼-÷Þcz’Øy†O%C×ö2‰>ÿJ`3%mµë·Æ5ÉEå’AVL\’1ÄŽÓ ÅýèÈMøŽö‡P ¡‚ÀgTŒÄ^ùuyÂÇC|vã4:ëã-òñ¡²ë|O¹¡ ¡ô¿y*>䧼ÈM ÒŸchhŽ8îE¥|7PþÇ+ÒdCi"µ1B'’/,éFÉñ&¶R‡ Üîz.“?l¹(¡*þ§DY6åŸ=7RT?l1])†ùDÒâûÊÕI*Rìß3yÕĹÏzz‡ðÁKØI7ö%ó;>j%ŒÍ¾(÷Ïõ'ûVð8ÿ«hP,·Ž1÷VèÀ¤ZÌž(r–ýÛ„ü±r}¨«˜U…Y>æ]WvmPmœð`\ƨwXµ‡‡s¹˜ŸúPžOJ,šÓkˆ¾d°ç{ÈqÒ`mŽ7cðýìÝrpÊ~#¨„¡¶ûÍ^$¸¥§ª‚mº¼¨WÔ»d×~÷aâ"$žÊ;mˆ‘Ý‚Ç4¡ä +l9ÅKC7õÿŠtœüòŽ`xBÂ@ Ñ®¨Ìd{]†I`ûÌ©òdÆüx4«SV§=uÞªFš3V%D_´ª3 G«:à8mUGŽñppZUçVµhí”I  =íE¼À "ccó8vÚ”ùqÂoâåhä;ijS8ÂÈMPj6S’ IzàH"Ç'Ïã÷#ˆî¯6Gô »)&Ükì»Z3lìÄ=ÎD½ ~Ñ3åæÕÜg—K~°Y[KG[üòsë1(uÆš4«ó)ŽàA ? Ü*ª¦ÎîýXü“­ẕp·t ûdRahgô2 + Y6:屪À¸9a :[0®þÛ²ßdÛ)ébˆÒ«Ü\ê_Œ7ô,k_—¼aœÀ,ÈèóU¹Es³BôEÌža8bö€ã4f-Ž×k©¬º)@‚vã!gÙÃcèGxÄÁcpJ£Œ‘(ëøûÐ<÷P+öÜ+k|rÂÖR~'à¥5@á$¼¡S¡yjñœ¡¼U?q¶€€¿Äc×E‡ØVÙÊ:ÍÓ› 0¶ñ>oŠ×r ÕÞ¾':–<ÍG¶™RÕò#‰ÿŸ¦—r& ´]CcwÀ’o2Av†÷Dèñc)Ò¯bMpÃHˆC˜’ェŒ&?r„΋y| šô±ßq¸SfÈè%"³…œÑÖÒH)nÏJéÈÊçeÑœ”!ú Î1uÈqP6G|Eì×¼¥bн%ØÈ*3Å9vèžÎ!PÊõ™ªj]y¦|ÙQÚ3Œ¯E5•×ø,,o‰H5¥$Ýðd‚ÓKF›§‹ÊÄó¬oߦDöCWE&qò'DHÝ(ÕÓIü^ù±²Ó+eŠ“ú&D“ŒÆX‡¶8üÒÌJñ¢³žœßaXXrûýz|šëŽCê#£Ç¬ô@ÿ"[2âòAOê~´^e$òg ÓI£åÔÞ†BzØÀ€n²Þ9ÿ”Œ9­ç/_,š3¢/bì Ãc§1fq|8‘ÝxV>õË<Žð7Ä£?Ha2ðS¸sA½gp§ç1ŒáfÊÙï9Ó¬ñe©„ vƒÕÅIB‚çOjÓ›‰Ûý[½2>¬nœ¸í:•‘…0%‡òjH4d­GÿðR…³endstream endobj -5721 0 obj << +5815 0 obj << /Type /Page -/Contents 5722 0 R -/Resources 5720 0 R +/Contents 5816 0 R +/Resources 5814 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5694 0 R +/Parent 5793 0 R >> endobj -5259 0 obj << -/Type /XObject -/Subtype /Image -/Width 780 -/Height 575 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5727 0 R] -/Length 36251 +5817 0 obj << +/D [5815 0 R /XYZ 85.039 781.388 null] +>> endobj +1658 0 obj << +/D [5815 0 R /XYZ 85.039 489.543 null] +>> endobj +5818 0 obj << +/D [5815 0 R /XYZ 85.039 455.403 null] +>> endobj +5814 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F41 2994 0 R >> +/XObject << /Im1 4096 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5821 0 obj << +/Length 2727 /Filter /FlateDecode >> stream -xÚì]‡‚£8 Ó;¦0üÿ_®$ ™š™ÍÌX{»—B èùI²,ͳ-Ìóüa‰ .XàÒÈn °Á‚°ËÈ. 6Xࡹ UBß`á"9çÌÜ…?‹à †Œ¨§oxÁð‚‘Ïa!¼yñ;xÁ`á/GN>²[ëÙ0Šz ¼<÷_ÅC53k±’’Z‚Mkõ^?µH§Žþ߸åZn6‡ÉભÛÙQ/ݳ½¼ÂO\+méµ¥phŸúÿ8yQŸä׿0."ï¤Î—Âp%3¼`äó¼àñ,d9g6[ÒÙïó%N8 –è­z z-ÔN-WJz–#÷;¸že뎤¥Xî\¾m)úðD§a½ú&ÈöÐT—"hÓ€ç—3ðÒð‚‘Oc¡-´øÉ÷¸5ϾÏöX°g&üIJêG ¤KÑÛ)…aÜâd·M!x…Ozßaƒ…³ -ö¶p¤BíØl°ÐÃC/D !’΄Wò¡«ì^ÛËi„Œìj´^Ɇ¿x¢£&¡á#[³ÿC6R€E’2H:Æé ¹è•I#ü°PnTSa^Ð|w g½W,„>¼Ú0Ì•8¤ÒÈ =üå2Z±Ë^YGņFPûm}>@ð`û¡ñŒ<ˆ*ž’zõ>Ø‹O!Íù ýŠ›³ ™-o·¼ð2”YT”Ù÷Ò^°‰rqe’Ëö¶¬õ«º×X˜_ˆ›^0Xx§Xmò“?G¤ÊƒÈïð³Ì/ãî^½iŒ:é!7(ÝE,dâp´/d;ïX‚xÁÄ‘Œ<*Žä‘Æ°|Ιòì,Dm;±']ô"Ï‹àO6Þy‹ûF‹êmyÁëñO‹GŠz|íl±pnàÀ©¦ x°ÀV",ØÊ\ÊèÈTDSFŸ–ÚFòáÄ /ù,/\¬¥®±°Ä‘\Š#Jìy”„…„";6 æ‹i¿å•>Û¡AÅée2ßÄ‘Å‘¼9 À;@,8 - ³Õ† )ísZãH*?—^0òi,ˆàê}qGÎçÁê”~–ÔÍâDQÄa³t5‚îø ö­äÁݤš€“D6:I×t‚#Kq±‹<ž ŸúèRkÉø FGÊï`!$“ië/¨±ùâ/À¨Ÿl½‡Q[íôv!ÙøÅí9¹€…\,1æ‚…ózˆ‰° âHì“þB† þí1¼^¬¥T6RG˜ˆd³Æ‘æ+^&.X1#Bœ.ËÞGº`a.„q$—ì1Û7XȸŽáÂ÷ÅâH¬mœ8M’Ä‚¿iì4Ù<‘$Cü6¬Þ=öÙp쪣W¥ÁÂ^¢½ÆØZgG Š× -Y]c!ßZPj*K„lFk³‰á|Ý}^È»ì>Ð7QÓÛn•{RŒãª¢–ôé p¾7ØH¯ðBéXÓ0¸(uÿÃwù~„åTãÕŒ¯o°å¿÷=Þ7"^÷Li/ƒ(÷o³EëyOó_WXðõ†æ|Ѓ· ¦9¥ÃÒ/hd¿Ï ©ìïc@X°…^ Éãô2û—ƒ7ôž/¥—-q¤ûúþ"/´ñ˜öJh5áÿÇB]liÍiìöíP“h /ìdñž&´2´ÆAËùÆ_ˆ–"š. Œ1‰îé™B?9¦] -ðB Ö‡Ú/¾s¼bÁézÜFZùÊ<걋3Z”9 ¡}„˜]×@Pâºiö±€˜|\¼Ü÷bÁ÷ñrŽÑŽ9( ®XÓßk¦jØv*ZXn ‡¼,ÕY¨mî®#^iµ]ß6-i`Y†úŸeÇE1×'ÀÊ‹®†Ëëà/„œ¼²Ä Ýv±˜ ¶ÒD«zýoŠ$a¡L‡ÅJívëlä øÓµB‰óÿ°ð•¼‰ýZ­H¶¿ \û¿Î4ýª)§C^ȬABÉ\Æ ƒýô¼P¶m[µïsô;™îÞLúüq^øµ#Ãb ×9†½=\«ü_Xx+/|Dœ+Ýﯰa°ð6Îxq ±”¾Û©ô"¹KÎØó®†a`¾Ä@!Å>Nau=ñ›ñgÁBŽ,ÍDPV È;¾h3|n±0ÁAŽN‡%ÓHb†¬#JÍ ·ÄsÄ mý6O r­t·–Á>ci¾ÃPƒ‹ÉKî0X묳ܿur¦'WÔƒGpÏ8²tæ‰×à¿SHs—rÛhC:ä09WhOé¢n\ü6¡‹¡¤[Üϲw7ÁÚDŽlÿ^,<<ŽTc*ï3ZÎÀhìšбãô_}ØrXSûZبëµXž;ß±‘/ðµ_¨ëà‰¿ $V2¡óp¦x!€ñØíÅÑœÑ /t4‘VO¯M°±¼³b”U‹ -EµåsÒ]÷9Mä´clª©Ý}–¸ÃŽya“5¥'­=†ç™=]]  a÷k‚KÂMð{30¾b~¡Lû€K¿ƒŸ«¢‘BH1/°Æ†?0&‹(„ôÆyÅB$q³J¿À综@XHt -1Žáëžm± ‚E €Œñ|0É€8œÄ?Ïoà5uðh©Â¸LÔM[w¢[”oŸïz5¯­±; -Ž´€H(ix¡ÍThwÚdкVöÚdIEß\Ëþ í:äSg°ðvL—û|Yè_ÚNÓƒ‘XÀ¨0€3å;W>ÙA•ŠuŽíp™­ þ‘Ý`!<öø=!C¯° èJ8M¡ü…°,Ëü8õ - jTÿÈ,a¡ ¦%IÃÖʇºµ,ÁZüÒ[,Ä/S;©¥éÄÝÙlŠ¦X!ÌИZô{?~€…Vã°F³\[ý›•þ{âH ×<’hä°FZª¢/úÓGJU=Ô5ĸ¬V,œ¯WP]âHÞUIÜ‹#Q™>Ä‚v’£xA¼KxÍ •J¯˜Êaaý¤øÖ‡ -Ü£Ò|×Mì ÉÊÖNµTOÕjKå:¥r¸µÅå¦á/L*GЭÓflÛÆY¨g—•z‹…ÒZÐwc¬²õ:Ý¥ü,<–ÆeZ €!>Yç³4®âHÌ'ÿÕZœg¦xaQãñ­q¤»1U@¤KX`üäÁVÅ6Žô^èÈhp“ðƒXPj–8¶Nƒ -ª1¥}®µ …­NÿÛæ÷©I>¼€Å’k‹f; ^nWØ-[fé uº| ¡2«À±Xo¶¶ÉþÛ,ú/ò;Y±êI?»Œ•ºÙ - -É~ØÕ¶þv†¢YŽ0lçù˜£æ¸7ö掬˜–§RËR8«§ç0ž£ :“=(zÍd´ÁBUÔ´ˆÆFx¾ÔØ}2g­6iÑAΔdÝngŒ{{fçøͼ~Øu^°p“È­ÔïÀê"Í­7.«Æ­á_]Ô ×Ùƒ*}ĵò»XpŽ£d*3÷#–¡ÁÂ×I½Ï@K>I8ÂÂGR}ì[@k8Nk0rÓ7ú|7)P9ß—ÏËcÒ¬¶ÅÒ5´aÖ„ë¿æ=³gîi›Ÿß¥…qÿÙjW¼ FÖCËY•îÞÉò=n'é*ÛI­)¹èªs ×Xpo7ͯ†íò^–, û[ª¹Â‚>Ð †ÀÜÚJÆ¿†…gæ…w®ïa®°àÞÃÂXo‹%Õ‹ŒW^÷a0†•Ë,5ì+,YíJÇW7»ÔÖXxÌM›aÿ - ê7-Ìhì®Íÿ\½X³Æóu^¨±p k–…ÖÃwøŸ!áî õQiHJ ¹ TñÂA°K_Ã],h;®4ÏýkâH?ÝbÜc᾿°ç…•öXx»§Á²ñ§¼Ê½«\Nw`×¼‚rþž‹ü¼ðü7ý0Ž4Å‘Þ„…eªù•“¶cMêx×XØF® ºêt9Ý1u÷E,h«Ì1 ø4bêCnQð³YBœÎÂ=^–Ì.jTyÍìœÝuŸnÙÊË÷²Oh©‡çê u²¤e²¸÷—õ@c¯å©þ굪ôk«QêBå.êP¹S>—EùV^Xæì×m¤c^°^tæüê쳌†å7¼p´¯ÊG:0¦^ÁBym•«à£XX&Å°—ç uövÉ…ž!ÆÌ—šz®ÏvûÔRçNà>%_ÞjÙ3¦•F›i·}ÓòN.«,Õð<ä[úb-ÕÞÞô²ZÖ¹Ô²Ç/ÞÊ Kþ`Fbt÷RaáÞB7TD\>C©Jî–anx!9:ÂÞ¸¹»Þù,¨(îÐ|š¨ùäz˜`ç.ͽ( zõG±ÁBëǸOŸ¨}ºy’:©ŒöI—}¦YUêŽè 爒7,)z»'Ž‡l( %PXhàSŽ]Ò§6ÇÌ#8‘5xf/=ÑCŸöšîW»ºæ…Û©Û5Ý^´gqÍ ÇfaÖ9´–g·*áØF:´æ•N[;^ø(\ƒ…Ïc!Ò ¥€ ãUNªâ…HåNdÂ+<¾]Ã}&)Ô…„ˆ@åÌ•°b[¹Ešl -ìôÕ>«^'ôÕ"éF¨…¤p^Êr)½É‚]ÔÇ [DêâRP+·àn)‡{yª¯›ýé1ŽNÚ“;ì#²‹ôÐw>Ê*ºZþQ^ 5{ÿ­ªÓ¯Š#-z} ¤–…/š•úHfd¿Lb)®Ó’²šÂUþ“Œ¸Tû„°Oqü&}j ªmœÉ^ËôÔ`ï7ò¬:M%b@,„~péÓ†‰Ú ØÍ–– åXlÜ@’7òÂ’TÚ| î/äéjñg=%MÉcªÇXx /¨õ« ä…TÏ•çI¡æ°U'ïV©ÖŶ¼pdÀ/”¢Hhut$FY“ý9®Ú7-ïä¤Ê3QŠŠÝbÒÆó7¼àÂÿméPAÜLx m2Jï¼ ´gzCiêc,Xûe2l‹×OVjØrâx®í©þ¬¿ÐéþB’X`ûûè/œH¿5/!gå­Xpùýe0x°±fn†â…>ä.ÚýçQã ÷(ƒ­Á_Ю W+=‡Í¦wÍ}'F,Ä`ûä\º°ù À -8‘•œ=̵¥mÓF²SX¸îO}Ÿ–E¯ÏGÝá…ƒ -½x‹tc¶®¯»‡…Ã8ÒŽ2>Ê Ù4™8ÒcãHØ… ›d‘*Í y‰¨ª %§EÛ} ¹J¬x¡§}`ø/‘Sk £N - ‰^ÑßÁ6Ø á3ñÂ9¸”Qu‰#ñãHņ̃g¬-RÖèžÃp[C/è>„…¡YòW¯[cá8¦ªÌ)gþ/èt$3¿ð^À¶ã5Eÿ©a¬¦‡ö` ç"ÛeÁ‚ -³ª}TÁj¸lÓ>Ä  ¨ãTÀ“L$ÀB[« -%-R°£ÈÃ5Ìtç|ù - Þ‰°PÀæªdJA'RkT ØT+:-Xð{#/èaüõÕA×[:ÈöS ´™Ö rƒAsÞ—s}”´ÛqÄðîz_*aŸˆ6;ÝÎZ‰|Á}ŸPàzþ3œÀ®8Î1/¸ ·ÖæDö"é‚Ì®˜6qõû/Ì•¥—ÇÕ4„™.Ãøª¿ ±p;êN¡·þ­=å­wþî¯ñtÿd!ŒoËÙ>½£‡EÈî}~XJ½ÏÇËiz!ôª7ñ¦¤E}ÜÑ×ò¤®åd—UØa>ÆÓZÛºÞ»3¿ bªWþjØYîZYì ûq»Ñk~6ø8/,õ,‡Mãˆ9TadwÊÿ¾o][5èwy5ËÚ¯ÀÙ-I»‰0Ý]¿Pnzò,ˤ× —%—Î à#ÛW=|Üaߊäs¼0çqíÖ×?èo&r??ÆÞ÷¹ß¿ìf½îw^Üãöö-a¬ü,ÌùˆíÐê+Fw:oÝL—ó®wf]²ÅÀniƒK»”WX˜«më)wW¬^cÁÅË8À^C½™¹ŽñƒëÅaå¸û šœöOææ=}}¤–KE\Fá˺ôQ®z¤o ~ñ–”/ñ©][®ò¨;à€nía¼¥™,ìÏyx´<Ö ñµÕèØ´Ëê³®X˜™m¡AEUrÓïs.i7k¼s ›^‡1~0ÝN'— Ø¥Ùü7åéyAw*9᪆±@„›Ê;³ø¥Róoã}¦ÑŽÓÄÂî¯èýÞ <2%w)Æ¡c$qÓ²«]½ï¬ÖêØ7Iñ¸Môv¿¾¸Qy§~ü¤ìÏÖ{z,*oˆùŒ_4(fM8çMØÆi^caî:y“¦iQé$1¾pe„Þ-¾­h€ÏÚÍîoå…ÕyIÑßÊÈìåç^X6ÿZ% ûêS˜8Òçdgz@yŽùt¨Ç“(g›Ÿ±ÍÉj8­X° `WI!±ÇÈÕ‹QP -mçãÛ˜h‚S”wó·ɖŒ^˜©Þ/tóíHc!£4Ø.ækA †%5XÈl?*¤›µ'Ì™ D“wˆ“ZF#®4MËчMc)ƒ³ûnáÛ±P,,l,}\Ç,¨4•³˜]ä2ÿ—´oÂG2Èq•ÏL•Áª™ -5YQ§ü…Š*¥Òƒ·bü˜¿`xÁÄ‘þ#\ÇôI¬š¤° x#ƒ(¸>¬Õ†\ö§S ôB¶ÎÙÃõ … <ŠRƘ3Ð*è“¡#£Ä‘ /^øXÕîÜÈE»ã[cÚbIçE6PäøQxBGaPq¤¥R†¥s\"Éð‚ÁÂóJéë•qžL5äáh,L}Ñ÷ͬ|gµ2¶ó¬þExd)DM¼†”ÝŽc›UŠ& /ùIq¤œ løK5'å–öq¤³•Z:ç¾óM) "ò"ª_œOé=,^0¼ðÄbIh2»@åí¥—çƒù†öX€MŠ™J굑”ŒóÎÓ°©ß‚üv±ÀŸá#? L×Ú‹@I;¶¾ô8úÎμL^±là`9@øø׎@¿!ȱö 8‰>ÇC^ø>麙åË,˱'"ÍS²KýL|ß(ùÐøÈÌgn³™Ù¦o»G²‹(ˆÔ*«¶<;;çs{¢‚Å’gº…ž8³ûtΊ 8³±‹ªñ‚`¢ÖA.pn›µ<†¾ú–ú~ˆåmOêm@}j|]ÿV¥ &Ø~¦úŽP‚^?‚‘¿£(ÍùX8Eìd‰Ô½Â`á‰yÁ¨ùÕOÇ5 (ÀR¥´²,Ö ‚+7ô`aWêMÝñÅÕ"‚”`:G6 S³®íyy¡Kcøóã¨1§§ÆYxŠSªgà›ž‚.Þ¬{DX¼Ñ¾d†Yà$4|$°R¸Þ`áYyáwˆ%*R÷‰f>¯X(E1bÊp."l¹Xðz½ö(O%"uØ«Ä°àÛ¬Š¤5w\8yyÆ-ÎÙ^±Α šì,EÒfÌIömÙöpÞJD]Þø˜wñ8Ë'JpÆÚ@å¨<&€ªÐØH†¾P<®œ+Å¡ºÕÖF"u´¥S*A‹µõN8oZKù¡á$}ÌBž©ðúöQ/ /^IJÇ„=â³ê¾aÏ%bÚ€Ýöëbg‹;¯,2Ø-4¼`xá % -¦ûG‚ƒ]x¡ŸÏ"Ÿ'Î2Å ic£,å4 ü ä`!¦$ÊHzg±ó//”Øé#¢až¶n¦žæ›è©–"TavæœÒ]kãLú¡±‘ /|i¬fÁhjfƒÎïxÌ Ùó¨åƽ8R »Õ;!Õ }9úK†esÍ Øné‚…²°b!¢þ| °pZÈg vj)…`ÆF2¼ð¥¼à+,ÔØŽÒåž*U¼¡6¹Ê4ÞbrÎbYPËÖDå’ ‘G2ÉÛª[vÅ jw¾bkgdØq §žd|3I öͪ1ÏÅn|+yhl$à _)=Ï5B?”¹ò‚‡-b<Ÿ-¼PñBèû´ +!/!}>Ó´Då7þbá ªø 3qG.|Ó('Áã],ã=ð"ã;^øRQ]„ÉÝûÄž÷¼€œ"Õ~¦ärJ•d‹;[`¦AyÓ öej9X<-M×V”^ó lZ|%·²‰N¤š¸ê{\"iüà _)-ÍœP;ôžU;§@Í/P»¾c¦&Uªt$)´OËà“¿¤ €îsŽGs|dá•x°%Tøà;#•4‘‘Šx¶„|¿àg _pÞìÜ7hf¾_؈=   /|­óìc^j·5,ñÞæø/5™é-+CõMX–YVUUVfË#È›_¢2ÓHŸÇ¶N:S‡Èƒ]¶EWA‹Òìðà¬I;/áLaYéÖPacU –¶{wÁ›dxákÅ•Ÿlû–ŠVa!ýø!pËÚTðø$ÉÁ0¼ðå·ôS=h’ž,«Ïa¡~bŸÉâº#ž7,^øjqøgˆÁ“\aÀñ?q˜ëE÷ÐQOK“§jxá«oêgš]…ùÒ¿èSõ-CrSîùlxÁð‚‘ËÓ7X0¼`D‘‡±‘ /1¼`xÁˆÁ‚á# ¯ñB•ù£RaÇ ¸¦Öüù£$7Ø°¤4*ñ‡ÿ,l¢jUkäKf `Ĉ#FŒ1bĈ#FŒ1bĈ#FŒ1bĈ‘? éùt>Îñó]YrÂ+bóŒŒ|Drm±ñ\>í•ù¥Ⱦ﩯Æó]YÐ÷žÁ‚‘oÓ8¬:<'¬¥Îµ# ¥á#߇…ržÏOŒà F¾Íwæ¾ÏŸqô ¤À+ëÍ32ò=ÒûØz‰O{e'óŒŒ|0ÖIцì¯l”¢b¦’ˆ‘w(ÍqqÏ|©Ê^®@ZIñ¤‹áÊJóx¼C¦µ‡ñ!œçsvjæùä¿8¶¶RTÏùÃZ!Ì’a#ïêY‹/bð•ƒÍÇ^Æ‚Oªq­á#À‚þ -°PðügÚH­4¼`ä2ºOØ‚;¯“pÎÓÞ+TëÖ*¼35˦ÞK,d”Çã<‡VZKé¥À ÛIùãxÁø F6RÊ3)…ÎŒú›„µ\½ -¼Gð™/䤜eì\úØŒ²“ÞÌEyæÒ?Ï')¸'dp_ã~‚¿ÀòШÃßÆ‚@,dÒ§öÙØV›Í%ê²™-ì:ÖHjHŸsTz6á"W6ÒIzá\q9ÞÁ‚ضO¬çQ¹¿à½ÐíŽØã7Œ ýü,œ/|$³ûºÒóuÈ+ö,¤bœÈø¢ -W,Ô Ü“Í[x!ì™°pá…èÞõßG¼qíÃI´FÓž_r©y!DSÇ÷Üà!?ð}øFÝ3-¾3ãç¹ïiaáü‚RïBÚǧÈv¼§Ïà ;!kß Òä­ýo#ixáÇØHä/Ìc/$J%@‚Ä ’5ŽÔ¡?äÒsÁvb,ð—±pã/„áÌ2tÒó¥ùw^•ËÄ|Òë0ûj—{ç/Øi97IžôC6çVaQl¬9÷ELWSÖ½U¥øC§(¸îÑ“EŠÿ?õ.ŽûMÂ’ØYÍПbú]vÑOðMãËÚVo-üÜŽói0Lñt’‘4"üçD åbIWc!²‰©NÂéìóÆÓ /ôü¼ÐGáõM ʼn„ôÑ0iÁó–>î^ð‘Ó£MfùLûûü´‘zH)ƒÑÇáG%W¾Áχ´$©ôè3¼-m¬ßr0-{Yà*¹„VË9Þü&›=µý‰VÑÁQ#Ÿ¸F÷žM)¾þ‚%\R žUNÎA -þdFZ2-c§DÏXxóŽò·óB Bð4€zை<éçóÈ¥WDÒg3 ¤_p‘ªNÒK1²+,𸂟çÛ6‡ŸÓȨËáU2ç¾L¼ŠÐ/ŠÚìÎT~’Ó$oX"àâáj½“‰ Á}&øË-YÌU ã -nUP•Fç<)Šb4º÷tÒËÞ*|ÀÂÈÅ)|^ÍŽäç¤à(g>RÄ^ȸh$"€x!‘Aý>^@wÜGh¤ß¢^8ó‰r\ò‘èy3(©Œ$ŸO Í],d;,„¾ìp¶¢§½’SEY‰Êw’¨/%`!–1v/@ÝB”/òäµd#[¤Ý Þ;)8èt@?®¤2rÏç!‚ëK½´2£ƒ}zÚöi’lŒ`î4cÁ`0I8ŸÝ@ÉÎèÝs‚ÁŽ[Õì>ìâFù²¬qF¥~Ìv²ð’§ÊÈÙ-iëÝ]ÖµKú2| /øœ1Á‘“§‚X˜³!@ô¥šaB^€êH ”pŸó¯YpÓÞòBƒÎS´`ýá|š<ÉàåÐÕZ€K­j dÐYj€H‡ÃŒß),œ—ýÎpã8ÿÙPÕÞFÊÁ_Øa!"ðNÈ y °PK¯)Nmêƒ|ÍR ^Øaa’Á3T÷€Â§#aáœãØŽùž"…DFç˜áÇ@fÍ9ð“/x¸ßØeðÖ`á¯bAn§š|²‘Ê R†ž ã ˜Ø )Ö Þ¥Ó´¾22ÿ2/¤š °lŒE*Ÿ’¿@qf×WþB&èÇ%ÒÕXPÓ“=lY›¼†°ÐIŽç*¸mxáOóBû/¤9iIWÎ)›YX`Ü'ßY~e¼å5^À3¼€YgeÆ‘È›cœyIdÑÂÊyăÂM_[Du1›G"å·2‚ÔÜ^^ø»’í± ØÌQKQh)A:ù,i÷8¾uâõôÅ5ªWü…gàE/U`A¨ù…ŽKîÓ„B#‘ñ<|+pš…°Ð¨}©ì@8¯Ìe@Ú³Á‚ñ”X ñÓ #Gg4Áã¾›«Ú ¼iÀYeñ©Ÿœ giD}̾ —W“–s—‚¿’Çh¨U1\ôh S3;qX湓66A3w¦)!mn’¤œÃfrd¯.¥ƒá>ãlÕ3{r- 1Çr0 Q× Þ‰&6k¬ôšØjIó]ñ÷ìÍë\ -+'‡‹]üx “¤¶îƺUP?OúH¥Ñ\mM»Oï–ºØó‹’ u”GoÍy{(/¼(Icqnrì~'|ðöî¬Ðœ0’csÚ&ºÝ†‰Ý š÷Ãçy|e?à”ô\¼ 2“¸™#û­XŽm;Ž'ƒCÕëÐRiOº¶£|›ëýÓdû™%OŸç…¹JϧÚù.sú=+îòÆn +üRa¾*_ªJ™ÈÙ’?­Ò©•Õk ×f |…¸ ak¶ØQyÅ^ÆB.ž5n’™µÿF/(,€­Æ€ €˜¨z!…×a*ðKG5šf”¸A;³ÈÂüÒ(`³¹BrŒÂÃæwL›R<ë²®ç]‰mä¿ðB#d‡Ñü¢ð(u$¼Âíu"é÷yÆ{ÒdjmM/ƒ“rÁ/ÃϺ6à FÁJ,ë„i˜¶ôÑ@iqiÂœD6ø @Ìp!Šðc²‚<‚N:s^éõ Î/³Ø/û ,Œ_¼>ç]¼ ÌâK#ó&ŽT0ž? þ¾ìí‹ïŒ±Ó-O8¯Š%V…ŒÓ”“âTó3ìþV¡ÿ®€éÛl$à FˆÎç3Α.j> ÏæŸÇ PgAÙ9z£ì â»îÐÊ•·cÁð‚‘'õ”‚Ò2ßçÌ©}¬ˆDX°<µ fhê¢/Œrª^ ½õv,€íÆmïûAbxÁÈ“ðÂ¥ ª«V¤x`ýO8ŸƒêÎÚ¢‰)?ˆÜŸæ /HE+Ö‹Xãp…sÏï—i5¼`ä[±À/¼0 -,‡«6sò\¢ˆ¥bÉ ˜PRiÌë¿ðB€„Raiën³'à…ñÊFÂÈæA7ÿ †Œ\óŒÿÜš|TìHFÓK?”‚{#¶*÷{ -@Àë )à•ò`¸G,ˆsBM)zöFßy”óüÏý¡ª§­zlä{±Poçì"(€ÔN^ø*ö¢qfÎ9ò²ŒY -_«9Š¢âÍ8^0ò8ñß0°Þò‚¶§À•àú_éü†ŒöHH#¼WH뉱`Öþy ›C¬œÈ +Éwv¨õs‰ÖT.«Jã‡läi.;J©¸»`^0òC±€¶OC-˜pá'b!¦®“QBÁPäØa#ži Â(x:$ØÂá#/HÀ1ƒ:è~µb—c¦`8Q‘ÚG œ8öiÛ»ïÍ^0òCy–ÙÄ –ÆñÂYØ -½÷â%Out})E÷,PŸs]t/¯rà Fž ´š¿íOîñ‚%×Uûb Y8‡¶w¯}÷ }sÉ©ƒ§ -Ò^0ò¬þrÀYŒ;^H.¼P€k¢Ëˆ7ÊFjhÍg§j,½†…@ïá¡"ÞŸú;… /y,È>°DÞÖ_Xm¤cª‰ô-‹úG©î´¾Œ’‰¿-ŽDÕæB”-ñÈàýÇJ†Œ¼l#Á+F MhÐL°©¦@ý DZY±@;' m¨‘±˜Þä;c´—:Ç3n÷k«^0ò2/°V¥S³RýËèï¬ÿ-;ü8sú6W ÎÃÖ±ïºÁ{,øÔ6“5–J’ÜúŸÞ³á#¯ûÎÇòdM®¶ Ö¾ùܦà8ðÿXRÒð‚‘—$©-¹Š³ØH%ù]K•\Oû”pà FžG\ï‘Qε˜÷Zø% ’yŸ|ñë…^0ò’.X(VÞÞàcüÕƒ'áÿÇ¥ž†Œ|§ô - -|Y(ð®×ùÝVÖÿŒ$^0òÒ ÂÂÚð6àÏÓô>3¼`äۉᲶÁ",´ F¾SbÄÂeî©xáûl$vø«Ã<\^0£)@|©Ê§j›©{¢>žßÇ Etè°`;àÒ çŽ{FQþ€¤ò×M}¾+ŠåùÇFš5ç¾O%Ç¢ü bxÒµ<ßÈ ÇX`M9WƒFFFOþ‚Øç'½°ñB“ ¢²Sv“¢HÉô“¾ˆ•Â§Å.X°\¹‘â$|gµ,®°Í|Òu2jϽeœ#ÿ,£©·Ôˆ§Ø+\ݱD’[Lâõ}my˜‹ÒQ®^6¥LfìÆR´ÒÇÿG F~4/(,8ÂƪeæáÂŽHžñ5ÀóÊÆ_ü sN&‰IYŸ+‘`=‘¦l¤ôÆÖ{VÇʈá…÷ò€:Þz¶¢›1ǃÏ#½…ÆB‹o=)â™ñÞ%‹¿€¨´¥‰&ù%¼Ð Q=^õù|æ²qÔ2ðhñ#´Œ -Ï›ؾ^hðûÑxÐF~¿Õß(¿2ÕSª25 YÇÒ©Å|ògâ…öG2X0ò;xŠ¬…ÝIHVДc[–sª|€Þ_ñõ’¥² ŠyË  F~/ º»Ø Ón™/[Õµ—MÓâëüB$ü`kÈ /ù]¼`I¿ X°äζ9à!Á/\°Q`)¨u^ÙÁiøœSi5ä…Lr;7X0ò+x!÷¥0ÐÛH <€AÃñ.Têà3!ü•T; -¦Zd_ʾSѦaÁ -Œüy9= /ÌåD1ÃÒxŠµP©,à)S=;ží\2u­P`÷èR—'$‡"J²"¡}’œ½‚ùÛòyƒâA¼ðŸ¥bFþ°„™ž…þ?Œüi)€…_à Fþ´äÁBe°`äð§ý…Êð‚à †Œᑼ0Ãp¦ôîQ-înŠ(:­íËëî`sƒ#?RݹNÜ™êˆ#¬; Á¹ýí¹Ú½;^n°`ägú ©tçCŽ”——©6 FžÑ_°ƒÄÒ'5N¹~§ôÏŽ/ÅÅ’Iu´;Øe=˜K° „äµ/â`AÕHRPø&ƒÉ -çÉw¸,Ê ž?†{f|U,ùO¼p è|’pÐcÉ"N"L)e’þÒ¤qáKÖ3óÅ×\¦³-¼4>Ëb¶¹<;sÇEtrÔˆ? -ߊ=a‘W$¨q,E§heŘœ¿€…°lÛql«24jüü‡ÌWbÏw:ç °ƒºê,x©•¸Ö‹µè;6ÂbÐþfªAô¸Ô§ ¢•¬N”˜Úªµÿ M6ÒâHáx$m[eOQ§2ÌìÔ²¦º®§iJbû+&x–~sfxáQ¼0ͪw©§t Ì~&9šGXë(DY»K W4“ªFz?­.¾3(z\pÚ(T¥"³ -ø¬ãHŽ¢ƒV?Â_`–[ß -(ÞdY©Ó•ÿ÷¡ÙÉäºëºÃ0¥ÍÃ/‰%.ûÝÏ~a}±¿àùƒ½KZ¼9÷2 %¹¿€…e=ÀBäžÏ5i¾¯hÊŒJ‹ñ øxOú3ŪÀxxe#Ñ‚è“Èã;3k¨”pp§Ôù†¹vfM§´±5¸Ë‹ÀUY郯(Lð| YÜý,,|9/(,x,ÄLuÚ,T}ß{Óê/Ì{,ÌMRø2`„…1Òú–­ÆBÈ´+‰ŽQÀ~â…+m»Ö½¡þò'=Zç[E íz8¼4¸"û¡æðö£X;ëÜá ½ -Erd+/\Å‘+Ô¸:äþl»%moÚ%1|’•v5ÎÜ>Ñá•Dø‚ùQ¼àN/K]mïÔÐv ”fp× pIêõ>Ò* ?ƒ…,…+3¼pŒpnKÄ?—+/\Å‘fÚt ˆ’§ëbD²S”âÉt#À3ðƒŒËVcx·³êäXˆò‚{-õEõ\ç Ýè¬õEl&}z×Ï%z…Ç`? Ÿá…Îà¾Å_Hq²ø$ƒáÄysÁBxÀ  üÑàáŒ8§sO!ÉÏsIy9Ø¥/ŠÁ½/4/X¼õO½àã<×28…ŸÇ‚Ò¯$ÝýͳêÅX¯‡øëX•éVm}n·N»–±0 YÈZ;©]}EÎ/}çù Œ®ÞðÂÞÏ+Ðf{TšÖ ‚3pC~šPUÓzDŠaÆ.{Æz‚Ÿm^G˜a÷Y.ÉÝÀïá¤1…Xq½30BDTb»Ýäav[Xµ-üW~ ®á…_„……¥Q¶Jm}ÕDá±®rŒ@+xϼù©¼ðÿ×/< î÷ñžÏÕÎêwòB6½4ôÇ -(ÏЊÅðÂýMõ`,¼È ‹oí&_4·zÈ ûÒÈ?’áVOÕ3`áïú ãüãå¼0ÛÊ‹¾ÈH:ä"£zº“!”«K®ÇgÀ‚á…ß„…—ya.iƒú«fŸy!~Ån#ÏÚmž ×_øꡈ±ïÇÂ+¼ ý؃%ÌÇƱ»ì%ŠU›5‡›òBúò5u8àž]˜0ëðlvÓæ/Zš°ÑË—½n:Úê7^ØÁéËy!Šv§¿ ¯ð‚vUoœgÖ¤V=¸SâÜ1¡Âʶ&WmVO‰]m_ƒ(ÚIb’v{Ê{6Ò\am’h`f§ëÙnrøl:Bd´Ôe«üà¾HÇýu©„»6¶àx.mÜíîQèàFÓæêퟒ®ú#üæûÛûÙñä°ð -/Ìñp€…¬I×½di –ÓÞ"Óz“j -›Méxù…ñÙ]Ž¡RŽ–$7Ç}qR#l³œ…á-îâiwMõ^}ñŠ‡ºœ™½Ì^»N`„Ö€ç¶÷×…ïsÛêM†lö7÷š. ,CòS°ð^_Î Ýn¬‹åw`á^Ó[‰9“ë^gºÉ57ä©{s–{ÆÙ¤ÙGŠÞµ¼&Këë³~²+ËkÊYzÉÒ#—%ÖïÇiŸ) h¨®í·ÉÏá…GØHæ…ÖjǾˆqlJÇ®HCÛA± “bÀV ½ì1I£zŠVIeõó©H²Çaá^P`©w6±s-ë5‡¯’½‰ž'Ãf£5ÕoXçíîb!×ÜøîS¹$Œ`^ëz27ÍwX¨§¼6'\…jIVns§ñ`á)ý…Dz\ -œIf^ñ {D¶21­ñáù+ ´„‡°€­Ù­òNb$×ÁÒõh=5;¥ßÄ ÊtßjŠ=è¥Í˜ÇîÅþÞiÔÔílBwG óÝÅΰÚ赕6¯F?cÍAg]deº5;¡F(8UΪ&Qƒü1/І“—©!À¹½{f~áX …üÌ'ÚB,t¡‘l ¡Ï‡3ˆ,ÖõB’Ÿ?qóßÇ :£žÚ+;Ù½ÊÖS&Ê&¹»$ÛêjB¬R×fß;‹ÊX:L›em“åŒ/Í´‹žî~†R~7ݽEîè–ÀSxŸnƒg - ;kñ/Ï/< z=h -oÁB(|(,0®‹g H‹cð¤ß< /ò‚NÍs/ã}§Ê«ç_&{Åà ±’2ê¡{ÐñÞÆppí3ÐýjÊ:î‡G®ÎòÛ46¸¾s ®§ÍÅøçóÂÎ/h^ˆd©Ë¿\°­Xˆ2*XT.ËþÁn)>Ñ}î¼Ð:Éâ%¯?|Iºyü šÕ”"cýz¼Oþ8¯ñ‚ŠÛ´Ú3uŽjÂèX—u]S9~‹ªjiº~ˆ÷xá&Œ*³o³°Éð±€Åx0³{¼0{ŸpÅŠXáû^”‚â…*ÛJÕŽ“¬ë‹7ûŠHº‹>ÛZ)ÜXü·‹Cm+všÍº™g7Óh. V|c-´ÝíºOTÕz]¡ze2½Æ îíš åWŸ9öºG`á¸F} ªOÛ)¦Ô½»æS}µX Ä ·CõuÆÕKE(Â&©o&Ð,;?ð´¦æœ3üK{éĪ;¼p°¤ºT·æB¢†G\`‘yÅ áÅwF^(9ˆéÁY2 -)–4#,ø1VPŠ…ú°ÌæS×jç+ø0Š¥Gg{ëW é+« ^.BÁZ;µ¦kz4ìæÔ1Ž.ªBb;¬Þ.”>æ…úHÓ«D©?ë/|/œìÈÃa&TÑÈ |鄼 (anú¾YÚG=)£*¹ž×ã˜åˆ‡`á•úHõ΃ìvø‘Õ¾ØSËÜñä¼}½8Q˜5‰å;zpw¶¼¶Î^ 'hÞªÞÆ ‡ d!nVN^x ŠOìÝðìXx¥nÞ´+Rg÷3H•N¹V¾1\è‰}o*N–£ƒÕ‘ê BSvå"¿ºÎMÇ‘Ê·ñÂú;|¢Æø O†…äC™{wx᨜*ë–]Þ/ïÍFìÞqÍr‡)qÚðƒ¼°šKM‚€kZS¼hmåoÁÂÁfá,\pyUvÀð“`ácSþwxÁº–$Ic»Ë‡þ—å¯KwÙÚnb7Uþ1^¸XKq²DZk·½Ò]ö,lv‡âûf cü…‡c¡´¿Ñèù…’±|ó‡JÕ½æÜDm†3:»Än¬o]-ˆy1Ó°Š—\¥4Ü)ù«©qéßÉS=ÆÂ&†~´¼{]Û»±pña;kïòâô@Ò°òÂêÔ{bÐa¤7b!|#/8÷-ºØø ²ÆѸxGí÷zM~OÓUw°ÚOðùKÊèÎp{5[ñî­_¸0¼ðý¼PA¯”4„ÿµC÷Xx8/l¯2Ì[\‚¼ƒƒ;5¯òB²™aÚDzÂ/á…c,X¿ƒžÐ_x ¿¾ðÚ Ô’ÏOòÂKX¸3Gæ]j¹Ã6 Ú¼À ¬±8µ^š; “íìwø>á­¼àÜýýƒcxựЬõ"±ÇáWaá=¼ Mó±0Ý$Z[³:›TŸ[^`Ó0¼¶’^EQëîe§øsþÂsk_’û/û øѹêˆN=Ë—)¨¥9ú;TomiéÀ銅{»|/¼\¹(^,w7:kK‡ËÈzÀ VýêQBøê™8Û~ÂûxáÐÿÈ(ÅÌ/<„FOQ”˜xÚastÒ —KmÒß|ø"ÆT’« lØ y†]zf1~’= ïâ…—æÕøú’N²ÊVív.ç;ð^Hÿ[oc½UfÄá¼s;VìµÐë|¤£ßÑ]YÙ_øìN$ŸÒ³ðC°¸—LØë|îÅ)ýO×m¢4Ž¤ÇâBz*æRÒÇöT¢O,jíÉ>N#á< ïâ…ý€üž Ó¢œÓ¾ÜËAÉv聾ïçuVï~>R˜ “•è2`ïã…à -²:!¶5¼ðy^M)  ÁvV³% °pAO'uçò\6û¨Yû»Ù¸uLëqµgJëF< ï╧zܳJ Ö«ùòѾ]^eÈð‚^°ùRu$뤵U•|=v¯^Ë€½“¦öómRšŒ¿ðQÍÎsµª9çè9ª$.ç/dÊÊ2×½pAí'Å=ù ;ßyé§ÞƒS]æ%ÿHšÏñ‚Žàêi¼Í‰nR¬ËrÓs5´ð²¢:}¥ÞñE­ÓáN¿‚çr²÷ñÂÏ(wasˆŸ‰…ÿÌ u;ϱCáLK4u@Ç{°wð;.ôjK53GÞh®±€ZŒìé]„ý,¼‹–¤íô®ù¤Å¨hu Õ},èsLw;×êR~e½·®mm}/¦šëŒu}÷þ^çÏð‚ía·ó ~47dì;„…¤íÆ.Ërí.$‹Ut `Áj»nÌ*ö,¼‹–ío‡B½^a‰±¨Š‰ WÆøSä^35¿½É8]BOå±Õf$Žt âù͸¡ç~žÂ_`ÜW*4/8 Øg"‚Pë/¨ XMžÄ”4ЃH…÷ñ‚Ž$¹×‹7Ãx7¼•nˆA¯A[ϧ†î«!}ÔGõacéν.Ù¤+Ò\ë$Û/C{'/Ü\|x[qü3­¡ÿ¬¿ %"EË ºÆ4X› Q•ÞÔÍ[Œú]õ˜,®ûê$¦¤ C–/gËÊÓz¨»ÕSaÙ:Kª_½·`tÜ!½$×åËÖtÖ÷ò®”ð\]Àܹi‰Wÿ‡ê©–˜w“(ðð®W'¼Ím“3áÃehi‹ 8ã¯.½Ñ»Þk·ýÔ³ÞN>Ë XÅ·ÖÝÕ˜fK)#w‡ìôÏ)Ö%ïÂÜžn ih¹µ•Xµ}èÝKb+|ÇN'ÓZU¾¾²ªsÈ¥’¹­u÷²á»y­´xdômëЇÑs®•$Ö34ýA¼ðòi^˜ódYMS[©ãàR³úÀ¦`º<6ñH•*ë!}§Çí¥Éö‹Ñ¶e‘°Â˜{©ÎQ×]ÐKkY^ ÀÁÜ>UÛ©.EÞí/_ìÂáÖRQ7uõ»u•ûeíŸÑ_(’ôtXx//`Õ^÷²”ymÏÊ^òø²â™¶;Öãø¢ôÛé2¬v¯"Á`Ý>ˆr):Ië´—kš6+‡Þ9ïL¹uAùåpõue¦M‘úÇL3ä â4 ¦ë8WeZ”’-Í vÛMW}Íò‹:íò7ÂÎrkt¸uz4ÕîûMo“SñÞyç|ÜW±Ü¹ïÒä秄“žÄ_x>,LØvl˜Þiëfq=,6KM6Lzd?b“ÀÕ´¡íŠ‡µmr5OÍkØ›FH0nrÏRÕg[7‡|œŽ»ªÝök[¦@²d9ýÄä`š?´ÝõêÓ¢†î`!NÓ8ãwû}mŒYª˜èwè”MœXÚFš°4pwp¢ÊI±•Ž‡¹:JÞáWt²T¬;GX®x6eÔÀÁºýÑlü¡©s‹oAÚ]ÛH؃Êöѵ'Nwü['ÑWÿSyá Ÿ‰‰±ll@6iÑ÷6ëp»6»¿cyοõþ¶ÝtUþ*düU'ûD„s;5²ªkì®}é'†Œ•Œ±ŸR}Z^`ìÇbá×J|§ÀÞo‘gõ¢÷W ³Gƒ…¯ÇÂQÚë/‘gåß{ïõ‡Êk,|ÌFú¼ð[°àIÇ`Á`áéy!tŠ“ -ÉÄEOB;aî©ÃéÕÞÝ„äXÒŸH¥ýˆv;´r¥‰Y\ Ùœ •÷ÒÖý€&Qž¶íÐ'lf±/‹NŸ,éYý… -Û -ʈa**HÐâ(^HÙÏ“À†åKªÝÜùø½Ç/”Ô¾Üoq¹?¾ô;<^o²ìÖ -_9ÔÇð¼ìa°`xá)yÁ“^Ûb^¶+½*dÂG¢85äIóeÿÆöŒ6$,ô2êª*ÿ ¶«")‚®ñEŽ]Ÿ“ÒÆ­^Ór˜ÇHNÌ–Ež»Ò3Xø2,LÆ_ø rj4UöN%h1.KöhÁ~A ËGqV¦ªXätß³È@Q\—€}ÏSxYcÛsÀA4·z‘C¤ü —>ç‰c°`l¤çä…qYo¨;ÕõhÕZ$°_ùYè|ýp>»(Ñ_eäžÏêxí9[釸x¡YwóçŠV²Qå Ü®âÒï?–þb°`âHßà/ØK´sR=Fp5šŠúºa¹ÆÂY¿ò‚½¼‹ 9bak {Ý ±€LÒ-X˜É£ƒƒ…çä…NñBצ /x ü¶Ƕk^ˆ+x;v!b¡“µ3ïʕȲçˆ/»µ{,„aØ ‘ä­Á‚±‘žÒ_`Ä=Œ÷¹ å`CaáDÅ*>-þ‰\íHû DY“ŸmyÁ^˜Ôn°Í/œ~}dÖÍ`ÁðÂwÄ‘"piYè±^ŒËù=]ïÂï0âªÕ°X5x@K -ç"Y0\õ̶¼`/d‚wsû½á…vKd‚+.*ƒ…¯Àæp»Æ_øl.9xµåÌÀ~ñ%.ç׳ÄýB˪¨Tà† èSm¸¾DëŠбÀÝ*ølX°`I2½¸/.ó ”¶éº®éØoý}ß3ïŒ=™TxæÔnŠ/½«K\kS±¤J'+ÆQÝFc'w¬šV¨t8iÇ6*ÛìÆbš}¦ol gÚ÷z2X0òLþƒ…?/f]›Á‚‘‡ù ¹Á‚à †ŒÁð‚à †Œáí¼0§ Â:63÷~Æ\î ^àÑŠžê¬+5X8Õ:¡œUŒ´Lû(*ÒKoáT€œ,:wê²yNhûÁª Œ</x2ÒXðD§9ÝÛ=ó¥<_r³ötw¶úR5æÁ2ô°".ýEÑ3!|.©­[„“q¤¦CÑ»ð™$ ž~ÇÝ} /l°PªQ9/t?rÀBFXÈ—ÖQlÛDªZý1ii‡…s¶ßWçh1;,PgOÀC,ÐÕ‡ê~?/¬ð}tP\ÀuŽ'ø§9ôï´O5˜¡ÓIÉ¥"ÿø°^ Í9Ÿ»Ó ý.ͺ[(’/,­²¬Çã¼|áég§øöÒ{öþB˜D‚ó¢›-0i|Z¤Ö`‡r{ý‰ ~Æš‚!ã¯m¤¦%©Ôg¸Ç‚¯°À|éRèhl­æ…|ÅBÉ?×zZ,`Æ{&¤®ò‘sd=jÞ[KM’a€ÙŽ¹\µn\~ÈY<¬€%KøëÜ!öF×j8V?þBdÅ÷Ž…–¿ ÑÍ~ý>Šâ+ü…Ô¾>¼AömyZmH”ÛKõó,4¸¶ÇDœÍ8‡X`!c'É«=/Ø+wü -,œ}j¦ZúÂÆõ¬)þ3I¹Ü ‰‹À…7ç,ßmŒ×Ãn¯ìã ÕˆàÞ=U„ߊêáw—¤œqïÔâ¨yV·ñÁþ‚GëP+Æ‹‹¿€¾3ø êh©±^_T Ø [AX‰e|bKdðb¥ið¹ÏtD¼úÎÜ9qE!¿ ¡o!ð¹.å‰ /½Pã$ð&.ÍP/Ï•TWZe9 aÙ–kW+UWuSª3,«V™·lÎÔ×ðm®v±äRÎ>Ì+uؾÊÕiÖ!SÁéàe¦ÎÕ÷³Þ!ÏÃ< ³J—tÍaÛàÒZŽ‡_((c[.ØŽ§¾Ï·fu¨®p5¸óå7e¸Cžå¬ßáçžvÊ3:ófwOb‚gÅíÇû úqнb)ß¹ -9.jceözœ›õàÈ z)gA[„qÏ¥Òü ð^’Ù¥x!ÒkBO¿)¦Z#ÊKé'dð4"æW8jô½ž†›=J', YsÎü€EACG€o-_€™£uµRhƒŸ ¯‚ý" -0¢Yõð*è/¤¨2i€»bÓ<|Á½2ÇÓLs¤J9ÀGш#mó -¦p<ˆ´á§HÀY@%;xÁ=¾ò€çìÙ"ÅœÀÐsxÀéAO*žµð–q°â^!¥„ópþµ^ØDaIŸulÀ1w?ñÕÛ£ ¨å¨vïC´aŒÐû÷2¥àŒ÷{,ä:Ž„Xp¥P‘ÒÓBSšyó‘m¬‘q–-ò¶p²ñ„4€…£%–A(“Œ ‰ˆ²ù °½ã|(eûi±@†ðBFwð$Ó¿‘”ó¸ [Uc7ŽË‚Ù° dZŽôH,¸Û¸n„¥ø¸ÉÓ€à—Û Vµá…2ÃaÞó h†òÞC9ï°àbÓl„Ž/+Òöaæ}2´vNqæ¬X€‘?Ö¥àñ_°p¢”-‡§=.Xˆ•ßù H áÀ‹¿€¼P¨_|Öõà$äVÒ(»¯§S¶¢‡2õ\ªŽ©– ¼›p°X.ø‚Oï~……ÇòÂœ[Q@óžá°Nð•ç(ž©;n笂~ëà6ðAdiÿ!ö¢À£¾•á4l—™w°•·NÑÍù2Yž‹qNðÀÖôûx¡[ý¼BÏÝŽ"øÊ;ˆ#-ó  ÔüLQìŽÓDîÌjv‘vG{_`k—:ôÎɧl@á!RŸøGŠomy¡Uã¸g¸`Á´!<áQ/XhI}ÙGÒ¾¡å‡ÊÀ÷ˆT”Œ‡N¢ÂðÍâ/Ð^g™•*fÀ -§XÍofuJw-w…°È{ƒ…e÷ šÌú…çÆ£çC¼ÐH„W¼0Ÿ£â…ˆÚÄ5M»ê7–LèÇÂãàXyXñÔË¢œËZóNÊ–mA{€² h[4`Àƒuëes‹¬²Ä‘ü$óDæ!ùg‚ª>Ü AíD·b!V5>ñ%9,€òÛs~FµdIC5vÙ<úèO!ά"/ÀQ¬kp?ØÜúË4z+$Œ’6ZឈYØrŽÆ3úòô³V`ÅÝF‡Töå\\·XC¨v聾s–¢—Ü`á¹cª½š_@ÛÄèa¢g.©ÄOñ‚Ž#­©‰“*ÎÙ“­Y¿à ÆäX²ä.ÀX[.:éû"ƒŠQ.Öé 9ìÂÉ[°€)ÁÃÜØ^zX,šNƒX`>Uô‰ç Π¢•¨¾ç !æm‚ºÃÁ‘*ü0ðÀàú`v!<8ELàÅœÎj­q$š[B·»åËn •ò‘*¥mz‡ã^_°²‘TL•ŽP0•[Å’ø}~è2Xø:±1ÈŸp}†ÝwhaZh/&˜‘ºÂ·s|bà.JúEgB+²Öˆ!ø ¶ç{ô¤ÂÔ #é7a!\rl /<;>7m’ƒ ­ÒêÞŠ…|‹…üò#VŸÅÂÞ-8‹nL}¤'ÇÂø©j¾N²xÇÍÛ –°Y2ð÷îò5R6w2ËXó©\ôëÝ“x6¼ðC°`ä»Àgüƒ#† ŒìxÁÌ/h,¤F /^ ,Dç“‘¿,…4¼@r’Fþ¼˜˜*Ie7FþºŒ†Œy”Ëa°`Ĉá#F /1rƒn°`Ĉá#FŒ¿`Ĉ±‘Œ16’#†Œ1¼`ÄÈ;xÁ6wÁÈ{‹¸Aä¿ Â`ÁÈû%ÆŠeª™á# §9Ì~—mxÁÈÇ°pþuÊcxÁȇ±À~دç…òÜ÷ü1á²Çb!šê³á…Ÿ%™.am~$Ô]ýU¾sùë±P Y ƒg°ðPiúˆKîõ&¦ú“¤X‹4–“QàÇJ/O¿ëý~©’ØÆ`á °P,ü8©Ãè  ÝF,pß  ž2/ð¥"Çh¯Á‹Rþ…¹6[Fu Œô?°¾ñ³¿„žgQ›¡ÔU̓Ú{x ®«®+™åE}ÊÞt“}Gsà «‡Ç”zðt+OOwWÞ{m4Lj“_ƒ…2P“sx©:o9Ò¿ÔÂÅ–§Ëž÷–ûÓÛ O[$³ÝÔܱÂÙã4•û>{ßAt#ò lΓ®Sl¦¾Á<—³ŒmÛv,γ™qm7½¥—‚ýð9oã/|’Dø„¹"[ZdœÞÜÜãÞÃRY*#$Ì2öi,2Ö»áõ&‘ÖÜéì€@Ž— a^[¯‚©ŽVܼbÚbbŸl\jxáá’q°BGÈ3*“B·KoͲZô+owµ™Ö4›x!¬ô.a©v†‡¾hé†T"Ç2ÀK·Á¸áÓ'±`K®~%«ã^P-JyžGÌ~ESiÊ. |\0ž¸EƦÂkñî—sÕÃÛnLÙ\º†ž 'Ž:ëù§ˆÙcs×V`ß ÛãœG8âÅ‘àüܪGËy±Ž‚ù‰ Å3ƒ'Î]8Èä Ñw¤’ðÍjcùƒøòN&„_Bij#ø©ø×Þu06‹ó`0Ëì `øÿÿò$Ù2›6Iß^kÝw÷¥ Ã`=Ö°F ç°0ž˜gr¡Ð‡$ØÇÚ‹›=Ò x=Áañ¤—ç>HÔ^Â|F Þ—"ìBl½`‹Òž‹93ráÕ”•x3>÷<¡uÜ÷ù2"<&Q:E„­”zéÛé(ËjiAA†ïÄ -†PÎE_Ên™BiµÀe< ²d0Õ¾Íbég°ŽŠ.w a&†.a°óኟ ƒ^ðϱ@raŽcë@ Vt`ï°€†V#†Eõv¶¨oô<àAƒŠ¸7¨6Ï÷"1ráÕÔœyA‘-!Þ?¡â jT À5š›×ÆàŽdA04”½€“Ã|Ù.¡(ˆ¥f8-|ÿCj›>”­+}åîäD_” §q|$ÚT*‹j:øðǬïÁ›ðŒ-œE06hD“žT{ᥟ±Œ¥"‡?­çW1ƒ…×RrÖñ~”ÙR" -Pm¨8¨ü ÍH_6YÁz\ùÕRKºB@a¾åÄ„ŸÁ)ààðá¡ù>Ñha°R ÐÚ·ôK¿ÿ¢\èN^Ê™\ÈÇÃaŽ²íçvÆM/ïWdBÙIèƒÅ(l€º¢#ì…•R Á›läÓF.¼š¬3±`âKâ„V<¿kP/‘¤sIŸ„¶,=ån:€^BXP>UON­Ô§ð£ûþ‡HE´ð‘lè.VéûþôE¹I_‹ëÀܽv…G{8^¯í€Ž· 2……*”~8Œ4ý!¨+¢\ÈÊ“‡<•éi,¹ðn,̲âB¯Š•ëKÑfr¨ú¾ŸÒ W¢ >¦ßc¡ƒ5nçS¹PÉ`êáŸ"Eýú;t¤‘l9E´GìÉô){aY­oÔùáÙjý¸‡£IÁ«×ïpØ@9Ó­:Ò>ý¥'Q¢ä‚O‚“Å=̱ÁÂב:É”KµigôÚ’4þª¶Epò‹9âË*ˆqú3¹À}šà”o‚Ÿâ£0–D=Oat}Ô'Ù-V›Ì ý_·ÃB/q‡qaën*k3½”5`á@o×Æ·ñ^Æ,\ø‘X˜Îl[Ôùi}¯Évn`Þ:ZÃ]x—nO®¹_W©’'ùžÙ`žŒ‘­Ñþ›§•ùLÜ¿D÷o°pÀ fËc ÿ#,Üá%÷r︒¢Iù=,œ<ƒs­:‡Ó¢§W? ïbXƒ…w¼Ô4#¹Ð­yê 0[Š:ü8*,°ê(é=ƬZ³šÙ1垥<Õ¿êÛHc¡¨²@ - \'C3ßN¥îCY†ÎÂêÀ÷½æåXàVà±…j˜ãùjï=ö¢Ð÷Tõø ·ÍáQ{ÏÉýgüÖ|ÉKé(#jià¼Ãhí¡÷n Ò`áßb¡Æìt†ëª%TÂúâ– u kdt²ôJ)B˜^8.Ôi |UF Ïá»ÐÐøV(ƒbû±<Ð3LžJwàpZœ@­àðƒß+,Ę#+Ùó\q¥Iaþ›òZE›ç°ËrðV i„ «CïÀóéAéç!òÙ²”ÁäðìãÒrÁÏ£0¾X”Î++ƒ…†…\]STà$zÔ(†™…iË1[‘üåÀexœÞ‹®!êüAÈ ¨Bs …|!ðz!½g¬ñ¥ï±\+?Ú pØ J!öÏæ‚’Ždá``üõ‹±0ɲÅK„:™/-e z”]Ö,”ÙMp¶¥ŒAÎ -Àëk)/¼? O‰bI¤_,¹Àüµþ!ú‘t¹¤p¨g•$Ú K;ç숅L¬X¨ìce™Ô ÄB„$pÈ),¨Ëîå¬0+ö‰ŸÄÚ7jD¹ÈXU¥éËt$K9€AylÞá£\(EµÍ]NŠgžb˜2[íΔJ„o96rágÚ JGj #¹€:0vŠ³&Ò îREíÂìa5ø.t¤p¹¢#@Š¦æ¨ÑÅâpUHbÅ‚ Øä*M:|rfI. -µeøbÛž/ÃD§‹©!Ü:ÑlXˆu=%[¬r¡£×æJ‘­rƒÈR¯Ò¹0¹ðí…˜ÖÆ$¹€:ÒL °ØzR;ÅÇU‘°0KUõÁuh“ •ÀE2&Šp†Õ"y€£©Ô\)«Õvæª_(D¥O²†ðsaÒ‰kîÊg}ªÂ $>A$Ë1ÐqtÄBæK/KÀ‡Â¬f‰3H\M,éäG²¤8ÄTnïErÁ`á ‚!î µ½€raeì6QTXˆ¥è -ä²+­/Ê Ì87—å¼~\‰ç“ùTá¼Câ!ÚR ‘y4‚ÙorÎ?æ\O:‡»*kÚ%WUþ§öAe,“Ÿ²Æ¦ ^»n)çh礞.¥×(U«ë•6®Y Ë¥C3&.ñ<@iBUü¬É`áå”á4 à Ý† ÄÁÂM TÊgJÁÚpíÍAr› ;v„­®Í¾N÷¨Lk„Ó5‹á -ÒÆ¿DŽn%¬ ƒ~zÜ«“XT`•1O¹¦/4E [^…¬XXFN üÃvHî0Ú2gÝ®¼;×»ïSdê'Ö·x.Ùœœ—2ƒ…©ùV,,¼m&¦Š€bLN[Ú÷0“)DGHT_xÕL[†:nam£êLû‰­švý}êU0«Z¶\Á˪>ðUª&ÖsŠõá9{a`¨ìÿ¤Ô׿‚¾ü1²O"õ~À)Ã’*’,üb¹ð#({5îçì…â”~÷“ `äÂ/¥Â›~6–Òæ Œ\x‘Í’-? ‹Á‚‘ ¿ƒÞŠn°`äÂO’-ìŸaÁ]·Í²ùª®Çã‘,¹ð}æ÷ø¯°àl¾Ööz?æËÔ`Á`á»è£|ç7bÁ? \0ämä‚ÁÂË5!¾Ð¾K×ìkVц`!RÛáO­Âó“¾ÒïÃÂ$Tlx–.• ,°oÍ™î¾ÎÖqë^sVe  ÏjBîAúíbûBŠ¸ž¹˜]ê,½/…-|Æäì¾cÂ?V߆…œ"©ÒAˆ B‰[0$l¼žS2Q„™‡Á­•'D‰Š\DÇ  ž¢P”yÇFéEQ‡ï)”]û"ÍfÄmêËþ,'Œ{õó}õ°·aAr5¥£\ ŽäI/‰Y/ Ù®<,h/D¢´’\ŽØ¶Í\Q6  ÏõKäFe3õ×í½IÙ Bå€!ܧÛãY#ë[Î*³£,T”,ËJQïBYð_ kõ|¢ ~zïÏ`á¯ËÕ -ƒ {,FáËP+]sÿYV,^¹æÚƒ\°(95¤^·`!‘‡1`ÿÄQùË ­ªTS¤KPY‘µ"0X0Xx - jïeòü’R!J™nt^[ èê`20&†å{ä‚êfª2­ °] #À1¤äbíE‚YålKý£Žç0Ji°`°ðƒ8˜Å+¢ÓžC5Y(ßYZ1Päð+XÞ‰…@Pg;ÀÂ(g5† ¡ÔÜäBæ(Þ眗eL¹°êHM]¼D*üÜÆf¢ƒŒ„KÕF²Š,›ÅòÓ`ì'«,,,ÔŠœ!û‰ª}c¥†&«+±˜Ù$½åûä‚My‚óȨ€`KÿÅz‚ŽÞw¦Ây`,PÁ¨`ó¯`¦¿g/ ë´Îƒ8/—~wðEƒko˜3ún.Ê^™{rß%TægÊp¤- ©+U=æ@b†8a¡ñe~žôFOŸª‘ Ï‘ê!Íæ ú~m¤‚ §.ç^àŸ~ˆ}ÄÙ!ú&,,³*Pf‡A^¹Èà=IUÔl*Ycfªº6Ç.Ù1_ Œ\ø'ô>,"ùdä‚¡‡UàÉ`Áȃ…¥ƒ#þ?T¿ ‹mqƒ# þ¹`È`ÁÈCOÑü(ú}ãiMéøi¶ãñÍS8_ªç   ½ ó•¦(Íç… -/oísÏ2²e°`°ðÓ±à„—Bý ±0ѵÑ,,üp,h-f­«LyÌ k7jlg½USÎR¶²õÇNù¢±p<…Sm}­I ÀØ€ýè°÷P–Q{ÛŽw"j\”±ŒºM&ÄâŽìt€J ô/œ‚Ý¡sY-ª1º²Uq€§ƒ_üv,”f¯íµÔi(<²‰©°`³je'þ×vÕñ’°(—[—óˆr…°wa¨úJƒ½`¯§DË@sŠ p5–à©YÎüG±mä‚¡=µ¥ÂÂ#-¤ðÈ„°€-a!Píª… °fu9Ïéà T`8@Q¢Oé ì OͲ…Ï.¿ Æ^x1 ;¹€ìíÑÎúA•©†ÞÑœ2–PŸŽŠÎ *é÷&]t3ŸÏ±ÀýçVX²C#‚{ >©"£ÜË…Û¢R-0Vbƒsæ•Å ­ZÍ«gë#`¸ÖÇÚèH†> ï1'’ÆB´Ét!%¹ÀsØ:@éæǟЙ„-®)šÐÏ -ßá'8e´èÀ# -ЫZeŒ<§÷‰g;Dÿ¨7rá ®$)u9ì(†¥Þ¡zÙÄ®ín* XèŽÂȱ´1j² ª*~³îP¯s†m«»t…npžÓúFÑ]2y;ùlf¨'Ò_?mF.¼G0<¨“`+raÁT“ê)šõ »œ£É‘ Þ::žˆ5Q¯NSý±™:¥Egê²oŒNQSëjb ´=˜ßX¿ÖŒ\x¥âu¬Ó‰§'è 3'ÙÎfáõ½n[* þ`fÄÈ…_@ñðìM^a^ãcX0/á—3«‘ † } Æ^0dÈÈC†Œ\0dÈÈC†Œ\0dÈÈC†Œ\0dÈÈC†  2X0dÈ`Á¡†…ª7dèGÑÄÿÚ õöUÄ?‡…úBAÚ í÷N|µk°ðu,d߀…"Ö|_ul7ýÔNSß8›¨8WGž’ õ5{aåîù”y¤qG+qš¦ïû¦qbw®ý9,Xñ9YÖQû¶¾B} ƒ0XøÙX(¬<íM»Ì¶¶Ø‹äpûÔOýñÀÝvÏ›X:éŒÐ(¦¯]kï8â­c­¸š>…ºîÏ|«Œ±¬j"Ë­¿A2Ð+1XøÑX` -õŸ»f²H«®ý"¹PÏW äv•L§KF¥TÙçwª4Jïâñ Ó-¿Á*~¬Â`á/c!ÒlU_Û/ˆôÊ\·¯’ íu‹ÅÑì¸?¥˜ëK ®º·;ßúí&nK‘fÖw· þ0&Å„n|ÕóÍý³•¾Q.гjulׯÉ!~w£æ>ÔJÇB}[£j•Öå& ? Óû±ÀÕ[»·xT1ä¼÷8¾A.ËèLëY!wý4ˆWòäÂj]?ªs,üF,4šÕonÂ1 –9{¯\XZ²MvT¤¸Ü™º…›ð‡±pG.,½~ÊÔ`á¯b!ÓºA|›¯[¥Kïé=rA]u>î1ô¨žy–ö/§V£ÈÆÂ=¹é»÷  ŽÖºïùOÔÆÀn}~\ÐjÊQkÆ «ý„{çúá•üc¹°>åu•‹3V¤iš±ûœÌñ¨âÆAaNÎÐÑx‘þ–`Ÿ„½ŽwÃW±®Ç±>*#ï‘ ë9щúv[.0kÄ­è¹z ww#¢›XÈ&;±fKmÖEý­Éz·îè &=aÖ¬ªª”–ÚªˆÎ/RôŽ¥î4ÕFOé,üÙÞÂiÿŠ·baÕ’ïòS;cé.¬úMr¡O]9¤#ÝÆ)·#Çnú–=Œ…»rAù¥.±:…É*kƒø’kÚ‰`ø -Ð÷üÂ(ÛE›œ›¤ÑìêиÜT—ŽZ¿ð4†ÁÔ%ì¤ ï• ŠÜûQi¼MÙÍþír¡˜ëÎx˜>– \N§LšÙñ<º¡»Éù…Šèì0àÖø¸C،Ǹ'ŠÂ:¹Í”Ì'‘¸5 ©áçÞ>8 ^x³îÐÏõ˜ü5,¼U.ðä|Ho’ δ»÷~ÎåB«VåÓáñd¼/Ža[§Š[j]FÓŸ°‰·ÇÓî|Ûu¯œÛœc^xZu›?†ñV¹ Ãzž>‹…wÈÍú;-E³±×`áž\P@<óJ9[˜”;"¹[ˆì¼_£Š-< -9†nOr¡ÞÉ…Ý‹™ôúkhTm_¼×âö -VöÇ°ð^I/ð™Ÿo— Ú/´[2W; Í{‹\л(§¾e0ŽÚd9ñ<_ ákØÔƒÓàaëf½FL3kÛcúg{ÈI{¬1£ON,×½Œ_×rvÇk…7Z ^ˆµuði%ä=rA™Ê'Ë3Ut§)žÅÂm¹P$õå–ã~M…ÖÞyÖ긩ýn¸¶ùã-mšöìî7Y–eLûT‹ iÓžô–½ú&0¥•…Ú¹™IÀ%†ÖV ïÕ‘š7Ú¾O.l+ó^TÄã1í̵»eÏ`á¦\˜V%g¯ú0mMŸ¹´š²_׬ÕB®={%gû kôa\]¾¼zÇík¤ ‹†Èz‡ý5,¼W.œ{nþ¡\àѵ`Ô÷œ±¶œ¾à¯ÅOm‘Ö'ã]cBÒk×ÚS]ç³Í®aAu¦úë(úÝ%5\Îzþ¯ØmûArA{nœOcáÕrMkÖÛÙïErâe«Ô%»ÿ¬|Pü[;§yD¦ÉE«vZ ¿äÓ‹ ‡ê,ž–¬šËû·F‹ßÂ’…õ|¾XÐ÷»lŠ ®ó»B8~\ˆÜ/í¿V.ðl²ã•ã/…¼9÷Wâ~–nbŸÆ•üÒ}‚éÙw‚÷½¦?ÒÅŽ?:tù20'ÏJ¢ììû{Kz–¸êHÖ/kMóƒäBtɱo– 3Á{ÂZx¸¯»–¸¢®Î|áåÇ׸ú4ÎêœnpI†N£ñ`ßx¶ãÓS8í%ÆÓfJÙãŸ`éåŸÝRê¶_Ö­–dù“XÀ÷تCt<Úç±ðD å©ßˆŠQ|à3¯"kv/ðàÎQñY,Ü®TÇçÆËÚÞŽ®®9Å‚²?Ž¿Ä‚²H®UÂQ»GÓ{Ý{qþ&š |)ñ¿Ö›åÂçu¤wÔGº–p½Ý±êÑkïž.åãÜðç±€Õ2cûõìΰ°:À’ö³XpÜ›¶j¹Ùx• ýßÄBV®m|Dÿã°ðL}¤›ãGŠ#EXöX!µÕ|Â;ßQȻͶ-ÚCL¯F\_Ç‚z7ö““üÖ{°ù XHV±0½ ö#aªïµÐb€«YΣ~!žÚ1FÇ—ÚãÙâ'¦è~ß.£Ê"Õnü@ ,ç`>4NlÕ«öXYy·#¨áÀ‚r¹±}TbÉ*V1ñW±° - óûüH½2Þ>›wøTmaçdÊ ~j?·Æ ¬¦K­ì’ZóÅ?›ƒþê^[‹_Ì÷”3^5vűE{ß›lÛ?}–Œ'vølENÏ>Ä‚ŽÊ«Çkt6«±ð¿Š…V|ªéç°~-‰+,ÌÙW°ð¢|¬Ì©O£äªÙ=ó˜Öî\Ü” ê +0ÔÇèê‹Û4ɬ¼]õ¼š^D’oÕ6ïèZçñSXè?,x¼¡wÅÂòW±°äˆoyÖ8ÕOF½éíÒ{AÃ:úSù Ÿ$]`reê -+mh½ƒÑêè‹ñÆŠÛXã%—ŸÛ t๓ µ¥Sqs…æc,¬Ž#ƒ… -]IÉ;±?ÄŸ¼=u´hKî„"÷íXàkvAº“q§¬d} 0*¯¾Qáß´ ¡ÜML4îµ+ôT”Mdí ‚¸©À‚;Þ¦ƒÁÂJó+HËíÏ6ÛÚzŽOúà|ÈÖ*aî4ªá“Xcµjû掑Ÿl^• ÅraST®ÁޒȨ¿EIßübḲTM| -wŸÿvCGªû69©Áºr¼poá*´*ócÒ‘¬cEvUÒáNš˜N˜;a¾ObÁã·v÷`Úï7c+÷¢ÕX(Ö²+«ê-[ ¤AÓnN)ÅÔ×·pd¿‘¾K“º‚…úÑTMƒ…eñ½å­XèÇ2Š×€äže|frj,´_Ç‚Cùòw÷‹yçΚKÚœ9wb¶+­[¹ñÙ¬hÌÏ[Ãéx¤[“˜‚¶´Eüíö?.° rFƒ…íß‹m<ßßÛ×…óÆ~g¶~ NR]¢zB.|¼÷¡Ø¹—×ÖÔõµ2šÕÕ4›#îyѲƉµ»éÈûX(î×È4Xx+]ÖͳÝóÈ£‹ì7U›ûŸ*×ùéÚùI,¬%"ù=,¸ŸÂ¼6{Õ’Ò+¦ÔS4~äE;^u—×p¹ïüøšÁÂ7`A'ÞSEt®ãþ'}{®¹¢{} ºŽö½ãu”¿ý(n8|ÝON´ëSMÆBö›‡ƒ7ïç;÷:Ÿ% ÷ä–•²ù¨XÕ8‘uÅâRªÔñž—XhÆ›íTx'Øž,|ÖBÛ7« 7«Þ|±ÆßïŠIÏÊ ­Ö¸o†¢¦‡‚<$¶\ë}¡(]ÀÒ¾©R­Xh)4ã - U™ðù -ו^ƒ'•KJŒ\øF,l nô°ìëúJ—ÀÆïT Hçs»ñ+XXóo—º,ÑCçÔÁ8bÊŽÌx#„W?ÜQ.X7HsV{ª/–çVí…µæso°ðXH畯³ÛP8Ÿ/-Mê«ò½Ð.û±_žÁÂÚ=«¾á×Âç¡VžökÏûµiÓ=¹e\Õ|eJ_>Wt–æÐ\nKèRã…PqÎ\ ß‚…µ$Ö×­²Ä|ÒºhâújðÚW°p¬ -äZö>¬›Mq½F5?TàÃzªl}tf²imU3êó\äSPÕaWI³_!ªUájøå„ìXß`á›°°YƒX«1š -†]À‹iK8«¡uêò«c»iÛªm;Ú’Î.ÿbóú#ç¹sìôm›¦Õ„ÍÉ×»<˜üqm{<»`¿vÞAÕ§©Ïê¾Úë‘G¹ÊúK—Ķy×ôÝžX pµc_]šh è™f·b/éJt ªÐÊÙ³'1ž¨·ècû*óÔ»‚Ek£Ž]Œ&{ °Bº'e‘Ô¥ÝãLÕþ¸Îö…ù¼*Q©S\*›ê–Õ£eÆNkãu8tª­öZ x¿ ¬;)µ•ša뫇U¨A¤÷ѼªŸ ÿcXÈËiéîfWL¡W¶oÄBíj5Rpr½‹<¶®®½Ü¶Ü“”å}øþµT±/ÅlOñ¾RØYU#w~´šÍ}yú5.iu¨M›„ƒÕóÚ‹À³ªÛÔn×½]ß„»²±{m|ѸÅÏO΢cÍùúx l=Ÿ- žœË¿“â!òX@Á|­éÍMr³AY4Ö7Š»\Û­øZþ‹Ü)/Ÿ©ö@¿¶ÕO|N­ÁFÈ˽Œx9|Ñørh U¯t•ÆªÞ‚êMV»ºÿu‰Óá~+ s×wçÀú]¯»õå¼6Þ'”ýurëS­û‘ WB1Òx}!.ÙDº˜ŽƒŠNÆoCÄ-càeö?o¬Z7ø9y ØšÓÝ[_ô^ùíra -„ç•°Ëx9È@Hoeé…2€ÙhD9À§"ÒO i#Cœ‡²L߃˜“tjì(¶, íg ‚~¬ÃTpNÇꜨéoÖ´¨Z¢¯”2àYÕë‘a Nú¹Ë¤Þzºï¿cj€íTíž®o°†~kt>ì4|^žC/"Žá5\¯ ÃÚ¦¡êgC¡r•úÜ«UÄéåMéoÅ‚']X‹ŽXM–fÂ-Ô„ßO±,ÌpÔ‘,‰1ËÃò.,¬³Ê€>綢SsɸKö顽à¶üñ›~æØk/‘ÿ¶ª/a!ôÆÂH«~"I?òý¥A¤,ímgKöˆ þÝX0dè{±àó“í¬ä®÷¹ò|ÈKŒŸœû‘Š2_x. †~UùhØ°àÒ_žzž×œˆÎ±°t"k„m°`è—a¡‘þ©\@,truZ[£º˜•ì°È(÷ƒC¿ ¬¤z/Á "…€ \zÒ™0G,LÒósƒC¿ °òvs'X`¾˜mÇà -aƒ˜LJ_@oêõ^[ ed°`è×aa±})ýP¨x$WÕÓnC¬2ïòEUSõÁ:è}°²CÑÒ©Ïõo3X0ô3±°Ž±‚/¬`ô/Qå¬ImdÓwY_-í`ÙO–”4X0ôC±ði¢m7ƒC ƒ/»Å`ÁÁÂÒ•OBÁ`ÁÐoÑ‘žîÐc°`è·Ø  †   ýf,pf°`È`µÿü`°`È`aÁH»Ü`ÁÁP¬±UÌ`ÁÐ_ÆB.¤ÙÒ‡B–f°`èïbaöe™sæË0‡™Á‚¡?®#嘧ƺo2  ýX,°’= ,úÛX(T´÷}f°`èOc!UÕŽxésƒC ºÄK+ÃÅ`ÁПÅB‚IjâÎáÙăCÿg,ØR ¼(E‡Ò¯  ý],ðK¦FAYúC»,ü_(³¦¥lmàõŽÃn÷Ë’:‘žFf;ÅÂœ•¶Úô¯«ÛFÕ’F·ÚUsÖÍ{EwJ©´ö‹íÖ+Ìãæ jЮúmõd ^@ƒHO -5¡¬”¢]2áam+©=ã–î©„Ô´úË3ïeKÞAÎ`o^/‘u)Îô­Þõ4Ö›×ÅKßUâ]¹^.ÚK,|;,ß-µ#{¡AT”øÎ¥}RáXÃuªEU¯.… ¼ám éÁùå*<¸JŠ`J#êatY)„—K-m)=¸ð¦¢ù¤cIß(}”˜ÀBØðÃT9˜@‚ÅÀ ~ƒåLR?”êD\þQ.X Nt#ëXÙΞ¢U!ˆáŒŠ:ÐØÀGä`CF´Ó:#o9k¿CVbTNv·‡›i)àaü%ÊÜŸšÚ #˜"àxÝí…ÊXŽEJ‰-‘=eUYÁ •lk—¿²±â;dW£4¦1ù²-²üX`tpãÝ› Ó¬$æ -áýx>©q¬ðWQ ‘Âk’Ç\m9žY”}ˆÄ«¦¹ÚgÌ`áûÍ…P½Èö€ÌËN.Ì‹è *ëÄdoŠ<9x\ô`¨ž,Ù¾Š‰Ýöñ™¬¶I~øÈÂA¥,tĦކ…‘¾é{©… m/„’·„¸îA+v Þ'õ­&`j^–œ´z@ꀰbA©€ñPrÂÐÞŒÒcØBîˆ ¶ž­ÕúöpI`}¡ì‹zM1_¦Lè°;G6§X°Hbˆò†;`q<,Ñ&„åû´-I3sƒ…·+õ"û -Ø£>ÛÉ…šZêùá‚XhA˜ˆØÞÔN–|ºS˜Ú>(í0Ï'vk2€úê!¿Ây`§¯Õ+3b!<Ö]‡0(•\@È f«DV†p²C\v‹’hÓ°ñ—Q¨\ùTà+maW;¹pP†ïÈA -¼˜-Qä øÀ_¦Ü @]*t­à0iÛyP'dÃÖpì‰Ð¿Ã‚+kžÇPÊëÝëC|7‘,ã¦éÄzòŽúð¤s[¹ð X hÀœÓ^.¸T1½Œ–«ö‚ö#…²‘);ú¸eU¦†|¯z ¾¸:®ðÁhÉÅ&DÆÐS@›“KëûÙ&âýçXHPè KÌ—AžôLÙ ºÉ`†ƒÊd… d8êÔãƒhjà V”ýU=„-ƒ…·ÓHúbV½ì 1uN"¹ ”ž ÿ´ëÄÓ&‚¥¶§RÉ€¼œðÉ-…­½9H0±–3H¥cˆ. Yr<…±ùTé%#HƒI”±Š ȸMG>ÕNŒ©ÇÓ*âE©xˆà|ÙÉ… ð$j«DYÖ Â‡»‹£{(ûäG*-K´)I'w~¤ -G,»hÛv‚wX…Çl~t…ñ(€Ë7¹àùË%8g6ºª"ÄóV9˜¢…"„9<Ÿ¬Jij>P‰¾ç¾àh;·Sã°ŒŽô-¤:êQ—í„Ô P`e婾šPMA,¬Ž$1mkZÏ•JV9ˆ ÿHÚwiÓ­va‡_E5¬Ó^‰<€;l8Å£½6KÕ×bxœŸª.N¥}(S!¢ ‡PK¦ S”9xqG$öªœ´sGÙÎÈQ)e—„†»kpîÀÕ÷¾S"B4JP$$%Þu:jó¹Œa˜C²² æR8b€Î¬þ,É jD~á—%\ÀÏ´/«ž C1(Ý-Æ’9B•l†CX8Ðu ÝêJ3XøJ‰“±›’n¥„“xSÅ·?Õ/¹Ìñ?«©—5`hóUó*ÒZo¢†¤–n~òÖq2¸&G=†¥’¦QƒWcpSÇN‘|Âéx–rìãÔrÕlj5*tV Ö‘èës5¨‚NU#d¶Í蹊LŸK·Z2Ûñ×Ýb«NQøcôè«›ÁãE©º$¯0R—^WOŒ5êF™v©&X( o,´ÞF¦÷A’Z=ù‘tÙÕÖòJ˜ts@¤LH„ו,|u7Ü~ϲA¹A Õ*>aÁú‡ŽXx‘ÍU¦Ëu{nh^ j%&×Y¹Ø®¶DPÕªÊÁ7©=|] ßµÛöL†¶”Z ÊÆBùS°ð¢ÂEó‘ ¯`A×ÁPþ9ôW•ð¢P.$«,8€E¯>;s6ÐÅ”ŽDÒ&(¹ÁÂwQ_>ÑW˜å X;ñŒÄ™‡ qhÿK, ñk®åË,€Ö£ZÖú°Ä÷Äú-É…ªTÌÎ̸©‰ؤ°àíŒ× Ò ßÆOÕïaýõñÝpÜw>b! Ê.Épw,}+îÐGçÉÐZ°†Ü£0Ŧôç$„O d/ÀA‡­†Az±Á‚¡ÿmñHû‘=¹¿&횢úª‘@¥¨E›ôI:Ø赚‘ííEÅ#MbÀ†é ‰î Ë,ú‘X`é^\²fMåÎì¨W¯&%7’£ÿ¦ŸÐ¹–‘‹ Ýbh/غNÕ¤ †þ—XxMâSöŒÁ‚¡_‹…V,2X ›Û³?‡…$K ú!”Eÿ2ÇÓ¡Eeñ°Ðù† ý( -ÿÙ~ 7*ª¡ÿõiz3ŒkèRZܯϙy'†þ¨\ˆOJÏz¾‘ †þq¾°4[?Û—:ŸÃS¡Á:Ñ(2óÒ ýJêLŸÃ:µoûòPöR„v'd/ [ wËâ:iì,)zóÖ ýFòdéž îÒ÷çVFX.Ç÷¼RÆKW -ÏÂr™CNå›QakÞš¡ß‰ŒÙ¨ÖF˜ö", fDå5°V@/ªÞYr8&2¯ÌЯÅ•¬¤zh¨)õ((—Ÿ²9 X.&˨œÌ -óÊ ýZ,¨\¶@×CC¹bz‚ªµ€¥-‰ÅTÖÜJãb5ô[)¤âaX0§’ ¢Þ°@¥1Ãa¼¼¹P«¡ß+P¸”³™¬ö‚œ÷XˆTW°>f †~5¼EU#ÜË… ¨MØÍdáØ"l(Í3ô{± †˜š® Ê^(ÜÕve€egEgùhZ{ÁÐoÆÂè!•Sp-«€u˜ÆŸå€¢,,Nƒ…•\£#ú½X0 —† ,2d°`ÈÐý³endstream +xÚ­ÙnÛHòÝ_! „F Éæ™],àÉ1ÉLìhmÙE’F¤$"<’²'¿u5Ù²Žd°‹ VwuuUwUu]t'üs'q`;*™D±k«8ž,« g²†•ß.\Á˜ ÊÌÀùuqñôUN\ÇNœd²XtÛÔd‘}´ž¿¾š/^ÞNgJ)ËMìé,ŠbëùûùÔµî:¿}s³xsóÎ|ºÖû9.¿»ÆÊZ0Ò››qùêú×+ž)Û™~^ü~ñr1œt8œ*Ác~»øøÙ™dp¥ß/[%ñäÆŽíÂruç´_ɼ¼¸»ø×@Š×ü ï:&1ƒ›%^p^r¡kû¡$çÁªo+?4%8vàø$9 éº ¯ÀO¬7uק%\½,àO=¹Ö$†Ö|ª\«éú»e‹P\Þö¸Y/Ð"ä>oôª(óŽ7Vi½KK¤ù×>9³ë`^Ôk†´[øu­å’çu(î)yû¡¸Ñy Œ8$78b;®g‡Ûλòw¬%^¤ÙÁ)Ú.GžÙ‹D“eZ3b»“^ŒýF6,›ªB2€êZYÇÀ‡M±DBž¦-¬ ~ŽÈ.~™ÎàožeSfLº¨qµhÃ[F^»-@;b—; !¡ñ6°9±î‘ÑÄSÈPr”4pæ‚$r+Ê¢Ç} 6ßI ph[¹‚ñ/°…Ȇíûx½ áÄ‹°‘ “ÛämþÅ „·e“ʲ‰Š—lómÚæ<§ûã C9ãåZr\- -„çldm…|ú];w‰Ç6äà'$ˆ¬Á•‡ÍÎÖÙ'¬2 ÀýÀ* œC«Lb[Ej Cïò€™ë„vÄg¹iœóì\°~åz{ü¶­6<8I[9ʺKÙ:Sžâë•áè\aBJSýã]¾E¿áZÕF uZÑÈ·|}Ž'fýˆ9€u2½2c\y+Bm ˜ŽúºrãUJ×$µÞy¹5{~æ42âÏfÕòZÍv€~éï§Lœl&çM`Ä9m‚ƒgõN›Àn£ œc7˜€ÁoÙlåIâ¥Ù¹)EŠý9H§oøÑTÓß>ŸJGv¹g¥bàœ”ŠÆÁSª“R9ÇmÊYvZ*&¿vG±x>}z²çÀ€:!I Ã÷.…ÃmTö9vƒ² ~ÿewyŸ¡!-ÛGÔ áÐ5?e;å"Qp]>%È[9ÖÁ`Ý ×s¡ÊJ@¦TûT{l~¶TÐ$¡´Úèv}§ øS¯ç 匦çdzlJ¬}•cýS!tñH…Jì:¡USz»0ÿ¶Ók¹VC  |Gu&d¨¦¨*¸•i„—òò‡B¸Ü,öö7í‘×îýñôßó +ø}Kî„C¹MƒuièYטhÎnç²Z°[Ã!݇Ÿxä µŽ?[ ^°UË•U'UŠŠ=ð`C£ÅOÕ’%”® S¨Ì/¤í¡´¢ø>¡…‘¼mªÃrkðky/ç™ÅrŸ Á>™ëL‹=.¢­4‹´§’l´eŸ{)—‚)Çq®\ÇD–‰TEu)|º•‘â¡åžªv ²ýÈ?ç œ¡ ö7jp»Qdv!\‹Zð†®¸7ð|“/¿r' +…P"×^߀5ZK?¢šÊK„1µ-Rêcä§nãBªœÏZ œ“¿±âžŠyYðeÞ?ñ¢¨S*@¤rE`Ê?t“¾/%MãT/§Ÿ¯ ")(µg4-»äfXiÕcxyÍëDQÈôlhBw¦ùý4­Ô$¼M;n=¬Ùøžñö`æ^d;ÉbHïǧ8wÿ#D; +â!,‘ÎæOÙ~¨cñ?Ѩ¼£ä¼À”æ·lj|´ë#ô”g;á@îHêîÛI¢ñË?‡¤{‡Iˆ;d“ø{E½š¹Q> .æ…Yz¢ó »Èùá@:A8,¨]W +\ŠØKhðâ¼8…¾Æû-£‰‚.Î-rœ+Ê÷9K¢ÀÙԼʿÑh€ãŽP+T¨O¬›¦—eB¥tÎ÷öeÜ64;8Hz,8‘6”þåTÚa—äïÒì;ãÒ¾? ó¹´©9á-ÛœžHßpˆ;ŒImν¡:Gn^ Ê¡Õ‰íÅ:)Y›ù~VKbÂÀ†G#øô =pNçéØ]ñE å…?¶rG"€ùŠ +@8%CýGÙ2ôV`Ü¥7öh–vŒÚoš.DOtqäQ„ ”$üùûA,Œ!Ms÷Ä i6eJœ.Эka8.Ý£äP¹ÖŽ¥å†wèu F§Ì ®µÙ+…Ó¥‚´j¨ãÜ ¤:ñL*Ø÷L¾²CIåia™Ã³!ž8¹I«üÙ'WùGLåDãa»û'v¤}úWðŸ7õªXÿ•¯órûSøœw¼MëõŽŠ>D¼nê_ÆÒ]Ù3âx©Å÷홫@ÎÈhwØÉ…Â,ãiYtB ›>ú±²Ek,$ŠWµÑ©Ê+ݶ쨯³¯¡ÌÄ8Ì^¢27\“Ð98# Ý£þ`×·fßðòæýÛ·—C=kÄ;³uºd¹œÖò·«öžWë|0äÐᬠÝn«Ëˆ^V8ûq·Ãmü­ pšä‚%2C®É‹@8Ñ—“t…ñ=€OgL‰Qù'évkÌô§ –R„€“>ÑyJ2dìÖzƒfàÇíWGÜå10©Ò¯:oìvü2çn²¢|ÊAÿ ,gzþ¾hê´düyë+OØ"ì +€¬wô•d™âé+/¨Ó‚¬Š÷Òè.;0¬ÃËV†Ž_›Ì,‚õ¦>e©øÓæÅMÄ£2 +`Û=U"¤*5#xâg–pø>‚À_ñÆmפF~æ8? ü~Tq,L'tÒrH )#†îÉÞl‹£3 ]¶îöë§n<ò÷¬¡±£+”Óú½iÙ凛¸z¤v§|ÀÔýíUZ”'ŠåØÞÑ.;üç þO_~ÇCAíp¢SxØÑg¡Ò9LŸ7P±ÄêðÀÿ¬y~‚endstream endobj -5727 0 obj << -/Length 107 -/Filter /FlateDecode ->> -stream -xÚ`Ÿÿ£££ÊÊÊùùù•••fff:::GGGýýýVVV»»»¬¬¬³³³ìììõõõ}}}ððð&&&éé阘˜ÑÑÑää䃃ƒÙÙÙ‹‹‹rrr’’’ÞÞÞ™™™ÿÿÿ¹¡<Žendstream +5820 0 obj << +/Type /Page +/Contents 5821 0 R +/Resources 5819 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5793 0 R +>> endobj +5822 0 obj << +/D [5820 0 R /XYZ 85.039 781.388 null] +>> endobj +1662 0 obj << +/D [5820 0 R /XYZ 85.039 761.463 null] +>> endobj +5823 0 obj << +/D [5820 0 R /XYZ 85.039 736.114 null] +>> endobj +5824 0 obj << +/D [5820 0 R /XYZ 85.039 682.515 null] +>> endobj +5825 0 obj << +/D [5820 0 R /XYZ 85.039 639.141 null] +>> endobj +5826 0 obj << +/D [5820 0 R /XYZ 85.039 612.042 null] +>> endobj +5827 0 obj << +/D [5820 0 R /XYZ 85.039 584.944 null] +>> endobj +1666 0 obj << +/D [5820 0 R /XYZ 85.039 447.474 null] +>> endobj +5828 0 obj << +/D [5820 0 R /XYZ 85.039 410.607 null] +>> endobj +5819 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F78 5831 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5834 0 obj << +/Length 3121 +/Filter /FlateDecode +>> +stream +xÚ¥Ymoܸþî_±pQX du’H½E‹\â\$Žk¯›—û@ïÊ^ÕZi#iomÜŸï¼Q/¶œ¢(gÉáp8Î<3¤ü™ÿüYºžJgqâ»*If«í‘7»ƒ‘_Ž|áXËbÀóóòè§wa4ó=7õÒÙò¶—º:T³åúWçÍû×˳ËùB)åø©;_Äqâ¼¹¾˜ûÎS/.?œ/?œÿ‚= Dß¹¾Àá/—óD9KfúpÞ¿þüókî)×›ÿ¶üxt¶ì4ít­RTóûѯ¿y³5léã‘çª4™ í¹> o@O7ÔJúÅÑÕÑß;Q<¦g?1•k× b×KS9lœ¥ )1W؃ù!g$n¿ŸC#sð‘=ãpî·Ïíâ£*öÐ9È;à(À~"䶪YHuÓÚhŽÃw²ÿ9Kñig@¨nyñò€Aƒ´¦¨Õ­(ýÜܼðôuçPûÖEÐ:U?ÄíT£¾›†á "•fF´>@5Œƒš¸\zÎu¹ZÐ+/ɱ=‹Ø©!~„ò +7šgeËäíœÛ;s—½¤¾ŠÝá‡ê÷<¤þ(έ/t“0 õ1@Â!FÊM:8Í̪@ $„ }@ƒ|#'Šœ¼)O¤¹5kŒC4xÅt +“¢‹¯š©7xŒÜî„Ì´€ô 4^á=ÏiÈ“H¤LxDAÕž'  ƒ¡m›Ô™û¬Kì¬3p?â< tW p\mð ב9áÎàî )˜qtiðÞUÅžkH3r\©Ù™)Þ JéÈyÏa&:å2ÛpW¦eØ"EIŸU£ Ú¼*™~‹{ž¼Ñ_ç‰æÍ&ÎÆ 6ýöÊ2[ ¼ µêžFEb»™¸A‚P˜ Øf³•ˆ“ùŠ}!&ŽDÖÉÌ}Ã]†wä8fÓþÐÇ<íFi,NVÞÞMåËÈU‘Í^Ç…Iä\7{ÀZÁßÄï]W:p§°ª‘¿aj‹Q²åDt0ã×õj“·ÙªÝ×Ù1Ó¾ùJ“Ža µE0RñøSUÞa¹v%Ëé[ö./ iZC7Uy›ßQó}Vì¨Ñ »Ç'SÞí!2?WeÞV½œåã.;ý”7í—[¤5¯Þ€Mꢃ xÐMŽ'Žàl´Õ¯Äh>mQU'è‰L`BÔuVVmÖ0Ÿ¢án“owŒ=låzP‚j\PŽ±ÔÕIØ•Lå7Ï×wS‚b@ÒôGÕ^@' }„)Ô5`›‚¤²fØ´;!׃è†8*òVà·š4y—e@Y8ž¸ªŠ +=r!«!{Åñèü²™ÏÅ&ã ppY±FÔÒÚçÚJྦ[zÈe]¹h2‡U­¹$âa,º0ý·¹œ +Ð5U­´[X¿ƒaÆ|Ž-_Dö¥„)­ +¸2¼¯Fúß'ìpràñï:‡¨¬Î¤ ›(9Öp„¼X byœÚ}²ÇÚHÊ@a™ßm¤´Ó~"ÛÙ3`…‘…Þî¡lJ©²FÝ•K´†çœW­Ý©ÖC—pØØf:*†¡Ý'RX Ž†étc¡ày¾éýH cPšYc€3×ÛÐ Ÿ¸)š í›Ç•NE¸‚ˆ­¯iœSIÑ +2Ín‰Tz;(Zk?—„Œ9A«Äù^“) L#Êñ¦±•O6íð‘ìÊÚX Jì;°¦³úÜ|o€õ®¨Œ{âhþ©­õì”}MÁs Óv6Š}F ‹ñ&ʸ4q£îVÅgˆÙ ÿÔŸ©v°|u1qbq‚nTâw{ÑÃÖŽ:˜¸+â‹@ECÎÆW¡ßaB×Hw» +Ê|…ƒÝš³^ÐõŠ)[1:÷ä€ v S4ÞÜž^¥šÞrÐ#«÷)W¿ti|~½Z¢ÓÔ{ëz§X^(tا¢wNЇ½ÆŽ[ ¡ˆ`ŽGàà˜: +•ói›Œ +_oàÄÚܳ¿NèÊõ<{ ï«"Œ¢4¡)Qrà;÷¥8lòÕ†ÇC +ŠxèÀÊa@Õ tŽßJs!GãžY8[È¢£êá­á«z’ç (²c<È4vhörlq’„ØHŸˆï™¡ºàg’Ö1aÏ”6öa>1B_–rƒy>wkå|,\óŠt"Œb~3Ü?maµa> +È›ð~ Ù:òl9úßQ{ßÆ¢½” Î1”4‡‘˃+ +v¶t?y䱚î- ໓‚î³›  ór¿ºç®‘©› +Y#Ö¯ä^kixè|É¿7T ÓÐS¤Nb;½Ù˜šŠ{h?}ãaßS$þ0§@…ӥφûr3S:tD‡Ãº$yœ£¶sQñžª$B® “Ž‚¨UÝEÆÒvuE›ã‹âz?ç›m¸BLÙÒ:d! ®-°Ù‹ŠÃÈÄkË0ûøs® ë)%' ÃÝvhÌÑIˆ<6½d3ʦw<Ö™-¯ X.Zñ'ʽ­H5 w‚ÃO}M¦e`#Ež…r­½}òø‘êÉ’‡¼Î0Y@uöUöƒ,ãFdPrÌŠB$áuÉÊ€'2.Ú +e£K=×Uë§Þ©!G0Ï+.vùf +d³âSn“°yKWÞ-w O¹>ÿðO&ð-±¾oZ#¥ºaö»öî­€ö³¾ãþ¸"Õœ'Fl`Èç·’j”$}ž¦G"¥"—¢·Ü‰’;Š+tß0' ‹¤D²µ»ÊŠ«†‰û†ùØŒÐhk¹Hc[dïËu_²uxözŒŒ]pGrC⎑IE]>{*úÅÈl~M@Cª‡:éФ ßhiæ¿ñš©‚N\å¥7Â@CóãO;=Ë‹/„Ÿ¸*QãB%/„ˆ@ +.u{:â>´ãîð hî§òpx3WlhG÷êÞéy5¢°®æ ”?ó[0L{xi§~äzáÙjÏóâs¢Ÿh7Pl\ûܤ4"ÊÞÞÿTJ'´/'œ?J\¯{FüŸ|?ô9mu+ùI%“ŸG”†mؼ}G%îècÒX®ru—ä¹h–n«^êÎ~t™ ŸÒÂÝìoú,„!üŒô^hÃtÃ$ÅÖ?Îsšª¹cÙ¯¹¾:»<ýùìϯ¯®¾~¹|{ÂCçËŒüãìr£Â¾âßñVû¼·ã—:¾!ALøšU*êo_”è‚ ¿%a[j4~xAR@) ñŽ.ñ‹Ýk7ß– +0|Ó»xÓ˜S‘ÊÒ^è0Dqö5/j¿ÎÆ|€ØÏ,úaçVtø™èQ¦<ýpdÓôé €§<7H§àþØMþ¯¯àh‚å•Ncf˜øV<œ ~öiÞ~-¦ðÄøò¸endstream endobj -5723 0 obj << -/D [5721 0 R /XYZ 85.039 781.388 null] +5833 0 obj << +/Type /Page +/Contents 5834 0 R +/Resources 5832 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5793 0 R >> endobj -5724 0 obj << -/D [5721 0 R /XYZ 85.039 728.299 null] +5835 0 obj << +/D [5833 0 R /XYZ 85.039 781.388 null] >> endobj -5725 0 obj << -/D [5721 0 R /XYZ 85.039 728.299 null] +1670 0 obj << +/D [5833 0 R /XYZ 85.039 667.493 null] >> endobj -5726 0 obj << -/D [5721 0 R /XYZ 230.943 101.64 null] +5836 0 obj << +/D [5833 0 R /XYZ 85.039 630.626 null] >> endobj -5720 0 obj << -/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> -/XObject << /Im13 5259 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +1674 0 obj << +/D [5833 0 R /XYZ 85.039 245.88 null] >> endobj -5730 0 obj << -/Length 515 +5837 0 obj << +/D [5833 0 R /XYZ 85.039 209.013 null] +>> endobj +5832 0 obj << +/Font << /F56 3226 0 R /F62 4047 0 R /F78 5831 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R /F35 2976 0 R /F38 2997 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5840 0 obj << +/Length 2504 /Filter /FlateDecode >> stream -xÚ¥SMoÛ0 ½ûWèḧ¢>wK?Ò¥À²4qOmAššeM3ìï²;³½] -†¤÷H>RO($(¼IA8@Þ‹õ.‘â•‘›kF^Sò3ÎE‘Œ&V ”dÅK›Ç€6$Šç‡ôòëx^\/²œˆR åÎùôò~žaº¬Nç‹é¬˜ÎnâNó!¦÷ó_džÒ¢"Mg-<þv1®v2{*n“ë¢QÚh`U!Ê|Ož¤xæ–n ¼øÍk Èð.a`4Õû·d™Ü5©*L‹*jh*'FŽFƒ ¶_ÏW×£N=êÕ“œ‡EÓP)¥xîèx}öôœX9¹Á”¢Å»h ÈJ¡‹ppªzÛâPÇlWÅ.ÆÏ=²hz†UÃ50†~ò!7ÞÕžþq5F)PI¨«lèÎÏÃó«Hg‚ÿ'½endstream +xÚÅÛrÛÆõ]_Á²îœ1aì.®êôA‘¬X‰L3"ewFÖD€$& @ eµ?ŸsY€ ÊJ뙤I¹»çì¹ß= þ'z¾cZ*èy¾0•ï÷f«#«·ÈÏGBc 5Ê°…óÓôèÍ…ãö„eVЛηtÓvToÝgïNÇӷ׃¡RÊ9zžoœÝŒ˜ðéøúr4½ýŒ;…q3Fð‡ë¯Œ)#]Ž¶àÓ÷?òN™ÖànúËÑÛi#i#H ˜_Žnï¬^*ýrd™*ð{°¶LàÕÈi:¶Òûôhrô[CŠavouYÅQ¾éøjß,Êé0‹rÍÀqÈ,EžW éÅz6K“8«x;¼9>³ßÃ|ƒŽùì“üuòöú#š·Ÿ…²QížðLáËÞP œÎŽqÉ׸`ìþùéè×S^_fó|Rq¸âýǤ¨6aÊ›q‘dU\ôy§Ž‰ÅPð¥ÍrZÊ›4Çú£›««>ÐQY<|üÓ=v) #™í=;B¶phV’<5³’ |SzÙ¦F€ƒ 6D…ãXƧeˆbºà%/‹øË&)âˆwÐñÚ‰6a‘[uÿ¤£Œ]H¢Š€lá\áQ®16³YG–¢«gná¢c8”®m +Å3óZ¸ÈafR¾Ô•«0ØzñÇzøì÷Öb=_`¹É«Xãå› +‰l*ÆÌç.i:u†Ï6ë X®î;’ÖqAxWc¾’„F4D1F ‡,†*³K*–‚Qâ™yE ´Mã°`¤ +ÝLɧ,³]w§z=RªlÐG~+qqW‘çcneàâU5ŸPgy¡ç+þJÆ©AyÕùRìÒ]…¿×4=kklX¯BJ¬ÅÔ×ë4§†‘d > 3]$iî$ašü§ÁaרÙÊ;ª`þÛp +\R8¢Ä±ñ-aK¡Â»dH¾_p+"3Ñ£„Ržaåæ~ ÌW jTÖ\‹ƒÃ•í0ò%”Ì:: †X`¼þu $ +ÝQ>´i}'‹ºè +Ómæï ÈÚ>=Ϭºp –<‹)/ЋÜ!‡¶@{Û}SÅÙ,ß´†*âMYOS +õ‡}ºàZIsE<$3B„¡|aºZaeÎùº6æºéó•.×óʲ.ë›±OT"(x§ÏV¢U"[´;0´8ÛR !6•ðžòø Æ3 kœ=Ž»=_HS±Û›¼–>”iìdÒ§<Íjͨ˜¸dèºØN:uÂ-¿Â‚¿Æ¾îò<Ð"çBUñ–Ú9JÂò¸w†V-“’WðÛQ0Aþ@Ö! Dºæß´Ý@£4£ßþV.”ECqÙ×Õ­ì†è¢ Еð¹„ÁïhŠ5YPouɇC Ý}„e›Ê“Z¾Ú ò¶ Æ\ñá¾nn`ºÐ¬­Qµä#!Š±85NŒ´¤Ì¦–‹0oçù}˜Þ1¤ÔnÇ ¢(Ðj 5¯pÀBåLN$$?Çôþç¡$Öæ9âù$Ùâ<“$é»Iò Ãm’<áØ$-Ž³|áòÑ!%´”4Qé‰ø`ÿ-CÇz¤N!¥ÒÅ辶¶¤¥êùþíð½©d]YË=–qÑæºOÝñMËÝÒîJ×T®Ý$µOÊ‘Wä¤oúÂ9½%¿ù®6_ÝevôLß{™öÞÿ¦½ø¾¸êϨ¼œ4+ÛâjâXø±ÖÙ©&”³6ÔÏ55²œÙÃã Ÿe¾cL—ñ#b¸0<èâŠ!ˆWbH²Yó/Õ"ÛÝN.6”<«Ï‡ELÝ­õ†,o6 ×—}^ÔÓGÄñMé51iÃŒ–†º^¹Æù„ß]°Ï¸MwÔ¾Ý+Â*bI㸫Šã§Š&&7ú…æøÍK‹Ú >½+|a tíÖ“ýñ¸6•ãÕC0‰XNÍ*¤aT ¹ç3Άçèj +\4îY ÂXmç©Ï`ž]GÓÓ±¤¢ñŸdƒÁRpïLæº=Ùž}`XcC. |÷K6ÀZ<ÒƧï}¾E\j^/x¶Ô”"úŽ³…¶…·Nüɵr53ð•-øL^i89ŽÞš°ÙÑAŽˆÃß;pÉÁ< uÓÞÿnÕ~ú÷_õO:fÃÛ¸™mWè¢{ì£8“ç3<ªøi÷æ VDáŠÃþÆ›5~Ó"> endobj -5270 0 obj << -/Type /XObject -/Subtype /Image -/Width 780 -/Height 369 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5735 0 R] -/Length 24902 +5841 0 obj << +/D [5839 0 R /XYZ 85.039 781.388 null] +>> endobj +1678 0 obj << +/D [5839 0 R /XYZ 85.039 323.047 null] +>> endobj +5842 0 obj << +/D [5839 0 R /XYZ 85.039 288.907 null] +>> endobj +5838 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R /F41 2994 0 R /F77 4849 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5846 0 obj << +/Length 2813 /Filter /FlateDecode >> stream -xÚì]‡b«: e˜a¦3Ãÿÿå•l d6IÉêÅ}ﶥ Öñ‘dI†©…ÂbûûÿýŸÎP2¹µ­ýÇï±PJjv[ÛÚÚ8_òB2x[ÛÚÙŒ˜`!7v[ÛÚÙÈnÃÂÖ¶¦°ÐoXØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ>üO{ßßÆsk¯åß'ÄóbýÏôÇví*Ç'øÛòIìÅ1ü£zä߇ ÿáoí¿æ?Ž{+¨:[[VOâs"Ó[ØúË:=A9h=~õ»Ø#äò#x¾e9™êÝU{t©Yg›º3Ü8&/¡´M¿¼¾lI’ äá·Î®N•DI×vmköFÙ·l<¡Kœé³ÄQ9úR­mÛȺ$”žŸ:4ö¨ÜÝŒ†Ø´»3÷m§—Ö Ð@6,|/øį’ÜîÌeëìúh0ã,Wl­ £L¬T†{,4æùÖ¨§iœ“o²+Ó¼=ú€ç%¹Q‚cÛ6Í+7ÎSÛ‰Ÿ+ª~æý††¯âB,;mÏÈŒ–$>”°ò',ù RóJë’´ìÉ 8ƒäì§Ú4ëã_caÂzä“g"¡¯ÒÆÚ°ðM¼@‚ö¢ÜØvDÎc\â… ÎX€–Ø!9‚By¥G%Y Ã6xK§K7,|/ÄVn¨`:/&âÜñîáß:á…0ýQ(sç@&Éx—éÏÝö–8ñ:X€ÇHú'6<Æ…¯â0mÛY2l´‹¡uvbÏàXÊé ¼^Ò‘Ðþ]4{!¬]²d†8œþAcþo÷=j‡ÜŽ…£»êÖîYÆz -à5àí7,|/Äa2Nº]šGè %„ô½åtéÝ ò”ņÑa°aá‹x¬æn²“+?Þ/F/J“iNxÁƒ*—1ÙYU2)CI8ß„´Éd'ô`;õ¨‹oÆB‡à>l±·«òéƹó bÂÐë(tpÔåø±iúº†çË· \ü0(Êßåê3QL¢4QQyZ’M¢ŸÊ ÞszÅ«èe4·³ ŸhúñH—±pð÷É^Èͳ3?©º2rœ ßý ½^Z±—:’÷í´®²Q4­øÐû$GÁŒyÚíÆçó£?2`± ~lµ©}xñöÀ›­µÀÌŽŠ/Ý#ÓŸÜoÇ~ãö)&QöI–Ÿ¬¼c,´å2{£í7‰~&/L‹ vrÇœó?Ò®=ôóϱ|mÚYýÃ^”Ÿ°@¦E¾ÅTG£¨‚šž€Y}·Dœ)ÔýTÙÓ絛žcxãgÕŸljÁŸL#³SÁXpù)ðj2aa©IÞÚóxaôߘÞ#XXk}a‚äÞ±KÌdÖZ»²ÈCpø q?º‹Û,^@a\oË(t EU6Éä¼ 1­@Ú ºœÀ‰"süœ­–ÊIX–Õh¥ð#|i¸Úºq•ÍãDe¢?ÙíÒ')Õ‰|išØYZmæÂsyaœÞÒð)¼p«½`˜ÇôÉÞøìl†Òé½{«`\Á‚Šó ¦{,ìÚi%:)‰7…ñ‘`TÛÛvìÀì÷ -°dˆ>i:¤]R$Ž½i}¡÷p…@Ca"<°–Çë{}9…¹LÉdÒ+nHª02|¶LÑçòB<CUyá®x$2…-}¨di6ªÉ1o#ËÚy÷ðçí“Þ²æé¾ÍgT“qM;9ÐHbkÔ¥:‹,“/æjß«’åÚùÙug¿30’EMß3GM—Ûc¡K*txÄܼHOæ…ÉsW˜ÀÊqª^ÍaØ䀲ì#ë2Áò̧wbÁÌíöàËÆ\¥ÙYd'Á"w\o8tøÇÑØýÈ#´íäÀJ´Í0ž‰G"ÙWxðIm£tÉ8»ì±;:HÌ7'Ò“yatw´w•jø]þB¼l0=‡öìË?Ì/‹­3®M°TóÌ"7’Ä…69I§ëÉ¥‹Ûúzúx‘o"‚ ¹öćN© â4‰/ñ‚ß·ÝA âÌ ÙÁzÊŒ…¤ÝØàU¼0baŸ8ðl?R«Âæ¯ M½sžu¿kûŒÛ2/Ã~­Ü €…Ü“ ÅìO»=6LÆ+%X8ä<ŠÙ±fè_âß²ÏGŽªY7*k3ž?»ñÂy,ØÉýIŽ¿Éw£æÖ-…rw¬@Å}˜¤g¼ýmÞÞ†Ÿ±€õe–WžÊ€{Êc·š§“&’ÉÌÃÜ}Ëêɾß)/ŒæÙreoú¤6HFgѼžx›¿Œ~‡…5ë`œÍÀ÷cßé€:NVxíÄŠ…ÎNóð8“Ä9)éž® ãrµ™Dþ2Ìô°Jë)/Lìr:Û1†NXÈÍ ¯·vO±n¯ælpV¸}[¡²tKúÙyH~ƒ…¹Zås÷º_'GÏÛÚ+çÖ µžðÂl59VpôeEºÈf§œ3‚Í\xùúBúœõ…3öÂaSÑ`TþuÏKË1A&Ûno_h…%:>¤Ÿg_Æš¤ÎÉòÑIL—nêÇž*Ñ­Œ‡4Ÿ1˜LbgöA ̼ ­>>Äó /LžÙd†æ¾5ùbcÄB—lq¯ã…yÝÙyQ<Ò‘Î’ee…‰27ø~ØaÈB²÷;áÇâ$=©6& ,j¨D1µ¹Ä.Œ°åùš±Uµm§ -|ªfóJ„ïwöa)J\ü#¯y!Î’K–ˬºY ^hÛm­ùu¼0Å#ýHÿ7Ô¾¼î¼(v4¦9rûR2Êr`§ær™úœQbá@¦ü9 ×Ï¥Wöå9sý€°’NÞ¨zù²Dÿ /ŒÎ¨«ÚâºmÔ×ñ‚oÑ7×Ó%ûÞ‹÷ÃWùrö&,„ç°ð“Ztáê^4­SG`ï‘¢%ù©ÛJ ~²W ‰_ž®~tiÎW<á…Ó@î Ä ½.Ù{}á9.S»²âiû"FHÿ„nÑÅü·Ì¹¼ï7Q±ÙýX@G×Ä Ç„HvÇ«Ýh1$Žò‚â§Msû¸n·sq}aÂBw²øJ6,¼‹vS^ÛÕà<ÏÎq}8Çt.Žz azd‘ÿ”×vÐÊÄB.ï[àé ¹5/ðBöæº| –G™Æ}»¨v¬’6 -H¡Å89xMêZ‚Ý|èíÝG›žð‚Ö‘Ú4¹Øì~ÛxaN첯xë‰^8ƒ•¦ä~Fƒ¢Ûkwñqš<±í®¹hЙNINlŸØÎvó@Ï›ô¬ì@KŠ'ý«KT_; šqJ??tgX’|Q¶;ïvÊ úe·öO*nXx /ŒrÝ^1ž'[ÙÏ™Y’K‚=­à™ä! d(»¾ê:-Z©ðÿÄY_ýî:|Òõ¢ ¦UB3I«1 B?ÃŒrÆ»EzËÉò}ˆáXøòÔ¤u»®ëɆ…Ïã…½ þb€ïÊõ”ûî“q¶ó®~ÀÞãë.,Ì˳ƒ4'§­eóÉ%™º’׆t§E¶gšL¬øÀ¸?ŒÍ_Ã"ö‚Ä»Ð.æ9ã˜æ<çŒ3rXcÃÂËyafv±@Ҕõ—¨‰ë/Ü“q°¨3s—½°›rÚ~*_ñ£ÿýZŽç¼ÙI·'†)D®56qówÞ“ZˆÞà]p¨0‘xÜÑ>íŸå…éòɹÈ+«G‡Ù°ð>^ØÅ£²Ð\ØõÉßµÇÅ…çºèìG&7úBðïó#MJÙŽwÆR~vöC¸Î5,Ìåp±pýžW%G,øV”ÙIs|{o4cFƒáLœêè:M]Ž# -Jþ†…·ñŒ¿}µ ª×žÃðSR&…aÏBù¸Æ u_µòÄç:ú‘Ê_`aG¢tNñ<ªš|² ?ÕÑÔXð­ã2l“œUî¦Ð‰3qªÙH¨Ç2ŽÁ~Êu–l~¤7ò‚ïO;œ/Š«)|'# Çãxì1Ä3¸öÁ¯÷ñÂŽL ÀöYWÕÌ?…ª^¯ƒ1]fïù™ÔÁKim|ól‰ËQÒî­s¼0ÕûÈeòñÚ]¼aá}¼0ÏyfÒZ'5n½É0—Í ¨‰s¼gƒOF鲎û½X°ò}šÂɾÏq`›·E×^ǾÖÆ´9Ö%,ÌÜ8jmcVô±ó`,ra³ÆˆsQ-|šDŽ‚±§ÏipÃÂ{xa¡8'öQpƨM[¹-Gov´yÕ/Ñ@â>š‚¢—–õXØW²“ÊZFVcìjôåçÙ/k “ÀžwM$‡ªœw8!Load"2b#?àÅi®ýHéñ:æ\Kæ iÊý$›½ðN^Àzˆs’´ôqiIÎy ×Ó’jrèfò&.1í¼´boÜ0¶²<9^~½ß^8¨c§]¸›ªy$0§¨»ýíUs)Ç~òævË;âwsÞ¸¤2ØØÏdòLªÛlpgXðÀÓÚÕä"cjÖœ¼)~56?Ò[yaék7»<7Œê-ÇLçê¹ÇVìžK`TS;‹œÀq* Ôœ?q`×ÞË ó†9zÝ+oKÇ kfíåòç]™¬!9Õ=š|Iñ¨üÙ¹3VòŠã`Q7•¶›ê‚wyfy$ƯØ5›â{+£­ª¬Ur>ïÕÛ6%ÖÆTìò£w¶aá]¼€EÜ÷!5-î¸ÜuvÚì“îíîØ¡CúEN’ãXépQýó@Rïå……Í>…Ç¥ÍÁÚ¤º}çË{TM!­ÖNÈÞ<*£0tB, ™ì3/& ÁŸÂ¾»4)«*Š@ØÇr»½Caoäi>–/Ž'ÓÃÌá“|M„>ÕÍÛ°ðz^Pµˆ–n]Û.ÃÍÒ“ -ʼ½’Wog‡Ÿ¸›”v”BÕ³ö…WŽ7}þ^5óŠO - §úJs æÅ\`)z§›TÏ^ Õ‰qQa¯^vöÁídQGiûx¹;O.fÉ—çr‘Ip1±¾ËÛ£uÛ°°ó£tÿe®sÜ’ÿ3æäÓqo¸¹ÈãqAx_w¥™“¬£ü\¶O—d±âŠ]*@>)óî‡: ÞÈ ˆ›Ð>³¹˜™s>“ôU’œE»dw wvˆ­ÊN»³»‚TÁ=µÂºîr¬©& EÛÄ*“s¯ Öów2û®bÇ<}ú¼ —t5%^.’û±Óžà]ËÝÞt¾³¹Û°ðz^À!ÚUùQj#¦å_.Pჹˆ¶ÅÁ'ì4-ýð°Q¥Áò{°€Ù2']ÂãLëÆ’ª^’â]Ǭ€ çع.[–Ž¾$/J—7¼‚ & ïè' ûœŒ¸<ÈäéÀÒ2vŒ|ûyA£™p£·nY§IÝcUç2±7^x/(Ñó£1å†AWò wפŽ\€ÀÚEúK•Úyç6¶ÎÛº³&" !j»éÐ%¸AfÅ·J©t)áìŠL«U=kÁÆ™òLÌHï×éz•~ê½Ý.VÂa.(§×…ùmiìOúÒîÐüêZsHßë³ý'ÕK;Ú»0S;–Þ Z—õ–B Ç ¬[*¼“8îǨO\(›…i›ñ¼ Á]Ï@âÝÔ%o@î¹Æ¸‡2¹Ž·øè,_„ ôM+}çžú¢Ÿ>ÀSýs=ºÅSà]üÕWUïƒé§DOK[{/èAÒëlD/¸Ý4wO¸ùw¶û»´Ê-oºßܷ˧^*tðã·öN^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^Ø°°µ6,lmÃÂÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ ÿoó·nß{kã…¿9—‘ïc•™ØðàˆAv;Ï+ÀÕãùIî¼;\œþ%‘óør·/^ÓóŸ+÷$Þxá/6¯lãÞëÆÆUžùÄI¸ï]CÌßuøk;íäëL[Kö«@!Lœ8<¿MXLz$%¹PÉÿâÆÜı­Õj{œyN×ØñÆ ,f” ÆøDHA•iVI7öA*ÍÌŒ,nñz—'™Í…O‚ î™52A£ÃÍJ![ø -Ì1Ð^hei„L˜™ ÂcÃ…ÍF¶^Édî„’êk&œYE#y“å¨Ïy”¥¹žWcÁEkº¼ô,ÁÚ @4nþÃ;CHÄ‚„g„SÍÒå‘ÑÈ´é},à19KÓ>•9<¨m%§Ð?i÷6wM+`¬5á‰ñ­ˆ¼qqùÙ7^øfËäÿm+™y^+â=/H‡Á€÷Ì.GóA5¦eÀ eTÄ(žC’ñÀ0zîl†b(%L­ý¤ˆSZõú=`!,Œ€ P¼Xo‘lê°ÐÉÊ p=¯g.qimÔ£†áÊÀ,TÚÚ+*i)XÒÜX4ð"Œøx¦aÉth¥Y{ž;bÁf+<jŸ‹ì‡7%Oõ¹»ã|7 & u‘[¢ï/ÒÁBx†F†ÃàÐÎë9j¤OeË`'d2€®Ý=ë:Øxá«Í…Rñ‚mÁ$‹´#aâ…>—Ìׂg m(mÆí´ãJF1œ0;Ç;Ö( ‹÷T¦UVf2õö\û]–-ˆ9°ªä”÷êp[FF,€h‹€ŽÞë³9 ˆ4@Žì4–E‘"r=ø=¶X…·J61ÀO¤“F:ù‘ÓP§ßå‚E¨ÿ>bƒJaVV¸ƒW๠;Ü÷AT¦²)2)ì20<´ -˜ìË2+[ÙÅ î Ïe¤@\/ü-,”8¿/$5Ì­Œ…ŽdDJk…¦öbËãDÈŸpAo‰<Ÿ%ˆ*!%Ç/º¯éM@ì$S<¼åȲx" ÷ØX°4áÄhJ¨³©7a0m¯a^ -†¾~h”Ì›&ho'¨¦/X¹êTi{“*«<%JéH¬÷ˆ§vQÉ#Yn˜ÈvùÏíïâûÏ@7ô"$BêxO‹€ë‡5Þ -ÑŒ“/ü5,Œ¼¥æÇ=/ž 1³km/PcYÈ[ñŠhè`R2”0Þ@ÈÌ«Â -fŸ*B„Ú!qElqàÑpÀ‚RÍ8' ,øðÇôÚ†8ÓOX0”€0CcÕ™½;FÎ-¦‰/(Y`!®8 ÜŸAëáRÖÄ éØÓbè3©í4Ð*Øú½MT`£x5‰ÀΧ1ò‚%<<•¢®¬mèI²ñ³ 4òH{ÊP÷¼³A šyÁ‹½i·à…ÈÀõˆœÙž:ûLÀœm×±aáæÓžŽ„ˆCÐãÁ˜`h%p ˆ…1¡E@Ð]cÄ(A ±Ám ©ŽXPöhF¥áƒ±A뙢žBrÂmô/€AQ~‘"|QÃz¼¨Õ-ˆAB{A ;Œ1+i‰01X FŒê”×s£.fn€g¯eZÙqá$`i^€>˜ÞÆ Ë´#y!1@uƒ,y&EÉ|Oó‚(3læè¢ eîôLj/5Ÿö=¢çp˜“´n­FïÀp£pW"dJ@.sô(å>üèSmeU˜²Ùù9h%’’T-dXš=òBÀ™Cà3 ”½!+áš¹;˜ÏÁ.G,P^áÄ õ8êöð ®åg`¡ƒãC¯”í¬{ -à³ IÑ°M‹Ø²K ™Â_î“R¢½/˜"€ãxAZj}Þ=¿ò¼ñÂ7ÐÂAïF,€t3P­ÅÞæ¦+so^†ÖÍö´ú³Cbt4‚"8¨ø(W^©~{Ö‘z -õáærø4#ø#“n cxZç© àÏ`90ã©Âe–aKÙ8¨¯TR_ÝP³1œá¤ZáG¼ýÞ^Ч -z¾,ï\ÔþÝÞˆÔÜeh/0è\ )¼¡;­ /ø>•Lpë]øIrP Á‚(ë\ÂQi¾æB˜8&µñÂ7c!“™ç÷(}‰ZvT4à×¾ÊzŸDBýªYšæŸ„¦iùF‹ÞS0‚› µ+ÜbØsºÄ¬z߷ʲ#J;)wAX`QkG>ªî©c·¸6çÀø&eÛ.quz:ÛßUfde!˜´xÍL‚0 |ü×ÊLe¨O ªäúÖoW)-x¤²™Ú$é%™˜VTî|Ö8m[BOã ƒŽ;Øù~ׄñ -ÝŠ{èFh"ŽiÂ;¨ÚÄÄÍS«²W¬È«ókm/|±’ÔsPvh¨p‡]?ÅÊ3ÿ!Ž½xa/àŸ<}ýè -,`Møãqý“7¹’üà&}À<&OÑüØé;¨ uÙŸI@„,®©ºÓÃßâ9ž\klzÍc<5ÆÍöüxºèt,šXé„cÿðÐ>¸;·WÅ?Æúóó'‰þ ?¥® -æ¿{>,|ã…¯&†NFñ£8ÊA÷÷ è ƒ®~ýñ§æ-R‚Xø}rCa¼ÇÆ Ž ;÷Åe­ -õÞ¥Ý xòÁžÕ¦žfñ{°Úño±€+é.²ñÂwƒÁ·ÿh?…­Þ–/°Ï‹×IzÀ‹¼Ffƒué*/|;ÿè ŸûÓÞ¶Ãî*7&[¾óÖ¶öH6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖâk[û/ñ7^ØÚÖÎñ[ÛÚÿÚä ã[ÛÚÛ˜Øc¡.¶¶µÿ·Å°µ­mmk[ÛÚÖ¶¶µ­mmk[ÛÚÖ¶¶µ­mmk[û¬Ø«_ÒI½õûY'åËßM¾{t¼4ødá)òèA¡ârms¸4×ïh"ù‹%³†[Zo†•Âø\áÁ*äÏ@A•´\•Š„sÁ»•ûºÒ•ì¥ï}7|9þ[ǤÍÇ -O$`P\ão PÉœ@Jgř̕<ˆ¹¬Ví¨Å%fp_øn&]¿‘âÓI™®l?U»ÆAI?«wQ@a‡ÚÇŠØ¢Ò^—Ú-ÜÔe¨LëW½¼e= ‰õ¡ôº[{^Yª™L‹¡`Ò®ÿ@dk5ìíŠÈ5e¬©%Áüœkáp^õjˆ+øV*h¿§9LÝÔ¶ž*åºQþˆ¡†#LRM®ƒ!¤XU·7˜ãçéë”Ó˜ÉrÈpGò÷ù5$w`¾âågJOŒn˜,’¿D -Ú}î®;ÛŽ—\™×3À|©½Ü†·|§½P€¹‚›Ÿ}ªô˜’Á¢Ãiw‡”tU†ás•òµêÉ¥peúb}nùVIÌáUr^}ªô”ð†˜Ò%ÿD«˜‰6éºz®Y¸«¿!›ë…ö¶Ô5@Sz§$Ö4G£îc¥'¡à!ø+`èGm|ÝKzbm ¦6™Òí_©£€½w½ Œ¯‘ù§jähKÙÒý;ëmÊí³6¶{þ í7P}¹R,¼7OóÙ:y¶²£äÝš’dþêoèËóôõb‘®lNÝß,þ¹ö36÷¬·Í’ËÖVÅ+ÎÖW$ý7³€¿73ƒÃdøÁÂÓ»Ï@{_£ë;,;ÉÖ÷̓!’½z¨ÙÛ‡Úá>C1Yý!,Äëǽxî3Üm¡|¹ÑaüÝÓ²)YüÁÒIþ!0Ôtuï½AŸ†òõqÂýûc‚Ò϶Ÿ«ÞC°¾÷ž¬Ÿ1('Þ«Ùäí>þÂýlû9ý;ëÏZ¿ww«OÏÜjdób‡ûøøA'Ï>XxP­øKÅíªõ³e2)Ö×s öú˜þ÷ûøCùÑö³÷ÙX½»=!<8—týé"àÜyñ«±¸|wjï¬ú]Å*çÁÂÂî žúŒ…ë™Ã÷;“Z)>YÚþ§œI±XÝØ}ŽïÙ–òÕÁÎûuñÙjþÁQ„L¸ruíÃy†Bóð ÷îš»Ï^Ó2>Ü×u¿±»ú¢NõŒ µHeóbÉôèÛãnzÁ?9ÚÁ{eFú Z²~(Ús|ÏâåI$õûkR8R~²3É’[µã¡¶¾÷¾hä•£×;“vL¾;÷8‘î'cdŸ8u7Ñ=!Í}FÜó<«àã7?º’zVÿœõÅ@íÑ3Ä‚ÿŸ$~¸3É–â­?¯=á–ü ®qÃUe“^ÚÀöys—ó~EíZ‹Åßr&Ù’¯í½wž™TÓ—ƒ¡~ÿ´Ü3ùÉÕ­ ÷OÙÏż÷Í3ªÅü™=ï–Dç³#“|þ§2{ŒtugRÜ5û.,8ÏÀVä…ä¦ÖçðB|MØ®C~-,8Œ…¬ÉÄ‚E«ÔMÃB4ðrëÖ…vCĤH€jøÍÂ}zÃT$õ­XˆòºÕR!\»Àå!h[9—.|ªsá0œV5¦ëFËx–Š4JDZlj«û8˜ðù&À ÁD Ã}¤pU£é7Y›l»t]g¨àÞ— ð™h…+Úœ’Áƒ>¹H31]Ú?ŒÔÁ§ês|x¼ö$í‡ÌUd5úÄ´LD^¿ZGrh” -{ˆa|qD†Â†÷‘CCcë¡Iwê!à´úÃu¤H2ÎiíJš dýRŠëó†êaB.›”3k0ƒ±?âç -©p.«Hò4e8×7xY Ü+Àt T­%ØpÏ~Ä‚Ááæ®!¤›»Xã8”~x#:LºoÎvƒ'¥äÍÚ¼àB¹ÓÁkip Û`%®xžÝH†í6poÖ?Á^ððᬺïL8@9•Ì¨àH¢öƒžCãè¾Ü^(ñ¶ M¯Á­•øàŽ0 >n‹ MƒÛ_ꇨ?œ")#Ã+•CœBÿTbN†EÝÅp|­‡Óâ›u$SŠž /áK6ìÐÙMxŽ’…¢Û‚& PÚ’Ïø™˜,ØQ}tA-¢¨©çÜÓ:RŽ}ÜP=ÎCÃ8‡…ß,¶QÙ»˜ó—KaŽÀgrÀJGªÆ>õC*S!&Bê¡ñ–ì\|&/`ïûÐê]ÊDÎSxR+ãÇÆ0 ˜üúZM¸5¶[xÁT!9œ`œ&p‹§•‡NZpÑ^‘­ÖÖö½È 8®$,†š4+èc¤úˆXð`¾1Œ‚J«PÃÐÇt$óÄŠþ1 Ðí,b„ÏÅQ'ð(&j£Ègº÷Š¼`¨7ïPqï‹Ê4¬ñát„§œåÃ;¯ÂÞÆ‚ÞÕ}Hy -àôk…=4@~¡v14Ê Z«È(–÷píôPO;vuŽµ#9ê÷9clÞêù:”¿ÏJWW-A}¡¨V ÀpºúbÚW0Á˜y é¾²EŸRB†YƒºÕ D¸ÜávÔ¿åu10œ¸Ú†¢" ®To~l "|”h]^ˆ¹ -ê,ZõðÕ` )YGPÚCœ–õÃ[»cP耰^Š=4¶«ÅÇAñéÔP:û¡ -ŽÇÒýÐ|(/ ÁírvÏ„—ï±Ðƒ’Ú¤i’ì -…… ì;°`KF›NÅj89ålo’F¦ØS;Þ¸¨È~ƂŸhìã}c³a¨†"è#´Ü¶ …°â5Vä4´^ššê¼±QÚäv X€/ÂG ׶ > P“äŠGM*$ /T`y©‡'ª;Åô/ÇBS$5SÔ# ŠÛXPC“ؾ¡B Mñá¼P ¥Ó$0–èK²à QN=mŠ†eapûÔ§ú@µ/87z“(yò@HjБ”lfΉú*ôýRij…Ír¥#)בSÆ…Äßñ‚‚ž1,Ô‘µ˜=DëHxJŸYš?´&rUí©”e½ÖÌŽ’6õÈV…ÓÖ¡ƒç…X¨™šúR× †¦.e¢°`hyTñqäný±¼Æ©£ª ICàaZ„‡Àã½äqñÔ@zT„*¦5‡ÇwaîèU¸w÷¸ ^SíòÆ0I°Ã!A›œbˆ»Œ…ßñ‚²šqT±dª©žš2\k«ÕC Ú”i^žâGjÕ­ µ_EYs¹CËØB¬PIóq×uQïÞˆµk†ÆÀƒr€À*Üмðéë ‘ ŒsêŠÞn(™ërc>­Awr)gáPœ†S_÷©‚ÜÖ¸·ë -Ô ¨`£ë‘U舣‚§†za·`AëqR÷±íû(_È 9—,ǘ\)›þ *-¨Ä ð8áò(|ñ!,ØRE%¹ðí|YË'ò‚Ã$ÆEõ ¼§è:R 7†w˜ ‰ÒŸ†…z—`Z‡ä$óݼ`2I;ÜÒ#¡’Y+a¡N%§½'¤HŽ*¨>„ÊÒ¨Ì=‹ž­#äîi*’+YcXð–òƒÍŠ^Æ ¥n…µzÓæ°DéG`¡ƒcÎÐî¿Þ^à¶o9:~¹ÝÃ:’y¥¦’æ`»«Çì…TɨOüÜvŸ‡m/PŒžloБ2xxÂhŒ¡¬ôãt$ÌøTGõ_i/`å…LoqKÜ=\ÌÝC,¨"jÈö} ¼pL*ƒ0˲ªx/ ½0L‰])ËùQ^k;—…Tî–ùÎâ#°PÃð¨Hh ÑZä;!/ 2-ô)/0ßy.ìÿK,¸îhF;pÑ1ßùQ?RÓŽ¥aáP.visŸŒO§c;2 ñQ¢—caLldH±¯Ìwþ …ªÙ¡Íèt‘.ÿ¥~¤ F†É½Å¯±ï±Ðƒ)ÃÑ/yÁÑ{á¸Ò2v>!õ+yÁ3aeÀ“¤Î»°Bgc~1ù^hTz»3þhÂëIŠ‰È·aA+|Ê=#ŽjÁý’Råz>T#åkL}‹Ïî áÊþ©X¨™Ð¯Þ`/`6m¨'‚ƒ°†Ï±r½cõí,¿Žl’˜ñwʇµ°À¹S‡Òµêž¬?†[Ò ·Ï,MÁ«³~¤çaÁ‚§€Ñnæ^’^5Ò™l½ÚeUa´»|/ä2Œ-ÆÃÐCá7Æ#…r¬ÕÈ%õÖÂBíb¡Ÿ.-y4ü ;!E]'h'œõl=“ -&e`PÉÅÁÍ_Ç !.®\2~øî> –Žr8ŠÏaØÍ7òÂPbÚ*I]z2ã>Ž…$˜15ªí¯±0ÔÎÈ~äœÀgòÂ`¥Xz¹¤n¾ô‹¼Žj³1¡¹KÍáó°0d­ÅçhkÓ?§Ú­¿A¦ý¤ü…þÕïæòÄ' ÏWòÂ5«mÃÂe,x®coXxÄÆ /lXØxás±`lXØì… Ã[6W]ÏFýD,´·ì¾èÂ3°€;\¾QüôáBc!~â| -jãç¬î §ü^pXõT,ÜÀ sîÅ‚uÇÙ%ã—sF{v¬Ö8}2/„‡ÑÏáùäŒ`m,ô§èXòÓ§;O5œ?Ä á>Cà]¼Ý{ßû°`JÖ\<ߺPÊ{jå¢~2/T]Ìñ\ ³ÎÜãÇá:Üù×ôñ¢·ðÂÓ±`_Ñ -v?É¸ËžÍ ÅAäavA\›Â3ÉÁ Ãuð»|/„–a¦¥ÒøŠ,µ­‡y!Ìs œ(É+5”ÄÌ;Å Ê´3nåË΃R:V¦&C«Â-áÊܬ‡ IÔ¡ÚLíþ×XˆKZ–˜„’§&ƹFVŸ”^娾§-^2(ñVžÕ›¹h,¬m/x%éó/N¢Â´wqd Ne”9>hÐH¼o]åXä:neêÔµy!HeaYã½Â¡Žz'™ºg0mÞ!Zœ*ÎÒ 4 H’á «+·yi u&EéMXø2^ .f#– þÀ³ÇxÁ£S.2æ&KÜD©âð#C#sܹͺ &vBÈÀ‘JÆm\¼¶]b0æv <Ãü5TbÌ™a¨®óh¨’‡ø2zÜ8 árõ20}b§©Ú´Ž´âHƒ&Â8¾û!â”mC%ÕÝÊÕ‹õð±1C0”ðS>òB½¢$à}˜Áp2Ç$ †›„…RíÒfŽ#£Ò8 2S*\è nipµÕ <;øR^ ²éˆçC̘ãY …Á#X Òôc5’§~ð¸ëx`u*™cœù·èH=§–WáB*?$”%ŒµúTŠj‡‘å=˜½˜õÜþ - æîTÅMøl““ï„L£í…žaßS`Å=\·÷,·äZ_G -@þ=‚©Ü¡dUG 5’:÷Ðôlyp»Šø™:ƒWaÿ,x&ýBLX¨™LBz–y;ìàÕò =³¼ˆc‚Š¤a„Ûœ›–•Â°Òí‹oåµY"ëRM6Aj9`aÜõÉ¢TaÅJ%žN^¤êH;^ê^hÕ\Òªí_2„˜5¤XO>P–(Uö´ÇÅoí/”`NŸâLP`˜oa©x•nÈè Bà†tÖl/4rM,`&B¯ö–Δµlé³Õ½0߹׃"È$ÝÛ kba@Öl6÷ ßIõM‘`rz‰D—âÁ´­B*Á½õ–ö—åxº–Ž>™RôÑ‘p7Ð4O™´bW²´êu¬j©’Óéª?`Am¤ ïGÓ Ë&Å£@õ°Ði©w³Žà ®]`5œÁ¨ºœâ˜³iÜ©¾\Ã`’˜°:5Ã¥½°žà¨ÈLRû¬ƒziy“ˆïLsxÁ\z{ÏÎÚXÀ»jçÆU÷À7Ts·Ð®fÜmZn g¢xÀƒ—E¾ØvÖXÈd€f>Œ˜>š†6MŽv¦#Û Hã@éWçŒPû ®Ð>Åÿñ#¼Š -T„KáóJ×¢¿Ã‚­0ÚW8¯u ûÒLñ„…ñr9_`ŒzPŽqiAŒö‚·"/´#"¥l£OµQ} #LIáýÒ4,¤ÏÂ&Î:’1bÁÖ¬Y³tœô g»AÏNêM OÕSû^âVžä‹yºZBcµaæ`˜ý#:ÒnN¸2`ZñmÎTIÜ ÖKÕTWŽPû ºtF‰Xð¸Ù!·¤lXð‚ÞdSÏH¿âÜ$“2ÜÐœ;õ¨#ÍúÀXuB š-qŽ©#ŠÝ˜ì…5± Ëݸ0i,ô#7M¼0­1ÔpÆÓxu$%ÀZOJíÝ÷L¸úžtD)"G°aÉ ñ—óUbs€Ö s.lçìV,Ôª4掇Z¯Õ3J# T½-­Ýu,88CÖ“®,PyÁ‘nÒÜü~}2žO±)—X•fPI,‚•«]vƒZèF«‰šUyÔ˜&’ JGÚó‚³´ëáζÍð<IÝ[½I[îu$tcÏ25™% ªà•¹ñ ^HF^øf{Jn› D6e"Yý/€Ìp3ÀgmIq¼\™f I%\xÎ…ý êS®TX°¥šz›^œPè&~ëGBÁÆÛÄ\Úa.ÉöX€>7Y -ï‡Û­,Àë¡YÇXñ^¬l¥ÚÂwšs÷¼PJQ(ŠÎ0q=àz)N -f*Ñ^PuÉà¹Ø³­jÏgžÃXÛÃd/ Í &z”¦5ýïãѨU…yЇû!äåݼ JQj74fÅDy]þ´A¹ÂªªöpðS,UáB½^KÊqÄ-E7hÜ9˜#n0üžÆ`Øau Ú*|ÀRºúö]¥ÛÁ_©‰ÐÃC ïû ^ pu -/-D‚«ìõ…{ù «•ácãÈ„üYöB ’@j^¡æ¬Œå€'îXÇÕÁ,³ÜàÊ·ëq¥…(ãÂVÞ½ 7‚ž Ïo´vÖèô|æÚ3îçt7ZÞôÃøvÁNÙ¨ŽgùÃX@w¼zôßáõ<Õ©b4Fð²ý)›<ƒ¡/7Øón©|,M¬±â’w«Uˆe ?Òª>Õ|°Ôè;ð¯¡~R_øøB=ý‚÷ó6ÆhŠ]«7cè·Q–5Œ¯!V¬ÇZ¿@ìxW|«éZlx¤æ £»%6O½WïŽ@ì»u$ãa)ª ÁÖæ硤Žõ±pë€7÷†Í’Öð#= écX¥µž…&‚G'czoݵ¶±P¼ ÖXø2©·žÿ ŽËÍX°Ì;Äõ>,xŽã?Ž£âVä#Ø=†…·ðB7báëjH> Çsró„ŽÞ‡…•fÇwGÛ¼‹nm_Ç Æ»Ñúð|g÷ÏÔÁH(m„t)|[kÐMuIÖPš®'G\”rÕQçE¯¦Ç[2 w<ªd÷ºVA\Éqt>qò ðÝpõ†‚?€…FNmµ‰<š/¹b- CLåþ‹^Áç)ߦMÖ(<1›ºÇþ7ì¦ÇëM<îtÉ5U퀯Ù[8OoDsêBø‘Ò3¿¡ìO(IæúS_;^r]ÍbB˜óºwCG&Ú½mtŠqªbj>lÍÿ†+ÉÐo›­8‡OÔ¹®¡›ŒÊÂëU”üÃCŸ1­¬×òWsõ+xnÕ2wÕú—ÆT`Ö¿|¨Ù;ÍV‡¬µ€¨iý™•e¿îNŸÁ›Ê&o_+‰¯f¢Ó–b>×K“ýkaR>’u/Y>Cjkúrz¯xôÖÑÁZ¬‚îºúõû-†µW6á’l}Zßñ—KE ŸR$ùžÖ½Ô]pw³ÞkO­Ïs«ûÏÛ§H­x½TÐ×—ö>ãgÏ»B …½úË6šgHmùúÈz».\§ÕGKi[ÛÚÖ¶¶µ­mmk[ÛÚÖ¶¶µ­mmk[ÛÚÖ¶¶µ­mmk[ûúVxVÞªá[ŽÔoÃø›þ6óoÆü~3ô™ûƒµqî”ËÍ;hã=›qá ^|ƒÆïæðSÅIWês‹ ë³k‹MD_ÖZÎy…å9ï0&ŠcXݾåX3R+ öp0…A†ßL}0Åøcõm K6áA -éªãÁ«izøáE+1︥úƇ­Ñ÷8984w¼Pk| -Å<韣¶ò=jÙ…ƒá¹ƒÞÉã•‹ƒí&¢/k‰NÏ‹ô–r˜®\a¹V^g™Ê‹±tþ fÁ\fïƤwþ8Xú ø!“ȃf.s•åÖÉAŠ>Ø];èòŸ±°ÿÖÿ©Nºb;o«Â:›ÊŠe¬Þ‡ÍzÇOÿŸÛ ¾ã8ÏÍý¿ü*ÄÐ)rľ^ŒPÉ]= ‹’=tÊÑ‹X(¥°·Cåý¶î=ˆÍSì„\-W¡ÆB ° @kÒ´}½0¥JÚe9{î6¬`ò=ÄN¡’*çÝxAè2<<ü5òïÀB¨bÚzø—E U#îêmªýHÆIá†7ž‡¡SÉ-Ï´/dªò½Ã­š;´R1ô - .÷`ìt÷xA°>A²ž„[ùÔ Ná§V±PiP`_ˆÆB9ñÂu©ÍšmF -»udSšªŸKÛ¸×^(Ü)W@Z´ð]Ùỹܨ^¡i˜AUA8–F·ð‚+ÍÌlvÎa!„G=ã $¶ï Û_?:`õúÆûز.»×Ðæƈj–÷ÌèxÌ’ š Lpi‚C”5â¦iâG{6iq#JÕ½Îa@^3±SñÌ ’U -ýKÚbì^õ$,xŒõν7’®W¤èC†`°%)2ÀG!xP8\ÙÎG!ä§bp9ç—ã“pÚ0)üK¾»«ö¼n[åJšÁ è1¨\õ|™äf´\í÷`ÆgNjs®=+?ñïÃý)¤¾ÃW¬b5ÇÏÖ±÷¨›wKVï`Ž2mÔ>óÆút¶ä«äþz;ÊR -"’²Ý!/ Ž¤„? ëÊTçß`[Ý°_Û~$­# ‰h¼=±K^0`VD•9u–©óÝ'a#‰â&.NJ̼Væ Ü®ÁXÊtÊn÷©®‘ïìq[Oð½‡Çš5cWaÁÂé§@页RÔã[ÿ Á9½Ž…×Úv:Ũ”¼®B–¼[V²©÷o» ¾íÝúZ¤d«0iÓ-¼–*µ‡FXic«±›¦-Z Ú>Iƒ±0ÎEÉ à±À®óÂ\1¢Ç'¥ÞÚ(× µS±Ðð³ä}Ë.#ð^µë6Ì)cT¤‡ÆänÞhÞ¹‚…]xÖ§ŒƒÕ°³ŒÈ)è¡Ao„žnQîÄ7ba8U×ÕÝ‚tLÍ–Úv®Š)‡„cI. ‰Ín*æiú¿Æ‚¢'t΀‰lƒ¿0Å ¸¯-tÍiÕ½~(¡Ÿ‰¸IGª=/^Íß݈[fÀKX htª»€êÆE^(nâ ¤†¹\ªÑË2òÂØy! ‘Â'"œ-F‚Š5Þ«/ÔóæG?Ò9Ÿª3bÁ,À‚}cM.4])ÐI"ùMÚ ˜#—½‡÷¬;gZÉ0,L£÷¥R#cÂŒŽÂ¿Aêº8 $wÝd·‚øܱî\©ƒºEÛ«L‡Y‚ßÁØx6­T÷¨êñú™Äëe¿ÀBÀÄ–9yç±pÕ^(@ES©’ œÈUArºÄOÁ*¼Šgqõä#/à¦Çv÷ñSI† -0,íF˜Ö^îõ©N¼@a -ÎA1±q­€í†…nô w~Í|/X¯Ív¼—ê”™×63y ŒSJ]&Óø®ÿ ?Ù :UR9$ú2U`¼Öò%; êªuJt»%Þ¼€:àÊêÑœi‘kB­?0`æJ§ñÉð€™Ã}e;c­Æ~Ôus¶ÂðܧšÜ˜a}G+J“uxaÈy¿ºø0o®ò‹6·CÃ`ËxÌ^8ô=Õ}‚Â×,DtÈ…¨ÄNìlwÛú¿¦lÕ®Áš&¡š? ¹3›_ÇB•¥qŽ4¶p¥B[ËVH”:½q1±.®T5¹/Aе‡þ–Üÿ[ãT Ö¬.šûopw5ÓÖÔq_?h/ÌX;oœßËi3`P+Skp1¾@Ì´?òB12&”sž3º p1S#Ç]¸4ïó#yÓ;Hœ/àOžÆÂmFÉý/Ìiˆýí§ÁñÑõ…[xa¾eð£5\Ÿïj±’Oµ¼g`a?|æT‹rï{aéGÊG\áÂL(]ý˜´,\*ÄÁLû/¸²Œª,<õœv8â…:Ü©ãtør‚…ÓOcá1^¸ÛäPÔ(i£[©Ë˜‹°;£ÍDt¬ÕtA#˜pÑ ¯su š«Y¨A5^ó8Déü[ÝæZ­Ì(ܳñUWN Ì&Hå©©ž½Ÿ*©½©)UýM¼ß`Á¼7Žõ ®õÀCݳè?Ù doþa*Å°C½«P hŸçÀDñB}/Œ1Õ8¿*óÁÖöB>òXêŒK׸ŽƒR_ö#i,x3/à¶Åè*Ïo__`wñB5ÒÆG#ðMÃ%Ⱥuæ:Z„ /TPÊñÕl¹NXqÞ®™ýšÜñÒB?w!™…’xêÃcï˜*IË]*ÔŠ­|ªTûГaZ×ÆãXð¹HoBÈxù†³¶Šàm–ø"ìšIî°¸d:W$9æJrµld¹R¤)“QèÆïà…,ÉóÜ®¦Žh]ÕÁ™¦Oðd-¦ðåÓôz rÿs¼ u$¯’Hó&[±¢Êƒv;/T2ÁЬPpð]žÕ8³0¬3y¦LÁÓ ¡Z«ªfŽ"j8ØkN´]˜$røÝsŽŸô^p@Eß@¿akvª"†ÛŸZö‚{ºw5<)†©âBj®õ×o”»Þ‘AÍ%Ó€ÃóDZàÜU–ÊêfÛy©â‚ÐBKwJO:wÕ^¨»dÌ•Äqñ;*܉ -F lju€’ÙÝa/ËOuãûºÝ§º˜qÑÅ8U8\vOñ#Uãè›ð—tü«Ï“KX8vŸW,ÂÉiôsâãÒ °0.rõù^ã¥)¨‘£ÍD¹]9‡…bÿTª§†4Ê·@Îî°¦®EÕ#ï,T¹L2o¨«&EŸ}‘0¼’8)¨s†­¢á¬Æ°–=&ºÕUš¢Û¤®fçÉ9JÑÝE‘ž=Õ⸾Ý^¸ÅÕrîàù !0 Y õâèútø¯çͯ'ž³¾°ÄŸz°°!¶ÔöF=»! -Äa;ä…½×í·¼0«åtw/.ðÂbu„ùØ}¬ÚÑLZ³zi:Ä\+Ùýqyþ;°¸ÒmbG°†JÒÏç®#a¶eU.\ü"èË™$Œ»ú ƒ>)–¦.Êå´¾0JÈ ÉAµÉßñÂ`P¸eâªh‚LªŽˆLGÎd ;':½DS½(ºŠzªF[öÊ4A7} ºfÇoÆÂ^à“½àJ;Ê9¯•Ìô9·3Š†ÃŠ>Õï¶ÂĶ/y=D %RæɹZaÕA"@„¾!Ž™‰:û1ÑYa•®Ð¥å¶Q»µ‰ùígêÔ–'óYwðBEOj…Ñ¥¦V¤xK¡‹ÆžØÐiêp§Þ¥ª¯èåÒK^*ê²ñ€"”lær¸#ä=X\ìFé2†aÞ…ªÞg¹*í™b97,Ê„Û9pâ® b +ùÔ%›½ð£CTöu]xí/nzWîq¸ÐY[Q¨¢ÞjolõPM¥­Š8žâåÂHKº1¿;+8¼¦á𿻆¤q8,±3Þ²PÝ0¼b¨óY[šº¬ƒh_ÄžJåÁ…ÞáEé /ܳ}U¥-ŒÉ¯âdO"x·zªW° ' Ê ¿$esx`§æ=,qÕ´{h/’:}<¿%K}­Üÿ%™¸§({î‚ŠúûH—' -ȳ -Ã3ê°àò¡” h¹¨êÞW¡ìûµ¿Ûà0Xeö^ÆÂÝ‘&Ö/Òï ëØwá_……ï¶:°Žû‹XØŽä£éYJi†AÅËsÄöæþì~m?µwï×öò¶­/\ô#%oΔ@”Ê¥éªS¹ÒÜWx¡®Rš‡¿¾Cýk,œç…¢L×l_ß½OÄŸ]_Htl@àZf3¹ç†§ë¼ú˼êd¥æw³rH¯Xµmõ/„Lû‡~§ÀDô‡ÇÛu]ë|¾Ú^p:Óô.bÁòFkBÕ6óÆ â;ÒÜkãÊî}y!à¬ì‰“þò]y]ØnÉý?÷nB.ªžÍ/ó]þƒ|@îÿe/ÜâGš°PkGxÁoïGǽß^ãN"TSÙM¾Ài[¾ÁWhëÅ2ôdêPM¥J5©É°í×V³q=ÀÕï‡è•f¸U±ïÞ¼} ¹Ô=¬ˆ¥rˆq ßµ×ù_^_ð°½Â¡NÞ®È?äGr樷– EF9c)€ÌpÁ¹‰©u c Ãú·¤œøE.gnY‰ÚÊKg y g`TÉq9Ði½ÁË°’:Æ­¦mwÂX£Ø†îaÊbèV§Ý«°{U=¤j;¡¥éÿ -¾Ú^ðú¾¯oÅ‚'xRÒ{¶x~¨žª½ÌYM%Ýù)Þ“J˜Ä\¸<ó#ÆÉa•ò GÇ”ÔRÉ6–+#>oÇ?8þà>žé2X;•¿kÔ7RTÞײ$—zßl+â߶l¬–# cx(“”Ü­ÿ /|±½`K~1NÕÞozVi½Hm¤AïØ53ns7/,…­vÕÔ¬·²tµ^=1[*æS(Ujó©=êôǘî Àë<œãB=üV{6{âÚ³1£) ·y;½ë)æö©\X)oaSÅp°qo³G.øÞâ6ŽJð³C°fccŸ¹õù„çÓY0;‚x$ZÐ3¯" î S‚rŠ&¼8äbÄÖÖšªïÍ=Õäý#°˜ÍxJG`h×t/q!G÷47ÚÖšÎÆ Ù³1h{;ÂGƒµý¸×Úóš8Ã~â·¶/;‚¸Ð¡]q¼Ä…üòl=a¹Ü›¸ §¸0Õ.¤z6÷Ä{6m5Å…ý&‡ýê Šžì@"ª­§bˆpÍ):‡þ,ÅÙ„Br’_=‘Zšž£WÚ~ÜRP•D!.<ÈKM/ÓãÛoe·øý·Âµ 0è†h xS=s ^Êý/Æ»w8ßQc>ÍÙ(¦z&“àèðbe{ÝUüÊ8zhendstream +xÚÅYëoܸÿî¿b‘¶ˆÈ2¢Þr?ù|y8h\7^ãppœvÅ]«ÖJ:IëÍýã;RÒ>sh ÔCr8‡óøQ–#þÉQä ÛGa$…E£ùêÂ-aæÃ…ÔÍ2ðü4½xûÞFÒ±¦‹^Ž/<ßMÓGëúãÕÝôÝ—ñÄu]KÆb< ÃȺ~¸Këž©w_nn§7·päQZw8ý÷/ãȵ¦ÌtsÛO_}þéŠG®°ÇߦŸ.ÞM;M;@«Õüýâñ›=JáHŸ.láÆÑh}[H˜^]€žÂ÷\=Î/î/þщâ9oÄ«ŽYÅpL\[D‘wÞr¾-|Ûë,çÉå¤-…g»#ĦûjËpÿtÒDäG£°ƒ ÏÁŽÒî(áJggÇö ¬«À´ŽmUЭ³bìDV«j ÉØÚâ¨\ã ²’Z1uY›´–ÜÞ?\_¿Ã´~ÿþáolXU×”+ ZxN %NPòÔýèIQóÌ$¼°w)­`§"è=—ølcX>Í §à™¶ÜGM´·&ìÒö…ë{;NÐeB'°­UbÖÃ`=ða£J‡F"#팪@Ÿ]¯*̷Л#þú"Ñ9¦ý(©[W=Ë<Ï›ƒŒjƒ[O^RîžÊm‚ƒÔ¤sœŸ­û~U«a²2ä\ê¦ÚN¾'œ8ØM§UqÈ×Q¢:x¹LÓ•L”ƒ´rÁm—•â¨/Df;Z@ $„’º +‘åLèYo™HÉkFj¤Lf͈BvRMÃÛ¢IÊâj5'Y‹ÕT}6t˜›!o’À²>RU6¸.Aɵ‚šT·*…›ðc×úB²WJ§HPùœxÃSF ]ôg¢¢I£XœqEi½6§Fæ¹É¬\ËZÒèiaiÃ`â àíŸ@ã\ƒæ©¬Ûk"“e9<ªÏN‰S0;‰Ôºî ‰9›«÷,±,äl„æ¼Óó­¶ÖûØ‹imV,™L5n3'*tàx"t΃²å+f¥ˆñ0œõãX¸^DÇ ó ‡—çÛÖç¤X'èuA`ýL'ÃtôB Bë†ðž/i³²`¢A!Е>·÷­ªšçðãPØ?8Ç€ç0ï9/›¯é¬ è`ëD{ öË¡rhbÏãòí¹Eñ á¹ý ‹´”\ˆ½P“zHÀãÆñ–û´L°4Q}Wä1ëþ²qSÞÝë=úwdÈjrkÏíò 9;e±]XWÍ¡—RPX¹aŸ¾]W§ ÅÎÈ”„›: ùfÏ +ÕÏæƒ0völÎ+´†ò +Šk¹¨çÕMû†uؘȅ™eÉ4LhO5EÎò‰§ºà…éƒÐúëºgh8Ô*Vv6<¤™A8}˜­Ô÷*'TtÀÞZÃœÚ'Ù‹ÙrÅŒÉ\»:L£”¶·¦ÇI'Znµ ÙDLZ£^BMoàÇ ¥ns(~Fø%-Ž>xSêèãЃ1†Þ8 4 Þ•'cˆP­Ìf4°cÁÅ!gK²¤è<Š^ä’2çBqÀsŠq$\Q†‡RŠ8…øÏíÖ!þýíÂøâ÷B€s øë²lÿ¹Ëñ­¼JÒL*nWÛf5k›¶ªÍÄ ·M9VíåÛ· ^ðh”Bºò2–¶­ßéöŽÛyR”ÅÍ°KU¥Ç¯ÓsE õš>eÚàQM¥à=ƒ[Ò“„“&äX‹žïiTŽ=€Ø)’•†^`§! +….€1ÆQ«-âµîćZBÒôáeÏܘQÜ‹â ô’¤^³…ÈZá7x¡Nø¡ÏZ»¸èà¶ouç·!LÆ aΈl0¯ ÓKÆîJÝ4è²x9¼ö«íÛÄ$ž9?–*H„Ÿ05´?“@4-/.{ö§¦×ÞÞàÿ T2u^“ÃŒZÀª>|0õƾõ+}+€h+åEèñ‹pŽâq-Kºh",ÆŽËŸ »s +\Æ­N¦:Âw³9à9˜†äœ Ìs»u¹¿ÝÑÀtýHÄa´™u5'ÀÞêˆzÀ¹¿|‡M˜sûZülÀ'ÃkÕå<ÉŸÊF¯ý7ËZéŸ\;‡‘~Xy²l.íï‘?ߎ\9Ä×åãWézøûœªÉ,k$V8ÿvDzªšyU˜ÿˆˆ7o~ o¥Ìuù¸Ï÷sŽïxˆo×9RNxO%úâ†G”V°³º¾X&‰vLyÖç/ŽÀêî ¿T‘¡(±ôû^]òKÉ\Ó´µšèVSñê÷84 á"•Q„T¢V¥†™¡Û¥Th5K9˜ù[,àhƒô¥x)€-ðãÐï4O¶$Ž$¿<ö]Æ…÷àlùœ‘9u}ž`ŸŸI0ú­Ê f¡G_CÆÇï ¿ïYéoG.O:‹©¥SŽìË©xþ¬¿ØD¼¬ƒ' Úc™0PÁ›ˆ!9sÞAÄ„ôY®Ð4O&•hkƺøuønC`¢s0O‹‹ωÍz>‡$í!­Û‘²±[@ç<òà®Û-®{Å´…ùr…ÖÏû÷ôîýÎT»ÁÝÞh<¨@.œ¦è44€PÀ[& ëGãþ‚W+†LìÃ…ÂòáÙÖGíï eê.dxÅ´æ÷²:ö.„$É—¶•T•Jjîg vÌqó¤ð#37ã(&ðˆ­yɉ‹×XcKDþnÑ ¬i›jçƇœçÑӣ mÛºÊ u›"—)4NQ9v¶¼jküsã¡%w(¶×Æ·õm¶Ùœ¥(^w-¹ uÜ2T„ÎÚ$Gýåm·Ð-ºd±2°D£—WøåºÎZ=dýWL!7€6U‹¬0ˆBec1ï‚oq=võæÈ'AWâW_óüÏGÿgòñ·S_J¤ Çv΢§ÏIôdxp3÷$z:·[‡žö·;Šž° úÿ zZªVƒ§oç8¦BtBno ßÛ ¼•Ö]œ ùÙ·x–¡Tl¯Üÿ˱$TñÈ9¬Éµ×Ÿï*·…sôù +¿,ú¿úûlÿävEäžxqûŽ#it!\:ûúún¯<÷Pá¾a{endstream endobj -5735 0 obj << -/Length 107 +5845 0 obj << +/Type /Page +/Contents 5846 0 R +/Resources 5844 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5843 0 R +>> endobj +5847 0 obj << +/D [5845 0 R /XYZ 85.039 781.388 null] +>> endobj +1682 0 obj << +/D [5845 0 R /XYZ 85.039 624.724 null] +>> endobj +5848 0 obj << +/D [5845 0 R /XYZ 85.039 589.978 null] +>> endobj +5849 0 obj << +/D [5845 0 R /XYZ 85.039 511.008 null] +>> endobj +5853 0 obj << +/D [5845 0 R /XYZ 85.039 399.625 null] +>> endobj +5854 0 obj << +/D [5845 0 R /XYZ 85.039 163.573 null] +>> endobj +5844 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F64 4112 0 R /F79 5852 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5857 0 obj << +/Length 1953 /Filter /FlateDecode >> stream -xÚ`ŸÿõõõšššÛÛÛ‹‹‹éééËËËIIIñññçççXXXÓÓÓºººíí탃ƒsss'''¤¤¤{{{ùùù«««³³³üüüiii‘‘‘•••999áááåååÿÿÿ=Œ=±endstream +xÚ­XmsÛ6þ®_¡Ñå&ÔLEÁ÷“Û¦©Û«ês”KgÜLŽa‹ŠdH(ŠÿýíbAŠ’)×7‰_†Øža<»${ðËÆ‘t=ȹ"ŠÆëíÈßÃÌë³3+2ëÉü°Í–Á˜ynìÅãåÝÁŽt})ÆËôÖùñ—Ëëå«›éLá°ØÎÂ0r~|{=eÎâ^ß\-–W‹×HùÀdÎÛkœþãf gIBW‹Ãôåï?\%\oú~ùëèÕ²‹´‹¢Š1ÌO£Û÷Þ8…%ý:ò\Gã=Œ=—ÁôvqºÒ–ÎGoFÿîLÑœ?&­¡¬H¹2Óƽ´0Æ]Áø8”ž+=ßä¥QõgUÉV]ÜþÅ„ÿS5[eºÙ”Õ{\ø˜1 !6*Uú $·Ív¥]Õʼnf“ÔŠ œ“”䫬5ɽI¶«d:“\:×€%@bÈEZg݆æ×åv« +}>+——ëDge1l¥QÕ]–Ÿº‡˜‹ñêæÃO7Wÿ+fæ?~ï`ͬUº, +ŒÕ…ÊôƒAìl•Þ”)Ë;|FxdÎFSoje‡°/pµ¶IóiCL8VS.œ}Ad‚s+Ãú¬:‰]nTŽ5:|¤(ɇ/5Üm]n2œï~8VŽB0±†ˆ´,îÐUY¡7–[íŒý +•"S¸z£«p•eÑè:™£3³ÞûÖDßýº,LàC®œ]Q“%mLW__pG—ød`˜ÆG¡Ö's1 àx s¹A­ô&khÔ€)3É”sçÞ*ï³<§ùªF>:ÜRì°ÛHlZhZí…˜ì"†¬ðÐ&f6+Tsö|ß™,7´£f¶¡"Ç\ +d™iÜ6$ŠR·özZµúj;c¹V)1òŒÄ¡Œd°&yÞÎɉ{¦*øaàJÁž¬p=åLön\¹"LšÿÈó7’Ñ“ÞZ™Gî+‡p7Žø)däô!k>ï0gn+‹c8{Ùá™…)”1G!ˆð£óÐÝ:µð$øŸQðý‰æI™Úµá(½ž¯wU3¯ªtÞHèG¨é^_ÿô\û¦ž›RFæ ‡Cì27ÅÓ€rúŒaù|»iý¹>¶Ür¾AÐî&¯†‘z9„öíù Áý_žô¥V-TœG‹f@ Ú¾§H n;^Y}ÕÞ|¸x*%ÝDð /‹{‹I@óv†äàe #ç_4†gÙYÕ*ùˆ¥O„T\0:hªspÞÌTË&ki¶>oÔŸPÊ|ÖK_A‚WôVÜݤ•®‰LÈV\H¬”*Z÷жM€0eê*°˜±•Êd–ÓŠg\x®'YÿÈeúÒ•ª‘ ûÈ ÂHÑ/qh!ßf°"ž7+é­DúÐØv)õT¢šäΧ]VãS!'HÏ]ÎÛŠjÜÃj$ +õESئDX®¦šc¨Ø»5RkŒV¥Tåͪ®4 o“8ÕPfX ¹?†ª‰žÀ>õM-ñ=î`»×а2A=4p îç¸%¤VA[e»³ ãC%â¶mj*iš’rõ<ôÝÀk³òb mø–Óο'÷xÁÛí‚¥Kh~~)ñLìqÙ°˜ïPº-ª¥©MðDG¹Ø›èµW´D¦Úã°hkµ&ze:2{V¹²í^I\º*‡¢µbÓ‚­ „&B†v`¡I€²ÜX›oŒQZ%¤—¶ÞUcÃé…òЦÀҺˉŧÇH 1h»¤móäñúÔ Îž*8—8ã÷’ÙZø˜|2Z¶%²VÚ +”Ù·:¦-1 \L=6CÌ„gwŠÎaG¼ –}†þq”Ðcbº"Ñõ2vûò¼Õ pk5A2t°JX½ ˆ_X÷_êYSÏà 3ÏsøáÅ8 ¤Û̼…Ò‘ÂJüž<ЀKû^d‡ûŒÿÛQz'ŽX@OO\0ëS ,if<ÍàÏzbç=Šùº—³‹âì¸;ùZ—fña$"ïy>»æë[øe2ò£çùµÍä7ðÊ‚Ø—ÏðzÒÏö¡}aV„)U2ƒ–HÛr‰˜a …}+-ÄÔªÅzêÖÒ;s›úˆ7ëM¦ávwІ¦‹^9 öOHß|h€©Ûî-n ¸Bvc.Ÿ[\Ï] Oøô˃ÈY˜³"è)8‹rO¸ê@îÄ× Æá7@ÿíǧ3Ÿþ›¤iÿ³Óä]V¤åÞäbIÏ/Q0±óÛ‡Þ¹ã7•|B§Êã¡5Â?þ¯ú zxÇn$âáM‘ºQÖÆ‚yâ¡8·ýðú(àÿH)´nendstream endobj -5731 0 obj << -/D [5729 0 R /XYZ 85.039 781.388 null] +5856 0 obj << +/Type /Page +/Contents 5857 0 R +/Resources 5855 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5843 0 R >> endobj -5732 0 obj << -/D [5729 0 R /XYZ 85.039 625.299 null] +5858 0 obj << +/D [5856 0 R /XYZ 85.039 781.388 null] >> endobj -5733 0 obj << -/D [5729 0 R /XYZ 85.039 625.299 null] +5859 0 obj << +/D [5856 0 R /XYZ 85.039 502.054 null] >> endobj -5734 0 obj << -/D [5729 0 R /XYZ 265.428 204.64 null] +5860 0 obj << +/D [5856 0 R /XYZ 85.039 270.305 null] >> endobj -5728 0 obj << -/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> -/XObject << /Im14 5270 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +5861 0 obj << +/D [5856 0 R /XYZ 85.039 88.449 null] >> endobj -5738 0 obj << -/Length 524 +5855 0 obj << +/Font << /F56 3226 0 R /F79 5852 0 R /F64 4112 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5864 0 obj << +/Length 1901 /Filter /FlateDecode >> stream -xÚ¥TMoÚ@½ûWìÑ>xØÙÝÙÞHR"•âœÒ"Ò ¤R(íßï¬b[½DHhçó½Ùyk’(<ÔA8 ½ËM&ÅŠ#×3ÊcJy–sQe£‰5%DõrêC`H‹êù!¿ü2žWW‹¢ÔZç (óùåý¼Àü.yç‹é¬šÎ®£e؉ùý<†¿- -¯ó*%Mg§ðøëÅ8YdñXÝdWUË´åÀ¬B¤ù–=o™˜¸íïÉ1®Ý¿#á!X×o¬ËŨ5mëý—$Ÿø»{Bã€È±zPººî\½ùššò¬¨fAöL…ÝΑÆd½:ì~°h|­B¬e3šD²mõ 1R,øÔå«wÃ0Ä÷ìþSNß;œn§·<¼î·›§ßëåèe[”ÊçÉJ2eÑï’{ÉC`¾ß¯­ÒÃøS°·vî8k‡tˆ•3nÒdD»yxጳ -ýoí: HeYdàÐÝ Y±¾ñc¯OÖ¯ -ƒ†ÀXùÁÞªÚhð: ¯‹x]Š×¥%Ë£^–r½¯iäõ1éŒð?f[kendstream +xÚ­XYsÜ6~Ÿ_1åd+œª%E$jŸd;‡R‰¢•Æqª¼zà Ë<&$GGÕþøEwƒ‡DŽG+[Ðhô…ƇÙÒÕÿØRùŽ+Â¥TÌJ-ãbá.oõÌ f8lÃbxÞ®'?øÁ’¹Nè†Ëõvã;ž/–ëä“õËõ÷W+[a±ÐYÙR*ë݇˳®‰zyu~±>¿øFž&2ëÃ%LÿvµRÂZÓùÅ0}öëÛ3 Ç]ݬ^|¿î-ímÐV…`柋O7î2Ñ.ý¼pªå½î»ÓÓÅBÛéøž0ã|q½øw/Šæ¼%­š‹Š/”ã+1 ‹ Gaa\82K黎ïz—ø°o’ú®v’¯!)YC£fÐÁ¬=Ѳ­iÍŠí*tµZX•7:A}éZçf.Fí0—'· +­(CQÒ»´¤^d´F3q¯Ó毂Ìܵª-µ4Ìj²bŸ§DjÑï½Ö\is<Xçä0ÞgyN½lk 9Ï>§9„á‘Æ&–ÚÖ»Ô°ƒ¼çšŨÞò¨ž±bi¬Jj ¤ÃÔ»m–§à<“†¦l+aðw) Þð7ÐQ¸-ÕM’ÕÝöÄm·µhË£ö=`>ú¾¥eí÷´éždŽ÷£ù§¦qe=Vb+Sð—{nIö7„#þ<²´ûFç¡Eë=ØyÍÝçC9·ƒ)ošfž Œ*ôNb²b œµ`qàZ›TKVU]äîÄ$†-Æ †D×#°«ìj×ÆÞFÒ ’!ÃH–d0Frº&¬a` eÂ0è„ýxWaö¥4Œ / ‰fè}ÈjbÐRMoÈ&mœò8½YU ‚Pbžw~뉈øn»d©’G²¤ 8°óöŸKë€&se¶•S.>±[ÓÊç<ÙºEë@ Ì7 ?!ù´}ÆSßç½æÞ×æPxö’ÿ¥'}A'µ‚å÷ ï ¯!/<×&¹Énç<ŦÔAŠÕ!î3ŽÛmDdðCÈ¢³c´Ciî`5™Jƒˆšòйµéت--ßÓ}Òõ~e°)‹wDy‚TSÿªÍ]VšÛdh%Ùv ¬ÓK×è\KÚh€Ìз®+šÂ}F¼¶„”oRŽàM:/»¼©iU`)+£´ãă¹èf +]88\Ê‹©V ÌÝ–¡r„½ˆ…œ(cnà(_½¨­ã™¨{Z¤0îÆ—¾pÉÝYUÕ~C{ÞPkçÔž¤m|ÒDÅ&:¡ª 9ù(ø*8™ÙöÒE­c3ÓI}ÿPÛMm?¬lÎ\×âÄ ê5%Ðݲ’R]Ò·|a8~LÝÁ}ÓŠSnæøÊ¿ZQ ÝgŠX@­+N™Ñ):E\:nøŠÈñ—Cç뜙áøä蟛™ ½µõã-;î-Ž˜ÇuÉx<°f}WuNãûU1þR 5 ±èÚS_ *»jùµž¢^æ+Oý5½Tkÿ?´² ô|õå?{|E%Å€f*°vXéÝÓ@ßêT–%­€h âWB´(o*"xaɨ¤ÁNà]0Ñ V}ÀѦêA´ß×]`î@º˜ŒüqhOÓ©N㶪 ðcÀþ¤]Ñ:ø}º òGä&kƒâ¬«JbÅÛ¼ÁP¨‚•þ1hç¡tt™ÿ"´xŽB{Ǿª£Ðþ’¶ÚŸ«›…v®„æöžT½ã<ûqêÌýãAÿBLíwiy( däûÎ@\ÿ¦|úòdÒaŠ?94ÿ%–Û¢ŒÒ߶Ïü™w&=RGr¾ðH=/·•1îtæÌþ®mϪҼ°?ñ9Ü‹»Ð6tÌc»æÖÕñ.kuÎê~ÍǬLª{®‹5µ*ø’Þ˨Ýu2 œðû9IíMÖ6»jC¬«¾…]Ðãðg –7ÓSõ>j#x®ý]ñÏÐiΓwU¹Ín_£dÞ9ù?¥ùþµÒá»ù"´^¥Xª¬È…. †g—}(ŠÞy0 ym¦ú2¦ +õ†JGæ9 KD¹»þyÓ¬ –yOžSd‹™˜›ûýa lʺÎ –®GÎHíLÑ?¹È!e‡Æ½ø±'5äñ{–_jh>F7æáÇPUJ'à/×ËËQL5,àxxR_PÕ#ê3]³€xŽ+ÕßÆÓ&m“'ß×úƒ5 ÒNOÅõäkœVpDtk@29ö}o~ôÛ€‡sqÓ¿dÈ«>¸ö­O áüFûœ;œu¶€ã\zÏíí>ÌN þ/¸³endstream endobj -5737 0 obj << +5863 0 obj << /Type /Page -/Contents 5738 0 R -/Resources 5736 0 R +/Contents 5864 0 R +/Resources 5862 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5694 0 R +/Parent 5843 0 R >> endobj -5293 0 obj << -/Type /XObject -/Subtype /Image -/Width 780 -/Height 546 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5743 0 R] -/Length 38179 +5865 0 obj << +/D [5863 0 R /XYZ 85.039 781.388 null] +>> endobj +5866 0 obj << +/D [5863 0 R /XYZ 85.039 571.376 null] +>> endobj +5867 0 obj << +/D [5863 0 R /XYZ 85.039 324.501 null] +>> endobj +5868 0 obj << +/D [5863 0 R /XYZ 85.039 104.725 null] +>> endobj +5862 0 obj << +/Font << /F56 3226 0 R /F79 5852 0 R /F64 4112 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5871 0 obj << +/Length 1549 /Filter /FlateDecode >> stream -xÚì]‰b²0 .¥å,g¹ûþoù§otþÓmD7  æë—4iªõ&I¨Ó%Zg!l¾¨±ž—»»ûçŸ3óaœL‡¹¢Ú´ão‰lUŠ ÚVýiÛ¶3Š0?¦ðhô¨ƒGÔLÀc8ín3»“Åa <6óaå|Ÿvß= -ªµ?fv3 -Wχ™Ý£ãÃÄââüÅî»G¸(íÀc<ŸÅ;ÞÝÑÓã°Ø/ƒÝY;=J8ŒÀÙâé³PÒ*Ù£M>IäÿÅkb:¹€…jVê––3@K³YKwXØié õ ır[,äÇXfíŒæG~Pj¶PîR°0+µy4»Ç3âyw¼ÀB9†¦ÖÍ£œ?ËŒØKÀj»ÐÝùϼ`ºÃæÓa»Ý/f. -Ëi÷f>‹ù ËÃøâÑvÏÌa 0qtØÄ >JŠÿŒ…]w¸ÉñðÚÆ ŸÈ ÿWQ™PÊÙ°p*ÙÐuņ…¿Å y’eÙö5_” Æ bû6,lò¾ó&6^ØdÃÂÆ §þÂæ:Ÿ-œsoÃÂßâF„ê60œŠ nXø[¼°Å.ca‹/ü=^söÎ&g¼°Å7^ØäŒòcù† Hd<!ùµàÏ7]íÆ ¿ b‰…Üâ#ñ}îõô¿iYÒ‡¥ë ®[úèy8ôæºûVþè5ÆÁÂ8ëO¥t…¤l‚æ FIPÓÈ{ÍGCztn»— (ýg;+d.­E ÿ6/lr]Xˆ÷‚ML_;¯t—Íä~Ì ˜Ÿ¸AôäŒ. +±ÐG͇3Èwþ,K^˜Õ5b_6Rc ˜…”Å–·Œ@J×¾ -ÊçÔ5k±…nà~:6^ø,øáb’U\N*}5±Ñ‡vJzüt?ì3ã÷‚ç`ÏÝDO1·ÚF2¨q7^øŠ¥[] ß ‹ÖKi’‚ÿ‘ÆðJ6U•^¤vvëgååüycÜ ‘™gÆ/Ùò‚íÆ77 Ù‰u]Z%å_ætÑIÀ5 ÎΟ›Ö.ž ¶ÜúIó —aý”žæ…ð TSÊQ÷5tèV'Kû¼"°[ †¼aðl‘ ŠOÉ„kPvjÆ‚4¬·ª-¬à’Ì”Lˆë·8ÌÌÚWæ3Ådhæ)Ѓ°É¸bå—³J.ðÂ, -â…:f(ŒÜÒ-c~æ½çÒ‹KØTúžÜ‘ „ ·¸<é÷X8gšŽ;¾Íú02­ÅÛŸ?7µåà¼c [BsjÞ™¯[ÂSãsHn Ñá -{„BƒnvÏÿ,/PNî“š3 -Ï~“¾Æ­éÙ‚V²6N˜INðmÜjSÓ: 8×~['ÂÏ7ºÞufC cí ÖÐÎFRFÅ91¾³K(1%H­KÒ‚©å‚²—µxlm·ì©~ÂÐ Rýױᢨïù §¶ õKvƒ q#ï ^ä6¦sÌC4Óu÷Ñ´ ±˜’¶Å³«‡~>Y&Íg -L<ÎÙ>—«=]ƒoFJ¡a´# |ŽÌww–|×bÜì/#p“?Ë Æ}úÓ;¶üî@  7¿|%€ffcw°õþ°3ñtMa¬¥è€,/”ægσ=jx+Hí|çAÙn²ê,J‘˜z¿‰(=_Ó´e×a¨)n=|ÁkO¡ ðÊW‰KþØjI/Ù^§ƒ»‹/FÃYÛvÛÂ|ÆÂ>ˆ=a!+Íæ{.ˆ<>“‹¦”K½¹MC/t{çÜóüï,jf•·W8Mñ"¬^&–¾$Q; †¡kN„Ãûì•q‡¿íÂ1P¥U5ä=xÃ`öc‘å ¾0J¡N°ÖM›ÏXB”}XµéŒp-À¯V¬Qž®jÀþÂ*Á%¤B;^Pà=`=.ØH ^‡ñäÎñb°„l´¸9XOV?cè”4Þ„…EBÇ´÷uoºþ½Át&ÓÚ œ¸DVÙåqÜ.6ðýÆæ7%7-’S,åæ…¯A€{`ŠÒy÷i¼°ëÓbÒ*ÓiOãHB : ¥`Ñ-xÊJˆP»¦ 5<êºç˜8®³iR Y@ƒ¬…"0åâs -s5úºj,” \gðà0$ âÑQpÖ•ü,Lø ;f´ ìŽÌŠ|«ü»ÀÝæÚM C¶1;nšôýhõõ}?]±œ”¼ -–_e…éL=´F=ä˜8Ë`ÁŒ‘ÇQëã|$\“ýG!—Ü=¸é²'.£Ï7^xÒÂò<:»Ó“ü³÷ö2¾âÌø €={”!ÉL|À¬ÿÀ»ðŽÑ£ý—g½;3â‘Åéí òéŽùüL#/FŒ£˜äL{PŸ¼ Ù%ZØ™NÉxÛ_½·P5m‘Ž‡bùÅq¤™B\ëUðËiá&Kã­—EûÖ,€Œ[‡í„,ý$Ë+tÙ6Žtpê(¥¿¦VXB‚WµäǾÛ_È'uŸM$Ïâ‚Œ·NÇäpørè•Ù£ŽšövN„IÜŽ½>;ÁÃ蟉•;DZ,¸wâÐ,±,ò§ø2‚·ÅÌH¾jM É< _ÔÒåøÂaf[2ò9[Ì%Wžvß“ª= -1Da~™Àb‰‚ànhé-ô§^ ÚóÂòDg¼°D«Í÷ØY~[Üy›×v â Q¼¿™\j«¯;o¡?Ï’8 NvüâKfòÐÙÇgë2r›…;Û”á,IyÓ°#»å .Ò×yá8¤½ ìm¼°Íw~€‚…ì†ãwCôVѼã6l·Ëö°yl蜬SÍã9V1y%:Roï:rò+&,мpœ<••Ûmã…à…óim‡xšu /¸Öè`ª—>ºà _à…Š‡±»›ìG¾öåQ2KGiKgþÂQì:·nP²ñÂÆ 7±@”pN°Ð,§<ƒE<9怓ÞíY³¡±É|/ì/Ãó£]D -Ƥèu,[A'¼p<ðçÞxÁüÌeoX8óÂ3,ð… t”p´ìa‡‹ø<Ö³·ªLa‹d /ìÎÍx¹ðÒ½u-f}ô£(ã /œæºúÁž*6^Øä–ÜÍG:ÂB¼iÌñ]žÝrl¨ "Ÿ­ã…™üÃ̶‹¨»Ž…Ó¸óNúAXØæ;nvÞ6‚pÒk%ËÔ¢ù gxŠ‡­â † aᘚKX/lò(/Ð{¼_µ‘vp8Œ•î³—¼›byü‚¢Oá öe^8™kñÓl¤Þ"&}÷1,œiè¸ÏÁ;ìǸœœá]¸lÉ Ð È¥A"¯ª/÷èÆ »Çmšh£ž³¯…Ñ­÷.Žîx—‹e½?%]ðü aŠi¯½ª.úò=Â’•¼pW÷˜ëŽl¼°Å®¹«kæ;ŸZÞ'ªä_-9ÌÿcÁ .MwÞµ?^9SXƾ‰Lßå…-CØ?“xåÞ= -z -ï¬ò -ºÔÿË-¾p «æ;/8 8›§œïÉ„¢Ð?ª»3µ—œóBïºA·H:Ÿm¦³5n¶†ŽiJ.ü–É ½Ñý£¦¹Ç]ÊÁÛxa-/ÜÄÂ…¹™6Õv?¼išãP±5N²è?Áy¼&“Ú!«£j}ý.#ï>/sŽ¥§ñp†Ç ±™¦’ϵ稙ð‘çÚ¤]3ûýd¦`FbM͇ÌvBrpiŸÃ¾'“Ò7^XÍ 7ƒ¶Æ?1@fÍìOëÞMÃNÉ9¦î¹9-´c8:S¸ëðïóÂQűqáµØäB}8Nx‘ÖáI¡D餪CšãZ þàsÄÐnEä×:„ª¦Ÿbá„XÇua&ƒ-¿æÎq† gC2i]7ø “u³P¦< ö&§ÑþÄ¢ò*:[OA´œ‹”÷Ó<¡ù-vÒÚx”{Ç_XÌ6²eÿöW<ºW¼öOæ…@…IGWXm$G‡m…º¶@£}S¬"M6RÙÆ£ìQC‹£ÈÑQ‹“Z›®¯’l¤]·» Èi -q¿ð|@ñ&Ó%by’Íš>MŽÂ>ÙM”°³Gx™ÏtÔX¿nÉÀs>ïX¥™Û©×%Ê“äƒçxžú ¾J™T·\ÙšA1oGk9q’ÈܬibýC&Y–™‚à/hS,eW“n“—b!™*L€3†|[¨boÉØy˜AsØÖs “}¬mœËO”óÈÆ8‡lÑùx7Q"XPN2ÕˆùHåܘmLõ”Œøˆ1o×=pÝœŠ[–%ý\,œò‚/¿íÓ[ÚšNjÊ×Åðç‘$ÁDXðuPib«P”Jˆ¾Ìl|ítÕ¦æÏ`áÎTXóÄÌùŸ{PKYî·MºÝì—ÚÉç|ð}MÆÍ~Ež]Óbþ‚–¿?É”¹±¼`ÝšùïxõwÖϵ.ñ‚gªùÊW®åS¾.V`A×$=àÇ·¼PC7!è^ƒà |ù¢ØÔü1,䦗{¯Ã̹Û,V–Š–JÅ¢ÅD5“dÑwÏ[ö%¿x¹ÜÙ(ýÉ< <\ži9;¸z‚€Ó #ß—d -ŽÇ«¦ÊI_¯•ü­¼ ¨©DÁQ(D¯‘û{^ÐU¡ H!©ÁRW¶Z—î&^ˆÚxbé"™ºƒýw>·xÀhYð‚©þx¿DÂè—võ³–?þRÏ–Fšf>øG!/•'rfÊ<ºû‰~ùL¶µ2–‡‹vK÷ `ô¸K,HÝGîtñ‰Ò³xºŒÏu ÏyAdš BÒÒƒ(Ò>¡ö]Ühå8HE›F•f°]LvéP˜U t¤ˆ#ŽBuLmcª— žãõMvÒ*§2‘Èãž×_àœšUj¹‡ÎK­Ò±ïåñœ·Lš9÷zvù×ÉÆéLË­gW™/Þ™± f¼Tn&“}?²TÉ–Ê<[v*”À;¹ý35Hû©ØµãÈ›;³lªFTv?NýÚæµ]ÆÂñúοAøõÉ¡?D^›tŒÞâÎkxaÃÂGòÂ×¾³T¦6^x·H·Æup,÷;òTI¶)ÿ)Bº ßte­JÝ¿Âäÿ^GŽ×oºþ½€lXø.,ø:lqÐ- }&¥£ìòÅuç/Hy|»/‘•òäö”ħ·§Ä2õãÅí) 7þ¬ ¸aáû°ÀÁ$]Ü.ŠjÅmQö>?¨Ãm¾?'íµÛÅûÙÆýFÔã÷öìåêvN¯Æü£> NѵÞ4r=K¾¸Í¢ 2?˦ÛN¨•ý«ýÝ=·/èaÿévYØ©Ðév¾ß­Èù·ù¾³QŽ»Wã8ÝODöóÝ ²÷ýسŠ˜çû{oöê{trG'÷+Ò7-Û°ðÑXè;ðΪû¹ÑN^û™ãg°xÿ.,„)â?|Lõÿxf5ÆAþ›±=³F‰/ß…ä‡aHò'(¾¡žê§ÅÚ^Œ…gxÁ¤¦ü²øÂÏ—o‰/ün,<Ë jçÙH¯Îö«yá,´/üI^/l¼°ñ‚¦CUá_…ø^Hâ(ò7,ü-^¸Gq<êÌÎÈ›y'~¦û8fšÅq¯ß,MÃc?×(Ž©Ù]j:ínßœw‡×~ä½ Ñ_Øxá«’S -jiÔ¶µND —‚Û¶×nkHÚÀxƒÖ í¦mËAï`wÏ잉VdûÝSct ?ÈFÚ°°ñÂR¸R `!H@íqÒƤOÐø¶Ô ¨}E™Ó*”Ô¤l[w¿»@fw/”੶c+ë|€´aaã…¥ø Ã(¸Dnã³¾l¢Qú‹$oOzAÊÞmb9ÆiÙÏ[æÝaKÙÌo²°±¯ÝšˆxÃÂ&Ë ç¡wn¨êJJ©%¥¬áß8²ùõüoÿæô¯ß¿ivŸßÜ홓¸oÁÂþB¤©»aáoñÂÍX[vžI÷¼0ßqüw`Aý‚øBþ)C}ù·›)Ãú¿Çnå`°ñ¥"Wþ `#}Z|ÁuuÑÙ™_5<¤‘öœÔr·ièc@¦Âpz|Æ ô±v‡ÓÕæfÝÙ\³Ÿ“l‚ýç?˜wáz¼Üì6ßÅ ôzÜ™;Ä¥¯„ÂÚr#Ÿ€…Ïâ)¸m94Ô] Îœ2¿šÛbݨÛâ?ô¸rôZ¤ ]'?NZiVÍx«s]IHðôcâÂõx¹Ùè»xázÜÙøÎô•6R×…?Å_ø0^( -ejÆŽ -uUëX˜:W‰#°N¿_غÌÖ â Qñ1µ-M5±d®”ó(f:GÔ‡Ý^šæ’\¢ÜD‹ŒÚyQ§ÊòBì`tÅÁÀ ,$UKb£šðDç'Ó#±ãØT-1)”£œŒôâÏ·¿ ‰á…D„UÀf^ :Å}§m$‹í¸ÐÏ"3”ìOuCUÔ;3qìT‡`ÁßBÑ -0±ÅmkÛÿ ŠÔd‡…Â|µ“˜ýAïpf愶¿Bj´Û‹…j2ëg,¸¦˜{h¿k•ÀûâÖì'EWMôX‹¶Ê be­Z8Ÿu˜sVðBawv©µì÷í¼`|çìqSˆöŒÉ‘±^;,Ę¯ä…|ÃÂÑGÔ`AwÉö¼ý‡/b!u*“Df»òÌôèý¾Fx-ÀÚ¯¨,»D§<‹í€þ…86-À'Ÿ°Šî*=cÁˆ()º|‡°®L µ¡ˆ‚;ƒ5r[Á„‡:Ã$a’YËÌ3׌ZV•të+¯wsø 3£T½áà Ä,Çæ1s1 ‰ÞÎ ¡jkúÄh‘3ÔewSÊç|ç×Îñ~ÊFÊ‘ç¡Á‚±Ñ ¢vÐc;c!É <Å…nTÚ4Mjó[2UôÚk,ˆ0SÈUqè€cŒí·*Ÿmª•ˆcpX‡Öåð)‹…XEœTa¡|Zø`i!Uð¼kcSa§'Æé0ÇÏX@@^þBŒAϱ7(VƒÉ%ìjh¼Ьϫ))³nk^¬WT(öåe -sU{©ê{UÙáh»nSîtà*Àe£Ý" ÿ=¾PuÝ•ù 9EûΉŽcÀÁ(U!³¥`f”Ê•6ÒÛy~Ô|焸:©\u¾–&ÖVj^ä:í¨.]0â‰ãRÏ¡ÐZÐ"Ð L̈R]¯é7cqÒ:ÍEå˜*R‘é¸Ðå@_NŠ4Žà¨Ð£S2A&è–“úç²ö›)îħÀíÂö¢ÄUäOËJte­K΄t­UrÖäʼc[ŒÝg†wy¸®Ú2±6,*ó -ÁEßñÞ[çµ%» ,RˆR3‚ùÈM#t€‰²•¼ðXø ø‚ë¬þFò\÷Æ¢A-×óÒUG?¯}e†’ÌcWè£õ²|Þ#ßg[,³?.%`LÇ,žæ6iÂíNÏ&ÖœN1=äóC¾k"?´tØþué7Ån¬ï<µÿ(hCF™aœD¢˜a¥Ú1ƒ\[ÂøżðŒôaqçýPÊI•cíªðVÀb2Á»á¿¡÷ì»Ã·/vŽ÷xsÜùQß™º¢§ÉPPpê6à®[ö{^ˆý•¼ðþq¤OËGòHùñSc”ÐèÆ—ÌÁàÿ¯ FgHäá‡/vöùÿ±â…g° =ð‰Ü¶–¤¤H¥‰ÍÜ>øÎïðüg°°ÕGú@ùß¼@qQ¤—±Àâ2”gZåœcE„ƒäsãH¯åõDM}³¤#Ú°ðaXxkÜùaßYzñˆhWSÆ#_!IrŒ½•Xx­ïüìúþ/ÜB‚ôÐÃXàªæ©Ÿ[2ö!qgµaaã…/ -oŸˆµÉ¨#]$¯ä#%+±°ñÂ&Å ÏÍ_`1z9OU­ÍSÝxa“7ðBÇQxeî?®Väæ)>¥×Âpë}ç·ó‚)ÅŸ’îÚâ-›¼A̺<ÿ 7×ñ\á;3¿>-Yé^>Š…kçµ}/Lñ…VmòAÒ:o‹/äÉx/IÊ,m½Ý -T’§7Fy<’´rú‚®__x &î–›|”øú¿ó•¸3'êÎO)½±i‘dÈëÙˆìâk½ ëy£Yï¡%äJÿÜ<µYèKØâÎ Ð"…hª”(³® uJž•B©B.ê#ÿXPÏò¦ D¨îÊÜÿîNMÖ‹V–*Å]eÔ¿¯ºÎÊS5 -ž‰õqçú¥ BMÒ¶¯DEmAE“w]Ru£ŠÖ#W•QÜul?¦jÓÔWñÂÛ±°É&a OÒR!G™#i28PÐUHÅld€ÞÇ‹`ÛJ5/ŒÛ/¹É×Ä뜛68%MjàBeŸú”‹Î‘xœ®BŒÅ‡´¤«}ç6ù(¹ë;ÓAX!j#–¶1c][S -fž':¤ŠÑWéN2¬†uñ…6ù0 Û¶¾=ŽäuJTÂŒ# °‘/T´ï”r„PU/‹;S¼À2ù28øOå`PJ³w|é9ãØ—›ö½Ã%¸>÷?ó|ï^îQÈGÔKÊ}ϺÈ&mã a(YO‘Ïsÿcµf.Ûš¡ý–¼Füwm… ôè×"”"ïø=§m×ÎyÚäµÂÚ/ÍýŸ ]˜ŠH»ú`‹7Žó¶{ÄVtö£2Ê°rôõ¾Ï3µFíãß_HD!=ÑlŠù±qçË>-‹Üð•E$Wš=…Q^ñ*+¡xYo‹;'ïŠomò^x~¾³<É8ºµ]zi€V¢³^õù¸‚óðaoä…ŠûÊÝó]¼\óïaõ·Ë‰¡¾GçlãÖ¬‘û*Z³øîÏá…Áü ñ¦˜ïðÓºvŸ´‘$¸(è­$WìQ,01U¹}‘Ǽ÷xÑù$ôÿ_½”ÛgÎÈ “M1?MîøΩ¢2IiƦ9=t””íÖö¤’9îöñÏÖnbA_ø!êŸ6*c*UoòY’y¡wÛw–]ÚÔYïا¾;ÊÞE¨‰0ö%óqQ£dÀîašèêé0 -w膅M¾&áݹÿ’#±A¸SÒ3$<Þ«“ºt:éy觞÷ï_%LoX¸)#zI3YrÇø3÷,û‘XX9Ž„„Ÿ°Ú`A"âym™$ŽOú¨_Ž#±x‹!}(¾‘sÂÒ $Y¼f¾Xµ÷òz÷,ð Ón^räC]‚Òuã˾sŸâxÍ„gÑË1ËkƒàÅMY)2ð'×_øû°¨ü3±ÀÕn>Tç,éV¯¹n´÷£K“‹ÎT Fœ(y#¾°®nžÅ ½ZŒ¬Ÿ°Ô”&ê 2 -þS°ðÎymcE¼6Ky)v™Æmë›Èý8w®±ÏQŠSiÖø`:„7rÍ㛈fî¸: -õô‡Â¸NØ·æ:+ú6ëΆ..A¹Q]ªeM?#œÓ¬1\AXðëˆ7ð*ÄD ²1”ƒ NXCr»`*y5ö£Oʼº_X· A™»™¹ ¼m²ÑIKGjÞÓŠÌrýc°ðÆùÎäQBòZ"¤ªŽ'uש(]…uÑ)RCŒ•§:®HÒ´Aâ -·X7­c­©x¤pt¦:³´xÑ©'ê¨h= -ͦ*ÒN[Ǥ†ýpÜ‘„Ãa&ÝØWAï–ª)UZRðkÒ6‘(u!"óS¢ˆ¢k•¢›±ÐºRµ«hGNË/pÕ¦+j…ÑTu!"À_Ž ="¢Ãñú…}Ÿœ€!Šgw&~ª•!ú-¼€L0±è<³`ll$¦€J•›…¤ú 1Ë&"ÔYœsEµY'R¬™Í%,2›ªˆ]ÁäÚ+íj%´íÚif•ŸPQ³N'‘7«oÝöqíp£Ò3Ö/¨¹0¯ˆŽ§ÃèdÎÌ¢å)9`îæug–‡k½ŸÁ kë汸n“^šzþÈUÙH2/¨Ýãü 0¦Nã©ŽÉH}üÖÄL=×ÌðkxÁ,ÙÙ¬k  HÁ í¢Ðfmg=âέ ë–F§©"¼ã5sº˜…ණj¯èHSãx”"s£&a':§kS»>¨ùÖ‰"ižLÓv­bx!2Ïåì/sî‹Ûuj…ª1 ŒfÂ5?ÿ0,\áϹ3÷ÿP:ÏL•&¸ÆB&ó«“¢âÎÐf}ð¦ÓS,´åÍ$Î-—ÑpMýž_$˜<3C#%yÖDP®zn–"„˜•a¹¨Ÿ”: kG à… l“2Š²tÎI7XÐEêøCEBÛ[Ç¢B5aÁ‰“Úu˜;'.£Úžè$Ïb,:j´Ÿ¢ Å 3/,$\V`žás,˜U -ÇÂBn´ôšÿøêÎ’;!»æd;ŽÿŠ÷„XYûTúŽSéÏñ(/ “³Ò&¨è)䵈‚Í®ka—\6Ý¿×ƨ£Ð džB ïÄà:ÌXHUfF~D™NÑ`ÁpCØF™5|: >ˆ±žŒfK'Üa¡îŒÏÀÌþ¸ã`.‰Á¬¨kZ·?”0,™Å²:qŠÀ`?åMIžHÙîo#ò—Œ'¼@ŸËjýT,ääq,ˆt Œ‰.èH.•“DªÆ*ÐÆF—7蔫‰ãÂ>½rFpZSp¬w¼`Ü =¶ ¦žV,wUÚ8­›@³•¯»-jkO8.!t‡®ªÀ)°1B;©ÅTßSƒ ©Q§ È8NYˆs,0ââ£ü…[_q±¦¶ð™Æß°¥^ƒ…_Î ¹xÜ_ðˬx5‘«,™ö´Ó3_ʱ÷4š’š£Fnêv]²±òéÜL-åö¦”xà±mÖ©ÃƳC·MœiêÏu_6~nâj4îÃy9JH›óê°´!½,Ja8sGÁùà—ä‡ôaN³Ð¿ ù$yf½¶Û« w÷m¤„Q³Šj"¯nëx!“ÙÔýý¼à}Íêö¯”Ößódµã”ˆ Ǭ%ýY_}ž_Ѻð™µHn­ävÉw>å"G‰¡ÐˆUÑ/ðÊ©°6ÕŠg°`×kû)¼€œ¯]*¾œƒÁæf‹Õ -žT04Ꜯû(‰:˜tW¼…£5ª¾:Ý“Åât-’s,t»Ôä® «EöVðÂ(Rp+-Rí;ãX0cªoŠ/<Î :ÿZ3¡7›} õÇ.„²Ï -¾Þˆ/ç`ô|7ÁÿYéûÓÀó(AfäC×*ðÀÐä!Ïžâ…ÈÌ€¨:MHÙç…œçcáMñ…Çya“aázÜytSŸŠ§’‚3ö,œÏ_8ÂLëØÑ ­ÓûJ]ò­Vð‚kà;ÝW¢­|±Æm,¼/î¼aá]ÂnÇ›–mS¯IÛv!} ’˜ßÁBfªÒƒC÷Z:N.å¥%VðBlþœ./iî WËKžøÇò|+l!ôÖí?ËÍhåÿ‘äúí?I>ßô8UÚ¿·Y¦ŒÞÊhæ&Àžªòž6”Øß¹/dÐ¥Qbg™›ª?ÆêÂ,˜Â%ŽU0)Wa! Òô7,]7XŸ!-Z?†¨‹eW€œPOXp˜SC1 hÙXUŽk÷¨vy0 !E1T‘öïõ@<ÙURqØh%<ÚU °HìeW\Áñ s“¥¿ÃwfaW…±@ÛÆø I¥ÀAµ® -£½µ“›µš’!Wæþûm‚ï ®²[E¯vCâ·Ø56“êÅšk×Ç‘ -ÕàÖ~(Jb¸ 2åw†œÇ´V¤¬”÷ç°ÀUƒœÖ÷ák*+9]FÖÊñ£Z€Y*›ejºŠºµµ¾Ì8CѺ’ ’䢲™©{g`H:ÀÜ8oÀ Êc¤ ð[™j’u ¾¦ÔQ:h?ǻʒ+þ*]WCÒ¤°ª{±ˆ[qg¿«J7Ñv -Ó¡š™º"ðW9M¢eíTQ¾b)q»"ž³esyš˜2Ñð¾Ó^zì |Ý8RÇ‘ÿ[ÀwU -xêtÝ]QÕuÍÚ'1ú+Ûñ`xÎjâé¼°›}OB±ÓU½Ž§(|-œÁ1*á ©Î;l -¤S`ûÌá?ç{bDˆ+ãHyÒ÷+“+Ü·ž¼Ï ñ,<$ß‘ôKâ “‰Íecò£øN>§Åï;™ËQòÝÐJ~R1%Éöÿ3ðí«ü4‚Tv?É=þêú vÁþ˜w?FèW`á[ò‘~G|a¢U»â¿êd¦®”PÊè}Q7âÎ}½f]Ë i\´Þ½}Ï×_Øxá›l¤.ý¯«ä&W*,±û“’ó^w¦±™ÿ)îñ‚ä©‹6^øSòkòTõ9=r[÷î>·s¶sSè`÷ü(‘Ðä˜Pnó4C/ýÐÌñûŸZ+l“· #Åq^Fo†Bo]ž*Û˜Ž_Â%¾Ø­gû¼óœgT8ØQˆ*5T*4Ë] mšsê?à/ .=݉±Gˆ«WE×â<ܯ°aa“ÿŠ¶Æ_¸S+ ¥Œ¥ˆšœ³†K Ñ<3ŽDÉ J”Éð3 G†Ç‘n”âßä· -ŸH/ÿê,~ÄFú¢ï<›efÍÉ(³K²ŠñÊôÄUë/ØU:‡Ú&âëÎIÄué6íø[bâ _žûÏü¼ y܉/øª -be­Å‚4Kì¼ZüšøB#Hí‘ÐW£ —¦énñ…MNzâëkÚfÜ_9¦º - +jÎ"ר-3½êÌœž_Ü -^ð7ªžQ˜ ŒË0ü¸ó&ëy\Ÿû¿Î_«°Ðó>»…¨ÅA×™u -ÌÆÊ}Â_`bÐÈ) -€ j\çI/lrÎ 7Ö_ ¯ãp*îÖÙæn‰üƒ-ð…­+ÞœvGHNoš×°ç…¹<ùÃX8å…èJ3·Zß°°ÉzñÍâ##«Z²ºUqæ«g½h+6v-éiÑ*–à$aÛt$m'íî n•O9ìž ³{¯y涧sÿ–ýäëÒšÃ:q.ßí-üeXxc|Á©tv_’{·ïÜÜrûw_’å³ãÃôíšq““/ïGåà´ýûòÿšXÛkå¯óÂVÄì=rc-’?…÷òÂ&ï ý<,ŒmúJ,<3¯-ª®Ø°ð·$Aê?mÅJ™½ò²6)gÃÂ&›lXØd“¥t[a¦M6Ù°°ÉÇIN¥þ–Ðι¶váŸþZ”jɆ…¿%챶„>%'Ë°åÙsÍÜúÔÙã ÕV€ã=òšùÎÏþêJ‰gn'k>Õ†Rø&/¼/î\m¼ðyt<|Xxq¶ŽgýD3!¹¹ÖùÆ /|/þïúηåæ0þ;×åÙ°ð&É‚4-ó……õë;?…œsîmXØdã…·Ê°aaÃÂñ†…M> &™¬¶äZ†ÞZ^ ÌNÉ®äæ}, -²iƆ+ÜQCißQ$þ -/DBU¨K¢¾aa“û’Deé’ï,UJË6ЄX¡çy!>­[?T^^tc!º·Í_Ø°ð&1ñ…S˜F]ªIåiš'4Ëžã…®2#£1o1Khžegaæ›X`oSÝ°ð&±ñ…Oâ…Ætâ8Õ¾hEª±RNò/ ¤G"]*°µ"ÎÂÌwã *‹roò?¾Úû¼@>‘PÎS¡(>³àVòÂ`4:¢(ó !ý(âaÁÐeAŽj|×]µo9íï¿;ã -^ø$,HU³²uá_«@¶Ú_`à/ÄÊÓ\°GýË Duóí÷N´ï8í¯¿Ã÷Úßáõa¼J¬:ÒèZ9¢Ê¾0ŽÔ(á¨XwÊQéã¾sç8q(û~É Á6y½$u{§@dnr ?iL•Iž;@’£ü ñ…8Ö S¡ÎG.ŸŒ/‡ÉñÛ%)Äø†ÓþzÉð=^ø¸øBßâ°P·®z/”Ê ;çã­ÂÂ[~3ÑoXø/X@? ÚªáfEÊ•qg·ªŠ[úL,H–`!)Ûаñ -ù¶|¤w`soPaè£My¿ŸLuØÁBvjÑdÉS¼pzXžåb!G oÀ«Z+ÂÛˆáÛy9DT2Ž4œ„ÃrÇ}Šºàd€ôâÀòý¹<ïÀB¨,jº)ï·óÂ'ÅN3€rÿ¹|$r2†šøÉsñ…7ØH´°´€6Zø~^Ÿw. ×—.¢$)᪙+ ¹_`/Ò¡¡kx¥El°8ÔÔeZ÷eæg:q‹E¸(“µqç·øÎÈC³ÑÂæ¬p×bª«ZW5€CPÒèTð‡`âä+x¡˜´.UQ©8¥Öõ“^ð¾È84/ÒOæ…‘b8óæ-¼Å_ø ^0 D' -Û:Y\$1ÉLBq³\\.ô¨‚û¼fvL¼US^…?!Œ+®‘o’Wùœ þ‘þCOÚb£…wðBEeüþ<ÕØ`ü"ºÎQa"|T–¸¡²–QÑv]×÷y›ù‘NãµN×E‘B±È2BKË}™0ÍÏ»ßGêû~|O¬bå±Muÿn|Áb¡,QÅRw¸­ž±èA˜·ù}^(vXàp™¦¨€&,äRØæÇŽ;3oPxO|á3°0ªXçðÒ¸Ï Sí À®4x]Pådˆîó‚6UU>VƒÜ ¹2éæšò6ÒˆÚ5M£x¦”¯z ÑÏÇÂÏ™ï,³qÔ’Ùü ÛÅ›~L¡oÏP‚’u¼ÀúPã -]‚”.rSâëRíÜ>ß•² Víƒæh°‡õÍÔONï#¼Pk•dží÷Ó©ûfÖ3©Cº<Ù„F|m(g…ÓQ`4Q̇€6^xÃ8Ò ©íîy§pöè8’Él2s^‚WÃUÙcãH§X`amYá$ƒÌúÀ*-{˜NµŠY*h\»O?QÀñ.,6×Ð\óvX8ÛÌb;¼°îüà ÈGa!›°Pï4)÷ÑøBØ’ªSø ©Î¡¥>žx!¡k±ð0ä ,ô¶oMÏôÐjˆÛ_å3†jOa£Òvå鉉/{«ìå£X˜NØ4§1jf¹f˜`›Ù´ÜoM¼@ÙÓ®ðÓ;Œ~Nu›5ãHDtÉçñBmÿsã1ü(/Ô -c\ÁG·sØdë÷“¿PWÄcªsä 9׳ÑXñ%¶jû%^YšîM 4™H' ±&-á\W¼ç«X [¯qNȇϓñIìÜF»y ›JŽF¶‡!ËÆ´>ö¨_4Ó{Qcw=F²{±>nÀ¿ú`õŠ/,y·\g™NÕü´Û¿Ë ‰üŸ©J_¾Ocå™IÑ“qçÉ[¸Eb¨›»vË—xa¤AmÉà*/€±/ÇÂhCÁþ8)yИ˜´ L7î2œ-eØ4»hxOh0¦``ÿàÉîk`¨œš¿€T^†°[Ò°±çp?#XýãΆ2¥ˆéNtªÈä_ØpZª$QBà YÕ:¤-žŒ;Oê\Š‘^ùsŽÃ×xºõŽ &µ‚ÓZ’È7#¬ã£6²}kŒ»iz;?¼%šŠ§¨DíZOHzÅ"â‡'¾’Ðë׋°y¹÷¥¬c“ú|›¤éÆ Ob! ™ÉžàF5Øãg]îò‚7ÅåXÌxǾÍý&àÏæ#±øj—kRIÙñ… 6’Ýi²‘¤‘5åI:Þ”xú(&¿?MÙ>PÒœ¼Ù¾ô$ïÃÓÊÉv“²LO’H8[`¡‰ƒ9‚ø!÷–ôl>’f:`!ºh³œ)ÝWx<ã`ç;Ïê ú룞­´·¯a”6XœPz¶»nÒ´ Lì{—H2}k î¶M±E¸ À¼§ ’[¸Ê~Š6µI¢b/ÍüÉ'^À¶©à²iù‘¼@ÁÚs·ù gáxÊ=ØHÆo¼>²¿ îª1Õ9”6Ѥãõã<\Ä‚™51õßÍ.cÜB®v9yþ;ï§P—f¤Šßñ 9ˆsϼjJsÞÛ ´—[Çfvâöó9&^HMŒÞmpšö?Ä_xo|¿‘ºõñ…Þ=tÙÿ‡äIÛq(ölÈuÝ4%ïÍ´ž5Xˆ—ë§È…s‡>Ÿ,$»×nÑî¼hoš5å<ˆI{ v“”4ZŽ©Nµ1¡ÇiçxÁœS ÄœŠýá½X¸xX09Á7SÎÍj5$šúè~|!/Ä‹\ Æ̤E†É Ò…›6eö7Çêç|¤4ŠÊÃÍM§ Ât7¢Ê"Ó½§‡„ØÙ›8¸ìøàó¥‚Ïñ…Ý0mc¾‘ý”œ¨¦Ï>c! ÍõÊO‰Î}8/`ò”tÇø¦ÝsÍ4ë±ÐB¯â…Ô?Ê ›3ï}¨™¿ÐÍB¨±{X°ù¯Í|Û;ÉÍnI¢"=Évµ¼ÆºÈv(÷@R‚…4Ó°ÑQÜyÊ—Z6#mc -FÎòò³bÔÎ .,Ó€ò‚{’YmÇišòÈÔçAz4äc&ó\w®Ï_€æw<`¦E€[¼°àå”ïáËEFÓî$ÒÌ=ÊGšÒ:š¥#ÀÌð€¿“,ò±¼”åûêæ}®d•Ó ÇXx-/\žqsìe2‰Â¨ÆM³@C9ʇ°Š#oq5• qsºà…)Õ·›}½¨pÄ vÇô¨²Dû!a‹…Ø|Ð/|®Åf,ã+yáLiÓ::p_…±‹Ó=ÀëÎu,,¤6œlì$û -GáÉ<êq—rÎl‘ ßúÖ–L}j¢iB4—ÞXò‚ô&—Gö 9ÄÊ'^(<ùÃxá­ñ…ÆÂQÜÙŽ#5zá8’ÑÙ½˜$7â]c£´ž•Íì=L“rú¸\ÌŠâ~ïÕ¡?IdѺáy³¦š÷ã(2³¬§WkÐÈiÀlº:7÷D^ÌS§#÷ys§ð`¼ÇB6^ø}¼0ö+ÇTùªym`úì}Ü&önV|1£M½¿‹‹™à2ÿB<S•¬Ÿ u$OyÇ™5š -L¼`qÍÁºªë(Ü-yaú î -»ó ÷itã…ŸÈ SÜù,oô±ËI«o`á|^ÛNn$=fªu;õ ‚#Qlž(z/—}¹tAÜÙFÚE¥›eõ °–8»À þU7=ÚcÁ•ãOã‡jÃÂÙ.p}’ty`„…Qˆ&CÆÂyªkƒ•×ò‘ŽÔÕË;¯ÏYJgõ_.baœæœ$AH^§å\`câ–úÀ „±MÁ8ŒAÍçˆâi’ß¹Ô&ñ±X¸_ÈA>LCÿ…åÑÓ–“<Õ‹æ²7vSö-wÏWi¦ÈÔJ,0ߌ{6ç¡=ZÎÉ×ÆFJ/ÛHËvçèu¬;æ¥s¸"-°I±í{÷ç¬?½šSî–¼0OçˆâsñäÏå…O[æe££Âý:zk4—ºp[ùkÊÄ™Ò9Ó”žáe9&» Sÿ‰vIý2¸•ßù8‰ñé›EdÍ¢»±ï!ã‡,â g£WÁ"Þ~4Ž4Ū{v.ûøÂOä…”á•XHDðe,ÌÚy©®ŠÍiØ»íišó‘ÿt¡¥«xÁìîªÏý±ɵ1Õ“Ü<æ/K -ì^7 ·0XÕg^»â«°™Ç³óÊ‹ãH§ŽÛù8/üb^˜Ô›ô,ê;;±õ"OáSt¬{u»‹é¥'Wïü–˃•—s¶§y ·;«bvÔ9¾`†ZÑ‚¢ý8é1/ظZz²ÚhzÓ|ÎŸÊ ¹)M¾ñÂÙQqùË:Qºt--øtaƒLã+gê(Óå Ѿ³-œajÒäÀ혿0©ú¾n^oF‰ÒF^ª™¨†ñ’üäìIï(î<ý±OŽ‹Úå?Ø_`êóâ À §õT¥·K½<±¦âœ-:ôÓ(Ó”îéîÒ\W`¹aéI*Þä÷^«ize.Ïb$v0^z4P§¸@]»åѽͼ`>êIæ÷‘Ÿîšá©‚³ŸË 6¾o¼p3¾°÷¦Äÿý{óô³E-»ô´¢°î4ï7uÙj,ì:óÀ“ˆ¦É™×ò|®Îk›F„¬eµ3nŸ+<Äw±Bvâèø ,Ðå.Àºïe?Ø_øĸóò‚ šÒ}\·Óøžáä[.Œ™ÙUmšÈ³ó ëy4ŸDr5vÈkÒÒœm*3N ]-u} 3-Y5"軙ɒMspv}ÿd›3’w‘ëyR‚µ‘š~+š¦+î”7b(Î÷£y!Ùxá/˜ýfžgù!ç~ì -m/—`˜'ħØÍÄ„hšö»ƒZƒ…yjŒ™ÅS—vŠƒñwõ*×ca¤‹ðóœ=‘†v ªÝt9?2ù‚4öFFå<%nöáç³ ŽK“2N55qäõŒàñ¢–ÚÆ ¿‹ˆÎqÍùô˦1«¹5Í…5丫ѤvbÂ.×í0(´ ‹“™à0´³oµ¸ÆdMã[`ÜØv± ”E©É÷ ps8l.–ŒÍ츹¨þ.@ÔÔî²$ñ:,˜vuÝŸ Ç7ÖšºQ7oŠ*LƸéòø¬_Ä -–ßÔå¡ÚŸ³Æ瑦ã²b@û™H3~\žêw^»v¡-›XÛI©y2­:Ú©‰üãr¼Ð37ÁŠµAXï—®mb>[|;i¼7óFÓK „ff§YxÔÎ5s›Órˆà›ÀÖ]1š1.§É@pʦ —Îxi?UíîÑZ6ó®iSòåZ]ApJìÆ ?˜¦Ìi„¢iŠrxmÎÙÉ‹'‡Á7køœìÕÛ›ïÿzf -¾¥Í\é÷ŽvÙìÖ‰¯=šu¸÷l]a×$Z^mmaSÉ“bKÈ3ÁåþuÑ{¥ù”ƃ^îjÜxáwð‚]ºëòZç£)³nfܪß%GF/ÏLfß…ƒ)ênZU=ïV…ÉåI¥„ [”ƒ— -É_<å´|úÉ®>å'.±~Ÿ2p}Ê|ã…óq$å\ÁÂ&?R¶øÂËâ ›ü|,Üá¹ÅVÅ7Ùxá-¼@^‰ån¼°ÉOå…È}¥”ò6Yà ´êœb›û† ·iÊß6Îã=Sù°ñø¥üâp/†å¥Q®uï=y?8¾ð)òÛ± G¿Ÿ—"4&ü0GL˜!ys¼â©Å8¡½þ4Ê`ç‘É/DŸP_lÏt|áOcÒŒÒï9/Å­Z3%!«Û(ÇŽô1¡‘P9’++…Í_uúxë%‘®:Vréa„ÈÙt£±:+=%¥SÓç~¼&+æ™K/ü8,Dõñ<ËÿH œ„´k+SzÌ,ðXÑS-(M[1†Êd²Fv]) -MY?JjV…ÎŒn±Ì>˜wMSÔ¾œ72Ê2*i©z^ÂA°IÎ{dA;Ž¥'Í+6ïÛx7Ú6™„#ÍIJ0Ý5m"—æÜ©í(æ³ÛÍ4³ÍÍç`µe¶?)\H,¦Ù/ü0,ȱk•jŸìì¸ë"“QœÑR(Wcèè:6²Š1c63+[â!¨YêE>JÐM¿¨)ûiÎl¨†r”Ql6²8r«e®@ÜE”×ð‚õÍ0#êÚº/9ëÓ -ûL–QZ¥½„ ]S¥¬äQ<¾i·jÎæ¦1§Q)¥çJî–æŒÅEL Kwa÷Á53Lª"¤AÛ…”ch˜†e4„Y5Ðu¼ ÏC[Íù³¯¥tÝè-X ëç.ñ?Ÿª'%eNGJ«J¸À €…F æu5ð‚ðù¼6 Z;¥‘ðU m“øÊ)Ä@1ˆDD]ë&UÛ -çEë`Ò/ȦEž ƒê(ìݵ¸'mD™TjpTLÕU-f¬kbPsp¬H%„G+U8­Å«ìŠ‡²˜ŒQK0} ¡¬éC›–Ø1×Y% -Gy)Nj.¯TŠDI líºøÂÛÆTNŽ¯7÷žk¥ÿÀø(h¥ǪÁÿCò­þU˜0.ü ‚ƒòà"#o­¿`×eÖ%éé€3Sp4%²+’Üoc†¦zõ¨))’®JrWEë垊"1m‰Ìy Œ¢ó$‘ˆ|Á“¬£C˜†íˆøÚõI·~îµ~ØúzTæK`¿dļp€ ˆŒÚ0—ã–kî›™¯`tÅÕH'•–\’•ØH¹ãP¸‚8‚#38?~^›'WßÏÖk{®™âã À Cßú ¼:âIà®xàôÊ`aäbÄ8sÜÀø ~ÒÛõkU‘‹ P*Ç¥Òú ÇSn^äáÎi ¿Û(.À'`95FiÝ9ÊOõ"® xeËŠÒ4œŒY#ØÐ%‘B )¿n{¸2ó%d€Tøš>ñtñIáxB‘š¡Î!Ûš´ysz8B€yäµ.#Â\^)¸|ÆÛˆ}~Ü™TÈãÞƒwtú™X›>ÑŒGªOäð@ÒïÀB¤@@UIZÕRͼÐGÄ(56¢sMHiúh°£J1JƒN¸*ÌlÐp^Ô3TG¤È»†ÛxÃŒ1‚¦,È9G¡©BÈba,xh…)ãÊ'M ‹@ŒÅ‚”YALá&MÒc æX_TUd°€Á1ðBÖ¤zÀ‚èÌì% eFÅÚ’~>/<»Ö9:óë×w~_ÜyÄAß±Œh°o°`A¼=/ cûç ûÉx²ëük|mÒ%fðµ+rÍ;OzÈ:áŠé^ I×eæИ0Ê·¼Ðc1æ¡S*V`¡í{…"LhGä„䘱«Â?ÁðØ6~Ñð‡< ž÷$„æ…Á×HÕi‘h€R’eIÓÂQ­§%!}k*ðØyG¨F/…ÁÂÁFºÃ o­ö,N×wþXèx•ïÀ‚¤Ð“ÊïqM ‡“¡þ ð¢]çµñ[e£Çt­à÷i‡¡-Áwî°pÆ^Õ¶Æ|[ÕN[Ѫ­Š65¾s-†¬´6¸±µ<á¤"2n;|çAaG'Á`Pg¦ÀWf¢¬Dð5°­vŠÚ®Æ_ 5! ^ab#Ô`«®6W -€o¡bsRBÆÒðmö¾ó^ÈÍ ¤üGa!8Á7ýX0µøßwþ›Bmõ@eã²1Y_û4J%ª{cÄüzDvÍì!"•Kkú8wÆ!õ«®8Ṧ^Õù~Ê:»‘¤qjÉÂzô1¢^{2^u.ǽLÏBH»3Ù˜ØÆ캉£ÔÌlÐŒ™X–‰cIót̬Ìuò2ÖÇ*,:Ÿb”™`V6×”¤ÔLpëR³1…׶=Û³/(e™ «Ë)fOjsãTJ “c/í8©´ š+Êl0m~g8Ûm¶Ü »L/›"qÌ^š=Áô1ÀÊš,Î;_ÄB_9¸ôÁu:þ^𧮹y¨ú Wr0Øú}m€ztn¸õ¬šÆü 2þ#EâaOŠ)(/$ĉ‡6ÐöÁ€}žzc0}‘ -üË#FŠ)¿ &7o=‰Lõhø-e´ž4ìÊÿÛÀÒ%eù²+u7%ûB|Áó¸ß+_³¨‰3ý/¼é[éº-gþ-B‹ªª?ËF*ÍÔÀ/ÇÁe-Ø“qçÄ÷}¾aa“÷ÚH©Ä},é/äàƒ:üùŒ÷Ɇ… û>™Þ橵ùHwÚÙ°°ÉÇcឬÎGº-6ù\,ÄáÉö’?Å ÑÉaII7,lrW’0ôù‡älw'4‘wåS¼@Òã×Y'ÿµw%Š­ª@TTÜpCÜ"ÿÿ—oLbö¤M_Û[¦ï¾´Qq›Ã™†áeß¹êûÀaáoÉ_¡Å ݘ @†¦S¥xŽDØj=Ìæ ÙvDh"«uÙ<ƒ_p1Õ?&?e|aéÔŠ”ónnºDëxòÚ\‡>ç ÚU‡ Ð]^È(oáÖ*^5%Ô$;Ö–Ú›…ݪºò,àcqXp¼ð Xhè®NF_÷ëôè*B¥Ö¼kZ%*ÓÉ(óBÈsà°®ZQO¤Ñ‘‚Æ-g%¡Âçž–kêîÅ‚ã…¿íNÿáɪ ô<™i9ç‡õ8ïÆ‘Î'€ÐB¸š2d`!‹Ž(çR šÏ´Ã‚“ŒÍâP M?ÇÆ„©ÑpÄ"aË€—Ña¼ìþø‹kl§ö<ãÕíÀsÁMkó N~.ž—ÿ# kwÇ K‰Ýïª!ùÔÍûα6‡…o’ò§Íýÿ¼ðã  ß$ì÷ÕÙþ /4â,ŒŽþ/üœùÎ~Qõð!|ÌµÈ ñÁË&Ò×:ë¼.~Ž¤Ÿìj4ý0ÛøÄl;J;O‹6iÇ NnÙH?ƒZMHíÆõ½—œhÆw’w:WÙ˜=Ç -‘8T+šz”Ußâ¸D¤¦\RU -žî Í<æ…$ø‘”ËÀÉW<ÙƒÊuïûÕϘ¿°“íN{„`¾éQ—d×èd\î)ï9^è§SJ¦”J¬›‡iÕ5DZ\FM²) ")Š„Ú%Ëþo¿ç´ÿ¼Œ¿¨žjç…Î*Xhpd!Q3Ö‹÷9[zÖ³çx!‘sŽ0 -±žªÅ(}báS×ZŠ"~ öò¦úŠ6®âãwÔüAX8˜êÖ gíæ˜\xÆOÄ‘|ªc>ƒÄ;\#Uª~-Ž´bÁù ÿT¿ µÅ‚Ç RAùUåSü´¿`×wþ,ì/\5V.Þ‡¼°_Žê$뢩_ÊÁø&^~×rµëZæt÷ç…ðÏä#ËÏä…Ö.›Ñ:Õýÿy!¤`;¸<Õ CÍßíüïÀ.Žõx'_Á Zñ]PÐÔÿ©¼`/oú–7Ò;Íý^øV¡´÷_–žœó‚š>ÒŒú™X(9Ђç4÷;xá;Åç(ôÅÿ89½'F>ÔÊù°ÅÁ‚ƱsŠûçx¡¸¹xñ¿‹UË›µÒüL,>:Zø{¼ðƒQÊ@¾i|¡ß¹çÿ-¼À:BÚÆ=¨óÇÂGEÏ°PƧâyÞò`9--<ØqyíÜaxådx¾yaîM}!/|ëøÂÆ•ñ…¨JÏ$‚<*ïég i•<}Öãš)ÙÅÉÖÓ½m. /œ…-¾sÜùcáʸs4\™7˜A>ßÃìò,â »2l,HÞRþ¶‰‚ø½SÇ o䣞›n:Ý«çíg\Ë ²çNY¤Ã9† b€ïŠ7J^ž Ž>Î W± ó£HXxÈå6/¤éð/ÔrÒ3,äY²‘BZô=Í3wÞ:´”:^8CUIç‘]šY]Á™åßÖQfÕ3ÍoÙ-u˜‰žB_p ædgÚÚ̉çc® ¶âxÁÉÓr g*œ£zÞ¶7žÈØc!½ãRè5 _À N>‡Í°˜QZ|údOð Aè°ð'xov_’ø+± c$)ޅǼ òЧ$Ç ¿CÚ7'ï# ¿ ̸ Þ;°ð/èäúU8,|žê òŸä;˱µ+ê¼Gjlùë¹nõ®ëÚç°Ðéáû:dfý/J"ýi“˱:Ö7¿xq–dÑ|6«3ê™À/v(û&²áü¥û’Ÿðo¾…ô Íœàˆßš“ù4ðTØ1Š! äaÄúP&N–^=‹°³kîmGHd­—¯6ýüðÃÆœœRZ¿¯3È Ñ—ç‰Ýw¾†…bƒ…8±cÆîÚ öã àXÀW”à ò/ÇÎþ Þ} ý…hã]¥évX:Ž=½H¶ÛRé[8|·õ±Ü|›áÖpÁ¤I’ß‹…_Ç UYûÆy]ÙÈ#¢^žøö/yP`ÄBïÓ'p_3î¼ÁB± Î™þ×Y[¥ËªaÕ5»X¨g3†¿ÑQ«òƒýÿ¡Ú•ÈÛÖÿÙöŠÊî‰'[±Ðdæ«ãþÁ²9a*Y±cw¼ð?ŠèFÞŽþ›Z+!#ÝK|Œ¡oË™ס0IJø¯´ùH{‹N2žIìʼnD^q2gQ˜Ô;ø%¼‡kM±­ßžIIŠ¶¾Ãñ°ù€…íÈQÞ@(®`Á eŸ:^zØ^ïÿ^~q>’¨ÆÏ,<-Çé³Y;×r¶M¤g•U?Óƒ¦,œtÔç¼p“ÄÝ¥¸Í —‡Ò`;±­á|ê ÅG,èÞÐá,Ì—ÊÎŽ©áÖ_(ÿ,<æ…gó(¿Aò‘,=Ö?5‹»‰¢(~f^¨‘<„ô­Þá…ÓÄ0°Ry‡ÒèìØX‘Äðm¼àyã;^Ø<ÀB6l½˜JWƪÿé1/0Bi÷Sï4áücäîÆáS7ޚ˃öúáGievì¨ÍøÂÉl Á;ÃBÜá…"³’Øhir7È!Ø'‹Í˜>Ú-âRÜÂ\„¨? Žn[ë ïà i¸¿~ö¼6F>TÒã*ûä‰oÎw–GÉó"óNjy#/œdw]ø ó9ö†úÝ8Rc£¥òêËlêpö¢$‡¬“1ïÃCé:ŒäÑ\ß‚õ··÷rŒxÕï™I÷x¡üÙóÙô:âê³¾Þqgq”‹¢eÈ Å]^˜_à…mLU`聯/³\'{%­ ÷̇¼ -`YÄâeŽ?Ç1fà ÿ~ÿ|çׇݪñóFß+ùHw±pΠˇxÁ`ò˜ÎÏϲ5õá -ŸoxΞw{‡cbÝ «-u)öôˆ~~ ð Ùk·Ü~þ~nÍý ç¼°|lÐÿÜáXä>³`Dž0q¤Í.ÌËòàŽ=$î]b¡¸"óá² yAäR?;J½2ì6OŸ–Xµzö¼ùGñ‚9> o®“­e‘E‹5Ø éY÷Ç¢BÚTÀC‹þÂíyyˆ~ƒ¼0ì^óûÞÛÏâ…}œuß´Ù×Q}¶Ëe÷'âÄì(®`Á‚oæÜý!^ø"vcõÔhAöŽ4¦·bá¼°Ow:\“FS6ÜšoÊLáz¶Ó˜jzo0ÍñÂÏÃôî §AŽô·ûÓxA‡Fùå~¼ ÖN#K6>jçR4õmGæšäˆ“,\d5¡©é•ÂŽÁ:^øq’¨‡j.Ú±ëúOã…½•TlHàtrMxŒ…ÎRž•‰Œ4N°^Ž,c¿ÕüC¼PW}ü†L܇ãgåÇÆån<–‰îÇñÂ>þ?Å‚ÅŠ·W÷Óì§øh -'áÙ‹,*Ã8Cñ×ü…ßSOužFygsLßè5ÃøÂYÿ{c^ÛlRÄ /lÕtÞŒ‘YØ,§8Úwÿå L v; -¸l†¯Ý¸óôo^i1ÒwNIz¥Æ{x§M&“Ý™ã9m©ùl¶„·Ž6ÄG“èà[h“b´¿;çmÿ0ëüdV§·Óã/üÔ»¹5¢ü† íoæ$’IRÜ­ ³ZIö­ÚÑ·ØN9óŠ5wb½Fa'%¥YÍÎËÓÍà„°y¯I’ë“ÛœÖw-“`»«wþ¡©«óøÙ{ؾ•³wì)nÖ„ñ6éæÀÎ)-@©1•uñ¦mu Ï‹\š©û§`Ídzõ ŒQdgÌÉbž”³ˆBBùô{²Ó=>^jcýN¯yßqƒü_yaß9¯»ßÄ‚Pj+¿ÄëŠ ¦ÄW¡6NÁzvzt°Ÿ7lÒ\½=‡Ä{³h­(³ŽO×úKã WÒ-²„»1=ƒnöÑYäb½¶a¨îc!‡=N`É@»öëµáñÃiž*–E:Œøι™*gã7ÙÍ“ ‰Ó{ªx=Æ¢ ݯ•Wû -K¨Ç‰ìB°]&[+2–&ÿî°–\áÙ×I2«¯ÞÁ?Î ¿Oü±«Ï¼æ/šx†…%¹?Ñ΃=N¸Àcöó ðwv¾û&“ZÄIæŽÑòw¾~_fÓþ4MœàAy‘ͦKcÑÉ%°Èl†íç‹ŠO–yÛ³›–òäd×íüë¼ðûä$‹»ùܬèW°ðS¥Ajo>ºù|WñÏ.ÒôO®Ë³IÀ+ɘ~Ùy~ œ¼‰šº®ÝÄ Ë[ض–Z  ‹BªÔôëÀÀv〦â_´ Æµñ'ÿ8/üÒõ…?¶"ÉWyC×Æœüã¼ðk×w.”z[5nÇ Ž~//hœÝ}]ãŽ/ü"‰Þ¸bÉ%¸©ÃÂßâ‘IÖ8,œ‰Y±ïOaAdz¶#ÓsRê%Ö,3U3š(‚_M©ïµ°þG´…E¢Ž.ÊIAã—c—Ñ•pˆ÷ñ‘ãiÿÉñ…ÿ F¾ ü†R¾•'çôn tJàù*„Æ2rü•s®ìZÃÅG -JF*ôÎácU-èÅ”A®DÉ»ÝÇ{µ.{–~:ðT¬Nþ¯Rò”=GÁÇT§P·Œ‹hŒÄamÞn8éÚ·û/›‹‘*E|üÎìÁÙâòüèh™ÝÀÂÕ³ŸW@/üR,âyÄÿßOÛvZû;š îÐAÀ ¼E"˜bá¨E…âyUàÂÙÑŒ¶ÔoûørG(|[å-i….ªžLb¡¬„ž'²›µð Ù11©ë3hˆÚÍ}ÚAÇ=ìbœ±Uôž' -[âKI!ìšÀ&­ã¶‰aûÛs8»Í:œ‡žF ì㋸‡Sw¥ŽzpýrÇ Ÿ3ŸA¾  ”ÓÿŽc¬ø~'ž*Àò‚Ê9(1•¼‰Æ‹c[ï>¦ÓÜÄ„GÆ¡à¾N”ŸL:ïʶ4%R zý„úz§¤ãa¬Â˜Š· ¡MÇóœ÷ºW’Ñ@O<”Mõ%‡Þ¡ÊtCýh$¹¯bMhÞŽ­5ŸhîÑ@±„ÈFZôjŽ©,¸¥ OQß›h§t†Mt¶Ó“¼ÀüvWýÒ8Òj #œ’ïÁM -ú¿c¡Ä -~Ÿ]Òxåj¦«]‚X „j ùÝš8ë©5¼)¹ ªa¶Ú&,ÈLÆo RÅÀê -<ôtÀk=÷%.ïO:"¢á9œºlŠ_`c:s ÅL•¨rÈ‹LSƒ…~m†¸" ɘ!þ2ž5^bV‰¡)À>tˆÖTõ‰eXÇ ž_p1ÕK,|ÛøÂý…àÿ>«‡éûš.èxeyaö‰¦Ibü…cÞø ‚÷LEM!DŒ¢àX¦mÌ>¥ãN“ -W±ˆ´Ö‰?,øÖt/+ÂÕ„þBCs‰ÚW("|pá-J%Á ³}g:þ´õ†š ]ûªÓí¨ür¦\É]²'NßO默Ã>9¯Ÿã…RýÖ±¶¯å…ow®™˜øÿ±,t~ŸknyaœcPTÐLmâœè;é+S3ïKÏ;,ä©)¯w“FO¢T±ÅBoyÁ§8b¦4`©ÅZK Á`!çº÷Ñ{ϧ\g£Á‚Ñdë;¸kÌ*k#% -üî~‡Ðâ<öý6ÂHãD² D?œB ñúy^ Ž~/€ñ §e3,H=éÞ_ðÐèG,œðÂû¬ÀÂsN zw”é˜Çz6pÈAEþ4HÆZJÍ ÜñÂÏá…ïÁ‚1i@çqÒÍÊ  ‹=¨OŽXà(6Ÿ¹Â>¨8f$ôByÚ§­—³pº#ˆE&p"†6¶8¾¾³ná0âyÞ‡`œ¢G2¨‰Roµ‘ÖÝ1F'×O<ËŒ4uüÄÃp÷~s˜<6Qäÿtw6K×Ýñ3€‹ÂÃp÷xý’×ÃÂõ^"Ø=8îþ—° “ziÓ1vÕ}Z “í—õ…ä©L•ºÝ{õOðB¶zÏ|Næq¬ÖOIœà3ZWmbÇϾîÖÝ:ƒ:›:@à3·»«í'ÕÇÃp÷tý ÖÃâõ°õÝÜc|î6»ûyìíaÞ12¼÷~ö»û›O¸—wÏÖOïX@s^ok»ÿ),èúùœ»†ÙR}÷ŽhýpŸOɳõ )Oð [¥îÏ°ÀJŸ×°®»o°®Ú‰Ÿàñ›Ã¶J}Ž…ñø¹Wê-ü+Xˆmëx{åÞ*õF¹õöA´eÅBþ#°Ðíä äY^åN7¼0\òBý$/L·ya…/ä…ñ./œca?¸âxá/ȼ¬úSÝç…Z]ç…þL¹W)Üca\-Šu÷mÿy^`kÞç…[6’ãÇ F–¡ªPçãªÂüCÁg´~âÁEU %V­*¬ƒ»ÿœ‡ãîÛà -{î¶?L®‡a¤b†Íɺ;z±Qo?ñ,ázØú)»ûzXŸlvϪÁÇ8R¾îžÚ³ÔëaÞz–l=,[ƒÝ«Å~Àmujwg©½‡Ía¸ûwaÁñÂwñÂï©~yÎ6,üßÄDjö çýךÞ/| £ú–Ÿñ›Îû¯ÿü˼ðÕXÈr™ƒPš;y¿È¼¨~™8ßى‡‡'  Nœ8,8,8qXpXpònYŠ¤§¬ˆœüqñptvhá°àäOËd  f‡']bC ©vXpòçëQóð_¼³Ã‚“—=†àßD¹Ã‚“פ5SM/8q’¸ñ'NŒ4²ü7oÌñ‚'«ñGÝ3pòÃdè¾Cv\í:'N~HMGú¢uâäÉ8}WMg#9ùYBœ8qXpâÄaÁ‰“‚…¦ßµ\µ]ËÜpòÇy¡µó2Z÷œüu,à2ã¨<÷œüy¡Z«é;qò×± ¨£' F¤]uʼn“?…†ŽŽœ8, ¤.ˆäÄaÁ+ÝÓwâ°àĉÂ' Nœü;XhDÓü_×…çjÜëqò±°DIKãY,Î`äš#\â†}³Ú;‘y^Â[Ъãõ\Iæ‰G&ÎÚ]˜x†Ì}ýB€!žF8UüXQ ©•!•Ùi¿xÒ!¹rX‚²õ/MƒíˆÌ‹è²$`™Èý¹àdyö •u ÎÛ•Eòžú³xcéׂdpšÀ%ìþ -,°”3ØÈDõ©Ê·° Ñ çÚ$§hh~»Ë #ñ çÍAá½ A:ÿX~–Ü {i«xC¾Ñà8½…Üpà…຤wE³ÍÉVô »‹…«­¦ñ°€çÿx!uXøXðŒv¦`ydQe‰´ËðDeÒ›Xˆî`a°`8v½,·'CW!K’\8\Úm,X½Á¸17æxágÊ]¯Ð .T&ö>kÚ¤É,¾jŽï.ÍÅxA–a¸þW–‹—Éô´©Â¨qV®_4l=Yv i±o·\f/Î-Ÿ”ïÀ‚ã…Ÿ)Qw'¨Á8ÍÏ¿›úÏbaY͘-ëÂègò^ÈÏÀÌlSGŸwŠO÷0ß…°pZ2¤“9^øwEò}ºF®ŸøÿØÌ8R–l³Oó,›%•gú £ŸÞ˼žca=ÁþkÔûs¨óô®•t «Kñ,8^ø™Ò4¶¬êi/ªiš -íUÕD­óiꢲ§HôÓ䇠ƒ]û>M‚B÷iGZ¦Y?u_¾Š…#)r9ÿº–[ ~ž.± gcÎX° ‰f”¸¶Çm½¾Š‘¿C/ü\éy$8ïs_eKÇ›´¿#oÌYG„TyݪÌã­NÇÌFÒG“¯¹Êh8$R×& ÜÅ‚Q©áÊ"¢ÑÖpù /è&?š3ìšZ[„ÜÖ•«X0 ¢7`ÁñÂOµ‘š†ƒ PD BcñP׿Ž¶Úá“"7x!4‰!‰Ø$׃Nô`78wæŒÐæ9’Ã$7×bÆÏxa)C 7óï/Ð}MHfŠ!`£™¯JO•Ñ˜…Ké]Åh[1ίa! n†pX)ôëq¤X°ÖЋƒd7l$Ô¯Ÿ³Áfì¡x8í9B¹aFœÊ°}F ÞN耯‰óŠøÁ¤‹Yu ÑÀ× ¥ Ä(Oö™¦V]õIïa!žz!Inf EœÛ4Ô-Ü…W¤Ãv&Bž•O`á\òe†vNPˆÖßÞ÷Îó>€›ÒÊlÜ󂥊 ì–OŠÉ£©ŸÛùá&«8Y‹7XHÒÓ½$‹þ‡™u¿ÁW3=—ºÑ"lÌ ®ñKØV °%͘1…tÉK=36b¢^¸æ3/Ï_Ä3!Îú¼`ŒŸõëÖ¹g§ðÀÝć «ca3]ÎÊf>œ`^vJ“¨+¿Oö¤›ðŠ$2Ò•. ¤+ -mãa’Hv XRJº4EÙÑuv•~yiÒÚ¯ˆšf-*®x¤s‹…¾TêÊŸTÜÍ̇½.ÔèÃA¹_Ô€…r§xeß  ¾|™j“ôV^¸6éæÊL'ypŒ³9{ˆyøYäOûß H§Cë‡,Fƒ…Y˜´ñ(XÝn.‚«?Ÿ»¼¨îëþËe -ú&¦j (1ç"œK1æl$¢òLuºWkù ÝXÔ Çþ¸ b‹‘DéX4„ÌO4€B½lOý¨®§zÞõ‚7û —“1OƨN²ž£|–s™){GbG)çxtý †ÅÉ1 Ъéí bçNÚ\f;•Gk/>w&š#¼Ë§ÍX[9.O\1€³w¡Â‚ ðž>‡hX+låxæ¸ú:Œ{".¬«=š(8&nÈ"*µ´ÇB´ÇðÂD’0Rå ¼Un°€¼°;òB’QYÆÆÎƽüE,$›8á½Èï]éQ>ÒC±s æZ«í w°pËaY°ª«Qa)¼°·½Õ=òàlfP6œ„?à ò’ôb2†w®›7™SpÅ…Kæ¶ÝÏ–÷µØ€ó”;p…[j†ÝðBKë=ò˜LawoìŒ{ Æ“»aK{q(¶^ã5-G^9`é,4âšÉT½X#OamÂ¥\CVeãQn5rnã=^Í#qž¯k° /%ØØHâi,Ìg¡ëÅöp‹ªø S¯'èÏS¢S“…ÔúΊRkŸ`ÀÔc$Ô Iu>îBÂ=BºP`TYjW]¡äkX`·gÔJY„Çwyeâ™MùžŸÆ‚WòjÄÈD½×xaëìÌûRIì•&·£8Ä‘ÚHˆòtÙÚHž¨/~ÄC^€Cӳ؜w1ŒŽM&ƒ}¡ËÎÓ6ÅŒj“RT£é¼ÀïÂ>µ©cè[Õ̤5kö‘KsК‡¢a47º¯aAßNHš ƒ—›~›ÝˆC±§±Uéõ2u‡eSžˆ¸ƒ3_Ϊocs~¶¶÷q|ãý·ªGÔlÆ.ÛbáN¢Ö=^ˆ‡‹ -ÞÕymÂÄÑ‚ÛÌìd/è/¼CÎk»ž(™ļ:¸žižðżpË÷îØô·±î/j>ØX‡G^Ø„þQ¨ÅVzMœMvƒ» ¼÷xÁ»L·‹nÍwKž>ÖþSR 'FC­‡àÚnYwPܲü<ÌhÛµp9Éô,®çvÛ”8ý4 ¿\›QÝË—½…Mš‘Atvi@‰c°ìDC°¦d¬OòT½< yy/k%?æ…+óX7s<žD™MV_àæóܦ\Ý -.DþþIÖ4û<¬¥ž××;݃ÚZ»¹f±ÍÇX°þEr#¶[¾†ï8BV\¤ÎÔMô.âbž>¿Pd‘^¨(ì,sï!/ £uJµ›Œ%—gÍ>°Æ~½Gœg našz9/y¦Ë4f.ç<‚§ý+Kò¨ÑõÌ -370Îç®Ã5=Ìá—2_]W³õÂ,ªgh²ÄdcÊ´Hðí0σíY5/cÁtÕ'éÎö Öâ*ƒk6Cœž¯{"Ž_ò7q*ýLU%ûµn}náí¿ºˆ7gb;¯ÍÄ·l˜ê$-O˜®À¹Ç Öºô.îÚbáb–v4ü˼0(¢vMH(å‰øDU ÿ*íSøðáŸÔ¥¾‰ñ€á;Ø—pbfòð‘̧”Î.ùD()õDÔ”sRBÇVïFh¾ãDå:á\I~m_Æ‚uõÒÓèŽHlÅ_q2°ÉÉ?Z%{ 6dšFWÂïÁku0B›…1®îDûlE›5šsQJéXBãd¾³õ:¶“N´vë@Ýã…Õ‹ -7fÐ f?YžAúŸõ•iit X0:3ÝSèìácŒº(Tí{ª(U¢cÐnè¥5Ú_©zV½Ö;3¼Œ“IP%|Ñ€…aŒu2Æ Îƒ×LÅœ$QžŽÚðe,4‰¸ÑÏÒNÉݾ2IJ7åãYf¿š_ÁÂ> ¿­*&Áý-[ˆÅVm™mÖuäëbÚ¶w:­Ò;- ¸ÈNë`ÃfÄÍô×Øô'ónñÂjm±ƒ¶Apš§º±6£ôAeåßíc‚P=ãô‚rÌå‚Ö3Ôa_ -ym2ˆDTM*ô8X9T&ª6þ¤ºlO-¢À/ ã7”#<¬€ -Š•“¸®¡ŠjiJ«¾ó v[¸j½×ý…ûò,žË°ôâb Ö{—J<È"ŠÍÌ„Ânmí¦§Æm¦y²o(¸Þ57^nò‚ÀæN²[-RW Š%Ùçv—'¬–™øÐÌ.ÚäØ¥óI¾÷ÁmMÙÀ–\Æ6ƒÍdŸ»¼°rJn¦%ÔÞéO{ŽÜ3‰ªbÉÞS#ù§ -&MáBW­ë1 ¦·X àÜ„”êœNí°@kpóš*X0­CgƒÒfô91˜ÐzD,ä{,d ~Ûö1bA/XXóëX8LB¶©<V¶z7+êìkMœ¸Ïå`Dk;¦~Ö­°»£Ëšñz˜Õ¶*×æ ËmAÇq–§lJ¶ŽÉZ{"È“¬0™±Ãª¶gõ‘Œ;¾7¶öÕñe±/ì‘qŸìi*8O—Ÿ‘”I½HÕýÿÝé ¨{3KUŒq`°,ð=j^a¾v‰X^ˆæ v:]à¯aå…¬)štŒr„/ÁÈ:Å‚‰´hƒ— €-r_w^_dv¾òMšÊÉáî"#Ïæ#Åò|ýPÒ{=ãr}VÄ6‘‡YnKm¡œ1±œŒ6³b_2Æ~›þ}[7Ï`j?h¼¤{àÃm÷yÍ°õzl=ý“qç57ïПÿðÌž™wQ¯<©òˆ0îÙÁFZ±0€µ3ŽØðB ',› -þ”åÜØŽù8„M -nJÊ—à%ç\jj±Ð[,h¾+•FZ8A4úQª²`ÁVÅJÓséG5e`§ýDék秳Úòù.€æáLLW{ºœÈöóFÍÕcQ".°ñ„þú0XÃNÃÐ!¦ÉV{ó]xùñ ÍQ8€Ÿ`AÂqùözö33Ðu|2éáZ–ãíÃ/Å?€±øS XOº)­á© x\/ t(:íùSŸ s<Û€ÁúiÈs=÷]g½AQí¼&˜vö¯Rùm/Hf¨p:“¸Ã¬3ø.k'6'Ðœ6ÒÆe“}*P-âáN29¯1ªÎ8ˆŸÉSK”?>ÛI»[‰½9]À—{V‡8§â­~ìvžNÜzŒæZÜÔ¶—± þ,8qòãEDÌaÁ‰“O‹Ã‚',„ĉ•É=‚¿+c§iv“##wâï¾|g#mƒŸÔwÁù N ÜaÁaÁ‰ã‡‡Ç NœüoX(GòÅ ‹fiDðµEF¾Jî•®©è‹Xȉ®§/ðø/ù ¢2ýPqÌȼ•7U|dæ\Ét‘;,| ë‚Ðu‰ýºñ¯aÅ‚MŸÙÔˆ†a–©hj{ÀzœÀ=­µY¡Ñ¤Ðíwåû–+ø—l¤p4+nL‡jB ½QŽrÚ½Þ:£‘ö[‡…×± :¥p¹uÉ9ÏuD” ðï„Æ•VrŸ+RjGqáÝ+ÎÍ´=Ž‹PŒ›ü¡@e›®ãŠz:£Jù W°«±XhLß“)‹\âš~MÝèz±=Jhj¶×õ¶Ï¥é„é‚ìÃl‡d+„@0³JL1GÛ4ìb¶Ù¿îa!àqè+«¡ÔÒMu=Ñ íÂHUŘ×RÅñH¼H¥šðh†ëTÇÖ‘ -˜äµOF™§VÀ› 4öx¯y«cþ¶É_ÿ/ô*°Xh§1£#õw85žé ƒÇª¸Ô¢mG¹ÛéŒÛy^=Ǿ'‚þŒÑ~‚nªÐC×™î&Á>¨Á¥ÂUǦ‘gU«üA<Lð™j±ƒî)sX¸‡A%öS)ÎÝIèÍ^6© N׎c²CXTÎ]=®¿B§,½‡ß´Èð Fë«ÀKÅ™°¦ü‡ôÞf$ýKþB8Êž-`¡§³ðiX¨È£Àc¦i•Œ²Æ…“¤ìÚˆÛé¿J˜? Ò†ØùcvTWc_Êq´1OõDË…ôX¤e7é‰xáçgeÅuV™ï;,ÜÃBhÈ‚^ɲDÆ9¡{,dÊLc¤^Œïá_‡:û5å˜3ùö -qA*Ìæ†v­ÆÓÉÙHW°hBô”j¾‹’bLbx¶D.œ¦Í‹!­¦àÿv|\oWaF±°ÄX¶­SÀƒ7çùP«Y+¸Àz7Rb×3=’–øb<åa„3èÖˆ«[©"ef€,t3’:S¼ÀB¨ ªxî°p]:šE¡S‹V1^8@Èà7 ‚Nü…d̵ÁWØòpo¢SUFpÜÀEÀ=ðæqÐÆ_°Xà]Ãhïü…«XÀ…7S¢–¸¨“Nhç3Tº#†©5bajW˜Ê)Ë.Á•mäÈZ‹…Êb¡À¡’dÆåò>4¼PãœJ@)¾BY\hÖ+æ°pUÚqT#ôGè½EXËŒcIQð9 vEžY¾nŠ8ðÂqýx¼7x#´ßSÜ#¡i¤Ò LÙ¨6µÎ_¸…f‚ÿ÷<†° ‰Ïøk:.:ƒï pÎ,À"2Ãúž– -ÒÕ ßáJ˜h#Y^ˆ9±ê¡{ Cê p•Ñ_às=,I„6ôsp2á°pUêTu¶…!B,ü æWXiÖDx¦Q‰u)ĺ¨J:ܾġ=?Ø‚Á@ÆèbàÔx³Kì¹ñ…«1UiLPø¿=J¦EšîƒªNÈMx[´‘€ &k%UëÑE”ó–™Z¦9EFÖ!ÐÍS;p&Ž•y»1÷;vŠ“Åå"¬¹8Ò?"ÿSGÃü¿ñL¥1 3& êCßcÆ.Mdz–Ÿ™ÍìyÛ¿˜}™éŸL3ulJU5f¹'133¾àÅë²Q¸ T3Ç¿¸²Ã¿ê/8qXpþ‚‡g#9qXpXpâ°àl$'ïÄ‚jw‘jØþWEñw´òžkù¦“ü—þSÎz">éG„¿vQ/žfT/îÏ ý´Œê àµÐ¯>þžVƒLôÃ6R6¾¶Öê«’äµÕÜ™ -Þ@“ﱑ–O•>Vòñ+²²ñ;V? ¨ø6’Û}çðÿÁ—dþDß‚…A9,ü›X(3/¨ïÀBÅk‡…7bA¾áq8^ø©r¼ðãxá=þÂç–‡q¼à°ðïØH‹ã…7óBnH?9Î -1°®àë¹÷û -þÙ""˜Ù°Öû¨"‡ç/¼ÊáÊÚà xÝRœ¤ª6˜Ú<ÒÊG¼0ŸZð J-zéûÝØö½]ñ”ñb³õWïÏbÁù _Ç Áxeê ›ÔDÆó'fæ}¡Ðz¶˜Òçxaù¼bÍ [Ä·½ë&ÓÚy§ÌÖ*YTfr̳NÿY,8áËxAÐŽâÛn43et}¿Ä ¹ÖX (Á×ÅN‰À?@i¡¹‚|Ö_ »‰X,ød"NÌáª2iÆ%"8¥ðIG;Qó¢#ݵB§©Ã‚óÞÎ ‰Z8hÖ<õœãÔZŸr¿ÖbA±f­R}­›€«®,LÕTꜫ)ÖíH ÝUŸõˆ?«±P`Ñ3¬ß!éÚëDpÊ ,¢ž;OJ•uX"°ËÞ…†5Í¡QS ‡…?ç/´“náõy#™‹1×TE3<©…ªV¢LtŽ”¯å˜/tgËÇ@;Ûñ:æ9kÈ­y¡Õ©ª „$Ex$jH8ÓnÅB#–, þ‚"h3yœ½ ÷ÊCe:F“wc¡± XÜÿv~Ô?â/ˆççnŸóÂCÍÃj®ípñÝ5^`зcåS×  käã¬Y¾Sc'<0ÐÁVŠñáÍÑ¢¦ÑN¢ `ÂLŸ~0}È ­=ÅS¿õýHãŠ+…çB,”à¼ô€•”#åpòesç ,Ä*>úCì` -ßÇB{õò -ßA11àWJ±ßH°úN;_ÅB'ùQÁëLЯñÍ-—z1ív‘ÙTvöQëó¨w·ÎuÊ 9<_h±›Ì3ô§¹ÆfM¼Å¼ƒšGWï"°ßMã:¥-{È ùïhÜBSƒ+öÄ*Âê¬u1ö ÀB/ªP©%E…·OÇ"¸ˆ…'Jé=ä5^MM1#/´¼ YÉ}‹…ŠÃƒSmü…bÌtÛ µÌoðÙ¶y£“¤š¹jýx´½‡1«§°P%ÛÛ¸ÀBÇ ýꉲ%Ÿ}ßSÒ\ÁBH;) eZ^åýØëš);…5dØ,pRAcñì¿:€sÇF’\ÌãTõ>':ÛªoGÿƒþBdŸœ x™œ‡ÞèiE°,¶œÂG‡”—µêà\ª÷y¡à¾ 8B™èc©Æ˜pd‡½XIg1Ñ!÷Ç -žS®{|Ö}  °q‚µNØ=^ &=gÚ=t@˜'Sg»›bÁÆ|ˆy)Âz/ÏçXØ™:aÕÚE{4ÀoئJð &‰Q\KSE½Re†åõðÅ×±`­ºžW@QLÏÜ‹ó/ʦ›9L<]'ùü rĪY2ÆV_ü±ü˜¿°–žXž;hO¼7òvU³Ç‚ŸñåææaËû¼` -F©¡  :à»É<ÅŒ -¯{mGiÐWÍ. -ÁegߊcaÁÒR;"€Bñœ<®¤«áU%3ò‚Wà ½¾Æ MK t -MÇ <©P•O< ø%»Á +€ãÚY =›Òºi2Z^ÁB¦dÙh`äÉ4Õ„X³j1õM¶¼pЖš§fˆ'R"átÌ#œMÀ@T×<¦å„ªïv‚k.žð$ožÆÂ!³Xh •/¦94È¡ßó±X¨,ìŸwxÁçƒg÷Ž•Át[©¸Ä²ð Kªõízcðè /ÀÓÇäEhì}^ðíCö©§(å;´@!gÝô -¤G Âß¼xNyÂù8u§(ÖöÜä ì…|$S"kë/6×çhVˆ×œŽXÀ†€¨@EzÝ¡&zíDÇ Õ8MàžˆkXÀŽ.ñÍ3ƒ~^Œ©¨ie\},„}•¸y M19µrÄy$ÃUAª‘ï<óêGA·wƒpFŽ;‰d šÃ~‹¥C' ‚TtYhÒÓ©ÆÚoðæâÇþðÂ2îrYq -pèsyÇFzà/l¤ ›ÃÒšŸ-Ø*Ðﲉær06’¹éŽÜç…¦íÚ°¤Ò1ÍTÄpFшP‰COíW#%¨Ì¢‡ƒüð‘¿ÀêU»<{ >¥!\K¿y¶RÛ¿±"œ)¥†º±eÞÄ’­ötîøªcð¯>|ÿ(\`!¤´Êv8Ä=€p±0÷<—²ˆ®úÎ%ç>ü‡ö½’‚‡¦nvS>Ÿîóô¬,«8€/P”톯·q¤%ñ•Š~4XG·ü… ìïÂb­É¶»Yt~I‰¿€%¼ ET«Í>æOù ån¡jÀ|Ò¡þ¨¿°òÅfã±ÚUdD’€|£7‚½v;ò ŽÔxìÚ²æÙ0étòÐFòk@Ô]-O§6þÂ0 =çíxº\Ͻ|$oáû#¹y!¯,T¢>†”‹ÒÈî»O`¡D`š°ìµ€Þya¢ÆVœÑ_ˆsã7åWyA—=Q;}qÛö1ÃÒ´ð¸|ÚùäZsïþ(b³€a¥¬¿`-Øs,äÆ\…¿;ÓëçHš®ß÷ °tè®mý$Ÿ$­ˆöÙù `w -n¯ùI!0•+ ™¸·æÃC!¶—ÙÛæÐ÷l|,ß¾KôÁwîlW¸b¶wyAžÑÕ|Ç”|(4y9€˜b·?¾®Â¿`ZÔð(ŽT™±² g™€Âª>;Dì7Z絉}M-Ÿ_]½*«?Î >ç—+lõ‡"N"²‹“U#Ói“ºô!^PýĽPMC§&à éèC%ÁFB‹vRÕ¤(&VÁÔS­zÄ våŸÂeøÁàs“j>l‘9ñ í9¼÷âÚ@3¥ÿ(/Z`ê‘XƒE´Ð‰¢ÂÇ}+ Ž:¸*Qømê´ÃMM| ²Åð~´ëŠyhr|öy×ÆyRW%«JLJl=-ïš¿PŽb`FǾòÞ3¼QƺAyP´c¢k¢‚¼R-ØHÕ0L*»‚pÙdÞÂ&AUô`M””F¯ÚHû7X(„& ê -Ž’Œ³öUµ¸RŽã+MjyÂ_P ò‚ `>ÀÂCÁO‡ª,˜æâ1Mvˆ£lÌ«>2ÕC{ÍB8ñäØæ9á3öUƒ -^hS£¸Xî·!õrÊ9´Sƒ‹“ Û¬±%ÒëÒ 92ža€íe`¬Í„sâ=wž¦¦® ¹yçþ ©ö°†„ÇøØ­..åCtM×¹"x†¼¥IôQ^FÇÕKì„ÞMèD ÀÖæœzÝì¤1œ SõjÊö ñDZ ë·Ÿó ø«¹™ƒ!öûŠZ<ÎÁ8îÜœ}s‰…++.ÿ>„âêæ™ñ…WäƒùHMýRñüó|¤[¡“ý÷âZó]ã…ÝÈAìHW.ýc ±@wfi=‰ã¦“µ ü¦°-¤ °K›)¨o­©û˜fEÛÀV¢u™óšTÚ,DÀß›&b7òB#» L‘ CzüxF3‹O`á qóÞ,ÿ_žªY])#h#)¥ø B)ß-x0]ßwcmü‹…«‰ º'~_QÙ,îOø ¾ò}¿=†@•\ JÄBÍÛBæÅl± &î¾åž«/ÈSý-XpóÞ‚…›þ‚XˆF·G:Ÿ¶ÒÅu¼àü…‡¼ðõòd}¤’;,8á[yáÀÂs¼ Ö`gÉœ¿ð·yákÅù Î_ø=¼à°àüÇ ÿ¨ü€àäÙ—öŸp‚ ÂiþÊîN´ù´¨é ÈalßÑ̃ÚŽé´ê½üßåeåøá“îÔÇ„íþ_Üü6ò¶f¾å,ÿϵÿHiõ킹Fendstream +xÚÍXmoÛ6þî_aì•JIë-À>¤/kS ™—ºëŠ4\‰Ž…ê­¢”4À~üîx”,'R²-û°‰äû‡wÇó1lîÂ6=ÇÑ<™#Âpç3w~ +¯fÌ l±˜gëÙO¿xþœ¹NäFóõv¯Çs–ž˜¯“sëùëãÕúåÙÂBX,rv„Öó÷«³ÞÑìêìät}rú +GK˜dÖû.ÿz¶…µ&ÐÉé~ùøí³c Ç]\¬ßÌ^®{¦=`!ͯ³ó wžÀ‘ÞÌ\GDáüd×a°œÏ€§ã-…g³w³ßzU´¶œÓ®1¯x"t¼PÜu‹¿¸…1îÆçw% ´_Þ¥ÅÂfV,6LY7eKB¼)P­Ïi‘´)nH¨ê´hp—'Ô(›Ü(øäzîÏÀéæ+Zl%¬0Â4%}ö +“:EЕ¬ŸÂÄÇ©"\÷¹AÃm†þˆ4سð}  R\W1Í •È—®aöXdŸJ6mEb®‰pi}m±êv2‹øÄ;Zm•4:vFPÚ(%Ú!)ð‚ó³>‚K¼=M;)‹'ÚC°)V!eB’fq«–•¶A‡Ø :Ë hG‡ÔȪ–WiÙ*ZR¬€¯m\XeÝí’ƒîÑÇ“¿ $.a%7tlp±q»jã8×k­{>.·Ê"ë¼ì +dgƒÎ˜ATíž&- EˆM-Ð$+$+gŠì¢=Y,·Ú\IÖÊì&xà:¡˜-y«²°»” M'@Ðdj –ábPwéØ< ?ò¼Ð±ÒùR3AËIÒ‚âsH &ˆV@LgGÁœ‰òâ‹Èaœß[*]˜7àq'ba¯ÂâmkÌõÁ³á½æ:Ì{A4Rƒ|î9^@ë²l¾‡ËÂ=«®â8£K‹Cû=®ýø þ™‰˜>Ÿ\ÊF—!ŒNä7*ÿÜ(˜,h‚?¡Ï¬Œ7Ù®TFã'&–:Ÿƒï†ÃpþIK¸{$%”·G𴌵ïè<¿Ù.º ÃÇ…Šý¿8£7~DûùrÖÉ“*Y÷'Eíøó%‘öç´Q»²º©†ùä4¦Bí 6tî½Y•uCÀe!/FêíC¡(‹Ë<‡è¿…þØyVÃ4}1°yRlK’„.òsUTø›‡ª‰n$Ü930ÔyŠQ4àÉXRØëx—62nÚºßòOÎ54»Ú4»NÇD>ëþ€ÒÁÿ}”8þŠÛJ%õUí$Y6jgÓlt¶üKýƒÐ:«Õ‹1ÏËb›^>Æ¢M§ŽðZfÕcµ;»¬‰âÛ²H›’n¯Ñ>êD¹Ý´Y“€/››ª‡žCÿGJí.¡ÿ溫² 6[ˆñª~§t¿&®Öcªo"U\§U¸‡U<^ŧèž,±·:§Þ»^à°Ð7‰œCWTao¬›âZ¿–ôçðhŒ1“”NÜÐò—¢Ë*Áã·ó<ðÊ#—îQÅ©»‡ø8Õ ¿q0Œ ŽË‚ 4ªãÁƒ½Á,R'4¡¹n”ßt¯Hs +h'B%\‡GcÞƒÊÄGýE¦÷RÀ#5·Ç¹ÃYÇ#Àï6ßî/7wÿÍOûendstream endobj -5743 0 obj << -/Length 107 +5870 0 obj << +/Type /Page +/Contents 5871 0 R +/Resources 5869 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5843 0 R +>> endobj +5872 0 obj << +/D [5870 0 R /XYZ 85.039 781.388 null] +>> endobj +5873 0 obj << +/D [5870 0 R /XYZ 85.039 664.099 null] +>> endobj +5874 0 obj << +/D [5870 0 R /XYZ 85.039 80.616 null] +>> endobj +5869 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F62 4047 0 R /F15 2972 0 R /F79 5852 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5877 0 obj << +/Length 2424 /Filter /FlateDecode >> stream -xÚ`ŸÿÛÛÛDDDwww™™™555ñññíííËËËÓÓÓ'''»»»•••ÃÃꪪ³³³ùùùèèè‹‹‹õõõýýýkkk¡¡¡]]]ƒƒƒ’’’QQQááácccåååÿÿÿzÔ;¹endstream +xÚµY[oÛ¸~ϯp½¨ ÔŒnÔ%X MÓmŠn6'q±§ÈöA–K'²¤Jr¼þ÷g.¤,'vv±)R‘Ã!9œùf8Ã8#þ9£H +Û‹Gaä/ŠFéêÄ-aä—GsL5ËtÀó~vrúQ#DZf»u¤ð¥7š-î­‹Oç7³ËÛÉÔó<ˉÅd†‘uñõfâXwL½¹½ºž]]ÿ‚=ˆŽõõ‡»Dž5c¦«ëÝðù¯ïϹç {ò}öùärÖKÚËRÅ(æ“ûïöhGú|b /ŽFhÛÂáÕ È)¤ïé~qrwòŸ~)óG<ëV¤ y/Õøµ8Ž+<Ç…ÒÒöI/eÕÁüÀª'Ah%Í$¬.O×Ådê@·Àþ–9&Ql%«¼ÈyŒ©PºŒ ¿#¡DÊ¢š¸.1´ï`LºV†dÕ(ä”VÞòŒ„?mV5(„¨Qi^«³ÉÔckÞàR°žgmZXP1O—)Ô;(aê Žb:Óµê6ÈY5Àf@È—´õ¼‚¹kl5Y…í¶Q8×±–rÃþÏêp,SL¼KVó„›­jPOª¡‰®UÐR<úÀ;ë¥Ìô6KÕ +<Œc}«Ö¤†ã¯‹ž+†-耑•…¦d¨p<8 $#4k Òp^vª¡}"i}¨ÖóÂLš¦ÔÌÓG^E.y6K‰´R7r=òc­PÛ¤‰\Ïp,1”^’ð3\‡™‹†ÀÊá>N'Õ÷šÇ3âÈRuÜÈ˶#ðÑh¡ŒMü@Z ‰;³I94°ï‡VZ•¥J»ÜlTêÍy‹7®Ñémß:/h?!¤ƒòÊ„]à‰7õÁ½7„|”q‹F. Tð[¡TɃ,&PÇ7 ;B§Œ}ô¼?li'å‚ù?NœàOc©F13>0ìA/¤‚œ†iò%¡³³æ)6ª‚Ý¥#É5é0ØÙÇ +Ò²7Ž¡½»ÜL#ƒ ”ÈB^W€’¹;¾èယóŒŠ×&†+3Î¥˜k vˆÁ'ÎÛ~üôðžrŽ5ÛïÚ8Åw\Øyƒ 0-£Ž„„v‡¹Â &dÉ$ŠœÌDçCuÔ +¼S³ *ð»íh˜ ýG•Ý[cIX£¨R€1Œoö½ðÀ1ØîZ é½í•1:9„lmVI’®Ðz^[Q¯ËøÜK¦ù#05®{è5ÃÐA´d¥¹ÈÐ0"Éô¥WgUÛ•À=î=Þ … w^ul·\›172Ö&Œ£ÉK—.c¿bÞí "à¨úS¥ënR8X»Ã]§ê"‡° L$dQг/VŒî€µÈ, õ—¨Z¼£(öIØf5WÐ0PëSïÇ'¥Ígn¹ÍÞR÷7¼À +ÌS-¸MwŠ¤+‘ût>lUz»ßórÁZá;ŽÖüïàQPöK±×­Bò Êap…Ð~Ëx-…RbŠŒ§ M€sW‰¾ê±ÓmkÅlE÷t­ñ‡ßî¸5')x™ Õl­ÆD°ª{Û¾„X‹ÏkÂJ‹¶ÞþF»‰yÚÆÜ"Ã^hîè/Å ´ýuÀùúyÀÈZ9– 2²&ž©¶¤ ZÓ•ô wªsm ¥…â…îÖ}ŒÇÈ”·mÎ:‚“šÐ¤³êOÜäTúÇ®b€Î}ïs|–=£rÀªŽÜ¿œVpÿWä¤R•cXƒÔ]°êkXðÅšá!¬yG±öÚv=ÖžïwkžÒîßÄZýA ŠºsB¾ƒCйŸM"Èbßç®äO—¯¨fzÇááþòzvy«YºMžªwz6.5Ãt´_C0¶ú‘8‡KP´Y&Œ÷™_&«„ ‹ŒXõ,í—ÇPåJ[„áëÏ1ž£¨2<„*ÿ(ª^Û®GÕóý¾s 7üD™ÑJ*`áÿÀ·­ÿ­wõ Ô!Q  Š$ }9¾N/¶Þo™¡äô ;,Ukn<î‘¿\+R¢gnYKæÕºãæÞ•Œ®ƒ±L:Tº.­JÌUìx‡ì(ØXT}ôÃn©”æ@ãK;Ú•YÉ`zŸ]îµà:>?¯[½ZmjxÝÏÍ·Ü-ãØP¿À +»’e_Üà¼*Ì«O`ž’¸Mx ì]ùŠ®Å ¾Ì‰mÿ*pöù³ýóöÖ@Æ1ýÆíHÇšõönƔۛ‹‹/† +>8Åïõ{ý—/—Xéæ–˜À_ÇìœSÀf[nð{4ö°Ç^É)SÿÎÅ ô +!ç¢ýÇÇzsÄkȃ¯ûª×xŽz­á!¯•G½öµíz¯}¾ßÁ»À bÈÅøÕsïŸ8š«4«t\¿Èþ4yE?o˜|·NSÕ¶Bˆ1~ÖwÈéSÒœÕò”îl þ‹czóm¯G»³OGÄèþñÙT8¡¾Ccã`ê\JB]7›Ä.{"=ÑX xH‹%N0ÁÊzÊñU(Ç +çˆÌ ÅÈ_—yÇóÒÖæ±:¶íô¼ÈÃê˜ËçO7bY±Æàj¡3@l¥LY¿M¬MN—Àñä^y±´ò&ÑÅLø†ž¬&VçØz‹Eoä[X¯÷ uFŽk£&Ý@V*¢a½ +IѶdA¹¾Y³¦©„ÊáÛ&b¸Ä,9‘j\£¢3‘æõeËaÑÚd©LýïÁÖs¨L"\™ýŸÑ êìX¶f 7>d3øåˆò·þj0¨.DäŇ /]W¸Ž‘ï†ÁsyÍ_^üÕJ4_endstream endobj -5739 0 obj << -/D [5737 0 R /XYZ 85.039 781.388 null] +5876 0 obj << +/Type /Page +/Contents 5877 0 R +/Resources 5875 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5843 0 R >> endobj -5740 0 obj << -/D [5737 0 R /XYZ 85.039 714.405 null] +5878 0 obj << +/D [5876 0 R /XYZ 85.039 781.388 null] >> endobj -5741 0 obj << -/D [5737 0 R /XYZ 85.039 714.405 null] +5879 0 obj << +/D [5876 0 R /XYZ 85.039 457.872 null] >> endobj -5742 0 obj << -/D [5737 0 R /XYZ 222.519 116.14 null] +5880 0 obj << +/D [5876 0 R /XYZ 85.039 372.982 null] >> endobj -5736 0 obj << -/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> -/XObject << /Im15 5293 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +5881 0 obj << +/D [5876 0 R /XYZ 85.039 277.876 null] >> endobj -5746 0 obj << -/Length 510 +5882 0 obj << +/D [5876 0 R /XYZ 85.039 210.13 null] +>> endobj +1686 0 obj << +/D [5876 0 R /XYZ 85.039 140.668 null] +>> endobj +5883 0 obj << +/D [5876 0 R /XYZ 85.039 103.801 null] +>> endobj +5875 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F79 5852 0 R /F58 3360 0 R /F20 2961 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5886 0 obj << +/Length 1847 /Filter /FlateDecode >> stream -xÚ¥SMOÛ@½ûWìÑ>x²³³ŸÜB 4HMM0'àPAJ#Qhûó;k;v°Ý^%{çó½¿E!ùAá H -Âyò^K@oæ FSc?'×ÉUÛªŽiQWmå‘£ ƒâ¹à<êáÑOr&McPJñÞÑñù(8àsÈÊI¦"-ÞD k†Îq88UyTðløpO[´âì•™‰«¡o–4¶ -pFp½µQÚ:°h„2¼ -•ßù…ý?…Þæ:¥,ïnl®Á|‡’¼«©8{¤Â^ßÈa¾yzß­Y3¾!V\&sfÚ•Y*Ɖ'}²Ê*ÐÊí–ߤôÉ}@éõ‰XÅŽ5½yÉ”O÷µØÏvvýŠ&é®v¯ÿTÖÃû>¼¾ÔÞÃwÿ“½ëú^Ìž7ë¦aoMÐüoéíÍrJ‚÷néÚ +(/׌µ!rÅxk‰–ט6z.&3ù'ґ㨹˯ªRrÝç5(;U4Ýݯlè=gÚ¹–ª-öÑ.Q¼˜/?.–'Ë«ÅÇ«ùâêììÕbq~õû÷çà `æ…¡¡ àA `•¯+˜ý1L–`g°ànÐ2ixÕû±Ò¤dhoy„’{qñ¹íÔç ëGaß¾ÙBræÈ-Š)›MLçCí†_Íd-ƒ²¤‘ûì{ÊϘw²•E®1óKDtÀ5}n¦ÕºÌ1¨Ah<Šˆ)~K¹Ã +ƒKÊBÖ +MGšña_³q³­18Y-°_¶P’z‡¦- IìSõÁˆ›ZštÔ$uìíhÀ H2ÖüU}vja¾ã Èt¨}ƒõ%^ ,,V‰=Ó% ‚·5g{˜årQâû!ôh@šÙ]Dl²i¾z`ùŠ©^PiM÷eÁ¢– ±GÛ#Õ7wXÉa8!×UÎo–§<šqD†Ú'÷2mùäÎê&#uŽ˜g˜T ±Õ° ˆº‘ºNäaÊ"FŠN¹ëc Yââ‰a°b¤¡°}6(ïêYW}uÍ¥Ð×µ¼7êñH¹Ñ=W®.µUÕüȶަi‘ËRÞ¦NJµ‘MÂ[s®¿WGHó“’i-›# Lù{$Ëv³åN¬Ë¶uô/Öµ„,´-èGÕ&ÙÑ°ºhò2ÙÈãkƼ+Lå@™“’’Èc¿É¿ô­Êø‰ãžQ„©UhHß½º[—Áÿ»1ײÙ§6ÆÑWì–n2FûEÛ{”z$zWE²VÇ×Ö}dáÏÍ +;ãƒízø×+ƒ›‡žeR¥u¾m >~“ö¹þ¼¼|y3ž\°ãñ5”Ë«rY©fA¼Íe-óÛNÅU¥ïór¾|áüöâïËïÇNHל.ÑÇïÁÙØTmoÐçmW÷yX´XÏð¸é“·ƒp$mt[¤AVQ[¬ü­b´„­äŽ÷›ª–Ϲ‡b¡Û*9Ý5,ÁˆN]‚ÆVÆͨoì×R}S¥e®%…}ÕŒ sï©Ee2Ø)úùò°¦0DÉúà*J®­Õ_y<Øq lßùæCh€C¿§žp½`ð²ƒ@„±C’ÃÛÇvÏ1ä<*…Ab»Ê­gZ€ü,šì—¡qžSV_4ð„e}GÐGt/¶:>N$"¶ð¢Â‘Ú =ƒ:ñC?ÈúáºÄ8¡o$Jéç ñTÃú™!t]G+ªüHÍ–Â@v£AÈÁ„x,Û£¡»Ž+s¡h$f`Ûàñ¡Šà^?>dÂÊZË\2¥Ü­Ñ s!R^š#¡GQœ`}Ðc¤jGvª 7Ç1=t9æFYʉ8à· ŽÁJMš(~ü쟫Ž3¾›ž8Þ="ˆ¼©mûpö÷¹®µFŸ¸fÇË0; ×wDì‡ýzú‡Ö_i±Yu-<«µ÷ÀT‚¦1ÚRÞß´Wm§?šÞt‚PÄ]ËиE›]Àá ‰â8š¯oýàD#Ë'Ž}Ó²t8åTõ†ì,0ÄÅóáUÉÓ ¾(iüª’C?h©ƒ%„ +“í±êZ;®9íB“.nº›Ç†ü÷ÍãÖU·;™×<lé}Ά®”~¤—×N> endobj -5319 0 obj << -/Type /XObject -/Subtype /Image -/Width 780 -/Height 299 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5752 0 R] -/Length 22110 +5887 0 obj << +/D [5885 0 R /XYZ 85.039 781.388 null] +>> endobj +1690 0 obj << +/D [5885 0 R /XYZ 85.039 196.152 null] +>> endobj +5888 0 obj << +/D [5885 0 R /XYZ 85.039 153.199 null] +>> endobj +5884 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F62 4047 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5892 0 obj << +/Length 2795 /Filter /FlateDecode >> stream -xÚì]‰bã( åò>1¶ñÿÿ—+á$M;m·¹ÚtÆt&q|ëñ$!Dgör¿¢…¿¡Äú‰wÿË w{¹_Q7a©g~6þ×cÁÀ ÜË}Šs$¾ ÏûlæÀ‚*c¶—ÛK,ÉíX°Ïù.âZýXˆý^îRùIM l—â{É a7bÁ>é³ÅjÇÂ^¾^š{èHOúll煽켰óÂ^v^Øya/;/ì¼°—v^ØËÎ ;/ìXØyaç… ;/ì¼°cá_á…æ^ò»óÂ^ž†mŒž£W»›îí^Ñrþ‹Î„ëeç… /TŽhî”<ß]·ov*_ϸ³Ö¹hç… /Tnò~v,Ê,š&×ËB›/³$¡h?“|êŒ÷™Ùˆ!*ŠmÍ¢ -V5iÖà™Âgã´Ýxš¦Ûyáúæ0És8E™çôPoù0$/åðÞèÙ¶G¿”ïžHæýeW®s(ÉÛÛOrö‘âÜDù_èCyar•Ú¥(ÖêT:ž×)®\µ5Þ®8«OîLuÀFî @ò|ÒºÅ.Ã7¤ìî˜ç}8ï¼ð5àkyt‡IÃP¹Ó;XöÑÞÛÚ.¼¸wTâóù•’…ñVä ÿÔ -šÅ†‡Ê=Ê  -³ã"?¡(¹Û}üÉÝÌ=XG5T®ÃKP2&d«4CY8Ìz®êPï3¬6iÈX³óÂMX˜Q/R;=µêE 54>+ˆ¬¸¤ˆ»÷UØür,n曀œ­íþ ¡Ôö]´âqUù`^ ZwP#·Ù ',Œð€vÛr~¼`‚SVIÞáJ 4ªÅa§€ZÑ¥ƒS‡ÒW]šWýíUù`{áD¦É&ÂçXˆßÃBŠ˜IÂ*éH5hdYš»dƒ™žª"ߤAî~¤Û°`\’8}x"£ç&ñZM®eÈ /:’® 7GÓáHßRXv$Ùp4Áù4иƟ#ñB ‘ zâ¦u$PžagØæTt¦#A# ÛtsЪq8ïðô~¤¢ø‰¶ᙓ³Š+b0ÛqÚ- ™ý9ر"КŠMÓäaaç…/bAn]vx‘Ìb:‡e$‘ XÉ7«-¼ ©ÜfÛt°ÿ¨°[ k]H¯R; ¯ŒCï°¥Ù ûvV0Kºd}…Á ²±:R@¤1Ù|p6NÔ¦½=³½ ¦/¨­ÍJÆ›œ®Ï»Rl6K‰Â{&á• [€ -ƒm7­v^¸‘"eŒYN/rMGuh»6ᜡÅæd<¬;b3¨´[³5 @lgŠËñá¶+Ž«”fãx·Ë¹íLˆžâC£œ¼²Ô ´Ë7!Ûé(ÿŠŒÞ8bD˜Ù{`᡼ÊÿÛÅFn)|ö úêeŠ>9ÊvÓÓí(Üýxž£tËä /2Öì¼pÐaÑåÛ‹,µv°ö/:š -Ða’×XÉ9aÁž°Ðã¡ìp[`שÛƒŒ,`”¿ˆm$/^ÜUô 4Êø†…ƒv-÷ í žO?=/üpÙyá«X¨AÝφÔZ³î,£,P´6êH‚¨Dd‡ª¯Qåç.¨H^tVijk_Ù /ò'XPJ6¯xá ©ÓrQOÏ ?\v^øª¬ (çû5°E =o/Á„]Ý‘*æ£í Wî6 êìQ¯ª5›­îÏ`65Ú­}ñ3êó‹Ðãùfò`2ð©òí[nv¸_xpÆÃýî¼°óÂb0¦‘‰bŒéx0ÅòÎèñÌ‘ä³%rjšþ29ÇB—}\é.?:XÓÙ´Gî@ÛÙEfM÷â)IÆïOs²©‡1(¿õ˜áòæ+MµÅU!¶ܶ¬ŸÆè í…)•Eïûz£"Yªÿí*i†ÁçÅÞ⨨w^øKÎ[ä†;D°Ý•¨K#×vîý0SP-õÿw¡7„ñ^òñêØyá_(`‘€=nïÐ}W^°JPW.i„G¿ƒ·$‚_.Wn°›{Ø3ô ÁNb{1{ñ55œ{šJ~¦ È°R%χUÿQŒKMÜ,$q¼9šþ¡ÒgE±Ü#4ãž¼ÀTçÅE¶Y¸VUÄ 14%‘·¤nL×[:´(›ræ„MÄ5W ®V)ƒÝþD‘Q *y£µâ¹ïµ2ö½5ð™Ñ’ùÈÂó–¼6,øÖàtmì3X?ì¼°—å…Å{ÄGƤ0IîÚÞuÒ¹i7{nREŠÎ½8&"çÌ´†®¡H±Ðºt[B:Ž¼€=öpÖÚéXŒyÁÂä5œÉ€°GpvX¡íæƒ+à+B mÎìÊöòS¼Pœdv€¥¦S¦,Jó´¥3©L4Ø;+†ø -BBŸJ¶„j¼ÀŽ™€…FY_¾ƒ…ì€6*37šÍy¶3uã踶6Ýya/?É Ã)X±€b\€lâÎT$µ£%rššÃˆ¢µqtrÃŽÈ#/ÌÔ-> ‘&¯±€Á“=2ÊaHÂÉÆ#hT f-…Üya/?É õi,GÚ’†ƒ0ÆÄMsg±¨‘RZ0ÐCêS ‹½08Æ©÷„€âXÐ ëÜq9Ûl‚ -°8ðÜ•ÏŒP¹S” QŽ¬¼ñxç…½ü$/4Ü• ì¶,[›öépÜya/?Æ ë›ï ÊÎ {ù9^ð)è=ÂêÌ7vÎ_t H˜ÒhJ´ÑZ›ùƒÆ|Ô1&žL|«A'Êt\ë‘Y-½Ÿu²þópÄI';/ìå9x!r3ÚF¨ÍÕiäêõÌÙÓ(¢›Þ+C|ñÏÙ:F÷Öµ8èã0bðótó+Czç…½ü /4Ê`’‚½blè}D×*mp|  y/„@é -DlyŸgxúˆ…0(°€½i€Öá8 -°0„=óbÀ$|Y…< †Q§¬–×áâ;/ìå'í­¼%ëg—`8Ç :òHiȇtˆÚŽÅy† H_aA9"Æ ~Q§^ëÉa¾Þ‡ã|‡¹Ñ×Æ9’ûˆ`ßݲóÂ^žƒ@Ô#¥s7j'WáØÕXbq…"ý D†$LÎ&…›SÈû‚Òº¬8`{’Ì.+ЕúÖ~ÌVëÊÉUõ4 bDo4|‘öò4¼9íF¦8È=bsŒ^ˆ@îOXˆ !(´8´HmISQèå Œ{ÀB¾¥Á‘ ÄÀIZÍ]’À½wŽ.·Dõ¯£øv^ø¼ô¬‰¡¼TOü¾?ƒõ!´Kľ‰o/óéѧÜA‚5ŸìÔ|v¼8=KÓ_ٸߛ0ÝÅ4„Ù†eƒXXॅ4#ˆ¡5Þ½ô±ãLÂ(,Ó,àÀ¸ -X€Ö½Pjõ£6ÆlKg–Â%‚f ,Qãƪ˜$bÁî¼ðµ’)¥oƒÄ?shˆá¡–Ê)Lˆ«yCÕ;.è«ÃŒ#U|v7/˨>î~mÕ‡3Ô`¹Ž¬G‘Öú:ÔÞ½A;ÒŠD€3^X 6Ü[{!sz™]Û±9žUJÕpˆ l¼0„Æ-#!fžZ¬R×Rà… ´"ãè覄t°_£~Äœî¼ð¿o]aŠSÅ¡á:xcìKUÙC, ØsÄ(Ç%¾•Ø?*3ýrfíˆOo,Ž)“*’¸“ý؇؅a-§|ÕI1îž©U3¶°EMÞ`@âSÄt«ºý—¦Dt þÌBCšœø#WI˘õJSEjX±5“ÒÊé80*[á šëHê{Ž+sö’äjç… -´"€+šÈ¹ºŽX”³$ñ,’2a³k8¤ð”h„‹(ÊŒBð<¥°ÐãûjOÁ12’9œ ~÷QìÜ£Æe‘à!,ïa¹¡[ì= W= $í'7ÂåÒ¯ë#PÊêù$EI¡I¼ÐD¾ ‰Ò_m’âÆ6d0î)\."…ºîµß6Ý3E -o#õÙaT¿ óðÈs«#@ó1™d¨ÐPEìð[¶ýÅ!õ$ó ÖE“ôá4dN£ ê)šyÜyáÿ¢>¤OÊ•˜x.!Öôú5<Ÿ®MqD`¡¡P™ÂnY‡5sNE Ç·Æ_Æ‘ ¼ÓÓã„Â2‹ÊpÄ!,Û°,0­ªÙÔÙ¦ Ë#¨Å%æ!U*ÎåÔâ¥PÃÖ[¼>bâ­Yá%:ív;жv rD–2 ‘èó?È ?]Ê—®ç>T‘€wAò³É‚F‹òŒŒpXãªT¹~PnÆJdî¤w,pЉl®A&µ3 «ÚÚÀ9^° ìœ3`€6‹éÒ; ìŽÄi3:§†),ã÷†…—1Ἣ.iݲÂaÚÔÁ™Ü†á*d›ý°Ðpg'‚?‡±ñKOLR`Ú #I¢ó~OÁ ?î$»éÿJ½eÅD €‹™J AÏ]°C¥z‹ÎÇâØBÌ>\œ W !é 8MFä¿ò=ˆwtXF·H0¼–»€…ćÄXÖ- ¬Ô®Hð”ú˜Pº4Á´’½ã!ßd QLF¼éH«­:ÇkLL¢õ¯ñÂîGú‚CuËŠ­ó(‰q xTÁ· CZÐ1)¯íëÔõ,€Òª A,Ä ã™Ð…§É /0ŸùÏÂøÄè°,8Ù.xÈ”rW kH^ùpq¼”9¦€Œ„DµŽlS1õF*vÄBì¾Ù¥“e}/4L|î$†ŸîsTvÂá47bÆfE™¼NIë.¿óÂGºóï-ôÆ ¯±2jbßcÞÞ/ ”'Ã:EOX8ôR,à0ô0i‡=¦ ÿÓ/lXÀæ^ºE+¼ °P#/ h¥ ÷ù€€Â£î¼@1Ç1hB1¦ŒŒ4(Z3œ|>ù‘@¿ -U¹ééxAº·“9W*yý“Ò÷ÇTÛø#‘*0¸,Ž6Ô¯anÃó|«íG`ÞyáÃÞù í+^ètðmJŽy±1.’oXX/x° }ÜmlH}ÂHCíÆ ¼þÄ’°€ËpéÐeŽièÁüžµ{ÁBŠ.Q¤£Ô‘†·}ªv|F`D´³yf঻/ ~ño»\Ÿƒââ­»x|máÃOY¼ç ä·üßî‹B;ÝX7ö,W92~¶óÂeõýEœÏ#Ξ$Є-´VÕ1·HÎœ¹F¿xC•iš#Àb¯áš¹Òèo%5ß2³M -¾  cÀ öÈTá;hÆzÀöµµ°Üphڭ惎䰲[ØHpÃ]çµ"r;“\ꀅ¶Iô:áÝb`ÜI³!ð ÛÊ5Ì‚,Ãã­OÇ ¬©± ò%ÖXŠ¢]ÛÉÇvÀ©"[P 묷b06Á¡ z˜³:q -C=mX@M+n%ÂÜ…Uu.ã‡I;/|¹,Ðò -v8N_7( aMðaçCÁÜ4Pôo·v&MŠAsE—9¯²Isæl*l ¢ §`‡=b†‰qY¸H,·»Q;Å/vƒkáÆ  ú!½.£(ÑìèƒGÃéå¹¢ »Ùàaaóâ×Ä>/Ô@›{슦Ð^À[+ÅÜ`Ž)€þ´‡}Dä°+Ín W~F$$[i -çÌ› €çRì¼ðaáænó$ÇúRfJ®FßçKn¶ù¯¦+Ð?”jœòU;£l†QÐ@U¢2¦/é¿JL–±½ÅFd#ug8-ý+ŸYõAŸûÎ ¡÷º¦¾üê–®¿{UDÄ ,Û]wüƒy¡E2Ø2Lom÷¸aSé‹àujœ@ï8µóÆ MÎŽöB¼ÐµULÝø({q|cÉ>èZÙyá“÷.~ô®zùkÛö‡óm²s1F.]xAK"/Ä€ ¸Ø#/LÛÙ€âÀ¥f,E{as¬8¥s—¢)™—e³ó‚ßË]úp{!„œb‚ùV¹šy8 à[ìéìp¾y´Â"ÂàºÓäó`B6°3àu¯Þ^yç”%NƒÝà䩘q»û üdç…½<Éd~¶ÂO†ùÁ“ûLSŸr>ÙÊ‹–èJ÷½)|§…/L~¤/x1r¢Ñë–kB0Äh<¥7'|–p>*Íè[#½ÞýH{yv^xs©þKoåtÐËNÝs'•R¼Ù¯y£lÆ Ùya/Oà —ú0á6¿Ø¿0ªÒï¼°—ßÄ ÿ_äR½\X†ÆBí¼°—ßÊ ÷.;/ìå×òÂËÎ {Ùya煽켰óÂ^v^Øya/;/ì¼°—v^ر°óÂÎ ;v^ØyaÇÂÎ ;/ìXØyaç… ;/ì¼°caç…Ÿç9UO_² ;/|/DN)EžûŸÚ±°óÂ7ðBäR?uaÓŽ…¾‡òg}ÙŽ…¾ƒ’ëÒrîXØyaç… ;/üå¼ ØÊ8ž¿Ù±°óÂóó‚Ì’G•;‰(IòeÇÂÎ ÏÏ ýð¸–(L‹– Þv,ì¼ðü¼°> 숅zر°óÂóóÂñ1FïÉ ÍãzEÎò¶‰Y?ªØäGäåQ¼Ð[ý­¥ø½¼Ð ‡{aqò¨Žnò2³sŠ?¨œåŠ¦éÃJô]¼9¿±`ûßÊ ·”÷±àxUUEˆWºïg{ÖãÂ\÷ ZéÏ®2º‡ý]¼ð;yË//< í£î÷LJ…›…õ ­J—‡üåœ/ü<þ]^è¾AJ¿‡Z"Sbmv^øxá;¤ô›xôåúˆÂþÄÂãxaùq,ü^h(ÏýïÀÂðB_? -%Ó|照ㅻûTw^¸+/ôy¡¹ú ÉÎ _Æ|”ÃïÀÂßÄ _µÆÍád«‰ñ~ç¾Ä _ó#ÅMXâØÏŸ[HåŸó…þ%ö‚l>ä…ºz\lö÷Äy’ä;/<%/ˆŠ[m}Õò±XÒ¶ñ½•²ã&óñÜñüïäZø dòQ%4-xz±ó¼PÖð·Ö¡”ÇU°ZN#e½&KbŠZE¾0±Œš¥qs^þöB5?ý À‚ˆ›@èMõTE7‡]ßnøsPż׀£cþ‰·'þ‚ª_È =…¿•Ò„Ò^0””ž¶Êú^~¤†Op Ú5x]x=zQWe™î¼JþZ{!êú…”D -^gÆ•Rü}dK¾æocÒ‘¤*:í+ Y"ê䣤üâSÌóe¼ 5ðŠbBÆÀ ñ¬åaÇ:ËäxApÐ]+ÀB°0ðU‹\u]×æ1¹ ¿Ì$¢¿‘•» -^F—Ô‰}Jx¦¶§LÞ>l¤èyAºÖÛKùrüúŧÐú2^©ËÈHݼ¤ÃìÉê˜-C:'«KÉ[í>,"E0V^o/4f¤ž° 8Åj‰.ÃÂoó#ýI /ä¤'‘7[»ËÉPŸÎ¼È(É»,`aêàA)6ÃŒÍúZÌSü.Þç…† £ÝúT“Ë<4p|RtxŠ~œ3áã”U]ðL3"ªçÐüdsdõe¼P'jáSâ*!YO -9ä]-2_rÛör &­efG*ë<* -Z^ïGJUU9*aѹÁ7– •ZØ×u¤ß׿G!/ÈA¤‚!~­bíHgÔà[e:¢á­]æGî™!™›TéYiŸ|™|.“° (ð2ˆÑ”NÌUÜ„§½âÚ¸ÔSÎg5û…« -k2e/ã…²Ÿh–D®C…ªªWĵ³-\A™²P¤`³²œD°J©HÞпÚ.K}7”|ÐQ¢oIÛÁ‹¢ü‹ûþ †¿€[í}$´,и' ãÆúNõ v™P¨p_pÐøkTl‡Ê¾ø:/l¥p=o(œŒùI5‰› ©mƒ‚‘;Ù»1\Ör &By kà&è[,ü¿‰•ŒEÎNÕÈ]ÊRϬiZ—‹Ü- N v’Z‹ŽDt-Q<Ò¨1öÐ,/öäˆ`ÑwòŸ—û xa«RMبoÐFš>ë`AU½A{aT¾0Á]âY5QX_À ± dÒ~%sÕV¡íœ«"o %6Z¸«w!/¨0t ^—°à‚Ž$•RîòÕEá= *Ë5a3r­Ö^Íùèìu¼P°Í«ä€,of^"bÎÓ•è%s¶±ó^(Ë ã‘¾Ù^Ðs-£Kcg$ˈ5RP•5ÀßßÊ o;Ÿÿ^ðõÌ × ‹(ë¢å¦ËЪqÓÀ¾™õ”\ ŸzhóU×ñÂ`°ðÑ·À+‰½† Ÿr®3;0 Ð¨à˜ -~S¼‹pG‘á¶(®à…:1CðÕTç5+º¸šqya×r1œw++ª×¼ å“ó‚vDAËåk‡]¤€à…·ßl/¼%†¿†‹o–PÕÿl·5=ñ^Í]„'=;]³]äy!>CÜgqªåù4ø¡Í‡ÿríWY†èŒòÕÁ’å]*ŸÛ^(¤Ä¨™s ž_øæX¸|üÂë>†¿‡Þ¯3sñåž+Nõ$èo°Ê:|–çHHZåö ~¤&ªjŠ®¶ XÓÙý°pÅø…|ý[yáÏ’N7Ié/¿°!Á¹AÖˆ)þäÏoä…æ„Œÿ:ÕOt/°à^caæõ7óÂëÁø9/Ü(¥?Ì çñÚðë=Àl‘ÝæÈX¥KÖ—užrl¹#lðrüX`!O°YðƒÂÇbÀ´ÄûòÙá#¤÷e -* P¯É@þû¥ÁP¬‘Å'ïØEöÂJôh?Rì ‹Aq ®×–ˆ†n”Ò?x!Þî£aï¾4Á$†tc H,^VŠw²í‰BÀöÊN¿Ê"»ËÚC†°¡é^¬Ó€O´kƒÝêˆÐè]ÀNñ˜g¸äYcì-#ðè1;K°£$ŠiÔ«&%±ß¹nàðt-ú‘OX¸¤M=ÖM¨EÁ¶JÅåºl¾™|Ÿÿ­¼[cŒþS/Zõz^hŒ - -r¡^g/µÙ…$”ÆÛÎÛˆR½îù^({ƒÎ,„žÞà GÅó„èí>ÐÃC@7xr3Cc!R6ˆ«xa%-5ËT’‚êUé.U‘ŒGRJk•5#hPÓÐ/QýÚàN+ž´áã"¾Í^ËQ¢htë30§‚®tóÊfÆb ç6¼aѵ©6ÓA]vfƒ[¦y·5‘f]?„Âõ+塽d©Ê#×ÃÛ›JE™j׈ ‘ÊdDÒ«y¡Õ­ox -Xàz31AGjmˆFòV™- {F8àûJT~µ x± S·,®ê{332³•t½*Ðd¡…KÁ².ß}>­xþ¼yiûÚªã­N„¥ßÀ ž¯"rq3/¨Z$j{£¨9½ØôG¡Èïv涅áÁ™SÜmN³Ö}½uºœ2ÕØ™IÉgÏ;ÐbUkæà9“l¶×Ú ¤ˆHˆ{Õi ÈÎ<É0å X)‘×£•ê 3¸CquÿÂTÂðiFOrg»Îº´"¥,u>Õñ•HWjÈm¾"‘·û‘šüd1D7òB­!î ÛÚÙMq¬X .õ£7׎ YcÔºùá0rNE¥/ ›pyõ¶ ³Lćñ»eGB5i…ëÛ«y¡kHÞµž«Û²ðÂ`ôÜ!Þ¥€…ØØaŒnå…¸R°P×f‘ZfÎBi“‚ÞG÷ö‡Nw7ô—«x²h‰}9,!R%r<’Š‹U…­¨×>Çö› -•ÎqˆM«xð‹^Å |£AÃT4k°ëÄ+j0b;óã¡«a¬|[à–±}5/ô3Ž­¶ƒ\Óºî -V÷f”´gŽ3»–WçGJÆ¢ÉÉÛ1!CäÅ ÓhŸHhц˜¶…gl²vø?,|Ö¦â’ÁeéÒ©¸ëR©<Œ)84S Æk‡z0P-˜|#Å]ÛÏæn½G¿³8Y ué†þ…wxáп-áÙçú0âÚS(Ûà³á¢iQ/ÀBƒ©*»Òe#YyìAeKÌrI®î_xS™â¤]‡víÏâ/!îÓ|ª%öªE¦âžµ¤TÊÿ èûÌ);+î_inà}jLœFø¬U½pàTØè&ÝLß‘N«å^èPp臎{M¸VùÍ¥Ÿ@vmµRÏVä…¤:ìúX^8s%mÄpu¿óX¼ðè0ΡÂD5ÆÐðl•'Ûy»DÒÙj;†Žéc°pòDqª%–óˆíc€vBöÊÿÃ'¼€Jš©‚HÍƤF%‘eá nŸ«"äRQ/É öŽˆÍp Œ„&èæ^èÆ OÍ|¸Ë3^»6å…?ˆaS½žî…¸È³Ý R#1ðŽªÕ…åÔ ünxšs†ÛkEYeµjsôÁÙìÄS],µDûxvèpˆ)áA¯=¨–òÂì….N{°½ðGçúļð™œåˆOüH|9üŸ‹ÞÊ e}/€vRKË…¶wŠ#N{”C¼àG¾ÆÖ0h²{2ÇdbÑ-öÂ¥çA/¯,)–Ó02VëX04ì¶ÀØ<î_ZÑ‘B€¿ƒ˜~ íß˜Æ 7ï{ªÛ*koà…jÚÀƒþ±pÑH§> ëtO­x /°LÓò ¼ð¡½ÀZ°`u³‚!kk^~ª*Ï 1nÌ’w°}õ1ÖZŸ@ ®o°>)Ѭ®ˆW»Óø…æÔ£‡3ÕÝ Óÿ  Œ«L| ¤;Ì ->¾iMú¾C‚Û™\Ï /='Øe2Ro¶ýZWa -¬*ÊÆŽ7òB,äÍsT†n›õŒ¿ãÖõ².OfôyóhZåMgít³ V`"ŒOØÜïk"<ÉÆâCgô½ó©¦äšéšî5®íÌ•ÔÜ ô£X›S©Š¿ ¨,M‰Õˆ³…YÂY¹@ŸnSâ—i s=/`BÖÓ ­ð%HMkèßÒñi Üx¡¯iÒË>¡r­kQYo#ØpB6* -pÞž$YåožßùªÙï5®M$Ç¢þ^˜ßíSm^‰(ñ߆…nÖJ~ÄA)!dlül áŽt¢#DYækM”†gæ„Xé‹!-®æ…0C9†’FhÊ bá8‚‘·ðB¹Z͕ɸ"£pãÊÖ…)KVh À‚!ª•2‡æ‘üUyóîPî7Þ¹>Y 7mzÊ-#º¤dö[òø+y!C׊!ólçNx3â`b;›°`»¹K7wù ¼P®\ WYbx\‘œf.…g`½ -ƒF7ÓÉe @HÍGqIߘ7ï mêò?JËòý¼àe~"y=/  ÷ƒ³¡eÂmë w¾rPŸB…×[ìöâ'üÖÍc± 1^hñªð‰YŒãÞ5B6CÕ7ŽÔРüõyªhWNÞäGÚrg+mà°P¤ÄׄrÄf¥G½l"ÍM¼@f!´‰EAê(‘}ª&Æuƒaz ”ÅFG®ªûÜ òùy!æÿ#iZ#/œÒ1$G9ˆ“äj^Àù[z§¢0 ÇÂÿ!õ¥RMäZPTªMD]ê§á$ REÅB·%r,´t$ÂÓ"'/FN •­·ûSØJèMý ñç:Òˆ½¥¦ X¨OÔßÆ c̬fñÈ×ÞâLMA˜58fa\žèx -Ï‚óDZç·Z{Ò¡›wÒ@­â«&Äíã¨Oò¥êZ^° ç%8GZ‹jeË‚¨Øl¦D ÐyR½rZ×> ó6/b×e/±À\Â6PA²Ÿ•f™¢e âv^8ÙÎp!=Û¿ÂÂDÄM¼À[Æ´– xÁò!¢ªŠAù#AîÁ^èe¬uî2šDSR?ýü ØLõmfMYÝI/[ ·ï'4ªÆÃÈÜY[|C³ÖEü`^xI+œÓB4ÓÕ:ö£÷Þ÷ XèÜÔÕJÅÐîjÓ‡$ú‘˜R«rm;ùC±€™¯QÚÁH¥¡éIºþ%ð‚1^€ ncf hÜ H‰¸‰‚ÄM”À_!Ü Êýì„…í…°ÒÎ +ïÄÚ¹Š±ÎñàX©ƒ›$çTv*ªŸ~þ…La¨6Y2G¦Þ:š4¸ºßÚãÙ½U½à†æ¤{´½pJ+,—æ¤õ_«#áøÆò F:FN O•;Ä­‚½Ð­•›‡«Œ–= @ØÏÏHî[e}E81e[ÃÀ^XvûÁ„Y>íáÿ/DaâJ…’J‡äo•*~¤ö6?êH¬à ª€kR0¹¸-I„sÕI™£ò”ý?ÒŒ£¿A­sS˜Ñ½'%$Ô^»(æ¾mÔ˜:‹È÷P?Ò1Ô7ûÂ"h‹{”}é;ƒÀh®€‹æ$ºµsþ%!ÛšÓÃömù°0×a¹õóŸ%Á’ØíÏB×>Ö@¼|ÒÃÿ5^½X†"Â…âÐMåOIò"UßÖ¿€½ =¨s=]ë$ËeOë8?ÌRXRÚ¹¬{°©*¯×ö­ö‚>¤JÃý@§Œ+ FCÃë0´jËëgÇ`ΩèÑ~¤SZá1\ïGjÀ8ecÕøt¬ý2F  Ú<Âñ½óÑ2ˆÇŒv3JeÒÚéJ7Ò“Æ©.ü =zƒ_èwaÙõö¿–Øá– æ8ÛyY×Û< ¥”õ•ãÚ¾•°ÕG,àLÈ †} -¯5'Ë!#`ÁÌ£Jè4~tÿÂËÔ…GWÒ }$ãûóŠ÷)¹ÖcôXøb®ìüÆÕ’Ÿ©Râ±¼àå‘LA)/,$N a1Yö ~ÃKs®ëÓÕ*DƒŽUL¯=:û@嵎+çŠwN‹…й‰ b3ζ«› ‘‹þâÔŸæ…É)Œ=Í·BÆFS§—•®=/âZ¦-qª–ÔR¦IK€%€3H%dâÒE½é~ŽþŽÉμµ#£Nà¤.Ú¼Q2æ—\0ÙüX^‰{^Î |¶rZ8OŽÀ÷('KWífê§kA=U*n$C¾aA-©rthÄÅBŽÉ-1ú¥é ž“Rä\jÍÓóÂ4d)e=ã5ny=€0µýJ -F{ÉÖȪDkV®Âw¼¬ T#°'²E½ŽW}{0-â(Dñ7¯üJØÇPWxu([O–Ù<˜Ή!¾‚°èºáع¬]>8eÆõ0­£§S˜(2äU]kà…“G"FŒÍ˜wùäãbaA,L‡‘–<òf8Ú _ÀÂÛ =“².kÒŠ:¶|-ë|tå®5°E$.ÒœÕrÈ[†5òBÃ÷ð/îÓ #jUFc¶mÕ6åßœæ´b¸œlQuJq<Ïä3Ð{Ô€‘ª`AD8»Š‹ŽSp„ï ;ŠÇc!A–Üö8i±J‚í,R¼‘ #ýïè©Ÿç…ÐKPÊV-õàªHeŒª‚‘~Íy’[Ufn¨sU^P†ö–ÐÔ¥ýú‘¸nDœ«8ˈÒÆ3Q¼°ï§ lbŽw™Eu¦-˜M†§Ícyáe†&WÙ x¨Ò[Ë”ô­Ó•ã´© NRÒYØ»:bA aÜ;ÐiΈ…üš¨Ó»„Sœ+57Û á~j^Ó¡— ^­â¤“õŒ™Á)ëœ'¢ÀšH%kCñÖÈ( á„,ŒU°ç³ŒãpÛ†Õ(j‘[ 0èXïS¼7:æB„¼®Q%Q¸@½ pH:ý`{!@àøFúKya<Ê`®œ&ð£r¤@\Œ`ÓIîÀXv8ØqX3î¡Kõe×¼Ô§ºez™Õ-Îe_´]W×ö”fí~f^({Úƒ.¢,Âþ…dX°/-ŠJÙ/Y¾²Öe9Ø4Ä(Q2EC/׺Ýñü$~$ÎÇs?wí©­z€æåpíºÙFóHÔ³;²M]Êì…X¸†Έ!Ê/ä…ÁÛÕ\ÌzÒTœðQ€jÍn—;¨kK|g˜´?Ò8¹µÕ–‰ó¤Ré#±°’OÿÂSðBÝC–¥Qˆ@Í«Lá2IÏ-á²Oa!K×Ó®¥Œª"Kd0³a‰N’ô-Ø7ôºýÖx¤Qýßwäç7w>«ßš§ø`4”a¦ç&¿ ?Á 2Rèu¶”Ô ÞÀQ¹óT/u‚{p¢×㮵•Ñ˜£.AÑ°„dŒUÎ2ìt˜Ø“k»Èqÿ¿p½'/xÝï(z½• sôbÇÛØ€y¬ÅoÅÂOð‚ŒÜ°ö}áfT.ãHi1¹óÁÍu⦚ö´¯»¦‰+ëµêÙìSërËÙ O5Þù¢kôÍ5X¸’N®¤{<uÊZâKÜur@ŒüZ,ü/äja ë«*wY\–ljå[,¨ACál×A0}¢ -Q®²WVDóZžxaϳ}+é.¼àp -:m“³åÎÀiùÎ —ð -¸d“K+ºÁ~ƒ…HQžçÉi× (DO  …=ÅLXE"Wˆ/üp/£7ÁiÄU„‰^çt®132üõ?Ê WÒ}xAÍÖ8·f§jÚyáb^ÐÝÜf}\¨Ðñ°ðFG:ñ¶k½‚µ°T\­`eË0q‘@‰sJžÂ^dŒòeË\›¬‹šAixÕϺº.Ç"î…«yÁÇáîÁ }ˆã&)˜ /XØyáB{!Gw\)—â\#™¡Jxy˜¥ y!Ø 5êH¨|X準"B#:‹±k›¸ =[\KžÂ“<4('¡M©¸ÏÕ,BzÄBÛ³,s…XM:@£¾+ØãyÁÓún¼@òÓj¤AYs¶óÂå~¤TnÙŽïcQ‚:&l}k;¶]ÁLâ8^\. ‰bÁ -@ `¡f­sßÍ ïÚ Ûô#ÒtˤØÄÀ ô5*!p $SdƉ¾:ÒqИ*¥54®™âZñúá¼€3TÝÓ^À'SP28Ò±ÐÄñ¯ÃÂÙ ›€¯˜9ÛÎœçMå¸6ºc…F x„Y€’#lÊ{4±¥Làs6¤`2ôe]÷ö±EÑrRg'üÁ $dƒ‚š.pl Nà[Ú« “òÖ»ôñ¼Ð`*£;ñÂá…¡Ù*‡Ó†©šŠZñÛ°ð#¼´GC¹îG­»^Öy7[k 9„ 5mg +æ„w-Yjµ°¯ZfZ· +ëeàÔILŸŽGŠ9Jz·ú3,¼å…Œ …Âi#©Š;§³ÚWŽ¡XõÎ}I²ÇóBHA^Xõ|Êe¯ ÑfÖ5ªad†ü:,üLNõUºà:J>‰è>íú^ŠáŸ¶Ä žõ u"WýX€ãG^V!¿!EoÓ DF ßÁ h1<8Ÿj¯oO4üOðÂ'ÙõµƒžÀt¬ÊH™,Åô¹ëªª˜|:Ë­t…¥É351¥óTeÞð%%6Ìöu,ÜÄ >—î;¿CöùN(oç­úLòåÓÍ¿ ì©%Œ4Ø ìÐ9Y-©Ão5ÊrœŸöÃQ’ ~µ °`óïàÏèߘgûoá…:_^çG­?ݖʧžßYįmÌ×)…¥ŠÃ#ãÓøÇOÊxá–9mÿZ,ü4/”ÇÿÐ8–Ûæ0;IM[º Ü9XÛ¶{Y÷z‘O<_Û›²¼q”Öê"ýä¼àÅcUU–ö|džn¾¶ 17ÂKº†~Ò— ŸD¨ .áÕÆ–Ãö¦–A©>xTYvodü[xÁÄ1ã˱†Rg{èÐ}ìTÈÅͦ-'÷Î _ã…’Ye¤æ$–Ô€ýRÂ2"²TPÍ¥ÎeÏ9éAGé)&à†Cyxÿdó/Ä–RùXke&–G¥9ñ ï1Š,^´„(cLgœpBL-0Λñ\à¡©¯~oñçä…CR´ã¶3g…Œ&âF¯ÃjóˆÁ~ºMÎ6P•Œ,¸!Rz´DQJt4(Û“Ô²s ‚·V¥’€ŽTJ£Ù“Íï<’\f.ʤ’©Äw 8Ϧá8­÷9Yb@;³œ®¤«kk¤$q¦æìB½Ðb)#續¸eTE2,º@@’2ÄÂÎ ðF\/²os)³;Ør¶X%m"'»Ä¹Õ-ì^Ãïz•´Õv‘k‘ÊÇ»ÉçŠGj0ù´·:>TiÃ[Á­<ó¸%#  -É(S&š\º,•[#E=¯<·ù²¸.~¿î)yAmý Iä8wjúÃi{À`ÀéÜæت^P;/|Ö:–kÍä€]Æu "1$[2ÙË- vØ>%îþF–OÄñ!GÎÈac¡sžJ‚´#äŒ#×&ĤB¤RâIFA^ÆüëJªä·ø‘ÂÔçP°D,ä>ß å:lj·B/Ãå9?þe^x7ÚèýSÌöŸ1?n/l¼ µ8úD¤µ1±¶ ¸U"<Ùxß1Ë…oÍa‡Æç}­¢ß §’;ý ©ù‡ãT/)uòGlÞÏÇ#u„ŠÅ Í 1}g3ˆ…‰€L‹fr€B{ÕÆq7'ŽêœI/R·È °ðüðrž0Ú_…ß6ÿ‡1Û?ïGª5á¤!=n,Ô -øÆL8“g*¤y º¶ªœj {e5ÞaoW­¯É×u¤gá…0sõÎ ?Ç ïÏ¿ðãñHÉ‚ó:3qÒ©·ÿaJQäø®©ð"¶Î…øphyöįㅫà³óÂyá ǵ=®<)/$ã4‰¯­Æ6{F,ì¼p7{á{±ðó¼0½©j¾‰×̪Þy᡼°çÙ~/j0n„DS€‰¸Á9G2×máÙ>®Îëé2ÔqY„ñz1®ÅŸ¨¾r¯&_µ®ç…g˜¯íoã…œ;gϸæ!™&½ïHæ2 ÎpL¦êG✮sç\ëîTç#Œž¡¤ÃÃ1 %#Vñø¼‘úJö¤v^x"^H”gGJ¡·Ø…6"4šÚõƒsUëH“83X×RíôÒ+UÍ® -Á“àvi}`)Îï¶ûJëÎ »½ðD¼0bJ' Š§ói{@¡tÜg[Tv)è*;¨§ `Òºî ·µž(1a°*W‹7r…‹ž »iç…Ï.yÌFWxu¼BZ§I¢ï:¬áÞ\a=ÀþŠEšÞñ`Ñ…Ÿˆ…î­Ý½<v^Øí…OJ‡ˆ¥Ç«cåÎ Þ‰"ЮgÛ ~2,¤°µËó4o`AŒFgó|ÉAGzŠ^}‰;/ìöÂñÂâø’)—4ÇáÍ8¦söÜñæ•ÍfWë0#ZGaÿ5Ça|°hU‰#”ò.`Atš k}®'L°IŸ »i·>ó¨V*L¼“£Âêÿà;r”Á‡àJF\­t“`eJ)…»0Tq"G1MjÄ—Q3E ÏÕîGÚyáwñÆ$ F‡œê1f} ¡ç‡yÆyâ™Ä`í:Ä™„Û:Ä“ÄQ$ÜØ݇{únµî¼°Û OÌ *“Kž »iç…o/Â|©ÕÝyaï_øëy¡ùÚp·v{á¯ç…/–p^YîñHÿ˜½ðœXxŸ*…¸·¼PÒ¨¾ 5–çÌ›'å·`án¼ 过…ÓÄâk¼`øt B–„øK¼ S¥sv)(–þ)í…”ÌýuõÕü/àLYÿ¨Á˜Õ[^xy«ñÙU´s· a ØårzŒõ/”õya˜™SG¡'{†Ò±W'z‡øX€Æw¾”ðyº Ñ°px’\‚¡œ¹åÑNÏÏèž ÃBäæ©r³xU¨KOËìl£Á̺¯œ˜t$–ûáU^ý°9›| uO:Ï Ñs"ò¶ÀiÉ-îM½»Z}zL@Cq Pžñ½µ7>ÛéŽõ¯ë CS+^Åxú+Zg¿‹ÑñÓòRÕ×b!nZ×¾w³åá<•Ñ^Åðõ~ÀÂ÷„Œ¯NDÈù£…?xáãXÜð§^êä¬Öæ—çùóïð<6º !Ý'åêµ- ¤¸áѺÓå60ðAüKXPœ¼•ç<Ï6ꀄõÚk'pçš4?ƒ ‹Ïÿš< !•ì/RÏ<‹g牛?íÔq[¥½o/ÐÏF¢„癓ËÞ:Ô—ú0.a~Ï^Š¿É^xyÄ‚y>$< eÕu]›Ñt w\ª/WùÄ´lH¸Ä‘TöÓlm—{U?ò©~¿éb$€~„õ5ößéS=ù‘¤zN$Qƒ<ˆ™4ˆtžƒ Íņ…¾™U’«ö¤O…¿‰þ­qm?È a:® »n´íqþ”ÞE©k¨ëY¹Àõ~Ʀ‰LBE‚´¾ââé±°óÂn/\\bœŠw -š^0$Ž˜¸"ƒ-ÇÈÄÖ/•û‚ Þî~¤Ý^ø+y!;ð‚é/PÜ[×'Â'†yAL5‘õù±°û‘v{á -{¡C{¡e™‹¼á}mxS¨D´ªÖ¦ۼՋجdˆ¿™¿”fç…~Ÿi4èGÒgœëáKS/­"(€b¨·Ö·ÆЖ$‰pLÇò °°Û »½pÅÁ¤û@Ðm8+Ý\D}‚uÝPÌ-Æb -Ó–3,ãÍ/ÀÂîGÚyኆñD¾ê¢íEƒ9v^Øû~/øÚʨý*"҉߀…Ý^Øyá*WÒ%Ò}å}î¼°Ç#ý^ø–²óÂÎ Ï Íôv—dxuIšú¨º„ „{¾ÎR¢Ùí…Ý^¸üóÖä­È«KNÆgü‚ -žZ€0}ôËöŸŽ)ŒÍ²û‘¾òwd#Ê¢äèyüMö4¢ðwÈÿPCÛ[ñ& ý R Ú7­mh/ã“i¦y~9ºÁ£­EÌWQögòLÜŒ…óñÓ`F†;ñÂOd>K}šþüð‰½ë?_m¤te}gï‹…o°ôäÛÊ(Mmn ¾!6ñ½UÆjpÈmKTBÝ)>ék!*BHÑ4öptÊI˜GYÉ ®téä°k®i+g›[±Ðä*Ó%öµ…{óý°Àk(ûdaTä¶Bð›ãÏ°p /4ðF›ÑÛ;Ùw{á–T‡ºÞ.z̬>r4bÕXó‹xAΕ%„7Œ´uá’‰‡›<œÓTi_8Ÿ:T€¬YÑEmó6Ona•£žàÑ€7ÊÉEµ1”’çÊÂå3V¨¤ádÌî 7\±(Õú”pnJ_ErXÍÕâ{XC8wã2žL‹Xˆë§â…'ˆGZxã‹Â’YBÃÉM¨øœ¨9* ¬ã&ý=¼€±Öh2 NTx EXÀ»˜'‘(Œ¯`Ú]5Æø’§ ùâU¹'U0*ÂpOc12C44ó,b"|©›y!siƒ)ÀÚ¶)Uå…Aœ.L:Ë„1*ë©üýxá`¢´b¡"ÔÉÎ çe„&¨%·¡u?(¬y6ó>7¨#YS.*ÿE¼ü­vª˜ÝÔ€ʵàÉ€ (H Z1Q¥? Ù,'Ð8z0 AÁšCôjÌa‡‚C%aÊ>ë?k.â… ùJ¾m}å†%íBÞà‚2'Ñ癫ü½x¡á:†AˆkߪTZR>/<½€œ D‚)ÐÁÒš@" X.‹"Þý*^À hS,а0)Iq"ÎT »Ž=æ:Ë/4êòò€…ÌxŽ• ‚³0Ĝƌ˜+½lør'^ÀáBˆ…ÎcwAÂd[ÒPM¸vÓýx!€y©E -Á¤šnå…²¼K&Œçð#™þƒb`»%5ŒwAD,$hnééWñ‚ X)‘Þ54¾-Hg®’^e¾± ±Ð6ÄŠØ,hð',Œp4mHëæÈ … ÇdžßŽXAQC†XØxhÙÄ®¸/> -!âfSýâ WU7ò‚”}/å—Äýó´ôOÑ¿ ¡ -uµñ‚½ ¨£9òBðX~/ –ÚÏL4Ñh6Ph_ ‰@PáK¿`¡ÃÑÿ`¦^•Öšg,4 Žåšòbú$皘µ¹ ò‚…ÑôŒXIáÞÎt$7Ïf7ÞÑ^8øn/••kMåm¼À͉Ž¾LµìsZ>»½Ph׸ÕÚÍ8踂‚Б¬p˯á…&§>Ù®—Ø‹´J…ïá˜~šúj5©†>ñý›ÜUH™Fƒ õÝ,ÕÀ(õ8ás5x4öX‹e`4N=´ l¨ÒØ7‘¼G_¨¥™Æ÷]øHñ&â`É–áe0’‡´ï9á|´V|‚½ëüH›½À5²/7ñ›œ®&¢"¹â%˜7¸ “Oáÿ>¶_¸6®øzü [êòã‘""|ozX¼,ô¼‰[žù5óKêEeí=Ö¿# YD}ÇÜ’_Ç…‹mß¾^šIèR`‡á¸À’çý¸gï^p­t| /ÈÈÍqSee-iÒƒ®DÃwOÃTn}-“°¶_“º%$¥\û¾OÞNø¼ÐØÉß½I ¹Ï¾¨ü~È ¬PTb®í¥^-Q$c o‰âQÏ3&Sž¬~-°V+/¿O´‚­,Å4Tìã‘"ž/NµÎ£»fþ·âTã™]GJ9«”v.J_r5ÙÊxælV µŠ&Î yG"©IB5‘ƒ³Ã›i|ž%)ù.,}~çŸä…kˇ¼[ŽÕ^²žŒBÖj¦®B‘©¨WÅ꺞FjJÔ ÄÈY..M].ê}¼óðBÚ¿ ?Ë ¬%+ü’ù¨Œ­RkzR-kR ¤œÑZØšJ6ò2u/©ûcr·ß6~!.Þ¨Öyú;x!"É/ÁÂzYýü0/ÈÔe¢–±!”±\ ð -ÖHÖÐljY¿¦@ €…–ËÜer¥i¬QÿòüHìmøJdä¯à…ÜE¿ Ã…sx}d¾`ùÿ0¼ær^(k­²$išDuá–Ä^¨eB\ÎÀ>ˆdáòÀ …ŠJÎûºSÉà¢'å…xÁMq¾0ßô"‚/Šwk -2$Ö>MµÙP™9HY/è”h»_Á ùa^¹&íæ‰ù2‹ÚO•w]2H1 ,³¨‘ùD6W¼ýº˜+ö@,àhˆfó— -¬Rìð )\q1 ±€F‘ý×ÞÙ°7ª2aDEbŒ(*ÿÿ_¾3¤{v÷=Ûm³Ö»ezõjjÓø7ÃPìäBußüô­V¤äã\Xjp×rÝ47§Ñô‘šÆ›æÒ€ .„£j‚£KÓ,JIÁS3É…ø ”98æ_g´wÆ1ÖX‡ÉZÃÎÍ’Ö3ÃdAD?GêØÁû°±X^K¿{2.¨Ä…Þ*Rð5óPQm>¦¹ucð×@CäI0›‹+q¹æ0-ŒŒ¸¶÷Žjc”œ -¥H›[EB:µŠT#T~ÆM`o­(m~“Tü7ó΀z¤Åe½^Áih.7z»\(ÅÉœbø~^ËöÖܪ‘¾ü~Âx¤Þ˜¾qÂxðÿ}óþD¯ð`ÓÀ#(I}….à¢.Q×\‰VÉ~Tk· Ž[¬¯=ÁSrû1Æií’cT6Å¢N TŠñ±Ó˜e•R<‹sÑâ-ù(-`ob Q“>RE=[)™JKd˜¤ÌôËæeØœ˜7º“ w'ïV-VÆÖ†7_‘ÖÒuà¿Ë:+{½ú8°›}„ôâþó>­œdðíèË44èæòò®ËõœñH«’8ЂóþÒXö&`x[¥µf檮ñJ˜–Øv`Œ@d&é­qUÀk±2çâ‚øæ/ˆÙ2Å*˜ +…zxE-`T«¬'³Qá¬ÚEF,4Íþ(-´Û|éWßg}yÅhXªZ^¶]O×]ü.bþ\¨ o~½qÁ|™£2à$ñŽ¸Ç ‚‡»¶××2|™õ +oP 7W`6jbgZRŽjÃTQ,[>95—ŠNI #F•Í÷¤ÔŸ‰ A™Áo\`Së†já¢dÒô‘ ûnï·s=#!„©:J Ѫ´¹<œØQ0Etƒ€í†Ý{%p‰•PÍ=Ro6µ©>·Æ0uLK¼.¶.âÂ%ô i+~ÓGú2ù‘ -\Èåj\ Ö™T· 4ŠP(Üv…WvJŽÐZÝ”Ä5c¨…F‰ÏÁúÏ3°[™¸àB¯&L½}ï#ßc…–X pÌ}PåQZàœ×NU¬ñ¼—ƒ2ȸJo²¬O%°Ÿ õ²TÐ;‚ËJÉöK¥eÒ|.ë"_º‰lâ—çB¬IgYS“©#÷õ„Äí¡”zÏ:‹ó‡ Àcµ”JÌtÌcû•´ ^ÓíÙ¸ »WSÄH¶k’ñPqu ¾38IË´¯äÄâ@.†ÍÓf òØÖ>ª¾÷k¡&+4ëc,1÷´&‚[•i‘))*Æá®À…»¿°ÀeIÔB¡: ¯Q =hÁ8=N¤_•ü¯¹p†x$9×Pz´ž¡†´¸¤ã¶Z¬´í\¯±Ä œ®u n)"¯0F0ã÷ä?ÅüÂm²Ð÷ï¢ð^K½^ 7ë -ú “®r0õ2Æ›5VÌ"òÚŽ¸ºÛGç%ˆSe¸@ŠºÃš6*g€ÉËæÊV£t¬RiÝÍ…ñÅ÷F-”¸t¸'^¸Zhðj'Õ_þl)çÙþ§Á`ôSÌ/üÚîÃJÿª¹7Ja˜ 硨ºG:«”ü[Ö ÂØ·u mS/¯¢ÅÂ#o›]\_æV– >G+;§$ üW¢9ñcPªh”_… ‡Ä#Õ¯æeÿqªVy£þåüs†ƒ,ôp-¼œíÆv„½ƒ tzÙq"eΟ7 ÃiEÐ_ëúkßfa‡½.ÚϧºLúaQOÝŸ¤…J‘f‡ržíõŽ°œgûZ(Äž–/çÙ> ÕÂÂÌü°Ã©Çjag-Íy¶Ïâ/| -.´ß;!e÷vdùyv›êÌZÈy¶30Ì‘÷MLêíGëþ/éuË.'ÖBæBöqUGÑ…º/Ãfe”6Ìe¼Žb¨d5ºˆ|líWô+â0AR€7F!:{MyÔ2²¿ð7paQמã7]åE«ÌÀL)a]·9Ë\Á‰bÓ¸Áaëb Á¨6jÅÜ-ZÆÏ«…<Ž”ý…GúHªIÑÙƒ>8œÏUE7SO \TÕòc\ö‘$íY§TíFÏ«…Ì…Ì…G¹P§ìÀB5\ Ŷ)©wÝXû{¹À¿6“ícLíç9ë½m_C Ù>.~¯Nl쯻!D‘üýAßnW³`g¾=ó×sá1£ºendstream +xÚ¥ksÛ6ò»…Æ÷¡T'¢ ’à#÷;iZw®i.V®w“f¦DIK¤JRv=ýóÝHÈ’Ü7›Àb±Xì{a5 +àG2íQ>J3åGY6šo/‚Ñ +V¾½P‚1”‰ƒs3½¸z§“‘ +ü<ÈGÓå@Gû±ŽFÓÅgïÍwצß|O¢(òTî'išyo>}+>Þ¾ŸÞ¾ÿg1•÷é.ÿøqœEÞ”‘nßË×?Ü\ó,òƒñ—é÷ßL{N{€«Ùüõâó—`´€+}øQžaø +–·À§¯ãH曋»‹÷¤x-ñ®SR±¸Yê—%—(?N¢^r!¬*?×Ú•œ|Ä$9 ©B®«@hZ ‰<ôšñDy%@J³!$‰÷A¦37¦-’zïaS´çd#§¼Èí€CÜ*}BÏ*ñ£„˜E}ä‰÷œ[V ø[ÃÔ{lü~Êߟ f›²‡™×Á\áŠöîŠæAEØ÷4)ðf;Ø tºÆÌ‘î=oª—ü5› ¯ãµ«eÝÀgËBAH]ñjc¢X,Šïìj^j .,­Îž›zx¡}‡‹Oý>˜<"/¦Y ˜Az…Æ“<Ê·±7G ÷Î=^ÓÞ 'OŒ×â*Y£p”·b°ÝÂjˆˆl-ñNAäuë‚¢] æK.?«²íš§K° Üåͦ,˜oúuoEÒô +ߦ¦jéžECBˆËvS˜…ð{,„%R­Aq§|ŽákœÅÞ+_/¬ÒH‰¸l:Ð$ðyüͽ½è‰góºú9P1¾Ç“@Û¨j\b¼ŽÔ_­Z>Õ4­Á;±¾¼g&úÅñ#É£³šÀDŠdW3ŠþøÎéäUÉÆ£XmOÈP10³ÅÓg8Â8‚Q¶D¾÷·ÿePMü< õ¾Ý<1”\«új¬H…XFËŠ%WY3]9çž­„aä>$+±æ× ¼FÞ2šy3ÙM›{Lº¨Z÷€w­+MRaÇÍÐqc` +OŽÃ„sÇ0qÞXúÓ‘~¹¬–ä[«g‚1¾á)ñV4ä%ö Žð5†Ñn1c,4 Ž€‹é(Œ).MßÞð¦¿ógŠrh†H‹°·¬1¾¿aØ ‰¡-0–ù' bºæ£ÈëWðÖ7/'pý9G-ö4ks4¼zkXsµAàìª2WBœ"ÌsÏRD±_ V›²…‚B„ ò|GFÏj`ÇaxSl–Äã6C¬à;_œ íœpß›ÖïÐg¯8·»8|p¿n}Î êv3ïω¼þˆ+­7Èþ4ÿL:LTæÇÙËéÐÁ9›¼uù*È“w(Éû¦¬Ì8"ÿâ=Ž@iƒ>ÙÎ?ýÎœ³‰ZëÌÏvůñ%áà Q‰m´ª;¬QŠû­©xŠÑÞÌHýx- `f/QoEœVJ:¼Úºd0~£$'*Íü$9'º¼(<ÃR§ÞÛÔolpª hÝr¸í%*¤*§ÞÚ¼w€ZP—’LŽ•ÌÒ2|[®Öö¢°ÃѼ¨ù‹¦˜’‘+Ñ¡Ö¤SŒËF?ÔW–Ièc­éÌÑÚ¡e™ŽÑ¹Ò†”QWnéœcÅSóŠâ1ªÅ¡¸g"õ‡0˜¤CôãUT¢ë«–×,÷°ìá<œP95Ôÿ0gÂêz] +TìÊ_Žìu%Œþ0&-Ûð› ™'ÆÈdä‚Nì=iÞÀ–bШ°ÿÛ;¡y²mf +D¡ÂVHÒT‡³!q!’hVPtÏ7Ò(¦›—L-S£Ja鑳JqaKj„óE…©ºíÅ4³§>–`fÇ‘h‡žÂ‰ –œâä“øYu®&‰ãÔ×QþbæwpÎÖ$qú*‰k’Hj’¡ÆÚ’ê<׺ðlëÜB ¤²?ãnÀ9[—€ùAHÌÝ¢ðó˜ì¿òð$Ð펔R7éû„Û_#û 2¼á±c)y|T±"¬)¶†zC m¡ÝtÚs†×ncÅM'œÈ- ,?R™I¶‹O‰¸ÛÑžƒå(þ°zùnxT(ÜsõÈÀ˜d¯XCqƒŒvf·³fKUWäìöìx­7©À­]Ž# Ês_C%ËñkQŸˆpJû‰²©mU[óºiÐþwÐ/ ¿¥!õV×'2iúQž{°· ë/UÞ$çï/ôüS.¨]„ùAºýåS`ÿ¡šëR$rf8nÅPǧità±”G€¨V½¦ZUµTJZjXm ·U3d­8QS’Ü,Â`´“ôPðxAí¿YÉÔÈ~Ö:½ci%P.—µòÄöëh„36×ÞLš=vRTŸ’ÍDÐ Ýœ‹*,W±C‹„X$w™KóÊ×=f”ŒR¨øºľWœG‘³4JÅ>Iuœ¦Ã^º: ×$€4šôÄ2iz*†ï#¨N·’f‡wš;%~š a'áH#(µ•@ þ?,U©_€IUÈÁgªKAؘ̭° iÕy…Ÿ aÐ÷²Gx“mŸa"Sä#²sÙ7K¤Ö”‚2¨Rïdž‘†ÆÖŸ=ùÀòV¢ ךգ3.øÅÔ9‘£­bàY?2Ђ˜H¹-Îå®(Ð~¦^îZœ³¹+„²4RéaîŠ%w}jɆVœ¯ qÍÌüìÿ4Kaª©^y‰%çl +¡üW)§S·AŠ·]cxÞµ<£â€F´ŒE|×a +BО¬ Öz•ârˆ³þÙNaÔØXŠ}M«"Ïi»¤¼~1€”¬”µœ†g„òÉnË„: R°a6<­â~wj;WÇÖpXŒJ£}‹“%?Î8yaªb¨íÆ *z¤–w-O9µ¼í4«½}õ‘çAy1*;y9r"IË” ¯PÓ$"èо¬²• Oå½ætéÃF ý4ã +¥©ëî/`|¡>4·‘öÓ0;Ç'¤úú9.M?×; @ížþmYA­êûþ?¬XÃÔr&óŸ¢Áüu䜾ÀE 5>8j2K𮣺i¢ÑðîH÷;ÖØDpÛýrYþ¦”àÓ8ñŒ‘.ç‚z‚Öƒ°ðP4åòIŽ®B €¦h»º@¹ä/ ;þ'Ðq.‡®ÔW ú‰N|°® +[X—¢í5÷2˜i~ËÚïYÞ÷f#`„Í,>›ÐÁã#/sŸñúl¨óÓe0ü²€þ¯@Ått¾–ÖPâ‡Êò‚b‚Àùœ_e¾Î¢c†ÿWÓ:@endstream endobj -5752 0 obj << -/Length 105 +5891 0 obj << +/Type /Page +/Contents 5892 0 R +/Resources 5890 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5889 0 R +>> endobj +5893 0 obj << +/D [5891 0 R /XYZ 85.039 781.388 null] +>> endobj +1694 0 obj << +/D [5891 0 R /XYZ 85.039 761.463 null] +>> endobj +5894 0 obj << +/D [5891 0 R /XYZ 85.039 743.459 null] +>> endobj +1698 0 obj << +/D [5891 0 R /XYZ 85.039 618.484 null] +>> endobj +5895 0 obj << +/D [5891 0 R /XYZ 85.039 583.738 null] +>> endobj +1702 0 obj << +/D [5891 0 R /XYZ 85.039 447.539 null] +>> endobj +5896 0 obj << +/D [5891 0 R /XYZ 85.039 412.793 null] +>> endobj +1706 0 obj << +/D [5891 0 R /XYZ 85.039 305.814 null] +>> endobj +5897 0 obj << +/D [5891 0 R /XYZ 85.039 268.947 null] +>> endobj +5890 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5900 0 obj << +/Length 1800 /Filter /FlateDecode >> stream -xÚÁ¡@P[˜Àª¬ K¢(Š¢(þª‰¢*Jw‚ ‚óßC•RÖZãsNJiïsöÞ;çæœÂ£Öº÷nŒcÜ{)¥RJBˆ¢Öú}cL)e­åœ‡Zk€÷Þð<Ùendstream +xÚ½XKsãD¾ûW¸à"SHÖè­ÜX »˜]s €¢dib‹H1Ç›O?FŠüX.T‘T¢VOO¿¦û›¶ÅÒ‡_±ÌbÏóeš /̲eÙ.üåV¾[+áZw&óÕv±þ6N–Â÷r?_n^ôÄ^‡Ëmõ›óõ÷¯6Û×ïWn†ŽÈ½•›¦™óõ/›•p>0wóþþÝöþÝwøS8¿lpù§÷«,t¶,tÿîeùÕÛ¯^ñ[èù«?¶o¯·“§“àUŽnþ½øíYAHo¾æÙò´ï Xnà§G¡}o?Oªx-Zò®[Y‰ÃÌ‹³ð:-a|#-aâåqLiÑJ™ÏWnÄN3` Ïh.§uÌSûÎN«Ó ½ª0p’‚´*ënï™j·rƒöw¦Òõ“ÔóD R½®;3ŠÍ´³q´'l…–Ö݃ší-U×ÉÒÔª³ÑÉVC±—–ß»J·Ã¥ À܃Ǟ•;ù±Õ²š™Ûi ‰¡€÷­ê‘14Y%ÅŽ¯><_»ëüŠ(DòèF][¬Bvÿ‘­âTG±—‰ó¹Ÿñ0ƒ*&+ÙyÜRCb2˜îÇmÁÀu^oYÀNÀóqò®·¡³¤[F˱÷³Ž&i.@&%EKNá`UÒí¡PÃ#3ÖpÛ–&¤~(&\žÝFjÞ€C!×ú–g]°ßŠš/ùKƒÓA1QÛñ¯hËáIX=C7 ï*ŽÔ¢_ðJhÎ` J;6·P¥«ëžE¨ ê¦æ©çïC?Ôrßjøã0ÿÓwÓ˜ ³0¿ÝPqx}Á´\ú;~×qåð?bã…endstream endobj -5747 0 obj << -/D [5745 0 R /XYZ 85.039 781.388 null] +5899 0 obj << +/Type /Page +/Contents 5900 0 R +/Resources 5898 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5889 0 R +/Annots [ 5903 0 R 5904 0 R ] >> endobj -5748 0 obj << -/D [5745 0 R /XYZ 85.039 590.299 null] +5903 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [325.68 275.906 539.579 287.898] +/Subtype/Link/A<> >> endobj -5749 0 obj << -/D [5745 0 R /XYZ 85.039 590.299 null] +5904 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 262.357 131.853 274.349] +/Subtype/Link/A<> >> endobj -5750 0 obj << -/D [5745 0 R /XYZ 262.428 239.639 null] +5901 0 obj << +/D [5899 0 R /XYZ 85.039 781.388 null] >> endobj -5744 0 obj << -/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> -/XObject << /Im16 5319 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +1710 0 obj << +/D [5899 0 R /XYZ 85.039 544.376 null] >> endobj -5755 0 obj << -/Length 511 +5902 0 obj << +/D [5899 0 R /XYZ 85.039 499.301 null] +>> endobj +5898 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F20 2961 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5907 0 obj << +/Length 3800 /Filter /FlateDecode >> stream -xÚ¥SKOÛ@¾ûWìÑ>x²³ã}õ¡Ajj‚9)Ô€°BÛŸßY¯©N(’³óü¾™ý…ä -§A’Ö!sâq—HñÌ‘‹ÛŒ¼MÉrNªd¶0…@ ^zQýúh(4‰êé6=ý:/«óu–QŠ²ÜZ—žÞ”¦×Ñ[®—«j¹ºVÁNLoÊþ¾Î¥ULZ®†ðüÛÉÐ|Knï¥xâ‘. äøÃg Èá]ÂM´£6é€ð?M¼iendstream +xÚ¥ZëoÛFÿî¿B5pT4—o¦ŸÒ¤IÜK_â Úâ@‹´Ä E*$åÇýõ7¯%—¤äP–»ÃÙÙÙyüfhµpàŸZÄíxÉ"Š•íÅñb½;sXys¦„b%$+ƒæç볋×A¸PŽ8ÉâúvàØ~à-®³?¬—o_\]ÿòq¹ò<ÏR‰½\EQl½ü|µTÖ'ž½úxùþúòý|òaRYŸ¯pùÃÇeìY×Ltù~X~ñÛÏ/øɳå_׿žýrÝKÚËR%(æ·³?þré×3Çö’xqcÇV°¼;9íÀ÷ä¹<ûtö¯ž¯ù ~ë˜V4ÅÊ×ÿ?¶eNpt;g±R }Å'ùÐ[ðá‘&óéï*ˆ`‡ý]…þB); ¼«Ä±}zò#;Q>ÝÕû”Û-WÊʧZê0pí òãâÛBÙŽŸ$“c’~8M\\îÔâU b. I…íÊàK’ªØ°*å&v‹H…¶ŠÙ¬®·K”rå)׺…a½t#«ÁŽÄopEYçëþ­wiW¬qúœg×uµÎñyÏÇE [VÀ+¶î™öf¹‚‡œš|_¦ë<ÓK°òÈãn+²T,–²îĉ€å9¬·L·#Þ ©—îÍ'¡ía§ˆÏq¿ä=èöP.W %뜊ÕÄ6Eùùh«¦ÀÓœ£9 M†G_iN@BŒ +8©ï:,5N´$$P/VNÛŠN‰¢¾å_P(kJ sÙ^¤µÕ‘³µy½˜…À_P7üÆVYWº7÷ÔEÕñOžÁF¡“Xoù~s“IÌF«M™æ÷<ø sß QÍs|Y0xzžiJbÊä ŸÞàOK +z>õ¹d§ðß¼.4¡øh„M½2ÈÉö½À´ý OeÛuûç÷÷÷vYT‡‡}j*ª]7›‹¬)îòæßeÑvözSLeô]ø¹c§AMhf’¼rÊ %Ã;Š"ë’ŒÅç@‹>ðÃaÏ–±r"s4Òî¦A½fhŽ~H…¿¦½O ¼Ë<+««ghòèZ›¼3AÆe+d¡°YƦbÒ±3À`paÚ¯íÈÏKY½ºzÕšæü²9˜•á±Aâ=…G\7Ç[ª˜|O¯¸m×;=y¨Óƒ'œ_¿/Ê’GUÝÉÔ’#IL„_qZÑmy™’ë+:OlhÛê„óæMÚQÌKãœðÀ~”„V]ÊònÑ<5„i "Ÿ„-P¡+ß!…A*±‘”ãüC˜r°Ù—^eÕÉæ4{D\‘ +PZT=p˜Ò'Çq˃nN[:Ê_ƒðu…Ò« •ü‘éS­OâÅ£êzÍe¬"ÅQ&q¬ÑƇV/÷YH>¥:aAX¡:avòTŽcÚVÉ,kw7¼z芲èô0‘‚éc&r" ¦ØÞê»"–‘]݉Òê¤Ì[^—DëÅQÔ…õ/E•qò”Öe‘W]{äÒ«]¾k¹Hçx5<«Ž'Ñ/Sr„¯Ëî1ÎSŽi šÉËè97œ¥©6I­Pv[)3ÿBÞ!«¬rmÑ/™gm!ÔÔÍ#?lø´¹¼vcˆÄò"1 äéÇÞÐRª‰"ÜÈvVÄG–8g“" K|Ú±'w!UÅ¥5Ú-5 R¶¹"Ì:c]©€ +NSí–#¯Ó¢ÔB#…Pƒ™M2‚{¶çCÊUÆê;%‹¦^äóì0åIIÎq– 9Í4í{>åï‘,ÓÒDhž–À÷ÛG˜œü?9êüàñ]1€á•ø¶‹§6l2øYÓg2ñ¬À€·‹ [ßZ¾oyŠœœÈ`Pì +Þ +Á‚oÇk·)!½Nú®k¥#)l +‘)ÊE‡sF0Ĉá¹Þ©ø€ïÌ4AûIbA‚Yîš»}½§|\W„ý<ö\Æ(ÍÝ2ƒ%ÃLoJYawDZ«q¨‡”!¿_Ôa'E‡Æ 3«÷Q€¹¬Á«@ÄÒ ¡yQ!0Áœ‡4cÒ‘õ Áq½8¶ƒØûŽ'hê•A~Ä'm‹„¾íkÎ{þ÷Ú"B½2È秚òDù\?`1F¦2»hWEP]¸cq&šÕ4O áºÊöÜp$Y˜¡’'íÒÁ+0ù`>¤¤]Zé:m.3͵TæqÆ%<Øi CîQÔ‚hpîx†§AÙDbk£óÈ—¬¼âdd62vlšÀ*v©–2ßPÓzc‘+½>Ðâ2–Ôž˜ˆ8+¯8gÔñøI9Úç3‘Àh§À§ÅºXç?œ(o<߇üôW ƒ¦¯Ñ¦å‡•™«¦E•i~b…‰ÃUØ9–eˆ*o9ßëú9/_™\ÅÝõ¹Uö{FOËÍë'K27Æü‘Ì/´Â‡ÐV“³ýõÁ­Pn¸8\«à€‹Y~jny6;  H,c¢TÖ©Þ©›¯ iî\Ú+ ™>™•ç*!«X Ù®fĈ©¡_Nž ­®Àü‰ëǺ „‘}×òCüõø0¾ï[çWh渚­Cg½Øl)ÛÒÎÔ6<럒±5œBVèÑø»+$â¹wÚÉJ_Þâayß ­È"ByVUWº(!ñäøŸtžÛ{š»xd_+8%_Ñ ´Ý§5 À÷U4A>TTÄ}r¦ñ¡ãî(ø‘ß™G}å¾ +OQpüòóÕ'Q‹E¬‡>lˆUשԈGúŠíd­1(+vHˆC5ŠFÈ; êKNV¼ÿJj¨š»+zgüú¾ò¾¥¯pfÛ °¾@©“¨ÇJ~è¶)ÿ$¡z·+ò*}×rú´dÂ^„;F+¾&X©¤hæÝçoÈ9-©ÉmN6nì~)&kç'.Bü‹h@Løu0ÓsVï´ÔtÇÕ”SMÍ4í:­d÷*c‚u½— Mߦ<8pï´áõ7ï?_Póîëá9›çpÅÕ)(¤\ôdn7]ÙS©Dg$×Ê©Sá±Zk'aÒìc7¹ô¦ç qÙÔ<è̦·nD1(5õNRq›H8pfwµnƒ³1U<8Χ¢Ÿç¹}ßëSe-)»E<:Ÿ÷³Î¥F—ÌÜËŽv±“Q/%÷ºŸ ± ˜{I"RykÅÌøi3í ”PtãÒ½ë?ùd c;Xtº‘æîý´ÕB—L>šsõÞpÒÊø+¯QUúÉôS ¬Z./a‘ÓÌÑ›]¾d™¾ŒÀêæ qÍÊ·X˜͵æ÷_#ÜÈZýx8>N_v5’/Í(”–n¾&Õ±¾3QÆÛsRAT¼”/²ºë²ŒëB ùX‹ŠG’ù×"~§öñyºß¦èáÄo‡9ÒlrIÊY.8º-ëIv¾•uÂ#àën!í«W혒öüÊãš1Ä@TWfC,­=OZuü-W>á/í¦Ë#~¡Ç÷7m‡ßþ¹D½.^£?ÌŠÀÕ\ü‹;ÿ´L̔㰠ìÈÑ„Tà9œDãÈ«ò5 +'opÿ¢”YîªÈ—ž,¡ëJÝ_‰G5Ô¦÷R9çÐë,“ô·ìWqbÇ^B¤&_Íš¯¾nWÂ`›6x‰üñSw=}oh ͼãAlÿÛ£gúŽK\¥zÀ®_²¥6nßDUœ9ò±’æÉ~4ka„Øû~bÛâd;Âüt,ÊÂÖ×ßúûʸø\Br> endobj -5330 0 obj << -/Type /XObject -/Subtype /Image -/Width 780 -/Height 299 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5760 0 R] -/Length 23606 -/Filter /FlateDecode ->> -stream -xÚì]‰bã( c0¾ÀøÂ'üÿ_®„4í´³IštÚ³;ãø¶O¹:Úûmõ÷µéßzL”û¿¥ w´÷¹ó‰Òë11ó×`A9'ökûþ¥Ç$ø_„YµG{Ûr'Ç»±ðï<ÑUþeXhýÑÞ¶â3¼ðï<ÑöÀÂ…ßcaþWÓð·aa>DÿÀÂ…ƒ>ÄÂgì… /¼p`áà… ^8°p`áà…Ã^8°pðÂÁ ^8°p`áà… Ï™ÑÁ­ †yþÞVó0¿YÏç_]ã^­1k§,¼ðcì…Q*íÍ"ðML›Ó[óëV)®gù«×•Ë·’ÞÔ—ßx¿Ò®^ø!¼0:Wx.B¯Õµc}ÿÎÙ'úR¸ìD ø'+O¢¸C„;uI°ygáà»ltaÞ.^ˆ4ÿw±pðŸÆBçœë¼›XgßÝ*qÿ`¿ÏiinS|{†–…´.åNÚéäL¦ÜOÉβô–BY@À´Ø•"†Bª d=-Xsð‡­MÓžIґ׬É^ÈyM@ŸÒtÀÅ°ºKßX—7ö˜)4òËåtïl«†tüyX n‘ªl{hƒ[>ÀÂ¥Ö5AÆ eÔá5ÌYö2 Ü]Fš•ÎÉ< -‹‘ÔÁO9,4nò™+¶U.Ú/_E/üFŸuDcq;Agšº³"뇋=u)¾áºw´„Ÿoh6ÄNQýFt~ ¦êx¿õóì…ÎŹëÕΠÉHgk7í ØÔ¼é>d?Ù°}m½ RÉåkRixWývKͺ„ÝNÏÈ0ÆmXCœ"©ËƒrVÂ^ø@Ÿ…'4ÃS ì EM_žÂÌàBOjÑŸ=ˆm¯ÂÂ’S¹½¥sÓùô j·ÙŒ$Ôs´‹ßðBzöm -öÂT'f×}ø%3|à/IEg•ç±TÛ£Œ±(`žî2Û “: ¿íXþa,\Á Ž•fn7ÜÆðò½tõÐÿx©b#Ž8@b­Ó&¯wXTuÞœ°`²¢ÈÂî&îoêÁ“:üTõy‘]bÐoýXUwq‰r1ÇYˆ´&qÁ#‹³ ®¬â]9®I_4;dҲ貾ýÆX¨á&‘]_ñÂ8M1©§º½°Nv{ƒ¾ca~……Ñ©:(µ yäÓ¤½ÄÂ*Ùé.¦ÊȶÙücáÿï8 =e;¶ ­–ÙE÷‘û” ±VÙþw)ƒîF:Þe%0 xÃBâã–ŒrD#‹oÇæÊ y÷Ø°`¦  Š9—l:ßÁš|;hü‚ÿmømòû N]}k,@‡"O¼ >°ì…Mü °À6Iæ/§7ð( &<1Iñ - ø”ÂkU©´ÛË¥/ü/XêFµ›ŽäÌžÁ’Ë·”º¾qý®©€€Ÿ°PiéÆð>îXhœXWµm;¹&‹ Ý^%*®$/° ¬Ø^0ùš`““ýäÐëâ€?/\9l-ûŽtŽ·e°^b^;§oÂÂWÚ d1ì–Ýè—ò}Ä,Ó t߶^æ0ŽD±›€OB\Üèœ &Ší 7ŠY²#æ ’eÔš2Q›íˆíÁ ¿Åí]!ËédW™1¦=gËäâ4­¡óåg,X<Ã>>Ñàrº q†EÂ[¶”Jì -ìéØ…±aQ‘¥Ùk³ø ½_÷år·^°ùhÛawöyá¡ííÌô•æžÜ.ÿ&/hP2² ½ŠÃ;ï/lb;JIè¤/xá ñ»X€}ÅÒK»[sláù¶/Xˆ[~®²o±ãrû1–ÝÔר;ü#XøÊöOò‚Ťb¤Üt¤ÆÉ´%âbL(wØ­nWDßã…ÚYCv Œáv¶› ?¸b<圊lï‰|Qg¬{™÷ù ›í0¹mö^©náÚ,Xx/,¨­ø“½`“îrv4 “ ÛÃ&}ѶzA;:,¯,X³ÁÈÐpV¶ÛÔ å¸ÔÈE°•Rn1/„_`a9aád;÷çe8w ˆdW¤ph+ÝGµ‰6¼\o¿pðÂ{M—Oá_RnÂcªl|!^â`çZ–{ßÛo ¤ÄÑrBR,}SlËsom}¯è¡GoÊ}®“Lv©_Œ¿¦|™´[Ëæt9}K?êr3ùødó`|—ñ¾#v ¥ÓDضóŸå…òeê×Ä=GUœ^Ð9×yqV£é÷·A¦ñÀÂM¼ð³›¡*pÿ9Xˆ/æí “¼²±ï_ì³Çñd|Åþo9võ…›xᇷ:¨tÿ9X`6ørƒã@i‚"kzóá$áµÎ‚¶Ã6TÔn ­ñC ߣ! -—´áj¸ß[½m·hàë,üC¼šB_ö‘¿ Ò^H¸ õ›|Ã:j+,иEí¡¥³I#3Œ-Ä—b‘Vľ]¬…µO„•t»EÀNfbŒÑ¡¢B°Ò 9c*õÚJ±Xø·xáŽögy!É:]8e”äL¶¹³$v"*¶±·])µ©¥2Ô‰2sÊ'.×n!Ôu™“y³Ý‡HKW´ŠêÇÄk]X^»id 貌؅ñ°w÷Ê©zM.%è<Dšõ_®ž$ï™°×ÎóŒ·ú|ÿL, óhã²E²ÈQ/$|‰ƒjŸž¼*@ -­«cæ*Š£s¹[s§GÑå5xYdÖf%Ø F.~ÈJáúÌ9Õ¯pø>^±ðæë á½” -ŽÄ§ÀÃú£t®wW^¿ëÖgð6í;z{”W_mòo`aEçkVJXèbìùñ÷¶×-ÎZJup”O™oœ‚UI‚.]“s%bÁ³eUè.V<Ðûž:»P:.’_ä>à èÞ«¥TžfÒüeØ";y€åŽN šü×È%¯=cŸ“¯ÂŸ´(ºpYÇfá˜ß°0ñÄvÇÂâʵn(u›G›÷Jã#èž’rÍ |n¡¢3 îW»:)(TI Û÷u°«{á1¼°âÜ—Âþ3‡GeI‘¾óYOê"æ+h±Ágz Îy‰ÈÒ¶Oò2An’åÓê)Ï£à„ ­xärœvWT›ÑÑ5`¡>Ðð l![¿… -vι> äùû#U"9°ð“x!ß°q³ÀíûXH‚÷\Çò IêDYL5A;ïÿ°Pâš6)ìX¨p9†e{ ;ðÈ '­5ò%lëÇò«¨ƒ ߟvi< ýŠ¾ëòTÚÌÎ !†±(AG:cA›±îv,h§vß°€SM+zt¿ð†áú9ßu$ ¬ÐRÂú…ê–Lß ŸoæÀÂòBƒ²|Îþ‚iIÂü‚XX0…I°qÔë“mçÂ1á“l¶w‚îàY¿)ùmK³X18Ö 6^PÈ lÏzbo -ˆHO%Ðp_øߎžšõƒHЭ‘Eo‡ý^BDýšXx(/ ãã“›v<ÁC‰Ê$øhÏeãÛi)¶ç´Ö‹Ål8h~Ö<^l?Ã×÷'>²¶EÀ¯K¸œ¶·4ßÁá` Ð1÷lJÒ–5‡:ãS㶬¦†“§8$RM‹ðv¾yü¢<‘ô·×Ÿ¿%Ç‹£Ê žÊÇ=‡õVkÑØ%9Íçv­uë[­g>p>hóy,üA^Xkc’¯³.d· fWaæÂþ ‘éE˜[ä‰&õiR%ª3ãA%Mp.Ÿ$sÖkØ€$ îÐECÜ3¹eÜL’*,|–¶T&jÙ͇šp*!ä¾òQñÒJü7üd,$ Q.z”lÄ -·ÙcÒœ\+᪨K1®0V^ÑfÂü †08Y£t ãpÂ9F@¯„';(œ…±N@gB Jøi:°ði^ðMó'/=­Ë~ëÒ çfo°Ä9ÿɼ «²à„‰WT‹Óµ+ÇEìXˆˆj¨Ôõ˜Pƒ“]¼1dâhVV…ƒ á6,KlÀ¹O ZW®_…cX ÖÞªä\º%Ó>Í qûƒöBä¥hŠYoY¥Â%t®+ὤBk­Åxîgóž!lfØÄl·®y,L¿lXÐÙ©ƒ&pànrŸéÏ^8iì§l-ç…÷Fü _Ní>%oåžæ¶‘ÿ}‹V©öoÁ‚ÐåpM¤å¹œ #p²6?ztLe -z8G"©×`ÿ²ÆYún1-`;;À^;/8VUa6í¶X$`AŽš9<¸”½)å…ÏòB•u˜ë¶Š†$š#ÒF+(=]g€É1ç©î†45 (ì°2<²1 ik†ƒ…$`aÒ¸kí¢WEÚ·öusCŠap$À”·°û®)‘Žûw$Yš´‰"Ï#Ý&á÷5ëLT} p~c à€Ø×ðg¨ mTq ªeDÌ€gYSøk†6üÛLïe¸÷.YqèuØ·š?ínEóšk~`ás¼1çÈòä§RGƒcæ©K·)æÖ‡,àŸ"¡ €cc4„Õê0ewr^®§XhÀ·Œ­L*‡Å0n ±PcxÜöè·ztÒÏpJ;7 Wp8lNM¸êÊË lùÜQ^ø³Y¸¼a 2OpäÚºsš¶ Ý)0ò@ÒÚïXèÃÒ%X%©)@š©H‰ÂK‘<Ö쳧àMÌ49WþËá):¡«(ËiP~§ý²W¾Ù 0¬v8 6Ò­3suÃ,`Ëèx`áɼ°nU© tKtšº¼Äñ펹5>õó}ˆ‰>Ý]cÉêÍM ›½0¹fØ“QJ”t=zßajlËŽèë»Tnª€•êdÀTÚ€‚€£m(²8°ðüvð‚ßêï$ åžôW1 j‹1œA0Ÿd±€%¬0çü´wþ“TÊö„…AÚø¥’q”)Õ5ÀÒÃýw,`yƶj@'^XsЛD·ñ‚g‰BÚÕøÓ¼ð•ö©bù{•Ë?Üårè͹Å?œçc„ÔbpL>ÌÐBùt3ÿ^tá÷aü‡±pG/¦QL뀅iÇÂä˜$!87©éO²¸ñBл”[¢ØIG‚í¬r5[¢7T¿\W†âo`;_b«ÿ 9Û %œ+Ɇ런`]DCã'éHý¼Ú]q™_F¾YØ?“Lƒ©ÔЗ §ø¸”ð4±Jú6ˆ!§ÿÐ-ôUÉ)^xyúNQ òZž±Ða ?WäN]b¡@—¢¡Mdøœ%ë©súÄ è¢½øU.§²K ý±ãmLõ„æxçdy’ñÜÙœñ2“Â,„ضÔX'”üQ:R½;¾GåÕ¹Àíåk£`TåX½¨vi6 //IÌ8””N@sÓ„~Úãÿôú'ÊÌ?‹…{´ÛÕ:YHê'œJKqlÛØПèÖ=ÝÞÿĸÐ`Y5xE õiké–\6+ìVãÏ+æ”!rŸ.K%¢† Å3„ý±S°œ±s&&ÂÀ—¹”sp 3c|ÄAtÜ´-¤-~ /˜iÉKG:ÚØ2)Ö:ç~ ¬*[Ÿå™=MF¦v)_ѤXŠn´¢p‹E&É Gb˜u‡º¡)†•6ƒ(Ö(P1=—€]^*xeC©–’ûˆ*‹I¨Ê+,~±4S÷d/ÜÔˆöðe²åalÛlý'$¨ªü¤³†$¹dÏ5?†Ï6Ñ-x‡íF ×4µÚ»#\5åwÞ„#â82î[rî7[2o¸8÷° ¢Ã¦šN릻ý{¡tbqnmp˜yr] Ýã(™ ~©ò4oŸJ)œâ˜ÝE`>ÉQO,‚ŸÒ —ÈQ!f)@{$‘“–Áq,hFk‰XX÷J˜QD)x6À«KÈÂP2Ùi6šÀ1¹–\#{ðÂc§øüªî>ƒÈXç¢Obá‹x¡’lÆœ‘™³Ú0"Ð2Žj¡•éâÔ©(‰ÎI5FÏ®È SšmXÍYºhrIÜ^·9 -ˆݱÍÐE#(’† Æ£Äd®®œÊº´½‹Cz"?xáË›¡¢DXuÀµ`Ì~X_†…`ñ÷ˆ…Ç"Ôò@4•"Ì´œ‚19[pŒø± Xà ³Ñnau_cP‘¶I0ùÞÎ &ņsêüHA§ªÑÈVOp2!3Ìkb`7΄ùW±ðÇGÃþ4ͧøu¼€Ú ½ÀBÆã¬ë£º6è—ÊCò(#Bʃr9À2BÛ¹”Ë^x«Áq70»äºñ †leÁ/²œºë­’EqÈêêØå]\V4”¸ËOµÑ^ø´¶Ü´¿úWŸÝºƒÿõËã{oD=ørÏüÒ›_îþ!¤^ý¶®ülZ|g{GÄÜŽ…hÀ(´s·Ôrñˆ…æ\ï1wLc>çU!9§œjæÍí£qì…rÂCø %|ªü‹»P -Š—”±u‘¢É] Ȩ•Ôc%ƒÝÖÃ^x‚ÂaBÿºz1Í(Â/5kKö«ûüȬïe_üÔŸ\»Kùq‡\¾(F­}ÉKIdr¾ji¦l©—*ÅrçÍBNõÇ{Å–ÎÇ°"Ý/¿ÌŽ~]Ï—ÉO8ç¨NÁ<_€ 2<*M`¬g^â6ùa±È|ë'Ö¥·,ç>¢ %–?%÷©b -ŽÔVSLÚÚü³Xx(/';÷«õº—Û 9a苃5}'Ï3Nj—®¸L‡~rCò¥øØ&..Ò4N'a6B´ß f2:ÉQãûšŸŽä]Qüt0<ñË/.¥¼>¥Ã¿Ê < ÞØè&q|S5TY˜&ê²]F'xEUdÆ S4çàh’ž“dÞ¦…ÆÈ„£iÔ’G’ŠjW7§î)ÊVôJêÈš¬k:æà#v1#™“p’¦#&Í*ºoè¯Á—·WmøFþHIöñ5ÖOˆJ^?ýòÖdvbÝ*‹¨Ógƒ­6±P×m,lhïó “¨:'‘µ8o¬1=˜:`a‘\/˜Ä‚†Û…£wãT,t¶#–lôïÃƘ«K/p¦6Ì´b¾UÁö‚ÐpŽÈBõŽÎÛ8¨Çô ^èúøI­5FÙ2fíòeÿ…Âóba>‡‹tÃóÂgÚ»¼08ÕI+܇×_°/Ò…ØSu$Lí÷¤¶¼âV~% ÅòwX0ɉªä‹yáÓXø…>Y÷ïêÖÉß`Á|Ìs±¥É3Z¤–×¼0},ø!2o‡’~./ä_óH£oÀ  ƒ<È^Èô3·êò‚þí8Rºž-óÓyá«°ððÂX­ÏhÃk,´ßIGÂ,èþÍPÒñ‚!]בO`áŸæ…gÛ _ƒ…oÆ ¿ÃWÍ/Dóü©1Õƒ^x,/ø¡{C _5¿ðèyçƒÞÚ ]x¼sÞ«ž†ƒþ‡|R½Jz>/œ}0ô#ç^xà f î^:Ô÷«Õ/ü/\ÃpÁ º’g^×Eh£ðdìÒƒžh/ÄÖ`A¬Q’YÑLB)ê`-XªÖ”¼ð 1œç‚WÒ)~áy. [ÒÐö´pðÂsxAÅžSQ©&DÂV ÀŸ·ʼê>RÌî`Ôþêâô^0q—4>™B;kók|m?¥÷Ù 3‹|ÆVŸ9»Ž9ֹƎÉ*Z~*Rfu¢û²(¦¬ -¿ë¬¾ -ߟ.†’ˆÿ¹qm`¡g=„Ñ[iy¥cÛ o‹eKûy^಴Â[2xœ629\y³ ½VIü¢§ÙÃæDêˆù^ù\PKݘÓíºœ-ƒ‘nAÙ¯ZÊÂ'üjŠ»TÕo‘ñíyáÅbàÉð×ñBí&‰å;Ë®JÓï+=¢·@÷n…åy‹š*oŽm+ŠŠéK5bóúó퇥÷Ù  <¶ö±P/µÏi7ÙLó[±¹’M+²6®´®ôØ­|VÃÊ©Ò+|ÂÿÛªÊ /^I˜æ/ã…”eŒW2ü¶²ÄG¤Ž½oòä?"Iž H%ÆGñ¡Æ5¾+òìC,Üh/ج, û·)Ë•}šE•°u½¨%õk‘X5Áû:¤xQ9|#vÉU~/l:RåS§{xó{)f_ƒŽÙ–ÞÊ Õ*’%Ö¬à êÌ®´EŸë¦˜”êۆɼ"T©I=a¢&/¼X &™ÿ6^h3Ýøfïùgî-“J+¦cË •¥ï¤X„ŒP^G¦(঑ÔJú^ðdÖ«·Š`3^É< -k‰ö<é\öft¢®]ìW4ðk/ëFQèÒmCßs9¼Æ^0›íl•W>v)7¥\s¶¶ÕSì…Z†"¨Ã+3û¸²z/xòB ü/ã…,P)]ív³œÄTÖÃÃf×ìL—Ü[ë:Æè¤XÜ0>„6EiãîÅ„eFL°ŠËŸ,‚ñq¿êuN-Ëâ‹Ò|¯½à[qKa•ëæ "§y=£›Z°‡RMg§N©E¸(úIãH%KÒ$Þ_ôßNê†GñÂE†$²v!/d(¾+!¢ðªÄñ¡…À Ë„Ã<ª(ˆÀ =¤ Ÿ”Í©Ôä…³½ 6,¤¡Ô-ˆÈㄵº(õpQžG©+›¸it؉Þ9ŽwÝ< ë -âÛ¶CUr8ðbaܱ ëºîë5WúIãH¥—*yÕSÕð¡!hØ Ô•ü³¼°ò_ˆ^ÄßÇ Sø¢ +‚,æØ­²É/Ðï;àDeX5°vë#yá„…/àVQz×àíœye%“§ÁV¡lÎòûì…Ûµ¼ÀŠ9,€üÏ/Œ;/˜Æe@ÁJ窪žÄ  íVÐD®D*º¸lX\Þ~–Vr&†SGSÅ2ùëxÁ§ŒÕÍÄdx¡”I]‰·®N* <ÐÔA^{Ù¤VÀ»æH÷@^p[ïšÌ$Èê9b*„Gt‚Kè˜-Aø3IK,]hY¹¸»yá XXW™·bA…^û¾tt¥2Ï]ûÓxA–S‰Õ±´}*õŠ ðØ©ýgyá%ß<9÷'ý_È pT0AAP -èˆ5j*Kà*¨öÝÖŠÞOðf&!,ñ™6¡Ýš?Œ²"Ç–xŒ~×½!5 &^´Ðq¤'¸„ºÕ5·¨¦EÔÖHdí›äÿÏÿ S¦·Yè"Ñ:.uVàr6œ®Umm£‡¦~Ö¼ó$•RZR‘¬Ö͆åL®Ÿ·Æ_‰!ù í… ýñ‹¾ ´íøùï}ü·óGóøyXæ¶/láá´ÜjüqÕ-N@뵚Aw†yxí¥ôX^(ĉf)¾P΢ î:,üvéÂh>C÷Wò»MÜåÍ÷ÍüTÇ\ž«R?Ü^¨Öº(Š2ÑßÃOµ|… ^xÄ8RGÞ¢"úKyá½áê»ò¹~+^@$¸ ,|†Ú,½uï m’IW´ß#~á|ß8ê9M܆…ÈMŸGzE äŸã…ûÚ7â…qÏdÔû¯)[œìz`ÞƒÎÀãu÷‡ðO×ã¢?Ãyt58ÓÇcxñ¼'Jbè_HߤJRé¤<Įքå;ªÐ΃Jï—[<šâÓ8B‰£qv®À¶ÃeNÕzØüÏü™Ú×ñÎ!/ðùbÿÕú›zó{xÁÌÛåò÷C6Zô-ZßrÿâI —õÑ…íç1™Ü°{Û‡wç"Ñ`Áhÿ“à`rãa=þAg$O§ýÇæVAß×.̱T¬èέ ¬«†zY+M]ãõ „Œ#Yõɉ›¼'ïd}ýsý‘¸ùY$‰·y‰GòB抙+kÀ!)ÃÞËúei9<Ÿ^`Iôº'#ؤÍFÓuqmç4Zmô^˜/°|Ì ¹+6Å݉ڢ%¾„R,`gƒÔ+±àxep×Ni‹^Ú -D$†ÿ‹»‹–Ì·Ëä ÙÖÛÉQ¦‹Xš¼Ùf‚qÿ}ÇM)ÄòÛéz^hOSjç£}(3©ùN{‘+›j.¤Òõ4¬:§@Ba= d«Gó\Õ*Ë$ËdÏŽaDßvؽf{%¿)Ê÷Mïç…—B$>Õw#Iö2£KOAµ ·Û -°‘³m å`Wåœ,ö[.žÏ ¯º¤_µOƒ»Ï˜_xÿäðÐ1e߯rmþÇxºÞ^(cOà/¤Ju.êïÁýú|ªƒ~ãÿB´~†ŸjÆ03‹À*œÙKaq -¿e)ï3“ˆ…À ³Ü6ý/¼Ã<ÞïlΓx½Ÿ‹›p ƒñ\ï‚6FÛ‚ÓêõfOå…µU„Å©±v„°zX }æ{!ÔWaár®áMŽŒªº"‘äí¼Ð0ä…ú‹HO²ãÞn¼P FŸ²¼½`!lZ}‚|u&†(“‡Ÿê“yáX¸Ö^X -V§‰鈲0)ã'ñ^øÒø… ” £–ŠÇ²Ã©ÑÄYoÕÚR I·Òž^É®#yÜ´qÑgxᥦ-ÿ)1ž/\à Ka@³ž·ŽAÃŽßÀ¾Êvþ}«ž¿¡wí(˜’“˜X»˜UÁº§$n1êÀªÞæì÷M?à ~M_F[þ)^07ç½ÿ,/´Õ–ÿ ýÇÛÍ+Û€M<Êa]«¯Á‚¿ -b!é°_,‘”¹ UG~/éä ¼°yæ˜(¤9mÓÔx\EÁÐÊX{ÒÏŸÛ(}ßô3¼ðb1ü}ñ ľz¬ob>baß÷X¤ÙT>‡(˜³’¡“v,Ÿm7Tú$øm³t¦ÃyAå4†%žeœŠgö¼ÍïБt¢~«9át´~r\Ûë×Zܸûµ¼à«>¿Ð÷ÿ×'ö1®ç…ĽJ2úJäEþîÌ“oå´¨§ðB&ÐjÑG;­Œp6\…£¾q ®Óûøƒì…81ÓêyM|OüÁ ôÝ7a^aá#-7òB -—•ÛE² ®5~bŒMž[+…r¢Ö6|÷‘‘䠄‡ñyWÇÏà…0Sª¨Á=ô„DUZ…X˜ƒß6Àpzœ½ðžúg;fªtK™°rQ‹TÕj%²Yå4±5b-‹ì[0_)SïZÒß¿þ‰æOòB+•×tjÔ’% ¾ã¶PŠN)¹J;`¡YÂTH³¨‚ / Cö"3be»²ind6d8mɲ´éP°QÇn5Œ’‘Õ£¬u'b@°yJ~¤ AlÑ ,#ú|Á - €… g”Âä0]žÊ ¼ó·c¡Zm[ê2_»Ò4Ž`üi+¨§¬,²ŽDgNåZ°Õ¯,Ç ¤7ÿó{ûX^8Ãý¼¹É¯Î1TV€uJ8 ¨OÁæ×ÒáO‰ïñÓ~/„ Wy …eignËÇ·Ú«oIp+ßu%›‡vROG¢xèEõÐcDM$HÈ S]×xè÷†ÿïµnàôßbAw®ngÊÖ!q)<.Ð…ÆžJÊ—t²Ù°Ð :’™eE^0ñž–t'/ØßÇ%€©µ>˜ü6|?/ä®A,t! ‡b¢’̯R‚,bºÍp?€…drk±óÔE_Ç í†±€ ¼c®ˆ -3J2!I½¹SÑð«âÏš_Òp²¸¨½ÈzêÅ…½X0Ïä…{±Ð豉Œ€eE\¡EÙoUÛˆL4baÔZZ?Î^Øs3˜}ûÍÛi^.Ý<†vb¸ŸA+4(zŽnµbNrÃ䬶±° \Š$Ò-–¹âëx!`°„Õ«N;¾aAs¡2Z|†ÝiV0»Ä<‹BŽï³í,&Ÿ£:°pz¡å'xáYXI/v^ɜȮ–É`„m‡‰-ABÛ™óØuvñÜÄÍÃ샣 5(“yT,6ò¦·v©y‚Ï0-LPH -‹>—¼¶6_ &Ãý¼€XX1(gÇ‚Q²h¤ä Mr‹"Ödxvl•®(Ë)ý^8ëHÀ eÛKtov^и/\Ô²‚W¢ˆ\côò;~ŽBêO%jl V"N†€çs¯BR¾/¬ZÙ± 3—Ήëzק¹[´& -gÄØ‚ hM+’ÒM³4&M]\HYFBÁÒTµK;Ô*»=St¹Ê|)¢Tû^ØjÚÞÏ ¥‹‘NXˆµ[Yk…¹=(0¯½£FÀYJ:| /0p¦²h2T*¶ðàÄ<«Ê×rQø¢aó¼×ð!Ö§Ù s” -Ìd¤€.Üè°MkŸÚýŽV™ÞÏ O‹wž'ÐJ -ŒºDCºt覗–èaÙJTÄæBеҽbz\½¶PfUÐçãçy’zŒ§ÃU!·0b+¹,³,8'‹ï-¼°¥ ¿Ÿ:W/€Dƒ1ª°cR²Qn¯&«Á´†ÿ;2¾-í—ðÎã‡éyô•%p!$CУ/ÈL·ÂWü½M“­’Îø§ñ‚ÏÿoÄ WþòB5²fx5÷¶7íyå|±ªÂºnçÜzà…»s,-†Cn tµLÆ _oÚ$9ÀrjhËæ!¼’‹ÜÏ † 3”µñYYù¤ŒüšÓ(‚O.FÙ–1ɱ ‚sÚßëÈö£ýTµHÿgø?ó÷óÂóâçRUgÇìS]óªê;vVëîÑ]=´.O(4r —E:°ø3S{@ -y©ˆ‹ YÉð^éa>1ï\¾˜H2vïˆÑCxáÑXø¤?Rÿ~£÷W`áëó`T$'‚S—K¦ïõÙ¾ŽF¬ewÆ‚˜q§(„a0Ví6X‚µ¼8†Êvb| /`Þ°OÌ;ïG§ÕÎåæáXø[ã®yR_k/ì<Õ»2¯ýÌøÔeÑÂÂR85KžË²T¨h¤§ ªÆ‰B ÐE¤-¥mà ˜#á3~ªé»0Zãè±Òø9^؃9ùG¿<›о– zxÇ[Ýð~ÅÈ…‚ô¶nÛ}ó èVƒd%@¨cmÌDs’Ř\d7 Æ:¡9öù¥ýcæ‚ý»ŽyüBƒÏ?[„°ºf/JY,dÑÒÔÇÓUXøÎqmÇ‚ŽÌ™P·"O°r!D­_!Ö'»Š¢êó΄‘wGD -q«ØÜÄ Þ¤é¼aÊ·FÔG-ßÞÊ:]›»°p'/¬hºŽ6ñ"Sà_Z–Ô©voþ׬ý'yA'ÎuKõÚ6è2h+Ët}²—@ª¼¶¸èŠˆxx„?RY¼s»+»5ùV^…æÆS”!]ûU>V¬H~};`ž]z"õô>,ÜÉ Ó‚“n\aÚÉz”9<ÐJ‹k2Óü¨xçG`A&¦5½K´&šâÈú²h&ìlrF@OêFø‰¬#F·‘Št+¬’ý#xá"×e¯‘›Åæ6^@K÷V,,Mlßñ³C/ŒÎ±,*{-¸Õ…¡ðwaá>^0X‚n§$‰á,À´d¦ÅqéU]1ãñ¯ñB겡jóšI–¯:’Ñ¡v²\%]u;&ëÐà:]/Jöt¬L$zq¬~Rý…_†soÆÜЊýôJU¨<Ò,Âf>cNÄ© •‘¦ÖóR©’û†6 íhì3›ä*ŸñÐõ,ÜÇ ƒÐžKz2žç Œº¢šá¿f/$2^I·H’¸ž4®Ö¬Ð‹+¥ˆž[Š±Õ‘¤$“q ºgoUȆXFR9‘ê¼ÕÓTgú}å;£4~Ý#èþeÓ÷îoç…[Ç‘J—sÞÀÁ Ã9åñs‰+ÎåsÒ–:ÆEw -u¤ÜaHËa—›K“|‚"x·012·a! c¼ð–0:[Æ<ZsÊV¦’j$³µs5'¥p²æµ\µnºÚu\«¼e”lVÖÌŸ± -œH–¿D6‚°$ôþºÇŸt- KÑ -)ˆj‘åü ^(#“ -‰G´<18Éi=£¸’¢ 7)3Eƒ¿û‘ækƲ/âOÄÇ='×\Æ¿çôÂ[bùJG#Š;›ÓQøiŸ{,ð}mõy{ål·åt­äÈ 4¼ìLjvh7œ±@ÐgO÷Âü ^¸÷uº‹ä™XoƽþHõÇæM~]gñOÙ ··jµ¥~„Ÿê ‹V,Í`o–<`aB)å93xÄU&tÃB…TøþÏŒ#ÝÙÊK,ô·9²~ÎOõã©åùª^ýŸã…§åœÿ?^ÈOÎØÌúQªÒ2Í™H8u eÀ„-%C>Ô&•d¨$ÎêŸÃ zîÞ÷¨¿ð|{¡šÛyžƒ§v5 zF h~°æVÝ6E*À-Ã0ê¶|¶ú¥˜Ï¼œ°GJk€?…{Å¢b ¢ µ¡ÔY•[ø©Áú$“^eL±ò3ïßqfø¶¼ð™vÔ_x:/è±Ì¡M`kÒS›ƒeÜ•—tQ‘°EžwÛÂÔ胀Ò ½Â>´©* NõWø#I~'6‚ öíö¾8t ¸ªåÅÂÁ ÏÄÂ:Uä¹Ý1QÖVNmæR}™ +œçy1FÛ¦r¨,êBæZ‚¡3÷BÚÉa˜4VÈúŠ|ª„u¿›?Á „áø½BPõèpTß1ËŠ…ƒžÊ ‘ëýÌá/WŒ´ske•ÉWXèdú¼Ó¦²¯ääg_J2SµÏ\é'éŠYñÏ |å߈sÔ2„Õ;—çìäȱÇbáà…gÚ À ý\þ=×·˜C²Ñ™L^ñ–(èó¦šY¢[’U+`Ÿ¤kV¸dXÅ×ðÂÿˆÍá Jh…k´Ä£ßšîÊÓ¼ð]xaZ )]š¹€=è_xAQ0 -¦ó¦É܃2PD|È6·¹v]ÍV%nç¾ÕðÚ†Yº`¿Q²Ïu¾n›?à 82¬\“lÞF¤ˆ‰ƒ~½mžÚSÛoVB¥å†Ð¹Þ7Í«jNKx3eÛ¸3iˆ]T³*u…¾•(Öëb%Ž¡¿Œ"Þ,¯³mç[M¯ä±ù3¼ )]œ«bGχ=xáñÂJÚÄM4èÄ…Œò$zÇ^hµÖ•Þ7E =ë.wIꂳö\:RƒµQºìV^À*^ɺõÊD´F‚­^¼Þتt«éõÝyA†è Ìû,,¼ðl{Á`î£je9¯ª6–V]1ýzç…¸ ébN›±ì†j&®ØÒêUk¡Ú‰¡ë*»•¶üÊ‹òE¸¬ó£¿ÎRrr¯7éçØ}wy7¯Kü¦“¹Î£ïÁ ,°2ht$NsðÂã·§vÑ…ë«*ebH\B ­c´©ö+~¯N›j° Ƶš\Êc—•P—ñ DÎõ7òBx™bÁ ä›±`Þ`ÁZnà?Ï[rYû˜Q+{Ÿ0EeîS)õ&µêŸ´|È«Ý„¼füd;›¶} ^x®½ ÷°ýª*À.`¶›) ©µÆ 6L6Ìð»ÈºÓ¦ºL…|Iºb*Öl ŒQËXßÄ ‹˜¦r‘I{.‡ù TbÞ&[ŒoD«0ÃdÏYŽ Õ³}£—å{ðÂÞqeÒ)…ÜÐ5`=²IKÅ‚…ƒž‰…j%§ÒåÕ@š¾C7ԱöºEôo_;ò²é Ó¸!Cȧ—Åé:¬›÷éãz^X$:à­`í…$MM¨`DK6u{zUv[ºáoÀ ërN ÚYÆôÓ^`(Ń…ƒži/T—© «=ijHVéd÷BݾV—Y#+­w7íÓÒþÛöq«½ªþ†Ï)yk/œBÓ¸H}G…+^a¡P߀^µ×™Kù¤ÌC°pðÂsyáãF¾ÀOõ\›(=Oêb/ê÷mg,¼²µ1¢­’1¬’q‡r_|^ø-e|>ÑðÁ ß:~áy¶Å ­’}VË…{¡°®×ªóú,ïSg„ŒSAÍÂ’Ô*“Ë,µ¬JßÅÂwóS}@ÏyðÂâ­o éÑŸà…üL¼L`)ðgöT’}z¬‹‰u¾Tã…]­|e•°€„A5‡»‰óïÍ S=xá¹öÂ{Ò&ÿ'í—>Ý̓ê;óWÙ§C¦°Ëï"Þ‹ð« ü^0íÖ̳±pð—óÂLÅk[˜§ŒêM„çéSõÃCê;¿Q²ßdŽä¬¿Zl¾˜Rüµ™~6^ø*,„ð4zL 9T§$Zë]•´Þ~Ü6„_Ãð«ÎØX=‚þ§óMÈÕbóż¡+´áÙX8xá«°@³ØzÐuME©T¯+BA7VëTƳEÙnîsIYð‹j†¡.¬ê1Íç…ψÍóBâöÉ>ÝRâ$ø:!‰™ÉŠ+ÈÆ$*šƒ~Š½PU‚šÌ) P(ÜÒS—T‚õ=Sk)ó1“4^DÕË7„ˆ ê–|l©ÐçÎï›/æ…Ä tR0h9G¡uÖùS‰)âc'ä'‹¼ð•¼0l˜$[¹Â¼bÓZŒÞÔlídÊ•j9‘e% K‚‰¶¹ Lé=/ºêá¼ð&§ÏPêëÅæËy!´°àêT¸¬t½ž(1ÖÑ4Òˆ‹2éôg±pðÂaAG2µ”%¥jAÄõ*J®K«#‘L*Ƶ`‚DÑ.ø@©…±*̯÷:@úA¼PÒ7ò6c^`%4Ì -Ž%H]Þ;¹vg  Lƒ! ìîwvðÂWó(I¹è,]rOŪ‰˜ˆ`E\°° ™íë:N†D&¬1V·>C,¬ÿ…ßòB’× ¯Q×àÇœ ¾m0L7å]^·aƒ<õ_áCbAó™5 Pf“Œ™²p=p~ºÈ‰'­ý´' &ÕØE~PÖSFÂTÕBA–Ÿ0SKr”˜œ„l‘\öbÑO›Œðb ï¯åê( Uûgy!çÆI ð€ÇÒ-Óâb_;F™«}¼aáà…Ÿb/@+³aÍc­ãi­Ö)›j§®H‡˜6mGmŽ9µIÑ¡sëdm2è¸qo'Û®çÌ écæé®e4²¥93…õÅϳ: -äMs‰‰š€5Å"c +ŠBˆ—¦?Æ [eì€[0])Xp1lSXGe©½¡KuðÂOáèá¡—oq~mÞ¾èaª¶Â”‘°n¹%ñ{ȉkØxè©î_^¨ˆ{Ú4±+‹E°0³ÌXf‹À €……Ò¼L|Ã*rJ‹Æ‹üO#[ -ýÿöÆÌÉŸäQAž/ü¤³m‹x¾Û)— 3`œ°DAá¶YÆ‘)ÖI† 2×úPª¤^½f¬—P±8K¾/üjD?¾¼ðòlWcü ?ÕUÒ´ÍÚž„¨†×›¡H,Ȭ“Mj7ˆë¤kקVVxÿ1¦ž§)¬y ŠH? /|o,¬•®>á§a¸´÷Ói ½dž`ùð¦Æd©Ÿ„¢m9‘¯•a1Ý‚C2)ìÚ_º}ÿq^xb;xá_¨¿ð®ÎÁÃleÍß8f¼¿ëÏŠ_07`áà…ïm/< .ÏûЯ煮|ƒ&~­ÃEK›«±pðÂ_Î OÀÂ×óBï^[-d¹Ú-•J}-^øñXøkxoµ`[Ã5S€qÐÓL‹IÓ¶u¾ÅmLíÐg;lÏC²äžº »ƒž7_VIë®èƒ^øN¼ -ç–ѷŠPœÙ²Õç,ö ë§&Sõ%sr©édá3ádî#f±RIîSfÊ1ñŸíeOqMö¤ƒ{áñÂ(]I«¸t*”‰Ë ”#ëHã\]8f:§ê -²¸%[¥¬©«ƒóEíøœ -WÀ¢³¯R@å×8*¼pðÂ7â…g5,ü‘¬Ýw+ˆtKå„ÑC•¹ª%ëšÃrì°´y ·.À–(ŒM -#ØEî½M× ñà…Ã^øF¼@Ñ9·t“—§» äž­€A ›'ê$¤¡ï]ƒš1ÉÌêD -°È·òðÓ®¯AâÁ /|#^È1¹«_°€ÒÞ1æ¢ÍU8 ~×,dðkž¦Yj`a~µt4M’D¿x‹…ƒ{ágñBæDK7ò³×QŠÁÍ ÆTê&nA ‚Ο$N¬)VVÍ Së#£Èxnn©Omo“\‰…ƒ^ø¼`jéœÈàvN -?˜ÏeçRGBŠE.&B›z’RŠú‚Eâèñk%ÂLp‚|Œ’Ç8Òa/ü,^ð~N;8žÎOþáLÂr:÷6áÓû5]áÒè¼ö izÞ1 a_⨿ /¼ð=xáI­wݵX8xá°¾ /<£ñ…úk±pðÂÁ 3/˜Á_…ƒ{áoæ…«oêà…oƒ…[j2¼ð,|o^ ä¹Xø6öB•&¡!$Û®®ã…qü -±¹›xÔ~g,|/´d á·òB)éÃÞî -—0®ß”æÒ-éð.:,´Ù]Ç “³VGVBF¢Ä 5ÿ¾Xø"^Ȥà õ+± NK%ìõ(4X×`ß?Ï/XXïÇ9 ÑÕ•­àN1%Ò¯y0¬ÃŸ†—CéÙ¾Êa.±·=ð½™_\þ.Z‰SÂWaáÄ 8›V·ß _Ä k²Ü%ÃKK\:|Ðr¦÷¥,? Bd™=ùõyÞœßÉh¸«iÀÂúr˜úÔñªÿ×2Ü©Mª_s¨¦Š\l½.êÕIeyZÜŽB»‡½7ŽOm±g›ëÓ®€}ÍSI]¶ïÁðú¾#¾’è.'/š{õM¾ÿ“Û[ó,XôÓºæÜo®íÚå®añê{+~Å‚õ†^núË…ÿú¼¦‡ñ>µÉ}x¶+Ê›ëSäßæ…µ]Ÿ[S^~{ÝvÚȆGÇúêXXÚ¶ïžçuk÷ñµýOƒ'ÚŸïÊúÚÖïw:EÕ¯XX«­òìÖ¦ºâòœ½´oŸy/ÀSË_.wõ¶PK8ÓÏ^uqºÒp}6áÿ4/„®áòu’ü¿½€ú/‹R´Î,`°ÈWFgùñü½àƒÜ\Ø íµÊ•©ºö­ÁPU -mç—ùk{aKxEÖ,ògàììµtsºC:ÒUÝÉ„AÉ~ÇɆ¯ä…µ‡­¹|Ié5ãHô<z³&Á.51_7ŽTÜ6ŽÄ¦q~o ©ÁBÙucª ÍLÕ?ð©Õuô q$°¶í÷œvûó qýÌB¦ßh~a¨ón~‚A·óüz|éc,ô%ù±¹{~aÈïA‚1_„…cÞù[Ì/Ü4ñüñüÂWèáŸà…»^+¡¿/ŸULЄ¥ùþÇÃéðGúZ^¸KK³ÿswuïéö<ôýç9xáðSýZ^¸KNXëõª³ æC–!ç ‹Îù5|[+Om׌xAip,¨Öû°pð·°^ø¨å«©¨…Q¸Š¥ž¥d榽¥>—°¢öZv>Œr>xáà…¿Ž wv½eãœ23A–çXKËÓ ËÌå’˜Þ‘Vv©\=‘ä>,¼pØ ß™8dëqc¡+vŸÄE™+’³Ou¸B9:sq–ûZ˜û°pðÂÁ ß™Zûöx¿tIÐerŽè…d7Ã<ÖzŠqœb2k«`ñу{á/ä¼€/Jådç²úÕºµã¾Sí䎼‚*³õN,¼pðÂ÷¶r´ŠKU+±VJ™I^H½¨ª¥*Ø .j©Ô`Þõwbáà…Ã^øÖãH¥Âq$Ë@)òëÂØB¼†o(@1¦òB¡×,ÅbŸÉ½X8xáà…oÍ ¨<½àãÀ=èwí°7d4¡dIËuÈ26ßF˜{±pðÂa/|k^ð9{áZç’±“¿ /¼ð­yÁWTGŵXèXÎïÆÂÁ ‡½ð½yám¥Ýß7sïM¼pð·ç…/º©ƒ{á{ð‚éßnÒ5¯:ª1óÝMùd¸çÍpnæ~mŸm~_qþà…ƒ.„E½5yë×/§W>7äϨ x.ä6,ÜÊ ³È^îñ·p_EtØ ß‚ºwîFÇQ4Ï¿ Ï° ‹…ÿö#c)çZ˜Ðf¶Íâ Ç/z>mr -¯Âëioƒ{›ÅòV¬|[Åõv¤™?”ù’ŸEýv†ü¾7x /ÄeQEìãÄ7ÉíXø'xa]~ÍdÀ•Š—.eÃ=Xx/ØÞ—Ó"Eªt¸µðˆ"§£'T*j}¶ø„– M眉Ú_ ^ Æ&Ø®ÞöÎ \¤¤ZMBâF±`*ñ¦¨5äÄѺI±À´%¨×¥pR¥éLL’áco“(Èäé¼`˜\ 軫èãx᯲ŠðF·ËâûÕ¹úÙ$ØÅóöð—…W2î„0+ªÉu½ðT ?RÊ• ™\üä|æl‡u9)¶uX½Ët ‹ öfÖ§®¬jUjéZÆ’TRèuk]ÊÎVÆå…°@—EÈëe•ðgù¯½3ÑrUÂ0ÐB‹Ñ¼ÿ[Þ*ìîÉd:é¸m˾8ÇqKVl-õóUIEÁ¬°BŒ‚DIX„P° D–ç£ï÷Ý0q%Œ]âÂÏX`.”M# ã2½-šïfÁ¨jR²ãªñù\` …3 Ÿ‡å6C-(Ô”nêB/A pad;bñ¸Ó¹ÐgYŽÝ.Æ "÷„n8¸ó-| åã(š Ú;Ç Èê žûÙj*ŸÁîÖ i2NžŽ3\—ZqØiî~ß܉ -Ô'ÔïÛݸðâ…A0±–ZV˜Ñ DÈf–eÒœXæ®#êc¸ZØs¬»;ÓsÍÛþM Ë€sŸö¬åc'ÙýS`k°‚¡rRÔ¸|´ÑGâÐáÇÜÔ³}:lpBìn.Z€Î€®ò Â… µ`ѹ+ópÖ‰ZTÃ!Ï|¤»pOÊÈMÔt i8¼(°ÒVAÒÝý¸°îoZà¢xˆZ˜#F .Ó´òWáÂý)eVì6Bü¢U,úHCäB Ÿ(ˆIQ ¦•Öî"Ó‚¶ð¿íz¯j¾F a™ræ!\°Q SPªË|¿¦øA `ŸDùé.¼Å Q ÚŸ ï%óí\x„æÌ -±WóŸÌÒSýÖ»ºŽ •ˆ:=ƒ+Þççâ«DêQf¥ÙŒšgsÁ”$d`Ûºƒ©ú‚·"O'7Á¯Mý@¦àŠóÇ%áz®²ÁÇý0EŸÏ„„Bˆ.3Ãÿ†ÃáÅ0ã,@ø5ÛЃm2}o.°}±0±õ*&$poâd8¸úX¥VvÒò.ü£ Ò~Þ±Wä‚®¤ê{%¾RKhÇ÷î\Nû}m×Í•ÌôËÝM\Ðl -ÓÉ„ ^µgjê•›Þ9BeiÿüûH×5¤WöŽÙ _â‚™9ŽžˆïÁáXìøTs{[…ŸiÐò¸™ÙË…:, høçI»GÆ c{7Ž‡)j2°u‚ï³#ø1µ .Á_‹;ù²ÓÝ29—IwÓó…–ÞÕ_aOènÙ]'qøyªååK2@,Øo—÷WtAGraÎ=ºG:«œ£L²U;ÚÀûÐíùÜ1Œ°Vœ¶EíÒ -Ï -²Ãò0V°ÜÎ7=wÖ–ÜW /§ªËéÎOyª‡ia¬ý¤c=÷²"½4ŤÄX[½µ’¬¬"­,‰ß‡²÷•¦¬$µtƒ·U©oËGrî¾f“æw~I.ܨ…ã¸0R]nÖªåzTV‹•óžu…Ì6Qo‚:2IJäÀÇ\.[)ýZøbìþÖñ î¡S$.<)^˜{Ý{7 „f·YåD>Ï+sŽõ™,„:»U-‘•žs™¦vXîÏaôAã~No\òçr¡ðÙ‘Z¸ÈõÂÿ˸ÐÙðNóZµò.r´Ð326‚ªÙ±¢‚*›¢üâØ ©–Áª…ûq¡ý©(¯VÙS¹P¾÷—3æ™ÆóoÏ3fl›p™¨dìÎû¡M\Çõ×´p.P{$ÈÚ`¦ö§öªùëÄ N×¾_–Õ×|eY7ø\_¸ éO›®Y¦sŸ#ôñÂ.H,ÎaÆM\( ´  sˆ»ÍU.Ìxx® ¼Äûõn.]˜*Xç°„{öÏÝ\  òý©\xÓBW3ÌÇžl/dkoë­›w wÛ†q«ë+÷¶ŽYÛªüŠ®çÂV Kàø#L.,C±·«%–ÃÇû¬²°UŸÍÕx*¯0Sû3~¡_‡ ®ëjœ¾±î4Ù¥€w§rˆ£Áⵕ¸¡•ø¤fb…î“Ã$˜Íø>ÒgϬPb1µP¬²Še ë‚…ÆüÍ÷5­ØYhr†Õ݉ØywÔc< —þ’ïlqBÀ¢*¡»­,æ‰Fj·aõÅL½3B¹Ü«PÊV7×:¹_ã‚ÃŒì~ÃN–9S‚¹®q¨¤ª µÚA¼®«yª÷½Žc˜€‹#Žr·w™È@ uÝä1“;œv¶sÛV¨…´Ð…e¿ÐÂÑ\ÐB¬¤÷mŒ®Ã¯#-€DY“Á"l‡+‹)Úî.@Ÿ"åʹ¨qþ“Ž2Q Å,Bô>÷¹ç\Èì3-Ü/0&ØeʺFQãèê^AA•al¨q /Å…çŒ_Àž³§8Zl’®>k!ÔÐWð”B9 ¶Æç m–˜_IE.¨æ¹\È°@‰õc†—EРзÃixªÐIÊq*öÞgNæ ðXØ9Eû.,]èZ0¼“Z„Ðà–3…ÝG2^x2Öö,×¢î¡ÏxÓB‰ÝF%á““-pasªFZƒ·Ý×Ì‘‹4˞ˈáBõîì#Ñ01K\¢µ–QàBßâüm«¤.»`™ŒÁ…FNGv::䌎pá ºŽÙM3½a-ØGrá²×ïäæÑáZX@ \UDÖE×¢æļۑŸ@Ú[~»^¦s3ÇIž9å—àOŒÕ©‚þ ‡‹Æ‚Ãú9Ž}"æ¢g¸:?U¼Ôs=w¶­«¢‚Hy¬ú‰L1K{Îȸ¹àÜ….ò|a¦› jŒU -pVv‡÷¤³.ÔX/_qï¹p>Ôz¯”øJàB…ÄŸª1ÕSý¬q;<õùÂ/ö -ŽíêçŸv¬ øâ©øêsç8¼â-¬—h63ÁÄ?ãÍ_æq\˜/wΙ±žÇ¹0@¨E•\K–'.ÜÒ -ú¡Ù<;OµdBˆÿz±-tҔߠ…¯>w.è—}꛹н=ÇÃPcLتÏðÒÁdœ‚¾ %$_R¼pKû° -è ä©Îå‡ÿÈ×¹oÊG:±á¶ãIõTS=Õ×i·å#Ýj®©žjª³ý{Ûn11¾\¯…4~!qá5¹P²÷[âãŒc(þ]å‚ïÕq\¸Y iþ…Ä…ßß!yv¼ÈÏë¿ýüT°ݵZH\H\xM.T ¹aêëÜ̵o¦0µô4†nÈêjª†ºŸÊvn¥« SÀæ5l¦lmuP}âBŠ¾ -ÙƬõëf=ÍJik±óL2µö^ÕBÍœIÑ:¦j%æ\Š>ÔŒZY†U -EB#ø•ZH\H\xU.ÌX"3¢ɱHc0²"~ `ì:Œ2²61ç'¨<ì-üN7oc™ÌB’+µ¸â…æB«@f ÀBÓÈBC«Îàà¬ÍÀbëëºÙeh£ w²¼R ‰ ‰ //ü …Qî”Ò6›0¢ÆÒá8bµ EMiS¢›ÔýE îj-$.¤xáU¹ 9>Ð]Q cœk$ä$jaÅ ÇN¨ÀÛN8T/VX]†ËDD™_®ÔBâBâ‹rÁk1>ñͲÊSYûi‘œ½o -Ê\ü¸’m¹‚ج¸Ú‹AÒÐÄ4ª^nWjái\˜ä/ÇîãøÑC´ð‹Ky·xŒó#ÿ™ ë‘Zâi¹éá:”§`rŠã±m³·ÎˆŠÞ¶.pü8dµ­AkKݘyµ47¡ˆÒSm¸R ÿåÂ^TG´õ7>’R«þ@JW çù˜ ÒÔ~í#µGí‚z¨šÇíø¿ÊQqámoGø¼<ÕösÇÁЫǹÀ§ì¨ö˪ÿî¨=X;?ð0þµ{fÉm“y6–Ï¿çs¸• ©Ý-^øîí -.d¯~,ÃG\Hín\HZxçí_¼ÙÄ…¤…C´ ýË7‘¸´p€8ù?h‰ )^8@ ÿ-q!q!iá] ‰ I I ‰ I I ‰ )^HZH\H\HZH\HZHZH\HZHZH\HñBÒBâBâBÒBâBÒBÒBÒÂkhá¯9£ÛwÓO¦çxá¯9£ã7Ó‚ßmj?7v þ¢3ê¿™Rû°Ý …¿©}#-XÉRû°}U ÍßuF÷ÿ{ÇØèendstream -endobj -5760 0 obj << -/Length 107 -/Filter /FlateDecode ->> -stream -xÚ`ŸÿÛÛÛeeeÊÊÊ%%%¢¢¢ùùù444¼¼¼ÃÃó³³sssyyy„„„AAAìììèèèýýý“““ªªªõõõÑÑÑ›››TTTðððÕÕÕ‹‹‹òòòKKKåååÿÿÿ +<endstream -endobj -5756 0 obj << -/D [5754 0 R /XYZ 85.039 781.388 null] ->> endobj -5757 0 obj << -/D [5754 0 R /XYZ 85.039 590.299 null] ->> endobj -5758 0 obj << -/D [5754 0 R /XYZ 85.039 590.299 null] ->> endobj -5759 0 obj << -/D [5754 0 R /XYZ 261.943 239.639 null] +5909 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [171.679 672.115 425.668 684.108] +/Subtype/Link/A<> >> endobj -5753 0 obj << -/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> -/XObject << /Im17 5330 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +5911 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [382.345 412.564 435.974 424.253] +/Subtype/Link/A<> >> endobj -5763 0 obj << -/Length 514 -/Filter /FlateDecode ->> -stream -xÚ¥SMsÚ0½ûWèh¼hµúìÐ’™R‡8§4ÚP†™ÒNH›þý®,cãö’a­öã½Ý}B!ùƒÂ„óä½øºÏ¤Ø²ç*Ã6¢lCÊ“˜‹:›Ì­(!È êo}Ú¨ïóÙ‡iU_®Š’ˆr P”Îù|vW˜ß¦ÛjµXÖ‹åU´4_b~WE÷§Uá)¯SÐbÙ»§/¦É"ÅC}]ÖÓŽ³ -‘æSvÿ Å#·tI àÅ>K@vï3æ FSkÏn³›®Tòi‘²Æ¦rŒ(QqË#p.¸Žpt'¹ s¦1$¥xìèø|â<£sŒ*5¦á,žD Cç9ÕÜh¥Ùðúèž,öèÅûŸÌLÜœ @¡ƒ ]'g„‡`mÜ¿¶,AShðY¹æ. -ƒÃJBË[ c}õwL)ûœ†ƒ±'"Ôæ»íïÆ%ã "E.“ydÚ¥Y*Ɖ ï†d•“¼·0B¶~2$÷ -eP'bU–ôîG¡|þ‹ÿ0ß&Å¿ìÖé0+Êø$⃙<¯÷…rù6Öé > >> endobj -5331 0 obj << -/Type /XObject -/Subtype /Image -/Width 780 -/Height 425 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5768 0 R] -/Length 23871 -/Filter /FlateDecode ->> -stream -xÚì]‹b«(EAQA|?€ÿÿ—;ƒ&}Ü>’4mÓ¬ìÞ$MŒåpæ ÃŒ÷{ÛÛ÷´d®÷‹°·½a+†ýìmo¦ýìmo¡Mb¿{Û6žî×`o{Û‰ao{{N ÅîJÚÛÞBkø~ ö¶7lÙkWR}·m¿Y{ûÞV¼T -½Û6î7koß«^ƒQý}¶ÖEûÍÚÛ÷¶©|{§§™¨ {û涌 ËŽ…½}{;d Âåû­ÚÛw¸ÅŸÀÂÎ {ûŽÆB}˜¾¡ا‹i“ {»ËÆ›×XHÒ,¹}ãhå4c’¼°Êv½°·ûiIQ¾ÆBñÇ)1°™¼Ÿ¯À®öö­>B`™ÿÁBýmX(²l¼ ;/ìí±PlÁHõTÿøÂa× {»7¡pœsn¦õm× {ûVb8òÁSß¿[,ìzaoßÚ†ÃñÅx÷XPQTííÊv‹qäðw~s–)9J‡äþ±@ÝÞ®læ·üÝŸ_D bø)í|å\è»÷éßÄBûwþYR³Ë—Šá|ªåu>U—[§ŠÃÞ.n…¼¢¿øó«3±pâß4/°ðê$ X˜¯œkC^»Ä»¦Ý - êOæ–KÏÅÂiÎyó)mXÈ—EÜü¿&‡C4©XŠ«±Pîû -wáÍx¡ù‹??? aœmž°à‹8º}‹ÑYÅáE~…ô‚Ìöž}ß Ãccá4Ç¥µ¿ïõ ;/ü2/¨ç…ü–æž×/ì¼ðÛ¼ðèX(>£r¬ï ;/ìzá±ð¤Šå¾×;ï¼ð˼ æGÇB™žˆa× ;/ü¯yÁ/Ëöâ0ìzaç…°0<<N³ÌÉ´ë…>°‘ŸüxÄûœízaç…/ÚHIÄtV‰•}´=x?µmÛç§ úå´}W‡»J³x U›Û-´öЦeÕ†¸Î(ìd¹§6º’扶³)v½°óÂ×°PÃm¢NâðÊñ¸b=xå”t.t{â¨qê˜Ç·¦d{e¥Î¬}’9µ¢¥r®óslÝBJå¶í™sâfXðÓñ·MÇÌó³ÝõÂÎ ïÚHçø‘"G’šÑâˆ~ÄBš Já°O¥ð=†¼ejc€°!1JèòÕ Äë ÆÍðkÖ¨4ØŠo‡…Óœ3?žXBW/Ô~».Ë#.˳þ’ÕÛC]®wã͸òº¼$|ŽUþó…äÝßÿçy…ø',è` ¹´,”a Ù?%. u¶ÛŽP¹H®_å(­¥Vú¨S}ؤw©”ÉÍ°ðT¢j:v û¸z¡UŒN&庤(Ê6Çå>ÆåÔZýö -ïÓ°^ü×­ÕGœ¤RŠV/o˜VËëíæÕ«]©ê[.ÝÏú‘Ì“åòœº`#uaXÓÊ9}4E:{¼>#.PY/¥€˜|½(Dª’ …û¦E|Ý §Ú…ü8ÇðÀz8×úDmW&‡Á‰=yF - a®œ¬ázc_åæÍ~™ºþ‚#N2s²o·Ö›×VîA­]52ß³¤ûgýH³LØÁ³¼ Û>t·š—Y¡OWE·Û‹’× Üc4QF§ ]͢ʊ6,¤ËlÃiÌ°‰uì†~¤ÌüÞ±ðe^ põü¤Ô:Þ0*{ œ…®«à>J‰ÃBÖ…O’j,Hµ]¤œTñ†…:&ͧU ÿ2ø,°ˆøØ»ÁÁ)<ë¹Û÷œváG¤]Ó“µo'WWK|s5w$ZǦ$&yQ}Ñcð³~¤FD -¹X{=ôécŸ—ÀùŠ¸ð2=õÙoRðd­UŠ‡ï5ÆQ®Nzî\Î79§Cœ‹…ì8µp¬UõÀó ÄQåcgW,À2ñ3·Ï*—yXoÒöăã–+'8RÀB¢‘¬‹u¯¹§ âh…­£Òéú9`Œ+Waí‘vµ4 ìÙá­Å®êl¾Ü¯#¨$‹ãtçê#F….ò'í¼ú¹=ȉÈËírÜÄd—aaR+ÈÿÅ‚ €þ"½þ‰umõ=`áT¢*¤‡¹ ù:šöÁ&>ÈÍG¨Ôrõ¶ §}³>˜S4¾ü_× sšðtÄDkI»øy¨!=`þÀíÓ2 |Y§púcºvî9ÎEº™ cÜÑðñ´mÛtO;åéSÁà%ݶ?¤áGLðt|ï‡x³aÝù’6pÜ¿lGÀÝ#O~eýBn¬5/&cûzÊf>]žƒÙUþ:Nµ k¼Ÿ×a!ZGúÍs´‘4 Ûk㢚ñ5cÀÿ2‰+UµŠ~qÌü•um½£F¾˜™,M÷JªžR§ %™qä÷±p -Fæk±P¬c>Y9¿Ú.jç8`¡¦ŽZºZNÌ×kçÿ[œjD•²ãwò+¼PaÉUÊÓãP’ÈùØva^R;vdYì%lUjK߯t‘§Q•­s“C·ÎB¶ýŠÆhÝãí±pR u‘]‰.Ñ_äz±ŽX0 dÕy9­©#‰;\sˆÿëú…ìëðÿ?Æ¥N+¨ N•l5¤NGö«ÐRéñæ:Ý­;¤’+ÿ€ Ãû“0ëTó¨¤ òg'é÷`©OÌ×ú‘"çÚVn>˜ØÙà Ýq^§t Jc×aa_¿ð·üHNÒ¯n -ªš5:iÃÂ!9zŒOÖrƒÎˆ~*ç-.ÒªàæÇð â÷´xÝJ¤\Î/ÂBýׯñLüª[§+´^ØIèY縈š®·‘öõ ÅTbñ0è40ÜÚ+˜Ëà:ÈËèä·(›H†X댦k°Ê–=—©|ÝÐ*c¨?è’^zÙO1ÃÕóÎuÓœíl}YfµOxr$Ÿ­—¼¾ ;/ü½pìTõ¶&¦<ò¿XˆÑéb‚¿ ÿ,Zm¤Íg0«m)ƒQ<ɧ€ómXðÓ±$ÉÁîëw^¸锫]yá„…5C´NzÁØu2&uzsÁP¹ švÓŸc$x*7ë{°pJ&è¾Þyç…[ðÂØžf˻՗š¬ë÷ó6ÙÞáÄ]dMkM·Zê£6k€îè‚-Ú-Ò/×:IJ×Uô}X¨O•röõÎ;/ÜÄt?íB,øåèÛ¹T/¼½¢·þ.,ì¼ðWüH þP^……’J¥hûr¸&ÿÚ•"újøö®î€þXX†«°)G©z‚.ýçšÉ/W—ÚõÂßÒ  õ1v9h,2¬è]¢¹ëpø׬i‡XDdµ½"§Ö¼uG6÷B‘Ïí%“n»^ø}^¸ÄĘO O‘w‚Œïg°_c/Íìd[“Ûùû±pt%]Ž…{}4u[ì1[]Ëa²=„_ÕÖ…Eª^XØf]WiÜ1¯×ÝÕq>Z{mVžØ6ÂÕûøÕ¡š×ÔXø‚ÏøN².jÞÜËm'ü áƒ:áÊþ"/œ÷žãØu~!Lt±¯×Â< ÑQ;ú‚¨}Ä*|§_üŒõµhuÇڸ地%†!6gl-Á³´,ª"U}BÄ_Œ^ù²×d:…íÝ ~,Ÿª‹5¤Z®-‘v6•ïhLK€ÍÃê¢!˜o K‘„­<˜­ -X,†Í”.SµeõÀ~I[Å -š{A ü[ÌœÞÚNÂöµ6`w0\-À–JõveÌŽe]R`v½Âæi駀![³.ˆMÐ_Øp¨ºS˜ _°ð´bA0“ø‰VpŽËïñÂÿ$i@¦Çʧšà vÕKwHœ3=ú#ˆ£½ui!;Éi€…¸˜8‚Ó"­“•qÑD>Ú%˜R1vÎ:˜­½×ÀàˆB¯N¯÷,8 Mµ­íãÊuÌ)\««ÜÅ3­‘ÅÖƒ€MÀò ©R-ú§*'ØÌ„zÅB³2­Ka?ù/òÂÿ ~æU!$ü]õ‚©ƒ_w -XȃåÎÖ!6wö  Ó28J#yÆj -j®}rþ†”“G,TÁ5Іiè‘Øá‰G4áBïü˜&‡àâw̼~Õ8Ž¹AÐ&¢ªf›‚½Ÿ<—²”*ñiœðC™+Wæ &rµª\*w¬ YñPzaX±Àú*OÖú0+F¸>UÈî4Î}dq³a¡qÊZ*L’Ž}ýYގбŸx!Ý°°& Vˆ…8|d]½¦9A|…Õ‹&á«Ð·µD"=¶¡›ÖTy\õl’ Ðõ˜¬XÈ)g2Ø÷_ºßˆGz¿×›e¾Ê÷' à£2ù,øá¡êµ^ÐÛbÃì_,)˜…Ô~Uø±ÀÍ’bªû¦ãŠŒ ìæ,¬01á­W¼°a¡”ú4ÎQ&ã|šeÉ ø-ø4Ã*dq»€Yçå‘8f¢GÒ_áBß»U¹üw¢¸¶Á}W§ÿŠ!.[O_Ÿþ8þî·váUzAšc‰ÿ//0g¶ü–¸ØVžô#ðtìë`¾‘ÚêiPTб9i·tö€4̼]GG¡~Ƴ -9b!QË1 -[´Ž2'…t=q.;baQÁ–‹Üå3 ¿±®M»÷Æòø­_°&¶ˆÞˆËÁñ¬‹_¿×þ¬^›‘˜Rd½öMŒIaøäÁ窭º±#&³*Â$LÍÃsvñ½*|¡zL)\mII:Lp“@Ÿha_ìw„Ï™j|¤",ì)°‘ð0±¤ív¿RèˆZÕ9~ -;æ1 |yxƒ°š"X@ @ÆÎ:¿Q‡öi1s³ ;lÿ‚)¶Dƒ¶™´m½Ð£÷m±ÈèC@3g– ¾Î%\PKBb‹™bb­ÔsM‚ÁÞ×À„“X•Õ“oX¤M£•Œa:ý¿bášù…ÌŸSÌ@Wó2¼‘`•hŽé?šð*áu‚«†¡Áæð'o’aÍã˜ð€ÅAà4Ãúù¶;Ø.ËÂ^ñ­ˆ¤åi^78žº&ÈÙâ·†Á?Kf²­JÒ2ã&¿˜ÔÛ®—`"•ïÅ@ß“)vV+U§Jjg„B_B‘¹–¾Ë"WªŒ’â ,žÎœ6á'ÀÂa…«péREµëØ~4FöIŽ)ª•* •­¥Ùÿ —Î;ß(•AÄ.ZÁÝÁÀ~Ñ—³:¢¾ÒDúq½@±–‘ª--æÒÎ-RU±Ë0Õ‹qCîF4“RWÕs)SÂ+ÕV÷v*•Ç_’^‘­ÿ§ýHXyÙk•Q ±ëÀh¤­ãRµ@ôÐ××ÎFy#PIÉ#žjt•«6@,$RQK+ô¢UnB, ˜nuøba_¿p=’˜¬Êjª°ŒBÙ8úä‚C.`x!‚Î ÿ0˜Hš 8a9ÖC?ÔJe Ý*Û,^ĵèsnÚ¡8a¡ì‹…¸øŠ…}ýµí§ýH ¬r~”Ê:Vb@X­X@Õ¸ÌM5küÐŽ°;ú-ö½&ç)²]/ìí×üHwÖv½°·_Ó ;v½ðð¼p[7ñŽ…]/<./î}6¼¹^1ûØ·d¾Î²P+ÙžÏl°í'5zv½°·oÐ û‘=QN™çÀ2õq‘Ë7œ²3ìA9ÉνÑ8­Mì®ööüð‰‰Q¬î½Uœ–R°Öb`£îµÓW9I×Ý-¬/>^ô¼ë…½}/|ˆ…D,ô]ú*ò³&ò«ŒN‰mëÌfúÒçCì°¥Ú’Á§¬ ÁÂF­á%rÍžQ¸)&Gâðà‰Mè±µlö |ÓÄ°c ¿ìzao÷¤fcj]Ç -_E¨[:ŒÆÀø(QJS×ÕŠ’5ËAá”v´ìÁ,:±ÐŽ1ŒòÌå…~”½(ÚZš, -#úÊA…oŽN1éf8 ªÜõÂÞ~”>ö#å8°'u`ñ&¶nŠ]½ $¾1Øbêפì`ѹ®ÚŒ!Ø*Ç¥¸rZ×äêçé-Ї€GpQÇ‚ËO&W*1-Æ/5»^ØÛñB=?…žÙH™I bá€KH0W^À³™Q†,`Ò¼Ô‘n[½³òB:r\“¥¯ìÿ ó´gø•Ò1­°3 X±Ðv!¦o× {»#?R -=³wí2J*œ©«#ÂrGÅÖæNUkÖ©8c®8V¾ XX{, ‰Ñ¦¨^"Q†ê¶K›ÎÌM•‹yëÒ¾I\zFA,`Ö¤êÃN»^ØÛOû‘è‚¢…{©¬tÅÆ ˆ¥¤Sc£¤Q¡ãÎÔ)Èý[XXVèéCÐ ¸ôGJ^cñíK¾Y¬¼TjZïzaowäGòºe–w°ÇGCº,)÷PÒéìÓ¦ˆ\O’â›Ð²4½ÒõŽR/¶…ÿS¨5ç^ä<ÉÓ¼Š2,ØãJ¦2Åä†6)¯ÁžâªûŸù‘v½pçzÁW¿t{¢×€ïzao?íGò5å÷UÏiïzao?Î —¯…½Ñïóÿ3,ìzáôÂðþ®öv{^Pûú…óŸ]/<>/ìX8§ö‰¾1Ë-°°óÂ]ë… hÍ–þYõ:îzá÷ya_×vNëAVåÅÐÆ~XëÍõø”çÞgQ±baªú0¹N*~Ív½°óŸÀ–•©qš«R»Ö– ¹£•1˜£ÎÉÙÇð ½Æ\ÚõÂè…Ýôy›ÁºµÕ¤\8H -]4ÔeX®†­?˜3Sët)å\(½ë…?É »錆ñ‡™t™—ŽÃ?á•VnÁÔ€[±Ví¾q´p´ï•ºÂéô¶^HÊohOgW2ó ý0¢ïÎı^°‡L©]‘ËvÖ[çBÃm4Œ¡%.g«& ¦7Áæ.l­á.M,Œ×F¸:®ÔÅqë7ŒÖ¢Å¿€à… F ÿ0;`gÁ@"®ßD5cMmÛ>¾ oê…Œ*©nþ¿=%sÒZzãÿŸª5{‘GßÐÆ{× Í3±˜*œ‘LdD ‘ÅfáY‡‘m8mÁù`ãLÝÆ:l͸ÈZܺ3ç©8?„­i”ÁÖð nMpÞð_±‘ZÄß° ðvS°. ç”Ø° ëØ™LQ@wwÅ!ÞÔ \‘êæM«S_ÍTtûazz*Šž:€Þÿû·ãß €-<,/_-ï~"^oùÆWÖ‡§m’ß°‘Ji|¢€`ž[G-¦“-¥Û´q”:U`¥Øó“|ª¸ZnßW£§¾ÊU|ûýÏOXK]147nË?·ðÞx¡~»_‹–+¶þ,ÀuuÕ&ð¯Ä¾×ñÜN­ßGýB^Êü”:öz‡š‹Ÿ°}žñB®\ܸ•ÚÞ¹)¦Í›Ýûæm-zôÓXÞL…Ÿ’£‰ôõö¦^àß1ûÿ/äîpó^‘éoã…<‡~ø ,ðBŽ¿oÞºÚ…›ÙÛâAyá°pw~¤äGXAÌýò+X‡·|gãíÌùwôÂÎ ×óÂZ´:) |ù™ö+ó ?ЖnÍ ,ÔAìôÙX¸™釰Pþ.Ò0™„ê˜3Kq¾$Õ7Yù·ë…›ó‚ Eà—é§y!7ÃÏhçäw±PaN@ -ONMp oÒŸþzaue ‹/òBItkÓ¹e,‡6ñœ” cdñ11é7û‘Rö#X£~ cKÃ\º¹KYW.º>ç…:ù^H0¬“,ãðßimvÞß²>†yž›åµ5Íßè8Csºãü*^èíÔ»1u,nm¦ -N 'ÖUMßìGú)í<±æ—±@0IG륂Œ™ïoà Ÿè®G”ßhKWêÿשµ^דÞ9ˆ‰¨¯T˜Ù=v–Ižå¨_Ž´ïñ‚XŒ‚ýÓèeïy÷ÖÌZ{œˆmÈ$.ç…’‚kÒT“[¯‰×i®º¸w&»v¾(ÓÊ¥µ£ÇèF¼ð±^X\,[蜶‹˜{“äéz“ÛWÈŒÿɹö6/0Û)OäX@;~~8sÚ›æçð‚X¨MóȪ‘ó¬Ä8^–|)öK†¯ÞÆO‹hY7⣛ùå¼.KSš F3ˤ“„‘vÑí£øT];wA/š«',ü„^Èd -|@ vìÖx>Lyæ§(‡n7”)>ÙvŠ0¬QÀ×rL×–ÅÙú,^ˆuª=Ù~Ô„`„O æÊ:Fyѳã, ÁÄn=«`G¢g¹=“¨Ix2»*)ˆîADŒÅY.i¼tŒ¥ zÝŽ<ŠHŸF"ŠáËÀy¤p/Ô&FnØ°àµÖp.%œsmÚo÷#䇴sýÛXÐã8àõÇœøëðþŒ^è–8›Üê²â>’R¥•Ä4œÞkí⤬C|¯(_,µX=ÃžÇ |â3`LõEøBQmU6)É,ÀQKàÂÂS©5fùT¨)³–4kc™TÅ™¼`JÎ#Í -¾¤9ìH«.R²"’•fL2*£(#”kgˆ"‹q¯”èyz!•Sã ½+|blg7ßÏ ‘ýí|Ðóïë…`S¸–sÒÇv缞Æ/e’:g~¡u0èƒmêÈÙL'€dä©­m¼µYæ†%Àui¢@)¸1Éù~$¡i?º{l\ªÑtðË,ó”Áõc^ö`„kÜ$‚Þ¶Èü<^°ÊXªtÆL™L*jÁKóvImVFS®Æä¡"A,Pž¤rUïð#ù©+fΤîckÚMÍX¸Ñº6þCÚ™ü®v®ŽÕ…„EŸªx ÑËÚ< Ûÿ®ù…€ C$4KcÙBOŒem±€‹^ø¥¤ôÙÔUŸË «€–MÓÌ ðBæKYÌEI|Òj¤ZÁ Ë•˜2ƨˆa/´çê4Ùã…Û*B¶“T¶âÜè$VÊäu+a›23ºD,VŠE¦…úT;ßݺ¶ÿ‰v>´GÛ¸¬ŒÁÕþEÛBZ^©¯aá ^(€êý2¤jŽ5B[°% ð&ümÛ€ÛáKuj cŸ`á5/õB¿%`að5%Üš>E^¨Ðò® ÃÌhGѲbá\½ “2ãBؾD,dS¦ôýD*£ªJB `!kW, rLÕ5~¤ë°°k絊%_ÇÂ'ó Ô`7]“Ö* X´4<°‡I© köFF—ò ‹@kÄB¶aA’Q¡vg/„ -b–u*ñÜÎ…\€ÒsõB13b—,UykOÔbtf{ŸPª´e„X 43t);)R5òŸâ…aaªþÚù}'{õµèí³â‘ÀÊРf¥O]™P¦oQÙ’PuŒúJöDˆŠzé4è/Ð [:y¡A,”ÔjKõÆ ~Äu¡M¢¥–M" }©?ò#ñu΀‚ê'Y®¬‘UB땵2ÍZe¤–!¸VÔ¨®ýÞ¼XÃò¼p#?RLÿÚùÛÚyñH¢Ã(Ç¡§ö5Œ Q‘‚ZÖ¸„ X¤±Çr1¹Ä¢Ÿ›ÎŸÏ CšcY‘øºà%–Í(f¿tU³ýgÓ[uâ>ªr€YWÓÄÏ›wÎÓãZ×FBð±os.†8æißÃðÏ£6xZ1æü†6ì¤bg‡NëÚÄò˜#=<(®Gªí…Wâ÷â‘øÑÚYÆOOÞæYX#Ìño¾¾gL6Bˆì@̶X,»ûum?§šýš”EZ¤éüX¸&NÕÆWcáŽãT!Gäðln•S«á!þÅ‚¿7?Rg*F)µ9Hí\ç©Ó߃…ë×/ˆòj,Üóú…áÄ&3Ã4…r8ÙHA3>=”ˆ…—ï½ÚâÕÃÛïo6Òg›}¾EÐ΢Q¶%®ËÒ§Z8ŠÙyŠoâ…ÿ×ú^–eÆ_ÛNÿf‚€Öª0Qb@b°Ökjà¬4 3Ì–5RåtIŸZD !‚%1f¤7 û-Ç-b‡átiˆKÒVÑ<`F£±0¡Ö‚}T8àµ=îäV‚±‡ðPb+ÛÖâ4SH¾®ádJœaÉеÌm†1kƒÈ:WùF}#ÄÔ¿‡…mš­'©ÅßYªá:Ö½µ†FŒ²«}ž¯Š–´môÚSZw‡/óB÷ÁU'ßSvê×3–*‰'åR ¸†DG!Ñ®Íóîö‘ `]£m%šVп“þ€p& ‘NÏm‚ÉHðçÅèÔ‹ðCè½e;cèT‰3C°ÅØ'ë¾ÃùÁ -{/ö(Ñ.ˆ\šUÕø€WsÚá¡jŒò^{µf|€}ä蒈Ž0GæD  ‹È xîZQ|'/€v 8mÊf}Ö(UÄ0#EmµN'…SÚ:òýz8k¬Ò¯`“˜è˼"w‚™ þÝkç¬Åü,÷²8]’T®à%-u-Êd‘ULݦëZŸK~²lD4HQ -ù zåþ@R.ÎR;c’<Ÿro\ æÈ¡êo„uéJ"»þ¦œ¯Âäð¢¤2CTÀOYg•!¸¸Žª4ŒŠÂó(q_\v°[‡éäJY’àx5«éߤâgð`%‚GÐU17ða<,¼™0ühX¦á…ÿ©`Gíüæ×þUUÕMßéUM~ &Ëʲ,$¾VtÀˆ$ÆcŒÙ&® -y&ÕÕ»?_/¬­ãžHV¬Ë °FðœJYùRKi—ëxÁà:c ±”2ÆÉ·h±RÁÛ\7Ò¹,¤p¨ÞsÆûì:^`å"8Õ1Jw¬±#ÏZSVp¨ªœ¨Uí‹•g)yקzoó Ùa;çlõ?¤vÞô‚k–(êyÑK§˜]˜¹x,ð/`á2^€+ФrÌ:™õ´öÄ&2.UËs99mëkxAP>‚V29ÈOŠ &sÚîÆuoù‘°Y÷ eÕ.Ð ªªZI¬R0µ ôƒcWK]ôj¨T”Rz•^€uÀx‘J„$°¯ÉK=ªöP:ê6,PÐ #¨ì¢{g¡÷y¼@û–9͹E^°œ§`fòI²”¨br×ó·oGo¤Ï^¦6¸™ÄÇwŒ *«–P9 Á Ú:3º^¤r#|†|а‘ãvB4ª/ï6f;&Éwaá^ˆqta8öv–Ü Õµ¯YêCíè}O©WÍ;ëÎ6õ£.}a)Îìv C,e‘NR½þjRx6ûU}aÞ™XJm &‰9‰ƒé²…ç”Ò®œÌ(®ã…šsœcβµ8=ÒuRû2Ãùd¤íuþ0áË7a¡’ï䜧º.ë çߢ -ú=Ÿºê¨=Œ.…s¶$ãsÏ|žÒ¸‡¦»®‰coîO4cöëXø–vUÕ\*â$ÄuùTÚ.D]Î+ë‰+j9ÚäJĺ6dIå!5¼4¬”ÕÂÜ÷ðÂ;zm¤–0j—–I¤R"…¯ªÄ脧VIg‚Âk]E.Z&À¡ W½¹Ã_æ…êå -.ÑŸ—·6UŸo·×_øzžíI Ÿ™ãFrs¥±d4˜$Qc¬t-ÖQOYªÿ¯ô­~$Ì‚Öm÷õÞŒûi†¹x§ֺjQXË0ëP:©4’ƒH[Þ júU½ÐºXèÝy)¶ë5Ç×ôÂcð s Ÿxa„ÞžŽñ©©MlebÓw¸ ×ðBfCB(5äÏU&å|Ä‚Ihì3šjí½Õ™Jaƒï±‘º·çðÌUO -º:…Ñpè¼,M›š±°¼’Á/²\•|ô­Xè1ÏøÓ!œ†Îl–”Zjy"i<ÆTx+ËI}[^àiû"Ïò?Rd™1Éb´6œG1S^&§Hƒ”fF×%ÄÂ…?¤ø,ÌÝ;Ä m¶Î(HÓRÃ;ÅZJJ¦Z¡•aVæe% “)€‰O.Í%– é·µó÷×kŠ.‰vQæä+1.³Fö®õ‘ë}%±# Íòš>cn˜0Fñ ->¬\W;9-ϺËr eúŠ^O9…û—¿¢UoûÔá®Óëx!‘0lRÌ@ŸÁF¡Xiç,Ÿ9¼•Ðô2^àae3üCß‘XcÖð‰‡IUÎË^‹l]ÿœ•‰Õå¶.:l¿~ýŒù‘–Iíë"ä0E^,|‰¾µ,Å˹¤‹‡3Šäe®üÛÕåyoï·Œâ|b¦å‚çÚTB „iælÉ"£Ó²è1¿øÉJ“‹‚EoúÖ†CùÝXqBá?.çËHi…ór€‡…(Ý»20NR'cUÛkøK:]¿ - -È>_ú¹^@ëiQ‘Ø/FƾŽIßø$JIeUViGÞqá -f¨×Õ[šÎá…ÔÖ!éÊGx”‹XؾJ>@oð‚ˆ‰yÓæ|è‹ljY;A¨à‰Ç…ài´Õ/ð¹hzVY W•[¬ùTE„åâÏÄ#½›7/{Ê}ÀCžñ ûŽÂù–ý ðn™ÅjÈÖÍÄoiç ñÈ‘SJªQJ—RÀBÏ¥ªÒ€…`¡í{蔕³íXß·éëu üs^ø\/  Ër-sø%Q+ÇDIV Å¢VžÙ˜¨%R}L‰‡K<\Ç lºŠNó4 €"³ ba†Û|àû—²JÂiW SK«¦…êXÓEPu°}–͵긦1SEihÇàê#l)§ÂÙJ«Bü™x¤Û¬÷ç‘œÅ/¯_€KÛÒÍâ4˜§Àh’. Í®oàÚW ­hÁ"bä¤ÃÕÜ餥S‰7§Õ57ÏÍä×~]/,ˆE‚m–XV+èµ­ÝŽ}Ôàíìxº¼¸Ú”`¶à -=€–`rŸ„D—|ƒ\À–2:Ÿ0Š€ó¥54ª‰lÄ ûØ’†Œ&`Á÷4+T*5£œ!CkOE¹Èö¦(hÈì¯äSn”+l?öµ ó÷kçô1!ëÒ±uZAÃ?èÎ=(ûBU K1†Íõ™vJ¡”$Ø+}0žÊL¡³B%¨ª€ŸOÏVœÇ $ÄÉõ8$¥T:ôZ"í¥ò|]|F~8^=¿ ð»•E?T‚Ù´cZ›°ªSL¢—¸:Ÿ0Ö(œO9ùÈu8sЈBˆ„#/À¨ÑRÞ‡÷ @`2Õe)(hnôAøB«ì¯äS-È{9\øùÙèUŸÄl»Ÿ˜wž°4M} -:ÅW5ÇšTðPsèn‡±Æ×n×ë̃ù†Ê :j¶Ì×ðŒÛµJœ‡…Oy° ¦a˜—<•HP:2JQE­–¦™Ê«yAàœâI/¨¢‘©ö1b‡âê|^à…ŠŘY¯è\;cÑ€Á$D:/”±†Ô8ŽÅÔùTÚ ¬ܲSª~€…»Ó õ;ã8yòMŸaaž?ƒ‹˜Ûß©uþµyHõ©‰tŽ^p˜/2ä®hÝÀ¨m_oX¨$êý˜«Ü/2e£êÊ«y¡Æüc-3ø¯Æ}2øˆ·aºTùù¼ Êʲ5Ç©ÀPæè°4늯7 4ßñ#½S£ -±hJ©ÊGÐE"–Tš¥¡ úp%ÊëÖ*:ee‹¢*Z l¾¥Š7áÅÿ Îiwd>œ(hsÙ¼óf5áºjq}ÂG±®tDka}ç´mò\lÞ¿)×ïb¡60:[¶TLªs¶ÊN³UE©%o]¾DÀÀ£ÊÁd. HDrâ¢éÿ•g{¹¯8ÕáÃõJñGÿ÷âTïÅFÊÞµ‘j«“„вµeï!ÒªK¸e ŸBq–„`‚ G¢ÝHè;96ç~yL,ÜÛú…ú#»îõBÇ#‰§¬yWaáé¿ZA,§µf]#ãLض3`• “Lk@Èg,%ÎHCì{Q»Q;Ÿo#ý×/ˆl<$Ë[þI¦òF -ˆ?àGª?à–a®Ö&1Æ.ƒŒR1çÖ”Iä&¶4ñIU *åR?÷œYñ×êµý¬^Hз<µŒUð<¶-i»3Û||8 w°~A,UÊàºß"¥¯êù¿9ïŸFòž^`žb1:ÉcU-Ôæ•ëÕe¸6’ ‹¤Šƒb)q9aªT•[™1ú/<*.Ô ÁêÍ:à.̯pð‹ë}NË;æ‘•kÄj¹N -¡U5V6“K›x×;Vü\è˜ý½üHïiçDY,õð’ Ckt,†¶àÂêÖT "¾ð‚VÀF:Ê"mÈ”EÕ{y¶í£Ö¨ºH/,´Áäþ8(ZwçÄ …TþƒÊö¿Ï bn59ð¡‹‹Ö©'"kL:©´é~ zEG³Úà ÉŽÔ·j烊p…Y4ô‘á+D¾e5zÌ‚Fæ|›qÿñSž½W5Š…‹x¡£Þ÷k";ÎCžaœvæ±Éú^yAK¥C£¤¦! RÖË-Õür5“´Lš¤rTKºe"þ÷üHçÆ©žÒX’]’=òÿ¡Ïå¦C[Ÿ`žö “:dˆ¬Ê|§¼U²©¹$ƒj=;µžW[‰˜ea’ûT:WÀ—'q–TÿõZ碸Îõ¼ël—„AGƒTÊnX˜Õx«â^y!3†‹’ÙFE™ 8f-]ª+/ÌX£Äº¨’Óÿ ´ÏT°Kc¶_ŠcÁÿï¼p‘^@,ôªöI3ôÔ÷ © ¸¬ýNy¡4&[ ƒŠøŠž»Íg]^H ´«º®©äÀÓ€þ÷xáŒ3Wð,⟠îÂÏ`Øç°<ȆU;û£v^Ôx·¼ÐÉC½H$˜- b‘vHxåÒ€°‘2 S%AU«t‘éô#}XßY¼õdzœÚ]\÷¸H|*Äh§]/ø5 v¬tk…ëëHßZ9Ÿª/¿W^‹¡­¥Ksƒ¢Ì¸¶ za˜¤é%åÈ …+8¥ñô#½o㾦˜ǧ5j;ü¦¹í“)=¾·º›î°FÕ=é…"l9µÚCÈçDNºe¸ü¿µ÷;¿ †¸í>D³Xò50obR\À{3³Vm´p0D5|¬þÉ·þüHÉûËo´µE™›¹,Ì”uÖ!²ÈZ6ÌzKcEã”,¼‚– Ór›÷sŽ?ì¼óEz!Ñﮥ²¸ßùL³¾ …§ø -‘•«c}UͲmÔÛº–?§B­ó·W¶QY JÏ”•fh`Y$I'õ,¸¨j”fj%ïUÛQ0Ç:ún8Ò´]oûÞò ö³”›OõNüHïÖkã‘.¤Ú§ŠRÎ)ãI{0ù «ÚT¾¥%>ÉÝÄ(¯Ó÷ö&¦‡S½pýBþ^A¶"; w›OõOÇ©ÖïžzÒ° ü<Ö Å  ò2Ó×-iÊÅìbb9é;ÕÄ(ÇÇIJçÙþýõ ßìGÊ*y˜¦qâ“”–/²mÓð!,d‹¬J‹¼ÐÈ(ËF—2ÀBAßÍÀëÇÄÂÿ­þÂ=òÂëµý£ux¡ªìƒ?µ£ì-N¨ rÚNª«òV -M'Á$Xx¯ÊÏãú‘öú ³®mÉ×R!ýøºf'o•vé䔀t˜­¤ ¡ffJRÚÕ½"å*%f ö„…Pô{´s=Üv^x½°ÖkƒRíôr1’È&L{0ÃçðÀEÍzx5ðTD¦Ú/&L… RxO !ëÁéë ¶guyr~3,$–5wƒ…]/<ŒÉYY– —Î)Ö¼ä±f<Ú–´ò*ëç[ɺ§^ìƒVJÉ<ènø/UX¿ÞÄF¢NééN°°ë…?Ä )i?ü`%x¦–á`é.¤©ˆkű¥Eç\Õ\Ó,}z=Óõ\w½°óÂE~$®Ðúis¡©Š¿ˆHåâ¢5 -â9z?(÷­­ªï ;/ü?Räæúƒ–MÙj ’ÌËüL<‡±A˧y;XéßÖ<}ÚH2N÷í±U¡1çtuM“òù·dÙõÂÎ —ØHš~ø1–˜´3pÂœ¤Jž"Šx+Áäg<‹í¿Ì Šöà Õ6½sy•ëbÍòPÀ{·Ð NVÂßEÛõÂŸÑ \uKçhuó˜vÊ–1Ï0+ëU˜"ÅÊŽòr«ÇµVÞ)³%!6_s"„ ð­rŠø&l$Ù¤•$Ñ)3ÈMëµÕTöw‚„]/ü!?R+“7(ŸÕ¤, "Š±Í³ª.’NóŽÆŒ\4­F¿kŠ¹}f Ò"b,Né+²4&í¡[Ò¸cí ZÅ&NóD¼.RuŸjÄ÷ù….æúYñ½ì™ì,4‹ Z:Õ„i- u -sˆRFå|†©¾¡ -³$i•D1£­£:V <i¢tºÐ©öõ ;/ü®)ýÌ<¯_Ŧ6"TÅæe/—Vk2*’ID͸Ì/w£Ÿò¤¥žÉ%I‹n‹ E«†2Âw³],èÌú¢ºmý XØõÂ_ñ#ùI$pü¼^[ÀBËclêÔ,ÑÖÍ1]xC',Ý›i³G ô‚˜¬´ý’b!¢²†¿3Ä‚£I1!'ÀÂ3^Í’¼Ç#í¼ðK~$®>«[ßÄ/±0,ÌXcL1b^4^§jÆB\ =“‰ÒÎ'")Æé Q0¥1~[ó ”óA‘…¾Â& -yd,ì¼p÷z!ÿ|«ä¥4£„Aœ©tYↀ9÷®(gP fñ‘åL—žQÐØå"û–¢jéÕXæ.äøÒFMÄ »^ø#~$ûi©îë‚tšCÆ`T%ãlå…‘ki@Ï’Ù–±3¹´>®¤¡vÙx¡WÒ¨6[¨ìÄKíìw½°óÂ/òÂÁ—ÐB°‘øÓÜqZµñœ‰)_ÄBÄm¼1U-–n‹*1öm -’·ÕÀGØhŽxKó>çBŒUÁÿ~¤]/ü ?R«’Ï6鞯¾,tÏåCHm°†[ðS*Lx°¬I‡¯²cLQ¿½7ÄòezÙ䑱°ó½û‘>\x•C’§”ü+¿·Ò[¼Æ«]=ºvÞyáÎýHÅ9£ÓËüH¸@çFíÅ®À~_Ãå÷Ùf·óÂÐ g¥üƒÄÁ×,\xoW_Ôθ4èN[ºóÂÝû‘²5‡í'­\~¦}Q;‹fnî´e;/Ü=/äêAü¾XëüžÛÎ wïG2úŒäG° Fyxd,ì¼p×~¤éóÉ…pB? -bj‡v^ø%?ù|rá_íü}í‹Úyç…®ÆB¦ôY{ú)í\>4v^¸g?RìΚòŸÒÎÉCcaç…{æCýaAÌôÈXØyáŽýHg?c#‰ƒžw^ØyáWüHŸ®ùÿiíüÅ5ž;/ì¼p¥TKvæžê];ï¼ðÐzargfÉiçÇö©î¼p¿~$r®‰ôbíÿw屇žkÛyányA|’-ïÇõ‚8¬%v^Øyá‡ýH‘[î û¼óÎ ¿ãGJ,={OÉ®w^x`?ÒèξT/ò#í¼°ó£é"Ï®Òѽ_ys× ;/ü}?ÒÙ“ p>ð/dñÈXØyáNy!½dTÊ~F. _¬u¾óÂÎ ×ø‘ì%Gø)í¼Ç©î¼ðó~$îºówÚy÷©î¼ð¨~¤ &¼¯ÔÏÌ;Ï•xd,ì¼p—z¡¶ì‚ñâgæ|íÿÎ wéG:œ·æÿØ~jçcç„Ùyá.y–÷£~¤×Î;/Ü£I¸KL¤Ÿš_Øçw^øy?Ò™kþO›ËŸÑÎÕåI†¿†…îÑtarv>þмóE9ç§rç…¾Š…Eå—íégô‚†Kj‘ ÅÃÂÎ wèGº ,o;¡PFçô ²ð€W"<𧇷6䯶~µÍ³­/ÒÎõXþ-,ì¼p¼PKvÙŽ²8‚žšâCÃCÑ ‹˜ªyY† -®ÇðÐÁçbQ„%w:œ0¨`Ã1[O ÂÖaÃ(ÇáC‡­/ó©.ãÎ ;/|Í4¹ ­‹H鲬[Äfe]IQ&©šËrPyRrÚ%¥]]f”Ôe¢M[S^&‘Zà.¸u‘”MØZVIYZ†ZØ°¢n•I,Åe~¤C¶óÂÎ _ò#š\¶£’ãmLð¡ÄK]Ÿ|†ÖV°mÂCÂÖ§m¶Wõ‹­ËÓ“ÓÖ ¿Ð§Ê›?……îÎÄUwßÝæl,Ôiö—°°óÂÝé…ø’°¼»Æ‚^õ&1Ük[v^¸C?RM­,ÔÓ ‡Xm•»ÓÿäÎ wÈ ÅÝ8\ƒÑL/¯›Nï³µóÂú‘ˆòƒ…¤¨_`¡½ÓŸ«îÐ$ÉaÁÓ‹ëFî ;/|/”É™XxÃFÊÕòHX¨‹dç…ÿ3/°êøjì.Å‚5þ‘°àÅð//$Ùw´u°Í²äZ,ì¼ð ¼p8]Df.ô#]´æÿ/`!yF /”Åô ­ÀÉúæ0Mcr%v^¸/dqJÈâKx*³ç–ä~¢2¾Œ"5<üÔ¼æ…lþŽ³xN'>eWbaç…ñÂà(1táNÚ˜õ^Qm\>JÙ_äGª)ó†…zzÍ Ùôgµ| ;/܈—{OÛ3ëÊã"Mc<1—ù‘ -wx,$â8T-¯yá±°dÙaç…ßæ÷^ëLM¨k4ûA,Àÿ½±¤>×F"*y,眳ÓÃ÷óáÐø+±°óÂxa@_¨f™: /Ôê„…˜4ÎÄÂâˆ,øùhÎÍñ—|ª;/ÜL/D>“݆â…ú?Rç–ÇÁBv¬¼X¦õOñ—°°óÂÍxªKñ’:§“ üH`ráíÜûÒ v^øé…¼ŠjŸ`È>¨Å „ùàË<¯Ï÷# =ÊãÔByø1^(˲¾ ;/ÜŠÜÅWî?‘þ‘°à‡£Å7.?Ä Ãaš×εí¼p#^XÌp9^ÚH‰$……rÜÆèrú!^Øçî"érj~…Ñ…?LJµþÀüÂ>ïü>/ñ ñHçÛH/Fž‹×üß=’c¯és^¿#4oþò\ÛïñBr3÷á¼ Š&?à ×`á/,ß1Nü.üÄŸÃÆ Éw„æMä œk›ë+±ps^ÀxÜWRþm^H,i¾r§ØÜxkš/ gðŸøum‡~œcà³ÿÿ­_ J)™¿:Pù„…§«HÒW¢!—p”S[ó„…ÔM\r¡]5½T)ø÷´W÷ìP/-ÕzvVÑ8WŽEñóY™¿l‘t4ÿzœvÏþ’õbÁÏGÅPðÿ/X&©»çÁ(¾5èh§·dϯÂB#˜:î¨Uýñ%qmÿ¢Ñ€7s^q?1»ÞŸWÿÿ“Nç·®ùïÅnóˆ…“•Oÿ;^`x[_ê…H=xÏhÀ‚)eWž:åd¹ OΩš_,¦MÚacH™~Ž^p¶e®ŸŠ±(Æq{œ m^¶Y:Û|½§ÒÓÃ…%Úþ -|q´§ÄÿÏxaNó<]Îð#ÕRuצÛ)ezËôʧÊÓEÆÏô"£½pñì¿ä-½p{?ÒÁʼn…1 £ßó`¼=¿PG·ZÙû|~áµOµ‹8?Û£*†-÷YüÆüBbécaáh kUÕc¹çGúÉyç×1œ_4ÕƱ‰ß™wŽþÄâ…³±PÎO|°u®†Þ5-IýÝ|ª™ªŠNµ AuªîÚFzt^øKùT[ùPñHKñúÅ v½°óÂ{6Ò‹‘gréu;J-µô'þ7ó%ÚyÌ^îv^8ËFº¼fá±UŽýHÓî’úÎ^眵ªö|ªÿ/^ˆtû9º WIÕ¥©.ªuþ´’ NùÎ ÿ?^H#²®èyXx5ò\;RT?”Ui¾ŒÖàÔ ¦þ¼ÐK_7¾Ão”âS,¼Îƒaè•Xø™ªâó…¼PÛÙjUí¼ðâ…H*뀅ˆJ³\äG²…ÍuX¸O^À¤µ­éav^ø?ñ'´ÉU XHUÊ[Ê/ñ#áåÑ×aá>y!Ä ­£GH¿óÂÿJ/€R(ò‚f^)~j#]™OõnyÁ7ÇTÉ˲óÂÿM/œ°`©6Ú¤baº*Æýò©Ix±óÂÿŠz -ÖQà…Ö×'íx¦ šÕWaá^yá©v!.ÍßyáÿåGB^@½«´¬>.²óV]žÔÍ×`á^yÁûñ¥ -Ä°óÂÿK/X_Hœ8“2½Ð„7 º wË Oµ çyç…ÿ/$¥¯3Ÿà^>Kàöf}gc‹’âH ÓÎ {<Ò%6XXóX¸_^xÊÕµU_Ž…;æ…§ZUƒø˜JªœRNÖýúK#éœz·6Wÿ9FÝÎ Ž—W;¿k^xª]˜Œc!SŠ1ëìûcA&évhߪwg23Ò¾ÆBñq%¼îl]ÛÖ.Ïpß¼à›æ¤…ÈÇXÀ_.]v²¹á²Š‘u -2v²âá@5šõ,ʘ´ë’ê¢;ÄGGOQt }¸Ä™vö°óÂßY×vÂss1&Ÿkõ /Ð$™Tè-µsɵ›éDèzDíV³rVNêí2èÅj]HÜúáÖ B’NâÕÄpíÎ Ì„†@ÿX¼°#ùOçÁFÂÌ¢a›ÑéLÐdq4×Bƒ£Yñ:· W/r¤u±bÁ,<`aã-œgòÖ#ÉÎ M/`×Î.ÅÂ]óÃ&>ö#• œÍ6Üw˜9¬éÓHHˆëC'_oERú,²k‚çöi•8Ù¤ßú5U(ìj]ízáïù‘pøM/ÅÂ}ó‚‡óxáI)Å®Â|¤hý×Iʨ³I ˆõV´*E’¥{8™$V,¬çuâèéz«âM¤î•ü¥9ª>™w~Žèèiä‚kt’&›Ö—Ü©œ»Hõ]‡úÂÑ´uýs,l¼P[gÆU«%ešþœéò¾}÷¼€¯?ç…Rڧ߃r ápI«”Ú^‚¢F—QÒc’òµvG]ÁëuR‚¨|ëÅëü‚UV9ì³E~h$í¼pŸ~$ô·TbáÎyÁó´þœ<>2'ãá8Ñã$Å6‹]O ¬y±†'ǺeÙZ6”Êd<^aQˆþœ }‡ôB,Ü;/¬%I~:NUž=Fì¼p¯z¬Ûñ±xaÍ<ÿÓqª=I.ÁÂÎ ÷çGº8Ày¼ÐV'›âÝ(‡6ÿ&^¨G±¯kÛyá -^ðýES çñB~ôÔæm¿‰|vØ×;ï¼p¹éÒ4ÃñÂXTýৢ‹³Š¾Z<£8úgiÔû¡êá@YÜVp&EßÙj†¿—¨¾5/„ZU—òÂÒ·m_M¯zSõÏ-—›`aç…;ô#¡z6aá}^02êmÒ+⎵­IpPÎÊTƒìsÕ”åŒúˆÆ•‹S™xbnÏ ¨.å…b­ôú²ËØ~ìüõ';/Ü­)m¿ /Š±äví5ñjô™äAŒ4p«+{˜zšå¼]Ø:Z•Ð"“ÅÍõÞ¦òR^(œYšÖ§ÚrÈÒàOMWÒj_¬)‹ëÞéõ:fé1‰ñ´4©¸ ;/Ü¥^ðå%e;>â 6&•õ b!2+¸o¥±Æ”µVr -\÷¾jsú z!”$¹˜4Fé…‰³Ögví³Fjw ÌpkhÆ`“Ó:äRùqž¶þŠÉ_–àC^¨/,Ô -”`!ðÂ, Ì{1ÐÅ ™^èÁâ0ííýHá>ñ‹yFÝ‚GœZ×3Øõn[gRTU¦ çcÀÂS/™r†”—baç…ûäP‡Ûð‚êˆ-[ê «áîŽ*)´öWmQ$¢ÕìºÔ:žÊ®Ç¸+³oáÏ/5ìÇ 4_±@^èãÊk\jºÆÝeJƱtÙŠqaÝyá^ýHþ¢ñ‚f„L¾€N¥¾ç^TIÝcßá=ô©‘°>ñ!y5øˆµÕèßUÎ_æ…‹kÎŽÇ Šc<ö ø´a!Za†|³ Î>î¼pÇ~$ŒKÎÎÇÂ~¤ /x9ÒÈ/xq1žÆr,ÂBvÄB¾b!‘²öq¾ÚHò -,ì¼pŸ~$œb¨ÎÇÂû¼@.ì¶ÔÉ7ñÂ>Uó/¨ÛÖofð^µšR*£¶Î²=™»p9ÔÎ ÷¬ÐSr ^H.Í0“}t¡¿Š…ËxahŸŽ“¶›“9^ÓÂÄmâ‹6hªº2mø•¹1!5€OÚª¾ ;/Ü©é’4×Ʃ&y4.Éxq¦Ÿæ…Ÿk;/Ü7/”g¢—¯ýaºZ$¿üBÿ,/ü0v^¸W?ÖAÌÎíÛñB¢Y•8¿°-zÙyaç…»ö#ášßè\,\Ä RQ2+5½h¤Þyaç…_ñ#ùó§.ä…Ì°Ò´‹LZ› {AÆÊv^ø½p~¢¤Kõ‚&Þô‹,­é{k/¹Ð;/ì¼ð~$ ЫÎÄBr ¸1„‘ nÈÎ ;/ü/œ›àb^` µ¬½ÄFÚyaç…ßñ#áÏ)ÎÃÂe¼Àˆ×•Él3¬“Øyaç…_ò#è”9 —ñBYú2ñYí뢨/ºÐ;/ì¼ð;~¤ssüüH;/ì¼ðE, g­Îúù‘v^ØyáK~$”¹ö,,ì¼°ó£ó‚/ÎÉð/$é…¡wå臗ÇÅÎ ;/Ü‹éÌoñBÌ.Ä êþe®{n;/ì¼p'~$ÞüèÁ×5O|¶da "cEŒàøW'Kø&çˆ^â}Z“]‹¶É_•ÔÜyaç…ßó#á+ÎÀÂ?¼k_kc‹Þ0L‚y’ -][0¦Yx|n´éü µ!É ’Žxx›Æ~1šéÔ—tÚyaç…{Ñ Þ[sþáC±Œ ;ûT.²É”ÅÐ ¬ñQ{²t®¨*¯sÅ™I2ÚsUãeŸÄÖVNx§HµóÂÎ ÷âG:+À¼`+Ÿà"~žwLÖ$Š åý³“4Ýð_{ç¢Ø¨ -„aD¼ˆðþoyí¶Ý=»Í¥iš¶ówÓ­1ÆÎïÇŒ1—T¨<ÝEê3>úUÇÞ/¢t’¦á0Øv\@.<ΘÉð/\/4´Š+eù xElÎFºýDÎtÕº4óør—§¹õXÆFðÂê„:î^{äráQêH){væ¤ø_ÛHU,`Í¡´ÈöµÒ`ªždúh›TŽX™å¥ï¥ædãÂê ak­³ÿ·‘ È…O¬#3Ìð_¸0ØÈ}…ìXMiDÊã6ëDºw^¾¯1SŽ¦Q#=µfU¦gÆ¥6’)òÐÂú_îŒ\@.|b)³þ¤þÇ…‚º4išñ%õÃσ½k“šD[¯<¹ÍhfˆyS¦)ÄÁT¦‰ÇÕDT¡¹€\xœ|! ‰*.æBìß »ñí«-%Ž–«"r¹ð8u$8‘Ÿ -½¿]wù[}”owù39i×(óÿ¥ñÈä§ráäØO¹ð3êH§ÇørýTxD/ ¾ŽÛÓã÷â‚P¤|{q­â//4:¨þðh^@.||¢¯~ãcÉQO7ÿÔÛN­3ØŽÌC®ÙžœÙ~O.:ÍÏÙËÇòráñëHpØTÐñ•¾ém¢Ùë~ýÕO U# r!vÕ[b:«î¡V÷U•U°ßäº7Ðvÿ?ßÌ@+\@.\VG:¥áNù´çÎïÏ xÁ½y„¿>2 ÿýÿ´¾ù½“¬2åËS¯¾%šóÞ–säÂÕ‘N×\ïTGzgMõy~g©éÛo {u»)÷ÞÄe†–âó“Æ©î÷¸e1ÓUäyùùå^8Í…•>·ê¦·:‰±¹ðam¤S^¸Óõ…›ÕT³ç×ùõX8ÆÙØiÅËQ7ô÷I‹%q€½bûdn± Ùå^8Í…õ¥ÿ|ÿÖeCÏnÀ…ÁyP&Ü´~þŸèÛç Á…î^}0ŒÓ|¿³2.¹¬ -΂¯Ë`;’ï.¢¡Û2š*ãqÎ¥ÉkðBuÔaoyMy‹zíÇò/œÁ]ÄléYïóØ´l‘Yê¥O³DòŒ0ØowŽNqÁê~ìûYuQg{áûב¾N›ÎÁÑÉ¢môzUtÕiÎs­©é¦íĪ] ñÑ…¢ 6y„°Ÿ²0Dª=¼Dœï…s¸PG­¬ õLi[:J<å¥R¾°ÊºG¢™Õcº{äý\°{ŒñŽ/4MÅ ? Y`irçF§‡‹ŠÆ<°²„üªÑÛ9ÒøÐ7$¨^{!+i˜¢áÜl^ycOßxÀ àgÚ§6RŠëRUFû]éÎE›cþF\ØîÓËòH”×ÃwæÂêHߎ 9Dy£h®)Íál ^Hó™oùÂ>Õ9pa‰SppV*#<ß½°Mþl«Í 2¶gÁy6&]U¥#Ú9§[“Øãljf°Ìën‘/0M=uæ¼`*%Áõ7æ‚F.üà }:<ÊZ)nÀ x¡|ñBL^Áñä….l^ éòÇæq™ÎàB/d»z8Uçyžu峜±¾¯¬» ˜jÛ67>hì!$Œïá‚,Ku¤/Ç… -ÚHñ1½Bš‡;qÁ®"ØW\ ëÞFš;õš u,…h²'/Œ7çáBž»«›_^`Žk½÷7₊‘PÆX?_ÏYÛ¶§I!1_x(.LéøÂQN=D®<¨ >ng~ -*ÕER§à‚äi±ÛÁÒn©Dÿa\t_:?:%K*ŸÛHÞ·LÝ6_8l\SÀåÝÕ\k NMR¨Ë¿EýÓ‚Õ(^-bé³¹`|Êë~Š¾ùy^øW¾à¼c±Ö2uö3tx²¼5m9|ì¨Ãl¼œ x_ÛçÂ//˜á«¸P¤#7Ä5(ðŠƒzÞ G“¼àÀ#uÖT›æ0Þœ U'ïàƒXÊ#äêÊ"pAAÄò*ŽyA¼ÕFÊ©I‡qÈ~¶·#é¢6ÖžRØØ¿½€\ø¾\8<µ‘ÜF‚{l^Ð6ÝÿéÀ °’±ÀÀ3€@‰Öb÷BuÁ^žË¦ŠÂo©9?˜Êv½Îj°Èøtž¼P¤?)ñ&a@v{#Ýÿ=¹€u¤«v}]šƒºU³ -¢.~IGŽPEXŸŠšL)|pªUqΩu/8ºçrJ™H7^Â{wŽÒ1MÜ’Ç‘R;Å,õ§D ù»¹ ôXNzŒ¿{¡«)àÀ¼øv\À:Ò¹¿iâë‹Ï}8¾.9>­àÏßö±¸¾°6>Ý—ÿ\ç4üÜ Êžö:l{nÒ<Äiøx?p¦(òÚ~?.`é*‘púÎßì’ƒ{Ùugé¯,í4š_{Á—„µt¥!Ùo›pÝaë¶(%æ ?• þųÓ}€ê<^è…³û#5cßï7ëH(g¹ðE¹ð1^Àq¶±Ž„\@.` ¹€\À:r¹€ùr¹€u$är¹€\@.` ¹€\À:r¹€u$äróärëHÈär¹€\À:r¹€u$ärëHÈäæ ÈäÖ‘ ŸÄ…õ‚ÐÕíßE. >‚ ³¸¹ÚW\ž°[ÙW^‡F”·ý2XGú¡\Ðᾞ½ÐXúrÏŸ¢m~keþñëH÷‰˜õGqÁTÙ¨0÷úLŇXÙ=z)ػȅŸÄ…¯.¾~€&ñàùBEÕ}D—ÄÔYŽ{°:’á÷¯ù•”!PÊ…; ¹€zØ:Ò×ñr¹ð±u$äráësá§y¹€\@/  o·‘?Ì Èär¹€\xÛ XGB. "Ö‘Í #û -ÝŒ ëWüôÅ÷ä‚®gÔŪoæ…ìøõ>ýqüž\@]©yá«ê;r…^¸§— sºRÇü¦¯ûñ×oÇL‚Q÷­¿ô -…\@¡ (r…B. PÈ -¹€B!P(ä -…\@¡ (r…B. PÈ -¹€B!P(ä -…\@¡Ð 1C/ îì—?¦,zu_9ý˜RÚÿDz‘> -stream -xÚ`Ÿÿxxx«««£££555hhhøøøºººíííñññ´´´ÂÂÂééé&&&õõõ“““üüüÚÚÚƒƒƒ›››‹‹‹ÞÞÞÉÉÉÒÒÒ×××[[[PPPAAAÌÌÌåååÿÿÿÄ=endstream -endobj -5764 0 obj << -/D [5762 0 R /XYZ 85.039 781.388 null] +5913 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [163.355 371.916 218.138 383.606] +/Subtype/Link/A<> >> endobj -5765 0 obj << -/D [5762 0 R /XYZ 85.039 653.905 null] +5916 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [165.032 124.057 229.961 135.747] +/Subtype/Link/A<> >> endobj -5766 0 obj << -/D [5762 0 R /XYZ 85.039 653.905 null] +5917 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [107.442 110.508 229.112 122.197] +/Subtype/Link/A<> >> endobj -5767 0 obj << -/D [5762 0 R /XYZ 270.549 176.64 null] +5908 0 obj << +/D [5906 0 R /XYZ 85.039 781.388 null] >> endobj -5761 0 obj << -/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> -/XObject << /Im18 5331 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +1714 0 obj << +/D [5906 0 R /XYZ 85.039 553.968 null] >> endobj -5771 0 obj << -/Length 496 -/Filter /FlateDecode ->> -stream -xÚ¥“MSÛ0†ïþ{´Þhµúì-|„†™¦!˜pHJ;Ó Êð÷»Šlsb<£ñjwõ>’^(ù‚EÅ| ä`³ËÜKæ,£¦¢lJʃš£*›ÌœRU„êg·ŽEcªíu~üuº¬NWEÉÌ9E,JïC~|µ,(¿¬g—«ù¢š/ÎRdd’ò«eJ_óª.š/ºôôÛÑ´ŽUq[g§UKÚ2UL˜Ùõ­‚­lé¢n¨ç£oô¸§Ç=%ë4Ii-çN^þ’ž·ª’uÀh÷Ðð€ª ½àÆèõ~F$;mÒ“ùÎÁɃ€ÁÅÐÚ+ †Zx "å\ºã<:² GÖqo€eÕZê_Tb šœœÜØ®Fw'eײ'°îÀ‚ïWM³ß÷/Owâ—°7 ™2™ f×åêhE%5|F'÷¨GP;´¦¤ÏöN¥·NÒÚ¼ü}^o·bê碤|Wèÿ¨£È>¤ø5 ›Bûü—Ô­ŸþõùŒ¢øœ,%^žfi‘hl'âA-֤Ͻœäd*ŽkPjýäëliXnüƒ#·Z£¦¬°ñ£ö¦~–Z1M]tüŠÇ -¿endstream -endobj -5770 0 obj << -/Type /Page -/Contents 5771 0 R -/Resources 5769 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5751 0 R +5910 0 obj << +/D [5906 0 R /XYZ 85.039 521.75 null] >> endobj -5772 0 obj << -/D [5770 0 R /XYZ 85.039 781.388 null] +1718 0 obj << +/D [5906 0 R /XYZ 85.039 344.098 null] >> endobj -5773 0 obj << -/D [5770 0 R /XYZ 85.039 599.799 null] +5914 0 obj << +/D [5906 0 R /XYZ 85.039 309.954 null] >> endobj -5774 0 obj << -/D [5770 0 R /XYZ 85.039 599.799 null] +1722 0 obj << +/D [5906 0 R /XYZ 85.039 186.296 null] >> endobj -5775 0 obj << -/D [5770 0 R /XYZ 296.792 230.14 null] +5915 0 obj << +/D [5906 0 R /XYZ 85.039 152.152 null] >> endobj -5769 0 obj << -/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> -/XObject << /Im6 5155 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +5905 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +/XObject << /Im1 4096 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5778 0 obj << -/Length 495 +5920 0 obj << +/Length 4197 /Filter /FlateDecode >> stream -xÚ¥”MoÛ0 †ïþ:Ú3¢(ZÒni×t)°ÔMS×ðfA€¥Cƒ­ýû£lÇNmc—€!ñC|H¿2*-*Ï )(çÈ{õãhµÏu‚mDÞ†äg1U2[V¡† ƒª~öç0X&U==¤—_æeuµÎr"J1@–;çÓËM™azßXËõrU-W×qgň馌îÛuæ)­š åªwÏ¿^̛Ϋ›äªêH;¡ -ó%yxÔêIZºI4PðêMÖP܇D8-µû_É}r×Õø¬j²¦¦rŠÈg̸œ ®-Gƒr4*§UŽÂLS•Œ‘±£“õ™s„sŠÊ-Cà"F«ÕWÐ ¢sA*9ÓØ‘¬ì8œü³åƒúü[ØÔÝHäO+¡(¢lá @–Á`ìk |Ó¬¿Ë ‡ŸÊ E -‰¶Lvª·qmÒYN!ÍöB9ûÝßãV„ãk%"GžÙBpûăl]'|{é”ý$pØ ßÕTß•Myº¢òãþ93>ý#Ëýó®±ß¾FÓöøºß¾ á¬Pþï4;H2Ø*g@œjCÄhD£ø±¤•¥‘PM–À˜ùÁKÚý™,§0=n6Œhš´|ÞzÖÆñp€L^fBmÐð?u - 0endstream +xÚ¥ÙrÜ6ò]_¡š—P["Cðfò°åĉíćb+•T%y †Ô לá˜äDVöç·/à¡Wí¦V  Ñw7`uéÂê2 ×O/ãD9~’\®wîåF^\(°Ä6`¾»½øúÇ0ºT®“ºéåíý°Nè¡y›ÿa}ÿòÙÍíï¯lß÷-•:Wv'Ö÷¿Þ\)ë÷Þ¼õööÕÛø@§²~½Ááwï¯ߺe Wo‡ágo¾{Æ_¾ã^ýuûÓÅ·=¦=€UŠh~ºøã/÷2‡#ýtá:~š\>@Ûu ï.O' |ù®.>\üÒ/ÅcÁ%ÏZ¢Jè'N˜øs²¨p,¡ë„n@dɳ’Ýeí•­¬N{ÖÝ•í%V±Æ®lG¾Õm¯À·ÖuÓ·vu€±Uï‹ýÌìx™úž»šÖËq£+{„ÆW-Ïÿñ* ,ç•Ÿr-«cO]AOU`sÝ•õ~²8 ÊüJÖÌöЗó0œ/^‡‘²^ÉÌn[ ¯€p¶Bº¦Dˆm1þ%,°Ó¦—ÿn‘LÈï]pãš—ó8ž³=ÿþþzÍSšâÐ0•ÕÒ_Ø+µºLÎàt&ß 5L#ªáž/å0:£* É„çÎe"J'L‘À0°/ˆÒ.HM¾‹dÆ¿;Àxý #-¢~”Õ5L½MÁ}oQl–1ŽRÏ â“ OÊp¹N0ˆïê·-2â¤ÀO{âykÝ¡½ß£(³öß«kè q¥çȬ Ž(ßúm BMC(øÛYUéÝDö>ògý§«|Y6kê£H"µ‡Åj¿áOÏu]üwÔ†ÇPKü¸ÏnT¡Ö.¯¨ß[|!P ©UÓxž1!À˜]#+ƒ^SˆˆR·ÑVmWìxOèL¬#3h's^ß<‡®k}'xO烡Z° IgElhÎ/<‡0ƒ¾t5%+ÒÝ÷Ð4#9Òˆ·D®–>¨¨Üœ%pßÜ ýÜk{àïM±/´.ø±ÊQ!ËA‹}¾üé†î†i§MX¿*žÏܨH™ïM!ð¨Ã%JF¿‹Ö²•ÒDJ  ?®0ûŠŠ¬Ð( +Sëv[h»Mû €å¸÷WÝuڣЯnpWØ|—iÝÀ¯¼ø»\Óæv{0\¢À¢H6À¯F\ÑhµèDÁ"ôNÉÉš¿Úm‰Ð²ZÎÂ%h•]Ë%þaÏw0ãXVhÙmÚ_ú‘p¬ž]Aºô; ´ŸóÓ"Òè9r‚5EŽ®mW7Èvƒ ˆ\bPÏ›rdÖqò»A÷ø¡õ%±f4Úu?éÐ!_ØlÄ`1ß¡®ó m‘°]ƒ÷\@=sÖDÅûIØ¿”=b‚ÉíUUxzñU_Àh_K,€B¤”æ4LB'—æ­¯BÛƒ1ÉíÚðƒ$,A©iêȇEJ¦‚EäLM¦“B_} +ƒß¬#üÝl„éÉö(ÃCæå?ýÁ½Á§c›ÌcQUv^ “÷&<ÏZÝ€…!@‘[ŽÚQÊV@¨XÅL°PD%toÈ ´Ý‡uC"+ÿ†¶G¼ÿsÖ: Ùûïñ~¢§AX7HÅc{ÍÓGAgoëñ#ç…Ëy&3°¸Óö×)XJ\üQº>wž-ïz,-^ì¸<âq_4†ô€ŸD¥íR–ójؽÍÐÎ1i þnË–G$*°‘Êññ‹ÉD$šÊK½Ø‚öˆAÄ3:î';Üõk¹—ľn>ÊWIû£˜á'ÙBÅAŠ2íá(Þ@ÉÒ_½à˜_&=Xåz€ª’X/­W¢õàÄjV¨ÕG6¸…("Ó——o²J´²$:ˆu`÷æCùwÃÙ«ožˆˆÌÙTz2$6`(&”a‰•«œÀõû…ÄýÅÓý”9 ˜ÿSj˜ÙŽ#Û¯”ƒÞhGM¼]oFäôäpd}lfÁ¤K½¥£½;6ÃtS°ØÓÖväàÉ‚êõ™EU}ØIN*ÜÉXÂÈÊÀiCé‹—¯e#$ÿö)®ÿóÆ•Då–g¡ †ýŽz DýÎx%ò,©õK|¯xnN¼Ãέë½Dt›c£c +ëᚧŽ¤u!)Å5ua ±Ý°| ¶ÚÞôŽ¿ÈDvéC?S'æÒÛûÛ³(³ž* ù‰¿ÞIù2`ž, ùa éÀ´~Hýh}<´\8¿aÎå¤ü™„<åšÆ"«’Až#yÙ뎺H&ž8P:¡Ú›0OV˜|X¨¸Â$"§s©úqŒx~ŸÕ`JƒßþÖ§#4aÞG2ö6“/ɉøxàß¹SÓÉ‘‘—ÀªF+Ÿ‡¤AÒŸ€(ÍF Þ4Ñж>'ÊtMJ¦N0üÔñoŒÁ„æô¾Ó•p_ +Ö”¹=‘¤¡ª«ç÷nØ8  fÜgæFºæ{˜¦ã˜æ_ðt¢/" , ÑvÍQ[¨Nøp¹ŒFë…¾';ƒAÙÑ>¹QsºA¸ú±]*Áœš/¹¼}QäEîpÙä춗„Öz+BÑ°}¢¢KcäÏåÍhÈ;½O}('pBÑZfm ž&5<èâzb¿9–@¯?¤¸AyÕãgè›çë—2mÅHdæO×+Y{1`kÌ׶—’i´´4y):ÉDÕrg_[†öRô€ë5Å~\N⊨bÑã:"WÙZÚ”ª§R\(`ÓUª®e¼0`„¤6]K=wxà¶/ÊÎy°\òHTäË‹].6\ï머 ÷”hzñzñ@™!®FÊÞ'£*'Yž¾òi\$$–œ,=1¢ÓwK‚ZŸ‰#À8ÙÿZë3F›óC£Á:wºœ(—ƒ ]’ƒ€à†ÝÅ_³‹]ûl×—šàs%¥ûýEgÅÝy)ã}åöÒ\ÁþÅlB,ÝžÝê–¸tl3AB‡›ËI-äÀB J8Èi²á^Ôkw¨Š‘…‘‚Ì\¹ÜEŸèÀâdTCÇo¹Çƒè¸åkË]I—8Wòù Ý׺ç±Ns‡›³õ…T@Är¡ôÄíyÓÁXc6àGjÈç¢A*±=±ö"3ôÄ‘‚·Ü7„˜Íì’ËKcGÅá¥ç%°òŒïÕж>÷Ó5ñÌ|‰BåñwºNþFb¨Y<Nª1No¬aNcâG0˜Ä#L0Œ5I͘IüQ™h¾“Dê ‰¤¡O£6]Qãë)&*(bdB7uâø$qä4!Ö•ÝÓ´±9. $JFB<\B‚3Ø‹Ö¸hÓÞ!ų`y &· ßJ!¬ÏÜå´…§ƒ® %ÄúªˆÆ¤†Šœ‹Ôéîté DW±¹¨«öÌ\7G})°¯/•¦É7×ñÝĪÈGa«=î8Ø¥Ô,æŒÜ¥;ÎŽ[½RfÍõL+ýØñCïR%‰ãzá9­hÛ_ÐÊÉšˆþmÉÉllýœíÌËJqI#­T +"Û`ŒÓT+æ4&¾ÝáÑvYÃVÝM†"ib„›Ø6 ¦±À1Y…î Ü9â@¹âÓ&d|3¾%Ié^ÈðKFá†J5 +iñP=r“«ÎõÖ\t1¯ßàoEg<¥„ó«8p‚ø,KØ6 8:^1Ãñ6ù„!áÃât}ßÍ0ŠC'ë8BiÂQ s“Äuüh„ _¤½÷’Œ‹ÜtÓÇ%ñm¡Ôð$3PÒ%ì7oùqò¤Ê.³E€@âkÈ¾\®¥¡ã{jdÙ&7$!_+a£-Äõr÷•WGe) ˜rAM" Ž᳆¶ ð…ÕdM²<¯Ñôdÿ<5àX¨SÆ +Ìé§+áζ֮|n¶ ùMý/<»†>ƒÁdMÄàw0ùÓ­#Ï`ýô‘æ̆Qä¤áxCô‹sýà°ɆñüA_÷*)«¨—llK©XVu°Y%v;¾O×Ï# ùy)hYžbT¢œTã AŒ?]y¹ÊAoÛ°¾‚xtÜì²Ó‰Èv1ÅÊ÷”o×ø…šk-\ Ì™=Á.¤¨Æž(ªÓs $CDÕÎä…奮þ àÍ#b÷$úBÒhèÓhNפ;ý·¿Vt=1OHBð!ÁIêh˜3Û¦ ¨Î˜# Á=È +éù—XCŸÞzº&÷ïÙ“M÷ñ}‡òÀæÌ®HçPÍÄAJtË ÖÅ”*A‚U"ÕùÜgñd Ha¾â¸PjÛ’(¡•Úë +„U)o|‰õ”zñ´~•@7U¦Ã×EIŸoHfúÜOzÏu¼8=§½mà š4Y“ž›%¦åº±†ts4Be*¬séJÂ;åངãˆ3ˆqЗ „>Ô×\ΠX¬}¶oùÁQÃß’¨É•M¹N%wQß೩ÈZýØ×)¥®¸b,OA|]éÂU¤!/ +¢Ñ3U±à}™ÊY”ók¾TäâUF&ªçz¤cÆþv¡ýÓÒJyŽâ’˜;×sè’>6('Öê_ºl*Ò÷…3º•jøøá0²þË3Fo¾¥~ÝtâÇráÕŸ§Õ±,=C@Ïq‘‹Ÿùk¨`ÓEKSŽ(êÇ ½Ò—i øÒ!d®¸S’œ%ŸØ5ÇuÿA^<ûÜáä=´ôèØÛ¯Yï›ÏóÀÛ©âŠgäÙ0‰=4ôe^‡{èê4ò9lÆŽŒ¿Ï¼*EHäÍèQ=³FƵÍùÉïõÍd1}J3<ƒ™æÿ×ríßÁ Ol4­‡Áœ1o†0 _>NÁÒ»³¢¡k¥ãÛN))> endobj -5714 0 obj << -/Type /XObject -/Subtype /Image -/Width 780 -/Height 1135 -/BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5783 0 R] -/Length 95337 +5924 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [384.951 320.399 440.338 332.089] +/Subtype/Link/A<> +>> endobj +5925 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [296.178 224.949 365.747 237.85] +/Subtype/Link/A<> +>> endobj +5926 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [442.864 224.949 510.766 237.85] +/Subtype/Link/A<> +>> endobj +5927 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [236.356 184.907 312.341 196.597] +/Subtype/Link/A<> +>> endobj +5928 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [208.094 171.358 276.783 183.047] +/Subtype/Link/A<> +>> endobj +5929 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [174.108 157.203 205.494 170.104] +/Subtype/Link/A<> +>> endobj +5930 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [238.397 157.203 263.419 170.104] +/Subtype/Link/A<> +>> endobj +5931 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [148.686 130.104 173.557 143.006] +/Subtype/Link/A<> +>> endobj +5932 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [256.19 130.104 296.471 143.006] +/Subtype/Link/A<> +>> endobj +5933 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [318.929 130.104 354.71 143.006] +/Subtype/Link/A<> +>> endobj +5934 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [194.892 116.555 256.309 129.457] +/Subtype/Link/A<> +>> endobj +5921 0 obj << +/D [5919 0 R /XYZ 85.039 781.388 null] +>> endobj +1726 0 obj << +/D [5919 0 R /XYZ 85.039 719.568 null] +>> endobj +5922 0 obj << +/D [5919 0 R /XYZ 85.039 685.425 null] +>> endobj +1730 0 obj << +/D [5919 0 R /XYZ 85.039 382.032 null] +>> endobj +5923 0 obj << +/D [5919 0 R /XYZ 85.039 348.494 null] +>> endobj +5918 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5937 0 obj << +/Length 3864 /Filter /FlateDecode >> stream -xÚì]‡bë* Å6¼·ñÀðÿù$°3šÑ$¯í5w4õÖáHBÆ<Ý|¶·µÊìí´A Áö¿¯þzÜe说N§†|ÿûÒ_CEý›Þv1£…¯a!ß„×ÿeX`Bý PÙ÷a¡ Ü‰}ÿPºƒáØâðÉÀ§Èž\Düž¬Ñë÷xàÆ;®<îkæ¯kuõ}X ÂÝÌ'ü½Cs6?´ŒSÑá§~„—â›AÌx 1Ý9»ïÍ Þn B“0¾cá…Çe;> ‘ìÏ°-Þ;4QÜùZ:ɹÔ>)ÊÌ"©î~©Ú$o¿W!Zã ;>›øÊÐôç¦Áä^w1y›Ô¬G_ÊÓ-Øô¿a¡=íDx¬â(›EqüFöÖˆ Thäke±`2@Æ(¢ƒÚ³vôz%ÎÖ¯~T6R:ôGÁýÂùñ¶Ïüø\‡.ÄSÜiœÿîñ ­–½rµCÒZjMø41­eïJ$Žnð¾ò±'ѼÝ4ËããôÕ‘V,ÄPC&XáCoÁ#Šg*2 YŸ•ÄæÀ ‘èehy¡@,L2^/Y ¸ŒáOÄH×ù‚• >Ü*›oBÀe-}¯çp Áàìªês7 †LXù#ô^/Òœ; ±i}Fh@„ -S• ieOƒ3êyçµ´U<3Í®aèõDˆ."â Z%€ -‚½ ¾ô±'yµ¼ŸŽ{—ÿ•¤ë‰Œ™D³’H–Õ2Zd`L©y£KCVK‚²é”bÅèL(åæžÏt•0L±M¨E2è±ÐãÉ1aÄT2K3±$M"@»bq TëºîõÅpV¦cÓK¦šQúŒtž«}C4'¡àª±õè ¡|¸X(«äoò/ñÂ(ìè>Z,lÞ‘bS~J«ÞÎðÂx/À"Â!&ԉɎҸ’ì)/s~¢>œRùÆËoõÎÏ8žŸ`á”ö7Ê÷äÿÊ ›Žd±Ð@”ð¼Aj± #Ó _¯Oâh/P4Ðu/il‡™qp¼‡ÃL,i‡!f Êô ú\¤ -BPØ,džœÀ!ðRb9,À«Œp3<r†¤= v`óÃ5Œa­©ñá¹M;¼tËw^€Ž#̇WK`8WtŽT•cM¦Vú.äv3%k§Õ¬Ù\˜ñ0 ¹ÓF™4W–ÙÏDÖy¦Ë «†úƒ’ZŒpódŠAˆÞ©É±'àà󦃃і„npXhº’¡Ü”ƒbÁ8E}È@‡ˆˆ¾@øÿ„…RPÀ¸ËØaAG&g¸™¦Ù áG^€^¬7^X„Þº0Ôëxì,ÃÍŸ­XÀ>áiQQ ¤ÅBĘ́Ü(…Cƒý‰€÷ŽØñq´¦"-*cBnÂç ( Oi%Å%Ö$þ€þ—x¡V#|™˜ôÂä‚$-êJÈh-¬o*Ô“ar8Ñ*y00|ÊZä\H¥"’88Ô])`Œ’Tžì“^2Ñ}%EíËF+ß_• Bb”€Af¾¬@¦B0†…ºõ¥¶öB EYÁ%[ÍÆ@z‘m¥;ЙÛéØ ˆwQsí° XŽ@£œh-xíƒ$Ú'ëE:Œ×~¿ñBÍz¹ZE3‘’üqdˆt€*03#b¯ãNä‚RË ­ô›z<Фõ´0áVÖM$b‚7'™3Z!ô³êa¿Àçžß¡‡w{yA…ðîƪ&`ПªÞm$j| Ö3ØÎ,;±¹7›/“À¨µäŽú¼`¼ -È3`ú¼Ðpèm„—‚W6û*Jës‡wexÕp™à@–{€Cj;n%N}°›àݶð˜ CDÎ^oþgIž`Z,¤2Α<3àï±Ê2¦hž²Îq)œ½Ö ¶ò¨4«‹°xF,!/,2€mŒ¿bÁHä…&,ÌC­¼P+KÀFbZ0"2T›"à…aå… Ç­Ê£¤;Á (iLô´óò!¡µø\ÂW[ Ùb >`Áð ºÛdb²*¤è|œFBîÚ Þ…c 8@þS+KËѵ}G¦Òu°jL¶3Ú~&:i`œ²ã`…Ôc± V ä@¬>ƒfŽèý϶ó‘ü• ®,ÔÄ[ýC3‹Œó›RèW„>ؼäŽ*h©íÛ¡ÐC€ ÀˆÝ"ïÙ^u¶3Š}#K¤_/´Î^à¶GO±€² /±àÙ£eÚƒö;K°¡{qÏqÄÂÒ¢2'Ãl_’*´,´@ ¢¶‚¸zT7 ºÍi>ÈUOjE¦Ã, Ä:½íPÕÈ@$è@,àψ±P9oy&y1€öàÐЀ"¡x©%4í7¨_t*EšH7,P4-ÀœvC/òÂÿìGb]×w©ïx!°XH cž/Àð ÔÂ: ªÑró3¥pÚ`ÝR£ŽfÝf/˜u:ŽF^€ã{«à¥RœÇS£/2­¼€&\µàÆÛx!=ðÂüb¡ˆlã<²SÁET¸»ÜËMÄsH"ë(›œ»,j }ç´¦66çn0Y§ïS/……¨hÃÑ`˧ÙjgùgÏ\¼/–ÜN@çÞ²^ ÀZÒQ3[`o°‹ƒ”U{k -›à¾öèxŒ'Øy¡@ö,ø2Ì{­VBvïiÔC\I0ª)Ñ?Hgè%£š}]/œ1H'áæÒúúL¬XPbšˆv~ Ë ¨"†;pÛ•dapSÒó]^è ( -Ìù‘<K:/ÑÊ ³›ÿ _÷²Ä:¡}Íx¦%â2,¦‡+•ºù²çýCóÎ -'g8Ž¼TiÙW„¯„ì|‡-hvŠ~©ñSêûý'i-éLÀy!Ài¢ÀÑèã2}C&!e¥:ËÑÀøÆï´Þtd=R“*­É œ:’‡–£Xu$°7@>Z…—ò"äŸ JÛ¿Œ…ðÓ°0 Étev,¼Ë [â?àÔÂ’íì»4õVe¤˜·Oâ€Ñ -FwÚ_†Ÿˆ…³CŒÖÒ7”´Ì>u"5¶«2ÜO¬Ž”Ã×e)ÔõÐH-¦®°¦hV„HŒyˆ”XfÖâ©ÐÒFÓf;+Z(åΰ‹Pƒ¡¨!+YK]s )–b²ñ³˜èìÚTZ+{¸¢¦áA’þýÝya;-9laŠ™'x×±ðÆïÉ™íå‚]Ç KÊCœÂ®tÀ£vMí²ÁÙåÎß³4]&%(º©"Ý-M3èàb!YUÄIJŒ2ÙBû‹’”Š.ò1ºÇéE"Á¼„Z43apŠ—+7¯ßÊÀm]ùtG™Á3U¡'ç0âÉÑ`|*Ø ƒöÓ¯­ÒD»ì¢"OV6‚,…§ÙÈÎŒ`ÔÛà—JP6D¡Œ9«ÓBŒi *¼ü¬t?·zÞyᶳ‚bÊ‘¬ü¿.aîÂc¹`÷cP¤™ÇOኖPb­ŒiKǧ̎ñ³ÀÈ1PìQ4X)9uq°ŸlEÅjÕõ²Iå:Tõ–0$ yÁRG*»ˆ…–Á8¸ DÖisÌæ?Ù¸¢…rÀ#R&9 þÏ!wö¥Òn f{ÕÁE9Ï8–´ÄÚ ˜Ç`ƒÃ—u®~`Á°¼ÆæGÄ‚{8ªT2²e D%­Áx€`F{!Fs¼¦ƒ+`ön*½n¶†õ ½P“¡cr6«0ÚÉc"ûÅ—Žã1Àq-¢Aõö+Ü°Åø‰V‘ʤ ”GìZÙÁÏw‰#l0 -„ÉœoJ™ê=ÅB¨Ç (åTö? tMßXÔj”ÊFPÌ î˜ ²Ú £Ž¼ÌšÔµÒá"e½¾_ò™ãx-°ŒÍÕèmtä© °@ÚC¿3µ*½t^p¢à}Ë:9ú>|½åDÀ¸EQÀàµx!ÔåO´½QëŽ 1ŽuŸØdLÀ‚ÍiW,ny!n´ÇL¯N© ×q<ÀÁºpƒ-Y± V,x6$ÃÖ ê «—4ÿrã—ê~ Ð°(˜Ù´ó!@^è4<ä8˜îÛ íîa!±™…‡ ¶syl -†; 0Ÿq‚œMRg/D…­Žè’¹Hà½Qæ±Ê”¾ÀÆÃn÷­E]¯óÔøÓƒ—&ý£µ~-Ш¶&%ò‚ìFVü@,ä©É™2ë¥á*ôny[^°ÙÐETD¹É3g$ŽdžºÙL5Ãþ>Ãs:’²[ 6þ®²Q¤¼˜áØí%èH8¿Pê‰F&íõ'Ô½)fÎ0ã 6v"’Þä0q&”6®"ƒ _m)¬íŒl±@5Cª@s"åf;Ã+EA·j³)D ¯%d¶Ê’-ÏÙqh\ëÊ({윰Cæ4èg›g£q¬ì°ey° ª÷r¯þ, :Ä<ÚµŠÅÔØÀÝñŒ›<›È EqqbXJ0h³ÅTWÀ««ßbó–:R3kßäÂ(¾ŸÊUÂèeá²ÅŽWpŸ΃›æ˜C¤j$ôßÑ(,bî¼ðˆú ÌÍ*™ÃH3t²êSI€êûؤƒµ-6,fÍw¶™þ"èLYð¥Ví:P®Öæ*|0˜%³u7­½èªÚ&[QÄ"¬Sãì…‡*hÿ/X5éÙf‹ÍE®eOœ K!/@ŸøZõz„Þ‚Sœa„žŸT§Õ-êO  Þ`aÖÂ뎄9V•&L:?ÒZhC¾®•DÛYŒDbú›ê±g@Fɾ†á¦µ¬–c šf¿óÂ#XÀ¹ŸDXÅuA^(/yãèSä] M´¿êH‘ýä¦Z áÕªÓ:E‡.‘)Æ·’dÎA›8u,6΃äÈÄ`¡ŒhMr¶slý(›½ð3±`bº¾U/úÆð -¤7ªRC[Ö–Žï¼ª(üÆ`|[áÜa½#¹"«'Ü껑¢>Sp…Ó½«(B* ð¨ LLŸrØTÄ]Òº>£Ã9<^±Þó‹Ù‰­\™k.[¾Ž¸ÞÒ÷ŽÃ1œ2µΞw^¸c/¸boxaÊßxa´Ê Î €#rþQ„nÍ]18ä… - OPð;íÙt´un¢FÏIŽnWeK’¬Ù+V…NV…Éù‘Ü¢úáX°‘sŸÔ¬½ðîx£ËCáIh<òþ[~$ ,XçÞ‚¶3N‰"’2Aà y8ÔɬZÀ\Ê9xh™ßýÊa¼Ÿ±î èHL Š”zPVõ4eZ)‰€hÀä Ò:VmR5>«ËçrÊV¶{ûã±`> T.Ÿt7eÄÇãçdü³öB¢9HÌ´ - (ò5¡JÒŒ`}$þ fÈoS‹q5¾Ä¡X?¯ÌïžèfY7ûø;S›všgÀáöÐi`ë'.†i°C\º e&ðáI‚ ÕC ŒÄnÆæýþоٱð1{᷶߅žJ›‡Êås±cá¼°cao;/8{A,ÿ¢]¢w^¸ây Å¿‡…‘ ûŸÿü®µÎ÷¼¶{-{ûPkÿ(/üƒX(8çôÓ4¥/]"‡/6Fi=z‰ÜÞùÞ_x¶}¹Gþ¿‹öµÎ¿¬EB¾É€'^–Ƶ~­'aW[ ¥Ø¡ó‘¯#ÿFû?è/—Ç@ó§O¼LáVZ?j‹r¦ß‰Ó -µ–;öö}¼ _«ØŽ'^ãý/è÷xA‹Ýa¼·okiß¼¦1ÏêZõ°ñq· oß)“ZxÝ…Ÿ7zNÓòW¿Ûðâ7£ã5ý¥ï¿Bõ^™œeØEïǵLkRìXxƒ…|ÇÂ?Ø*ýn†æŽ… ÿDó±RÕŽ… {3&¨ÌŽ… {ƒæe;v,ìÍbaç… {ÛyaÇÂÞv^ر°·v,ìmç… {ÛyaÇÂÞv^ر°·Œiÿ?,Lïa¡Ý%oç…okyÇê—ªUϽèç`¶DÅwÀšn{ÐöÎ ßÖjýZÊ4£â…NËûJÒ,t½‹ÞÎ ß÷Í^] ³¼Zõ ,Lï¦ÀuÚÛEoç…ïk¯n§ÃGí…ì=IŸ«]òv^øÆöjQ”âjág°P¼v‹½í¼ð+Ú3XØÛÎ ßÛŠèñv1RÓÇÏåXÈÃ8ü7/ÞöëÚNJŽ"KŠ>ÔÄ…éP?zêVYæ ~¢uçFóhl[ …—“ ²,óqw/ÃVÙoôce p;I”…IaÅÞ>“ÅÂìVú}ƒ…‡ßæ^ð柂Ë v…ûVó‡tî/¦ ñ/dX°5kS]Q9`Aeà…fAy/¶ÅåÃpÅÂhÜyá%,|„ØðS°päË+6žçåÀí&bÓ/ sÓL…éX-:ðB¬ƒ\ÆÀ ‰|;UyBÎ^(§Æûk®í¼ð’Žô^xØTù&{¡m[Òš9“615V ÀðÇÕÞ óÖv†oЭG¢˜×UÛkÝÎr@^(Jœ~è#»kIÊrã…ÍFßyaç\ëØΊm&;§ §hMÌ ÿ&, /tZÁ2,¡X&Ðf3¢ÖTk Qï(ìÀ uéû `AøÐf‹ §‹í¦VÒvÅ‚§«3,„€¸°å…Á÷³¸ ÏÎ ÿ/ø -†Ö¸”>è1­È•/u­JSôR“ô»°€öBÄíb€Õf/ :ÅIÁ”UžJV^X®Ø 26öìº)•]Å@è06òb<4kpyTdøåw{aç…3^ð5 ”dñ ÃHÊÏv"Ú7ƒL<¦¾ tô,F±n>`Ásè/ ¬1Y Xü–i[ïÅv“/Ĭdr8È÷Ñ_ya÷#í¼p €¹Hļ†a´g¦yI¥o@mùâ‘sÅÜ-_çG:Å‚!d¶0 -œ@ Hø5?Mï€즈áŒÛ`íéY(S¬±/‰=1ªw^°Ó÷™ò¯ÂÂOã…Læpa˜áâsœ f¾æSÙûY&“¯×‘”¬„Huఠƺ®Gp¡ûJi¶´ð재;äƒ+X¨É^€AöD êcWb¹*{&U‡ˆó#ýã¼P±›aãÜkÅû+sÿ ^È`°@¯¦"”DÍWCüY -ÆØ—®p·ba&’Á×Èú aØH„K ÉZàô…fBö0Á甬©«™ëø"µŽ -©Â.á#êGt`Rô)šBÛär [ðТOàœæ‡bá›x¡“·ˆ -÷âCݽ×GñYòå¯æ…qtòÀi8Ë"P¦ žÒ¯Ç‚)hq‡Æq·C¿5Š…7ûp]P·èÿùѱßÅ ·±­Xð廈«¼mUµmu~~‘?×^°X@)ôÑkC„Á™*”\¢ÜûRë2ÓÓ']è=MÎëÌojßÇ œûÞH|nâ°dÝl¸ß 9è©8ÊLv5I -Ó”%ñb¯b/‰%Ûž)$W9ðt°õ-Bÿˆ…A -‰^òóeÖÊñ^(ÊPT© ~ˆOø©mýâ./Ðmhå”Ò5….M­Ù3óã¨û/ á(Í«`¡Òm"ý Xx÷!ùïÊ”ø>^਌D'ð‘u𶠴+ ÕV ­¦L×5XX‰"©%QR1Â4 Ö/LÖT‰ŽÉ†Ñ# Ë+½íøN=b/p†(Ò„¤®áã'!¿Ã ^LPRø¥” ãÛ(›"Z#Ó-Žî®ðBç›n“ª ôëôqÑj1“b%#,Zõ¥ -Ÿ†…?ÖŠ 2Å÷`¡ 8åBF["¥qX(6{!”ŠÊÂ#Æ"¨QðÚ‰»@zGБŠE†&Ó2ÊÏì… ½!EÅÜä1(©Sæ=À nIM7Äé`^â3Â'ꦀoòB“ØäΫd=Ž ],30S¦I–С&‡¡ ^ 7FÏØ3έ´êê;¾»•BŽü{°¼B?*t¦ƒ¤w ‚oöB&‹e¬ÇßaF†vDTEê±í…H°0º´qJÓ´ˆìÚäbˆ¥‹÷y¡–Aü]ÈÜÚ kßµšÒ -u -JMkÄ žì3œrJnðÂõ6H/äwD¬íX¸ÞRqfþżáËHLŠ¼ªW^àG^0%N÷€¢_š öhÐA"„¬Ð–0®EVü Hh V§VS‰üdrô./X¿~ö¬ÃšgXxŸ¬·­ájlÛq?ÝäÓC¼°"›hù¥Ó -—X³Ì[¢Ä·#Ì8¨æAÁ\l‡ÙÍMmJÛÂ…Ñö ¥nÛÖ×x¼‡WB;Í@ƒÆnL&A¿ ü€TäÕh±ÐÊ^)N­5Æ°_ÒnXà`F$´®M‰6%Oˆn¯ñæ‘Ø™%0”þA{t$NÄ"FJ?óówxaÎÓ¨9ðB 0f†n:?É &á÷Ô•Ü°àc&çPØORÚ˜¨L;1 5nqÝ<àG•›‚œd—kê´?Ãß}ž&yšàÍíñÞyï¢2B­ {לÐI ß4x ¨Õ6ØÅG•¤Àù¦Uœ±cahoì|å ”ô(´µµ†ÈNx^á…QF0»Ê³¹·Ýƒ¼ ±„Xƒ#´ÜN¹Å «0/B3ùˆÍ²@1C3“;ïa^ø¾¶ba’]D+Dl©GßÑYé|<ÂyòFœTnõóD—³Ú c"ìKd² Â'‘3Ù¡AÑ`§ÍµØf$JÆì‹Á ­ÅB “ÿ´–¼@ÑkŽXЭdJõ -:’«³‹~FFæ™10eÏx*–F•®A¦Cxƒy#:f¼P‹®ï»•%äGýHl{Ÿš )Àmgº°7x!‘´þ÷§Çà+v˜! #ßô¬½ðíXpñGÐÜ¥adõ‘&Ë™-|™ÊñÀìTÇFocz` iÊÖ/u>-RØTQÖF‰âD B Ãä_Æ€f/òe ¼À4*1 ù‹”íÚ…¹ø0dN¿Ü@¢g^ªS`00L+çg¡§Dg>Õ•,L ˆ·°<Ê b›`qXH´Ê£½öU­}xXŒ0¥m;Êf¹m/ð˜Ïáìô"PؽôófU±©SËWÅܪרaßö,=˜ 7ð<ûcÂoËaxKlv9b=[in1öúÔV,äÝ::Œã…Õ°8›‚,B,u·&ŒR€YõˆJÿ_Æ\Ô"¥`ÔR' i<Œ˜à™ê'ãµ@$^ËAUáÌ/lXp¯º/à%¯ðBc':=A+E4ë.IÊ8¿ä…˜a–¤õžaðb!Ö˜¶TòÅÞDÅà›§È™EÄ)+F´Á¨·5?€rÚD@¯VŽSö˧ÅF¸M¢@ve 7Oæ¦çm®ÿ¢_a]˜©L’(Ôã ¬Ø[,(ØY‚í„ÉxÒOxAú¾Ÿy€…®ô³¸8ÚÎa©À0Tõ,çTPË ˜ZßÑëPØá½E—C%z¹Ðn¸ã´ŒÖ÷Ö^ÙÁoí°5[«» T¬<|¶ƒ¾ÙQ­î3{m¶;ËÖÌmoÛ!ÖÕº#8½Ô¥f–Ÿ…ûí^<’¿é¸å0 ™UÛýà‘ùÚ"‘ÜÆÄÒÐk/{–¶zÜ|É jÀñ‡Jˆ´*Y"••¹^4—XÑfš1Je®{¦±4ØU2CqlÐÅ0ö¶ÖUùLZŠà·ŽYÌ¿mpÀŒÍFRßaÁ¤–Î$ QÏ‘é_¢›ì¥ý+EF hüŽ. ¹à…ƒ½pÅvF^¬køR1«ŽtZ¤ªŒ8`¿Gá°®Úb ¬d«dΉ|q.òù•«¼öÚ¸ãÈ+ܽÙåzÆŠ… `;ƒY‘/ΰp¸Ô×YIÿoþ‚}£0T²”¦5ä#ãÔîÊ¡EöBQ Ûöl°Õíj/ÈR.&g>òB?yž×ÊèéÕ†:a Q‚L>Ø#™0êUé*–²m -D§š[xºN†°‰R8°Äñ]%&ô°Ø)AézƒôÎW¯3!Æb!ÏA÷/,YÛr/N•ôW,t슽ÀoÚΫM­L[·#z3¢w§¬({¥¯§KdåµIÓe©ŒŠBFÒ4Ö Š|Gßì˜Ò4e×w,‘r;"=rÂk'yšãŽáΚ­;f¼v ÚõÚá¶ϨÖ*M£øtG–†A3ýÏXøIù ˜¡Xhà™ú6Û°0ÎT°¹WÛùtke%ã,H;Øå³UÐbÖsªqÎÔ&F…JV5¾,b¼ ¨éËár+W,¸µ0ÝYÙ%µ<ÙýHvK²]0[‰8–+/Ìrt^Ž«¼`õ§Âòv¼àÁx -XIG,Ш¸Í ÷°YÉžÓô€…Uä;Â팳Ë*¯Mºä7°pÜaE~>îH7d§’}Š…øîŽyÃþ&þ/<ê?{Ë 6V°ÀÁà#ᆫÖÔ„Õq’$±™àÿeÃB&y³z{#ø2Ë|7UÁ £+ÞˆÓòÜK:]5X´1¦r‚Íw˜Ö ÕŠ…\è®Â¸a@ŠÍéýìèSE,«‰‡±Å01ÖJJtyGÖ[zÄÂÆ ®H·S• -{<‚ô¿ #ÀB¾U§½és¼ Œ‰*ZÒSíP²|ˆA^Kø9.€;@ú–ŽÌ"·£?Ý1º‘ow,©ÇÜŽtXÏH܆Å^;„ÝÉ…X°; °ƒœ‘Î5|ð×kwpfðvGfw,v‡šÖçO~~/€pM.Ù¿§"¯6^ £Ì³¼PmþMWŽËba‘ Η`"(•~¦1s¤vôíì-ÎJ -“-ˆÎ<”V°`¬MvÌå m²Ž s-¤õŽ˜¼ƒO]„.Çž‹÷­m‚‡UܾoÌ lêf£ðÿY6Ö ÈÙ%oN®ÄvD0³­·ð®üÁÐ5'´º‰äí€.[›í¯ë®ùðáÍŽåüøË+Àérµì¸qÓË óÛ[]ì8<`Tî¼p†[¢0ŠWÊlXÐ@¢ £ˆ“ͱ…Š{tÐëI¥2çáJuœ±¢(h¾º‚X`¦žá²²Ü‚Y¼8íñ/˜Óèð‚^Ÿ·ûù›Õ¾x?¸nx¤Xú[óï Æ¿ÒM,·o~ÂŽ¯¼öµ? ?Ð^ Dd,ÈÔ,’$¯ø‘zg²‚”h/€†b¿ðúT7 ö˜ÐŠ ˜Ú‰w°ðÀäl>Z´~ùјíwR7§þý8ÿ¦K¥ÈÓ¦™—?Ùv^¸ð#ù– D­~¤R/¦¤¨f×µ -ÏŸt™Âè¡£¡L$­Î`ä÷̪# NGdRè—D÷£””»›cÎhtð#½ÞÞIÝ| üÏ]¿j‘¦ -`=ô}Wí¼pœ_¨a‹ß&SÔ$ð¯/M r’tðÙt¶4 ;D¯ Ùa~xA 4f%ðwô©ö¾é2œÁ•¥ŠT –€^úRÙ€îÀøø ¡äþÏå)–?ÛRúEaÊ¿µ>R ^ÈS h¢uíLzkl¶;"?Eš ëï'ùØÿø¼¶?Œ@ÃÿŽ…Å y:b¹ðzTsŠGËÕS¡ò†ÕWv°à),¤^Ø{õŒ(Jw,ü¼`ƒEŸæžâáeL0–]‰úñÇCœªWµm‹«oN• Ð.= Îêg+û¾‰±TŽoã5æ¬&ºM“ÖUÞkѨÉÂÆ–ÐM½$Ñ´öq¹Ÿa¢Éso5)3ú£`HÓhç…S^0Eð´ÖØ4÷5£Ëû†Þµc½ù€… +ßàŠƒ‰…+f¶ÚÆÜÎr‹â«mͬ6ÜMˆD/qI›žS6Wö°ã}wÉ.i/4iYÌì9ÌÍ;ÿQ,Ì^3§?=7ÕtÏLÏœs& wt°aa½X—™ -@1S -ØÈ3g,Q€«ºuFbÁc¦e”XW;Ã*U©ML´×6-cŸCý:×ö7}ª@×_äSíiúHƒG¸ÄÂøع¹w•²5áìÝžv”Kú?7ZmXH­¸Î±Äåk ƒD¯©ÙŠ…º¹¯×9ÂÄ)†Àh –c°,î+•+º`*±c”Ìv«Íu°Tnš—¾¿â‹›.”–å$‚‰©€:Šzy ®|yyé£>Á/uX ïÝ;aìk‹(F-ËÞ›àö6Þm*”|^y&¬¸ à߶ Ëx–ɉÚ9ÖÖÃìÇî_ÛeBÿ ûÛnšõ_Ü*ï ÿŸ*ÝÚç=Ì<ÍQÛ®’N.C(ËÍz $ ¤–IÁ[ðБÇG­ëÈ„pTŸ­ß®›R´¨ÕÌëÀüSøq 7ªÞ5ɘdðª˜Dz 3ã|*ólçZ -¡;P‹ b6‘‚ɤÎy?ܯr~õÊ`ùøA` û„ˆ0 ï^dÅûX Æé ûÇFðyèÜŸ.ü,0ä  - v•JÝxšõž¯Ë‰¹n*é§ÄÚ 5 ù= EŒ@±¬Oz6ÅòCªè5K"&:Á -*ꌥÌÆ‚UVT¦¹Q@ã¤ÃãÇ°0êÔ¸bÒÄPÌ®´Ó ß°pÿÞñ—c¡þŒ¤þ ëLG¸_óø÷ý /ÌÍÔ¬ç‰pÚªè+ç=VíJ3V™ÅH“®+’x S`,X{¡°ë—r QóÇÈÒ¸¼¢#aþV*1ã1Dåö0Íù/x¶0–—@ªRvjõ1,(‚çG>¨Çøt³>òŸÀ‚)Û_"|Òý¡x$,Š$צû™àétÄýR,زš}j‹ìP9úY&},D-*‡,Ðég• BôúUš$BŠÓ›ŠLÍŒ5G-–'±cI­ mÄ\¶téÃX¨¸yƒ³Ið|HFT”‹î.‡þ(·<©f}(NÕ–æÚšø1|/ÈÐ¥£”G CA ì„æ„P7Â;žÅĶBÒ9/Ø¡3-äNÆ'°a¤ÅB$žä…qÅBj¿…vXøc¼ð?´ü#¹%×i&˜¸L,êä'cáMzˆý,^¸ƒ1oÓ`ž²ËÓAÖ lèÓ•†Ö†Z!êŽÊñõ -qé5ïá}µv ™„GèR“Çu¤¸Æ‚ŸfëÆŸM>Ž…xl©8 º'Ðñ¸ŸM`ÎTÍoÁ‚uÎ5òzéªÞÎ ·ÓÅù7¬:ørœjê½ÉîRùÛY;õEÇ(Ë=é=^°‡úŒŒÇüEq^„íZA6»ÍœL+{c‘Ñi~ צ€ÃÂáÜ%†êìr¿ ƒX»p÷`ÄɃ,(N±`%¿ñí֥Ě¡îfÃÃ,,LáÍIX|ú“SÏ‹Ã×b0"ÿMŸØlðùÐÒhŽ³ÊÓ ‡=Kž†~•Åst“òhŠý¬ÊÊ`yÕ¤ùž%¼/_öc¶óÇ°à­òŸÉ¬dÄü",ÄÚÇðnWÁ™B„Ø–ŽqXð€:Bœ_ÏLÄ$Fí)\¨—LöÀÁLA%ƒäµÙõÜJskË"7Ä»R„ öM©ïÌkØ]y+Ö]Yº¼_VÚQÿ’Ò(è¶m,›¢/â…ÿ J?Š…¹v—àÕæ~@®Ep·Ò,àbqj•î^Æq˜Ù)ÎQØ"ñ(pQ®TAœ#e2h>Ÿ^ŸkKièdY’žñÒ«IßÖãz´0Úä ûC~òy8ãœäyjÀÕ$È1¾9˜Œ-!‘ÞP‰?y£·¤'…~îv}ÄŸÅÂõë>……£þv6©ô°À3†ë(x“8K—¹€ëŒ¢¾ †ªŸ¾.*<·Z“õÛ©Úˆñ+žüõx$šmr:d¿IϱpRòAù)ˆ<·¹ßòB>½-Ñ> †óùμBœ¯zù!²ËIJ}nž•Ç凣,º7ÈÓW±ù±Àëð™{ÿ”ù… ×™F,ˆ… «ªå~=ö¼“ókLŽòz>ÄŸ6stµ0‰]ÿáœN®®_ö/c¡ªa꼞ömP³/©ÉtIçú\‹÷†Ã€‹;XHÄ˼PÊba‘¿ ‰ukWº8ð‚XH!XÔáDŽÂQkÒ ÀQË4£¸ˆ"]ßwI!†Å v=6§¾¤Ã©¼ß‚ŽóX@)à '3Ú‡í2Î?€N â<¼™Q;á6I¡Âõ8\2 `S(Ÿsç@š'+î·EŒv"æf)ýæy,dÖžþ2b=̆ÆÙæXùXpI:‰æ "T®¼ SÃAYµ¶ó²ÍtêáB?:Ããìò»Sc¾ i;tÃ+1v¹@꟎ð—¾Ö­rUt lNÏy!jV;Åâi¯b=Ôbט@_í¸É}m0_¡ÆÈíÂüA©ÉbT§I)ÀÂq‘7Sd< q: )Ù=c¯;=®öø"8ÁtáZ³mvê`Á‡ñ®˜™‚3ü‹W)=ñ# ºÁ9J4EêKYè -¼ˆ _„›¹õ’ŠÄæŽòNoó‚XÒXÐA~Î Çã†"2Ù ³<:¶ó–'ˆ%\Z&–fd¬)%f4lM[BPJíè Ê’'”azôKÉcÍšPb†äö+.ámÀÒa‰È‡±ÀáÖE/cOØå._á… èKÆÕø×Ø ðz.Þ I„8ò ‘T“XÍ,Ä¿£‘#f;½ðê¼óIˆjqÁÒ3Õ_¶^)NHã $ &Añ И"ꈺ§«éÁMƒIT¨ªí¤ !š ­ŒpcRZ{Áàƒ²À-Ò’»ÛbtÛŠ™ð^ -tÉ bfÚRŸ±(þ¶@ñ«ö‚õ–)õ{lçdTŠ~3ŽSÙßÖŸ§ëÚwQÚ©«{4#Á}S_‚é@†ÜYø“°pTèEJM{ê-:ëŽç4<1ŽXsÍâ81qÆ ·˜…,éËsm×'˜» &L¢±u -3Ѓrg;c=ö^j W¿‡ª—àÃõVEßÃB"LˆÇqÙ>‹_r›i‡«Û¿Ž{ߵЧú,¼’y¢*J¿ìâÚG§ö"caG9b•©HPÁ)/íò »âå¹6\«G`»Ž@ÏŒ+?V?ˆbÁ†b 8· G×ò¢&”4¼çG* zx v -ë뾌…†ö¬Eâv,¼Œ„‚Ï/„`DÉBÊ $ˆµ],÷:8 Ú‡™¸–žñÂ-,ˆ` fõ#³ñ‚‡õÁ„@´…©Nƒ>Ñ 8Þ'`C¿£#ÙeÄ—5lú^(^æ,ec—7éw,|¬M*Ѥ¯«Hoç -À >b¡åitd‰S‰¥y~DÉ^8a°ˆréžÄB_ ýÓ Ö^¨dÞ'8¡F‘˜Õ¶Yg $”Ó†Œ—lÑ^¸;¿J¿–{Ö^ˆlÎëöBªƒ¾ÉyUÐv,|d~áù¹¶7Y<§­?kY.;ñØÎý4'3ÏçöÂÑ’HhšFœsJ£üÙ‰g»¦í–BÞ±ÂäЃìŒ2œA=-5É|\÷¸’I#jÃJ‹…P³&‘™ ôp;¶)Ð$M´êA÷coÝÁSöª‰ -é/‚u‚E;þ‡yç7Y£ZqâcbÍNCó¢SÝŠÉÓhìËü…Ì”-a6Œc?øá«ÉÿVÙçÁdC,¢I‚rê{凩39i‚.èsEžC(Z¤!^ dÔÑ­\s¿™AȘ Þ³Xx£—òÚ¸»ß±ð`áZ¡ù“õêO°@qîLŠt¹ÀBj÷ãů]3ÀÁÓ_- -“º¹Ùƒž“`äÂô#(_fHM"S)¦CI)ÄUÈÃÊ®‰5 -5º2ª–.n®´Óé:&¨Ú%dËo{ •ßŸÃèi,C&X‚UŸ„ðw,|¬MŠ0Ò|êZ$énÌK|¬ñ£ObW"!lYOsÑ¥,ͨ³´×‹ajiVûê“™Õó òÜ:fíç™ “ñl˨ªÑ,Ý-Ë“&`ÀÒ4<—¿Pë:dŒ§¢‰õW=…´ÏNzF±xXѺcáÕö¡šóÀû,¤ÞÐV~ŠC{¥©]r$¦é^dc#âJYTz6ÜŸ0Û’R"ìšy¤³Ë -û¸~Øpo9È^adÝ°€MCŸ´”ÈÍ, TM‡±âz—\—¦hw,|¬5ÿ¦¯Ç‚›_°!ÑžÌ{]×µƒô"éùZÕ5ÑsesšV‰ .|ºw?mæauo™àq­6ƒBÕ>‡[D•eTn0z †ÏÂã)9L»½ð XПŒï‡èH 1b¡‘ù(ÆìðsÙ"Lã©á÷¶81€EQ#b‹Ô¼;Æ]u†å=,ÔÈ Õ4ŸÌkS˜v@ £®x ¨ÂùÂ`Ù5ïXØu¤»X°ÊP¢#;qQ›ì™ Ï–¦â‘iÁÞm¤_ µêHµ Ë#ì¼óÝåãñº³ŒƒšÛŸŸâ<—ÉŠ‚ÞÂè,€àeˆ¢©ô¸cáCm~-áWØÎ Çl¢#»Ð/QÆñB`Ë¿ ×fsé DSÌã,ô"´dkÕmGeŠœßô#µhw{zH³­8ô£¼À–qL¨á⥼6KzJ¥X+|Øsao~Õ5öTÚLÍóíX¸Ë ËFV´ S"?²Z0)Í;ó ¯cá¼½æS}êÞ;îaáþª7éÛvsß»g^WƼÁ{‡ÞŽÁð„Íç|¹än½ù¦Ù±ðGüH£Rõ?Rz óqwór\1ê$w¤ôUssÑ®YéooÒƒŒÏÓù™óÛg¹_`^ë`D®Žð«-}>èôA,xÓG±zÅŽ…Ïœ_¸7×uÇølhB1YƒFóXêÓªçÙ¤ÃÙ™m×`¸¬Ëúæ}°®ï–Nb;ӮѕçWLeÓ4¤_ÆáÿÑ«ÿgÌv»cáÅö^ í¯¤êg–òËza¢;®%E¯”P -ó;5ŠlÊ[»g©@ Äá±ÝíĆ«kC‹âÚŸ^91MTy‘RZxJyÅã÷ïß{ÇÂ]^x ZXØ4¿V;OdÛ@} ÁCXØV´z ˜ð–ÿ0,`øæ%1Z\¦WÃx¼¬tñÞ½w,Üåý4ljç:’ýªî?È »Z ŒÅÂípŽÿ &Ö/®'Öê+’:ËgêĺÞu¤±€Šwó4p)„üFMÕÑá#¼ 5 XRæga×Þk'¦jþ¨½ðÞ½w,ÜæÔ(Ÿ¦{ËïÜÀ‚Êo×v²ù!^Ð:ÉÆ­ئÿ &zqf¯¸ºušâ½w,Üëÿ»nú[Xù»Å XPû5^8­«„é¡bA'ùó#ýàö-X8)ƒð»°pw²ê ¬«OjéM^p «`dkE±Keì„dèÅêôw° úþC=}¿ÎöÞ¾ “xDI¤åÝ×zß…ôA,´&šÔIiì^`U«ÞÔ'X€3]»¼Õ /È9?YªG,÷° (MÛŠK¦»ðÿXXúù#³{kZ*âÿÁbˆÃh-' NUÑ /(Nsï õ(þI¯Ík±0¥'uTA »ƒ`üX’L¥;~VÉâîZô«ÒÄWÝÉV°i-¶b6Ü~.ÜÑh÷ˆÐŠæNüʶtý8NécXHir‚…^aL󔜹9Ou¤ªµ-¸Ï SšFädm¶{XÈÓ|z —µÂòfÂNÿÌßù*(ÿj^¨ç¨™¨%FnŠJØÊ5¼ƒc„lXˆqb$@ˆŽ¯$.©bkã”LÉŒÀÀÇÆðÁäëÕÝ'æÚ€„Ý*‰MízÂ1Çe‘F R¾CzS n×óMôèØÊÕ)e„•¦0ù¼&n…SQË\ÛK1VË §µæ“XÀÈÓãß;ó Ï̵Ýò©¾©³í°™¨u⎽€*øVÂ’µøígj±PУîrÄ#XÁÇ5;bŠ"òZ{Ëha(X0vÀ$ÀŸpX0êy’¬äÎ^`µ†¸†^ö½å½ˆ…:Z.xád ’ø:hx¶ª–ôÖ¼³Á@—Óã¼ÿKXÄU^¨2 †AÙ,À ÐÙ9Ö–~癢¢2¼Æ•ßAgQ³¡}z?µG¨ù1,ØmXmm f"R -bî8H4Úpc‹…7q‘H“’ÉÉ$6åÕbÁjz]0ìxA¾„Œ¾~Ë '¥èñŠ×°Àã·K—_çeãíÅBõx Æ%ŠâòÓÁR\|úe¼p]GR£éu ‚M|†zŠJZ€\¥Ð¡é¥ŸIßdºKC݃êN¹ÐCzJz¿ Ï`yA"Â)ŽÕÞî¼ l!7Ë ³) S{LÖ:( ¶Jd+U}}ãóäyóÓóÎ(~oyV§ °=‚…ôz<[dy 7=ª·°¥Tm‡šfdLÙ*ó [³q6³²”†¶Œ»0 ¯àSŒow°­Qƒñ”» -­Ý]ñkxÁba1­öL(gO̶TÁUyu@%|ÕJP -:©Ý¢Õ¨÷‡’b!&¯*žã…NåDyÒ — FÝò -«y¶©$p(H!ðBîŠ}Î~]ØU&ElÜ·K#Êoê°çc0¤Ÿ/g~#•§=ú€ìˆ‚¡ì*Í$¦áC¼Ðåq,ô7+-¥^–ùÉ%ÖeP2$lw¿í‹šÍif\)§£Ýœã ¤b;1ÐXØýB×­ŒÿD^àW±Ð›‘¹Z±3H|Ág_Và"„º _zˆ+ƒ¬Ò±è0Ð$yñ—¼À‰<]Ù˪“šæ •Ð‹¥né(O(„$ÈÿHc©›@WK‹7W3®$<`É›oÂÂÃ1‡a»u©6'¼@–9®OœLCt6×6ðÕ”ßåùfe¶° úøNºöe †Å‚¯Iœ( £Ñ$sM¢7»oBï+‰;Í’rZ´ˆ›^ -B/K8Hð>$ èÑ`eØÌðʼn;Â_Å X½Ã—ˆ…Æ´´ùÖ P¬Éƒ€…ÆMýrÐÛÉÌÖ€òÁ‚h°è8@(éRd@¥|Фƒ›ŒnR¦=®$H‘b¥gÉ_Ø» ºÂ…†ácñã° ²ª‚q6˜×ùãÓùq¶ºš ?ÅE€?ù=^õ1ìû½¼6fŸ¥54-’K,t8êÉC`żÌ`1Ð °Ï]@¨AZ"BRØUbšHS|ô¼IÀòBÎ=ã)~fàÓ^8`aJtëQÒ\ˆx!Ñ V+rév=lØ…¼b7¤1‘óûX("^Dź00Å´ì~ÒsÔ¾pù`›ŽK MSØbž+LEöðÙÃ÷VÌ‘;ó‹'O±@iú*UtP©nÇ©öoâT¥$óKÛùdÞùd¹Â÷òÚ·K&æïU¸‹…¹u cˆ=0ÀV ,F€hsëi³•¸—t$üä âxÁ*Óˆ…ù§bá^˜z,Ç*zk/Ä:˜Q¹ IŽó ¨ï〬Q«Ïý-Á£13p%ÊzóS[Ú]÷X FK¯¸ï¯&šÙë]ÃB0!Çô|ÞyéÎŒï»Xx¬¨ÓE Ʀ#…¥ùí]J7ÎHš/`j%àƒ‚V» ®‹¶eëu¿Ú ,Æ«p‹…è×òÂ\é0¾w_¡‰Ï“ÊPY§¥ög%—”Ç´úDûi/óW±Æ:“bú±Xxb~á-nñºøì5,,Ë|ÚÞÆ©žÈ~}æfŽ¢kXXáQû+¨ijKM^04û×pô&P©tÕ@áµ¼°²åïã…º3}³€Ñp0:DM)d&B³¤lc{Tw5;d°(Ê{Ñ£÷ry‚¬üÁÑ’OÄ`<È 2Ž–ÛX¸ˆÁ8S¥ÃY>ÐG±'`²kX°l -ú+GVÚ§RXFX±€nnøòSl‡~œ¡]à» 6µÞñ‚Ä«óûxtrTË9¨ô¨ÖÓf*Šœ)79N6ó¦±ßx¶ª;–á”oP‹É{w®òŸ¨ƒñ/°€.w°p7N5?¦/ ¢õQ,Üš_ðõª³f.v­³¡Æa¯±ã»Ó‘2[³:Ž¬Í™r´F êu°Ù ®ý6^¸Þˆ2¶Üþe£Ûº´¢>Ò#¼ «9ZžÂÂYþÂÉtÃÂZc,_ßN-ÄÝßh/´H”á<,Vµˆ1ÕHK\·ä0¿ N°ð«xᆃÞÀm:föø¿‡ùyX$óŽ©k'Xèã…´&vÉw‚…ê+x~Õ¤–špÔ„|ª:ldZ¦HxPmR;ü·ZÞ_äÓø¾Çœ—Èקî¢"˜þ,PÏ ã;1iÒwk‹ó·ÓºÛža*¿Œ›ô4‰3?œÙÇw&æêp•9=9©ëËtn·_ºýJÁaŸÿ9Xཋ‰…~P.uôèG²Óèv…û t¨Åÿ‹Ð™÷yÁ¹=ÃU_ò^ýF¿¼Îö=ÁÊéÖÒ+Ë'Ú•læã™ù½•¢Ãaç'QÌ=¿ùñ†-eâÖ´½ÄÂ*Ëžï‡ö­Ó>Ù·˜Æ.p¿)ýÒ‡s™á.Ú¹å&ö"8$=^…†Añ+ya«W±†bãŠs n)Ó-"±(þ,üáÕèÕŒ§Ýà…Z7&f6§2¯m¦ñóªFE¯Eg<"˜‡3’îXøk‘üËX¸5ïŒK™JŠ>&•%’ø Ôƒ/´5J¡ÂIDÉc¶êè_ÁÒ ÿ/¬XðädÒ! -qƤ&¸^»)p‰kt¯rÖžÓÿ~/ò²Ì²é¯‚á¢úâÎ "éE’e ·½ à—)³Á¨á†»øt¿®výO`á½ù…ßݦùM„ãÎ '¼`B¡egzm×”™0(•Š/à즕œTÿ -Þ[—ç7·<âMJâ],¤“¡ô >ŒR°¿b‰P·L¯Û`?FÏ—¨„‹^¯5z-*¹y*v‡Ÿ=Ì<¿Ã N DA¯ƒN¤é’¦ÔåòxÁòA'þ!,üe^ÈŸÌý}£\èf]-ĒKvD¥n½,aÏŸÖêO/³Ðˆ%¿¨5JKZËNnÔE¦É5iŽë‰6‰‰Õ^¨fs6!¡†‹2Æ°ó¬.0f;8Ú #Ú °ýS¼ðW±ðdŒ†-†hmPëÖÌ0pŽÚÒJ WIu]ú~æ[áŠà“$eötïFNô¢Ö(Ö.³rqcåµäj:ir”Ù±6…MÕ¾Á ™.¡½Ivi‚ Sß;ÑeÃ6,dÆ“ÝÒb~åa¡øÄ)™Ï)ÍÐüaéI,ôH`—ÉV,ÔÌ&¾µš™EŸgNSyX8ª8ÎVÌ(Þl²?¹F3¸N_ª¶Ž³úD&Q'gó“úD%Î^L“ÜL_eê6/ðZËŠx6ƒ²:.ú[iÙ» KSå ?Hö©XÖÝ¥íéG[ZBÔpéÛ]à zD`¢ÉÙ]z~vÈC- -Ã$™— €ÆÃ5˜€±ô À¨3m)}aÑç9·±ôË×M]ŠL`+šr,LãŠ%C‡µCMë×¢Na°h=™h¨‡pL z“&sgSLˆdÓûL pݱ5ƒ¯D OœÃñkÝÃ5Í$$ápyœ£¶–ÑÔù2+[S¶=Nž%Z¨ÝžwæÍl×,Y<ËQ¼™ìqs³U ³?^˯| ¥{Tÿ‰ OZÌ¡xûuPÍó¤h{}¾â|"Éã÷)ÞIþÅÕ ï»êQ,4¶DO…Ã`ß©Áò‚êÇkie (= -†å…SÖÕoʽÞʘŠ[F(KZ]ÁXKâÑÎXõ±Pxtà(Q:ˆd :¤JfèЄÃ}9bfQÖi0[T gu±€AŽÇ¥Ü2Yfr £ô)#q—Å -¥:i$HÖ@à -$$ `è³ÕŸŽGú /ý;XvpÏŸ«P9i—‰ž¼½|ÁŽÙ@ûð†#!cû¼ó³1¨©€ÍØÁC²òB_ÂÖlLD± á,åxÆ X03a|ëÀLO0¾Õ742”ŒÊTXŽµvÆÊ“Í„X€ÿáÅ‘*dð0 ŽW‚£±Š#¨›_8œ±É0[—hÐç;À$>€jÔMVqëëïÞÊö”¦WEé/pô‚Ý’Ø+ù:OQb!Íà<[X×(£i§*¼F¨*ßb!t홹SX}Û÷z+㉫–Zímª8ðênÙ°€¾ŠÁö±êQÏ„+fV²5 -)!Â+M=Œp¹ÎŸJ3%pzjf"+¾cá¹yçžY›Ñ“y$f²òˆwå'È u–UUl¢išøf/€ô'X4EZŽ„ -€ÕΆ(–ˆ Eã{$=“T$ “9Ãèžås/PX°+a ¹’؈œþ‚M%Št i¦ÇÀªÚ²1‰1>–r[l®#X®Ñàô1¿Š™õ‚]®«îÁÕg¢µÏrâVm’G°ÐàÁÓ„’€ë,D-UúaÒUR`ZÄ°YÍ á‡•]s­V.Ðc1kðB -f­€ŠñÊñjzŠ•Ùá|¿L.b)@³,ÀR|בžÃÂHœÿD¥2/Œ Ž¹ˆ6{¡Ò6ÍÓòÆcEÆo¡ŽÖJHXP«—¤š3–S$§JòuZ¨¦Âúq€,£ˆ‡ ®†Xè:ÃIi±à3ç‚âÖ þ b€)P#ÜÞ -­‡Ø‚ç†@F -"0nðè[¾ß^®2ODdú|®¹ŠO]TO`+ À¿$z’1–ÕàÌéHXeC1,>åa‘ûV”œ@°Ó™•xW!(ŒÁŠ…Ìд×ÓdÍybjxø‡]‘-k|Â~•l¦¥­ k²&{8†$ò‚8žÿ,žˆÁ-/T }…²hy¡ $&0ýHMY&ÑÆ ³LÚ ŽÑ©ì¢yvµ7BÝz84[^Êq¼P:,dxüœgºò( ÎêHåäx!±®&تJëæwX(Pà±úL){`_„8Ȧ©ÃqS ¤~—ZM·¾Xëh;¯Œ¹`é¬À^sQÕc¾:†üÓâ8|%k#TöÞpŸ¦@÷‡{ʵg1 -ˆ³Â/•hÚÁˆÕÊŠ¢,à(-m®„+hØ®ˆJ‚Er„ÉVX‡v„ãÌ–=…¿ƒ1§o¼Øw°0n±P1æðB êµ’«~$‹`̳*>t»].@ÙY³‹º_¡Cã?ö®±qR…"Õ»¨Jþÿ—‡e§lv/mÓÖºbG݆(„,XNdýx!€P_. é„zù$õ†©,ƒàÔ t5È„"³2o©ã¥D¤ʨô;öneGB\ôÂ@j  †õ&Ô~«RŽè¬œµÝƒáîvkÉ)g,¬aŒLn»hœM6äBTÏ× dÃèYÆÐùɾÃÏÈ®¾³âÜ'0Tžn/2 À×$xYG~òùd¦kÁ—áÊNîà@`«½@ÿ(ö©/!*ÂB|Eý?1U:ÁfÓÌNAJF¶™|µ¸›_Øéî2¨‡z¡GT¸&õ÷ ÍE^i#Aú¾„ÀЧªNèŠÀÔNeJï/€P>»ý¦îæ*Å‹lëºõníñ»=†3Oö¥Y=î’ô’e¾—”»Ìîz!K¢­vÜ@ ã7’1HÐM²•.ö8ÍŸ¹„¨ èÿxüÏ\Ûh¢h‰•HíZµžŒ,H<…ÔžƒXèµ^hPOú ] CØAî_ôáx—¤HèT;‰d ¸SÐä ó7r·Mm¼^Ȍّç‘XýÌ<}ô´ú8 '©°®L°ôG,ÈÏÁB€y¼?û Á=ì8Ä<]®ä!57_.T“z~¹O„…d™Æô°·{Þ7È>Ú·m#ÂÛÑ>~æ+ÆôÈ:a«jÏdņ0‘¶˜ªÙxÙØVz‚…j¸NSÓÆž§í0»æši£cºŽ:Ösm-íÚ—¤£nD¤,œžŸûþck<«LKýlß™N,¬EùÛ´ƒèüÑÜæÿoÐB¯0ydç ~è/€´Ä¥†RŽv?Æ‚<0ÍDzaÔ\ŠÿEl¤)eíâ’ ¢$t}Wäæ×íX¹¬ÛɸOhYúbYÝk°€*!M>xç~GC±äOÎÜ\/·ÉãSôÂmÞùXãÉûÄü÷±PjðÍËÉV©o/XèX/ÀFòz!±+s~,üÅ 0;‚Ÿ\§§s$.5ýtðzÇoª›^øjXPörÛ Ív ½iÓÐô™A¡däv¹FæN/ä&‰¯6Rà¤Ú/GZþ6:¯ :¨Ç#l¨|êuš—‰r‘ ¤{À‹s„™‚#˪ VQÑ„…«›?áDlaHCJÑÓ>ÛÝ)9ä3ÁãìL.ɓ˪ç/Û.„èoXøƒ¿àÙ£Ì$ÙƒùP©€Î`%2V/Â% †îÈÙÖf%#Î'èÁzi„ü"XhË¿Œ…Ê·ú‚Wj­QFQ õºäIÚ¸X“oÈÉŽ™FN6r¸3³Áœ¢Ð EûÕ†â#2-4çá”ætG/Ò¡á´HoVòªfþÜyç4'Y}»d’j—$÷Iz{öŠ·e¼bÍY_TÙVǾ÷'\âW'ÝXºb¥ÿý?‰ÄÇ`á¯.Ì!i¯ÌÜ¡m}‚‡Þ\ ¾¿•妡ࢋÈ=ŸM±Û¤ÌV„íü šXŠº¦W‘€*p5ZÏšå`£§kb¶Ä 9¼¼aáÌÁÖ7Ï<+Œk4®ƒáÑ´ç_b‹¢*E·ÿ0ËôÝÞyÚ:„Ú3ú{Ù -¿!*Žª%\¶ÿ·<ób›ü¹±AÌ$ªÁSºèƒ ÙyŠ ç|›E1йKÚŸ‚Óû/fqoÃá7ìë[_mýNXø*ËÇô.œ¼ÏX¨™ÿþlõB­j¿xió6’Ç“Ë«ˆu-DmŽÊ8¤’ ¬*¶—ÌoÝŽà$Qmz¤#ø0k –õ¼ÚÒ‰>;2Ë@úü†#]ès¡Ïðþ†ì²!õ D涤8ÕN`‰ÎisÃÝ5’3ÆËBÚP‚ºj;ŠÈøÛïºèT— ÁyÿÅ£ þâ­™[u¹8P7,¼ ½«Š3-¯Xð¤Ú}nWò›¸LÂmRp7vEQ°@6"_ ±¿†‘R”ŠŽgÔmédL§ääÁ„ÔNoó<îÀú:º íõK¢ç‰ÒTþ¶Œ˜±POÃåiO,Ù‡(åvnÈ~·!©Š cÁUqxÉöGìiQA²IäÏ tQ…âIu·§GQñDHD{°ÈÇþÜOn`,Ðý32í{Ô³—u_hÑò=ßåèÓ²[ðEl“œ þXú (Ð4ÆÊÀ—0hô›Ö½ŒZšÅÈ -½YOÂbC{ñ°ckä<>‘!›!A¤ñ¶a¡7tä9UÒd§’?ØoP»]p¦Î;ûf|ÀBèjæB\–»oD´à˜øVHÈÔuƒ{z´ÒtnÈqnÜŽä.þTËå² iÆü<Õeƒ¹ÛPó)àm87DkaGSH¿aÅ\£»·»òO{ÏV>i#eÆŒ‚n¶±ÝtMËÞݡ多éLR§ÿ(Ü1t Œõ ¬I·&˜r»™r»_² 7­ÉѪ„¾µéf²$J.ŸžG"n‘Û#…»É8å»y¿TXÀ‚¹¿¡¹·á]°Ð ÓÖu#.œôW,ÐãRrᔆ̨ˆLÝ‚@0 Í¦AûZ·‰þ_ÅÂ+—Í|Þ[…¤E‰#}ÁIHŸTUØÉ.ézDŸ‹:7ôOl(h¿ý–V”çAΚèKr1œ—Eó¥úþœj{¼!¡Ï©>Ͻ±›äÏ}ÙÀG¿Ùð¸_Û«–@“¡ÚÚn?b\ë «[Y+oäîq11[¿Ê%5"ú‚~ÅÇÂú‰Xð^ººúìü©¼ß~ñßi÷3ÅŽ¿Ûp=B§`²÷» wç¾ìp^´~´á—»¹wî§ïæzª_6\}«¿ ¹ÅCÞÇÂÙ)²ÑÆÇ2J_º 4+è24=ˆ©Þ- ½ñCÿ2’”í¿‡…>¤Mé_nb"'²Q ù9Yi !Þ;ªϾÍfÏî˜wã¤ûFZ÷ ú>²•É×{:ËöÊ“w§3·Ãí²’61¥ºýaN/»3Ã0¼0–ѯß -®˜Å‡ · á?N¢‹Éú4Ri:#ÑÁýu§:þW°Ð˜² '£H/Y– " -!QÝy,:¤UZíÓYþÊ·¤ø£sX™­¦YÍ–¥·¤Ú+Ož÷}IÓâG­<äÆL³à¢¢ŒãH´Ë ûeGÁ7‚KÆÏ@à‰…5|¨“ªy~kŽn«‹tñ`!´~š“° ä¹[ðVΚ±Ðñª]aÕ=, “RÓ=,H¸Öyħó…¹ç8?ÒÃxØ©A½Pó”ÒÊùìÇ(XNõŽgî}çX½´@rb!å÷oOh¼à,õG6H¦OÄ‹Ñ’§ÿÏ`bÀ‚è\ò5(…bñ\:¨f¸‡…šÃIÝ~ßFH/€Šµ®~ê/ Éjå< Í†w>„W)‰)®q¤ÀNîžïüBÛøÄÂ2üR{"”àéF4ëSÓŠý=f› ¾aá\dé¾ÄòA5ž(sà/€¥X!ÁúªÒ)jä\õ‚÷¨vQ3Ïi#¥W½Ð8аõÆ×P ˜¡›ÞÉ:BT¢$×䊅ááÉ`ϵó9¿Ð½‚ƒ8ðò½ÁO\ì^–’|–èI¶%Ÿr û»Ñ/øëišŸ‹…u’;f¢NÂ\Ê8{/V‚/´º'Ïvcdr´ê£Sü’}ßZ¹LÄ€IÑŸ «°×Y=·sôöyÆ âß#Ž´“K@f{+ÝjD¶Ø€•Œ—Èlµ”Ùló«^:óŠ.CÚŠ-¢AØN³m3y:ÍÑe ¦n’|Q.Èè¼b¡’vjÁÕíõ¤o3;{û+ú4œþÂ8ùå%òÑžêÞN÷ýÞZÅ×µ¿œúWùõé™Þ_XIÅw&~8ËÐ&U+) ˆZÖ­Õydö…ÆDô e4Y-hô[î:›¤Âîë·ÇÂïy¶U]‘¹URœ"Rîâš=¶ûmûî‡ôBï;ä@ŠÇÔý`”Ð9YCê(߇ö*Š#®N½ÀÜA~,ü„Åû hFZ¡“V½mÛAÕÀU+‹dG> ۇܴÅT -i²–-Át"[* ,Ày§±1ùþÂx¶ëFZmçÊg)EÞŽät´Þ¬áE/ÌW,@/@ðIÊqH¬O,T˜R½¶vT¨q ¯{Y;ǧ^È)ßޜ솅—ú ¿ÉÜ—Všƒ_θ{Î ±?‚2üÚ’kâ iìö x™VÑðþÀ³Û.IåÃ*R7׋c×À¨y‘•çÙ¾è¦r€”g`–<1T ’º:éìXŒÓ\öš§%‹/zçmßÞ—ú à÷cΪ³»Æ½à°ÖOÌ#6¢ÒÝZÑ«³}KÇägU}@vÂOÐ àÙò+2Ÿðã#`èhdÿ6÷¼@½ý^@q_rú öE¨!•Šò«<X´`IÚåxÝÛ«ônXx©¿Àq-ÙÎÂÆq¤qO9s!U)mÂ]™\?Ƀg½]°Àí}ó#ôÂx¶G½¥#™ƒ­ -òŸ;¹®r‰õ^ôº#%oùÀ,ˆ½ÊLê¥|t¥m"MXhB²?»"!"÷ã8Ÿxr ä/™ï¼ Aü†…÷FÌL”>Ä—Ù‹^à6£©ÖA±í@CfÈeC1æÍMŒ…‚«[B}1¡¿¹¿ð[žm²ðÍB?9&ݨJ'q !ÙŠ+ božíÖ.ô8¤#ïàæ6f& iìDÎY£ÒÇ ÙÜÚÏ,¿’NŽNjg‚ø í/äÙka‡(¬Œ½^.4I:“š°aŠ}Z¤ƒ Ð.;3YJøÊ ÜlVn=a%0Múݱð'ží* j¦Õ®_‰8{ïLâÃ_ñ…g»v(J‰ýÞ±ª×8VÈ,XGDþ™§Yß 9ÆwdÞE#Ax‚³þ¬®M‘^NÅ\¶OYæÙÄÂSP?ßvÑ!ºMÖQ‰N•*+slXÃæðzA%èYɽ+`&õ ßÐ_x$¦Éų°~…MwO=Ýó÷ c!ÓR¡Pш:çÑH°m'Fkôécr 6Ÿ-,³Ìß°ðýü…,ÉET$»ñ¶½û—rÏ€…õ)Å5;ÛEy#9?Û׳€ ¼‘ÞÐs+Ú˜9Â]îGþA¯È,ˆK:{‚‹Ñ¾‡× 8¾>Iÿ<ìèV´åkÝf‚kž‚XONÉKLÂ%‰“Y (j_@-Ü°ðbaÒ²Óº¢×Í)ÙƒÕ¾]"êMr×YÙá³-¹ÒêYK…V)]*õr¡#Ø­\ÌäF”Àž…pgBNa̲“¼L)à -ýì»w¤ƒâçv¼üT,pŠÐ ÕÊ¥õjʸ.|EzÎå\ÄÞu)ꬊVM7á[ú “í]ObŠæ ¹ÙÔi#a¨[·“\7Zõ&åìlzÉ%íOccäPÓFô -:õCjE³Òíäæ…üÓ) -x »p`ƒBÚéø%-IS, u”d>´vAb5s')´Q¥pÝͯî¹ùÎßÖ_˜tíRDè,RÑ@Vs.n!wÚŠ 238zJ£ GMö%0ɺvÐ7®ÖÉ׬’N|ú½ïªù’­Ær2¸d›É×52Ïç<ú|,„ô¤¢Î`â,ßíƒö‘0"¸“dÜ°ð­ý¼·X' >„úÔ «´v*P‘HRLz¡G&jdêÉÄãž õ€±7¸ßOß¹ßG‰’ˆÓÞAÛD:¡ÀŒkdŠib 9`Ç›ä›`SÁ³ˆåj! -ú(ôÄõŠ¾3gX¯ý)«›ô=ý… 9ºì¢8áZå-vç8cü… -‘“š •§=Í÷Vy)÷° C: ðÅ+±ã4J­*(•Œ°Ðù½uØd[×B},d6i$ô¦[vÒ‰„ù©€™8±¿ÐŽ£2v¥©à1õ¤ò¢ÕÕÉqÃÂ÷Ò Ùõ¾^*\<{Ú›Ýc!€¿°ƒf?%G&e_g®¿JÏ [ç õJ.’³ rn»–Ù ÅÞ³æ -0êŒ×lsñM°`L§IÎÛ rw:»H’þÐîH5"«1fѺ@1xGº¡±&K9]ñç5ì¹aá¥þ‰·è¾Xt]ë2!·¢÷ôÂ%;»´mÜ’ ¹»¦e|éû lF"€þ×gú}'½v”E`Zòio³Öt=/Lê¾EL5—‘X0×VJ„†ãA3ÕA ˜å\hE\»Ä9Ib™0qÒ _~ñÜ 9™¾—çÄÝ7]Ľ”ïù «‘ÜÛ³$/dõ=w;G6·ÕçüÂ.ïú™yòBv²ëÍ ì%&½@{”Œ½Õ_ï›ÄTõ7|ëÉ Ï·‘|G´ðŽhL;šûÄ5~ ëKü Ý‘&*MÜj‚ù­èKÎ0ØBÞ_%eßûì`‹J>8ðÙ«*ñ&PŸåÄ/;Ì×[ýñCù•±°|_,d»ë^â;?[‹œÙÙÏiÌ5=.\/Î ½'‚Sþu±°Ír`‹1“ß ö= -EoXxzO…ÿ<,¨ì ϵÚú €úŽ/]˜í†…ùÎnÝàÇæô·Œ¶kW­gºÚ_ã …rí©sˆ.€šO›ë§‡¿ ¹Ÿa#…6ü¾ï7ûÛm‚þ ªþVXèõv™+ÌïD5¸cßîÅ/ÅY­Ú›Ðúší¯‚…cùÆ#_­> ƒyŽ•¶ªzüuÎuþÐQÈÛHhçpôÔéïžè.£Í¯¬`Xõ3±ð}¶ÏXþ éž‘WK¥ä¯ÍÕÄôáXP‹ 1$ûX¸¸\]:ïƒö>ï»ñ@žu;l¡ªÂcî2úýf.²¤Ù[îôk±*Ý—ˆ÷ö?oGVwѪ“Ú}ÿu,Sw[þ´D‰…Ü<‡@nÖµû•DûŽ(çãl¤TZÙwFK+˜bX˜Îø†™™Ñ¦1V'˜bRÛ¤ ý·ÅÈAŠÅvÒfç*#ìɇ;Û$&ÀÈZéLìoMX{znmw[~·Øé±;®.X€4l΄Œ,Èh º9ÅŒå>wÍ U޻ˎ0šòd ²ÄåçûaþÛH$¹™ÙR›€>ð=¦3ÛºT„… L¼ÚÎ)Ù9d¤u´WZuºyѹ„WõtªÈ«ÆÆÅ´çd#̺ٓ¡cÃÀBþÛòärå -ý,äÚÊ ³ýZÐøÉÈÃÑè*í(QñRcØ5k ­ØH6C;&§Íml»O$S4äg#q‡{Øf›Ib“mV× HL$zòÔ3ntÌ.þ¼©)kÐQ/w«ÎÒÍÙ(Ÿ í³ÁQ¬@ÞÄjúÀBânËï—Å‚kL¬Pþ;š8£sèÙud! "l0 -Éj)zèþnm÷¦ÂUJ2¹4‰>> ôÂÀXH zNÛ“¤ÂçìË“E8†Æ ЊùÝëBfÓîWuW,pwÆÞlÈ\F[:ú74jx#‰ú ﰈƂê1±T˜ˆ³ØGÍC&X³hè"7躖â\Oä$Ô¾3°Ð9nþõ6ÒÁX8 H–ƒA{:ëW.Xè1ssÑ çwF·Át®Z®#v ÂÂîWÑ¿•Nö7F»oXø†z¡ÎìÁý91zÒß)>Áf -Áh§‘´”Ì7svÆ‘ºÍ ,ˆñ®Nìãü…«^ØZEcùäFÊÂÿ ¬vìŸq“¦î\µ\õ€KÃU¿'œ˜etÃÂ?ˆnÛ¢s{,°Ô%V” J Y/>3!ßw‘x,øæ¸êc°àm$wb~á0ù sàXm3Y:-kª{XˆÀp”M–Oêèñª{za3¥C{¿åN/¸öÍ,)7,|Gµï(~GûfÔ;úÞÏÐ UÇÕÁl#‘⨠S£ø²—S/ø!·ù8,TÚF§^ˆÁj ôŒ©J´ð{¤c“ÅhM÷¸-d'yUw§<‹Ðq­ŒŽ7ÇnXø†þBêä®\§Uds&Õwz¡#2´- “bŒB¨K;Ù ü[}ă9ó‘‚æ6N°®“ÂÅYÛT§ïÜ—M|IÛ®c´ X >}Sì‹OÎÞÊr+"E«6¤ms*6Ÿ’Ùå.ÙàXë䆅O/ ¿% ›ˆ@Òø(â³:ë…ˆÆZJ]`M hÚ±€…ݹˆ…ß-ÈÙß——^+3¼oXøvX8P粆ÜòÒE-H8ƒ•ÖDèpcĬ֨vQ^`0¦ϼÚ] ØÝÁGUþOÎvö,¼ð‘Æ}sÎä ß o¶è–{0š“#sý¥‰—°*<Óòø@Ì.Àþ˜Õ)ý&Zב·§ýY@—g/g¹é…ÃBž} ,lÉ}¡ëžÂB\;mF®Je¦ý žNFRÙU‡ÿ[ƒõR,ì ÉwŠYvøk;…HA »ÅX±LùsáÚ]¶;•VOĺ…þºœ%èèƒ6$7,|$>p9m¤ºÏHc1hÖGIzª÷' ÿ/]Œ2~Æ‚Š‚ÓœÁ «þ£5líŒÚ­f]}“Ê>aI_“ Û’Žô=0i KŠ›žÔqÝ£fb‚wÆB€¡}@N˜BFí‚ÝžèÓup.˜ç3’z™v„¨ ,/¬Vƒ@U·»xøã°´íû€ºZ~Ôn ºxC ä’ŒcMæ2ÉXhi›H‘}ÞÀB¯y –y‰ wötJ{Ëîˆ7ö”›«'2šr$Ÿ 'æbmH² …×dnYŒ‰dËÎWјýÔª¯ÀÂ@"-y ¿?è^•[{uÅÂn÷ÍAE·µäÛ‰…á>B6/P?À_(aö¹(G"5קÀ]e8=“£$1H2°œÐsÊ‘#D­{ß–ŽkuqdýàQn%1ßeNÁ£Z[@?â5«¯ìÛ߯BÓº0B=˹_B_µ´_ŽýàÑE´¦âÝÀßÃòó€6BÈž†ìyõGHÿÎÞyõ6Òl¢¢´+óæu]­÷m‚ýí"ÛT YÉ“ «lÛ«“b륗üqw¥Ž0øoöZí¼ZÑG¦$ÙIŠÑ¬…ÉÓÒ¬›žÝ r°ÝåtÎÉmóÕŠŒ«•66&Sï‹…ÈU’nËëИ9`ñ¬èöXÈÉGx—â~*­ÈšÁ\m¤Þ‚“þ^h á„øF ò‚Ò©ÍYÁ[$°ÆT¢Ê©“Â#ö#™ièIläºVªs¿ïû:mmæa´ä8_Ü‘ì´ß±“°Ï¹¿‚Â~Íè‹â]Ùžûå3¨©h¿mç¡}pd@W¨Gº“d&, gHŽ<º…$°ißXû㱬"³ºÛÁ_·¾é!ÓußÔÜtg‘ÈÑÈ7sD°ëïILû%îÊ\ëjž¦±Ø V‚Æã3ì%æàU’Ö²¡“Ô E<6Š]ÂwîSèŽÒ¨÷÷4\[ÃJl·[ÙU.ï°@¦dI]±pñ=üY~Œ^`,äÍ1ê·W¯~)ay3Úé/¤áC¢Ñ^²ûa×Òë‚a6 Ø ' ¦Èm·wÂç”>C••AÃvˆµçî“ãt `¢Û|çȆ®MJFŽ#Å4X`þB‰î!5¶ðÂýÁ>ëï°àÖP :$ïé91-à‰–Ÿ¥êúŠ¸¿ŽêíXHÈ^oÉ€'§wÞ¹ÍÆÔ]ôÂø -²ì`O¸hL·tËX=Ô È…ë4îÍ2 .Zr‡8RÐaÀ•¿H$½ëžiöÞ_/äë3@¹ª›>‚1à’Öü‚U ɥ†Ö ñ’ô9ü…ñâý…ŒÏò³ü…[éw6’ìR‡"'&ÓÈæ5øµ½¿ÐBRÉ;àŒSÓ’Ä,qzñN½À½w8´z‡…Ð üæTfB`¡JÉϱ7,iû}ôX€ËœÛêýõ—ÚÙÚo¬Q3ǃö;,Ä;EV’ ï¼éŒ# üéõÂõ®~^ø™XHÕ›±À=lC” ‡-¦È¼®…özÁ!Ó¶'Z4*‘ÖÕl+".­Võ‚ ,yX.]lÏ¥œ¤P®×›„Žb’y²†Ð› 2Á>Ÿ6’o^üoè+±XÛådµ´ÍŽÙhyÃ%Ž$óF“cÊ0_üüÂȼÊÙ]Éý ½ðs±Pïo -%y©3ã¢1åÚûø»„Ñµ× ¹]F©w2œÄd:Ž©ÒèÚù×£¸#K¢W–¸ ¡C„Šµêm“Ø}4»;´é\§¿ Œévnb¥ƒwÄ‚ºbÁ ì ïˆv\ÜâKà(à)i½2÷¨e7á2¿ nXøfz¡ˆßŽ…b”SßÀ|æ˜h—åÚÆkéÖ²V¥Ü“ tY3È!&Û¿r*”âD`–Ó>ÍŒRΨmE“çÁ.*^½ƒ¯» ].xMßÉ!åtÜ©n¹Ù­kö÷ÄBÞu9I&Ù!÷Ü©¦£o|ÃÍÌîI? -1³¸“èÕ ˜Ám†*{WwããOÈú»ù ô>w©žÝ½ð]òT  Ôÿ/Þ¶‘ÞÁ_ølçc±ð¯/? ±xÓ›?ë$&ÉïGκ xžþÞäN/¨ëÛûéÛ©nX¸aáôB¡ÞŽ…‡ÔŽ¿TéÔó+±Ü#V‚³éˆ| 5áC‡?®oX¸ù _Ä_ŒéAð‹A],ÌOaáEœÈ‰|‚oX¸é…¿§<`ÅQ¤®Q¬â„c++Z¯Ì[¶e}Ím…ºø¦Ûø1´9=J1==ÿ\”EÂWQ® â4PJf7,Ü°ðÎK%ßäýz‰ÄyÕÖh¯–ÉBrÛh)çë,©Êc!ÝýÞ¹±RœzAk«3Ÿ÷íá"™I„ØÉì±;¤5rCTÕ6®oX¸aá½õBZ¿ ä/t{µjqñFÛ“®“¤³Ž{ÛÖ }mlä<ft›™Óò¬ðÜmV,fyfíóJóW9¤‰Éœë&‘¯ÝåëeÚú†…›¿ðÅü…eg¾Þë…®ãíÀT`¼D7[“sñFJ¶°08dM Á-$ZžzAø\UÙ"%Écô‚¤C_`ȉ̖ñlpò*êänzá‹ÚêwÀ‚pÕÓz#!/0[¬-&˜¹‡[Ü,žX(¬ìºÝ†¥tƒˆ*R3F'v©½^X,&™+pL”q)hÿ*öùnXøò‰wÈÙFL5gžë…ÝW6³±B¥6wh1“ïÀXØ̾tË 0ªæÓwž‘õ9ƒ -`÷¹JI5ä)ô™åLï#³˜[XMðÙXècïâû -oå.ÅôWŠ%ö6(}¡ÿ^4âà¿ðk&Õÿ: ¿ç,øƒ>¼Ûqóž……ŠœÛÝ÷ÖÚ¯X¨ç6¬I/tòp©õX˜Sˆ[]¸ -à^Lµ";–¡ôÂÚa¤ÀnJõzbMP§g¯èÓõBß¹Ky9˜ðíɾ)m°ðÈ°Òwüû’7®Dëõ—ÝýB'›ýJþ“ÊײÄmO$i–â"iã‚®¾ù Ïñ$'hô‘kÔ5”nÀ‚Üçöôà#8G4ºÆ?[!ùÅ$†‹ö¼ÄÚÛ(”ô¾èH‚G‘³Ô˜â“±°”$ý€qŒLT6åpö”þŠÍ˜dyÎB™fYkš,y‰«ËÌ•Õ#xäOÌÌ¿’-=þW¹âõ6,„dÎîùÏÖ qÿ>þBk»ÉˆGþBaä(uᤠ[;.’†JÃóÎ ¸’½'qÆ‘V˜+»T¼¤Zr&øn&´$¢+€g¥±•{mÃwÄB*{7IV£èTG.~'$*Í!,<bÂ-,'úŸRqÏ@/úø´gâ•<6ú¶m¼b=<®;Ñ¢Ò“JõÛPÅ -pífvHµÓqœ4[lÕ [¯ØÄ©cw¹ªêOçð¼Î]ø}Q/”«W>/_E©•ª@ûÑÒv? ýž¾ÝFF#e{’kgÌàìì¾Ó 1ˆöP ² ’Ü•‘+I֟βM<É|“’³·¹@Ž—h®Õ,öÉ…,ã³­­h? %jYwÜ×2ëz¡[ÚÕ ½Æû½£Éû†ê¾vL„4` Œ!,ÁéÉÈ€ê\AãùJ>¦:–‰’+ùK(ÈhÈÚZÜlMBZ`“ãEב÷UfV Õá~ˆÎ`! î -=QU²+ˆ:ÂrÝ]ŠÁŠIz]| ](0vIw:*¥Û »pC§%ýÊyùÿ¡á÷±áöƒý…øü…w]ý‹ùóË-ºÿd,thÇ»L#¬`Ô×¼ÀÛ)u›½l‡v»‡„É”Ì3ÛÖ£t‰IÒIºª=bÉ“$¶2LT‘„'¨ ÍfZšxä0Å™ -Ùâ’b?ÐáTê>ÐdÀﮣ_´·±]¶ä9Mºû¤P›œ3òÇ­2;¨YºVTgR’—43Ùªƒ˜ìÚQT<62E¥ØÈzm´ÒM6‹‘°ëgûoþÂm¤÷´ÙÊç4^ÇûŽX!°I·ŠÕë…}h«é׺]OÃXhi›®rŠ6³ìNmìN(à'†Œ. Ï¡tä|%±.F2·¼â2's‚Â\ý(x.’4ã0 @–V¦¤`ÈQ(IôϹD"‚íò"Æî0}IÝqx,ÐÝ]€QgêzºxºâCú%GÁ Û¬`öéص‹qn'Ê­Ò þRXHÞþ0"ød,ÔÖQW뵕9õ¸Má/„¥º^HÜ(c†grNn3”wFŠ“O©@ºJk’Ñvß œ¥L f;ÓL¶I $°0lÀOnR\|'EÑÐÉ‚D×y,±Œ&îkä9;xæ>g½PçkÂB[:0“r) VËȄ˼X=§ty0£¡K²õNàÄXX$Wð».‚îj<ßsÙž RkýéXh€·‡KÎX(ÑFL4]R˜Ãû ÛÒ-ý‰…X6]ËX¨tN~P“ƒ–þ ‡I—)@0¸6°  u]Ñžx½°{,4:H/h{IvÚAë Sw‰©2jwÑ Â¯©aàëÁ]VIÔÉd¾¸4ßm ê‚DrS³…¬~6ê·¤©ÖÀÂ7ªp|O©d,Ì»XSG",,‹(ó”ïŒ@ŒÜFâÞ°‘ŽkA’o#íW«’q½PÌ`3ïpÚH~÷$œ× 1š[4‚€ÂX’O mš)“1]Aå¼¾ošËdÛHÓr±‘Zz -"A‰`§bj¦ Úî9N`éæ/<½´F7îŸÄøh–Ý­v'ɺè…ÄN:öÛ!€…!¹È&ß¹‰;­Šå ‡Y¶UVVé+r¡DÐ › cÑå&ˆ¹v1aa—Eßz¡ÌG<ÓÙ½^ˆÈá;—%RÁªr¿7i¥Ž;òõZxg,6úÈwrsÑ^pèÉÝnL’¨ Y»~b|ç‚Éjó3ÖûsõBñ&!±6ú7±’d ó6Uz…+½Ì$Ûôª|ÿ‘ËœmÀ}æ_Bö0rug¸´'qœŒž§)ÕASS|„tÒDÑ9scdá:Úa/]iÃqp…ÀtvPnÎì g|¡¡"˜YÈF"w·žé”›­&)Ïèªt>DL}=Õ»6tô*‘RO#½½‘ñbÐ<µ¢«´Žl/üÊEHCòZ抟S­³®xËñgñÁ¿‡…ŠduG±â4ú¸÷WZñ?—gÌi.lôF¤~®íRÏ» ú³ZfÅäùœô+>æÀæ½èÔõ‘ªø:צðßÆgÂ÷úRõTõœ…)¶“¨õºÖñõªqß{‹¸ÒÑe®ãJ[´¦…«ý|œ….Ù͊ץǽû±XHŒ}“4'Á?Š…—r2÷“`mò´>|zÕöªLôÿ]òDZ©y~*î]ÕT-xrâÇú JØïdð!,¬/›°‡Í½ð4¼õA6ÒöW° a!ÖÏ·l—kuzä'u~®¿ð»·sÃÂÿî÷¢—X°°Ç¿ÁO]Ô÷>Þ}À{œ–_WϦןyF»p½sànXxþÕåÖ»ð†…Ûr†KnX¸aá¶|š^÷®Û}jrI_»Q]Öv › e#.Ã×¢mÁWžç)ø+ûÆñ„¯ú¨çîÁ‰÷Ô§èØw‹ð­ãÈÆÊ_}U -ŸåDñÙ8ª æë5êöî6ù†&þ™ÑÝmw'î»ëÙîݱš÷.¸aᆅ_"˜¯ñj‰9þù _ÏNÈ<£Ã>™oÀåeçã¯üþSNä_¡ä݉¹}½¸Í¼³Oø½K³Œø+Ëéa®mûbs¶àÎMÜÖXð·Égkù6ÓëÙ|ËœœÏÆJìõlwwœî—‹Ý°pÃÂc,ìw"ë±°<‚²öi,˜+ª§±Ð=‰…æI,ø³ñ5R@{w6¾†ºÙÇX°÷°pïÄ¥¾óŽcaoX¸ù ¿ÃÂYM7à.Oê…æÅzá%X8î°p_/ÜaáW½?©~‹…Æ~,F‹ÛòûÅ.Ÿ……ã‘´üŸÔßaa5¯ÃBø<½pÏFú_½ð,,„_ DzïâöÏoÿÙ“OÅBg9EvÂW_9[0l^ôèÛ©°ÒËéÆ_ÇSzéërŠ¬¹d^,øêg%>[ïõ¾&wgc ¿à¯^/ðÙNézZÜÝfÉ·_Îfýmfæzâèîlý县nËG.ÏÃÂA°dÅi…:)þZUæ)úJx‚*þÊûÖüõä©Â÷ eÕå«»÷g»ûJ‹º;N=:±Kï¾Ò ×piqw6ܦÿªînS¥w_ißâ—_ïø†…¿³Äã4nß ÿÞòÕ° )~´|a¾njý ¿Ñ„MNËñe°@¦àˆ) Á ·å-zá‡`!.™Œê†…Ûòj,Ô¡þ²vöË~ÈüG(ÔÅ -<©² -…h9Sf«µú|,l-½ºIð'úÎÝú#~w=þ Gg­ÎQ=ÁNŸ¸Xcô"ILJø³±0ÝÍ$Ü–ÏÂBÿó±ph3„Âæ— ÷N¸Øˆe錬Ül§r²ógcáÞüÂ?² äZUꆅÅž2·k·z‚IÆ‚y‘͘ÜܵvûXø—ô‚Ÿ•ËnXøH,~ÔµÚ;,à[¬K§1zL_ Û?„…¯7×ö`!²—ßØ?Ò ‡iÜnš¿k™Ül¤¾ 2s©Á¾ï/´A”Ó»UZ»gê³±ó<é ? iù¯*ƒÇB~ÅÂ=‰.Y9¨|7vrñQêó°ðï-? ÿßo16í‡c!ñ)Ī¸`aßÁñ%ÇÚ Í6h/5X7,|ÌuÝÒ}zç'bA}ֳ̱O¡—Ýé;Ã6AÛ-Wë0Z¦©¿aá-Ÿ…( ¹I^æ$c*)sîφL™‡½>±°…!ÖiT5áö—±àvβŸMì4ê[6ÛÞµ XKW‘@ú½±P…ûÒS=¼AÚdnk‡ah™‰?ïöá7³§ñ^‹F±äôÀ’§IõÔ¯YÃ;ó2U7,@ÊŒÔZ÷ î•(™4¢v‘¡µ«S•Lø ¤5&q‘¦5ïA¥÷G,vúÕ(¡%—Y˜ÃÝ‘æï¶ô«> ÕºÑò "µƒž¬°"¾4=&%—YH“1 ¹N“|Zõ?%0ñŠyÓ  ¤Ws­‚ iÔMaÚØä»9¸ pá±À/¦0ILk1ÿm,¸8º$ÊoyÄYz÷4ùšGóõ½ïüÂê#/ô,ïé”%f‹˜< Ü/I‡9¢vkT“±ºfvØœÊÊ„þ -¶<)¢4g»¨hÊ,½bAHßî}p“ئòæ,4÷âl¡)S”Má-a4(£“U«‚"¤µñ¨³çÑ„Öè¬êŸŠ…cVDo´owM:{¤Ñ¸w9)n2…V9!I¼½†v”lz|Šñ¯cá3—÷wn-ÿÐ6*äBXˆyDßV;Çw¨ -I&jNTB{$»5¡[Èv],ÉÈÊÐ0§­¥Ý/XˆMxñ -F2xaèÂÂ5‘ß/wÒê §ó’a› -£éüdQÉ\×™VFªÞXù<#)§jü\,ˆ×¤‰Ñ]‰§ŠÐ==ºišÆ¶jÙz£¢º ðyÂ{~>Ò¢/:ì¾^(ê¸è4:³˜1»øÈ£®Ü@†ü.b²R‘‹ÕL'6rZG[n;UÐÈ´è‚àÔ ý%5Ó`–Y´6Rõ®éLÊ-’vè½ÃT‡n —7j%M´e„Û94Ejô3' üüB¼ÇäÀR‰r•ž¨ð*BXߥ>¦º¢m[ª“€õ‹m¤&™ÑÞEû¥ûük±Æ_ - ÿ¯:ù ¤˜ƒ#Ç9y?ggp~Ôd©Òà$dÅf)Þºå¡ |Ž9ø}áþ"œ:ÆB£<3鶜¼ªÕƒŠ‚¿ —ÊUJ¡ØÚ*0« x•­|¾¿ðñ°“gL<ÚrÃãKŠÞU£¦Qi¥7Àþ‚‚ŽL½J/Ô¤âGzŸ½Ù'³¿ ꪽŸ‡…f™¦eüÿ!u4Oa¡[–éü%EiH »eŒF_á0%b|‰“„ -av¥`@ÛÆ` åÝ× í¤ÝHžƒÒY£,Ö9ú7)ë…ÒÚ%¢ÁÎ󪄅¡¤FÃ]¼a‡{=¬¥“z¢ÁnÁŸ ¢€!êg:}Æ‘2+vZ½Î_4öä&é#éÔ°P™¯‚…ç.¥Ï.Oæ¸g¶EÙû €Gî±cÐZf§iN@36ûp…Ö´fÌÙiËÁ;FX­ìrÔý…ÑpLUÉ<3 ®˜¥>ŽuÆ6©—ãZÏ prñžé.üt,Tå6aV½Ř&S¥@ûgX¦ßJç=jÎèeÀ«¶6…Åób,Œx·YdçK_Êç`aë£1ò4ˆä¦¬\œ—tS*Øšèëca3<ïZ¥LßuÐÿ¯É‡-É0tιùõ8&ØèäèÛ½Ë ئBŽ§T½ÌFJ„Ø…ˆ~*>h©eé3›&keôl, Úؾ±RÛÌ¥ÒHÒñÂj’úJZ Q“¯·À~o ç»îëx$Ù¼b!²SQWö¦ÛIzyoô/ QÒΫœ× ôæ»…¿ÏöŠ…Àv[ædgXp°È2[$éÙµh9¿q”©+uuÁ‚è©.¤¾JÆ¿‘³-ÉÞåÜ¢äûx.Z®+J’ ÄWF]Ã1œI@B³ÖFÛ7ÀB%­Ö–aÀÜŽÃý¤ô–<çk­Xotg@ε4‹‘Š$½^èÈ€ZvIÊæ2ùØfš\y®­Ö Fp}¬Ñ ¹ƒ±¶IiwAãɪõN/A_° w­+£YoX€ã–‡ e4ÍÝ™ûä*eUâÍš>yC¾9QQ‹¹§äùz¡vUC‚9HòÛ£ZU¤ûD¹‰µ?Ó_ˆÓô½øþ~¹wÞÊÞÆ®ƒ÷íÕ,‰–}¼>÷uÚËÚ…dTÕeãú%‡•:WtR-=HtòÜ©vŸS²ËËaÛÜù|¤Æ.{Ü÷$Xö«rw^³Mè)RÒ XK—è ›ðši»aæ·5VÃ,}+¯£•¹„­{m˜¦¹´F¿þÊÒ$ÕN¦©IÒÐBÏÁ (n&¸€•¶2L =9”BJ^uö™XÕ߸Þ9Ñ_­éS±Ù}­{IæGbÛ¸OZÇÌäñî#m©îTN -70òÕd% ܽâZ÷,ĈÚ?qe‚Z Lês±ðíësÃÂ}å\–•|Òßbío3<½ðÆ0x,ƒ[ÄsŠþGJ3° ßÜ‹°CôHZˆbº õñWÀÂûëõ§¨NãßgïþÇ%X^è%bßwñCky‚3àLŽBÉÁ„€Ï]™Üç#È:Áð!NÁx=~y«ÏÄBc*whé&R^½ b²ÝrøºÇŸ©~éïŠ;ñk¤Ëäu8W‘ªÅ_Œ÷?Z~ôüÂ]]1N´Á)«É…>sÙ„9àª:'_[â¦^…ÍèQJ­6­³ƒO6OµîŒP_B/¼EÖ=ÆÂ|—Ò]®/­¡ñ¡»aá}~¦?צiÒ"=k£í-¥¾tI’á»$| \˜¸8P/ÅB=Ôw{r´¤Ñ"£ É£hS§Êþ3±À=m—êdp|„…ë5[ý¡U8? °PÚ³#R?êK{½åÌùB!JE£ºPò Ažç¯ðºJñb½ðIËçÖ;÷¡ëóH`’¿d¡¢0tÅ E™ÒèÅzaåž¹MعÂ8– Ñ(·…Q‹iŽ^®Ž¹(¡ªÉ1ðüjÁòÊ¥÷•/^[;lz‰é{ãÀ¼âZyó$N’íª;Iïf1£0kdÌ „™v;œ6R¬å$l´iÓm4H…v_h[`uGk]ò·[dËÍÁ8¹Ý(jA -9Z Ý«ò:‚CüƒQHÓŽ½ uAðraé…iëº"{-ªØåÑ?…Ìfî0­2¹K÷6R€¹Nz½ 2½q]I«UMX@kc·€†0d[ÄÅ_*ú«ýò3±àfžQ[õî&°ýl7/¸µX¨áAÂûL(IÞ2Wh3¹Öv»ç{y9 -±¾KÑWÇBCzl9:-3øÓNbèª~×ÀBnRÈ""¿PËSñ¨[èñù1Oè'b¡¶kKˆè™[q¶ü‰Ì˜ƒŒEì„™-„‡C/¹~Se²‘6à`ðß‹±€Šº¢ú:Xø[ƒ$l$<"9¹H[3ÄÀ‚K„ÕF_ü…\ZmO½ÐpI‰’ïWrøobÁÅ3=a–Ê~7F^r±s­;šFäøî4:á>¥îÞ$‰­ðwŸ±;± ’2Øz01!#[EqÆœ•´:«]*u|o6øøaºn—úxTÙçÆ‘ZMƳx§çR]ÃÅæùnG`!°äæb#Ù=‹ÉjõzÅ:ÈO}·Rô îÞÄ¥ºGqpor³Žý*~Û ˆLy¼ãÂ?žX¬Ô`ÅF’³~èNkËÅ,e‚Æ¿x²(\W¨aßg®·%Ù’öŒ> k~6Jä¨ðˆF ,”xr»ñ6RÜ ?aÁ@/(¤¹®&¸é…o³^`,læ^ž*f¾3Û¹’ÞchŽÊÊtMXÉ3¨ROLDÇŒ\!IcáB~ckWeDzIùL,l ÚcÁtÕ*òÕÖÐqh/zžA:ÛÁ…6‹ÉwÞe_í‚S/¬ó_Š©#–þÁBýÌ‚€×hÒ \ð›ùNƒ"·Rë6Fåí8Á‡ïvNõîsÚ…ða°€I¿šþ‡j±E|:Š¿‚Tš‘Tƒ1M‚ôBnÂêÂP+ùû¾»MÛ@4 æCâc„4ÒœÉßjœýoõ_Pú93˪}M<©Ô‘’b[¥¸Gb¡Ÿ÷ØW½OLšZJ'¸ä]ø4¦£\4© {„Ö*À}NòÓ±ðþzAÅNa*3¦›(²Ãζ¹8‰”KmQiíÒ$àϪg VI|²©á¨%¸aá\i„ªÿwÙ^3ÕF²lT¯i ÛžÀ‚¨qOPÆKXPBO\ò,ôFï¥¸ê… Ìgc¡”BˆýC[/[¶®ºaËÑÇܹêù}¦ýU‰×7#V+˜4Uoê²Êù=+è…á²#yÏ ÿ•ßã<­+ð˜W)áá¢(zPûÏ6Ò¾×׎ 0ÈìY/`f£&erêäÊ¢|úÓõ—]ª¿U±ùÍ°Pr•Z,Íão¢í…ž:ž¬•;vk—Øåûn7Òª+™1HG%IaíáÑÛJñ`¬\]ŠÓŠBIkÞN$øÐw¹î6¯N,4 J$X@E{b¶!bÔÇÇß uíŠàOÎÖv•ãÕWÙªˆÙd]‘ü.ŽïrÖ×Z﬎9C¹Æò]8$Û®»9jmÂŒDi5Ë6œ8ƒÉÓ¹]G‰YÀ˜:ö­É¹ŸÌ´ “™&ï1 [ŒV†!IkkËUÈ46&ÏÍ N‡ê°àk´îÈ ÔÝ]qú ±0‹Ñ)W©&$mÇÆ&ûè+ÚG—šïˆ…&Á¯ûƒ@Ë‹šû*[Õ‘Ïœò¬½ýsu÷=:íé•!…àá*ó¨\¥Žãø­‘õÂäpLèPG9j’•úBø˜Â -ɦÀ2ÇP Þ)N;Š¼÷7K4éK¶9F샄òˆUà|Ç û¥O´ý µ‹†méP¿·±Ká•aMšhÇöƒP¶/k?¤.[‚<áúõ¦vªÜ|±ûwÂBAJº”¿&5ÙKã3¨‰ŒÃÐ+ jJîuùç ˜wÀÂ,Ýíßk÷ò÷±à“çÄèð9èZÈ° }ܦ÷ê#ü½é1³Ø9 oÿaÏFˆZ·›ðµMO áü<1ÒÛËÒ”\HF&ËúR,¬O8 ùDr¯g÷¥–×aAÅn=ȳZ½W¶^½2wõÊ@VJµzëgíÓÓ-»0Î sÁB(i=)I‰!‚ÑsOòKV1X¯Ç=°^ h¨§F¨™nàâ -VýqΘ*TˆÖ|yEgaåîQ*ÝCêò7ýŽ­²ù7Æ‚ï×±/,´À‚A’íX;ŸÍÃϘg»"D°#‹­œ7ZKÞsVº\y­ÌzSñ8F¯£÷«ruÚè/ÆBÿD¡ôÅ_óî‰Àdýõ±€Zžn¹+äÈwr´È†„.e¯, ÉÓdN¯L kËF’ãF:úÜP%ä‹-þç&²¿ÄñF `räsdSÛ žxrš…ÕëÄ>üÁõ‰™Á´GçœôBJ7pƸ°OKÖÓ®ÒõF¶Ün ý\pSLw*,!Q Ñ ÷€)-Y©ù·Ö Í© JLä­U•GüðUô}m<§š«ÕÁXt$~iL¾óFr[×½ÔczW©ôYz!ÉÊ}­K!@¨ QÆõd÷ˆl9N…Q7Üór©ŸÈˆo|bwôøe0ûÏÁÂãŒÜŠ¨³2@|§£ÌL`>{8j§W–¡ö†vÉBÝuH‰)iOW@ù8–Ü‘KÇl «Y¹ö£´ü&;;'Út‘Ô4¨uë`3BI–:§AFØ ,LtvÃêVÉekO&â\à \sR÷³«Ž„AèwÚX9G üß9ie/¿µ^`ú̓ám$ŽÎ81y•1Â+8P£™C“Ù´Oîg$Ö§¿02­ôkIRÓH *ôU/läØÉF³t4@&f_è*;‰H¥å¤iÀÒôë;,<™æ´Êãnt|`‡èæ‹a¡¸‡…€{ðÄ:ãÐpn‹†V)L”ŸŠ-ÀBµÞFB&êH£zb6†C…Þöëö”G }‘Úb1V½p!šqÉ} -qb²y|Òãý)*Dcý½±ðØä¸$\ó&uÆ!Ä>îö|jíÝ*õhÎè÷X€Ÿ×w XŒÉ¸µ¢GÉB­¹Í¢ÎvÂ7É(‘̽:´$9Pÿ­®HßpsÝžD>OÄ—Å=, :ã†^ôBŒ:44ñý˜*¹e•™*Èäo°€Q Ö³ÂÐœhå‡míîc!2Té…â¢zu\°ïŒqÉcTáâÆxÂÍz¡b£z¡¾ê…‚1AëPä[ÇUýôÂXÐ&Õ²¬Zfœ™‰Q¾c¦b]‹8~À˜Ñ›Ò¡¡XC‡æ¦ç~£ÈÀÈ1ñ\ËÓJ.Ÿˆ…ºV÷+>®z¡Öy -“¨4)ô‹÷™µ‚µ× %{£y iLR[ø‰öΓÒ×ôÌ›œ—½¶°Åȵ@äµµ÷:9ýîãs¸“ìܸ-£æLxÌÁÊZmÂ!•–üÆü…ˆýIÌ7EÅþ§aa ϨM‘‡h G¬xשBQTç¶ä"E%QÄ9L´qÅNýkË1|1=údU“³ß%^ʺ͞£à&pÀ‹ŽaÙœz{¤]0c&púš¿Óðüuó MO!'¯,„sbdní@þ—òq>@êbÓ’Ï•Ð0¡ŒÓ÷°0ã ¾È01”™¶D”©ÓYwRßÙH[ .ÙØ6Ô›"g½mÑä*÷]£k)³–°IÛ&,èUîƒíø´ºE%n°5e½ÃŸÄìþ’ÿG"³Ž3u~6mýXš`{'wÖÿà IlG¾M€½hÿÆ‚ÝßþÇÞu(ƪQPPPì+þÿ_¾ÔmÙdÝ’Mî‹Ü²tugC•Ø½`jû¥AÞà¬DìÁ®4•¥V£©d`Bé˜0Ù€ k-6ƒ/4'\ãΗ,ÔÒçáâÐ-qÛ]nŠßƒ®¦Ì»)©½É¯À8ó§`Àfûk¾˜"óàJ&m8BänÞ¡Y6ek¦¼ß¦˜w‘aÙA°S$,U¨áàz.á:-\ãAM”Ì p#ÁÓ¶‡Ãƒ1èOQW÷` -ÂHÈ(CˆK¨átбÁs{€¸µj4ëIdkíI\ÒÛÔ©G¾­²ïÿ_°,|P?F ÑzÅVHÒŽë…Xs›‹$y™«A»ŽÖ@­Ê–2õ\'’/üHH·­Ñ<ƒa )Å î2i`ªdâ6†Y1À€¯¹Ý° I¡mQ/V,`Vw©~.B=þUîÄÐÂM¿°»ÖN‹•—°«2xX€ë_öxÐÅÖ›¿ -<Õ‘ì„Û™PÙW9s,&0ÏŽXhÌó•û¿ÀêGXG»Û9™/ð„•š@Gt Da¾`þ=»ilÃBДe“É K•î&ÿ³Xèæh=è±vGªcÕ¯þ‚pƒ¼Ö´ÁÁ(u„bRaæö ä¹Ò_`!@øq‡v‚š7,Ce>Ç„;Eó¦d¿'¾ðo4ÙU‹±?‹»w*|8o€rºÛ¹ÊÊË Ç-ËGÛw¯ªý ºÌÊ—$ª|…Ic“38˜7Cc™ `þ¼î †iþMkÜÿȾ<ø SøÓÿëX@üd÷#Nlg\U#jëT•Á]²Ãógª†Øä±Ùßá¯X6ðUFÕþè=ÿÙ:¿·ýOâ 6ï1+/Ð9I‰±šKçÄÆs¬ïAÙ„¦‹ð^££ßЖ˜u$v`ú,PÎþ,ô;þ9^@·AÄW^`ÚÕ5®oóƒ0‚뮙سµ ñ)-æWRÓ‰½ðÝX˜ªóÒ4ñÕ5£û£XÀ|\!v^øç°axs8Ø SfWA ½«Aá±àZ?Ò‰˜‘‘¼ ?s–^ß}Uñî'±à3Æ$›v,ükX·ÙÛéÌ èž)#ë‡ñŒÈƒËÜ+tÀ€Îê%>½úTOâ÷aFɹcéªë²m~ ¯a -‚1ÿ~FAlö¶[/¥¬vÀ…ÎG,´½ê¾>ßn–/z­}’òŽ tʪ·`ÁN»Éº.XÚ¤u qr(ùD¿ICÙ±p½É¢+Š‚ýóXøÄ?ØÀ×ÂûWÞzñä/±’yù0n”Ñ/¨Á.̆\¯)M>w,üŸÚŸ©³}Ÿ½`—ã¹F»Ö>®öt9e†¨lÝlhv,ìXø Xè'Â[(FÚï1IÊÑIdºµäÓ×Ùö²(Šœ5;¾ ©-£Úز?žh”ŽÓè.Éå÷ìoüÎÁرð/bݪ¢)0²ë -\ò‰Ë†Ç a€KY°eúDZð—â }@S;ÞvÊ ©Q¸[àœX•/¼Ðü<ö¸óŽ…·ð‚Ï«s³íw˜ka‘ ¾Ø ¿`/’=î¼cá=¼ ª©Ôž‹~$"¨+°ðÏÐ7šN)–eü¦úv^رð‹°@æ=Ë€üÖèp…?Aþ3=Ø-%23NìGã EàyçïXرð4š/°€Û’¡<âŠÜH øVŽÎļXפPñ=³²jZ­FmzÿÖ?'e8»ôžŽ'‰ý=ýN¨6ÑKÞ‹…êObAµ|xd‹½ìÄÚ~ŠÔýÐ湧VÜ»¯#}´ã1•ÑÛÚç,ù¨‹lj¾O+t‰(“?ˆ…)7-V>ÁBÌ¿éJ fx¤[eh±µu©9\qôÝ“jv© ºÍƒ“#z›:v®yëÎÔ˜;•¤ÿ è\~àÞÖ»‡™£ÿ®Ãñ¿Ð>Ä.°àgCàa½ó¡.îâ…$BÚ}ê®ðSüÒÁ¡XŒ8¿V¡Ð¿ ‰ÿG±ð¯·ùHXô &ÖâŠFò/ÔØc˜B3ð+{Á %v$X4‡\YqsÎ ÝXð™„?¿É‹¼cáŸà…À¸“ XàÎäóè^À­“ -°ÞqkÒÞÁ ¸/k/ø„;” í×¼ á…Pkñ­µ…w,üÓXè?Âͥ%ÍÄI%K“ •ðs^À{°^U.\»ñæEÇÏyw¿ÂE¸­ð®u|Þ^p>ºYw,ìí¶ŽdóC† - š-PÁÏwîýœl¥Ó kô‘Mç¢ÜÆ 6{·äS'Œh¤OÄyÇçí…oµ½ ÉÞÞÞ&šB;õ8]`¡ž±0u7QŸçC´ì¶ó¸/J‰©ú|œm¼Paè{«t0ƒ__t|Þ^X±ð“Wý’šïí'9¿çX¨a–öy3á¾—­H¶Û ¶Âø@’’Ú}‰·Û ¸pʹ-¶¹ìùùZ{aÆ‚øÉKÜÀ‚ÏEÛæûŸ7ÿöp“-ܨw>#Ã~¤N7 äù„»æT<ÙîGb¢õC&Bü©ü¾{Þ^(ʬ©ëŸ“µv¸ŒÏ~Äh¢’íÞÿ'ù S¤5jì¡âJû‹øB`4ôàæŒWœ6_Ä\<"±;‡šô{â þO^nŸnÀBÅƽ½»)¥ü/°à'E q A9Ýt/øSÈzÀŽÑ•XÛç¼à'} Ð}ÕEÙ•ŽÏÛ xôþ'¯¸{ ÉŽ…Ÿh]Q¨X&Ÿa!M%égbö9/„MR|š÷9/P~²äoú†øÂ?€…~¢Å-îé(ÆÏí^ ®¶aá”zèÈ?ß¹ú {‹Š.ä/ÉGb£Úyao—XÈ?‹/ø©õáÐœW‹3Ç 7ñ‚ŸÚ[[´|Í`*Âd/V'êj¾f0õ 7=o/ø¾w}¿óÂÞ®báJÜ™‰K‹·â›xéìâ[ÎÇ(®ò¿ì|\ˆý¼½ -Á…ãöv Wò‘ä,Po/0}™·Ô{ÛxáÆ€}W|Á‘[.îâ+­Nÿ+¬Ð?¿Šá³UÕRÖC¤v^øòBRP‹Ÿºþ²/c¶.sïÙ¹xôÆë¼ÐѱP¾/×ÕÞ˜s7wìçŽy¡wA,îsrD¹±e>Ò,(•æy+åfÈy¹2(Ë2K •Økó²ŸÅ_yðv¹ñÇv^øw\ª!ÜÛ(ºÌÁ‹z,ŒÜÞO$ÂP¨‡ÅþJ°´,õgììÿc|£E1å-î#ćO êN <”×x!3š‹hòs°ä©í8 –ãáˆÆ9lÿ—å#mÀ‚êt,ä=‹ JèD WÇÎi,që3#Š™0Êy]usÕµTí¼ðÏ»ksŒ7ãM„÷=ìÖ-®Á^ðL¤RC]íHCo—¼èPÖÆ™jQŒ·QݧD¸éé<¢¥ù’¨Žd2ÒhWµÂÁšgÂsµ’ºR¡öðó 3¿*ibø%}™,™±Ðjã¹nÀÅHuÛõέô³FàêÀ\ã×b«9)Ô«bOÓxU±”ŠÕÎ ¿¼}Œµavj¡=†‹p\ÝSÝaò6`c`~Im*®J¸ÄB123”tèU€Bï $¦Œ'kŠÓ8pUÂ%/ Üð®‘íÌR -5ó4sÀ–ñ³bί^a/¸mÝæ¹wÓvVT—¾RŒé,XȦZ÷2öCÝIå—ÂjI€tB.U  -¥”v1¢ÀᆨTu½Gw^ø×° Dâ´lH> À"E!,,eò‰Î‡\Xà5vt:è˜&Ř@x¡&ó=ØØâ’ln8Ø šcGñ´œ;N;âÖ“¯‰/Èø¶+3D@Âc§¼ÐÃŒ×5YÌâÎ^«°àøž½*’(‰:íà…#1„ã0Ê[C0®±ó¯5®ä`øhfÜóÌжmÕúƒFXà僩µu>bSø|îPIhµ;edÅxÁîÌ=1ÍÛ6¯3ÿ/,XH4™;FBòT.¹æ'³å#mò!±V[‹”ž3^©¯tç†W®”+Š¢ó8tàœÒAÈHxEÎGG§c¤Ó:Fd¡Úyá·¾ëä™É€::7 -4 ‰».bl¡æ³È¦!Á}¶qÉð%ð¦;úXfŸclx¡±»‡È“dí»s7pñˆÉ¤„£{ä… -ó½À½KïËG’¹XÜDòÈ •á„SŪo´1¤P1zYKÜшPö%¦š •‰ÎïBåê"æ9\ -upr·~³é\_îïŒXÈA‹ Q7ÊÐÓ ×ðPêxR:r„œbä€K?Ö@Ã…E;o' ÒÎû1ÜéÔÖHC@\òóÃ1/œ¢™2臈©¡¨uÍgѼ(iSð‚Å‚’'¼Pṃ¦±ìÂÚØæŒKí¤¹ ý^ù´!BŒ®6C*Ñvî´È–öj®ï¼ð´*³úªñaý7ë8ø϶õã‹­ñ…‹ŒN“—Çg&o­ åƵX‚W\øJ`ÎP÷‘”ീ[š¡Fí~*ñ ÷1ËHpÌRª8îSwÉ >~=C*MvL #€Ž¨˜="}‰½lãÖô˜Æ^3¦ÆW©C€iœÂ#sLÑb¨²á`<Ÿ5Fç¹è¤ ï瀅¢3LÜ)tº ;/|«,Æ®ŸÞðØwãØujÖqðåÜV¥Ç6Ðs;Óœ˜£ncn ÿ ®w-oáý¾æö~ˆ/Àç!–ÿ Ï0 ]dþ¼ÏõXñº·ŸçôZ|FtRœ;p[®¹/ñÛpظ9‘¾$¾psûíŒØ‹wý\wTrŒ)œsm:;Í°JÀ£tµ×QJe#úQz¦ö]SöI*º®`] ¶.zÝLÀ!#½ ;/|…‚žæ8MÉʤ~„~·è»JÍäjö~ØW:UN§¶báÓ:7ÚO×ÍûÞøÑTÊÀT²Ã«ÖP¿ÖóECÓ¨8® -ÀdhÞšVp—(–Å¿~ÎUBÁ^Ði¼óÂóM¶µÄü4Q’‰[¸ñ`ê)Óe–eåâ¥(£^—E -¦ßÜ -Ö¸¾óµŽô îè?Š…7æ#ŮЄÞ©83,æF2ä…ùB¶ö­rµi»fë "Zwž±¹îæ$WóVˆ¾0;/¼‚z°@ë ˆ:Ð ]÷ $› -݂Ū˜”l™vXêžI-X˜ÿõèQUg5§#TZWMYÊëXðçÝ\Üö¶[²ÛڻŠcfo. ]Çúkûh´[çFQ·…ûÒ-ì,(~íú…íùH1­9/;Œ§ƒ÷°ZSƈˆa™êã ³ï9òÑІʈ–*å”Á[-»ÆU¯à;³½Â•þÂ5¯9§m´b-C͉Yɵå…^Q¨8EGM†R´–ãTJ¹Â iVCÐÒÜá¢Æ("•Ê#îúå^²/Ö;SCðÃÚJ†znæô /yá‚ÿiÔår×[Áò9a'ÝÀ nX§¡ ØУ°‰M¯¯´)OUÉ5B.Ïbvü,—ðL4óÉÆ8†ï10%bLk…oÄc,á­^­i¬Ïð‚Mðè×<å˜ØäÇWóÓ¥ÆÑö{vÅf:ëu’\>”ÉžÓx8§³!ÖãÛlŸo^¼ßôùÈ¡e@‘¦±"•žyA×¼ÎÎ9b¡@‹yuŽH±P :Ãô Y“BƒÒ¤+FO[ ƒÚÖW9‡Š0DP+ËEW4èþ×¾熽àá7pK®w§pM8EQôÃQûœ@ú!œp†+Éó—Ú '`<ñÆouá©í.¼•9NG9õƒ<Ì 0Õhø“¼,VÉËê -þdý‡WQmŸÛ?eÐÐi‹ƒð¡r¥ºÔ@Êc§ªÊ¼î D‘ý vN{É~Ž ë9xùS§0'_¾]ƒÁ§'ïVeJox|ÔÈK‡Úãs…·òBY‘¸ç!ba6—©,®$òÂÈbZôÕÕS€)?Ô¦öºíÍ M¡i4(>ÛÎ`,Çf¬¼` @Æcª]{Ú# ƒÃ½*N¡ï{æûױЈ þS­'ãƒÿ±`ö§~¤ÈÌ;2öº"‹ŠSŸì´ö9/ø@@á -E|âåÚ}u}¤;ê`È&g…½û('iRë‡Øz·sæÀ4-…<ËjSeå1ö$>zP•åy)Lu´s^Èø€S!€ƒ+ƒ|‰Ӯ߈‡£d¯ç^#þÂ;± ÝøK, / -rÀƒÎ83/T>¯òF.¶³ýžEá /ô˜BCj†¡"L ¤À4û3Ÿj%8äzÍyžÁ]‰VÛ¹†7ª­ñ°ºÏA1Û[â +|N| ¡³šØ/ÉGÚÎ k)\?0¶Æ8lÓèÂaS׃ïès\e_®î;÷cl¬O=Å 2Ô—RSÊ{xÁˆî€MÚUÝ:3œ®aÁ,²‰î|s®$­ÇƒáVõ©{NG²‘_Þk/¸ -l”±[y¡šJàîØb!f¸2,zŸðB¬X%„+ Óø`/¨JH–4ù© |_PºSJØÎE‘jg®4¼‰ÚU‚Õ²‘ß™†ô¥iÁB’Ï<Â@Ïê^l/°Í9*2…¤‚€¬É<“©E^à‹ãÌEÀBwšñ‚w)Û2U…U-xe#D‹«äæ`Äc¼p”mMøQ¸oò†š†ƒjÇžŸÅReG¶ø€d7œ+-¸’ïBIŠ½e™Ÿ”ý"Ô»2¬À(+ê(˪O¼W_@[‹ÖšAì…* WÊÚ ¶.j³¦Uμà€yÆû˜†ºežiiÌäOmˆ;Ûß®—…6Vm_4wÌ©øšã ÜŸÓ´ç%•î¦»x¡6ôðÝð•ö‚wƒ~$Ö‚AuÂ?òH Ž—¾%5Ü[¸€…3ZuJÖ6‚ÈðtÐËL™éVö"ç…xUnêFà+1Üä«>/û×LÎû‹*ÉGÉ[±À±”Á*§ »P‘JÒ:œŒU¼°F+§ÁÕßË1Ei_„jÅ‚ÇT¼ü¯ÇÉ|wa¾â ,ÈÒªþ. MÄ -íø þô¢a®åÈëdì!Å8µlH¹ñd§s© -=h3ô*NÁ°ka¨#1~^L×t‰^G Z±Jmu¨›ý /H1ÀGÙ,ÈÍG i/”vïZ+%ÉÓº}o/€pŠ¡\ó̧›yaÔu“‰râ§Ö\6%›o­eoø¯@/^d\Õˆ ¼á-UtOØ ²]¥Ä\v|ö%Å7yE~ÀÒw^“±dÎP7e–^Å‚õ¸§XXT¤™”ô¼Œ{µ¦q8™ ØNÆàßÏÇ$ÀP ±Õ!:·b!´ºäBeT}•ŽÓ:óÆnõä#úE;ø]§ú¢èàow°‡‹ùäiætü®½U…ç©ôG¯ß¼°LÝ,$h× ¦C,oØ ’@eGeÚ®<@ étç[¼@A#ƒoû˜ú#ùH‹z*áúyù”C¯^¨=ÑSÑY^q*Ë ž]x0{Ã.t6µ$)9(©5ñt†‘ ×8ÒC¼°Jù¢¼ƒÍ>da¡nÛ vZ,V,ØE %U¾r*¯ù‘8úYzP{Ž*RÔž(IÇáò¬ˆ}Ü odÕ‚?²jä+\_ÎÍ~õ€0}bÅ6ÇJÒаñO¡Î‚>‡€O|Œƒ/l¶R`¢†NÙ’ˆÏ4Ò“²aÈóöZF4KšcŠÊ!4*çüjbˆÿµ½@íæâ½MÚfö9ÝÆuÙV^ÈñËÖõ™(¿·>æi3ÄB¨»!ÃM©qQƒn{¦$Èl;ô‡2Ä1ȼs8éD”” ^ÉŠ„ª×úà*|ˆVÕ/÷¶/”%ßæ…^JßYmÕûîHíÆñx5¾ÀÑ¢â8gT$w†D>/K*ôÉp = Ý­‘õ­ C½´6S§X€)zQ«†/Õ×ØãÅ-c¸¢ï>^À,îÔ!]øÐÜ †>‰/„‘ý@–…W5U3çÑš““¡ë¼`3¼AT1ÍÉÏP×éʦ‚Aê`/ø¼L8dÚ¬qÇÿ¡|$+j òBЋ”ýâGÒm2´Uë$qæõ>cŸFQxÀ‚#Àäf%Wp¯I ôÞuOù‘VѪå1Ÿh7Ät襵>L¾çŽYMD/®ß“”ª[9KD¥â‚]T9 ²;†çH‚Kvš¾ÿUÍùߧjÛÇHN¤í^!/„£ï¼0EBxÌú‘FëÂgžµ@Ä@M‘)Ñv`8ù.9Î>ñ=³cOÁº9¾ züÆpîÌâCnºîSÁ‹Šæ -?™K°„ÔÙp‡¨ñ§¼pÚ¸âSn9¼ÏGÔYö¬2a˜Ù³1ðc² ŸÈ"wÑkpÖ£§Ðzþõ  $«[y'©`í­À¯@Ãè¼à»F¨YG².¼ª?x{P¡—9XÓ23­µËjº\ôýÐ<îGRî×XØ_(m9ÌñBúRùu|!Z¢ ÃÖž(IС¾(Û W±@º{*ÝÆj‰ÝÄ6[Ù„lZ³¯l|'3;F†¶5«ÑžùQFéïàßåýí9«‘TÌ›«aRa|¡f=Ïã8üÔœ™{ #á,Ã"x™ XaOu9H§ &E.Ÿà}Ž… i/ «Éèåú,'KÔPð¯+/° «C M/¦ûjÖKp‡;åø^?`8ã]Pp‰mÏ¢ªÜ“]qÑÂå*È{I ÖŽ4TY¨MKWv-Ø¡J¦U)0w[æg—úæ…oÏÁ€‰2”˜Ë¨ºþdyíhÓõ:4Ñ.\x–pX¦ˆXïvzr½>>¤ô=g/,ï÷t´îͼ ×èæX»N{„CÊ°°†‘›ÅËÂæÈ¥TâÌrí:Gt­ÑOy¡Š²¥…'~$½ @è]y“…àNeš©1$%¢ï´n"]û€ÃÂt˜Ü‚ ÇÕtÖ˜Æ ÏZ$Er°Î dˆO±0úlc›“QXP›;úãh²¹cq†…-ýþ™ÍºWÖɲ¬ ‹j‹ß8zïã…EH—ô!å¢Û—WŒäJž*?±‡<ÏëÆ™}<Ê®IP1‹‹`‘Ëä€oÅï¼ ¹:U‘D £éƒGkNÊ"½ˆRÊ î"$ç>ÕtÕµ´wÇ͉Ñ%SN’F~§³Ñ ~ÆB$¤#FÞìEá2MñAÙuMèû%|»` vÜý*ÞøþëODZoï©ObwvìN°°í$?lÈâxsB=^¬k xàÒö(cÇÊ‹dUxOÇ–L æX/f jñ¬¾/åkºu2>älˆ^ÆXÂi†PÑÔí@8fJ¶„h«kXPþ:ˆØÉÀ§Í‹UQÙá‹îW‡$£/yá<à𩲕ǾÌÀ¸ÂÛ4įÐ C¯›xqà\s®fw+“M5‰©ö4%ð+ȤN‚ãñ>ÆitGËNÖ{v÷tŒ‚äÁŽ'Gìm]Â3-Ðmqr󶪥*ü ¢ #í…c² .Ðà"Ÿ£´žóçâÎ.‹;¾ÎÍ«WӾσ‡þ4ÖöÁê°š–Z”S,Ä+z%‡Ué‰?dz/JÒêܲÃG©?çOª“5OǸó!å5»ƒT‰sÝXˆ1]¦³‘e8¨#Å5;–E3"`¡â°ñrA„ÜIÚ©®Ùçqçÿ}»+ú*ÎÜwgu@u©ý&‹¾=»Ö­¡ŸVV:ÍÙŽó’=žä­^Ë8Ž;²Šãšd@ -âØ]8Îu,t«=‡ ¢Œ‹ꈅõ€8Ø_É·ãÇL>Ž§‘¹/xAõ‡vŠ…5c­ã¿Í³aª@Õ–F9`b€Œ]íF iWéÈ-t ¼€%|¬‹ ¾²ò9.—ø˜§ºcá“)(îgGÝê“C‡EÍ0x‹Îþ:¼þoí¡Ô¼ÓÏ¡OÔS]EE“|G;õúÕd úäýkX×,=R¨Ch@Ä–eÒê ‡ÂYŸÆ—O•¤u¸†£üìxŸò‚àkØç˜t †hó­aðýXxY¯›ÑÔ>†|"§BE¢cŠ·¼|ìëŠàâO{Ì4|ˆ—¨–'‹}ãϨ 7>×Bp·Ä: -2¬áÊ¥y¡Îâ8bèã.‚Ðq0 á;GG__GD7ŽÕôÁõ Xå¢Ymܘkï_ÇBì2&ˆ¸²˜ç «Å±UEÊçì ²¦ ¸†ÓçË|6ÄðÜNó‘V‹At›=Þ™N‹Ö»¥ƒè:­O狩Э´› êrSM ð°'^_ɬŽTwgë{–$ÓŽ…[šR­Kø‘j•ºBŸœƒ{xžWG:—ƒÈ"MTir·äÀÄÄ!šŽB·™Æ8ôð¸édN?ŠR¡NôžÓu›ê3,àþ*—³ûµX›EíúxµÃmŒÝ/ž¤Ãœ ñüòižêªî™të½QÝ`4LN0£Ô :ñ8å „ÑÅQ”ùÀ<-<°.—ý -b¡‰Nm½ëÿ÷-µÎìô>,¨« „š&ó“ Øx>pŒXhXâpÊi‚9 L¸©á²Êï|…`ÑåžÕõSu¶/O/ì{ñ±@ŽŸbAuä«ÕÅçXX•–´×§sþ!g68¤ŒŸû^H-•ñ{]IJy.hp²"½×áâ§Ã„ì%7/î<*çÿá¥*(Šbå._A' ½ÈmúcX)ë(½wgÌŽC©vm…fEVq°ÞöH36"W¤¹#ôKÞFFø -†©A}íÆE5}¼†ŠNÔ$Ð×V §òÍç‰þx¸P8âî4L|Yuâ ¥…/îR‡û´ry1qå‡<Õ/° Ï±p,.pƒ´O•:kÁU¶éÐ@¼›Á½„ƒÖ.K2’ºLÔýcX¸k牺Î1XA Ћú#¬?½^(t(ÁÄÑÚêQiÒðI³¿Â$¨¯.ïžÝ¯Q‹!Íëô$W!ÆØ÷Ev«9Xá¨./çX{%Yé.…®Ï*ìÍ_ phåü°Î¡Ê«ߊ•¸–WáÉ9©®:É^Àe°cƒsSa}Zóêðë»ó!™ ±€ÂÞݶ»/jàx…úË:Ò]9'& ±r°­)`8§_x»·‚ê\ª‡°©_x>:ÁÂè,SäSuó¤ì J‹þb NÌÖûÆ÷/ -ê]¾<KõIÝ<¹~sÛv¬ÌxZ?ÏWÐb¼¨§wYcïcÝ憿}j¼3·ÞÞ·£úLž]“öÛû~HÁû„äP#­½øÎ[)òt©£À"A°jgÏ+ŸÏÖX`.n@ „'+SGdŒqvøŠh€¸».MÜ÷_¸£É,ïGå]q‘w -&QÎXPc%DÓ*Õ2+ðÄ܉缰jA7_QF€(7Üc êbÚ¦b8]ÿö1é:îÊã¾ÀÂ}™v·rïé[gÜ9¦^w` ¸ÔUJf¼G‡ÍÍëpM¹‡œK½>.:Œü[Ÿ^áóW°Ôªû̺¶¿Ú°Œp¬H;j]5&ó=ÝFbñ:5º,M‰n,à -<¢».æÄqV1¸ƒˆ2=0Gg‘úV7]h*˜É¤«5©ï½øN^x ñ=Ëœs^¸ íwbavÍaª#ÖÅ“™cµÖÚ>ºïf¿:¸ïÔQi½cíÿÎ '>‹×PõºIBØÀ¥Ø›\“øqX >|  1µ]ʉo±B„É -kÅý)(e· +ýºÚ£¦eÊÖ*>Æ!5ÿ}¼¤ƒS„Xê4wïægÈ:ÇŸh;wóB0÷íëÁI®àè[yá`CÛyÄ.#´kw¾ÀÎyGWí¼ð€’4àœ^t:•¬åŠ7 ÄožÌ &Uõ |[§%½ÐM›ÐS7.…5 Š”‹ì»Pùh/¦ ÂÔ4Ôr.ús\ˆJ˜LîÂBc¡ÉàNÚý’“ ¡ýBóá¢|Øm^€ßƒ}•¹©ßÎ Ëõ -ç²³O6ÃgF¸r϶)Pkxaç…û°êàÐé0,Œ"ÃR8•³Í`ÅV^(q§žŠƒ½€Åû0*È0K$ÄÝl¸-8#j–Ø6µeF~¼Ô›â çX :œzÀîOžç÷ñö•\O5™ì¿{x‰wšžR »T°á…%…[-³þ乌ˆÚâîùY·ÕîGz€ˆAAâX-2ˆYÎq'’•J¬5ÙG^­¨æ±ßGÄd^Û¶´´µ|ž¿ñÝñÙŽéx3B]H†{±C+È$ ,õuç'9ap¦Žî™4ÒêH¸”aç…ïÃC#õåÞ…[ì…<¬µûP>ö-¯«·Ù ú†?•d«HhcÔ+¯ub(œ¹Œ„B^ˆQ­©à'®hýVàâžÂònVGÊÉûµííûí -Ö-ümXH¨•kL‹]DRÑd#/$´_û.òÎ(ÛÊ …í‹u“—Ï}7~?/€’”ƒµfyAP€)@†¥v#î: vBžãž ˜ÀÍÃmNý†Ø¨Nùxí½½ q¼=ÖÆÄ<£'lE@ø1â{ÁÍÒw=^¯éV^ ÍÅq•~" }s³{+*)UÝÑï§ -ÇU}7Æ4}}îwøTÙno©—²óÂ/nÛ± Å¥ÒÌßÈ +N¿·òùP)»)å…"Š²²tZ’x’ƒ=Úd‹ó=^d<\³¯/^ŸÚÊ¡ÍâÉÞyစ¾Ÿ±ÐƒJ•HìåϤÀ -ë“‹øS{AuÌbûÎILþïögõgâ*/ÄEb±  -vÑ·ë’“!¶Çî_ãù‚ðéZ­pç…ß«#mÍÁÈŒ® ~ƒ1î)ÇI8¯<Â& -zr:{ÿ½Ox!Õ&,,}kôUy,Š Cãåd‡p>áO˜7˜‚¡¡ƒí›’QxÚý­?õÄñíqç'¯³Wîë~9<' oCF`XD2í8™R¨½@øJ]iº½‰¨¸b/PSv¬í+œIxà¼pLà‹¡‹°Û^"ïj蘬°/:Vs öB«Ý@78D¨£ïÏGzÚé7Ž;/üj¯ìæ¸3pÊÇ]ì).4*ÀpžaÓ“Øà•¸›9¯¯òBÆ“©yƾX0E¤ôWº³iØUh·zÃåWxÁ“C[ƒÔóÖÏÐwÔÔÞˆæ³ÓxèÆÜ•§ªÔÏM?;/üj,ÜŒ;³‰ãÔ+Ì{2\MSiôÙ)ÜÁ ô‡E­»¥#íí'Z…§ûÖµÝÀ‚û]¼´èŽUz`…ȧÀ„~ÎÙC¼ðËÚŽ…ßÑÚûë`$=&Xb›2½æjoá†N+?–VÇ‘v·`éoä…7ÿ@7Јe–¦lÀÊáýý¼0{+ÙŽ…½]ÅÂ=u0–©O µ69CÅho£½€¥…§<Ç -GSʬñrVmû+^p % #a‚XðÑ#åÚV^Hm™å`ÇÂÞžæ…L‡E®ýØèÀƒ©¸0ußžð¥½óÉ3.ÃÓ¡ViÖ祴¿à–ø|5: æ@É×Ø s|!ܱ°·§y¡Ìp~ÆzQWáÉ4ºÑ^èt…‰¤±ù× ý‹r»)Y±à`| )}À´cao×[PfY™ÝUO•¹in:…¶³«%æcO§•M¿ö#EFŒX†uÑõ gÛýH+‚¹ZŸï;§‡Úyaooq6È3š X葺EþŽ/¸«?vº³‹5£‹’ª›xÁ=nØÉóööcXð9ïqa›ÂüPO³ó±ƒb+/bRYET_lSµ…¼YæC´~‡á~^p[lôßÅBŸ•‘ÿÔ‹ò¦*ð¡yeù´¿ -2>9œ‡·õ»aYºß‰…QÓÔÐØ4v;…È.|N7Ú !:‘j"Š‰ñË®6ð‚ó:ºì¥›ûyá÷µ;±€'Ÿ:`x;¤tEÌÓ×WicèÓ²¸ý<†¹*Äwò‚ ã)-¢pÑë! §•ç¿â… çXØÅo‡­²² îã…Ò6Ï+ø¬†ãªûyá…øi,ôÿ.6ßgrTÑA»'ƒrA¼:emÊ1eÚ¾.6Ú Q¸½•œ|áÞ>¸<³ÜÎ u€Ëv°×àO—>àGúç±Ðµ¼yRGDs/³„?¯#U¼îŸãžó9ñîºÆÕ¿wÆ1wÚéò¯·ñÂ’| Ú¸:?Ü•§êËG÷åù·±0O¿ûÀ¥ -çiR©§Ç¸ç<¢»Ì…öþ:Û·®óí|¤„¶üê -¢yª_O:yÁgØ’ Í_ÆBz¼û± ^ˆ… yªŒozš>àhÛ qsííX¸ Ñ?È `¡ÿN,\±óŠî3yþ~^ø÷ã ;/|'nêH1ÛÚ5é×’)¹Ú7Ö¶ŠÞ|ÜøÏÄw^ø,„uUÕ•¼…±½éóXrxO_qž?êÞ×7Û±°óÂXØvò{ÚùüAÛ;ºÍY8´¿§o^± ;/|7þWÍ°Ñ ;/ìí×µv^ØÛÎ ¿‰pË1¥’] w,üy^ÀÅËvyÍÞv,üq^Ø_ØÛŽ…=îü?l'ÐÜ €œò~,¨?„…=¾ðs¼à¿™Xžî¼ð¿ÆBÿïòBý^^˜âáŽENž·y+w,üCX`OG -Š¦æùAîÃd?ì!†ÿ3¦‚x?€…ð(-O’Þ7Bq×Äá†a˜Î¶¤›ÂóÀF(> íʵÂ>µÜÑÙ§6ãZâ³ÔÞFfŸÚcúÁáiⶣyÉq4›ÈÝã³ÐÒflŸZ]ÍǘG+Ž£Í¿«8ŽfO(ð£ÙÓ+{nÇ32°ù?m;Ãå| ?Æ “¼Kƒ&:l¿¼ Áyr..1àÓy¯Ø£zÞ®ÀŠS6oðdaŸZÕµ×øÔ^_iŸÚR-óŽóÀv‹DnE¶´ý¬P§ö©½­îq¶Vú°Gø´<Ž6/Q¨Ž§iOhÙéùxš}¶£öi…kLUpñúHÝsÔ_ ýa4ø')Ùmï,gãnÿ± ß„…9û Å ÌòËobaFVzyÄÛ†m±~…fúmí‘ZaÝð³äîcºõkj“«áÉѽ' [ˆ|É ã‘Š;xáQ,ÜÅ þ ì8Ú^ø?`¦ö§Àà ݽ]ÊÊÉÏŸCVßy"i¾=ÏóB÷<®ëH¯å…îÄ ÷…¯ÃkT˧};w£Òi·ùV^ø`/è“þ/X£ð)0÷Û Mó0tσáÎÉ6jÔs]o¾>¥³ƒŸºþúÔµûN=>÷ ”.~Ã^OfŸÎžŸ“Ñ®l‡˜7>Töñq4KC¾}:G³ÇHèáó G[VÇÓŒ/§Ùÿ_°0QR¼ Õ‹J2>ií<€Êæ÷M{{!&÷~=çÌ34¨ŸCñ,ª;eÛ¯£]ÐþÏXxDé?·)ïCRg/y2v^•÷1{:°±·_Cÿî-Rì¿ ü9›!©ëûÀ ‡pµÿ3@éjí‰sw*šß¾HÙÉÓôÜS“þßX0<•úÝÅXë¼ - î{Áð´Åþ]ME‘Ãv<°€ã7ƒ!úgm†{CÅð;w£l Ñ·a”þ§RîïŽâ^¤ywO‚!¹×­åýŽ…ÿ3¦(ª{u·ë]’iÞ”tÏ!¿Óx Éo,ùÒ1ÈG,<áº/Ÿ +xÚ¥ksÛÆñ»~…š™NÀŽ 8<ÓOvœØJkGµåig’|€B  ZQò绯;@ˆJ&ã‘y½½½½}üKþù—iäz*»LRßUiz¹Ù_x—;˜y}á ÄZ@ÖÌË›‹çßFñ¥ï¹™—]ÞlG<‘Fêò¦øÁùúÍ‹ë›oÞ¯ÖJ)ÇÏÜÕ:IRçë×+ßùÀ£×ï¯ÞÝ\½{½}çã5Nÿ~•*熮ÞÓ/Þ¾|Á=åz«Ÿn¾»øæÆPjhª2$ó—‹~ò. 8Òwž«²ôòÚžëÃôþèt£PI¿¾øpñƒŠçÂK^µÄ ±†“eAtžs±ï†±2œ ¼ÎEžy!qPúÊ…ãúnl‹Â yá;w%œ=Nœ×]ÞÜüØT?z~¸É‡ +àÛ†GóÍ]U~. ‘¸ñIvp›äúø¸¢>)ZÕ•ú€G˜øb%j͇®×8«O¤JH7è%8?ö‚‹<ÃgÁ õYV‚_Nvƒ:†Ý¹Ôõ+ÙmÎ-£„“À'’íZ\Zí*¼þ¼¶9£®‘ض>h¦Ã²Ð!@Røìr4>î rØ0üƒ‹úwE«ñ¿"ÂŽûtcÍÎ%zv$»²)»|(IÛ”Ä_²š¾ó F£L²)ÿ(nR£(2€^ÑÂΔÙ0ˆÍ?Krç—ªb¼>òk^ÛVâÔp' -ðß½eKi©üRlñJæƒÁP \Q‰–´t¼¼þ'Œ'¡%Åš¢¶A"¸Ó”dKWˈ5.Ùñàguæ—ôGÄže5K4•A3%ýP>vñ(í*@ª×G"o|f1¾;Ð)FI:Š¿{V+mGö<¹—;!Î…Ò`cMpˆQ“ÖâÙ»MÉ{ŽRè䨗Ñn9_zÙ1’¾úöêGœ§|:’€‡žCÃÏ‚Ñ xô +‘á]üŸ)V@‹·#ÊJW#×Ëñ‹ºoŸá}©ÑG‰óŽHºçÎkVhÁIVOµŽT~AëxÉ(„QJŒe©gåCJ¿P"ƒ!¯Þ„lEÙÕ ‚ “º–GY°G‹•“¹3¦&ÃöL‰ùÄK ˆ¹˜<õ‡<κž),¢»€ß“(ï5 +¦Û³-°…¬Gnüj*”ή2D§–˜@»)ï¹F”9/éµjU FcaàÜ% ºý†î`·íúÉ﬌©žà†M×ch©¡7-q‰ç@^d¬!…^P0}ª$qÌ%ÞÏ#14ÇOýË’ $y"8ÔÀëú4"›a<·:¨)›IÝIø@¨ ˆmúf¢@œ%jŠiú\"xõ«†ás…?Ç52‰f9ø3N÷xIŒnBr¦«…Qëj¡—ó3²u©Wßsƒí‡'¦˜xC1ŠV_AúùÓ&•~/K@ÚR”5÷onL.=Qn ü‰BÏ ‚§R ½¶À®}†“ï}k­³)ÍC5¢‹¡<ô'×Ãy½tJâüâæu–éÓI08âØ ø£3øî{[OIìxê¾Ë"Ï2’wOP„]êÆ–}*õdË¿ä n¿ÆÏ ’«!ÿ1W£ + +Ù䜑šüc9ÏÂ5ýƒ¸¹_)N>5¢EÅÇ<‡ÁÒL{‚L1èð*¡Ix¥s©±©¯Yù5bœÒ.÷9 XòG¶ÛQæ&ä’¨QêzÆÅeRlL`ðþq~*^ÊùÊÃ?p^Xpœq)`I¾—ÖPéV%@cR§"§3:\¿âú‚³¯äq,{Þ{SI¾Æ4‘)²Ý¸Ø>9ü‚ÚU¹…p )+SQm)£8ÉqñÇNèpÄ'ÓÞr;ßp¸‹RP¶ã 2ùž?Aeå4<ÉÎ D Ë=%¡sC±”Ä$wvPçySüdT<±í^Çô<_rÃ÷¼¿O dXóf#ÔAÔr&6Q¾›@ÿ¬ÙUVºŽ ¬òز¾(„“áÁ´d¥¬\TQT„æ ¨+!á}à6Y̆Bz ãó +bv ñ-s Ï5[”¤§HŽˆàä<¦zÊH6„;î+®º†u¡p¡j±Òjg²Æ@¦”qÖ^?ÏÝbÑ Û³.Ôå#DH¤ì¬Nï9¬~àž'9†‰5pzJÚ¥¥ÂÁñ`RK`œïOÔ¯¢¨Á—tÍ÷ĘÊâ0^9'”÷ l;¹_åOš9ÙÍâ‘3ÍQ$T$s> ¾¥ˆ0öJ‹ÌüLÊ ¤bQIƒßòIl},‡ð žr¤+É ûó{NùÉÑ›ö*É¢I–MMgÂS˜`7 ”¥à°|Kàž;ÿ¥ÓZöï{ŠÏo¥ø/™``êšBc\ôŠS£®Ò© Ö¤{ÆPiì&*>ûŒaÁ<ú£âÀUq4€‰åæ—y?—â_•Ÿ1®Ú—vìÇ¡G™-ÊÇ!” Ï¿·X0¾·¨ 5!éÛ–³ ùH›>OJ_ ðÑ’‡Å0–VC_Ö[A3$´…‚ѦPzÍ9X¥ä†·±\A%Cº$ò«1DR!Çä¶Ý9 !Á«ñžy.:@ŽtOˆAv:v]MV)é2_”±)NÔ`öyµP¡“ˆä¤éã¥C7ãúÙØRA> RzN¿ù­&µT«†ªÐÝžŸ¨Øª²p¬’¤sk¬ŽàÓ9„e©p8PyÐäCn©º/ +¯¨VV–ʶ•µ=ø6Œ’pi^÷-·èüâ̼ ¢RXõ™`éÑ—îêcÉ­AiS¿“t7ÔAè[žh?‘e>Èçg<íÂéG,`BLVÛ‰!D“ªíŽI?vùæ +É\8›·ë­¾g¸OòØ×LË|´¹+²Ÿ¸K±Tnü *”"¤\J Ò±ö¤ÙÜqšN-ä8ôDÚ‡`;ºÕã#€0€Q½ÌœÒê£|b*)±ƒÑö¦ +ƒ „(¨†0h pd¸3R\.\šØŠfùÁÆz|‚(ô®ìMÈEU߯±±»©ÊÎÚX †llèÛ ÏwCODH \@rR ñ`>JÏmˆ_B„Ðz¢NâƒÛñƒS²¦u²Éú~ßT'd©ÔÍ’ó|Ð0OìôDjïø;>RR?¤ø]IÏ–)ÆÛ‹6®˜}½\ð 1Üоzù–÷wœÞJ¢@RÖUdr`„T,H–ßË«.iÁÊÉZÇÓ¶Y‘¡O­K¥©¦Â"¿õ‚#Æm;´*v”vÛ¡O¬œ]k=^º4IE¬/âûÏy[¨ŒFöŒJbŸ–çsþ1y¡¥ÓH|óŒËHÚ´¡Öy'£üƼðµ›ÔÜdІeIÈòÊ<Ñm†£h¬>ìbÚn{Êçß]ýo4³½©GÿƒQû£ £Ö:]¶&“ž$"}†*3¿À«zôéËv‡`/ƒ³v‚yÜNh §ìÄ™ ÿ¤˜“µh'l²Þ\_}÷á„®î1Ï2BÃ<±eáhâO¶ü«TR Ul +ì- +œÈ™`LÚ^`ûÍ5ÿ¢Îà¯õrY‰„º „ó‹i Np^ŠiÛ mAÃs]Þì‘%Ö*r³(›½¥é +:Å°))ÁÊ·ÍÔ—û¤8ÁET\p”‹QG’pº¿ûÖÄ™Ð3éï¤?W¦—#Æ­”y™ .“d9®\–çŸÃ]ËRÁÊëŠß~Wü‘€»`þ’J«8›©t"=£È^ê†áùÏï,˜3Š,@O*òãþYEž‘µ¬ÈY¯«ýA»—k»8'5NÜÐ?KêZÃíµ +kŠ¾̦ñ_bc£ àûyüÓ?Z-ƒ°v1-€?æÁ_únÚØ\M-€l7ð5-Èó æôF¥D©:%øÿº;,¾endstream +endobj +5936 0 obj << +/Type /Page +/Contents 5937 0 R +/Resources 5935 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5889 0 R +/Annots [ 5940 0 R 5941 0 R 5942 0 R 5944 0 R 5945 0 R 5946 0 R ] +>> endobj +5940 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [417.336 699.694 477.54 711.989] +/Subtype/Link/A<> +>> endobj +5941 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [126.184 550.652 219.086 562.342] +/Subtype/Link/A<> +>> endobj +5942 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [172.618 537.103 264.005 548.793] +/Subtype/Link/A<> +>> endobj +5944 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 213.721 139.975 225.411] +/Subtype/Link/A<> +>> endobj +5945 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 159.525 144.521 171.214] +/Subtype/Link/A<> +>> endobj +5946 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 104.722 168.415 117.623] +/Subtype/Link/A<> +>> endobj +5938 0 obj << +/D [5936 0 R /XYZ 85.039 781.388 null] +>> endobj +1734 0 obj << +/D [5936 0 R /XYZ 85.039 761.463 null] +>> endobj +5939 0 obj << +/D [5936 0 R /XYZ 85.039 743.459 null] +>> endobj +1738 0 obj << +/D [5936 0 R /XYZ 85.039 386.736 null] +>> endobj +5943 0 obj << +/D [5936 0 R /XYZ 85.039 353.199 null] +>> endobj +5935 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5949 0 obj << +/Length 3768 +/Filter /FlateDecode +>> +stream +xÚ¥ÙrÛFò]_ÁÒKÀ-Æ`pæÍŽdY‰%s-y×UI $€–•ýùíkð”wS. ƒžžžžž¾A5ràŸE¾íèxFÊÖQ4š­ÎœÑf®Î”`Le2Ày{öúŒ”cÇN<ºŸ÷t|Ûóõè>ýÕúéý›éýå§ñDkm©ØOÂ0²~ú<+뎡ÓO×·÷×·WøæPYŸ§8ýñÓ8ÒÖ=#]ßöÓonÞ¾á7m;ãßï>»¼ï8íx®bdóϳ_wF)éç3ÇÖq4z‚±c+˜^Ÿ¶ïiy/ÎîÎþÙ‘â9oÄ«IÅ`Làd±ëŸ–\ l/Ðä\ç€ä|Çö$$•¶á¸ÊAl¾[ïÆÚ±ª±VV=ž(k³‚Ùæˆ"¬ „ÐÜŽÊæª$5Ó÷ã´R¨s˜K +3õž€OmÕà{hý‡ Rh*Æ™wÔkž½If<ógîxüEV–K6«V«¬žñ–xY#ß·áî@f(»˜Îúùöú˱‹Ôû/ˆ¶Ç!Ñ*ÿ€h׎”¢í>äåج ðôm]Ã_~o‘ÉraWZŒ'žã[ ± L¥ÈþØ ­g{VÞÈô2ãAUF†çž4ø·Eñ¯yî¼YÂPYç=I|"Í +i>áÚ.‹i¯é~˜#¢X3<%N¿"<«iP‹À¬ÌcõÈxóª>@¨&Ù;[bÏqc@_%m˜x*†ËKwoB¡í†£ Šm7pù&^/áÓàNy2ÀÞ¿“ŠÈK‹·ÑVuŠ¹Ë€ë„¶Ô6;º`pNoì*eÇ^°µ3‰Ëu@× .¾*k_1m]Wx_Ù +¯ a`^ʳÀš¯¯}S$õî‰<åÛ®ï}§L öé³íÒijÍI—7«=‘z^h‡A|R¤ç…mw(á¶èæAÃßnZ#–D.e% ?ð¾ÅTP3ÁY¸v¨·ô“4=ÊÕíç×C£ýü¡ò¬ŽÙƒ"Ò^öAé*/XÍ÷*ˆ€gUèÛ¡Ò/ˆß`OèTk‡&œ²·3VÖ â ‰7ò|4¢ƒ<7­Ñ«–uØNl³¼saç4£žÁ<áѤÎD€»üÈZT9ª<Û¥qnµ`ìƒ^ÞèùA Ðå{ô‰xà`ض +p Z¡WBO{ÞÆ÷l2ŒôA/ÝÁž Ðø›šÈG0`åã?¿ðØ̞Î@qT¸Í×®œÓܸ:¶=ånq³LÞ¾Ýàöe–òk…&DðŠŸàXBV.DLÐ悵)QÕÈâyý¹1g—fÞdŸ9£:á—dŽñ‚ S"ñÌw‹bÔ;6šp~6Ïž8%{ +ä%HIàqCPÎè +À@/AMÁÈ›p´à»qäYõ0xÍŒµ6’AOH*Y¯ÔX…¡]W›ù+TóŠ}R33¸ùºåi²\VràŽ0Ó"2<Ï ™ß¤NÄ[I&ª‚<0´L0ph/ùã8¶ÖtŒíȃðJp“¢àß6Ìä+>`Uãþt½„æM[W ¸cÒ¿Ö¤47Œ¬xBÌFË阀ˆHÚïx -«;#Nˆ=<2›þ¿ž(8_s”ô]p$ÝÌ°ŠsÏ´S‚Ž_WrüÖI$¤D@(MÚ„GKÊž`ð@"β’W&)±šòÛRxæñ}ŽbÄ%¿9¾ó´¬Lú[ÕÂG"Ü •¤`É#± +«Ô«—¼âÀ]\ŒC¸&§üŠ½>BéøUgˆuŽÅF(RFÖ,!ÎxżÆPâ%F¼E^føû)‡+ y¬6øçò>eéû¤Åß±~ªÊ’¥ßr6郧9e]d90¿$öòü h\—zzžgý ±ã(­êI™mèHI‘·"ô˜0ãkz§ÃuZKÒ5Š Ó‹Š$©*lͺ~ØöL*`8ÏF-g­}¤ªð]È•Âð;êC…™°>!E¨ãdh‘dx$ØÛTº*ÆÓ‘]È€T“U4¤ù(v bÛ +"†Ð¥ÜVc²<ëÎ!Û S¹Žþ)ÛñâX3Ê`L¼÷G"Àëë•]TÀåhÀ¨ èrp‹†¡ÖmÈ,F^î^s){^Œœ–ò­_’Õš³ã¬³e ÉÜœ.pÅH7ÆÖàÏ#zÊ쮚óyqš´ žiE%̂ߪvh˜}cSrÊÒ? {§ýÈóÂsiˆ5kry” Ák›¯²#>܃:x®»M8tà7ßÖD„^ZÈ lSåu1M bšuF ¨3æÎÌXöÉçøtØ?VnšLf[~V±K2cßZYÒdû¾¸éí”l‰F¨9€á;ŵVÌŒ¬|9ˆtÊêd ÓÂN-V k>x6Ë©šÜ³ó(­úDO˜Ê‰£vfÂ@LöCì½Ô+á[mã¾"<§pÒK¡ + *-ëxD ' ŸU½ ?ÿEKeV| ~PBbzOH¨]&m,Crw\cÑYz—ñ’Bé(²Î±µ:½8çe¿9Ê£fF#³Ui69äüÝæN–Eî]6¤UtC +²¤0³_0ú0Av0×IšîÐ0IݵV`-¥«ž†Ü‘ÂFÆTûTµ¤a\ÀtÕ7ì»(†•&äÓ˜& —²î µã${d̦OQ8ešꡉù¤ #j·ç{(o4Îfï b_XÊtï÷wFS-œÕ9ÚOŸ r30w¥nùA9)x`·F`ŽÖ[d Po-^ïÙ:Ý•‘ñþ¹Sbå4®HJ"Ðý‚ 1Ò;V‚(C9`óßœ‰g‡\AŠù#7‰úK²t͈0åU°c'ª®DÆi*–pžH„<ô.‚”£Ä2eÄ'ù x"Ãp#¿ ¿{QuVm +Ô,Ç• ¿à*æàùPtm^™(ù™Èócgc wìÿpÑUÛÑv»¤3yíDÝ ?ÞOù9¥˜Ý² WIÝn³óÎc²4Ýl¾Ÿ‰Îær–Ü?â²ÏUç-ùK*bÑÄ’”ž4%`@k,8¤Ë©î¨Ø1  -C¥UÒD0G„¯y“,:ãñˆýN96ë)ÛA±?#óœ }²‚o*9ø²` WO¸Áa¿wþÙfݼˑٶó©xnJ`!%•âŠ¬Åë¯Âõ¥›}íãþ{˜Âðš­H`¼4ÙѨøI¶Â¦:Ë:? +r D5ž ˆO±è=ꀈ࠼fJ­8|§*ð€äQW4-HTN;B¡2xe¸v߈üõ;«Ž¹­ì°•ø%!Ô­Æ÷í2JÇ„(oxM´ÅV7çªG –`ZÈV— ‹ÙÓ¡ÃíÃX5îÀî¿(œdâjmÚßim¡â6BBñ¯,´#/êNæ+ ÷%ÞÒ‰¹ag‚Vï[a| îêEÕ´°HåPŒ^lÉ#C»Ó¦Y0Ô…ÖÄÏ®3Üõ¼Ët'òr³¡Æiõ刚‹Ë½Deòøhk…Â(­1 +Ÿ³ÀÈ7.߇ª¤g¦6-5œ0Ý›»(sNùI›k™ ¤(J<–l‘Äc JĽ_Ë榻-xè(º›‰À_.0ßùAP ?éEÁ±Ú«tU¨èÎéïA¦æ`­y EøÇíÛ9ßû,¥=[Åj›‚ÛàœÞ}—nO9¸‹8êÂ7Tíä²o?Þ\î}Rà9µþN¹ìÓ¬íÒ$É,ÚG¼šõžH\_Û.`‰ÁyaßJ‘œ[óæ$Ó9#!™›onLå2¨è£l2;OØ'HÔˆ£>l%)¯ç˜3\UÉV¢Ú†‰T¾‡‘ízñ0xQgÎ ðKœø7pÙýó‡E -Æz U"W ?:èª\2uÊɘ¢–/3Ló"yg¤‚–º®‘uÕÎúÁgs!(˜Ô¿ ã³¹ÓqEu.$y»¬>;»¿cÝvå9vàŸî° pº[×þ6tðÒ¤êZl.6ØÀ͇Í5J©Ì·öµùY’|«ÞoÅA„ŸRù³üs¨’³µð¯Š*¹¦8r`åë/¸Ç9ê¡"‡äÄï3*}C"è}Ø×@8–xºµ åÇK¡ÇêÇ|Ó{²PïõºJŸ^MýsÖ2-Ób3hP ÒÁ5Ðî´Ø:ô5Éæ%/!cÞ+´1œôjŒú܃¼û=gS.à÷>­i‰Ï¸î™½»äÂ'>SCÎô^ÕVß„1ŒÂå7Ûa•˜^š¥Ñ?x‘êÌÓ”Áƒó­ÕºëPµÙ±.¯c»{¼ðŸ³‡¿õCÇÁ'(pÿGžëÚ®2¼à¸‘Þå××8p½Ïð¤-Éendstream +endobj +5948 0 obj << +/Type /Page +/Contents 5949 0 R +/Resources 5947 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5960 0 R +/Annots [ 5952 0 R 5953 0 R 5954 0 R 5955 0 R 5957 0 R 5958 0 R ] +>> endobj +5952 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [166.274 686.144 208.357 697.834] +/Subtype/Link/A<> +>> endobj +5953 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [414.258 686.144 448.765 697.834] +/Subtype/Link/A<> +>> endobj +5954 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [267.768 671.989 397.093 684.891] +/Subtype/Link/A<> +>> endobj +5955 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [153.592 659.046 237.013 670.735] +/Subtype/Link/A<> +>> endobj +5957 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 167.864 135.187 180.766] +/Subtype/Link/A<> +>> endobj +5958 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [216.837 167.864 254.284 180.766] +/Subtype/Link/A<> +>> endobj +5950 0 obj << +/D [5948 0 R /XYZ 85.039 781.388 null] +>> endobj +1742 0 obj << +/D [5948 0 R /XYZ 85.039 761.463 null] +>> endobj +5951 0 obj << +/D [5948 0 R /XYZ 85.039 729.909 null] +>> endobj +1746 0 obj << +/D [5948 0 R /XYZ 85.039 417.541 null] +>> endobj +5956 0 obj << +/D [5948 0 R /XYZ 85.039 386.254 null] +>> endobj +1750 0 obj << +/D [5948 0 R /XYZ 85.039 140.652 null] +>> endobj +5959 0 obj << +/D [5948 0 R /XYZ 85.039 105.906 null] +>> endobj +5947 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F58 3360 0 R >> +/XObject << /Im1 4096 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5963 0 obj << +/Length 3376 +/Filter /FlateDecode +>> +stream +xÚµkÛ6òûþ +ú2P)"E½ziÓ&¤É6Ù|8´E ØZ[]Ùre9Ûܯ¿yzY\‡`c‘ÎÃy“báÂ?±ˆ|ÇõâE Ç‹¢Åzå.¶0òâJh[ƒØ-˜ïﮞüä á:±/îî<¾£|oq·ùÕúáå³Û»ß­lÏó,;+; #뇷+a½çÞÛw7oînÞ¼À–‚Na}¸Åá·ïV‘gÝ1ÐÍ›føÙÏß?ã–縫ßï^]ýxW¯´^¬*Æeþyõëïîb[zuå:^-áÛu ï¯`Ž¯<ÝίÞ_ýR£â1µàYC\ñ½Èñ#ï’-Â`‹ï:¾«ˆ-Çd½’‘õ°ò+Ù®la¥+[ù¡UÜão`ý„{/V6û¤ÊÖöíísØû ‡#ëŸùùÄsªž|½fâL*èÈÖøi—Ù‘1Ÿ©3Ï*\À—U¤,8”HøÖ¶È[F´A2¥™žÑ” +þ}V2¶Îá:JnT0ÛÁ”[<`-1m8=œÎezâcû‚¤‹3Ÿ,âÄßmÊÔ¸s·"– tžT8±ÛÍψ#-Ÿ¨<ç‘ß\¡r†ýÍõ |7&nàDÁŒ¨70t¦J´ÎT¸ÂQ®W#Â=ù°OOà¸M40;R$„tABš‘^è„JGŪ»ÙQ11ÐÛîˆI笘Ͱe†8’ÓÑ ôé³Ã—âö·"lÙ p¤>¶(tÏÈÒ´ ¼ØŒgB–4Ь,5È&d©GqX–Zïvi© å‰&gaÖºêZ[°l(öì#6iÎíä°áuži·D‹þJ$²Ä$]ΈQ `y®ô¦9ÚÀLpTÍrt‚`ÃÑÅaŽ¶(þ‹\/òë:G‡LJÒ5ö9Øå£oå!þ9&[=€üÏØ_»¶ÎàÚtPá¡WÇ©h +ìx½ÖVwg`!à Ýbvb,d%ô9š×Àõ¹ ”=Ê=ƒñ-ôÆd&ÊtÀc?f¹‘üç$0hþ H‡̓ 0j±4„p)€ ‰híq]"ˆ§At˜Qì÷´ Ü÷&Õ9Ä+ˆV”ò!.„•_L¸i.’ØjqÅp¥þTa40&µ~¡[LJm f\j ÐœÔN¬¥¶OqPjÛoHYcÜ’?ÖÚÜCK¹$Ë—·<ô:9Õì|Õ„]±¥ø–¢K樰–È=%¬Çú(®&çi n@›MÒ@ôe¼B‡óž¦ÏŒAOÓfÆëi|šuÚµ·!G¢y8¼µAæb[ù*­>ª·|÷7éü-|?t"9|¾2ˆàäÔW9ßsPÎÄŸhVèdB×£8,t-ŠwÆ3”µÓ=&±;Ôfi3¶sW¦5v™ÿa€1ÛPËQ]u=ðÝÓ\«A&˜Æ0³<§Ö°¬Kn˜c 9ã­£”F°šjÆ$9w’9<œ¸EiVŸ³_£€” lbàúµç¢~fTá|Ã(>×n MeÅ`û÷z5y*®\—†ï¹³ÉÓ_½ÞCQqÏ}²Ï($Hʶÿðµû §ÕËå^³ûÁ…ýÕvGì)ò}[Å}bàªmÕ˜H¨@:q$'e¢3.hN*¦Öbѧ8(mŠZ0”˧„¿ ŸGN¡À7(‡±:e€ï^xπఠúÓÚJ§–£¦º³ÝySÝßø ©noüo&d«7`O´©æϧùi¥Æ’©«ò†ÚÀØ- Ë““¡9ªWc•¼Ç+cYóVÆ=[w}b<t£Àû&$§G1X¡Ø‡›ÙþHVQV «÷S¬.cŒ‘ª$Ë!P"‰OtXDrs_”X>âPB9ŽÛˆ´NvT4 +Ü6õ˜óIë,m,©­ìYqÔtv²ºëyŸ©¸EJ^œµ¥§’²œ¤67ÉË‘ W¼¾¼O(¿9aäO+3¡ühVù'6Êߣ8¬ü-ŠÏФ +´äÌBP„ªqЭ»‰)‰ö§­"šÔ‡¦:¶––±ÎN086Å"¢7z¦É™0ºi~«Á)c§ãE ¢pòtZ0ã§c€æNgŠ`}:}Šƒ§Ó¦x³×¢‰âØÒFð€Ú6£‚ŽÝÄ&ì)ÆÄžxä¿w\•9ßqï€{ÇÙ»Æ?j +ìT%ä„lë«ó‘1þªò¼&]×ôBT¨+îØÀd ÏCßX…]ŽÚ{}ÁÍŽ½ïã¬í=-È>¹Ó2Zcž`}>ž8 +ßkgWíó ‡%• + !¶ðÆêˆ c·€.… ‰ÅŽr ?ô);zþ |ÃqÒx¹ÎBæ=gIƒž³½¤¿[NÛü9ÍH§å{°}_9~4RûÔ0v h@›z˜ZŒô@ª_ß>§¯¾€§ï¨T-®GÁÇ‹70>–Üd¶ FÝÅŽ3[C_,»ËìÎYfçÇMÃRÍyàxíˆxמïH ÛP‚ìá ¯5ŒÝàu“á5h¼Œ)6”žÛÊß‘±ywáö÷ ñZ +HZ#¯»ØQ^èée÷q£ÈäUh™å2·ƒÙËø¶åEX6§H¦H¢N ûœ˜Ò¿ƒ±#cò Ìô~”'œ°…‰Š`%ót9ãغ퉫.<§¾`ƒµÛÚl +>‘±ýXokÊ^—G'<0i^¢‚™»ÒÀv=pÔÅ8«#¼O¬fLx:Ò“Uö-¸鯭kÀc—®’Zk›ªz.ÞðN§-˜‰8EÍÆ)›8¥Gq8NiQl²ÿÀµ¨¦š¸ñ9K1¸„ààƒtý9gLG”%·>•œ@Ôaª…Ô_íhà¼Ý™6•qa¢¡ËT2ö=²»íq­¡/еÑ=œ“ò§Mrä9x½ÙR²Æxøã[tÛ~‘S~£ë‚cÅÀo0!}ziXbáD°LˆºœH §žt +Iå×\nJ?vB¥¦ÅÐ͉a Ù¸ö)Ša›b-†à1”r×Üäsw ¥Úæn{.Ó^œóÅ82©_ Ôa5Šbbê†6K}…Ä7œÖò"Ùðl“õ kÀw—®¶¤¼.sF…Õ@_°©#¬}œ_!¬Ìv=ñ•VwTZ@±ÿÒ:]Á–à©Üx&¹3@³ÒÚ ›ÖÅaimQ¤ +¶ ½Ú ÊPZë‚e/ÉL*z|†£u¡:Mþ×/n0Ãj BÒÔD!¦bKtTóëK–”‡ÈúâGûŽÛ,ÔaK„Ã^™é¦ •5kÎð’ÓEÊ ×Lè¢Tkv‰Ùm^?<@ätëÞK‚PUer8“ºöÏÏ€ð­ŽÖWJ'Äøq>a¹ÀV‘‘¬j·‚¬_¹*\1#ò.R‹*€‰ógJ57]Uò ‚.°t6üíÀýæ1aSƒ%Ö)û·©ŸB+­ÖuÚ‘’´—k)8Äï*‚€Ù’~²±D½á®}È3ÖÓã˜k¯AÐÇ¡ ±AØ ñ°Ç·6Y’[†|ïán¾åÆ®¡ë[ýdŸÐE »æÉBº€ÉóŤB·`ÆÚÍ)ôÁZ¡ûºMñ=Õ­Î9—R=8ˆ¦P®@šËJ·S…'‡9RÝ¥º®«¹ƒ—Ò×';Dõ¶‘< +\Á%Æã! }ÁŠn<ÔÃ9S]F³øª“«~me])  ê…à8†ÒÀØ- <°‡©]*íƒ.Þlã© r¡w§_Œ.´ôýŽëò§¹5Ö¯ŽQVíšðŽ€—›:¡Ã‚xnÉ#E ‘FOçLÙÏŽpôBÔ`×8ȵҚšçO8ãÒ¬._¤\®éÙóõáúXß”bÇÒ¬Ëwë»ñÃZãʪт#ó4øcQùŸÞ7WW`ÓÇ +M>äÈêµàÁÈèÂ>›÷é þ­Åóendstream +endobj +5962 0 obj << +/Type /Page +/Contents 5963 0 R +/Resources 5961 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5960 0 R +/Annots [ 5965 0 R 5966 0 R 5967 0 R 5968 0 R 5969 0 R 5970 0 R 5971 0 R 5972 0 R 5973 0 R 5974 0 R 5975 0 R 5976 0 R 5977 0 R 5978 0 R 5979 0 R 5980 0 R 5981 0 R 5982 0 R 5983 0 R 5984 0 R 5985 0 R ] +>> endobj +5965 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [148.013 703.447 407.73 715.44] +/Subtype/Link/A<> +>> endobj +5966 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [371.497 676.349 539.579 688.341] +/Subtype/Link/A<> +>> endobj +5967 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 662.8 273.67 673.883] +/Subtype/Link/A<> +>> endobj +5968 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [371.497 567.652 539.579 580.554] +/Subtype/Link/A<> +>> endobj +5969 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 554.406 354.349 565.489] +/Subtype/Link/A<> +>> endobj +5970 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [371.497 459.562 539.579 471.554] +/Subtype/Link/A<> +>> endobj +5971 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 446.012 273.67 458.005] +/Subtype/Link/A<> +>> endobj +5972 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [508.95 377.963 539.579 390.865] +/Subtype/Link/A<> +>> endobj +5973 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 364.414 325.713 377.316] +/Subtype/Link/A<> +>> endobj +5974 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [371.497 364.414 539.579 377.316] +/Subtype/Link/A<> +>> endobj +5975 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 350.865 182.533 363.767] +/Subtype/Link/A<> +>> endobj +5976 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [325.181 350.865 539.579 363.767] +/Subtype/Link/A<> +>> endobj +5977 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 337.316 136.217 350.217] +/Subtype/Link/A<> +>> endobj +5978 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [216.087 337.316 430.291 350.217] +/Subtype/Link/A<> +>> endobj +5979 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [133.74 323.767 388.228 336.668] +/Subtype/Link/A<> +>> endobj +5980 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [394.406 296.971 539.579 308.964] +/Subtype/Link/A<> +>> endobj +5981 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 283.422 492.799 295.415] +/Subtype/Link/A<> +>> endobj +5982 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [421.347 256.021 539.579 268.922] +/Subtype/Link/A<> +>> endobj +5983 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 242.774 492.799 254.767] +/Subtype/Link/A<> +>> endobj +5984 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [342.861 147.627 539.579 160.529] +/Subtype/Link/A<> +>> endobj +5985 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 134.078 245.034 146.979] +/Subtype/Link/A<> +>> endobj +5964 0 obj << +/D [5962 0 R /XYZ 85.039 781.388 null] +>> endobj +5961 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F35 2976 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5988 0 obj << +/Length 3477 +/Filter /FlateDecode +>> +stream +xÚ¥koÛFò»…à;\(œE‘\’"S‡$mÓ½Ô»m®ÅµÄ†Y>"÷ço»äR¢äEà;;Ü™Ý÷ÈŸyðÏŸ%‘ë‰t¶J|W$Él½»òf˜yåkŒ…FYX8oﯖßEñÌ÷ÜÔKg÷Ã:‘FbvŸýâ¼ûþÍíý·Ÿæ !„ã§î|±Z%λŸoç¾sÇÐÛO>ÞøøG!}çç[œþéÓ<Î=#}ø8L¿ù÷Û7<®7ÿíþ‡«oï{N{€«Ùüóê—ß¼Y[úáÊsEšÌðî¹>LﮀO7 +…WwWÿé—â¹pÆ_MJ$7JÄé±ø‘u,¾¸Âf«Ès#/¤sY—]‘ÍA’8470Jç°EÄõ(ly~'?σÄQú»v«NgþEŒÑ)j–Ú’1‘J^00oÍp×âGÏ0ù«ù7x9pR 2¥?t0ÙÂõEžÓ5 +_|çúNâw_4EÉÆu]@½æ!ìu!–”²«y‡0Jφ¸EØ«†?Ûd?R§Ù ÓóÞ¸Ñlä÷6b«ÅÃ3,fLg_”23|yNYµy¹çw<“ºÜMlº_dö€w¡X¬+º_|Ëòšq|gÝÏx|îÙŽÓØÞꢞZ8$¡o ¤ç»¡'ú…Å_=uLÏ÷b7‰’‹ Î ÅI°)¾Ù—(«[—zQû|ƒÏ „{h«jEêѲÌó\%k–%à%à“küjË ±r{u‡úè‰FƒÏØÜصÄâ>X%nâ–‘ï»m Ò@ëIÍ£ÀYw,a:™j‰Õ¸áµNN"^%z-Ö†¶Ä]ÑuÏ"õ]ßOGòóá„$öŒô㥽ÐâÂc3I;D@…¯9 kvŽ«ìH‡Õ‚ñ$RÏxnMúŽÜ“ÍøÌÐv+[~{èð΀á¯lŽJòx+§_ƒYÉvhÉp[\ +Moœ:Ö«ÄGâlzƒ‚ !ä€Tõ€¬9<¯T²Þãû +θlŽqÞêo¾)ù°®‰‹Àù ç󆟲hÌn`5¹g¨z¢UQ(Þ»&ÌŠª€CkÓí¹Ù*–4µ©¯O^$‰¼¨§Š$YÑ™ê«Õb@ò8ÝàðÓ€¥”‰Ç½ˆ˜OÈÀ³&èb ·ßÖY¸ÕLðÇÖ%}w<5ÃÔCü¢ß™›ñÆõmƒßßkÿ`TN¬—Q€Ó¯ëœÄó†a½g…wbôú•†ðfvÊ’£Þ&À´í¡Ô“ìwŠ´ž™¾|ÂCç«z§sÎ }K,.;§ç‚sÒH/:§ çtDqÚ9YïJ PËèÜÙP0mYGª·*0%8ú¢UZ† @áóǼ· \‡• )ì Ú\/ØÐâ׌ôH¹ìŽú‘íK÷d›Qð7à#ÐU ÔD +¾‰¡¦œÐó½Â°&ˆ + á£FÇLë\ 8ì“FzÑ>] 8ا#ŠÓöÉ¢8.jceæ‚¡‚Y•›X‚ÒrÑ!Ö ++º̣ë)Ë®©—u F)yn°IËÇ^TÏP+5‰†EP¶ªV6‘tTQ<•¿ßΓÐyCMšï3Dzì_ —Ã'ª :m=6² É5e\ñÙ‚Žå©¯‘wC€Í‰ +UP¡—8ot‡Ù*ˆZVš:®yšZ#kF~㚃õÊt2^í_¡Û½•Wµ]èm€päž,”"T¤=%ëlõ<[÷Ÿu"PNÔcŽ»#¢îÈ5£Ú=Ê´j§•N'7ãÚ0‹jng°…¬ÏeyA»+ð'—4ÑÂ9¯‰é%M¼D°×ÄcŠ“šhS¤ú9ðCÀ¼Zçè9¯žø1å°HÍ#ÔZ‚Üð:kpÿ­^Sjb¸Ú³©$é;×_ؽ†dåƉé¬A—B!HÝQÕ î.!Q·tq¾Òq¢^ÀÌbÏ(˜òãówn ’"ÍE@ãþaDû§9 ·Ÿjb€ÕfÔ.Z ç;<ƒRË»Ÿoïø +ð*IëÒ>xIDÄ,zq0€LÊœßdÅfpû8z«ˆJÝtÞ­¬qÁ®â&ä°‰<ÄR#ôv¬ì6[qh\†gˆéò„ƇÁu– Á¨oŽ'ø;‘âyâ'¡—òo½¸þ±WQÏ ÙÒï´¯[i¸êc„ÒLîµS»”ôzn0Y?&÷—~Ì6Tä…›ˆ3õ•(ÜÀ7¼àöàÈŽù5?z;aøÿà^«endstream +endobj +5987 0 obj << +/Type /Page +/Contents 5988 0 R +/Resources 5986 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5960 0 R +/Annots [ 5990 0 R 5991 0 R 5992 0 R 5993 0 R ] +>> endobj +5990 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [140.74 415.925 539.579 427.918] +/Subtype/Link/A<> +>> endobj +5991 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 404.8 119.036 413.459] +/Subtype/Link/A<> +>> endobj +5992 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [439.559 374.975 539.579 387.876] +/Subtype/Link/A<> +>> endobj +5993 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 361.425 440.258 374.327] +/Subtype/Link/A<> +>> endobj +5989 0 obj << +/D [5987 0 R /XYZ 85.039 781.388 null] +>> endobj +5986 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F35 2976 0 R /F62 4047 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5996 0 obj << +/Length 2698 +/Filter /FlateDecode +>> +stream +xÚ¥YYsÜ6~ׯ˜å>˜ªÒPo¦Ê¶7ñ:[ë(–RyHò@ ! ccžh}ú@ÌÁñÖªD Ñ@7}|Àˆ•b•Åžæ«4^˜e«Ms寞aäý•PkŲ¶xÞ>\Ýþ'+á{¹Ÿ¯žæub/ŠÃÕCù›ûîßoî¾ÿt½Ãйw½NÓÌ}÷Ëݵpï™z÷éÃLJßc/¢p¹ÃáŸ>]g¡ûÀL>ÎÃoþûö ÷BÏ¿þãáǫFÐ*G5¿\ýö‡¿*aK?^ù^˜g«=´}OÀpszzqª~}uõ³YŠÇ¢Ï:gͱ}/ˢ˖‹}/ö#c¹HX–¾ð"?\i&4Ýï¾Hw'üÄËâle-v"PóœH±-Q^(‚‰[ÉvužÀÌÝõ:ÈÜ®)Æj³¾^ ·bµsø@@»¨Â(yˆˆÃfæ5_ìß]ÃB²Gvè +–Qµø ÜÛièoëêoiú­ÝpKFh³€áv餃L—\¶ýÌsÁöŠé›¶¿ p¶ý‘Äó¶·$‘ÕÆŽ¿ î½øLcLyZ8íÑxí‚¥’<ñB?½h)‹gÙRšé[–º$ÐXêXâYKÙßoÑ9Üúxäpq’Ã=‚RvœM1 Gr·BwÅfæVˉí3÷Æ-»¶Ùò4Ê„=B×¾nš¸›®EÂØwèÖ5É*YƒGxáö¸UëaF»û×-_ +ÇG˸>maÝÂÁ8kI%§½n€‘V¤IsðŒŸØÜA³g§(¡9mT [å1}Á¶2¡Ädd.Æ‚™1ØØ:ìcŠç…ö<©I‚°Sê¨l§Y<ÑÑ"¯^ì4LÍn¬ºE·Œc/¹¿3˧džoúä²´Ù%Å÷ÈYܲC‚P"3kzœyI%…&6­ƒb;$h£ØУmw³k·@++üþäpR-~SãÇH+I—¯*ƒ°j·æÐR·”5»N$å•ckßGú`ò2‹ïú‘ÈS°Q°´ìa¢šå¥¿?—Î ¹ù:‹¼4d_i—½ÜõšPûCO«0:)'j‡&md-iÁQ–LuÎíÔa'¤rvÖ§›×5U«Pó\ðqÅôM'¿ pöò#‰çÝÜ’x1w­Ã$$$3Êr` +æ—$šöÜçSêÌ +Ä×=ñ—ÓäÀ\ŒÀƒz.„Ò!µ0ã¹Hég™Ã‡¶0Ž¶Ë”êùj<“ˆuöçsßWbs9^² ÃoÁ+â,ð‚ürâ³x茼0J,¸å#„ ãPq¢L‚JÏ4I꾡bˆêuSK£+ŽîµIi_@„~¿¤7 Æ4¾ìÍÏ©oéuÀµž?=$ ºEi€ÁÞKl‚ éÆ—IFs:{¤öò¹èK½¤8”H*Ncz*N‹Áá>íw;WDÕ¨”ôû¢ÁÉsSš&·î•PôÌq[¨Õ+=ŽØÀÏÜ_I|I5š¦´sÕ½®$kI³Uyc^ŒªÊT—LjiØN\o°S ï£Â H ì_»\Í* R1Ë NÒ*‰#¡hÐ_ؒا@…ï< £/N9¸€Tˆ1 +^bµ«' ¤Vʨ`fqBÍ"÷f)ð8§`ðe ‹ËbHݬÚ \>ñ\`Ø!Ó“>RÒiBB²:)l–rG C¶&ù[¡”–¥èZŠ´^5·Žl ”azÔ^ð2Œ²aª*6¯úy‘i€ŠFúú³Ÿ½:绢W˜L$„Xñ[Ôd‘aá‹ÚHùÐaظ2§@ܯ®ˆÄ¦wí?Ñ£yšÂµTË=QBmx /46ÜU–¹Ô ŒJxxkƒØ-Ï€Ÿ ‡ÈCkàOl? Å1µfEª²Ta"À7Û’[Óª”¹(ðT½P»èx„>@°4¶¡Y¥R¥ÜN\Ôîü8¼p’§O-H=?Ït.[GQ¦°NèÎD±Ïñ¦Ú†kŽ¾rµƒ<ÔÏ“pË[V`à)\upí®•ˆ¯‘mÎ0- Ð\rá¾FkUÙªÎqD)•Z˜*E–éºè0͈íÅ®cr-.ì0q¿åÊœ[¦lŠ–s2ÃN1˜Ò ] +Â(rMÅÿ%’”p*‚Ñ?;zD짲óF˜@ÁPǾæTËèŒf‰cGvºARF>wjªQÆK0;mk +,ЋւcÕH}y³Ò!lQc©*ÈAQÏn¹„(Â,÷²Ë€bf1xBx9Æ©Ë€„¼(‹m@þªÚ 3Âàq¸2mð®DénAõ8õ`Ç—UŸy“›bnC¤ú„Ñ;"rÕ…V@N†ßU˜ë ðmº~~c­À4„@hj<²Ù©Ã >j¥J t®Ha‰0©4e+Züó vœÉY˜Kwtŧ?­Qw;öGÓ©ƒ–Kt Ú­±G/ +?.M =¾8<´±®*Ðå7ÈyÂñøöž"§/˜ÂH1O̱8XÃZ5t~šöü^ý=5êÆð² +µÁʤæϦh-Bwj‘œx¬Qï(à…I‚?;VZ ðî(¢/tã + ÝåxoÒb¥¨õvJ–,Zµ +ßyíúŽž‹þ…ieoß7øxÕ¢æÆ‚HW7Fæ}6µ–TÆËeÆü[GKçH€ÄgÐ_ÎeÐàKe]ð”wøìè4èbOÞ¥¯ÄÀaUð[„Â…z‹‡Öõlb§e–®16v†ùÑVáŒÚè8è‹1tÉ[¤ÖB}žŽjïhžØ¯<é1F-‰ó«õZª7ÝpZžs¥VX–7 +AèçýÓ˜d†)‘ÚS£Ÿ)nô;X]ëWQâéÍ_Ç¡RAZý¢êªãýàÌ¿v¡eþ±!}/ÈÏeY¥LðýÎkr5@†,Ìϧê8¼@h]ÐäA–뇙gá©Â• bmendstream +endobj +5995 0 obj << +/Type /Page +/Contents 5996 0 R +/Resources 5994 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5960 0 R +>> endobj +5997 0 obj << +/D [5995 0 R /XYZ 85.039 781.388 null] +>> endobj +1754 0 obj << +/D [5995 0 R /XYZ 85.039 582.296 null] +>> endobj +5998 0 obj << +/D [5995 0 R /XYZ 85.039 539.949 null] +>> endobj +1758 0 obj << +/D [5995 0 R /XYZ 85.039 389.86 null] +>> endobj +5999 0 obj << +/D [5995 0 R /XYZ 85.039 355.115 null] +>> endobj +1762 0 obj << +/D [5995 0 R /XYZ 85.039 184.428 null] +>> endobj +6000 0 obj << +/D [5995 0 R /XYZ 85.039 150.288 null] +>> endobj +5994 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6003 0 obj << +/Length 2684 +/Filter /FlateDecode +>> +stream +xÚ¥Z[“›F~Ÿ_¡Òª²š› o¶ÇÎŽ7ñ*¹¼[I°`$b +’"Ïþúœ[C Úª-W¢¾œîsÎwú\º5qàŸšDíxñd)Û‹¢ÉzwçL60óãŠ¹Ì š7«»û÷A8QŽ;ñdõÜîØ~àMVé¯ÖÛ¼^®Þ}šÍ=ϳTlÏæ‹Ed½ý¼œ)ë‰G—Ÿ?®?þˆ=•õy‰Óÿú4‹Ü½[5’62€T1Šùçݯ¿;“TúpçØ^MÎÐvlÓ»;Ó|OúÅÝÓÝ/ÍV<çOxU*ÙAä]â‚XÇŸ`ùªV@‹8¶Ê,›Í••rïXÍæ¾ãXËJ]ÎÜȪǧuïƒ#=×Юvر-t2n¯‹<+qÍñÀ”¿9“Û ô}«>•¼o³Û§¸}þN’ˆµˆ¸Íê 6TL¥%Þ&H¨©if›¡}¬¹B,cR~=sÊš”ë ÉJ{ÞÂÚ›#v"+Y¯±0)‹uÉKhnx6­JVWY ”,¬Gl?óF ܪsÞ!«yucžNxw«Êy8»a"ÍŠW¼ê…èNÌÍ° ò®xM‘Éb8îO=8¤¸gÜÚÍ]ë”â«ŒËüº*[`ëãõ¢ßåC¯î÷`ª„öuÞ`8gC +tI +­¦z®pxGÃÄÅ¡¡+vÇéS 1˜2Ó Ð,žƒ¬ÈÜùןó¥å•¨ëBï|&Pëobg²€#q0¬OÈ –#^¼ðh›U§£Ä›WŽãp3Í$/Ó+8|ôHMÄÚؤâðŠ'Ø'³nÌñ|ß^x‹É‰í""… +œ¨7BñÉšzn_~{¨ý^× ÁY®G–¤ ÖóôÝô:›ì¾¹ïª(eGÔ.ÔêF@¡W¦»*cDî0ÚÐÍB 1saVÙ1ž’&܆áÂvb·x”oƒ’œÉ p¬×):™Çh† ˆD)7ÞRúyâÎr:yì¡Fp¸¿²úÀcÏÖÜù’—)õÏHH¡õ¶ÀYyä±ÍC0ùb\ñ†d0Í„ž H(ÒûMÆ!´¨%Jê+þ…Ÿ$–Õ¾ª’ý Zûc^•Ü>cÐN¼@G¸ÓAÇo#ܾNu ‹x(²‚êC-X‚2óŠ(€me·/x KÚIÏ €—‘á"ßQè”l­tFôCŒ +ÈcƒïVõÌÃÄ =;)ùF#QHJd¾¬duRð8‚ò©ç÷ÉCDÊdÇmMÙk³Õ}fºçEä›æ”‰0šG{j·lw¸Î$”`”uÿ”ìP¢¯3‰üREäM${…£wœf¤ëËc‚¹1FSj”ŒÐMÉYjŽsT¦6EeœÁÊm¾Íx·6÷P+$áÌ€õ‚N<¹üV(g”‚äÛȼ×Ùƒ§Óy8ºhp.Áˆ¿M:[xÖbù0噯íŽyø¤”¥(Cä[çº:f<™ðÏtù¨~šÎuÂk3¬6¥»ÀÓÌä¨Y]é|DÒ=3Cu–Ü2=ÖíeÅy‹=)¨hdSb12pN(°CFûI­ë‰i†#Lodj“›&6w3Ôt8Vur€’kjdÏc²¡ÒÑÖ⹦Y¼÷3ÀµÆrÖS¾>Ô„&F+hSÀ‚)F]°F•gdÐ!ñ’’;¥`áŠi{ÞcÅÒ=œRÀpЇ.ô¹Æ:\)‡&„LÖÇÕ½ûÏû/û*ßË(…¯r3HÚ>HE1I…؆â PrGͦØW¶*\zFiŠ*òη(ÚÁï–jãþŒ÷(Ãù|¶×§ý¡)x¥fnp™™>#sú?F›Èúšôyç4”‹öæ¿Ó¶äJHÍo³ ´šÃ@ÁíñØž±Jç ÷pÕŒŒd§׎T L‘Æe¢¹Hˆ*²ãP“èÒ’94…ä‚4þ~ÿ3ü¾“â’j¾\»­x¨hN¢úÖ]cæò»9%ub”’Qÿ0êýØ·ýñTß’Pª÷•©™£lßñô6¨dE—™rB(·¢1nš¤ËîHåÚžrMvÚã)#bã\çÇLJÎR.ö~šo³$¯@J4o¡ÆahiFp¢›@Œ0l‘èpì‡ÂàØÄRŠ xnŠ‚GÀÿR‰4äD{:ÝärrIäN¤ÃÚ‹n¤ˆÑ³“..èä•×A×¼È _.ÄB9PòJd+û¶Umçòý/KÊ¡*Õ÷Òæ¸ÑZš£ ÑM£0lÖáØo4ƒ#¡–ø&„Æe»pY«pq×·•¡I{MEóíu G"½õÅe³Ü›$7q1‡áÕ¼{ÖڶƬÁ¸qZšãÑMãŒ0lÓáØoƒ£ö¨=äÊÿëêı•!ZWuSE®Û*d+È|î jšh1Gaµ'`î9¶Ò‹·8×_@ùTrƒ][;.Šýèâ}g¸NƒÛæxÚs—ê8_¡¨¶…Å목Íó2çfº¼ìì·“òE¼žËsžŸRŠÂó·?$izhvžòž i>pÇÁki_"ÜصCÏ%Q+vI‡Æ#d7C±ÓO'@zuÒ@+9·R_Çß{¸1z~#Óÿ`Œ½ö­æÆ^=ïwŽCL@òi§þÌ̼Æ%øÖN÷Ö"ë©~ãˆZ\ÙîgA£qG0’†BW=7ØãÏŒ¡Õ ]<‘4ÉDÝJ$c ›DÒåØ›HLŽKª‡Ì§(Y“]6¤µØþºÜ ÑZˆnj=°պñ_kƒãçƒY`•ãÚNd{þø‡?ƒfDm!º©öÃVíÇ~µ ŽèM?> (ª"e»ã‡º%VShni9­Q²Ã®WGƒÝ*ßIœÓÞ¼7NxûÙ¤O÷À·Õ¨nÐŒh/D7ÕaØêßáØ€ÁÑÌ\ñí¿mHDxC²Â÷¦`üúbÐŒÀ D7aaØÂÐá؃ÁÑ„ŒâËBûz©¯rNÖÕ>φîtqLeÄ&-É0$Bs ‘n v½xì$§}å/‹y¹1ŠRȵ»DÈp¥Fe¯Ùè{YàÀ}‡ª2)èËöÀŸ¸ Þx~hI†š[@pk€ê°ëÊ`gž›muÐ7Ý»W!WõûaÆo¾Tk k~:Ãb>Õχæ)}-+/Kž×Ö¡gÃxÄpqsã>Hà?¾Ùü_óÑÞ’=;òâÏ™®k»JË‚°ºÑ•õ߆\ ü7ô¹ƒendstream +endobj +6002 0 obj << +/Type /Page +/Contents 6003 0 R +/Resources 6001 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5960 0 R +/Annots [ 6005 0 R ] +>> endobj +6005 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [343.74 706.133 512.885 719.034] +/Subtype/Link/A<> +>> endobj +6004 0 obj << +/D [6002 0 R /XYZ 85.039 781.388 null] +>> endobj +1766 0 obj << +/D [6002 0 R /XYZ 85.039 691.864 null] +>> endobj +6006 0 obj << +/D [6002 0 R /XYZ 85.039 657.724 null] +>> endobj +1770 0 obj << +/D [6002 0 R /XYZ 85.039 351.546 null] +>> endobj +6007 0 obj << +/D [6002 0 R /XYZ 85.039 317.406 null] +>> endobj +6001 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6010 0 obj << +/Length 2644 +/Filter /FlateDecode +>> +stream +xÚÍkoÛFò»… ~(…Z wùö—Cš4­ 4ç‹]܇\p %Jb#‘ +IÅñ¿¿y-¹’(hQàÜÇìÎì¼gd5ñàŸš$¡ëùé$N”ë'Éd±»ò&kØùùJ Ä\@æÌW¯Þ…ÑDyn꥓‡UOè¡?yX~tÞüòúî᧳¹ïûŽJÝÙ<ŽçÍïw3åÜóê݇Û÷·ïÆY‹Êùý·ÿùa–øÎݾï·_ÿöãkžù®7ûôðëÕO¥ @UŠd~¹úøÉ›,áI¿^y®Ÿ&“'{®‚íÝÐé†/óíÕýÕ¿º«x/˜ð©!®„~↉ΰ%ôÜÐ ˆ-¿äu>›kxBÑð7+ù›kkxc¶˜Í•ÓòZµÂ¯ïìf:qžy XxÏ«MŽ xè+îóì{˜ÒÍ¡³ÇëÖù)£tê¹qÒ“õ"«|WÇÃŒš›»æÖeç|Ðiàz‘>bĶZó{þã©Ý +[ÚJ؃kÛCÓÖYk¶6°&ãUUﲶã r–Ì“¢\lK†ëÛ|×àüyñêo7×^êzdønäGD]Q®ª6_ü÷ö^{:žÍC:ŸuË£ÀS<ø¨õ«×ûú•ö<ÿFy7:¹ |ÞúÁSž÷‰Ç-;ßí²úsÞåZv³2ÆU>Òœ+PÀðo Dÿ)J‚ôo Åÿÿ!%ø+¤¼-ÖÅoYÓæuª”ÇG«¦1¤èaR|ÿF닪rÓª(³r‘Ï—ùþ˜p;>kó‘©y¢Æ1Ñö°A/(ßyB‘ÉäêÚ¹}Ëß)plz c0ôuQÎtê´Æˆ¦*¶@s#öŸ{–Ø”L"´(ÿ¯z¾kn]6äYRð?ªÃˆf˜2µâ9q| ×òÐxHËïÖNƼ‰‚ù&3 +*<$üºÄXBŘk¸q ô´ÊBgQ틼áqV.yð÷Û­å®üˆ] îN¿Ûáj†d~î<|Kü_#Ù~l‚“ÄÇV_íp9·w|g¶D§XçÄ!ÃVlˆÏÓ0è*GÜ,/ ißfÊÜOÚƒwn2!ÔèÜ.@§4 G@ûbÒ>?L{Šº1L:!áîãË ¦€ N“E)gÊ‹+| ½&ôFøføÄ%¼‘Þçáû`AExŽ†d4×¾d +VÝeUi^ïu”&d’KºÂ½"gnž?ž% Z…ö‡ ?©åœ† _|I!tÁb˜DÒÐàþ¼ rû©{! +áÁž§Fó: †ÌKîrSŒ>]~Ç4Ç#Hå@É‘™¨2¡çÜÍ|EÒò·¢7÷¤Gn¡SVÀ4ÔIð©Í%Zµïú㔈‹‰V*7o€tþµ8k™·À¼§(ó'cÀÕªæocÔ¾ªÛEEVÇV&ÒËê\ıÉk‘×Sù/äÆú LU›Y?•†4äžD ›i0Ê †X(‹ʃ·{~wòžŸâS^ä&a2ŠÐÀœaÂhR4äDUæ“2Ûå¢Ïë|…’0Y+K(ôžÈq•ëí3ÃBŠ¸6çØé`.7CßAC2Ĭ1èV¼j›·13©D½äXh䈮$+¶r×¼–· (R—„å®NÃqaõ0# …5‚°Ö ÆaaY‹’_[6eۂܶÑgJv!â ,ªß•…±YáÁºÂ|‚<Ä7Uþ‘¿§³uuXƒKÐAÌÑAâL?ÜÞMI•hJ:ž2ÊҚȱý†„ЋlË+Í&çðßÈü@ÜY{Vª—žy³‹"äñ¾Þ2ƒi;!† +@W¾â*‹ÀqDâ‚:ókÅCóe‹ö.ãÏÙŽO +{5D“}%ŽCr»aÐ;í¼‹­°]$SÁñŠ!!½ö½”Š§—²{ ƒžNÉ:jIPW!Åz`„íóìäõu4$ˆsfydB3Îi( @ôç¨ÑöÃM%A‹ #Mç1©n^Ll2P^+®Í„¸v“Iö!F:ìÚ xÓÃÆ\›sÙµ —\ÛÂεbtm6Æ ù%„óÕÂ1ZM³×ÇAgl0n2T Ì ÓðtwÍAz- OÑ]”•«0ÿVpúV´¦S;­@¬ ésÎË CÈÖì!,ú-ªÉ_àõ›|@ÛÎô>£ß,++!Á;÷{£à¼aëÊ<Ù~&™í’@>˜zz\Iz˜% •da¯$'‡•ÄÂhx²cWYÎ$/ º¬»Î3É?ªC{bÌ Ãɺλb“úlۥ锗ÔGgÚ—8Ë9‰b*2"‡J½>© êcË^ê.VÛ(;%—N7ñÆ“k 沸 ÐKâC؉ëã ¸lŒ¼Æy¶™õAn-={ea_í¤)~ƒ>”ŠÀcIcò<èí·Á5cx•Š›«pk¥¯ãbÌp·2"-B|y)”táÆv¨]¡áø¹e÷dwñyC‚¢Âh\Þ=̈¼èEy ìå}‚qXÞFlÈÄ¡%oœÙ£$¸¼ÌËÅc9ÇM®ã#‹Œn âˆ$nAc4µ‹o(°;OÉ_ ª#e£ãKî ™¦LS~Ïiî­óÖº;ÿ’•œ‚­[ÞÉÉÁ5œ‹™½w;$]ðMF'É88N'ÙÅHx dƒeô¶Ã‡Um&%éú|ß$æ.hòÅÞ‚Ö±«ÇC@r±³ AӒळIgá¶Ô>à$'Š·ù×|[íwyÙ^ŠN*MÝpœ²äb/AE±{Êj£êØãmbÕ§±2úÕ˜ßm¬y6õ>Ï9VÔTb²(S‡ö]³0Â4{”B¨ìЉæ>’ŽRÓx@|¦€Â1çà¨Z²Pì¨þ=ª¯•è7 åx¨\RšdôI?a³ÂœkèÊ„´£_ó”«o.IDãï?ãõ²sÙ! —ÒÂÎ!btH6Fé '"Oª4¤V‘ ÷žŒõ`îˆ ëŠ¿âëef4(H¶8é‡?P£¾ÏK¡¢™24ק¬cBC›m?ó…WÔ9ÿpˆ>ìY :Trd_ÉÔ‡5Ò0¢["ÚÀ/P¦ìÔt‰Ó¾ ‰“3¦ðªé×À°y.<’ÞY,Ù0.e‹ömyñ¨ 4}XJVöº ËKÞ`ïš¼ŸC#Wò‡kMœ·'8CCÅY)y®ô}u¶í’B“&fÒãm«½4©J«38PñA®2Ò^ŠR7‰ÆïA.‹À¼d+#Ø:S9A7h):«è:.l»PŒËΆ¶¦Å·«êü¨]ÛýðP¯¼Qendstream +endobj +6009 0 obj << +/Type /Page +/Contents 6010 0 R +/Resources 6008 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5960 0 R +>> endobj +6011 0 obj << +/D [6009 0 R /XYZ 85.039 781.388 null] +>> endobj +1774 0 obj << +/D [6009 0 R /XYZ 85.039 551.001 null] +>> endobj +6012 0 obj << +/D [6009 0 R /XYZ 85.039 516.255 null] +>> endobj +1778 0 obj << +/D [6009 0 R /XYZ 85.039 227.22 null] +>> endobj +6013 0 obj << +/D [6009 0 R /XYZ 85.039 192.475 null] +>> endobj +6008 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6016 0 obj << +/Length 2856 +/Filter /FlateDecode +>> +stream +xÚµYYsÛÈ~ׯ`ø²`JqzÓzmGÎÚVdºò°Ù‡!‘S‚%1¿>}Í<$W*•Úò3Ó3Óç×Ý#äÁþ(‹]/ÌGiæ»a––Þh+/|¡˜ +Ét@óëübö!NF¾çæ^>šß÷çÄn‡£yñ‡óîo×·ó÷w“i†ŽŸ»“išfλï·ßùƳ·w7_æ7_>â(‚Ißù~‹Ë_ï&YèÌ™èæK¿|ýù×k…®7ùsþéâýÜrjy®rdóÇÅz£Dútá¹ažžáÛs}X~¼>Ý8 +e\]|»ø‡=Š×¢ï:§C1 =7Ë¢·5{nìEVs‘?Ðœïùnä…#C„ªû—ç§ÇÒù^âfq6vr¡¡9¹Ñ‡7úúÁÁÛ´[/Ô~ª=+¾[—MÉÚ~Ö.ð`1™©#+ín +[˜Êœéxó= èc×–MË´]ÍSzówÉå¸Kˆ±Z.'SàfË› œÛµc¦Ò4CTªxšÄ‰£6Ëò5?BPlò¶ezš7,#D?µÌö–9ºñ¼e7þÿ,ÓÖ¨g!¯»5›Ãwd½Ã‹y{%TÄÌnSà0>t+´õV/_3ÈîùùÛ†èiH-¬únÇpI °“ˆýðÄ\`&\‰cÏù +ì£0È{’:×Ë%°ÙéÍ +Ç `IN„ðTXû +¯IšÞæu@sjBsN”¸1qz‹*ÓìÇ×øVÕþߢfß¹d½n'Aîìÿ^wê’õ‰¦kdZ^W•¬ü^¯îÊ¡UÝ×D R7"JOcÕ¹a” D‰óÌÓ̪=FG¹s2…fÏò)8ëªXáŸUÇBjùÍÙoñ8 yUÝq®‘¦Ä#ðQËq#D¯À¹;ãâòyAà:Àd´ì úS׋Çñ`Gù²$¹Óõ¦•ëYG êdØÑÅ[Fº“ŒŸ:óµ&¦mç)ùÝòoS¶ìhQp½pG)8bN‡ˆËMA°â¹ú^Ø…IÃ1¨NÉÂ@žFÇ‹òI£ƒ†)ºbì¡ „iŠC¿Fɸ>.ŒÂŸPÌ¥I³@öý7c¡ úè¬W€ª*Ž<àj6Cb0 ’ ³°–ºÁâ#N/6hJýýxM‚5˜$GnA„Ùê +¾`õÔÚ!–_Í.Mi· œÃÊŽäĤ úñÍ)a¼œ³Çx¹ÛBÑâåxöa’E"d:Š®2Ês˜f®}‡Áäî (PÏ×B¢PhA,>|ô~q 6²†%*]m°5"gÚ e½ù…ÓÒ´ä»[^z6©ëœx‡.ÏÌñÜ8sÈCÕ¾…yŠ9 Ì“uSðÌ-r¨¸‚c°%rd¿˜Ö0FäèŸ6~Т5;R)‡*À¶ß5AÈîÅf–ÜÁ2É¥bb,'`Ëë–©[“+åªC<ÁÃdX§T•Vœ¹xvmÂü$¶¨1HB‡êQepg(¿Ù%Æó¢¤r4‰(‡VÜ0­ÉIøýy­ùÛ¥IAzÛñrÑôþÑÕl«ri;€¾kHï#V k­€’¤:9‡b@dhE¾gÔ")úO~³ԙ€#/åò0ˆ¹D¯ˆ§Ze‹w¡"VµÍ¸)a;ÌS©ÛÄõ_˜'ôajÀT¥­G!ZXqƒx`éVnª±÷ÎÊ-N±ÎïKlyu xЦ2÷ž‘Ÿ-²ÖKL÷aœ±‹Äê_¸ˆÙu%O(^_ع!ìxiY?²cQlW$žœJQ x+¡o;µ’u£ +"‘¹þf)Mv¶º!ú/I-çjŒQ²?õm§ÒŽ7äÌ%õs{Ô–—È­g +Т‰qœb$Cª±UuGqy,§˜dÞÙö&Ÿñ¨zW<|°õÏOPMÖ„ +âĘÌÁ‚ª‘©©Ú¤*¢V·-p£ÚnÐìœýA£kn”½+ßÀcÉ£Àw†@ÅU.Ü7Ø¿"…µN+‹M‰oÓ,¶¬øєӃZ¸å#¨ Ç[kSÝL\ôŽ‡pb6Þ†/\ 72Ë ÄÉ£F¹íÌca|+©tÁ`M4jgN.m»/íwßWHY«U×וD,ÈAFùj>>³÷,ipšviuxû›< ôµó¤ ®8on²‚»¸IÈOÅ|ÿA#’Bu­’Gº-ÏŸ6…‹$ÓmÝrЂbÀúra|&ÑOÏÜ8ç ˆÒƒ0ßšwð¤v§luÖÚˆ–p6(³&±È Çïëñ(;ŒKFv*ßmá‡PÒ™£åÖAnE'âú¶½ßQæÜ Ás)‰JŽ¢V—t÷Jõ=[áâ÷ç›Ïï1óÃŽ‰&ÌGT4»KØgPx·ÝËú¢¥åƒ-ã¹Ó—%Ñ\Å,q£Š_XÌÑÇZõÏV¥ñ“||ªíQ §qÓEa@½# þIÞ]bCËsÏkMõFvès ƒó~]=娬`BraKêôøÝc&%:ö™Ü6%4˜X1ÅÉQ•J£B·Éc' +Pÿ§ö¹d³*@´¼„Τðž \qö¨K÷Èàìï‡Ï¨ÛJq×힩ץT†ÒÞ)rж±ƒ*@pÍ{/õ)BVÔúÚ†·Ùª:§Œ—/šž3ËKlzÄ;l ‡T¡Wªá&N,›£ç 7g`\çÂh 2Ý>Je’C¿{®†ñÑœçÄæž–›zgÛäЪ{øj*@©;ª¦0‚&VÉÃô*oŸfÍCøZõ‘}bšÉß-gƒPD»Òí¯Ø64ý³´{6Þ¢äâ®* Ð5žóØMƒìY‡¸}×i;gA½QÏúžüNÏ…îÏòíüo.8NCYÒa–Ck$cæÀÙ6ƒ>Š‹ùƒ!PP;F Ú’º‰pðGïìT9<™¿weœxpŸÃ*ç©ŽÃbûÒ¼µ—{þ²`ÂñCýº¡¿—ðKT`J†;Œ†ž£øö¨¥>zæULcn.m9JŽtE®†Òc%” +MÃ_ãé»Ìà(‡y"Š 6çJ +J|Ñð/0صå=2†Tœ +àÃá>õJyx˜eäΛ{¦Ú³­…A*­}#‰I>Ìþ݉Wø&jàEðhfà/H߃ôK/;›)¡wôÝ2 šyÛP(Ò;QÁoŒþñƒ×× +[ÉÃMÇ”×XëÑ“Ã ±q#”/BpÔæKWbEÌ%3ÕÈMŒÁ Nàë4†°mÇoE¸W]½òîznpö/ðÏýŸþ|kÿvAŸ…¯ü¥&7ð /(GåÇüBvrã,> endobj +6017 0 obj << +/D [6015 0 R /XYZ 85.039 781.388 null] +>> endobj +1782 0 obj << +/D [6015 0 R /XYZ 85.039 706.019 null] +>> endobj +6018 0 obj << +/D [6015 0 R /XYZ 85.039 671.274 null] +>> endobj +1786 0 obj << +/D [6015 0 R /XYZ 85.039 627.939 null] +>> endobj +6019 0 obj << +/D [6015 0 R /XYZ 85.039 587.775 null] +>> endobj +6014 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6023 0 obj << +/Length 3103 +/Filter /FlateDecode +>> +stream +xÚ­ZYÛ8~ï_aøeåA,ë>˜‡œ3äèMw€dƒ@¶Õ¶ft8Ýþ÷[)©-wv0˜ˆd‹ÅbÕWEºÝ™ÿ¹³$´?ʼnkûI2ÛTÎl”ß/\áX +ËrÀóâæbõ&Œf®c§N:»¹íå„vú³›íëåϯn^Z,}ß·ÜÔ^,ã8±^~¾Z¸Ö5^}ºüpsùáwì0èZŸ¯üñÓ"ñ­fºüГŸ¿ñœ{¾í,¾Þ¼½x}c45:€V)ªùýâËWg¶…-½½pl?Mf÷ÐvlÈÕèi‡/ýòâúâßFÓ‚Ïš²Jè'v˜ø§fñÃYRÇŽ£xû‘†!™å—Õ/‹eÇ¡•e±ÉTÑÔ«»zkoŽ‡nÙf÷‹¥ë„ŽåÈw‰û\½q‡r—¡{ÉløväÇ$7«·hϺ_x±ÕK0×–-˜ƒ$ë¿Žëçl©âná%V^>0¹#zMü´T˜ –r½ÄN‚vM«” ¼k•:¹¡í¡ðÁjj@¢;>2ýFš{¦a{mP¿I§^Rí¾Pûæ}ÅýÛc‹}ÞrÿвL˜J[Ë;Z¯@;•œ-Ý €fK/¶8MTï]Ö)Ø>8Ù3ô€«ÃJÔÙŒ¬·Ïv'ê=Öþ¶AÖ²A2žœU@·Þ _#I¡¢¿²ÙF.âÈ)Flß)Ÿ84ê6mq+„ÞSŽƒT‡?Õ÷«·ï¾u +æŠz÷í¶(Øíôàœ‘ý‰VAKxžÛï¨,qÀ³êœö´åžœ¨çÁIµÈ¦rîeSŽäºS‘8Hõð8|= ±7 ãÄNƒøç쳿M„ïRËZ„1h 5òÜÀNÜĬˆzÍNóÔ¢F1‘õÅ\Ç)† > ùädØÚ( päB¸þ#ÊŠ¬Ÿ(›v†#e)ü§½Í 7c¡ƒÑ¶ew[S$"ëöyYvÝC0ÉÿÃ@ÌwÒ; (€‚iWÞºÆ("8!hð@RÀÒE¸O8ê†V›W B)G>b˜±DlkŽxø'ãÏ·LÁööÍÔ° É1s÷ØäZC¤ž¬^œöÛ ù¶i«!-¤Pè ¥1>U΢Ù[ÆAô’]­ùB§Ê{àsS²)M¥4ƒX0°Å†(…Á>×ÑæqÀÜmËíáÚ|YE{´y[°ô‚mÝs>c½ÿB¶1&PÂÌ¢8¸a Us[ovP@p¡²©+¬¹³Ï¨*­ž&6(ò<¨yÑ–pëiWÞ7åvyÔh­ +´×o½·9žG]¨|ªžòR;Št¾‡Š<ð„À$õõR~!'h@h°Ú…¨o(ßùQšó¦æ†/¨9—%.58BÍžºé(0Ø‚±I¢"½Þ1°3Œuôhä>JDÕÜ­2™kó2Ϲµ@p®á…dS +Ù­h§›·™jŒ4EK±wã¼B¾ è}‡Æ±0ÝJl)º'M¬'àAÔ'/¬ùf0«ÍJ52É\¢¢_7ä§Àƒ0 p‰ˆÂ ÈÛêæT’Bôï Ræ,3ãÏ­¿ç~#Aèx TÌv2ì“ÂÑÜòwzÉ»Û|ÛMl—9 +&>¤V*zÞH`uM%‡G}±ãF…•}LþUÔÒ0xÅ{Îû¯û yƇŽ‰Å,$€Ä\f–æÛþ07‚02R'‚1êÝéú±fÙ¾æjÁŸ}~ +Á#ÆS9/NÁp +šÉ°nŽ¥‘v—m¹£ýÛ‡Öª  díè"Ä a¢§­{UÐIšVÆ[B šÎa'³÷BsgŽãðà|G Ap¨Í¿Í=NÉ&N}dûUÖ28©B_„ ˆÑ.ù“Ü£(ù¶ôlp]B:1›óèô%?œŒýôÉ‹U­P¨v£Áƒ…%nšðIÞ¹ ìÉzNž¡šå+€&U°£²#D; ß!_b*÷Z):u¼Þeä‘ÄðIb‘k†ȸäý¾LxCé!ïÎìÙAA(´ŸÚó€‡ö<Ê(Z\ˆ„i®¡ƒ£Z#´xÁ¸N£Sä``Àµ’±Ó·z/Ã-6»½ôM]ÜðÀ¼“ýbàD\Ι„€X´ò*Aà]°£aù¸ÖÇ:gÆÂ,¦ l¨Ø½&å<0¡’ÿì~î»pc {Ä03Ð+=®œ»\éu™Ï(rÈÔž‡~ãÕÝ"¨nWÝxË«NDgÌ>Bª¾Ä6k}¬@ûË8óu_y¸ÓóÑ ½-pàÖd¶aošú–®L˜OwƒK €¹êŽp™Ö1Q1—oM&¶ÈÝŸÁ’>Iÿ¾bdþpùn‹t³ò®»j«¼HÒÐz³@ME‡”ÖT±¦¥krö’Ë•ÓýÏ+éw¥ä †\ FéÁ‰Pé¸G?ɶ¾5˜Ìž'gÁÔ‘Ë¢ÎÃ,ö©/Nø>£>‰Z²à”Ò1:Ù`ÑsÐéá-\zŸ‚‘N—Ÿ0 Œx‘cGq0„N׋O:p4ÐaÀèkj„‘ݱŻ:ßKcë:Wª6ëx0ÿq@ûÃu5ßžÛE˜”?CÿÉĉÂÿ&eDendstream +endobj +6022 0 obj << +/Type /Page +/Contents 6023 0 R +/Resources 6021 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6020 0 R +>> endobj +6024 0 obj << +/D [6022 0 R /XYZ 85.039 781.388 null] +>> endobj +1790 0 obj << +/D [6022 0 R /XYZ 85.039 410.739 null] +>> endobj +6025 0 obj << +/D [6022 0 R /XYZ 85.039 368.392 null] +>> endobj +1794 0 obj << +/D [6022 0 R /XYZ 85.039 285.443 null] +>> endobj +6026 0 obj << +/D [6022 0 R /XYZ 85.039 251.304 null] +>> endobj +6021 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6029 0 obj << +/Length 2128 +/Filter /FlateDecode +>> +stream +xÚ¥XëÛ6ÿî¿Âpœ ¬¹"©çùn›vƒKΗ8Ÿz-J[ÊÚ,9’¼›îï<(‰ëWrk¾†3Ãyü8”ûð'ÇI(|ŽãD +$ãÕväï`å—‘´3K2sh~\Œ®_†ÑXú"õÓñâÃÀ'A¨Ç‹ì7ïæ×óÅÏo§3­µ'S1ÅqâݼŸO¥÷Žgçooß,nßü‚£&¥÷~ŽËÿ~;M´·`¢Û7Ãò‹×?¾à‘þô÷Å«ÑÏ‹^Ó^Ð*E5?~ûÝgp¤W#_è4?@ß–·#ÐS„¶ãbônôŸž¯cÞuÊ*¡ND˜èc³ÈÐ1‹”Jh©Æqè‹ÐÈ.»éLÅ^>I¯„#eü½ƒSÅ‘WÕÜšU»¹ŸªÉpÜ®ó²ë5ÍÆ´ø<ðÚ_0®–ÜØ÷–<Ôù_ù +·´y cEv%.mëªâ +ښϛ-ª³ßÚÅŠ[Ÿ›l´ ò0KèÄ®Aÿ€±fm™ÒÙ‰é¦a~Øà„“V(Ö›E<¢ëAµ ¼Å:çÈò©‹–Ç$+wvÌV{¾ Áph¡bpö…ŸÄ$þ¿~èÏ:禶GÄ~ÑT¶—‘WZÔ´*Ma%v&BﺠÁk&˜¼6Ÿ_UËÎó©JÙ¬õû&¯'LdÊl RØÐÌ­ŸfæøÇ‚¹¶ !` zË3Ñ%‰Hâðbæ:4¢ +V¥HÃÐÉÜ( +„ô#2$«ŒP®Â }P*Ÿ­ð¬´ämôZsN'Ëë¢NÍqÚt|T*ÒH‘N/§IÐÛš¬ÅùQ?rL•w¼D‘ í¾Bc~´¦·>3%ÆLµÇ_Ê„<»bŠGdXíyPæyær <c¤OL˜l×u—>6TÛ5%EÁ?ÏX(LÓ/zÍ¡! Ò_ŠÀ×=#ŽnÊ‹$L. +ìhŽ$ž„2W¢4LG1[48†¿™QöÛ1bO†d±÷°Þ¬Ðtkb¾ânrBµÝ¡‹<ãIsg(Óš–Ç“‡È6ìw]–M˜æõÍ€ „}ä)ÀjÿŹ´ÿÌÃ%C õkŸ²‹œšYæÂóOÐœ¢د-¸Çûsr!AÃ0JÅ—]=Ð\pµ%ú¢«/\} ñ´«‰†ÏýÎÐ=°43²?Ī*?ðá“G|zGê$€gÖ(p.­ÔÍc-Ò€ôM…AÇ@|pÎŽZI¨¨RKáiª™Äé“öéhâúv+Ç?U æØÑÔ²9|97à‹.ƒ 2‘ñäk9¥ðª` ÓÊúÉtÀ–3…¡":UËáÝmGXîñ·(™A“·ÜÙapD`Îê¼0-Ýf°Û¢íÀ$T@-6»ëí€Õ“ý³ÅÝÖ³+„ÒÔ+¸Îý#¨ VI,®(’ê­%9Ò슱¿Ø!r˜=fÀiB¬S¨NHY¢)z͹ÝoŸn¾ ?a9„_·}W#ÂxsW² 2&°tÄX¢#ëG‘×Th–ÀîÝö̬ͽå\V<³)ŽÂ}^®ìÂCÇÇ´Œ¸Õ,¿·ÅâÑ=…wžSÈÔì¢X\ q˜A +Dc'á¾!}#¤g¸/ýfLQ¾ˆÕEÀ×Q(4<ã.·:P"HŠ[m‹Û× Ó,Š¼› +ÜíkCP‚V«žÆM€Ò±¼¬Ý@s¶ÌÕ>@CÈeî-"z”:µh”p- ™ÉÒò2Õ¤Ðf¶µ5°­;uìS¦aÝ'Œ GÕ?æê|WŠ/ ㋈™ì8Hø~îV0ÿœ÷"¡‰®–¢½ÎÝÞßPÝ^(zm†ŸtåÓ#„òŒV<JѪ¯.` Hé L÷àhÓòð äŽJy~Šÿ£e’¶‡–šŒYõW‹uHo_u’‹$ùÄL±êàŠà©žóR±ãáÌN?›óü³æ‡fA°Ä¤~FêMø²¬9$ð´6í™w8Ð*R"JõÅ€vhút #' •ÖŽÐ§[Œ¾€¦{/Š½4“ó€jhÓT!z#d.Ñç9¿}ÅYm­”‹Ú4gÓOþZé'ÝôƒÁúé«OArUµíQÜW¬/E#…Çß•|VMË´ýèW{ ²Ý¾e••Û‘H +u$ì.»!Ê‘SeÛ.{¡ó~þÎ2«¹=x–YÕͦ°É}]Ŧií3Ó„_k=ºª¦ñMª2ï^ÛöšÚ> endobj +6030 0 obj << +/D [6028 0 R /XYZ 85.039 781.388 null] +>> endobj +1798 0 obj << +/D [6028 0 R /XYZ 85.039 688.875 null] +>> endobj +6031 0 obj << +/D [6028 0 R /XYZ 85.039 657.06 null] +>> endobj +1802 0 obj << +/D [6028 0 R /XYZ 85.039 365.343 null] +>> endobj +6032 0 obj << +/D [6028 0 R /XYZ 85.039 333.126 null] +>> endobj +1806 0 obj << +/D [6028 0 R /XYZ 85.039 262.693 null] +>> endobj +6033 0 obj << +/D [6028 0 R /XYZ 85.039 222.529 null] +>> endobj +6027 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R >> +/XObject << /Im1 4096 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6036 0 obj << +/Length 2494 +/Filter /FlateDecode +>> +stream +xÚµkÛÆñûý +Åý +ˆ(îò}ZØ®\»®ï £H„)‹5E*$Uùþ}çµKJ¢ï\\ ÌÝÙ÷ììHÍ<ø§fIèz~:‹åúI2[﮼Ù'€üx¥c!(‹΋»«åë0š)ÏM½tv·Î Ý ôgwù/ÎËŸž¿»{õ~¾ð}ßQ©;_Äqâ¼üðn®œ[^}÷þæíÝÍÛqÀ¢r>¼CðßßÏß¹c¤›·øù›Ïyæ»Þü·»Ÿ¯^ÝYN-ÀUŠlþqõËoÞ,‘~¾ò\?MfG{®ðî +øtÃÀ—yuu{õ{ÂïšÒJè'n˜ø—jQá„ZBÏ ½€Ôòï¹Nœ¢íæ å” RSw(QêÜ# 9ð$kTÀ8𜠽†Ñ§ïæ‹ RÎݶäuDé2ÜÌG#¦¹ÊpG~,ó¾[9šÖx¼Ë>ŸïÙ4-d1ëÊ¢e€pk9Œ²UY!=î¿ŸÚú ûù‚¤íåð_½ÐËê-j\(ÔrJjIïƒôø <%vŠ5NzVÂXˆNß0´-²œGý¶Øý ‹å§-’êÿ +j çÏ àI}Í•TìÆ…Å€Cö× \?ˆFö’¾lˆ•@0€à붬A ”&Šœ JÓ6;žA Üò¨Çõ†ÇË:oæ¾rŽÆd°˜õ„’­ÙÈ`&”;ŠŒ¥Ö8ZÝ“ºÀó¦…’ÈÕàó ;Âùª³G¡r•¯IØ×ó$0"y`»]!#'LÇ+[üq0~ÖõeS3…CIAPÐÿhÍ(t¶ ÚòÈ;‚ë¬æÕ=êœF5”W2bZC¶ð!4=âø"”¹ÀK•Ö‚‘ññh ^!/¦ðÀ` ðÈ-™÷Ä}MnÑtÉ„‚d¢}_HlÚy¨PÚ%+‹ÀWn¦'¡s›íðèU^@ô½mÚ]VU”*Ūةˆ_ŒG +¤¬bøº©k£ñµh–7È3¶~¤ ËYڎ׶M× …†W¬¦ALsbË(G6M•ótÅËÛòFèãdeÒ `}¸}Áƒ¦H{ò ³@A´øª*Ð/BŽQΡçõ~+¾ƒ“œ5ÀN„t¿¬e:ÜÑðoÔm,ºMÕØ¡a[P¢‚QS£zïyB®'ûß¼î(ˆ‘bm%†Z ygy¸”yÐ[ê9ÍÞÌÔ°œ$,A’Šñ“ôÒ‚pê¥!Eô ]¤àÞÝðvf±í + ·ÀÓpé1¹piZ#MÙ˪ç£V¬oÆxF¤ >Æ‹¿z*hí.áä¹Ðb&´‰ÈE7RPHú©Š¬=Q…Ž‚qÍ!;Gô=®Fzèäœ +PÈm© ÐÕ<Älû¹¨ón"HƒÀM´2 +ÞgÕgÑJ|’˜$V8 ïHBnÈ{m(ÁJgq‡ëÞª½4ÐP9AùôÂѹ/ *NÝT'ÞÖmÑJè+p‘·t…ˆ½ÉôÈ8)ºµÕ:̈|I§ˆ‹ž8¡×8r¢ªn·šÐ¦Ön›ì‹õCwhYu]An±èä­ûÑ=ñ]ìàM)¥ÎÉC¹C:pþr[”˜.7"„Í €ýÖ#`!ÚKSW+}¢=¹¿ã¨38GͶ’›ö3 ÖXÛ/ñ…‹ÀÜÞ¼n#îÀùðž%>á»´ðv‰9ª\-ׇ½Y[ž3WçK"®’ø°nÎäz¾Fpˆ‘;$›ÈXÏ:ΟëJÓØP<í1Ò­;7&i(aÒ“\j”G`_ÆŸî~W•õgFà[Hó^¾;.?Ê“MÅðã¶\#t;Éç0¾Ù´S|)Í#òœ‘â ÛíÐg+:åš=Ø{°‡×¶ù1i¤mšþO a:UÇßEÅß塱ºåŠ3ÌrB«}Óg²G‡þBÞ¿´ ün•ç9>c#qX‰ì='ÖƒŸCüÐÀ—•^{Ýo!=DFéÁ×o|­„CwŠÎ✎ú +@#ЋRͯ‹•PδºÖB*D¸~/îÿ ­bßÒÁ*$F‹üÁˆÖJ*Bú:ƒmû~/Nõþ–ûýÓ5ûF¨‡ˆÿOH…Á…7špO6WûüI¤b&Q=N êL.2Ÿà)1yC$Žò&3Q&´­$4öù&‡œSÅö)þÆ1æ†ÇÃzo3‰qÊBݪ¬—[`.z²ª#«º[wå“…6~I„Ô Ž¨Ý-B»Õ„Ì(2@º}ÓTO–8N•þ‰ÈñýS]+õ¾…Ö¡[B:†j6yì:ú¯Ê­Õéå÷§(ÆÀ>aäëàü"Љ°\é&9« ÍÍ7Óí1e›`€74U>T*Bn_Â\GÕßϹô|ºò¥W´6µ5·½ziJ•ýwË×¢Öî!µ>PL×ŧ²K™Õñ›…£Š'‚w^FÍ 5<A"éŽÛÞ½2±O%¿)M±Š;ñ%{D +\ä÷Œ³™Û~•­‡iü‘ìÓ +14ÀgóFAYoF•Â ½1ÖÕ!¿á°«bªLÛÚ°ÜË®c ´/Ýò´-97TÉyùCfû pzÕ5<Õvžy"Y/e"´~Òæ •î°2õô½}È;S£Fƒ•.IOÔ!€ =¸›¥¤+¦DÄ Kà_踫N +^)Äaø‘¼û¼!u‘UÎí<}è‘gì{ʾ H®Òó ðMΞ‚ {v,ë±^Šö°Á›FñCìãÁÃãA"æÉ?ô¶q1¢9Ésú ºÔŠÆõ¨§jÊW]'/1d¸ÞN*e˜‹¬–))ľÙÀWÛ6ܵ:÷“Àɳ>c<9GXÞJ¿‰Ä&ˆé³ ”€Ñ‡¾1éaRLµÌ.š6±ôIa€ÞS~’Æ+/ákÛJ”$ÎG2ü¨‰”$ã&.D¬6à³³–WѸ)Oh.ÁŽ‡‰H8eU!Z@ÑYð¾nxNã{ô^8~8'ß—ÚØqV¯Q'£~†NNß œ}pÕfÄ·Òá¤oc¬d^126¢Nt~yÞÈPörÒmeãÖ^\ÍÐJÎÈ~m±îщq!ëO¥²dlb\’×]j]Ž²ÏýNK}KǬªbPsc•ÁðDñ°GCùKzjôª@ì‚x¥|Û¬¿È éy—(Ù£$CØ»bè9ïJi•0o©pç˜N³ùÊÏ!¾çêtêÇo&ªzÒ/Œö'¸Ä?þE%ÔÚÕÊð‚¦ÑðÚ<ã×üyÁð‡Kâendstream +endobj +6035 0 obj << +/Type /Page +/Contents 6036 0 R +/Resources 6034 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6020 0 R +>> endobj +6037 0 obj << +/D [6035 0 R /XYZ 85.039 781.388 null] +>> endobj +1810 0 obj << +/D [6035 0 R /XYZ 85.039 717.788 null] +>> endobj +6038 0 obj << +/D [6035 0 R /XYZ 85.039 675.441 null] +>> endobj +6034 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6043 0 obj << +/Length 2386 +/Filter /FlateDecode +>> +stream +xÚ¥ËrÛFò®¯àV« fðÖeײl‡I,q%ª|ˆs ˆD 4ŠÖ~}ú…EŠÞMÊeb¦§§§ßÝ3R#þ©QèY¶‚PYNŽ–› {´‚•J0LA18Wó‹É{Ï)ÛŠìh4ìéx–ë9£yò›ñö§7³ù»»±é8Ž¡"klAh¼}˜•qÏÐÙÝôf>½ù€3€Êx˜áòíÝ8tŒ9#Moúå7¯Þð̱ìñïóŸ/ÞÍ;N;€«ÙüzñÛïö(‘~¾°-' +G{Û–‚åÍðiy®#óüâþâ?)^sG¼ë”V<'´¼Ð9V‹òN¨Å³-ÏvI-ÍäHA;4¶U96u`,Ç&Àjü­ye9Ö¡±Ž³§‘Õò•yY%iuϘ¯SÜ(+[ NTFJ /4%?ÛÊý& µðQ0KÊhðØ=þ”ÕF"ÞJÄ(Ò%ã(#+‹I¼ƒ(½É–qÐóð0hÌT¨Ðˆ4ð)CjIIgÕlÎuY7ÿd{§ cµ;u`Ù[”Œ–uç9Obþl+äJ+†í‘XF¬2€¥†é{ƒÈ ,bP{`|APZ ÞmL°ø±Ùy…Q”Ÿh¤,*f‰@Ër³Áµ˜d½Da&ï¡o€h®cùŽO¢UeÙü06=íù6N6hiœ˜[þî³b[e‰Eð'þÖ›Åådòizs}ûéþæÝüjz{óæ㻉`×ë¸J‹x“2úg帤X¥ P½»˜3Æ™lãf=iÊÉlvÍ|ø´Ùn%î6 ’B8ÀÔŽ¥ ‚" +6¨ãA0°ÛbmÐbðp[¡yÐ"8ÑF¼ÈÙ[]Û!GCŒ$«Z^6Œ‰æžI«´H«¸:ä8: CÄM̓Dz2í†&Æ«´ãPŽ¸¤e"‡ØôÝÈxO[‘ÆML‘>PùŒB­nî—U†‘‹ä¼—~\#Ð5þØ®Œ]2´M'8¦ÜyÍÍ:Tçj-aH¯Ï–’,éÃha:=ý—‹°›9ãKrø ‰õDáEÙKGÆÕ®AncO ëÐçŒqC“gæžq’’¿Èà#[þtrîk-)–¨ú5cQ.ËŸ/‡¹7[à’PÛg¨ä!fÜm\šäG4ö¿XˆÛö”GÞ@®B[ ùc}B)˜ùT‰©C{œS±+à¤D’ ß¸([QY(ØÐ&êUUbÈl‘B02¥E$Xbh=!?Išð:ú¶2.ч½¦a¥·‡©v™ïÄ·‘\§sWé×]|B W”t{ð±Ü±$JÆm8¥¢´¯åhHs KÒ§lI¤Í‡»©ÅÀ_3NÛ’Š‘ÃŒ6_¾Ò&xÚµïlÇÓ£PewÕ i)² í´dP"¨¬ÁËÔí[!$Å3§µ(/;È‘JiËQzx\M¹rq ’B@áoï~Áχ;š<̪Œ)*ªÂpE~çÅZc.§b‹G;Á¨‰7\îNkÔË÷ôY•p^×i‹ô=¥ž;°ÓêËOªuxâ^%;¢ +ñçKòXN{D¥ JþÍ&€ao…€æhˆikRxW¦ar¨úôÿÕyEÅsÏë¼Ç9£sAú®ÎÏØëüʼn§u>8ñ¯ë¼Síw<;2šŽ0‘ZSêáîˆ*4t":€žÞ±-;äÎ榤†Á 9§PQu¥uFhWòŸ°Äp11©U¼›2ê>Ã.G jöeãSå¦me`Ž Sîa’·©™ç2UóBžQ##̘®ë÷ ݳϠ:qÄÀ^£O’%©ˆàyŸmÏN­^Ï rí[½ˆÿ ò¶d’ý±,°@‹ÓwÁ5š¶ôõð&¤­Ðw¤ËÛR)†&–ªÌîÛ‰¦ÐU–ß6…K>scO®]*áôý•£Yør(h̵ï‰=¸‹gD*ÌdÃ#®«aÑ·ì¼áDÍ1ãV£²«îºý¬Éþ+Õ¼JAÎvñª8¨~+`#6®°piò«gù}‰“}{XÖ4(Â$c”<㊠òrżèåi}–«ûRè.)Z®•ð{’°šVr§ËŸ`Ö¹!*¯e¸Ü6èøe!çüTʤ“NO΋4tìq?ÐÝ‹CÝ·hNˆ¤S íA7uMð†SšÀA&4²Ú}#ƒ@2\Üv÷!Á—oÊM{©%X»•¢£E:Î;51WiÓ¦:y˜Uä°µ Ž®¦!MOôEC¾ñÈg¦Í =Ž¸ –žu¨‘®n|E ²–‡øœ(ÿ`ÕÎËV¬„ STÞZ'Ïù•à´îmcã¬Í8hؘúó¿ÈI¶Q¤Í"+OyGEàtu™ïÄ᱿å/å Õ=WÛ®È/mÉ㈠Š¤‘\ v&ߘ?­.cÔÇ®¨AUÃg¬áÙ½ô0Izo…™<žÈE#®2VåQ~-Ò4‘¸”§JãCEðàí‚nžôXQ %g2˜ß; >ع_sM¡ñ 8êAç7x•p=ãÒÄ´j½Ò|8.ÔIû|=À¡V@êk9®?xs”²4‹¯"‹ž +ÁöÆÇrìPhq^ð}¹Ó;>¿bå,æp´cÕ âÓYýÛvh¹¾:Ïvóê«´ + HÔ=€þ(›ç9gAvn¼²`LÅ+¸‰š«´/ı¤1zŠ}6ßÓƒLÎÏ@ˆ†ñœ÷—] 1‡.d¨qûPVθÖ4»¼‰r  ¾}€Ž!<XKN$Üw÷3yŸög•<ºnsÌ$+êÛ2yÝcà ^M%¦ï²›’òT)뮲àû­DB‰99òY7òÀoüÑÀAþº·¡C+;™¸-úÛ 4øDpòÚ ÿYë¯ýÍͱB':„<­-­0›YšÍ¦#ç¥Û¿R0Ò€á?€1& endstream +endobj +6042 0 obj << +/Type /Page +/Contents 6043 0 R +/Resources 6041 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6020 0 R +>> endobj +6044 0 obj << +/D [6042 0 R /XYZ 85.039 781.388 null] +>> endobj +1814 0 obj << +/D [6042 0 R /XYZ 85.039 340.005 null] +>> endobj +6045 0 obj << +/D [6042 0 R /XYZ 85.039 297.657 null] +>> endobj +6041 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F58 3360 0 R /F41 2994 0 R /F62 4047 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6048 0 obj << +/Length 1394 +/Filter /FlateDecode +>> +stream +xÚ¥WßoÛ6~÷_!äe0±ü)‘†!Í’6–f©‹bhû XŽ#Ô–I®“ÿ~w$%+¶œ>,’w¼ûîøÝ‘a…?hE¨0AªZ³Õ„ ¼0¯{•x óf:yu¡’€Qb¨ ¦w;;ŠH%‚iþ%<{wz==¿‰b!DÈ ‰â4Õá٧눅ÝêõÍåÕôòê-Î$,²ðÓ5Š?ÜDZ„S§tyµŸþóæÔÍ¡Ñ·éûÉù´GÚcTa>L¾|£A!½ŸP"Œ¶0¦„x5œDIáçËÉÇÉ¿½)'“Û5–•N#攤œºKMê݉=wâÀ b˜Å˜'. åàGHØÉäPe_s˜Q%xˆ¢v½ûZ„©6„¥"±+I0©PøÕåŠëàï +;p1c’(–BÌL¡LÏ€$ 41ð TZv#‰–©eÀWªh?lÿ¤¸@%ˆDFõXL ïöăMðpß2¸(›z´Ñ–‡,E8¯.˜ìK4á^ïãÔMÓ1¼=¾Nçß3?û–¾%P»„,¬aT” ÇüYÄÓðV²¢ôet€Lk’¦éK™ $({F¢"rà'ûµêA:b¸z±Ÿž’”©>O¤À!™ ú‰` I¡Ñ`šÀ$ÔZ+i³jµ‚¼T˜–$ Ï뺊 ëæHOè쌇 Ç£©x,UÄ(ñ ,”¬R°<ÕP€ÏÀ²!bEÃÏLJóèÏ–8—­Ÿfåo~hÕš6[.qž„y]ü˜×GÂê<¾„| sHÇÎŽ„Ä3׶/"-êŽb)yøÙÒQKÉ€ÀPäja¹ZFÜ„mã4ëùñc¡á¼EÞúñº¶QE\÷,·öJ¤ö +æÞJ[9Émƒ²ß®;ï]5Ô^ûKåmhï –øñ:Â}77›¯”%'¶?YIöJ`¾-3€äʦ¥êôÛ¢O!ú{?È1ô↧…ItL.10”oQRÙSFÙÂò“¶ÎJ˜…w½ŸK¦­Ö¶÷_º…'krã¥_æNÄC«œ$¯Po[.«Ì[ÚE²rªè´®üä£;0w‹#rŒz1ÞDvÔÛé- ŒRö¼h¸/š“ÙfÝdyÞ¬nO\y|`Ÿ¯WYóÝRká¤w® 8YB`¥òŵΚf‹*š©s_r¥ÛPÚœ@µÍ˼èL"ÝÑü®¤‚Á7ùI*:G«AKÕÊÝ ï2<5Ç'ô.wÇ …6êlc¯‹%ONð§SÞt|š×¹…þ™Á݆ÜÝŽÏoU +O¿Dûë±YE‚‡·LÜ´ÍÇ®SIÀ©×o+çcQ Ý×.±ˆ¡uòÌ öè³™m>Õ¦o$>®ÿð¥è¢à®AA`õÆ_ ù:Ì8\þ$»”#ŠY‡Ô‚ɹ¤rלéXfwù2%\»ôIcÍÚè„ñv+§Þ÷ö ž¬‘Ћ0+ø¤¹w ƒÛbï‘cvX„Q¶>QÁuK[Ÿ ±»<ªn‹×Ç‹½«i½`ôd ™$p¤j§tk;köÝͪß[ÝâYz‚®»ÂÓðnðy¹·Ñ¶ýÃí¦WS„€£÷‹-Óm1›»)^^ÛÂzs`_[? ß6^üb1 dÝ]‹¸š9;xáe6k½* ?Ç[íXëÞºãO!Ó/½þúž'¡ 3Þò焳 æ¹Wa‰hqøŸFN[endstream +endobj +6047 0 obj << +/Type /Page +/Contents 6048 0 R +/Resources 6046 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6020 0 R +>> endobj +6039 0 obj << +/Type /XObject +/Subtype /Image +/Width 559 +/Height 468 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 29949 +/Filter /FlateDecode +>> +stream +xÚì{x ×÷‰ÜT.$HˆŠàAszzŠÐº•PÔ¥E©{iÕ­äÑœ +z\’¦¢iÕKëÒ:´”RÑöéÃQ¡T©âPÔý’«‹äý>YÏ»žygÏÌž½“ìÄ÷óÇ~Ö^{]~³fæ÷]köÌüŠŠ!„B!„B!„B){ì1çì+55µ~ýú^^^Ž0X6âÐ^ì +›úñÅóp‚a V÷¬,ïзµq[Ë+w„Ý}™¬X–',yÄ9uêTß¾}ýüüÜÝÝ###W¯^­w*càââ0bĈ´´4‘ãÆÁƒûúúV«V­W¯^Ë—/¯@Â÷ä“O~ÿý÷:+e]½^Jý”W5Xòö322j×®}íÚ5ç#V§N¬¬,“{Ö¡ªäP®·#$.VË—ú‘FMÎœ9ƒûã?Æž½oß¾aÆ™#|^¾|966vРA"¿S§Nsçν{÷.šJIIéÞ½{£êÕ«;ÎÃȺz½8¿%%%½òÊ+μÐÆ¡ûÑG™Ü³WŒôvňTh† ²dÉ“¡æù‹e‘···HW­Zõþýû毬Y³&""µZ´hqèÐ!Íòaaažžž(ÓªU+9¿Õ« }œ3gN­Zµ<<<¢££5Ï X8fÌŸbÆ÷àÁ¹ÖhüØÿr<‡* +?|øðwÞ¾ÃæÞ½{ß¹sG¯Ë^ôFCs4{W¶¦êK¯}i‰qƒKÝ-[¶È¯êyóæa1Ûºuëæêêju4 0(ÿÅ_4lØåiÒæÍ›{ôèa0–Ç°å@™·G’››;qâD??¿ÐÐÐøøx;ö¦M'…jGèmˆ™¾ôì×ûì³'Ož4éÛ! rjm G...Æu1Ѻ}û¶ñœËòO®»wïÖ«WÏ>1Âd/99-(34hžž.Ò8ÑjÖ¬i^Œ¬Ž†r4{7yñDÙ¾Ì·Ú f¶xùµQ£Fr•íX•fÊ›<`¼Š‘öàÂü§${Ó¦“Bµ#Ì\o4îËÒ~Ím192ö§ÕÃTz°¨ù믿4‰€%¶üŠ´<ÓÅ_áü.\¨,&.à@¤0íÑœ×é;š§f€'Nlݺ5ìtww·Z&¡wã6±]²Œj£l£]»vµk×­EFFnß¾] ¼LaìmÌh‡ÞhönþJ¾¥=VTù@l©r¿+wñØWÞÌ‘€yµå54[ÅȤ=gŠ{Ó¦“¤™ïËÒþ’ì)ûÆÓêáG*=\´h‘æOX8CSä×?þø“«'¦r2†³¦„bÔ¼yó9sæ?~37¸«uqÞ‰ÿ€ Ú –0LÕ°P2/F–çlvvöÚµkä$óúõëæ·ÚªûÒÍÞU-hŠ…±= ª®¡ ¦î– ZûÊ›9`ž}—é”eÒ%AAA·nÝ*ÉÞ´é¤0¸L§Üó}YÚoëžRiv§ÁáG*='Nœ¨Q£Èð-)))]ºt‘s•˜˜葸‡ôîÝ»OÌ®]»¢´“••µbÅŠ^x¡„bÛÐ ¸qãƪU«¬Ö3fÌþýûq.àlÕlsÚ´iï½÷^NNì´é?#¨óÆå‰öÁ\¸psT Khh¨Èœ={vbb"4ù©©©}úô)¡é€f調„ÒZ«bdµÁž={nÞ¼Y~9rä† `Øï¿ÿ>zôhÙŽÕP}5YÞÌ‘ yƒU1R ”I{”Lš4iÊ”)iiiW®\ÿ‰Øº7m:)T;BoCÌ÷ei¿M{JÕ¯}ãiõð#‡îÖ­[õêÕ± Æ9..Nþ´zõjLðvÆ„sÍš5Vg‰K–,éر£———Ï!C4¯ÛtÞmÛ¶­aÆ0 Q£FóæͳZ'ÐÃã~ýú æï¦3#0&,,¬J•*âº7¼q`` ­M›6e + + +pâc éîîŽQÝ´iS ÅHo4{W ÒZ«bdµÁeË–)ï(ÆÎíÝ»7†ºC‡çÏŸ÷õõ59ª¯&Ë›9† †i•­b¤(“ö(Á¬£‡Ã Gæ9vìM›N +ÕŽÐÛó}YÚoÓž²ì׎ñ´zøBˆ ==]óYËÜÜÜ•+WöíÛ·|Íì¾N:™™™ìŽ „G„¥K—*_„‰4¦²ÞÞÞ111åîûõë§÷: J¿#!„B!„B!„B!„()•¨1zá~HeÂ9_ì\öaQ¢J…ŠïÐ& ÆQcJÒHÅu‰è¢C‡Êœ>}ú¨ÂB)¿š)¬÷Þogö<"Ê@Ù‡=*²NÄp „”ã¨1%i¤B‹QݺuOœ8!¾^¾|soÍg0­6c-ÅÈq°ƒlV'¢‘G½ 'Êh#zAI”gAÔ3-X6bðª¥mø:cÆŒ5jÔ¬Y399yòäÉþþþH+_™b¹&ã)1ij‹þõ¯¡°øúÏþóÝwß5#ƒÂfbœ©¶(<<üøñãH;v¬yóæ²Xbb"ÄÃãgÏžò-z;Ȧ@3VcEW²#–PÙÀŽ Ó£ Näˆ(TæKâ$X=QFÑ J¢7‹³t¡fZP5bxHi¾¢ñÌÌÌ­[·º¸¸ˆô7ß|#·Å`•¿Z¨bÒÕæ\»v ☞žžŸŸß Aƒëׯˆ‘Aa;VFð–"rââÅ‹e˜”‰‹‹»zõ*6dæÌ™£F2ÞA6š1+ª´b•åì 0=zo=5(óQ¨Ì—$Ä©ôHïïzAIÌŸËfZP5b2ðüª´é*UªØ´V#ªØIþôòË/c1òå—_2Do ¬¶ã?#,ˆºvíŠD—.]dl)e™[·nÉÀˆz;Ȧ@3¶î²¢Ç6*³ØAazôâA”ù(TæKR¾˜ ¤”Äü¹lÖDóòH‘éÀCƾÝü6Z¨bk $ùÓš6mÚ¹sçƒZ5X¯°}ÿa. uhÛ¶­f™‚‚¹z;Ȧ@3vì²"Û#æ”Ëì 0=æŨȮ(TæKR¾˜ ¤”Äü¹l¦U#&Y#ƒm´ŸH‰­”?µiÓF*‚Uƒ5 ›#ÕÅÆÆΘ1C^£Sµƒ­€ŒwÉ@3Cd&¸’±„ÊìvP˜ËËt¥…Ê|IBÊ“ƒô‚’˜?—Í´ jÄdà!«¾]oÍÄ'Rbk $åO?cÒ`ÍÂfÄHµEEÅÏÎ`î­ŒÿŽv‰ÑHOO_¸p¡|Û¶ÞÒ–   üdrˆLW²#–P™À +Ó£ +NTêQ¨Ì—$¤|10H/(‰ùsÙL ªFL²êÛõ¶ÑL|"%¶BÒûÉà9#3… þ3RmÀz!""BÕ`tt´‡‡6Seã¤9,gÎœñòò’Y"“Á•ìˆ%Tf°ƒÂô¨‚•z*ó% !Äq,Z´Hy®¨”]Y¹r¥Ò…»ap"BH¥§°°°qãÆÊkt¥%FP¢Ÿ~ú‰#\*08!„B!„B!„B!„8F&â@™¡ì_L]iÜÙÞé]Æö¼øâ‹ t tV)ËÈDfÈÍÍ=pà€¯¯¯#ʘyÈIêÿüŸÿ£gÞ¦M›X­Z5Ÿ¾}û^¾|¹Ró~êÔ)l¸ŸŸŸ»»{ddäêÕ«õNÕó_...#FŒÏ^ݸqcðàÁ8N0ž½zõZ¾|yÙœ¼z‡¢ž=zö[¶i\ƃKØìµk×êÔ©“••E7N12¦,#™ÜR«2aw™’ cYÔÞ½{ƒƒƒõ¬íܹó®]»²‹Y¼x±*Ò_¥AoÀÏœ9S»ví?þ8###°oß¾aÆ™£¢â»è¡Ý±±±ƒ ù:uš;wîÝ»wÑTJJJ÷îÝËLŒ4 ëÙ£g¿e›Æeì£6‹ôÑGÑW%²|O©*Tæ±dktû"i†Ý±5NâkG3U¬Æúqô`ÚÿÄOœ8qÂŒµyyyXX® +£¢¢äW¤‘ST²à>ÒƒƒD3¦}ñ§ |È!"↙CBóU˜Û{{{‹4 ƒVÇY/“æ&ÃoÏ™3§V­Z8$¢££m#={ôì7SFÏ]hÚ¯émÌ4«w`€Í›7÷èÑÃi¯[’ÎUT¡‚4 ÛƾH@šawìˆSS6b„ÇÕÕ5$$äÍ7ßÔ¼t`2ÖƒFàÆûÛß~ûí7“xìرŽ;Zæ8ð—_~^zé%cÌ÷‘ÆŒfLŸ’ÄŸÒÜä:uê\¹r¥$btóæM’B9{öl(fNNŽÕѶ Ƥ¹ÉX®¾õÖ[èS…#GŽØ$FzöèÙo¦Œž»°†É¦fõö#¸xñ¢|Ó/Ũò‰‘™¯¶F‡±;@vÇŽ85e F‚‚‚‚sçÎÁch^p°uJw°`JduÅe||ž?Þò×õë× oûŸÿüÇØ3Á}d3㣌éSêñ§ÜÜÜòóóí#TݦàDvD&RU× »cGœ“×[J’Ó¹sç”””û÷ï_½z‹™§e׶‚ƒFÀÀW@eÄVܾ};99Yï°¤¤$¸²O>ùĪ f‚ûÈ2¶†¯*õøS'Nœ¨Q£6<##U0]ºt‘«°˜˜葸¦„4:5n­k×®hídee­X±â…^°,c2“ü:f̘ýû÷ãl…ŽµIŒôì)K12ö6zÍêíÇ"ÞÀP¹0ŽŸrèСˆˆ¬‹ÃÃÃ?ûì3›‚Ù™HU]3ìŽqj4¯¥kÚiw™üñ¥—^‚µAAAP"Í¿l„R«>dïÞ½Ø + #GŽÔ»1ïòåË®®®ðŸVm0ÜÇÌÝtšÖ:"þÔáÇaõêÕÑ,fbqqqò§Õ«WcNŽ ÇT|Íš5Và’%K:vìèåå…Þ‡ ¢ùß–É`LòkZZD‡DýúõlúÏHÏž²#co£×¬ÁÝtÆ ÃäbD}ý#ÀÀ=®\¹R§NùÇ%!tÅBÊž~ýúñu@„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„B!„8;v<{ö¬ƒß³gOPPPýúõU=îܹӦ*„B*¿üòK‹-D:333,,L³˜,c7÷ï߯W¯ÞÏ?ÿ¬l=úøøää䘩Rfã@!¤ŒY¸pá´iÓDzëÖ­C† qPG[¶l‰‰‰Qe¢Ç®]»ÚT¥ ÆBˆäâÅ‹pÅÞÞÞM›6]½zµÈ>>22R”„+†'ÿý÷ßQøõ×_÷óóKLLÌÈÈ€W‡: À_ýÕ¨Q£íÛ·£Àºuë6l(*Š«d÷ïß_Qæù矇ÛG1týøãËöO:%]ºtQ¸uëV“&M°ŠA&äÉÍÍíòåË–›Ëa¡ªAôøÛo¿é™'«løèÑ£ïܹcr$………h­V­Zšã@!Dÿ‰¹½2çÕW_]±b…HÃsV­Z‰3gÎÀ{ˆüÅ‹¿öÚk"}òäÉÐÐP$à±—-[&2sssEEðõ×_wïÞ]®n”í@,4h Ú‡Xv$ LŸ>!nÍ›7·Ü–7!ÈÑ#ÖAzæ)«˜Ùp3ã €´}ûí·°YþI¤B!J–/_ˆÙûçŸ.r‚‚‚nÞ¼)Òׯ_Fn|âĉ²VLLÌ—_~)Ò~øáرcEÅÇÈ¥Üõûï¿/ÒIIIÊvàüÇŒ#Ú‡XXv$ `Q#—B .œ2eŠH×®]}áiô"Q6ˆG¥gž²Š™ 73Xc¶jÕªiÓ¦øµY³fS§NµB!* + ÷íÛW£F ñÕÍÍM^JJNN×îzõêµmÛ6‘ùàÁ__ßôôtñµOŸ>_}õ•¨ˆ‡eû7†–Þ[¶ú÷ï¿iÓ&ѾLh@ãyyy"³sçλví²ìèù矅• ¢Ç7ꙧ¬buÃMŽCddä–-[DfÇŽ÷ìÙc9„B$LJ{„‹Þ°aÃÓO?-2áKrrrvîÜröìYð÷÷ÏÊÊà]Ÿyæ‘ÎÏχŠedd ݲeË¥K—¢âéÓ§'L˜ {©^½úO?ý„Ô…e;5kÖLKKCûðê"¡ìH@ë¸úÌÌL¬tРå}Ú¨ëãã# +ËÑ#wïÞÕ4OYÅ̆›ooï“'OÞ¹sgîܹhš¥B!JÖ­[פI//¯=züùçŸ"óÀM›6uwwꩧÄl)))ÑÑѲִiÓâââDúÇ”955µuëÖ®®®5JLL”å!h Z°ÿ~e;è]ˆöeB³øôÓOáÌëÕ«‡µRTT”å¶ÈF”iô(3-ÍSV1³á&ÇaíÚµµk×nÞ¼ùèÑ£{öìi9<ð!¤BsãÆÁƒÏž=›CA!¤ìiÕªU•*U|||úõë'/¬B!„B!„B!„B!„B!„B!„B!„B!„B!„B©”Ì™3ç1»@EŽ!„Š!„Ê$F6)Ëܹs)F„B(F„B(F#B!#B!#Š!„Š!„ŠňBňBňbD!„bD!„bD1"„B1"„B1¢B¡B©LeÁ'ňBˆã¸qãFDDD)'bdºC§yB!*= +/-12ŽÇ‡Ž¨D„BŒõÈbáÐÆ !‘Y³fåæærH™I•ˆb |B³fÍ8À¡ e T"Bˆž—É“'gggs@ˆãäƒJD1#WWW|†††¦¤¤pLˆ#D„JD±*FGmÙ²¥X";6##ƒ#CJQJ¨D„3b„D^^^\\\ÕªUñ5((hÇŽR*‚B%"„˜#ÁÉ“'£¢¢Dæ°aÃnß¾Í!"%‘*!Ä1ñññžžžÈØ´iG‰Ø'.T"BˆÝb$8wî\‡įýúõ»víÇŠØ$1T"B*7sJ=1………ÉÉÉÕªUC__ßÏ>ûŒƒOL + •ˆGd-SºtwéÒ¥îÝ»‹bHà+w1–*!Ž•îúÈj§Xaq„~±PÂr ‹&î¢):T"B)1*û~¯]»Ö¯_?Ñ{‡Î;Ç}ATÒC%"„bT6lÚ´) xzzÆÇÇpP„Õ)†JDMÇŽÏž=[ýãÿØ¿å´={öÕ¯_¿Òˆ¸}ûö°aÄQQQ'Ožt„à–{ eÓf%Ó#*q¿üòK‹-D:333,,L³˜,S*¤§§ûùùåååÙT«tm(9žû÷ï׫WïçŸ.]#Ë]Œ;vì€ÎÂ’ªU«ÆÅÅÙºË(F•OZC%"¥ÎÂ… §M›&Ò[·n2dHtúÕW_ÅÄÄ8Ãæfee•¤…-[¶8b[œDŒ@FFÆرc]\\`OË–-=J1z”É)†ãðHqñâEx9ooï¦M›®^½Zd9r¤}ûöX&:tHdŽ?î¢mÛ¶îîî!!!ß}÷Ýĉƒƒƒýýý?ùäQæôéÓݺuóòòÂ4~çÎ"í §‡’ø:a„Y³f!³Zµjýû÷OMM•í'$$ˆh×® èÛ·ïáÇE³gÏvíÚ™°iÙ©’ÿýïÝ»w÷ôô„aX%%%iZµ~ýzt-ªäçç7lØð§Ÿ~RÚpþüùøøø4jÔH ‹æ¦™L(ohh(6ù+W®4(ËN…=òªE`` ±‘WŒ)))b¬\]]qy¿ά×^{M¤Ož<‰9$ð‡Ë–-“ÓKQ|ýõ×X­ÈÕ²œÚ 4í G­êH˜>}º˜¦Š…[óæÍ-·N†‰4ÚÿLéY‘=vìæ·ðxÿýï•6 Êû￯lY¯«ƒ SÛ´i#ÒðBXTêµfÙ©´ƒ ï[00’bdõ‚¦˜X–¡G‘ÆZ’aÙv¥òÂËôôt‘Ʋ3ËîîÝ»‡%žHã¨V¾*–bDˆŠåË—â ýüóÏENPP<±‚FÎsâĉ²VLL æù"ýᇎ;VTT>‰/—-é61WT¶Õ3fŒh_ÌíUÉXJÈ¥ÐÂ… §L™"Òµk×F_øç»,ƒvÆo`Z€ºa«±L“U„ ØdÕ?§z({×LÌÉgÍš%ÒXË`+ôZ³ìTڃѓ #y™Îªa¡Š5µH_ºt GZëÖ­±¿0IÅÐ5¦(ª°:þ¼2í(w¢Ô2Õxʯ(¯|¼—bDˆ%8GöíÛW£F yÖÈKjÉÉÉârS¯^½¶mÛ&§‘¾¾¾rZاOŸ¯¾úJTÄ<ß²ýÆ?~\ª˜lôïß_¼ÉíË„f4.o²êܹó®]»,;ÂC–AG[¶l1°jÇŽ={ölÑ¢…üOJÚ€*˜ÓªdéÒ¥¨xúôé &È^ªW¯.n€R °l§   fÍšiiihê&ÊŽd±€äeffbm…5ï´A™­[·B%!ghÇتììly‹š´A¸©wß}U~ýõ×qãÆ4b<˜°úˆÙ>6&aY$^X­ÙšªSå˜øøøÃŒ¬¸bäè[»þùg¨=B¯¾úªÈÇ¡ˆ]ƒ|,0W­Z%ÇaÒ¤IX5c±’ÿÉŸ —_ýµHÏž=òtçÎX›ššŠ)™±a¿ÿ~¬¹°"‹¥¢dݺuMš4ñòòêѣǟþ)28дiSww÷§žzJ¬pÎFGGËZÓ¦MƒÇiÌ¥0á”lݺµ««+¼.ÎSYòÖàq2*ÛAGèB´/šŠŠo3€a:ŠµRTT”ææ|öÙgðÛ(Ö¯_?«V:ȸ´ÀwA‘±ô@ñçŽA#ƒ elÛ¶mxx86¿}ûö¿ýö›IªN•c" 36²"ŠQ<ôŠ!êÚµ«§§'&6ÿüç?åß‘˜4lØPì…yóæÉqÀzsäÈ‘8êׯÿÞ{ï)röÜsωkÎhÖ AìÜnݺɥ«žAÝ^xáÌÐ,&{#B*4˜Ä<“Ò +a-V=âÞr§…¯"„›hÕªU•*U0_ŪG\§r~0åvòW€òE©Ä©ŽF›ò !•éôg â$êSê¢C#¤b‰ƒëŠ!¥Èµk×NŸ>Íq0ÃŽM<UµjÕÀÀÀ¡C‡ŠÌû÷ï3Ƨ˜qãÆÉ;Õ±Og̘Q£Fš5kb/Ož<ÙßßéÍ›7‹š¯N²œÃè½IIT¯Zš7o^:uÐ~·nÝăƖíØŸ˜˜æááѳgOùÂ(ÍA Ä*YYYÍ‹)á+II ×Y–ùçÎëСƒøµ_¿~âþvâÌ„„„ìÝ»777÷ìÙ³óçϙӧO_´hѽ{÷²³³,X’ûe233·nÝêââ"Òß|ó|Ã’Á«“TÇæ›””b¤Y`É’%ñññèùPeyeûöÇÅÅ]½z?Íœ9S¾0Js±ÊÀ…»C‚£á$bTPP/ù*òäýÏÄÉÁ*kåKeAݺuå½CøI>>,wºò­JHW©RE¤Í¼:©HÿMJšâ¢,ШQ#åMMzbdÕþ¢â÷[ÊFi!ÆÀãáˆr+ ù;RŽbtòäɨ¨(‘9lØ0å›Ùˆ“³k×®víÚÁÛGFFnß¾]d⫼ÛäáÇòÅJÊ®™¶õÕIzšbðª%åœôÊ›±Ó'™¯9„ðÃ?à€Á¾¹$ðU¾„‡”½åååÅÅÅU­Z_ƒ‚‚vìØÁÁ©ˆdgg¯]»KZñ588X.°ÀÁBä¼:ISDl#X¨|5–²¼²}3ö#_¼SoÑãÊ•+8œbccEŽx× +2ñǧìÅèèÑ£-[¶à±cÇŠ—2‘ŠÅ|páÂL*vïÞ-ÞÉ_Tüê•÷Þ{/''ž_õŸ‹±é½:)$$dãÆR/죑#GnØ°!??ÿ÷ß=z´ÌWµo`?¬Bõôôô… öíÛ×`ÑÇÉßÿþwK:u’Ïï#¯ÈÄO¥û–3bFŒ°,Å'NÞ””ŽIîÓ977·6mÚÈ(w£‹‘Þ«“¶mÛV¥Jñ/’Ýb„õNïÞ½=<<:tèpþüy___Íö 쎎Ful2tK!ƒA D“7Þx–Ûª4øŠLü„¥2#,ˆ&Ož,ÏhBÊŒÜÜÜ•+WÊ¥ùã–CGJºuëÄ{ž•/ö— Sügb«2£fÍšqIÊžúõëc ãíícë³#RŽ?.nþøãõÊà'ñNM‰8z¡j2ê!„TÒÒÒ 4#GŽ4.‰(†Âåݪ„B*………½zõ‚Ä´nÝZF¤ÕP …Q…/ä$„RZˆ8h~~~.\0SÅPUP‘£G!¤äìڵ˥$]‹B)Ý5Ž­ë)B!Ä’þûcÓ?M„Bˆ&%¿/Îü=x„Bˆ%¥õÄ™§“!„KJ÷] +Æïm „B,qÄ[æôÞhG!„Xâ ÷ok¾ë›RÆÌ;÷1»˜3gG”%Ž‹Ld‰RÆ@S(FÄùqtÌVe|XŽ6!å%F6)‹U) §OŸ®V­ŽºøøxÇõ‚ÆÑ:BwsBœ_ŒÄ•=Š)²²²š5kf¼N·µMãÖÐ:åÈB1"D2hÐ «KWŒ:åÈB1"Ä&Y)›Z„Š!#B(F#B1"„PŒ¡B1¢Š!„bDňŠňPŒ!#B(F„PŒ(F„bD¡B1"„bD1"#BňŠ!š7nDDD¿úb«€îÐ)GžPŒ!*= +/­HyÆb„Ž¨D„bD1Ö#Gˆ…C'„bDõˆJD(FN²™äQ€zD%"#Š¡UD=¢Š‘3o&yfꕈPŒè¦÷rùꕈPŒè¦÷rùꕈPŒM7U^6”¤ßÔÔÔúõë{yy)Ûqνÿ(O9ì*qÂó·ÒÿS\ÆŸ8q"&&Æ×××ÓÓó™gžyÿý÷º]...#FŒHKK+uµzòÉ'¿ÿþ{½òNu<âë_›Ä…JD(F•ÞM>}ºvíÚ«W¯Î.fïÞ½;wvè’§°°ðòå˱±±ƒ *u1ª^½ºAyŠQEÔ#*!Îæ¦>|øÎ;ï@;°„éÝ»÷;w,ËÀÕÏ›7¯N:(Ó­[7WWW㾜`ìó‘˜1cF5jÖ¬™œœ·nß#ðª¯h³°°P¤>|(Ÿ÷×ìQ¯°ÕÛ•í³ÍêSÿÊöõ^•PönÊAÿ|9ÏdÉ&cÊÆrŠ!¥{²7oÞ|Îœ9Ç¿yófnn®êWÕsëö=¯ª,—?X³`ícУ^a«bd`›ÁûvÌ‹‘Á«(FåÛ/ňŠ(F5jÔHIIÉÏÏ¿qãƪU«ä¯šÏ­Û÷¼ªÖ´iÓÞ{｜œ8såß@š=ê¶*Fz¶©Œ±[ŒŒ_•@1¢Bl:U·mÛÖ°aCWW×FÍ›7Oél-Ÿ[·ïxU-½ä4{4¸›ÎXŒôlSc·¿*AïZ“ñ€E:w6†‡‡céŠÄ±cÇ°’ÕlyïÞ½O=õêÆÄÄȵ¤™JzÁŒ¬Ž€Þý„zùzÆ <ÖæµjÕ‚ÑÑÑÆ—éônnTÖ,c2þ‘™A£Bœ ËW%ˆ‘ñ€ÕðøŠÄâÅ‹eàUËX6^½zãããe@"3”ô‚Y#½û õòõŒÁF½õÖ[7oÞÄöÈ‘#VÅHóæFUaÍ2&oþ43h#Bˆó ÷ª1’Z£y Jd,ˆºvíŠD—.]Nž}šnŠp/ëýí·ßÂW‹ÿ2àóÛ´i#~ÊËËsww×Ë<{ö¬¸§åÌ™3ÂßÂ-¿ÿþûV»_ýu÷îÝEZVõÕWW¬X!2á±ÅÃÂø /ÃÕ7hÐ@¶Ü­[7qû„¦…š Ìg¾ûî;•‘J“4ËXnÊ6¹!šÆXvA²²²šS’ËÈ#RY÷2æüXV4mÚ+ÍfÍšM:™ ,˜5k–(€µÖ>z™IIIâYæeË–‰eBppð7¬v^{í5éØeõ   ›7oŠÌëׯ‹;0ñëĉeƒ—1cƈ4db$Òšj6–/_ˆÅËçŸ.[Vš¤YÆrëT¶É Ñ4Ʋ òè0pà@qj#A7E¸—UDFFnÙ²E¤;vì¸gÏ‘øá‡Dfbbâ›o¾©— }Ù¸q#½zõ÷c¸¹¹)o¿×ë4nÜX¼ŠJU]^ÂJNNÇðë¶mÛdƒýû÷…±̉‹„zj6((,,Ü·o_5dŽÒ$Í2–[§²Mnˆ¦1š]GøøxœÔnÅ ¯tS„{Y‰··÷É“'ïܹ3wî\ŸdffV­Z5%%%//nSúk×®if"íëë{÷îÝÜÜ\$ÄË1š7oþî»ïæääüúë¯ãÆÓìBt]½zõŸ~ú©¨øvYÊ•€êXò„„„ˆ7/ùûûË+ š5kŠÂÑEQñ1–j6ˆÌáÇCÐò† ž~úi9Ò$½2ª­SÙ&7DÏUäÓWWW—ÍÅ ¯r®RùܤöÅ_´©5yk´ŸŸŸsn¬Mù%ÜvŒž¸ ê‘£µk×Ö®]>vôèÑ={ö,*¾U»mÛ¶áááîîîíÛ·ëÍÌýû÷?õÔSHÀëŠøùçŸáÿ1ýƒ^¶l™f‚¤¤$´Ö²eKeõ4mÚùÈ·Ìá×èèhY Dጌ ¬2äE3M 5ëÖ­kÒ¤‰——W=þüóOK“ôʨ¶Ne›Ü=cT]G+W®⌎9â™Gdâ§Ê'F81q¾ÛzwY«V­DBþÓêípž·£W§Ngøo±|׿&L€Ã4“Y¾Ìœ9sáÂ…Îi¡)°4þûßÿŽÓ¹S§Nʇ4ñ™ø *™áÈå•WlmM¾ ÿþšinû°aÃ>úè£G\Œ0ç?wÌrK¬w”7H;•…Î6\¤¼xã7p.×­[WÞE#ÀWdâ'¨dbÔ«W/ùq ÛWÆß)Ò‰‚tðàÁ¨¨(db¥9tèPi˜¤Ètˆ%zá‡TUD~nn.lu‘¯¹³£_ÉæÍ›{ôèñˆ‹!¤TX·nNd8ÍàhÈÄO(€b•IŒ ²—.]R³3í+ãïHTQBBBöîÝ çöìÙùóçk.dL†øQ¢~HUEæ8ð—_~)*„ñÒK/ÙݯäâÅ‹òÖ_Š!ÄnŽ?Žù0Nä?þX¯ ~B«ˆ7Xê¹)lN©\{4ðÊ(HXw$''ËÈ­šuM†øQ¢~HïpëׯÁâcccÿóŸÿØݯc(ã\PŒ!öÉpXXÎâ‘#G—DCae¤¶Ê$F%Y)¿êEAÚµkW»ví\]]###·oß®Y×dˆUÍðCzbÑÁb UÂÃÃ333íîW‚µžÁE<Š!Ä*ðH½zõÂ) Ïiõ½O(€b(Œ*JïWqÅHu™®´VFQ@vvöÚµkd]eä;“!~”è…2xŸösÏ=ÿüóÏ—¤_¥øò2!¤$ˆ°~~~&£k¡ +£ +*V1êÙ³çæÍ›K]Œô¢ }ðÁ@¬ÅvïÞ*2CBB6nÜ(õÈdˆ%zᇠÄ()) «ÂO>ùDæØѯ„70BJ®]»\ŠAÂѵœÓM-[¶ÌŽ[»­Š‘^¤‘#Gº¹¹µiÓæÀ²pXXX•*UÄß4&Cü(Ñ ?d F—/_†yÊ×…ÙѯdØ°a"ňb+%YãغžrZ7•žžnÇC¯DÉ•+WêÔ©#ÿ{¢BÌSÂlú§É™Å,]ºÔÖ×%ýúõ{_D)J~_œù{ðè¦÷2!Ä’ÒzbÈÌÓItS„{™bIé¾KÁø½ tS„{¹Œ™3gÎcvŠ<„H™áˆ·Ìé½ÑŽnŠp/SŒ±ÄAïßÖ|×7Ýá^.G1²IYì¨BHIp\d"Ë(HÎé¦È£ÅˆbDœGÇlUƇ¥ŠňKNŸ>]­Z5oñññŽë£ t„î8æ„PŒQ’••Õ¬Y³ÒL·†îœ!5!#Šq TêW6¬6ˆN9ò„PŒ±IVʦ!„bDňŠňPŒ!#B(F„PŒ(F„bD¡B1"„bD1"#BňŠ!#Š¡B(F„PŒ©ܸq#""¢ƒY „îÐ)GžPŒ!*= +/1BGT"B1"„ë‘#Ä¡B1"„zD%"#Bˆ“땈PŒ!å+T"B1"„”¯ˆP‰ňR¾zD%"#BHùꕈPŒ!å«GT"B1"„”¯Q‰ňR¾zD%"N(FöÁÑ#¤‚ꕈPŒ!å«GT"B!å«GT"B!å«GT"B!å®GT"B!å®GT"B!å®GT"b+;vܹsgùÚðàÁƒfÍš]¸pÁîþñìß¿Ÿ{“g ''‡JDl"33ÓÇÇGÒ-Z´°©î/¿ü¢¬bku% .œ9s¦ÝÕÓÓÓýüüòòò*ÐÈ«FB*%………YYYV3·nÝÚµkW»dÚ´i¥²¨oܸqFF†Ý-|õÕW111¥>\¥´FBœÎ;ciãêêþã?ŠÌ!C†„††>öØcÞÞÞ+W®4Èœ0aÂÒ¥K‘?~|BBçÏŸ0`ÚlÔ¨ÑêÕ«õº€óÿQúûû+«9r¤}ûö(|èÐ!Qx|1íÚµC~ß¾}>¬Ü„qãÆ%''¯_¿¾ÿþ"'??¿aÆ?ýô“AÝÿýïÝ»w÷ôô  KJJRŒå†´jÕJÙõ›o¾yðàA½‘¹xñ"¶9M›6Õ-a”¨¨( 7Pší¨FïôéÓݺuóòòªW¯ž¼dªjœB*Ä:h÷îݵjÕi$Þ~ûm¬5¾üò˽LGýÛo¿!wêÔ©+W®@6lØpÿþý'NŒ=Z³‹¢ÿw}ÅÄWQýܹshÅrrrâãã###å¯]ºtN=xð¢óøãËfÑ;4¢  àúõë號~ú©\¯iÖ½uëÖO<±iÓ¦ÜÜÜË—/׬YóÌ™3ʱÜk×®>|øP–iÓ¦M^^žÞÈ@Ð:=~üøˆ#4‡¶¡å;wîèí ½v”£÷×_a/lß¾eÖ­[³ '„§ðí·ßÂù‹ÿ à·áfÅOp¶îîîz™gÏžÅT xrá„áýÞÿ}«]€¯¿þ ‘–Õ_}õÕ+VˆLxÚªU«Š_á`!7"šÕ AÙ2Vr-ñ:vìô¢I“&ÿýï êN:uñâŲw˵ƒå†@à^zé%ùõÂ… Ï=÷œÞȬe¾ûî;ƒaWÙ¦7Pší(G¦.[¶L¤¡­šƒF!Î &ÛXV4mÚ4&&¦Y³fpÑÈ\°`Á¬Y³ä³n½Ì¤¤¤Q£F!g(AÁÁÁª{`4»¯½öšôö²zPPÐÍ›7E&V:hMü:qâDÙ Ôj̘1" ‚ÉŸ¦L™7þùçŸ?ÿüó²eͺpÔXÉ2ãÇWŒå†@‰V­Z%¿&''¿ûî»z#–/_Ž•8°GÖª]»öc=†OKÛôJ³åèaДoá+#Uã„âÌ`)±eË‘îرãž={Dâ‡~™‰‰‰o¾ù¦^&ÜæÆ‘èիצM›pss»wïžÕ.@ãÆá~EZY]^¸ƒ·W¥ðë¶mÛdƒýû÷…1í‡÷ ;vìèÙ³'ÖòŸ½ºX>È{ç°ÒB‰å†@ÄjKЧOŸï¿ÿ^odä·}ûöÕ¨QCsðU¶é ”f;Êу©X7N!ÎŒ··÷É“'ïܹ3wî\ŸdffÂQ§¤¤ÀWÛažíÚ5ÍL¤}}}ïÞ½ OˆDZZlÞ¼9Ö 999¿þúë¸qã4»]W¯^]Ü` ¬‡œ€êXò„„„œ={¿úûûËÕ @5kÖ…¡V¢ Ivv¶‡‡‡¼/Π.>[·nMOOÇæ Œ¼/**J$,7ÄËË «üüü'N¼þúëÕªUƒnjŽ +>b6lØðôÓO[Ž¼Ê6½ÒkGŽhÙ²åÒ¥KaêéÓ§'L˜ Ù8!„83k×®­]»6ïèÑ£±¦(*¾U»mÛ¶áááîîîíÛ·ëÍÌýû÷?õÔSHÀ‹øùçŸ!(˜«Ã-‹?2,»$%%¡58Reõ4mÚùÈ«ü-k¡€( ùÀêÀò±¸:=zT¤õê‚Ï>û .½_¿~Ï<óŒ,Ó®];½ Áª'00Ò1dÈQKsdÀºuëš4iýêѣǟþi9ò*ÛôJ¯9zH§¦¦¶nÝÚÕÕ¦ÂHÍÆ !¤b©µåMΚ™åËÌ™3.\èœÃE±Æ#J0»>wÌrk, ä¿KÎ6\„Š!„çÑ—ÄÄÄ°°0ž={Þ½{Wä|(ëÚÔ&!e̵b8„8­ݹsG¼SE’½víÚ€€YXùîG–ËÔÅBÉŽ6 )K²²²š7oÞ¬Y3>æIˆ³‰Qjjj~~~zzúÂ… ûöí+ò?øàƒ .äååíÞ½;44Td†„„lܸQêÑ´iÓÞ{｜œœ{÷î©þ32ß&!eÉÀÅ8Hp4q*1ŠŽŽöðð œ={6–-"äÈ‘ÈqsskÓ¦ÍDæ¶mÛªT©R³fÍ"ûéÌ·IH™ƒG`µjÕÀWŽ !Î#F¢MBJÈ?üàêêêââ²¹$ðU¾¶”B1"ÄÑ\¹r«r™±±±" |E&~âøBq4yyyÿûß!=:u’!äÀWdâ'!‚Bqo¼ñD§nݺ2Ÿ_‘‰ŸPÀA]?Fˆƒá NH…`ݺu8a«V­zèÐ!Ë_‘‰ŸPÅ(F„bDqÇ÷ôôÄ ûñÇë•ÁO(€b2j©‹wqÜT‡ã@ˆ““––†³uäÈ‘Æ%QÅPX¾ÞŠî‚PŒ!%§°°°W¯^8U[·nm5˜ +  +£Š|ÃÝ¡BJȼyópžúùù]¸pÁLyCaTAEº B1r6æÎkßjsæÌá¡BÊ‹]»v¹ƒ„£kÑ]ŠQM¡‘ŠEIÖ8¶®§è.Ũ,ÅÈ&e±£ +!¥E ÿý±éŸ&º B1¢¢IÉï‹3ž³¹ ½Žm€}í——µ#Š!Ž¦´ž2ótR#'ïWUÝdk§NêÛ·¯ŸŸŸ»»{ddäêÕ«õªË±/\\\FŒ!§+7nÜ::Zs›5köûï¿#qõêU,FDú?þ@¾Ò*Ë7Ûèm…’!C†,Y²Ä¤2ªÄH€e‘···H££RùbD1"8zÿ¶æ»¾ä.Zž7oü6– “&M>|¸È_¼xñ[o½Æ9rDsß~ûí?ü°¨øÚéã?¾`Á¤W­Z5kÖ,0Ø +%uêÔÑ üaRŒ`<ÄT¤!ë³gφ¾çääPŒ(F„Øã"YFArœ»€a!ÒXŒ$''ËŠ%š”AV\]] ¼ñ­[·¤7ÖËoРAzzºHcY$â;ƒ† Þ¾}ÛøÂÚÑ£G €–Zï¿ÿ~»ví†Ì¥¦¦Z#Í­Pâææ–ŸŸoŸ¡â™3g°œ;w®È¿páLõññA³Ï>ûìÉ“')F#BlÅÑ1[•ñaKÝ]\ºtiâĉ­[·†ÿwww—%wíÚï~###·oßnYQ³€žW×tûXëÁ÷ç#¡¼†&µùÊÛæõ6ðoû[VVV£F>|X¯^=ll·nÝŒ,EæþBÂpýõ×_šbLÐüŠ´r3EÐyˆéÂ… •ÅŠŠ¯=B¤°pÓ\‹QŒ(F„púôéjÕªáx‹w\/h] #tWºî¢yóæ8SŽ?~óæÍÜÜ\UÉìììµk×èUW°IŒ°Ò 6·‚\¿~]S °Ž³*FÓ§Oÿ׿þ5a¤¡¹³gÏž2eŠ¦yJ]0#F\´h‘f§!!!Ðùõ?þÀúÎØNÕúÔÓÓ“bD1"Ä<˜u7kÖ¬tC½·†îÐi)º‹5j¤¤¤äçç߸qcÕªU²ä|páÂ…¼¼¼Ý»w‡††ZVÔ,`FŒRSSÑ]zz:–}ûö5·|$&&BžÐ +ôéÓGä3fÿþýP,vÄ5RÍ­;xð |Ïž=HïÝ»iåêUÖ‚|lܸQê‘1:qâ†.999##ãÞ½{Ã.]ºÈ5cLL ôH\ŽCCd,F]»vE h;wÅŠ/¼ð‚ü)((CM1¢bÀ AƒJ=î˜ÕåýÀ¥â.¶mÛÖ°aCWW×F‰7‰ü‘#Gº¹¹µiÓæÀ–5 ˜£èèhÔ…Ð`aeœ_PP‰ÄÊÂÝݽ[·n›6mùiiiðØ(_¿~ý„„½ ,,,Œˆˆîà3<<\s„A «R¥ŠøOÊäÞ‡†IÕ«WÇ DFFÆÅÅÉŸV¯^]·n]Œ*–xkÖ¬±ÚÔ’%K:vìèåååãã3dÈùO´ ™¥U„bD1"%£Êê.øÒ›X¹rå+¯¼RùrŠ!#ŠQJôÓO?QŒ(F„PŒáÑE1"#º B1*3nܸaü§­|:Ì Vãñ¡;tʉPŒáÑ¥Ò£ðððÒŠ”gQ‰ň]Æzä±phã„T\1²µ¯ +ú^nMRSSëׯïååÅc•bT6’A%"#g‡ökPñÉ'Ÿ”o)'#G •ˆPŒ(FšT¯^G)ŨläƒJD(F&/ÓéñÑ‹¤iÈÖÈD¥Ø¯e;oðŒaôÅ_4lØÕñõþýûcÆŒñ)fܸqò=x(6cÆŒ5jÔ¬Y399yòäÉþþþHë½ÃV3V”Þ&ÃM‰ÁÇŽkÞ¼9ŨÒ蕈PŒl#Í >z‘ƒô" Ù™¨û5¥d¼hBzÖ¬YRÚ¦OŸ¾hÑ"lzY°`Hƒ™™™[·nuqqéo¾ùFÆÒD+JÏTˆ¬؇m·éþaŠ‘3땈PŒl#™© â£9H/Ò­‘‰ѯf(%«b¤ü©nݺòpXÜÕ«WOULû é*Uªïey=S± êÚµ+]ºt©(!‘{5í*¡•DŒ”_õ"éE²52‘#ú5Ø.“b½«™©.Ћeð"V¬’ ‚mÛ¶­Üù#¢GT"B1*E1Ò‹¤iÈÖÈDŽè·H?V‘I1‚Ùòß.lJvˆ‘^¬(1Š1cFE¹FWôˆ=Åf“¸P‰*³f͹I1ªb¤9H/Ò­‘‰J±_ÍvT±ŠLŠÑ´iÓÞ{｜œœ{÷î©þ32/Fz±¢ Ä[äééÉ°ã]¨DènÖ¬™f”Š‘³‰‘^ä ½HC¶F&*Å~5ÛQÅ*2)FwÓ™#½XQb„5TDDD¥?È+·Q‰*Üìââ2yòdé¬(Få"FŽØjáv³hÑ¢ +t®èQ}Ù”ÜP‰*¢—ÆŒŸ¡¡¡)))#Š),,lܸqºFWô¿ùPSt¨DÔK=z´eË–b‰4vìØŒŒ ŠQ_”Jƒ¼RꕨBÀyyyqqqU«VÅ×   ;vð<¥ŠQ…Ó£:ÅP‰*ú|òäɨ¨(‘9lØ0壎#º B1ªzD%ªpAAA||¼§§'òä-R•`3íƒî‚PŒ*µ(†JTiàsçÎuèÐAüÚ¯_¿k×®QŒÊÑ]8•“)‰1Ý3¯zpþáµÛŠ‘ §ŽC0·T18€ “““«U«†¾¾¾Ÿ}ößÑbtâĉ˜˜Œ6V¦Ï<óÌûï¿_ŠÞRÕ¦ŽƒF_ØŽzõZ¾|¹3¨UI4/FN®>#Ré'ùvLþ/]ºÔ½{wQ |å.p>}ºvíÚ«W¯Î.fïÞ½;wvœuêÔ ³‘»w””ì\Šň[¹9¥ŠÕN±,Âýbå’òµ™¤´ÜÖ) z5Ãîè½ààÁƒQQQ(8tèÐ"­pBøÕ-ûÊÍÍ8q¢ŸŸ_hhh|||‘E€!¥Ï·Œ—d<ϱ³ÉŒåEúÁ‰,¹eIËeyƒ·=hZ«ÄöhVÑ E1"Îy©ÇA\»v­_¿~¢÷:œ;wŽû¢t÷]­Zµ®^½ªWQ3ìŽ^¬Ÿ,¬PUæÏŸ¯9߆ϟ={6œ¿ê{llì¤I“ÒÒÒ.^¼øòË/YRú|ÍxI%‰ÙdÆr‰ep"½òz%U_ b'iZ«¤$u-íѬ¢@ŠbD)1lÚ´) `n†isAA÷Hií;7779žª…€^ؽX?˜+ß6€FnÞ¼iæ"’^¼¤’Äl2c¹Je,CWh–× c¤üj5v’ÊZ%%©kp™NYE/€ň<‚bnß¾=lØ0af×ë•)N¾2º|ù²U×­üªëg×®]íڵï‘‘‘Û·o7pѨ~æÌ,|äôµT/Ö6#FÊxI%y¬Ë­'’ [Ù‰¤·%©k\Æj)Šy4ÅH°cÇŽ   XRµjÕ¸¸¸¼¼<îšî;¬SþýïÛäºõbý²³³×®]‹•¬¬¥N«,uE»Ë[ÅH/ÉLÜ"c÷kl¹ÕàD2aPRÙ Õñ4#(%©«gê«^©2ó ;vܹsgùžD8V›5k†u½Ý-üãÿØ¿?ÝQ¥#‘‘1vìXLÏ`æÕGåÞ)ɾ;qâ„¿¿ÿ‡~˜––vïÞ=œõV]·^¬Ÿ>øg+f»wï ™ªpB]»vMIIAŬ¬¬+V¼ð "Ò¤IS¦L W®\ÿJˆ‘f¼$3q‹ôÚ4c¹ÕàD2¡WRÕ Õñ4#(%©«gê«^©²ñ ™™™>>>âÆ-ZØT÷—_~QV±µºi3gδ»:ŽU??¿Š8yV¡}·`kζÇɧ!^ý=kÖ,eHÐ2ðí« «ûîÈ‘#=zô¨^½º——f¡ëׯ7öNzwp9200ÐÍÍ­M›62X•*œÐ’%KÐ:BÝ!C†ÈY=|)ª#³~ýúð®Æb¤/ÉLÜ"½6ÍXn58‘2‚’fIUƒfzT”¤®ž=ª*z¤Jè + 1!±š¹uëVL`ìVˆuÉÏ L*7n\’79õÕW111%±As¸Z±tÇÐÀ[»pÂ+ÃðB“'OK¤&Mš”Y¨¾Ê'Fn¡ÇÕnºfÒ¹sg%¤9<<üÇ™˜‡ˆÉ¤··÷Ê•+ 2'L˜°téR$Æ/žA8þ¼¸Z¿zõj½.àü…mXø+«cêÕ¾}{LfPXÞ¾>¾˜víÚ!kíÇ+7*ŸœœŒIZÿþýE–½˜oüôÓOuÿ÷¿ÿuïÞÝÓÓ388¢Ÿ””¤Ë iÕª•²ë7ß|óàÁƒz#sñâEl#rš6m*ª[¢YQs4[S¡fË­Àh@\¢¢¢°ÕÊ‘×4FÕÅHóÑ•"sŸLM•Éé<¥b¦ ½=,» g#9%Þ½{·¸õi$Þ~ûm¬5¾üò˽L÷Ûo¿‰ÓçÔ©SW®\Á¿aÃœw'Nœ=z´fòúž|¨MT?wîZF±œœœøøøÈÈHùk—.]à¥qþBtüqÙ,zÇ ‹åáõë×Äí"Ÿ~ú©\¯iÖ½uëÖOz™IIIbf¸lÙ21ëV½[³ ðÚk¯I?)«ÉÇÙ°Ò·bâ׉'Êá«ÇŒ#Ò!ˆ‘üiÊ”)лÏ?ÿüù矗-kÖ…C–OL ÌøñãU#c¹!P¢U«Vɯp ï¾û®ÞÈ€åË—c%g{d-øì|êUÔ½Ö”c¨YÆr+T"G^o+T]T ‡æ [»õ]1óø‰É=ôž=1Ó…Þƒ#âäb„£zË–-"ݱcÇ={öˆÄ?ü 2ß|óM½LèËÆ‘èÕ«—¸qç½{÷¬v7n ieuyEÞ^\k¯۶m“ öïß_†+€Ì‰‹„ÒÿôìÙ‹/ùÏŽ^]8(é°ÒBåI­Úx±ÚôéÓG\Ì×y!nß¾}5jÔÐ|ÍŠš# ×šr 5ËXn…j@äÈëm…eÎïÐúЫޣ+ãÇOL>è¡÷쉙.ôô '#oooœª8/æÎëããóàÁƒÌÌL8ê””øjx-̯]»¦™‰´¯¯/N.œ/Hˆë8°^ÈÉÉùõ×_ǧمèºzõêâeu(WBBªcÉ"Þ}äïï/oñ‚Õ¬YS†¯](ÏSy_œA]¸…­[·¦§§csPFÞ‰ß%‚jC¼¼¼°°ÊÏÏ?qâÄ믿^­Z5¨†æÈ ððáÃáL`À† ž~úiˑ׫h9­É1Ô+£Ú +Հȑ×3FÕE…#G¿HïÑ3Ÿ˜|ÐCïÙ3]è=èA1"N.F˜bÕ®].kôèÑXSߪݶmÛððpww÷öíÛ‹u‡fæþýûŸzê©¢â?ˆEüüóÏp§˜Ã¡-[¶L³ ARRZkÙ²¥²úš6mŠ|äˆÕ ~ŽŽ–µP@†|`Òn,¯C‡ò¯½ºEÅ/y†2ÂÓöë×ï™gž‘eÚµk§·!8Çá´#""† "jiŽ X·n]“&M _=zôøóÏ?-G^¯¢å´&ÇP¯Œj+T"G^ÏUN.Feó¢T½GWÌ<~bòA½gOÌt¡÷ ‡3ˆeŽbdÓ10aÂË›œ53Ë—™3gb^ZîfØ=2N5¤¥kLå!Q¹=*ň8Ïхɘå”R3³ÁÌË›î7vvŒS iéS¹ƒë=Êbdù À‚Zü«xìرæ͛땴鑨3fÔ¨Qk=Ì+&OžìïïôæÍ›éÏ9Õ!Ä< ;^YÝ…æƒN”%K– ±xñbì/ƒ’æ‰ÂO™™™[·nuqqéo¾ùF>oE(F„8ÏŒ¥\‡įýúõ“w\ǹ Í° ˜wéÒEÞ¸X*D)Ÿ±BºJ•*ÜA#Bœç.((ˆ÷ôôD~@@€êeŒÄqîBóA'вeK,pÚ¶mk\ÒŽG¢ôÒ„bDHùÀ˜{GEE‰ÌaÆݾ}›CTÆîBõ SQqð3fÈktz%íx$ŠbD1"ÄÙ༼¼¸¸¸ªU«âkPPÐŽ;88eì.4t©©©X¨*..­G¢(F#Bœê>zôhË–-ÅÅœ±cÇ–$\±Û]h>ènÞ¼aµ¤DQŒ(F„8ÕìêêŠO̱SRR8&Îæ.-ZdyŽŠ©|0D“'O–¯; Îã. + 7n\º/$<ºq¸Y³fe›•£MwAxtbÉo¼‘››Ëq » <º!t„ðè"„Ð]]„º A||ü‹/¾hS›¾¾¾"áççç„Û[.u Ë}„½œ@1"„8¡eddÔ®]ÛÖ׶jÕJ$Ú´iã$:R‰ÕʾN-÷ör:ud NŠ!ÄyÄ())é•W^±µMùj…þýûSŒœÓ`Í}4lØ°>úˆbDq61êÕ«×–-[J¥—ÄÄÄ°°0ž={Ê—{ëEÂ5I3ÖRnnîĉýüüBCCãããEÅ/¾ø¢aÆ(©tÝš&ÕRÖ]³fMDDÚlѢšC‡ŠlŒß¤2IspTÅ4[³»SM6oÞÜ£GŠ!ÄÙĨnݺÊØ…¶†ATVŒ‹‹»zõê½{÷fÎœ9jÔ(‘?}úôE‹!3;;{Á‚3fÌùf¢#i–‰4iRZZÚÅ‹_~ùeQkÖ¬YJŸll’Á)ëN:ý¢w,[¶l©Y× ~“Ê$=K”Å Z³£SM0hÁÁÁ#Bˆ³‰f×yyy¥{)éÖ­[µjÕ’b·)ÒXÔ«WO¤ÍDGÒ,ƒnÞ¼iPK)(š&™#™ quuÕ¬k5~“M–˜lÍd1M°¯ÝÜÜ(F„'£’¬Œdº  @z<¸ñÂÂB‘~øð¡Ì7I³ ¾*ƒV˜#¥I¶Š‘A¾™øMæ-1ÙšÉbš`¡gpbD)/1R]¦+••¦ëòZriƒ|t§¬eI³LPP¶Š‘Ò$Í^Ì‹‘­ñ›Œ-Q-úôZ³£SM°¯y™Žâ„bÔ³gÏÍ›7—J/©©©ùùùééé .ìÛ·¯ÈŸ6mÚ{ï½—““sïÞ=åFf¢#i–™4iÒ”)SÒÒÒ®\¹"þ.1M“T½Ø$FvÄo2°DUL¯5û:Õ„70BœSŒ–-[fÇ­Ýš½DGG{xxÂ[Ê—±ëÝMg&:’fˆòÑZýúõ!sÆb¤i’ª›ÄÈŽøM–¨Šéµf_§š 6,99™bDq61Â\ÝŽ‡^í»FTöNK”`-Y§NÌÌLŠ!ÄÙÄ,]ºÔÖ×QŒ*¢%ýúõãë€!N+F„ðè"„Ð]]„º BxtBÊÆ]â8x–B(F„bD!„B!„B!„B!„RQ(Ç{-ÁÛ<Ê}“5 ðõõ ???žæ÷šÝ{ÓxÀSSSëׯïååU¤ÿjPB·ã¸ñѼïƃơ[­Zµ^½z-_¾\YÞÅÅ% `Ĉ2V£e›ÆeìØw¥Õ,ÅÈy hÕª•H´iÓ¦¼¶Ñ©ƒx7¥‚ñ€?ùä“ßÿ½žIô¥Ž8>9ªV‡¢S§Nsçν{÷nvvvJJJ÷îÝ•å /_¾;hÐ ½6ËØ}b–¼YŠ‘ó C®ôïߟbTbd<àÕ«W70‰n“bT.>ªjÕª÷ïß7.µ‰···ù2Èÿâ‹/6l(âÛ*ò5kÖDDD ¿E‹‡²\²™oV/NŠÊBËaaažžžÈÇRÎ<…ÌÀÀÀ¡C‡Z6¨Y@Ïô>cÆŒ5jÔ¬Y399yòäÉþþþHËXf>|çwj×® Kz÷î}çÎËõÊèmš­›¬W>77wâĉ~~~¡¡¡ñññ–`Ú0gÎœZµjyxxDGG›R­Ü›æ÷ˆåc0D² ËZz{­ v±æ1¯·7wÞ¼yuêÔAûݺusuuµé"‰¥Ù7¼fλO:ËCÑî݉‰‰0ÇjÏž=eZƒ³C¹vŸæ¿GYŒpÌž=ÇCNNŽ^ù›7obœÛT–Aþ¬Y³”­LL:õìÙ³8º’’’Z¶liu–hÐìôéÓ-ZtïÞ=¬é”$UMiö(Á1°dÉ’Æ‹¯!!!{÷îEaT™?¾eƒšô,Aï(“™™¹uëV‘þæ›odwÈ'à¢â¤I“DØJze Ó¦MÖ+5)ºC¿/^|ùå— ,Y¼xñ[o½…=•——wäÈób¤Ü›6íUC¤yïµ²ÙŖǼñ©¡WcÿŒN‘³Øüà,ˆì^«çŽÝ'å¡h÷î@¸¸¸«W¯¢îÌ™3GeõìPncIN“‡ß#"Fšÿ]¸paÀ€Pg77·gŸ}öäÉ“Ê¡ËÏÏ?sæ æsçÎÕ^Ë2fBÒc/ÈYœfy«ÍÖ­[Wþ„N½zõŒeªÃÇ­Hc΃ •r¾¤B³€ž%²weHW©RE¤4hžž.Ò8à-ãN”13˜f6Y¯<¶'—K0o¼}û¶­—# ŠYÝ#ªºf†ÈüñS6»ØÀ6ͽ©W Q£FÊ?U!F&7Áê¹c÷Igy(Ú½;”6ߺuKsŽ­wv”ð°Ã}=š%`™ Ï9€rJ Pç… êÅ‹×,cFŒŒóÍ4‹ófË‹!(oþÊü¥K—°ðoݺ5ŽFwww™¿k×®víÚ¡åÈÈÈíÛ·[6¨Y@ÏÍS^™FIåô@žJôÊØ:Èz›¬W¥Úéz– _n¾ÝbdÓQÕµuˆŒ÷ZÙìbcÛ¬ +„²}ånr„™Ü«çŽÝ'å¡h÷îPfÈŠ&ÏŽ’œv¸¯GSŒä”ÀÓÓÓ|y“÷£š#3'”*?88XΦ0KÁLü%Í›7Ÿ3gÎñãÇ1ãÊÍÍUÃÂyíÚµz®* g‰ÕSÓ¡ëׯ²^[Yo“õÊaêhÆœ¿Ê+Þö‰‘M{DuÀ˜"e-ããÇÑ»Øø˜7/F° ¥R#;†×ê¹c÷Igy(Ú½;”™¨ˆvl:;Jr +Øtø=šbÔµk×””ÏYÿ·½³ª¢zãøüQD IÓ©Pÿ‚jÌÉþ(¡Rn¦T¢FX™Öd3N&£…:X ™¯““éôfÍ$£b6N‰¦CI˜SŠ¦™r5Dá÷ïÌÎÎî9gŸÝ{ïÊÕçósØ»{^žóœóœ³»÷~[ZÖ­[7qâD÷ƒQ\\ÜæÍ›e; Y¶sçÎ]¶lÙ… PyÅ3#῱±±hu{{û©S§ÊË˵ã+V¬hhh¸téReeåàÁƒÍ +OÕÄrhäçç/_¾®ˆ «««µ7 ôÈαkdY“eçÏž={Îœ9çÎkllôÝ—ÕdæÌ™»víB÷ay™——ç,ÙêƒÃMd¸JÖkît±ÚçéÁhúôé›6m‚Ýjkkg̘`ä̼–cÇñ 3»¢ãî@M@ššš–.]š™™iktø3ˆîw#?3***JII‰ˆˆˆŽŽÎÎÎÖ‚µ›ÁhëÖ­C† éÖ­›ï,1[âÛt²‡ŠrBBBAA~h÷ïß[æ#Fìٳǜ¡ðÅ»=ê¡qùòex~|||xx¸ÇãÙ²e‹¹DÙ9Œ,l²ì|Œ4-4hF¢&˜%°†éÙ³'Î,))qŒlõˆÁaˆ&2\%ë5wºXíóô`„›‘‘ã=º¾¾^û®«?ÁÈ™y-ÇŽãAgvEÇÝDjj*Ì…Y°³5:üD÷c† iÚÚÚÊÊÊ´¥>ãøiÃ0 ã¬Æ±­èÝ»wzzúÉ“'Ù Œ†a†a†a†a†a†a† ¶;ÞPÏ(ØØ°Û %–ÄšDÌõÊáÇ333áØáááÉÉÉ2Öû¶PZH¦‚ÄÁ¨‹£P7N0Ä’\°‰³"X“ˆ¹.9räÈ€Ö®]ëõz[[[wîÜ™““C F"i!™ +#Fî·×O±¤.ŒX“ˆ¹.ÉÎÎ.**"Ž¡K륅d*H +l‰é%rdyú¶„i(9ëqGØhøðáµµµHœ8qûS_º®®ÇÕ6AøÂNw& +CœjkkƒÝ´B‘Æ‘Î ˆ% kHQGRt¢›L– †&øÀÀý Fzi!™ +’%D1[9æ<} [Â4”œõ¸£z³`Á‚U«V!-mŸ>}'ÒåååóçÏWÐÒ8êEµ3Q¢àTVVÖ/¿ü‚ÄÁƒ§Nª¶€c±$a )êHŠNtY€‰¾Û +”&ø@XXX{{»³`d–’© ã‘¥˜Ž]‰až¶„i(9ëqGõæÀ°3XÞ—––Ž9iL­ÕÕÕjR n¹±+ +CTlÙ¸q£o†ÏËËûì³ÏÔð_,I_CŠ:’e'ª-@¦£€”È0ãñøñã r!}…ª‘YI†]1Š>ˆež¶„i(9ëqMØhÔ¨Q--- È#êæñxd–±«^d¹¶% +CTlÁ¬ˆ}>JLLÄžKmÿÅ’ô5¤¨#Q:±Ó¦£€”È0!++«°°PøQ\\bŠöo]]ÖQt_Õ« É°+¦CÑ!æI¦¡älÆa£ÜÜÜÅ‹Ïš5 iÌ~ùùùsæ̱ F +ãu#½( ]pj̘1ÅÅÅ=ö˜v$xbIú +{(4㾓ŸÁ(à%2L@¨©©‰]½zµ×ë=þ|UUÕرcµµ\zz:â‘ïvÒ•••j_•© u^UÂZ±b…á|»b:}ËY]]mî£_ýõæ›o^¿~½÷*ëÖ­‹ýí·ß;;ýþûïG­WÙ±cÇÃ?Ô¹´££s]^^ÞäÉ“9u‘`„N߶m›ÏÞ{ï½Ñ£GûŒüéhgÁèn‘V®\9mÚ4Eeü,7àqslæää¬Y³†ƒQH££G>øàƒpCM™2Å°Ã-**zúé§ÍN²Ì¥‡ð¼yó +W¯^ýꫯöíÛé/¾øB;aùòåC† éÙ³çøñãÏž=kY,½z÷î­ÿôÓO‡Ú£GC¹6lHJJÂñ;ï¼ó§Ÿ~2/Í¥ Øâá’»ï¾ûûï¿Wdå} .¼å–[PóÔÔTa†{÷î½ï¾ûpaÿþýŸyæßÁ‹/Îœ93ú*ØÛþ÷ßD[]¹råÍ7ßÄ•ÌÈÈø÷ßÍ% +3n„…’a°³ŒK—.…‡‡ /¡˜KÑÑŠÞÑJ17311ñСCHà ÂÂòþûïGæéééÚTømÆ&<ܸqêMŸ¢bŒËkÝÜÜܲ²2ƒWÀKOœ8¡?¹±±{ÞÀ#L,†R„~þöÛo777ýõ×ØÈûÒß|óÍ°aô–,Y‚|Ο?ÿÆo¼ð –u8}ú4ŠÖŽc„ê§-ñÚk¯ýñÇmmmX|Þu×]ô5œ±[_CaVؼþúë¨ fàýû÷ sŽ‹‹Ã¸Æ…¸m÷D—¢½ØJ¼óÎ;@D[áHAAÆ;.œ={ö³Ï>k.Q‘¹ÁžÂFÉŠ0ØYæü””á%s):ZÑ;Bð'ûJ_´h‘ã`d>h(¡è¹í¶Ûþúë/J¹k×®=|ø0Ýl#ƒ á9’0uqq±6$)®رùçŸÞzë­–]&«ãr0òz½XòùV/Z………]¾|Yr{{;ªƒ‘Ý;ÌúR W™plL°Zº[·næjüóÏ?æÉGZqäÈ줴‰…r‡^Ú½{w[|}meYaÉwæÌõœ†Uö8†íæí¾:>ºýöÛ‰¶Šojjò¥1ƱiNnêÌÕ’ai7ßSü­¯¯^B1—¢£)½cþÁ1-- ‰±cÇnS+VÚ”`D4”Ðô`÷èlŒ¾/\¸`Yºã`$»Ó‹6$Õ®Œ± Ëf-ᙲŠ1î?X³fÍË/¿¬?bÞ³à_Ç;#(Åð´Z=„…iýA„6Í÷„ïWàSÌiK—.½r劳ñ¥h&¨¯¼òÊ=÷܃v…‡‡[f…Êh7He9oÛ¶mäÈ‘nÉÉÉß~û­ï þÕ.DCôMVÛ +gêÍ¢MÈz(™«%,‚â˜Þ}÷ÝG}Tx‰Ì\ÄŽ¶Û;Xxc¦º÷Þ{…ÑÇñΈh(¡Ø FØi!žî  Fè2Í…®¤±‰­“ð¶°áLYÅ÷ƒæp Rý­É“'c‰¢?¹´´Ôñ3#“&MÂäÀ`„5žpWn¹¶åðÚ`1€ æÂ… :túôiŒˬ0+êïN+ ØÚÚúÉ'Ÿôë×Ï÷/Ú¨-•Ñd¬ëˆ¶Â’ïï¿ÿVwŠ"s}Ãe’At¬ÞõÏŒ KŠ¹dÇé½cèß¼¼¼yóæÉîÑÙ +FúœmÊàvoÓýðÃÎÚs=¢'˜ëƒ-6Lg+µ´´h ŠßvlÂ2²Ûtú3ecÜFÀ÷ÀQÿ6<ÿ£>Â.»¹¹‰þýûk7œí#ÙG555}ûö]µjVžØn÷Ýw΂Quu5öøMMMXVeff5ÅÅÅmÞ¼Ybcc«ªªP“S§N•——[f5sæÌ]»v!+ Ìx®X±¢¡¡KßÊÊÊÁƒûÎ;wÙ²e˜·a4Ù½wa:??“†2„Ñüqs‰²Ì —5JV„Â=ÆŒ»]¼xñÌ™3«W¯–íŒ(æRDìsÿ¢Ø}ÈîÑу‘!g¢¡„ güøñÚ *êåÜ‹/¾øÕW_Ñ=Á\ìÎ0ZqÉÑ£GsssþóÏ?ÃÔˆ\ŸþùóÏ?O÷ÛÀŽMá æ3ec®I0ú#pQÌ‘WABûž‘ÂUdÏŒ‘ïÛLQQQ)))7ntŒRSS{öì‰p‰!†5dPƒÑÖ­[‡ ‚%¢ù6;>:t(¶ü –Y!Oœ854hPII‰°†Ó§OG»ÂÂÂFŒ±gÏßAÊ[IÂ4¶À˜‡ããã±ûðx<[¶l1—(ËÜÐpY£dE(| ¡©S§bÂÇú핽K@1—¢ bï˜û;©¤¤$ú8’9’!g¢¡„ çƒ>¾ÚmN 4` û¾ÊGñs}°·‚)P™ÄÄÄ?þXq2-- Š–¾õÖ[ÚsaŠßvlæää`y#tý™ü6ŒÊ0¥°°PqîšÓÔÔ¤ÿÒ+£á{¸¹¹™MÁp0bBŽŽŽaÆ)îÑuÞÿ}íç€'žx‚ˆa†a†a†a†a†a†a˜ë˜®ö¾D|#PU +lÓøE—.âé†L08|øpffæM7ÝžœœìûUáNåáËPN:5eÊ”˜˜˜ÈÈÈ &|øá‡îxì;V²úP\‚$ò¨lCn`†–BG(6*x"#ÜŒ 9rdÀ€k×®õz½­­­;wîÌÉÉ¡£N‘ÊC=´hÑ¢³gÏ"«ªª*í»ü.#áɲúP\‚$ò¨l9ñÈÁˆƒÑõDvv¶ï'ú)ý+ü +¶^¥G/^´,4àªC2W”ÕG¡¹cyŽŸ"/Äl)ßI—)IY~S&-((8p zÁãñh¿º¬èna×è>|xmmmçÕ_ôžϗ®««Ãqu&D]!ŠY³Ièif‰"gjGt]T±èŠW–ÝJq-K½'Y)DÝ.YGÕµ˜.×ØØèO0Ò  À-óóóáŸú_Ë—@Õ!™+Êêc©¹Ó4‘b¶…™’”e0‚Ù‹‹‹›››QUÇòႬiz,X°jժΫª=}úôA‘.//G£Ô™u…(@2Í&ƒ§ %Šœ©uyÜQÅ"*^Yv+Å=ô¿G§Ö{’•BÔí’5–¨®Å„aaaííí΂‘Y¥¡¡aÒ¤IXê ÛGyÄò‹óR’=3’Õ‡¢¹$‘b¶…™’”e0JHHÐ?«¢#aÓô8p¦î¼úᥥ¥#GŽDñ±ººZ QWˆ"¤˜‘ôž&”(r¦vDì5wT±ˆŠW–ÝJq½ ¨ZïIV +Q·KÖX¢ºB`;~ü¸ð#¸þx)(Ú3-Â%t0T‡Ô®h®ºþêsüy!fKQxQ(IYšT¨F!»£H|1jÔ¨––LeÈs :ÚãñX>Ñ ê +Q€ —È EÎÔŽléò[‹¨xeÙ­÷P“2^ˆº]²ÆÒÅȘP¡¦¦&66m¯× ¬ªª;v¬¶æIOOG<òÝSBº²²RÝõiiiÈù`…¼nݺ‰'šÏ †êÝú¸ŒÔ:D²l) +/2%)-+™üÍôéÓ7mÚ„ kkkg̘¨`´wïÞÈÈÈíÛ·w^•¥@z÷îÝ–v#ê +Q€ —È> endobj +6050 0 obj << +/D [6047 0 R /XYZ 85.039 758.673 null] +>> endobj +6051 0 obj << +/D [6047 0 R /XYZ 85.039 758.673 null] +>> endobj +6052 0 obj << +/D [6047 0 R /XYZ 309.807 377.657 null] +>> endobj +1818 0 obj << +/D [6047 0 R /XYZ 85.039 327.715 null] +>> endobj +6053 0 obj << +/D [6047 0 R /XYZ 85.039 305.953 null] +>> endobj +1822 0 obj << +/D [6047 0 R /XYZ 85.039 305.953 null] +>> endobj +6054 0 obj << +/D [6047 0 R /XYZ 85.039 271.411 null] +>> endobj +1826 0 obj << +/D [6047 0 R /XYZ 85.039 213.377 null] +>> endobj +6055 0 obj << +/D [6047 0 R /XYZ 85.039 178.631 null] +>> endobj +6046 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R >> +/XObject << /Im28 6039 0 R >> +/ProcSet [ /PDF /Text /ImageC ] +>> endobj +6058 0 obj << +/Length 3322 +/Filter /FlateDecode +>> +stream +xÚ¥ZYÛF~Ÿ_!L‡Ý¼³› Æ_IÖžõŒ‘ ?pDJ",‘ +I2ùõ[Wó¨Y/q¬>ª»««ëøªh5qà?5‰|ÛqãI)Û¢Éb{áLV0óæB Å\Hæ=šw—¯ý`¢;vâÉݲÛÇ·=ßÜ¥Ÿ­—o¯nî^}œÍ]×µTlÏæaY/?ÝÌ”uË£7ß½¿{÷þ ö<TÖ§œþðq¹Ö½{ßM_ýóÅ÷\Û™}¹ûéâÕ]ËiËp#›\|þâLR¸ÒOŽíÆÑämÇV0½½>mßs¥¿¹¸½øW»Ïy^5&C1‡›ÅÚZr²½Àm%§aVÙ±ï÷%ç;¶ïx$9ØR;6\סù¾cMû]¤i½½ŸÂõƒÐZå0ýÕÜ›‚ˆ”Ub'°nn®yôwGy›Œ—Là*«âÉ´•…; ¶² +µm9c ¬®“UÆýÃ:ßà÷†ÇÐ8¼Ç®á) bqíØ‹è:yÍ ü^6xË¿<Ï—HX?Eó*!”ƒ{·¯Ù…ÉpìÛ­; 7ÊV¡ +&ì’Ød <Ø"»îw5G[#ö00½›Eï±Ý]c©¦|LšWfw0©ÖqÁš¼Óð­ác˜K1± +¸ÉrD…|mÇ‘˜oç“u˜ñàê~`%›œT‘&` us/l‘+–Ù\î›Ëv‡ +—ò#JpÀæg‚V B[?¢:’³PÀaÄñ‡PÀ(ðYÏ3 Ø|IñlÆ·Ç^YÙB:$ +ø½M¶÷ÉxÐ5¿ˆŶÿôE:’³±×÷C°]äSñCºï ´­ÍýÉ +=W6²oÉEQrfh’>Íô9Žø`ˆ}6%¤.—­C,d„3RÙWÜpŒ«ý Ktét|}Ç}k›ì°!J«½JÝðÌ>Ý°‚ÒwzŸ}Ãs LqÕfÃ#¢ÏLŸ0Ã1Þ‚pNžòPVU¢çØÛJZ‰ïÌ «ïà·¡I¾Î#ÅóÑEóâk¯—4Lwxd£4+r#AaÐè3…ŽÎ ! ¶7= +….8–‚À·Å¹!ï ‹¬&Ôb¯mLÄ¡% +I”…î‘ãˆ8 ´õ³y0\Å‘È1zw]K¬Cºß’nøÔ´çÙ¡×BÃ9ɆXŠpÈ_‘rc•É´+s|*ª'àYÄ}ª6¿!Îg¦$Cè±Xã‡ÐC+áI Kf*0oZîÛPÊãKÒEŒ2aØ ´kö»“±²NæEGµm3<˜^ehCQȺ…{°c¦ìy¨ù·Ó]¬²SÛT¤Ñ+HÝ<­­«‚âJÐAg¥æ¡Ø3¦°ç>p6ÚÌÚ9ö&¡¬(»x Œ±âIÃs'Æ£©jä;ƒ³përE"øÞ7b¿ŽSSFøëÖE™áø)ù}"$™¦¹‰¸I#õ™q¿â!Ò(¸¡¿Ly€=7«ˆŽ+á‘¿GqF€CÖ(‚½¨R‘ÒCãFܘŽcÿ•Ä#a)´hk¸ÓÝš/<ñQ^dq “1ñl"°êÐâ¸fä®”Ì(·óWÀ‰õžÏRš+@š73 ˜ž(綬™ÆlÁŽ­á´(¯×\6ñ(&ÄPô +»Š˜¸i•ÍÅÒzky?>Ï YhTùjml–šð/Û¿0páTÛNëÀ±”æbÍþ3–±‘ðÏõ‡[&„„i›Ɇ{‡! E:’ãj ¾:0å&¬—Vu3Vq{E0*Æè¡š#®þâ²!­÷To}Ç8&›*–+ø3rŠ«íP›8óæêý5òõËë‘ }À³aÐm8VI l70•Ÿ~ñ;©jŽóïp W©¾¯8– &M‘o½ìgqâ‹Oä‚ÜÁu£oOƒ¶ÖÔFtL¦—š& Gj5’ì‹´gÌ´ˆ—à0C·k2Ñ(CFBƒt_Ïz/ŠÃå¥0‚|)ˆ©Ü(Çf¢±œÞôÒ9¬×Í”§È7l8/ÒìhËãå-\ãnÝòÞ/oÒT.…BÝƵý<ÛŒž¼Ï(Y;”!) `°÷\Ä3Ö%µñ¯±ú ‚Ô1 £ÖZ|…ñØ¢‹é3~Ø´ÙÉ×c'A5½Ó¬ÚMJ>ÿþÑK5Øïc©Wbä¶1Ña¤”幉‘ï¸h¤â=’qj,ªë§“ëÍÙäò-q‡Éu ÉõÕCI 9à2#$…9†è^Á(K‡%#Ö“~íŽL¾ÈW–vʉ²XÉ÷#´òs÷&Ãü/÷îhÎfÚZ‡väa>L:{Ђ+7¡ÑêS—â°‡äQ8ª£¿w,¡íÇÇ~Ï:“ÞŸÎ.ðö3ýa6œšÃ¢Ç)¡#“š›d¾w¬â¤05—(Qƒ¹6=¤ZB%в™ŠRžíÆCoM¥ptÓÑ2ápŠSEŠ Œ”¦ä5/%»+ï*<òX*ö†tÄ¢Ìÿ±!¹4Î K8ùÿ˜¶{92V.¯Ÿû!Ao2æÜœ?„ÂðH­B¤°'O@Ê:&RÇŠPI鉎B¿ÆÀJVð²d‡¥ÃòŒ «ÞÒèc—ŇÊ$î´…Ä’|ø½¨a LrVÞž†V¦ +»¢Ñ üÎ"°>fÛ²÷ÅqDQ¦-µ{<Ÿºäßî¾T°ì´rX¬ßµQ“OÐ4>ç=UC¤žô"=š³ÞSyž}ôå=ßùi·oýe#%HúÆK#)$=é+;¹HSm¼JÑzÝö‹y4älˆèËýÝ%—%Ù'› +}îƒú*—/ÿôMÝŸ{¿É¶dgEßÜž®ç÷hκÛ"ªÃ<¼Î+csh–]¶¹¡¯^Z»œŸmxz +˜dÊM ê÷Ü|¾ªÛ+¦ÙâøNˆÕ¯â?‘{•Å•ÔAªZ6Fóû [sÒůXíùˆ!ŒÁr9„Eð{Ï ÿ×UUî œÐTH¥_@rƒ/ï„âT‡âü¸Ð6ƒäȦ·ý¤ø½9T®©Jþr‘UM[¢ª’Lig}ŒkhfuÌÝu'¦éXM•ˆ˜é?þ&9§4¥6{Î’]ÇGð?öýsž®zïÚ‘{RøZÓG æ/§cÿ˜_ß꺧 ÿËFíCendstream +endobj +6057 0 obj << +/Type /Page +/Contents 6058 0 R +/Resources 6056 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6065 0 R +>> endobj +6059 0 obj << +/D [6057 0 R /XYZ 85.039 781.388 null] +>> endobj +1830 0 obj << +/D [6057 0 R /XYZ 85.039 761.463 null] +>> endobj +6060 0 obj << +/D [6057 0 R /XYZ 85.039 727.186 null] +>> endobj +1834 0 obj << +/D [6057 0 R /XYZ 85.039 617.28 null] +>> endobj +6061 0 obj << +/D [6057 0 R /XYZ 85.039 582.534 null] +>> endobj +1838 0 obj << +/D [6057 0 R /XYZ 85.039 526.219 null] +>> endobj +6062 0 obj << +/D [6057 0 R /XYZ 85.039 491.415 null] +>> endobj +1842 0 obj << +/D [6057 0 R /XYZ 85.039 287.329 null] +>> endobj +6063 0 obj << +/D [6057 0 R /XYZ 85.039 252.583 null] +>> endobj +1846 0 obj << +/D [6057 0 R /XYZ 85.039 169.776 null] +>> endobj +6064 0 obj << +/D [6057 0 R /XYZ 85.039 121.082 null] +>> endobj +6056 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F38 2997 0 R /F58 3360 0 R /F62 4047 0 R /F41 2994 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6068 0 obj << +/Length 2967 +/Filter /FlateDecode +>> +stream +xÚ¥YYsã6~÷¯péaCÕŽh‚xäa·Ï'v¬©™­$´DÉÜ‘H…¤ìÒ¿ß¾@Qç>lÍ!  ÑÇ×Ý ºàºN¬èô:N”¯“äzºº +®0óáJ ÅHHF=šŸ&W7ïmt­? ÒëÉ|·õÕדÙïÞÝÏ·ãÉ»ÏÑÖÚS©?ÅqâÝ}•÷È£ãÏ÷“û‡Ø30¨¼/cœþôy˜hoÂD÷»éÛ?ÝrOûÁðÏÉ/Wï&§ÀUŠlþuõûŸÁõ ®ôËUàë4¹~…và+˜^]Ÿ¾5ZúË«Ç«u[ñœ¹æU§¤â(Fp³4´—%)ßDº“\³ÊO­íKξ I¶ ®›€Ð¬ ¼»¬üº-\=Š½M“sc0ݬ›l6kV0ù4)oÀU‰¿ŠYyÍf<ÓäõK^sûgŸ ˜>ó¶n +=jã-ÒÝ“¶I|§—ï¿£¡û+{ÂrTä눮ÿ¶ŽLxÛa˜xÕ†;fMy9÷ÛgjÀ•K˜É¾#mŽó³!‰ijØ·h·¨y ÌVù?Á,ƒl ®‚­l/<Ìä·hݱ@S4|ô+šáÛ‡£H%ž(Ĵ¹'^9ú¿o?}¼½¡8AJ#…f”Ò½n?¾Ãá›÷Fõ¤µƒÛDSÎð—©öĨC?]<¦‹k›z#äåÚqè­ñ’E‰ŒµyàÍtÒÛ, gÐfÿ8qš +}#Ó6@T-Y¥ˆÈµñSŬm~œ“,ê +Í›Lচã¯@ Æt°HŒo È3`Š9:ær–×Èh¨þ–ù”¥Â»<: ¯å~<ŽÐ_WkB’nó–eÞÈþ™ãmº,˜gaµäßî¶aè Þ·}qï3ÛfOÞ›eòœ;üGÙ5ˆ\,ÙåL´}¤N6~”tA†DOî>8\ç»À0sfÔ‡&Ñ\ŽH(œíÎ^p7ÒEÓfî(gÖHºgÖp@Ñ>ÛCÃáZzˆÍ{‚``¸G+°QK$ê<Á²WÜÜ°g!4ÎU¼EÆÝ2åF_€d1‘¦pš;‡cgr»8ΡÍ:°q.@ G4-☲Œc°P4nÝ’ƒ/v˜ßŠÄÑOKwNB"ž ×tÁc;©ÚNq5Cø®Àئ阄{¢?KZ§Œéú[øq¬/eæ,úƒx ߌ÷ñà”ÀW²¯ð×›oÈϘq|ðê¡F¡:QMœùåÓM I‹f¡R&§ —ŠøÌ]0´—+ WÉ1è¨B©~ZÔ•E6á¿ x´AÈÙi>´¡‡¼r~KìâäXâ xý‰ü$k—‚¬2ZÌÜRHê(݃øaÅét•$Œ)Y‚¸;¹*ðÃæˆkb‘†`·)%"ÌȉÅ5ÐHªb>ŒLñFHÕ!)\͇ҟ­$"ÂrßVÇäÃ+FÐ:<«\qjÉöÈ)Oônv˜¾ì]ã½\ŽR™¹øƒ¤´‹4¾GÞ/ÛyÎú T.Z]¶˜ÍYë7¡ñSX¿Ú³þ¾éOInyÙ²#+3Èr¿ÛçÞ¨ê'Úš€µ¥”G2£iVrƒìÅåJ|ï+ +°{$˜˜c·¿W·d) «È$Pí6òÓ$&¥§&¡»ôÔgÝÏ §æ²0w4gs.G~bø•ŒbÆ&w£Ðû6Æ_rÍ-{¨ÓhÈâö±¹4¼í +3¦¤ +¡µ0õSÖè@X@M\5…ëW´2Æ‘œë²Ç-¯Ü®¹×›|&K$ìaóÈŽc©óœ0V%z¹îP¯$cšüÓ†KÅJváÖ.Pà`&Ä}ž‚ÞËco±Ì\dCêy%$ù~ÌÙrÂÂ@3sIg,t ®Z’~r÷yÊXg¼¿L¬öJišêI3°M±lþŠòDˆ½£õ„Zì†ýL<„lj,JçŠeÑ}ë‚9"üeÃS„Ûøê,“ó¬æ¡ê#OåÓ)ÿwµÄa.ëpá=½Hò7.@Æ¢ÙR`âñ9Û-xŒLÉ?>òÀCÞRyYÕßOf¶Iâ‡Q$ç’º}/?@…Ê€ G—­hGsÖ-T’úF– úD6Âgü±:ÃÛç?=š³V­¬õÃT÷ò˜oãÑ#JCí*B6myíŲ™vÚµø”}¬YF¾Só¸b&îE@Ô!4?cÕ’7m§Ü©$ÕHVu¦?ÝžÒgøVŽÇÒ´‘ý:oÜUÝm‹¥xµK¦~Ï›¬1©Xn»2žBI˜Æ~F{¶IðŠÄUìö‡¸¦Ò""lÀßW Ý+í®ˆ¼/M—„ЪØ[`»Ú¬Ùdο›fÿ9‡í¿x÷%“|•Ü#<`}·å}?ñç k½ÿì^¦€îÝŒŠ¨ªÆÌÌoQñx{ÊWVôÊÈ‚æk–ŽïKç®*P¥Aõ™‘bѪR KC*t‹ZG)Ò#ª(ŸÈ‹Š)¤‚1è+5Zy#+a{(9°æ¥º a¨ÈÊÍä ¿ÃËÓ]+ß#Pt'õÑcCÛePßœ4#&r/%"JcÙ®`b?lw0ÉqW*R·{/!nä¹tdâ3bÖÚ7q(½#y¹<Åuâ&ô•q+ȽLܽ{Ò£¯‚¤§Æ†Ë:~:(¹S•è&Iœëâ /íq¯rãJšàw•MŸ»¹¼ám +ÙbNQsó=*·"•£ïŸÐN²HõN; èõßz7b{aè‡j?É£h\=QrLžœFý:äI1ŧnpJ®Ñ(÷€!ü¥åCÉ))“¦+áêmÑü/õh?Ž‰UõÉ{_ƒœF”íi:¢eØØE+0Á‡Æ~¼4*b(´… ›]ž}ÊBûQbv±‘…l }sÞ{¬g€$QzTqŸ +O¿òu/!î……«Ìe•ÉW=\6'®ä»tÆŸù2÷ºB|¸ÌÏg±ÕNGøÇ·ø¿>_ïž +´Ÿè3^-§ã¥¦Ñ!¿V'¾Mô1Ãÿ«ª©endstream +endobj +6067 0 obj << +/Type /Page +/Contents 6068 0 R +/Resources 6066 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6065 0 R +>> endobj +6069 0 obj << +/D [6067 0 R /XYZ 85.039 781.388 null] +>> endobj +1850 0 obj << +/D [6067 0 R /XYZ 85.039 761.463 null] +>> endobj +6070 0 obj << +/D [6067 0 R /XYZ 85.039 741.134 null] +>> endobj +1854 0 obj << +/D [6067 0 R /XYZ 85.039 671.269 null] +>> endobj +6071 0 obj << +/D [6067 0 R /XYZ 85.039 637.13 null] +>> endobj +1858 0 obj << +/D [6067 0 R /XYZ 85.039 540.773 null] +>> endobj +6072 0 obj << +/D [6067 0 R /XYZ 85.039 505.363 null] +>> endobj +1862 0 obj << +/D [6067 0 R /XYZ 85.039 450.318 null] +>> endobj +6073 0 obj << +/D [6067 0 R /XYZ 85.039 403.949 null] +>> endobj +1866 0 obj << +/D [6067 0 R /XYZ 85.039 307.389 null] +>> endobj +6074 0 obj << +/D [6067 0 R /XYZ 85.039 270.522 null] +>> endobj +1870 0 obj << +/D [6067 0 R /XYZ 85.039 214.206 null] +>> endobj +6075 0 obj << +/D [6067 0 R /XYZ 85.039 182.391 null] +>> endobj +6066 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F38 2997 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6078 0 obj << +/Length 2863 +/Filter /FlateDecode +>> +stream +xÚÅZÝsã¶÷_¡ñK©™B€ß}éø.éÝ%í{q¦é¤y %ZbO"UŠ>Çÿ}÷ $d‘Hš>t<âc],û[,¤!üéEž¨0*Y®U”ç‹õá*\l¡çí•Š•¬š×wW_ý9I:TEX,îÆy'ÑânóSðæÝÍíÝ7Ÿ–«(Š]¨å*ËòàÍ·K|Ï­·ŸÞ¸{ÿá-ÖbhÔÁ·ØýñÓ2‚;&zÿaì¾ùëë®E*\þ|÷íÕ7wƒ¤ƒ Ubþû꧟ÃÅ–ôíU¨¢"_Ð,(l¥Ñ’ +R¯EüÁõÖ0sD<»¥fæ ʃ²í.æ$ [î¹g£Ùrë¨Gè²$¥°AÂrßn­ÄXíQ>8æ¹³i&ÎUh2¥=UË$:œ˜òl{#0p£…Ù°ÒVp*š…æ]M{„ŽB‡ÁÍ*{G ®ª¬´(êiB<Ø{8q~¦Ó}‹R¶Ÿ'„4 dš[!w¬Þ$:•”®YâØæûðœTRx௨ƒÃ„L:Ê”˜lH˜jJc&Ri,dO»²çɇm‹LÔ¼ñUƒv!²ý]%dAc%©6"[Ë_9\¹Ùê·üDÛÑÑn·¬J¾è‡;aH–ºÒ¹Qy–ž)—¦B#å©pŒLž›˜Ãw#_ØafŠüÁR•²ÑØøh…·E닃wlú×2UÞ¢å? Hp3ù.’ísg+ßoÿøÒ›eZe¹Y¤q¢Ò/.$+‡fÒ›Å:æ!Õ¼äUÀ{9ŸOQ¨pÃås·«xÅâºSÏ˽~²N£m¶×Üæx‹ ]عu¢’hõ„dåÐÌË(4„h/yé0¸+¼Ì,Ÿ›áÈÃÁqÙ}cJBe…ñÛÒH3oLBƒrD³Öäa6š“Û`O»¿€CF û,'Áêzßr¨°–Aˆ1.wcóa9âZg½ÛJ¼0\Èwoe~x€ëÏ{à5 ‰†e„~Xph&a!Ï¢aTÇëIXðqbXðò±»ìð`áT­éÀ8*üÈçp‚µšY1-|Ìcôr³Æè²û?#CœÂ-O~ Ž4ó/8ø˜ôq4谛ć8OÈYã׆ÃqŽANÝjÇýsð%ºëß +qÁ7ָȎ§Ý d°?瀀B `Aü Ÿ‘žÛꉕ à€t¿È]1w0¢˜Äˆ•I#•%fÚ#­±ëk¾L™‹.Àø½¿C3o.Bãõþ>f£¹ø¸ æâ°{CF’ŸÙµÞC—jØ,{Uz[5Œ”pA˜8w¡J“á~YÞÏh0*ŒÊ²È«A‡fVƒ–¹Åsô14èåf5è²óhîÁûÚ/Zd*É."”U”äC4²¤ó„ÅßD)Ü<²Ä¯Ð‘f^¡Bƒ‚%³ +õ0êã6(ÔawÀ×TO㥱¶ÁG„çc…ª±7ÐïøF}´q‹\w/âg¨Zo·rÆ­*­ÏoÈ1]œí~‘¨«lŽ‡.Ð$Þ\”çLf’·6Jqh&£”Ìèa2ºÉ(Ålj£/»õŽRBL¢Ôèá7¯07i­Ú¯9xé†Ü׺¿æž³€eGšåÄÙ¶ý†‰Æô Tlv Ì]„ +ž®=8=—ïÇ`aKwJu4[ò_Cº¢gë²Ã$!I +if’ê(ì´šÊü±­˜ÀÕ%ŽP³1Ü°~ áÊ{Žr±kxÓÙ˜‚öc‹C3»›–ÆÌù˜ ÙËÍd—ãã0dÏXäsØ©bp…7èé6_àZEn‘f349„ÔÙ4˜Á G1:xGw‘Ãoð/Ý5æ‹"¨¾ — ´àg¾õ†^N4‡Áõ[ÊÁqFÚÒo˜æ#¹÷kL&ëTEÃ]£qCEæ!å[›²ÓîÜ[Z"éÐí¶ª­£wVrÕÉÂ9÷*Jï¸A‚`ô¸•¦#å ¿àÙW["8qÆ{Æþ + +ýY‡fÞþ„Æ +û˜öçã6ØŸÃî÷Ç6çPü5¡p‰*#ßÕ;ürÑ™2…LrO.¦'§0«e+¦~-4óZoéc6jÙÇmвÃî〦d?‹®^DA=¿‘û£†!.b8º§W\$_J)‹m–X`â†Räஓ_s!£'¸Ü¾¤P&Jÿ‹ýÓ°áÜoÿšÙý³4ÞøÕÇlØ?/7».; ·2#áV…[ÐÞžÝÈÅñà³gªƒ7íáX +òãÐ1g”Eò“ñ{}wÒÐB©Ã½Î y­SõºÜ3ŪåY†5Âf„^h½~mw4¹ÆÝ~ߨèšq}¶‹/€õ*ÌY_£ˆ…v=v(WÏŠ{ÊFÞ#±‡ÂJ|öc' ‘9‘âS'`À{±!á7]BõøÕ‘ *a_VQÏç€ôŠ/Ûá«Ðcå}9Ä7"l%žh'èøì¸ïliÕÌh# ý„ΞP^z-u"$œýúÒj•ªkaVã{ö@WŽñ¼7Î[®¼1öŒ³2¡ÄåÝ¡lÄd½<\Þl‡p/ÓñòåÕ*ùéÇ}ÏVˆ]Ø‚/Yô^츬Ëë;™s +~þ=Oá(‚!yT]JXK¾Ž¢-¯ùÐ5ú­1éП˜ˆo`Ë•Œv1’3U¤¶©JÁ™WÜr&@S áÔì¼ë–×/¦×¤pb¹‘#éæÒ{ÂÉQ&±¾"Ž$A/ +æ~ °º>õt¥ÄKß¹²3¸&„aØÑy©¤ˆ%†hˆÞ%©h¿'IÃvÀbè„qt|‘‰JUA“xi¾&·œ´Ÿ~é6™Í–Ì‹wª~ù^]›áå’Î\[nHá¸a¨ÊvÉã87IÀÉNêë}-¦,ã×¥,t_jà(N8Ãк“¸0Í•&ìUÉ>b*‹` Ümè"Y«É…Ëõ*{:¦ò¤¹½‹Š¯‹ØÙ¶û=sçˆ@X|]K§rͯÚK~ ž¶1ëMm|t3…À:QaaóFÖÎ^L¢¢á!þõä±JCf§A;:Þ¹Ô̯fÌdB6\ÈNüO?[~yG*f’º l§ÑV +›‹ì¥¼I±œ ÿ5L·endstream +endobj +6077 0 obj << +/Type /Page +/Contents 6078 0 R +/Resources 6076 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6065 0 R +>> endobj +6079 0 obj << +/D [6077 0 R /XYZ 85.039 781.388 null] +>> endobj +1874 0 obj << +/D [6077 0 R /XYZ 85.039 761.463 null] +>> endobj +6080 0 obj << +/D [6077 0 R /XYZ 85.039 740.47 null] +>> endobj +6081 0 obj << +/D [6077 0 R /XYZ 85.039 672.724 null] +>> endobj +6082 0 obj << +/D [6077 0 R /XYZ 85.039 640.515 null] +>> endobj +6083 0 obj << +/D [6077 0 R /XYZ 85.039 613.417 null] +>> endobj +6084 0 obj << +/D [6077 0 R /XYZ 85.039 572.769 null] +>> endobj +6085 0 obj << +/D [6077 0 R /XYZ 85.039 542.682 null] +>> endobj +6086 0 obj << +/D [6077 0 R /XYZ 85.039 512.595 null] +>> endobj +6087 0 obj << +/D [6077 0 R /XYZ 85.039 485.497 null] +>> endobj +6088 0 obj << +/D [6077 0 R /XYZ 85.039 444.849 null] +>> endobj +6089 0 obj << +/D [6077 0 R /XYZ 85.039 419.872 null] +>> endobj +6090 0 obj << +/D [6077 0 R /XYZ 85.039 390.652 null] +>> endobj +6091 0 obj << +/D [6077 0 R /XYZ 85.039 360.565 null] +>> endobj +6092 0 obj << +/D [6077 0 R /XYZ 85.039 316.323 null] +>> endobj +6093 0 obj << +/D [6077 0 R /XYZ 85.039 275.675 null] +>> endobj +6094 0 obj << +/D [6077 0 R /XYZ 85.039 249.183 null] +>> endobj +6095 0 obj << +/D [6077 0 R /XYZ 85.039 222.084 null] +>> endobj +6076 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6099 0 obj << +/Length 3630 +/Filter /FlateDecode +>> +stream +xÚ­ZYoãF~÷¯0ŒBÅîæ »ë9’8‡Ç;–1 ’y EJb†"’ÇÙ?¿u5EÉ”'‹] Æ컫«ëøªZê܃ê<\Ï$çQ¬\Çç‹Í™w¾‚žoΔŒ˜Êé`Ì‹ùÙìë ¢ˆEIc™sù¡èÖ#$% ÈÇCÑÏ“(ròö«C+4ÈÕQÀÈíÙK|¯—¢h@’µT‘?à2óÔÚõ“ð€§i7fÀp»å’ý¦CÝïEËïèÒ¯ç3ýý짾Dl¿ZòÜn797¥¶°m@”Sæ«°ÐHÜ/_á†]‹lñÃçåÙ$ÚMü@Xóª&3P¡ÐÖÈZ–ÄÀI[9¼ þ¶^v˺"å“ÍaÃQcƒ‚©‰%»»ì_ànçHæI˜ð}…÷5{0“~¨¯'pøº“l6(±—?Gi%9ÅH©p|¢óàøØŠ^W£’e7èW_ œ¯i6Ò^Ÿf»ï†VÛÞìXîxߢÊG¶1«´ G¾cE‡¤á„àÎèRÖ— mßÝ.šb+b õ‡·aî•Ü¤¿`¯Š—´ä¦Gš¼ã +  Àc‘ +$©]qkGú³»GÒe #ÎåOE6iŠ[À–n’E5o¾¤HPcµ@ˆl¹(k3Çë^s÷„» +}ߢèYw5sÒ[‡`)}OyëP¼õb·mÓ,kÑ+ܳ‡ÍPÚ%ò­U-¾üab<‡\/ùêÜ-̃þ*°2ñÈ-½"HË2ÏxÒ—jŠJôkìô*r½O~?椳à«A’Iï ²B$a5ÁæD:;cyðAÅð){6lÅ@5E±È¸ Œ/I}¨‡ÊúŒÓX¹ˆ·8Øk4ð÷©žDÊ”Õä îõq±ÉÐÒÆÎWø!¤5sƒ‹£¡ffè€zôèÄY Èêb3\a•nrÛWp#I6„¾I9´D~•5äMÞªDy ŒÃ>¸åÊõüXP@™ÜPh€,ôâOƒhãêhBOíZÓÁbOEʘÐM@Þì ’©9ÚñKŠînŸÐGô øø¿Ð(k}‚ÆظF'4Þ]ßÞ½|ùƒ’Û¯1pùyê÷2OJŠLÞ’øÕ-]EA^ûÑâ²àÖµ³u™Fló÷ׇPqÐŽ`Yë\Ô .šœe|UYlŠj¦œ ž|?}ä2D +–FòRô, o¯p^Æ«²j»®q£ž‡‚µ•Õ˜S¾÷Àú:' ~¨´rZCC±Zߣ‡­q¥fMÞ¶>…Ò¢»=Fù‡ÐXLd0:ÀÐÕ¡:à'Òm|= k»-Ù”>Uì0tã¾6[²ÜlJÒÑÜê£I ¸¶ce5À‡é‚¿Ÿñ˜Ý¦×ÞÜâÌö³‘ÃiO»Al§‹”ó–P—6örI(Q7!R"$é[|WIO:f² ¢,k²>@\BÎ…IÿBó§”AD¸þ‘œÖâ©ËràÇï°&ZÚ\ütY´H ÔÑjc0F †Ó–>±ðÀ€n7»‚Ø5=Ï4§›G!n•Õ)$ÀiÂÈÖÆœD~ŒJœ!HÀ zö¼Ùè¬[B÷ìcÚûþYËêd4,(gm*ÔrÆSW¹@‡&·(À¶¤K+e4’ÊébÍ5Ú#¿ç•y—îo|øõ,köCN¢?ðÁ±¿û–1£©@«=¼ÄŠˆ”= ˜4­Èöv- w²„w<ËK,¿Ä›ZêGŠíe^rGV4våEW7²+ +ôáš m¤ÕX*…;í + +°@M!láýmþû.o»·²‡ÞÞÒÌ>Nˆƒ›Y»åA–.ºû)Ûàع§› Aiø"äÉ\‹LF/¹‡?FpŒ…öíÝt=à’©ð‡0T'Ðõ%š@×SžÍ`s9Z²Z^¨%±ƒB* 80µA¼:0Õ®êC¿Æ殎Ã}„-: qÌ&ŽzH;¿àŽh_kîí+Þãa|ÏqÍFŠJ;óu~2,ST:°veC‘s7f³×ïÒ½E™HÊnñ«§LOÔ@’…‚[ÛÚ1©(@¶i(GÔ9&:]xÛvÆCQj´ AOæ.êjÉfhl|S„#:ůY?Xt-FÍvd8O0˜‰ç²¶öš³ÔÒ €r$F·Óqø¼È çqqGëŸ9à4Ðþ¸¡ÉË"½ç÷)ib(‘~Ö) Æœô—&ˆ(sè/cë/›}æȦ¬\Iˆ{acáí…Ãí’€`‚µ“lõ \nÐÁNy’ßþ­¾—RZYh•vË—‰^zÇf<€Eâ·Ägø¿ÀØQ\¯Â4J¿aFŠ?aú%Žíu•ŸJ¢lŠ~‹ Æœô¸ÆK\å±R_a ëG6Yâûèàö^˜Eû‘‡‘þfû)Yžr%¿Ç¬`ØVAøb9šA¬‚û\”Û |ôPn¾Ñ#ö[Th(¦/ÄP§%7ß]_ýÄ‹I8 mËZÖÇÉÍ•À:_¦}¼yΨ‡ aómš6LœMï aJoɱÒ¬H¼ƒER|˜Iy¨§×Ój*gA&`@X~Ñä)Ž†ÕKþ^\‘ð’( «´²ÝË2e“îê‚È6ÈÌvÄdmò>›Bÿ@#óýyÚY5µï{Šq;6Ÿò ¾gÐ2AeÍû\”¬H­êKv¯”79B9Ô†Ço–,$ÇB„&û<'x+ÍH(Ë´ZÕŠ§ݹý7J†#Õà÷Ò}BŸS8Ü 37\Bÿ䛀¨„*ó¥Êlr’fÞÛAË´]³ÅGQ´ó’2 •Ð.[¢Æ ]­íŽäN¹Ò²Hä`¸!/[*q¦8µ+UüÝ¡PýéY{k¨”nˆúBE7\G‘¼ÿ3åÅwÌz1PñÁät§¨»à½ +PIù#¶¶ÛÇ­&éúܭäÁõð>%Àñœ«fHÇ^¶¡gn'jå*n— ú€Œ2mV#Τ‚‹¤‹ÛC&»¹à¯¼â·d^]mr‹ðÇý¼Jb7Ižÿ­À`ÌI ¥"åúI|„¡ÁP?°éÃœUïqBñ8‘sIÔלȹ²öHà +f¨-@ã—ýÓE¾ÈÛ–Óy–5==påâàõãâ+B€*ŸH¿ Æœ„<ÊD® øgwöMû £¤ñ·ê0£„‘Åq2o$½º:±ñÙ®(Äà•€yn·ýiÕC‰Xžv3VzóNDäk”©?x”D!4ü´kð(—ÇÞð ù@¹›±× £!ÐÓéÜçè[]>gÏfü³ Êϳ©þÇìøÁ‚ ˆ¢ƒTÄôÚr¾Z®ÆÒ}±+ûㇿåƒXsz‡_ßYa>e<ëûjÿ +²ƒ3l[_r4(÷’$—ËUÚÉÏè² Óš-l{gôOq8ÓÜÓî$ËZ42”´jD¼LèÏaƒÙ¹>­âø€£—¯Þ¼xýùØ‘×õA"S«ãdŽÖ¤ˆô첤 ç´8Vèwuí{3+¶1{€M”'Ò{‡ÎÌ濹õ’_Ö¹lW“À± Ѻw…׶Π§—u*ä[¬6•Ó 9ñ¹›ÿ!¯¹”t  ÷å8VCûzp`¼l]SðM§Q—dÏ´Ÿs^´Ì}[t'ƒ‡Ï/#þ3©ÿÓoÈö¹RãÆæÄÏŸ J¢,-ÈÄÇô&¦Ç'ÿ?p¸endstream +endobj +6098 0 obj << +/Type /Page +/Contents 6099 0 R +/Resources 6097 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6065 0 R +>> endobj +6100 0 obj << +/D [6098 0 R /XYZ 85.039 781.388 null] +>> endobj +1878 0 obj << +/D [6098 0 R /XYZ 85.039 761.463 null] +>> endobj +6101 0 obj << +/D [6098 0 R /XYZ 85.039 741.134 null] +>> endobj +1882 0 obj << +/D [6098 0 R /XYZ 85.039 644.777 null] +>> endobj +6102 0 obj << +/D [6098 0 R /XYZ 85.039 610.031 null] +>> endobj +1886 0 obj << +/D [6098 0 R /XYZ 85.039 513.674 null] +>> endobj +6103 0 obj << +/D [6098 0 R /XYZ 85.039 478.265 null] +>> endobj +1890 0 obj << +/D [6098 0 R /XYZ 85.039 382.572 null] +>> endobj +6104 0 obj << +/D [6098 0 R /XYZ 85.039 333.878 null] +>> endobj +1894 0 obj << +/D [6098 0 R /XYZ 85.039 198.995 null] +>> endobj +6105 0 obj << +/D [6098 0 R /XYZ 85.039 162.128 null] +>> endobj +6097 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F62 4047 0 R /F38 2997 0 R /F77 4849 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6108 0 obj << +/Length 347 +/Filter /FlateDecode +>> +stream +xÚ¥’1oÂ0…wÿ +Ϋ/g'öˆRJS0b‚@‘ +¨€àï÷Bhˆ*èReðßóéÞ§ Ôü¡t4y™9rNÎ7BË+=WG|µÄ O;ˆ§g›JÔൗay›cÁX’a1U—Vº£(&"…¢8ËœêLòÕ¸ºÍGýaè{egøÕ$/å·QäH…ÊÔÞäÖk»Uu:š…è†zÓzÞÊ—k~‰éLËG ä> endobj +6109 0 obj << +/D [6107 0 R /XYZ 85.039 781.388 null] +>> endobj +1898 0 obj << +/D [6107 0 R /XYZ 85.039 761.463 null] +>> endobj +6110 0 obj << +/D [6107 0 R /XYZ 85.039 736.911 null] +>> endobj +6106 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6113 0 obj << +/Length 511 +/Filter /FlateDecode +>> +stream +xÚ¥TÁRÛ0½û+t´Þhµ’,õ(¡a¦ỉrÈ„6x†@¡aøý®,ÇqO/ŒglIûVû´ïÉ($?(œI^Tœ›]&Å–#—vˆ²ƒ”ÌYMfÆ +”à¥õ¯ã>´!Qßßæç_¦ËúbU”D”£‡¢¬*—Ÿß, ̯ãêr5_ÔóÅe˜i^ÄüfÂßV…£¼Ž ùâž~=›Æ,îê«ì¢î™ö˜•4_²Û;)îùHW™òN¼óXrx—1O0šºùcv}ï·Š1-bÖXWˆ’4xkNËU¾êÊQRŽNÊIQ"sVc•´%J+=(c†€:oxÄñ"ÀÈvýðmùURƒ¶.& w`7¬ Oæ;åÅçgæ%ŽÔJ$Öë8ÀÊöú[+Ýù‰7Þ@D°V·úÿF®ù…©N¡°6¬ë¤FtÒíCJỷÔÀƒÉ¾Ã¬Ù¾½þdǸւè—É Í Í:P>4.$|JɪŠ@#íÉ )¹ª$ûDrlé=ÓÃü•GÍÓ6:~S¨*à•uóWÞ›ýC{ûÍ?!çy·Þ7›”°VA¦ÿu·'Nš½Oì.Ô £²)†©Ø°ø±ë$Ûk‚Ö—ÀùÁÛÿ¦4A0õ¨F)PèÙ®,y«ɓ߈¡ö^t ῲ÷Cendstream +endobj +6112 0 obj << +/Type /Page +/Contents 6113 0 R +/Resources 6111 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6065 0 R +>> endobj +6040 0 obj << +/Type /XObject +/Subtype /Image +/Width 499 +/Height 849 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 31825 +/Filter /FlateDecode +>> +stream +xÚì½ytUÞ¸/YYdIB¶@BöíÃ˨H/‚1,"êQ‘‰' +AaÐA¾‚a ‘âðŠ(/È*Ã"H”ã‹QdLÙB²~ŸÃ=§Nýº«*ÝÙèTžçÎÍí»ÕýT?}«¨¾}çTúôé“––VAïÝ»·qãÆÍ›7wèq×®]nU ~øá‡:¨tVVVDD„a1­L©¹uëV³fÍ>¬oPz¬W¯^nn®+U*mª4óæÍ‹WémÛ¶ >¼‚:Ú²eË Aƒ2¥Çþýû»U¥æ ‚8sæŒh­víÚmÚ´Y½zµÊø@¥ÅB¾¾¾’øõ×_Å„EEE*Á‚/½ô’JÿüóÏ-Z´„ØoéÒ¥*3??_U¶nÝúè£j«n};"ÞððpÕ¾HÕ¹#­ÀÔ©SE¶ÚEûöíE +kÿª5(=ÊúÜlxú*®¸+ó ‰;wʘµ›êúy¨8Þ{ï½àà`YU~òÉ'*§qãÆW®\QéK—.5iÒD¢ÄØØX­Ö Aƒ>ûì3•^¶lÙøñãUÅûthKbQß’%KT:99Yߎˆtܸqª}¯sGZYlkKôyóæMžnܸ!éÎ;/Z´H*žÔË—/·jÕêÆfîü!YÌaùvàLß¾}eÉíííÝ®]»¨ÌáÇ·hÑâ¾ûî«]»öÊ•+-2'Mš´hÑ"ILœ8111Q§Nzꩧ¤ÍÈÈÈÕ«W›u1hÐ µUo@@€¾ú‘#Gz÷îíïï/…:¤ +O¼K=$èСß}÷þ&L˜°|ùr³6xæÌ€kÓ¦¤ó Ë8 LDݳgψˆýÆ¡ € +]ŸïÙ³'$$D¥%ñÆoÈø³Ï> 3ËÄo?ýô“$Dk'Nœ8þ|Ë–-ׯ_ëÖ­ãÇ;Ö° íŽSªêéééÒ²ËÍÍ]¼xq§N´WyäQt^^Þºuëî¿ÿ~­Yé½K—.EEE†#4kP<,íHkÇŽ{ñÅ ‡ä\Æðèdl’¸víšþ@̦ˡ € +Bì·sçNñžº÷+þìÖ­›z©  ÀÏÏÏ,3--­Y³f’øõ×_•»DqK–,)± aëÖ­>ú¨JkÕGõÁ¨L±Ÿ¯¯¯zUt*êVù¢Íððp­å¨ÿº5¡aƒ‚¬¢¿øâ ‡Aê‡dXÆùèƦˆá`œ»¨d¹Û¦M›AƒµmÛvÊ”)’3wîÜ3f¨We*kr³Ìäää1cÆHbéÒ¥jùÚ¤I“Ë—/ëÛ—å®sÂK/½¤IR«Þ¸qã+W®¨ÌK—.IkêÕØØX­Aõ¸qãTZ”.bWiÃ6(¼÷Þ{ÁÁÁ²¨þä“O´–õC2,ã|tcÓÄp0Î]T[¶lQ‰>}úìÝ»W%¾þúk•™””ôÊ+¯˜eŠ«7lØ ‰nܸQ>>>999úö;uêä܅ЪU+q¾Jë«k·)–/_®n€È«Û·o×6l˜*,ëdùÈP7‚ÌFhØ vkèË/¿ ÔrôC2,ã|tcÓÄp0†]”;?ÿüóµk×fÍšU¯^½¼¼¼¬¬,__ßýû÷ˆ²d©yñâEÃLIׯ_ÿúõëùùù’ÈÈÈÖÚ·oÿöÛoçææþøã&LP74ºPýÖ­[÷›o¾‘„¾º| +$&&JuYŠ‡……¥¥¥É«Ú³%"ó   UXD­º¸s÷Þµó ”Ì‘#GŠ]¥åõë×?ðÀÚThC2+ãptcÓÄl0]T¡¡¡â«±cÇÆÄÄܹûøb÷îÝÛµkççç×»woµ6ÌLIIéÕ«—$Ä`*!>|X\*+[±ÙÒ¥K%gíÚµ](’““¥µÎ;ë«#üqéZLLLDìˆÝZì²þ¬„/(Ùd…Ø9  ªˆ]X´h[ +ðŽFìœ`'±Tg±›}õÌ•¯ÚYÜÙs±MĈ½"ÄnøÕ3W¾jgñ}7×Û@ì€ØË]ìZZÿÕ3W¾jçÊ×÷Jl±b¯8±ë¿zæÊWí\ù¾[‰mT¦Ø=çíYMþÇÊùÉɪxàUZìú¯ž)¬¿jçÊ÷ÝJl "Ä~üøñAƒÕ¯_¿fÍš=ôÐ’%KÊÑ*•ó·‡ù«´Ï«´Ø ¿zæÊWí,¾ïæz›å.ö“'O†††®^½:û.ûöíëÛ·/bGìÕJì†_=så«vOŸÞ&@¹‹ý™gžILL4;á w\7;™]y<Ìðq/ç ÌÍ6l7|ŠÌ¹=å»%»u;Fû®[̤ÙFë† Ã̶pGì÷vUÀãîpoÅ.V¹pá‚ÙÉi¸ãºÙ#^®<fXÆpßuà ÛKÜÝ™òݒݺ€†ó¾ë†3i¶Ñºa°³-Ü;b‡ê,v¹*,**ÒÎFý¢×lÇu³G¼\y<Ì°L‰û®ÉpStg*bKv³n7Üw]?“f­[ÿ/ª¾³-Ü;@5_±Ÿ;w®D‹Þùÿï7nøˆ—+‡–)qßu×7Ew¦‚¶d7L»¸ïºö§ÙFë%>£oÁp wÄPÅþÔSOýýïwKìfx)¬3,c¸ïz‰CrØݹ³ÆËeKvôž놇c¶Ñºëb7Û±Tg±?~< `Ù²er¿k×®eböˆ—+‡–qÞÀÜBì†O‘9ô¢§|·d·.`¶ïºÙá˜m´îºØͶpGìÕYì‘#G¢££ëÖ­[«V­>}ú¬[·ÎZ&fO•¸òx˜aç Ì-Änø™C/zÊwKvëfû®›ŽÙF뮋Ýl wÄPÍÅ^…Àžb@숱@u; vĎر vÄ®HOO/Ró; v"%%å¾2 Õ9 ªˆ½߶ei*55µyóæµjÕºSÚ}«çã.Ç©°ŸØ###º‰TAìpÅ^Š÷`‰U, +˜=] +þüç?kÛ'–®AÄŽØ]{TT”»Õ^ˆ»»Ô­[·Œ‡ƒØ;b»Š]¿©£Ù·2 %`¸¸ÅîèÎ/•z›qçv\›s#ûöíëÕ«—”4h¶Œ‹uw†¿ã´“¼Ù|:ïoÖ©áö†™f-˜íúîÊT´k×îرc’8zôhûöí O!‡-è;bO[±›íUnXÅl3p·Vì¥ÞfÜú[ÿ.¶ ÇxáÂñ­ØUÛÝÝźf;Ãëw’7›Oç]âÍ:5ÜÁÞ0Ó¬³]ß]™ +ù¤X¸p¡jDŒmq"i[Ð#vÄž&v³½Ê «˜m^º[1în3n-vw[¸qㆶ»»»u-v†7›Oç]âÍ:5ÜÁÞ0Ó¬³]ß]™ +Y¨÷ïß_<òÈÏ?ÿl}¾©-è;bO»Ù^å†UÌ6/õ=v·¶·»»-ÈQkën]‹áÍæÓy—x³N w°7Ì4kÁl×wW¦BË(ùlêÞ½»a@· Gìˆ\XX(FÚ´iÓ¨Q£Üªk¸3¼Ã™Í§ó.ñfî`o˜iÖ‚Ù®ï®LŻߨY³¦Ù}ç-è;b‡{.v‡ÌÝz*Æl3p‹ÝÑ^*Ë6ãÖbw¥Ÿþýû‹µd0ûÛß´ß~u±wÃáŽÈl>w‰7ëÔp{ÃL³Ìv}we*YŠwìØÑâüqØ‚±#v¸çb‡ÒQ}žŸ?¾õó0 vĈ±{2ÅÅÅ­Zµ*ñyĎرƒAìˆ; vĀر#v@ìL vÄÕGìõë×W‰ TÏYrÅBå5K¥Û7þÉ'ŸLLLDìAvvv–9;wî,‹Ø¥ºEãÚ#²å.ö.]º¨D·nÝÜ”àëëÛ´iÓ^xáÌ™3/é9vìXXX˜Ã÷•äOÉ”—œ÷G3’é\å×_ ]±bÅ7dIóå—_Ž1¢2,_±—n–ÊKì‚LÂûï¿Ø+Èí5jÔP»ëÔ6"::ÚÝ6¥ŠaSZGX*Tì%b¸õ·Ã;÷í·ß?~¼…²DÔO?ý´>G )™ÎU†®ö‰-Ý=³›]PÜ1ßÞuœ7W¿ã´KyžyóæRè±»ëvõ-à +BÇêà!b7ÜúÛáûûï¿kÛ[¾©³²²µ]ʯ\¹ ™ÎU5jtþüù²ˆÝpÀÖ+vÃ=á]Çysu m—ò2Š]ZÖöCìUÑíX]êä:=%%…hÚ^ìŠíÛ·7mÚTÆæãã3mÚ´ÜÜ\Ä ‘••U¯^=õ¾èСƒ[uøá}w«ë™7ož¼=K]=33³Aƒž°û«»8Ìaé°n¡,]xòÏOÈ©çåå%# ÿâ‹/J×N~~~ll¬œ?-Z´X¼x±³Bµ?%‘””áïïsýúu•ÿí·ßöìÙÓ××788øùçŸW™·nÝ7n\½»L˜0A{_yýõ׃‚‚–/_þꫯHzóæÍZÒEÍš5¥Á.]º|õÕWª–ÃF¯Ú¨œÇ6¦¸¸øæÍ›%fnÛ¶­ÿþ¥¶q|||Ù‡zùòåV­Zݸq£Ô-lÚ´iРAå>]Z±|çÐb0eéÂóWèСC;vTº1bÄÕ«WÝmaúôéò‘‘‘qæÌ™çž{ÎZìsæ̹páBNNŽ¬CÆŒ£òÃÂÂöíÛ'‚MKK{çwTæÔ©SçÏŸ/%³³³çÎ+2ב2ò©$o½5j¨ôçŸ.oçËØ… jùf£r?Ø€¾}ûÊ’ÀÛÛ»]»vÚ—8†.ßêÿ˜V®\i‘9iÒ¤E‹Ibâĉ‰‰‰’8uêÔSO=%mFFF®^½Ú¬ ©z7ÉzC_ýÈ‘#½{÷–%Ö6Ùžx—=zHþСC¿ûî;ý!ÈzF–.ëÖ­6l˜Ê),,lÙ²å7ß|cQ÷·ß~{ôÑGeaÓ¤IYá$'';ÌŒóÈúGßõ+¯¼"k-³™‘·‰£ä´iÓFUwÆ°¢á ¶æ0‡†eœBfCD-KD9jýÌÆ¡ û‰]+µ„„™pu˜~ø¡[›Ì4kÖìÊ•+7=ôb×2å$$$D¥CCCåÖðŠ¦M›jOÝËKÒ‹C#âm»––Kç±é˘Êyü`§õùž={Ô™&iI¼ñƲþì³Ïd9a–)ˆ.~úé'uõwâĉóçÏ‹Qׯ_/’Ç;v¬aÚ=)¦]XåRQ_Kº[»v­,NÔŸòª¶†—²€wQìíÛ·— —wY‡Ë0ô½ë®å;l€,wåÊ]®¸Û¶m+º“œ¹sçΘ1C[¸ÊšÜ,399YÝ'\ºt©Z ÊÙxùòe}ûr‚9w!¼ôÒKšs´êrŽiW…²Wg¾¼*+­AñÞ¸qãTZ”.b×^š +‡ ÑfÞì(º°±ØK}³=..NN¼ŒŒ ™·‘#GªƲeËäóQÖ3S§NÕ«555µ°°033sÞ¼yC‡Uùï¾û®¬¤¼\©µhÑBeÆÇÇ'$$È…[NNŽÃ=vk±îß¿_z‘ÐË«åË'ø† 4·kùÎã°eË•èÓ§ÏÞ½{Uâ믿V™III¯¼òŠY¦¸Z}A{àÀ7n”„\0Êy¨o_Nrç.„V­Z‰óUZ_]»êsªû òªþgq† ¦ +ËúJ>2Ô Å?ÿùϘ˜¹(Ðî„›Õ••°ö Œ…6B çaª«Å!CÔó†3£ÝlùòË/åf8ó† gÀ¬5ý–q> +‡ ÑfÞì(œ»°ŸØËøxŒÌðèÑ£ëÕ«×¼ysõsêê3B&¿]»v~ø¡^ìQQQþþþòù;sæLíŠ@ªKŽ”—‹¦ƒj×kfOÅX‹]â+ëoooùtž={¶>_®Lå0ƒ‚‚ôåÇ6à矖 ½Y³fIdåä‘“\¤'Ÿøâ=9äܸxñ¢a¦¤årU®årOê?zä2PÖ±²ÌøñÇålT÷ºPýÖ­[Wý禾º| +$&&JuYŠË#--M^ ÐÕ™Ëi© +‹÷Tú‹Yy×hÏ·XÔ•¥ì¶mÛdá$‡#e´'jzöì©]Ï:H­ZµdÁ/ ¡ãÇ¿üòËuêÔ‘·žáÌHaYùˆeëׯà ebXÑy,ZÓæЬŒÃQ8Lˆ6ófƒqè–b¯ÌÚy’*ÐÐPyûËõ¸¬uïÜ}|±{÷î²ÒðóóëÝ»·Zf¦¤¤ôêÕK"•>,j’÷ˆÈA.ó%gíÚµ](’““¥µÎ;ë«Ër¥M›6’/9jÕ-¯Ê"G«%TaQ±,&î3?üð÷߯ÒfuYGɧŒXë‰'žx衇´2=zô0;YÇʲJ(‹±áÇ«Z†3#|üñÇ­[·–Ï‚èèèßÿÝyÚÍ*:Ï€EkÚš•q8 +‡ ÑfÞl0]ØLì•ÿTÄ÷ŠI“&9?øg˜yo‘ÅÕ¼yór¾Ù  Ït;VÄ`'·cu(_‘&%%EDDøûûÇÄÄ\¿~]åûí·={öôõõ ~þùçUI=’sëÖ­qãÆջ˄ òòò´6?ýôÓ–-[Ju•#í׬YSþìÒ¥ËW_}åzr†¿ù曡¡¡R}ðàÁ×®]3ë êº«C¹‹}Îœ9.\ÈÉÉ™6mÚ˜1cT~XXؾ}ûòóóÓÒÒÞyçÃåôÔ©SçÏŸ/³³³çÎûúë¯kÅf̘¡IXCÌ¿páÂV­Z¹Þ…äÏž=;##Cºˆ‹‹9r¤uUÎíX*ôÖÇÕ«WCBBTZÉË—/×ð†ÖmÚ´©(W¥¥d³fÍJ¼"n—SÚõ.ÂÃÃ333UZ4Ä°“Û±:T´Ø‹ŠŠ|||Tz÷îÝ=zôðööîÔ©ÓŽ; u*¯j?¶(ç¤VסØÙ³gccc»ví*ŸêW ]ïBÚÔßœÑ>;ØÀíBÍš5±:T¨ØeIܤIý«ÙÙÙk×®mØ°¡VXúIam½-ueohÝöíÛ¿õÖ[ÇŽ»råJ~~¾Ã«Ö]ÈUÀ¥K—¬‡ P¥ÝŽÕ¡"ÄžššZXX˜™™9oÞ¼¡C‡ªüwß}÷ôéÓ{öìiÑ¢…Ê Û°aƒvÆÇÇ'$$äæææää8Üc×w¸ÿ~éâòåË«V­Ò^u¥‹™3g&%%ɧ†“q2±ƒÜ>jÔ(¬!ö¨¨(ÿàà`±¨¬ŸUþèÑ£%ÇÇǧ[·nT™Û·oˆˆðòòR÷º-žŠÑw!µZ¶léíí9{ölíUWº(**’Ï‚ððp??¿lܸ±¸~+;@éX¼xñ“O>éV•úõë«Dƒ <ípÊò¯vú[çI”9álÏ7BCC/^¼èV­.]º¨D·nÝ<ÄÉ66é:uŽ‘D¹Q£F7oÞä´°7ÉÉÉ/¼ð‚»µ´¯[6 ±{æ€ c4bĈ÷ߟÓÀÞ 8pË–-å"ÃMÔ; +êÊÎçÎe„üüüØØØ ´hÑbñâÅwœ6B×4h8$ç^ *‰>ú¨cÇŽÒf‡:t§ {³›MŽC1ÃÖÊwCøÍ›7GGGsÚØ›¦M›ž={Vo6g\»á&êf¤»²ó¹a™éÓ§ÇÅÅeddœ9sæ¹çž»ã´º^ΆC²8"}Ý)S¦H¿Ò»\ÔtîÜÙ°®‹{³[ŒD_Ì¢µRtjˆLšÃ¦j`?dÕWPPP¾· ô›¨›mîÊÎç†e¤…+W®XÔÒËÙpH.Š]Ë{{{ÖuqovGâbkeÙ^b­me ÕDìeY±kiý&êf¤»²ó¹aùÓaë9WÄ®’»b·ÈwqovGâbkeÙ^.@øå>€êv+¦\VìúMÔÍ6HWXï|nX¦qãƲèuWìú!öâºØK±7»ÅH.FÌZ+¯ á%ÖÜŠ°=111›7o.±n¢n¶Aº+;Ÿ–‰‹‹›¨úH9™ï¡Ø###º‰TAìP¡bïß¿ÿB¨šHìû={TT”»¥ +b‡ +;Z ‚€Ø-Ähˆ bG쀀"v´@±Z@ D;  ‚€Ø-DìˆÐAÄ€ˆ v´@±Z"ˆÐAÄŽØ-DìhBEeÎÎ;Ë"v©nѸtÍüZ ‚Pî¬Y³ÆËËËú‡NJ-v ¤Séšù´@¡‚Ü^£F ™gù·¶ÑÑÑî¶)U ›Ò:Âꀈ SQ9nOHH¨¸^¤q¬hˆ mÜŽÕ-´“Û±:  ‚vr;V´DÐNnÇꀀÚÉíXÐA;¹«Z"h'·cu@ @íäv¬hˆ ÜŽÕ-´“Û±:  ‚vr;V´DÐNnÇꀀÚÉíXÐA;¹«Z"h'·cu@ @mæv¬hˆ ÍÜŽÕ-´›îÂ<Z"hA@ DÐA@ @-´@‰  "hˆ   ‚BŸ>}víÚuoÇ——׶mÛÓ§O—º…|0%%…hZ ‚••U¯^½ÜÜ\IwèÐÁ­º?üðƒ¾Š»ÕõÌ›7oÚ´i¥®ž™™Ù Aƒ‚‚‚*4ó³hˆ`‰ß¼y³ÄÌmÛ¶õïß¿Ô6Ž/ûP/_¾ÜªU«7n”º…M›6 4¨Ü§«B)¯Ù´@íGß¾}eÉíííÝ®]»¨ÌáÇ·hÑB¼víÚ+W®´Èœ4iÒ¢E‹$1qâÄÄÄDIœ:uꩧž’6###W¯^mÖ…ˆTmº ¯~äÈ‘Þ½{ûûûKáC‡©ÂïÒ£GÉ:tèwß}§?„ &,_¾|ݺuÆ S9………-[¶üæ›o,êþöÛo>úhÍš5›4i‘œœì03ÎÒ¥K}ׯ¼òÊ·ß~k63gÎœ‘c”œ6mÚ¨êÎÈÀDÎ={ö”˜M”a;³wòäÉÔªU«Y³fÚm1‡Æ-@u‹ ,8÷ìÙ¢Ò’xã7d üÙgŸ………™e +"½Ÿ~úIb'Nœ?^Œº~ýú[·n?~|ìر†]h÷p¤˜úSUOOO—–¥XnnîâÅ‹;uꤽúÈ#ˆóóòòDà÷ß¿Ö¬ô.¾-**ºtéRÆ ¥—;wwôÕ®# ë^½zõOúÓÆóóóÏ;ô믿ê'Äù@.^¼|ûöm­L·nÝ + + +ÌfFŒ*ÝI§ÇŽ{ñÅ §]Æ&-_»vÍ,fíègï?þ(ìرCÊ|üñÇ2l‹Æ-@5‰ ètçÎ"RuÏV(ÊR/‰¸üüüÌ2ÓÒÒd‰( ±¢š˜dÉ’%%v!lݺUÌ*­U5jÔ| 2ÅZ¾¾¾êU‘•¨[å‹ÿÃÃõ–e¥ª­QåƒàèÑ£âÞÖ­[ÿë_ÿ²¨;eÊ” h½;¯iD>,ž}öYíÏÓ§O÷ë×ÏlfYcñÅÓî06³‰2lG?{2Ô¥K—ª´|NN ¨V”å®\ãË¥}Û¶mEw’3wîÜ3fh WY še&''3F"µ8oÒ¤ÉåË—õíË:Ó¹ ᥗ^ÒÌ©Uoܸñ•+WT¦¬À¥5õjll¬Ö ˜ܸq*-J±k/Mž{÷îU‰¯¿þZe&%%½òÊ+f™¢  6HbàÀ7n”„ONNŽ¾}YE;w!´jÕJT¦ÒúêÚÍ1§ºó ¯nß¾]kpØ°aª°,GÅ„êFâŸÿügLLŒ¬uµ;áfueY«=#G¡PÃù@D­ê*@1dȯ¾úÊlf´›*_~ùe`` áÌ;ŒÍl¢ ÛÑÏž UêÖZ€jÁŸþùÚµk³fͪW¯^^^^VV–Hoÿþýâ=1ƒ¬?/^¼h˜)éúõë_¿~]¬"‰ŒŒ i­}ûö²ŽÍÍÍýñÇ'L˜ î$8t¡ú­[·®úÏM}u‘[bb¢T—¥xXXXZZš¼ =p"2 + +R…Åüª ììlíù‹º² ߶m[ff¦Ž”Ñž¨éÙ³§J8H­ZµdÁ_XXxüøñ—_~¹N:òd83RxäÈ‘"^Àúõëxàçiw›ÙD™µ£ÍžÐ¹sçE‹ÉPOž<9iÒ$ÃÆ-@µŠ`hh¨Hlìر²Ö½s÷ñÅîÝ»·k×ÎÏϯwïÞj=l˜™’’Ò«W/IˆÖTB8|ø°ÈYÖ¢8uãwíÚµ](’““¥5‘’¾úÁƒÛ´i#ù’£VÝòjTT”VK +¨Â¢bYµ:Ü-~øáï¿ÿ^¥Íê +~ø¡ÈSôøÄO<ôÐCZ™=z˜ˆ¬ÆƒƒƒEã;v>|¸ªe83ÂÇܺukù,ˆŽŽþý÷ߧÝalfeÖŽ6{’NMMíÚµ«··· UiØ8 ¨Î”%Ÿóƒ†™÷–iӦ͛7Ï3§ ÐABV}ééé®dÞCdí* {ín¼§M  ‚€€Z"hˆ  "hˆ   ‚€€Z"hZ"hˆ`õ$===¾ °   ‚žFJJÊ}e@ª3‡€€z Ø###º‰TA쀀z¬ØKñãR±Z"ˆØÐÄhˆ v@ @;b´D±#v@ @;Z ‚€Ø-Ähˆ bG쀀"vÄhˆ b@ D;  ‚€Ø-Ähˆ`•#;;;Ëœ;w–EìRÝ¢qéšù´@¡ÜY³f———õ!•ZìH§Ò5óhB¹½F2Ûòom#¢££ÝmSª6¥u„Õ-A¨·'$$T\/Ò8V´@‰ mÜŽÕ-´“Û±:  ‚vr;V´DÐNnÇꀀÚÉíXÐA;¹«Z"h'·cu@ @íäv¬hˆ ÜŽÕ-´“Û±:  ‚vr;V´DÐNnÇꀀÚÉíXÐA;¹«Z"h'·cu@ @mæv¬hˆ ÍÜŽÕ-´›îÂ<Z"h"gˆ[ù€€V VD­Ê9Ž€"vÄhˆ ÊùÓO?mÙ²¥¯¯¯Ê‰ˆˆ¨Y³¦üÙ¥K—¯¾úJe~ûí·={ö”ÌàààçŸ^UÔ#9·oß~óÍ7CCC¥úàÁƒ¯]»æÜ…s­[·n7®Þ]&L˜——gÖ£Eaiêõ×_ + +Z¾|ù«¯¾ éÍ›7«†csŒüûÑGuìØQúíСáC‡„oV ¸¸xöìÙ5’ö àííÍ©…€ÞC±Ï˜1C“°†8sáÂ…­ZµR†……íÛ·/???--íwÞ1\ßJ¾È-###;;;..näÈ‘†]8Ôš:uêüùósrr¤ÖܹsÅÏ=š–6¥LVVÖ¶mÛjÔ¨¡ÒŸþ¹6~‹±9ÌÆ”)S¤Gé799¹sçÎÎb7, sµxñbéTòå#‰•?Z"è™·SÄí"I•–µ®¬„¯_¿nQ7<<<33S¥Eã²`våvGÓ¦MÅ·*-í7kÖÌ¢G³ÂZ›ú1KÚËË«Ôc“má­»aÈÈHm`ÜÒA @=JìgÏžíÚµkHHˆŸŸŸöêîÝ»{ôè!ëÔ©ÓŽ; ëúøøèïlh‚µ»´Y\\¬Ý0‘F,z4+¬oÓ0]º±9ûܬ€´/ãAìhˆ Š½}ûö2EÇŽ»råJ~~¾Ã«ÙÙÙk×®mØ°¡VWo3Y?_ºt©Ä.j5iÒD[–ËZZÖä=š.Qìc³²ëb—ʱ£ ‚(öÀÀÀýû÷^¾|yÕªUÚ«ï¾ûîéÓ§ + +öìÙÓ¢E •¶aÃMŒ3gÎLJJßJ±ÔÔÔ!C†váP+>>>!!!77WĨ¿mnØ£YáÅn66‡Á”Zì£G^¿~½ÌÛ/¿ü2vìXÄŽ€zŽØ·oßÞ²eKooïÈÈÈÙ³gëÅìããÓ­[·ƒj…#""¼¼¼Ô-뢢"ù,÷óó0`ÀÆͺÐ×2{ÐÅ°G‹§b¬Ån66‡Á”Zìr1xð`ÿ‡~øÔ©Sõë×çÔB @Áäçç¯\¹rèСLZ"UæÍ›ËõEíÚµ tñâE&-´DÐ$‚€ˆ   ‚UŽÅ‹?ùä“nUÑçkРQ…n«î|ì2{‰‰‰œHhˆ ‡pãÆÐÐPwŸâèÒ¥‹JtëÖ­â<ì9 Z»Ì^£FnÞ¼Éé„€zÉÉÉ/¼ð‚»µ´on6¬º‰ÝðØGŒñþûïs:¡ ‚žÀÀ·lÙR..­Ì}Ýz/..–Ȇ„„øûûGEEé¿(ª¯¢òóóóe Z]IKNéúÕؼystt4§Z"è 4mÚôìÙ³z?;ã¢Ø+y_w= ,xíµ×®\¹RPPpäÈ½Ø ·‚úé§øáI=zôÙgŸ-u¿gÎœiÒ¤ §Z"è ÈêTdX¡w?*h_w=²œþÏþãÜ ÙÖ.ëÖ­SˆMŸ>ýÿ÷Kݯ†Ì¡¶‡0  ‚%ö²¬ØõV¾îU´}Ú]»\."¤J»ví²²²Jݯ†\ƒXܨ[jÁsö𬢻‰–Ë°»+·bÊ+F•°¯»ùøÐvztEìB¿~ý/^üØc•¥_ý·bì*öãÇ4¨~ýú² +z衇–,YRŽ^ª'—¢—Jb¯8bbb´_|.ÇU¾îzÆ—’’"-ˆ`§OŸîŠØ“““å}úüCË)E¿üç©]Å~òäÉÐÐÐÕ«Wgßeß¾}}ûöEìˆÝÃYºti)w,1F•°¯»žŒŒŒÇÜßß¿yó扉‰®ˆýܹs2<ùÜÑrJѯƈ#–/_Îéd?±?óÌ3fß>“Š}ôQÇŽ}}};tèpèÐ!•oö«®<æ\æÎÝ}±±± 4µ\fÞ1yÜK%dq"ï&y/ÈšMýgV‰wV`³®Ò¶mÛ_~ùE.\¨Q£†Jÿûßÿ–|ë0¶0cÆ ùôDìåEfff)¾ zΟ?ߨQ#í^=ØIì!!!¢/3±O™2%--MÄ+€;wVùS§N?~NNŽ¬ðõ¿óåÊ#a†eä"4..NV/gÎœyî¹çî˜?î%‰9sæÈ€¥÷iÓ¦3ÆõʼnÃlUÞxãeË–IbÅŠ÷ß¿£¤eQ$C²ž³aK;'Nœ`Å^¾,Z´ÈÝ-@ÏO<Á–v»\]Ê¥œ&"ý +V¯>‘˜\ªtÓ¦MEÂ*-kæfÍš©´+„–‘®\¹bQËpHW¯^•O%·nzè`³¨òý÷ß?õÔSwîÞÈ]²dI=$-"©©©Ö3`8ì#GŽäæær+*sÅ~îܹ-ªÿS ¯=£uûömí9XW 3,#êŸ.pQìòy¤umai³ج? þë¿þëæÍ›‘‘‘20ñ¶42`ÀíU³p¶\•œ:uªB#ˆÝYšþýïwKìMš4Ñ–Ü×®]“嫾˜õ#a†e7n,ËowÅ.]kOjö¢0{€Í¢ŠºÙòÿþßÿ›4i’¤åsaæÌ™“'OÖ^5›ça8p ))Iûï Ä• öãÇ,[¶,###''g×®]%Š=>>>!!!77WÊëï0»òH˜a™¸¸8Ѧ àüùóê ÑbOMM-,,ÌÌÌœ7ožöÛ»½è1{€Í¢Ê»ÿÉ[§N½{÷Jzß¾}’þú믵WÍfÀlØãÇߺu«áÇV‰iÄ¥Xï9r$::ºnݺµjÕêӧϺuë¬5eöLˆ+„–=J¾´Ö¼ys¦µØ£¢¢üýý¥YEËÊß°=f°YT¹sww¦Ž;ÊǤåßvíÚé?,žŠ1¶\)ôë×Ï𠈪ù…|ý +*´€Ø; "Mzzz|êÌ!  ‚EJJÊ}e@ª3‡€€z Ø###º‰TA쀀z¬Ø£¢¢Ü­¨~ö±Z"ˆØÐÄhˆ v@ @;b´D±#v@ @;Z ‚€Ø-Ähˆ bG쀀"vÄhˆ b@ D;  ‚€Ø-DìˆÐÁªEvvv–9;wî,‹Ø¥ºEãÚ/³ "åÈš5k¼¼¼¬©Ôb·@:•®™@ D*Èí5jÔ9—kín›RÅ°)­#¬hBå¸=!!¡âz‘Ʊ: "¶q;V´@‰ ÜŽÕ-A"h'·cu@ @íäv¬hˆ ÜŽÕ-´“Û±:  ‚vr;V´DÐNnÇꀀÚÉíXÐA;¹«Z"h'·cu@ @íäv¬hˆ ÜŽÕ-´“Û±:  ‚vr;V´DÐfnÇꀀÚÌíXÐA;±é.Ì  ‚€ˆ  ´@-´DÐA@ D-A°¦OŸ>iiiÝ˃>˜’’bƒéÚ»woãÆ›7oΙƒ€z?üðC‡T:+++""°˜V¦ìdff6hР  À­Zå8€²£sëÖ­fÍš>|ØGˆ€VgæÍ›¯ÒÛ¶m>|xE÷¸iÓ¦AƒÝó/..¾yófYZزe‹' "X…8sæŒx£víÚmÚ´Y½zµÊvìX³ã²žFi?$$ä7Þ)úì³ÏdJͦȹGýlHE™sëòžE @õˆ“eí­Ï5jÔ| Ò¢___Iˆ$E&EEE*Á‚/½ô’Jÿüóϲ.•„féÒ¥*Sìª* +[·n•…´¶êÖ·#š +Wí+õ9t¤˜:uª|ÊhíÛ·w8)S¦È¨TZQ·ñ͆$ŸVG½}û¶|Xüë_ÿÒ@ª,Y²Dß²Y#ÖÓ(ƒìÖ­›JÈeŽYSÎ=jƒ‘Ã×þÏÔb„€€êyï½÷ä2_Ö–Ÿ|ò‰Êiܸñ•+WTZ·Mš4‘„è(66V«5hÐ Y…ªô²eËƯ*Þ§C[ÙÊG€&¢ääd};ò 2nÜ8Õ¾Zy:t¤…®¶DŸ7oÞäÉ“DºÓ +H#'N´’T— 9d¹vЪ¨Èñ^¾|Yß²Y#ÖÓ8wîÜ3f¨´¬±eüfM9÷¨ FæM[[ŒÐAŠ‹‹¿üòËÀÀ@õ§vÛdùòåêÆÂÀ·oß®2óòòêׯŸ™™©þ2dˆÚ;W*Ê*Ô¹ýV­Z;vLûDÐÚ† ¶qãFÕ¾–0, k¸ôíÛw÷îݽÈêW+ ½lÙ²ÅbHÿüç?cbb:tè ÝÀ× Urrrô…ͱžÆ>}ú|ýõ×*””ôÊ+¯˜5åÜ£6ùÜQ ëZ"¨G”+ªY¿~ý< Ý¦HLLÌÍÍݵk—\û§¥¥I€€í鎽{÷>ôÐC*]XX(*»qㆤ;wî¼hÑ"©xòäÉI“&i]Ô­[Wý龜W +kíeddHûòI¡úŽ´j™*YYY²æ—¥‡‘Û¶m“ù\F¬‡”íïï¯=m¢ @ÒíÛ·ûí·¥Ê?þ8a‹F4FŽé02Nù Ù¿¿²ŒG–ë/^4kÊ¡GýlÔ«WOÊz„€€êiݺu­Zµ¢££ÿýw•sðàÁ6mÚøùùõêÕK-hEPQQQZ•øøø9sæ¨ô4ɧ¦¦víÚÕÛÛ[<&kT­¼¨XZ§¥¤¤èÛ‘Ž¤ Õ¾–0,pçîÿrŠÏ›5k&køž={:ȇ~(”2O<ñD‰C~øáï¿ÿ^¥µ‡–6YKu?Ü¢ÅÇì0òÓ½{÷víÚÉ÷îÝû§Ÿ~²CúÙÐFe=B@ @«.—/_~æ™gfÎœéáã”Õ¸zØÐA0£K—.^^^²&—¹º#áÉÈZ:==¨¡ ‚€€Z"h "hˆ   ‚€€Z ‚hZ"hˆ`5!===¾ °a   ‚žFJJÊ}e@ª3‡€€z Ø###º‰TA쀀z¬Øõ¿¾á"R±Z"ˆØÐÄhˆ v@ @;b´D±#v@ @;Z ‚€Ø-Ähˆ bG쀀"vÄhˆ b@ D;  ‚€Ø-Ähˆ`•#;;;Ëœ;w–EìRÝ¢qéšù´@¡ÜY³f———õ!•ZìH§Ò5óhB¹½F2çòom#¢££ÝmSª6¥u„Õ-A¨·'$$T\/Ò8V´@Á6nÇꀈ ´“Û±: "Híäv¬hˆ ÜŽÕ-´“Û±:  ‚vr;V´DÐNnÇꀀÚÉíXÐA;¹«Z"h'·cõJfÑ¢Ehˆ TœÛ±z%£&-„ +r;V¿'VGì@¡‚ÜŽÕï•Õ;A¨·cõ{huÄDÊÝíXýžX]M8b"áv¬~¯¬."v ‚PnÇê÷Êꈈ TÛ±ú½²:b"`3«#v ‚6³:b"`3«kbß^þýï£ ‚buMìe¡ +½ËÐb°½Õ…e uëÖˆˆ €GY½ŒÌš5 ±°Õ;A›Y±°™Õ;A›Y±°™Õ;AÛSöo/VÄ÷«Ïw*ïÉÖLjˆ bGìv²:b"ˆØ{±xñbeõuëÖUr׈ˆ ížoß¾^½zÕ¬YsРAׯ_×^ŠˆˆL__ß.]º|õÕW*3???66¶Aƒ-Z´59HxÆŒ«W¯–ÄíÛ·ß|óÍÐÐPiaðàÁ×®]Óºûè£:vì(ÍvèÐáСC*¿¸¸X‚âïïUÄnýûàˆ- v(‹ØçÎ{áÂ…¼¼<õ˜1c +HþÂ… [µj¥þœ>}z\\\FFÆ™3gž{î9½ØW¬XqâÄ •~çwfÏž-Ų³³¥üÈ‘#µî¦L™’––&ÉÉÉ;wVù ,xíµ×®\¹RPPpäÈ‘jr+æ^¹±´½Øµô7dÍì\FÜ.þQéfÍš‰~[çææj™ááá™™™*-Ëõ   çîrrr¼½½UºeË–ÿùϪխ˜{èvÄD°úˆ½¸¸ØÇÇG¥Ïž=ÛµkWQ½ŸŸŸVLT|ûöm‡d}~êÔ)}¦´£ßHPû\p0¶ö§”—Þ«¡Øï‰Û;Áê#ö›7oÊ‚\¥Û·o/Q8v올Ïóóóµb7¾zõªC HJJÒn˜«…ý¥K—¬»Óÿ)r]P=Å^ùnGì@m/öÇŠ½7mÚ4jÔ(•¸ÿ~É¿|ùòªU«4ÓÆÅÅMž<9##ãüùóêιöÒøñã·nݪÒ3gÎÕ_»v­   55uÈ!Öb7n\JJŠ\ È•ÂôéÓ«›Ø+Ù툈 ½ñññéß¿Íš5ƒ‚‚þö·¿©üíÛ··lÙÒÛÛ;22röìÙšisrrF]¯^½æÍ›+i/ÉGC¿~ý–,Y"iiG>ÂÃÃýüü °qãFk±Ë'Åã?îïï/Í&&&VC±W¦Û;A›¹±°™Û;At{·nݺ––Æ#v ‚žæv~Ì;€ÍÜ®äœZΟ?€xŽÛ•ØÑAÛ¸±°™Û«¡Øÿò—¿ÄCÕDb‡ØJt{5;Tu;€µÛ«•Ø<¸ª>GÞÈn¯Vb¨nGì¶t;³`3·3vr»——ó`'6mÚÄ$€GÁ/#»8õë×W‰ XT4k­ræÙy÷6ôîv‘ššÚ¼yóZµjéë–Ë8õ-ó&‚J8ó'L˜àÖIRƳȡº»­Ùà.Ý!téÒE%ºuëVŠv*gÞœYŽ¡¯„XüùÏþꫯ*bêô-—½AœIð4É 6L–ˆÝÃÅ>dÈ•xy¬ØYµÄ^·nÝ +š:}ˈ*áÄNOOïÝ»wqq±ÃIrëÖ­qãÆÕ»‹¬êóòòÔ«z$çöíÛo¾ùfhhhÍš5|íÚ5ëîªË¿}ôQÇŽ}}};tèpèÐ!­pDD„´)ù²T«çêzòóóccc4hТE‹Å‹[œÿ’HJJ’öýýýcbb®_¿®ò¿ýöÛž={JÁÁÁÏ?ÿ¼Å<¨F^ýõÀÀÀ   åË—¿úê«’Þ¼y³[‡ Êyü®¿»g̘±zõj}¦ô­·Þ + ‘cŒŠŠÒ»ëîî\•Kè]9£ÌF%ùŸ~úiË–-¥M‡ˆ;÷uŸ9†·b\<ÕK º‹ï ‡c© ™»Š]þ:uêÊ•+NcÉœ?~NNNvvöܹsEb†ËƒwÞygöìÙR,..näÈ‘î.6¦L™’––&ZKNNîܹ³CyéÂ… [µjUââdúôé2É™3gž{î9k±Ï™3çÂ… rtÓ¦M3fŒÊ Û·oŸŒDÆ#ÇUâGNíþŒ\ÓùøøžT’¯¿0ÔÎäÒÝÔþ<{öllll×®]å=ëçççÊ# +2`§»b/**Òm÷îÝ=zôv:uê´cÇ×çÁ0íâ!è'Üaü%Τ,ÉN:eØšŒSöóg<Üm‰sU.¡wåŒ2•+w%ß°Œ+se]|•Nìîì-vywÈÙ¨¿foÒ¤‰¶“{Y¸jUôþ‘uæ¥K—ÜêQ_Ý윔+ˆ·Þzëرc²ˆ• LýÄÌ~7–Å›>GÏR×úí,‡&Gª¯%×­k×®mØ°a‰ó`-AËw‰3yàÀ¤¤$ý}r­5‹öß®¨Ìb´®ÏU¹„Þ•3ÊlT¥»Ùœëº20W¦ÑÅwµØËk&ÁÞböíÛ׫W/-'>>>!!A.óåâNo9,,lÆ Úy5sæLq‹¼¹ + + +RSSµç"”©Þ}÷]‡ª›“û÷ï/,,¼|ùòªU«´|‡êzâââ&Ožœ‘‘qþüyu;Q“Ë–-“¥§§O:Uÿ.“¡Jãr¡:oÞ¼¡C‡ª|íéÓ§¥üž={Z´ha=%ŠÝÅCÐòÇïbìÆ¿uëV‡ÌqãÆ¥¤¤H/²†œ>}z‰Š3­[se‹¡·8£ô… Gå®Ø-†ä\וYL£Ù<˜5k!örœI°½Ø…Áƒ[?#lß¾=""BÃê–,õå— ÏlܸQûõ×_kÕª¥ÝÖp¨nvNJ±–-[Ê•~ddäìÙ³õùúêzD¼£G–Ñ6oÞ\T,9²”íر£\¶k×îÃ?Ô¿Ë¢¢¢üýýƒƒƒåä—e§Ê—ê’#å»uëvðàAëy(Qì.‚–ï<~c'+Ã~ýú-Y²DŸ)3ÿøãË1Jk‰‰‰%*Îl´nÍ•5.†ÞìŒr(l8*wÅn1$纮 ÌbÍæÁ¬Y ±—ãL¸ÅÊ•+_xá…*ñqUn®ˆ À=A¬þÍ7ß +ÄN ZQŽ›W—±…sçÎÜÃ1Ø,¦rÙ§¥Ò&³,qڃǞN‹-=zt5wZåŒß~[.WœØ+¿ÙR4ˆØÁcÅÞ³gÏ={ö vÄŽØ{uÆ­]¸-ò†»‹»µ?¹ÅW>Ív?}útpppaa¡ô.†×Û^mcV×l÷r=´ß»ó›Ë°®Ùl8·é<¥†ýŽÙfæÎC²Þß•Q™{‹Ù³g7jÔH^0`€¶Wa©·C/cÜÍÊŽÇâij¡ë›´—x +io"‹è˜Í°Å; ª(.îÂm‘ï°Ø]ÜÅýÉ-6B7ÛQüïÿ»öKO?ýô?ü ‰£G>ûì³ÖuÍv/×SAû½;¿1 ëšÍ†a›3,cx8f›™[ÝWFev>HZ>h²²²¤ºx¬¼¶C/uÜÍʘÇìÄ+q„úWÍ/ñrå»þ¿öÎ>F‹êúãJ)-PÖRØ +$º°YQIÓøRaQ`©XA±‚J-¥Da•€XqY^\¡‚Š ZŠI%®ÛZ‰(.Z ò²%YAÑÖº,Ey)OO˜ünîoæž;çÎ3Ïë~¿lfæ¹sï¹çž{æÎìó|†óp(«ÊÑÜJá=.¤‹Køä ¼(^VVVWWçmoØ°ÁË~”Á6nÜh?—£—ëJïÝr;¬ŸËyÃX§Ï0c™ä»cI«¸xèÓ§ŽŠ‡î:î\ΞÐÀ“Ì®òÐ’$vÎÃV?”r¥p‡·ÐÅ#ðÉ%@xµ{ðàAº»TÒ¼ åÕPZZJ‹û¹½\WŠxïÜ“(ß¹œ7¸:uÃ8Î|’ݱ¤‰U\7 »“ŒNŸ>½zõjuƒÁÃPKKìýúõ{÷Ýw‘Øó#±ÓÚ˜¥mÛ¶­¨¨øôÓO1áa‚ ‚ ‚ ‚ ‚ ‚ ô _p‚C;W³ÇQYûÏîȯ9ÈVd®L®¼Lzñ~suïÞ½£GîÔ©S›6m °víZ®Z=b½_LwíÚõ¾ûîS‹ãÇ7®cÇŽíÚµ9räsÏ=—+#˜êV2‡®ìÙ³§¢¢‚†²  àÇ?þñ’%KbìHŽŽ©°BybÏû¨ËÚ¤—÷}lhhèÞ½ûÊ•+›ššNž<ùæ›oN˜0A’Ø8¢³fͺóÎ;½ã7ÝtÓO<ñå—_RUuuu·Ür {.&öýû÷STÐ%þäÕÖÖþä'?AbGbGbOu}*#Y‚Â?~|UU•0*ŒKËõ¶mÛzÛdÀ×_j¿Ñ°Ý»w_qÅÅåÌ™3%%%/¼ð‚yÄ’sjým·ÙˆÔ.--ݵkWâëµ_¿~\I§^Ìœ9³¨¨¨K—.+V¬˜6mZçÎiû•W^ñ +\yå•ûöí£cÇŽÑ“·}àÀ:îëˆÜ'ºíZ¼x1FÇæy^?×ØdÐôÆi’ê—pƒEåÁƒSÓtÿ¥°EƸåÞ)ÀuÓ8jƃ¡ÞæPóÆŒ—|ÒË¡‹—È,Aa“3=šLbÿüóÏ–Æ´²²’÷Ô©Sû9Ãè~Ù²e´Aw3fÌ0šÁÄ’Û!Õv°vPF¤6…wY|æ™gèVÅRRÞ úèĉ›7o¦¼ímoÙ²EÙùØc-_¾ÜsÑ¥—^º`ÁÚ^³f õÝ×+\ (]8¸¨0:6·Èó¡0ódÐô–{ê^jÀu“N'ÏP»tqTž1Æ-çFÎx£‹ì~ãìçPó)Jz¹xW¢™%(ìÖ­[Ÿ={6Zb§è*¯bãðáÃcÆŒ¡eU{óÍ7ôÑGÆš9ÃèÂMAMž<ùܹsF3¸s…>ñ*ÖʈԦOyy9m :TuVB5í…nm·jÕÊÛþàƒÈôAk*º4ˆ¶iÖ××ûjp’û¢B÷¿¾Få›[äùÐî$ƒ¦·?ŠIÑK B§pSS“òŒ1n97rÆ]d÷g?‡šOQÒËÑÇMN(l¾O>ùÄØŠý탫“h—²ÇSO=åƒÑQ~¦„O‹+uõÝFY Û½{7]ˆé/×;î\¡O„`í 8¤6õ‘bòꫯ¶—ŒÐ nûºë®knn¦¹@n§)O=¢»Wãè;É}QÑØØ(ynÊáÏNò|hw’AÓ7RýRI¢  +U=ƸåÜÈot‘Ýo–Led€§(éesb·øÁ …=vìXºéã>P~V» «¡ü?tq/((0~d1lúô锵Ƨ¯%ÈkḠÑßœ‚HíY³fѲºgáJFè·M÷ésçÎ}øá‡i›f\ee¥R …–K¢‚n +ž~úi§L˜[äy!ó6š>¸‘ê—H;M+µò7Æ-çFÎxnFýf·ŸCͧ(ée­8ºoW‚ÂÞ³gOQQÝ=Ñù¶®®ŽîÎÔÅ·¢¢‚r»÷È…¶·nÝj(º¿£¨Š¢çŸþ¶Ûn3³`«½/[ÖÔÔÌž=ÛØYî\ab— ¿)¥xúuqHm²®_úC' Õ\Ò n{ûöííÚµ{ã7h»¶¶–¶ßzë­`É@r=*:wî¼|ùrZÔÑhþùÏ›¹EžíN2húàFª_jÀ-رc‡÷šøM›6Mœ8Ñ·œ9ã.2 õ6‡šOQÒËZq,t_%(lÒûï¿OŸ¶oßžîbèjþüùê#J³´Z +º|¯[·.t©PUUuà 7vèÐaüøñÜK†Q2¡µ÷ÀŸâ°wïÞ”µbäµ0±‡¢¿éFöëOüTì‘Ú´Œéß¿hɽà¶éžšZôEKKK+™@r];wî¼õÖ[)*È4¦6l°;6·Èó’TMÜHéK ,AKöÓZ‹8Õ?gÎulŒ[‹Æ]d<êm5Ÿº¤µ4­^½úÞ{ï•—_¸pað9 ”Á9!h£Åm6¸¨y(E¢ ²mÛ6aaZ<÷íÛ—ûò„Äž…AËÅmfÝÔ<AAAAAA‘¥¾Ô©S§–Ó¯úúú^½z&’@^ÛU]]}Çw?JÑ¿–ôN¥AÉ÷ˆoÈÕp¬PW]u•·QVV–­ {¿®¹æE– 6”|§šššºwï®þ#ŸL¨±SHìñF~¿×WÆì—ú9ÕÏ~ö³|Jìö~µoßÞÒPòª©©Ñ¿ œžÄnì{Î%öì¯{Ž†¨‘¥,ÁJ[~æ¦ã¯b,sdˆº½ƒFrµÚM¾EZ½úê«Áæ¢ñŸ} ‹E!qÚŽ +7r³9|ÄwÐ-y¯AÆg(Çü7’óOŸ>Mf¨siÛ{ù‚°ic´„Änd)K°Òø³Ž¿V’`™£AÔåëËÏ·#·Ø£G#GŽX–sNüg_C–b®áDœæàÆQã ðùˆï`Uy¯AÆg(ÇüçÈùcÇŽýðý«ÿ]wÝåÔ´±-!±«m¥,ÁJKàÏÁȱc™£AÔcLìZ¤ŧä>]ÂŽ`p \‰ÓF¸qÔ88?ñ­”‘÷d|†rÌα6lðV ³fÍÚ¸q£SÓÆ^´¨Ä®³”%Xi!üÙ Ë ¢cbТ<±'üçöBBœ€st£œ€øVÊÈ{ Ò?Cƒ/V02ÿ9OR§û:¥´´”n¦œšæ^ˆÐr»ÎRödÇJ áÏNXæhõ${’-Å$Ãö•—„„8-ÄÎûFÍÎTÖÄ·RFÞkñÊ1ÿ-WÌ!C†TWW>C9æ¿%±×ÔÔP¬ZµÊij$ø"ä}b7²”%Xi!üÙ Ë ¢žLbO¾ÅgŸ}Vÿºc’üg_yI1á@HˆÓ¡¨pã¨I¾Äwö¼× ã3”cþ[{cc#YH—§©‘à_ˆÐrÅ@ÑD«JýJ«€ø† $ö,Ô¢E‹8¤dßAAAAAAPF”¯<ö¸;:m—ü@2Õ^J݉Y ÉWû Rô–4¾ÈYIòØcˆ¬¾T#vãuxÎ%öôŒ³9äŒMÛ_ÙF²6´d¬}¼J’ÇŽÄžY‡#±çGb·¿ ‰=‚rkŸ†ÀK'™Yuwâ~SU3gÎ,**êҥˊ+¦M›Ö¹sgÚV¿ô¥šÛÁÚÉC¼%â@è\‹F¢µopçÆÕ–t/·<ýqߺN¯ÁRIè¸Ø_ ô†…gnì WçéÓ§§L™B«Ü’’’êêjãy%Ø|ËX‡þ9°öYžØÓLfBݸßT'•9qâÄæÍ›éÆÊÛÞ²e‹²_B5Oð`íX ÞBAèÆ9¢µ¤;qµJºŽ‘[žñ@%­_¿þ¡‡²W"K’‘xÃÂ37ö…«“–©´KÇ?þøã»ï¾Û²Š6bó-c-DôÇÁÚgyb·d˜T™…Pw'î·ªS·™¶[µjÙ6¬ ÄÛ)·¤z‹ÑZÒ¸Ú +%]ÇÈ-Ïx Ö××———+>3W‰ë¸CKâPž¹°Ë4ƒ(¡I†ÌˆÍ0¯SÁÚçPbO™YßåPÞNÜoãLI¸ÃϹÝX Þv…‚Ѓ-‰Ö’îÄÕV(é:Fnyfõ³Ï>ûÑ~¤¨¸J\Ç%è|‰7ByæÂ.ûïv'±ùæuŠÂ#=XûÜMìi 3 ¡îÆ%àqã¶Å6 X;ˆ·]BºÚåˆÖ’™o[ÒuŒÜòŒª·A«tZ¬îܹSÿ”«Äu\‚Ηx#”g.Dñ_vÙe_|ñ…pÈ‚ØüÈó:öðÈÖ>‡{ÈÌB¨»÷;4±s¶ ÁÚ±@¼õÙD½ó ¡ûv9¢µ$SÅÕV(é:FnyúUí>ôÐC/¾ø¢Ï®×q :_âPž¹Å?uêÔéÓ§Ó:üèÑ£Þ³k˱ùæuŠÂ##XûJìi 3 ¡îNÜïÐÄÎÙ&kÇñöD¡UXX¨?·{žk‘#ZK{\m…’®cä–§?Píߊá*q— ó%Þå™ Qü”»Èc4›¨ÊÃö! bó#Ìë…G"X{¨å(âMŸêo倠\Q›Ay/!Ä›²ú¶mÛà.(·dÄæCAAAAAå´’§À¥”3A;A„ÄA”¯‰½¶¶vðàÁú/ªŒtk®Ù—„}ôQï5%Àud–8A$Lì ,8vìØ7ß|C‰úþûï÷ðÑ­-¸æ•+WîÝ»×Û¶®#³Ä!‚ ׇMMM +,ïËí +ŒÉáš)ëz àÚ•%A¹&öóçÏ+.1G·6âši}~èÐ!ý +àZ¬† ‚\{ss³z­ G·6âšÿö·¿-]ºT¦+àZ¬† ‚„‰}ÇŽgÏž¥ì½iÓ¦‰'zÇ9ºu׬>š=eÊZb•””TWW[f:m,]ºôòË/¿ä’KFŒA3Î;¾}ûök¯½öÛßþv·nÝî¹çïà×_ýàƒv¸ _üâß|óªdæÌ™EEE]ºtY±bÅ´iÓ:wîLÛ¯¼òŠj‘š(((  +¯ºêª¿þõ¯úrE-Z”UAûÆô•\·n]ÿþý©Ì~ðƒ÷Þ{ÏÒ‘ =¾ª"ôÑKn?þøw¾óòð7Þ¨jþïÿ;{ölÊ™tʨQ£þõ¯í¯­­úÈéQŒî‰ ­[·>{öl´ÄN'644КM]}>-tëFWÑÔ¦u)RZZJ·QöÂN1 ÏˆÐ +…1™db­ßu®…¦ß8 M’ÎŒ¥]K¿rN—]v]õ#´°ôž=ZzJ—¼ï~÷»úYtƒ³~ýú®]»z»ô©Z*PaZó“^¿~ýüñ]»vÑ:œÌÐ[ק¼:´ß“>#% ÍÒ4¿Ôó[ß]ÉgŸ}&ŸõÍÍÍjUé­Ni™j|cqlÆŽ»páBãG={ö¤ü¬v8@+(ù "·/%®2dHuuõðáÃõ›VcaI gDh…˜´Ç•$üìõ[æZò‰Ýuh’tf,íúúeY1f¿¦N:}útZÑ=zÔ{îD×÷åË—Ÿ9sæàÁƒ3fÌÐ{Z__O·Ì´ì¡•ÕèÑ£½ãË–-£»f*¿uëÖ’’ïà¯~õ«ßþö·§N¢»îÑ´q»¨¨¨®®ŽZ9~üøš5kô†/¿ü²rµ:´ß8LF#%ãËuÄgSbçúøàƒþå/¡:i)EÙX¯¬¬\ºt)E;ÙOCðÓŸþÔØèŽ;¨Nš¡›6mš8q¢úˆN¡¬h|”aq¬oWbÞ={¨ktûßÔÔDî¢>:T­+**(·{\h›žØËËË©ª‡®SÏ?ÿüm·Ý,Ác555äU«V©#\áÐàfDh…ö˜ä¢—„_hÌsqKbwš$™L»Ü(8ç„(V'MšÔ¡C‡^½zQôÒ‘÷Þ{¯ÿþtçB·«¿ÿýïõ¼ñÆ/¹ä’nݺ‘—h%à§Óé•/++{çw¼ƒ–/Ø“ÞŸþô'º%§ûÇ>}úÌ›7O?~ùå—ÓÝ„÷pLÚo&£‘’ÄÎuÄgSbçúH—'J_äaêËâÅ‹Õqº3¥yGK\º_6lØþðãC Ê„”²Èž9sæÐ)ú$i@¹àë³Ybéý÷ߧOÛ·oOöÐ +aþüùꣵk×ÒZ—zM‹±uëօ汪ªªn¸¡°°-û Óz3Ã…t5 [‘¶Wå;ň‰¶tSè%{ùªª*òÒ‰'èøöíÛ9-;iä¡8ú‘±sƒï„0 +N½àæoò/V€2¢ Ï\BŸ¶€‹%‰Z†»&vWó,¶qUq§è˜h‰Ù/qåûôé£lã’[vÒÈCqô)"cç._‚< +®½Î'oCéWg.$ ‘AÆb:0ܵZWó,¹ª¸StL´«Ù®Ç©! MW•ÉBy(-EdìÜÅàKðã‘GÁµÂ9êm(³ +òÌ%ôé.–LOnÁ¿«u5ÏwP¯“«Š«GÇDGHàÆîpå»víJ«V{w²“F:åSDÆÎ9 ¾Ñ{\£‘GÁµ¾Qˆüb(³ +òÌ%(õ.¶LO#0œÃ¿sÕºš§ËW'W•¯#&Ú5±sÝáÊOš4饗^¢v÷íÛ÷À»“4òÐ)Ÿ<›V#Ë–-sMìY…ÁwÅGa/¸‰ùÅ +Pfä™KPê \ly¶`†søw®ZWótùê~+ƈ‰vMì\w¸ò´L5jµ{ýõ×:t¨cÇŽAÛ²“F:å“$c744êÿ€¶›U|WüxäQôÂ’™#¿X‚²YTZ +®^½Z­Äàòƽ÷Þ›ý‘cÇàÇå=$RÊ­‰C HZ¶mÛ¶¢¢âÓO?…göØcË—/÷‚çÒK/% i{Íš54qÐ|%ÀŒ½3:9ÞèÒý“ƒ-Êí·Ä@„è²ÃÞõòä …>ƒä‰]”ÐÅiíA#þÕW_Mž3f mÐzVƒ ¢mÊõõõqÐ|$ÀôÞotéþIƒÁ–¥èKbÀ5º8Ø»^ž&š¸Ä.Lì ƒ}÷îÝtQ¦¿ÆO³ i.¤»Kª²$ö×_’ µ5`À€×^{MÕieKÚZ\m[tåÏ'Ü©û¾!öéàÁƒÅÅÅÊ“¾]Òu×]×ÜÜL‰ŽR£n6L¯!ùúÐûhÀ’¾ë½3:9Æèòù'EsO8ƒ³ÉNÑ—Ä@„è2nëiñï=Ñ‚’OìD4}útšYãÆ3®Ø³ i.¤»Kª²<ŠñD÷°ëׯ§ªÔÌÊ–´9´¸Ï0_‹®üy»ó¹+>Ä>Ñ=õ#<ÂízÏ.æÎûðÃÓ6]¹*++)œâ- |åÕ–Þùœctùü“ƒ-JÑ—Ä@„w:„&všhxWbç êË–-[»vmâÂ×BfÏž­ÎÊ6¤¹+Ý]R•®#Fèoõ%·>|˜ÜµuëÖ’’ï Ê–´9´¸>Á…üy‰óƒcab_…|ûí·¹]ï¿{íÚµ{ã7h»¶¶–¶ßzë­x ({‚o"࢚ëÑÉ1F—Ï?©3X¡}I Dx§ChbÇ?O¹q´áÄ8Fˆúž={h%©þƒß»wošY‰¬Dš»ÒÝ%UézöÙgõ¯;ÒÌ¥¾“»ÊÊÊÞyçu»jeKÚZ\¿¨[~+FâüàX‡X¯aÿþý´êS&|»ê4W^Ñ_Š.ßÇä ({‚o"à^ ÀõÎè丢+èŸÔ, €PŠ¾$"¼Ó!4±O˜0aÅŠÈäYrSNň4VE‹–Œü@)›‡xîܹúSß.Ø]Éø''~9‹è楸¸X½Àj!‰=F¤¹kU‹-J?R ›‡˜îæÞ}÷]n·…p0º’ñOËIì·ß~;AAAAAAAy¦ÿ®\»endstream +endobj +6114 0 obj << +/D [6112 0 R /XYZ 85.039 781.388 null] +>> endobj +6115 0 obj << +/D [6112 0 R /XYZ 85.039 744.431 null] +>> endobj +6116 0 obj << +/D [6112 0 R /XYZ 85.039 744.431 null] +>> endobj +6117 0 obj << +/D [6112 0 R /XYZ 273.413 94.474 null] +>> endobj +6111 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R >> +/XObject << /Im29 6040 0 R >> +/ProcSet [ /PDF /Text /ImageC ] +>> endobj +6120 0 obj << +/Length 499 +/Filter /FlateDecode +>> +stream +xÚ¥”MoÛ0 †ïþ:Ú3¤¨ÏÝÒ®éR`©—:§¶‡bÍ‚K‡[û÷GÙŽ“9Æ.…[IñõÒ¤PRÁrT>pêû.CµËuFGÙ¹”'>u6™Y§!bTõã>ŒeU?ßç—_¦U}µ,JfÎ)BQzòËUUP~×®VËù¢ž/®ÓÌÈ"å«*™o—Eà¼næ‹£yúõbÚΰx¬o²«º'í„*&Ì×ìþÕ³é&CàÔ»ŒHÌ»L8Áîæ?³»ì[¿Uk3ª«ÊÁ£´Áéót>ú.ÒñY:T% ³ˤ0Éã=G§.C×T{aN.êUÅfýðm½’Èë6‚ØÈÌƃ}2ß1ªÏ¿MéJ"ÒÀ ç^ΩQÞ¢FÓȃ´+œIhñI^4¼*Mœ0T”µ;ÓYÁ!å1¦eÐ'2ì›fÛÍŸýZDRL,“Ù“0@G+yRÀ§3Ø ‡´aö×¹ áþÉ2اé‘UuhQ÷~ûRèÿ–áöeӮ߾¥¥õþm»~‚Œà´ýO{@Ölpr…FnÐBD¨E›ô±ÎÁ¦#ÐÙñ”"?ØœýÉ0ŽãŶZƒ¦(²”«mjÍx&CËAªÂÓ ð_°c +Åendstream +endobj +6119 0 obj << +/Type /Page +/Contents 6120 0 R +/Resources 6118 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6125 0 R +>> endobj +6096 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 1135 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 6126 0 R] +/Length 95337 +/Filter /FlateDecode +>> +stream +xÚì]‡bë* Å6¼·ñÀðÿù$°3šÑ$¯í5w4õÖáHBÆ<Ý|¶·µÊìí´A Áö¿¯þzÜe说N§†|ÿûÒ_CEý›Þv1£…¯a!ß„×ÿeX`Bý PÙ÷a¡ Ü‰}ÿPºƒáØâðÉÀ§Èž\Düž¬Ñë÷xàÆ;®<îkæ¯kuõ}X ÂÝÌ'ü½Cs6?´ŒSÑá§~„—â›AÌx 1Ý9»ïÍ Þn B“0¾cá…Çe;> ‘ìÏ°-Þ;4QÜùZ:ɹÔ>)ÊÌ"©î~©Ú$o¿W!Zã ;>›øÊÐôç¦Áä^w1y›Ô¬G_ÊÓ-Øô¿a¡=íDx¬â(›EqüFöÖˆ Thäke±`2@Æ(¢ƒÚ³vôz%ÎÖ¯~T6R:ôGÁýÂùñ¶Ïüø\‡.ÄSÜiœÿîñ ­–½rµCÒZjMø41­eïJ$Žnð¾ò±'ѼÝ4ËããôÕ‘V,ÄPC&XáCoÁ#Šg*2 YŸ•ÄæÀ ‘èehy¡@,L2^/Y ¸ŒáOÄH×ù‚• >Ü*›oBÀe-}¯çp Áàìªês7 †LXù#ô^/Òœ; ±i}Fh@„ +S• ieOƒ3êyçµ´U<3Í®aèõDˆ."â Z%€ +‚½ ¾ô±'yµ¼ŸŽ{—ÿ•¤ë‰Œ™D³’H–Õ2Zd`L©y£KCVK‚²é”bÅèL(åæžÏt•0L±M¨E2è±ÐãÉ1aÄT2K3±$M"@»bq TëºîõÅpV¦cÓK¦šQúŒtž«}C4'¡àª±õè ¡|¸X(«äoò/ñÂ(ìè>Z,lÞ‘bS~J«ÞÎðÂx/À"Â!&ԉɎҸ’ì)/s~¢>œRùÆËoõÎÏ8žŸ`á”ö7Ê÷äÿÊ ›Žd±Ð@”ð¼Aj± #Ó _¯Oâh/P4Ðu/il‡™qp¼‡ÃL,i‡!f Êô ú\¤ +BPØ,džœÀ!ðRb9,À«Œp3<r†¤= v`óÃ5Œa­©ñá¹M;¼tËw^€Ž#̇WK`8WtŽT•cM¦Vú.äv3%k§Õ¬Ù\˜ñ0 ¹ÓF™4W–ÙÏDÖy¦Ë «†úƒ’ZŒpódŠAˆÞ©É±'àà󦃃і„npXhº’¡Ü”ƒbÁ8E}È@‡ˆˆ¾@øÿ„…RPÀ¸ËØaAG&g¸™¦Ù áG^€^¬7^X„Þº0Ôëxì,ÃÍŸ­XÀ>áiQQ ¤ÅBĘ́Ü(…Cƒý‰€÷ŽØñq´¦"-*cBnÂç ( Oi%Å%Ö$þ€þ—x¡V#|™˜ôÂä‚$-êJÈh-¬o*Ô“ar8Ñ*y00|ÊZä\H¥"’88Ô])`Œ’Tžì“^2Ñ}%EíËF+ß_• Bb”€Af¾¬@¦B0†…ºõ¥¶öB EYÁ%[ÍÆ@z‘m¥;ЙÛéØ ˆwQsí° XŽ@£œh-xíƒ$Ú'ëE:Œ×~¿ñBÍz¹ZE3‘’üqdˆt€*03#b¯ãNä‚RË ­ô›z<Фõ´0áVÖM$b‚7'™3Z!ô³êa¿Àçžß¡‡w{yA…ðîƪ&`ПªÞm$j| Ö3ØÎ,;±¹7›/“À¨µäŽú¼`¼ +È3`ú¼Ðpèm„—‚W6û*Jës‡wexÕp™à@–{€Cj;n%N}°›àݶð˜ CDÎ^oþgIž`Z,¤2Α<3àï±Ê2¦hž²Îq)œ½Ö ¶ò¨4«‹°xF,!/,2€mŒ¿bÁHä…&,ÌC­¼P+KÀFbZ0"2T›"à…aå… Ç­Ê£¤;Á (iLô´óò!¡µø\ÂW[ Ùb >`Áð ºÛdb²*¤è|œFBîÚ Þ…c 8@þS+KËѵ}G¦Òu°jL¶3Ú~&:i`œ²ã`…Ôc± V ä@¬>ƒfŽèý϶ó‘ü• ®,ÔÄ[ýC3‹Œó›RèW„>ؼäŽ*h©íÛ¡ÐC€ ÀˆÝ"ïÙ^u¶3Š}#K¤_/´Î^à¶GO±€² /±àÙ£eÚƒö;K°¡{qÏqÄÂÒ¢2'Ãl_’*´,´@ ¢¶‚¸zT7 ºÍi>ÈUOjE¦Ã, Ä:½íPÕÈ@$è@,àψ±P9oy&y1€öàÐЀ"¡x©%4í7¨_t*EšH7,P4-ÀœvC/òÂÿìGb]×w©ïx!°XH cž/Àð ÔÂ: ªÑró3¥pÚ`ÝR£ŽfÝf/˜u:ŽF^€ã{«à¥RœÇS£/2­¼€&\µàÆÛx!=ðÂüb¡ˆlã<²SÁET¸»ÜËMÄsH"ë(›œ»,j }ç´¦66çn0Y§ïS/……¨hÃÑ`˧ÙjgùgÏ\¼/–ÜN@çÞ²^ ÀZÒQ3[`o°‹ƒ”U{k +›à¾öèxŒ'Øy¡@ö,ø2Ì{­VBvïiÔC\I0ª)Ñ?Hgè%£š}]/œ1H'áæÒúúL¬XPbšˆv~ Ë ¨"†;pÛ•dapSÒó]^è ( +Ìù‘<K:/ÑÊ ³›ÿ _÷²Ä:¡}Íx¦%â2,¦‡+•ºù²çýCóÎ +'g8Ž¼TiÙW„¯„ì|‡-hvŠ~©ñSêûý'i-éLÀy!Ài¢ÀÑèã2}C&!e¥:ËÑÀøÆï´Þtd=R“*­É œ:’‡–£Xu$°7@>Z…—ò"äŸ JÛ¿Œ…ðÓ°0 Étev,¼Ë [â?àÔÂ’íì»4õVe¤˜·Oâ€Ñ -FwÚ_†Ÿˆ…³CŒÖÒ7”´Ì>u"5¶«2ÜO¬Ž”Ã×e)ÔõÐH-¦®°¦hV„HŒyˆ”XfÖâ©ÐÒFÓf;+Z(åΰ‹Pƒ¡¨!+YK]s )–b²ñ³˜èìÚTZ+{¸¢¦áA’þýÝya;-9laŠ™'x×±ðÆïÉ™íå‚]Ç KÊCœÂ®tÀ£vMí²ÁÙåÎß³4]&%(º©"Ý-M3èàb!YUÄIJŒ2ÙBû‹’”Š.ò1ºÇéE"Á¼„Z43apŠ—+7¯ßÊÀm]ùtG™Á3U¡'ç0âÉÑ`|*Ø ƒöÓ¯­ÒD»ì¢"OV6‚,…§ÙÈÎŒ`ÔÛà—JP6D¡Œ9«ÓBŒi *¼ü¬t?·zÞyᶳ‚bÊ‘¬ü¿.aîÂc¹`÷cP¤™ÇOኖPb­ŒiKǧ̎ñ³ÀÈ1PìQ4X)9uq°ŸlEÅjÕõ²Iå:Tõ–0$ yÁRG*»ˆ…–Á8¸ DÖisÌæ?Ù¸¢…rÀ#R&9 þÏ!wö¥Òn f{ÕÁE9Ï8–´ÄÚ ˜Ç`ƒÃ—u®~`Á°¼ÆæGÄ‚{8ªT2²e D%­Áx€`F{!Fs¼¦ƒ+`ön*½n¶†õ ½P“¡cr6«0ÚÉc"ûÅ—Žã1Àq-¢Aõö+Ü°Åø‰V‘ʤ ”GìZÙÁÏw‰#l0 +„ÉœoJ™ê=ÅB¨Ç (åTö? tMßXÔj”ÊFPÌ î˜ ²Ú £Ž¼ÌšÔµÒá"e½¾_ò™ãx-°ŒÍÕèmtä© °@ÚC¿3µ*½t^p¢à}Ë:9ú>|½åDÀ¸EQÀàµx!ÔåO´½QëŽ 1ŽuŸØdLÀ‚ÍiW,ny!n´ÇL¯N© ×q<ÀÁºpƒ-Y± V,x6$ÃÖ ê «—4ÿrã—ê~ Ð°(˜Ù´ó!@^è4<ä8˜îÛ íîa!±™…‡ ¶syl +†; 0Ÿq‚œMRg/D…­Žè’¹Hà½Qæ±Ê”¾ÀÆÃn÷­E]¯óÔøÓƒ—&ý£µ~-Ш¶&%ò‚ìFVü@,ä©É™2ë¥á*ôny[^°ÙÐETD¹É3g$ŽdžºÙL5Ãþ>Ãs:’²[ 6þ®²Q¤¼˜áØí%èH8¿Pê‰F&íõ'Ô½)fÎ0ã 6v"’Þä0q&”6®"ƒ _m)¬íŒl±@5Cª@s"åf;Ã+EA·j³)D ¯%d¶Ê’-ÏÙqh\ëÊ({윰Cæ4èg›g£q¬ì°ey° ª÷r¯þ, :Ä<ÚµŠÅÔØÀÝñŒ›<›È EqqbXJ0h³ÅTWÀ««ßbó–:R3kßäÂ(¾ŸÊUÂèeá²ÅŽWpŸ΃›æ˜C¤j$ôßÑ(,bî¼ðˆú ÌÍ*™ÃH3t²êSI€êûؤƒµ-6,fÍw¶™þ"èLYð¥Ví:P®Öæ*|0˜%³u7­½èªÚ&[QÄ"¬Sãì…‡*hÿ/X5éÙf‹ÍE®eOœ K!/@ŸøZõz„Þ‚Sœa„žŸT§Õ-êO  Þ`aÖÂ뎄9V•&L:?ÒZhC¾®•DÛYŒDbú›ê±g@Fɾ†á¦µ¬–c šf¿óÂ#XÀ¹ŸDXÅuA^(/yãèSä] M´¿êH‘ýä¦Z áÕªÓ:E‡.‘)Æ·’dÎA›8u,6΃äÈÄ`¡ŒhMr¶slý(›½ð3±`bº¾U/úÆð +¤7ªRC[Ö–Žï¼ª(üÆ`|[áÜa½#¹"«'Ü껑¢>Sp…Ó½«(B* ð¨ LLŸrØTÄ]Òº>£Ã9<^±Þó‹Ù‰­\™k.[¾Ž¸ÞÒ÷ŽÃ1œ2µΞw^¸c/¸boxaÊßxa´Ê Î €#rþQ„nÍ]18ä… + OPð;íÙt´un¢FÏIŽnWeK’¬Ù+V…NV…Éù‘Ü¢úáX°‘sŸÔ¬½ðîx£ËCáIh<òþ[~$ ,XçÞ‚¶3N‰"’2Aà y8ÔɬZÀ\Ê9xh™ßýÊa¼Ÿ±î èHL Š”zPVõ4eZ)‰€hÀä Ò:VmR5>«ËçrÊV¶{ûã±`> T.Ÿt7eÄÇãçdü³öB¢9HÌ´ + (ò5¡JÒŒ`}$þ fÈoS‹q5¾Ä¡X?¯ÌïžèfY7ûø;S›všgÀáöÐi`ë'.†i°C\º e&ðáI‚ ÕC ŒÄnÆæýþоٱð1{᷶߅žJ›‡Êås±cá¼°cao;/8{A,ÿ¢]¢w^¸ây Å¿‡…‘ ûŸÿü®µÎ÷¼¶{-{ûPkÿ(/üƒX(8çôÓ4¥/]"‡/6Fi=z‰ÜÞùÞ_x¶}¹Gþ¿‹öµÎ¿¬EB¾É€'^–Ƶ~­'aW[ ¥Ø¡ó‘¯#ÿFû?è/—Ç@ó§O¼LáVZ?j‹r¦ß‰Ó +µ–;öö}¼ _«ØŽ'^ãý/è÷xA‹Ýa¼·okiß¼¦1ÏêZõ°ñq· oß)“ZxÝ…Ÿ7zNÓòW¿Ûðâ7£ã5ý¥ï¿Bõ^™œeØEïǵLkRìXxƒ…|ÇÂ?Ø*ýn†æŽ… ÿDó±RÕŽ… {3&¨ÌŽ… {ƒæe;v,ìÍbaç… {ÛyaÇÂÞv^ر°·v,ìmç… {ÛyaÇÂÞv^ر°·Œiÿ?,Lïa¡Ý%oç…okyÇê—ªUϽèç`¶DÅwÀšn{ÐöÎ ßÖjýZÊ4£â…NËûJÒ,t½‹ÞÎ ß÷Í^] ³¼Zõ ,Lï¦ÀuÚÛEoç…ïk¯n§ÃGí…ì=IŸ«]òv^øÆöjQ”âjág°P¼v‹½í¼ð+Ú3XØÛÎ ßÛŠèñv1RÓÇÏåXÈÃ8ü7/ÞöëÚNJŽ"KŠ>ÔÄ…éP?zêVYæ ~¢uçFóhl[ …—“ ²,óqw/ÃVÙoôce p;I”…IaÅÞ>“ÅÂìVú}ƒ…‡ßæ^ð柂Ë v…ûVó‡tî/¦ ñ/dX°5kS]Q9`Aeà…fAy/¶ÅåÃpÅÂhÜyá%,|„ØðS°päË+6žçåÀí&bÓ/ sÓL…éX-:ðB¬ƒ\ÆÀ ‰|;UyBÎ^(§Æûk®í¼ð’Žô^xØTù&{¡m[Òš9“615V ÀðÇÕÞ óÖv†oЭG¢˜×UÛkÝÎr@^(Jœ~è#»kIÊrã…ÍFßyaç\ëØΊm&;§ §hMÌ ÿ&, /tZÁ2,¡X&Ðf3¢ÖTk Qï(ìÀ uéû `AøÐf‹ §‹í¦VÒvÅ‚§«3,„€¸°å…Á÷³¸ ÏÎ ÿ/ø +†Ö¸”>è1­È•/u­JSôR“ô»°€öBÄíb€Õf/ :ÅIÁ”UžJV^X®Ø 26öìº)•]Å@è06òb<4kpyTdøåw{aç…3^ð5 ”dñ ÃHÊÏv"Ú7ƒL<¦¾ tô,F±n>`Ásè/ ¬1Y Xü–i[ïÅv“/Ĭdr8È÷Ñ_ya÷#í¼p €¹Hļ†a´g¦yI¥o@mùâ‘sÅÜ-_çG:Å‚!d¶0 +œ@ Hø5?Mï€즈áŒÛ`íéY(S¬±/‰=1ªw^°Ó÷™ò¯ÂÂOã…Læpa˜áâsœ f¾æSÙûY&“¯×‘”¬„Huఠƺ®Gp¡ûJi¶´ð재;äƒ+X¨É^€AöD êcWb¹*{&U‡ˆó#ýã¼P±›aãÜkÅû+sÿ ^È`°@¯¦"”DÍWCüY +ÆØ—®p·ba&’Á×Èú aØH„K ÉZàô…fBö0Á甬©«™ëø"µŽ +©Â.á#êGt`Rô)šBÛär [ðТOàœæ‡bá›x¡“·ˆ +÷âCݽ×GñYòå¯æ…qtòÀi8Ë"P¦ žÒ¯Ç‚)hq‡Æq·C¿5Š…7ûp]P·èÿùѱßÅ ·±­Xð廈«¼mUµmu~~‘?×^°X@)ôÑkC„Á™*”\¢ÜûRë2ÓÓ']è=MÎëÌojßÇ œûÞH|nâ°dÝl¸ß 9è©8ÊLv5I +Ó”%ñb¯b/‰%Ûž)$W9ðt°õ-Bÿˆ…A +‰^òóeÖÊñ^(ÊPT© ~ˆOø©mýâ./Ðmhå”Ò5….M­Ù3óã¨û/ á(Í«`¡Òm"ý Xx÷!ùïÊ”ø>^਌D'ð‘u𶠴+ ÕV ­¦L×5XX‰"©%QR1Â4 Ö/LÖT‰ŽÉ†Ñ# Ë+½íøN=b/p†(Ò„¤®áã'!¿Ã ^LPRø¥” ãÛ(›"Z#Ó-Žî®ðBç›n“ª ôëôqÑj1“b%#,Zõ¥ +Ÿ†…?ÖŠ 2Å÷`¡ 8åBF["¥qX(6{!”ŠÊÂ#Æ"¨QðÚ‰»@zGБŠE†&Ó2ÊÏì… ½!EÅÜä1(©Sæ=À nIM7Äé`^â3Â'ꦀoòB“ØäΫd=Ž ],30S¦I–С&‡¡ ^ 7FÏØ3έ´êê;¾»•BŽü{°¼B?*t¦ƒ¤w ‚oöB&‹e¬ÇßaF†vDTEê±í…H°0º´qJÓ´ˆìÚäbˆ¥‹÷y¡–Aü]ÈÜÚ kßµšÒ +u +JMkÄ žì3œrJnðÂõ6H/äwD¬íX¸ÞRqfþżáËHLŠ¼ªW^àG^0%N÷€¢_š öhÐA"„¬Ð–0®EVü Hh V§VS‰üdrô./X¿~ö¬ÃšgXxŸ¬·­ájlÛq?ÝäÓC¼°"›hù¥Ó +—X³Ì[¢Ä·#Ì8¨æAÁ\l‡ÙÍMmJÛÂ…Ñö ¥nÛÖ×x¼‡WB;Í@ƒÆnL&A¿ ü€TäÕh±ÐÊ^)N­5Æ°_ÒnXà`F$´®M‰6%Oˆn¯ñæ‘Ø™%0”þA{t$NÄ"FJ?óówxaÎÓ¨9ðB 0f†n:?É &á÷Ô•Ü°àc&çPØORÚ˜¨L;1 5nqÝ<àG•›‚œd—kê´?Ãß}ž&yšàÍíñÞyï¢2B­ {לÐI ß4x ¨Õ6ØÅG•¤Àù¦Uœ±cahoì|å ”ô(´µµ†ÈNx^á…QF0»Ê³¹·Ýƒ¼ ±„Xƒ#´ÜN¹Å «0/B3ùˆÍ²@1C3“;ïa^ø¾¶ba’]D+Dl©GßÑYé|<ÂyòFœTnõóD—³Ú c"ìKd² Â'‘3Ù¡AÑ`§ÍµØf$JÆì‹Á ­ÅB “ÿ´–¼@ÑkŽXЭdJõ +:’«³‹~FFæ™10eÏx*–F•®A¦Cxƒy#:f¼P‹®ï»•%äGýHl{Ÿš )Àmgº°7x!‘´þ÷§Çà+v˜! #ßô¬½ðíXpñGÐÜ¥adõ‘&Ë™-|™ÊñÀìTÇFocz` iÊÖ/u>-RØTQÖF‰âD B Ãä_Æ€f/òe ¼À4*1 ù‹”íÚ…¹ø0dN¿Ü@¢g^ªS`00L+çg¡§Dg>Õ•,L ˆ·°<Ê b›`qXH´Ê£½öU­}xXŒ0¥m;Êf¹m/ð˜Ïáìô"PؽôófU±©SËWÅܪרaßö,=˜ 7ð<ûcÂoËaxKlv9b=[in1öúÔV,äÝ::Œã…Õ°8›‚,B,u·&ŒR€YõˆJÿ_Æ\Ô"¥`ÔR' i<Œ˜à™ê'ãµ@$^ËAUáÌ/lXp¯º/à%¯ðBc':=A+E4ë.IÊ8¿ä…˜a–¤õžaðb!Ö˜¶TòÅÞDÅà›§È™EÄ)+F´Á¨·5?€rÚD@¯VŽSö˧ÅF¸M¢@ve 7Oæ¦çm®ÿ¢_a]˜©L’(Ôã ¬Ø[,(ØY‚í„ÉxÒOxAú¾Ÿy€…®ô³¸8ÚÎa©À0Tõ,çTPË ˜ZßÑëPØá½E—C%z¹Ðn¸ã´ŒÖ÷Ö^ÙÁoí°5[«» T¬<|¶ƒ¾ÙQ­î3{m¶;ËÖÌmoÛ!ÖÕº#8½Ô¥f–Ÿ…ûí^<’¿é¸å0 ™UÛýà‘ùÚ"‘ÜÆÄÒÐk/{–¶zÜ|É jÀñ‡Jˆ´*Y"••¹^4—XÑfš1Je®{¦±4ØU2CqlÐÅ0ö¶ÖUùLZŠà·ŽYÌ¿mpÀŒÍFRßaÁ¤–Î$ QÏ‘é_¢›ì¥ý+EF hüŽ. ¹à…ƒ½pÅvF^¬køR1«ŽtZ¤ªŒ8`¿Gá°®Úb ¬d«dΉ|q.òù•«¼öÚ¸ãÈ+ܽÙåzÆŠ… `;ƒY‘/ΰp¸Ô×YIÿoþ‚}£0T²”¦5ä#ãÔîÊ¡EöBQ Ûöl°Õíj/ÈR.&g>òB?yž×ÊèéÕ†:a Q‚L>Ø#™0êUé*–²m +D§š[xºN†°‰R8°Äñ]%&ô°Ø)AézƒôÎW¯3!Æb!ÏA÷/,YÛr/N•ôW,t슽ÀoÚΫM­L[·#z3¢w§¬({¥¯§KdåµIÓe©ŒŠBFÒ4Ö Š|Gßì˜Ò4e×w,‘r;"=rÂk'yšãŽáΚ­;f¼v ÚõÚá¶ϨÖ*M£øtG–†A3ýÏXøIù ˜¡Xhà™ú6Û°0ÎT°¹WÛùtke%ã,H;Øå³UÐbÖsªqÎÔ&F…JV5¾,b¼ ¨éËár+W,¸µ0ÝYÙ%µ<ÙýHvK²]0[‰8–+/Ìrt^Ž«¼`õ§Âòv¼àÁx +XIG,Ш¸Í ÷°YÉžÓô€…Uä;Â팳Ë*¯Mºä7°pÜaE~>îH7d§’}Š…øîŽyÃþ&þ/<ê?{Ë 6V°ÀÁà#ᆫÖÔ„Õq’$±™àÿeÃB&y³z{#ø2Ë|7UÁ £+ÞˆÓòÜK:]5X´1¦r‚Íw˜Ö ÕŠ…\è®Â¸a@ŠÍéýìèSE,«‰‡±Å01ÖJJtyGÖ[zÄÂÆ ®H·S• +{<‚ô¿ #ÀB¾U§½és¼ Œ‰*ZÒSíP²|ˆA^Kø9.€;@ú–ŽÌ"·£?Ý1º‘ow,©ÇÜŽtXÏH܆Å^;„ÝÉ…X°; °ƒœ‘Î5|ð×kwpfðvGfw,v‡šÖçO~~/€pM.Ù¿§"¯6^ £Ì³¼PmþMWŽËba‘ Η`"(•~¦1s¤vôíì-ÎJ +“-ˆÎ<”V°`¬MvÌå m²Ž s-¤õŽ˜¼ƒO]„.Çž‹÷­m‚‡UܾoÌ lêf£ðÿY6Ö ÈÙ%oN®ÄvD0³­·ð®üÁÐ5'´º‰äí€.[›í¯ë®ùðáÍŽåüøË+Àérµì¸qÓË óÛ[]ì8<`Tî¼p†[¢0ŠWÊlXÐ@¢ £ˆ“ͱ…Š{tÐëI¥2çáJuœ±¢(h¾º‚X`¦žá²²Ü‚Y¼8íñ/˜Óèð‚^Ÿ·ûù›Õ¾x?¸nx¤Xú[óï Æ¿ÒM,·o~ÂŽ¯¼öµ? ?Ð^ Dd,ÈÔ,’$¯ø‘zg²‚”h/€†b¿ðúT7 ö˜ÐŠ ˜Ú‰w°ðÀäl>Z´~ùјíwR7§þý8ÿ¦K¥ÈÓ¦™—?Ùv^¸ð#ù– D­~¤R/¦¤¨f×µ +ÏŸt™Âè¡£¡L$­Î`ä÷̪# NGdRè—D÷£””»›cÎhtð#½ÞÞIÝ| üÏ]¿j‘¦ +`=ô}Wí¼pœ_¨a‹ß&SÔ$ð¯/M r’tðÙt¶4 ;D¯ Ùa~xA 4f%ðwô©ö¾é2œÁ•¥ŠT –€^úRÙ€îÀøø ¡äþÏå)–?ÛRúEaÊ¿µ>R ^ÈS h¢uíLzkl¶;"?Eš ëï'ùØÿø¼¶?Œ@ÃÿŽ…Å y:b¹ðzTsŠGËÕS¡ò†ÕWv°à),¤^Ø{õŒ(Jw,ü¼`ƒEŸæžâáeL0–]‰úñÇCœªWµm‹«oN• Ð.= Îêg+û¾‰±TŽoã5æ¬&ºM“ÖUÞkѨÉÂÆ–ÐM½$Ñ´öq¹Ÿa¢Éso5)3ú£`HÓhç…S^0Eð´ÖØ4÷5£Ëû†Þµc½ù€… +ßàŠƒ‰…+f¶ÚÆÜÎr‹â«mͬ6ÜMˆD/qI›žS6Wö°ã}wÉ.i/4iYÌì9ÌÍ;ÿQ,Ì^3§?=7ÕtÏLÏœs& wt°aa½X—™ +@1S +ØÈ3g,Q€«ºuFbÁc¦e”XW;Ã*U©ML´×6-cŸCý:×ö7}ª@×_äSíiúHƒG¸ÄÂøع¹w•²5áìÝžv”Kú?7ZmXH­¸Î±Äåk ƒD¯©ÙŠ…º¹¯×9ÂÄ)†Àh –c°,î+•+º`*±c”Ìv«Íu°Tnš—¾¿â‹›.”–å$‚‰©€:Šzy ®|yyé£>Á/uX ïÝ;aìk‹(F-ËÞ›àö6Þm*”|^y&¬¸ à߶ Ëx–ɉÚ9ÖÖÃìÇî_ÛeBÿ ûÛnšõ_Ü*ï ÿŸ*ÝÚç=Ì<ÍQÛ®’N.C(ËÍz $ ¤–IÁ[ðБÇG­ëÈ„pTŸ­ß®›R´¨ÕÌëÀüSøq 7ªÞ5ɘdðª˜Dz 3ã|*ólçZ +¡;P‹ b6‘‚ɤÎy?ܯr~õÊ`ùøA` û„ˆ0 ï^dÅûX Æé ûÇFðyèÜŸ.ü,0ä  + v•JÝxšõž¯Ë‰¹n*é§ÄÚ 5 ù= EŒ@±¬Oz6ÅòCªè5K"&:Á +*ꌥÌÆ‚UVT¦¹Q@ã¤ÃãÇ°0êÔ¸bÒÄPÌ®´Ó ß°pÿÞñ—c¡þŒ¤þ ëLG¸_óø÷ý /ÌÍÔ¬ç‰pÚªè+ç=VíJ3V™ÅH“®+’x S`,X{¡°ë—r QóÇÈÒ¸¼¢#aþV*1ã1Dåö0Íù/x¶0–—@ªRvjõ1,(‚çG>¨Çøt³>òŸÀ‚)Û_"|Òý¡x$,Š$צû™àétÄýR,زš}j‹ìP9úY&},D-*‡,Ðég• BôúUš$BŠÓ›ŠLÍŒ5G-–'±cI­ mÄ\¶téÃX¨¸yƒ³Ið|HFT”‹î.‡þ(·<©f}(NÕ–æÚšø1|/ÈÐ¥£”G CA ì„æ„P7Â;žÅĶBÒ9/Ø¡3-äNÆ'°a¤ÅB$žä…qÅBj¿…vXøc¼ð?´ü#¹%×i&˜¸L,êä'cáMzˆý,^¸ƒ1oÓ`ž²ËÓAÖ lèÓ•†Ö†Z!êŽÊñõ +qé5ïá}µv ™„GèR“Çu¤¸Æ‚ŸfëÆŸM>Ž…xl©8 º'Ðñ¸ŸM`ÎTÍoÁ‚uÎ5òzéªÞÎ ·ÓÅù7¬:ørœjê½ÉîRùÛY;õEÇ(Ë=é=^°‡úŒŒÇüEq^„íZA6»ÍœL+{c‘Ñi~ צ€ÃÂáÜ%†êìr¿ ƒX»p÷`ÄɃ,(N±`%¿ñí֥Ě¡îfÃÃ,,LáÍIX|ú“SÏ‹Ã×b0"ÿMŸØlðùÐÒhŽ³ÊÓ ‡=Kž†~•Åst“òhŠý¬ÊÊ`yÕ¤ùž%¼/_öc¶óÇ°à­òŸÉ¬dÄü",ÄÚÇðnWÁ™B„Ø–ŽqXð€:Bœ_ÏLÄ$Fí)\¨—LöÀÁLA%ƒäµÙõÜJskË"7Ä»R„ öM©ïÌkØ]y+Ö]Yº¼_VÚQÿ’Ò(è¶m,›¢/â…ÿ J?Š…¹v—àÕæ~@®Ep·Ò,àbqj•î^Æq˜Ù)ÎQØ"ñ(pQ®TAœ#e2h>Ÿ^ŸkKièdY’žñÒ«IßÖãz´0Úä ûC~òy8ãœäyjÀÕ$È1¾9˜Œ-!‘ÞP‰?y£·¤'…~îv}ÄŸÅÂõë>……£þv6©ô°À3†ë(x“8K—¹€ëŒ¢¾ †ªŸ¾.*<·Z“õÛ©Úˆñ+žüõx$šmr:d¿IϱpRòAù)ˆ<·¹ßòB>½-Ñ> †óùμBœ¯zù!²ËIJ}nž•Ç凣,º7ÈÓW±ù±Àëð™{ÿ”ù… ×™F,ˆ… «ªå~=ö¼“ókLŽòz>ÄŸ6stµ0‰]ÿáœN®®_ö/c¡ªa꼞ömP³/©ÉtIçú\‹÷†Ã€‹;XHÄ˼PÊba‘¿ ‰ukWº8ð‚XH!XÔáDŽÂQkÒ ÀQË4£¸ˆ"]ßwI!†Å v=6§¾¤Ã©¼ß‚ŽóX@)à '3Ú‡í2Î?€N â<¼™Q;á6I¡Âõ8\2 `S(Ÿsç@š'+î·EŒv"æf)ýæy,dÖžþ2b=̆ÆÙæXùXpI:‰æ "T®¼ SÃAYµ¶ó²ÍtêáB?:Ããìò»Sc¾ i;tÃ+1v¹@꟎ð—¾Ö­rUt lNÏy!jV;Åâi¯b=Ôbט@_í¸É}m0_¡ÆÈíÂüA©ÉbT§I)ÀÂq‘7Sd< q: )Ù=c¯;=®öø"8ÁtáZ³mvê`Á‡ñ®˜™‚3ü‹W)=ñ# ºÁ9J4EêKYè +¼ˆ _„›¹õ’ŠÄæŽòNoó‚XÒXÐA~Î Çã†"2Ù ³<:¶ó–'ˆ%\Z&–fd¬)%f4lM[BPJíè Ê’'”azôKÉcÍšPb†äö+.ámÀÒa‰È‡±ÀáÖE/cOØå._á… èKÆÕø×Ø ðz.Þ I„8ò ‘T“XÍ,Ä¿£‘#f;½ðê¼óIˆjqÁÒ3Õ_¶^)NHã $ &Añ И"ꈺ§«éÁMƒIT¨ªí¤ !š ­ŒpcRZ{Áàƒ²À-Ò’»ÛbtÛŠ™ð^ +tÉ bfÚRŸ±(þ¶@ñ«ö‚õ–)õ{lçdTŠ~3ŽSÙßÖŸ§ëÚwQÚ©«{4#Á}S_‚é@†ÜYø“°pTèEJM{ê-:ëŽç4<1ŽXsÍâ81qÆ ·˜…,éËsm×'˜» &L¢±u +3Ѓrg;c=ö^j W¿‡ª—àÃõVEßÃB"LˆÇqÙ>‹_r›i‡«Û¿Ž{ߵЧú,¼’y¢*J¿ìâÚG§ö"caG9b•©HPÁ)/íò »âå¹6\«G`»Ž@ÏŒ+?V?ˆbÁ†b 8· G×ò¢&”4¼çG* zx v +ë뾌…†ö¬Eâv,¼Œ„‚Ï/„`DÉBÊ $ˆµ],÷:8 Ú‡™¸–žñÂ-,ˆ` fõ#³ñ‚‡õÁ„@´…©Nƒ>Ñ 8Þ'`C¿£#ÙeÄ—5lú^(^æ,ec—7éw,|¬M*Ѥ¯«Hoç +À >b¡åitd‰S‰¥y~DÉ^8a°ˆréžÄB_ ýÓ Ö^¨dÞ'8¡F‘˜Õ¶Yg $”Ó†Œ—lÑ^¸;¿J¿–{Ö^ˆlÎëöBªƒ¾ÉyUÐv,|d~áù¹¶7Y<§­?kY.;ñØÎý4'3ÏçöÂÑ’HhšFœsJ£üÙ‰g»¦í–BÞ±ÂäЃìŒ2œA=-5É|\÷¸’I#jÃJ‹…P³&‘™ ôp;¶)Ð$M´êA÷coÝÁSöª‰ +é/‚u‚E;þ‡yç7Y£ZqâcbÍNCó¢SÝŠÉÓhìËü…Ì”-a6Œc?øá«ÉÿVÙçÁdC,¢I‚rê{凩39i‚.èsEžC(Z¤!^ dÔÑ­\s¿™AȘ Þ³Xx£—òÚ¸»ß±ð`áZ¡ù“õêO°@qîLŠt¹ÀBj÷ãů]3ÀÁÓ_- +“º¹Ùƒž“`äÂô#(_fHM"S)¦CI)ÄUÈÃÊ®‰5 +5º2ª–.n®´Óé:&¨Ú%dËo{ •ßŸÃèi,C&X‚UŸ„ðw,|¬MŠ0Ò|êZ$énÌK|¬ñ£ObW"!lYOsÑ¥,ͨ³´×‹ajiVûê“™Õó òÜ:fíç™ “ñl˨ªÑ,Ý-Ë“&`ÀÒ4<—¿Pë:dŒ§¢‰õW=…´ÏNzF±xXѺcáÕö¡šóÀû,¤ÞÐV~ŠC{¥©]r$¦é^dc#âJYTz6ÜŸ0Û’R"ìšy¤³Ë +û¸~Øpo9È^adÝ°€MCŸ´”ÈÍ, TM‡±âz—\—¦hw,|¬5ÿ¦¯Ç‚›_°!ÑžÌ{]×µƒô"éùZÕ5ÑsesšV‰ .|ºw?mæauo™àq­6ƒBÕ>‡[D•eTn0z †ÏÂã)9L»½ð XПŒï‡èH 1b¡‘ù(ÆìðsÙ"Lã©á÷¶81€EQ#b‹Ô¼;Æ]u†å=,ÔÈ Õ4ŸÌkS˜v@ £®x ¨ÂùÂ`Ù5ïXØu¤»X°ÊP¢#;qQ›ì™ Ï–¦â‘iÁÞm¤_ µêHµ Ë#ì¼óÝåãñº³ŒƒšÛŸŸâ<—ÉŠ‚ÞÂè,€àeˆ¢©ô¸cáCm~-áWØÎ Çl¢#»Ð/QÆñB`Ë¿ ×fsé DSÌã,ô"´dkÕmGeŠœßô#µhw{zH³­8ô£¼À–qL¨á⥼6KzJ¥X+|Øsao~Õ5öTÚLÍóíX¸Ë ËFV´ S"?²Z0)Í;ó ¯cá¼½æS}êÞ;îaáþª7éÛvsß»g^WƼÁ{‡ÞŽÁð„Íç|¹än½ù¦Ù±ðGüH£Rõ?Rz óqwór\1ê$w¤ôUssÑ®YéooÒƒŒÏÓù™óÛg¹_`^ë`D®Žð«-}>èôA,xÓG±zÅŽ…Ïœ_¸7×uÇølhB1YƒFóXêÓªçÙ¤ÃÙ™m×`¸¬Ëúæ}°®ï–Nb;ӮѕçWLeÓ4¤_ÆáÿÑ«ÿgÌv»cáÅö^ í¯¤êg–òËza¢;®%E¯”P +ó;5ŠlÊ[»g©@ Äá±ÝíĆ«kC‹âÚŸ^91MTy‘RZxJyÅã÷ïß{ÇÂ]^x ZXØ4¿V;OdÛ@} ÁCXØV´z ˜ð–ÿ0,`øæ%1Z\¦WÃx¼¬tñÞ½w,Üåý4ljç:’ýªî?È »Z ŒÅÂípŽÿ &Ö/®'Öê+’:ËgêĺÞu¤±€Šwó4p)„üFMÕÑá#¼ 5 XRæga×Þk'¦jþ¨½ðÞ½w,ÜæÔ(Ÿ¦{ËïÜÀ‚Êo×v²ù!^Ð:ÉÆ­ئÿ &zqf¯¸ºušâ½w,Üëÿ»nú[Xù»Å XPû5^8­«„é¡bA'ùó#ýàö-X8)ƒð»°pw²ê ¬«OjéM^p «`dkE±Keì„dèÅêôw° úþC=}¿ÎöÞ¾ “xDI¤åÝ×zß…ôA,´&šÔIiì^`U«ÞÔ'X€3]»¼Õ /È9?YªG,÷° (MÛŠK¦»ðÿXXúù#³{kZ*âÿÁbˆÃh-' NUÑ /(Nsï õ(þI¯Ík±0¥'uTA »ƒ`üX’L¥;~VÉâîZô«ÒÄWÝÉV°i-¶b6Ü~.ÜÑh÷ˆÐŠæNüʶtý8NécXHir‚…^aL󔜹9Ou¤ªµ-¸Ï SšFädm¶{XÈÓ|z —µÂòfÂNÿÌßù*(ÿj^¨ç¨™¨%FnŠJØÊ5¼ƒc„lXˆqb$@ˆŽ¯$.©bkã”LÉŒÀÀÇÆðÁäëÕÝ'æÚ€„Ý*‰MízÂ1Çe‘F R¾CzS n×óMôèØÊÕ)e„•¦0ù¼&n…SQË\ÛK1VË §µæ“XÀÈÓãß;ó Ï̵Ýò©¾©³í°™¨u⎽€*øVÂ’µøígj±PУîrÄ#XÁÇ5;bŠ"òZ{Ëha(X0vÀ$ÀŸpX0êy’¬äÎ^`µ†¸†^ö½å½ˆ…:Z.xád ’ø:hx¶ª–ôÖ¼³Á@—Óã¼ÿKXÄU^¨2 †AÙ,À ÐÙ9Ö–~癢¢2¼Æ•ßAgQ³¡}z?µG¨ù1,ØmXmm f"R +bî8H4Úpc‹…7q‘H“’ÉÉ$6åÕbÁjz]0ìxA¾„Œ¾~Ë '¥èñŠ×°Àã·K—_çeãíÅBõx Æ%ŠâòÓÁR\|úe¼p]GR£éu ‚M|†zŠJZ€\¥Ð¡é¥ŸIßdºKC݃êN¹ÐCzJz¿ Ï`yA"Â)ŽÕÞî¼ l!7Ë ³) S{LÖ:( ¶Jd+U}}ãóäyóÓóÎ(~oyV§ °=‚…ôz<[dy 7=ª·°¥Tm‡šfdLÙ*ó [³q6³²”†¶Œ»0 ¯àSŒow°­Qƒñ”» +­Ý]ñkxÁba1­öL(gO̶TÁUyu@%|ÕJP +:©Ý¢Õ¨÷‡’b!&¯*žã…NåDyÒ — FÝò +«y¶©$p(H!ðBîŠ}Î~]ØU&ElÜ·K#Êoê°çc0¤Ÿ/g~#•§=ú€ìˆ‚¡ì*Í$¦áC¼Ðåq,ô7+-¥^–ùÉ%ÖeP2$lw¿í‹šÍif\)§£Ýœã ¤b;1ÐXØýB×­ŒÿD^àW±Ð›‘¹Z±3H|Ág_Và"„º _zˆ+ƒ¬Ò±è0Ð$yñ—¼À‰<]Ù˪“šæ •Ð‹¥né(O(„$ÈÿHc©›@WK‹7W3®$<`É›oÂÂÃ1‡a»u©6'¼@–9®OœLCt6×6ðÕ”ßåùfe¶° úøNºöe †Å‚¯Iœ( £Ñ$sM¢7»oBï+‰;Í’rZ´ˆ›^ +B/K8Hð>$ èÑ`eØÌðʼn;Â_Å X½Ã—ˆ…Æ´´ùÖ P¬Éƒ€…ÆMýrÐÛÉÌÖ€òÁ‚h°è8@(éRd@¥|Фƒ›ŒnR¦=®$H‘b¥gÉ_Ø» ºÂ…†ácñã° ²ª‚q6˜×ùãÓùq¶ºš ?ÅE€?ù=^õ1ìû½¼6fŸ¥54-’K,t8êÉC`żÌ`1Ð °Ï]@¨AZ"BRØUbšHS|ô¼IÀòBÎ=ã)~fàÓ^8`aJtëQÒ\ˆx!Ñ V+rév=lØ…¼b7¤1‘óûX("^Dź00Å´ì~ÒsÔ¾pù`›ŽK MSØbž+LEöðÙÃ÷VÌ‘;ó‹'O±@iú*UtP©nÇ©öoâT¥$óKÛùdÞùd¹Â÷òÚ·K&æïU¸‹…¹u cˆ=0ÀV ,F€hsëi³•¸—t$üä âxÁ*Óˆ…ù§bá^˜z,Ç*zk/Ä:˜Q¹ IŽó ¨ï〬Q«Ïý-Á£13p%ÊzóS[Ú]÷X FK¯¸ï¯&šÙë]ÃB0!Çô|ÞyéÎŒï»Xx¬¨ÓE Ʀ#…¥ùí]J7ÎHš/`j%àƒ‚V» ®‹¶eëu¿Ú ,Æ«p‹…è×òÂ\é0¾w_¡‰Ï“ÊPY§¥ög%—”Ç´úDûi/óW±Æ:“bú±Xxb~á-nñºøì5,,Ë|ÚÞÆ©žÈ~}æfŽ¢kXXáQû+¨ijKM^04û×pô&P©tÕ@áµ¼°²åïã…º3}³€Ñp0:DM)d&B³¤lc{Tw5;d°(Ê{Ñ£÷ry‚¬üÁÑ’OÄ`<È 2Ž–ÛX¸ˆÁ8S¥ÃY>ÐG±'`²kX°l +ú+GVÚ§RXFX±€nnøòSl‡~œ¡]à» 6µÞñ‚Ä«óûxtrTË9¨ô¨ÖÓf*Šœ)79N6ó¦±ßx¶ª;–á”oP‹É{w®òŸ¨ƒñ/°€.w°p7N5?¦/ ¢õQ,Üš_ðõª³f.v­³¡Æa¯±ã»Ó‘2[³:Ž¬Í™r´F êu°Ù ®ý6^¸Þˆ2¶Üþe£Ûº´¢>Ò#¼ «9ZžÂÂYþÂÉtÃÂZc,_ßN-ÄÝßh/´H”á<,Vµˆ1ÕHK\·ä0¿ N°ð«xᆃÞÀm:föø¿‡ùyX$óŽ©k'Xèã…´&vÉw‚…ê+x~Õ¤–špÔ„|ª:ldZ¦HxPmR;ü·ZÞ_äÓø¾Çœ—Èקî¢"˜þ,PÏ ã;1iÒwk‹ó·ÓºÛža*¿Œ›ô4‰3?œÙÇw&æêp•9=9©ëËtn·_ºýJÁaŸÿ9Xཋ‰…~P.uôèG²Óèv…û t¨Åÿ‹Ð™÷yÁ¹=ÃU_ò^ýF¿¼Îö=ÁÊéÖÒ+Ë'Ú•læã™ù½•¢Ãaç'QÌ=¿ùñ†-eâÖ´½ÄÂ*Ëžï‡ö­Ó>Ù·˜Æ.p¿)ýÒ‡s™á.Ú¹å&ö"8$=^…†Añ+ya«W±†bãŠs n)Ó-"±(þ,üáÕèÕŒ§Ýà…Z7&f6§2¯m¦ñóªFE¯Eg<"˜‡3’îXøk‘üËX¸5ïŒK™JŠ>&•%’ø Ôƒ/´5J¡ÂIDÉc¶êè_ÁÒ ÿ/¬XðädÒ! +qƤ&¸^»)p‰kt¯rÖžÓÿ~/ò²Ì²é¯‚á¢úâÎ "éE’e ·½ à—)³Á¨á†»øt¿®výO`á½ù…ßݦùM„ãÎ '¼`B¡egzm×”™0(•Š/à즕œTÿ +Þ[—ç7·<âMJâ],¤“¡ô >ŒR°¿b‰P·L¯Û`?FÏ—¨„‹^¯5z-*¹y*v‡Ÿ=Ì<¿Ã N DA¯ƒN¤é’¦ÔåòxÁòA'þ!,üe^ÈŸÌý}£\èf]-ĒKvD¥n½,aÏŸÖêO/³Ðˆ%¿¨5JKZËNnÔE¦É5iŽë‰6‰‰Õ^¨fs6!¡†‹2Æ°ó¬.0f;8Ú #Ú °ýS¼ðW±ðdŒ†-†hmPëÖÌ0pŽÚÒJ WIu]ú~æ[áŠà“$eötïFNô¢Ö(Ö.³rqcåµäj:ir”Ù±6…MÕ¾Á ™.¡½Ivi‚ Sß;ÑeÃ6,dÆ“ÝÒb~åa¡øÄ)™Ï)ÍÐüaéI,ôH`—ÉV,ÔÌ&¾µš™EŸgNSyX8ª8ÎVÌ(Þl²?¹F3¸N_ª¶Ž³úD&Q'gó“úD%Î^L“ÜL_eê6/ðZËŠx6ƒ²:.ú[iÙ» KSå ?Hö©XÖÝ¥íéG[ZBÔpéÛ]à zD`¢ÉÙ]z~vÈC- +Ã$™— €ÆÃ5˜€±ô À¨3m)}aÑç9·±ôË×M]ŠL`+šr,LãŠ%C‡µCMë×¢Na°h=™h¨‡pL z“&sgSLˆdÓûL pݱ5ƒ¯D OœÃñkÝÃ5Í$$ápyœ£¶–ÑÔù2+[S¶=Nž%Z¨ÝžwæÍl×,Y<ËQ¼™ìqs³U ³?^˯| ¥{Tÿ‰ OZÌ¡xûuPÍó¤h{}¾â|"Éã÷)ÞIþÅÕ ï»êQ,4¶DO…Ã`ß©Áò‚êÇkie (= +†å…SÖÕoʽÞʘŠ[F(KZ]ÁXKâÑÎXõ±Pxtà(Q:ˆd :¤JfèЄÃ}9bfQÖi0[T gu±€AŽÇ¥Ü2Yfr £ô)#q—Å +¥:i$HÖ@à +$$ `è³ÕŸŽGú /ý;XvpÏŸ«P9i—‰ž¼½|ÁŽÙ@ûð†#!cû¼ó³1¨©€ÍØÁC²òB_ÂÖlLD± á,åxÆ X03a|ëÀLO0¾Õ742”ŒÊTXŽµvÆÊ“Í„X€ÿáÅ‘*dð0 ŽW‚£±Š#¨›_8œ±É0[—hÐç;À$>€jÔMVqëëïÞÊö”¦WEé/pô‚Ý’Ø+ù:OQb!Íà<[X×(£i§*¼F¨*ßb!t홹SX}Û÷z+㉫–Zímª8ðênÙ°€¾ŠÁö±êQÏ„+fV²5 +)!Â+M=Œp¹ÎŸJ3%pzjf"+¾cá¹yçžY›Ñ“y$f²òˆwå'È u–UUl¢išøf/€ô'X4EZŽ„ +€ÕΆ(–ˆ Eã{$=“T$ “9Ãèžås/PX°+a ¹’؈œþ‚M%Št i¦ÇÀªÚ²1‰1>–r[l®#X®Ñàô1¿Š™õ‚]®«îÁÕg¢µÏrâVm’G°ÐàÁÓ„’€ë,D-UúaÒUR`ZÄ°YÍ á‡•]s­V.Ðc1kðB +f­€ŠñÊñjzŠ•Ùá|¿L.b)@³,ÀR|בžÃÂHœÿD¥2/Œ Ž¹ˆ6{¡Ò6ÍÓòÆcEÆo¡ŽÖJHXP«—¤š3–S$§JòuZ¨¦Âúq€,£ˆ‡ ®†Xè:ÃIi±à3ç‚âÖ þ b€)P#ÜÞ +­‡Ø‚ç†@F +"0nðè[¾ß^®2ODdú|®¹ŠO]TO`+ À¿$z’1–ÕàÌéHXeC1,>åa‘ûV”œ@°Ó™•xW!(ŒÁŠ…Ìд×ÓdÍybjxø‡]‘-k|Â~•l¦¥­ k²&{8†$ò‚8žÿ,žˆÁ-/T }…²hy¡ $&0ýHMY&ÑÆ ³LÚ ŽÑ©ì¢yvµ7BÝz84[^Êq¼P:,dxüœgºò( ÎêHåäx!±®&تJëæwX(Pà±úL){`_„8Ȧ©ÃqS ¤~—ZM·¾Xëh;¯Œ¹`é¬À^sQÕc¾:†üÓâ8|%k#TöÞpŸ¦@÷‡{ʵg1 +ˆ³Â/•hÚÁˆÕÊŠ¢,à(-m®„+hØ®ˆJ‚Er„ÉVX‡v„ãÌ–=…¿ƒ1§o¼Øw°0n±P1æðB êµ’«~$‹`̳*>t»].@ÙY³‹º_¡Cã?ö®±qR…"Õ»¨Jþÿ—‡e§lv/mÓÖºbG݆(„,XNdýx!€P_. é„zù$õ†©,ƒàÔ t5È„"³2o©ã¥D¤ʨô;öneGB\ôÂ@j  †õ&Ô~«RŽè¬œµÝƒáîvkÉ)g,¬aŒLn»hœM6äBTÏ× dÃèYÆÐùɾÃÏÈ®¾³âÜ'0Tžn/2 À×$xYG~òùd¦kÁ—áÊNîà@`«½@ÿ(ö©/!*ÂB|Eý?1U:ÁfÓÌNAJF¶™|µ¸›_Øéî2¨‡z¡GT¸&õ÷ ÍE^i#Aú¾„ÀЧªNèŠÀÔNeJï/€P>»ý¦îæ*Å‹lëºõníñ»=†3Oö¥Y=î’ô’e¾—”»Ìîz!K¢­vÜ@ ã7’1HÐM²•.ö8ÍŸ¹„¨ èÿxüÏ\Ûh¢h‰•HíZµžŒ,H<…ÔžƒXèµ^hPOú ] CØAî_ôáx—¤HèT;‰d ¸SÐä ó7r·Mm¼^Ȍّç‘XýÌ<}ô´ú8 '©°®L°ôG,ÈÏÁB€y¼?û Á=ì8Ä<]®ä!57_.T“z~¹O„…d™Æô°·{Þ7È>Ú·m#ÂÛÑ>~æ+ÆôÈ:a«jÏdņ0‘¶˜ªÙxÙØVz‚…j¸NSÓÆž§í0»æši£cºŽ:Ösm-íÚ—¤£nD¤,œžŸûþck<«LKýlß™N,¬EùÛ´ƒèüÑÜæÿoÐB¯0ydç ~è/€´Ä¥†RŽv?Æ‚<0ÍDzaÔ\ŠÿEl¤)eíâ’ ¢$t}Wäæ×íX¹¬ÛɸOhYúbYÝk°€*!M>xç~GC±äOÎÜ\/·ÉãSôÂmÞùXãÉûÄü÷±PjðÍËÉV©o/XèX/ÀFòz!±+s~,üÅ 0;‚Ÿ\§§s$.5ýtðzÇoª›^øjXPörÛ Ív ½iÓÐô™A¡däv¹FæN/ä&‰¯6Rà¤Ú/GZþ6:¯ :¨Ç#l¨|êuš—‰r‘ ¤{À‹s„™‚#˪ VQÑ„…«›?áDlaHCJÑÓ>ÛÝ)9ä3ÁãìL.ɓ˪ç/Û.„èoXøƒ¿àÙ£Ì$ÙƒùP©€Î`%2V/Â% †îÈÙÖf%#Î'èÁzi„ü"XhË¿Œ…Ê·ú‚Wj­QFQ õºäIÚ¸X“oÈÉŽ™FN6r¸3³Áœ¢Ð EûÕ†â#2-4çá”ætG/Ò¡á´HoVòªfþÜyç4'Y}»d’j—$÷Iz{öŠ·e¼bÍY_TÙVǾ÷'\âW'ÝXºb¥ÿý?‰ÄÇ`á¯.Ì!i¯ÌÜ¡m}‚‡Þ\ ¾¿•妡ࢋÈ=ŸM±Û¤ÌV„íü šXŠº¦W‘€*p5ZÏšå`£§kb¶Ä 9¼¼aáÌÁÖ7Ï<+Œk4®ƒáÑ´ç_b‹¢*E·ÿ0ËôÝÞyÚ:„Ú3ú{Ù +¿!*Žª%\¶ÿ·<ób›ü¹±AÌ$ªÁSºèƒ ÙyŠ ç|›E1йKÚŸ‚Óû/fqoÃá7ìë[_mýNXø*ËÇô.œ¼ÏX¨™ÿþlõB­j¿xió6’Ç“Ë«ˆu-DmŽÊ8¤’ ¬*¶—ÌoÝŽà$Qmz¤#ø0k –õ¼ÚÒ‰>;2Ë@úü†#]ès¡Ïðþ†ì²!õ D涤8ÕN`‰ÎisÃÝ5’3ÆËBÚP‚ºj;ŠÈøÛïºèT— ÁyÿÅ£ þâ­™[u¹8P7,¼ ½«Š3-¯Xð¤Ú}nWò›¸LÂmRp7vEQ°@6"_ ±¿†‘R”ŠŽgÔmédL§ääÁ„ÔNoó<îÀú:º íõK¢ç‰ÒTþ¶Œ˜±POÃåiO,Ù‡(åvnÈ~·!©Š cÁUqxÉöGìiQA²IäÏ tQ…âIu·§GQñDHD{°ÈÇþÜOn`,Ðý32í{Ô³—u_hÑò=ßåèÓ²[ðEl“œ þXú (Ð4ÆÊÀ—0hô›Ö½ŒZšÅÈ +½YOÂbC{ñ°ckä<>‘!›!A¤ñ¶a¡7tä9UÒd§’?ØoP»]p¦Î;ûf|ÀBèjæB\–»oD´à˜øVHÈÔuƒ{z´ÒtnÈqnÜŽä.þTËå² iÆü<Õeƒ¹ÛPó)àm87DkaGSH¿aÅ\£»·»òO{ÏV>i#eÆŒ‚n¶±ÝtMËÞݡ多éLR§ÿ(Ü1t Œõ ¬I·&˜r»™r»_² 7­ÉѪ„¾µéf²$J.ŸžG"n‘Û#…»É8å»y¿TXÀ‚¹¿¡¹·á]°Ð ÓÖu#.œôW,ÐãRrᔆ̨ˆLÝ‚@0 Í¦AûZ·‰þ_ÅÂ+—Í|Þ[…¤E‰#}ÁIHŸTUØÉ.ézDŸ‹:7ôOl(h¿ý–V”çAΚèKr1œ—Eó¥úþœj{¼!¡Ï©>Ͻ±›äÏ}ÙÀG¿Ùð¸_Û«–@“¡ÚÚn?b\ë «[Y+oäîq11[¿Ê%5"ú‚~ÅÇÂú‰Xð^ººúìü©¼ß~ñßi÷3ÅŽ¿Ûp=B§`²÷» wç¾ìp^´~´á—»¹wî§ïæzª_6\}«¿ ¹ÅCÞÇÂÙ)²ÑÆÇ2J_º 4+è24=ˆ©Þ- ½ñCÿ2’”í¿‡…>¤Mé_nb"'²Q ù9Yi !Þ;ªϾÍfÏî˜wã¤ûFZ÷ ú>²•É×{:ËöÊ“w§3·Ãí²’61¥ºýaN/»3Ã0¼0–ѯß +®˜Å‡ · á?N¢‹Éú4Ri:#ÑÁýu§:þW°Ð˜² '£H/Y– " +!QÝy,:¤UZíÓYþÊ·¤ø£sX™­¦YÍ–¥·¤Ú+Ož÷}IÓâG­<äÆL³à¢¢ŒãH´Ë ûeGÁ7‚KÆÏ@à‰…5|¨“ªy~kŽn«‹tñ`!´~š“° ä¹[ðVΚ±Ðñª]aÕ=, “RÓ=,H¸Öyħó…¹ç8?ÒÃxØ©A½Pó”ÒÊùìÇ(XNõŽgî}çX½´@rb!å÷oOh¼à,õG6H¦OÄ‹Ñ’§ÿÏ`bÀ‚è\ò5(…bñ\:¨f¸‡…šÃIÝ~ßFH/€Šµ®~ê/ Éjå< Í†w>„W)‰)®q¤ÀNîžïüBÛøÄÂ2üR{"”àéF4ëSÓŠý=f› ¾aá\dé¾ÄòA5ž(sà/€¥X!ÁúªÒ)jä\õ‚÷¨vQ3Ïi#¥W½Ð8аõÆ×P ˜¡›ÞÉ:BT¢$×䊅ááÉ`ϵó9¿Ð½‚ƒ8ðò½ÁO\ì^–’|–èI¶%Ÿr û»Ñ/øëišŸ‹…u’;f¢NÂ\Ê8{/V‚/´º'Ïvcdr´ê£Sü’}ßZ¹LÄ€IÑŸ «°×Y=·sôöyÆ âß#Ž´“K@f{+ÝjD¶Ø€•Œ—Èlµ”Ùló«^:óŠ.CÚŠ+¢AØN³m3y:ÍÑe ¦n’|Q.Èè¼b¡’vjÁÕíõ¤o3;{û+ú4œþÂ8ùå%òÑžêÞN÷ýÞZÅ×µ¿œúWùõé™Þ_XIÅw&~8ËÐ&U+) ˆZÖ­Õydö…ÆDô e4Y-hô[î:›¤Âîë·ÇÂïy¶U]‘¹URœ"Rîâš=¶ûmûî‡ôBï;ä@ŠÇÔý`”Ð9YCê(߇ö*Š#®N½ÀÜA~,ü„Åû hFZ¡“V½mÛAÕÀU+‹dG> ۇܴÅT +i²–-Át"[* ,Ày§±1ùþÂx¶ëFZmçÊg)EÞŽät´Þ¬áE/ÌW,@/@ðIÊqH¬O,T˜R½¶vT¨q ¯{Y;ǧ^È)ßޜ솅—ú ¿ÉÜ—Všƒ_θ{Î ±?‚2üÚ’kâ iìö x™VÑðþÀ³Û.IåÃ*R7׋c×À¨y‘•çÙ¾è¦r€”g`–<1T ’º:éìXŒÓ\öš§%‹/zçmßÞ—ú à÷cΪ³»Æ½à°ÖOÌ#6¢ÒÝZÑ«³}KÇägU}@vÂOÐ àÙò+2Ÿðã#`èhdÿ6÷¼@½ý^@q_rú öE¨!•Šò«<X´`IÚåxÝÛ«ônXx©¿Àq-ÙÎÂÆq¤qO9s!U)mÂ]™\?Ƀg½]°Àí}ó#ôÂx¶G½¥#™ƒ­ +òŸ;¹®r‰õ^ôº#%oùÀ,ˆ½ÊLê¥|t¥m"MXhB²?»"!"÷ã8Ÿxr ä/™ï¼ Aü†…÷FÌL”>Ä—Ù‹^à6£©ÖA±í@CfÈeC1æÍMŒ…‚«[B}1¡¿¹¿ð[žm²ðÍB?9&ݨJ'q !ÙŠ+ božíÖ.ô8¤#ïàæ6f& iìDÎY£ÒÇ ÙÜÚÏ,¿’NŽNjg‚ø í/äÙka‡(¬Œ½^.4I:“š°aŠ}Z¤ƒ Ð.;3YJøÊ ÜlVn=a%0Múݱð'ží* j¦Õ®_‰8{ïLâÃ_ñ…g»v(J‰ýÞ±ª×8VÈ,XGDþ™§Yß 9ÆwdÞE#Ax‚³þ¬®M‘^NÅ\¶OYæÙÄÂSP?ßvÑ!ºMÖQ‰N•*+slXÃæðzA%èYɽ+`&õ ßÐ_x$¦Éų°~…MwO=Ýó÷ c!ÓR¡Pш:çÑH°m'Fkôécr 6Ÿ-,³Ìß°ðýü…,ÉET$»ñ¶½û—rÏ€…õ)Å5;ÛEy#9?Û׳€ ¼‘ÞÐs+Ú˜9Â]îGþA¯È,ˆK:{‚‹Ñ¾‡× 8¾>Iÿ<ìèV´åkÝf‚kž‚XONÉKLÂ%‰“Y (j_@-Ü°ðbaÒ²Óº¢×Í)ÙƒÕ¾]"êMr×YÙá³-¹ÒêYK…V)]*õr¡#Ø­\ÌäF”Àž…pgBNa̲“¼L)à +ýì»w¤ƒâçv¼üT,pŠÐ ÕÊ¥õjʸ.|EzÎå\ÄÞu)ꬊVM7á[ú “í]ObŠæ ¹ÙÔi#a¨[·“\7Zõ&åìlzÉ%íOccäPÓFô +:õCjE³Òíäæ…üÓ) +x »p`ƒBÚéø%-IS, u”d>´vAb5s')´Q¥pÝͯî¹ùÎßÖ_˜tíRDè,RÑ@Vs.n!wÚŠ 238zJ£ GMö%0ɺvÐ7®ÖÉ׬’N|ú½ïªù’­Ær2¸d›É×52Ïç<ú|,„ô¤¢Î`â,ßíƒö‘0"¸“dÜ°ð­ý¼·X' >„úÔ «´v*P‘HRLz¡G&jdêÉÄãž õ€±7¸ßOß¹ßG‰’ˆÓÞAÛD:¡ÀŒkdŠib 9`Ç›ä›`SÁ³ˆåj! +ú(ôÄõŠ¾3gX¯ý)«›ô=ý… 9ºì¢8áZå-vç8cü… +‘“š •§=Í÷Vy)÷° C: ðÅ+±ã4J­*(•Œ°Ðù½uØd[×B},d6i$ô¦[vÒ‰„ù©€™8±¿ÐŽ£2v¥©à1õ¤ò¢ÕÕÉqÃÂ÷Ò Ùõ¾^*\<{Ú›Ýc!€¿°ƒf?%G&e_g®¿JÏ [ç õJ.’³ rn»–Ù ÅÞ³æ +0êŒ×lsñM°`L§IÎÛ rw:»H’þÐîH5"«1fѺ@1xGº¡±&K9]ñç5ì¹aá¥þ‰·è¾Xt]ë2!·¢÷ôÂ%;»´mÜ’ ¹»¦e|éû lF"€þ×gú}'½v”E`Zòio³Öt=/Lê¾EL5—‘X0×VJ„†ãA3ÕA ˜å\hE\»Ä9Ib™0qÒ _~ñÜ 9™¾—çÄÝ7]Ľ”ïù «‘ÜÛ³$/dõ=w;G6·ÕçüÂ.ïú™yòBv²ëÍ ì%&½@{”Œ½Õ_ï›ÄTõ7|ëÉ Ï·‘|G´ðŽhL;šûÄ5~ ëKü Ý‘&*MÜj‚ù­èKÎ0ØBÞ_%eßûì`‹J>8ðÙ«*ñ&PŸåÄ/;Ì×[ýñCù•±°|_,d»ë^â;?[‹œÙÙÏiÌ5=.\/Î ½'‚Sþu±°Ír`‹1“ß ö= +EoXxzO…ÿ<,¨ì ϵÚú €úŽ/]˜í†…ùÎnÝàÇæô·Œ¶kW­gºÚ_ã …rí©sˆ.€šO›ë§‡¿ ¹Ÿa#…6ü¾ï7ûÛm‚þ ªþVXèõv™+ÌïD5¸cßîÅ/ÅY­Ú›Ðúší¯‚…cùÆ#_­> ƒyŽ•¶ªzüuÎuþÐQÈÛHhçpôÔéïžè.£Í¯¬`Xõ3±ð}¶ÏXþ éž‘WK¥ä¯ÍÕÄôáXP‹ 1$ûX¸¸\]:ïƒö>ï»ñ@žu;l¡ªÂcî2úýf.²¤Ù[îôk±*Ý—ˆ÷ö?oGVwѪ“Ú}ÿu,Sw[þ´D‰…Ü<‡@nÖµû•DûŽ(çãl¤TZÙwFK+˜bX˜Îø†™™Ñ¦1V'˜bRÛ¤ ý·ÅÈAŠÅvÒfç*#ìɇ;Û$&ÀÈZéLìoMX{znmw[~·Øé±;®.X€4l΄Œ,Èh º9ÅŒå>wÍ U޻ˎ0šòd ²ÄåçûaþÛH$¹™ÙR›€>ð=¦3ÛºT„… L¼ÚÎ)Ù9d¤u´WZuºyѹ„WõtªÈ«ÆÆÅ´çd#̺ٓ¡cÃÀBþÛòärå +ý,äÚÊ ³ýZÐøÉÈÃÑè*í(QñRcØ5k ­ØH6C;&§Íml»O$S4äg#q‡{Øf›Ib“mV× HL$zòÔ3ntÌ.þ¼©)kÐQ/w«ÎÒÍÙ(Ÿ í³ÁQ¬@ÞÄjúÀBânËï—Å‚kL¬Pþ;š8£sèÙud! "l0 +Éj)zèþnm÷¦ÂUJ2¹4‰>> ôÂÀXH zNÛ“¤ÂçìË“E8†Æ ЊùÝëBfÓîWuW,pwÆÞlÈ\F[:ú74jx#‰ú ﰈƂê1±T˜ˆ³ØGÍC&X³hè"7躖â\Oä$Ô¾3°Ð9nþõ6ÒÁX8 H–ƒA{:ëW.Xè1ssÑ çwF·Át®Z®#v ÂÂîWÑ¿•Nö7F»oXø†z¡ÎìÁý91zÒß)>Áf +Áh§‘´”Ì7svÆ‘ºÍ ,ˆñ®Nìãü…«^ØZEcùäFÊÂÿ ¬vìŸq“¦î\µ\õ€KÃU¿'œ˜etÃÂ?ˆnÛ¢s{,°Ô%V” J Y/>3!ßw‘x,øæ¸êc°àm$wb~á0ù sàXm3Y:-kª{XˆÀp”M–Oêèñª{za3¥C{¿åN/¸öÍ,)7,|Gµï(~GûfÔ;úÞÏÐ UÇÕÁl#‘⨠S£ø²—S/ø!·ù8,TÚF§^ˆÁj ôŒ©J´ð{¤c“ÅhM÷¸-d'yUw§<‹Ðq­ŒŽ7ÇnXø†þBêä®\§Uds&Õwz¡#2´- “bŒB¨K;Ù ü[}ă9ó‘‚æ6N°®“ÂÅYÛT§ïÜ—M|IÛ®c´ X >}Sì‹OÎÞÊr+"E«6¤ms*6Ÿ’Ùå.ÙàXë䆅O/ ¿% ›ˆ@Òø(â³:ë…ˆÆZJ]`M hÚ±€…ݹˆ…ß-ÈÙß——^+3¼oXøvX8P粆ÜòÒE-H8ƒ•ÖDèpcĬ֨vQ^`0¦ϼÚ] ØÝÁGUþOÎvö,¼ð‘Æ}sÎä ß o¶è–{0š“#sý¥‰—°*<Óòø@Ì.Àþ˜Õ)ý&Zב·§ýY@—g/g¹é…ÃBž} ,lÉ}¡ëžÂB\;mF®Je¦ý žNFRÙU‡ÿ[ƒõR,ì ÉwŠYvøk;…HA »ÅX±LùsáÚ]¶;•VOĺ…þºœ%èèƒ6$7,|$>p9m¤ºÏHc1hÖGIzª÷' ÿ/]Œ2~Æ‚Š‚ÓœÁ «þ£5líŒÚ­f]}“Ê>aI_“ Û’Žô=0i KŠ›žÔqÝ£fb‚wÆB€¡}@N˜BFí‚ÝžèÓup.˜ç3’z™v„¨ ,/¬Vƒ@U·»xøã°´íû€ºZ~Ôn ºxC ä’ŒcMæ2ÉXhi›H‘}ÞÀB¯y –y‰ wötJ{Ëîˆ7ö”›«'2šr$Ÿ 'æbmH² …×dnYŒ‰dËÎWјýÔª¯ÀÂ@"-y ¿?è^•[{uÅÂn÷ÍAE·µäÛ‰…á>B6/P?À_(aö¹(G"5קÀ]e8=“£$1H2°œÐsÊ‘#D­{ß–ŽkuqdýàQn%1ßeNÁ£Z[@?â5«¯ìÛ߯BÓº0B=˹_B_µ´_ŽýàÑE´¦âÝÀßÃòó€6BÈž†ìyõGHÿÎÞyõ6Òl¢¢´+óæu]­÷m‚ýí"ÛT YÉ“ «lÛ«“b륗üqw¥Ž0øoöZí¼ZÑG¦$ÙIŠÑ¬…ÉÓÒ¬›žÝ r°ÝåtÎÉmóÕŠŒ«•66&Sï‹…ÈU’nËëИ9`ñ¬èöXÈÉGx—â~*­ÈšÁ\m¤Þ‚“þ^h á„øF ò‚Ò©ÍYÁ[$°ÆT¢Ê©“Â#ö#™ièIläºVªs¿ïû:mmæa´ä8_Ü‘ì´ß±“°Ï¹¿‚Â~Íè‹â]Ùžûå3¨©h¿mç¡}pd@W¨Gº“d&, gHŽ<º…$°ißXû㱬"³ºÛÁ_·¾é!ÓußÔÜtg‘ÈÑÈ7sD°ëïILû%îÊ\ëjž¦±Ø V‚Æã3ì%æàU’Ö²¡“Ô E<6Š]ÂwîSèŽÒ¨÷÷4\[ÃJl·[ÙU.ï°@¦dI]±pñ=üY~Œ^`,äÍ1ê·W¯~)ay3Úé/¤áC¢Ñ^²ûa×Òë‚a6 Ø ' ¦Èm·wÂç”>C••AÃvˆµçî“ãt `¢Û|çȆ®MJFŽ#Å4X`þB‰î!5¶ðÂýÁ>ëï°àÖP :$ïé91-à‰–Ÿ¥êúŠ¸¿ŽêíXHÈ^oÉ€'§wÞ¹ÍÆÔ]ôÂø +²ì`O¸hL·tËX=Ô È…ë4îÍ2 .Zr‡8RÐaÀ•¿H$½ëžiöÞ_/äë3@¹ª›>‚1à’Öü‚U ɥ†Ö ñ’ô9ü…ñâý…ŒÏò³ü…[éw6’ìR‡"'&ÓÈæ5øµ½¿ÐBRÉ;àŒSÓ’Ä,qzñN½À½w8´z‡…Ð üæTfB`¡JÉϱ7,iû}ôX€ËœÛêýõ—ÚÙÚo¬Q3ǃö;,Ä;EV’ ï¼éŒ# üéõÂõ®~^ø™XHÕ›±À=lC” ‡-¦È¼®…özÁ!Ó¶'Z4*‘ÖÕl+".­Võ‚ ,yX.]lÏ¥œ¤P®×›„Žb’y²†Ð› 2Á>Ÿ6’o^üoè+±XÛådµ´ÍŽÙhyÃ%Ž$óF“cÊ0_üüÂȼÊÙ]Éý ½ðs±Pïo +%y©3ã¢1åÚûø»„Ñµ× ¹]F©w2œÄd:Ž©ÒèÚù×£¸#K¢W–¸ ¡C„Šµêm“Ø}4»;´é\§¿ Œévnb¥ƒwÄ‚ºbÁ ì ïˆv\ÜâKà(à)i½2÷¨e7á2¿ nXøfz¡ˆßŽ…b”SßÀ|æ˜h—åÚÆkéÖ²V¥Ü“ tY3È!&Û¿r*”âD`–Ó>ÍŒRΨmE“çÁ.*^½ƒ¯» ].xMßÉ!åtÜ©n¹Ù­kö÷ÄBÞu9I&Ù!÷Ü©¦£o|ÃÍÌîI? +1³¸“èÕ ˜Ám†*{WwããOÈú»ù ô>w©žÝ½ð]òT  Ôÿ/Þ¶‘ÞÁ_ølçc±ð¯/? ±xÓ›?ë$&ÉïGκ xžþÞäN/¨ëÛûéÛ©nX¸aáôB¡ÞŽ…‡ÔŽ¿TéÔó+±Ü#V‚³éˆ| 5áC‡?®oX¸ù _Ä_ŒéAð‹A],ÌOaáEœÈ‰|‚oX¸é…¿§<`ÅQ¤®Q¬â„c++Z¯Ì[¶e}Ím…ºø¦Ûø1´9=J1==ÿ\”EÂWQ® â4PJf7,Ü°ðÎK%ßäýz‰ÄyÕÖh¯–ÉBrÛh)çë,©Êc!ÝýÞ¹±RœzAk«3Ÿ÷íá"™I„ØÉì±;¤5rCTÕ6®oX¸aá½õBZ¿ ä/t{µjqñFÛ“®“¤³Ž{ÛÖ }mlä<ft›™Óò¬ðÜmV,fyfíóJóW9¤‰Éœë&‘¯ÝåëeÚú†…›¿ðÅü…eg¾Þë…®ãíÀT`¼D7[“sñFJ¶°08dM Á-$ZžzAø\UÙ"%Écô‚¤C_`ȉ̖ñlpò*êänzá‹ÚêwÀ‚pÕÓz#!/0[¬-&˜¹‡[Ü,žX(¬ìºÝ†¥tƒˆ*R3F'v©½^X,&™+pL”q)hÿ*öùnXøò‰wÈÙFL5gžë…ÝW6³±B¥6wh1“ïÀXØ̾tË 0ªæÓwž‘õ9ƒ +`÷¹JI5ä)ô™åLï#³˜[XMðÙXècïâû +oå.ÅôWŠ%ö6(}¡ÿ^4âà¿ðk&Õÿ: ¿ç,øƒ>¼Ûqóž……ŠœÛÝ÷ÖÚ¯X¨ç6¬I/tòp©õX˜Sˆ[]¸ +à^Lµ";–¡ôÂÚa¤ÀnJõzbMP§g¯èÓõBß¹Ky9˜ðíɾ)m°ðÈ°Òwüû’7®Dëõ—ÝýB'›ýJþ“ÊײÄmO$i–â"iã‚®¾ù Ïñ$'hô‘kÔ5”nÀ‚Üçöôà#8G4ºÆ?[!ùÅ$†‹ö¼ÄÚÛ(”ô¾èH‚G‘³Ô˜â“±°”$ý€qŒLT6åpö”þŠÍ˜dyÎB™fYkš,y‰«ËÌ•Õ#xäOÌÌ¿’-=þW¹âõ6,„dÎîùÏÖ qÿ>þBk»ÉˆGþBaä(uᤠ[;.’†JÃóÎ ¸’½'qÆ‘V˜+»T¼¤Zr&øn&´$¢+€g¥±•{mÃwÄB*{7IV£èTG.~'$*Í!,<bÂ-,'úŸRqÏ@/úø´gâ•<6ú¶m¼b=<®;Ñ¢Ò“JõÛPÅ +pífvHµÓqœ4[lÕ [¯ØÄ©cw¹ªêOçð¼Î]ø}Q/”«W>/_E©•ª@ûÑÒv? ýž¾ÝFF#e{’kgÌàìì¾Ó 1ˆöP ² ’Ü•‘+I֟βM<É|“’³·¹@Ž—h®Õ,öÉ…,ã³­­h? %jYwÜ×2ëz¡[ÚÕ ½Æû½£Éû†ê¾vL„4` Œ!,ÁéÉÈ€ê\AãùJ>¦:–‰’+ùK(ÈhÈÚZÜlMBZ`“ãEב÷UfV Õá~ˆÎ`! î +=QU²+ˆ:ÂrÝ]ŠÁŠIz]| ](0vIw:*¥Û »pC§%ýÊyùÿ¡á÷±áöƒý…øü…w]ý‹ùóË-ºÿd,thÇ»L#¬`Ô×¼ÀÛ)u›½l‡v»‡„É”Ì3ÛÖ£t‰IÒIºª=bÉ“$¶2LT‘„'¨ ÍfZšxä0Å™ +Ùâ’b?ÐáTê>ÐdÀﮣ_´·±]¶ä9Mºû¤P›œ3òÇ­2;¨YºVTgR’—43Ùªƒ˜ìÚQT<62E¥ØÈzm´ÒM6‹‘°ëgûoþÂm¤÷´ÙÊç4^ÇûŽX!°I·ŠÕë…}h«é׺]OÃXhi›®rŠ6³ìNmìN(à'†Œ. Ï¡tä|%±.F2·¼â2's‚Â\ý(x.’4ã0 @–V¦¤`ÈQ(IôϹD"‚íò"Æî0}IÝqx,ÐÝ]€QgêzºxºâCú%GÁ Û¬`öéص‹qn'Ê­Ò þRXHÞþ0"ød,ÔÖQW뵕9õ¸Má/„¥º^HÜ(c†grNn3”wFŠ“O©@ºJk’Ñvß œ¥L f;ÓL¶I $°0lÀOnR\|'EÑÐÉ‚D×y,±Œ&îkä9;xæ>g½PçkÂB[:0“r) VËȄ˼X=§ty0£¡K²õNàÄXX$Wð».‚îj<ßsÙž RkýéXh€·‡KÎX(ÑFL4]R˜Ãû ÛÒ-ý‰…X6]ËX¨tN~P“ƒ–þ ‡I—)@0¸6°  u]Ñžx½°{,4:H/h{IvÚAë Sw‰©2jwÑ Â¯©aàëÁ]VIÔÉd¾¸4ßm ê‚DrS³…¬~6ê·¤©ÖÀÂ7ªp|O©d,Ì»XSG",,‹(ó”ïŒ@ŒÜFâÞ°‘ŽkA’o#íW«’q½PÌ`3ïpÚH~÷$œ× 1š[4‚€ÂX’O mš)“1]Aå¼¾ošËdÛHÓr±‘Zz +"A‰`§bj¦ Úî9N`éæ/<½´F7îŸÄøh–Ý­v'ɺè…ÄN:öÛ!€…!¹È&ß¹‰;­Šå ‡Y¶UVVé+r¡DÐ › cÑå&ˆ¹v1aa—Eßz¡ÌG<ÓÙ½^ˆÈá;—%RÁªr¿7i¥Ž;òõZxg,6úÈwrsÑ^pèÉÝnL’¨ Y»~b|ç‚Éjó3ÖûsõBñ&!±6ú7±’d ó6Uz…+½Ì$Ûôª|ÿ‘ËœmÀ}æ_Bö0rug¸´'qœŒž§)ÕASS|„tÒDÑ9scdá:Úa/]iÃqp…ÀtvPnÎì g|¡¡"˜YÈF"w·žé”›­&)Ïèªt>DL}=Õ»6tô*‘RO#½½‘ñbÐ<µ¢«´Žl/üÊEHCòZ抟S­³®xËñgñÁ¿‡…ŠduG±â4ú¸÷WZñ?—gÌi.lôF¤~®íRÏ» ú³ZfÅäùœô+>æÀæ½èÔõ‘ªø:צðßÆgÂ÷úRõTõœ…)¶“¨õºÖñõªqß{‹¸ÒÑe®ãJ[´¦…«ý|œ….Ù͊ץǽû±XHŒ}“4'Á?Š…—r2÷“`mò´>|zÕöªLôÿ]òDZ©y~*î]ÕT-xrâÇú JØïdð!,¬/›°‡Í½ð4¼õA6ÒöW° a!ÖÏ·l—kuzä'u~®¿ð»·sÃÂÿî÷¢—X°°Ç¿ÁO]Ô÷>Þ}À{œ–_WϦןyF»p½sànXxþÕåÖ»ð†…Ûr†KnX¸aá¶|š^÷®Û}jrI_»Q]Öv › e#.Ã×¢mÁWžç)ø+ûÆñ„¯ú¨çîÁ‰÷Ô§èØw‹ð­ãÈÆÊ_}U +ŸåDñÙ8ª æë5êöî6ù†&þ™ÑÝmw'î»ëÙîݱš÷.¸aᆅ_"˜¯ñj‰9þù _ÏNÈ<£Ã>™oÀåeçã¯üþSNä_¡ä݉¹}½¸Í¼³Oø½K³Œø+Ëéa®mûbs¶àÎMÜÖXð·Égkù6ÓëÙ|ËœœÏÆJìõlwwœî—‹Ý°pÃÂc,ìw"ë±°<‚²öi,˜+ª§±Ð=‰…æI,ø³ñ5R@{w6¾†ºÙÇX°÷°pïÄ¥¾óŽcaoX¸ù ¿ÃÂYM7à.Oê…æÅzá%X8î°p_/ÜaáW½?©~‹…Æ~,F‹ÛòûÅ.Ÿ……ã‘´üŸÔßaa5¯ÃBø<½pÏFú_½ð,,„_ DzïâöÏoÿÙ“OÅBg9EvÂW_9[0l^ôèÛ©°ÒËéÆ_ÇSzéërŠ¬¹d^,øêg%>[ïõ¾&wgc ¿à¯^/ðÙNézZÜÝfÉ·_Îfýmfæzâèîlý县nËG.ÏÃÂA°dÅi…:)þZUæ)úJx‚*þÊûÖüõä©Â÷ eÕå«»÷g»ûJ‹º;N=:±Kï¾Ò ×piqw6ܦÿªînS¥w_ißâ—_ïø†…¿³Äã4nß ÿÞòÕ° )~´|a¾njý ¿Ñ„MNËñe°@¦àˆ) Á ·å-zá‡`!.™Œê†…Ûòj,Ô¡þ²vöË~ÈüG(ÔÅ +<©² +…h9Sf«µú|,l-½ºIð'úÎÝú#~w=þ Gg­ÎQ=ÁNŸ¸Xcô"ILJø³±0ÝÍ$Ü–ÏÂBÿó±ph3„Âæ— ÷N¸Øˆe錬Ül§r²ógcáÞüÂ?² äZUꆅÅž2·k·z‚IÆ‚y‘͘ÜܵvûXø—ô‚Ÿ•ËnXøH,~ÔµÚ;,à[¬K§1zL_ Û?„…¯7×ö`!²—ßØ?Ò ‡iÜnš¿k™Ül¤¾ 2s©Á¾ï/´A”Ó»UZ»gê³±ó<é ? iù¯*ƒÇB~ÅÂ=‰.Y9¨|7vrñQêó°ðï-? ÿßo16í‡c!ñ)Ī¸`aßÁñ%ÇÚ Í6h/5X7,|ÌuÝÒ}zç'bA}ֳ̱O¡—Ýé;Ã6AÛ-Wë0Z¦©¿aá-Ÿ…( ¹I^æ$c*)sîφL™‡½>±°…!ÖiT5áö—±àvβŸMì4ê[6ÛÞµ XKW‘@ú½±P…ûÒS=¼AÚdnk‡ah™‰?ïöá7³§ñ^‹F±äôÀ’§IõÔ¯YÃ;ó2U7,@ÊŒÔZ÷ î•(™4¢v‘¡µ«S•Lø ¤5&q‘¦5ïA¥÷G,vúÕ(¡%—Y˜ÃÝ‘æï¶ô«> ÕºÑò "µƒž¬°"¾4=&%—YH“1 ¹N“|Zõ?%0ñŠyÓ  ¤Ws­‚ iÔMaÚØä»9¸ pá±À/¦0ILk1ÿm,¸8º$ÊoyÄYz÷4ùšGóõ½ïüÂê#/ô,ïé”%f‹˜< Ü/I‡9¢vkT“±ºfvØœÊÊ„þ +¶<)¢4g»¨hÊ,½bAHßî}p“ئòæ,4÷âl¡)S”Má-a4(£“U«‚"¤µñ¨³çÑ„Öè¬êŸŠ…cVDo´owM:{¤Ñ¸w9)n2…V9!I¼½†v”lz|Šñ¯cá3—÷wn-ÿÐ6*äBXˆyDßV;Çw¨ +I&jNTB{$»5¡[Èv],ÉÈÊÐ0§­¥Ý/XˆMxñ +F2xaèÂÂ5‘ß/wÒê §ó’a› +£éüdQÉ\×™VFªÞXù<#)§jü\,ˆ×¤‰Ñ]‰§ŠÐ==ºišÆ¶jÙz£¢º ðyÂ{~>Ò¢/:ì¾^(ê¸è4:³˜1»øÈ£®Ü@†ü.b²R‘‹ÕL'6rZG[n;UÐÈ´è‚àÔ ý%5Ó`–Y´6Rõ®éLÊ-’vè½ÃT‡n —7j%M´e„Û94Ejô3' üüB¼ÇäÀR‰r•ž¨ð*BXߥ>¦º¢m[ª“€õ‹m¤&™ÑÞEû¥ûük±Æ_ + ÿ¯:ù ¤˜ƒ#Ç9y?ggp~Ôd©Òà$dÅf)Þºå¡ |Ž9ø}áþ"œ:ÆB£<3鶜¼ªÕƒŠ‚¿ —ÊUJ¡ØÚ*0« x•­|¾¿ðñ°“gL<ÚrÃãKŠÞU£¦Qi¥7Àþ‚‚ŽL½J/Ô¤âGzŸ½Ù'³¿ ꪽŸ‡…f™¦eüÿ!u4Oa¡[–éü%EiH »eŒF_á0%b|‰“„ +av¥`@ÛÆ` åÝ× í¤ÝHžƒÒY£,Ö9ú7)ë…ÒÚ%¢ÁÎ󪄅¡¤FÃ]¼a‡{=¬¥“z¢ÁnÁŸ ¢€!êg:}Æ‘2+vZ½Î_4öä&é#éÔ°P™¯‚…ç.¥Ï.Oæ¸g¶EÙû €Gî±cÐZf§iN@36ûp…Ö´fÌÙiËÁ;FX­ìrÔý…ÑpLUÉ<3 ®˜¥>ŽuÆ6©—ãZÏ prñžé.üt,Tå6aV½Ř&S¥@ûgX¦ßJç=jÎèeÀ«¶6…Åób,Œx·YdçK_Êç`aë£1ò4ˆä¦¬\œ—tS*Øšèëca3<ïZ¥LßuÐÿ¯É‡-É0tιùõ8&ØèäèÛ½Ë ئBŽ§T½ÌFJ„Ø…ˆ~*>h©eé3›&keôl, Úؾ±RÛÌ¥ÒHÒñÂj’úJZ Q“¯·À~o ç»îëx$Ù¼b!²SQWö¦ÛIzyoô/ QÒΫœ× ôæ»…¿ÏöŠ…Àv[ædgXp°È2[$éÙµh9¿q”©+uuÁ‚è©.¤¾JÆ¿‘³-ÉÞåÜ¢äûx.Z®+J’ ÄWF]Ã1œI@B³ÖFÛ7ÀB%­Ö–aÀÜŽÃý¤ô–<çk­Xotg@ε4‹‘Š$½^èÈ€ZvIÊæ2ùØfš\y®­Ö Fp}¬Ñ ¹ƒ±¶IiwAãɪõN/A_° w­+£YoX€ã–‡ e4ÍÝ™ûä*eUâÍš>yC¾9QQ‹¹§äùz¡vUC‚9HòÛ£ZU¤ûD¹‰µ?Ó_ˆÓô½øþ~¹wÞÊÞÆ®ƒ÷íÕ,‰–}¼>÷uÚËÚ…dTÕeãú%‡•:WtR-=HtòÜ©vŸS²ËËaÛÜù|¤Æ.{Ü÷$Xö«rw^³Mè)RÒ XK—è ›ðši»aæ·5VÃ,}+¯£•¹„­{m˜¦¹´F¿þÊÒ$ÕN¦©IÒÐBÏÁ (n&¸€•¶2L =9”BJ^uö™XÕ߸Þ9Ñ_­éS±Ù}­{IæGbÛ¸OZÇÌäñî#m©îTN +70òÕd% ܽâZ÷,ĈÚ?qe‚Z Lês±ðíësÃÂ}å\–•|Òßbío3<½ðÆ0x,ƒ[ÄsŠþGJ3° ßÜ‹°CôHZˆbº õñWÀÂûëõ§¨NãßgïþÇ%X^è%bßwñCky‚3àLŽBÉÁ„€Ï]™Üç#È:Áð!NÁx=~y«ÏÄBc*whé&R^½ b²ÝrøºÇŸ©~éïŠ;ñk¤Ëäu8W‘ªÅ_Œ÷?Z~ôüÂ]]1N´Á)«É…>sÙ„9àª:'_[â¦^…ÍèQJ­6­³ƒO6OµîŒP_B/¼EÖ=ÆÂ|—Ò]®/­¡ñ¡»aá}~¦?צiÒ"=k£í-¥¾tI’á»$| \˜¸8P/ÅB=Ôw{r´¤Ñ"£ É£hS§Êþ3±À=m—êdp|„…ë5[ý¡U8? °PÚ³#R?êK{½åÌùB!JE£ºPò Ažç¯ðºJñb½ðIËçÖ;÷¡ëóH`’¿d¡¢0tÅ E™ÒèÅzaåž¹MعÂ8– Ñ(·…Q‹iŽ^®Ž¹(¡ªÉ1ðüjÁòÊ¥÷•/^[;lz‰é{ãÀ¼âZyó$N’íª;Iïf1£0kdÌ „™v;œ6R¬å$l´iÓm4H…v_h[`uGk]ò·[dËÍÁ8¹Ý(jA +9Z Ý«ò:‚CüƒQHÓŽ½ uAðraé…iëº"{-ªØåÑ?…Ìfî0­2¹K÷6R€¹Nz½ 2½q]I«UMX@kc·€†0d[ÄÅ_*ú«ýò3±àfžQ[õî&°ýl7/¸µX¨áAÂûL(IÞ2Wh3¹Öv»ç{y9 +±¾KÑWÇBCzl9:-3øÓNbèª~×ÀBnRÈ""¿PËSñ¨[èñù1Oè'b¡¶kKˆè™[q¶ü‰Ì˜ƒŒEì„™-„‡C/¹~Se²‘6à`ðß‹±€Šº¢ú:Xø[ƒ$l$<"9¹H[3ÄÀ‚K„ÕF_ü…\ZmO½ÐpI‰’ïWrøobÁÅ3=a–Ê~7F^r±s­;šFäøî4:á>¥îÞ$‰­ðwŸ±;± ’2Øz01!#[EqÆœ•´:«]*u|o6øøaºn—úxTÙçÆ‘ZMƳx§çR]ÃÅæùnG`!°äæb#Ù=‹ÉjõzÅ:ÈO}·Rô îÞÄ¥ºGqpor³Žý*~Û ˆLy¼ãÂ?žX¬Ô`ÅF’³~èNkËÅ,e‚Æ¿x²(\W¨aßg®·%Ù’öŒ> k~6Jä¨ðˆF ,”xr»ñ6RÜ ?aÁ@/(¤¹®&¸é…o³^`,læ^ž*f¾3Û¹’ÞchŽÊÊtMXÉ3¨ROLDÇŒ\!IcáB~ckWeDzIùL,l ÚcÁtÕ*òÕÖÐqh/zžA:ÛÁ…6‹ÉwÞe_í‚S/¬ó_Š©#–þÁBýÌ‚€×hÒ \ð›ùNƒ"·Rë6Fåí8Á‡ïvNõîsÚ…ða°€I¿šþ‡j±E|:Š¿‚Tš‘Tƒ1M‚ôBnÂêÂP+ùû¾»MÛ@4 æCâc„4ÒœÉßjœýoõ_Pú93˪}M<©Ô‘’b[¥¸Gb¡Ÿ÷ØW½OLšZJ'¸ä]ø4¦£\4© {„Ö*À}NòÓ±ðþzAÅNa*3¦›(²Ãζ¹8‰”KmQiíÒ$àϪg VI|²©á¨%¸aá\i„ªÿwÙ^3ÕF²lT¯i ÛžÀ‚¨qOPÆKXPBO\ò,ôFï¥¸ê… Ìgc¡”BˆýC[/[¶®ºaËÑÇܹêù}¦ýU‰×7#V+˜4Uoê²Êù=+è…á²#yÏ ÿ•ßã<­+ð˜W)áá¢(zPûÏ6Ò¾×׎ 0ÈìY/`f£&erêäÊ¢|úÓõ—]ª¿U±ùÍ°Pr•Z,Íão¢í…ž:ž¬•;vk—Øåûn7Òª+™1HG%IaíáÑÛJñ`¬\]ŠÓŠBIkÞN$øÐw¹î6¯N,4 J$X@E{b¶!bÔÇÇß uíŠàOÎÖv•ãÕWÙªˆÙd]‘ü.ŽïrÖ×Z﬎9C¹Æò]8$Û®»9jmÂŒDi5Ë6œ8ƒÉÓ¹]G‰YÀ˜:ö­É¹ŸÌ´ “™&ï1 [ŒV†!IkkËUÈ46&ÏÍ N‡ê°àk´îÈ ÔÝ]qú ±0‹Ñ)W©&$mÇÆ&ûè+ÚG—šïˆ…&Á¯ûƒ@Ë‹šû*[Õ‘Ïœò¬½ýsu÷=:íé•!…àá*ó¨\¥Žãø­‘õÂäpLèPG9j’•úBø˜Â +ɦÀ2ÇP Þ)N;Š¼÷7K4éK¶9F샄òˆUà|Ç û¥O´ý µ‹†méP¿·±Ká•aMšhÇöƒP¶/k?¤.[‚<áúõ¦vªÜ|±ûwÂBAJº”¿&5ÙKã3¨‰ŒÃÐ+ jJîuùç ˜wÀÂ,Ýíßk÷ò÷±à“çÄèð9èZÈ° }ܦ÷ê#ü½é1³Ø9 oÿaÏFˆZ·›ðµMO áü<1ÒÛËÒ”\HF&ËúR,¬O8 ùDr¯g÷¥–×aAÅn=ȳZ½W¶^½2wõÊ@VJµzëgíÓÓ-»0Î sÁB(i=)I‰!‚ÑsOòKV1X¯Ç=°^ h¨§F¨™nàâ +VýqΘ*TˆÖ|yEgaåîQ*ÝCêò7ýŽ­²ù7Æ‚ï×±/,´À‚A’íX;ŸÍÃϘg»"D°#‹­œ7ZKÞsVº\y­ÌzSñ8F¯£÷«ruÚè/ÆBÿD¡ôÅ_óî‰Àdýõ±€Zžn¹+äÈwr´È†„.e¯, ÉÓdN¯L kËF’ãF:úÜP%ä‹-þç&²¿ÄñF `räsdSÛ žxrš…ÕëÄ>üÁõ‰™Á´GçœôBJ7pƸ°OKÖÓ®ÒõF¶Ün ý\pSLw*,!Q Ñ ÷€)-Y©ù·Ö Í© JLä­U•GüðUô}m<§š«ÕÁXt$~iL¾óFr[×½ÔczW©ôYz!ÉÊ}­K!@¨ QÆõd÷ˆl9N…Q7Üór©ŸÈˆo|bwôøe0ûÏÁÂãŒÜŠ¨³2@|§£ÌL`>{8j§W–¡ö†vÉBÝuH‰)iOW@ù8–Ü‘KÇl «Y¹ö£´ü&;;'Út‘Ô4¨uë`3BI–:§AFØ ,LtvÃêVÉekO&â\à \sR÷³«Ž„AèwÚX9G üß9ie/¿µ^`ú̓ám$ŽÎ81y•1Â+8P£™C“Ù´Oîg$Ö§¿02­ôkIRÓH *ôU/läØÉF³t4@&f_è*;‰H¥å¤iÀÒôë;,<™æ´Êãnt|`‡èæ‹a¡¸‡…€{ðÄ:ãÐpn‹†V)L”ŸŠ-ÀBµÞFB&êH£zb6†C…Þöëö”G }‘Úb1V½p!šqÉ} +qb²y|Òãý)*Dcý½±ðØä¸$\ó&uÆ!Ä>îö|jíÝ*õhÎè÷X€Ÿ×w XŒÉ¸µ¢GÉB­¹Í¢ÎvÂ7É(‘̽:´$9Pÿ­®HßpsÝžD>OÄ—Å=, :ã†^ôBŒ:44ñý˜*¹e•™*Èäo°€Q Ö³ÂÐœhå‡míîc!2Té…â¢zu\°ïŒqÉcTáâÆxÂÍz¡b£z¡¾ê…‚1AëPä[ÇUýôÂXÐ&Õ²¬Zfœ™‰Q¾c¦b]‹8~À˜Ñ›Ò¡¡XC‡æ¦ç~£ÈÀÈ1ñ\ËÓJ.Ÿˆ…ºV÷+>®z¡Öy +“¨4)ô‹÷™µ‚µ× %{£y iLR[ø‰öΓÒ×ôÌ›œ—½¶°Åȵ@äµµ÷:9ýîãs¸“ìܸ-£æLxÌÁÊZmÂ!•–üÆü…ˆýIÌ7EÅþ§aa ϨM‘‡h G¬xשBQTç¶ä"E%QÄ9L´qÅNýkË1|1=údU“³ß%^ʺ͞£à&pÀ‹ŽaÙœz{¤]0c&púš¿Óðüuó MO!'¯,„sbdní@þ—òq>@êbÓ’Ï•Ð0¡ŒÓ÷°0ã ¾È01”™¶D”©ÓYwRßÙH[ .ÙØ6Ô›"g½mÑä*÷]£k)³–°IÛ&,èUîƒíø´ºE%n°5e½ÃŸÄìþ’ÿG"³Ž3u~6mýXš`{'wÖÿà IlG¾M€½hÿÆ‚ÝßþÇÞu(ƪQPPPì+þÿ_¾ÔmÙdÝ’Mî‹Ü²tugC•Ø½`jû¥AÞà¬DìÁ®4•¥V£©d`Bé˜0Ù€ k-6ƒ/4'\ãΗ,ÔÒçáâÐ-qÛ]nŠßƒ®¦Ì»)©½É¯À8ó§`Àfûk¾˜"óàJ&m8BänÞ¡Y6ek¦¼ß¦˜w‘aÙA°S$,U¨áàz.á:-\ãAM”Ì p#ÁÓ¶‡Ãƒ1èOQW÷` +ÂHÈ(CˆK¨átбÁs{€¸µj4ëIdkíI\ÒÛÔ©G¾­²ïÿ_°,|P?F ÑzÅVHÒŽë…Xs›‹$y™«A»ŽÖ@­Ê–2õ\'’/üHH·­Ñ<ƒa )Å î2i`ªdâ6†Y1À€¯¹Ý° I¡mQ/V,`Vw©~.B=þUîÄÐÂM¿°»ÖN‹•—°«2xX€ë_öxÐÅÖ›¿ +<Õ‘ì„Û™PÙW9s,&0ÏŽXhÌó•û¿ÀêGXG»Û9™/ð„•š@Gt Da¾`þ=»ilÃBДe“É K•î&ÿ³Xèæh=è±vGªcÕ¯þ‚pƒ¼Ö´ÁÁ(u„bRaæö ä¹Ò_`!@øq‡v‚š7,Ce>Ç„;Eó¦d¿'¾ðo4ÙU‹±?‹»w*|8o€rºÛ¹ÊÊË Ç-ËGÛw¯ªý ºÌÊ—$ª|…Ic“38˜7Cc™ `þ¼î †iþMkÜÿȾ<ø SøÓÿëX@üd÷#Nlg\U#jëT•Á]²Ãógª†Øä±Ùßá¯X6ðUFÕþè=ÿÙ:¿·ýOâ 6ï1+/Ð9I‰±šKçÄÆs¬ïAÙ„¦‹ð^££ßЖ˜u$v`ú,PÎþ,ô;þ9^@·AÄW^`ÚÕ5®oóƒ0‚뮙سµ ñ)-æWRÓ‰½ðÝX˜ªóÒ4ñÕ5£û£XÀ|\!v^øç°axs8Ø SfWA ½«Aá±àZ?Ò‰˜‘‘¼ ?s–^ß}Uñî'±à3Æ$›v,ükX·ÙÛéÌ èž)#ë‡ñŒÈƒËÜ+tÀ€Îê%>½úTOâ÷aFɹcéªë²m~ ¯a +‚1ÿ~FAlö¶[/¥¬vÀ…ÎG,´½ê¾>ßn–/z­}’òŽ tʪ·`ÁN»Éº.XÚ¤u qr(ùD¿ICÙ±p½É¢+Š‚ýóXøÄ?ØÀ×ÂûWÞzñä/±’yù0n”Ñ/¨Á.̆\¯)M>w,üŸÚŸ©³}Ÿ½`—ã¹F»Ö>®öt9e†¨lÝlhv,ìXø Xè'Â[(FÚï1IÊÑIdºµäÓ×Ùö²(Šœ5;¾ ©-£Úز?žh”ŽÓè.Éå÷ìoüÎÁرð/bݪ¢)0²ë +\ò‰Ë†Ç a€KY°eúDZð—â }@S;ÞvÊ ©Q¸[àœX•/¼Ðü<ö¸óŽ…·ð‚Ï«s³íw˜ka‘ ¾Ø ¿`/’=î¼cá=¼ ª©Ôž‹~$"¨+°ðÏÐ7šN)–eü¦úv^رð‹°@æ=Ë€üÖèp…?Aþ3=Ø-%23NìGã EàyçïXرð4š/°€Û’¡<âŠÜH øVŽÎļXפPñ=³²jZ­FmzÿÖ?'e8»ôžŽ'‰ý=ýN¨6ÑKÞ‹…êObAµ|xd‹½ìÄÚ~ŠÔýÐ湧VÜ»¯#}´ã1•ÑÛÚç,ù¨‹lj¾O+t‰(“?ˆ…)7-V>ÁBÌ¿éJ fx¤[eh±µu©9\qôÝ“jv© ºÍƒ“#z›:v®yëÎÔ˜;•¤ÿ è\~àÞÖ»‡™£ÿ®Ãñ¿Ð>Ä.°àgCàa½ó¡.îâ…$BÚ}ê®ðSüÒÁ¡XŒ8¿V¡Ð¿ ‰ÿG±ð¯·ùHXô &ÖâŠFò/ÔØc˜B3ð+{Á %v$X4‡\YqsÎ ÝXð™„?¿É‹¼cáŸà…À¸“ XàÎäóè^À­“ +°ÞqkÒÞÁ ¸/k/ø„;” í×¼ á…Pkñ­µ…w,üÓXè?Âͥ%ÍÄI%K“ •ðs^À{°^U.\»ñæEÇÏyw¿ÂE¸­ð®u|Þ^p>ºYw,ìí¶ŽdóC† + š-PÁÏwîýœl¥Ó kô‘Mç¢ÜÆ 6{·äS'Œh¤OÄyÇçí…oµ½ ÉÞÞÞ&šB;õ8]`¡ž±0u7QŸçC´ì¶ó¸/J‰©ú|œm¼Paè{«t0ƒ__t|Þ^X±ð“Wý’šïí'9¿çX¨a–öy3á¾—­H¶Û ¶Âø@’’Ú}‰·Û ¸pʹ-¶¹ìùùZ{aÆ‚øÉKÜÀ‚ÏEÛæûŸ7ÿöp“-ܨw>#Ã~¤N7 äù„»æT<ÙîGb¢õC&Bü©ü¾{Þ^(ʬ©ëŸ“µv¸ŒÏ~Äh¢’íÞÿ'ù S¤5jì¡âJû‹øB`4ôàæŒWœ6_Ä\<"±;‡šô{â þO^nŸnÀBÅƽ½»)¥ü/°à'E q A9Ýt/øSÈzÀŽÑ•XÛç¼à'} Ð}ÕEÙ•ŽÏÛ xôþ'¯¸{ ÉŽ…Ÿh]Q¨X&Ÿa!M%égbö9/„MR|š÷9/P~²äoú†øÂ?€…~¢Å-îé(ÆÏí^ ®¶aá”zèÈ?ß¹ú {‹Š.ä/ÉGb£Úyao—XÈ?‹/ø©õáÐœW‹3Ç 7ñ‚ŸÚ[[´|Í`*Âd/V'êj¾f0õ 7=o/ø¾w}¿óÂÞ®báJÜ™‰K‹·â›xéìâ[ÎÇ(®ò¿ì|\ˆý¼½ +Á…ãöv Wò‘ä,Po/0}™·Ô{ÛxáÆ€}W|Á‘[.îâ+­Nÿ+¬Ð?¿Šá³UÕRÖC¤v^øòBRP‹Ÿºþ²/c¶.sïÙ¹xôÆë¼ÐѱP¾/×ÕÞ˜s7wìçŽy¡wA,îsrD¹±e>Ò,(•æy+åfÈy¹2(Ë2K •Økó²ŸÅ_yðv¹ñÇv^øw\ª!ÜÛ(ºÌÁ‹z,ŒÜÞO$ÂP¨‡ÅþJ°´,õgììÿc|£E1å-î#ćO êN <”×x!3š‹hòs°ä©í8 –ãáˆÆ9lÿ—å#mÀ‚êt,ä=‹ JèD WÇÎi,që3#Š™0Êy]usÕµTí¼ðÏ»ksŒ7ãM„÷=ìÖ-®Á^ðL¤RC]íHCo—¼èPÖÆ™jQŒ·QݧD¸éé<¢¥ù’¨Žd2ÒhWµÂÁšgÂsµ’ºR¡öðó 3¿*ibø%}™,™±Ðjã¹nÀÅHuÛõέô³FàêÀ\ã×b«9)Ô«bOÓxU±”ŠÕÎ ¿¼}Œµavj¡=†‹p\ÝSÝaò6`c`~Im*®J¸ÄB123”tèU€Bï $¦Œ'kŠÓ8pUÂ%/ Üð®‘íÌR +5ó4sÀ–ñ³bί^a/¸mÝæ¹wÓvVT—¾RŒé,XȦZ÷2öCÝIå—ÂjI€tB.U  +¥”v1¢ÀᆨTu½Gw^ø×° Dâ´lH> À"E!,,eò‰Î‡\Xà5vt:è˜&Ř@x¡&ó=ØØâ’ln8Ø šcGñ´œ;N;âÖ“¯‰/Èø¶+3D@Âc§¼ÐÃŒ×5YÌâÎ^«°àøž½*’(‰:íà…#1„ã0Ê[C0®±ó¯5®ä`øhfÜóÌжmÕúƒFXà僩µu>bSø|îPIhµ;edÅxÁîÌ=1ÍÛ6¯3ÿ/,XH4™;FBòT.¹æ'³å#mò!±V[‹”ž3^©¯tç†W®”+Š¢ó8tàœÒAÈHxEÎGG§c¤Ó:Fd¡Úyá·¾ëä™É€::7 +4 ‰».bl¡æ³È¦!Á}¶qÉð%ð¦;úXfŸclx¡±»‡È“dí»s7pñˆÉ¤„£{ä… +ó½À½KïËG’¹XÜDòÈ •á„SŪo´1¤P1zYKÜшPö%¦š •‰ÎïBåê"æ9\ +upr·~³é\_îïŒXÈA‹ Q7ÊÐÓ ×ðPêxR:r„œbä€K?Ö@Ã…E;o' ÒÎû1ÜéÔÖHC@\òóÃ1/œ¢™2臈©¡¨uÍgѼ(iSð‚Å‚’'¼Pṃ¦±ìÂÚØæŒKí¤¹ ý^ù´!BŒ®6C*Ñvî´È–öj®ï¼ð´*³úªñaý7ë8ø϶õã‹­ñ…‹ŒN“—Çg&o­ åƵX‚W\øJ`ÎP÷‘”ീ[š¡Fí~*ñ ÷1ËHpÌRª8îSwÉ >~=C*MvL #€Ž¨˜="}‰½lãÖô˜Æ^3¦ÆW©C€iœÂ#sLÑb¨²á`<Ÿ5Fç¹è¤ ï瀅¢3LÜ)tº ;/|«,Æ®ŸÞðØwãØujÖqðåÜV¥Ç6Ðs;Óœ˜£ncn ÿ ®w-oáý¾æö~ˆ/Àç!–ÿ Ï0 ]dþ¼ÏõXñº·ŸçôZ|FtRœ;p[®¹/ñÛpظ9‘¾$¾psûíŒØ‹wý\wTrŒ)œsm:;Í°JÀ£tµ×QJe#úQz¦ö]SöI*º®`] ¶.zÝLÀ!#½ ;/|…‚žæ8MÉʤ~„~·è»JÍäjö~ØW:UN§¶báÓ:7ÚO×ÍûÞøÑTÊÀT²Ã«ÖP¿ÖóECÓ¨8® +ÀdhÞšVp—(–Å¿~ÎUBÁ^Ði¼óÂóM¶µÄü4Q’‰[¸ñ`ê)Óe–eåâ¥(£^—E +¦ßÜ +Ö¸¾óµŽô îè?Š…7æ#ŮЄÞ©83,æF2ä…ùB¶ö­rµi»fë "Zwž±¹îæ$WóVˆ¾0;/¼‚z°@ë ˆ:Ð ]÷ $› +݂Ū˜”l™vXêžI-X˜ÿõèQUg5§#TZWMYÊëXðçÝ\Üö¶[²ÛڻŠcfo. ]Çúkûh´[çFQ·…ûÒ-ì,(~íú…íùH1­9/;Œ§ƒ÷°ZSƈˆa™êã ³ï9òÑІʈ–*å”Á[-»ÆU¯à;³½Â•þÂ5¯9§m´b-C͉Yɵå…^Q¨8EGM†R´–ãTJ¹Â iVCÐÒÜá¢Æ("•Ê#îúå^²/Ö;SCðÃÚJ†znæô /yá‚ÿiÔår×[Áò9a'ÝÀ nX§¡ ØУ°‰M¯¯´)OUÉ5B.Ïbvü,—ðL4óÉÆ8†ï10%bLk…oÄc,á­^­i¬Ïð‚Mðè×<å˜ØäÇWóÓ¥ÆÑö{vÅf:ëu’\>”ÉžÓx8§³!ÖãÛlŸo^¼ßôùÈ¡e@‘¦±"•žyA×¼ÎÎ9b¡@‹yuŽH±P :Ãô Y“BƒÒ¤+FO[ ƒÚÖW9‡Š0DP+ËEW4èþ×¾熽àá7pK®w§pM8EQôÃQûœ@ú!œp†+Éó—Ú '`<ñÆouá©í.¼•9NG9õƒ<Ì 0Õhø“¼,VÉËê +þdý‡WQmŸÛ?eÐÐi‹ƒð¡r¥ºÔ@Êc§ªÊ¼î D‘ý vN{É~Ž ë9xùS§0'_¾]ƒÁ§'ïVeJox|ÔÈK‡Úãs…·òBY‘¸ç!ba6—©,®$òÂÈbZôÕÕS€)?Ô¦öºíÍ M¡i4(>ÛÎ`,Çf¬¼` @Æcª]{Ú# ƒÃ½*N¡ï{æûױЈ þS­'ãƒÿ±`ö§~¤ÈÌ;2öº"‹ŠSŸì´ö9/ø@@á +E|âåÚ}u}¤;ê`È&g…½û('iRë‡Øz·sæÀ4-…<ËjSeå1ö$>zP•åy)Lu´s^Èø€S!€ƒ+ƒ|‰Ӯ߈‡£d¯ç^#þÂ;± ÝøK, / +rÀƒÎ83/T>¯òF.¶³ýžEá /ô˜BCj†¡"L ¤À4û3Ÿj%8äzÍyžÁ]‰VÛ¹†7ª­ñ°ºÏA1Û[â +|N| ¡³šØ/ÉGÚÎ k)\?0¶Æ8lÓèÂaS׃ïès\e_®î;÷cl¬O=Å 2Ô—RSÊ{xÁˆî€MÚUÝ:3œ®aÁ,²‰î|s®$­ÇƒáVõ©{NG²‘_Þk/¸ +l”±[y¡šJàîØb!f¸2,zŸðB¬X%„+ Óø`/¨JH–4ù© |_PºSJØÎE‘jg®4¼‰ÚU‚Õ²‘ß™†ô¥iÁB’Ï<Â@Ïê^l/°Í9*2…¤‚€¬É<“©E^à‹ãÌEÀBwšñ‚w)Û2U…U-xe#D‹«äæ`Äc¼p”mMøQ¸oò†š†ƒjÇžŸÅReG¶ø€d7œ+-¸’ïBIŠ½e™Ÿ”ý"Ô»2¬À(+ê(˪O¼W_@[‹ÖšAì…* WÊÚ ¶.j³¦Uμà€yÆû˜†ºežiiÌäOmˆ;Ûß®—…6Vm_4wÌ©øšã ÜŸÓ´ç%•î¦»x¡6ôðÝð•ö‚wƒ~$Ö‚AuÂ?òH Ž—¾%5Ü[¸€…3ZuJÖ6‚ÈðtÐËL™éVö"ç…xUnêFà+1Üä«>/û×LÎû‹*ÉGÉ[±À±”Á*§ »P‘JÒ:œŒU¼°F+§ÁÕßË1Ei_„jÅ‚ÇT¼ü¯ÇÉ|wa¾â ,ÈÒªþ. MÄ +íø þô¢a®åÈëdì!Å8µlH¹ñd§s© +=h3ô*NÁ°ka¨#1~^L×t‰^G Z±Jmu¨›ý /H1ÀGÙ,ÈÍG i/”vïZ+%ÉÓº}o/€pŠ¡\ó̧›yaÔu“‰râ§Ö\6%›o­eoø¯@/^d\Õˆ ¼á-UtOØ ²]¥Ä\v|ö%Å7yE~ÀÒw^“±dÎP7e–^Å‚õ¸§XXT¤™”ô¼Œ{µ¦q8™ ØNÆàßÏÇ$ÀP ±Õ!:·b!´ºäBeT}•ŽÓ:óÆnõä#úE;ø]§ú¢èàow°‡‹ùäiætü®½U…ç©ôG¯ß¼°LÝ,$h× ¦C,oØ ’@eGeÚ®<@ étç[¼@A#ƒoû˜ú#ùH‹z*áúyù”C¯^¨=ÑSÑY^q*Ë ž]x0{Ã.t6µ$)9(©5ñt†‘ ×8ÒC¼°Jù¢¼ƒÍ>da¡nÛ vZ,V,ØE %U¾r*¯ù‘8úYzP{Ž*RÔž(IÇáò¬ˆ}Ü odÕ‚?²jä+\_ÎÍ~õ€0}bÅ6ÇJÒаñO¡Î‚>‡€O|Œƒ/l¶R`¢†NÙ’ˆÏ4Ò“²aÈóöZF4KšcŠÊ!4*çüjbˆÿµ½@íæâ½MÚfö9ÝÆuÙV^ÈñËÖõ™(¿·>æi3ÄB¨»!ÃM©qQƒn{¦$Èl;ô‡2Ä1ȼs8éD”” ^ÉŠ„ª×úà*|ˆVÕ/÷¶/”%ßæ…^JßYmÕûîHíÆñx5¾ÀÑ¢â8gT$w†D>/K*ôÉp = Ý­‘õ­ C½´6S§X€)zQ«†/Õ×ØãÅ-c¸¢ï>^À,îÔ!]øÐÜ †>‰/„‘ý@–…W5U3çÑš““¡ë¼`3¼AT1ÍÉÏP×éʦ‚Aê`/ø¼L8dÚ¬qÇÿ¡|$+j òBЋ”ýâGÒm2´Uë$qæõ>cŸFQxÀ‚#Àäf%Wp¯I ôÞuOù‘VѪå1Ÿh7Ät襵>L¾çŽYMD/®ß“”ª[9KD¥â‚]T9 ²;†çH‚Kvš¾ÿUÍùߧjÛÇHN¤í^!/„£ï¼0EBxÌú‘FëÂgžµ@Ä@M‘)Ñv`8ù.9Î>ñ=³cOÁº9¾ züÆpîÌâCnºîSÁ‹Šæ +?™K°„ÔÙp‡¨ñ§¼pÚ¸âSn9¼ÏGÔYö¬2a˜Ù³1ðc² ŸÈ"wÑkpÖ£§Ðzþõ  $«[y'©`í­À¯@Ãè¼à»F¨YG².¼ª?x{P¡—9XÓ23­µËjº\ôýÐ<îGRî×XØ_(m9ÌñBúRùu|!Z¢ ÃÖž(IС¾(Û W±@º{*ÝÆj‰ÝÄ6[Ù„lZ³¯l|'3;F†¶5«ÑžùQFéïàßåýí9«‘TÌ›«aRa|¡f=Ïã8üÔœ™{ #á,Ã"x™ XaOu9H§ &E.Ÿà}Ž… i/ «Éèåú,'KÔPð¯+/° «C M/¦ûjÖKp‡;åø^?`8ã]Pp‰mÏ¢ªÜ“]qÑÂå*È{I ÖŽ4TY¨MKWv-Ø¡J¦U)0w[æg—úæ…oÏÁ€‰2”˜Ë¨ºþdyíhÓõ:4Ñ.\x–pX¦ˆXïvzr½>>¤ô=g/,ï÷t´îͼ ×èæX»N{„CÊ°°†‘›ÅËÂæÈ¥TâÌrí:Gt­ÑOy¡Š²¥…'~$½ @è]y“…àNeš©1$%¢ï´n"]û€ÃÂt˜Ü‚ ÇÕtÖ˜Æ ÏZ$Er°Î dˆO±0úlc›“QXP›;úãh²¹cq†…-ýþ™ÍºWÖɲ¬ ‹j‹ß8zïã…EH—ô!å¢Û—WŒäJž*?±‡<ÏëÆ™}<Ê®IP1‹‹`‘Ëä€oÅï¼ ¹:U‘D £éƒGkNÊ"½ˆRÊ î"$ç>ÕtÕµ´wÇ͉Ñ%SN’F~§³Ñ ~ÆB$¤#FÞìEá2MñAÙuMèû%|»` vÜý*ÞøþëODZoï©ObwvìN°°í$?lÈâxsB=^¬k xàÒö(cÇÊ‹dUxOÇ–L æX/f jñ¬¾/åkºu2>älˆ^ÆXÂi†PÑÔí@8fJ¶„h«kXPþ:ˆØÉÀ§Í‹UQÙá‹îW‡$£/yá<à𩲕ǾÌÀ¸ÂÛ4įÐ C¯›xqà\s®fw+“M5‰©ö4%ð+ȤN‚ãñ>ÆitGËNÖ{v÷tŒ‚äÁŽ'Gìm]Â3-Ðmqr󶪥*ü ¢ #í…c² .Ðà"Ÿ£´žóçâÎ.‹;¾ÎÍ«WӾσ‡þ4ÖöÁê°š–Z”S,Ä+z%‡Ué‰?dz/JÒêܲÃG©?çOª“5OǸó!å5»ƒT‰sÝXˆ1]¦³‘e8¨#Å5;–E3"`¡â°ñrA„ÜIÚ©®Ùçqçÿ}»+ú*ÎÜwgu@u©ý&‹¾=»Ö­¡ŸVV:ÍÙŽó’=žä­^Ë8Ž;²Šãšd@ +âØ]8Îu,t«=‡ ¢Œ‹ꈅõ€8Ø_É·ãÇL>Ž§‘¹/xAõ‡vŠ…5c­ã¿Í³aª@Õ–F9`b€Œ]íF iWéÈ-t ¼€%|¬‹ ¾²ò9.—ø˜§ºcá“)(îgGÝê“C‡EÍ0x‹Îþ:¼þoí¡Ô¼ÓÏ¡OÔS]EE“|G;õúÕd úäýkX×,=R¨Ch@Ä–eÒê ‡ÂYŸÆ—O•¤u¸†£üìxŸò‚àkØç˜t †hó­aðýXxY¯›ÑÔ>†|"§BE¢cŠ·¼|ìëŠàâO{Ì4|ˆ—¨–'‹}ãϨ 7>×Bp·Ä: +2¬áÊ¥y¡Îâ8bèã.‚Ðq0 á;GG__GD7ŽÕôÁõ Xå¢Ymܘkï_ÇBì2&ˆ¸²˜ç «Å±UEÊçì ²¦ ¸†ÓçË|6ÄðÜNó‘V‹At›=Þ™N‹Ö»¥ƒè:­O狩Э´› êrSM ð°'^_ɬŽTwgë{–$ÓŽ…[šR­Kø‘j•ºBŸœƒ{xžWG:—ƒÈ"MTir·äÀÄÄ!šŽB·™Æ8ôð¸édN?ŠR¡NôžÓu›ê3,àþ*—³ûµX›EíúxµÃmŒÝ/ž¤Ãœ ñüòižêªî™të½QÝ`4LN0£Ô :ñ8å „ÑÅQ”ùÀ<-<°.—ý +b¡‰Nm½ëÿ÷-µÎìô>,¨« „š&ó“ Øx>pŒXhXâpÊi‚9 L¸©á²Êï|…`ÑåžÕõSu¶/O/ì{ñ±@ŽŸbAuä«ÕÅçXX•–´×§sþ!g68¤ŒŸû^H-•ñ{]IJy.hp²"½×áâ§Ã„ì%7/î<*çÿá¥*(Šbå._A' ½ÈmúcX)ë(½wgÌŽC©vm…fEVq°ÞöH36"W¤¹#ôKÞFFø +†©A}íÆE5}¼†ŠNÔ$Ð×V §òÍç‰þx¸P8âî4L|Yuâ ¥…/îR‡û´ry1qå‡<Õ/° Ï±p,.pƒ´O•:kÁU¶éÐ@¼›Á½„ƒÖ.K2’ºLÔýcX¸k牺Î1XA Ћú#¬?½^(t(ÁÄÑÚêQiÒðI³¿Â$¨¯.ïžÝ¯Q‹!Íëô$W!ÆØ÷Ev«9Xá¨./çX{%Yé.…®Ï*ìÍ_ phåü°Î¡Ê«ߊ•¸–WáÉ9©®:É^Àe°cƒsSa}Zóêðë»ó!™ ±€ÂÞݶ»/jàx…úË:Ò]9'& ±r°­)`8§_x»·‚ê\ª‡°©_x>:ÁÂè,SäSuó¤ì J‹þb NÌÖûÆ÷/ +ê]¾<KõIÝ<¹~sÛv¬ÌxZ?ÏWÐb¼¨§wYcïcÝ憿}j¼3·ÞÞ·£úLž]“öÛû~HÁû„äP#­½øÎ[)òt©£À"A°jgÏ+ŸÏÖX`.n@ „'+SGdŒqvøŠh€¸».MÜ÷_¸£É,ïGå]q‘w +&QÎXPc%DÓ*Õ2+ðÄ܉缰jA7_QF€(7Üc êbÚ¦b8]ÿö1é:îÊã¾ÀÂ}™v·rïé[gÜ9¦^w` ¸ÔUJf¼G‡ÍÍëpM¹‡œK½>.:Œü[Ÿ^áóW°Ôªû̺¶¿Ú°Œp¬H;j]5&ó=ÝFbñ:5º,M‰n,à +<¢».æÄqV1¸ƒˆ2=0Gg‘úV7]h*˜É¤«5©ï½øN^x ñ=Ëœs^¸ íwbavÍaª#ÖÅ“™cµÖÚ>ºïf¿:¸ïÔQi½cíÿÎ '>‹×PõºIBØÀ¥Ø›\“øqX >|  1µ]ʉo±B„É +kÅý)(e· +ýºÚ£¦eÊÖ*>Æ!5ÿ}¼¤ƒS„Xê4wïægÈ:ÇŸh;wóB0÷íëÁI®àè[yá`CÛyÄ.#´kw¾ÀÎyGWí¼ð€’4àœ^t:•¬åŠ7 ÄožÌ &Uõ |[§%½ÐM›ÐS7.…5 Š”‹ì»Pùh/¦ ÂÔ4Ôr.ús\ˆJ˜LîÂBc¡ÉàNÚý’“ ¡ýBóá¢|Øm^€ßƒ}•¹©ßÎ Ëõ +ç²³O6ÃgF¸r϶)Pkxaç…û°êàÐé0,Œ"ÃR8•³Í`ÅV^(q§žŠƒ½€Åû0*È0K$ÄÝl¸-8#j–Ø6µeF~¼Ô›â çX :œzÀîOžç÷ñö•\O5™ì¿{x‰wšžR »T°á…%…[-³þ乌ˆÚâîùY·ÕîGz€ˆAAâX-2ˆYÎq'’•J¬5ÙG^­¨æ±ßGÄd^Û¶´´µ|ž¿ñÝñÙŽéx3B]H†{±C+È$ ,õuç'9ap¦Žî™4ÒêH¸”aç…ïÃC#õåÞ…[ì…<¬µûP>ö-¯«·Ù ú†?•d«HhcÔ+¯ub(œ¹Œ„B^ˆQ­©à'®hýVàâžÂònVGÊÉûµííûí +Ö-ümXH¨•kL‹]DRÑd#/$´_û.òÎ(ÛÊ …í‹u“—Ï}7~?/€’”ƒµfyAP€)@†¥v#î: vBžãž ˜ÀÍÃmNý†Ø¨Nùxí½½ q¼=ÖÆÄ<£'lE@ø1â{ÁÍÒw=^¯éV^ ÍÅq•~" }s³{+*)UÝÑï§ +ÇU}7Æ4}}îwøTÙno©—²óÂ/nÛ± Å¥ÒÌßÈ +N¿·òùP)»)å…"Š²²tZ’x’ƒ=Úd‹ó=^d<\³¯/^ŸÚÊ¡ÍâÉÞyစ¾Ÿ±ÐƒJ•HìåϤÀ +ë“‹øS{AuÌbûÎILþïögõgâ*/ÄEb±  +vÑ·ë’“!¶Çî_ãù‚ðéZ­pç…ß«#mÍÁÈŒ® ~ƒ1î)ÇI8¯<Â& +zr:{ÿ½Ox!Õ&,,}kôUy,Š Cãåd‡p>áO˜7˜‚¡¡ƒí›’QxÚý­?õÄñíqç'¯³Wîë~9<' oCF`XD2í8™R¨½@øJ]iº½‰¨¸b/PSv¬í+œIxà¼pLà‹¡‹°Û^"ïj蘬°/:Vs öB«Ý@78D¨£ïÏGzÚé7Ž;/üj¯ìæ¸3pÊÇ]ì).4*ÀpžaÓ“Øà•¸›9¯¯òBÆ“©yƾX0E¤ôWº³iØUh·zÃåWxÁ“C[ƒÔóÖÏÐwÔÔÞˆæ³ÓxèÆÜ•§ªÔÏM?;/üj,ÜŒ;³‰ãÔ+Ì{2\MSiôÙ)ÜÁ ô‡E­»¥#íí'Z…§ûÖµÝÀ‚û]¼´èŽUz`…ȧÀ„~ÎÙC¼ðËÚŽ…ßÑÚûë`$=&Xb›2½æjoá†N+?–VÇ‘v·`éoä…7ÿ@7Јe–¦lÀÊáýý¼0{+ÙŽ…½]ÅÂ=u0–©O µ69CÅho£½€¥…§<Ç +GSʬñrVmû+^p % #a‚XðÑ#åÚV^Hm™å`ÇÂÞžæ…L‡E®ýØèÀƒ©¸0ußžð¥½óÉ3.ÃÓ¡ViÖ祴¿à–ø|5: æ@É×Ø s|!ܱ°·§y¡Ìp~ÆzQWáÉ4ºÑ^èt…‰¤±ù× ý‹r»)Y±à`| )}À´cao×[PfY™ÝUO•¹in:…¶³«%æcO§•M¿ö#EFŒX†uÑõ gÛýH+‚¹ZŸï;§‡Úyaooq6È3š X葺EþŽ/¸«?vº³‹5£‹’ª›xÁ=nØÉóööcXð9ïqa›ÂüPO³ó±ƒb+/bRYET_lSµ…¼YæC´~‡á~^p[lôßÅBŸ•‘ÿÔ‹ò¦*ð¡yeù´¿ +2>9œ‡·õ»aYºß‰…QÓÔÐØ4v;…È.|N7Ú !:‘j"Š‰ñË®6ð‚ó:ºì¥›ûyá÷µ;±€'Ÿ:`x;¤tEÌÓ×WicèÓ²¸ý<†¹*Äwò‚ ã)-¢pÑë! §•ç¿â… çXØÅo‡­²² îã…Ò6Ï+ø¬†ãªûyá…øi,ôÿ.6ßgrTÑA»'ƒrA¼:emÊ1eÚ¾.6Ú Q¸½•œ|áÞ>¸<³ÜÎ u€Ëv°×àO—>àGúç±Ðµ¼yRGDs/³„?¯#U¼îŸãžó9ñîºÆÕ¿wÆ1wÚéò¯·ñÂ’| Ú¸:?Ü•§êËG÷åù·±0O¿ûÀ¥ +çiR©§Ç¸ç<¢»Ì…öþ:Û·®óí|¤„¶üê +¢yª_O:yÁgØ’ Í_ÆBz¼û± ^ˆ… yªŒozš>àhÛ qsííX¸ Ñ?È `¡ÿN,\±óŠî3yþ~^ø÷ã ;/|'nêH1ÛÚ5é×’)¹Ú7Ö¶ŠÞ|ÜøÏÄw^ø,„uUÕ•¼…±½éóXrxO_qž?êÞ×7Û±°óÂXØvò{ÚùüAÛ;ºÍY8´¿§o^± ;/|7þWÍ°Ñ ;/ìí×µv^ØÛÎ ¿‰pË1¥’] w,üy^ÀÅËvyÍÞv,üq^Ø_ØÛŽ…=îü?l'ÐÜ €œò~,¨?„…=¾ðs¼à¿™Xžî¼ð¿ÆBÿïòBý^^˜âáŽENž·y+w,üCX`OG +Š¦æùAîÃd?ì!†ÿ3¦‚x?€…ð(-O’Þ7Bq×Äá†a˜Î¶¤›ÂóÀF(> íʵÂ>µÜÑÙ§6ãZâ³ÔÞFfŸÚcúÁáiⶣyÉq4›ÈÝã³ÐÒflŸZ]ÍǘG+Ž£Í¿«8ŽfO(ð£ÙÓ+{nÇ32°ù?m;Ãå| ?Æ “¼Kƒ&:l¿¼ Áyr..1àÓy¯Ø£zÞ®ÀŠS6oðdaŸZÕµ×øÔ^_iŸÚR-óŽóÀv‹DnE¶´ý¬P§ö©½­îq¶Vú°Gø´<Ž6/Q¨Ž§iOhÙéùxš}¶£öi…kLUpñúHÝsÔ_ ýa4ø')Ùmï,gãnÿ± ß„…9û Å ÌòËobaFVzyÄÛ†m±~…fúmí‘ZaÝð³äîcºõkj“«áÉѽ' [ˆ|É ã‘Š;xáQ,ÜÅ þ ì8Ú^ø?`¦ö§Àà ݽ]ÊÊÉÏŸCVßy"i¾=ÏóB÷<®ëH¯å…îÄ ÷…¯ÃkT˧};w£Òi·ùV^ø`/è“þ/X£ð)0÷Û Mó0tσáÎÉ6jÔs]o¾>¥³ƒŸºþúÔµûN=>÷ ”.~Ã^OfŸÎžŸ“Ñ®l‡˜7>Töñq4KC¾}:G³ÇHèáó G[VÇÓŒ/§Ùÿ_°0QR¼ Õ‹J2>ií<€Êæ÷M{{!&÷~=çÌ34¨ŸCñ,ª;eÛ¯£]ÐþÏXxDé?·)ïCRg/y2v^•÷1{:°±·_Cÿî-Rì¿ ü9›!©ëûÀ ‡pµÿ3@éjí‰sw*šß¾HÙÉÓôÜS“þßX0<•úÝÅXë¼ + î{Áð´Åþ]ME‘Ãv<°€ã7ƒ!úgm†{CÅð;w£l Ñ·a”þ§RîïŽâ^¤ywO‚!¹×­åýŽ…ÿ3¦(ª{u·ë]’iÞ”tÏ!¿Óx Éo,ùÒ1ÈG,<áº/Ÿ $=à'-^UwðIkgŠïõ”F¿rÃUíU™N°à‹Çgw¿~Ê™ô€kˆ’à5¿½yÒöP÷êkeµcá×óB**¯ÀöÀe)ŸSƒp Ñá5`ˆžµÃÇ;ÃIUîXøíXÀó° öv,<”}ÑB⧱p÷‰°_˜±cá }תë»îý¼€ lîÖ²^ã­ @Qw _ Ù±ð]Xér2Fò'<…ä_~TÎîíîXøÕXƒ6z$šþ ºï—Áß‚«VÍ{¥mo;Þˆ…V©VŠü„½ðÇ°úݱå§n¶nÇÂ÷cÁéj5Q]ìXøöó`ýØ#üëçvÚüx½ø·€ÿswÇ°À³)Ðã一ñTÉÕpŽß#\¸€sæ {º;Þ ü:Lþji6ц¡Ža @@ -25266,6023 +27082,7042 @@ B ì²Ék§l"°ïFÄ2Ña9æ­Ó»Nè¸I5äCœ§˜ØÕZZæ} )í!Â2œ ÌÌš4Vµ9|•ÏE¡Uغ¥EÀ¸´gßrŠ©FKåŒ-ûÈrò$Eâm]‡Poá˜v1ôûÊØøYö=Âh¹ «>´íIØ5±< ""éIeÛUeC—=e˜_:„H'6 ¦ÝJDp£_ù½oC}“À¨ÁiFáöþ84jmá71<ìO0Ò.|Û§S(By¶“ˆû6öÃ8{ñ£ü_‹iC¿O•L]È-<ä}ÆœÑÙ=µpvOûü˜31ˆ7ùû²‰Ê¤Æ*ò¼4ãfCCÄG»t$ûÌŒ5‰„H‹lûQÑÔoï -«Ñúc¾ÓÔfblå7´X|R¦Q ý'(«R’‘‰Ž#ôü# Œ¥I,&9¢^â&xÖyµˆ`ãB)™0à±½…–v)4˜Jì.ª GìHŠ ˜¦˜.áL&b|ƒ¡ÿÀ¼“5þ<¥åŽeÙˆ.òÈåa+óìMÅÜÒ°´ªÈ±­²q­vŸSÃhx™êÊf‘—m;µs+ŠFÂÒOA96néYn3xa ÷>6Š6ôî4 ¢.ŠF8cî8½(mkÌó:*G;ijf+h6Žm;yIÂ2šE¿ˆl@çþ,’°ÉÇ¡Êãv´ì'O ?êÇRÙŠ<„ÿ|Ršüì†ÞžòD8yãŠbðòÚCØ‹>j"y@[P’¸¨½¶´G«EÞŠ°vòl€h¨„ÐÈv›¼ŽÓfa_ à9JáàÝ©›@Q÷€“dqÂ"¶K£hCoO`õe8¤a 0(ý¥Í1¸ƒ ¦_‰` ‰Sç"¯B1‡m8ˆÆI¦±ÌäKJ~™I/Z4‹]†%á;x>7“»s&j»%…=dEkmèí‰ -ËÇóË_3€Ú6xbÓXa5´)‹6l³¦µÜž¸ÙV3WQT”mâBÿo'uÛæz\02¾±EÔ/VÔ¤mmåFцޞÜqð±i̦~ñ41’QØ83Kª S•ÁÇ€ÒÊŽ‡˜êE…ØÅy£a¬ð3€)¥”ªu ü?¡ñ2¥DÄ ie2ô_/ÌóºHàþ°>çZeñqà}d®ôÿ–<á"endstream endobj -5783 0 obj << -/Length 107 +6126 0 obj << +/Length 107 +/Filter /FlateDecode +>> +stream +xÚ`ŸÿFFFÌÌÌšššÂÂÂõõõ666»»»úúú%%%ñññ³³³«««ééé“““íííýýý¢¢¢ŠŠŠ[[[ÕÕÕ‚‚‚ssskkk{{{bbbÚÚÚáááRRRåååÿÿÿ¡ò;Pendstream +endobj +6121 0 obj << +/D [6119 0 R /XYZ 85.039 781.388 null] +>> endobj +6122 0 obj << +/D [6119 0 R /XYZ 85.039 728.534 null] +>> endobj +6123 0 obj << +/D [6119 0 R /XYZ 85.039 728.534 null] +>> endobj +6124 0 obj << +/D [6119 0 R /XYZ 288.958 110.371 null] +>> endobj +6118 0 obj << +/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R >> +/XObject << /Im30 6096 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] +>> endobj +6129 0 obj << +/Length 1834 +/Filter /FlateDecode +>> +stream +xÚ…XYoÛF~ׯÐ#D—˳@4Z»A'+‰²ÙðPxØÖ¿ï\KÒ¢äÂâÎÎÎÎõÍÌZ-=øSË$t=.ãD¹:I–»rá-`çÓB Gj7 ø¾°¹¶»ëÈw½ ¾È#w¬c•º:PÈóán±¹ñ½¥ï¹Q¤—w«H”xn’„Ë»ý½›«uzÎmgv?VZ9f[¬”“­Ö:Š¯7·üQÖðë9ûÕZ9=1´«ïw_ïΤ_ÐÒ[®}íêØÓ„(ŒÝPé© *£¢© ~¿Êš Ðˆ unV cfº¾ÉPÑuSíÙˆY•}óT€{ÝUýEô›*Ž<¤¢ +—ÊsS/¨&‰«ü”T¼ÍÁcÕ”òÓĹ5åÊ-ÐÌZ¿CdžN÷˜5²Ì-~¦NÛaq„EìÔMÇû Õ ·6öc‚¡(²)ºo^èåkÞt=^VðÎM>a»=µ]V¢G€[! ‚Ëš.Ý÷ *“í¿RŸe Ž¦%ñ;¸£­0qÙëùˆ‘ŽÏO8×gt°cz‡i…ŽÙíÊ{-ÓºG›—¡ÓWhà /(¤¬%.éŒXÅçš^¤O$µÙg{¦K–£á dºMtk{¨Sç%ä¢dÐúŽ¸–²«qãiR²æ’/L‘ÐZ +éàšÓ-£éø‹üR—rè9ïУÈ&µ¯ÂC”ºo`Åe’©€°g‰Mv€Ô£ìï«íÑr8¥Ù/uJSIRáÞÕœ¹Œ2¨gn˜¾² ÏÕB…ÂUCð¥ü†wŒv}ÛbÈêêš",àM=–«`âÐõ½„ôø|/D©ƒÞ©;þ¦œD·1[Š3é??Jœ¦ ŠèÄeºC+Ñ«edÞvMŽ¡í;4‰Nn©¸˜æÄË3x¢0„^‚%€õ1QîãEipuâÅ#-8}E@Sse)%E)2Ïìç ªŸ=Ì]†±,KÁ×$I¨¦TBƒ¸¦!„©@·AwäñA7‚/8»XN Yn%T?È*!åþúη ˆhÒ €Ló<ã·A‡ž¸*ãeõpO'æþhO\ݲ’~±‚T‘ì4A3z¢±B +Ù!ûÇ:ÂÄ-¹.#¯U‚Ô¡Dq P›C·ù,þø{ó{N·ôR<Ï*Áç¿>ÿãZ+üØõR¶ân•hÄ6@Ïé±Äë –‚àŒny÷U«'fŒ]½YN>05o´yiÑ[˜†¹:¹|¸³®$ôAlRÔhÙ3º8 ¸P C^‰…ÀÔ™!¼ ðhSfcõR~©b…ÚO§CË +œ­™»N6¨‚`ʧ.CÁ¨š5UnPD.ÊSñ¢nÃý¹ªL>D(;¼*72$ÏAÆwmWt!1U¦Ì†¬ôaxÂ(‹ÜìÅ €*²w—\RsÒõƒ¤œíj†l~ÒršYnìÕc^ÌSðˆK«Ûg¬z—í¯¦,—{™Ò ñ8í +éwX¾òê—+=@Ç) ÖXà.î¿{Ë=ô‚/ ÏÓxù ßž« å‚q-ëbq»øs:Û*7Mõ¥N¢`(q8wÃ8š2œÿ­Ç÷7‚áæ‰Ô â+ÍÇrY& ËÇL¾IìØÜ•£f>ð“'ËÉMsu„çÔ9“D›‘kçîãe‡-y«Çæ@Ã×ü‰¨„||A×ù«IxßÖ9U®§â%Üíêû÷½ÁÜçÝ÷iÖ‡ÓþVJ,I}}Ïúÿ*GmÆnÐÓIfRo²q{º¬£Á=ñÌ{+…ÌyŸ« ¶‰üö•ÓS—ë.Bd.÷¹Æ—àhàIºÑå!‹‚¹¯áU2sí æG8\]{BúÔ¬:M¬ê ¬jÖa´óCx¤EoŽv¾Ü`KÐÙçyÊu¬‘6Ý·ÓV<©PÃN­hOAË ‚€xÌiR{¸eÉ0óSc‡ÓGí_wlÎaa4ÄÄ‹#ŽuÔ‚ ¦ãžW;&P}†_|ñוVŽ›1=AÄ.¤9‚›ÀФ ø¡›&øo Ô‰g8f{åh³3”Gæ¢4µA€2ä!TÓöa¸¶áÔbäF<¬óƒÔP¡óÖ~ \’ešÌyÅØ™¡àyœfnîD¡×Ûm~[ÓàÓÆf 7êßÛÍôI¶áñAK«El÷-p²1;S¼æ.àø–LÉ1|¤_ 8? ÓèBjqGEÚa‰©ƒ¦T®`·#èæ;Ù?ŠéäéFÖ{võh†bsD¤=I~éÖØ +ØêВ›xe˜}ì˜á4³ógy6-×)Úª±ŽmG ã•©Zfúf‹±UdàœxCp‹&Ôç†:qÃD_¿ñ?^Ë&endstream +endobj +6128 0 obj << +/Type /Page +/Contents 6129 0 R +/Resources 6127 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6125 0 R +>> endobj +6130 0 obj << +/D [6128 0 R /XYZ 85.039 781.388 null] +>> endobj +1902 0 obj << +/D [6128 0 R /XYZ 85.039 761.463 null] +>> endobj +3094 0 obj << +/D [6128 0 R /XYZ 85.039 657.513 null] +>> endobj +1906 0 obj << +/D [6128 0 R /XYZ 85.039 657.513 null] +>> endobj +6131 0 obj << +/D [6128 0 R /XYZ 85.039 615.228 null] +>> endobj +1910 0 obj << +/D [6128 0 R /XYZ 85.039 544.591 null] +>> endobj +6132 0 obj << +/D [6128 0 R /XYZ 85.039 502.307 null] +>> endobj +6133 0 obj << +/D [6128 0 R /XYZ 284.478 383.02 null] +>> endobj +6134 0 obj << +/D [6128 0 R /XYZ 85.039 260.551 null] +>> endobj +6127 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6137 0 obj << +/Length 2293 +/Filter /FlateDecode +>> +stream +xÚÍËrܸñ®¯˜#yˆ>T•ƒV¶“Ý8eǞ݋ã5CIÌr†Ê²¤¿Ow Áç8åqUJUhôû òU|•(Èt'œÉ$Ym÷ÁêvþzÁ ÄÚ€¬˜_6—ïT´âKƒtµ¹ëð(*¹Úì¾x7»þ¸yûÉ_K)=0lj÷ÙçÞÆO¤wí‹Ä»ñ×Üû;,]ÿ‚Oïßjè?ÞÁÒgýüo~‡u|ÿºùíâí¦å¬¥ \¤ÈÖ.¾| V;á·‹€É4Y=ÃsÀ8lï/€/¦BiÞË‹ÏÿlQé½p¥OMiÁB¬A’Xˆ1¹8 99 'Gä‚ÕšÏrŠRš0!"P7S±r†¿-k<‘LD +Ž(΂´³WŽ…,”B½}½f{Tý#<•9ªâ&àêÖ_+åý;'[7usÂý’í[ã]åôšó€C!:_¾j´$Í}H~åƒy½eÇL[¢É=ŽøI4߃EM`±þAçÃåóñLŒΔH§ˆ ÈAüÇ2$²œ²T¨Å¡â” .ÛØ°2FNPd8¥c2„šð~=lÑÖO;;‡ÿ2Š¼=„±äÞî©ÌëÉ-ºiÉ!2“@.ó¬b¨Y¼Ç3dgŒ•Žg²÷xæGÆUàeO»¢™cÎœ[¤ßÁŒó‰ +SÅNä¯!±ÅW ú¹Mx1hÊăˆÁy*½Ÿáâ®ð1Ñ¿ÚÃÙ–âOû`­×ìAH¹}ˆ¬~%´Qu¯·ï²mQ‚ìí¯~z PH§œ“óUYêÌQ`N7ç«GJÒù1k +Êõ†|v4'5±{ŠLåW3jÁb.ÕìÀšCîGŸüÄ¡¢AI£hãAÄ•,´0#ŠýrÌ!(aÓ¥X? ä3"†œE|Ù“˜ ÐIv"(N‹èPÜV‡C¾m.wEÝ•øƒ)s¢C +Q|9ñ80 ¢ “¢/ìDPœÝ¡Hx4¢VXK_M!|¤ÐÍõ%mó¬É/¹ kˆoº.O«G&¿ çXR3¯ tJ=K[õ )Nªg@1t:«ÝqO«¦¬t×qy´mÁ¡í`óË'|))Ãü ðp³›çT¥,î:+ö·¹AVêó0˜ž^šŠL×Õ"¸Ž{¢§è!’ÈMqm.:´ž¿lsÛ6–Ì<æ·Î;#10€R˜²º7ëXqñ÷–HWPx±O„–+„¡-鵋ƒBŒÁ’™–ú¹íßq·Ô-£ÝDýÐß#è­’hÙEˆÁh¤‡`«™îL7&8ï¶/×Ú0´î*Ó®RçPÊ#…ÂZQ;ÌäfâAÛ,‚1· ª‡[™m¨EÜΑšÏ(A>ï ç½~§ç;ʽ”hdÂÖvck8x¢ùËR¼µÉ_p|jr{¨Ò‹¶UÂç)hIÚ…Û~Y–PQŠµ‘Üü¨û%Ý# _ÇT ºÄ™b4ð=fÇ.M¶#Eqk¸?zí>èäî[<-¿×mœ×ÔZ08Ú̽­Žm|/5wÚh!~Þ –Æñÿtåqð¼Nr–ÄÝÀ 7÷( D¾éS6!ó'tÕÂ'ò‘ŠX¥&oa ‰s%Vññ-ŒqØÏ{Lí¥PÓ×]nòõI]¶ƒGc¾¯Œüz ß°>0¼g' +¢)†GŒËŠÖ±~±‹wj%¨Ëò;j'Èš„Éìt«3ì:ýd ‡5ä Ànk„@K͸…„®6ú.‰Z‰ôÞçß|)L÷Z…\Xq0ÿŸÙ2ŸBÆC1Éç›¼É +*4µ^XkÆ‹[½n<;ì̉z_è{_õëèïPP=ûoæ’ú…3‰‹–ay­3Ãÿ•§ð4`I:×'Gœ pqL$i¤‡Ä`Î3LgðŒE¾D ŽÃ_78¶´ùÿRÿ¼i›}›5•Œ¥ÏÂ~ÏÒÉY,­Îeè8‚æ==aèïõ¨Ìg Ýa:‡¡—øj íðE†6Å|ÆÌýÝOΠæî„ÞGlmh·mÉŠºnèæ!£Z3syoçêø Žs¾Iâ„çDÐÿFz”³žÓa:‡ç,ñÕzŽÃ×Ïô\tüÅýàãxFh?9Ý´c”BfìZ;g Z‡tÆ`=ÖÿÔ;É¢˜/Žÿ\†LÁð¼t1Âü.л‘æ^ä.ûÓ—Ú‡¶”alþØÕˆFµîpMÝŒ(ê;VéãC~ÜÏ}{ Û.-ú¼z:˜ÙÛ‘Xµ1b.GxÒ¿Õ·7c<ÕC> õð²µ! ?Æ5Ô¬ÃaKá7+KýÑŽ†Z\ùTé9°‹aí#œíX ++úÙ¡¨2ˆwE7ÀA7WtßV ´!jôØÍÌð¢¯í‹\”ãylæ|Xüœé¯¿ìã VŸ?ê æW‘rú|ØÙ·ß‘Éâps½€*©p´³Ã…fÛ²ý\!ƒîsEaìÝoǹFól©ŸŠ;¥8ÔM¦§t\Fyp™äÁ…Ǫw‹RëåÚRÓ9µ{Ù€ Ç\§+º§hôØsæ‚.`sŸýN¡ïJÝ»d‰œé +‚[^Ð\0Ä ùU²i"Ç ÿb°endstream +endobj +6136 0 obj << +/Type /Page +/Contents 6137 0 R +/Resources 6135 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6125 0 R +>> endobj +6138 0 obj << +/D [6136 0 R /XYZ 85.039 781.388 null] +>> endobj +6139 0 obj << +/D [6136 0 R /XYZ 263.114 764.647 null] +>> endobj +6140 0 obj << +/D [6136 0 R /XYZ 85.039 601.529 null] +>> endobj +1914 0 obj << +/D [6136 0 R /XYZ 85.039 579.213 null] +>> endobj +6141 0 obj << +/D [6136 0 R /XYZ 85.039 557.451 null] +>> endobj +1918 0 obj << +/D [6136 0 R /XYZ 85.039 557.451 null] +>> endobj +6142 0 obj << +/D [6136 0 R /XYZ 85.039 522.909 null] +>> endobj +1922 0 obj << +/D [6136 0 R /XYZ 85.039 369.425 null] +>> endobj +6143 0 obj << +/D [6136 0 R /XYZ 85.039 337.609 null] +>> endobj +6144 0 obj << +/D [6136 0 R /XYZ 85.039 239.448 null] +>> endobj +6145 0 obj << +/D [6136 0 R /XYZ 257.152 245.422 null] +>> endobj +1926 0 obj << +/D [6136 0 R /XYZ 85.039 134.586 null] +>> endobj +6146 0 obj << +/D [6136 0 R /XYZ 85.039 99.84 null] +>> endobj +6135 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R /F62 4047 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6149 0 obj << +/Length 2524 +/Filter /FlateDecode +>> +stream +xÚ¥YY“ÛÆ~ß_ÁR V‰ §ÞV²”ØqbÇÚÄŽ°$v‰,I0¸«Í¯O_3¸¨\)ÕŠs4zÝ_ÓÐ+þéU)ßd«$Õʤéj{¼ñW°ó§-!ÙôhÞßÝüñS¯´¯2?[Ý=t|"Ffu·ûÕûðçÛŸî>þ¼Þc¼ÀWëM’¤ÞçµöîÖ©ñn×Aê}Xo´÷Xº}£>2õ??ÁÒgÿõÇoÿë8ÿíîû›wN2w&H‘¡Xÿ¹ùõ7µƒWøþÆW&KW/0ö•†íã È¥¢ÐÈüpóùæïŽï…+~êš"“ª(5S5èèŠ"_E~Hjh÷ {ïâ§Þ_òó²ÀÑid^‹[ ånÔ=ðS ãê_¾ïÒ˜ ´×0U~‚…ïï{]ÐImU»³ÞÎkáó‚‹´Ýæ÷Ž!)4‘w·/…¾ÁÕ¼-<·óZ ßÛW:”Å M)ÒÏ8‘×ã÷Aêêò¸Gû27u •cB~3:&/åáÀö?YÙ˜qÍ«÷ë ƒ“j$vû¥.á¶u˜ÀË…i»—£BƒCõ($ÕŸ¶ré`ä´)”¨h:ø%TsàÔ™Šâ¯8VGCˆ +`W«,ŠzˆŠ³`ËŽ¾dœ‚µ¢È÷ÀÚ¯[6áu!âL«ô+BôhfaǾòÅr·h܈DªFh°¹GP‘íCïP> øX‘Õv¨ÆC!XûeoYÈ3¸K*/v¼“©^e÷Dþszâé6'œs@ ²å Â#±Ç–ìg…E<ùFqn;þ2˜úÉ ‡w Ò¶’ß}qÖâ¯ö0r^~;ÄfÍúç|åU\<5,_Žü“Ä«xϽéT{¨8­ÈC^%z-«ÎÀä±d™eê ÆM~”QolH/˜9¹ ü²»ÀàÍÏ}ãƒïI˜7<©NWTð QìH{/â2Ûêˆ|ΰqi‹ºQö¹ Q~ÆÏ}FóŸÏôÚUÍ6B_ô`²ÊÐXèÿŒÔëS&¨22JT?Êa0|ÜœRZ«Ôþ¦/g38:/•y[ÄèeÈUº:„ä¢6ò/¯fx b??Í–AÜÑ̃XhF ~fL4ý¦Ö +jƒE),ÍDŒ!†ãDép(Çw†Œ À%!L £‘ªOí2ë¸} YÒfKqCAÅÛe¤k +W™/H³87Áì$£€O'ÈÀ2°™îÅ,— ‰TŽ@Á¸¨Ú½€<Ù$ƒ$åêLyf óP‹àBÝÏH/u¥ß8˼¿Á‹­Rñ™~š&n]Q7`NN×È c6>‘óÓïºÚ÷\é‹j~ZwκXUg,|^™ò¸ò…ÇpÚ4c"=Š–S¶.ÞÌ!/Mi,"¿G3‹|K3B~K¯pÙî'˜‡ÛU˜d‹ç[š‰CÌG‘ÊL8`9nûébÜöÉ‚ø3Ðæ7ö¢FL·ÌÖ2o—·r•j,ãêB¡ÍOûu,ÔpÇzXÙBIü$—²½õ°ƒÓRÎ&c^+fIР+£bÐÂÜÍVµ\RØF˜…°ÑÉrAÖ£™‡‡ÐŒàqÌ¿4‡þK ½ƒL/ +ai&RŒâb¬’0ˆñ©”D±×wåRk™ äJ­~tð$<ÙQÁOÐõærÄÿ{‰°æM*æ€úžî@m!ç5œáõv€Ô]ÿ+àZbu åbMK=9Š"§ •!¸E/ŸŸªöJ²åJÞ¥R¼PW£Úów‚Æ$Š‚å’°G3 K3 ½ð—-ºÇe7M”© +ó%!,ÍDŠhB•AñÞㇲU!_î‚0î:¸ÈÂeŽ®ÄÁ%R?\ðÇGÎÒ¬À±\r+ËLHú÷ó^„©Í_ÄvÓdqaw؃˜Íw‘3‡@Å~<ˆ!׋¬Ç {‡\F0ªåŒ×ÔÌ[Æh•&ËÅVfBóûàûJ§a_ˆåŽ#„Ó«ÝÆå´,«ŽJzçq]]O¯œ ¢pQ7–fràµi ?ø¡b¿ÎK©V Ô#˜ã Ê8¢ ôk»Pò—Eã:ŠÙ¨Ë£¯ô1áéêvyæ’R8['åèQ. õ¸3ò–Ag*Í⫉M.&F8`Ãцº³ë†|-¹àÂIŒb‘¿•ˆÙk)º½;ß°-Õ>ÇG +W]$œuÈh*0ËUYfÖE,ÍÈENTF<u×€é$ZJ/Ëai&‚ŒnÕ™‚ØÙäGÌ8|Ã& ÁÏ‘?ì´÷NšÃXs7ø!Âhï;ÜÀª;°%uEF–ö’ÓðœÐßkäÉ —Â"TÝ ‰>‰`mÞ]Gb¬²(@ñÜÉí€ëŠpnVε—ƒñbg·G3Û^ ä«@ÚË‘´—OE›·ùáiNytQ„Žf¶¹ø¾J’Ä5—ÑíÉ4vQ-o{yŶ^lÁ~?à¶jc;ÿÕ†ú¥lÚ‘Ž‡Í3¹ŒRQ–K„8íFŸ$Z:ØIè¾Ót 0ùÆ-¶Î\ú¹”{Àµ.èíîyÅÒùnóÇbÚADvýµaHªk×+YÒồê0†8±hÑŽ„ ê¾ßúZ…¾±län™L…«öN³$ãã†aBÊè \iÃmÕUÈÍéYÝæ¶ï™K‹ÀÖ°ÛºÈÛÒ¶Ÿ,Ô-ECñmu¹·7+xúDýÔ ÿí>\7ö}׋ê>B%§Hìo^„3ÆÐPp¦Á²5:šsÑWí±p`gщ×-Ò;ûŠ!~€äŸfoïI¡/Í\=bŽC«mu’'øCÛF>f°Ç¢)q<·âÒ7·\úö‚Á=uQ`½d?ÊL¨é^´ëdÁF(®sÊ@ß–:ꃘÀ…K]SÆO\]Þk«ðÅ)ßíÝËÀË/mu˜á§«×£ Ù×,œ8þ¯ÏÝ8pãOÍL5P j+ ¾‹ññ¼ö³øDàÿbendstream +endobj +6148 0 obj << +/Type /Page +/Contents 6149 0 R +/Resources 6147 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6125 0 R +>> endobj +6150 0 obj << +/D [6148 0 R /XYZ 85.039 781.388 null] +>> endobj +1930 0 obj << +/D [6148 0 R /XYZ 85.039 719.568 null] +>> endobj +6151 0 obj << +/D [6148 0 R /XYZ 85.039 684.823 null] +>> endobj +1934 0 obj << +/D [6148 0 R /XYZ 85.039 260.296 null] +>> endobj +6152 0 obj << +/D [6148 0 R /XYZ 85.039 227.875 null] +>> endobj +6147 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6155 0 obj << +/Length 2060 +/Filter /FlateDecode +>> +stream +xÚ¥XYÛ6~÷¯0òRˆ¹¢nçm“&mÚôʺA¶\‹¶„èpu¬ë>ô·wR’¯m"‡èápøqf8óIrîÂ9OBáú«yœHá'É|SÎÜùf¾šI£±4*ˉÎëõìî]Í¥+Vîj¾ÞŽvB„þ|þê¼ùúþÇõÛ‹¥ïûŽçŠÅ2Žça!õ"ñû…—8oKé| ¢û×8úð–µ?½Ñ¿ûáËŸAŽ¿_3{» {ŠÂúcöëïî<…#|3s…¿Jæ»BÂt9\" |ó»˜=Ì~Lñ\0çU×¼`5–r%V^ø¼§")‚È<åÁl ü šz*tEèä)pNî ƒ•ó ÝðENYÃS:i_Àñ5δ<¡žTŽ2õXh”ÄŽÆŸ­> R¦}ËWf×gÑ:„^†Wâ,=¹çu–#¬8Ft€sÓåuÅ‚ ÊÊ«ƒ‡ P<‡€sZÑå0¬v,®·ü|Z„pΕêÞد;8?‘bðZ?y1ø ´‹ÁO ÕeªãQ†ÞB,OøŸf$´ŒhƒxO¢ºíHšòhØJk<Ê:ü¶”!ùaÓ7x\,ƒUì4šŽŠ'M5ŠW<Ûe¼ÅªÄÅŠ§Þ|zÀAät6ÛºaQ]ik]‘ùÚس +ªª­ié4<÷›ºV$vv+?tòŽ'1 ø¤YÕð۹ؘ(™ž?XÑùKŒòm»'Þá®æ§‰B~@¨­ÖtuʇŠ?È&ùCây$,‘ î0"ú·=§íT§KfDز\qÔCx½!´Œ’” nEN: }ÄIÉ`á¹ÅÅç<®OÂViËOUM„'[œm‡Û×}‘²ê 8Ÿ—{º3cfâC:½™''ƒ,‡ã]Fg?äfk2T:r‰q:¥ñã•Ê_ƒøÙÂ1ª UOŠÞŽ¡nD®Ñ 'UO:K_è:_*ô5åB}w«Þ[ÏBunÖ°0Š$,?üðê|; 5;ö£AöÉfg4>Nv¶Úˉ:míO·>·‰{g]·uww8ĦmE§ŽEÝôB§ýÝ߆y©›»£Z½mïò*ÕŠ}¶?RÈ$>|ÞÆŒÎÌ« +\‘„¡|}¼ðøXFrÐúÿíåDýrãs›¸ó[j®júÅ—¹¹€ù—Î<`uþÈ™%Â%xžwRhÞc] ì¤Ã dÃeÌÜ<¨B)Ë?¨‹«€:=¬:Nl=€³{ØÁH«€.'M¦=±¸UX¨šâhö¯Q½Ó\·G X7–¦cÀŽFû7Wc =š&XbðVÎûî?•Ð$L¾ëäuŽ¦TL ˜Û₺dÅDcòÛÈÉ€¤yXƒ¸ + €¨ ëÒZçYcĺ+b¡3‡ÇKYa§+Ýä\öÐøݧLaF, ´¨(¸å\9oŠÏ hú‰¡æ †çp=N¦EF¦™:$f~DPµ= ¿ÌP–μþøt|z2‡ùO6¦º¡—–„6t'®ñÅ{KÓ‚È¥ËƯ)e]Ï<Ç MÅ:eÉ8€0qvBÔseß#¤ój±Œ€¼S&Ôå´‚×r2£ßíôpÁЫfb¯º .Èô¨n0š[”x¡ó~ˈ(v]fß­PDªÅ(//ïyVó ÞRfP5š¸·jRfëH÷M}òf¾î‡Mˆ¬¸µ ¿­¹Ó +™Í‡CfBuÈ[:ì4|ÜR5yåŠÅOï®Wf¯›½ì:©ô Cñó/Æ›î˜M:Y‚ë‚û„¼v×ò³ôY£ÎMÖæ{‰L<ŸãµVï?òÚ‰úm^;Ý{Âkë½®TÕ夾кîÎAy ð,/<uæ«såª\)ü0"$-¾RÇðJ½|j)}ÖÓÐãZr…>“.Žõv 7uµÑCcÝž¡y!'6 ðë–Ù G/Qš\ar¸¹¡ÂP a<|þ +}¢'¹žä6ª[bd VI¯Ä—U{ —oc3웸üŠ +ÏÉgüé Oüyçcúº(An‚E-S¿Öø~šµ\ÓÈ4Ÿ Ï ëÌl'3íÇt§®ž\;kå>®oÊjrÿà@0h{ª¶5ò“¸röë)€¥hXŽ¥3ÅÆ|}ÊémÜʈY÷¦Ç‘Ëá2Ÿ:ló«LŸÊÛIÑTüµçìóˆÑ|´_`üñòëÉZûùfér…·ºvaà;à}jOà‹Ä_]¿t¡ #-t¸ï†çxC?aâ_þåêWdendstream +endobj +6154 0 obj << +/Type /Page +/Contents 6155 0 R +/Resources 6153 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6125 0 R +/Annots [ 6159 0 R 6160 0 R 6162 0 R ] +>> endobj +6159 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [113.74 564.53 442.184 576.523] +/Subtype/Link/A<> +>> endobj +6160 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [101.164 537.735 164.157 549.303] +/Subtype/Link/A<> +>> endobj +6162 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [113.74 325.034 281.822 337.027] +/Subtype/Link/A<> +>> endobj +6156 0 obj << +/D [6154 0 R /XYZ 85.039 781.388 null] +>> endobj +1938 0 obj << +/D [6154 0 R /XYZ 85.039 761.463 null] +>> endobj +6157 0 obj << +/D [6154 0 R /XYZ 85.039 739.701 null] +>> endobj +1942 0 obj << +/D [6154 0 R /XYZ 85.039 627.47 null] +>> endobj +6158 0 obj << +/D [6154 0 R /XYZ 85.039 595.049 null] +>> endobj +1946 0 obj << +/D [6154 0 R /XYZ 85.039 387.974 null] +>> endobj +6161 0 obj << +/D [6154 0 R /XYZ 85.039 355.553 null] +>> endobj +6153 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6165 0 obj << +/Length 2240 +/Filter /FlateDecode +>> +stream +xÚ¥iÛ¸õ»…°Ÿd –I‰ºòm¶i³hig‚Ø] ²$ÛBtxuŒ7ÿ¾ï %ÙÖ8@‹Fäãã»/ZZþ¤ùŽðb+Œ¤ãE‘•V+aàä—•ÔÊ÷_)X/nÌé&p¡ÂEÍcÊØñ”DœŸ_VÛ®°\ág½ì A$œ(ò­—ì7Û•ÎzãûÂþº–vQïŠ:{¿Þ¨(²¿tùzã¡ÝìñØÖi7à%EÍGiÚ uß­ÿxùuõ÷—Qœ+F  kãzŽºwµ üÐñ¥7×F*Ð/˜kãð•FÒGÅöǵ'ì<é‡6G¹;Ö!©3–üç¼ÎRáÙÛòkÒwEœpHDé[R8±ˆg"úQäH7&ëµÙ}~h“¾hÐŽR°‰áûåéñß¼bAañ©ƒ§(fÛt;gèWð€´³iQ7)í§þöÇ5"ðÿpdP·¼T Ú¹¦^6#ÞJ4©Ýz„s²œ>N›º+²¼57´ºQbp²n?›¨| OÙ‡–B¥ü ·žM1_äC„û¼mà†fèøBÚT§¡§8<0®Àí×¢mPúÊ€"t!í›– ÊÆ\ï‹*wŒœnèˆ8"9_Ž9F…«¿àZš~°å£=ªA(P»¢GæßùìLà5½Ñvd—¹!èJv+®È­¸¸u+B¿"´žÜŠÕ£½Šÿšöã:˜Úæ€Ðˆ òî.d¹ŠÓžÉ %eƒow…g”F9IÏ><›RKØ=ã:©ŠjÎ=!¾"ƒœÏûc¢oÌm+ÍñÎ\¦åO•³ýŠØ®b({å=&í'°Ç. i“ê)XV¯É·ñÚ}ï8+œu9 'Ùðt§yàÆ`$D¢+:¼³5É©’ÂL$¬Ü*³qÁÊÍpbû¼ÎÛîXœø²9ýQçÏÚÄ=iI2þ%߀~Û~4+?—QæòÎxeJ Çó±²!yÕeO¸>Çh£= YÂ"0 +•-ÀAs†='bìôuÒ{ QóËK'ªRP+Í°kJ5¬¾Œƒë©zOgLɱ‘ènŒ… +BV)W'Ö†b`£ÕGÂŽˆøs¡¾"S\Wg`ÄK»dÚ$¦œ"©ßO(pj½!š –“žÏÿ…€Ï°ÿ“M“²ìÞá:²?—TÀSÐÂÃ0e•ÅžÉsÎöŸ*߉Ôïn«Å¡š™YÁµ§¤¢Uh?çík‘š D¢©it¥ax‚JŽ^&À“冒9[~ùGI‚ô†BŸOGÒ§Y]„'¼Qæ›’Ç5rÔ#é2ž]¨¤;OÊŽ!h>ÅÍ·j•hÅQ/cO¬ Œ¡•úzŠÊ“S?kH.ˉMÚº˜hü3g®â;m6º4U&åiŠQÔ%$Õ>Eí>_PtúÕ)Å$¨TŽ]‹JIÏßSËN +íW¤¨%}7õi:;_^*Æn]ë\<ÀŒ•½3¥mÍy‰Œÿç×ÏHØXâÆ&Æ’–PΔ½Ô¶qè˜ß3K*Py¦!ˆ¬–3&;ûD#éuŸ™©{ÿÆèÁÜ‹ûƒê ‡¦@˜À§ò*…t”ðFB¨ ˜.¼æ'EàDPÀï1487/ +º”®ãI÷‚ãÃÀeš­]¤¦^yº^-5ªtÖª%eílü*È]ÚÞ¿ _¼œ†¸ÿŒN|ø`ù–Y}åDBÝ7ë„sǬé‡f½Ãp2ëÇe³Î8>fÆ¢ó mMm K[³¡ô¨úôü Gh¤ÿ¼e%ˆÿP÷­4áܱ’Fú¡•î0œ¬tÅqÙJ3Žú½Â]kœ3ž’°Áë¢Rùõ¹{%}²KðŠlŽyÆ8¦dê®}¥Š§àsUþ\ýö‡°2Pé×t((gX GƱU­<Ç =½+WÏ«N*Z÷UöToìøBå5`±l;=îw,?5=ÔãXpÛÐàž¿ieÍøxEðDìDæ,K7v‚ªz8®äŽÉ¡\9ýÌSëá“Þ .—7ø"Œj¬[z§Ö0Ÿãè®”=²5Šðj§i©›Á‘iÐC—ôjç¶IÃÔLž’±ö ®õf—˜ß–¾-D(•P¶x‰Ù3> endobj +6166 0 obj << +/D [6164 0 R /XYZ 85.039 781.388 null] +>> endobj +1950 0 obj << +/D [6164 0 R /XYZ 85.039 761.463 null] +>> endobj +4123 0 obj << +/D [6164 0 R /XYZ 85.039 657.513 null] +>> endobj +1954 0 obj << +/D [6164 0 R /XYZ 85.039 657.513 null] +>> endobj +6167 0 obj << +/D [6164 0 R /XYZ 85.039 615.228 null] +>> endobj +6163 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6170 0 obj << +/Length 2977 +/Filter /FlateDecode +>> +stream +xÚ¥]o£Hò=¿ÂÚ'¢s@†}›¯½ËJ“Ì]<ÊJ»ûÐ1ÄF1<Ùܯ¿úꦱqrÒi¹©®®®®ª®¯žpÀ¿p‘%~ òÅ* }•e‹M},¶0ó‹P0–‚²tp>¬/þþK’.ÂÀσ|±~é$~œ¨ÅºøÝûøÏ÷_ןÿ}¹TJyQè_.W«Ì»» ½«Ëeè]¸ºþô3Ï~»ýŒƒÈ»ù…Ÿn¾¼¿ºæñûË(ó>â’7ß®×·—®½ø¼¶ Ú­™¹û~ñûŸÁ¢€“üzø*ÏÏ0ü¦ë `ÏOb%ßû‹Û‹YR</xÕœ0 Æ2ÌýYA6®XwåKÈ­j̆½KÔÖFà8£ùgƒÛÑ¥.™®Uf˜ùô'Û?éžø"…µ]!ž u%/êÊ¢A1s®Ô’"{ß±i W3’ÙhMš‚@uÁ#2Uøí_ºÔ¸’¬¶©þ£Å³¤Àg×Þ“ÉÖFÖÛz;éGðô½ÔÈD‚êZvãæBü˜'ÉÅqé_ ƒ;5‡™B#à¢2çL–,4’‹[JÝIë:Fæz37‹8° …šï6s±ònšPl+>ªÞ Û¶B ¾’›¢ZF?ýCž+Ã; Ybö?ò$Š=É©\·’+*U~šnEŠžëªÒp”±q– Ã9ÖNhÙÊ"Wãvïðâf³:E< è<@„"8‰”ç[þµ:Dœñ̲[5W€¶®r{“ÖëÑ0þH3È jé\]_ÝþMòÕþ8¿•Ô##¹×±ÔX¶Í^Z3lè?*®ìjÇÍ:seÑš#7nQê| wýaÏ‘¡Ì[nùÃÙ>UÒàyÝؾT†€[q5O²ÿ;*¶V +P«é̦ÄReB(1 6 ÎÙ&Ág¦ÕDÝÈ…¸yÖ>’1Œ®ž:*/Þʯ1:þj¤önÒXRÞwì­”Ý c™ë9&HÒým÷,²Â ˆÄBx´Q=2é ȘJa,`›–uNV@¥ä¹š9F±pT‘âƤ@觉£ wÀE­"%¦²¤N¯ò>°CÔÜ®„}îÜPŒåHÕßeòr-–,6®í;¥úÙ¸Ãù(“B{0Ý{.m±ø8ô cn¸W?>»á IÝÙÍfå´THÈ+ÍB“dü]Ü‘(? +âH‚cã ¿‰´ÜÒFªƒ~dý½òø"PTsIøéæ |â 8,:jæä‘ŸfP¢:þaË(ÓîKêƒyǤÑ7íã/gwˆ¡òys%(&8S­xkÛ0ïy/óÛ”ò¸Â ŠÓ«Œ ÑaÓI(e긲¡rž¸á®ü, §>·Ê®æŠ±ñSðpºqè¦iϽ!ø´¦ ã9· ˜¦HWü ¡mög½@ê> endobj +6171 0 obj << +/D [6169 0 R /XYZ 85.039 781.388 null] +>> endobj +1958 0 obj << +/D [6169 0 R /XYZ 85.039 761.463 null] +>> endobj +6172 0 obj << +/D [6169 0 R /XYZ 85.039 739.701 null] +>> endobj +1962 0 obj << +/D [6169 0 R /XYZ 85.039 382.411 null] +>> endobj +6173 0 obj << +/D [6169 0 R /XYZ 85.039 342.247 null] +>> endobj +6168 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6177 0 obj << +/Length 3038 +/Filter /FlateDecode +>> +stream +xÚ¥YKsÛH¾ûWø6TUÄð)’{sìd'³kÇ+•©šC[¢%V(RCRv<¿~ñh’zù²år©îF£@Ó¿ôèÏ¿Lc× ³Ë$õÝ0M/› ïrE#ÿ¼ð•cª,ÓχùÅûOñìÒ÷ÜÌË.çOÃ:±Åáå|ù‡sýëÕýüã×É4 C'ðÝÉ4IRçûÄw>O¦¾s÷áóÝÍ?dôÛÃG4çË'!Ü|¹½ú|'í«I:טrýåÛÝüaòçü·‹ó^À~k&ƒt]üñ§w¹¤“üvá¹a–^¾PÛs}Þ\xn…Ú//.þÓ/%cÑ¥Ì:¥Œ8LÝ8 µáÇ'´{nìE¬«å’N^tE]ѯ)Ë×I9ï&Ó(ñœïE…C>‚£Z- +œmC½z$Î3È˼=t 4Q Ùu4¶ÎyvW, /ÏlmÞ<‹Èa.ÓÉÈš×ÒŒú‡®)Ûwµô:pèÌ{j–»ÕÊ@¶2†«Ý—@™úPXÆ'´Ó ‹Cݺ*UHç½í÷^îxÁô™ó_/ö¨?Iiu0ÁÇPì´¯mÇ«n¤)±Ô¶©±Í3¶Yæ2f°hw¤°?FFXïæò‹[©7,&Vªt‘“×äÅ^eò=.<>}^™ÇÒ*WèÓŠÛ-iåðƒä³$sæPW ðÕ¸ÍcQ²¡è®mëòÝ\¹é„ÒÀ„¦öݹ~’ýÛ×jyë†w/þ.ª•ŒlM˲¼`¸n–"æ>òíä¼ý ¬/×+9æÓÅ`¤Ë7¸Ä0’Ó±aw ™‹ŸÞYš\Xd±ºé䢒_£\t=.f—bLýELɶÅ;„u|Ñ•  k½cao+˼å¹g0f–ùn:‹Þ„ÉC@£¾›Ai=0Ìf‰ëe „Œ¡K› ãØsæ“Œ{zN³¢k˜†³ÄùÖÒÕŸi¹Iò¶D=ËY¤š…‰è³@ F™óXÀfè‚Lì¿P¹R(ø­›•ã{°¼k÷zØSÙ„A àT<Â7ý³°®Á˜Å|x(~Mk S–õ†/ÅûœÀÈ|4w‹n§V„­Ä«ÞŽløe]ˆ‡/ù¤ØË«t^ŠÖ’ae»¶»Nßî>ÿ®LbÐ?ÚnäãAêMXEöFß´tÉQ0Û|U3o ‡Á4òœZ\P$è±ëÂ:ÇÙþ V6j™oKRg?äh±«³óÙ£´v@º[׌® K‘[eùWBel¦I|CP¹¸Zä³ûrTÂrŒs¬ƒÛ°.êÌ"/ûôjÑä«Í¡ÃÄ'-ÚÇ\5¹éJЧàQl¶eÁñÄ8Øø³^™hÀ¦®¢íH.4­µ‚©›/]&[‰YÊ[ü.í 1æó”×^74®º¦–êúGoõ²£¨œÆ‡hŒž‘ŽWô;xÃñÑ?›@³®\Ët„óªª-6â<Ó0Iì¶y“«/ZáÆB"ð½b€£ØÃëžUGv˜ÿÜ E/‹NˆßÅèÇùæÙKv:;«¦\E0­ôtõS +]¬¬“ß’õÜcÍA«KIElÐfM²eæ}Øöçª^Hò’ˆ=ë0ý8-IØø4}â*݊÷ ­Î–ƒræf¯eä¶O§šº­Ÿ”ÿ±÷+~eÍÐFp§g° ýh¤oØ›ÍôÐ#Œœ]«„ï=œ>rk)ã–Ï&­PŸÞ×´ 7›Rðkdätl¦­ØÍ5„Ó q©h䨱$GÛ½k¦±·ìOÑH«;;c/¦’aöfðñôá¢â% %í˜s^ä'ÀÞj²ŸzSŸ=~—yŸê­ª\™MÃñAæζ¹)FàQeðÅÉNeB£(‚ä7çy¼3ªyŲîA5¡`_1l ‰´÷þÓ,<òB—œT%_M(í£Ìf¹æ=-M-÷^Ô4ù†kªçP}h¨h1;f¤+(‚ÍSÐn5MÅL$¿æÁÕ‚‘šss¢=!u@£ÉÿÚõa¿Óý¸HÃ~M3SŒOI˜RúHí½l³N.…ÔûDüÌ«\b³æਠø‘RÛ|úî|Ðä¼RN[À1uQŠÉ6××T‡+‚¦/d³ÕÀH衤´¥ó~XKGFJÁ+AÇÚTU—õª·Ch?¶„šÀ ê ´!ߌvòËaÜR-ö†,¾°YB¡ÕÔA-Ósv\sj¤¼š÷Ã,ÂקLý-,ñœ-A()£¢`ŒYC "±¦3„\_É 8]#ĺoצ\‹|¹k,ÓØ5*>èôŒðºé›Â!F:.fú|7Ù«bôÆÔL¸"aYQ‡¡!çân^ ÇwÅ M^0„´ž…2Cô«r,ªE¹[ö±c¥@ÍÇ—º1•Y ƒâ.L:ö%{“@¥gÉ¢DqVÉز=ˆÙÜ]]Æ5Ls +¬X­£ª^ÖRMhÕ>SíE¡3ñÑúoA Í-û·ZH;®™ŽKÏ£ç¥ÈíÓ +ð)h.!‰v MRHoA¶¥Œ|‘ç W¿ÛŒ<`ùúþ'OG{[6º @‰æJ2Ùí!ÝîS?¸û•£ùÙò\ž4êfÓ¿V&¨¶Xiöi%LõAˆ“»‚“ ZâíÝXó—T¯"a‰·£÷åˆÐýËðf¤\j¥'Oήy5¡¨`CMH#v U)Äß½ñê +£ä#è³ãÐ÷Ïåö‡$‹¾¯Õ]0ds¦ZåBaÛÙwmÑ ‰ûáUw‡a5Zd”ê5DòM3z¾ ¤ž Øz‘Û3Ž«´÷7×ÒàÌ]OÔœòi†Wò~kaèEúŠÉéÆFó½3I:Gƒ)ëD«/xc}#"šYˆÛï&£ô5Žz<ÜHFë¡&©ËïÒi9÷ϱ=qÐÊlFp"ô£Ð ƒøÍDpÄs6‹õýØMƒl/‹ Îf±W‹®xÎ¥}ƒû§ÃâýUHüð2”gDÇ9½·¿ŒxÎæ°©ïÎRÉS†&iêHêVày>âe¥!TyyZs¼$–•|µ’ןD«³4áÏHcìÇ«á…-M÷^_%šaîKÑ­¥u+{Ê$È^?)T¥é¹ÄSIvO˜zðªôC`äDÓ‹_îÈ$m† Âí^èò_„,ß½:-ë²…–‚Сºu z‘ÿ¢IK½ã9’ÎWÄök´g΀Còé”äÆ«ßÌs¾µ’‚Ñ„ß@¾«{Y”]ä‘Cƒ(ÙÞ»ã¬W˜¥§>ãb¡›†Ùi7ŒƒÀ |+ .&ôÒCyíçþ#ÿë'áendstream +endobj +6176 0 obj << +/Type /Page +/Contents 6177 0 R +/Resources 6175 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6174 0 R +>> endobj +6178 0 obj << +/D [6176 0 R /XYZ 85.039 781.388 null] +>> endobj +1966 0 obj << +/D [6176 0 R /XYZ 85.039 691.864 null] +>> endobj +6179 0 obj << +/D [6176 0 R /XYZ 85.039 657.724 null] +>> endobj +1970 0 obj << +/D [6176 0 R /XYZ 85.039 505.996 null] +>> endobj +6180 0 obj << +/D [6176 0 R /XYZ 85.039 465.833 null] +>> endobj +1974 0 obj << +/D [6176 0 R /XYZ 85.039 367.151 null] +>> endobj +6181 0 obj << +/D [6176 0 R /XYZ 85.039 334.73 null] +>> endobj +1978 0 obj << +/D [6176 0 R /XYZ 85.039 143.325 null] +>> endobj +6182 0 obj << +/D [6176 0 R /XYZ 85.039 106.459 null] +>> endobj +6175 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6185 0 obj << +/Length 3178 +/Filter /FlateDecode +>> +stream +xÚ¥ÙrÛ8òÝ_¡Ê]Ѽ¼y<“]OUœìØ©lÕì<@"%±B‘Ñz¿~ûHŠTòJEF£ÑwvWüsWIh;~ºŠ×ö“dµ=Þ8«=Ìüãƈµ€¬G0¿¼Üܽ£•ëØ©“®^vžÐBõ’ýi=üóþÓËoÜ®}ß·<×¾]Çqb}¹u­ÇÛµk=ýòøôë;žýüüv<ëã{øõã‡ûÇ'îßßz‰õ€K>~~zy¾ýëå÷›ß^ fk &Eêþ¾ùó/g•ÁI~¿ql?MVgè;¶ ÓÇ Ï_¾Ë›ç›T<¬xÕ3B?±ÃÄŸsà ¸:vèÄ ÕÂi’ÀRØøĆ¢ò¾ò׶,ò +Ùñ÷ûu_fõ†ÒÐRUÆsŒUÜmkƉ`uQÁïžNÐmjDò­ÀÉ|²÷'ú-þd¤n$ÿãF[dö”"…Ø…„ñ$'À)ú†°‚ã\ÐÊ 1CqïÖ.²6%^ÇSÉT¹Ö‘~e+×R]QWö5»©F?ÐÒ†äâÁ¬k§a8’K” |ÖRPÌÀ†}ÐÏ0t¬'…ùQl=çÍ·bK‘õŒTž‹n{¸B›Æù=ÚF0Wu&ŠÛ>½`w8ÎDaïYó­A¦y4Œ¤‘@A]¼Ô³ê'<ëéù™u?Š–¡îrÕõMÎÝAuS(R¢¼%AkU ùŠÛ£¢ÑWþúüôøo^WŸ ­¼YŠNâpûÚv,ñÖ^ЉGăž—%)£Ñ2ž/ªj{s$Má±Ö(3a•„#òQ±*ÅšÖ/b ¾(õŽ¨ÀŠ*kÉÚ¼8°úV¸Í›#¢ùþ]Íí†Î(-©¶.µu  ;CÐúˆÞ.±2ÜÃX3¡[DbÝ£\¶Œ”6cëý-˜Š¡hæ¿jdcoµaéØ UYWâ€eˆ=v@ÍW˜p>­ïG(`—ˆŠ’ Ç4» ìä\Znë1B:¿f¥áa×#┨…KSà8\︅ä/Ìg`Î+ mn-“e‚¿;hwèX’K,òcªdB•ƒÞÑÁó#:†Ä…0Dˆ*½IGZªù„—­–xÇ;±ã†-ŽÂ¾¹.àæY ÐŽgDBÈN4æ‘ÊáÜœ÷™šÐÎß—6ƒ„Ñ0[’öŽxcH,);ê“14ùH€o[Wm_jŠ¹yz|æÉLuj3Ï2M <›k8ôχ±Zæ”d +OÏÜEa>ÌN|B5óM\˸'/¶ÈŒ+Ò€*t`ÿ:È²Ø +m8Éqwߨ㱨ö<ÆñØøíÚ6ô=ˆƒžh.®¹ˆ ´Jœö‘c¦Ù¤c”;R‚KqÓÖ}£wšáDgbÜ ­‘\6xVâŠgÏñÇê!è ÉADœ ÌiÊœ,Ô4 + öMÝŸ´æS0­/| l&$Ý¡¸5 auƒ2U¤ÓùÛ#„ÑLÅÐÖ¸a§ +cëïH¼GþPÜ|AÂкÇ"„ñ§n/ÕÇú–µº`íóŸøk ÑÖs2Tsw!›Ãa!Ày^8¦–º—Ô©UÛ­‰#C\%È÷Zà¿ÅÖÌ|¦£:ïyEÛ):¼j0ZBÒI@v.å)g…ð!«(k'žRÂ#sæÁ® +J¥.‚]àB×£ÐLþK;bJèÄWñf”3f㺙| µc_ˆZHžêdÒÔö,øÍGFìyp`,*ÚwHåÝ{\ÑÍoG~̾4蜽ƒÄÆ ­]A©5vs*Õr^ï.­øÌSO4øæ ¬G]ü>eÉ=‘uƒÎ… k•qOqCêÏ•@Ö‹ fLIr½cüÒTÌ¥Ëû? ìÐñV¾—ØIêþøBη½xù:n­q­GÈæ7'àÈì8ÌŽºŽêA»­ù4dúú†õWm#±ò’±G¶*TŸž…´ÂŠÆŽAÒ£ìù’33®¸~h‡.pÅ mˆä?Åk=B6çŠë'vœ„fG$umps6—Žh iÄQ×] + ¡;Ñ%?tØðÑì(¡ 9yT Š«öˆñÊø!-˜š)æp¯ëM?ôL\‚ùŽî;*^«ä>qúvD§°¥T 3ÕùÕKÃ;ÌÉÅe-±ç ØdÛ@.#)þ”Dä{C’Ž]²98mW_#Bµv! )¤ŠyÒá-9 ùhˆÌçä`²“!ÃGÑ.¦r+0º™5îÑÄ5Ÿü%pè¬7 ¥ò’è5y×7bå&1”U‚žØ!–’B.0×Ò¢åâ£RèB¢‹·•·…NºXÊ1Ô¤ Êe©âFäýÊ8X ÛWž£äUß\á€Îô²ÖÄ1<¶[Ç”É$±Õ£ Ùð]6VJ÷a:X/…´ü(…oÅþ=UJ aˆ”$zŒdÄÄ*Q²º¢o-isÌta…EË Éiu/ø8MR¾™7wSÛs£•Äv˜F?çÍ×z„lÁ›{ž$‰Ù™sqlj%\á0Þ3i',|™ÄK˜VYÆðofèÞD,Wr1žÛHgìærdí¯¥ÊˆXKÏX1ŽXO¨*•¸8|*ßí’&x`ƒ Æ23©=I Ç™’J½/æʬšaáå5â÷.åFµ\­kø’ÌTJº…Ïñm×u¿ûB2‚¹úzãÆ1…ßñëM ¯7Ÿ¨ÞïÕ¦”Wœûž0ÈmQ,0ºˆt•ŠÞ}í’'ÌÛ+'pãÐ~p‚ÌÕ7ÒºP•ÅÃCm´Ë]íD9«æw¸“ܤ¥‡BЫR? ~­&S²J?D~Â7ƒûò˜ºN6…Áäí¿‡ŠÐlÚ®QÛnüì¨PHÑŒŠ%7gnKÏäìÔç¥tßXüoÔi>óª(¬ÕûÂÜi‚«/ ~Oíž%´\^Öm[rߎí´0Ú½2î K$x­Y¸ŽêÙö…5š ¾'WywÚPžÜcàôÕ!Ò—¶æ1•‡/®¦Y¬œâ uß1êƒâªE(Ù Nqf²­§‚,É;Ô6×û¬¯]BMƒ> +)…9$I˜ÛЪÒ8ó$UÉ»¾ä!­v´ˆ +ÍÑ›¤¾$Lؤ\Â5Àd³’•"Trž[¹Ñ"ìõ‚ +"Ù½õóÚü¬Ó„ú-:S~™Hã©õÀ·ÊŽÄéÂȬQI9Í‹}ÌJù@/NfLµ7ŽàSKMR A‹8M†+jœ»¸‡KõÛŸ<‹¥:q\&Æhnóf¯TÄ")XQ“Û7/Eœöm$· ª»*oÍÅ¡y×e¸Éí-'•WÞK©<—×*ýìÈÓ|Óýs§6ª +t& +Œ™^pÂ8º¿œeÃËo{×â™ïØ^º à?kÈOý-Š‰(,?](!$Kž«iA ùNzI¯þ›•ÁÿÒ¥Øendstream +endobj +6184 0 obj << +/Type /Page +/Contents 6185 0 R +/Resources 6183 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6174 0 R +>> endobj +6186 0 obj << +/D [6184 0 R /XYZ 85.039 781.388 null] +>> endobj +1982 0 obj << +/D [6184 0 R /XYZ 85.039 719.568 null] +>> endobj +6187 0 obj << +/D [6184 0 R /XYZ 85.039 687.147 null] +>> endobj +1986 0 obj << +/D [6184 0 R /XYZ 85.039 203.111 null] +>> endobj +6188 0 obj << +/D [6184 0 R /XYZ 85.039 168.365 null] +>> endobj +6183 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6191 0 obj << +/Length 3296 +/Filter /FlateDecode +>> +stream +xÚ¥ZÝsÛ6÷_á·P31M‚à‡îͱӞ{Ç+ãδ}€IZâ…U’Šëÿ¾ûÔ‡s77 ° ,‹Ýß®žð_xžÅ~ÍÏÓ,ô£,;Ï×gÁùf~> …âBH.F4g—?ÅÉyøó`~¾xÖ‰}Gç‹â7ïúŸW÷‹_fQy*ôgišy³Ð»]„Þ݇ۻ›ðìׇØQÞçŸxàæó§«Û;î_ÍTæ]#Ëõç¯w‹‡Ù‹_Î>.œ€nkfŽÒýyöÛÁy'ùå,ð£yvþýÀaz}âù±Žä»>{8û·[Šçô9sSFe~œE‡Úã#Úˆ?4iã±ÚÌÔÜ{‚&ôŠÙ…]ìºÕñW¿*±3÷ÌHàkƒï«ÜôU³ašµAv³$¾5ýËTÍ.`ÚŽN/>r”Ô(ÔfihºÐ^Ƹ¡!ä¯zó„Ç—5ïñ⪵i_™î¦Y:ô¯Þ Išº.[Ðdâ,V%-WŽOÓAA¤­½Üà2:buCÃ9®º"#\ò:4ܯ¬iT-Ž¨CÛä Å­#²Ôâw$/VYQF–<Ô›o#jÚõ÷ ŒÊܪFq¿ªµC ³Wo6,½D¸oñ2Öt¨¬×#Wï ®Ê)¶©å*øù–O¥~žùÜ‹SIL–Djð< ´^îZ«¹çÑl`ùW¦Ý¶lѨ8OQ‰ÞÇëÈ»DyhW­íš²' +­½&•$^çn‰*ï´!~á’úürkÖ>*ñ’©ŸQ–W)­áÓWó|¸vçÔò½ÊECµ‡ S±•äOÙU¢+x7x¸=G ¶¬Cxô8LÌƶ§^yW°ÍŸ»Ò¾1d©Ø0q¯µ)Jtw0^{ ”ÛúØ¢dLHc/üàmåð|`I\_‡Ý¶Vg:Ôþp¨®ð‰·ô¨u¨Ð×!gó­ãùÝvÄZÉàØøÅóøÈp t¸8\”}Ù®«Hó²ÂKÀÞZÄÜ9Ó– ,gݘBFØâ²…íF¤‰#®óØ%C¢<çBÙ‘àÏÅ)+ Ù©[“Á ð*äײˆ"_¤N"­Ê­Öä⧅ß9»!6Ea=øRF˜vS¾È÷[VuxZ1~z±vïˆ}B<òGñI± $g_¥!+}E‹zC)h¤®y%Ò&j 7¥xv°IÌqÚ!ÁGÑØ%¾(²o–0öáõïc0i@:óó$䪣°ÈWéq va׺-v±t”ú€ÁÜŽ¨Ü—©âÀïºèºØ·_9+Þvå§ZM®*o¶`­›8´—ü/9Læ6ö¶UONá’© SK°3 ,¥†79ç`AƒûÎÇžÑ(°Ó–uù}#„ .e9Zt¤ÄöØÊ~è à† FãC€©ú¯_#·ï•áΡša]½hlQ¤%~%œ9¢3ã‡xàÌwêÜ%Rѱ³nZY<’©êÎ?üãTù‰ž¿™»ŒhÈ”̆þ°C뱎ý0fK‚tEû XŒœø×ï…Þg* :?Ó[nPÓøy 47ܽÂA£ú~JRØ3;ŠV~¦Ò·2ÐœL<ûAÀ8ãÑ9P H)Gl,äå¯FÚ%C,INpfS"f²ðR˜9©a£DÖØÚ%ðÜ=wÑU9SàuÇ0g‘ìCl…àlnj^Âá¢Úϵ‘v*FÎ߈yhè¿qðåöÌLÕ<•@¨¼ÙøEQWÈ—o,+oMÛs [‰Fb ‡'G[ÀÔ'¦“c>Õm)ùt2ÊÍ8ûÔÚ™¤U ö)ãôÉ%íÐsLnm<Ýv Ãhç ÏÂËáüŽ‡é^-ä$3Çðx,¹×ì‚°^G+3xc‡‡·¾¯ÃtÐ5Ù +ž)Ë8Û¦¥„”œÓNÙܪz•Ì´œOP>8EÁDôesQtð¢Û®—ÑŠ½2ò5ð½µÙÂÈ¡U]/‘£#™ç†[#íí ·œX‘ Œw+(”™'Ӊܫ².öV¡‹§#6[n@~Ò½„rD¢RŒ"ëháNÖZÄéž3%è°J·¸s$6™´µ òDXµ–Ôžð²Ütÿ܈ûî*)YZ¨€É³Öm~xÿXÙ×Z1Ä9—¤LýÆ+…0»Ø$¾ó@#Tƒ»À¯jÏ(h¬c[|ÂüQÙ.©- c‡5iofÉÍôù<+Zhå ˜Mª¢ük[µãm(·sà0Ù¿•,=‘â05ãÍt¸‹á5w<“B"å;¦ƒÑgé€h€!oÖ.hí*?ueÉd±7¼É¡Þr-*å´H‘ë*y`ÿ-âØ ðL“›PÃuM˜§:Ué(,½cÚ¢ávC :`4îºß#mæÙJÍ¿)"iìÙYÞ‘ŸhÛP5»ã%ÚbdY+h›°ŽÅj‚’ívî·±^ªZŒd/ü5ed%£ŠÁ6sTøsæ3© Þ\ŸBF!´*ˆßD!#‡Œ´Éì…„qìgÚ!#*ùé¹w»ézþAÙúø„R`9|\7û+ÝX '¤#?ˆJ‹WøYð6È µòU¬Þya˜Òß/ G ½P@V'7=W,ÑUã)¬ü@lYñMÉš“P/‹|„’¦°…Ø·œÛâoâ9‹ìœë¯äá‹Æ^ªé W;*Ÿ#Õ¤0†;°=§€{îì'ŒHäìä¯`¸¥ªç†¡1:‚XüYòØ0Iý†RóTùY²²Ë¥Hõ’?—#…‰àáQ2c”؆øwýj¯¢æ~> “ï¸ý†Ÿjé'Òý c7ì“ÔôphšÝâH¿b<´\‰BI¾›cWÞMý˽ë½zÿ;wwTæªMûŽ'Žü^üž½D·s"̹lŽ]Ö›²åaÚ¥ÑÏèU·ï§,/®2cÓ}WšþÃÕ§W"‹ý½ÅE'¥À?ž&Áÿ¬™ÿëÏ•Ü Ô‘ŸE'r­Xß­,xµöåµÖt ðßC§endstream +endobj +6190 0 obj << +/Type /Page +/Contents 6191 0 R +/Resources 6189 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6174 0 R +>> endobj +6192 0 obj << +/D [6190 0 R /XYZ 85.039 781.388 null] +>> endobj +1990 0 obj << +/D [6190 0 R /XYZ 85.039 572.649 null] +>> endobj +6193 0 obj << +/D [6190 0 R /XYZ 85.039 535.782 null] +>> endobj +1994 0 obj << +/D [6190 0 R /XYZ 85.039 357.523 null] +>> endobj +6194 0 obj << +/D [6190 0 R /XYZ 85.039 323.384 null] +>> endobj +1998 0 obj << +/D [6190 0 R /XYZ 85.039 185.205 null] +>> endobj +6195 0 obj << +/D [6190 0 R /XYZ 85.039 142.252 null] +>> endobj +2002 0 obj << +/D [6190 0 R /XYZ 85.039 142.252 null] +>> endobj +6196 0 obj << +/D [6190 0 R /XYZ 85.039 110.499 null] +>> endobj +6189 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6199 0 obj << +/Length 3098 +/Filter /FlateDecode +>> +stream +xÚ¥ZKsã6¾ûWhO¡ª,$Á×îaËóÚ8Sc{Çšò!›-ÒË”èTÿûô (ÉÎakj†x4F?¾†&˜)ø̲ØWQ>K³À²l¶Úž©ÙfþsÅBH͇åÙÅ—8™ÊÏU>[>Ž|b_ÇÑlYþê}üùòvùùû|E‘þ|‘¦™w?¼«ù"ð®?\]ú'Ïþ¸ûŒÐ»ùŸn¾]^]sûrfÞG\òñæÇõònþÛò—³ÏK+ Ý„ÉQºßÏ~ýMÍJ8É/gÊòlömå0½=ñüXGÒoÎîÎþkYñœžñªSÊ0‹HùY¦ßWX¬üXi«08 + TàkÍ jì*HO¨ÄÏâlæ0;ÚÐÐícÎŽAèGA8Ùñ~ó +JŽS¯ß´û¦Äv†×ƒCCËÝaS÷ÿF±.¾±ÃOÍaê+PrZЧ©W4M‹WöB}\W^qûš—ß>\ +e¹­w0‚+oè Y mÇ“´=|»ªyåV»Ão +Y¿7¼o7so¨WØ.dÊä©·¥ùŠ´)Æí¶"žË‰Ç +àŽc:ÕõòâžD ¿U{·Ðþô‘ÛÐ&iC-2Á`±‡Qèíp?§X iù[âº- ZËÔ¶ÚÎÃÔ{˜ƒJù<¨ ’üFëàX’½!¨ºžGp¶åfƒÍݺêÜ#éœÎ´«ª’=‹Ti•X ¼à?2ïç‚oE‹)¸ÅÍù„=OБ¥¹l»»ü¸à’g{>oÓùoxr’ä~¨òw}Ë¡yÛ· ÑßùÖ{Zß:Üñ¤o¹;ÞoÄÈ·@â^ó˜Uín‡Ð†¢¬wëÑá¸U¶8µÚoQ©;r’÷<1w<1ÌcïçTôýò†»f¸¬ènëõÎ8O‰Ú{DkFŠþµhbËýÑQ‡=´G£Œ$?òâWÜ ƒt•ì¹}nª­ñP8rÁƒâä ÂOƒÚp~âнD"kD-¶“^¹ƒ°+%LìDK¼•A¶ òV¾pÕdëæneø9r_ÝPÙf[›»™†¶€Â +0ýSÿV‹3í«4}7Š94SB˜ ü“…Tqœù© +HM€¢bÍ î+Ž•÷½ú}bvdÛjáø iâć,÷¾4# I3‰1†O¨!7¦$Íx¾VéxiÌä(—h•ã…!á >Lºjwx«°`½ïÆœ”Æßµü€‰g¯”£ qÂó£wƒ`)†ÝW¦±ù’víû>GÒI´öÃ$½àÁÛ —~rpo&ÞÕ¿±÷ùÜþãD(NA…–õ +âd eÁÔþ_9¸ Xè@†êª¢|åΘé{‹º8HE£ïijr ì‡0È}ˆ´³ŸJbÆ8Ñ­…⻃$ õÂ!?†‡<9¦³û]¶Óî¬dƒñ#('2`Có¾dQ”ø‰N'’µ ¯s7‡gÍ"8yômyÕ´½„9Þ´(†‘mM¨¥xÆŸ¨l +jS€?ò…Y K6UÙþÀŒÊrzr@U¾àdÓBµI&k­©ù[JCÄH†V“H‡•Â GD80 L‡-Ô-ÔmWºáKKÕ¦ÑH)kâž5W›9h¼Ônøä…DîÚflT©vj¤¶†%o¤0´™¾—Á6nõÒHýI +ÌŒ£åÞ3•ÑР*ó¡£W¶šìE+?Ôee¡Pó}e‡†’;õê, ¼/h­ÌZ~+÷!†8}[ ¼Ÿ Ù¤g˜`²|µ©Ð°R¬>ƒsàw`RC*v«Šà±lñUžc ¤Ro„= å§R"¦C˜JÞbÃ^ØtœñQÍ@·ƒµLÒK|-êÁû}~$bžázRqÓ‹)`Ò4Ü‘ËJÆØÇ×Ý´Ï[çV–_@ZœP†"Ì~ôš\ïÆx .+aºÀ®Bõ‚°Z8]ˇIä‡Yün-ïмù²F)'>çe!’—…å<Å1jðÛd’âã"B7h'ø¬0¼%eC™û7RŽ4o¾8„*òÓ$á‚Ü‚˜–¢6FJþ30v:gEǘ†Ì¾Ï”g8*¾ò˜duë¥`×Uï Y5@§… q“-D¨:Ò¡ [t0zBÓ’©¤ÙšO$êÿíl2ÖÄF5ññ#K:|Hৼ¯”@Nq"/e;Jp9lêüÈÀÏzŠÞñN ›r—½CiNRºæ˜ž9óáÖÃÝ ·æµ ;öå.Ì#Ò•¨_fømyIŒÙlÀ†d:IãFEÇç¥æ¤žÔ›8 "ç0Ò™D¾½¼C„¹ÎŽEQ–ÄK+m ‡%‘’ÉÇÊ:§â®zÙÔü+Õ4Ï”ÎkÖét£ ûúy¢‚ÐÃ'" Ãt\g_»]`…_ §™rX _`z"+× éÖnÚ×:·f}RQûbßwåÜ`†ºÄ÷@šÞâë ö¦¿vttqHNù @*ü5< ¼{Á&¤[aö°'3HÓTsaG¤¦9ÇG¬éé1à$¦Ux2ç83樕y#ï™òdË­zg¡‹féG„SÇF^ε)ÙŽ˜‡ÓšX›:°±©Š’ΪœG0áf°ªJŒªtÀö8:ÁÁH¿ea㯕…¸™àbûëëéì)?<ùƒ!üå[ø¿þ#‚Í:ò³(? c€PK‹,xð(å£ Rlt,ð_ϲ"endstream +endobj +6198 0 obj << +/Type /Page +/Contents 6199 0 R +/Resources 6197 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6174 0 R +/Annots [ 6202 0 R ] +>> endobj +6202 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [218.337 385.948 334.338 397.637] +/Subtype/Link/A<> +>> endobj +6200 0 obj << +/D [6198 0 R /XYZ 85.039 781.388 null] +>> endobj +2006 0 obj << +/D [6198 0 R /XYZ 85.039 584.077 null] +>> endobj +6201 0 obj << +/D [6198 0 R /XYZ 85.039 549.331 null] +>> endobj +2010 0 obj << +/D [6198 0 R /XYZ 85.039 263.285 null] +>> endobj +6203 0 obj << +/D [6198 0 R /XYZ 85.039 228.539 null] +>> endobj +6197 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F58 3360 0 R /F15 2972 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6206 0 obj << +/Length 1889 /Filter /FlateDecode >> stream -xÚ`ŸÿFFFÌÌÌšššÂÂÂõõõ666»»»úúú%%%ñññ³³³«««ééé“““íííýýý¢¢¢ŠŠŠ[[[ÕÕÕ‚‚‚ssskkk{{{bbbÚÚÚáááRRRåååÿÿÿ¡ò;Pendstream +xÚÅXYoÛF~ׯЇR@¹â.ï}p®ÖAã´µƒH‚‚)™0%º$GE|çZŠºì‡(‚X»;³³³³s|C=öàŸ'¡òüt'ZùI2ž¯FÞx ”ŸFZ8\aq<ÏoFÓ×a4ÖžJ½t|³ØÉ Uúã›ü£óâç‹_o^ý>q}ßwŒV7ŽçÃD;—W;WÏ/¯^>cêûëW80λ׼ðòÝÛ‹Ë+_LLâ¼À-/Þ½¿º¹ž|¾y3zuÓ+Ø ʤ¨Ý_£Ÿ½q7y3ò”Ÿ&ã{Jy5õTø2¯F×£ßzQL Ƽë”1,‡«S•šðqƒEZ‘ßÌx' z*ô2Ø(T`_¡±Â u^ÔëOž–›¯_€=¢ÈY㸾ö¡ìæ·j^¯LɈ”ó¤Ãñ­ìyÀI {ˆcF#â‹ +'³‰ï9MFq^´L¬×üû ¬•ëÍWževïu]a·­=÷6A®ã?n­YK‡'¬¥#åGd¬ºZhõo²U,Ø6DXOÈdð'/PßlR3©Ù°)hÍ +z(×èi3ºj>aCCž+S÷€ÖÔ›å-Ï×tq<··r7Ÿ˜Ø±ô¢°ÏÒ«Á1.&GÏëûòPG:¦°´,ÌÕè)™à¯\ß³ †ƒ¥ªi:Ϻ²îûimB¦¯ý¡eAd"SC"›ºî¾ß3¡3¿ç_¥¦m¶šeÓ¶Þ4óbºnÙï¦U9ƒñŸ`¶ØKtâÇu>GŸ:‡sÃ%k”U¤_ͳE½±~ 3²#ƒÝKÎù}Û¬Ù2S'[é²»‰˜ötñ~/ÐN˜È îRÌ{¶@Zácá{€¿Wåœ÷Täwð÷™5½‰•iíÄìh¬ƒhÍ2Ý–w“´ý3†NC°L4“D…&y:mùÊħ“–ke¹aÇ!•ŽÓþD¼Æ‘ËÓ+Ê0¬Î_À÷|•†ár+ëñ ø^¬Œ‰Ÿº9¦QCïæc”†²5|¾ â•°(åílÀáõçäO­Ìês\Ãf½×UÖ”í³G¢Ê?Œ*tüEG¡hÙ´ ùl4¥+}"%ü'ý?ǘGrç¦+Ž_|µjU¨Ä¡H9¯îxe‹lJ¨BAòÍy™R¬H2‡þiÑÍQ\Ç̆ÛwU5– $+Ø$I„W6- kªâ²¡Dv?8¼´ãEŠ§” D2瞂׿ Skóþ¬*†öÉ ºôJÝÀmm8H}ç¢Î:(a"7ç-¦Ð †ë#µ!§§ü~PÇ”%Ò~ &U±Wuê;™–»LŒqU¶’î­SƒW(QèòTé"×ì9Á}êåMδ(«BüN\鄳¶·Y^?ìo9æÂG»G8ªCïŒÜït÷Ôów¨$ð‡ó& ’ÒÖ®– =ÐÖ°ŒåÇ ç‹-]8·Áà Ed$c…Ð¥ôÜUÅ<½gá$Ûtõ +€Á<«*9ª`Ç,šB„¢¥äò¤ÉmÁÌàâÖÊ3)¯\åsA©§ldy‡¦žgìVè/ }™ÿŠ‘§+WD +ú˜æ`ÞvK!Ò¡_ã¼)Põ©`}‚ЙmMk)ÒÉ+F™H韼ÐÃUŠh`Ý¥ æßwJSžÁëH\“R„¶*ˆb ZËù æ²Â}2tC#ÊÉè¹6œ‰¶Oªã-«€õ‘‰}-Œ9fq¿°ôøgÉZßsCvèkJ*ÃsSq|äC(&hè< +Š=Â$ÆO”§ÓoCA"Ë;‚bTÓŸxDpªÂ•/ÀãYYeHª,°”G9Ù.àN+¢&ÜAì0˨¸ÜÙ#j`½aæ»}T+ž¡ÎtUÆx*ŠƒG»ªÏÙñc”Æ=¨‘ô +ßóúš‹Ùr…YiKí/.ÿ8£¤þ˜’ž³­Ÿ†f:”/ žàpãhCrò‚JT‡Ëµ€´Rè±ÕÖ¶ÍðÕ­m­a¥Ù ãš+o…›Qȇw ^pì?žO¡A™KŽ-%êZb–(IMOB†7ßTRÎAð’KsË3”¿)+Id° ¡ú® =‚êÀëÀk?ß¿ ª‹,w ìTªë¨?ñ‘^ô/Å =’µC<ÆyÙô­`WCÈ?„Ç{©!» b..&Hèa¹ÍÃï¼Bý,ÊBD¤CÉaH’§ªd/?Ùš%ö%µ§@ n?=ärjÍ¿ìbæÝ4ÜØ‚Œí$ °@™(Dé»ÝVgr" 1[QçŠ ‹QŠ2}G:."œDª¼ïvà rçˆÃ~9ëö éLQ"ûÍà»…4æÙª¯~°ãÃ%}×SöÓ‡gG×û›<†ˆûö°Yº½’3¹¡Jtrð¤^6¨&â¹Ú–ž¤ÛNEÊ™4æ{ʤ§’ü瓾éÃcŸ +áZ‰¦v…ÐÉmuÁ›ùÚêBa ÿXáN|I„endstream endobj -5779 0 obj << -/D [5777 0 R /XYZ 85.039 781.388 null] +6205 0 obj << +/Type /Page +/Contents 6206 0 R +/Resources 6204 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6174 0 R >> endobj -5780 0 obj << -/D [5777 0 R /XYZ 85.039 758.673 null] +6207 0 obj << +/D [6205 0 R /XYZ 85.039 781.388 null] >> endobj -5781 0 obj << -/D [5777 0 R /XYZ 85.039 758.673 null] +2014 0 obj << +/D [6205 0 R /XYZ 85.039 761.463 null] >> endobj -5782 0 obj << -/D [5777 0 R /XYZ 288.958 -427.984 null] +6208 0 obj << +/D [6205 0 R /XYZ 85.039 741.337 null] >> endobj -5776 0 obj << -/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> -/XObject << /Im19 5714 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +2018 0 obj << +/D [6205 0 R /XYZ 85.039 220.674 null] >> endobj -5786 0 obj << -/Length 1844 +6209 0 obj << +/D [6205 0 R /XYZ 85.039 188.652 null] +>> endobj +6204 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F62 4047 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6212 0 obj << +/Length 2384 /Filter /FlateDecode >> stream -xÚ­XKÛ6¾çWø(±V$E=ôР٠EÑCí’hI^+ÑÃÕ#Žÿ}çAÉÖZÞZˆ©á 9Ïo†+V>ü«X{¾JVQ,<Ç«´z寞`çý+a9­<°^Ø\»ëPz~-òØ;Ö‘H<äy»}õð(ý•ô½0T«í~%„ô”«0 ¼@«möÉ]w­µïlz“~s•pÌ®t…“»kFÎÇÇ /ª~}'s׈¡s¿l}õn;)auO_PÓ_­¥òT$_´!Œ„ç‡òÚ€UáÌpŠÉhƒ@+‚ÄytAÉÜôC›£¦*:¦ÎØŠ·yöE€{ý]ìÑ/êxá!…^ ßKüd¦£Œ½(ŠHÇM>«SÐ* 7ða*WFÎWkÔG½†=-þ£òLœ¢cön8ÛÑ]ËØiZXö¼¿‡XÄh'MêÂú›«5¸J{ ñ³¯ý¨BÛ¦d¡ÇbdØœ]aÏÈ+üvÁLôÙÐÍ™;†ž\ë¡û0¤Ó“#±A£bggÀÝR:¨µ¡s»)@¦5*9¤€VùßCÎ -0Kßð¯IS¤òžñb¨Ñ¢üa-íqŸ;2FIhù0ŠÛô†²1ÙhPÆÛ°áue __›ªÉÒ™#Ö±9[<—"þ§H̱¹0P:pÒ7¾ã–Lf¡ˆ)KæA4×7îÏ;Ët0ýx$1YSöY×RµÓ]%ï’‹šý’Z&¬’Û¶ùò‘2—# GGÁ!ÓÕH%Ž‹k¼­ä½ÉŽÈÉ›šc-” _®À Ë}ÐP¥‘ŽF$~Á»1uºtè:ŒZSßSÄžð¢&žûX eâ>ç·=b©ïÔMÏ -×8¦U1å#ìq@quƬi†–¿»4ýžðóÜ‘¢ëÛ£<ôh˜Et¤ŽöÌ”gÄÄã ™OU_Ž·ò¥•Á/{Æ$á›Î·¹sDÝš]™W`¡†ÁÄÑ~8æ,Ú@ D{”öM(¤TóÄÍÊt|q’mž1©$Û[ÓNN´¼¦µGÂÅG¸ÑòôÉ$‹ߦÊ\ª`YqD8Š=¯Qªç½®É-Tƒ8¦@ Kqs©„¥À­X!œ$'ù™…©RÛ±¶øBÌ•3ËÛX\ ‰;ª7È­| Ü•ñ·y2EÝõ·øöþ÷?~+HÅá×0wQ%xÆþâ`sýÚO[7Va„v†.çÃ6,x¦€EõØ„óšwÒz8±‡”œ@êDZÕXÁ¥iíéÍx‹EwlêËúÊè¶tW€ÛQ³¢{,&£±aE#× V)Ï C`Ÿƒ"R+Æ^¢Å üð¨Ã+DˆO& -¼g|ß#oâC•¸ë0p¾’†)Ï&Ï $ÓVnùîÓáÒnhÄ©€% ”K`}”ÅÔö™ÐÔV¦i™P5­¥PИ4{G%à5sÏn‚ŠÀ©M•£³ÁÇnÐùHç–aªãÔM1„ÏᆲyâuGZ ¶a?òõÄM3ÀÔ—yo¬qÜ?<;!}êû“ÅtLnå‹ÚÞË?mN÷cmÓ‚F ï>ÞpØÔuØ ¬”ïù1·¡OfÈŠþ ¹-Ð^,âëªxªò4ÔR;?ñÏÏ(@ˆ™é /³té@ôà5Ø4®a¹[FÊ?dhv_sL»k!R•—pÕ9-—0þÔ‚vðfÈg¢g›sÞ]Ûœº»ÌÏÒ}­.9ò^ÌÀ•ÜB-@(ÆŽºâŠ¬íà2ÊS×ÌòÖrØíÓ¡àÁmâ>[èk­\w¼àHŠ`äÙ¿ Â2‰¡‰c–•üazL=`êÊ$âI”(7¦!qßbÇ$®qòWx+ž~0mX€ ÚÞ-¸¦¤Àòdô à„îÉ#g¾ýJ‘»ÐòèÖX¥Ÿ ž™»Ù3È®bæ–% Ý„8WþA›ŠÇ>bJlp&£=|º ãö@3ey^¨3„žJFÛ†®}€yàFßyÀ<_ð…¯=-FðÀ©ÒZÎmRSÚcñ‚;G«Èƒ‡»Ä÷§ÉZ%ð÷ƒy¶4¶l_݉h0M w&¿P?‡Ý½z»c:> €u]¯µ\KìÌôvðål¢Â% v¨]1*²¨D6öYÒ¨+ê'f2w;gÚÔX:O4ÔUy¬¡ù‚ô(ªÂ6wE£¡}r\ú{Àí -÷wä´¼¤ÇÕÉ[ay~Â÷êónƒ'ínA˜Ú.¶ï6Ûÿ¸ÿ\Îçµ<§›¿±¿bF³ glÜ$°ž)4Ê¿aB ¯Óôqu™X°d< Õ|GP/¢:(¥£{×Ew^nÐ5æùû~›8o_oÊW^(ÇÃè…Ï/Ô*öt¬îßø­ûåendstream +xÚ¥Y[oã6~ϯ0R•1k™’¨Û}È$™nfw.['èÓyPlÙQW¶¼’4ÿ¾çFJ–ìL€¶À˜"Ïùx®Œ7Rð¿7JBWé(N<7H’Ñ|}¦F+XùåÌŠ‰L:4ïnϦïÃhä)7UéèvÙò ]£ÛÅWçòŸ_n¯O‚ p|ÏOâ8q~{ÎÍxâ9ŸÞÝ|ºzË«w³køÎç÷ÝÎÆßn?œ]ßZíÑ LŠÒýÿìë75Z€&Δ¤Éè ÆÊõ`y}⹡ä»<›ýDzâ5=â]ÇÀƒÄ “`ˆFvÐðå&a<ŠCå†JÕvWT›f< ýÐù™²ýî¡Ú”ϨÒô½×e1Ñ¡›x ünDÄbžm’ÄÙ=ä2ºO?R'[¸‹|!DÿN÷M=-‹{X›6c>Ç÷ð];÷—Ö´òÇØY4.Q-aiW§#åÜ>ÀGÑðYëŠN^ ›RÎUàë™?šý>¶Ä­ªw²­@sä¼û©³+~Wžžg ,ü 'ÜCH:ßã;à’† ¶Ù\óÀO#ç²1ò8f$òžŽ%RD +§šý|NMÃkì+#Rî›…Y™C…g³Ë6(}V/pB;O¸¹“*p´iÁ´¨z¶æ1+¨îËVp„¶ª™&#-ñVÓ®°€¸]@tJˆÜ5÷Ìo¤"[ˆº0Ú† ®ö¨`±YñbY‘ud÷|Yɉ#‰¶·€™ì‘߂2% 6dadlæ c‡ëìcc«°oÇgë-fvÂFq¨6²ÑÊEV(§Vž¢+±xnv9af…ÊùXÕ²L7´¬êµèŠ<2ö JÌì€ÝÅÍy€~Ú±[Ð ¡%¼Õ˜P'Â>rZAüúÂ!×y‹m|w¨ë’ÄÙ 1Åp:š8çÿÊë£ä¹køþs—oŽ-8•™}Wùc&ïÇÚ™Ý~k- ¾ÔÕªKõœµµz`rYmæâ€KÃL¬Å`sþ¶Šu⻉NFQè»QìqÅ…z%¿vb©¡žtÈ)–Â>OJ-É%±€”ñv–IÆn{»€þ¬?3Féƒù]·~,òã˜Ýµs¸oñÊÖkr*$½áíy½ÌæyŒÖ$£ u=ß?šN ͤC4„ !ÅéÐrBø–ƒH‹ ˆèY¾§uG'óK1ä/ÀGj¹oÍ•«TÔ¼Æäƒ@a4ÚgOu/LÝ üÐ cÿ;v`¨'ò!}ž(âù Sy=ùK~¬Ù9XÎ cùØT—KÑçãcWvJ÷îÛм¬jŸªêž({"•¸^½X¹uhè0_ +7(j\_±·@±ºGàCÁ‡0˜œ2a£ˆ"§Yß#Õ +…ã†P(©ï”–š!†N]±iÎrNöu†aPs”ÊÀ5s6…ºáé #?6yNuŽ ô­¬}ûÇ+ n›E—L‡Š—Â3þ¢ÎhWuUfBÑ©<¤2IœÇ‚¢&¬VÂó©àš24UmXcys_K ") isÆž™ó ƒí¼¦ËFx$ã‘ô íÙeEyHÄzÂâPƒßU¨øÇë°ËdÝÏ*—¬¬aãG,•bç]+P]2½`PšÃPg(>†p˜„[HÕCG,¸™àÂCs‰6/÷‹6ž‘èÐ˪,)Þû¬%@¤ÀA5Tì-‡¯«²B²òOtjl© Þžr ¹:‰‡=KœÆÒ³½ž%ô,ˆ4>Gãç+W+È°1Ä‘ƒÑÿµ.é+èàt ¡*ÜÔKû¤¡2Dx×ÚRbkË?mƒ‰7@Á uNŠ#4ߧÇé%Gá[¯yгb2¾¿ÝÄ4IÛA ‡RËÃcr¾Ð¾, +áÏ4#h‡¸®Y ÍÞuu?0â-Ü $îÄLÕ:3¶kÓÙÞdO.,ùòdƒín NÒÄOo~¢Î@§)Úz^cÇSд¿Ù7¶EÛ`DÊ9D¼&ߢ´æb~æŸ7§µle]¨µ”’d‰§WRx +þ¯•à·SÖ´Å‚ÔQ£¶¥t‡¸m‹e±8žžðY¯ÖcU,ŒTqžR"8®DGªí+jÛWÞªKøì)~G‘ m¢¬çS7†î×HÛc” Ø~€>³·2ŠZ¯ÕI¤K5§ðUŸÅž_×€÷ª¦Öm{Œñ3èöÇŽ7™³ +i{Îj á…:Ç2Ȧ[”2‹‰™¢_ù̦¢|¶´ùLV¸féH³ËKÛwJ)Í)¨rUÑPÖ?Ò²çm6@¤I¼Š eí®ÃkgÊËtÔ”2'âéWÓqöîµ5¹A@®aÊo4Óû¬y8‘’ý8u#ÁGréCþõþÞ# n›ã±1‡—*v»AéÚŠ]KÅþr¿NAµKÁƒÙ.a´~‡ƒ žmìÓÚc^ËŽª·óËÕ%Wþ b¾FDO )⽨fKs²îÇRCù —ühhÛþÀ“‚Ò6TrÝø#/s+^œ³Å­¥k–BÚG)ü²Ìf]|p¦6JˆTT“0¦ è½ñÂÍ•){ú¡Ïò 3éÝÆôô=4ò‚šS‚À²+¸­ˆ8ÎPªyâ7 Šì7)Ç™y³„ñEû6 ‰Ø‡&Ùœšõ7‡m¥/«SÅ”™Ù¹à—%æ[|ƒP¸¥Rû±°¯ «\Â\[r·¼EÔÖA>ôÌ)›IÍ/ÕNÂ+¿€ó$¿À•Ó&³-_6å8;ÝäÝê­¡ÅíX7‚%Ê„3›+F¢ÉüµÂjKÑ’³€9”òöA·uÅç¡ãáDÍaU^ë6 ÑiyîlqÀ¹öO t ûR¦¤Ý{ !ÑÎù‡ª°Ñ|qðâ©»5žd‹ºs^~jm67“#¦Úþñ¦;<°Ìþ_xÐO½o +*ûãáXü[á؆"¸Ip¢<}ßõ=# *xA_^ó—¡Àµ +|endstream endobj -5785 0 obj << +6211 0 obj << /Type /Page -/Contents 5786 0 R -/Resources 5784 0 R +/Contents 6212 0 R +/Resources 6210 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5751 0 R +/Parent 6221 0 R +/Annots [ 6214 0 R 6215 0 R 6216 0 R ] >> endobj -5787 0 obj << -/D [5785 0 R /XYZ 85.039 781.388 null] +6214 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [481.851 649.553 539.579 661.243] +/Subtype/Link/A<> >> endobj -1870 0 obj << -/D [5785 0 R /XYZ 85.039 761.463 null] +6215 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 636.004 353.452 647.694] +/Subtype/Link/A<> >> endobj -3022 0 obj << -/D [5785 0 R /XYZ 85.039 671.062 null] +6216 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [158.952 622.455 458.051 634.144] +/Subtype/Link/A<> >> endobj -1874 0 obj << -/D [5785 0 R /XYZ 85.039 671.062 null] +6213 0 obj << +/D [6211 0 R /XYZ 85.039 781.388 null] >> endobj -5788 0 obj << -/D [5785 0 R /XYZ 85.039 642.326 null] +2022 0 obj << +/D [6211 0 R /XYZ 85.039 608.186 null] >> endobj -1878 0 obj << -/D [5785 0 R /XYZ 85.039 571.69 null] +6217 0 obj << +/D [6211 0 R /XYZ 85.039 574.042 null] >> endobj -5789 0 obj << -/D [5785 0 R /XYZ 85.039 542.954 null] +6218 0 obj << +/D [6211 0 R /XYZ 285.296 510.468 null] >> endobj -5784 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R >> +6219 0 obj << +/D [6211 0 R /XYZ 85.039 279.605 null] +>> endobj +2026 0 obj << +/D [6211 0 R /XYZ 85.039 263.543 null] +>> endobj +6220 0 obj << +/D [6211 0 R /XYZ 85.039 232.126 null] +>> endobj +6210 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5792 0 obj << -/Length 2737 +6224 0 obj << +/Length 1771 /Filter /FlateDecode >> stream -xÚµZIsÛF¾ëWðØB£÷ÜÇžq&){lffª’ ’P& ZÒüúy¯ì[)W‰î×ï-ý6˜®bøGWZ˜™•Ò”0­W»ãU¼ºƒ•¿]QO±ñ$›Í÷Û«ë·’¯hLLlVÛÛöA¸`«íþ×èõß_}ؾù¸Þ0Æ¢$&ëR:ú´¦Ñv­YôjèèõzC£ÀÔ«ïqôÓGý¯·0õÉ~ÿÃ/0Ï¿o¼z³m5ïaý÷ê×ßãÕXøñ*&ÌèÕ#ŒcBaùx¸ˆàÌ?®>]ý³9Ê­ñ•Û5%…@±¡†˜D,KJRÂ%k$•À*'ŒK”¥ a4Y)s+*ùn¢w§Ý˜=ïQüeRFÇ~i´?ãR†+Õœ0ü©ðbÀ³eìÌÓvJŒ=ì‰ Ê«Ùa§ED¥ç}^Ï¡óû´43kÄ‚Pa,€W Î@" –üøPNq+60²ý¹3WŽ`Â, µO¿Å”{Ù"QºÃÃvNÒUc}ßÒÙw>¯©Š;Gr›îòCÓ5Úø3Z;‡+mïýÎ[X-‡ ó“ßX<`å4\EZçÅɪÚj,PX–Ó2s—^yg©‘™ï†RÒ’J“XNI=¡DS Ã)PÆ e«M»}B!`.B‹ð -WÝ#¼9(’Aé×ci÷/€ñDˆfWœNÙ®¾Þç•UjqIÁ ŽëY”p‹ŒL¾e»¥'B”{´–Ò£*PõϨ`ÞXÄ©º¶‹e–ÖÙu™-/h=_ðϼ¼™"œ²¯ç¤Ý¿À‰'BNº7©ƒá¢ä‡¢²3×eðg¸–Z¦²ë3>rüûèa;^9Ï1ž¶Ÿq/|3O½KK2ïÝd¬IÒóm‰÷mÙS=z7…ð#¤ð».F!F “1hNÚ4GM`ÔhÚˆKî¶9g^½7MºZ¡‘±ó;Ûû½aÌ׊¡ÊºV˜ kù¾Õjb¢:·:O¸š€·jGõ½5[È$d÷½,“€³ÇÞ]¢H¢´'ùy‘Þعî±óÙ“E“=ÔDêG6EÕäÞ3”âÁûÜÓÏu.((wž™»hdÄÔѵÔÂò -Õ³ èöÑÙK¥•[zD Ï÷fk)p'î;"7^ä0­|°u{á²ëÊçÛ°YàßlgmÜ)Ã+rºÍH†@û5'‘ÚOžºñ(p}ß^ù`Þ÷ÖE*„i&v»×d÷ -kw>$ªÈº[ë­€¸¶^Ü®zíÁè1·„ÑMð8v:„Ò¼®³°©›=Ñ”ˆGPŒ”=$›h -¸§.!‹ß `øÏÞJ:¬Š‘´œ1”ÛýNa7õ–­[¬}V`WP'w-XïÒ&’Єú{Q½Æ÷‡ ïü‘“’6™œà;½&Ž6+qs õµ³-xpÂóg4ž}W”ûV:YŠ÷E‚j"˜{Pe”÷ ldz‘E«„b`ÒéQðuF)È0‰P½lhøÛzdÃILåj#p¯T§=å©‘5æµ‘àƒ¬ÉhŽ„NhAH¨Œ×ÂH0‰Pä&«ÎËGÍaß[NÂ×½yµõu¶Ö-¾ò‰±U÷SæOÁHßœñ60Ì¡BNgýÄ`©€Æ]¢Å’’¯8DN•|[™×:­¹c즎q#O=Ô!zr¨ˆ 33ñS (ùØŠkIb_ç5rü©wÙbdî%DÞÎñ_5¶ –QE Ôö“`pî?E§s¨œElÜÖéùÁ_ùÔÚ‘ß“C6 ™ì³{|?[ØtLHp^†q´ -©Ö¦©é¿ÙnÄ ™a›¹Æ@ù ‡r•X¸Š*žµö¤—°%\…tp½Æj¤‰×]ki¢ ×ÎËÌ©û%¸xauC~›?l–ZÏê›Ç„~Aß„k+W:«ïö¤¯‡Õê{ W£ï.«oÙg´Ý_ýØ©íº+<ú€ Rãl†“W•)ƒäòõ½õ,wӯƊ^B6…é²"¨ÇŒÑ¬ˆÅV·¶xµ¢ö¤—°¢%\upý•V„“sq¤£öÙû^S¨’pàkÛ™˜³°—[ÏÂÌ7[$EZÌt{¡~_𪆓å&S’¶ÜTš•P%{mæÛ*·éç5£M,8˜µ[¿©·âŽÚtΚj®0’HÑÃú`;ïYyœë¸3ɉ$ÔÒÌ7Z—Dè¤ÓháPÏwÛ^¡ýÏAf¶kz¢¶5¸wXââoª8·éc‘m=‡kðΡ°Å7®mz²gA5œ·µdty ïhêmœ¬\­:¾s¿Å"ÆLÃ-³…7g"ú”ºª;uUs•Û¾E鶜]R:Â_N˜U<Á™ÔMXAÀ/È`ïF¶Ï{½w|lñ8¬¼sO<)Z&Û¢‰ò[ ?U5H3k_è‚ ® °D™ñm$qí{£;å3,—ÙƒkY•k×l1¾UaB«»Cž¹®CX° (6’cTÔA¡Û,Ý([罶s]ö}ü—e^§7¾—³ Ck $o®Kc‡Ks.4r‚ñ.xþ¼Ó1tKîzi Àâ|wßyôçtXnÞÓŠN„;µtG´Í" )ðNùeàÕPw_ŸVZ_sÌ`Ÿ'¤Áw•‹jŹößÓñæ[ε¯²ökßä Ìx¡DqˆMfÑ uhæýt"!>©~û›{? –ò¼se…Œ‰æjEK3ï ž¡Tó}OÉðu¿¶91g››£DtÈ?‡¯RƒÞ4bW,ú·µ•“;ë\ÙnŒÒ“ûD禱«f?Ü>»™]j»ŠJ†þ"ŒZ“w¹FÞÇÆw…þrçîÂÁx`¥ck:vlЗÒÖàï½ÿèW:_ ªÈZ3ÉÇ_˜uZÖ#Z;»íµéºý¦AwÈöl‡ö -èÁ%OEY€Å^D,èÇ_ c OC~ª!6ÓéOMžfÓ!jìsdñ8{̾[Û0BÇ}TT9È ¢vù<»5SËx<ÍO¿¥Cf›èž·ïþóó›YÀ`ÓÉŽZ¢x¢|匯ÌÆÙ”I¥rˆ§ðNIËeÞ…;Ï.ðÞ-ðq·¯òv8þFç’‹8<ÍÇ ÐÒ$îpt™u¨Ÿs‰õ–huO4`½¶YÌyw?ΞQ"YFàiFúLki™í"Xfšs¢8¿ÀtK´À´'0}LŸ*t½ÿ³æ>¥nÿ=i †§Á¨[ ² c™sF¡ü8o‰8÷Dέ¡?í0ˆœ÷œK¢Ð¿-Áð4#£Ž‚NtÆ2çPêK./pÞ-pî‰þ$çøAua\*åÜgxwÒ°†‚#P=°X) ¿áĜĉ\”N ½°ït!Aï…Ë -Ácº –hA!žh “õ<_²²rŸd«1ó #½Œ$ÐŒ ˜U)ÓC2É|(ÊcpTÓm‘ €þP[¤mÊ1Hf¾©ˆ$! Xl>­ÔToIh6üì‹,jendstream +xÚ­XÛnÛF}×W¨èƒ)Ä¢I.)‘~)|Kê±ÓZAP¤yXI”Í„Ô*¼Ä5ÐïÜ–¢$:MÑ .wgggÎÌœYÊzðÇÆ‘ë©d8}WÅñpQ ¼á=¬¼ø"1‘qGæ|68yM†¾ç&^2œ­¶z"7ŒÔp¶üà\üzövvõûh¬”rߧÓØy?òëÑØwnίo.OyõÝÝçö%O\Þ¾9»¾áñÙ(ˆ Ürqûîfv7ú8{=¸šµ¶Gƒ1 Z÷eðá£7\‚'¯ž«’xøcÏõa¹€yn*yÏwƒßZU¼yWVbì'nDßlâ»áDµ€^`‘çF^H€F‘ ð(|Œ£0qîjt[”ï”0T“©ÓløY?¤@°jxXà3v–0“­žxƒU¨ñD…* œËD­K2dÓX”Ù†©ÚðS7µ)t-ÈfšÊÈòÉ|&ÏdËCj-¶1¡3i¡¼Ʊ)”0mœ¦‰óøʈc £’‡]¢m`¨Š=ǬxöæÎÞœŸñyQ³ «üõ¦æåÌ>+QIÈ™ª²ÖÎs9}ÇcçW+Ùj¬®OŸgmfYÜöÈáÙ’=nãÉSÇ”uFÎC‘ÿéù!Æ«ª!õÃ0tf£XaŒ• +9Z,'1Ãa/ȼT‘ÑåW4`ô:fU’ƒ„*2Ò0XÈ6L*Œ˜ï;÷¼aaŠ‚ŠçD½®x­4ìG}j} ¦®—°íâÏ,|ÒTåIΓd“ÎO*]à”>aNöÀÃC»ÊcRþ>£r˜“¥TôáD´®ùemPË#¾@ç•áQÙ`4ζÃ#TÓèœ÷bV¢.#ºl¥Gœ8rflJ£pº[¯8Qh[tJ½ò„ c'à%¬º’ÏX¤”TÀª=.íI"L™²›…*‚Ðas~Ñ늨ƒƒ ïµ2ýÒ¤•“š8+2 à%ɉÈYènHíº%‰ÛÀÑmª N2E’{->È^#:óLRPVºª9[Aå~¹ﶞàƒuˆLp8L%¶2„ uMð{Ûº„1'È)ôÜ”¬AO€¦|²s¤ìPW[°-ú ™Ì¡õö!ÊÙt‰ÎNçlùuMˆß}/6Ñ”gJhËZ&uÀˆ¸âöñ§­ØH©9À¤0Ô$,œdAiÑ÷9B%…F9-5,µ bƒÝÒó|»qÉŽEvj +J—_ÚxÉ–9‚`-¤â§"ÅNãžs^å„ò(h‡i±0¤¿ÐÄ 9e)yÚC&?©ˆÅÌCJ¼>*øªDnëä°ð)ò€.‰iMf¹Ör:nÉZbiF@ué{EU+ÖR¸m·°-³$n¡ÑÔž¶³ ²æ +w]÷;ÛT´ú7ÏÝ—©m\ßÃð3É{Å!èéBÕƒiòí릵 …þsßcè.To¹þ!š»P2ŸKÄè®öúãNú"z–*Á‰<9y©º×Að+TîDMÉ/å\nƒÈù**ð<ÇóNé/Ï8|%E~Ÿ"¾SÞpƒÃÀÐ…aeÚž¾ x™rýÁ¬ÜcŽå• NµYtŸÖ’@\:âw¶f†Ä õ]Ï9êM}x`Sµd.ðØ]r)#ß‚ÀåÅ,F¾ ¬ÄqÓS’SQD¹ƒÄ°ä×”'N̹K|æ7Í\š>'Q2GÃBKõi)úÉiè8 oï9ÝíÍ„!úûß^^¸¼þ?(àhý_ºØäÔ¥'~\â$Æó»¡zöÊ×2BµÛÊO{’ÛŸº~ì$æÅÕ틳e‘­³ª†ÖbÊÃN…"ó¦\¦`Á¡‘¸ú +o'Ϭ}ªÇzùÌÚçr^ß?·qV]¯¡•­Óú]Å·‰½ +ï¸Ã{;爽iªö³ ºæ\{Ðíç@K­° ЄŠ¶±—À÷T&Uqvð‘ô…½m³Æl¯»B”0üYD(ï°úÑ ÔÚÇÙ®lG›k™N 7˜ì7ˆYud3jÎ;DÒ^zôMç‹E*t‡L:WÏÐá{™!Nÿ•PKC\Ü)\±`Š˜#701 + À˜ø¹MÚ½ô¸”¸ $%põLu1“¾Gî_·ûrPž$}?8À?Vù¿~Öi¶Øb•ôÿjøÖjUpÃݳ7R±ÅêÐàs-»endstream endobj -5791 0 obj << +6223 0 obj << /Type /Page -/Contents 5792 0 R -/Resources 5790 0 R +/Contents 6224 0 R +/Resources 6222 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5801 0 R +/Parent 6221 0 R >> endobj -5793 0 obj << -/D [5791 0 R /XYZ 85.039 781.388 null] +6225 0 obj << +/D [6223 0 R /XYZ 85.039 781.388 null] >> endobj -1882 0 obj << -/D [5791 0 R /XYZ 85.039 761.463 null] +2030 0 obj << +/D [6223 0 R /XYZ 85.039 761.463 null] >> endobj -5794 0 obj << -/D [5791 0 R /XYZ 85.039 739.701 null] +6226 0 obj << +/D [6223 0 R /XYZ 85.039 741.337 null] >> endobj -1886 0 obj << -/D [5791 0 R /XYZ 85.039 739.701 null] +6222 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5795 0 obj << -/D [5791 0 R /XYZ 85.039 718.708 null] +6229 0 obj << +/Length 1649 +/Filter /FlateDecode +>> +stream +xÚÍXYoÛF~ׯÜ ¦Ðˆâry)@P8>çÜHiP$y IÊ",’ +(BÓÿÞ9–©#MÓ—À0´»3;óͽ’èð'ºž­rØu=¡KÏëIÇèÞåYG(Ž¾bé7xžN;ƒ+Ûé +CÃît¶•cë–-»Óð½vþüìfzù¦×—Rj¦Ð{}×õ´w=¡]÷úB=½].VìŠ}qö<©Þ¾*ãæp+«!™ ¾ä…ÏèG^•s_­ +Ò}{ < âD|°ÆuVå¬eÀˆƒÁÒ/HãJéZÀµ¸PÑăB©ÝÔÃ\Pœ·=s¨­kJKˆÜ\zx^&¤¬bò^œÊyí´8g‡¥õÁŠ÷UÖ!Ä'w{'ä.Š™ +lÒ”˜*(Ž +‡TñD3sd¡"µq<][,júˆM9ƒ,­ðµ*çèñôŽ…m + +7›B>òPª6ä\eø&e™DþRéÚõí€ÍLIÿcyYk;2,ÏÑMèóßi j⦱?Ò,Gè¦ÃM ¦˜­ƒNhSP•Ðÿ´«ø  q\•?° Æ¥Ž1r­(ýž4´¼Äöˆô"Èc‚vÇÀÛC]Xö!ðà/iê†ù/–O…i~Û2Ń–½"ØÕ—]–NÉ'œ"´ô1WKº³¬²Ö_$Ø8Ë•êºÐHç.ÙÖB?¢<ÎÒ\É•¸œHÊåÄÕ×—®îš^kpN©kÂfÕ›*l¹8Ä™DÕƒÍt 0®¸„Z¬º2¸%Tìs&<‰ÐQñlÝ12²R¹hä;HNT^*m8äV«bÏÕÌ낽™àˆC°§Ù”J?ᦚ Ç2jM’†O|ÁFÝÞá.9f@ãÊ +6¤=áŒ!nìÖ4ó7<ÚŸ×Rê ²ÄR‰RŠ¤´?Š­ßtAê)I¾^¥Ýößਠ+C¾JJZ¸ØpîÛˉÿ™ü[;Ëñ¶AÇ &=`Mè<Š‰nΖäß(ç³"úTEiñ è{–«½^#ÉU…‚ÕʼnÎ. л,›l\O +ˆ»Y‘¶!¨N¼³Ç2ûPÁË¡Cã$Ç"ÀÍflÀzPù`û¸ÚÆmÀ2 ª½“o¦æúÀéb)p‡#E+cQËiÓàÓ-¤*­±Œiú1IÅbk;Kö^ Ê +7us‹xóÐÁA „y\<æ§rë›…Ñz$S 0lþ?²ÿ"}–­{¢Ýl^Â×­''“×OO„# +æß﫯N&(<Æçíñ>/áEô9"ÀGÛ“} ë|E² +œŠÆ+NEr*¹€èb|3½&€½¹œþqöêɃߎÞ?fCG?‡¡éÖÐÑwjþ€¥ïâ4…?ƒµ+†µOþ'ûÞ+Œ|W}â…¡ö~‹Éü..y˜ë#<|ÈŸ„´xvÃDz­¶2«‚¹rÅgŸ\q?(ªÛb]`v3åëWþTY,HÚayTVyÚ¶–7ë˜cð÷‘£4tsxø½¨ý¯_F¶K©{rxø‰gÃÏ5D+…½‹·þeð?,ù‰Lendstream +endobj +6228 0 obj << +/Type /Page +/Contents 6229 0 R +/Resources 6227 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6221 0 R >> endobj -1890 0 obj << -/D [5791 0 R /XYZ 85.039 619.42 null] +6230 0 obj << +/D [6228 0 R /XYZ 85.039 781.388 null] >> endobj -5796 0 obj << -/D [5791 0 R /XYZ 85.039 601.154 null] +2034 0 obj << +/D [6228 0 R /XYZ 85.039 486.243 null] >> endobj -5797 0 obj << -/D [5791 0 R /XYZ 85.039 516.543 null] +6231 0 obj << +/D [6228 0 R /XYZ 85.039 452.1 null] >> endobj -5798 0 obj << -/D [5791 0 R /XYZ 257.152 522.516 null] +6232 0 obj << +/D [6228 0 R /XYZ 85.039 452.1 null] >> endobj -1894 0 obj << -/D [5791 0 R /XYZ 85.039 379.003 null] +6233 0 obj << +/D [6228 0 R /XYZ 85.039 452.1 null] >> endobj -5799 0 obj << -/D [5791 0 R /XYZ 85.039 357.806 null] +6227 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1898 0 obj << -/D [5791 0 R /XYZ 85.039 274.999 null] +6236 0 obj << +/Length 1272 +/Filter /FlateDecode +>> +stream +xÚÅWßOÛH~Ï_aѪ8R³özmÇ©T€BÞz$½>Nlˆ…c§¶Cî¿ù±Nlbàª{¨*ÊîÎìÎ÷Í®g>¤aÃ?iž°ÕÈR¨ 0f‹žmÜ‚åcOjv4|'=ëÄó i‹‘=2&7Ûs<ázʘD—æѯ_&ÇýRÊt¤è†ÃÀüÖ—æi ͳÃÓ³ïØúu|ŒÇUŽŒö™ðÍ*ƒ ÝI…¯£¾ÄyXò äݳ¼(ârI7›ã–(Áÿouªè­T¬<è›…aÎÃrŽÆU¥_  ‡ëŽ”—ô`Š{DÂï¤Ôy§úóûÊï4´ý¤ñ¸¤ìº »•¬òpe{6üHÎóß”¾:¯?Õ¹þ•äýÞøóá^à†1žÍs}OúJ_ï竪J²[žGùº¶àI<,ãâ>™Å”¦]'ß%iº,ò™Þ°˜FNÇ“?~ÿú—§ 5–½›³ŸË&{Žóãt¾ñó3)5KN'-ÕMëR‡f'4þÎ[ÏÖ“óŸ¼T·×5ÿzó†_Iåª'†Î°™Úb¡O¸Ñµê>¤Zug•«iùPZð&ikcçNÒ÷º2WÄÕªÈÚÄ CÇ×÷Ï YúR ƒÑ³š¢áC]Ô±w»h탱Æyö” ¤|UÊ¡PPÀŸ [ûìÄm•néÂqýV`x¿}gí¶Q袜š ÕÄ2Û¯š=½¸ãY]¯86WÄMep¤».WÔ¸.µñcV€VøÃ&)¶·.ô´óóìˆä¾0dX…Ó„TH…K;h‚@ؾûlŽkŸPŒÀØ1æƒÍ!\Vq¡»_^l»eª +Q†¤Ô(¹” „|Ùêªçv×Ò{)¨áh¥ã£­C,¦s#ž¡àr½ÀdÁ´ÑIÉ wN4á%ÑÀb@3‹ÞDR ô´(Ôf¡Ð  µÁm/«°¨P§-õ|V»&Ë +Ä2|fæiŶU¹ +ñZR!ÏR´SléP€àúØ0£,ˆž¿mÓ8ΣæKÊœ"œŠÍÄcÎ*AšhHë¬T¢c²i°(EY´UiI€´”Ïúÿ†cn/üæaS¸Ñá¡f!Qé O’AÀ4£zÚQ¾´h#ê”VVo›“,–Ío·Ÿ ®lé¦zLÛòš÷v…ʼÂL«ÊS¾à·@Ú¦¡»H3·ÕOR˼.åINK‹¾zÕÁ¹¢"Ø á‹é®ÂÊNç‡ +?|àÿú‹iSÉr žøØ=ÇŽ¬± %ýÇx뿬vÿ #(@endstream +endobj +6235 0 obj << +/Type /Page +/Contents 6236 0 R +/Resources 6234 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6221 0 R +/Annots [ 6240 0 R ] >> endobj -5800 0 obj << -/D [5791 0 R /XYZ 85.039 253.802 null] +6240 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [335.674 158.672 389.06 170.361] +/Subtype /Link +/A << /S /GoTo /D (winbind-solaris9) >> >> endobj -5790 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F56 2890 0 R >> +6237 0 obj << +/D [6235 0 R /XYZ 85.039 781.388 null] +>> endobj +6238 0 obj << +/D [6235 0 R /XYZ 85.039 188.887 null] +>> endobj +6239 0 obj << +/D [6235 0 R /XYZ 85.039 188.887 null] +>> endobj +6234 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5804 0 obj << -/Length 2666 +6244 0 obj << +/Length 931 /Filter /FlateDecode >> stream -xÚ¥Y[sÛÆ~ׯ`ýRpF\Xüâ‘m¹ã4©¥x:“ä"@50¸ˆfúÛ{n‹ I°v4ìåìî·ç~–Î̆?gúÊÖÑl:J‡álµ»±g˜ùË# !Y hÞ>ÝÜ}¼™c«ÈŽfOë~_y¾ž=%¿XïþzÿÓÓÃçùBkm¹¶š/–ËÐzœ;ÖÓ<ÔÖýÜ ­wó…c}C÷o±õé©¿|€¡GnÿðãûŸaû¿=}¼yxêugŠaý~óËoö,+|¼±•ŽÂÙÚ¶r`zw¸”ïiéç77ï¶â9oÆ«.qÁP,œHE®S£¼@wœraÖQ‘ï#§ÇUÚqgKßV¾í«€;ZÁ}`’ïÛV‘6qç_§n,K¯bèiƒã¤Õap# ÷ó…§GSoWÎ ¦¤pyŠ"º… ß³š-ŒÄ R9Ö!Ëqž;i\#]ʬ°].hé7 Êh²™cÐXuä@¹æeu¼›»Këá™I“KµOà!!@èª ×l‰À›…ƒä»Ötxõ‚€øøZ™°hH{Ÿ¼ÌýÏF4 vMkTOÏZ•;ìïéÀ4amJùnS¦*sFƒ=zì9üúTâFRA)7p/‰ÜuTè„м¤Žö”£g‹Áú ê #å‡~w^;k_‚ø–,­ºø³Œ®à®|³ø™æËÖÌTiÜdņ{(Oüª{dÐ>Oß—xÑç\V¯¡SV_ë[&û'NŠ†ÐÀWdzš Ï­;n„áëòš#kÓ—¾Z:úç`¿þ -…ˆ8HwP_´Ø·qÅj=8ï>èá.­‚È…cIGwÏjUk¦æÁan(täÝ•¬¯1s(B ìIÅ@Ïb.¤³Å¯¤ðEÊ’”;eÅß’ ¨ä‘<ëDvK&´p¨ë² ù#]?‘sëÙ`&Jƒ!aq’‰¡.4å´içùqžV­¯úÂMç=¥½`è w©–‘cü±‡®Ø‹¬/åÆ¢ c“´¹\óDü“ŒY³¸vëô°%÷Ö2_N½ -¿§™våp?åivYO[t³¤trÕdeÁC½`ôžk44ùg¶a}2ËÞ÷-Òá¬leÿL±âf³¡}6„¾ ØÙÆŨµÐ@§îi§²nD?Îù3) -o‰ŠTöF`Ô¨ªR¾6^ñȤUZ‹z;Î<Á‚‰Ê( -!á»/BY¥²vml£,R³3‡À²O\”æ â±_mßNÕ”Í5C9¿_&^v=½æ(Äh‹ÂŠÕH¼i5ŽE'܆m¶"o -PB=‡éw([#€2¼3<ÿ†ŠÑ“µ*nRB)¨qnÙG#6a[–¢2r6 ÊäÈû"lü"GÚ‚õ¸#áC´æ/‡p$ ì:;sîŽÃãË6O˜´sV8Ÿíöd'u\ /Î4_Øl5ÂkôÃUÊYR±2¡&œ„¯!@ùÁU'1 ™Î9}pl¶¸8Çr$å|#Q…j„þa*Û–-®BéH¦Ý•E஘Y?þtž÷x®²a‰¡£óp¢ÚÅçaŒêÅ€œÎ…×Ó=ñìmÓì_ßݵªkÕÄǼ¬Z•&íÝ¿Rhf»´ºK7q®ë»¬HÒoj¿ÝŸö‚rþ1ÞÓ‚IÎ@Žäjˆž°p3 ùöxΨ<·£úOìaêÅ€üÂÉ'{âÉ•¤È¨¢Ÿ€s‡-¼Ë $׆òÊ«¤šë@NwB ìa UÎ8·øÌ2ˆN¼›»´95I…„èÂqÜÄ)\u§pþ°Í(“ß2˜|ÇvßÄ1S¬c\SåGîj‚xób@®{×R<&ïWB"e¶7)©lu!äð&±øym»ìCm ž7+qæÀ#xBµD­®°¤jŸ\±æ…fË>µ=««?¨’ƒµŸAí7Ç•\ð$Ìr¼û¦è2W˜èB3ì\"šM\dp.Ó?ü¤ë ÷m‰+±!Ç¢+U骃 -ŒÕ&•1Š©}“†õêOj²º!²ÛW<ýê±ä˜vø>=p-¡Jj&ò­´Y±ZÁ?†;B“ÂJÕF9òlX²#YÌuEFƒS/æ0ÈlÏæb>uÓ&IE()¯LžWaß>WN$êkŠm %å¢$üÈ) ¤ýKH…eU’uºŒ=òœ\àL»jZ¡ð@P˜1Ò’ªzlc–ˆ‹0å:¿"`¥ ®%¢C¼§ã’”Áq!NŸµx \¸‹¹ì•t¡ü!®ëv·—§¾\}#óæPªÝÒæ²­ ·Õè.ìSŸûŠòˆHÊ¢½èž4š¾ÜÑìnv|þ÷ïÙ^Ó!ÂQL?»˜d̓bjŠ9Ös¼Â |ûŸNŽ¢låuG:ì؉éÕLÉkëõ|•ºñÕ¿No\¾QD¹Ùð÷5MʃOÃÖ˜šA®ŒW --)ô´$”ý”K‡zå•+Äi^›g6½,÷½,(ÉÍM l¡º¾»ÎqòÊ…3ûªY0œÐ»¸u˯vHÈU 4jæGÊÕL G*\}Ø–<|Èê-i( 62¶¹`äõ¹™Ä,ý—¬"õ‹åA@bá‘u4ÝM¥Â@ 9Üòjþ9 ™N…µë('tF¹°+¹ð ¦À«¸˜Â K¯bèi¦“`mÛÊ—çZlèþË$x@>Ï$Áå>-â¢É@>m­Êjsw -JÛ¡²£p ê„ †æ ÊÅT× —À´%¿zIÉ/^jR§s‹ˆ f%‘Oi|(õa÷Y¢i,(íèZ«’j+¶Ô†79ËLR'íÇÆ#N$¾åx}’ E[g†Œ¿Åö|%BÌèi¹jZÊ&i½Ôž^(¯˜µdzÅpÝ_Ü'>Ú ¹ª…É2w]åªowôk‚Í„qŽØÆÿPLñ£,ä§yzé|ŽºWÜa+!Ûhëøí‹bèðV»}Öe‰—jYC‰‹fVa£nÉC³)‰¡Äý@â|1n í’×÷¼gYVT`C -ÂöT¬ðKŽQ†nznAJ+4¹)nžÉØŽ^Tº³éG(‰VèË>håå|òj®»T¡]õ(šéGL¾¶³4^Í—GÌwån7—)ðÓ؆’¤žÂ#Û\ÅÓÓL{8L;|y•Lͤ±mÝôÁÝ£ÄimJ ¯¢}8Fì0é_j(§èR¼²Jδ¤ñ'È  úø˜æRɾyófÊÓÛê²TàŸeÿýêØñÒÓ*ÔÑeVú.˜´c°`—á)^_‡àgõ9àa÷ -=endstream +xÚ¥V[SÛ:~÷¯ð Æî`Y²âØi§@ ‡Îzaú@9S+Áƒ/©å4‡iûß«µ$§í0íj/úöâe‰‰Å1Ca:2ƒ †æ,3°¹’wQŽRq6t§†{âM‚ÑÌéüÁ>5§ñ•uô÷Á‡éñ¿¶C)µ<‚l'Bë£M¬SÛ!Öäðt2~-¥—Ç@xÖù‰¼ŸŸœN$}`{¡u&Gç—“é…}=}oO€ÍÓÌÐ}1®®±‹HÞÑQh®âÌð? ŠO ãŸÆ•” LiÕ• Ÿ†Èév6¨¿‘ ‚=äyÄ |Œ|<¨Ó±·À…Ç îá2™ÛŽïùÖ•<þ’‡ËÓ]ñÒ½IrÉ]k{"@úµyuË„`ckïÁFRyQI"+VyÅâÚœˆ„žô1ÕNØÿIUËœá<é@}—¤é²,fŸÄÃâGä3ßlgH€€’¤J…(ʘ + ÌçàñÚÇct2Âe¿ý¬óà.¹Jrø½¶òB4¤ÃìÆbQ²¥²YËóÙ´ÅÝf\ãÔ/õ¹ûŸÌ´õÊuû[BI }–Éì@¥ªÜ{!¢ê©Š¿Uw=]äúxùòqÁfg•~´Š$ïT.ª¨¬\^ËVâ™Êdɾ¬’RG;/Tïð(»‰Éʯ¬ìè‚YÄ™ˆ(ø¢W·‘ô9`è7Unç|¯ó®öv'UÓBú±4É5øªPWZï¾X•‰x5M£*)Ô÷½¶Œª[¾/ùuQÞ-ÊbµTümÁ«g`d³Ûb#ÅI¾PÜÙáxקV÷WZÌ¢Ô­3,{-»ÑÍ6V§Šï¡ƒí~ˉp€fE>o·ÇF¥vA<j¾ 5톺ËË×øE;ÎçDôëäLrSaG,+òg¸–öqG(oÞìDӇϫß9Å”±ž˜jB·_h+ñ§(ýÞW¿‚úÚÞ%쵪«fn’'Še¾ zöט¡z¼ª=x~ôžrf tOÈæ¿ÖFu@Å| jÕƒE$±öaaX‰ çrw¸‡Ý¡XIfm{0ÄJcy“‚êè0i +å*— ‡½#Ê@"È’\ž1xŠRň^ÕB 3áHØÄB…Áý¾ò«ù% :À×Q¶ˆÍ ‡Oë׎ˆbäºöñ“™þ£u©Y ÌŽš]¨U0ß»ÑX J‚ÇxõZµø'°¥|endstream endobj -5803 0 obj << +6243 0 obj << /Type /Page -/Contents 5804 0 R -/Resources 5802 0 R +/Contents 6244 0 R +/Resources 6242 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5801 0 R -/Annots [ 5809 0 R 5810 0 R 5812 0 R ] ->> endobj -5809 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [141.013 496.014 469.456 508.007] -/Subtype/Link/A<> +/Parent 6221 0 R >> endobj -5810 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [139.346 482.768 202.339 494.336] -/Subtype/Link/A<> +6245 0 obj << +/D [6243 0 R /XYZ 85.039 781.388 null] >> endobj -5812 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [141.013 297.166 309.095 309.158] -/Subtype/Link/A<> +6242 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5805 0 obj << -/D [5803 0 R /XYZ 85.039 781.388 null] +6248 0 obj << +/Length 2246 +/Filter /FlateDecode +>> +stream +xÚ­YYoä6~ï_ÑÀ¾¨[usn$3ÉØA°H‚…,©mÅ:::Æñ¿O¤Žnµg, ["Y,ÖùUQ–[~ä6ò…£âmI¡¢h›Vg{+ÿÙHMak{Fóêf³ç[éˆØ‰·7‡‰/<_mo²_¬×ß¼üáæíÇ­”²\)vvFÖÏ;i]íli½uõþÍW¼úÓõ[|q­ïxâ͇ï_^½ç÷—;7²^ã–×~zs½ûíæÛÍÛ›QÀñh&FéþØüò›³Í@“o7ŽPq´}„wGHX®6 žð=¥ÇåæzóãȊ׼-ïZ3†¯"áGêÜÒ_±†ïßñÈEÍÚô÷`€ß=«KQ«¶€™cÏËÉíÎvC«ÙÁŸO¨xÎóH‰„ýýWh€ý;5?P†BFîÖö”T@ݗMš”û.©n“ýmQï‹Y¶³}×·ìWl€à±ï?32€ëœÀР<ó®Ov +ôí.õÝéùR ¼g04g,\ ½@Ä¡ZˆpucÆŽõ„†mD±Õæ(Ȇráê衦+tû${±³=dzjX^™Np>c`f<âfÀÚÓ|–äUSw£‡õûBO'ÈFÖA½æ>‰ DÝ=¼I«ÌÐ|`)bå¡a xcÒ”EÓa–Ü–SÌõ ?Ó¦®yVZ©>^Ã5šhE¥•è™¼5a žÔ1Ûé'“ ¾M…ë «A‹4‘Ïì–ëÝ¿]?çãYÅǓΔө£2 ¯• Y BÇCÇ„âRx»Žpdü|xO4ÃÛáé¹dq8_€dJ„€tàëuSÿêHïnhIu-¬Ÿ9qBÈè—v±k½üþ‚¸~ìŠØ•ÏŠ;£¹G~àˆpͤ‚'6ÆÁ=ù&Œ‹½ ²ª$Ëy¹èùÙߣ_;^>àž¢Ôwœ%·‡ºÁá£Ù”èí”±fÀÄÈp2`Sàê2äp&iµ$Mû ¡ƒÙ6w9„+¸ÚŽ<Ÿ+ËÒÂY$Ä,å=f”p~ñ æ`ï<*ò—I¬s8Ò Ï#Lµ¤á§"Ó! »’@:gîEšôEƒ))ëдüÒ ÄÌ¥CúS‘2½À$ó‘hêÈÛÚ<ÉH’;Œ°8°n(OQ0ڹΩ @”ÔÈE'Ë\'Ûy¶%„”½¡k á,¹Çˆ ˆèµÐÒ9=σ}çM‘eµ«Á·Zà YŒ[€k•<ÌÊám’âŽTí¨á§9 ärn”†Êí]Q°Øç=•á= +œL ímXm%­³2Wú˜ºAlÆ·l’²ÐPVÓHø(@yiäpCáÄ,ÇwèÙE‰ÒÄñ‰;`"a +ô0IÀ†+Ï q݃Ô#·ÁúÀŽÐ,¾PŠpžêLÉ“È®™¦Z–€™¶ŸÐ|d0¶ +¸8ð$„"ÐñæŠñOÊQV1"7£#׶2‘S”c˜­4NBì»fhGIöuG€R)j{¯S´S‰kÚ'Ø@ñ42("¸k8·t™œ¦Åª£æŽd$mÙMÿ¯ó@…ô:ÌDÙ Ò»`)#h@]èýÏw±J¸ázk^öŒÙyMpeLåx"ªr+¢k¸Å +º]ß]Dð¡Õ…^R· c\“æ<Ÿa¸´3Z!z¹‡Œ&;®˜$„Ä[Ï…+…ü3“h^öŒÙŠIB%”sCtÁ$:QYB‡I ZB­š¡Ì˜bBQXO›c‘ëÊ×@wz½äP¢˜6x ¤lsl¶Œ"¡µÄ·e↾†Ž0е&¥¼ì×Y Ë|5ií‡ÒúP3Âç'~ÿHløja‘ó“ý +!1 +fVqs¢cb…¡µGÛ·û‹‚á!E›“A¨`©™pçrݔԑÝ‹“fÖà;·±k'š6unŽyã(]‘åK€â 꽪‘øìHMµ‡Òˆ‰¤{¡ä"ÚÑ\ĸ¥B†oU(w‡?‡4+{âµ’B‘'B×3ç}&ƒÐh§£;.;d½Vn$"/x¶žÑ\lÞ Êøõ2ßûw;å\å¯Pšë7v‡Îp¬<-0ÕÁü +{Ó­Ã ›,Ü0è.ëDpå€1”|VrCs&ú¼JºBz ѹ”L¹É’³v­¾'«c@/Þ‚‚ã=RsÈ8î©3”÷0=/-Û2|É©g#O¼ñWŒHÕS­x>h÷Ðg÷¬}  R +_|óá¨ãiÝÓú=òx!îëúvHûaluÑÅ¡î `Y#ìL“nö1hº +ÑdPÚÒè sø\ñÿüžRNÊœ®èÚº)˜õÄDTtÐNKmëé*üô…M`8~äúRR}BSØæ ‰_ó£n> „!£¹Ô38Â]ýÜ¿lËôoƒ±ïY"¯×nßu¡%2² ¸PdOå5ÿ^8ø/ò¤(Žendstream +endobj +6247 0 obj << +/Type /Page +/Contents 6248 0 R +/Resources 6246 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6221 0 R >> endobj -1902 0 obj << -/D [5803 0 R /XYZ 85.039 761.463 null] +6249 0 obj << +/D [6247 0 R /XYZ 85.039 781.388 null] >> endobj -5806 0 obj << -/D [5803 0 R /XYZ 85.039 743.459 null] +6250 0 obj << +/D [6247 0 R /XYZ 85.039 678.053 null] >> endobj -1906 0 obj << -/D [5803 0 R /XYZ 85.039 643.603 null] +6251 0 obj << +/D [6247 0 R /XYZ 85.039 678.053 null] >> endobj -5807 0 obj << -/D [5803 0 R /XYZ 85.039 616.988 null] +2038 0 obj << +/D [6247 0 R /XYZ 85.039 620.019 null] >> endobj -1910 0 obj << -/D [5803 0 R /XYZ 85.039 531.856 null] +6252 0 obj << +/D [6247 0 R /XYZ 85.039 585.876 null] >> endobj -5808 0 obj << -/D [5803 0 R /XYZ 85.039 512.984 null] +6253 0 obj << +/D [6247 0 R /XYZ 85.039 353.217 null] >> endobj -1914 0 obj << -/D [5803 0 R /XYZ 85.039 333.007 null] +6254 0 obj << +/D [6247 0 R /XYZ 85.039 353.217 null] >> endobj -5811 0 obj << -/D [5803 0 R /XYZ 85.039 314.135 null] +6246 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1918 0 obj << -/D [5803 0 R /XYZ 85.039 227.829 null] +6257 0 obj << +/Length 1447 +/Filter /FlateDecode +>> +stream +xÚÕXßoÛ6~÷_¡GˆeI”l©@ÒÙ\ É¶ºØC[´DÛDdÑ¥¸þïwÇ£d9vš®Ý†ER¼;Þ}w÷‰Tàøð/p’ØóYêL“ÀcIâd›ï¬`å—A`%FVdÔ“y>Œ¯ã‰ø^ê§Î|y°{QÌœyþÞ}ñëÕoóW GŒ17 ¼áh:MÜ?‡;Ž÷æùìæå3Z}÷öB÷öš¼¼}s5»¡ñÕ0LܨòâöÝÍüíðãüõàÕ¼s°ÛœIѻσ÷}'‡H^|¥‰³ƒ±ï°¼€{^1;/o¿w¦h-rHë1K¼8a§h°¸‡Fà‡^ΔM¼4Ž ¢ä‹B Gq»—ôg/43¾úÊ£`êIèŒ"æMØÔ(_“ÈULÝ%@Xoqf¯ A‡Œ›CŒ&±Ð£›¸óu&æ'®±Ê­ÖJˆ2 +‚ë®PöôˆŒÖí²\ÑA ¶ð@ÇVÝ’ÖVXejÁ­·mš ®[Ü@pÛÀNa@Ôs‰²^»N=?¥Õ¹q!òÝ1ù˜·|ãaÑ—¦¥`éƒD•<„“EÛ=´r”|ê–Ra WèùŽ¦]C™pÔ´Ôu4jefGa`ÕôLÚí9ýÙð²ì·ìIIØÈ‚WÇNœoÍ)œ(C.Z‹XQä¾A¬£) Õ¢4îÜ‘tŸƒ€D–vß?ŽÀ‹áÀ­/ˆ Ò‡þ¶ŸRNþ ¢'ûendstream +endobj +6256 0 obj << +/Type /Page +/Contents 6257 0 R +/Resources 6255 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6259 0 R >> endobj -5813 0 obj << -/D [5803 0 R /XYZ 85.039 201.214 null] +6258 0 obj << +/D [6256 0 R /XYZ 85.039 781.388 null] >> endobj -5802 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +6255 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5816 0 obj << -/Length 2888 +6262 0 obj << +/Length 1245 /Filter /FlateDecode >> stream -xÚ…ÉŽÛÈõî¯æD!‡¬âšÛLâq=@flŠ’sQHÊmÍ×çmU$%RF­Z^Õ[êíô7üù›$t=nâÄwu’lòú·9ÂÎ?Þø„Ú ƒÆ ›;³»‹”ëñ"ŒàØÅ~êêÀG˜_ŸÞüüNyå¹Q¤7O‡ï+Wûj¥è`ó´ÿ¯£|w» CÏy¿õf(ŽÝvç;ÙPì·;Åο`¹=¶ Ͼ\ÎgÁÒþè€;‘séËæ¸ýãéŸ@ÏNnêEtÿs‰÷"à öóæïO–t¡<ŠR7T‹ÒÁ óåMËyÄn8åÛ@ÑŒo8¢ØðMœ©ón«=§È†KW =3”5"_‹¦øÝób¶_#_®~HáC4úáÆ÷@PéŒF/tì ï›­J|“l(Í´þýÏÇ÷¿á(JA°Bì‡2ïÚ¾= <}.i¯Å{^‰±ÔùøÄ{é÷½O<Ïø¶ ¾RI û D®®F58ÁVÖ3üËv—ÙðQcSb"o›¾Ü)” - -œŸNmuå!°WV?ñ¸lø÷T t#‘x”Ë…žIDì*‚Ûë3NÔ>:)°@Ó7X/»ÏÕ¸X°8{¦ãÐv| ãyE€Gž e]¸SføAž· !P‘vÎ- -##üÏï¢hòª!<&\g_Ëæ¥dõ¿yz¹qš -Ø[¸=Ž()d1œqÑiƒˆöPT¬Ÿ -^ø’Õ¸ý"gû Ü äè3K´Ëêž7²žÁÍ)’p@Ö9BÑòæp¢7@¹ìRßMêéS_P‚·ª£´v*ëDpÆ$¼TE ø>i©JÁAˆ"#Ð¥/0Mïƒ ¬ï8*ë3œßy@mbµpªÕÔpùߟÿƃ<«ªþ킦~&®Çì~«ýœçü‚hHÃN"}”jÎN’ÒK-½Ðþ"'A)Þâù@Ü€Ð3᳚F¾óň ò­Ì'˯åoZnùl†$VlμòŒ:…þ˜—Ð0î93&O¤Q™¸evÝL„8>Â…þ5üÌÖu3§9-«¤¥>C=£SýÜ=ÅŽX+°ÚÉ^+ˆ3þPÜþguÆŒ¹èÀy:•K|3!ÉUÙ„(ïÊ^G„:ÙIˆYGK‘ˆD[ýµçp&oR¿å³Åw”C•‘r²—h{ãüeŽª@Sxó•7ËϽÏ7Ä'4¾å“}K¿s9eÏ{àFÅ°Ž—n4/{‘  á“KµÐ aŠ.~•+Kk=üŒxØÆœ»ç‚T¹* ƹ Ìz,âÈ ›ƒ(‰Å#]["¡®Ñ!ÇÒ1¬ÇÛ T®¯Ç[U“‚ô<$©U…³ÈùÚ°dž§là‘h;°ï㨹 cìZ[Ι`ÿ™4JÌ7æ Ëd­©DYdhƒ¼¸Gÿª­Ý/˜š;ë–,v_Trâƒg¿S¬®8Û úÉ5¤âA[·À3²|;Š¿gœ%YÅÔªŸˆøÞ5ÂÀñèx¾—X!¼ØІ88ö‹ÂZ ¥ÉÏð¼ðÅT@D0¼ìüÄM°`CL -¢”/ñcô2LdÂýY>ðè”ÉRí •üˆ84|DDò¥wБ"–r’ÆÉy ¤<¦·G–À±jÁ‹I^”-°ÖƒÄI¬(,7.¬í®löü* 9ÓŽS1‚é-Ÿ$¹Ò¡9"/ &y—àb)¿¤$ʇAôŽu6&û$;ÜãEÑÈR|æ3}æ`Ëå~®âlL¯ BN‹Ó»ý„$Ò[œ±HX)v œçíŦ…*ˆˆk„’Ö¶ðP45¦ÚØè7ŽgÆlc1m™ÐRPÎijsS»ÀùÓf÷BråÛ.å °”êu_ŽDoìÓCŸ“V‰E{óäÊ‘ÈR‰p”áž;+Þêoòv”°1yßùgŸežÛ·Œ!¤Å0Øn÷mu!Cmåìdô¼ãå±SÞ(UéFgòaÁ^Ll4Ô±oí ŠP‘¥ïɬ¥" ëÊ:×ÂøI…úÖÉ1ö{J„AʃSÚ`€øküeŽøO¥-nHÄIÊÛÖãåéÀçÚ®Xà‘}µ[1ÇäZ¼dJ ̈ø=K98$KØ‹„Ô3³ÄqWüïBEU±ç“SFí…1+ÿ‰£'±¸š‹+¢ gÉ™!ÔЇ‹×f;qþPÀáëÿ9fÜ y ­($µYÐF˜’&‚O´É›„m­Eå¡jXȧ €)Ç\ÛÅyÒ ÚÁÚ² ‚¸Á…&–4“DxÕ›S›9j 圗J-H±l•Cð -\ÉÔ|† l¶K«:ˆ›\•‘ë Ô¶àúzôÆ£ËÌk,ø\vF•È𯷹ÉÉT»ÞJ3ÅÀì&@œÝÓìN%nGö&D Šï0겿Çäß,›Ô©&á ß'þuùÐ#ëÀ]C´ˆò=øèÇL)µsäNÍY2úµœkMœ1ˆÞO~ Îè8èGâ|„Јóߢ8'ø~¡ˆ`‹ð<“–ÏC¡êIq»&0uÓ(ýtF Ò IçB#[|‹Ò™àûŒ¼g=©ÇÕÎø%2nòTG+1ë“ž¥ž– ÒÛš¬bçG®Žúõ”æ²i_˜²‹Ñ4¡Â>¡²·Ÿô  ž³•L.ä•p„¼M2æ[8¾¡¯£VÆ~Î8©y±@ÍË,†Kµç›{6t›6_¾2dFõ]ÂUýZ¢˜I¬C160&.·è$x¾–Éʥç(è Õ*’ÊÚ,wM<6^K‡‰B«À°ð˜ý8ŽÖs ŒàÜu¼‰™HyªVB'ï -4)Éx`Ar "Ü<¬‚ˆ8QøÚ3­Â`lIƒñ˜òšËjn ôTA|"p^Ñœi¿ÎÆnºL¦ã.5¹V:æÞAZÿØó”d¿EiÔˆËØ4¸ ã{¦➈ê4¼kMPŒEÏ9ÈI&]šv¬G™Ò%ù3™­Þ± 5K|1Ui%ŠRîbˤÂt†jN}Ûf^-‰-Óƒ1ëÑ“Ü¡a’­ïi­äÇ>x½Ç˜ Ìz'ÈC7‰”éié=ss…?bŒ:˜îZ–ù -arßCÂF˜õÖ¯}ˆ>òkÞ¡6ázþ¡¤Ÿg•á$? {ZÍsûmÃ\°_gMv,¦ß/L†kÚŒ¤ûl{2›Pr¯zOö{m¢f¾žæÍyËmj¾ ö(»%5ô¥­PHij[°>W7ø+‡ˆ=¸cÚyF¡`Õ§ç5OÏ`K@˜”ýä`S™'[Š‰ýï¼÷ZRFºÔ+1f(¦,Pcù¦&5,›6—Ùêy¹<ðïèX®¼0V”¦^‚S ™°áB™Ï‚xŒ­ëø±2 8FÕ¹÷ŽÂ m+E¬XAÅjK¾•ÆTfE“gÆɘvîyA> àzà ǹâ$Çzéºð Ô´™ºZó±m÷?¾Ç^Æ_A¿ˆYþwÀ(vÏ -o×6•è=Ä·’\qsÓäëÙÁß–YGØãÇð*T*Ç1T6½ùÒS ¼DdƉ´yqãUñmòÒ´š5b‹8¿¯ñaŠEq<> ¬M:Ý3¿o1JBZ“éŽOz>·&É7ûøáÕäô‹ãrÎmÇ û/‡Ù#ÇeöŧÑÅɯZûu|Š‚g_žé“ËóáèBËCÇ ìcwN'Û·®!˜£»í|ûA­2ùÜ¡„‡µ™êEÂ#~›uÖwþÜBi]ÏÒ§ÚÈØX¸œ’ è=M˜O‰O{[Â<ÚB˜±AÂÆE9œÙ¥.°$—?³ÓXÀâ;e½ÖáÀŽ‹W³ºDN¢ +ÕEþÏÏó¬F;nlv"e~#R„qv/ÔÉ<…`úÌî¦D!Ä(t— E  Ä9E#jçišHm_úýÆq½­@<8 +žGù,M K|¯‚V  @gÊQ¢«9ì©O#°ÌLDí +¤ÃrT‹† ê…*tu6ª·Ç¨½@ÏkihŸ‹HäZ®¥rW: +-ãȨ²bVQ'Q¢Ñ¨µ""Ê28k#ƒ±ÂtRÐÜíÂ{¥\e˜¤&“€4Ai®·ðè‹œˆw%ò™(Sƒ17ÂcR1AÛ)à]h»mãD¥é9åMt©;Tªâf3&pJ "Ø™VU( õ€•îoÎ?À õ8éó¾bꨥ©ŽD’æ"ó¾ýá·ïÔ§GðÂ–Ø ê*`°e3ÓªÅ0ìÒ°Ëú8ò¾=>}hƒÝ­Ó‘>p\,×¥˜Í+½D‡1:ÔK¸Üû.¼„ |ká\Äe!×ø“F7ÊcÒêZi‡8°(|AgÒÈ©LËŸx_í ù>ÖÕð\ Ȉ€+®o}w?;ía s–W"ÖGÕÞ"Ê£Lðÿ¼pàÃVµŠj¼À¦Lok˜²Ä(ºµ,»™¸éÊ4®KQ­»PËk¸}nDžY<Ž‹`­°Xö]Ø_Fã¡Â®sñSê\_OE)«ëe$åáÝ%"Ê®ñàK|¶T¦ÜЉþî‘õt*b¡¦ׯàóÕÈÛËy!+ÙÈò 'vÃËÖÖ‘IÕZÌ·pèß~Àáÿ›^)ço øE„o!ø!úÀÅZпûHûûîÎaõ&‘·ÝxM¤&Eœµ&ó¢k¯‰­h’¿áíÓ"KåNmýýè/,Âk†ñÐl=˜ÈCöL¯'íñ.½7€‡¦¬9„ïÀדðïÒaf¦Ç©”{¾Åìe\qÜÄy÷¨¯àêZeòҫȤÒì”å=¨f«xýgÞ×-ÏB8%^Øö“þulozL²}Â? ¶?6ð=xl &Î=ú0^ŸÄønÀÿ +· endstream endobj -5815 0 obj << +6261 0 obj << /Type /Page -/Contents 5816 0 R -/Resources 5814 0 R +/Contents 6262 0 R +/Resources 6260 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5801 0 R +/Parent 6259 0 R >> endobj -5817 0 obj << -/D [5815 0 R /XYZ 85.039 781.388 null] +6263 0 obj << +/D [6261 0 R /XYZ 85.039 781.388 null] >> endobj -1922 0 obj << -/D [5815 0 R /XYZ 85.039 761.463 null] +6264 0 obj << +/D [6261 0 R /XYZ 85.039 761.463 null] >> endobj -3023 0 obj << -/D [5815 0 R /XYZ 85.039 647.5 null] +6265 0 obj << +/D [6261 0 R /XYZ 85.039 761.463 null] >> endobj -1926 0 obj << -/D [5815 0 R /XYZ 85.039 647.5 null] +6260 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5818 0 obj << -/D [5815 0 R /XYZ 85.039 618.764 null] +6268 0 obj << +/Length 2413 +/Filter /FlateDecode +>> +stream +xÚÅYmoÛÈþî_! ý@MrI‘ºo>'i}­7vzÜš¤d"¤VY’qüï;oKR¯Ú\‹ áîÎìÌìÎÛ³Š?ñà?I"×S‹Iœø®J’IV_x“5Pþzá ÇLXf#ž..ßEó‰ï¹ o1yX r"7ŒÔä!ÿÕ¹þÛÕÝÃÛÓ™RÊ |w:‹ãÄùyê;7Ó™ï,¼Y¾ù©ïßâ pÞ¿ã…7ïo¯n–<¾š‰s[®ß\>ÜOøéâíCo`¯ŒY u_.~ýÝ›äp’Ÿ.ǪC3þ€øýÚíÏn'(ºnǯWolÇk÷ÌÊš„QiÞ9‚nù½F<Âož0˜NÐظ Ò‡ßÇF‘õŠ‹ÈGñŽä‘™ò=§KËM!W»j1èzŸdíRZæ#ñ¡#ܱkªVìv¬µ(s]´¼`*nÓ+ѱÁe¾”8^ó&­;TS¼²…±Ñõ¶åtžùp¦¹ŸìÄ-5 ìëÈœ’eÍó4ˆ.È×Æz»Ü,îY’òçé,HÙ +ÚÖ¦Øy‚Äw^®;ó{”\£L4.åmtŠœ0iéͦÈÚr³Â [?íÈÅE^H·hvÕ÷°~SÚ²»&ž“ѽ£b ±u×›.v+¬â°äBŽº`â +}xö„±ïFÁYà6°P¨@ ]ÎG¸- ×ØAÕæÖÀ_εÞdU×` Á)N [ÏZ0ðF»•ãA°Gìï åÐ9”Îc)Î ý9géKÓ5þ‹*î‡ÑùÄ|­ÒÙÔ–9Æ53LûµeZËè¾0_Ñ/ÙhÔ3ΑÐfY¸WtßU¤v>VÂ… v0Ú^ÇÌa)¿…,‘yWõ¡ ¢UBÐb.†6îŒÞb•i‹ Îm™0Ò«–§î€zcådi…%—ŸR´ã+þ#û€&)Åkœó §“-TàKú4ø+*ÎeC{Òºbke׶X›ƒ“r˜8‹˜ÁœbiSˆ%#†Ñ$²´O©0S-Ä`½µá”ò¾z¨^]\ãC•ìƒÁœìZê–½•UÁÍ»h~8á›@Z Ϻf`!Ï„þÎ#ÚwCOY1ÔâxæÍÐ%ç´Y–}u» ËhæcuûÀµa1Àï‡Á¼0Qo°’ËDŠo4wÒ²‚Á»Œ·‹h¹lqÀõ°Þît’Û®RÓ× Y¿ÂÊF*FÞ|°«CpMç©Áþ‰ë5tšC÷§™Ã8(SX<ôlyVóP[Ë)ð‘ù„^$”`‘—bxá ëwµPâå‘ 4´±dЉ?)A¾›&!Ý#ò5]†÷=²;adÙ›®™ôH¤cÁ¿‚È.¡—c{‡·•í‘a˜ Ñÿs¢$«Ãx@0¾æOE6š‘fÎtì±~%àãKK[*ðk& Î’mšEöjÛ»çP›ƒ$çfŒ@Õô@ þýsiá ÌÆH@`Quˆqî‡÷÷`ŽÅÄÈËë9µR쪸Î2xžºï< ûJh# fŠ1†®m»CŽZ›c~“zVk)^T¯¡d-1îmû“Þw‡AsuË“uj ^Ó!·ì«{(/=Wpоö ŠÒP÷OÉSÔ"7 Ï·ÐÏéÒh™^«çöÅq_ãÑê8ÖH˜)ˆáÆBÀ6¼€ÁÄP¼‚BCÐß7od¥ÕüåÅ}e.¤R¾(F·V[.zÓjM—]RÀ3úAØûÂRÈ×8ÈmÖŽrŒ ;ö«G<”´ÊGI,€KŸ88_Òm¬!éGÔ¹U¼UI4׃)ôˆ‰g,VLlb×#½ÃÅ€ƒ—>$àÒ›–éu:bî +ÊDæBfžÐîA‰ Ô› Yéñ3‚o#ª‚õÑÑ9a^',„‚Ê\6i&HÁŠ¥`0Ñ»xÍ8^YM¢_ÓögìÅ’›Ò…!™{pl;k)†a¥M}ê-V6~S'Ÿ´œVŽýù"~†0üÛ]L~*é“ÄõçêÀr:å…経?£­Oø=uGó}¤îš~¾0ñ¦ÄDçf0îŸÉ™4Êùy%WqÉ…I½ÓxoÎkEÃÓnE~ú¹»*‡Á?P¡0gš¯ò¢ äžÒB.|PÛÇM#ˆœ_Ã`áa$TzÍ €ÊZ¾ð–í@ø‚æ°y CÞÉN"—H¹$Ènþu,<,¨‡ÞkôHïQ’…ƒlo(ÑŽß ‡4g©Î| }$ÙGÏÓ»7×åtÍðeƒ°2F;ù<ôÜàhàÁ_¾Üÿê¿è†ß””›¨ÑøÖ<œ +ü}{íåüo 9Ëendstream +endobj +6267 0 obj << +/Type /Page +/Contents 6268 0 R +/Resources 6266 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6259 0 R >> endobj -1930 0 obj << -/D [5815 0 R /XYZ 85.039 492.295 null] +6269 0 obj << +/D [6267 0 R /XYZ 85.039 781.388 null] >> endobj -5819 0 obj << -/D [5815 0 R /XYZ 85.039 465.681 null] +2042 0 obj << +/D [6267 0 R /XYZ 85.039 471.52 null] >> endobj -1934 0 obj << -/D [5815 0 R /XYZ 85.039 171.674 null] +6270 0 obj << +/D [6267 0 R /XYZ 85.039 431.356 null] +>> endobj +2046 0 obj << +/D [6267 0 R /XYZ 85.039 345.05 null] >> endobj -5820 0 obj << -/D [5815 0 R /XYZ 85.039 145.059 null] +6271 0 obj << +/D [6267 0 R /XYZ 85.039 304.886 null] >> endobj -5814 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R >> +6266 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5823 0 obj << -/Length 3465 -/Filter /FlateDecode ->> -stream -xÚ¥ZÝoÛ8Ï_Ü“ l´ú¶ô˜M{Ý..i®qÑv÷A¶Gˆlee¹ÙÜ_3óR´-w8ÈápHç›/ú^æ©ÄÅå<ý8Ï/W›‹àrM#.BŸR”+ç§ÅÅÿÌ’Ë0ð‹ ¸\<ŽtR?IãËEõ›wóóõýâýçÙUÇ^ú³«ù<÷>Þ-Þ˜…ÞçëY{‹÷ï0þ¯O>ôŽ{‰÷@Í/÷÷ô÷ÓgAø Ã?Þ}À”¯ï~š]1àÝìÅ/ïvÏv7´¿‚7üçÅo—î—‹À‹üò•ÚÒðæ‚vì§I¬ýöâáâß–Æ’KÌšâOç~šÇ§ -S‡Aaùq]ÎÓÀOƒD8Tîž›íšNÞðDg«¹M\XVu›²Ù¢½ê¶³(÷†¾k ±­ùäýì** -ï±ëOiì^h0÷ê#6¿a‚±Ð«0Ë%>tº át˜ïÒj ͽîyÿB@ºÈ„Ø/¼ùrOàôù&ˆ-W!s­S~¥U¢Â[Ò‹g©÷d(y@ámpϬÍíîE0õ¼´Ö ,c"»·Ý ð úå€)%º´kbÀ«vñCê ßƒ4øÖ(²»äÝÃ7o[nÔ×r<áý~hè.NϹé„ãÕ^îgǬK=p8!ú57è·Í’Ðú²£m„‡@NìëªéÍ•­dI uG!,‰sŸ‰+,­¡ÑcÈÐ_u›—¶ÿçÍ=Q*úrk.–/¾ìkõWeÛeÁ—–¢)IN×»åïxŸ ûr÷ñW´6åjF7+‡ÞŽ¨£™¡§GÒ›OÏßÞ±ÜVh¬™‹I®ôøJuw¥~‰“8üÕĉ^ùÀݾ%bñ<5+^à Ý¡·KLcâ ÌOlœuu9zÑ©5À–Qãù¬£áCê꬟º®„Á¢œ!_äÛŒÌÐðú_ÁIÑM²$™÷ÒwÐs±ÊDÉ\ü–{×S1G³ 5Œ5Z˜o KSÀåóèâ‡î§çAH”„EId0Æí~}uªÔ°Sër©÷žÄ™wÍ<§¹ÓûJˆ›·¸B\Dx!Ò=³æúa -cËõ½÷¸.ï’¿)VUã.Ê¿Ý…p¶ýo:•A㨒úÅ_ˆñ:ºct¬LOXäû…7ÙªyfÇ<§€˜¬„Ö4ÒÍIÔ³lZ»»â>P±åf¸Ã/-7wS®êm ÝèE -›ÿ ȈJ †à£¯X²Øè þ]–7‘O:¹µ³º³2 AIæǵ^™"­£jÇýâ톮MÍ –ºXéÒfðº -ý[ˆ´qƒ¬Û,RÆž±E/sÖ)Ë–;$lÍêžåÐ?“ï¥aêÏ£ä»Y¬ƒ#IZD£¡_°æŒI%h6I£Ì5öiG¡ÄoäLfŸ?¼~]³ÝÎæ÷îÎí)ˆüp^|O#ÎùÄ1Éc€&Rª8]ù»A¬ôºíl#b$¼®_—7H? cPI§RÔ×xi!"$ÿj¬”Y›L8HD -q€%‚dÝÚÄÝò†yîco±¯&nS/Ë"v #÷^% ÔÐR ŒŒÈ˜‡”Ê2‚Ù¹/b—ÐÖ@S¦ˆF<Ûƒ–ê…wYÄ&å«z¶$Y4Ý Q1$íÄ1m(Áhîd=;É?Ù0ŸË­^šzˆL}M©Ì ±lÚ*Á¡¸¥æäy7ym„_Ý^h½s¹²%]GL/³^L0²ísQ8rÆr 'Ä´yoÜ븰ȑƒ›ûÕ°·.݇Ù^Øü8æ´®.Ácò°CXuΛjŲi¯_mší(º´1&g¥œ0:WìÉÛk(«‰C’Q·Ì1ëaÊc+Rñ߈@uˆdƱÉVD­¨»,mÀÝS‰8—µ\o;¨çAft§Öš†pA CLh<é›B‡Ô PgŒYÿe*NÇñ0OMc6¬K7w¯tQõÃ&éÔtø¦Ñ­„ng Uy^€»*rº©Š–ÂÒ -M”Û•ÍÖ³$ò®á@×Z/½ÉÛ¿ñA« Úä]›Õ‚+b£"‰+P—;•»[‹Öw»îQtö@<¸k³›vE5.¢Vg™{ú™‰[ -ŸT<$:>µmLÈ OD …rcªM6KçA#ë¾tU‰ºªÄ­©3Ô>©-\ìvð¦#)`öu #Ȉ楲w²+†«@˜é„!O'‰TŒQýDê§Ú0ñ>åÙÔÛ ¸\S¨U»¯L,åü‚ˆƒ¨•ú¶FPبýåÒg‘¾¢1£ºfÁ¥_”ífú¾"XbÝs­ýé[.VTqÑÒf wæO󺕕ºýú‰÷¢‡$;ÁÎ¥ˆÆ'RîhFEg ÈE“¹SuÊ¥H³}þ–Mêö½·@]kc8pMùbŠ·…H±|Ej›¼pÿÝèÚOOu3ýjÏPj«ïnôù—Œ'‹à~»²Ei[qäAq -4Kìù–’-Ò<岤Œ?© ‹)/[y*$è[S·ÊwsعÚÕtp–Á¢Âôum€Ô Žò¾Û‚WÌÑ3¼¦©K³ÚÅ‰ë ™(7¥öÒ«„ìLâž÷Ü'?% ”NWÚ¡wl³ø—lŒ>sÑü€É”ŽA0rGÂ÷ç·õáo%d½QG”FéìƼ‰²endstream +6274 0 obj << +/Length 867 +/Filter /FlateDecode +>> +stream +xÚ¥U]oÚ0}ϯðc×ß±÷Ö–n£ÚB7RmÓÖ +”F‚¤ a]ÿý–nÒ*$°ï=¾>>÷ØpÂàÉՔIGRË©´–L–#sȼx‹HZHÒÁœäÑÑ;mgÔ1Gò›]M•–$ŸþˆO?_äg_z‰”2œö’4µñ×½„ÇÙÉ ë¿ ÙËÑD<|ýá§ãAÆÇ=aãS\r:¼ÌòQï*?Îò-ÁíÖ@Æ!»ûèÇ#S8ÉyĨt–<À˜Qéeô¨V²/¢Qôy[*ä «‰±A$ÜQ'ôß3œ*#·‚ Èrê´î +¦ÕLyÁ@£”‚<(•Ö,ÎF§}À¤ñE]]/fKœPP²xÜ“<®KT¥€%åü%U”¥p4XrÒ¯€&é0mË&ºž)·ûÀ…£&ÕÄh28Oµ_õ¡Mœ!ÛaŽ¯Kà?a¨‘ãì{ÀMŠz²^®0ÕŒ±ÉÌUÈÖ°lµÛÔåÆËÕd@{ä„¢ÎØS•¡žßá1ŒWaW´œÐi‹ÑñFoXLÂèæ(³ª-þP”×EyˆC"¹¤ÂžoTP¨Xá•W aP™¢œÓ§}UNS® éXåÿ}‡Öæ,% ó}zÕUØ31OõÎúùS© h><÷à&(dÄž…¨áÏÙ-&³lƒAñ”uÞÐÊ¿ç!„ýÃßæv—ÙàÛÑG€ÀÓºþbÐôÆûpùÞH4Øii—Ï~!~AHµÆmn `öuûçúCnxyËTØÚÚ—˜4‹G<ô@ÀÚw¤*2®ækŸB¡ã¢Á_®Z@x&Þ$Ì^ƒG=;ŒÞÁ|»ò>.®Þfš*Àë™ÏU‹Í¡09`µÄøØ?«!Š$> endobj -5824 0 obj << -/D [5822 0 R /XYZ 85.039 781.388 null] ->> endobj -1938 0 obj << -/D [5822 0 R /XYZ 85.039 515.724 null] +/Parent 6259 0 R >> endobj -5825 0 obj << -/D [5822 0 R /XYZ 85.039 495.134 null] ->> endobj -1942 0 obj << -/D [5822 0 R /XYZ 85.039 356.955 null] ->> endobj -5826 0 obj << -/D [5822 0 R /XYZ 85.039 330.341 null] +6275 0 obj << +/D [6273 0 R /XYZ 85.039 781.388 null] >> endobj -1946 0 obj << -/D [5822 0 R /XYZ 85.039 258.758 null] +2050 0 obj << +/D [6273 0 R /XYZ 85.039 761.463 null] >> endobj -5827 0 obj << -/D [5822 0 R /XYZ 85.039 239.886 null] +6276 0 obj << +/D [6273 0 R /XYZ 85.039 741.134 null] >> endobj -5821 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R /F56 2890 0 R >> +6272 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F62 4047 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5830 0 obj << -/Length 3646 -/Filter /FlateDecode ->> -stream -xÚ¥]sÛ6òÝ¿ÂÓ—R3Cüì››¤¹Ü5Ž/v'7Óë,R2'”¨’TtýHJ”;NÆ!°X,‹Å~AáuÿÂë,ö_§Yèë,»^m¯‚ë Œ¼¿ -c)(ËÎW¯J¢ë0ðó ¿~Xtb?ŠõõCñ«÷æ7wï>/–ZkO…þb™¦™÷áöáÝûEè}¾YdÚ{x÷–Çþôþ@o±y÷Ðüåîþÿô™Ðü Â?ܾç)_>Üþ¸X"àíâ·‡^½{p<;n€¿þýê×ß‚ë6÷Ï«À×yv}„và‡0¼½Žý8ÒÒ¯¯î¯þíHñXtͳæäc1–aîç*~Y†IèG‰v2T0úy£ ÃPù:T×iøq‘An‘»V ¾8¼tVmÓ5ëĤÞͪ¯¾•Ü~[µåªo:ðÚg% JQÙ~«V0±ÄNwIZQæ‡iþ2ÿñÆ#pü«œAÀÿ=ò»[!¹öjÓSKy*ÂW‹e¤tØf»P©÷ˆ-276¦Ú•·û'Þ’2ˆ\ÕU¿P™÷,ãj¸YíÞ—­YážQVyè±%Bcq"Ô‰ _ô® j@åè¤ÂX†xÚ¼9ØD3²Ä;tÕnÃM"Ìg©÷ý­é±ÿ É” ûÂ^‹ò{Æß·MÏ â£©»WÈEîµÆî¸c\Üà“ÙIÇJˆÞ>D ü|÷†œ;n…—5JåýBRèmf6öó[døæU(ó ¢Üþ×ÀQçµÄ}èå4¥Ã$’ÜŽ»[š°E’´Q·%PÙö€Ôw -áùðå¶@;‡NI㇭c„Õ*ɽÃ"´;ï,óÅÌ7mƒ¨{DŠb8"fìHµ¦~fxÿT2bŠºd©Cïˆl«€0BÏðç íJ}åÞª®˜ñ~4»9Ô(\”_”³´ eˆöÒ0>IÕÉ  9HâjXQÚ•Ï7Kwë@Š'¶žÛ¦-¹E›þo&´ç0Æ iå45ÐäX•»L–{•U˜Ym÷uÉ'Ä *oÕìü æ'‰3_«äEó3¹l>“(ñã‰ñÔbä6þ ýH'³/KKk9"Fuž kmû‰ÖnE2[(y¿kfäå@SÉFÖ͸$‚ȉ+Få~êÉÅx´î:ÌF'’óíâòÍιÓÐÏqŸ&?¥€ƒü4Jÿ–ü,­åˆØ¹üTúÔ¹©¼Äê:/Á8õUª‹YÁƒ½Ò"“7ü9ÕÒ0³Z -­â™3J²ÞZ‚Í0³ÊŠ‹5b8KÊ_ëpr4dzÔ8)F»©Äi9Æ]tˆáX„yÅÛ;žK6Vþa뼊$‰1N^S¸¹²©˜ÂŽg;ÜBO%9]9eɲ°)Q7m¨9·\sE,b;ŒR Cz<¸>íFi…Ž[WÕÉ~Gn†ÀmmÇß“bSa) ‹½aÐ$VÁ‰–vOU´]7YÛ¶… -k.…¸Rñžæ÷/È-ë˜ãKl°ë ·©i¦©t"%ÎÓ -rÂ4zÅéw'i+¬TWwÊ2ãl £¿–5¥~†2…ß/F—<õÆ‹·oNöä=9áŒVJfX ‡XIY² ù‰]€>x¼Ã¢Ä™öµŠÇöm*" Í8ÇŸŒe1¼y‘B‚u˜³×Ÿà³I.÷F¥Hy´— -3ÑÁËOf#œËOfaÀE™¼™EòfvG¥‚ÍÆ<Öòvvs ‹b¡Jþ -O‰M#ï³øÄ­ é¤ÎX^úÍA˜d¾N^~[á\~] cˆ[s>¸eR*äš<¡¤ îÙßñb÷0Šÿ¯x®©Ý;,øůh@9TÛ1„ê§ð½Ã'™›¯¸çj‹ü°Qyžú.aD.Pn‡è‹E$s ßØíØ¢¾qWeÚêÑ0sÀ‘ÌŽ*#ͦ~„ Ýøó¢À¯G²/îL#y“Ç*´ÌØgGÑt®ð÷XϽ:õiŒ²A‹¾~擇±á>Êû ˜ÏBwùù‹‚Yïx*yGÄ(xvR+'ÆΟ3ñ ˆmPí²rû¤%tG×L=º9ÐÛUä=vô¶¾ŠGƒoË¢h¶ûÊÖÒä$ªDÈEFðò¦Ápp¸^%ïhôüêVÌÒš‚ †rÉç]H»ÇŒÏýì`Oe[ÐÍCmZ.ØrÅ¢¸‰^Õp -'IOfÕ¼û“0Eùðâ‰Ø’¼âªaàä‚!ÉÂV (ꩺb—F˜Á¸”Ÿ2QföÏÜ´Ú=Uk8û“ç­ÆžÂŠæ¦ÚÙK¯‡'^zx˜þ0±J5-E²Ð·V¥$4…ƤF -}Lë¹P׫•™î”—BCB:Cv[Ô™ìä„¥ó}Ï…÷ÎÓ {Ó‘}q£g=ltnæ‘Øý" ˆv¯ãhwœÔŒëLj|þÔzÉê2ï9_¼±¿õS@ç‘"ígúÂàb¥|Z^È£fá)¿±Îü8Óç ÿÕ’,þendstream +6279 0 obj << +/Length 1950 +/Filter /FlateDecode +>> +stream +xÚ•X[oÛ6~ï¯ð[d fDQ×¾ í–j·+°í±i[ˆ$’’6ÿ~çBʲ#gXytnüÎwÈÈYr–'"TÅ,Ë¥Py>[ׯÂÙV~}%Dœ(‘Ä1Œ'~u‘F"Œ³Igc‘ÉB¨X¢Ì»Õ«ë÷Q8‹B‘¦j¶ÚzGÒ<yžÌV›¿‚(óE’„ÁÛÍ£nÖf3_¨4 >š~®Âà;þع’A{Ï ·sèf¾€ß Žj4ýüŸÕ¯nVƒOÞZ–Š<}Ùë‘ y-“™ Ec¯U(b“׫}ÙÍQZ:`ÖøÛƒ¥mx~cá™´ð0GQ®™GyлOðÈÓ–Xß›VW<_vÿŠÂsâý^÷<Ò-/E$gËs»Öøå²fÍÅzL*‹ö–ׯ¸Go¾ÏIôÞ©ÞÔ%®—¨Õ½m;Ì-¤l! åàûô©L±Í¡ñ ~çÁ™ÖâÒ#þžlŒ7±—÷<ß2k1ôvMÂq ×kNCÇïk˦ð;[½†É\Ql*‹ýÐÛZ÷ÎN¿wƒ‡ŽT´,ÄÛðX¶C­i‰u’6ÐÒl&&JñVê{";eËêä@ÑYÎûÙ¾¯8í8KuWšV\m’ ³ôEÐŽd|©ÉŠ/6I¡Š¡Ô$[\ï±®0­G˜JS +›ŠìiÌß¡Œ Ý%ê]<Ê\¬«Df".¹øi‹u²ˆ%€vÏi‹el˜à—r›é`Œ›HuFb2¸£Ê;C¸qõGJ5 zèâw<7Mœ÷˜AdÚ¦6ñû³úÞT•³w8 Þ®K€ç†çmã\&÷AÍsЂéÐ\˜§â°ôê-ZÒKàÜŽ3ªP{ý>ÉG¹—Q,òl¡ +£ê{Tã@Gi@ï{\"ºÝu¬æd “\ÄÔ6¨>p«´s² +„à…S4æêhŸ"öCâÃóŒ£Ûí‰ð¨ì¨bKûÐUOó<ÎišoYŽ->Q2W"Jã“dHz˜dÄœq’ƻį§¸w2ž1sš1 +¯«³n@Oô âÂ_ë;L&PßCNÁµµíMåk‡ +ìuNÇí’—þÄ44âYò–Ò:°¨PAÂ#¬¨Ã@´˜ƒ0âýám?Sð*Ò­mk6BÂþi 'àÓÞÍnùyÌ/¥th8@­ÆËjožü¤‹ƇJ¯‡}£rÜí0w= +$Ð+Û.²=Ÿ¤& +Áù ;uèMËu 0,8uù¦@`v0¾}æαé\jáq‹pú¸=ôÇ‘ÌÅg‘E™oá‘k០R÷ë¥iMË㷔Śøö\âA i„pk› Îz#/9;’!gOŠ×£àL¥äìohI%|VIüŽ,Ø™žß¯¾tä5òšn€ãÚ+^àMF ðyIY&~aéœ/´ î#Ê৉þtZKªf:WìM‘Ñ¡Â6WÜp¢1 G_ÞÃñþkW1O`þ¹‰¼æ“ÊÞ³2Yp*œA¿8öC*\˜ôÊ· ŽßÖnÙtWΔëï§TwµvÌË„ëÛcSa L¡t)U­†§ç4B§k´LÿRð·gŒÈ _Ï!‡sr8ÈQ ÛvWì„¿#‘¾Ëì4¡ŸØ çuëâÔüÿ8ë²ZL”ÈpxŠÓ"ضèO ׄ[¿­üúXj'vàÉ-ñëgLps"¸7I‘ÅaÐI/Fâ<Óù¿0¸üüuõéÓ‡†iEªN +ü†92Ši¢"p=ËE˜œˆ\>„"*¦á +§3‘Â"‹ [*Rçn%* 8?è9·ø/Öó endstream endobj -5829 0 obj << +6278 0 obj << /Type /Page -/Contents 5830 0 R -/Resources 5828 0 R +/Contents 6279 0 R +/Resources 6277 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5801 0 R +/Parent 6259 0 R +/Annots [ 6283 0 R 6284 0 R 6285 0 R 6286 0 R ] >> endobj -5831 0 obj << -/D [5829 0 R /XYZ 85.039 781.388 null] +6283 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [268.952 172.675 539.579 184.667] +/Subtype/Link/A<> >> endobj -1950 0 obj << -/D [5829 0 R /XYZ 85.039 761.463 null] +6284 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 161.55 103.217 170.209] +/Subtype/Link/A<> >> endobj -5832 0 obj << -/D [5829 0 R /XYZ 85.039 741.134 null] +6285 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [251.226 118.478 539.579 130.471] +/Subtype/Link/A<> >> endobj -1954 0 obj << -/D [5829 0 R /XYZ 85.039 658.326 null] +6286 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 107.353 103.217 116.012] +/Subtype/Link/A<> >> endobj -5833 0 obj << -/D [5829 0 R /XYZ 85.039 639.454 null] +6280 0 obj << +/D [6278 0 R /XYZ 85.039 781.388 null] >> endobj -1958 0 obj << -/D [5829 0 R /XYZ 85.039 182.516 null] +2054 0 obj << +/D [6278 0 R /XYZ 85.039 761.463 null] >> endobj -5834 0 obj << -/D [5829 0 R /XYZ 85.039 161.32 null] +3123 0 obj << +/D [6278 0 R /XYZ 85.039 653.495 null] >> endobj -5828 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +2058 0 obj << +/D [6278 0 R /XYZ 85.039 586.876 null] +>> endobj +6281 0 obj << +/D [6278 0 R /XYZ 85.039 544.591 null] +>> endobj +2062 0 obj << +/D [6278 0 R /XYZ 85.039 404.088 null] +>> endobj +6282 0 obj << +/D [6278 0 R /XYZ 85.039 363.924 null] +>> endobj +6277 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5837 0 obj << -/Length 3600 -/Filter /FlateDecode ->> -stream -xÚ¥ZY“Û6~Ÿ_¡·¥ª"IðÒÛŽ=Ž3©Äãu”òVeóÀ9c -Iy2ÿ>}%JNÕ–kL  ôñuCþƒþ"\O­Iê»*MÛúÆ[ì çý/+!YY4o67·ßÇáÂ÷ܵ·^lžÇy"7ŒÔb“ÿæ¼ýáîãæݧåJ)å¾»\%Iê<|ؼ{¿ôOwËT9›w÷ÜÿÓãûGhý€µÐùŠ¿~üÿ?~"2nþÛ>¼ç!Ÿ>¼Y®°á~ùûæÇ›wóáø[#ÃÞüö»·Èas?Þx®Z§‹({®Ýõ pìF¡’zuóËÍÌTÜ.xÔÜùD*u£TYäÊ ‘Džy!Ðç²Ykç >¾“/Wa:ǾÀMõX‹œa=–c';ByØ0&u†*[¤Ì†²mxl5Ù®¨i¦âö¬‘ÉYß¿,ƒÄi»üúË4tî~ƃ]¬d+bM¬—BLÜùN÷ ¥Œøºò”3´ø Þâ@T»©†‚{>ó¶[œè¥ç¶þâV{š­ë'óȬ/ò뇇ÿrCÿÚó5ÈY²²Ù—22«`²Š—‘£Å±°|v;nÖ›lù Sï„lANð[µ;($kd;hR*füa.±TÃÁé㥖M!Dúò¡ü´\A·î8êÛ7WÃä΋œWÍvYÙôÃd½þˆÂ1dOUao)¢}Ä;(ë¬{…c#ç¾­3dËo[^§kéÈøf¡äò¼¬–PNUŸ^´l3™/«ú–K¼mÚêNÆ›+;&: tÐT(¤) -i/¡cÇd8×W$(fnŒ¦¥«!0§5´,4 ÙJ6„ÖÿŸç+*lnÍËNó¶ªWnD%ïæ'›&ô™Ã„òåÃD¦gTJ«Ü*ŒcÚA'¬â-žpîð°;š*gº'\ã•Ë‡ŽåOØÊQ -šÌ£¹A’ŠÛpFÚ¬GR·ƒm“ãha¯°Ûï•mÝ”»k•Â]àNn‹a{{Èj7¿eÚ‰%ŒS -LùÜvlb˜ìµJ&Rhm…öœö-ÓzäL± ò©~-·f@LDÙÀ•®ø“4¢+¸~®X¶1ÅjÐYÁý~¶èhñL¿=Ÿ¶Ñ˜aF^颓LC^pé Ý+—i½l?êÆ¡š[¨Ð0ìeô(E0Œ¥‡ŒŠž½”Í1BÛ[þ œ–Od£»W¦ªp0hâá÷rÐhÖOdëÌä œU¢4QÂ6<Š\ŸËèEjr B÷¢ï‰kk'ÇÊœ(wê«6C;EãòÕ'„åtwHh¬‹>’~‘)Y‡”¾/Ú4fswŒÞVo‘Íi´Ž´‡J§> ž3fì¡m‹Åâ,ÏÉ}ì°ªÈBk£x‘æ´IØëVPiøg²8΀l«+l¾Îlµ`þŠRøìÓC/€ö&ñ-¥„JSˆcMö¨ ;Á”EáA£å4pJ‹Øž @ÑŒM -üÄSmiÀ¢D&nš,bТ|&*7Tñ,H\ÉT+k.‚€S#>ôb³ ²õR6p¹ ŽrÆRnè ÿ5kb~‹û.å0¶í¡Ô—ó!í̉îñÝÀ§}c·UùtÛÛcW¯sö:U.€Waƒ$?ˆG3Àb££ÍÁŽ­å÷¨ÁRº>A‚†]Q_—ºxÒîžµëØ‘u²¤"<)iïÄZË_Dg¡ œEhš"@¬=Þ²'bì ðž.¥=¸ú4÷\¼ÃÙ+…v†•ÓwÄÔ\ØK»*‰¯ïe¤™ ªô^ óA³(¨šøì8 T+XuÜØvÜJ! m [unì -Ø8Ma^È€ÏFi½ôÜL|K©—ÑøA`ëkkêÈIHJRXÍVPm€Ã˜6×¢+XnÜ¢zyŸîჱ7¶°ÇÑc¥Øë»+w{š«zejˆÜ&<Œ%úÁÚ@Ë˾$¹çê>“é3®wŒÀ±€Üùöxû°`§jâ 6=ÀÞ >„Åd°i >r ˜[î(sËûI(Ÿ_™`®øè¤Â0£°` Xî³Z‚Z¬u&” 5ž¶N¾U°ªÍ…}EÏ\æT -­Y =Ð&%4_§è_ÒñJÖóŠc¼{¶œµÌÒ Cu -E¹B\0ç/>Ö¼(ùâN†§”ˆeÆV^¨ë3÷ûM´Q¥1ïfmà -vTJ@Räxwì,5!šÁ¦è‚L{È:!À8¿òÁÄ’'€ÖÑ -@ÄA;ÆV’„Ã$…‘j”‡³ÆÕs×D¯K &Z/°Iß.×hAtpç ¢?o¸—o©J±;ÇA ¶4cβ(ÐFYø{[…°…·d±Õ“Å¡“d3»;]"€“Ã%‚”ÒU—Jé1×·_QÎìóSŧ„-xÙ&/°2”uʬCºëqÊ9YP¶ÊD®'iŠ¿„œê%1êkëKi‚‚÷Ü™¼có(K9vÓ™gµÔ4%sÃÛìåäÆÍÄ&BØÃC!µ}Q_ôMo#pm  )Ž˜+•œÙ„óý½”ˆºƒÔ?K™P#Ç¢øT}ÆêXnm7¤\û©daÔ%ë0¶K}s9m¹«Ì/NÃý(}ýyÞ„-̆Mu’f%€<ôÜÆI‰Ki¬³ÃÁäF žu:ÉšBŒ@L,ܽû‰Rs=ˆ='7i¼@,©€E÷f<^ÒY(φìÉ$¹Š‹ÉÕ}Q! !Ç—øE/Š93<©'.3îÍž²^’Xäæ8/qó@S4ýhH¥M¼(L*î ´N ŒgE©ÉÃ@¿ø (ÉðØâò\Á¦÷åäàV£Xeœ½M½wÁh¹qrîZ4—ᮊÖn¸ ÜýT Þ=V£Ù·Ùv/òq©(q£àúk‰Es·*µvƒ(%¦î´m-˜g4f¶¹ŸQ¤@¸V+»@±‰5ÓWíÀÖ…xª,¹|,0 5œ•ÌNfAxPUð]̹`P›£N1ÌäÁõ£‘ßÃ3ÊõbjÅèݲ°`M±cõC+YLigh1 ±áäFmÅxÑム-Rd²Š¤µvb[ÏMô‚\Zšš3Em¾80lÀ÷(y$™J=¯9¦þšñdHáíÛ‹;úãU¯*Yí’1Á e -2à›KšuÏ>“€«Àb‘%ˆ1ŽÓ÷&óÀw„$X£#/UsX:y dDrqdXÂrÆ|ª»ËeòÚqlÎØrÄVöè7FýYÕ¢aæn¸wnäÞΟǢAß‹‹Ì`UaŒÞ°Dü7#ç;Ô,©$´€Þ•Ë’®ƒ’æbîr±ör±COPš]q’07 M"Ëç0/˜R¿/šbŠ’P*sc6„„M’dRQ"7‰à¶žGè4”Ća‘£ dunæò±W\½—$ G‰H^üuà }Ž'M5’N¯iÒ™¹D¤ÄŠ’ò…ø¤œ»ž&R§€44bMÕFHYãjBïÝ¢üg`‚Ìf¢u"½Ø2/)©š‘MÊ \Öœr…©u¾äSW¡ÏÐû1‡ë«Æ ûçã?ìÁt:NÕ OÁBmRÌÎw¬rôJ=]ôÃß´>ú)’Þ=;¿ŽÂêœß‹R:%Hotí8ˆß›Uh–Zjø;æÁ•2ëLlÌõª`þUð™ln}š D«1tý^x;X4Є® -c;øëØ ×ÐPêÎù¡é~ñÖÚÇc -ï-GØ^Û'0Ϫ¿VnâWYµh.Ã? \Ÿòð³6K ›˜¸§ÐëK/Õ–¿?¶{z~  -a :eÑØê”ÝïZ™eˆ]lïvBðÉb\¯FêsÆOfDÆÿ(ðÓ<ü»o²Ã¤$ânÛóW†î)L'ܦ&¹ÊĉnèMxâˆƒÒ /¿~u¡¬yàüðˆ|b -“ÞòÇd<…"`Ö“PdòœÞ‹ð—ø@z)£ØËõZ›G¬F ¯tTÛ®»Ldlôo0p…ðÝ @¤Á/:›Â;ìÒ`ž·ôÄâxòó,tG·ÆÖz3˜s¡Y¶5‹0¦LSí’Ó_èlÙôÅI"&]Ëó[Š€ –žõ™ô'Îÿâ~6Àt@Òrìåí/µœËYF€Hpêß±y®ÔI¦¹¸M'>ñæ‰áZlÝ~¹ûùÍ•ë]2t¾@Tv=H²h.Gniê&Ê2s¾ãK܆/ÍÀ¯ø£´Ôžl¯›5žï[†â²I‹S×W±%òÊómýÀoVè•ŒƒDw͇Q&d¸qNþ ”?*6ž>ÐFï4ž'â …Ž^2ózì‰÷ó<þ=•p¾:‡U?Ð#< ðÄõ¹Ào¼àk3SÉäÍX³ èÅ7“W &A[Äá]¬à HÂI‰s“!Š×êÖK]Ïz®jâìÂMž á=7˜Í*À+Áÿõ«A#J¡rSµž—¥(ÜÀ×¼€§Á)¿ú×…g ÿ ´ä!Ïendstream +6289 0 obj << +/Length 2710 +/Filter /FlateDecode +>> +stream +xÚ¥]OãHò_Í“#ãïØ<܈f—ÝnŽ‰vv÷ÁØba»³¶CÝŸ¿újÛ ÎH§‚nwUW×wW5îÌw‡¶ã'³eìÚ~ϲêÌ™=ä§3W0‚²á|Z]|£™ë؉“ÌVëNh¡?[å¿[×?_}]Ý>̾ï[žgÏËel]Ý̽Øúmuu};w­D ¬{œ¯¾#ø_¿òÚ—9b]áÚO·øq{¿šÿ¹úåìvÕ3Ø Ì$ÈÝ_g¿ÿéÌrä—3Çö“x¶‡¹c»®Î€=; |ù.Ͼý»'Å°`Æ»¦”a0nb'^øc…E®D~¯0 íÑXa¡c‡N@ +ù ¥0H¬UéN¢¥u£Ú—NoùuÖé3À\«‚Uã¬;¥”`i/ÝàÇl8ĦNØÕõìÈa»®6ªãƒ(²Ò~ÂC†ÚÍ‘3oi=Íð—8mZzÍ#ˆºmVþS)„<Ys1D~ÜY‘ð®*:­ã}­.wàºny¥Û ªܤ5|= á5Ì]1hݘc*t³pÁÆ!ÉJD½{Þ€úãÐÊtËêv­òmûØ+rëF3¼ÖOJÅxôѳâÇÈîZ;¼¡zÇúÇõ‰žk}$ÍRvEÅJ0´Ó© +Œ•°ñP%ðÕ±Jp5-S! +ÅmºíƲ Ÿ '„`Gd8ɺâWè¬nhÝÕˆN@ycô,¥ÍêýÖI +ˆû¢,yV+¢˜óW§y/¾IqÇždwÃhZ ®%gºÎÊ]+‚~*£!¸ß è:冷ƒô8ë¤22Qr>+j\äâ¸P«ŽÙj]ë…×ó  WtÓF×&ƒÛ'B8 +;Œ’†ð§Ï4® ÷!y d<”i\ËE †¦t¸Ž£ Y_8ÐTÝqâ0Y°O"ô^I³MQ«É\Ãò æ½ÈŽ£ß+#œ“ù'L`K¬Ød¡µÖ%º»FUï +pÐ|­›*Eçǵ ‹_D”À<ìÞ*g va0ù–V¸é)åÏ*-Jt£ZN)%œ$BBŽp tµmxâóºç_úþeèð×O˜ÂWqßžp¶;L[N@^8!匆}S¼Å„ aÍ)pJì R +ÈXˆYŠ*/:“çdfAПð‡:{BÙ04ÝQÖÒ æªñ…]©m Ãómƒ¼¼ÎQ™œÜ(Îäð4ƒ³Ðñ"ˆ:´å{ñEÆEÆØIë–âIIŒQðúHzÛ`dæ; +qôàœÑF!=ø ƒ@Ô Ï˜·J1ÅLWã˜4çÍUš“kÒµÈ~Ÿý±×‚8oGþ’Äù™i’‡Múªx–ò°×u®šõ®äϲ¨w_´iõ$ðV5¯(9Λ]]耴¿åñëÍ5OÖº9  ¹h¯›—)žîõþ€¹½Þ•¹áãEøÄÀ ª¹€Ì%óÜT'ø‘¥Ûô ¢¤+”ðÖÊÞn“v§ÙØŒ²Aﺶȅx6bG?cÎóCJ‡¼µÖÄd-ž!´¢™`v'ãºáô5ÍÚ†|ƒ83Ê…K~c Ö]ófOëø]=a\¡íYkŽœ!};Rz>¹-‹vc¶íGžÞèÛÁ]šÒ*ê\ïÍQª©Š:-Ç>õñ´Ø'i¾àÎ]Ï;Ã~ÑMØûR´ÌUªz2JIJðÀ ¹†d[©ý4³Ÿn®Ï!D-W†§±vë7}ÙK{-_¾ñø}¬¯Ç¯‡òª:¥"õØÿÙ/O²¦^•ÈQ ‰vÝuFF=Fìt¬‰ÿ“w]a!ŽÒöBý½UM¡êL½‹ñ'£ží¶QY‘vÆÊ—˜£9±¹S‰-¢ó®(/ÇC‰¿„«ªá‰A®òKèú¼ÄºÞ(ª¾^IcŒRF°ÄÎARìž¿u_m +Ý¡f_JùÇlŠ~ã9£®õáþñ#µzmJ±;•ËãÈÚaìÏü ´Ý8â"ͳ`<Œ;?Á^ŒÐ©^9ÈüÇ4QM›®Û^^\ì÷{Î ?q¤‰ÌYƒ¡©¢²Á/.ŽYu£Ðö¼™ï»t«L•S‚²á¼/§ŽèàÁÂtÏn d¼¥í$£*ŒVTXpGS™:6¡ÛÁ)¯#O åî[tzI^èI Ó¬ÓL–0ÊhÜ°9@ݺ =ò@å–Š<Ã’œø~—, õ¢Ît#µ_µ!—ŒïCë·û닇ϟ°FsøBñ¡'orE¼`S¥·7_ òhÆGÇïι|¢L蘑‡v;T'\:R–‚^¨q B„úÖÌÔå€CõnÜÍO¤ ÕQ6A,î8k#÷e.^§d4(Šª‰¿ñ‘×=X߼Ќ +)¥j{¸ É—b"ÿ0²¤}ó#éHqJ­3‚Æ©¿SYOÑœ8ùF¹8ßo d”7žå”‚d¯h +ãç #Æûâ1ã2»ÅzŒš|Â)Z¡#¼±HÕi*Ý/.àæÅ“„<ßû²‚>ptþœ +©ÊXftó A¼´~×¥ü,t.n0—ò†R§ù¨CHŸ{ç’C³¾{2Ê@Nu}ξH­ÌTõÊøˆÄ±¸½Ã':nl‘&tu |ôµ÷*,†¼Ä5&¢ýzs‹ç&¹•®ÿÚäFAÄ¢×™C_„-òì‡é{”ý„¹¬Â´¨ª¾½Â¢„¢Öµðð¡Òt™¸Öâ¨!C>LÕâŸç *®\Ÿåá6#p=)V—Ý¡a¿äK ì8mb˜öÜ ŒL“"Cwî’Åܼ{ÍÑZžehR1V,;ð=Cì;9_Îa-Ëë»”RI!yñ¹.ðk5'Ïd"%N¸#_¿ÜÒSÊÄ}„þ—$~hÛRòšBLúunÜú =­,…Ù’VÆóèmä¤Â]Zs߸Îu=!›—Uü¨äÒBÚ$ÜöSÏ ÃS\d‘ï.éiæRH$Êc)¬ÓÕ WÔ¤AÓÊt}èSÓ×Ý=Üoþ2šºÑ[†ÈãD×™"×Ǻ¸æ±2©€Xö/|/”ŒòÏ«{ž€óÊ®áýuÉ=•o*l¤£)úǧ} §è>ì?ðêDºéÙRÝFr÷¼䎇tª‡Þµæò +–>¿´s ê£gí`ƒ‹®E]ƒo­è ü +²sÆxFMéù Æf\.ò£Íëwâã8§'5€Þ^Á pè8¼¡†Bô”×ò¢WWÖ½·¬á7Ŷ$¹åé÷T^©°vë_•aʇ€ï榢Õò¾<€ÕpêÝØwloòÕ~ÙBÿ׿Êúç[èc?™n7Bϳ=×ð‚ò½à˜ßйe:fø¿ôC¶endstream endobj -5836 0 obj << +6288 0 obj << /Type /Page -/Contents 5837 0 R -/Resources 5835 0 R +/Contents 6289 0 R +/Resources 6287 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5801 0 R -/Annots [ 5842 0 R ] +/Parent 6259 0 R +/Annots [ 6293 0 R 6294 0 R ] >> endobj -5842 0 obj << +6293 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [250.936 169.022 367.444 180.712] -/Subtype/Link/A<> ->> endobj -5838 0 obj << -/D [5836 0 R /XYZ 85.039 781.388 null] ->> endobj -1962 0 obj << -/D [5836 0 R /XYZ 85.039 572.649 null] ->> endobj -5839 0 obj << -/D [5836 0 R /XYZ 85.039 549.331 null] +/Rect [474.587 341.766 539.579 353.758] +/Subtype/Link/A<> >> endobj -1966 0 obj << -/D [5836 0 R /XYZ 85.039 371.679 null] +6294 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 329.732 166.217 340.209] +/Subtype/Link/A<> >> endobj -5840 0 obj << -/D [5836 0 R /XYZ 85.039 350.482 null] +6290 0 obj << +/D [6288 0 R /XYZ 85.039 781.388 null] >> endobj -1970 0 obj << -/D [5836 0 R /XYZ 85.039 212.304 null] +2066 0 obj << +/D [6288 0 R /XYZ 85.039 761.463 null] >> endobj -5841 0 obj << -/D [5836 0 R /XYZ 85.039 182.899 null] +6291 0 obj << +/D [6288 0 R /XYZ 85.039 736.911 null] >> endobj -1974 0 obj << -/D [5836 0 R /XYZ 85.039 102.678 null] +2070 0 obj << +/D [6288 0 R /XYZ 85.039 654.569 null] >> endobj -5843 0 obj << -/D [5836 0 R /XYZ 85.039 81.685 null] +6292 0 obj << +/D [6288 0 R /XYZ 85.039 619.823 null] >> endobj -5835 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +6287 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5846 0 obj << -/Length 3787 -/Filter /FlateDecode ->> -stream -xÚ¥ZKsÛ8¾ûWxO¡ª"†ßµ‡­¼“ÉŽíM4åÃì(‘–X¡H IÅã¿ýJ”3U[©˜Ð~|Ý”íÁ?ÿ:\/È®“Ôwƒ4½Þ쯼ë-Œ|¼ò…b)$K‹æÍêêÕ‡8¼ö=7ó²ëÕøNä†Qp½*~wÞ~z}·zÿu± ‚ÀQ¾»X&Iê|¾Y½ÿ¸ð¯¯ià¬Þ¿ãñß~¼…Þl…Î7xýíîþÞ~%2îþ û?ß|ä)÷ŸoÞ,–ØñnñÇê—«÷+óáøËá?¯~ÿû.àp¿\yn¥×ðî¹> ﯀c7 -i×Wß®þc–â±ðšgÍÉ' -R7Jƒsù‘% ßWnà«ë$òÜÈ IBm·X†ïÜWp°¦€?íB%ÎcÝÊy×îóªa’# öxܲ“Ña]]{Üî˜"Ê›?yqåÜYÕ¨/Ü‹B}÷–G#Õ \¬Ä ¶¸Uw/xBOôý¨6ôÞ¿DyÃá—>Ê&£³ôÇ ²¾ã»É{~4¡ÆÓÑÛ Ãü€Óù/§Sq¹²®…ùÄT׿¾yÍ1ÃœK̉àmW» -—öçÓíB¥Îýê–›»\ú׋%ô—´Nƒ]1p!ëWÃP6Lö€ív”Ž}/¾–ŧ|XnèŠ\ iÔñ‚‰°~‚xàhlÀ»ÿh_”‚¯œ¾ååqðg?!M{äFw…ç\ÚèœÇt®öÈ2Њ–E}©STýÐUkè=Òîmƒ»zn‘ÐHµÏ±õÄ]Ž»k6qá¡åçnédE…7ù$ã;!$nHuI"ÇÍPµMÏc}KÓËÇ]>L—ý¯ç‡¨3ª¦Ïƒ -@ZB¼=±~ˆ”D[Фìöx… í4­í¾kÎÜS¢Í5N27‰³YÃ×4K‹ˆ ßöŒ¾JÝ8‰ÍJx8\r¶cº~ðü†Lr¶_Ûû¸£h²ßý¥%N¿k5Z]ž˜»PàØÀ<þ…L8.oƈ«®[”59«Ø3·‚e±¯¼¸cq8_4>»²~â7¼±VÊÑ*±EU›œïÉö%{œåŒŠäM¥¯vß‹;$÷hñI®òÕ=©'{GϹc×èi× ä0ºòKÌY FªÌ)ŒËö€Aډųtâ¦ÌN¹€#G·†ÌÃ̆B Öm³-;~o´a—w B„gœX,.«p®¢dÊœœÐ¦=ò¡zî¥cázúôðþnÔbŸÝðÊu— žž -~bH#Ñ3†$D?3¤ç6Ô†t²ß¼!YûÝïÄZÈ@8bKëEÄ. Þ»E¤à:ò¢j¶£uñ[ÑâÐæ¸_P @·øwÍ.¥²c4uwQ’²£Öo›²àNš •4öÔ%-Tdô‹{=Al³íFo¸ ÃÀùüÀËŒ–ÂÀÃ;ïu¹·Â-µÑoP"¬A©˜ÔK‘㦇øúºä¦ÀÑ(¡lXØøþXõ;~Ø,xÈ{È+<úì*s#“ú Æ}î&>‰ãrËv@ÄHú—ñú44fèùñÀZ»žåú@ˆl?[Ç-»vEŠ`@I$úMãïĨ^jBa׸ ‚“ÆK3·¹ÂÉ/ 3FœWìz>……Ž§HçÁW–ø¤-€än‘†àæ¹Qþ% ¦h!åØòè¨BÐ ¥11;åû—û¥­y›5£¥aÐÐÇôÞúnKiOq@Jžp&,lÈÛµ ºæ¦±Ž ©h1äý÷Þ½ZD*vÓÌ6a²hÈ»(õÝ E>æ‘Ô1ç$E.ª\YyÎ×òÏ#òÙ‘Aì5ƒ xé \Á¢Iøÿ®M2d˜ª)óN›IH‘›\k+|­k‘^è눊du+Ìãg©¦NÅ(MõíX­}.µ,<”à^V{^P® ØN;ëq:7±‘³qsÞE"/¯ÙsL‡SIE[]m ~´äè;wTcü……ÆHyÂ~%e $œÔ<ÞÕ‚ú¬ú çU{Ö½BÆ5€Á¡Ž5‚—Œ ’VÑ©RªKÖ;QÀØwýDû¶5ž#¥COò¼qÓ¶«¶tʼ–üø"PDsvåS>2‘¢€"wªäUÃ&¦ëíá±µË?T@9è,¥¤ "8Íî±ÂÂe3R—‘€ÑÐÙ¶l]„uBçŸKÜ ßi1(9ìؘ$37õà™Æ®y¡è¶BñÕÂ'šzi‘Ÿ#”Ó5ñÈœp# ‘[Ö×57(åÝž1Æ ~sÊà lÒ4ϳ¢…¦é„­a»Ê’Ñkþe'Q/‚ 4™ÚL‰ðYÅ¡$ÂÄÙÔ-稬Ø1*#¶L.×u-͈QzºÔ‹ï r!'þø”Z´hN¨[Š²¬RabìT… ·¥¸ø) [eÁòrM«ûè˜2,(qó—sÖZêšÖE‚LÎ"À@™^5èÀ’IhÈ|]å` Ê\«’œ™\ÀgŸ"`l-øÅ䨽TiC/âZu¦DÛÈNk™×_4Q ¾ƒ”™1Upvä8a€%uüªó`]ÙÆÞ”¹#Aý¨ -mÏXë£'“B(´¦98ö°t)Bì*SHÂT®äï…ÀH§Ã]ëãv›¯%QGVòãò<•©±,À0…kͺ¸î+"Q E°œ¦Ó º}U1rø… ÁÚ0 Í{X6‡Ñàt9[ÙÕ nsŽUR糶]aù;ì!…‚Å6¬¸aU—Ï©UCp£k·‹}ÑéÙÑè“lŒ™è°Æ„üÜ<)ÁÃT3‡g-ÙðÀ„\y‡þ§cLS­ HvåÐ#(dT"ÖE$?0õBÈå3úNæ -¯—„0…Å>y£èbÌ{ì#اþjÂï=&Jºb‹¨w‰‹1ˆ3ãÁpÄò`x¦† D¢(É$Pï˼égpUÙ8x/AK©–û„n怕r³,R<¤ˆ±·Ú¡'!,–L„ay~tÛU»{ÁÖƒv%¼.fÆÕ‡Rn3|ò{/o–òZSI½6ˆ=ÇÜ+«LÝtÑo¼˜rÐ(1Š0Hö<™½îŒÌÏU‰oɬ(”5HNÄ ã¶.Éë¹Ald:_ÒP”ö>ÿeÚ¢¹\h›ÖE ]g ¤Î²ZdJ® “&.ÚÆ V]j‚ ßÒµ —¸ c×£ç¹i.—^Y§ {Ò7qµ])A}È;ÁŒÒF¤7Hq “ë|- ö‰ä„Û`è;ÅÌš-¹€Çsݧ5 -ßO -¹!úš1<6Šœ¿ÅÄ)ݱ¡ -3ç¾çþ‚ñ†?A;“oÎ&²vRÊôCçËÈ´?2­4ÓúÃþð„„厑ò”éF›j -ž7uÔÒ)½õ ¤d -!O*úfš²Øu>Zò!-Ks‚ ‚d~Ì'¹m*CÐJíÜÊ÷ü±<;Í ƒTjÍÓçôG€R!"ÎÏο$áDãf‚L{ ’UêŠ Ã¼ä‰“™9;Õ﵋÷‰ @ ÝUŒUx¸?âµp× #ß Ò™$:h%+‰†0 bS[˜ÐÅ û“p0tG mƒt%^Žòì¬ û Søù£wØ_Òi?vüɈ¢4<8jÌz1CSÄ„ñ£ŸÔ‡#:äCtÎLc]\®×0_ôo{„JÃÍ©Áa]€–Å5ñ¥¦/éÀ#x™NF„ì »9ùQàú¦†qì»WE»™­®2áôkn1³¢R®ç){Å}Þ̬ADÂðþiF¥eÊzùˆà^âXÿ`†½¾L°>ؤÅÆM-D_}a`ê$±§zà'á2$•°9& ¬‰F§)áh71Ù Õ]Ù¼{V6ÁZí4”î - ªˆ‡áL2' >èŠØ¸²7[oÀ~£µŠs¤Ò.º -6ÎìÏxfë 5•z|A2Êû9„F1ÙJ\JÑçp¨öêï ?Ôø~äÆ?‰ÌÁg‘Ù÷àù§Öü:o¹`‹ÕZñÙ€òFçfЀã*]iùs:+ÉÆ=Ðïì'Œ4—!E¸±RcÙ ÓÓ‰Óšë±ÆLY¯øq$µ¯ÉÐð/pü$³Ì¸ÄŽÏƒ)ØvNŽu¿j»£d¬µ¹=ýTs©´BuýÅ_q®Ž!66”‡ž_Ç8 ú„9ð»ä4  ×ÁóŽè•S”VÙØ'Iº‰!²aúÇ]9ý‰U¤¸Öφ7VVf“TVeõ£jMìg w~öÑVL¿å {ôW✒¾K‚€}öçFðŸwü¿~?it5 Ü4ÈæU5_®|Í YXœò«gyÆðÿT™AÄendstream +6297 0 obj << +/Length 3138 +/Filter /FlateDecode +>> +stream +xÚ¥]“ÓFò}Å&/ÈUXè[2÷Ä!X8ÖI¸Jò d­­CÒ8’Œqò篿f4öÊÞª»JzÚ==ýÝ­õ¯=øÏ¿Îb× ×iæ»a–]Í•w½†WW¾`Ìenáüsyõä‡8¹ö=wá-®—w#Øâðz¹úÍyþã³Ë—gó0 pgó4Íœg/fAæü2ó}ßyvóüåÌw^ JäÜàzù+n¿ÿøÃÞÍëÂ^½Ä——7ËÙË7W/—†As40³@îþ¼úíïz7yså¹á"»ÞÃÚs}Øn®€=7ŽBy¯¯n¯þeHñ^tÍ¿šFfnœ…÷¥áÇÒˆ=7ö"’ÆëÙ<Ž|§üŠw)gsßi²V/zµká†+~Û²ÎùP!xàÀ¹ƒe§Æ6%/º²AŠ@ÉwJFüÄ;9ÒÙ +ºâg3 Rç€kÏ©g9þ¾fØg)<û[ÙãÆcØXNÞ +s šË:çÇÑU÷E˜Àæ>ÊsAø¾P[ºÎ#Äx´ÍûÄðýlÖÅð%oùyó‰Ÿ{¢º"–ö úÝ‹½nж­ðßµü’?½x‰ *Qöô¨TËÀJÈ¿ò~{Z>CPDøÔ"Bìwê/ú5*¤úM^Õgoš¯Ë9\Œ>Š"g¹a9–ì ëÝ¡gûλ™@#§ qt¨Ã¼jëã®àUUx=|ë)º6úÒíªõ†Øwš¡ u½ÅBÛ^˜dŽœå;SiÄ ÉæÂ$¥Û#âÀÜ ]ux–¶[ÜGµžàçtÝ`iÓÓÕ¿'é!oAg¸â;Â*þÊF rDÅ,»#VPqG7 wBsß £j&E’n‹{#¼[ Âlj¨ga“Ÿ‡~®qPÖ›aØ>}òd¿ß»­jòbSµ¥ Ì=¡ ʯ¥»ÝlOY ½ÀMÒ𘷓Уqî±tzN)!O.ÙÄ<ðS7 #1 Þzƒ.dDølohý{”a­ÐÍ>lÄRµ¯–ò¢î¡@…mȠײUÔ•x£Ð9 +=°'Ã1Æħ)ä}Å 8AF¬SUÇ”>–«óá1¾„Î-Þá³ÇcÞ}A¶¿­0’ (×fë_q£Ûž“0$Àô#^/Ä°K†î¶ 4»ˆˆîšqölñj#fhÃv½´÷ Ç›C4?ð[«wË(,"úÔ…Ü£èÐŒ°^$nbM”€pTp>ä'éXíÖc°ÈèÒ©„Œ|×—O¢­¾`Tû¾Z·È3í Ä@4%ÄXüLú›ìNp‡p Ñø3FÕÉ’΃òå8ľ…ö³!¡“‹1;{AüõÅú½#³_’¬Ã q¶5›HÌÑ (®Ë·pš%\&]Y<#˜ì"ÿ܈iÒ%ù€„³&›·ÄR@§X +›ù–2~Uäå)„õœ¬è o=ïuT,˜ÜG$z&™ókÁ)â¡dÚŽáà€÷UßJÌ6ù>òÂÑi@ &N”ÄA&ÆX5[J¡h ›Bw‡']1X™½Î¨JöMRCRÈ¢) +M‹iÔe¡ÃžCu²R±Ì¦.¼’*ÑwDT×iâc"ls“b@Óð{ª(D‘ªzÎ;”u¸NcŒã +!tÒ“”×*QY1‰˜<.0œ¥‰óy'ò„ã¶z‡éÌŽa +qõY&t¬Ï]ˆ`&îcÇ"bhï ¥Õj¨Ð£Ã0¥­ÉþÏ0Ñá‚å?Ú ãV?WU¿•º¶—–Ÿ†M e± ;{m-­DhW 'îW×yô?xÉë^1E¶mXLáwu݇ÝVha€Ÿ¨ïî[sP€åR!ˆbh70d¨©î,¶B‘ðºÔŒ˜F®Dá²ÔÅ¢T{våàž}¶ç°ÜIð%ÌdSñïF—Òa’PÙH!.1:‹.Ñ W ð–ÛPùf$ßy +€—á©÷1 +Eá1‘ˆ¨š­ñ¯“X°ÔaIôäÂB7AD™SÁ[…N†¨Ó)QЧueMð\ø=O瞫Ĥ™&†ç(MW°üð–á:Ñú¸B©Ç_ ;!FoR[WÈVÁñmUÊ9ÊÐEO`© +‡SÜÝoš+Æúc +ªZx£'EÃþn6ÏÒÀê<&Ò}Éï¦Ð—5Œ",tSÇ€N¡OI”!ï‰B]>‚”»³?ÂÃgO º‘tÈ¡6¹‰iLQÖB³ÒŸ$Vm¡Ú1¶V­‰Çª‰Sœ#¯WQÖ>ù ’þÌvLñº»*Zwe''»¥ôàÒä}ÒÞ9aä°5$‘×ש²´9ĹT‹N0³,t”&ÑK ÂïjäíÏñ4ª,$,?=ÓAwëß'A5 ‘o5 ¾ç»º !äöwÏOOÏó½ÄÍ A¹t Æ¹wâQËãû°éG'þ›ä³³zèöÑT +l[óUÛÀFÍÆð“‡rA‘ +-°û‡hþ?)¢KìþøB€ýn»eo×9û”]Uš]²N('\Än&•cáœWŽFzH9—4Ê9=qR9ö‰Tèà]E8 õDRÎÓÇö2çŠÛø熓xà<ךºêoþ­ATj ònl$-çg=”Ý2Ê%o¤´CÅ"ážúÌq^¼ÿ.7õ=%™ë‡—Ç©Î= Òƒzºpਧ“§õdø?:ц;³/ÇÞ ú©ÄÎÿà “Òy¦?'ÏȧçEyŽ8ä)HÊó£_a9Ž‹¿ù1N¢biðˆ÷±Ž–¾üL!d O©r Iâè*Y|¶ºäÙ bH'cÕ´5Ï¢˜$³ë£RÝÔÑ©ò$Ñò²PlŒ4z‹¹(˜ÂxÍÌš(á ÿë&†+Îi¤­ò~σ·¥A‚¢ìV•¦€7%6_âF +Yl‡~~Ík?2¢× ×Ìgaݨ¶<œñž J\_ô ç¼÷h¤‡¼çÒÆ{NOœôûÄõÎnM©á uç8fB3Î9»|=v±nsGó¡)2¥ÓÒjl_†<óþö¶žü€Ù„Çðp0‚Ôž«gšŽ“¦ân¸[Îdž1ÏÎ}zS›‹JÏ»o¸'¾§0j{ÉIÔF„êNžSiÊœft°Ô“1”Pìæq¨&Žˆc°oÀÓs <0öæxÔ +hû®€ÕSbzÂâÁï&ŠaB÷“Î_ãì*rÞ¢^–·dŒ‰Ûô9ò´Û{uóž¾hKÞ±ˆÓDã¸ôå(Cß íüYW&‹õ–¿X¸‹ð¢Ç(dþlFn%Ög.?õ]?eë‡V+rñËï¹á/’³?‡4ø§ûƒŸ·j­Ç·}HÜšÑRâ¼(Îñ …h˜]îu,œ³áý0tƒ4’ŒG@¦Gë…ÌÚ!nZÕ¬ è¢®™€mü‚úTõŽ+*FíS2Å@îËÓÚѱ ò7Š +]MÓèX,žÞå”䤹™œVÍ <9þÔƒ¼oóA&a}Ò‹wìYüýÇL˸;œát@Ü[¸i?ð©TcÏ-ô‰zB“¾>ªÍÌø4LÜöPÊžò@´Ž³ø˜¯ÛÐ8—¹9¥d}&õd–}A_rA2Ãëèx4…sÜSc“O3úhF”ˆ !©×sýíšÏâ¡XjÑhpDzÚ1ð㸎ùr>}+TT á-Bê».'†ø""‡óÁ׊zÝã/£b<Íqq}v@á¹Ád×ÿ3±ÿëïsÆ Tèfç:¯bSàk^ù0ˆOùÕÇsáÿjäÑœendstream endobj -5845 0 obj << +6296 0 obj << /Type /Page -/Contents 5846 0 R -/Resources 5844 0 R +/Contents 6297 0 R +/Resources 6295 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5852 0 R -/Annots [ 5849 0 R ] +/Parent 6302 0 R +/Annots [ 6299 0 R 6301 0 R ] >> endobj -5849 0 obj << +6299 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [348.805 382.959 464.335 394.648] -/Subtype/Link/A<> ->> endobj -5847 0 obj << -/D [5845 0 R /XYZ 85.039 781.388 null] ->> endobj -1978 0 obj << -/D [5845 0 R /XYZ 85.039 526.891 null] ->> endobj -5848 0 obj << -/D [5845 0 R /XYZ 85.039 505.694 null] +/Rect [84.043 679.338 303.67 691.33] +/Subtype/Link/A<> >> endobj -1982 0 obj << -/D [5845 0 R /XYZ 85.039 262.418 null] +6301 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.346 116.607 207.581 128.297] +/Subtype/Link/A<> >> endobj -5850 0 obj << -/D [5845 0 R /XYZ 85.039 239.1 null] +6298 0 obj << +/D [6296 0 R /XYZ 85.039 781.388 null] >> endobj -1986 0 obj << -/D [5845 0 R /XYZ 85.039 115.645 null] +2074 0 obj << +/D [6296 0 R /XYZ 85.039 199.93 null] >> endobj -5851 0 obj << -/D [5845 0 R /XYZ 85.039 95.05 null] +6300 0 obj << +/D [6296 0 R /XYZ 85.039 157.583 null] >> endobj -5844 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F20 2865 0 R /F69 5128 0 R /F35 2880 0 R >> +6295 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F41 2994 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5855 0 obj << -/Length 2273 +6305 0 obj << +/Length 1634 /Filter /FlateDecode >> stream -xÚÅYYãÆ~Ÿ_! ¡³E²Ù<ȃÖ{d {v³#à ØF@Q”D E*$µã üã])J¢f'q€Àðªêî:¿ªâ¸þs'‘QŽŽ'aä*E“twãL6°óþÆ -[HìÍëÅÍì]àO\GÅNâ„L²Ì;”O£€SíX($/“½á÷{"?°ºh¥¿ú+ 9 £æš†šœ¯àû€†4äŽÁ— <¸¾D+ººñAxz 6B3“EÞ(; g«l…Kš<·öPÊZw¹KlvÐäÄ*ÉvUÉí¡BÏÛlo4ô&Ú#aËçŸ>½¤H“')àª}ÏùjÄ‹9šˆÏ¼æážøØÑ•ÉZQÑ4åp®¾á=šKäqNÀoŸé^Y1ÍšêP§Ù¬s¶x Œÿ úBOR’Hë/CÚ[f ¢™äçÙš[Jä¡Q[È^•)[·Iê'Q‰% I0Ø%ˆ—·2F¨® -ÐlÏÑ žy"¬{°Uª"OùLA˜ñÿ¾WÝEæ¹\{Ê ;d/J~Önø»­ü€:ÏcÇ}yA<ñC£´ï}½ŽÐüÚHawwÙƒË.£ ÒÈäõ/ŽB¨šì(Ä’ þB Õ‰v£ÿ‰Ý]Ï ¡}@ÎØýš•ò$ºpëI.œ‰DN^vÁÇNˆ¦£ M™Uk¦¸HéÆUY£ó{$"ᇞ‚¿è)VTäË«awu_¹Ï×IÿõKÿŸg¼—˺TeIÃePÍðXµ<í+œœbµ/XíK¡€Þ·c¥›Ž•„]é–µi‘ª«¦/Ø5*Äz¾Gv|&éÀ‰§‡†Þ­eSÊo8ùìÜq†ù³7»´1*ò†.MÅz{`ò%oòe!“5e”O8#  œœ™ù€u&ô<äF,Ö †À*óiDKžk” ‰ý?ÒÔÄQWãbÕS°…¼˜‘YlùÀÜuà$¬¹hCC)å¦ 3Y·É%{f«¼%)7cë† ‚wâeû„X½"'3Ö:/2ñnqØ‘h¶Éªz<=rI…6Þ‘vsåÞ3uÙ&s Š£ ¼RÁÆyqecßçÀv—?q|ŸDÛ—E´OÝOŽ.ì+wP@?S<ñÁÎi¡Yý»]˜Ñ>¿E 3©ëgïL0 µ«T -ä ùŠ |d‚^”ê4ÄïXZ&”Ùo­,¡¤»®Ì†A ô•xP9РÍvLT“RHØ4€B¾s·"·çÝ/ß cÃͤÜVóî/ŽqúNäÈs°¢ -ï¯-{¸H7ÔF™e«a‰äõ|Ê <ãJ¦“<6èí8Ð%×Û}­EVB¡È²ãUÒˆ•®•J^MmÐaDÃ%ø¬·)Ü,†ý…¹ø6¬ô½ô‰}‡Ã¨Åê“ž—ò"í~à÷AéaÎ1 à°C0NZÕ¢œ™x€ï±yQ㣼£Å_eîºü ƒe‹‰‚þA)s® „¯©rb”õËÔ@Ÿ˜ɲ‡VúŠUr®JJ„þ昑€.ãXªD“ˆ^¼ð‰¸ãŽ‘œtþv­»†Ô¡L`ží4×»k7×áYw­¥»¾Cyïï±· ­ŸNºäPÚáКßÂúçkŒÊýÏ2z¤¹Þäºànø=sŸqÀO)Àÿ $2ª@ ¥*©8sÙ'`(žºŽªT¯UÓ!¬Ô$,)D¤!šÓçÌÏ„3#áKiE{—)A{hç3ò•|9Ê%v¹`¦üJüÂ; Ä—C!—n²¶á‘|Üiù¾DV¯v¾ãƒZ!CøžŠcÿOuÝ]öà²K[ùN¨×û¯uÌ85^pl"€ìøáÀ„ŠÁIâ“NdøI! ¸­Æ¯° Æ lA¼p´a ;õµ “p׆j­¹‹Æª ª -A8 ¶*ä|š”|rÉ_dµÚçT.À0¬Í(56Yi6pTzÒU‘OßK£ˆ>%|íètDâQR¬$»’6¼ -É¡¬Ãn.+8&‚€?LV‡B’h@†€q~tÉŒ×ÛmÒòÊr°ÒlIY…ì«â&Ùu Á¿ÜâüîÍ”ôJP1VÿµIùïdð}áäƒÅ6낶àW âóÕW¿ÞwoˆpâCù}òàé}]mêD¾Éÿí¬Íj²ôöyšÉ-W¿!ÄcðÿóKêO=HB²Št<wÆó”çv¼”Gþ9¿ÝŸD.þkÎendstream +xÚ½XmsÚFþί Ž3™ ô‚ŒäL;uml'qÀ58ùøƒs¤#’0fšßÝ»=ñ&ì¤éd°îN{»Ï>ûrYuþYuÏ5Lǯw=Ëp<¯&5³~o.jI´H¤µ&óǨÖ>wê–iø¦_MVz\£ã:õQô¹qzyr=êÝ4[Žã4lÛh¶º]¯qrÖ´½ÆǦeY“þi¯i5ÎP¤Óèãxô _nÞ«µM”:Áµ‹NzýQónô®Ö•KÓÆGtßjŸïÌzž¼«™†ã{õŒMÂ×I ànÇ¡y\Öþ,U©wºÚUE†ëx†ë9»lXî¾e˜V·Þu-Ãïú’¾PD\‰{‘ªá0Ìø |*Ð#Pß²Àº+¥‡Ö“fËj @Ìs§üÙ`YÄOh”ò §A¡Þ3©Š³œ^  &=óœ¡Á ¤òuDåÀmN(Ä„6ªGˆ›€Õˆx°.àü9€N£Ø‹nÖlÙÝRð$.˜3ZôDQ¯\½ÏJÎHmQdˆi¡Ai?NàÈæ¡®'~Ý-äJž$ÀË2àÔØÏ¥C\ž®—õF5’©ÐüDØ"÷òxEÝ¥N'"ö6ºõŠNŠP$‰öSšÔ¡•wH1ÞR¤+°ù6Ü*xyœµò ùDÓ¼n«t"dÆ~;¯åþ§¬UYÅýÿÊ覥®Ð­2±_ˆì«îM2òª“ôÅV «Ö½S»nbÄs¾>LxúúÚyÃ(XÂ_ KÀÂB.,å_žGy ±Ñ%!·ƒkÒÓzSañÿ3¨ø3}0Â5œN“ƒß~{¢sTÁ–ì—zH "nKðm‰[-KŸŽÑ½ctT-¶Ôã¶L½Ã“›‹ŸÍ»òÄ¿×Í ‰uëî‹åtÒJXÐSrVÂz³?5†ò>¾~ÖÈ;_åmãý’Æv>…›aTÒ×Ö^ã øñ¿ERzø{ïôr æƒós\ɶßuk£\$*¿æùªZé~B}(&ÅB^hqv](³¤¬Ù*óɪGêÀPûF^ 磳ÞÇ5ýþ½*Ò¥p0"öp 3{‡ñ¿å’¾Ç>O`¿7¢ öÔàƒîéÀáúOÁ±ïô|8¸½9ímÓ]ñÁÆ1 Û¯úÈ?…ï?}Ë)¿[Á¥Ýsüê5®m¶¥± Ž}´WóÙüåãò²endstream endobj -5854 0 obj << +6304 0 obj << /Type /Page -/Contents 5855 0 R -/Resources 5853 0 R +/Contents 6305 0 R +/Resources 6303 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5852 0 R ->> endobj -5856 0 obj << -/D [5854 0 R /XYZ 85.039 781.388 null] ->> endobj -1990 0 obj << -/D [5854 0 R /XYZ 85.039 596.758 null] +/Parent 6302 0 R >> endobj -5857 0 obj << -/D [5854 0 R /XYZ 85.039 574.042 null] ->> endobj -1994 0 obj << -/D [5854 0 R /XYZ 85.039 188.565 null] ->> endobj -5858 0 obj << -/D [5854 0 R /XYZ 85.039 170.092 null] +6306 0 obj << +/D [6304 0 R /XYZ 85.039 781.388 null] >> endobj -5853 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R >> +6303 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5861 0 obj << -/Length 2891 +6309 0 obj << +/Length 1380 /Filter /FlateDecode >> stream -xÚÅkoÛÈñ»…êà -‰(.ß ÚNìË9='i¬à -äòi‰9RTøˆêßy-EJ”>€&H8»;;;3;¯©‰Õ$ôLˉ&A¨L' 'ËâÌš¬`å홌™ Ìz8¯góŸ}w¢,3²¢Éâ~OÇ3]Ï™,’/Æ›_.>.®>MgŽã¶2§³ ë÷‹«·Se|º˜†Ž±¸ºäõ_?¼ý³ïqä·~þøþÿð‰Ðxú3Î_¿Ë[~»~ÿz:ÉËé×Å»³«EÇsÇ ð!ÃßϾ|µ& ÷îÌ2(œì¶LËÅplz®#ãüìöìï)^s'¼kL?žš^è+Èñz -R^h*gx–éY.)¨Ü6Y¹©§3ÏöŒ¿ð'n›u¹ÉP¢ùϪOaæ¸Î˴€H,ã (Ãõf -t7Ù¡‘â 0â4–¤‰ •LvȘ噡‚,HpÞÖÕ<Ïîæuºl«¬y˜)p”Ôæò~5”ò}`&’ÝpÇnè‹5œšÕÌBQCI s¹°Âèu»…Á ‰OÓnüÉL¡Ú#¢º°§j¢òŒ,Yd“Á¾ß-å.cTäK\ ;<¨aÌIÑH*å8ãþSQ”b­FJ¸¨Hå5ÂHl‰À’–ja¡J·$U‰t™/ŸpiòµY Y@˜¸2¸“w&<¿ËHž;ÔÚ&!EX¬ ØÀ2 -$P«>Ý@÷+„ƒ¤¥Þ«‰dˆ ,7pM¡çŸkÙ΋¤7Ð#“Y–T-Ì­ÚŠ[ñB^’QÅw|øS½žr&Ü‹qòšaŽ€(ö̳÷tì&a»Žåüó¿uαÑPλ¯`üÏ&ÝÔŸŽåŠ‰V—é =ÉívÛ9+#|¬Êê(&%¤5ôŒÈ2Þ”vª­ö¡hoɈJ9uÚ6D[ß³M?P‘q¡Z Ƨ^lÖس:ÅæA;¤IÙk_=H‚ø Â_ÁbmLÈöEÛ a~dF@e`{ÈÌŽ"°-ql1oÇR^-j0. -r@DzŒk&‘V¨«˜¨¤GZ‚|@õÈT¶=š·4ά‡4¢siØQê®Y.ÈQ -y|y…¶WàUË'|õ™øS%!’¦l3°ý~Äë¢&dý± GÁ˜DWa`Ú¶šøÀ¸ØOˆÆžõЕpHY<¿}ÐñâssC±=^‡…d)®VÞ¶¥âWH\ÏÀb‡SHZ¾´[âíCÍFWð˜} íkpèù¡ÐuMLJBÜ·Æy\ÔCJœÖÇë+ß‚š&ô­{8t˜mõõ -7ï({âE¾x!Vé™ ÇtÁÛÀ0P`*Â<4c«ð}£.î ÒÔý î¼È5}'x”»ÎÈ­kîßT>×l·)W UŒ¡,ƒD þ™Ša×<“c°áš"Ñþ—…˜>èK©ñj¾r,LŠ–Qn .¸&(D2-Œ¬¥0ÒQêB¿Ò¥N¥øÇÕÈ(…8”³ãbã.ã\¬¢þ9PJt¤Š }¨´=)ñnôÅšÄFˆ´Œ·X§µ¾ÒÐÐ)«^êÚ-“²–òŽbõ¦ þž&Îò>’ÍÎAþnyVÿ)ŽDÊ1‚pX«`JumpWðk|ÄX¡qó0¢‚ „$b?­x¸Ê¼þÛÀ!^Bx`?ðerÚ†p ˆ’÷QYr‡,œì)’ðˆ}_æ9mr;p#ÝÛR¦C+nÈDn‰Å¬ ;4ýhXžYå%ª4οr ª‰Ê³À«=Yƒ íÆ­H©;Cê6Mó¯ÇVúŒŸKuºçÃx‰£¤,bäšR6hë´Úâh—8=ñü%Cyö‡¬^~¸¹¸~ÿ¢Ûr\ù€æî2MZNG¿ê=á^Œl{Öñ"@–È»ï¾* †”D?ǯ½Ÿº×§ô…DFÇê³,) zÑ' ¸£SfLøi>Wÿ>WUÙnëã[ìñ¹úOøŒó¼Ü1˜nÚ‚Ri)gb”ãïÝ+lh ÇÌÝ5Ò?¢!¼>¤ÿÆv9îéýÏ´b~¤OHŸ*ÅœDv¹Ns1ÀQ?FŒ¨€p&ú!«ëXŸÔ¤ù&m„úr™Öu#÷…Ï6ïÜo]i’ aŽ“sà|Ó̺œÿôyì•4 Òc^Ó©çwq½>‘è¡Ð4ÝÀ{4Ñ÷pN—!6f1(D‡eˆ'eÈ; -Ç”± $¯p{K7°B © ž­»çÕ´’åÁN¬ï/ç W5 Q`4Í6'ÄÕ\>&nçt]cû¾é8üܹâǦ~í¸v¨3GÄo2ð4L;î´dV ò#Â/}ÿÇQGåö¢¯ ÜÀ¹¿’‚Š±¾áYœyzšÞ0,qE/Ç|nÒݵ –†s:·`Z¿,æ´€ Äz@^èµ\ñÄotT² Ùp›9 _ 9H„“Cÿü˜‡˜¡KndctoΦ;]È•üÆ šN¿~º }]C ¶mé‰õ#ËÓÕþ½äpM_¶@Xs´1Èíƽ»WeÙ<©h$m÷;ˆÌ¯6“8Ÿ×q• -s®1çc‰o%óeÃz†šÕ·Ž’Î>óé8ë^ÔZ@Kóð¨|Xœ ÷-ÕÊúÉÅsUWgJ×bS¶bGutQ ¨kÇ•º»–6—©^ᯙ8©±»ß§Ð.8ÈSõÌÐç_Ê0ŠHus]Pˆ -ZÚ OlF¸¤qº|ù½í2'5î}nÜÓ³øºÍ½D¢ëô¥Žò8lk&+ªè~5ÓX„~ZFîFâJÙÆ2Ï$£ÿGñw…‹ƒˆC6éÙ¢;R”‰°ãB\j4ú@ž¢×.!É9oÓêAï¥å€Ð0,ðœ.ëw,‚Ûº9ùÜ1íÑ ÿX1ÿÕÞ]6t3t¢ñlèÙ¶i+Í eùÐ;äWÿ0~Äð¿ŠüäÌendstream +xÚÝWmo›Hþî_ÁåN +–ê5Ë‚T§Ê×:¹¤©ã&´=©—Ö†…uÜèzÿýf_À»iZµ_N‘Ãîì¼<3;3 X3àk® âiŽ‹q]-\ö m''=¬8ŠeÐâùÃï 푆 äžæÏ7zldÙDó£÷úó?Ç3rÙBtÓDýã¸úøEßtõ·}Œ±>ž>Ÿô±þ‚³Xú”¯ýwüøâò¥¤½ês®1§Løf2õû×þYoâ7ÓÆãè>öÞ_Zžœõ D®ÞÌf—þÜ~þ,Ÿ’Ùè2WÒæèÃmk–'Ìý#hØAØ5·Š2ÉÒó‹“‹©R7ørõæj¢œ:R€1±Ú?‰Ç¼®÷ +5_–ü_vðTØì1¾} Þ·_C´}ãh™dIÅÊ€%yö…ø+Û§_¿€ñ‹W§ÓÇ…?à–^ðÏ|x'ôÆ÷}ùH£¯^ú§Ó“‡/ÜþZÙMóµ\„í‹Ÿq¬´¬ _a¸'ý*¼8È¢”v‚­s¹ÈKEˆKJ›d)Uò‘&ŒŽÝ)DQ2ŸÓ’f,½¢ÒŒ†ASû,¦*ë 7’J‹O!-x +VõAÀjàwŠ'¢Õ-Ë‹/Û/”ïÊ%•Îç3«{(ó©j;9Ø/7Þ*É… + +Ë;(Ïà:£lÛ?ÞéV +ðßÑíÁ¼Ûκ%rø!Y +IxýðÖܸºïïxR6å5Ø£âÙÌ7™òçgŸü¨:»ä‘vǽþ¦Bká¡iENsÚ¤äÿ&n» j\—Y”gôõ’Jóª[ûùŠ+…ž¤t_µ„9á¢À3<Æí±¥Ag4"Žóc!G¬¯(o¬Ç0†%Ù‚Ó Qáü¹ª™–y©V4 nú˜Ü 5b=`ŠÌ%—¹® àG7)üWÇi¾àms\.*3­„ý$òBrW÷× f¥H0_¥Qmäc +G¿•¤œK ÷¥ç<çxÒœ ®…EØ +‡a•˜ Žºã¨‡‘Í$ Ð#rˆäôr¡.[ã¤b´¸w§ÉŽF1f¬8×ë5 +Ë Y@¬Ã8¡(/Ã2BZá%"BÙGF0¹oÁë̸¦eˆ ¹ŽÉ#]0 dÀìü  Š§ãÂmò‰%ãè»pMHI´–ö¼Ø´aò÷¾¯1B–g?ŒWñ´ðª¡-“°Ì«|ÎP˜/‡«”¡ *žUaý~{ó”fð¶´FPO±ëÁ,ÑõÍ‚8»Ž­µìøFl¹d¾yˆ¿Ï° Õ;Ú8dÂ)Fo3Í÷Yˆ`YÙðB³ä1†IdžAgE²¬GŽ^ô ÖË&÷늎65Áâ|Å×LÒù ÅÅq' +$cœs7@ÑûŠcáØVϪõøžsdqÌJÑ¡xùÊa†I.¾¿—E,û•› ŠøP/–+îU¾­I—]*å á^*Š`¹*›RuËâÝAð‹Ó‚Iïp¥êb²eTÝž3£hY‹¸Þ«~ædc…E>â‘ìÚÛ›í¦=(W0«¦ÄlMu«鉘nßœN2VªQrøì W5½}¿¦Ð¾ÿ[»¹^ÀíoÿíÚ¤&®±p׈étñÖßä;€ÿÓŸÁendstream endobj -5860 0 obj << +6308 0 obj << /Type /Page -/Contents 5861 0 R -/Resources 5859 0 R +/Contents 6309 0 R +/Resources 6307 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5852 0 R -/Annots [ 5863 0 R 5864 0 R 5865 0 R ] +/Parent 6302 0 R +/Annots [ 6311 0 R 6312 0 R 6313 0 R ] >> endobj -5863 0 obj << +6311 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [381.287 649.553 512.306 661.243] -/Subtype/Link/A<> +/Rect [90.021 228.532 332.556 244.074] +/Subtype/Link/A<> >> endobj -5864 0 obj << +6312 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 636.004 322.762 647.694] -/Subtype/Link/A<> +/Rect [90.021 214.983 218.012 230.525] +/Subtype/Link/A<> >> endobj -5865 0 obj << +6313 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [186.225 622.455 485.324 634.144] -/Subtype/Link/A<> ->> endobj -5862 0 obj << -/D [5860 0 R /XYZ 85.039 781.388 null] ->> endobj -1998 0 obj << -/D [5860 0 R /XYZ 85.039 608.186 null] ->> endobj -5866 0 obj << -/D [5860 0 R /XYZ 85.039 587.591 null] ->> endobj -2002 0 obj << -/D [5860 0 R /XYZ 85.039 300.475 null] +/Rect [90.021 201.434 441.871 216.975] +/Subtype/Link/A<> >> endobj -5867 0 obj << -/D [5860 0 R /XYZ 85.039 279.88 null] +6310 0 obj << +/D [6308 0 R /XYZ 85.039 781.388 null] >> endobj -2006 0 obj << -/D [5860 0 R /XYZ 85.039 181.199 null] +2078 0 obj << +/D [6308 0 R /XYZ 85.039 187.165 null] >> endobj -5868 0 obj << -/D [5860 0 R /XYZ 85.039 160.604 null] +6314 0 obj << +/D [6308 0 R /XYZ 85.039 154.947 null] >> endobj -5859 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> +6307 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5871 0 obj << -/Length 2297 +6317 0 obj << +/Length 791 /Filter /FlateDecode >> stream -xÚµYÝoÛF×_!àL¡%E.¿órHlÇuÑÚn¢ (z} DJâY$U~TpüÍ)R¢’îqLrvvgvvæ73kkjÂ?k¸†i‡S?° ;¦«lbN70ò0±„C½Çón1™¿÷œ©e¡NëÓ:®á¸ötÿ®Ýþðöeqÿa¦Û¶­)˘é¾hO‹û‡™¥}x; lmqÇã?=?<õ ¿í#¼~zyßψɟþøôÀS~}|z7Ó‘p7ûcñãä~ÑéÜiú…¨ðŸ“ßÿ0§1lîljiØa0=À»iX0œM@cÃulùÞM>N~é–â1gʳÆìãÚáö¥,·g ËR†m©©ïš†k:d¡2©pû™®|­Èasqƒ<ÏÒÞÆðù×Ìuµ(Ÿ©P«£M2ÓÓÓŠ5>]­Þ¦SR`•×zÕ<|¶x•à—pUu4Svä¯hµÂ±V)£Z¤D¤/•B\GU”¢áox2Eƒ¶CèÚ)¤}­`2ÉÄ…¢å.aRÜD;yC:qd…ðgh€øs)Jâ{#šoPÞü½=°m -Ϥëï˜eh~ðˆÐŽºà5ë­¢ýY†ÞøŽ„%oF¤éÊ´ G¹ƒ-—EQÿmD® - ÏöDÊ9®ÌÛ$©Ñn^EÙ Îh‰ö˜/ñ0óù!ÍqóKR#æ£@Mys ¯K*¸´øãMÆQ¡„®È‡\1yË—´»"•Õ¢\^h»¯Èž0wk¢,êS«ÎOZ¶-|È{%ÝA¦"´äaÜ&Š8ž¨ *’§ø{cƈÍÿÜÀûJ¬D"åpÿÅB7e²gˆm/l*RÛ´ºæ"L¯¶E³;}îËîxc4MH¨÷ô[Ì>´93­¾ç/ôƒõ™Ÿ¢‰IÖÌødS\6ÏÉ{ÆbD—WÝ6 3ðiw¶©Ü™î*Wû;Ä·2MÍ4ßÐSÁPK°P<O—«=¸—¦î€rë¢Õ`QV^Jq!3@Õ¸_D®ò(tt=Ü"©™P±é&§ùM\fQ’€#Z2Ê5õ@"û*MOÊŠ)í”#*K'"Z¾ÜÝ^wB÷ÿäKòÿµÄšÞ|ÍCŸü æìÐßBOKV¸ê¶à¯e´Âm½2kÄÄ]ZÕü†™Ÿ '2 ’s~ŠIJþú•t‹ùPEx;QÜ.ô¯Ì}¹Ž[d5˜ð~€ÿ—¼¿ÖwzûK>Gg+ØZò=ÛãQ—üà lÈv;Ö³͸Èycømù†¨ëÞÞ?÷6ÎÒL)Pò,›2NÉz£n7øÐ$`èñ‰ÿ¬õ(¾2öZ.ë͵‰‹ê1‡”›'õ§*)G|O÷ åÛƒÝdäAª¸ùW5FìÐŒÃmmsˆ; ¡ÐWQ -Ô–JÁ_zÚ¹°nJ -1É¢'¼AhCØ(²:;Ö«w·o¾ -¾ALg2ŠÃÄñÁ‘tBôÎsÏ|äNN9É‹«+ÎÔgDwú>òêoa¼-²}SŸ-ê^aÍë¢÷º· žò¾4K°íuÖ«m’Eß°û{ ¤}™"†}•ù|`/»tuÍË„=?ž¹¨õ¥˜ ÀÑI\S[Sá³bwÃÍ™~0'å2Vû7L]I¹1j9£ŽXg๤¬U n[á•DFy¾¹h}$cŽzSqÆ=ƒˆ ™UDcà8ÐÜAx—§êDæW%‹,¢êmã/5ú¦äÝ;„ …*œIáêÀøx-Kw@¥‚A¢ÆÏað#âgfŒJ‘|œŠ‡âµRW(âÚ9†½¬”$I½šï£ª:Œ•ržgXZ•|€¼+nvátŽ8¸D'=ötOø]È·¨s¾â‡´Þö ™VO¥bž˜¯Ab\IM°I»×mÑ¢|Lóª¢LÛåF0NÖKÝËI|ÜðN|“·çFn/Ž1³t9úp.ºO}B›£NAŠZ¢5ó¾c—Ã|sÕ0Híûüÿ¤Wsõt/ìXû+×*–ž÷åˢ݅(sä.ÄrèÛI¾b€LÛð`#Úûô3(åù’_á…̜֥Ǘ6455ŽW+:ú½ÀÚåpw+S^ù ÛV`8¾3º½VsÝfÏq¿²?a þDÚ7ŸÏÕ²ìÂoÚ[ïR(³\È<»à€dã D²¯*¥ÚØâ¾—k2´¢²†-%ðæm,$qÅJ'ðätAÕ[Í2<<#ôæZZžÓb¸‚“ÆC!– mD¢ÀŒ›qj™/t &4±}ÃWÁÀÍéZJAR.°ûTœUEà½à‚ã;•˜‡!O.Ñp‘š1þ•ÚQ§ëi¬ga.øÉjŠî`ãõQÆ[Léà§à£ì˜8FbÀUQ™ºb̾8ÖïJ/ “êÈgd”:é^´‡^˜?–#¾œ‘Äí "Õ”úq¸Ë`ÞÀõûù"¥P›WÙrI‚.1™:XùƒdKû!ªY9èK¾±æŒÉÃx¬¦‚æÐkx높Tbw$™.t¢mcC3#›Ç§O¼K¤yí¥xÊï¸ø–ˆš¤¢Ë¾Ê¼æ³KL™G‹n!ï„öä%ÐÃé?›ö캢0!õCíg*ˆ.Jé3Ù!`^Û§{Ü¥ â´b®fßêâ ´gW®O1x -QK#rÐ…).1¸4üÀ%×´9ˆå˜mØ_· - qÁÉ°ß;òvVÿÈÏrý©l¤øk0ΈmÙÞ Ýô­s#Ý]­Ní]ÛêúÊ¡¡éö®-ÒN·pý =›ÀåÍ•<½ÍBðŸwû_ýÙ¢KÄŽmv8ž3\¥ eµºP¼s}Û?o\(üoèl«endstream +xÚ¥UMs›0½ó+8Š*BÈ=ÕMÜtÒ‰Û&L{Hs €m¦€R“¿ß]IØÔ±séx<–vŸvß~šù|˜/xêÏ%£\J¿h½È߀æÊc:H8Á|̼wŸÄÌgM£ÔÏÖ;‚&‚ûYyO.>/¾eËÛ äœ“8¦A8ŸK²¸ bI~Œ1²X],F.’ž³Ÿ¨þzûÅÊnD-PvµÄËr•Ùµ·Ìö÷®LŠìþx÷‘_B$×^Dy*ý8G”ºõ€ w÷Æ»ó¾ïMY]âÛW§’!¸¤Bò×Ù`âD6DDE”˜lÜU• iØBî\ª Œç¤BFv nñPuîµê“º³I¶ÕqðqœÒXÆ{W†3*ôÆ!n'ìGt8¿fléßÔ@ÏðÔªWëÁúÝT!ÝT562FJ8lÌéNyo²!ç$C]4îÞ©÷A˜$ a2e‘8Ž/á3:çóã;ªÉˆy;ªcK=×KœÑzäÍq8`Œ³´ åÉlÚQlº}Á˜‘¤äBµ-&Ë:›“¥Ö*àÑý9:ÎÌ›t˜³ý8›%t&™¡“A/A?`s­‘‹n]áì)À:c]ŸëòPT‹‡»ƒ [¼ôxáÐÐÉØÛùÓPi Øæ½=<Â$•±cƒ}sqžP‹ŽvÅÁ#k­Ú‘"T?ÔØqçRíyXŽ(ë󉘾û`’<æTaëm0Ǻᨧ&m^7Ö0ØHg¤©ûJ•Àè­[*HÝ>5õ4 sÑÀÝX¶]>a SÚZÕãóBP[ue>€Ð¦ô©~EŒ;º* Ø‚ã\µuô´y©´{a|cÔ®qì +Õ…'b-wã ãRyÕÚJì@»S=BG{7YIjmÕyÅî@úg|g,õnÖMrP»¯ºBí0ùfL¦¡a6‰ÝŠØ¹Û*Ó•y†"DZ4»¹¹*œ›kÑ8=5Fðµ)ú¯¿ý0&œJžžžE‹ f#, å1ßñoæá¿"@Âendstream endobj -5870 0 obj << +6316 0 obj << /Type /Page -/Contents 5871 0 R -/Resources 5869 0 R +/Contents 6317 0 R +/Resources 6315 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5852 0 R +/Parent 6302 0 R +/Annots [ 6319 0 R ] >> endobj -5872 0 obj << -/D [5870 0 R /XYZ 85.039 781.388 null] ->> endobj -2010 0 obj << -/D [5870 0 R /XYZ 85.039 159.668 null] +6319 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.286 747.387 437.733 759.076] +/Subtype/Link/A<> >> endobj -5873 0 obj << -/D [5870 0 R /XYZ 85.039 139.073 null] +6318 0 obj << +/D [6316 0 R /XYZ 85.039 781.388 null] >> endobj -5874 0 obj << -/D [5870 0 R /XYZ 85.039 139.073 null] +2082 0 obj << +/D [6316 0 R /XYZ 85.039 731.943 null] >> endobj -5875 0 obj << -/D [5870 0 R /XYZ 85.039 139.073 null] +6320 0 obj << +/D [6316 0 R /XYZ 85.039 691.78 null] >> endobj -5869 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +6315 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5878 0 obj << -/Length 926 +6323 0 obj << +/Length 2852 /Filter /FlateDecode >> stream -xÚÍWÛnÓ@}÷WX[›½x±„PKC —¤4JÛ%V»ØNCü;»;›4nL(EBU•zç>gv2ã‹?búa˜žOó}3žØü"$‡ÑŽVq6töC£ÿò‰kŒ˜áÙµŽ\ÎÌ09±^¼Ú; -Ƕó(A¶ãy¾5…ƒC›XÇ{¶Ï¬ppò·ãñàŽ$åZqüpt$þ•°?Hþpt&Ÿ†£}Û‘Œû4|m ÂuÎëlD~Lø«qrŠÍD€{m`Äß\Š3FDˆç†Èq—i:7&Æûµ+¹&XuÕ‡3qŸmˆñB#ÔôØp®*T7QÕ|Æ‹±N¹õ]BA‘O|Ó!2v tߘÏz“wû=¥A~ÒxV‚¹SÀóAo"}gÅMKs8Öiu™ÅiýÈ–;+‰Òy©=õuÕÏË8Êûu4ŸFýiVôëù4ÑŽEFã£p8M:<Â{oŸ=xÞ!SYo³èè~-®Žn”Þ駬‘’û€v ©$¿ÅÇþ -߉Nl5’ô+°¦£–½•ëÖ:…ÇÇðüL˜«²rC‰·rkÊE<Ó¥¸ŒT)ÎûõbZ_Õ²»Aòãç*R -h[ƒ¹­‡pp‡Æ¼Q<§åª·ÖÌìuré·HẬ\ó"qÏÔ³JYšËB.3eùtWö×wuûì¡k÷»P¬ZEù…ª h7Ý=ª"cf=ª%¢¦”˜ëLÝ}ÜdêþC‰jyx—U•ÖP …¿·«†Š§ªUšê -Hy«%Ø×3)‘%ªtKªYå¥|Ëy$4¡AV ²õ0µrèªò¼ÖßÐm”ùFoKßYÝu¸uµ¨ÅŸö)ß±N7çÙÍÁ;[4׃7)—Å]Fðy–çUk¹]þmiò;ó?£)v¡¡§k1þgHw]ˆ÷fóqäQ¯µ«æÚÃÙŽå'M7,·ŠÞëýæ…›aDƒ®—dñGÿô.¾þ)â2ä³`ý¢Ý¥œRDÉ*™8õ½›ù®ÞÙ·þEÃ6°endstream +xÚ…YÉ’ãÈ ½÷W”çb*¢ÅæNÊGé%ÜrôÁãCÉ’è¢H™¤ªZo<IR[OTD1d&Ëòï<úóï²ØõÂÕ]šùn˜ewùî…w·¡™/|¥ˆâУˆÚW&—vv™®¥WiôŒeê¯Ü0òAófýâÕ‡À» <7I»õƒe$É<7Ëâ»uño'ÝÅ2Ž=çÛ±_øÎP.–¾³[,Ã$qLS ‘:¯ó¼=4ƒt¾.Bßi늨óªìÿYÿúâýzäÄž‘&n–üœ× óêÇw¾ç®¼Õœ×Ðs#?b^×Ûª_42'_™³5û‘ãã©Ó£} ÑÝ-ÓQ³âÁRWÛR·8`²ãÕÍ"X9ƒŒ÷ƒ”¤}]›ç=×e±Ñ©¢ì €'Œó…>`Óv'DûÅÓ]ß6¦–ù=æMŽC•ëf3I‘„³ô¡éßö±ÁV‹ 3: ̧7;ÌßcO™Þ™ª®°p#ýºêi¢¹ïs‘‰æž8Lå]CÈRç wZ”rŽ6}ïZ¾VAÍC>Tm8Å*iïyÛ–ÊB€¼ÙV”3`D–ÓöË+2rh&HHßÐ!ß—¹VÕÑP¬;Â'h†V=-b2äºÂ”(“Û‰¥EçìŒÜ»í;Vø,Ê‚“¡ó}kÅÐMËùÌ¢Ò»°šéÔk›>CU¦¿r˨Y)r,UÇr Cb–U~Ølm_: £³ë‰2ˆ¦ôÛË÷ìB2hjVPëÞpá8õÝÀK~êÂ3 7~D”Ì\8Ž|7‹F¸ñagÑÊù°=§4ÃA|°?Ãœ7eSþáùÛÐ-”±[ÿ”ʼnæ&ÊÄ^è®"A™IÍ$Ì öOÔÿ&ÍïlÄ…ÀA±Àù¼&MÊô3ÆŽ“ Po8÷£Bè­‚Ívñ¦|–Á¡…ÇU¹ôN¶Ÿ¯5÷à«&­ÁQ÷nå[íöu¹³0†xø#óuØ_1ǯ S€Ç²Š±Ó÷Ø—‘·bTítŠÕ†©+Ø&='iè¬A8—)ÈLÝ*JaunÀ ZŸ¾Éüwö IИûÌ;Eº=ÐÈç"óUAתwŒD %Ñ\ÞÚ,kˆg•LN†Kƒ šå¢‚ÎB\2 +ç©Ð ÜÜd§/¥=t=„ú[3ü]¶xs—–AÆ1‡¡‘'Ý‹UyØáÿ½F™âØùE@R,¯=é°„~ò?¼ØWºzGáÂ<ŽA­§i.«XEµcõHde 7CÛ)Öœ@10J\È…û– +Q]ù¿C9‹4´-ë½R¶–¨oë)Ⱥ–— u½UÆÌ@lQ2I'"ì`4f>ÊÙ¤¤Ã6–Ä—6F+ÏódV Œ¯5ZÏÂ=(ßUœ>ÈdÛ…Ø‚<Ô•uiÄOŠ—4´ÊDt•uŸ³l.-ÓÞ,L"½TϫͦüA©OÎL4Áè¿œñ*Óérd IHçˆ%°U26l%oø mIJ[oYâG™ÌM#ÑYS40¦‚nöœÑB2ÊÊ·â˜Ó–µ«¹É‡ƒ©kœž®ôtj¨¤+1Lͱx&4{Nxú‡~žã¯Ùdh„…͵ÝO ­'ñQÛRˆX[‡ò$ÅJÕ +‘¾ +F†ïw°Ñ"B@÷.Ev÷: ÈÜ&y¡ÿ®²FÆ~z”Qæ+ír©çOÚWÊ/÷ÈïÿZå<&àú¿~±¶È®Î¨}Šôrr!‰ŸK&Îʶx *Á½Nï°—XBCó„»\@¬‚(¬Ìr.bfjÍÇ #F`ôzL‹¢™¢£ùÔQz„…”ì?UíA§ØyvÒ}-Jγkš=É®©_Ož,öÈJ/ pÂ3ª0õíqÑ¥žG1±çN È¡‘+™gÍñÝáPĮܘ®`#ÜÝǯÔûÒ[lV¶¿ÖB11!ð¾ÖÄúç åNè*…s#Ÿo–ˆMGÄAž*6Òæ$¹è¿Â投s@*f•¥-ADÛŒŸ”%&lÙTIµõa§D}ÕäÚÜU…Ђ—y3q€€Ã¸Ÿ<0´V€ËîjdŽÂ%;7dÌ{£ :Œ³P ‚¤ÉR>./1à4I ãT„KâÎ4šÙ¡×WƒN€™ŸiYJYœÊöCàÈÉ¿ “¯X”‚ v‡&‰Ë ­<0%ûÇ”ÎÚlx&`)Ü@e'3„º[}Ël]mu-îµ{Ùn8XÞ†j,à€)¶>Æòö¼® EøŠö¤ÐïÚZ'§rËB Î0O +÷#Ÿ±¿â9M9ˆë0· 2M^Wå¨O¢c·n»G¼1Tœ÷·Òš×@µ@²xÚ´–.vß™¿ LaPÄ ¥þ¥ƒ +*ÂwÌ•FiË3ÖŽ Z~Áñê„h?°ì¹Š»ÉÑëiÏ_¯Åþ®WG ¢èI:B¤¯>$Á¬zKB7 2ZueªW³PŸÔzT¢%Ôƒ¦@õi¡¬ªÎ;û4¢¶0wR|¢œ||tb£áÝ*ªƒ8þÓ7¼ÍÍ¢:b7É[TZT¿íJ3Ø +ˆŸRÕ±¦þd³™Ï|;ö#ùô®Ç`ÏPq«è‚ÀÍVr…‰æfÑíg©›ê3ä¿šbè2$Pø~¿Ìžhœ€¶f#Â#K(ÏbkªU~¨M‡é£Û&…æC[kò0Æ—ÔâsrÆÎÎcéÁé;ãæ¤fÒˆêÒHˆ®ç²œ úÁÅÛAè‡Î*–´ óüfCcê&hÚ>Ö´÷`3  ´èZþëK4ö-S÷#ûŠ‡>²??›ÝoËðíë#C{¨ éŽ/„ÌOmr›¼1Ë .èyE´?¿_ÿþ5É—Ï—Q®ßr5$ZØJU‚OÑR~ÕH;oÅ8k¨ë²¾óº—¥¢1jÌ! ëv£$í˜e´vÖÏÔ¾†ØLƒkTºÃLFèÚáIÜ…òo“qj+cÑpˆåðÚÛŸ”IT?ðÛ¤Ù§ífï.ždb‘§FŠñü Ê«£Ì22Ï©æ‚ÁÄõto4q4½ÑTz(®^kAM]c½¦™LÁ$\h|fñ"+m4GÃAçôyV.u£Ð•ç }:à7—nP¼µ±|´µðŠ0F”6t‘†¼gn3uùž+ßy)ýÙ»ÕÙi¶v´ÑKØÔcgÆì©jÊ›ñüJ~?£­ù‚Öž‡©H—¦W?^}RQ…ñr05×K¹Ò²žøÑ›Dªý™ZíW~  #߶šõÆåâïw!—ç¾MÎwÜŒayˆæ{z ª¼ã5 Ï¢.9Ù•ýy@³êsžçòÆ?ìaú*´ü ã>(ÅíÏ3úK×`™oëvÿâ=ó(ÃïùážsºNú˜?UâwËÓùRN5¤HFwª6qÎF«§ª°—#¸Â©Ô<{Š² .¥=«l¬'mî$*µoýDóöÝKiÜÛ ZÀ_o4ƒ.ÇÃFô&z³1¶N}æûl¥#‚“S%]¾üÁ'RÿˆÄ˜ñýÓ—±{ OŸªºž^†‘ãk×ï FN”'9 Ä•¤bGöÕîæyW/£SQO}ÀÇ¡çñÓW³w¢½ýV‡U®ƒd/¯¤²Vþ¦³ÀdQiØVÔœ%£³_åäeœëD<-nFSRlÁ˜¦sláé‰òŸ‚Ü-ÿšÏP÷7–û­ 6ôÜ`5Oþn&#åe +z¡›v3È* VçÆaæÆYxûÄÿnµ¶›endstream endobj -5877 0 obj << +6322 0 obj << /Type /Page -/Contents 5878 0 R -/Resources 5876 0 R +/Contents 6323 0 R +/Resources 6321 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5852 0 R +/Parent 6302 0 R >> endobj -5879 0 obj << -/D [5877 0 R /XYZ 85.039 781.388 null] +6324 0 obj << +/D [6322 0 R /XYZ 85.039 781.388 null] >> endobj -5876 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +2086 0 obj << +/D [6322 0 R /XYZ 85.039 761.463 null] +>> endobj +3124 0 obj << +/D [6322 0 R /XYZ 85.039 653.495 null] +>> endobj +2090 0 obj << +/D [6322 0 R /XYZ 85.039 571.206 null] +>> endobj +6325 0 obj << +/D [6322 0 R /XYZ 85.039 531.042 null] +>> endobj +2094 0 obj << +/D [6322 0 R /XYZ 85.039 255.047 null] +>> endobj +6326 0 obj << +/D [6322 0 R /XYZ 85.039 212.094 null] +>> endobj +6321 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5882 0 obj << -/Length 1329 +6329 0 obj << +/Length 3402 /Filter /FlateDecode >> stream -xÚ¥Wms›Fþ®_AíLèÄq  ™|pjÅu&µ][i>ØîIHbŒ@áUO›ÿÞÝÛC »õt<òÝííËóìîÀ þ¸x̡ᜉ 0&ËŽmÌaç¤ÃµFO«ôj:ïGþ‡kp›…vhŒf~<æzÂM¯ÍŸ9º /­žÂt8³z¾˜§g£á‰ÅÍË#+æhxLûŸÎOÎAz†+×¼‚éç‹ ø~©ÔHüå§g'dòåôì½ÕCÁ±u;úØŽ¶˜·h_ˆ€¿u®omc -ä>vl&ÂÀØÀÜf¶—@Ì¢¾9%Ý(ÓLÌþö=ëhr‘ã*­ rÌ릅ä„2ÜקHÛ`²ÁyñÀ ÍÓYWBÂvƒé"­{ü‡‡'´‰o´T¾#©’Ú™§ªÀxrƒ7[êÇ}æC]¿µ,úi>‰R*_\5kÇ]º†•6— gy¡qÝØÜM©¹DÈÍI¾N5UÔ\eO~”d²F%_R£ã ˆÌu› ‡9¡hd#MîªLÀ!)‰ü©µ9 a qlèQ4<ø$]u«u·UÞ9­2åm8MÊm UÁÒ$«Àã5¨ ®+½‡|]TH jšFe’ë󃽶ŠÊ…|Cë ¼uÌ‹|½ÒëE.Ë`Œ'‹¼–â$›ëÕ¯ïŸhæ¶ ²/—ãª×Žõ¨éÝpá>Õ¤u/àMòlÖlZ¥ž‚zÖõ©(ˆ5ÛÇš¾ ë}„ëy“èK=Ÿ|xçœãq/óìE7d?m¡òöí“hºx¼º­·˜6®nL}b÷#4•äQúW¼-ŸRðâÇ_?¼½\†Þ‡kx¹»üóþ—‹ë{˙ݸȑ­ÿ\üñg°(á¿\~”g‹'~Óû àËu$ïÍÅÝÅ¿,)žÓ ^5'…8Êü8‹ÎÅÆ3bˆ?4‰áæΓiïK ghKø×]ªÔ{{·÷š(˜ +ÛÃà/”†¼ÑêÇž.\`¸Æ¹Qhe‚40:”L gÆ]…RƒËÊ.UúAžÀÁÁ»ã0VûË¥bïS× ±õ‘_¯Ëzìz¦prÎ0Hü@åBáК²VqO{¢±èG~[2™Èe$S~ ‘Ìm£ü$ ቀÈ,–:R~ +¸ ñârBØöÅ$¢U4»Y”ø™J¾µ[RÉáM¹¯ñXõ@’†Q_Œµ¹Üãþ2‹äJºFöÝÓµˆu@ˆòj-ª~yïiAÏpT |~©NdÞ.J¤8(`ž0›b¬z†­›º¢MFÁwµŒþ„º!`9å~®ô‰˜ö¨~¨Cr22¿œ#%­Ó[MS•<æzo;”ÒÞúl˜>Ñ° ¤Æ”o+8Žï©w8eÐè(ó;«Æ¨r°áu~ÞÅÓð ^éå XAÀ£'¶;ÞÔ뾺Í8,Úb‹ªâavx +N7t,c}Ç“92»ÁÕäŠà.u†—ãè‡FK³ë„h™1"€AKâɈßÌ+ðŸÕ§Œ$D¤->écô YãË®h·dñ[6™ß@²,ÍE"I&tE+XK‘ãÜk.Ùà9æD°Ÿ^¤rÚŸm5²Ãö^ó*Pàkb¬yG}Æq±> nMkh (`y×ϼ`³²Ïr…ðy)<öü«5²‡÷ÖvM·=ºœðÙ†™£ò7»b5º(`³ eÜ5%£õ¸}S fû°¡ò KJ­ OnÀµ|ÕŒµïúŠ¡´¶Û?6Õ×i+ë–ˆ³,óøGºùÔSoæ>fͯ s,ìW¬*Jɶ}U"ÆÈ EÛ¶»×ðŽŒ ppÂŽËÎè¨%U<ŠÞ½B¬è B¤à„«G±²²9õ¥ì¹:LüÔ{Q ÅÚT2ÝÍbæXwmÑ8 +x~ùëŽ%6°o,ÄaüºíÍ]™ Ú°^Wì,\'™½i†9Gç¼~ ¬ +²œm;Š3òŠˆaô Ç|ÛÖ$41jÆöÏY{ŒEa8ÚÐ& Ð<_äëšÎœž\0΢SÃçaÛ]sdZEùWm"J±"õÆ»‘öU׊oTilt‚Ά'rýŒñÅiƉWÔÝ lz¼'Ýü×舧å=¾ƒdR­˜$Í×"•&ž½Ñ-]FIiÀöyò©C퇉^ÄYêç¡æœ'ú­`|v²Gƒ½tÐϳÇç4QVЬ]i;t Å}7…|1(˜Á[¦ü›ªØ5éO—ä¬aÓ=+0Œ@*£œÎ9‰Ìa€OíÏE¡Â2«h§Ú=›>œ¥ƒt.f0Œ-%äöÙ•ËA‘¹r`˜CÁtÑCàŠïwU/¸…ðŠ¦è·‘l-äÄh5ù¦žQÑ ðYZ‡=«¥F†èWXôaùYrš£eIÞ†5:‰ÙÑ%){N´.|éö×*IÀÒ+Á@€^¡ƒÉ?ºCS2¥¢a 0‚=.ƒ0Y?bÚÒ-8Ø°JTò9í„À ½þèl Nš«ŠÈ²9ÏNö|Ù g<ÂèVìE‡z”dT‚þðSß¡ÜùÕ(2{ªÐûaÎß~A)’lH²ÍI¶ðZžèÕ´,¤ƒ#dE^]\7AJ[¬;Ic‘gÀˆ7Hü`øνy„E¡Fò\=² Kt¿“U$è yñ=Çw¯Gòd&µ½Ô’w' 8 êµ3.™ÁGq¦6" Â’GôA"_?Ís怶*ý +t徊Ô7› ¹³!‡±SUëì j><Š|åö!ˆ*ŽS]w—Ri ˜½ºA>Ao?!œî”å’¢ù ¼&Øì·!΋ nj>âõwJ­˜8¹e"˜BŠJ(:NçÏLÊŽoVÙü~ÍŽMƒÈtüä +…yKa6ZÀŒÁ ¤ˆ +y|³25a8D™šÅ¨¥aâ}͸þhϵmrEPŸn:Þß{ šÎq•H²Ã²»µNò»Æ$0÷ö?§¶¾ÙœÙ,¼ê«á¡¯ìEi È_™TI ¯ÃŸqnÚ˜hØz¬ŸGó9 Æ…FT+O†õÉ•WŸ93ëÜZ‘šct±Òð /Y¬ë†ó4Êc9W•´ßî+Ý ¬A•Ðzøµ°Í4aý«Ÿ‹ç¿³^ïF¯„qô°«9çûª£R)jƒÄQj|¥¶¡âÈàkÊ»ð4Ô.Oð´Ern¡ZðãQ®Ð¦6Bu^Ü3#!çv~¤¢œ ¶1ÚÞ°ßH ê„ *²ˆ¨ƒ­Ôˆcl֯Ε–…á+à\¸92ìÝwóÄb ]SäÐ9ä>9%?½Fê1 &*¤j”ÜÒ¢ L¥ã…Ô‡è6o|Þ(2šúÈq€Ã¹¯ {VzòøB¡©X¯‰m.j–(Ó,œ©œîF†Ð½¨I¦ûãöúþ×?}ÈíŸ vEïx´4Œ½²rrLjÈ6 a+²Øzçø´—°ßy +|OÝÄð¹ÜRþ¡ò€•uû¢n_›"Ÿjô!8*ÔmrRç6¤u;ÙHÉ‹¬ãÁY'à+÷(ÉÄNoļLO-0­¸ü+êìÀúj[cd +l ú…sî nÀ‹=/œddä!‹Oà];çYÞcZzè'·&TNÞ 6¦lï]½uüi?i¯•­ÂÁŽ(8üÌCÞ«_;ÆóÏZ4ûû5ìóŽ€ÄR·pʲð¥ìøö9-ä1ùÙÛ‚VFû•×s9nzšÁ&Éðš½Á‰ïGâÕYg–È–œ¥»øœ L±±žLÊKZ ® *T´ ëšÃ1µß¨¬v~fÙ¦›q…@n*Ém—a´-ÁdŠs +[ÏÉ©¡”¯†‘»,ðRSý£Á¦¹àñ¶ÜÃÞó‹»9vXm–¦ø”u÷hB­Š¥ šLá“v7†¤%¸9r${r‹¡Joò\â‡$Í)œ"Ìx¯”øçªåîÞ~訮d'‚# )ë‚kÒNð Gžeµ£6V”›ê”e•c–.*¶¢MðUaSŠ<1-qZoÄ’K3ªæu›W®gä&÷pÞH{žV¥Î…¥)(¥¼QÏ&ˆ¾c•i\ç‘&S­ T¬«cú?™’¼SÂZÝ™7·‰f*º8¼_%DÉbºÿTÒ gÓŒÁ¨žK§nùÓ•O?”Å*’OWíf;÷u+ñ£Ä 8 âsbJùi–}Ÿ˜”¾² a=ÎÑK|ÇŸ¹¶:Í´Ï)jíg:ÿûÎ&êKe DN€ºjÒ±óP[²9jíä†d t‰¡¦<)Œ]½àô¥ŽgWè<¦†ÒaeóCù´¦Ê’ü´ m“u2Cü¢‰ž‡.‡~Ýn(Ê@QŒÚ†˜)T¾ï#rû7É™mxÛ¢6CFYÛ8÷HÙØ0ÆXïíщ˜8^á²|6 sÕ9 4n:ÆÀØFÒ@œÏs®ñsÆ”f±÷[Ëö:R!Wpt1)F§%Ñ?{œ¤<ÝñÓ~bÀ—²DúÞƒáO''ℶ¹eñËJaýbÝV†ª3€ˆ”²ùÿpÖùFEž0Í£o6*œ›*a |f'Mõ¦ +ÖÜV¹qêØÌtYŽ z_7/öZ gþ#L8/öZ’ÌW)7‹Í7y¬òÖ}% lê™2Òq `Û|öIÅ7·À8S^$ç_ÏxxV沘ðùò¯:œò÷y¹j[;¯Ù±%êäg ¡Ÿ&ÙäÙ äƒgƒrùñ«¯ÕŒ7L´¯dÅÓ®æÄA~  b?r'!•.¯n×Íz$%ä»~Oj€àoPW‡qæ7(a’øIftK)nx·¸e—æÞ—®¸( :§kg‰ø¡6Ñ7ÓÊ4þ5è«q0,˜Û¹žCB¿u± ‡„C3‚e‘9ï¼&G¯ò9="Öÿë×ISç1ò³(Ÿ7†¶ + /(Œ(:ûTc~ÅtÆð×Ò<endstream endobj -5881 0 obj << +6328 0 obj << /Type /Page -/Contents 5882 0 R -/Resources 5880 0 R +/Contents 6329 0 R +/Resources 6327 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5852 0 R -/Annots [ 5886 0 R ] +/Parent 6302 0 R +/Annots [ 6331 0 R 6332 0 R ] >> endobj -5886 0 obj << +6331 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [362.947 691.474 416.333 703.163] -/Subtype /Link -/A << /S /GoTo /D (winbind-solaris9) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [413.168 584.796 539.579 596.486] +/Subtype/Link/A<> >> endobj -5883 0 obj << -/D [5881 0 R /XYZ 85.039 781.388 null] +6332 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 571.247 216.819 582.936] +/Subtype/Link/A<> >> endobj -5884 0 obj << -/D [5881 0 R /XYZ 85.039 708.141 null] +6330 0 obj << +/D [6328 0 R /XYZ 85.039 781.388 null] >> endobj -5885 0 obj << -/D [5881 0 R /XYZ 85.039 708.141 null] +2098 0 obj << +/D [6328 0 R /XYZ 85.039 489.232 null] >> endobj -5880 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R >> +6333 0 obj << +/D [6328 0 R /XYZ 85.039 453.822 null] +>> endobj +2102 0 obj << +/D [6328 0 R /XYZ 85.039 127.793 null] +>> endobj +6334 0 obj << +/D [6328 0 R /XYZ 85.039 93.047 null] +>> endobj +6327 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F38 2997 0 R /F20 2961 0 R /F41 2994 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5890 0 obj << -/Length 2650 -/Filter /FlateDecode ->> -stream -xÚ­kÛ6òûþ -£÷E>D´HŠz´(Ióèm’ÛlPÚâ µ´¶nmË•äÝw÷ßo¤–v ‡`#r8Î çIËEÿä"1"Ðé"N¤ÐI²Xï/‚ÅVÞ\H‹á[€óâúbõ: -2i.®o{:F„F/®ó_¼ï¾þþúÕÕÒ×Z{JŠ¥ljwùöúÕ›¥ô®ž/í]¿zÉë?¾{ó oqz`øñý{øÿÝ¡1ø#Â/ß¾á-?_¾}±ôðrùÛõ¯®;ž;n€¿þýâ—ß‚EÂýp&‹BÂòþ8&Ôv¾»øpñ÷Ž¯… Þ5§£a=U6I•Š0 ± „ BÒÐ_ ŒDÞ22ZKi±Xo«¥o”ñ¾úØd›âkž¬Šv½*e+òU“ío2Ñõ}Qóê¿ùÓ´YÝòð?Ryô߯èÄ`tØ7ßÐòa˜&[ãÚ굊ãGBÅ ³DÄ„ù|“•¸ g|=å-?-UâU'ž<,UŒéír†ìJ˜Ü!NÁ—ÜV¼PŸ8P^ƒ—œíå&³´üÍ‘R¶³“¬Ø#je÷@öä€R ÜòU»ù¹á|œ“„£ ³ªXpñ(àêÔÔ«]µÎv¬ùÕMyX=”øäù:"¬gÇx»e.Pà†X¨QÇ–—³`…ÚºïtƒêLDl·_?ÎòàNžf™ìÁqî=R*¡¥Z0}©Ô¬Ñ;€DF¯‚¡ÑŸQB–® -°Î¥‰['Ía3a!ÒBëøi,΄…Ñ%È8*ŒF,\‚i†AÔ›&Nê‚ <õ‹°¸»&Ó*[agW`R!¨­~wÅ×–[p†ðœ©ƒÎi+‰›;xLT22Ç}uh–µ¼‡N/-ðH‡V´)µÏØc#)RŽœ¹÷¸¬k[v|N™w4§Ô ™ Ø ù`¬­Á9[†»õvk74™•$°õçŒg´+kì‘<Í«}F¾ã}1Òl<Ú÷/ôðfÀ†#áeÆÌ™àj::_Ëøƒ -áè@ºÒUÔâ‘”b‚DD`tO%ÊÎã.¦±P_$G#àl-È’pÞwÕá×@†›SÍáÉ×QäýÌ~‹07x¿L•÷ü§Gø Sø~&±pfüÇñG"’aç?J›^ß8Ùf8s¯täí³ÜŽÊ–qÚmÉ*FàmVƒ£(sFç-¯BÈã‘d-Oœ¡g8?Â]¤Œ­·dµå‚,¢ªïlÈaŽª Ùˆót¶1“"IèX˜“ÌØ!yÝWNè „2öü¦ šd½/mžBpvêÙaÚ¸™M•†˜âñÇ5«&[ç;xÊÀË5TxvùÎ82n]d9eïÍœì×äóqàA»4裄³Sâr/,#b zkŒ¡¤Èy…Â|;WÇål׵ลh, CØÿ‹#:‡ ¸ ^–9cõ>ˆ5WÅ cedÏʵφ•Ç 0»;ÙHV«˜šgŠ[nHa<¦™X†˜óÑÓ( cͪsUBÄ#ÆD½íÜÕ7ƒÐ²<<O«Z[Æä¶L*mÉ`]Ft%¥/Sæa(ð?°š&ãMЗð¨Nb"ΑójÆpÔ^:Ž]Eu²iadÊ€Îö€YÅÓúÚ…HÝpŸµßšgXÔ:£˜NS0B›‡¬øVVVâ œ¬U¢ (e¤{«C0ÛðþXZq˜UÀâ$KCÌv3׫"¨Ø^š«Lc]¬MóP¶ëíÌ5ËÀˆ4ÒvKŽGÔ6¿’5}bžn–*uã.×SP­îØ?yÍ’£"«ßc œòê+H/ÁYsQWUû—.f®È29ö OAùº]YË8Ë; -,?LÔr4ä/h¾4­s­—ïhùbÓ ¥ £ŠM؈¬OŒP󕵨ÈÖ#Üâ% "TN»Se† ´·áù½Ï(Ò@#¥ä· ~vÆ16·`ø§PÞ%–Îqªn –z¡¡÷Œã/Ñvˆ÷;§mGÊïiMÛXÍ ÇêËÑTsÑM‰$L¦Ñ µŒ¥©í”½oâÚº:–…]°¡üZçØŒ®Íù RogK:›‡  £ðß>|´¥8ƒCJh¸™“åšÄT…{haÐFžv±ðâ õ¼³‡P¶ùÄã+G¤÷=–,Dù“­_m€Ý?Ã4¦8¿Ms—Xõ§O"t3©sÔÕ®¼Y50_¶Ÿf.Œ(éRÌÆ(c’)LïCµ£F¨Ä’Áhf«€0•¬4pü&Rx“u§8$ÁÍ8wD§>©ñNÛmÙªÇz¥A`†A¼x.øŠ¸‹½Üà>->äAÝE^1"ÓtòüòEr}ää‹‘ÀÖÅW®QJ°a“`€òXäÔÒˆÎÒ $þ™ÈéhùbÓÈ Ñ’ -‡ôHä¬8¬è©5m=…’9_ø#/*M 4§O¿ o—²ø#%ÆÓ«×K5_AÏ€^ú ^GYb¤ Pijû#Äø‰ëQoÕÔ“À -¹GË'Ep8ÆZÖ‰€}(ÁõlUy:6ɤfä—›9»!^›il« òÐµÒ ƒ¸|d_Ó!¨õ¬6´5:¾NÙïktÕfýì°)r,ÈÂлdìq‹ŽOzÅm;xæ*m)=àZq vl÷¤7÷¶E/“jô¸Em’¯d€Fðû©¤"T0EÔâ?›6[ß‘)Ók(W—ßBhn‹½O„&¯ Ùz]öõÿsÀçQ©ÓR±q9 -‡öIâ¾k ºÑag X— ¤+ò*çcc[Nh”w»®¹F°;Ïö«¥LP H¡oµ¯X´ÙœQÿ~¦Qe§çÖÖlkz\®ÝGšðûpQÓ,í_IaLÖ[ï驦ô‚³á'¤„Ÿ|á;ÜÐw¨\úíú%l «š·dvg×+ï»WI>+±Ìr/mÏk$>òÉÐnÜuíSË{vÀÒhžÍ¤x~»à¶=òÀ]q¯ìuí]¢d;μ  -䤰b•¿q"špðžÑXÈ°£ÂÒ$ƒÞè‘Ü™ÍßHØöðuÓòâƒí‘†ÇsJÃ㛂A¶g:º`©K²Þ4²íÍLi‰D›aü£<m>Û=DZˆâ>Ò½ÎtH‘ B&¸¡™@§ô5«ÁŸ® Ì{WÜSa§RãQôï†V´®;ƒñ¡x`,+y׳>"8hsš¶>­[ª¥ºß,ÀÏøI$rO"Q EnÓ½ ƃ‹Œ"Ç#îÍr~G¸´µƒ%úÂ’-¸ñq2w#«¶ØÁh®ß• ÿnÖYüLÝ…]D¨ÔÈNÆôN>:É<}¬Ù‚Q÷6s¤‘B…4Œ²Åœ¥àPý-Õ—hnFf^ZGÍ– ðÇÒý©ß!û×Z îñH©a”J:^èi9IÏùu¿WNþ&ž>Ûendstream +6337 0 obj << +/Length 3821 +/Filter /FlateDecode +>> +stream +xÚ­ZYsÛF~ׯЛÁ”ã>òæµÛ[òFÜÊf“<@$$b ZÖ¿ßþº{ 9©Ú-• +ƒ9{úøúýsþüó,v½0?O3ß ³ì|µ=óÎïiäÝ™¯3.tÊÅdÎß–g¯~ˆ“sßss/?_ÞûÄn‡çËõ¯Î›÷¯?//Z\„aè¡»¸HÓ̹YøÎ/7ËËOÒÿúê­6Aæ¼ysýÏ«%:"ç3M¼þøáÍâÂw>\ÒËÍâ÷åßÏ.—–2{&Q‘ƒ¬?Î~ýÝ;_Óþ~æ¹až?RÛs}Þž]n…ú^ŸÝœýÃn%cѹ¬šãBfnœ…§lðã6Äž{³áçE9m÷ÐÅPµÍâ"ÈbçvOÐNœÊ<©«G3uj¶ÚÝï«¡¸¥Žº”Ž»¶“MV`MG#%´;5›{p‰„“M¨ +|¢=Êé" èm»-*¢#ô‰Ém]­°®ìeÝÁmÒÌõ“X—‘ü"Ñ‹,t@}7lÊî%Q’ÇNQã:›v¿Ò†…ËüLͪYãJñ#ˆåÓÎimâ¦~t~á‡L ÎÉcZú$ÿ w@Þ“¼CÖÕÀ—=gU`ŸF^né‘òy!ÎFEE]ö¬ef«+ŠF&_-#éø÷"1k™ŸmóêÆlÑ}ýréØgy ²ËcEñ6 ‹ ¢¨…tÌœa#CÐpô¬êªl°åлÌï€ï•]¸™œläýRL† ¦ò›çG¬ ½¼ßaR»•:Æ°Nî#Ãr´:ˆ·‘ö¦ØÑË®Ÿ¤«ÆÓ ,ntµ:»hÌQ‘4”«à‚á*´¡mì…ƒÔõr¹ð/2&M`kx’þÒ€&\L/Ïñ2ÜÛ˜%õž YK?#5£ÜF:CÊ!ÔøR­´û3¤\¬@݃¬åñ›{l†x©d9 øêÕTœßö‡&ÈxNäz,/Äס+VƒŒXÅ +ü%nÐø¾çË«’'ÁTÉ£ÜÍã4ûR®Êr-wtÉ0pšb‹Í“ÌyõuÎN¼Œâ c–@í p*·Tb‡M1¼XèÕŽN×÷ÍÊ«!êwIQ¹Œ‡_¿udî¹i”é:ŽB?Vv_¬n”b ‘Gñ +‚š Sq7b:¬,Oœ¤ CRÔ%–næ©…cöϘ9Áå–\ä C)‚ +#;pp¾fž2–ÏÜ'!Ùfæ>¬Ba®è +*ŠÞ*r*7«FíZ aC¹Ý‘ΕòÆ0ËŽ’–C/¿›¸QGLë)˜²è&À¨Å Ü( ¸VŠÖ™s#B 8ÏW^×`d”ˆŸ¡îJ‡É[i©÷}u %E× C‡¶•­[&{z øÝÈʆ·)ùzpP t;ô±Æ`¯kMDUòT mÖ36x_ÂÔƃâ²v:Ÿä­½“§Œ¥ '¥Ð5Àu;âRÄÎëfŠÊãÚüa9›g× 3ѺÉ2ÆÞÄ`aœj|çße×ʤ×ë-#A%a +â[ ×1ú#«õôö±(¤D1!jU·ÊMÁZ «F¼¶Rãþƒí“5Lî"î3IOçì!¾•°Mæp¦x§™J®çù|ÊÑ— \Rˆrç§òžÂa.‘Æ¢"ð‡é’h9&¬$ᘣ0 üüvF9Ny6“ŠòÔÍâT2© +rÙš_1 EòÒs”õÄê@k=ð}eÃy¦ž¦BmŠÞ–è9D²‚ wöéͽD Ý!«8m{ݽÆqÔ~‹5Šlúèùå0ˆ§éeUÑÇH΀™g…ívÔaQçZ¢ïSãëŽ{¯ üÁÓæb¹Ïá‘:d˹ïe´%£Gž‘xoX¸ìÙsµ_4N.#£ˆ~Ðz< G× Ù<$ÄSñ½áP@tïJ¾/£h]²k§K‹Ý®¶¡ø$ hm*£’Èж°Ò®žΫä?.@óÚ¡¡pªT3Mnà…öîho°­:,מdÛ÷œË_Ž-+ +È»ÇÁy”âùJdÐé|ÁãÂìu1ÙìÔ +£€üoÛÁÞ×o^aa|阪h«˜]s¬%AHVÁïU-=åWv¦Õªʣ˪¦Õ½ˆ`R~D‘<Çß4Už$øæȯS¯ÀF)Y¬ck iyŸÐù .ŠwZq!ƒ¬ˆPe£XèTSgo¸×])¯íË?ö%ÛöQ\-^m-5ýЕ²hrQ’E›ª÷Ø°I='E@œi`ã¡E›A:où&º“„%%8ˆqA;ËG8À}-CŒ‘Xfl*Ô„._ÂUtµûá˜J~UWƒF%<ØΠƶhŠûr’ÑiÛ g_Úg’½Bˆ©Œ»§æs>;ò7%cú–KœÌ±>›r{HÆúÄ0K)Î|6`;Ž=çÓ œtB¾²!1¢ÕKGày_Å¿’Ç¿>˸ÛIÀQÂ×÷õµ,ú¼}“RVR"œ¹W˜En˜|óZã”g=}ÓU¼X==c¬è!笑Vê²Ð¹yê9žEçè»Aw‘·=pòñ&9KƒŠ„hüž¤ëO¾uÐ,ÁÚRS.GGä<Ô’¨ë­ÎÚoÍçBs†)eê'ߤ¢ XJ36FÌ4õH!ž{SO?5±gâf/&:Wvç |3ý €+yé´ö2­¢h­—Aý˜ãÅHâGïRtÒÉÖæÉ75Öojß Œ +ƒ¼I¾Àtîõv\¯@ÁPfk©A‹r K½6«{”÷»²XY•j¢Ô´ò¡¶IÄ~RÑùLþ`Òx%´2H7­¸êÊ%]àñ®è‹€\c.û9F0Ÿ|-ÒfÇá0°Ótbnœº´v̾ŸºôPs;ßye|Ð}Ç°ëç>Gý¤®iZð2Û}ÕM'¥¹0š/øê7ký`sšÎ |PYKójùFP…&÷3ðñ£ÎÿËzÒöR;Y‰ÆïÞ1ЃIЯu¬½Óñ«ËåÅŒl.¡’W2ÒoXÑ3Íäéî šÚPaÂÉþø—-èÜjb‚û0ó»ûSë·Ì/Fž‹iL@rß›}Dz+¨£&å¡TeÖÒs™+戌›Il¾§|Úƒ«“JB8ÁòûdUÉ ³£Ê +ýÕÑݘàþƨÓ_4¸'P4öt´ÍÀc)mOúë$þTÔñ ¤Ëå5è8„©#ÄW± »9m¶>2Òï‘ÀC4ƒ14E‹AÑ3ßã"oš¦cA¥ -ÐFRÖ£ ÒøkÁŽiÝo«®4¿†ÀÊA¡ÆPªuÙ­”F‹ß—)‘ðe²òÙ”ç³_Ãè_øô?ý>p¬Ï…n>S‘ŽƒÀ |C ä†þ1½æw„'ÿUa)üendstream endobj -5889 0 obj << +6336 0 obj << /Type /Page -/Contents 5890 0 R -/Resources 5888 0 R +/Contents 6337 0 R +/Resources 6335 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5897 0 R ->> endobj -5891 0 obj << -/D [5889 0 R /XYZ 85.039 781.388 null] ->> endobj -5892 0 obj << -/D [5889 0 R /XYZ 85.039 566.671 null] +/Parent 6341 0 R >> endobj -5893 0 obj << -/D [5889 0 R /XYZ 85.039 566.671 null] +6338 0 obj << +/D [6336 0 R /XYZ 85.039 781.388 null] >> endobj -2014 0 obj << -/D [5889 0 R /XYZ 85.039 508.637 null] +2106 0 obj << +/D [6336 0 R /XYZ 85.039 559.099 null] >> endobj -5894 0 obj << -/D [5889 0 R /XYZ 85.039 488.042 null] +6339 0 obj << +/D [6336 0 R /XYZ 85.039 522.834 null] >> endobj -5895 0 obj << -/D [5889 0 R /XYZ 85.039 309.581 null] +2110 0 obj << +/D [6336 0 R /XYZ 85.039 412.725 null] >> endobj -5896 0 obj << -/D [5889 0 R /XYZ 85.039 309.581 null] +6340 0 obj << +/D [6336 0 R /XYZ 85.039 377.315 null] >> endobj -5888 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> +6335 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F62 4047 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5900 0 obj << -/Length 2208 -/Filter /FlateDecode ->> -stream -xÚÝYYoÜF~ׯÄ/@Óbwó ‡U°>bO°XÄA‘œ![as¬Õþú­£yŒ†²ìÄv†‡}VWUW}UÕ’ þÉE -_§‹8‘B'É"ßø‹-̼8‘nÅÊ-YMÖü°>9{ é‹ÔOëÍH'A¨ëâWïÇ¿}ÿfýìír¥µö”ËU'ÞÅ«õ³Ké½ý~™hoýì)Ïÿýõ‹×0ú -{÷š¿¼y¿¯ßÒ2þÇ/^½à-ÿ¸xõÃr…O—¿­:y¶x¸þRdø÷“_ó÷Ó‰/tš,n¡í Ó»àX„výúäÝÉÏ)ž ¼kN?¡ND˜ècép¢ ©R¤Á"Ö‘HÃ4T6Ùe].W¡ -½sþÜ•…9{.§›W‘P1œ }á'1í}¾LÏ´ËU+ozén¸mËöc•—¨Ë#Á¯ôn—*Æ-Ò»æ‰h¶öÁ8mhk¹CŸ;~m•xfïöWuÍ­¬¶¸ÜÑmJÚ\pOS^YuW@éòÔU†ä>âOÉ‹ª–ÕGø­Šý)£ø‹•“}%Aû¬¬¢BnËéu$EÕ ©cM*@u`»?Û…Ùep -´•··ÌÛ’ÕmÏ`Và4LZ)IÀ²A^;7ŽÊH=ðAè¥â¨Oƒ™!åå¨yÜ–5Û²çÑ5pØìè4Ýg¡ƒô©‘Ë(ö::kwƒ7–aGG é'3þl˦lA£ÔA + T‰Ae¸£ž,cv2<ºáQÐ\K/ƒÐ[_9ñtž¹u—½-!7eFk*6ªcÙXy{óÞ’-lÙÓŽÉÜ( -„àñ™ÀîRä¦ÙÌxLÞö붵¹dÛ¢£èX¾Ù^¡ÁœB+³+‹ -W‰Þ.Õh˜NPÆ §J 凎ƒ³²ËÏn²(Î6à¨Çü&@ð…W¿÷eP;#“G—O–Š4œðŒvv•‘âzÄEd°3C*µAQoyä¶"ÁQì{L™¢F–;è°¼ž\Çù³ËšftjÖˆŒD,ÕáÍVdAh@uÖ²Ö‰'Ý>èÖf;dŸn†GPnÜR‚•`e/{ù¥|—_ ÛDÆ3º…# ÑN‘µYuj§NX šDó6×¼¼®®Ó&[Ùogø])?Q9Oˆ‘l;ÐiBðïß÷àšpšŠ œÕÕå™-ó}[uw(Ù‡º²Ý¦½XÃa¢êÊÝ9:%wmÙØò¼(›;î¿—: ÛQÇÖŠtÎIg -ç׸ÇV´çvœÐÕÎìžpm÷›M•We,ÃxŽo°¶Ëª)íc÷ÿØ.˯é]ˆ;·wô°"B’þUY×ö>óÜìQH%}ÿKÎûK䶥µ«¯xÄãùÈ ¨…ö“cG­Íå˜p 9ÀöÄUŽ0 0@û-ŽP•!‚×wy„¹é ƒÙÜG@Nh GËÏ®‹¦wQ -áÏsÎ^ËSî^ð’¬(zP铃Yà›)`ØIè‰Ý„êq³¹'Á”ô5Ö¹\&sb\ŽÕÝÆ õÎ)/ÂÜkïp¨é\šCÅPQc¾öˆ|Ž‰ñêQ¨9pz\Œù5ˆèC¡˜BÚaEêÒH(* 5Ë€Ê0Òºì¬ã.‡.‚ÓÐ3céÙò‚¾ŽÃÙA{Dho¯!¤*«R=-zÓ©’¨ÇÒ…ÑD:­¡ñ£¾VÁê"Z„4ðî—h;úö¡EŒõÔÌËǪ§µš£‡1•Ä˜'"ó„þlŒ¬0_÷¶<â7ŽEì‡_‡_Gë~)‚(9à3yíîó§ýÂsðUøëi}š?íÇ" ùëÃæ=ÿQPyÅÊØ:H½lÓ¡™csZJ…@¿ßu!ØÔà)álÎœEÕ|·Î“–³#þµ•«7Á‹ÍÆ•“äíwT’ny¼0h.ô8†Ý›ÖìðY¦s ¶1®¨ÄAÆi;¾nVÜ¿F‰¦ EªŒ¡U<ûŽ×¯YMÑõ(ŠY÷(¡dïL-5:§]¡•S- N[±Ë9¿AXÂÞvßRâÙá´iŽ<" „>Íj¿æˆÕ{æ -ÊV×T} $ãt[œÓ# - @X–Gøz“ÉÃt´ -,ד”B$Ï%˜oû2R†PGêCœC- ï´&‡.Å!øÒš à ìŽm„ÚOû7=hïâasë¨ñcGz³KûrÁPÝš³÷"ˆ#™¹Í·Ã3=NveÝ”`¦h†õj&[qQ‰Y¦\}àå‡ÐeyawEÒJV%|vYQŠb9‚o°Z&Ó· ×Й]õï™cÈGvüx'yÁkÞðSåÃêÌñrÃ×Ýr¯î_}ü£Àϯ‹»É«©=½Ü¤0‡£ù¨8‚`èT‚Ä\Ñ]ë†4ƒ“,&Ïöý2´Þ9Rs±Ûº§Eœî39·©ç)Âm¾dìÔC±8}¤Æ™„gTƒÄ•ŽBÑšŽkNÄ©jÇú4ÖöcÜ á9&k®´ìÄçU‹OfnäIUŒUÉ7ß½÷Cÿ üÈÑÙ% yRÈÀ5ÓôÌOÏ0=ÁäíÝË‹oæÈÎŽÑŽÍÍ][m¯\J‹'æx"w!F+øIOý}×UÞNþ­›»hrñÀt@j•Î!"ügŽþÔßz†?uZ$:GÕveÏ j@¥þ}~û¿ 1üããkendstream +6344 0 obj << +/Length 3290 +/Filter /FlateDecode +>> +stream +xÚ¥ZY“Û6~Ÿ_¡GªÊâà½[e¯cϱ9^W’šâHŒ%R&©Œgýö•ÚTÊŽF£ÑøÐGMøOM²ØÂ|’fʳlRn.‚ÉfÞ^(¡˜ ÉÌ¡y5¿¸ü)N&*ðó ŸÌF>±Åád¾øÕ»ú×Ë»ù›ÓY†žýé,M3ï~ª¼/÷ó7×<þòæµ4¦:ó®®n?ÝÌq òî€ðöû«éLyïÞ@ç~úûüç‹7s+™Ý¤ÈQ¬ï¿þLp„Ÿ/?̳É#´_Áôæäòã(”þúâþâß–ÏE^uL q˜ùqªAÅGÔ~D¤†~h»jgÒ©W7ø›xwûUÑÁÁ*<â‚g~ â h¦ÒO=;¿…ƺ.‹A¨’*&úu×®w0¸ÁÙŠ‡Ëb½6;«©¿ÿ‚—ðËš·ÐøÀ£í·­:¸¨(ÒÞ|U÷2ãífäÐ¥™Œ„ꪞölPˆIÚï +7S¨×œÒÀl¦½—åP“È÷_×]U"Ð0|âÑE»)H_™òh¶å:’f]u=ç +>[ÒæÀaUH‹Ž¿ý¸…Õ8ðæ=ô¨¡,|&a轆©£BÖCO¼ÖGL'Ü‘àÚ“pÜ0‰½%j·åøA%Âu? sþÜ@)t@‡`y{w…@xÁ#Ec™W¼¯¨èîЖ…tŒx 8ÖÊv‚D‰®ÜÃÇtv‹=xÚ€·_P™·¸OÃï·¦Åádž»EÏßî íe×"ª·LzA ãmJžx|¨6Û5‰…=ÖʵâÁtêð°Q²ÏõëWò8ôÐØ(/âNi®©¦²º{œ‹XŸHddÀW`dÀñß­Yp¤¯e]W & «ÁFõƒ„³ªÄ 9)¿i›µ°/„_U”ønEü]PÀÖº] +…<“–ÇQîCd6Õ@šGVçoøèÃÄ»¾9( ´2-Ò<âÕ¨ÀÓAðƒ FˆÖ•L"hnƒKv¤•[šº²…Ûª„ÏŒÇÞ’µ·ŒÐÞÒà —¤«ž­Í‚—3ÞƒÌ+¶ÛñæǬ¢>Ž½r]¦ +ÔE•šy«º‘Ž­[z—@‹ÈÚ˜ @ËahUY# +J”‡'V¬YNÈ}eVÃø@¼c»Òñ ß.ŽËí²Rp€:4ÃÍ\- ´ûf8y¢ ¥‡òã µ¦ØA8ão§Úø­Bè¨Ä{× C@90„ ·Â>¡]¤=]ÇRZ±¤Í6γäéñ5 ÃcWIB“—ôCXˆRh¬p_ˆR¾²Bx¦ßA4üGU<‚¯  º YCíÝÿ/Ë…sûÀeÛ”»®o]nrý$ÜD¹eñU,‰Î‚½ˆÀ¡rÀnBœÝ× +Ϙè¹Ç¶‘ÞÚž}t4²çûòŒ½3¸´µyŠ^œ­vÏÓŒ?h ~ÐÅ×ýÐè+i*ŒWÓ­KŸòÀëz¨Œ<;Ð>F~ ¹ÉäÙq‡€ŒùÐI²Ä@! Sï¦åUýNPsxøêûC„¶­D(®4_|­É ró8K»ý@!z£l~4ÊVúS'‹?Lõù“4'ãðXG~y +žì]ÓäŒÃT±¼)û`º3²KdHc£5ø¢®iRt¦šò™§žýø†çî8çÛ„>&/‹šãÆжôR6m#ïŸøÈöãÄ40ì*`Átøˆ1&ïÚÍ(ðy‡0™”»¡ø*,ÃÜD±!âËŸí*Lû¨a\ˆÎNó†„f9ÑŠ=hÒ$–5&Ýså°›Äàv!ãÆ ½!LîYy™ßõöJÿ\|º–ȃDû2Q4Àaãæ"¨“™Š”Ÿ î3¿j›¾5¯Չ믯ÄWãmè±Ïêg±)§B£TÞ?N@8J?ó³vh!œgïÐòA±Õ%PAâgqvv7Cs~;¥´*½·ß[Â,ï ±¦ÛŸézV8&¾=£Ç ññã¯s+;†ÒžRiâGZ t?Ó0ðºaÆ”aæPêÌÏAsLùÏ#¬2?Ê (ïºvÙ›þ#ð}qúù¼\lÀô¡¥@—fŒúŸ¡FÞ|š³CóÖy+*ˆ}0CÌŽbVÔŠ¤ŽÆ–Ø0ÍýnÀ¬›]__1({Ž"Ð1Y Š:¢c…\í‘ÐÉWl™ÅÁ“ÒŸx螃ýp’š¤2õ®ý›íŽt€Ó' ¾Rê<ôGšÓÐòK§¡f·ú綳Ðwö»¯Ö’îcí$ÄMSLËÁ&©=ÖÅ9˜°uK²eõiZ|d±æÙFÂÍÎí'“„Nn'²ù;î<ÖýJhZþåÍ£‰¶7ά”’Rh¯«—+›ì„˜üPxüíHèC¼A­$(yn‚c œÈ|Ç#¤‘Ð=òÆ@:ñþ!ÿ²«òg;s(’uƒ@ÐtmSéÍ©`)ÌÿIt”ÍIPTYx”çv³ <»¥»ß [[8s”C@EA~3Ö-(®ýÆ£šE© ž›ƒn>0.ÿmG7Kyn¦M¬F%Ž§#æ,Iý<1öšÃ  E"²ísñjSØ Š¥ }SÉÙ€'f•àHæ””q€,T3 @†$³›©T®B7 +rAÔûcñöøÜ0l¯©Pi¢~›¯Aür\Qæg*9®‘æ4¸„%NƒëÌn#¸ÎmgÁåì7‚ 4$·“Á׆/ؘ¾¶cÀÒ~ªk}³ §yChäÖ!†˜­!WÆÅ•¦®šÚ&¥QÕV,€­~T Sv´¼žßâa™‘cV_P³hnÑð%BBëg¥Y€¤³µ%Úv')©v+] tdëZØ.M5»Ý‹÷µÆB4ƒ—+fc£.Xfó•J¶x8!Vac²¨a›×#«Áh„j§ûÉæ~&¹ŽÙ3J›¨ŒcdäÝt þñMe;6UìÕrþE™X‘¢©¯|šªœ9¥ñ×)Öæ\†TìðzÜQ³äy”Šs¥bë’‰ JÍ"*cÁØ+’‹ÊgÏ +Ûâ'W­­¯)Ÿ¸CÑ£ÔI& b#-E:lŒº o=¢Èžûؾ¹óŠÚq·­©’ïg×o³;¤.,Ø9Gêy˜ +4OEhh|¦|^ªs—*„õƒëTNYî¡°ÔŽÞ]ÑÕH«ã\9îJë›u@É”J`}§Ü€´žŽ]¢øqé¨dz$û“ÕBüæaraØ‹n!Ú²e +˜>RÆ©ÛTÿνwƒœëœRÝc§Ñ+6Û'› +¼ËÖº0-å ©=ÑQm5åBžTºÍç7›ul ®lù—ß}™¡`ÇVέjSÆHM-S"î¥Eõ&VÄ ”@süfE,Ó‘0Œk©ò!ÛîÄ0$p¹UGߘt"Ùd’3h\Ûo)Ù·èxì Á„ä#ËHß„º²âÁ÷µÔ©‹ «Å£Ko‹_ÀLpGÊêx¼Þ¾&Å)] +E_œ©yPÉ>h¥ü\ÿ•OÑ +¿ÇG?E£ +ƒødC‹`Ã-¡ÞçbÃHhü,“~%QJ4ív~¤€„iš›0@J|ÕóSê²uE…·É÷‰òƒ(ÏC&qÚ$üx&¸|·Q“×-ˆ9q$¶3‡/G,n¾®tî')ièg:¿$¯,Ïù«CNÿÀ¨á8µ€[­«x”²ü½-Õrßd:Š¾· +2·*ˆ]¶)ˆ©Ñ‹ÃðÒ¸d.‰/}³íŠlMÈâ×ý‰TÌÔ~?&óŽ_%pT¾-¸GÁünjxßâ^C“` Oqõ™W´ PwôYVEbx!Þð,øU;–þa@£JÑ›D XßN¥¾`Ib+j½2Ÿ•ñï°2 +ëñB¾ð´èû,·íÖ<·²ïûcÌR6óa¿næýÜYu.S«i,vCPt·®Š^´!ãƒiP’ŸóíQ³/ñdçbl/z ánsásG_E8kF9%s¶_å@æËbè…”#'Y¿_Ñ6V*ÊcÙÄ1 ÿ¿}A¦‚t2³2ó·L^¦|}¼ˆÿXÃë|œÂ“Ÿ…'j ±Ö ¤s¯ùFÃP?×¢ùC &rþ¸Ùæ#endstream endobj -5899 0 obj << +6343 0 obj << /Type /Page -/Contents 5900 0 R -/Resources 5898 0 R +/Contents 6344 0 R +/Resources 6342 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5897 0 R +/Parent 6341 0 R >> endobj -5901 0 obj << -/D [5899 0 R /XYZ 85.039 781.388 null] +6345 0 obj << +/D [6343 0 R /XYZ 85.039 781.388 null] >> endobj -5902 0 obj << -/D [5899 0 R /XYZ 85.039 189.755 null] +2114 0 obj << +/D [6343 0 R /XYZ 85.039 584.077 null] >> endobj -5903 0 obj << -/D [5899 0 R /XYZ 85.039 189.755 null] +6346 0 obj << +/D [6343 0 R /XYZ 85.039 549.327 null] >> endobj -5898 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R >> -/ProcSet [ /PDF /Text ] +6347 0 obj << +/D [6343 0 R /XYZ 85.039 495.13 null] >> endobj -5906 0 obj << -/Length 788 -/Filter /FlateDecode ->> -stream -xÚÅXß“š0~ç¯`æú€FBÈ ^ÏZ¯­g•k®7j¦H¼z½ÿ¾Aã‰âùc:Ž’ì·»_v“PÕŪ:²Õ¦²,Õ›+º:#æ3êù”º4çÆQŸ®MêÀÖmÕ™¬q001RÿQûø¹ÕwÚƒZ!¤Ôêͦ¥u{N»SƒÚ U³æ´o³ñ¯÷{ÑÛKßLm(šý¾ø½,§eÝi·×ÉD~v{7µzÚq[{rSØ\X#ì³SƒŸ•Ç']õ…swŠm©/¢­(†çŠ°`åï¡2T¾PÙ˜©fReü`dl¡m‚–‚† LÛT›XX7— ]ÕêØÀZ+ ³Æ€Lg1ÏÛØŸÀ©oBQ¦vع\YßR¬ßú–5<MÈ4anLh$ÏÇU­$žQL¼LtÙ7w#wÌE÷æ„tJ„,ÄM¬¹0ƒaÁsBXà焳FHÆ x #ñkcáÎG/$“ÈœîÆMÁJau¬—À~è[Kì$"0€™`Ì^GÂx> endobj -5907 0 obj << -/D [5905 0 R /XYZ 85.039 781.388 null] +6349 0 obj << +/D [6343 0 R /XYZ 85.039 414.441 null] >> endobj -5904 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +6350 0 obj << +/D [6343 0 R /XYZ 85.039 373.793 null] +>> endobj +6342 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R /F38 2997 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5910 0 obj << -/Length 2299 +6353 0 obj << +/Length 3222 /Filter /FlateDecode >> stream -xÚµYmoÛFþî_! ÷"šäòõ¾¹Ž“ºhŸ­ ôŠ`MÒQTù×ÿ¾ó¶$J2î®Ep_fgggžyvVqgüqgq`;*™E±k«8ž¥å…3[ÃÌû W$"²Éü¸º¸|ú3×±'™­ž=íj¶Ê~µ®ºº[ÝÜÏJ)Ësíù"Šbëv¹ºy?w­û«y¬¬ÕÍ[žÿåãû0ºÄžo=@óÓÝüûñžÄxøŽß.ßó’Ï·Ëç x;ÿmõóÅͪ·¹·ìKÐàß/~ýÍ™ep¸Ÿ/[%ñìÚŽíÂtyÛ¯¤¿½x¸øW¯Šçü¯:æŸ@Åv«©ƒT0rë%¶Ÿø³(pìÀñÉC?Tí&¯á AX:M«n×ÎXÕ¾-ªÞrï²kêËmñxÙäiWíËå?n®.÷ºüòµ~ 즲]tسpÑÜdª¾É›Tþ]ê÷ºiž«:ûŸõ“d[¿|y*ê¦ý‚úpÏËwîØ‹‹Ðö"pµrl@fVu ð¸•-€9öèÛªD öÐj~ªjæÔd`ó<÷"«Bù¬±iñÊx‡%ò<_øžoÕ9-luÝ′^p²êjžFÒÒ%jEghÔà’EDÒHZíÄ'®•¶rDši75h½á¾¨‡ÙA£ùûm‘ê–Rœônt{(Îîšž6Fô­I!å 8ö§o»9Q—6?a0O0nàrݳ×È B¨ó`Ò·•IºÀÍ›…nl{ ›7GwXk]W»tÛ5)8æ déY™)ò @?ñ#²a…¨ö|Š8lŽH$pS+ã©æ¥i)xåvDÃæùôEI×P#!lÌ,5ATzyý wHÇcÏE›âÞÙåQÞ­×ÁµÅWKк[Œy; ³´=LTìZ ÷™Y'«Ço0ñ#Eô~O¡ ‡T±g}À0i”[œÝˆ–çïñú¾ævª·Û†›ÊØòžBtyo%§`.—­;YD }Nc^ »gù‘k©¡Sèr›s>Cø¡ÅlÔæëÚäˆÿqòÜQpþ3ecÆö‘ÂÈZ®x.ë‰E3.h´3Tž×b@%3š?Ÿ–·ÿæà†8?/í#§!ä)Bf’Å©å¡‚X,¢» ºëÚЇ~ìR‰º -%»謤3l .?õ!‚MÒª­ÄȨm!Î*vkQß²øƒyDÎ9=ƒKyäFä–p¿‰>‘ï×Sxx%ÍïAä4ÅN`«(6õS–QtPY7u]ÍÜHÍ)kDÍYs™ÓtãCñèxœ¢ˆ7/zÙÉ=è…œ7 ·5Ò]É×,fqΆIÆ6 -af¥¡­–ÑOàT°B ‹‚E; C™F—.#SZ–©ómÎ×d.f1Dj.-q_¾w°Å™,Ö{,†.äó”^rœŠ”“U)÷¹“03»¶ q¦:šÇ,öÏïÖ; -ðD˜‘YŒ„8dþA)Ûaöš¤~‹&;âM§ÎoÈ"Óý ¢x`ûM tF|ßÔE]çL{Ûž¡Ð›Žf€§bÛ_&ä`ªŒ|CÐø…)õþW^F¢K×¼qÈ5šs{G›bè$€=„Ûúi÷$H_Ô5 ] í¦/~”‡åÛ‚(¢G«Ë·|+S¬H8Ö€:ÆX@TS´ÏK_qç¥\¨H ž°Í—oÝê¢÷¬æ#Uð¤zÜæ6¹c½›Ç>ºíÈéºsË7‘µµÔ¡~Lùß`Hc|êéw17øRR˜\±ìÑÿ;&FQ笌"‡kþÀ 1¡©àŒåö‹ýA -X*Áiò¿ -¬I>|û‹j?‹$>~b©#­‡!h®õ­HGÃ}¹Õö5fØÆ"c;.pðªÀ ЗQ|®뢾ê]MÁ1Hi D Ú18hµ)æ"Â×&Š>²Ó„¶úfhm%‘Â%) %Õ  EÅòáAÌ)¡}‡ÐºúÀµÇp6ö8R¥ýknrÅlÉK²ªnìSD©ÂÄ}už(GB§‰Ò½B”g7¢œìwŒ(Çûq.¹Žhx€oÈhRÝ)àU*K ûV¤™dbãFhÑ#Uf ù•rE˜‰ËÖU].K®5¹è}9UùPÜgùˆÀv²Ÿu ¡&49BQVg#îébÇ3Ï®n%B.Nw䎅ÔÚftT²’Nþ®ùù¹—aMF4¹ØEû=ÒÓüÈi¦¿À7¶nÁU^àA`жîô èÊÊÐŘÞÄÝV`(ðËõI:©XHõp0è‘ÌdÖð8½¿P‘üÞ0(7é‚#…ÌL´L9¤xš¾šñmmîVEÏ|b$¸OD‹¬:áB‡oàÒ<ÔðA>L§=—Ôýš!5>Ôæ,JùŠŒÊN§»Øðy%Ý¡3é.B¯¥û¹ Mº¿ßÑtíw=©\éÊv’!&Ð>ñŒWNŒT«ˆj±SVDèýë×f<†îÅ.g<ê×_Ís z\ži@O§ŒÔ®/¦að †0vQeðuqŒÜ¥v§¾æ_x4¯ÍX[”„ww(š¶.Ò¡â÷Gêsl•š3–:£¼ë¯±|Ç]®¨[Þ…~2ÃÆgNfóCX¿R'~Ç|òæÈy(…A¼ùb$äw-?E÷H–T&[$›ðú{ÍívÎ?/B3—JIÑ©—¤rlïèEð—íü¿þç ÿùÊŽÕ‰_›ϳ=×ØBÑÄûÞ^ó? ƒÿF3 endstream +xÚ¥ÙrÛ8òÝ_á·•ª"š Ákß¼Î1™JlïX©ìÔÌ<Ð"-sB‘IÙñßo_!‰RjkËeh4ÐèF£/Xûð£ÎÓÈóÃì}¼š/Ôìã;èÜÍÿZþzöniwfiÂ.2ÜÖ÷³?þòÏ `á×3ß ³ôüÚ¾§`xsûò"J¿>»;û·]ŠÇô9Ïš’‚ÁX¨ÌË‚è´¤båé8´’ +`T{¡Ž]IE¾ùš$ÂAñD:›}Λ|]5kAƒP€ùÕªÝ6ÃÅ—¾ìš€dB5kkIµªào‰Xý1éèØËTrz¿#íWE'«/öùdoñ¬Úi¯vUö°³$æ^Þ`'šfkúJC»))çOÿ4_ c¬*ÄYñÀvŽÜ´ìþ!ëöå0€P¤×vL`xd +„A `Œ˜Ì m…êºkqý'¶${<ˆDÍ–²rWÒ¢Ô²<Š$¸P I„y‘¬^aVžë’»«¶A™ 9-Ð3Ðî?B*ëŠè ëh‘h‚)À| Ž`4¯kn¸»ƒ*¢,›¦Ÿã +£Ó!µ›'DHüÝÞžò;/•!qoÎ +Á–Þ¡4tFâ°œÁ=FѤF]qÖ+_xGBjB×Z“q þî¢ËgQ¼2¹UŸìiÃ8ÁóÊü‘!ÛÞ²ú†ñ×Øn·OÚÙS¢¼ùjÚM¹âmLåuž†À“&H<¬ + +æãJ#”É–;+³1Þ5R Ò5G§ä‡p{RˆË'…`{R´Ävh7ùP­@WdZÑ"é—×kó¢,üеžó<‡#Îér¹QxÁ X@Gg÷¢Þ$Ѻ&=<Ô +Ët˜ù¬@tuÁ $•Óú(âLj”±©¥}½„û„€µ·7Ÿ<^à²çñžÅ$¡Ü08/6ÄŽsÑò¡íàðµ¯ÝÝñÆr<ã"ÐŒGÙBû4  ÚFº¼{Š‹CÑä#Mp&À\É©F¸sA°›7î4 àˆ_6-Í.*Ôþ×Éõ¿TνG˜ .Ò=²É¦£`ä’B÷­àìÛ†ï†m.Ý®¤ ûtÏzÅŠ‚—k;ãRÙlhù»åû\ðýÆGiL €#w¤¡ØASø³MNJ‡—4¯ezN*CÖÄŸý>O5Ÿ( ®I¥( ¡[‰éƒõŒXq ¬ŒîñÝйúÕ¬ +|²4ëÅ„Œ Â0ÕÚVOÖ•US60‰!ŠÆ-…ÑÕ% w¯=[ª ÷÷]´,‚qTQ d)QJ‘ŽÎÈ ŒÙîŒ<Š Ì-η¡1›3>!d§°º% Ϭ¶³f¿‘qdÐbVæ‚·"”=÷* #ãQtÛÕ 1nd¦w6A0k»ª5uÃ68n•B|‘s&Ò"RtƒŸ+´â[Ñ`˜Aw=¦8öÍÀ®7ã-|µw„î•OZŸ¯ÈFCî×D£ƒ`ŒìÕL_¾ÿÆ.þsËðýÓ N¦GYïÒ2ºõ +J0ÐÁË®ñ®ß-?Ý|ÀŒâš­ûÉ»ÒY„~vÄž'¥ëË;‡:Hq.¸Øªá¶‰ó:ÒºÚÚ²áIl®mÌ÷M̲Y œ‰‹u½¼b‡*èqbÄ#V•)}P_àÔ¶‘©åªÇËíjàÁªŸ`ð .˜è)ïlxYHÔHÈ„¡OÈL]Ï„ˆréxp?¼§ðÏAT˜¸ÇÅ9ûÑñAtÅ<|¾CKž ÇåCÚ¨x¬uÐYÁVù°h4cn(ô`Ý®¹áè|ÉÂ÷3å£ÔÜw¯¸Ôåj¨läý·®ól¡‡qÄÊ$]5‹N݉·š) ãµÁ@bÁ¦£ºßàýÐykŒ„¿oy ÐW·O# /t%ÏB „‰õ#Sù`Ó'ì'³’=Ü€ùdáoaT–ùÓ|˜óáö¦‡¦bÔ$M7›*&c'áÝ^vŒUtÀz¨u8ëA¦¥´%2Åæ¥+seÃ8L2ÞVÖû®`âë8oà㨨Vrˆƒßd:ÇfÚ±³Ž ’»80ª1~Ü6í쎿è.÷¼/qÃØ´®‘À ¼N…9ÅÞFÌ$%øMé '‚ Xåâ}”:Ù}z)d÷>- )yÚS‘ÇlÖŒ¾S о燑 —Àq8*ðR‹5=ïƸhíûhûÊq—ß›ì8CÝå¤Cräµ€2§óEà E/Ü*]9€ôQb /à/Ñ;‚³ÖÔd&¥Œüë¥fE@oýÊ+m4 æ²r'äÎæ‰õS&ê#Æ&1XË1+r®ZþÚ<•ÑVD†=zÏÇïNaƒ!fcFx•ˆ”5ÇÜ&Dk IcÇþ\åÜପ§t +—ÊÉÈ^ð<'&dka¦.óª2y{$x1è›óâìÆ ½4F†ÐyA£G6ô-Êc&ªfã4+‘.NÂxžùœüo»bÉ$HSö¾ˆ³;cƒºr#WÏáìKžÉʶÍF\Ëó[r”3Ž$Å<¢´Ñ‘l2d8“nt•‰ÛˆòD˜àÁz±–ŒJ;€Å#¦ÆböµíM+'±b rNN’€³Y©HÎS1…‰-ïéj”6N û#ºgk?W\tÙ´OL‘à`ÂúiªÈ”cõ§+¿oEðµs3w‚2ÃÄR½¥ƒ Ñ©ž†:ô’ôtµ×Á¡ê©VŽÁT¾ò´Ú…Ä—%ûô”{)XæS ÎÅ­Tà…*Ø¡ø©]±þB¼;V.UìÅéér±ƒs‚aAú)Ã'Ž ïQœfØ¡H‘IÎù˜drþ—ë±j9Áf^”f'ùwpŽóo~Æÿ)‚–ÿ}Š“ü»‰ÿ²ÛTÃ`ßчN"K¼8œºvx«ØZÂAŠŠˆmS¿“Zxú'B³('dÆ8?Ùqj£ÄvÉM l$wÉ~–êœáP„m¼»Ø‰h?qíÍ)vŒ%dÌ5ëö>¯)ž8"µ0òÂ,8-¶ç„Ü駂;Ap”ÜÅiÑ9¿ôn‰ü· +ràñ7©@¥žïǧqìšò2¬¥Ú7)•^:Ohj¦0ŽüÙ]¾¹Ï9í}Y$üv¶œgT‘ }Nú±z0½Q•ù^èŸ6ÿÎÑÇ3¥žNcV5Œ‡!R/_¸1´&¨¤.–êáÊRèn¤î{Q’šÐ‹xæÕ`2P¼$Œ»êyí1ôÀ^Q>Á„§¨†sœÏOnµá†0µòw=®™…_Þ3¶NT?q˜KýýÁ‡Jï%ƒ‘/r¢×©ë¥ÑAT·¸ÿK¬,%˜"÷]+’ Á<°q5Ô–-"M%~ÇÈ{\öˆ´û†E“!$*!0²W·¹A›Á“ ‹ÔyÜ}iˆ¢#5¨Þ>ŽhD†nkB™ak’{%—_O°âš‹gÄ£á.Иó–FÓ)«†ƒäãUþ¾ápIeÄa°‰¸{ää/Ö Xm”²EPÔoB³Ã$ô‚ ú_T;r5[)£’´ž,ò2ÀrÅwÛ¬jŒ×³xÌ#±cDd‰ð +˜Û@Q/¡µü-›ü¾gL3"Úcvg[qb§§Ÿ=&\YÄé â—?„.—7¹té„Ó¬¸ú+Î+.E0wåák”H£TŸ=üƒüš[lÖ7‡*˜È>ÝWy]õæ=‚­¾§‡/P˜ZØrDnS¯©„Mü÷8#o·6u²•`&=–cnVÙ'\qì;“v= %e½ÉùŒ3b‰ô£â„;ïûOµ)Åhí‹ìøÞïËs|/˜ !á—åñý?‘4××&ƒƒ(¼@™½ üaãûû¢úðpÃÿ"¸kendstream endobj -5909 0 obj << +6352 0 obj << /Type /Page -/Contents 5910 0 R -/Resources 5908 0 R +/Contents 6353 0 R +/Resources 6351 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5897 0 R +/Parent 6341 0 R >> endobj -5911 0 obj << -/D [5909 0 R /XYZ 85.039 781.388 null] +6354 0 obj << +/D [6352 0 R /XYZ 85.039 781.388 null] >> endobj -2018 0 obj << -/D [5909 0 R /XYZ 85.039 634.11 null] +2118 0 obj << +/D [6352 0 R /XYZ 85.039 761.463 null] >> endobj -5912 0 obj << -/D [5909 0 R /XYZ 85.039 607.496 null] +6355 0 obj << +/D [6352 0 R /XYZ 85.039 736.114 null] >> endobj -2022 0 obj << -/D [5909 0 R /XYZ 85.039 523.31 null] +2122 0 obj << +/D [6352 0 R /XYZ 85.039 218.006 null] >> endobj -5913 0 obj << -/D [5909 0 R /XYZ 85.039 494.575 null] +6356 0 obj << +/D [6352 0 R /XYZ 85.039 183.26 null] >> endobj -5908 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R >> +6351 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5916 0 obj << +6359 0 obj << /Length 2735 /Filter /FlateDecode >> stream -xÚ­YYoÛH~ϯЛ) ¢Ù¯¼,2g6‹8"gf€Ù} EJ"L‘IÅã¿u5IÉ’v0Xp7»«»«««¾:¤fü©YúIgq¢|“$³ÕîM0ÛÀÌ/o”PØÐø¡µÐ?3¹p³‹HûÏÒÈ‹X¥¾± -i~zxsûQ3øQdfë™RÚ7JÏ¢ÔúÖØÙCþ‡§µ?_„aà½ÏdõªÈç ÅÞ—¢Ÿ›À{ÆÍÜ(¯}â‰û¹ò²:Ûó…òvðQÔýü?ÿzs÷0p#ÌDià[uß ñ«Â™ -ü4Hø c?T†ø}Ø–Ý|aUäuÈA±Âÿ} Œ45çÍ|¡ouØõ\§^OkboS±Gã-®Ùoñô™U¼‡iëîPȪ~›õ<™µ5klCoÓÒj7_îø„¦í³6"îdIß0M ¢þžçDDO(?ËBÁ;‡tË,ß•¸¾ìú6ë›1)®íå¿SÜ#×Àÿ=Sô ·ÀHÛàøüW0yí.ëH€'^Ðtéæ4íJdÄÿŠ§:[5|^ÛT@ú–ÅàŽÍ=r·c™Ó‹Ù”n֋ıޡcÑã—E"~Ë–Þrúxo™ «sîÐiÐî²'w;حߥlUá#º›3ç@¹I䱯dY‘ÑíÊ¢õ/é±R~Úëz<Ò8»S,1šêq˜F`ÀÚÙB˳©÷¬ÈúC;pEr[°¸ŸŠºøw ,=\wG·õ5'4—m-Œ•ñS}]£œä&0ããÖËK`ÊmQ¯dä‘ìn¢ÝÅtmÆÍDíIÃ7¼öŒQиS -ÔJTŠA×aŽ,,ŸìnY§éTTÎJèöhém±*3¾M~F/›Í4ÑÞ*CI”»NÇ3 | !)¹hY b'N<¢Ò¾p_$çÝ~Œ¢©¼cóDx:)lß;Æñ„Ôzô½Å©{›Ž÷9z·0õÓTv¡ÃŠ½Á8H¥p¨MEüÒóÞžñ¯J·£—`+^h ÇúHhÛ ˜”àŠàƒ$R½Ìë†G©öÞ3ò1C/ü’µ‚›N‰7沺K 5³†àé-1Áïâ…\ùÝ©I:S26†ô=:g“b•\ÈÞ•±>䮋Éú3Ñ·Iý Ç‘e\׌Klã'&þûlŽë¯°)DÈæ÷£$îÔ:ÍÙ:¨/¦p‘{'Ÿûqýî…¹¿ci°økYpöâ :òMd© ¯ú¹*W¸‚beCî{?A+J[SD”å2é@cr°ìüŽsUÉ!0á«ŠS1øCÆãÇâÌp¼ÝÁ·‰Lñb¤&™˜©LNvÄË­ûý»Û[øïïÊcŠ¿jv·KèTåã­¤*ôcCÑòóÇOŸï–·_î~ÿ¾ôï~¿;½®²žéž PgßÒÑ,&DgS_ƒgÓqäG¡–(ªÀ¨Ëx¿îŒÈ¡cKŽç¬pç8æ"€”‘pá[÷j¸ú¿ï8@š=ÕwkF?œdew›ßð ËZ±³áãðœ7§ZÛEdg«µÔ¥4hSÆÉPCeEùL%3ëV*3øñÚià.”fgBŽncÏãnémÔ‘ñU ÿª:NÈ/ë£#ú?)äòÛ¯_¿~>¯“؆‰i ðžºàrhCè>Ûäj`†ûéà„‘È­J” #Í™0òCÑ=õ˜G\(»ræq>€ÔxLz½4¡¹\R`ƒ‰vI -㜥Šn¨NwÌsÁàI”wh+…׆³ÖòÑ9@¹† žoŽ‹rNwžPQ8¶›Ú´8ÈÓ\¼Ämc:R»Ú¬Þœ«H†aÒˆÔ¾- -þè·4uØlñ;ôVM×c]ÃP]ÿÐ0!žG¹U[àj¤ÃqtOa÷_(S<ðGƒU4ÜÎÞ²á‹QrÀeŒÎq"!#ôw+I OôUQ(üúvTû`\#‰@2F-–¦ -7ÄáÕÑVÍI¡}Ä)à;†ØôSÍÄ\‰~‘}(Ïé -Œ¼íäÒ8÷\V÷†ð‘RKäªá6o3)™à—¬nùk,¦Ô¯+3«: k;)KÐç²ü¡ˆ^º™RÔùP'î]ØxR"É5mŒyfd¿®ÕFåýq¦du)ƒU+qz=ƒÐ Уü%31iR)ñ2ô(OÉ@€?¢ÊRPŠ$ÜáÏ<„DkJ`É^`öKsŸ­¶e]t¸Íϯ„ãÑÈ^¯¡Oh®Rø&¶£¿7 ;«¦ªX/J¬A IÅquÇø“Ž—í9+€Ô!çÉ-©ë,ú'55¿^¹ân[AºÅ3dð0ò~ßrÇð¸6ï€Þ˜wapÆJA|‡ÅÆ©§ƒ!IÀ°z"“…vßNS3)}ön -(¦œ‹Ún(YmXã-±Œˆ;y9ä…²nÝH1×&ÄŸÀ§b[¡ßK¶¼.#Ûb„ƒkò¢Iwü³W²/ÖÙ)8²¢úo[r¨²zá±Vê=c=ø@ÝŒl¯Tð/Éš£*Zñìr&$媚†¥¢‰ž†rQÎdc±®šV`ê¹ì·Üëø~ÂÄŠ­`wT—;[&æ**2•_²mn:µ‹62P¾¶ áÁ)ÉfdÝ©9=2vÌåÿ ήTcendstream +xÚ¥ZÛr£H}÷W(æ EX4P\ûÍ+{z{¢}™¶ž™y@Il#вÇûõ›·tOÄFG7P•UYu2ëdVªí‰ìIè™–Š&Ah›* 'Ëí…5YCÏ— [$f"2ëÉüãéâÓÏž?±-3²¢ÉÓª›Ç3]OMž’ßù?¯žn¾OgJ)ÃQæt¡ñ8µ=>ÝÜrûÕݵ¼LИÏïŸïž°Á5@ðþÛ×ùtf_oàãqúçÓ/7OíÊZ°Š—õŸ‹ßÿ´& lá— ËTQ8yƒwË´¡{{ë2=WÉw~ñxñk;÷¹u-1³#3r¼q¤|Ût}Õ"å@¯mFž×GʳLÏr )à± 0ò<ËxÉà£HÊ©²Œ·àða± ÷“cY á¦g°´N†–¯§F´}Sù´²§M +êmßhÊé Tæµ|oâ†ß¶1Zî?$%cöuŠkNðË£”˲øò]Øáz_Á¿)77~·Z·Ð¼;˜1ž¶\ñ&B‰¦*ó©tÆ +§,·‡sâû-y |É +øxaô›ŒKi®×Œ†3D€›Ùhôˆ ØÒX%z¨gÄUúy:sÝÐ ÛheÊc¹üòÌT<×ñ:­¸w…ʤ/)·1­«Æ—,Ðœ›OÐ{ÝÐÄ[nŠiC<ÑÚvîáeÇS2úÕ»Þ¹ù&†¬)«KþnÀܧ;¯ÒuV7Ž‰”!6åqÜô‡åY Ôö4Ê1éã/mS°Á¹}Ç3ži­Aä¶fל³HhõhmrèB§ÿôÛk#P2éÑOV¤ü±¯ É55›´Ó•-Ù M@—hƒæ̦o Ó˜7ÕÚ>"Û{ʘ—E]æ)àþooç¸InxË`‘ðæñnÓT%ý›ÅŒø©æ AÃnÖ™ý'´ƒÈ’A®=|¥IÖËXØ™úøœ” ;r“Å9žŠ÷þÎ<ÚXœ×%3,ÎEŠà]¼K®¥@GÂ/_hû= àPËwþ¾IзÀ#Ìrò]× ‚`”œz2ƒ¼éÿº–}À›Jxó1Þ.b¤Kßx¸Æ=̇#“Œ.¦“dJžŽÒb^È6`v7‚É<ªñv +†YP‹g\#7A#1< Í5¡ió<Õ +FöˆR–+Ò7~és1~¯ðâä<5ûmV¬¹é¥€+YÜ’A¹Ÿv|Fíhj"¾DÖ=ñòVP¹› Vh‡Ð¶Ì÷IKàŸqÔ§Ÿ}§‡˜mù¦kû0NRo§Ê1»¸F×KxÀÄC-;ùË33¦íéùÐ+#YЃŽÉé„®cúáß°HÏMaCð„üàïMQᢄo—@½ð€Ã ë;»¸À `IîìHðõ##N¶„zF$AŽ3ùBg½)÷¹ð|ViLhNfN˜–ë°ZPÜÖ[èüî:²«¹eÅ‘IGf$í€w¡©¥‰Çkö°­ XÅÛŒ‚O,s¹cl´’4“¾½fÃtˆK<¢ÑãÛ“i¹Ä5•ë÷/àï¨Ps‰‹¸»Sà–Ó®Ç&ž* +à°V"?häÍÂË7<²k>ñP•bqî„"RÒ=6½¦Õky`cV`B>1¾±Nf—ÜÀ1U?…s| ŠöÊ»àJ´æÎÉKˆ×ÔÜHvö)UB{/÷ÛTóu‹cà{YQHGi$lâÀÇ#ŽúX+‹BÏ;{¶n+‹’ø†ïWTzz!)ÓdiÝn4ç,"€HÌ™Ài€ÙÛhNmppÕ*嶔xªÝ['XÅåéÈT 7RRÊ~,^ÜËü Ž^bŸ ï:¡9[‰S£G¡©%sàÖ쓃ƒìB Ö£%ÆÙ6¸•íô4ÝM"Ê”^V?¶eŒ4ÕtÙ¬'ùFÁßS⟒2"ÊP¼Ãɾ’Þ9¦34ùa~âQˆmCæk¶”lS²ï8çüñQò²Ž¥ DwÊ› m˜‹Žç";—÷¿âÞÒŠ6çlλxÛf˜0›Dp–”ü«,t¢Dû¢ËEÒ­•úp‘Ðtûü —þØ O÷¸}›–§Fý¤'3è)Z†xoÐWÆ´µÞ2ªNûK_ß˦o0Lml˸Z6£Çß×ì*"èèÂâZE@zv€—9LÀË\' ˆ†"ÀHGšè»VhäS‹ÐŠŸ|iB~Ç~}[ZŠÖûdãßzš%º5®S øåá¾f ÊO’&¹lÄKq’&GÉuŒŽ¸#.kßÄ»¥üÝ…l^8àà­oÞÐ@þH€å{º`ñÌÚaušœâæ„Z#A +âZç«ZfÖ"s»vßÜŽª 7WýàD£²ØÁÆ4ŠÌ‰ÆCSþÁÚQãݸr…ª/„|;Fš!‘”ÚêY|/‘Ö6«RáûL„$p\£ƒ‚s¾êX¦²‚í„F¡ÓØz¤ñ< =‡€–ß+ ’·ö0 6ô(—€¼GÜnwìÈã]ª†¬Ód@'R¦c…ãö„†ÔB8ªQx¬ñ,€}×éŽËbtÚ,TàÓÑ¥°5Ø +®SÓ®‹<ž5'Òm¬ßǵ ©x‘åT!>Àš”ŠN=ç+¥r<ÈI›”^Ý®ì$]D¶ë¸ÈþË×;x÷ti.ÙÀiC*L¹w¸ð®ïþNN`’RýAŒÝ¹$)ãKKÙ«x)þ’õR®Šç‘8«™t/a9­nÄ|+)ýðÔ3åúÒ÷é<6M†®'z\ ÇÂtOf0LkDQ †é1mm˜Uמ·ž¾›¶t·ÜwŽÙ£È~’7;¨6*qÚ +‡Ñ]•P¹¡$(I‹£X¿K4Æ °å¾Ö×É.Ä%é*æ¼Ë‰çÑ·=ßE¿'3ˆ¾–A4ÜAôÇ´µèªÓè÷õ]ñ†ˆcߊÇ•N–]ŠÙðI'G>Q’£œÚéЂ¹Ü\%7U>»Ê›ÙušâئãÿÊГÆWdp¿Þ0¾#Ú:|ÇÔµøöô=ðβJ“®lª U—v½N=x\7nÚMØï¹½–[#­çš¼º*IÞËýó6CíýÊA7ÍZ[MAm½%ëê÷m¸møN]šÍuMÛ¿cöd†Í&2£?l¶mÙÆÔµfëé»*)6 ŽN¨(ÎIaLzWÜÑ[¿Ðï‰X![“àk¹À“Á1ð õÀ¹t‚:2]}h¸Aÿö$nSsk’ž±#v”?ßèW3\N&=ÞQ¶Ëd§QWg í}¦–Äb)e +ú5c0÷-Ëô”=žOõ„†ó)-ôQ>5ªQçSÇÏæS}_å4”„ÚÌ\~ :(³·7¦”‹ñl¥ê²-pˆûî˜Ö:žÉ½O.¢‡7ŠÞÓõy¤°¤‹›]ù<“2à€AeºÊ·G'3l‘ùÈcê´1ŽÔµEOÝ7©cŽ´àKÓÉ ‹x!ÅüýŒÏÉåQÔïçhuÿŽ±Tž™:4…Z“&ÇÃ7åW¹¶°–ºœ®j'wØ!{Ä4*¥ü@áÅ2³åføËÇóÿúß]‘O™¡ŠÎ£ï9ŽéØz-”*÷x½ž +M/T§ þ&ûÓgendstream endobj -5915 0 obj << +6358 0 obj << /Type /Page -/Contents 5916 0 R -/Resources 5914 0 R +/Contents 6359 0 R +/Resources 6357 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5897 0 R -/Annots [ 5920 0 R 5921 0 R 5922 0 R 5923 0 R ] ->> endobj -5920 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [327.043 300.33 512.306 312.322] -/Subtype/Link/A<> ->> endobj -5921 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 288.296 216.398 298.773] -/Subtype/Link/A<> +/Parent 6341 0 R >> endobj -5922 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [327.043 259.682 512.306 271.674] -/Subtype/Link/A<> +6360 0 obj << +/D [6358 0 R /XYZ 85.039 781.388 null] >> endobj -5923 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 247.648 233.58 258.125] -/Subtype/Link/A<> +2126 0 obj << +/D [6358 0 R /XYZ 85.039 761.463 null] >> endobj -5917 0 obj << -/D [5915 0 R /XYZ 85.039 781.388 null] +6361 0 obj << +/D [6358 0 R /XYZ 85.039 740.47 null] >> endobj -2026 0 obj << -/D [5915 0 R /XYZ 85.039 761.463 null] +2130 0 obj << +/D [6358 0 R /XYZ 85.039 644.777 null] >> endobj -3024 0 obj << -/D [5915 0 R /XYZ 85.039 667.044 null] +6362 0 obj << +/D [6358 0 R /XYZ 85.039 612.356 null] >> endobj -2030 0 obj << -/D [5915 0 R /XYZ 85.039 611.854 null] +2134 0 obj << +/D [6358 0 R /XYZ 85.039 539.599 null] >> endobj -5918 0 obj << -/D [5915 0 R /XYZ 85.039 585.239 null] +6363 0 obj << +/D [6358 0 R /XYZ 85.039 496.645 null] >> endobj -2034 0 obj << -/D [5915 0 R /XYZ 85.039 458.285 null] +6364 0 obj << +/D [6358 0 R /XYZ 85.039 453.677 null] >> endobj -5919 0 obj << -/D [5915 0 R /XYZ 85.039 431.67 null] +6365 0 obj << +/D [6358 0 R /XYZ 85.039 412.424 null] >> endobj -2038 0 obj << -/D [5915 0 R /XYZ 85.039 232.205 null] +6366 0 obj << +/D [6358 0 R /XYZ 85.039 250.439 null] >> endobj -5924 0 obj << -/D [5915 0 R /XYZ 85.039 201.589 null] +6367 0 obj << +/D [6358 0 R /XYZ 85.039 222.735 null] >> endobj -2042 0 obj << -/D [5915 0 R /XYZ 85.039 132.795 null] +6368 0 obj << +/D [6358 0 R /XYZ 85.039 195.636 null] >> endobj -5925 0 obj << -/D [5915 0 R /XYZ 85.039 111.599 null] +6369 0 obj << +/D [6358 0 R /XYZ 85.039 168.538 null] >> endobj -5914 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R >> +6357 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5928 0 obj << -/Length 3553 +6372 0 obj << +/Length 1942 /Filter /FlateDecode >> stream -xÚ¥ksÛÆñ»~«/¦fDo€éL3Še'JbÕ•ÕX$ âDbàÍôÏw_wøp§ÓñX÷ÚÛÛÛÛ7èM\øçMÒÈqƒù$I='HÓÉ¢:s'KXùþ̈™€Ì0ß=œ]½Ã‰ç:sw>yxîñDN“‡ü×éÛ®?>¼»¿˜A0õ}çb–$éôúæÂO§¿\xž7½¾{ûîÂ›Þ H8½ÃþÃg\þûýO<÷á¡®qîûw8xw÷pñûÃgï,öh fŽÔýqöëïî$‡›üxæ:Á2l]¾¾î':ß0Å ¤ãÌxØ29dq¼¦K ‰@âPféWG¬D…°!RŠÒžK×5ÆIb> £AFÄî:Ö3ø³ä@m‡Ó ÁTeă ^…ó«^‡–aZÅòÔÑ;ò ÷ÅV7ð}|öÀˆc-wÁ)óRm¿åq&ó¾;vþÍá0nÞÒ= ÐŽ{9Ø.èd"§ -ƒÚ^ ö¶›sº%Cƒ‚¼)KÁ0 0òÔVÎD­9d[€n1ˆc‘ÄjÝX™¢£ -]ó:IDbS Ö å½õ}?d‚·ÈS-˜Ñï#øm—ðÀÄ%{Ê=v¤,HXê,W¹l¶¦DT ñv'ͲHoè`kÑქæYÏy ó€vSáß'äkV”¼ÒKã«Õ ž‚4–ËDÓŸ0Å{Ç})]ÿ±1À¸_7¼¸],µ‚› îÚÚ^CÄì‡2TT•å1†0$.Ðôc¨šÛóJoØÚÌôÐ.1%礆 êï/ÒP‚‹_…“ìwÆHàßܺ#xäGÇn;TS¼§Ðp+Ë]ÖP¨…ƒŒ›¡Ç˜¹%å-AË,£-«ÄÈt»˜˜XîâÓFG"Ìg‘œ•_)ò)ÄÅ}cqD>€H<  jÞ<Ð -Ɉâë¾GH¸5°ð,bð çóØþ£æ§ _±D‚‚”°xá4«¸e¿A¹ðr¡´Š‡³ ¢p7ð¢éj(pŠá8;Á^eüôÛ…n€£Ä–qà%‘kÎÅëÂK²YÄg—¼s?£I2=ðLC-ÆùGGˆë¸-Z>iä©Õó9k;eÃ&3q““·—$nÊš@Öæ’.ý2X<àï(N³©Œ:O3ÀSÖ=Ó-¾æC/†85Ï,1¸ÂçR¤^9Ï ´Ú<[è¥}Š†0<କ#Žäpê‘A2±õ®¹í%;Ù“ìDØ ⋽Ø%[ŠÌÐFB/ýìTÅÜj^ õþ|>=_€”à•ÞàM߬û(GaR æ‘Å{øÔØ¢c»56¿Î‰÷>EY¸B>ƒxW›Špó:Jìõ0_HË‚ 1\ÑìV}@9–ÏúÏ¢D{šIŽ¼âAR—"G¨:d¯Ðî†!8 ™, ä—x]˃Œ¬¦‘[Õta.% È5±c9ˆæ´Ø˜_ s £¿ùZØ溽0-4ip¥ð݉š!ÀouÜË ±ä`Ÿ‹`„q’ݹ2³c(Ž'´¹à`Δ…°o[ë:Ÿp>´9§c4›co:aÑ^À‹cÇü œçsÿ¿, ôl~¤|½‡Ó,ŽÕ%¿9ÈÊY¯ÖûÔA\ê¤i<¦n¯Ha`h)ö1 Š~ì:q<.Rühý­4™JÔScÄÌ3$wh€R±TJä ÓD2ã ¥f)K‹²*[ýÜ[[ÒœE—¬7Š1X–pº? ý1Ê .±êO?!éŸðcÈå)su£ž -ò.¦Ú„©‰î¬½i%ýÓFæäj×#NЋUÇp`˺U!gFŒ *(ˆØPhˆxñ>úÜñ~›ˆ)!‚4Ú–“þüˆ¡²å„‚4<â–Üñl|‡À%f]†¶? -%ÊØ,WÄCš²‡­Wž`Ûè~>˜ÍÄì.ë¾hÉÜ°''£ÖÈ›/²•Ëìœd)Žó}ibÖ¥ o—8佫ý¤ž×l…ªêƒ”ÓÅ/_8¸À‘ùº4õˆ+ÝØÒ‡“áDðÇ{á/ÎI¬L¥v„îËA~ääŠÎÚ`˜$Qõ•¤XdçR–F2ß–Ç"zÊtRØ>çÔšEÙŠÐæüÁ!˜Â#6Ô(3î\”äËî±¹/~îˆqCJÇCº3´t=ÜxÄ¡ã|i_ˆTJÎýGT0-ª²¯oæO{Ìä$"ñM&`îXF©OYJV·kÐ~TIq‘¬Ef-O°,JÊ&î~¬˜pL»©yUK;ÎLyŽÒžÄ=šA×?Õ¦¯9tŠk^’úÅÑÀ¾ÅœÑâJ&Ú¬’I´V(È6Å!ÂÓ‚2 Ôtœ¢¯<˜MÁ¬h—g=ÙÛq›-+Ç°RGãÏ;¸nuŠi;UªÅ/xlÕÅsdF)q8®i“ìî| €.V=[ -†‘!è˜Âe"Úg¼GY¶œ•(U .ʧsAõÌêƒ]ÆÔšÐP7‚Gr4XPˆßcÃâö•”#¥ÉŽ -YòÐFV1 à -(F¯²/#F ÷;n÷…ÄA-#°ïJ!£YâB'Z÷Ž[¨€}Î -Ã@jË´Üãë¿Œ&˸Æ$à1$ÕÐY k2B§ÿìjMÖcYH‘öD´À‘y4ȼJ•õR%S²¨9=,€õ¦>~ÿú?sŸéŠ’éñ؆@Znû±¡ -L4=Ì@émð²-ñ¬ûÞ°•ªõ)Òê /ŒçPˆÈ|TÒMf-´$³:ãd&IÇŒ•È í°CnŽÞSrEÔ‘t¤ÓC €TÝÄxús#®œÎ[ J¢ûšYÎs%ÆÂÄQ_n{ï‰j¾Ÿzɯ|âÄqãähnc@f= §6ÃßNy~êÄIl𠱿¹^rp\:^ðÕÓâà°QnÌ(†‡ý‹8#ßîÈÓÔo䳘úð=_PY¼›gk\ý§‡ÊV@²rø‘ÏsåI*?ãWB©®à‰÷72ÙnÖj6‰oÁmeOàœøIXà:þü§à? Æÿõk1û˸RÓ`~œß‘ï;¾ghAvûópŸ^󫲂ÿ1Lº endstream +xÚ¥X[s›F~ׯÐ[ÐLL€åÚ—Žk»ŽSGvkeÜL’™"d* *ú÷=·" å¡“qØËÙ=÷=¶àŸ==ÓRÑ8mS…áx±YãìÜŽl¡¸’‹Í/³Ñ›_=l[fdEãÙ²»Ç3]OgÉ'ãêíåãìæÉ…RÊp”9¹‚ÐxšØÆǧÙÍ{^¿œ^Ë`â„ÆÕÕÇé \ãîï®&¶qw“§É—Ù»Ñͬ•¬å RD(Ö?£O_¬q*¼Y¦ŠÂñÆ–iÃözr™ž«džžF¿·Wñž;æS§¬à:¾é0P–†îIÛvLe;`*Ï2=ËmMåÚ=SÙØÈRcM„¶úlÙÁ¡z6ròÂqï²cŽBsÄÑöú•Orõ9Þ—“ °ø"n²²`”Kþ6/`픽p¹h²Ñ52¿Î*Þ´ESV{>‘5°Xãbš/ô«®åÿÀrÑË Ñ-wŽck¹Ž§-×ãø6®Ù};åYÝ|oÅ[ +`!]LœÀ@ò¸X¥ ¤‚ëºÆ´dÊM…¾€ Hf¬³b%¦­ù[¤dôD[?‘máVÀz)0³—Ví!s {üH†ç3¿Gsl¢(4U Ú{ÐBÁ3ÛòÉÚç¸išóìt¤ôù}¨IÍŠÕÄp-sÐ9#‹fÚd⋸êÜo60ɳT̹Ľr­cOahŸOÐ5È£x´Ñ[?±g/i•óå\Ñ·¢è¹¤®î7”ž ƒ¾ó“œó®kI†=Ç$hÈpØqì:¿áÕº­cv_®y?4j²t…žÚ45®E­¹p\ma\ ‘eLÓ¯¢­K>ãÑÂù¯‹‹„}ôB²kôe•²_KdÞSÆk´5„Á‘@H.…Æ—br/Ì)kåêrÞÄYÑe'ØÌ0u%"}çqaæ*ˆÎ¿q ôU¹Ýð îɳÅ^¨€çwÑVóÆg˳^P㤅¹’^˜¤ßXQ´]£1‰ê=R1JP¼åVãw¾‡Üoc¹öc:sù¶šÃ2Oyʶ:VòГ‡ß¼¤Rmا‚bòÌÈ5loIŠÙ6)QˆÝ`>@YŽ:ŸÍpF * §Än]Nœc×&EhlGj„Ïî +Ô¼I«e¼@Ç2¨ ÁV’6-†¬5à„h°Û!i+Œ»úTTe`Ñ°b°L…cW@ЬCˆƒpº+øŽ˜?OñÎeš{pev*`0–s”ø«ä)”YN`ׂ9Ó‚–g\—kN1ŒO&\ÇmeÕɇËxi½'6éZ“{ƒjIü¸6 ÀǪ;Ý/ +x*nø[7qÕ\lqó5CQç#}{@ œI½9V7æj  •¨~1¥€sr ã¾ ª|÷lœ÷h(ðØuMåú½nÝSiI? Ž.9«r½&XiüÀ¸© ?Q–QÕCâÈ5gÅéhŽó@ˆÜ(2m‹‹ƒñÖQØh:Äf7Ú0ÙPhÏótMÑ O,P¨›Ð™k6ö*­Ü„q™Aóè·™7¼Ó”B‘Å+j«ØɼH‘‰ƒ^ñ.xe]V©>IooÔ•µZv}ƒMI+KjbrƼ6±WºÉƒ…2Ï»âÐöñmQX—EÝT`0b +ª\zv(GØázV×Ú¸Cçú¡iûÁYO÷hÚÀ³ÍÈóúžv3ˆì^àÙVϳÀóÊÖžßs^£ý¸5V¾oLIõ†÷ž‰ÿ«pùëä®eº¾^òŽf8F­ÐôÝ€$ÿë]ˆ (nîÑS:.pqQ¥qWz»`Ú, »tSCî8ø¦qóŽ°-ê°…à³mxŒ&ÒÃBßOó°';¼[MtE¡§7(Î ŽÞ?Ü>ÀgʾS\è‘œ¨_´À9¡ow´­Y¼uœ¤¼Z”ÅS‘Àù~0'·­1ӂ˘­»8¬>åVªÝs&5åÏGÞy¤F‰Çó¹ÌQä¾–<{I÷Lƒ=Ó–^d0I(î_ÉŒß +R³3PA}±4;Š‹QÂDâ¥BÎì2ðâ÷bF!oÍ©×:‘ÊI©{ÅöÒ±íP!äÊe ÀFp/KBâU*R7+4,¦½óÒa¡›=(ý¬!‚½g®“´F¦¥çšVž¤—…ô·¸ó’‘ ñüù•VË$¢!”v!')~©²b3Ž¨ˆƒéÃŒìUÏd{ÞY¨aÄÓøŠ#R°ôÔP ¾;a}c®oxú^îãÖß?ñwà8w¸0óŽeµ;­†{º™'u@‰¸YâÅÕZl¡ ·¦ížfèünk3·/<*jË7<Ó¦^ˆo(¡ðÓ»/l‡,À _mç…´Õ¼rú©2]18­™î{ÁWö~$â†ÅÕH¤‡á:Òú¿“,Jݪêb(ï^˯—È <Þ“ö[™¡G•r0ÿÄR ëƒÐ®DØ4sÜΖ6e™Ntª<ÀæýÀØe†*:]c<Ç1[Ë‚ŽPÊ;”×SΡ:ø?P¾ ´endstream endobj -5927 0 obj << +6371 0 obj << /Type /Page -/Contents 5928 0 R -/Resources 5926 0 R +/Contents 6372 0 R +/Resources 6370 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5897 0 R -/Annots [ 5930 0 R 5931 0 R 5932 0 R ] ->> endobj -5930 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [481.678 567.955 512.306 579.948] -/Subtype/Link/A<> ->> endobj -5931 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 555.921 227.853 566.398] -/Subtype/Link/A<> ->> endobj -5932 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [165.255 296.971 384.882 308.964] -/Subtype/Link/A<> ->> endobj -5929 0 obj << -/D [5927 0 R /XYZ 85.039 781.388 null] ->> endobj -5926 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F14 2895 0 R >> -/ProcSet [ /PDF /Text ] +/Parent 6341 0 R >> endobj -5935 0 obj << -/Length 2778 -/Filter /FlateDecode ->> -stream -xÚ¥koÛFò»…E -ˆÖ\¾à>ä’Ôy8¶/VÚÚ~ %Jâ…•¤bùó7¯%)‰’¯-Šx—»³3³óžUõȆÿô(ò•íNGa¤•E£y~fV°sq¦b" “Ì¿fgç?ÞHÛjjOG³e‡ÇWžïŽf‹_­×ï^ÝÌÞ~O\×µG'aY¯ÞŒÈúi¬µ¶^]½~;ÖÖñ¬+œÏ~ÆíëÏyíÓ¡^áÚÅ[üx{5ÿ>ûpövÖ2Ø’f¦ÈÝg¿þnp“g¶r§Ñèæ¶Ò°Ÿ{Ê÷\ùÎÎnÏþÝ¢â=oħ†„á9rB˜¸¶Š"oFkG¹Ú‰ù¶òm¯•˜îKL;‘ -Â`d€Pd¿Ù:Ü¿žv=¥ÝQ×!A9¤ç÷é¹SåGþ½«_@Ìah¥5Ž‘•ÐÚ‚˜ç8Yó¦Ìµ•Œ'ÚŠ7ã |Ó¼b€7ã‚?^§M•>ðü;q±0˜àP™o¼Šï2Ɖ„S9È#+©–°UVy\̉РØ"kSáò]|Cöˆ‚‚ûÃíAgSºÏ2®›¤: è#t\åÙÁ:ë€NèL€žÒÙ)‚FgûôuÖ£÷ŸqäZå–Ýj)žÃ߆¦0zJ Ñ”<®cÒãWþúå†Çï<¤ ÿ…ÓÛZPݣוÕ×ú¨<í©Šü§äÙ§=%ÏS<÷é ʳG¯“ç¬ -å¹Â¹ƒ6 hp…qœ“áÀl‰¼²$#ͬJòµÑt'›*F%ո̞@úbS««&$¿Ù¾ÍnïyhÖ)€_ÍWR Fò^X*Ê—(²O³%xäÛ˜2±B žƒÎ Ô…ªoÛ,ƼƞŒ(Š„æMJ_訞k%ßFRð™tɇbŒ,À7Ë5Çtˆ¶è -ˆ~§àá=b1ø2>f•A0UŽ==m•= ãVi€ž°Ê“Å*è YeŸÞlªñÑ0ÎËJVÒk±(ÙbSZ« 6q–áÄ·®{A»à¥ÛµQÍ c4|-øXebH–ÄuKà̶X˜­ŠWÃæÅ ì\òüû€ú)˜ —iךS²Ðœ`±ÆðÈËÛ±j”ßè lQLZÀ´˜—dMbo©ØÙ“BOÔVÎ÷ËR‰ˆœì©o”õT¢)lÅ2Êf_7hæ:´îÈ û·õ÷.ëšË„ ysˆî8Û5œ×ÞÂ;cx¨JÊziÒÄÕ£Ü YÀxñå=Ã/ ¶ Y¢jÖ)À-ËŠ'yY$G},ßô¾ÓðzÊwN4¾³OoÐwzô®ÊO1»‡Q·zì8iEÃÚ$7ˆWºPŒ¼NiXw[£K‹/¯Ù;Æšê8 I§×··ðqþ#f•Ö‘„2î”ËY»ÇdW{inB–Ð4)&~ÔÄiÁbp@Ò«ã{V½55~Ų{Ü(pÛ° Æú¹°¢ Þˆ ƒ7 ŸÉ¹ -ì±ÐVumˆiÈ…(¸ãQòr -†‡œÐÆ‘‡5X$-¬9„ÂÂÀýï«´é]Lz*%Δñs&›´ª›7²Ò%¥C O.Qc³Û›qäQƒ¥oÞò¤Ž0¿¸º†O²ÓDFž•{å1€@ÂÊ$¯Þ'Kë¦JgÒÕøA¤B/<Ù˜õ`ÈAØõ”ëä â¶>µ6…f̃v x°®ÈÔš±«Á$]ÌþTXcuY®(A¡u;¯ð›†??Ã̱ Fè;§Yî`|Ú°ìL•ŽL>$ÅF¶U‹R¹v§XáàÊ‚-AȹJt®¯xMPèO¨Õ2Ûr•Å>Y1°d†<œ#: LyY›â(Þ$“¨î›q/S -ìÀ >fÒZÄ¡lâ¦m¸’šƒ¹ Ö[¶&ÊM›â]pöäïè)L_û*F—«•ìî)B`'ð¡vñ!¯Jt1Ég3t˜68nj(l8Š冻,íY„9ÍÉ.dE‘(':p•CêKt&¥q ŵ8b5ì¤Uœñn¹1!Óï·}—‰îÔ:1\ ©»Ù2):WB«½gž‰\„/»ëÙÄAÔ\Ö|K9œçRå¨ciÜ e¿8ZE:‚é©ŒÛ;<ã θ̧ 0Å€±1åÑ “~¤<(˜þ2“ÝùL -2y‹âëeYö$TB‘ŠaÔdÇ.ÒzÞ:–~9ÞªÔø­i¶¹ðv¥’e9ÚF{žlÿ AtçOB€P_¨¼¶¨Ep´Éží~S·H)…—ɶŒû"÷{v!|‚øÙ%›¸Šó¤;+^x¯’—O)×è ›SjäRn³©N2øñÏCÕ O»,'Ê–fær}9SXQdB luYVùqt1 ó£ã¿üsühÜ%þ’±ƒ±³H±š´µ@±àóoquâ9¯ãü.>/Žs -þÊÏ8Bï6iöèݼ~.&Ö¤y²K©ºL‹íƒ0©¾»øLt¿NçbKÆjñ‡€þ%‹aQ8 -ÈEœâo*ƒ„¯(©Å¢—÷EݤÍÖ8/f{ºTW s‘WPñ¤sãOåüë¡'çN*©:®> endobj -5938 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [218.134 512.523 287.369 524.212] -/Subtype/Link/A<> +6374 0 obj << +/D [6371 0 R /XYZ 85.039 718.296 null] >> endobj -5936 0 obj << -/D [5934 0 R /XYZ 85.039 781.388 null] +6375 0 obj << +/D [6371 0 R /XYZ 85.039 691.197 null] >> endobj -2046 0 obj << -/D [5934 0 R /XYZ 85.039 568.747 null] +6376 0 obj << +/D [6371 0 R /XYZ 85.039 637 null] >> endobj -5937 0 obj << -/D [5934 0 R /XYZ 85.039 539.949 null] +2138 0 obj << +/D [6371 0 R /XYZ 85.039 566.364 null] >> endobj -5933 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R >> -/ProcSet [ /PDF /Text ] +6377 0 obj << +/D [6371 0 R /XYZ 85.039 526.201 null] >> endobj -5942 0 obj << -/Length 1121 -/Filter /FlateDecode ->> -stream -xÚÝWmSÛ8þž_áã˜!™ÁŠeÇĆ¹Îå‡!I‰¡7CóÁØJâÖ±\[ —¹ö¿W²dãS Ç݇†XZI»Ï>»«()ôJ†Í”ÚšaHHs:rZƒb†,¦È…9صfÿ¨%A˜Š)Ù³=:héšd{·õîûÎض®²¦iuU ¹Ý6ê^C5ê7 a½3ìZ Xï±)­úµílxtuÁe— 6«Ãd§ëXC»1µÏk–ÌMS0&C÷µv;U$zr^S€fÒ=m+ÒáeÂzKý 6©}ÈUñ±–ÄW•‘¡kÐ m— M/°U´Ì–ÔÖ +­”Ž_²®êõ#À¿]†È%¼³JP,'rý™ïr‘ûk”ðö Ǽᢘ8~ø°(Œ -M† ¹Y´Ô.³"rã/¼Å~HŠJÔ6PÌ-%<¦…B‰Ë5ú8,³þIÑ•ý¹‡ûK?<Ü_àUL›ž³¡¿˜ -6È¡‚ûT°IýÄK]¹úßø'À®‰˜Bñ…'%ÿsƒ8B"ƒÑé!oí½{×\;q3Àófâ,ïœ&¥švpèï^™š”þ\Pà 7SôÍ8§N3ÿŽ™§\(óÏ5Í1«suzs«L3wæsäñ65„‹sàôÔZá6,=Eå8A9ª“­Ô0Š©1!N,àÏQˆb‡øá<7C‰ûyŽÄÑ0§±™,œy9}ÍÌ+pç -<Ž†Bóðw«û~Äû£~ŸIâGŽï¦üV½¤`D~^%õÊwÁž‘{:“÷zh-ó‚™Çx• ÷g|<Í`.A_…“QßîY7{¼ûí[Y¤óÉ …á¡õ^šÚ»æþNe°  «08´l‘b‹7.`JbñŸãQ§Y2º¾êZ;|Ë%¶¿¿m$lä.BŸ²Ì*Šp–¦ qf³W†áz<]ÙÃÀþ{a˜T Gýó8è%a0^o;nV~BضïOðö<ÿÞåÙ°û³\{ýeÔ*RŸ.Ûp^ï‹ŠF//ì³áé+Ên+ÞC|¿uÎóÎ8¿,ÈÆ©þQÞ ½=NzËàìêB1B…‹ o:â¼ð ¡:vÎ"Èóg3ÓÝ4؈câ¹N^údDÒå;0‰¬øËEËÀ$pH†{-æx(ùBpôôM*»' ²cklÃã­“Ø Ä®ƒ©ýøÁÙ±r.8ÉÎâåÀ¡³ÎÙ6À†ŸÄD¬Q *ífKä೿> endobj -5943 0 obj << -/D [5941 0 R /XYZ 85.039 781.388 null] +6378 0 obj << +/D [6371 0 R /XYZ 85.039 433.421 null] >> endobj -5940 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +6370 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5946 0 obj << -/Length 1399 +6381 0 obj << +/Length 2049 /Filter /FlateDecode >> stream -xÚµWÛŽÛ6}÷WèQjZ¼é’ H·‰›6E¶ÛÄmÒ<0’l +‰®D¯»ß’Òzmï(†É™!9·sHÓ † 2IbžiF ϲ hgq°ÍÛõso2?²ùq5[ü”ˆ€Æ$ó`µ~ØG!y°*?…¯¾ºY-?DsÎyȉæiš…Wo"–…F”Òðêúõ2¢á4á5ŽW¡ú·¿:Ùû­®Pöv‰“åõ*ú¼z7[®&§£Á™½ûgöés”É»YLxžÇ„‚º{D -îçÍìãì÷i+§[u)’gDfü<Teƒ2N£A*c"caÓ±Úê¡‚¨ò<<ÔÃ¶î š γÐh'߃hˆæ4¬œ¼Å±î#/ÈêQ_¢9$à -•ñb˜YûBí@OÃÆËëîœv‡k´]^ØCìQÃ#y8ܸ'Å“q‰µØâ²}SbÞƒ¹rN1S¹¬ˆXj­ìÒ‹u몮÷Æ Ì¶r]ãfM£Ñè0 Š¡6Ρ§õ¥”NY²˜š^* £$£ /è°!å¨BA¿ñšGu¥<‡ºJ¨ëÃ)¶®üQ]½Õh„ÑoÙ½X,‡)zUo FŶ®ˆî7‹~«Šª_t¦±e8 ŒCÇR–=Øœ%)„–LùþÆÁÇ É’ì+Á{£“àoëê Æ}(K$¬ÁÑögR€K™ T~ã8“œCK}%ÎÑè(Îa¿Ûiˆ±­‹^zmH¡ÛEY­Õ¾1D »WCQ—ßß~yYuóh.’p?¼¤YNcyš‘åD ¹r– _p<%I–?ËÎI*IÂò)$ZJrÈ -†ä!”$‚Ð8±!# ø£@ÌRÆáUYÖ‚1IÃ]ÄiØשzË(MÂŽkXb¶Ø`¹ÐGÖú®êÐÈ ÕyÃ{_“„ ÏçÃy°¹@¯c8z…RÎ ² -ð -øÇqØ*œß» 2gj™&ªó²*A¼§öF·ÊÔ…jš{'*‘Œû‰¡`‰Ã°U–@í‰;ãD;4÷ìjypÆtu~ãm¯qãÍÖ­r¼º#êGš¬^[R<íӔРÃRçΰßweÓpej²¯ ˆ¾»Áñ¿,;Óß;íâ•ÛóQfç €û=]ë¬ïTœæã;Å··y>ªÓ0*ò´¤L ÆxZG6SÂEr -)ày“ó‘)$’„ÈÃ׺m´-æ—=´/kêq‰Ášåqx­¦nwV9zË3?F,”ºÜËϣح±/Køb/të­J…|æ Ž»Ç1¹.ÕÇ”W#UN#ˆNkéµL¯Œ¶œÍNßœ ò4£;—lãÌ€RêÞ Ž;7±§ÜE2 U³·dç"Ú­Ývª1“S²¥¹‹Æ¥Ö ¸lRÜ:Õ_"åª+ô¾Wì1ËqÚý–½ò¼â™Ïº‰áÉM˜øFnj&þw7çðÀyLØŇ|§âÿÿ4nÖŒç—1)}± ‘§§þŽ”Îþ<ƒ]Oendstream +xÚ¥X[Û¶~÷¯Ð[d Ö’"u{<é%MÑ9Íäm¸¶ÖbKŽ$w“ß¹‘’×vZ´X`Mr†Ã¹ó£t¤àOGe–(SEE©S–Ñú°PÑ(¯Z8lf’ÌZ_!®ó—èÌãàaº¤Ù½Œ£®­yppkdÛ¡B~ ÍÄ_×vãÎ+ÐêÅZßïÈ{±Æ#ªŒkGò:ù£™Ô—Ó”´HGcwýÁ 8‰–{¿wëp¸¡°l™¶#ùOAÝˤYw-~‹‡Q‘‹1æÄ3h7w%\Ÿª SÒ@•]K±hoC NU²W4S·rΨ’“mÝî$â¸Ê•‰ZRÕ((ºÆ'Ê£\ì9³pìx™B„Û¡¨Q–žW„p}aº/âÇK}íöBä#KJs×nŸ·ÈÍa|Ø{‡+NF-lQÄ +ØÕ=IR6~Ý"-¤ÂجO{׃š™Nçi>ˆ„Gæ&'uÞÃHZsg@}N#åÊ– T°u?ˆPô¨Q™X_ÜqHúy6ÄÅI;Ã=èb°†Æ$^„¹ËNÃèš;©Õm­¹iPn¿Îõ‘Y¦&ÐÖ4&{ºt·&ãnnuþ\smIȉ‘ª E‰û¸¼Eß—qLî +%´—ÕŸÙet6f®Í>T+Ä0¯”:kŽõꎤW%Ž=7Tªzê7PXTØâµ´L±—+r¸BPðü£Ðv5Þ;ê’úXÅØT æša„ÖLmã\^h:”ç@xjÆ‹üì;^ánŒbNÜ{¸^ñœýÐ%7îzkl¢Š¯CªÏM8b•M +{8’ +¡¦"™~ªna«tR¥ù 씩De„‹>-~ý]E`úi¡í Æ*ÑU°H¦2™ïïÿ‹)L’ö¦Ú¤@ ˆÛ<“œ“rªÉ9¹4˜€•õU*±ºŠŒ)€|Ôs—ZC ö-E ÜòÌ ²#­Ò¤ª J>•¶ÖË|LLvÑÂÝ냉¾ë@Õh¦­ˆ]Íä2l+g° °XšEF›‹€Û|ÎûË!ͱ(Ó*ž2ÑÜB'9¹—aõ#¯6ïÂ|n`á’GMôGææɇ¦­>óðŽÞÔ¼Ýßzµá«Sd¿½·w©RŸ/€t¢!WgúçQÇÄÒªˆV¼í_%â,…Š¤ò×°tj!6º ˜¼$3ÎÀâ/ Àþ"ZŸ†a-¤îfç#ãXNüd©Ÿ˜sc”òÅF¯ö¢Éñ8< A½¶­2ç~$¦ˆø ùÀäfF» zŠ,LpÇÓ7WA5Ýý&¥”ð­ûÉÃhŒoïqÂÙÁ+ë}#`Õ·wŸãÇ€uÎJŸz­=R¨ßöµà…+‹<8¥*´¶Ê°U†¬¢ßµ¿9¹/¡ÄFÙ2ÔleÎwG¿å úC¯êñuûØ1¿þ>¡rµàÚæ#Ãœ{v÷B9Ûz¾Yî7K”ûþš)g=ŒXcϨµ¿£ð¢€ƒ~”°!NM Zô„’/K ¡nX.]Ø0mû˜¶›¿üHsÒ‚šOÏœŽçlãàV–=g¹ÏK熤×û(ÞµÌ/×Цw$TÐiŠà‹—¨\åIÏ"²“'}/HH4á W»6¼¥œ<Á8õªÿß½‘£Ž·_‘½°œ¤¡× ½ì6"[^OÎ.¯æز‹îÿé¡wé|õ½&lÇÊÛ4AÞdÓóüïÂP'àÌJ}5^š”7ù™9™°ÌÙñÏÛz|ÿüôós·Å(ãÚ/ï¾åÁe‘aWÌ*€îÍ¥ïfw\ϳ^eI«_X‰L@è²õCf²)§³Ç¤1W^f0,^ç-s†â¾Lm 㳆Øè}Äl³ÇÏ éµÇó/;Ò¯à< 7\zý[`¸g<wh%L¥<”Î`§Žµ|ÐÀýàøû×·á ½¢Ï R±9"ƒYùÅZh³{Ý2M²¿°cb¹ý©L%EÎÕ ß$<¢?{^IIHxN‡ó[ììšÏsqÇ÷S¤éQRÆä§y6`Ê¿çáå f¯_ULºh2”‘öãòvRˆw5wåM—ÎKÈ-õÂУp‘=?0Dž•æö‰ɘg£endstream endobj -5945 0 obj << +6380 0 obj << /Type /Page -/Contents 5946 0 R -/Resources 5944 0 R +/Contents 6381 0 R +/Resources 6379 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5939 0 R -/Annots [ 5948 0 R 5949 0 R 5950 0 R 5952 0 R ] +/Parent 6341 0 R >> endobj -5948 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 716.996 381.124 728.989] -/Subtype/Link/A<> +6382 0 obj << +/D [6380 0 R /XYZ 85.039 781.388 null] >> endobj -5949 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 703.447 266.58 715.44] -/Subtype/Link/A<> +2146 0 obj << +/D [6380 0 R /XYZ 85.039 761.463 null] >> endobj -5950 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 689.898 490.439 701.89] -/Subtype/Link/A<> +3125 0 obj << +/D [6380 0 R /XYZ 85.039 653.495 null] >> endobj -5952 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [266.468 572.648 475.915 584.337] -/Subtype/Link/A<> +2150 0 obj << +/D [6380 0 R /XYZ 85.039 653.495 null] >> endobj -5947 0 obj << -/D [5945 0 R /XYZ 85.039 781.388 null] +6383 0 obj << +/D [6380 0 R /XYZ 85.039 615.228 null] >> endobj -2050 0 obj << -/D [5945 0 R /XYZ 85.039 675.629 null] +2154 0 obj << +/D [6380 0 R /XYZ 85.039 434.077 null] >> endobj -5951 0 obj << -/D [5945 0 R /XYZ 85.039 654.736 null] +6384 0 obj << +/D [6380 0 R /XYZ 85.039 391.123 null] >> endobj -2054 0 obj << -/D [5945 0 R /XYZ 85.039 557.204 null] +2158 0 obj << +/D [6380 0 R /XYZ 85.039 110.288 null] >> endobj -5953 0 obj << -/D [5945 0 R /XYZ 85.039 530.59 null] +6385 0 obj << +/D [6380 0 R /XYZ 85.039 75.542 null] >> endobj -5944 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +6379 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im3 4353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5956 0 obj << -/Length 3338 -/Filter /FlateDecode ->> -stream -xÚZYoãÈ~Ÿ_áìK(`Ä!›Í+ æ6ë#v0Ù<´EZbL‘Z’²Çÿ>uu³uÁfÕWuõW_•&¾Šà_|U¤a””Wy‡IQ\­¶o¢«5ô|}‹„N“0ÕÊg:—¶w™©0ÒùYYc™Çe˜èe>ܽy÷EEW* -³,¹º{¸Šc&±ºÊJêD_ÝUÿT.–i·/ã"¦z±Œƒíb™dY`º - yð~µê÷ÝÄ•›E}Û€ôª©ÇÅî~}óùÎmEv’•Q¨ã×7ëÉÐfãô*ŽÂ2*6›æa'´Ù»M3Â&"¬*6fG[¸mÄ­ï´}øcÜ"5Ö4* ¦Mm‡‹è0ÔÝBÁ$SLfªY¶à¦ÇÄz”yÆA-ÔHGÖ"[Õ´ÖJI'}Àú- íKØs=Œ}gZîß `h3KÔ#¨gÃe§tÚ©YÁdºÀ‹XÐœºHÝ~ò๭«uÍ­8®„â£Ùbÿ½á¾­i趺5×Ûfœ¸ä4v?Ò&p’æž÷IõŒ£Œ¢àUñ8ý +Ô´£ˆ‚²_MMß±(Ð;’.éL¬„žžj8’JŠ éxæ­áÑØF³ÿÅI?Lܲ1#ÊÀÛ`-Òtã¦â»Q:‚ûD%‘øÓ" ¶ öÒíb#YTçÃáÚr(8ÓSSù÷ ÚÐqüØÔpúÓÙ -…šÖÂKN’“ÓaÛ3NŽçIìQšôÏk’ ¨6tµûõÆÖq zx67}3ÉwäïΞÍÈNlZº…>¼ð‚Ó²“H¿ú‚= 7±Êüœ*Ôebá&FÀÑeðe‘DAm¦=[Òx„9ꮆû×d)—PÆNýêg™Ë(“¦Enâlì£%ç*¸†ú-ÐCªFlK‚ow`ÜíîÛF–AL^ÈÞ^4ÞÊO²Šc±Ÿ¸ÜÙ<‹\6Ù¬¸÷` -sß´d(ðb‡ž"K³Ý9ÛÊIUI æýuèq£;®Ýà\÷(Ù˜ÆZЀ…ö#à7[¬ÂæµÌ„ï&ɾñ½b‡i鉬yÈÊà&°t}‹_T3ÍâÔŒ}ßîô¹7‡ö¢˜?jT™(o&Ü)ɆÌàü› ÕðЊÔ;±4Bù¬¬ÌÎÜ£J[«ÔB# äQüÝz¬ø–±ø,nË/DS›éo<þË'oxöÓ’Jc[s™ k¿Å¿÷dY䡃…£ànîmç -üaÑߣ4êeØ<‚ytÞk„¾˜{S ]éF@n0S?°cMRÎ¥’MñË…Å'¾æ”ý ÍøÇÞ–F{§'ÝÔíN0®çïP½uº³s%À²oØŸš”ù¬*,7öµ×iÐÔËŒí ¾ÇÏUEÜË'ƒÂ{pov(ò U2Ôô.X+²ƒß¡â´ÐÖ†éHõ‰í6;ÿå™#)¼Èƒ5bD^žÉ øt#MmÖõ_˜Ïy¯dοb˜ÎÈî¨Ì²ëÞ³<98óiC÷¿þÓb™——üÂÂ4›éXJnšÁ}Í`w -@¦Úzö4ëTÃ!#WY÷àÑ™&áííMÛ¾pã¼:Tduôþ½ÌeI ©Ÿ©4#bšÝ®±³ò#ÛÙR£#ÚO² v³:>Ïp,'ŠYÈ°'l+-õ™„p6Äâ‚ß,|ûŠ3ØW¢-þäÒ BýSãη;yá9XkPøÊäaÇ5k+û~¶üW,xZ· F&%½;õÛòà+ÈÜZ@€Oáž"íÀÅ%«ž ÃÀ‰„‚6QßÔ¸cJrü9•`%‰£À#ˆCl÷/Çü-b•Ã°­éœNd£@£ãd6œˆ£À=W³“¨º”8ï ¥˜‘ŠìT;é®ñü;2¼)‰„KñQdÍâWì4´ÜtÆ2Wˆë:.-ÅA²{ÓWÜK$¾´úOV Æ?ØÖïÄü‡iOû$ø¶ûD‰„1,˜ýÔÛ†>ðwÕ{,¾å=øaK9¤ZUÀØÇKt5ITÐÕÅðdÃ#¿…UÛÌéqó°ô£Z6ìq¼ÈÞ#ó*H+déXÍaµç¹¿·†Ù£Y&ÜÀÈeí%-¬5s\JÖœìjá „U¬qN9r6ƒT˜Œæb¾Ðð€—ñž€VZúp -bï«3|ˆß=°—Ô¡+AnDµ? Ì8ï]w¦E×Ù -NøîKšù¡Ÿ‚/UpA8s]¡Ñ¢®Yü RÔ1•XÚW¯gW5-½l¥²)€3±{Åì|uµ’ë¿“ÃS -•~=&÷d.ÇäªLB(“+‰É?³'æãbñkÓ™µM!aÃí ðøíA>œQªKÁº*£0Ó¯ëžÌå`]ee´÷u•ÏR¡Q)Ѩê s7²É‘»2¦|Æ·œs«uäo£5C+/aÚôø¼“,bâÓ -ã`=¥åÌ @â€ìK?»µ2øAîöëð *¥ˆ— -äj—‰€6žääˆØU¦LÕpA!´É³Ñ*s”€=>¼¶f!ˆS0àš\9­-] ;ëâ°‰ –À,›Aàœ* nûö\°çœ%1ÀÖ¬fæ'¤¾3ÙÊ‚oŸ¡|÷Û÷¯ß¿q'mŸ–³D’ô =†«º‰aŒ½ä7èŒ!"Ìy c &hûõ踨*ΦUÜváŽ]gâÛq0Oea*V{«ÒÆ>×TŒŸX{@j’çúźé‘6dÊLÆ Øõ†¸ÇÚùhϸi b@ör -ßg¼³§ ôèëƒV³L ÿÆnÊ䉡AÕØ7$Ý3ñèÖµ´‘1Fùl)´ŒŸèõ¥˜ZŒBâ°E^µÌFÆesº ÚXÍëCòr)¦£œRbÌJKÄÄ°~8¾åf›ýç@ú¼,Mñ|­"é&ëñÕ„ÇÌFá@Øè¢tasîW‚‘»ËŸï®k.:ûà -ÙŸ$ÎS ¾”Zˆ;î±Â¿õ~!/™ø­y‘‰›üØwÍ:¼ùþÛ‡š–aYh‘$ÇÝo-9Y~][NÉú#.ä%“Àw¤a™jh?ÚAòþxÞ«+8S}î0à”Ê"–îú9BXÿ¬Ï&SaYZvð7œ[Þ:•Æ…Ž~JÂ_`ñ"ÔœµBI?PÇúgþa¨ "0ê;++p> »Ÿ+h3)]ÀQ4㥨ÒK¿x@_±wé1ÈŸæËtPümºqZªÊ?½åºJ¨@™ö8šÝnœÌp´ºY3†ƒøs3m¸ñ’$©í¢Æ3?H%Sú¤7\œI´”9Øš‹˜ù€Úu3[|Gè*d eÐ'U$…Ðé"ðATó“œ3(0†à_$0Gn}pý°¡SÌ9ÞŽ³‹NEÇ©—R;&ÇØËQ*œJÆYõ›&ÊŽrIæõ½Gƒ}~x@é{”1ÜgãZj{=I–H΀ïĦí®Šÿd×ÕSøà‚uèøYúEŒ¼¾å íDŸJY‚œªæxê»s?Ú+Q~º ¥4D-¿&Ø(#ó£ •$aá@ÄòfÁKmÓËŦϕ}²ÇÌ7ÊÃØ¢*ý^XÙ­Š*OÑ 3ða™(ãv¢è,ØYÊ2±ãDaTÚ½þõÌœH¨Ø†L7C¿Ìv¼<_š‡*Wÿï|ïÑ‚mF¸æYïú¾Ï)DE¡è%ö0 S ¤eÂÊ2Ïù9¢ŸLãØrh,™{ ¨å>²™gÃàjqÙ+w‘G„ ód¡Xñ|-V)ðu !31N´u¹Âœ.¸Ül£°ºøv÷ªÓÍŠ0W¹È†râüÐH¾q² ´€k«ÐÉ×qÖGîä"±Âæ>q!ç‹üh -Ê×ÍjèÇþA2 -×tf]ûpz1}Š{¢ÖYÊô*cD¹þrEòÃYêþ¿€ÄôÐçz\p—ü,‹2„¦fα”MïfZ¨5$‰fªËôåuyLMáiW+³³y/'¥âþ›åÅÜ@¨J?¸~%C ’§!v%a¦ìd”¿~´`šaZ$—WüF qendstream +6388 0 obj << +/Length 2559 +/Filter /FlateDecode +>> +stream +xÚÅÙrÛFò]_Á}p-XeŽ0®T탽±³N,ÙÓ•Ç J(‘€‘õ÷Û× ÙrìÊ–ÌÑÓÓÓw7õ$„?z’F*´Ù$Iµ²i:YlÎÂÉ5ìüt¦b& ³ÌóùÙùË(žèPea6™¯z<‘r‘Ì—‚ÿçÙÛù‹_§3km`œšÎ’$ ~|1ÕÁ»_à¿ùt¦ƒ70xË oš4xóòÕë¼pñìò.ý0/.ðÜå|úqþóÙ‹yG]w/P’!iœ}øN–ðŒŸÏBe³trãPiØÞœm*rVæë³wgÿíPñž›ð©1Nxˆ™ÎTf¢Ïs+ÖÊŶ㖠G¸…* +q dÍ‚’M‡‹º“ZâB6ÐV›¼-ù]*ž¿"ËãŽÞš8®X/šr—ŒÞ9»frŽW+¸GdÕž'yÍv‹Ø:»õ™0¯ÓT™#VwÚFƧÎ$L: Æ}vQ°xh)2MGéq±Ò&†¸*cô—s_Ëf6’ùÎ<®ÙÙi"h\FH=EK|fÇœö„ÈÄ*ç’ïC¤àú‘P „qtHd~+¦‹<î˜Í™ 1Mظ%òŸ3ˆ†Сˆ|$†µ>Ãäªîr]u~µfåÑX¤Î F£šD0;ò2_u±"!…HËÍ°°É·¼²Ë¯eiEK ëàS¤ØªéŠ÷J9V §ªýS[FS­üU©`m‰l°óäç¼Ï¶„4aS.šCTOp÷59nââåÓ‘:—€}×ùWJ™x1—`JøÞŸÆaáïHáã éÓ#jBUX4ªt@hŠIXò : ô‘êú:˦ÊÔ¾(g¨Áý¢:¬&Y¨œ²!9Ï sæ²âˆì?z¤‡Ö˜“R):ùcvˆŸ@c"¾-œ¿ÚèÉ9P*hg¼lcéЛLÅI4q %R/Þ'µë¾¾ès #.cáçæ^Y¬}µ§©Øõ¼åo[n| +…Ø-#h% ˲rn+eÃåüÕßz}]p"„[­`ÊGpâ%53qÖD†ÒREØéf±å]öâø0Œh#-ïQ2ßš‰¬6’ò/=a΢ŒE[ñ˜øôfΓ=’„B¬ÒÄ<¬›ÜÁ“6Ÿ éé·ùT ¬‘X91|]ÝòFŸwûÀÄ«à=i]ÐQ™4bŒÜž†"n úÝŽÐTu! ëÑ|“i›’šÏ6FllTšDŸíâXˆ4Ú¥G]#]¶«Aƒ¤2ˆã “†Î9.ÄëR‹ç¨¿Ó…ˆ‡ú;Ö&Ê}áȃ݈`*”VTßÞ‘2½ìŽÃFEZø.n—¤ýÓ`ž¦= ¦Ò]A›çHÁiÍ ÕB0*½ö´eú"é´MãÃ/Øï‘*×R ´EVi®ì88æ ˆ'siJmå §&sÕJ4zgÂ@ºŸ¼£Ñ7ïµ7äÄ`Ôù™߃óóÊé„ç#Nî¦Äh€¹mx%§¯>ŽÀIçÀùQ§!1yne]b’iÅ×e¯St¨ÚúL%Ò@h2Ãì*ð(ò-¡û4ÑŸùCvî(ŸÎÅ_¡t†e/Ã<Ç>I’ž¦Û¸Ø©A’Ñû #°’i€߇z™|¯wpˆÀÝXÓÖå¢+6p“0Dhö-ÖåVHù&¤ë ›1,^=ü‰ñÒN)´¶7c.+Â"dª^“"Mpc탖÷h¦èeÒ(x¾GÓIEwò!þ[1V}µàÊ +‡9¨¥ºe={`² ŒûFRYºí·$Nᛢ¼^T0^U¤¬½§@2ˆ‘p¢” Æ9rØìíº2Ö‡ÁÊ“a¼‡<ìþÂj×ÕÃÝGôÚÅð@¿-ÀÚ¿¿ßö]º)jT[¹bIœÊtzÐwó‚%³3qçÆkžwýMœQDÀï9ƒ\<D^¸+×kYµÂ×ù°¸ÛK÷ @{*J–ø(ÂRHÌyÚìÙ¡X¹Ù{@]:}ÒPN5tItȤ͋í ßÙU¸Ë¿,LÉX(ú1<]•ßvF™؆OP§o¹ìe ‰s¥—˜/[/ÙR÷Ù‰Í1<`¥v% µ¥ #B’½ãÆ9·PpÈòÁÝ|1Gªn§üƒ b¥_‚˜!ùA wÌaBÀŸU‘·d²²MÎÀ¡áã—ݯ1 o“»…ísþ\x—äRʼO…SBÀ}Ä‚Îq+ #kb_Ý× +,>#í¢ K`>VõCNŒ15 :лLÜ»=ãõF&^çú;(ò°ÆY‡ië-öU<íÝÍãMÉÕH‰#½úý€«£€Vm‘ÎA˜È[ÿCÆSȺâ·Íáo¬’}@¯»ñûÊH¿ÑƇÒoq—ú«zÏDo×w£—õždõP'Á†Êdc6ücÓÏ]žî¬Jm6ž§GÆ(£=-ø Èêélª¢Ôžü?w掆endstream endobj -5955 0 obj << +6387 0 obj << /Type /Page -/Contents 5956 0 R -/Resources 5954 0 R +/Contents 6388 0 R +/Resources 6386 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5939 0 R ->> endobj -5957 0 obj << -/D [5955 0 R /XYZ 85.039 781.388 null] +/Parent 6392 0 R >> endobj -2058 0 obj << -/D [5955 0 R /XYZ 85.039 761.463 null] ->> endobj -3025 0 obj << -/D [5955 0 R /XYZ 85.039 667.044 null] +6389 0 obj << +/D [6387 0 R /XYZ 85.039 781.388 null] >> endobj -2062 0 obj << -/D [5955 0 R /XYZ 85.039 598.304 null] +2162 0 obj << +/D [6387 0 R /XYZ 85.039 761.463 null] >> endobj -5958 0 obj << -/D [5955 0 R /XYZ 85.039 571.69 null] +6390 0 obj << +/D [6387 0 R /XYZ 85.039 740.731 null] >> endobj -2066 0 obj << -/D [5955 0 R /XYZ 85.039 309.244 null] +2166 0 obj << +/D [6387 0 R /XYZ 85.039 362.875 null] >> endobj -5959 0 obj << -/D [5955 0 R /XYZ 85.039 279.84 null] +6391 0 obj << +/D [6387 0 R /XYZ 85.039 330.375 null] >> endobj -5954 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R /F11 2898 0 R >> +6386 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R /F62 4047 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5962 0 obj << -/Length 4283 +6395 0 obj << +/Length 2001 /Filter /FlateDecode >> stream -xÚ¥ÙrÛFò]_¡ÚC)fpæÍñg-Ùk+åÊ&y€HD¸hI¿}Í` rR)—Ì9zÝÓwÏ„çü ϳØt~žf¡¯³ì|µ? η0óö,ˆ…€,˜Ÿ®Ï–o’è< ü<Èϯ7ã>±Åúüzý»÷òç¯_ºXh­=¥ý‹EšfÞç‹ÐûíóõëKqõJ*ó^¾üðëÕ5DÞGüðþÝË‹Eè½{ Ï^ÿröúÚbf¿ XäˆÖÿÎ~ÿ38_ ¿œ¾Î³ó[h~Óû3ÀË#-ýúìóÙìV<óª¹SˆuæÇ™~| aìC*_‡ê<?":‡U×öHD»"†‹…ÒÊÛã@9ìZè¦ÞºÇQí!@Û DÑÛ’á<Y »Ðo°%Î8y‹ÿµÝWž+V8±*é³²w Ö<ßÓÂÕ±«.dýýE¦=àPÞëo8Rv÷ò¡ò–w¸àŠvîO—&` œÒ"ÄC̉èÁÀÂÌ[¡¹bT:OˆDÇÞÀhà×vM[ã‚í=ƒÐæ%Íï{Ja1mˆÍöæ"dZÅÇPòÊa'¶^s£Ãï×¥lcÎ`[þ­ø€çP–Íð€QeÇÝ¢YÏмo;’Ø[µûC]Þa'¢¯ wêžû¸ú‘Àùg:õ®‘-Ã^V(=ífxÆÓæ¼Fv ò‰¢~ÜîžCß­¿|ɵ¥­d¡pÐ ûâp <Ê¢c¤ÓE¼áaî<×3;åì<ÈâK¢Xtëç<ˆ¬:Ü®ö"° ÙZVây7«¡j‘;E]‰PÒ$ñ¡ÝÙ¬àî¶+ÍmÎZúD (¦Ë¤ŸcFiR9Ó°Ç/Þ¸ÅתÙâ ð¬á_*e\É?‚0Ú"Ú]Ah3ü†›ÒheŠÒ[òr+|ÐîïûA¾L}>ý¶®V‘ -CÈ^úeækxÈèj»C±¿'34ëoFL*nHú]=83£0k4fÍ‚H4"e®ñ"/B>”ûvC«ª'_ÀƒíÚ=w.+£F!Æ)V§F‡­DœHeËma ͺÂCÛ>4þÆÒ&Iî« g›ÝV >9ÖÛ@/ðÓÖÛáY¾CMvOBÐY(¥¼]‹r`ì‹Ršµ[©ü)½°§`%­ú‚ÌiÖFn{FLJ`‘ð€=KÝ]€ ÃáG\.o¡Û[?oýUK(/ZÅÖ´»¾|ìZ–ëQ•––´o@ãEC_­Ë%+òæ!WÒ$ñÓ,r¹ò´SÖ¾Jç]òÂìõ4ÏÒ4ðƒ8ðÌU%²v~ÑE’d°ÕD€†>óÅ&Žý$a œ*ˆx)dÞ†nÏkÞÑõêL?`»3¼èÆUEgø“+pr+ƒÄ£#[0¶ñƒ‘=‚ߧ4»ç=P8´X“Ρ±Yƒ12ø»«f9Ú(ˆÁ: × Ðý IÆ¡ÞÔ TQ³ rïÆø$\Çf [ÆPb›|ƒЮ7þ”½&œ\’(vš²Ø¯‚ãÐÂ(,î…1†¼_Tý­¸†¼!r#ž°Ä5šè Gÿõ¶koñŒÆsXqhö¯“^ê âG~-ʽM[³J¢¥Ðq`ý4 ùfÑêÈ3Ðà Åwâïh„b†ÞŠLJÌf˜½­àX •Ilµ/ùV k´ä«k^Ñ´S‚ò›‡ù%Dñè7m·gyÊ_™¨Tl‹Ä£”=H@›JPp˜Æ0»`à{:ñ£„ -LJlbcg<ÿDZg`ˆÓôÉ”È!³ `6ôsTŒÑ,Ä©ò« -˜åÃ7C8¯ÎçKE²Ý^€g'æ&©—ß-/Ý$±q -qÁ’!Îý)\Ñ<%áÓ¸Ž0§MX‡~"zýÅ¡x„1 Y_beUÛ_ˆyƽ·ÄÆãWXÿwϳ¯­]!%ÁZ†duf7¡úXàÀLÉD¥ƒÞëP1ìzኜáÑÖ#ÒÀ{‡ŸMoU ¤±íÂè¦ãCS­€Øˆsn+Ž[e†¼uÍÀrâœUàøJ>ÈA@Ñzª‹š\­X_˜{ùŠ-Á@ØòvÙ7%sh!×Xveÿµ–Šë}Õ,m]®«WO™Ž6ÈrØWcžžGÞ»¦T€ˆä”(FýÃα§øØŽ£¼ DZüÄk³X%…Pi‹gUìGî,Ì—]ì7ŪªÄ”ƒ~8c^²+É @º0‚úÊÝV†mL Ÿý\¸˜àÐ+}& („=iŒÅ|YgéÈxh;ršÅSaÏv–t˜&I‡á•ãÖѾ—<\ðÏAòDëîy5‹?ðkÅÑ^2/–V°ˆ•„¢’à ¸¬«YWF®`ˆ£·©AfÍ?ö¤VQ*–yÔ?ð ÌŠ%‘ñ d&~œ¤"R—@H¬bïU»:îËfèg„ŒdjYP+ãU€Òkf8 ÓcêÈ#ƒuÄ$ô]ì(_i¶=ƒU²AÁ?6hç%+ôr=CÆ"ÌrЉ4¼l›Mµõ?~x?CEœûy ƒqâ -ä¿)­Çéy„âøµ;‡ºX àB‡¥œ~ #æ¤xŠ*BŽ2bû÷«××ï?¼ÅÚÕŸ<ÔïŠÎ1~Q˜xï6¼ƒ5ã$BƒK3»^ ÛFŽn{ìF' -s’[j”´-7ZŽ/[^juÚŸ ɶðU»/ªæ9ϱæSó¶"# -Å‘üÆžµÆê›Ê{†áªHa°1 7rÙ­ÓÕ›#ëÒúÂ(¦ŽD}ÀBÀ åw˜y]ÊŒ¥~[õC'• +xÚ½XYoÛF~ׯÐKQ +¨hîrÉ% …“8iR;qcI‘(-Q +Iùø÷cW&-J P È¡=fvfçøf–bìÁ1Ž×ó㱎„ëGÑx^Œ¼ñ +v^„¡˜’i‡æÙltò2ÇÂsc/Ï–ç® +üñlñÙyþûÙÕìüýdêû¾#•;™j9/Î'¹þþ›M¦Âyƒ+&¹z?‘‘óîåë‹s^¸<{{†K¯€æüùÞÎ&_goFç³v;¹ IŒª}}þêp7#Ïõãh|cÏ°]Œ@77P¾™ç£ëÑŸ»£xO™kÈ–b*b7–Áqk…ÂU¡¿³–ô¬xnà)²HºpE°1X*P±s™Ý§ °D¨°‘•‹jâ{Î]ƒk¡£ùîy|Âd—)O“÷<ùȌ¹ÃEÃüÇ3u"=ïžy?4 #­yrUW_<¡(ÇåæÙ•vµÖÇ ñHC†Á€!Dèú!Ùá¯Iä;Õôˆ¤3Ç›à AU¶ Êf3™JíTu‹¾³5£,èšÚ+ÂΪšÙo€)rªvÍÓì•ñ'ž%åÂ.—cÄ?··ÏèÔr"c§5gß`X>tTKÛ–˜WvŸ”´òÚuÊëyµªÌÖ¨^A¼h\°ÙT`tÅdÖÉ—;H‡MBçù|é¤N +R¬Eá n p”RÎK2aÍ´é}Rlòô”„n¬£ñT†® êœßÕˆ~Ež“—Jt¦!;<Èb.—+øËT=·úÒÕRªŸ.Îvç B1¡ì!ÛáCD ÿý«¯û-¹µ…6Ø> ÝHD='tm·æ² °‡¡þÿí²©Ñkt#ÎÒ'çùÊíºëÇÌ<é¡ò](G3½CsòB)ÀPOOÄ{ÁÜl’›œrtÅxô¾J +‚ÀUŸrƒw×[dDh|$x8p€îÀ?^è:4+ˆ´¾Èd{(ïÛ´± ™aààbµlS3Lšo©Áf\Êþýû÷ +·îpæ;Ebà'¯™"-—ºznò׶MÊ4Õ’òŠpnžä<ßt‘Tûíg@ɸHra Ek-EÅ¿Fê"COqätÝ>h]õb‘Å*©]/fªÙ:­ ``ØÄ€Œ¬mJš•;´›¢á¼'&àåp0À¬EàÊHàéS¯kðdŒÁS£×L;4£×Òà=^—|MqƒQ<¯ÊåSéÂõQñ–fO~?IUäFu]ÎÀÒ>lÞZKÓQíËsª¡®-g–±i‚Þ\0ÁÙÅ/Îó ¢˜©àÁÎÍÌ<箨]qõÜF6©‚K¼‹e»éø5a -·ÉBZ#o_‰Ú‘8š"J/.àÈ$¶i›“VèÍEyÇnpÒZl#ã¡ÀoÔ¦Lb¦ÕsÜLS¬lSGB3n~âÐŽ\`g‹a0ñoƒ÷w -T'ñ' (v:Íœ-ÍM -›¸¬¸=_¶§¹c€ïNJ£¸ûÏòУ(åc öXÝ´kZnCV -ä”ßind¦˜¥uâÃÁòaé±14&D"!=k­Ùö™{[j2W8ÛIqlƨÌW9ãiúô%µsº"£Ò ¤9”dÔ%™+ªkE\”ù<àÔ}=S£¹ç¡7U}²R£ÒÄWZ=MÃsºR£âÔÏE4˜C¼4˜I1q˜®•á×½:|¬…x.‘µÃŠSPĹ„-ôC£¯Öûâ'(¶?öß[ŒÌçYr`îuÇg·ÜíÊß°à†¸6„v«HÏ«8q';¢AD ÚÑv’¯õË»r†LÁ5LsžÛ«+*€TýHs§úX©³æq.žF ^]G<ôÙ^¹pÿæhŠÊË7‰‹´ -4Áœ;ƾ]Wø•k®¬~ákD¹Â ÞÊ8ɹi¬2hãk9Ä€$ÒÌã6¢3â›û‘]êËä1èTö½´+ôžsöTÔÃŽ,ÙvÇc¼§çnù$ùwR1ÒjR1Ò"aT“Ô¡c¸9eK…õ$ — ZÄL~‰AØ0 Z̘taÚò¤&ÁXã#.b…ÕØØ1éZ4y‡!Ím£ÐïxuÁÆ°@¢y{K‰ÕGü¹µ¯ZܤMаeG´µ)ìØ˵È\Úc¾ú(uu¹ej šŸ‹HZ¼+00>Tµ\ª€ï*‡ãcͱ_9pd?Úd8 Ë,¹A?ç;õöÜõâ3vÌœÃ46Û?M_ægàV†?äF»r5¦ë÷Lû­¹Å«l¦.Îãvz1—¦Èx7;ÙǦáЩmŠ(!tè'A:­ü›ÛS.àïYá(Ø­í[6 --ɲËu@ Ÿïn«Þ6£È»jMJ„¶ÈC•.–Úò,‘›3‡AQöýôÖ‘¬\·—ªL<£Z¯ÇSè=;©Ü×ö¤áìã¦h( fïp¼߀m öqÙx™N3± Žsl‚-[#†µh«•tÈÙŽh^ñGöí ôëb°^æ“ >;pX1¡ØÞÎÑùøVä­Ä1¹Á»¡+ðš,JE¶Ä}gƒ}¾…z*•û±ÕF¼ÈïQñ{ȾðkSàÕv Yãòn.Œ‚¦Õ’ç˜{E^å—„¡¼˜*†gýÌÇA0r?‹'—)WCÔ’¢òÉšßᇓÎ#?É”|˜Ï/K%³ì¾95*çšMaj6˜ð<ÈXØÄ© !Ç -OÄÏ*+Ÿé¿?'¸d±ãè[®ƒì?¸S(z+ºT V¨Ð øm¾AäG¤Ç‰ãæu’“LþàÓK•=É †‰0“°Tä)ñ 4hlñNFø‡ª)ïâ]áK\ÆÆ©C"€b~”ó…Ä\@Ýa,噘¿• êq¦vŠ±ã‹B9sÕ3„˜ªd|¢ƒ£ÿµ&§åºlÞ›ð²Á*´$*‰ù‚÷ëB~†…|¿1˜Ø3L’‘EÀŸòÆ[:rŸ4:…†'Þ‘h0&³¯Ëà?ò^®ÛªA¤ýLŸx¡+å«ÐàBe<ˆ¯yáþáÿ|Ëbendstream +V͘S»hÆ 2Ú Bù#5k? |8>4bQÍÁø°4(üòÚôndînïx†¡¾Êš¶~Ø YhL]pìQ,ÍžR½ ‘ž‚T÷´z°¢è¥Û¯àŒ—Ù¼®-3E«•É*esHðÖóªlªÜ°­6 ¼këu37gWü›•pÝ­…°–½KðjÐsÚ +©¶ˆPq@\ã0´M0ƒ%Ån}ºbê"™#˜ ”)ï™HÄ!& ªëÿOæí',t–Ø_A#=[gF./ðÎA_{vÁç);5´5±Êl6´5©Ð‰ZöГ,¥ž.@Ôä@^n;YøضU M¢U:Ħ@Öœrù÷{È¢]A~ …¦¿¨È ÀËÅfÛâ³gWUžÍ¾_‘ÚÄ*zÎëÓCŒ,³Õ¶NZ¨‡}6Ùc;[Y‰é”·)3ÏRè[“6mÙV×M›ÇúÐ씯«e–wŽ›†tc¡)N‘¿à‚wÊ,ïÊüGg¦w<ìXgÿðêyU§·iÙò+*¡sçc¹uR®ÌxY#Â’M²Yô:ý® íuZß‚NÃ('ô^:>Šršƒ(giÈáFQD5*ÏØaæ`w;mܘMbynÓÒÁz%¥<ªª¥ÙÓõ øÅ°ö”…‡‘rÈšJkz0hÚŸ“8,ã¶<à ÍVk‹z:4ÂŒP €æÓa†á®M>¥#®Þæ¤Ø=Ó˜6££*á_ÀwËsn«9¥iÏôÓXS›Þï·*´%>ÛÛÌvÿ=#±0½=ˆQ±ºBðBEFÙ—®fœ×Í(!»ð!ѽ‡b›Üð=U€ËSSvbI½š‚Ë”&½ãVom+æ›#Éšš™•áZÒQ…yßž멾ývéÇ 6šüuÁ¶¤S/Le0 +]ÄtI$öۀń] ¬ÍºYÒO‚}Ã…™+k/᧢º!/ÒjËf›£ý¢ÐØ/ÒÔuà‚é:¸Xjj> endobj -5964 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 665.485 824.811 678.387] -/Subtype/Link/A<> +/Parent 6392 0 R >> endobj -5963 0 obj << -/D [5961 0 R /XYZ 85.039 781.388 null] +6396 0 obj << +/D [6394 0 R /XYZ 85.039 781.388 null] >> endobj -2070 0 obj << -/D [5961 0 R /XYZ 85.039 584.077 null] +2170 0 obj << +/D [6394 0 R /XYZ 85.039 761.463 null] >> endobj -5965 0 obj << -/D [5961 0 R /XYZ 85.039 562.216 null] +6397 0 obj << +/D [6394 0 R /XYZ 85.039 740.731 null] >> endobj -2074 0 obj << -/D [5961 0 R /XYZ 85.039 289.778 null] +2174 0 obj << +/D [6394 0 R /XYZ 85.039 643.781 null] >> endobj -5966 0 obj << -/D [5961 0 R /XYZ 85.039 269.187 null] +6398 0 obj << +/D [6394 0 R /XYZ 85.039 612.493 null] >> endobj -5960 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F14 2895 0 R /F56 2890 0 R /F66 3242 0 R >> +6393 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5969 0 obj << -/Length 3942 -/Filter /FlateDecode ->> -stream -xÚ­ÙrãÆñ]_¡·€UK,0¸ý¦hyÕ‹ÉÆeû"! -иZý}úšÁ€å‡¤T*ÎÑ3ÓÓÓwÃ?÷àÏ?O#× ²ó$õÝ MÏ×»3ï| 3×g¾@,diÁüuuöñoqxî{næe竧aŸÈ £à|µùÕ¹üñâ~uõób£w±L’ÔyXøÎ/««¿¸ý$…JË˻ޮp tîðîËçËÅÒw>_Açañû꧳«•ÁÌœ XdˆÖg¿þîoà -?yn¥ç¯Ðö\¦wg€—…ô«³‡³˜­x.<çUsTÐK?s3½O©ØwÃ80”RžE)ßWnà«ó$òÜÈ ‰T@å•뙢0s~.¶e#=^¿}’Ä1P:{h{NSV0[ÖÛSD Sx¬à}4BÓæÐTš_Ë}^,C?sð|'äN×ãó½Ut•ç´Và4\¢GìæóG‹ ÀUTâ4U¹õúÏy [Zß}€‰Öñ|•·2…§Ôxæv¸ì‘6£U-C7Oø›:|fßµ:žÉ[³…ï4=ÒH³ôñ‰ùªù¯ÚìpiÞ—Ð^S³ªÕ,®ø ±(ÚŽ:žÄk†YâôÏ …íCgpˆªÙ -Ló›ç£pd e­O*¦; ÷@"˜#òž·|%Dø ³`i².fny»ºlj8?Ü"÷Ýß}`@G*Ù$ñÉ[É`2ßï‰õÌ}åô Cl¡½®Ê‚^¨çuLÊ5Ž<Ó ®- “àîµÞ’ïÅt%pÔô•pó…~x¡öÓãÇ¿_ýr,2 -XÝ÷ãó8Í\«?×$ ­É¼Yê½–ÖfSáR~DªTá¾Ü]^|™ …®móAMöúԢĪP»aåüãçÛ+¦bÞôÞÛrçË3×Z:  ,t”ßéiËuÙWò@§äÊw\zø¥F®ŸÆ£÷_=ƒ²\ð»ü¾d#ã¾Ö8Â2DpxÞ“hÚ)¨Ñz‹לÏ=¯\ç²à9G 4'áÒÎܲlrк©yøÃpg-óip“×zIÜ›+æ;ž'¦Ç#¤4bU´Ù‘¼ ”ä} -$H=Ôy üºž{t›‚;´÷w4mAÏQ qqf ŠïéPqGtµQ€ñ·b²”¾ðPsÐ0"dA -˜£2/«’Õþx]^çÛB¯™S;»œ=Jj]°¹GiG? çŸ*ï‹–›hº'Ì\nfïš9 ÆXcßͺƒ™‹Á¬‡ž?²Æ¨•£ÈsnØü~-kxI0¾¯(ÏûŽ­ÄùÈ?ÿ¾ç_ô]Z¤|óT ïʦÎ+^t¿|´yÈ$%Ìž¸˜»¡ÿ¾ý¶`NÛï(KÝÔKÄ~ã› 7ÂTæf;蜽u=1ÐŽ‡Í_–!4&CcóÄch‚ñwâ¨Ìsö¤FrfÑÞÈm§œÎR,ëMÒš÷B>ÃßÃBŸÙ‚›0å²mÛ È¾ÓB¶ {…rFÒÙìö8?:ó"Ï6^8F¶µi_:Ðð–údõµäâUZ«Glóíl¥•s6Zè©až;¬*X¼@EZ“,§ -b——µ‹~RHx`ábá¹XÁض£Ø½–UÅdåÄüEȦ½ìEr¿_In7öûãV |ä’ø%j>Ð5szY”W]Ê]Xw䞀ˆ®# -;SF"LƼ,Œ‰ó‚Bâ‰ký¸MÇòÈ>5ΗòÀ0ÏZoCÄÓ~ ’3dÍx¤ö£h†ìg"´f8†S4‹°›Þ,É3GÌj0V| lj™Ãžgé`^çûA!k2ËFköaÑ΂òßðà«vä±s» -¹a9ñص%Ÿð@užÙÝ#ÛE¶‚`ZÒÐ7=HN©û^lmÅ@ƒÜndUÿ떭b/¤MõЂa«…æÛè5³ð‹  -™ØRÜo(Ûì -+²(;Ùò‰liœ9¥!Q%SÜÑdr5I7gÒpÿþAøØٵ™͔Õ#q``^Åh6h÷°Iï‚ ë]°ÛŠ"Õd$âçs‡¨Ø›UÞ±Ïá6^jñLdœn‘}l;„q¾*\ñ¼XD°9ø#¨Æ‘"•Çó­`µ¼Z$ äv{´à²ßÈ0F©«Ò1ïc˜‚ê€UL8±TA@ÖÖûÈ:%t®I¦{+ þ%!‹‚åvþ£­ÎšÕMDºýš2 F“æLùÄx‘3Dc(í‡M!»ä}‹zžçø0Ž#­Øù¶@/´-€œXZk;f U3£‡[\ÒŽLÏö¾‹5ZÓ¢Ú ?3ç­ñÀåtÌ |ßW±ÄˆÆ¡óØ"£0𦸂æ9ë*|Ž¾>Åã©o,lŽ¨\Ü -ùy£Û®ã»àR -ÕÓAhq̶ïáé +¢—¾MBv|ϲ^W»aqýa±L‚l a'òj‰à‰ˆ´%ö lö Ò„3Aùðë.õ¨MOÍú°+ê~ŽÉ£ÈUž’M,“Ë:LqS¶ƒ6íyô²Èî¹°=‡õl¥#3Z²mKÃåZ¦È*Pؾôçá¹ÅæÇ  Mdv`ÐR\>}$±·>qo=X®%ƒB9"\ÕRfšô -tÅCOÎP=ϱ”ëa1ˆŸŸ85CäzI2cì3ã¨aæWî?yh‡S0êÃqr¥p@›C:“y üb—¿HdGðlÒP@ËŠW2Ƴ/ׇŠZ3¢Ð5O=»!ÊòýfµX¨³åÚ’f'#ˆf$R•KtèFž*îENØÇFŒÃ{Ò¡ú™Ÿ¹˜&Ì|ä&98¡A*^GS„Þx|ÊÑ’SÃF=8õ›ó3ßM3-”z*·.&Ÿ¦r”(7T¾À²i‡ã CŒcÃnMŠIÅ£TZ|ÉðAxU©IHZ¼tˆn½Ì¹½Z}¹»¾ƒ[èžùv‡Êƒáx3ä Y*hZëoTÆdªª -Ô2;ÈׯüJܱ§“?æ¥VÆ{â“Œx ó†„…mï -Ô$J‘/©<ædR„3H6̆êȹœ/(²š~&w…ƦÁXƒÛÖ3 TÃç¼>3»ˆägƒ+³6nÙDÂD¢ï ã†õÓ ‡v÷”Ó¹ ¼€}¶œ}v—ó‰ŸÈV× —ðS)Lºòó)gßš¯î:Þqàƒ ¯ŸËfâ’¶È7Ýѱ,R—ƒ5w¹¶1órvæŒó';ì ˜áÄ-šsÚö ²éõÝ-à £Pdèb5Z™SÌû¬=\TCB*ZÏöVroäcDÎn(/:ÞÊkX¨G ±§·R¼¨¦XÍV‡Bk±5 K;Øð±J4Oc“8™¯Ú,e1%=~R«çlõwVƒ×÷wâ¥Q<·¬….oÜ#+$N‚µß;¦~~¥Ö“²Ê<¬¸½ãgĶVd#Š$Ô‰ ~µZž ¢ZÔÆpÿÀ®!øÏäà…ž¶jÜ!ç 58w%¼Ècœéâ•vÍ ¹R#a 6ÍJß(òˆr±îKÉ°NÙæÓ‘$´éY-VOBOíuêT -RªéŸm?¦öÚ %K<¡¹<—©çÜL¡³Æ… è´Å~°‡:Vå 5§ƒpõ7H:!>“ÖQ©è5l?üòð/\MÅ õ„„¶‡uT…ñŠ¦4(%Š8rÄ%t=€Ù·ì/u|ºš'1ƒG¬ëñN¦l?@}±˜¡(míê¹°@Û¼¦ªl¬u! ë--Ó*˜1P©•HƒɲÊ#¯ÄÈ«DÔ+ þù€‘?bZÚ›¹g8!ÕÕ=ad6‡ö!è[ígî{T G†AT¢WñÃ!ö¼4©CãüPÊ^¾UAó#KHi"—–~w€èôË5­)ÇÎ!V>Úìˆm 9Ï2~4C…é?aÞ°(ê]­rŠ.˜Í×Þ­ö ½µB÷™¥„"„mÞZ™ íV3œÔè:¯k,OÖ®FJ6`㎓¤‘Ü/²ØùF;àâ9A»ø.±|_ÈÈ·k„M]É ¹lYävÂÈòø†jÄuÏÚC8Œ2g±•ëŠº‚NçbÞ.Qœ[I¢iT’˜J´fRF8Ìþ/4¸îdNÐ=Ðs:­n$ÿ;C,ñ'q®©Ælm8#Nsn™|0ày"&Ø@ÙØÛê~Ͽ챕“ê£çMŠN¡‡ -äKž aÍfëÔžè …é˜R,ßšçÅÀˆ ð¬tl<ŽÅëwJØ* -6PI Ÿ -àxÃhÃ={ÅôÑFƒvò)¼ñ$cÝP(J¥ d·Êÿ¬ÔU„‰'½¡/u¨9)7%!3ÚL-QºÄÝ#>ÄØٌʊ»‘=ÃñÂz/ 9~iÜŽƒBe9¢®‘ävL5;&9ÅØÎ)òOS7Q̵Ÿë®/´åç$«¥H8U.ÞŽv,zÉ?I*U»ücê \s׎œ.½ãÌ=j{«ªqeR£MûAvlv;S)о…þRmMì"‰°”ýl"òLâ!Huª à☴dŸ?V2lg‚(…Ùõ#?ÜÌ×$ôú`å¼²‹nÓLþ> +stream +xÚ­ksÛÆñ»~ûÉÔŒ áp‡WgÒŽk9©“HVcuÜŽã R¨I@ÀÈú÷Ý׎(g’Œf„{ìíííîíë¨f!ü©Y¡Îgi¦e³åî,œm`æ»3% Yx0ÿ¸=»ø6Nf* ò0ŸÝ®BãÄ“$ +±ObfJy£xò00 +ØdÒ W†ÄsÝC{”AyÌTNòŽK¬˜ý2ì&Ï5ƒxm"~8 \¼Ý©ÙedÎ+ŠEñ ‚ }‰ì{ýŒNæ¢4v[·ÍŽýtY,Ñkݳ⥱™ÿ¯:}dUÁVmu‹$ p †Ápßj!¶?n¶ ±Ø~âEͺD^­E;ÜhV žç˜®“Þ7ü¡°¤$Î$à”ï›–âà‘?¹ŽA 1¶¾ÁÄöÊÆÑpe¡½,Ü}„^'ÖÐFWä’|䂲nø‹zëˆÖšKìõ2ËÀ@ˆÕ +aNf¥ê)4„.í{²W8fá;f5m¿Ü÷ÃìøÒ¤ O|¯)ôìÿð,XÉ•ÝÜ™øÀâŽÀiæ6ÖÇarÚJã¤ïáÃÔYª¢žâ`Av*Œ%¨=Dù¢ã¡‡¶\—mY/YpÆó·kžBX@ã,špŠq7 éºnÚ¥lWð‡ßs§Ì(—í§ÜÌÒµGžŽí³ç?1<¸Ä«L2Ä$XAù¤A#Ë<ÆBŠ-NÇ÷/«Ò0°o'¦¿%ƒ.ø +Î&ØÑt‡{±U7Ðá4/8x`h©Ÿ ;Ä8èȳ@§Zp ãÔh&Aùäé},Äs)x;½Ãh$ÓidÓéŽcx†ß þ\ 8_Þ%BßWµŸ)BŠµ!ï³Ïf/q,*H‰›€8·o›-§(7"u¹p.© +¬÷Yð´öSpp¡:‘ù¿Míª‚8³îðÃТëñKqy»ê&öÄÒIn±RÐ\cõÝÚÈ„8"Š>Þ7É óIÅ¿Á'²¤¡:¸8.â"Å(ß-ÓúâN¼W„‘ñ@Š‰ Ll÷†à´¦ÄL~ÝíÅñ=(zaz”Ix$wQŒ‚ƒ£„v•fMˆ”R= +šÕù´P ìY¥¯S¬4.È÷²E‚.‘ryBR»F9‡NÎRô:%k…í1ß$ñ×|•eK¾âª7…çua'´û{‰®‘G}µnxØÁåEÀë0 â$=àõ²!Â1ö¾/¬´™;Îå ) °±¦L½   Â,åH£ö2¸` º¡Ìܱ¿E#‡ß þ\ ñ¬9‚eMÑ–ÜX¹'‹šÎZ¬J 0Ö´x7G«èÒD:D…™¿%©ó¸Ka°sO/.E&”SU™„VA¡‰y¬Žâù‹×ÛÊUp€jØ-]Óa$4ÚÊh=Ê =íçîjÐÔûÕAt7VRhˆ V·ˆê–mõÀñ‚H‰ +&† ‹ÀêÅ8ÙG–{¡æÃŽó˜[.ò ƒÙÑ aì½S©bá¥É3Î&m€²É˜3íbÀ!= ÞKÛ0.°2ˆË@^ȤӵàÄã˜2`Y:-ïc6kÇCíó†­nÒ­ÚñÄþLJ/RÐß e¢ª–HjÁSî¨L!yå,r× ZËhC–Ï‘³5ŒqõÁLEÜ\ˆh¼,˜²l~ré'¸Àª¹ßJÌir¹ûËD•Â+s¥È*~74:£€öq{±q\ß*zÛ’º”÷ž…]Q +¹+Œ +DJgc8k¿/^¹«qe Yõ­àò“û2ÄB.IAæ†f*KR[±STóOã›R¹ªU_È©0“¢F>ÿmÕsç£WžxÉoh'“kõI +Ö:w D<¹2D@…)À.å›|Þ|1³¡›Ã#Œ^®×tr¶¦®(F8jWN\?‡qHÖ +&‡rL4¬qíª±Ê|®=Ë N6d7_bø©‚pÕ¹…Dÿ¾g(bY´Ü­É®"#‡è$®RŸªÃ—œqµ)º´bî{ßȢɮì;hÑ—²Ópíh'*Þ@KtA€ª¯“8×X™U“„ƒÑ0I„×5ÂýjÍrC’akÄÈíFzãŠ,ûfœÚ£j³"5m/U=\ÑNÑphŠU£d‚l8‚“_tS禪mÃ//¾™Èm–ä½7§‘• Oöîå6BV7˜[ªºÓt·_2¾>ë= ú‰'=ˆ‘P¢+”æK›˜ÉN“"•¬ ¾ü¹ð©” ÉdƒØÛïxÎ:¶1œúFiÂ?ø±?åHÓ£÷¿ÓŽX ‹}c(J9šÇ)OLŒ`µ"D˜¢ûÜñ¨ó½ˆâ²áio+º{nõ2Ýøgšñ©ïØâàøQaçïÁ+žÍ[´ +beó¢'ŒÍK/Æ>Œ !ëÍ3–s ,¡<É÷P§UOÞÐá:¡ƒè—~¤— +ÖfWzÊ—Ž¦+zîK=ýs ÃWNÑÎ!Jý—ö½©òbÀPÜmíþ–_ðç2åØ;¹($4SÏ—¡> endobj -5970 0 obj << -/D [5968 0 R /XYZ 85.039 781.388 null] +6402 0 obj << +/D [6400 0 R /XYZ 85.039 781.388 null] >> endobj -2078 0 obj << -/D [5968 0 R /XYZ 85.039 761.463 null] +2178 0 obj << +/D [6400 0 R /XYZ 85.039 639.916 null] >> endobj -5971 0 obj << -/D [5968 0 R /XYZ 85.039 741.337 null] +6403 0 obj << +/D [6400 0 R /XYZ 85.039 607.699 null] >> endobj -2082 0 obj << -/D [5968 0 R /XYZ 85.039 633.349 null] +2182 0 obj << +/D [6400 0 R /XYZ 85.039 607.699 null] >> endobj -5972 0 obj << -/D [5968 0 R /XYZ 85.039 609.367 null] +6404 0 obj << +/D [6400 0 R /XYZ 85.039 573.152 null] >> endobj -2086 0 obj << -/D [5968 0 R /XYZ 85.039 120.748 null] +6405 0 obj << +/D [6400 0 R /XYZ 85.039 435.278 null] >> endobj -5973 0 obj << -/D [5968 0 R /XYZ 85.039 99.547 null] +6406 0 obj << +/D [6400 0 R /XYZ 85.039 381.081 null] >> endobj -5967 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F56 2890 0 R >> +6399 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F38 2997 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5976 0 obj << -/Length 3874 -/Filter /FlateDecode ->> -stream -xÚ¥]sÛ6òÝ¿Bo¥f*š$À¯—›q]7—^bûjår¶°DIl(Q%©&ýHI”3sŒC`±X‹ý†ÂIÿÂIûÊ'iú*Ë&‹íU0YÃÈ›«P0f‚2à|7¿ºþ!Ñ“0ðó ŸÌW=Ø×±šÌ—¿x·ÿ¼yœßý4)¥¼HùÓYšfÞÓ4ô~~šß½gøÍý÷Ò˜F™w{ûðá~Ží=âû··ÓYè½½ƒÎÓô·ùWws·3·&ì"ÇmýqõËoÁd Gøñ*ðUžM>C;ðCÞ^Á¾üX+éWWOWÿv¤xLOxÖt”øQ - øY¦GqÂ0òU«âÀíXÆV…Qì':™X$äUèŸ.TÚÕd@é|9FùÊj*÷ã,>ZíM=E*÷:ûÝ{ hëÀûÍr·„ÿëi”zŸ[F‰‚à ·®ùóßGþn‹ÞÜ÷ýC —Nq›ÅEŸ:3U×t3F Ãj”ù¹ÄŒÊ|ÙñǦ^7fێщC?N¿B'–ñ›å¶Ü•pжkL‡b†?‘‰òæÓY×íÕU+K  X¹Ÿ© ïd''š8Òy-Ò+ª?‹ŽE¼ÛÜxÿþ–„µƒUÍ~Vî¶0UU,GÙø:²\¸Yt%îU%©÷}Ù ¸Ldï ƒ>๊¦åo ·õö:.ŸJHp -úªƒä+RÞ#½"å‚„{Ž.JùkËY)u5+åƒÕž€ý <'±?´ì<î-Ž¼ñCë†ÑêfmðJÊ¿£Ãf½3h¨ã)¿qðýÐDªddü5£>ðÌÏ%ÝöF6Só—·A"°&aùVèdªü6ˆÅtª·¼Þ eX%ÊbÎX!xû‰¡¤ÛYâÕ{ø¦b02á‹šô¶+¾™mÁÂHÊLò©±óŒàÕÏÓY{¿ƒÄÁ^£€Ù†>sž&¦Â ¡Q¯F÷« Ï‚pe&Gâk¹¤(†"Ü A¿‹í¾¶µ ”IyóMáÖ :äE¥etr^8}HÃà'ö|³Üò,pÅ®.€Ñ*ñžy·Ý†1Á/ò¡§¹cZžûíIAü‡ž…–GŽNNô±D6/Y¦1 # CUbŠC3&a߉‰€ t-ˆ°q‘¬É2¨AŠ÷¢¥Â$ÅÁÌ÷™õÜqüBLÙ’ñÄöýÃœ§—â\²ŸÄÖݺ0ÏU1rP³hêÖR£|?×ØÈ8.X2ðŒ0ŽÜ@k §˜sl!v9óðÒž‰{¿¡€€‚ŸÃÂP·†6ûÂØG–ú+°œ§²C#S{ž’¥å‘ó¢ÀØH—T\Á- ä&‡S¤`\˜=ù²¢à äEñŒyæ½í )1¯N+ô™ã ö;YĹ*@oYC­G"*œÃ³t—5¡úa*1§9ƒ³¨ŒÂ9ih¿_ÐJT†z€ $úŒ›z{2 -˜ÊpßG)YJçXÒ¾e»a2D ïH&’$i¨V‘h6 -<%‘ó¥½=]ÙFã@Ëáë#Nîó½s» ¸õJÒ›L$üöOlnj2¤ qæÿ*e†sõÖm£­gÿNZÕ•î*##¢¼-‹ è -1©z’mœ&°]~¬àE_¯@ëÇy2Z9@Î kÒËšnYôc:}¡ÃÌOµrn?`ŠŸ£¤{S 9$º¹á”uûw‹K<>*£ë$ðæäIè:Ïã Út€þ`¸~» 'ß×°ÓÉÑf™îl@˜c”lKÄ ¤õéDçÚBÎÊ梑IÑ•%A‚¶í¨à)Ú¶€[g2„SI†p´÷Ø)Å/#‚aÒœapÌØ.¹>Ößµx\÷² -­ýâ‹D³8#»!JÓ!YìÒ&Œä’Ðv6&…lªuš%3ñ»-Aóû{#˜‘éì¨qKG›(!(þãÃ;tšºh-°]î(~‚–áÏG[ݨ§V±¸SÄàŒüS‰½7€ÿA'ÀÿðqÂ:ÉéÁÉ4άª‘-o\"”çƒP:Ä#ltÌbhIˆÏ3¬›i„6`d̺ZB% p 2|¬ -ci5'FNfÕv%‡v"_hj?•ÝÈÀU"–©Ä¼­Xj3k¶ˆs0`#K¼–#»`¯}-¶°Üõ4¶v}Ì™ÕÒ<Å Wóð7¬ š´0O'3WñüÿM ×RˆÀ£ÐÏrýjYA^¬ãÞ^`î¡}i76à‘Áº°fFÊÇÒ1Ü€÷Þì̺ܭ±”•x7ÄàE}Øu×Z -v’ãT¸ì£–ñʱÊBò×7ÜãŒ$avÃ`•æ²÷ãô83¥r‡Š¤NC*¹è§à!ßVj$ «®Vz`L¬Hó K‘Š!J»µ¬B.5ê 0CD²qe1 ïhmS-.+„<+.í²”C1ÌææÇq”¦X‘È]wd‹×XKuª,ÎÖ>r°;Ì ¸2‡…¢4p•l»HeÁ Êdw,*³è€8j0DÄ,íy°~•Á„| £Š)mŠ3Y?tR1=± -®æ§s[tÐk9'€àCK‚‹pÎþru’åÀñ¸œG‘÷T@d¤JN´Ÿ1({ I6þ-S¡s#´0’}Popx8#Ä>îÜÒ…içg;9>›9N®¤,Sw§måíX„YZ×DI’I]ߢœ%zàq*R¶Q Ki¢Ç ?‰–ú$¶¤ê“¸Œ@æ£Xvõx dš¸Ã]USäìu¶½ÁÓãì?§1d«U¹¤›„Ó/'ä[N »« 4Ó«(0[›ÅÕ‡JR¿S2.…Y_ 9I¨lö™J½¨w"GÀçÏÃ7-Û—–Ó±-÷9êœËP0Ît¼ßn€ùÇ°V Õ[äi/y6æ´—Ïä]óp?ýD;pp`-pœ“cä"D{Ï}ÞVÝoðÅÚ!&/[;K¦Þý|,Êz†h-A–qé¢n>YKÑq¹…Ê QžzT*k¤ -îÌ_–÷æ+ËÏõ )s4 ‘"ŸyIBOvÚ3pdÕÈ#Ž†Ù·ªàc”Âà½!¶ú#§ûyš)ºMâÃn4¿pÓåÅØy–2"Ó%–ö¾(¸B°ÔŲzáyT|ÜÐ}±ûFL¶‚0ÚÖ’#˜l×ÉZh;™›nKW•ð1¹—æóóúb”<´UͺÁ tpî²°“Ä.Bëv+GéÍ Ì2ü©¥z2¼ž sÖ.#P,—] ǶÒ#‘•6F6ZvcÎH ðȱ‡‰N -XXUÐÊ{Æ×@Vü5ŒËKóµ "I€ïŽ£Û}'p'‚Mò¹Ø°G  ¥hër¨ß¯$E2™† xÈ-ÇϬÒÖ,mPk®Äj­ñÙHŠž-ØRa „–rý5÷ÈÀ÷=ýZ‡š§º«ÐOìàÐÏè*(êx¹,¾lv ?JIÑ:ˆHª@ƒ-À{áŽY.]Yl°æ[.Ò›ÅöÙLe,MA"gÙ…ÂÂ:õ†Šø¬ƒóßð+Ïžgù?<…øš.¿´Ápé¥åŸD*³Ïï*åØñ\¼*6}GqŠê_ °ÝK-œt(ÜH„2x*Bzp –âf½02:zÝ_ñË.úã9)§ÂE®¸SGŒóŽÛŽa ­çgíÝy^ìæ ¿÷†bÕ–%}­oä–ÝÜ Ê­87ûž…À]Í_§ôn™$ÃwË(æ_±Dí§ø°]VœC¼sªÌÏûîŽgS´óŠc?”ýÞÉ?Gùð-±µqî²hÌsÕ¿]F‰öu _ƒ–œl¸|ÁØZÜîÍQµžº)ÂP6›Šã*ùE{J£({òlgÒ¢@†\Y)Çå0>ˆZÛKFç-Z”M”Úe)3øV™ Ë ‚¼f‘ s¹½hUˤ2Ò~E$9ù>˜%£P¼‰jµ?¶Ïû³4ŒÔǘc¦ÉPûšj*`ÒÖlöÜ;KZ¹&¤ù­1  |ÞBBâBh¹EæHYëˆý~p®T~±$sY4 å<‹l mՑˤŒT§ÖµŒÕË?ýÉü1+þÖ0]ÍM+?S~÷G‘…v/ôcž <Ýo¬ðG ê|ÃÿáyVçendstream +6409 0 obj << +/Length 3000 +/Filter /FlateDecode +>> +stream +xÚ­ÙrÛFò]_ÁÒK ªÆ¸òæØNâÄV´‰v³)Ç ‘(‘€ B–õ÷ék 2Úò–ÊÖ===}wCjÁšeq™|–f*4Y6[lÏ¢Ù +v~}øÍ–ðŒŸÏ¢ÐäÙìÆQ¨`{{´…±52ßœý~ö/Š÷ìŒOMq"6Ygæ*ž`E…qd‰¯Ë>ö®kîáßòó~ïŠfÎlð†%Õ:æ +!šU[lw VÔKÞ¹,»us1×i€ÿg,ß68±,[_츨ÏÈÉ’nèD)×Á’8nË¢+—!ò ¸Ã8¸^ó Ažoù#îU°´Ùð Q&Є»X k÷J$7Ï‚ ¿(6›'^ij>Ô ¨G°©Ê‚8dU ¹lÀ5ÞÓÍK|ˆÐ¶.kFÝ­ßÎ𴎆•<£ù+RÐFQðWG€­ºå'¼²ypœQ )11f]à3·þeió`[,ñ¦8áª`M—my X¼œ75½Ö"Ÿà Œ»uÿ@…(0›ëàÏ‹ÌàåõXaÄZ$…pÇ‹ŽïE^ݺu¡¹ÃBly‡eî.Žíð–ÚžÇåf#B‡yÓÙasâÇnÝ´Ý|ñÐíPƒÓ!YiÔ Æ,Täq¯ö&oL€“¥£qU:2@KjQbvã06¬%ÿÚñêÉFÝ{D¶nÍ’‘{­²hÁãžÆÔÜö`‡/¿'SõôXM7Wm¹èš–D |Ø üeBšn•Ü +ð¢”ì²áýŦ*½Êk‚®¸«ð-+>æ™ +ãº|ħ²±v|~d¬Ã.6PVøú9ƒÈX?ä¶m¶ SmwBÜ´ß]o½EnE™7šˆ;Êzwys‰Fí©}ÁË¢õRÖ¨7(X{b@âkäÌÄŒb‹7Þ²ÄzÅT´ÈWeFPé˜tQJ­ÊŽŒ„äÞîzª‘y‡¬òo‹MðjF-š™±"’ñé ÿ‚¿=¦ïÝ!„El$ùË:½7FÕ^¹!‹XÖÐîIuâ$(ä–ªãßE×¹7oï;Ùì>¼eg±’{úèß<Î Çêˆy´å¶éJt®ÙÈTÀÇ%I|_”*Ž™Å iuâ™J'q ‹ZÜ)N¼çhI8¸Ô–÷D6«½‹C¸sƒÞG’Þ ™G¤„0(%üý‚!EJ8ÜŠ± áuùí'Æäy‡œKNƒ_¾ý/¼ÆóôÞ…V~ ©Úíª¦Þ1@/‹dàøøÀŽèºçͶZ­½ƒƒ¬=ɈŒ=¯+Ϋ±‡AÕâc´²ç8Qí=À<¥;´Í”m²“±ms-:hN4BùÍ ñn+ÂÃEŸë8/ªãlõÞËñ:5ã Àh´¥¸Až’þàÀ§*øfÇ·l8eóþÁ–åŽCAÊêQÒš ië‘*Ö¬¼é•cØCÐå‘o#gW¡Ø•fC0㌥æI]~éx$IŒªšÜe6p—OŒrœ¨ä™‚œùàŠB·žxT´¥¿kå¤xdJ¼u~ÛŒèd±v×MùÝj[ž‡Gꛫ0Iãg +³ùx²pÀûÀeGñЩððˆÁÓ=<¾Ò2& +£$õåEbgJ…9¦œ·³< +­ÊS¨E4—à¨Ø}[“êÕþcåˆÉãòD;û/É•ÅRczBÿ4Zxñvkf¯ u6 WÐÎx¹ÊÕÒ9qØÆ:ÌMô~_Þ’r¢À-&Jå† ÈIÝRZC»“1ð'è¤p“°Á6öΈq>ñò¦ÚQ €c@;>såÇ+9ß²+=ŠÃª‘TÚUz~AÏ©¼èë3Ž´^¹ 鯋M®ˆ"l½6#ÔfÎaÿݧÿ¼{S,îîyLU.mErEs»_]˜›aâY1ÒëR²+_ÖEspâ½®Åâ(3–,Fk¤æ³$ÌRÄƆeºK@h•ˆ…4´å8ß|öácxv?iEaù sÉ]€™Or}µ¤ª©æéî‰/À¹ËˆøY@ _#^bù~ ÇtÄŠ¥ÕÀ6H¿t4¶N"ÏÖeŽ×Oˆ ã¯6œËW|Ä6ͦèô^Â×/G-©s ñÕ§Š{Ý¥ó©Lö|'Ñqææ¬áœ§…ëNÀø\Þ·ÂWP7 .õ-«eßj,ì `[2Ê&³AlüŠH‹á\ÁòÜ7û¾*üªTìžê< m~¤e{&53ƒ¼UPQfq6`:¸ÍÁœ¾N)¥G÷‘ňŽ"42+cÆ ÌÙ=šà¡æÆÏØÎ`ðaøJóžË»Ý#%ÐíR–©¶bEIÞGYÆI·ºÓaKÀÒÑ0`f*—Tî:´ˆ=ÒÞ›T'.öKuªB{ZŒâ¸ oÑÇExôž^€Ç/òâó7µ’"‹èùl’… ¢y$µøª\V]HæúeŠ[ 9,DƒÎ6¡E¾ -åLsÇÍf’áwÍ# Ò˜QÝöÓ/ØÄÿó€+65rßÚÐD꟭D™N÷ðç×|€l‚ƒ’gä !qï~}õòÝiYû"MpýiU'Ö I{OŸA^ýôöòÍDÚ›ÐfñAêËÿ S>‘XZ&yú|„¯¨Í2hãþÃTÙbSb* Öaœþ_ *ñw•yàáÒP±¥øÏ}}žYL%0žóOK_§Tºgfø=Ÿà«Î1,µ×¥•±Ó¹%O‰;RXPËÁec˜ÂÙKjé,öqLJf$ÑÙÀ#ÊUÇ“{OQóüNºœÊ.d‹'z&²Ü˜ªQ´íóEóx؛ЧhP8<é¨ó2U§XðÅÏGÇ¥ÊÖÕ(Üg¦¼.2TzvÂi› çé/\ ¾5 ’lØ¡.uËc¾-?=TmŸû²CÏ”$‰ ®è'¿TÝ^`e[U>R·®:2}š]uMûñX€S&þÎ;€9ä kŽ†¹S·ù@wò:ê†÷±ñ-wÂQá/sÿ È]j¼Á8¼Ânî;ž@6BüsÙÈ|1lÚ®hÐvÕYêšP£ &‹|äaª’¯²!ÂNY/ÿZ××yÌ}‚ïœø: †Ñ¸Š®ºcúIµNNjƒ‡8ª ÷Ø£špü¯'.rZÐß¹¡¤¨üɳ_î;ÉS§¯+°ÿBþÂ@ kòó…:š'&Y¨ ½:Å·ä(ãßå܉«<ëNÝåx7¸lú„Õ}dÂ//‡‘ !¨ý¦ÅWâÂø3¬[á–šæ8ÅmuÙ•¯T€R.ÚJâÔ’Š)C ¹èÆ~“MÙƒ{{t~Où¼Ò5IʘApß¿¼äE_–I Ø/÷ +wXòpYsç\ +Ä‹_$ØáÜÉ_,PQ%Å–Ÿ¸ÿ³<¦…P ë|J3à¿ö«þÆ«2䃙ɧÕ+†|A+G …íÓëþnæ€à¿>E¢Ìendstream endobj -5975 0 obj << +6408 0 obj << /Type /Page -/Contents 5976 0 R -/Resources 5974 0 R +/Contents 6409 0 R +/Resources 6407 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5983 0 R ->> endobj -5977 0 obj << -/D [5975 0 R /XYZ 85.039 781.388 null] +/Parent 6392 0 R >> endobj -5978 0 obj << -/D [5975 0 R /XYZ 85.039 761.463 null] +6410 0 obj << +/D [6408 0 R /XYZ 85.039 781.388 null] >> endobj -5979 0 obj << -/D [5975 0 R /XYZ 85.039 734.834 null] +6411 0 obj << +/D [6408 0 R /XYZ 85.039 321.225 null] >> endobj -5980 0 obj << -/D [5975 0 R /XYZ 85.039 707.735 null] +6412 0 obj << +/D [6408 0 R /XYZ 85.039 295.771 null] >> endobj -5981 0 obj << -/D [5975 0 R /XYZ 85.039 680.637 null] +6413 0 obj << +/D [6408 0 R /XYZ 85.039 160.279 null] >> endobj -2090 0 obj << -/D [5975 0 R /XYZ 85.039 396.451 null] +6414 0 obj << +/D [6408 0 R /XYZ 85.039 122.359 null] >> endobj -5982 0 obj << -/D [5975 0 R /XYZ 85.039 370.305 null] +6415 0 obj << +/D [6408 0 R /XYZ 85.039 92.533 null] >> endobj -5974 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F11 2898 0 R /F72 3966 0 R /F18 3969 0 R /F66 3242 0 R >> -/XObject << /Im1 3957 0 R >> +6407 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R /F20 2961 0 R /F62 4047 0 R >> +/XObject << /Im3 4353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5986 0 obj << -/Length 3253 +6418 0 obj << +/Length 2914 /Filter /FlateDecode >> stream -xÚ¥ZYsÛF~ׯ`å ¬2aƒËoZJqœ²d­E—w+ÉH@Ö À då×o_€$§”JÅ zfúšî¯²gügÏBÏ´Üh„¶é†ál³»°f[xóþŠ…,z4ÿZ]¼ýÙW3Û2#+š­º}~Xζñáîç¬~½¸^µœµg²õçÅoX³DøõÂ2Ý(œ=ÃØ2mx½»¾LO¹òœ_Ü_ü»ÝŠß©¯҂熦ºçj°½žlÛ1]Û™žez–"=ê´š/74v(K\€,ñ6ÅñŽþ-æNd4L¢'Bã)ºª,v)=Êû®Nô†7÷üûi‹þ)çN`<×8·+õÖ±¬ïoÿs‡çy‰›i‚=ü|¦ìH{0ŸY -é6*'"abXé:¾ñŒç¤yŽO^;‹û Ï‚à²3ÑlðaS´¸¸ Jkœm*86Û4YYÈNMÉ«Ö¼#OÆ{ Ûç(,íŒÌ‚[)åKfzW¼îxcâ²nÿG´‚pW逨•>çOÄ ù û«—à“cdÅ&?$š¾~wꪭ_X¾úƒæØfh‡0ò>ÛU¦Î×­p>7õÚCPˆå–TÿRУê1ÞüÈ…ß×óÖ[?Λ&BÞîP¡qM†zÆqY% ¶äÐÛQVƒÈ üèõ¬vë'X¢–Õ´ÚeM“ -=Í’§ bÜÚ°Ó7s¾BD°ç‡ûòHR¡g"aY€/ èû¦ã¼^¾vù„xLƒÒ]nè†è`ƒl7Èô Þ¹öÂìï–g},i†–Å9Ï—ÿ¾‡y¹Žs ´GôÓì×KØ­ŸQˆPÆ/]0?gÛGnëH^ñ]Ït`—©œØ£!6xk›‘çõ“ÉOyìó0„Lh6Ä-ϳŒûx·Ž'ß7®“¬©Ò->Æja0_¸–Qæµ,Í« 3Ûu§YíhÆó–o9:8_qÝTÙZ§ t[öi’s„n.Ð< -,(Òß-[5Úßû·?{~ÿ`/2­™Å#SP[ Þ2ùŸÊ¦SÇ…DßGNj| e ‰áÆQ›‡h%&ÕÖ£·°¸¦ïÙGvÄÂ’›Ë9˜ó.Z1Žmprã-°Lßw¦yëhÆMê´±@çÈÛ - ä(›”„7¯åùs!Žv1êò…Úì‹]Æs”Å;À,GD%hë-¥ZàpŽå„¨gxï6 Ô< žA{ê½ðbRHÍ…à ÐNó* úQ¨a }È äFŸdóT@í[ì:œE   ™}Ljb%Ü»`7RLõ…®œÈ¸Aç/ËÉó…@Ø3)wûë7¼ºÚ qð c”t',?Ãà=‰{؈A‰¨$DÚB4âØâc¸;% -§:Šn&ÝGÇ1ZÙ¶YÝT´Æê ­£m0´CJ“ÆuÌô{Šœ–e|)’T¨nŒÓT'· k'Ò„ÿà(pºç©ñî -åZŽq#›LrÓÑŒ‡JÙܳ8û}ÍHÝp¾ç1ÿGh µ<^Ñ-Ç1Ô:tTež§^C/œÔEŠ Êã‹Ù ¿8…MwÐC¬þ,ð—&0:âïA{[*”ñlÃyð«³+'>FF_( K>ucÙ¥çôuC<$)W2§9[A™8’…ëÝRðz#J©Ÿ“¬íÛ¦eë¬ýf`ÇÀô-_Þï1pÉš~ ÀÀuá6 ä}‘ma¦…s‹ -™Íl ør¬qc¹À =- ø2N¼¨á8Ùe„.&Xÿ8¦@Ôˆ9G›ÃayÈå2[VÍã„É8ìÀðì»CÍ3ÚÅp|œ˜i¦çøÌ©¶^w‚ —Øi·_Lè«y Ë”€õÝ9>Œ€ÅX qƒÐT¶?yµ{4m Q¦«üþÕv}ËT¡«Â£ ¿Ôœ~”Ý7ñÜ¥ -béaÏ“¬|DýqÅOwU)¡‰ÎO·–Ò,‡­O8~J«§ îþˆ€øY4Ü{4ã±Ëu}€÷vó0ÃÑuχ,f©¸i8_¢— :GRô|™”dqru ,ljµKr°„R¡œÆ0…¿ûªo´ W5…–­,Òµ¯3V Ô2›a™ölª¾KJ—ÜùÒÇ ðù}݇Y0Ý^ömñ|)y¥¦p¹¥¿û¸’W‡©ÊÑpNIogstŽÑ¾kAúQÃfÖ4‹Ñ€Ïô!j"Tˆ}vm¤<ž•ÖQf þ´Ýú i…ˆ›„ÒÊ¡Ô ˜‡J @H›²À†fãCEšéWt”Û‹eûJùaû.f-f›xåTÒux7_¶Ý¹PN™Çâ­²¶–YnÃPŒ8¿Èeµ¥„‘ýE¬é°OÅTּ᧴¡H`2`wŽ±ú­xvÂçvû£ÏC•¾¿T¶Ñð!Þèæ¤x7µxI0ú;ÃAò ªã¤Íksâ+çÞ#0¾ïw{Î[¤G†S|zbŽe%;„T`ÙÓY©G4ž•4jÑËJ“ÇIVš>M.Eÿ´ëïmÔ8ÈÁãØÃ険ÍBƒ`1jÍ(\¶×]mÌXìPîOÒâFÖ/ÅíðÈ}Çò |Ý‹îIú3Bá~Û˜ú °óõwDê"TˆUÿÔqZý“§iõ÷N»d‰¿µüE\8®t’”µÚ.Ò-!w‡€âJÄ?7Ö±óîëZhÙTùâ2oWi>­d¨µ,ëGJîˆ&”,D(¶7ªä©ã´’'OÓJîÖ}êR⪅J½¿6Èb.õöñ㧹¡7'_Ž›#ˆåø½æ7îËuÆø<å™Lv<>ø -mÐÎIÀ/’š_r÷)ÇÍmœ— 9Ô‚m¸Þ#ƦíêD 2õ»vDv"<ÞµëÔqÚ®“§i»öN»D‡Vv[w·ØRi¤Koø·÷©ž:Ĩœ®â§—5•"º=S0$…DÜ~þ¢nóM¯ÍÙÿ„Òî—¤½¿)¡zLT0£-Š›¡–ºDÕSôÐÁhWʲ -êÞ‘›6Œâa¿qZþ«1Roý8FÒD(Ô긫¡¬:ú››N6n¼ìöIö®Þ´ Pú¡«9j§ŽË—cü½ç0™µ<®48í«Œh.ŒLÇ{½âºåãzþÓŽTÖ\`ÓÁw tòÁR¾ßœÂ )é!ùÝ×GåS—¢‘!Ìã×ùéI¡>i0$Á¼.ì9ÐnSž-‡º›ŸSÝjËcZƒ¡ÿdÁ1A]¯Vq·|\ÅBÓSñ&nÎj°~—ë²W±ãóYíÅ÷²iý;kwZP' Iÿ³ÊþÑŸñuŸ{\3tGþ¾ÇsÓ±5/A-ç”_ýç~g ÿÒð„3endstream +xÚ­ZKsÛ8¾ûWø¶TÕˆøfn^'™d6v¼±¦2[3s %Zâš"5$Ûÿ~û2)îa·R‰@°nôãëF3ú\Á}ž„®òÓó8Ñ®Ÿ$çëý™:ß›ŸÏ´P,…d9 ùûêìâckå¦*=_=ôû„núç«ÍïÎÕ§ËÛÕ‡o‹¥ïûŽ¸‹e'Îû íÜýþY-–Úù +ƒ[&¹ý¶ðçëÇÏ_>ðÄõåÍ%Ný 4®qÝÍjñçê—³++å ’¤(Ú_g¿ÿ©Î7pŒ_Δë§Éù3Œ•«áõþ dsÃÀ—çòìîìŸv+~œóª)M„~↉?V…'T*7T©âóœ( ¬„C”<ÎËóÓCVà+šúi± ´rp¢Z7y6¤£q¶GµÜgkyr³ ÷Ú¹‡ÁÓ–'ËÚ ÌÛ¸ŠØâtWóïýbéÅLÐ!Á3QËŠ)|¾‚6<ÖJ„N^ðOÝàoà4OxYË?˜ÉÖ à÷H\:4'èv©Qõ)éªk²5Öˆ¼©· œ—‚»Ò;žDõ qÞírPVɳ l}ñ1ò–Ñ‘ïF*†È¨Ê»}]¹tÒ—œÉ y0ÒBý“p«6<@­‚áõ#Ï<ÐÁa7îs’¹Í¶¤ÑÖ¥/=/ßH`»*M­:t^Q3õ>Î.çb’@G ¾5IܶüŒfÄe`Zñ½¨6$™yòû›Upá)õÂOìR oÜ -}ðˆñ”Š©þP:@´Ýp•< =® ÙVaÝCDÃíÎL¶‚`<}È:! 4YA!IÎCé 1âÈÒ¤üŘˆ¤PW˜Œó†_’¶9Š•]Ñ'FŒ#TÁ¸+P²ì¾(gÃTdœ$WG|eàa`Å·½-óöˆN±Ø c¨)|0|€ßj‡ûˆL­œú©ÜLFo4°ÂS¥ìP5?½ã_®5bÌ~^ +©“'±àáPªXüAÅ;íŽ WÊã€u Š Ó«ˆbg×uõo0‹ƒâQ@" #v ®òg>ÇÀÒ˜OÏö›LÇö=öŽ´w÷ ðP\ñÊ3ƘAà± 8¤ÈœcØ€#Â…A_õ…á¸Á·›ÂÖ“krÇ$ ËCe=Qlà +‹_ø€¢°_È&-3Ú×08Ö¸%àÐGu4¤/üî‚®¥ô\†*v>w=÷NØŽ•}yÀä^¦Ô`÷÷YG® ©M?ø¢îo\M‹é)ôè:ð5t®‡O<›:ïóö±«D«ÎŽ»þ*Jÿn8p·»Ž’IÇ»\s¶x’=é:\nñŽmSN‹p¬0Œ'’Ó±1•Ï%;_‰mÅé_µ`\J BVñ0cªA5è+21¸Á D˜A5èòÊÖcl‘$γFXRWC «:#‡4”¯—Å;Žm"Í´Ž" Ø´“à: f4,Xm{7jB°~j÷)Œ·ò•)¨¬x”ª­šJüÿ¢j-*®aÑ,Tæülü +Çw¯m—ïy|…45ólê’w¹]3䥬eoÂ!å‹ú ¥Îd¼ÄÖÓ²f\Þ‡žáS­´w¼˜šU¿ì¯?ìå¸á¬öÊJN¿š°Â'Ê¡¾r›À Æ"—w˜KCšüçEܘ#Ùj~·ÎÙ½¹A඼-nØÿlù…´AphA×Ó^Í íò|ß6¢YB® E j¼—± ŽGÄÉÛ Xp¬îJ©í+iT©†€ + Ñr®¥¸ªO¤©R6Ôaœ•VEð4*Ih¶ãKŒš¼êÛB~˜ûžõUä1y€õJÒÉöcêk_ÞYe°]qé:V‚\.×ÒÌãxÜ3&gRa÷Ðv¡NßØXZ÷­Yx" %£ãÄÛÄ—2`GªØVYBÄ(õ¥ J´™s {K"`uOžd¥)KBÛ0S—ê²(ìo0™ñ¾”z­˜‚{F½Ò_é¯/oNõn°Ô zkƒ hNönH·sˆâÔý<î›`_³>jnê}VHv’ËTöún¢²³½éQ#‡>?Ôé%÷øÉUËÒÖlÚywÂR.›©ÍZj@3¶Tš¸>\ Š¦GŽ¬á¦˜„É,7C3ÏNkðXíñûB_pŽŽÔÐíäs²î?W$n”š_¾^!Z¢Š¾L|Ú´ å´Â7öÒ„(P´]#@p*˜µï»‰7ÿq@sZáBCÁ|Zá3Üz…ϱ³ +ðûF÷Û^CÏŸŽ¬ ÎMJ=†£ÄMÑêõ+ãÊU½?>§näëùoç–ä¤N…Y'U:ÃÊjtŽ—Qè€Ù]ïcC÷æ«Ì›*è¿N¢ÎŸº*¦û-ÅÕº®†ß.¹Îõ¦:4gd¦-QWüýÇô&ÔznèÏêINª_HP#áIõÏ°²êŸãeÔ?`6ãÎÒ„ë]×ñ·¤7ÞÆn¿ð© Œ¾Z¤˜h§5æ+w:,á/—wÿÓ¤°jZý¡zžëi# I0²°ù#ÿµ'2ìendstream endobj -5985 0 obj << +6417 0 obj << /Type /Page -/Contents 5986 0 R -/Resources 5984 0 R +/Contents 6418 0 R +/Resources 6416 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5983 0 R ->> endobj -5987 0 obj << -/D [5985 0 R /XYZ 85.039 781.388 null] ->> endobj -2094 0 obj << -/D [5985 0 R /XYZ 85.039 635.285 null] ->> endobj -5988 0 obj << -/D [5985 0 R /XYZ 85.039 614.088 null] ->> endobj -2098 0 obj << -/D [5985 0 R /XYZ 85.039 585.477 null] ->> endobj -5989 0 obj << -/D [5985 0 R /XYZ 85.039 563.616 null] +/Parent 6392 0 R >> endobj -2102 0 obj << -/D [5985 0 R /XYZ 85.039 470.045 null] +6419 0 obj << +/D [6417 0 R /XYZ 85.039 781.388 null] >> endobj -5990 0 obj << -/D [5985 0 R /XYZ 85.039 449.052 null] +2186 0 obj << +/D [6417 0 R /XYZ 85.039 651.823 null] >> endobj -2106 0 obj << -/D [5985 0 R /XYZ 85.039 378.416 null] +6420 0 obj << +/D [6417 0 R /XYZ 85.039 619.8 null] >> endobj -5991 0 obj << -/D [5985 0 R /XYZ 85.039 346.89 null] +2190 0 obj << +/D [6417 0 R /XYZ 85.039 263.684 null] >> endobj -5992 0 obj << -/D [5985 0 R /XYZ 85.039 317.471 null] +6421 0 obj << +/D [6417 0 R /XYZ 85.039 228.934 null] >> endobj -5993 0 obj << -/D [5985 0 R /XYZ 85.039 289.767 null] +6422 0 obj << +/D [6417 0 R /XYZ 85.039 188.025 null] >> endobj -5994 0 obj << -/D [5985 0 R /XYZ 85.039 195.529 null] +6423 0 obj << +/D [6417 0 R /XYZ 85.039 158.805 null] >> endobj -5995 0 obj << -/D [5985 0 R /XYZ 85.039 181.373 null] +6424 0 obj << +/D [6417 0 R /XYZ 85.039 131.707 null] >> endobj -5996 0 obj << -/D [5985 0 R /XYZ 85.039 167.824 null] +6425 0 obj << +/D [6417 0 R /XYZ 85.039 106.729 null] >> endobj -5997 0 obj << -/D [5985 0 R /XYZ 85.039 140.726 null] +6426 0 obj << +/D [6417 0 R /XYZ 85.039 76.904 null] >> endobj -5984 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R >> +6416 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6000 0 obj << -/Length 2003 +6429 0 obj << +/Length 2662 /Filter /FlateDecode >> stream -xÚ¥XKsãF¾ëWè¶TUÄa³Ùd3—-¯í8“±X)o*›-Ñ23©%©õèßï IqlJ9lMÙ4€ÆãZjàŸšZã:&VùÚÚér; ¦kìÜL”£˜;’ù€æ‹É‡âhª? ÒéâùÈÇø‘ÑÓÅêwïòÇ‹ûÅõ/³¹ÖÚ µ?›'‰õfÊûíaqýYÖ/n¯Ü`Zïòòî×Û-DÞ=ï>}¼œÍ•÷ñ“‡Ù‹Ÿ&׋^³^&´HI­ÿL~ÿ#˜®p…Ÿ&¯S;}Å8ð¶·èå›H»ùfò0ù¹g%{ÑTNYëb1|k£1eÁÃ`8v^ë+ +šÀ7AÔ[Q™U 5¬™vDdƳF Ò¾À¹Œ7EӊݪgùÞ°½ér&‘gå:_ÁòQy·•Pîj °¿$Ëæ ýmŠr-›E#ß2Ïic%"i Û,-ôÊʉIY ºuÂë)¥B_«pšèØO7£™ˆF,?ŽâžY(y/OGdì³â„ä/¤éTü1ökÃ÷¬É†)¢a[mŠeÁ«°^h/«s7ØÁ»M‘¯dþŒi]mer±l‹ÿÒy&VÞ6‹:g¿´UÙafµGî c¸¯eßcªoñ’÷Bºû2ïX’Žˆ€ìµ´zرçEÕÓ^B²FAü^:ñ’#"»Ù“^:'®óÒYi—Ò>U몄¥bë5ËÎÅ®mdMFƒz_rÀÎm”z·ù+­¦0–ò*>Ò¹2ü'ÍäÓJÎ }Gó«Ç}7››@y›“ªÀ¸&.é»ØÚf”NëÄ{ê|i„ØS›8WR$ñnÖt‰IS–€ï 1¯ö;™uщ5–ì8W`mŒ÷§ÓxÆqKRþ˜à¥ ^厡܃ü+Ë[îÛ&ÐFs(çëD)ߥǠº*Y§fsÕ¡Ñ"¬j$27²-Œà…#zY”F­7öm¶/¹#«÷dQî›9 «ê-å_‹rÅž…ÀWâ|2bú‰±çS`@t::"2Iz*Ίs)p^šK¡4 ™: V¡––tý6¯ ‹2)BG…†¾=èƒh[HÄáà3‡ÖVhÚŽù ïïÜÉÂ}É]µ”–܉£*” ŸÆaqÌš0ãl$z²-{"/šÔ[UÛŒ‹1é¦øâ’OÇÄ(mIPaåJè+YÚf}DâN²F¬šCÓe_z{<"h)èNÁ³Úa»£{2¸¿¿@Ö"¸åcí|¿ûNV.áŠüFÎ0È!„R¢8VáÐñîs…vʱ²ë¤X'~ ÒÉæn@ÃÑb7ò5˜¢«ËŠPù¡•èÖ¸×õ.«í–4!ÿ#¯k4:ðêæ”>ŽÍY}Ž4#Ñîô1)ʲè:mDá&k{ÛaC³zÚôî&ƒ+‡²Rˆzè¥A=uLWG–Š‰W+´m%_J¡"[—RG€¯Ž—‹ÔdX¥ÌmU;¢·ì[!ï÷aV1¼xFÕ‰<‡¯ ZtŒÏ©¹9bW“u×Åa¡ÚôFAq븃mU6m cºeTß„ -Õ¨XÊzÑpÈï»sÍ©°4q|6Ü~ŽJZ°û 1уpT•c„ƒV]8$.¯È7Òñêýß¹•½G&§?5-9¥2Ê…ójiÎD®†¾‰¸ð磩Øì®Å  ÜI­]l¤™'üêÆm~ÍDzaEc.Œt?èodG‰oÓÚry®ÊçbíïLúš1ÞHF9JDbä"ƒ4á^% -P2¡àqÑŠp‚iš»ç -3‡'Ì‘´qâxß^“Ú P~º»¹ÃçvL›6ë´i^RxŠ%ÊBûMB|$&îõC®Æ›s›­rY-)’)†[é¼Î;ììê qã[‘cj?®ÃÀø_÷Âä¾–ô¦µ-;bIÎyáÂ#%¸·–Óó%?éŸ{i¸4H™ªü›ƒlKÕtª-Åsb¼‹÷Ýâ+C^ý¥G–4`‡q«HS…®®àþ§VvŸöNt*o7zZI¬È;ä¯{ÜÚ~‘ŒëúAv7ÕñXËž”ËN™ÓT`a·æ‡É*wú²½±÷ýG8¶6 æžÛ¡ÛE/;dð0åþPy‰87r½àôx¤ß'(áÞGI]œŽ5Òp³ô¦{ûÑš<-u·Ï » -_·Ù“£§UWfZ²;3ï -1’—‡kXAàø§_åûAx|–X£¡´ê¨Ï’±õbxïGΕ”~­ ¹VD41Ä–Ö ø*£²Nn é“Ë+H]ÉΖzI4Ú4Õx¯Zï7z!…˜¦Ì…:fgÓʾáGkâr£Ó$’ÁMÍÉ·Úþ‘}‰k®µôìh¦ÌŸ¾ÀF.üQÐS€–Èr·Íùz¬x«QÀ }t€y»¸ȼ¿û4.‰öCôO¤*ÌH݉,ºo#›”‘²®•îtªêúX…eý™ž0DZø6T±¯3ă›iïšÊÏü“ß:ÊtŸVˆÑÏFèe¥]?Y´u€kŽÕ?üŸü_¿ÃõU4Ò¾Õ'Š¨ C?T.tsè·úmñ"Òïþ¿ÛâSendstream +xÚµZ_sÛ6÷§ÐÜK¨™!óÒqc§ç¦±}±:i§í-ÉÇ©ŠTTûÛÅ$(‘L¦½›NLX`‹ýóÛUƒ‰ÿ2_$“XL(5Yl/üÉf~¸ ÅÌÌšïçoÞ‡Ñ$ðYâ'“ùS»OÈd(&óåoÞ»_Þϯ?MgBK6űò®®§÷ðþ̧³À»ƒ—{"¹ÿ4åÊ»{óÓ5 |¼¼½Ä¡€æú#®»Oÿ˜ÿxq=o¤kø‚$ ŠöçÅoø“%ãÇ Ÿ‰DMŽð·  ¥0ßùÅÃÅš­hNNhUŸ&,ÅLøL)9®­Ðg¡/m¡£­D1‹‰¥AmEìôh1ª‰³Ó7K3Î.8ïð»)HÉõôºBÞoÞsßY$8“´¡©ï§¨öxc[ Ïêzµ„õQìÕ%=•Ù¤ÃY)æÇfÇéŒÇ^9…?Á¯‘¿ôy¶ÀK~&qÊF¬>™g1Wf¿w›´X÷1•p;ÒR=€W]—2.˜ô£ñËli†/ÓÐ Óxø2G¸µ—9Æ®¹L‡ß;W‰‘QbdïV¿¿ú . +HJC“ÁTñ/zO÷«ÔY‘Öô‘gU]Ùq³ÍM ÕÌ6YÑn_¤ÛN½¦ÏãfedxAÒò€¡·@’Y/Ð Œ(FÊÀÛÛýb-žãˆSøçæx;mIzIŠõÍpÍP+ã°C2î¥d`•¦Ë-EY;1HPR†¨ËŽ|®MZù¤·,·ifÇKz7t ›Ö„õËn_þîO`Vo‘ìPÕôõhƒéB+iUáß*{4«P¼S“2†E1SüzðJ0.xoð B d8¸^äÃ6ôf¨»»Ì¬L³PÅ,Š’Æ„# ò²¯M&<”@DÙⶤ7Á¨{PCî+–-áäÏIÀ|™$‚hœw-{,=ðæfL®JtÒ–ö9“¿)×߈%2žDàoõש’dÒÜ?±N(Vúº–ô¥mžy¹¦mLðÌžè‰V$8og:fIk:fú±Zß»^¿…¡(®#ck¬@¸(‹b¥Íª6L«·ç~su÷ñòæ–â© Üx +FE&žOkr;JŠ˜ˆ„!Ù—t‚º àW*mÔGðÏ~‰BKð‡œ04Ç)çÏŒ^&!Ø]4qìëï[«€|¢äs\–ü3‚3iŸa<žNÂ0ÃÇ–ªÓ‰³Óp:eg=Öå7Ÿ*ˆztqðŸñ:V¸&õ}…¶EºKó6P–On°Õ&¬óÆš†Uã-šؼÐ{ZÐKÑîgÂùja‚ç+‡_´x{C¼z5êCÀ4aò•»ii†ïÆР®’á»áÖÞÍ»æn~mª?‡G`z*NŒÞ}èFcŒ”<·wù`óãW%¥º ér áʪ?EY½ûP$ãÕ…CÓ£wΈ7–“ƒŠa×*~Œ_£x‡á­IÇÔ*[„J鮂EÂêþî¹ïf)'Á)híŒÅ^«9­[wYW¨ÆeÓÚš ¯(·Ú/ÓÚ8¤¹NPO˜ïºêñ)ãʺ¤I@“¢h7ƒIm.GúÞ¤ÈêKD$3”)Qð¼‰.?á´©c~ÍÂÕRCC7j(%R.Ö'èKϤq=¦¤øˆ»uN@›4ï¨ÑÀ°žúB˜ì‚ j«óé°ýK! =ªo(O,ÐÂÿ'B³þ& –å\ô´Äg2¹¹Ï8„Œ¯à3C-b 8!ùŸÁ3³íÌÙ·qFq8XiJõg4ƒ%V«"VÞ-Ê<‡¡7üŽ$Æ4àE'|ÑI +h·i±Ô>@ðã…fwSž˜DGP¼"ê'¢Z´cI »ú¶ÿø@Ïk\ð×¼íuåB1™è#TµvôŽt}’I¡ðhc/‰›'Äc6þcs6ȳ«hhI¢>×åÎÂ2<õÁNü¯ˆAã\(ìc¾DdŽAý}ëDüø›Ù˜Ã8¦0ËŽ©Ÿ6®ÁEIùŸ3°‚™Ž`é¦Í}ÿ‚ª8öÀ´„³l±¢‰{ü„ǽÅ3‘€‚àq0š šAbit&L„cÜšD8ÊÎ&B—ß|“¡BõÌkJ‹Ã^7‰,šƒ *ŒWMY­B(”Ž4§Óvi‹¨Nü0¦v.éݘJr“›ð¥a/99cVüÅæÎ~ÉRzI‰`­] 8HU] Pâ…¦uþ¢¹K*×pĦM¤¸Êö¶ƒ @AÒ5âi(‡4'Û +/ÓþûV¼Óf½ÝixV|~àweaòßú°×@QàyM0RáYMžÖ„¶x¹$x‘U5l›Ù3q¸§9–ÓÚn¶»Üb4¬s®Ôà<”ßÎöáņ¯zµíÙPH&|ñõý,ÉÏ•iTäÒ»wÐKŸ¸3ñíÒ^•´o¥3¾hwiÚcq¢Òžôý@R±¨s‹yPÄXOjÀÚ¾Ú IíÌä=?•éÖÅO8FgÃQVrHfïu÷#_¶[2Æ0 aÐÄ•YMÏjS¢åf¸)q}%+C¨!¦Å"¥v×ÓHq“Ž¸“_ñ½9Õñ¼™a*Âj(Ñ‘ñÙE…0”h=wq* ¦f]?âô™?jâ´Hór}°â}7…Ü÷n\ÖåkÊ%Î Ú­ä‘Ò!ŽÂg¤œ(‡2Ù¦ ~Pÿ]5=wi·m¹kÁj¦å~qZ›{}_ë¦}™UÌn•¥oê }ŒP:†‚»)^ˆ¶]œ¯VæeMûîè«NY3BS¬„'hu¶w®ƒ#9¬¥£§Ðm¥†¡£'˜ÑzB±¬åéA« î„MœÌÉúèh9ªì¥G»Ú°¸›Ô8+|Žmr]*EØ¢{"¢ö‰¢®õ®à–fXÆO-†U<­Õñ»FÉ¿¦#÷¶ÿWÔ€Û¶ÎCN…ïíë À%K,xݳQÄ¢È6>Š}&ø·×–dP›†YÉAeŽ°jt9Æ˪Òa6×®MNº²? h`¸8oÛnÏÛ’ ž× áàyGX5çãÕü\×2ûvË¡fn„ÏxÒ'ü£$õþŸˆF‹R0%’þ“…à <°²h”üTÞP(*q.ðboÍendstream endobj -5999 0 obj << +6428 0 obj << /Type /Page -/Contents 6000 0 R -/Resources 5998 0 R +/Contents 6429 0 R +/Resources 6427 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5983 0 R +/Parent 6392 0 R >> endobj -6001 0 obj << -/D [5999 0 R /XYZ 85.039 781.388 null] +6430 0 obj << +/D [6428 0 R /XYZ 85.039 781.388 null] >> endobj -6002 0 obj << -/D [5999 0 R /XYZ 85.039 748.383 null] +6431 0 obj << +/D [6428 0 R /XYZ 85.039 761.463 null] >> endobj -6003 0 obj << -/D [5999 0 R /XYZ 85.039 734.834 null] +6432 0 obj << +/D [6428 0 R /XYZ 85.039 748.383 null] >> endobj -6004 0 obj << -/D [5999 0 R /XYZ 85.039 693.58 null] +6433 0 obj << +/D [6428 0 R /XYZ 85.039 581.816 null] >> endobj -2110 0 obj << -/D [5999 0 R /XYZ 85.039 637.099 null] +6434 0 obj << +/D [6428 0 R /XYZ 85.039 557.573 null] >> endobj -6005 0 obj << -/D [5999 0 R /XYZ 85.039 610.485 null] +6435 0 obj << +/D [6428 0 R /XYZ 85.039 532.596 null] >> endobj -2114 0 obj << -/D [5999 0 R /XYZ 85.039 566 null] +6436 0 obj << +/D [6428 0 R /XYZ 85.039 325.369 null] >> endobj -6006 0 obj << -/D [5999 0 R /XYZ 85.039 544.803 null] +6437 0 obj << +/D [6428 0 R /XYZ 85.039 173.601 null] >> endobj -5998 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R >> +6438 0 obj << +/D [6428 0 R /XYZ 85.039 147.109 null] +>> endobj +6439 0 obj << +/D [6428 0 R /XYZ 85.039 120.01 null] +>> endobj +6440 0 obj << +/D [6428 0 R /XYZ 85.039 92.912 null] +>> endobj +6427 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R /F62 4047 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6009 0 obj << -/Length 2369 +6443 0 obj << +/Length 2645 /Filter /FlateDecode >> stream -xÚ¥XYÛ8~ï_¡—Ed`­IìÃff“É`d'ô™<°mڢÑätæßo¤DuÛ`¶x‹Åb_Q1ü‰ H£X•A^ˆHE°mnâà3¯o„¥HR¥Ií “k7»Îd'ùE»Ç:e¤4/77·¯dÈ8Ê2lö2RBY™D‰J‚Íîc(“hµNÓ8üÉ ŸW"»Ój­²<|ßwÆ"© wßÂœnõÁ4¦WŸ6¿Üüg3mowÏÊ8JÄEã`-U¤rõ¬ôY–à _z‘Ày²…ô !K'½@ù“2|µRqhôxîAb(v"ïXþ—¦5xœ‡k°¬Ÿ•q¦!Eˆ8*ãr!£,¢<ÏIÆß:ÝTíaµ–e¾5ZÅBËIŠ3åÆÆÞh>H.‹2¼_É"ü‹ç†®ÁóOìáQfÇ3¬Ð8$½ÛáÁ’×}ÅŸk4ºå^‘„´ -¸µ+&E!ùóºÃ•0HÒÃ. eÐ(Þ²@[åËÙw=è^)”­H%¡Þ*`UEËÆjìú!¢åVÄ#]êNÅ™§;hÔÓ-ÃŒ®Q›pº<|°#-~ÓÇ"Ü'ÇŽ‰ýÙêDÅ9œ‘””“ªÖ÷v/bÊŸ-²êZwøÊ5FCº™ê<)§çÝtáŸ×tܵ^«3r¿D¨PøMHä£áö‚%‘1x—j×ìQ¯h)Ø!A-¢×[¤=VÞ8*‚6m»ñèÄD&à[XÂûG«F\À,ôiœ‰‰Á‰®ˆªvNœûç-ÞÎñ‚™ `+«®e‹é߃ÆæŽhlCÇ•=ó÷éaÍ|-h"TVïÌΚ0’±p‚OÏVóïIyú.Ø¥úŽ´†‘¨lf¨tÉ€ç›êp´¦t‡ -ˆÑ GÐ|+g„¸¢E«êÙ -[ÍDtK0Çî$Ð?“LX ù‹ç´Õµù3éR×ÌG[o½h¤™CuOG‹‹ðD§nÃ}¾`(ýbv¾iq0OºGi*º -<_­{”R‚; “Q¡Râ2ìö¼ˆø~Ò'0ç«lNÈbtwïv%uõ@lÁÝA -ãÇn?Y&ŠVªpi׸OéüÁ†?¤ûçÆ=ì“;2ÍŸá<ŒÚ¹ Ù-qý‘mÅë?óÜl’­ÙºF§`jç‘s‡¡ÃÇ´7Â8’›ãƦ÷ƒöSºŸŽP’ ž§;¯íè¯h;ÙŒ]ÊEp¡e"ÃÍÑFµ4ŽCë¹°ðdE*­YxŽŽ„¸¦Å£ÌÎŒ´d2ðn Æùh¤À3tƒ{  è Ç›ƒøè¢7hÏùýÎà°õàÂ1\6“»ÁúøPgÊ6 Ö`£Bíâi] U¦Ïæ:hIr%™t EZÐBµvxº®!”$+£,——’y$_Ÿ(3¤øróñSì€ò—”± G¢,ƒæF¥e”–™í×7nþëõ°\R\eC‹b`Ã-K½ä²v§_«TF¹(&Á „ˆJôVÔQe%èj,ØïV0 -ÒÒ•‚z©Ã­Q9(“AuðŽRŠ$QDã·éóÙhàöM#ƒŸ:7XHÌ|×c†y…óÒ,*‰œ„5R¸J¸È†ååˆ%ÓÜ|dÊdý>ðK1¬ Ëž8°õˆŠ’- p¨`µâÔø›æ÷LÍ;gûmù—ÝòÄ[Ã]mÓ WíŽSèpÁÝÞm’[Çßž8E’ 0­2ðnóïÛšŸ(ó`ÍËþ/s]š’WÀ9T RŠ@©"’¥¢³¾¤›à˜…ŠR9«{˜Rˆàendstream +xÚ­ZÛrã6}÷W¨ò²RÕ& ^óæØžÙIb×ÒÖìV’Z¢$–)Q!)kô÷Û„d’;[ÙJ‰K8Ýèn@qGüçŽâ@82E±+dÛ+g´†žOW®’˜*‘©%óÓüêúcŽ\G$N2š¯Úyár4_þ6¾ýûÍÓüþy2•RŽ=_L¦Qïî'îxö ü™O¦îø žXäéyâÅã/?ÿzÏ 77Øô dîpÜã|òÇüç«û¹YÁ…•$¸´?¯~ûÃ-a?_9B&ñèeG¸Ð½½‚µ‰À—ª^\Í®þa¦â>Ä£º˜ÐSéˆ8ö‡Ù +8¾aË ,¶’XÈHŽ´ ²ŠË­¹N(â Y3½CÓ2Ãp®ë ézgx7Šã|Q•u¹jT5ÝÍé:CÝléïnâ%cêöÇ·%v×Ø\¡ÚšËC±ä¦tÕýd +ºËÒJôéÌ“ÂwÂa[™~• î*êgq­eqΰháÝùMôõGĽþè9Öé ×C”ü˜@JÆbçóF"v%ö¡cžP„a¨úo–Käûú™&C%!óo¨‹0Ïvé~šï´ ÑXþ¬ÈÂêV]˜„B:Ñ ê,™^ÕiD‹{U7„fT7§UgãÝ• é¥È¦H#(j Ë¨[—a'_÷©¢pØ#ë!ø/éÀy€ñùâÔÇLà9É0c­L?cJ—‘ô36€Ö26g³ðþcß!õ¦Ã½D8qð&x‹¬–uÖǪ¨î0©F¤ƒSO$n¬gA<èëå´«¥tÌ0Ú¢}?¡_~écÀ…/Ì:HA+ÓÏ’!Ü~àZ†ð àçÇfÃ^ CÍkT iŸK +*eó8æ»%Ûã=q[ŽÖ–L/EZ†(òz)‚3 âiŠlÀûoR):/»¬Å‡¼ËX˯@¸¤EZL¦¾#!lc”Øä3«¸¼’KnïÔ+|áöûjv¬ã–‚@€C£!@…¿;®¿>¿LÄ‚ ¢Ës…7—l¬›åVù—¦JiOXÁˆ óI›Üî‹´ÉêN,`Õ°¦>DxÒ<Ò½€Äf§ºÉ¶³ÉP¸¡ûÞìŸ52ƒú ÌA " ¯ûÌׄ§I–L¿ù*2_Ùo¾p­ùáóµÿB°½+™²]Ùpa±É¯yW%†^ÅéÁ°[¢iwlíõ&gˤžŸËí5ß­{õÁMl_RºUõªÉƒ;E8|ƒ²dúÕ¤dHM~¿šàZ5 á5Y€³¬È¸Í¦3"" +´C¸ß¥/…NBûòD?‘ ‡³K¦—-C¤½¤ ÁRñ4)6àÿ!Jûa ’h8Q±dúyP2ÄCÿq®åaÏð`Þ˜ˆÑ¹k6ªpÜð=Š ˆ×Pk~à»ãOb 2vãeÉ_u„¡)³¡Z£º)ܧHõþ1Xú4†,‘5MŽqp]sãïNà4›\Õ*m“+]¨øÊJs•ïç${?¿×­@¹Ÿm ¦™Š`;†l'NŠJg/iGƒ×àãì"§9j9ቨlÎ7 £È7â,én-a‡nß-Ú÷!=9lZ­L¿i)2­þkô\kZCxÆ´,Àg¢æ…©R)^ß~a&'ö³– áã‰uE‚±Ü¼TÉØAÈ–íùÂÃ;³Dã œñ "U@`«(QqxÈ”9Á‚%Ú#ƈ#þɲK~M¾]?´Q$Ý-¹ðˆSÎýkÏq¾]ÿë‰i(ŬêµnLšDÆÒM‚Œ BFÃY¿%ó^ z?†ïÃ32·Š,,8ZÂw©RýÚ”I°k´~‹Ž Tú:@G4àL= Ñ€¯43¸ìU#Øä«:§\¡rõ}ü2çBÅ©Üê×(ŒÄKT”“Œï2:³¯Ð¨Œñí‰õ…"34^œè´¢£†'Œ¿-¦,Þ иßd»r ÿvF˜Ýö]0 =ò9eÅݘªâÅ61ï^ñ÷a†_ÉQ¤N» —½,Xoq +,]¶kYeis0®¯k¿ä“0[ö#g¼%‡sâ +Y8Öã.W²ƒÇB¬Hð%Ò6%DmçCyÜö ñϸx©xã}™é^»`PnxxÚ^pÍ/ʼn'Òn•vPêÖi‘gj‚÷Û®²´V®DÐí(V&mÛüö–ÝÔ,”«¯¡åŽúÉÓØ74ÒKÅzÍ)%Ôq*ɃS%rI!¶Yªq+þ’iÀ÷+å©ï­7Ca؉u‚Zu°*Q¡[¾€ÁM%×d'ákÁg4˜Ði“¬4ö&±´–ª“È"%ÍOät½ÐmÕå:%~3–5)ê¸á¾‡3ÈA2¾æ>pþŽœü– ô ë‡ì†£à|ÑǼ(¸dŒ-[v,–³6ê_äh§®‚Vƒ)Ðú·dP/ØÅêâìÙƒ:u„À2_,œEð~>D„¹f(NÆõÎP´ÙêJ%ZSŽŽ éŸç¦³GV®5Ú%ô«Ù½ƒ´j±Á>ùÉæbó{:õƒÏNýòÃÒœÔâžxYç6•›’ Ì6âËD8@ŸÏA¢s®Ô•Š‹²R9.b\<>ð…âlns–Ðp ò­Ã9ΟíÇFáâc‚¸Ãñ78áœ[SKþqŽíºÄ/’j££°ò;îæ,ðÝá"•ÁÆ%îA;m¹ï~ྈ“áTÑ’éÍ—]/¡ŸŽì|ÙWù²Î‹Û„÷!_W*Ð; 9<´2¬a²ÃO4šh´3cõcVV½éF=ÍÒíKÚ·S/7ü£”%Ó›'p/‰øaz¾¡DHBªIfè²ß(›¹@-¾5ç ŽmÔœm‡BZc‡bÒL'Q^óÄ•=_+ÕÜmÞq6mÂÙÓ«>*°2“|:mª„íEIض32¡)Vá!± ¹þ[»3Í‚„è0Zb b?z\ß³î¶>Jþ© x‰-pÍW¿ ƒc=qK››R%ã‚í¹åE{eß ‘í*SS¢á7U©q˜º…w¦b¤ZgYñ û4U×*n™Aýá§ÞGkRr…êq€¢YˆÕÈ^[Ô¤ÔZ›ÌÆÎsøÇõCûS:õFÍ”íÕ ûó’"9£ã|·¦Ü€†,ë>ß áu¾–Á?Þæ_ú*Úû¸±ìyq > endobj -6010 0 obj << -/D [6008 0 R /XYZ 85.039 781.388 null] +6444 0 obj << +/D [6442 0 R /XYZ 85.039 781.388 null] >> endobj -2118 0 obj << -/D [6008 0 R /XYZ 85.039 761.463 null] +6445 0 obj << +/D [6442 0 R /XYZ 85.039 761.463 null] >> endobj -3026 0 obj << -/D [6008 0 R /XYZ 85.039 667.044 null] +6446 0 obj << +/D [6442 0 R /XYZ 85.039 748.383 null] >> endobj -2122 0 obj << -/D [6008 0 R /XYZ 85.039 667.044 null] +6447 0 obj << +/D [6442 0 R /XYZ 85.039 720.678 null] >> endobj -6011 0 obj << -/D [6008 0 R /XYZ 85.039 642.326 null] +6448 0 obj << +/D [6442 0 R /XYZ 85.039 694.186 null] >> endobj -2126 0 obj << -/D [6008 0 R /XYZ 85.039 490.395 null] +6449 0 obj << +/D [6442 0 R /XYZ 85.039 667.088 null] >> endobj -6012 0 obj << -/D [6008 0 R /XYZ 85.039 458.869 null] +6450 0 obj << +/D [6442 0 R /XYZ 85.039 642.11 null] >> endobj -2130 0 obj << -/D [6008 0 R /XYZ 85.039 226.062 null] +6451 0 obj << +/D [6442 0 R /XYZ 85.039 615.012 null] >> endobj -6013 0 obj << -/D [6008 0 R /XYZ 85.039 204.866 null] +6452 0 obj << +/D [6442 0 R /XYZ 85.039 572.243 null] >> endobj -2134 0 obj << -/D [6008 0 R /XYZ 85.039 162.706 null] +6453 0 obj << +/D [6442 0 R /XYZ 85.039 545.145 null] >> endobj -6014 0 obj << -/D [6008 0 R /XYZ 85.039 141.505 null] +6454 0 obj << +/D [6442 0 R /XYZ 85.039 520.168 null] >> endobj -6007 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R >> -/XObject << /Im2 4150 0 R >> +6455 0 obj << +/D [6442 0 R /XYZ 85.039 493.069 null] +>> endobj +6456 0 obj << +/D [6442 0 R /XYZ 85.039 449.694 null] +>> endobj +2194 0 obj << +/D [6442 0 R /XYZ 85.039 410.058 null] +>> endobj +6457 0 obj << +/D [6442 0 R /XYZ 85.039 372.527 null] +>> endobj +2198 0 obj << +/D [6442 0 R /XYZ 85.039 154.892 null] +>> endobj +6458 0 obj << +/D [6442 0 R /XYZ 85.039 119.482 null] +>> endobj +6441 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6017 0 obj << -/Length 2860 +6462 0 obj << +/Length 2269 /Filter /FlateDecode >> stream -xÚ­ZëoÛFÿî¿B÷!( D4÷ÅÇÅ!¹$ÛØñÅ -ÒC ”DÙD$R!©8þï;]>$Ê5šÀ°¹ÜÇo–“~Ä$6~ ’I _Åñd±9 &70òˉ°SK2íÑ<Ÿœ½ -õD~$“Ùªãc|mÔd¶üèý÷õ³«ÙËw§S¥”'µ:¢Ø{ñòTx׿ÁŸÙéTxo¡qÅ$WïNeì½}uþæ%w\<»|†]¿ÍË œw9;ý4ûõä嬕®]$IP´/'?“%lãדÀWI<¹ƒvà Þœ€l¾Ñʾ¯O®Oþײâ1=áYcš0*öM¬U¡LOB‡~™I¤B?1†t±.oÊâtj¤ñ¶isË­Ÿùñ‡PŸ¼Á¿WU¹Ê×YM=;ÜîÙ+Ñg?UÚW!¡?ˆ#bw›U(M„Þ“7ül*ÐWZÔë´ÉjÛUÚç- Yò"ÝØV¹Â§QÛq 6§2òæØâÎ:ÃS«¾â¹dÏH‹%7@^fQYø8Ãî@³SŠg=‘8Øk÷KC:¡±N•RzËl•îÖÀ«Áwå­ YV•(_Fã‰dêxM{Ì(O ÎVÆÊÚ´+âÖ)ܶzjö…TAëé"¤ãõ° -ÎEGCÓϤÿ±Ø³Á#°ç ¦²Å'k‘ãadK¦Í‹Ã#³)RFšS$Y‡ „/L<09f¶E¸£se£ÇµF[ ÃÀ»jO=Åa„^•­Ðbt`(ÑÓ®ŽÃ›´àÎmz“q ëÐe% ™8i]r3÷e±q]øR9ºœ¸k=t ˜†WÃôËBÙå—¨1y½À­6V‘ñ… -û)“÷ò#Y¾Àœ«4§sQ„à=EŸ[ھ˧ÜH-ñš]¶^{!"ñ{áæíü}‹BúJȉI"?ˆÀ”I|“„£6 P 6qx” M -€ ·ˆ:Ú·l'ÓÔ  BÕZv$1$&ÃàAâÉÁ ɦuY2ª@³8ب% (<'_&Â4®@4½6Éßm‹:ÎÎ7bò¢I'a™ï´Ç˜Ý0îçXüИÀƒ¾‹k hÂû@!/–ì˜bé]bÿ úÏäoÜCñz;ß(K™Z,Í&·áž_—äjÔ,ʆ×[æ51*Ñ¢ŠlÁ‘Š†R»NYn‘Å´ò¬ 3&S!û">S~¸OÐÞçÈÐË´Ï;u€ÀN¦QƒÏxç wb6T!8|+g>Þy†!Zœ¶ÁíË·3n09Ä¥ ŠÁ'0d0¿Ìz ómP‡Ó.áê_Û,Îc‘6º"ÇwlnSÜTÅúï»m‹Ñ‘ˆh8›Ù®ú&&N˜3ûíwêHøà“ž#üs·BÏ€”§8í;=e&ð>xåCe§ŽcH¦_È`€°ØÕ5dÜÖ³‚-}PˆÀ˜Fâ}ÈÑ5”° ƒí#ù†ÏÈ;ãÇ…Õ74ß×l~‘wµ!Ž”Ÿ:÷ “‡÷ÑѦÙv¨ã@2.=Z'ìÍ«wxÄ[ò†Òš ö (Õù=öáÆðyÆ»1ÞbÛl‚`@Ô’ Ö®¶¬w”9¡Á 6Ck¨âbç6­¸:DkZÛ÷G¼þºsZVÀ<£F›ÌñeÞ¥FtsìÂ#–ßÐmñ½.ùI>’6–If-zÊøýÌʺ¿…“²úl…p¸T -ÒJ´i‡rÄÎÔ/)naùô0VT¨Ùeábà΄Lد—D¯ˆ° -V±f‚Š0ôM *¬ê95YekÌ(HÔWýó{Ü‚>€àÔÙâ h»3ʱÐû ¹3&Uèž Á$8§ ¿uSµµBÃG¨‚!g*Mš¾4(•‘áw^dvo‡×[‚ƒQëZÚRZب­û6Qýdizœ;0Õå•Mgäc÷è€XÝ„‰÷|×0O²”Lá_èÔn«•e•Û¯å5”¤‚\júÌ­Êpl‘ûRÚEÏWCòC—âdÓ8#³©fU®×Œ‘!k:Ý¢9’jÄšŠ¼›u9§rð“M/V œ¦ÁÜ]Z²’Œc㫶b~ë¤WÂë¿GØN¥sŽÌྫwÆVzô:íÉ{üëÛ[‚zì>-äLDìc›í[ˆ^õD»mxCÀ…þ³V!<„f‹Ï3~ØØ+CÙ½—ÀkwÄÙ ú[èÀëÊáAéqµ^VYM0qv›6L#šRaŒ:Ö|®™•\îÒ;ºøÚÛ<}çÝö¦äð>u$U µÿº«~€¿¢ô@Ý¡ëQâ¹q¸ÇÝúG€³Ô!VÍçÍñ@â5¾{€²ÀEþk¾È¹ -”!æ±R ãnÌËl ð2ZCp‰­Ïd|sµÚÍ^ù«¤~œè‡·ßѯ¤Ð~ ¹þù?Õ „Ç Ã.ºÛ‚—Ñ*ÂÏ„Â.:OœÃ¡©ÄoVøÊGò;S‘Ãp7"‹Ëwò’Ýí²n¿ 5t]ܸqò·Hs›xõºgVƒPÛ¿¢êÙ¢¸÷RÙ/!€•ñÖ@kã½:°íl—¿µPwKWŠc ¶ˆå?…$»H2¾ÓG|-Ü|-±2!c0ŽèA+ëÑw2Ÿ#¢hÏÉ´u².~Õéœ"ž.ºÁ»ôiO{àìD×;R6˜%¸$ùeÕÛ -b‡wÒÑ÷—DùqÌŸ©Ÿáukì}Ùu Á^€E®*Ba<­?·ébÉ£xÓ¤ƒÄûf¾f°Í´›_î™êœûÚ„žµÈxâ T¾Ž9†’ß¹5ÄiËz#«¤iÿù ¯»É—iÞŸ¯ÛÞ–%?ÏG,l™»¥íÅ9)<)>&ü?Œ -´Üþ§Yã¾ ¹›¨6o,k¡AÖÞ3ƒ&)ì]Svi—n¿âÚš`ÄÀõähÞ€_Þçwý3@wm–¢ŽÜÚ)})œ,¨ ˜}yÝ? ürÁæ™endstream +xÚ¥ÛrÛ¶òÝ_¡é‹©™!ð–·ÛiÝÔŽ+“éôô–h‰QTH*Žÿ¾{(È"™žÓÉ$ÅîbﻑþÈI +_¥“8‘B%ÉdQžù“œü|& Ä̘̀ÿÌÏ^¿ £‰ôE꧓ùãO(t¨&óåŸÞÅ/oïæW§3¥”h1Åqâ]^M¥wÿþ™OgÒû‹;¹û8 ïûëß®xãæíí[Üú`®nðÞí|ú×ü׳«yÇ]G8I‘µ¯gþåO–ðŒ_Ï|¡Òdòk_H8.Ï€7je¾7g÷g¿w¨øLOøVŸ$,ÄL¦" ÂqiERèHuÒ +üi…¾}MÒž¨…I…:õ>Ûe5UÒ{BA5 “(ònq=×øƒà¤WãFõ__ê |å|p“m³U^æÛ–¿çÓ€`í{Õ¦’¡N@¿jüUz• {^%#¡"zÔ§í#0UÕí~¶Y›ož§‰ö^MgAxíš9tè}ÌzÖ \ÒöÞ°Óòº0èʬ-ª-î)¯høŒ®ï`ãMé- +” €/˜@[1ܨö¾¡utÝt«G>¼A;åågä•àO†Þ-™¯~øþw8(TÕL¢‰¤ôúùÕ¡´·¨êš©;-ïuMµ¯™MVœ}ï¢e'À÷|þeSÔù’«šy¶˜Â«×üµ MÖâ©ôJDÚ±ÄÂËFÖ~ÉkCËâÏø:!„_xgE;ËüÍ€ÙD:ÑœÁ95›L*VdOŠ—Ĥ‰$LF©Y˜qrRBÉàˆÞÔ=x×3jõA_·èg¸ÏeUf…¹; ¶®6«Â :N½ºX­éAI¥Wž¸ ÷ám/BîŸú1¼Ù¹yÐT­r·oóš/½"JD¬¤Gò‰ß™6Ø*“jèc“#†©Õf¼³¡…qdwC«e›È•ˆTrd柚¼ŒGMï€# ïbȬ|H<ž‘˜a³20c‡Íj„ÚÁ¬ÆÈufåлϲGW2>¶g½Ô‡­8x£1D†xÂlk, w0˜!XY¬ÐÍ!°'Þšà°Ø Í%Ö‡1¶Q0iO%`ø£@¤*üq +…ð/ô¦PŒ¾/ü`8Ó-ððŠÀÕ 43ËÔL#W~Ô‰<ÒÀ°HÁzH䱈R`]§ +ùmÅé%yòR×i,´$'_'Rø:MÃ8kâÿð.Úx}]ÊÉeœNŽ˜e¼31ÛGâÚG‰TÇ“<= Øs®A+TË‘—û¦Ø®xi½™Öô Úý„jϺwþÄ»›Š¼¸¢DH‰VsÍ´J½?0é’5Ü"Cc1d¥šÈ³e‚6i˘£%^™‹5™-Î{ÒbHµ·ª«ýŽ—GÈ€—(py€…Eˆ,¥¡·*¾å¼¢0… ÇYàÂùÕ7ó)ÑGb´lóÎcpÛ$•EfD™F†§©Q}éœ/ˆ•#%üj×ToàªBá²{€Mè(˜ª=Jî% ªt½‰AXó8ªEùì[©ä›ÎØ°ª8ÃH.¹ðõÅΪ¢5Uëf?í(pÝŠõ-#½»¼8 E: …ÔÑÄqúÿ?„¨$‰‚Z¯¥ÿ.¬a嚢ß0ŽFs’Vÿ!3å$ ƒêRƒ9ÉÁ4œ“FÉÙ0êÒ»p3”à’uÞ“êu$¢È$àJR¨8t§‰*ªPÛÄþ€ÚoÛj;”ᵃ†Æû fXš‰êaiŽP;HsŒ\'M‡ÞµI¬]„‘¢{碿óéÿPaQ}Õ/ö;',c!G…VâT@Ð7(²%UN£mþÄÌî(x­_™Vbõ‚š6ù #×ÒB „ÙÂsû¸êa€ú?m@Ú¼äÎ춼:øç¨M†{Èê“R‰eñx/âÀ š”…Aªá IQëLj”œ5)—Þ åÒ-0 ‘Ì b3úUŸõp|2ֳζ«¼ÏM}‘hk űŸâTR„Ò:õÚcN5~IMjKí(¶ÿb¾>%™$¢ënØ*Ì]çܧË]a<Ø:0ú40H:Ö嵃.ÇÈuºtèýH—T½s¹*8Ç—3“à¼v›Ÿ›ülëû£Vï¸àïi.¡@•‰u´ïûü,îÚ1B7_s¡L[qÖXê†ÿs\àðá¨øäý-òÚ°ßi"ã ÚƒH„j¼ïs`†Õn`ðQñ°ÚG¨Ô>F®S»Cï–'Efø3¢h\¢4þ‡ŠÁJoù.Ì”hŠendstream endobj -6016 0 obj << +6461 0 obj << /Type /Page -/Contents 6017 0 R -/Resources 6015 0 R +/Contents 6462 0 R +/Resources 6460 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5983 0 R +/Parent 6459 0 R >> endobj -6018 0 obj << -/D [6016 0 R /XYZ 85.039 781.388 null] +6463 0 obj << +/D [6461 0 R /XYZ 85.039 781.388 null] >> endobj -2138 0 obj << -/D [6016 0 R /XYZ 85.039 488.874 null] +2202 0 obj << +/D [6461 0 R /XYZ 85.039 761.463 null] >> endobj -6019 0 obj << -/D [6016 0 R /XYZ 85.039 469.924 null] +6464 0 obj << +/D [6461 0 R /XYZ 85.039 741.337 null] >> endobj -2142 0 obj << -/D [6016 0 R /XYZ 85.039 246.049 null] +6465 0 obj << +/D [6461 0 R /XYZ 85.039 670.603 null] >> endobj -6020 0 obj << -/D [6016 0 R /XYZ 85.039 224.848 null] +6466 0 obj << +/D [6461 0 R /XYZ 85.039 632.076 null] >> endobj -2146 0 obj << -/D [6016 0 R /XYZ 85.039 128.027 null] +6467 0 obj << +/D [6461 0 R /XYZ 85.039 457.053 null] >> endobj -6021 0 obj << -/D [6016 0 R /XYZ 85.039 105.311 null] +6468 0 obj << +/D [6461 0 R /XYZ 85.039 432.81 null] >> endobj -6015 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F14 2895 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F56 2890 0 R >> -/XObject << /Im1 3957 0 R >> +6469 0 obj << +/D [6461 0 R /XYZ 85.039 405.106 null] +>> endobj +6470 0 obj << +/D [6461 0 R /XYZ 85.039 378.613 null] +>> endobj +6471 0 obj << +/D [6461 0 R /XYZ 85.039 351.515 null] +>> endobj +2206 0 obj << +/D [6461 0 R /XYZ 85.039 279.064 null] +>> endobj +6472 0 obj << +/D [6461 0 R /XYZ 85.039 247.042 null] +>> endobj +2210 0 obj << +/D [6461 0 R /XYZ 85.039 189.008 null] +>> endobj +6473 0 obj << +/D [6461 0 R /XYZ 85.039 156.985 null] +>> endobj +6460 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6024 0 obj << -/Length 3177 +6476 0 obj << +/Length 2931 /Filter /FlateDecode >> stream -xÚ­ÙŽÛFò}¾BoKV›}ð -&>²N<ö¬G g‘ä#q$©”µúû­£›‡Ä‘ƒÍÂÀ¨êê꺫h9óៜÅðu2‹b)tÏV»¶o¤…XXÅæ‡åÍË·¡™I_$~2[>õxa=[®õ^ýãö~ùæÓ|¡µö”óEÅÞë7sé=ü –ó…ô>ÂàžAî?ÍUì}|ûîý^¸»ýp‹K?Ì›;<÷a9ÿ}ùÓÍ›eG]w/P’ iÜüú»?[Ã3~ºñ…NâÙƾ°½»ÚD`´77ÿìPñž™ñ©)N-E¤‚ÙBû"ŽÍ$ŒôC1°+ðEà›Ž]Ê°KJ%´T3„üzWâã^¾ÕÁPàFˆf÷(VUùtÎI¸3š ®¼¤ËÂ\Ð%G׌iFtÝþæK¡°V-&¼v›á ôž@&UQT(¥c^Âlà Á·-¬äå¦áci¹æÁíû÷á¨Æ(ïëìkV¶<ùT¥ðîÍ…åÜ6-7vüTW»dŸn€Gî Êœ~·ö!«¿MÏxAãKÕu/8zÞ : ’¹¥½ØýÞ³õ:ï?çàËyN\eÖéäÈ9B`s•XsAì™sLDè‰};Áò¡ -l --Y‡ã¦Më‡ÚÛõaóÀ+5ïfk½ ®·(p™Ï^E{ÃßvËOFÄwìspù±d‡Î…­sH:^°FJ¬PFCæX_d+ödÀ#‘(x¤Žmƒ¼…»ë6guÁº@„‰ËY…}˜:ËP:¶®¸l²Q»œR‡Kaá"–êˆ2bÿ&EæÝpym=U5c²2°³=+œÆ^¤µ½+~¦”dM‘øÃ÷‡ÞWÄ”¹œ„s—ªt–AïŠ(P1ÄþªFS‹5§°¾K9ôánÊynuhæ¸åÔ‡dOµÍÓxÿ QqjxÖVü»ÂUjB6޲΂.v/· ”yàý"^UQDÁÑ W¾Œ¶'J¡ÇIH#.œ»uɼ\šoWi:HD„“U’!Á·ñ³xè”xxäÀÇxŽ*`}(Œv:RpD$èÝ0œD Ì@{dD$¹°ýPqjµüT jj8gÌ$¸’$Ñ 3Óú‡ÑÂËw;9{]¥³±Œw1@Ìá$ƾ ‰‰fÚ$" -8UZ:?Y…µž” GÉ­Þ% €ôqË&Ç‹¤Bð ÂvË“”IA"›•r‡»{<Þ9Br–= ŸEQWx2xçî¢@/|©Œƒƒ¶†„~¦Ã2#î<´Š#k$ÝÁa…ˆóª´Äè×”ŽŸìÕŠœÒ¹¦„W:ògt(«kêáY&nú"M¡Óéj¡Þë)ðz§9yJk2Þ¬H` ÷c.eïUq·‹ò0¾{®š¢MGCÞ_~I駌R郥¸Jïçq$š:9$º#Zò‚ñ¾žùM$£ä-Ò<8ó¹×Úé Arç‹-þfOrê1æ¥RvN5ÑÙ^ø%Au–3pÁŸ Ó’öx.ùkN~iøõÁë$WÛr*  GÙðÀ}±“S&IÌBTF(ÝÀƒ4“Êð‰—‚ -b.^ç‚¿(¿ÑQ*1g\È“XÕºÚé0ô’ÿð›^òÏ]ÏûÞàô!kûç§<.ºþ€f¢-çàÁ¹Óç­sˆdC 5 |Ÿã¹µ¹„ŠùÎâZ†(*êÇÁ(·GIn0·M¢QÒËÉ//xÐeº>· lÈ^‹}¦w;‡œbiﱈ:÷“±ÎdkB >­a¤iÝ_À­Å58ω–ÀØ+=p]„Õå]V¦J -4'Õ•—Cêzòþë¬ùÒVû 4jŸAe2F÷…ΦNwSµ„g:8ìŠ^bR'(wÕ‡¬ÝVÕú[aÐqßþát ù)CˆPçWmUçÔãunÊJJÀóš‡$¨Š;j¶±ÖØ4ÒY·Œûµ¼GׯŠ·åêM¶æù1Ç>ÁF¯%΀­r‹†³lŠš ¯4@±Ã“OµÉ±6“àʶ‘¤ÙÐb -~¹ìþ}Á±™@Cÿ“XöƒžË9š@Ä2þG-&Ûeº›ªµ ìhˆõ8š³sk\óÈÆùÇ¡w(„Blú6ç L! kH¿¸¤ A¸% ƒ]å â¯Y™úΫµZªNqÂfÎu èfh"ïßØÜÀT÷­âª2sm}œa -…ûö¾£ã2'ùuSTXž§ÅïXàcWÑ|>®ýRÎ]²ÚqËz×ØÙ÷üCõb梃ÈÕëø¢e˜ÿ#C%ÚÚB[HcÛ -å0=jó!â©O ¥-ìóÒ6T)u•—ýÆÛ¥9KÛ%ˆ‡Óß_»’½‡™È• É ![´0H†¼¼L‘úÚ] qý*ˆ:A ¯úXºÏX6ÆIsÑÉÂ5Ì+î¥ý˜•ñt7p™yÙ×¼ù´·©,îj²] c\× Òó¶®Ð»RÇSc1+&âGd„ߥ" –ëÐîÿ}â^I’8¾©iŽøKE½žlñbk6'@Ê€åfl$gÍeHµ;#¸¤ò*۸㛄}¦þLŸ·K ¸Ï‹å€ -½Çý¢Ï›ð~ÙõäqÜ%U]sÊRÆ"ë{…/ñ—Ÿ ðtÔšÀå Ä~CbícF<¹ï.mš)MˆE»ÔâãÏo–Ñ »ŠõxàFŽ×Õå·àHÄ`PQô'êZª\§«Z‹iÑ¡šú$"…„„†A8ȵ$™HZþ?H²˜®’z "è)JÝyE=áh·?XÿÈ߆_=ëì‘:œðV­x¦XÔ¾PÉtluà/ý/—®à„‚;ÖÏ|´ UÒÑ‚O†@tNo cð~ú’àÿö×™Ìendstream +xÚ­ËrÛFò®¯`åb°*„0DnZK¶[²Ö¢7›Jr€HˆD™h´¬¿O¿IHVe·\fzzzzzúM5 +àŸMC?0É(ž*ßL§£ùæ$-aå퉌‰ Lz8ÿšœ¾ £‘ +ü$HF³ûŽNèÛÐŒf‹?¼×ïÎnfŸÆcŒ§­?žÄñÔ;¿+ïö=ü™'ÊûƒF¹ù4ÖSïã›Ë ¸:»>CÐ[À¹¸Â}׳ñ_³_O.f-wí¹ÀI‚¬}=ùã¯`´€küzø&™Ž`ø +–7'À›Z#óõÉíÉ¿[R¼fG¼kHc¢?ÑáóÒŠ”o#ÓJKÒ +? ,I ¤}¸¢õQR¡MàÚ Ÿ¬YD±w{ kçOÝ^è<ËO‡Cü¨p€ù&"v~OWîÆoŽœ¤OòEVà«49ptÿˆ@ë5+˜d8½[^ž3ü1gð)áÆbÉÀ·Ys{yîónå}Ï|_¤Ü0Á>ñß`˜ \EÒ¸©æ= ô½Íªo¸–U<·~ÀƒO_"#Õ\¾Gn% Àë£~Ë XZð9°Óš€Î°:aš8¨›²Êd±Ye \—@{êÍÓ5Ï·t›?eׂ‘÷ª6i“—…ÀP,ñÍ 4])ïìÓIàAMõËI^¡We]Þ7$­õø‹IZ‡ÖFÜó!¯úe¼Ay½Ck©HQÁÑ€‚ÿ}QVµ¾ æø˜Xû!<Þ‹ù¿éÙ䇼&‘ ‡|›hñlŸÉÝ?hr*êLNÅÇtʶö8žZïg4ÍMº’-ùzÍ„îÐ9JõîN¶Õ @§Š ÆÈáè#ÀÖ -ïݪ,µ>—ÄG‡¯JÆAéŽgg9àÖår‰'›hŠ2‡/ÙrÞyl؈8C)B:óÈžE?lìa2‚ß”q¶C8Í*mx¹UN€‚W ]°EfBêúãŒá«´³G©ÛŸÞ¡¬3ý’¿e#pôP‘¾Ó$oAñÎ)飘µÐì6ÅÔÖÔ”÷ªfkwÍýžj +E ¯oR—çüŽ¯Ç+[òð¥l½׆+MÉè­J‹¥[êq³à¤õ VnyK¿åU‰wbåg/6¦`cçøÓ^Z;ÂîŽÉ2øzÁ)y߀õcÔbÏÙãXBÀ&]ˆÃåè†xmtc?\7b—÷¼ž7òr՜¿ 5®?rňc`Äe¸{dïR¸ÂnYü=(Pß îQŸ#l•’v±Ȧ ~¡W@3ð +ıÀt/I™} ÈÅEnsW7<ëĪp +™`ò¿ªèa–+¦#zµÎçÎq6M^,kÔw‹Eì¥ðE|£Üi'gË•·!{ØñX./´/¨¯V™á`‚ ’„*]ÙèI2´)2<"ìð0MwŽÎ„‰o‚®™R~‚/u?Jß*à[CÊp’~]²=(Îuú·l†1•õ£¯#Ü!ÙÀŠ{½à}løä±áÙ÷2„.òVKæM›¶ ì‘0‰ÑË›Wrؼ,Qp/ÍÙ¢u®&ÄhJ¥ë€w©²u~B§.OEM»”’ΚÕ_hí V•íeélj™³d¼Ká$e)&»:½[gGJo“Ô´§aÿ\]Ñ"ToÛVúçÔÓý©Ÿ¨gc¼1kîd¼Á:„²Ê$ö®nñAGZÖp¸vM=9{ªƒà;¬žþ÷†ám N0Ó£îÅ\„³ó#Lð >§má¤UÜÑùë…Sö¶´Éy&ž@ÙÕ 9ªàPäªKñ‹m%bÄ„Jöà]òÀ^ÂÍé'¸\ö¼[žm÷k@˹J-÷6möó)Ú¸WGjo¶k¶1œ®[ÉÍ»kåôXÃë|îRÿY>ÃëÌxù˜­§óŽx}a.Åí;¼ õRW®€-¥ç.È•üeí+ÿêìz¿¥–(¢6¬ˆZuŒ¶^òqNU¸Ör(ìʳ½Œéè}¹ÀæþmÜÊP5úÝÓC!Ý)©î.Ì€Uº-,|–Të-¸.Ýb +‡çO²ïÅèö¨(Nì^?šµµ¾ÕúÙš ‡ódÅ¢|#å*ׄ~ ~¹é:‰§P'¤ËœJ1(^Þ‚ilyxãìSÅ‹†èlãç›Ô=œ'›Šc_…,Ç«’.2¡jI‚ÌkêÔ M©åBƒªÍîè%­‰Èp9D”6| ðÓªÙH:]KCÕ9“&ŽáJˆ(ó§Èç² ÚSd(áεvMÜ%€ÖL=ln¤sQ=d‰àÂÅ÷¡@¹«wmÕÛ”NwqvÐðÑäè›òçøš]£1¤=£ÖE²9]-`%:ˆ¬ƒ(K¥Bz+‡RDzTîßoíC\ +““VÀk)ãîÝæÞˆ·–‚‹ÚXWÄÊ’C±ìPŽ~ °Ú F7„» ›~eaµäÝ;ÁòœZm°å-™êNøºHÂÝïkñox³Ÿ—%\á7åÏQ¹­“„™Dío˜£Ù:]× wªÖÏIÔAÌ]-Eqÿ &Û8YbÈ¥¶ÝB™ä{D¬ßý³àâfýÁó–<ä¤ïÕ¿ø±\6ù²rý?Ëæ8Y®‚œñÛ Óƒ…yÄ5÷¨8>î_" !’u¾,ºö —ÎÙ8kÑ-D¦Žgâ1ÄKáÙ¸_£ÂJ/»pÌqû$ñŠLNmO_u,ž½ºq™ó}¥Üdç2gEtYty/Å‹ÿ¡>#sŒ×Êä;z|A#^…fÒFLxºýV…àÍ–†²,éšúܪ÷ª¢8ô£öçˆP‹t®&ÛU*I‹³_šü¶Ðý–pY[é‚!‹ °‚oê´WR^èžgûy¢Q¤€•ž–s¶9ÑP'ø³AïYP)s`qLÜy&žzŸ»fncë jÙ]¥ës» >?mÝS·›{úôïÁSÚ6Rh€]×i¯_XîÍcNå²õ½€jÆJë–в ,=³ÅÕ¢çdq¾‘¼?¹½¨¥þT^å‹N†’øÏ”þ§ûÛ”Ãj’áŒû¤Z9^scÃC~C3õé9føoQì™endstream endobj -6023 0 obj << +6475 0 obj << /Type /Page -/Contents 6024 0 R -/Resources 6022 0 R +/Contents 6476 0 R +/Resources 6474 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5983 0 R +/Parent 6459 0 R >> endobj -6025 0 obj << -/D [6023 0 R /XYZ 85.039 781.388 null] +6477 0 obj << +/D [6475 0 R /XYZ 85.039 781.388 null] >> endobj -2150 0 obj << -/D [6023 0 R /XYZ 85.039 255.288 null] +2214 0 obj << +/D [6475 0 R /XYZ 85.039 761.463 null] >> endobj -6026 0 obj << -/D [6023 0 R /XYZ 85.039 236.619 null] +6478 0 obj << +/D [6475 0 R /XYZ 85.039 743.459 null] >> endobj -2154 0 obj << -/D [6023 0 R /XYZ 85.039 236.619 null] +2218 0 obj << +/D [6475 0 R /XYZ 85.039 589.406 null] >> endobj -6027 0 obj << -/D [6023 0 R /XYZ 85.039 215.622 null] +6479 0 obj << +/D [6475 0 R /XYZ 85.039 546.453 null] >> endobj -6028 0 obj << -/D [6023 0 R /XYZ 85.039 93.418 null] +2222 0 obj << +/D [6475 0 R /XYZ 85.039 244.422 null] >> endobj -6022 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F35 2880 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R /F11 2898 0 R >> -/XObject << /Im1 3957 0 R >> +6480 0 obj << +/D [6475 0 R /XYZ 85.039 200.671 null] +>> endobj +6474 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R /F58 3360 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6031 0 obj << -/Length 4226 -/Filter /FlateDecode ->> -stream -xÚµÛrÛ6öÝ_áíKä‹&ðÖ‡ÝI“ô;ÞÆÝL'›F¢%®%Q%©8þû=7€ DÉ;ÓîtÀÁpîçVç!ü§Î³8u~žf*ÐYv>[Ÿ…ç ùáL ÄT@¦ÌwwgWß'æ\…Aæçw÷=ž80±>¿›œ¼úñåíÝ›_/¦ZëId‚‹išf“×o.Ôäý/ðÏÝÅTMÞAã–An½ˆ²É»ïzû†;®_޼ĮæÍ5λ¹»øt÷óÙ›;·;·.ì$Ç­ýqöñSx>‡cü|:ÏΡ -†×g°· 6Z¾WgïÏþéPñ˜9çYc”0QD)4td™…Q* -´Š€\qÄ¡qäR±G.ÅAb’s „ôŠ‚ýÃ)m¥Ï=L‡Ë1È3«é<ˆ³x°Ú»ÍÅ4ÊÒId]–ØÎ&*øØÌáŸú"J'-wç_ôŠ®Kþ]#ÿŠrhYm`R‰—0˜'“E-èk<ÔÕ÷Qèï'ƒÍbRoº¦^ËU¢ ç¦\ñ¬Á)R¨4’YSP€ÈøßÇ–UA¢r¸¡Ýv¸Þã…áÄÐj°ïadmc‚4ŽÿìÚ™=ò -¨U•›Aš ˆLš 3As¹¯qSP¼š5u‹l¹çMSï ¶ËÁ `ÆC;²}¥@póçö¯ÀmSÞ—D«r3+ÇŒÓ ±dpÐ|…“÷媜ñþñë,Ð&• oë±Þ°vµwä;î{]¯ ’×±ó†Yé½õï–åæR(®Q> x¹iw …Ž“I·,:i‰zè8á ©ÖEó„ß1n7ˆ`U;F³¤Fð|ªó¨ç¯Î•ð·¾—±djè‹å8SMè0é«YÓ"‘Æö£Ó ‰­ü¿ûe ¥å€¥S’I3b)À>ý" šìtW­‘BÚLŠÕªF{ðÈŸÝ’­¶g5Ù‹-ôì:šYóoS~F¦Njþ‰ð@p5.þÆ:£üFŠÔÑ„Ñä’ÖÚ-Z @Ch»ð÷ -À¥È† yÛ ü¿CeVeË]EÓÏÕÙVórÎxîiÖšaÜù,:+HÂ’gÿéžûže½““1Õ}\ðÿA¬QÔ¯!kQÜÙêâbOÜm¥0‚î–»^¼Z¤!šŽîë†7µ¿‚š¬VÒ"‡Ÿ6Ø<\ýÔäÅ%ãAKY¢[Ên¶{äƒ. ZÑ–ð”áà|-©?cKú•O+$ðŠ?PR:nNz7„¾eey`÷¨‡Äøšâùâlü|Ðÿ¾l¸³A=-K`€§#èŽ;öx+ð‘¡1Ôÿ\(xLbƒI'/>[I’NšDtCÇ^´b0šôü6©JöP‚ˆ¶bxV›’»‘FrÎ㽸Â8„iÚ¬Xñ÷½x:Y’ Ì” -þùŒCÝØY²ÇDZMë@ƒØ]ã0µÊ­ #µ¯‹5Í^°èOŒç_2h%Sq£ B0>çž–àJÒ‹¿Ñ}Íb£õûE¦qÖ4J2¡¶6Ö\DI>Áe‰]üIœ@/à>0ìIC2! 2Ò–^£H -ì¨*áDà<û+cY§ |åžYÍ*늓>î,qËC« T§h©CV@–_5)sô’ˆïL6È_Ǭ²À£šØcÿAÛÜvü±¿0ÈûÈŸÐÂ) >ó´µú++v’ì ¹Å'.¤Ëª¥%ç‹–dÛ„`S¬ C,ŠC¤y3&ˆD<Ð̈<ÈÒsØCÖd]`eô>l<#C=iàŽ¾Vm‡ç6ÀªpwÎ -WÚJ¦±Ï‡(ïãkh{$eHEÁˤ¸‚\Š ¯fE':ý¼þëvÑ9ËÁ‰ô¸YCvÚÑ7qÞohRpÈY_ü¨Fd£º÷Ö.:‹e-‹ñ ´¾@ ò˜ŸØmY”ê¦ã³iZ ø¯ÄìZC°xPô±“àÑùE?D|ƒ#öâ]o³ÐsgbÒ ±kûÀ##‹IÖ>ôœFÅ<ÜîfŒ„C²{2[«'ürqc±Biœƒçx0åÇùäÀ@44YÐäΊ“|KŸu¯ÇÌ-ÑÁ¯Pèò’ÂD=ÈÄ ÉÏl6t‡¤‰£XX‚­%Òå¨Ü_ ûÆ6Šþ~.aáòï¨Ñ>Èä'Ü6P¶U»ä#ÉNü#¡#P[|‘uþ_ö-å0”¿üc,Î 'Ëm¶y:uQA¬,5ž0^/½|ˆ5¢‚ƒâ3Ø”c’G¡ƒ¡•'å^Âc6~@3*Q6[¥(~ýsþ†`g]MZn&í–­öÌš4yMÂq„É=­½ÂéÛ¢[rËöô€ ÈÙÕ#¤bÌ–±½°Æ<=`gh‰4)&¾â.:‡Î*¡ŠT&J„éuI,+]„A˜+?¯ÛC”`V­ wE#*{]nvã™}äª0Ï¡»mêES¬ÇTÁ@féljÿ!¦( Œ1®^Ó-ëz>†) -òØ*Õ}o^6-“oÎKµEs®7÷û¦Û†®´Ï‡¾B8 °µªªbòõŠw€ß¬+ã)‡ٖꙋ؈òMÏ ‚ì÷Ï!ñSžøY<äE¬†d$@äNr'j8mÇN•¼ ÷¢0+Ò®L“Ÿ„ùk«lÐ ¾³è*6®é°æAsŽù²áj³bÚRl$ögL]¤â²üŒµ&íý¢šs€fäQ{3IB!Òa*i}„.œ9ŸÊW®vp]ã[:”3¾ Õ ^Z[ªÞÕ|åÚöQ¤E­j#»è#'éëå²æ†5%a´ -E¼ÞÓXѨaô¼²n°!úæžklÃZ.2¬±Þo|Ôä›Ã+k¹þŽ2dñ3WäÐñ+r „WÇ®ÈO.'Wä§W“+rµýZ©_ºfÊÙÒuO¼Ý†Ó=ê}Üõú':»_Ž’n¿^‡Fí“5 h‹aU;´bôŽOÃþÝEsÙÎ -ÌñC›AÎ  Q2¨FŒr2 ÆÏp²:ÁI:ùØáär–“'W³œôVkv’ä Oˆq2¼îÉÖ”‹r^AL†fëëéíÕ|Ø -b¢+Ìq…H1FõƒT0qߎdº`€ZûäÇ_Þü~@#XWeê<Šzðì{¼µyí2µ¸¦2¢æ°Ê$A¢R·"]Ï¿{õòíÁÖèMÇ_´5ÁõÌÖò<Ðépk×/_ýøÓÍá˜Ù/ƒÃ6#,ÀwK–¡FÖí1,ê4îeË®iÊM÷/ˆªz3‚- ‰ÿÛ¦n›ú¾Z•o«¶Èi¤Él`çû4JÃSËYž\ÍÒÐ[íXÅ"óJ#ý‘²w‡A¾vò l;É°"4zĶ”{7 çV RLšûçZ’iÎyrá=^é« Ö7D‰-—”šA7º’ß±½Ù2yÄñ¦ë—7Ç0%ÎÇ9²á6ÉFYm€Ãt.ÊÕd]<Ø| -žó™oxè꾱̥ù1Ö?{L“ 4ùàÝ#ÕdrzdÉ Ǹ맜¯ŸŠjE*ävï2«PW!²Ö/PKzí²p— ¼Ôªü2ˆœÚ^âJØÔ?|*Ý£6˜¬eß\:3^²Ü¹ž+¹^mË3ÃÎà› üá:;Ž/:î&^Ø»s È÷<¿µÕyÃ"Ò–KpBMI -qê„j*F Àal¥eSvk÷ÌíTÆA«¿†š,•‡8°zŸ©"öÔa£lK*ºéôŠë0ìw‹×¹NVõLìâMîUõp˜©7s˜±9McþùS쾡?ê0WQ~eôw&³u0ve%œíê|øÚr“ÂÂÈ,:v¬Š·ÿ*UG½_¾âk°\ܱÝs‰«¨ö+€<¶ ›;{:ºö«ª² à…Ôuñથ½¥„ŸížÔÒcjOj/ü‹ƒh4îƒÿ™êÏ_Üßù@”é#ÁcEŒÙ½P ¦ûûƒNnø¿u+“"endstream +6483 0 obj << +/Length 3274 +/Filter /FlateDecode +>> +stream +xÚ­Z[sÛ6~÷¯Ðô¥ÔŒEÞöawÜ8ݤoâlv§í#Ñ2'´èRtmÿû=7€¤(9žm'“¾sAÔ,‚?j–ÅadòYš©ÐdÙly{ÍÖ0òÏ#% !Y h~¸::ù1Nf* +ó(Ÿ]]÷|âÐÆfvµú%xõæôòêõ‡ùÂhÎišg¯ç*øø3üs5_¨à=4.™äòÃ\gÁûß¾{Í秧ØõO y}Žó.®æ¿]ýtôúÊKç×Irí÷£_~‹f+ØÆOGQhòlöí(T0|{²…±5ò]}<ú—gÅcvƳöiÂQ@#Ìtö‚å@Aqï].ÍB¿²¡I°á–P¹øÓIbмŠýé$v¦T˜Ç1žNÁhIëÐâyÁé\4 Ï ÜÕ©P'i&™BŽ³ßg*Œlž&´Iø~OÔqòöVÍÎs6TØ.|IR• ìHé=ô%Q&ÊÒñÚÅ€w±Íƒ3RÞuqO§$Á%!v×¢¼$ ®›¹Áƒ§ÏÕfßQð°å9ŸÀ8· Ï­û¬ü= _¹x +Ýq…©bè>ÿb +"‚,x²[싃ü‘ÇNðÇç%wDÉ}WöDGÑãÉ.™–-‡¼‘•ü]ðÏ +5$¦ŠßwxüµÅžë¦e^°Hó´Ë®2œ'm¸È·£UF\'w¶éo è÷ÔйÁë¶,VOüQ>VÛŽN8 +N[F†Áªî +"áDþùºa5Öåj]2{ºE0ôpã0­u‘2Á(é¦f´Æï;1 ЖPÁHÝ6-‹n(]eE†ƒM[ö»Gl,]b@¶ö«SnWtŒ ˆ:qG€¬mâ÷D<ÖØ—òþqCÕ±à†)Ûr kŸ˜æ+Î*Ÿ¶üUÀv â’Vã¼¾+:arMçw+BÞ Lý)L„…eÒÀ ¦{[—3$ Âïrp€¼]¹Â-[ØL'„‚ÛV `7¤¡mõÅu ÿÞ2ú#ÙªBË|’q‡šiàÎ%€ä¾ÆçlmPX7·ÖM!Si!û'Õ;‡eÃqÙ²®H£_Å}ozO=•!סŽ”p{‡° îcyâx1ð ÷Ä.SY2ˆ/µÌ®–ìzáHHµµ÷|½$S’4Ô^KŸÅÈ€@lcx¦ P¦¹ÝA¸˜åfx‰e*&dÄ*Q½Î¬I% {Æ LZ§çO| `©ËÖƒÓtĆ;Œ×Yººrº°ŠOŪ´‡•Nn)tq +D—éà>ÉmpÖð‹ú°}MÆÏž¨ã:!ÛR:ê\˜U™@p´˜h6NB%#KèBmÖœ¬=6±¶{ã‰XÇ~]l÷ÎXá±·#DC„Hõ!(~Bb§1dóáLâÚ.ÎÄ,‘-ÑÃsʬ³b¬4 É:÷Ýû8³4rL6EV+ìw (Er¤j¸¨¡3fÆ©7?£ÄÿÝõ×Ja’Î ü&ðûÍ<Ò„:Ý_:Z8^‹³©gWl\»#"dxÿêôÝD´$ +£4ùkD^ß-1ÏŽE;§êÛ«7o/^óaY5¾ù6³rX›ëõžóTI ˆ\”Å.·˜r´ ¨y9ÃwͺÙ`, +Áâ{EŒzsˆ$1ͨ(ƒßg8ö™Š‹θ‹jOÞ%ëØ s©éý  Ó0‰r%¢Æ7[F?ü¸IÛ‡µóènQ|HVucŽÑ¡È.L~6ÐøØ|7Ö 8d¹Ä}l®¤²ò†Ñºgv%ظò§­”ðƒæA +[SÔâ¹òÂð€³/`¬…4'üy^þãÐöÇ">¿ýžæ` Á $ŠS€ÏÃXKkM¶ ?ãtÔÍ 5Ú#ÔZÑqá·ÌØëã(•u`ø„¨¬¿är +Ž#)þ$Ž¹žâpç×ì—È'c”ƒ“v%ì(—÷ó˜'¨lÁÓ[¸\nóú¯Å€ÙTÛFªã‘º÷¢r%a ÁÎ_!šãõ¼hqÑØ‘h/@åøÛ êpöcsM‰£+Ým“ï‚sn_Î÷œCTĘfÛ\wû8Úq´>‚¥?{øAV§/ñÕ}ëƒ#®8üc-¬´öEðé2©ã4y¹ÜCWðB3N¤iùA<ò!•€.߶R‚ZôJ+)Ñ»·ê<•!}ñü +Õ\ZIh]5”]FÑyðoÿ6 +5yý·XŽŒ•8—x\p„ =0BÄ‘Py´&tUÇ¥bŸTû ð¢«è¥ƒÊ‹É´$ <|c‚'œ}.úšC\JÎd+ h þ®Ùûb}T0 +„a–åÌV{*g¶ãW’\žCrWeÈíпæv_z)‡N÷±É9­Ç‰'üs.\ ÷žD_‡öž÷2¶ñ´¿—þªŸÊÀ¨ÚÑйäÊ7"wÓ +ÓSmlï¸Ê¸têÀºÊ³ÕUBªVòÀF2 . _߀kzŸ5Ð8ÙŽé‹'¥Œùd(ãuD½²¾ +ø± +'37Õ§gÚ›µ(÷¹ÛB´.{§%)*ôï2¾gG)]§øv9Ó|a·Ü¦‹’¹½5TäÎÔ ˆjÀçJ2,WÚ†y›’šî$ГíeîÖÂøàŽG*Y,a…±³ow' Â×l¼Ï©àͦŸ<) + Q,:ú ’í{®Nê4 Vþº@S§I°i:nPçcŸwr/Å2©< +`Ãk©f®·ýí­6å±Äî¢5$˜Ä¸Ø¹Ã6uÒ÷)%ëi*‘TpiS7Ū·7òo`Ð@’pi¼Ýó€úi”윱ü\?  ë&̆ +±ƒœŸXÈ3ñ²¹“6 +ú·Îip«}5 +vÚ!í`ðµ³Øø7hÒ±Z#Ñ=½+Á—‹È¡YöÏiŽã膈ÏŸe‚³ÁKâ·……[zP‚–w{XîgDÎú€}Ðô ¢Áð¢õ®r©~½IÀW"h:ñÃ~ ÚiEº(Ó¨Œ)ñæKÉëi0gô^Å”×M½ê¡[º¤Áû„É*¬ÝJdB:é—<óèà÷Óñ(Ìr|²ÛSö³&ÊwËð¬Ç(w‘¶¬EùÐeF™˜«ìÁ¨È¦Ô~h«Î¿Fmx©Š˜ïòSÁ÷²ðèNDãÜ­IØ”£þá—‡A0è_ÚP.î"N?®q<ö¼;8åñFœùŽ®0Òkå>Oö> endobj -6032 0 obj << -/D [6030 0 R /XYZ 85.039 781.388 null] +6484 0 obj << +/D [6482 0 R /XYZ 85.039 781.388 null] >> endobj -6033 0 obj << -/D [6030 0 R /XYZ 85.039 761.463 null] +2226 0 obj << +/D [6482 0 R /XYZ 85.039 633.122 null] >> endobj -6034 0 obj << -/D [6030 0 R /XYZ 85.039 295.282 null] +6485 0 obj << +/D [6482 0 R /XYZ 85.039 597.811 null] >> endobj -6035 0 obj << -/D [6030 0 R /XYZ 85.039 281.126 null] +2230 0 obj << +/D [6482 0 R /XYZ 85.039 499.13 null] >> endobj -6036 0 obj << -/D [6030 0 R /XYZ 85.039 199.831 null] +6486 0 obj << +/D [6482 0 R /XYZ 85.039 463.72 null] >> endobj -6037 0 obj << -/D [6030 0 R /XYZ 85.039 175.46 null] +2234 0 obj << +/D [6482 0 R /XYZ 85.039 286.732 null] >> endobj -6038 0 obj << -/D [6030 0 R /XYZ 85.039 159.184 null] +6487 0 obj << +/D [6482 0 R /XYZ 85.039 251.982 null] >> endobj -6029 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F11 2898 0 R /F35 2880 0 R /F56 2890 0 R /F14 2895 0 R >> +6481 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F15 2972 0 R /F38 2997 0 R /F62 4047 0 R /F41 2994 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6042 0 obj << -/Length 3667 -/Filter /FlateDecode ->> -stream -xÚ­]SãFò_áÊKä*¬Õhô™7H–da¹ÅW{WI´F€neË‘äÿþúk¤±-‰½ÜUXšé™îéïî‘šyð§fIèz:ʼnru’ÌVëoö3?(XÈ‚ùÛòäÝQ0Sž›zélùÐïºA¨gËû_ó÷g·ËËOó…ÖÚñw¾ˆãŸœ+çîø·œ/”ónäöÓÜOœ?^}¸äë³›3ú `.¯qÝÍrþûòç“ËeG]‡(I‘´?N~ýÝ›ÝÃ1~>ñ\&³gxö\Óë Í -ïåÉÝÉß»­x.˜ñª!N„:qÃD³B…+”ò]­üYznèÄ‹ªž/|8}þ’­ñØf“ãXê´ðü$Ï8¿-sÞf«¹;_‘yËcm­rÜ¡˜ºÂé?qÃûüžŸ Šö‰>œ'Ðç†QÝ,ƒw¾ç½0DƒKòúOÂUŸÂ`’:Ùæù ‡_(äMJgiŽ2 -œç'Ø8kù¥Å™¸Gü¿yJóÆù¦#E›Õf}4â½8ÿc‡Ëÿœ‡¡“•ù©j¬S¾d²ªFü+BâŽ)‡JÝ0zC¹{’¨ï IÔK\(â(´ïnÀd2pX+f?4Šœ|^ø;Ÿq–@jþ -Ë›6k‹j3F¹ œ¤¼‡×Å(‰A~QþY d/‘•Àà ¶æA]€¼%Åh¢„÷êOæ§N!«ÛŠ'e—ÏŒ@H”ÓsÃÃ`¹2h´8½ìŒê8åù-¶S!eÞmk;*•ã^ ^œá¨ì^4úºªiEÖšc#q ³À÷%^:[«ƒá`Y¡8+ iZ&/_Ðv8r6|d²>\LÇÛå¬ -ܽ§v ¥¯«Ýã“õ.2·1˜µ¶ÍHíÉ•ämÏ:½Hßf“ .ô‘Eô‹â -ÕáN5O’K"«³bcNÇËÑëÌÃÈÉŠ2ûð¥ x@²eŸQ œ·ÚsL8@j€·–´iÁ ŸÄ ¥Vì ø  û¤¡”¨õ=F‹Ü¬vå=uâÒ¾/Öò è0løîG½g;^àz*mÂßÿÀ ûæ¸)°Øë|1;Úá¼Í½…ç‹;ž â_äLŠâ#ƒ½ D -2x³EÕXieS´;“HÊØI ·DŽ°…d†ë¢hŸ(~¡Øó˱š¸pj5楮€ÂÀëÃqà… ÎÞ£ª¶¨£IàœrBq˜iãJòaø`„ź ;Û¬êIÇqYÊF"Ô í¾ðÜ»ãˆ(g¹F›uä\õÃ4†(i¢^ì»QJH;Ûnˤ?¡:Y› ÄÁ4t#ÏDJV¥Hc샃 Äà¢ÆüŒÖ“fÂ[Ö ÞØýD¶»È›¯mµÀx®—*;:‹ë%æ(7yûTU÷cÛ¼±K$ówmV·Ìjƒ“Žü^ov|`Obqç‡{䶮ëlÝ ÑºI—’¸ì¬8‡ ƒ Å‘¢å4§|ÀwMñÇ›>.uÙ(Nox:ãŸÞg È(Š\/꘻„´¼v/Ζ4‡1„.¿§·¾á¼¨Ø< -FtH[¶Ø¬–p¢UèªdŸÃä÷­{à88\ˆŸášÝ6Œ{Ú‹5¢¡’8•Õ¤d¸OÛðz$rW³k®ã~drµ«)æs¨+_y-¥c_%uÞ§EìMÿEUÑN¹Lr6*u0‚t.žï^»H’¯yè¼’\ -Å_òØíÜÇú=—W -¦ü¸[êóÓŒKžÇb‡dɳ}Òeb‡O!È—d6´Kó„Ks3ÔµFýFŸ¾¥H©˜¤Î{N9’˜ƒ^²_š*!D½myžD‘PŠPñ«lÛ'0S=ð¯©nIq`Çú‡·q}Uwé‘rPÖ O¡šgò -`ÓN^(¬v¸ÅW¾R\ćW¯v©ÀnRåI†’¤Ä¤ cR G*e–€O]úéä^Ijå^ðR÷í“ÉK*slöûg›4ûˆŸD»`"û.äúìfl/ã)3¨7bvÒ:.Ð4{ME“–4A*x0ïÌØ=MT†Ä SbbŸ'P5 DÃUÖå,ðFºå¦…1ÐSÀA®O¥=P<">j ¬¸llÑ©ªÇ±g|á@2 ƒVˆD•e>c¨ø¾Åa·¥»ª–Òب¯ÐG& #ß·=Ù:£ÞOFiKÆ2Ú¡ðš*7‰ÓoÑ‚ƒ@2Ü2 ü ‚É–™3Þì  ¸O¤eÖ7ûôT³Ï÷<ïÝ?qà– ’?äMÉ;8Õ’£Ré4É=Ìx—O§@g¨ŽC -ùå]Ó²?níyìö+ò¦(å5í‘'qýƒñà¡®$‰ãï|d9±ª­¬5ÜÝ©Ö™ifl‡¢Î>-×wÞö0E¦3yÑú«iµ²3IÒê²ì`L9RÇÝÊìPŠÉÀ,, 9a"*e€bu¤ÈJ.˜ß$:y›NÝò_Û‡êQœÝ$è‘ÑE‘í Jc1ºÏì Ùôa(;U®I”‡™ŽRîï?Š¦­Å»£L5”ÁLï&˜.@dÏ£LŸBg˜>‰Í0ÝÂöi¿0]AIÅ÷:{’°%°çÐmkã ¯_ù*áœìe»k9³: "Ö®ŠŒÐ®Œm+“ÜrÔ*MbsŒ2Œ¬ œfF˜Ëµ׌ƒ’Â: -¢À´¤z  I "×£’šBg$5‰ÍHÊÂvN¢IX4SYÄ1“"\Ê0é õÎA2Ø¡ë>òUr`”~W¼¶¤Ž±bUè½ÅÖh‚­„ƒQ¶N¡3lÄfØja»ëuí¨etpÏ#’õ2ë»>žôÅy½dt+N¤­€5•¦^ôtls¦uTÉí¤é -~Ó0zC=Є YŽ -b -Ä$6# Û„~Ó–J»¶åûÈuOc7Œ{?— 9s•_ÎS,G秩xñ4ã, qÆ ¤ cÜ$:aÜ46aœíê-'­}7ðã1çä-Q£Ö˜ß·Ô–FN‘æÂ/–öÇ><}×E㜞îP_zÏ=­ÎÃ~*ñ-g~þ”móá.XÒu ¾`…Az0š}ÈM“0yC®=Є\QÇ£rBgä:‰ÍÈÕÂfD˜ÈÝFbÝ@%Î÷8­†R—ïø9ë[ʲ°û^JHp3.»­ù›Ž'óŽm2®ÒO¹mºßè&ŠbË)‚Õ>Õ}S|¨A>ê·çcQÉ/•u¿°ášn·å©ÌªO󒯮%…“R3á{î)UÏI'QÏ;D ²@òõˆ3|2 ÉòC©€´'>Ï¿öí®x¨vˆûræèZ¢¯„±5@Ö²âVQS|)÷jû}Õ4ÄôðnãÀÞµ?|%0ŒoC‹<؆ŸúàVÏдP¤’½¯‚ -X)ðè!_@ná*ñˆypSqGµwNW üjÚsöÇL¹^¦ša¬g"¿? ¼»Z«ÙE„ÎlZeß…µ1`b Lú@=øUåuUj UªB •Šq“óív_&–T¸Xu`ñpPsò%5ŒtžTTÖHg™zFx‡¾%ÕõœËÇøzïʪ.¾ ©6›½&kp]8×W—8~,ÿ´|/~58¨ÍÃ.Ñ“ÀºÇübÎ4Ò늉o?ÖVÆ7€\Uá¿ú^(X¿òw&C—+2¤äA¬ #Kg½>ýuåÔxÓ ñnÑ},÷×íLwÛ E®ç¿‘'¨ uýàL×!G“±xbí4O¦±‰ÚØè¥Ên4~÷÷]žuìÕð{ÕV÷’ú‰rÕ!®º»bÖ݇P÷Hzú|wá›æñ¦ßO®‚ò•dÈßãg•Òàüû±`¯4°6}#ûµ€&„#@È®tT8SèŒp&±áXØú`œ$ö]È¿ }ëc]»!——F˜w&¬tñeÕ·<œ}ñhâ0ʼ¬š‘dïû`€oYE4Äx´:ÕíD]'o”óSø ç'ÑÎ[ènºOÇèÌÿE‘€¯Ò¦êøøuH.‰u Ü'®û…âáõÿ·Øca61É fæË«PÕΦZ“uÊÿý¼¿B -­4墲î!lÜÂH[_ÚEewû‹D|ëéÃâ9Â#Qö O|ÙW¥‘î?€,¤&AG·`‘U˜ -ó¡-¢_à*ízØ÷Xa´÷uQ↾1«yKYÈPûW¨®ttt¹‹,-‡Êé„C¢ã¶Ê½™ìô?}Þ7Ü!Ô#ýöTÛW†jSyÉ!½æcñ#‚ÿZÐú7endstream +6490 0 obj << +/Length 3207 +/Filter /FlateDecode +>> +stream +xÚÍkoÛFò»…P  T —»|¸>ÛIÓú‘³•+Š¶(‰²‰È¢Ž¤ãøßß¼–ZŠ”ÒCŠCÔ$ggggfç¹+5 àŸš¤‘èl’¤Ê×i:™?“;y{¤c*(S石£Wo¢x¢? ²Él¹¥ù&Ò“ÙâWïô‡“÷³ó›ã©ÖÚ ¶9­A3TÞ²®v–XUðL½9«„@/nŸ›¶xÀy7¬E-|ßÃ0î72:)ëbNâW8ñ™Õ«¸IÞzI+;r~ФU‘ t GƒÉÔ¨1m¬6øì#ñL Õ…|ýD†?Š1em·m –Eóúö>òNu²¶^ÖeÓÖ9Kð=Ï<±‹} ¦Šº‘³]# vŸ¤&Àžd,ö ^Ç°¤ Þí–!‹’Ä°œ>#ÔxsPX¤x• > <2ZS´m¹¾kø«½Ï[~ËkY{^=°´80¯«FÈå$)RAŒçnÐqü¿&ƒNH ÓÙÝ3Œ(a˱Ъ¿Æ …%ˆîJyy-î ‡Wô(‘3¶rÆlThɼÉMþQâNÞX¢°&B:_‹bC!¨Xãë;¦ÎÚ‹(Ž 5°q‡Í‚U€[#´;`¡bm¶âáõ«y]PXP¤¦¾ ¥ìÞ÷ÖŠ‘ƒc<ºPûÄߎð…¬ Q5-¯*ââµ(½bBT2…ÉÚf +$æ*m´GËT!Ül8O Õ F)FŠûwÎ ò/xÒ’òËÃë=‰2JR?Ô‡«!‡e/ª’ ;B¨^à2Ù]O±ŸFéÁ-Î`Å~tU¡¯UØ[щ.½@ ÍÀhöè!R¾ÒÙa=lqèA¾ª‡ nõ°³â¸œÏœZà ¶ü#ü\b†‰œ+e,Uk4àmœVÞÚïÉ1d±™%,¶JéƒÒ¸`˜hxf~f#®¨#NgÑ6è0ó‘õ6xs¼ ñežõ6xx›ŽÅÛ`ð!çˆAyªàAÊyü¡lF0~> þÇ~ˆùªeáËs@µ*¬™ù#ZbÙ"'Ï#1nQ=äåÚª[\h£¢«ÕŠ%àxi÷¯µúÚlm<¯Çæá[8JI@Ï.J4NÜž·®Tƒ`#¤# +à+àh_@1à•J‡ÉÁšu–úlÄâ –”¿Ï‹­ÖyÑÁ嬹ëq‰‘e®6/”bœFmUl„ ${[Ræ`Þ¢uQzËp#Dežä*ž#ÛËP™Oæ¸à±.\³›2Jgðž`Is÷ÀÅ?o©:Dd,Ïî4&‹ÈLsÀ—Ç^XUÞKw¡ùÔV†m±*t20©™ÕM†­sªD˜+“‡"*ÎÞ o%LW–ù-UëôT}Œ)ö5º*=wVæ9er†U–Ȳ”j…µGy‘ºb¢í¼±‚Ö•P«Š¼î4FÞ»%·]P¬­ †¿¿”]1Ö08ç)ýj‰ZKl”kk¡8ûí¨$"X¢@á¦ÐŽdÒ|FAÀdñe[$!ÂŽ@‘…Èk;Mú¢»käÁ€ù¬¥´Q ÀíuÖW3@û!KF,§ žŽl{×õÅ:ô£$þ†¶x—^M¨ùóMè‹·xtƒÌ_`~;†ÇzëJ¨,$C¯C`ëæVÄÜ›AˆÏ¶±Hª-efçLÃb‹Ò¹ +?Î’žFmI 5Ä0p +·Õl‘Ó#‘´l¨ã»¢’àÏ©q|[hÉ1Oð÷$4èËýð+ç…ÎÞ„fqèloB;´Z—Ð.gš»Å• tvQSÊÐAJC §†Qsí„„äDœÜ„„Hèez.ϲ}É›‹tv3Mv¤©ÐÕ¶l;lŒ»f íû˜[Bdê°[nqö»¥à $z¿[Xmë–‡–ëÜÒYÝ2”ºŒ^®Îg×o¯¯ø«¹çºÒêºe ÀòG6>öÚ½ +µN3Y©Ÿ©¨†}žTŽ +PøÜõ 5ô…£õ#®ÈîªU9¶¤Éq†é×¼šVkÉwþûë ^|'?Q´ GßÔ‰t6Õçh)›UI¥RªúÛS®Ý}Û›Lœ8öDíŸ-Çqfi—Øl¨Ãq(ï-Юøéü—ÕÄÆÂd¢~ý®FS[qàц>¹Jºè€(®DðIŠb.dͺ˜RÉä4<‘îÈá8 dí7\VÚN‚à +|ŒDí'C“øIcdaZS‡ØXd‰ý,ͺ¿[Âè/áMHf #K†=Ö¶‘%ˆ<÷XÓ¹ô°—/FÛHø‘.¤$»{²ÇÕ‚‰p’åDqŠ/Å—²‘WêhÓÛ¿+dC’9÷JÊø¡r³ˆMï&æ3Lƒ‡”’+ïÐ.!WÊpËÏn“lKØ/2Hm0¤w”Âd=ÜHj²÷¹uu˜@Žc"1Uƒ!¢ø\Vræ…óvS7<.xœ›.߆FÜ´ã׊÷ÅjçÒ–Î6 +¿©1FüPHç¨ÒÍ¥t›¥ôwŸÖt&«?ÙKR)˜!";”„Ô¿r9Ü¢šqZ(ÆáçX­?Oó冀iõζù‡ ‘÷3;-˜'9”ËÂ+2@ÛNoïìŽÛ@:”›bÚ³Š ÿÌñO¾‘šH>2JüšìYÄMG2À2sHÐ(ß(Õ)e™‚*ñ}±sJG²îî8J+9†h;è44ÿŠt˜N¯5•Ö$Ò~÷¯Èw1Ö†EŸ€Ü«S>sé';ò•Š£Ä†$d9(FðH'ˆ^M€—ÓM%óY7¹X:±Ò%^¥~šd=uŽÝT4Ì‚ýMZ«˜,”irÅ!eM&-7N_¸sÓ!'Þ¶êkéâð?Q“òÜwó‘æ\yòûí*B”Álç!X²ÿqq}zrñÇåÉéï®ÎSÚÜþr;;¿¤·jÙ>AlÆ÷îV?èJx¡…è¹:}¬ëbÝþ»¨Ø$„ Û‹/ýî¬XmqS‘æóûâ»,žªzñ:àÿÔˆÁôù‡-\ŒMŒ{§Ær œsA÷=F_9ÞCìޙ׊aój#ágc·V +íì[öPîkçIÿ½Î1¤“íÏ\P¾®Eð‚öFŽ6 `OÒÑŸØàöQº÷4"ðÃÑ»Ü`"ä¾é÷zÛ›3 ½Ôžû`(… Â°¼Ðy†\?G:õ£Tþ/“âÂendstream endobj -6041 0 obj << +6489 0 obj << /Type /Page -/Contents 6042 0 R -/Resources 6040 0 R +/Contents 6490 0 R +/Resources 6488 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6039 0 R +/Parent 6459 0 R >> endobj -6043 0 obj << -/D [6041 0 R /XYZ 85.039 781.388 null] +6491 0 obj << +/D [6489 0 R /XYZ 85.039 781.388 null] +>> endobj +2238 0 obj << +/D [6489 0 R /XYZ 85.039 761.463 null] >> endobj -2158 0 obj << -/D [6041 0 R /XYZ 85.039 719.568 null] +6492 0 obj << +/D [6489 0 R /XYZ 85.039 743.459 null] >> endobj -6044 0 obj << -/D [6041 0 R /XYZ 85.039 701.095 null] +6493 0 obj << +/D [6489 0 R /XYZ 85.039 503.109 null] >> endobj -2162 0 obj << -/D [6041 0 R /XYZ 85.039 426.274 null] +6494 0 obj << +/D [6489 0 R /XYZ 85.039 407.659 null] >> endobj -6045 0 obj << -/D [6041 0 R /XYZ 85.039 405.073 null] +6495 0 obj << +/D [6489 0 R /XYZ 85.039 354.068 null] >> endobj -6046 0 obj << -/D [6041 0 R /XYZ 85.039 380.702 null] +6496 0 obj << +/D [6489 0 R /XYZ 85.039 299.871 null] >> endobj -6047 0 obj << -/D [6041 0 R /XYZ 85.039 365.032 null] +6488 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6048 0 obj << -/D [6041 0 R /XYZ 85.039 351.483 null] +6499 0 obj << +/Length 2975 +/Filter /FlateDecode +>> +stream +xÚå[YsÛ8~÷¯ÐKª¤ªBÜà¼y瘉¯­ÌQ3ó H´ÄŠ$z(*‰ÿývà!ñ°¼¡¶¼³å*‹FãCwhÒAt`$ x8ІnÌ`¶>  ¨y}F=ÅØ“Œ+4ÿœœ=%Õ€$ ÂÁä¶ä#‰|0™ÿ>|ñæüjrq=s·LÑXk3|y1¢Ã›Ÿàßd4¦ÃðpåH®®GÌ ?¼zûîÂ\ž¿?Ç¢×@sq‰íÞOFN~<»˜Òý‚$!Šö×Ùïƒ9 ãdz€ðÐ ¾Âs@(T¯Ï@6"÷﫳›³¬\¸VMšÜix]T6¨BDªâãfÒG8àÆ&Õðµà‰7ð2Op¨_·X¦a Â=ínáaº[e®Í*|6Íâ[ûf·‰g?KÖØh •ö=¶É.YN[WôG ƒUü{\k”éÞ=¾Dþz8Cú[nщ3ß×zŠo÷ŽÙ'+N„³ªSÔdh‡žFó¤¶ëYÍ]ƒ,q¿S÷³‰2;üt +c ÃÏ®|‹­–8ô4Ê{*{];-Ønï­žýÒ“ß&+(]9å"³*U-âm–znN÷¶K«¤l8YFöÕ3›¡xVšÍ"ª¨A;d‡¦”ç:ÀÔƒaÃ/1jÀp«å¢/xOnÝo¶ù2€ ÚºökW}…B'+Ô€¬{WŒ‹egðß"Jpº­Òáyî·þ·H”Fíâ´ìÔ +0Íå½ínç^fi4Í¢½ +ß™S÷f[U„´zÈ" ¥;œ×8àß²ê›\±…o <®áçšÜYMÛÉ‹×-”f®Z-¸Çéª@‚­YÆ[ÿä >YØÛ>”e“l¢œQœìËI^|KÜÓ9 +ž@…ïø+våWIy—óR<ǯeè½òX`úµKdZ)°@Æ0"ZÍe®næ,Ž×+‹ü¨‹²ûC-wÛÂZÁÛ]šxö«èPDiKœ.'Ø2^yÔ€Èø˜,Ô ö„S?ªX F ÿÔv Óݦќ,Š)Î8sŽÂª’Ãä[K¹—báÀ³_ÚŽÚu“yeøåî{bš`ü±§ N°`bx]X ÁøðMüÅ›L|ËͧіnÑÛI@«éê}Ko*–v*¿Ä * uU8£ø‹3’¬æQºuì*¼¹3ˆXzg­c¶ß4<Ì£Û)r_y˜Ú´¾0ï&v–W‘Ó“3¹ ½Yâ êli1§GÁ¡׫ƒ¥Äh-$4·‹êk~ꜟƒ‡8Ÿÿ¦âÍOhÏ~;ôý”j*=P<.e{N˜nöýãœ×¸Â¬îÚ)£„oωl˜óñúoŽO¨ÖDö#¡åô€|i`P•ïã Jv‚=%h…š…D…¸#ÙæváHö*Â÷$7É­]^¹£ž:ËRg,àI<Ì7'¹,¼Wšl“Û¬‰£ !èýh–Xk`È7ö»´ˆb6úìç8ºÈ™ÛØzŠ†n4#R«ãå¾øœîVIZ†‹ ²S@<žéÇmÉj0JcÔžU½)Œ¹]ánI¾÷ûSŠ‚K´.Ž +ˆÝs3ö4nQ‡¥}åŒ §ÎÚ¹Êm+–/ãêÛž¥Å‚Ü*Mã<F«èêlXP8B(°N’¡ƒË’5øÁDžÏzº™.lX +/¥ÉŸ.lRr/Ì›\%´ñaqçÕ[?®4ú¡e»"eHDHëö@&=àû^³h¾aÓÚ¶*FÃÀZh ¿ +Ááoż0b2cÀ / ŒbU\yªœÈNä(„8þÓª¼Ân6À@*"TŽ”šnWƒJç5 ±¾&Ýÿ*‡=à[ÿƒÑó2Z­ÜÛ+\¾{è¶ÅÅÂ+vœWv¸.š`D_F¸YíJŒOÀ†PKÓ4ÆÚX9,\ÀãMÃ.ZÜpË GøŃk“‡)­66¶QlÜ“§>ôS̸µ.`%”-@€É’)ð»v¶ÞO×QÍ}†è¬äõ’yfÝ’A4J”í²ì%FP«Üœn~…¸™ØÕä!Ì1ïI^®(XjÐdq"ñÝ“+ûšÛÀ€‹×-Qø •À$BÎï0N}9ͦ­S\²ìcŠ»dB‚]ÜðY'ñ@ +òèg >/JÍñ.Ø ûk0@h@Z!Ô‡>N¡Þ샨¬Àüà´pÐDH%ü´îü³ÝÌßµaHôf"Z…c +-³Þî´ØézÑ«µ ŸT %lÛô@<0ÐW°³:³±«=Õ²1¤§ã,Ú¶§ì ðt‰Ë”$Ü°=qO  c•Q@©e]²€AÄ+ö<ÝÖî:Åç ©ÛLÐÓGù®õ¬—YêÓÁBì Ó $tÇï‡8˜ë,Ù÷e/iš\¢4ïÌMä xV½†å¢óæ˧Ù,§$õ»WžgDAí~r¢-²÷¯œï%åTóR°î0E ÝõÎyo[Gÿ§i"œÐ[Oi"fíi"9 +÷îËów5ÑT@XN½ˆæy= šâ„‹}Ñ.m–í‹7oß_4­xXPæÙ7Ö6M~QJ‡ç×M,AjØß.A$-3âþ§DÀG €Æ "MWèþÖ»X—&¦åæ¼1ȧŠÛò(˜‚ EÓºé+‚°äúQ‰FZÚ1“±Š–ûoO•µ'R°–D +ÝšG! Ñ” *ý×s)`, †û,ªIþx¡ì/ +Ñ_6Ý‘B\ÀAŸe/ßÇ:fÝ2ã) N]Uèg7˜Án¿ö§áYS«%yŒù½ªMævü19‰çyžPa›“ßÀMhÓÛe®4‚(ÙÓá µB¤ÅtÙÐacZp>m°“e#̯¬¡i9ýö/:èâÒ2L¦T{âö pÑ3ÀyÀû@wÇáyí¦æÈîˆScˆiÛ}…ö¦P2VM#¸1I1;âHËa³Ò[@ï”ÁW`—áÿÏmùqgn9ð{™«=ä‡O ù¶`¬-¥ ãè”  ñ»‚6äcpÙ¼T:éð]"³À}CQù1xWá߶Ÿ +ð«“Âb=ö¥¾=ØVÉ: é÷º%¯4íüЛbz,-ýƒZwzYž Rjì@P×°I•ÔÍñ«Y /ñÃfe?lž'#¸¯½ €Á·ç¿º æ =Å—˜nÑÌœæ-•˜²Ç¡â™-oIwÀÔnFÃò#T.L dþKqGTøßõìòvendstream +endobj +6498 0 obj << +/Type /Page +/Contents 6499 0 R +/Resources 6497 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6459 0 R >> endobj -6049 0 obj << -/D [6041 0 R /XYZ 85.039 340.055 null] +6500 0 obj << +/D [6498 0 R /XYZ 85.039 781.388 null] >> endobj -6050 0 obj << -/D [6041 0 R /XYZ 85.039 323.778 null] +6501 0 obj << +/D [6498 0 R /XYZ 85.039 557.499 null] >> endobj -6051 0 obj << -/D [6041 0 R /XYZ 85.039 310.835 null] +6502 0 obj << +/D [6498 0 R /XYZ 236 563.472 null] >> endobj -6052 0 obj << -/D [6041 0 R /XYZ 85.039 297.286 null] +6503 0 obj << +/D [6498 0 R /XYZ 85.039 262.8 null] >> endobj -6053 0 obj << -/D [6041 0 R /XYZ 85.039 157.817 null] +6504 0 obj << +/D [6498 0 R /XYZ 248.712 268.773 null] >> endobj -6054 0 obj << -/D [6041 0 R /XYZ 85.039 147.124 null] +2242 0 obj << +/D [6498 0 R /XYZ 85.039 145.513 null] >> endobj -6055 0 obj << -/D [6041 0 R /XYZ 85.039 135.696 null] +6505 0 obj << +/D [6498 0 R /XYZ 85.039 107.982 null] >> endobj -6040 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R /F56 2890 0 R >> -/XObject << /Im1 3957 0 R >> +6497 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F62 4047 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6058 0 obj << -/Length 575 +6508 0 obj << +/Length 3178 /Filter /FlateDecode >> stream -xÚ¥TMSÛ0½ûWèh,´ú°¤cZš÷D9¤±òÓòï»+¹ŽÉ¤Ó™2™$ëÕ{OO»+øæ Ê3ë€+çØ|•v+ç ´ˆ¼…ä=̇299+4Á½ð¬\ìu ×F±²ºM?~LÊáM–+¥R©y–[ëÒÓaéô -Ê,‡ôƒI„Ln2éÒ볋ÏØ ÆJ#f8"Þ¸ÌîÊËdXvîº}щ'kOÉí`ã2\yÇ~b,8àò*AoÜhÕ>/“iò¥“ŠkšEÖ±JhYpi1ˆ‘úßÛ)ã¹ñÅÑíD¨¬3wHebԢߪä’+,/¬áR˜®=V2î¡öX^xɬ¶Üƒýo°¢;jB}XÕ.$W&{bÀ…ö^EL/þ÷Ç -‰“‹°Ó :eoÌFݼ'Ì‚ë͘‚{m™•€Ãä‚Ù¯k4[ÕÏ8àÒ1¹.1s"¯(ãÓÝCƒ—¦ 6‹ˆ]ÍÖ"g» ÍÒókÌnÃÃ曽¬›ÈXDļ&õ&âB}2ªÑqùÑ”ŠGÝÜÍo†Äõ=2¤²i´âdèOž”è5û±¤¨H«ÙŽ˜xc4È´ 2»z$z0Xo›˜ªê懩m¤ž@/Íìû2ƒ„ú­-pƒÅïÍÐÿO$ =xËr¢ù÷]’\Z¼q -§[kn 8v-ñ+ÿ®Ûß½æ´âNùýdšÞd)¹Ï”à2vZ XL£7Nµ žáßa)endstream +xÚµÙrÛFò]_ÁWÀªÆÌàÌ›ÖRgcÊk1ëT%y€IˆÂ$Œ¢¿ß¾fp¢d·\6‡3=Ý=}wÓjÀ5K#?0Ù,I•oÒt¶Þ]³-œ¼¾P±Eæ«‹—ßFñL~d³Õ]‡'òÃÈÌV›Ÿ½Wß]¾[]¿Ÿ/Œ1žýù"IRïêz®¼ÛÂ?«ùBy7°xÇ ïÞÏuêÝ|ûæ‡kÞx{¹¼Ä­×sýï-Wó_Wß_\¯wŽ.p’!k¿]üük0ÛÀ3¾¿|“¥³X¾‚ãÝðæG¡‘ïÕÅíÅ¿*> g|kJb¡F‡_@Ñ$¹`¶P:ñó<º^Yð!§ŸØߧž8œ)ågQ„êÉ?T ¦0ñ3’z–5´Ec¡ +t +³1Î~›)?³Ì0HoMÌw¢—ovjvU—³£‚vÑÃKœª´gHJg~œD³Dk`>%VßÞÎ: ¼Èm¹¾75ÆÃ÷µ÷‘Δ÷]½ã'Ñ·ëMÙ–õžoÃ…NðHyG>?pSÜå€äTµüýÐ6|@{¤€® Tˆ Õ\ Ú¯$ó>žZ¾µÆ]ļç»È{Ý¢¼IÿhN=ñÏuæ5mI7J;ä-2‡øbø4ð€Eg·ŽôXºs‚í¦l‘¹Çyjv*Ý[}!µö(h…ÇM]î·ýEò µøŒå\kBœzE~"Bi1\}'ð÷õQ@ÑqëƒUò¾3d<'EV¥eoߎIæ-o¼º\ònÒ3ÁtÊJ·bô ­¬Îžê¨ª·èFe=›¦ÇÅ‘åL<^ŽvSÕøÀÙrúÃã ¬wÎAKºÛ6ÄsÍ؉Ú¯›"oí]>ÚVõG„¯økß';; ¡‹Ï™_Í)„ÅxGÃÛk¼hÀ¥Zþ¤4õi{Ïð`<¼ È€¤EØxMÒ9$W!¶º*× uóñ?VikRìýDÁëwsÌqà«òÇ‘6Ì"_…ñ¬‹Ý#`¶QA2[¸ ö׳S/«@6º ÖÑÓ¬¡Ÿ°›|¸wÆ‹RˆI·&ñöÅ/H°Uñ•Ùp  +GŽO$Dñã«3aÿkFI!uü›/zÇ°»|¶zOñ¦à=g°¿±Œ¢uäle€úÀ†¶.—ÈïáƒWéBÇ”ÕÝ‘ì8 ½B¨oêå·¡ê ÍÄ~ +Ê èÊþnË ¹ªØ7±+ñÉÓ®Øãƒ[‰ª9X>E®Û¢m!f'h)Àñç‰Y~®Àé0‘8€ÈV]jSí­î%bç›Ý„«7ƒqHà ÄK”ö#àƒ0|ä±®rÄ·¥z›Æ¾Š“aîôG1ªf‰t6gåƒúº³J/ÅDªa€Ëñ•ÆâD#Õ—`g;¤nÀ}´5gheUñj[å›JÞäNÖ°­!µ(Â(ŠØÊ~’6 y'¡˜"*¿¡˜°·ú@/Ø¡ìN~I1x»É÷Ûbד +ËùH*[[®(ò§<wærçwŽrôQX=¡Ô\e gmmª¥çü}30§¼ËÖM.]×üYX*Àú#gbòv8ú@„ÆŠx*ŽžVŒ·®ÊÂ=¾? j$ÿI‚ hß·˜ ¨Y:Å¢ÈÙ,ŸÄž(îQJÉ’Ž)ÃER\D,&ø”Lkv°õ©)¹~HÉ|éZŒ»ø£…jËĘ(¢»ãOç>Ï„êÖ'ÕÌHJ¢œJ¹LÄ Jš'û×6Ý{>ã4 Ð)+ç °âgåÍOï%y;,rþX|Å^ÀϦ8¤¹ÄNpõÃÍ뛥rÕQ# àúS%)KHkòi{*Æ SöBµ† +Jb[fƒÎ€ Šo€Hšyoö %¶Ë±m )6‡*ïüNî¿ 'Übsû~®”òþ{ÿb2e@Œ¦à sÆò„µÇr]úŠÿDêôD‘9Œ T-j Ý»¼ +`KÞ‰R( C!WüA%*éá}~TbÒŠ<6WZh¨3¸¼ç/\ í•íe\‘p§¨!…Ü涇£>Œ7Ü^Vt{M÷èš"#Ìh¸8î>úµ¨ï½Ÿ1a¢@­¼_ßñ>·Í&!ó'BõÊå5©žqH'I ÈÝקjÃÙOšp>X÷ +ÏKXy>– \zù¨ß×A6¹*’ÈvsÄFþÅëĸ~6Ýà ¬óª:×B\õR¸ÍŒàhïùZ„6ÕHöLû¯ûÉÿ¥‘Ä8Š½s¤QÚO’˜$ñ†Ì(¥ZôTy§W)÷+¯­Qptƒ]™¿ÑÒÐQ–¶ÌÀB–2êÉpܺ“Ò€SˆN½vP†-áÊt±JG]•ˆ%ÍSødÐ)è^b²<á<-ãæ~Y7U×ÞìÙ5¹ÅÞrõß땘º×!ë^«.Ì}ÅÀNÇOm}à½Qˆpw_ŠA÷\@'ž+¿ëFܶ¥@P:’ÿœ>ÂHHzSÚu)úïPÆZcIY°`šÛÒ9iC ÛSOäÇ·D›kPŠ'p:‰6V…m.TèØ Ši2Ì‘‹.½a3&4ûîÆQPº 0¾hÍgüR8ÙC7ÆNyÆ‘cc{(ÜìÍ;‹=ÅŶØм:¾HÈÀ61{´rÄ{èÓ¸{S¯ì*¸ O¢©xÁ¾EuF+W_@;sè ù9G†ÁÁ@.ëÛœÚ[IH¸Óól‚Ñ*[è© Š‡øúˆ£6j™’‘«Æ½™%Üë©æ+™VþQ;bÈp»K3¸Í-[+蟙Bv­KÒ÷eúÎó|n‘ìh‰Ke¤þÈ@½® šKj«ÎLštùZgiÔÔuFG[ÒKžÚk€Èóö'0Ÿ3¿3ÔœõÈM_œµ½ZRøˆ=ûs!®[û{/~q.zW7k,{Â(é†_îKC¦‚/]®m¥]Z‡FÈ«’ÿVYCðMCìèôëeñ¶DI‰Ž#ABªÃÍÍp6xnÊŒ1j?2T¢=-Ù »0õkð׎;b%%ò¡Cï}a3H¨÷]÷PøöÉE19îDŠ#`iŒŽFnK©7vB> endobj -6059 0 obj << -/D [6057 0 R /XYZ 85.039 781.388 null] +6509 0 obj << +/D [6507 0 R /XYZ 85.039 781.388 null] >> endobj -6056 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F15 2876 0 R >> -/XObject << /Im1 3957 0 R >> +6506 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F41 2994 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6062 0 obj << -/Length 2861 +6513 0 obj << +/Length 3331 /Filter /FlateDecode >> stream -xÚ¥ZKsÛ8¾ûW¨æ²TÕ&>sÙò$v63Çkk+Ùš™-ÑË©)+þ÷Û€¤mòV* ºñ¡ÑÝhPN|ø''I(|NâD -$“ÅæÄŸÜCÏÇi(f†dÖ£ùe~rzé‹ÔO'ó»nžP¡žÌ—xïÿuv5?¿žÎ´Öž -Ätlj÷á|*½›ßàÏ|:“Þ(\1ÉÕõT%Þ—‹O¿ŸsÃç³Ë3lú4çŸqÜå|ú×üדóy+]Ë$IQ´¿OþøËŸ,a¿žøB§Éäe_HèÞœ€l" ´©¯OnNþÝNÅ}Á„G !¨H¨ - -hTpœS¦Ñ ;2‹”2ˆGç¡Q>ÌÃ%&O^Ì3“R -t,R·«‰”" CÜ )c¥jHÐ]V€iƒÛ¿ÄÕ’Z‹4!d'O¤ðƒ4ÕLÓ+Óº…QÃ駜|¨@ÒI'¬N… -£‰U -GÔM†‘Ha•³X†"Œ»åȤ§o2öÌ2±D¸)^­"NDE“ÞT¯ùš#ü’@(õŒÝ|èõt¦Ýþfø£¼š@]àß=PíŠù‰i¨çXX"Pú-H´6ô:øË. aò¦ç°°sKí‘„†uE2·6½6U9€iž-Vhæ#pY‹UQæä:”÷ FÞqG+¾JCpˆ07¹’†{É5â/ê R æƒöuìXV– ç!wÕ="ùê×â¡_½¿€P:” ü(˜¨üKX{(ÙubMƒÌ4a‚Ž{ëý.çR³Ê[2Á8 5h4ö[Гµr¦‡mÎ5¸°¢kͺ]Û"…ÐËj“ÑŒºçS©öBŸÑƒ¿{>™P,ÔJD`ìáZh<\³D(¾ לül¸ææÇáZŸÝ<qظ8¢P*ˆFÒlCÝ°[¦0E<ª(-%žÉfŵ̴v>xÊ&‚2¢XÌvnQíËFŒÁ¤°ÄÔvG3¶¡A†zk3 µ“#ÝãõtêÁDKÊï‡ V`C†›&›B¸¸kÜ\SŸfŠ`WcÓ½/G„°7’‘JC„ ƒq,]üZ0ü š=vó)x­'6¹ù;¶õdÐ7‹Ñu‡ \œ×‘c݆ Ç×íâ×®ÛÉϬ»Çîmjôå·Q ÎMä±cÔ9@0DÈ/ÁůÁÉÏ€Ðcwf2!ÅbWÕÕ]cªY‰†æž<ÝÆø;vN`úáâaï,ÕÚ8h~lâ<8ÉÖhVÆLzãfIÂÅ! Ú95D¸ÂxP¿P'?hÝÛ´ê¢`àâú¸w#9fšÎ–Kýô'ÛT#ë(önÊl;+J¼1Ę„2ü?˜Œì˜Nc!céÞ±ÑøŽY"d˜Œî˜“ŸÝ17?Þ±>»Õþvm¯³Ñý‹BXŽä㎔ŸB(ò®ÐÑÐQÀ€u «8IÁª#r`eˆP’t+¿+'?ƒUÝ[µ»¤¬ÆjÈõ¦ÂOŽ©ž½Ö¾§PºÎG1…ßó¤L;¢5FHàzk‰(ÍçƒêbØ‚êdh@íñûQG¤u$Ô ,‰"¡õç9¬ÚÕ;X™µ·œ>™›Ýž°ðø–ºZrÍ™ƒªù‰{mJqô&¡e(’øHDÖ#ràaˆ‘ñ«„“a‹‰“¡A¥Çïüû–®ñË!­”P±=A¿Wx+õÙš)ïñÀP–3¬Ôö ]5¥YŸýA t›¶:”`-ý ËB¢[§Ô3%#‰oUþéËà~O–1³‰ÉH‹8~žïè2’ÏDH…–éÍ߆ÐÂ`RÒf­÷›OSô†VF4!½Lå3¦*&¹ÞæŸe*ûÓ€:ËH¾QvÊT’œWSÚ ØDŽå‹x$kc?|‘ppã´KÚ Eé}WÁ__H®ašaQ€Þî5¨Ð÷n@?´‰&Ðϱۊ­ÛZ“N05ê+ÞWø'Ç.¤ü -£Òï”LøÜ98zPÄÂ%}Kœ*ßÿ~úíª§Å¨BüV€wàVŠŠÎ(Ñ]|R“*‘ù"¨#aeyö4np‰!Nù"uC‡bWàQEdL®^ËÈ[æõCSm¹²5Þ_¥j¦3V ¿ºàkž}åÁ_ Ôîsñ8å®Ö|0ô•M–²Âü^~™s¡ûX â,k^.[¯IU‰÷jõà]£U€íÛÒsKo}X»1¿YÉ49IY­[L sÛ~RÒm¡+–íhôà†Ës¬ ›Þº±¿Øq£A¸†Š"T§nB%+ø£…}@×9xNà?/ÿ‡¾¾j•*ÐpŽÒa¥ -h“´²ÐÆô_ÊêD„‰~-ðÿ'wÉIendstream +xÚÕ\[sÛ¶~÷¯Ðt&Si¦Bˆæ-§v.mìøXNN{Ú>0–li¢‹+QIüïÏ.àE"i»¥ç¨ã“ÀÅb÷Ãî‚ÀŠ÷"øã=«Y$“ž±œIk{W‹£¨w5¯¸o1ôM†¥6ÿº<~{·r-ŸÑ$Ë\ÔsSfì#¨_º8v¬ßB?¦¿Z»ÀÞ{µ·EÄ›‡ËIbD´æ“M#˜»PKÌö°À¬m”j\-BÀcEO'@„–I•«Ï³}¡ø•hv€åV¬)a¹Xb°ÉÝÚÃ6 Øt"C¶t•Ø&ØP¥6 ÓqBÜræs† ”ÛFäd»@N“ÂÄÌ(]aòéœheød©š Ó…:1Çe{cè¥9Ìçøç´¶wËøâ–ÓîËÂ,k±>9ý. Ô¬0Š™˜W˜}Z?úPQäXê@Oà¼tWHR0ÌH4A ÂPàCkÎâØÐgXXì®`µÛ„œ‚^ÐiãNÈ^¶îžÎúÔÇ__ "ÍØ…H:~’’Åæ,²LJ†©ŠZUÜ¿°,õÐ*Ûø\0‹ñ^Áï?qaðWW®Hú ]/O˜‰LX9wŸ=4ø`Ó€ÖýÔÂµè£ ¸¶q,bÁ$„ýeŽÿ?F´M]â½o¤™ÑI˜ Ò‚÷fíΞú9jgvEß#y»n åŠ.ºÀRÃBó¿Âð_[J>Âü‰¯Üw 'üÞï¾eøm™Mý¦\,±÷W#ù­Û lo’?d¿­ºÍËüî¡ͬ¡èìl’½ñ+÷ÜÚå@Ûʧ[È +›Oþùã^9u"‡Cö¦Ê·—Ø!PÐ=e¡µHœèÎÝþÚz³Z‚iBOA´ ô´±(t¬™ +‹‡còj!Õ…pØ¥ªX²¤is˜c<­„Á‰¥çî Ií Iô>ëTtѾچ³(’†Ÿv9ñpqäˆêBíçLò¸)Jƒ ‡KÕSZ±HªB†«›uºh ËJ4»ÀP‡V¢ 8‘2‡O‹¡¥éÚŸ¨8%“´­! =èd”,ƒ³^°9»ìA»L }‰Æ}wË !D,²´«}áv쮼_hÄcAµ <¶ñ( hHÛ +“O‹ÇväÈéB‡ìÁREF6êÅ8FÄ`Íh?{4YŽÝÙg+Á4ᦠÚnÚXÆ2 j/óøÄv¬M9lºÀA»¿È2.#*ã /˜ÜcükñSï?m¬ŠØ’Ý)x}øÈŠ ç%räg)¶êB(‡ìÃd¢7¶ùÄ„x(3¡dTÛÆmïÉ€ÔÊ àÜ}ç*3ø ¨T}@µ{Æ\ÃúÛ<žÍmãÎ|'Z:`+mÄD£‹@9«˜Hôþ¹+ÞŸ§-›òí.ÞÂ(.:-BeFŸßC¡ÄÐ%‚†P‡Ëß!' Ô[ÇD& Éÿ^ÒWžÝ&cÍ”[Sº¤'‰e9+Jk—×tNùî$ , ûé’*&EâÖ•`š¦F`«ïŽË'æÑ©}G²©;OîÞw´ôô¿ B¯[Ï +å£dl0´‘¡ ;ŸgµãüØ~_3Þâ‘~ì$Ã/mw:Ãhé hÉw¹¥ÀÉë½ùá&ˆ ÖNZË¿—Ÿåi KÄê‚&Á+òíüï>Ýnî7Dzv‚I Ù´š‚ãJó̼ÓàÒ²î觯ºÀi»7fŒ¥«;s Õ>fa…Kj(ùä—s<óòìx—?)ü*ß{žT;w <÷­ªFÉRBaZ ªd.½õy‹”2>6ô˜ÒeJþ™÷o|2ÌÑú{Ä¥ûD»ž,¯|E¶ò× l¸ßÇp'y’¥õ Lp†°Ò¥·¹<§å U­Wé"؆”/÷„†•2Zæå$%èoæé¦!ñk‡Ÿk—ï9vinn뺙…gX\ +•J(ÕSY'xÌSmÆùæXø1µ™‡=aÀŠèšÐëÖ4Y|¥óZŸ©pC’¤ô°5fj%QaEÐÎ!ú$ž.ýcn¦ða–¥¯!yÏM<¨8{O)¿xÿÉ[÷° ã¸"ñ9ü9é’@Èc:ÍÂœüºže~.–gô{„G6a‹ÍÅÑ%Ý)¸ªœ·ÆÁWå<…”Ì #hä2ÙÖ¥¬\OÂïÌW73¤#uPÊ‹WŽ9V“…ë×®!© 9™Ki´Nôè´ç“EÝi»Ï¡›ªÞ¡èÎq¿¥‡«Õvî9Úg5Ù<¥êÍ)ÓUPÅä[º¸ÓѺdâgïÞ¿~6Âlí‹ç¼ÿÑE7u± xQkñð`¦*½<Å>êèZ<µöˆPý¸äQ¯œ&jR3a *E*ö#N|€ú±ðšp¤ÆTâ¦.Ý:ÑŠX–² ©‘B ¨Clƒ¹rßoè‹W _áÌåÉ^¹£mîUìrYâצtq–a=¡õ•wóXAÖ¢’p.bÞ?ÞIÝæ!YyÞ·O¿:y•ÀU >‡P¨Š¶5j«âôV¯:)`é"àQº@„~JGee}ɳYëò{ñØ©Ñ<×êL½Þ]Æ[6A’Å‘©@Ì3qJ¹Ü._Ç•ÑI“fîËq>{ØårÚx’ …]†—r׉r'U_Aeh,0ßлWxcäJëE5÷1­w‹!|–<Ÿ²äL]¾5EpPµ]R)=¥tÏòS?°4súÍèaŠ¶+zJK7*¼sñB¹êt„W±ÿ \…¼WìÜ—Pô0YRiþ žàþHßÍ–!ìùöüÃÙÛ_öýØænC D‹:ßrž&*-Âò!swúÄ!ãÝÊOX›û ,¦¨(œëöoÑ +L(ÚÀ‚”Þ¬IþÅÚ½ ÛnBPÊú£2Yí§ÅôÚØx1»Y»ÿœR›Š}O¶k*?´±=üé¨!C9xô|ßέ\¸¯ò²'†\yMº„µtR¿d½çƒßã–¬J2+ö'µ€•¼àॎöVÿþ÷LöþhZendstream endobj -6061 0 obj << +6512 0 obj << /Type /Page -/Contents 6062 0 R -/Resources 6060 0 R +/Contents 6513 0 R +/Resources 6511 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6039 0 R ->> endobj -6063 0 obj << -/D [6061 0 R /XYZ 85.039 781.388 null] ->> endobj -6064 0 obj << -/D [6061 0 R /XYZ 156.947 730.534 null] ->> endobj -6065 0 obj << -/D [6061 0 R /XYZ 156.947 550.26 null] ->> endobj -6066 0 obj << -/D [6061 0 R /XYZ 156.947 519.114 null] ->> endobj -6067 0 obj << -/D [6061 0 R /XYZ 156.947 497.426 null] ->> endobj -6068 0 obj << -/D [6061 0 R /XYZ 156.947 476.345 null] ->> endobj -6069 0 obj << -/D [6061 0 R /XYZ 156.947 458.143 null] ->> endobj -6070 0 obj << -/D [6061 0 R /XYZ 156.947 435.697 null] ->> endobj -6071 0 obj << -/D [6061 0 R /XYZ 156.947 414.768 null] ->> endobj -6072 0 obj << -/D [6061 0 R /XYZ 156.947 395.05 null] ->> endobj -6073 0 obj << -/D [6061 0 R /XYZ 156.947 375.484 null] ->> endobj -6074 0 obj << -/D [6061 0 R /XYZ 156.947 356.524 null] ->> endobj -6075 0 obj << -/D [6061 0 R /XYZ 156.947 336.2 null] ->> endobj -6076 0 obj << -/D [6061 0 R /XYZ 156.947 300.206 null] ->> endobj -6077 0 obj << -/D [6061 0 R /XYZ 156.947 266.333 null] ->> endobj -6078 0 obj << -/D [6061 0 R /XYZ 156.947 248.13 null] ->> endobj -6079 0 obj << -/D [6061 0 R /XYZ 156.947 227.806 null] +/Parent 6510 0 R >> endobj -6080 0 obj << -/D [6061 0 R /XYZ 156.947 177.657 null] +6514 0 obj << +/D [6512 0 R /XYZ 85.039 781.388 null] >> endobj -2166 0 obj << -/D [6061 0 R /XYZ 85.039 116.799 null] +6515 0 obj << +/D [6512 0 R /XYZ 85.039 665.892 null] >> endobj -6081 0 obj << -/D [6061 0 R /XYZ 85.039 85.843 null] +6516 0 obj << +/D [6512 0 R /XYZ 224 671.866 null] >> endobj -6060 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F14 2895 0 R /F20 2865 0 R /F15 2876 0 R >> -/XObject << /Im1 3957 0 R >> +6511 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6084 0 obj << -/Length 3250 -/Filter /FlateDecode ->> -stream -xÚ¥ÛnÛÆòÝ_!ô%2­I.¯}Kc§MS;>±Š¢èé-ÑRTH*NþþÌmÉ•DÒÅ)ŠÔ{™™;åÎøÏÅrt2‹bWé8ž­Ê g¶Ÿ/\XÈ‚ùiyqõ.ôg®£'™-Ÿz<ò=[®ÿš¿ýåÍýòæÓåBk=÷|u¹ˆ¢x~}séÎ>Àÿ–— wþ÷ rÿéÒ‹çß½ÿí†nßܽÁ¥ŸææÏÝ-/ÿ^þzq³ì¨ëîJ$íËÅ_;³5°ñë…£tÏžaì(¶Ë  M¾–yqñpñŸïù3>5$‰@Ç*ˆõ¹(ÜÀ…ëzJ»Þ, -8>Éb]!#ÏÍåÂw½ù -9/€Ÿ<ÃÑ÷Z˜Ò¶ž§k¯ô †”"À¡ÎE»…•)ÿΓüÒ £C5LŸ²:ãÍç¼ÝâÈ`¬{j^ÿŠG³ºÁ%DUíäºê‰ÿÞâãñð<¼CR™7<Óàó€¬.Š2!ÖWEž1I„Vñéûºz„£éc”{:!þ·@‹ç;ó²B’q•Ž¤G¢BPÚ«™‹¦Ú †ŠÿÞ}\ò Ì¿ñ`r¨þë¸~òÃ+r7A($^šb30 «•eðß#Œ@qñ$®Èfì½hÈwÄ\X…Úm&zKÏŠ¢z5øÛlÓ:“¥­ Ø(K™=´)š—œ»íEwà•+þsÍïøÕ Ú˵, !'É·«Ûì5?ŸE'‚¡(ˆ·Ås»,o©ã©†¿Íž5q•?¡zǨ:mç­Ê’$ -ó}FÄËF«t„Ì3¹ða¡ãq3¯Gó¦ÄW@·¦@‘žÃ>­AT½;nÖèϹ -7¨!kÇ#Ñ(ª²ªÈtËN·ê^@óÌòžÐ‹ª¥;Áˆr¬6$‚óæÛªÌØ-ŸjN0¦8>ñœ"¯Æ·±zˆOE§Co‰Nä¹WU]3Zµàøc>òÞÄ~‰|T<:J¬Õ){¨«wÚŽ½^è(ÈA@¤H<Øe­®ß,ð(Hû‰ru$p(Ÿ\ŽŠƒên9l¡}WE^xôŽ¤+†Ý†ˆÃ³˜ÆËšÂÖ3Þ_ç–Ъš¤¦FÒ Ðu•“iœC¹‹»®Jð½ûÜ%H¥ý˜ÔÍS@fpAà`è¶xÓa4¿Í7µ±ž0„œuõgÚ ®i×d´x‡ã¥å9Î7ÆñÕ_ÉÿÁ˜×Òò1a5HB¥ÃIN{ñ$-ˆbœ¤-·œ*9±Ip¸«(r™ÐƒKäÃxØ´èÌ|'êU'ä€"y5tBè¨7¼Ç~ö;O:;ÅIT³…üTþYL ·0)DÕ‘uòfñ|%oÛ2Î] ª2©Ý+sžæG”¤…:tIG†.Q&¯9…ëm6Z -ÎZqÖù_ÁÈ '‡ÝU(‰â5,öŽq"®¶§bÍ´“ÒÁv*Piç„Óó Fâ´ÄWä#tX’`zý»À¤û¤õò]w~û¤ oJÞó(‰: |è‘Ô_í¼7›ÃžU¦ªM% Ãy¶[ÕßQ4­°|þ–û´i(y¨ê5tGÝC.-ò¦m¦éœÃ¹Í8‰òïÄ9¸èüdÒÞÙ¬ï/‰m£r–Iwé&+³]ËóåeB†¦á‘ŠfŒ)'æNsÕÃŒ»?ŽU˜DÄÖï;¶±óÎÄš.Zy¡ønÏçŸØ¹WÔJRvÙøS=€Õ3"“3ÓZÃ@ G3Òq¶ÑÿïSAƒÅNfœdå<^Õ韟àqZÚÔ2²çÙÑy %Ñ‘E b Zð\þU1Ë°ÔÙÊYúêæk'Žï”¸uÝ°W˜õÁ(ÄͶ¥$ûš¸Ì¸±I„™”ݸkÙd”>b IÇÌ=zۼÌMù áDŸóÔwÏ…ùÌilXuIˆ+zÀ5Ï:ñÂx]½f‘4ùs9J´qÖ xÏ ÇDlcéEƒ¡çå¾E)=Çú¸C&«­I^²‚R°†Ú{ã¡PeM›¤¥8£PJß%®ßžy?r¤Á3ËÌÿ…×Ð\ƒçÏݧ‡ÿß•AüS^¤Ñº•ãEÓqȃê×qôt2@(t=‡,L£qhú6ñœömoíhà›òy\÷C†&®¿×.µµûb €&™hþˆ:Ù¶d‰£‘Ý }H=ü$ÚMHT€ðjT¢S׉NÞf$jÝö~wÞ|f ¢RáÛyÕÕ'2O Òá Ìï{§+ÝœsñG‰ÂOmÜ~[K}pl€Øçž÷H^Kí°ùq Yçºrc“Š®Äõ@H ±ÀŸ.F´Y¹Àáy4šÆaîxªªÇ´U§½PX@ê$@xg0ªNS×uš¼Í¨“uÛ‰š¦²ô6}jÃÈ®(WØ)Ð6Ým²!3uTìÇ•kï9Nð£kpÞ£Jf”Ø—ôÚ–ëVƒôù•18 ãLØèëÊ·Iß ¡ -³šxLÂÛÃÑÇœºÎ<æämæ1­ÛìÇt~L'±¾Û9V‚„;¯ð“¼ÕÉb󵳄JwÒD\òÅ)9¯2ªK0i'1&ýñÃÀS¹QWŽÖå–Ú@骨š®ón¾S -¯ˆÍm—mòj—Âfõ+©5!Ì"Vòöõhô‚—¢o4¡„·G£ú0uчÉÛŒ>X·Ý™î5ƒ:å¿vYýÒ;‘dc­œð¸ˆG™uQØ—ÚQ*µDß}vÒÚê)iâI‰jšÊ§%êùÇ6»4鷺¿´7ÝJµ`Æ{©.”UqâŸôR=é¥>äk ¢&k.½aBÝÔªÍÆZ¢é$u=ÌxKÔõ!™LøþÄ’ åæ™fü–?ƒÈÇù5î€dÑç·Ò{ŠûÞe’P#ý=Â_ è#³[X±iaÅR`sBŠu»8èm–oè¿Àb[œ~` dQ/‘2ÍÜr)¤j îë¦ë“pV¦æëjºÉF{”äälЫø ¹{L òÊáÅ´Øó'Tš­¤jò˜:rG¡¥¦Bà /û¯‚ªàÁ<×.00U®ø¦C÷¡†¯ê‹wþ~1ö½ÿAJ†Cwcóù²ù¾[ñBÉŸ~E9)Å3–¦ôÄóÜê~Û_€åqPg¬J6„ü&>ýVjˆÉZùˆ\•6¼É?±àO˱¬&üã¢â¼L?ÎE­àÐŒù ®3²9øÇBüW?Oë,××*ÖÉ°á z®¡…*6×=¥×üŒíŒàÿ.X˜endstream +6519 0 obj << +/Length 2503 +/Filter /FlateDecode +>> +stream +xÚ­YësÛ¸ÿî¿Bs_BÍT4Að™™NÇuœ‹ïbÇëšÞ\n®´DKl(B!©*þﻀ%JùÐ^æL<‹ÅoØ…Äăb’„®'ÓIœW&Éd±¹ð&+˜ùñBhŠ™&™Y4Ÿ_\¾ £‰ðÜÔK'óçžO衜̗¿;×ï®æ7§3)¥ãîtljóæf*œÇŸáÏ|:Îh<0ÉÃÇ©Ÿ8ÞÞ¾¿á»«û+úhnîpÝý|úÇü§‹›y']·/H’¢h_/~ÿÛ,á?]x®L“ÉÚž+`zs²¹a u¿¼x¼ø¥cÅsÁ„W!ÊÄ y …G =7ô‚âîq: dì|*àÕRá©ö Ž%Žïyß.ÿùÀÛÔgOe®ç7S†+^˜æi:ƒNŽH€kg‘Fn"Q\Üôý4^øg²’W dõhùzªÇxp +Cñ±c™mŠj5Â0n 9ª<Œ+>H­pœoÅ}û¬<²/ʲ?cìÐpê,²Åzk ÏŒ%î;„ñd&Po)íX*g‘•å Ñ'0…ÓðP»Î±8Ï(@Y²:Œh8Q›­VEÓÖšÓ$Ëu§h˜rQ]Öö ç5#m`¼ œÅdLr¾ûùæ·?߸¾zÿçÝÕõ»Ûû›ÏB¿=ÎožÛ}Vçؾ+µj`;Ÿ +04ÐÁpèzW×yÕþ#¯›BU8BøˆØ‰?@ÎXªÓüð&/ó6ÿHJY]g‹uþÃ_—{U/_{üŸQïÌp•žë%|–ÛŠ!Ù¯‹B´æî‚pi”¿à%Ž4kªR/ÑŠÎ-j«MŸ¶ ÁVg ÈkiÀÇ-™@i©ðÀ;ÔŽ{"tDR¸ÂgCŸECþî{è2ˆ,<áÆ‘ H ÚE`ü€»s­643'Š›ºVSé9usJÍæ¬8=ÍÉðFÒMBÖûü„Á¯¢¬Ö€““¨&n ø-,)ZÊkrÜš¨/q¾VOS6Íå×»[[ÐÁµ§òÁOˆÇšÚÈ£xºS(¨R«.#.ìvËSê ƒÐM¢ø,^M§>á¦ahãå ×KcK}¨ÃÐsó¶e´@ƒ»-)œapÑã[R+Ç3cxô(ržAå€Óý{Ç3€düyÎ÷zƒ&¯_é•l+<¾ªÕnû +þí"qãXžÇ¢§9i;A:|u}*ÐyÀ§ßwšlƒŠÚÎfx aòÝo>|†bèé áhñbJ >œ®D:¬ûJE¯Z@yÄ—ìjW÷g5‘V²aëÑ¡‹àì–‹s}æ]Ó!wD„tYp`ÅG}¯QEi$1u>'Ýt_÷®6eæHAÌ3:›Z4dœ°k~¨/OvŒU2>ÜOxÔÉÙ ÍÑŽwÂw¥ð;^iD¢’¾ø +w¦TQViеÍûPT³ñùW/‹æ Pšè»@Ù°ê`Çq ¬5PmÆgd&µ:mf莶)·¦êÞ <¹³ÆJµÆ[tFU«}ð¸çzqzÜžæ ¸šè»àžÙ°÷`Çqp­5¸T|aÓ1HIJ»õ»\gšµ¢´9òj±á|ue•ò×»ªÏ©b+•<¶ïÓ{ÌY°{š“U°Hc@`Xûº +¾&S€<÷žnç]µÊ |I¢®ëᇣZx\t.Ÿ¦ç‹V‹ædÑ*" !{¥…S†¼Œ:6ø}‚ߊBëR‹ŽžH^cÜNœ1[&âKŠÖj¿y!D0lw÷gxX’"³Vs²ŒҪͶRÉuÞkÞñ.…ÜžÚ8'”«¢«-EjdžG°Æ‰õ‚ÊýkGÂÒÄ –Rw×Õ‡NhzùCòu^n™ÕFÜj>nU«Ÿkiû¦åé½Io‰f]h1Íë“Þð-Ö_ø,ÀTZ@·ÍšÑ:ŠôŠþ…¨ V%¿®Ó1KZÁm +SÂIòu&öB²±b1¥ð=³nÅø©•]âò "ˆ©ÖED™ò®å6Ùܮ҄•–¬WÑóŽëVåCqíMVÁq.?¡?tÛjXï欇ôÐ-x5RYtï…üž«ŠEn=Ÿgu~”yÄ©&á$NÜ$ÀšbÖ“tAèøG$"¡ß0 O[c ÙòæH pˆàœ†äPáE¦d1–$·XœûÎă(*úi¾unÊ>ì}Ñ.'ȼž 'kyzð +ƒ³½PØü³]«föw¡*^lv¦Ÿ¸yðBDòU\±ëËÃKô0>gé¹þ(Žð?3úŸ~rë| ÝDžPF÷–/Œ,(¸<¾ÍOsGÿ3ì̲endstream endobj -6083 0 obj << +6518 0 obj << /Type /Page -/Contents 6084 0 R -/Resources 6082 0 R +/Contents 6519 0 R +/Resources 6517 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6039 0 R ->> endobj -6085 0 obj << -/D [6083 0 R /XYZ 85.039 781.388 null] ->> endobj -2170 0 obj << -/D [6083 0 R /XYZ 85.039 611.175 null] +/Parent 6510 0 R >> endobj -6086 0 obj << -/D [6083 0 R /XYZ 85.039 589.314 null] +6520 0 obj << +/D [6518 0 R /XYZ 85.039 781.388 null] >> endobj -2174 0 obj << -/D [6083 0 R /XYZ 85.039 520.72 null] +2246 0 obj << +/D [6518 0 R /XYZ 85.039 631.121 null] >> endobj -6087 0 obj << -/D [6083 0 R /XYZ 85.039 500.125 null] +6521 0 obj << +/D [6518 0 R /XYZ 85.039 590.958 null] >> endobj -6088 0 obj << -/D [6083 0 R /XYZ 85.039 459.478 null] +2250 0 obj << +/D [6518 0 R /XYZ 85.039 545.867 null] >> endobj -6089 0 obj << -/D [6083 0 R /XYZ 85.039 434.501 null] +6522 0 obj << +/D [6518 0 R /XYZ 85.039 511.727 null] >> endobj -6090 0 obj << -/D [6083 0 R /XYZ 85.039 286.575 null] +2254 0 obj << +/D [6518 0 R /XYZ 85.039 222.087 null] >> endobj -6091 0 obj << -/D [6083 0 R /XYZ 85.039 275.882 null] +6523 0 obj << +/D [6518 0 R /XYZ 85.039 187.947 null] >> endobj -6092 0 obj << -/D [6083 0 R /XYZ 85.039 261.727 null] +6517 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F35 2976 0 R /F20 2961 0 R /F41 2994 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6093 0 obj << -/D [6083 0 R /XYZ 85.039 248.784 null] +6526 0 obj << +/Length 2864 +/Filter /FlateDecode +>> +stream +xÚ¥ZYoÛH~÷¯Ð[( bH6ϼ9YO6³qìI4È3,-Q2aIÔ’Tï¯ßººÙ)fE°êîê:¾ªjÅŸyðÇŸ¥‘ë©l–¤¾«Òt¶Ú_y³-Ì|¸ò…b!$ ‹æÝòêÍ/Q<ó=7ó²ÙrÓí¹a¤fËõÎû¿_ß/o¾ÌJ)'Ýù"IRço7sßùúøg9_øÎ4î™äþË~ºáÛëÏ×8ôhnnqÝçåü¯å¯W7KÃ98ɵ_ýñ—7[Ã5~½ò\•¥³gh{®Óû+àÍB%ýÝÕ׫ßÌV<ÎxÕ˜$Â(…SÒÙBynš†£4IæFißÈs#/4Ò +¼i JëK•ïK¸âa —ç8W¾S£ˆª?=?ÜÁTѼ=¿¾Ÿ€NT2³Np¤i,ù‘Å’ŸÄn’ù=ž®›ù" <'‡Ÿ9§¦@~jîíª­LWÔR V<Ð>"·Ü>-Î>σĩjêí¹Â ÞgóÝî…gœii »æá#ôëN$¼Y)œ¬ªcYa«™²Ç7[Ä¡&`Ê>j:£;>ãÑUýÔ´y[ÂMòi-~7x§z9ƱÎ%Ìx¾ã±#rÉL.ï9ËGdÊ,HUGL”°bWðÎÏ%ÞeÇ#m_ÔMÉàEz‘gD±ÏKaÔ0Ì—äÝÎn„7÷zw^£¡ÑîO°¯ËBÐîa§÷oóȧGžcÎÝ–M[¿0ùžB£/L%{âºÎ=æ‡-ê爽¼åÜvÇ{° ɬˆŠE-[ž2Wñ÷¥#ü樫=mƒg”Z+ Mak]ìŠV È’DD‚@ñ!Ò€-W´—Ëv$n(øf`/ŒfK¶!€½Ôòš pà ‚MÉ…çº2¶/É£Ô¹¯iTîB;ôüð"óRÙa…^‚ÎS•+Öò:¹QÁobp[ðÞ)DêH.’ +÷ˆ?EÍL ¡¡ù"0}Áž¾`#PyÚ#‹æœ½ÀÝÀŸbO(ÎÙë )ð37ŽC›?ÐYp¡%$ B›—ãÐp²´ ]ÏÔàÑš8SâvÎ ºt{9ísvR`@¤rÒ¦Òdqdìlk¶ThP€zbB I¼å°úHãî´"Рmù³/öhæ*ÂØ0–{ãLxʇwLR +iC£G +¬ŒÉrtÊ:ßL‹¿44Dù11 5`]í„ų|[DÁéÒ÷²æÔ…cäÞ‚rÉ_üˆòLR­®‹aøÌ8üX.‚-”Ò·ï¸Aî9w·¢IÒZŽ9Y[é @øTD,”²éIç LÊÈå3Œîòù a:§š+ºŠá°qGÄò 9 +ÙEA'ÒmÉöˆ·?îÈ_ ’Z†â¬ÎåÈû}äag—ƒâ`$a±“ñZGnÒMá Å`c,@€ÕD^âüÞNñ~m—X ÝV+®ÑXD¥\’r$+da%Þ"P´s®ëMˆ˜‚Ày¤¢­ªŠ¿”o¹-V)39?nõpb¤ S/rN^³ä´ã &ŽD¾AK=•m#gnx~SívŽ{†š*·”AÖùaU Á¥äKÚ>öå= *^cÏ€oNq4ö„ Îªž¶c ø%YÀ‚F _§«4I5:N×Táa„ÐLŒæ±o`WYþ•ê1 š>óý£m™ã: 3Cgéeܦ@‘×J%¥jî ÊÝV"!Í$Ìu"«ò¸#–ý÷á©ÎK0'Õ13·ó·]!i*E¡B§ Ú[\[ß|«[œæ´ªjªMûJžSR@ÜCÃW©±/¯Sø¥ Ð! Û¬©ƒÂ{¦-e/½¶_¿Ñ)ô*“vOLÒ¥§¦”ÓüÞâaܼùq–Kà>_ qáö‹È' Y0â¬í*ÔR,?™qB<ô¬XC”Ø:HÕ baÕ =µ„V´VŽ~Ÿ:Û§»÷ן†YŒX aW‘Þ^x|2å¦i0ùxnÑPªúvªîù.DQ³²L$ƒÂÀ‹Ý4J'Ô4ƒûŸÊz'~D¿ÌB¸©8õöÝ€A*“Èš™$an¤/z¡Iå³~^Ë# ÆƒP⪙¿>WõÞ¢á·ð‡2âCj}hZæ@¤ì¤ý݆v×Ïð/è8Rn Âiw4:¢ŸêxâÀNÇg'ŽëØ:ñF\ó…ça(„Á.#NíføÉ_2ï K§ õLûJZ ﲩ-ã×’yÓ›u÷ê4?±J)¥@³LPÍé;SaÂ"PêÌ$+¦LR¿VRÐôç..w ?]ÑUuaK`‡CÑú5÷zÉ¢’ÜñÍ< ªa‰ˆS˜"«}õ“óSÏMT6i•Íe«ÔD?³Ê©UžŸ8j•ö‰Ë¢ëߌÈ:ÐMÛÖVeÛUµòÒšqb‡ +ðlgOmEá;°ÞY¿ãž’@[/º}…å:‹8u¯I åcš§‹§á¢#™Ð ÓüT-—Oë´Ò?n\)Ýq¿7ÚÆ7ÚM¿îº(ð1{÷õôN„Âú=²æÞ¯SÚ‡ÓóGÔOj”|Ý\ÔK(LÇj‹fB3BôSÕLØéæìÄqåX'~£]¥…jÚØÁRZ\jcîeÒÅ#£n]Ú•ÜÊú‘e£'ž-³)œg—àeà÷Ñ´:óÂê»–…æ…5 ]1|¡»p´Â¢4òœ÷øÓcÉ" +&Öbp“ŸvRññ{l÷ÖÆÓ>ÓÝ‘ðHG†=7ðßNô›>Þ·#? "¥Ò?-þ 58ßȼÜѺ‡@å¬v¥q œã"¸áÉÞïó¼²àƺ’Ÿ’ßþ©ŠÔ¡|¥ÈJ–69šåµüþ"'èÄ)rþ *F¤k…ñßIàóú‚ðc4êÀ_Žòÿ×ý0 !¾¹¢ Ýi^P+* +ÎùTêF©2ü_¢‡X endstream +endobj +6525 0 obj << +/Type /Page +/Contents 6526 0 R +/Resources 6524 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6510 0 R >> endobj -6094 0 obj << -/D [6083 0 R /XYZ 85.039 223.806 null] +6527 0 obj << +/D [6525 0 R /XYZ 85.039 781.388 null] >> endobj -2178 0 obj << -/D [6083 0 R /XYZ 85.039 179.322 null] +2258 0 obj << +/D [6525 0 R /XYZ 85.039 109.735 null] >> endobj -6095 0 obj << -/D [6083 0 R /XYZ 85.039 160.848 null] +6528 0 obj << +/D [6525 0 R /XYZ 85.039 74.989 null] >> endobj -6082 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R >> -/XObject << /Im1 3957 0 R >> +6524 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6098 0 obj << -/Length 3252 -/Filter /FlateDecode ->> -stream -xÚ­]sÛ6òÝ¿BÓ—P3MàWß|±º‰_¬\®Óö–h™‰TH*±ÿ}÷‹$(QNæzÓ‰.‹Åb¿QâÁþ$\O'“(ö]Ç“ÅæÄ›¬`æ͉/3A™Y8ÿšŸœ^†fâ{nâ%“ùCO'pM 'óåÎë_Ïnç¦3­µ£Œ;EQìœ_L}çî-ü™Og¾ó·ŒrûaªbçýåÕ» \ŸÝœ!è à\\㺛ùô¯ùo'óŽ»n_à$AÖ¾œüñ—7YÂ1~;ñ\Ä“o0ö\¦7'À›-ßë“»“w¤xÎLxÕ˜$ZŒ™Ÿ¸‰ -^–Vè»&Ô´”gIË÷•«}5‰Ï V@§¥ëQ -|IðùÄ?½Ô¶²¡«!z´î×·¿ïk¥Ÿ(WE M UQ`¾©@ét8§f-­™EŒôwÀ’ŸnäÅÝŽÈÙ»÷¯ÏÞí³¦šÃÿ‡µ–Öˬ)Cl²v}öú׫› –­o§ÆsaÀ¢-ÆdG ówï/çŸÎ>Œ’ ÀùÄß¡Ó^áu¾¨Êº|hF>è}ðƒ ¡‰–h(§/ûä"ºÌãëõ®ª²¢ùOVa¡yû?ÈÜ-„õ|½3R6&Ä™È5*XúÇbÙ;•™öÃÎ!i?‚}ü$ª»™ÆÆÁ ¤<ÇŠ‘S!÷…Ƽ^3àžœ‚Эw÷0õ¹ó`ϵpŠã8¡“mµ&ìK>s-³V¬œúÛ#ÆÂ0æ0Øg( \—«UÇÄ%òMðÛÈ":m^ó¹Ôr³Å}H0®EΟ^àÍ)¸0–x¾B(2·ïýâZ¤&ì1Q±\#,z xo¯ÆœkÄåÃé0AÒIľ8b&Ó5îî3 Ò¥Ýq“`/iBäg†Iüø†kRŽŒ !¹Àf›Ò–¤Êa|ŸÎNáD°…êÝÕ9ø¨{³]²È›æ”äô8‡§~“5@ÑmC‘8¡{É×’(F©­ ÷ãCýßWEÝÆ{D§R‰ŒnùŽèož6YQ³W5ƒ•š Ä~/A¤ý-G£ÀShw2MEqeŸ‘Ø×iÂ5î2;µcÁb½µcÁL6)kò-^WÚ<K÷ºÆ¼\/Z8]ºÅ íì*k !šHº×–>׶¦ 'Ús(€ƒo§š®·Õ5¼ƒú{à¹bórògáOþLº*æu¦abd •¸«Ø<x;¤2l”5SÆÚ BšÇ´iG¬Rˆ>HÉqrÉFÙ–9ºy?g䇄@›ZzO^5o«Ú­äß=ûCþ¾µƒ¼á\ÏjÎw¤×¬p3í±@oPJ¼ÿ P†Ðßš]T@yÿTñ¥Âz¯K·tìRÖÞ·™ '¥ üîUv–Yý¹3$º}vþ5¯Jħ­3.¯0*y‰sO¶?rh¬_Ao…¶8ƒ ìŠ"´Xªz'¥HfÂÑRá|xñ%¸ì|Ê°áøµ3ë²†ä› -Ü«žÏûr!¸d1ç•í ?’Ì“ÒkmÍÐëðÐ, Z+rÞ|CÊG}Z“zt0®~ñwÿ:”Uk´ð÷9§‹ßÀל|Q±±ª(!ýØ×V´ÓVÒH}ƒ‹wµàö"ÃͨXïHTånõxè!EÅÖùâ™"«kÓ@Ò_£Äqî2)ˆ·`¿¢Ê]Íp9ö–"z_øïW­Kñ`÷äGÒì ÄñDÛ#?Ç[^´È2<ìýJBxÂLÈtÐ9CHH}ßMPJè #7LÔD'8tv†7%ë -äà ‚nŒù!Òœ|™ø®g’D3Ž5&þûcàôjãOÎKàt2`–éÎ,Âì¹cÛsC)–€[×!Ôöq,I+zlîp$`ü»È«ÅnCÞ¤˜B-:ë„Ùú‘Œy½äÏ.Ë5( ègÕg<0½ìnÑP—K‚NbrGöF Ä`;¯dN‘»Ù¡n6¢öÀ1É9ˆJt¯èø!>ÈîÉdVëg†¦Óç£ø±iÝ//¤÷*Q|Çmÿ¬ˆÒn{HW¬‚Ý~9X´áöej34h ½ ºßõ3ƒeL3Ý:{ÿ}3ÿ(y‹{ŽœŸá‰æz5rÈýSk-[0îg’WïshDÜ< &ÖuX) B‚Òiµ¹†g7GnÞ)|'Á~BF›‚8•<á¯ÂV0-ÊøWò -¦œï°wàƒuÍ…ØÀ??›tLìê®É`«Lœr^`dƒêNÁá½Oë„´”å+Ú¸¾Ú¼\ŸÝŒu1t ]ˆƒËy§À›&/¹)žØPùAeæs{©½¾+Š¾¡˜ðŪÃÂ9^)ù:h‹¢¶ùýÍ“S(AÒµ%urO¼bË -£¶Y-Ž'øNífá/Žü8q£˜û®KºÈE¶"}Ïk¶>J•Šš'S N<¨¬Œo:ôÈHu"P" ZWZ5vrX˳‘Qø¶’µTIƒCEWȱ3_d »ï‹¨¢¥,v*œ£}#b -»é¢9 ÌuN©‚Öؼßñk©‰'OX”—õ€U3>»õ̃½Mq¶±«žâ¢GUöÃk^Éžýó M7]‹Þ;L°q'êG@‚K¡z¬ºÁ.“ <éaRÅ‘—2êïAê)ÄXKÖÀ] -Ø_w“˜B ’Ú@:ƒø‡D¤¯ø{/bˆÜ=sök—cíœ>¼á ou%ð ÖðbÖqdž§Š -~Sþ9ìºR²£/³´‘–Ý=ÐÆEUËÓ6Ô«ïØÕÒý~M¶Ù®Çãæ’ÙS -óçƒøj?”Ng1äc`…Ìíïƒ@¾éx?V*›œµô ¹”"‰?‘ƒ¾+úìÅn&ôÜuW›CI"0ÕÊš¹^ƒjœöBòtªzSåP؉OÀon{«ô4ûÏœ0¹‡I/jt‹,2ÙHjti4mWãÆYå|Ì¢eˆÒþSí:é´ûÖŸûae,ØÓ{¼‚B½Èž±:e[þêzMPv¤öû3€J0y¤~UÃÅ6m™$Pr}JúýìE{®}¿‡¼õ?ú¿kºÔÂh7ÖÉxf(å*¿å -yÆ>¿ŽÝÒŽ†ÿ> +stream +xÚ¥WYoÛF~ׯ P%j½K.¯A‘&vâ4±ÝXEÐ&y EJ"L‘2IGp}çX²è"H‘c—»3³s|sHYþ(+ò…ôb+Œ”ð¢ÈZngÒZÃÍ›™2sC2Ñü¶˜œù¥¤ˆel-Vƒ_hß³égûÕÛ—W‹ÓÎÜó<ÛÕ™‡ad¿>u”}ý;ü·pæʾ„Í“\}tÜȾ<;Ê^^¼Ä£7@súù.Î×Å»Ùé¢×®4‰Qµ»Ùç¯ÒJÁŒw3)¼8²ö°—BÁõvº _{滘]ÏþèEñ¶˜kʾ ?òŽ]¡ü WøRøR“+ö›¬ÎÐ(m§`FÅÛs6swG-ïÛMÞð.ÍVÉ}ÑÝh{Ûºú"•†M‘¡ï~uæZkûgô (8wC!As|ð,¯¬Aª…<8‘gÿ’b|P›Èµ›d븡}' žž¬þ†ŽÏj>+3z/e‘È×V|sãÀ«°eUýÖ÷u–2EÒ˜•—´Ú&yÉ{ ÇWZTµ*Ø&ÜRü(²›|xp™”/’3Kóqã¸1jœ¡ ˜>ù¢!Ám‹ÒÊ5{—T€•¬Ý¢7®—ø Z){õœù"#ðl ”¯FÒ–÷uN±ÎÐ –xïô>«¢câ®&.2vpqÀë¹¼~‘¾¬jÞo«:ƒo5!¬÷%a«uU6ÿ°g ñÎ[ÂØ% †¥6Á ×½ÅCŸ|Ù†€‡ŸË¬-ð) þÊWÍ&©Sn2¾’–¯θîÑܪ.RRgIšÜ’!ÚÚsíóG /ëŠâ]‘&†9O3s‹0$bB:bômV‘¶dÒ²Îw±c?˜edïêlΡÜ“1ç\Î ¥\¢¤Ly“Ò%‡‘ÉÏ%»žksÙt~FJoX“¢óµy<áóU²Ì‹há!·6ŒT- òm¾LŠâ¹IÒCIwm¨X”(ç¼Éñf=ezW 3{ä¬0· ˆ!°Vam¾5„Ë‚ÃAOÝòí>Q°ƒÒ°IL1«V]QË H9&”xœíC™1°OPÓ +8ÌÙšŸêãÏòP¯.•)zX0+LñDƒð)‚PG‡PX¶ýɾ“ä=)†˜$ˆá¡>”Ò7T:iÝw‘@[J‰ËÖÊŠ¥Ð +ôÖ¡ð]î"·ŒØ#+ µŽ}(T!J´î,%¤ŽcIF{R~°‰NηÊz]šÖHS#v>’Ëý.õ;åÆàZßò]Wø÷Ÿ…i š–Ò¦ºû­º5™‚GÄó®«Š¬e°Å1CÖºJ,І‰‡²¨m`Ã)ŒÔlùƒ@‡›‚+•vVð1$’sÛÔû§—Ér“wgšwI ¨wµ´ÈÆw“5—i:¿Gx»Z±xò¦®Ðæ]ÑãENJ=ðÙiš·¬SmƒuٵŬ³ 5Â&è\Г•…iÙt s“²_q{^‹«Ë÷¥€3ØÕq§tL‚vìëj‡ÝµÎ“ÖÜee[ç9«œ‚*Ô4¾àõ Tüh| Lásu4j2pÑUx&ålpHÖ+Õ·ú‚ÖÓa!›0ª6íà QÀÚhv6MFGUƒ¯k”¢?žïXR” ­y?Yþx :(.hø_#(ôUÈLrÄ'JŸ”lÞ7ܨ ,؇ròH‰nÍ]3î³<´âE?áÇ6æ'cmø1‰s3 f^aÀ@§ø„®ç†³†ôØ™I$é[XÞ·S#5ô¸¸\0=ç©L=sÔÆ&ÑM.fNê;°7ÌÅŠ':ì(¼rKb*f<tyYíŒé”Ô ©^a¦n:Iä6 òEo8áYÓ3*¡¦ BÜvB»Æ·@cN’¦¦ ›ŸM?Þ ˜NžjGyGÛÑûÒŸœi5ÂVˆ@%‰±\­á/S ºÕ³‹ 9*nè r&„¨@xAGrhî±> endobj -6099 0 obj << -/D [6097 0 R /XYZ 85.039 781.388 null] +6532 0 obj << +/D [6530 0 R /XYZ 85.039 781.388 null] >> endobj -2182 0 obj << -/D [6097 0 R /XYZ 85.039 761.463 null] +6529 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R >> +/XObject << /Im1 4096 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6100 0 obj << -/D [6097 0 R /XYZ 85.039 743.459 null] +6535 0 obj << +/Length 2763 +/Filter /FlateDecode +>> +stream +xÚ­ÙnÛHòÝ_ÁG +ˆhöÁ+o ²³È`“ͬ½È³ó@‹´D„’²ìùú­«IŠ¦`30`öQ]]U]·”ŸòÒ(Mæ%© +Lšz›ýUèmaçïWJ ld‚ÈZ/l®Ýî:ÖAh“E¹c¨,0V!ÌûÛ«ë_tèé0ˆcãÝÞ;Bâ4 Ò4òn‹ß}«u…þ—U¦ýwŸVkÇþ]Þ•ÿCÕõmuwêÝ»S¿+Wkåúj¥üMÞWÍaõÇí¯W»è™ÝôÅ¢XEž +ƒ,̦›0°ÊÅ·»ªJTâoV:õwù¨è‰¢×cÿ ×›OºŒ”_<Ý•õqªoø[”ǺÁ'žŸ«ÎîÓƒ ¸ƒqÞá}¥¬ä Xd© |³jƒÓœ„"@÷Í“;¾¬RÃ’‡IyÈM¸ ++Hk­P2bÿߟ?þçúL2ö¸Zë8ô»§Že°‡÷´:ô¿" —Äë(ƒç:ð;ø$H2NÑÀ‚¡P¸Ž'Ù6TÓú@a…`3ÿ—•„0ïOméw³›Çºà}y(Q;q¯ï^ðQõ«$Ž0/F§A–"ñh}qh:qúD¢ly­¿˜9óˆ¬æ½0b³br:ÃؾÅ$*õoNl‰x覩)©è4@+ÄàßÉ›#‚3ú÷’²­l\u•Ž1cn`ôAïó}U?É1ô]–‡Þ,˜êÁÅM,†(¡®(þ錖ÝõF¥àKÀM Üv›ßÕåÜ +3BÉÄ]⎵È'´‰Ou)EŠIœÊ€!ïó \ÝOŠ.¨Ÿó4NW‹‘”S€šAfµ€P°ÌrÎÔ6mõ§#4LDÃttq]CÝÆIö\ö%Á´mj^—’æa(Ù8/E_ +û¥¥ú­eXâ +¿;AZM²VÖÉ];~G!L')ÑŸlLu6UW¹îªIlYêfˆ©}?¤x.9]±bCÎ/ŒÈ¶¡p˜Épù˜w´p¦<¤-øT‘÷ù$ÕgPTƒë²'N¯'9Í™ëV6el§ZÐaDY·‚i êغTðA䀫 ¹ç°Û8cKPLmDÑ ß Ç9eÅÖ +îm›ï *K [PR„aÍØ& ÊðÝ ì‡jÃw£º¨ˆ¬ú´AG°ã‹s>!K@@ìN,lïTQYH 5µã‹èsĹ[®’IÉ0ó~&žî²>"¬¨L).^ˆˆŠ¬î-^I›žFîÄi‚¡ ¯¬›mÅuA^¸jÜ8¾Y@qœÈ>¨2w.ðõÙ"Ú¬ u†ò þŸ—¨‚Ø®"5 #Öé {g¸\‚1'²íE!8fc‰ZÒŽŠ W™ðá¢IúT‡!xìyw,oaR YÞaì-t¶r9˜ªYQ¾,~‰ºxÅD“9´ÍôÆ’7N®aÂÊŒzøD¹êVX8-•óF׬uÎ@ša­5&sD{ ò¿§Mü5š8ı,…¬e…ßÊf6-*Žb-éw-•ÿÛϨֆÔãôúòñÙ—Q^ÀC,8ô|7Ô¥ÈÛª“<µ¨‘fÃ{§YÒ4p²…en7U¬7'ì–àꄲ¡/Blq  »• ¹âȾ,bþ¢k¾†:8(–úÿ$¨IÀ˜dlõ<—F£kBœùÌBèbŸ•‘‡²”ËUe.iƇþ¢qk$i€CRç ¼NCׇÃ6× ö;‡ûqîŽ^”b|ÿ ­6I%œ.g“äÇjin‘ü6DÊÍÞ`‘>´a8¨»¶<¢Œ•OÐâ˜û¡d“G²UêUáNñD±z/mbʇžÊõ‚s4Z¨î¨?Õ +À~’kPbFWµ‹ù'ê#T5`ifÙ'¡Æ`ëŒAÊ·$â ›ä¸fìóÞ>wJž¥c+ÑÎUu;“÷ÉÒÑèسF™*+ä$¢à ‰KèÅfâ~H,uÕ9€À”A\ÎÓ–U´éËç¶<ä~T.,™ÊÄD&qó(½¯V óòA‹˜Xììwîdâí¼`‚‚1‚è™j(³ÅzI Ö#ÈPÑÍË%A†Ä3tjŸÝ©"8˜ê×.u ó[/b¬Š ô›dz-h%|iÄ2ÁÛ©ŸZÆ°8v˜á+Í”uqšºF„ìÉ/"˜dá€dÓóÞ¹E£½ž~.¢ëúœÜnN‰-lIA[Ãïù-¤:º0£‚œUŽýx WqªÙT¬2Bg×ólÓì÷³`®…aÜ€|´±¯cHÊ%ÐÌ•& tb½8 ¢øçú”‚i= ZhSÚXŒå6dôDYÊcàÜhƒ¦‰ÍÛç¤BeèÈü¤:L¯‘jÃ8ˆô©ú‡h…¬5N“¿‚VÁô*­IdQ6¡õH•zvO]_ÔÔFÒ7GAl“©cZ`Aت"0iõS,8LëÕ‚ ›²ßXn#qweëx©mÂ@_ø—›<rA)AbíáÕ&²ó #( +¢Ô¼|ãÿö|xendstream +endobj +6534 0 obj << +/Type /Page +/Contents 6535 0 R +/Resources 6533 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6510 0 R +/Annots [ 6537 0 R ] >> endobj -2186 0 obj << -/D [6097 0 R /XYZ 85.039 684.819 null] +6537 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [141.709 431.843 237.338 443.533] +/Subtype /Link +/A << /S /GoTo /D (winbind) >> >> endobj -6101 0 obj << -/D [6097 0 R /XYZ 85.039 666.951 null] +6536 0 obj << +/D [6534 0 R /XYZ 85.039 781.388 null] >> endobj -2190 0 obj << -/D [6097 0 R /XYZ 85.039 526.448 null] +2262 0 obj << +/D [6534 0 R /XYZ 85.039 761.463 null] >> endobj -6102 0 obj << -/D [6097 0 R /XYZ 85.039 497.044 null] +3126 0 obj << +/D [6534 0 R /XYZ 85.039 657.513 null] >> endobj -2194 0 obj << -/D [6097 0 R /XYZ 85.039 229.946 null] +2266 0 obj << +/D [6534 0 R /XYZ 85.039 391.393 null] >> endobj -6103 0 obj << -/D [6097 0 R /XYZ 85.039 199.745 null] +6538 0 obj << +/D [6534 0 R /XYZ 85.039 356.082 null] >> endobj -6096 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F72 3966 0 R /F18 3969 0 R /F66 3242 0 R >> -/XObject << /Im1 3957 0 R >> +6533 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F62 4047 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6106 0 obj << -/Length 3490 +6541 0 obj << +/Length 3479 /Filter /FlateDecode >> stream -xÚµ]sÜ6îÝ¿b§3ÓÎdeQ%±wã&n“6v|‰s¹›¶ŠW»ÖD+¹’ܵÿ}ñAJ”VëdšÞdR$ àŠEÿÄ"U~ õ"I…/Ótq³; [˜ùñDˆ•Y90ß_ŸœþG ø:ЋëÍ€Gù‘’‹ëõ/Þó—gW×ço—+)¥Fþr•$©÷â|)¼w?Ã×Ë•ðÞ@çŠA®Þ.ÃÔ{óë×ç>Õ¾áìZ^ó´µ=âí¾O20À°ñ)×ø J>Èé¿x·—"!@"Ђ ´D 1úçN±ÑÞEÎmV­yü’¼|tÁ,>ýï°"Ø£Êxfm••ÅN -g@Tf›MÝ0’¬B¢y”¬ùP8€½É¾wð!x×à7L¬Ù °€ 1\UwÜÉÊ&ÏÖü‘?mG'Ò;C«ÛÑ9¯Í~äŸh7Ÿ* &²/óõÖlˆ–éà‚Œ¡ ‰x—5j’ -•ˆ #21. Ú²&¯uƒX³‰Cøºâ–íÀ¦§ŒclÎHʧ¶Ë:pÏŒ»#XÆð©â5´~kÞ78xË ±´-–$OØQ>ÎœÕ'\”?P¨/Ž$Iô¦ã‘ÎÈûwŠ7Ô1iLƒ‹ÃÎÖ8GüáøT¿:ž¿ëki •Ø%™ÁyƒÔñ ¢ICKa€îH¼uKœÍ µ5ï±3nÀÖÅæë–5§s´¢˜œqÌ;`[Wv±d˜+&ñœ{‹/‹Ø«ïºbW´4¶æ!2s¥ðº¶èrò`Ê»¾-Ú Ö¶ØV(¤é†-±›a,[ïH5ÀTС?–æú;#CFÿXªØr—ms£ÄÍ©@ù‰|:^u`z?íDìæ"-}-„㧅'UßC18`ýpz‘¡,¿©?〘ãîGhc¢ìz™JRœ0æÓC9fI¿`ˆ|€q”ah5Cœ%KÃŽÚ´<B0ðüªÁèq];Îrsa°<" D44ˆÇ=PEFq{°/›^È‚dÏg¼\;£&:å€âÝcÛå;Ö+Ú³,nyîÑé)Æ ¦½A7EŠ_móIXÒÇB[Ô?ƒ‡Ð49™wW’A‚ Ié쉸¤Ùc˜\q úHŽ¿îÛ>^¤9ᬘ| Îà‘`{à‡ƒŽçN¹¹èã¿ ñJÚ»22€!ºwÈ{\+†£p$‹L¯f¸„Í{)icMh˜©Òˆq°¡õê¬Q›1˜CT?äØHë!îŠ!£b°•€ôc›ùÎìVBàÆo0Ø6>.¼·¹9ôÃ}1 ¥YÖs·ìÏ—˜¼)ù*ùÄŸµ6p3< ?çkÒ0”’iyN±ÇÝ='^Í I)x¤ÐrRÜà]KG#1gJ¢ÑÙ0e QJÎû„š(¯cYdC'gO1æÞjÜ6dyÐË;¤Lд#-©>¯2ö£84‹Þs¦»\Ù̬Ù)†ãNäx£C^i¸¿/%x¡*³÷.NqŠCô>=ŠRïEÍSÇ‘TÃHø–º!Õ†T}›3CìFjnɆ(u¯¯ð3¹ë`Fi¸Ñžt.*L¬S»Ðwö‚Eë¢÷q7] ž,âÔ0p\Gb*2®pm8±Íž¯É•“_…OLýøTìÚ,¦Úž,“¯ Œ‚ˆ‡9‡ü+M¬cùŒ3QÚ>/ åFÙcp‰žŒÀö°kCÚIº;E¡/dbvzùóùÿ -Iê‘ZÈÑð ’G?’GRG‹kå £k}DdŒ~Y£"ßðæùÙë)i!¬Iƒ¿‡4‹ëiÒBH_Á F¤]œ=ùêòÜœb4q'Úz·jFøŠŠ6<™wûºùôµh^×[ëÚÆ·FêÜ -háiŠe-/$˜{¶^›6 äß`¨Î -ôöORÉâñ®/ˆD©M@øƒ8öxO›˜UËÄœüá@à}ó~¸öc NoÈ2ÚoPÿÍÎ`]ïŸ÷£•CÀ@Á°Ýtüû­YÉ‘tyo>-~²·$í¿Éµ´&~á çòf73jÙɵ®o,&>28´Ã¤¯¹Þy44v`ú ý 4–a¾ZO‚vaj,/Ùyòå†ù‰½s÷Ρ@rusTðAë²j]RjsXÙ ÅÇf“úP@í)£¸ÈÿuŒwÎO>80ÇÓÚ|óEõÁ Tª”ØÜÛüšCqLý·ÔKº5A‰9%…o³ÂògËšS€S€Ð¤!_O_'¥Ú84Œ†Ë×J%/vy¤QúAüª'œy”‚h´ìEó5ÓâZ9È=&Ð'5:‹Y_®„ò…ú{(³¸ž¦L‰ÔW©‘ö•¾ÜŠþ]½éöY“Ïáqˆä ñ\7MݲD -ÂñH}á­@yù¾ýÚËåù}ÓäU÷Ÿ¼±•ï ¶4 zï—q.fS”ùkÌæâÚÐ×z éNI\¿“¸¾0Ž–m,7q/^Ikv²›óf·T‚ìKo°4çJŠD1„´kºÛÌøltùßD¤¬6¯6æzâW’`ìVp†+@0CDÀ€ÝÓD’0S˜ºž -~˜‹ĸ<‰'Áé¦Õ ÄAž–òç…¹ƒ¡Ë1·•g70ÌK´y¢™ËtK¹!W+‰|È9²>‚ï+d0Ì'ë ðó «Óx"+€poQ¬Cz~ÈVÌlø)79·Ùðd„T¹Zaö÷ÿxóÌ•Xnë•”õ¸B‚m‘RÈOõrè×S¦‘ÖÄJ7¶êƒ|Q¹&)whL4ß#ÄÁ wIHØéåMÇMC¤RØ1ÏSöv‹D2.ŸšÒ‰9áñ‹ò4ûz5¤h D/ÍÞ8¼‚|p0x”Q¾ ®œ’ †›Jx¯¸Ú¡B3˜æ=É 6µæ“#¯ô„ =Ì‚:/¦/*º¢‘™èYɵ®¹ûã d«MÉVSW9tø«!f ª÷úç5-úYâ­Æ(ºèKs@mÆPU¾§; FœÇ+ž#–k2f˜ç‹Q‹#Žr‡-GÆؤSË”uCÔƯ>+ 8¾Û=ã~ÿB‹ë§e±‰Â9Ö,åä*•(»un6¦³o -¼¾º¾j+DŽãߌj x:½´ñq™:±ê¤§ä¥ÌWË“5u¶+ª­AzXúÆÐ¥zFD€­æ‘ãέSK“Øcëàù\,0ñxRNýF4½/¿Ê‰ …üE?™ä:0Ç_åtìÇ"å÷áçå.‘ºëÈä똤ÓtC! ?Z!ÛìöÕÈñÌ<‰ý@¤üþ€Y¶RD,¶ÐZ'éµ’‘\ìØà ûî+®Ê@ø5y¦xûL Ýúc— Ž|Í+†Gq5„6ØG_3‰·’÷˜\å[~X™ê,O¹zô¶®»og’§Q‰î “§¹(…$ɹoû¡2¯˜Š‹j,Aš†ó/Ë¥Í+h€‚=JW²ª-³Î¼S‚ÒŠØOÒ>iün†WPä—/È^ùçŒÿ/aNžöµÑ#e©Àgíþøl¿ê'•Ã‹·ôSÇèÇÏaè‡ÂÒ‚ÔJ!*)ëòà? $Rendstream +xÚ­ZKsÛ8¾ûWè¶TUÄÁÇìɉ³;ž™<6Vj3s )ÚæF"µ$mÿýöA‰Rª2S©”A Ñh4ûë%ü‹L‡‘Êi&B•e‹rw-îaåßÂP¬ ÉÊ£y³¾xý/,DæQ¾Xß|tkµXo~ Þþxùiýîór¥” +¤—«4Í‚OË,.ßóì›Ë›wK\áS Dp½\‰àëÏ4|óeý/—2 ¾¬|÷a}ý×.‘ÕšÈ>ÂŽË?Ö?]¼[;ÉL eŽbÿïâ·?¢Å®øÓEª<[<Ã8 +,ï.@îPÇÊnQþ$Ší¶E zî™fx0 =Zyhï uƒ´/üÀú—)‰Ïj “'ÚÝ~ s5ïx3ížpªêÀø3-A™u„+Æa"R|1`W9]b`¡Û-š{%ü… kf¶á¤Ã¿^’L½!~½æÁÏK1J{KŒÑx^ñê´TÃÒ¨§Âûóé]Ec$Ø“2Ú¡â × Z 1" *J_Qµ*P1¸~Y5k…4MtpUwVðrh»Fþï‘Žê;WMq $Ûj³"<´G±$OB¥gQèÑœD¡¥AÙ~¹Z¢ø(Û§cŠ,L£äìÁ–æèä©}Ë8‰˜Í ÔI°ŸA`’‡ŽÇôûhx}CÂT‚“O'nɆöŒ@”ìª%;Ù<ÒûÂù4`S ¦ D ìå{CD ÔÚ!¬‚úááò?=i¨;¦~R¼d1‰ õí– +)o2Àã+[P5K4~d +‰õÄ{†Âa‰à-sߵͭ3Í +£¤ +ššC A09õÞ,"<6åöqc!ð© +n{cãóÎY aÄ…eþ$CÍ£àæ±™AÙÇïLxâ•Ñ!™`Ê:LjÜ[-œ_ñ¾ôyi»5ÀìV¤ûß°Åîô¦fÿûº·ÒÞ &².”£ó¼Äù“Há¶â<ÐÉiœ3 *ç;üŠ`/–àíP•¤Áz?ä/«îåؤ:irN Kr(ÑA|‹ÂD _$‚¿ÌÅü¥Ta¦cïØïF¿euV<)ÓPÈÔ¯)÷GRÅq˜jñ·HeX—*ÎÂHƾTÅ#Úáy$ÔÝÄ#§ sy葶>X š˜ncZAi&l„2{¬¯Â‡[2‡ãŽ¦£Ñç·¿Øï¥ÃTÈ >?T`~™ + + oÛÎŒ>Q\5ÙBÙøÝì®6v²SŸ„Q$Â8Qçq4Òœ’¡ÁkܼÃÈùDXêûgüÛ¦6ÇøI û‹ÔYI,Í‘(SA‹t6‘…2/H̲Y; Ǧ#”` èÆ‘pl9D>•ù2~¿]^çï"s41¹K¿Cc½¥Gîµ#7x®Ñ£ø.ßåÇGk¼ˆA ¯qû%˜5Ú4.›Æ–T;…ä\Á-|;ÝÃ;ÝÜûCi¼H7†WZ +ãì9¯U&L# ß?:—O;dP7vgŃ›‚ïy±e‡Ç݆eÛÜÙlQÄ”qœ²u ±>-Ÿ³u椭[š‰­ß@¬cM[x ÙÕÙÓ™âèð©uë8ÔZON§¡t4›æPÔÉɹߟ^ç%”`«I®&›=Ž^`Öyþ·gy}C8H¯ÓTN„óCjq.yUš ¦ž‡6@à¸EÇZß×-£€ÅûøçÁ¯4»q•'Ò7Öé ŒO,úº¯2îy·ÈÂse (Àc$ZàPlý™jÇèòŒ¼4lEì®sÆàØ{Uã!«Ý‘”ÏD70]KŽcS ÕÆâÞ¦‹jT +âÅe‘Ðssz=’´„לdça:Òœ†©¡A}ýêr8¢)Í>„ŒÌÃ4IÏJ`iŽD8è¨èP"ø<L1—ì¨D¡Ô¹ø_è¨0¯o ®]«©Ï5Ù:Ûš™°7/ ©CkÂÛK]È!ÃCÒ©×Æ™¡å -Î úyª O„$XÂîA×îÌ9dW/¼0ãvŠ¥0ÁI›7}¼(®Ú§¢ ò)>ˆ’)úXßÅPl]¼ÎÙž!þ/6’z³Rnd¼E_Sekáâ´(„UêÚàî£Ü Ñä–ÓØXÝóãV¸´·$ºŠƒþLaÇ­!5&£ø0鸤 L½GKÜZ•ŸFdœè0OÏ[ÍIDZùóåŠt Ç~¹™émŠPAv|îdKstô«6 ±£* ¦¬ÿüç¦ß¨3™+ñúË /`+êsÅŽl°E„† +vòfˆôª&H¬èz ³úbÊa¦¸q“+0*lkYæ||Oj¢ĵXOcz‹ýG•’q‚Ñ xĆÇöÖó”iŒê @Üïê¦î‡®à¢ž)žm÷sÍ8h*›¹AŽÊ‡Ù­)QÈ®‘¡µ|³;¡¬¯4S¥ñ*o¿³ÇÑ6Nß5G¹»¤žù›0N {)îÕìð2¼¨¹ËÒõ-ðyàMpmÒ*ëb;©œzlþÄ‘³¤ßOÊ0:qkâm’Œ¥Œ§¾Žt1_…ñ3ãL×>Î0úQú¸W¼žb{¦äëCc)E ü:eܲûx‡šLÝ[‘)xÎÈk2—W8‘“©N<9RïÉ/míŠÝž×|®s•T’…à' +ê©’¿–ø^+ÙLâ1BgÒ8_I=o¸aR !“fU<˜¹JEa¢ÿ–›Vç/G*Ì¥š\d&\›[LCµy9Ŷm*cJdôÁ +M$Ê9úllLB,ŠÅÚæ†Ì1ícì ¹éV‚uz¥üµ?ýt»Ýzo—nݼlvj÷us°µ6©7^&å_Ä|47xtVÿùÃr•Fæ‡õ胻ƒT½gµoýä/53`͵D_Í(âu5Ða¯M?uOÝTü“=HÛ´b_sûª| éPˆúš}ÝW@ŠH/¨¥S.‘LÏ‚Ú£qNG„9F%j¡³PêÌs:"h?:‚×@ž¤XôsþÒYkÁŽíK3žQC¹¨Î»Eæ¤ß¡¯ú‚­rM]ÌR¬Ó‰lìtßOY:lè/mSó +ôš+ïW!f»Ãi„‰Fç¾ÄþÅXåŸüLøˆL*„ƒûª©:¬?iuoÚ†uÇU-ÿèÃð­ÌFWÉDÒ%9¦J••«µw­ÌÏlŽ _‰C–Z8açœã$ +z“P–5Ò–<9´Ó/ AÁ@oe°实³Àe‡ ~¤ä +ù”Åø» ¸öUÓ×ö;µrmϘû¨„LøGýîZ×þõ²^úDžF^{¢¨ÄÖy5€šü¶û|äì Jo èâ…GÜõ6¤Š¿»=˜ t¦Óï¾¥aÂÕͶø\ÊÙ, þó‰éw”ÎgÆ*ÌÔ‰TMKIÝ\–o¨´>”W« Êyu,ðÿJÀendstream endobj -6105 0 obj << +6540 0 obj << /Type /Page -/Contents 6106 0 R -/Resources 6104 0 R +/Contents 6541 0 R +/Resources 6539 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6112 0 R ->> endobj -6107 0 obj << -/D [6105 0 R /XYZ 85.039 781.388 null] ->> endobj -2198 0 obj << -/D [6105 0 R /XYZ 85.039 626.181 null] ->> endobj -6108 0 obj << -/D [6105 0 R /XYZ 85.039 604.419 null] ->> endobj -2202 0 obj << -/D [6105 0 R /XYZ 85.039 505.738 null] +/Parent 6545 0 R >> endobj -6109 0 obj << -/D [6105 0 R /XYZ 85.039 483.877 null] +6542 0 obj << +/D [6540 0 R /XYZ 85.039 781.388 null] >> endobj -2206 0 obj << -/D [6105 0 R /XYZ 85.039 333.987 null] +2270 0 obj << +/D [6540 0 R /XYZ 85.039 308.93 null] >> endobj -6110 0 obj << -/D [6105 0 R /XYZ 85.039 312.787 null] +6543 0 obj << +/D [6540 0 R /XYZ 85.039 268.766 null] >> endobj -2210 0 obj << -/D [6105 0 R /XYZ 85.039 108.439 null] +2274 0 obj << +/D [6540 0 R /XYZ 85.039 183.027 null] >> endobj -6111 0 obj << -/D [6105 0 R /XYZ 85.039 89.567 null] +6544 0 obj << +/D [6540 0 R /XYZ 85.039 148.888 null] >> endobj -6104 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F11 2898 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R >> -/XObject << /Im1 3957 0 R >> +6539 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6115 0 obj << -/Length 3968 -/Filter /FlateDecode ->> -stream -xÚÕkoÛFò»…P ˆ D,—»|¸¾Äy´¶“³•+Š¶(‰¶‰H¢KQqüïo^»\J”â^Šâ®AErwvvvvÞ»V£þ©Q¡ÎGi¦e£Ùò(Ý@Ïë#%™x0ÿœ}ÿ*1#y˜¦×ž80±Mç¿Œ_¼9y?=½<žh­Ç‘ Ž'iš_ž«ñÕð3=ž¨ñ;xyÏ ï/£lüîÕÛ³Sn8?¹8Á¦×szŽã.¦Ç¿M8::êܼ@IŽ¤ýqôËoáhËøá( tžîá= t/€¶ 6Z¾GWGÿr¨¸ÏŒxÔ'bq¦wY¡bJEVÑ(à  ñâÃjä—¸âgô¸½…†jf<¯Û=këæAê? š- ÖjCÖØÒ x]0ᕉèïñ»B úx<‰RÛKC#-¿†q¨áGñTóÊ y•aý·ãûWÚ_¾6ª †ë>™/«Uµž Üh"]…ŒÎ  m -ÀÈhz\Ô&Љ4ÏæI‚$Ií4¸®8ŠÇÖe³À+˜1~$¶—åu±Y´Æ„I¤Q"^žŠÓ ŒóÞú¦·åÀlQ’¡M|D€–¡e/f´ñ5î1I ì ˆ (K[XÁÀÆ%ítäã ¶„,1eÛÔ€µ·EËÝESZtË%‚²BǬ©×^°²B'Û›eÀDY~Ì»[Ž(Sã - @Á -˜(ÙÖÔqò'6!UœCŒÁ¹wƒ}ÆDY8¶ ‰ˆªR ™7A¼ÁšcãÔ¯^Vëâã¢)0I AÖ|)¸³êÆê¶Í.¥a^"P6.ÉRT«n&ökíÔZk3¾ÃÅÕ¿†Ê,JîÝÝT›Ãœ8¬æîÕ÷³¦,Z¢ç`©núÔþäLNž'd€òt¼*ïñ%Û"zdóƒ-j"ÀkÇÕšÁÉ„ÁóüŠA"ºç5‚ÝË ‹©a eÁ Áí]•‚€aV–Î{n¾C˜1Â-ªÖ²/» ±M+Z‹gÎì¼&<ËçÛÎÆZöì˜6C."RAFÆoÈ}(°i -¼G7|Àyè\Ll§pöÉ-°v]¶x{ß÷Ñ HÓü¿§× ?@/Ã8ÍE_ÓZ²}9Uô73±6 ‘¨ªk+÷"ôÎâæ€e8fAƒž‹©eL/QˆNŽ3ñã&Ù\”äÏX@C!zƒdÉÌÇ1‰<6k§µð…³²XljëZàeÉ4<"y“ЃøÞË kè'㊢h‹ #€˜b€ àÀR’ˆÅZâ€}s0õuêójr@èÙÔ×ÌÂ(IǼÈÙE«jqŠî ú—h9á3áÝÀöëšBÖX\ Í"lmy·æW6™8-ì¤~Î(-ê¦$ªØDƒ—ÉÃtØÜVIÜ>èäBäÃqžçä: NN€púh¯“;4urg³NΛ M” =“f^ †=`ÈÓeäéBNqŠ5ƒÜ´eäC–]°óÏ0ýŒÇ7l‚iˆ ©Ð(=<[–ŒæÔÛJ€àóº [îTÝîZÓòKµFÃźãQD‰>(ÑŠ"2Y -6’:™#ÊèæÜP –ýzžçÿƒ*~Œšhe¨ºèkÇp=â~Iâ8D¯—ZïgS”{$?ªyÅ*ßÖìÕU“¨@kuXW= ýºjpj½OWN'ºzx6ÑU6 -'¢NŒ5DŸ§¶²{†¥Ý×ï.ÆF¸…"- ÅÆשTžÓ¥³¸Êæ3ÂPpOÌ %<Õ #}©dZî'™»Á@!E2”æ0 [é$~Æ4ïóÐAèâbú¢^]W7ÁûwgûJ‰VÑ„TmlToUûÔ¦üqo}V 3_ÐzÜ-ª^qÃpªÍ!+‰G<Ê|ðòdúXô² T³JrüAr´sHAŒsûo~<ýy[Æ£4!IF9Òúë§:0:<˜X\iC¿~›æ -#7#w|¸¼<Ý= Ð -ŒIö—Ð&¨“¦# Æ#鑆Fu`÷"ˆ×Œ­·Þ-©hŽÚýê‹;ž¸©\Ù“mm¦÷$& -ƒ$ûJÖíí3r‰Ã„”š½FîÐtÖÈœÍ9o¶~a(íXtJÕ¡†ßºÊ|ÔJM2PÝëÝA[±(ôV2N‚bRs£—r}úšºXrÅCPî¤:ÐX ¢þáOjd¶÷©·~Lb$ßjù“#e“£h79²é;¼¶Ð6]ˆ|JKÊ14{‹}ÚQÊÙ¢Í~[çð¦õ’”H2›)â[SN¨h"ñ'0© BÕ7f]zEž£‹\Y£äî`ÄKÆg{;lʲ ™?`Êð`1×#øŸ$ñ›L™àšxÈLYf iÍÝŒ‡L*#$'q×aâ ¢B£{Äí7fƱÖmŽ;äiÝé“ 1«¼S ÔÕHw!J½Y sŠBW(]I0?‰°jÜÏÐ(¦0•q_¥‚€/§Ó³wxˆMÁJ·ƒ!V Ö’4HÜØW¢AUfa©2ã“°*¿HI²h¯âD” 5šLÐÌ® bf¢ÞbI«skòˆíqú3•F6ë¡£=€Ó|äR ´*_¡ÕÂùØéTrÔ;ËåzìÌ4Ì€¢©Ûv’EB‡¾"HêC~t¥hhíÖîN• ½QYïÐÓ<ŸP¸à-‡x…pâ ÏneôÆËmqçФÆð#²„V~à|<&Å[Ð -Ï×ûìt‘D»gl‰Æë€Ý0ÀváT`°B™q…R;Žï®B¥a¹ ñŒèÇŸþ‹!…Í‚0³ù£½ÐÇ©Á [‘¾t(Ñõ qÄ(°ª«_ÅÀñ^Û™ï£CëÅÕ±¬áÛ2Içè­·¢µÙcæ5Ⱥàÿ»2 $xin)Ú­=M’,G¶âò9 ¹áíÂz,üľbÁGNÂQ¯b£zmJ>erG„TToüLÁšÖ..Ðb)Q*À¥¢Á×39j_u2½îå>\'Øw”Åuƒ›Êv©ñe•.'´)Žö+2C7cT -Ú ÆœšQ¹‹~?{÷âäì÷ó“oÞ^œþ -‘êÕÏWÓÓsz«¯Û{ðø~^áÑ4à¨ó¼F=ƪÄÅ›^lš¦\µÿ.›5l¶ÜW+2÷ø>í}÷²\”myÉ»ø¢˜Ý–ßýc~_7óç!ÿ§†r¾„ÊļŠŒ ¤!d~œ-Ó½ƒ‰ sÑ8®ßQíMò}„öQð{V߉©Á/L¬«a¯¨ƒý}Uö¨—íëXW€e~t>Ñžl¼hÓœ^DîŠnõ¦Ý{«cë -Z¢Ä5¨=®AÜÂÜ?͇ï—:{g!kîºæ®¨w(Qöl—2‰fÖy—ˆË6•(Ô€%5pËšÒó÷—õl3p£Œ½ïT`¨´®U;IpÇn`ÜÃá#R{wñø”:æÄ'¡ü îâÉÖ¹ö­o‹ÆžO'€Ü¦>ògöÍ+,O>ØŽ¦¸À -ܵ‚ŒQÛ<ð3ía-¾_Ö·u÷lm/õåaw¨XÝ”tËFyÞºLz -/ø¡£Gø\üÒÍñ7¥=ð¤s=i#Åä+ ôýž¸DõWOƒf¬R ·%éÉYó)ù…÷¹½4$×äÝ’½kÓšò$®¢À:N™"¾Q‘À$aÃö2BÙ¹O‘óíE:ÄS.ùzh‚Au¹ZóY' ¢;½Æ!÷9øB¬{öÀ îþUÕ:àšŸ…» ±»°îhÓ«áu;¦cæÕªô<\Sonnwï½þð6à·>¥¸åË9ÍlµÓNd÷Áb¶„ØçG7Fóõ‰­&axиò‘ï2­:r-hOYV©¾9RÊ¿Ÿ£Ôîy ç9*¶ÕT€¹§3yŠùš³›o%G‚`‹ k ”»©zçÑ‚³ÙÈPL꘣´éˆ1ë¶V­Åes­Èjïîù¯§•‚÷z¯9Ÿ²žåãK©Ë±eÀooªÏ¡˜0t30‘@+‚ÂË÷Ö Ü»9spK[ù¹rê‘Ë©><ùVOçWÖvž"ã‘Ñù[ÓúÃ3>^SšoÝ"ó6¾v6š*ÌMé •”¾xTJé ª”nøª' ªxÒ¡»[tÑÌØxo0¼Û]ÄP‰ï‡f*åa%ßV¶¨&®ÝŠŠ!3ƒØD`ÔwT®‚P«¿„2Au˜²Ü&É|ʼâŽéß—îr䯅_6fþÖ0ÎÅÛˆz÷É¿WÚX}€ž0øê²,–~x?€,ƒÈÔ#wúånéUó­¶ö@tZ®‚Șžü_Ý–öšÆ+°ÝE Ó¿õÝѵÌ84qÛ³’S{0Q°•"·i­¶““ò:3ˆW£Ý4Tt{@%a4×ò¼SbÓÖx2•…˜Že±*n¬Má rîÝp7ÆR¨}C¶ÏÖí¢ÂyÄç{þàEƒR^½G‚ø›þÆýÑÑA¦÷Ü߈A-#ei¡óge¶éµ3³Cð^]•%endstream +6548 0 obj << +/Length 3061 +/Filter /FlateDecode +>> +stream +xÚ¥ZK“Û6¾Ï¯PÕ†ª²8ßôžÆÉxãÔ®µ•S’²1"¥á†…¤f¬¿ý IÔìaËe“F£_7­üQ‹4r½ [$©rƒ4]lêo±ƒ™Ü(¡X ÉÊ¢y·¾¹{Å å¹™—-ÖÛ‰Oä†Q°Xç¿9?ütÿËúáórãGîr•$©óË2 ûñè»û/Kåüˆ¿Bx(çÃr¥œ/ð²þL¯ï~]?üÈÄ÷K?u~]ÿôðqý᜻GVk"û+>.ÿXÿ|ó°%e)3û¯›ßþð9ñçÏ ²tñïž«`º¾¹Ý( äwuóåæß#+ž ¼jNKQºQ\ªIE3jŠ<7òBRÓ‡ŽùŽÎá y9À¿e+cC‹Oå OTeó¹ç‘¼èñצ+—+?qŠœÇåÎU°¤]¯—78#»Njó2 v_ªå~?qØ”ºâÑ ’=éNo†¢ö]‹£Ï%Àì¿ÅM;áýÄBQàlÚf…Z[)TjFZxFESÍ ÃÈi·üD…<ÉX¤ÃEÍ¿u^“BÊ~èôÐvo—«0ŽAH jëšdoóÐË‚N$÷}WaÁ2‡!è Hü®™èÛßnåw#DÄôû¥`öphž¡ÛB‰Ÿ¦Mšâû0sÜ¢ÉW-ªhE„škŠ¿³h¼/:gû†-¿Æ Y~€‰ª`ªÓëùÝSáFl8°B8öL[k¼×#O†3 ˆB燩—D§7Ío(úÝûPY&ø©›%pj˜âWQäü‡ms—ƒ÷É(ÑS¢ê$±PLݶ‘ÉèÌöpåH¦c/Îo5{ñ’Eä+7‹¾UïvBðÙº_!^YÔ—÷{Æqº_Á$8_l!Ív+#8ÍàͶµ,ÞëÝ…øay- Nå?³JCóºØb–aºiœ’Ø÷,ÄnD#ôÒ±oI Ù(­Ù AÈQn²À +a0vW˜Ë¦[¿£F×é[ZàSz4 ×j6£m‹A¿bJ»îx7°úµÆž×Ýs¹)V&H%‘Ã1k5÷f$º¶Zm+½;%ÚS¦ÝíúÀrºÝ;FÍj2ûYÀÞY ³!hÚãq4º¶ŸN*ùºÐ9 ΡZñYè þÉ¥<Å/ŒZñú ÞÈ$qF¢E‹ "ÑüÃx¾DË…<ò„ÎÛýYs²oÀ2–ÓGtrŽA,†‰D ƒ¨vŒ-©ä°—XadŠ¡€$ˆ<ÏH«yŒÓ( ÂQHÆ‚çf»‘,1hØ /ÇWÈlÀüGÜõ•ÆÎ'©Òñ¾ð¬ÅEÆ‡Õ ™sãbºö…N~âOšÓ8—@fW´ÿñ2ßðÀ‹5ùRVâŸ#HêIǤ؈><•ŒHº^28A6îy°I2¨C£E%&àö¹P#«‰äjÊÛ QKà‡oÏ÷U‘ïèe_¡8ß÷´tˆR€þ¡½1Çe•:ìþøF— R oeâ"¨?“ÇtÏuÔ¶Kê +‘A Òì­RǪ;ò#ð"B™§<ÄVÆÏŽÌp0‚²OwdøñïñTé@¡“¤þ‰ –ý™í‹‹›"i Cø¦Ø^) +³{<-Þ•Ï€€: ½_™‰³wJÙ;àì ‹¹²Õõ^À2geŽßÖ Nó[3ØQHß‘sä·²ÏX'ηþpK™}ÆßR At^¡°Ê¾µ´(”¹E5)¨=°ãäb»ÀsS(¶_ÛNHηÃUÓvAl‹mºog2°ß—–Þ˜(C/¼h±àØ™zqƒ…éçVŽ{Ú{Æ}Ñ „”ZOHq°Ûc”1þbÄ&Ž2‰;&ÿÓˆ£Ðy_vc+¦2É}Þ÷œr^$ø$kñ +½¨ªì »©ôÑ4Fò4•è /ã¶ôË`8 yj ©9Á‘6Bk™«zjjR§)WÙ,žè°a ØÌqG“ýM!gUšà>—akßQEËw@éÎû ¾±…ag(¾â‹æÇ^p¥¶ËyÔµœ`ð•Ã°–S oªŒ`¦ÌMZ•šƒ³+ú6 ­/ÅTäUX§ÅÙ$äY†¸(u65¾£ü$hi{Ɯʩ'—Ñõ&´”BƒáŒqP!ªÉgB³gð:µ__q“k×µ”S{¦ kŸ[©%è9ôýÔ̸üHíòã¼´“K5=šv2;!×,ŸËÊŒï +»†©vòY ”Þ(Îmº±˜´½Ðôvž.°Ù™6jÖ`†²§{5”*ƒý^¥Ñ+ÁTˆþg4}mÇ1œží8O­ùDèvšT3ÌÅÖ0t•ŠÏc+~=ºh_ãg+1B«¹Öó÷§†ü¾(]ƒ¦aà<êÉ~ð»Ö†]é°M•ÆkÝè]a÷Ñ÷’D kh:õ+‘þäË…„SþÐ-4ªŒÃ¸½ßÊZecêQ™ 5Ü™“ÖåÀDŒ"¢a„ñÃdd ù!A÷¤ôÂqëÔ¸-*çzIZ7È©¬å‚P催9;øó.1 ç‹ð¢Ù#¬¬ôce:D>GÎã·QÅ8<²í[ꮌßrL»§Öß!9`RVpÓ…†Gî§JºKÊŽÓ=£*\Ö +•Ñî“–˜Ã ©IÐËoT0ìÜ1Ò^F½§ê±ÜLüÞÊ…ôU‘ …­A>b!)ŸÎ¨?\O;Åv7 +ã¾åÕ½Òÿwõ³9O†¿,ìÿõßÆoaà¦A6…#ßw}edAåQ|.¯ùoÿ~ö$Äendstream endobj -6114 0 obj << +6547 0 obj << /Type /Page -/Contents 6115 0 R -/Resources 6113 0 R +/Contents 6548 0 R +/Resources 6546 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6112 0 R ->> endobj -6116 0 obj << -/D [6114 0 R /XYZ 85.039 781.388 null] +/Parent 6545 0 R +/Annots [ 6551 0 R ] >> endobj -6117 0 obj << -/D [6114 0 R /XYZ 85.039 608.251 null] +6551 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [324.074 518.849 496.369 530.539] +/Subtype/Link/A<> >> endobj -6118 0 obj << -/D [6114 0 R /XYZ 85.039 515.528 null] +6549 0 obj << +/D [6547 0 R /XYZ 85.039 781.388 null] >> endobj -6119 0 obj << -/D [6114 0 R /XYZ 85.039 472.759 null] +2278 0 obj << +/D [6547 0 R /XYZ 85.039 596.758 null] >> endobj -6120 0 obj << -/D [6114 0 R /XYZ 85.039 432.111 null] +6550 0 obj << +/D [6547 0 R /XYZ 85.039 559.887 null] >> endobj -6113 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F66 3242 0 R >> +6546 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F35 2976 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6123 0 obj << -/Length 3060 +6554 0 obj << +/Length 3927 /Filter /FlateDecode >> stream -xÚí[ÝsÛ8Ï_á—ÎØ35ËO}ô-צ»mškÜíÞìîƒë(Ž®²••åíæ¿?€ $Ú–”´UîÒ™›ÌD”D ð´qø£È0®âQ ¦¢h´XñÑÞ¼<®ÇÔu™z}þ1;zò"Ð#ÁYÌãÑ첡c˜6j4»ømüìÕñÙìäýdª”KÍ&Ó0ŒÆÏO&b|þ3ü›M¦bügÔåìýDFãw/^¿9¡oOñÑKèsò¿;Mþ˜ýtt2«¹«ÇNbdíÏ£ßþ࣠˜ÆOGœ©8}6g^¯Ž€7f´r÷ÙÑùÑ?kRôNè«6IT=¦’³PÊÃáÂ8té½áÔÁp|4À³j) -Y$ ˆœ™Ðøö¯5k"”,LC#-™ÀÓRÕ«ê„jšMâ`<ÿ”¡6|d•%PÐO^ã}m¦ƒÆÃÏžîkBª`ä ~À!¾?àn‡¾O‡ø°I©‚Ðpú¿J²Œî^L€Ï<»˜X¦ëNEu¿L7eqC?#ˆ’› ÞéqýÉ%4æÛ¬¤NM ˆ!ÛVo7ûóÓôk¢¶9ÌU…‚‰P¦qÌt¬ûú¢½èQ0.Ì÷á…o»ÍÀ~Ä µ\ï]*¹ -xØ®©X0 B1¡ŒUÖé|•ì‹L Á!G ©og«¢ÕË—!‹ÁEùŒ=O.ç¨ÕJÑ¿ r*Eï1l|éAFU FLÆÿ T 俺u+À D¡áñõ5Hëù¼œwj¸¡8„Šûø«uì1øèÃ9.ïÑpÏl£ZI9?æ¯UqÀ"9?¶nst`“ƽ§¹géb^¦ùš ’@ßщž!„±Ÿhø˜aЀüD¨ûÑÃ9“Й pƒzù\æ×]ðñHŸ^køxÞ#|êÉÙÃùWˆdþ÷€˜¡NI&eÿbÀ(ci¥«»û’!,Ë Š—õ´l_—k 5c ¡>Ž+ ù,ß#†:¤±éDÓ’xÀËWDL†q?š ÒUªÛÐ$)_å“)ŠÎþ¿è„PCxõ±YCÈãó!t«jì !‚¼vÍ”ýÐ1ЬÜά­­Q¾Ã 5# ¡>~k y ß#†dÞ -¦!dñ—5 ßEý‘P 5Ó:n$˜/‹ùª{kHŸ>køxÞ#|ÎmÌ\¸]ØÛÄiÛB@cÂàªÚe»Hk!Ò‡¼Ê€iô£Pqf¸°"{o㨅ýJˆÇe'ÊC€±ÏŒ£÷ÆJäÍ:‘3Äüðb($ÓQÔÀx”Ð=OÖ6o‹©·NÌ4D‡ÀL‹5f<ïÓõM¿†ÌÓÀKž‰#x}KÅ% ¸iõúµÓÙvÈaõò[Ècø²¶!i9 ¼lÉ°J}ß…%×» I¡`\÷O&ŠD·;ÒÛvf‘<ŠßÎ^ƒœ>þ*äø þ7ÝÀž®« NçØ£'ž‚E,Âo‹§öHiÃB~%ÓÛÎ´× -â -ôjÚ -X &¾o„þf2èÈ©˜”((¡+9¦ÙUB,¯Æ5Á|´öK]tS^ͯYäèÌaûf?A:%T㌶q~†;¿¬HÐ`¶p¶WH¹¶Pù ¹T¯Cµ—éz¹¡n©åð)Eù³ä;~õóÉ¿ö"4ZI82"fQO V‹^Ùx­Uð­©GÌJ~‡'a8“` U'äìÍ»gÇoX cئ Äš£u k‘b\¨ÖÞ?{õúô¤ÍT9‹Ø5UÕeõçï^Ì>¿?i7ù?¥ºLþmº(òM~Y¶më¨ÚÜ‘¡éú"ÿ²ùÞy=ÛE².IŠ BûZúˆÄgwò÷u–IÑ%¥ðŽt>lˆø.°8;vpNEn#ÍøEž]ë-~ÖµÜn`Ç=tÔ·ÝV§H›·í>¯ÝÉÓŽ³Ðé|âwŸvmžUpØó©Ž;w;î¼aß©9D -aÇq׫êÔ}ÜAvw;O;舅&xãžxp}˜Ü=õ°Gi·fí´Tùc¬EäsÇllR–Ö¹/ÝEÒzbÿP¬Ä\mÓ8<Ô`"¦Y%Xœ‚Û5à >¨í‹Ö¸ ö—´-ûÖä+üºr.qÝåLo”¶0½MîÓ*Ä·"m}E5¦?ñ=ˆ¢0ÖU„u/Óuˆ°8[±Ž' -Ë[ó1R½Ñ€}/ï5ì=æ §.¹”€q´b<“øÖ´Gq(Ä*]i6Di÷a%ÑTÀÁÄûãFÌÕklv†3Þ C ¿å -ù>ÏÿGþòÍ›ïH?V¾ì]ÊÞ_V(PYÌ›T³„·°[FUÃ&Vh…p Å@°c5 ¤­Ødj ¿=sJ›LÙÐÉùßO~¥Œtûî^qÀVкEÆ1|Q²¯äØ$¸LÌLtnã´`2RwŽ¼]÷ýT™“˜BÀ„jdÊ™…,€ÈGÚ$+í©Osôu´íßÏå¹î<¦¤c˜£?G˜›ÆßgØ>^ÛN ™˜}ðäõJŒžçÀéh‡Y¢;õ“Ï‹vRŽ }Ø'KÃÔ¨ômʹU((þ³:åbü«ûÉ ¼~…ÓÉW ½8¹H«)bÃúxètAN3qŸo«¤qâ^ûi]¸¿¦ÞÝmëß`È8†wðª¨s¾@è±õP»™ÜO[bCóx¼˜¯±×¹{rmN#2]¤×sì›Ð«tMW;eëðçtäÈR ¦ø(Ò©Ü`9ö1ô –åKz’¯ËœZóu ˧³'ÇÏQæJŽ7D7sÙñ}fS¯9&[.¨]^m7Ô²`#ÿT©¢šuL¨±'HûÅ:»¡ÖeACzl’ÓOKÒF†©=0}-!W)R`ô@½pM0¥ˆðþ)uàˆ˜T‡ȕ” î<]/©Y^¥›šXóiHBœÊÖIݾô}–o\w@î¡xÉ/ÁwÃFŒ­³:¹.Ýs[o°U ¸yíãSjN`„Œ…·ÂßYéúj^µAñ¹k:YÛiد)Q°¡…Ó9æÕ²ÆÞBã”ùÅ*]{5 Ýœ$M=sº.ŠZ\–Ç0€6\ôx™åŸðqFÑöP¦ÖöàþºR[ƒ û-Hè¢âéd}Il,\F0-«òM‘£­,¯ª{×ÁšµŸX|i÷ý°t»,FYYºpéÃw8Dô¿Éþª´äïÜpxúòìÝš‚¤CûvL£ÔÎú;|?.0B¼»®ü} ’¿@£L!NHÁ§xôãU [ÀT£nñ²N¾ Ƹça zƒÊ,À­Ø·™ ¸6tãêr9õC¯×©Õxm1Ø“Vò3ê°š/¡WÖµ$ôŒ z¶ðýN¹ÎÕ‘›"‚CZ?ÈÜ—«ZBˆ½8¿DNi¯´)²ª¸\}¼ú¯]JÆâk™µÄ¥8L½0£Fä{y/ÂAèEAH¬L|/ñcËÊ8pX¯b?º6@àå~o/¦$¿v›cT˜Fês0F)Óåb쫾¯‰«mþ~ ä7߉3+¼œ&ù þØl},»úðŒcyCgG«zêÁêØ®7t„»u*é3ce4½@lÑòr¨ÐÜÆ_=ÕôvmÝÐð^æ€mö½ù,kxv¥Ó‡VÆïG¶bü!--Vء숸F‡]ð¾îÛŽ3šý€Y°:õ¼j'_ºU7åýPi7¬îY:¶e3™€pµáŸ!× Û*fEÕ}®·)M’ä«`ÙvM 5€^ÖáæÚ§ Lj!íC»ß+ß°]²Ñö~M2œÐR÷`Iw,‡g>^¹µ8ªͺÙË(s†ÄÕ>š½a+ q³=´½B¦GßyéÝñA—òQ}ÑmR_³W9xÌT({ š³—„·rlO x:ˆXˆõØÕ9’íÐvuÕ¿«S [o¦Zª¨izY’¿¬ÌÐee6@¯)ó‹2Ÿc\Tfãã:ŠõO$ÍÔÚ-©sBÛ sUgèfL:”ý€V4Ó`Œ`õ3u<òX%f®eúߘSwPFŒ‹Iû$r#r ÂB½Fr±J‰É$gz¬[#› xûÉÑVc݉+Ý´w–a1/5Ù•š…ŠZ_Xø+ S-ô qÅêRùüˆ=l˃µqa‘ƒ®®’5°kÌg]ѵÎy†>³{Ì©J£Øøúk‹Ý< +Ã8VXnÝt%ìbBäW ú|Wöløˆ“åi4G£b°*—ƒ±ñüÃO|¦f Ç‘q8¡“%l#'¯Çî ïØ= Ÿ‹àݲmÈ +kB€èÚÃ†Ô )÷2ÌâB¿ªØŠ`±y´Ù ãáâÜgóЂkO`e…Æl€[ßAËîYºžjâ-·¬l–ÛA×iÍzJ6ó÷d¸µþ+­t€s¶ß—`èá¤kDZZ½8‰¤¾£ËÐJÆëA{ù}Í%ÆqŒýK÷ðÀñU±ú8ú]× ©ØxzŠD¤ ‘ë›ðÁ؇’åqT± BRh¥™lT½Ýóœ7VÃè€xõò¨_£$e úRm óí£­ÑoD± ì7FY£QßH½0àʦå¤ê Î +Ëg‹Ñ‹"ÙËøŽ7<†uÇÚÁâ¤GêÆçÛ®ª°ÝP6[Ì!¡À¯£ý™&lz"2=„Ý # Rlý³tŸé1 Ø Ñ/¶/ë–;3Ÿ`Aè°–ÝØË¥*ú¼v»«?ca6^åAÎu‚¥I1þˆ"Ñ 8ß©qìe𠾿¸º‘_‰Â¢duc‡©¸?JGoÛ6º:glÜŒóÕû¦ b–¼‘Õ zøC„Ê(ÖõSÊO:2:æá³éÛŠâ©™˜E&L¦Ûÿ²>ÈÇ%«® ‚%´dïÔøwÍB ž}Ù¹‹$ŸJýÕa´u$— îÖÌk»fí¹—yÜG +w¿Š.r#Ùž— ÎŒ:ëþ’Âs0®Á~mD +]íëjÇ*†û ö†µ›ÇòhΗ†q¾LÄ¿ð WÚjw‹1:^S&˜e¿’EÈÐð‰ŸDبlj饃ԛ{좱¤z ;~Û‹ä‰|GtTkÅ~â£SßϾ—úo¤m£-LݪI"{D½ ‚Y'÷ +Qª¿s êÝU`‡%O}¿æL(!Ë™Ð6¨ÈaÁ1Ð? æòË|aæùÅħ“¸×GcŠàú8„`Ë!ß²3Ü6IPÁSGTôKš…Æ`™ €˜Ar¦¦Ù«²ÇYª.ëYö×ídõ9g»dµÅüIÌAñô(‹Ô–(ELCWkL#ªQôKäomŽÒHßÔ¡×Nrø®'hQ÷ ¸hoA”Àkb1¤””Î*êa%˜PíÙ +øT«½¹íº•0‚RZKŽ“ÃŒNDÊ!•g“ì¤È¼ 4ËøDç£Iÿ5E‚˜,ÁÒ‰Mì÷Ê’d3®R l1¢?ÑÖRPQW ¬eÐecxM-ó¶Ž|Ú< +ãÌ#Ç«Dj`Å1W€fš&¸jn¤u¢íd˜Á%Bñmá+$Öù j $v±Î€z΄º×ÅcF*iÜ·œ>H„l+%p·¬šÅùõyš^’'×qH)T´\RRÃIhèÏËÌ"Æk†9ˆ/ôÓ—P£´˜Pk17NÈž¦Áœ¬i6žF”‡º³ñ´x˜™aœfãYÌt¹‡$ÁðP|±È–y)Y¤ó¬’-¦¤±¤„h¤õÉìðRÊŒ’Ô»¥cÿËy€ðµ—R—£è·”ŸþY+/GSØzPYGåHON…Ñr=ú{Ú›¶§ÃNºìÖ±À“µ†XuÿÀ ìgR‰‰¢™4(2j°Hõõ¾©×¢¯ÐæÛ|Ãcn§ëºYuõÅì„Iq‚ïRs$[ÕµÜòÇ^dÏf RËæCoLq}ЩROùÌΣmŽNdrчIáeñ+÷ÕÐel€^sÁ/b4.ø㢠v1N“¾Å ®ØËÓÔ ¥aï‹âb‚1ù’Ç„ÞÔ9sŒ`ÆvUu4ý aÄj½ë+]³•ßž<Óp¯î®P EÃû$¯”û-Ùˆ+’c²‰{Þ饇ÜGsŽ[µ^ÿƒèOJ1†Ú;®•áæYES›ƒB>²‡5Ÿ¯±Sõ¾™ÞŽGYd¢U¶ñκ\Ò¼†#ëŒ\QE&NU”ç—"'žDÉæéA^ˆµÔùð¡v")_T´•á£”sç…k‘`õ•=/æ…æ™›w`»¸Sœp›z‘P,–£Lô­ž;XQvê‰?õû‘ÈU ßvÈdìøêOwýÈ3Ë~ -ewXêâE "àL 1ªE´H4 +¥ü­@)ïOÓ}'öU‚>ñèåÁÆüI¸2cŒØ¼ê¼ä8> ÑÓŽåò¹pŸ`ó.¤× ±¿6ÏxØF0¡¦|{mÇKE<ž/H]LÏ6K…ò³Ô¾ìg55k -zÆ^ñ²=· —­¹€¼fË_Àe,ù×¢qµR•3/Yó§Ä+SA“Â$¶¶íÆ^A‡ƒ{ ûÁÞ¦…!'Nñº8¯:c±ñÒç“α9zÏãtšahµH"7b3‘,º·&“«ñÂá Ù“ìv",ì6|ã"üü—–c +v/]êÚœuœW5_éôsÇ 5ž*Ù°•t»R6õØWMÕ•ÉOJ7ØŸ¸™kûxuï“CݳæÛ±Ø/œ¨£¥üÌ<1õ=á·¬*½½•×%Xq°4DzX\¯·±,ÏÖê c‹Ê‰±ìÅ»PæR¸úñ¥lww0ã±ó8,-ïÆÒÞó«Á¯®ÏòaY 9hS +~Ijäúˆø r’Õ›1Eö¸65Ï`o{ꕘ¥Í³ÓùÛõ6ùʱnö¡6;,–½·ºœÜz·|á•M1žvÕXj?ÚÐ\!Ç·?…˜Á(J¨1`Xä(ë${ rÜ{ÛP‚»Ë/ Æò¡U--[Æü”µQ˜êKy|<Œs$ŒpŸUÒÇR7ÎIñ¦A<¢€"5u.h²Vðd‡ˆv¼ÞåÂË5ELåÒÉRÚk^ô™§˜æÖã““×í>s%ayyœ^ç‘—úÉëÏt#/Ì–énÌR›q-v:ÓÛ(ó‚ 7ø@ýû>üüë;S¨¤…a£´Ïw=…s×S˜7/欅AàT)¥“kCExf/Ÿ&:®o¬È\‡bâAç[à<ýÛ·ŸxP&(9/ÞëÑ|s ؽ智ô`¶TîÈ:ÚºÓ ôóÕ"/<«&ÿ.º~úÁø¿^\Ûgç1iT,Ÿe†^ZpLQ2‹U’(÷’<šü? _endstream endobj -6122 0 obj << +6553 0 obj << /Type /Page -/Contents 6123 0 R -/Resources 6121 0 R +/Contents 6554 0 R +/Resources 6552 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6112 0 R ->> endobj -6124 0 obj << -/D [6122 0 R /XYZ 85.039 781.388 null] ->> endobj -6125 0 obj << -/D [6122 0 R /XYZ 85.039 758.673 null] ->> endobj -6126 0 obj << -/D [6122 0 R /XYZ 236 764.647 null] +/Parent 6545 0 R >> endobj -6127 0 obj << -/D [6122 0 R /XYZ 85.039 477.993 null] +6555 0 obj << +/D [6553 0 R /XYZ 85.039 781.388 null] >> endobj -6128 0 obj << -/D [6122 0 R /XYZ 248.712 483.966 null] +6552 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F58 3360 0 R /F15 2972 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2214 0 obj << -/D [6122 0 R /XYZ 85.039 326.904 null] +6558 0 obj << +/Length 3900 +/Filter /FlateDecode +>> +stream +xÚÍ[KsÛF¾ëWèfªÊD0/<ìòÁqœMR•l6VjŽI(“„L€–õï·_ƒAp7âaËåâ`Ðèù¦§_3=R—!üS—‰ B“^Ɖ +L’\®6áå¼ùÇ…Š¥,{4ß__|÷£‹.U¤azy}Ûñquæò:ÿ¸x÷ÓÛ߯ßÿqµ4Æ,´ ®–qœ,~¿Jìâí¯ÜûýÛï¯Ôâ|²ð£?_-Õâ4®ÿ æ÷^¿ÿ‰ß^édñçõOï»þù¾{‹¬®‰ìŸðÅoWŸ®¹xÝ"o1Êa¹øø)¼ÌaŠ¿\„I“ËGh‡‚×› À8käy}ñáâ_-+~g/ù«))9“.1‡bR®'&¥t`”¾Œ]¸Ð’œîvEÖÀc½È‹l-³¨nñW-V8»j‹Sov0Éj͔ՕŽ_±»ØqÏ}…Oüy¤÷·÷Ю‘§,k~‘á›æ¾`îå*k +$Ë¡ËE°ø|Ïþ“[„°Ûô1j`½2ØÊcõ@ÿ +•ËîÚa‰@^K…âLiúy±.7eSä¼Ê%°£VýeŸí„3hÇ ¶³Îû3Í»©ùE¶¥Ou++™nY{ + +3aÌÂ(™7Q÷©¾^¹h‘­÷þõZ ~RakË#6Cá.÷Nò»MÝaÊÖ‘‰iÊ¿ûB½ÉVMYmÈZ»õiéÓÜÁ'榦¸EÄí§bG^Â7*9€ìmÂ+hÍò)¤}Ëïüb­ðzí• >„ŽíîŠfË°åG +‰Öй/dúË؆‹z¿"™qgýÀ9·¨®–(°íØV­qA©ËȦA”èÓÖjOÛêÒóZö˜š¢ƒMmGDQ»­Ÿ6¨i77F£ÃM]Gñyà +¯pÓ4¢¥•Æ•Y’…-M±N†öµ\ãy(£À_ëKÐ¥@ó¬yx^˳ h, ³íˆ½‰˜„ è©nŠÍÒ4 ´ŽÎƒTx@šš¤~é Øí¥àçç@éyÍ£Ô ì*ÑGPŠ¹íÄ©ÄÊž¨ð:ÂqšÄ y±m½0†BúÀ4Æll Σž×6ŒÏØóšìÀ_«xh—%½-{é%&¬ñнày»vÑ"/nI‡ÖM.^¥‹k,9h/ÖYÝ`+¡#f¤mîy#….ì>‡'Åý«lË VÖ‚™tŒœß6ÿrg#rŠ_Èy=î¦+áÈ¥ OZÕBÙjWƒ£ì„x|ˆ>U¸ ñ¨rƒEˆ^¥b[5\Ií]£Ÿ#0%¢Y?ñ›¼ø+TvÛ×ìÀ¡!‚¥< Ô‚ ¸*pŧùZäduDr¢Qqß:A¨fñõª#*ù৸“3cú¤ò¿¾:€ n¹¯ñ ¥’jøZj ÛúÕÕ22 +‰ºÀÀe¢ÏÒÀYVÛâõ„,o21nkS¢+ yÈYŽúBÖ# úÅnñ–»ù³ªa®íD¡{¥X?j›ˆb5í g7!¶ÜEöŸ³ƒ!™BÛ2×[0‡ æÓ³=-š.PÔ÷iVÎo»xCœªýŸ%p9 ÊdÜ.¢¶ ‘²É䦂ŽÑzR»±ÓŸ¬\ó†Ð9Š±’ˆ´:tW÷ó{= 3 T]6H¡£È²½!QÝø{/í`ÕÓK|ÚÔídpHíSYáö‡s:ôˆÁNöµä¥tÍåC.ß}&©­÷Ù}3|¼¯ÖÝÓÀŵ%¬ÃF`ù³¶Ô#:nKžè”-ÍŽèmi<â¤-õGÌËI­5l|­ØQñe_Êjt=LÙ¥QÒHûBêk¯ÞP”F"RÌPË\Z¸‡0äæW ÷Ъ q±ƒÄ)küÝ|׺Ahθ™¯7ÉN×ÂT.WAÃßÛc âi ²ØͦÝÊ”r“ µáI\ôx›…j~×wéF¦ˆ÷´Ö=wÂ¾æ¸ +…qFæ„ +uD3*$D'UhnÄV…F#N«PoÄêó”©í¡'Æ—ñZzº»•´ÇeÏ‹\qWŒ‹ƒuÝ쨂@v¬ˆ/UxæmÖŽ{ä.œããªóm¸ö÷«={ì¸ ßÈ™Ž.›‚•Gf4¸ˆƒÉ™vC{d•ˆY´šŸ`Àc?bÀ#é>‘{ï’{ÜÓžE%㜧ÿÍD΃Þ¤¼‹AʦÝ)î˜meè”-÷I9ï[AïQƒóÜLæúè¤1¡oj{ÞԚà ïFb›ElÁ-¯‹,—ï*îÉø±Ÿ~µÜuß„‡ @8Ô (nỗ>fµìñš8çKl;Óˆ²øðç»wïñÚŒ•sMcF®êEÝ›áÖ‡ó$€X%r?Õƒ„¦•ÏÑÈ¡X©t>rôˆŽGOt*rÌŽè#ÇxÄÉÈÑ1¯¶“Ù0Ô©™É>hÝ*þ­è„à 3^X Kò½½äCRWbrËLÆ È˜Ï8Á÷§-‘5?p]¦Í>dZÿÙ^!°ñ‰¶Gt\‡<Ñ)šÑëÐxÄIêȇ õŸ§··ØÇú„•KÖ§{„ Oã4ñ57Èq›j÷$†{Ëýíò'íR7Å1’x’å³nDC’v@úwâI°Æ‘Ÿä n4:£zM¢Rì0*÷þÆ @ Nû˜Q—ûß³SÚ.[ÓÐktÜÒ¾vÇ<ÈÇõ]Ž'èxŒÜªë¤-wEþs {`Äíß74½ +¾½å )W{–NÀð$D 3Ú@ÂàžoIÅmhDJ:„)ôüÈaü)¾=´“¨­?g‘å!“ž#Öã­¥äGú3ØoCô{â!³o|¶i!ê^ßRUÉvþ˜GXÝVëu{ϲ~ŭGÉ̬ w4Ç-XhNðÜpÞ~GÃ\«êÁ–‹Ž^U@K5ÿÖfQ LÎýéä_ËQ6?öï “ï[õ–ÿ†"𞸒Š·ilÒ—ä3®ï0«Y£ ‡t}Ìßz0ì:âô,…Õ<@p­xå`¸FèÍÞx1ŠôoÐ,°£à—]qô  |:¦¼. NDOq\q‰â”ÚÈ+í` I•mò +[·ÙFÁjø_)®æ¬åùZ›Òílû:ËŒf$`äÆd+ú‡A¤õ  £9h± ’Ôçoi*n‘èÓ‘¿Å¤ÔmJ‰à?Ggý™fû·ªfdÒc×t •Ç‚ó5.9¸!Îyø?knÙendstream +endobj +6557 0 obj << +/Type /Page +/Contents 6558 0 R +/Resources 6556 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6545 0 R >> endobj -6129 0 obj << -/D [6122 0 R /XYZ 85.039 302.922 null] +6559 0 obj << +/D [6557 0 R /XYZ 85.039 781.388 null] >> endobj -6121 0 obj << -/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F14 2895 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> +6556 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F41 2994 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6132 0 obj << -/Length 3695 +6562 0 obj << +/Length 3140 /Filter /FlateDecode >> stream -xÚ­Z[sÛ¶~÷¯Ðt&Si&b¼å-'QÒ´ñåØJÓž¶ŒD[œP¤KRuüïÏ^”(Û“f2±p],€½|» ˜øðOL’Ðóe:‰áÉ$™¬¶'þäzÞ=b®‡Ì1ÿYž¼x©‰ð½ÔO'ËëžNè©PN–ë?¦¯zu±\\ÎæRÊi ¼Ù<Ž“é›ÅLL¯~?ËÙ\LÏ¡pÁC..gA2=ûþÂN_½Â¦w0fqŠóΖ³¿–?Ÿ,––;».p’"kŸüñ—?YÃ6~>ñ=™&“;(ûž€îí ðæ…Jêzyruò_KŠûÔ„gD(/LäáQˆÐ9 -H/Ä$}/ôŧ pŸã†+Ø›§§Wüû©¨ÖÐUã>ï°¿Åöhøþ׿]ð Û¬1]±*n³.ç…&”qu]o3ÓÔ"|…w0¯):¤~ÏWu…µ.ÿÚ=Ç–tšU0h­©^3‰n“ãIOæz[sg“Ò^Öùu†tËƦjºkic ×n‘ÕúO_¨9MÃi1ã]A±ªõœë)Tk`Aù).Wq.LCWe‘3§ÜqW”%—x{Y³šñt£éᢚƒŒ ¬Í‰c_¶3ÜŽðWÑVýÁ&;}a2Š§g #­P\ߟa{4m7Y“s±¾æßú7º-ÛuέãNð$èZ2*V7šŸß?8&o@OBL‹ü%àlÞ©‰´ÔD$5xg,5-sy‹ÛlJºMZÀ¾^¼•®pê]†´ÉgÎa3W‹Ë_—Ïx°p•:V Ì 4¸¡:ýg‹%‘¡£B/É#tBÝÿÅ o+ ÂéÇ6o4ÁpȘz| -4WZή¹XW9¢iþµèZnÉjt+(5±LaiUßjá¡,³¤zRˆ¡tÔúº­”D ½ Ž5J×’Ð.Ca(ꪗ ;+9À)¤æ^¿9G!žpöëÕn›W¸}Ïæhæ¹BSšNH÷fÿvf¢^¢©iZ­»ëëQ—Å×!xf=¢£]óˆí®í¸ù‰§zÈ*+K`eÄ8Ép–3ÑM}]”ùÈ‘ƒ~¤¾±&ª«bð(8jòíJ‡j-R°*¼}»j°ïÇü`£ŒYƒß|b?cšÑS7 A´û Wj#* ˜ Ž¬ÕE†yŠmd¡–”ë¥ÃEÉb6€ŠP¿åmcKN1¡|^¡H¦è4nÈ—Ü QtkúvIl5è³ý‘ëöÌÛ/8u¢4Ä|8Š=?öY}Ä涫TE,wæB|ömX ýÅÃÕšÓö–‰P;B\ÊÐ1Žod§v¡-½FĆ„!ôÕÔØmÐ<`é–•¶éó!Ù=&ç‚9-FL’‰ã*=n”å³ÂÔëÒÂÕ"o¹ÇÚƪÜh-ì¥bê+²iØ‚×ñÜ5VŒ<«##ÐJæª%M¸ú5Ê+ãK -ƒ¦ÓiÇ]kq´œÐD3 QÇŒ¤ß,¥Í芤åŽ?ýÐϨk§„Hî3m•—¨ûê9€í!à‚ˆ æ=^(ž?F0±†I*Žú¨ILD¢qìØRn4zH“zç•;ìº}ò5÷Ùe\Äú6ã°‰F©«òž§ï*«>Í¿ynŽÇz»ÇQkøÄ(â›QkúÄž}„xçìÕéâÙ¼ c/˜æx,Ø^ª¼8û\nj2Æ€ïlXa¹Ë@~(n±“Åh] 7¸×CŒñ„2Ë’! Ö½ÒzƒÞaH±CÌmíPÅ•u¿Z«WÃænÓP¬}³±õ¸ –ÃõÆäÐ]ÏÈ!âxŒoà>ß‘d9›¬ã«®×”cÖÁi×'ty'˜WDF»‘Ø’÷~–Èésk(ß–Ù*w¨êò“-'Ç'ƒä°dËÉ$uC/Ni£8 y2RôJ“$¡s:½øˆF§?Ù=*ß7ž†[¥ÄJÜHNèS&Ów”µn•äêžI¹4ø¥ÜxÙ»Ö¬ÂK$S¶÷@ŒSÈ;=yúS‡ó€§¹g) ÑèƒdßÁæŽRÔõÙ¼W@Y?4Ë"7ŒŸ -ÎgP sªQr mÇJr:°ÎX*ÜÝG%?ý²øý@¥Tä%"žH{~ô„Ì‚§ä±¼‚&5ïi‘ê ¹ -}/´ªÇæ}¼¼\>}‰TPNæ{p¦I=Ìa%.gˆ¥GyPéi€üª¾îîP*¾ñÝÀÐ9-VMݱB¡‘ Ÿ˜8ÇôH}7i(ß{t[6¿kˆc~Í›ó‡Ä¸‰D"|`dÄï^(âïrH†ÖÇðÌKC98¤Åo¯ÎÞð‡îûòûð¦i=Â\ ز§ÝŸæw‚±µ(ë{jßf_f{yÚß`;åUœü=ÆKÒ¦õ,¶!-&åëarž¾×¸u2¨kî'A”š niœØ×ÔÙÖ­;¨K 1lË è—qbŸ¤UÈak eõ e“"—qÈP,æoPàg¯/Ì ‘œ9„ûs«¼ãçûˆÎíúá×ù6"öÁp™oJ0£™ëÜŠmé­"(ºÜoÒÿ>'3‚XôÑl}аÊ99Qb>öUŠ˜Íu« a.&SvÞuý…` t¥Wr1VkŽ›iýÝ;v.Øn>xÁrÞçB´ÆÖþÍ}¸÷¬Ò ¨wÝá3 ó%†Yµóž˜wÆÌÙà­8âÑ+D½÷4M÷8bøq”âûÔ?ˆºô÷=eÉOVVö%¾‹eÛÛ2? -ò‡{ÿ.¼„Ç2ÉêX&ùѤ·ûž:D^`%TàErYñu`€K‡Êgéó9vµu>ã j'%tœë›ûï8‡²·šÀðÑÛàœØÂ) ü9:ÚdNYpàáQ™¨'Y’:ÀÿwiGêLò@(6øÚdì-cƒ³_5øz¥:\ê¿s¸+6 -àí× ‰ oój3,=™Ìƒ/ c1©½) 7FüÂiÃæ?»Ã¾=”” Š{+e73€#¯÷2DÏärÉGÎóR°o±Qd9pWzîç‰8ßÕ½×¼++Ñ®Á4 <þH›Úìa˜X`Žå·³D±6]QÌŒáo‰9¨eücT¡«ù±7q’°P!o[õºod®Nt†Iï* ŒÏûA=ïz]›ë,M¦a*Ÿ§ý^€¼}ÆZâ6)¿ûúâ#2V|å!î †Þ½Ñ¦.ßÚ\ýXxtQé`qJ‡1®ØôbÊií¢*l°þ+N2ZK4®&Þ¹éì4 KI‡*`}ï‹Ôý¦¦¡/“|1\õº>’‹‡Ê¶¸iLv{L¦²½t™±±j$‰ÏÓûy¶ºqrhÖbAÔ‹ïÐCçŒ×ÕyG>›–¾¤cibøÏÜþ«/ªí§ãJz‰LÇsÍax0¼àéHíók¾¼>`øÿÌ•&Öendstream +xÚ­ÙŽÛFò}¾B/ÁP€Å!ÙÍË‹Y`’8‰ƒ\+ðÃd`s$Jâ†"eëï·®n’’<ÆîqÌ>ª««ë®’ý™ÿù³$t=•ÎâÄwU’ÌVû+o¶…ï¯|XÈbóõòêæ»0šùž›zél¹ð„®Õl¹¾w¾ùáî·å«ßç ¥”„î|ljóÛ<ÑÎÝϼúõÝ›Wsßùg>¾óz¾ð70XþNïÿX¾ú–ïæAâü±üáÕ/Ë×ßàÞ¢Zدpâ—ùÃòÇ«WKK¹¥ ¨L‘ìW÷Þl OüñÊsUšÌž`ì¹>l﯀n7ÔJæåÕ›«YT¼§g|ê—t¹A å¹I¢/Âø~à*?V†žzÚ²Rû#VúÀ+í©™B^þéùñéó|¼)Lf#dç7 +ÌÙ~8¾QED×øƶ‡;£2·È+d}Çb(Z–Vþ¡¦çaädeŽ€–2˜vºšÁïÛ~EXò¶ÅÏíNÕUÎPLèèÓéë”N\Цñ랟ö_ÞÂàzž * \oÄOäBÖw@᎞_ÿuFc’ºQü=4 +®/Иn†›üòôv] 7‘±ë|“¡|Êî¶ØâzÝäg$ú +4.ú‚Î@Ïè¬}QgŸ»ÑêìÉ—uvtc}@iu••ÿ®"xHêJ¢® uBõŒ¦*íúq:~Óÿ®‚ëù·+ƒ—¾ý šƒ/Œ£¿‡FÁõãÄU:Ðh4Õðô³J:[QÎ;&wêAÐÁã?",Iä¦ý˜|Œö#g›3þlŒ¼òrX¨9¸ã]æ àYŒ{¿èPÈëÍ• 'Uþ„ƒÄiâ}'ûôÖTâì̵¹!±…².k;¹ÛàÂc™<àˆHëž'«¬â¹Mâ‡&Ñ(%¦<@ÜBE©SDQ6 ç­¬&ÎOÙ‚Ý&xṑ¢AN–*öHÏëlˆ‘"…ø]•£(óC pývQ\¶•í–Ñ+3™llMM¬Æ—ôlc8Š—;`Óùóˆw±f±×{4I£ÚòNgy“=îg‘édè²…rŽ¢¶xDµËÂj@Ùô„P×£ËQù‚¤1×e«9ÌwÈú*'öš%"1g0°M«Ì%<@Q1[\x´°?ôœ¾¥wâ°Û¡„Bx~“UÆFôàÖÖ›ºc>¯ê’W ßåÍ @ÄRË×Èd0ù¦µJüqlHHvÀkÊb•! >ÆÎ[|/éÜ€Yb2r +ÚK܆=óµCƒ€¸lö`ÌY‰¼Ïo³•0F{x€TG‡Úyà›&î'ˆï%rѪæW5Ä_1ïŽs# ²^F†º¢|M¦„ºë‡VmèˆUÚ Î 64QúNÃkÄf~$4r’$OÑb¤ÞöQŽõôPÛÈj‰5ò"âLHÏ _yÎ#É9kŽ<=4õ“E*ß8 +Øáë÷dÂE6äv²SS]5ºö‚ñ zç$Ïw¶ø‚ŒÓ¼ yôR¨ØdeÉ#ò°¬L Ÿ*¬ 1@3¤¬³X?E ÏmEâžèíÀ{/{ñ79OY^0¨ËõØK¿àÈ_šµm¶:ÎÅë(U4|+Ua†{aãÔ !Å í¦Ax1±Å†âfàRŸˆï®¬{’’¹8dÝîåYrú®¯£gi00gDL“«0r£ Kô>Z§äbàòE•íe…‚˜NØAár÷HºHî8Gê€0eánöXšÃèþæ¯:^Gà [ûì{Ñ€œL¬ßn3ëÁaÑHºç5v%Ú ’dL:vkÈà :p$¯1Àƽ¾¹¹1‰nZ—ž5à„¬3„úôø )´†Òb0JHaå=ìÞ\£†Š½Nà[¯9Û~o]B –ø#?“Œ?«zϱoìÆwŠž“aQ¾ÞpZÒí81IÍÅ8¬êŽlU<æHÕæ/˜eYß“øP1ÞS $s`H†R1+‚Ì«õÈiµ!QÎ[ŒÕY_vry2bÉùu¾óò‚¿¸)ɉßxóUßPÚ„ò=²½ÿé…Þàã Vp)•Ân(±8SâZW2–ÎÈÓá& ôÇ’b×K“‘U¡“i¶­Ñ’¦læ¥džœß¢÷Bñ©€²üó,@©evY7A¦€!Àò5Ï¥â±ÌòS²4ñ‰ö„.–€(¡ +¹‘³;zïˆ$Iíb­Ÿ)ác:HY˜CÊK øC*饬ú¸ÅŸ÷Ž¨=ëeÉë?1èÒ´Ýå¥ìH¼Ûg•¥Uä|ŸWyCŽ ¾w¥>,Ö†ߊŽc!RE¬ÅAMA–CÐr!BUˆnÉ$Ϋ$go97YÄï¬xŸgèÞ#O¶ÅÄØpi?–VŽ¹tš8¯E"àX)”–€)sá~ìAVOò“–áîLî[œ ™È¿”=dr~Zœ»|”H"¼ÆRzá;£ÌŒ(šÅÖÛ$!o(ÁÙòÙLÀ¹¼K<Ô©ä@‰èÊ`0`}ÁUk65Ä¥j_Lø¡D‘Ý|D É›F + œu—ŠµöØšøSoÑÑ(t‰Bç;ÔD“£dü)‹VzhÀ궖?ÌJ©$ä@uE]‰;y.%jÜrû4÷M¤•ØËZ|ÉSýžY˜Ç7\5Ú:UÅ qöQ;ž£¤°r¤r‘21XnÙÊúM£/qŽ£ž<隨«Ü=¹³5êS÷åz´„gY}%ë¹DƒÛØÀçËiôûzk°À¢GIqA»Ù_u’‚ìôTvÌÝŒlš¼ä +Es,¸W+¨ÁcÖ P7 5 B®iÄJ˜Ëú!Û¿ÛÛ¥ÛÖ¼Ò·ys‹®ýiýîCŸcæÏ€¸r»ÏÖ/üé+MoÕ¡›øÓœhýx›ï¡R­P"|O˜nÛ¼Ì13÷¼ã„§›Xe•wïàca0À«}Ïs‹ŽdN»Ü\9¡Ð¸îÌÞ™4óû²¡!`¢oÆE´¿z´ŽñÜ)›£ÖþGjÿ¬ÁY +sÆåkëq‹h°ºˆ’Q+á¿œkóxCy +wú:Û(X3j¾Ϋ:›áé(挣 #ÛæÕ¥œ¤†pñ£ éˆyÀR³j‹ô¬hh¥é(pØ8iwÃ_¶ý~H…ul²qî3“ ÓÆãgˆšÛ~Üô³¿]à™MFoõK`ïîÂCWuÓäãV"åÈìç0”5‰j¦:ÅZ )º.e6?ôI‚ašk-‹e/yL½5Õˆ>7xl°•tg%Ý"ƒUcÆTNR¥Ë¿ñ‚¸i<ûûõƶ]|ú5mh»ø` ~¿_¡`—1 µçà/ÕÕñ Ko ™£ +D„ÏŒ"盺’Ž^ÖMÃtì3D{1ýÐõ,ÑÌy›ÆüÀÑÇ”*ÄfWYòo6i‡¾f¨9 +`nŸ“›ÜÄÒÖH9\Ô‡%iØ$¾Ð¼4M·P 䚧¹¯Ï7¤EH9ü5ï³ìa`+ªK?Ø¥†‹ „|o¨öãœ'ÜG œÍä‘;GGÞ£~!i¹)…€Y+;ž·Iüˆ}¸´—H`NJ++1¡Kˆ«ÜáؘڊТÙòEÃoäd½ÜBýŒÖ(ÈVÒK:ÿ3›þ¯é`5¢C¢ÒËŠø†‹ +ÓSzC•¸!ØÒÁÿ»³[ßendstream endobj -6131 0 obj << +6561 0 obj << /Type /Page -/Contents 6132 0 R -/Resources 6130 0 R +/Contents 6562 0 R +/Resources 6560 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6112 0 R +/Parent 6545 0 R >> endobj -6133 0 obj << -/D [6131 0 R /XYZ 85.039 781.388 null] +6563 0 obj << +/D [6561 0 R /XYZ 85.039 781.388 null] >> endobj -6130 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> +2282 0 obj << +/D [6561 0 R /XYZ 85.039 134.952 null] +>> endobj +6564 0 obj << +/D [6561 0 R /XYZ 85.039 100.813 null] +>> endobj +6560 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6136 0 obj << -/Length 3472 -/Filter /FlateDecode ->> -stream -xÚÍ\YoãF~÷¯+Q›}ñ°XxÇžÌ$cw¬$$y -ZÖFŠŠ3ÿ~«ºšÍ–xؙЉÀ"û¨®®úêèƒÃGüÏG±fLFQÌ™ŒãÑÍýQ0Z@ÍWGܶ˜Ú&S¯Í¿gGǯC5âK‚d4»­éh¦´Íæ?Ž_½9¹œ}˜L¥”c¡ØdEñøôlÂÇWßÀŸÙdÊÇïáá’š\~˜ˆxüþõÛwgTp~rq‚E_A›³sìw1›ü<ûúèlæ¸sã' ²öëÑ?£9Lã룀É$=ÂsÀ8TßoL+ißWGWGÿq¤¨N¨W›$ªS°HˆæpQÙáäÞp²1\0šràY¶i "g:Ò~ƒý_ǃF¦‘æ,Hj-éÐÓRÕªj„jšM’pœ^¯P>6Ê’(èã×\{½uÈT˜ÀxØíË}MQÓmÖ7¸Û¡ïSÀ!N³Ût Z_•„ç·ŒùÄ°ÊÇ·ðnW%o7YAOEþSÀöͨë¶,ï,¡¢"°XnÊâ#uú±–}ÜìOL…‚E:n›\c’ =Æ# ú†Aoc´0! ÎÅŸ„.b k»É˜N¡'Ûz—Jmé€ jWR™‚‚HÄŒKmôt‘ÞgûB“œ³‹QMêÓÙªhõò%yÄðN>c5€HÃßMÜéjk´¿Ç°–Ð/Vƒ0Œªâ -ì—ìþ T ã人uˈ"2"çÚŠ¤DqÀ[%ZGÕúW:ÒL”2ÛmhTÌòÆ8ܨ,º•ÞC8Å>~š<†_M( `YŒOs³saÄÒ0»ÙG*Û\_¹ž”Ï…¼k3òM˜Ë%ŒÖ«ã!´ðù¥È*ÉÕŸ^j³€ÓY@V¾±;æï¼¼5Ý!x<_)ŸÚ#¥4‹Dô™ÞvžÌ¢°CÎÌx J~"3‚ÅqóŠ¯Ò²{·Ö#=„—ìcÔa½æô¡þ!8ü !„ó3 ²ÒmWÖÑ}1þçFð°%X Ú5Æ…dBXbù+y§ó+;ZŽ¿7KxÌcr¼õðˆwص‹ øÊŽÿ{IÍü;ﶉÑIŠšþHm®Í@F - w¾ pK^ù”w£i܇?´·[1&l‡¼h£ B‰«ÍøŽdz¿\/Z*4¯êØ’M`)¬Æ'4‘"ÇNxšDÝ+þPø¸\­ÈÝ -9*Âw·ÕÔÍG³»†WSãñ]6§è¾r'X+»‡ÛoëÝXÚPQyg)à—ù -ú@—Gœ©.²– -¨ž'l¼ÑÝ'`.ó/IrôäÏáÍ7g?ì[Wh«Ñ$Àý o*™’a;R+ZS˜Áê.cÓåF4€yÿêä]ƒµ(a:ˆ5Kë ÖbÉ.wX;?yõæíÅY[l šçä²+Ì^ýp5;;o¡"! Õs©ä·åcZd푺ás;éœ/oŠ|ÄÚvc8F?A¨ªÿ;ÍVY™}0^dñ*½¹Ë>ûçü1/æ_ôoñG&ÎÕ¹ mÕ¾µ7$ï–ä=è•üÉÆØó•§ Gƒ_y{úÕù»_SÈ*_C ;3O;®Ë}û„3²®«º·ÂÚbÇ:>““‚³Dõæçµ1&  ®Bc`Ã$äw %Å)¡XˆîZ%ãWùý=:Fä'ŒÆgE‘Od0.6]üX2½üÔmZâ¦åG@ÜŒbZÎú}4ZŸy0~=¿·K#úwø^é)+L~]˜ÖÇx®mÔáãûÍñ¯[ŠåÒÌÜúx£þÔ.ïL 6×íhN¥æl‡ø¢›±¦Ñ¼K"”,JD¯À¼6N RD°'0-ÀŸrO|ÌQ‹:¿1J{$λð–UA0 a’ÕmÌ'ð SS‘¦÷&cYPÝÃDr[{…øÝPÕmnëðåÛ¥æèÿèÀo’ÚnÙ#Ô“µùb¯â€Ç–¸ßqQäÛ‡ãÍ¿º¤*5 ¥î—jݦ†Þ"±ž-„}o@& pN -I¥`¿c¹Í'„É Ð›äËûþÑÜmÝR«]ü`õrC¿eN-ì. Ç9mHÉL:Œ¥ÁVZá«ý”JH?¥ZUÆŽ±ÙbÝ£¡1”Ì}•›¼EåÅužc.隟̯Aá>ÜÚäWðDþ²4†³^ ø Öký&ôœûßïíÒƉã¯13wØ~¿Js[ÐË~^ŒŒ­çTW¶ÖœÝCj•i<3²¼TÚ¥ŽeæY?9ˆ:û[ï¤æsU“þ£Î ïœ;2Z+2º’Óg;À0IÞO m\Â/c#=ž/7ø)¯|N…‹•ñX6±…`aMOë|JÖ…UÀÒ=…&[E»žšÓDÊá¸,L¯—+s'›‚™áz -¾Æ1™­›<¢JìVI#íu¶ ¤áƒ²S{ -`J–æWšû’9=¦t©ñ#½åkïÅke„›ejµƒe÷6,–m ˜+{ú\Ó˜¹ý-ïrÔ¢éé­)ŒŒ*²,XˆÛašPÛ1L5×:XØ´I,É/@ýÅû<"?V\•¼…ÖFh~oD® wvå“âz‹³ß6$|Œ‹¦Ö¦Ü`$k™î]Šs¯\Èi-×ÍjwiU} žUꢈ¾õßvUÙ´µç§a²d´ ®ët -é ¨CÙ)·'èF¥\©` ÒY@ÂI=››XešÔ@†~”eX"»‡Rêâ9O|m€›nÜuáÒˆ.×Ms"W±¡HĪûmÆ:nk7ü(ÀÕ|R…½§Ön¸ÁÙ¾v³´¦±–B’%nDs9ùâ´ÁX1)‡á‹H=ÁV¢˜ -å[N¸§âôˆ/yŠŠif0·»åÝÒîÊ\{2dÁж -TLÈ©oК~ÛoZDÓÚ<Ÿæ䀖–“o+‚±`\ïÞp<7†—.ܸ`2ˆòt³åJkOf? -~¿7,ìîG^ÌÔqÕÀÚ¯øw¨ÿÖ‡ *PuQèh"H†¬é|ÒñÌÞ¤kÛ(_[;Xl1¥Ç2çéÝ‹­Øý!L‰•> +stream +xÚ¥XmÛDþž_©  ;ûâ—‰W8 ˆ–BS Pql_²ª¯séý{ff×o‰ +UuÍzwçÙÙÙ™gf—ÏüãóUà1Ï£÷äj5OË›oaäû·3\;ÅÌy¾ž-¿ Â9g^Ìâùú¡Ç dèÅAðï® =M;‚Ûb¹°Ës<öB)»qC4À)C‹yºò®y+HF’ߎÄ~--Ø¥‹…±ïEq1>áÁ²Âãà``ˆÂX@ü€Y_~f C§ZHp%µUû¤0=º!|ãW„þñãþöŠÚa,h÷ÔÌ!µåDd„~ä10/ªýìó×w/]î± ïxû³Æ°ÀÆk¤l€žj{¬rdêzP…õPզѴra<í¿0:¯ÄÑÔr—}É<Ñõ#¬ó¿ªÎ!g ]ðÎÓc7ÍœõP8øÙ}EZIŽwnàd&2•ÇÃÇT4ž{P&ª˜¿­úåŒ=wIVL»Ì‚º¤iuÜ7‡`µjPqUæÓ–lE%Ø-.×¹ÖÊí}Ö:ŒE ‘ 3‰nà,o‚­OUÙÝNè‘ÖIú¾P½aÁ±ê§¯åf&ÂÿwBÁíûñfl÷S®2’ÏG⌑ÄUFóÏQcvÚoÍ×Éû@Ìý*Áñá†7@îérO±¨îI— áæ@iQS‚¼bM8.ÜføÁœ«E„„Bƒ‰­=ªª 'V”klfÔ\øY¸¢" ·Ë.`öã"à,26E».ž¡„bÃ|êdTñPדnl%@XjŸǬUó«ÖÑ$‡Øìø³å†ê e›ÿ—¸¦Ú,M­äKÕŒ©F@ü,ݘ/=?ômÔ”ï€H š)2ºXyhm¨ØxV¥jôt8s§‡wH$Å™•ªw•nôÄ€nj»æ4Ü(ð;©m]nw}ÑòŒÒ ¦¹IŠ½Ø1ªôÐêøD1V´o_½ømù“" ìþ0uoz"u›¼„Cý•½…3A<vQèù +óÿ´×—Êí±&B/Š½ÈÛõn„^À&ÈÓ·ƒÞØn«¦üô¨º¢4Ã1Ö½w!Ôàðó?òZ·FïÌ\z¸iÒ{Ã"¼é\›Œ™—ÐÆ ã3ÜôeBÂã©«ü™û¤wÏþB"½•Œ§íØouAsËëÛ¾^(ü`­êendstream endobj -6135 0 obj << +6566 0 obj << /Type /Page -/Contents 6136 0 R -/Resources 6134 0 R +/Contents 6567 0 R +/Resources 6565 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6112 0 R ->> endobj -6137 0 obj << -/D [6135 0 R /XYZ 85.039 781.388 null] ->> endobj -6138 0 obj << -/D [6135 0 R /XYZ 85.039 758.673 null] +/Parent 6545 0 R >> endobj -6139 0 obj << -/D [6135 0 R /XYZ 224 764.647 null] +6568 0 obj << +/D [6566 0 R /XYZ 85.039 781.388 null] >> endobj -2218 0 obj << -/D [6135 0 R /XYZ 85.039 321.948 null] +2286 0 obj << +/D [6566 0 R /XYZ 85.039 719.731 null] >> endobj -6140 0 obj << -/D [6135 0 R /XYZ 85.039 295.333 null] +6569 0 obj << +/D [6566 0 R /XYZ 85.039 685.588 null] >> endobj -2222 0 obj << -/D [6135 0 R /XYZ 85.039 263.792 null] +2290 0 obj << +/D [6566 0 R /XYZ 85.039 442.27 null] >> endobj -6141 0 obj << -/D [6135 0 R /XYZ 85.039 228.589 null] +6570 0 obj << +/D [6566 0 R /XYZ 85.039 406.005 null] >> endobj -6134 0 obj << -/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F35 2880 0 R /F20 2865 0 R >> +6565 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6144 0 obj << -/Length 3332 +6573 0 obj << +/Length 1396 /Filter /FlateDecode >> stream -xÚ¥ÙrÛFò]_Á}2XÂfpåÍv¯bëX[Ùl*IU "±í(_¿}Í fË)—Œ9zfzúîú3þù³$t=•ÎâÄwU’Ì–Û o¶†™·¾@,d1€y}ñòûHÏ|ÏM½tvÿØïº:T³ûÕ/Λ¾º»¿ü0_(¥œ@»óE'Îw—sßùøþ»Ÿ/|çw r÷a$Îí÷Wï/yàúÕÍ+z 0—׸îæ~þÛý—÷;{.`’"jŸ.~ùÍ›­à?\x®J“Ùh{®ÓÛ ÀÍ µ’~yññâ_v+žÓ3^uŠ:ˆÜ ††òÜ$ѧ`ßMüš§ÖûJ»¾J†žzÚRÒ”ôUê†I83@HÊWLuSïwØ œ]SÿêùhRæ8¢_½Ðk Ÿ#Y³²„æ3Ï´›z€+Þåa¾bGVm³jsYW7Ï<]äßî+ZÎjƒsÕ:{(ÍÎpŒ?Ÿ¡œ¢†®À¬ï¦aHW÷WÁd T RŸ®‚¹pxò†žó&«Ï(rnH|î±;û6çƇ:ÛtQ­¹Çt²è·S¸û‰›FñyÜ{˜l3¸{ž¥1áþûÕ|¡#å …ë -E¹ã/ØÎú‘Àù€Èî’~ÍP;d'£ŸóHWóײ;ÅvWæ[ºì(wÅc¿˜4t‘ÿ¢´8'Ç~A&1G¬‹Ï8*g}›–›%ÀÄ2+‘”@!kùbܲ8Õx¡òyž(8¨µv›®´ï,c2â ,Øä¥ÈøVF®¸ Œ¥nWw ÞÏ<ˆëks#øRtnu(¼… Ag vMÝðô#udÏÊùp›/OÔ©y`•áÈs;¼´NéÖW‚WSä«ÁiL¿æù±1|EË°-k¦f½.ÍÚ¬!m­¤û Úû¢uÍŒ -ÃÍ:iï¥Q?òw¯|c¨‹dÚMÑ\[š+‡åYô‚n*>¼îÏÈK±á5ÖRÔÅW3ëÙ&ÿöPÝ|/r“0™E6ôýÓfR` k,ŽÎ!jïñÞÉ&ÙˆÝzÈC\â[ŸÇE`Žp+»qäpA©Hç‰ÙAÒDÄ&ø6AÓšíuÑvd‡SßyõC3NJ«REº½É:^ö¥@N–Üa‹_#+ä  YÔÕ‹U^Ò6]Áfh€…＿}óê=qz¡×£«ôYóÀt:Mš„¡›dµ¹ÜÞyV÷@gX-@ˆÚ¡¡V“@|ç$‡‡(¥!8ðè,JaöQ‹ÜPŒÀ „:œòñaB>>LS7‰Ã y‰ùx„ZfBÙ½ÑÊlܳ*œ#`YP¯…ò¬ÿ»®€©Ã+K8&‘«‚ðëïÓ¯?sÂû4ù'D®h¬9`4‘t뉚>Ra™>0+€ÜœügÝ<Ù=2#Ü$ɶìûû‹c¶‚Ã@§gúÌ 6| Dìe6o8.AôÙnA3—``ýÿر JÜ8 Ïâh`Žñ1@k‘\ -á8ˆ ‡A$Ìí€Çì`Ùç q ¾˜Ôk4tSl­cþlí]ÃSr°áõ‚yëûÚÕÉÈJµÈþºB&F ø-ŸÊ,›i×LZ “[ˆvs -diEƶŸÛpÍ –õŽ ¶Û ÕYò `¦Ég€çkHÇ #ª=Û$ !ŸŠuts„Θ„’®2 Ôñ°Ó Ö½ÞƒÔ¤ÃL -Añ>’—b¬ß5Åûï±àÕK³ç fqfD_Ž˜ÿ¡òæ0Çv&æ€Ä,v#¸Ë y0*‹|§‘¡+ÝâRô†Z˜öJðY4v”tÇÎOºßÜë—Á»—ÿ¹ãÁc}V‰ñà1˜²0gòÌ=:›mñ'‹õ‰*[^ì+ïÝkïjþâþJ†6²†h ñmŽÁ|:·ûŽ2€~y±ß}är‹òç ¦± }26¶}*åj]^ñåGMÇŠa¾Ûª<5 ˆ)IྔÄxþÀÒA§w°nËÉç3O½}Í %lŠ?é² ª·2œ¡hHz•­O™JÜ$Ðw:äd./Kî-%'””|á0»§ÏECb”C Iá¹ìN´ms¾f!]RÙDT¾×ø¨ÀÍË?Ɖã??æ’­HRø€ùBâ@žAöƒ)˜½Æ‘A¢ÝmLU±0‰#Fï ·f/ö¢¶¤ÎÏLQ÷cýèùœ|ÚQpâú ǤA—sÙÎ’|Ñ‘ÇÙ«TN”Ÿºiðõ/ƒõÓ/ˆª_h "ˆ¾k²H{2Ù­4ÌØšÏMî–8ÙF(ËyÝ‚?pÄ‹ƒ35jêƒö<1ÊV¶– *£Ä9§É:3Þâ/¼Ï̓4p“ újšÖOÓÜ!V—¦âŒQ’2ïOÕ¡eïãi1ÍÞˆüÞ{Ýòxa_jØdfÆ/’Ú¦lzð,å1“¼pm$Ì ò~AœÂ Ž}±<"%ƒlÐø’eõ¾¨Ä/v})ü`š­B$A¿åmetÜÄõàK{kß µZM«m3xÊÁ-&üÜé’`E'u7Щë§_/Fvù)b˜ÞËÊV9ÌSWÜS) -*M*ÅÕ5“pY/‹™u-™õå¿ñ!÷–ä~–ÍZÅl.¹ª¶Ç¬=1G‘ðY5ý3•xdjòÕÞøgÄ€UàÉKÆXábá -™ž³q|LAºo^q=QugkÏ1>Ö‹lÑ w¬ÆaN¬Ž‹”Óå—W'|\Y[×µ7õªƒ”:õø@i²ºu'~há+å¦çgуLÿDÄ××zôe~"½/™·A)ÃÇÎ*$±Ü—Ís}µ/QO! ‘mrÚ÷X÷0Ó¿ñ=ßÊÚï?Yj!¹õ€!Z³5§˨–‚S”²ÖZhÑbÍ/‚f¯Z¦(/áöÝwÐyÃm*qhËâúI¶2u#Å•3ÿexž}‘¨³°Þœ|»èË[îûgŠÁï4´cí â|꾕lwò -߶ݱƒ`Cbµg2{“§eRPóÍë¤èú(3¬rkÀ,«ýÕÒ–¾Ç5½5Ú÷™ñûçªÞrÅ #$Sƒ¨K{¯fJs”ç'EþøòëçoVµr5!Ç!¨]à\ØÊOñ÷ÎY#ü?£¬~endstream +xÚÕXÝÓFÏ_a Ul¤zo×ëχ>pP¡WÎ~3;FZþH+ô¸P‘„’«0´Òj&¬p~žI#a{"ó,ž]¼ô|K +‰ÈŠ—{=w=eÅÙGöüÕåu|õ~n+¥˜ãñ¹!»ž‡.»|KÔg—7WsÉ^àÎ…É^ÏmÉn`¿×Ëgâ«$|9wBö!~uõ.~ýy—¨*Öb¿Â‰wóOñ›ÙUÚVFhöçÙÇOÂÊÀÅ73ÁUZ;X .]ÍÀnî¹ÊìËÙÍì·Qñ\‹NŠ’§Bî…ê8LÒ;&OpO¸:L‹¹í,ŸÛ.¸—ÖÕ¶(Á™½ÊèƒpniÝ"};‘,-– }[lVÄïÖZSÀþÞÝX6,©îÆÇ îÈј{¤¸œmTÙ]ÇÎ;‘à.„hê}[ÍÁØ…6PûÖ’ù5Rº¢Þ˜ýn=eCŽ6=6›ÿ]‘Ì y‰úpõ´E‡/^úÎÄ…\@…¾=­7¿ é®úFk×â&Û®€ÄGeK@D6§hGƒWo;€µ®Ç^ÎCÅêf@P¬Bš”ÁcÚLÌTÝT 2;XƒwÈuý*Ö­÷'Τ ÌW(ŸGž÷¸”‘*{¢ë8eJHîCM BçR†^T5À2ÐJÖ—ù@„òluÎr’ÐàÄÊ´%¦²2ÉZ—DGÇnP0ä ì—>÷E™©û&ÕŠ.NÇOº„+pw…ÿ¨ºì‰²ãJ×å!P¡sÄ—Í€ò´«›[¢ÖKúЭòq²EB,­¤Æ0j÷Q"ðiz‡J‹Eo +ŠÌÕ̽ˆpWÜP ‘O~¸¾|kK.t¸ÅAœŸ@:Å:Ÿ°¸Æ†Ž (¨eå”t”> -‹ÒH-uyÀ¢ÎýYÖ«bó”6mÞ|)ÒüäuÇ´¤‡x@Ù Ášüs_49tKGÂv›T´Õb›´-okÒ½©³¼Ln§zÌIšÖý¦ƒ£>ˆ}Ÿ¦|yÛj¯¯ +Åvu3þ6]w(LV z:eN(™nFeY#ŒvúùpBÁŠ–¸Ý 6>×ÈÕÅ +JF]ñf2l$©nÀt#=¡½†{Ói_êQ) æ#Ö%YØÛ¶Ëu åÔëc\ôã™,_&xyÙÑP‡¥Ð¦¥¸‡ÄPMlO4'‚EZ³C¯ö÷7£Ëž(;Ñ”ÃÇoÔùÖYÈðÙ‚Œž¬P7à~èäò_©Ð6©É·U¨7)Påµ€¥øÝ‚·{ðöÄ¿L®“¬ÞÑ:é³¢;ÕÆ +¾S*'¯"-®ä‡¨|HKïa˜z[eÞ½µü,TyVq±œ4@i…Tå_“j[æ´XgyZèzç¢6ÊÖø"!w±2së’lPS¥oG½Æ­'í¾™c‘…5štÉ"å_Pn˜ê´zD:œ) û¨0¢ &cQ5ÚÆ ‡lºaÒµÐL|éè)±Oñ8Â3 µ†HhëÌHMÉGµ­23b%½²Ä£ƒGM\`eì×"c¨#¡‘€§wñ°6õª¡!E‹$ÐÃŽ!´C_Œ4`³4ý,)K=Há|<ðóÉD`Ò°3Æl(go’¾¡ÉÌ ¢3 º÷Â&E™u²YåÆŽ~.F át˵9qîÒ‰ÓØÞøϵ8ïžä\‹{øsÿ¿naçܤpV ÌÆOy—^è8ó숩g¾×•àNtêþ’aú”ÿ?`ªèô#í9|϶` ”/ïÚ;|òüˆXendstream endobj -6143 0 obj << +6572 0 obj << /Type /Page -/Contents 6144 0 R -/Resources 6142 0 R +/Contents 6573 0 R +/Resources 6571 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6112 0 R ->> endobj -6145 0 obj << -/D [6143 0 R /XYZ 85.039 781.388 null] ->> endobj -2226 0 obj << -/D [6143 0 R /XYZ 85.039 732.512 null] ->> endobj -6146 0 obj << -/D [6143 0 R /XYZ 85.039 711.921 null] ->> endobj -2230 0 obj << -/D [6143 0 R /XYZ 85.039 133.97 null] +/Parent 6575 0 R >> endobj -6147 0 obj << -/D [6143 0 R /XYZ 85.039 112.774 null] +6574 0 obj << +/D [6572 0 R /XYZ 85.039 781.388 null] >> endobj -6142 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> +6571 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6150 0 obj << -/Length 1583 +6578 0 obj << +/Length 3316 /Filter /FlateDecode >> stream -xÚ¥WYoÛF~ׯàK -7\îò -‡4q®&¶«(Ú$ŒHI„)®CRÔ_ß9viÊVÑaq¹vfö›Yé…ð'½,¡Ê½4“Be™·ÚÍBo;ogÒR–$˜Ðü²œ={“hO†"so¹¾— +oY~ñ_½{¹X^|žJ)?Òb¤i濾˜KÿúWøYÎé_Á`Á$‹Ïó(ó¯Þ¼ÿxÁ Ÿ^^¾Ä¥·@sñ ù.—óo˳‹åhݨ,ÉÑ´³/ßB¯„c|˜…Bå™w€q($lïf`›ˆµ²ófv=ûmÅ{Úc®sžˆU&âL=v…Š'®Q.t®½T%"còE_uwU7â(ö_ðgkx/i”zDí9Q›žIšê®jN˜TÄ߯a+ogº -æ’„i¬º4»¢n­@³1m"ñϪGÆgoäô A"¢ªBf)ÉY4€}¡Iý#ÆÅìq’ømUa(Kž †¿Ûiîð§b¦‚7¾´Õ@†|ãy¿-:K1€Šm1ðzmuæQêÃa¥ßX]U”Åw´‡CféXûïðüÙ€=(~3gc]V»ËyêýHs¿(çt(ó‡ÌÆaæ÷¨yÕÕ@s;ð®c¼…µ® - 'f¹%ê=2ÐzÇëE[ò $ç²(ý•i[wÌÕPœôîÌQî/·Vt5Sà°hzsbþöŠ2Ôè¼z@MGrDxâ‚5æ–Á´ýé3Ô«¢iŽ¸”ûýXaP¶¨×´õß5.m`_†ÊÇJ“îÆY=€(baQC½³„«†ã³B†Þ=ÔÃÖÒmÑð'f=Y´ì—Çç`÷wìÑŽQ¯Nö Zk·6lÄ$U«©Ûþ–oœxˆFRFBÉÈK ­’(ûoíÑR/lÕHr¨ñ´Ì.·60Jéñh8]Nˆ+ "ÚÿNcÉ‚ y°hæP -pÒ²ÀÁÖ!ÜíÝ.•ÛÎÒt¶è <-k*I\E8dÇy¦üG¦Áq1¸p‚?<ˆn2‡nùòŸCÃ)Še"èá´ùR"‚,Ñ™©N(4W螧˜³Ýs%'œÁäî8ùã± àø@­$W0lR3KS;ôà:n÷Æ"MÁ“6Æ ç;EµâÅ‘ìÑ®w–ŸÍÒ´mÜ°ÐCó†‹+é¦3ûÛÇÝ §á®àÊLFe®´UëòjéÊ!•è„ÜaÝð"¶¶ODæ`’gÆÕÄêè¸n…º"d?8EÜ|âøv£ö"é¾®+èyJ´2ô){M ö$ꢩ±}‡"¤œx^ºïRa2 Ñsh}ãÔus -[¶!G/,šL7Q’ŠÚ}†“¶=Ó0ÛS<¹<#ê¶ÔVÆørruâ«3”†güŸÂžüÎÀòAXH¹£âH„š'ý’ÙÙàé0òû=µcÔ„Iv‘+,¸m݇{n]íR7_ðÆ»çüEÕÙ1‚$’Œ ŒËj]ì1èýü–ƒ=Ã&ÎÇh¢ûB†³‚?“äõ¹nÐ=40ƒù•¡Fȶ­jcÁ÷@ ?œ¼2Î?=á‰åçž‹ðϺêU:>¿µ™ÊÏ£´@"’Î<«’ùC{Ýëõ‘Áÿ7ƒÅrendstream +xÚ¥ÙrãÆñ]_Á·€U&˜ÁàHÊÚË–+Þ8+nmªl?@D"ÆA ´J~>}Í!;U[[*ÎÑÓÓÓw76\ð/\¥Æt¶JÒÐ×iºÚ5WÁj;ß]…±Í æõöêÕ{¯ÂÀÏ‚lµ½Ÿð?2zµ-~öÞ|ýÓöÝÇõFkí)ã¯7I’z?­ÓÈ»þ‘W__ß¾[‡Þ[œEðz7ëMèÝÂ`û‘†¯?mß½eàëµJ½OÛïß}ØÞ¼Á½kDµ%°À‰ë_·?\½Û:ÊM@e†dÿ~õó¯Áª€'þpø:KW0ü¶›+ Û7‘–y}u{õO‡Š÷¢ŸZâ’…Ø(€QÑÿq0Ïfñº`µ ‘Ûʼˆ‡N€‡Gü“I2?Ñ™“]­ÂÐÏŒAÙe…À§(ñ³0"Ù}耡#r¶|ÎUŽMä¾Õï«Ð¢,Ó 0íÓ›háÕM®Þv@äjF§ Ý8¬De˜Î4,T™'f•(„§D&(êEè>©,õòºîPKžø‚1€Ž~«Zîy¯»—3'|ê¡lÇŠ€z¬º–w›×v\m«¡ÁÙªBÞ0¬¢ 3:\Ó­oá'ñºÖª;Ü.ttp'ì›Iî¨F½®jï׈Ô79ÓE±×Ýy…ôm/>V㡲¸EÉdl¸ÚX²R8z§Z€ÆCלö†CÂx]itÕ—‘Árâç,Q€™|4Êâ-°1Œùî7`c¦Ø`¦0ëV:‚êËû²LÅ({Ó°;±„Z«¯“øJ˜x„&òžpÜ!Ý‚÷˜¯Uæõ"{zPN Ÿ¿ÊУ†'V§²A™*E@<=Ö–A/Ò¢’Л„Éóž"­Pmp¹/÷LAA2Þó*½ÑÞ]½ñKF¤£¼¿ËI¡î*$ª+ºAP“Ê'Á¹ÙÀ:ˆëR† NbEeûPõ]kŸ –B ¼Û®)äïU‹¼û"ÖÀlqrmàë/“â Å™¾·{¨„%¸F â(DŸe•Ýnsêi|÷$>O¡=àïkÃaOúmBUr*çŸý`m‰T{º—A Ï_ЭF›`I0aúx S¿F0×f†l!8$‘Ÿ&ÊÝx&"“UwtcYð™³7(½²L$#ø—PNèå«Áîk`•‰ ¼;9÷Ÿèhc«.¤áÒ½u!Q,49¯YY*e7/¬É’¼+v_èìI‘ÀˆS@u-ˆ1€Ìoe|h8•EžÖëê^\{ŒÊLÑ#ô¾a/[>!8Ü ?ZL¾‹É&~ ðòßÖ¬Ó,›B©fQnHF ›z€«t¨<kê sŸ#ƒ•'Þ}Äq.¾8¤åM…Ñ’n9È`îq¾kØ/MÃÉSVäÑ©·zÚåCYi«æùY ŸÿÂåe ,Q¼šås_‘b + z.­ýª”2_0Á?*!ŒIýXMÎU³4T€Œ6~’p +UƒòtÕ‚Bßùàç ’é%•)®&`ò™ØÚx¸?õNF UÑÚ¢ìÉ`Øå˜ËŠÇàq´xŽ®Ž#«Ü8ÌQ»cíuG— à”\r, +Ü è§wiˆâuMŽÞQI +ôÄKâÆß[åƾÚMQ=7¼ šœ5ßw³hc³a"G¨EEì;A=Âä ' -Ù%íRÚ‡z=)~'ÚΉŽº£ `JB’ön?¯C°ãk4¹íß,R•øAÆH?;ë¡”\Qu‡SÅE- ¸Ä2¢õ2ª,”¬[C¸Ë§d\OÉ)âl*x”ì½yã—À•oÉ¡$(ðþûh½ÙxØ@0 S€n¾²È,ïó¦­@|”¤Õ¼ÂG- ÿÜÕ Ü}<@ø¢|XÅÄÜH¯íF^˜q%ç•á@‰n]0d'©ÂïÊ‹ÿ2ð4'ÆíºS‹ù°àÌ[9ËI9‡έa‘=²:ߟe¿‚¢rÚ šù@nݪ&Ôqh1 -Ê{*ÊjÊ2o¦ÿ‡µ8õ‡ŠÕ+cÍÕ™dD™wJ°§NC +Š/໺Ìe8–_ä†ü4δ é—Z-@T6cµªŸäH[0f{oµoɲ$ð!Q€ütö̌ɔáâù®_`ÁÀ=ÅGÒjr}Ãj"ü~èP»Tj$»ÄÑ¥±Àb^SÂÂÑqà5!¿wõ¬MV‘gÒ„`_’œ®5k:U€*Á©Ùâw¨ß²Ý\æ»þé(Õu’H‰L„á2¸xó[ü‰9ø;åBýÜrÉ‹È.Äböp’Ü1*™•§8¹(•å“»¼%nÉÙe‡RµÁ¤îÀ©¾Ë!Xˆ¯&Î¥ÝäÀ—ŒXO^™%?« ´íUðU­Ë¯ÞmKñƒr[asñÒÖ×CÄ8’×dÚ,¢¼Èaÿ»¯'ÀsÁìÝÝIã!ÞHhòÏ|<÷qÞ:‹ÿ+v¢¹³Â;ìô³`gÑO1A¾•çv/~AífÂ? ü3˜ó­´¯“ø,O‰$OùX6¢ycïÍÍû[NS®©œcÂñ V‚°ulÍ3ÐwU[þ@Žå…ç¨Ðþì9Ì‹yŒJ3_iEϹ¦â’“Nš ˜IÍ’Û qmIœn±”ä"ä<® ¦ïØŸ—}Ï¿§ÁU‚×—…Uü¼Q¾ãúõ8ºˆNwuÏïdu­ó‘=Y³TØ~úpó/Ð@pKNÓ~GŬÈ¢Ô6 `@F"o ˜²•ànÎS÷šUŽzJRgÕlbrñéæ-¦¼Ó1.%dˆx˜]`¼=÷îŽÏ/ˆÒCäßÙöú[Ú4áre_:'ÍÑ~êÀ°IvX%ª,D 9Ö²Uq çìËžF +/GÛ @8;I8ÚØš™Ú=ÙG{«ÀwwTjUíÌi!ê{zu#Ðó>êó aI1øÂ*—–­àN´(/ʇË@ôªI½^¡?ºäÊ>‰ÄI;SIÀ˜÷=JIT9“ âñç3åÔÅY#–?lz²„W÷Œ7Ÿ'š®°o¹„p·ô%heQàJ%¨ˆ¤*XÿpíñÀ–DÐBÖ‰Ú dr«$K]D› )bYÇY£d: +1­m9Wâú–ÀjzQÖ[Ì=°µ“°>NºÁ¡˜²ÅÔ¯8ΫùÕ˜qq"+ô>;Æc#Gš°NÌ8°³M,µ&g‡«ü$E áBØæ6Љ>#p§ÔÎ'ÜØ;’_«.XIÃÇ¥‰E Þ£ &´¶4N­([/á!–ëÀ ”¯K‹ÅøE&ÎSáŒÕ–è°þgÔ L•üö¥õ…Ï=õ­ÍÔ« ô°è…÷¶L”DãßxãÝ`W¹Oª©\UlÊU+É‹Ä™þžŒÝ~œ¹4Êk"Dp@AQ9.P˜ée;Ÿ-[á<%—„0SÒÕ¬SrÀù$ÂÄk‹vK"ÏZ†«3†ó7†ÂRg­ÇRÆS[ê¹09RÈ/ªbF¬vÇ©´Ú¥‚ú|JTAºq +¶EåV³³&óƒØÀeÔ«¤_5~æ§Ñù‡ª—ÅÙõ:ô¡àFÔ,*P ? +‰¾ÒŸHáqmF_qÇK—é$¡ ¦F€K+7¦¸šT‘”‘öÝG$šrÏ@Û~ÛH_sëj84ÎO µO,åp¡löž^ª_-ö¼á¹øUÿMÆUœ‘öSýBãÜ(å«ÐÒ‚jï9½F§¾Iõ%ÁÿƒOàendstream endobj -6149 0 obj << +6577 0 obj << /Type /Page -/Contents 6150 0 R -/Resources 6148 0 R +/Contents 6578 0 R +/Resources 6576 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6152 0 R +/Parent 6575 0 R >> endobj -6151 0 obj << -/D [6149 0 R /XYZ 85.039 781.388 null] +6579 0 obj << +/D [6577 0 R /XYZ 85.039 781.388 null] >> endobj -6148 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R >> -/XObject << /Im1 3957 0 R >> +2294 0 obj << +/D [6577 0 R /XYZ 85.039 558.621 null] +>> endobj +6580 0 obj << +/D [6577 0 R /XYZ 85.039 526.404 null] +>> endobj +2298 0 obj << +/D [6577 0 R /XYZ 85.039 348.751 null] +>> endobj +6581 0 obj << +/D [6577 0 R /XYZ 85.039 314.006 null] +>> endobj +6576 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6155 0 obj << -/Length 3086 +6584 0 obj << +/Length 3989 /Filter /FlateDecode >> stream -xÚ­É’Û6öÞ_¡#Ue¡ Ü|³Ëã'qÆ3îTIl‰-±L‘’êÅ_?o ITÇ5Ž»Ê"‡‡·oÔ‹þô"‹UhòEšie²l±Þ_…‹-ìüóJ „Š­…ç™Í•Û]%‘ -m: #w¬R+c5¼½¹º~…‹(TIb7w ­#et´Hr«¬±‹›ÍoA«å*ŽÃàÓ2‚7—+“$ÁmÑ—|LƒwU?tÕía€…?n~€ëV‘Uy˜Ðñ7‡a¹ÒÁ®l†j½ÔAA¯<µ ‚_ýãf$RhL’\ÅQö" ±¡ã…áÒüˆ ©Dè¸ÙUýreu¬—Qì”û¡ìxíyeA{À—,è‰`¤ðPoxiWÖ÷üäAæÁÐòï€KüIãÖ„€Ãmx‹Ã‚Ã!¡D<`Ô)ás —º,:!w[6eA9]Í°:F§(Š‚}ÑÛÒ7:^¿'5·¬ÈŠâf RAÍFù3Œ hË|Ä×A8ÔôÄ«£dð˜3CxœÕxYG6ÉT཮¾ˆóâ¹{VôIʲi¤b­±IUšD˜þ¼úíp±ÜõÃU¨ÀÙð*ç‹ý•QQjä­¾ú|õ/ ®•‡ì<¹Ù4VifÇQ²=àýè5½¿$=˜Ä(@쇥yC&|XƱä—Ôƒ¨Ô)Ë.»ÚÑù7°C®Î“Y¦ÁÅÒ\eö²äèPhøI ODçhÂP©²4Eœk­räë‚T%9Pž 6ÊŸ[Ì"d†çŒ -¸IàN*™.4”XynÆ{&ú'¶háúÃ^/Þµ@éâˆXÆ»ò³ž3¿ˆ‰•C1gãP¥a$E ¯‰£½š#$¾ƒyßáoÉmE¾¬=ïŽ1ü‰'ªNÀÉóÈúÝÊ°+(.ЋWIhÑ œQì¤4‹W5™ÉLN˘ی±pË])–6´§’Ž¢êM”tªtlP ¼ÕmE˜ÿõj@½òÀÏåwŠ“,'Ô@3Õ7³w”¸êNÉ3P!‡`/Þ}g…©ƒy™¨SLH”:)ZÅïÙòÿïè|:O+<öÎ -‘™¢×*Ò*Ë틺ÉÁ2ë÷ÚBç‘øºGL¢Äõ+P›ï—& Êb8tö±Ç(i6ÞBŽ¡ì -zú „Cû"}ÌåÂÄ1LÅÖa çÍÕKÑXw¼‡.ˆµÚ/MõÄOä X`ï¥0A°ßÃ8,·¯¡ÆÒ!Õ‡†¡?·œÀª@4~&¥€Ž§§º¹fp·CVOð¼E ÄûŽ—ï8saX@üϼŠ"=wÙŸª‘Á§WìÍXìò;•ÝU]}_ÂÜÊ~eÀãqw»•ÒVÞw79VêÜÚ ÿQ$¨\ÝmÔ°ˆ¬pe%±e‹ÄÐzd¨\IÌÁ…~ï;Gö‚lÊÙê%¦3-ž9jÁPQ‚ÈnÛáêW Æ ÑH¼µ!DU‡¯o)l®%TãÞºåK *åƒÇ»‡±ñãBËp°ùO‰ªcXê9‰£Ø†ùTÐʹ6ŠäJˆ'©§)§ øõj=x+øgS²„ûœD›JÛgÒ,(d£¨½Ø ”SÛƒ`R|Ñ£K`ð 'Q„¾ï^õòˆzk;É^HL1^O0Ã" -._¿7GÕ’Š,æg¹.‡õõ}Ñ÷†<òù$R9ÅSÁ¦±3 ·K±ò»Üð -fÒjl^Ò‘'|†'E©Ò’rlÀß‹²êÃêy¬-^×n»bß{wrãvYï«B´=*÷*)y¡s÷y ûýfÜ@’ª5.˜ŸÍRŽPkÝ!(œà¥– ñý‘ËIBq;A¼µõhç<Å$ÆeÅy=”]ÃÑaô|ÔYÒ{9ι)ð"-ŒPEÿš'¾Âc•˜T^·ÛŠ½ÿÜ2°È¬¾šÃ¤ÀMeí ®Ÿ51“‰Å߈h½4ÔÄÀÿsT „‘QÐ+‹¯§’l¥)7çZ1k3±VÈØõ¼Wð÷iÓ䬩 å€|²DÛŒv!n, ×CïÁ2ö’Wz2Ô¡Ža|¢Itˆw´°ç]Ìx—ºÌᲫŸ©Àƒ>ÙbO37,º–UŠ4ÕWÉœ*ç»nŒ8CGN€ xE¦CO‚Þóï…Æ›“Bl™÷Šf77bØ—‡í]/\ymó0ÖK ~'Q.3*âã0·W ƒ»Ã:1s]ˆÞÖ^Ù£ÏvL­S -< +È hË”ñH¬¢Ð»œÏ üD²Oö85ÐK¦~ت¹M•R¤WÍ ëÐáˆ÷„õ9xu|‹oäÐc%Çöóo ØYâM+²“™æ†×¨ÊÓÁµ_2áŽ?Ríy¡øH%ïEã¡-úg~ã Ý08‰u¼Ìc‰ôx®$)'K¹ú;¾õ¢o¸âˆ3¸ñÆ£ô2Sª¹nÏÈLŽBEš Eˆ^0sG¸„Ǭoæ&mºy¦d¸¯Ü€rß³CI£ *)Ï]¦®®®è¸²@i{¶2ÅšòjæF}Å5!ž«Z&ä ‚!†²/@U8µ€ÅµÜp[PÎû2¦%7Œ‚¬<7MÊ µ<<ÊÌdÌ5cró¨l>s»àb(TF¯x<é¨ÚËçb˜æòF&Ÿê(†ÕÕ4b‰:ÊÀ²+÷í G]%J,vçSËøä;ï]¿—Ù]7ð†ÓÃYQOº c ¤sª Üa]¼>É„‰Êbè¨!•Ú|þK—ƒYy@Ô♹Ï͈G§1€ë—/˜³‹{ËÌ*_,µ›µ*sAPôz‰‚r%Z°$ëÔ4ÕG¬eÞór»9÷„vœ°›ùN8¤I ÍÇjØñÓ°“Ä>Þ=p¯SHŽ@ÒõZã¦æ’܆Š»Â}öPÜÖÜìdκç¡~I6Ýï%©Âš70p%ˆÄÐD› ª…óÁ¬ÄåP\iýƒËƒY‡kå!;W¬‰¡"ƒdâ€Æb¤zRN -:4Èp†`«Aû‘ý[v¸^&ØêL…žˆ<‚#Õ¿D*˜pþ=²u¸þ‚Ô,U6ÍŽH½§ùþ£Æ4í¶)hÊwù<ä‹æ8ÑY¤Bˆ9‹¿‹‡i5¢šs}F.#i÷e' u¨Kñ„dBýr¸›`ÆÛY´¼ûDzƒ¤aÐIÛ³A ŸÕ—îÓ{9N&Ö¿Wb6UéQR¡€%âü—Œ›yji¨ÒX§®ÕjÂ5§¬ :éÔ݇~Áhw£µ¡ÇÁ•×p¦ä}K^Ù¦Ê hV˜yßsñåÇ1Kõ€ª!ð5¿å/åò†w¼Æ}JRÞÚ Êè$¡`ŠŸâÇÏ]üê–ýú2óßÓ¬¸öñà ?Ì‘µab‚•îƒãÞ5Eý—§ØeãÔ} \ßæ -à sßPE¹o¬—§¿r&Œ‡F%‘C†"3Qxza É;ÎÌåÿendstream +xÚÍ[KsÛF¾ëW°r ” +'˜^IíAŽ½yì:ñÆre«’ ¤P&†-+‡ýíÛ`@”×âV¹T%˜žFOOwÏ×=9 áOÎÒH„:›%©:Mg·›‹p¶‚–ï.¤¥˜[’¹Góìúâ«¿GñL†" ³Ùõ²ç éÙõâ·àÛï¯^]¿øår®µT$.çI’¯.S\½ä§Ï®^¿¸”Ás¼3ð#ƒ.ç2x ׿Ðå³7×/ž3ñÕ¥Jƒ7×ß¿øéú‡o±í +Y]ÙÏÐã§Ë?®¼xqÝIÞÉRf(öŸ¿ýÎ0Ä/B¡³tvסм¹¹Ed´½__¼¾øWÇŠÛÌŒ{i)Ò©ˆR}¬&¨) +ERÓ&¯òU±øòrnt,` eƒCjwxy³‡ÿm±€V™û¦À&lùj›7Dwj©w–ûçm~“#¥‘iÐÞÑn½Åy…7q¯©ÍM7—s•¶¾”Ý‹oð%®ßšvS‰7¿‡QX¬°Ï×—óXÊàŸe…Õ{h”8; ª¹DMf4ô @þ$ÈqHøòÐ[¼®W»|Óðƒ¼B)BäÛ-4­ËÛ¼-몋Š#°€»’5pÙÁàd°"-m + å¶~èpC:ÁÆwøϽ—„hËÛýš®ÖL¼Í€†[–P>×õýî2ŠµÊ‚6çw7#£½­7Ø„CÈwDEÊ‚û&‰®Ú;’%æ‰6aÔKnyYB7înêeËO¯èI[öȃçåÎIzÛÖ»¦|]ìÞ•·–)ÎÐ\=MCÝÅ—MÍ¿KPuÎî×1ÆQïoq˜¤ôÆÑpïËEÁŽkG›ó]嘴vöÑzßZÊ=™«Ss†³A]Qùô6¤jwùï¡Œ©EL8}'"•æ¼^¢+F£^ã Cà7Ɇ:…À†¯,õK@#)IMb3“Rd¨¯å, …‘ wdDsýõRJt +ZV«Ã¡º.¡*KíìOG& F1üó®iýÀèÁW?lôìy ²Î@1*Ç«sæ4÷XË$ÃLD‰j¯»!Ò0’™+SQ£ÝvÐo6– `(Ãg]\†ÞáÓ¨aHÒ!Nä;@œØZW^—£Ñ²ÆˆƒðŽ»4MË@ÏÊÖÒÒå[Dã-âCË 2¦·l°GIƒlî9cˆ*iã/˜0)ÉY;¨ˆçž’(¢Ö¼ ©°}€Å•Nƶ<ˆ¯ýá•[²´[.•Ž‚c¨ä¸r L-"påÍ 5Fá+lݯV´¾®-ã+J(î,6îP%/©ÇöeM³´Ø¯»Àl1cœòz¿«ÁÙ¯^q‡ÏšýÖFð]ÛÃF"ÛÓŒëÞq²)¸Û›ŠP*¼Ö´(„ß½3 $Îíq2j€é¥#ûþÕ›[’ʾ†,Ø¿·$.:$g”hµK‰…«+ F=„˜)˜Û=_æ··ÐRyŒgT* ´ °ÃDÿ(zÔ'«JD˜9E«¹ ;·ÛÛÙÅgÇ/´òâ Û1çŸM­ùþØõïÜ2\ÓáÁÀ² ßÄ7Kn} 3ÝÃMˆˆéÏ=zg%$>´÷æA Kœƒ†5Òù10k)ý³qÀ„`}«œ«ií½MVŠMÝüèõK xÆ×} +í²&¾C ¥b»—Kþuƒ‘Áç;›>õ!é–•Rù9‡¶zßò}‡EáõÛát–Ålü„/éõT.úä«v©è± 3Üèس)º¤©‡Eô‚7³m±ùÒZ5ª¾¿´lvz³é¤^Rµwy;| c°Îj˜Å–è!Ha]Óð›‘ê'­yŽÕ¼çu¼èéT‹ð™¥áL•\å†à¾“µ(N\ÃóÚ¥"‚ÄÍwÉŸ·T7¨«Æ‚JN¾ëU…\þr«6¹: +«ÍÖzP9GÎŒhçhK´¬1 +¯ñÒ=Wt¤D`«:V§>(zéÑôWdÙ(Δa* âÙ DìSþö$Óžžk“˜õi°ò1‰%²4ñ.³\jíL)¥j"Õ“æ6Š…‰‹c·#Õ(hŽR5ë_$¢#9qð–>ãÀÞòˆŒã41ºC'ÀÜYŒÎðRûƒ€‡™‘†&ñˆ&4ª±Ò™aUA‰Dž¤Åʱ™%™PF>­ZÛ­š²q(Ûh «) +‚* #Ó*!. +ªÚÕkd” 4ížßÇ gyÎ@B‡ð…[×+6>‚µ]0º8±Wnqµ‡Ê‡aR‡ìLCIogJ~xjüøÌ›ìLS*¡åTú—¡ŠfS­ÄV´÷TÀo§¦¾çw†©?%œN 0D[—o-ÞÁÙw“m}\ûövÏ×…¯`+vå!Èþ¶â•§:\ßwU¾)š)9ǘ6’}R6¢ÒTè8Ÿ†L +D?£Í–¦ŽÒþD(XQÙÓæ5÷˜Ûn Ã|r×áÁ#!æ‡iz-¯GdÔ+2R&<î[Þ<<Ý·NNª±1¶ |àsëBœPvÛ=Nc.vgƒí0¥‚.ËÚ^ŒWšozyïÈTóÝXtˆØ¾¶7®p +XŠisò³èxžÅ3î"øÊ*!ÛhÜú ;_LÄŽ³Ìéÿa}9²P‰¡­–©Ð‘¦à¡ í”·ŠÛÝÃXÅ0•ª#{jÍyÍ=fËÞ`„Ü+‚ažEFËë5¤?€:}O…Ž~Î:NM* +”xÓåf•ÂÚ•œFÆxX°±Ãº½æ¢ïŠwe½ï3øÁÁ‹Ýù–ö¾´ìrJ3m¾’SaêíPÄÃçCFWí 0×@|›ðís(ýÆŽ*…I&¢bf€§™©KÍñ$.€ +W@Kö$DZ¼æ³1çÖTûöË÷d‡TM¬ßN¹P?Ú3¸Ð)ÕÉ8©Ž"±íH˜Ta(’XŸE“Ž×iMªÐ€ Å<&•¥ ¬8‡Œ–×#2*øF dÄ09’|è"/×_ØòØÒÕ°¬Î«âþ$ð€,DD<Î08Çëôàt +kÀPÿîÙ5ûK~g+ +_Õ­«Òؽ)ˆdU˸²÷Ž£ì›õƒWI-Z¬‚C;/eW{?®–v@¯imhíöK©$t¸ÕCázPì*»¦ÜÙª±{§ü”S/‹HM`€L3~ÂTÊ)pU·£!á©%{rˆ^sÙDˆMr5ÅnJë¤ç‘ÍòzD6HÌ7yÂÂM½þÏôOM&š4ÆoO°aÊEX$÷—#Wê =ÒWd³¾&_6ÉÛØf„.ûî2Š1bè¸q-ŒÀ/[ï<ÒÀ}™Ïøiç²çPé§ì²€Ìí†ÁX1Õ‰å‹ØH볌R‹µ=°4aŠ=ß3˜â)!µè3ä 94EÃ6¹·þûFzŒ`a‚&»[±\ìgØ+¦þbÓoA.\=Ïêç`Û/n÷ßvÛÎ:°+:m “öx½~Ê(]¦"žÚÁZnŽ(¥Dœñfaw¨y½žÃ=Ó3ã) ‚%ܸ„B»ÃþÆ""ŸÅ¤AœclŸr€‚§rÚ ’ÔBob ø˜ h{ÂzŽg°†Sâiªý¦Cñ>Â0®ÔÝnÀYÈ}3XA]U öÔó© +>`YW^ç|˳é&I+ +J«N¬•çPì'lŠ2ƒDSëéµR)Ê̈ÄDØ”+PZ1a‡»§ÛáiÙðä,LŒ/›ÍVaf­?Tb›T]ÊáV§0O ½qwÕÞI«:‡:ÎV•È"9vfOG·§ŸQ¸U~úL½Ô°à$}ÐÀyJa,:"[ðKFwl¢tæ1? r>Ø­lË/þy*‰ëêX¬ƒrSùb]Ñg;,Ù/)P­òêHTð1yZÔ¹£yDŠN(¸LT&V¸ƒ¸ ×Ø®2†mö{ 3ø°pŽ†Ü‡hì.hΧÝÇeô&I±œvDZ&=>£nŒ&¥GrR +R‰ñ…¡ãX€ç@úÞ/H4> endobj -6157 0 obj << +6589 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [225.436 434.035 321.065 445.725] -/Subtype /Link -/A << /S /GoTo /D (winbind) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 131.555 192.154 143.245] +/Subtype/Link/A<> >> endobj -6156 0 obj << -/D [6154 0 R /XYZ 85.039 781.388 null] +6590 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 90.908 196.509 102.597] +/Subtype/Link/A<> >> endobj -2234 0 obj << -/D [6154 0 R /XYZ 85.039 761.463 null] +6585 0 obj << +/D [6583 0 R /XYZ 85.039 781.388 null] >> endobj -3027 0 obj << -/D [6154 0 R /XYZ 85.039 646.155 null] +2302 0 obj << +/D [6583 0 R /XYZ 85.039 546.666 null] >> endobj -2238 0 obj << -/D [6154 0 R /XYZ 85.039 393.584 null] +6586 0 obj << +/D [6583 0 R /XYZ 85.039 514.448 null] >> endobj -6158 0 obj << -/D [6154 0 R /XYZ 85.039 371.823 null] +6587 0 obj << +/D [6583 0 R /XYZ 85.039 350.866 null] >> endobj -6153 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F56 2890 0 R >> -/XObject << /Im1 3957 0 R >> +6588 0 obj << +/D [6583 0 R /XYZ 256.582 356.839 null] +>> endobj +6582 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F62 4047 0 R /F41 2994 0 R >> +/XObject << /Im3 4353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6161 0 obj << -/Length 3645 +6593 0 obj << +/Length 1887 /Filter /FlateDecode >> stream -xÚ­ZÝoÜ6÷_aà*YY¤¾Û''N¯).‰/Þ mj%ÙÖU»ÚJ²ÿ÷7_¤¤•v{‡³9ÉùøÍPê܃ê< ]ÏOÏãD¹~’œçÛ3ïüzþy¦„b%$«ÍëõÙåQp®<7õÒóõÝÀ'tƒÐ?_¿8o~ººY¿ýt±ò}ßÑ¡{±ŠãĹ¹Hçê=·¾¾º}{¡œk| àG9ï.Vʹ…‡õ'z|ýyýöš‰¯.tâ|^ÿôöÃúÝì»BVk"û#>\ü¶þùìíÚJne)Sûϳ_~óÎ XâÏgžë§Éù3<{®‚îíÈí†/ïõÙíÙ¿-+î ÎyÔÒ.…~↉?ß&Ž¶Iù)P…çq蹡Ð>½¯@øWÑ6]s×Ëjó¾z—²9HÕ–H–÷MûÂT¿z¡‡wüJÝ;xÏ6uY@§‚g÷p_”¹I˜œÇ~ä¦a¸¸C³Ñr´7^ŽÒ®¯´å„Ëù×õ…g’ÜÌf´Ñé™…f6ót#CåÆ~<™y…ÓíªPÃ/YJ=ëØ™ ÒÎ>ÛÎdJ7Ša Úw/úk=ñ]/kÉÊðZ˜-ÈžÄn„vF”°.ðÔön×° [ø…Ã/¡¹ᳺnP#ž;|÷þ:K~Fº÷\h›;ü–;ñÂp4ðruÃ]OZH[þ}>?’66Û}ÖC[ºÄ;$®ñÆòŽo²9þ!zʺW€.FžÓQC O¶»%u\…:pÞ4[lÙ6»_xÌ° -a2Hì‡éÿ?]Ç}ÕÎXÎõX”ßÃ2ÓØù¸‡MŽVv6\­7Ñ 'ízÀ e»‚ I½FÊwnQð7üð–ªka¬S§¯z9Ð&µî ± œt¼ÜU×L[^W-ó`øÀœwIØ´2þ=žV^„ŽïÞú…¥Ì=ËÁàUúŒ(J]í¥§}ƈè¸Ï0D(Òš½ÿ‚ž#»ð=rt~;¯+ÞX8æ$;*M]¥¢ÓB ÍL¨‰Ij/Îh"”¸“(q#­ÜIs'£0t£ow&Ài5°Zv%‰g§CávùþP&íATÖñß!”auR*ÜÍx,SöˆŽä½ìÛÌ»AÛÄ»…ŒAý}(ÉõUžõU³CÒÄi~õ”/£¬ƒ— êÿ®0ÚܲcÁžq`4Ý…œ/êG8öjJÐÄÄw2± 4’7M+O7‡›žW75GÞMÖ Sz=îüŽÙ•ø©¿°«è„] ®äöýk¶£²¬®{Æ߆,¬˜knLøç¤(B3eª•iäF~0E¬)Œ]¬hjMyêYµ@']—¯0P$ì·A9†cƒ8´hz:òÝXÁ^*~°ߤçÂk5b¶ è TÙq9ÝöbÊfÊFŽ¸µ§µ¤Îs…˨yµ¼¦©ŸyMFmè ŒæÁ,Z‚ˆ5è6FœÀJ ô‰ QŒ·wÇ^lDKQ¨gœÇPE&èO ÌÜ?Z J#4FVYòÃ- pÞd(Ðåþd·|ÐP6\öiãæÍîŽ 'Û¤D„B‡ÛÃ?j?!b*œ¶ŸÑqû1Dû¹…P+gs(@ìƒFŸžŸIfÓxr€¾šL/6€8 &¸‹N#‡´l!iÞ”8À|cÒ²y³%é#–^ˆF†°ŒR@î‡p†×iá  »z*Û8 á>$lCÀ_c…øÜ´Õ=A’¬Æ†ÐyË¿_c6‚!ñ®$Ð÷ŒÛдPpºgò©m+‹5RÀáÄ|£÷=ˆ‡ !Ö¦@0Z#2Vož3`Ûƒ¸!|ÞPwY -/F‰[’á™èz¦k(òþ­±Ã€°(ˆˆô_¤¡ÙWÆ›xÊŠ³ZÀ ÿƒEûèã¿°èè„E NüÅÊ =Í£ dú1¸Ð“Ó Ílú©MDÚÓx2½œ3$~Z-¤¨>àžc& ¹"8Pƒ!DÉ7š4óZ˜-›t¬R;# -ù\ñ1[œE„RÏt/œ¸Ž›nyqè2hd†¿Í¦Ï(š ¨[†~ØuGèk+øc/ƒ -Æ^mÓ×ÞÌ6}­ëfËÓiØŽ'"Öu]¶h\ç¼ë¹?Ï„ð?6?•²,-šœuUýÂ3Š¥qç〠¡‹Ö‹C§Ñ§¯ìôå’É@ÖØ1ÅMÀ¬nFCrâÓI?Í}ãˤð6- õU¯–í>j—Aœº¡>m–Íq«\Ú§«k”çLÿùvn¡«C}r^!9œ÷ÀÁýtÍk¬1pc”zjˆsÀ„8 Ào†?zØF|ùDeH[·ü|ËÍX•ƒ6ê-·M/œ®ä¨rÛu•Õäÿqý;þÙÂ@|»µéÌ“Õ’J{Ô=×#[NÌè”{®LSs}@5ßQ·ÕñÔ°b‘P¿R=8xΊmµ«¬]´GH9¡Óâ]|Ù1IáRfØQK.…zÀ2©æ±5 ’î\„ŸX ›üάMÖDy…†D®'7„c0]Ãn*âàCÎe(ÔüŠBfCæŠýä:xi™¬I*ª­0s»ý[Þ¤šS¾½<€r¿#ÅnûƒÜQä3‰&>ƒ™ ¶Yòvb×-‡k›bŠà2Bó²ÝÒ*2IU§¥£Îa˜/"€„¿¡Ïÿã©5Raøn gX|´3 ¢ã¥R=«*ÊŽ-—…ìÍW‰›jð/X´:¢¢£Èîzp\5‘Žé8/·T™ ÙûB­Qž+ó”µò0MC€önß°:/ÁsàBfA´Q…®J ·/(¦;ˆT£RX•›(‚ì«ÓÝ`±B*¼0‡½@añ›ZnÅ[­q¸ñ|Ò@Û¿âÝéMj¤Cò}Ê‘ú"‹0 6ÍY”{ ]_àbÄ°vŸïWð7—Ö–Áî ·nå˜à¿{þ´h=0Í›ú’šÀXV¢~¢=¾>†‰±Ë`âù9f#O1ྖ*æpÓ2Å‘Í#Ÿ$SÑ¥TŸ™â¦{ä†Õ“ú'/‹ŽEcD¨SßUŠãŽD‡7E ë‹Ïöa‹F+‡³½†saù(áo: ⾧äÑ,@G#`žUJÚœV gà -!IWÝÓIâáø„BA6*eˆR2 ÅKÎ}Ya´ŽtõAP•B]¥aÿÜ[7I)<üVó9E C§h(¿"ã á3ãçúƒÎ)¯›7»¡þga%†%¾h ‡* ¶íۊ̽.ï¥å¾ÍpŠE G=Jz˜kwȶ¬Z~¼(F¢PŒ•rFÓZYÏ­ûpd;qÀv‡“Ðq$¶A’ÑB87~º©%±…C×­ç…yŒR…P҈Ȏͪݨ¼‚¢P$J·Ljd3î;¡0sÕ¯ÎÄ™~¿pn%hˆ1l[š]ð®˜Â«ùœ@TxÇ—K¾”Ë/¬q¥V9?ð8“|Z†¶Ë²§íºd4ä—LS~¸°t½h,lNéè´¥4Ö•(þ`°T•‚»ñ‘+QŽBñâær²\‚oD•-\1µ,ú¾ìúìëQñŽ#LÔIQG4ÇŠŠˆ)¾$y'\6váËHÍXÌѼd‚¦_ùc×ñ…—5G ©MÛ–y?âöÂNÇ÷iwükñ-<ß—»²EÓ$‚=ÍL³ Gëoº=W:rzìM[XPO1ŸŠ0f¤ÙSF3`éiõSªÐ÷F¾7’… ~$1*è”yOï:dJ‚‘óÀoØC y<Ž|œÂÀNü£5C2óÉ…p41u×U«„!×îT»M¥ânyV;Ø‘Ñ^»W\9zh,Œ+gŸPI©‚ËH4 /ãÕsL}`âùæ|4l8Ž$\H«$SÐ䔾“`¸ã¬ˆØ-@óE[VÏmÉ!–3I“Qíß•±¶ W¼“ì#eM&ä­÷‚Òd8Bª´ ~ÏÊÈ'ñd:»rVö`{Žmãï9쬋+m)êŒ1¤Ü®q.˜Öéè~ái¤²œóO®FyX5dûnb0Ž(8h\'d@@ßÏ<KÊ8ÈpÕóƒáNßÎÜZ/eT1ò†+E5'èé0á¡"^Ç-—Ârĺd¿·o†Ïr³£†+Še­pËÌCϨ±aîH <¹zñã%øc±¿éÛU GßMü#@…X SF\D”CyÍ7®3ÿ hendstream +xÚµXmoÓHþž_ ΑðÆözý‚tJ)w à8š~T¹ŽÓøê—`;¤ý÷7/kÇIœ¶PNˆz½3ž}fvvžÙØc þÙã@ K†c?°… ‚qœ¬ñ5HþÙZÃÔ*fOçål4}­¼±m‰Ð +dzÅÖŽ®’ãÙü³qú×ÉÇÙÙ§‰)¥4%&¦ïÆÇIà'ïyöåÉùÙÄ6^á› Ûx31mã³O4|y1;{ÅÊ''0.f}˜½9EÙ šš‘ÚßðŇÉ×ÙÛÑÙ¬CÞa”!Âþ6úüÕÏÁÅ·#KÈ0o`l Äùp åJýžÎGÿt¦XæŽù«¡(µ¦´D¸÷GRYBYnI×îEÒ¶láZrÜ*a(¿X¶¿ïmy"PÁ¸glAÜ ÀÌ"œ¨®µäS•m;BÚÎ!,[õai­>¬wëÜ“öÇów îD +;q½Äé¦,0C +Ùžº³Ùê<bi{áœEY!ϸš˜+- NFCÂÓß¼6é÷ú¦ÔÏ¥žHçIô†¾2¢bÎs øŒAE6‰ÖKZ0Ž#´]§%.e¬wÍBþ;‰J¤Ñ¬;XsFã¸ÌM DÀö!$˜Z!ù¸ÊðCð Ìç"Bw}£\ëwöÎ:YÁºJÿ&d¹ù¦j–Ö450³ÖSäR¤ÍÀÖúF’¬ø-Gí„Ç””Õ (§Å5ÏËôLõ×/¾XÊf/_8¾„g(¤ È A‹dVȞͶ¯ƒœe%º¸á|ψ*-¦pÝF9z—ÑKÍ‚rÁšÝÆ@µY³¿ú}«ƒGù~zJ8RN(ÇT e— Iž  ³µeöŒ¦±´B¡ Ù[% Dc|¯"a¯E]2ü´ØwÑǬÏiÏzî½Ã õ-¿N)LM<]E¹Àœêq\¡o'Á Ô¸Y›•YÇ1ê¦Â@r +á¨J š».TiRvÝMZ/»ƒït®È”|•%y¹¯“¦É“´ÞêâQÉXF9…OÈ芇«Œ}®Ûõ2­^$ÝIBÃŒU¢yDç½]–Óé×ó;Zñq¡¿iÔ$ÙÒ‹8B*žô„•ßªÐ¾;Ö!]z¶-|éÒ°8Ô5.Àª”¦ìÇåD6]ŠÎïŠxYQ¹(°æÖQ“RÀ@v:áàÙ´›×ëŠeG<ô\ç~W¶:‡9¬•”ï Ïæ`žÀ>bÞ 8©:ŸGnéåqY0@Œ9`Ô°QÔ,1§ÉÈ’+AÍÚÔÇñºÖÌ{Ô=r¬])¬Àë>éXk[fÏØÀ±v=!›û19<ÖÚÓ’ŸTa£–P»ðñqc797¿O”Ã&™’<Ç®VQ 9BÙÏ'Ûƒ^ îg82×5Ú%4 ò$UWòšw0_Ä,Ø,“‚GÓ¤¡ +0í¹°™³ ª½ÕÉëe4§Ó‡ÛÆY\@æ[ 1ÆbQЧÖ6°¦@µºàr²@ϳ]@vLr»JudøȃŒƒ@Ü48áyªûf(Ý$ð˘w@ tî4ÏjŠãJ‘¥q{â`ý¯×l…¿Œú4[/1TK¦¯e?S¢ ,péöÛÇ“÷¦-¬øÏ (8ŠÍ +À Ú@m[7Kª +ömÖiƒe[˜Ë/‹2+¯ÓYæáo«Bãx„$¿\éíÞwŠ?‹ãr]4z•Ç}Ù¶8ÚCœ:‚8®¢ø&K¯ˆ1*UÒTwÈŸ³ÖB!K˜¼å†Çù\ñ +Í%¢)oxV»\¤UÝ\¢ýG.»€:§SÛ-\¬¡ç¹ùÙõꤦ¾ó1ñ ©|¡y/ ôtŽš„Û¸{„æ<†ÐÞ§×UÇažqÚrq\GGà;Þð·:G9Ì ¡n»-…I¨³{1èÝ`UÛ°cÝØa2òún¦12´¥14ÂM:̇á õnêhkª „Ë©Fø$ +Ӧ̭­SИÚ^?"C†€©ÃƒgÞ]ÿ Ú©õT9¿PÙŒ¸5m¸o:úªà +×ß½ñ$E\Ý­šÞEÉu˜ºZâ’ó…NwMCÅóˆ2Â߬À¸(2ÄØ’ ªëþµ¹A¥C_ØêçØéJnI‡¶É_øî¥ moå¢E±•TãòDtçBômôðl ‹À–*èšÚ d¡ou½Ø8¡Ë(v®ó+T¶îºY¿ÀÅ™Mð}ƒŠT®ÐÀÎNrUA³Ñ¶s¨Ù$ïh¬Ûœa¦ÆÑ®Ë8³hVl‰îx·¶¤Ôƒ®ì}¤¯…ŽÄKm€n¹tû]µ—ßÖÅ´Ò7×(ͶÚУüZλ²õ.&’x‹»µ;öà‰T?ã(Ë0õpüæõVk¿f·u'ɼ?Žì8Õo¿+W üå£#×}šãx ¥ùÑ–aŸ§„ä;ø¿¤e8ÆÿØ2<"–?Ù2¨û;†pQ®%œpˆpá?ûô¤\;Ú†ûV \³”ãÇn± SÒs÷ñ*PÛrø?‘Ò´Âendstream endobj -6160 0 obj << +6592 0 obj << /Type /Page -/Contents 6161 0 R -/Resources 6159 0 R +/Contents 6593 0 R +/Resources 6591 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6152 0 R +/Parent 6575 0 R +/Annots [ 6595 0 R ] >> endobj -6162 0 obj << -/D [6160 0 R /XYZ 85.039 781.388 null] +6595 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 747.387 182.161 759.076] +/Subtype/Link/A<> >> endobj -2242 0 obj << -/D [6160 0 R /XYZ 85.039 308.93 null] +6594 0 obj << +/D [6592 0 R /XYZ 85.039 781.388 null] >> endobj -6163 0 obj << -/D [6160 0 R /XYZ 85.039 282.315 null] +2306 0 obj << +/D [6592 0 R /XYZ 85.039 636.74 null] >> endobj -2246 0 obj << -/D [6160 0 R /XYZ 85.039 210.126 null] +6596 0 obj << +/D [6592 0 R /XYZ 85.039 602.596 null] >> endobj -6164 0 obj << -/D [6160 0 R /XYZ 85.039 189.535 null] +2310 0 obj << +/D [6592 0 R /XYZ 85.039 357.583 null] >> endobj -6159 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F14 2895 0 R >> +6597 0 obj << +/D [6592 0 R /XYZ 85.039 321.318 null] +>> endobj +6591 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6167 0 obj << -/Length 3589 +6600 0 obj << +/Length 1514 /Filter /FlateDecode >> stream -xÚ¥ZÛ’Û6}Ÿ¯Ð›©ªE¼ˆ~³“ñÚ©];k+OIÊæH”†‰TxñØ¿}^$oÕ–ËCh  ûôé¦ü…ÿüÅ&r=•.’ïªÍf±;ßy‹#ôüãΉ•ˆ¬,™×Û»õ›8\øž›zéb{èljÜ0R‹íþw秷¯~Ý>|\®”RN¹ËU’lœ_—›Ðyõ/n}ýêÓÃÒw~Ƨ.¾ón¹òOp³ýH·¯Û>ü̯–ÁÆùmûöáýöÝOØ÷ -‡Ú’ØxãýòÏí/w[£¹Ñ ´LQí¿ï~ÿÓ[ìa‰¿Üy®J7‹g¸÷\ºÏw ·…JžOwŸîþm†â¾pÁoÍíR¤6n´QÓmò#k›ü@¹Aà/’Ès#/¤}zwX®Âhã´°†§œïa—íR%NÖqW‰Ð»¬-ª’»Î¸øj¹‚Ž=Èt'øCC¤Î^äác•í³G«o‹ò/~ÿT<ÖðœÕßyÞ??dŽÚÂAnk$Z6µO¬ ïHC!²8;^ËJÊ|‡byƒRœ¨øJÍ?áávÅF&¡~‡ñþ‚ËnŸÀ*c/vÞ=¤{—ÑH97W¾þ³ 3è¾ÁË÷´^o°R½ ¦t¤*u´øP¶1qh°x@%÷ÀRaÄõ50Í -¦Áá×p\ë&ßuuÑ~gáu%!8_(°²‚Ö…£Ûªm‹ÉÍìÔG&ÃçÃ*êe챶¢k›bŸëAåÆ:b¶‚ß ys¢ÁÞðƒ?Àõ/px€EÃîtMË2¤IÎÓ³s5úPÖ¼œÙF8¦ u˜ÀŸ`2üé󿻢Î÷ò¸®`EõgÔf}ÉΟ›¶ÎÊcþù\ía£Ü¦º1qÀ5¹ Ÿ– áBàÙÇì®òƒE (nR 3pau¾ëÃY‚‰àáîemuFƒŽc¶Ë8qÖy»C…Ý=·?”m²h^ysMi¹I|[g#2eZe?q7)ïì–íA9µ>•s.ƒ€sÄŽnЪú¬ŸÚøJîÉv‡Ý=Â#;!Y"öšWžÑJ²FÞËþZ²•°mANRWgª7}åì-÷Cƒ%dµT‚µ¼{hÀA  @Ë·•k@vçRà QäüG´F7ôç ƪªF°ñª–qhsU­5éåôUbæ=?59#ÓèTU -öµcõBVÊçŠõQ$>Z'¬¥W–øôŒÇcâ6<Ñ^µˆŸ/×kÜèöâòÔ¥>ö“K§|\_p‹¸–x6;È4Øñ"¢#l0\Ä8ÒŠÌmÕµy¢t’†–yÜ ]ìˆE²CÇü¡bž|u6XuÌ]2™X÷Š_8Š1ÊvPŒ=ñ뻪Ø:vÔ.VoŠ²‡DòíL¢ŸãxkŠ^d1.Œw`èÄaO"‰/‘À½=¡B€‡  }ÖAÎ S!žçÐÓõC›¼þZìòU™á¶øQ9 ’«öûE·€jm]V‡Sv -1ÞSKV›™X6˜Ò§9_³i±îà ¡JÈóC?uòo—SƆÏ}ÈÃ>ÒÒÉ‹pï¹79ô%žd;ì‰_Ö=4 1+k D¤6/ÔªÊ=?#ÃóÐÏäÿ×ØR-‡1éÄì%áõ}…ÇÞæ{&gØFËÏð¡ÚAè1ÀU%ÛyxD›®õÂQî -€Á›À(ñw2ã{Šóxk"µD»f8©À‘õk œ@8ŒU¼ºsÀ×sö»‘ïË {Ô­fÐVÀá6*r>à"wúÄâ°·¸¢­újµ Íð:Å „±â%£ÄÀrŽÜIÆa eVªñð³æ‚¦›ÆÅž‹ÓI,‚×9äÏ -¨FŒ¨åp©PËö©guîW}/v7À#Ã؇pÍ⪖YYB×™ŠêÁ@ƒÝ -·aa¬CKKÒÛ:ˆÌD‡¡-?‰“ -+Þ½0†x v½‹¡ -w»?¾¥1ŽªõW<æÞ|”Ãy@#”¸€ìG Ä '"™²%´+vË4Cä3úÙ·öòïÿ“BÓ„ƒ×¤FÉ’¸{¸oeƒ”ì‘0b¼¤_&™„Âè¡ëXè×è1C蹜tòI˜%^ÏkP(ÿ–/§ü“¥Èùrh™¬£E¾˜K—¾Ô‹ŽEI"BàKaò_´¿t/(Ý¢FÚ”v‡¬* Ù·, ŽAE|xÍøÒ RÚ üŒÕÌ´—rd¥u“«s-C²ç÷´h¸Ù爰=É…&™p÷bsgç@t« ï›n㇦¬,ô¦œ1脹¶H0}ðñžaÉ,†¾ óÙbÃ[,¼||ÁÍ„nhמ'ÃWyIxGñßÌäŬ¡­áã¬÷ÜY‰te#?õpTÌÊf.8`û¼Óù¬±Ëüý“‘=Xq=! |@&µVhÛe%Op¬3ž@?VÝ…o9꟱ó±7Ǻy*8D¢ ¢YQ®¦hŸ[&L¡Ýâ™ø¦^ ìÊ4gK•l;e#ÝæõH 3*Aˆ 2te×ññhúÔ'L‰ðSÁ`ÔN˜UÅ oÉ,Š¯ÅIïù‘Ëš˜/y®ï©iô=>1òdÝÕ&`Z!ÀԀ̉Øu6JMLZÇî54Bˆ”*¾Æ–Ðu4ÖB?@ã› -ç›Ec{> Wh¦ø§êÊv˜!à†J9ˆ‚þ›T‚ä@j¦àqb“µUî”7J⾫?Æcé¿AR ÐcÖèz?>2Üšô†¨•Ù1ï©j:åÔâzœËx¢Ò軜7D&š YËNì;Aús"SÅWIÚÚP»v­|.dàl·cÔÖTÒÎc˜TĪ``÷£P{í=á|¢`‚O #”ØI®‹×=U9@ƒR‰ß—ÁëÚFL{Ù1# ´ät}dÀ†£†ŽZù™›e*ªišOt؃0ÅI–~ þÀÀªÒ¹uÔ*HWOVé‡l¾ šž0p/°ƒ7J=Q⊚xªÿþrãžo&iµLŸô”¶u §/5›zվХ‰O”+Ó¦zþŽ ÁÉTíx3 Ü]Å$ÎQznz™ëh#2?›[³ ÖŒ&›…k²&oýÉCHîh|wãéPÄqàœÕEmñ !†¡?“Àé>oTÍÑÙ\ÿIež þ™:ûÊ;*‚rŽ/CµOD¸à®Ìåu†ÖwpÄ8_œö‘öU)wDe‚X>§b‹ÅGoú’næëìÐêÞ›ÃvR²¤“¿£¨UÖÁÇÞ°"µì0PDn:]7sÐ꯰8—nÓªÝlãJ+u«,¶±Æ\·ÿ~Ï™Ûà¦E sîsæûf‡ü𡯘#‚¡çs&|8KÎp 3x%aW"vKæb2xþBé!wXàÃÉboG1©Äp2ÿ`]¾ßN®ßl!„å*6²=Ï·nG¾´ÆoèëÅøîzÄ­+|“ðàÖÍÈæÖ &ïÌðâýäúŠ„Ç#×·ÞO^^¿Ü\âÜMMŒØ_ ñvôqòjp=i"ob‚( ûÓàÃGg8‡_ &¸ƒ±Ã8L§ˆ›))ª÷dp7ø»1EsrHZ]Uª%l°ÀUç+©9“Z4•tŽJ*‡)GšJBñ\*& ŠJÖ›°Üæ˜xµÑª*+,@¦Øá0 n9 \fë.—¤–1ˆf뾊IVZœÏa/cràª#®™Ð&…ñÈvmaºI"7€/3Š¢ÂM„L)k‘å4Iôi +ɃHa*Oi®HG®gM7¨Zà÷b7'qÌt]”a’ÔYC ¥p-”ÍãÏ#¥Á[ôÜh¥ØcVª¢¸ ‹ ˜Þ& üýŠ„ºØ?0™n@ȳ² †.#2À­gàU{V¸kR:Ö]E8æ˜}Ï£œfâ’žášžÆDŽUÉj‰=ËUDƒvðaÑDSè;ƒ˜À™‘ZÃûÓ’üF_â¢rV›žwË:`Ý4Î ¬öîO ðþíÍ?´c7MA'Ëç ¥Ÿ¿íV])˜žÑ}òÛíøÍ™Óa÷ ´¾«,“³± ò¨Sðô[¸-W¸<}ói1®ŒË ¦÷ë,É–ñšÙ#tóB›XÒûí:þr¤§Hm6˶ë²òò8ͺ‡ª¡zª'âYÎ’xŠL]ò¨Ì¿þ!~ÌZŠ±T¬Ây¶£q:W4ØÑ=¢Ìèx»_ÄyQÞ£ýGº=,@‘šnmŸøÀg}QQP|»Æ@'É|}žöZ2½` ›yÞVË +«_Gs§ÐB°—Í8+ØF¤AÜ®a²0íâé2Zæâ÷Kb-m—4ד¡VLËà|†{™^(—6©»Çr-sÏç°—´lA:Ì@zÃ8fª\…eed•!8ì +2`7=ÎÅ &€™ë ¾I傹^7‘Ûµ-»eì4ká¸Ls}ö)ÅP +Ф5Ih×*³¥yÈàrÓ„Ád,‚ êmN•JCk»¿$ÑÚÖùD¥ +˜_Ú‰> ÕLñÀ&]8ˆ­0èj}f¦{ µÍÍv´…'¡õõÁ®œ +ŒèTW•‡H“xÁt2û)j2˜ùÝÔt¤ûÃ2~K1Û ~„I‹Ž9¢ïà¸ÚRý¬Ô„ÿã÷ˆœÖp„kó̯"·ãÌÐA/³uT¶÷]ì^}ö÷" ¯I€FÝB}îLz~Mlõíã2KÓ +Í‘®óœˆ«è ¦6s.š–L/ qÉ™ªxvôj𨌃=òø´ïáñ¹:hs³Ï¿ÒGd&s”}Hji<˜ ß%^‹à@^Ƶ*ΗYå«û¦‚SK¼ÄxDö¬þ ,Z ¬—MÆ l.¨™Ð©»ÃÄRR(U‹hWù6 E€ZœîÆ…¹#¤j5áøaé(°žÄxÄ_’TR=Pë[IX-ùù•ÜË4ÅY€16+ W«V_q‹c”ÓE‹îÖ¯•AŠTݤXY²÷¦NCä@œ8lŸ‹×Óx]Ë6ÍÝ:›â‚GiO±|9_«½HoÓ+θëš0þ£å»¡åÂõ qY›.5«‘Ð"x3G«öü÷¥ó€ö;^í$\«»ss;O“ðKàõSÿgÙŸIóEÏ‘T¹.sy Fhu¯>S¾8 ø¤·£oendstream endobj -6166 0 obj << +6599 0 obj << /Type /Page -/Contents 6167 0 R -/Resources 6165 0 R +/Contents 6600 0 R +/Resources 6598 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6152 0 R -/Annots [ 6170 0 R ] +/Parent 6575 0 R >> endobj -6170 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [391.093 600.62 591.389 613.522] -/Subtype/Link/A<> +6601 0 obj << +/D [6599 0 R /XYZ 85.039 781.388 null] >> endobj -6168 0 obj << -/D [6166 0 R /XYZ 85.039 781.388 null] +2314 0 obj << +/D [6599 0 R /XYZ 85.039 761.463 null] >> endobj -2250 0 obj << -/D [6166 0 R /XYZ 85.039 652.037 null] +6602 0 obj << +/D [6599 0 R /XYZ 85.039 741.337 null] >> endobj -6169 0 obj << -/D [6166 0 R /XYZ 85.039 628.715 null] +2318 0 obj << +/D [6599 0 R /XYZ 85.039 494.868 null] >> endobj -6165 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R /F66 3242 0 R >> +6603 0 obj << +/D [6599 0 R /XYZ 85.039 458.603 null] +>> endobj +2322 0 obj << +/D [6599 0 R /XYZ 85.039 210.96 null] +>> endobj +6604 0 obj << +/D [6599 0 R /XYZ 85.039 168.675 null] +>> endobj +2326 0 obj << +/D [6599 0 R /XYZ 85.039 110.641 null] +>> endobj +6605 0 obj << +/D [6599 0 R /XYZ 85.039 75.895 null] +>> endobj +6598 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6173 0 obj << -/Length 4515 +6608 0 obj << +/Length 1755 /Filter /FlateDecode >> stream -xÚ­[Y“ܶ~ß_±oáVyh/¹ò 'r¬Tb'öæÉqU¸3Ü–fÈÉ‘´ÿ>}™MES.kHl4}|ÝÀÆ·üßæIéâ6ËãPçùíöxÝ>AÏ_nb±‘!oÌ÷÷7ßþšÛ8 -‹¨¸½é$¡Iôíýî·àO?¾ýÇý»_î6Zë@%áÝ&Ëòàw¹ Þþ[¿ûë»»8ø3¾ø‰ƒ÷w›8øî¡ÇïÿuÿîÏ<øíʃÝÿøî§û÷¾·HꞆý _üt÷ûý_oÞÝ;ÎOÀel¼ùí÷èvKüëMê"¿ý ÏQC÷ñø£åýpóëÍ?)î3·üÕš”‡I®—bŠOL±.`Tr›%Q˜D†äÔåöNeÁ\_µ»Û˜XÿŽ’èØÞm iw‚Ū;tÐ>âo ûŠGö¸þò(oRzžé[i­pÌh¥‡íiöºabD£êꊾFm#£ÊÇ¡êä±"-Ì݃± DV@ô ‡MŒb*hYÛ¶Á ]{Øü;Šø°|ú:SÁ®ˆ“øP7Ìvûñ¹«åPºã¥`K}Ä•eAÛ ÄÌ–Xç>”Îà•ºç·©A “¤î÷òMùŒÂ:À?5‘*7+kjXÌF«$¨q* švàb¿Ü ËÐSâÔŸ‘㲓&â ÆÒža-wë‚Y‰¯òÀýiË ¢¹ÚŽ?,ëž“%Z’Êît°»,ê~@¥¢i¡¯ñ——ðêXàÐþíz¢­y¨ŒÅAßVÃöÛçò¾>ò؉fgY˜¨XÃ~ÇHÜkïqÍ´¬¡*w :ª€Õ¸7¸$^¶lu­°7ÜI¬ªËîEÚ°d< - -;@P¸×–4}/ZÓô¬«›" 3OvùÕ±…IT;-Äç¿Õ¤ÊÈ— 80ML¥Q@zó€ß!WЋA½pJBÛí¬8:þ7«/¼t$Îjæ÷Z.`±Biá°±î=¦ËÁÑXÑdk\&eº°²Œ”LYGà1±v=S -ðªY’ÿ¯ZkZñÌ‘ ©v‡Ú Î[‰ã@Ù:U†v¶'dÜ—@7&x`§÷Øvã*Á€÷¢=SY6x¹7ÍDÁ[2¾†Mœl;Î2Æ.èý…iô ~!.«–ÏWŸt• ?<6Vü²«P2•ÂŽé®‡=?µÖ9z¼ ÎË´+»Ü¿0 åVþpiôì" ¨­u=“ZuÜ…AˆœìŽß÷µ3a’°xLÜS ½Ò"f›Ѷ„®SBÒÂþ‰y&4+×Rè×ÍÓAxçùòùŽÂȨ3¶5g>¶JSXþæ¬ý»ÚÆ•r «ËØs〾²ÁÔÇ øúÂlµ)ÛŽÑ©k˜JÙ÷ÖUçÁ¶.É1cï5OdF¾ 8€|üúÁ€Ú׬E¦óÀs€ j”³§u±ŒÜÇý~4KÞ-É&´§N蟶(…=;€4„,Ô€Ù|€½‚€Ýïú78MÐ[…ÿ|<¡<ÇwŒ:Õآ܈žd^Q—…€µ¤[ò! ©¦ØºL<Gƒú‘ÀF=VëÛFtxé¼’€œ ilBió©²%~ý[mµþ„Xkæ2Áê\!0|wãG4ôÜY©=S aÏ* óŒZŸc`é…Xÿ 2àá±= e¶ä)q<ñ÷G²é¦êÞ̳…§I¦Âàîеc6Þ º~>'*L³ÔQÃË3&yëËòÅ|S=×îsŽóYUR¨8£íÞ¬ìµÉCY¬ãܹÉÓ— ´1lMž8»ÅŽ…ÝâÂí³ÖîP‹÷×2¾«Ä¬›2 HØH …ݵÈnN zÃf~Ê9…6\n­!jëÊŒ2äñ×a/·­„BuYœ? ~£+êÆÙi©J4—Ö/k ®AKi§ü,|Í¥=?ÚË‚¹Å_‘AEÄ´ä5Üyb¨Søµ<ȱ[ä’QACW1¨§·†ƒg6vb°dRS>úòȶ»\ËkÛ$AL–p²K…ÀÀEHã É&z>:Ú…g<ÎÂÜä¯ù8肑ˠ׌üÒ„ÖÈgó­¹7ßÄÈ9:¸Ïy\X#?Ô\Z³¹u#* ,<=I¾u`‹zy:±ßÍâIÚÊž¢÷Zt8Ì3¨1E-%S]Ñ/΂²¯¦wÖë˜Gú(g“¶ÀŒµGqPÆ€*b¿SKæ5àt/Ü>† ¢3¦ð9ýR ñ’B×Û’Îøt*q }ÿé.lùpª–à”ò™툒xZ‡N¹…ÉÂE Çê" Ѻ>ê9õ#JÍJ%Ð2hØÜV>•uÓËˈ" ›ør,"R®~D­eÛ㔿=UÃ`] S^sdí³+Ê „š 0.8šà¯8môÈøZò9tæo‚䱯ÅÄàä#”S¡Ñ‹5•vã%ÌT»šÊ´%*x?ð$}3‡ç5kâá:·o¤…Æ,WIÒ Îz_«5é’ÑR×BÉí%Rá`’%„ñ#¿Òb`p9LŠ€÷ÒÎÀ¯XJ-bÁïa´'‡ {ù¤‘Âð §kV¯áÊï)H#.žéÊà€~OSGilRˆƒ¬Ÿö•ô’JºŒÛ¬Ó€N. ÁÃ8„„Õx¹ Ë¿]¦UýÒuP‚ Á±úâ/Ƈ¿%è%nÚÉœ~ ¯ –âs,Îö1;=–cln˜ëƒ|κþ‰|MÛ½bËÙˆl¢"4É+°Ût>"ÛA¯Dä‹JDžÏ·‘ýùzÊÈp—êªÖâp‡¹+!¹¸™Æ ´IzØsm¬-‰ÕÒ8‰˜„¢¸Ýö»B@%Žiü‡ytØ×nNN[øþ–â\*rYcŠ±/–©&ÊŠ|«š 9 T‰™ ¡IÛ@GOä¦`Ø4æl–•}´߉ÏkÒ«v(Îéwáèv V0Á¶wÕÚ˜ªµ—Š‡‰„œ‚Ãá…àSÓòï˜Ñ~¢|û$Õ¼1Öž‡H o -Šyì¾ì¹cmE…“qÂÀŽ-× l-YbI‰³íh__ƒàTiÒRXGà&/lœ%PØ$~/‘'´Ói©ºH²ˆÁ|b6Îçðp#¼õ§—Ã|Ô Ž!WàJ•ì‹à-”rºMñE¦<óP 4.ARæúlr‡m;NYŽ á2Öß\ÀëÀ¥˜¹æµâ´Ù]’lÑwîNEÑÑSªèp©TG,×ÖÖðé8‚KÏÞd¿]ÂÅj”]†æuÖk4).»soÐywn½âÎ/N(î|>ߪ;÷çkŸQz%.×j^•†&ÍÄŸ³Œ2ö3XÄÝ¡óI.>=q]dè¿á¦Ñ¡ÃˬŒ@™êÀ@ðXv„¶Ô¸²¥³–TtN—˜=_ŸÆb¨Óž쯫¿® Jòeó½rHTÛ†Q6³EÓH܉OÀ+MüA>_C¶8ID-uùê“+GUk€î}ÃGnOâ¸úbyÀCÛäÜ™~U?‘±Ò¹™Qùôâ ’ûæòǶÏûJæ_?æ­›'™è‘g9Åšã 4ž”Ãk -ÀÌ–®ÜÀœnmäãƶãecÀµ¥üH‰ÅZNot&çâéXSƒïˇ1ÚCglçùT ê ¿ð‘ÎÚéçF”Øëé &+6Óng±Í,O]ÕûÜŠBw'|ƒ8¦fJ>Tg#vÍo`ãÔs÷¶lQ÷¯FLTËÙN`ƒÃ]ëëF†9çqð.‡ÑL21{JÃg'·nEB¬]µ•ˆ±Xë$’àçf-ë¾”ÞÑ;9ZO/:C‚| –wT ý[Î[)¨gF`'Èc?‚J¡c {ÿ´3MVLµR1¡}Ë(–¹3Z.Æ«jAÀ²v= *ÊÃB§·JëPƒ'õjŒU¶~1fcimÖ|_š[¡“p#áò¹  Σ<—6->ì3Ê+¸*CïØŒv¬–üÚ;å‘;!BÍå*] óåÖا›þÍÊý mBS1ÇLæ·OH#"1Š8 ¨MI›â¶0 _Á_› M®‹ÿXq€À‹6À¤ãÍ@©?üÒ%/z@Do¡6<¶èïV{Xpº±séŸð[˜$áë'vÝo@ Ez6­§[ X£l=ëjæÞÊÀêR¥oã8 ‹4þ*oeimîFó-˜í°°X¼g“×àÓ’ºÈ(¨N˜¦Êg´úò<½— ,KÁ@¬TC~Ín¶öH…Â"ŒÀµe¤aæë¬SHmFZ+Ö™*@¦±oô‘ Vè#yQ‹ô’DˆW`Ò’ºÈ¤ŠR…>ç<qí]‰\c>ÅÒ©º -óBê2óàÿŒJ&^Q™‘óe\‚œànz –-©‹,k€×qZ¬+E³ˆ(:-B€9×àŽ)]fPjXÛcnVñšûˆ¢T|éYR41øˆÑ„ '•Ci÷¸•S9—`ˆ*¯Â¥ºÌeŠaìï±Äë»øi1ù‹”eĈ!aœO5Þ¯ó\Lj3ÒZñ\ÒŠ4³óy)`RÀ¸(±ÜV°ÌUXµ¤.²ªâ"ŒAmT^øOˆ:½ -{Bê2{º€ÇÜçïÁÕó^Øß³PÏJÔD`žÀÄX¶¤.²Œž-7ݹB\ù°îX¢4ì< -©Ë<š„:Çò‰OE C÷²VæÉ#u&…Ôe& Hç33e’¯Yy…“Ó:³=ÒûN*Ͷ†>|ÇY.£ueÒ0D¡úÚã!µi­¸ -S@ÔÈí|g1÷çprç`QÅs1]qKê"ãZtâ1.™—Q7*|¹Äaà=PÀkp+¤.rk"€ŽZûÜÖCu´:bÿð ÿd¢z,éBòò÷û}u毭5[½ÿ³B~Õb»¿F74u±¾°D)ú³Cæ×¥•žókÿ`{Áð,à¦)endstream +xÚµX[sÓ8~ϯȰ8ÃƱ-_;Ó‡@ËRf +,„á¡Ûa][IMm+øÒ¿ç"»Ië†v§ÓZ:::×OGGµÇüØãÐ3-ƒÐ6EŽ“bdW°òÇÈÖSÍ2Ýáy¾Í^zþضÌÈŠÆ‹åÏt=1^¤Æ‹Wów‹Ó÷“©Âp.^¾Yœ½Àµ9ŠZÛ[Øñfr¹x=:]ô–÷6•šýutqiSpñõÈ2EŽ70¶L–‹Ømz®Ðó|ôaôg/Š×Ü1'BÓ ÅÃ0 o LÂ7#Ï£0Åms=™zŽgTòk›U2åÙ,Ï®fµLÚ*k¶³u\|¦‰lš­Y+ôOm´+º'¨n—Ë,ÉdÙ<&j“•WY™Þäý°œ¶Ì¾¡Znkùy™Uuóy×5ÓÊ6ÏÕÍAk¿ëv'7½’ZV·Y"ëmÝÈbJb~Ez©rµÊÊGBš$ªí¼ÿ_ìü‡’†ߨ*ýM½´w¡ ê\aúÂ'}Ù m㜻kYòäŒ?j=™:ÑQcþ”À)ñ¨nxž¨²V¹äÉ&Ãt‰Ð2.äi€¹Ê//àçÍåÅKØ—¿K$ `Õ¢JÞ£õ&q‰¢ád•W3͵ÁleU¶Q ÷–Ç-Ðkdž¬’5™|uË ãìé-òË$6UÖY”r©ÒþÀh_0žÔä!ª„v ó^Â8¯¨u]×xÚésÓŠXßâvºŽeà¶J]åö‚ÉE¬=à .fšŸÍríCµÏ2L™…Üm©’Ô¾Qè*îW]DÁØó3tüï—Wa:Ápqv²¦;¨vîP8¡éûQ¯C@žØÌè£3:sÜÅžpƶmà]d dÜ°£Y¶«ÃˆBÔrJqŸ:ùýl#°ÝÀâ€)Æ\Œ(k\ Äãz®PáK¶4˜pP'˜·aÎZ@YƒIŠyXSîHMÜh㛌^ðN»K&PžV’÷Çy%ã´¦(Á+ð:ô|c1 …QMlÖ…'± àHv…y`®ZÔ á/Š†`a»!àÔ{Â2'ü%Xt²¦;ÂÂÂöà¾õƒ^ã,ØNŠc)ñJ²,c 3UñJÜê‚@ô<Õã„Ó‹ë]Y¹ÏSÊt,²e‚ªfòÍPíäB•\òÊ]ÛòÎTAó\P¥­‡4}ß„#°—’™lÈÌV‚˜²h"tf ûÿXÕ E·B„à «@ãxÝUC ¨2ß2Ó†à‰£dÄPÊ»jR@+Uð$ÓüGMíïF&ÌH@“àuÄ&Ó5Ì‹x”Ks†ó¼‘UIðÏtIÖ…k‹ÀÆK·)Âóv̆ %o‰ˆn 8 qžó’®Ñ·YW - è*RÌÜbÂqÐ_%äãR­xO!^I´óÓ6L¤ãCb8FW„NŒ%©Ö×'Ž“ C‘0{Ý´\7p[ô?‡ó‘¶Ù ÓúΓ`‡‡¦«6w¶}¯ëº)l>—XçMÐêà¥êYÆ' +65¼ÀÈ0è¾o”X:‘PIh€ç6+WL$Tš+* ¸m¬ëÇ|q]x¸‡}¹ãyXd:9l;ðúÈŒó-k¾€1Ÿ&ô6K¦öH†)Tbò¯UU’;®¦–šÕVw]Wž'¨Ï¶kºÞ;è#… 3†‹LYw–ñš‡mÆU ™™d;–e!fƒ®Ж u½s¤@;æVF€B’€²Ê$]©{ôݺ¦ƒo+ÚÀŽAyØh^lh˜•"-Æ£Eáe—a{ô‰›OÁÁ¾TW!ô9|x†`Ä6 $XæB%t À¦Nnu£5êT”r·»÷œƒ˜Ø&< w;ãJ©æ7n¬7àáR7ÙÓv –ŸœÎß/^=+âj«1|†ýêa&úõ¸i= À4ÍCbÑؽ3<èÃê¬UÄXÁ‘ó#ÒÇÍÝå§EVÖÿVò­¬›ŸðtÎ/­z ŸÞñv%›þµKOªt@&ò};²à‡†3þ š]ÅõÐ3–`ƒ ?8šucv…0‚bà´YôW­} wWžË£Ùµ*ä¬s{Æ›HÙžòÀÃ.èËþg¦mŸ"ji!QT1Š®5Â]_úw³Œ³¼#í¨b }œ •jøåhüÒ¿rî +¾0C ×{ÏqLÇîlÁ¸À…sßÞî_> þ¶>Þõendstream endobj -6172 0 obj << +6607 0 obj << /Type /Page -/Contents 6173 0 R -/Resources 6171 0 R +/Contents 6608 0 R +/Resources 6606 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6152 0 R +/Parent 6575 0 R >> endobj -6174 0 obj << -/D [6172 0 R /XYZ 85.039 781.388 null] +6609 0 obj << +/D [6607 0 R /XYZ 85.039 781.388 null] >> endobj -6171 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F14 2895 0 R >> +2330 0 obj << +/D [6607 0 R /XYZ 85.039 472.088 null] +>> endobj +6610 0 obj << +/D [6607 0 R /XYZ 85.039 437.948 null] +>> endobj +6606 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6177 0 obj << -/Length 4278 +6613 0 obj << +/Length 633 /Filter /FlateDecode >> stream -xÚÍ[Ysã¸~÷¯ðÛRU‡ xnjf7“d¦’Í1ÞÊÃdªBK´Ä˜½$µÿûô¤(*ÉîCÊå" 4Ð8¾>Ðh©ÛþÔmûÎoÓLù:Ën7‡›àv5¿¿QB±’µCóÝýÍ›ß%Ñ­ -ü<Èoï‡~b?Šõíýö³÷ýÞýåþýßVk­µÆþj¦™÷—Uyïþĥ߽ûô~¥¼ßâWå}X­•÷ ^îÿF¯ßýxÿþ·LünfÞ÷xÿÃý‡ï±îvuOd†?¬¾Ü¼yoGnÇ£ÌqØ?Ý|þÜnaŠo_çÙí ¼¾‚êà ŒÛ#-ßõͧ›¿Ú®¸.ºåVs«ëÌ3}¾L*v–Ié¨âÛ4ü8ˆhê¢ëWë0˽摟ý¾ìpV%þ#ˆƒmùXœ`’u_ŠË7HSñ#óðaZœºë¶Ò]ÃO.ì 3ȯØôUsäòG(nZCÓtBÒ–ý©…*¡úy'^QŸpœXM½=î,ÇZájå4»¢-yûŽMÏ/4Š¯@ÿ\W›ª¯_¹xËãQ0]!§rëÏôw¿ÇþòT­øcƒË ódX"áÇ3”¥^CKZAÏ}õój ªŽøÑ—;bÞr7MË•°*ÊâîàÓ¬ W«®ìâ¥Bâ5OÂ×LyÄüÛÕ:Na »#-rùw~1M¯yú …!-Gs,åë¡ÀoSU™ââ[Źךœ=aË þך¨†™GI@k!“ÇF»²½ƒ -ØÍwÜîe_ù†ÏÝ”»JvÉà,Š3¯è¸_€ïh¿ g$tuО¥´¢òNf±Ê-×"zñYq ªMÑ e¿/z!1; l¾JéG~ýÞ–¤‡×ˆ+h?.½Ð ¬mK^éˤÓËzfŽ=¶z}¶ó @E]ã[ìLŠ»§êYèæë( -½G¦ëžê¤9öXP·«L{w\ÊC†‚Å¡:V]ß=¡z`i€+S¼íuóÌå?܉•Ð¾Y<ŸT×<ï+³+=¾ñîõ´CI(ÅyÁmQ{ÂÔD@è° >ÆŽtúHæ­V!Þ,­á …`ÕìÖ¥ÿ¢(Åièp¼X%‡è²(¢+¢´ÈPDiÊoV”\~à—Ί‘òS8+²•?*9£$è¿£4rÙ‹uØ÷B„kŒT]µ•·½Ú¥MÏ%d5‘¸lÁ1b­vÜq5¶ð>õ ©ß‘A`iâÑ<Ù#!"ij¬¶gÙʘúƒøÄ0vv©¨Úʽ=%ŒTø A)“ ¡°6Çˉ"?’+ˆ #D× ³ÄÐ@fÂo2¿æi1 -Œã™ÞÕ¬WY×ò:Ä"mŽ‘C¨gÏغ^ŽƒÉzWÇ'Ñ Ø3k°7Êh²ßXä(i¤íX ƒ‚&„ðh]€X›]!œOh°£(aH´|~êQí¼r9¢€ž‚|ŸŒ"Šb6/Æ[g*RýØ5’”=ÒØjþ°ª‡»0ôWdzwƒáðbár®\32:G:æcIÓn;tŠ^ãG®bK/ /¥ÐH&¨eèD>”Mý1f'WYn*©ËBÞhÝ4fð1]2%`r>ƒœ)̳ÌÏ5ˆCùá/Ò~˜ÎG‹Ö¦¯µÓÙL0(ý^ îÓßÿã_ŸÐ”©á| •^ð8‘r -\(šø~J:•|M ipÙ)hÉÇÜ -åp …ï1<ÑЩ÷CÓ—w¢'3? #7”Q=:~ù/¡D—JP&Zj›™.‚¡jß༷T6!³)Ó;^Æe ÏÝ4|µÑ‡y1™³Ó*jp9È“hË;£Å«ÁÕø¦yú†‹Çk'NG= Š]¾C+ÃF"ò(ÈdvŠÎ‚ÖŸGS¸Yç¢ñˆ@'±Z6Ñeãaˆ®E†b<¦üf‡ËoÛ炸$KþF$1Ñœç'þû‘óB| xs| H$h‹ fü€2±öØÞzqpÉÓcå žOŠ4›ÿ;ÿô5º¾¡hBBt BK „&üæ!äðãhB‡³ï9B;'å«Øàiì‚¢R9  -9…ý,yG[6ëXD'xãŒïÆ–I"`£n&N©ÓƆנˆäÎ ©í¥jWTGAÜQəL¡ôìÀeBظ ¨5aµ5€ØÏê{4²Ìs‰Ÿg2Ù\®l̕˘å«õ/(dŽ¶ä¸âÍ `D¶ì§ù‰‹!Õ‚(P ¬Eü¥†WFÓ4ÿÂÞ[÷Ê]_Wl¡ìÞzf"çö¾¥0fª©kZh˜ÑK÷í%yÖiê§êÊyÂ!º,φèŠãÏȳËqÂ^6ž!£Ôo£Ô…ɹEHÙ"€oü¹;m1ìwoÙD$ &/Ó©è8õƒ,qçò?ûŒ¦¯åIë:óѤ‹ÇÑq.ÍÓÙóÔÏ3ýëŒQúZc(?Œ“éÆ ÔÊbò¾`4·|koÃD…èP4>O —Ÿo9>ðå"ŠãÀOTzÅÑŠ…芗OùÍ¢ØágP<ÜX¢kÛ‹%¡ÑÉ L(ÀgzÊPqÊa>šÐ/‚2öµát¥ƒv.WîÀÇî='‹Ðj›"º¯@NYè‘ô{QC¨Á*'{ÊÎÍI1¡÷¶°éhÃP¨-TN”ˆšk¨³}édEe–ÌÔ…l¯Mm þ¾Dm%r‰Q -Ì<àü?'+é9ë8ÑFBbšÞ§¡°²˜.ŽÉ|Æ“|äÑQ™:ȽŸ1ü–½q¢iòxD÷eîö õGh>æ.‡†nNáØ9ʱÎð¾ÙÁ3?‹ôøîn¾ƒKÈ Õ€œ0àЂʧ©+8%!N9‰XÈû…Kˆë;Š¨ÐŵiÏ€ªz.àXeûÊý2ŒåÑU:ŒÒdkÍìõ@\W…ÅH( R4']Ë$Óè0ò8¡ßµ 3ôvmÁbüH!&¹(CŠGÊ}ª™Ì½¸àÉä”n8žõ™=ŽÃþØ'XÀýX5Mîšã¹v=8‚nf@So]~Çڛŧ!Øôw6”6ry‚ÄÏâìVe±Ÿœ¡Y;Dd_Ã`„ìÐ×*´=™©èï“Êõ3æ¼M¹§±€«´È]hθå*¿ì³Ë“(×QäǹšÉóÅäÕ‚6hm2i ŒoÃÙ‘íKlâ‰@¹}åz#ð¼‰@@Q7t-\<ÔÒ¤!Šcï_6¢…’šRc–-ë ‘Õ$0kW<˜mL®Sg$¤ê»ÒˆÂ#Þ´ªÀû€fäŽÁ¶%šF“¤£xHMúà—²lÏæAL^îôH>à<–èDìΛºzxÓ•›S[õ¯3V*Íü 7Iø N5pâø¥{=hBýMo®/ ¾rtn9ù>V&˜(?…³ì¹T¢jwy3Eü¨mäªg{ÂYfM‰?JÃáÚÒí…ö¥Rٷ܉±aCzXp9[ Œ•£Ó©}%| ²B5¤¿Óì÷²c>OøO|ºã4aô8êêÉþ Æ;!Pñ§ƒëå2³<1ÂCtü0¹â”Ó^sÙÙ¥=}åþm6 +šKE¶ÅQüÜ:ú½…¬µ> ù^ѽãô@9¼V[î¥hçØqøÆû”(žTÉï ¹rDÖ0N¹ˆ FT;ò3qH6LÇ®0y9œFhü9¾óYM} u.Z*˘\Õc¡+L³á§[þ~Àn_ù½àÇX™ßñï]ööÅ¢D\;þùÍËh«0%<5rÜ4'ù…EkóЕT‚?Þ™ÿbëÏ¡$|&Þv<“ž€³XR¦bç‚ŒBÎç=5ü|iéæ [ãEœÂ)S±0ÝCuƘ5;T=šµÆ:‚¡ÿ!Ç"‚:4«„H.ºà¹+°0¦²ðšÛAVsÍLÈÞaÒ×föòZ~¦?œtÂ?³üE?³¿˜‹´Ÿé Q¸8 ýP™±àÁžŽ×ü¨ìlÀÿ”Ö.eendstream +xÚ¥T[OÛ0~ϯȴli1ql'Î^¦e€´Â¨Ñ414Jh´\¶4mÕ¿sìºÑ=MUås?Ÿ¿ãî‡ðã¾V,©Ÿh΄Öþ¼òBÿ <=ÞG}H°sd¼ÃSû> endobj -6178 0 obj << -/D [6176 0 R /XYZ 85.039 781.388 null] +6614 0 obj << +/D [6612 0 R /XYZ 85.039 781.388 null] >> endobj -6175 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F20 2865 0 R /F35 2880 0 R >> +6611 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6181 0 obj << -/Length 2259 +6618 0 obj << +/Length 2072 /Filter /FlateDecode >> stream -xÚ¥XmoÛ8þž_a`¯ˆ ¬Q-i¶émh7×xqÒ •%:ªW’ëõ¿¿y!9–Ó½=äE9>Î<3”˜xð#&‘r=OÂH¸2Š&iyæMaä_gÂHÌŒÈl ózqvñnL„çÆ^g þ, ȹçÐ>ЧѡQ”½ÝD I¬x rGg®+c(\«æ'%£ä«ue±ú(%ôˆˆWljMŒ¾‘Ým((ù”¦¶h@pˆUB…nHµËÌØLð t„ ñç”8¬É¢˜âð-7šv¸`|C~Ñ~P†Ðcƒ”îÛN—<©¨ÎþÜ ÷qÆVbp%c‘OF³»·qšñ”$“óxÕÄ@ùþ‹å“J> -7ÆÅ¡P¾+…? B¶3Ô¾ ËÁ¿™Ržƒe#¥:üйݷh$"4Á|î¼AÀHh’Î\]µ§ð†swª—?ÉŒ”v±ŠÜÀc .èxÞª.Šjg}ÚŸG¶¨Ã&&*Ô°)ö:³cJRº¡ž»Ð]zE‹›]À¹äc´pžÂȧÖ&†Ø­ieì/4ú«ïðÜÓƒ" ß×IFžBÔèG‡E:p`½ÁàÎÑÚð>w–äíÚT‚$²í ׺,mÐCS3cŠxBe±Ätµ$ꀎž@wŸ<’¥ñsìMÌÊyÇ3ÚÎÔ•¦¿Lzö…Q0KFA–yåüL†¸ - MžŸ*v¶Û”öÅÞ®`ÁCikHÓÏŠŸLB €†¦s¤î!¹ 4Rj“Ü10_nø¦ðiàÜS»c'¥" ã|I+™œå-Ø[gvÈ ÚiMjs~¿õA]@U?¥Ým7¬×í‘ëéæK“Q1í‰tÕ#ÞïÇÀ6Ƀß?fð]Wøð¡ªðÇ—>ér>zå›Y]³2 -ûD0“‚A+DÀvÙ/ÇÁ@úm0ž¤N¤æ/_Æ2=yQ\CÁZò -¤Ð †›xìcb·_˜1ë©Ä¬ þ—Ü3ðG Ë'pËhîF?àü̱-{Ü*pØCï§W7WfÂõFÂò'¾œËbã¿+`€®r"~ -5ºQå…½[a‚ÅFgç}!î4÷#{Ï[nä’KI¸F o’TâU²Õé¶Ñ]·7Þð?M®j‚õlªîœÀÑŒ*È€ ¶›ñ¥gƒ±ðà{e’¹õ¶'dŒzÇí2S/`IÓz[uF©msÊXV£Þ./õ qŽÝÔMkØÿýDú¡-—ô=ä¢0õƢ˗\MoãkÇuÏÈ—W¨†z , "  -­>ØVÝÆÆš!„¼Ì»vœˆùÓÍ2,Íž™Õ¬ë¶kGÚ®1kžÈËpÍŠÇ| þxáÿëÛøSM"ÝHÆ㎪ ˜ò…Å‚•þÓØoèG€ÿ š§endstream +xÚ¥XYoÛH ~÷¯ÐÛÊÀZK×kz,\¤IqÑÚ>(¶b ±%¯4n’¿jƒßCçO–ö +÷É<¸sl$Y8ÓÐùW¼-TNžŽv–ü6¸ ªÌTê,Å4([cǺ›œ”/ö{ØÚ¾™IYPø:£¡¼@&"[[zðm1XÛd YûÿâûnÝAØKpÏkÝlYy×dáÁ*™KãØ£Ýæ¸~ wno0î´Ì{ñ'ŸŒ­ˆÊYh,º÷©IŽí©u¸+¦ +U£IÏÍ°ç5¯5MȆðeè¼f¸hè84ÈÛè\û؃Û·Í=¸ÜÑñèB¸ÇJE™¤Pþwòí‡Vö'"Òy<ÁXD2σÝÄ@„Ç"vóíänòwÏ õ–&’€m—øÐ)|xäÉùôcD%Z÷“8åhA€&Ar‘¾2 Ý4·üпèé¨M,"¥ˆcðo Ïó\3ÉhLÒZÑ›ùNï3IêØÎF| +³J"¦q`2ÐV0JôˆcÔªT‡ÍOŒV»·‘«átS°ã¸nÀÏðÝ×<· WîË ‰#оÇÑÌ#¿g¯Þ™ãDQä«Ôp8ÜÞñaÌC¬Âëf]-!na¢Ãkæ‘'o›Ú¶Ûù.bq {×oa$#^¼­ù»Cq³÷Ûšy׿º3Æ +õ#ÆrlÂÊ2‚+ønªõcç…·ÑR«ŸU×ãeL&:U‰Ñb™j÷fÁÐ),/"Ëí‘ ‚ü¦±{1/w ÓXz"ë'ÎZ 8@[¹„ Û[&êË'§Ä¾nó¤Nš×ß#°=ÎÂHçaù\1\–õÒ-ú“Föhð¶±ü4K~ÇÌY:gªÔe§Ý~[ZÇ° „ÇÄkѲpWu³ÓYì ìð¶rSÖ@ã 0™<Ž¤I‚ü¢ lI,ð\þÛ0§d”åæÕâHg T‚ãB$ƒ41ª “F™V¾Ä?` WöÐ)7#¯¸¢»*ëëzÕîž{Ö¯J8Ð\,ß´ÒQ®%‰ø© ºåKCU©I´¯J± ÀP}êx».} CJm!p*/ÊE”¥ªÎ¶…%wi”€™ÕQ:ÆK¤¬™ª|ÞÓbÉ~Å„\ø™s`A;Õ’W}­¨GiôŒ³öYÕ®Îcb¥sFøíx½‚°ð¼v£R¯G#¤E¬É5…ùr3ÿç ‚(О™¤ÙS–í¨€e’ÿ¥/€8¥ƒÓ$ öuõHFzâp/ÿÍDΖîßÍßÇìУN¡åšË(,™žÙáFOVS8~2dTÃPMÓ—&pÊ•ˆ4¾guÊš§§O…«\Õ¦TØm–Åâ]áN±¬Jw+Á·GÉ™º;U½Ix_ø¤pªô©·ö¯ Œ‰¬Ç¸sܱò“4WÜPT®‚'´w[Î&PȯäF¢BGhêq_*ŸtÕ"_…ÛÍÅŒ s¥ÒøŒ \F¸rJ_®Ûæà3Á¼~à~‡>h½§Á;ž—RæP<«×¥Ñ\L +2N YÐü–J¥ì28®s2”¥oÜÈ×”bWBúOÜ€áÒ×>›oqá $JÁˆºt‰Ûñh±Æ펓§á¯¯ñðô§áž#¼@ºs8°fr¬«©=×öú^PæPW®î2ñëêp št…atÒi"µƒ¬Ì ²óñã&•XŸ9šøŸ@|“Š„ LÇb}y÷™©8·v–‰¤Nyðд£;oÝeüKJßUÇcÏhaß‹›¡$4ñ¨ûîxÁ7ÓDé  ¦RçLÔµ‰ÏôéfàÌûky±ýYygc¬ÝÓ,üzܱ›³|›Ë[^›õ•œÐ[R…«Ê+[x?$;IqI_ªœàû«©“ã.Õ{8Ø–~ãîËmÅØdÝuoµgŽ?ºà¨·.NFÖEzcb^ò`±ÝòNÒ89tc¹Ï× äOô ÃèaJÎDíSíÒ%xô@9xç ¹O +B©“ê†K@«¡ÍÎÇv¹ºõ”§0¦…Ž噡2P+üza¬³(Îôåÿo}H4endstream endobj -6180 0 obj << +6617 0 obj << /Type /Page -/Contents 6181 0 R -/Resources 6179 0 R +/Contents 6618 0 R +/Resources 6616 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6186 0 R +/Parent 6615 0 R >> endobj -6182 0 obj << -/D [6180 0 R /XYZ 85.039 781.388 null] +6619 0 obj << +/D [6617 0 R /XYZ 85.039 781.388 null] >> endobj -2254 0 obj << -/D [6180 0 R /XYZ 85.039 490.22 null] +2334 0 obj << +/D [6617 0 R /XYZ 85.039 761.463 null] >> endobj -6183 0 obj << -/D [6180 0 R /XYZ 85.039 469.63 null] +3127 0 obj << +/D [6617 0 R /XYZ 85.039 632.606 null] >> endobj -2258 0 obj << -/D [6180 0 R /XYZ 85.039 400.068 null] +2338 0 obj << +/D [6617 0 R /XYZ 85.039 386.34 null] >> endobj -6184 0 obj << -/D [6180 0 R /XYZ 85.039 379.777 null] +6620 0 obj << +/D [6617 0 R /XYZ 85.039 351.029 null] >> endobj -2262 0 obj << -/D [6180 0 R /XYZ 85.039 149.846 null] +2342 0 obj << +/D [6617 0 R /XYZ 85.039 224.075 null] >> endobj -6185 0 obj << -/D [6180 0 R /XYZ 85.039 127.13 null] +6621 0 obj << +/D [6617 0 R /XYZ 85.039 181.122 null] >> endobj -6179 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F20 2865 0 R >> +6616 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6189 0 obj << -/Length 2296 +6624 0 obj << +/Length 2311 /Filter /FlateDecode >> stream -xÚÍY[oÛÆ~÷¯P¥Ã÷ÆË£Ó:mŠ“ž´VžÚ¢¥ÄµE„U’²ìff—)QŠs|PA å^¾ùffÍgüã³X³@&³(æLÆñlU^³ùþŠ»¾›âæ¼Y\Í߆jÆ–ÉlqÀÑLi9[d¿zßþpóaqû˵/¥ô„f×~ÅÞ‡ëXy7ïmï››»Ûkî}‡_ -~¸÷îÚçÞ4¿PóÍÇÅíwvò͵ˆ½‹nZ¼ûÇnjAÓþ+~ºþ}ñãÕí¢—¼— ¤LPì¿®~ý=˜epį&“x¶‡vÀ8 —W 7ÓJºïâêîêçÊŽ©™]5¥%-c¦cyª&©jâ\0ÉÅ,ÒÓ"=mÓòU®>ù’5'Ðõ>ÔÕnK]J¶«È›ö>/ öÂqaoŸ£hIµ©Šê!ßX$iꬫª­>QŸ ]_›ÅóyœÌlžíîÄÉ›fgÆâ”i^Aèakê2oiànAcV»Ú´íó¸»ÍË GÊò´pŠèWiÓÂAÇ–ŸÖUi²¼>µÝgËñ¢fmŠ¢ëf·ÉŸÎc˜Íãxz‘¥îž"a{ʪÍÎÔi–ïš#Í”ËmÚ4cÙPŽ?ÒÕª=«äýÚ˜Â"…BíÚõxêÆ-ö$Û5¦v -êîÓz3>A5¦iòjã°æoùÈÐmË— âˆàk<òî«ܵ¨ÐŸ÷è½9|nì yJËmÑϬ±zm·–lÛömkXV=Ôii‡j³-Ò•ið+†0jl{Í7r Õý•Dù¨Oæ*å8¥óŠŠ&d4ÓIÌT¤>Ï,’)NòŠßaù°SÚP±`! v“H04dºE_F°g(F—9}+ÀÎw'+ñŽc/Cí Âe˜x{ÔZ¾º‘·Æž¡î;¥S,¶›ç¦58XÚÉh]ø¹Ç«­êÌöf° mÓeÚ¸e¿ÁM(^¨ˆI:ñæ¦]Í­¹Nœ$”nÚ¿&€"¸?>„iÖiVí¿Æ—‰fIôJxDÌp:b"Nɯ} ªÜç 4juÊÓ ŸNÿг+¦ /[GçíP@€K8l -' -_e†Ê`Z¡ˆ&UØoHfv`­)í²@tޯѮbÏibdW¨Ž¡jîà°ð³LíÜ¡‘Á ´ªpá^iå­ª ~µ)°m¤´öZh‘À„÷ùª®šê¾uŸ˜†(Û&‹Æe+l Ë¥B­zR’þ÷ìÕòH2†RÎ(ªK•`>ýº;uPþkâN!Ä P„›sùNï ÑÈ‘Æ®Œ,cðýèIi“ »€tŽ‹J†-ÇZCÁÉ…D)Ï¥ï’:'µ©©˜8èûC·"ÿ¤žð'Š¥çDZ3_]çv>_HC14$Ã͇ÙÅå§ t¤ð‘8³çîžÀÓï̸×_F÷³ƒ¡ïû® +½Á0Šbw<™}ü<îÃhûîl<ùÌ·Sþ>Ž'7w»faò¨g¸t÷ð¯–jö…GÓÑí‡Ñà¯Ù¯g­Ì­4 _‚¿øã/á,@¹_/„ç'±ócáIØ^]€Ä^ }3/.¦ÿi¯â=íð©cö±C4Jÿ v`¶@GÙ g(…ô”V'ï¡Sîá‘%ß½§õZ$^¬TëµP;RzI ×ái vÒ‘—HM^›”`îf0”n¶oUC&ÚK´ÄïŽô„NŸIzc’¾ÓŠ.Ç+éÜ” ¦Ó“Ô\;ìÝK’ʸ_R%^N¤”çŠD}\f(çAkw r×8Ïa°~ÁÅÀ}Ì× ˜–=o¸Y3±B0mU¼Z¤Mf†s$.àhnx£Ô¿à~äæÏL7Éhùì寮V¾ÒsÓ ¶®ï/Ç÷<Íkæ;¹›¡}Éá? ©´Èë蟊lŒ”p›e† +ÊG<˜;BáÒ[^<ÚÖ†êëÍ=6ƒ¡ŠŒž†\úþ˜ÐeM§¬OÒ•¹fšU¯ùœHŒD(`A–.û¤À·5Ûšd–nZó×È®z¡k^£Ãc3f ¯[!”;`8šýWëä9G)Q´nf!SPLþÂSvÑqßl‘ð`4¹9â‘Ù5ÇÓ¾>°$ÀÖï¡%Ÿm¨U¼™Î)802Ó‚—þRAC‚5h}CÇrëRØmP×èÃ9*ãíg£NOêÐé%ø?€ Ä$)"gØâÜÿa;Ø£9£ƒÃ#ôYNhëg ŸDº649.ãæWüC‰ ++3›[0ÎüÄw1Èr +Òô ã5[0IcX M‹™¹ü™¿7“)³ÏÍeYÍdkdÜäioY™p[Öἶw5)¢ I^®;qˆmÚÍx{Ò:jà¸òaŒ«w°8ŵ¨¯¼Á­Bï!Å·tÉHØ”æhƒÉßy™ /¿òÑePƒ¦²×âö ŠTySVæôn$ 1Æýè79J‰ˆC•}ßæ•=YÑÿæÍ”®zIík†äàæƒQH`„Ò¶™»cz³ÚÝ Y‰ì5¯¡´Ó‡„tÿ¯|@š”ç)e$ :®ãõœ­±2@É ·ý—\lØÍ°ž©ÒuýœUÇEÖãß?=´fîW}ZIŠ>\¼ùr}Ï#–GÆž‚"‰+£ÛjÕ¾ qÜK MÊGžÉ0ÀÏÉÒȹËv•æF9ŠeúóÂ$ó^ðWŒe¸?/Í~i€î0XqŸ.&äù¾ä¡ouÃ9Cëk2 ¿Ü-•¹†”_SÐIýBÚŒóNƒA{:Ζ¸=,»ÚƒèV•ˆT\,AUëƒ/ÁÅî„Rxeâ!¤¸, +¶ mRv¨@áaʟͶ2§¾Ò=ø"þ~ùï|½ýÁËoŸ_¸U±8¥  +¼À?_Ã÷hN"²N‘×ð³¥y«¾‘'ßfþö#(«ù,“÷;3^n:憺6ÀÓ^—VÙÕ •u(=éŸ÷i†T† +³WVÂk¨…ß^ĉ*£}~R„^ÄgZšŽ;F– +X©v8^f ÙèíPò3RŸRÙ×ðΫÜÑœQÙýTå3 ;•÷8W¹Ç±U¹{ÊâÕy>¥8ðJüä¼âÍÅ ÑO?ðS|ãqÅ{ùÚ³Åìiíýª<}VùŽä´î†ægªŸáÖj¾Çî¨â=v­Þm¥TÃû6GdGKx¦œ4dL¬Ïã[¦ð¶Ûµ÷ø‘'¢¸àÐ Š‚¤¼\BYw*ý|Œáø|öhN‚¬/„›æºì¿¼µmüLMÙØÒvŠ¼6¯'¬ð¥ú‘r±h+·ºÎl¿‹·Q…`ÞÖ”‹†«èHiòB{ùÉïË*0±½ÐIL©Ànð +%D[”ó´XR ÏJ7õh´(©¢8¬ƒd¢<ƞċðàSþòTþððLV¥+À7Ì$-ò´Ö8'9å19£þ›¥ §‚×ñÅt}µY§’GÄàl2®u8íñ+$©„Æï¦â‡+§ +‹iRÞêêÖŒ*‹cø Ú÷ «FzÐðš%ùû’ïšFš™š.&Ûž•ËM3ó- Å:#ŠÅ#³øPf,à +óì‰Ú×~9Öª×A1×¥ô׳·£÷ÎüÑûwT©¬°&‹bw“’ŠßÚ’L%=­`’&8î7U¼²×ÞÙÆ~³¨Ä}çyæT„_ü¹ «0M•¶8cºvêØa«0-Q¿2…e;ð +¬o×m“‘6†,Èᥑ”ÚôˆåɤBX“f-}!ݧ­iðJ¦e×S U’€ÏsúåJˆNq8u›Q—˜òl4Ÿ·^¹…´,U߼öÇbM·#ˆ „R¥àßVÈà'Ó‰S¾1*/l@Qш²²? )ò’ø/lˈ` @ ƒÀ%(¥ÇKËÒÎÅ5£c^¤þÁ:æïÆã¡èÄ‚«B³OŠ4Ymm˜˜¦–·îÛÞ7íÏtà1¾óf•m:¬1 ,€Y³—l~Ç„€pž²á%ox¶Ì~P²1Ì’Ó: ßCÂö‘äLÝDõ}ç£Ê‰»Óüe‹/ûžÑâ +¶b:%RœHuåë« > endobj -6190 0 obj << -/D [6188 0 R /XYZ 85.039 781.388 null] +6625 0 obj << +/D [6623 0 R /XYZ 85.039 781.388 null] >> endobj -6187 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R >> +2346 0 obj << +/D [6623 0 R /XYZ 85.039 558.485 null] +>> endobj +6626 0 obj << +/D [6623 0 R /XYZ 85.039 514.734 null] +>> endobj +2350 0 obj << +/D [6623 0 R /XYZ 85.039 361.848 null] +>> endobj +6627 0 obj << +/D [6623 0 R /XYZ 85.039 327.044 null] +>> endobj +6622 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F35 2976 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6193 0 obj << -/Length 3626 -/Filter /FlateDecode ->> -stream -xÚ¥ZI“Ûƾϯà-d•h4–¤|Ðf[®Xq4Tù`»RMÃAÎhòëó¶n\&®¨TôÞ¯ßúõk†‹þ…‹LûÊiú*ËÛýM°ØAÏ7¡Œðdˆ7óz}óòû$^„Ÿùb}7®£ýX«ÅºømùæÇW¿¬ß}\yJ©e¤ý•—¦Ùò—U/_ýÌ­¯_ݾ[…Ë·X‹á.߯¼py …õG*¾þ´~÷–¿ZEÙòÓúÇwÖïß`ß+\jMÃþ3>¬þXÿtóní(w4•9’ýåæ·?‚EGüé&ðUž-¡ø!tïo€n_ÇJêõÍíÍ?ÝRÜ/xÖ%.i•ù:SçlRz¦0Œ|F‹T¾bâ“ÙnÛc3¬¼( ‚eW~9V]Y@5‰ôò`öÿ:<¿oWž†s,ª‹M[”µyÂc ^ˆ$æ´d_ö}Õ6rÉëëLß?¶Ì uª/-Ôï78èl-ª@ç¶mî¾{YÛ—½ÙoŒ_¼„F[O¥eY“¤™¯ÒøËKéÜ×yrQ^pŒ(Èü8RWסY¬Ã%;|¾Žg©òâ$÷s:±¦P -šÅšúI´'Ú"ë‡tr@å,ÏÊõÎü$¡5_¡Äy®x̤LF /ßïÃÅÛ(]̈åu½ÉÂDl˜MuP'~§‹$ü(ɈX°J4°p †ƒU™ºnÑÜ{¬ƒ$é l±ð -U³ã±íÌ9÷+<- hìÙ+;ÅL[P5qÊžØCý8Õ4U¿ï±Î"ËÓåûÇUB.RÓ€ö’¶‚^¦Ë–úûjS—8 vmù‹zÊ¥ª¹£Óu{3TLK°l7ƒ©{€‚G>VÃ=ÜpµmdMæ×Ï\ÙðZqDêÊ „ ÷]‹»{˜%L~…_1ívþ:pçɪÔV5v¢48oŠ•~0ÛÏèf£:x3¾g5¤Q]yWvŽŽ ±Zh…qJ+àrIØYNÍ@B$Ž)-…‰\yÂr{”Ú¥I½Cµ=Öf2°be*÷¼Oµ?ÔåžµæÊç-Jj‚JB8ÑŽ7(¬Zb+ -ýNÁjVý„ñ–;œ^ðϦª«¡*eMTjüN ë(^½b¾ª$Îþ` öãG©Bxì§Ñ³÷½8ÎüL)gÍQ0C¼Œ‹c{)¶f¸ãE>°DwÒ ë=òIÀ>¨ -Ê,øî•7„­gÛ;ö¯—ïp±²ÃçÉuCò^ºvÅaЗˆ]ƒØɲ¥‹ä¤zD\{H’:Û!ƒÜ£ -ÇJGÔõˆOm®ýD§v{:¶w;ðqr;ØGŸèdEHÃù Úqð­˜]2Ïbj†„+•a>%˜Ùæs ³‘ÐáØD„Œ) áNÈB’"ß3aÖÖ8A­=KpD|$ * ÀóaÀŽö&Ã/¸Û“5ñøe³íž"t „Ì—Ùýˆl#>ƒïøOïžE†p{ècFöIh°cž'öt% !¦æÂn®€*›¡õ®äCpr ï$®Š4# ¦4`Œ&W†c=>t²DÑC³¯&ð¸’Bê¤ÅÊ‹î'až"•^v¬Î2»™™kp’» R×r²åxØs¼j¨·,ÊÂbS‰räJ9(ä0ÍÖË; x?Cïkˆ9^Ö‹‚â;‘w8™àÿ,8 -Áoû+_M[ñpr;íF#8b÷p¨„†|'§l¯€Á(Œ>'c®ƒ×¬'Íæà5ðúœhÏàä˜,ß¼ÿþ–ë+Ê 0åx3BÅcO¾A à›MÕ…߯$gyé< ܈“çã†\·Qœàç[!Å_€4ía ŽÙ çÇBÎÃq†‰\/{“9(•B–jøël¦:rÂÄ—ãÈ;þŽa«“-¶‚¬Wµ,l7¤ÛÒ¦¾³©Ç](èÐÎåy¾òPÓ±îZw+“Àñ©©¾r¸àd̼ÌU³@AeŒbd2óÓdr k\=ʉ$ºãÐE&\:ˆÔ>½‹°J–MÇìÉ †Úß]×ú;w U1÷#+IhRæ ËiÇð6õ¹€7âœ(O$ÇÇ2æÓQ–I -ÂòÐæq~Å{•;{6>Ppuš‚ãhØ‘áÛ>Š{œ‹ÆŠéd|»Aú Üî n˜âþ“ˆnC5⟸+Å0`‹ì³ã«Õ[Ì©ïžk¦¿”-S‰ŽG`0½V‘W,. æ$òsº´sôâÜR–QJkJò'Æ–ÄÐF#EyHÒEŸ*]”VÊÊÐçWºÍcÖAК¿¢{ 7;™FüÄ-z'Ã]ã[ãÂ]Y UyF5Ò„šÓ‘z±ºb÷#],÷pTÕËÏÀ©®¾Åœ4Þó(ãŸØ'ˆÂíÞP¬‚ÆGr ØêLP£÷tcxFˆÿÀ­øµ€]gÏf( ´ü00hSµ¤–³|Þp¾1p½°¾ìÑá ¹«A)(Ný70ÁŒÎÀÚMË53ÎeÇmÓÓ“UX=ð*¦5O0cY`!¹õ L0ÝÝFSh%Œ§CAï¸ßÉæ—ò^r7ŠÄ1¾°‹)~ŠÃ6~ ScNÚB¹êd=žMQÈôÿoäÜFfŒN)–Feï›jbÚ'Á ξ^A)”-ͳ³5±„kæ£ÊHk·X¶âµ]”?Ê)µÒÖ£†ÉBw<ôÐXþÌ탺ÎÕéÊž¼fULö¾f‰”rFÆl­] ÆÖνB³ÄÔ6“t…Йââ³"(ÍÚ -×௳–ü 6R¦Ui»®×¹T6·m%_çOxK$­—î“„J³¿¸x×8€o«p¢<0s\õƒK/ßÂÁ?˜0:˜ø×ûXÕò¤K—dÀ´E®Ëd -ßðí9 MÐaÒlø³­«1‡¤Ô׆_7ïÌ‘Õz‘¦œ|§Îk¥DáRÒ©Ô( ßóyÑNÃœóq¸‘gJŸ›ñIݱuX¡èÐËœN&÷CË?‘w®ˆÞ¹èS˜²[öZ|.<”|=ú -!EéRvÒ<ɳхŸëñuš#?¿ö vv¬Í±S®âÕ”KM©‰DñV"/Ð3ô‚åŠ#aæE‘n „5)~¾!3@$&Èci Yxˆê?rÃÀ®;²O,¹÷e\‘3Ü,ZQªÂ”ª1ƒý]ãäà ÊQQŽ)Ùë¾i—þÕßöÚË yn¥ O½i ÷™D6£·!ù!‘Üÿf…:¾üÔ;¿üø±¶O½/x€N¦xÍWî)³ÍÙèFv)øîŃoO`[Â0*e“—9,n¬ìÝÀIÂ¥ØpÓ)Fm -Ú@±³;Ò=ج„&ãV5îeB‹óGØ5}·æId/ØÅ—~¶=ïÊ•S~”_ºqÂæø7ý\nò(ãg*¿|oÕQäG¡¥™®¢ô”^û³º3‚ÿ ŠÔqendstream +6630 0 obj << +/Length 2885 +/Filter /FlateDecode +>> +stream +xÚ¥]sÛ6òÝ¿BÓ—£fjŠH‰Ì=¹IÚºwq|Ž2¹™¶°DK‹¤BRuüïo¿’¥tæ&“X,°‹ýÆ*á$€?á$‰ý@§“Eú:I&«â*˜l`å—«P0®庇óÓòjös<Ÿ„ŸédùÔûQ¬'ËõïÞÛ_oî—ï¦×ZkOÍýéõb‘x·wË÷¿LCïáfšhoy{÷ #|øÄß/·wï>NUâ}ÀÝ{À^~AÐLJ9¬å¯<útó᧛éŸËß®Þ/ÏŽà/E†¿^ýþg0YÃå~» +|&“~ËÅpìÇ‘–ùîêÓÕÜQ¼Mxט|bøq¢OÆ#Š?"Ðû¿ðRYý:½ŽÔÜ+ážÙô:ôZ¿à?UýÌky‰Ó6«ŸÉ¬+ã•bªÞ¡iy¶5ˆÇç"dá™’W>ÀÆÄ}Ës³^¤Î<«Aå(íÝð¬š^ëܴٚ±_žÃ†v+ÛåÔ$õVHá‰ëÚ^£iÜn³:C ¸®C”fJ×/ ²—×aê=ÉîÓ*ð*kF(ª:ãÑí=‡7Èì=¢(ð–D’°ò†Ï¹ûÈsÇÞδx¡ªl¶ù×bgåüfÉ«¦¼D_`åZü±ò9½ýp÷€žžÙí`°Àa…·<3 aå”KAÊg{hd.KƒGÀÈÛÚà5_H„/Ò˲:ks²© EQòàí¡Î@˜q¼ðè +-¯.yPT ›*ͪi¬¬¨¼•4›ã®/„˜e@×Õ‰Wöd^!ëÏO½UU°}#wùÊ × oiͳX9 °÷SÔªuD:4y¹á¡³TÄKáçxã šÎ<ð>‘$V#^Ø• ÕΑŒ˜ÐˆÂ7»ŠÄ´Û‰ÈH6ÿz°b²6@&뛬Ìê½Î +“—¢ñ?‚0ú– â“Õ°!«ü=©·ÍW‡©ûJ–@bV}ª¢X…¶vVˆá«”U¬¼êÉÑ8½º„Jæ'.¡’¸9+J¦ ›/ú+NŸPÛUÁßs)¦4Z,ľg¹× V¼îü—3Ô0Œ?P$AB¸¾E·Æª2ãÁ-⺠„4ÜH§J¢‹c¡ú-@Ñ!pÜâ,ìLNâr¤ÞGñГ°zÎIœS†áˆÛî´Œ:/Ø÷‘Z€'nÊÆƼ™)ìΧBvxè[§’!dCny/9»¾îq `G¾ÅËÔ%Y8 å%Ia‚{ópÏÀ:Ûï(ÚA=á[Âjá)þ²µ§¢¦ç ™Ù<íä…z@xUó‚áé¾®ˆ7(ΤLÒ¸Œ ¶âïIÄÊdKŽ™“¨—Uë8ÊD-Ø´%•ä‘8 uU­$åjÇ[rÊò²~J0×c²ÇhOi<ï@JÒ +£9éCY÷ÐǬ °4~è¥dÄÅktyVŽs¡S³IU;öŵPÇÝ<4Âu=£-ãå‚gx +Á€¸¬/™[¤ÙvñKª¬XPxv;ªp4z ĺW“4p°|{?CïˆtàörðÝj:ŸÛ_îŽæ#™”äê,ðç¥%€«’'#­¼YÖÒ9³žd›á(Lá€JPÔÈÝ{§†Ã%TçÉ +Š@ +æJÆ>XÆDp¼eíZJ¦ÆEßJHëì~PÇ"ÂÖ4< ÚqLd-ï*ò~$Å%à Œøµ2¬_C¸˜=`Ì8™iAw1:ÐäÑÍ×âYù“ÔTt‘/ˆ{áN¢3À(umj©BÛdÖy§[‰ Ö%CSÀxg˜k¬€¡Z*\ÀÚ°`•†ä˜¡ +­â@F{*†{2ÛN†üƒDê‘@@ ÈùàóXWd!œ ©þ(Uoy¯zèDjK×vËquÍ;º¼QPúüîž7þÄÁg«qé¡ÛojS0àÔϹç˶`e*[}¬Ç +rÄDn_QN™ mçl‰ƒ±'YÃÔ(Øâ§p™‘íÃ’÷™|ûMWÚ Ð± Ó}.Â͞Π+ÙÄ€îN‹ì_8倫éÀÂ%"àxO&ƒJ`Õ¢¯Íµ$CmÝ`Oê¦Ðy„Ðcˆî8Þ"s 8â³v¯ÿä"­K§yÍ;+:·ä §bÖ¨\a$²!xhq—GPêÑ1C ƒX«ßŒüƒ8o8YhëÅP>SäÇ}Ž:¥p +Tf†ž}Ý˦e¸«’‰‹’\Á ÎºGù! A…ç2B?7ûÒ‹”˜`Ks€í§wѳÅmë•š³~OÒ8À8TÁ “bÃUyçlo˜ÄâE Ûg,ªÕl[5ô$¥@YÏöT‘)¬mâ&WTsvmì_SÁàóÝígÿv¯¥Ã7Æ["™·÷žu… +õflá'ÈáBÓˆÕÓØÂøSØ÷r µ’)F-…rJt +,à,êÞ.º k2@cU%Göœ{fᦋéH½‰:ã£x¼»yb­û:·- ×¢°­e«Ôb'¾ø²Í][$Å|šáþ4v1 ÇÏ¥ó~Dêu®òÒîë°B¹-§¡×Õà»s@ZníÛÁØşݾC «‚¯8† ²$|(öÌ'gË%C™±÷¥i@×Q0Ò_hHÅ~Y¤ˆWÛÜÖ/+ ¬Œ èŒoòÂ#³A¨{—A!‚&UËi¦´…2f{~Õ<+$µ'¨öÒÐßæEˆqœ²¦0–¢©¹û<ß™Ça‰;ÒÿÓòÓùŦv‡B-[‹¡Ÿ¢½¹–­Žc?šsO[Í}íYE½±€ +ö\ +ž6}:ÇK¬üh]f¦Ã9Û@†w¯ÃT"`.ÕY#Db経rœÖ¢ zlŸÔ„„€Óü‘^7uÎ(oÎÜI¥¡¯´ºx§Ý) +{w +ƒÐí’ÇËâ˜^Ìý$N.´8'R CâSŠK›ÃèébÅCU;ö¬äÖUa\#¢âo?"u¸Ñ0Œd]§ý”Š—MsN¦óȵ¾,Óç‚Lé»2½@°“éÅq™ö(’L©™'¡Kø† rÓ+2Yt-Kœ¬¥Ê-P^”nGDjn«ÃNÊH˜º¥x§Ún{›¯¸sŠõ!ý¦v*qÈD~Ù<‡±¢¬_¹), Tüu#=ÅÓE=]ªÆÌ.G§´,,Múèj!¶¤HZ[y}\=bc&£´%—ã\ç‚ÉÒwMæÁÎdŽ(Ž›L"»ahMráÒ¡\tÅd#ëO&é· Æ;ë´€uçÎýÔõßB¯k× #J +ôwÔÃ…ëí3IRɳkh…l&øÝw©³æÜ9VÙuØ“±R¹­MÙ¸Ÿª$Bs’­žÑÎöç¬"LÖM—Œ¢C9›üÂùÂñ ùé~òCÃöWÂÖ +g¸ÁØðíáœM_à?cÝ2ŸR0ˆ‡ùƒ0/Ô4+>q½ÈL)¨6öË–Ëâ÷ B\Ç+µã¶ua"åî$vï‘^¼€"¥k >ñyîPœt± N2øj¤SV¶"} À»mÏ´°è ËŸ•µíœ¡«Rš‘›CÝY. š”ô3IØU»j÷Üùƒf§Ð—¦5dÏz=èqG®ÁŠã^ÚÄ)ç]Û œ–&ø’gÕY`Ø¢ïIêTB.ÉÓkçËo zÛÞä°Â_>å=Ú?³ŸußáèHûs½ £á®XÇ*¦0ßüø˜s'a¬ |•Žyüefÿ¯ÿ­à| ØKt:îJ±R¾ +-/x½Žùµÿ«á„áÿt¼EÃendstream endobj -6192 0 obj << +6629 0 obj << /Type /Page -/Contents 6193 0 R -/Resources 6191 0 R +/Contents 6630 0 R +/Resources 6628 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6186 0 R -/Annots [ 6196 0 R 6197 0 R ] ->> endobj -6196 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [294.66 415.822 400.604 427.512] -/Subtype/Link/A<> ->> endobj -6197 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [366.309 334.527 485.694 346.217] -/Subtype/Link/A<> +/Parent 6615 0 R >> endobj -6194 0 obj << -/D [6192 0 R /XYZ 85.039 781.388 null] +6631 0 obj << +/D [6629 0 R /XYZ 85.039 781.388 null] >> endobj -2266 0 obj << -/D [6192 0 R /XYZ 85.039 448.833 null] +2354 0 obj << +/D [6629 0 R /XYZ 85.039 382.96 null] >> endobj -6195 0 obj << -/D [6192 0 R /XYZ 85.039 430.164 null] +6632 0 obj << +/D [6629 0 R /XYZ 85.039 345.429 null] >> endobj -2270 0 obj << -/D [6192 0 R /XYZ 85.039 279.611 null] +2358 0 obj << +/D [6629 0 R /XYZ 85.039 192.55 null] >> endobj -6198 0 obj << -/D [6192 0 R /XYZ 85.039 258.414 null] +6633 0 obj << +/D [6629 0 R /XYZ 85.039 157.14 null] >> endobj -6191 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R >> -/XObject << /Im1 3957 0 R >> +6628 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6201 0 obj << -/Length 3747 -/Filter /FlateDecode ->> -stream -xÚÍ[Ksã6¾ûW¨ö*1$ð‘Ô<™ÙÍdw’ÙXSÙª$Z¢%–%R!¥qœÃþöíRâÃS6S®2A<šFwãëäÏ<øóg±r=‘Ì¢ØwEÏVû+o¶–^ùºÇBwY´ú¼Z^}ýPÎ|ÏM¼d¶¼kè(W*1[®u¾ûþúýòÍÏó… ”;_DQ켟ÇÒ¹~ǵ¯®oÞÌ}ç5¾IxøÎÛùÂwn °ü™Š¯>,ß¼æÎ×ó v>,¿óãòíwØv¤–Ôí'ñãü÷åWo––sËp™ Û\ýú»7[øò\‘ij({®Íû+àÛURè÷ÝÕÍÕ,)n“3Õ'%%bWÅ¢+&_µÄäû+ü`)ÏUž$9íòz»Ï -œÝfùNyÇÏ”+ÝX¥»Ìó‘k÷i‘n²õWð{Î:¯U­·'øwÌP(kìè9§šÞ*¨ÿúÖX®`Y­™ÔšÒcz›bOÀ‡ïlSÍÍ*-4;»ºDÄ>Ê#!þoç‹ r2üš­ñMAS ¿XFæ© Hðå7OyÙæ›ùBúÊùwNÅü ¾8òÄpZ鯠GUnpJéž&ÄõÀ©ývzÀ^»|•ó²¨Aýd œå…dºWØÏv ºSdˆØÙâ±×Gü—qå!­ŽHu…Tù]Zíp•Dœ¢pJ^ÅqäAéúã\ÇôM Ë\Ôܼ*i^8˜õš+òã–É‘ýy9Hm ñ]¾ªÊº¼Ó_º^sÍnkfŠ&ö:¯˜p,+dZ†d¬3¡”Ó¼2nÂõº~}ëƒ9JF*‡ôªäº»´âj>+­ ž®×¿0ôQ€kúH36 ¤Ü³ÈŽ8Ô„ï5ýÓq«WÍ.-wÏ‚ùüæùáʽtÆ&Ã0rc_>í(„J\•„½Ž¿éyàwÉÐ ÈpI÷>§²0<-0ÅÒz“(~Ý—½Iä† p®¤†ìu™C-H° ¡›îlõ/pƒ$B³?`*‰/Ñ÷á_«L“hæF_¿Ý³×%°;;ã˜é.Z„ÙÿÅmÿ§B7‘Ñ, 7òbâx©u9ˆ„Såd½àJ®@s*ò?ùÅ4…ZÌk~‚Bp¡,´³Ä—’«bå "[볋¡`Q—Rüüºk7›ªDÎè|CpÅäk@Ú5W‹Ð”E95LkÈ¡ýß¹ü·4xÓ7tÞ¢iÄ -XÊ5IÐ]¹Ë¸lêÖÙŽæp4tù+}¬DÓAŽª²z$“æÍCâÄ+òüŠIÃÝbÉEv½†c¨¸£6ú¼Km¿8âf1פ5ÄþëìhE½·}õ¶ùjËÅ{fhꛂñíPü.æë¹vš²=ˬf÷IÞ·ÐÈ!xþb™X—ìWŒã€" ¼ÄrÐìœÔ¢uÁ2 ×_ÖÖ·"#¶ødÖ²àçût9>ÕÂç»(‰ º OÏw2ù” Á±„Ö–ïÌû°R"rEȶ 0/pA0ˆö”ò`¯h£5T=Ì…jÿv„‘sóX¬¶UYäi³ÄÊSžü½`{¿«P1ø—Ð~öiY€ÇQý’0´-b݉Š<š<Ÿh½Gu?Іƒ³«qÖ z ¨ð”b\ÖMŸaܨüÐ"öô=²ñØ 4›nŸ Ô„^ÙZ‹±ÆDèÆ2åRÁKe­¶«ªpÃ@­ÞOÏ1c¡±¥–Ù†Œù/ÆíÜd£„¶¸è¹ÆÁ#†:ÊŒÕîÈóíZø›ô3(uå"eyŠ‹ šè ŒÝ$éÅ@>ˆOz€n#¹j÷¸|6ë“W‚ä1Ã劸Y¶×G÷2È×Íðη;³uÄ”œôqî« ±ª ›ã°ŽphVq0k1ÐáÒôépyöKJýjÀá 5èÃË1æÂoóùl«0´ÆçŠâl>=˜ð2^ðÉ(ì“gG®Ó§ ªAèÁ©±Î˜–3"™$_–nüì§sÜûBŠñ ) žðû…˜ø®„ -!#W!ÉpQr·“Òª„´è=Ÿ9Clœ;áG ÎøŒ½]¹a%Ü—•v:±¡7lB2â€3=¡0óãàâ7ô¦Xü1îìâ·ØÛå÷&#tÖAò îóÀ³“00=G™³€s@Å=þk6¦‚;µ°c‘î³zPs¦Ä™æÄ/Öœ r½ä“5‡zǃšãÁFê‡ãšã'®>†Ã$Ö%Pò"7À ‡{½'iR‹†V_öܵ:ã -ãϪÕ$ç¹jØ jRã -v6-)r²µfž¿œ­­§µµ†³5E_€!© ÑGaû½Æœ Àú³H +LÐcu3õ·óEo‘ÝwNŒ. ÊådØ÷›Ã½KÉ% 6wOÁtü—MkÑ"ÖœôHUÙ/"ë¹ÎüÐîp<]ú)Vø3ö!A$ÁO$£>$Hè,ôáÙc׉„.lÒ¶Û˼ÓZ´ˆõX©—€Åœ3ö„­À½„GMë E€(8ãqÌ•´bW2º¬Æ•\®+g³Lø9›ìh2\lÇÞÀZk÷AÌé®8Òù†y©ÝÖ™lbO²ê,Nýªq'tW€b›”RY÷íóÙø<{T ôé¶^#õ™÷$RŸØ¼•¤žOdI÷2oØ-â@Ž›wˆ)îð)Œ`ºMZĆQB›±ôDWQ(=WÞQ3ÝçË®1¢1áY#j1Ù`ß(T}®R(›ƒxYZã²!ý36Ç]¥ˆ!’r5­'xŒ…yÑèiÀÄ‘´ÑÊôKr -ùîK~Å´)‰z«e^dœP •ùIïaÆå|1¾[ 0G/›¯¦µhë™/¦¢¶êNÈœ¹Ó¶4—Øþ…çÿÒÙ":ÃBÙØÐ'}3}@U›R¥£‡òTïõéU :r~zÅùõ#^ƒ|í*çëHö€‚³±^ؤǡ\S:6¹·®Ö>X¶sŸ^÷x}}1ƒ„†üóýÃ/¶`DãþÐN"¸¢ôøç}ŠîöRÿ“OiˆõùgßõÏØÒ:ÕE]ŠQ׬iZO° -O¨«ÅÜêjÉÔ5ºšvÃh±ÖDp2öøJŒ‰· Æ -ϸ±¹a)醓¿X¶gØm¯Ó+h‹èIws¿7œÓ·ñ*b¾Ã´¸>P•ö¶L‰×ƒtfÏÀÀwÆûtï¾;žDΟ³ÃÖçðü)µ³è²¾N5¤ž–ìÚ9£QÎ6“rŠ„âd{xIUÊùŸÏMŒ±›sÊ5WÛÙÕÜŽ “Îav‚'ɤù‹¾$ƒ¾M ½óŸ(°V´ $6±žM™,ö2ÄO)ì‚xµ’Í\VØí†Qs‹èãQ­žõóhή.¢L{¯/5ç iûÈïÿ¬‡5bŠÙM|~ õn×æŒÇ³À¾…dp'ô.4Ô¦p9c¼Y]0̵õ ˆ/““¤ -5·ðý(ÐíÔ£®¤E”öGöª9ÝøOœµ9,ÅÞ6Ï‘ðÖÖõŒ>?TÙké¸!n›Íñ&åÛ_)ëîª,0¼Ú›â»9ú¿W7§öĺ)=7”Ÿ¼SSïAÝ„ÝDŒ'|”±Ç9¨}¾‘eCªi‰=Ÿ/«˜#ŒYµlqÖ\!—J߬¢Ka|ŒywB…•t’IÏT?ÿ¦·º¿ñÀU©/záø?qý–¯wµ~+# nuõïÄ7—ø»þ FûîaÛTô/~¤j.÷ñý³©øçª'Ÿ‡µMÞ¬çÂû]©!`}Zé;vÔ÷Ž±%ß,ádÍÙO¶0h¬íg|ÄÆ0,µƒp—ŠÚ7$h½Pu÷÷f1 ¤ùÌÛøÏÆDÚL8-±27RïÈZ<¶Þù˜U…Q_l9¤¨ØF×¥gü*]ÀgaŒÝXð´€n]º×Û½©ý0ßäÙ<—MUo -©M¬{¤«úî!tbþË¿à›p¬û‰'4ÿ“>aU_ -€ãç*ÜÀOfÂsör"ˆû– NÉZ ÿØmßendstream +6636 0 obj << +/Length 2000 +/Filter /FlateDecode +>> +stream +xÚ¥XK“Û6¾Ï¯Py/T%¢H‚”(ßÆ^Ç™<Æ^ª|Hr€DjĘ"d²2ÿ~ûë!žCÊåÐèú ƃˆþŃ< #5Ló8Ty>Xnn¢Á#¼¿‰ÆÈ¡ŒŽpÞÌoÆ?e“A…³h6˜¯|²0ÍÔ`^ü¼ýùöãüݧáH)$“p8šNóàî~þîý0>ÝsÌïîß Âïòûùîþ¿†I|v€ûw„=ÿ ЇO¿z¬ùϲz¸ýýÍíð¯ù/7ïæ^g¯ é7ƒÂ_oþø+t¹_n¢PÍòÁžÖQÓñæ†4³T¹}}ópó?ÏJÎÒP]²O¦ò0ËÕ¹TvÁ@YfQÊÚìj[ GY’¦ÁÆ?ÅÇ$Ñ`”ªp¢&Œm×d‡r8Šƒ†nžÅÁb8J¦!8ouQB[v@é±ÃItk³££º8¦+å¬-í®mzÎà@~Jg³à#(¨;»*[áaû]»³vZmõ£­ˆƒqøkÓÙp nÂV]õÇ@ݵ–þ®IYwÉð_½(­®ê.¼âæÉ4# +ºïïû&¡Ó8œA€÷;ÉÄÚ¯*$}R2G–EÁ¸´ËqÓuÚã-,Ë5Ж¦Y]Ó.†Ùäû©u„ÃÚÅ"gOÂ4–Ôš¯+òmšgÁŸQœÂMX÷öMfmMí0ØEXh>·] ¨Ñ>œ nL½³¸qBÝ>––ÉŒSḺva"wa‚­EŽ>m R-u]? àëÎKak‚}6X+ˆfS÷Á¸´ç‘Ðm)x‰lÙû*ðF#z*Ó æUÊQV¦†03¤ßw¯%ËÔõ,ûäcïî}eÉÁ½w{]ҙýcú{6,Veû­Zöæ'k0­w­¶,ЪªËðüÒ^N2 #*B€m5)W¼&kL˜×f«íuunk[¶ Iúæ)ÛVp‹EbÁLM[ÈNï(tK¾úܺfÄìXN¯å‰Õ Ûsmiñƒ#)»Ê8§‹>ºÆfèKWlJKnÿÒõžó2N8·iI!Òv½ƒNèÎm[cÍ’J$Eä†)Úíòeî.X$Ó®Ýâ¥þúMIõUU²åbUþ85LªŸTDÖ‚e{rÔ•¹KÞ¦I¥òäÊ;Õ¨çóÁq‹;Ü ð¤…l“F:  œ±Ž A²þæ„k7µ7L'ZýtÂýe?¬ræ5ûºóÔv¼ñlÈT<Žê^V'¼N5œÈAÙ@€…ÓSêxo?Žï>~ON/›¶£È~˜ªÒ”ªH-}‰[é[ YŸ@x¯gÓW^ç?ij´ÙmÊ ”!ͲÚjÇ^ÂSù~©¿Tàó(d̳~”=yY5¥3\û4ÌÓwKÖ? Ruk=OÊdêlk±™4ö¶ãz@&a$ËNóõ º~<Àú·Š…Ëÿ#nÇyÀ—0íÐùmæ&GZ°CþÁeq|yZ%d™Vi!µ™ð)Q0ÄñÚÁÑ©%ßÏÝÊ÷^µº³í®§ã¹ª5=k:#¿\8Èiƒø~~A.ëÊEH'€}Å!’'G±I`½¨ÝŠ/CÇfACñP^y¢éîÔh` ±=°VòËÏ+úýÌ$…áv"ïKûÄwΫ*LÕÁþ2ôã›äQp{áÅ8'­çxÜA{Ôtk^Y[Á‚þÆÛN¼¥©˜ñ)؈•Ï”ó½é,=;J‡ïsã@ +Ä1§áBX‡n¼´¦}¨n +YH½ ¯pÇW²ÞjÐh‰ Ëb‚úæPÝqžª“4æ”ñM2Ì…è;ÄV¼’‰ðv)®9!¯R¥ÜNÇÒŸä¥zCò„ady1ÂSÔ¶nQ⬳P~WÒÆ•ÜJ^“«Ü¯”(¬üÝ ÍV¾GˆdöoíN,¿ÀRø@ ½fOl€Š•&U,N!_±Ò_¤6³K-„­I‚$kL¥ ò¥=%«Q + %îGôg%íÀ¸6>`Ý 6I™q†‹…½_©rÒ_ +Öìª$bWÕØ~–À;FÚÚ1tÿꮨDî¾þÙÏŽéi“%Èé­A!Q®Ž²ƒýW8Æ,/çë|D‘ÒYëÚ7…ÉìÒ7ú/>ÿW_éü—ès5»\¼²„&‘¸×†WÓøTßþkÞ™ÂÿÎH-endstream endobj -6200 0 obj << +6635 0 obj << /Type /Page -/Contents 6201 0 R -/Resources 6199 0 R +/Contents 6636 0 R +/Resources 6634 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6186 0 R +/Parent 6615 0 R >> endobj -6202 0 obj << -/D [6200 0 R /XYZ 85.039 781.388 null] ->> endobj -2274 0 obj << -/D [6200 0 R /XYZ 85.039 546.666 null] ->> endobj -6203 0 obj << -/D [6200 0 R /XYZ 85.039 527.998 null] +6637 0 obj << +/D [6635 0 R /XYZ 85.039 781.388 null] >> endobj -6204 0 obj << -/D [6200 0 R /XYZ 85.039 377.964 null] +2362 0 obj << +/D [6635 0 R /XYZ 85.039 678.053 null] >> endobj -6205 0 obj << -/D [6200 0 R /XYZ 256.582 383.938 null] +6638 0 obj << +/D [6635 0 R /XYZ 85.039 640.522 null] >> endobj -6199 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F56 2890 0 R /F35 2880 0 R >> -/XObject << /Im2 4150 0 R >> +6634 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6208 0 obj << -/Length 2299 -/Filter /FlateDecode ->> -stream -xÚµYëoÛ¶ÿž¿Â@qqm bDRÏûvéÖ¡ÙímÜOÛ(²bëF–<=êä¿¿çAʲ#»é²¢hM‘‡‡çý;dåÄ…?rùÂÕñ$Œ¤ÐQ4I×gîd +?ŸICág@óf~vþ.ð&Ò±Oæw;>¾ð|=™/~Ÿ¾ýåâãüòÓÌÑZO•/fNFӳț^\ñ웋ëË™œþ„_üÈéû™#§×0˜¢á›ÏóËŸ˜øb¦¢éçù/—¿Í߿ŵ d5'²ÿÀŽßfÎ=»œ÷’÷2”1Šý×Ùﺓ¨øë™+tM¶0v…„åõÈ-|O›ïâìúì¿=+^ó&¼kÌJ¾Ž„é§f’þÀLRi¡”œ„¾+|×#;ÍWI âß7l…eÅ궷°¶Êx|ãª(*´Ä6/—L¹™9*œfh‡j 84‡”Jh©&¡DìûcZ()"Ápd ëÛ%œ¨—fåÓÀ RÇ`Ì°;eÄ †Ê¡.ÊÈ^g[Ð&p§W¨j½Ó¨¡d <éRñ4§¥8ä„R¼F[‚¡«~Ž¥9-Ž‚‰c¹'•cOƒ¸RÙ*ìA¨õy–Ò¿è¥6ÿ2Ô³™…ƒ|‘%y^àqÎ"csBÔud]Q§Äœ=ŸWì_¦]räïâß1‹C°êe‚8ÞÕ™©Æiµ¶Ò cGË+É-çM×Úšž™ôr|ú¿Œ$B~ÿ6Á×´IÛ™1)˜ÍÖ‹ Ò†gÖY!í½µ&…qÉd9ÃNýÃ?\_Ú<¦ ê&hÅx|ÓØàYw׳˜£(‚Æs8Î’õ¦Èþ"8 £zÀ°Jö7 ™ Âzj ™™Ž5ˆÃàÅGÈ2t9€`.Æ.Ó: -©[²’¾ 㘗3`6‚q±+¢=ËŒ"\l~×äH£Ô¥Z[<‹„E{¹Ný ¹=eX."~0­xhHr{Ü7-v¤w¨Çïr îp¿þÉ5oB™hú¹¤ÒmqiºTØD>ÏÚ•cºhð½/6O¹¹9$E@ÀÁ­}¾Ånð^p¤,û®³©‘ܶö° ²ï|aÿ·[ÊìKå† _ß §­E-\iwÌ®¹YB—%¼®Î~`†k<Š™H¼îß lvÓÅáùœr«v -¹mê™yGµ†Ë¼|Í4ˆE3ê>xGÿHÞôIôš÷šç©ÍàÀϵÁû$/vÔЦüMüí‘u€×}ÅÁêç‚0¡ÃWA¸?º‡ žÈÍoš&Žß¿ÛcÑ7°Ö¥i–-ñí’ÀøÝÆjƒ–Àg•VΆoèúz…^ü¤WxbŒïØ+<ÔߩW1÷ÚºB‚-üåC^ôu=d{ZDúdûJ %­,¨”Vñ¡¼ö?ôžü`_endstream +6641 0 obj << +/Length 3831 +/Filter /FlateDecode +>> +stream +xÚÕ[ÝoÛ8Ï_aäI>l‰Ôçáp@ÚæÚìmÒ^㢻û ØJ¢[YJ%¹Ùü÷7_¤d[v·­ôP Éáp8üq8CNü‰ÿüIºžN'qâ»:I&óå‘7¹ƒ–×G¾PœÉÉ€æÅìèô_a4ñ=7õÒÉì¶çºA¨'³Å¯ÎË7gïfçï§'ZkGEîô$Žçâjvþzê;ïϦ‰vfW¯™àòš?^\½z;U‰óQ*®Îzö«Þ¾ÿ·¥š½á¯ë³ËgÓßg?ϬÌV/E?ýú»7YÀä~>ò\&“Gøö\š—G ±ZÊåÑõÑ,+n &ÜkL?†âÄOÝT…ûuùni«C­«ƒh¨ÃÐsC/ ‚ÚP\¤ÎÕôÄw²%(#‡™G±Óäm]®º¢®°9YËõ«6_pÍ#v) G‡÷øU1 i~?RÝ¢žjÏy”þUÞMµ¡Žš?ˆên—–ƒØý`ÿ¼{š·Ž`ÇWnä1vP¾Àù`à¢ZÀÿõTÅ$bà'0 ÒN `ñˆÿÕ %Vß1EÑ2ƒ‡&_ó¬C•`9»™ž õŠµ‚¤Ý=s#ÆÙR¾òlŽ#Þs·%)ŽÝUO_ˆ@wÅglË+X¬(œ)…o7C èÔsânBšî•!.P:Ÿ§!¬hS -r+Ÿ¸å7/ô²jÁ’eŽÍue óÑå +Õ•OÐÇç°»Ïùãx^Óä ×ªË®EfÕçÇ?¡Ü¾s<¦¢¥©!Ü»:ƒ¹)MûS_Ï[ëë;7Eâ&ëcè4~\| d—/°‹ÐL‡ëài笄º’i;ji ‚f"œy’Y%4‚d×ò†“Êso†¤ýæº7}sþ qþ4 “?ÐÝžw}‹ú‚9À†»),n¸\óHpêA1{” .à‚„Je[s·Îü¢ü¹00ÆV†Î4™ÕºC=Õ«nFuo2YÔˬÁ‘¡;2Å£Léjq65VÀõ‡cnÊP !“¡`Y¥±!¶šçŒÖù‰›ÿk÷L'ôüÓˇRbà×ú:bÅ}Á Ñ $`¼¥1 +h•ò‘ Óv÷@ž–ÆÝ9­S6Q„€Ê’á~e¡þ?.Þ^sý`õ Cœ2~äfóŽ–èüˆ+YÞ Õ‘Íyë7Ò‘–HK£*‚pw/¢XC%ìýÕ€ìL³F”õ£–1 Öä4á¼a;ˆ3aÿ]MY/Êó É\ËØLe­jYM¤Ëø§®úªdüÔI‰íc¹’"3ë¸ÀgïÄF—Ëè<8ˆhš¤·Õ _ØÜÖ´YG›´b™oyO¤´u¶p•wƒ%õ£ÁÐË +»ÈœSM~W´ ,&Ãlö“ô,DÎGH’ucw÷‡ 02½µj»`p€L¿6‘™ŸX3ƒû퉎éý²;<Ꭶ×ÔÒÄñ eÓ: s§©Q…gÁ4°ä©ódzæÜa^r®¶ÖªðÂQÉÚ!»¸l½‚η¸‚eIã=Õóf{ÂBÆÀa(ÅùÙ X?Ø §{4€Ì†ÓïW™¶* íßw¸U!¸Š‘ö·½×8Å{ÕÞ«Þò^q­ÀVcΙ¯c7cpÎÜ0Ž†›¿ÖSJ»žMNÂP¹ÞÀÔÀŸ3T†ˆV` +žBvSý$ø8÷ o0—7Ja<춥•@¯PMlK)4[R®³É ‡ûPáFú´Ê×VÿÅز·›’e÷5“lKB­|×S;hGí£Åx*˜hÏ ”þ¾H¦ß·»ØP'Øð—P¯s±.}¨ð#Wn +aT„*u}vèÏp7¼|squ~uvyÎ뮓a»*Ö²îÿFâI(íž7ÂA¾˜âŸ[Èð" P&+÷·+Á0Û¯¥S7N‚®ÍÙHô +åÂzŠl£ÄÇÏ=™ª’ð‹zP´‡ñò¶B×Ð+ !?Èl/r5Do'6þn†¡)‰÷ƒÐi£? õ·Ã°—ü0ܧ.¬ÞP¯ó*oð´"(­{µlúúàpˆ1'º½!„& +*wÁî³{ØÊøiìîºÎ0°ó|WyásÀN}»õë?êöiAù‰›Â7TÃ/Yu9åÕ¿¡14ijÄC(` ˜éÌD•ÚÌÈÃh ؘ–ÄÜ«âÏë÷Tøðn]qè¦_§3†Oß ôE|öò û´¡ÒÜTµ¦ŽWr©Áf±í 4_˜@C®!%ðØ…±CLâÐÖO¹i8`¨Üüï‡ó%9HÀ2êØû‘rU 8` ÿZÀÀÚ&¨Í°¯Â‹P¢Ý‹úê€E!Äà“Ûá€ÐlI¹6Î&':Çí5Úrû¹›è°øcBl«L¬Äÿslø©¥»ÝÂØO& ³Gêù¬à·8‡pX&;äÿ+(ÌökCy‰ qÊš:Ö¼Ã+ xåîoŒúg†&ï/lsa“•r‡Â˜\b?¾ÐÝ$2ÃÛgzÍ#㣠]˜Ê¼C …e+܇ÐP€qœü縺13A°r=——º‰|=‚ƒ¿zŽÏǬ=ýE÷òÁû´g7P­icxŒ¿¬ù¶°©éÀ^ +O×®z¤¾«·Ôv'1Ï5þXøn⩽‘ŽNCX€èýÉÅ×û“üÀá^mÐÁ ŸCuüR“ų÷ÉäSÊS +ù•|õý(¡ÏN˜d?°¹Ó1ìá0Økîtž¡Ÿ>£¹Ë¿ÙÜ ä?ÌöiC:­©ã‚M\Þ žÏ!Ú¹÷ìÖåà©d:â*ZÄbF‡FÆ0þóÅ0=!Òð}½7]EëÔÕš·ùEÇJnÍkj½*­Kdߧª;v•ûG)p7lÁÆËV!¿ H0xÚCB©ì3IpÌ>+B¸döéíÄÞ¾ôœˆâ†®‰ãÅBp;³ûõÇßá³·Òüج”¼Îš'x¬19**…“Œ ÓÓ0üÎ^¾;½xÇ”…MdéøUŸžÉ¸i/Ö¾cߌz¥k²=åC›@™'n%×LO½÷ºäêl±,ªÞ©å:zÅA N$Ùz÷^ä°ë–|mÊù8ð˜ôšÐ9Í;šú)¡‚Y·ÜD9,@»ÕçÕÕ5×,²VÂMJë#¾6V³{š¼OóÁÝΧOÁùOÔ»à4‡`à„¥ ¤7²´Ù_eåy¿{\}krbϹ]5”IA ŠRXÍ™gh¢˜Œhž—YSüæù¹ñËp%£-ÝÚNPÅÀ”Ñh;aFPœˆö 5~z_·¤f(#ûRÚlVI”öXÝPcc›yÝ,¤7§ž$-Õ8?qì­=/)eˆRà{ýÑ&ƒ™}#Ž uQÑ#u³Ì$µRÔ2îRX|¤m²°Þö$ –EŸè¡8Ù›O%çT/ŽrÈ€•¤f6å k€³y»™B5ò̵”VÂÈx›;7¤”LÒqa™I¨ˆ»¨X°GX¾à4’4qÎ*æÇ™UÙò¡ì%0cu÷d…Bɹ •ì¬¹çì(±²Í½¦ˆ*“_Ðñö‚o*\%Þ ':”Δ±‘’®æ¦Ò8‚h½±!ãz“EE46øÀÒZ>MƒöWEtÐ`#‚šä1Ø\C,X­Ó8yìEÇ´µø»¾¹¹èsÄ + „"âå›Ç5ƒ§·JƒÜ°–+yãâi©?O¹rxž£…¦.’c‡ßl(Øí CUñV•]5ûÞàëâû=.3ÂRû˜¡„â–‚ÞtpOô óJsã +`Sau“ qkìUjhhÛà!5È9åš >¤N¸hà î>ªÐ˜EtB¡Ê&ï蜪èTÄ2áÀjÇ KD¡+e—± è ƒÜPX6"<­–t”R*³É,$›5Üq4¹¤Ã±i;#:Ù¾¢¿ç·Íœé þgN™pâñ™‹âÍmj3¡z'Ю&½Ìõ‰VdXvxœfèÞ3Á®,Ï@ñÆ 63<ƒÑÄÎ@õ ¯:ðŽ5ÐÏk:5W­µPÙöÙÑBÖk§•Ù–‰Ý–L–󀼜6%-ÀÒ;dZÜžŒ¹Áó¬šçìP2RÍî,¥ [Ñ Õ8q’7ØöÚî‡9a´èŒ¹L1Q­·1l6æÝJ7´ÏY Øc€º6-Ò¦Òcóx²6f‚K=3¡“;2áã>]x-{w4““i3ÉÉíç«À‡*l’%ÎùÉäè"Ѫ*žœoüdE¨À2xq=ïÜÏyfÕrè ƒbKÃZ…§RÞŒ-tWŸˆ3‘K–ä"·¹÷wüG +£rNÆÆŸpÇ…¤ksš:~o¦tJJx$)ÀdÚÞäýßÈýæZú&ë¹»/"×Ìí`*¾†áªÅ¶y¹Ã—8òÐqÓŠÇ]Ñ&“´t¬4lù/OÄÍ“”Oü%¶´i×6ëúR@¿”'Œ´äÝiÌ馘߸âAR¬Ò]óÇ ‡Š·d28þÁÀ›³÷ç\Ât„·¯Î×[q3vvÑ} ,¥EVIâ,k{Æ™¿(¾ƒðU%)`¸"ÜihT‰…¬¶Qn r`—.a¯ÅÞ"R ”k.ÏáĹc\`›ÅÖE‡hÂbJ–ö9·þ‰¿ë‡©û;?·L-VVµô’€y‹PZyÂiåJ<}e6,¯@Ûï%€RlŽü‘€ž†Í—øÚD8PF½,±‘Eþ€ŠÄ Æ78ŸÂ£& üŸìÁ‹ÞFkò„?­ˆÖÌýò®?eÒÜšL…ÊÞøñ õ4P> endobj -6210 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 733.837 217.411 745.527] -/Subtype/Link/A<> +/Parent 6615 0 R >> endobj -6211 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 706.739 221.713 718.428] -/Subtype/Link/A<> +6642 0 obj << +/D [6640 0 R /XYZ 85.039 781.388 null] >> endobj -6212 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 679.641 210.209 691.33] -/Subtype/Link/A<> +2366 0 obj << +/D [6640 0 R /XYZ 85.039 761.463 null] >> endobj -6209 0 obj << -/D [6207 0 R /XYZ 85.039 781.388 null] +6643 0 obj << +/D [6640 0 R /XYZ 85.039 736.911 null] >> endobj -2278 0 obj << -/D [6207 0 R /XYZ 85.039 597.626 null] +6644 0 obj << +/D [6640 0 R /XYZ 85.039 559.639 null] >> endobj -6213 0 obj << -/D [6207 0 R /XYZ 85.039 577.031 null] +6645 0 obj << +/D [6640 0 R /XYZ 286.152 565.612 null] >> endobj -2282 0 obj << -/D [6207 0 R /XYZ 85.039 357.66 null] +6646 0 obj << +/D [6640 0 R /XYZ 85.039 454.3 null] >> endobj -6214 0 obj << -/D [6207 0 R /XYZ 85.039 334.945 null] +6647 0 obj << +/D [6640 0 R /XYZ 310.417 460.274 null] >> endobj -6206 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +6639 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F38 2997 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6217 0 obj << -/Length 1634 +6650 0 obj << +/Length 2805 /Filter /FlateDecode >> stream -xÚ­XYoÛ8~÷¯0P,*+F¼t,Ð7M·ÚÍ6îS·dIŽ…èp%9nþýÎ’,Û’ãñÎÅá÷‘¦SþèÔ“ÄæþÔõ(áž7 ³‰=½ƒ™¿'´‘°«'ór>¹xíˆ)µ‰oûÓùr§G!ùt}1.ßÌ®çWŸL‹sn0ILËu=ãÚô„1û G_În®Lj¼Âž€5Þš5n 1ÿ¤š/?ϯ^iá™É<ãóüÍÕÇùÛKœ›¡ª¹ûV|4¿ÎßM®æçOà¥n›|ùjO#ñÝÄ&Ü÷¦[hÛ„Ât6¿‰¼é§“›É¿*='¦zÕP–Z ‹úÄgòt&J„ûL2»—IJá”M]ii •JÈ#¢$Ò(…o|êM‰‘ÇÇ´rÛ*©¶Ø,LN %iË"ÿϦâN¯ -êD‹|,eƒ­æ§ƒØɨ ¨ -‚ùz‚˜™c̨”ýl öÓ‡ø®&p>l²óSM-‹R7ýyž©,¨$Pãy£?3™k,`tTÊØ6Ò3¨*¯ê MA-è¤$SØ®±.qêÁ”Óª»h¡£ÒS"ȤÁ¢¸Ù:¬æ„ÆNÓGÝ[ƒI×(Öj0¨ãèOwASi-VsŒm‰!WIÔ.µºTëfëo\–…šåF²ÔCõJ/C5Ñ£ê.À#°¨Æ1öçòø{R5MP~_T¨P”kUŽ«ð0BæC´¶ÒÝÖ <ÆŸQ{ò]Otž`¸E©¤ƒ‘‹×¼_/`’ÛÄö\eòÙ׳%ö€;Ï þ™Tz· ÏR%÷e#w¼6ØÔè¯ãJ£Œ¿m’*©±©mƒ¾ì6/Òâ.ÉIUœ±¶Œ±ªåJv»É“ï#ë°Øäuc懖¶1BþäˆËa„÷i²@*/e\—/øq>ÎPÖz¢U« *¶ºER76U|‹‰¨‹{=Æn—IYÕ·j£Ï‹a?þ*[ PgøÈœ´QÅU•(Œx:Å`'%¾ãž»žÌ8bKÛ#‚zˆ-Ä~+ä]@Ù†nUÞˆ1ˆÞ-xC -¸]`D8¯µ‚ú»R—¿TÀˆP‰s€ëzn$FÛ!ÌwNǸ“tá¹Äc¼tÇ6ª C:@‡!t®]úF¨BEPØÃuµa0]¯‚Z·P¬T²l+­ 6ð0(Î"lÞ9ó$µsÂÜab·Z]VOÙqøxÌq½ðùA; õéV]ÜÅõ -÷{ÛIx®ô·„Ôê:’ðâr±Ò=’éB*„†Ô¸‚ÆöÎÚ|…|‡È®·Uñ[¤G-Q @P` ó›TÏ«Ê…o ?7 …EÓ½~uÙrIÐLk*HU~‹½åªèâ†ò”á²1³ìÉ ã}Ç«­˜:v0SÆAšý$É>ÝG¡µŽÂA¶:—…<þ0 ¬½/aóžZX¬ñðiù18KjXu”ÍZMãŒPçþ9l6¬íŒ˜òMšö)åwñØaä?i`”Ä2;ðÌõˆkŸøžLGb‚páôŠ¸.oI¬}o\YÖÜÄ‘|®à&ªHªó§QsÒŸÌ8á0ø̨òg÷vžÆ¼cg=àk ?ê†]>j äžGîÓV ¯â8¥‘ - JÁŒºx'Íý%ë¢g²Çdˆ–-#Ãô]šàëAß‹õEžo¼i.ö´Õ¸5wî¦ú‚•¢Üªµ¶` H–ñVCWh§$C”-‹Lwúwq|I#[Ø ’4Áît?…Û?ÛD®/ÞEµ“éŠ -îJˆ»M¤>'Žô{EE Š•%ù‹ÁÓ²]vúB“a«Ëê)pÔ„1oÏÑm’/’¼¹…­»÷t±HME<Ã9£>%ù“9ëÉŒ>u9±ýþ«÷j`Qv•y°×Ë"M»ËÓn‹ÅþO.ÍóÚl®ŒøT+ò¿ž$AÍ“[hÂÞÀõE‡›2©/îb'®ëÇSD¤^›å2 “édXU³¿®hïesðžè“Ã)+OÆ]yížOqù„ñ‹ê±ªãÌRjŽÙôlå§/-)ÿv7ÆÀþ¦ œ¨*æø×6é§ºî” N<î2Éa´õcäÜ>ôWrH€Ž#‡ÿ-^±endstream +xÚ¥YÝsÛ6÷_áI^¨™Š! R"û»n¢ž¿.RÏwÓö¦h‰gŠTI(ŽÿûÛ/”D9™¹ÉÄ‹Åbw±ûåŸ{ðÏ?#×SÉù4ö]ÇçéæÌ;_Á̧3_8ÆÂ2îñ\,Î>üMÎ}ÏM¼ä|ñÔɉÜ0Rç‹åÎåç÷‹«/£±RÊ &îh<ÆÎìvqõiä;_>Žbå,f·Ÿ˜áfÎíÃìö—»Q;B¸½îÅ’î¾ü£åZ|æÞüãÍÅÇÑ_‹ßή­Î­6 _‚ +ÿ}öÇ_Þù÷Û™çª$>¾çú0½9Ý(T2.ÎægÿlEñ\xΫ†ì©Øbul ?0P乑’èÈQä<äpÂr ªQ0u^$OœÙhì;Ïþ‚ªú9GòŠ9rá4ëQ8;m¡¦…ËN‚têMÞŠ]òî¦âv×d¼~ƒ“:ÅýÖ–›ôÑ›L¶xªj^¤‹‚;H©.˜CãBÙ¡ÎHde2ômì£M2ÂwšÂNhØ)ô•CûøN£WBØê¦ÉË„Ð$†`X³R4S£ÙŒì^H ø,´?ŽPtÃì)­BÑqøÎ<«¿ây³šWÜ*paχº>3ÓŸ^äÍAÒÍô|¦éR$š58çø´ä±©çä›mÁVÉJÜØdKžØ±®¾Óúˆfqç–½y1»ÃЙ$püÊPÜ°rhå‚YQ;˜¹=Ž ž¿Ð¼MÊÃY‰a³3<ºC5Ì–þ2eþÚV Žˆ¢„› $¡:½³FtÔBLá9 Ü”ý…ÇMõ¶Ù¡´i]àaô‚ƒyÁõõ%wð ×Õ +ýgG¼×yù̽K:2›þ*¬/<¾¡á9cnò’¼¬sŽt&§l•ŒGdwìÔhˆgŽ{‹Ê ØåÐÂÕ(ÈË^çß!ûa†û}Ælxf°«8l*ƒ5}‡®ùf²rÙ¿ÎÀö;‡~Í£™DWý¤ÓL<ª}Ï#y ;ºh*Þ¡õê]9pâ +¥óͱ›ÆâïÿÍü: z8Í L¨…ê”›¤‰Ç‚."TaË+÷Þzq$ OÁ\þSo¢ÈŽå$ÌU*p§Q¸‡sƒCœ{}ÔÏ„Ïæô¸‹µ³ <¡¢SÇŽç$Ô ’ØøâU +‹ àÍ3î3MuWqGÐß(8MùÆÖAzUТ’Û É`àB€ÌÛÏ…®Ç¼÷ØžçíKºü™ú½3Iàª$°að´p¸?qám+,³[ØóXJ@NøãræÿÁÈ_\ݨ`@Z4q#?ú¾4¿¿|™ýëêË|H’÷ã:]-.骎#OÛ'¨ì˜Ê3MîÀ+„]¶ƒ>aQ`üxˆEÁ_­”þ‚#”ØG4öøÉȇe#HiÉ“ˆEt^#¶C_.Яo>ß‘ç< Ydv•z<š7m¬ÒJ„8¡ò»ö9­ñðËš ÒY}ÔwË…j~›Ù0¹oó”¯ ’äšTÏí„<· nÕw.È•;Qü }y#ˆœËjûZ竵á!~dKùƒý$‰¹w“§uÕTOÆ.«·C‰üýqå”8`϶š›Fã7î“ŸÐI8xÊ-y× ƒ±÷øÊ-«½ )ˆôË"ÏÊÞ©èÙºÿi¹Õ™˜ª¯ø*&Ué3Hg…ÆèôYtªêv£eõÒ€y¾c„ýM:+t§ƒ„·§98ÙFo!4VBÆ"‡-ÆoIÁ”ÙU·˜Yæf»Ãg3ýÌrRžaºãÒ¸A>L:W:]3¬Y‹õ›uµ+¬GDÝçl+ÖF`A*J –Ê¿æË>vp\À­vß2Q6xÔÓ[o ÚÉË3>A:0Ö(ÅnSZG4z +«SœV5¨±8J@­ìh¿§5å¹=µúKOÛbè´M¶ÐiU×rÈ"ÓMë»d«SéÚø5úñPãwï߉nkFµõiÅl¯²2«9+í_Tˬğêöª6ûq­[³lö®m“.†ç„À×7âú1çò/'ÐŽçÉÖÿ,íÿú·ELpc• ¦(ÜÀ·º öjªõµ¿)ü?¸qÁ1endstream endobj -6216 0 obj << +6649 0 obj << /Type /Page -/Contents 6217 0 R -/Resources 6215 0 R +/Contents 6650 0 R +/Resources 6648 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6186 0 R ->> endobj -6218 0 obj << -/D [6216 0 R /XYZ 85.039 781.388 null] ->> endobj -2286 0 obj << -/D [6216 0 R /XYZ 85.039 761.463 null] ->> endobj -6219 0 obj << -/D [6216 0 R /XYZ 85.039 741.337 null] ->> endobj -2290 0 obj << -/D [6216 0 R /XYZ 85.039 521.967 null] +/Parent 6654 0 R >> endobj -6220 0 obj << -/D [6216 0 R /XYZ 85.039 499.251 null] +6651 0 obj << +/D [6649 0 R /XYZ 85.039 781.388 null] >> endobj -2294 0 obj << -/D [6216 0 R /XYZ 85.039 278.706 null] +2370 0 obj << +/D [6649 0 R /XYZ 85.039 597.02 null] >> endobj -6221 0 obj << -/D [6216 0 R /XYZ 85.039 249.97 null] +6652 0 obj << +/D [6649 0 R /XYZ 85.039 565.205 null] >> endobj -2298 0 obj << -/D [6216 0 R /XYZ 85.039 205.486 null] +2374 0 obj << +/D [6649 0 R /XYZ 85.039 358.13 null] >> endobj -6222 0 obj << -/D [6216 0 R /XYZ 85.039 184.289 null] +6653 0 obj << +/D [6649 0 R /XYZ 85.039 325.708 null] >> endobj -6215 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +6648 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R /F41 2994 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6225 0 obj << -/Length 1180 +6657 0 obj << +/Length 1642 /Filter /FlateDecode >> stream -xÚ¥VßoÛ8 ~Ï_aôe6nV,ɲ¥î!ÝÚ[l·­î¡W\Çi:vf; òß)Êù±dCQ„’HŠüø‘2÷"øãžV,’ÆK5gRk¯XN"ïNþœp§:•ð@ç2›L¯“Øã3‘ñ²ÅÞb±’^6¿óß¼›}Ê®¾¡”ÒŠašjÿS cöv/g·W÷ßâ*†îß!÷oAȾXñòkvõ–”gÐþ×ìÝÕÇìæ žÍÐUfÕþ‹Á}ö~r•í"ßÅQ ûÛäî>òæâûIĤÑÞäˆq8^N n¦béÖõävòyçŠÎb¬Î¡¤¤fJËS˜¤:€‰sÁ$^ª"¦¢Øâ´Êû~Óvó TBù]ùm]u¥[Mëêaڗź«†ít•/ÿ퇼xf}Kç}Ù½TEùG¿í‡ræëá Q˜^ó£[I -eÄ"ÚKÿ~ÄJ„® Â8Ò|Ì#¿]¡HýÒî?§Ÿ¦ÜÐqÑ6}[—´»Aó -üÀ¥v㮺Ö÷wy=܃pwÍï_Ãn8w!ظ•7XÛvÐCûH÷¡wʦ¯Y¢ò–ä5 €{á˜$ÇJ›äÅÊFW•@¾8VþÍ«´-‰PCW!Î(’s”Ö`ÑcLà×n\ØUQ•MaÃG…ßVÕPù\^^÷-³¡F¢l ³¦ß¸‹¹ßýZû.*BHb×>Ô£ß%n ü€\ʸQW{Šw·¨ÑbpmTMQï’©ÚwØ\E@ºå÷í11&^b$pTÿ¼a$éùv G_á3Û G¼”F0µ•*äw $Žc"®/˜¶e жcrÈ| ÒÚr‘Š,6LËôˆÙS$“àþŸˆÇÈc‰¨-Ðnä&žÍ-!óª¡KP-§KÏagiõ) 8Xƒ_Ig–ð¹S\ŽÄűÚuUäƒ b3²a4ÙôUçtr¼»+óù–®·6¾GÊ8:N5ÐÒï°KR€­µ,Zº…¦hé¬]$ OØש°D<¥‡P†™XxI’0!~‰£«pïë”"<ï;â\WMÙSÈ‹¶£=;IBhæN¶¼)ÚõnÎXwJsÉW‹ 0z7]&Ž ¶-ÝvÏ0\”6þ ’A[±>ZØB·0ÿ¤‰ýÙ êϤU¶súøu€WR›@B÷Ór(pä³ùô'ãæ:O„3³iáÌrG:ˆ¥E8ê-“M劉=mÆ Ó‘ZI%,Rú(ùE‡É-Ñ"¡GEYˆ[ZN¥Ó|á6ŠŸ¦[·àæ4Qð€Ò·ÏyÎsl{M—ÿóšƒÀqýa³?ð0h†›†Û\ñ/· Oõè¨.ƒ>—óÆû›à¢é¹ÎÐ6çËbžÀé~s}m_}=ÎÇOgß÷ÛÝ ç¬ÓïÚ“é||{浟Fg¿=ŸLoe‡û™ü}žL¯κƒö³z1óÞógñêáé/ÓkþI¶f£ûËÑÙ÷ùçÆxn04ßPþÙøúÝmF|qŸ®ãÍo»ŽÇ?o±ô|õŒ³Æßf*ù­×”£Nù'ðN0ðä'¸Nàör½°ùO˜ªw ´çkÄdk‰0”-ý&¤›¤h¡ßïPº–­{&”Ñe*ïFSõ°‚‰|è:/ÊÆÕãûÉ£lãÍš²”U0”}@"Ù Ë%LÔËt­Ð,)Æt‡ÈJ>—†(a'êà{Û~÷ø4®û|ýpÿácD7‘?ëúM¦Ww_®ÇÍG± 6°vÈåøv2ýwtÇÉ;Íǧp«žãéõé~Ö”ß<¿ç¾"Q|s—PÒ‰DRã©p ¦:L,‹cš¤¼¯wrâÊHÝ”È^E‚¤‰j"b “É|4ÀT¨["4-ÝcÕ d V£2³ÀH©ü]¨Oq1Œ4JÝÁ ¡ÓæÂ5tdûRÍÁ%Èpz^B†³ <Æ|RšZöÕ ‹,-FË a%XÙKµhÏ!¢ÐF›@Fq–ò4Pþ3ç7ãzäϱk•òD-+;z€1"Âb|%z‹Ò”âp C´DÚc 5JÃql­\PÂT=¬éî ` Ý1í}£L˜®´«ùÇ- +5p ¶°œ‡:É%”lø™†GKìxÅ…”Ú 0Žlω8Vq¥eÑ'¯;ufº©™A%ÑsI- 71"Є–ÃTðìÙÉ„8]Ólµ.¯  ™H´ê@*«ŒÇ]f·†¤^Êжî`ô‹i5Ë9º7yÕªªGŠ·¤I-|O7W²1…éåäaVþôr^©årá¼nïŒÒè1X6¬¬:¨iå$ÈŪ  <…–VŒ`>bìœ6¦]¿‚&E”?_¦W0Š)Ækª”´¬Ú+¡H +€Ñz½S±ê–]KsSþW¨u ™P˜8Õv'VþîžGÿÌjs1NèE°dgâØ,“Æ +¥–ž¼¼D0½­zƒîÉhÃÈÌl'¶fó‘Ö–m2­X³)]¨F„.Ïh ëüFÌŠPQï +î® Ã[q¶À(lUlIà ØÄ:º ®3;ê­âð |<;pFzíïÖ4ÃxÆÃÀaÏNfa£I¤G›P†q†j—†kÎ8fBñªØ…Íß‚ÈÖæÓŒgY(h¸ä ÷GÑý÷eþfD`¯$6¨ +¾h²=KáF´Â,IøCÊÓbÓü³ª©¢Ù"é(ž«mp=â ö‘¢ḙtvNŠš³Ç7¸âÑKô²gˆ3eo•Á2½N<þ%ÍHáò¤LîàõƒšNyj°4Ø:!èØì8•ØjjãΛ:T­)ßOä[•Ó¸JhkLé +Šõ)Ÿô±€q8¦”v|ˆ³¨F…ìíÙǹ}«œ o¨Ñ¥ä½AD”–s½‹¨<9é²ÞkGÀÍF犒2³9­9ü&š-Œçƒ Œ1nV[ªøÅ>E[û™Q.Áös3hÍ-ÍV›¤Å)’¨ù,ËíL©­¡:ñoΠ%`àU¯þâ†j^yp èœ7\ÇÎß" Žªƒµw¯òÆs»¼—3äÿûgî…P®pÜS½~©°å‡$Sž–?r¼ž+N÷üÍ‘ÿPH¯¯ª×^Xä-nÒsÝv‹ÓLÒ!ŸUÑëµä37“‡ èƒX— +ü[Lu}e*¦q†ì…杖ÎÅ@,ÑÌlVaf¯¯fÎ÷€,Ùòý~Pššð|Ö©u¼Ã©“ÊsJÍLjy¯.\›—$V´eÈßW\'® +}×éO]ïñ?iö·nÍ%jÏwþÐ\z‡W„A·ët=E,Óï÷l¼ú¶ñðÿû¾½+endstream endobj -6224 0 obj << +6656 0 obj << /Type /Page -/Contents 6225 0 R -/Resources 6223 0 R +/Contents 6657 0 R +/Resources 6655 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6227 0 R +/Parent 6654 0 R >> endobj -6226 0 obj << -/D [6224 0 R /XYZ 85.039 781.388 null] +6658 0 obj << +/D [6656 0 R /XYZ 85.039 781.388 null] >> endobj -6223 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +6655 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6230 0 obj << -/Length 2408 +6661 0 obj << +/Length 2464 /Filter /FlateDecode >> stream -xÚÍYKoã8¾çWè¶20VK"©Çq“îYxN÷"r˜™ƒb+±[ÊXr§ûßO}U¤±]ììa *‹d±‹tä…ôy™ B•{i*˼Õî"ôž¨ç_‘•ÐFFk¢OtÎ]ï<‰ƒP§'eìó4Ê¥#È\./>ü‡^I¢¼å£Eq ¢ØKrh¥½åúW?N‚ÙܘÐ_Ì"¿îʧýlùEW¡ù4›«$õ?ßÊ÷žxU½nf*ô_[ð¿†xÙÍTä¿‚Ïûg’lg¿/!íæ±ò0áÕ^«n#sÝ»‡Ÿ–ý6ì.’$Lœ½»Ñ‘ o42^Ò:ùd£JYñÒËME*ë('Å òª«šZkÒ¶ämo­ˆè ê¦ì._n¥ÑÌâÌÿ†å^8Ë«¯_…®išbÇ“ £käë -,´Þ»ÕZ,“µÊ¶ÙØâMMÞHȼA΂ çmüÀêÍ–W™ÏÐ÷žÝµfýØ3™ñW˜b —ñjõ,&l_ŽUí›/K;¨© #ýt ¾}¹fÍ„<´nOjmF¶‘É™»¼Bã+MÀfâÙ6Îõ‰ýq/{ʤÎS¼Øì0“ø´Ñ9²buÓ ¿xy!±íi±ù©ÛšlÆJÁÆj»b»-«g‘ö2r02ZUÍÑ % -Ø£œ&›•·Ýl‡Ý[Ån`yb§ Ël„Aè Iß -ïؘ:Ëü%è«Þ˜SÔ–HÏò‰ýd£Âß³váF?öö"Ï•ÈŒhÞÀ°1f|Xì"ïcCšzeeÞùhbÉl ’& r:N ùF'“}VÏŽsŽÇ8Q~ó €'”Ð3„ Çšž¢šÒ“ÇÚˆ|× WA¹•¨ï¨;"ëë.?Ý-Nä ;N'£€À³:¦Ê¿nžª¥*³¯Y¥gé¹jênßl¥ñ[hÂkt_"þ¥–NÆqhúëÒ¡¥í«'ÑžJ¶¢ÿ¹=Ž÷Š|¯rͪ«ÜPr"/6)°‹õ·ªe ÍÅb8&Æþ «‚¾‘“–-#C%°0ävK[HH›¦+-{Û6væMÑDÛrY€b+ß"¦ÛÃj#ÔàY´ -Á5e²ÞWÔHȬã^¤F¡‚ι pˆºü^µ’õêD*¥œDòya‹7œ+xlÞƒÒNjÕ°ùL—•®§¥ºŽVÖçU;Ç1B¨¾ç1#€µ`ð?\:C©5Bˆ¿8@µ(O½¹ŒûK(HAPÜÒ—ð$MÞ­«t”P] HRPéd\WéÐ5¥Èr™ÿ3j¿²èû²•*¯`+qYÖ% - öB{¦îsÓ¾«ß s¾îSTjÇ‘àïç‚hJ·8Ž¹`Â÷mÁÇêÌ9&ò\ºI|Ô\ tû¢kö­ônŠñy=™«¯!÷ÀxRJÄ «üþÂ1Ü0€ÃA ᢭V2›­2¤.G(Äd]ŠçYÑÞ‚ðm…_¹½Hfì¬>4QÇHÑZ¾…|îxÓß?\W,Tú.=ÍË°'2IÔÕþ¢©ÜQ|hM¸\=³5^ÙŽ}mô“hÅj8gÁè]]ÙEÃRTH }-%Ø»òÖ»ªîçî`ë(O׎ø %¥«¥ÀšúÒ Ð!jX;\ìÁËБÕVUÚŽèûYê:rƒšŸðä¨vWº¿V•ìK–²uÊëOÒ…3­·Žƒ4Þôa¼±­UÛêž:×¥œ»({$±s7D‰·«¡ö„¼œ¡Ø˜ÍÇñîäò䯰ò¦@äu®¶é°xªD'+VȧÝ4ûN¬¥QÅ ê##öΛÑÚæGÚp d7¼g¶áx¹É Žµ-ìäýöÁ=UÃâØüüÄî «î­P ¹ h™^ aõÇÆI%ÅT }¹å’mÈsD[îFî©ÅÏð&ŸWã,Îpœ› ð? À#™óDL…gn˜ˆØ—+DìÓ¾9¸ÃaQ?ʳÁŽ³Õ¡CSŸS3Mƒ(ŽÞWs9NĆ“±š·|"¬áz¸Wå¸<àßôVª´¾.߉¼g7r›¦‹Ã0”^Æe|mx·i% lÙÂêØÕr ;ÔÿÕJÃv -qÞ\Ô(²µß#s·á 3çž<lJ¡GwZ")%E;ØRuâ 1‹l™öƒÿeÓƒ -­èt÷ñÔáhÍ Q*ñ#•‚H]r%G7oðêbWŠØ^À°Ù²!ÄË*±% -0€TâháÜ. /ökßOˆÑö !u¼‘ØsN¯daä•Êýû Ê •˜á¹ -és8ý¹’Ø ñÖU[Ðu|-ÜÆN$o~ú8®¨ÏF0Q¶¾Óx¡5Žu^m+‹9­+ÿYU‚Ô¦æ;. -WÍÔxÔÔÚÈÀ×j»V_E}NFãêM"ÇÓe6Æ’â5êz³0¼vT…X%”xMwöõ"¢r\Eùßîõ‘Òï?^Dš*z÷ðŸ/²„Žóÿ»æ=ÿtAOu¾ÜCî7®t3éèåÍ¡›I#å-‚üŒXObCì-ži g&å•¢¸k©PMÁõ£ô¸ 9ç›IG×ßã -‡ÉSvfŒÅ§”möhcèX×bÕ -ëªØpÞÚbºp//î©b—‡.™$™¸j£/±O>;ô©ýw{u ¥´ž¼:œ­ÚTÄùéšM…*H¨SD`S*žßè,0™òúyÞ®ø'Ôçuendstream +xÚ¥koÛFò»…Ð~¡€˜æS$ Ü'vµŽ’‹”óMqXI+‹ŠdHÊnþýÍkIÊ"}=‡ËÙ™ÙyÏ,åNøçNâÐvüdÅ®íÇñds¸p&°óöÂŒKA¹ìá¼^]\ýÎ&®c'N2Yí:>¡„þdµýÝzóîúãêöÓôÒ÷}Ë›ÙÓË(Š­ùbuûvêZŸ®§±o­æ‹·Œð~ÉÏûùâæÃÔ‹­{,n{u Ÿ~m±Vïxµ¼~ÿúzúÇê—‹ÛU+s+ È— Àß.~ÿÙlA¹_.ÛOâɬۅíÃHl‡/ïÙÅòâï-+Þ &L5dŸÐí0öÏ ä‡ +;t2ÐÓËÐ ­ç‹7wŸonùí‹ëøWíÓ¼ÀEy\géWÙa_ÔMÊÂÉ—. +–œpº]ÜüëúŒ¾¸^Ýâõ`aŸtžó³Ùk^¨uñ(Ký§:”™~õ ãU–¹:èøµÖÕ£®x½)òF¥y-¬¡Ô›TeãâoöªR›Æ0IE¤´>xØ™eQ3U‰*ß +<+6*««Çé­Òãò”•Î +µÕÛWϘw§“—FŽéëžö»T ‹º0ʉîJ´] ݱÔQÑ!ÏTk®Ó0›otÞT*˾ó뜂Ž1R˜ˆ¢—]š™wÏõì¬9*Rý½nôáTéc®Uš©u¦í¡Ðe¶(mdPÍ3ižö…‘´'³Yªª6ê¥ù&;nÓüÁDåáöÄB ®Õf/Ö(Š¯ÇòÕ *ŠÕ¿j]¶\[±òãamœQ솎4^çÒ<=ÅdOi–‰Ô‡²js¯ÔÕ®¨*ßœZðT°Õ^WðôiP›ä…Ôö1­Ñ§òÔp¤ µ}960 RÝÚа@+ŒŠ§Mâm`¥=ÆöHùÃÄv¸~6¥Õ\v];Ákknè»öÌñH"èC Ňv†ŽõîÃôÒµ–+ì+³Èúâ¸A¦Çä>/ÊÓá<î@’š$[hE–ð<ÏMk†ùÖ$­Q@\pãvF÷"kƒ;P¶B”óó=à.yy0×ÚØ<Ÿ„çbÅ{íð¢¨øé9ŽsÊéÍOh‰«Ÿ·§„—xÐ +=PåÏwŒs¢¨;³ýY (ÐÑáÌsF~|‚¿ÎgùÛ'Û÷¾7À-œÙ!ÐþWn¾ Ü|šÿãöÓrˆ“ó×eº]½¡°¿ ߎ`"ê•7j^h×z…‰µÕ%%IK8„ùÀlÌ‘{&äªÜ¸»zóñ +͉@¡5Óª@B•Yðšé`̹P3ùáH^Ü¢ƒ@ÒçU“æ¾jYæ¼­§l{ †Ýï }š‚f +wÀ¢#>b~ÃÃÒÇi8ƒ"Ñ)Ð0k,º¾ïšÀú¼˜ÿóê.%œãŸÌçŠÈÐ¥­Wh{E$DÁ8^®˜ƒc÷årÝÃ-× ¥ILiÊu åúfAå‹õ̺ƒ2胘_1lÊ1©€ä/KÕáŒmˆ1€„½¢ÐØVª5?ƒžËî ¼Àj·‹\Ìöp¬0i3ç'ù±Lø!³­A‡– U1^GÈù°\7Ñ FÌדUƒ‘VùNm:qãÀš+æ3AtÙ„CÎÁAŒspo3£Mªt¾ÂÁ-Í@LJ:C¬*Æ9P€éoG ã S‘åà¹+2ä\ ^OmJl™¬50/)Ï(hSÓ-[ ÎB~-D§'DAé¹ïšݫ΋ŠjëdUxî;Iû™½V7¯ç– ]d¥­7Ø^!Íwv5«ˆPÔ.B‡6#¥.#žé) ²—¢s-Bð´°íÇ·z!ÈT‡\ÇU>d2=Näp/&õ—T BÏÂT¨àÊdʈªó‹:Tz¹¼U ý|óq”(\Æâè C”H@•îøɉý.DjQFZ ‚Šú¸ÆÂbý[o«¦êü¾"íqг7ñÆ07‘œç0Áy;ðˆâ#E ¿Qþ¦$¾Û…îž +¶„Ĩx?¢8§§çÈåˆNBê4š–@Ž¼Y,_1â»4EÉ¡8Yœ;ùî}‡åG>Ý’aX2KL_{YI‚…³C +)cü‚w|šÐüÊÑß"ð±™ÇäŸ\ŽRæ'É€ÏyzdHAf2±3B¾ù8DE!v®=¥X˜ˆm')ƒ߸nsÄZ,ygÙ¥«kõ[9Ó }±ÆK8¯?2NÜ˶îjº—®wx*;1Œ›äµõ7IžB*ÌD8”žçúŸ‰âû–™^ÚiеÆÆoÙ³(|±áöpFÇ/ðl/9Bîçðò?Ü8’èåQ ‡3: +xNl»R®ÑV.ÞqðÊ;„÷4Ùö®]€1çÆ¡+ìØYÈÐJèJâ•«Âê.ŒÒ áy¦‚á²¾%ྡæí hºncECɺ˃G|w×qÜ+øÏ“#‘ä#7Ti/âóóPY¼Fµ'&µOÛ¡†¦žÊ©–àÉÙ,AûáÞI"!)úªk€T›†H™ÀÅÜ‘lÄE.=SàtkÂÍVÀSÉÕŠpê5éõ ¤«†ï0iÝ´N1ãßÚ æ³ˆÒ@pMÙr)ŠyÞ¨y{“¥­oð[âßø³¸»œÍÐPÂë^ Ÿ^i J {iWo¤ä”LË‹ÁE®ÎQ‹ Î7çmdÜ?½™¶S£ÙNó\ŒŸô!?l/½nÿ:„[p„œµVŒÙE{íDÙc qU—Ub`ÆA ;™Í 7F§*äk½­o@ú(FCGOÚá^õ^ۦ’vý›}R™„Pdb¶]ìå}.G¼öƒOɹXT oü¿¡•u-ßZF®;;qÞÙNï þ ðˆÖ mx¢Á%Õxߧϔò‹Ì’wF|лÃÀRUÝ„uP®•ÊÈ>0­¥M.ì<ù³êNvôÛ\À3Ã科nà;Ð^†zü1«ÿëw£Þ•×Žýd¸¡„ô8×È‚¢ûQø\^óûÒ™Àÿ¤S¸¯endstream endobj -6229 0 obj << +6660 0 obj << /Type /Page -/Contents 6230 0 R -/Resources 6228 0 R +/Contents 6661 0 R +/Resources 6659 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6227 0 R +/Parent 6654 0 R >> endobj -6231 0 obj << -/D [6229 0 R /XYZ 85.039 781.388 null] +6662 0 obj << +/D [6660 0 R /XYZ 85.039 781.388 null] >> endobj -2302 0 obj << -/D [6229 0 R /XYZ 85.039 761.463 null] +2378 0 obj << +/D [6660 0 R /XYZ 85.039 559.099 null] >> endobj -3028 0 obj << -/D [6229 0 R /XYZ 85.039 648.42 null] +6663 0 obj << +/D [6660 0 R /XYZ 85.039 524.557 null] >> endobj -2306 0 obj << -/D [6229 0 R /XYZ 85.039 416.522 null] +2382 0 obj << +/D [6660 0 R /XYZ 85.039 438.819 null] >> endobj -6232 0 obj << -/D [6229 0 R /XYZ 85.039 394.76 null] +6664 0 obj << +/D [6660 0 R /XYZ 85.039 404.679 null] >> endobj -2310 0 obj << -/D [6229 0 R /XYZ 85.039 295.722 null] +2386 0 obj << +/D [6660 0 R /XYZ 85.039 267.675 null] >> endobj -6233 0 obj << -/D [6229 0 R /XYZ 85.039 266.318 null] +6665 0 obj << +/D [6660 0 R /XYZ 85.039 232.929 null] >> endobj -6228 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> +6659 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6236 0 obj << -/Length 3283 +6668 0 obj << +/Length 2190 /Filter /FlateDecode >> stream -xÚ¥ZÝsÛ6÷_¡éËQ31Cà‡|ONœ¶îŸ­\n®í%ѧé’Tÿ÷·_)‰R:sÓi `w±ØýíÂjÀj’F~ g“$U¾NÓÉr{LÖ0òÓ…ŠK!¹м›_¼ý16ø³`6™?÷ëD¾‰ôd¾úÕ{ÿóõÃüÃãôRkí…±?½L’Ô»½Ÿøiª¼Çëiª½ùíýOLp÷Ä¿Ÿoïo>NÃÔû,÷€zþ»>>þÃQÍæÖÓõÝ»ëéïó_.>ÌÏŽào† ÿyñëïÁdÂýrøz–N¾B;ð o/€c?2Z¾Ë‹§‹¹¥xÌLxÖ˜~"úQª¤¢‚T¨ý0T“$ -ü(0¤¡Ï-Ÿ^*¯a‚ػϻw·Ÿø£F‘¿à?DÒpïüýÃÛÛn0½Åfâ­Š6[”v¹w²>ì˜Ö}×Ïøy7÷²]!+åDÕ -[áÌ늬„Ã3:òîê¶êªí²ò?¹)/ªjF¢•Y‡ÜÕ® +YÇ+h¿9÷bÇјØÐëĆvWO/aWÉî•WÙ“ÈîdÁëeWØõî¦h¬ž–]ݼ2ÕSÞ|A¶–¼ÊìIô[×7O@- -ÑÆxØ í5ùŸ¸Ñ úpäæµÊ¶¸}Ü Ù×A-Ü5´´Ù#ë¾Æ•šýúª‘ñ•l€ü 7S¥ïß¼êã#2ÇYµŠ‘=·Õ²É·ö˜SŽ“þ[WS·óoi“UV·ÏVuMËÔÈÆí~|tJÑÞ§vÀ:ÙtÞüüþáPN{Ö¾Q·ÂÚª·éã3É`’ 5˜ý s»¦s·ªÁîÐ㕬 HˆLáï6+Dvä *dÍCËfPí¨ê¯û¾ZúŽM·]–EδLõÛuó\œ®€Uˆ¨Ê;솱„÷1aÏßeÖd©'±[‰šJŽvÔ`úü†Lr´ŸÞÓ²žALŒöö{›wË·ˆ í)9£™ög&9/ç€è´œ–è;ržÝPä<ÜoTÎá~$gƒ—â‹7÷ù¤´)bŠïIÛ‘Vˆ¾'í¹ ­´ûK;ØÏêyYãØOMúY{¢3² -Ñ÷d=·¡•õ`¿qYû‘¬UÛB[nFåÈ‹sÖK hœVþ ãtï¥"ø±Ž>Xyfaò™ûd¹9cs> hNûÊH%~`£úÚFL‰§èÍ2öa÷;F~K) BŒšc.þŠƒßë†ö†ü`ËîЮ†+‹óÅCˆ@ÐÇš<åá%¾JÁŠtà)Û¦ -oø‘Š’È+ëeVnÃFáàÓ§Öª&8p™Ô,ôUœú -×Áy‹b½¨¿ù8%o2°ƒ­¬Ïò‘•EÖü&^÷{ûa¢÷x¥dƒ!Ä!ˆ[·Ô¡òŽ%Nf~Ë#Þõ`¿Xùqª„Cn„0š6l8já©­d¿Œ‡ð ²­ 9ìh¡– Å@÷@˜ \Ñny‘¶æß:7€ý9W˜Ñ¾Ùµ6ˆ®j9öZ¬¦Êmíj&qà}›oqÓh*és……eh`+`™ñ(ýK¨i2’°Ü#KHCõk8ŸDcdÊ…~PŠC™°ƒ½¼…|8z ±×Tœó²Á뵵ЉPbM$¬¬¨#Xë ü…TP7²k)YÑÁ¶`§¤°AÝÓ©Û2ë9Óþx¡‰Ø<2n£‚CÌ0V+w½’‘bAöÁmMCDŽw­…ÚHÐmrnÜõX´!›]/—ýñÉòÖ 5ˆÀ…r&Lô:cxšﮑøýñÍÞŸ…&ŠÄzbôO#Âi Tã1F¸°‘cGüʃ:äß*®“©Œ¯ìPåC¸°s|‰3,­S>þ×JO³²” ^zÞe÷ÜÎmG’ˆgN+-x#©"|®8é*¶”âµÃõþøŠ97Í—€±«åÕ^‚ê"Cr®|A–¾0Vb`Ø…,ÕÂtÞ}¦/ùå0ÐyfôÐO\okT⸶Ž+TøH*$&åß꽓êˆã2ˆ½ØŽãétÎVD­AB8Q²Å@ÏÈIÂ0ÁçÐyö³Ù تšOѼ˛ü[æ2è¥=_Ã…Ý—ZŠóf/1!Ç7ïÏŽë,˜Õe]µcga‚«4¿ -²+^iskDñ©ù YÒ+޺फÃ1ÉÑóæ™Ý±„£ˆ¬Î ã9~mlAÈz\ìÌ*^ÄuîE¬LÎÀÑ°9°É-­CîmWáÚ¶²ýe`ÌÃ`š‹î?ç$X{Zû–îošŽçê0ØndFmçÞâ\ªˆ…Û8Ààq…A¹'¬uÿ‘¿{+3´^ˆæí¦xáÅ*úâD.îj¤S¡›qT@Í ”FÊyµµ†¤î0˜þÈw'/&hwŒ.xnƇV¬+rOýmie9—@°(¸zƒv†f|sh¡e“#!ê×ñÐe‡:b,ÔíœÒð(å]#k“¸Àác[3æ‘EÖb-œëg+-¹×É‹;Aèd”)_¹J¥;9^¿²?\ä—^¼Íe¶Î0ø®yÑ‘ÈhuïP8ZƒÄ1È'*Ú,ö÷*0öèÃ&D >¬bL00x¤X—õ‚Jmèq”¥Ê*-ø‹fûU_ç pGÞCCòíh W™oÃ"9,öLW‹Vµ> €uNÉ;ÒŸõÞ4úû #\¼e¡"g*;²O¦4ˆw£_‚¡Sv³‡à•.‰-íRѳã8F7XPMNzV oë -£ÙZ0µãÕ$. @&[PÇ; ö®¶&u V¯+é"¡ãÈÂØÒR‹Çá^{ÉÑì* -BvFvÞƒXJÏÚûhj0–˜ÈÊOÁ€!ø ŒŠó(JC ¥wƒ@Î/ÆMÿ}‡)dþUƒ—å´âŽÝŽKÊ´/é×¢,mL¶±³¢œ]S5Zu¢ëGÉŒšüî œÜI¼´÷4EÛ"÷!Ž·[1“DžŽ;™]ÖûiÃYaÍÍs¾-· ˆ9tÙRÄôb›I @•÷ÛØü‚ή–ç#€1'aS±})û4³ ³å_ð‚pûXÐrŸ â¨:Š½ÙB[×ø?ÉEÆû«#…ìá2ð©d–+Ù–uŠ»f#• ²U¥Ž.ˆV!Û‹¢?·Y®•»D,$ôM[ïßBJ2=ö@ÚNJ÷ox°æᓆ}5À•‡ÉÒ"¡;ŽÖ¹®€ïŠò#åü¥R ·úR .ëd‡F´™·œyºœ§ï6e˜|3á¨ï7Ú=¹èb0Sk»¢(L^φA‰{7™,#~bÈÈ*Òm!ž5äPiä_¸˜»àÜ0‰Ð©¼}$Ï&†4&ÃÇX!£Uá—«LÌnñÌé2Ó%M¢6Ä"ÚAÄÀ>T Ï÷ÛußÖ¹…\²Ñ¾V8„èYùdžÔv½8¶üÞMØÀ+±ÏxìåêrçN»”ˆ˜%š fÑŒÂqíŒÉ䓲Õ2£4­)ùö°# ymBLý§£„­¨¥Þ§›. -`æú©íëd‰wC6[7XâCÚ‡ÿh ‰ß‹=läí›•Ó '¤×Jñcÿ8¤(RKQ„c,VG„ƒ¬<öa#¦dx,Ùº0Ø鬌aͽÝ„šØОú[Ë=ó3#"°žûÑ’ÚþˆÅɪ®L˜P”\7®°º=ù¸M*L±:ÐJ5Ø–‡ Óî— £GBi|¢@‡#uU¾þ3˜Þ+±–çuÅe¤Ñ×i²—çÑ÷½Íëc•ë+÷R]ñ£ëq”ئàó§îO=ÏPrû‚Á6õú¨ãþgº–[¦'Ì[@2á¼ Ì‚ÖrðàAÝ`ã^Û¸ê÷åz­¥›}49Vºv×DK¢<ë#=„&®:÷,’S ?}?‡ÿ™Õÿëï¥ÜË’Ñ~ªO<ÂGaè‡Êò‚ªIùµWuÄðÿ]ÁX8endstream +xÚ¥koã¸ñ»…ûédà¬EêU (rÙì^®½ìvc4®œb+Ž=\I®“ßÎP/KN‹Å"KŠÎûEZ,ø'–¡g;2Z¡°e.·ùÂYîaçóB0ÄšAÖ=˜Ÿ6‹Ÿ<);r¢åæ©ÃãÙÊ“ËÍî7ëú端››o«µ”Òr}{µ‚к½ÛÜ|^ ëÛÕ*”Öæöî3üzOãÃíÝÇ/+7´xáî 7¸ôåÛßZ¨ÍÏ4»¿úõ§«Õï›_7›–ç–à/B†ÿ½øíwg¹á~Y8¶ŒÂå æŽ-`;_Ƕ§$g‹ûÅ?ZT´§–tjJ?ž m/”ç +^OA‘°,OØQiÒ¢&!`Öä<Vk7°Êª¡¿°J”È­pãMNªÿ Š’jpðõõÕ~¼8è‘ní+ár ¶¡OHŸ“*Á£ÊÀÀ£4â”i7Ï ~û•âÀí*ø/A¶êš¶Ë'O;¸¦fsÖÖH`aÝÀv@éÈاUHP8áXiñXÊ*›´,`͉¬ø4Z%j±!0ÒKÓ¤¬íiíx ñ–â|º~Ä-ÆȬh?™?@>Ô𸭬J3 òŽœOFÒö£¥N(”‡Þ@;Õ~I“o=çaàuúÜwFQ­Ý-Šßñ¡IXEF-EÒàî 9/«Z|¬Jü>i±Öä Ò mßäaŠ”7’/ŠÀݽ¥Û‹üÉ`uf""†x =È>¡#½‹é©£i¹°«l©ü^zò]Pd 4-ðzrÈj]—yŽ…:óë¦ýHǪê9vÍEv:˜sÑÄ·ƒ€²åæúëC®c&zm¦Îv°·-‹9BíÑÏ+ãÿ"²råc–ä:ì!ÙŽ>r`kot¬˜££ãXãJaR¤uÔ(9J +¸–YÞÓ0€ ‹ åµRŽµ,ÑK`ì^Ûøˆ/] .Œ¡„¢¸®õ¨s ïÀ"Pyè~nÖ1TeN'^Z¹ÞèpW;ÚÊÓú9>¬ñŒ¡ë*ë©DmíIvÄtÌŠ~Æjë4?dÌ `jâŽRÍ qÁ”¶q•dŒ¢H4–Úžû §Âmy¬ _É´V”4–çÈ” pªQs +z#°a:C8Ê€ Ø)É€ôÚfã,!éþ4ãØž¶ûNЃiã jV¥Î±”!{q&,Áæ9ÖWíOû´ØS´0Ô ÞÀœ/(©ïƒôš˜¥’¤#ôÛœ ¨ê÷dè`fƒSA5|2Ù·hbL\Њ$p=K—‘7Ú¨‡EWÆÕÖzÎë[Ú­w½”¬=‹3€GJÞ;Fé#§p™ÄŒHó¸-)û<.8j&ÃÕˆO×laý0¨Ûth£ûÚ9ÍdX3¼è-†ÓY(f€¸¡Q'F°þÕ=¾âà¢=¹¶ðCr1—‘¤Põ‰.•æqýB»®çÙø[88¨îÀïJ*€Ü÷Í8¡Šìp$ ×zÎßA¥nd_áCÐr'OÈòÀ¢–'DyΛ¥°Ih¡¤C« |>ÓI¨ëy¬ÕðB #¡„ YûŽÏÌQã¡õœvénB¼SW&“¸»£T”­Lú§“qöš«[°Ç&a¨’SÚ+Ԉ‡ÒÖbØêÊÆÙÑžp¬G¶–r] (jHÓ…. íôÔ¥ó6Òzâtæ™°6¥+\?¡WÄ DJá+¤=–7êÙÐùà*¦yÒa—1²é0Ó®va6ÑÜw\ôL3äbEŽ:FFÐ4/à\¬Ù–å>ÝÆ™©Lv‡JöAù¤S¦<“WÌöm˜Å½(xF ®DOpá[9²E„’ƒCczÂñíÐ /40gªµ¥p¯³tà»)k”ÛhìU²ãË)w_G£²æ‚›.æíâThü;í†d+LE3J–xÎå‹Dæ‚’è]%_ Ø)yDqZÉ=Šß§ä*ÉËf¬ða…åî¸mˆ´“Sà4Ý{–# › =oRs«;· TæY«€ˆ"¼|ÛìÁ\° +½k• ;«Œ(N[¥Gñû¬·Ïq“Þn,bž[è)¨:¿µ˜ÍÙcÏÊ\fèkÚÇ0¸hŠ̼) Ð{¦¸D°5Řâ¤)úçLq÷eÓ¯Õ\¾ÜM£¬®* z±X¾ÅeÒ¯;4”Qõ™½TÛ\=gþÿÇj^`GïÍÌ«1лV»@°³Úˆâ´Õz?¥mgN]|– ÍÇa”AÛ>M`µÖ拲k´Aì1àðuÃ;§K­s¹÷`f[(Wr× -”ä +ZNÝnBGTƒã´¯9>Þ3×ú¡”oFµ}Ž‹=Ïú•¬|ÌŒšò9!@»Ñ{Bt0³]\ÉÚÀ?ô½FACWÄ9Ï°MÂÑx¶Âh\Èqw\¶q­í¨ñ£{OIw9Êóú·_>¶è%¸nâª1šØQÌ)Ïÿ9Ð7{-ßìqÎ/:·¾ócŽPàr|ëWº-<ñ„ãYOúq0§ü¥E¡'Ž^pïn£hò@ïí/&ç41S-TÔ&„MÍT!6Í1£«›cFé*_ºCfSŽ‡î¥yø#DZîVÿǃ2Ûu×ÉX÷‰~m„Œø¬µñ×æzzÇv'sü‘†¿ë£Ö£•´C9“o<×µ]axAQeàù5¿,1ü_‚@fxendstream endobj -6235 0 obj << +6667 0 obj << /Type /Page -/Contents 6236 0 R -/Resources 6234 0 R +/Contents 6668 0 R +/Resources 6666 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6227 0 R +/Parent 6654 0 R +/Annots [ 6670 0 R 6671 0 R ] >> endobj -6237 0 obj << -/D [6235 0 R /XYZ 85.039 781.388 null] +6670 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [392.693 682.027 539.579 693.717] +/Subtype /Link +/A << /S /GoTo /D (NetworkBrowsing) >> >> endobj -2314 0 obj << -/D [6235 0 R /XYZ 85.039 664.197 null] +6671 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 668.478 100.581 679.878] +/Subtype /Link +/A << /S /GoTo /D (NetworkBrowsing) >> >> endobj -6238 0 obj << -/D [6235 0 R /XYZ 85.039 633.996 null] +6669 0 obj << +/D [6667 0 R /XYZ 85.039 781.388 null] >> endobj -2318 0 obj << -/D [6235 0 R /XYZ 85.039 550.674 null] +2390 0 obj << +/D [6667 0 R /XYZ 85.039 653.035 null] >> endobj -6239 0 obj << -/D [6235 0 R /XYZ 85.039 527.601 null] +6672 0 obj << +/D [6667 0 R /XYZ 85.039 612.871 null] >> endobj -6234 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R /F35 2880 0 R >> +2394 0 obj << +/D [6667 0 R /XYZ 85.039 541.288 null] +>> endobj +6673 0 obj << +/D [6667 0 R /XYZ 85.039 506.543 null] +>> endobj +2398 0 obj << +/D [6667 0 R /XYZ 85.039 355.383 null] +>> endobj +6674 0 obj << +/D [6667 0 R /XYZ 85.039 321.243 null] +>> endobj +2402 0 obj << +/D [6667 0 R /XYZ 85.039 140.602 null] +>> endobj +6675 0 obj << +/D [6667 0 R /XYZ 85.039 105.857 null] +>> endobj +6666 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6242 0 obj << -/Length 2106 +6678 0 obj << +/Length 1472 /Filter /FlateDecode >> stream -xÚ¥X[s£Æ~ׯPU^PåÃØ7'Ùlœ‹ãì*µIÆ€,Ž(€¬õ¿O߸IHNUjË ôôt÷|}›–;wàŸ;µí¨h„®­ÂpïfÎü V>Ì\áX -ËrÀóÍzvóýÊŸ»Ž9Ñ|½éåhÛ×j¾Nþ°¾ýáöaýþãb©”²¼•½XAhÝݯßX¸ÖÇÛE¨¬õÝýføå??ßÝ÷ë ­ÏB¸ÜëÏHúõãO×ú~ûtûË7·‹¿Ö?ÎÞ¯;›;kÀ¾ þ{öÇ_Î<Ãý8sl…ó#¼;¶ Ë»Xlk_Éw>û4û­ÅkþœwMá£UhëPäê@®§lÏsçvlíø„Ðz›¢å7ß«!§çÙ+­A6²Ü¤M|³-ë¦fΑ̕k»*Î?×ϪpÑÚÊj~n€TŠ¦ÉÊŸ9/5¸Ä¯&'šoýŽ Ù—›Ÿ³?À×^Y/–®õínîðõÉŠº ¢Ø ¤­ž/#ßo¾tˈÌ5Àæ{¾e𡬊$YÙŽïxù˜á™rfŠ‘©$ÃCÌLoGâÎùD°N¬¿WÖ¾Bí$:e -{L@8ìöL­KÙ‡n3  Óº=IÌÄ<}AKÉÆœÙË ?ÍJñP™cLS&96ò’~É(PH× N7e•Nzu¾rù)›m RÅö ‘ÛD87ü†„ Ã,FàR\öa¡0e@êËB6Yn˜<µ/”ÀUÙ -JÛµÂ>ࡺåÁªkGèR¨[®g+×›¯V­Ý!Å\Ù Öƒ¸ÐÚá"Ç(ó$Çe±¹dÎÊ·µw½Ï x&ÊhkŽ¿²#Ï“2Ja ˜IXÒ;çlž/:Ü8èÑ”fHê°Ç0ì±ÇÏìóÝT³¼;=Qg‰rìP¹“Gjy–&>“?j ¡½ -V$©æÁ™FåC½¿®YÎõ0T4,=Ò·Þ -"]Â6f;ä’rg2 ³ŸÇmÆõbÄë[;#• -°”J‚äGJŠ4§VôT_„Õ l/ôÞ€µgº«0½ë5…-¬§ú&aè#X=„U*ûŸŽvjøÏe2ŒO¬)TêñC@¦¸õ”æZ‚å붔‡ÎGW·µÊ…ÎV1…ç9"̶‘å‰.Áßaôp£§\v}ë¾ïH°õSZ±G+‘ÙE ®î Ñ+t] -ÙLýLÛ’+1³ç`­è^Zí†1è‰ÌíOžÃ¥2’.Õj3(Ý%YT>ø"2݇´ŽÀÅWÛPÏr¹)j?°Cß5E5lŠóvL×b´õR[„ÃAôU{z2HMµEíAíÄHC>‰»PÙ+Ï—ñ!ºZü9¸·Qõxe2gnë¤<¶7"x?Ž/©®ˆ  5ME…8ú4XJW&ºCtíø…Í… bö0¸ú( !f WÅ Mš G"H `:é¨!øˆ«¬‘;¥ÌFa?jp {«YÕFY¨†ÃÝŽQ<\CÚÝDPŒ,UÙ^FB¾¶ÂPVÉðªÐPßüÏ“kp¡éRî“2ɽ”Ž7¸ºÒü!×ÚB@ù¾ß_fw­}Æl#5¨ç7‡J6ë/I§¡@Qƒ’ëA:q¦ÀqS8§ö4õ„úY1U2v‡N@|pˆóø]®l/PCÉͨ‹­BixI§ÏÉY V"«ÞB?åñ?»€ò§Ç´¡0(úöÉ“ ]0˜út×fà[4kê ‹¾ìLÁ/èó$û¹@òõ{¾Kf€Š‘B¶)¥mâîCE3_*¤$…¡9¯/M -* -íèú Ð³\.‰Ïv$·Ÿ¶$úÃ’X@w3) 8Û7悢ȿn]ÏsynP0\ào4ƒ¹Aë>[á½û‘!¢Œ¾ÕâÏq íï(’}ÐiÇÙ‡)KÙ‡ûMõ”65á:’`'Š9ÙöíÍ \Ùšú\°´æ‰„)gëÿRø$_¥ãÆ*‹©ˆÉ¸d¤n¨0åü£iùw‰ü'gëÖcÖ€#»øÛöÕ$öß~ø†,n?H¿£ÐìéЖ`$m2™zÇ¿@tz :;zoÀ¸äæÉÚíá.sќۼI«4½ˆ!iÑðHjK)]$+7}Áµ{ |Y<°ÐTé»Ëj:£\tFu'mE&/yböüvÌŠ õ²Þš¤<^>&ôT•‡ý;ê«Î Ó2*Ì-×”AIQÿgy" ±]Ðχ bkæ lhÜØ\xùZ¶¤uVŠ×’Ç6¼zôGH×çøin®[Ïu*NôŸcšb-®[ÿœì;?â¾*›2† -„š`l|{Gµß–Χ¨9Ó.âBvl/šªÁðÇVü§ŸÚ»Jî+;TÑt!מg{nk *Ø©½íOògÿl 3endstream +xÚ¥WKsÛ8 ¾ûWø(ÏT,zvvvÆiâÔmb·¶:9´=(¶Rkj[YIi6ÿ~‚”åXvÚn2‰HÀ Š>‡_Ñ|ÆUÜ#ÁTõ›ï‡•Ëž0®aq[Å–Î]¯JË“Ñž¯Üç +þ Ë€›¶ß+š¦¥a+ÓVYIôâ‘ý™@­PÜ›chJÎ<žŽ‘†À-Ì㪄|å"|®Oð€E~tR¡å9иº’)!÷4B€™ Ê 4“iBÐä[é µp`—±óPgÕ1¿“ò´[–^!žr\ÛÎ'ûêº]²Sg<ÂbHÁi5èžbšÖªÌf }÷÷6ÝÉ{Ž—em¨[â«­žIVŸáþñtþ\]¨ªh¬ÚÒ—ò¯ÍÆ›|‹×°@þGíp£!ñ@Àظcºó˜i‹òD…¾}ÈáÊÉÒ¶âŒG”¬IÅÀ•q€¾ð@F–Œ}çqyS/´Â¯"ŠÎ­8¸/³Ê„(ØUÓNDí1p<Ñ\õ™™\j€E3R +¤E»žÓ÷FÇöZÀ¡#KÈ6{ÕÆÈ×G/î1´Œn}´As•ªU¶^¿jU˜æFê²ñz¤Ú1<ÅPCðæ«PÞß×—pàÛ½A—\åZDB{†Ç”40b4HÈvU,Ò5 '/%éí:#Ê}lö“ç‰/Š‘ñ鞶pgš*Ú$BP*÷ÂÅýÍŸŽˆͦÐƸâÜù‹+8´€òì|žŒ?}¾øLfÙ÷¼ª³2[vž_C¡JfÃd +-” à¿'Çï°ƒÿ¾óáì|:ÜÂÐoK¸œM?O +س@þ{Äèxœ^ôRÜ-4{èAÓê»Y¶)jnoÓÅ*;ƒ>f¹/ëy jÐÞ•±b¸\BÞ¨Œ—¯ò;#õK•-¾©ÿG1úbÄ^'çë‘A÷˜§D,™"&˜0wIzÜJkÙb®s‚èÊ ”qÇ[ G“KpœÞ%3[s®SÍ¿éæ~mó&"€MG>m¾ +*GA´'u¾ßue¯ë(nLeKfúÑÁ·šj]‹`¡³Áú/Õ"xy´¥8Öe§¤¾2vÖÔÐÂÓ¤Z‘”îqc U›Œ>f¹¸£]MñÚU¡ÕI×&­&5¦â§Ùâóœeì èΘ:Ô&ácYÏkÔøDüùöA(»bkCe*wìwWÉU²HWu„¿9'®=¢× +ì?,dú£/cÓ\ @r§®V…ñ¢&¯öÄ5ìÏJ0ßïÚ‘wXÚî`ÏiÛ0nWpá ›=o×<ú¯qlªQ©ì3±ySèí:15=« 7dM[ä9?°ì¶ .l·oNÝlC`Úw ‚­œìHÿ “Œ»Rø#Lþ×Ë»i¢!]D*îîj})™Öô +ZhûB?0ø?zÏúòendstream endobj -6241 0 obj << +6677 0 obj << /Type /Page -/Contents 6242 0 R -/Resources 6240 0 R +/Contents 6678 0 R +/Resources 6676 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6227 0 R +/Parent 6654 0 R >> endobj -6243 0 obj << -/D [6241 0 R /XYZ 85.039 781.388 null] +6679 0 obj << +/D [6677 0 R /XYZ 85.039 781.388 null] >> endobj -2322 0 obj << -/D [6241 0 R /XYZ 85.039 679.343 null] +6676 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6244 0 obj << -/D [6241 0 R /XYZ 85.039 657.482 null] +6682 0 obj << +/Length 2548 +/Filter /FlateDecode +>> +stream +xÚ…kã¶ñûý +‹\œu¢H½PE$iRô®h6H¦¸’ÖN– ‰>ßþû΋’lËp¦f†Ãἇ«6üS›< #]l²\…:Ï7åñ]´ÙæÇwJ(L¢ÃÄX¯ w»Kã02Ù*œ±ËTj£æÛ§w~ˆ£M…iª7O/^4Â)ßp$ƒžf“ â•wÞö– #§Åétb¬ȮŻ©žæm©t’‡K±š‘5Vùt3Ö×ÆG% XobÈÅʬFòåNèSè½84Bù-ñëœÎûÅ‘ðÙîâð+§ô©+FY®# ÔJYh¥&X ÓƒoƒcÏÛ"NϽ'Ø®¼¶¶pHùá‡$_ªU“¥ Ur¿m‚ÎÿUõ À­GÞu¥X“„ +úÞDÅ2 ~Áx6žÝ¡,ZJÝÈRTõ蚎å@Æ\îÑÿ¹Ur’ï%ûb¤HÝh+þ< êÚWÿE®D*ÝíÛžÎ;a/Ò΃ݰ’ªG¹ˆmè㌘â†Ù!€´µŽƒ÷>hj ¸?4-o65 š‡}—Qy§SÛKßõWžkt`T S,÷M#SqG–‚“á­§v-ð×GW£ß¼ÂLó°/ÓÐùê”cí»ël†Ò)=U5Ôý™…ã.ªf<Õ,žDÀÑÃþ0Œèk:~.d_·ÔoJfT˜Ô%|€FœsŠèñß’cåAæ’© 8EÒN€AŠxòRÅ]Þ§†)™œHRªòÕn%Á{Ç2Àº¥-P¸Vš§Á•<•€ËCì.(¥àÁêÒP}TSŒ0ØJãµÇèâ-½`ø§œJˆ³¨`„­*f`Æ?ñ§^zd±¨Fª©¤Ü¤¡)¦Tr€ÊŠ¤Äø¢€÷‹€Ÿý=J"$æ¥ZÉ6© M” _J}’Xð*d…±ÍØß2'Á«'î€&š]­ãÙИsç{yálùÇÙçVªíÔ““¬‘T¼Ÿ|Iî÷ö¾È½ýNîºtbULîrÕëúi%>©ÙBj¡p±Þ£¼EÂòâbê#`=Ú£ïðà«D!Ù4 @[¡‡zË # +·“PœŒ€âÒ¸“ü8uøG²@aÄûvØ šÎn|¿3?[šQ:)×°Óèåy–î‰ ãß$|ˆ+Ñ0ad:øu<£VTðÊ»í’É— ¼çÊ`©û'éÝ®»£/‡†µÆ¤Ü*ø¥a,!õY9gt½/5÷׶¾«¾¿(cD³Ó)³™ô8õWÙáoŽÍW'åô™çïk=ù“ØY{;cnyò௥g«ëd¦ð1žÑ€’v^ßÌ©&8öþ@ï{wöÜ3Þáý([ºzŠ@DÐXÔ”Ò'6æÁ©>÷Ü¢'_ŒÚ©¬`¾ÛQ×èñdËš2PZ›Æ$l½Vö”¹”¿+ã$˜ÆË;‰ÂDù,H¾htü‰ âôýþI“D§+©TEy¨õÔí-üØÝÏ…¾rç;vߺåan®Ó›.NÕ”PH¿qqBÂÅú+îy, bÉi‰¬?·ÜÄ!;w àùÌ_ý u¢àUö"IÿK@ªvÔCºæ*näŒ " Øw¦Ö‹‰øÞsf-¼.Ƹ¥“›kMÑ;Íjti¿hR]?̳ŸìYÏœïCËdNl©ÀÛ¡¢Œ.ƒT¼¡'Üxø ç‚x;o¦ + +¶‰Uf™þ£S¨w ò•‰ó†'^êLSeÉÓRu?ö9Œ-æZŒ›V×ÓüÁá7œd JUêûLO¼¦—´/Û$•·.Çi£àGETõ¾=/-c8ß´4_²ò×4?Õ¬"šb3Tqrï‹ôŽX(y;óGßImÀ9ÆÀüêÏøl„Éœê’Ð(‡¤ý´¥â•ÈqzŒ HŒgñTü˜_ª„¶\kN’b…¸dA^fÂéª3AôÅÏnŸ¶îâq*i% #ìë]SZÇ%ù:lxšÿÔÊ > ]Eo«qA°¶‘7f™yù&¹¼'ðkR[Ót v-Ø®´s¾’ÏÀ¤`{œŒç~SJõy¡G§ùßða¦´þ'Å‚×k¿x/”ýïýdŽEIDâ÷b®ùIÖ?QÇÞÍ¢eΠÁêÛ"øY]½ï]ã5Œ°bñŽ-«þœVbi§çAsú­Àµóš)¬‰Æ7ÜÈå4ôŽUÈÚléÉ8†ÂAQÇmF4Š¦ +ˆs6= Îx±®ÞÅï]o¤?˜è<[°Ì3qÀ<Ÿ/âËϪy¶ð|¤ÝÄÇ>\4·à.zZüÜL\z9Kð}[ÍF%È챘Á¢4øX³OÜáG–+áoôzRñSiÎÑ°ö׉OòXÿCÿùuZÒ®¶Ÿçþn‘¹¹UÕ=Ü?yN8ÔžetÆW){ø²1Q®<"F:LcÏ /¥³üöÀDç!LŸOü?tÎî$endstream +endobj +6681 0 obj << +/Type /Page +/Contents 6682 0 R +/Resources 6680 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6654 0 R +/Annots [ 6685 0 R 6687 0 R ] >> endobj -2326 0 obj << -/D [6241 0 R /XYZ 85.039 559.67 null] +6685 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [246.134 503.717 355.794 515.406] +/Subtype/Link/A<> >> endobj -6245 0 obj << -/D [6241 0 R /XYZ 85.039 537.81 null] +6687 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [260.501 214.656 299.16 226.345] +/Subtype/Link/A<> >> endobj -2330 0 obj << -/D [6241 0 R /XYZ 85.039 398.93 null] +6683 0 obj << +/D [6681 0 R /XYZ 85.039 781.388 null] >> endobj -6246 0 obj << -/D [6241 0 R /XYZ 85.039 374.948 null] +2406 0 obj << +/D [6681 0 R /XYZ 85.039 761.463 null] >> endobj -6240 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R >> -/ProcSet [ /PDF /Text ] +3128 0 obj << +/D [6681 0 R /XYZ 85.039 652.347 null] >> endobj -6249 0 obj << -/Length 3257 -/Filter /FlateDecode ->> -stream -xÚ¥ÙnãFòÝ_!øe)`D“lžƒlÏ“øX[’<Ð"-qM‘’ÿ~ëê&)Ñ,‚Áˆ}TWw]WÛ9ðÏÅí¨dÅ®­âx¶Ú9³5Ìœ¹±ÅæÃòèä—П¹Ž8ÉlùÐã l?P³eö§õñËéõòóÍ|¡”²¼Ðž/¢(¶Î/—ŸÏæ®us:•µ<¿o·0 Cë´,hùñúäüšÛ«z‹€|àʈ,%¹×•ÆÏô!Ý[-Qg$¬9ժإ²ê,gÇâH D¾&Êœ‘ë -+ÂFì›þø4XéþJx6/hH^U[Tï´édÏ…Š]ÆŒDÐÀ7$9oÚ¢®xÀ³=æî±@‰/÷)‘꠮Ğõ{A¼EŽ|—O;è0½$œŽÇ Cü{—W´aG,]ÍSŒc82—ÿ+ìv=>ôsäk ‚ÃHvõÐÈña;l>­º'QißUV[3,Ûl•$T¢ò;Ž¸|iËb¬]-C?¤^Ð2êŽô¾”V'Ô÷]JânÃF­ÆÝž:ä΄Š€6)Ïgß;Zv¨F*Ÿ‘›^`]æÝÄu~3·<ÆÜÔ Gˆç€o~O³ÌX¡–ÛÂñ}.&h™€¯Ó¢â «ldCV‹5ƒ‰LyaÈ[Ô4I03$Kßæ Ø$ëKé»ZKÉÑôf&˜@ºZ JÝw˜R\[?álÆ£ÀñŠ[½‡‚ìÜ¥e™gº«¡çrÿO~QÃã{IbûIãÁOÊâžF4.TÚN<¶YAjN"îÈ@½ÈEaãõÖV(«ö˜‡v¤Vbšº¼áQcœI™‡}lè–i-¦Ýj½«ÞrS·]û^v#3SÉTQõ°‡<«áIÞ­NP‹nµ±!šx˜àë„ Z‰°ã ã3Q @9¥kÒp$Z¢‘U³e$eòe#ˆ­þ&÷Kø -÷²a®|gtÊÁkî%dC s!¶ €î(«)hµs`B†ØJø¨98¨tl–°Mô_-w.‰èîÃùìâ'Éäê -L(+ØDô8TÖrb줂LœbÑal ˜DG‡5ªå&û© ÉVˆlÇ6òyNÞôqÝP‡ŒDP²üÔ|Þ&VNt¨Uw›Â\hï9to@*9:K+¾³´\[ Mä€Ãw/î'æÈ¢cÔÌÃ1¹ïÂ0û•¼%;†á­llC†ÍƒYßV~H*íz¶r½Y H€–Pû4àBü>V#=ÄË9Ì·ym -:"i¾Ù¸ºVs†È"ý‚CÃqpG«Ð/òÊT65žÚÇ:N!np`Êx‘ìñ;ô«¾u¼Çƒi - :q¬ã±ˆiˆÈ’a`׃ëÃwrhp tîf/>ô“ÇÀôØs%C -bC†¤;‚‡±¤•Àl¦ŽßêÐ$Ρ"k•Òq›R~Aƒ0~缃8¹ŽŠ³~ü" 5ˆÓP#HÉÆ–`^é#b‡ÃCX§%Ún:V=:†sL„ß‘£``•)ÊÙñ4å9C0²ì´íˆF9š¦u]@P% l®¥6þÇŒŸƒShgõ6¥‹}Ì‹0 >p!MñÕ šbßú¯¹XI+åqN›·š[83d °ôÚ$©×ã›;á%á„cá›N[r.]“§"qaàžQØ!*ˆèF~*“ÆJˆóŽï)WR°ã†ø 5¢&åðÒ^áÀ*„ü¢Z“³ÄZl¶ÜäG·y ‹¾m ‚Sbå¼a‹– ÊóN¶dø.gÏ ›1 -P̉+Ñ*ñÐeqA -YiVc”‰±R'`÷€Ã”KʈԼÊeÁä+àvËk[sÍ¿+ÁWæ|ìR/z@-n¶)_MìeôŒ»?&Ÿ"+÷÷iPƒòÄ`¼ œ7¬ ¾‚ ”æFº ”;]! ö1ê[Öëz$œöí]²=áÖtA_aqû¦¸ò1ªó -–cԹǴL–ôÁö«-ž²ýÀÝOrv^2Q ÂѾ2iÑøÂGƒÆY4’Lphœ¥{{©ëà‰縖¹.L¬Cµ/xªñà8w€vhðZ>§Xò×ß}L -Á±ÎȬ“MÆX¼ÿ’ë('0ô•Ð0ˆÄ{Ó³ L@RBæ}P·f0.bÆæÇ -ScìÈý—i×WÚƒxïa¡éOÚ5)Æ©…©àR¸Œ»LÇ÷/ÂR°öÊîd:I ÀÍjÒŽ¼¦ër´2,˜m9ëƒUšf·/Q`KWˆê„4†7jyJ£¤¡Ûg`8÷éòVvIéáã>meÆP Ó©–yš8*wã³±‡éMÚ? æôò'‡¢8˜ÊYîÇñËi~:Z¼@š;9 q¾œÃTÊŸab?õ^'þóÙö0&_D*f óxAèR—ñúÇ5ì˜è ;}ÅJ¿@ƒž±á›Ê#^«©‡1b»¢¤Ñ&-ôì«ñ¤rŽ‰ËcÝ+Kpø^2U¯„ÿÌôg(¦ê Ö!VÉtÕ3ð<ÛsõYûJûçÕ®rpàÿ¥…ê;endstream -endobj -6248 0 obj << -/Type /Page -/Contents 6249 0 R -/Resources 6247 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6227 0 R +2410 0 obj << +/D [6681 0 R /XYZ 85.039 652.347 null] >> endobj -6250 0 obj << -/D [6248 0 R /XYZ 85.039 781.388 null] +6684 0 obj << +/D [6681 0 R /XYZ 85.039 615.228 null] >> endobj -2334 0 obj << -/D [6248 0 R /XYZ 85.039 555.804 null] +2414 0 obj << +/D [6681 0 R /XYZ 85.039 447.626 null] >> endobj -6251 0 obj << -/D [6248 0 R /XYZ 85.039 508.467 null] +6686 0 obj << +/D [6681 0 R /XYZ 85.039 407.462 null] >> endobj -6247 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +6680 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6254 0 obj << -/Length 3659 +6690 0 obj << +/Length 2774 /Filter /FlateDecode >> stream -xÚ¥ksÛÆñ»~…ÆùvBïG¦ÓYQm¦–ìJLÕN’'"‘ €–õﻯ;HPN§ã‘qØÛÛÛÛÛ7èŸ{ðÏ?Ïb× óó4óÝ0ËÎÛ3ï|3ïÎ|Á˜ -ÊÔÂy;?ûáïItî{nîåçóÇžNìFqx>_þê\¾¿ø4¿ºLÃ0t‚ÄLÓ4sf7ó«wß¹½˜d¡3ŸÝ¼c„ë;~ÞÏn~ú8 2ç^7W€=¿GÐÇÛ¬ù{Ý]\¿½˜ü>ÿùìjnx6Ü92üùì×ß½ó%îç3Ï óìüÆžëÃôö 8vã(”÷ÍÙÝÙ? )ž‹ÎyÕ˜|â0sã,<[òýÀ ýà<=7ö"’ÐêÏ‘8»É4Hb2õüX7Û²‚Á -§SG1Ö¦&´Ñž`v¿cøo^ì}÷R ÐoŠî-¢Î>ÂÜÚZ-áuªí`©Ï3°'Š -ÛÒ‘ŠFue]ñ\ýˆÏØQ› E-pÅš8¦3´x% Ÿ©âËé¸ÝfUÇ®®ø‚ÿ iŠUÙvF4XòÝZp¾b¦БðôܤïÛÒO7…¡GŒüU0ìûÉÜ(‹eÞ_Œ‘ ðBÁøÛ7(€²Gqä\0G›z¥Åן÷E‹èP¶ruQñ¨eñ‹œºZîD‹DÇÙ'’ñ4ðB7Ï‚¨Õ¯¸áp/€Hö0*ÒÌèQSÙ"÷@“*½ªàMg¹³ßšKR]¿&p6¨æp e'°JD-sµ-!-Š*ŒœûuIJ)çà µràVÙêó#{…­a1ú7Ï~/ßθ#¶ -- €iY‡úPpšŠHéw<·CR5ii¹D檕YÎs¯!oY4_JmY,z—˜±/hÎ42ÑhyyóŒç«qã§US3oXØ6SçͲÞ*²³7¼ÆTá97/ŒÆÖ-J÷æ!f–9‹ºzÄo{÷’9ð²y²R––@Èl‡Öš‘HýFÇÚ§5#È€T¹ÂÝJ¼¡…¢½‚Œõ§‰•e¹?ƒBFÐ3i+M¶Œ¬Ã1‹›‰BjÊN\).Px£®Xtû¦`¨Þ‹ni`ÄAÀ=©ÓR_öó)÷UÏ›+Õ1ˆá -a.Ì<§÷a[œºV˜"½Z­{j…[kš‹ºhG'ݪæ…'*ÕÑáešŒÍÆ?fxäTìl¾”¤ìÕV[9ûŸ(%‘¥(³ü7Ài·ˆ# óI;ï ×æ¨FDEÓ2äy]3¸H²€¦ÞèEšnÙ0„]EÅ/§R š$‚l„Ÿ~Kaé…w®w¤X4îè"h(Ž7ÕŽwÄ'avZÐÒŽ½†rZ„l®€€¦ÃA:(@Ê-h¾¢¶|؈+ƒ™Nèdk0óËæå·üÒkÅk¼Ð5; Ø:‘>ÐÜÿ?õ½ŽÊ”›H7Qñ3ÞsÙØñ{Ï-’\6älYàì­àí Õ ÙÎ-t¾õΘ´½Å¡¡çìž(åù‰DSäÅS£Ë„¸â)Îã<‡mSvP¤(–Å ±VèIpqW󓥋ƴᖠ„<æuÃË«uÎ¥ ¤†œÌ ÈS¦ z5òA^8ôç볨V­ÐÁ”è)¥/ Ñ ø~J§p'mð‚ö‹P¹YÙ+V7äW=Ÿ¼œÖ ñÄÙëaÒŠìkè[-<Êfµ9¹V,½®ßr™…0EÉ»µÄ×(¾ˆ¾$•@!ØÆeéÔI<¸aÇ÷vöñŽ¤CYK7Ç™ÍQ±¨Æ\m[‚›=:HyÏþ*L<ç#mÈÝ‹‰>| :;yŸ8ˆ4ŸÚ Ó8‡ë`›¦—SÑAW9GÚµûÍ°öˆs;Ÿ…>\òOû¡^•¨–ºä_fŒzâžGô–™¤ †ši|íŠÊNáþK~›‰fš~…Zúªñž½˜˜’Ë ­z^Ô¦­y³þšá¥ÙK€€qÝÇ›†!PCúοyŒgÓ4ã1zœ 1§™ó Ñ”˜*îÒ1üê«ñçd§+s*ž·®GŠ,º"˜¡|)EŒæŠ#ÓÞñu ¬ÝcL™`…¡,ë="•bWifÉ0M­šfŒä`<ÜñmÏ/?ý@åxž9K$Or°¹×â+ÆJ|Üy ¾nŒøùðå0±EØZÉ^àpë±mq9u»5D=€|hi¨û±aˆ$…ž•0w<ã{S?æ9üÀ }~¶+ìŦàg‚Ë ) Ö+àFr8¥éR#œÛÀÉC§ä’ñUÉSüëQD>lS™Ü?Eä\€4(=DŠÞ#W¡Sp)4¿è[ùŠ*ž.;y¶2©ëoÏYÕzÚo¿Zã»èF¿5îaœv8Wº-‡®j¤h—~¯U¥¶õ|:•¶VqYÆÁ³·Û×;Ê3êoF,¶h4&YŒMŽV†[`Ä-ÖˆìŸr®È.êx‰]#ÂÂÚFˆ­Eåp,YJ!t[Î#´Ò1pÙ÷R²H¯x¬›žç×zÍ"Ì(»¢~V¬“ÊB—¢1¦v»rðm ¦Ø?Àn.¦ÆøºÈ#éÒ6©;ŒGÆŒ-Ê­Q¥©Ê³ƒh×õTj_­»] e5æ êNˆ‡m²5Œ·Á—ñ;‡â¤$…Mó>kDtS<`ðrþàNžÐâl žå¶ †nm®Ìƒè½ád¥Ï2 Ÿs ÷Gú)Û{7›ö¦y¢i\7Ò¬>>´6YoŠæ¡“tÃÖLr`G”z’%¡VàúIØØ #‡«7‹®;ŽKÙ›YLjœç†_¢¶P²gU úAóy9Ñæ;p‚sNŠB»H‚—¾4GAoßvø%Öj3ÉÛ𠙉+¦BE×å*­akµ²">6j±®l;ª­™Q€¨ßøÄ%7%ðK<|WnÝÂÄ|¸[“nã‚â«‚ÐE7¹gùø‘x}ÂpULš¨¿~ü¸‹Ä? )Û“^F·ŠPo(ð=tm§º7ÔQôç<î–+ŠÞÔ¼%`ÁMÈ/“¿aôR»)¯åû©¾¬VßÎaDŸãÄÊü‚$wƒTž®¶“0p6d·˜£8þlÀ(‹Ìwëñ¼47 _O-œÓ¹sg¾?HžƒÃäùöÛÞÓÍÝQ•&94ÆVnNŸàRˆ¿Êes:ösÏ üÄ2O8o_ð˜a–áíÍלÞX NÜhQÅÏkÖG•“@ófÎs‘ëñ€2"xžçJt“¡Í=øU7Ê´\þ(— èF±¾ì1øóý#†ûÙ °rL$Èàž“?Iäî?wó«ë0¡Åp韤óÓíì_W·wcd<×ü²ã[T® (=6ÌQÝð¸Uú‘ÉìÐ\UYQêK €±sÁEEÿƒ ?îiìÑ»Ÿ4@ä¶",Pí¥¤áNX•æ‡ô -n>Œ3j!¸~u7&h ¡·7ñüýO”øÀ¶ÕÝ–Îêå‚»éS\þýJȂˆ#)¿Îjg«v;þ®q:»ít$¢ßû`?—êšßD= 5Š$O¦…ÿãˆTò•Ó4'K‰þwØ›ŽËz÷Ò”«uǯØg\pó_ý<Ïxt].šº­;½¬ÙDöïFRÙˆ½ -ŽôSñ£UØâ±¾.zy,5˜;Œ8zxá')Ø_÷¤°Äá -6ëTº9{’Áú Ö’Ä*u {)@Ü[< Ouc6ZÖÏ-ˆgŒàŸBºE]‰¡ N†: -"` ™øD­"á-ÑöÚB¯ªù‰ž”inw{*ã·E{"x€2ùXè€?füÿúaß¿ Ý,ÌÇãO !4ð5/(¨0LùÕ¿7|^Ý|™/”RŽ‰ù"Šbçë?o¯þñf.%Àªtîáåfu?ÿ}uwu³êw[“¹þyõëïîlÞ]¹B%ñìcWHXÞ][øJ¿W÷Wÿê¶â5Æ_ÒP,d"/˜VD(…ªN¬úBù¡­ˆÀë“"àì +Nø‰sŸîRÐH9i¹áÁz›Î•tê&k›K:лMJÕÓT21ôDè²y>4̾zäg“îæ^ä°x¡£„ûFQà4h#\Œ#û:-yð›¸0–Ž>Ë1/ +xƒiÉmZ<óèóe¾®æ Øh/ÎÇN…¿à?2ª™}»ÍÌŽuFÊ œÛ©Ú¬.SdR¼Îcå!µô0¯e|.içc£Ù<¢nAe –HíÈkb›±›>ç%Š†ß(ŸU³kÜh›Öé˜ó) ÷§V‹ÄÁ, c‘„á¨Õ4É¢é|éÔj†E>”ù7msK¦1Þs*†ôá{OÊahθßò#5dµÍáôžï:æIêÌx¼Fk€ÊX™¨*ž?4ÙFÖLÀšltð”\ç•WPå8V <`\j~«öäAY¶9zÞмŸ–EΜƗ +ÄÔm²Ç}°h‡R]}\ÄïÈ9*2”ì"~BÇIJÈcïô•‰¡qú‡—aúÏ4EÅOÎç<. 5ïñ1‹Ü¬ëÓQHR Ük­úã  +Ûl2AºT\)Q"ëûsThxA‡«]PhÕ®YÕŒµjûù”$*>’Ì5’݆|Tø +²YÛ¥± Hœ/‡r,£PøÊÓQÕfM»Ok€aŸ¿ðø¿üxªñè8úŽ¢G¸A:k¿‰\™° h&•–0£‚½Éo[í-‘+b/9+²Lš³r°M+ç†zè²g£Ó¦¸P€òº ¿X[4‹v?I„t=S´ûºh¿®Ê—¬nr’€ä‘|²Úñ[UèÚ·„@%œÒl>%¤Es±†÷¡ûð\F•ÈGÖéQCA9Eɇ&_rJ ÏŸ$2˜aåSqÀä&dzaY¡…0R+~¦¥.Èðe®p¾*O‹yíûÌås±jÃtÍUQÝðTðÀË«¢tASÖÀiß¡9˜Æ`á%!Œ5Qk-/Î#7|v…kø‰Ü0«ñ‡çÅùtQ=®JÃϼ¥ÞbÐ#Î  Ù™°e°m_Rl4S÷;†áË_¨ÆØÐÞÚ\Sœ58gH­)À¹]h„É…þ¨t=Mª;6 üÙÀ˜QBÃãc·moú*åé%/ò¶ó–Ð6ßæ46¼bPBƒî‚D¦ÁÅ…úIS|±ÂÄP/,òó89Ý“¡=sw*€’ð¼!ÿ“àÔ$ÓL•ŒEŦ­FFR·Ì ŽAÔ-O·U‘ñp“w1¼n«Z+±ikÔ-{/d¦­€LÐë)%"• "b“S3.i¿Îºª”›Úè<»aÏÀÅ‚¢¤Ø׉yùTô¯¦äHËÍ%TV‘/âdúÒ¢¹ˆÊ +ZÔ@)ƒÊFå; +§}Zf~îâCþ‘ÿ†L=ÍEV`æPq¦¸ï 4ß 1Ñ´®ï[\ˆ¸ž©êg&;Ç$Ýý)™ÉîRìýðºÕÀåsXjxògÖ‚†ÂÐw>uL߈wãÈá¨BéçñΧmkª,èÒ)÷áôÑôzñ…µD-íü¤ó¼ö¹ÃþýÃ@o ’xÚ0 Æ—v•âJỪÛEÏÎÊ|7qO244g‡u‘ôg¼Çÿà•0\¼l©”¡ú_»T‰—)„“­"Èv[Q£¦?ù;?¶i³½¤7èÇâ8œÖ[O3¡7Mô¦Þ&öz;á8®7‹ãj›Õ—çÆIqü2‡Æš&r.e|qäh¥»FWß7¨RRåžjmÖ*;xÚöµñ!ëÐ-¬/û~Æ\ýà$·2’oá IxÇŸ÷ÑŒódÚ?ÔðPËíÛý ]l‰‘XàÆ|í}¯ï$úãAf –ºp¾ 4 ×9eÝuZ0Õž¶Ô· ×HüÖåÑ•BÂÝÔCnrÒBŠXßsèã5æÚƒrnò¾æI¬&öd~êãÆú¢Æ*è+sÝ@÷Z$©Î=|)t›®l2WYlX²4o]¶ºùz½¸û<ý‹}‚„g'“ÁbÑ\CôV°L1ì‚å”ãh°Øÿ2ÈðÕÇh®à‹íïxªÓö=z]þxv]¢´žž´8ýûŒ^4þëÌÂì5­ +xB­`«âîö^ Œ?"Á›óË}¢ b$rÚþ=Í„ý5Ñ›öŸ`ØÛÿ„ã¸ý-Ž×‡ºûÝ‚Ó3Aþ–SšQ×ÆðO#æc2?,›Æ_[¨Y›d‰lúçž.êaµ1Oo>áJçðf#Þ~“•Ø?¢ËItn¬{Õs1¿Ètˆe!$Ý'ЗSŸ˜{ö^]0põ4 FtÔrƒ"®Þž­‰Œ´f߶ö͹õsÒ_þ‚ˈn{'ݸ§™pcMô¦O0ìÝø„ã¸[/¸1Æòðg %Ü3sPF@§ju{rÀ\¢‹ÚzÞAà¡Doþfš–‘k~˜×–ÿºú/~ú€D×Ë럗Ÿnþ½ÄvøÖüJý7ÝjE„evýS¥ËÏS|ç÷XÕ;.9`ŽËºoð¼Ó¢ž]è7)Ø@ß"bžÏ‹ôA_ÒJ{VA+7 +ÄI\ûÁ-´!^ôÔd-5@Ú᎔ÀÛvÿ~¹<"mwiýœ·b]‰?öËÇ"/ß–Í>[çi±Ôò (ØàoßjÉTlÛ]qæp‰g +g(8¹Pcj’EO3ânÃ}Frè:9 ãYöÿëôW{ ‘ºÙÏž4² ´*JNå d€X ü?zÕ’endstream endobj -6253 0 obj << +6689 0 obj << /Type /Page -/Contents 6254 0 R -/Resources 6252 0 R +/Contents 6690 0 R +/Resources 6688 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6227 0 R +/Parent 6698 0 R +/Annots [ 6694 0 R 6696 0 R 6697 0 R ] >> endobj -6255 0 obj << -/D [6253 0 R /XYZ 85.039 781.388 null] +6694 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [283.315 403.886 316.216 415.576] +/Subtype/Link/A<> >> endobj -2338 0 obj << -/D [6253 0 R /XYZ 85.039 420.88 null] +6696 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [304.377 87.121 539.579 100.023] +/Subtype/Link/A<> >> endobj -6256 0 obj << -/D [6253 0 R /XYZ 85.039 402.614 null] +6697 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 75.39 194.853 85.868] +/Subtype/Link/A<> >> endobj -2342 0 obj << -/D [6253 0 R /XYZ 85.039 222.638 null] +6691 0 obj << +/D [6689 0 R /XYZ 85.039 781.388 null] >> endobj -6257 0 obj << -/D [6253 0 R /XYZ 85.039 203.766 null] +2418 0 obj << +/D [6689 0 R /XYZ 85.039 761.463 null] >> endobj -6252 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F11 2898 0 R /F20 2865 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R >> +6692 0 obj << +/D [6689 0 R /XYZ 85.039 739.701 null] +>> endobj +2422 0 obj << +/D [6689 0 R /XYZ 85.039 528.463 null] +>> endobj +6693 0 obj << +/D [6689 0 R /XYZ 85.039 488.299 null] +>> endobj +2426 0 obj << +/D [6689 0 R /XYZ 85.039 374.894 null] +>> endobj +6695 0 obj << +/D [6689 0 R /XYZ 85.039 331.941 null] +>> endobj +6688 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F41 2994 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6260 0 obj << -/Length 1746 +6701 0 obj << +/Length 847 /Filter /FlateDecode >> stream -xÚ¥XmoÚ:þί@ôÃ¥RÉ+LÓ$ÚÒŽÝ–ö¦êj»º2‰«ÆfqRÊýõ÷8±ÄlÕ´U1‰_ŸóœçÛkºðÏkúŽë›çÏñƒf°i¸Í|¹ixªGGuéú\Ìï®ß÷šžë Ýas¾Ìçé;½¾ßœ‡ßÚ—ŸGóñãiÇ÷ýv÷½sÚ9?´'ÓùøæÔk?ŽN~{>™ÞdîfÙói2½º?íÚOêÅt ½çOòÕý㟦×üsÖšî.F§ÿÌ¿4ÆsƒÙ |C øGãÛ?n3„Í}i¸Ž?4wÐv>o€Øé÷|õ›6f¿ÌTÙ·^3uÌ>}àôþ¡ü~Á@^wèô†½æyßuún/µÐÉi§ßí·¿»}wŠã‹Éý š^ö’¡ `3>¶Ç(Xg¯1‹£}ÖkžÐ0k/pö|ÆÛ8kq–=‘z’&ˆf¿)aØ‘vƒMt<¹ÇaÓ|­fœ<¨yÂ0ÂBT/½¥(À¡^,{Æz–%‰„pšlÔ÷%§”ïô¨Å>U ,ààØrØ[éW›mãHšÌ±à—`#Z¸ŠC‹kö‹KÛ­À[¡Ø†ŽÔ&)FÂ8BÙ‚Ô»Há@ p뤥 ­a°UÛ‚¨}­0âTH„†óìbÆclí]Ä(Ò— -¾±Êˆ–³S`{0~ €j„3Q oÁ¹’ÑÇyVÃ=½±%¡¸¼Ué0“…~¿#±ŠŒ;D\ð¥‚};šª÷ˆ¡Vï:¯jˇwšÚt³æ"•þ—(lñåGÂfyJgÃKüc&¤>üº|âýäáq\÷ùêþîÃÇoaŸêúM¦—·_¯Æœr’蟎î4q1¾™LÿÝ‚pOGóZãéÕ/uüîù=÷•±œNŒ³Î6",ÎCØ=£f²Ýò(NÕðMÔ¹.{±ýlѦC2å¡ žàš–îN•˜b®U59 šF>#ˆæ -ª;˜Á©F©å‚µVº‹½ñ%Jh|–/D i£jm]°ÖW3,’8õ@‘δؠ¥ñZ¸ˆ$°Ñ‚þ‚äK­PöF„ -ç7ýz`Ï#¾k•â¤¥%we{ Á‚ŠY ¤~Ål)-÷8 Kbg DZµ¢±ú±æ»_³ˆøNhëi¢|¥M _H y°Àkô‚ËQPÔAÌ^HÄ™”~¡áñ;*id, •Ô&€±ohN:¨`WE=—5ŸaØ‚@vä *¸Iò:UÚ*•ÔÒxƒ9+…Êiبk ¢;´GÑÊ„Õº¼…œd2Ðj2¥©4vÊ1»5fõP†öB0Ro «YÊѽ‰«VUÆ8P¼%»&x¼¾Ìª˜-T·s[Ëˤíí ¨:žíš¥T…”VŽT«Ê®@ÊPdi¹G5!Fy€¨s|µŠòKQ_§—2Š)Çiª”´¬¦Ö•Q(ùOO¢++oÙ¹D27†¿\­KȤ*ਦøŸX8º}ý=« ÆmÄátKëlÐvk¶¹45oíÉBW¢µº—m@/LÌÌv`k6hm Ù&Ñ’•›Ò¹j„$y&/åCS‰Åf6Dòt—swmÞÚ& J‚VEE‚_Ñf«›VÑ6Ò>Zi®[Ä žŒF‰°*ÿÖ4¡tnÜ3 TXàxêÑÆ•%昰IÆ ãŠŸŠZØü0²hŒI i¸Ðûï>ã}™¿ ëŽQ²@UðeSìEŒ7²$pÖdqÀ! 98N?«œ*Û± båoy&Ü`Y-Ê_ Љ̤©ïkŽJˆð -|éÍÍboe»2‹Ž¤5íä%O -'ßè8…~ –ÔZçíFôN3˜ÆÄPÛd›êH¡lH ’ãJ·Šx²ÍO»+,÷§l6ÒÅ¿€P?$Ž6|@“°&xì"¿lãt}+kÉÞœ‰¯ “äL •$}Ö%°¶Þ,pÚ0Jè„©A«Ï¸æ‚Fë%aÌÚf·¥¼žW#z± wI¶Ÿ™L+ki¶ÚPÌÏŠLÍg8+ZJ©fÕ¹þÑ[2…~jÔ7_PTø º ¼¹–wDyä8ß|UPr›çv¡—3„ÿç§î{© c`©Þy)}¥G!†cËçoz¯xo -DþC!½º¬Þ{¾"´`IÏuÛ-`YF‡tÖ̉^¯•ý†eR—é›Gè\JãÇïn}×éÝ·Â_ê·®uÍ­vÏwþÐÜÙzÅ;Û~·ët=EÁ÷Ïm¼úú÷ðÿj2endstream +xÚ¥UßoÓ0~Ï_‘·¹õìØNœG6 ¬< $²Öm£%Í–¤ ý÷ÜùÜ4ݺ½ J­ï÷wß] øÈØ.TgVrem<¯#¯Àò1’Ác\¦#Ÿw³èôƒIc)x.òx¶Üç1\Ï7ììÓÛ«Ùù÷ÉT)Å’ŒO¦YfÙ/g_ߟO$;°Jv ÂùìzòkvφÂCJ(’cÕ‡èæ—ˆ€ð2\å6þ gÁ%˜ëÊr£U«è:ú6¤"›Ž)êX“;©Ìyž˜×‰H%שˆHÀª¹Òé˜#¸Ú½§Ð½Ñ9;kêºm6ÀJš1׶H@3Q’µÝK„TG À+¸êu¼*ç™x%Ïã• OðJ&´ìì + (ºa§l^lNzêà~s$,›íûY¼ÔI(ò*ؽ+Íó-K3ËEê±þÆå)êI‚Pà„Û¦YÙÑÖÍ=»õ}U”`Ü”ø^‘KÈ!¨Ù‚ª* +ª1Z²nðÖvDÍË;þRW w¨;áØ4Nè°eþ +\A 8'† %)ë×ç…[X¿êÉgÑtt˜c?뢛/èz…Ö ›£›¼í¡7éKRàqÛ9 HšõM„=„Ð?øåÚˆ¢/èDnð»v;àÌB–Ðó=2¾rOJ$^¨ÜÓp‹‰´G<7Û–$LåÛúçUé<ž¾óÝv±<ˆ…lNöc[û¹aÔy›QÍÅ‘oŽ¤öëRàÝT QY,]’”+܇¦u”Êϱ ykG+ãÉìpòñ*haX·ö[W-H¤Et(¤¬Û"©÷žç'Ú暈ˆÄ°rx9HQÑtæEEr9Œ—Dð¬wS«|Ö:QôeƒÍíi*Øg$ô.I Z9 +ch]ìˆÌÞˆ€çù6´îQ—­Ã®LÊî ¿ïw8ƒj3毟§µ§œÓJÅ.P^¢³2épëËQ”7tj–mS›òtÎ} ,ˆ¶«÷L(`‹ F|V>08-qO¶›c7a˜ á‰T‚'ùñ§>¤ù¯?Âá™ÕŠ[•eMO°ÜaAØÊŠ§x²ÜXõð? âêendstream endobj -6259 0 obj << +6700 0 obj << /Type /Page -/Contents 6260 0 R -/Resources 6258 0 R +/Contents 6701 0 R +/Resources 6699 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6262 0 R +/Parent 6698 0 R >> endobj -6261 0 obj << -/D [6259 0 R /XYZ 85.039 781.388 null] +6702 0 obj << +/D [6700 0 R /XYZ 85.039 781.388 null] >> endobj -6258 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +2430 0 obj << +/D [6700 0 R /XYZ 85.039 761.463 null] +>> endobj +6703 0 obj << +/D [6700 0 R /XYZ 85.039 739.701 null] +>> endobj +2434 0 obj << +/D [6700 0 R /XYZ 85.039 739.701 null] +>> endobj +6704 0 obj << +/D [6700 0 R /XYZ 85.039 705.159 null] +>> endobj +6699 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6265 0 obj << -/Length 2628 +6707 0 obj << +/Length 777 /Filter /FlateDecode >> stream -xÚ¥Y[sÚH~÷¯ ’¨ -².-SµvÌ&Ì8ØkȺ¦&S[£IØÉ¿ßsëäMj*å¨Õ}úôw®}Žð:.üó:Qè¸Á¨3Œ<'ˆ¢Îr{ávž`åÃ…'}!éÑ\Ï/.ÿ9PÏuFî¨3_ø„Ž -ƒÎ|õG÷ýÇ«ûùø¡×‚ ëœ^8Œº“é|ü¡çu®zQÐO¦˜àÓŒŸ“éÍ]Ϻ21õü§î~³Tó<š]}º¾êý9ÿõb<·˜-À7BÀ]üñ§ÛYp¿^¸N0Š:/0v–·€Ø U ïéÅìâ_–¯©ïjÒODNç - -Â#yþÈQ#Õ†®ºŠ4ô¶×ý°ë¹>ጔãùA¯ï{®ÛÝå»}½þ €··÷cF@ü¶Ì÷ÅRóÎRϺ@éJßC¤£ÎÞP8§ù2NËâ(†Ã°Æ:Óz¥W¼u<¨6rX’-ÓýJ7žv4x{=þ0™þçêaz5·C};™¾¿ý|3æ·/^ ðÏ€Åñn¿H“%Ín7yY•?ˬØ$Yþ³œÆÓ›ÿ¿MöIv¢Àx‘?ËP‹·»T¿;¡xïvY¼Õojæ¥ñ2Ϫ8ÉJa%;½Lâ´þrñ²2L”TÂ;!¾' âL<â1F:äc ºÏ®Ðiƒ“½;a~8¬Ôr„ /¤_'ÆcËÜ'²Ç"íBöíK m…VÉö4¶êª»‘è|©³ªˆÓô;¿nÁ(hƒÂxQ’ÌëS9Úl…T~/+½­ ½Ïâç8IãEª&×ke6Í+m0ÄÕ š—Mna–#wqQñ8 $Ù“ñÊíô!„¹(\ÇËh#Ï¿îwï^Q´þUëåjaeûíÂ#_7i¬&ÆÙ&Y²Ý‹Ê^’4ÔÛ]aco§ HnÛ8[Ö5X6ßèB®;•ÑI–ËD¼zNJ´FO G‰W¯û:T¢­ ÔB+}×u-'PÁIUàCÉ  vp¹bú…IñJeÕ ._wR‡¨8Lˆ?ªˆã­Et%?-­åÀ£!7ÿ×xÁR6rfuf{°O¤¬a“±ø¯8`saµÎ÷Tûˆ2F죢šzÏ©ØŸrÅ 1‡ï@I DkªҒߪÍ!ðˆöf:ƒ™w¼ -u·-»18¸Å›ýãÝa¡0(†4¡øJ6^@‘ä&¸òqêî©·!Bp6Œ* ê@ ‡VÁG-îpâ3ê=1ŽÅsÍIÔè‘çÛØq½q”µÂW°Ý¢çF >ªR¦³ó|4Ó… bxª“ØÏPq\"fw¶ÞenX’‚»Kœ8˜^ÀTøÅs&¯Gæ³$yÁÌOãOš1ñ©;¦LÊ–àk«|¨¯=õúá#šöÊÁ÷BÇ¯Õ ¡Ô xùéÚÁ¾ÑðõŽñˆ¦½vðFÊH {%­Ýd:3cè>R+•ðPz=é¸ô„W]ñâÔ¦|³ÞbèØ!q‰rñœ,5·’rpÈ5'ñm‹Ú°u§½Ê|Nûø´5'ì-ÖÆ<×õ.á?¿Áò¥'&r3Q&@3{=%ƒ°0‘ÈwÒ Ž¥Dú™ i”ðH^– -óšƒ+&¦èbþ}ß«].À»¬rjepsëâ"¦(Û ðW˜=5])¬ Û9ñT8ÅßÔ ×j/r† øß5OSWë:þ¨é^‚?ö·~‰<| œ(5_n¡ï;¾g° ô ˆNñš_,ÏÿQüG£endstream +xÚ}TM›0½çWp4RñúÌu¥nµ=ôÒH=´=°ÄYP¤|4ÚßgI7D‘ö¼™y3ó1øñÈhÊde†SiLT7,zË— ŸJKª•‚÷Æ$X“TP¦²›˜9G’ñœJÅó¸Ý<<  FÓTFÛ} ’FÑÑv÷“CãDkF¾ǘ“—"Ndš‘Ç¢_ö8B¹%zLËÕd=}ºÒ~­¡mê~û˜ÕákQªó0|1ÿ)–ŒØbœz‹dÔl +ÝØÍB¶­ýŸBÛ¸&Þú.Åw̪B($Ó™£ø#6 +»*'­Å†KÁÈÞ:–;·j%öí0zÚÑãO®ËÙáÜš9ιBw(úùgZ8jÔÛ«·»íå9qӅ݆Tn¹ÁäÞÿuRìh¤RìŠðMÝÔì|Œ¦²EãHp Åuh;ûÐg ,‹ñ†|†n?z0°-°b )•Ó>flp|R’7Ÿß|¥€š¼ä¹Ó~ûê­èŠÆEwº +ÔûÓ€}È<Ô{ ¡  =¸4e¹qäŸ[/-HÑu9¹µë?Áu¦H½G³^PlUà)dðÂÄÛ? SéVÉ¥«Éƒ?ã&ã·º¨›)´ Ä=Œ]_ÛÙï*q9 —‘ô³Û¹ÆVsø±ò±~wsi3hãƾ|ÿ¼PÂçÀ¥„>¿ý"Ä}O½-ÃäŠñ²kß É¨¸ZÇÕµ¼ ?.¥d’¦"CêÒðÿji¨6r=ã?LÉÉÇendstream endobj -6264 0 obj << +6706 0 obj << /Type /Page -/Contents 6265 0 R -/Resources 6263 0 R +/Contents 6707 0 R +/Resources 6705 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6262 0 R +/Parent 6698 0 R >> endobj -6266 0 obj << -/D [6264 0 R /XYZ 85.039 781.388 null] +6708 0 obj << +/D [6706 0 R /XYZ 85.039 781.388 null] >> endobj -2346 0 obj << -/D [6264 0 R /XYZ 85.039 491.353 null] +2438 0 obj << +/D [6706 0 R /XYZ 85.039 761.463 null] >> endobj -6267 0 obj << -/D [6264 0 R /XYZ 85.039 470.36 null] +3129 0 obj << +/D [6706 0 R /XYZ 85.039 653.495 null] >> endobj -2350 0 obj << -/D [6264 0 R /XYZ 85.039 386.44 null] +2442 0 obj << +/D [6706 0 R /XYZ 85.039 653.495 null] >> endobj -6268 0 obj << -/D [6264 0 R /XYZ 85.039 364.031 null] +6709 0 obj << +/D [6706 0 R /XYZ 85.039 615.228 null] >> endobj -2354 0 obj << -/D [6264 0 R /XYZ 85.039 229.148 null] +2446 0 obj << +/D [6706 0 R /XYZ 85.039 558.141 null] >> endobj -6269 0 obj << -/D [6264 0 R /XYZ 85.039 205.83 null] +6710 0 obj << +/D [6706 0 R /XYZ 85.039 515.856 null] >> endobj -6263 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R >> +6705 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6272 0 obj << -/Length 2697 +6713 0 obj << +/Length 393 /Filter /FlateDecode >> -stream -xÚ¥Z[sÛ6~÷¯Ðöe©‹!^3»Ýq'u›Øi¬®š>Ðmq,‘*IÇö¿ßs/)ÍN’±IÀÁw®8´;qà¿;‰|ÛÑñ$Œ\[GÑd±9q&0òñÄŠ™Ì:4ïæ'o>ÞÄuì؉'óûvßö|=™/ÿ´Î9û2¿ø:i­-ØÓYFÖåÕüâãÔµ¾žM#mÍ/¯>2Áç~Þ^^½¿žªÈº•Ž«  žßb×õ×ߪù/üvsöùÝÙô¯ù¯'ó†ç†à/F†ÿ>ùó/g²„ÃýzâØ:Ž&ÏðîØ. oN€cÛ÷´´×'7'¿7Kñ˜7áYCøø:²ýHï¤ý@®Šm/ö&¡ìØ÷ ¡ç,¯¦3_ùVõ´ÝeÍóãªÀcÁ3Yˆw§¤å÷´ìÍxyy±;?8ýÍ·ËÅ,°U¬jÇv€SZq•–)béY/€4MÅ'­àZô ¤³ŠŸõJÈ/¿pG²ºe ¿`ÀµªŠ‡‹{CÏ#ØÒ VD[~G¹¦¥="Á ì(Œêe‡†`W0êÙÚ vWÙÚU“Àì»àÄ ‹>h#@j› pWäÀTZeYLµc•Õ?²ÌA~Zâ§'€†íÙ>¨ò3?ÿò±ô#oA`½½,6À5  óvªÑJÿYsÌV| -4hN²€ŽÇ±#„>0s8ºuhÆ­Ö÷C;¿y;<‘DI9âUXeš¬ùmÊé’‰®“ T8å¡‘*É–2ï§K!FÅW±om3T•îÝLA_y J¨u—H“ôÄøQ&¿'o°áÆ--´,Ȇã–è-žj^Åì.¦·¯õyQ³öà12 4 _’É(—ä( ÷Y4t’抦‰öÞsX¢ùr2´¬Nos8û'bLÄÒåŽ< -¶!&°{— ì#o—A‚8„ -qp­/ü~¶ÖÔ•í‘íÚŠéž3ˆpô–§õ&!ž¹Cù¾m~`ç”08 ’JAJƒ8D,a¥v"%÷}s|çëÒÓ 4\înϤäLЉ¡Ÿrž”¬¸¯=Œ«Yƒ£zÑ" ¨zä¡îÁ\Ù37iBüM{nÝW›$P4F_ÊuA>löDÎ0­I¶M´ÂN暆9T‘w|©ÓÛf*ûWìÉSz§*aÁÞÓ.ÎÒÞ?µ¢© >–C0® 4¦ìÔŦ• £ƒòüž”EU»Ä¾==e™†"SEÐhR±CŒ´¬p=y:o”7®nÏ«LÜ¿ö•X!¼ÜL#Dð}wϽ`_ÃN!aùî G8n8"gªòFù<0ãǺx@ Øó'}åa`™A£Ó²4Ž·@φòdÑŽ±ÄÒóBÛ?’XvhÆ£š§µh·Õ”Dµÿb.IÉÆ©›5i&t=sÇ@F-ŒvàJq Ï‹tõs,õ4\7œððZšñ¨éP‡t„³®¡l6Æw3µ¿Z³sï *•¸ž­¤•˜;9Ú`,™êíî© ·:à"5,9C3ëñ¹½ÞU,²áÒЬ„ç% ÷v„ÝÕ‡7d’ýýz8ë.ˆ~o¿óu–R6[÷º^ŽŸJ.YKú÷d {onQ Åv~?|µê¯/¡‘d…ö4r¤às ä–èÈBt äCw÷¹³_d0*è„ÄúòmÂÆkxön% -ó9ºWµ´mx©šðõ½Ì0ËÂ(.Y­a\V»Œ°Ò8³ßé4Üæ ·"ÆeĶwDR†ä€œˆä˜”Æ·22êï4(¡f§3‚¤)Ý e‹rujðçlÓ”:²i“ƒ˜ËÕ^mbG¤cðC -ùî´DD DÇ„phC#†ÝýÑÙoLW×óÝÔiÇfÑx}›1 œ7%—kÆW -g×<ÃäI½´Ð°”ü˜¸†\^ßðÒdaƒ\;‹E>Ë$@¤_%¨FˈÔn•ß¸¿­Iÿ˜t.±¶j•®×§ýoÅl´où vÿ;zh»‘’/Ø\³:û ºN7[|þœßÕÿù“øŒE90 _…¶#R* -É>T^¦Ï͓;ù8 ´Ìe)3M#Ñë–É!U…]Ÿ X!oØköþPÖ›Ogç¿áGTDZþåèŸ(ˆÞÖW—¿ÿqºÐøš>`]/g# ¯c«Áà?¼ÕýÁD§öhGz$ÂúJS1¼àÑ´Žwù5X±Çðÿä’9endstream -endobj -6271 0 obj << -/Type /Page -/Contents 6272 0 R -/Resources 6270 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6262 0 R ->> endobj -6273 0 obj << -/D [6271 0 R /XYZ 85.039 781.388 null] ->> endobj -2358 0 obj << -/D [6271 0 R /XYZ 85.039 676.879 null] ->> endobj -6274 0 obj << -/D [6271 0 R /XYZ 85.039 648.143 null] ->> endobj -2362 0 obj << -/D [6271 0 R /XYZ 85.039 590.109 null] +stream +xÚ}RËnƒ0¼ó>Ú\¿±­Ô硽p«z Á ¨ DTêß׋!Emˆð²;Þ™Ù…#Ž¬¦L:”YN¥µh½OÚ†ÊcÂG„Ò’j¥B|¡˜NÕÔÊTv3r¤wT*˜»<¹y F‘(ßLBŒeÔZòò GIª5ÃOõ¶"©4ß’”㯢&ïŠÕpÀ«'’áo€døíÐ×mÓ‘ü%¹ÏÏ*¦þ™¡Ö\ÔÉP*$•™¸jÂÃÊé¹ ®‚-37!L8ùd‚ƒ åð+ˆo{¿$m¼u•ý3°s8£Ž¹»¶–ráö¼ª;’*f𚈠WŦå1WÖe Âb¼•Å'û˜©ÇJÝ@²oãW_Áä‡î>ú/:¸éƒÙ°RüÜÇÊ tØ…¸h?²n€õ8uó#($O«a±]5!gí#ªÝÀ©AÄ°iX‡?1Ú.ƒÆ`w 7N¡×àÉGùtaü’Ñ0´Ùð—pFþ_d’15)ÒŠ¿„ZZª­\füyPË(endstream +endobj +6712 0 obj << +/Type /Page +/Contents 6713 0 R +/Resources 6711 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6698 0 R >> endobj -6275 0 obj << -/D [6271 0 R /XYZ 85.039 568.913 null] +6714 0 obj << +/D [6712 0 R /XYZ 85.039 781.388 null] >> endobj -2366 0 obj << -/D [6271 0 R /XYZ 85.039 447.579 null] +2450 0 obj << +/D [6712 0 R /XYZ 85.039 761.463 null] >> endobj -6276 0 obj << -/D [6271 0 R /XYZ 85.039 424.261 null] +3130 0 obj << +/D [6712 0 R /XYZ 85.039 653.495 null] >> endobj -2370 0 obj << -/D [6271 0 R /XYZ 85.039 324.915 null] +2454 0 obj << +/D [6712 0 R /XYZ 85.039 653.495 null] >> endobj -6277 0 obj << -/D [6271 0 R /XYZ 85.039 303.719 null] +6715 0 obj << +/D [6712 0 R /XYZ 85.039 615.228 null] >> endobj -6270 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R >> +6711 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6280 0 obj << -/Length 927 +6718 0 obj << +/Length 243 /Filter /FlateDecode >> stream -xÚ¥V[SÛ:~÷¯ð£}.Ç…ç+¥XqÏã„ey9>ó$+F^¢X™åg¸œÒ8Ëò“‰$lfùÐå U“âÓUž“4]¼Ûò£3.w6ï¬ûR4ø›s}+Üœûè®ÒÄÝ€,¸„å¥óP+;r¦Î—­i—v½ŸP%> endobj -6281 0 obj << -/D [6279 0 R /XYZ 85.039 781.388 null] +6719 0 obj << +/D [6717 0 R /XYZ 85.039 781.388 null] >> endobj -6278 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +2458 0 obj << +/D [6717 0 R /XYZ 85.039 542.44 null] +>> endobj +6716 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6284 0 obj << -/Length 3210 +6722 0 obj << +/Length 2227 /Filter /FlateDecode >> stream -xÚ…Z[Û6~ϯð[åE­H$uëbQ´EÓM‹mÛ)Z íÇæØBdi Éqæß﹑–lyŠcŠ<$ÏõãaÒUÿÒU™Å‰®VE™Æº,WÛã›dµ‡‘Þ¤Ba2gÆ@{apãG7¹ŠS,ÒÈ›"­bmR¤ùöáÍÛw*Y©$Îs½zxZ¥©ŠuªVyeb£Íêa÷G¤Šx½É²$úuFíz“F54¶Ýz£“h‡ßîíwÐsÀ¦]ë4ê7ë¿~|óýC`@öÏË*VyµÄb²Ú(ëB¿ÊžgqYåSþS'Êgüƒ@RUyþS<©¢wk`ÙÙñÔ;dv€#äydÛ6Šè[׺?“ÔàØýÈÒ¯òx¡!Ól•&q•T3UEA<~ÿi­ÊÈõ/ÀHQEu òÜÖÄ"ðÒCK†ˆq¦nñïˆT¶idøˆ‡ƒ>»TчÖñh÷Ä¿ãA:ö=HšeÙ0Ísê#uŽ0|êíˆÊïZásà¹5[†_‡ÊLÑ(YO`-ªˆ¶¸’Kçp°ÃšV¦jËÀ#‘;bΓh›ðÁ'½vˆð¸‡Ïg;ŒÜÚ9ÚØîø„´sÇCGûQ–ÄÞZ&<Óö ¨aZ#OxzÙÉ’^ðO׺Yßf*ƒŒDp>8´:iÞ~OƒtXþ!.»ã3Jzt=j/ÑÑû‘Gƒ| ÝvÒi›3nhiWDá•áej"h‡…ÌX—&ú{Ë C ÀCZbf¤Áâ²ß ¬7šè^˜Øw :'ajÚ®dƵñG<’Áà SãÂO#25I -ÈIRZ{{àÎs_£»^À}Þ6§¡ö‚„Á“Ô2‡MD{ŸèäèKäÐO–¿èõ¾nc:Ÿøðôžx+ð@ld~팭¢‰îúÑy%ÀÇ%’mµò‰[v§ý’‰Ý…¤`{þìd -ÚKÏŽP£‰×ížZÚo"’zr?0÷é4+(X$ŸUy˜Ú¸²ùö]žO²ªNÒ8ÍùÝ®3ÐþÙ¹gü{xÖ,›,Nùð$P°IŠÉYÙ! þÅJ™™<´‰j»qǺu;‰2“ØÚ‘Ðd…wj^&_¶6H¸oºGJí<†¸¤‘°Å€äù5©óô`{Šå{¡iì(6ß4¦,cõ7°kBsv™BÅ&Wv)]¿8ǽrD·À‘)”å›ÐäD~}ï²ý«ç¸Ð܇fÆ”qšÒ1¾›‡6äÎä!¡…Rú þ'9&¡d¿ ˆ…lRl =â2SBf'’L<çóšP'´0é‚Øœ "Òòe"ÄÜä\£—5ü!ÛðÇØSħu›µðGnJ;wLebä¶ë{7 ]’‹BàFÆ(&-£‰í*3⼶õFˆÄ#Y¶€Ó†[á8É -ÖÚ“û(IŠ±lå¸ #‹¢Å! t‘æRÁñà–Ï—!BÖÃm¼ìÚ |\ˆ.&Îtéƒ xÅ”-;hìöÏ$Kp„›éB°I“2N²JV™aßZp¯äLd}˜þ†ÙbK ŒÎIB&nm;CÌüÁ$N†<¨¶}íÐŽâ› òÀÀ¨8«Š™-_r”D55·+6zè½c¤Ã|nC½cÈáThMÆD?ÚBAU -Æó隣ChÂtë€ó{ µjYtÐ - ”ßÚ>P“›…É2ò ìv$’B~>¢2°‹mÒ{Üi$TÑö™¤Æ¹ÂñJ—4×£EÍ"óܸE›B¢‹è×€ÙøÞ‡;Ú{ì.:6g [‹5³ÊrŽ:3v¼ž.HNƒ/žq¸¾§JÐ’ ë%Þ®`Œ¯° ¥))AŸe¢Å£‹[tÀ‘ìc¸ÿÉ6î³0ÙÐyéµÎ§a¼ðŒîãpxàû™ø«0µ¼ò(ÖS‘ƒ{© < Á Ęh‚•±ÇÍn¬Øsìx›™²äŽD¬ä=’µ3Ýxèá¦udá]˜ê­ é,áËé=?çE'Ì +ú¢8‘d¹ï)¨® ^…|kÒÁçDfÜ¡ã"õi€ךhXä6ð -[1þIW1 -Ù4þªªŒ‹Ä£;¶UÐþ?ø'|ÿ‹ò,ÓùBÞøefÞðºûe)Ú;§wˆ) -Š×ÒY™„ÊÎÃ}IÅêç…„ærQðÖDIDVëÚÉxwBê_¼ç#ïÞ=a$(0íº—ûÑ+!7îyµ¬ŠliÆšÝBB«ÉÓe3Ç4°IPßÚÓ S9¡=C¯È†sjË­pBÊXŒ^ü¶˜bÃ4t݅赬/ŽË® 94KS€ÚÙž€ Ht%ˆ°W"ÆpÖÔ‚}úÀ~¹pbóÔrÃ⢟Ö /Bnö±‘íìx nÊãB›•›¥RxÄ~/ÿ›–‚…z3!¿º×kRŠ/‡1"Ý žå[@R1…˜ý5@UÎY¼àBò:_Wëð­ŒoaUWy93ÄFbe½ç†Ý±H%˜P°2RÇ4å¥TûÚ•d"SÞÑÿU>ô.A3²™j‚ãàƒ‹'¦ c§»|\"w¢ŽbÈÊ –v¼FrB<.U×&…Km.UœP8 µ´N -oËÊxe&JÖ³Gç‹vóÀe½ƒkçЋkÔx?ígõµé5ikG–þýŠZƒQ*QØÈ[©°uƔȂè0µ/ÏT”Qp,`gš=²@i`RÄïIQ"6ø ø¨3¼Ç8,ÕØãt/î8 %Æ=çÁ/˜TÂ,µÿSß/µm{N^ÙG¼ä:úw´9)ÿ÷cJ¬¡pa¹zDåaþ½­Ñp¨b#­ÛwcÍu}‚gÅLz>RÞ(¦¥Ùbª](¾êúM€ƒòà/m&ûnœ<t œ<_xÀ¯Ý ÑAp1%ùÞå €uH©/.‚_3ÁŽÙBòÍìÅ‹„ìép!È ¦æ<sf¦Sµnw´ÍLJ…cüe<¤áü;nl›ZžyaÁÕˆÖ¼˜BM7p&ëßjº±‹ñf†±Ÿ|‘>ÔOki›è÷ÿJ"®KjI‚3 xõô’è;o?çºw÷*Oiab¥óW+6šû•§4Ëc`ÁWž´Tž~±ÇG;+(x}ÿ»GJ¿Ú«l]hî’RÆUÆ•¤oPüiÎé(Íè–JÀ7sèÑq‚š#¿Ëå¢D¨YÆ1ü}ö–Ú4¢:èÕAKÂî,BS¯a;J³‹ã§¹è ¬®ÄB•}êhñbŽá¾ÔÑÇ·Fð‘Pœ%ïð •€ä™äp»aþóÊ…T®ûr±øêZ›i’ÇeVÂo—¹YT§§ÙLˆ‚™ÝêSˆ¨&ÒÖŸ¹DI•EÝ°P¨XUéë,Í s“*±,SÎXx8ÐEÄd‘ÿ½<²ä ¹Œi¸˜C³8ÎôúÂ5˜° -‘²ç¯Nž/zŸÊy­á…o‰îFSÀ æA¢XPœ¤zûwîÉ2Ø -utº­éF-âÜž¯|ßüòÝû÷ W:UNˆ¾ôȤæ£Ï‹ôô²gc 9Høgnè/œDÑï˜Ä¥"Ï^·ª Í}£ 0›bÉ#ÔË$^ݱ. F…~•!¹ædn[•1SNØ´ˆGþ—^å°±„ˆ±´°g›¸ƒð-Öñï3¿UÈc'ö0Ââ« ôæTžUåÔñ‹ˆ¶½ •]¹,d&N²ù5ÿýT¹zcmäeïZ0f‰hÓ'¥ñv+¸xRYÔáQ;ÔŒg5 ”|UˆiJ°(1œjÅ+Y£WÊÈ‹Xåyx“ZÎP:‰çÿånž -”·j‡ôçÊ/FïZ&½¹Úé2ÎJ}ÇÿDÎÛ>endstream +xÚ…YKs㸾ϯP퉮ZÑ ¾ró¬gS“ÊN¶bMmª²9@"-sCŠ.ŠâŸ~$d Lù ht7º¿~N6þ’M™ÅBV›¢LbY–›CÿIlŽ°òçO‰¥P™Œ3¥àûÆâÖ­nó4ª¸Icel‹¤Š¥JæóîÓýϩؤ"Îs¹Ù=;EòRÄe™mvõ?#)â»m–‰èû]½Þm“è8꺅Áéx·•y=CÏ_Oº‡ù=é-|¥ñq! N wÿÚýe£D¬D±Ù¦*®àEÀ¶½ÞJØ‹X Õ§/»Ys§S–ÅUqÓ8¸ÉXéêÁs™Æ¹Èýƒ' +L‘ûIœ¤Ê<Á£«*ú†ê7>äÏwtFs›‰gÉ ³è8sX«ª.4¤j’m檛'æ„äqx`p¢²p><´å81ÎSK± Ÿ}Ä]¿Þÿ›…íÉ8Äõhc€ªÒXÝÎW3l<š l - ÂfMÚ ›Uq6¾¼ï§Ùb9¡f{b֚ίœó`z@sÊ‚òz ™ge %€®ã‰Ó€Ë;hŽƒiÙÀôû·¯?ýíñ ¯ ”2Td^ìê¥ùìfXnٷ͈­»îwî±¹Â,x©gM`¬Ùç {A¨8àÇ OzŽ7¦±y¤EÏ£žÌxvV2ð¹Ä&—qfži·{”ùfìAP0ãUz‡‡ÁÉ^4X#çÃ,—ájÖÁ—%q¹žF’0ô˜„ò}yaQ ðVd͸[„}Ãj¢T²Áø‰AÂém2œ0„”™Ý‡‹ @t‡3â=ß +ø€!slaäØã8Ó2³ÉÈnen]?L†—Xí“h{x¯i©‚4Ø\ÆÖ˜YÐ^•iô ñ“ +2ñ3þf6`ÃR#öŽ´gâyM¨S®ÖÒ]¢‚sÿˆ‹U„yúlx‡3n:Qý†05/L±X•Ç:HÔMϸšÂrÞnœú0œ~‰:"ßq®aäBîs%W¡ëѱëhPïš´½«â|}y„ßT©OÞ-@:\Å´€8&Ov”LŽ¼ë +Ì*Á"Ü,üÈ‚'ÝÛ©^ŸüÝò +¼Hð‚ÈÅ…wÈMØœÙû÷ÈDjFæ-›aZf2zÀ(Xu7^Àr¡ÞSÀsîÇÁ vˆªHøØj`íÅÅ^¿riÆUîJ¨Ds-™XYÆ9¨\ªˆtòǧ­N(c0vÁuëxÌœ›ø L•ŒÕÿ¹Lx4a˜Z”œ…aº"m隸¦ž<‚©ÌÒè‡Sc~àOÈ_ ,kÄ_UE¸–Ø$áÓ»ÞÀßÃó„:¤õJgsâ5]×oøa…|5¼Áº?'fÎÍ:%aK3µ}Ûé‘Ù™Á÷"÷»snDÌÚ*—ûES*ãô{iO5·Et™°—Yôf–Çp;/mns]5°í´eF=p†QD±ÅÜRi^Ú#ŸÓÜeÀ åzü]ŠÓÈ3””Û®ÅBÑÚ¬ÿ¹¿‹LLç™cÉEK–¨Áäûª'²ê¥ê„©æò>”ŸéÌ^sÎ…eâ2l!›bM©;Ö¸DÁGoÝÆæâ¹áD+É8ñL`Ýè°œÀ¬¶úvß楩ޫÜŽn‡jZdq!’ÕPõh‚¡êhP™<ªkÒæP]çBÕ—ç÷ÔIézׂzW».-˜À•|·å$F½¦»›ÁÂdà®;É”·Í}Õn+5Ý°6GÌÍ}7«¬ ËR/tà–ÑiÑb5ãHýoâÚ•Ú•©W6îl»Á(á7[o <š°- J-ÂN\‘¶8qMÜìDOÞgï¡DýFö¨¹$bIe” +!îÿñ+ÌßçäI¬„£-²\ a7Ü¿æË:Ï;ò)ʹžË)¬½b +Ùwsí|¹Ztü©Kæ9m úµ¥4e‚9‡¸Nû p©!ác3_Šð©á¶g“JÅŠ_ž‚žõh‚žu4¨Uôìš´Ù³«âœg}y\IáØÝ ©çÙwÖGWþÄßýr‡>wͲG^ÄR¬wMØ–õ«ÂöX‘¶ØcMÜlOÞlš‹å¶Ö W — £yÏ`ï¿_xëÚw¶5Ë¿[_]Íý² k¯×ï5°‡+ÿ›ð€ý•ˆS8ÚªýšöOã*)g>ôÜ'ÂX·8`MÞìOàÓõcü‚3ž)ù›¼ÑéysŠ£ ÷jH[˜”qî}–Â¥o;^S±à êœzÙç±ýIùMWŸøæc[ío¡¾Ñ>§î1„Ô6!áŽö,ç©dwÇáÌ¢ŒäžU|A'~|úú +¿ªŠ³|½YXH‚η$äûð[ÙõkÂœç=iOÁBz‰‹Ú€[µ×ø1Ëv436}lq·Øe—½£a¨_Zc_ËÞ#W1¸FˆqâÚýüêÅI+Ý8t^ùnû©Hc•¯÷ IÐO–„ü~\]‘5ûiM˜ó“'í+½¬BÏÖ¡«ª›¹ç)Ï¥EIQãºÌˆ[÷g³\¢ˆâ7˜=yÓÎé‘ß[cK1=Ã4Ì _ºí»Œðê‚¿îÑ›ÔKëgÿ_@Z¹L‚šÃt0:!Ð,¬ûºŽº×÷ÇÖ'\ó_~!GKÈjWé1|ßv”= …ŒóÔ1£ÍR½˜É2ÎJ–ø?é]šûendstream endobj -6283 0 obj << +6721 0 obj << /Type /Page -/Contents 6284 0 R -/Resources 6282 0 R +/Contents 6722 0 R +/Resources 6720 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6262 0 R -/Annots [ 6288 0 R ] +/Parent 6698 0 R >> endobj -6288 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [425.738 282.402 509.276 294.091] -/Subtype/Link/A<> +6723 0 obj << +/D [6721 0 R /XYZ 85.039 781.388 null] >> endobj -6285 0 obj << -/D [6283 0 R /XYZ 85.039 781.388 null] +6724 0 obj << +/D [6721 0 R /XYZ 85.039 761.463 null] >> endobj -2374 0 obj << -/D [6283 0 R /XYZ 85.039 761.463 null] +2462 0 obj << +/D [6721 0 R /XYZ 85.039 761.463 null] >> endobj -3029 0 obj << -/D [6283 0 R /XYZ 85.039 665.896 null] +3131 0 obj << +/D [6721 0 R /XYZ 85.039 632.606 null] >> endobj -2378 0 obj << -/D [6283 0 R /XYZ 85.039 665.896 null] +2466 0 obj << +/D [6721 0 R /XYZ 85.039 632.606 null] >> endobj -6286 0 obj << -/D [6283 0 R /XYZ 85.039 642.326 null] +6725 0 obj << +/D [6721 0 R /XYZ 85.039 590.321 null] >> endobj -2382 0 obj << -/D [6283 0 R /XYZ 85.039 488.273 null] +6726 0 obj << +/D [6721 0 R /XYZ 85.039 558.113 null] >> endobj -6287 0 obj << -/D [6283 0 R /XYZ 85.039 461.659 null] +6727 0 obj << +/D [6721 0 R /XYZ 85.039 516.859 null] >> endobj -2386 0 obj << -/D [6283 0 R /XYZ 85.039 174.236 null] +6728 0 obj << +/D [6721 0 R /XYZ 85.039 476.817 null] >> endobj -6289 0 obj << -/D [6283 0 R /XYZ 85.039 145.5 null] +6729 0 obj << +/D [6721 0 R /XYZ 85.039 422.621 null] >> endobj -6282 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F56 2890 0 R /F35 2880 0 R >> +6730 0 obj << +/D [6721 0 R /XYZ 85.039 368.424 null] +>> endobj +6731 0 obj << +/D [6721 0 R /XYZ 85.039 300.678 null] +>> endobj +6732 0 obj << +/D [6721 0 R /XYZ 85.039 262.152 null] +>> endobj +6733 0 obj << +/D [6721 0 R /XYZ 85.039 219.383 null] +>> endobj +6734 0 obj << +/D [6721 0 R /XYZ 85.039 194.406 null] +>> endobj +6735 0 obj << +/D [6721 0 R /XYZ 85.039 164.58 null] +>> endobj +6736 0 obj << +/D [6721 0 R /XYZ 85.039 124.538 null] +>> endobj +6737 0 obj << +/D [6721 0 R /XYZ 85.039 97.44 null] +>> endobj +6720 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6292 0 obj << -/Length 2415 +6740 0 obj << +/Length 1556 /Filter /FlateDecode >> stream -xÚ¥Y[oã6~ϯðf D^T²(ŠºL‘‡©'ÓI°m²“ º‹é+Ûr¬,¹’'@|Ï…”e[v -,Cyxîçã¡".ü‰A¤Wƃ0ŽŒ¢Átyæaå§3¡)lMbwh~|8} üpØó-åøJf_­ñ§÷wWŸ‡¶”ÒòBgh‡ad}ùåz|ûáj(¬Àª°îáåêá~øíáæìê¡ܲ!1Jýýìë7w0 oÎ\GÆÑ`c×°¼<±Žò¥~ÏÏîÏþÕ²â5À»úŒô¥pBO lé:Qä÷Ò7p"'”ë(×o=á¹Oá9RxC„®˜•5¸!¬é"Jתê´Ù7W‘£¼hÐa~¨¦9Ð@¨®aä~´£ÁÃ"|/²Ì³Y€ÛSO‡^h-’ -fjŒhGóu²Ä• Ì'<³®S$Ð<6‹´ÀQ`¶\ùÈ‹lš4Y£GMš@"ýp{σ¤˜¡Àç±ãÌÃ(ŤﯴwVq+J b+~áç4Ï@,šPCREJX× ¯l²våüÒ$ùŽ@iä•MË¡ ›f©^.ù™t¶éù’‰ï%Ã$£Y [ÉI$ÛÏj†³tž é9…Öµg–®@zhi&`f„+­²À§€p¤<1E "šägÊ5¾x°‚oÏZMœÉŠLÍÓ¿2C¯ÝE–à)ýZ7éRkïKßúLÁB…GUÐI"é†N)0ÕoÒºY%ì”~dÙÏ:nš† UDøPDÒz¬Ð^sîGh˜ôÈ0Ì»æœeî&®'/Ì’¡ƒ3}7‹¤ái“¿8Ûq=­aŽã<ùBÊ=_ž_ôCO Ç‹ƒ“¨Ø¡i±Àw¤t± #®D@Bœ‰aËâ9­êŒÔt˜SÞ•K~+sŒhZT!˜ZÓR3?©å–¦/Œ–J8Bz¤å”¨Ó„êÝ‘µªØÝrŠ¡\cQŠ=¹ 0ûÜ)#)h%p›eXL[” f0WòzBuöÊ/¦"vÐIÌ)¶õ@®ü{»)™60ÏŒ²¢§2s…ŸÛPÅ„r"¥¬ ¬¤Jy°6âqõöŠÓŠµÇkƒJV)õ|Vð³ÍWäU ý/üÒ)xž@?®õî²0‚æeuÈ(gL›ˆi%€üÐbˆéŒË`‚¢_M=ébú›oïG¿¢ŠÇ˜ntIí€/òÖyÔÀè HhØçŒâYAGkÕäž -ù¯žšSÖãè¾IMò ‡&ÅcÂgÎLw"ÞÔLáe '"AO8I#t ËÖøœ·Ø¤u­aDëâLV—Q¤b9 -Å~c—£ J»Üah“;5v西÷  ‚&ÄàZRè2ñCk´JH•QSŽHËD?!$7Êöñ^æ¼ÑN_¸˜™’ªT3àu½p1¾»„5ÌÝî΃:R+6ìÃn1Åùp®o]›öîöò¿¦ÄZ•Zó‚Õ8ÿn|wÎSp,à(p —ÙqZֆߖ·ì9>%ß -˜b@õbGFý¢×ï¾2gÝ0ïÝ`£þ`•„´ÁÄ3ÍWº#Õ¹þvÉÏóï®É~=ýX¸mRaŠÐçcÜËí¹Þ«3ü¢ÇN)”Äê/úÑEAߧð©ódKrüÐS„ÊzJz7t`¬’"ŲÞkŠqJz OÖiKsüŒSÎ8Á”{<¶  ,ä›MÄÒ´..žÙ`PÒŸp:ϲjÁiCÈ,Mk‹£´Ëy¸©´@}Œ¹+A¸€öѵ>¥•ÞTqbkE:•„ÅŒº<_ÎYbÒ4iawA^£VfzŸÍNªaïÃJ4xŒ#$Sä§5Öлƒ«‰vž7@×ë‚¡±;D§Ãƒ«I´œ4Î…¥­ÈiLr(o'ì\ -:Ô®¼ÿ ¡¥v± ¶0Ÿíø†_–pöääyí%>IšEI(«·\òc‘Ô‹£~ óÃà ¿m‰NøM½å·Sßöåõú­#Nu:m„9v„ˆ¥°EB'éŽ/Z¦/‹­çß\åÂOè¥å*O—æ"ÙŒU©Z¾åÚyøÚë.ÑÅ“/d9/`%às ©KžèVïa”þ¾ÆžAP“éS­ëŽ•xã׊(´ þ -6Ùä]èèY K }Ââ8áÇ´ÊtmÂf O_èt³{̸¹Fþám¬-# õÂø2Ú(#MôVhÊh_^ouäýeøá‹sÛaîÞ:ÈÓ6 êïyŠãƒ{ÌÅl~ð± º!hü®…§¿®!Yÿ·5Ûð:í -8èZ†®+n®ïµÂØ#Á›ã ÅñøË8v@‰“áßÒ¾¦y#ø§¤éØï ë }GØxÍ·Ãíw$ì ¼0°èjL/±«?Ÿ½àŠê¹]ðŽK~ŒuÜùmCUM# ü†ðt“uÃL‰á‘¡7å…] À•-HñG/ŠaÝaýN¶Ÿ¸ô—‰Æa«R[ü3¼°¶¸I$¡^§æóš -âÎU9Tý•ó—ü¸ú2¶ChÜ'âZ\høÛñRî!?ONx+ãu{õO{ŒæNLn1ºc}ŠƒHƒãy­bÇÞJì-щÌÖDo¥ö)&·÷åõ&wGÞ‘ìö¼nŸ¯Òqy0+·ùRóÚ/-+¾Ò–•^ØV¼l?hÜÄÉK~|yøÙ?¿GŠñhüþnôéêߣØÝ^Jÿ¡¯ü\}z*‘-?—ºÇÆœ¾DÏi† -#¡ÊÁöÚW1¥0ܪ§ý§ L˜éÞ!À†ò[§,OÌ!K+Í»C¨öß…,ñ=È9Ý ãBõ¨)>ÿÔc¦¶;ä?¹ Æ»<ÑæEÓ¬ÞF›ÍÆIšeR=e3-ÿ­Fú6W¾Ý/#ó<+Ö/£z•N³$ÕÉr’HýHœE³ÌlqC¸«… ùÇý}½¡±;D=ÇÉ'ÔçØg\é:^ï!?®ãÿëŸKíÔ—N$ÊóO]P[ðý¾¾~PVòPá?ÜvbFendstream +xÚY]“›6}÷¯ oð`UB}ÛÝ&i3“f»qg:“äŬM +ÆÅx3ù÷ÕHKÐ¥íd2Áè sÏÑÕÇUH€ÅdašiFͲ l788ˆ–7b[Ù:˜ÛÝæÇ×< F9΃ݓí‡#Æi°Û ï~¹¹ß½zˆ¶”ÒbmÓ4 ÿ¸Høæáæç_{£›^?Dq¾§}¸y'·Ñ–„7Ûý©ßîÞO­·7[Š0ÂÑçÝÛÍ«Ýçˆ)—Aþ½ùø{!èí#šgÁWñŒÍíFD‰8£æw³ù°ù}êJ·±@µäÉˆØ +]YÆ`ß8F³É7Âßòå$ FŒôP4×Fp‚2naKt#æ#$F”Ä/ßÑ–óðK×k“¯bÎÑV Ê^<C%ã¢Û†NþËÂá(š*ýüA¢Ú(NÃÇB£äwê¡”ßÊ[ùPäPÅPKÀÉtÙWŠA©¶qŠâ”*gq–ªï¿^4[£û&ᙨXØ=鮺áXu{îR„õ,Y«V±èô§$üÁ—E˜3x\-Fù‹V†(Kœù¤1by¢TA±˜œåá]wú„ ;\{„cG’†÷¯"ŠÃ¾h«Aé¯ïŽÅéP]<ñ&IŽR Çë`¾Ï‹±ÊÏuZ쎵´7¡Úªªj# ËÎ d}2ƒ°°ÐmâM_WOúWSV +{Я;Ó\ÊnŒ2ÕÉ GW>^tJ‰Hð™ºs$»êÞZ‹”¬4F/ê±×YJ¦*´ +9"=î§*ë°˜?rFçJy_=i¤óšÎéwQ}‹g.þ%Ð&¯e¤ÅÁ|ö4N®²S3A66Õ`Z÷•Š¥ì¥[gGž“Û§QÊWóÞtØvÓT­eRU{‡^¦2¿ê/È—;X&Öl0w,fÊu‚rÎÜái†âŒ:¹NB"íæ8|¨Z9°Ï*`’ÈDÇ2щMt)z9ȱs(HãMp±h#Bõ0˱ëúýè«ñ³ ÌùX< +[Ó°ê²hšor|òÅFR„c³#î¢,V†éÔ‘Ž¤¾m"œ¶9ãâ6à2û¶6©«Ö؃G.Ër”³”ë`ürGК\ˆp’;g\”ë2H¹Ó¸ÁÉuÖ#®r¡­/jJê•Ù—•,‰QÆàíßÁVЪ¡µbƸl…ÃXÊ%í¨×‹rp'ÃE¯>ù”£”Á»ŽƒäЪ|€ÐÊŸ1.Ëw˦6³DKÍvU­ÆõZ.æ#p†–ÂFX `„­Z#fŒËF8Œ¥=ÍgSûK_)o†Nî«ß%ëÊðô—Ì‚N.–_Ç Q€Æ–ŽúXÝ{¼µ"žÆïÍZó"œ¼™3.zã2ºûÅXè×óT>w½oçŒY"ÎÓð†á` hՀк0c\vÁaÔ'¦N×wF¿JSÈøÔ“LÔðm“ƒÔЪz€ÐªŸ1.«wÕC­3a¬÷ê¾pÐç¨e HNPŸœ,Äo€Á¬éØ&ù3ºEõÝ¿¯^˪T•»>/†ÒÞ/ à†­ÚZ?fŒË†8ŒÿÁ‘æåýØtäñ‡¦(IàÚ×ÁþЪ?¡õgƸìÃxŠáꫤˆø–'ð¶à`´ª ´gŒËÆ¡ŠÆÞ¿ôµ»O|é#ÿ GFKàÁBüú fM>À6©ŸÑ-Šwè®S*Èœ?v—Á{—“ šÀ«¿…·%³zYâg³w%/é–¯J,ÝsÄ“°hêýX/ªKÌþâ=¢x±:éX”üÿÿ­pJm”QO…ÃãÅdŒE]Ñe|/§âý>à༞rendstream endobj -6291 0 obj << +6739 0 obj << /Type /Page -/Contents 6292 0 R -/Resources 6290 0 R +/Contents 6740 0 R +/Resources 6738 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6262 0 R -/Annots [ 6296 0 R 6297 0 R ] ->> endobj -6296 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [361.406 338.821 512.306 351.723] -/Subtype/Link/A<> +/Parent 6745 0 R >> endobj -6297 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 325.575 308.034 337.567] -/Subtype/Link/A<> +6741 0 obj << +/D [6739 0 R /XYZ 85.039 781.388 null] >> endobj -6293 0 obj << -/D [6291 0 R /XYZ 85.039 781.388 null] +6742 0 obj << +/D [6739 0 R /XYZ 85.039 761.463 null] >> endobj -2390 0 obj << -/D [6291 0 R /XYZ 85.039 691.296 null] +2470 0 obj << +/D [6739 0 R /XYZ 85.039 701.856 null] >> endobj -6294 0 obj << -/D [6291 0 R /XYZ 85.039 664.681 null] +6743 0 obj << +/D [6739 0 R /XYZ 85.039 658.903 null] >> endobj -2394 0 obj << -/D [6291 0 R /XYZ 85.039 550.67 null] +2474 0 obj << +/D [6739 0 R /XYZ 85.039 603.053 null] >> endobj -6295 0 obj << -/D [6291 0 R /XYZ 85.039 521.872 null] +6744 0 obj << +/D [6739 0 R /XYZ 85.039 571.237 null] >> endobj -6290 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R >> +6738 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6300 0 obj << -/Length 881 +6748 0 obj << +/Length 1358 /Filter /FlateDecode >> stream -xÚ}UÉnÛ0½ç+t¤€Šm§š"=ôR-æ@Ët¤Z¶T-5ú÷á"Ëmä`‘³¾Ç7ÄðÇ‚<¡±(‚,gTäyPîïâà ,Ÿï˜ó‰ ‰”ð}Áyk”rË좫e¬ B2ôy\ÝÝ?ñ8à1MS¬¶cœ -ƃ´T -¬6/„ç4Œ’$&ßÔ>dd­ÂH¤yTånêì÷*,8Ñeu¨Oz_W_î>­æÒ®rZÄT²‹ÍÅAÄ™¸Ùyšf€N.;g°¤gŒ¾s†½Ë‚| #FÚQ_ëÍEÝ,ò1åY°˜qqVjfYfʯªz#^d¤ yN*ÕÀŸÆNz¼OɦÞØCˆÝYç½Ú¡»¶§ÚÝÖ‡dlíi¬ Àgïuc’ªÁüb)8ymjïÕ5 -«´+¹m]cåJu`žÖËÌHå»uXG‹¡_¡î,Ùí´ä§ÖDR@$à‚è(€¸ Ž{“à€G|Vgú/ÛÉ0 -yFþ86ðÒTo÷¦+$³ªÓ›-†ä SÙÚì}rFk¿ëÐrVŽ5+²°à}´éYaºf‰<1Àñ…„¶<üþèõöyóÎö Û4ý|`€Ð‘Ѷ{x½¿¢Ç$ç49ÝÒãÂçú8$03"Ný8p7O¡ˆ‰VãÔ¤ÈEšuظÙÖý3fÒÐ|mž}ê›=ž|®ÏL"9-»l¾‡¹4 <´WŸà W¯F½1–HåÎÙúvo¿:#6Ývudz!ÿÚÃ0•&™oÝØØ{ûc–Ü#™ªn°hï cÛ×ÚÅÕ5)[Ó Ë6TʇkX,4º€´«ÅîGçWÐýà^oÞKpXJ¼×ð°™f…;ªë}²V£ÞÐ+c*bzþíê°ÎžïGUÄ‚¦Ü'C@BŠÿ &"§I.®Wü©ÿžendstream +xÚ¥˜MsÛ6†ïú·ª¤ÕwŠc_ 4¾«V^^õ·Ú4]iýEÙºUêrŠ³ ‰4aÞFðÖ¢ oÀÐðž8ºy[ŽE©ñÈI}úå&ú!Æpµ4@úZL04éOÝé[Žcúý/6ò‰ïjÝ0eSê'åæ\ŸæÄ[ +IÆzˆ…¥ñ³D!áÈbêèda;Ž,.W¨k¦]lV!.\„Bà>mi.Zä.G7˱Øo›~2t»C½QeÑÞ|…àå!@s”¸)[€€ ††ÀÄÑMÀr,«}5¼¥Ýe ¯xËS´$ð"ÓÒ´(04&Žn–£ á¢Ö›¢KèIò|nfšœÔ<ú‘9ÂRŽ8_#–Æg…à@†#œ©£Žíx*Ú¶|V‚ª“¦ñßz)_à$.}’ %$… €@‹‚Cƒ`âèF`9¶zE­–Ø}ƒ8çïáªp.bV¹6ßé5H½)úÅ´ ÍD)Üg-à +„ G€SG'@Û±P)+`jÖíš~\ú¶Lt™"Bá-“¥R×¢`ꀡI}âèNÝr,ÊÖê§ÕYmÀξ¤Œ0…ª¥’Ö¢`Ò€¡IzâèNÚrn}Gi)JXà\s”ÇšJ<Õô»™CÍk;÷™¦±›fÝïÉÆ ©\;«mãÛœcć÷æ£Øš+Mpgîw3ók;÷¾ÜØ•õ°À.äjr¯sK¾“WëÆ÷DZΆ$þ˃ïÿy¾nv- eÌÓÔ8¥ˆ’!–þ8[Nã•'1> endobj -6301 0 obj << -/D [6299 0 R /XYZ 85.039 781.388 null] +/Parent 6745 0 R >> endobj -2398 0 obj << -/D [6299 0 R /XYZ 85.039 761.463 null] +6749 0 obj << +/D [6747 0 R /XYZ 85.039 781.388 null] >> endobj -3030 0 obj << -/D [6299 0 R /XYZ 85.039 667.044 null] +2478 0 obj << +/D [6747 0 R /XYZ 85.039 733.118 null] >> endobj -2402 0 obj << -/D [6299 0 R /XYZ 85.039 667.044 null] +6750 0 obj << +/D [6747 0 R /XYZ 85.039 700.697 null] >> endobj -6302 0 obj << -/D [6299 0 R /XYZ 85.039 642.326 null] +6746 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2406 0 obj << -/D [6299 0 R /XYZ 85.039 582.512 null] +6753 0 obj << +/Length 1318 +/Filter /FlateDecode +>> +stream +xÚ¥˜KoÛ8…÷þZÊ ³|ˆ–´Ì{R M'q:](¶â¨µ-Ç–ÛÌ¿>$‘aÈK Aà(:ÖáùÄÇ%I‚ÅI +Ž0+“¼ ˆE²ÜNp²wn&¤WÌzÉÌÒœ/&®ùJßËý-“A1¹Š"ƒ¹qŒ8ÎFn±¸LP†Y2ˆ$¸¿1ÉÝtÏQÁ‹ÄzØ;ÃAóΑpÛ‘PÄ}㸓o Ûð[É9K«S÷L™hñŽl4@ä^ šÈŽ£?²å¸¯"nµk›•ŒLÓ£ìrõá—DQË¿ºË를: õ¡éäÝdæå1œƒd,M˜Ì Š‘ G2®£—ŒíxÔé5ˆÂrJóô¹Ú +»z0/Å% Àh½( +04G?Ëñ¸•auòýt&.ÚCw …Î("Î˽ûŠª³,›j£YˆFe›:4R8c('ðühi½(Ê04G?Ëñ ¹,¨Õó·XêêÑÂNàŠËÒ0zQ`h`8Ž~–ãs{ìä¬Qmõ  ’K­èEÚþ<íÅEB–—ˆS‘„ôšÀmàØyó[v?õ")—Ä~2ˤ*,Ö= I§íš§PÕqŠ2`4…^ÅŽ£„å(æ¿õ¦î×ÌC-;ÿk(1åˆQ'6 q/Š& MbÇÑŸØrܪŠq%^ïÓQ¿jÙխ쯡·-6ˆRx-°4áìƒ(–2³»ŽÞ춣®;ýº_Nª‹W²USÁVÕŠ¡%‘å +o", €¡E1†ƒãèÇ`9šÒIñP‰eÏŸ›P5IJ a +Oü–ˆÞ‹¢ÑCÝqôG·=©y]¥oE­ÌyúCï”t¥ì­¿È=W£w›¤µ@¢E‰ +WÕ–& iÅ A†#$×Ñ ÉvÜV¯zˆTÿ÷õjØ\ÈM¥æ¡ÿóC¥Ç0Á¯Ÿo/î.¯´X–œjïz!Ÿ®–CµììÝëÃPÑ÷/”q4gðŒdiÔ½(Š04¨G?jËqÕèþHÔM¥7êÖ¢¬öûz“ß…PàqÏJ–@Ñ‹¢(CƒÂqô£°Wíñ?'…h7ƒç$K>ˆbÁ!Ã1¸ëè n;žä”Ò,ué¹ +MÀ„gˆ1ø”ÂÒa{Q4,`hÂ:Žþ°–£ûêÖ‡aiÍ ·—ú;]«?O¬a>¬›~R’ç¯Õ~/ÇÓnš5ƈdp giˆ½( +04G?DËQEWõJµ×éez…S×öÁ]}ÎÎ"'¿£8Õšè!hØÍœ¾µó»÷Ù× T²aD½}XüÊÃðÿyæn*&–ÏÀ8à”"J†¶È¬x‡Œ31ì}ƒÿAP?xendstream +endobj +6752 0 obj << +/Type /Page +/Contents 6753 0 R +/Resources 6751 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6745 0 R >> endobj -6303 0 obj << -/D [6299 0 R /XYZ 85.039 556.503 null] +6754 0 obj << +/D [6752 0 R /XYZ 85.039 781.388 null] >> endobj -6298 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R >> +6751 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6307 0 obj << -/Length 410 +6757 0 obj << +/Length 1479 /Filter /FlateDecode >> stream -xÚ}RMoÛ0 ½çWè(̉¢¬ãlmwØ.¾ ;¸SKì Q ìß²åvْ€õÁG¾÷H¡Ðü¡5hŠÂ -A<6Zl”ß²ú)u×´•¬wéß03=Ö5DÏèMïýLßôÃIU&zù L}{LÜ°.+yÊ÷Nn‡í²UV·€í¯ ï–ÓPn‡Q™(Ó´œRÏ kõ§n?mOóÂŽ-y—–Ò+ê¸o3ËØÊÝTD¤¾P9ü|¿/•Qö«Ú’‘yÚ92·1O ó\š=íø½I#²œÉ¾8;p 8¹À˜-&¸2Òp>Œ«CyEþ?ÒάŲD²ö_šÔ®3þ%΀endstream +xÚ¥™K“£6…÷þìVô@<²ëyu’Êd:3NUª&³  mS±Mìéô¿ÏH¦Åe‘ê…18:Ò•äf…?d’P‘iƈȲ`{\Ñ`WîVÌ(ÖF²v4o6«>È$`”ä46ö9’ÄR›òkøö§ÛûÍûÏÑZ +J¢ušfá÷ ï>ß¾ûù·;}éÃçˆgá§úÛ—Û x­Yx»æäO}vói¼úæv-%4ú¶ùeõ~3¶sl´)Wügõõ JôËŠ‘gÁ3SÂàòq­$2æûaõeõûø(}-ô]>&ƒb ¹²,ƹIJ$Gn1s¸1ÊHLE0ˆ¸¿(K§éMH&³ÀyØ+ÃAóÊ‘Iבq"¿r¬K`~TÌ‹' º9Á™ÃËd. Õ ÛjØF´1´±'ŽþØŽãëØ8g¡Áš§„§¢ÿ¤ÐEÔ ¿¾S]õö~K’ä„ÓÅâhæ± ¢%,˜áˆeêèÅâ:–HYªs¥Žã°<Í9a Ï=JØZ³˜zÞ͆¾¶óg¶vW‘wm£úùÖ©þ¡¾C“uüïŸðX”‚Õ Œh‘bhALý$Ç+uy»‹0^f)É^Í|øA´3ÃO½á]Ç«ðº2lÕßתša°@")ŒPVƒ0¢Eˆ¡%1qô“p¯H<]? žKÓ^NÛ¹øB”¥x|«AâÑb|ÄÐÆŸ8úã;ŽWñÏ­ÿ=ó0.ú3À5aøbÊÑ ŒhbhLýÇ+—®RñÛWµ`2Oê[ïªSÕ-~Ûœ@ÃÃv—¶8«¶™›HbÉIÌñêhæÑ ¢%t˜áˆnêèEç:>µºZÀ +š¢t +J©°¼É\7Š¹$‚ œ…Õ ,Œh‘bhYLý,ÇžEý=’IXœûÀª_Õí\j +ÕXàõÃÑômàp•‘\Jg'"2Nd¢gwX¤s¦ö RÒð#¼AòVý²R/'IÃûH@wà|[‡ws®ÚN]Nœ¤Û}qÚ™wÖŸ¬AwÒ·?ÀÜ´/¾×zR 7°gBŠ4'2õö: +{ +F˜Ä'g$^ª ƒhé½;›ïSGï{w«Ó¶}yŠLÉŒCuXô5´{Ž`4ª_”¾¨èV§âAm:*3ZÔÄû2¬B Uƒg…uŽ*‡ *×ߎgD‹àC nâèç8¡“úžµsÊFuޛʡO*b¾`&©F£¼;÷E·ç7ŒC¿~T/cXØ¢PyÎñµ½£™‡:ˆ– b†#Ô©£ªë¨V0Ϻøô$ôªf£™ÔIJØÂ<ähÔF´˜1´©'ŽþÔŽã4µƒm³Sn&wL åø2ÞÑ ¹h17bhsOý¹Ƕ2‹5ˆ[oM*ÔVj8›KgÇQÝŸ> endobj -6308 0 obj << -/D [6306 0 R /XYZ 85.039 781.388 null] ->> endobj -2410 0 obj << -/D [6306 0 R /XYZ 85.039 761.463 null] +/Parent 6745 0 R >> endobj -3031 0 obj << -/D [6306 0 R /XYZ 85.039 667.044 null] +6758 0 obj << +/D [6756 0 R /XYZ 85.039 781.388 null] >> endobj -2414 0 obj << -/D [6306 0 R /XYZ 85.039 667.044 null] +2482 0 obj << +/D [6756 0 R /XYZ 85.039 407.937 null] >> endobj -6309 0 obj << -/D [6306 0 R /XYZ 85.039 642.326 null] +6759 0 obj << +/D [6756 0 R /XYZ 85.039 372.527 null] >> endobj -6305 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R >> +6755 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6312 0 obj << -/Length 243 +6762 0 obj << +/Length 3429 /Filter /FlateDecode >> stream -xÚuAK1 …ïó+rlMÓtÒ« ¢ x½ˆ‡ÅÁÁƒ£,ûÿ1uÆ—‘x/ßKBí¨`ä -½²*¼~t&Sn:ZY%g«wÄð«†ÄŠ5ïÂ$'4¯Y.‡îâ:EHKaÞ õŒ -’¥* ã³{ðLîà9ºãÉ.½»õäž| ‡þe¸[{í TE-–’+*ñâþÝ:¦ck9œZý9/¤Ã<.Åã—ýäÆEž›sjðîjØæ_ÇÏ%xwÃh©œPÒõß;pÄT·3E¬±¶-82KÛ³œ$vkQ†sžø ¿[bendstream +xÚÍ[YsÛF~ׯàÃV‰L…cÌk_¶d+ö:•ØYI®ìV’ˆ„(¬I‚A+ú÷ÛLJ·b¤Ê¥æü¦§»§»§%güÉYä Odz0’BGÑlµ»ðfhys!m¥í²tú¼¼»xñÚfÒ±Ïîšy|a|=»[ÿ2õÏ«Ÿî¾»Y,µÖsí‰Å2 £ù‡Ÿrþææêúí»7Üôúf¡¢ùûùëöêGèðr±”ó«¥ÿæÚ»÷uëË«¥žð¿Ý}ñÝ]³F˜bùûÅ/¿y³5lèû Oè8š=AÙšw€RøFÛïíÅíſ꩸ÍÌxTMªK‹Xùãt ¤0®é¦ Õm—n¾'|ÏÝ€Tˆå›xþÉ>ÁÞƒpþz¡åü„5ûU™‘ò}²ÍJ¬}"† E(M<°{"òô8vˆXÊv)bßw±K%T »œKÜ€ïͯ“2¹GÈÉjÓãN;Å(”¦A‘~—ý‚0^@Hî³#ÒÍ›S$Ë÷PáÇó~ÇŠçe’ím·ûfé­.ö;Roj;XªÛ¹íšÐLÏü±¯Æ=Ùy’j’û„QØ¡ÙY¾ÄYóÅŠëi¥tÍ ³=w½Åá»… +ç÷XâJ °ÒóŸ¶)Ç!iéT‘3c¢A‘îhÕ®vO ¥üÀd%®Kµ0é +§ÿˆÜúŒò“í›þ‘Ël¿á¯¿áB/^é_ˆ`q\ôÛ[ǃJÁØö-ïx…K|ä)×YQ‘mUæÅsÏ +HL`gØ ¬àÛöß”x|÷<¹Ý÷Cn×À]ŸPÞÉ´ÚXE’ű’)n¼¸ÓŒd_*£€ñâõŸ²íŽKš9Qvƒë'딫Ö$$K ¨õé [ËÇô™K‰E­9žNÈtªù ÙEêù¯žïe\Þ§«jRฤx†Fù-¶fÄRZ 9žÁÓ üsn¸é¡Èw\‚[L9ÿ*”oÅå¬Â½ïá¾ÎGhÿ >/JâpÐåG1 ¥„¯{4y‡V“ë3M®;šÁu ú4‹4RÈ5‹ðÃÀíqþ[ë"¥Ü0[ Œâ°Ñ‹rx±êUu"u´ˆP[Õ¥ŽèJ”}œÀm[Vþû9qTƒ ˜™ ‹Òöé l­s>¡¼~‰gcæ¯Q0¶)\3'­Š ņô(ì2‡p½È:áê!›B„ã}Yu¾P|ŠþVo¸shäÁ4\²½Û³Ô÷‘…Øè~ˆáÊjû1*^D´}—ìÒsšÉP‰(fÎ\X5Ù82Pa"ü.48àÝpxÌ:à3 !Œ +µ? Ðj²q ¡ „ÓÃú®*­àª:ü£ƒ0ˆD¤ô4ƒH‹0 ª-À¯‡íBThA¿LÇF€øÍ@UfP²bkçÄæN‡5̦M5â³ÕB…ýÛ\VS-›¹º¥A†F¡½¶ÙêyP<š=O!c F·ð›n…½µ¸TÁxYòõy”œ)öÐHÎØB­„lï º®ùÍBc¦ÇBã³ÐÄ_—Ðøà˜h€'=hŒAÑ@6ɾë&ݯØ,~VÚͤSpåDû"2mˆoÒ}Zd+fBr Ø5åàöfSxˆ+§ØCÕc{5°‡jïaŸªñ)€µÔøWƑƈÃ,ûIL$dà3;9{g笨À…¢ºïéo;×Ò™¬GXàÚèvÉá@L·•j·SÊ0å´‡à‚¸Ävp%‚=òʺ}€/öv@Ž~ÎökrÊÑ1ªv¨Ç8TîÌ tß^7“å\Ä#ÚgT#°át¾¾œ&à Ó¤¾ š|î6ørd­»`ÊŸHðÐíòÕwc`Îí£P2$beÈ;Ò¯‡Aþn&‚ÃÇ jåã¥î"ÜS„yR£@r¡D“NätbÉܾ½¾µþðî­ ¸žhÛÌît×ÃŒ<ÅæVÛ|ÍÌÎî?ÇÌS û Øy²‹Ü$å ikǽ@·+Ë,à†ÖÖB4fÞ4OÁÓc0u³ÂeïÀ$o™x²àèC¾=UÁ¶xkÇv´q1tsŠ,f×)öÕ°ëؾj“Ç!ÿ°Å3®¯Ùâñ”P~8`óØx‰­”Õjå6ßtCt@€:Àöý2Ÿ•çZ:“õ;­1lÌEGÁÍlS _ Ív§Ÿ1â)0{´ð½êˆ=W f'äŸHk$Zɶm²ØK¤ûtp|ÌøÛó{|t|Êš—z'Û~qä|¦BúGÝâÞIŸ~Àï­Y~:ºÁ³Ê—²obõRŸ²¤Bf…ê‰&„Íðç &»¼âC’6Åù4’6v>µ¤9ç3"iS›ÚU"öå@: ¨XN!ÌÁÀ»j-£ÆŒÑœ#c¸,Ú91ÊæļzLözñ›æÎ_¦É§,ÇdžbàAÜÈÄ+‡ÖôL’ј£¥m’ &D„1ÈÆvËq¯Ðòð†2N"8!^yu>–?âms¸w}Úb¯ŒÚj#ò1a±ÅÕ +å˜|%Þ*áOí¼· Û† ‚Õľ/mŸNÚF„‰2Pö¸CùˆºK;ÂðÜ“³üêImQœÈzZ­Kd™Ëd»Mê§ð–íI†’´‘"ŒÇžœ>=æ\ƒàÕT}»ì,&Á +ühtµªÏør$OKÕZïg×Ö7F·òS(Ù…“†° í}<üéMK¤!õ矾p,v[Û@¬AÇñ-T‡ÒeMl‚ÝŸ8i»æz +Ñ*{æêtªâ]èõpƉ²URkž®’²²É”Æ;‚'RZ͹—‹”Pæ¥ý¾~eûäö×ÒË—›‡:Jž3!Ö[ÑÓ-,yɵ˜äC­<ãtô½âýaqŸ—ª%Kö$ ‰•®¹‚d0©p´òÇì«CZXº“æa°xÎWÀý¨ÍBÓ“Ÿíœ4°ÿÿr´©ƒÊ½êƒTPƒÊ}lµZ¹.W)ww½–r×Æ~mßøèsç„›(Ž ˜¾ð›ðOWE@%S +«ÜI†Ýn);ª{T¼6qs8Ðå1šS“¢_6e—bU¨6±î —O,>Û}Ý£æ zlÎoûÍÒP¶%бñ?šÀE¹ Zh·Ñ«Ø´FïlØ€Õ±m/NÇ’‹uÎ΢štmº„Œ«MD2’T|ä…í'I¹£ô/ÉW#AQ] è_a ’å’û°YE½q}Þ|Õ—~н昫 -Ó +l( +’°f/ÆìØ4N…uÚøì_Ú]ŠàÿX£ç!«’·\A—cµZRÕÞ'6y€#0nzdæ?Ó– ñ*nå µòÆmD‡MHÕ¸‹äR²Ñ±_Åiko:¢{Äœ¯4 “d <9np:}{"ÐQ˱ÑcCþË1-‡ý«ác0œ>ƒ>ŒÄ,Yk‡þ¯`0A´²Í#gºÁgP»úµMš1¡±Âùý–M´#Êàp©t<0¯*Â096ð #Ä&ZIqtŸ-³,$æq)§¬š`8©Ö„³'&º~ÛÊ«mf/¹£• Ð_Èi›ëôlp{^>›1^˜ÜÄj›œ§M%€ØùÛáÁéï¸Ú qkbG'cÁ…„-±ÏL·ö™;%6d'pS±™qáÆýÛ{étï³yÚsRºÞ>«ÔžUƒ|D“žØÐL_IáE-˜N­úŒƒó•/|¥Zà0E–Ž1žÓ©u¼ë,ôm¥]GO¨¸?ò™@äÿiB ZD:Ú\ß²ÂBº Š;”Ô‘ða‹Àÿ„€ñ2endstream endobj -6311 0 obj << +6761 0 obj << /Type /Page -/Contents 6312 0 R -/Resources 6310 0 R +/Contents 6762 0 R +/Resources 6760 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6304 0 R +/Parent 6745 0 R +/Annots [ 6772 0 R ] >> endobj -6313 0 obj << -/D [6311 0 R /XYZ 85.039 781.388 null] +6772 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [440.111 139.828 522.084 151.517] +/Subtype /Link +/A << /S /GoTo /D (unicode) >> >> endobj -2418 0 obj << -/D [6311 0 R /XYZ 85.039 542.44 null] +6763 0 obj << +/D [6761 0 R /XYZ 85.039 781.388 null] >> endobj -6310 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R >> +2486 0 obj << +/D [6761 0 R /XYZ 85.039 761.463 null] +>> endobj +6764 0 obj << +/D [6761 0 R /XYZ 85.039 736.911 null] +>> endobj +2490 0 obj << +/D [6761 0 R /XYZ 85.039 736.911 null] +>> endobj +6765 0 obj << +/D [6761 0 R /XYZ 85.039 705.159 null] +>> endobj +6766 0 obj << +/D [6761 0 R /XYZ 85.039 620.547 null] +>> endobj +6767 0 obj << +/D [6761 0 R /XYZ 289.364 626.52 null] +>> endobj +2494 0 obj << +/D [6761 0 R /XYZ 85.039 444.95 null] +>> endobj +6768 0 obj << +/D [6761 0 R /XYZ 85.039 410.204 null] +>> endobj +6769 0 obj << +/D [6761 0 R /XYZ 85.039 368.892 null] +>> endobj +6770 0 obj << +/D [6761 0 R /XYZ 85.039 301.146 null] +>> endobj +2498 0 obj << +/D [6761 0 R /XYZ 85.039 216.014 null] +>> endobj +6771 0 obj << +/D [6761 0 R /XYZ 85.039 183.593 null] +>> endobj +6760 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6316 0 obj << -/Length 1661 +6775 0 obj << +/Length 2641 /Filter /FlateDecode >> stream -xÚ¥XYÛ6~÷¯Ð£ DŒxé(Їæ*hšlŠ$²%ˆ-¹’ïþûÎpHIöJJ²E€,E‡ß|œ‹æ^ÿ¸—hÊÔ‹Îd’xëã"ô¶°òû‚[ ¥%ÓJÁxd1p«A$X¨âQ{Fó”IÅQæÅÝâùz"dQ$½»Ç¹`’ /JSRywù'_†lhú—Ü?-îoaPã Ë÷0,·Ë@F±¿©«#>dG˜_‘F‚ÝãBä·8U-¿Ü½PP, #sìXeY²¯ï:ð{¥L‹Q~P›d2–³¶G*b\ë¡í\Ñ•í"aBg;GëUê¿ÜeKúu 4£m¦`Z³Hzƒ„k‡ÀFz…$”,‰ –‰ô«ó2Paä÷ÛÝR$È&~÷p+ðYÔ{‡­„ÁŠÄpmpcÕêàÖ Í_ö펔4V‡Ù…z²‰¬ñ¤]Vg붨ݶ]QÒ6#^Kûgô…½;9k÷ˆb;8È^;GgMYÕ!‡u.üW} Áú°Ýh\ÄG`õËÊ Ëv´%Û¢a\ú ÎàÁ'ÄûUÝÒÂ¥¯™(·ENsÆq­ŽÌÀ_¡ÍHšÃ…ÿ¾Èì†vGz…"RnÝÀ]ŸŽ#ÇæŽi©Þz4x?ð' ħ] !y{²¯(’RùÍy@È-¾”3•ª!¾G~êd¾ƒ*ÕŒË+P›ªF²¿¯6C˜sSl"d´†pà|6d2ÓÁ«•`]Ú6tÿ£W¸Õ¡h ÊQëªürµ=×Ö[q¹¤µêÔî«r*¾µLYô¬ÈÌUò’ubÀþQiàxÏhäÜ /sS0r+ôº‹‹*¢»Ç gŠ±¤²Ú*ã Æó  ¼äþg5¯Œ˜k*즺8’Gu¢9›ôð3=Ê„à,áÉD¹âR¡Ûýö–€Ahw’tBóö” -çefΙdÊNuXÆ![›qNë+Üð@ãÒÉ]fUR -5qæTAæéiàH>Å“Jb–FOæ©ß>Í“•ùiž¸Bv¬;ŒÑf|ã‡hÃúQÚŠy¾bh?øÓk°†1+ô“”Q${n‡ó»â„Þ6FYq!ž‘ƒÚªv<’b[µs,i@~Ì…,‰ÄÓ‰ê÷Ïe…¨sc]ÉÙUÍã&¨ƒ¦bø+Ÿ­ß?Í -™;¤z×Po¶¦+ƒ<µ“¥dq¤ž±ß?Ñ -!ľ¹æïÛÚ}2ÝÍ;]'¯Ô¹T^5´Éµi ÕÜåwüZ~Áÿ‡åýþË­Zþmˆgõ‚£ÀÂÞ"úéÀúý3À¬Ð-0,û&˜§*?<ÎõléÈL·)2L¤Ò5*Ò6*ï–»Öæ‚/ -?êœ:’Ùú+~SwŸOá³jgñõ2Ó½‰„¸JåÆ×P$$½ ÚaŠ‰{?ˆ$2·³³] éÞYc—ª ‰{nxö™5TÞÒò¾¡©ri;‘‹9žúŽÅv;C<Ef•¸ -N†UÓç8£ýUfBæk—߉՛J× QŒa¸Ö&5hàCŸÓ Êצ¦–®ìmmh:‹Yß·mLoånÀœL~yɵ ¤ðÜ«©ÌàK[$Ð"|lãò•¨Ú^îß“äÅ=çèž øræJÝ}kgªå0m)šx\¡xY9Zºó›50FC«,ŸÔ½þ‚ëÏßDÑÀõ4îà \®M äÀ¿Ô ‡ßë¯E™Óįø'ö·ç¢iIÙÃPÇV³pðx¦ ñXš¥Œ-ͦ0íuäoLïr¤å+šé ¡ÀQQ®ëzv¹Z‹³£Ä¢’fW‘Æœ>³Ünh«IF­[±î)hÜj„`¥¡‘Ö?Ips\9ÑKþŒ–tª#¼G ä uÍ»WAÿù -ùøí(TÀDÓ=j”ð? Ãd”#dš‡Æ¶î ”^g% 8ãѯéq£sAR-5m8¬e+c¯Rñþí³ão/Õý΂ÇÕ& } ½2þÛ”’4ñ.0OSï¸Pz´ý:,>,þî+‚Ó ”™’p—Š³8é4m b®ŽdJÛy’64ÚC—«\Ð*¤Ãº5]¿œäãê%ÁÑ"á”™Úª¢Û5X­9}âåºè¡endstream +xÚ¥Yëܶÿ~Å"-¥EQUQ8ûlש;¾ Ò"É­–{«F+mõðùþû΋’öÙM,E‡Ãyüf†§g>ü«gËHù&%K­Ìr9Ëw7þìVÞÝh¡XÉbBóêáæÅÛ(ži_¥~:{ØŒ|"Ffö°þÍ{ý÷ÛOo>ÏÆÏøj¾H’¥÷˧¹öÞ}¾½{ÿÓ;^zûy,½?ò×ýí@ðj¾ÐÞí"PÿäÙ‡Ãê«Û…Q¾òç<üpóæasdJQÈÿÜüö‡?[Ã…~¸ñ•I—³'ûJÃòî¤TQh仼¹¿ùy`ÅkáŒwÓ‰£XèT¥At]o±Val½°ªUES½E¾Šüôª2 +t‚Æ¢È÷>Íö²¶…©õ +Ô'¬ž,ÿWlµnq6ö²jÍË·¸Üw[[uEžuE]]R–{Uü‘†Ä×ѳëX™˜¤ØÚÆÎÁÒx[8›‰÷ L“·ÂÏZ±â©Œ6ö‰÷U°ÖŸx!GĬz¤ù–ç»mÖñè>Ûá+á”­w2)Z¤îÜÚÕMËìÛmÝÃL¹J<9C6Ox^Ö°8[o˜ôi;Š­½ŽkÜð…N{D%ƒî}#%mtµøí( E8ð“ÄI ’àºI&4§&I—Ê$fàƒRè“ô«e´¼zš£¹~œÖ2:88ï ª#Gõ Ÿ÷3(úg’x{4Ù¦}BµÔ ¹0¬lÉÎ_ à…˜Ç)Þ$±'cà±*­°\á–g^_ÛMÖ—°ÞñZQñoÒ¬mÃ_d^…­mõÞ¹ žu‡23 w6OE·=cøºG¹Èƺ­Û¼`–5zÚ×ù"LïWtXˆ`ñ©'qt\"U–…ÛÌóy»y†W.9Üe$ 4Äd1fÆ[×ò¹#–Y…_ZB +Ó4nixêw?ò3øŸæÏŒ´èÚh ö‰""ÒC–“ðqNn£#¡oé+t Àì8´¿æ‰MÝðÀfôÕ·¶ù‡è@<…®XBüüÎVyó 'ïåœ=Â( {kåyÉUýèNý ÛQÌ„ÅŒXA_‘9Y†¤.:´ÁóXÛß}VÓ@0{&à¡òºB‡¹ˆ~¨Òäz¦žÐ\Æ¡Aá‚Ëøpå´®7àÃä¼÷U^ºEw]˜”Q§ðßDeó¾):ä0û’2gÃ4ôê}'Ìñ ðv<Œ19”—9ÉÌmÞ×»¢q›sH"r<Å)e€¬¨ÎØ»o%'€}Ã!ðqLÀÅN—N‚•_i˚ÿå¹ØfuˆJµ¬Dì:œôaðá÷Ý~â/„ئî8ÖóºlÉÄ3रþŠ ÉÖ˜ä¦|r²²­yT ½ÖN -Ov˜ q°§3jŽ,Ôíª ˆè0„ž™m±¸í:§œDEOØ3٘鋪îiú=Á¤©7”6´Ì0F$|çµì'ÐêÏbô™=‚n:@w 0 5VZdýºW;` œ’aY‚›V P’Q+qM\@)øàôJèçÄüp ÊÀ/±ôD·œ*åˆÆnµ¦ †SN1¡†`À˜„wñ§*Ø“èªLô£c0òãt™P!°¼Ô<Îxðy +B½˜Ÿƒ#žT$¹èˆôÄöejM’e0¦§æ@"ô¸jCæàëRxQ˜ÃêšÒy¶ÊZqᣫBÕ¬?š^õïÍõ šD«(0d0É×¶Ë +ŒEȜK¹¹\’àH÷Y“íl7„}+ñ»ŒU¸ Œ(~Õ»«SÕAb®d4„.&(¨j¡ÌŠ i $f­@6 @®BÖ‹–·—{gùÌó®î!º1ò{þx*Ê’G•µk!­™¥ÿAŒ¦í¶h»c2ç 8vÒY‘"Ë»>+/å×±ŒAôã¼`Š''‚)W‰Åã ³Fà÷™Ô24y¶&äŒ̸¶i& t—RNB€[?e _<:L‹0ŽÈ}•%[m!^<*ç$¬§…ó1e)€…ä5;PÉ;¤ù‹iœœ¤+"7ä[¢ÙqfZíJ;´<Ü3•¬Â®m""‚¹«²ÍDÊ3I’b´ty‡ˆ€ +ÛMn-N7jÕ´¶µ< ¹IO uÎîV(Vq̴æEƒÅs¨}r ëÂÊÊÖXQßÀ{R< Á=Ùï]šàî–Ðöˆ ¸:àÂùš/ —Ђ_e˜Ð\|e£¼2DòÊðZ/ƒ¡i»ö’²ýª#ÍÅ׳LU”jã_¨iD0¦ xÜRjÇOèó¾_õ¼åµ=•BÐÿí\Iû¹˜ÃQËE‰Í]M’•¼Àù…š{N#eÜnüœÔ0)ÍH½ÚŠªW½€ îL€ +|Q@FwïÏ8{^‚ø”°\kÇÆ{Í䢖³qè'^ÛïùîuƒÊð!ž1îq)G[òùG×K a +üôc´ƒ^è´ÏäÇ™ìà +¢ôQ—pŽ< µÒ~Ù-V~üRÀQ/&ä§ÞpÌ•ôK5ôRR’ Ò N`OTs$fh(kÄ<ñTGs]¸(ˆ Âa§$†>$asÔàa÷ù2!ÔßÁõîmBs1’N!ÌôA$ÇÉ`|77>?~º$‰p¸*ÉHs1˜!5«ÔÉoE;ih9úÆvË`¤wÔT¶u‘åÂkœÙ¸Ì:—‡|›Am&¬éÉäñìÛ‹±+J¤+ +†·ê)ç^2TÅ^”^Ǻ Í`¨õ„Œ +ë{pï'ºË¿ÚÞç[»Ë.É#|®Ê3Ò\6—Ÿ‚÷“8à&ˆDñÔ+ôïßc1ÃüúD9É0oN1ô~;)Ƚå¶há¦ãW> endobj -6320 0 obj << +6780 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [131.073 531.126 368.701 542.815] +/Subtype /Link +/A << /S /GoTo /D (passdb) >> +>> endobj +6782 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 573.654 192.49 585.344] +/Rect [440.111 372.925 522.084 384.614] /Subtype /Link /A << /S /GoTo /D (unicode) >> >> endobj -6317 0 obj << -/D [6315 0 R /XYZ 85.039 781.388 null] +6776 0 obj << +/D [6774 0 R /XYZ 85.039 781.388 null] >> endobj -6318 0 obj << -/D [6315 0 R /XYZ 85.039 761.463 null] +2502 0 obj << +/D [6774 0 R /XYZ 85.039 761.463 null] >> endobj -2422 0 obj << -/D [6315 0 R /XYZ 85.039 761.463 null] +6777 0 obj << +/D [6774 0 R /XYZ 85.039 743.459 null] >> endobj -3032 0 obj << -/D [6315 0 R /XYZ 85.039 646.155 null] +6778 0 obj << +/D [6774 0 R /XYZ 85.039 699.822 null] >> endobj -2426 0 obj << -/D [6315 0 R /XYZ 85.039 646.155 null] +6779 0 obj << +/D [6774 0 R /XYZ 85.039 632.076 null] >> endobj -6319 0 obj << -/D [6315 0 R /XYZ 85.039 617.419 null] +2506 0 obj << +/D [6774 0 R /XYZ 85.039 448.505 null] >> endobj -2430 0 obj << -/D [6315 0 R /XYZ 85.039 558.211 null] +6781 0 obj << +/D [6774 0 R /XYZ 85.039 416.69 null] >> endobj -6321 0 obj << -/D [6315 0 R /XYZ 85.039 528.807 null] +2510 0 obj << +/D [6774 0 R /XYZ 85.039 347.228 null] >> endobj -2434 0 obj << -/D [6315 0 R /XYZ 85.039 388.105 null] +6783 0 obj << +/D [6774 0 R /XYZ 85.039 312.685 null] >> endobj -6322 0 obj << -/D [6315 0 R /XYZ 85.039 361.49 null] +2514 0 obj << +/D [6774 0 R /XYZ 85.039 267.595 null] >> endobj -6314 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +6784 0 obj << +/D [6774 0 R /XYZ 85.039 236.178 null] +>> endobj +6773 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6325 0 obj << -/Length 2776 -/Filter /FlateDecode ->> -stream -xÚ¥YKoã8¾÷¯ðme`¬EJ–ç²èíÞnôbÒilôag´-ۚȒ!ÉÉäßO½HI‰åid â£HÖ‹_UÑjÁŸšeIéÕl™©PgÙls|Íö0óù -“è01Ú&nv‘Æad–iäŒÅR­BmÒüëþÝÏŸâhGašêÙýn¦TjÏÒ• 6³ûíÿ­Âù"I¢àf®‚bßØ®¨«ùB§i°›/TÐÔGî}ÅÞ½ÁÎ2øÄqàOvõüÿ÷ÿV± WQJ[ßÙãÚ.4S|ûøIÞýûÞ3-<§é*LâìªXK%3ÁA«‘X:S9ûþP´pp2É×â'yÎû7÷çÄØæ<"0]Û¢`8EN¦¡¨["Žƒ§¢= Eµ.Ž‚£[ŠŠ”w ôI‹°ð+iF·4h‹Š»PzœÑ–N™ - ¿"è­Q©H(ŠÕ&XÏ‘g<7ß2ÉÖí íñ¾á” "ÐœºîYçYÊ€¯¥C$™ Ó,qžE¾eVÁ·ÒV•×ø­¶Üøœ“Ž;šÄæžÝå®ÃŽkðÀ»ÌwW*[%WùÐL»N’F¡Ö1ñýUë ;O9·¿ósû Z7%JÇ@–7BE®ßz×岉åOkqÑ3X…%¤ím'4eÉ[ÈJxµÌÉ›dOë!…á>lÔgRšØØ2Éz¾ˆ—L¸±gòÙØWÜêD¤p&ɧ]ªÂ3Šj&4*‚ ÅÚˆµ;™]ª´ø}æ•è¤H@—µƒ-[r(?ó´b5£*p°ª¥A:!fæˆAë’OWÁQ–mlÅ^Xµ¬ŠÂ©§8Ñæ´r{A|öØ)Yf!¦áÊØ  - ª€­ -Üíá‚ýÄÊÞ׺Ý`+´KooÁfŽ®0‰tÇÚÃN,Ê;[À!OƒÁ®Æe':6ox¢C¢ç~ø‚ÄmÑ-]W-á»CªûÔ9Š1Ü©ÜQ¨ðbÀ²êÝÜ1ýwÚdëÅi_‚âÉÉ@U+@¯º3˜«¢$‹ ¢ø=á -x4¤ý` §þcAÌVG¹[x$Î'r×Ï|× ƒö`†èÑ5K$ö.Mƒ©hÜ2ÙÖyYg‹räq&8r &~xDœ‰œ0]l„´ -͇A—?q_®záТåáNd‚æÁñR"¿:ûîÙ°œÀŽû¼czÂ/Ló¤¾îóLS!Ǥ*Luº4>ä¨p…"÷ÐmÌ*ÌâaÈQËin׿3 -ÎéB±¯>æíOf^&žb:”˜xÆZnœn@éä ÏÜ©×È\ð{¾é -ç&8¾Cü5qÊZ¯ÛNÈQû{[-›€"‚a0`WpÀ#!vÐñ{´ƒ3:ÇÑØÍèø¹${Ø û:¾œmkÜ®.HÁW71ìúðEÿÄ[¹t) -Œù+˜èþZgäy|ƶü=Y:¥$»µrŠŸd&@j‹>( ¹£4¸­r¦ƒPÇL¹{lðȃ-$+ójŸÓ}@¯¥+1…83 Ðq0ySäÕ&çeœp¥ny3XïòA¹@©ó@IêÈ[è5ŒAœ(Ÿ°SàÐc§®\cÇ_·ÇÂ'~^ÅÑVvÏÙE.–`(p¡Øwèˆ$ðaQ d6e#=ˆZ 0ÔðyV=ÜÅå¨p›œà- n88>3ÅÓaNdwaxý%[¸“š¶g§L‹â4"vy&É*hÁRhAœî*ÐM*Êmê}‘‹e€´ƒqLà`þÇ`צpŠª^NyŒúÜH.•rDCN0qn„9š‚¥–?T m\ åKPïÙ^kam[W€z;ÎcŽ¬·¶.Q7= [1¡6~‹”iÚ¡1ɇ…œN£¦qŸu™Oæ_:Nj83v»Í¾|æA‹!ä±h‡‰—ËŽ•sz@GIl×±/HŸbqV€Ô8bÅ’6ÄÊ 0 -[ ÜLóÔ0Cp(´Ì-*ˆ„†s‡Ós¬Ö…{lÑì/Í3]1pEÄ {]7²|-yuøm{zÂxøîÝ­B*Èœ`‚jaÈ=‹nœàô[°é_áÄå"¯x„ šAÁö ½|Œ—™à'Þ•€î ¸i–cF–&x¨‰,œw_6b~ØØøùSšBk¬²0ƒÒ3"®XqÝ(Ç:ŒWZÈ~™e2„FÄ)Ôœx™¥é¬×qP^rš$:ZÄ&•yBÝì)K“(Mhf‚o¤—þAa] -tkŒýIøT\@Wªü>jûLθFï!Ðá ]émþËËÔÆ¥%ñ* -—Àì…ì&†YeOJ›Pi¹_!÷Ñ«0²ßÑÕ?žšú%dû@âî VNfŒJv]”Å\ž'¥Y.Ãøí²¸ÕW$!”ã1¢ó*ƒÚºë^¤¾PjK«ÜûRòpÊ–7èïDñ¦z*?þ1ûõW¤"”ó¿‚up‡7?`­ÚUžìÁTj‡5m×NÊ•D¡Šþ†íúõWä¢ ¹\Ìf >Sd–+ÆÏ%†ÈÚ.Ñ×â¯>rË»žÖXl9œœ4»ÐŠçŸ<úLêM§ËCoýú+z"ÔÛ{òÞºØöÒßqó×bãs~xdå¥<]O¥ÛèñmJ.í(Òo—«_E.!šð‡àý¹$ãXÈ‹›÷e®G\q —D±{4¯ò²…JCú&:óiÆ -Bð},:ôlúœæåÛWvæÂËR49ß¼=Ëá|˜vÄÈåv¤Ô‡ÞÑúWä!'_oï¹O6Æh,úä½&cw„÷&œÌ‹ÆÔ Ô˜Õ0T¶<‚ÏwôE!ºÜ]«ÊöE1Nc®*y\”¹¬Z”P*÷úWw&GV‹þ¬ÞfR›ÀÊÿ¢Äô*#¯êZدèÔs!Tš}¥-‡Â‰çÀ¦m}̹Åé-{æÃî]U«7õñdùé6J‡ ÂÓÔÆtªAʦèeyC¶lk^ЉpvŸ_g\DKÏþk Ç–Ë4ù˜¥üé¡å‘c_¢e‚iYÜ—‹>9ÙîLÅöÄhø H÷£ÞI÷`…âäÞ -áG<âŸLöÍ´»UR¾ãõt`Ä×…îè•#6J¬ œ4|é8M ªÂ€èÆ»W/ÿ†‰dqEL@N‚AªÀ ²ää8÷[”DO{ôònð¸;PMuÉ4ïïEˆM‹Þº]ݵަ[8KMVh߇5¿uj¦ú?wˆhÍ¡¶ÇO~“¢ÇyŠt'T„J.È¿¸ýs*¨( Sýö(7X? Ñ+õÎ'zRÊMñ¿JÂ({{0ë—Os/4Èügº7ç3ÉÅFé³áýVž{±Ä„è‚þ5Fƒ&(Ó£Ò¹{fÒ¨-ôNÜ<£3MIŸ)ˆpæÍÒ÷˧¥”þÆrATT½ÓŠŠ—1Ú?¹:I&ó‘t®²·ËÐ/Ÿ–AhP†_ë½ËîÏôˆtrVš´ÐÐesöÕ ‘üµ?y³Hýòi‘„†"ˆä>>ù`ÊûýÎVl¿&XAÅ^ÂMÿö k>Œ~ÁnÇO‡¯¯/%󬨚™¼üÖ¯£0UÓoþžòµø:‚ú)v›Ñ/fùò@Hú@GzúÄ?TˆÑendstream +6787 0 obj << +/Length 2676 +/Filter /FlateDecode +>> +stream +xÚ¥koãÆñ»…/¢jÍÇò´|±ÏqÐó¹g ÍZ¤%6”¨#©Øþ÷ÇîrEQtÓàk³3³óÚ™áy3þy³$nÎâÄA’Ì–›3w¶‚›3OA,È‚ùðxvñ1Œfž+R7=>÷xB!Ã`ö˜ÿâüðãåýãõ—óENàŠóE'Î×ûsϹùryu{wÃ[¿œû‰óùÏ.?À‡ó…ç\.|ñ3¯>~6».p…{þëãOg׆OÃð”"“ßÎ~ùÕåp¡ŸÎ\¤ÉìÆ®ð`{s\ŠPj^=œýÓ â=9ãSc2 ƒD„Ip,/JèŠÐ•$”ÇuŒ_|  ÐZ´ýWÞ<Ä"dªý+“Œcçáöj +"_Áþ}—ˆ(À2Û"²Äy:_ø±Sð¤~ê²r :(P9“{B½ñ¸Ùãî¶Ä?+>37ðìxRÁr Èg‰ó ç-ŽÊ|L +¾òú’¹½»»üt=‚,áÑÿ(ŠzË|w¬žÙBúžˆ¢p¶ðÐRzÈ6(†§Œmñþêd-þJ§©IŽu'‡;ƒ™pÓÔ(~$©SW9ZD¢Í.—Ëd +¨;µ³Äu±AJ©ëÀ/‹Ÿ6YÌ Ãªâ£>„Ý·E®—­C;ÒBAj@Í=¿‘ŽW¼Ýi澫òl§•ü |L†‰ð½h»©HÀÿßõ²@øñ¸-4®……ìØ…däÒC‘ì¶Þ {ÈgÖ}njﲶe{õàâ¤Â Ž„ÕÙ*|Ê–(•ßð™( +!‡Ð$A?Ö(ö³÷;š¿Ï±nhT‡\’Lm ºÒɶ¨—mÄi9AIlkç"àÕÙ”ˆnß-ÓX“ÒWÜàŠÑ3ð±å£b™¶®V¿¤S¬Ë¶«›…¶IKå2CŠ|Ö7[G‡ ¢?àzýÌ¿ŒL²yj—'+…­»ž¬ßä1ûÅ–¥ÂdDérS°ôŒX"€áZÏu£gZ5(c&ðyz O¹ùv}×€. ÿhøe7"e¥ôÅŽ3d•5¤³’¤ëÈ{>ÿL›¬3…q[«#Âl»"ÍÁZ©ÐK›„§NÑPIH´#* VÁXøùÜ`Å»‘Ü Ïµ€”h6aŒQ[É¥°¤Ã:¶øÛV¸÷:„*4R°1Èöyñý‰ç;òà ðƒÉDÄ‚¡€!=;¬»0àÑ@xyK<¤ç¹”d’ †9¢xøÀfàùMl¿Bg"ÇGuᇱ³ÀŸ”"•ÞAOÀÕ„öµQæ†ö­v œ¡#dVU*ªP4A”h¦eÞò>)ze4j‹4‡¸VlÀÈ^E}D“)°-›BÁªÏš·óD:bÄmÈá|x| ’ÙaÌOárÊ{iœçV^áCØ&™ÀÁ9š>=4k÷ ±èuÎ3$7nÖ=9cÕ_QÅåë-ÞöµÆ¿®Ðn$=(ð³ÔÁ¼àèGâ†u­ÂXå„8°Tˆ9‹—gd$h~F“°8Œµ°tk‘þȫ4 @¬UÆà%l{~,3éÚÛâµÓéeÀaOd•=U–u0ËDo×ç´:?Ž½óþ†dQe>?a42òEšø“VcÁœ6 ôžÝL4†3¤8j96Ec:·¶œ<çZe¥`(XzÅDÏÎþ:^hûçÖÄ=3^øQîtçVi¢C]bU*ž¯bß‚iõh¤¾óõîOü̳=é ßb*Ïb+~GŽa(WIªä †ƒeSXU½š…ì·™}…Ò¶ü;+PËTÈ øS…¯Æµ°kŽC†"ÞÒ8-òLJåŽCŽ¶_©+ènÄ 2:aîä¬2ž6÷†ØôÝã—t¡ÔˆX\ ¯HøXÉÔ¹#6°Îˆbç_ž<×çW$¸Sdçë4Ëu vu‚aWŠTN7*-˜“=¹ gQÙ¥¯2ñg4wL«Ñ‚Kjn%`ãÈ9n“õq&–õö™·)qk² ?åØLµ]_œóâ ‚Çã‡91®`‚O;¥Z(h^6}õªÑršÞtº@à\!ñËûãøúmßW‚€¼/é¤ób*9•ÉÎ1 9h­°ïØi)—¾ó7Æ¡2yˆ@ß_\!8"K²H¥a/CW¸œ +©>–³½pN¿ôŸ +Èä'‚9´5Ð{A{Š  ÚCŠ£AÛ¦xàÞ¯0Ž_y}¡^»ÖŽeÔó¡Âƒ"}CM®õ YaÕƒ~YovûnÐÈ–üfS›†^ö”ø]âœ7-þfBü +è]ñOìÅ? 8.~‹âø•|•,Z³´¤%Ρ(˜®‚¶ÿŸ`ý~ÓédÄ‚9-X ôž`§Á)Ž +Ö¦xülqv­?3 ŒFEl¹¯ä+¹<™FÖ5F;ݺŒEšÊi¡÷0BW@ï +}‚`/ôÅq¡[„¾êëÉ÷B pû£ ¥öºõI ajWX%ë+~ÒS$.ìf¨^Öâ€@X‚ZÏÐ ø®HÒé6…3¡ô®N&ö:P׉Eñ@'ªít*¼ôͽìýÃVð-¢¹6Vݼvsû„¡å¯"~L™)„Gá& ±uK½tÉ}‘(´šq¸:b-\cdÙòo^àS½µßjüjuf$½ð«Hê†/³iðÊÖÎ…’|ôÑZñª>H„NSX=Tc`°aø~ZôòÂã|m¬£y‹Y”›rGo)=tÁñ®&QÖ*Y­ºÉ­çSº 1j0((ÃnTe IܪåY©¶ÆytŠ‰›ÌE¹QžÙkrì(öœËŠÚKü¥P!ÝUÜAä¦s£súÐw|ñ¾£¿'4mwúó^âðs›Ô•Ê1ƒóÙ t©ÊƒŸªÜ”]Öe‚% uƒ:æ-ï'ݹ˚–•vJ(ä°!²·Î¬©-U©*VùÛ nïnnûMs)`øên® +H˜¼”Ýši~Û׋ãlº³t“5¿éwçd®ê +4qtgJ ê¿.XU›H‚ÉgèûÂ÷4/T³¥Þ_ý_Žþ/<¡òTendstream endobj -6324 0 obj << +6786 0 obj << /Type /Page -/Contents 6325 0 R -/Resources 6323 0 R +/Contents 6787 0 R +/Resources 6785 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6304 0 R +/Parent 6790 0 R >> endobj -6326 0 obj << -/D [6324 0 R /XYZ 85.039 781.388 null] +6788 0 obj << +/D [6786 0 R /XYZ 85.039 781.388 null] >> endobj -2438 0 obj << -/D [6324 0 R /XYZ 85.039 761.463 null] +2518 0 obj << +/D [6786 0 R /XYZ 85.039 432.047 null] >> endobj -3033 0 obj << -/D [6324 0 R /XYZ 85.039 646.155 null] +6789 0 obj << +/D [6786 0 R /XYZ 85.039 397.903 null] >> endobj -2442 0 obj << -/D [6324 0 R /XYZ 85.039 602.617 null] +6785 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F38 2997 0 R /F41 2994 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6327 0 obj << -/D [6324 0 R /XYZ 85.039 571.092 null] +6793 0 obj << +/Length 949 +/Filter /FlateDecode +>> +stream +xÚ¥UÛnÛ8}×W}¢€ˆ¦H] äÁÙ6ÙM›MT @6²å:êʦV—õæïwfHÉq£6A"Šg.ggÄÀð¸iÄ…ÊÜ$ ¸JSw½s„»äÊ ¬…oMüg6¹³¸Œb7<™›=Ɖx)7/ïÙo¿/oò··ž¯”bJpÏO’”}¾ñvu»|óîã•.o=™²O×æíny ž°¥/ù³›šÐ‹¥¯¸àÂ{Èß;oó‰çÄ8eHòoçþA¸%ôÞ\e©{€µàÀ;Xò(Tö½vîœ?¦P ]ã5§ÉháÏdôsÝ ±št“bF·HðH„¤H¥8hãÃÂŒ½+¯‹ˆö€7žlyc6:ØP­-Ó¶ýÔ S8Cõs¾GâD3|`Ý»b‡ç·*> endobj -2446 0 obj << -/D [6324 0 R /XYZ 85.039 461.651 null] +6794 0 obj << +/D [6792 0 R /XYZ 85.039 781.388 null] >> endobj -6328 0 obj << -/D [6324 0 R /XYZ 85.039 440.454 null] +2522 0 obj << +/D [6792 0 R /XYZ 85.039 761.463 null] >> endobj -6323 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +6795 0 obj << +/D [6792 0 R /XYZ 85.039 741.337 null] +>> endobj +6791 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6331 0 obj << -/Length 3618 -/Filter /FlateDecode ->> -stream -xÚ¥ËrÛFò®¯à¬2¼ú&[vÖ[vìµ”Ê!ÉaH€$Ê Á eí×o¿æAP¶”R©8ÓÓ3ÓÝÓÓ¯A8 à/œ©ÄËY^„~\³õþ&˜maäç›P0‚²ppÞ<Üüô>Kfaà/ƒåìac×Iý$gåïÞÛÝ~yx÷u¾ˆãØ‹C¾ÈóÂû4½?½±÷ðáó/<üþë<ʽÏ0ö‰¿<Ì¡—pç ÀïÞb;ñ>3ìþöÓ›ÛEÌ@Aøóáß7ï å†& r‰dÿuóûŸÁ¬ÿ}øñ²˜=B;ðCÞßÝ~šÄÒonîoþc–â±dƳƤ”Æ…Ÿñµ˜ÂÔSÅ~…³< ü4HHN» -¸SoS©áÔ+òÞ3pØ@ ܹWûyTx+EŒàîó;¾ÇNâ»G¿×*eMu(ypØñ"‰·ÇÕb>1`5_@G&´®«Ýy¬ipÑÖqêÃ)2%[–̹4ˆrÃJ3&šKªKÆ3‹«*j“òLñ¿á2{9vþ3ü ò÷¾©~ÔÈV¦Aä‚@nëµPŽŠž,—”¹ÿ¶ Ad«d…FqØUd¶†Z»z¹+8u¨Ì⇶i·µá -htŒ -V=ÛnУ4áh¡TG¶Îh×_XÁ=.ý¤qþj,ös†1Åàq<Ôû¿äíÌŸ–·FB2oWäÏTHÇMõþØ°-!jgN?›òÔ8¶‘qS‘Ùéëía¡­’êHü(lºS$嵎:§d‘‡ Í ;ÿYÒ¨,À¼,àÕ Æ`uóD$@ÕÉZWNëµ6Æ0 N’YÝ÷ Ø´hÉ -’!¨•Ö‰¶qÝׇšâíÓžu©÷[?¢k‡j0‘"¹þo,ö‹æSÀÀ’”‡$vG iÿ²yCt³©Ä̓èÚvj0y&ÀÀA‹@SÑv÷Q6HN»gÄO˜1±÷[}()„#tI:Ùf_H~Ï“X…­²iöÜü^mâL“»\±–Nå`ùÊóåDj)=ɼZm×sG99GæÞº=ôp*]UB~™Ä…÷+ͯ4¾\àñÔ”œ½8éNÆâBœ@_¤Ã‰£µ'ap‘R‡mÕóþVí„Ú½2~êB9ª: «­ªŠ1$ˆrÛ -:‚qFƒë¦áÖŠât‹ë X ªFÒ9™ÂÑ'4ÄãÉËqíÞ!ÝL7büFAMžYyµtâ4rÕ1 9®ž¸s¨ŒäÓ€õ-åSiñT—¹äÈÜ´MÛãdçx@u‚Ñ[’¡Ga˜ÙOÖ0 -…œ§_2< m…Iw¥7vïûÓš‘„ÒoNÖ s®±íæâñ^OT)’<ð£0y¶ãà!׊µNÒÂÏ vâqè‡>ìL?à2—ÞëRSãif¹÷‘â8Á§yŒ÷d˜¢0Íü,û --Έ©×Æ„œ‘HÓ$68pÇhb²ŒðªCÜœà‘Ÿà¾3†êyPq·l÷Ä­Ô²³ìȪ7&ÏÂàïm¡Ã“í>³j^Ó@|­£`$Òµ+ŠÐíhY¸—©Ä,Z¢JçHŽ²ý²Áa©º'Fа3R0ˆy%–(ÅÐËãL¾ =ÌA?ˆ“PŽôë1°kZ¨íňֳH9oíPÁ°>G·,KÀ· ƒ*Ù·ô õYìòŒGÐYσú$°­O¢ú1ðŠýŽ,4Ùv·Çô…þ/-/(lòpS–çÑPymÁœã³>î‡d:Þ(ȾÐý&ƒpZ§:CN¢ ¾À’ˆ‚)0ñØUÙóÂdf’ÂñR<Ò}-y„1–Ö¸B»i ÝÄ<€F–ÑwcgwDé×{Ö­<8S®a tü --¢lIúþåN@(”&8)Rj¿ÓðB Ìm;Û¨ô’6iÈo#".ÿæîm¯G±F±÷aàaçØq-¬‘ˆ¬´ˆ·­_Å9¨ï¤8U -…"dÇ€³jñ¾ Ørå;’ñÂU(8#³¤zž¿éP²ØúT¯»¶o7²»Î{ÈùBÞ£·îyµ3Jë¥øšM›œqÔÒëô)Ê9€‹òØ;!êÀ€wÈõíî]ÄйڜΉés¸»(s¼MtçžpCI¸¤W[j¥4=ÆæÓêúÆáÈ©¿¾˜ÂòʘˆTìÇyÁŽ‚Ð,»<“sy:[˜Þç¬òaW÷<•ï7YAH´Q œ~H t4×ä·Ý–æ×½¾šÖô+²#8OvãϘ2Ùűh‡m#FÏ0§3$[©¸2£X"häsG‘pB=ðX³áþš¢º,9ßÓ,òd)VWåØŠæøŒ)—´©!«x yÐ}íuÿéÚÒžy;AtχZKË)âøTb.Ê:á²æ óݦ—ú´S"§õ ‘\û2¯,Ùê ™#ÙÊJj"&RF­Dö¶B~'pEøŠö<¢fŸ= cçÇ7uZ|“Š‹‹œy!YBs -|âÈÊ‘aAr -ð ÷ªÒÏö Á~¢þj2y£(, å‰>ö4”È®a%7‘“PJI€Ä]ß)nK J=^M3¡Z\æ{²Ad‰ÓWM%ƒjͧ֕:Ÿ&Š[M°ãž¯¯¨dOÑU–IšgŠ - °_‘Ò¾5påæœiž£Žj}V2%ÒÉ\Ë tíJÖòa7©Å·!°ÑÚÑ}­cSÆõ$Ùîr œ?- -;{í+™;eª“ð*é_ñI¥´ãÅ59°eÛÕ¦˜Å#WÛó…óz¦¸©­ ^ ^ÆG¸aœ½-/‘Éo;÷íHÖÇ"“JªŽ« -&*Ƀëãü»ZK4TKŸŸœä!öBUËïÆ¢+]ÖÅH óª¥8jIY‰Tr±=TúÑ“zÚÁÃT÷Rž•õqbe*çI(t´$X“«¸Qòd£eÆ -ôÀš­Ë\3ÊÚQM‚‰k‚gŽë–qÞŠT;Õ4Rv¨ ©É‚'ÖÎÄñXàÊ8ÖÊ'|.ø+6Ø”+p-˦ OqaŽîEuI˜(k_ùÆìR·â8¨JfWט•|jnêX¼hÕ£3§¶ÆvÉÿdÿ —µqx2üBuo¯‹¸à†ÉOTºÊñzÖ|R)'åuïä}–9{ Ç\À®¦TšB0\ïëÖóì;^ȪH%µvžÁu£Ä븄ܲW_m/Šò©~ÃJ§ö•z:QÂ6)üî1—¯˜Qù#J¼0°‘RÙš,MæÞ‡ûz8鬓łP“¬¸¶Ø G©3œEÛÕ²Ä`óPÅ|#b ¬íž»z»“’btR½Ø‹f•VÅG©[¶ñÎuãçrÅpòeœoHu¡NbÚ¸~†$s”Nb³Ãe€ %¯ú6•N˜Üsa|ù„eÓìØØGjŸUÇÒ4'Ÿ§?jù¸?1J³g pÎt‰0Œ;È/J„‘”ïENdҲܻß), vú–e)(s ;”0ÆäèOR]¤ÉOX_œ.-†QäEúŽ|uÆæ}ôq¤OPäÁ<ç§yy‘Í0=æã%è™åÌg>ÊÄt0ÜýÜ¢¿‹™0JªÏòž1êop[uPÛËwÌí¢f>usR]›W×&¾f›Ö€Xã›q²x è tpÃÍ'ÙL%¾¨¬RfÖP‚€CÄLîFxÇwâôdµ#½W ¼+ÉH‡4Bd—']Q!ÓÝ ‚ñåæX–ùXMK‚V#eâ¡-³ bì剰°_ï¹åˆ 'ããuo¦ËŒ-~½b³À\?+N ›®ƒ~H!ív_0 Ä ¦.ÑQÍ‘RX6¯ñƒ¦ŠËëSW]$>^žÌÙ8?ÕLÍ8ð£ÑáŸwûG†Ú—Ø/â‰O -S0]Q¨i!«›—ôêH¯þv#|²endstream +6798 0 obj << +/Length 2079 +/Filter /FlateDecode +>> +stream +xÚ…XI³£8¾×¯ðmpD›Fìômzš™Zbž#úÐ=lc›.@ÀÏýþýä&!o¼ð¡Lg¦¾\…ZðS‹<ñƒ¨Xd¹ò£<_lÛÁâ”ß>(ሓÈOâÖˆ+C]¥¡ÄÙCѱÊTáG±Bž×¾ÿ5 aà§i´Xï!iøyž,Ö»?¼HùËU’Þ§¥òêC_Žµî–«(ͼ}¯[\¥ÞçåJy똷¿ãϸñGÍû/e»)W@Œ–ÿ[ÿk~d‹UûÖX–¤žy–øH¼^ŸG^Î5¼«˜N'A¾aÀó!‰#3G=çåŠ~D躃‘Óžò—}„–_>¯ñ1ËÝ鶬;^oqÞØëæN$€¼ s€f”ƒÅJAp°/7åPí€/Š&™°Þ¢¼œäùOðO2ÀM³ø;<&²T ±–:øC”Â33‘E±Þצì:„‹@‚X)»/~«à‘ˆ¸lž§a“©¯¢”ÌþfÄEÞ“*\+ïãš÷.Ë0ó4:²Ù]s™;Æõ~¬DZÉ¡DO¼Q°Ø¿—£ð4 /N°ÙëMcD·Ë-U·ÕgökÕWbÍf¹é?Ûò<«ÞÃ3/@ì +Ø5ñh6Ù ¡¸ ãŸP+x‹CÚǦJÄq¡ADýîdœ3@Á儃{Ì%;¶˜üG<.®:- :7.›´R,`4Ç)1÷Äž’3¥Þš|<•#¥@lbLÄ6|$»»Ïœ=9OÇÞÚä4qK•‡’bô;~=h fîIΉä²'bïRã~yh0“Z=Œ¼Žñ»°X.A¥³«ž #|2>§±ã¹¤œÒÝà›ã†™¦6r)SÓõp´©ìPxrñboOÎi™ø韹÷{ cqbs©"ý35 XØ:äj›£®dªo8%îFF1Õ2ÔÚ<ˆßŠè¯uÏ5ý$žÄràp&Ÿ%“qgG\ %gÏ·Åb%MòE¹©T„š ×ûÄûwçŒQÈH³pÅÙ>TÍZöý¯Iîô¥z$ö¢¡—#ò +ßUÿ +•Ÿ™°Ý“ÑÈQv‡Šm¥1Ÿ­ †Q2–E)â…®OÑU‚Üv5ž6dÂþº¼+ófÆ–‰Wp§ :)å4;¦ùqƒ)nM¥²9Óÿ‡'ÃAïÎ+ ±rÀUòã ²‚ðìTÙ­>WÌÜ7§ÐðÜi¼r§Ràv^iüØžz}UÑ„§IC@b×(7uCÁË¥ù1D +Ã,Ig!rxžCd˜ÞƒhN¡…èVãCˆ\_6É棈sU†‚&C.\™eÕ¸S>oí)õ·XÒJ¬Oõ> endobj -6332 0 obj << -/D [6330 0 R /XYZ 85.039 781.388 null] +6799 0 obj << +/D [6797 0 R /XYZ 85.039 781.388 null] >> endobj -2450 0 obj << -/D [6330 0 R /XYZ 85.039 470.214 null] +2526 0 obj << +/D [6797 0 R /XYZ 85.039 761.463 null] >> endobj -6333 0 obj << -/D [6330 0 R /XYZ 85.039 449.619 null] +3132 0 obj << +/D [6797 0 R /XYZ 85.039 632.606 null] >> endobj -2454 0 obj << -/D [6330 0 R /XYZ 85.039 138.556 null] +2530 0 obj << +/D [6797 0 R /XYZ 85.039 575.519 null] >> endobj -6334 0 obj << -/D [6330 0 R /XYZ 85.039 115.84 null] +6800 0 obj << +/D [6797 0 R /XYZ 85.039 530.445 null] >> endobj -6329 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> +2534 0 obj << +/D [6797 0 R /XYZ 85.039 407.454 null] +>> endobj +6801 0 obj << +/D [6797 0 R /XYZ 85.039 372.708 null] +>> endobj +6796 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6337 0 obj << -/Length 3679 +6804 0 obj << +/Length 2342 /Filter /FlateDecode >> stream -xÚ¥]oÛ8ò=¿ÂØ—“Z•DI–î-m·½î6i¯qq8ìîƒb)6/²å•ä¤ù÷;_¤([îpñcHç{†gü…³,ñ•Ï–Yè«,›­wWÁl3®BXÈÂy³ºzý>gaàçA>[= û$~œ¨ÙªüÍ{ûë/«Ÿ¿ÎJ)O…þ|±\fÞÍ<ô>~øz=Ï”·úøù–§ßGKï3ÌÝðÀíj¾½˜;_`üÝ[lÇÞê3Ý]ß¼¹^(€?V¿\ý¼²˜[œËÑþóê·?‚Y Wüå*ðUžÍž¡ø!Lï®o?‰•ôë«»«Ú­x.žñª)*%*ó“L“)L2…‘ò£(œ-“ÀO‚˜è´ÚVóE'ÞnQôÇ>2Ò<à7özRHaF‹ž[;¤Þæ:¤š ÞÃgivâ‰Föa#‚Ù›~Uv Ø7«±“y´zÏÓZ¾;½—­ž·•Œ•ÕZ—·Þ Kf ¹ÿ"D"ætém3‡Ÿç‹8Ƚ]±ÇÞ ÷Õ-^´­ ‡Þ/óŽ]ÏŒMÅ5BÛk}U‚ ¥ËÉŠ‡-o.ÔÑë¢æ $¦¦±G9ùP¬eQ]ð" Aƒ„•£»ms¬çD>ìu׌qÂû£›öÅ#nEÄÉO a€ ÅzÝy,!sæ6]«Ó$§ÞoĨrn+\ÚñÈøØh>¡ãÁg]×¼ÓÀfž¤e¬Bï׊F¼†xŸ ï '|_:î¢r‚NÍm+»*¼}%bH\Ái¤ÎXîR§X# ˜‚%!;¯ìK<,ÊA2d ! ¶;½c”áüªå•¤FØ(u÷È-ËgïcÆdè´Y¯û þ2-ã0vä2d=Â/£^d©kîD‹PÅqæ™”GΔùlo¢J&[‹6#ÐñÀ_>¾ÅÁ]úËGÂ[ú=Õ¢Öbâ0õ:°ÅfJ’w–eú¸CÉÈ—ÞuýŒXˆ³¨˜J"&;h5tà¾{ÖlëÝ¡6Æû푃=Ï> Š*A…GM%™gÝß1ƒÉxÆšÚ‚Ö§Šøú$B” -n.v‰v:ß’˜³µ[Ò{ÆJÄdŽJBeÅ&…´óŽ>³J5ãóa»º€ˆ 3^ܶ¤)NWßrCòßÙ"'H‡Þßàm߸k´Ø—Üè«®5A€§y’¶šõµb[=Yak_ØŸ¢ôŠ‡×­XÑEX\ð‡ímÁbM:àmEVÇ!—ÙÿÀ¤"A‡ôcÊ*ãq^Ë—d²i;Ÿîçú6Rß:¾ -ÚÃ4$³Ž‹®, eùMÛõÄ!DAH¯›¶$YÜ0(™t˜-ÙE§HfGGE°‚åÍ@S3ŒëƒQ|£À{¯k9®N{"ñ„XìÇ_.:W8•ö#JãÉÀ#-_kða¦ç!fëaÛÔµ#D©÷¤ †ÛÖhdpXÒîtÇJÐìçö4F 8rAƒÖIƒbšhiu»üÔõšMÚ‹Á6ì’{Þ 9q˜ÒXCÔÜÕÒ#ö°@®jÚ:TœÎ ð`»E°t dõ}×s@Òkö_/ =(e£e0Ÿ±œ©|ÌnXÁ”“ç˜,™zh›·º‚,>©“ŒlÑ}Ÿ_hØvlåNÅZ n -b#jPàHVÏÁ+Ï(PàÁu×·¤« n3ÏÛF@$ ­ªgnô2i}-´7Ùeé±CThIßW»C/ ÄäA“d„Ò¯sq.Ó¬°-[¢Í;rŽÒlÃ_"SÕsG´ÕêŽY¡·ÚØ¡‹‰B o)z e4‰‘ƒH *³ŠxæBtPÈd¯ˆ$ˆŠŒ²<0ª¸]Vˆ]³·ÊÅó ©P )º -R¢÷VÆF¬+%e|+|â8ýýÆ€ ÁÜi§(wìŸ%J ‘EMû·Ž§»ãÈ5²È„ç·Ý“ ÀÕS´‚Þ³Ù‡!+k -¬Qªï8‰ÃÀRè9øåì ;^#6O‚Ú’p‡0H› 7õ¾V,Å¢´¤Ef†Ç…e¼Xà˜ÿ4÷—aï²>’Áé%·Q¹ fl³Å~æÜ&ÏOÂ}šg@â&’EŽ›˜c‰M[C†re½Þ½Õ/9~]°êA³nÐHÅ ¥`ÏoÐ?A1+ž…äBÙxN¼p'ærW1i!ÌŠÁ¢Eòµ¼„6œ$cD^õ‚mÉ lRWE+Ò?Ú[ˆ@ñ\-;ºÚD¨nc4¶ÀöôtÈmT’YSa¬¸Jò)Sà“»!šÅ®DVrFÖâ®õÉåDzΔõ@­ Hd-›0AaäÙ‹L ì+£ág9™uú.I*Xµx—#ŠUo\&‡u"®ÊI¨`Y׬.E¦—:~,ËZä=‹ÙMMTdâe⧙úaµÉ¡2J¸e”0òUÍâ4ö#¹£ -ýÐÔB_!gãÜûÔlH?Ò¥w·&U<;ºKh¥‘ªøÇh 0ÕƒV¬ü4%¬¾ !=@‰ì‡ÁzÃDÄá#~År#pgDˆ‚ ˆø)|B ­_„’tè¾>Ú¬Š -IÈñ,¹.9´Gaã\òÄmEü†> ´Ù碅 ý"£ -9ÜÎX&ˆxÛjS´¥)^à§×©ºžÀ’Í°¨`+šÂ Ø¥9ôÈQ6J©#LÜ”1Þ ’L+Ñx£n*–äœCêƒ(AÃ_›kŽÕ”ãx”¢<ÇÎZÏŽá6…–ÝÙç3ü(¹±Êitj¿¯ÖÖö¢FV/¼™“6\ åæQ–ŸÞœÆh¨ €ÌIz²©ªS²0[-ÄÒ%ìcè Nç¨m ƒ" mÞéÛáÍ9ϯúÎ’~tíâ%•,°¶ŽKZkŒÖ3 ª€PÈBõ¼”/¾ÙšçˆðØ8Ð䓶ªº¡ºc€ÇÓ!ÚÓî-EtxåÇËÃìaBåÝJ,î¶>u0¸pTnL¦ŠŒlû -r6”ZÚ¥ñ(ÜÀ¾“˦ Än¨ãÈ*–ZÀº†¿3¡3Þ‰¼6›£û8LÊ„ç: u⸲R6nÊò_ŠÕ»)ý¼X]p,*£Õ®Ý²>² b-’ê[ÍF@F±8â¾øI†ÓŸª´1¸#`ûú½rB”ç~˜DpÄýöçÕ§Ï>ß2àÈsĹ'±À‘q`†½—~š/G4¸kÐÆÇ`‰9ñîGmõ@>ñ)qR‰”å‹a/_3ˆ5kRLbÐŽ±MR×ÏåK™f‚î£þ±zÛO] rcT"I úc°ZwÛNN.oãÝÒ\AˆO„‰’Ô‡4gDŽ‹Ÿ(Ekö®#¥Ì!<ü¸çòàðÞuai“ÛR0Oí -Î\¢!4H—‚o)ß‚?!-¦¸-ãN¢dÉ pâJ d`œ ð¹"¨ŠÏ·Ñj…SÑ*>½rûˆkâÀ/mÂ21¦:q9ˆ¤k‰ÏÚÞ^²müßÑÔæ‰)Ž†@%îaƒ -Þ¸ÖÌà‹ ¶§aÿñpzm6tT-¥`¥®ÊMuOQ•‚X/´®¥óë›0Ëà ážDÑÄIUA±{Üì·<°KòYV5²qYòbvÆ?›mt¿5DØÇŒg:2¢xÌXÿ'y¢¬iÎ!šªµ9ê0k²aRÅ“|øRà-—~¤~x;0—o0Û~œÞ±Þ_Ú† -cß7xà ‘Bòfÿúm[¹ýKø¦Ê–?~–v`.GäQœøQ8*ýÊ'ØÊû`‹›Ø“˜òÂ×.WÆy¨Â·0¼`%›W“Fæ±cmåÉË}ß–:nXv¡`qô¬‹ãr‚‰÷FÝ»UP‘wU÷Ø7Î~¡‹ZþÀÈM±/6ÕØ\^(ÝÅxçƒTi&¢Ø¨“šT—Þi6±tié”:5ØÒ áeÒÒîÜE‘eËPœÌa`œèùWR¹Ÿ¤Æ)‹È®L:…ç÷¬QèùR5†N|2DÅјꦚ > Ú6ï_”•f9g[+žëlêóR‹»! nM*Màº4öB.è†"˜æý$ÁÝÇw|C"¶Ä¼£Ÿï›–3?Øtßér8|Èg¼Øàš/ùC[T†ñ®ê{PôŽ{”“ìd‰dø7wü=U„~ e³ã,:U'ï·|£“ôâ‹76ójL]&ÌÏz¶AI&¯©¹1æRyüE’ Õ»!¢ Ïn.U:-õ;KàLCÈÕû¯øùöô?¡Þü{šå“-²“wQ‚¦y]r“tæCFçÈÓ’èFf´&“·4IcÜÒ9¾b™×hìûY7¼Àúf²!1¾g „MnWñÔûs’ìsêZtü%Ud úõ-þnÂŒGK?‹”“\`= &Ãó. wà†Î†”GC:R ßèeãûëOšÒÿ£<7ØP÷)&õÞc­³1N‚¥É«åm¢3±Žó«ö&)ä1q<ÅôµyT£m·Ú œšj•Ã¿xøÑ ´ =*7E"<ÖÓû )û±¯$µµ…[ƒ°çš€NŒ3%z!­©XüUåSV þ™ÿ×/õ†J­ò3•O›Â$Š 4¸ÝŽóS|Í/úÎþ ÝÓ'fendstream +xÚ¥Y[s›H~ׯÐ#ª1\ÌË–ã$Þ™Šãl¤©<ÌÌ’ÍPýû=·†6‚ÖÖn¹\êË¡O÷w®}Ú;ðçÎãÐvüdÅ®íÇñ|wœ9óG˜¹›¹B±’¥Fón3ûùc¸š»Ž8É|sè× í ôç›ýÖí?o¾l>|],}ß·|×^,£(¶î®õëÝ×›Eì[›_>óôǯ /²`îž>oK× +¸óÆßßb;°6<¶¾¹w³ôyPþÚü6û°évÞí v™à¶ÿžýñ—3ßÛ9¶ŸÄóWh;¶ ÓÇìÛ_úÅl=ûW·Ïsþj ¥Ðí0ö/arØBÇ€`ºOŸ^lep’$²šS g‘Nû”¶ØZá€k}'ºúŒ?UÙ“=—½6ïÖé'¶)áS9|$TŸ6Ü@¬™þ[^î¡Ç«!GE» @z+z Ó¸hdm±µD"Ÿ?®þt\ŸöYËgi‰x–.¢—ÐqÓ¢ÍjÜ|Úæßåà!+à\ÀÄ©Íát0¸‚£!Sä ÿnKà_ÁÑìñPÈÈê¬ÄEå“LÕÕ‘;rPl~ƒæÈYq +ÎÊ7¹WûàMÈ)™“|â2ßaˆ_x‰Õ¦¯wyøîŵ^ðT5Qß ¬×ƒ­¼¨€ú.ÍKª³óˆ;ÊïÐñP— ‹ÆÍt‡cÏ S‚çÌ T¥…2n²´U:È + §{œvTWMuhy­§ôÍC:ï .Äg®Ú Îê%Sƒ¿+!À ·Å8i\‘Ï¿Çü±NùØØí„Šû5ÿ‚ꢸ:CÀeI”ØhIÐÔdú`TÕqÏq¦TòÇQT9ÐT±¼ýˆdÿtBG„Ωªù—F€Ë©åþÍ®Wzô[ïóé][Õg¦jØŠP­ò˃¶^d;à…í·N0°Zª\‡º‘ñb—òôuÍAOúÆKÀì.-Å “€ÆKM@}GÉï³L8Ú•ŸØ®çƒˆFCÞ1p5ïè:®8~·ëFC~®³²ã062T4ßøc×õlßõÞpüï„´Vcµ¸å)P€ƒãùfPz(BtÔÇqP4ŽwdɧÑнää“°ðƒÿîá}Cë oæ{/Néû1û8²ÔúŒê>gvâ…F<5ši<Ñ5a§T.•Õi¡ò£Îh3¶Ö ¨|ÇŽ`Žºr¡ˆ¿íN”ý:Ç×8s‡“F¡§¼»tLæ\ʘ +²ÉG&Í9§ë"2£ÕÊž+^‡ó‚Sͽ&òË V%¬(ÑÙg”ñþ2¡Ÿ؃7“~j4Óú©ˆ®é§‰a§ŸCŽ£ú©süTuª™INt[5ìÇع$t¼–Q?‘•OAâ%ÀÊìÝ4$BtÃ’ÇqH4ŽwEEw§B,’´™®xø"ÝæW[•§k p¨à’hŠ¬ñøNÚ™ÊÛôEø/·*F›?IûH–>–áªÌ4ñtëJæÌ7éý^"‹?ÊÉÍ¢(ˆ°Î ;™£!÷ñ£ÐŽœÄ(fZ<ŠèšxL ;ñ 9ŽŠGçx[gZHRÊM *(¨ë(tas¡ZEŸÖ»:Ç×NåC~Û+×5ãÕÓð¢«xöx 8Žã¥qüßðú‚ ²ÉÝ™5ì#z•"›ÄÊsíÐ5ßS4VBt+ëÇq¬4ŽwuŸ_(«[·é–¯œjX?ñÔWŽúh•èxs•L±<ù“vÙÉê]MŽi¹'–*‘âúE^(6¼JdM%Ÿ^ØkîÍ4ÖŠèÖ&†ÖCŽ£Xëï)ï’r×b†’´T¡%†K–ûÄwA®ká*¥¤‘¨æ ­"Ø9ük4Єè*h†=hŽã i?Ù±*D8$WªÒóÖÈ·R¾S¦ž)K1v´ORí쮌šŸh»[8®€.¢¬Ø‡æ:'Œ{í~Ë…a š¢õÅ>}¹<²VËðßEO`ˆZ^àØž™×Ó'DWg`Ø nÀq\pÇ›-ågoœ.ð›weÝ";²œ¤ +Í)WâNt»Ðâ§gEF¢mòÇrÙÝÓj)ôRTU¼ á¦áºæÔ@£1€,DWA60ìApYã89Hb±^›7ªR“0iÂÉôÔGÁK›X—!†++¢¸mvÄ2~’XìÞe±mS''9%n¤þ'jÐðk¾ïiRˆÒüy™õrº?\·|iå%Tö¾ÏŽ©”—Ç.Ñïèx¼Sô¡£jãhÝxc Ò6˜(j/pC­Ÿ™ä ÊòHˆqÈ6Æ€¸‰ƒ)<ü¾­Ã*»ªlxSæ­7ºÍôÕ—kgÙQŠÅšÆ¾|Bø½éÞ”‚H¤Æ5õbÏCÝÕ>ˆ<+ÛŸz¹gB‘Ê“–á±ßyÄ´|Ìþ°WŸ3S¥ƒ‘LüBAg”àgülÅDýk®í'!b[&?ÊÐkŽØ\l?Ñ”W)¹€]ìª#=™DÝûŸ—DÚKÅŠï-·åÕBªY÷¬A¿Uçò[~%ZrH¢÷y,Q˜ “^ƒðA"ÏYfê‹ÆåKÒ$zÈò¸ôƒƒ‡ª(XÃ`9Ud¡=©‡ QƒZý¡ƒÁCƒé„VPá€ÆĸýuY]ÛÒÁ5Z +`Ôo'岪…DÓ© + Ø¥7êþàŸ÷ý½8÷÷mߎý zÄ'µÄÉO‚á~ÕËôņÿµR,endstream endobj -6336 0 obj << +6803 0 obj << /Type /Page -/Contents 6337 0 R -/Resources 6335 0 R +/Contents 6804 0 R +/Resources 6802 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6342 0 R +/Parent 6790 0 R >> endobj -6338 0 obj << -/D [6336 0 R /XYZ 85.039 781.388 null] +6805 0 obj << +/D [6803 0 R /XYZ 85.039 781.388 null] >> endobj -2458 0 obj << -/D [6336 0 R /XYZ 85.039 475.683 null] +6802 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6339 0 obj << -/D [6336 0 R /XYZ 85.039 455.088 null] +6808 0 obj << +/Length 3626 +/Filter /FlateDecode +>> +stream +xÚ¥ÉrÜ6ö®¯PåDU¥9Ü—¹Ù’8±c­™9$9@Mv7Fl²Ã%ŠæëçmÑlÊ—©”Óð¼}ƒÂëþ ¯‹Ôâò:/B?.Šëíñ*¸ÞÃÊW¡@ldãÀ¼}¸úÛû4»¿ Êë‡Ý|Nê'i|ýPýêÝþøæþáÝ—›MÇ^ú7›â–®iêþû3ÐGµEÝy‚Õ 8ÁljwV7Ĥá@ÛÃà$ƒBÏK¿ip¢KÕ#.¾,h½˜ +¼Ú„(í’¨ß*@ +ÈHâqŸë- ©…“*Õóy¸h¦£’Ѩ{¸9¢’,5,0O€\ÕG¤U0êeO×ËåÃŒD²ŠîÞ¨¦kk±þOäAÝ£If¡G¦v`nàÆçn „{&ÊWoë‘×™ |†…¹7¯¶S¯aŽ@^xÁJ5Ìf.€0Œ þym0uSSñ’\"áú¿DGÅC&S–øÜsH& îðÔ^ÎÑÇSSižQˆŠîZŸ¹u2Rý¨·êñ’ jkÞ ûàØ"óZCO]¡V¹7vü;› Nd°¦}ØjGø[¯!A ùD›Á‘7t;Ù“s0ÊBUÿÂcV&æ|qÎykS ‰&3÷w·¨’<§„†ç@H5vÑaIJ!ƒ,¼§é„\Ì.ôÝš©+_úöî–„Ž×¢V¦‰÷™u6gýR¢F8üjeí€r¾|r8…î¡* ~'®Í…»M ¿>ñnD¦ºÝÈGŒ¬¿xã¡%u{sõš°@,›¨ <½ãßN´¿?–a7ÔΆ$k\E‡ÅvÉcôQQzïpÛ›{©‰E,º¶U¬o¸h'ˆ2Ó¥-#B„Q'ü¦«Ô±f$*B]=ªÁâŠË‚‚µ:Âs‡}ÉGcäi,¤üiµUL¡º€L+ä7Ê‚Ý#kŽËCê‚ÌûÐòºâãY›Ðpÿâyò<{ÕêAX‚P@:9¬s,‚ÙøÌi #K×íYA¶Äv<¨Bæ LÖ÷+ă²®ÀŽ2õô8X+Ùñ”å)f4ÊŒˆÖt4J·×xÕ4’ßP´ ]ÿøÞ +%løŠËŠÏ8*{€ g°:XàÆaÂ7Y ª`3jôH`64dró}Ù"x â"àŒñ€ÚïRzÉ¥A;7©¶î¦¡yáTN0µWÁÔ*VèIƒñÍ=Qî%ßóþ¦H<2ð8$ÿ‡±™¸Þ·<%¢§ƒd@ØúŒe˜l„ *ï#•8ßaëèy +(†ëzá:JèbMn`ŒF’‰ï%tæ±ë²g/ÃÅC»‚L}ìFù^ÚmI|Ê_Ħ&ÈM‡Äç…;þmˆ˜ý +C”#×I©Q"J£ +/ þ zLãFŠ5Ê6ÅóNŽ%N9U¸•LÏKR ÌÇvr/G`ø&Pel<Š5xá&ïê\ Y™aŠâ)QW_zEKL#Áf2r0ÌÖËjÌ Ij»e¥8L.j ‰v‹b|½_“$±Ÿeßl×Ì ¯¶“’0óÓ,Z´“"i'}•ô€r”,÷¾6‘z£æYFâç¤wÆ2ĸŒà/Ò‰¢Í/Ø‹z½ •„‰Ÿ$á·éša^mCÅEä'!GòÉú¡hVü~Qõ”d·JJÖ~²èÀ°\t‹ÙQ¥(‰ Õ–¢X÷g0Ïî#eP Ö5…“÷ým7ò¬Ó€AßIÑÆãg=¢:ÕÖä<Ö®¹®4‹$Š¼c'eŒ°üŸóÚ®Ù~%K`$`j°´ÈøëY$t»6‹õ þÚÄŽ&[¾gQèÉ'mîµ&@ÅË«Q1‡ÿn‘ Ú+¨{Ò 9c_)Ë‘ÍIÀnw׫aì'“ŒøÕ %ô¦qìÔ½8˜‹Ú Î\$áìbñö—¶ÃgjT˜Ðr®VöímˆÏÙ3à³nš•Üá’d3¤£xr ¬^5«ƒ‰IÆû¼˜`6²S\Ï´5íÔ^’}[7ÈŽ”s‹¹;e*kµØÏæÚM’¶m“J¸§qÅ6KaŽ|êDùfÊuþL3a¤maN“¬Ä@Ì|CpÛP·€Š•êýyº;*=<ñ×`˜¥¶&m‡Ù³ünt çNe’̺³Ò(¦Ä\¥oº&Û“œ$Û+b̺“|rG=šÌ!7]‹“–X_¶ƒä6ê‹S®°ÓÀI›Ð É’9oñƒš6øÄÔ å:ä,×uö°:Ú¦ôš +Úµ’!¡LL•±Ð@b@oVF˜›d ‡”_—ñ*Ùe|ÖŒ¥¶nè}¨œH^pr¶{áÓž­¦Œ—ÇÒı®´r€q7+["biØ›dáÛÚúSð`òº,‹ÝÚ·9 Õ/׉kP§ÙSˆŠ¼Û»ÍÜûùCáSþb–E}®Yy„p¡:vSfdw›F·Æa)ÖõäÙ§‘'ÓÑçç‰ûÆdIàY_¥;J¾+Í@ã<þ2-;êV›nÇtDö`ÿKº uëÔ{$ëÈûXÛÊ„‘¨ÌI+ºñ`"ÃíØÌ4“å­@så‘}ïð¬©D¢„¼5 s[u«šF *¹†1àïfIGõÈx‡×Ä_šnµC?–!ܾ¥“ç†|Ì fiÿ9]ÃaÄò;HƒñÕìujs;/|ÊYZO{%ÍuÃïVüÃÍNéV’V•ô¶sé·±aHK¸j4>ø­Îáô7:ó½8Ƕ‘3¬5ƒþ9Ø· ¬˜Öܳ}ç·»é4WpÉ?Y4®W\ðI1ÞIÝ.Þ¼3× +TÉ/k\ºŸŸ÷º©/;ÄèÓòþåõ{´ü¾ú¾™š¨uñbZ1GÿÔô›:¬ÀiSŒ¹³=hãÛè¡×æéœÎÀ¼Û$Ã5ê\Ʀñ +ßÙ.·fÅ{a€G=~'[ZžÙs;âijkµ¦àO~ª—lŸÄ¥ë×;mçò£éÑF`%å ˜¸iLZEî´dKòîmÚØ¢!\, ns’F~þ°ÝßQã(WçKfª7ŒLÌ3M¿Þ$g-ÿÐÖÜf±¡|öˆx”¿Þ[Å79Ô3ôÈUSÎÖQÇAvÔjn„ìò4ò nŒìÙ?ÀçòÁMÿ1Õƒ,uü˪!g\°Ï´Æf«Y!½—Tâ%Mm"0FXÇ`ôÙÂÌZ¸HæÐEEÄÅJM¡¿˜gµ\⦜¼RÕx1Ñ7ê®=³äsåÃÍYUo6ò³]c̯:ÏÛÜ(Ê=õË^¯u±X7- ø¨ægæiÑT‚Õ9ôX÷=%‹Ì~ ).»ãFJÖM +JùãùcÑáÝ 8L•–>ß⪈ãå'"ŽŽ½»Ž·I@]I»ûÚvjÈuÓËY”C¸êÎØøã¼ÉÜŒv!$¿páš“`n:SÅN¦MšK*üñcâ‚Ç>Ëßg$Þþû.éÜç%T»"õþÓ=ÊæÏ+H“LÏ”$?1í«ÅÇ%­h7KQFÎßSD¹é‘3VK 0ÈÑôm­ª3g³M7Ìžfº…ûQ³I ke„D~Guê´š%·ªçQÆoêÕ¿XyÆåH\—mȲ£´7Bþ¨¾o‚GÈ–wâha¦8™Èšª È‹¶…ljXÆ`ܳø+r\´°´Ô(rÄÖFm*:ÏiSPµ¼žìãª> endobj -2462 0 obj << -/D [6336 0 R /XYZ 85.039 277.233 null] +6809 0 obj << +/D [6807 0 R /XYZ 85.039 781.388 null] >> endobj -6340 0 obj << -/D [6336 0 R /XYZ 85.039 256.032 null] +2538 0 obj << +/D [6807 0 R /XYZ 85.039 761.463 null] >> endobj -2466 0 obj << -/D [6336 0 R /XYZ 85.039 173.627 null] +6810 0 obj << +/D [6807 0 R /XYZ 85.039 741.337 null] >> endobj -6341 0 obj << -/D [6336 0 R /XYZ 85.039 153.033 null] +2542 0 obj << +/D [6807 0 R /XYZ 85.039 443.66 null] >> endobj -6335 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F56 2890 0 R /F66 3242 0 R >> +6811 0 obj << +/D [6807 0 R /XYZ 85.039 407.395 null] +>> endobj +6806 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6345 0 obj << -/Length 3267 +6814 0 obj << +/Length 2713 /Filter /FlateDecode >> stream -xÚÍ]oã6ò=¿"÷P@j®HŠú8îý¼ÍÇ­½(m[IÔ³­Ô–7Ý3R¢m‘ZlóPäÁ”8â ç“3Ãðóþøy®X,‹ó,çLæùùb}Ÿ?À̇3n ¦dêÀ¼žŸ½zŸ&ç^LrÍ/o®iúýljȢ˜»¢×óÉ”G =ÜÂû·opœDóz7»¸z}1•ôÒü:ÿáìݼ£¼£ ¨,ìßÏ~þ5>_Â8‹™,òógÇŒÃôú èf*‘æyu6;ûO·Í%çôÕ—,Ä”¬*ÌÉ”³$•'ÌrV(…œä\0ÉÅy¦b¦âD³¸üã‘&*G³¶zÚÁÖÓ,º„×^Õ0~Ø"ãÊÇ™¸Ý60àÑ¢ÚÁÛOIÎxV„)ïa4å\9:ÐQ. -z”Ï+Qù¨Ÿ¶HŠúÔk"†H¿ ]À4ù jüw r½ƒ)nAƒ×“n¸¤‰Å¶¾À,ª–ôíþ¬ZÒë á2ÆDe¤ä ÚØ ý@»ÝÕæd:y çÆI½½A|}qõÎÌ}"F’AÕ›o²$•%,/xXÅ ¿%Y 1K -b4*FhTÌE8ªb>U‚ÄK&#Ç|( L©I¼ÚBgÕ)ˆÍŠÍÁv¬P+RéäHŸV6tÕ~-7‘bD z € Q-a´ZDhµÀA8ªæ›DJ;sm[ð¼Àÿh=ÐgþgU¥ao¹ZÙWè *:—RíáòíìÈ‹™tgÛÚijÜж+u$¬þæUPÐ -‘Œd/P@A 2Jy4„Î*h›Õ([§ öÔ@{ÿ­©Íyß::ÍC]㜠Sä™j˜kÞ\Y(Žks¢Ðf€’@wøÝS¹ÓožýEÄ,-Æ"J`²Âm§^&‡ÐY&±Y&;ؘR‹ã­| HS–#¹ `€B’ -/Bè,‚Ø,lýùÃTüÖ¥)G­Àux D V$#)œ04j !ŒÖ@‚­8¯N9…>Lø]aôè\°­Íx[ãi|¼‘E1¢1=ÐÆ`Cƒw+éZWìU™>«2AtV຿X°JÀ†òdŒ§=P€§HóÔ[@ â³< ¢³@¢Mâ·ÏÄŸðeÛÐo§ÿøY·5|À‚ØŒ€~Ò[[’e+hð¶ÑÒ€oªRk«Y¹;£#¯¶:ŒË}õ 4žÛ—w]T±Ùý®Yíû;¼@ó1¾·&„ÍAõÀø¬»rW›è·0¶ô mÌ4I}F%ŠœÅJ^bÈàTF—äÑ%yr‰÷ÍŠbÐs™±L‚ßʘʲŠãßÎh„,ËÀ ¬v:í•:Vc¡,îN -üw+[RÉõýN=Æ›SpîÌ~õ÷cÞ`Â9øO‰40'D 9^éàæ‚éÀ^•x÷"úÍ6àf:ܘ¹6ä§>˜œx¡$Žuì ö„h)ÀÝa(D‚Åë6 ¤±,K²?wÅ¥·wß2ú£–¡‘>\¥s¥ï¸(+-`^ˆT1%¨ q½§.…YÃãæž~?íœ}ÄX ¯ܲƒðÛ©·‹…É—Ô¹LíW£—ØûåZDÆââ«ÕHCç^5‚ ‚jØ@ÔJEnµÄ¦>È=К~åo'³×šÖ8„jM ÈŸip_•í¾ë)àUª4-र¡éµ¾Ac­=ÍÚ<Õ›¡CÛcÓ—êl²¤¿²ú 8}PÃóί¢½»^XÑàž&ù×’d =ŠÆ³œiöWð†KjÀýsÌ_TÏÁõí„wªwBù ê9¤Ïü^G'½ºìj/«ŠS¤•&KPJDWŸðœ3ÇãÝ%^Sê$'ù~@ƒBë&…nÈQGm¹Ã¼êÛ7FËêI_DkˆZѧˮmWw™Û#Üæ²)]ÕöÔ¥¶IýhfJS8LgZ]—ÓwLm²ßìlA¡3Ðrç³™‘ó ÛŒuì ã†ÅøK¸!™?OVd#WŸ¹ÄgNæÏñzž¾ú|«Ë› ÝfK³è¾™Hº´³ýbQí|%.á .D˜ÀÆ_À_°›'`áRd)ÕvqÐ>ꌇ&ãYfêÅM½èòb˜¿Ç|Bdj(mÖ+éœFÔ=EK¨6K3i†TìéëQˆ¯ÏàjFhNgÄÄùÔ~lëÜEõÞŸÎKÒ‘ö_ã¿sk`F®Ü†°™zê1²¡rªƒlVÛ[jÖU¡¥›Ú¹G¹«ûd_ÅmÓZ×±­t<¥+›Žt°,Ú]Tf»ÄÚÁ„®)k˜Ñ[Ê~lÝ%åCdÃw”;dŸžHÛ–¶&rÀ­¡C®ÐŒ£#LVÎýî~w³©s?SN©ì¿ð(ÄU¥ø‘>tãçªáj›mC!ìB÷ÈÞ¸ÓV>vÕDr õƒ£ˆ <ÎUm‡¿Ø{ߦK唪†g«£1ÅppÉ ¿*8tî5‘,—ž´Z Á·´hçz’«ryJðÿk€ðendstream +xÚ¥ÙnÛHòÝ_¡·¡Ãfóh.°±x=;ÞX‹Á`f‰–ˆP¢–¤ìäï·®n¶¬c†Á>ª«ªë®–šDð§&& #]Lr£BmÌd¾¾ˆ&Kع½P1©s5»x÷1Í&* +‹¨˜ÌžGÌçŽ'à²@¶ÿ{ñÇ_ÑdWüå" +ua&¯0ŽBÛë à;L-óæâéâßï%>uLJbªŠ°ˆÓó’ÌT˜dÚI2ŽŽH2Â4JH’ <Ÿ +@þ Å4)‚Oí²ÝÀݳ´í8 +Ötl4sׯjÜT…Ó#J²v˜ ©7x™¶[—dš´Í®gK:Vžd‚RP“ÝîЮe¹#ÞÈþp^ò§7†á¾)Ó’CS£U-˜€UúO×ÒÛÁz ÕFõ A¶dx%Yj58§&Þ16¬*‰ÿfŸ>ßbBx`ˆ~^~ÌŸZº[éë¡êyxÌ6pÇ0%øŽâãå¸WhxÚïæ¨ËÏJ +¯ï>f±•Éô¦™oõ÷~(»áö"h’…I‘ œå‚Ýb(¿6(u h°“3?…oÀhµÖ*b×û÷ªî¥Æ‹·¶CX*‚ü&1Ep·!áMc„‘É÷”ÈþA/. ˜”V.8û;`â4Y—ÜkݯxDBƒïB¾%–-Ùk»lè-Yœc¾—ãlñ<sŒ ïܶ°=ð.©•54gÑõŒy_Lt¯­^›°mQ+ cçMÙý ¢‹”»âoãusÊY‚×µêÉÄ`³,{ÛûÏÙ€a@ÚÑY´ÏrÂ: +¬Ý;NèBžùžxøÛ†î Ä_›j±¬¾–½ …[ÔóF&¿^)S¨(µ¤K9¾°6_Š4æk=¬ŽøïªÅÛ¿ŠûI^.~½$÷§q}¶ûŽËffhû®~08ÙPÓðM9‰¥ØŸSîH±ãZo-jª_j,Ðâ,âÒ³á­SÂñr,F)XhGž·£&Ž°Û÷víú¡âG“Õ¼9è5^‰ˆLü@C; cÃâ>\< UX ·¹èC=©„/ cŒƒi< ™ ½;öe¯`äž\ +DÚxÄR:—9ȳΠÆ!œ™¿c|„9!ÄC9ÁcfsK‰Ò”f M¦æ`4ŒÅúÚ&RÔ‚+í÷jõ^^}œâ&'WÊs†d?É•bl§ô¥ +êüCµC×N”ß®GPÂGÚ!Â{CöÎßÒSQtà3-ÌÅ=A+‡ZÅ{G›¤®Ú¤àYÖWLÆ5µò—¶ð¦LîU'7zÍ®þq(z»!(ü‡ÔŸ±%NG¯—¹dÁ¦ž×ö¹éH÷ŠAxýB&Åcê· ©Æ~«pB›¹ +:_‡x0g´)@«Í3Gm¾¡x\›Åý 'Ì#ÐÇPÁcX%ÚÐëNé €}µn4¬xÁ½NS·#1"]•.[áËEáW¬÷Î{8F7ÇxTDÁ5=:ã©¥{}7¶²´øFá¼Ý< ½^½ë?ß=ïèiÇ5W.¬á“¾Ä’§W”ÿ®Cy.¨þO­‰MŸ´¸æ‡¨Á¾)üSžÛPÚ¢ÄÓ öoq®!Fô¼5ƳÜ@­ i}ŽuÚÀ ÷µDÞK¸À&=Ìrh†]èÿâ˜æüFéä„ ƒFæüï=Ì¡AAT€Äîð ß*<Ó8cey¡Z©ÈÞòKÏnF2ü?ê¹D–endstream endobj -6344 0 obj << +6813 0 obj << /Type /Page -/Contents 6345 0 R -/Resources 6343 0 R +/Contents 6814 0 R +/Resources 6812 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6342 0 R ->> endobj -6346 0 obj << -/D [6344 0 R /XYZ 85.039 781.388 null] +/Parent 6790 0 R >> endobj -2470 0 obj << -/D [6344 0 R /XYZ 85.039 761.463 null] +6815 0 obj << +/D [6813 0 R /XYZ 85.039 781.388 null] >> endobj -6347 0 obj << -/D [6344 0 R /XYZ 85.039 741.134 null] +2546 0 obj << +/D [6813 0 R /XYZ 85.039 761.463 null] >> endobj -6348 0 obj << -/D [6344 0 R /XYZ 85.039 669.735 null] +6816 0 obj << +/D [6813 0 R /XYZ 85.039 741.337 null] >> endobj -6349 0 obj << -/D [6344 0 R /XYZ 85.039 654.065 null] +2550 0 obj << +/D [6813 0 R /XYZ 85.039 563.482 null] >> endobj -6350 0 obj << -/D [6344 0 R /XYZ 85.039 639.909 null] +6817 0 obj << +/D [6813 0 R /XYZ 85.039 528.732 null] >> endobj -6351 0 obj << -/D [6344 0 R /XYZ 85.039 626.966 null] +2554 0 obj << +/D [6813 0 R /XYZ 85.039 419.229 null] >> endobj -6352 0 obj << -/D [6344 0 R /XYZ 85.039 612.811 null] +6818 0 obj << +/D [6813 0 R /XYZ 85.039 385.085 null] >> endobj -6353 0 obj << -/D [6344 0 R /XYZ 85.039 599.262 null] +2558 0 obj << +/D [6813 0 R /XYZ 85.039 288.524 null] >> endobj -6354 0 obj << -/D [6344 0 R /XYZ 85.039 586.319 null] +6819 0 obj << +/D [6813 0 R /XYZ 85.039 253.779 null] >> endobj -6355 0 obj << -/D [6344 0 R /XYZ 85.039 572.163 null] +6820 0 obj << +/D [6813 0 R /XYZ 85.039 128.183 null] >> endobj -6356 0 obj << -/D [6344 0 R /XYZ 85.039 559.22 null] +6821 0 obj << +/D [6813 0 R /XYZ 85.039 98.963 null] >> endobj -6357 0 obj << -/D [6344 0 R /XYZ 85.039 545.065 null] +6812 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R /F41 2994 0 R /F64 4112 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6358 0 obj << -/D [6344 0 R /XYZ 85.039 532.122 null] +6824 0 obj << +/Length 2269 +/Filter /FlateDecode +>> +stream +xÚÍYûoëÄþ½E!9ÙîË/t¨œåÒöpš +$à7vCÛ¡§ÿýÙÙµ‡]t›+]ŽDö1Þ™ýöÛÙ™©qø'F‘ϸŠGa$˜Š¢ÑluÆGs˜y&¬ÄÄŠL:2ßMÏÎßùÁHpóx4}h×ñ™öÕhšþê½þþâÃôíÇñD)å)ÁÆ“0Œ¼«±ð.ß¼GÊ›^Þ\Óô»cz70wE×ÓñDxš:`üÍklkozCc·Wß]L Zߧ?œ½6–76•1šý×Ù¯¿óQ +[üáŒ3G£Ghs&`zuv3_+Û_žÝžýÔ,EszD_CÉILgQ¤‡‘ô9ó¹n~É8b*T#'ƒHJ¶¿5ÁùѨ³Ò6'3¬NÉ”;úÖYM —›ñÎeF(ÿQä€óš¦&x>·î°t÷ˆ&ð«#ï ŒÝ\]_\½ÅqIŸÜÑ'é*_Ã|^á`]B3©‹òËMR™‘Ç´ï4¥bšÃø¶2ýøZܯêÇw@[‹ïºߎ¾|ÿû—¬pû„¦Ìž‡úŽ~“ѼªKÄz_ºuhÕ‹hLñpÑŽL/¢Nw¨{ÒÖ :¨Î!ÚÕG8¦÷æ'Ãý" yÝðÇ‹Ü:AÌ$[de&¡#IÁD š•Ð¢ä7î‹•è„!•Væ•*Ø1U^ufiAûNó”õаs[hFdeE#«|¤! á}ÛG-™Ã,iDúIB"h®ßÏ‘~U-Et5'Û*».Æ2òÐ1©Ð݈|n|Y@ûNf(± ‘â$[àBïîúòjÍËQÜTV¨ _|³h&‹íÆýõ^á!8‘í^Ö$½JPïucg[Ã`í’ìrªfŦù +FàFK€èÏñ¡Î>Ù @Ÿ› n5ÃuKôæ+aF’%Œ,íõ1.< +ã½Û03BP½Ïß©.ô`€ÚkùÅgç÷ùúü>©GìûþO|é{ÿβ µÌVL+q¿ôS-²åÒ6geŽvcû|5¶õ&¶Ël‚ØY2dm£‘æßåeU;-Dl?6þ\v0-VInÛóeqŸXäÀæêƹ7«ÄnlU¤ùõ׵™{õù›ÎâæE¬>§Îv"™u˜‰®&ÿEŠÞo³ª>¢¨¸/Ò§nè®s f‹£ýGs]<îl±µ$M³ô´‡Kîo C>3#ÛÕ HlàÿYI¤0éU¤!DSºÿ²áBX_l•ý÷–»Å†M×HÇðôum‡`p†î&o<ðÁ‚ñHÆÐPŒc ±©2¾øÐu|¢SC#ÚàIE;KÀb`Fà…$]²¹óý@lc/½Ï{½ÕuŠCß³|Ç" MµgùÏc fBžÞ¦ËƱ¯6˶ˆbÜ;>H±÷7J×PVôfÃ'y½  úú†¾0•¸¼Ÿ@§Øôâÿ/Ê\¯žè;f +OÂÏ8TŽ®v‡ðɾ´KŸ‚/C†ª@‚?V;†òeÙö!KêméÒê«nhàÂÓ#¡dnyE1ÊÊöL”4Y¦dhW4Õáeö)¯©ÔG©Sàò?ðI§zˆ48ì^¤™äprÐrIö7Ïy¤!Š5ºNÁ°]Ãw ŠÁ  Cê~Û‰Y…w~Ù¡€ifÄ=—1€Ï¹º»v\×,YZþ<6¾ÊTúº„,ÿ&¼OŽÇYZAN¢µï½.‹Ê–‹S'f\ZY¯lºe.€)"îŠÍòÖ/â'ea’¯] +ƒíýhg›¥‘16ø*ë¼jï]ž¢²ÁyÒܲ¤ê½'8ÄS_Ébÿh|‹Å1XM¼\pK b„TLFz'U…÷KXMj¼Œma€2Uáá_t}Ÿ{7Éz¯ç˜°†ÞC1VpÌÔ¹ÝÎfYÕ—¹B°å?óÇÒV¤7oGÚ÷Xu˜‡XN`r5G3âcrˆ¹Nšª&·E>s /Žcᓯ\j[·¾­`+'þgëûÚ$‰¸–LÚl iÒaì`:ŒÂ§&‹¦òG³|“]ý6IîäH«zKœÉø8ÑžyæÿÑšÓ‚Ä&R=³ò±$"œ-ÆÜ8Ü·×Wœ·:4ø?”©fendstream +endobj +6823 0 obj << +/Type /Page +/Contents 6824 0 R +/Resources 6822 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6837 0 R >> endobj -6359 0 obj << -/D [6344 0 R /XYZ 85.039 518.573 null] +6825 0 obj << +/D [6823 0 R /XYZ 85.039 781.388 null] >> endobj -6360 0 obj << -/D [6344 0 R /XYZ 85.039 505.023 null] +6826 0 obj << +/D [6823 0 R /XYZ 85.039 761.463 null] >> endobj -6361 0 obj << -/D [6344 0 R /XYZ 85.039 490.868 null] +6827 0 obj << +/D [6823 0 R /XYZ 85.039 748.383 null] >> endobj -6362 0 obj << -/D [6344 0 R /XYZ 85.039 477.925 null] +6828 0 obj << +/D [6823 0 R /XYZ 85.039 721.284 null] >> endobj -6363 0 obj << -/D [6344 0 R /XYZ 85.039 464.376 null] +6829 0 obj << +/D [6823 0 R /XYZ 85.039 694.186 null] >> endobj -6364 0 obj << -/D [6344 0 R /XYZ 85.039 450.221 null] +6830 0 obj << +/D [6823 0 R /XYZ 85.039 666.482 null] >> endobj -6365 0 obj << -/D [6344 0 R /XYZ 85.039 437.277 null] +6831 0 obj << +/D [6823 0 R /XYZ 85.039 421.205 null] >> endobj -6366 0 obj << -/D [6344 0 R /XYZ 85.039 423.728 null] +6832 0 obj << +/D [6823 0 R /XYZ 85.039 391.985 null] >> endobj -2474 0 obj << -/D [6344 0 R /XYZ 85.039 380.191 null] +2562 0 obj << +/D [6823 0 R /XYZ 85.039 322.225 null] >> endobj -6367 0 obj << -/D [6344 0 R /XYZ 85.039 350.786 null] +6833 0 obj << +/D [6823 0 R /XYZ 85.039 279.272 null] >> endobj -6368 0 obj << -/D [6344 0 R /XYZ 85.039 296.062 null] +6834 0 obj << +/D [6823 0 R /XYZ 85.039 226.407 null] >> endobj -6369 0 obj << -/D [6344 0 R /XYZ 285.909 302.036 null] +6835 0 obj << +/D [6823 0 R /XYZ 285.909 232.38 null] >> endobj -2478 0 obj << -/D [6344 0 R /XYZ 85.039 144.973 null] +2566 0 obj << +/D [6823 0 R /XYZ 85.039 123.284 null] >> endobj -6370 0 obj << -/D [6344 0 R /XYZ 85.039 123.777 null] +6836 0 obj << +/D [6823 0 R /XYZ 85.039 88.538 null] >> endobj -6343 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F72 3966 0 R /F56 2890 0 R /F11 2898 0 R >> +6822 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R /F62 4047 0 R /F38 2997 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6373 0 obj << -/Length 2568 +6840 0 obj << +/Length 3110 /Filter /FlateDecode >> stream -xÚ­Z[oÛ¸~ϯ𣠬UQ¤n}9HÓnOMÚӸ؇ÝÅ#ɶKòJrÓüû’ºX’S`±HŽ†3ß\I•-øÇ¡g;ÃÚš¸_/WÌjðæßßà³°ÖŸÕÜÃõÝ»ëW“šà¯õoWÖ­ä­L e„bÿ}õÇ_Î"»rl…‹gxvlËùÈm{‚ëñþêáê-+µ&ê­)”<Ú^ÈÇ01¯s¹íºlxŽí9‚pº/A‰À±rÙ4i¥žŸw²QOñÒ ­]™Å©¿à¸<šWžp˜"V¿àTh5;M¸)÷€Ê¾D‚g$È`XlÕbuĵ´Æ³ž3"Õ<³)sz¥ÖÌŦXÕ8ÝT@@›ÊA_¬´†+†0E¤Ö‰ÊÇ}šÓ;oO­Ã˜ksæ.×± &A54«‘U @ m?ð[N¸ûŸ F;ra3~~CE2Þo`D©½Á~kôçÖè“õdðãŒp*–nd5j¡iáMg1q|;ôÃW0éˆÎ`¢‰^Ãä܆“Óý&1éíwý|5KL²Èâ9­ýˆÃï+Z÷ˆæµ6D¯h}vC­õh¿)­ûû‘'¤*N”âן>©I³õ1?”E= EÙ½EGt -Môç64Pœî7 Eo¿1Ê;{5¨T†Záz‰ šèP•[L27y &³fbœÀ—Ž üÉ(›ÁÚ3_yªÙde¡æ“ô€Ä%.¿´AW W63ÅÂ÷hŒ«EºZð“jÁGÕÂÌ ä¸Sh2&ìÈÇðµ=0Oâô·ÅßuÛqàÁ÷Àò¼3€ç÷ `¨ ‘2@ä[r0à -,Â.ê}b:Ï·XÌ¡WFyÚõ9X?Xô6K¨iFö9åDÅO6hùJ'Ír£,×ìT…Á¹›’,FÉ$­jSÊŒ‘opÉU„ø:Õ@@Ñõ]wJƒ‘&\ðƒÞ±]q–[9ÚaÄþ]Ñ6Y¾¸B6 `Älˆà…v‘ª;m19PEY{väAXº-¸;+%É䀔êI×ñ! ³UÛ„™ÂÌb~;¨ˆNÒäTB¶ îw ³órH×¾ð~%ßILcSgÛb.Ek‡‹K¼ã6op´mÕ]×d8…±S«V‚Æ?ŽM&È\îÕüç5_–+H†¤âŠZ7gдÅÔ«ÀÛ´]^ƒ)·Jë9ïò¢ÈŽ¸÷³¶C•aaλzÜÎxWª3•, ˜ôe¢aÐ$‚з6)äT„–šr‚"}VêSNé/‘»“O¾­'ŸE£õäïS*“YëËog9{<¸#÷¸Í:²Aò\•¹ŽTÐÁŸ–+á–ľ@øP°Hþ¸<ªJ]«å 'r„`T1aºL—v,ùdÂÕEÀøDŸubyý¬Ù QûâŒwÜæ¸ÇMy@é_t«Xè®yß«²«„“–m]ðºt.xNã‚}]®h„nµ²X÷dn$|h·ÃCЉ!ÿt<'¡ –Ï ,`ϲ+àg¸ÁœÂiü¾ŒÉ…TëY76 ™¸Xñîq›A›æŸæòÀÇ⹶nÔ°;Jä¿mÞ®Ô:¥úÀ³Ê¡’Vr*¡TÀU·Üo;Ê”Ûéf©¨{V!ã³}…nÓ™ øÐq Y÷d®4AK -‡+«·Ë•9–*¦ÜŽK‹2ž|DÅ[­C·V> 2r/±ÍöÝsÑ…”!cÖƒjÙé&dÀd!×ß— ÌZ~ÓHkGh„w©þ¦Çm>^<׎|u¦¾U(§*C{Äú¹Ä¯78gzEäÙ¾šÀoæº'Ûë™c›3h(+šw!o6:^§p47Lج< ¿¶ ìœÎÅ&™a&à lL³ôí¿š.!åA%pu9Õx¶1턶뉟 OÀO0Ó·31Ý3Í°ú2Çw,™(×R*+gÇyƒÚ»Ôg•ÅÆvÊ¥>‚¥…l“‚¹ÚÃZ¦zUºªm(m¼–(.w\ÛåðkG¡7u :Bÿö€\@j÷ìGTÛ÷ºÏ .¬2²!Þ¡ë›}Ž †â­ @ÁˆÇzù£Dáœ|›Óõvš§E£®iÚ{Q8/ßàGÃö:k&?p¿CçEîhHd>¸ö7"ãç†00§?çîØ繞•´G9=ÊøI=¥úüÆ›…î ¢~ÏŠÇ ÁH‡—þ€.£À£ Îh ðü‰~ï×âë8?Ô¨N«ïiebð$\o¤ìhd:ÈüÿùÓ®ÌÓ$«ìºT³þ•Ç¦\ÅUªL ¡V-SíÊÉÒ*aÔs\÷ÉÉîט¬ôóû¬J㦬^FÚéõ’âL}xÕ¸Q[§ïP7/‡tá:<Ⱥ~N~Ñ´Éc-s=Ø'òÐò—úï}Ý~îíïª?öÅqZ׊š2að¥ÌŠ¦žá³6}¶&³î(ãcÖÔé~ÓÙÿ›Ñ©E⡇êæì=ÚgCõƒLóR7i>NfߊL{Ò!­ SÇM+h¼™è)i<5ÑÖËÒI¯(Ôç…Lmv¸¾ù¤ùdÅ´|ÿ™`¶ÞUåq»ÅCÝax•ÌÓ&­z`&÷e£HAì2‡\‚wô4±Ò!ú#NšF¶ì_Ì[uY5Ê-¸°¹ÏÎø¥Ügqf@B+šƒÙÀ·û‘E°j“´½»™ò ýÁ@ Ûh‰>$Ycøâ†à-3Nñ»lb^yÔnÌ«kÙ4¥Žþt³›Îú>8fuâ}ÙªRùÉL -vl7š®JZÔ 5op°›û2ç¹P!™‘…Êθs1ÿÃe$ð?f>ßendstream +xÚÍ[YoÛH~÷¯Ð£Œ˜>yäÍq2Yb'+Øfæ–h›°$jH*ŽÿýVŸlÝZÌj €%‘EÖÑu|UÝÁ3ÿð,å¢Ù,IqDÓt¶Þ] Ù#Üùx5ÅR“,šw«‹7¿òx†Q”¡l¶zèÞÃ#Æélµù}~õË/«_KJéœâh±L’t~³Àóë_/)¯®?ߪۿ~]dþîݨ ·«ÅÏ™úñ®¿¿ßÙ|õY]»»¼yw¹¤ê¢&øsõÛŇ••ÜÊRfBì¿.~ÿÍ6 âo(¢Y:{ï(Âp{wrGœQý{{qwñOû*uÍÔSSV2KŠ¢4eaKrqĬ%v,‰Ž¢3C$LùÂÉP;Œâ(åéÌyÙˆ¡¡qÄÜåˆID1éq¼+Á¤;±ø²-”¯ªý‚¤óïâOQ7%ü”‹ñ⨭Ú|«~ÖÅa Oåkñ|!ßRÈ[ ľe"ôŽÃ†ëh†ÓD' `ØnÀqÚpÇo‡ÇZè¾)6Ê=› SˆÛø¢ÍG¤ù¤­ª£0¶~ð~±„˜Ð–¯ö…ºZ=¨ÏR´x¬óV¼Ï¶³8¢( ÚÖ¡ñÛÖ²mˆ¡µíã¤m]ŽW•ã‘­¶ÌWiÔ \“_šòÑqÊuµ;(RxH^Õ­}ñ¢nªíq`¾X=" •‘Œb,9߈pØ—»²Ñ\7•0ÿË~)W²…»µd’Xåê~«¼¿1+ +ϼ¾õ-#|"s84EÒD')À°[¤ÇéEr8®DfÏŸµ»K#AŠx]J)·Uöhm’)|6AY„ÒpRph6ÑD'm`ØÙdÀqÚ&ÇKýU¹1õŒdó|_®=Zs¨´Ù‰jìÐøµ6D§´1´Z9Njír”žPè‘Š_~ú¤¾äòjsܤTûÆg +ΠœfaSt4Sh¢“¦0ìL1à8m +‡ãØ2Õ›‚YmEvZÚК,R©j"ƒä›ùñ|m2ÚQd¾rÿ¨î½U‰GžmbRõAÞÞ¨Â\ ªW{:$= @“#>†OI–høDð‰ŽàÛ£SVŘEYL ÔF<éÞðÓ®A™|áª9í^Ó­ƒ¡2Dj²xžßK<“2J‰Ð{°‚<ŽXœ/ñÈ(]“˜F˜&3‡ùXBM3’°Çgø&Áî6oºšÈº¯Ë}û¤ +Ü +“PB‘â‚ ¯Êµ*‰C à•˜) FšPÆÀ@“˜D "!ZýÙŒC—Àøÿ·…¿ˆ»~Ô.BðõMS÷ßÒ%D¢˜z¼$bÏ8„vœì«`ÆvT•8#ंڼðï gÞ”.f½8é‰ç"Ì|IF#h²Î"ŸyWP¾ +?eqO¾¯Å2ðI0"€±a¢Å$P‚Ï"$FŒÂCöPiçgò:–¦QœOèc%8›± Š)x{ã &:?6ƒ°+€šëóúlÐ%À3ëŠ[«' ÎEþ?ÖEãsdGÆ3xrPc–a½]eY¬ó½éˆd×h€ýíŠÔQ©±Q×Ûj€æeÒs‹¬±ÒÄ<‘sƒØÐ $c" ³žAÞ²°—¶yë Ÿ³HÚŸô,ñÃÏ> ‹Ê|áÃ"ŒÁ™’€ˆÂXwG‰‹Ú9¹•ÙIÈQÛöZæàj îzF_”t‚#JBjÆðpÌÒžš7ùÑH.¼ØõhGÜäÛ²UXÐ,çP¨ –B)‚wpÖSèzcÝC·s+W¤ØèÕ{¨ê· ˆC&ŠÿG• À+­~)3óлu¾Íï…þ£›l~gréú(–ÜPóôå÷çy¹5ï—ÓW9õ†ã9løSã@ Ç<¨= Ë"BjÐíìEÝEã”Ì%.—“mÚeŠz¦âÁn¾ùb˜åÖ…@ÐjÉÍt4_·:übÞ]˜)¨ÄŽý ¬º@]EEO´íZˆ²NÇçÍ‹¸Ÿk¼S'÷¬m~è,uŽü²;gp“ãžáÇØ!“piŽØejóÇÁi«v.L¨!7;ÊûÜfc¿ƒBêU-Ç'ûS9æ F‰#’·ÿdEÈ5˜ùÃMoÃg äŒ7¼hšE1êvâÜÅ wNâPòn"¶9"X8ø³ä‰‘Æ=„¤ŠÈ8™_ïrܽ+ö­i¸áòÕS%²áºðmÎѸzvùÕfÀ–1IÉ$E’E<¯§@á=m†çŠ ,åŒ@ÍLW«9€DÎ"¼¹Ï×ÏêN±ßLläà©&6rÍHÊÁFN,½ÏÓuÙ'×éé8¨æ¹> +"Cò€IYùÌüêèæL½Ê‰©è«æ_"¸÷"LÍåî$É’ÅžÍM³tˆ&vV —;«†È»³*NDñ4ÌQÓŒ8öwVÅnƒ#»àø¯Ræ¹{¹+ºéò¹2¤(æïÙÙ‚]Þjs挽!ýГu¹:µÆ–žÁ'΢,æ'LÙL©‰Nš2ÄÑšrÀqÚ”Çsõ-á–R÷¸ÒУ/mmÖíOY«áv+÷§_‡¶wÎû½¯d5ò™Êe''ÌÝÌ­‰Nš;ÄÑš{ÀqÚÜÇ+› L|P i(E–É=@‡A¸ÀPy|iª¼,Í»ÂÒD¢„°ž´»ç§jgZ•ud–[OÌôrUµ\Ò›.ÚÔäñ)‘µêF·Ê J¢Ï[‘¿“<-²(E‘v©Ó7O–É2?[$$3ˆ7ab(E :áv‘ßí Ñ)· r4n7ä8év.ÇF¡òƒ—7/ƒžÅÒÞ7½Ó&[q-?ô/ÊÅymþÚ6cwÕeó0J¬ü·òYù×k9§§q,:ú¶–þ·U¾,¨8ò°o›ñf©Ü- +Ȥà +šÆ „ÁHÞÞêG±X5Gà©Õ%„œfihFÓÄDÊårü¼Ÿ½Ø“í™dƒ«¢g«[‚¥ÉCöÑxÜ>r)–ûêS㠘Ө؉ K Es2.ìlXôÙMGEÇnÊlbCÝ9û,Möj2O[è]ñí¾Ý^ÿÛäs¹¿QïJhê icNô°‚™ø6 Z0£R¥ša@é,;R‘<‘<®Š2ÕÞV­icmuù Kù½£Éy±)5ÐQ«+^ù©± CÑÈ·MåóŒ$ ³£ñ{†¦9å!vÆ3ì&=Ãa·z’'yO“ر1E燼ÎwE뎭ƒ0±4æp¼ÂN»]Wt̘RÓ?T÷}h»Ó’fc wÏ7Ôj‡FªÖ“ˆ9ŠæÁ<Ü‘xÓ°&Q‰VÊÖe¡Ó±€Ü;qé±îJ>ô]• ®Õ÷u]Øëê̆ Ø«íW}{ܤ%\Ÿ€ò©!îs_êÿ÷%#û™;£Q–¥®Ž“‰[c§€A É]ÏÉ(bR&‡Ý·.{|¬%ª>ؓ©±µŠ>Ó›²5àYš—Àç'ÙôØâÄàð¿[8ƒ|ÿæ ‡¢F°‘EÎ%²t4X£)ø$ üÁ”uÜendstream endobj -6372 0 obj << +6839 0 obj << /Type /Page -/Contents 6373 0 R -/Resources 6371 0 R +/Contents 6840 0 R +/Resources 6838 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6342 0 R +/Parent 6837 0 R >> endobj -6374 0 obj << -/D [6372 0 R /XYZ 85.039 781.388 null] +6841 0 obj << +/D [6839 0 R /XYZ 85.039 781.388 null] >> endobj -6375 0 obj << -/D [6372 0 R /XYZ 85.039 659.915 null] +6842 0 obj << +/D [6839 0 R /XYZ 85.039 535.112 null] >> endobj -6376 0 obj << -/D [6372 0 R /XYZ 263.137 665.888 null] +6843 0 obj << +/D [6839 0 R /XYZ 263.137 541.085 null] >> endobj -2482 0 obj << -/D [6372 0 R /XYZ 85.039 374.658 null] +2570 0 obj << +/D [6839 0 R /XYZ 85.039 389.607 null] >> endobj -6377 0 obj << -/D [6372 0 R /XYZ 85.039 353.461 null] +6844 0 obj << +/D [6839 0 R /XYZ 85.039 354.862 null] >> endobj -6371 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F56 2890 0 R /F20 2865 0 R /F35 2880 0 R >> +6838 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6380 0 obj << -/Length 1050 +6847 0 obj << +/Length 1970 /Filter /FlateDecode >> stream -xÚ­V[s£6~÷¯àmí™@A ycã$ÍÖ·ÆdÚ™í>È ;š‰E¸^÷×WXss»v2I‡£ï|ç&Ç°ùŸc¾eƒÐ˜Ž‚ÀHò‘mìùÉóÈ‘¦T1:ãÑíÓg8¶Ú¡ï.v|Ëó§ŸÇ?EëøñubÆÀ±&ætŒgüòüM0Ž_VKqüô:q§ã?[ˆe<1±'k¾?{¨eo¯ÄÞ&Z|ŒL 6¥Â—øÓè1ÖÈ5&Ž2¬a}þb)wñÓȶ@G.Û–ÃóÇmùël´ý¢M‰3Ï_ ±äƒÀòЧ ø š7´¼Ð3¦¾mù¶wæiÁjGË|bú®?fJð'rEÅï!!-åŠÒLIâ7y‡d/uw%•zPüÌi³š%ÙtjÂ3õ±T{¥0Çd//,égÒâ$<[zìG€m^flÆï¶o/ã7†JkÅ|圕Lgj9k˜îÔ²C¡:§{*¡l’•¼·6ñ3¡Ó»ªwtÒ‘–_µe[Ú Î6ë‹%$ÂsI…sXšåÔÁßo瘾Ÿí)  Ÿ8Q%9ÒFdh`‚3\Ô¶¶šU”¢´I‘¯ -…UBÚ׹ݺ)!(‘:ËØk(³¾­Ó~`ôµEºE)®Úªn›Ñ=h9ˆÞJXa­V,Ö—«øñ~àÖ—dïk ]îç³h-YƒÉW!!8…±Ç,‚ +xÊRzÈeX0Á†Y÷‚Vp 9 ×Kg>{yºÑÉ&S³æª·Y¢ŒB“´¼iæP#ÙW›ÁÖÐÌû[]„œ«œýsZ¯qZ®DiÚ2–¢ Uò˺6ص_R¥¦f8Ç -šªS†ÿ”ZTöRuÙŠ2:/Ý2J¦‹uèb•×ªH›®ï5LˆÌžøÈúQs˜¼c‚úN‹JŒŠ"Ã(U.f§NJÑbéxŽòmÍžö”h¾º¸»!χŠæï ?_êøˆ–n†V‡]3ÛßÙžLpÖwìf Œˆê%LÔ ¹\¬†`QèÎUKÖÜž{LÓ yw5u§­‚ZˆŽ¢|ù°ºJ׬ÉJªR 61­džmªS†šs¥aa-'£ìkšáëe”p‡Y˾:Ú äPÖCâÚü7~l`¾…÷ª¨¶TIÂó˜¨5Ë·dì˜Þ´þMgÆ÷ü“”Ù}gà4Ù»Ì×$pJífùGç¤Áðãoo›+O1¶£CÝ[+œ\¦L¿\—ê™ÂŸW‡F}_—€*Ý2˜ËE–Ââ²ÊOì[Æ— -ÝÀÓØ–=ù¿àî?½JõÓÜVBýätšONßu-×QXj2€ïvñª×kð_Þˆ Dendstream +xÚÍYKsÛ6¾ëWèj&‚ ‚ÏÜ;I“ڱɓÎ$9Ð’"sB‘ªHÕI}÷P EQ‡^:™¦ °À.¾Ýýv¡È± ä8„«’qK¡âx¼ØŒÜñVÞ¤–˜j‘©%óz>ºx„céŠÄMÆóï‡sáj<_~q®~»¼Ÿ¿ù4™*¥%ÅdE±s;‘ÎûwŸ.'±ræïï>òòÛO/rî`í–'>Î'Séøüqó×W8öùÏÍ.o__NOjoó£7óÆòÆ&°2A³ÿ}ù掗pÅ#W¨$?ÃØ–7#°[¾Òßùh6ú£9Š×ü1ïêCÉ÷BáE0P®ˆc¿WFJO(é”+×o ô¥¥ôCWbùÕ•Q÷z5ñØ:ìX£–9Ò([£ +É.[㔑ý<‰}'­èž'F¾ÜÚ5¿—;ÌÑŸi]—“)H–¼yf+ôãjQw­ÄÁ8ò\6ì5^‹L-²Ýs{OË éÕ +­ +#'-–}â4¸+vžÒ×z÷wïJ½-å£ox÷"Íù»Ö*SD‚Ǖ‡„€(p¼Ä§2ÝdÅš}¾EC4˜ìð+PIK"yž¿‹Õ3KØ{*ž21“>q‹9À¬XëSfï¯õž¯nà~œ? 4p-×xefX”'Â-Œ=pL<n–ÌÉp32ˆÉM¹.ñÚaèÌÐœ"mº­«£“A(bˆŠ!cŒÌ‘5íÄ =á…²eÎïèõÁ{fÔžJ„FÔO«_áÒÞp9û¢,°Fàú~Gu3Ï`Ur!g#áB‡†V|¼›¿y…[\çó“ ë‚'6Ùz—ÖDkžawI熋Å=Ï>âùTm~¼äõ,ñ\J)_îáš$Š +Ó*#n³T ûÍVSPŽfiÎߨ?BýúBX_}¾Ð’,NSo­¡ƒ=Ð8£¶·0xÙ°¹.¸êÍZ Ee’¾ó2]ò3.`aÙ¶¬§( +ú VKædY02x㻳<öBèÂêƒh¾SOq„­ÛÅvPîJpò¦â‚n‚~ñ¾G>ŽW¨¬¬VËÕòUkC¿6t7, Á‰‚d†ññ½ÛÄK¨@Ûï-!*8gÌÔÈilß%»l—KŒ‹ëUÎyCý£ÊLÍd’ïá•f}ã%1X›¬®xÛœ®ŒWþáVºFÏõ…‚·¡Õåw]€0¶7M_È}Ìݘƒ(÷šKãn#¸«¨µ£š•¡ÕܶiÜ |{_º#º>ÁÆ~¢„&Ãll fc#tŽ56îjìec[cŸgcxl§Ì´Yar¿"{Î%V±-õš:`ôƒEþ‹Gü²b/7iVð{nƒ¸Z\σ@bÜɤãI²ì¬Жa3£7™~å˜ -¦õpµl;[†¼¨ Ê.]Ô+%§<x8ãñƒÐ€ÇµÐYil<ÞÑØïqKãÿ°µñåim,¡hµÐYh‡46Ðv4öCkiìI&ñk…îa(OG9®P ‹BQÄ/Š‰#q®Ë‘´_@°Z¤õ¾©ËÎàUž1 ÂôO§4¥ä£†f2í(PD)SMb€9F×qZUÛtÁdÀ®¦>L'VQ6¬*uk·2=YZYÌm2®âEÌ| )á7ð +W±/ÂhøqiÉœl#Œ ^ê!YSŸÍâD² ˜Oî?]§Ì{ãa$à¡5h“‘92ªJ‘Òm[u­Ù!º*¹ÕÚñ/Jÿˆ¡«Õ¬&ÌM0˜J§œûöO&Mów?ñ¸R¶ÈØ™zú’\;X{¸Q'åö!3£oAq˜Õ ÷e¸ +"DÑp†[B§3ÜËðA&û{3ÜÖ8ƒ&îù˜b…ò}§)¦yÞm©ô,ËC•dµL¥ !F|E˜>/MkÎÏ¢¨yA-›Î|K?Åé÷M®3ñâpG?:Ó XBˆk¡³ˆilïhìGÜÒø™Z%ÿÕ4›¾ÕÇ]—Äp©þˆjŽæŸ[â©tÍMG7~1zÿžðoÍ3²½åuØ£¼ùóaÖÇQ†[\áõ‚ÿ1•þ§PhþUÅW"V'€ <:}c ¨’¤ko b`Lulð¿;KÃHendstream endobj -6379 0 obj << +6846 0 obj << /Type /Page -/Contents 6380 0 R -/Resources 6378 0 R +/Contents 6847 0 R +/Resources 6845 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6342 0 R +/Parent 6837 0 R >> endobj -6381 0 obj << -/D [6379 0 R /XYZ 85.039 781.388 null] +6848 0 obj << +/D [6846 0 R /XYZ 85.039 781.388 null] >> endobj -6378 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +6845 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6384 0 obj << -/Length 2619 -/Filter /FlateDecode ->> -stream -xÚ¥YKãÈ ¾÷¯0‹ ŒÕ’JϽÍbw‚]$‚î`³sÛ²­ŒI·÷ׇÉ’ä¶Ý@4ÐbU‘,‹Ï²¿ðèÏ_¤‘ë™l‘¤¾kÒtñR?x‹­üõÁWŒ02n†ßX\ÙÕU¸^˜ÜÄÑ=V‰Ÿ¹&ôóóóÃã§À[žÇfñ¼]ø~à?XÄYè†&\âßóreâÄYÉçy_ð”×ë`ì|^Ï)Ö˯ϿÓþ« t3/f~7uÙ”Kßé‡.ʶQ&àÛì;m²‡_ŸGéUø8ÎÜ(Hß=ß ‡ÏçG ߣͳ‹ó㦤(ÈCÒwß ¼#±®óf¤Î#ãäÍ@àüXF‘à•„è;:ÝÊsmÓ AWìònƒc6;™XK{¦ÜÒÚ±jdGÒF/û¶`µÃÞ.a·SÙTíV¾t%t$º“Ô8Ï®U¶kÈøpÿ€FSœfŠN`ðm—A✦1ÉŠqn -™¦3ö:Ó -Ê¡#€È7Ç‹»WàÀ £ÐÛâà t ·8ðžîŽÀ°@Ë`O -§Ëça9Ë®¨ó’´z}¶„deíöéü{Ú “[ù˜iÑõm“W25ä¬Ê¡ »CU¢%†lØdP6¾¹RÌD3ØÂwöù ƒSYÑPWr†Gåé 0ùÖy? _ÚF4ADê -קÄABâÁ2ç5lr“ä ¿ XKå{sùœ€óû“é ë¬°]åJYçï,[ì‹ê Œå]¡*½’@ÖõÄ®³ØÞ÷cù¤oÕ*ý@³QÀ²Xqó[×I¼@5𖯊GT³aJh¿üÔBTì$€qñ—)rb¯LjœsM¤.í³´«…NÇ"÷ I#/aËãe²sâð£ÜŒ>*Ìà¹pS Õ£Q—CÛY]Üì‘œñØu–™œ–pý˜BaŽs‡~"÷MS“·4jØ`Î'$,ÞHä¨Ùr e“À'䢉ŸƒpG£T«èezŒ<ƒ¬ÀÀ»oBz*7*Îß ëI&?—ÍFBÇÈèú›Â²K #ßù[§ ‘÷|}ºÏFf)Èæ»B.@ôáÞ ý‘¡Œ¾ù'›ØüR]<ü‘Ÿº1eMl>R[˜9Ÿ8[åñå0 ú”›~.š‚íÚêïI¨¬ßq¹ŸœBJ¾AÏ“SyäÃÒLTœÌn “9®†)‰ˆ“kÛõ²Ê×%qŸy­%NWß­3sàÀ¨´ß^÷—ÏN‚¿DÄ¢Œ’+ÝçÄ1è ØÎÖ‘¹÷[F´‘=Øìö\j 6cPö£´ÀvŠ´ù^r¡eR•\³•\J@‡8Æ‹.sªLM1žùè. {™^ÛÔ'8üi4.«u·1›P4ºqú7‰çlôêÒ1a¶iqEq¦úl5´‰¦¨BÐÞªfÊ6LŒÉJQKk JË]­É‹Ì‹Ã(¶¼+_Ѐ÷EåÂÓÆÆÐ\ŠûÆ$P¶ ´…%ƱüSÌÎëbPî4»bØðw½ŠbH”¾¢Ó¾hz"”1ÝËý‡“•µ -\gŽ -³”¼§ÙD3“b!u/VS|<.d „Ñõ…“—°:Óç> Ä´=ÏÇW©ª—é1—ƒBD1J&ë ›”°CíhUºÌoôE9¢ýŒbê‰s]ÔJ¤wJlyTëd¼É‹ºmH‘©9¿úJÃý%ë87ŸCNûÒöõ†r`î%>Õ2¶¾)Ú¦‰q7ôúø7©b±òz›¯ó)iXçÝ¿¼~…î-+N)–Qiu¹y_Ž‰·Ê;WëìÈQzq8ùm‚ŽËKÁ\1M…ïÖn0?U[m -»ï ï¥Ú÷™‹— ër·×‡=[Ü“þtC ±&ªÌ)dCÖ¿P^ ¨ï:¡¬„Ò_¶hú ÀÏxT ¿§L?¦`î¹mo5šgB/ÐM2÷—ƒM{ÊËÁ =OÆ]Û*úã±ïûuÙ<ÎXºt®ÏõQt1w Ä‘¶šÊªxGÿM!¯èÝ,léƒÊ¤ø×r`ô‰ÝîÉEåæM»å;ÿÕ­lŠ-j®ŸdÔn·w’¸¡Â#›§ð»©|ļNäÆ3nXf\|Dæ톑IÝ(5÷wüÐEÕ -endstream +6851 0 obj << +/Length 2375 +/Filter /FlateDecode +>> +stream +xÚ¥XYã¸~ï_¡G«EêÎÛ,v7˜E²@Ðl€É<Жl)££G’Çãýõ©‹´|õC‚ÚT±X,ëøŠÊ áOyy„Qáe¹ +¢<÷¶ÝSèíaæ¯OJ8â$ +’8†ñɵ]§:ãì.ì±ÎTD±BžŸ^ŸžÕ¡§Ã M#ïugIó0ÈóÄ{-?û‘Vë$ ý—?V…ö?â¿×Õ:J3Í?¯uŃÓm SÿUúÕ†éË®Y)¿o¦y4s3ô«/¯¿yqÄaæ­uð‹{½® +å°(ô‡™ž~yu'°º%IPdù»g\ðÐUâ©v)–g “ sÞ·®F<ƒÊ}3‚¦2îL¿Ò¹¯Ì7}Ƀï«$e¾•OäÔÞšiC?1ßH³{â,inÏs-€6!SµÃaÛóÞ@œ˜ayÅ0×vj<6“,v¼3ÜŒR +®&ñj”ðªßþíÌ(:ÓM‹ža¿5F]µ`½H'tÈH§þ¾²† Èà´R¶lÜóíÚ{+YÌ·C³Å;¶'4è¤f|Ë°š_ˆAÎÙJøa7¥¯ÞÞ$&•¹ù.æDi.JÐúo¼ˆÜ ~+³] iC؆|ÇÔ73š®šÃ|¸cÔXç)ˆº×ïMé—çÐí1vqÜ }C3Ú€TºLøÝ’ÆJL´i6¨ÂÛÐ÷çPb—È¿éy§ŽÜLª‹#ƒ/Ö‘‰xè¼Ptì«™cnüÊMYÝ9óß_À>Qi¬Þ—”`ŠŠ¢ØwªY‰9KÄ%h&CÖžd+Öç:òMŠGv®N.XC6€ +˜Õ»`Ác‹œŠ¡ì¥‹çEǶÆ)¬rqáÿJ…Ë̇ÑÞ'–3ÎýPÊ~ªúŠ<;=ÐP$¿§à™åaŠQ±,P: ”epy`ï€×C–åzDEwô§ÓØ?֜ƑyCù«j›Ê†R%¥š(”÷P8ÿì%UÓêRXËJfg~ÉýD(ùÀ 2lgˆ% ¢ ?X½%Ìú^Žær~sÎ¥­Ùê²¾P¢s ÞV´“Š9L9Ö‰ã\e;d¹ èÉ#=@‚ÌÞ2·¡@U9‰NÌ &åÃ?½ ‚Ù! +WN©€`nJr•ÌR‰ø~˜y0Á¥Þ‹U{ Ì{¥$Š´˜‚ƒ°éù×Pد ;Iá`eJJ8¹ƒ„ó‡\ÂÁ;å›Ò9ü’r’¨à¶"˜QæªI†/Üf\RŽÑ…©±zkÙóDìp/IL÷Ðã\DVjXˆCüú¡ÅOø~ûFp›‘ÅT•Ìj+ r¸ µ±½G´a’#hPIóÆ %Ò†ïLé WéÅ‚®«SÉ¢ ¨Ä Ü×3Sjó½âÑÒV%“féýÜ0ÊÓŒ \ÕB¬5ôkL£@⼈x†o‚Ò(S$ã¥Ë”Á0hžíÙQ‡pä FÄ‚çt]>I…fñ$æ,h•I/®H'p¨J­;ZŽ01^Üe¤‚4/„q³Fi,?Þ••‘ÆÅ㎷® b ³ŽbÀ °|aáÞ$aEœù=4£ôDÀŸœ¤â€%Jf‹‡4`¡×/à˜ˆ{ô ‡óŽkô+FÞ9éõ¿0Â2ÛÀ™†«§63³3á.g¯¡ï¦;²{-žÃ’Ô¶`{߯ Û3llh~¤§·<½Dìà“pñ³hý`FÉ›Šéyà"W¶‹Ž:ûŽ"¬çÖ!»Þò¹šiÑ3Àj.]?‘8=œ±®£Àåù’nçt[œðÏ?€á :_PZ<)ÑÕtMKM•CÆ7îÄ-![ÍÓ2­:“N®Å³ ùÜM- WÛß¡/äø®fy»f_Ë“ÖCÿåà…¬Q<æcÇy›£0 +Rm…á¡ã0¼Þ0ØLòèñŽÿíæ'ºendstream endobj -6383 0 obj << +6850 0 obj << /Type /Page -/Contents 6384 0 R -/Resources 6382 0 R +/Contents 6851 0 R +/Resources 6849 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6342 0 R +/Parent 6837 0 R >> endobj -6385 0 obj << -/D [6383 0 R /XYZ 85.039 781.388 null] +6852 0 obj << +/D [6850 0 R /XYZ 85.039 781.388 null] >> endobj -2486 0 obj << -/D [6383 0 R /XYZ 85.039 761.463 null] +2574 0 obj << +/D [6850 0 R /XYZ 85.039 761.463 null] >> endobj -3034 0 obj << -/D [6383 0 R /XYZ 85.039 647.397 null] +3163 0 obj << +/D [6850 0 R /XYZ 85.039 632.606 null] >> endobj -2490 0 obj << -/D [6383 0 R /XYZ 85.039 534.44 null] +2578 0 obj << +/D [6850 0 R /XYZ 85.039 519.201 null] >> endobj -6386 0 obj << -/D [6383 0 R /XYZ 85.039 507.825 null] +6853 0 obj << +/D [6850 0 R /XYZ 85.039 479.037 null] >> endobj -2494 0 obj << -/D [6383 0 R /XYZ 85.039 263.788 null] +2582 0 obj << +/D [6850 0 R /XYZ 85.039 223.124 null] >> endobj -6387 0 obj << -/D [6383 0 R /XYZ 85.039 245.119 null] +6854 0 obj << +/D [6850 0 R /XYZ 85.039 190.906 null] >> endobj -6382 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F56 2890 0 R >> -/XObject << /Im1 3957 0 R >> +6849 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F62 4047 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6390 0 obj << -/Length 2748 +6857 0 obj << +/Length 2356 /Filter /FlateDecode >> stream -xÚ­YmoÛ8þž_a`?œŒ«QÔkû^³Ûì¦Û^â^€ë…bɶ[ôJr]ãpÿýæ…TdYqrè¡HÅ—áp8œyf8–#þÉQW%£(–BÅñh¶>sG ˜ùåLŠ‰!™thÞLÏÎý‘tEâ&£éü‘O ü@¦Ùgçïï.>N/oÆ¥”£<1žDQìÜŽ¥s7–R:ãX9SžžàÇw¦ï.¹Tïß\ððÝ%tßpûâí{è\'Òùý -ɦ7Øf°œ†?Ààï†ß‡×ã/Ó_Ï.§íyZIAöóçÙç/î(ƒƒÿzæ -•Ä£´]!az}§¯Luv{ö–Ïù#^5¤»@Å"ˆÕ±òTÐQžôá'þ( -\¸>iï§ñ$ð'ËëYUlšB—¯yäöîbÊ­¢æo³ÌÍTº¾O¹y—ßsã"[%7§Z¯7?ÕfI½Kný!•ºÁ'Ï•X9"¸N£™l¦Ëy±ØVfý^o«£Íë¼ú–WÂîÊß­ÝðêE{Â^e>3òY6º2#‰+¹±+še_œyúMWEcöÜYuÜWzW£l]Ú….f]µ öo“‘±<˜`¡<éºÎß…;fPëÙCÞ|möØÈ Î×M•§ë»´èq.õ±ðº\í¿Î+½fC¹Ò³tµÔõÐQà:ªC¾•ÖC„|™àXnÐ’žoëê¼¾/Êó'µÒ‹¯ºü:O‹™ --þ«YýéöòæêíÀª¬¨ÓûU~p†}^夫u>ôpâügÙu¥I(¼üM¹Â#"{£Ñ:|7Ghȱ8)„9zìÅÎ7üÏŒçßáE6@º‚½™¸®ql c4™[~è<Î$OväñÜD„Q%]îÆn¬±žà®%»/€[™V{d9ËÔˆÁ"ç¨O§ä¹x?KÍx´(Å:@œ‰ç£\ñúÛ[/ð…ÀwÍ=Û*ŸáŽ® ³G,‡÷¥r®`sÏw4ƒ‰¬hX›1tbú"dQ{ Q{ 8~‹1ÂkcíŠÕŠ[xµ¹b‚<¼t - DÚ›‰ɘqÍcR˜&ã†l¾sÀ®>æx2t)/’În‰+f(çG\‡ü2jå‚ÖJÙyh›¿Ô¼ÔXØÓ†gÿp¥oÍ RóÝÀ”áhgÀ3y,ŒÒ¡4KO2ꢜc¯Z§/ ‰7âA$mA–ÏSTÞjØg­)t]±ëÌ5îK6$Œ7ØáYpMzm¸wÝjtûGê}ÍV¹¦…iÅ6Íl±´6…ä|ÇFëE“Ð![ë2­òóCO E=Ë•ž à™U ü•" ÍŸ´„YCfï µ™nWc:#Ί"ÖÚ6&,Ûº(ÜiÐJ0b·Ï­©™˜ ÞÝ“ê‡<ÕS !ZçÐë/9´ìÚEÌ;zÑsŠôx,n$k~f -Äxx´RØXGaØlx1Û"S¤ü° K4ÊÄs®æ<¶G“ÑÛ–€ƺ5÷zh€ÜÑ3ˆ3î¹S’ÕOPŠO¼‡í AàjìPQ$åֆѶZ¬ãž“®V6vxÍyÆÔ슾ߊ|‡-ß™åU“vmÍZ"Ölì5“é9SXç– tתuIf€ä=¬€ÓzÀ©û¨\ΤèK Ä7:Œ®2ñ-ÎÁ– C4OgÅ -0´ à5ªÀx Ìߣ¤M£K» Gl=Z:’Ù£+7„`Ëš` ɳ¾|ì:HY’¯MNX±OjÜ,VœfâõC´Uå¯Ù=<·ã‘Ö7Þ}@ò÷—N®Â4¯†XÏÌüítœ ‹€UO‘Û§Ûn¾a½ã?¯.„D%/äñ幸EÀ<ŒnÞðl£º`N­ÖÑ&QíèŠüÌaaf(¥Fçàämp ;“­ya ”ÜTߨgé2@“Ö² BU, ¨y„!·6ËŠzàìB8D»'OÍØkX Âu{p š »py‹–éL‘5.¸CH¤ÜÁ—Ì;2è ªå_vHh´FL’†‡ ¥/‚Äƃj âiP®o/RÄ=VG¾Ä©—šÌH‰—À(…ÒÏ·Öca®m(p™©H(xï\3G‚5æG>HÖ»`†Ž(‰: ¶œøǾŸœaù€ú6NÒð1zàhQRž†ÀˆlÛð[r¥peòÃXø±™ÿåúÃ*H\@à`c²’C§¹}GÜn°2+þ3°væ?Þ\qqD:X™æ„Ï€L—ã2ü‹8äX>»á ™ýp9†Ïã¨ÿB? -$µ'T`y'«m*¡|R$DuÒJz`•žð#.)OHRa¡-ÀÜ-Ÿm+NJÃEÇc ~§<Ò,+½],ÍôíSu2ȵ„ô“Ó²>Ò¬‡©¨•UElÔך²à(¤¬GE͈ôŸÿ8Aþß}œã gO4’ñBû€Ü6Ü_šÔŒèm* MFÔAoÔý¤ˆvÅ53`}mi³[›úQ—ÞGØ`ša­c CÉ×BãxMUÔÍê”oÔàGXDCö÷)fWqè¼Ë«œg("î®ù8(-g¹?Æe蘜†êW˜60b 2$î™Îîþ>%ÚíP"ùN´l‘W\;N¨ßs2–æ‰k_JÚ1x“.•I¹éÁ„D”Ï’àv$o¶î’X&ô§†Ë\Sˆ²·Á’rñºoÆÖü¼(a¬íØÒL:D†ìÁóÓ[Nx^yäâRùBªÓÛ1É3»Á»/ˆƒƒÝŠÒ>š´}<úTðæªF^¢Íûr«„w~N D'”`ˆP,ïI%œÚÎ*áänV Ýy™WTî¢2·½†lnÖΤ¨¬Œ ˆ¨Å·qbçÚÔP­ÁÅën›7†n~ê”>±ò©7yY×+S;ÍÿäƤÄgµ¾nbšYº7µz–Pg¹œpQ½W§‚§7P¡£šG¦gç›töy}^7Û²ÌWö+fåüd}BpIÇÉ›ÙÑòMnêÈ“‡|ÿ<éÆ‹Xŧ­Cô´±Y" -sOÛÉ팱ÞÍ[w7„îni²WTjÈ+q{NøhÇ4é?ÿBŽÛ"vö¤ÆÂDxqòŒÆ‰NhÌáü'5vj;«±“»Yuv«›´ê¢8Eܲ=ÿêñ5cdÆ7/²Ø¬÷ÛPëžw­&«ŽOw«jí/?õj0•9Þ”[æ=iE&‚.zFF!…ýacÞÖ^ôXôÁG`:³UU˜ r|c$2»Gb³ÜTi×z=祩G¡@ERD+^>ø»&]>NT CqÓ1K=éÿ~Ù牚X6ͦ~}~¾ÞãP¯ÍÏa]I q…„°'IÏ -ÍÑþ‡O‚'Në©LÆÊä(ÁµI.…†žÂch«MUÈ­+ªðrT±¾Û—Ì&1ƒ&ö>Ö+(ë)Íï$Ýjqa’˜í†ŠôOdÞ®ðþXìúñºÍÞáA«'<<¯ñ¤•…ð7ðûòÚ¹þ/νendstream +xÚ¥Y[oãÆ~÷¯ЇRèŠæ ï äÁî:±S;ÞZJ 4 4EIÄR…¤¬Šþ÷žË EJ´v“b±æ\ÎœùæÜg$Fü£È·7…‘°Ý(¥ë g´„™.„¦˜h’I‡æzvqù½Œ„cÇN<š-||ÛóÝÑlþ‹õ÷Û«³›§ñÄu]Ë•öx†‘5 ëy,„°®Æ‘kÍxz‚ÏšÝÞp©®®¯xøùº×ܾúð»ñDX?Ý!Ùì ÛÀ –Óð# þ¤ù=>Þ›ýxq3kÏÓ"ì1æ÷‹_~sFs8øŽíÆÑhmÇ0½¾€Óؾçê~q1½øgˊ缯’ïF¶¹§ÂsýŽð„#m)Å(t;ö}’Þ_Æ_úV½Knå5›UÆi²~I¸ùœ½pãj¾Î˼nª¤ÉUÉc3¥ + šÓÎ@ž%kÍ=Ýp£T»$olÏq¸_)¥É/·uuY¿äåe‡¶`ËïE÷`Ú"’£‰çÚÒ¾W¬áUed5h 0Òø¯ŽðŠŒÛ Uq£YEÆ:-³ÝX†V¦§jäÓ ›=КèK^ò +˜›ãÔn‘hÎKAfÈÇß3ø¾VºØƒ®RæÙ"ÙÍ{î©Åb@¼-iVùµ¡É§ÏW³?ªÑƒ"mnþ\gÇöñ«p½.ŽÖŒB×w¬F1UªÊE¾ÜVzù^m«“½ë¬zÍ*ÛlÊß­Ùñ¿ÞòptÚö*³TÃ36ªÒ#±#¸±ËA¿GpÉ«ªòFï¹3Òx©Ô®Flö ¨ó4ëÛãÍhÌ(¶3Á¨¤p뻺MTú9k>5û l$ û®çC'òG'ê3.Õ_UûO‹Ji/Ô¤…J“b¥ê¡£€>ª>còÐa¹ ©pü–ôÈ…OjùI•ŸI^­Ðâ¿éÕ?Oožî>œžuž×ÉK‘õŽ°Ïj"œ ý¿_ìu× +íÃÚS\X û®B¿Å?zœœùK²ÞèX 0>ЂšºÿZÓ6+tÖ ²EBT†r—cƒQNF¶i²—v(“jÏœ1n%B „ªäéBÑ1(4%M6çѼ<:í%Â&ü)/©õ-C8ÇMIMV:aqK×±ƒXôäÝ(€i=;€Š«Ci%sZÏ ÐUéKû#CïK;t‡r9Pïò¢àÅ $L¸?Ï+•SÃÜS:VuÁ‚ «(c«á±=;;”lžb&X1›¼9Þ¾PÉüÔJóæ¯,M×­•ÁSlpÀçôc‰(`—óq¦eR1ÁÔ””“0§ ²ÆQîªD}iÍHÜ@77üðĘhxa)R„¶”é &‘”²¥p¶Ì ÷y¸ì< ]êàжÎË%7[î!¹ +Z ï²ªN¯-¨[!`MAA³ç±ÅeÝÙ´Ãóà14_Ú‡TùºÇi¿ÓÖ<ò#/@Åx~–¿i¸ÝêÚ  ^+´.ž9ÖÝ‚‡÷j¦ÁeKnkë|{óDãKJ.­¨S’¹N*¼ÒpZgSkšn»?uÃÍ¡øj"ç Í^ëQÆlö@K’¥éió†/AX¯¹ÑìŽRfÖ˜ä†Y½áœ6´\Bí†_§uYA`‰G2%4N'šœ!ux:°ã—Vó†õ.Ž¡ÐØ@"WÕ|Àæt$få’Ì>‚(Í‹\—¶:l‹Ø„ pš-®Q%9fLŽÇ) &µ #YkÃ@“}Ñ‘•6g‹ßÖéb(SP=]WØÖE³t:¹Ð }`~ D‰ST¢t}¶¹bÏ£›d©‡I¨K Ô»«y’m%Á•†>M6 •­ÁÐJ4|ü¶iYùÜãÈ~zH¶þùcRâ¹±8^/ +NÁ¢¼ †…¡Ú Ù»ðÛF+žÖ³‡P…ÃG¡ê°œŠǨòÀÈBý¨{0ê5ÆW}Œ.øg°²sáÒn̪¯Ídj‹×IR/MBÕCÀ(½E'Ĺ#•ìrnæ0ö¬×&ô5º‚›v¡îÄÌ#sLð@lN±Û‹ ØçWƺ4{„D¤&.È؈ HB§I‹m›5ë!—G R~“ËÛŽ#κ½”F3?Ü?^ÓÃÎý¿ûò+lŒÒ¦·Ää _‡#üFfŸîøm $~óôGƒWüGCÑ3rþ7cò,/G:ó¿=d~£™?)ÏžµËãOÅ—;éĶ„+â¹·Ê =·!(Áokí[¥ˆ\Ø“¯˜®´… ÀWJ®ºÓ,ÝV\K!ÂEè(Ô4«Jm—+==}ë‘QDrÅy¨‚Ú†áãÅv—S„z¯ +x!/^Xº¨Q›"ã JqÌe “ú³î kÎ Í-‚õWœf˜ž".|9’6Xmx¤wíÓa8Ô¯8ÈåA âWÄш)ayƒÔ\Í+µÊ(ª&(•zã|ÆQ¿-Õ d§ŠN¿ wŠs ”žgÝrZÐï‹TDb‚å.í™5+.ñçæé‘J*hQñ§ªÏõ»î &Án¸¦ß÷!<$XÙ~ÞÖÜýG•gˬ¸<ès,>a‰¾ßåThŒT£ž¬óð©o‘¬Ùn¸›T‡GÓDsY(ºS=sF(—ïßz$mG~åW–äÔzãȆ»ºá‚''N-œÀŽ AŸÙÊœÝKi»Bv7ËKs3is•<²%£/”h%oz¯CÆgO yóôšÉ7Of«öôçö2§ïl¶ÌÊ C@ÚÞ´²²´¡¢Dû ò×1>o˜ùCÔØ¿!'×±‡±ÃvÛÿëW–Vر"÷ øRÚPÙi,x~p»xͯ1'€ÿ`}{gendstream endobj -6389 0 obj << +6856 0 obj << /Type /Page -/Contents 6390 0 R -/Resources 6388 0 R +/Contents 6857 0 R +/Resources 6855 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6342 0 R -/Annots [ 6397 0 R ] ->> endobj -6397 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [370.786 98.123 475.868 110.115] -/Subtype/Link/A<> ->> endobj -6391 0 obj << -/D [6389 0 R /XYZ 85.039 781.388 null] ->> endobj -2498 0 obj << -/D [6389 0 R /XYZ 85.039 364.301 null] +/Parent 6837 0 R >> endobj -6392 0 obj << -/D [6389 0 R /XYZ 85.039 343.104 null] +6858 0 obj << +/D [6856 0 R /XYZ 85.039 781.388 null] >> endobj -6393 0 obj << -/D [6389 0 R /XYZ 85.039 289.111 null] +2586 0 obj << +/D [6856 0 R /XYZ 85.039 209.282 null] >> endobj -6394 0 obj << -/D [6389 0 R /XYZ 85.039 275.561 null] +6859 0 obj << +/D [6856 0 R /XYZ 85.039 174.536 null] >> endobj -6395 0 obj << -/D [6389 0 R /XYZ 85.039 196.388 null] +6860 0 obj << +/D [6856 0 R /XYZ 85.039 104.005 null] >> endobj -6396 0 obj << -/D [6389 0 R /XYZ 85.039 180.111 null] +6861 0 obj << +/D [6856 0 R /XYZ 85.039 76.906 null] >> endobj -6388 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R /F66 3242 0 R >> +6855 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6400 0 obj << -/Length 3389 +6864 0 obj << +/Length 2424 /Filter /FlateDecode >> stream -xÚ­ËrÛFò®¯`å²`Uc^xø&ËNœÔÆÊÚÜò!É"!eP@H´ÿ~û5 @‚Ôn²åJ8ÓÓ3ÓÓïnHÍ"ø§f© #“Í’T…&Mg«íU4{€•¯”`,e1Ày³¼zõClg* -³(›-ïç¸Ð:3[® nÞ_ÿº|÷q¾0ÆF‡óE’¤Á§¹ ->Ï•RÁõ<5Á’—øcƒåûwû3ü^$èû £¹CùÁ=F¡¥å2"3Q¸ eED*z•·^ßaùiG÷"Çžª~'\òê]°³ÀD W㕈±-òŠG¾Úš0Âï{<Ñ9;[–r…< -Þu/bF “&¡±³"B¬,G „·‚ðq?y1À>G'"eâ|‡šúúÕ«ý~Ï -'bðzjäy…«âGIvQêtLòQ ”Ë„ƒ„†Çwù`kÈ"´z9é0. ]O&¨IBp”œ=‡vEp<úøœ…§ -Ãa¨ïKô(ñHÂ8Ú£8Ìzš`F]“W7{ò\Þâ,$(*ÆsgÂ[2e1‘ƒ1=âð8¼úi«go v6"˜Ï] f¤#µBm2s©#ÅN"ð>}²á²`…Ž=0Iˆ£çÜkÆBG¨[O²¼,ÙRb†·'ŸÅbKë‚|F#67¤Ò¢X%‚·e7´.Àe¥“b‰ÓtÍŽ¯F?D_G Ö$:ɶ-µ8'“:Ž£i”ÿ¶O5Ç03ñªÌNÈaǾì6Í“ çøjð5ø$«\¯yŒøŽŽz) ƒdmYi8Øzs…CŸ A¨PBDAkÿ†¡ŠJzÐk˜€c½FŸTQF¸ßñFâ9ðú¡Ejø¥`´½;¸ƒúbf ìñ6º ª&žAh ó’x@*.óÚS’;Iô ‰éîÀQ‚ù5ñš¤ŸfèÖ:íõs‘Oh°²¡Š|tsqùž©9¨ÂÙ;Êå„XÅ^ñÈZÀÍéÌßòVöÕMÇQ c*=½eÍKyÍñaÌņؿ~Z§83ŸœéxÄ–¢~.Û¦†´;qÓ XP[e³?üî}¸‚Ç-úêð¯û|xZ¨s`û!xçKU™M Ôµñå*ÒÆ—ÕXðGãñrŒËØMŽ!P'Gȼs²>¯ŠmÛF„**Ô—x¢B¸$þ\ʹ³ù¢…Hoã—8{@ºÀYAz‰³—.ôœ=ºoš³ƒû®ç‘çœÒÅNŠ¹ÓšLT"˜¥f[ÿlÏslXPìÜù"Ï™iŠ<– ,¨}Ô.Ö”ÕHjkn4:Ò÷]¸8Å»®ƒC;ˆzP-É-}!tÚ@ãöÑeAƒg Mœ^ôé¼ =Ò ‚¾x¡úø¾IAï{[<°%ÜNH×Axísc/ݯ½XINv,RÎ Y¤zd6–ÚäÁq¥®¾ñ¨ïù¥–Ú.­ô8¿Ã]û’Bàr‚âk´»a -©£„*ß2©EËFLi0càƒ¥_g˜KÌ^1$Ce·Âë0Œ-g¦ðÛ`YÎ(Ô9Ê¥¨3[¥a{»8ç©LF={‹uÙQ–ýÀ‡¥Õt7i:’(û"ÕüKú[Ëj&|1Ž‰„%¾ð¿}í÷5ý5Sw€NBzdÕH0/©ÅÖ»O2×%åìßû€Wxg]˜`Æy1fPýa™†Ìvƒ—âª*N‚ äñ§”¤îjŸ2s¨#}ÒÞeñ¨²»¾ïÀ&Ø6ÿâ‹SVßo< ëk È9§µ³G\ÇûþÎ\Jý”/bE%t½¾ãÕoˆÙ<ÉÍÞâ´OÏO—gÙà´;° Ib»‚› ¿v‚ßàãì„ß õuÿ=ù}H©ŽÎ‚Ó]“¡ÂoeÉÈvh51€¬y_î¨l‹z.ôŽä#lH ã·#>°‹BEìÛ”.nY<¬ÄœMᔆò7Ž³‘FÇT¿•ÆÔ¿ø/K$Á>×€RX³$/4 ´MBË ¶/*‹s½')ÈÛ´ôžTÙ,ã~Óp|¦÷¤.ôžŸï=•‡Æ¦½'­c°´*+„:â׎»¾¿À_r¸-‚+›¢zÄz”h‰G5 FSÆ KíîÙ QoòÕ†GdÞT(ç¾ S0Û‰b…zNJ÷d-Ov%m£Äƒ­b¯ù…W{‡=¶ÛȆiâýåû^c§ZbÀaëƒ\E>î _CÝ7¹ƒUßï@5Ùc|R¶6(wÑ“ _ûŒÉ‚A­s¶30PÔ¿®ö£Æ@öl ¨Ëßk•Óaê^è (‹¡gÜpÒø´Éñ«qëKNl°"Aªq¶;á:Ôærw`€s¾; À¨²ØŒR+AІD·ê‚?`^$üV>Ù Îââ(¿ÄJ»MÞ˜DFLoû(ž•öÞ–TžK (…ÎÁgf¼ó‘¾ÊT¼°î» -‚yGÔŽ7:rî)Ú!üŸ?|ŠýŸû -6a`I˜$Þhnè{%&?Z„Qú4>ÆP¶ŸääGltþ.“„Yª|·®·ejkÐUÔe™¼ÎQ;î4ý!Ž÷µËÄúÉž"ùMbâá!Ä}¹ãî/£7Œ2jÉJÄd')ШdäšÅkŸº˜C¿K|']=—ú$NZËdœ“qo8ëI)£t §ÕΞ’d–†Ú™‘(#.wMfŽŒï”¹‰õIªãŸ$é? T$3~Š±–ÓPü†a͈=GÎS“Ç>ûÙ?ÓŸ¾-UôÝkRsèV.)i -;>Ÿ4+ƒ|ßÞ=ØHjÔ&ǹæV Y±çù®ÿn@ÀªìÐ*øÚ1r'gIËO áø-»Wµªï¬'X¡¡´ŒS/©O˜Õ™‰Œ× qh>E@û´|¥Šô@3ü+ 0òqÅÔ”p€ÿOÈt¯ÙŒ{w‚©ù¯däS>lÀ@ËHð&³½àš¸5®ÆŸd»b†ždƒ¶5o– 0mêÃMlÌ ÓÒæˆÚÊ9]n:Ñ¥‰à5µžŒªðóóoýÙ¡=nÂÔœùS*qO+O fçN>gƒ¸Ôœü4<^}endstream +xÚ¥YsÛ6óÝ¿‚Óï¡ÔL Á#oN“&é´q?[<$y $J愇BRvüï»@Rg2“Éd.{aOX:>ü“N¢…¯R'N¤PIâ,«+ßÙÀΛ+i0<ƒâMp^ί®ÿБ#}‘ú©3_t´µræ«îïooþ™¿¾›yJ)WbæÅqâÞϤûa&¥tof‰rç¼íáOèÎß¾æoĺùûå ƒ?¼†Ï—¼¾yõ7|¼›yÒ}ÿÑæw¸bpœÀ·|oèÝÞþ5û<ÿóêõ|ÐgdOQ™¯W?ûÎ +ÿóÊ*Mœ'XûBÂvuÚ*ó]^Ý_ý Å{¡Ã§NÙN«DèDOé‰ñ¤ „’«H¤Z“õÚ¦éÿ7ót Ýë]×^/ŠúºÙæuו mó¯¼ðêüɬ¾i?5ËUöÜñREÚ"6«Ü½eS¯‹ |’*D3922 O¢^)ÉAÌ»‡¬Í¯WÍòz›-¿d›¼»îú]]ç¥ýËz}@Ìg:¬Ž×ìz£MÞ/NoóÊÈõ%þ>êé+¢Hh?ºèĺ9½‡4*V”[‰CfÒD¢“‹Ü,ÎevöÚ§üÚ¼jfAì>΂ÄÍ9:ôê'd½‡ë¼Æ¾GfG_òm*ÆÿøísQ GÜ«sS©ýø²ÁFœó38¨@xÞ`¸»Än0Ø„_×gm?±S¿…ëAý¥97pÌP ¥åa 3ž¸ý!]ñoêË÷â7%¯œtÙ,3 ˜U‹Œ‚»{ÊŒÛÓŠÄÞÓÞÓ>GçDølÝ[M[ò¦],h TT¸³HùŒ Ð…°'ßÉ–=ãô otOèvYÏ_ D2GvLPºZvÃÀþ!çÅ¿wGV))™8®Ij!¸Ñn ÆÝäê-¶7A?N‘‡4Qù‡¾ßv/®¯«ç‡¦ë_àHªHràzçˆÿžñ)!ÿßÀ±ïfË%嶷¦á+Aë.ùjð’ŠO¾ —YŸ“wx*LEíûGV¯Ð“¶.Æ5¸û¿Ø½‰Kƒž]ç´îñB@»EÇ'ð¶¶âLÀk?az1ÞG2B›’‹ÒPäÃD )CÎXBžô´öÝ9IÅîý‡Y@YN%Õx€¼%ù+6þ™)éB19#l:¾,ìˆr|c–J˜ˆ”SË&” RÉØ€Àº/úÒH&E +6|´ Äc±²ÑÖñ1{÷݆E¿#A¤WX½AÝ"C¤i ÅÄ]î*B„@M!Pû¢©Á¸¡ŠA‘b•Q ãug%SÜ‘*M;­ÂÆÃòl‰& eHX†Áɪ-IÒ i”ea³žº³Bœ˜eò£rdâÁ22âqK¦5J©pßï­q¼··(á‡ù­÷{S–G¾ºŸ|íÃgÿ\Žu&³Æ¬š«š”P8)Yq+Γ)¼ L9ÝQ£pØ`þzG8Eir+",ØhÄ­ù¸¿üÛQ-Þé…«_„•7ˆ…=$Ê{³ªèHÑÙúÝf}Ó¢q +ò-ÚL¾ ›¢Ø›ÍÇ™ŽÀ=ÈmÉýTâ~ ÇZFë&"1dÌ5˜µ6;¢ ƒÃv•™ú€Í¢Ï +Úwìˆ0Þÿ®ämÒeÝ´Ÿ?¾Ÿ5:9 úˆÓ-e5 ñÈAxÆÃiלI]T³È65TƒbÉ ”¼/Ê‚ü… `0… +³AgÎAskåd´¢Ì6# ?vç)·“ l?4•ÙßšÔ¶ßge×>ùQM ¢£Ü¨S7x7ià“pbhJÆ¥ Ìzþ À‚ß÷·s^L“<_1˜®N&“h”,âoÈ&pd© ¶¨`Ø]I+òz™ŽíA¾Æe9œ:Õ•… ¾×Ø?Á¦ ÇÞâP~ƒÛió¬<êAƒD$0~íq?ìA ÎÓýô€r=Wn! ? `ÈúÚ×'‡LôtŸøü°J§| Ã+‹¾Og°©„®™ 6 '%>õE(S'œTñ>a[SÊ€ð@Y{:£8 ¬ó4Ieˆc3þ›¬I…Q5\¿«”óªY‰¸†¬7¡Ë·‘ìÝF*¢X;A¬ Ês™‡êáÈ7>g³ £¿9Qc‹–Hìˆ9ǵ6C¬‹:c@@øÎœ,jnÌ£=—Ðõ†>—›œRWc:ø©´ä£(6xõ*Çl˜âŽÁ†<í/E52nsS™MõZåFÊŒKž'“.]ïeÖC:ÔvWsªXš´•ƒ…ã©è›b6Öb©†xò¾Ï6\GxµÞQ©4ûX½Š®Çrñ˜ð‚ê$ˆz>#[êµ[½_œ( +7eIy<¡àZò-Rfª7¹Q¡Ó&U ¯ñ¹jkš›c7'5ëe6¸œÔy›™¬°†û†µ‘«ªÙL2î²Å’ÑE™o¸ 'Ô:7PºÙZÊá$ÓâlF³‚õÂŒoƒ›K<7fnøÀÝÖ5[ˆu8ìq…€Çth >®3Óˆ˜±Ocò'\;ˆp·®ýªáÃT¨z^éßjdÅ q‘Ó’™ÖÁz|½`¦]íf涡 ·ÊëÇ¢¥†Ä@”tÃT FÎ$¿ýD¶Ä”,ýØñð\úÓ)<€l¦/Î22†ì0?OM^ŠNâ'{“Wh&¯7e³ I ŠÜû¼ïljý\)–:!—§óR8gG, ÊEQ8ÎX!\âŒ*’ˆüAÜbôx¥˜ðž +ŒJ\å߶Ü4[G +É'éÐÐú…A2† ~é’³'Ó†¶Ï?ݺâv³Æ߈ƒÉl(ÑépŸÛœŒ½¬Ï[#{qªsí¸mÖ]‰ëšº»-ÑÚQ§Íí1„·Ù*í7?ø•f +A)Éí÷,CºäûÔIÃÕì/Î=~ÇfÈ˯ý +Ý{(§Ï—"ô•%ƒ¦[Ççþ.pÞýØéäÔóøÈîeÖA‡üFí@ NWæ +Þe,¼lÈL•M0C`üeò´b¶ÉsçßVD õwÞV,Êy›œïÙô·Á¦ìNÚtÂîfålõ˜QŸ·Ä|¦~<>| ‹Eš$?ff2+žÝ³"êðØSsCZµj¬ÛõmËü›‰3éà̆Óì´>ÐxßíÌAí“OKðŸãû§þ04>P)‘¨3T:ÀöVz;÷ƒCyíŽþ]~Äendstream endobj -6399 0 obj << +6863 0 obj << /Type /Page -/Contents 6400 0 R -/Resources 6398 0 R +/Contents 6864 0 R +/Resources 6862 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6406 0 R -/Annots [ 6403 0 R ] +/Parent 6837 0 R +/Annots [ 6868 0 R 6870 0 R ] >> endobj -6403 0 obj << +6868 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [386.344 644.891 509.276 657.792] -/Subtype/Link/A<> +/Rect [330.822 535.736 435.904 547.728] +/Subtype/Link/A<> >> endobj -6401 0 obj << -/D [6399 0 R /XYZ 85.039 781.388 null] +6870 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 353.13 129.884 362.698] +/Subtype/Link/A<> >> endobj -2502 0 obj << -/D [6399 0 R /XYZ 85.039 761.463 null] +6865 0 obj << +/D [6863 0 R /XYZ 85.039 781.388 null] >> endobj -6402 0 obj << -/D [6399 0 R /XYZ 85.039 741.134 null] +6866 0 obj << +/D [6863 0 R /XYZ 85.039 693.604 null] >> endobj -2506 0 obj << -/D [6399 0 R /XYZ 85.039 473.996 null] +6867 0 obj << +/D [6863 0 R /XYZ 85.039 663.778 null] >> endobj -6404 0 obj << -/D [6399 0 R /XYZ 85.039 455.327 null] +2590 0 obj << +/D [6863 0 R /XYZ 85.039 508.49 null] >> endobj -2510 0 obj << -/D [6399 0 R /XYZ 85.039 152.856 null] +6869 0 obj << +/D [6863 0 R /XYZ 85.039 473.744 null] >> endobj -6405 0 obj << -/D [6399 0 R /XYZ 85.039 134.187 null] +2594 0 obj << +/D [6863 0 R /XYZ 85.039 177.656 null] >> endobj -6398 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R /F35 2880 0 R /F14 2895 0 R /F66 3242 0 R >> -/XObject << /Im2 4150 0 R /Im1 3957 0 R >> +6871 0 obj << +/D [6863 0 R /XYZ 85.039 145.438 null] +>> endobj +6862 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F41 2994 0 R /F58 3360 0 R >> +/XObject << /Im3 4353 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6409 0 obj << -/Length 3335 -/Filter /FlateDecode ->> -stream -xÚ¥ZY“Û6~Ÿ_1T•Å%žû6vœMRñ±™©‡l8"Gb™"’²ìýõÛHPUÙÚJÅÂÑh }|hŽºà?uŸF~`²û$U¾IÓûÍþ.¸ßÂÌ?î”P¬…díм}ºûÛqx¯? ²û§×‰O䇑¹*~÷Þýôðùéýo«µ1Æ3Ú_­“$õWÊ{^)¥¼‡Uj¼'ž^ãOè=ýôžûHõðáí?¿‡î[n?üð:?¯ÖÊûø3’=ý†m`Ëiø ~~Ÿ>ýºúãé—»÷O£<ãIáì -óçÝï÷þË]à›,½?A;ðLïï@? -ôë»Ç»Ž¬x.¼çU×tg)Ö*ó3ÝÖo¬ü06£~5Ì*?‹"Ô¯RÚ7Jß'QàGAH -*„AµQxŸ» -zÍ€J(»TÇÞc‰Ýa )lnû%„©¯’ìö':£ŠϨ3‚3>á%·«µµ—ÿ;P†Ž³dŒ·9vpº®lV:õ†ú;OnÚ„0³=veÁƒ$¬˜šÄ­{sqàõÕþ0.®« }ánÛðï°ãE¸ëáíºæ‰ÚíJ'ÞI(_`à8 ¼PAw ÜÊyž®¤­Ô%¨h­ðžYdÙ&ø'ýd~N°wì@+&ðÚ™,:»=^>So’ Ʋú©êw²¬%=®µ -}è™:Û¨>‘›†9 ›Ï’Dã¦dàhóª6–5x³ÕÀîä‰R‚W \Ûž²Í$h3HÓZn»kêÕ&õ“$»v›aÞÒnQôB½V9ya%ªñ¾H7FëÅé5S£XG"a?ïìˆøTò›’hzž]6Súa-Xî†l!µÎdóY•iâë -`ÃChoÓ•t·ØÎù§)OÜ8àÍWÖ–@Ya¬aöÛÀÓy/7wÂÂqàÐÄ^¿Lv„âÔbW®66¤i¹Z{¬TýMü$°N'ñL,—N1E.±x)2#RJ4¿TŒW´ø*’$"ŽR`€ðĆ &ßËÒöÕNMìÎl7`ÍŠx¢ìØË`ÿA너 »4Ìtc÷Ÿ<FÛf¶å¥fN|Dgš5Il5K¹êªf×v­k>ntòÒZlŒoÂÛiÍ¡YN½1Äï0P³Ô›Hê}²åñy•i@#™"h#ÏÕò•! s»vHá}óÍrî²ÔOƒ„k'¡ž2]w &ùLÆ^y~4~Dp¦'pÓ(AWp»â<€”«`hWÖl…b…0ô¡Út-X!Û.Œ~iÆ$[—ŶÌ_êißÆÉ­-zû—+©5/ö±«~èò¡í8¶ÑAà—Œ’l½dKBK(D ˜ï‘7†…œOÕ°ã•9ÿs”èŽ{#7‚_ò0m7Xk³úwœ—u®õ¤4­¼C¾•Q -Ã- -úµc|Ïs9ÿ 4xO5¯}%)5Šrê*IXBi¯M¯…ó7½òTC-;WðcÔó{ía¨öU?…BÅ‘IÔþJ²G¢œ…_‡a€æÁѤê™Û©¢Àʼ¶¯GÞ.GéÙ -)ŽÀXõÊ¿.P¦DslUÀqÓîé •˜”VNŸNeÉ­=¥öE5ÐN¶ç˜cwYÄrpä/Àbj1%‚ÃT[2q:?Nçî¿ó$EJ -¾ÍÖ »|àÙ}>’†LEV‚ÿŒ{‘æ,ÐÑ©–+ qpf¼Ó®ª§c“úp‡wtû=€¡KA§HÊ®”ûÒ ¹½XcåÈÉ'놡“Gp¡ƒùËâÒk,¸Ž±´Ÿ›‡ß|ï—©AhÓµ+HÂææ€ÇÉ~ðЉãCÐ. Ç¿tŸ(˜EQ¯yLÏW€Ë¡µMo9ä|!랊Üh‚F‘xáfzmFäÍW@[å(â÷ùmØDN—ÁSNŒÅ]Š‘ý¨:kŠÐ[¼Æ‰_Žá,PCìÀóÎ"‘нÐ',1ÝŽ¤ ´ŽQ¦Àe%8N›äóøºÃ¢.M ‘£œ¦¥!ï‡ -M[ò9:ÖC·,Q‡©÷B9xl÷‡ó\ÕYŒ^!äÊ•ãñ#ÞQ$1‘@HÛ¸"Ÿí–yr–çŸ?>r«·rX­Èf‡œ²[µ±ìÉGÏKó+уãJ`/Þ>ÛM´ø;¶Fœ~uä5-ÓLlH×èɾ -HºÞ© Ä6Λ üÄÇÁV6jìoÉ 7"@wJ5ÈÜæÚ+¾¬§‡­ãNå79[Ob °`¤i‰Ð *ûv/NHa¬æ-Á^vá%|"˜›ØСY°¡Æ’€™ØôÀùp´Q^¿Ÿ»"~Y8¼Jµ¾]8th–«É28o:(|.õx˜žÛG¡{ÌìWÈÈ#¯@3”Å´ˆ|Ë¿„’HA´ê,DjŠœ%ɸb€Ü –\;É&ÖoÑÂqu[ó8 ¤·>J‡t£é¥…y¹‡,‡‰u8©’±ô 2:’Ž£·`Û†­L ¯ôYè úp~ ™{?q`¯ýJÆÙ6{qbžƒ`ýw0“XŠ ßH¡ü8¼”­i¯x#i‡¿/{qám8KÕ…àÚfÚ-%j -u:¡ª¡s95Õ ª(v=ÞG›¤`* …$¹ðÏùghÌãØÜv-Å" A€µ -®)qr²Â-^.ÒÃyFO´36 œH$?í>0üÒ<‰n„|86&Š×©¢³ã©¡š¥·­ÏwöÐó&X7dÊg¾ƒÑ²qzŠÜ2àVïr2°WSྼs7ñé„PNÜ·/2 ªNK]b.˜ôè`ÌAb±/Û+f{š. ‰Éá3smZE7ƒðæºòB¯»ò4¹ãÔ+‹K(ºbDpE^>=ëz|ÙòÈ”dœ÷é€j”j vâû6˜0™û¤-*ð̯ò$fÔ‰)J^©‹ÞõkÞc‘ƒQÁt’ &(Q×Ñuqn|£àÌG¡sìGÄ„,0Œ‚áÀá8(A·0‚ „>™»,Äi2J&ƒ«Ÿï@ z ‡Uò”! [”Ý<³÷ˆöéì¾Æ^QÅnȹÀâ5¿Øå{ƒ«Åš”NB_%·³¦C³œÒu ¿‘ž¥ôì<¥ÿ«Â—+Uno's~ “ÛÇšh–“¹ŽD¶ -…åífp츉ûãKç -©Äpnæª?…i$äŠ%6¿VNŒ9g"ï¬12`“z¯™½ãÄ‡Ø È~ÿÂ%”ˇf˜ú&µtŽÑЙ)”ê(¢²†40†ìà“G*ù±DáÌZôvƒÈ¬©E•‚ËÙŠµ0P'½+.5.>t¹¦âXÐ}ßò°-ÿB“=¸dnùœ-£Ý¾z‘º9Òoë– …Ê×:®ºå«.C&K™ïùEÇß( ¥?ŽËJ|µw?]nñ±Ê2ÿM«uh–IáÇë0ž9\þ™7±õýi…ß{¨²[ðÌ»Vvþ’§©ÔøJß®÷:4Ëž¦âÐO#å &üL±Òü^ƒ;›ûˆ„Ò€Ë@¶ Åô“c¦\ÌÃßœÉ8®BfÄ9ëŠX­$lùÕÖ‘…SÊDò™Ë§Ê)®É…ÛätçôULgjö5Œ“à5ÌY”9¤„¯«(öØþ V…ü¡€ŽÄÀÏ©¾ë8² ‡ž2N'†ÇИ{œÚb÷…í“ÇHÓõõjré5û’ìì¸:á_‘ñ¡¯!Ô‰’ÚTã>^.ÐÇ&oÆǨ“Ú*›çœró¬–î+gÕ£ÚÁl¹¬:?¡‘k)[O¥õc?>6ppÃÀæ8BÌE°òì~ÜÕ€¾IwÛ­ÅZjÛ8E^ÓI±KµØf݉„ƒm6­­.Xhããýçy’ã,¶v[Ž¥YÍZÃ߃­íä°|¥ÑÖ…P¹ÚZ‚/9U¿C6²é£%ò¤±¥ñp¶lÁ]2Ñ‚G±NA)ª/› RVyæO{¨_T®,¨d,ï9Æñ,m¦Ð´;»U„6ÿ\­Ñ SgÛÔR¨üŸdà?È?Ngo*kÊcøøƒUå”Ô®}¯=j,öU—±Í5Äsû1& -façì'2™Á_NÜcɇ‡ŽÀ[¸äø1Ͷ™¾·„&•'qH^Êöï®Èúá‘Ýï™êeò'/R;ìm½÷¬0ØsÁäz3¯¯~Y…ÿyÛÿëï«œò–Ÿš…¿:Š´öµ²g¡ÜÅççLêG©¹<ð!×lõendstream +6874 0 obj << +/Length 2658 +/Filter /FlateDecode +>> +stream +xÚÕYK“Û6¾Ï¯à‘ªŠ`€_Çñ#k§Ö±7£ª©­lœgÄ2E*$meòë· J”¼»9m¹Æ$  »ÑÝ_7¤ ÿTÅBêý}õÛ槛w›QŸQR=Ge~¿ùõ7lAñŸn¤Ðyá] +ÃûÐFÄFÛïúæîæãR5º¶ 0…„ÜEgû4xN¡e†›T—š"''ãHÔä†Íq˜æôL§ˆf/À¿’}(š‰å€Ÿ]±§iCÙõ<vs _=ͲÃŽæ¾ ,Ê0¹7~ºõ—ÍhÀ iªÎÌH1î}ŸºlZùS»`m +ž—H8}LvåSÛ•LØ£–-å%gL$S’€gÑœ¤ ¤uŽP0XÊîXõ´¤0Nàà܂d¾z&“«=Û}‹ÎW ¥sÄkVÍ·CÝöƒ¸€¢qþ“þ'0ªEâE7Ls‘™èâ24IÂ2üf¹ç«Œ8+È:Q B@)‘c<¹FÜ™¤bý~n)k®mþóµtÜ:‘T¸bð{IØä¹fï„Ÿt"«{¼mAÌÀ“Ô.»öÖ%IÕr‘¤qÇdýˆD½»GèáZF #¤1'BF>Ö?¦÷eÓV|+ùsWÖ,Ʋ‘Ì’£µÙòªä[vö‘b©Ö#o´câ¡À¤àE3“++Óy~çÒçV}E‘qÜP<ñÐ~)ŒS# #ØØ{?ºïÁ†©oÁ()Ô«ÌZSð¹ÕÛYå`º|²AûtRTX«¢yž]™â@€2)ˆf!}ÊÁF² +Ï‚Æä±P& <ýßÝ#JÉ4Xã´¿‘©Ê¯¨&O„brW<—1°,“Iµˆ ‘¢É¡æW샷ű ïÀY5å,Nì_wl²¡jžû )Ƥp `´«’M<Hñykbt.T4¯à¢4 8YMbÐI–ÊDZ8í&Çò‘S&ð$gHgÓ+ÍïwS.ÿ ÌýþP¿Øå'ÃOt+|’ïáÒè__1#36EÓÑH´ÅÏ4”êBfì_z̃ʠC‚ý,6î0<Vì–½9ü¦ó”aW.—ªqîJºóŠ6 —Z‹H¶+@ÕL:‹N\ç|;(RµIÏYq}ŽUø__Ö´òã`¥¡‡d…§T2íFõ|âî,kËÏÖu „œ8—v±ÌËe h¢M63pC%5ïOç-” Á±'7SÙJ¥U‹=nl«ÊÆé“~ê¬W[0ü2'–ƒ¾éºå2±˜j.ÕÈBÜ|À<ž‹ÐªÁïe:CÖÄ"ë玎‹‹Xê§[ý4‚¯!V«H¤&¾.áÄsb#¼S‹’ù% $‹sˆ%*?<ˆµnˆ9Füª«Ü2‘EeýµGˆUvšPL6Ë—8Ú³Ìz1ŽÐŠÔ-ãªåñ;:üt~hïVŽ¶KU6ã¢çÎ%OºI›¹W¶ŽáÑ5ÃâEGšŠ,f*Õe_†òF« z}#Tv–ê{Œ1™Y0³ûãàzì©;GSv]L)D*¿WW\´T«X™Övî‡ÉÆ|YPº–ÞŠáC+gŽ·ÑéÌÆÔSÌàêÞq6¾÷cɹ¢ âyþÀuÈà¹|¾*¯ãæ«“˜\°;‹N¢eˆ5hK«ÍÖ–-ä{1*Ãi“^±®äª?éPÊÞÞÌxF8WdïH=¿ý8u!HŠW](W—R"t÷4¼¨*S;¾ühÊ#¿œE»†h· +ÃtÉf_wv @tv…¿tl½c  ãV§@ŠEÞç•-'¾s¤¨¨Ì.€*c5Yzu²½Ä(ïÖqúðjD¥ÿ¿ðzÅ“bòü課“ëØåñ\DW'"Kò¼¦^7;Wܯ º]A¹³aÊ}õçTln/Éh×¾*ãÄs_UñU.É j:¹/¡äˆÕ>m¢@®»ñ77º:Bž{tæ?©ˆíØÏ/npݿǼ[fKFáGò‡Ž×§ãÞ¦|iN¡\}.‹‡ÚŠÐxmiÛ}ab±¥kئêè©00–îŠÜ}ÍtÃåìÁøS`±ÇµŠé'{ço€m蚘¾îç×=¤"–)m7,]Ž³ €øxàÝ–ßéúç™rN¸öžwìŠzf,øA6…Sªùó Ñ LWòUÃxãŽÜ®dã=.þ  ,zâyh„ÚrT]ÔÖ5HÀßÑöUïn%pnl¯«Š~1‰@Áª÷-Ï^æ.‘MXÔ»[&PGwð€›.À5¹ŽèăE‰™ð8ôß’ ô‹ŽMùƒ~éd›Ø§Ìʱ­ðئësM¦8ÝŵXø>6dG‚èÁ’§/TÉЩ/Æ0ü±«þ¥“§Ë,ü%ðB"ˆ!DÊÉ‚'d¤>•¯•ãLŸ üo«”åendstream endobj -6408 0 obj << +6873 0 obj << /Type /Page -/Contents 6409 0 R -/Resources 6407 0 R +/Contents 6874 0 R +/Resources 6872 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6406 0 R +/Parent 6879 0 R >> endobj -6410 0 obj << -/D [6408 0 R /XYZ 85.039 781.388 null] +6875 0 obj << +/D [6873 0 R /XYZ 85.039 781.388 null] >> endobj -2514 0 obj << -/D [6408 0 R /XYZ 85.039 761.463 null] +2598 0 obj << +/D [6873 0 R /XYZ 85.039 496.119 null] >> endobj -6411 0 obj << -/D [6408 0 R /XYZ 85.039 741.134 null] +6876 0 obj << +/D [6873 0 R /XYZ 85.039 463.901 null] >> endobj -2518 0 obj << -/D [6408 0 R /XYZ 85.039 633.349 null] +2602 0 obj << +/D [6873 0 R /XYZ 85.039 340.446 null] >> endobj -6412 0 obj << -/D [6408 0 R /XYZ 85.039 612.356 null] +6877 0 obj << +/D [6873 0 R /XYZ 85.039 305.7 null] >> endobj -2522 0 obj << -/D [6408 0 R /XYZ 85.039 431.773 null] +2606 0 obj << +/D [6873 0 R /XYZ 85.039 182.245 null] >> endobj -6413 0 obj << -/D [6408 0 R /XYZ 85.039 411.183 null] +6878 0 obj << +/D [6873 0 R /XYZ 85.039 149.824 null] >> endobj -2526 0 obj << -/D [6408 0 R /XYZ 85.039 274.178 null] +6872 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F58 3360 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6414 0 obj << -/D [6408 0 R /XYZ 85.039 252.982 null] +6882 0 obj << +/Length 2424 +/Filter /FlateDecode +>> +stream +xÚ¥YYsÛF~ׯà#XÂç¾É^{ãT|lÄZ=$y“‰2((Fÿ~ûën\$¥¤*¥’0GOOßÇÈ_xôã/ÒÈõL¶HRß5iºØn¼ÅŽvþsã+ÄJAV˜·ë›7¢xá{næe‹õÈ'rÃÈ,ÖÛ_w?Þ~]¿ÿe¹2Æ8&p—«$I»¥ïÜ/}ßwn—©qÖ²½Â'tÖ?¾—9 n?½½•åû÷4}+ãÛ¢ÉÇåÊw>ØúŒ çå/´øYñ}ùòóò÷õO7ï×?¥D{fþ¸ùõwo±%ƺñ\“¥‹=קíà qãF¡Ñyyswóß•ì… 9uMv‘IÝ(5—Âó£+‹<7òB^±«ˆºÉÁQKÜ„žc«e:Ï`-s6Ë qöP»)P·§ÛÉä`¥'öÇŸð'—íoË&|¼ ƒÝæ?`7pNû‚P•yWïêàE×#ñc×ÕŠ`cíŒè²”Á_#¸††H\+Ò̘}P–0™¤Eû›ç>²éø³%n*H\/“Sk¢‘Vß|¼‰tß ƒˆ@ò~ ¦:›)!ÜŒLZÀ¾ÅL¡ï<Š bºÅJ bÎe<ÐTtEµ“¿y‘×b=ïh<ÓŠ/ðõƒÀ°H±p`ˆ‚åjKÙÔÃóõ#È*êjJ…U AÙ€„Æ©„V’Ÿ¾µÍ3‹o†d•þLô¤vÁ @›þ¤ízeÈî Ú¬›ï›:­=€„B Ø\3WYÊ·}`d$Ïp`²¼Ðg[ƒá›,r¬ bÆHórëQEO[á(1ÀAbüí%¶ƒ#L£‡Ðþ©GÅfJ Ûžãê®”ŒÓ¾?б>öIå®ðŒ[G„R±(§<”¯}9›º"³!Ýc“ƒEŠ–uóƒÜyÚç–C‡]15gÌÐÆ£hŽ>÷?ßÉHü*ÌøŠÄälÓ›‚GfÛ«èÔ`Ê¢—«nDW7V÷ÎŒ!D,ƒSAêY™(p*Øad,¹ƒ&í´†´v”V"Ï8oŸ`Sh¾³'&Ú©Õ 0þva]¿õÌÆ|øÕռ̙¥N¦8¡$1Ž„´ŠNÏlFâsu'NùqÙû´À +%”æWlÃT£ÔÍ ÕÖ}!ŸÅt8ÈâW3ø†“¤OQ/š$¡ˆ¾‰ÆSJÚ¾K7§räq|]™8qî:¸Å}ØB;_—†,d—¿@e@7L¢Wi›À¼˜ £Èwc5¡…RK´¨p1}—Á§O8´nP"I1†8Çf®Uä +’!Å)è£í§ ›4a’T"a‘ºÆ]§É]¬¿Z\¨ëRÖ9dÐW²jO,E*‚–¶6?èq5¥EÓÜ™Å|g>Ÿ…D1Ëô8YÈ]Ã@U£1]=‚¼FÈE\3fââOcÃDŠ5«ã‹¬›ü_ :rZÍ H[ +t¯wT²§‚± •p‚Øn¯%¶Ðøì†Æb¬VLXÐjG&—Š)d±UTœËŸ ÝíQ«(àÜøÚVîµòéêi;;Fv|Dµk"çv«uA}žæ¢h ;Lî”Ô>•]jÁ) ˆ‚cW,gLÉ<æÙ:W¨&hòv/0Ý,uV;èÅÎm+Û(«ïäؽˆ`fÍ¡àªÚÕh)Ó,ŒËm0EB9Fw£=aZå'¥š5&Š†n¶—ù౑°K»}ñ ‚€8E2…àãdLuXÞ¨f…¾#Ë¡ÚGó©ÊÉ V)Ùåè´˜ÃQË•_½šÉóƒq+ Œèaà–ómÑõÚ£½‘(¿,ÇrÄʨsš Ôâoc%iéôªKÁk«ÝXu…àujc5’+õÅ¥-e'G5]7Ý5‡úÙN#\š e®I4èkÌO´<ØéÞÌÙLΆÝ1÷me—kL|Ë»¬†B#®Ç eÔCÝ›EÆu½ü­ºªòÖÍ8Î {u³å˜&T]Šýat*‘'¨(ó¶›}Lü“‘{M4jÁ Zâôö¥<úk‚×óøæÅæŒÅC>oƒD›þí [œÚgV¥ýÑCÝL›QD²¸‘ªú¸ìÓïµã~?¦hâ7" +v;. ‚xHÌ4äw†@~èÃýtµj”¿NÎJ ¶©Cº§Eéeè̼禩ÌsöhMB_0ß°<j&˜èœ@êr+X­DP} ÓÕžr–].72?—Jê+´Bœ‹á¬â_j‡*O ÝàeK ÇCƒ¶‡÷û¼àA²èUuMÈxó!JgoŸ¾ëS’ÇÏf!“àÏÕ‡RßM³DaëJÒÛ´› ÇÇ“Ô¥œ´}V³mò?ŽÅàÌãû.ž/]ÏÏfϼ_}ÀTçÁ+‹Ä,ƒ,{ÅJ'µFO³å,>¥Æ3+Ì\?Ìb±›†s*ŽY¹ Ñ ¬ï„¼¤}}7²¡Í î9rœ÷_—¦£®§]yûrÊtƒìZö¡_Aöþ2Ö¤ÆMMv=…EAà~O ˆ§çœÞþ_%ÿÍ©qendstream +endobj +6881 0 obj << +/Type /Page +/Contents 6882 0 R +/Resources 6880 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6879 0 R >> endobj -2530 0 obj << -/D [6408 0 R /XYZ 85.039 197.272 null] +6883 0 obj << +/D [6881 0 R /XYZ 85.039 781.388 null] >> endobj -6415 0 obj << -/D [6408 0 R /XYZ 85.039 176.076 null] +2610 0 obj << +/D [6881 0 R /XYZ 85.039 613.296 null] >> endobj -6407 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R >> +6884 0 obj << +/D [6881 0 R /XYZ 85.039 576.429 null] +>> endobj +2614 0 obj << +/D [6881 0 R /XYZ 85.039 412.326 null] +>> endobj +6885 0 obj << +/D [6881 0 R /XYZ 85.039 377.581 null] +>> endobj +2618 0 obj << +/D [6881 0 R /XYZ 85.039 308.322 null] +>> endobj +6886 0 obj << +/D [6881 0 R /XYZ 85.039 273.576 null] +>> endobj +6880 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6418 0 obj << +6889 0 obj << /Length 232 /Filter /FlateDecode >> stream -xÚu;O1 „ûý)“"Æ8ö$@¢¢ˆhÏé`¥ãøÿx¹e%N‹ÒDšñø“C{äªJs¥H­îñ}@·5år Ù‘T@S²ÿŠÕÈR¡¥Õ„8/‰šÌk–MÎ.#ä,®¿8.˜Ô)h«®?Ýúë äßB”\ü „»~uMPj™F£fQƒiPI~F{hä÷ã×Ãîù3 ‘ühèÇÃÛÇvJÎû‚8¦Ì–°Z-^”ÿ¨ÿVnKSëE Û„+(M> endobj -6419 0 obj << -/D [6417 0 R /XYZ 85.039 781.388 null] +6890 0 obj << +/D [6888 0 R /XYZ 85.039 781.388 null] >> endobj -2534 0 obj << -/D [6417 0 R /XYZ 85.039 542.44 null] +2622 0 obj << +/D [6888 0 R /XYZ 85.039 542.44 null] >> endobj -6416 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R >> +6887 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6422 0 obj << -/Length 2419 +6893 0 obj << +/Length 1996 /Filter /FlateDecode >> stream -xÚ¥koãÆñ»…/¥€hÍ}ð .Éåêàz½Æj‚âzh‰² ó¡Ô9þ÷W¤%ùІÍÝÙÙÙÙyÏZ/BøÑ‹4R¡ÍIª•MÓŦ¾ -÷°òîJ †‹¬Šœƒñ™ÅÕ¸ºŠ -]rGÎX%:SÖiÄùa}uý³ &TqlëÝBk£¬6‹8sÊY·Xo?Öªå*ŠÂ`ýP,W6N‚Û¼^êàn¹ÒAŽ8Ø<›Ç -€e†åçõ/Wo×þp9{¤z†½p±2VÙļÊ{œhÆfÊ»vp›xÆ;C›lä]#÷. nš¡k[l›¡l›KLÊöWù8â:ZèPea6ãä*Iâcý‚YÙ$þj"ª -žnPˆÀ‹Iƒ!/a¡¼œ?UÙïYlxˆu ŠF~5‰—Fµ.=2œÙÌÉ•²²¤®½C©ÝUϼöDRíËÀ÷ C[k -æSìsª-SËŠ÷è`âØòtÛò÷Íû÷< ½ˆƒç| Ž¿0D²Ý¨-jb[tr¨êvi’à©aÛq: ~_¦.=9^d41:©”…0†ŒÐMÞ;â%€+$ËôÑð[Q^~uæöG€·ü­F—@û¹¹,¶ €Ö”Øxr¾ÏQ%eUÄð¨÷0–ët(#Ô ÞI”Ðg›˜¼«üþ9,0m‘à“w¡ÿ-†78ËF!·ç<³Ú=ú5;~½ 3KêzYóÎÞµìêÇ]EWðp®9$TRÐn -J!K¬­Þ7/- äcÂt£”`%ù** lîeO ü" -óô¾Ó¨ žñ‹+ùcª=3»my½o+#t`ñkvÀÊ[ЩMB4ÒÑIQ5[P¸¡ ³A *Ä1¨&….¾}„Yb4Fº †ö†¿Ì^^VB/G'yö’Ð7]`@.Ÿˆo7èW¾én/zÔ$Ùkp£-Òê®­ª6¼å2CN–“ HK,urîlÑÁÍÏŽáF3>ŽQçPÉSFî8IòqýmœòGÉ®-;ÊÝœ2:颉ñå1”—÷ ÅBϵºP|¸4U&±¯œËEKŒrP)Id¤zÃn¿‡zEP‰‘8SñWª± Îå*ȹTiÍÎ@é Ë4^“ÅÛø}lr’ -I€ñQ¤  BB]Ô^Uvêi'_¡å² -vß.Ù­’€²(¯±Ê; ¦ Û@ÊIÿpóîö- ÿºÔe{û«l¶|Z~Æ&>þÈÆÀ•Y%•[»5 `áÇ÷7o?¬í±Å»?ˆ5óß‘îº~‹WY#ÉwÄÐû; þù“û¥°Ä•¼¯$N\jÔ…ó%G_Öe•w|(W”2ÎXZœ/xá¬Êãt¢r˜;Ö…6I¦-º•¤…ãùnB>=sVÅ#`ß3°v®¹´¥|=“ÀŽF‰ÙÃבǂ×QÈhϨ#”šÿRß!´ÒºlgUl¹±û4ÔûÏÄn¤“ÌXÞ´u]4`Õ‘‰‚ïù3õ¾íò»²*ú3·ÝçXÎLö]Ã9gðºÄF\˜Nv<'±}ŒÉÆ&ÊeÔ¾þqõés¸ØBÿå*T6KO0•†åúÊF™Š²XæÕÕíÕ?¦;ˆ5IõE2´)2<"ló‚Êjäi¥#XשÏ&X´VF,Ì&‰Š3àÜ`¦ã»hé©a,òçet gƆ8\ü±ÐàNYfg2&þ×"ÀõM­?µÀébÆ,Ó]MsêK§©/ŠU撅δrFKÄ5|¢å±‰Âé9ð—¢ëñ­‚&V…80lù«Ü‹A Þ̱ɴâw^S Ëý¡ -l$œn±?5+°\®›í±ˆQÂ*G@ˆè¸ZJÅÜ´Ò¥Ò½þäw‹IþâÞ)tT»úþÆú[ö'e‘K´Š@ªãøßM ­Ygࣸíÿ´þ¹ÝZ}é-È@í& SÌJß6äh .‹ÀÝ%â$Ç(6H€Ù…Œ&à2G} "ºÅ1K²“¤Œš+¨>¿ó0B}žDB]A‘½(¹Ü{Èà‹ý -ñ@–0TtvAÍô¸-¹?Ó\G–¸ -h;4o“&Ì/½ñ¤É¬Œ&@?V]b&ùÙ¾R¡S¿‚óÆû]ç[dê£è T8Á'ŠN±©¥Ž'üXPÐç‘A¯³xó‘±®ýÓÂËxÌ {ØqãPJ ~Õ‰ÜQ©ô’kéF=Œ‰‹¨ûïPìYð·Ü§ÐXj"bM¯"Æ•Ä™¤´ëbØ\ÐÔ^JY¤¢DÐQbb¬66è´ä&¼g O¹à_<ÁÎ{B)º0|\x?ô¯]¹ ÈiÕøª5>eB!åâ[Ö›ªoñù#2ܬ¹dRº”š[üúÞÆ/º¨¼~úpË{OZ@ÏIqq-†íÚîH7÷ÞPQb ÞS÷̦ˆ Ñ¿övåBçÅ0€s ‡Ú—æ. _3 ZJM_­ˆ"~izjxVÇÁ€|lóˆ‰Dñ„Hœ(Žå×_¸]Œï´íZ ?Ÿyú=~¨v?å;ÞxR%Ç.æ¼›4ƒ¨Wò1Ãh¢a¦Âd«ü³!QØà¦Çñ‘¶ìç¯òÊ„kÒ£î©Ø­Øók">Ö°ÃÌû… Y í™É•›]Å¡ +l2+#6V‰Î”±e¾]/Þü= ¼0Pql¼õÞ9§JÓÈ[ï>úƨå*Š}(–+'þc^/µ¿Y®´ŸãHìoÅö©‚Á²‡?ÃòÓúûÅ»õhûJëŒw· +2Iøªëq”¨H›©ëÚÂfâ©ëa _í\×è¼Íü‡fèZpVû»Óv(Ûæž²üU7Î2䆎<¨,È&nDiªt˜‘ë„L'þm!@UÁÝ-†\ 3ÈËF„0¦:ö«²x ÝóÈP |?ˆÜË2LýöÄs¤*o¸s\®ÂÄ'éÌíÛ®æ%ôZn~YF±ŸWå†ò¡¸PÙ±Ì3ô79Oö£Â/8<ö ÂÖ@„ÅÛqÐÓÎÎFI¸’£ÓÑyÈ&_#~9Zχ5eÆpШÊ'²X½pŸ7{rvHÊr˜hÙr;¢ƒí¦*jîS"ð‹aañR¬íó²ê¹ q ÑEê´Íýš"‚3äŸͣó ‡Ö¸0di>ïy½¸“ChÜ–eK·xŠÒoH´á)Æ/Í°®Ýä„Ú Ï=/-Fã©làïg@6…rÃDüu™XóŽpçí Ó¸ÃÑÄß   ùöÃnpÚ°áþ $ü²aU£@Ûí\кk+˜gì5 ±8ˆü£C²…rÜ”#YìJ§p'¶Ä»mÞÑðæiœÀåB†YŠ`^BšÏ<&׳c¡ë¾E ÔÇÍžŽÔ Šºu_Q̸½ãsÂXÃØ~-´¶{újÔÌѺÞÕÀy”lç@µ§ÈVÇ‚#¾Rî 0w'òÇ™|$@;¼$ðä“ìhL8q͘ ‚Kâµ7¼sÖÔŸÐYã:ßÊ=f&6cجÄyBÕ¸“ÏMÛ;u§ ±Æª y½¤›ÈÜ­‹l`U¢cW…R½åƒÿOõë¢þžVY¿îÇYænaå¢J5—–ÀL®¿8tŸÙǦUt鲑Rúr“žjJ Lð–Íܸ„ç/ LÌW8$Ì%G%Å›€;ó¿}xÿcï~^j­ýÁ—7Ôȼ(þ d¾ãæ­¢ ô9,oÑøwpúþ°f°0Y¶Ä_ˆ¡f¼Úéì!”ºötäÑ5®|\¿ÿgüå§ejýKòI¥8-¦UŸñ î.ÇÞÆŽ˜í˺¬rÁ5Þ§­´Á³BšPÇ‘-p]+gc ·u?çב|4znæÕ¹ž4“Œ»Dh3-†ÿÔp‘ éãS=h‰|¼_´8¥”ÎÆ~bbúÌ7•Hö‡Ü½k.ìvÜë¹dÀ¢Y¬\J{W$§þËwwØÓR$ŒZ, øj¸ÁzQ\rÈ4܆Ú£hÛÚI9‡IÈ=ùN¨+—ÌÕÇ+>ÌVèñÓòLƒL¼q5³(¥Âe,4Ç íKf—HÐuƒö[AÙx8Õ–CøÍf +x¾Zbß?ÞêûE ’,ñž¡(7m½àW²‘~µx\üsúîÊÌ¿éЪ8BžS:½x^GF ƒLÅÀˆa(˯Ú[F!'ƒé}÷ûУ{(B0˜°µ¯ob¦™ŠLêM Ý:#2àÍ•&B'a‚ey7sUOÁÀG€Î'ÁŽ;+WÞZrfÂ9ooÓÙ׽δ +tâ…¡QIÄN³·Å– ËZ*|tstÿ*È+j&,z&å`+ߪè窺œÞ ,&JÞ¸cwsr»"—“6¾ÆuR%÷._¤*°æÞ/'€g} „Êð×Wð×sð7©2aò'Ô@𣠺§¶ž†CŠñ„Ä(tFgS'–"üCË•ê ðDÌYf +ï7cñēĤM®ŸwDojíý­'½‰Ÿ¢uuVËM'Õ!ò$B †6‘+÷âk.žö©¦Î‚»®`æKÑõøãtBߨ€tÕuÜ®pñ0–.8»ç/_‚Ðèù—;Ñìê7&KV€GUD[‹yw„°¾Aâ¿=ýaúr'„ÓUà*jWN“þßKW¸»Z†Ÿ¶¨Až·nfÜ{S)Û,Râ†Ëÿ=D·oÅËþßÓuME¯òœ» T˜Í“œ ŒŠa’E0Ì6ˆ¯£Ü­¢Ôx£žk‹ÿx1dendstream endobj -6421 0 obj << +6892 0 obj << /Type /Page -/Contents 6422 0 R -/Resources 6420 0 R +/Contents 6893 0 R +/Resources 6891 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6406 0 R +/Parent 6879 0 R >> endobj -6423 0 obj << -/D [6421 0 R /XYZ 85.039 781.388 null] +6894 0 obj << +/D [6892 0 R /XYZ 85.039 781.388 null] >> endobj -6424 0 obj << -/D [6421 0 R /XYZ 85.039 761.463 null] +6895 0 obj << +/D [6892 0 R /XYZ 85.039 761.463 null] >> endobj -2538 0 obj << -/D [6421 0 R /XYZ 85.039 761.463 null] +2626 0 obj << +/D [6892 0 R /XYZ 85.039 761.463 null] >> endobj -3035 0 obj << -/D [6421 0 R /XYZ 85.039 671.062 null] +3164 0 obj << +/D [6892 0 R /XYZ 85.039 657.513 null] >> endobj -2542 0 obj << -/D [6421 0 R /XYZ 85.039 671.062 null] +2630 0 obj << +/D [6892 0 R /XYZ 85.039 657.513 null] >> endobj -6425 0 obj << -/D [6421 0 R /XYZ 85.039 642.326 null] +6896 0 obj << +/D [6892 0 R /XYZ 85.039 615.228 null] >> endobj -2546 0 obj << -/D [6421 0 R /XYZ 85.039 488.273 null] +2634 0 obj << +/D [6892 0 R /XYZ 85.039 434.077 null] >> endobj -6426 0 obj << -/D [6421 0 R /XYZ 85.039 458.869 null] +6897 0 obj << +/D [6892 0 R /XYZ 85.039 391.123 null] >> endobj -6420 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F56 2890 0 R >> -/XObject << /Im1 3957 0 R >> +6898 0 obj << +/D [6892 0 R /XYZ 289.538 274.021 null] +>> endobj +6899 0 obj << +/D [6892 0 R /XYZ 85.039 178.043 null] +>> endobj +6891 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6429 0 obj << -/Length 3440 +6902 0 obj << +/Length 2762 /Filter /FlateDecode >> stream -xÚ­ÙrÛ8òÝ_¡ÊËJUM}Ë9ãÙL6›¸¶vkv(‰’Y‘DIÙñßo_ A‰’S3)—‹8F£oHMBøS“Ô¡Î&Iª¦“åî*œl`æ§+%s™{0¯o¯®ßÇf¢Â ³ÉíºÇccõävõÛôÍϯ>ݾû<›k­§Z³y’¤ÓÛŸßñÈ—™š¾úõõ+ì~ý7³¹šþãà ÎÝÎ~¿ýåêÝmGH·lš!\ýö{8YÅ¿\…ÎÒÉ#´Ã@Áôî -ȬÑÒß^}¹úW‡ŠçÌ„WÚê4°©>=µ²Þ©U¤ƒ(R“Ć û¦Í£(š– ~õôÎR๶и_fØ"ˆ¶âïg«=L”mUËœ,C ÛjÃÿ •Áå„®á±Õ¡Æ…{i‹'[l1‹Òé·q{‚(q?·è®@f_¿·±w¸(Mƒ$Í€x¬6/ùóÈÆÓù{üZ"íèšLl€aYÇ“g/JIlF¯iîpÍ=dt BMœ -„οdÕ¶8¡ dH©C£z†2`aš˜eû|'܈Ò\'q`ãh2W(›ÁÂ%Í#c¦9ºø{¸¸¼ÎÛ‚[D!Øu÷šoynÙIÝyµ¡2dÃC#e[ãÔòmëšï•lÂXW(;›;zó—ä¾»Y”pmÛò^d1·E½’á3éé€ '€¡þ¡?wÚB‡È[¾GFÍÊœ>@£ÓDÁqó=O,à“ÐIat ÕiX¹e6\áèO±Î™nž,;nµù‰ÈÛ²Ú7Hl@·§í@WT`"-ºr}hêëmµÌ·×M¾[ä×y=råJ8´•EÌŠ¹ÎlÅ)sÄÒÌ«mS½<¾Ð}Am$•X!WÄâ¬é¶vÜÙåK¼š;2…@0£È48Fá:ºáýŠñݵŒ;›tOÀUÃöcL«2Ê­² ‰RÇàðdÃU÷eaUÜ; -2¼Bg·ÐiàÑÑ•àá*G¯y¼\ó÷ çàpЉøn=¬ËRĈz+^„nJdÆF0í˜ê1Ÿb¬»Íf·–Õ~=rP“œ8²SnsËnðIæüè.ÿŠ]X§ÓäÚw9ñÆy\‚.Æ_Š†â”teÈšþ.Ò3{J9RðH†jûm*ò>Hh{×[Hç°@ÀuÿQ¾ÿÖ -'Â(0jÈ Ô\wÊ–o…N ßZpåѲ,4d™XÎårs±ØÞï38ÒÞÁ™¨# ›Ë’C® ‚Yð_&fe G‰µ RÐQ (°NÑÎUˆŠc$øÓð!ð.ÏÐ$¨.ÒÔÃMI40@B ?#šÞ–ù ´³¯pòùî&ŸPð©Å:ÌÍ‚„*M§E}L¨ÛÀfqÈQê`æÐX¤e·q‡ IU'—¥à´J_ÞŽAžÙMgýÙÁn7`Lw‘™É’˜²KLrùÄ@¥³Vˆ¦‘N‰MfÅÏÐBÁxÉÀ„Yéôy-·Ú¹¢}³:žÖ‡=oqÅneG„hë_ ‚M²SXC`‰¶Y§e @½‹Z£lG!Û/›BtËßšŒz:¥s· c`ÿÄ]HSWµÌ·]½g˜Ë&-²pƒF}—IK"ä 2lCXÉñ‹SFÖ'6øæÌ FûøEß› ˜ Ã¤f:"£"[43Óß„jPh<‘È)A©ˆÏ¢¡E! á–@³Ž¦¹I@ÍìÐ\(°ù–Ý„Ð(w‘˜ˆØð±rVê$Øvà `0 qNþ˜¨ 4Y¦Ækýý±hàúf§&o+ tâ+xçbVáÔWáÔ@j6±xs1_Ùñ>Î9ï@…gT+J‹Íº…÷obŽ½s'Â0ÐEVÚ$NPoÉ@Ža+†¤ˆæïcn9L€ª.¨,Úå xò銑•±@þ³~1„’Q€×íÉóI̺…ï8}J Nž”üy™Ó+2“9.ËþšsA?5ÊFFñe?cb´Ñe?ã€5Ñ9?ãa:ëg.ï&zçïöù@ÎvOCþ³¬HÀv9Fç8yï|ì¼¾ùé –O>Ï”RÓS͆ה0*Áó‰‹,šS*Ž‚[UÃÄ+”â7nÞ}¼õðxyûÃŽ<4ÊÊoØ1"ù:„oQUÉØ ÀìŽS .Ú£^ÓAš˜ódÓY8íŠGjŽo%Ù7BÂÐ?ðF Œ·o>]ß|âIN‡×¤Š”7®¼.°lF²Ò}… bªÅWÖµÛnÙR¦…†ÓÆb|¬(AO%{Î[îtî;åvË­½Ã†FQJCÍaL‹#9^¬ª†[÷pC÷¸ä… ¦ ’9É‹NDÉSji'hz#ckºXn‹Ät‘þIprS´ÜÈù³ãK"Òó`ozÙåV0|W5²¹PI»OF±GãEÙÕ:(?¯G7° }\E½·¿p£©Ö¾Hy$¡rÄ GiÆÖ7ÈH|3V@à…< Â7UáË"•œ)¤d¢=Ü‹"Efz#J‚Ó“Ë̉éå‚÷¢ÈE¥Y ¢aÕ¥KFÆÆeÅ9'C9uBÔÞÑ]H²E¼Ãyao±Y] Ï®9÷ŽÄäÀ­êÊVe’Í4–®ÔSzØ^òÂ…·édnMsØäþÄ0È£2ª -´=H¢l4$ÊÀf‰×*íN‰)Rñ HU£š1qœ º`?Ϫå®K ÀœF/Á¥Å/7Á«=+µ«Ò¼‘˜™ÖCÎ@aÄ©Tß;µ1* €¬÷À!ÅÁ'(uJ®cQsÍKz%ÀëÝhM…²½ó8$呺`%Ùnyù¨ê”ÆIìb-í$i+´ ÌB€Hž·.¶ù76ºthÙHf¹à‡VRLä¶h=Ü[P·Šh¤tã+Øg©™¥\ÖÁÁÑ—\âóªC¸æ.¿—ýÈl±ö\$7÷ØÓq|¹”ôÝ¥îGÇZ#NòÌ/älóî -)YÑ*üžÙÇr¥«t}(ITà›Ô>îäöü,„ýª¤&%)µ;§ÀhTÖˆ/_í8’ ’—ïø.ñö­:—ÂèËö/§0©³ú½Ñ$Ûìl2Õ2.f0†Tf¾7ƒ‰b ipüã3ñÙ d*H íGZ­ºBK'Šìò͇oÜ[• XdLÆT»æÑ’CéÜ÷ ÙI˜½&h]Ž² -Ó™éÞw1éœÔ²Å„?Ž§·¨4$‹âíð›óÇE²$ÑäºÐV°ÛŽÚŽ¦vˆìM!‹ª‡¢Þ2/*.ƒ®‚sÉŠ'^¼ÉJú#“•är²Š…ñå\E`¨¢x.UéñœÍT.n%êåmEyJ”†ýSeáíúE$Sƒ -ìr[ÝSÌÍ?ðw$ƒÁájd Î5Ø"ÌHºMð?ZâlpUÀl{‚0X=•a”O«9i\"b#rëø•PÓreù•¬˜mÚº+¿[M1~ùŠ¶”B7AׇÏÐáðäÜ÷ë_<²cŸâÔ½¬˜—9ùI]è…Tàˆáô¸/^çÈñ{"{«ÞO®^ðä0ÖÊK`d)è."XPȪÑ[ú1WäŲÇT3`.˽”¼C'iuÅ ¸ÁrÆŠ  ¦`u¤ -ë\Mçåb$©êÑÊí òFI˜=Gíq³§‘Í"ˆ³• ø]ö0ØT:M]5çaz¦•Ä°š¢>“JØ®B¹-%vŠ²P—ôRÑØÆA’|G¬^G=EA)?û¥Ã·#ØÜ ¨+çkngœœ•.«Ã1?w¯]!>¤Ç~ÿæ®`¥Æ€9xx¥öáQ„ÝœZâ£/“ƒƒäFÔÈ/ pð´¨­¢¾B«ù•}'‰V×”{>1`üî*_ö‡ æÄa¨Žù£âüsÒ«À$ö‚x'A–ÅcâMè/ˆ²ÍȵŸÁlÇQŸd¤&»¨"&ã-%x‚?üÈïÑ-M¡Þ‘®À¡©ly]ÿþ¢ÙP#Y„l9LÕàf@cöÅ’s­©?aªuhú'㤂F^7ºP¼U¨`EŒg§Ï”‰¬õg|õu±tºr‰N½r3t¸l³gÛÑ&\ÓÉXÚÜÿؤÿåC÷3£»’R=„[ù™×ëèÙ”ì -Í€÷ÏÅafÔ.ØkÒ3¨­lý‡wZíôæ½ß;a—Å HB,sZydÒæ|&Îè|øEG‘#:bì®òb×åæq&‡Ã¿éuvŠ'óÖÖ„dsð+ÂN_áBÍ5Sw,¤ÿ+/ë˜Áb¬,Y´è~K®ýÌ9@dÑ+É#]r(92ÕSxÄýà–böÑKE[úv &ÁM1æÅóüÜ›¹ƒ( 9áŸOð—~Ä×½qƒ£Nu6¸Ú( -"åh¡ÙfÇôºûüÃW²ÿendstream +xÚ­Y[oÛF~÷¯úR +¨(‡×ûà¤Ië6Ífa±‹¶´DID(ŽCR±ýï÷܆Z´»Ø. ƒs9sΙ™3ß¹H-øS‹,ö/ÒLù:ËÛÓU°8ÀÌWJ(VB²rh^m®Öoãd¡?òÅf?ò‰ý(Ö‹Íî7ïõO×6o>.WZkOk¹JÓÌÛüô†G>-•wýë«kìE@üú¯—+åýòîç6Ë?6?_½Ù Š "@hŽZ|¹úí`±¾ +|g‹{h¾‚éÓ¨áÇ‘–~}õéê+ž‹¼jnÓ±Îü8Ó—»VñÌ®ãÀƒˆvý¡ÝKÜGÑÁGÇ©w#Å2̼Gì'^Ñ÷eƒý¾2 Å^oxª?òj\V¶-tLË3'âÙuÄùPv<ú¸ SÏœ™I[nq¶¬¾"óƒ‚Ïr1ŽÒ[C·AZoûúQ´¡³ëgàŒ—7E/:|Ï_‹Ït(löÝY¸bÇQÞǺì·ëA«¯ÈŽ®×à™í™·_—Ü– «ðɸ:æJ¦ó²UÊ—„_EèuL%¦ñ@Ššö í"/.ª®÷íŽÃÔrÞñuÝ™ïðX¯Bõ²Ð¹¹ xþ6¦çÆÑ> «…Î"ï‡÷ŸxvVIž*¶[ÇfylodO§`›æáÑnäb3M².‹n ŒÐ~2×~2í˜<Ì÷Ð> +-«×ËæÐÍXkîµBžpèÖ‡ÕÓ+ ])©Æ]Ñžlžn4¤WâÖo“Ð"+?LA”½k4ɼ»Ö,uè=à=&¹÷7þ4†<Ų0Ñ€,7ð6GQÃy³ôÚ`è÷PàY=òÎÈÐB%Ïpx,Hö™gè4+»‹ÎòA XÒ,SÙ¥]W œètW¡NüXë)ÎœPØÓ“œ3ÏP;Ò‰ÅﱬïöøÖkî£öø=™†”ÁÛ£qÙI¤áÌK" ıa¡E4Z*»pÇnÅ`ûÜM¨á¬/¯U« ®%’ké‹ +Y¢Êyì­Þâ7Â.ìüðÔ_FIàgyºH¢ÐWêϦöS4ã.W–ÕjäEÎp¢j”D~’(+õ|zª¸ÔDeÿÅ„ÕËŠi¹Š^¾ˆRòá°árV¸Ì‚Í/Ò‘¯ƒtÆÍ‘o ¼nÏ)ÛSÕ5öÀ,MÓ™Z¦~âÍd@Ûöm½*ê~õVñŠþH~ÿ|8rÿmÂ_“ˆÀ#@¨î,T¸raw€+þr•Ïí¤r]~]JLž‚gj6¡'0FW8¼H„ÍO ÖRg€†0¼=iŽV½ãYÜ1!a˜†Þ®Ü¬8OVM׃“)ðÅ0w¨¦áïz8­v]³…Y>ö×1žkÞT‹èFÖ#…Yì€CÃAR܈Øy7êßšÓÌ9œ +Æ5ò¯~¹·ÅCÐA6vöà `o@Bëéa]eZŸÍQr¾% 3•0¶[âݦûe’Åj‚Î$x«`Ö4£wp/ã¢ùê s|5 vlÖÄ•Ž«Ä#»™ã#< b!Là0„‚‡iX#ˆý|8c¥Ì‚8*å(«±ÇˆJ…âÄ RÅÚ,.!ïä,åhžUHM1tï•mÌ°[%Ž­•'«F§¡!P­¾ìzŒŽT Pó-z^º§û á¯UÅ÷÷äç‚L«:ÞÓŽ°h¤Ñ,)dÚ&Š5@;/e~ ¡k³†Qâä@QžÃHLzŒbºjB·’ )Ip¶)nuϨdY½¤’CÀ]¦eQ¢ü(âdô‡ +B8çÆ xò¢ ^d¤l›ÐêŠ=*l–d!D§eûœžèþLÏ‘æ2}Ì3_§zàƒzª‹{RAâgqö¢4Kó²8¥Blq"ï!P§ƒÅ†¥rRÓ>2A²N8^£@N=š^$’°Ùšvd9b»OÎ4{œÄTÛ˜†žFXÃ’üJO'2uš‘wÂ~ø$2œ8›„8ˆâ<¡žjÈzöLkó'ö‘’qÞÌ ‚¹ÕðΧX'è‚p÷T …–l÷@ `!yÉ GEê_œÁq’.€\Ú‰Ü.X¯ŸÆú¿«2í‡:œ ¬à²Oö,ZnõExfuZ…hêÁô¹*?c¶ËÔOrÐ<‰ý$à÷úÞX”(/7*ä*÷³”x.¾,”&h¦qÚ¤ÿ¸-XßœÔâš.&Ê2ߕØQ6ɳ?R!,Õ )ûo¼²î<²ž›“À­ça2dë9Ø×É„ò¢e¦–âÉ/ýX%ƒ`Y¹®¬ñß[þV@uiâësáƒ!9á3“H‚¼ÄJÑc,Öuu{¬ç±¯éüßí¢p?ÓÑb…Ëò¿f¢@ðFß8}…Ãxkõ" +[<²ðYv8=Â/Š³o•÷ñŒ —80 ¹ûÖÐÍÎû¼³!ξºùñ–L?.„ +ÿÄ:+2 .D—Û‡×L ܸ*Y5î\£5RõõÝ r}¿áU6¾`GÀ\=ðj¶_Š.žâl<Ù1p³U¥æ[AÞ1Â0†?üÖ•Ä4ƒ[ê$pnÜ\ŠªWålйyýaM%?Dd³'åúE;ÁY[Ò’ãÖ·nÑOk.Zv¶üùK¹›Æª™ X_:^–Õ&'0Ô>êZÄ—aóvƲ$Jíôl¾Ùñ w|Iwý7µj¸`G»$ë]†ú2Œ¡EИÛsc+‰ds›Â{ “Èq÷‰ss8SðçI¹š;) †qZÒ9ëñp´÷äIÙ`#ÊXP'K§ª&wÏs|ñ®fäq€*ŠÃ:³'¿By½ÿ‘y4«£XwiÏ®—Ž¥J _¶hÌ”‹ckª½­ ÇA@e)œ²†Œ°º­…9ÿ6 ä~M1ÄO“ÜWt±æ,⹊ +¤ò;C[9<ì‡_Bç7[Ðêö—ÎDò‹ßG]ñÊùŽ è–jèܾ‘(ªëΧi[@@¬OªÁéX ¡s”†"ù%™öÒÎÛòTð‹ŠÈ@aöSJIÕð¹J8ÙÍ=€k¼bÌh(e@pà2=°4°Ñ±üÒhcçdß;$ŠRxÑ}AÀ2„4$ª=9XŽ¦ë§¤xTqh\YôÓHÉV^ óÉ L½¢3îU§Íh¾XqOϬž±€*4…,aÍÒžée>ðàX4g‚sM—…3†—×ðg ×=²˜£}¤¢ ˜ö3 -ÞÇB•x_Îc­&éç‡ÜsÊ!(ñXÜuLn‹¯Ø†3a€$(¢‘éÏ +3}ë[%-@ bC°>ªsÛ”½ åãÀﻊÌ ¬áUc"aÃ|v‰bˆ_+yáN¦AĈ{¾ÙÝI0»5‡vøéçJÚ|Ö +¹|˜ÏÅ/ðÏ{ýK?­:™/„zù| ‡¡*« žm¤Oõµ?Á^(üòáJendstream endobj -6428 0 obj << +6901 0 obj << /Type /Page -/Contents 6429 0 R -/Resources 6427 0 R +/Contents 6902 0 R +/Resources 6900 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6406 0 R +/Parent 6879 0 R >> endobj -6430 0 obj << -/D [6428 0 R /XYZ 85.039 781.388 null] ->> endobj -2550 0 obj << -/D [6428 0 R /XYZ 85.039 650.648 null] +6903 0 obj << +/D [6901 0 R /XYZ 85.039 781.388 null] >> endobj -6431 0 obj << -/D [6428 0 R /XYZ 85.039 624.034 null] +2638 0 obj << +/D [6901 0 R /XYZ 85.039 530.827 null] >> endobj -6432 0 obj << -/D [6428 0 R /XYZ 85.039 610.485 null] +6904 0 obj << +/D [6901 0 R /XYZ 85.039 488.542 null] >> endobj -6433 0 obj << -/D [6428 0 R /XYZ 85.039 469.804 null] +6905 0 obj << +/D [6901 0 R /XYZ 85.039 461.443 null] >> endobj -6434 0 obj << -/D [6428 0 R /XYZ 85.039 232.632 null] +6906 0 obj << +/D [6901 0 R /XYZ 85.039 292.452 null] >> endobj -6427 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> +6900 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6437 0 obj << -/Length 3553 +6909 0 obj << +/Length 2880 /Filter /FlateDecode >> stream -xÚ­Ùrä¶ñ]_1ñËΤ<qñpU´‡c9ëÍfWI•Ëñ5CiXâ2ɱ4Ÿ>ÔPò±©--Fh ïƈE ÿÄ"3Q¬òEš‰HeÙb³?‹·0ò÷3a1Öe༾:;ÿ6Ñ Gyœ/®nÆuL¤Z\mZ¾ùîâãÕ»O«µRj©T´Z§i¶¼úîC>¯Äòâ‡×ØÓ€üúoVk±üÇûK»Zý|õýÙ»+Oˆß6Í‘Š_Î~ú9^lâïÏâHåÙâÚq$`xdDF+Û¯Ï>ŸýË/ÅczÁ³æ pØ%[¬%àHýÛÛ)%q~»x±q%*yvšÃ:ÜrèÓuÖBå‘ÉÌb$q¤åÈ‹T.„ˆrcBë(OÌ"Õi” MÌøЕx½åÓ{uèIn"©é¨‹_"Šuž+Æ Út€ñ`8¿Ü‹ÅÛ(]„ÄÚu×ÁÂD¬ÈÁ™Ž¤\¤®ÏH¢õs»/Wk-ôòßMd?bÇ,Ïñ£–ï«æà€zÙã‘ŽýPâwß3ðÐÓ!Ï¿•q¸“‘Q–$@nòX5å°e´ A -¨†+f¬ªáïaǺØX²Ú›™åA¤R“ûyó‹Kaá$,I¢Dä.eκ³+7w°hÆq%³e{è°§–ýêÎË[ ®]­msØ‹›¡@vWmÃ7„÷‡Ý -ÚµZ8t…ç£ï°£{$ùÚ ‘¶i›¡kkÀˆåò¿±Ð5ÑrÞ3äÆï€vèá%4:T›C]xDñ„SKd=ç¾fj¡Kÿ7N”ƒCÂòÌG¬½ÈaWõlo€#+™.ˆ$lu0ûŽ­O¸‡KH—eǸۢ¤[Ü*zª0:‘~Jø:­(.X˜µ7FÞÐL D¬F•3¡"X¤D'Q³±¾–+;Žqç–®{àNÁâTIÿ÷tõìÊ_ŽG=á ’¹¢ªË-£€,5¾.ÕýŠ[ÒÍìÎ-ƒÓQ¡éWà1D!lÊ òÜŠNŒ§¿f„ /ßÇÉNÿêÇU¦ð˜¸á3´¬½°O"Stvk’'½f‰ÁyŠÉ-ƒؾé*wìnëãWÓ3 8Ÿ½–$TŽ®½ÆK»®“-6$뇕U“rÊ©ÓãîH³ø(¸H“,‹ºÚ"0^Ҳힽ 2¹FÚšiu¶+Xñ†²ëghùÛ³¾Ââ×dEÐ}-0’oSðB}µ¯ê¢ãi$CQsï™Þ^רsˆúLËݬ6[0)_z5T¸Š2†I -\k@uF2‡î÷(|[#äò¢î[Ýà gÌOsÇ#£ýÂÕ6Þ$ Ù»el¢s(]×Äl÷U¨r2•Kœáï÷×H°õ"ÝÔ&ÊÀc0,&xY2à=Ì‘¸9ì?”0—©ÉE•]×v,025x£;lågÕ˜¯{ÍÖŽîˆ1<‰˜Pr›E‡¤º=ØE‘×UÇÒ9ÐnUéöÛ•ÙöîK‚»EÁ¤»¾I$E@êööÔé…ÊÀèèëpÙ;†’òˆ¹U>Vý]1%(:'<†Œ|è"äg¼|ЯËò£G«Tômc×Y¢ÁB¬IPee‰ ©cÐÞZ"^µ¼ ”úTÚiuplÛrSW¨ØAÊÁ9ö ð© ŽØ·_‘©ô}KfZ«ñn<0Xeo]ì,ÊíL Î'ùwmKà¾íJ¿Ú Z‹‘H[3 Ñ[»yª.¿KSrÈ4´×/¸‹µ°2_]Åçúff›užF`p K£Ü,O¸)˜`$xÙ¹õ7þ\¼*šÁ„¢®Û‡ÉŒÇÇÇ(ø;?gîçºBéFôª{q¦]°mê)?ÂÈéU¬E‰lzŽKŠŠÒ1Ô‹Á‡±‘nG÷¶ZË„œTkqþßk6v6Ù†žÛª”v#ö#Ûq7§ 8X8¹sB ЫX(Æv7o–‘t zz—ÅÍVËÄ ˆÆÞ“N…û+õŽÜPÓÊ -K²x­ÅÙ•Ü ð8E0›«ëÂ9¥ó÷CÙýmWö=¯(#À ZÃX¥×bèÃ6êðúõŒæp«'nûDÇ®hnKZC †.š ;shç¤"4ù~ÿ)é'8ÞÊïã·-#BÞPž@Üm5¿i‡™¥`¥§à¤Œ„DB¨ç½…u5Ô@ú|ðXûªŒŸR9¡Ý1Њ+Î ƒC²™\)УMh°œGFO"bŽðXNž|Ëc>2²R&lè¶ñ:X L%Èô׈Àqε1Î áÆi]iFó'ÆéMécÿ8§xQŠÍ†MCoûŒìsØ9“ÀI„öäž‚¤£‡v3²‰ÞõmM&…­Jí”d2Ý kjx¼cmä$#ÜslRújy‡N›‚h‡òìzV>•XF9†"ËÁ …‡P±s†ƒÙ ‘IÒ¬!¬{Aš3¥©yV˜UM‰¾wSùdgËѠ“hVƒ曨ÀÔ@ûÁéVßž»&Z>¬%o6ÖH•“ŠÖ›mŽ!Ã(¶h§-‡zÆ~¨P*kîxÿ†â?zÄtÆ®Íـќ#ÐiBšÄZØ/Èášv¥rb´±”(N%9ˆêµdÇ€ß×UÒ%‰xs‹Pç[öå°sé)â5Üûê##w”¶RµÍÍ'Ç,Ñ>ÐA)¯šËlŒ‰¤r¦V¨|Þ£]g 9Àbõ*ã&WÀ÷ó$[@j ×7¶\–ÊH‹dbѦ¶Ö™³•Zç¤Êöxî"ᦳqaS¹š(…]Ylœz!€BÀé[+ù;Ë%Kvgãc¼­n«nùUÏFÁ4WJh»»>ša/ýœæbL>O/ÝdQ–ª°Öø\”œX^ÎDɹ ƒ86f>tGwD¤ƒlo.& 6#>Mprö$8TpwRHCÎljµ Ô…±’1ptªÇc £­¶ìX -þÔd/„M΄bNzˆê¬•øËe‹0t´ŒaŠq ŠtAé:îsÙ¯µ±èµKä…ñº*‚L&Üd».—¶È t¬aÇÕÂNÙLj«Õ“0 a KºµÆªä5Ub☶¿ãeÄØ8ç‹©"ÕéÚb»aŸnçNâRmËæå0°FX •¸»j6m×ÆwNX?ÖcNŒÓ’ü™: -ŽŒ|’ÙР޼¡j0çŸvùxÃκüÈ|$ï§{>çÏk¼ý÷ƒ›37á$¥ûŒ>û: o­¤\þà¥;p`1 l5‘ñRU‰¹vçê#<Õٰíï1?³gMbìŠ~\gäUa§†Kòá,DÚó)ùLREiæ"ẽšýõödß3år!d¤„\ˆ¬Öük›CY83ek QºNÜ:¸±>ÝLéH¨÷bŒ—·²ò`«Orâ63D¾yR;EÿÝp-Ô%wTˆ„IkD|Í8¯±}ùwdù»O+QìðíóÓÓ£¨TGF¦ÁY~ãa ’éü³€ŠrÊn¾`  <Ž›—ïMe"JG’I—.PoèÌ')RB²¤ÿO'L¿ð„ZBZ™ˆ—O¨e¥#ÉüŒ·6‰Xº'âwïl{{¨­hÜ–ƒ `rØôp.l•YLN¦9©c…cèkpl,Lc/°C|ÎcŸ3æ*ÑåtîlÉu¾¸Ç¯5Øj&Õ}U–2.¡Ç8Wߪ|†ÃQmmg<*™å/>"Ö‘VÙïŠ| ¨ðqiu3Yz…Lp! `P‚°rŸ{î=VÊdžñ«†*†)žÌùX?V¶.¾I4„k2ô0&dÉÓ¸A\êÎ äÖö=´ñÑ S4_tQÛ{Æœ„è4*Tý“JÆYâz( ¾}j_UÌ4¥càÞUîža+»@ EbˆýéS-¦÷˜õüÒ Qß+¦{CácçXŒ›Qoæé Á\0ŒƒÂ¦<1ňG‘yS‚ˆÓÀ÷Á—Êkqâ¿>ƒŒ=”n„ž0cû4> - ¡àѶ)×¾ÊÑرÞÏ©îÆv…mó“ŽS»7èÙå–ò‡!Ó«ñBÚÏDIœ ÿïÈ)bÒÎ -ƒçvÏ-Î^òß {1ÿ„å>"½àÁ-Ògžuá/mç|ø‹»9'ìÖVjg®Ä›‘ôÄrH±Âù`ÌUîpê=#8wŽí D|óþò݇+¼úë+ï °ßï¨TÛÅý£ú„†ø맞ÛàNÀžV,rá"N”røÒ+x®ƒW|茖{Vˆ¹Åëlêªlœtå69hoVc`žÚçolŸÎþÈ¿ÛÂfÕ;ݦÞhöWT/·3òø.ÑÛJ¢±•6ÃÊL¡C9IE½3™Ì -Š©Ø¹míÌñY=)ú[”1.ÄìoxàŠÍ-¹N¸ÀÅ-ÓOÏ´mÇÌ®„¼„¶U—~|N“pI¿V7Þ~øÌhÖõhRÔÍ “… Šà[œ¦@2O8Hp,B¼gj®’™d×v.,ág¢4|&bø¾/Îÿ8OÅ‘ÌçTþø~¾èw{þ·ˆZE™ÊçõÞ@T)…£ù¡’ø)½Fe`Ô)ÁÿGeáendstream +xÚ­ZÝÛ6ß¿ÂÈ“ ÄZQ¤¾¸‡$͵é¥Å]â;àÐökË»BdÉ‘äìîóE‰²½Û  ¬(j83ÎÇoè¨EÿÔ"OÂH‹,W¡ÎóÅf-náËWJ(VB²òh^¯¯®ÿ‘¤ …ET,Ö»‰OšD/ÖÛß‚7?½ú×úí‡åJkh.WY–ëŸÞòÌÇ¥ +^ýòú¾ ~ ïo–+üóý;ü¶^þ±þùêízTdB ÔâóÕoD‹-hüóUê"_ÜÃ8 +|Þ_ab´¼×W¯þ=²âofÁ«.mÚÄig0ˆ&6.Nç:Œu|Q\F„y“<ɆEÀ†GB=ç²R*µŠ«M Šñ$R³P*,’OB©,L‹x‘™ ˆ ů-t@ã–§VÉ£8TyŠ<Ÿ*ŒLQh¦ñƤÿ´-š¸~·W‹ZÐt1S–ù®<Ƥ¬Ê=·QI&[d* 3ÃÊþÒ.WqlË®ßHãà}Õ€úÇ|ÓÁÆU{:Þ‡ªE‚ž¿WM?غæ¥Õxmî,’6ýuupxS—B~³„ïºÜáÇc=€³&:Öw•Ç¸GÛáa*ôž‚”µìÌ›víÛ†ßȵkoê%š¿°›w0a&Â]àd»JY×~!jÜXÍfh?!+šÅ‡§çgŠ|%]x>ñ×=Lçq˜k³Xá²âÛœ~gAšžI–<›ZÒ$7H&I<)òPGƒV×gfPQæI¾ð8Is4Ï‹sQæËûpÄóÉ28¿àQx í~o›-éù”á¬nØåê +/X½ççk¤{÷#åGÈJ©à¿˜ù>ðWòx’Ÿ¨"8°©X 3o‘ñ:)Ðþo™ƒã=5pq{¬E³[rQÃò£ž‚Hï|çNÄ·AÊ—e’¶ª­óeôØQŠíJqâ»AòO¡ãÇ» £w; 1f¨û‘_&µ «eÄÍÑù»¶ã™=Mõ$Ðâm +ˆ6¶¬¥Ä@nùËh7Ëö€™OñâµÝ2ëƒe¶÷¤U‡ÑõbÎì~Añéwƒ»¿©yŽl±Œ30Eëy¢(+ðØ”‰ãÀ6ü¬šMÛuNÖfÀeÍcßùM˜Ä˜{‘Ç]Û ²É“ÀÖ¸rd©{^7óâju¦dÝË Œ³0Ï㉯«Â~ ¾ œ/qÖ°2—•pL笕 µN…âË25¢mµEæipDie×_fž&F–Ötn%Ú +Ó:ÛÌú }è÷hw<ŽübÏ—ðÁ$¢$µ(!¦þid¡ÒàöXºX0* 솣›OBç1`ðÙ´¯ƒØ “À­A0¦E¼¹+7¨Ï'&½gÇp¼Ó™`Í£;üþ+eûª¹åáPŽ~°Ý^ÖC>: 䡤ꄵ0³Xª›äºPr:þØr°s­Á€' çóó…Ò®SsÑy "T}‘ãS¾…q¢ŸñÍ4LÓtîóÈ÷§LòP¥ñŸ°Ìæ.YqM%ÖǾì¨Ò_Œ¤$ÕÏú»s8ŠŠtd¢‰0Ïy}¦ÂQ¹ÑéA›PJ|åç)UÅ^f‚J2¥TE^‡ìNȳ)iLh‰(ºrwdx·L>f£ž‘“CVœU`ž —DørZ·üwìZ“î­C]ðBá„”¼L¸uœßo!¸ŒÎÎ6}že«QÝâ²à±‘Õ Ïf|ÊV0†¶œ>èËl“81š_h¤öÆbÎÁ(¹ Uƒ/ßY‘û{¤ *dTÁ²ùl¨ÞÉÙ ÎXϱ[Š"Úñ™ü§6yÁhÙ²AX.³ðºµ%#Õ”Œ(oçjîh¬0r ºÂ³;’g!Jnn_"”H1qp\}%ϱfƒ‚M9Ü ³–¶·¢¿½èçÒ×L°Æ’]·yÁÐL®`ý*Èe°ƒ$¸Ñ÷'x¡bYé+{Ž5!H yª¾¹7,ô³lN»P?Õ‚Ižï ÉC@_ÙBš¸øþm¡Çøé¶*&Àn ?¶ˆ1“þ‡²Â¿\s‡ÏS&ûG>D.m½$à)“Q +Ž£™Ä(̳B’ðC~°•Lí+¦‡O0 ìCm]0‹†Œ¦OD@?‘¥ÓÚËb舔«}ð SŒô‰ù(‚êC ¨I+=s{ß&/(5qC¹9’Qʆa®&σÝR@@Çï”×q@hÆû³Îa(Hee‹I*ϦH‡®­yÖe=\÷3IKÊæ»™GïÁ"醊¤ã ÖVtÄàôw‰!]íu9nO*¶Õ;~Rªqm7œ²ºGMx㟄ë‘k_)R¶vìâÛæÉ\﯇ðwm¾½|©ç{]m¢0ŠÓ YèÄCr9ðÀò£÷Ú2ç +8?‡Ï3d‹ŸðÔ¡$ ¯sòÆ2…¾Á/ãíGÇdg ya•-y|ï~!’xÜ]%ZõŒDz~{áziw£E« ÉèœõhwΙlçvRˆ³„m2ÞK^~¤†¥«ÊfK`âOKQÖˆYzf-§Î}Ž{ìEžwjç])kä: îìŸê|¼Â:é $GXªÑ-Ú€˜–¦‡ŸÙ H=™Ž£€ÚzÅ@)«}UÛŽ_vá ¥ÅžÝžÁªûŠNšiw +¨è˜y}ŽU¾ðLKñò¤WDËm TÁ«ºo/lø2r1itÒ&…çr˜ëny’Òž´¯°è÷(‰<»¸V¦ÓïZáÖ?ÊåÆ¿ûw"=OÝ;7‚˜¡‰A"í@W2{ép0¥QÉn^©l—®6·•L ¥V¥+§>ïGãt'C–÷(W£Óýeyèåâsu{Ë3#f„±\|º6§Ð˜#Ð&4~¨F(<¿xâ-¬ïÊŽwŒ7U2À‡„ÀÑóRºœQŠ«™ß Ù¾mzž£ÊÕñøžî†ÅMhå…§Çf‡¸ú鋧Z¼-7es-™Ža0WjêÛ>Ë~Ú°wfë;9ˆ}Ëy×`\ïÅAçµ’æØÚaõœ2zxíß´ÍtÈ­ÔÅýؾ¸~™•¹][óe6eG?ý™Y¦îKCóì.—;TÏûþFÛNÂ"ÃŽ8 U¢f°h;•ºÂ É¿³n¯Þ¿¿`7o±éë­|xxÀK&x„ˆ4áñ@ÏëÇÇ ©iÄ¥+Rd£eg7~(‘qÝ}ŒH£JTr\®¼ÝæR¥ñ4£ÂeAˆvÎjí”î1å*€9­ÔµÃ]tãi›,½£ö^I¡úS{»uy_îOìFÛÂË ´¢ºéD„´}‘—Äè·äˆÔW!;TR³Þ—LÜÙ¸(©&·˜lºƒ—ÑÛ\#`à·,#õHæø1kkÞ‚»ù«üîX¶â´m& ùÄïý: +ùšàô÷¼h!ü¦ÿ +0þi )ÓÅå>)‰ã0VN<0å§ú&:“\Ÿ+üôÜöendstream endobj -6436 0 obj << +6908 0 obj << /Type /Page -/Contents 6437 0 R -/Resources 6435 0 R +/Contents 6909 0 R +/Resources 6907 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6406 0 R +/Parent 6879 0 R >> endobj -6438 0 obj << -/D [6436 0 R /XYZ 85.039 781.388 null] ->> endobj -6439 0 obj << -/D [6436 0 R /XYZ 85.039 210.005 null] +6910 0 obj << +/D [6908 0 R /XYZ 85.039 781.388 null] >> endobj -6440 0 obj << -/D [6436 0 R /XYZ 85.039 117.585 null] +6911 0 obj << +/D [6908 0 R /XYZ 85.039 675.066 null] >> endobj -6435 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R >> -/XObject << /Im1 3957 0 R >> +6907 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F58 3360 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6443 0 obj << -/Length 3989 +6914 0 obj << +/Length 3150 /Filter /FlateDecode >> stream -xÚ¥kã¶ñûþ -ã€âä"ÖJ$õ -йË%Ù´I®wn"Í­-ÛêÙ–#É{ÙßyQ¢lY¤8,L‘CÎp8oòÂYÿÂYùÎfIú:Mg«Ã]0ÛÂÈ·w¡@,dáÀ¼YÞÝ›YøYÍ–›~È7‘ž-×?{o¿ûêýò݇ùBkíiíÏI’zËïÞqÏÇyè}õÛ¯ðËð;ø~;_„Þßþþ€cËù/ËïïÞ-;B:€4C*~½ûù—`¶Š¿¿ |¥³ÏÐü†w@†-ßû»wÿè–â13ãYc›6*öU øijFaÂPù:TÀ™(ð£Àtœ #‡3¡ŠüØÄ3 „¬‰ýËÍ…Úø¡ž9+]£c°éÌÒh€íÃù8_“yíøZ@; -¼²º:ò㚇¹J½Ç}5_¨Ä«>OÜ¿qÅó^ÿù5ÌÆÕʆ»Ûò Æe¤×Òhëg>n-!Òßä\É‚7ÈØ-ìÎ'#ê;¢Mà YOeuF´*œßâ–ãÅñú¹„9„>K*sîŸG\·Ê׫¼ieb%¿ö57Coü¼·Xq&ôGqë=äë5QNÄ6¨ aâäe¼#òë ÃÀÿ(Aǫ þjïGêlß<üô‘îùgùöýýÃ{n#±s¤‘ÙGþeŽ#º¢E„ŸYUü'îoì‰Vçýš»j»ß…»¥ˆvÔ€tÀ2°|è­¿ø¸¾‡vWáf¶;Ðë ´F¥Æ³'u9ε©@æ†ø²*ž9ðNQì'*’‰Õ‰ -Œ\Xhú€Ó52å‘×ÐCêÇQ&k4‡GU7#¸LÑJ,p$z°_pwdnÉTѱC'»B©ÿ¡ÙÒY<$§_óšY­b<ì^‰Ã_à@záGp -¹Wlí„ö7Ÿü‡ ï:V~`¢88Áμç°H§ÖBcËÝ|àµ(6÷××d÷ñ·Ó5˜ß;ÛnÜë#º.dš•zúø\’A†V·‰BÈ ¾Âï¹"1B½x£Aì9|ŠA€_ÞLË0Î -Ûü õȃ÷i’¬Ôîò–[ä;¨GPïß -xsÆ•aßþ’­ò‚2ý³µÓ°õëýÕªóG‘"ko“8”þíÏRÅê’åp`+ò‰¿HZòÚÈÐð…‘¡>U³I¬%ºîØ´j}Thð(øPl@bF­Šóå»K Úùüt!®!d³ŠÛbÙƒÃëhV"ã(1¾Ž_ˆž ÛѳBB“[Ñó$:‰ž§±Iôìb£èY©C(va3‹è£²v–C2¬tû²w[0Ò2èýý›‡o?bºóa†¡÷¯wî—? žû ÐÅ´p_(²ÈŽ'ÄŽ.`DÊ(>®§ôóú€7†”…$øsÊÙxQÄ^Õk ob -o û€¹ôÐuî.ûºÚ—Kò -aá—ƒPŒW,¡çyÏèÌÕýºûj»ÝS)ÓÉáÕë;¶Ïx@åoìÕ˜Q$¹¿ñ0ø9´5Ž?l®§]!~ä‰H[< j«1T:Ó”ò£›æÐ\‚tÔï‰Hc¸+üÛ-Ñr«ê̾›CH+K&8 „õ0XP¾=t(4Ò/?L -ap_v&Ùµ·_‚¨@vÔ89Ëj_²­ë=Üß?¢.l‡në¾=œØÄð¾þ‹Ç¸#­’ôZÑEAƒÈWʼ\ЬŒ¯TÛ€áÖ*4'€U¸…ÀÑå" KÒ„ÙÀ²$ -ì Ÿa,–Å?‹#ˆJÀá'\ ù±âØ8Ù§7±¯!>€5g¿ÎBˆ²L3ŒÓ&úû]QÇýÃ!œ}]¥3—XYwá,Ìf0uÍ x‰™8†¦õ茓„BNü•ä«iÊÇ}Á](jøë$-ì|Êͳ@ìô”[Òp"ŠòP³5Åñ|OáØ–¿ØcL'ñú˜Û¬ÐDa„õúÅ|½Úï+N|+Èoj­Û}ÉoËP\·°â“èoè¨Ê¶"ˆÂE Cï¿,®cYȺêYð'–ûUÍàåi›$ô#`½#A\µ¡ÕXtÅ­?®!®p§ 8ñ´Û4H—æíÿt´áKÁÙ¬R&ž“sX‰Ý}´š’/Ë]©mô{±Ö O ‰ky $¯3äËûB²‡ÐÝR⇩¿Ž¤½$MC8 ¦BAÌ©õ%¹ÂUÇ×s‘ƒlxêjÔæ³›ØÛ|–?1ÊUV£T‚Æ”H¨¹û`ë!À¼|kÍ7z)$ !Ê–ç5\iø‹½éÓ<‚@›‚—5C‹FBp—Qàì+¢m!âs~B¼êlÞý7±›Y5èUËA©]è½9ÝÈØD7aËJ*S#Q0Å꙲ –8ñ³<òo­d 3qj~GÚ JÚÜØ'v#†–iCv£2Î}”æ-K(g`Âóöå'r²”äj¬±ùl$ß±åË[NVGŸu#œÃà“úFën%ª…bÆp…2J1:ŸÄÈ / Œõ€t'Ÿ†mƒX#×è ºJV„„’-ë°ëÚú¬¥8ƒ˜E¡ªá‚MÕ%ÕðQ_!ס0?7¶êDÌ?7hU,`#"+×R{»ö-«ÞÖ”û‚Ô–=µ“ÚŸ¤vH…O  ½ª¸£´Sˆn}S0”†¤Ì¼ =И`$~ª’n%*ÛM ÆF+“­`8‡ê>,q?M¬ušCzµS<“®ÞQ“<\€|y¬e*‰¾¦”·%Ù~á¸(bÙ9Jòpµ˜ª›¼LA½ÀûhŒ÷]¤Y ¢sŠ÷S-ï'ZÞ;{¥4jD)¡3çtÈáD\‘ÿ¦«‹¨&U봔ƹìf”‹ŒgÞ×-µm£úŽœÊÇ=2å˜ÚK)ÉÒ  Â£¾keƒ¶Î5°ÎR–Ðb?"D*õu'nÕ 'e–ú;‚©Ä }ű¯8ÃçÞ©þïoI”J•Ÿeñ´D9@·µÙQø;!Q“E¢¦ŠD¹ož8Ç$M»Cjw¬ÂsÞʇM@»ÜW´ô:(ÐÚ.ÿ®R´„)½vî!0@3Æ{»+è.ì“X 9l®É“éî §¼>Ücë$?Ü+."ap»GÛ«l~™øÙtQÞ2*u/¢3–^Ü"~Ë -)³@Àœ^­«†['¼©@ûûÊÂKå³0¬6C_O0t:*ŠŸr[Ϭ¬:|ÄÁ­j3ö0§¯w”û.òӱƜ°¿eÄ.Å‘{,AØÑ[ü>¦Ä/Jû W.˜Æ…©˜#[øéo„¥¶’rmÅŽñ“Xw7{8@¥Ì3E·1×{ð·{UÂѲ<ŸÞnQ×4%Ì.žT@GOÎ#¹HÜ´ -†U„“ëÇjO¾“]i˜±ÕÁeˆRh8/ŒÊãÖççTrÝjáaýsã\ÆC?Gö½[s÷£}7⣭›7²û‚òٰφû°ŒÚšoÙЕ.I´¤ê“zÕ'ô0ÂñWàšÉï\ÈO€€®í -G™À†\.\°±©h{}ñ¹”Ò6b%a°49)àÅÕƒ«cQ¬ÝÄÈ© 6â2*'fµ>H¡2ÃÍBO,ÞSLÆŠÐíBz©Ð3‰QbÅi„+º1ÓÆDñ|9èÁs7»¶%¦ŸÞeå·˜£ß/¤GÐíôȽTì˜Äh™3‰Ð2ÇAˆw‹ôºÎ}GZðÅÝåë¥îñòÞ`ß÷0þñõ'äZø)]Õ?©,†¾Ilò6žŒ–‚í¦VÖnŽÄ•±ŸXŸ×]ß&x}«¥jË*˜*â-Äe%©¯‚aÎvþ¸rÓûz’©–æ¬Ù<Á•¤÷oý[¢’A>¤Ó’ÒÃÜθæ¥ÂÌ:“Il"%6L°:ài¹uQ©föµ"@Œ9 `&g¯¡ýãGî/e¼ã'Œçëî\Ö<*—et]Å úI"£ìò•ä ùéß³Â»Í ›>«æ¶R ÌK%)trV“Øä¬l¬ÐºSP|3© Út«óª C6V¾Æ!´¢ûÞ› -qf†ã\ÿÆË|øjt‹ðÇZø=Úïþ#‚Ñ~ªo0*RÊW¡¥ùñÑ%½‘Æ S_ü?rP„yendstream +xÚÍÉrÛFö®¯àœ N™VÈMR<‰2¶£‘˜©šJrh ‰0X,ûïçmÝH9ä2år±—×ý–~;äÎøçÎâÐvüdÅ®íÇñls¸qf;Øùáƈ…€,0÷«›Û„Ë™ë؉“ÌVÛþžÐB¶Jµ~¼{Z}xž/|ß·|ßž/¢(¶V?~à•—¹kÝ}º¿ÃYÀ`þ0_¸Ö??>âÞjþû꧛+CˆAH¤â›_wf)PüÓcûI<{ƒ±c»°}¸2ì0ðe^ܼÜüË\Å{ÁŒOM1ú±Æþ9×n8àÚu=Ûw½Y:vèÄv5ÈEU]›Wå|øŽUÕü»Õƒ¢š/¼ØÚ¨ç.ž«ºz“ñlCw”pG™Ñ¸Íç¸Ð ýÈúÍ ÏU›}7_,ýÄj÷rn Py™2Š¼œ†–2¼¢ÞÂHÑmH#‚WeñaªÆÝí¶YÒQ,\”TBœ¥ÙoŽlò¬ÜÀ!ßK¬·}Vg<Ì[ü­7¼i- +Þ@ª–Ǫ@©Ts/B8\ÙTe©éÛ´\«A•pˆîŠ¡ˆ=Ð"«:®Àö*÷¦›‚åè[Žx„€5Éx9€­¯YÊ› ¿á™º¶æÛ‹l'a¾ïÊ +i^áLÈÛø´4W]ƒ×G¡Umñׂ5Sz§“pŸâ'°ºª^Êåw¯îKŽDíx©©äeö(ÛRVUQk<$‚o¼\wS’*$Óê[GfµOìúÉ{Œ#«é6øL{¦^e‘õ +ç× +§KÒÂu0Ñ’Úó6!I&—…ÓBWÏÁÒÚ"%ÈîçFZ9¬ðëƒøF¼UÕüËÖv@Éy-­"EJ2¾ø{D¹Ë[U¼k&¸~BPo†*\Wõ+SíZhoNh=ì3’(\à9 h”bWóŒÊÚÔmÞò’èYfé¹ZÁø3Þoëoš\Ü]ÇaÓªºe æ€(ùlÊKø¥xšªì`<¼\xd‰¸GjªÊ ~Y½ˆ…»•ºîÝ!êžëXOE¦H.pDŒRƒˆÄ;Ú½jE™ör-è¤xViÚ• Õ[µ¸G¼ëi‚Õ;ᄨoøoY2÷ç¬ÃæÝ)ë$CÚzAã?}l}RÍ+Î%„oÁokáÐå›ÁyŪiöQï£pºWS&¿AËE…8NÐvÐÖL „Èñ4/Ͳ¶””ŽMwÐô‹Ì¾¾„Q`ûËàj¦5€9Ï9’ØGnîAf‚3d®³´ã0¾ŠMÃ\G§Sœ!¾ç¤áy" ÏëC"=. DãêT§zE82Àâžïñäã˜ñA®èº®õoÌŸO9òýÈÃ`ÈÑõüÏ·½h:ûóíÄ‹`ô®Xøk±û'ÂóƒÀŽD£ð^î>ÄöÝ“ Vÿ¿ð'Àcôg<&ž-G,‚ß +œØúÏ<†Ä£ãw&cBÇUuûW\Ýi_0Ò&ñG´¨Æ.-tɱÁ´Ç^Y–Dæ9…ª3”ÑCŵF“Õ_L ¨5§ÆáÇ)`L·?âíKÏÜN“”â»–g-E•'I,é$h‰žd3rò˜€H©SŽ–ÓdÚGæm̯¼a +2$…YÀ‹ÇYˆF;E9'bÓòñ-…³Ã„¯Dð콤µv‡ªÕ£¹8Ë€²’J&å´þyNŠ9‡Zr§yÃA|ÑVüÛ¥ì8p<Ê`iÅ×0‘•ü,±ÆK ³ß$yœŽ­#¥ë³'/æ”á(ÏG–p¼ +훀ˆxûÝx”ü¦GVÕ—1„Z•ï˜V<×*—IÑ4–ø´ Ó5‚ÜU•WžÇ°œ¢“#Z€SŽF H“a•NÑãÀDÿrtÃp«Lðãe|Mˆ²M§ä­(þ©ÊlQè$Éi |~lùÑÄQ‰¼ˆ¾S +jJÙ÷\Àž3}Z®Š– UªîH½’öÕÀŽª ´²é€ø±GÞÕ€=€¹°5 R^ Ø×°™€}ØC|ÆÞWKØèJÊ;}Ìæ*]bö‘w1`ã±;|jÔ||ÄHýyÅëïþþŽÁíûìiwäöÍ.kùD¯¸žõôÐðàñ‰¥¤7e´l¯ÅIë;Q Òngèí`’Rç„ü´cü´3Àïø¬ØÈv.^»¼ÕTÛ¾x§„W+} uxí‰[X8Ìmõ4# G¿Né%æ³&@¸DÿêÄì_,o´OÔäK„ ÷g"Dê\$½(ÀvU{’Ç–ê ^[GС'zàµ7mÇU¹»£D”ã#p£±ÃO@ +•9‚3R-T…Êxà >…âñ÷xÑ ËëÁˆ{.°mè…1iO”œf ´Ç½íb`aSäâ²ùP^jý…ŠS{jY }‡ì€M{Ƀ`èx×›«˜‹Dà ÎåEr ›ñ WÑi2Ä÷ÜéHë;hÇ؃øœùœ¤üX¸Kä^ˆcöøƹ&­¨¨÷“„0冒„ PÆl‡Õ÷RhE?ŒéaXÃñPsq¬³/9¥QzS^gÅubÅ×qæþ%—4ÁùgªM0Ä)ÓÑÊ ƒ4Û*Ä]´<_“õ©T"³¬ŽõC|ˆFH{¤ÚݸDíSÞXì=²>s ¼üù…7nùgõðtKöcòàŒ¸‘Ó¥&X{‹ä¤ß0ÇŽÊ™±4{S@µÓçͱoĦèÏ’ÈREË¡c‡mHðŽÃö#L9}’ì JropíFµ¦}Ôw¦ñ ¿âBÝq£{ã¸Eî` ¤×­¬åY̧^“²YêÕAØ×A¨õ§Ñ×½!±)ã¡¥XÑݲ¼Íô¹¾V‡Aƒâ.«¥‹!ê '{¾øäA”Eqí%‰“Îþ¥@ÔGø}oªÀ¥xË>± ¨%bü>!ÓAw†!„T¼Ø°ÅÓUóšð£­TdrÃÑèYaÕ æûG£s_FR©¦;žD^>k¿ûŽúWèÜpÐ#ÆÙd·Ðw—“‰Ž‹Dֽ껨g T×V¨16 wè{Ê~™ðê˜çcɧ¸WŠ#Ážññ>;€­±nž™nö•M%«MõÓÇOßµÞòv/ŸnŒSàTZŽ:‰àΣè`Ê¿”ùüÕŠ–LtE‹7W¼)µYG¨„ÆfU)}÷5‹qí¤àrŠ7]çû‰×œr¹¾Õ»¬eÔ\n螸!t–8h5ãrcÄ3nN@ͤêl”4â~©œ’ziéôŒ®Y;(øä:Ú?=ì¾åä"a¹Ì$­äû+ÞçlkÐJÇ1—pÉ‘^ïRTóuow”zL«¸ “€e}[_ÏM§¬Þtk.Ù§šœfPßÜÄ{ìŽ>_âö‘ˆ\«µèÑ n¦ojôÈÔï×Èy:ø€o¨iŸ…Î4Œ¿œ±Ï_ ´¯ó8Ðá€R;U áǹçl›ÕÃ^J`­>ð×ušø¦ïm°É˜¼7è£ùB:‘庎c»5ËÀ\Ìr5 ²]Ìr¯a3YîUt:Ëâã,w¹]FãÆ6îœ~åpàööþñ‡nas7ûùvõé‰ÛxЗÇ0Ál+5hKÞè?Z/cÑÁÑ?NÀ®þ:†cui$ ÓýÃÀ"^ž"fó^F½%Á¯Anù«u- dsH«.† Ë©3¾žaMÇ¥¤ÏMáv·3nör.¸+!bp5]™e°R~Ðx +@Ì/$Þ’ëõDÀ„Ä¢Ly !Å”Îä¸*±,––RÕò×Ø^«Î0Éù¡dŠRÆ)ãâsèD@ã@†Q0&gw¥Õç– é©/”Œp¬ºÔc5@ÈJ³Ýw8®k4»½]结ž¹kݶ]ÖáÒ/ÿE)í‰ð]¨†ÛK¦ìþ3§éO{=9;ö“iÛ=Ïö\M }Bs’SzõŸü?þîendstream endobj -6442 0 obj << +6913 0 obj << /Type /Page -/Contents 6443 0 R -/Resources 6441 0 R +/Contents 6914 0 R +/Resources 6912 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6457 0 R +/Parent 6920 0 R >> endobj -6444 0 obj << -/D [6442 0 R /XYZ 85.039 781.388 null] +6915 0 obj << +/D [6913 0 R /XYZ 85.039 781.388 null] >> endobj -6445 0 obj << -/D [6442 0 R /XYZ 85.039 761.463 null] +6916 0 obj << +/D [6913 0 R /XYZ 85.039 599.342 null] >> endobj -6446 0 obj << -/D [6442 0 R /XYZ 85.039 585.186 null] +6917 0 obj << +/D [6913 0 R /XYZ 85.039 463.85 null] >> endobj -6447 0 obj << -/D [6442 0 R /XYZ 85.039 362.17 null] +6918 0 obj << +/D [6913 0 R /XYZ 85.039 371.126 null] >> endobj -6448 0 obj << -/D [6442 0 R /XYZ 85.039 335.072 null] +6919 0 obj << +/D [6913 0 R /XYZ 85.039 124.514 null] >> endobj -6449 0 obj << -/D [6442 0 R /XYZ 85.039 320.917 null] +6912 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6450 0 obj << -/D [6442 0 R /XYZ 85.039 294.424 null] +6923 0 obj << +/Length 2630 +/Filter /FlateDecode +>> +stream +xÚ¥koãÆñ»q@ +¨h.—Ï|(pvœ‹Ó6¹Þ©Š$(‘²XS¤BRçó¿Ï¼–K¢€çƒÈÝÙ™ÙyÏPY.üSV8®N¬(VŽŽck³¿q­'Øùp£b) ËÌÝêæöû ´”ë$nb­¶žÀñm­²_ìûÞ\=|Z,µÖ¶ÖÎbE±½úáW>/”ýþŸwïñÍàx¿_,•ý÷<âÞjñÛêÇ›‡UÏHOˆ&ÈÅï7¿üæZpüãëè$¶^àÙulïo€ 'ðµ¼—7ŸoþÕ£â=ßâSç.í{¡ãEø8±_'§cíxÚ;KÎ!º\DC‡\@ÃO=ŲTÊs´ò¬e€”UÐk"ô-¥œ$PJEN˜xVäyŽÊUüTƒ@;nþVª<ŒB'Œâ´~·”ãúI¢fôLü×¢…Ûǽ²¾«SkÂ,ã]Ž³*™ +B'ñ#+L\'öCböõÂÈ.ZüíüDvݶȱ†›”9ït5CÒƒåø¸)¶¯¼Óír~8¤mû²@< /¶›ŒWSDVWOüöRt;9†Xv :¶yS!ðžeȇ…¿-¬×eIˆ_p¿ý…ŒZW`f]ª¥“kâqƒe‘W{Âííºx +_ˆùÐÝv{¹î/ÿý?$±«2ü1_ó/-߶ɻ·Zõ“,(´F–òÿÛŽ='Ö¾µÄcÉŸs…©»*ì"Û…@…^䀟¢®àö‘¿ÖÊ~E×G|qY ®tyÃK¤{DÝãö @Ýãöäxk^KÙ"”Ý\ GÐàå}û½›²1ÅÑMÛ¿1ÄôRžã&¾Pϵ¨è@xô}m?nÏ\.«ñîßt¼Õ‰aâ}i»d›¨Ÿù5%k°À6Á¢ˆ­Ðç@`ÎjíÙ½µ5uØ÷´ÄÂJŸrbÉïY*"ÏnSdïµå·äžØ_A`§%¨À.É'Ðí㬧{aÄZM/EØ™³/ˆjÓ-H8cqkOe‡"Íwä±ûùŒ²ß‘¾öœÄ€­pR‹L‰ ñØäôÜ•¯,EøŽŽÂ‰™Áî¸è]´¨øWÔÖð›1e;›ºÂ8á˜Èví‚ÛP¼Û + (Ü0)»åܸN3ÞACII;í TÙ3¢Ô#Qúež‘£nC{t·ôȸJ(¤Mþíib` üФ®“,Ù;óèŒ3ƒªT¨zLxéôW7P'$5dÐò,I¹BR‡æ‘äàRahïÈ‚¿,8–jL"»”ã+‡q-Ic8X%°Ü»ä5€Š@ê½ ©÷”ý‹Z3g_Û.§@@2¡õõQœ ž³ WßÈëfE)DÁüFÇXéñ ©³Ë¢LÕôö²gåÛ5ÖŠG²‹ÖàBB¹P3 Ö0³’bÐcBV׳Ö0G²·†Y’ÆF$§ž +Á+„àU þtlûø(NÂ1#ñ¯®òŸPCMÚµˆ¯ ‹>UÕMc¬aÓ]’©Å&±^–é輇EaÔc næd:KÒÈtž¤ÈtLrð° zëaA Õmù¢´¾’\2^ݤ­€I×°ŸVò0%‚¾5¦ƒIQR% Ê«”ëE9Ëii\òI* #,y©>žO},ÏJYñÈNñ´ãµ¼ªÑFÌëí%SБÞS€.»—B.³YS˜#Ù›Â,Ic +#’ã$tH;#”O%Ëh&ôpöѬ9Sr]qÆ(C³;Iyr¿ƒŒ *|žfQ.æ)Ò儾#7û‹¢‡ …к΋~šñBB9ä³¢Ÿ#Ù‹~–¤ýˆä¨tÔƒW»RFô.´1ÑïõСÖL˜ë3<3¼îS©†Žˆ ø*â¯G:NYÉé4ƶ¢ÊOÇJ +ëñ§ÕR»_S/ü^`/SþåmŸŸ)üÌyöXGŠc‚uÒ\@×< +ö•„&ŽgRFèvG®^ÊÞÚôh¸—®K> +:",5¯ÓåÍÚnBv¿‡h×òUBoÜcà ¤ï1²¢áSOPhÓÃáØ@è;‘'gòŽH€ÀÃȵWTišÎù”´4^bÈíòòÀÂó]hu’iM e vŒÓ§,@¯¶X‚x„‹ªíš£¼XÙ‚çÚÿ]Ä>É× &òÅ×|ÜðÓႬrqŸâA_†mPSϼCa ƒ6¿äüîë#÷Žü^o™ÁmŸ¼0+Lå,øÚCºÉY(|ÅI¶ãbÒ¦Ž€¢À؇ª¾tŸ¸.5O3ÊQЙ@ÈÙ–™2‚w.LÔ¼( ú|nø7‚9B ”‘îñ ­ø„˜rC +hsÔ Ì<9ÇôÀÁ™ôàLÊ·?âDñ¯fÝ“SiV?>ŒœŽ*£öŽß¿fá…e쫱SºžG±¹Ú>Áßùþ3ò"º{üðžŸJ)û?Ÿ¦V¯9ª(‡IHº,…¯¼@°W³Ú܇­“ã›Í»ÁÄ·fä !T`~¤Êßå ~ÞeuË›o‡ïÌ”LÆVëpà1¼£ÀÅ&<¼N#â›,‹V¶Ñ瘪æp–@W‡ð™34h½? +Ÿµ\Uy¦2sÔy3m½“¡õöÑßùp «)ÿŒ¬§X•>{© +š…ZÎo)hQÝ +h©ñ‚Õ¶ØeÚð"sؘ¾ ¶§Ó©ònM¡± +<=ñ#{F]‡$ 0¦ aèT:æ"¤Ó'ÔfäÙ«E)_Š/sô1-1¸¾òû&•¬1Üg?²—ò[èmÏËdf°^Ñuè1 MŠô ZOkù¦/üøÎRÞ®‘Æ<1W²šëêœaÔÛÓIɶ¦ 2LqY. ˆíþ$6ו™¨ôÖ‘gÓz§OB2kûÑ%^Sª,!þ–!Ög2* ¡Ò¼Ò…€.Ïd ÐÕ™Ì,IS«Î“”ZuL;é¯pçãáT#׊$½ÌLÛ¬ºîUg—Ä£' ¯4Ô# Ë]”º:¤˜%Ù‹g–¤ψdšaÅy½\¼È·?ò«²†‹!üi®\`ïî?À4Í0}7!¬çê +ÏÅl‰d*ˆù ¿àŠÎÏ¡vXà3ìß5:ÀW¦„!ÀP$ˆyóCé-—]áË=fï[ºÆG3Ïö†e[÷SPñµ÷Î%;IÇõ®4ÛÌå†O`®N]æ虥'&2¢‡ýé/|5” ò­4ðÒòÖ$UáÂ4}ˆGÁŽ õNÊßýô™ +Ùáš ýA–¬6}UòMŠçb¸€&ÉG6ÏkxúÁl¬ÙKÃH¬;ý+³ÈffÉ0WG%sôúAä=3‡葇ch»ÃëBU÷}0îJžK±Ð$•éÔ²4_$)Íð”£5Kù¥É.Uÿµ…¨0¾Ô ÀE¼³q þ³ãý©Oï}Gák'ÖbaàyŽ§ /('h”ßòèØ  >aø¨ˆþendstream +endobj +6922 0 obj << +/Type /Page +/Contents 6923 0 R +/Resources 6921 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6920 0 R >> endobj -6451 0 obj << -/D [6442 0 R /XYZ 85.039 280.269 null] +6924 0 obj << +/D [6922 0 R /XYZ 85.039 781.388 null] >> endobj -6452 0 obj << -/D [6442 0 R /XYZ 85.039 226.678 null] +6925 0 obj << +/D [6922 0 R /XYZ 85.039 571.122 null] >> endobj -6453 0 obj << -/D [6442 0 R /XYZ 85.039 144.777 null] +6926 0 obj << +/D [6922 0 R /XYZ 85.039 530.475 null] >> endobj -6454 0 obj << -/D [6442 0 R /XYZ 85.039 131.228 null] +6927 0 obj << +/D [6922 0 R /XYZ 85.039 502.77 null] >> endobj -6455 0 obj << -/D [6442 0 R /XYZ 85.039 104.13 null] +6928 0 obj << +/D [6922 0 R /XYZ 85.039 462.729 null] >> endobj -6456 0 obj << -/D [6442 0 R /XYZ 85.039 77.031 null] +6929 0 obj << +/D [6922 0 R /XYZ 85.039 435.024 null] >> endobj -6441 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F11 2898 0 R /F66 3242 0 R /F14 2895 0 R >> -/XObject << /Im1 3957 0 R >> +6930 0 obj << +/D [6922 0 R /XYZ 85.039 300.138 null] +>> endobj +6931 0 obj << +/D [6922 0 R /XYZ 85.039 191.139 null] +>> endobj +6932 0 obj << +/D [6922 0 R /XYZ 85.039 164.04 null] +>> endobj +6933 0 obj << +/D [6922 0 R /XYZ 85.039 123.999 null] +>> endobj +6934 0 obj << +/D [6922 0 R /XYZ 85.039 83.351 null] +>> endobj +6921 0 obj << +/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F38 2997 0 R /F58 3360 0 R /F35 2976 0 R /F62 4047 0 R /F41 2994 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6460 0 obj << -/Length 3438 +6937 0 obj << +/Length 3117 /Filter /FlateDecode >> stream -xÚ­ZmoÛÈþî_!äËQ@Äãr—oÒ"—æz¾^ib4(®÷–h‰5EêHÊŽÿ}çm—+‹¶´íËìÎÌîìÌ3C«EÿÔ"OÂH‹,W¡ÎóÅz-¶0ó· %+!Yy4?\]|ÿcj* -‹¨X\ÝLû$¡Iôâjó[ð¯ÞZ®´ÖÖár•eypõÓ{ù¼TÁÛ?¼Åžâ÷з\©àï¿\âÜÕò÷«Ÿ/Þ_9A `Z \üö{´Ø€Ä?_D¡.òÅ=´£PÁôþÄ£¥ß\|¾ø‡ÛŠçÌ‚WÍ)èZÞÔ-Ÿ•ViPü»Æ èûjm-G%pIDÂV²€Žû²e’C¹åZõ¶º×8^›ŽçÛNöòάGóëèè»[»1ÜÈl‹h+Ñ€Ž!!5&z÷îúQ(=ÙMÒÙö·ÃXŽu'}õÇÑ®Æ)ýU|"xT­=x1vùØY>BŽV ê]£P<ÅÇÖ‹ÂÍtÂÐ%ŽÜð¦ÓAgrëÐØFб‰Öâ=‰hÃDëΙÒq$;¶r&V´nœQPAUßÑnñµ&Ao·ô|pŽÜ,\/ÉUïkt€4€f¿‡¾£rÏÿíi:Ù†ÏéÙ_ø¼‘[µ¥K­ä4¼îøâáìa÷ÊW‡ÝÅ] k"CÏx-g"í.º^³2`§i’ïvYï­¬êøw¨$Va§¾™¶ÜÉKJ³þò‰ÉãÝÊ_†û£ÚÊšlo-ö5†<œ ÓY†C7ç56xãèMhmýaÌá¶àÑZfÅaP°Ð~°(RÀ(6X :CX6M7WÒ0Õ©¢í5ÖºÈÈm4@šþ°dÑ°Ã]7¯ÉqŒ¯=uÆuˆaæ1RS*µŠ©È¿sËÒ¬<¢€'ajR·jV„gü´ •~ž“¼ÀMàœÏíÓ‘kdCmŒOxï ^²¢sáÆqª¯’òQ²2q«B®¨mg.[J~¸üÛg„ÅŸ– -¶þ'`éó-SÐ+µ—>·!òDæ¯>|„íB|¿fOaG6ш>×ÖüQ•Ç)Š?#$Çq˜%'–Ïø.ÓyãÌ< Lqnô‘®qî;ƒ ‘ݱÙðÐW–3oEepoùI¼'z«IŒihª±’îp\¯«a¸96]g.!3aÙØ'+ÖX›"ÌÁ$}•‡’#FÕ<âü:c-CH·åÖéóƒïø—tínbXô_Š{×F !ÐÕíºë!Œˆ¹yÀETp 'áÆ0ÜŸØJopà(œpÕl7œ{kbácRŠî#ft…L¢NÑIâ°´‚Ä°Hbß¿Á ©üe Îέc—œD€vTQˆA·,ù¸Á1öêv΀ÀÝhwïÃþ:„]nf¸(I º|DV»Þf8¦Ëñ»ApQcïŠUJpNg,ÅhÉØËjìØ ¡ JwrìlK±¤ ä–¾ydzp·¼š.Bv½÷Y­d•lÖ2Bbxß&äk|Ô -6WbÐ6˜ê“ƒðå²´1y¤£3ìÁ -ú @(Τ÷‚×6^ZƒY”´Žƒ;è½y4¨¬Zø(çÔšrŽ8ømÜ~Çf$âsâ×ĉ=Ø™Av”¿lDàHœ³º»­xO+ì„RA:˜” Gͨ¤c2¼Êáô°7tÈ{)“ûüTgDS¦pºãCzÊi#»mcröVlÇÕ†\‚"ˆ“eak ôTqᎠ™L|uðÕÊÂ0w8c‰É;ñäN[YǛ΀M8ª^ÎPÛ¾DÝýé(ºe¢à/GÙ×ÛM]"Ì臎[\ ¨¸Ã— ~xƒ.eÝ©··„3` …hÉ£Ck¨ÚÍ\WµëþÁÀð:!:—ì=lÂ"¹D¬Ù+"ÉôRM -žËOPêóì¥úì¥ÆIakj‘M4áLË uÓ±g¸=xœŠkdµdÛžŒöÀ[Måœ^6·E¸-!C»SMÕ?å¢Rò»ÃQp•N™ü]ªBgMB¡Ò ½Ï\õŠÑ£çF§Ì]÷“6þ8g{ÊG*÷Á€=æðR¸L.:›N0ÄÓñQ»-âfiP56>v2Åœ+ºlX“îJiÜ”TuwÆøÐù|û452]É?ûšò磸@;þu•ì ¾@¨Ð‘1´Àñÿ8#ûÊ•SÙ ÁœÀ_P^Ç€?(‡F¹-ë–jjüµEZ°ïX4§&ÕRëfà^yãÜy/[J1Íؤ¨•gqÝDþ%pf]\nö’Ï5ÛF„\Ž‚,8OæÁrüœzæ*:|HE|˜ê‰–“«'æ>šÄZÓ™d‡­oœ_êý¼^)'èWØ`Íogô]:—. VípìmõN%ŠC£²ó‹/¥*â -:Í Ô‚ÓLà,…2j˜(%T cÙüöžŠH:S¡ŠÓç#’GôtD²D‘ÔSéY~‘ÎØ©™ˆä³ûóŒ-ä¡Ém)âGt¦=)üà"Ø°‘ï/{JbÊ­ÍGèÃO¿tŸ“èÕ§hõüVûøϾ*¹šqÈÅ;)zÈž§Ÿ Îyc¾«çOO~°äšôŠ5<(è uâ|G¬Sâ×{Õznjß=Á -™úQÑñª˜$cß}+HÛs<öÊwÌ^˜tí$ÇTlŠÁSgM¥k,–àŒUÁ/àc_e}e -gŠ+.•úÅ%ìº@k0ìQÆ‹-JC`zCÄ6ïÃFÍ5ÁS)+Ò„~I5$;ùFŠx~FM_cpL⤻`œçò4(d“TÜoêa.Ò¾Xñß•Îñ ô}ÛHê£ýŒEªVØÀ}!}ÅX™[ü›zÃóói×+žt _·Š#÷"ÎØ1Æ¡æ8O¥Šs½¸Ðw]^Ë']̯z¼Œ¶¥ÚÉ–“¬/uûëÏÚ(¶%ÞQSÒ¶Þ¹iü6&¥S¸Œó~Áijä™'ªœã•Âf'§Ey`÷m“IÏ3&#+¤xÝ°"ôIŠèAº\ÎE{“žÔÀXªIÔ†÷äù5…—z”¬'öü€7ôbÐeËã^EŸ·øµ3hYÕ\çÂBÀà¾A¹Îc†0ñÆŸ?/é(xûë_™fæxhe¶D6ýBW»±®øQ1: AµEœa®Õ˸¡Ã8›ÿ³•ÝkåmvýŒÎÃ4v ñÀ~=ûk“ÀV€gþ/bÉ^/ˆ•€XQ~"×N vî°Ôcóèb~J}›viÐL¦mÂ<+¾­ð”˜óEô‰‹2hùèã}ø…x0©ò¿e­¥NP Äy¢¡CEž­Néù«gWëð‰¿ú‰“,ÌâøÙ?Pòhèôc˜5`/)aN±Qø5×:4”ÚÁgè)&'w  ñïXzªÕ!Fáyüå)áÿ¨ds$3hÍŠ¦2xà9'ô +ä¢TýLÀÖRF‡|]Éã‘h1˜Œ‰´Û8óT¿]pã“'¦¥^yäç‚>Þ}ÛRQûÁU°éì´­>ÉzuÍ+¸¹´ër¿ý™×Ði,_ü³³µ4Ï ýx'ÎCæ/RGa\Ìñ‚ÿüÿ§?;sÖ`4x€b^Þ$æo„, Ùi?–×þyÚ™Àÿ¤»“Øendstream +xÚ­ZYÛ8~ï_aä%20­%RÇyH²ÉLf'A6il°ÈäAmËnmË’G’ÓÝÿ~ë"EÛêλ˜Ã<ŠUE²Ž¥V‹þQ‹Ü„QR,²\…Iž/V»‹h±…™_.”P\ +É¥Góêêâç·&]¨(,¢bqµ™ø˜P›dqµþ¼þõåÇ«7Ÿ–—I’I./³,®~}Ã#Ÿ—*xùþÕKìi ~ý×ËKüã÷w8wµüvõÛÅ›+§ˆB ÔâÏ‹¯ß¢Å4þí" +“"_ÜA; +Lï.@ÐèDúÍÅç‹:V<§¼jnÓ&ÉC“'ç»VÆÛµRq˜¨x‘™(4‘¦m¿Û,/ã" –qtîl+ÜÙÈò n—q|_” l¸^ót[¸ôngA×ÃÄ-Ó·Ð,wȧ☤×8±æ±=¶$îH^¸’È­·ËÆ›ªu-^=”;iý)}_ Ü)÷ȶyõeV=àÁ]*<Ï‚ö¿®„êX”…ñfIjëؤݕ»Fy°jjP#Ó^âüï²®äà°Wâ8<™ï¸¢B£Ryð®eÚ}?Ö«CC­Ÿ`XgÁ®¼%jOþOBìMáùÀ~~~›ÆÞ'‰¢;Žhw7Ý°$}òÑy†w¦[&1Ü­?²‘4 £ØÈò¦n§ƒ¨:¾Ë¤ÈÂ$ÉŽNqÕõ}µ’½£»ü™h¨äöÑcF`t#í]Ù2Õ¾ÜV*{1qF³|Ù H¢ã`Ýáo´ÝÈ€´‡­àµt·yîÚ“Ki¥ƒ¯ñbS·±@ 0EE ѧXñ~ŠÔ#ê†Lê0NÓà>°K8X™I'½ÐqBž›ÇåfeôMóü$K“Ö«éÓ°ö<®cœK­9°=†g“0Ï 1D;0’ÜV0ŠmyÐ_ÊsÓ0/µ^ âAàJâkÙOA҃Üš/E£=>GÞ€ºÜâÞq‚¯]N‚™ñ† µDØa!‡ˆQÎ"Àð\VXË=:c7#þg™CLé¹%àŠrÓIµÖ‡ñÉ™@:¿æ0+B¢º"_g*›Ïí™2T„Ș’_¤8 F6…ö„ƹLÊ©,Š$`ÂÜ´Ãt.QðâdP¹- +VŽÔ‘À¯ãnÿ‡Ù/ƒyàÕ¡ÊYa]£Û‘Kà¢;0±¹íâ‹dXK[SQçú”‡Ùºvmá-î,QHNŸ÷pdRì<dÌÇ×ÈâÐ-@ï°(ÔŠbå3›ÿïÅaÎ÷ÌÔíVœib Ž³+Iî´• <¼Gã1'¢ì£Ò?( M` Bå ¸°Yl+"ë¶0;0àɦ³ÁA¡]Q‚ÊŒjözFÿºB(sòÍTyé X¾û(ê­×„{†ÇBa·9TíØÍF‹I®{Ù’Û8 ú¯*AÐòê®ö«$™y¡ƒšvísqÄÌH¼my–c4*¿4rÌ´¤d®Š² ÌçF"¶©W´D°›fÁ<ò²™EÉ?»š^…‡Ñ–lŒTvä‰PÉ`-éÆ-ÊAðû— dâzÊm’fÊnÓ3Öè#Ø pÁô†F¹-ë7 Z‡1RžþÃX#Å¡MI¹Ù•¿nBüøÚLâ4tü& +³4ÖB ‡ÈÞê +\ªºn?Öt“÷§;6%ìÎƵá'?üúÀ8cƒ< +ÞOE6zE6íÃmÎäÒàÞ==6.õ^Ñ)ÑZÞÃtnš“ã@¹æJÇͪ=ÒÅ+ô¦\åÐÖ§¢¬«iŸ¼.ªFð‡u2xõãä[3(ÎÒ0Îã'3Góh²4”Ô£è)q.=)Ïf _à[tÍ3ŽNð‰×cwçžòxÅWajØG¨Ñ1¡gªƒ`4vßT }\-Ëʵr…᜺š8WYid>- t?xËXà×ÉJ¡D'}gK†×Tq˜^§1<*°@‡­Ž^¼êèmì2ñ +?¯ ÕLXæ ¬xI ×^ +Ñ*a0(òœ/ag¬¨HËôØâ-"˜}†`© ÞðNqEÔõ8ÏÍ œÚPéUZt¿&‚tKE:ŽÝÖôìçÔˆ£è`´H<¶?`‹ÎÐLèÇN*è,\r=ÒºTŒ’çyƒ¸qËØm±”LŒ_Þ +¼ãØC4Ó÷q®ˆŠ_¾òàÙÜ·O-o,¿ÿŒ‡§ÀÆsyµL2 ‡ß5‡1lŽOfRÖ½«‹/Ñi¬Çk¡O=ô.Ä¡/ÔùpÅ=wšøì<Ú.P[Ãé]„>¸<£¿2q~ÎÁa¸dªÇ|TiIH{SŠ¬Vxž¿tpÁÙ§¢]•{*××M=ÊÓ‘äÛí—£è—Êç÷ÛT“Žè¸X‘dC¹db;öð5~—Ê£Œ?âZÐ@ò°XKOBlUöiÉ•¦‰õx"‡ßA“œ2æ:xùáïܘ9“Ì.yñãOo§)Ƥašê…*tXäÙÿr! ãlþï.-¯KÙL*2EX$©“ˆ:~8û{ +‰*5ñÿG/áõ½2Ð+ÖGz½/ùK¨û0îŠÿ©C§ú AÑ ûP‚Ÿú‹ŒãCªýOþ©™PvüW9’žÞýÀõü²-x,W³0Uñ‘> endobj -6466 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [212.407 214.44 369.551 226.13] -/Subtype /Link -/A << /S /GoTo /D (problems) >> ->> endobj -6461 0 obj << -/D [6459 0 R /XYZ 85.039 781.388 null] ->> endobj -6462 0 obj << -/D [6459 0 R /XYZ 85.039 625.834 null] +/Parent 6920 0 R >> endobj -6463 0 obj << -/D [6459 0 R /XYZ 85.039 479.52 null] +6938 0 obj << +/D [6936 0 R /XYZ 85.039 781.388 null] >> endobj -6464 0 obj << -/D [6459 0 R /XYZ 85.039 382.554 null] +6939 0 obj << +/D [6936 0 R /XYZ 85.039 598.736 null] >> endobj -2554 0 obj << -/D [6459 0 R /XYZ 85.039 257.722 null] +6940 0 obj << +/D [6936 0 R /XYZ 85.039 423.202 null] >> endobj -6465 0 obj << -/D [6459 0 R /XYZ 85.039 228.317 null] +6941 0 obj << +/D [6936 0 R /XYZ 85.039 301.259 null] >> endobj -6458 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R /F11 2898 0 R /F20 2865 0 R >> +6935 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6469 0 obj << -/Length 2909 -/Filter /FlateDecode ->> -stream -xÚÛŽÛ¸õ=_á‡#±FuÝ·d“[l²ÅδAÑíƒl˶]\‰Î$hûï=7R²-{‹Æ$Ï!yîJ-øS‹,ö/ÒLù:Ë›æU°Ø䯔`D±öã(‚ñ pe¡«$ôƒ(Å‘;V©Ê})ÄyûüêñC,ÂÀO½xÞ-” -}­ÂE’G~¤£Åóöüå*ŽïM[ÔKå}ªv¿\é$ñŠv¹RÞ–'C‡Ð¯L½fE³.–ÿxþ° -#?:ò¸Ô×wkÜPâ D|õþÙ‘,'IìÇê.O# -±¤â… -à²üŒ%ú‰Üÿ|({¸WG¡Wð@{ 0fÞw^ºS4m¸r`ŒnÇ° -í®CxƒðÂÀ¨êZ9OùºŒA:U]¬TË a(Ïän8£á‘=º=tüžçu5˜á5Žcï×xòƒ¨B¥çÄPÑŠ¶ÝrX›SCr–rÏ©Sê1J{»N2ÆO™Ï— ‚'R"ºF°_*Ò:²|Õ¡h–p²ZÈ©(Áô® ˨ãÓHΦ >ù´¯¸B£P¿Ï0¸g¾ø?òªCÞðíˆ.Zàq‰g#:bjíí˶ìÁliòß2‚épcµüÏ:‘Æ•ãD.úi|!<ÖÃ^ã,ñóßq ŽuB[&S‹Så+['T¤¾Ü{gI(öm7f„k@8DPßñ¥8Éè–»´8·½)Ž?Í4ÑöKËö)É= -g¸¶&+It†Ád –~Ù!®ž£ƒ9\R5Ó~_áu{†!ˆ‡5bÀ¸X |ï ‰iÐ tX½c‡€Àçým™ÅœlbÁµ žp§Îbr`?~ÐSÑèÌOãö î -l4c¯;’õö™ ãØO£P°‰WE"ªŽ¼,«lÐðÖÎða™½-… ÐŠx+äu“ÝG>7ÕŽ¼‹^ä‶-×'–(®×å茵\gì–jtÏ -³DžŸ ‰/O½þ$'AM”$9‰-2nDЄ~${.mp'aÊàkÔ‘šå;µb·Àý6â(oÇ0uê5]/„AÅs%ŽŽkS°2sƨóÌêZ±à‘uÁ6Ï/-™wY×<Ý8©ä Ä‚Ž—í; -C ã)þù-ˆ3w"§Ú‚âÃH3¸3·ª@&ˆø8…€HÚ".‡5Én;à]­ÓAÀÞ´ÇŽƒúˆ—žˆï€%_šCç4 -HÅsu3 ½™=e3Ö±²™7/3`¤ˆÁ6•ÁxO»7”½ÿì¤âÄ ›tÄ¥jÇaŸÀ/ ¥c .!à |øy(ÞÈWó¼Ì4xÇ`Êí;ÉðºI³Ä{Æ£–)§¨½Ü¸µ×sÞgÙÕçÖc¬ÙèÔ#éÕôÀØd¹:„D.Y -òœ½¶;¶Œc®Iåx$„H ·dUuÍW±ó—|H!^džk.x4-΄C”&ųpfb*lå§f -p] NœÞqBnÊlaƒû—ËAšPvÀµ¾„ ú]à’»Å>/;p %¿ÅLCdTÜxuh’|qkÑnNË•-)’ Gn -¥»ÐÖ%fÑW‘CKð«—R]O‹s&Sbå¤Rçì´ecщ٥`ÊM0ŽÓ{¬ç.Ÿô\oÇ2ƒ#h*™8ì¸]QKTÏlÃ…iˆ;/“`H“¶ö™ÍQ<ýôÈ‹ëC§É­G€Ø"÷¢…Ñ’t&¹Ÿ…!7°è÷‚ñ뤕µØ« úu/{y& -á@ffÐß~x||yyáRÔ½»©-šÓÑ'ûØ?^’™fç”^´Ú‚rŸ¼‹s:)>uûy’™Êû12+Ú­ÇCGI…· -¯_Rðµ—†ñ«ú -r­–”@éhü—¶úÆ#ç²0þLñB‡<;@—O§EÐaS~P¶b@Å+튺+¶£©]%÷]Ï ûBè -ºoµ£ÐOCý;ÖÁ¸« òÌ;ÇÙyw-ƒìLŠ¯ý¥kG.é ãÜ¢s‚/ŒDPîÓyqÎÄH”ŽýL·(è¡T&‘gRÎ.‘âò‚ì~à)zvL¸ð‘žÍ,§)¶ÛI†8ë~ëžËpíÓókL—3r(#•aÚ4§ù/ ŽŠB8±4ëå)¯Þêè ˳1!ÔW剰p§Zçw¤PéӻɓJÏð9¶pýGÄy÷`ó!ÖcU7&ÑÒÂ5l8p÷Doº²Ÿ¯äTSH·‰áóÇw`­7¦ã[ŽŸÕ'‹û0y¬ˆS…ïâ :užææQ)¤ ÃJèè(¡^ÞŒ1±LîfšmŸz¯Ó©Í"îa–Î#–Ô½ëQ1VÂ…-Ç7~¬uNÇû7ÜéѺìåT´E´¿IE`Rüê¼_ƒmù,•±+´'—ô_IJö²ß9,¯†Q rco"]lN7~4è\®¥+ùf•& +4ŠÔ=…"¸“ËŒÅ'ŒnÛôB?3š×Ðq'÷¸ÒµT\FÁäiâZÛ`Häÿ|¸Š¤Çdø½%L„qs%/n«~ltlÑBØÜl`%ì¼Æõäe? *I@ÙÎƶµ¸âjh„’vŠí†ë`´D¢¼•ûse]-ýN1-IQ¡ë‘S´³(òÞJ-[¸øRô¶-Œ¬ÏÁï©T-±q™Ô´Üˆiìg¶×…õ‹Õkeä¼ñzvk@r¯QNŽ¸*íw]Jô˜ÿÚ ´ò£èîdžåöw…¢ Rû$”ï ?µƒ„>éNäÝ"ñ0ë„ÝR“½RPF(äÜí=~„|àÅN¾DòK>ðûy> +stream +xÚ…Xß㸠~ß¿b +¬L¼–m%Nßöº·Å{×âv€¢èõA“8wý#°•™´ýßˤÏ$™C€H¢(‰¢È¤ÍMB?sSØ8É67ëÂÄYQÜlÛwÉME3~g”#·Ylóœú&—av¹Jã$__äÑ3–k³‰³Ü€ç‡»w>§ÉMšÄ«Uvs·‚¬Š$. +{s·ûg”åñbim}ì\ó¼0ÑXwÕb™­V‘ëKíd0öÍ#Íêä:iàÚ{'£Ã"3Ñöþ¾¡™²ÿºûË»ï& ÃÙëU\¬Þ¾ÃŒ‡ï`ìIâM²™ß!ÃR¾ÃÝC9”„D’Nµ$}ZDÏ%$-D;’dÃÝrö~/mÝÑÔ¾Zç뾓5ëÖF®¦ÙÆÝ7åÄÍþA X9ß0‰Zœâêæ¤2Ú–Ä· ѯŸqÈŸÞ«8®ÛÉò]¿XÒÄö¸„I;KØðuÛ{ðõ<^wÄÞ}Go™Û BûdÅ´öÏ6$0ø½ ¶}[J辶 æ÷a!‹éZœÁoŒ½êÑÐÄ=ô¨z"ú¶Q\­„G ËáYF•ˆ ÿ¸^¶Žø߬ÕΩì*#iðüÊUÙ•ƒkÀ‘E_þA:¾?@~Q^Gãq‹Ó„Á)õ~ ¶OÌËÏ]ÅWLÔR›mÒ7MtÆÜÌääx«™‰Z»¢Ö73p´|}‚ÛU]?úš‡<Ì“ŠÈ‹z˜É5ﱄiþ;¢x®z5El2–ìï5ô…%R-õ¡]“DÐQ)¶ÅŠÃ#ßDu0_“Gµ—eõB€VÑóÑ +µPš,¢®\­Xîïí|Ù< ߯ §¹A¨O“­&µËÀëŽr¯àGiÙû¨u3ærðì¿Ðl +äÊm|ÁξÎLžüˆU#5{!Áh6¥Çzdenpì`LÂ-lGA)ÇF7U¬¡A ñúŽ!ÁªwM¬¼‹À»+ÃÖ†Óó"]Û˜³­«žcb^|RˆlhÔî”®RÝ;vœo”ÂüiMZguVBtXðá³-fFf“Ø’o$¼zìêß“•ƒ0¾°FÂð4/”Ø•S’}G± :ŒW•¦¡r27ò ÕàZŸ0Ž aVÙé,jŸÙ”9áËÇ_neo‚à¤`Þ±”ÎÎy'|2ßMO›˜ 4¸DˆÍEhÛ³8zh8¸<SìFÔ +¢f… ͶC)']ê|E*\Ù7aÆ3a•‰7k„œª(63¬2‘ÑÌàSI6IRTÕôðò5hPïë)ƒá,WÄÍÒØþž¸'ž«ø•'I¼ÎE±U ÊMÆ5¥ÝSäÑ3z™ÞMð;Åέ0ÃÖáNÍ(c8.¹ª¬*Ù7I Ð('0Qöz” Æ‘5Íá”Ú 4Ø‘»*LôE‘±çæF£R.pÏN蹓ö £ˆ³ã wäö=Þ +ÃQåq'$6Ì´XG`_Ô˜cu`Ù©å6¸ÿþY&žàjèM`ˆK+!6Lðiô8åçHü ª'aD9 ›t¢ªhâúsy/¾ßøÄQ bìF1Eçt'›‚eþˆT‚Œ&DƒÜbÐ`—ýQBYnSͦ¬tZ2óc“ì¹ÔâRhåu[ì]ÊA{•ƒty€>6‹ªíVˆì¹Ä°I )cåŸ%zSMŸÀþTKLž=˜ Ë*™ÎÜá]Öߥ’îµ¼bšå6È–­)-f¡'õSCËCàGªqöÑ* a¼¥ã´Ø:ù‘ÚÉVÆÉ)*ò±®ú£T­Ù¼IP£Ä¹¡þ@¾›b”£?8|Äè¿Òpx~w]2¶÷Û†ÎËpùEÚþÓ•þ¾Fq‚qçpkôÀðÂrx,‡ÿ]©± w…]½YcÍx®–„EgöeE˜jEx·=ð·ªÝ‘¤ËR)5ù%!Hn62 ÒPéܯ—¾gQõjÞ.•…¿ó‹ êí&Ä8“Òy’Ýœ6?ÓU`yS“eq‘s ØWÕ¦©–òišJ4BˆÇ€+›ú» .éÀŒ”Øijä“çÄŒkäŠýàÒ“uô“î]ëÉN†[‰ÄpZµ ŸÚêNå:zùHíõk9hRR§;e¸ÓN¿ZÜ^ys|ÎÙÌuyÕþ&ÎsfI¯Ò°JuïëmVĶȮŸø7?.endstream endobj -6468 0 obj << +6943 0 obj << /Type /Page -/Contents 6469 0 R -/Resources 6467 0 R +/Contents 6944 0 R +/Resources 6942 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6457 0 R -/Annots [ 6472 0 R 6473 0 R ] +/Parent 6920 0 R +/Annots [ 6949 0 R ] >> endobj -6472 0 obj << +6949 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [389.071 266.098 509.276 279] +/Rect [84.043 47.098 132.399 58.787] /Subtype/Link/A<> >> endobj -6473 0 obj << +6945 0 obj << +/D [6943 0 R /XYZ 85.039 781.388 null] +>> endobj +2642 0 obj << +/D [6943 0 R /XYZ 85.039 761.463 null] +>> endobj +3165 0 obj << +/D [6943 0 R /XYZ 85.039 653.963 null] +>> endobj +2646 0 obj << +/D [6943 0 R /XYZ 85.039 585.392 null] +>> endobj +6946 0 obj << +/D [6943 0 R /XYZ 85.039 542.439 null] +>> endobj +2650 0 obj << +/D [6943 0 R /XYZ 85.039 460.265 null] +>> endobj +6947 0 obj << +/D [6943 0 R /XYZ 85.039 425.519 null] +>> endobj +2654 0 obj << +/D [6943 0 R /XYZ 85.039 111.856 null] +>> endobj +6948 0 obj << +/D [6943 0 R /XYZ 85.039 74.989 null] +>> endobj +6942 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6952 0 obj << +/Length 2718 +/Filter /FlateDecode +>> +stream +xÚ¥ÙrÛ¶öÝ_¡—N¨N„×Gg½im'Ôv2mh‰²9–E•¤¯ã¿¿gII¤ì™;ž1œœ}¤'>üéI*ߦ“8ÑÊ&ÉdyæOnòéL ÆLPf=œ·‹³7Ãh¢}•úéd±îÎ UÚÉbõ—÷î?ç_¾MgÖZÏj:‹ãÄ;¿:¿˜&÷}þùêÃίÞó`þåbªµöþhAó©öÎ/ßžã,ð¾ÂìÛÔÄ޼δwñF—óé?‹_Î>,Zž[n€¿þ÷ì¯üÉ +„ûåÌW6M&0ö•ðýp¬ÂÀÊ|s6?û­=ŠaÁ„w é'´‰ +{¬ ((ôU褠¢yÜ×,Ûüò-‹\£\Øí¦3µ¬‚Y—÷9â<ÞfÙäµÀšÛ|ËkM -×üÍXåÙ†gÙv%ˆn]iÑZ¥õ3¾Ñáè Z¥aØÝUÜA+Ñ‚W„¡ï¡JXáDNàÄŸÌðL0q©ºØ·†£Ìšž¶•ÃA†?4Sf™@›ñç¦ÊvÈM±DcâJ½-`áo_[d/¯^Ãr>øϧaäeŲëMÎÖe…ã]ƒ%^IÒ1]o[ü`ðß~èjîࣅ…-€W ü³Ò^9…‘p1X¶&[ò•°Žî :›Ì‚$ @V)‰W? »ºÞáhRyõÄ+7%cÛ+rY´½‰•/ÊúˆÙÅCôUÞ€èeÀ_Îkí¼,Œ¤AŒ×¼ +ÃÕñ¨æ|³™=VEÓ¸mÛ¡¨ûi wŸÐl«|_ VÊEQ7Ý9©·FMW<^eMÆ£R ­þjžk#ˆQÒŽRJè§^„`± 2d1u#“‡ |´!#‚g›&¯ˆµ´½ƒ'Âlžà c^$﹃ði[#îá“ƉñcÓŸ3þÕVneËM~äMuáœaÄàû)7Ã.²k@Üˆí³ºõ9í0Ç:^röØ8J+âÍÇÈô€Iù1ˆ†"µÙ™1÷RE¨Ø8ıì ZU©MOfïÎhöQA`÷²w Ù{A~ŔʩՒp1ò®HÔ†—-¸ þ«îxYn‹†¶Tcá“t8£Ù4.ñ7"ÞñKõ ûù„½3Ã@-ܶ6LþÅÔQTyÍë¸û£ 4ÝvК ðiù BjCÉ,€°.ÉÝM¦Ï9¹1aq ~ì\½ŒÂi‚Ú §P)Y\ÿ(ߧKoB‘4)îpHó–1$;£@8Ý+1¸p‰“‘ºðÃNÄ$>)aý,ˆs`™HøA§wÇ"’ +Œ/õØàîªõ;XLÞ}ÌçRA`ËŽHq‚áД³ê[2áfÅG¶E`Å=táCܽÇe¯‡ç•~É á~râ-up…•b*1Þüh×ý€]1 Aߧ‰E#¨”DwOÉ<1.9SÃt’…ݬûjߤ¸gGnpÙ±4Þ:!Ð9£}î;¨ÜO`™J^"­³4ÔBÙ¯2|6 >»æ 'ïÞÝe?sâ* «)DâÕÞˆÊ`´ÍIW0¢Â17T¬Óè¸u:¸cx›++ž/ÈD|¤ç€4nŸ2~~#wm@hx‰ENœ™RÉ®ðíÔ.†­ +ˆïÈ ÛìX›|èG²±ñCFáÉlÜálèþû‘¯´BíARüâ£+?RI˜œ$èpŽ(î¿Xi£¬6{?•MÉ7Ö½ò>ÉOn¬ó&£JÖ \mM¢Â8ÄÙÀI±2±qåMÓ%ízè¦(ã?wœø»rÛT¥ô'_±„fÛ|èþeLòB&ÇnÁÌ†Ê„É ™Å´^,óA¡­ŠRýÂsÎW«Ôq¢‚(:é‘=œqtHÏyä)‚­GRôÈ>Åy¾É—l‚þÞ±VB_Yß>cµ½†Œr¶tkè3‹iJE ñ7õA3ë2Í×ë8TqäL/¯G†+þ†k?Ô€;y¸Ú0ie´s¹/¿ÒxæÁHÃÅ úìÓöîpNØ[žµ÷ ‚½(Û»Gñݦ õ`Jâô”–Œ¯"ëÆлñð»VÀ’‹gXøŠwaÌ £ +7âÓúnQN¨›qžÕö8µNÙûä†uÝ‘ƒ íAÚè= <ýúòû^ÿnÞï*Šý®BYo×ñ£*ïwp_æ¾»Lj{ÊOÜ«0ucBj"nñ 'òN-¯‚ $p|Õ{ 2& ;$=ýÊ~jKnéùûTc,3÷£èzÚXÈ?Í¿cç°@ýpù Yûòeñ»àž]-X#Ô.m×7CÁ¿®<µdó{kŽÄÊÒf‡œ¸åÛËo§Âøåý¬~û¤Š÷ÿYð…߯‚îçOî–Wp¿[âKNÏa¡h˜[(ÉæZžázð °p÷ØeUû3OUÈ£áNïk}Z TÅ©¨wqCòîô£ \—™áŸ yÜ^ºkôÈÖ#¼¿¸p¿ÃŒ ádôð¬ªûwR\vú̃‰îéSÌÆrô¬(?Œí=D¾>ø½b™íD¨òAmEI/¾Àü£Ï-¾2éð¯¹"ÎÿõÓ}›>¡JìÈëþt`´ã¹ ´=ä×ýÄÄðÿòAÒendstream +endobj +6951 0 obj << +/Type /Page +/Contents 6952 0 R +/Resources 6950 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6920 0 R +/Annots [ 6955 0 R ] +>> endobj +6955 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [137.104 239 260.036 251.901] +/Rect [84.043 669.875 126.217 682.776] /Subtype/Link/A<> >> endobj -6470 0 obj << -/D [6468 0 R /XYZ 85.039 781.388 null] +6953 0 obj << +/D [6951 0 R /XYZ 85.039 781.388 null] >> endobj -2558 0 obj << -/D [6468 0 R /XYZ 85.039 761.463 null] +2658 0 obj << +/D [6951 0 R /XYZ 85.039 733.118 null] >> endobj -3036 0 obj << -/D [6468 0 R /XYZ 85.039 642.137 null] +6954 0 obj << +/D [6951 0 R /XYZ 85.039 700.697 null] >> endobj -2562 0 obj << -/D [6468 0 R /XYZ 85.039 586.947 null] +2662 0 obj << +/D [6951 0 R /XYZ 85.039 549.94 null] >> endobj -6471 0 obj << -/D [6468 0 R /XYZ 85.039 557.543 null] +6956 0 obj << +/D [6951 0 R /XYZ 85.039 515.397 null] >> endobj -2566 0 obj << -/D [6468 0 R /XYZ 85.039 131.44 null] +2666 0 obj << +/D [6951 0 R /XYZ 85.039 391.739 null] >> endobj -6474 0 obj << -/D [6468 0 R /XYZ 85.039 84.771 null] +6957 0 obj << +/D [6951 0 R /XYZ 85.039 355.473 null] >> endobj -6467 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +6950 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6477 0 obj << -/Length 3882 +6960 0 obj << +/Length 2875 /Filter /FlateDecode >> stream -xÚí]oÛFòÝ¿Â/E¨"¢ÉåwßÜ4É¥'¹HmQ´} -Z&B‰*IÅÉ¿¿ùZrIQ¤‡»âP¤âr‡;³ó=³k÷ÒÿÜË8°/¹Œb×öâøònwá\naæõ…+KY0߯/®^…þ¥ë؉“\®ï»uÛ¼Ëõæ7ëÅ?®?¬_~\,=ϳ<ß^,£(¶®ß]¿]ľõëêÍ»×1õà“N)][¹Zœïÿ9ŠÀv­öYQ -DåÎȺš¶ÍI{ -¡÷ߨ¼ |/ZŽz¡8J¦8¥;ô´¿ÐqÏ ŒZ38îÄ#% –<ØÀ‹ •9Ïp ß5®h‚á4Çð)„šáC|£ 7ðA2Ц­‘µiÄi¾èI¾ˆÙt6 F>–¨P¾Ð¦v"›Œ«rwh²-á9´!=¤_È„ÙÇIXW„’0óšN -(~ a2~ïP”"{ý"“ïkM䬞Ͼäµ,“‹µz= s!)µ£ùfõëjýòæãû÷ëoDMù†±)íÆVÃêÆ×ákÝd;O¬‘%vã™u=OiîÈ* !ås«|+âðâˆê#/üvÄðc£X.$¡µf9C.Jœ>§oId¨Ry¥=;9ÊÄ‹-ü(­ù—2Ĭ(žÐìFð¨}ã!­j¬F8èØNÒßzþÄ}íƒØ=0ö;ñ ©Ncñ%›<ì3©(ÇO«¯øÚ³~xûögüK¥P£û ç}YuúDçûí©¯A2\z‡LøDæ&fºA~î/®ò¼+F´ÖQ€[;Æ»ôЫ¬>§iÑ£LQ¾:É¨ß Ý -*´jCÞho¸bÄÇÎ?³RETŸQP–o›~Îïá³L¥òKž>ý…òuª!¤äyÎmÅ‚.óð;ôUW”л}–q*¥‘Ÿ«Œr&EÚ -îO;Îgcµ ŠG'ZþýÂŵžñ÷÷ìO-ìÈÿ–tc1+\;ögªè|ÌÒ@31k¡Ä¬|c1ËÄ÷ÿ*åïU¥`ËË›ÑI 2¡‘2§çQimìcÕÅÓ°>™,A”g;­FKXM¢Ç_«Bæ*@ùvÌȱ…™$ÃÌIr›åÙ¨,;dÿCµGi¨rfŠ=h‚Ù4Çí)„šÝC|£ü6ðý…ÚÃŒømgq¤×Ù ÖÊä!ÓéÖ H„¤®u¾y§{º^±…•|ƒ™_¤Ó˜¢JC—;5¿»§fñŽ-$í ~{õTt®qCÏþ› -ÿIˆÿÄU¾µÇê H®! pÃ^B¦“~aI©òÿ¶uÚ4›Àùm½C¥o¢Ï. 2›°„£ð4‰Õ~tÐ'9l®”©çõàLàR){Üü‹ã÷ÕeãAhm8ßÞñ(=p+€–ò Ñ ">%Òg!¦Wh_0¶3¬=]Owü‘¤ýA/ÅG”›v˜ÚAÙYŒ$ Ê·äœkþˆL Í<ˆô±Bÿ`GNÐq}¿&§ÕqÑ6?ör 5<~‘EÚCˆ0­9  )²}ìÇ¿ I}®7rìXÉþ ßwõY¨K]€Û÷jšO<«ñ¢J9ÚKû§1ø­.hNj*Ž¼:Lú~býBÒØ°—¥³ž˜HÅ_ôÜøû»8#–ãÂc›ˆÏYNºÙåcæ‡qÑ ŸnÄM‰í⧕ÒOsÁ9gÛvñÜ;Ž­õCVeÌŒ\˜”òO•Á΄—ƒP[²ÛTÇ9®ß=( ú†ú˜ã§9:H¹Ýéž4%`nC¶Ú?¯„×R |¢™´œäC‘â0 ïò{þí¼ƒ‰ jÏ'Æ;åáþ}èB²Ë–†Ô•2採=b¦/ºÈÝ¥^×#¤R¼ Ù0Hu+³-ëÉ0·:Áë6bBìPÄÈG®`8ÃrlꢄCi楠~hÞ#³}?¢m¡Î #ø©Îî?}|[Ÿ#C¾!Cq=¸„4Ù fšÝžïÚN2“Ýk ™„ÓXëlÂy‚o,á4ñ­0(åqÓW”Ç+ª‘Еa±¯”²n²ŠÔ›nÀ¸Îw(utß Uê Ãw)OÒå‘^ðඋ”ˆ&E4ŸstŽ8›6à CªŒ ú;Ɖj+½kèéÍ×ÄÍsk0Î~wuõøøÈSâÊ'TÔƒØDO\ÒUѶÖ_®jbÀ-¼YjÇÛ}?.†Ø”ö–0ÜÏ+N$œÀàq<…½å3"˜¥4"ãÁJ“å©t&I8£ÂЄ - Ðœ -O!Ô*<Ä7ªÂ¾Wëìaê¼Éºn¡n(–ÅFǬnøZ‚ÔÜ&&Å$=¯¿­â¤·¹i5ÔÐÓ®I½oLW t[æ`ïô%û®Ü]m².ž%å„W˜¹TÛ«o^­®†TŽgC59Åjßì$"²Ý0œôµ*ñíØ›vµ*‚M)_»Z_\íkΖî僿}àM,ˆñØÁ¹ç–n¨K?xØ¡ƒÈÙ̶üª pÕœsÕ* -Â`zÌù›c*¨CG©&gâÚ9… ë§ “¬ß¨XáîEÛÒÖ=È—U†ŽrùKrŒ*PÛ|¡çµx¾Tt='™¸v'-Õ3NR —8q¢—€ ×$t³Nw·©]VÛ!~ìÙ¾ -út N`N°÷¨ƒ•ûsÞþÙˆB—ïÚ.: ó–kA¬“¦ŠGmÖ”Vmç.¤%Ö.§xV -$yðИG²ø‚‘S·‡:+ žßÅ”D'¯«ã5\qJ4ÖŸô#Èb³=9:fÔÉ8êXÙQÒb¥¼·†“5Ž6ZÇœS®í%&ç@¥-ºu„2‹Gµî»Ž5¼ÃÐv£¨ô…¢ c3¾âXÕWÖŸÇN -y©a¢j]C*þ—Ä&1cJyfM÷Waj+ |–64)Tà²Ð?͘ˆ@/ ð¬i˜$6™ÉÌ -âýíåÄAûà-c`Nª¡ÁÌ -'ƒcMZÞ4ÌJ´êÎ\ùûaAÎ*ˆ¼µSJtí3–¾mÚð -Lp@eôþ™LqH-kþyÌÚŽJÎ-x›ò¡7µ-¼e ^’l ei Æ45&¯IÔ*©ý[šÓÝH9Ó.ʹÀ(r¶»ðFüvWuyÝvŒ Ylgžro³ÖMˉBÖm)E40ð¡ÈÒZ>,oë“û®´ þî¾,Š¶_aÖX[db¾i—ß›V˜ÿî\öç‘í{3'ŸÐùìOÍd“%û;Á7–ý™ø® :: šâ+Öýn΄…c芧Z5Æ+Ï|Þn4Ϙõ˜fuQ]ÕŸ ¬,Ží5¶£ª~ŽÛ1üøWÆD9~‰Ò)~¦«ùF øòî©÷ÖÂ~â>k{â8ÜÓ ->Æâ‚©`Ï/— ð‘ûˆí5“〤ÒÇL«&×ÕWs²ô}–6GÙ6} ÏÙ›|§›¾çZ×{.¢ŒÍI—‹à(û¡TH·Ú”ëY{A&3MpÛ9(zýL_õ{öØJä[óí=’]Yeg !× !†Î@¦ @s¦0…P›Âߨ)ø†¦à©@¼+)7^øý£¶è?'à6’òÙk))’ ª|óþˆ–¬p¬[—¤¤_Žó=,å a®=âùJ˜–cêŸI?<× gnï[သO—Õ×í7»ñï/P77 ʧq›bZŽ·øñ]Á¬¨‰-Ý8Ä“âº_#½Û@Ü5Ð<ù» œ1»ñ§ýÍþÎêÝ-xûû±ì01Ú²½c3}©I #Hï°]‡ƒ‘^yØ¿æ÷¿¡ -Ø>.ø‡q›F/˜6·g¬‹„Í*œ.àèÀøY³‚¢Ëõýi«ê`ΕÀÌØÔ61©!²1‹2Ñ­Ø±Ò ]ÏÓmÖ„Ã|ìv‘b×4"Râr76Û¸0(QñðêÕðÂÌQ`ø9—‡?¯øa§Ï/SmcÀ¼Áîõ‰oíÎr{ M‘Ö"Tªi2ã¸Î\Êcs¶KëØj4Ã?Öð¿ô7amÝî{P¶ŸÉ¥låjZ¨÷ú'ÝùÛ±‚ÿ Šiíîendstream +xÚ½ZYsÛ8~÷¯ÐK*ÔÔ +&žysœc3;ÙH³©ÔÌ<Ð%³"‰ +I“¿}¼DÑÎnÕ–«Lh ݯ»Aɉ rùÂÕñ$Œ¤ÐQ4Yî.ÜÉFÞ^HC13$³ÍËÅÅå?˜HWÄnMUè|€ÆËéL:ï_Cëf>ýkñëÅëE-s- È£Àß.þøˬ`s¿^¸BÇÑäÚ®0¼»‰…ïi󾽘_ü«^ŠÇ¼ ÏÒ¯#áGúTAÒPï +ßõHAïöÓ™çJ'/V°‹÷SpO•ó3Û—U²ÝšÎ{¦ò\åÜuµË÷Í9ùHJ&±C‰yÞ.¸ÿ3j?/¾ÂÊUDÒù ÈØù1ÅŽLýY¶ºÒ¢¢¬xþÞÊš®ÚÂ*'ƒ®¼)Ú”4“¨Ã˜6ýü6­ÑÚÄ`;ßÀÜ|ŸUya\b“zÎïk” ß±XE`»¿¢Îö¬$v_cÏ+èçüÅ D”F‰ ¦ƒ þŒ¿6!±‰•žpmÐ4±›m2²‡ûÔÐ ü;ɱ²Qt2SŒd3í +7 +ùàælº™V®³ÌøöÞ É`©¡Û¤Û´ä÷5‡÷6 í:fq‰´à~Ú/=Ca0Iü2_¼¾i§‡ÏØõ:ÖTq t`ÃÂ~½:ÄHâYˆÿQ§éN«%1bÈ'¬hcŸRÚvºöEX‡ž'ˆö‹øÅ(,gKx*žÒtëÙ5ƒIò'Tá‡aµÄíuÿ¯Zñž¤•ð'µâ)Éù/x ¹vœ„BÆt”'£_S»4D/H­Cp¾]FÓJNš1ËVÊIJs +H÷~G÷uB­}Ï©SütÇÉဲäô?Kð\iߧL—²` ± ppƒŽ2ããµ”ïÎÚ1Ð&cGªN†N¬ù®ÎÒ²²* ÉÇŠر¹'|-ya„ßJ¸Œ%ôÝ‘Vq¾³XàHqÜäýlàs0íë°NÂt‹†@³uì:€^È唜R€à~¢¾¼Q QÇ@l˜³ ªJ »°yi\:½\ƒçÜIÊ„#1Ïø;??ãìöà+¦89³wØèo|ï ÍÙÒÒ #¡¹ô^c 9ÂNY¦ý S:â;?aüú™Š§#8ùAÄ[ƒ±¾Íƒv¥ÅŠåµ‡ Ñð–š@óvu±/‰-öxBSëuVŠ@³X›@GñyŸºŠ«"bøüÓõÝ!dDEÿ²$«]¶Œ)ê‡?uÝr}P´XÇ?‹ž°Opx€¥ÐYܧEÊ»GÔÂgÂ"…}¤V1ÒÛšö–EZ­¸ç!åCK1„bW,ì>8¶*Ú@‚NOx(}OøA‰]¥ +ù–B…Ò°€2tdk~Ö Šƒd#ª=ãåÎd4ØgŸ÷ÖKp&ižì=Ü…®Å˜NZÃôÒ¦*õ¸‘Š5ed^nïø%á‡uo:îL!Ð͇ð°sr¶6';‡‡„òÆ1¢ESã£%ÐÂaQ&->Z`ü½L×Ç-ãÚïŸÞ—g¤°³¤€Í¡Óºã¥‚ñDÛÐ<–g7KO³{ì³ì»yŠ™‚:÷u.ï3_æxÉÍ›´ ‡§K.x/mTÝ!ý‘ i ^òå«k~¿£c–Þ'è0gìŽ|ñçù0·¿_BDµ¶÷‹ýÅÆ|jíÜî¼·"~…ùý‹Ëˇ‡>ÆA¿¢”s4"Ï \šH +CÇï—%)ázf&+ +°(ˆ;ŽoŽe•‹{,ÞøˆlOÌBù` AMž©_ ͬE4`èÞJcå9ŒSÚ:êà ͈¢G½x„aãÆ=ŽÃ~Üâøfñ‘‹6α¬ÓJ¼ÜØ®RÓœßðM:’­M²KW"勾Ø*Pí{£¥ß@MÜÀ3ó¸"Š]Ä.[y™¯+±Ìw—«´ 7Û¶¸D\/6—×ïÞÌ/ûR{!ÔéÇ”­c¢8([Ƶ0Ñ”äüÝïÝš‰:[Þ¬E˜ËÚ*¡7åöHjëÎu3‰`lö|ئIiæçwÍEu}»D;5Ó×9U;œ^Ûj )6¨ÒlUsÙ·*Eq&ÖIˆ½.àÀX¬kÑœÏÙ,Ñc9ÛÃ:gësÌÙÚ¯¶TBRYðk© vìRƒ”™ÙbAbÍŒÎË­”gÔ·Œ¬{ÌŽZ³¸(‘à…ù)´‰’n"Ž| “¦Y˜¢Nó³,ʼn™ ÿ\ç·If®O᥾J…6úÉ}úÃÌHíEþiA¼9’T‰¬…ìQàð])ø: +Å C“œ]TÙò¸M0°E¾³Në«Ç"e2:ðƒ³¨Å½U¶³­««½ý„Acö6Õð笅>dàºF·Ø~Þ2ZY n:-IÙæwõ7É}^Ý× Ÿ=¬yaMq¶€q!ë®Ï ×ÿéÇ0Í]ƒѹÆW +Òl+ îÒ“^_^û£™ÿ™&r¸endstream endobj -6476 0 obj << +6959 0 obj << /Type /Page -/Contents 6477 0 R -/Resources 6475 0 R +/Contents 6960 0 R +/Resources 6958 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6457 0 R -/Annots [ 6480 0 R 6481 0 R 6482 0 R 6484 0 R 6485 0 R ] +/Parent 6920 0 R +/Annots [ 6964 0 R 6965 0 R 6966 0 R 6968 0 R 6969 0 R ] >> endobj -6480 0 obj << +6964 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [376.679 337.371 512.306 350.273] +/Rect [371.404 348.137 539.579 361.038] /Subtype/Link/A<> >> endobj -6481 0 obj << +6965 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 326.549 194.521 336.117] +/Rect [111.316 337.315 167.248 346.883] /Subtype/Link/A<> >> endobj -6482 0 obj << +6966 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [288.68 310.273 504.006 323.174] +/Rect [261.407 307.489 476.733 320.391] /Subtype/Link/A<> >> endobj -6484 0 obj << +6968 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [390.793 251.851 484.421 263.844] +/Rect [375.124 221.969 468.752 233.962] /Subtype/Link/A<> >> endobj -6485 0 obj << +6969 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [335.18 211.204 480.851 223.196] +/Rect [290.756 181.322 436.427 193.314] /Subtype/Link/A<> >> endobj -6478 0 obj << -/D [6476 0 R /XYZ 85.039 781.388 null] +6961 0 obj << +/D [6959 0 R /XYZ 85.039 781.388 null] >> endobj -2570 0 obj << -/D [6476 0 R /XYZ 85.039 381.258 null] +2670 0 obj << +/D [6959 0 R /XYZ 85.039 539.573 null] >> endobj -6479 0 obj << -/D [6476 0 R /XYZ 85.039 354.644 null] +6962 0 obj << +/D [6959 0 R /XYZ 85.039 503.308 null] >> endobj -2574 0 obj << -/D [6476 0 R /XYZ 85.039 294.83 null] +2674 0 obj << +/D [6959 0 R /XYZ 85.039 421.243 null] >> endobj -6483 0 obj << -/D [6476 0 R /XYZ 85.039 266.032 null] +6963 0 obj << +/D [6959 0 R /XYZ 85.039 378.958 null] >> endobj -6475 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R /F35 2880 0 R /F56 2890 0 R >> +2678 0 obj << +/D [6959 0 R /XYZ 85.039 292.046 null] +>> endobj +6967 0 obj << +/D [6959 0 R /XYZ 85.039 249.699 null] +>> endobj +6958 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F35 2976 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6488 0 obj << -/Length 2519 +6972 0 obj << +/Length 2805 /Filter /FlateDecode >> stream -xÚ¥YY“Û6~Ÿ_¡}2µÑ ðÈËÖøXÇ)³ž©M¥’Ü(¡˜ Él@óæáæõ?c=QŸÙäauØÇøÚD“‡åoÞÛŸnïޛ΢(ò"íOgI’z·_n?MSíýzÿñËž»ýòŽ÷_?M•RÞ¿û©û©òn?¿¹Åžöî ÷m&ÞWh¼™Î”÷é=´>ßOÿxøùæýC/s/ È—¡ÀÞüöG0YÂá~¾ ü(K'OÐ|ÓÛØ7:’~ysó¯~+žÓ^5v?:Œý0FøiªGi” -ýH…p‰&ðM ûKTÃKTaêÇIÒ”…;9y ÌRƒÄ¼eÕ£(½’p ¹Pnëƺ)bÃÅÕ• ±±Å™æÖ’ÍdãPÍgb9IƤõÁ) ûw¯ÝœxC )f+­-[_çÚÑõá¤æLøeщ¤•pÕ±ÑÞ×¥ìŠgi»zkéXÈæ©ÀxPf­Ìä²ó‰çêâûD)±þvz§é8§7Lѧâ¼t»h’ØbÝ£·Ô¨€ªÅèšx®’)Vp nØN‚eýFxM@y~< ì—cd |G/ÄÈÑ•)D/ÅÈk ]Œ<å7#ü~E´Ié+‰85k€›·µ.Ê=+¤‚š#l˜…t[x¯5]‘—LzÄä‹GZÖkÞ]ÒZ)ðŠÆžzgíÈ|q,irþ,í|/‰-1XÅ1¢d¶iYÇžë[^Bajï":=gp7Saâ+ÈCKð))*XÖÝ8Ì@”>Ç„™s$ô ì9E:ËѳhCt ؘÃØ^v°U½@›£2ίûèÇ»ÊzAèýKÖ"ô9¢°MsfÝ…N¼û:01ÔU Í«–> ºléŽèK¿ÊP,ýŒß˜¥ó3Áù4Ƽ|†¿¡›FšJ@ Röík! \*&KÂÇÕ]oƒåEU?°¥H´]“/deᆟó)vHqبORzã””k¸#ÆTYì$ªžÇ1™2Å2hD. /a8s^*c$éíùwÿííÛLéR†sA° LËò²‰E‘Ÿ¨ä;]11!zÉÄ®1t&vÊoÔÄüîz3 ø 3ãr#BJtY(V” Áðhd€9ɺAz—sˆBSÅÄŠ rþ,¹j]ì·Ö‹8L@©*þÒÆX @Ë êKöÚ£DÜxiDzß.‡ºÞY]šŠ¦S,¶Kû}jbÁqî(ÅôMòÒlíV RK]Ê?ÝÏLBf&FR€»…°ª´7}„7eV<|UgaJ9jB™€…ƒoÎ*¨÷ˆ¸°Gâïy{v­†'HNøŠ‡Ö»Ò"ô0†¶l½±Ï²9ÁÜÐöÈêœEY€£K9:ØÚEDF ,ËâS%BJ\¨­¨œc:K,ï yç Šû(pÑXÚ®#´ôü y:Ѿ ²«Ï“r—fµé˜ÜEœXpÓŒÝÜÌ€ZAvï':Ò4BÀÐ9aåÀ—‘°Qƒ3GØŒÑæ &²ÜA¥siÎtRæ*¦j/ÇpäëÏ­š÷wç‰ðˆæðr‡†màŠ2FhÒc­"IE˜§»åó÷K–L²¢Ô€­œ)[´ø„ƒŒ Ï„hè? m†dèHÒ‰LŒ  !¾#Ü)yå )K†¢ñ $Î~!½H…AÁz(Ž´€l¬—±ÂÖÏ?¨OªÌÏ]j@[I&/H8Ѭ…âÛ@GŽz6 ?WÒéžT2ÓA:Lš?¾~=,ý£âS4^ŸŠ…Úס:óÄ€ÍuáNwBá(’HÒ-ûG‡ÇãË<üB¯²SÚþÎ%n’×7µÐp¥¦)ŠWŒsC°_‚ U¹(‹ž?ˆŽ7CÈYOÇÇßïw;Ä pQÝæ׉ŸÁ@0¨‘Z™ðK™_6Î/Õ~–¥Ž(0 Å{¸ b}|¡71cäi “ÀŒ& Eÿs Š•oO(?ö¾6,Dø†Y0y(ÅÖ^Â0QQh»n¹=š_/Žˆ,×6ç¼# Ó'¼Ïà Ó¼À1ŒüÌ1J_étÏ@x;Ô;: ‡Oë8¹=}/§ÑŽó"5Ý{´åq,E”øè Æ }Ž°3%Á_ŒÊñ -ezrö™þ³oEÜù$ÏäèCpÆ%SŸª­=ÖÍå•ì¨$›c>]öË[Á¾ˆõ÷UŽ­+saO¹Éåív×ÔtÒÅàGù-ÌÙ=ùºäÞÖ[;ÀÕ‡fß÷ Êç¼(ðÃÑ ÿùþ¯ßéy3òÓ(·2†>De‘…@@lNå5Q -Ð::øµÎLendstream +xÚ¥ZK“Ûƾï¯`NSâïG.©ÕJ–å’dE»åTJÑK€$² @ ×̯O¿€ ÷ri1žéžžîoº›v6üç,â@Ù^²ˆbGyq¼XïoìÅf>Ü8B±’•AóöáæÍOA¸pl•ØÉâa3ì(?ðÙwëîçÛ¯ï¿-WžçYž¯–«(Š­Û/·Ÿ–±oýëþã—¯°Ûuµ\ùIb=£òw û´C +Ûúçsm`´ÅFO\o˜¦M÷xy¸ŒGN¸ª>r'Å•93<ö›TÐÚ +A•]à^–+عçŸvE%‹ÚSÛÑøžûE×¢>AK+ï-¡C7È°B^´ÐwC눽,oÐn]°×e쑨8×îj\PfÜ=45ê±<ñ@Yhù;èv96"«ÉËüeÂaH£<Ú’„kÒ/-ÄAT®%5šÏCj]WBfâ£@´ÏkóTÎùAË<Õr¡u;Ö9zW}èPìºj¹ª‡¯k}ß–õcZÂÔ½(•å)ðõDöÁEßÝq»= ‡Wòãµtê‚£†I¨<;ºê:Íe×ÑD/¹Î5†½ëL9κŽÉñc…gõ­4ËÐ’Ø]p «å‹f€ Ã]Z¾t¸47¥o˜ ÷ ìÔ]ŠWSåÜ<ÉØJûî·{&Û0´Ä2d‘+GÊ,í¤õ¼Ë«ÎeÚÎYѹË>öbë©?Qƶ‹Q³\¾ü Paxýî{’+WÏ4/ÞüenÃÅÙÍßûÀî¡¡×÷œˆA +{ÔEªÕâ9±áÈØûtrÌÙÙïx|ÍNœ6“ý›B+|Ãöâ¹àñu×ò:„ ü–dN[™_#}M&@6W—Ç.Ïf$ÐÈã9‰µÍ;¦È­:¹Tà +:ö〹(PÝ Ä9ù‰[©b)ö‡RŸ ËK¡iôPšñÀ_–«ôùŽzÕñ ã{ÝC* íȬIË%Ž¸–X»>4áN¦·Ï˜†èó–6J·xxßñÁ`µ»á­{ ÙÓŠ ÒýÖ³ŽQ—|Áàµ|7|¹Œö8ÀÛv º@$û„q.ú +{è]w–抷Ñ‹îr…áà/Žócpüˆ¶š„ƒ¢½$"K8V¾XÇêøé( @%`@#@žs“öøØ®›¢¿ßuù„ðÝóCƒ#;‚f—à•· 0œƒ'ù˜Ð g ¦é×|#lA"͆Ѿç´ìÛ¢,éMÞ!Ôˆ¬Zäk ÙÏÛ{~†Éˆ}Jo7#<53LK.ÊR¦´dlo²UKÒàÀ`™hêG>Ñß-ÚAK1âG²sÃ3 ÓuI0åi©×ÝNÜ­:RD5ÈÖòæ5ƒ™H#%¤§´É8Ù( Å…†ŸQIóˆçG‰ +Ü«€7\Æ;¡y î®pëÑnÂnì v}ŠéEV±å(‡"Š¨«uyä˜äzóp¶L\:È€›–‘]™‘Ž¸{¾ +=GHË-!â,²oZfúÜP*ÃÖ4„døåé>¾Â\ä(û`Š«Ýªä!¶TYK˜‰{Bž#¥»ñŒkƒK‘Gy¥Æ-»ÐÊq#åúñœì­¼Ób˜‡çS3š!÷eÀ’Çã¶äÙÛv7~¦·=º!‘™AÁ6GÍ9ÐFv!gM£Í{äµð½hä^¬âè+h®˜¹½hçW†>á8oé#Žý•<š¡M«'Î8˜ +$bJ<$¤ÐÙQD¦/ÉRþ¬%ù!êd®Ê9A ÜVwTZ h" +Âs›w ªLÖ“‡šjCHQo&”ȶ8hÄÄJùM¸lÊ’fðŸÏl¢uHÎTª0¦-ë6Uw·_yØp`œI¥’ó‘>1 A™m@´%Ògð½Àz06Wi™ÖØk‹X[’Æí¥’”"&˦•½Wœ5ëBÃïyÐúš}DnŽ ÎuÂ+‘€¥ÊÍWjx)ì>Iì²9³ |Ë"ªåP”¡‚Õʪ±[Ãu˪‘ÁñÕ›œ6éÈ8O¿äÑ«‚jk ù— ³¾òüÐøYÇs=åÚì^:ào9 Xëg®³xÄ­¼0âë‚/ Qc›!šŸ˜ tölê¨H'A»ÃTí¥ã@8™Äõã 4çp!D.|=ù¹ƒŠw5—Ø(S3ߣj‡ ;Sá½¥{x;XÓß×x?¼ŠŠk¡<'TÁãQ’%%Bt‰³"*ßÙì’Þ!Ç0ÐhG%÷ïŽ  ¬æbB_‚2÷“/^ØŒÓPI8„ðýV¨y–M!݇ˆtíFŽŠtœh¶BñÍw¡^ä3à>ÙEâ"Y‡þÛ›7f©F +VôÖn§bº~¢ìh,åÄ„äºh“}P²×‡Ð3Û—žXaZ“$`ѽʩÐÄÕœÞb[§m¤ïdŸuYHÕ]oO1~èš2º¾rÃD‚üûãá€6%¿ÄÌä~¤Â0rLš)ÊWI›)ÝH‚@’†+¹Û¹4¡¯b¿® D!?ˆ}®—t}\œŽåA!ÿX‰ƒÄ˜Û#4¶\38³/cÓpeå‚Ô‘‡—©ì$ž ÀËû+®®$}uEº3cXÂõ–Ĩ Ø“Ê@ÿÔÖ'ÛD/ëŒÒ†=ÔÀ÷µ‰> F¿æ9fM:–÷ùF.ZÔñ¦ù†CΡübÏ ©~ð{0“G(ËúZ‰)1p¦MKyõ§¿ š!­Ü0öO+ªŒœ­ÞçFä:”^•R:E¸ðBØÊMæÜþñ9ÿ¯ÿÀH±Tì%óظ®r- êÕw‚©¼$CAì ü?Jï×{endstream endobj -6487 0 obj << +6971 0 obj << /Type /Page -/Contents 6488 0 R -/Resources 6486 0 R +/Contents 6972 0 R +/Resources 6970 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6457 0 R -/Annots [ 6491 0 R 6492 0 R ] +/Parent 6976 0 R +/Annots [ 6975 0 R ] >> endobj -6491 0 obj << +6975 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [218.97 417.072 325.417 429.974] +/Rect [143.619 268.031 250.066 280.933] /Subtype/Link/A<> >> endobj -6492 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 392.701 133.339 402.269] -/Subtype/Link/A<> ->> endobj -6489 0 obj << -/D [6487 0 R /XYZ 85.039 781.388 null] +6973 0 obj << +/D [6971 0 R /XYZ 85.039 781.388 null] >> endobj -2578 0 obj << -/D [6487 0 R /XYZ 85.039 474.509 null] +2682 0 obj << +/D [6971 0 R /XYZ 85.039 352.566 null] >> endobj -6490 0 obj << -/D [6487 0 R /XYZ 85.039 445.105 null] +6974 0 obj << +/D [6971 0 R /XYZ 85.039 309.613 null] >> endobj -6486 0 obj << -/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F56 2890 0 R >> +6970 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6495 0 obj << -/Length 2917 -/Filter /FlateDecode ->> -stream -xÚk‹ãÈñûþ -s"ÃZ#©[¯ƒn¹ä²G>„»rù Û²­ŒF’wvòëS¯î–dyö÷£ºººÞU -7ü…›,ö•oÒ,ôU–m͇`s†Ÿ>„¡cåÇZÃxesgvwIä:]…‘;vi˜ûJ‡óéùÃÓ_£`~’¨Íói†‘¯Âh“äÚ×JožÿöTìowqx¿lC¯¼nw*ôº-üë·»Ð+Xmqt†$ñ>Ýh2lÿóüó‡¿<[äþ$|®’lv‘òUªÞ¥?IRx£žÒjxQ2£F¹¡?ÄèÜûÜŽ}G8ÞcÕµˆ”ãïÒá`ˆŽ0Þ„ŸùŒŽ(óÓ4%:þQ#ÿ9Å?Ji¯GvF©×õ#.(oÆÑè6TíyI^¤”À -чýY ~™Pj wð{R—8‘Ôý H=ÿiEñÖuqGI’ûyº dÁ)óû˜ð~¯ÛìBøiœÁÕ;_åb˜xcñ²2ÏÌ`ÿbÆH}ƒÀ´{cǽErÄí—j`ß‚P×¾éâS'ðxô ïên 0Üöæ†jä¥BŽ yÌb†Sˆf]Ô*÷~À‡ x²ûˆ`™w­Ëb`bùùÌ#z}LJy‹ÖWQF# ÆÃTêØ‹ö\ysOzFÇG|À«p °µ Ñ—µa+Di0gB -Û¯[>4ž~s˜ Nøê¢Å·£þÒâxÙZ¢ [pl…` ¢ƒôú`&õ†àx-`¯ 綕‚ŸE㡳ò†ÙXñIV¨)C¨SØêµ$¼£ü"p§ÁûoLÅ|Ç)EŽd"º–!̸K–^xâ½Qð_Êú*+È“‚¸ø"4lÑÛÂüUZý†kQùngP¨$ -¼_‹áp­¸W y/j¹sð( òߤ&!ˆÇÆC ƒpPñÛFîéiWžu'þem/»«0ѼâÁ =†æ_ˆ/pcBJº¤g FeØÿ˜E&jf”³¼°’WíqEyJ0iE†Fö7°B€ -†Þ?·™&]‰b§Ž{ñãW`û„|íq¬½¦ëK?ˆ^(ØÒºÛÈsr hâ…4FÆ’p÷À‹Ú˜Ñ6T(ÃúM¶FÛÍö™&vŒÖ© "ëÇ{䦰'A/•fi JP|,ÂOu¶ìïyiâR;*ÍIظE/T«t£ ]ìWVb i6y@²4çnƒÜÁ?ßË/öŽºcÞ•=o¢œú -Ž¢n½}·¢Ö5ƒƒèçH¼½tämÄh#3oà+`ï+¯VröT ãCoó#ÊJÇ^Û<`?ÜP±!…A-‘ôîø븓©–ÜH¾@cÀ9ËJ7ÛI¼»Ä+ë_QË;´‡®c°þV÷BcI&;8ÇU0¡G®ÅجJ0BTµ8óŠs¯®†‘GòÂ8·j‚ð¯U-&c$¢¨ £ -ƒe…Þç/8nÄ“|3´_]„;Ø»ŒÝÑžgÈŒ¾#;+M$Á þeÁ àQ™º„°kg€\mQ5Îäó Ê2a=õ˜õûºläÓò¨×T0×ãÔñ {QNÌn0xÆÎÜ „¿"+8@$#tþgž×6¬Ž”(ÔÎû;×ÜK-Lvãß‚8`ˉ¼º°Š -3Š¤Jìï2ä8>Ý3Ç{V¼e/æG섉‘ª)íf×PÑ|ã‰e+ѽ§™ö‘,¾oØØG6›<›‹ $™$<¦cìú¾L×þFîÜ@–Ë?0wä`&n­w¾Û¹¹e×$ý0Çv-6À[à°x0ëßôn¾Ò?YàDÂy϶ª»>\”k61‡ô¾s#0߸y oþ3ÖU±÷L* ŽÛü2#{‰UcͲ`I˜®OúAÎ$Aù_2å?LÈîI¤5JâH¹dÌ‘ƒl`:9XðZ ¬ŽÀ×jD©%jjžcë„$^éU0ŒKXZ9d3ŒÛCä±ÑgX!k€ì²e£Y¡+˽òkqà “WNm²iÅ”™ ݳcg½"Ì(øf®£òÀ;Ô&zó^1ÞÃ`ÅÕv ¤†Ë$‡øÊm -´&&+sé„CT®x·¾´Î»E1¸è]§f%´DYä'ßhÉN`‡¹(Ñ~’Û0§$ÌýHaŽ‹¨$åªïKY?jcGIòz¿Ó>yé" ‘Nk«år0ªÜ4$p¶[gÌZìs`U‚ƒŠf¼˜¼PÅðô±ã9«®Lrê 0nnÒ\ -M "Oü%Ò¼ÅdÇ ©ºë”p³îÄB 6Iïšœljo“×0µµ »IE×rïµàŸY„”:»½\Pñˆq T'¨%ž×6§ÀW×âf WBuðÆ@ΤÃtöPb .º*…^UûÜ™ý±\¦ -§ÏíÚw*¬(N×êÔ(&FDqÌî çõ´!Â{èùðWälº¾@‰á(î*Ág‚4ŒÃ€·×±Ãö£ñ'â(L ¬ò¦ØÖ@¸iYG—\ù5TWàý•Çÿ •Ø¢…5ž™óSköçj¦}âQ¤A§ŽåõÑGù¼‚i¡ÄîÜ™zú:¥Ë=ÐÇ *Óôå ŠÂc5¼Haú*ì ˇ™Ä3U‰ì(YQ–Þ}vi#Ì"Å“L¡¸V2ú½~€ÒÎI @^…‹’¿…ôm‘¾14{²ßÎË’ØÏÂLà°ë“ú7›Ö¿PÜÞE4Q¤¢¶ E¾(Ëý, §)!<ôt£4U±4rí؆«€yly€ëõ\Ap‰2‘ó¥ìyê2iíýÕa”][ò áþ;ûVY£è‡Ô¼¸ï&W¡«´JÐST':ºó ÷ñeJ>2ˆ­|á˜ÝêK…íiÑãxF%¯7Y•ó=߯È.QÔü]üEŨ+Èþ‰Àêð§ -9;º ýSÝŠZŠáºÚÃüìÿ¡YÁSµ‡úvüŒò šeÌâe‹n~Æž¦qÍ¥|©àïºÈqϪ,õ3¨¹Y»ß§„u©Úr…Ä(Lü8‹Ëë…²$ÀÈ—J#Yãä|ƒß!ÐëÝTp3mÑȈÒYjoÉÂ,‹SÓ¯õZ —yƒË~̱_Ž´ÖÞçYKmÒE›Zêɘf'¶zZ6õw’ç~˜å¿Ãä>(¹ÀI“ºAKC…^O»@òóðaòe!ïS/(J„òÀ$Y^« ©ßø°Yendstream +6979 0 obj << +/Length 2379 +/Filter /FlateDecode +>> +stream +xÚ…ËŽã¸ñ>_aì%2°Öˆ¢ž¹;˜d3AÁnÁb7Ú-[B˦¡Çôô~}êEJ²å4Ð"‹Åb±ÞE«MjS¤a¤ËM^¨PÅæpþmN°òó%IªÃ4I`¼²¸s«»,£$_Å‘3v¹*C(Äùôôáã?âhGa–éÍÓÑ1’QXéæéù÷@§áv—¦QðËVÕu»Ó*°[ø×mw*€^pt‚•, >4é·ÿ{úׇ¿?ùóå< ‹l•Ãh³‹u¨óø]ö3¸jR¦söUÊæìÇ|•c_á’2ør:Kü?‡¡±—G<ÊöwÙ˜pˆ •nT–Q9c#-ŠPÅ%±ñŸ¥‡¢1=|´N‚…í`i@˜ö#HŽFcß\N· ÆQæ:ó”‰C\èN‚ñËŒW‡½›¡ß3{K¹ÝÀÒéOdõ۶掓$ó膓Y9œïœC Ïñ¸ÍN¥9f”ò0*‹UA¦I0˜—-ÈÑÍjF qsv#ËßÎï~F€fô¦çÕ?"•à}eÓô“3úÀ¶øgG&Ðã2Êkn·N Z* 2JƒŸÚÞþˆëEpm+C”ªÕJÎkŽ tôkCî…£ÐñYh‡-0‹·1—S·‹ËÈÝ`À¥WÝ悼”ÀT;IRý¸©‘¸T² o Ê<™Ý\¶ >Ô•ÃfQà˜E‘ƒ(†9î™x˜QBË#1œÁ üííYEG€ŠC' ²“u‡Ë³À€¸yôŒÚ`Ïß3Þm<àÿ!©_™´ ÀQ¼ðÄ­@,d ¶G^ kƒo]µW Þ Ýî…!Ïw¿ +)’žÆ’BÉ£àWClí #5ŽW‚ø`H€tôóŠEìE_Zåd“ª › >˜ýÁ 2!œSG—¹òÌùˆ[Ù«Hɼâ®Z¤ó¯$‰v¤d€œ±uLÁ¹$œè ¨\V#:@ š~iÚ–5ŽÍExªÀ'5"²çA€t]ÿ݉c¨«H3UóÕ…¢ÓšŽÇgôÞ{([9qÏ:J4P#ß¡&Ó½õ288 xvß»x¹oßÜ-œ »Š"Ý9z‘Þda0©É˾ÎÕÑx;ñÆF5žêJn9sŸƒìf5ãÖ\úWÄr[PÒ÷r1œ…0 ~ã!!øN̤—pÂ&Di‹¿†sÜÞÞøB­½N1µcTÔR×TDmß~p‰#%JGÃÇ Æ!³2#ywzŒbL:YÜÂåÚ„­ƒ”3¬ÏÕšÐåìÀcFïGŒU8à–B¼t(üò ∈î‚DÆ:r|‰¸€@cÏ×ðŠ¢±¼ ¶% bP˜Ø£{¿öè¾W>œeyÇoJæ>è¸múaEû“dc°µ¸±/ ÐU”HcJN왉 +¾6Ù +Lú±Ÿ)ÿ ÔY„sd6 \QñvßVg9ÕOA˜á7—XÒîrù`/’ÚO#bªþøñÞ›Ïù‘8\âL qc`H¢Œ8Âï¬Pt,¢ÚðÛ£i/¶¹G7‰òàWd‹\ù7Œ°¢5£Ö „$1[$“ªºŠ‡Æ þˆÒÈÈ‘­éeDqÒN‘°¯¤QñÈ¢.1¨ÜËbì«NÜŠD¸æ‡³ø›U½,#ÈÏäp¯ÙSå…›,C¼à[ÉKSZóÙ߶hû#ÛÁò¬8uùFmã+ÆX²5BÙÏì ïj;žj7\—gXv ÃâÔÃÔ{Y1’•H,û³àµn|±A˜r«È—>€¦šÉé\Œ”²ñÀ íÝŠÂúÆKuR˜üÎèÈ©jϨWsªDÝf¸o’0MÓΡoMâïµ#‚½›¡S; —íÀ’&^¡†ë_?~ìÍyoBÛxôñ–(¸XrsÓ’Ê ‹Žä†ŽoHVZEÆa’ﶊ3œ‡+D¢0‰}ÇKÇú3ÛZÕ™–»ëær´Xï²2á<ìZ!ù„©bÛù´ì}`iÑîøW \(Æñm‹‹0_¢¸z¿ÀŠWı1|&…wEé[2+ ŒoŒë «Îv=È.‡îåß“7#¶¼SÜŸÓZ¡=kþ¨r˜wïU–jë¯HÕRÍSäÐÁpy.#$J¡”â_aÚ³–S†ÄU'à¿lÕT â YoÓ™¯áa§ëŽ†šn|b(—Ó0@ôñâ˜é‡«éÎ2³sWË‚Ipf\Le–랥¾²×Wð@%ÐuÞ|.2ß–Q[þ.+b,kÐŽs™D6ª8n»äSÝÅ-‡e¦®ÁÃcîÀK·x°ˆ[‚½›¡¯ÏÜ|znðÙ 6Ú%o…kê|6?óºáUäÆ1ßVò0ÁSˆSkÏhSwGovÞ{8Ô”Æ{´‚ŠÞ×üÈקྊNjöæË~%/æ ª+¼Óµ³tµ‚J§PÁOŒ[7'_Su rWãàL ÓÔˆè"â71¢îŸi|Ã&eE ãô;Å]7º_5ä±Â:> endobj -6498 0 obj << +6982 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [232.013 625.659 270.975 637.349] +/Rect [204.74 585.012 243.702 596.701] /Subtype/Link/A<> >> endobj -6499 0 obj << +6983 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [341.801 435.668 475.519 447.66] +/Rect [243.558 367.922 377.277 379.914] /Subtype/Link/A<> >> endobj -6501 0 obj << +6985 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [250.165 336.599 295.309 348.288] +/Rect [211.983 228.205 257.127 239.895] /Subtype /Link /A << /S /GoTo /D (diagnosis) >> >> endobj -6496 0 obj << -/D [6494 0 R /XYZ 85.039 781.388 null] +6980 0 obj << +/D [6978 0 R /XYZ 85.039 781.388 null] >> endobj -2582 0 obj << -/D [6494 0 R /XYZ 85.039 761.463 null] +2686 0 obj << +/D [6978 0 R /XYZ 85.039 761.463 null] >> endobj -3060 0 obj << -/D [6494 0 R /XYZ 85.039 667.044 null] +3166 0 obj << +/D [6978 0 R /XYZ 85.039 653.495 null] >> endobj -2586 0 obj << -/D [6494 0 R /XYZ 85.039 667.044 null] +2690 0 obj << +/D [6978 0 R /XYZ 85.039 653.495 null] >> endobj -6497 0 obj << -/D [6494 0 R /XYZ 85.039 642.326 null] +6981 0 obj << +/D [6978 0 R /XYZ 85.039 615.228 null] >> endobj -2590 0 obj << -/D [6494 0 R /XYZ 85.039 420.224 null] +2694 0 obj << +/D [6978 0 R /XYZ 85.039 352.478 null] >> endobj -6500 0 obj << -/D [6494 0 R /XYZ 85.039 393.913 null] +6984 0 obj << +/D [6978 0 R /XYZ 85.039 312.618 null] >> endobj -2594 0 obj << -/D [6494 0 R /XYZ 85.039 282.629 null] +2698 0 obj << +/D [6978 0 R /XYZ 85.039 172.114 null] >> endobj -6502 0 obj << -/D [6494 0 R /XYZ 85.039 251.104 null] +6986 0 obj << +/D [6978 0 R /XYZ 85.039 129.161 null] >> endobj -6493 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +6977 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6505 0 obj << -/Length 3381 +6989 0 obj << +/Length 2829 /Filter /FlateDecode >> stream -xÚ¥ZYãÆ~Ÿ_1X,šlÞyÛw1âÍfgÀ°ýÐ#R3)óˆvþ}êêfS¢‚Åû(vWW×ñUQÁ½ÿ‚û,öü0¿O³À ³ì~{¼óï÷0óÃ] !Ù84ïŸî¾û˜D÷ïå~~ÿ´›Ö‰½(_WýÛ»ÏO¾¬7a®ÂØ[oÒ4[}ù°VŸÿñeE«§õ&X=|úIÞÿüÃãú÷§ï><ÙÍí²°QŽ;ÿq÷ëïþ}\þxç{ažÝŸ¡í{Lï`k/ŽBé×wwÿ´Kñ\tÏo-43/ÎÂ등sÒ P^¨û4ö½Ø訯k•­ÚΑú«3vtƒ‡oa(óW;8sÛñt‰‡þ -úˆ­´ê§àÙ.ÿƒ¯iÍCG½V)lDçõ:òÖØî1ÖðÇÉêéPA§g]÷HÓò뺮[\ÿ,³3ö‡ö‚Ïl¼tÕ±äCá%Ä6 -4'œ«áÀ·XÀÕo~Òûy…戇r;vÈÙ`΃¯ý@ôÇ%F$–®E^€jK¼×L;“MÏcÔ¶Üi~þ{äófû¶)¹A‚×[\æP5@Eï{t.¹h÷pO‡§¾ûºz ”—‚¦E|ö¶m³c²™ºD¹—&B&Âèèc¹î$¸ºnªz~ÿ¯ÈcK/¿ÛQ¦Î8E’<ðÀp(¹qÒ>–,ÑŽ‡ -sÊgT“ýÂŽ° -…/w“…`%"…˜x?hÜ6H÷àͲá®h_=UÉh[Û ;áýº¾jQËX­ÚO>²9ÀU#{š'5LPÍ7¯š=÷;³Ë QM)ô»¶3/ðM§«¶Ë®˜¶ß¶¤ ›…>$`Ûç --ªHô¢E»eHÀDÉÿ¤ Q XIT›ô¬~›<÷ü<˜ñòÙõC¾¡’Ûø©´i –1Þ§¯ Ç`éxÝ%T²©ü–ïFÞÔÓ-ú®?€·ÎU-+vå¶í -nk~ôÕ¾AkÌŠè÷òÕP¿Ê–K[ñíÁì¥úJ¤ Ç¿6â|F‹ÞïiQ\"Šy¸í£X³ÀûEf>®³]n±½·ýÀ¯\˜ÂžG–kOìY;³\Ïã“D ƒ®˜Õ:dšÃÔ¦•I acÍãì÷†A¿Ö6rÕûCÙ±üÙ›=‹3âèO¸ `±—ªTæQ °ŸXìªÂ+o ùJzî˜ „ŽbàV†n2#{cêAÖä+œÕHÆMF©ÈËcc3¿p˜ p¬ƒb\³C÷­7àEŒÒ„TÝ•¢Ì{I«€_OE3¿¦Ùªÿ@4æ‰1¼/9‘’¶õx”>y­Ð±A+Èyjï€Imø¼šHs(˜Œ¼œŠƒ9?… “ñíÒÂP嫇f(»F“#GåíÚu诺þ3²Ê›ÜL4·!PŒa"Kˆ‡j[:YJ&$Aº-œÑüxø ðÓ»¿sï×/øàAêÙ’Áh|1¨¸KSLÁ - ØTóÛòÖà.©Å˜£0³‘Ž¦ݸsm™ûvà£è†Ÿ£5r‘å ¨qH‚N/Ûg2íZN‚Z56¸ø@Äq¸z ªžŸ§®%fžÑ‡Òβ*mºçã°—e'E³¨åz¬-³ÅÂYt}l'<ö^Ç Ñ³1î!T 2ÝôÜÔLÊž—‡(ƃ~=Î#6ÌüæÇ>pŠj²Ìä?a±ùOãúqÚroÂ,‘´…Ž:LNxqá˜}»£…Îȶq˜ ®!^l•W%aA¶)h”$¯žTÙE¥·ë@`«Q Ï,d­ƒÙ¹ÁE -‰gÂ5wNÈ_û¬QŠxá8f]¯J „l¥Wkª²0D ò‚Ž/ŒçV dì  –pý„¤ƒÄJÛµ¦ $?½çÆ•Ppí\ñ•Lúl.Ú3ñxl…ŸÈž*v-“šÁub ” £NèdI îËÝHâ¼V„J7zÙ°„© -'A†êPº©Ç³õ'G'yi¹}ªgÀ ßšNüfX¢•4e/1‡Ž{„¹Ý•ìRZ2Ë›)É/oFhÎœ¡¶µc]ðä{˜:AêÉ·Ëm¢A1œ¹?µ>:1€mÄ{UY`uÛWâÀ¬r€þ;^Œ;š¾šèðÚU²ú<®xÔTS¨·T·+5ßCÃ.Òø¬hBuœ ÔQ–Òºx.ÂÈ÷'H‡)YÆÆÉD°;(r ?89F~àÂzìêÓÉØsà¸#YŽt4Ï9ö\"¤0÷òÌ $ÀÞ宪Ë~ õÅ^ØdtC«ìfÛ¡íäp^ø4)°(ñ2?›£íŠðG6:e­ÑJrÇÐtê‰CQ#ÊogñIúyÄ€©x$qMªÜÆ,Æã ä'àÉf '¶ÁÞó¢S’ö“qɈ çžcè¸:ðbS Ñ0öâÔÙkHNlǨçÖ¶P½˜h´Nb˜Ù¿uCÓRâ/ Ú¤^)¼,ÏÏRbóÏ &¯öÅ37 ñ,¸…ʲ '›ÄSi8[CT±‘sFj´p@!dè•Hfćž›CË”Q§yPƒ8`ª–GˆMš",å+6­‚Íîñ(n"¼à¤ïìdöß ×îÁÔ(æÀ"…=×”&`{C@IƒÑê˜=E¬¯xq„E!ÃÚ–õÝ©sãé”’ÚJ"ľ4”Ò€~´ ´à{Ìgº€S^”š¼î|˜j'b£÷&^˜äBN;ÛŦ°éh^HÐN$DÃMˆÔÛ‹ìÆØ9 ¹J.€¥.BNµÝŽãÚØÛCæû°CöñÔª#¢(˜t·#!ç¹›w䫗Ɖt8ÀåØWépl’àãµs@> õ'wç"!ºÇ‚§­ÇLä`‚¥]A ‡ù¸õ]I0/iñâ'I!·R(à—F©û§Ñ„ÊÍ aÁÐg˜}øþÚš è»UFèìËô"nù=ößS¤:b'³™o‚ôgÄT#Ib{¸ˆ£yKñ€ZdJÒÛ¥š5@ë r ®¹åw2ÁŽrÁÊ ÄIQèr‹®“µ©x‰çY£îPAV11 SÊ -^9ÙŠ’R™§©(fXp ŒñdôÚ,Ê ·ã^˜4ÖgN«(³}"§2‰Ätfl°nÒwåÖ•AžKÁ^¾À ä4®¨ëÊâVTjEÁÛQÁ¡¹‚ ó¢ÌF…D¢Âçuȵdvï©Ý`FÖx“™‰æ¶oÏ#/•ý8 Rɧª!hÌÀC½õƒ2ÀØØ(~¥›£ldlž›ïå¹Ádá Lž,gÇ›“ŸÅ²øŸ@NâB›ãê¬Î¤Ðe×2v¦¥™ª¥èS^»ʵTp¹vÀÝ ë¦8ôñ8EuªÜŸW'pÀ©1ÒWjl…úbýÞèÞÉÊ®—åQÚTBŒéΕáÑaÖátQAÔ_ý4•Áp‡qÑ&QÊGýÖùzO.YM?Áà)½×UC*‘pÝÛº´°+™Ý8œŠr@Ô&¤Øô6|t[ÙÔ¢oú=ƒìv”IDÀÅ›É%èNü•¤zéç%æÇ3Æ.ë(ö—·1"xo•/™üçÝþ¯ŸY#ŽB/ óeŽ•òT`x!w’¤—üšŸ"]1ü_äå"1X£·A§i¢ë¡ã+ÿåù!œhs¹Æã9• +í£aÑ6Α¯}dFüâ×ÄÙ«×Àr¬*†==¯"íŒÿ=Ý?òB× +—³Ç×–¶à}Mo€Á]Fxq%•g<êàõ(8€¼A®5w-jð®¤Î±j ©ÀÛ(ògeL9’ÍÆcÅdãºÎó¶ÌÚÂÍuM‡áÖ'º£äš_6ðla‰ì{ž5šuB9Cƒv(ù=ÒH¬:ÌžÔðDOäfIº¹b×|KT¨çŠ§œ?ñÇ÷ì·DËcÖ%H¯¹9 ýM ´ƽ®o=Ñ©oêjwCo/Ýïš67è55jB^XÔ„€ÚhÊtq IíAÓ pÑ:ƒ\øï;¶¼ÿzæK’ Y€IÅ@P_…1/‰Õ²ú£lMýð‚§cÑ|õ%jà}r,8hu#[Ý¿Þ“Ý×UÑ":´9pÝÆÙÐä o«Ì뎼Hª ßÜ0 +Ÿr*ÑJ²ÄùÒ +ÔQ F‹[*œÇ“8ØÒt3z¨,5*í%˜Ty¡iÀâ‡U:á$"s|‡Ø±pØ+žuóÈ—‡¤¾+nkiAš’ï$Êp²#<9±DÇuªÑíÂ¥÷Gä?î‚›%RÍl¶uÈfºƒ4!Vâbñ n € +£DU#*È‚A\O¨&Ê+`©š` dÆ™8êý‰Ö;ˆ´—ÉɤL0,†="x7Šòvõïò‰X&Ç…=[k'jéÌiCìù’“•û‚Äõ2¾ïž¢d\övÑü|d0ä…WÙOE¯ã*졬ë ¢éX›î$ËÌhœü6¬B(ÑD@+„EþÿWn#€ÑQ öÝ,è¢å=Ѩ|Ý%‚8"§«ó¢Ça,yE?ÓìÚ7ÐÎñ{gO5>2çq% ¢ÐU[ò|R£QÏÉùj2$ì8T>˺ˆU¼Ÿ‚‰@Wr¼jÑ­s’óyË¡Ä µ$@È‚ 홑¬ygBÙVâæTOúX¿˜ ÍÞÄk=Láßq¦=(ôo9ÚRŽ½ŠÍ´âj@ÄUôNQæ|”œÜ¡ÇÖÍF™^BM{Ý#kI茞)ey0¥1fãÅá™”`o £HªùøPŒ#)BHRXqdpºå‰"òSç+s«G‰¼¬Ø:Yð¡¼aAømͪ®Ž”²OìÎqO9hª£ùœ¤»#¥e%¯¡D"/€ÌèæÛ`H§qå4„“Ï"ç]“åâX3Ì?±\ºÅ”ò'^¯u_<$MèêS#ø(‚êBôÊ5Ò¨Ý %V˜$nš†oV€ ÕE솮 +c«.‚纡ÇI}!Æû0ƒx?}K¢D?…é»­òpQ(LoR4Ã\¬ÔBÊ:¢çËó÷Y5aRR±ÍŸ/_¡hýúþ¯<ûx{‹À?ÞZ™A¦1èRê Tûv™ª†ÄÔ9);¬b˜ÁG&“‰S`t·å„0!ÿLdv†Ì–‘ŸÚâùzEÎVŠ°'Ã7TeK̇ñU#”îD‰ÓŸÐ[z%h~è|yÏT-†þŽ2ôy+ô™‚˜^Q6¬Ð¥±k¡]Tj}ªG9Ò +5º#wì§$ 0mp$¥Ð$4è•Ûuµ)|¬èÆeHäÑ#k§$–RädÈEKu˜¦wœ\ÀqPãd²Ÿk›Nª¯áeΛp}èt\b´øki jg@•"¦XËr|4~JYÜSz£CñG&ïAÁç’–GÕÈß)IG?ˆ§ÈýXE É? :@;b·U‘ ÙX[/I%qRYÉLáŒÐy®‡7jßÐçœQ›ðz™s÷·¸ƒ×X¦‡ S”dÂû~[8lo&ÇVfAQ+çð'!d‘[Îù𢊺%Ldåh}€n¾«g¥E°×íÆÈGìÐbÂ(îçéˆZ-Â8÷ÞÕ³fñ÷‘[Ï£}Ò¾>å³~VãÒDÎúEʲ£pf,»“®×Ò¬¹ERüÂz2rËŽXx|œjž!±ïX—O&G…ü?ÊxV_Né¬è°Ä=09œ–tÔ|ßÈ·)ç[='W‚­Ñ&ÐÓ=FÈ;g»lä<±à ÂO*ò·ù“eVŸ &Üg =bƒäÞ8åÜfä‰æϾ£º^€kkä€$_’CÀª£³ÓSÂâ²v¶ +’×±ë_€2Ê,›Òó'(2ËΨ»çI×ᵲξ\Áyç-³#%z0«„+ì(|&V#e˜úlÑl¯ žVÒgãôýé Ř-jsdë¬N$·poÅd©»7™ìâ.6#C%w_³‡h°Ír‹Lã[|üNjÐÝ|Rv‚CåÆ*!Œ€! ,ó†f—óˆô‡ŽûkÇcÎs±y_ )è#Û¹ŠÛ£°ü¨‰¤gdµð=‹At^ÔK:)Å ‡ˆVÚæ¬&\tceµÙd¨Š%‡³Ù“œê˜ïGÆ!<™9]Å +O4[Í»•PDÍ0prŠϦm®¸ÑÀ¹^À“ú™Õ½õ¦Z¿œAj$î- %ÂbÇŠ%–„‚(uAŸ@$ì‰Î­ŠRÅ.ÆG"ŠÊjb@@‘?W¹¯ò ”÷z/äåS®B<ß±ÛGíÔ ²Ð£äÍ%}¢ý©ïç†04Â. iå¢-šVîH}²•X%ê÷‚ÓœO)/°4&­u`aî-â„Ó‹bÎL2êñO6º-Oœ÷{äX8Ê;9¿&C?uƒÌÈ&¯= k^f‰@usƒp®ï)²Žü«ÌŸ^‰ÇSâ„`ð*:2BÇÜøøÁÂŒ7ËÔB˜˜5W”•r0b#Jj7ÅTªã§®vä!ûžÛ”âÜä¢ ¿žYÌîBq@Å HƒN£é0ñžEœì¡’çT¨1›jZY%:ѸãC”|wý¯v§‘ųæˆv©k`zê¾ü‡áí”D4¼Ìib0盘Ê2û®­€¢»ï϶ŽŽ*”|Î +q›ìT1{‰SÏù¸Hr[Æ…bÂï¤ìxš¢Hû=×›¸°Ð~"…Ó£bŠ¾P¤¡óî¿øÙeî- ö0‡.ã•QLeº/bÇÅdÀ¼`ºbœŽšZ'Õ—ÚÊc[kÀ¿åúyn<(7UÙzß! +7ð -È»ÐOÎé5?6¿"ø?gºsendstream endobj -6504 0 obj << +6988 0 obj << /Type /Page -/Contents 6505 0 R -/Resources 6503 0 R +/Contents 6989 0 R +/Resources 6987 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6510 0 R +/Parent 6976 0 R >> endobj -6506 0 obj << -/D [6504 0 R /XYZ 85.039 781.388 null] +6990 0 obj << +/D [6988 0 R /XYZ 85.039 781.388 null] >> endobj -2598 0 obj << -/D [6504 0 R /XYZ 85.039 623.55 null] +2702 0 obj << +/D [6988 0 R /XYZ 85.039 477.884 null] >> endobj -6507 0 obj << -/D [6504 0 R /XYZ 85.039 596.935 null] +6991 0 obj << +/D [6988 0 R /XYZ 85.039 435.599 null] >> endobj -2602 0 obj << -/D [6504 0 R /XYZ 85.039 262.887 null] +6987 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R /F62 4047 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6508 0 obj << -/D [6504 0 R /XYZ 85.039 231.362 null] +6994 0 obj << +/Length 1187 +/Filter /FlateDecode +>> +stream +xÚ¥VKsÛ6¾ëW¨7p¦dà㘴ŽëÌ´Qå”æ@“´Ä1Eª$XÙÿ¾ûI¹‘uéxd-°öñaw!¹áO®S„*['© Tš®‹Ã*\ï@s»’á;ˆ†ù°]½ûhâµ ƒ,ÌÖÛÇÅŽ ´QëmùMüòÛûÍöæÞó•RB™Àó“$÷7ž›Ï÷^ªÅÖó¥¸ûã–!¾Þ~ñ¾o?­n¶³óÙ,8ÊÐóß«oßÃu Q~Z…ÊÒõ ä0 >¬Àu`´rëfõeõçlŠuzͧ.%:!|™Yd®“Ë@Çj&#­”ŽÏÉ0a`BMd@þȀљxï©PX›ûºÝAêq"lÇß9~Å¢‘˜¶­ªÅïñdX) +ÐU¨<ü¼Á›N‚Dêë™,ÊDš ×*£ ùZ¿¶à±ëíˆÑå¶j^  PAMw¨p¥ÅØ‚º~v!ÒÖ_¡ ]J¸<‚˜÷w +D¡½&ïY98CFôS¢ýo½(–AMM«ñ™xò¢”¡x¦­Š¼JÖ÷Õã8¸ðˆqø.9Ž Èy¢éœ_\êÆÉõ#r úªÅ%v?a°9y}b4*ò5…%bŸ#/;Š²tL!QåBÑiÏ” Ú‘qÀŃçÃ,!~ÌÖÙîðN¬#ˆs†jÓÊ@¥JLÉVèlÇgNµuö-lîkgj€«åm0Êî_(%[ñ‚Mš~Ï*.k{i<Ç€#‚ÿÐûÒu×2‚dšP!±ZãñH¬â$å×/M¹†ÂPtv?§šZΓPžó 5ÃØýçËôÆ¡Åaœfà–6pu,ν´Øý‘‰|—Ó0usŒ[¿¨k€Ú–—¸‹unŸ¨ Ö­Xà""ö +בsó6•óqp÷…òSÛ¡í¯ˆ›ç¼°ôë‚:;·×Cx5ˆËë-®Â Ê.5|˜šÿõ{snM­‚Te—;ÓDQÉ)¼ +-ÓÿÆkTJ}ûCÀÿŸ}Ãêendstream +endobj +6993 0 obj << +/Type /Page +/Contents 6994 0 R +/Resources 6992 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6976 0 R >> endobj -2606 0 obj << -/D [6504 0 R /XYZ 85.039 136.417 null] +6995 0 obj << +/D [6993 0 R /XYZ 85.039 781.388 null] >> endobj -6509 0 obj << -/D [6504 0 R /XYZ 85.039 107.681 null] +2706 0 obj << +/D [6993 0 R /XYZ 85.039 761.463 null] >> endobj -6503 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F56 2890 0 R >> +6996 0 obj << +/D [6993 0 R /XYZ 85.039 736.911 null] +>> endobj +2710 0 obj << +/D [6993 0 R /XYZ 85.039 639.845 null] +>> endobj +6997 0 obj << +/D [6993 0 R /XYZ 85.039 599.682 null] +>> endobj +6992 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6513 0 obj << +7000 0 obj << /Length 221 /Filter /FlateDecode >> stream -xÚu=O1 †÷ûsCŒclj3 L  b@´ ª -øùøèqÕ¡,‘Þ?vò—ÀITK(fðô6¼¸r5¤Ù‘UPsöÿŠÕÈbØòjCœ‡DÍŒîuËyÎ.™€ KèÏÀUÐ@9¡6ƒ¾½·£¤ð8 -…÷Ï1J©áîLJ~sLf¬V§dä‚*ì, -ÉOvs8x$…Ý~ûúµû˜RÃE_ˆf \Ø«Ìäu¨üGýw3!ä¶,–a£6á – NŠ©_OM`é9ø ½X&endstream +xÚu;KA Çûý)g‹‰yLæQž ¢•Å`#âbáq¨…߬·.x¬L3ðä—0?†jHÚ TF­žÞ‚W®žÉ-%ÿ¯ˆñW¢[ZmˆóhIнn9ïÃÙ¥aÎ +ý¤(V0a´V¡oïÃí¨G¥ðþ9FÍ%Ü]ãøÐoŽÉ„¥–)%£©8KÃÊú“Ýá°Ûo_¿vSj¸è Ñ ”²xb•™¼NMþ¨ÿn¦„Ò–ÅØ€ µ OI1»x´Lp‰Û)ùõ¬*,=§¿$X#endstream endobj -6512 0 obj << +6999 0 obj << /Type /Page -/Contents 6513 0 R -/Resources 6511 0 R +/Contents 7000 0 R +/Resources 6998 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6510 0 R +/Parent 6976 0 R >> endobj -6514 0 obj << -/D [6512 0 R /XYZ 85.039 781.388 null] +7001 0 obj << +/D [6999 0 R /XYZ 85.039 781.388 null] >> endobj -2610 0 obj << -/D [6512 0 R /XYZ 85.039 542.44 null] +2714 0 obj << +/D [6999 0 R /XYZ 85.039 542.44 null] >> endobj -6511 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R >> +6998 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6517 0 obj << -/Length 3034 +7004 0 obj << +/Length 2085 /Filter /FlateDecode >> stream -xÚ•ZK“ÛƾëW°|Xb1¼tŠ¬D¶SŠ+¥]IåŠsA /Il 7ûïÓ¯@„œÚ=™žžî¯XµàO-’ÐLºˆå›$Yä‡7Áb3?½QÂaCã‡ÖÂxbråfW‘öOòÈ«X¥¾± -y~|xs÷Q øQdÛ…RÚ7J/¢ÔúÖØÅÃæßž‰üå* ïçji”÷²\™(öÚåJyŽ#/¯ÏåRyû‚çîßÿóÇ÷Ëÿ<üãÍß:dÿ( |«æEðˆ*\¨ÀOƒôBÄ0ö£$"[&Æ«N°{z9J–ù¡Â‡5ÈÖf¥ÚGS^CŒ‡¥N¼u6 ÁBÊ«sâRÞª?´ð¯_ͨØW&ìD¢³áD½ŽÏƒS:îÕ€}|Ìë5ñ˜ -w¾ ä…; ‰Ž·ÐŽåÅÚ$¾”ïJ÷Žç;R]­„RuX{ËÄ’A€šªKgLÝ‘Ä=“àûê$G¤´(÷b¥cã«ô£À¨CÚ‚_¨»#VÇ¿À’Æx¯8A9]: 6’_Žû*Û0ÅiÞ͘²å;…Ñ\õë=?T5ÿž†=î˜X7¯ÇÜ¿eØ:ô#“ÌvÏã|OYðÆè°ƒÔOtì|O¡÷ÙÔ{Òä M^4 ûݽ°b“Ïkª.Œs¼ŒÀÛÈã¹Ìø­_ñµû[ÇÝ'ŽÀ•~˜Ù3†iêÚ^œQù)ÞdƹãhpFå)™_Pã/µœÇ§¼å›¿!·[qV´žç6®„@_¢H´û:èÐ+Qï:•ö¼ÂÁFæü›É/MÇlóBbK?—5å SP ÝÈjïo²6Nìݵl|j -| {…õ~ÂàCuÌOuí¼K|‰¦¿"0õŠ<+`—²)ƒIYA`å¡qGÚ»u&ßä”°´Â) TÌòCŽNôè6¢§'x*?0J“íÝ:òÖnÂékfM·&²|ýà6ÖÞ±xáÁ5.G†ÌÖÜh6`%Ý]½m&N{^†‘—Õe%Žmƒ˜•hƒˆ`¡ÎPL>`! (Ì ÷ˆIœ“ - ïgÎ%ã q+ºˆW‡q“;`‰ p@×ÃW‚·‹.P§N·)l÷î^óJACŠYdºÆâï1{æ8>#‚4ç -Ãuè=kû÷Z·Itã¹ùŒr)h¿Ê’f€­·é펉Ֆù¼ðöäyEk6¤H\°‘MÛk0°&I-B8ŒNÂïDbǽ°0˜!0\¯‰ŠylÛçwwwVÖkÜÍrÖ‡­ªÞ1Ë]~nüÇö°¿–W+ˆ§^Ø4òcN¢—2ˆ¹z>s²qê« ™_Å~(qà«|X \¼Ïû8ÃþSÅXãS"XãEínÀ±B_Ï£qÏrŒ­üÔÙ":>x1ySÆICôø"Æû zæ&C#B®ŒÉè§5ºLIWžºôïr½—}Y5²$Í2:W}æUÕ²™jíÖ£ bk˜F ÙÕ' Y¢¸N4g³½W•]G'°Ü Ÿªyé<[&àŒûïxkH™tªÙɺ3Ÿ6yðÍ¡ -…r/û'ŸIèyž pò2ÙqÃâýúm{ Y#Þíü‰#ÃíÖCT&úÅqËaµÌ`vȬ5#ˆm$wÛòïÕºìóþ넯)ê8ÉB´…†7JYú±jÚ[‰ø¯Fó‰ß€§óË‘±›TùÊ^¹åeú—;ÓkÄ¢)±“¬6¢Àò²„`X¬o+{ÌÉÚ³ÜöKpu×Å—Å—MÐò»(i,V^r³0î2UçöNVmÒ%ø|7@ØÒ•Ÿ{rÙ<óíÛ7P8ï¸aÌ­’Ù¨ ¶Èö{ÎKbïEHn³y2J¢»Z­F®Œ4w(«Á8æ·RÏÅ9­Øó6åbƒ²£ÃâFÊ}³Ž~ Ž@¨ N6«¦œa¸"™ÐÙ3Û7"¦wÏz­ž„¡uON]œKŽÍèÂ`ùŒfÆœk§1i_íš!&™écâÄå1ñN@¸ß¨l<ÉúÙ‘|5O<Ø"ž’4ü¼ÁÈ=0IJ;>ߺÏŪˆ×‚(™$l’5]!ϸ•”ªæY‚[ó!$¾™r}iô9¸úò_þÄï®ýZAæ@©àÖ˜Ïx÷jÀ>Îx®×e<˜Øä»rWÉqyÄüæeŒ9&†â6´—²]¡ŽNRØ+üSÙN?ÖzEuÙM_Á¨þ¿`Žs?Ýê³bö<·TC@æw‰ © hêüÀ¤vTu˜4ì-æ¯+$˜î*$æ`LM)WÇ*Ëêz'>â™y@¹AyYN‚ú"¨;ìJÙ~‡<}ð”×û– @¹ÏÖî+Ìô¶(Ûì_þ@.ÇãÛߘV -#H¸`&2˜($]aß1=¸V)}[<Ë k•Ì.¡<„Â`PÉõíÐ5³ŸÊýï#•µ{Ýe2°vñßìð¼—õÊV~Ù¸VIzÆ}ßS÷ýjã´HHk†Y Å';äv 3´ç®ä%ï"}£DD ×Â)Ü:}/ÜBü‘. /WÖêï/3Y^dJ\‚–]â×uMÐP\IK/¿, Cyç´îË74®SÛµú’*¯êºÈå•q‹‹éGF&:œáîc¬‡¹÷ø&?m]BåK™.ÚMœxTãðð$í#¢_×^’˧ŸDÓ_Å˪癨 ð³ Ü:(—u›”±¾2³{1ÇüV&¥Þï`«_ŽM‹Í•5ô©@ÓÃï²DãÌÐ,R¨±3gt±²à÷nÎþy5X_Þ9î…5‰|>ܶ··èº,ÀL@ƒÇ-›5EÒ «mëù·n.2~Ùù›ëynßœðàÆúÖÍÍí%77»•ÜÜ`«Ï§‰ÖC^‘ýK?Ì2pv%9ð»ç>£ö?•÷î21ùëu[ý î¤d¨¥Á$)ô¾¢’ðxKÛaàkÎk»ç¹­má¡ -ÿ–¶çömÏn%Úlõí±/‰ùwÁÏ®/*”î3@__rqÿÂBUo §×î‹1]å¹éÂìT/d»hªÜné:ΉÿèŒi·7MÒë C“€6Ìíÿ7e¦endstream +xÚ•XK“›F¾ûW¨| ªŠXæÁË7ÇyWNÞµ]©8„„Á ÝÚŸ~ ôp¥tÐ0Óôt÷tý jÀO-’ÐLºˆå›$Yä‡7Áb+¿½Q"aCã‡ÖÂøÂâÊ­®"í6¾(#{¬b•úÆ*”ùéáÍݯ:XèÀ"³xØ:C¢$ð“$\\3[4Þ´l”¹Š!6|Ƹ{Ìš„#k"¯Ä˜›ø,‹WYņ×\Îó1òœŠË'üsÙ’?Y¢PXM6 ½Ÿ§» ª‘Ê@õCvüüS8ö¾ak”Ö,ÌŒ"X;VXñëµà„ŸdzS—øÖŽµÝ¿ºµ•apR}A [*­×7üÿ6ÇöEŽe÷H +ßò +š—UÈ=ÖR«ü˜uÃëhýáPöoGåuñ²§!—(Õ!\˜ês(»—T®èèXìyF^Ö’ŸGÙl€ÐxkŒEV“ÝÒÐÿs×´Yó¹à8çüÀ ²ND§Þëw‡7äÜnº1îvlL0¦yRØ£uXLáò¦¬­Ü^¥˜E +JáÓÈžzçQë;—tì)»ô°'y)#îÃ+EËsn-㿃Cù5P–ö‡y‡ßh"M4[ü¨m²¢¹;4Dk›ZöØÒáÖ~3ëÏúYb¢’…µÀÔ|§ß:éÕDœÊßœt¶™NŒÈ¾ïŸÞÝÝuH]ü¦Ýñè.î|iJ€æøþ43öý¡š¬‚˜•ëÄÃË ¥µ¨ +}…7qÌÂv6Io"¬ÿ4Õ'«a9é %¼ÏÇ^Bµ‹Dú‰OÌ®ÅÓÙ]Á\ŒYôÞ6‘¹Š¹&„Þáá,¤<‰½C6¤aYÓ\Äiã`ND +Ä(•8"ÎÑØC†qÄú¯Ê¼z•%J·i•b¯+Ù”#r­+†ïfí›VTm›Öé$¥EÇ`AsMxq(d=éÍ:ë¶PÉ$ÚëÈ©¨¬âɧŒªù‘lÇ~üˆÜ)äî“WÇ …l'Jg$!;‚ýëÐd…j™ 3ŸÎóC&ŽZÉ@vÃ;|#ÒÙ­d}Üaž¥ +Îrœ‚e³Vô„ûÄßx…: óóxX†^¼Ž°GABL=9ÐÒ5†›9¿cXn%¤,Ð ˆÉpi¼}Óõ×8žJ6Ñm4‘Êsžò:˜I¢YyžR½|l@ì6‘8!±%ëËøQ±¾b¬Ûä–±™«õ©mâk«ç÷*ëîUáy ÀÜx¹ +OZ¶c-é¤móãàŒ…Û·¼Ñ6#Êäæð¢#ï|ùò…E¨u7˜%/Ý‹x7† ­MB˜BÕ Ÿª˜xLÌ/©™s¿.P qÒBÍç¹c Õêx“Õê{ÕÙs¹Áh`Uã¶Ðªiìá89ÕÝž€QÉ(„B¶IT®|y½áW«†ßzäGh§W´? epDå ,Nw»@†ª^ kÈ¢ØqGä*å*…‚&ç8Â2Á,ãCžcúCLJ³| ÁèC Xuå<Ä¥¬{ämð‚Nhòe3DfªØ.02ÀÃzäã#re tv¯üàdb·é„á8'ë‰XÕÌÞÝÁw—ا®pìOŸ>þÅôîŒQà%Ë,T÷ð4úáÕDúœÍ4^ä?ù®\A"DÞº¬‘½œCA4‹õ©esªý^4(ö#æ1WñIEnœñM0U&!}§`ªÿ˜‚7WPÔi¿iå(sEU 3Ig(jÕ$Ã-"]Ž¬>£*ÆâÉ”V_ÄT˜žb*<òåÕñ_M¥r úCégÑœW¥`Þ@ã`‚™°º+9í;~kÄJ‹ŽBÖÈBƒF()T$ˆ®.QžÞ ÷ ?pѤçp|Ž'!ÃïJKå><½ 4m?~­£Á¼ùÔ£18®¤'tgûñͼáù“«-ËôÎܦš|Oœ|@ì:YˆöË@Jú +õ’·(~¯îŽçýÄCg 7™Üíð'grÐè¼a 0û A„ òÚÔ¸; ¬»ÿÇ`ü4¸±ˆÝRI÷Øð&‡¢ßKòµø?£¸ÉUÑÐ…û<(Ì‘êÉ…×íÍùRM¿°´î¢-ç +ãºéyðmøfÒOôÉ¥Ž[ÝèéËÓ@Šö:ôõ zÝ „"yá“*ÀpQ†[Ì7 _ÂÄ\ßñ?6[­endstream endobj -6516 0 obj << +7003 0 obj << /Type /Page -/Contents 6517 0 R -/Resources 6515 0 R +/Contents 7004 0 R +/Resources 7002 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6510 0 R -/Annots [ 6520 0 R 6523 0 R 6524 0 R 6527 0 R 6529 0 R 6530 0 R ] +/Parent 6976 0 R +/Annots [ 7007 0 R 7010 0 R 7011 0 R 7014 0 R ] >> endobj -6520 0 obj << +7007 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [316.138 654.568 386.484 666.258] +/Rect [296.557 627.297 367.864 638.986] /Subtype/Link/A<> >> endobj -6523 0 obj << +7010 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [435.86 506.864 512.306 518.857] +/Rect [382.952 438.883 539.579 450.875] /Subtype/Link/A<> >> endobj -6524 0 obj << +7011 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 493.315 216.398 505.307] +/Rect [84.043 427.758 108.944 436.417] /Subtype/Link/A<> >> endobj -6527 0 obj << +7014 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [195.316 312.928 375.35 324.921] +/Rect [157.134 177.076 337.168 189.068] /Subtype/Link/A<> >> endobj -6529 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [481.678 209.385 512.306 221.377] -/Subtype/Link/A<> ->> endobj -6530 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 195.836 210.671 207.828] -/Subtype/Link/A<> ->> endobj -6518 0 obj << -/D [6516 0 R /XYZ 85.039 781.388 null] ->> endobj -6519 0 obj << -/D [6516 0 R /XYZ 85.039 761.463 null] ->> endobj -2614 0 obj << -/D [6516 0 R /XYZ 85.039 761.463 null] ->> endobj -3061 0 obj << -/D [6516 0 R /XYZ 85.039 667.217 null] +7005 0 obj << +/D [7003 0 R /XYZ 85.039 781.388 null] >> endobj -2618 0 obj << -/D [6516 0 R /XYZ 85.039 625.638 null] +7006 0 obj << +/D [7003 0 R /XYZ 85.039 761.463 null] >> endobj -6521 0 obj << -/D [6516 0 R /XYZ 85.039 599.024 null] +2718 0 obj << +/D [7003 0 R /XYZ 85.039 761.463 null] >> endobj -2622 0 obj << -/D [6516 0 R /XYZ 85.039 599.024 null] +3167 0 obj << +/D [7003 0 R /XYZ 85.039 653.495 null] >> endobj -6522 0 obj << -/D [6516 0 R /XYZ 85.039 578.031 null] +2722 0 obj << +/D [7003 0 R /XYZ 85.039 598.304 null] >> endobj -2626 0 obj << -/D [6516 0 R /XYZ 85.039 479.108 null] +7008 0 obj << +/D [7003 0 R /XYZ 85.039 558.141 null] >> endobj -6525 0 obj << -/D [6516 0 R /XYZ 85.039 458.215 null] +2726 0 obj << +/D [7003 0 R /XYZ 85.039 558.141 null] >> endobj -2630 0 obj << -/D [6516 0 R /XYZ 85.039 402.568 null] +7009 0 obj << +/D [7003 0 R /XYZ 85.039 523.598 null] >> endobj -6526 0 obj << -/D [6516 0 R /XYZ 85.039 384.095 null] +2730 0 obj << +/D [7003 0 R /XYZ 85.039 413.489 null] >> endobj -2634 0 obj << -/D [6516 0 R /XYZ 85.039 298.722 null] +7012 0 obj << +/D [7003 0 R /XYZ 85.039 376.622 null] >> endobj -6528 0 obj << -/D [6516 0 R /XYZ 85.039 280.551 null] +2734 0 obj << +/D [7003 0 R /XYZ 85.039 307.363 null] >> endobj -6531 0 obj << -/D [6516 0 R /XYZ 85.039 104.412 null] +7013 0 obj << +/D [7003 0 R /XYZ 85.039 275.341 null] >> endobj -6532 0 obj << -/D [6516 0 R /XYZ 85.039 75.192 null] +2738 0 obj << +/D [7003 0 R /XYZ 85.039 162.807 null] >> endobj -6533 0 obj << -/D [6516 0 R /XYZ 85.039 61.037 null] +7015 0 obj << +/D [7003 0 R /XYZ 85.039 131.088 null] >> endobj -6515 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R >> +7002 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6536 0 obj << -/Length 3098 +7018 0 obj << +/Length 2660 /Filter /FlateDecode >> stream -xÚ­ZÛŽÛF}Ÿ¯ŒB‡÷ËìKƉ×vvƒx3ç!ÉG¢$Â’¨”'Ê×oªj²%Q“`waØêKuuuu]N5íO<úãO²ØõÂ|’f¾fÙd¾½ñ&+šywã+ÅLIf͛ǛÛ$ÑÄ÷ÜÜË'ËOìFq8y\üì|óþþããÛ§³0 0q§³4Íœ÷?LƒÌùIFßo~øþãÔw>üë­ôî¿s?ýõñ»›·½ ý´i)~»ùùWo² ‰¿»ñÜ0Ï&ÏÔö\Ÿ¦·7$†G¡ö777ÿîYÉ\4‘Uc‡Ž‚Ä Rj„ž›eÑ(ïn褙Øsc/ê5ãÇ–fü v“(™"¨&rÏ燑뇋ÓåvBò'»…¹gñÉn?vS:ïtëЙ×Ûítæ;ÅŽ´¾˜iex¶ÀoàÜíi¸AÙ|Áu•Í}ÝÛi:O…Kóu³º»å¥¾Ó ?eÝ ‹y-,Í"(×U+³ÏXTÑØfEÐùètt#9Ë;oJ®#j…yâø‰EÕȘïÌ»º9Êè¼ØlÊ…´íýdé¼Þá]Qá°üÏJfºõ°ÁÆìFï” ±Åâ§ÂªDÙÌKÞϽ(…â/ö*·tGŽe¶‹¼Ðyÿöþ[´’kµâmÒ—Ë ’'µØÍq¬$Î>ùP)R.ts,f‘šRNº9*+–lš’%ß“¨©SïÃê®Ö_K¸Ðõ„Á¢”ÛÇÚÍÌ>RÌ'ª÷[Ý’èÃÜéš’iÝo>=Èî¡áCdÎBD‘G6².]±6ZßÉÀû·4Àº!Ây±3l x©ËŸè.‰j‡;—Yâ~”ö¡­v+û„È·ÿm9½“Y#$§>„·E±ƒe%d{å/žíxgP"V™¤¸Béö -v,2€ç^&6•q¨Nê¥ü—Lú‘!å–ÚÜZa}ð2£Œ.Ù ELâ¬$ªYÜÙLdüÕ·öÝÖpø­Þîó6€Á0Ot 3~Íipæn˜}F¿|’N[uÐD°&0b"Ä R,ó·Ci4ƒ„pî4¤`ã'v^žÖK=»Fò^‹‰OL«=i7åFÂI«25–çJ¤zDG |uèv³‘^í`ƒõõ®43b‚hÃ%Ȉ¶”dYS°Ã™ˆÅ³M!ûl·diwSíR¸<%Â3²ãݾ5qÙß; Ä_Ûâ"DSãVY6µø?l0ŒX`7&’xá}#¹7LS7%¯ObJfÉŸ'ß’çxêV³×e kxAföÃéà ™²”òaú‘IY½,Sî¹5-™<ÑÚi¦8Ï슒(p}ÿe 1Ð\ÇJƒíãk0⥽E¼¸•‚k«Ÿ¬@­ Eä=yH¶ä@'@±*È93äšfèwÛ[,¢ -FàØLaµmwFÿÔc£œl—&ÃÉž­PÚÒ°Ó¹<¸Æ‚vP5G¦­D|ºÖ%’Ñ‘µˆJkˆŒ¡?3á´US²ïuœ…⥘DTÙ÷‡¢ãÊ°ñpvÉWp‚‹ -^Æê _o@³‘’ùàzÕÜâ<¦ëMÅ»îrÎÊ©…èoÙ¶CºKE§hÐaQšiëA!ÍO_*=>µ›öHi›šB)Suû+gŠs)H_<“E3b²æL©ç¦‰À“Ë0éž#X …Ø)6&=ÃLéxÁï -—šNáQ`qû‚AÙgf½Ä‘/«Ri‘/1%ù®íd”SjÓÑôÖOc -ž"…S,`w-ªÄqê¤ V&š•Rü8`,rÖa8ªC%‚éÊînoY“eãòÅ#­ÜîO·‡iâ3ià<0û™KaàT¶³K54†Ü€JÎ8;‘ˆ­)Hºµq! {»C»ØÕxŽÛúÐÊš"Ï^(2J7Ò¿¨HCý²"ÏyBlâNðX˜DnB+ìè3¦dR~¯äÛ -{¤B%.e£d\ÉB2³hFt|ʲ o ¯Mcg(¹4@–ìÏ©D±ÖŠ©<ˆƒ -ŒáÅ\W1ÞÇd·f›† €½ fÕôÙ‰BÊò2»ùnê%“˜Šr®?1z¥žYäc¹î”§]©!$›8FQy]Kú2¨øLº H8AŸHwv#†æe™š ²àD¦e­m[7¥´ªÝR@2ä¬5)5æNŽ¸“¹Q°—º^rZ<®5º,ôÒ©Ðü2ÎÞ(šWåõ@u5š:Pƒ\5ÄOºÿÎ0*ÒZhÐÝÕ:ÕšŠv?D`ž(]½-ºjnÅ -³Ïdá ©ÉæXtúÝô¬)èÓ0êgØgPäÕgÍèIPNEZ)ˆ’%C®ëu®–‘åó¹Ôn­ô+åk¥ƒ42¯CšâGŠ¡ª&¾y4HÆ‹\5º -§›è+MÎj÷JÆ¥£»yü2Š°h®£ˆ(NªÇE„Š">MCÐaµ¾›¢öäÛÿÜ»íQÓK×G¿ÍþE·­T²\ãêÛ’m[€K‡Ó-¨ýîÚÏ/³6?u}‚EgÆKXíWҘͪížzÁf ? Ù<ïÅ{+ji”0Ž£ìÁú:`\Óú:З…$:TÉ»³]5œ½õñpxf€"×c°…NðGµW ,ì³[^µúcÜ©Îô÷…“öY‡ðÀ¥CCg¨$øßÊèsÐa”QNd-¶ <1``‚]ì;¯Þ Ÿšôý„—Û¡ZF–òtC-ûš¨ûmE)¹‚[ºj*OÑÿ4ÍBäõs‰³«žÓU¹}矄di)ž\÷•˜Îɇ !;r£j…BÊ7ö"ëù¹´¦ hl'ñ¸ÕÐ.)‡Í¬Ó½šƒýy!ä7ï‚åÓa~ÖÞëÆò! ìä‚Õýý,úÄt’Vï—<‚u¿Ëw‰½†ÃÈ“¯˜{C­Á`X:›…tMŽÇJž*zÄK³òQJƒaYödéði “ŒùJSõ”™ï8dáwš@Þàû›·âNýLbØ·,VâWòê…¶šÐAl#Ÿà5Õ¼FÈ*^]Á²>Y½ˆe-šëØÛ§ÚÝ턽#ÅÞo˜ò÷UÁKkúïBòÐyÓïàzƒ·«q‘óÌÍÒäE‰’ëà;MéGó,|í{ -S¸ÙÉ'˜×ÀŽùƒÍk°—;lí;¥æÇiïù+ôªm¢ïÞRq¥ V0ZY‹ „ö/ò. uþ±™Ð=>ÀR%öh¾õK1Àæ}‰Eü)K¾·sÀÑòsÃàÛÓ±›J¦_ €Ý·#º~ïs#ô,ìy©w.ofnœ…—ÿKBs;endstream +xÚÍ]sÛ6òÝ¿BÓ—R3'˜?DúéÜ4iÚI›\ì^Ú>À-ó"‘*IÙõ¿¿ý ’ûp7s7™Dàb±»Øo >ü i¬ü0[¬Ó@…iºØ®üÅf¾» +c%(+ç›û«ëwq²|•ùÙâþ±§«(÷Û_½7ïo?Ý¿ý¼\…aè…‰Z®ÖëÔ{ÿq©Sï†Þäß7ü´ ¼ï?¼åï»Û¿¹]þ~ÿÃÕÛûNŽ0ÍPŠ?®~ýÝ_lAâ®|féâƾ +`úpb¨8 +å{uwõŽÏE ^unÓq˜ª8 §»â3»Ž}ûíú~™†^ÛRo {ª–zí½”0ÚWfËð¾žrïM›7ËU@úÞ<7;ê³Ø+ÔºêÓDý=µíñæúúååEm^7ûb£P’Å*œ(Ž«M—î¦:\å üµÊ¢t±Ëâø¬q-ÎÊAšwL 9‚ÇAä™-' +ˆšýŸUÉ¿-Y7^{_¿¯Ð/üÕV<½Ë­Á‘ŽŸÁä_3p_ Ç|vopæŸwðCúâ‰Ä{ÃZY£!ò׶"ò‹ ƒ"ž÷X“-ž¾µÜ‡ôáßb@¿`šyª54•“*|V{ÛÕïãÆl‘CÞÚNÃ`RÖ‰¬aJAåMD™„ùá`hž(€F!B¼ìB¤ã×)´qyŒtá[û¸-¡+ id ;5ÅÞ<`–ÔGÊËh°k1ýŠOÌØzœØíÁ²(Z+²‹õZùpy2ÖÞΠMJþ0VsC‡…‘9ÔBE{{=T§†¡œ2apjr^ÓB{Õž’¯Ä!C^;žlÚüØë9óÞ-ÓÈ«jž$*…ÐÎÿGÄc§#;„ßÀ³8†H5'¶ø–'mLõ'ix,!ËfcˆÁÈÕ‘öË_ã4iM0âjÃP@˜ý%VrK‡ëGŽ[ÕÎV™œ`UnÒ» æ*G:]w¤¬kЕ£µW5E[Õ6"ZZ.…@š×¦%üÃ4šþu²Ôr7Ðœ:ŸjÉ©N”^ÀëºÒãMU×ùÆYvä¥ìŒ¾ÄÒÈ›¯ß%‘“î‡îù9oA~È+qh]s@ýâðÔŠÑ{¾S‰S( A4ÛT98Ó +”¥*\‡”+PÓ‚—¨4Ng¹YœyvA Uè¿ï˦5û=kÔð¨9·ÎŠ0N]ÖS‚žJ3Ï z\y·–NçøL èËš2ï"'ÔV`0óW,ºpG7x–U}d¤J¡¦~E¿W—L–ø* ây“õ8—M&8¨B}Ùd3Üz“ͱëLæðû|*Ϩ¥¢ìE¥ešŒ;¥­¶¼ôæØäõ°ß •¿7˜qÖ”îªêÝ ®§©+N-SÝW;Nð”[M‚ùǃsY邃; +/+}†[¯ô9vÒ~¿tiS”_,%ÿ6_D½ÇÇ–‚J¬ˆS*¨U½µ¦D¯çäê:zpÑ“£u¦b=«Óå¢Jw]Ôè «N¡s¼¬>fÿ>Œ5Ý%)¸¦ßsÃàgÞKAéΗÓ¤9ªZ0cøg[tUsÕòÕAÆŒ+S[j<®ßp#ÔJl\Üç|oO­÷†-O[ù…ȨQ`ºÒ(ð'ž +E]C˜\èß¿½ýVìev»|ë$lQ6ªŽ¢¦”ž<ðäÄ€¥AÔ†z&yjIݶ0PqoœÃvÈÔT›%„à÷y°uÎû +£ë0©\m_lR©3×›»¦î“¥§Î&CïxÊk¶nÐY"JÁÛTÀ¤Ý\Ö? ƒƒQgÌZ³Wc“³;K_Ö¬„!B‘â6ÿÍ"v‚ßÈ2#ßØö¨i·u ZÈb8pºM¨¶fh4gÛ "’ˆƒ$ѸEܺPJq'\¿ª¥ Sà«osöÔÉÔD_1åŵ’u4Ʊ‘ŃãÈÔ]¡;“¯± +(½k–1ì{Ú?NÝ1«å)rÖL<~+ô +DšîB¦÷;™õM$Ï^iI›Ftw=kîÕÛðÈl„í· éü ÓS)âKÓý÷Ž5n¢É`V®sg¦®³§Ô›ÿ]*^Iñ¼Ôs†a’)_§‹0HTþõa¨ôúü}áÊ’Zõ´¦u,\C³Ü¨ ™H´NUÈÿ ‰„Ô¼Di ’T»2IfÆÌùB§™JÃ`¶‡pp.6ÙÇ»ˆ9n]1ËÎö.?·/“ûa=9ŠèÑ!¶´pNªwR`(ÐqÚVœA”S½rOÈä´Hõ‰ré®»¬L¾³8†{‰¿>V‡±×5‘uu8ä/Q,ÊQqgK,“£Nd6¦O\·¶µ HtNm4þtÉ¥B_%:œw©‡l¬a6Ra”87îÚ”N¸W ¥ñâ1Ê0“c©‚¿yÓt9+‘â‰{†O¹`oN·‚†ÇuóZnxÈz†Ác{¼°¥¼}IÓD%>ÒC_\GA¦à¤æÆé8¯yVœëãéáúT‚~¾äÛ±Ð:Æ ”€'Bn Îv,ÎÊAšš[Ç™‚8é(¡,ÜÊém‰™C£CLï<Z“a^ÑÅ7‚7Qtù0N£¡Ì—Ÿl{"ýðÉfD¥§xU5*Ï6Bâ(hu Æét=}ÃI5Ô6P†vr>´,ÎÊA:SF”ä 'É|ï{8y±½Ì’Þ/GCDAd/øƒÓ ÍàzA|½[òf‰À2¸Ëó‰E4¸)Þ:º»lÁžßâ˜&=Hˆ”Q¸â?U‡ÜÞac;=L/«ój·8ó2Å:†“üPíŠ8#_Eø´ÚBU-•„ŠÝ£TÝJjnÁRϾ%Pv‡>y[4fËÏr6ÞÉ ´\tãàb.$¬®R}ÐòêFëé5KÇÎyïU˜sïŒÃ²¤æt¥b&g°ƒo«ƒié è.ºJ¯å”£ñîŒoÌþLïŽÒ¦ÜåRŸ÷…ݽ¬wO‡Xç—ö9ï= E÷ê¥Û*Ró†{¡Y4NT5ƒ;ß’ŸhYôÍVÀÜsÙÛ1Bm ³·ßtÍ|é2 :óGøËÚøþ;@#Bã˜]òiM%†e¡1LBHþÛÀDà *Õªendstream endobj -6535 0 obj << +7017 0 obj << /Type /Page -/Contents 6536 0 R -/Resources 6534 0 R +/Contents 7018 0 R +/Resources 7016 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6510 0 R -/Annots [ 6541 0 R 6542 0 R 6543 0 R 6544 0 R ] +/Parent 7033 0 R +/Annots [ 7020 0 R 7021 0 R 7028 0 R 7029 0 R 7030 0 R 7031 0 R 7032 0 R ] >> endobj -6541 0 obj << +7020 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [434.497 747.083 539.579 759.076] +/Subtype/Link/A<> +>> endobj +7021 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 733.231 108.944 746.133] +/Subtype/Link/A<> +>> endobj +7028 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 553.795 319.488 565.787] +/Rect [503.223 159.941 539.579 171.933] /Subtype/Link/A<> >> endobj -6542 0 obj << +7029 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 146.391 257.852 158.384] +/Subtype/Link/A<> +>> endobj +7030 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [475.95 553.795 512.306 565.787] +/Rect [411.588 146.391 539.579 158.384] /Subtype/Link/A<> >> endobj -6543 0 obj << +7031 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 540.246 302.306 552.238] +/Rect [84.043 132.842 183.398 144.835] /Subtype/Link/A<> >> endobj -6544 0 obj << +7032 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [130.71 527 227.642 538.689] +/Rect [423.268 132.842 521.988 144.835] /Subtype/Link/A<> >> endobj -6537 0 obj << -/D [6535 0 R /XYZ 85.039 781.388 null] ->> endobj -6538 0 obj << -/D [6535 0 R /XYZ 85.039 761.463 null] +7019 0 obj << +/D [7017 0 R /XYZ 85.039 781.388 null] >> endobj -6539 0 obj << -/D [6535 0 R /XYZ 85.039 652.932 null] +7022 0 obj << +/D [7017 0 R /XYZ 85.039 615.012 null] >> endobj -2638 0 obj << -/D [6535 0 R /XYZ 85.039 610.928 null] +7023 0 obj << +/D [7017 0 R /XYZ 85.039 585.792 null] >> endobj -6540 0 obj << -/D [6535 0 R /XYZ 85.039 581.524 null] +7024 0 obj << +/D [7017 0 R /XYZ 85.039 530.99 null] >> endobj -2642 0 obj << -/D [6535 0 R /XYZ 85.039 473.958 null] +7025 0 obj << +/D [7017 0 R /XYZ 85.039 504.497 null] >> endobj -6545 0 obj << -/D [6535 0 R /XYZ 85.039 442.432 null] +7026 0 obj << +/D [7017 0 R /XYZ 85.039 314.202 null] >> endobj -2646 0 obj << -/D [6535 0 R /XYZ 85.039 117.174 null] +2742 0 obj << +/D [7017 0 R /XYZ 85.039 230.623 null] >> endobj -6546 0 obj << -/D [6535 0 R /XYZ 85.039 88.073 null] +7027 0 obj << +/D [7017 0 R /XYZ 85.039 187.67 null] >> endobj -6534 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +7016 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F64 4112 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6549 0 obj << -/Length 2316 +7036 0 obj << +/Length 1698 /Filter /FlateDecode >> stream -xÚ½YëÛÆÿ®¿BM>„"šË%E2@?œ}NωÝsχA”HI„(R!)_Œþó×òa‘Šã$…qæ>fwgfçñ›•š;ðOÍCßvt4Beë0œoŽ3g¾ƒ™¿Í”P,…dÙ£yþ8{öíÊ›+ÇŽœhþ¸íöñmÏ×óÇäGëÅÝÍÛÇ—‹¥ÖÚÒ+{± ‚к»_¸¡õ/}¼çï‹û7oÊzõú%÷ßݼy~³øéñ»ÙËÇ–‘ö84B.~žýø“3O€ãïfŽ­£pþmÇV0}œ¶ïiéç³w³´[ñœ7çUcBû:´ýP_J­ýžÔÊÕ¶ëªyà;¶ïx$vU–Í—Èû³oUŸÖ í•^ÁîHd?۔ſåÔ»s•²Øÿݧù —ΗB½TÈhDk¼úz±TVÃ+š’¿4–Ò6žõ´eº>-`'+Ýàtkãœ'ÊS“•o†K>॔gžÜÄ7R\†Tñ:Oáþ<ϳqlc2 „.·ácÎ0×d¸jÇZḧôIº:Æä.½TŒOóOY.Rmª4nD Í^”º&^â*KII"Æ=¿B–5_‰.êó†'ˆ¾Þ¢@yþAŽ(8z‚±,O×Þ¹Nÿ`{YÑÚ@ ‚OY YF\5ÑQ§‘‹Ó;Ô ÄEÂTGÎ;{¡S¼kÕçû¡õÃ"Ô,1L²Äp•žâ -ìO „ôFlô¸F…ò™H·7 ¡N‹M<£µ5 'Zé ‡¬*ëYY±¦FåÂ&ªé\gŘŽìöû/A‘6'ì™ýóí® Ûq1i/É7¼˜haLØr³3bϳÒ3Zú®Š¤…ÒàÚ¤{hÇü9UæÆßãý•çšÇß ÇÊjC:¤Üò÷]|\¸Ý|ÁËÊ:f»ýÂ,a9ÏZ- (夑PA%îü´¾gĦ–ø\ä 2«U üÕ2… úZb LTˆžLl%'ƒ}Ös¹S¥E|$ù唧 §VÌŸ/ìo/ù‚»J[ÿ)jŽÓ6‰94šÎ ûag')aoP ƒ„Cm%‡±Þ!ÿ|gz ^D<_w%ÿs͸J‡&ÒLÚo¶‰¶’C‹¤'^6%GÌŸ$«ãºiOüËÐð`{ntõh¸0«ìÕúQ®­•;÷µ²WŽKBòl8TQ u¬O ¼f9Yú×*°ê×1÷Äb u³i²÷)·o³*ÝÀ­jǪ>È2XþJéi ã<ÙL‰çF¶\‡|=op©­x ±ã„$Þ+дç¸À¤ÓŠ{h|ø&O£€ $qÆ´À›ÛwØØ9é„ &€#š¯aFEA Y‘oÞ9y#±4¹Ÿýe¥ˆavFC¹ô¿ú¯Oß|¬c£Á*Ä1%šeˆµì &xB°jw$\œ¨=[éë2Éåyƒ[Õ_p^4´õæÕ#7؉«5];SY‹ƒu¹iòòdÒSJÈ¢aÔ˜gëªAÈ›}'sO+¦èÀ t¶HŒÄŽ.üÔå¹j¡œlcpÁÙ\qÚ¿=ÉÊ1l0C>¤²] - ¨ ‹Ñä.ÍŽl"Œ Ð6@#±„ž§Ì€èPDþ´ Ó=˜>j4P„®û+FÓ]1!ú5£¹v 1šÏ5šÞyýLsꬵñúÍàæ­˜K/ŒÛJOÓ:´%ó¯l ¥(~¡hã(´ÅÜV5÷ƒ<#YšlÖ }8«.·»!X„dH$€€AÛÄÜ¥K-–A°—u"ÛöÀ#È2 SÂ-Àx¥U?ÇTPçJBXÊ™IÒ®œÄ;RQî(\‰âI›Tê]¦opð•$)/—˜f–‡jíÿõöÕÃH‡œA”—úU¸ðý‹4}³mÁKÅy©KØÐA nj`±–UØÐkã~%™`܉4ؼa0+6ù9I±ÌÞf;{?"P¼{ÊÐ7¼ù.-R(_(’¬äò@{?cˆF,¶v(ûÃØ9%”.è>PÕžA&ߌ—Ú±÷Ë$Ýf¬ò]ߺ»ùçËÿ|ÿðÜç®ÉB—ô¯oѳZú}U,‡Ž ZÑ:b%x…86^.úŠ¯üâsÍ°ö.ÍN6Èž/JY9€jQÏ9±w Ÿô™’ÀÐ 7À Î '·ÔI|â}F"²=é1¯YÈò Oc^â9¶ò]±±¦¼Ü(våôÄàíK<‹.é¡e‘—Ž!ݪ_Ì»„=àÜ`eà_p=šŸ^8"dÅž@õ"@tµTìT¢F ¥bižO SQûçsÆ÷í„ -ìa¡•%•9n— -ŒM×׬c! ëëµG3 Q]?bP"ÞK1€'/¨`¾¬*:IXƒÝᣢ›`@>@#WÆy^âfOŒçd ígaN¢F« -ŒÉí*;Thd×ruoýt®6D¼Ðk øÃÿþóñgP„«ðó9ëÖ_áLˆ¨ˆç¸°ÄÇ´¥Àð1KQ”Xúº¥t4W|ÁbF°;gpÿ?Îð°`ReÝÅSe›ŠB;ÒîUI{4Ó>¡Àë=?øÄCšÜ™·ãfŸuïÃü„O½×+—缋bâ ™½ó4f'štµÒSuÌ'Zoý´¡¢¾¡ @Gwl×B7S¡lM}q ¢ªU,&eñ[îçËÒ­¿"‹õea·– pÎÏ ‡öQ*yÇjöW…¯˜¨>M˜nýa„¨/Ì Jè.£š71E‰ ë4('ÐOô`'¿R´‘»âêÒ•F£¥Ffž–ò$ÙÀVº779‚=\ÇUò -åöwr&Ø¿¢Á>ÙØë <÷†ÙÈõÂ>~«ešßz¡ÁH-ˆ:>M±”ð8 ߘéRSß™ÝÉ ¨fÿ"Õ¡šÐé] -ìqŒ öÁ“ O©œDªƒ‰]ÚL¢·N¹µ`“–oÝ)ظwüQþxóßõÓb„!½†:·sßumW^(×g~‚¼`ø9\ü—endstream +xÚ¥X[oÛ6~÷¯0²‘˜ÖÝr÷”´YšvE²Åhº>Ð- ÑÅÓ¥®ûëw.¤¬ÄvÐn(Z“<‡‡?ž›ê møã £@ØÞl8áEÑp™ìa’›£5ÆZeÜÓ¹š&¿áбÅÌž 竽@ø7œÇŸ­×o/ïç×ÆžçY^(Fãé4²ÞÞÜÈúÄ«ó;þ}}÷á~äX·\óüáòÃÕåèËüÝàzÞ鎀CgˆâŸÁç/ö0Äï¶ðfÑp c[8 ÎC¾§çÙàaðggŠeþw»´Ñ;31sƒ—‰ á‡^GŒ R_x~Ø'&°E`ûD pá?³>Ž<ÛRUºÚ¥EwCëAæ y^óäþæS«zÒ¤M[ÆŽ¥N‘ãOÅÔñ_†»×!¸NpäW„6¿ãm1ûŽk5kUóÙ0õ¬I|Ë]Í åŠõÒ¢V¨·¨º!QäY ÷\\q¬s½‰,6¨XI¶c •Zâr™çd¨i¬bƒB6<Ú¡á²åÉWœv•‚új×aæsнK\¬™HX©´t…çWÈ)P5và麺,<8ehÕe[-Ž§Ö߶ãÞLO£±;µÔª¬ëÌ2„BïŠK ¼9¸•u ‹{¸J+]±–¾Ô¹‡ÆñúeÃâ¸Dù¶ÈJ‰ü§Æ8^ *sÞ y-O«ŠïÅðñ4âžÎ½`]¢9Kñ¨¤Oƒ?#îo@pϱÉvP±G¢ƒËtǶYÌKšœøŒÍ<;zPKD©u+Ìê›0 Ü©°!DÄ'¿fEvƒÎ”D@ñ¯$%ÿʵ’Ú.Ãd94žETj›Lâ\•YƪSk«y!%|ùŒá‚œüîõã ûž½)Aþ¢Ü ¬m¢­›fój2ikGÔ碬’ &«fã±+\IÑÈJÈzyä9þ›ÙM»xT;còYÜÜ!0Ç°qg3ãçUÝà<Ò·çqZ³Ž¡ ÇÆQP~ÔQPIG)5km Òr½ ¬²ß_ÒÆ¥Î;{¿Ák8ö“³K3 }„/²Aû‹,]òóí!ß$;ö ¼QÉ0[aHû¾u›o`„·B·ÖÞ¤]ik-I§àŠIF¨Ö³í±SÒëv®d“ð`펄Ès”ðIù¤¤DͨgºŒªg%YUÁ9¦#ƒÍõ®ë&És f;¢´Ü3“5}²˜œŒÛ[ +É.©à@f,*ŒI×¼ÒÏy‡Æ™S×@}›ÖkA¬R¡ŸöhÁólaG\諲l~áúD¼JJü\¾Ö*Û¼P¢Ø2^õòæéô³ï«5ÛK5Ä +Ê UÝòû= +@¸”:-t_nr‘)Ý&õs¾þòqyüá²Ô}…ü(+¹|TÇ)èéoÓL_`É_,²ÙçÆ®¹YÐé’rèhàw…ñk­–6çúöu»\öÊù +¯eº¯Yr\`˜fJ§ôã|µõ©oz¸ƒ;;–Šà/ûÒÿú¿.¡»DÞìx> \艃éô]÷9ÞÀ‹D9üð¿ßCwHendstream endobj -6548 0 obj << +7035 0 obj << /Type /Page -/Contents 6549 0 R -/Resources 6547 0 R +/Contents 7036 0 R +/Resources 7034 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6510 0 R +/Parent 7033 0 R >> endobj -6550 0 obj << -/D [6548 0 R /XYZ 85.039 781.388 null] +7037 0 obj << +/D [7035 0 R /XYZ 85.039 781.388 null] >> endobj -2650 0 obj << -/D [6548 0 R /XYZ 85.039 543.429 null] +2746 0 obj << +/D [7035 0 R /XYZ 85.039 761.463 null] >> endobj -6551 0 obj << -/D [6548 0 R /XYZ 85.039 522.232 null] +7038 0 obj << +/D [7035 0 R /XYZ 85.039 736.911 null] >> endobj -2654 0 obj << -/D [6548 0 R /XYZ 85.039 291.675 null] +2750 0 obj << +/D [7035 0 R /XYZ 85.039 283.183 null] >> endobj -6552 0 obj << -/D [6548 0 R /XYZ 85.039 271.383 null] +7039 0 obj << +/D [7035 0 R /XYZ 85.039 240.229 null] >> endobj -2658 0 obj << -/D [6548 0 R /XYZ 85.039 214.603 null] +7034 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6553 0 obj << -/D [6548 0 R /XYZ 85.039 191.887 null] +7042 0 obj << +/Length 1667 +/Filter /FlateDecode +>> +stream +xÚ¥X[oÛ6~÷¯ðÚ‡ÉÀ̈¢(Köà6é’.YºÆØ0´Å X²#X–\INìÏï\¨‹mÙ6HêçöG–CþäÐ×ÂVÁpâK¡|8_ìáÞü2FblDÆ™·³ÁÙ{í ¥-;Îí9Z¸Z gÑgëÝåôãìâÓh¬”²”'FãÉÄ·.oGŽoýÉ«³[~¾»½ù8’ÖÕõÏï¦7o§£¯³ƒ‹YcH£”hÅ·Áç¯ö0‹? l¡øc[Hx½€B»ÊÌÓÁÝà÷æ(~çyWŸÓZùBûêÐk¥{¼Ö¶Ð¶K^y^½µ£­u¸Šy”de¦)ztö^vO°‡ce ÛŸÐæ*ÿ·‘§Iõ¡‰q¬­{&YXà–¤U²L˜EOŠx™S¶U<›m° ª’bnñËê˜w˜ã—¼keÈ;Ùsµ(¸~¼€/Ô+缈jÐ&/9?çùºfð$9M¥)q¬G^—‘ºyËôüŽ„räß͆ +(/ªŸz‘ÕªãhW÷Cˆb5ï žƒ{£©CåX5hÌáÆ‘ò™åk%ë7Gâ«´+tàžŒoG†âëÊN|¥-…k«æ 0 }²¯OÚžðµRa-s q'£R:BAº»›»XòæjfÈt‡»‘ΰÎrÃìQK¸žæ˜mJ{œuy1p_Ð]Î\ ‹_lmÇ5›!™»gMÇÌ¿(GÄÜõã²4ošXà«H·—v¼{5¡î9bo5Ò°ºŒA=Tæ! Î b.ãdQßXHѬûb¯ÙA*Üa|Äd^ÕoLÅJC ( ÜÉiÔ´2'Pc„^DÍ …-jö4ö£¦£±A „ìvS_w|Y]Ÿcħ¹Ê¢¸mz‘BqFn؉3' ÎÎDÑÓ8UWpK¸R6œ@„ Úâ¾µÏCкÒ9D#.ÖýŽ+ài#vð4j'²±!œE$ñë4§¢˜‡]>¸ÐlF3Glh¯c æ|FEÍN^™ç™¹ï–Û¢·cÙT£º‚ÀýƒwÇxEEª>¿úÔ`›ÆêtQí‘õ¬foÒ¿¤¨šôÂ5ÞaÔr[´™7Ý$l$¢¥Nã¼â³ú(Ñ}b„— Tš,…U[^.šAè™x‘Š1‹›YkvIù¦¿7é´Á¯£x‘d¦'¹œþqñ÷¯ŸÞjžÊž`Ê_Ÿ#¬ù“Ý áÔ3DÇÈA—µÿ?šu9Q"\ÏæPæ(²“:$‰X†8W:-®·÷ÎVÖ–fɦи:AfÁ­œéüâû„?êz<ó'B¹ú¤c­ÈÑžNk¡‡üº5¥ZGæCü ãŠÛ¾Iuó×é¯ès?­ËÑ}.¦À•pØ·¿ðúðZ&\m´lá}Ã?CíýÓ6à +ºø ?nÚqà3 ¶ãæ:jßÞú›ƒÿ6©}6endstream +endobj +7041 0 obj << +/Type /Page +/Contents 7042 0 R +/Resources 7040 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 7033 0 R >> endobj -6547 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R >> +7043 0 obj << +/D [7041 0 R /XYZ 85.039 781.388 null] +>> endobj +2754 0 obj << +/D [7041 0 R /XYZ 85.039 441.212 null] +>> endobj +7044 0 obj << +/D [7041 0 R /XYZ 85.039 406.466 null] +>> endobj +2758 0 obj << +/D [7041 0 R /XYZ 85.039 114.443 null] +>> endobj +7045 0 obj << +/D [7041 0 R /XYZ 85.039 80.299 null] +>> endobj +7040 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6556 0 obj << -/Length 2557 +7048 0 obj << +/Length 2085 /Filter /FlateDecode >> stream -xÚ­Y[oÛF~÷¯Ð>-…­FÎ /û–6éÖEšdEÑö–(‹°H:$Çÿ¾ç6$eKª[†Á¹Ï¹ŸoŽô,„?=K -M6KR­LšÎVÕE8»™ÿ]hY±%‹Éšo¯.–ßÇv¦C•…Ùìj3žã”ufvµþ-øî‡W®Þü<_c«ù"IÒà‡÷ó( ~áÑ«÷üýîýOæ:¸|û†û_ýôí«ùW?^¼¹®€K3¤âÓÅo„³5PüãE¨L–Îî¡* ÓÕ¡œ5Òß]|¼øÿpÏÙï:Æ´_±Ð™Ê"w^0±V66ƒ`"˜µÊØ£u¤ŒŽf‰ • -I„á@ÎfÁÇ>Ÿ›0hû²¾Þã$è·7:Hu m¬y$¯¥QW0ç§NˆÉ&*Ñö<áã"\»‰F£Xiá¿ÎS4{¸8 ƒj%Áéæ ô<¸ÂÁm3_À§¡ ä&ù†¿]Ÿ·½4é„kZ»æíÌ!4€C0œKý\Q‚hZÞšwü]çEÕÔÒidr4µMŲž @ÁZ(v—¯þw™,4j;#ûöv:Ç»8ÀmÒdZ›~û/8FëàM sBL? Í$ؾÊk½ƒ5û^ÎÜ]p÷ò{3•yv:ÔRRÖE¿V«¦ÞðÒõ€Í¡Vx%‹ ÎßÂ]9Jõ3’RðUýÖ‹@î&²¥!BfÀ˜SQhXŽŽ]•œlõ( ¸M„}ƒíŒ…cÞ X\ÆüÛAãÐ|D‰e=(ãœ'X0Gݲ‡° 6-ê¢ò²äÃHظ¶©FrwsT}qD¿DpìN( VI‹T—E¿Z¶+µkVùîˆ - ±ÎÊbòç0øè,øñf‡ ‹H ƒ&‘ßкŽG6ž¬õ`®¸¦ÜÑ|ŒZ‚¯Ïó˱#\°C“¬ Ù…õ%;9£b]ëP«Èˆå -];¿³‰2 ÕR¤›ÐÏwyË3«¼•5è#øm‹|-!‡®Au4’³7xDÏs÷Û\ZCü(äìÁŽpk](üÑr{!]C~D“M;H®=\Îá)oéú§öð1çP“ƒ­µÁeÍ9l ǸÇÝ *ƒ¡Ñâqõ“`ƒ¡ÆXˆH,†~îÕ –t ”ž…_ådý¨KÈ‘½Ïs°u¤+†nh)œ¸Á¯x5…»ÞÒ±£Mã(®#ÁÆcžºé½§¦-¼¹‘ÈÜ -Ù2ºîÂ×ÈÇ‘Š¬×€°eo9¢Jh‡ñ²ãoOvÁ-¯Í¸/w;nµ~¦»c‰z뇹nWÞl‘«~'ûª¦-¸õiâ¤uëg)ÆÇŽ‰„ ÀË?¹\Çœ×äUÔ&zjGmñi?PÖ«i9CÛó@k²fÀZe(Ì1-»4UiMð„4e·AùRË6DJŘ°iY•Ü;Ì1Gvi¬l–#8JT”@Â0FEŒ"Î#2HÊeñQD²L2•Úèä1´)„c¸%«OYxé,lb”µzaÈ0Qq2´p–a¾k8<¡IÂ/·ü}šiÚ,3¼fÒ&úG¶h`yYéÙë(Ëç.&3K§8ÌÅ*³ÉÌ…©Šb'aBR_l sìv šü½@È(¸§ØAþ=v~YÞZþjÃ1·¨{G+ÙpsŒk°yßÉÆw¸áÓÛ72@ÿp‡hyËÛ×ØyõgÀÞúʺìú¶¼&`$᱓РAŽ3NÑñD•ßuO¼É&Ðt6›¨ùŸ Ú¥_à¶ìev|h!ÛópÏDøIAó,”·’ n!®:ˆ?=½:P8OKœwÚ)`éŠ$ÒûkÀ’dð#È(wa¶.AXŠ¥È·>$J"/çTÑ&[ö¤¸;†Ùxøå†'kÊzÛ!·À%åJNΪÔ%‡RàÕv§ðaB’윯×ÒàÏÎã|4™]éq NõÛ²ûïÑ¡Iƃإ ^—M·è:qä„£»#r2ܸ½++Ÿ°&í5àK„€´µI–{ìÝø@©šÒâ~'¼ns\0àx`+Þ &üN!ÖaŸgXÇX]¡Ø3Œp[‡5˜Àgòû®ø" GôCPÈåƒz)öaVo&ò¨}øè8Ûý`}d!HïíD¶„7Êî´MF¾ˆR%Ù“q`1Ô -@“ÔFË¡FÝÜç(l·M#­å¾k—ô°Xvyu/¯ËzÙU×k9 [OãæTg¸l}ÓúûPsÔxömõp[-·=’ý‚Ôȳ*FùâK¾¢Ü!÷APék6G¤¨ØÀCù©_ Рk[’^%«%þ¥Ä @!HØ£¾Ë/…<|€ÓtcqI. OI8¸¡÷J Øî¾ÆÀñeÀ0”ï†ÇFŽç‡)e~–mËÈŒMPŒ(D<à¿¥fAq 믵O¸û(ü£“³žÊÁÄNÅÆÈ¡Ò‡T€7½P?ø‰h|d/¼¤*Nãƒ0Õñ›‰0!äq§ñ¤ìxÅÅFðÖÑgLzÀXð×_ç©•<šÕ¾ë¹%Õ£í¤(@Ãë²?™Øø3©áFÊ&î°¬ÄøÈÑÀ`œœyéã„çƒ^ßøê‚XàíÜ ¿Î¹’æ c¡öh˜'áóĵÿy 8€Ïé‹cW17s/>FCŒtý\Öüò“hÞÁKÑžÚòcä™1Ø{¾~Ï=µ†wGÊ)í=V˜4¼¸Õ=tLz%å.ð*¯•ÚvÆ*öÐfñ;Vöd|+²î‡·Þ&§’Œ„\«í¤d)‹O ÷I´©®O9“ œ9q& Qw#|X•›ža¡qù¿øÊBBt2Få³HOÂz•w·Žrÿ¶é‡b ¤m ÿ4èÜ2ø-ë~èèMxª‰¸¶IŸ’^øµb¿WûþYEy¬4t¼Îeÿ{ÏAçÔÐ,/ÆŽÿÞ™7„‡_zý»#e Ã{IûŒKù¼’_\™€0¶}Õ}©¸Ð`Ì›Äÿum·Ùï=I||™ÁýG”¯ÊS’6;™j“ß {y»b*?¯Öã;uôü[V(¹q2>R¹inDUITH§0¶xÛ”¬7s[éÛUOŸ–n~4.„ÁÉã²Ø}Ýö‹¾§Æö¼S_ÞÙ×;ëvкØôOÑ%½€6éÍQÜOÔs÷spê[™”yêv_ï!›ñSÀ÷+… +óéü+(þ__Ûï3£2“O;l† +’¦Ø‚¸A~nol2gæ¹Á+­Sendstream endobj -6555 0 obj << +7047 0 obj << /Type /Page -/Contents 6556 0 R -/Resources 6554 0 R +/Contents 7048 0 R +/Resources 7046 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6510 0 R +/Parent 7033 0 R >> endobj -6557 0 obj << -/D [6555 0 R /XYZ 85.039 781.388 null] +7049 0 obj << +/D [7047 0 R /XYZ 85.039 781.388 null] >> endobj -2662 0 obj << -/D [6555 0 R /XYZ 85.039 761.463 null] +2762 0 obj << +/D [7047 0 R /XYZ 85.039 708.141 null] >> endobj -6558 0 obj << -/D [6555 0 R /XYZ 85.039 736.911 null] +7050 0 obj << +/D [7047 0 R /XYZ 85.039 671.875 null] >> endobj -2666 0 obj << -/D [6555 0 R /XYZ 85.039 600.648 null] +2766 0 obj << +/D [7047 0 R /XYZ 85.039 486.868 null] >> endobj -6559 0 obj << -/D [6555 0 R /XYZ 85.039 579.451 null] +7051 0 obj << +/D [7047 0 R /XYZ 85.039 443.915 null] >> endobj -6554 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> +2770 0 obj << +/D [7047 0 R /XYZ 85.039 307.375 null] +>> endobj +7052 0 obj << +/D [7047 0 R /XYZ 85.039 272.63 null] +>> endobj +7046 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6562 0 obj << -/Length 2051 +7055 0 obj << +/Length 1823 /Filter /FlateDecode >> stream -xÚ¥XY“ÛÆ~ç¯@* VŒ!fƒ#/)y-[ë²"EËØ•r\Ä’ˆpШÕþûô18È7.©¶$ÌÑÓÓ3ýõ×=”ŽÒ‰ðuâD±:Žm¹ð=Ìü°V³"ÞDæÛõbõ}8Ò‰Ÿ8ë‡QÑÎz÷«{ûæÕûõëKOkíêP,½(ŠÝ7ï–*váÑõ;þÞ¾{û~)Ý»Ÿ^sÿþÕÛo_-[ÿ¸x½ ¶€M´â÷ů¿ùÎ,þqá ÄÎ#´}!aº\€ÂÚö‹Åýâƒ*ž ^5wè@…BEØ0"VñÿßN›D˜$œÝÎw<éû`ýU5´È5ܲÒçZ<)•ÐR9^¨0zpD¤)Eb :BÊH„‰r"¥D€¾Oü²„Q7mª¥'ݼÚ_Þl¿&Œ`Û€;¿ÃIàâߤMgF«»R9ßÕ`­sf0ëõ&ŠÉbO #M(’ rÂ$ìdñÛ´<<-½À×î Ûùç ­oy¨®Šq>Ýnq*;v¶¿T‰ÛÔ´lÇC?Ê=¦¾ÆÓ’ÔuY3hd‘‡ ‘ñ8©®Ë?) W;¼=r)`ȵE^ñ$p¿(°ú^›ÉU"tÃ*Ï«¬Û‰m]=°äÙm˜p§¬$ÄL Cw Úy‹úc—,Éè~ìÈÓREn}ÂN„cl}*v(tӱԩ͸AG¼ƒm¥8¼Oäò­à-=¢ÖŒút" ‚P„ŠÏ0°ºÌë0tëc—×Ö$ì§öî©MîØŸJ«Kò·ßÀtû4(jð$1;g'á!:ë¤O»mòcgM÷l;öt7uÖ™Ñ:°«™quÉQþÄ!‘Tš©ëf¼¦€›¤¼v_è0 8Æí—“òŒL"ǸëËyéœQ¤Vc€NÁ+•JI'TRHŸ!ÿ¡Ó¥ ^ 2nè]púüzdP5‡ôhÁ¡B÷¿'npm; cg•Ù‰”?oþù~ Ø»CálÀÀÄ|þ ÿËx§¼w¼Ef7¬Ð—6NÑ÷Ež5<Ö+D´±M!`/e -§ú„[•ˆe¤Ø*n¦B§LQòi\Iûeý¢š¿ó¢xIyÚ2‹ ¤Eq%sš@½˜ãG‚Â$³0XL™qŽ‡´nl©À7ÆøJ»üSöWà®8ûƒËO—Ú‡`ÄÔá¹9“6ÓvÑp²4+ù²ç…fÉË'efÜX6²þ[/c$!,3 -ÁF˜,ú©¬ap4gÚ -|xÁ}íc 9fù?R‡Xék¥ƒ–ˆdüòkÞBÆ\Ûÿ½îKÀìÚCD´@&?D$¼’„Óö•‡ˆ|á!2Q|ý!¢C-|Fcï0»ûÁXcc‡ËP¿ÏиÿÎô!àNÛQr/ì\^õ€ó-?µ§‰AKÅ­1]À.öÉa£ -f‰¦òCÆ£`Öy$½Vø΄Y”mƒ,ûœ–Ç"kWí§&ðˆNÇ™r+ÂÐô¡ÙnûÌÂå´ôÙ½5·'¬)¥{O¯MÊsÿöe`—äUgtk>PßaxvŠö‰³tF÷sµÖžÀòËA~Vl'_Yl+|ÙiøJ'úÅ"F%SžÕa]á´ˆQ1^NÔ×aø Ü‘{‹UIïY,¨^7MMÕW{¥¨êÕ¼hÏ(s½¨RPTIÉ1þŸ»·Äg'WÐÜã;]ËÄÕüHæîn†ºf¶uy̹X‡9† U¿©§yìÁÒ. p(Bã¾ÇNd“M[ÊíŒÇ*mräj2¤'Ï«ÿ§™0*H|où\dmß1~à3­¿Ý<§z5̤Ä×}LΛšR~éÛ”Íy…êG›6ée‚Ôr˜ûÅ!Ò7QÏ˪tSd^{H›l7“?c@nÐWx»áøÓ`äå{gª(¦r—~$H›‰àQ>iÊ´c É·6øÀ·¸½å†¶‹°>À‡uÝôÅ(Ží² y¿F˜@'é².ZÖ—Ûï¥yrxdÃÂmnó>˜Õ‰«O»{| -4ùñyÖ Ôk¥_3@hWW7cyÁ8—QMHrÞžGúâ$ûŸeò"{î`^„û–ëÌv–þlÄB«fßIðÏ÷U¿ŸÄhë+-£”P²·…X*Ò—ö ëçÿ !;Sendstream +xÚÍXÝ“Ó6Ï_á™>Ô™ÁŠdIþè¥Pè@¡N§Cypbçνضwÿ}÷CvœKBo 戴Z­öCûÛ••'áŸò+¤N½8QB'‰·®fÒ»‚•ŸgÊqŽ%˜ðü¸œ-žÙÈSR¤2õ–›ƒ+ŒÕÞ2ï?yþøÍòéÛy µöu$æA'þó×ó0ñÿ`êò5ÿ>yýêÍ\ù/^>åù»Ç¯~|<ÿ°üeöt9*2‡¦¨ÅÇÙûÒËAã_fRè4ñ>ÃX +ËÕ ÔÖh7ßÎÞÍ~Eñšñx×9£­N„Mô©ÕÚž±ÚJa¥!«ë¢_•MÔÝ©DB[ðð–+EŸµÇï}BpAq%½¥r¶s ÿ7Â×ObQÔ.p“oQ.Ôσ-º8óýÇÂËØ£ï?ø}å;þ‚rSn·ÙvË“ÅÐh à™¯ÆÇĹ¯tðÇ—ø›>±Z$:=ïk†"Tƒ.h“ í}}‡†' +ÿ£÷Ñendstream endobj -6561 0 obj << +7054 0 obj << /Type /Page -/Contents 6562 0 R -/Resources 6560 0 R +/Contents 7055 0 R +/Resources 7053 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6566 0 R +/Parent 7033 0 R >> endobj -6563 0 obj << -/D [6561 0 R /XYZ 85.039 781.388 null] +7056 0 obj << +/D [7054 0 R /XYZ 85.039 781.388 null] >> endobj -2670 0 obj << -/D [6561 0 R /XYZ 85.039 590.17 null] +7053 0 obj << +/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R >> +/XObject << /Im1 4096 0 R /Im3 4353 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6564 0 obj << -/D [6561 0 R /XYZ 85.039 568.973 null] +7059 0 obj << +/Length 1068 +/Filter /FlateDecode +>> +stream +xÚ¥VÛnÛF}×W°È ‰–˽’ܾ9‰Ó8hê$Zi(™¶óâ”cÿ}gv–-ËAÑ@¸»svæÌÙÙ!EÀá'‚Ü0®lå‚©<Öõ‚×`ùm!<"öx†y¹\$oLÎ,·ÁòjïÇ0mT°¼ü¾z{òayú)Š•R¡JYgY¾=dþE«Ësz¾:ÿ!áÙï§4¿8yÿò$ú²|·8]ND¦Ô"‹¯‹Ï_xp Œß-8S6¾Á˜3æz4˜ÑÊÏ«ÅÅâãäŠl: ]Ç’±°ÌJó}aRÁtª&a$X³ÆÌ…1œ®0 …a®IŒááI5”]S Q,Â-¬ß•¿F±ÎmØÃÄ­‘a7l›kÐ'Íj aÑã3ˆ›^eÝ6ÏI§s&2ûýdö—Œ0GNY¤L¥.—e”«°ºŠ‡ýPt ‡ 0,ý2fPvwxîeGkÈÚ=é¬Ìc-mø€Øvç÷o`$Âê’lkve1”\¸(땹õ$úÖ9-‡ ®¢v¸ZáäÆ‘ÁA\·žPÛ”¿ÀÈèð6Še†ˆ†ˆâ¶GYA­X`mX—ÿº¨ªmf<¥Ãí@ì´èë\¬ÀÊpkòFÍÅTD„ +ÓŠ¥^Í?%«m“ô›y$ãLɮ…xI_Ô«‚€õ +T1Ò„ñë#äŽîiöq|„Öxš "eW£€óœË{‡Yï†s®¼ùÛvØP TÎ -Y&s ìtŒ” 75T<ŸÊuøó=>÷Z‚euŒñè ΋qK©ÿíêrGÄÖ…çý$‘æ»æ»oz6Å!²ß^7…ícÅð o»‘Ò]8rÚ¶©1ñ`ò)Æ,žÛ0A U±gÚ”¶’I.þC‹ØTÍÑ7^B§Ïºq›8¸¡‘C›/S[ÔB2nÌÔá†ì{¼åL àYÀ¸£ø£[wy˜äVŠ))Ñað5ŒkkAfcÇ}Ÿ’[HÎj¼ne0#êÝÆ3¿Ô¿óù“–¥™ ´Î˜ÎérŸ]a7˜õ\m.õmš?¸ÃŸŸ4mqˆÁU{åíÛëm2>ôCIÇ>ºi¦hEƒI]øc\{‹ÛÑúU*½ö†¦…‚¼žö½òž^š..¼|3‚”’þ®Ó1ñvA± »[_¡ônß!Xóã=xÜñPl¨dû‡ íáîEC{4Ýb˜Uÿ$Ç“Ò×Ö¸bÕÙÿ/Z¼‚gA<}ßüÐ=Røá—fÇ>àO²ÿÐçØþ–)–«g¾=Œ„®®8“tÌZ¦‡2h‹&W4#ü/âÙ€endstream +endobj +7058 0 obj << +/Type /Page +/Contents 7059 0 R +/Resources 7057 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 7033 0 R >> endobj -2674 0 obj << -/D [6561 0 R /XYZ 85.039 292.426 null] +7060 0 obj << +/D [7058 0 R /XYZ 85.039 781.388 null] >> endobj -6565 0 obj << -/D [6561 0 R /XYZ 85.039 270.664 null] +2774 0 obj << +/D [7058 0 R /XYZ 85.039 761.463 null] >> endobj -6560 0 obj << -/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R >> -/XObject << /Im2 4150 0 R /Im1 3957 0 R >> +7061 0 obj << +/D [7058 0 R /XYZ 85.039 741.134 null] +>> endobj +7057 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R >> +/XObject << /Im1 4096 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6569 0 obj << -/Length 2878 -/Filter /FlateDecode ->> -stream -xÚ­YoÛFúÝ¿B@BÙá¹ûÔ›ÄE›d×6h,(‘’ˆðPI*®ÿ}¿kHJ¦ÜZ!h'¸Ð,uä|ƒA‘åÈ>àÊJ0"²PãÅNÝô/ó~óYp`Є8R™ÖÙÌmZ¹Ú;¹¬lvE}éFЃċüŸBÑ~¤Ž8‚ü«ˆw+pÕ®G§,¬R’•ö·72êÉ™Ð}$U!›,·M˜Ñ¼è° €ã‰£b™¬ÑúÚ°¹½åx‡Ò'ñÑ.ˆ6ëžÞ¾ÔÄ)ßùµéú§Ž®{dåªW:§UÖ#áô7÷L!οÖì:Qh½- ÚF<•œdvVìf¾ÎŠOü½ÊV ûfN³´GÉ÷ëBâz9IιÍDð¨¥^t"xKÆÊèÄÉr³yW¿èye‚4CAÒ µÖvMÝñZχž1óÉ èÑQqyÎN@0ä%Ãê¹²“k-P™êÑÆEQÑÃ$Ž JŒ>OEnÌ$1; -´Ž$!׆kƒÅÀÚÄ}áôqicÏ‹V ÐmÖ|_:HÖ˜ï—ä*zP„}ÚñÕƒ’¦½¼%ßÍ©»³‰È`ˆ"1`9tæ°Ê€«…h÷ÇÕç/Þ"ƒÈøó.Æ‹{®J’Eue Ý eV^Ý]ý{Œœö®Õä2 -'h™ vÁ±/"r¿þøéËŒø´¦pͼyØçíµÿu ì ¡€µ«!ãþjïzžPß$n›sBçè+§BvxË$“°‹ú+™¥Äš8­Nô,ôà‡&ÒcTœ¶•¤£|äÊüàûÓ#J?~ry‰Â9å±Æƒ»Ø”xQ–K>ŒtNóC-Eó0Œͧѩì%!8ZkÂçç’ÓÆUúëfÝd3L26¿Pê -ÀÞ´o¦êv˱ÌzšHZ¥ÄÂK›dazíë@XÜñ}aÛ¬‡Ü¤¢àq¨M¿.Ùî²;¶6zâiocªÔCÛPNm91¼Å Á/áx›%IÚû†©œ9ïâQ'^[…c&“ö(NUÁk¯»·+\¸HaA‰A¼;$n<ùP*(÷ ÿ†ÜjŽ}g}Ή8À’K -) -€y&J‘ÇB¡ª#Q=«Ÿ™¤ñ¨ëœ‰X¥6)êó¼ÍGÕ§µŠ)<¦%Ï‘¸t7ê9«n=‰œöÑd6lj‘™ÅX ÒŽ@2‚uŸCðÓ@ú¾æóVŠ—“0I*¥]Ï3£ïAìßlx@™F)›ÕÁ k?¾»ƒÅ[žØB´ê“–3ûò‚û½Äãm›Ë%þ‹rÊ ûJÚ_ÔR©sáçCAÊræ~NKùbÏk€ðíÄ¡aRªp}4õ?’ÖãY_ð•T}hA\ªH ¸è¾ÏÕƒ˜Ë©‰ êÈV¤Z*Ò»Wï“0r>ÖÅŸ—p£Ïâ0Â\®IÑ)šhô†Æó&J䱤5o¤òmÊŒ߼ Þ̼±@r“"‡F`äõÌSUj½ˆÇ˜nÎå-Ê¥`c—÷<(*. -š¶¥ €÷xê*ÍË[.îŸÏ!íÉÁcEEE %’Ô»:%`?l›¼ÈÙµ‘*µåœ6 ÄÎ5uŸ°†Y3€ý· ½o¨Ù„wH´Ã1 ±A¼÷”­˜‘:Ö?„!×›æÈéº5+„cmGdZr0s­™,•Å[ö Ý6o»³¨ûlofÞ×æcs‰¨¡´[HÉFNÊ™t—¤¿õñý‰¿²éZ8‰Ö˺;7mÁªÖÊÑ»_î\Ýö§—¦Üzú(Óµx,ÄqK‘ºâ -ó‰3 -†²íÜò” -a;Xè$„”TÚ¹¸Ñîâ?#´Ð« øœžÞ‰ooQV·cÁºCR=A(‚EŸ"tæ ,Ìß qv“dÐè 3CËÉ]ß´’"÷~¹lÍ ABï‘ã-ÆCqêþ6Ó -lÈz3Ú/‘èÖýmv3>OG‘ë©çûp˜Ë~W‡Ê½Ðú]#~÷ñw{© hO=ûüsÙåjxÓ¸ ƒïQþF'Ò“¼rìò.‡EIn‘©Lœ¶lF>9Ñ>ß5mBv”CÍßIbÉÙ[_ ØâÕ -ÀÄ3çò†¸Î§žgÒÏÇεmg™ðÔ‰âÂÄ‘‰@Gê£"ú¡rÖÜwæköùãpK|Ò²ðMä ™Çv> +stream +xÚ­XÝsÛ6÷_¡·P3Lüœ{êÙw‰;mâÖò\¦i(‘’8¦HIÅ£ÿ¾û’’%õ¥ÉŒ,‹Åîâ·»ÔþëI(×$“(ÖÊÄñd¹½q'kXùx£…ÃŒ +|ÆggvuzÊõ£³¡öO ÀË×K +ÈÆ« + <C<БòC +|zúÀn \ãÛ]™oÉì³½FF\BÉahùÝŽ"‚ìžËŽæÀLë¶ßµ<-hÓ-^ÕwòFU]ÍÚvo2fýÓ \ö8kµ™z …¢v†ø*8>`[É»šÞ €·M̓WB"vÃñM- @Æ?sÛö@WBÕ+lrõYçÀmÉŽãå±6¼øÆÆ"ò3¼òjVô©>tÌÂÑÓ l6vÍ•ƒZ—‘–`À"ÀŸ_ž„ïÑ; g 1­˜Ø[íÇ4Ⱥ@|¸åÁÛ†‘¶n˜ÂxG¹ZN¨÷OÈ;ÚžÑÛÆCnÇÙ7W)îLJSäöu¨¢ÐŸø~¢".™þóí»;ɾq«ãÉŒ]¥“d²½1Ê‹ŒÌÊ›ç›ßFå—Èš„½ÇxHîòQ"Zðן¾~Ÿú’ ðb›!S÷—:£àÆ*ìõOèoe]×?Оòtrª?ÅT./ã£èÀÄb´¦§ûÈÃnïVžPBþñpi“WÓXð3C90&<üý„éx†,/_“æh8>Óã2‹k–rO•Ÿ,Ì<ææœØñÑþ:â÷6Ðp€© wU5Ç6ÃE6èõòBŸÜÀ.mðˆ/6ì³ä‰\MnLoOÊJ)Щë¯ÏeG){ 5 %c¤¯¸+g–vß'O¼½[#$.<)÷§[Æma¥z'éHÆ*-¿×"©fziREŒ ¸$¾Ɔ¯ 5axÚnß2vÀPª^#N2Ì'=Š2Û[Ñmxá#P910¢íÁæl”U–u_Tä¸ÐÎ9B1Ý2g!ò%×ôÑ:®±¬ÔBÔï +öAÈmËwÚSLÁ“®së4 Þ?ìÈÖæ¶Ì!>?.OÌÏö‚`ÁiK,o2Ý?*ÁF—üBµ;ª.úxõMàPq³o;žõ#çùzIÝ@H™Õ'ƒK_4¼4Ò~úüŒ>âöÛµ=Ôa÷Åö|´{E¯8?ÙUµ2¾;Ž„ÅÚwQ¼ ÆOO3¼éØ­ãìµÅ ¶XeNKY[y™Vï3ÇŽ¸ý™Üßµ0ÆM”üµbÄs±…ñ¢:wc[OZ˜çû/‘óò5|U.õ2VÂ5MF<{Ï×*‰½½ÈÂʃâÂ".`•€´ºÌ˜ðcÊ¥4µ8žÔ>¸€ö¼Ç;|aúËçǯ¼½:sÌ6EãxRåϨìþuÞñÚ,.1 »TÚcZšß?Ý=>ñ>h¹¥N± óH}ù.ÜF_+ *Zóïq}Ù¦|HË®³C”Œ² ,rª°0 +„¼ZÖ{ûC†C ZEr–vVWJU»b¤Žôðþ¥¡9SýK¼§ç5çdK¸×õõž'IX®¬Sa•S{è¼|y0qÀ´{ùŠqÄɾCLá"!t> +IL{þå™±'ݱèTêÓÀáÜ—.JQ–_7É ÇûWOëÊX«ü®ãHE±|À…f-¿?Ü ÷lÄ~¦r<‘‰v\a*Ø©–cFõÕÄö]¡hˆCïX¡“wmy®«q* Õ¸•ò/pU ÍQdÅP„uu#IÍÿËó-OäsR9d?ãì‡â +üœª?ÞcîžSpFë%¢QôÉí ¦é~Ãä*¦x.¢«öBeä$ «t}@õ‡.œ.»®ž>ð\DÔ8V¾fh`Ô‹ñÛ^˃©ó½U·¼ÊÅŽ†B"·%L‘ E‰[{ökAÞåë= üØ70çã¹DëŠj (²†Ñ»ÎåÛ–ãx•8åÆ<>‚Ês}hcãŒ{…Ø8aýǪÆr B.IÑ}A±²¼~ÿý¹©íæý¼ÈÖGÒý ¡XTÚ8_Õ¶p£‚¹ð“CX— åê•r@8ߌq +=+ MýÙ{`ˆUIü≤¡Üendstream endobj -6568 0 obj << +7063 0 obj << /Type /Page -/Contents 6569 0 R -/Resources 6567 0 R +/Contents 7064 0 R +/Resources 7062 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6566 0 R -/Annots [ 6573 0 R ] +/Parent 7070 0 R +/Annots [ 7068 0 R ] >> endobj -6573 0 obj << +7068 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [115.558 292.455 171.248 305.357] +/Rect [480.859 184.061 536.549 196.963] /Subtype/Link/A<> >> endobj -6570 0 obj << -/D [6568 0 R /XYZ 85.039 781.388 null] +7065 0 obj << +/D [7063 0 R /XYZ 85.039 781.388 null] >> endobj -2678 0 obj << -/D [6568 0 R /XYZ 85.039 761.463 null] +2778 0 obj << +/D [7063 0 R /XYZ 85.039 761.463 null] >> endobj -3062 0 obj << -/D [6568 0 R /XYZ 85.039 667.044 null] +3168 0 obj << +/D [7063 0 R /XYZ 85.039 653.495 null] >> endobj -2682 0 obj << -/D [6568 0 R /XYZ 85.039 611.854 null] +2782 0 obj << +/D [7063 0 R /XYZ 85.039 584.755 null] >> endobj -6571 0 obj << -/D [6568 0 R /XYZ 85.039 585.239 null] +7066 0 obj << +/D [7063 0 R /XYZ 85.039 544.591 null] >> endobj -2686 0 obj << -/D [6568 0 R /XYZ 85.039 390.539 null] +2786 0 obj << +/D [7063 0 R /XYZ 85.039 309.244 null] >> endobj -6572 0 obj << -/D [6568 0 R /XYZ 85.039 363.924 null] +7067 0 obj << +/D [7063 0 R /XYZ 85.039 269.08 null] >> endobj -2690 0 obj << -/D [6568 0 R /XYZ 85.039 277.012 null] +2790 0 obj << +/D [7063 0 R /XYZ 85.039 155.069 null] >> endobj -6574 0 obj << -/D [6568 0 R /XYZ 85.039 251.003 null] +7069 0 obj << +/D [7063 0 R /XYZ 85.039 115.511 null] >> endobj -6567 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +7062 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6577 0 obj << +7073 0 obj << /Length 1158 /Filter /FlateDecode >> stream -xÚµWßoÛ6~÷_!$y€ˆ!ER” ì¡YÒÕE’v‰Z´EAK²­E¶\In–ÿ~ÇR$[*¬C…äßÝ}wdˆƒá‡8G˜ND£È‰7ì¬@òÇ„X ߪøËùäâMÈ‚ÑOùòÅGŒSgž|vûúÃüúÞó)¥.Èó…ˆÜqßß{uçêóúrv3›ò¾ÎßM®çí¡­98`ªNü>ùü;  {7ÁˆN#ç Æo&p$âŒÚy>y˜üÙš22æ˜]Cr!Ñc)ïxHx„uLjc¦=Ü?ÒïžO¸àî)9OˆrlúD9mtrÏÆ.û‚9®vð%çrH·.åÎêžN»r®Å‹8®¬˜œ lÿk£v‡wã´,‹R«øŒ£ˆD=EröJËDq^6pçrDéÅ> ÿu|²òÿ•Pü—ñÉ$M.k °†¸¥¡N\ê™TëÙvu@,¹€s#·ðàóC}ô:Ó„ƒ yZ™ù³’ûv·%¨¬*e<ÝxpzƒÑ¯× ŒYP<׺ Æ1CÚsæÌó9„UVæoÞP]T‚ß=ÈT¡F+kƒ´Z -lžw%L -¥D­ÇÚá^{á:vŒ0 íži1T¤‘ˆXE¹MŒ$èØZØ:…(b} -¾¤E'0ìæ5t·iš˜Q]¨¿Â• è7kë´j}nm¢‡ÖªßÌ.•Ò¬Üš}y¶MÍ(Û¶–ŒòhÝÍ”þG#©4¶¸Î -«Z,{[B÷A¶\“¦Ò¬Ë]7oå£æ²n›Çpµ2ÆÜOêBÕ¶r£\¶ˆi‹˜ºO cóüú¹áDñh¦U±ÑÁѱhë,ÏÛ¢2 ~¨õâë!‚·†Æ¿õÙ\ôëÀNý|;þ&*ÃçoŸåÄ nÙÖïQoh›Ä©Ñ¹QŽî»Ó$]êè*äwï¿]Ï®þø¥.ÃM¿»¨ñÕÝì£-ÜT×fCž@‘g ƒxÚ -ʶq¾OÒ -­GWDDH0ñÓ7_GG¿ˆ2Dáu …Š%!†¶ožDðÎc@G «{Ÿ&omöiõ£é³ÿÛÌî•Ÿ›…G±[B?¨}à*Œgc`í?û¢£Áö߀¥!ba Á^>ÙÚ@º”š2µ™+äµÀ€³w VÕ74\àÍÌ€µ}©9³2+z¬›J-UæÒ&LÊ$1B*è…fŠìÕå³™ÖÅ@‚)#HM‚/Ò:¾XÕØ jt»ÍCÚ+o©—çšþOÕɉ€–ô¨J`†ˆay^»…ŒÍìDaÙÊMz‚N’b#³­žŒ$¬Ó¡t¯AüŸ^ý-)Es‚\9 C_~ˆ·ùïàð?gý$ endstream +xÚåWYÛ6~÷¯*CŠ¢%õ-›ì¶äjÖ ’ -ÙV—²IÎvÿ}g8¤l¯•èñT–†3Ã9¾‡ŸðRŸ̼$L¦©·¬'Ü[ƒä§‰°¡U t.瓧×jæ Î2žyóÕÁŽb±’Þ¼øè?ÿùÙ»ùÕû ”Rú2aA˜$©ÿ.þÛ÷A*ý9>ž]Þ¼º™>Ï_N®æƒÓÁ8ÈÐã—ÉÇÏÜ+ º—Îd–z÷@s&@\OÀ%S±´c=¹ü2˜"YìѬ±•L™Jåy†Bd¨8S<6^iì7-d(f~¿ÌªŽm™%üf‹cåß‚,¯ƒ(ñ9qA”úDå*߃†îivt‰Ó?q½-;ç£$¢Î—(oAØçÍÛÇJˆTÈÙñwQ”,JÆ1 ­ðÈØ9D Žù)FW7/(ÉÊB1äðâÍͯÄ2P•&£¾ +¨5+ÒDÞv©÷.Û0L× £YÊdâ…‹œó©Oý{¼Aî 'ósƒØ~ Ï‚tLÙJ’îŒt¡Ëšd&dxçôÒGþ«ÞER žPÍ”ºzŠqK¨±ð÷½µ´#m0+lŠ–x+ãº&êe®­ꤺtWþÚéúJk$›. +è :ücÓÞÑ‚l«õ˜ sÚQÂxfQÄ<°·iÚð"©zIìï`^Û`†ÚQ³w˜"€0/ý@“L{lË@´k]Ѳé¬IP_hëuιFëîMA°CÖÖq b¬L½©½p6ÛŽÌä®(±-QåPáMÙŽà˜8EF8³–1E/‡[=§—®­©ô›Öñѽ-ÇÁp£ÌZŒ7¤N+•šxv{ÛZÆŒi. LïJW0IEÔ–¦×›LצÛX÷#š~z-t¬X*R/Œ%›Á*Col­a…ÀD®¸ÿ[FÖUAkÑiaåŒqoD¡n¾–_ÀšJ”ÿ$N¦A”Àc$8÷ŸÀcšŸ(©sCbZˆ¿¶‚ø»<Å4ÓíÛ|ç|f#òÅrÙY¹¸‘ÿ^ãôY¤üeÙ¶MûMˆÄÅ98”ÒR·.ÜQXÚ¾£šlÂáIÑfÿF‹àìª`ð4Ü¿Ý)ûïuÊþ¿í”1KüQ«¨ÿw§ä«áh³ÛÔ²5£Ülf=n™|~aÏÃï+>JÚ·ìÍE›› Œ[¿öZœÞQŸ ;œ¶óݱL 0ö®ûìVÞ‚ü¤û.‚P¤xžàÛvëFÐQ];ÕGñ°LyOv›ÆÜá +Êlgïfv±wÇOy‚Þ9JnÑáBcÙž*ùÖÚ¤c‘v\#>? ¸mÑwv‡3G}Cos Æ0=E'|[ Ò¯n.QO¦×ÄѦ5¬ØÔÇβG6ÒtÛCŠ²XöUcCÄkÞ±{Tº=:ôˆóÉ;ÛbâàÛ"†C󃹳 Úí7>($gQ6öjˆô­1|+A“¤2¿%«(b‘p±`Ñâ(}¯û&9 øOÔB®endstream endobj -6576 0 obj << +7072 0 obj << /Type /Page -/Contents 6577 0 R -/Resources 6575 0 R +/Contents 7073 0 R +/Resources 7071 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6566 0 R ->> endobj -6578 0 obj << -/D [6576 0 R /XYZ 85.039 781.388 null] ->> endobj -2694 0 obj << -/D [6576 0 R /XYZ 85.039 178.747 null] +/Parent 7070 0 R >> endobj -6579 0 obj << -/D [6576 0 R /XYZ 85.039 150.011 null] +7074 0 obj << +/D [7072 0 R /XYZ 85.039 781.388 null] >> endobj -6575 0 obj << -/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> +7071 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6582 0 obj << -/Length 2076 +7077 0 obj << +/Length 1727 /Filter /FlateDecode >> stream -xÚ¥XY“ÛD~÷¯ð£\‰9tò¶9€„!k -¨Ù–mUdi#ÉkößÓÇÌH>´TAmÕjŽžž>¾>Ær.àOÎÓ(:›'© tšÎׇ™˜ï`çû™4¾!ñG4/—³o¾‹Ã¹A&²ùr;ð‰‚0Òóåæ“÷ꇻË7¾ÖÚÓI°ð“$õ>,¤÷ËÇEª½%þ»{ùöýÛ埋ÏËw³7Kw©cdxã×Ù§Ïb¾éÞÍD ³t~‚±$lfpe…ÚÌ«ÙýìWÇŠ÷Â9Ÿº¥`¤Ó Jõµ†2i(•”’ó$A$BRq¹/;Ð/‹¼õ—^~å:´{÷ùa¡Ro•3Ußð·‚/,7<]Á±|½P‰÷…šOYê~_0· -èìÉ«3%Ÿ)Ú-ï `óX °4Lö°lø´ ‰ÒV½9mî‘,ïÑsß(ïK´`FoÒ]eÕñŒ†/]ÞˆòX—@Ãæé‹ñ~ ëmAã5{âÍS 20;+r’y'äÕ´H·áݼ¦A‚æi‹-°£ÙnBê§3/$lZŸtgÚYqÐ0x\H¯f¤·kú2ïDBy§={‰ÈzðeOÁà“…Á8ÞªmP¤ƒƒiªÒ¢¥çbXmì…æ(ë ƒÓþ궅cÆjwýøäª% "§Î¬K/ µÇž8Z›´ïËG”“p"¼;¶ÊÙÔß.ü(J¼×EU°jLã„€1m0 Ñ·O¼š£ÁÒltFZÇnxg [ãÞæð¾:‹h(ksy×çm_¢»v“è•* ü‘œH9q’iü|&ÑPžP°:Œ)OHh©æq,ƒL³q!ûE‹ †w‡vx ü1%€9wCAJ¥B?/]$©Õ™tÀý<’D’i8’L‚"F»/¾‹ºGAÑõ9ÆN{‹½'¬Ã§*èìó¼ŽäF¦µ2Ê8ˆØq¯Ë._±»wœ°îm˜|=Ú ðQ’¼@aä…ÑÝÞ CïØYµQ(2ïqÑAÒk ­Èó-\áŒ0)’b ‘ÉÁÌ‘b=ŠØØ\¹fŽ)Ñq|Ö67’OWîêò/!C—/Y!ÈDP(ƒ [Gi„ÏÃu ™Fk§A 6xˆ Zï›*_h²[­›ÃœÿϨ…Ü€ˆžG-Ôø “c)Ô¾7éŒ÷ÅÀŠRPÛæ±8°'u%àí_Äh¦A« wA÷Í!¦LóP˜}©Ú"j\ÚÂ#‡pRóRñ÷ðˆx* â T, éJû«ª8t|‰©¨aâ}w©¹N eIü¯ô@Éí>Ë·¼ü³ké6ÓèÜFo@âåûÃo¶k. K|µ.¨/-¶ò5p_A¾ Ó8”jgDC“¬M‹M=lÆÛ²CÅЕR ‡$>–Ô%ŠË¬šø¬ ‘©W\¨r@LÁ^PsF®ËîÀô'\Ë;žÔMσnWÞ -#ÂÂÂÍe"™øZ…¦’m‹¤´·)vm¾1Û½‰Ú -cFeCãÊÍÌœÍÛ‚™=´ Apmû[HDÐM]¿+ls“rhi•>«óæ|³å­¾}Uñsõ¹}“çf祜?è6d”zo{^$«7Ôînx¥omÃéN<±¥–Þ ì7†&‹Át¦Ÿ¤mlŠúË]^Ö7LgÍ7€£²f4­;’÷}áŠËXæ¼{‰mŽ¾ªŒüP% ”®A—á:µ£8ص .'äß;B DÜ6š¯í£ m9~ðÉd÷ŒæÈŠàø±ìÊUe&‚c¹e`ôÔ(—dxº¿==—Ü‚esÃÉN²sBáí‰ýµ;V¼Dx¯)Ȥãq€%0€–8wÆ"ŽˆÐ Ü·ÃàÕ‡ß^ðˆ/äñ‰Ì„OfÍ$l ¸×ºçK€§uÆg®ÕL@äAk‚ÐG‡m˜¢7¶Lv•Á•ˆ=C•þ¯üÍœü«ëì­<•“ᾋìÍ2^·}s` Õ‘:NR&GòìXül*6¼ò÷d†=¢J¥1¥?Úqi›¯À=Äà:WJß_NHŒ:ÊíHû@\“ ‰„ãÆ0GÎ ~g!uÂËûÜ̘ºqqÅEÝ$ˆ©wǹjh£'Ÿ~êEÆ•H‡ÒâéÖæ¤G÷†¤`ÓZ± Âz/)"™JÀ*/;Âô’,TêËŒ§.ÆG²‹#R)­}ÞÀùݶ½hC=J"e ﶪâ Ê#$$;Cë™´4sx»6”B®1Ú ­‰]Ãß–¶ÖMmŠøîØ‚XˆÊÞm€Í¤W;Ûð_{ÐP,9o}1f¢òf{ÇbÜû“S¶âwEɪ^˜¼-¸lƯÜ]¬†›ûçºØÍt³­5´ºê¬×V¦×þêê¬Íƒ°_ˆj±°Ù&lÀ³1›’“Ù?+¦#™îµ5.)Ž˜Ÿ; -èw f,œÎ¬p,ä댗¿©¸Œj‡p- ‡_ö\RçÁɵßô»Xé¢%óêÎð9°¿7T½°9 ce;:“Cö9{ßd"ܱ¢ÀþmÊÊ­ši~ðÒÜÒk æ{B¤„N:öEÄS×g—‘âNU›Þ ¨~ÊÛ16•ú<pKë.V¦é0’µMUùhÉ#•ý3Š¡e*†Zq ."PÙí祱Ãÿú•Øa"#ÕÙmÌEJJZY80âKyí¯ÉWÿÆJyendstream +xÚ¥XÛŽÛ6}÷Wé‹ DZQu ЇÝdÓ:Ý&éÚ@¤AA[²-¬,9–'ß¹PïÊNÑ"@ÌË<3šþh·â9Ì«†T2rT$Ÿz(Ô€‡Êu”듇wÓ›Ùïì_žàXŠß:fyÎÃõ†G…U;è—Û‹¬òG*œ-·dTÃì†vZóNyí‡ ˜›­ë ŽÐš´«×²ÒÛ¾tôñ)OY?óO•Öé:Kœ²ëº®¼§Ú3¤=?â­•ƒ}-aåÉo÷M[¢_OIEîßxôS’®²"e¸oßý};}õCÄ+DQn›c»kzõvú[Uº¤ðg%÷¬r5±}!,ÂFs9:š¤y¯é e•Š%â‹™Ô³!žy0ë;ÒzHpš§õã¡IÛˆ7™«W-ŒÖÒÜb¢WqO¨öi-LeOzR¬Ù²Kåaé”æÜà¢tölÎʼt]'ôU#óÊÈü5K¡°>œ;߬8¹â:‘+/‚ó¢Ø‰}ïœpb¥zà¼ÀsüpˆP¹Ö,ýrH‹qbÜ4¦A€´ë„ß"raƒÝa¼¢ã]ÆØšœ}z¼Sú¹XbÔŸs’AbÆùûz­ÉDä5” +Ä/h]×)]ñÎTÒ`Ià‰$Ð1ç®»}µàšÕlß>Ð&´· +K:Ò !d.-TMÃÖÀÌJã פƒE‰ãÅÃ’o‚ö¿þ’ÓÊ.|E2Öåy 8 ¼$ß‹ãmþâóð?FutÆendstream endobj -6581 0 obj << +7076 0 obj << /Type /Page -/Contents 6582 0 R -/Resources 6580 0 R +/Contents 7077 0 R +/Resources 7075 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6566 0 R +/Parent 7070 0 R >> endobj -6583 0 obj << -/D [6581 0 R /XYZ 85.039 781.388 null] +7078 0 obj << +/D [7076 0 R /XYZ 85.039 781.388 null] >> endobj -2698 0 obj << -/D [6581 0 R /XYZ 85.039 679.868 null] +2794 0 obj << +/D [7076 0 R /XYZ 85.039 559.519 null] >> endobj -6584 0 obj << -/D [6581 0 R /XYZ 85.039 651.132 null] +7079 0 obj << +/D [7076 0 R /XYZ 85.039 517.234 null] >> endobj -2702 0 obj << -/D [6581 0 R /XYZ 85.039 651.132 null] +2798 0 obj << +/D [7076 0 R /XYZ 85.039 330.106 null] >> endobj -6585 0 obj << -/D [6581 0 R /XYZ 85.039 627.814 null] +7080 0 obj << +/D [7076 0 R /XYZ 85.039 289.942 null] >> endobj -2706 0 obj << -/D [6581 0 R /XYZ 85.039 584.48 null] +2802 0 obj << +/D [7076 0 R /XYZ 85.039 289.942 null] >> endobj -6586 0 obj << -/D [6581 0 R /XYZ 85.039 557.865 null] +7081 0 obj << +/D [7076 0 R /XYZ 85.039 253.075 null] >> endobj -2710 0 obj << -/D [6581 0 R /XYZ 85.039 557.865 null] +2806 0 obj << +/D [7076 0 R /XYZ 85.039 209.741 null] >> endobj -6587 0 obj << -/D [6581 0 R /XYZ 85.039 534.548 null] +7082 0 obj << +/D [7076 0 R /XYZ 85.039 169.577 null] >> endobj -2714 0 obj << -/D [6581 0 R /XYZ 85.039 343.346 null] +2810 0 obj << +/D [7076 0 R /XYZ 85.039 169.577 null] >> endobj -5887 0 obj << -/D [6581 0 R /XYZ 85.039 324.475 null] +7083 0 obj << +/D [7076 0 R /XYZ 85.039 132.71 null] >> endobj -6580 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> +7075 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6590 0 obj << -/Length 3165 +7086 0 obj << +/Length 1029 /Filter /FlateDecode >> stream -xÚYoÛÈù=¿Bð‹)`EsÈáµ/EâÆ­ÚÄ1bïz‹n±Q´Í5EjIj¿ô·÷»†¤NEsŽof¾ûRÔăj’„®¤“8Qn$“lõΛ<ÂÎßÞ)Ðaà†ZÃøÀæÌîÎ"ßõt|FÞ˜Å*u­æÃÝ»‹+ß›øžEÁäîa¢”ïÊŸD©vu 'wË;AâNgaè9·f5UÎÂLgA;¦Zò îžò†‡—s¸šÎ”s‹ ‘“•¬äU‡kíô?wÿx÷ñ®ÇIP²ÂzCX«p¢<7õÒ-¬ÃØ U@Xß=-àN6õcçɬ‘Ž ´“ÕÕÔOœÎ zU+‹e‘óò¬E|×ÓœÌ3¿zJlÆ EㇺY™®¨qì£ ¸—†þiÚ+¥AFÑm~àª^ -E¢Sç³ÉˆD±«[>±$v¯œ¿Cï=‰_rœõaš¸1¨.â÷¯i89±p-*ˆÜn°ðô.n4ñu„…žÀà°s'‹¹i¦H= ²˜ú©óº‡M¹Ú ¶±Ùá‚…y‡Ä#fq¨jÄá…µðɈ–ž_ίneÔ«Ï/î凨# â¾ÌX©MYæË]z‚(tã(þNîZèÓ”íÞ‰”ýÑy?UJ9?ÜC"Ü >ÍT óSAñ|_MBÐD˜Ë‚Í_Á.ÃŒ¹íxTÐ7tÌ£)*»xl+ÀG)§FðÒòrþ€f­œ{2œ%ËH6¯ïøkФ—w‹ð€Ë^™¢%ÅÛX1¶d  OLè6¸l¦é½H_ƒ`Á™Ê XÑH;õ~}ç¥):BúHÐa²#†A\QÕð -#w²ö4„^‹Ö•ë¹0Egk¬Ö=Á‚øׯ*nØ5.MÇÔ!–¹wï˜2ƒ/ÿ9E–¥Y” Ä áH_þ<4–O²/‚#ûA§œ²6qâ˜ëÃp &[M»Aàú Q¿àI[tþ«zÝÓ€ÐØå"òr¿H-(†ÀÅ…ÃJ‘÷ám‡~±úÔg†XäL ,ùÎcC3Ó!W^,·Ä>™*Ë—?ð*‡Z‘Û\< àòÍãLâÓ7A…Ö‹*+7KËXÑŠõp¬†!ka áß}ü ^jg†ŸU„ íë°Ö±”àOÍ hM.»Åj]æ+¡‹Ôœ¨+¹˜Ø ß÷kädI€w@ ²å™7ÐÜpÐÒ¾è3@Ðâ3Eãe{Ô¾è _9?]ÏÁ‘ï¬ gä#8T!¯}Ëk_ÂF>~ -ÏÕD5ŒÀðWÑdï¢]Ù¨7ÓÚCfµV£áÒ×Ô¤(ŠMÖµ¼®¼0}%VnøÊ®> U͆c~¤¤–ȵ õ„;/Š¬—lX†Ö g pNÛR†ò•Ïw5obêÁ·Ôíom†›,K!r:/E'UÍ_³D’;ûöil7k6ƺA‡ž$ R ÝE“/yÝ~­ûIºÊÂ>ù5ÜÜÒT\è5'§4÷ »¨h§uäú:™èÔsƒ4|#äZèÙ|?îíÞ‰ü¸Î;Ó™òyïý$v!SÜz~·:`7ÞܾŸÄ@™r¢¿›7IÖ§!7JàÔYœ@ÏFàÇ3I „\¾¿ÙO !Iãí§wS6yãÁ›ðA²\íÜ?‘ìqR"¶• D v°ý· öyJUg‡Ô§¸½±FÐ.b# î®Ñ%àî(‹Éå =b³>­²=û–É$«˜ÅŒ®Ðe‚—$i“N±og¿å'ž­\xB§½)ò¸³fùL¡û±÷~Êe àº02ï“%8ö©÷-›o|5†Yò©8©‡‡^A—<ã]QNÛL“׶ËÉ϶ºø‘Vò„cJ©S7¶Eðw(åN:TJ¢˜Þuë/.^^^ÜÜt­ ‘à¢,ªÍ·ß ªüöRTîS·*÷²b?uS4°1v;zëk ƒÞªÄM  ?U”éÀs“DŸ.µ -!ÍmÕèKÕø…*tŸKôK©©„ãA%%9ÄUÍ ”Ùad¼RQ‘¬¤¬°’†'bÛE¡ÔïXQ€KŠâÓ}œÌqg„‘ë%¾T3¿Oa|Hu²zÅdaÞÕÉ¢©Ú—q±‰GÐíЗò¥–ÿ*ŠãA’ÁÁ‚i¥‚icÝìø®yĉ›ª¸GøÊU g#ð•ëÎd¼Ù;¤l83M]º/ä%sƒÄŒë·B!^ü—SÒ|CÎü¢58xAœ2 ÞæòÍû†©ÔõÒt›²™Z˜ÓôìÞÄ‹<¾NC7‰“­ ê»Ó[¯ÓD;RM ù%Lª¡Ö PÀœ·S‡l5D”¦2£öÇcÎ7ðC7=œ‡øÊMTr¤ƒ©íª0œ?±S7„Àf¤À_Q nK#›ð‰7 eù£ËnÇcÔùüÒ÷YÎ`»ˆßœSä9F/|õá4äûèΟ W€ˆÞË›‹ùÍï>Ye“íE%ÄA"=e9&˜ ÀúI‚übOúÿ4:œ ´%À3Hq?Ì¿HW¬æÎÁNÛK¨WΟÁ2¢‘¥1à>|üiÞS -øEniú†w±æU uÉ-ÌeRn&àãI_Çt²¹Uèz7G™Ù[‰ CÑÃÝØ­k“<[¯­‡ä‚ * ”Ü#ﶘ÷°§¡sä_ákätÙ¦zæÙøXL½ðTúÛ½š¢­#LÐ0èËm¹GWa(RÂ29°&0‡)1ûž3àMµÈ nyÀE¦ì{:f)-Ž0"'Œ ‚û‘vZ:¼ÚŽê~¹ÈžØµVŠse¥ìå²H ûÎÈPz¹6ÏVz\ƒbÎA|HãåÂ'œÝæ)²¡{‚ëóñóÔÇÐʃjnÿaÿÙÚêæ@ÎïüKDg{;Öe[óÁ:åUôU([í´’qc³>ã(*—˼ÙoÙ¾$—éV/Ó°WsŸ b³©ÛlÃ0[ö -ó]{M5«&lá+u7€qj‘Yí*¤ƒ¶”SÇ­XþjǤÚ®ÛÁQã÷Íȶƒ4áòƒr¶–%¿­ ó™M`ŠÊ¾›b¡‡J’ÙvïJt›~`êšEÚ#It¦‘G?#gînÝðùå㼘Y -©Àhµ4¾üsÊ­*x7+ ©-bûºsvɹ1ŠÓcí;ŸÞßÜŠL`Æ/ŒïÓ>? ß³!2j©5eÇ°~hßá–h¬}Áó?ãÆW^ ýK¤óbŽÃ›áÝBî?¿¡ÆXWÏàŸÕ%‰éœyb[ ç6ÅL¼ä.NÂ~qpÈ;’ÊHC— Oí,øž_nšf”夤X‘ü¸¾@D­DÏ´ûÞ0#1#“^OXhq Lf¹À¡=Qó(¦]Ùƶt!†ÀqfÄCºSTY“›¾ñˆ+â2ê™ÃÈã{‰vêìsßâÖŒƒ.Aô|æMU¢Ö?pâ¨óÀ ¡#¯„ŽÔÐ:à-iŠ;ÀÀ-U>nâ«xÆú\£.à+A)„ˆ’›ªÚ=]k qQåä·ÓQSdÔøNúaØv"±Ë‰«Ø¡$XÑÚ#~¤2+ìj$-ï– ·MZ AmhŽ½xXºBÃ4¸H¢QÖ½ÃàìÚ¬úÞ,Ì?½«?CÕR1ý&…÷ïÿxý . QãÏýüúvÝ?@)¡ês3ì„ö¨ØcÖIŸK'U³½ãÀ 7`ð¯ðÜ¥´eófEvR—õã+ÿDA[ÛÔ¢c÷ô£@³æVðÖ²²ŽïéeŒ“•áŸ€ö钇Ĥí[8”fÕ|ü;“¢*‚·éè%ÙvÎÛü«ìCíð™G7ÓþWžæœ—X’³hlj3²I¸£–'ú8k$b1ÎÊ|àq)ªÖò–°Dr/ØÐîzoó±1Ëx¨ñ1ò­u5«‘ÿ›ÈÅ©v:ôK*£sì?<žë§ã -áxÃB¨Ü½À|{õƒâx÷AH㡘Ž¿ø?èFàendstream +xÚ¥VMsÛ6½ëWðÍ”(><:§›6iÄN¦“æ@I”Å1Eº$eÕÿ¾»X¢d:=t<2îâíîÛ·€d àOÖp¡Ó ±’kkƒÍa!‚{°ü´Þ#ô.áÄçM¶øñ‰)x*Ò Ûq Œ²íWööç›OÙíçe¨µf:áË0I,û´”ìãç¥Õ,Ã7oÞxŸý¹ü–Ý-n³1èRŒø÷âë7l!»»…à:µÁ ¾ .Á|X@Hn"í×Õbµø}„"[Ю¹¶ÜXý²Bif*4‚¹ +ŸÊ®\C=UEvÈërkXJÖõy_65Z"ÖìèÙïK°wä~Zª„5GØ’y½ •e-ròÚç5xl÷X]¢=¶ð²q{6²è\` +O.îM_äU‰(÷™WÕuZ¾‚·Øž?~ðn.0yœg?ÔVc¿€¼P"·©#£­ÏÔrW^Ñ´êÛcG™mý‹ tê’‹®?nÐü@®åŽžï®u£RÁ…J‚DÇ<5æ¿•£¹JæuXáì¥,Tª¹ã!«[(,ûðË—8¢,+jQóH­—Œ;úB%,W1FJ¸H‰ÅÊDIÁÚ ªÈݾbKÊû ò;’Ø‘i×´ôe…Ò¨ò¶ôÅchk¤Rfý3¯N¤,…ÑŒÃ2TÃwàÀ'˜à¸B@À%Lɲc¹…’izzï;èãÚ¢rË|ÂK=cä¢çƒÉ‘c)Û{9\à8¹z*–ýð)Ê€¯?Rie¨}£FG{íf²¡Lý`Žs1Ù’^m‘JiŠè¢ ªðf×Ù¶—³€;ËNPít:,Ýg 8X÷þkçé)ÜÑNGÐy¿Å[ßÿH㦩ÿ2Â3ã8Œ° ¡­Q¦eå×]~À<ð(Ìçûæ({ðùQ0Íîšéˆÿ:Vó¯ŸÊAƒ<·Å#ì‚s³íý‘6u˜4᱊¿{£M|Ü`+°Jšãñ¼7‰âŠî°˜CHóbŒ`_èz]:ZbH©¦'Œ 2±Ô0®q òx%M‚ÿn–£Ë«—Þ`RÄ.Ëß:§þSyžXúÜä›ÏK9ÙÂcì»»fÎ7Hì¥û·:žˆŒ'è4ií˜Ø’cÝùNkëÖöX <8}²ýÂÚyÓSó]¿c:kÐ ÕøOáC¬ÑçÙWtô¥•s·e€9=)¤ÔQ‡Âø‹ÍÝÈS‡¼›^ŽÚ 3oÏŠ)!0[=yÍê¦÷/êa^†4ýÕTUx|¤µ›_ú°41Ëï‰sþŠN´à*“ |¨Úÿõ#i[¤¹Õé¼ØŒ!Ê!d7Òâ:ßáÇÔ‹„ÿ(ÙfÐendstream endobj -6589 0 obj << +7085 0 obj << /Type /Page -/Contents 6590 0 R -/Resources 6588 0 R +/Contents 7086 0 R +/Resources 7084 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6566 0 R -/Annots [ 6593 0 R 6594 0 R 6595 0 R 6596 0 R 6597 0 R 6600 0 R ] +/Parent 7070 0 R >> endobj -6593 0 obj << +7087 0 obj << +/D [7085 0 R /XYZ 85.039 781.388 null] +>> endobj +2814 0 obj << +/D [7085 0 R /XYZ 85.039 597.626 null] +>> endobj +6241 0 obj << +/D [7085 0 R /XYZ 85.039 565.205 null] +>> endobj +7084 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +7090 0 obj << +/Length 2306 +/Filter /FlateDecode +>> +stream +xÚÙnãÈñ}¾B˜—¥€Q›}ðÚ—Àvƃ̵v½A6XP-1¦H-IÇŸ:º)R=0`5»ª»ªë®’þä$„¯“IK¡ãx²Ü¾ó'k€üã´&Ð"0Ög€3…Jø&:‹ciÌ"™m$âÜÌß]Ý)¢|†z2rŒ„±/â8˜ÌWÿñt,¦³ ð½‡t;•Þ"Îtyi¹âEÕn²š—·÷€p7Iï7BoYä°“•-î5ÓÿÎÿùîã¼céˆØÓ=bZé‹ÄOúLk_iˆéù&o€­½åTEÞ&Ým†lÔv¿*§*öÚ9, Ù ¿oÏÄÝMgp:[â:ÿ×p—Œš—°~ªêmÚæ®Å¥çI)âÀŒ?ï€ãt" h)ì=/ˆ•0‰v:‘¨“xŸÒ%½Yl«–VÆ‘ì¥÷· º‹Çìá\”? I þ{k/#žÈEúh€ªÃ'º¨×ã—{ÖC?eáøN¶Ô侞âó‘~¾žpc!õ™#!X”78”ˆÂhÀAY!É6¸Mj,åïÛû»»ê¬Ž¿¯ïÕÇ+½oØoZÙêø5,Ã$æeë°Ç_v|'¾ìïÈÎõTJéýöñ„‰ä5*QÆ'ë¬JFÙÏ7Ù+¼Þ÷Á•I¥-¡¡ÛeºNÉ3ûàGrü«0¼4¼pyÉOáŸçöJŒt*IøN‚ðtŠ‚{ÂC5¯—Õ–c µù/-ò–®c“îhöÎ5fTyítÛ°Öµìãº3Cƒèfã|B¨ž Ì«Î ±\ãs¤>Ò ãà»Èþü˜ã;IYÆ0’ ¢‹ô| +2F‡(x>+…/|Fi+·Å¨üµŸrÔŒ½ÉÁžËm¤ùm„^š)ʨ°wüƒ‚­3 [±•E•®ÎHâ ùGáke@ŽñœÒÞßQت›…Ó^º§/pCyMNœÂù?üÀGsrwôó©bÅ'HüǬ€·¢$¨0±ìrT/®Ùça± ‘dtCɬë,m ËPV¢ÞÓrI(:T¦ +lšt̲–¥´>g ýz†ü|Ïš^’¢ìUì‰ÇXÉ]ÒQ_ +‡—Në¸sb Hî•aÈþ~B.Jô3¬@ÈHxûf^@º*ïË[‹PÚkR´øUŽ¾ !%‰P:C…ý¯ª-¯µ³Á¿š×è“¸Ñ º ªLt™C[™ †#èm`ÊP/C”É,(ßîlàBÕ³KãÍ®lͺi?3*¨$bMŒùo<9;ÜY‡|š#‡÷!ÿŸ3`å˜r¡ÞØ£|”“Æ(½Á-HÆhgeƒ*ú ©ô½ÕáŽÑÞ‡´o¯¿ž5J„~<òL‡1Jjp ’l¥[Ö/ÖgX Dæ±”7+ðKÕÖÐøìQŽLìã|êh3D"¶KnÂÚ.ìR0‰oÇÁë™réš¼v‰<‡Ü0:mBƒDÃ;Œ§•…Süª¬C!b^>q”¢ëJ{Ëçà™D}¹¤v+¥·ó]ÿâ°³ÿΟ˜o` É ¼>ã›Æg‹´éÒ0ÔNÍ«­ô,[úÄ,gáYW? Ü4C§­¡¯ñý7]ÑbÏzèd5zàGw"Ë›¶Ýý|uõòò" Û7ÆU‘—ûïBòùó%/ŦÝÇÜHÌRCîŽ[~‹sÂÓ¹"Zv´T f¶èUÍ!|Aí@ t)ìa³ÉI£j6 Fý}JmSüÅÚ;ìÿ~ÐA^.‹ýêpKß@.uÍZ"ÒáhSÚùØ5k?I,]׬l×ü…†Š§·¶SfCºÀ½ç ?h¤¾ˆýñZ%¡Q<`VŠý»cV…±cÕcVzÒN_n«Sþz_çåš;ü/WŠWSHû^½³£ª¨(7eËÖNj«îÎ"ÐJশçò4Œº™æ[š)àçSÿƇt ]Ñyé©0á#†ÎE;VF“€n8äØ¿N!’|`k;TNðQf¶ †/¬¡9‡ã¤Ç5kTX”.|°q7?_z‡Í(üŽ¾ã€Cï0r0§Â€¥8$|¨5:‘„"âQ‚ç„âp.!•ÐR (r‘R¸£&Õ~tQäöuPžR ßÿtƒBûdÏ`Äá¶þ‰¼ÿ¼eì»äE!öp. Ñ!½%Ä1‚)žbŸâüöëÕý×¾0X<ÜFenþ€9h¿ëºbJµí¨x-”÷•Έx,Ò›â!xÏÅóâéQìlì=”¤7÷_lZ¨xp4̲²”Þ{>ƒÉ¢¶GÝ1àÝ|üõ¾µ°*ÒƒVö¾l .x&‚‡cÛÍëij3ܺ!ÐVúU=¸Q­3;ÔÖÔIž0mŽ.£²«Þ¨zs‚š»'´…5C]©‚½/a—|_Ê?‹‚ð¹Cæqõ–¡<ζþõÍ©àA—o§Õ@g&L˜]ùä±®Ùqc›r%–Ô uÞýŸ:A¦Q.Ò¢ÎÒÕ+£Í5p«7~-8¤ú0ð *Z¾¬ ÖøÑKñƒZ¯ÔEÜÁR°³à͹©H™õÔ‹Ïyv*129ã™°k÷©ëtš5ÒêO¼ï¦²ÝÓ–‡1¬ùñ97Äõgº¾²¶¼¼çƒÕ3½÷¿Ã½|Žyà!Ð8¶|ê!kéïÏ Æª‚'S«,_¨Ar¹\k9Ì3Ý’¯E¨ÜeH×è“àY[±¾Lñÿw 7endstream +endobj +7089 0 obj << +/Type /Page +/Contents 7090 0 R +/Resources 7088 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 7070 0 R +/Annots [ 7093 0 R 7094 0 R 7095 0 R 7096 0 R 7097 0 R ] +>> endobj +7093 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [135.619 595.065 177.399 607.966] +/Rect [108.346 540.868 150.127 553.77] /Subtype/Link/A<> >> endobj -6594 0 obj << +7094 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [364.771 595.065 397.369 607.966] +/Rect [337.498 540.868 370.096 553.77] /Subtype/Link/A<> >> endobj -6595 0 obj << +7095 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [445.251 487.277 488.456 498.967] +/Rect [248.84 405.982 292.045 417.672] /Subtype/Link/A<> >> endobj -6596 0 obj << +7096 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 473.728 136.793 485.418] +/Rect [318.127 405.982 343.604 417.672] /Subtype/Link/A<> >> endobj -6597 0 obj << +7097 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 446.327 330.942 458.319] +/Rect [208.892 378.278 428.518 391.179] /Subtype/Link/A<> >> endobj -6600 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [377.921 352.358 620.096 365.26] -/Subtype/Link/A<> ->> endobj -6591 0 obj << -/D [6589 0 R /XYZ 85.039 781.388 null] +7091 0 obj << +/D [7089 0 R /XYZ 85.039 781.388 null] >> endobj -2718 0 obj << -/D [6589 0 R /XYZ 85.039 761.463 null] +2818 0 obj << +/D [7089 0 R /XYZ 85.039 761.463 null] >> endobj -3063 0 obj << -/D [6589 0 R /XYZ 85.039 671.062 null] +3169 0 obj << +/D [7089 0 R /XYZ 85.039 657.513 null] >> endobj -2722 0 obj << -/D [6589 0 R /XYZ 85.039 638.952 null] +2822 0 obj << +/D [7089 0 R /XYZ 85.039 611.854 null] >> endobj -6592 0 obj << -/D [6589 0 R /XYZ 85.039 612.337 null] +7092 0 obj << +/D [7089 0 R /XYZ 85.039 571.69 null] >> endobj -2726 0 obj << -/D [6589 0 R /XYZ 85.039 430.884 null] +2826 0 obj << +/D [7089 0 R /XYZ 85.039 335.736 null] >> endobj -6598 0 obj << -/D [6589 0 R /XYZ 85.039 404.572 null] +7098 0 obj << +/D [7089 0 R /XYZ 85.039 296.178 null] >> endobj -2730 0 obj << -/D [6589 0 R /XYZ 85.039 404.572 null] +2830 0 obj << +/D [7089 0 R /XYZ 85.039 296.178 null] >> endobj -6599 0 obj << -/D [6589 0 R /XYZ 85.039 369.631 null] +7099 0 obj << +/D [7089 0 R /XYZ 85.039 258.647 null] >> endobj -6588 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +7088 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6603 0 obj << -/Length 3455 -/Filter /FlateDecode ->> -stream -xÚ­ZëoÛ8ÿž¿"ßNjZ$õ\ 8¤iöš^šôos‡Ýý Ør¢«,y%¹n¾Üß~ó õ°ew;¨ùg†Ã™ßP‘ç.ü“ç‘/\Ÿ‡‘:ŠÎë3÷üfþv& ÅÔL{4ïæg³Ÿï\º"vãóùªãã Ï×çóå¯Î凋Ïó«ûÉTkíèHL¦a9é\|zwÞsqûžçïæ®`枇/¯~àñË›ë«ÛùÃä÷ùdz«y+T»£Dœýú»{¾é?ž¹BÇÑùÚ®0½>‘„ïiÓÏÏÎþѲâ9ïœWÀRLe,båŸ6R …èÖH -f¥ˆ}$¥ZªóÐw…ïzd%0Œ 9ü7õ}×ùPN´ëì@û@;‹¤àƵéa CÒùÍ•Þó¶Jyü‡fŠ{-ÿ«p|ãš~s}¸“²á±Ë²(ÒESòaø€ó–¡$ßØŽÆÓµ§R‹Ø‹HÒl§ƒTùÎUô!Y?%=v:¾œ6mGC¦•~ÏÿZÓJ_Ä"™þ5‰´Sn'S¥$˜Bs*¥œ-èSã@Êýæ…ÚYÁD•šÎ§lbÖUhwZP"EÃó7·¼üÓY'ÏiÅ}%Ô‚I.ó,-&*â%Šø—†êŽÌŽVåzß6žçÂ^«'ªgCqß÷RC=í‘ÚiŸ'ÚiÕÀþ›Ÿf3Òm#ÖÙ¢*ërÕˆE¹ž½Cµ[ƒáõ}­g—ØΡ¥Øc§!‚XåÓÅ-zÌ݃šíëÊ€|f ÓÞ[šÓšìsBMyæ4p=è€oÌ<À¡î‰"µ+B¸ª¡«„'d^K=푸áOÜú…οـEÀÆ‹¤*s±Ë -kQ´ÔöÛÄœDhÒÙr2jºÅ…»Yž íÚø/,`†ë|_!í…BÉp¨Ðžm-Íi5´‘N´X‘Ûz³.1ê(/t²‚Ýy4F%œåß”†™‰ -1’a¿)y>+¦|FJ‡Â‡€KgäÅ´GÝ$yŽÑÂM—Ððcg[SŒÇD–YÍÓt+s¼ŸÖÿÀ"A•ç\†ÿon›ú%Ís -a¯Y"»†ièþcÃjNžéç7ÐAx:#¢ …¡èÛ Ÿoæïðš¨/”ü€kV°.í6Z#2ñ×eQª””jJ 6¯ÆH¾Q¬F‚D™‘ì‘r¾¤ý(ZCç x‡No Þ$ȵÉø p„\iiÚKÓÀ@ðbx’u‹”|ô'ÖW}Dh¼àñn’hÊ}[§Ív#Òïi/GXÉaºH›ÝW8fQ¿ÖG)¾-—v~ÏÆà5`eÏlÊ™‡Õ¥#ewDï ˜õßr‡t1î¥Bi>L,Æ8’Žt‘×å4£ç,K4×_^4H¡j‚v*ùvisÉÛÝ"¶Q®ë2Í#û†¦œ^ˆª§É"!¿'† û‚±Bß\x05¦4Êœ©Y±ï70´Âœ`Ys=ÏÕ(´0“SÀ[3:Éc×65£ÍZeÁ:·sCϯú®’bÕà䶺jÙ$fbCFc”˜VÆ™ç/ia®ÖÒ,,ù×$¤Cô£b¨:´{õú J%@Lj€´ -C—iØ…(k4¬ý@HXØ·Jjã-›‡gOÊ‚]=©Ç24s°áÎ[þaT[$ë6nD¾Ußcß:¯…Ø6H˜Úõ†ïÁ"ÃQô}2®â©¨s3Q¨½ (øÚ -„‘âö±däÝ«C JN G&nmioË„/ãÞÅ`ä}‡B>­IÍ¿äNy^~èpðÀƒ}Sp‰?z=¼Î ØyËdíYî¯9P­…”ßtÑÓwhn\—ŠgñÓˆ?|æù›¤n]ëcj/Lø7üû–9ß\ Í®î?bXŸ‹ÞrÚ¾ú˜vëwkŸ_(ºØÀð’ –VUÜeímNõÉ&ïìÐ(·ÙŸ6X^¶ÂUóBIT[¿#²]ƒŸyawÉ¡ƒµkþÊ­Ú¼›µp<[QQFk(Ûa£õ(ìŒ]GŽ/»àkg1þØ.ÓoÙ‚ÚÑÈrëÒ8kn]U/’/kçìFáàwÙÖè¸MÎ0 çí­Aš‘KûÌæè$‹f‹á›,D‹øÊ–¥Q§¢Fžð ¤ÙßÛS)åÅÎcV,¹â±È˪¯L)Còúç¹B×Éë#R+€®‘öƤvé¦G®>©’ŠBhÈÓ¢ -}u%¢ÆQšñ—ÚX4ÈðÖ¦*œ_~Ƹwý™5è¶øÚ«á -BïS¶˜KdU®šcº†JD‘wZŽæxͦ|à;Ï/zNÙ]rƒÚkã>sìô”A°Êz·ñë>¶ýdßÅM¾1X¥ 4Ðé? áæteL¤:AÆ¥IóøtwŸ|]Bs ‰Ò¤²ázp $|H>f’åKb$ÕâM=DZO¸å³y‰>¼‚½o Fu|"l]ó›R•æ©Kžµ_Y¨$i¿Ÿé×&„cÕBb6t’¥ýS¶d2óädµÃ¶VÓw™‘áË÷÷ö©j'X}Ʋ"Òó=ökQ°ßS†ÚÏFž¯»rgVtXøLSeÁ£Fp" 7*n×Yc–%f§}Ào-c˜ðË‹ÅÏàyIX„…i€‹¬)L†Ç7Û¤U¹l¶Ã(µ«g›íSž-fÍb“mf»Õ®ÑÊ>×îÑÚ‘´µ ;…–ãŽy‹¹ä |Z?,ùd„@Œékžâç[hlè=²KÎë–€¹øœiÒÊÐSÖL—˜e¥ïܦ»n¸C%öK…õ^ä¾]¦£U >Rد×·w—ïonFÌ(DZ!}3ÂÌ¡4Óó«›Û«¹°µa$a?\ýójd -©;"ðZaITcŸ2$œˆš‘oeýrûn~„ÉEF?à£Zà¦ÿ?šß_\^ÝÏŸ‘ý' ð0¿8ÊfxšJ%}³ñÈãž• lELíÉj8±Á ø'{ çH0· â“Y´GsH-…Rr -ìŸ'¼‡ÙP 6-êÉ{W½ÿÆcɪI Ú$uÝ{6¯Â‹—¤xN)¥"Åái¥:šãÐ@Joüêcì# aÏsM4µÙ£æÑ„(enëWîý{OÜÞe¬«oL2„µ¬]Öø÷.‡oêH„–¡\¡{o§ÈQ^s—Ç ÕˆÏ˜1<Éõ±‘`|/ž…Ði†!wÍà lq‡ì;OØ/†ðŸ)«®x1K(]r³Ï©NVm -mw1µF̵&ü.Í/%þxÊA·±ÅÇ‹i€s!^ʹwàX°1?鵫FŠÂÜåC^Éè<_[#M N*ƒ±€ìó%ÿvu ț Õ„üY<ÜØokr q!é·™¥è -0l­êÛìؾ⫆ysÚÙoߘkŽ4´A`×½¯|™5öÝ×>f±$ûؕΟÌCiï%ªÿ×¾aïì·åºæ.•°G?kiW¨x¼ž1züOÇÕ†OCáG_)¡¤•…\|„ çGúPàÿc&:†endstream +7102 0 obj << +/Length 2860 +/Filter /FlateDecode +>> +stream +xÚ¥kOãHò;¿"â ŽD»Ûvì•F'`á†9XíÞin>˜Ø ¾qì¬m†áß_=ºÛí$0{:÷£ººªºÞñGüóGqèz2Íbß•qžÝ/.Æ)¥#cw<™Íbg>ö³Ïçg¸8g·¿òþÝâã%ì<ðòÅõÕœ×/n®/oóñ×ŧ£Ë…!Ê\$HÑŸG_¾z£ ¨ÿtä¹2‰G/0ö\¶7G@’RÍË£ùÑoï#>uH!Ær_~x@¡ç†^@8Ë2੨ÖÀËÌsº§œÇ·ã‰ïäÝùõÝœW걈ïø'Ç­†W÷ÓëûcždMÈö`Š¿¾SÁfÝño%˜vÉ@Äãx"f¼š©“•&‹Áñä÷Ój,ç9-y?­Ôÿ<`‹/<¦¾©„Á+ã¼ðZ º‰’MHú §®Ê¢ê§YM¤©xÑWÈh—vE  <ÀÌ;º±ãƒŸax¿˜»ð¹üçå).úβ,–cýÆS8Mß»Ô)Ÿc˜A„9¾¨«{~€ë禧ïæì~~Ì $ŠþD±Ï*â“R8ÇÈÇõùg¥à€p><¹E]_à¾R¿C|¿k{韶è¥`ñäŽ5ug ¬.ÛN8‹'Ò€+QSªœ'z´O¡Ùìh[Æ· Zºå‚¸oÔ؆lضœà…Pó*¤"ò¥3ÏË|©u$NàÚG‰G*RT9oIÕ²´ÓnS:+MÔ ù@Ý“L _'‡ìK9¡ÇÆDNôaëÊø2°AèleÞ›OÉ©ò~J2[žÊeεl$ÿI_ ªG”gºVëåÙ&z +èÙCíxW÷Ü%ò}ן…ï¦\ %v}7A½1 GßYÂÒƒDE`8„?“0ô´§7­Dé9w*¡ªÃŸt,á1H,¾#yUœ´­ãå‹1ÇQŒ)ËuŒjfáò]¡Ö|¼_!ªñ††ÇDׯì ðàÿË(Œ…ûy3% ÁX"ekÿB= å*b á˜ä&ç9;i!9päjò¹°#MMê•ÊI`ÿæì–cr’V 5 Ï…+– rQ:´Òž®K”V ÿfW0?s!1<‘hp£Y+ˆKHzbï‹i'Êi…¦°ýe:%Þ¶î¦X6u[¯:wYo¦ç:ŒÿhE¯íôBçEÎaÝ3LA*ŸÏnQîæbºËS'nZ>àiç¹5ÌûœìbBN8O"/p# œÍ5>}£ïI¢ÒN³eQYrî(½ÈÉ3ôExˆõ#I(ö— M¯ß"È <à}ÕjÍ0¢ýÈ•Q @îP˜‚Ò@Ä]Tú2æ<¢¥EUF£Ó.Ô¦WÞÀ º{Ü$¢ =– #~ÚPZGNŽED1 +ÎI ¾L\/ŽfùäŒ ãÛ_˜mi³-b{Hz<.¼mÞ=oÝüG¾&a·Ê»—om—ºíë¡‚!¾g™Þß‘ôäÀV]ĆHi£•á„XáÊ'ŧ.y™Ã –‡TsJH«ÏJv˜÷ú+(lœt|Ðv:Œ}F["L–g¼N•ƒð<§…ÉaQ˜„Ä”NrÒÝ; +uwÁë2™Q„{^Cj¹„{@° ôš¬TVüЦ§äÃpy>X¦ì¯09.éT|Lj™t=OŽ€8xžÙO|›†žXàûaç!߶̔¯¥h­Ä^nK‰ò´nÅÔ +xÁ¨n¾Áú´Ê +-Ø=Ä3’³!';MüOxn é·´1O³·ò 9‹ádðnð´`ÞÌ/d(Ýxò ©ò‹{êIT§¼ KÑ ûß͸Æôâ…l̓GÜè35ñõäŽ" +åQ„U¢v"ÄßùÛ[܆žƒ7z—ÛæÍ\Aú‰;“>q{U4FÐTµB1Õpq©ò\ 怅C"ú‘²‘¦ð6Y"~Á"þáú–Êÿ_Æ>8…ß¿òùO®—Uá_JDë¦DCš k\\JË] fP­q6È”kxF…Ä +(º ᨪ¾|³H닳ï $8¤  LôÄûVSÉg›º<Û³vÈyŒ ªº~,~ÞÄ“.óÁÞDãšXÈøÐm¯¿êc÷„!N͆A«ËS¥`Whç`&p ‹\×räL;ìqH?tÚšAûX˜^t5W*D&L’÷Um Ï­-Y5®ééÖä|`?¡×C]¾½¶]¾1•Ònˤ‚pO’³^p Ú~w ‚!“MÛñdU7ÖaROÝÒ)ŽÓ¦¥¢P: £ä•Êû°=©nbªÉ ã‚Äwt M®¨£‘ƒPW‚rl¸u7§¼Ì%„`¶]6ìo“b¥úÎüì¬ÕƒAN “[<å^r°¯ø,çÃÓ8mY…M:´,€yãka¥QøæíêJC¬¹Ð‚ájú„–‚Ã=l(ú¨ppÏ;íƒNWñƒ¶ë!”Jí{²LÓ Ý!¯9ô›DÖ¨(ß©k¹ŸÞ Hú zæáÿÂ9PNÓÔÿnJP…ЂR»k—I•”5ØõñžanÒÖhþ§\»:Øoø«è¼9›_>|¢†µkåÿ)ï‘ÏÙ¿ÏTܶÔnà)µ»$ÔW¡ê«¤ªc[öuľhØSã‘t»þ¬Á.ŠÛÙ¦NN/w<5d»÷ JÐ©Ó “}£Xñ/¸É™p0³jª :ôC . DDé`Ó.U_„SµÐm–/–j¼\7«pW™"y=œ§]§Õe³Õ˜kEësEm¼·c|eǹ¾ +ôÆ• כϦ3Œ‹ä´BB“Ãìâ”Û—Tyt;&Fà„‹ > TÖ†¡a»\g^”–ßgIåñŠÅuw@*J]Á­¥E )—&GÅŒ»Š[e} þ”ë¯ZÿN!1ü¨PG]õS^,T›%K#Îø¾™€Äš¬xàŸ~ä +i[l¶å+7ÓŒ{–*;Ì(b¯5u9´b!™ÿ£CE¯ô3Z@¬:ó_tÌ¿Â=©°:k×ä>´  +ªa{×jÃÚšMyÄ@³ß,~> endobj -6606 0 obj << +7105 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [443.558 712.238 717.944 725.14] +/Rect [416.285 547.932 690.672 560.833] /Subtype/Link/A<> >> endobj -6607 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [129.766 698.689 348.214 711.591] -/Subtype/Link/A<> ->> endobj -6608 0 obj << +7106 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [338.851 570.769 555.269 583.67] +/Rect [272.007 392.913 488.424 405.815] /Subtype/Link/A<> >> endobj -6604 0 obj << -/D [6602 0 R /XYZ 85.039 781.388 null] ->> endobj -2734 0 obj << -/D [6602 0 R /XYZ 85.039 761.463 null] ->> endobj -6605 0 obj << -/D [6602 0 R /XYZ 85.039 729.511 null] ->> endobj -2738 0 obj << -/D [6602 0 R /XYZ 85.039 545.678 null] ->> endobj -6609 0 obj << -/D [6602 0 R /XYZ 85.039 521.696 null] ->> endobj -2742 0 obj << -/D [6602 0 R /XYZ 85.039 316.435 null] ->> endobj -6610 0 obj << -/D [6602 0 R /XYZ 85.039 287.031 null] +7103 0 obj << +/D [7101 0 R /XYZ 85.039 781.388 null] >> endobj -2746 0 obj << -/D [6602 0 R /XYZ 85.039 287.031 null] +2834 0 obj << +/D [7101 0 R /XYZ 85.039 611.175 null] >> endobj -6611 0 obj << -/D [6602 0 R /XYZ 85.039 265.839 null] +7104 0 obj << +/D [7101 0 R /XYZ 85.039 575.765 null] >> endobj -2750 0 obj << -/D [6602 0 R /XYZ 85.039 145.169 null] +2838 0 obj << +/D [7101 0 R /XYZ 85.039 378.644 null] >> endobj -6612 0 obj << -/D [6602 0 R /XYZ 85.039 121.851 null] +7107 0 obj << +/D [7101 0 R /XYZ 85.039 343.84 null] >> endobj -6601 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F35 2880 0 R >> +7100 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F35 2976 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6615 0 obj << -/Length 3336 +7110 0 obj << +/Length 2667 /Filter /FlateDecode >> stream -xÚ¥ZYsã6~÷¯ÐÛPUCTíÃÄö$ÞÄÇÚòzRIh‰’X–D‡¢Æž¿}‡®¤fkjLh t÷×¥üSƒÄúNq¢|$ƒÉê,Ìaä§3%#!uh~Ÿ}ÿ)2øiƳvë«ãéïÞùÏïÆ—÷ÑÖÚÓ‰?Åqâ= •÷ñúÇØm¼7<~;þùFî¹ûüêÓ÷Ÿÿzuy3~þ9þ÷Ùå¸aªÙH‘£¿Î~ÿ3LûŸ¾N“Á´_Áðê Xò­Ñò¾<{8ûO³™Ï:t˜·‰Þ¿e;7 B퇡Ä6ðm`è -®fÃQ¨­÷u&^¹å—i¹†“~¨ñ-ò¦Ð.¹Y/ ]lø¥7e• úèå@\aʯõ"«¹õ4ƒÞ§9ϯ GÊ[ñ_\î†/¯d‹¬³ÊvCd›'9·Ë¥¼f› Ò¼g2þÊe0’K)¼É”NžA*ZsÍ’,fø ÛƒagM«ÓpÍÏŒëüU.‹Öñi³{Ýâ¹ëî^OÐ1ÛÀ—·b¹t»Õ´Þ$í9_—rO¸UÆWèÉ褛7¼v".{ÌÏ wHœV msÝ9Ž!)Ù²–P°0®þ>”“Rï ò•ž¶Ê–†t2„Qå§Ö’NªÐ×*D©Íg³eÖ>l -FÖÞy¹Fšo+¤KÐðªèÔˆo"Š¼¶³õ¯³XÏœ J•ŸD§q¥CsÀªÜ b7Ø'ž`¼È‘×0MÙZÒ¯_QtU9¯²¿OPÜL0]¨IdõeîçﲨÑÔ‹œKÍoS'u¼pÇ ¦bªMg½Š›å¬·^Jêøé‰;µ¯÷ò/¤ÕAO¡ÙkQ±7&š ÂâM;^j>öÕü¬Q¿¾’jáÆ6ô.?ß AY$ùøîWÜ…n…¾‰Sà÷^ EWˆéFÆ?^\_Ýœ½~B5ºü¼+z)°6Š?0ÿœ6ãÃÐ<’¥FµöUTÕ7&j6$ßsð Ü:}N+ãOW7·xʧ‡KÙØW¡ú‡Kõ¯Œ0ÁbÓ“úåçK‚‘6 -u|Í­l:•†tNKé@uâÁšŸ_ŠŒ¤„ظCÃ@h[á{è]ügsÒµŠ€àѤ÷™È!nrÆþý£†@I,d×À6œsË'1Q -'SÁM;J÷và+m{÷Š]âo0ÇOhðv%wNJڧƕKî[+Å™üþ„6‡“ìé–¹¬ˆžL }êì ¸òŠœI¦Å&{^²oÀ÷;\·õ -ìiñól‚K-È4ç]k¶ì ë û€ÉÐëöÌÅAa§T±ƒIÆH[lÚ<ø/Yd“WÇ@7Á%ØÓ ÛÒw6«LÒžÛ0Îms—±@G€^€\âŸø®ó˜nŽðk“€9Éo‡æ¸“°Q -N‚C¯'’Ç´Ñ$"!uçe^•xǯBBíC…Q$ˆ¬ ÌHØÞ‹‹h ‰µfM€”,×õT\&Ñ‘ÁâŠò⎾a¡¦*/ìøŒÇ5âÂ;è$\øáfÃ6,º^æn$LnŠº opœN\nç ¶ìcóENªÿÂË!Û»® µ¾œ´0ˆFâ@5ŠûŽ¬õ¨C~îwÖ$‡¹B>žý2,¢Ÿ¶ä–wØ2Vê¤}¶vÏÑœf@ÞOBÛc†ä¾Êê¢\ Þ”Ò=‰|§ö€°P…Rã-Ià,„%ÓÖ%?‰¼£¦“bö•GÞP@) $Î]dU6©)êǾMÆ—…dÒ³  H÷¨¾ö7Û"‡]›˜1àT‚®…‹Ð×ûèÇØ舟FÊcA¯²Ñi0hHŽc—ÏkÓÃ.+ØõØ®ñùÝ÷Ww \(|NÉfÙv)1=‚YUÒÀAÀçfߤ‘›ÓàÛ¡9f’‘RÄ+! V†Eß©²ªy€|kÁn‘{þÚº‹—†VÖ«òfž¸,¢m3xYâ9§˜!`R3å׺Q²Ý™ šÕäEJ´Fz^ú›‹Wš/iBv mŠ¢@¥ # "p]8Ûû’ço ['©GrbŒEtê}Âh¸”!b¦\å¼h•³ ’UÂ(¥«ÊvOyK·úÎ)# ê/¯x)n=u²JN€“»‡Žç&•Ï^¸‡„N[‘§œz¦D,ò„Ý@+uÍ©®Ø¹ èÝ|•üÇ•\„dlê]Ij„Ó(¬s|äfòa–r†Œé\…b&ž·§ Á„€ÅÁßØTKs‚’~@ (<¼’eçù” ÝéêµI{Ë/ùªÁ¹ú£Œ§öt$Ó¡9nü:Iü(aôº)kÒŸTJ=ØÚ°¬Â ‹Ë%Ša)´»†˜‚KÚ6&œ’pÛåX{ë&0ï~Ñ(ëýäK/šâ9ŠSFèøýk{c\éüZÍl'äï”så8ufBÙ…îÞHÖ%¿=Œ/¯ý«›«id:B„+±Õ0 Ž˜‡x™¶Âú1Š¤žâ[mU‡Ëa@”ñ*t!ó -§æ Fݻƒ£0ZL¡Åàªô­?ÔR3ƒ´IõëX/kN`bºbL  þûÅ/6œk, -Ú@òž5¿äï¯Ré+Z×,¡QΕ€7—o ýEîª"àòj.Ã9H¦å -©©æ‚õç°óŠœMJÅ[Ú˜‚êäÒW^×¥±S”¸âh™á£Ãñ±"#3¦#™0ô–Y5ϹùehÁ¡/ -†šÊ6*Ò‰á)äxª³CÑ"C¤Ì·õ¢ëNBuØÚ`‘kƒž*oC4pµ„*¡r& Áö×zA—<çÎŽ"U̇µÔ€ÇÜ,-’–b—[I^§Jà[¾n¯¶l\1À38DL}AÅn¥Òj(–èe@g4*ô:Q©,Þ8¨Þqq$n;빡)Î+¿ àÚÙCÏ zu©3¥–ø9!p’K¡u!eØ·NÝÙ¹ECº]•+7o»)6žD¥!ÉÜ "»‚-+;ËdðÃ]œeš£ÅÛ < O—>;4Ó2¾6Q×PFÅÎiQnRLp§”X;ÀÈõCj¿ÿ¼¦É1® E6ú4S ÉqÿðO‘dÚø¤-˜ü†ˆMû§<óJÇû:öñÄ‘€ ø¸r`^Q‰ÆjÐf§[ïn)dÎ7·ãKligóiƒAX8k>t€ú%g[ (a—|Á€¥2ðlº­ÕÜÛƨ|0™tûÜ´8Ú?·»IBò¦À§!lï±R0p&W¬7X…Æ8òeF*õ&€Å\ƒ!¨r¥µsZ¹Ï³Yw^dRûYH(°)ûY•kš “žVí—¤Qdbï7ʶ;üUù,¯RZ#²£j”CÞèº)ÌV妜lLL¥&ÃK=sǦÀ\Ý{©š¶êWI!¬ "$ôlÅ’lYëè%blU2SòfÄÊ^Aò¼ OèWˆš7ÃÛ^¿WsIí@:Q`ÝA€„X>QXy>„SJŸJ)Íô8¥Sß&ÖmÌý’WÎÈ÷ÀÇG~@ô·Þ/ˆC7¿>Þ]øXŒÿ|y”wø‰VßÎ|;ÿ÷B„ìß5èŒ*Þ`w…öÕÍOÈ0}Œ9ΰŽý0 ¿ávþ †…¾¿;ïÜr£—rÑ÷Èø9Êâ „²†GìûÛ‹µkýíçhçŸ8‡†¹:Å…1Þ‘ñ+düˆ@a9Ý|;ëíü¬ ‰@ ÌœbD=î…;ÌýÅ=Únÿ(hi¾Ž =­XÓÇå¦ü—‹äþm]b«©Ö»~àç-ŽÖË’ë/ÜÙ|2‹¿ˆÈ›Uªì™"l-e$!d¿#ý ÉmÔû&–“¸t·¿^Š€äH;w—@*†Ÿ ›Üñ]r«šÏW\Ƶ±ŸFý2.Ó7?ÓHÜÏ4¸„‚n¨›"Y固h±Î¹oFñ)¶ÄùSE#â'°¾Ÿ$¶÷Îï$È¡jt‚÷B~^’¸zpÄLK¼M-($±|b”϶gX8€xµóÔ$íü0F²%ç ¨»ºX]U]oë‘ zùÊvãQiåFÑh¾¾°GK8ùñB ÆDP&=œOÓ‹Ë;?i[Åv<š.::¾ò|w4M·®ºzšÞ~O\×µÜH'aYÏcm]=|ºB°g]=Þðù—éO·pò•Á×÷wÏ ¿þ|û8}ÿ9ýùâvÚ2Õ^ ÄÈÑ_¿ÿiRàþç [¹q4ÚÃÚVŽ×À’ò=WöÅÅóÅ¿[R|æø«!Œ‰ŽUìøï+)ÐÊ ÜVIœzÊõ‚¾’|[ù¶GJ½¸ ß‹­Y¾I˱«­ýx¢­äkÛªpZ3<%” +Q¾ƒÂ–U¹Ãõ¶>§"/T¡ö†˜¶A"[E¶û¾Dn b­$Ò*öý¾DÚQÎDÚÒ(–o[Ÿa4ÈcVòaQ¦¸†ýÓåý‹Z7Éü»H]•kÆ{Èg^•u¹hÎIhÇÊÑ; µ–„ËŠ³qäZ°ƒ k@cP¨+|`'T6˜5 +55²dIU¼‰ ×OóÄxHfU3æ*Iù Å/–Âù Þµ$vï‹é>~:5«¦,ÄYs±˜.È´& e犿/TŒ´×R™ª­… `b=èóef0Ö&täËMÙ&p¹Õ{7 ÐËÜÈ‹ŸõؗꆲC0uçIQ +K‘E„ˆìTéwC{çl¶r=­‚£låJ¶º.7hBË]•“GPëÚCùgœž†sDä´ÀoÎðîBôïÎÙ¼äÚ!4¹ú „ëÇMŸT ?\S-ñ±’5ƒ¨JðÁ ŠIºÎ7óÅRszÍ$°·QS[@#!Ÿ¯æ>˜ؾÍÀï|U-´B ÎWÂîìnÌ긫´`¦ò¹'}XC‹ì²œ…â¸4~ÃÖî4ö*L1›1ÂíoT“ñøöWÿDÊ—wžîi[;ð°´9´-–Œsð":Pnà +ÊÕÍÃýãõÞø#sdžÙ@…q0rbšzçãɉ«œpxn21´&=b§&:P¾Û^Hƒ¡Aayõ¡¬ž @Í|ó%=PóC¥ý¿S;Õ«ô2Ó¶­ØÐãcèP¼}ß’0Š¬Äsô“%/ºj±©ÞLá)¾¹í’s5OúÓ×}/ö íͱmœ«µçƒ³¾?ZïáœuhíØÊö¢‡öÅ¡¿õü¹râìBf)ɲHvE#U#ý3¡äŽ +uqŽy •¼¿Ï|‡sÖ½á'– Hý4ñ &ª{:'ÇkNY'—/AþÚ™«¬3Ÿ²jLüÆ£¶ð u¯Ià¦×“!b;Ü8ú*bë·®žŽÉXÊ®€Q7QÝ„$Ñ©¤¨vÌ™Cƒaή cKšB„qÚ^Üdý>5`Ýͨ=”›üŒw¬Ž¤¦JöÔßÁ×]_˜yÄ\æj¡ùtûížl:Ýì×-[è¤Æ˜4W1ð»n[ßÀ¡A•%ßùh°G?|et«“WF竲¾´ÚŒz:0¾þV7{s-mîÈåß&Û*«wk(ÞzÍ Û¯y<ç8ëÙ®­œxøÿiòÆÿ×ÿ#[ó\¹güËwuŸð‚Zõ\÷˜_â…¹§ ÿrÆåendstream endobj -6614 0 obj << +7109 0 obj << /Type /Page -/Contents 6615 0 R -/Resources 6613 0 R +/Contents 7110 0 R +/Resources 7108 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6623 0 R -/Annots [ 6619 0 R ] +/Parent 7118 0 R >> endobj -6619 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [394.325 552.321 452.136 565.223] -/Subtype/Link/A<> +7111 0 obj << +/D [7109 0 R /XYZ 85.039 781.388 null] >> endobj -6616 0 obj << -/D [6614 0 R /XYZ 85.039 781.388 null] +2842 0 obj << +/D [7109 0 R /XYZ 85.039 761.463 null] >> endobj -2754 0 obj << -/D [6614 0 R /XYZ 85.039 706.019 null] +7112 0 obj << +/D [7109 0 R /XYZ 85.039 736.911 null] >> endobj -6617 0 obj << -/D [6614 0 R /XYZ 85.039 684.823 null] +2846 0 obj << +/D [7109 0 R /XYZ 85.039 736.911 null] >> endobj -2758 0 obj << -/D [6614 0 R /XYZ 85.039 602.015 null] +7113 0 obj << +/D [7109 0 R /XYZ 85.039 702.17 null] >> endobj -6618 0 obj << -/D [6614 0 R /XYZ 85.039 580.819 null] +2850 0 obj << +/D [7109 0 R /XYZ 85.039 552.28 null] >> endobj -2762 0 obj << -/D [6614 0 R /XYZ 85.039 511.56 null] +7114 0 obj << +/D [7109 0 R /XYZ 85.039 517.535 null] >> endobj -6620 0 obj << -/D [6614 0 R /XYZ 85.039 489.699 null] +2854 0 obj << +/D [7109 0 R /XYZ 85.039 366.981 null] >> endobj -2766 0 obj << -/D [6614 0 R /XYZ 85.039 421.105 null] +7115 0 obj << +/D [7109 0 R /XYZ 85.039 332.235 null] >> endobj -6621 0 obj << -/D [6614 0 R /XYZ 85.039 399.909 null] +2858 0 obj << +/D [7109 0 R /XYZ 85.039 249.428 null] >> endobj -2770 0 obj << -/D [6614 0 R /XYZ 85.039 288.828 null] +7116 0 obj << +/D [7109 0 R /XYZ 85.039 214.682 null] >> endobj -6622 0 obj << -/D [6614 0 R /XYZ 85.039 258.627 null] +2862 0 obj << +/D [7109 0 R /XYZ 85.039 145.423 null] >> endobj -6613 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R /F35 2880 0 R /F56 2890 0 R >> +7117 0 obj << +/D [7109 0 R /XYZ 85.039 110.013 null] +>> endobj +7108 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6626 0 obj << -/Length 2862 -/Filter /FlateDecode ->> -stream -xÚ¥koÛ8ò{~…±_Nj–Ô[ìiÒ^½·M³ýÐíÅV¡²è•äfs¿þæ%J~¥¸[­Éáp8Î[f¢áÏLÒHé ›$©QAšN–› =YÃÊ?/Œ`Ìe6Ây³¸xý.'F«Lg“ÅÃ@'RaL«/ÞÕûËÛÅÛOÓY^ªé,IRïnj¼Ëo.z—7×¼þqñþ-¬|bðÕüÝï~¿½YÜM¿.~¹x»pL¹ã€ 9úãâËW=Y÷¿\hdéä ÆZXÞ\K* -™Ww¿9R¼Nx×)ô3“©Ì^RlTNH>¬•E -É_ÆŸ$‘V‘IJ ˜PÁÍ È'Š´w·…‹¯(Vð'^ k›í@Ítf<û½Ø¤ÀqÝK˜*“d/3:à£&½¦cÔÏ„Ïiëßµ áðõ®óC?òºG*Œ|oñX4£æýàû4ÂÊÍîZ! ÏÓЭg&1*£½ËïHöUÙ•ý-[Ÿ}`Û#>JvÈû³9‚`¹)hgõÌ[rÄb^Ê*¿„ -Þã´–Æi¨~`MŠ3¦Pa<ÖÑ8 -²Þ˜"´£0ó>—õÊ¢Ù<õ7‹cÏ×Z³YÝÍ÷rYðäñòå7A:ǯô"ÃÎy«ŠÃPé4!Žû·Œ¼eì‹i°ú7y%«¨ µ¥WÀÿPÓ[Æ*»GFúLÖ´B%@œáêÆ]Ö} |C:ôî±æmôö ° ),@mMŒ¬la 5øË›vlW‘¨zQ*xû] ÆÍÃ2òÿ`n@µC€­3âÞèÉÝá6t øûhÛŽ‘wSº°Ý0Ùi¬8§Êi2¬t$ ~&ï´b¹È²ÈD¸ºõù¤%)4^Ÿ½ìÔB²£¬ûË;Ð8Ø4œê f›¼¬AÖq¢á­Kç-]o²¡›¼{Ì;A˜D¥Þ}Î %ß94ÚË÷‰ É(FÅWDöÍÈ -ÐsâðúCصëÄs®ñ¾*6lìOeU±“h¾¹wÂé³8b„ä·Ü5Œ]’3ñ½²“¹ø“Ú²GÓÅDÆÇÏAÐax¶YõÞ ï—ø#`ETÀE mµÀa¢¬™³‚æíB*ÔiÄé©=bŠšàj¯&8>§&¸ãwé§G§y¶øããÛƒp–wl:èåÅ¡çüs{}˜W<”¬“æìZ ,â“YLSU!)× I»,Û"‚ô3ÿÔVöà“¬(AÁheû¨%¡Ÿ "XûˆŽíXÁÆñòžGŽ\ÎzÄaÐØ|ÀÉ`í•‹[³È›£®…hF¥à_ÓËž`+ë‚*Š0 -]À¥§brò¡: -ñ˜«‘'=ö˪[:q¨l;Qæ-ÙñUN΀9°Ýu<¯­ îÙÇÊÕ±*˜bïØ`˜ïiµ,÷Œ÷!¨—ËeïxÜ®ë¢v©>1*™œQ¯N¼à²!Ô¼“ÃR-ªWQJ±¥óÀiÒIvK¦Ò2…ð£¥øt+~uU¶ß‚L^„=.ç7 -£QZ“ÎgÀéÇXFðBo0°îË:gLK¥”\C`ÿS—À¸|ë êHÒÍ$ò}e ÷§ àf-ëŸFáŸqg#äÑ2вժÞ3‘^>àÅ#ýC¾ŽTf²}–òçeV|©ÒÙ13:£4 «Î×"ÌïlÃÐmêüq)‡%[Ù>$ÄGïJ‹0 Rï²j-£Ž¥aw²ÎæCÎÒh 9ßøíò%TžvYGhy=sJ™B@f'oš…r½MN1Ws†¯+Š|”xt›7ìaÑ\:—šÀ -Ù/ü6½Dª"˜0Ñ”VÐÉQÂïÝ8ý9VK_áßQ\ŒútqȽmU±c’@ÑW¾ mÈ{•û%z%KˆH>úï\ÁcM‰•Ÿ“Y ]ÂúüÉCY_™ÃD™Ôì'9f£”^?óÏëâÏ­mº×²ñ´#ÉQ²ˆ½ÉÑŒ¶ëÜíñžUÙËÎb9yz[²¿å%3­’þàô™ÛÛ -qîø<`qÅËœáØØÌT…{²£×óÓ‰µbñ0, לáä“”5{˜37ª¬üoLP"Çшæv;®ø˜Š`õÅäÍ o¦bƒœÕ·ËÞß–ÛŽÙ>—Ñ<æë>5Љ$•»2Î4òÆœr¦ŠÚŒ * { -£¼§âý¥VúÛ°³¢9®]sÆ‹Èň°SæT]NÁÝ׊'‹“ùñXª¡¯Ç‘l©e ôGô˜Hâ3 ¤†K—¢E㶚I2'} ¡>¡gØo‹d£$ŸGÕâŠÇÎ=å”­þÇ°V -÷}}ÃU‰UGÉm'Q?7¡;Jø*D  6?6=©yÊu=äÜf\ü‹ë§D¡ëø0ôÞË$Ê}?Cžƃ„Z -cÀënß¼£T `«AF˜ßÈ6£äŠâi_ê̲T™ÈßS¥7Xƒè“Èð¸!Æ'^zNÙNî ®´Ùrõ@® ãß+ÑÃqYHbJ„ÜVÇGs팾Wö4™9ë–€°V»ºdŠ‡þà ù wEó|×K\QIQŸap}Î 1©&w§`5ïÇüæ9åß0»,UóQÅqÀÊ^ïØå -<ÀWÅCNµ¥T¼—H„º¡¿êÖHO”5¢¿Ü6@ü”ïJ¨–õ²ÚQaÖ²mÄñžõ½Žž4‡Á)› c•šÜÙcïD‰÷Ó»i“Zb”åòÀW¶îši„‰ËOr˜wK}•¤Fˆýã(—æ™ñÔÒ÷ü¡`RQŸìùküšA§#C›4áaûTf=OÿDâ²íÄßëú'*΀søÕiJ×»±œªžª;[¶AŒ$'L dÀY0ÊhLì·"ÀëùÆL®-0:Ùã•Éκ\¤{5J¬²0™˜4T&–œ¥Ïç¡<ÃœuGý<Œ—\¶<å˜ -š@  -®£èŠl@t}<ŠõBõÉîK -×IìZ€}šˆx9ׯv‡¨]{ {OÞõÆn’Üoh¹³.V‰v*–y- 3rÆ Uš­óç㇠A°Èq¤ ÿ¿j¡öš,™Ìp[ö×´¼/§ñ¾Qi¾ØÀ6>œ‡/·ÜITš}Ë=~©å~ƒã÷ÙúÐu¦½Þ}‘»ç|{= T*Ÿ çò%ƒ:æv7¼|Žžsè‰Që¿VlF±r:*ÕPSëré:r€Û -Vcq½k7L©+÷qõf!ßE•á•¦¶ùÖ«W—ÏN(5ÖÒ=Æ+Þ8$/«#WÇðtþ$}Ñ?ìaòlÀ>!ã}ŠÄÒø+чcĦþUï}Š¨ÆÝ¥µ˜åN¼ú«éøÃC?¸S&ÀA°w§méQ^¼É¼É¹UqN~öü4é´Óî÷Ü·#lÕø¦ç… Oòá÷¯48fø¿³7ƒ{endstream +7121 0 obj << +/Length 2803 +/Filter /FlateDecode +>> +stream +xÚ­YKsÛ8¾ûWø6TÕš!@‚"§jÛ™ÑLlk-e²SÙh‰’Y¦D IÙÉ¿ß~¤ž—ÝJÅÄ£hôó¤.ø§.ãaz9L”&Éålu\.aæ× %WBrÕ£ùezñᣉ/Uà§Az9]të?2áåtþÕ»ùíz<½{\…aè…‰?¸o2PÞõý/×8y×·<ÿ8ýífžxøfôqÂã7ŸFwÓÉàÛô÷‹»©Êm¤(Ñß_¿—sþ÷‹ÀÓäòÚ¯`zu"ù& +¥_^L.þå–â¹è’¹Ž)ÀR\©ÔOµ9¯¤XùQ:%i˜U~jL_I&ðM‘’@/¡A=ÆÞdçV^žÏá½æV› Õƒ+åUoù +Frl¯ÛSZ‰_ Óórv4$§2GŒ©b?ŒİªÍQ íµ/°ÖbGy É´’)]Y¶jT¥ŒǦÞ:ñrf]T[^Ϲ×[U{MÞ¶Åz ¡ñnóE†”eû4Õߠý¥XÃßy…˽3ŒÀ7€…dÓ¯@q?™ÞŒ¿‰¨$׬-ª5T ThåJ¡yS:'É‘³NþB_"ºæ½?z±Sþ'PÚ[%¯¹÷eñeÉ­¶Ç†š×[¢-­ +Hw8š1Ù3ÌK"›# *±¦Svl«|íü%Š"oÄ,s ¬Ö?µ¼Ø+Êä´Óï/Øù1H"Ï·§ÖC?‡ÇSßÿË¥©c»ð@þ½gÓEdσuÞ{z#†¾µÞöÍ”EÃßÎÞÐ1ï’Ön¹³BÙÒ>ÐÕŸájh[R7pŠtõ¢ª­Î²#ÂÁÈ w2^¨ÌjØ­g~Czx˜ØËÊ-rj f6ŠÃ$Â.(´æáE¯—N'@¦È÷îW3õ†e­6¥¬&QÐÙ2Ô!ñçlj&mSÆ6~:LÀر¯Œ"5ü‘×ÎræÏÏýÌé÷ ÿ‡OŸÇ·>â´ßÑç˜R‰@³Å÷Ÿ=a~EVhÝí²²w>oz;­ÉÞO¸Â Š÷„ö¤àüŒcgdLúa4>uš?GÈ~\"YàÉHQçRûD9åŸO·O¨ï½E¯zúNæ_—MõôOÈ^h°(ÌäòxõýÓ-MöЄÃh§¢I^KS}ÖK{4'ï1*}ALæÜ5FAÀa5Á¨gÀ:?ºlö*D'ä•}ΉۑœŒ)ˆ9?Ò” +&°W +l³·îB¥Œj ¤Åõºbé¤ÿŠÑ0+¿± á„‚Y9>ÌNÆt-FÞãºÛ˜ý!ÜõQ@ekŒ¸û¦s¬¶{îÜžjÿšv€–2¼ A‚–._nj>wÍcŒùY¤jäåà*$$ÈüØF(=t\r5ìts¢Ã×±±æöŒ±c÷t¥ƒ=e¥FÇÚyix|^­2:0½(„Ç®v³­}‰"™UØ{ëR»šá;"}¥Ë|r‘ìe@˜TlC¥åF¡zr!dS±÷¼•M\~Ýù ñÙe¿“ÈåOñsVñê\»?x† *Wë­Qˆ…leAìDí±;ÛaKB©ž÷2Ž =ñk˵ˆ©@'ë[¦†gšíLBƒØ0‡mKtäþŠûQ‚Œì!ز‚”§<éð P`P"(âƒôëSÖÚ‡9œÊ„3;v ¹µ·|3D«p“‡ƒP÷Þ>]XÀàáÍú‚v6+¹á¼pã^Ùx⟖‰oyÈ3ïP”¦•v2voÝve¤–‘w;RØwZ\ä¥êJ3Ýñ‚ÞÃz@Y¯ÊVçòÈ^è3ŠWÆûi{aÀàÑrÙÀ/™GGCy‰£c’uŒum¨»«µ÷}DCuaÁU&è Ø`)º\ÈJÇ)#\kV­6eFi‰2§[!uÒ Ø!Á>ÔüÄC£†¢•Ízøµá1w(q]œHŒã ú-þжµqê¶;‡uù¹¼bˆø£ŒŽ7cd@þ-ëRòÚ–„76¼Y GßðÀvÅIü˜#ð‹o87›¦Ç ”òöñþzô€8YÞÀjl„Ç¡N€O5BºLÎA ÑÚI@ræû¾}—×\r‹IÒh8%bFögÕzÁ£«L$FÝfK9;ÝàPlynê´2Ï[FVk»‡äF¤¨6-¿†ˆ@xÑf²5þ²v +ìûúè•þ³Nþ§>¶‰B? Oüh´öµ²²  ¢0Ú—× :ƒ[ÏÀÿÄ»:¬endstream endobj -6625 0 obj << +7120 0 obj << /Type /Page -/Contents 6626 0 R -/Resources 6624 0 R +/Contents 7121 0 R +/Resources 7119 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6623 0 R -/Annots [ 6630 0 R 6632 0 R ] +/Parent 7118 0 R >> endobj -6630 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [149.104 518.42 206.915 531.322] -/Subtype/Link/A<> +7122 0 obj << +/D [7120 0 R /XYZ 85.039 781.388 null] >> endobj -6632 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [165.346 77.186 348.339 88.876] -/Subtype/Link/A<> +2866 0 obj << +/D [7120 0 R /XYZ 85.039 761.463 null] >> endobj -6627 0 obj << -/D [6625 0 R /XYZ 85.039 781.388 null] +7123 0 obj << +/D [7120 0 R /XYZ 85.039 741.134 null] >> endobj -2774 0 obj << -/D [6625 0 R /XYZ 85.039 761.463 null] +2870 0 obj << +/D [7120 0 R /XYZ 85.039 616.695 null] >> endobj -6628 0 obj << -/D [6625 0 R /XYZ 85.039 741.134 null] +7124 0 obj << +/D [7120 0 R /XYZ 85.039 572.945 null] >> endobj -2778 0 obj << -/D [6625 0 R /XYZ 85.039 684.25 null] +2874 0 obj << +/D [7120 0 R /XYZ 85.039 330.859 null] >> endobj -6629 0 obj << -/D [6625 0 R /XYZ 85.039 657.636 null] +7125 0 obj << +/D [7120 0 R /XYZ 85.039 296.113 null] >> endobj -2782 0 obj << -/D [6625 0 R /XYZ 85.039 129.164 null] +2878 0 obj << +/D [7120 0 R /XYZ 85.039 227.992 null] >> endobj -6631 0 obj << -/D [6625 0 R /XYZ 85.039 107.402 null] +7126 0 obj << +/D [7120 0 R /XYZ 85.039 185.707 null] >> endobj -6624 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R /F66 3242 0 R /F11 2898 0 R /F72 3966 0 R /F18 3969 0 R >> -/XObject << /Im1 3957 0 R >> +7119 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6635 0 obj << -/Length 2878 +7129 0 obj << +/Length 1868 /Filter /FlateDecode >> stream -xÚÙrÛÈñ]_ÁG°Ê„1˜Áõ‡µc»´‰e'RÊIíîÈID$ÀÅ@æj¿>} rUJUÂ==}OwSÍ"øS³< #]̲\…:ÏgËýM4ÛÀΧ%&Ñab Œ/l.üî"ÃÈdaäŽE¦ŠP…0ïnÞ~Œ£Y…iªgë™Rq¨U" -ٶ䰋Ï{ j0™¦æEâ¶ò–‹r¦e¦•‘-wP w žF`¦Âäþ 㶻Ž/ÛlG ¨gœLÃÔ /îé‘c:·îU9’/iÄqô#Ï„ˆè5É> $î–»’TqÕ4îKqL‹6™˜\×(þÃÂ4ªàÊŠLV&¯Y4l‹áv¬SÄŒ¡ wF–„#^´5: -$PwÍøVÐ/H9† EÎè5øoä÷wáU3¹E%±[›8XZŽMŽ§g!ô‰µôo‘QCðƒ±°É"Ãø*¹°‡MÎ `·Ï`LA®igNYp+”úPCƒ‘,;¡`„ƒŒu³ñoÖY XÛeG!Y唿 ªèƒ .c„P¾Ó 0Ÿ£À¬ÁÈ-/ŽßÈ=ÏŸ%/Rù@ÜAîÒ®ˆKΡTΚÖ* Vd8Sßâ†äb%—×|h¸à+ Ûª‘s:U—½Áá+§Á§j’< rÈ[Ä*šlɮǴÒ± ðÀ4~âÒ²g¥³d™öðhÿZádÉ’ÍvU׋wáÜ9'ÁŽ<þX‘)òÄë§n`úrb¢4,²üÕ2ds½Ò… -UšùZ(–Zè“`ö‰ªºŽ«¸æÐU× #¨T¡<{½ØÁ\/tš†¹êsfR`qZ}ã'å×ÿ™õ*>ÏÍš¿Î§å +Îó: VÄäòl”õÃd‰ïBmÚÒvd0±}ö±$Eœ©{“§Ã^¨®dË—3dÚÚ¡éûtß“Þ¦¯>\ZB̽, Ƙ6„‘D’9h4ƒ‘ÓÀÆàÛÉÞ…è9‰B›æZEË;’Q(%dL!bÃg¨Ù“•ûd 7wU-»GL]¯= ª`ûíG=1"(«óDP‹/ 153°ÅB ØF²¦~#ž(¢®ä¥–÷âüž\…¹ñ÷¸ýc¸lêõ…ÛLšÄ•hþ]ñ¯^bÂ8‹Ïµc$¼¤5ÜèµæP õ Y~»‹Ô«$ 5¬ü˜ü{–†×ñC±ˆAUE”LDÃOŽƒÍèùq¬,®¤½U•õŠ|…tî‰$Ù]×70òÜ{t~-päƒÁ8ž·gŽRCÁŠDÈmï«yÎ! óÓ ‡†ÕÅjFqn&g¨Ìó“|.´NìpøÍU·ñ¯½‰²`C¼cQQ(ì:µˆ¬ÊMkEÍV ˆ¥þÁñ±(u²©~)?Ãt9¶ð¾¤iÂN4m[.¥‚ ŽÉ’£`.% n_Xíœnç¢ðQOëI÷NtŒæŒóz”ñRAôôzX5®.Ú‰1¹`hŒ¡þäÍŒá­-à!Œ sð~x¿ùå·h¶‚Çóç›(ÔE>;Â8 -UQÌö7‚„–ÙîæþæÃãêq-FÈÎ_×ØŠ¤¿¹¸ûò×Àæßšç:øÓJu††w9Z¤šY'I—{ áï`õ§hÀô7¥¤¹ L LçÓ< ôNo‡Ñ?v€¡Ö††ÎÎõè8ÞBíf‚ÏÜ7zaX±®œpcûWÓ -Æ!;0†;u+icS¿ƒ (:22„E£h}–ü=:¹d# -‚o®ÁVTfÜ÷þ¿mÄãZŒ]ÈÀ’8T‘éo¼d$HìŠòfß•’$*ê÷]M˜™Ëñj) œ$%!%©ê9¹®•pùiQH^{f×ñRùÇ‚m ü"+¦/ëaGmËΩc®Û°ŽŸöábßzï‹ €áôŽw)1¨OüwÔ;·RÆŸ+oºmãšuÇø|×Noo¿òÛ±¥Xù4Eîvþ ¥U¡É MyÈÎÃe·³kÙÎòdäK}Rc?ÏÖÞ\Öã®HK%>@P0ä!Ûã¨?5¾­0¾§Ÿ`0­/b×vùÜžôy¹zBï?Ãú;;¶¾%H'§“MJZhóß"_yAplPýS;CÒ‘ûÃıй³í†ŠNÏ­G†J}Ã÷ÙsŸŽ’ÝúDS'?/¼Ò;U¾j‹ -doÈe£ÑO~0^±Ž£||šÃ™@Tïo­ “¬¬”¸»âm&oÛ6»ÿÁždʺn±SrJÉùãŒzRTyóŠQ..¸wƒ¼oÿñŒ| ¾ü :¾ÒŒF¼QBŒ!ÌDlh¯Ž×ÇbÃ9Õ&ÅÐ Ã1ý°È|Ç{çX€ŽéÅàf¸"~U­eíë+M5ýȸç„vUyo|º½!¹Š‹q¼¼Þ‘ñçQÂi˜ÆÅï\^˜èÇáØ…–”‚ñ0ö&!&ŽÐáå¸zðúúܸä±ç UßâÈ Šƒ<y½“ŽÔq<Ï«s( Õ¹ÃèØëîz0žÌõôïÆ„Ö^—Lë`H¯#ýïóú%à-T/H˜â¨÷i.]|ØÇÔ¤)Ùð g†û[—›g‡¡w,&«)ƒZ:ËÄ0¥Ô—=Ñ<ä|`ûYç™IT“àß­+ èDûè26˜M­M!/èÿ-êÝG§GàczUŠÔy:'ÆjS:5Žw $›ŽB$ÁP”!@f‰ƒí®,é(`‚«gAY(Gr‡<2ŠÐ¶¦ÚÐ|a¡MF!€6¢RÕ¶KšãXr»BH'V+룉~ù…ÈÓw’&™ÃÓ„ƒC}Ü‘UEÞ ´bp³-ÞxÑâ%~§…¹‹Ùƈ4ëm§t߀¨+48ßKÃãû}ZƒÀÉENjð18»º {po(¤rý'îËëŸvÛ°ÎßâÚL^sºÁh +¸¿©Z¢ô…Ï«ujª0Lo¯Qgn9+‹¼ l£l~úNÙ•Í8§ÁÕ€Õ ã©„ïzà9» D/pt•^ÂF“O‹%±ìÅ––0°,Û&7BÑH:§ ÆÊâ/WFqµhi¥°ßx³Ü"?v" 43ËiRQÍaMƒ”b¹qbOÆãÕÛ»óÛûY âg!ÜI ¸ÿ*wj˜p¤Èš¨ê^÷¨»@ Ì7äÆœCq!‹óÖµi–‘·úžç›¢gò®;0™ïw±9öÂà'ç6éCiâyIÄ.ä`ÞÅ$¦JÞÊØ7àÛý°zIä)Õá^Zñ©(KÛt¾š¡u‡Dí h ùV cJ&È;ß4VŒiŬÜãX¿uî3edJE‰µE˜«Ü‚ +:ú±5WÂÁÀ:µ |I¤l×e"A"|˜}V}–­ÛhÒ’Kk3Lö’O©ˆN^²Ä”hèa¤¤ÛÒ®žãöK¤¿!¢SÙEÇvuW Ù€_f+×cÎów×Xùol#ºÉJ´f–˜üÐq/?ö{ZH5ÄÔì&CI„,æáaÎíÉ@¥#ÿÅÍ +Ê–|¯é€|YmÚz¬±‡~AÂT_X"¼Y¬°_O”j‡,Rú”cO=XŽ9¾Žà0yRŒÙÄA Í,÷‰¢®xĽ+êà}7 +XÅ¡÷½#¸Î˜^Z÷]à@é¸á¦bx²‚Dï«b€]¼aéÍò;› áìv-¼« +ÔôzšZ±“ž\j?ö.S&,„§”4êÈFžA%Ìâx¯Å˜Wrr»dº«–æ´’ír—v<á÷Ê¥‰íeºä3=ɲÇiPð¡À"lºƒÆ¶tns:,u¸žUÛMk{×)Ù^%¶°÷wŸ«ª±ÝåÂ<ë,Æ_Q½N êiÛtÈd4fGoƒD3„^/þ{laø +z×ýh¸Ã›,~vQ,a†¢‹ «S`Ю5•¡`BSo +·J,`t”ˆ%èæªÂ æ3œG¾2¯¼)í„>«ÜŽçdß,¥bRÓêv'øÀº¸¥UŠ_Ôý!ÅïƒAݵSˆ¶W[#ßּ峴¥×>61]S[5½Mu…¡ …Ö~?íŠ6|4‘<§? ìêýŒFÅ„e7zÖ_\pµpbÕ•4(Þ×¾}§ÍOù‘',âÖH¯—–áÃGwܧ=jyºî¨°Î]‘ÕUS-lêüN+4pïO,ŠKÛ,]tÿÒ˜ÖÉ´*E¶c?°I†! ݾM‡GËó–ÈAKØ©Ò™L†ß€¶ÿ?oÀ@±X%Ãêj)™NÔ6PúP_÷ß‘Ââ×…endstream endobj -6634 0 obj << +7128 0 obj << /Type /Page -/Contents 6635 0 R -/Resources 6633 0 R +/Contents 7129 0 R +/Resources 7127 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6623 0 R +/Parent 7118 0 R +/Annots [ 7134 0 R ] >> endobj -6636 0 obj << -/D [6634 0 R /XYZ 85.039 781.388 null] +7134 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 206.584 267.036 218.274] +/Subtype/Link/A<> >> endobj -2786 0 obj << -/D [6634 0 R /XYZ 85.039 761.463 null] +7130 0 obj << +/D [7128 0 R /XYZ 85.039 781.388 null] >> endobj -3064 0 obj << -/D [6634 0 R /XYZ 85.039 667.044 null] +7131 0 obj << +/D [7128 0 R /XYZ 300.917 698.964 null] >> endobj -2790 0 obj << -/D [6634 0 R /XYZ 85.039 667.044 null] +7132 0 obj << +/D [7128 0 R /XYZ 85.039 576.494 null] >> endobj -6637 0 obj << -/D [6634 0 R /XYZ 85.039 639.536 null] +2882 0 obj << +/D [7128 0 R /XYZ 85.039 285.661 null] >> endobj -2794 0 obj << -/D [6634 0 R /XYZ 85.039 406.978 null] +7133 0 obj << +/D [7128 0 R /XYZ 85.039 250.349 null] >> endobj -6638 0 obj << -/D [6634 0 R /XYZ 85.039 377.574 null] +7127 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F38 2997 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R >> +/XObject << /Im1 4096 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2798 0 obj << -/D [6634 0 R /XYZ 85.039 172.114 null] +7137 0 obj << +/Length 2311 +/Filter /FlateDecode +>> +stream +xڥɎã6ö^_ᣠĊ(j=äît•¤«3(A’Ë’m¥dÉ‘ä®ñßÏÛ(Ѷœ9 X\ß¾P-ø©EûÎi¦|e‹Íá!Xì`çト(Ö~E0žÙ\ÙÝUúA”ÎÂÈ«T徎¼[?|ûc,ÂÀO½Xo-!IøY/ÖÅïžÎýå*ŽïÙ–Ê{1Ë•NRï×¥V^Ù-WÊÛ¶8î¦Ù”¼¹^æ¡wjp³‚3Ínùçú§‡ë‘{OšøY2Ko°X…Ú×iøÌ$Àx”Ç.3*ö—™0¯²Ì(d'ʽ÷íáhˆðªo›þ…@DÈÒºOÄCD¨x¡?r‡ˆ8Ë|æDÄzbJ3ïdB SïG¼Ø—(¶îë2ÌH¾:M½/ö ±~ÿ+/­|Mýê®dÞ°„rËÖ0¯I³ so@!üzל1êjˈθޞxÝt¶¡;‹J/.dË<ÕÀKÇå +Ø,»m‹¸Ì ˆõ¬ÐxY4oÄ5\/WQ 'B¢ òú=Œ`¯à½®4u}æ1q‰*Z£ &:>‰tâ÷K]»ëÌ¡—½ ™—dÐ#NsÙ1·ˆ(Ú´5ˆ0‰áxá¡íå> ­¨Pèç. òôu ‡MU›—Z¤«íB. ¼` ½?!ë8  iúm)ûÌŽˆ„a;ÓÉÊräE‹Ø4­µ ¯'_L_<|þôŽ$•Ò¨où S?È™¿GT~œ9Fç¬ZÓàÿÀÛd;°3”„RVÍÎTM/“žµJ´•ìÔÕ«Ø +¢0¼ø´æ)ñß/hˆ_v®Òq,¼zä¼¹!9óÞ*´BíEeÓ–ø‰êA‰åœ¢é<›—›"Ž×x &mÃß²ºTB4Ѧ!ö²W±"ÅHx…ïeÜ㌠v±*ÐDäÞz+àžX,bôÌ“7 MåȾ:Y$c0ˆD ˆfàpÆa§lE6¬Ë®êoÅuíal´q`oÃk7HÕ^ŒWÜä©Þ}ø÷#€*kÕb¶›–‚ ú½‘HOë´:2 àbóª1{i]¡š/M=#’?–MÙ¡šáÏŸÄ 1Å X8'ndJÊ!·…s·É€ÂÕLؤ¾:@ìè¬|[Ë;£“Ã#‡HIœ¾1ÀeìÄ£–m0ŒÍ¸$¶=+Žâ¸DpŽ"j öÀ¢üûT Sp3üAö*‘õÖôƒÁ=ýˆÂøF4Y,ÄÝÞ‘ËYý¹Ÿ­RŽk)¬8d6°VŠVnµŠ£ q}¶¦7”‡9x.…ƒ KÇö–öˆ¡HÉnøˆtBDµ@l(o~Ù6@í::c›Ñ *6.öâ$ž‰06?š†â¿8!€ZB O¹¶…9Ö¶l(·î|Ó„µ8§xbÜs507y*œä“rVb$o^ÈF…¶ŠWê"¢ÂÆÚJd]Yüå0L}„²>Ô’é+‰ +„Þ‚„¶a:p`QX^6q¥œ3Ú[}¶dcQQ¢úfF|¶·¨'e‹Ïö,7ßj‰l§&§.çÒìš{2`w45G”Q Äo$sV.clÇ=†Ûòw1ŽŠô7m#»îTN”Õa~4»’G§¬MW9>!wR‰$•ι봚dq C½P@&[0讚rvk»ÒêmªcÌÄø½"uH¹;ÎëÌ:%ø9aba`Ü󜊓Ý^Ú\!ÇÅÁÁ¼Žu 9~^ªé¶±î·[ç$RZþ^_¸0Sù:ž…Lœ“ÒNBÐnbòÖ '™cîMCÝà— ñŠF)*zð¢ä~ÃÀŠEºÿ5:¤lR'ß«#}¢ÆGbGÒuSPƒ#l†Û[ÁÃþ àN… Ëw‹Ùrì Šü¾®To…R‹öM-åŽSf’Ô_ï¶(ü?r£M1ð^%5•g¾Æ¥?J)‡þýðûŸÁ¢€ôöÓCàk°à7¾‚ëÚ!µñ¬~x~ø×”þ,®•ƒì6†òcÈÖ9zúüàô—ï—™ö~cb©ŒlÙˆÌ44Ð\YaQž½ÆÆ,bŸÇ/›ì˜2\\\‚:’êÙpk¹‚ÞÈiÈJK|WEE¬”JH{®ù…HåøødQ¬±†buŠUó+Wx÷ÉÐ3 U\¶,¸Ð]ZYÛ R›ž ÕG TðÌl,Á 7Yô¼ô#±/!WVE +4¹Paèçaþ… Z9¸nmÚ° =^8k@nAžôR——ñù‡_ÝgÎâIŠ3,à™i‹.«•LÊ*€5<½-£a±ÀÓNžÀ “ÇSÉ¢«îŠ0èäXÓ­F\¶ùtªéôЋbâÉÖ–aJ—~a*ùŠ}Ðö\×ø©²Üvmßn‡ñµñÛGypì#Ä„ôè}mÓê\Ù_6Åø4ˆÕÆFž8¿Ç3ïâç‹ô8WW>›‡-«ï—×òÖt ý$´Èahá¯/ŒuFÖv÷Æÿ×ÊKendstream +endobj +7136 0 obj << +/Type /Page +/Contents 7137 0 R +/Resources 7135 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 7118 0 R >> endobj -6639 0 obj << -/D [6634 0 R /XYZ 85.039 145.5 null] +7138 0 obj << +/D [7136 0 R /XYZ 85.039 781.388 null] >> endobj -6633 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +2886 0 obj << +/D [7136 0 R /XYZ 85.039 761.463 null] +>> endobj +3170 0 obj << +/D [7136 0 R /XYZ 85.039 653.495 null] +>> endobj +2890 0 obj << +/D [7136 0 R /XYZ 85.039 653.495 null] +>> endobj +7139 0 obj << +/D [7136 0 R /XYZ 85.039 612.438 null] +>> endobj +2894 0 obj << +/D [7136 0 R /XYZ 85.039 379.88 null] +>> endobj +7140 0 obj << +/D [7136 0 R /XYZ 85.039 336.927 null] +>> endobj +7135 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6642 0 obj << -/Length 2794 +7143 0 obj << +/Length 2570 /Filter /FlateDecode >> stream -xÚíZI“Û6¾÷¯Ðm¨”Ÿr°SN&©±“qwjj*É-±%–¹tHÊÝš_?oHJ¢|˜ëT*-,ÀÃ[¿:\ð_¸Êb?Pù*ÍB_eÙj[ß«=Ìüx -ÅFH6šwwßþèUøy¯žÆ}b_Çjõ°ûÝûþïo}xÿi½QJy*÷×›4ͼûuè½ýðî-kïWè½ÿôÃ:ʼ_>}À©ß¯70Æ«~ûøÓÇ×>ü|÷þÁqä΂Ósd篻ßÿ V;`ýç»ÀWy¶zvà‡0]ß?~¬•ô«»û»º­xN¯xÕµÛÇ*óãL]^?Œ'×#åGQ¸JãÀM÷8”ýzE©×®áϼdÑUæ®ù\ŸfÏÓ/8Ýv0ò™dÞ#ü¤^’èKÐÐhÃô¯éŸáN ùLÈ^íÓâ2§ð€iÖHHí¦½ 'B³Å[æD64]Á“´YY—•ÁoPM«Èd¢`sÄÁàÞ_ì•Q±, \KOl r8 UÁ44ýG*jl½ƒR‘7 -Þ‚„ ’+v¼@¿•,lÖxá#ô·Ø80á¾³Û›¡èxl8˜FZ"s\ÞŽ\ã“®Hच”@äOÐ0Ç -/•¢8âÄ3Õ‘g‘5…¿a¢2ýÚ™«½£[q.Àt.ÀTø:‘’–µÖãUÌP¶ ÓLÏlj%É2΄ÎÉ.Ü í¥òcºù®Ö%®ÔQÌŠÂFû<3$å -Ç´“B÷Õ:sŠôå ¿¬;%|ÛÏŽ•êÄ»€¦„Öj -Ûr¥^˜–ãb<„*Dd[xBUñsÔ¸7µ‹Š¤Ž—fšžx®õ(á¯Iê¸?õ Ô=Òʼn(ÉSNkP6„Ë Ë4sÑi„1%³1…i’8V 6²âЖpBî]Ðõݱ;&~)éºÐ"g7G±œ²¶Û#“ˆ¦ç—6UÕÒ½·â4ì)¤Ü‚þ¶ÎÍ•wl+Ç­pdºÔ—iö +±>I4Dïôf~šÐP€Ž`VûJ' ÃÈWa´JtQÌCyö‡©d6¸Ë^S³Rúœë¯DÚ©í.“=À¡úwÆpÝ9@'ÆÜM¿R›wÕÀ»MÃQÜ/Æ—±2X?iŠû_q‹ k„FïÇ´(¤cñØ­s7îÏ6 ½¹®dÐ< 1â,c3Á|—NÜžE1*,ßHÑNœÖØ[[N‹/]< H±PLëWÆÊÙe—\Nåà+ÁíG­ Ͳө,ô³Ü ‰8ݧÂì¸jèÌ`Õ˲ü&#Ͳߩ8¥×ªñI -ÅŽ¹Àåd*:©ßZ«³5~ÆÈçvE_î›BVJjåG«èYÕúïûb‡jÍÁÙK76¶›Á©‰löÄ«Y lH;»µ0¹¹†:ˆqFö*ÅbX%ú¢ÂÁ1Î}âµ8 ÆÆ<»'Hs®ù¦d·ã³d÷NF(3â¡Ì>´ó*^†lÝ…«fâÍ1ïõ|4œ´v5yG)æòÊüÙòç’RgêÅÇ'VJۘʺAl•c“ RÚ§·¢1"ì¬Šà”ºŠÀ.sk<¦V(¹ú¨8œ¥UìN‘RîHŸ¸w`’q@WL[|WzöľˆýĽ—¢¨x*¸%Æ=C'Ü»ÒH«3¥vL3·Äk/™O¤¶ZjJ±r‰]ÇÞ‰¸æ†ô@)â‘5œÐp–—EÚ¹%(?:÷hW¢ÒÅ* -kWð2,ºGG&Ï;ØqH’(¿J¨ šÃ8dí@ cË uÎDî;k„œUØ<&›½p‘ Ã3:HÑôç<"F]ÎûZ{¿àŽ•†Ô/ÃÔ"\–ùV#aU-¥¼2Dò•ï8šå”iÈGijS^*)ï_˜çºRj‘¯§>»ÍM~FšåÔ…ú¢iêÃx7rBŠsÁqÁع4:Ì„³€(®¢):‰<ëÌxë²wZÄp*J6h‘› -2a³}aú£:Å1=¬]Ôøú[H/ô±b<Ó­ÈåZâFX)êŸ~wrør`q-ùaõ‡ÊnÄMÊuX%X@œy‡²™¢k)!RF@šLÀÊ -æ&v õÅ,×añ4‹J<æJì4LªóÝØ¡/…rþL‹œp-ÑËÑ6^-†Kw r/Bëuܘ¬`_\yüùjQjí§Éíð0¡YWa”ùyìz&áêD©B,„*(’KÈ* ¬D‰&·Aú„f9R…ö“€?ß1!F†¥V)U AzËÀO]&Á¯½Ü·ŸƒRzÜúýBmR‚¶ïØ_BÑWÏ9ÑƾºÀÏŠHò™! îRÖf¥,÷~ã˦!<ê0{Žúk^üL6Í™±´8É"–gÓ÷ò¡Y¢m5‰-•5¶JZeM»M¾¡[pÅ,ö7KÀÀ¿þàÿ3»ÿÓ?ŸM”Ÿ©…W“8Šü(´¼…fÑ9¿öŸ\0ü_÷endstream +xÚ¥Ërã6òî¯Ðm©”Å|‰<Ú©IvRëÙìØ[•T’,QË|($5²òõÛ/€E鲕 l4ýîFGÍøOͲÄ¢|¶Ì”eÙlUß³-ìüt§c!( çñåîû“t¦?òÙËf¤“øqÍ^Ö¿{?üóá——O_ç‹(Š¼(÷ç‹å2óžçÊ{xz|@pìý_Ÿ¾þ83ïß_ŸpëËóÀøÔË¿|þòÓüÏ—Ÿï>½XŽì]p{Žìüu÷ûŸÁl ¬ÿ|øQžÍŽ°|Ûõðã'q$ßÕÝóÝ,)Þ‹g|jJzƒ±P¹Ÿ‡Ém ¥ÊÓÈj(„ÝØâÔÕPøI“†@)¨%‰sïk¡× sºôúÔð7*¡¸&¸¸ÉʈC¬¨dÂX*ôÓ€õ²+æ‹x¹ôÚýP¶ ®S¯#¦Ú—Â}é?X =‚2o¦™DæµhÎoø§è*½gZí†Ï®±ìñ웹?4 üý±C”À=:–ÃŽWÍœ¸Pp!Ð?⟶{ã½ÎìCu +1Ðu7~Þ bA_ ¶MH~ Ïâp¼Fìö/°ð»ÖƒæÕë|B–ÈÔ–ÏÈ„núMÑuÅšÑʆ{âB£«sªiÏO¼Xu­›uÏ?‚$ (²ô™»ê$øôxÄ}Ñà½+gœ“ ÏeˆäªæW”$Æ×¼&Ðø¯x&MÃÝ +öò€¬‡¿•î¶EÇkRŸnä}Á`}›'©§«Cá Ò• ßDrãÙ«èD= C/½b[6B xëf{N.ÌyšæRf!ƒl©íHÕ¨—ÞN÷ èŠa•ÌÅš·Å4 „][7ɼ½^Íì¡ +¥M×Ö¼kÖMa¼â móvaŠtŒ=Ĺi¥{oðÅ>² 0 â¹å¹)ü–<µçÔëªsíÐÊ/ò€×B ‘¦4ŠgtU*|0hþ G*àËtŽS®X•¸Z—ý›o$ —~ç’³Èɲà"ã(oo‚·-ï$TÈ{º‰?‰ÀVi”Å÷¸N<Œ’ƒE'ï8ñhgPÆCDþ]DîÊZT¾ ¹â!ëºqdÈd2ÜF>ÛF(žLVÀ +-W’¡èê²ïGm\šJ1ÚœœËE«Qj1¶Ž‡{åઅÄTc=¥:1Ú°ÓƒY‰ò$M8¸ê5L†P„)¸í{ÈÖ†¾¨f ‚¢ õ§ž=¢5U°Å'e³Ó<‹<(Óqš{—UÚµ9úÇ… „¤I¥¼4žÉVmK)–E/pªu%zBÅЕ>ôâÚdBèβ#$¸–R‘ƒ#˜lTpß`ôàCc“èJB_w%(*‹=ÿJw—Äð¨›ÝƒsµÑLT⧶ό¥Ï|ÒïÜf¾×Ô#\c‚ßäÁ¢\m0¡)ó—;óƒé¤$˜Awzö†J’n¬ª²hDãÝtÈô’Rð Õî¶J2âMŽ›w!°Ø,b nL‹X—†«òïÂSÊ¥Ig¸[ÙP¤®©B†s§A†¯v3ÎM¡»J|ý¢ ¦#‹ ݬ ß#¶IplXcH¿aT'ZÇkøƒ»„ q8âÖïg"#e–Wœ‡å̳¦ÌýªùSbVgªW‡ã£8SaÍÕÑZ“¯)ô5JM +_¨<Ψ*¥¾ÙĈ¿jLô(z”{_ZºW-MÚìê>ÂÌ/K ‘JQÍ€Ñ.tý†)Pûdøë`Výм”´¤r2Õ^²ÒB*Så÷ýôHvàͦ•…mZÓìš“âÖÈ:ÒÇ¿£ûÈ7šõ#m7aÙãLÄõC%‡¡÷‚‡ª†xî“:æ í8p²r/M_âfX×#©Ó¤²pÞ4°Ôåø”ÉØ‚xIjGK{èzC®”UU‚‡N5!Ÿ17@M[RWøX:[þ•‚SÝCN‡B0ð±Æé!V×4HXjÎ9´iÜ%–jN¿BOêW‘òÕÆ0Ï!†éâ…)g2Y@Ò”TO|šxcÓ±1ÐÕÇ9ìdæSÙþ±$ÿ×ÿ¯³9 ÒUåÓ)- C?T†Ô\-?ò›D™ŸdÑ%Ãÿê endstream endobj -6641 0 obj << +7142 0 obj << /Type /Page -/Contents 6642 0 R -/Resources 6640 0 R +/Contents 7143 0 R +/Resources 7141 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6623 0 R ->> endobj -6643 0 obj << -/D [6641 0 R /XYZ 85.039 781.388 null] ->> endobj -2802 0 obj << -/D [6641 0 R /XYZ 85.039 664.197 null] +/Parent 7118 0 R >> endobj -6644 0 obj << -/D [6641 0 R /XYZ 85.039 637.583 null] +7144 0 obj << +/D [7142 0 R /XYZ 85.039 781.388 null] >> endobj -2806 0 obj << -/D [6641 0 R /XYZ 85.039 483.53 null] +2898 0 obj << +/D [7142 0 R /XYZ 85.039 761.463 null] >> endobj -6645 0 obj << -/D [6641 0 R /XYZ 85.039 454.126 null] +7145 0 obj << +/D [7142 0 R /XYZ 85.039 739.701 null] >> endobj -2810 0 obj << -/D [6641 0 R /XYZ 85.039 397.708 null] +2902 0 obj << +/D [7142 0 R /XYZ 85.039 545.001 null] >> endobj -6646 0 obj << -/D [6641 0 R /XYZ 85.039 371.093 null] +7146 0 obj << +/D [7142 0 R /XYZ 85.039 504.837 null] >> endobj -2814 0 obj << -/D [6641 0 R /XYZ 85.039 257.688 null] +2906 0 obj << +/D [7142 0 R /XYZ 85.039 323.686 null] >> endobj -6647 0 obj << -/D [6641 0 R /XYZ 85.039 231.074 null] +7147 0 obj << +/D [7142 0 R /XYZ 85.039 280.733 null] >> endobj -2818 0 obj << -/D [6641 0 R /XYZ 85.039 144.767 null] +2910 0 obj << +/D [7142 0 R /XYZ 85.039 210.765 null] >> endobj -6648 0 obj << -/D [6641 0 R /XYZ 85.039 115.363 null] +7148 0 obj << +/D [7142 0 R /XYZ 85.039 170.601 null] >> endobj -6640 0 obj << -/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R >> +7141 0 obj << +/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6651 0 obj << -/Length 2647 +7151 0 obj << +/Length 2646 /Filter /FlateDecode >> stream -xÚ¥YKsÛ8¾ûWhN¡f"šø¬=l9ž<<•Ø‰í©ÌV&X¢%®)RKRQ²¿~ú’²%Ïa*e‘l4€F£û눚ðOMÒÈL6IRå›4Ì×'Ád -oO”hÌDe6Òyu{rú&'*ð³ ›ÜÞãD~™Éíâ‹wþîìãíëëéÌã™ÌŸÎ’$õn¦Ê;ûðê Å¡÷¾^_¿™êÔ»ºþ€M—çÓȸ×íï——o§_o;y}Û[ÔϳghÎÿN¾| & 0ý·“À7Y:ÙÁ{à+h^Ÿ€=~ù.OnN>õCq[8á^‡Vï4f*ó3=ï¡Xùalzih }Æè!¥´o”ž$QàGAH.¯ _¢0óÎË–ŸW¬OÓtA W÷°lê-<7-Ì¢PC{sZ"¼ÔûƒÎâæ)o[‘³ ©ŸuR/ﺼáanÏ?ò‹¸¸AUå­Å›Š×ž“cBï|•Ï§ öÀ£±¡3mR>Ú[_DË«+N«N\ŠømÅžm -Z`˲ƒn–¶¢zÚ>Äsœe~QðsK³œðËõ(.Ey6Ò~—FDÓoìwîÎò -,l&¼hï -–ް켞ö±‰&èÍú$cœÎó¦= móägœj?þ›ü里8ý8U2ÀÆ p -9ð¢Æœ˜9Sƒ;ÃðÁèÁ¬c%Ði$WM{‹­´ÌW¶Z€4ôõ€ýó¦ÊËc+ K3ýüÊãȇ€¼š“ï]± 1L‹ø†™7?ðQW® -<=Kcå] "ÁšŸ ¥*ø³dé[ Ìe3ŸkLžüÞæ.ÏyRþ¢& -3Ò±ÔãÝÉÃkÞµŸZ²I{×9'(OZÊØ@†wE³D\µ3CÂãAlœÚ‚ì½{Û5·–M†‰û}¦ýêÛl9ÊXYù¬Qw@ ŽB3o˽t0Û‘›Ë‡ÐZ¬ÓJ{g°ô§¶W?Mœá6àceQæ|g’ào Œ{-aÕVzí -À%j{C=‚|ú 5ÖÕ³càB}P­:•ñÎÊ‘7J$Û3îçu…q¸ìg—}‰÷ -¶òþ‹W”1§œ±.­Aœ7T´š—Y´²šjZ„ 9ïê+Í, C¯”èyàQ(a›µ-Y› Ô ‰sO¬ºc6Lc_'ɳLo¤sœÃ†Igã¨ç°Ê{²Úl7îô»¸ã—7TÄóö˜uqâÇIü¼uƒÎq†pVLçéìG^)‰†%® /¸š2q„Æ9>Wv#ŒÎyˆ™‘ò®0UEB?Á®¦íø{ …‚ã¿rZEÑ“`dñÖ¿Üð;JàýjÛ°)Ìiú£Š>þz~ þ¤º`yº¢2–°”ÀÛê¶ëƒT ‹é€þŠEÄÂ}lg%jÁ™­LÁ/ü¶mÇ•¿<¦ (¼¤9NÿÀ«¢¯Ü“ƒaï w)-:Ú„šŒ„§¾mZþœêÖî|L,H¤ -M•pGìÀû³p 2¾Úv¬äB¤ç“ ³Äøpð}¾‚¢¡<õ4zܼ¿Â¯ÏÿâÏþÄ£”ìÿÀv -h5Ǽ™“@Š/G‡D4‰™$Pò9¥‹õ]åx¶UùŽ‡vNŽó¾"p¹Çfú¨¹³_–ʬ*æP0Ê!-Ø9 âh*ü.^´¹[ôGg.ÇVs~·ÌÛaH̘TGŽu&p~¸Œœ»@´íèƉÐ=¤ÝáÚŠWRxùû%¿¿†w=¤ì£‹nv¸7Uô÷78ñÙ}ßly,â ¿C&ËXÛPÑ_ ~2Äéù¼XäBV aˆÓ7Q)¹QËàÌÒÊ5!&¹´³•Œ†k(YˆéÞ8|óó‰ Â/?ûÒ»%Ü£‘$+*w¹‘[Æšˆ`Ñѱ›f’KÅÕèQgÂc徑w‡Ï—GøÎ"ïä„"%½nºW¤™”÷ïclñ̹ ¶æ?}yB #¬›”áO÷¯£3·E°w6W{ÛÍ ñ~\ts+Dïë¼®Xç<·å°Å×ݦ÷NYÕCKB{dTO’p¹óìÏ;li;ÛtaP©'=hÙ™Zùqºï•OZ¼’ÞgaZðA÷C(³Š(àò¶¤[XȵÂÝ·`#C7Æ×ÇŽ?¢i,é§p0‹ï£“j1Yi»¼šÿp -\Ôe Ëã–µŒ5¤? ŸG¤QðÜŒ 5ß} £³Káƒ|]ì.xËœSk‹{øÒ…F© HbEÙÝKš¹ê 5Á0Ý'ÈÙð !r×UŽGµìö¨6T=”÷cÉ]ç£C5íöH<ÚÜ>¢µŸÔOG¸¢ |bŠðÇ6ý£ÿIø¦ñS“¦›‘Ö¾V΢©ylodR?JÍSƒÿ„×tendstream +xÚ¥YIsÛF¾ëWð¨b"@7ÖÃdÅv”²%Ä”Råø‘ ‰JÖüúy[7À5‡”JÅ^Þë~ýú{[ßxðçO’Ðõt:‰ßÕI2™WÞd3Ÿ.|¡˜ +ÉtDó~vñËÇ0šøž›zéd¶Ö Ý Ô“Ùâ›sýÛÕ×Ù‡ûË©ÖÚÑ©{9ãÄy¸ô«/ï¯p8p¾BïÃýÇK•8w÷_pêöúr +cÌ5ûãöæöÓå÷ÙïfV"»잢8ÿ½øöÝ›,@ôß/Ô‰&úðø~xäø¡ç†^@Çhà ~ê¼ááš-wªbµÆ~ÏÝN\<ã@ÊszaêÛ7n´@‘£F²Å0!Ç+sü‹‡knx$öPwÈšËâ¯käí¹CíÍærªb'¯;lê]™}ØŽ—Ï{Þ¨á®3<ç¦?~°FÈ–YÞá=‚R§>ê<%%µY3,%#¢iùêé@=ey¾ÎçHÕó¬(´rŠvI¢U¤.ä'Žœ$ œ»µýÆ+öF­]_Ô+^ežÕÜhó¬,߸Ýçeéž Ÿl‚óF3ÐjÌ®¢j¢$…_F ØI ƒ~œÇKí9-ê§GÝD1^^¾öA³ÇE2KiDsÈQ軾V$Òl Û ´W+ öZƒBì4r殳¾@, Á¢c’…Uy±ªóO"Þñ÷ Ø *H™ ', +ÛUÁøX¼ƒá01Øšâ`I{ѲöÂߘ0”¼§o$?.¬ï ‡ +BçêN;&~!@Ã5¨Ôs*RÀwæhk6B„&2¨Ô§ª ±Œ„ÝOµa*Ü]Æ‹þ6g½g:²'¢XÆ,èJ³ +7~"§ÀRFاt²%¡1‹¹7­ì¹Dyå4¨ÖŠ-^&ÆûÅY¹Š¦ÎÊ–üZôk6™BlôiÐ2âƘ™½¬ì©D0)kÛ'(]¶-{×ì¦b×KSq®ÚDÁ-°êi <1 ²¡È¢iH`0nº¯æê Èaьκ¯˜nYú5¹h‘gj+ÐVŠ™¾w´â¢„Ðè<³.V"LUƒØ°vÑ àèPçtY½÷ÙÓ^øRskîã#Œ7QÑY1¢9éÄB ‘? +Kĉ=€*É_‘ûܬ +ˆ5'$ÑÊâð¼$ÍIߤ±Fœƒ<”d’ äÀÓä0Xêfm.²jºÞ´ÉúÿožØVÈÉoá/Œ­el“ut«ÄÜ´èá<5ÜdŽsÏrpœ ƒ²¢P9×µ’õ…÷EŒ›œm‘:›÷ÅPyˆ”LB·\ibïRò諱ÕRŠjÓ’)¼˜Ebçš…ìXøã÷ h€\ð|,ÑœDV #°{m• +²®K”4¯{†V¿­Gžæ„DZ»ÚÓç%hN" rEÈ%9:Þ-­õ£É+ŽX«€½®Dš^ðôýN¾¯bº¹¤+4iã Îôp¥cNJU`A¡x’²ÈkJ¼(Íñ9ZÓºv†ûy¡g>öóYÅ"Â} Ï#]낽_Ç;Œy/ÌО§c±Í¯ZÊ7ìãc¬Š‡“Á :ͲÏk·!Ð Ý–÷‚§0ƒÓô½DiZc†íë¯Üá +I]öçGr¿8Œœë±ÆÎ3¯Ð¯E†NrKö”6õU 6†à0п6Ûî˜;¶ÿ ÚÜ¢¯}ð’ÁDÇ>aPÆSíjÂû& õtD~Êý5Éïa^8OÛqV“Ý+çN#IóõHÚ=)U¨Ü8ŠÇRØ‹¡9/ÛþJ(Û)¡ÃÀþÆ_ŒhNú 0וñ Œ„¢¬"}€³ì@.ÅÐZR€¢Ôº¢P:Ï æßÆR£ÈYlef¹ÀŠë†Ñüy[ç婃)(/uþ`ÍI·£àWÅt®ß +Ü[ídˆœFÔˆy“Î RhLé·%;C|‹àÊù$÷/)+ÓQ “•IC`¬³©ò˨¢#2F4ºL¹”«Ü$iîÙÄdGª®"+#EEÔi.‹=Ù=k“SwÆë£à*J%ù× +ý‡Ç6í‰ÇÿA5ƒr¡€§Þj¤S³©ïñr4¿åxå®ò¦SËgZÏ“`8 ”r®P-ÈÆu9§–(Ð ¯MoŠs{eÉ“LB#rpÔOçÞ’êÛ§ˆ »gœtgµM³A¨%s É'¦iG~€Ï9º)š¥LÏFkP&@ +¸ü^¢ 8^i ¸`rÊ°|&kañn¼4k¯Å圛¥ð ²O[p±àK}á ¸=T¡R…)‹È£ô­X ?Ɉ$jô”á§|5ž¹šx¸ô=•ÊË~¾ºåq[ŽÁàè…„èpMµÙÚ ¡åð‚œŽÇ˜âÑŸ™ó‘Ò‡•çyU [žóy—+4¯<¶:=R¾®!Ñ¥ ”: \»•ˆGèOÅίÅËŸØJ¸ˆæûyÇT;iôñ—þ:HÍd”e0vDŽÞÆäŠ^ð‚2nƒ‚]–཭›6A-gÍ47üCºÏºÃÜdÏ÷uЂÑÊSî:Þq¯\ZIrŽ³f?ê˜ +ÓÔ* œ§­Àækë Ci +ÛK‘ËË–ÓÄÿñ@$ N$“Dh6ëº7LßS&bòC¤¯*·‘LrR›0¼°¯¡ ?¢GÚùÈ`ÞýÄeY/y'ßAÔv²@vÉÃÌC% Ñ[GóTŽ¢o»Á5‡yp·mYºI¦ÇïP¿^xGÎΤã¶ÔèržCì­›®7² n5þÄÎì=w)ñ´/²>ãþèË÷ h„ž÷3·¶öë&ºÈþ F­»M8ðvL};ûåϯ߹̀ÆÕå‰ +™K9GI‘mð™¤(H*]1Á8»GsT¾d¶'*ÏUG-þYQÿè«Ýè±ÆMFfµƒÝPAâYðbÀŸíËk¾îüW?Ûáendstream endobj -6650 0 obj << +7150 0 obj << /Type /Page -/Contents 6651 0 R -/Resources 6649 0 R +/Contents 7151 0 R +/Resources 7149 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6623 0 R -/Annots [ 6654 0 R ] +/Parent 7118 0 R +/Annots [ 7156 0 R ] >> endobj -6654 0 obj << +7156 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [229.043 698.057 352.339 707.625] +/Rect [130.467 370.097 253.763 379.665] /Subtype /Link /A << /S /GoTo /D (Other-Clients) >> >> endobj -6652 0 obj << -/D [6650 0 R /XYZ 85.039 781.388 null] +7152 0 obj << +/D [7150 0 R /XYZ 85.039 781.388 null] >> endobj -2822 0 obj << -/D [6650 0 R /XYZ 85.039 761.463 null] +2914 0 obj << +/D [7150 0 R /XYZ 85.039 718.394 null] >> endobj -6653 0 obj << -/D [6650 0 R /XYZ 85.039 736.911 null] +7153 0 obj << +/D [7150 0 R /XYZ 85.039 678.231 null] >> endobj -2826 0 obj << -/D [6650 0 R /XYZ 85.039 682.614 null] +2918 0 obj << +/D [7150 0 R /XYZ 85.039 564.826 null] >> endobj -6655 0 obj << -/D [6650 0 R /XYZ 85.039 651.089 null] +7154 0 obj << +/D [7150 0 R /XYZ 85.039 521.872 null] >> endobj -2830 0 obj << -/D [6650 0 R /XYZ 85.039 486.277 null] +2922 0 obj << +/D [7150 0 R /XYZ 85.039 465.454 null] >> endobj -6656 0 obj << -/D [6650 0 R /XYZ 85.039 456.872 null] +7155 0 obj << +/D [7150 0 R /XYZ 85.039 422.5 null] >> endobj -6649 0 obj << -/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R >> +2926 0 obj << +/D [7150 0 R /XYZ 85.039 354.654 null] +>> endobj +7157 0 obj << +/D [7150 0 R /XYZ 85.039 309.579 null] +>> endobj +2930 0 obj << +/D [7150 0 R /XYZ 85.039 133.339 null] +>> endobj +7158 0 obj << +/D [7150 0 R /XYZ 85.039 88.265 null] +>> endobj +7149 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6659 0 obj << -/Length 411 +7161 0 obj << +/Length 1035 /Filter /FlateDecode >> stream -xÚ}R=sÛ0 Ýý+8’ƒP‚€ø±6IÓvÈõ®ÚÚj$GºØ’Ï‘ÿI‰JêÖÎiA<ཅŽ -_‚¦ œG ïÅã~£ÅSÌÜo0#¸$(™ãùB²X³…5 Ù]ÄdŽÂabL˜ÕæÃ'£…Ñ`-‰j+ a‹ªù!Yƒ*ÊRËÛ‡ïª ëd=4Ëáö³*PÞ|K‘•7ãðS#?ŽõÔù?õM«~U_7wÕ«˜¬Å ŒåjQrô®k]ôË{AŽîì™—84aõ‚É ù¤ÓUm¹ê]ú7ÌL¥@ A‡3zãÁ97ÓW]ÿ¢ -œ|TÆË®>L -e›”Ó½•Mß,‡A%u x_?'x»D}¾íe‚œÆ%šºX°v?¶»¹iý2ÿ¢c&#¿LKëuØÕ‰eh3åvÌ"¦.Sbúô{—;£ìVµ¹"ñÔsfcÚ¦—¸ {ÜÆ'@ô&ˆceô«}A¬;Åp?7’Å ®¬ƒ4œ/ãêR^‘ÿ¯„45k³$‘<ÿKX’‡ÒÓuÆ?ÆÂÏÐendstream +xÚ¥VÝoœH ß¿‚>uèugçXÐ=œ6UÒ¦º¦M²UujûÀû¡ÃÉ*ÿýÙãlútŠ"ŒÇöØ?ÿìEzþ¤‡\èÄ[Æ’ë8ö²j&¼œ¼ŸIg1w&ó›³õlqFž<‰·Þ>Å yjogï>¬¾¬Ïoü¹Öšé„ûóå2f·¾d«Og+Tì ¼ß\ø*fŸo>áÑÕ;:òZ½º¼zïÿ\œ¯ÇŒÆ»àöÓùwöý§ðrHýãLpÄÞdÁ%W3ȇ‡vïåìvv=†¢³À#¯©êCó0Ö/Ë—áDù¡à¡lùM å˜MYTPy(vvßCU*d½ñçPpžbÙ¤KË’„Ë߃kÚ(v¨ŽØm­¢öUÂzÒ"˜Æ£o’æÁÚµ.jW|?¢ŸÍ.í Æ¥²/ȯJµó©|µdHqÉrRÝ—7p¡»»klþÇ%Û‘EkxĦ‚s‰''ˆØÚ3ªÍ¦R`‰:bc^:ËEý>ÍI)#!þ ±½‡P5Þv¨w¤z–÷뎔?D(jÓV¯´XëèYp[ÃÃÁ S¡éÞ.1¡žemÚí —¡¦ ÿ¯W$Ÿƒ¬C!& +ÏÊû®··ÄëÞ"w lc¶Ú"¶§V)=JÓ“`¶ôì¬QÚfe?ÂãtIy‘rJV#Û £ÅE¤Nøª„E’c~m¦±f‹? + ð¢´ô`™¯%4µxÃ-ù†‚=#¿”’+˜ +æÊù6ÍÀo¬e—ÚD¹…g®aî´„¥¢–\$„ÒµDìÁ;JØeGO@ÇÅ´váð¥*ú½›"TÄ< ªŽ\Àq±HxñëöCÈ 8ëîÄAÀ³Þ4¤ÈLc¬þ`Ü‘iéd?Œ—oèY¤mùHvyA Íú)V˜ÖÒ¸±q%ûk°±˜ÄÖfå0Aÿñ¡E…’·¤¡)˜hoðH/]C ØM +­Tìî¾™h_{m`B†0?{GCU±Òäìžæiþ´ý_Vö½vi‹­i À*mûgA*tã:;ÒEª'Áò9]”ƒÖÎ7»0ÝbÂ!€«Ò²3ãî\2ƒX•9iʃ/Ç­†Æ½3­† íGS“þÐ9»Ó‹ÆåIk¬}@ÌÊd]ZcÒ=:«-*7uy™~ˆXY;Ü6ðÔåtŠèKv æؽÒ-]ŒyבÎ&3RŸ†Ë²ñíи“éÅÂò"u®Ð>ý, Z M<ôÃæi\WMO»j’âj’â¯hܦ#ÂŽ~[†{‡EÙÑskœâZ¾úÍGƒ\%S?ôðOàý¯ï‰ñc)Ð<ÖÉôÇB¨WrÈ1tòk¾ÃwÇ‹„ÿ!UIcendstream endobj -6658 0 obj << +7160 0 obj << /Type /Page -/Contents 6659 0 R -/Resources 6657 0 R +/Contents 7161 0 R +/Resources 7159 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6623 0 R +/Parent 7163 0 R >> endobj -6660 0 obj << -/D [6658 0 R /XYZ 85.039 781.388 null] +7162 0 obj << +/D [7160 0 R /XYZ 85.039 781.388 null] >> endobj -2834 0 obj << -/D [6658 0 R /XYZ 85.039 761.463 null] +7159 0 obj << +/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -3065 0 obj << -/D [6658 0 R /XYZ 85.039 667.044 null] +7166 0 obj << +/Length 398 +/Filter /FlateDecode +>> +stream +xÚ}RMSƒ0½ó+rLÄÍ'áj«Ug䦰¤…±…¥ÿß„@e´t˜ÍîÛ}ïeaÜÃQDŠè0m «¬"6 ¤TIéâ+Åx¬ÆšSÉUÌÀ',¥B2¹Ï¢»GˆÕZ l; +Ѩ1 +eÅ;–@I¬àåúÄB'8¯‹,ŸHÌðâÕŸ4^4õ0¹;·yW5u€¬ÎUaÉgö=d-#K¢©ÑWÕŠ¹ "á7­hg[¦jj…IgNO­pí¾l´Â¼™âµWÞt³Ò†®›ì¿˜ž)Ä€¦NØ•1”ñ´gÏÊêDb oOp™ ÃmC®¨ŠÔÄ ñÁ«Ì¿ 7؆L5TªÚ'»&œº²r]ýô·voó“ï´Î¬[,~îBe:î]œ×µX·žµ§Ùä’ç/÷ÚW§rDNÆT³õ_åEœüuúå1ÿ?Û…Óèìn|ÇÙÍê=Ù ŸÎ\¿ê.mrù³K¸ ÿ¯@€ šÃúýKøK¨„¡ÊˆyÆyÌoendstream +endobj +7165 0 obj << +/Type /Page +/Contents 7166 0 R +/Resources 7164 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 7163 0 R >> endobj -2838 0 obj << -/D [6658 0 R /XYZ 85.039 667.044 null] +7167 0 obj << +/D [7165 0 R /XYZ 85.039 781.388 null] >> endobj -6661 0 obj << -/D [6658 0 R /XYZ 85.039 642.326 null] +2934 0 obj << +/D [7165 0 R /XYZ 85.039 761.463 null] >> endobj -6657 0 obj << -/Font << /F20 2865 0 R /F15 2876 0 R >> +3171 0 obj << +/D [7165 0 R /XYZ 85.039 653.495 null] +>> endobj +2938 0 obj << +/D [7165 0 R /XYZ 85.039 653.495 null] +>> endobj +7168 0 obj << +/D [7165 0 R /XYZ 85.039 615.228 null] +>> endobj +7164 0 obj << +/Font << /F20 2961 0 R /F15 2972 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6664 0 obj << -/Length 2760 -/Filter /FlateDecode ->> -stream -xÚµZ[oœH~ϯhÍËÐÒRC]}%NœËN&‘íÈíìî&n”6ôÒt<Ù_¿çÔ¥Át™j-ZEŠ8>Îwnu(ºHà]d’$<_¤%<Ë«‡É⮼}A­„œH!à·çbì®ÆŠ‘D¤^ûŒ8¥9Ⴂ̫›¿\²dÁ¢_Ü|]Pʧl¡rA‹›õ?#AÉ2–2‰.—œF‡¶[Æ4Ú”í2æ*®–4*÷Í¡]•ûå¿n>¼xss|¦}¤SæA•,bÆ OÙ$d•R’(6„L¼„zl@Yî kÐ"n—<‰Ê»=À¬ºç!Ú›=(XJXÊ'b¢û¶Ô¤À Éx¤¹£ˆr»>áJaÑ¡†‰™„¼ªò3©RÐùpàÊ -…ÈêuÍek„ÊO׉áäݧ%SÑí X𓇠-°Ϲ‡‰×|¯lÌ"jt¸˜ÿOˆ`,9$³‰—Žiª ïUg2^"2` -…˜èuÍeb„ÊÏÄ0ñ‹«3š‘»¦C»qý†V£ÿë|Ñ‹J}ÑòÓ¶\ëÎà¤]ã ´iùÔkÇ4‡"|ÓHΡ_Qa…BTôºæR1Bå§b€ÊZšcS½[ËDóuܸùˋ⡆÷ÝÿÒ@»!Ø”m !€~ŽŸ:à2<㾬Pˆ¯^×\¾F¨ü| Pùú‚V«@©Vèð…±¢áòi·íò/ÙQXsf\†³Ýo%´ )t Ø°£T{ÂX -FLØ”ub¦aç–D4`Ì -…ëuÍel„ÊÏØÕ³¾)Ñ×÷¦©^Ÿ®~/;Ý#4­.÷æž(‘Ýû&´i7Í13®½ëXø)ÿO!)dNr`o˜1‡ôªè™= È9a™œfØ èšÉð•—á!ª/û#£È+lX˜¸üŒf}}á Cª CPâ^Ö@Ⱥ-Mó÷ªh»-N84‘ÝI Šœ¤)›²FÌ8TÀ3‘‚>À5Í -1ÔëšËЕŸ¡ªÏ¯/±CK"èÆ÷NðkþÕ1È2Ýà¸H·èÍáN[yïâ ­}VÜ›û´x‰×W›ºú÷ÁžPÓjS캲õE(ô‚¹r¯­žkÁMqbñ÷^¼jjH¿Ld†ïµž"~ЋÉÔ¨²í -êÓe;z=W<üŒî—H -+†²° Nñè<ÕZ³†„Çn¿š àÁ(vgJ -êªjó— ó÷]ƒoÚîÍÑŸ‰Lvxân[9e½º7ºÀŒ‚Hû”×æõ ópjÊþ§iAú¢ Ž=HR -þ¸P=h¦ü‰º‘<ÏÎtkɈâ© -¹u¯k®[PùÝz€êZ›|­ù3f×ê5龬»â8 m̤Ô×Á1’{§kÆ´#æŒõ¡“†4xÇ´ûÓN•O\›C¯@Ïd Ld™ -±ÖëšËÚ•Ÿµª÷u×öECgõ„*ÝèV`ЙëºÂ\]á$ñ®ŠR’ùjÈÇF—üº¹;à fÈ,¾-¥Œ - Ö¢[sFõc[u]Y›•ýû¡Àù^Q—&k`°’“>!§D[MØ8æù¹³<Á$‘<0ËsB!â{]s‰¡ò?@5Ñ Rf;Aø ž 5í7w¢:·ÿ£¹$u dU–ó£+0 Ý´vÆ,Ã0¶É>fidÛ?-í¢Íæ(vÒbÞf¸\¯ö¦¹ç::ñéЩ Ž•¾£4îSìvý³ô ˶“9S@šù¨«È[GÆú`E÷ÚFÊêÒ‚ ÐÂòèð—õýâ¾øOU—§^ŠŸ Á»ÅÏ8~'MÒ³fX{D`¡beÞÙkšéœ#H^ß@õ­Œ$,û—9rmø)ôǶ¨ÿlpÐ¥È;ÚT)I£Ícǃœ}FÏ,P©ý†ó¶-µCÔ§ŸpR’P:a p+õæÌÅ%~ÊòÀLÓ …HëuÍem„ÊOÛ•iAmÑøc™ª¨´eÂÄ«]˜iθ”Œ§•\êà¯S¥ç̵O¡i ™ -™¸×5×Ä#T~PBãå’Iv섺«VúrWš¤¬¥Þ.ÍwÈNÅÏæ‰oó„¤ ›zɘьðs}[BÀåQ— -¾×5×ð#T~ÃPiK¿÷wfyfZ§•^ ™†©q pÓ˜Bš:Ž-Ÿ8¹‚…q*§Þ+¦p©3çŠ\à·åPò·B!c÷ºæ{„ÊoìªÛû¬XíM®¸x VÔã×+BÍLáí'ÇyNÎÜ÷€þ¯òÀÈ …LØëškÂ*¿ ¨n/o1ìqÊ Ñçb¿lL]›³Åjcj¦À.Úž}×àtG0íæ9÷o…åfÀÐíÍéßôùßÍÁG7÷­‹{=͉!ÌÜ£—éUçÛïw“œ¹>QSO¥ùÔ›ŽÎI † «¶ÑMT -ö?êkøã¶\ß—nDeÖ'NëÀœf NSBÅ3-ô -YŠy¿-LîÇbøùa0¦óîÇb#iÊÝ~,f÷c]•[È×k³yì°Ã·ÖE§· )…=Jl›8ÒVÁwo¾vÏìÜb°šÉ31¹s‹ê%“À$47,Д8¡@ tÍ „1*o Q½Ñ™zSÔº0Ëâ›z¥¿†ïŽó´Æt{ú*ºUÓzwés¹4uhÙY¹ -ܸ¡UžîÑb„)6e ½G+?s%Š[P²4ÐÓ8¡C½®¹ Pù ºÅm -ά?;»ê-U[·ckS´Ãçñ›“Þõ`‚åä «€º©¦^ ŠŒ(yfa`"hdœPÈÚ½®¹Ö¡ò[{€ê‰µ¿O£[Xßß÷«ªÝþhw×¼W_œÍu^=µ»{q9õŠzÃË•M¬t:³‚ýÓÐNWüVžKê2+·™õ•\%Qóí¹®î^ÿ^\ªpGÄ“«ÏB…ò;Üãõ¤Ä%œ(¸hD&ÏäÉ`™cá‹£žñÿ ª'¬endstream +7171 0 obj << +/Length 2178 +/Filter /FlateDecode +>> +stream +xÚµZ[oÛÆ~ϯòrHàhý“})š¸ÎíI`+Š¶”ÄXD$R‡¢âúüú3³»)jMª +6/£ÑÇùvf¾šÎ"ø¡³X’ˆ'3SÂãx¶Ú½ˆfpçí ê,„äD +Çž›óæî\1 íµqß1×4!\P´y½xñê–E3¥ølñµ¢âˆÄ±œ-Ö¿‚’p.e܆œǪç4ØdU8çJw! 2¼r€ƒòX­²CøçâËŸ§oîùô`‹fsÆ ×l¸’šHÊ»À©€GQ]àLÁ_Ú7ÐE| ydKĘ×Ï#tö#äš$Ñ0BÇ„²ä„¢L#øT‚iD‰ˆø¬1BˆDT÷ÁÐH‘XƳŽ³þJ"äi)à…êÁݹ렢”NÙ%,pÞ嬺°Þ¼‡@ÝÞÿË8xƒÌîveaOñ^aÏBÉ‚Õ±ÊáŠYxÑ5f·¡ÖAšoñL÷«êXçÅ>ì«[*;XÔ3€Œß¼ Y<Ág8^¾+—àp™×/û1âZÍøPŒæ,NˆŠ!'˜&Q§hÃüqÎh”¸ÖÙTâz°üÄu`Ý”yñ`ã_o2{pŸî–¡¤AjO¿ä ëòñàá… + ÅH{ˆ¹5M‹Užní•;S¾cz™£Ç ”˜h06À“$R%Ž°d˜0ÎIÂÙaÎh”°ÖÙTÂz°ü„u`½ßAÌöÛl—õ‰:L¸÷·÷N¨€ptIÉ›M…Á?`ðkÌ×½­ÐÈ ±ßfЬ6GÛ Ž8ƒpСpÌ,ŠŸôš¤Âðr1‘3å¨u6•£,?GXŽ‡Úå oƒ±K붺zwÿëë}ŒÅD2êaì._áÙ&­ÖöÂ=:O‘Ÿ}Å ºjŸ(”Z³¡P̉æü*~„NÀV óÓñÓq6‘Ÿ>,/?]X÷XÞ²â”?HS^¬KS‰=?Ϫ§+“S/к²gª^"¤‡°_±ê} 3pAÀ×Ä<0„A`D¶]_&@O€*ˆÍœaAŒäUEOHF×#„9£QÂZgS ëÁòÖ©bIy÷1d*ø²€~ôpMž'ÂCÅMŠ'ßs“9ÌQš¤Áß:¸`‚) B‘ =ôœ‚>…».u´*>"ô£Q&ZgS™èÁò3ÑL¼jºadùdõÚ¢Qw˜[¥ùUûÒ¶”ú8z¹ÍÖy¾/ă(Rx¬çž³ý^—j¬i3ÎfŒŠÖÕD&z˜¼Dt0¹pƒN6 ¼¬ å×¾†ówؼýSš´@¤’ &±ÒWå ×Ôäá0WÎh”¬ÖÙT¶z°ütu`øúŒQ+J€©VØREËå¹ðnŠ¯ÒQØ¿Ç\Ž•:ü’jÐ BP»£UuÁ˜$Qj(:Ðt’°+)‚°ÑôrF£”µÎ¦Rփ姬ë³Ýëd¸Øµá©X_î–þ“ÕF"”•éöö^ÈÞ‡a´¬6å©.®½{Z8”c9YîÃf’òwrRpEX‡‚ °)aR\W?©&TȆÑ(í³© ÷`ùîÀú|8ÑÙK½Ô‰ÀÔ&æ' ëÍ_Rœ)q?a+[WÙ£Õ~¯ÓªÞ6£¯º¾HB¦?Ñ€º Ê/¹. Y5s½ç)jŒÆ(ê8›HQ–—¢.¬O7·!VÛÔøÊL#4fÄ›Ž M¾Ù“Ž‘*“lÇ¥‰øaÓÈ7q2¤ƒcšá½Õ¦Èÿ{4“(gé¾Î*_šª˜$ºq|­Ì  >$š‚Cñª,° ø‚uŽÍ47È…kÑ`‡Û·t÷/3IÁ +k=Ï)f­ØZ LÍRWÀͪúÍ(×#|´²ß³ýj%-,`4[Ú–‚¦yaÿ2áÊDy¬öðHF{t²Üæ‡Í)$pgÖn³R:Ç7öq Ö!ÊþmoCÁ¢à†^ÔýŸÂšÑŠˆg)d‰õus&Ðô#¹1]È­³© ¹Ë¿;°î·æu³P¡¨ìÍ"ÍYQ§§¥YÚA©Oµ1’x‡k÷ŠØáÅ¥cß­ek—µvVP|ÓœHê¡ ™iNì^U‚D!‘6F£ÌµÎ¦2׃åg®ë}QWmïƬYÑeÔ€QEnÚ kÚ '‘w+¤Aû¥QßE¹<Ú4d¦ßB)ƒ•\jäåmB?Vy]gÅyòHQ2¤Ef>‘aÆ’‹”qÇŠñœÇ Øu³qšHÂ">L|c4F|ÇÙDâû°¼Äwa=/…VmÓÁfvTVßš ùõÒš4™ åU$â´„b ê0…â¾4¶& s;YD³KAH¨ß1®¤S“h’ÏVMæZ‘dZ‘UJé~oæ$YZeëófû®Ú´³„±=ØÒãpÁ¯ãYg­IÞlJŽ5.Òÿ™€ÁM._ +"Á‹)Q’?óR6žVW­TØúH9"d£Ñ•Ú:›ºR{°ü+µ«§^¡Žˆá_ö¬+ˆLËoÑIþ>MwòÎ7•&Zˆ ÉD~BîRtêÞê¼­2C\á#Žk9#CçW6BŽÈÛÆh”¸ÖÙTâz°üÄu`YêšÈo!ŽÌµ ›¿nb§:ýÖÒŸ’Qj†ÆQ§-Ä°ò¢°%…/‰±3qëljŒ{°ü1îÀê%ÇO!“Á±y½Á×h+s»Îl…6VoQUgé“gsþž¢©äÐCÙ±ëV·æЇãnMÆ¢~r41æ瀼o™÷_ý×æý‰“P«:? §²ÙÛÎõé4¶<[Ü> endobj -6667 0 obj << +7174 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 625.659 402.992 637.349] +/Rect [111.316 585.012 375.719 596.701] /Subtype/Link/A<> >> endobj -6668 0 obj << +7175 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 612.11 385.241 623.8] +/Rect [111.316 557.913 361.605 569.603] /Subtype/Link/A<> >> endobj -6669 0 obj << +7176 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 598.561 357.484 610.25] +/Rect [111.316 530.815 333.847 542.504] /Subtype/Link/A<> >> endobj -6670 0 obj << +7177 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 585.012 328.405 596.701] +/Rect [111.316 503.717 304.768 515.406] /Subtype/Link/A<> >> endobj -6671 0 obj << +7178 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 571.463 370.677 583.152] +/Rect [111.316 476.618 347.041 488.308] /Subtype/Link/A<> >> endobj -6672 0 obj << +7179 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 557.913 289.975 569.603] +/Rect [111.316 449.52 266.338 461.209] /Subtype/Link/A<> >> endobj -6673 0 obj << +7180 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 543.758 309.786 556.66] +/Rect [111.316 421.815 286.15 434.717] /Subtype/Link/A<> >> endobj -6674 0 obj << +7181 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 530.815 358.538 542.504] +/Rect [111.316 395.323 334.902 407.012] /Subtype/Link/A<> >> endobj -6675 0 obj << +7182 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 517.266 379.598 528.955] +/Rect [111.316 368.225 355.962 379.914] /Subtype/Link/A<> >> endobj -6676 0 obj << +7183 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 503.717 460.925 515.406] +/Rect [111.316 341.126 437.289 352.816] /Subtype/Link/A<> >> endobj -6677 0 obj << +7184 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 490.167 350.768 501.857] +/Rect [111.316 314.028 327.132 325.717] /Subtype/Link/A<> >> endobj -6678 0 obj << +7185 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 476.618 512.306 488.308] +/Rect [111.316 286.929 539.579 298.619] /Subtype/Link/A<> >> endobj -6679 0 obj << +7186 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 462.463 512.306 475.365] +/Rect [111.316 272.774 444.915 285.676] /Subtype/Link/A<> >> endobj -6680 0 obj << +7187 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 449.52 356.69 461.209] +/Rect [111.316 246.282 333.053 257.971] /Subtype/Link/A<> >> endobj -6681 0 obj << +7188 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 435.365 492.684 448.266] +/Rect [111.316 218.577 470.259 231.479] /Subtype/Link/A<> >> endobj -6682 0 obj << +7189 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 422.421 512.306 434.111] +/Rect [111.316 192.085 539.579 203.775] /Subtype/Link/A<> >> endobj -6683 0 obj << +7190 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 408.872 420.309 420.562] +/Rect [111.316 178.536 364.521 190.225] /Subtype/Link/A<> >> endobj -6684 0 obj << +7191 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 395.323 388.007 407.012] +/Rect [111.316 151.437 364.371 163.127] /Subtype/Link/A<> >> endobj -6685 0 obj << +7192 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 381.774 236.368 393.463] +/Rect [111.316 124.339 212.732 136.029] /Subtype/Link/A<> >> endobj -6686 0 obj << +7193 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 368.225 331.698 379.914] +/Rect [111.316 97.241 308.062 108.93] /Subtype/Link/A<> >> endobj -6687 0 obj << +7194 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 356.797 264.271 366.365] +/Rect [111.316 72.263 240.635 81.832] /Subtype/Link/A<> >> endobj -6688 0 obj << +7172 0 obj << +/D [7170 0 R /XYZ 85.039 781.388 null] +>> endobj +2942 0 obj << +/D [7170 0 R /XYZ 85.039 761.463 null] +>> endobj +3179 0 obj << +/D [7170 0 R /XYZ 85.039 657.513 null] +>> endobj +2946 0 obj << +/D [7170 0 R /XYZ 85.039 657.513 null] +>> endobj +7173 0 obj << +/D [7170 0 R /XYZ 85.039 615.228 null] +>> endobj +7169 0 obj << +/Font << /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R /F15 2972 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +7197 0 obj << +/Length 977 +/Filter /FlateDecode +>> +stream +xÚ¥VËnÛ:Ýë+´+µË·È»¹H»é#M;𢷠Ֆã:R*90ò÷e[U9€á…DÎhxxÎ<ÌC?ZM™tab9•Ö†óÇ€…+°| xã7.qËçÃ4x?Ö&äŒ:æÂéòGS¥e8]ü —W·ÓÑ]K)‰â4Š“Ä’qÄÉý]d%™^íðàd†É·Š„\Ž&ÑÏéç`4= 9œ§:„ñ;øñ“… €ü9`T:îàQæÇpP­d³Þ“àû!”·©ÐÕwë½G,µV 3£ÕL˜Q¼Å gœ*&ýRóãI÷vœjµ [Áº"·€Ù›p£\5–»*Ε\¼†Á[°¯6¬ÙCºE´%ë +Ÿ Â'Ôk‚úüû +°µ”%zpÌ™ŠL‹„2w"¿„¢Ì §“,ƒËbV?‹-X³ñì#öO ­É-r—VÕ®(#ÍÉw ¹‡tþ°ÎW~æáªØù—O[ÿ¼€[JŒ‘EZù_+úë.¾y¿kŒ˜×‡­²Ò;L2”ÃÙ1·T>,QÐy“¬ŠJeZóÂHE­LjÜ0" ­¹Ë6é6CÐ&!ÏOð„ÊìJÆe‰ùU<úÕõ® ë+ö!oû'‡¬e*éCÍ §5\M ^I;CÔÃ9·w:•s­`gæ\VoεaêFñæsL¸¬iL˜f£|^¾‰Oè°]×…o¹·.q]ú÷ë8‹bWù=§ýó^­Q‰]«‰} ïUSPòFè!6bá ËØ·Mm\QÃ5N'%:;W¢¬~‰Z°fëüÈë»=±c$}“5 ã!-"¬üÀ¾Ç÷§Zк^:øN¸¡‹Å”—7‘­ UHw‚ìÆé$ÙÇ`ç’ÝÕOv Ö_d/}†'dV”ÿ¯ê©]¥\“Âq«Îüï{P¦†m±ô×HÑBPÁ]ÿ~…çH)ѽ––0¬lœZ€ÿh- ;endstream +endobj +7196 0 obj << +/Type /Page +/Contents 7197 0 R +/Resources 7195 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 7163 0 R +/Annots [ 7199 0 R 7200 0 R 7201 0 R 7202 0 R 7204 0 R 7205 0 R 7206 0 R ] +>> endobj +7199 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 343.247 212.708 352.816] +/Rect [111.316 749.508 189.072 759.076] /Subtype/Link/A<> >> endobj -6689 0 obj << +7200 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 327.577 512.306 339.267] +/Rect [111.316 720.288 539.579 731.978] /Subtype/Link/A<> >> endobj -6690 0 obj << +7201 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 314.028 253.915 325.717] +/Rect [111.316 706.739 164.127 718.428] /Subtype/Link/A<> >> endobj -6692 0 obj << +7202 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 679.641 358.15 691.33] +/Subtype/Link/A<> +>> endobj +7204 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 255.304 403.258 266.993] +/Rect [111.316 593.818 379.622 605.507] /Subtype/Link/A<> >> endobj -6693 0 obj << +7205 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 241.754 305.962 253.444] +/Rect [111.316 566.719 282.325 578.409] /Subtype/Link/A<> >> endobj -6694 0 obj << +7206 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 228.205 343.331 239.895] +/Rect [111.316 539.621 319.695 551.311] /Subtype/Link/A<> >> endobj -6665 0 obj << -/D [6663 0 R /XYZ 85.039 781.388 null] ->> endobj -2842 0 obj << -/D [6663 0 R /XYZ 85.039 761.463 null] ->> endobj -3066 0 obj << -/D [6663 0 R /XYZ 85.039 671.062 null] ->> endobj -2846 0 obj << -/D [6663 0 R /XYZ 85.039 671.062 null] +7198 0 obj << +/D [7196 0 R /XYZ 85.039 781.388 null] >> endobj -6666 0 obj << -/D [6663 0 R /XYZ 85.039 642.326 null] +2950 0 obj << +/D [7196 0 R /XYZ 85.039 664.197 null] >> endobj -2850 0 obj << -/D [6663 0 R /XYZ 85.039 298.585 null] +7203 0 obj << +/D [7196 0 R /XYZ 85.039 621.244 null] >> endobj -6691 0 obj << -/D [6663 0 R /XYZ 85.039 269.181 null] +7195 0 obj << +/Font << /F56 3226 0 R /F41 2994 0 R /F58 3360 0 R /F15 2972 0 R /F20 2961 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2854 0 obj << -/D [6663 0 R /XYZ 85.039 212.762 null] +7207 0 obj << +/Type /Encoding +/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/dieresis/visiblespace 129/.notdef 161/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/dieresis 197/.notdef] >> endobj -6695 0 obj << -/D [6663 0 R /XYZ 85.039 186.147 null] +5851 0 obj << +/Length1 1934 +/Length2 10773 +/Length3 532 +/Length 11863 +/Filter /FlateDecode +>> +stream +xÚí–UX\ÝÒ­qw‡ …àîwwwhÜÝ!8‡Cî ® îî<¸‡¿¿-Ùû¿<çê<§¹é·f­cÖœ«jre5FsGS ¤£ƒ#++@LA]LMŒ•ÀÊÄ‚DM-æ4q³vt7qòXyyY"î–V+ '+;5@ÌÑÉÛÅÚÒÊ ðNŒö¯$n€ˆ=ÐÅÚÌÄ `âf´×03±¨9šYݼ™"vvÕ¿žp¨].@s&$VV€¹µ™Àhií€Äü—' G÷?ÃæîNÿ^òº¸‚MÞMÒÀÍì¼æ@ $fEG°ìäÿ†©ÿ..éng§hbÿWùõée˜Ø[Ûyÿ+ÇÑÞÉÝ èPp4º8üwªðŸö€æÖîöÿ½*ãfbgm&â`i°ü3dí*ií4W¶v3³X˜Ø¹ÿ:˜ÿ· pëþaYIIR\\‹þïSýDz²‰µƒ›º·Óß…ÿÊÿ³¾2¸G.Ö^=&Vp"øïßß þKNÂÁÌÑÜÚÁÀÆÉ0qq1ñFß0q|YÖæ@/Ð ì™™ÉÁÑ üÜ€…£ Ò_‡ÊÎ`/Û™ØÿÿgˆÀììîè47µ{ r˜ÜíMÿ:|K‡×0€ÙÜÑÎÎÄå5Ä `vº˜Ü^c¼ÿ*ùÏKñï0XÉÌÑÞÞä5–±òv²¾Jppý£žµ£ùk,ájgâjõá0û]_`EGàßÌÉ`vó|]çd³• ð 6³…£ûëF8Á­±°öø#l×|,3ج+Ðã¯à#`þÇ9ÁV¬ÿ4Âóמíÿxˆ÷¯2öÖÿåÛ±ük_qE^ ,&úJ`!±W«ˆ¿XAâoâW–~%ð.e^ ¬ ÷J`ùW+(¼XAñ•À +J¸ÙʯÖS}%°žÚ+[ªþJ`uW«k¾X]ë•ÀêÚx02›º˜˜ÙÝ쀯Íç+›‚ÃÿyWxÙÿÎþÏëÈ –w¿0.®fŽ.¯'ÆËõ¯ËûŸµÁ~^ï-/Øé+»aö7±²€Ûaþ‚ÝÿÀ¿îÝvgù‚dõ‚-Zÿ`¶ ؅ݶñúZ³‚'³Ã¶áø‚m8ý`]—?ð¯«þ‚[âö‚m¸ÿ` ؆ç+²mxý`Þ Ç_GöOåÿ=WEE½|9Œlà±Å ¾¹\¼\þÿ™¥á`í씿ð,,óiÂoYg’£æUòëHJš’»CÑ‹ñÍÑ(gBÑ›3ŠD[å¦eãpXPÑŽ ö^´óéÜâÉ+-ˆ¦¢ÐC˜Ix’•/ÂF0pŸH +º†Pç8Ø ,†ºÔh– ä",š¼Ïø±-Zo¢"rú¥ð 7¨©ÞeÔÆ©ËœšÝ¨ñ¸^¢’NÛ.•Zw"ËZ¸rtÃRŸ·ê#!2é–uÎç)ÚX²ÉPuÍ%çpEbpÒÜT!½wðá /˜â+jȾª~')XÞÍ6Å®xAH™}K÷Á®¾ýü§Í ®@lÍFÂ6ÐP g‡'X!Ý‚Úù@§Î¾ôÏù/½²¡à\ë·‰t‡Lžm‘´1ë‹ý¨Ú!,(ôâÏOJ_áV+ózÞáO·Å¤dØ€€©‘AoÑA 9&„ «!í“øù6~å“ÖJúö_Zõrd"¼„ø–tÃðÞò{ÔIŽ2ÉÍ +ãSøú:-XxKÆÜŽ×äâ zwŒÍö†[SMÖBT¯¤ÜnôO’[ ›×{•~ür=–©ð²è‡ñNò{™JÂ1D¡X£ ~ž¸¼UMu¦öEÊÊâ]Îs:äbëÓ’` gù¯güfŒ³hašßF< EÃD!É°Ë M†_:ùtþ•ï°¡_(ŒÒzƒáúj~«GW4Ü¡†eÊ8u¾½G'8þFMܧ,jžó¶»SÒ©;åAØÙ}´Ó² ÆæÊÓhÅ^>?bµQæÌBÔ㓉@Xä®÷§ÁàÁúwúh¢v ãlõ-JÍÇYä¤l…/Šø´GÔ»'Ò3Ú0ÚÕË»]ƒ}ì|òBãBiÏ0çôÇÙŸ·Hå˜Ï_¦P1bùK­¼f!ÄF+÷{ÅT\®Þû·k®i³¯ü¦ŽHy¿EV„ª6Þ<m–-HüÉÕ/ªJ/\ÿ FO}rÏbeˆ'ö>¶´ßøaë~ø;B‘Ø4õíF9æùŽUæãr|[!myô;cÇ°ýfÌiU…@…è³fÑ`lDTY|õö±WʉPU‚/Ú1š†x +-ñ„Ý-¿xÁã—N=ÎÉ + >Ï)>ªý€¶ÙüÅÃvÄ%©2WXÆD29„¡³iÛóµïh[d§ûc?ðƒ†°Tú%VcОX [h‚‘xdãqLm± +‡‚6|Ó=2äÏãwá<Äș̡Ÿš#ö@:ê<®ð÷‡oÉÇ ¾`Ùj~‹5Ç ¡õ=æikïUof¢ÿy-Ìè¦QÂ6oìóO2\<˜£>3uMZx›PIÄi»F¿E7OP—7ÖÔa]ð³)Å¢¬L¿E ^ÉŠƒ6%ü‹Á6¦•ƒr¡„oßÎvÉ7­ëˆzŒJÑ + <—ûQp›KZ2Ó¡ï Ãô%¶dª9Õ½ýúqsOy¤h)¥&$}åΉ šÉÁ-yÈó—+±¥›÷› š‘ß Ò=ZŽó-È[£˜Y=š(9HˆaÔ3èØý»ô?&µ¦S$4åäòÑ®’‹|*r‹G+"jÕ¹g5ý¯‘(äÞ[œ#¢ÇŸãEBÝã•6èidK&ªwêéœæŽO6<òÑßÅ!QÝ&€-o›tk…øX Óî’ xÚ ÙÆYMèy~®ÏÀ„¨æÙnã”ø”¾=#~¨`Ó ¿|Ù'YœËƒtÅ0ñ}R/JXwÝå¡Éºÿâ€ÐH’ÍÁÛ9 +EhS ‘ÕÛ6^ŒvJ3£u9ÇÄjMQéTPô™ò”½3¨—¢²\ Æÿàþ\¾¡ARÖþºN»rª;.ª“]ˆç…¬¸¢Ê)¾‘C’N=UÁÙ•ÃEÔþŠâÞGÓrK@Bªˆ;³FþS“¬"VøY‰"Êv&†é¾òðó.0£?aÙ‡·&\SåSkCn#öÞ¦äê÷Q‰ßÒ"¿µ2yûQõóCIüïâ@§áY°4Õ8ˆõ´6Š#v–‚-š +sìü¥ƒ|,Œ9&[Ò¶bô-b*Gû›ž«g1cxŒªªÓüð™JƒáTâH˜RlZ±ª^LqóºO“;!ÈÚ°U¾*$ õ?eý¬Â+ñÚûâØv–­{9‚Qò#ŒØÍyÊY¦»oCt>K±vÄ: oSC­ÊúÁ Æ̹è>õg_.7Aæ"îëñäÎc Ä‘ÏWA­¿ÔñLç,”•§Ìܯ¥7R«%¶JãÌÓ#¶÷˜“Û/dmSóæ|Ê bˆ¯C(÷òåV6Ì?„£ûÕ†Mè!Rýç>:ÿçôLCŠìY=§ÜçÏ3^²WNíäùHŠÆeÎÍÞÏÂ5«‘ªk9òXrúŒ'vùÙžÔäÇøýð)! +þ¨|3.~ìï/ÌæødvÔf‡p.4µä¿Œ a#W¨Ô­HÜ»¯)©‹?GY#-~ôüÎùédY(¥ŽANZÊÞœãB'²º¸ØP„Ÿ¸A–3þ3Wf•wÅ/¦˜sx,˜Èkü µÝDBœQDDË©2ÿ¹aá¾³ØgboIÌ'?­€ÜÞâ~¼L(ŸŒÎÍÅ£exP26Ö;Èö˯¸Eì}59hèyÛ4˜ƒ‹ŠWÏXÉzwÚ ìÆ]Ÿ˜2üÚ+¹lF)âÂc +*ŒN;C徆ÔñûJJ±œÎËÊ~ îK˜]„NzKžãÃ.þ8ñÝûCé…Ô•þ&¼˜pv˜3öfò#Œ4tCîã> +cª/{ÓøÍU´(¨7Nò9»ô$´W'¯#¶Á™«µ¶ò«èÅGhRïöæ›l혦…M¸¾¥ÀR#+‘÷•'é[†)?Z[¶ÒÌ›1iUÞ8#ºR§ón«’›p«åä!±[ "ÒqÑì3Ò¸*ü¤ƒ’Î od(¯š¼Ðò]¸èšdc <”;´h†']¦ÅcdÞ!oÜÈWžH„+OÌö´!N›ì½‘ ÝÅ3K?©•Z׋¡„$<:0ú±×s×·D•±žLûŒ²Âþ‹Ùr]¡©‚=óÐú“UEîçb®Œ_Å›¶pñŠ Od'ásL⬩δh¢wÞ¶mÊ0‡Ûˬf€·Zœ…¡Ó, PÅäôá.a=—ºlÚÈ +ëSè°R?(šãë. {K¢qO^ºô wÍ{³o®¨ .‘ß)­Y|‚'\z‚},Ù;í~ÈoÚ¥§BoÎÌÂ@žä>äÂËu¾Mu{9ìø¸×L™–ÝP¸uÌ@"çö`—‘؈™~`Å°±³Ê"1ü¨Ýe¥ÇÓ¬¢k¯->¢ókî“'(9"ÒÏ]Ø,ÕGõP²y‹¾^Èó.T— /„èªÐ­Gç”"b²žq‹ÆÃÂ7ˆv{«¥ü®ø:t¥½Z+ÐÚ[U>/y´±†0ô‚ä×"½™~—‡Ár5 +co¬ÖÓ o<Ëß^º÷ᦨX*%/keÂôç.À³I™NÖýÙ Hh:1Mdâø Á3mꊅ51Ê™ÓØ>Þm<Ž¹¹åß($;½‡”€´î”šê|Ì £x>„Œ£.…Ät|J_;ÃÒx­ ¹×§½¥ÃÕV-'Д·% )< 0Ò#Žã5>þÅkwË`t×<°Ükqs@7F3N‡êÇ7þÆ`°ÎøÑ´ó¹yÿ{™öôüèìºP¹Tܪ!GcB)-Ëûe›o rçDÞ×%p¦Ø©™'ÙÁc¾8Ga¥†£™˜„Ãü°Üs«:40A¡_Tã䜳>rMðûH1¿,uîÃ"8º +§ÐP‚Ôl™š'çKÜ»1œ a{<äsù—@8¹Ñ¯@´üš§PCU¹ š— /î-Bçˆe·–a¼@;}1„ä-û6›õ#VÁž¨iÒ€^’[M‹y^—pb‘´ü™À§ËµQ̈Ì7VÂøÁô‡œÈ 7N3Ìá¤ÓokEâ®xa²koâ Ï ›OdSòųU½Ò··Ý@俦o @°ênzˆbí'³uÃUÎUôX2ÍOááÞ –¹è›ZJNû‹ä%¢„t©rOãÃLÎ9Ÿå‹Kýb…QâÄÈ9n?««¿ ` q_úaÚòÄå&‰ +ý8jq1§š+ ›Úx‹s°dUº‚œiÐóÒ“?ö¦„ÆŸfä¯?8D¯ßËÆRsòüHþ£ø.B˜kË¢]ÒG¶e +këóýê6T‘]óW &‡’Q8¤øl:Åjã"ž~ÁŽ]K^ˆ°ÿçŠ!Ÿ ǹÂÒÑç @‹pŽ{2¥ü–úz Ìò…Λ»´~[Ê=ðydBbaÿ%+ÓcÝ _hâQ³†&¶¶ÈzãîJWX/µ5ñ€¥“L‹RÖ +¦Á55ÇÈå‹7üþ×{z_ì )/ºÎ"æ`é)wK°(F™(j÷6Ɔw·U²‰< çà\¢Uuý—°æ2Àií­5Ê’Å|7±òÓzÑ~jÛ©EÚªu©]Eu†Áÿ§R-[%Ö~HËÚ€*¸ßQ³}j+FóxóaÏyyÑWn•Õz­ç–„ùÁá&m +—fª §L•¼ÇÉ—ô¶NM +»!{æ)ò÷B232Ë[þ·ÄE"[óS/wŽ&Ö‰ì6}B{m‚^HtGlM{’kÑ·æç å¡ÍU-!¿“G®ÝMJ{ôåa¿Ðq£yöÁfdt[)/O=÷¶Naû¹ Þ3°bÓªå0Tëp$™C:©£BEÃÓÂn =l¨YqT€ê½§(ãÆÈDV³áub›ZYVlÞezÒcæjŠÀù¹Ûìþê‰ *†B™á`!iEóEª°¾¶ó~ô|ô÷]‹}+§<~9zàÌÄ[úˆUcï(Ì>ºzí 3VBrï ìØÚ{ Ýtf#îêÑœ-@Þêç'õÖwÄópŒNuÆÅ´ó[ÚU‡àÍIÅ…By'Šx1“ÈÞ ø åúvŒ·ûá×]wiI\hF\w(œÉ?éDˆòG9y°©åYz¥¯/§a"N²ñÙpÝ®s\„qŸ{ØA^³_zêC£ V\˜ÜÊ¢úlgú/Ê®XB[lwfiãwÈ •öù0ÿ†åÃlä¡/¡í}«8·Gˆg+lï£ÞÏÉ?Ù»t˜[ÁÄx^ß|=Ñ-m¡´»S9¬]˜Áœj{áâʤ Úýè,63ZY¨ÃCš¥>¤a‘¬a‹îPÓ@RH*Ÿ¿WÏ SK7d¥Ã v»k?Ï;s–œ§H¿~—ø¢A§{û¬ýæ#¯™–Þ.½âF5a×:ªsîÚJÁœ#Îo´~?âéÜÁê2_»ÉÎký½ÒlW¡ +bîÀÚš™y£0xÚ‡ÖQ“›…´£'Þ(8@Z"õ£íý.vb_ãU¥E)êr„Y”ºñêóYÅ—Éf·ØQ•÷Úh„ŠQ0§ žwÎP‡£¸$y!ÀŽU ¸ªûÊ›;×¼a>R˪7©Oï¸SA“ä{wHŠèXÎŽWù¦Ùd‹ð"Yp–’–3”¢_Ö÷•¡ NC¿?Py¯©Gú<Ôšüò‚(ynº„qv_ü«nùE¾ hà*Û–q­£“%½_&b T¤¨0í_ýrRb”udßÎ퇠ijÓ4üHVúüƈ`Rà¨Y)—7t=2ñÙgQ3<‰â·SOl¾uò¥Â.z—Ú·[†+¹‹ sgÛÃ$CùÏÙû_üSŽTFÏs›¢‚ÜÖ#Œæ¥ZÓûú?¾–¦Ýzwí NøªÜÍ.VÒ„IÅZš!>Ôê˜Æ:#>x‰ïoò—ÞÅWŒ>Q׬”°¼CC½¡øàH¶… +E¹'!ÓD׈w WÈ2(ãùü¬š"òa“ð îÕ„‹ÃP§ áš8¦ã +á~¾EÍo +iºhÐ% ˆï\“…Pzw³ŸTrȱMDban[9K—ÚŒïôêèIÈP¦¨±2[ÅéœG8¿ÒÉ¡Kï(@ô|áÿ‰ˆ³-£ÔebbŽAî-éË—A{{tzÑB[·k­œ¹X@•«¨ÝH­n»AìÉ;‡Œž†Ú9;þZôÁ¿ûâü7ÞSeÃZ½Κn1âšÞÁöÅØÁ•½Ö„‚ª ïÃ$¸,z<ÿB« ÅÒ¯H 6UÝ"lM}BÈ3iäíY“Ϋ–þtø8¿)¼’Ò¡Èetõ5Wo5Ýaœ„læR‘RNÇ ™ÚZ÷&ñ¨ÀÖý –·äÒLþ}‡Ô‘wÚ'ôxñ–úe7ŠkKFzÉ÷Xï‹p£~벯¥þê"£Às´ª¥5»….Ñq£õ0Xº,šâs¼Ñ³Ä/ä$‚Õ •fqÇ?(>ŸniÅ_ÅCUTC"ùÖ»RsŸ +!R>SÆtìÓK˜ÞÈ 1X£Ð©Äð $¹s_OeX$§¹‡—ÐÇ&+-;jÍö^ÛÜ^ìzø#¡g“çjÝÛð†e^q¯©á¢‚º“jõkl!«§o'Œ³œ…Éè é.$wéC5–—9z«Y-Ÿ±âës…£…Ó2±üý5¯¬é’¬ƒy }áÄ•½= æŽ?}ime´ùÜ#,þ¬bƒƒ’-nÅËÞ){qŒ3÷oÖ²$‡.ˆh¥c-I¸t”:¹Ó¡bô\·G7œòƒf`! kƒñ¶<'˜ò:ý¢Í^^z§xä–¥Tž`Égß¹c(fQëÚ´Î7â¢LÚ2DÑý£YeL2‹›UŽñ­t"ó Ùù]0ƒ ÅÖ,½ü<³OJ) ‘gnS׈¥¹³ámùÉÝo˵ä ís:£V¿5‡`pª.ý\•ƒÙÆp/P{ ø?œç-äm|ûU(ËFJô‹Œ±=a~°ƒ!Ù ´¿¥;‚ËÒ€©ÐK»ð<­rÐBmµ"Eýa^V`„cA™ÜJ‘$áÃø¾PW±ål +{SÁ ¿cµX„*¢÷„ò³íØCÄ$w˜é¹U±/§.Çÿ£DËCbïÅ×éìýØšq~÷Pû©o +BËïרe·ä?ÙmÎ^~Ð_YFâÐsæо+Ñ ÓŽo pìâr5NSæsŠ¶lßž}cêP…ô +8â‡z¸#Á½N+¡ç·6ÀP]bjlSG5«Nb#¿7ˆ˜àQÓ•?ÂMÔ€Úì昕ö‡¯‰Aò8ÂÅþÍ¡c©ÍORiº2ÌóËY™Ìúµ©¾àîNþ ñv‰–¬6j-b«?nj,sH‡sa~à´Ð `—2ëǦÐÉ¥O³[ÇÔ¯|ÜêËVU(+/½ÏÛ”m®»ª“æ3kâÒ ™ +¢ÎS¹Æö¢­;_g1ÕímM#âfçÑc÷·¾¡É‚˜0ô‡Yä cg"kúûýPpfÕºS‚jRš(Æ£’,û!j +Mxõy5]rèAñ–=ŒfEžKýiÆ1ýÏ­Û‹3êˆÎÎÿg&¹°ý`¿öÍ÷wVN»DØn›e~ÒpÕuÙå¿õÖ¹©Ɖ‡0Ì’¿ö4ýn¹÷–Sɸ‘æš „¥ø6¡É½ |‰Ú­´ö‘%vÉ'JÜ–™Âðw›–\¡åx¾ñ†Ê7×2^Z +Suܸ-Û)Aõp|Åð£ÐÌ¥Á-_`§=l¨}ˆµ :«c‡ fSšþœ{²ÛŽB!üÐŽË…æf¡04h_™çÐ-PÍz ÍþÞ9 í½Û“C}‘˜Yþ_]r$GîOzÍíˆJÓ½ÚŸœ¦x8•~W‹Î‘-iY=v—«üŠ‹‡@­+âR‘‹ëiPmîàVcý•¡¯û± õD‚PÛ›ê“hÓ“d©ö½‹rbÏ8Éa•^M¬Ùlq_r¡n™WÂ2ÆV¼™BÙ¤¹Žš\ÒòWeÔ¹î)6áYŸ:µ/ýäžËý¥yšß…Ï(ÒχU¬¬†b¤XT[VfÕÛ|Yû×Øñö«ôñ“ˆ8úiW»zÁ#ªð^_ðžK<‡`´HÖeφpOt‹=5˜»Yb»ïbtõO³-«ÃˆëÞ¬ ¡!Ús@Ær…ãôç}™…q“Q»g>Ul)·ú}àþìØK»cê)¢àBªv¹•TÓùì…+¼Œ®GÏ|F .Mu¹d¯hãW¨sqŠcã£,]œrpK~a‹îƒUا†#X+õ1IoØË뤪œ\]²C;Ǹ—V´ÅèÛ ¿ÄºdÙ z Hhºô0 àši¤°ŠÁ<øRZ8„Ùyà(áåeßJ.õ0xÊe›¹ù^·u<º_G7°îrxŠ *ŽÔl)fU@1¿nQ=zF\rÃÛß\\3ÏÚ¼%ÄßàQ…ún#†ÛCþ±uRšßkõt¦¦ÙÑ×oÇ{ª²·^“ïÈÆ+? ‡r® +•ÕñLŽ{ÜgÎq2©ëóH —ç%Ñ~_Ûé²Þm1Ÿw!¿¨DZæËóæ4ñ x@>i ‡ŸÈAS¹™Øõ$λÜòžZ<<_Ç]¦æeT}|fˆ ¤c™'[±}CnÜ$³.Æýà &¬«Çž}½Ø1õs´_ok99€e^óÈþnü] —+ +öøN’oÁꔂV;Cþþ¾æÍ¥½õáØg]5Aâ‡\_âB…¤jÄÉN vòØ/r=Ÿ=‰¾I‡Œ²Áö~³}›²…io­òB€:k»ñ¿;5‹d•¸ÑÂ;o èŸ[p«Í‹Ã9Í/¹h€„¨TòüAò¡“b•Å´qNC‡IÇ_¯?ªâ©H= Q:¶¸ÊŒó"ã“t ë7Ì áØ!Íò®g¹Æ%Õ9î&tâ³°õ¯i‹.¯ªæºH¬| îr>®ü¦’Ù“+Åñº%u cÊà…¢“3Ë—ÐÁ§”_3ú„]‡^¥ö)3_Öù¥OæÞžMålźÂT¯fçPp±ÜÓ°™EœZ¶EKPó¡C~g9@Ë*;e¦<^Z`˜•¦H¥m +oâÇ€Ì~XðR—œe†îÏ4Gj7Š#*ZåâXf¯³üóKwþAâJÑA íGXŠ;~Ý{œ!³, ó·äâ&Æj‚]JAcÒ|Ö(¬HoÇŽMú¤ˆ>ÅY°?˜.ö0áŠB‡èª]ÁHºÅÞd0N¹ÅÀó!ê€UÜæZß`UltDro$öPL¤Êù’×t$>×Ò7'&—EkÀôØ0oðRVö»+¤9ÉèûNŠŠeX†ÂëW@‘ ß7š[ 5(`DYûUO’šÝß‚ÜŸ“ Þ@GÉ”+F´ø°ŸäI÷ÐÙ˜º¾ªØ/»>˜º¤”•nNÊC9ƒ})‚Je½3m(¼rø^k"i¦_|w탓è¡ÿºO±©T¡ÖiÊ@ÏTl2[k´˜@ hp‚†¯ß0}cAéS=Í‘MóÌ´i¬Ž—¶·ôOwÏèGÀG•»,쯀Þñz€•îÓå3G ?©9ÛÌnÙ,Ú „ÊD+©ô¥³!›6ÎÖÔNl7Á ³#©Û/ÜØ(‚± +Ýæ¹’GúU;Ö/«€˜iMÇ#Æ,~•æ½èÓâL*™òOxÖ!~ñçÑï"ɨëÛP Ìé/H *bmÍbzí˜ßeæ/eØIétv·Ý~ǘ±F0«‹†#?4åŽ=ÂÑf´DU;aNýÇzòˆpÕ=1@aÕºû‰=ï?™AÆi‰6A¬pÉý¶=1W|‚ëÉ6'›ÄÞosSïWÈ1"ù¢ÖÃó}Tm¢«rúÉk€îGDŠ€*Ã6­„”¢tÊ—ÍçÜKɯãP>ÕÙÐá£9.ˆZÐÕ]gø»¤a;^÷Æ’-£û±sí OûršpV¡(ÑÚƒ6çŠÝßA°©pZ0AV/hZº*9e錖ò¨õHªúz‘~~·{q&¯RDô¶Y)Xh⇫ä¿2ôÔû[ʯfï Âgö]^é·EK=NÜ¿6°äWáæ›[ºÙ…”Z­»åUˆb}§ËƉyIK˼Û»:PP}¡ ƒjŒYÜõ¾î»÷·M/RéJfÍjŒhÈLœÀlú&Ûî°’Yvgë§ÂŽ>XÝO>èíQôRr¿IäÀ§è³<¡´*Kú¼œ;)5û°œA(¸>øÉ÷£i‹'GYD¼ÎÕ(Ї&†m®˜îr ø8jñ¥oW®jsÙ•¡§(ó»¦ZÀ,)uÉ1ú|c~Óò㽈ÓAw*0=‡êSdV"MÓBÛþñÞ<³†ÏP š©NJ)/Q˜…0œSSàžOk›ß`•´ÎK&¯—Ä/~5‡oç9LÿH©K=sq±¾ƒÀš˜·â­üŽ9[,®k§`”ù·®ï|,×'ÓxɽÊ;¢åæ âüaw²dˆßp9¼è‚xN,$›Jº#ê©ôµËÀœVÚŠûÑx˜&¬ÞŸn5à +y×nMC…Ffàôˆ)œ¸ñb*8CÝnÞåKoq%C ¥j±©BÉ¿D(§lÛTIáÐÖsÞ^8Ñ›¢¢Â •#¢Ÿ­0”ȱ2z ßø@‰L\‘bòÓsPw·š` `nzñ¢í.w.„—˜£ãÐ.Kù„d•=˜Î¹Y-ÇêÚt?ÌÖ˜ƒTÚqüÛžÓ;§ñWËÇ…Ø÷4)ÅÆzÚy½£Ta÷ã³ +¿7–f…H\ß’.pFC¦ý,Xç¤ØP—ÿÙÑ°“J?=]ôÎgÄÅJW ¡¼©Qa죦³Cªž¢ñ=ð'‘SêA%æe2c½ÆVœÒûÀ$¨@xÙ ÷^ÓôÂd$ú Ù9Œ„Ž©jˆvK—Ë%wM$y"z ´‡æf–{ ‰q¾&î®”3FaÖÊ•‹ +lœ…$ae«±nG%¾„|(ÔáÙ·9»Å{‹©óæÈw?ÛáqÙ°ŠvÝœnÌE÷ÔCä0H;^8ØXaövÞE +öy}¼E~ðŠ¡„|jCã±ó‹ƒP[±¯±%iA;O­qƒEEñ'ègåìn~Ò…î„ònó›äÏhÇ¿ßè)çƒp“!£‰Ž“—±»’9@CÕ­lðrÃ:º’¡‘ƒÔ—)$l×\kÓù°º¯5ãÔCÎG“ß¾Ã_òSëí!l³ÍÁJ1è;ÒíÕ7|ºkâ¨pÐPµžÑðxùæZ6” +—ð½sAÏSòGsª Ùᨮoì)yæ„š©Gé+GP½ØuD¡jà‡ÓÝIqWdÞ¨¶¦ +hBÐýt©þõÂ>ŽIt3eÁS ¨Pb2Ä>ñÂî‡Ñ%£I œŠ³Á.«ÐÓ_³<ÎRc{‘u³9tÓf3n'ì|É÷.¤ÒeXôL‰MR®Ç³˜6ᵪŽö +IzÎgçR+¹È3{ݦAX¥P†ínGáEz¿bõ¢ÔÎÜdÁf‘…l€fÕÝ„foY¦ë”OnÐTu®åoñË…GtN6Yˆ0ÇXIô‘H¬cgaõ7zØ^[ŒB<[¢ët‡|+-~QO†š-³Ðr ˆhcmZÇÈl,L{ÛL= +ÅIÿþVŸ–5h—ŒBó—^W¿„Ñ%q/ÂQ83!ýî𷇧ƒ¹Æ÷=‰]“äjÏÑÛD÷¡ËRÁ;¸’ÔHI{Ø8rtb¦Ô6 `ˆò¢Z'iö§Ö‚Êïð/Ž/ýÓŸ'[¥Y ”Šû>t¢Q?{©—*@¨Š@ÚËðÔ,w£âôØóÔ¬`dÚ»’Y8!>$vʘѶèàÛœiÒUªØךÉJ`¹UMùq4D•²¾ÈodЙ¨˜ÎSN–S«¤Šs™pV{â;|R 4ä8õ¨ªÖ™K¯ž*¤m†ºÜ'€ýž©Œd1Îzû^WUÌ;b5ªTÂIã5Ñ‚»¸¬¡lq„ }Kéô枺sñô'z•†¸ô—G˜Oj]Ë„ì)$cæ„3Ø@¬ù@ztS?ÓÛ®úzsåf–ÿÃÒÿ/ðÿD3; ‰‹›£½‰‹-ÒÿJÛ°Wendstream +endobj +5852 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 7207 0 R +/FirstChar 33 +/LastChar 124 +/Widths 7208 0 R +/BaseFont /OOFDDW+CMTCSC10 +/FontDescriptor 5850 0 R >> endobj -6662 0 obj << -/Font << /F20 2865 0 R /F14 2895 0 R /F66 3242 0 R /F15 2876 0 R >> -/ProcSet [ /PDF /Text ] +5850 0 obj << +/Ascent 472 +/CapHeight 611 +/Descent 0 +/FontName /OOFDDW+CMTCSC10 +/ItalicAngle 0 +/StemV 69 +/XHeight 431 +/FontBBox [4 -233 973 696] +/Flags 4 +/CharSet (/exclam/quotedbl/numbersign/dollar/percent/quoteright/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/greater/A/B/C/D/E/H/I/K/L/M/N/O/P/R/S/T/U/V/W/X/bracketleft/backslash/bracketright/underscore/quoteleft/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/r/s/t/u/v/w/x/y/bar) +/FontFile 5851 0 R >> endobj -6697 0 obj << +7208 0 obj +[525 525 525 525 525 0 525 0 0 0 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 0 0 525 0 0 525 525 525 525 525 0 0 525 525 0 525 525 525 525 525 525 0 525 525 525 525 525 525 525 0 0 525 525 525 0 525 525 525 525 525 525 525 525 525 525 525 0 525 525 525 525 525 525 0 525 525 525 525 525 525 525 525 0 0 525 ] +endobj +7209 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/alpha/beta/gamma/delta/epsilon1/zeta/eta/theta/iota/kappa/lambda/mu/nu/xi/pi/rho/sigma/tau/upsilon/phi/chi/psi/omega/epsilon/theta1/pi1/rho1/sigma1/phi1/arrowlefttophalf/arrowleftbothalf/arrowrighttophalf/arrowrightbothalf/arrowhookleft/arrowhookright/triangleright/triangleleft/zerooldstyle/oneoldstyle/twooldstyle/threeoldstyle/fouroldstyle/fiveoldstyle/sixoldstyle/sevenoldstyle/eightoldstyle/nineoldstyle/period/comma/less/slash/greater/star/partialdiff/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/flat/natural/sharp/slurbelow/slurabove/lscript/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/dotlessi/dotlessj/weierstrass/vector/tie/psi 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/alpha/beta/gamma/delta/epsilon1/zeta/eta/theta/iota/kappa/lambda/mu/nu/xi/pi/rho/sigma/tau/upsilon/phi/chi/psi/tie 197/.notdef] >> endobj -5446 0 obj << +5830 0 obj << /Length1 794 /Length2 1135 /Length3 532 @@ -31290,757 +34125,794 @@ endobj /Filter /FlateDecode >> stream -xÚíRkTT×Ê# PALyÄ’£a Ì †ÇP”ç /%ÊðæÞ 3÷wî0ÃS–@DÅP4 E:“¬X‹(: hJáQJ£AÅôueU¶¿ºzÏŸ»÷ÙçûöÙç³ÛÁsö…°$˜‹¡„3“Æäÿðð`?&€Á ØÙùã°€@04@@ÀÀôôt!r1`¹†;‡íÊYLš‰#É)p𧮋ܯÆ¡á"–5„1àaB&2iÀW,ÖOÈÀXã0D£0™B„H‚“”B_7ŒŠ0à¾ICré«­ —‘¦€Ã†M* MB*Î,¢Ð÷ad7˜ôòß°õzq®\,Þ'¬—ߌê @‚ˆ3ÿ%Á$R9ã ƒ`}] oºóÃÄoô &bDè‹&‹aàÌt¥1\7yDÆE”0 ˆeð£Ðë>Èø6\Ðý‚üB‚ö:½zÚÝ‚‘™R0~–o`æϘ G” –Ac0˜¤\¯þâ^ëˆ -1A“‹í8.ȤCD"6Èf…`%€•¤e: Åò ƒÉ" §¬¿«ÐÅ°L¶În,@O^Ÿ=2¼uîÍ»ùùaÊlg&8³Ød+Ó ¸³¹ÿ.<ˆ"ér88°î.ž¬ V(Çq%6†ŠÌí!dÔ0¬„…”Ñû˜Ð«0õì4å~zç²U¶½ª±ðvG‘ªÊ‹6ÿ­×Ö{ø—ƒ‘°Íc³"³TäŠiåBh ±Ç­¾ðÍéÍæÑ‹FÌzM¶Q/Tó …óüx¾Úž®-’óÅß¾ûôK§Å?Û.=ÊèÐû,l–é~Ñj¡D·éÁýµ'yiG4ã£Fç Û©JJ\íÂ*ਙGe·Vÿ„}Š6ôYð«—Ì_ŽZu=Nû‹I•ç‰Úp­Ð‰ëL©ÝÓÙqnßÄTµÓ`È`þE‰ò­Ü¿Ž—ÝýGÅÛO5'·ŽÀ×ÿJµ/fës˜]Âð‰ƒ<ÊåÖö÷¸iŠ²Ê‘ÉŸ([[Þ~šè½`}ôÉû懶¹˜Y”åß4%Œ|¶—WÚoº²ûÖàbÜÔžîÕÖŠ£'£Ë>Üå³XòÕƒŽ äeþ,¿;"±¼TãÓØi\m3êqI -:šÙNò„¥w'‚‹qƒ¦@Ý-Qé))ˆ™_vûøQeOoMÞ¬Öí07h%#Ë—L&ÿ* 1Á‘4é«zR¤c3GbC,Щléxo‰oèm©™x'áÚöÔ’ÏOé-t¬ }ýõ‰ÝBÅUÇ”¢Ì{Ëo­4 îº9ù‰ý.Sô¬ù´‡">‚4Éûâºø³—*/Åè÷Íë«vLpÈ7oîém?ÛäõN®"ðv{¬aÅ‘ˆ­¥jÛ†Ãý©YŽÚå nSeT›Ñojûþ;î4½ëý–Ô—C"gým! «I¥1Yûëb-j­ó¼lU -x­3ÒÞÚäz“êGÅ»ùCË—Guö¦t›´ð—ÆÓG$¼¶i¢ --Õ^^<Ûnwñ8þ¬%è@½h\ÙÕæ è¶9_©…6íà cZÒóP?G¼û‡ü¢¹¹kÚ6µì?u„Æ%žPÕÊðæƒÑ—tf'»tËÎŽ;mtå̾cš~n?Þ¨V;Ãrÿ Oµô˜×u×T“_O~ä\éúQ5<\m«;scË‘³ößÌQùéìèýýü‰bÓõs{­Ú-‰wN{_*Ñ-ÿ¦¾äÚÕŸ ,‚äˆÂ Í5ÕeWT…Õ0wz…'7ü©QãíÁ;3øØ¥ÀxM<`øÌ)^ç¢jªª~hŠ¸‘çSû÷ÖW#x :DËY§;u_é›ôÖÉÕƒ3üAÏ ldi&kzBwïiÓÃ[û–v&öáÒîšÉêö‡ž÷Äñ3Uô¡­ œ*/ >žåõ½ŠgçÌ6KdÙsƒézý}1¼ûÞ]&Ìo6ç›K_,:X-$”ïxÜ’¾;<5ær›»õä;#駬¯p†ŠUÍôd/õAÎç±ù3m9·ôÌ©åÔÖ‘;*->åù‡¢øÌÞrrùãí×0÷Ë÷ -£¿óèZÃOÝ[úec½Úqg«±w„ÃmOWcfQ½ScøKµËäÜxMdLCÚIµW““ÁôpèýC1¿ø],‰zE.Jó±2x»îù± t+êAÄÊ”ëù´Õq³Àb†•Êø?Êÿ üOŠaN`žFù'þÜendstream +xÚíRkTT×Â# PALyÄ’£™2/CQžCx qx)Ãc˜{.ÌÜ;ܹà OYQC@!ЀBè¬X‹( +…R#…@x”ÒhA1½@]YÕŸí¯®Þóçî}öù¾}öùlv…ñ¼ ,æa(áÀ¢³¸À'$$À›Å$`2)66>8,$ õ0°ÜÜœA BØŽ€éÂå8q7DÀ“eàHR2¨>´ ‘ ð’Â8"¢ DH$ÃR²†H(|L„ÀDxI$àÀÆ 98Ëa<†è @ˆˆ‰p‚R¦P1\¶hH!{¹•ãrÒ nÚ¤Ò$„¡’ Áb +c?FvƒI/ÿ [¯ç)$’ýBéFù­¨^¥ˆ$ã_L*S0B0ÆÑW¥Qð–;oLòZŸB(AD^h’,':Ói‹Gä,½¹ö7ìSl¬¾ÏLPµlúbÌ¢ëÁHê_Œ*ݎׄhåKfKlž Êñú&§«ì‡‡ò.HUGée>µü¬î?*ßzl7P~âPË(|í¯4Û"Ž.—Õ% +™\ÕË¥\ji{——ª,­ú™²½ùý¨' ‹–G¿ozp‡£‰YiÞ cÂÀsg™a…í¶áË{o-ÅNï›å]i)?r"ªôÃ=žKÅ_ßìHG^ÔÚãO“ñ;£Š@óó‰Õž †å؃ÇDÿ#Ýè_Trg2 ×kôÓöÕ—œ”è…jðÇó)ûz«sç4n;C«é™Ö¸bp*é×¾ ñVˆ´QWÝ“,Ÿ=h†€NUsÇ»Ë}óÉ·ã¯îL)þâ¤ÎbÇêð7ßß+R^±K.̸»òæjýPhä©Ol÷£gLg\•q 4´?¶K0w±âb´nß܈®z×$ïÇ<Ó¦žÞ¶³1îoç(ýnµÅè—Û^Òn]¨?%ÓN³¬Þyº”f5ö­²Ý¶ÿ¶ ]çZ¿9íÅ°ØAwG`üZbItfhmŒYe®»µZ ¯w†ÛZ]«¶Wÿ¤|'oxåÒ˜Ö{ÉÝFÍ‚ê¸]Ú¨”ß:CT¢%š+KgÚl.ß6û¨O¨ºZÁB>Ã:ûëv‘UÛÈ⸆ìœ+ÔÏ•ìý1¯p~þª¦U çOA± ùÂÇ´vUHSDÔE­¹©.íÒsãgO\>½ÿè@² §^gP£™núÜ­]vÔýšSŠÑo¦>r¨ wú¨ +„F¯´Öž¾¾íðO™¡7²ÕÞZ»z¿p¼ÈØ·ý™–­FͶêG…~3‹µçʾ­+þ‡f•ß'ƒK )¬`t€î”â¸'2®Ÿ?µÊWèÿÜ0àáÊ?=ôÈ1ßp]2¨ÿÔ>Në‚zº²nx +»žëYó÷ë–~éWÂøõçã;Ä+ ا:µWá•ø扵l½Ó‚!=7ÿ,dy6sfRû½SƇ¶÷/ïNèé²îêxéÚƒçÖŸõÄ +~;]ø¡µ°Œ¤( 8–éùƒš˜àdÏ5IåYóCi:ý}Ñü{]Fù¬ï"šòŒ eÏ—¨¾‹ñ%»µ¦-ÃÔ'†<^S·ŽâAg8ã¤åeîH|‘º‰‘äÞÁý"&o¶5û¦Ž)­ÌŒÖ2z[­! <çR”ŸÛšO­|¼ó*¦çrénAÔ÷®]ëøɻ˿j¨k·ÛÝbèF]§ï ä ˜˜UíÐÿ€­Þctv¢:<º>õD»{£½ÞÌHнƒÑo| ‹q¢N™ƒÒ=-ôÞª}vÔ?ËŽ¼¶:ít.umNÜÈ7›e§0ÿÃòÿÿDXˆ˜Tˆ§Rþ psŽ endstream endobj -5447 0 obj << +5831 0 obj << /Type /Font /Subtype /Type1 -/Encoding 6697 0 R +/Encoding 7209 0 R /FirstChar 60 /LastChar 62 -/Widths 6698 0 R -/BaseFont /BGBJGH+CMMIB10 -/FontDescriptor 5445 0 R +/Widths 7210 0 R +/BaseFont /OUAGMX+CMMIB10 +/FontDescriptor 5829 0 R >> endobj -5445 0 obj << +5829 0 obj << /Ascent 694 /CapHeight 686 /Descent -194 -/FontName /BGBJGH+CMMIB10 +/FontName /OUAGMX+CMMIB10 /ItalicAngle -14 /StemV 113 /XHeight 444 /FontBBox [-15 -250 1216 750] /Flags 4 /CharSet (/less/greater) -/FontFile 5446 0 R +/FontFile 5830 0 R >> endobj -6698 0 obj +7210 0 obj [894 0 894 ] endobj -6699 0 obj << +7211 0 obj << /Type /Encoding -/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] +/Differences [ 0 /minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/arrowright/arrowup/arrowdown/arrowboth/arrownortheast/arrowsoutheast/similarequal/arrowdblleft/arrowdblright/arrowdblup/arrowdbldown/arrowdblboth/arrownorthwest/arrowsouthwest/proportional/prime/infinity/element/owner/triangle/triangleinv/negationslash/mapsto/universal/existential/logicalnot/emptyset/Rfractur/Ifractur/latticetop/perpendicular/aleph/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/union/intersection/unionmulti/logicaland/logicalor/turnstileleft/turnstileright/floorleft/floorright/ceilingleft/ceilingright/braceleft/braceright/angbracketleft/angbracketright/bar/bardbl/arrowbothv/arrowdblbothv/backslash/wreathproduct/radical/coproduct/nabla/integral/unionsq/intersectionsq/subsetsqequal/supersetsqequal/section/dagger/daggerdbl/paragraph/club/diamond/heart/spade/arrowleft 129/.notdef 160/space/minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus 171/.notdef 173/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/spade 197/.notdef] >> endobj -5170 0 obj << -/Length1 800 -/Length2 1394 +4848 0 obj << +/Length1 826 +/Length2 1389 /Length3 532 -/Length 1980 +/Length 1989 /Filter /FlateDecode >> stream -xÚíR{ß -™‘Ç3ú … |ÉŸ<"ÃBà‚ñ`!úmëVxΚ ÌCÂB¾eÅáÚ |Pç Dä€DÂ<7DÌ þ_Ïâ0ÊûÖÛ¬ÓõNΞŽÎ«f·9K¹A*v—þ):Ó;[ÓþUãÙ‘HàM¥P©4¼¿~mÿf”=ÊÅxŠ_†9€„BHBÀï^1@4 (Žp$î×”‚bbüÀ#‰þ˜0³ÌÕT`*€„0ʇýÅ3ÔJû[ÞW_Ÿ)4[ýõw×­Ã"£Mè,`bÆÀ Péæ€É Æü{£Š„†ÁŽv€A¥R™,³Y”&Ä'‰gïå×ÚÁƒ‡áH˜KxÒq-cƒŽ—Çì¶?ó PÎHf]Àõd×Ò[m5ŠºRdøùMΡF½%žER5¥~¹~ƒˆ/DÑ¡ê]›Z†÷…&ŸhŸî÷ë—FU=ßK]$¿ -–}>0¨\UþøÃCfã£Þæ‚t¯³õÙ#wO¹Ú¹¿^ô”4ï¶wøµÛY±æLO)ß#þ`É÷tGåDhAÂêøž•ôÔ=­vÅËW¬êŪÖLœ‘ÏK›öù¬‘¤Ê­6 s^©s^[ ]8¯¢|õ;—­³@Àf!è—ûEžÓäx G-îrv”Ž½ïÃÍûö .áÃÆ•Õž¤)²ùöÞüW¾ôU¾gºÎQGRÏ`Åå’VÏŸ§Ú~Õ›jS¯ÔñóÐè\ùÜ!ËM¹Ê3Öd›{«ß’­iãŒ,;td©¦ yS‹n@‹"‘ÔÛn&»»<~uIJ@ª^—±o¼§ïÙ£ÀÀ°šE¾Z´›÷Jõ-É  -Ü=K¥¬ëšt¯mÏüÒÆã˜Q GN•‘[rÏÛLËéµ;™Ýhñ¸ØÃU•Ú -ÆÌŒ›‡²jÏ/o¶ÖøâT@x#PïU³0.h]œ8 ý6%åUY¹ˆô)ºRÍŸ–%}°Yºœ ¨cÝÛ—>ߨ”èsÒSúVÁY!l*v`Þ]œö¦G5Ú5z}lZ¥~>ë¶Êï´(¼ê8Y¢3ï¢QæI’Ýö—š{H]å…¥Hã~hm~ÙЖõÁ[Vké7XNwo‘ Ü·¤oÄ,œû²—j¼Œ¶’˜‡Ý/”unNÝÿ<èœæóm“ÓXe¯ë½eÿ^åhe™à¤[뛓T¹¤ù-³8ÛxíVæ -ñŒ ‡ï_ESï5PMSÔ;~;ri£7q*ë8[›Hÿ»%KK£X}´ù-#Ýhèñ<×àaf²ÿ”d7&R¸®’êÚÊ#áüšÔzè½ÀêJŸ?‡™6r¸éHáÈjÿ^éX´=öR¦"}µ“5+ôcâÔXWÇž¼Š÷y]±c·¤Û„jÚ•ªÝyg¼dãE¶uÑuü¥Ë7¯0ÑGÛ¿ä«Þ IwëÇ_ߊFí6W¾‚êXd]éM\ÝùRƒ±1!xÇÒckhÍ䃒גÕ~X°¼¢s:í‹ðtžƒqÒB£+ûQyŒ1úÓû¸r™O§HFu:û5|+!b¼åöɨ2× &AôJaQwoÛÊ6ý•ü €’ïÞ8:@w2T~<¦Ð´·0ÒdíçÓ/Ø~æÅKW8ï`e<éÛ_~Ž©Xõ¬òðŽ¢W땘OoíêÏQÝÃÌ3ˆ/Mt¸7='#¥î]7«½,¦éÚ]íë·JˆO9¶¯¨7ý#’ï$™k/½Øv\.?é ÷Þ'”ßÆüœ­“ÙŒ WØ=Ÿ$ïR¦Ò}}úwô»•I$Owz_´O®Ñ -›ÜóöÇM׶)Pæe®1üÔQÑ}´Š ^˜kW?˜›Nò[«ýäAÑé{ó-ÎPªvÖ“M°½Jýn°Yû—Àû :5îqT6©YŒëx¯7«É™÷ÚÿáÁ±&´|”m\ãÔ‹àÚ€IèaóìëOÊ™É7¾›h`Ö¦ä<¦­s7j‰Â®g²GÓ#['ÙƒA!Ïúä[Ùê›7)o ŽÉœïܾÃýÜtJ«ÓÁr±†øØ#k³²ýTq,IëÜ£éoO÷ µ?¦ÿœû:o fÿ…Np.é]ÒqªÞê¢ÅË= -WüPÖ–Jœ“ Ø`Ù8;Å¿Ã3ìSón×ü…4«¸'Ç«7P}4Ôê´ÌÙ0xS~׶§Rï V­2MBʪŽóÐÕòÕîvŬÝø’Gúþ¯ :¹BwX/ù²Ei­ô»ðêÉBêøþ/ð?!ÀåÃPŒ…@Â`Â?ã6Ðendstream +xÚíRiTSבh#¥* E AQ™Ò2ÉŒa’¸ps’‹&HÀJZ®'f$8 HPAª.†‚àæ-AR5¡EµñÐv=ýùÞ¯·zîùq÷·¿³÷w¾}¬,CìܘœXÊAP;"Žèxø»‡D G `­¬ÈÛ2qX"`B ˆã ‹ŸÕä°8yf&s?¤ö€<¾F`=«r# ÑÈä °`‚,,~GÓ ÔHù_¨ú¸85†wÐÙ³åçú„@gC°ð=…Ãæ&£ ðç0Aò1u'8¯ÎÒÇ¥Ãà ‰ƒAÀŽè€#çŸ + @f „2âæƒs8ˆ0?¢±oN>8(Ì-"ØöÃdç²tAC…\ üMŸ‹‰Ç—xˆ"h\&jˆšïÃß®ºy! Bâ{G'€ÎãÑ…XÍÒDŽÀ>"!LP€d<á š#€ÆÀâð°³s%ì|,Îa…ÎæÞä÷ðü ÿÂ5×ÀÇÒ‰|˜ÎŸƒ?½¼»;G°ÏΞ ØQ4ZH${ÀÙÞQôŸÄ0JJ½=G@v²ŸCÉ<ˆ s¯Nc쇘i†‚½?Àal'»ø]Uš—¬ç¬®¶{\}ÞŽÚ澫K2îÒ†OÝòM²‘ÿL{}®ÐX_¡«X³÷­)?ûJjP'õù7IyÇûÕŠ=»…)—Li“…þÂQîÚé ¥Áå‹w¦TŽÚ½òÛU‡#*ÛKÆo(OZ{†þ¶hÈB«%jO]K‘؉L£Âa™ßþ¼ždlx<©*Ë!óá^ÃÃù vg¤%d.n°œà\I6z-[\.UGO¤½1Pú1C2Ô’ïJˆw=Ó)^¹+rQ#~ÅímýïÆ*ïmž¦a,îù4jgžê\³ÿÅÐò:ÿåÑ0ÏÈÞgÎ ZŽst©õ•ŒÐqáL„cØ‘ÛÞEIŠ4 ¥õ-<Þ,£ú O^ùºª–›Ôž;‹ÅȇúgÔg#Ûj¾Œ:©ZÂx†¾ØïýÈ!î®n®q…­¼fëÃ[õ'²‚â{£Œ ^iu¤^á¿3¢úÂXb±Ý¢ßà·¥Õ£ù«ªôÚ;×g|§¯Wû¶þqî)^ðuêåTãÉ3a÷%J²e±ž9°ÝŸ€Ýûl¦éѸ'£™´0=ýئðÆå¶êÑšÈÑkßf›Ê?M+"£›ìÃKÒǬŸ×5¿˜þ…}¾¥üËÛA;VÖ&ˆï R ÔQb3 +†¥ÞÐa4¼uí[ñ™8Ìú'õ´.ý^†™42b¶tCjÕV@"Zš·SÇš >‘í[q>ú‘þcõË¥6Ř£;…D©Òü8éi“e¡#íÕ .5õ17¼Â—Y-–#äzCÚ«K©«Šü”ÓWíØâ*~ôé[B$pkÉiLÆà—çrnqeë„Ì«z€`£)bÜZzð;÷bÓ¼ëGy%‰r¿îuMZ:yw?à_VUG­j)ÚÄÒ›èTéZ—Á5ãÀ‘XÑ0‹ÛxÆʽÈ7wTh½^ÓäÜ~M:£³P)‘|ã„¿ ëCÏYÕnéqÉ)ýq»ÉŒ¡Š©¢=·]\@jNLÎ÷®bGZ‘ǧèín _Eì··š¿å•rqø“hÅ¿jÓ²UX½.ÊæòμƶK¿6D­H¯ÇÖtÖG¤Äô¨ªÊÌ è[C‚œêLþõþòc7Úb÷'ø2V9 S;Jœ’mÓa¦}–Mì¼Þ6_¬ÝgÞ/U, ä†(õ¡¯½Ñè™L'©Æ¼]¼’¹Æ‚äøÚ.ϨôöäkÚÍU‚¬ÜÝOÌV>Þ;>b 'N67Ãÿ^ÕC¨|µT9†©þ¡.'±R³JU'ģM«GBפá¶ÔT´¤€=u°ÕV·k{z|>FIˆð#·oªÍWY2*ÂÍ&:ëRß)÷9¦ÅðuCÀà–ѶJâý¥’^rŸ¶~ñnÜ€ ,8§°7oÎMðé|cåâ/~xõ«®î˹ԔܕèjíÝ*óÂÖýØløÄèD¹è鯿 -ÄåÛ¨—º§ÙV¯ØüV;[«}ÐÁ­Ö«“/Š]½£ ^WCšœïß,‘˜ MXÉqëê‹Kžõnµ¤K3ú„m6SJ·iy/Ç›8= ¿â_šuhA=ÅÍçt,ÿ ¥ãT¶o­ ­«Ò¤*mðA€òóp©ì,Í°Ç-ç‡X˜.É÷¦JÖÞÀí?=Äž°\jö(åðäW—ûóþl ê.gõc2Çø„Á'–„êD߬‡õhêPîõy“Ï)ño%u»Je–þ Ý»ÊêÄÖ~èó¦—û\„Š8­{Ñû–«ºªsŒÛÇeŸv.pXut·gÐebt¹âpÿç™Eb+ʺ†\Ú÷Š¼< ltêŸr»|M©ÃéZ±“­©Â¹°ÿø¿(À€A:å°é¼Dì¿5Ü*³endstream endobj -5171 0 obj << +4849 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 7211 0 R +/FirstChar 102 +/LastChar 110 +/Widths 7212 0 R +/BaseFont /RQUAYR+CMBSY10 +/FontDescriptor 4847 0 R +>> endobj +4847 0 obj << +/Ascent 750 +/CapHeight 686 +/Descent -194 +/FontName /RQUAYR+CMBSY10 +/ItalicAngle -14 +/StemV 85 +/XHeight 444 +/FontBBox [-27 -940 1332 825] +/Flags 4 +/CharSet (/braceleft/braceright/backslash) +/FontFile 4848 0 R +>> endobj +7212 0 obj +[575 575 0 0 0 0 0 0 575 ] +endobj +7213 0 obj << +/Type /Encoding +/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] +>> endobj +4189 0 obj << +/Length1 1299 +/Length2 6824 +/Length3 532 +/Length 7625 +/Filter /FlateDecode +>> +stream +xÚí—eTÛë¶î¡h ŠS,h‹ww‡â)‚“àÅÝ­Å­P¼w—â^ܽÅJq¹YkŸ½Ú»ÏÇ{?q’/ùÍ9ßg>™ïügŒÐQ©i°ˆ›ÁL!20¨3 ;+»PRYÈÎʆAG'é1q¶‚A¥Lœ!@v~~v ¸‹ƒ ÈÎ#ÀÉ/ÀÍA”„Ù»;ZYX:_I2üUÄ ·ƒ8ZM @egKˆ\lb Ô€­ Îî¬@q[[ ú_'œ€ê'ˆ£+ÄŒƒhfvšB,¬  ¿üÈCÍa@Þ…Í\ìÿr…8:ÁM_ÁM2áÍ`P[w Ä¤ƒ÷‚Àüÿ0õŸâ2.¶¶*&vÉÃgôß²&vV¶îÿ•‡ÙÙ»8CÊ03ˆ#ô?Ku ÿ²¦ 1³r±ûϬ¼³‰­Xja ²ý+då$cå1S³r[ÍMl Ç!P³ÿ4Ûß@²º*J +ÒLßæß)5+¨³¦»ý?¢ÕþÍì¿>G+7 >+;¼þþ÷'Ãÿh% Ã̬ ðuàæš8:š¸cÀ÷NÜ@Ov Ô ℸÁý‚X¡0gø |$Þ@s˜#Æ_—ÉÅÙ›8B ¶sç¿RÿŠ²ÿWô_—÷O˜†_ÌìŸ7$þ›ø€ ©ßÄIÿC¼ðN2¿‰’ÿMpa¥ßÄ )ÿ&¸Šê?ÄWQûMpß?§ó›à^t\Eï‚ï!Èä7Á+M¼ü±Ã§‚ü@ù7`ñrA– |8V ¼«ÍokûÂûÚýFvø…þp°?nÃþ„÷uüá}þ@øtÿ@¸ —?nÃõ„Ûx÷9à}ÝÿÆÿ¾á07ON~ 7Û_³àòr³yÿß…ZP+ˆ¼›—Ÿãï(Øž\Îÿ¤ÀŸž³¹üYƒ@Ü `ŒùX0È:¹.ä‹tîX +#¢„Eý•ê¯“­€À¹XDÛ‚AEÆ•*Ý›â4¼g[([”ïîH"Z¼^Èû;|H™~Ør5ÞJóh$Õ=KSvß´§¾ ÜÇn®›:?àFTXú’ —דqÒ»Ÿ­öJJsm‰ +¡Cßµ¦#=ˆ‡WW&ÍV+4¸Šž“J'ÅáKWèò;œ„8äåÑ@ëPô¦ÅSX‹ îM.zVüƒÁ%ÁûçàJNõïŒøêÛ¢…y¡8Ø•Ýýåbé@ Gàʺú |`&^Hy†Ç é·ã'DߤÔ]™©îéx W +6Þr2½µÌS˜Ëg;‰Ë…•Ö¹ê6ÝOn’ßOâ7¾0Ö"˜e8vÓ¡Ü« s eðèãEj±›T?¡Žˆ"¤$b¡{=Bf1 ¥Z™æ@B†•_WâÆZÄ‘Ï1ë™]/¯®MXZº´¢½í'fÿ"~ö¬gä2ÆSV­Ovä‚ÏÒë‰8õÞ¬íÇ_‡ðz$¡N³kéF>}@!ŸVàhÑ*´\?O“´¿â`:KïüL3$Fp§ðcÇiùË(Vô-ä¤øð>ͬYTÙ‰‚•,(œúý¹8! †}ÿ€’ëÆjRƒºi»OŸ†_—Êðv8`Åï,?÷Tñ” Šo¤(`ƒ-ŠÌòUÊßV½@(aLýH%eøƒÈ—j®®¨šÏª?ÀD¤ ö@[ÖF›‹˜bèDðaQçÄ}ï› §*ŒOq5þ¬U9f”Š7R³°vñr(.`Ý:Ÿh]NòC<ív>RäÏfyQÁ0²Î·™ïq‡¾³§–f0‹èð¾´'ÍET·5ï2ñLÄŸ9¥| Oîp#ì×'½OO !åä'&(Å?ÚåN`<˜BP±9æý`~ïÌèf«¸·t6F¹Ú¶Æõ˜œÙ‹FàdÚÚx†À@}¥2íò¬êH$?å‹ ƒÊRœ\ +bü¿¢ï¯æf|³β悮¾¦½qÄ#i|¾˜•«‡ê$ÙåÙekTM£ñ’…:}Wð¼=͇"ˆ¹^ê}z'ÃMÒ`È–°G‚nN–fEKW­×sÙ鳄üìütÁîqŠ–†UŒ—ìè#5™X4Íñ,ß6C½ö°Rò9—¨‰s÷É»°ƒ€½íOõ¼H"["™ô4O§™-ÃwÖcC «ü^@ÇÐ9 Y‚\\j6¡4Æ 9Ö&ÒBÕVùy=`FÀI6ÄÍèÎèÒÛ½£,æ£cØÂœºÎ†§ÊŠY˜B4çéá¥`ÓIÌ}#ç’ÃÝ+Áv³õ“É£ *-ç4z7Ê0?F§Û¯\ÿ7æF¶¶Ãï#î˜Ö²î +‘[e³¦zP‰´£‚p¯QΓª‚¾Ú±&~ŠEA\@ƒ57·^o +Á4ôêShUÈ:ÖIF:ű²GoxvgcP,Tè ®?Ѽylʧ´ÈìYüƒ(èvh5] 8Á$žqpQ­m»Ã¤Erí7Øü#‘««=Lz᳇ý¯ß{0fõ¡Ý'ŒÍ¨W«¤‚ƒ”ë³âðö}™lo鲋o0²÷hÛ…Å穳d—•Íîoýh¿¸drfì] +s”›ùŒƒ†¯‚¢Cn#Ÿ+ðc(\¤ÙÄÉ™éÓîo]µCüÜØÍwÓ³Ü1åŸÓ~¬ÃˆÃ.¹áoÞÜ>“ÅèƒJJî+ åÝ|`Vy +ÑÀŽ½ETµÕ5ZN>²PÄ£àÞ I +Ø6†î#ATî W>˲Þé­'AÈùZ„BDÚ‰ß6Ìo1’åãþÛEßh>‘¿îVø¢ÛB2-¾Xlx­Ì»sx¨­…`vâVeí/ÛrçÔÆÕ3°ÙL oþŒ+f##ÿ~Úöé\g{x”:À“¸cè#?¦;a°ˆ|¥‹¥IŠ¶bR¨õz×Ä%ãap Ö'ÕŒw s#_nOÈ0b+²°.ƒÁ°jzÚ†z"-‘ÇSšmCÈ(é +Úùu¾{ßB)[à°Íœ–ý),”4«êòÉ[Ó»ésDÜc^˜üTíÌÀŽèƒÞùIû× ×üËÙ0qÍ™å¯÷H‹ä¬]ÙRÞL ¥Úƒ«iI/ç´ëŽS"“‹&`"´2ªk"Wésá9NN +±Îù˜7ýâÿz†úç©šå…±ñ6 IÁ©G¨f¯ÈÕ®¸¥ÝIRÿ5²?ÿa+ ^|Œ·ÞÑac._…3šµÖv~£`-c"¦5ôƒcOfØñò¸ a5 ÁS!ÇÕ;ñÝLŒþ.eñÁLò«ÊPÒ‡”èAïßãèúÞ¸ИÞÚµõì΄æ§a3X´Í%QÞYõšòO=ü¨M`È"ÏåjBòijЧzÝå~J½ Ï‹Êq®Ú¤& Ö03K<……ñj½5õ"ê¾æy”V ÝžÃä¼Óã­¢. æÌ +V®ÝÞOH¨cJ×{Ý™Nq¹Öê¼.rÛ€¢WnĦ>Y™Çd!9ß HphÇ0-¼ö0©~çÐêL˜.å'6¤U/‰ÝAT¼0F°P\8BÀØúMTòÎ1ûvßS¼àÌSx>ÜšçídeüÿæÑ@¦µ­A>ðƒý@}íÚ%E4¤Àz#êKwtL»DÇó3rm–ùÞyÃÚqÑEúÑ:®iéE"u$u(Ê!›8€X¹;9k,üÂ6•XÈ]YX »ì§×¦XQû:@¢êQ$ŸÈ\É)=9gq¾· àTíÄQä%ßePß÷Ð çb…º÷B“‹Yè‚õb4†‚œrÞª%ÄÔ$MÌŒº¼¾öW6K1”OÕY,$zø ­Ç&$‘aL&ä¿ØµhŠ³H:Y–”"ê°Q?à[êä¨1ú¡ú.("'§SÊx±?0Ä!ó®ý<ZÂÑ÷àÒÍ ¥ð(…S]£Þ—™h¼ýŠlrhrqÿœ³YúË °â]RwÍUo…œÿQD³±¿óÍUµXܤt¯øÏz…{Ñá‰Ô(¨Å\?êe+a^ÒoÑYÍWSl¥OíîD4ÒeÇÑ«<½ßjÍ?üÀãëè›a™§týštF»Â™}ºcâ÷ª]^rשòëò°0¹ÂVˆêê¹­ŧzt {Ÿ8iÙP{•Ø7ŠÏ‰)\1µ”f]^l„¬f!¨·{w,ŠÇÕ]6»¾+QëÓ=~ë‘Õ5Ì´^8«ë ýÔž"RÑ—xO. ãߺëjR76¯y¯ÜŒ«~ûñc>œ¢#c.ቸ點RÒF8úÅUö5¶êùåN°.Ϧ_´ÛçØê;¼23I@ö+¡Ý×îv9ºÍ²šwúˆÚ“Qºê€×Ýй:£3Žý‚ Ð.‡¿”6UPleî`ÈuEa~¯+ä,5è¼zè¶ôQ¬7> +ï±"ÏWŒ«!Ö¹ÚwáÕQ$ÒTѤ—}øˆG*0ùI·…Z±)꺤0ðC™}y`FÕî4ÖŸ0j(%.€9îå3j}ãñF¡®x#nôQýA‰*#¾k)ã¾_ç_”*Ôw¢eñÜüµ :³ïýd¹x—l,’8©ÅÇ>Óù +#ðm¿xcHØruþΠխ݆€ 3 :µþÅd– nÛ_“ÄJ AwHKÅ¥Á-uåEáSìó¶Ï·Xvº='úŒl s¯^tW*™KònH=\(º2%c‘ uŠ»zk^ÄksZ%¡VoFš¹ˆ‘g½;ˆëp÷$Gþ5rv¬?¦áòQVå@íàÓÛ’©ÑÞ7 ™ñ˜kká¤öFø¸Ÿíy¿‡ý­7¸xL}‹iUâáWÉópbd —sb]M5sþÔ5ĸնë¢âÁû¥½¿T»¿æóÓ“?mÜy…­¤ÒPÉzÀ~1š‚/Ä)½©¸bòêÞ¯?!L§w~tsˆ&|»E&UÐeî»ï)Bn_ÇF¼ãù„sÀ(¬®ÄOq¸ºùe²zÕ÷2zd¬ñi(›ø·‡ÍI—Ÿ.¾Øa·"˜çýÿ&Šçq +B‡ôå-Î·Ú G‰œæ^ù©A™ûùH–x®d-™ÕºÇá÷Æ¡Úôd;àœŒÛÓL美;D@¤$wsiªú¯ ÷øù¬!’UL6Z†Œ`üܧþá[ѶÍÙsèv~KÇ#.Ý/º™}:‚s©é{°Àé0©Ûl‹.J‘¦µLXäròãÙV7»añãæª]Ýåpø`Ö³ðmz}ˆSŸ*>×c YËIt†)®MÂ¥:¾è!Ôa²àáɸ9âNŒ²ŒV”Îc;=#ã”ÇŽ‘øh?*á®7ÖdÁÎhú$èÁÁP½œõå9§xõ¦D_í3­¬·>ù®øLH3N‹Ê½r=4מèrµ>ÊGnÜŒ)V‚R[לÓä2_N¨­"«zÆ (¸WlÝ®«ë]ÿë[w°‚㌦ãônŽ”ðÀÖB¾ÒuÂÎOÔ<P»ƒSÄŸ:…y~Á´ä=µ.Ð!ÉÛc°0Ƀ°‡‘èAA^Éq6–¤Ö"ø–ÁølþV¾)!ÖÞ·yoÜÆQª!üÒ5•}£yLÈÂgü4”s§eÆßU)ÔtdÈfžÆ¸êZ ŽçWãqƒ‰çï È°©“¡­„6ËA÷dJÃÄw-×ÙÇ êX ýgS7øÌhV9}¤»ÅÚ–œTKkÛeñUâqÛËÝ™eݳ¾±R® ¡Œµd|ƒ<Ü\s{Ó6”Hçmã.mÞbs†B÷»dÄæ;ÈŒO9eío‰X„ï ×ݯ¥ú¤M+BOKuÜø4é)Û0ñF!›)_FD,'y[øÙÑOôü:_•6dv'ûº–80Ë®ö˙ͫ¨žz”Å'ìå0°¼V}¶Ÿ~ì-—þ 6œÖÏ'*¼´Ðl³§fú]@é¡:È'ÜäP\7Å÷ªÕ)]­ý2T6›¦Ò€|1ʘñhßýƒy£ÔðºUÆ)„äÉô¡wåݧ‰ø/œsœo›‹³]¼‰X§9|ÑÏïqÕYpfÎâ× iræí/ sÉ3m/XøÃ65bˆéÆ?™&'óâ5ï3PèI%WwÂjmz†Ø$šÛ\Ü"I‰îtß<ù¨¤vm–hØhÌŸîÖ ø‡£}=ÂuöÈ0¾–~ag¨úÅÿ²I¨úê–у- ¹dŽÝaµWûI +7‰¼--Eƨ«ã…S­‘j±þ§n»œnÄ_Œ 'äøJH?£…­’#V½%¹ðå¹lñ"ìŸÒžç}ÖÇ©ú)ÑÈ1p®†¾N.«~½äïEÇJ/n½rŒ¬iÔÝ’a‰Âpì4Ñp°Î{œÿ¤ šÉ-2ÒõÒÀ ÿQPB·RñQ`ò–½,äkÿeå™Í%þQâ¹ÝĽÏz~èsº’.´õo8m­qs)… +U HÙȳÒWŒE¾kUvZT~盾Î&½Õ Üñû443`¯Þľí~9xMXêSuÓc•Ûð–À!‘\:Ë´îÅ’Ô!±ØB–ŽlP‹¡ §ý᣻O¬©Lœ_¤?š¼ÝZ¸¶Q0 ‡tDÅ3qÝ›3kÂs"³Î'Ù”Ž˜¼¤¦Jêg˜ÐÔ{Æ +?%ÒûsSÔ÷fí'lZç2¾×`þl%Sß—þ(;{­þ¯+e7šŽSâªjzTv-r±^áÚ“ÆÚƒ£.>DŽu˘UlÝÞà«&}ëÔˆ¿¼šäLK Ê죹?ñ]£„©i`ÙÐðàäîÏÚ‹B%²Obhåć¸Æl0c™Ã\sð$íŽÖ;|?ñ™~i£m\,ð Úß[qVï)˜ž¾ÒQ]jkS¡…‰‹¦Œü%'¬QåâìGH8ûÙ$W*îÓ$ãhXçà(¦ƒÁqzø³ƒ­äAL‰ê¡DÙó¢·R#˜EКy@>ÕõÒD@1ÜøÌj*5úýcð °b;dº~|ø ¾ÜS>TÚ¼ðPqCï=«JƒVõÞÎ'äÎdÉù±ëGhs¬®·`cºžÅ¢EK¾0(’MLèPVmvgy†F^dfP¹ÍásZi|NËÅÆÏÙ|“éËÞ(Í¡jºØY•O´˜tKuëNª0™‚Ë=,ZŠZˆÛŸù¸“ð˜í­ƒâºdµg*Ž’)»æÑ  Ñ_çŧ'[d‹kŠFô¿VGÊ\Q£š®|5;ñ_¶Äן½áXgñmxõFdˆ¢•jRªZ°Z£>~?V‹Ÿ*mtÀ _=G‹  #¾-LÑ}†^)Ûý†q*nÛïrµ!>Or2ö,ÖNJí—¶B³gŒ¿"4"9}ÐöY lŽçSPõú5ŒÚï*Ë݃oD°>øùú¹AZ$OHÏùRùEbÃ~Á^$¸¹[oF‘½[æ½v§ ;Ðî"¾²VV¨é±F”*SöF•ê ¨Ó ¯Ô³-?6J„œÑu£¿Ža«â¼(:IGäÀs}øÐ`‘„×1ºüØÜY•OçÚ\uv¾ 6†½Y„ôqÙU»‰×àsâ'Þâ ©fßï[Ìàó’ǼÒ.DæäÝã£QGÚá úsÞÖ1Äfý´¹Ë£××}ºMdÓ&3¼\ž†åEõVoDRÞ"¯Ì™s´rmœ`›å)éÈ.Pö‡“;ü@¼x1}&5•´€|Ú%ð\ŸÛHÛ*Y¢ƃKms†FP{ÿá[[mŽz!,|C¯Ûï¡È§Ãô$»’°u´\È'5»Òˆè©Cæ¦Â"Õò¤>?‘Tk˜ïèç…ǬÜ'ÈêdRÇU­êgÜíÄoÊǾt+R‡ž ËüHy,p¡_œ·c²´©d©6 +g”Å!wpq©%ŠÜÒUØ.V"”¯¹ðÚxÂd“ÌN•¢A[¡çhÞ +Ž|ê’Ó(Îýùˆ­`ã%ÝïQ%D\‡ú*å\þ³;Ðñ ünT"ûYÅåˆDi«~l¬ÊÃœÐÖgy ·Ië e ÄJÑÍÒî™ÞÜx;ݾ5yª«ÉÕ CwÈ‹ƒÿÕr£ Ž4¹Ga^1’Xì½^è}¬‘¤©²ôýáX(‡-w5&ú WOŠöpæÄL¢f`òŠ¡‚xÉ·iM ¯ ŠÊ×yu§öƒËüz¤kì|Qi×ÌbÃÅeó³?LòÖGã䈴@y!Þ¾Nì“(¢x?Š(:y0ûmÚP=¨|hˆÛgï£<»j,o^ç lÓ“‚ÏŒÒ/Ô_ Óùž-ÕâÖ£õQˆ "¬'Xåa鑸g}‡~AM7¥]$.•O£˜Ô˜gɲ¯^©¸ÈË,S’1ðŒ0žc2võQ¿Í®º¶²RdÂÏjä?0v:xJ©¡˜" $mT¯c~ÈQÆÔÆRÏ*ÌLºkq/•æ¥ÿ”M íù>¸›œýŽ73ë;«0ÅMmøÖI >>Ê·¦hs¬vr)ªè!Iís¦Q&Ò}Ro“Y÷+rùÖ†šO<¿ú¼cåMº¶{ 1¡)$&®—"7Ý[+7]œÀú¯ájÕ9nK}ûE…-âzÕß7):ß~_OŽé-‘2è\ROÍ[ç‹Ê¼Ä´˜×˜+‡UWÆ•#vÙ¦¯î>]­{ð“»%른&9ªJ(J?õNŒxnDzËfoG¨„§„)VT¸B!¯ž'Áj„+Ý-À¯õ’_ÄØ\D8Ïû!àpÛ^†Ê´åaOå0ÉñÌb¦ª¹e„{¾Tt>œBe7¯æÇyŽi6cP£%X¨“üÍÆÃ%¶ðœÖ=­‰áCöÏýoeùoÏ\ªƒ“ÊÍ+y`·u¬…^Î*>%ÊWÆãˆHÅ÷IBÈ(ýœ¡³G(Ü/ËPž”|ÇW:W)×Á';~â•ôqlØJ.é®ì$‰ß¹Ð†3±æg4¿Ó??¨Û\ïæ¹oa¨bȺ%y,0Ó“ôzîÄêh‹>2”žuŒ_‹¤Îc/zÔšãFO­m™ÖKÜ ðt—„”> endobj -5169 0 obj << +4188 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /GJKXIK+CMR9 +/FontName /GXNLJE+CMR9 /ItalicAngle 0 /StemV 74 /XHeight 431 /FontBBox [-39 -250 1036 750] /Flags 4 -/CharSet (/parenleft/parenright/a) -/FontFile 5170 0 R +/CharSet (/parenleft/parenright/period/A/D/E/F/I/L/M/O/P/S/W/X/Y/a/b/c/e/f/g/h/i/k/l/m/n/o/p/r/s/t/u/v/w/y) +/FontFile 4189 0 R >> endobj -6700 0 obj -[400 400 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 514 ] +7214 0 obj +[400 400 0 0 0 0 286 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 771 0 0 785 699 671 0 0 371 0 0 642 942 0 799 699 0 0 571 0 0 0 1056 771 771 0 0 0 0 0 0 0 514 571 457 0 457 314 514 571 286 0 542 286 857 571 514 571 0 402 405 400 571 542 742 0 542 ] endobj -6701 0 obj << -/Type /Encoding -/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/exclam/quotedbl/numbersign/sterling/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/dieresis/visiblespace 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/dieresis 197/.notdef] ->> endobj -5127 0 obj << -/Length1 966 -/Length2 3059 +4186 0 obj << +/Length1 773 +/Length2 1212 /Length3 532 -/Length 3719 -/Filter /FlateDecode ->> -stream -xÚí“w<•ÿßÇí™ÉH]2"9Ã̈ì=2Cë8çàâ Î9ä ŒPÙ{Ï"¢"„¤“)’ŒdDTdïõ;ÕýýÕÝïÏûþë~Ü×õÏõ|^ï÷çu½ßŸ„¨¥µ¬ -ïŒÖÇãH²p\Ð13²±Ã8Æ&!¡C@#H §‹ ¡U¸Š -Ðòvà'¸²ªÂIUEªÐÁ{’  « Ò‘þ!R´°hˆDà3É ¥Ö@"0€5 ¢Id …ÁV?2ˆ€šˆ&ø Q68@HàŒvqlЖŒp.x@ùWåíùÏ’š@¤š¤¨&¥ªE‡!(´ ÔOÝ Muò¿aêïâúÞŒ9û£ü¯6ý‡1äÿ’౞Þ$40ãÐÜßR{ô/wfhèý{Õˆ„À€H-œ+ È 0…_q¨ú¢Q– éÞèŸa4õ·j÷~Ú€[ØXZÙËü3ן«–G²!{¢ØoùO†ÿfj— /àƒÀ`pªúþóuþ¯ÝôpH< -ĹrŠJ‚@@Ù¨'ˆJŠ€?q(´/€ö¥:†Bpx5 væ -à‚'°ý«‚õ¤ÎúÿR D ‚èöïu€PÄo: @“ -Eþ›à0EýpŠþå¨ËHÍÅþFj‹ ¸?š‹ÿ©¹ž "ÕåHýÒOüÏahkã}ý©Õdåäå%%@IEéÊ—Ùâ@/o´‘. ƒÁ”•U~F‘ÞGúy¨cþ‡]@êÁ@£}ÑH¶>ªñô¿¶A^äãvK¹’fMÊ (ÅQÁj­€VkhX?w+Ÿtnš5óòÛ¹ tmÙ-ÍœØ̈©#žeæÅVF|ï›~+ç ÎÞd¸û¾ogéªGà«Ñ})(±É$¶óÙOLÑvÓ#1›3ø|ü@aÛÁsi+¼»‚ÍÃ=8RU"³ÍhÌ.û¢ü7C„‰c ¬qcOSIœ·K &R¬Ûø28#ÇÕñò2MÊêáW˜Loîñ«^ºÿf·ý.$Y%ùÜù1ÈC–ÄKf¢GPçÍyå9£ª?Ù ÛÕ¼¡à‘aŠ^bEΗÉ<*…•2Ô:t–ëø%}…¬4ûӪ½֩3S2|þ^J‚ô$— fi®£ëòtëâfPNÞ }\ðhÕ(Û’­3›_üRƒQ+›kS %d‘QØ -ÅX«"¬s:o†K~îxã-?bìªC^­D÷ðݳnˆ‹Õ½.÷è kaZ G#CÒøÖsï(0¢ÔÒµ«ÕINØ>m,ý&|ÖãXêeÅzUñyÍRÝÌŠò´#®/=ø…ÛÛÆ Xñ§eC2μ†6­yÔ[9ð²×µ†ë;Ý Ó¶¥›Š÷‹å†*ƒ›]u„ù=õðýû¬,¹#æÛw{ÑØÀ$b¡«¤ŠuãÈËž1l(o]S jç\üœCÒò yÆ·³ mÝŸç+§Ò˜è"FÜ «ŒÈ×ÝÞK„jŽ$–¹ð}Zx0KΩ»ò{—¸j±'<ýñÜ{C[¯’W¦Ô0¶®òh£©±°—Ï’Fnš^°°××›k -ÌKló’±g›wÉVêyÞ¦°€.Fl‡×º¸Þ­ŽÒ¬ôàÁÁÚý—㲜æWè¸ôCŒ¶xAý#:sA0iž{Ün7Œùãî9<­×æ»W¸ÍD)u¸˜¹Š™üÚÔuÌgßÉgɃûUÝ:ÖD?=Ç1&_zQœ“ÃÅgã[JQ¿4ë™Æn\•ôäQ§Ž¼ˆãÐ+ ?7&æe—ÜW"¾Ý¼7’<ßè¹­»±vG1½¶ö62£&¾•¹«½È’ø¨¤ž <¨Ý@–*ZãÌwI3ugtÉa…'rxÖR˜Ûµ\í§¹œÒIB\KË$µ¨®Š%M—:>Æâèp4W…+ÃÁ}7, ÷ÜB×!RË !Ùe}µ•&ZÈ°ŒGRY3/í×u˜çv¥‘12 uת”D‡w+ zÄú"‘ü»OQf¦luØîÍ¦Ø ½Ž£¢q‘öij¾7Ïr·X®Ý -“7¿õ!·€³Ü×H§ëãMã¸xŠ“¼'MÓ:6zðj§ã/rv+&òdöp™}øms÷™Ç‡ø[2Ö¢3dˆFÕ2r}[÷™ôLF—6½7,‹<F-°oÚ‡øäƒV¯rŠÓr¿½#¿ÓfþŽ UíS",9ë}œ´X>Üí}ƒ¢½ IÁЇVu{jj>;†YX¦mè­'ÖzQt ú×_#Ží0)‘ÒŠô$6´[vr&Ø;‡ã< 2‘לLš˜"MD7üU3}ßá¬?'ØÍOí¸¥¸7š¹ŠíRXQ$ŒC5žŠµÍÄžþÄâÛªƒ+ -6¸Õ×) -[ªQöwøtµŸö]AÌ×Ù¤L -ßÁN­ÖˆÍRI|ÖkV±mÅt LŒoÔÈÌ-X;45êÑÓÖþ¾¼]G4wN.`jB܉%ál€±x)1½ùKËÛÇï[ g-?5Ó1Og°ë¶^OTµ¦×]³œD”㉓ù‹z_N±9Û2\Òë!äñ6KÞ‘]ýâÀ%1 :èÑ–¿óéQ¹ûD0M5îLB4ÏÅø72Øõ/ºßt=a¹>þP%uaOåcïó”8‡ÐÝñð'Î*Zã­*Žü>zM›ºe#/P$]ÉOnœ) ¾oô<Ö¼â=vYª¥þKñÄsî¡ò‚ÔÕ\Û‡ãwÖÑ*Ûcׄ¡D$×mo2‘âÙ[6"úhg† ›*7óbêÅGW\uq|. ý”Â=“­îøÞ‚ôÍËyýõ2‹aAÈ•=ìþìá1·ªhîÉ Ðe»›êܦN*áRŠÌ»î1ë ©Ž ªº3¾C¶ØØ[YAÒ:J6vö;x¿]°Š²©4¾ïfK´ -ÉÜc·˜gñ¾ÀÚU’ßrðCçÓD[¹BaåäJ7P»LwóúªÐY¸ ?W2/ÍñˆW giÈÞ\гè¨q$>ß)êŒü’¶_¼<[ŽÃð™8±£~ØòÑc™k,®ß–V3Ú®Ÿ†uÉ°:ÒðZæ‰R†œ¼Æ€)-ô&É¥¬t•8ýl³oˆˆÅƒïÇ_›>Øu¬ ß×d¼(Yxx¾JȆÿÐRNI6ŒÞ9NŒJAßβÔ>Mº /Þ½yErdfÜkgUaý™ÉÝ2íMlî¿5…§÷lDßAz>"¤Àí ó’ -óæ‡"ÏÜ«Kë^Öì 7>’cíÙ+«LÞpOLÑð -xýõ¢r‹1o#×ÜŽw¤ -K>·é˜$+ä-7¿cÎÀâ`ÍHO‘ÃWõW_ÚoÂ7¬7bõ,è»ã'¦É4”¾H¢Ñæ‹x%ôìeÙʤx~d‰ò„¢Ê€ýVVHâwŸ®EéYÕŠ+vM±JM‰é< ¦ÚæU¾×Îs4“kVMFd“kª2XQi®¥Ùþz8ï..¸Ö@Ò{L·nª¬Hfrh¼–À}Lãy\5{ Þvu5~d·ã¯g”¸ì1¥’S¥{Τµîa«H ˃~¬ñ¤·k‰GëA¨œZ'eŸ¨ßQH ú‰VÕGqYîéä•Ïc¢Iâó€1ù›SyG¶!y=Y5|VPÃ-Ÿ%ë=ú°n’#ÞéþKš”шx{äðç +é/ö™ê|ÎM+õQŽh¿8Ø´š]„±õÁ•ïb¶ -á׳û„ñ ÕåO*<i#í†êê·%”¿Èê‘UÌ]U/¨ÿ:×ß/uâz¾:8x·ŒKïh/÷!`Çê–ž™¢y@FOû]ž'+@àÜOª>Öþ([ý­LìR/{²s©”o¸ïØ WfµáˆdýÕ]Ïx‘’ú´2˜*÷Þ1û„®€o¢:Ö…~2|Ó•RºòƒJ#·cð×>L>ˆíJqbæ™A˜$äÛM÷·Ø{ª„Š¹_§±¯¸ašÙÁk“¸¼Á¥ï™¤ÌaðyÑêÛÀ‡! áĵ]öƙﱤ:¥Á½DgôDÒî†V]î *÷™|Ï®¡ýü§× -Æ73,W’ëMuÃßž÷ -¢-ÊË:õÈ.ë“]^|yEùãÚÉ6p`wõ´Õ·£HŠo Ó˜#]µý"œóÞPL?â”øƒÜ[þd¢³y·žÆ¤*FèEñõÉûu mx‡yè!·Š…ïÖŽÒ”yæ¤_)™PÑ~V±ä£.Paƒo¢û‚²úš’ÐŽñ¨ñï÷%G_ÝGßPηÒÒ5ˆ:> +stream +xÚíR{<”é_›9iägí)ÔYÌ`Æ­Û¸mŽ0Ä¢´3ï̼̼ï\ÞaÆ-‹®²å¶ÄøH.…nk[JŠ’´‰¬[«-b[ìŠÌûÒéìgíŸçüµŸ}Þžïï÷}¾Ï÷ý>?ãô=4¹£fA¶$;/?* [’ˆÆÆ."ˆÁ(âÊÀ G@vp š„¬I€Lu´qp$Y *‰`¦.f‹$;@ãC"˜É@€ãB|\ƒÉà=(†0™% ñxÀoñ„øAbH ±,‰d2`ÁL „A!Z-úñ@Ø(°{[fIïZ‘HŒ›¦¸I3€[d¡OX›håâwA¸“ÿ‡©åâîÏ›Á_”Ç3úC—Á‡y²ÿôQ¾@‚A"à…² ²œ½µæ±` y×cð`& áð @z[‚Åî°bÑaŒÉlO -Õ!„µÜÛ’«]»ÝÝÌ—^s©EgÀæ/üWt‘»„É¿a<,ûH–$'âß»ÝþeW¹!L”#ø8P¨€!1dD|.pD1d#,H + )î×ÊA1üÀ#‰lTD\|L[`…"Ðbq SHÀ +‹B—ðÿÉÙ•ÆXàƒgaÉd`G!Åýž€ÀB äáŠk‘HvöKU¦D$‚liˆð¼Þa6Œ§ ARˆIìéF™NÉáÙU‡ËâÝŠÚÊ [Tœ9Õ§¼¿ªï¸©žô]š +¯ô§pKoe²"WçïC„¡ Qszâãµ±¾-î㟠OåtÍE†åF_× ú9×KöƒÀp&iLóFUçÔŸöÞæ²ÌàâÆü‰{c…tSWÿá•Ï6¾w{_äÕÛyÉT» ÷\^À‘C•&6ý´r„eGm(¢´2ÓU’âè]3:‰ÖJ´•Ejg2æC¦^´ïܧ+ï¢îGZ»s»ù<.#åÄ.sÛ 'Š>Ï»^3§¼(·ÚÑfSer*éÜ&Ï`PÝ®¥w=è_{5?Þ2ñYç¡æ¸u ³œ7=Šo}RW}¿)ÖðŒ¾-]Úžº½ùµjËyº±Rƒð°q¼þîëøæ—:Š¾“¶ÏU§„÷–.6⑼ZápÝÑ‚° ÙŽñ½ß(ìÒ'¬£©»i»\fÊÉ®:m†—¬íÅêÎÄøüÕ¯Ú|èÿðmù±Ÿ8Óï3â£ýË\q\OËÖèÑÔ|UâŒtôW½ÔÚMþ~ïs‹•[™ö5¼ÉÝÛk~¥˜!ƒßu{„Eõ,„FγîŸo œÃ>ÞÆ4Ü¡¤5_ +•oËŽÈ軺2÷Y¬÷„xŬ½š¢lÚwZïáLV!×µùrò¹5üµ­ãAFþwñ°»gçŽÒ׶•d—L'TýíùxæÅ×ui%«ÂøUÞß°©eIÙí[° ËjÛp¹ç§/ö4oM(gzΙ–gœx>I½û-Å÷á¼ùæä[)¯ÜÞ+»Ü™'3Š‘B&ÐkI/´R® $ûˇŽŽœ)ÿò ˜¯E}AO^uóŒÒѬhøh—XHoem|³ßYÓçà×WžÖ¬í¶ç òÉà bãñ¯Ïx«™Kú‰ä&}MåéêìVÿ¼7£Ô6¥"ât»ÍØÔb¢gýÙ§m'¾WsP-íáv]rú6¸M¯oÊBw^}ɇ÷"\²ABÂÇ)wøßk®PZ…!Úÿ¬|,‹4Hψڣ×u’¼ýææA§ñüFzS⺔Z§‚¾cùñåê™NÙ—GWŒ}úø\§aE®fzñÕ€6ÊÙäG¯W³¿GAÏÔ˜é>¡Î_zÝé}¾J^ù¯ÏƤ3 í‘é)E&›Js[¯EE»kçTªtx~qüþlnçÀq´&ËŠo¶÷üêú¼Õo"Fv +œVÆ÷8œû„t§©%¯4é¥[œ­¡\`~à|°£ïÈ ÝÓ:‡àíku7L^¼=¯Þv\niH '´Fì0§~Tu\7qýúJű,C9 ¾úÜÄīȪC#ñ˜ ¿€0|pƒ~G]{g÷ýª7ßdÅ<½ÕèÔ¤þÅTKÔ°íO«§wç¦1Bª\КCCé6©®£rû4ìd%ôFB=Ÿ- ëÔ·0JÞNÜ"ž±ðô;<Øs8«ÒÅUÜìt¯Ãû Žf3 ©Ý£ÿ昴¾àšÁk0³âdEYi°(¿â_)d{h€ê]”ÏÎ ÷­ÊöRjÆ™¦¿ +´IP,¬ŸmxR€Ý¼u£¯D¸wÀš5Ë©•ÒZƒ~øi3+ XÚ£:=Ò;ý’}Wš|²aoÎæ £±#!‡Mn‡-˜qá^Òÿ¸ˆ ü)˜<ˆ!ÂP>CAü¤¤Ð;endstream endobj -5128 0 obj << +4187 0 obj << /Type /Font /Subtype /Type1 -/Encoding 6701 0 R -/FirstChar 46 -/LastChar 116 -/Widths 6702 0 R -/BaseFont /JOTPRW+CMITT10 -/FontDescriptor 5126 0 R +/Encoding 7213 0 R +/FirstChar 49 +/LastChar 50 +/Widths 7215 0 R +/BaseFont /HLWFFU+CMR6 +/FontDescriptor 4185 0 R >> endobj -5126 0 obj << -/Ascent 611 -/CapHeight 611 -/Descent -222 -/FontName /JOTPRW+CMITT10 -/ItalicAngle -14 -/StemV 69 +4185 0 obj << +/Ascent 694 +/CapHeight 683 +/Descent -194 +/FontName /HLWFFU+CMR6 +/ItalicAngle 0 +/StemV 83 /XHeight 431 -/FontBBox [11 -233 669 696] +/FontBBox [-20 -250 1193 750] /Flags 4 -/CharSet (/period/slash/a/b/c/d/e/f/m/n/o/p/s/t) -/FontFile 5127 0 R +/CharSet (/one/two) +/FontFile 4186 0 R >> endobj -6702 0 obj -[525 525 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 525 525 525 525 525 525 0 0 0 0 0 0 525 525 525 525 0 0 525 525 ] +7215 0 obj +[611 611 ] endobj -6703 0 obj << -/Type /Encoding -/Differences [ 0 /minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/arrowright/arrowup/arrowdown/arrowboth/arrownortheast/arrowsoutheast/similarequal/arrowdblleft/arrowdblright/arrowdblup/arrowdbldown/arrowdblboth/arrownorthwest/arrowsouthwest/proportional/prime/infinity/element/owner/triangle/triangleinv/negationslash/mapsto/universal/existential/logicalnot/emptyset/Rfractur/Ifractur/latticetop/perpendicular/aleph/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/union/intersection/unionmulti/logicaland/logicalor/turnstileleft/turnstileright/floorleft/floorright/ceilingleft/ceilingright/braceleft/braceright/angbracketleft/angbracketright/bar/bardbl/arrowbothv/arrowdblbothv/backslash/wreathproduct/radical/coproduct/nabla/integral/unionsq/intersectionsq/subsetsqequal/supersetsqequal/section/dagger/daggerdbl/paragraph/club/diamond/heart/spade/arrowleft 129/.notdef 160/space/minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus 171/.notdef 173/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/spade 197/.notdef] ->> endobj -4585 0 obj << -/Length1 779 -/Length2 1014 +4183 0 obj << +/Length1 773 +/Length2 1206 /Length3 532 -/Length 1585 +/Length 1774 /Filter /FlateDecode >> stream -xÚí’{XLiÇki0¡yÊ%²ö CJÍ¥Ë4ºÈSS)¥ÒmMsÞ™N9§Îœ˜Q ‰)%—\JXPrkØ´êqÙ.„Ìn¨µ5VYT–iOÙÏòçî_ûì9ç÷÷û}ßßïs¾ï˶ ²uCˆèEà”-ÏŽç<ü܃–ó¸€gÇå2ÙlŠ)”À=Åt<¡|’0À·|ž ýñœ™làA$¨HTK+Ù"p“C•ˆqà'¦b¡œî!c ˆ RÙ7 Kv(ÀR¨€äJˆØ1y<€  -Ä@Š39LÞ¸”‚i$)a¨´’ - -X PÎ4#Bà˜ - PÊäøô0H£üTŸ7÷JÂ0±| ýG£¾ˆå(¦úKBÈ’(H?$þ¹4~¤s'°/æxSb •¸á2 [žƒ×ÞñcUx¡Jˆ ”$HŘæ!Ž|BÛ7ˆÁ õów[j3t²ƒÕ1ŠSÁª¸Ÿäƒ1ïSL»D¢JÁ¥]æÑBúZE}6m.!—¾£“¤XŤï9‚d@q*TÒÈ;œ è-€v&H ’9p®<š‹#–Ä+0±"v ÆüòoÜÝ e²-_l…ts{{>pæ;¦þ]¸ G“ ·'pär¹'þ`V’D’§¯íÔP,Eiw!TB óÁ=B2W·ûüÆ’5‹Šî7²6t—•gù—U5\6NoÞaˆ­%ZkÏ„½+Ýk6¶Ý¨ý›Uï-›/¥Þòz¹.1+¯Iß¾rEûÞÕ,Â^íõSµ%LëIï4¹x¾ñµÎÑpI½¶®dçòÃÕûºnt °ò þeD‹¥&båYM¾ÚIæµ[–±áÌL{Ë¥¬¼Ä’MW±vf|'}M\ÆÈ -›GÝÄ¥$ÓwE#äè#»×üa¢ÇP}ezf‹&Û•ëZ|+§gRTøˆJŽyÝ‚¦þ‡›çö„1,š}ªX†Go}“ö¦eüÙTÅÛÜežáõæÅ'•¼pŽ,´õê-âÖœ+^ÞÉ`Õl¯¾-L ŸÖ0<¯ªHàCÕ<ï¹êÆO(+=Îdh[šúôÇÿ?µ5<âˆÎQz¿IónuÝ7ÚnvÈFÛÔ7ÿqmùÁMq±õ¦&[.]sôº¤Èk|ª›h–i¹ÐW8¶ÂwÞ5ª~W]áÕ~×…Ó·SE×~/ÝaÁQŽòzýöõÇ#þ}Ëd.éL/ÈÄúÖ/œÀ‰ÃsWuÌ`\iíò”TÙ_»v÷œ¯ÌjØèÛN…·]%)/vZËÓ–·tÍ»§´iUYþ`q(<ò -?dßÚV/ÏV½éùA~Rs`q] ÿ¤²8uã#¡‰>B=EÈêgÕ˜>™?í½ºXƘù¼|–Á…ßö3^™š"š;¨^7d¦ŽÉ -fÅÕÜ,:t2²uì3}ãÅBëFn¨j}jJeN¶,çØ„qÁO«OĹœ*¾±(d{¤”³Âz/¤LÎ÷íìYrÙV®~óðÐiŸc7¡L™þh±Ié¶P¶† -¹<(g[àf× -·lt/°ÈºžKî‹×úÞ™qÅ`XÖý¼‡Š‹º‘ù“5ùs¤£»o錬öc§ºž9À§1©O¤ •Ål÷|Ñö6•ÕÌÔè+ÎÕWsú† ïÌÔšš¬sâœ+j JÙeóîºl+œˆ»ÝDb¢ÃŽF—„½´¹Ç¾*>ñI¶w‰<|ú.mìêÑ+*ç`rV/b=ë´àYÿ»õöå×!…Þaí_=&+>¯àfŸf]°\Ž´`uÝêþØ™óû[Ë}“_Ì|úS¡Ÿû$¿ú]µi•5!/{µç7Î3Þô¶½¼+dÊžÝõ]eïÒygD«ó¶?Ö§ÉgoPƒºx£ CVåÏòiç:"âƒ+;ç°ß›I~¹ÝÿbÏï|F‰¤[‹ÍŸLDÖ<ˆk­pþúE¶Ò¼â]i÷±¹),ŸjFùÛû¯¥×£\DNì¨Y¿N¯ÖÒD«{ÀŠªo“ëvtN]|=ÔúüÝ--S77$k­`ó¸Üø0ÿoðŸh Á ˜¤¹˜Œgþ E^\¼endstream +xÚíRm<”k&DÓŠ£#/'¹Ç‰­0f¼ÌxYi˜Ä)/1%1fžáaæyÆ3/ÞíÉ(/Ç‘ƒQ)¤_+ÇñžŠt’H”ˆÝ +»„ +:8Ù‡¶Ýß:w?íoŸûËsýÿ×}Ý×}ÝC"ÓË”ÎEƒ g›RH[àäæi ($2ÁÐÐ ƒØbEl1d (66@—s2 Pm-ll-qpB…Q";œv®h€.€0˜ÃF€[ p ›¼P ‰£H€ÎçÏ•"à ‰ L +qI +paŽAÁ0B0[ñãŠðP@ûXæJ„ŸZRá¦ÀÜäN€[ä¢? +p!ÁÌÅÏ‚p'ÿ SkÅ%|¾;[°"gô›.[ó£þÑGB‰€Ê…0d-ÕúhÍ âÂÁÚ®«˜Í‡9t$˜òÇ,r†#!.sBÍA«uá®5ǶjÁl¿³'ÓÑÝxõ5W[L6Œˆ½£„ÿ]á®bÊ¿0ž G?2‰L¦àD|}úó_sÔ^„ƒra+*`c;Š€ÏŽ¬@ ÀŠP$î׌„ b| À#‰<#¬<¦¥ 0Ch¥¸Š­ÈÀL®âßÞÉÑŒ1µ SsœH!ÓÈ€fEŽûwâ!—@® \‹L¦Ù|¼G‚a"^"<¯O˜ãéBP$Ä!ÿPÒ‰j# ¢§z^xy²eÒp„zv¦âp·,>4I¥Îxè Ú$ÑX(Q9ŸõáèüDï¿-gû©þÈýþÇ!üö7i.Æ–úi%éõ K UgÍz,j2ò>û³YlêÞº/3ûï>Ó­)Œ'%<í;ÑYa2jШ‡Éª‚ý —‹“rð%Ù”^Åný¢û’“º iý¾c+v—Ç7<ÌÑyp½û+WšDŸž$ømZ¼nû´…¤ðØ''zKíæ!µ¶€ïK(¤ß9_øU‘W¹!–µ<Ó¶^¾Îæ˜g„?aéñPê5- Šº×¶£ŒÒÎýGº|uus6jŽ2³SM~>l¡6 2¡¡t]ý;ª]Öæ½üÏìu“ï¤!VdÁ[Pßc¿½1Ws—kã¯G{Y?õ"öøFšfQ¶È6–œYw­}vvXÞÉNUx¦5®ùyHÏò´ÜÔcïRýšU4œ$è(™óÔ49Ó³û—€ÔzuWz Z£7Û ÕÒ±,ÿ?€’¼¹™™[š9¡bëW3Ž&w% )è¿ÜñƒñtÞþ…*ê«B þF©'f”þ'×ð[pŽ«/¿§’?oñ°TDí¥ÆÂ…ï¶uÔÁJol?z¹Nô6A¦™”UwogØ·Ïžvk0õíܤp4~ÐN.s:[•vÞ;‹Ô>q©´2ŽTœÐôÆÈö{ÆÕøÖÉŒ­ÊÑJç„çÈN‰]f•VåG;õM:Fi7ÓJ!Êæ°À[ûbyæ-¬sHÓù}(YÇèæ•YIU¤aR¶ºÖ<±ºd£¨‡jÉj¯”¶½½ÆŒšWp •/œJ'š»ég/­“«Ì?Ϫ¸ÿ¤¬¹#=¸Õñ¤pOûÄ» :tj0…Qaªu”ùà˜Ó_ªÿQ'¨Òäç »ªÅÃ^²ÊË ƒ÷öYæq>ríÐè9Ò”bÙLCa`@³Ýá®o_È]¸K˘¨éN俽’U›4÷p’¾õ²šB[ôŸ eÉëö£–L®IC¯+Ÿ.š¿ý³½ëf¿BgêùÍÞ¬pòƒˆD‰ª¼—}ìƒRMö%ƒÓ^±ó‘%Çï†;—5 éXz¤z0“uTB8å‚úßËœÎòa©ý­'†T|Ø?†'™4ŒRm×ñŠÎ¼Òí)brøËáØØËE½Öt©†CÿØ#UéP´ÿPéœ!±Ô›×'¾˜-Þ^Üõ®à–APJ¸ÜÕ–qíòëc5 4÷5ÆåZ†:,Ô—†$$RŽ«®ßÓ3÷:.½é”îiãů ÞPd|FØö—&Qæ½ç Û;6…`—~Òû›¡ÊwKíV¢ö!åªL&m LµTR\wöß>©5î&ÿ‡áÿÿ>ÄÆĨ€…þ¼v¯Jendstream endobj -4586 0 obj << +4184 0 obj << /Type /Font /Subtype /Type1 -/Encoding 6703 0 R -/FirstChar 110 -/LastChar 110 -/Widths 6704 0 R -/BaseFont /WWMNAR+CMBSY10 -/FontDescriptor 4584 0 R +/Encoding 7213 0 R +/FirstChar 49 +/LastChar 50 +/Widths 7216 0 R +/BaseFont /KFRPBN+CMR8 +/FontDescriptor 4182 0 R >> endobj -4584 0 obj << -/Ascent 750 -/CapHeight 686 +4182 0 obj << +/Ascent 694 +/CapHeight 683 /Descent -194 -/FontName /WWMNAR+CMBSY10 -/ItalicAngle -14 -/StemV 85 -/XHeight 444 -/FontBBox [-27 -940 1332 825] +/FontName /KFRPBN+CMR8 +/ItalicAngle 0 +/StemV 76 +/XHeight 431 +/FontBBox [-36 -250 1070 750] /Flags 4 -/CharSet (/backslash) -/FontFile 4585 0 R +/CharSet (/one/two) +/FontFile 4183 0 R >> endobj -6704 0 obj -[575 ] +7216 0 obj +[531 531 ] endobj -3991 0 obj << -/Length1 1354 -/Length2 5076 +4135 0 obj << +/Length1 1352 +/Length2 5101 /Length3 532 -/Length 5901 -/Filter /FlateDecode ->> -stream -xÚí”g<œ[»Æ%F”(ÑeA0£½w‰N”a£Ì(Ãè=ºè½›„¨!ˆ ZD ‘è-¢‹N$Q"™½ßwïx÷ùxΧó;Ï|yþ÷ºŸu]ëZk »¾€ e WE!ÑB !) ’Ž† P$àâRò€CÑRŠ†K…$%…€ -^@aÜ8DJDTJà*¡Ü|=Žh ïM ‚+ÜaEu hG¸+n;¨ Ðe‡€£}A@àý?¾ðÞ‡{Â=¼á0@HCØ¡¶pþÃ’Ò„ü« órûkÈîá‰3äÁ™äâ,ÂPH_ në¢pZpœ“ÿ Sÿœ\ÕËÅEêúÇôÿŠé¿5@].¾ÿnA¹ºy¡á@ îüg« ü_îtà0„—ë?G5ÐP„ÒÁþWá©ŠðÃôh;G =ÔÅþgŽ„ýÓ.»?M€Í ´îñýµ«ŽêCH´¡¯(ø»ýOú͸Œ<>@ A  ®÷ûëÍòj*H; Ä 1q ÔÃê À‰ý…€$ î„ûà,ƒAH÷ —K ÐåøcSq«Û#þ¨ý‰"’@°» -ÜŸùüU‚}ÝáÈß%q Ø ×†‚ý.A€`O¨§ãßq\Eé7IÁÊ¿ '¥ò7A`Õß$«ý&\§Þß$ëÔÿM"@°Áß„»!`[¨3í·ÿí_Räïú. w0ÁÐß„3hû›p²v“ Nv qRðKøGŽ—'èp Eqù]B\œˆKˆ‹Òéâ\¸\Bœ ×߈;G`ä%ÄÙ@]Bœ ·KˆÓõ¸„8]ÏKˆÓE_B\^—gÃûâl`~£0N×÷âÖ‹» íý¿ŠŠ(\ÜÂb¸ó)!b’ÿÙh„D¸{Á5”b‚‚‚ÿ¾1v^p$úÏ¿!œÄ_lÀ]N8Ün˜™DÙIG8e¾ˆ,RÁWñz²d—E¼kØ- Úž—¦÷hú`gûzýáu'D%UÆ®V5f/¶ÈøB! Ïßüpúz9-oqŽɾÝö+‚þÂÞ×”®ù1ë37WÝšøög9¼Û‰žio -AJwc ˧&} rZœ!Ë‚q¬e, [µÓáÆ Iƒ§;j(,jæI?ýƒœCšóÆןFçȳ%ã -u®LdËœ‘ -Í9–Sû[ê Þ†p5ªâ¡’ºtÚa&K¶»¯d‘Ú²»É*ã=õy?"±ãÃ]Ýúag˜¹·¶M>‹÷8¼xÅ}"ŸûÄqZ7¤…`^¸e~H‰¹b“"÷ƒ!#qÏ3È·gܹ`{Ÿ¹]•¬Î;5Ɤx´íú6”ÓÑËáPmiÉY·öMï«~bè[^ÒP‚È•ä½/¼köí¤÷½nT°b­Þ«5«Htq¹¥‘SnK¥rçIæ ñuãêºÇ³ž·‚aÖÞö¸UÎÒþ–e#&qOIÌL÷w ë§Qác2·ÝÇf~SÎ<â|Ä‚Æü÷ÆØ•,‡šd°þ âRµøaGKô` «¹†­=*ØŽñHRæ­|'e©]£9è[ZqEóÒ?Gùoò·Ô3Àü^§o È¥„ªŒe×Íìaoèõ¬SO>‰g«êçïx%¦8ª¾ÙX6—ˆDÞö|ýD¿§æ)'¨Âñl?I&â®tûk2rZy×ÂÙ«§GWqm…ùmE4gCŠýü’ßÏþ·UÎYòö» 2ÃTïMú|†‰Èn̺äïî‘Y 9’Û^JN6ˆlÞb‹-Ÿ*ÒñQ6â0•Y.å„Ìò„I¿¿ð/©L½˜xK¡Á]†/õÁsPúr’"1’„ûù¹™Õ未{H—¡ ÊLŒmÉ«Ý6æ .ºM¤Gm'¾(#y!Sì<ÿ©†#s BØ8sf¹ šs¦Jñ¥+šEgÌJ/C|våB>]j!”û kgå›óq•f›QLB­&BV¶eðºEwóª¹#oTqý°ë])i“\ÝÙö÷»X:êИӟ/œYÌ8ÒѾɤC!¾ŸAF¿\?x'Ï[Új¤é¹;S|ã0HÈDD"üAzsm»aq«ÙÒ¿V7άÝÕYÝôvZÉ–W<¾7ÈÓ€E‘–ÎÑ#ÃçÜ a3¼¶õâ“ú©¤[ö!¬ÿzéZ‹c°bÿ²u4S¢¬+Ép©ŸŽÛ$¤/¬”i.¢ÄªM5GÏŽ/LÄ‹îjéñKÕ=¿âðÕ£ïó0É·Íø"6öYùßÕEÉVJ¯±Z†êÉÆ/‰œGÇßý1ÎFW\»M\ƒ¥Ìx|NG&Tý8§Xb2QO}½³…8/–cl=Í=Hh,ˆÕu´ø®²J×hµs £Ì·‡F%ºÓî—Íl9CkEµ“DïI„hÄ8γœ.|‹äÝ":;)£;ì~ƒ ¦_ybl2ÆÎ!/“ØÀ{LXKRÓ ‰7"œíxê>QyW¶‹v!ɺ]:'û–ÑX¬ºÍÆëæ˜Naõ(§lŸ?è¡bô‘‰ü®öAw® Ï­õ´)ÂUÐ@ÑÕ¹trBæÝSÈÔ@æ,‡xˆÏ±1T{ø’è…ÇÏ(%K-b&ñB†vj=¿™Ô\RÜ’ïf-§ÒkqÑ;ÄUÍœÅSkì^MIÕßÍsƒ;׊òj®tÕ¬”¼OŤ„.”+ì7Ö«ÕÞ2a›iÈÅ™7Þj*¤ºqoÔ',›Œ‰ï[|_›`œîÂèÊ7ú%ÙáÉ - ®ˆ¶¸Mu‡ÒÕol|gÛ[ YãCª>‘|-áøñ¥ç“.Ý‹éùÁEï©V&¥Ÿo_Uql|NIk“YL¼’žív#t¤Yª'œøæüNfZGAÒAØ#θ›!î’áñsúRÃÎ^ç¶âït¢4ñ·—ÔGœ…ŸÕsµ3ÐÚJîøÙ ìYš}ؾž›‘v:Öòº°÷še ƒä1§Œn¹‰.r¾q§È<±þ¤/¼›*×ô½KöuÉ}¦{:¢}“Ñ|þ½e?«{€ãˆ9V¹wOkŒ Ó%µÂcC\E÷u>KLšo…ó¾Ê|ôÎ{gÌ0 FŒ]u ¸Íô+ëaëŒe[Åõ_\x™nßÁ3žŽóí™ô“KžE‚‰‘‹îv+v>§WK&‰íå1NúñÅé ñ«çŽ+(PÊHªî»b”%òÒ/Bý2V#Ò1˜€ÑÙ›ù%Ÿ»ç7©"bD1~4›“ÜbŸk(K:}QÖ> -áØaòá^¦Ïû‚Mð£fHXO˜í&ï PË^ó¶ÌÑΪfv9Ï)™»úy3í$2(òˆ©rAÄÚAëFÞ‰lŬñº+–­znmºYóU*»{ñm°féØyRêÿóY2G¾6IUìÐ2¯1.H:aŒõÄ©?þH™ë1½}­²¥ý±Dûë»òïcÏü,á¤ÝÏŸ/ÓRMyû¨©3K}1”·„º±óÀ»_¦)[¼’ †uu]ñˆbß™…ÖnlÅ¡Ú¿ˆQ½Ðr“, Z>(”…È{›UvÓœ:¡Í¤c*Mo*¢„\1ŒaõU¾ ûLbǦzP›=5Ÿ9JÁØXüqŽí§Û#üè£iDr5©$¼™0.¿k4X>íUðÓ·ß®Uê s:¼›ºA5“Ôv'óÙC]tø²Sœíq®9ˆÿ¼h÷ˆ^Xlò«…™Jw†ICbkÍ*”vWS9]œ›P/ ÒW£Ü+ž•hª*æK>”å¯X¼«þrœ%·S…éñDŒCc“Ü ç4†Ç39²ÙºƒU.Ø,¦’’>È„1\e‹'Ñðs - ïĪÛO}-DÜ3âÄæK½CFëÞÆc²ÂþRv› -¢õJëad>Ï]òÅ=D8¨qÓ˜wXü‘2Õz¢·nJèÎÀÒ{Sé°.RUfXž‰‹¶Ê÷ }9` §ß9ïöSaj»Â9“¨]´ïÙxá™ßkß½ûÔƒ¹Y¤>ç¯ÍN®Ú\I>·"*%†!ùߥ´ö~chuK„môQR|¿Ãtõ鱊 âa¹l‚^w¾ÂýÝk}+<•Eù»óÀ‹²Ž±Ï?°rQ_³cˆ–¼4)I¹ú튭ÀÖWåÄ>¼ªŽ9 -]¾Îª¨Ì+ÙÁW¶ír'ãc@#æ´œ×G¯iÇX‘u=qÿî ÆR…¤³ÅŽ ±°74C§ÁÜ w5ëù©óê#™R^ÕN×X'&\=ß {Ùz÷]1C(#°x­©a{ Ðò¶ŽÍÚŽ=Û¬ÑÎ8Úµ äßùÈ‘þËñKèZ‰ö¤~–¤FÓ =É÷7lÿnÏÜñý- éYnÒz ”Mª–ÑüNÆ;³U³õ Ô'~}¢ŽÃ•÷& ZÈÕe[)/ØYT¶Ì^Y5}:ÑƇu>+µR&p&ÇŒH|n1‘s„ÿ;° _6"y€OKÝ"U%,igŽq¤´¹øùm_8Lë{Í«J/ -H’›#'©ÇˆíÖ@ ˆÍÑ÷”“-ï5íÝUŸ#¨ÙÙ! ÷ÒaaºN9 ÒG±h“ž;#´b”WQ‹¼ayÔ>ñ jP5¬`›­+ž†§hŸÅ­×ˆðH½—ÿ!ùh•=&`#*à>ãIM“/Ío¬Œ Ü=ê}˜¨¢»ZhWx> -&‚øI~¼ÙDdV9œ¡´ÊFq¥zi@³½‘U¨€S¨G‘êþaÅâÌÉN½1½¿Û :e†ÌSE—Šé©Fç …§ÝçNï .ÔÕ3µ#ð#µ¬ø>o„óû|[~Æôþµ²ì•yÑÊXv²Èí¯´‹5O›§á&òæÓ -6¯$Ñ’Æ!¤Ú¶Á7fy–غ%ÀæFÙ‰o·bo\—Ðì bPÈÏ-)»ïòÉ´½ -Ò-¦nÍõèž: -=Ì °>6ȇÖ1Zí½d‰*Ÿ œrZ}cWõøf%­Ƭ˺ŒHeµzäezßÑ!Û„n/šä*Ù:¶†º~I{fÙ®Ña6_ÞË:‚{Ç7î#+9WMqŸ.ß>†Ü3 ϵg²s+¹Åé’™JÙ"\\óºó MpeÔ^D™d3ëíb¾Tü,ÎðSÀÃœ\¢ErdåÐV -‰W¶‹&u‚ÿÃðÿüŸ˜ÀÎõ@£\¡΀ÿê÷endstream +/Length 5935 +/Filter /FlateDecode +>> +stream +xÚí”i<”mßǹKö=Æ–ÝÛX“ì²el³ØÆ cÆZH!$”%²…lY²ï[%$ûY';!Hœ7ÉP”dR H²ˆÀbÐþ@™`IZH’“ÿ Sÿ\\—€F›À<þ\þ_1ý·˜‡+Úÿß-XO‰cH柭בÿrgŒD¸<þ9j€‡¡]ášg4(–ýWÑÕ[×Õ‰0sÅÃ]€(Úù³ŽÄ þiƒ”ÝO K c‰¿¾êÏQ3˜+oáï‰ÊüjÿÉà_LÊçê´•‘–‘“I¿¿Þìÿ¡¦ƒc®Ò±PPÂp8˜?€t>H¤ ]1¤éG² ’Æ`ñ¤)@R.·(,ðçG%í„rý³öå” /–ÜÏ|þ*ËËAp¬‡ìWErñ÷tAb~• OÒD,âW y£aÞ.WI­_¤iÿ"’¸Îß‘‚tÒûE¤NÓ¿I‰Ôiö‹ä€ èßDº3 ' îŽÄ£‘¨_;R–û»þŸ[%UЯm*“ :ý"’,üoËt¿!I +ùþ™ìoHtþ I‰ºü†¤8]CR”n¿!Éú7$Ùðø…¤“Âü†$ØßdÃó7$éâ~C’®÷oHÒÅÿ†¤,¿!ɆÏoH²áû eIºþ?ñ¿_‡+W°~R¤h¥dH§SB”oÿg£%ÆÕ‹€4Ð*ÈÈÈ(ýû¾À 8ƒÿù'Dºj1Ê•t5‘H?$0ú W½ç–ü:¼0H'çCÑ91ož”ü{} a•)ªÒ«SªLC¸ê÷HÞ-Æ0F7× IÄ«% Ja†óµæ­Î@((ì3c'‹Ø³TèëðU;‡³]™-ç=Ò#Gùæ=«%ÖÇw§}Ε-ƒ!ÙœÄ(ŠÂ‘OÇÛAîÁý3£4O‚ IûÌ:£D¤ÕÒt\ïáš6;ú¼‹Ý.u—ùd”³eò£û]Šrt¦1ùpŠújð„K!S ½ Ú²)\¥{×l<Ý€¸>{êD|{ ct‰¯3Ô^‘vž3ô¡¹§Õ,´è‡ïD·SµßÌ5A‚˜¢_x¥?4ZèfeBˆïksÉïE’;>Ò8àHŠýæäß>äž±ºÎÝ KSîó8É¡K˜òcýIL[AvZ¿oóòŽ;”wr/”\¿Ÿ`ì½{Ênyˆ°‡”q™ÅZÝlª”ó¦ñ¦€TZ õž™ª©­™zZÝDêl$yêæÙ~\—zóqümH}í®Ð¦Y€°Øf‚á Ð'2‘õv|@³u€µöÒÆ zÁpÚaíš(Ò÷ÖX¯`z^˦´Z#h ^pJ7£Ô¢3–‘ Uöó3*žˆôäYyúm}1ŠnJð)Rû®ò¦{†„ÃßWõý­niæ}êËvC¶cÎÎ gûcLÁ[!ÂÜÁjOö•´õ]ˆ€ŽxŒ"íb3ͽ×䧬{µâþE˜ ÁyWovÖÝäe[ÇÛ.JX·õ³=òøo!b ¨js[ G¡Îg¾Ô`ƒVØnoéö´öE`|Ó÷ä×z.JF«’òÜ1ï‹G „ï…Ž†èyã@¡¼®Ú9K.EoeßÑÖ ‡ÛGÙv+Obî€wQE ÊS+ÉkƒüZöýÕê9Š*/ÉB÷fÙß#8æŸZÔµëä4…Ss¯¤»i«Ø5LÅ÷\ΚR=ú(É'™IY[Á} Ð’¸Òs)(ñÖŒÁ”òÑo¾·ÙLÛéß'StÍÒ‚×1·¹èÈ´-ÍÙ(…ã-¥5»Û·&éɾéykÈè–­Ç™!ä¼´.nÅc>k­ B¦¦¬E´_¸»‹î U>BMÍuuõ»?¹Œ:KlœVÿ`Ëðîz§ß‡s4lcètâ7š›`çL:'ªññÐðšި‘,c?mKAyõ™y’½1ÑPÕw§Ù/Ÿwӈ䓩¼wôÝÌ{ó‰>6ü‘W'7–'tøCš-®s|Q„²d¿%Ös; +³.cp/›rȦ²’â§c}Ÿ¹OM– +&ÏB(ZoÒ2Ïe”pøþ0zL¿Ñ|ŸÇxÐÁ4諉°|„ù`äXÂiÞhÖÄ“¸'4 ç|™U"¿`®§F'ÝùÔê8¬:µùµ\$Ñ’Ù„Æ»û &ÅK õw…ëÖþ’aߤ®šñDžÜ>’¼Úš²÷V×þH<ò÷ö±Ê•ÌçW3ØÙ¬©¶çb{ƒ=B·ÆOâ^|¨Œ“täŠ\ᄒݞϺ:þjið«iê¥ —rçhÆÉ’jè°âùÛøu}J&¹~Œÿ1öÝHñm¯Š©ó³CèÉ!y M㿪c‘Ò/BΊPOÅ|IÜÁ«òÙ×ñ&9ª•%bÕc¾7o¿–1·í©s¿Ý…«CFCUk#×ËfzW5¹B^‹®xöiÈÁËQmÜÄõ2Õ-ESv•¸@oàè¨-—1))Ùz§bŒ©Z5`•€Œ9¨›GWçR;£ûŒtÔEé’ÉU½fß/²LÈãfèŒê¶äÑ2 Q¶2w|–ydU¥?┋Y'ÖU2Y´nÖ—Ì3ž"“(˜R¯0ÛÐÎ|Æv]ü~œ4:—»¢s(KÝGdÏ)øð»óz> ¾l[g1ë.[<Ývq²Ñ]ƒêÂôDQ–™6Z VçÁ4ÃR­«e´É…³y¦Ô\NlRìù\òýšÙÇ«.2#wiX›cý¶Fù2ê2d‰#'YáÎq™¯Ï”°~Nb„Ý7i¾Õ¾]æûZ~]ûyôÅÇ1øÕfëÃH®xxgèžÇZ÷ @S¹jΊƒÖÁ§U{á¬öÝ„m®è–‡\òV“^K º.†câŠd(ŠST<Ö*«ÐPm’p"t¯¼q?hG;<íÅüHf5¿å1¢õHƒUg‚Z>îC'Õlnþêtqƒ9$«€ýº2Zq–þón“íFãáéì6&‹òqoILšR~JX†‘ »Ú¿6["!sÏi³÷Íþ mË,õà˜d²!“ZôC£EݨTûäL# €ZQåMP&ýf€|SÞ1Ç@>æÆ0ª·9ênòq’vUÄÒ²Üe9}ˆ nQ…ˆñ¼îσ7!¯É²5úêjÌ&w×~b˜;:ß`5Åb±(¡PѼÐ\Þj?•}¦‡u¢ÙuýÞÀ¾Loù]}òJXî ³y¸L¿ô +-ÿ]¹¯B¤è Þ—Ìc[,Ë¡Ô«ý?ª¢br§û»\š‚byÌSÇúO‹/˜¯K÷N‡w6ÏÔ¾s›ÕvnkžÙàŒ)¤û"¶t6Qàk· Ôãv=¹Xt:x‰?à I9*Ï°r°d@!d Õþ¼3 (ˆã9vL¢«Tq&Ž—W슾ˆ +ëËÏ×iƒ¿Ý)–Êÿòí«¢ø5Ni!*û¦·²)ɃйáÊõ~¾<Àp@\Uª[ZàשOF2Óª`†õ—/d÷<öøvÆë-iKfºh@³]ÙkKM³¸æâ9™sˆt»Ôà.Þ0ƒÑh‘–Œ…굚^†ÅRúGü)MÕC„Wµ—Ÿ ˜Åá÷­©PYM.©SÌß$šf FL´y\òbµQAC•LÈ‹_2}-$­*×Eβsbv**`$æ^´Æó0§» +›Þ¾ô˜/=¶H@acò){™ÛŽí¥±8'¯-‘šÆu2§CËÅm (¾puå}ãèG{ÈÁáUýœWìü÷+Ùì´ã¾±P±ÐåßÏïœ<ËÒvÓ;dB•"â@­lЈ’À2:$†2ù‹˜[£|]¥7Ÿâgj}2‘Ík*ôC¤ÿ†^úÍkRå¡æ|ÇÞ½¼÷<ìær*®Smõ†°^ÙUš6œ–zÑÓAD¥0’YÇútuÕŸ¼à6Ø<ø~ žñÌR3IsÎeœBŸ|·Ã|öQ²z&ñ“‹T¯@‹þÝGN2VÜ3;s½ôNû&.ì5MÃ߸ÔJ ñ•ÚÃ\Ú c¿ìU®Y!¾¿ÿ4}_„èö2˜ÿñÐÂ}vì];±®u(Æo\ÆÛvv»ZzѱÖb;(âÉ$Q­(ôl¿!(Sº€x›ñ/TEÛåÏüú×SÜÝÆ&ä'sï\ÚšKº1ÉkÕî¶Ô/cÎû~k˜XÁ«&¿ë{7e†1£›]5µØzÚÝþÚ¦…å@é«Ã9H@‹Í΋.õ¯S³Q ×”/xOm‰·iù¼¹ty½K :gúöÏ¥YŠG»rúCn^©[³ŽÍœ–Ù•(8[3láuô”ÍÓ-`¯8ä³ñ‰š¶œÔQ<—©–ïv&]+×u9«¨¨ã!d‡bbë‚[¢Ä‚]ÃŒnŸd•*]Iã“ÊÚ#Ö) APÜ?x4õÕrBM”™ÿKìeµW÷×ÖA¨îî+¾b®k÷?¼Í¸Dè^¨¾kJ”zt6Ô!dÒåÛ¯[j_D}*2Îà”îgòF46ÇUžÓœê´ÇP¡æ¹3뎚®Û®Q¼-_v>‹×VÏŽ/@ƒ÷ìvÍnSûHCètuw~àˆ¨ËÜ´~ 3_º‰ùþëãá©’D€ðGLŸ_ìYê¾õ²wBL÷˜šÁ5am<÷¤T¡×É^‹*©K63B7ŒWŽš]ýš²¯ë’NÉdÒDŠ¦´Ø«‘SŠì”÷©Ò—ô’€JÝ„ûš½ÒŒÏÖ_É€¦ƒŒA\»†¡NªEëåÞ ŸGöRñØóõ³|O˜f”·ÃRõê@WØ»-?¯=4eímÑÂæêb!óè%{V“Ä/K®‚ÁcÍ“ÜJ÷ENß÷ÞŠÀÄ[<ßoÒ…«]Ûz5:8EënœFÓÿDcfô ºœEY‰.}lË4g͆;{ÝÌ6/âa]Þ±¬˜ºy>éãÖ“_.y<Á½×à¤5ùõXXû(3“3• kº¨:‡¼¾µy±Â-㤋µª0݇—û4ÉÊúÁ¼&Æ×æ@ºJ †8‰Qq›©—'Ú òQF²®Hs¤ºBåÉÙ{ô®R¾ÌÎ=ÊóqØã>o’°Å¯ýy©„»Rc2+´] PS{äý¸"1½—ûec­\PÓIz¾Ä’“Wë¾Û{Î8QR“` Þ8H,´ vÏ ÐSˆ†iê Ú9 (Ït°®øf8 >ôƒr¾Ë<¾7\/©ðµ(›e£0±Ò­Š|9„HÜ£áÚnb\£Ú*Ÿ>WíïÜCöú  T_é„Üì§ ‡½Ÿ‰+«ãšC€çõ={úùll KGÑUôS~)Z}W­õµ«ª'PµÔCò ðfþ›‡x}=J¿êÆå,­ŸåÔ!ýcॹåžD½h3µÛuO•›ƒ ‹Q#™Åi/ÐÂõ95Ï>ýbqÙ:ËÔ˜Sµ”òÊg€Ãô4¿¦§£ås>¥±ú­ä>?@^0!û\œ–Lóq¡ò)ª(è“î §j»rFÆ}ËÓ+Ôv>²Ð +Û%*–|•5 xê1Vì=Ž3ýÐ`Úg´•¶UöeˆÞ¯q {ÈâT{wÑŒ£u–ˆÜÊN&¤}rßç;Yï‰VíUãU7g?ƒ~mŒR ì§äÔš*y>î%(hõ• á9¾nn©œûTÀ´nêwöÑ· +Ž»˜î™©ÉÓ_9ú,…(ƒÎW¨‡Üá|¸ÍªßSCùéë,(ÅØÃGfJMÕD,l¤Š[FŠêl°'ÅÆU;Ñx·{LK£ÏSðâ?ŽÏìs¼K²EäæV,×°™ æñwÁ\qêÜYöH­(³7å”ÑÀáq3ÄɮգKy5 qèƒëŽJ™Æ5&&Ï–Sß7%Íg¾}W¤ÅCîÜ¡«]_[|¬ÝŒêÕŠ¨z?7_LÈíÍU²“cß²cØF„¹p§m~µÉãeâöÕ…Íê¼Tºœˆ„IZÐò÷·;11­¼ßlUÞ™ÜɤŽ’Ë4Ë[ [ûb €íÕñ£¶h§^xã4§>ÍŽÊB:'˜ùF¼µa£:7çná:DÔ§_mEµ«žkËÖI®L jR»ò9‘ü:\÷~ÐÎðbÞ£¬ÃŒîVïÜÒÚ:J +ààëÏ>,÷Þ'Ös:£nÇð<‹Î—bŒÊM\:[‘Á32èΪJ»”@èW²´}ÖÕ6ñmF`àcþp B}¿°±¤jÔ6L+åÛçmí\mñ‘8îk{þÕ]/~ÆBrMô¤™"~ŽIdOT ö /™7`Öi}u1¨çóµÞ5{þ¼è(ÿòæÁË€<{Ÿ…ìRP¸.ßà½ä½hJyChË7Ñ#*©ùké‚õglËKµ?RûèaïeîZ„¦—©–q“e…J<áLεîÓÛÁª¯·™žÞ଻|á.^çÅ|þ]™W»YúÀÍKe¸Céj½ñÁׇöÊÓõˆ”of—ô$PÛÔÃi—á|¬üðÓ96Ix«~Y­LVÓôúRKrßX²4òÍà¼Ðæ:?UéQê™:Áðhcݘ‡+€(­ÂíÏ;{þ*l—7‹Þ/„^U¬–x8|s5tÏ*iÆ.†(|ûZDm˜w<¼Š*©Ðø&î¢*HVªÀ+ *,Ï!Ž¬üñ%ã渟-îS^ÌnEø×ÍP¶öû!œç]þÈz›:a—Rw˱ LÌÆ= Äòñðã¥Ã“VY¼BºÎ*nʱøgß÷˜Vags±>­4 ðQGv–óÞæƒó{+ÛËžj +åÄqðNº$ì_XË Iü\ëÄð kz—Ù6U¶x‡ËK:äÅÔñ(¾*koãZ +y5iV·It#Y¢N¨ñ(]U4ÖAcÄn ë²Òp!¸ ‚öxå$ËC{^üÁÃüçßH]y~®ñœúwóÜaÈ«’ÛLK÷(Ù-3¥Ë3b7mÃΚ Q;^ßDP½[²UT_õ¬!롽E—®$jR³!M#ø|}¶¡_: Ä°]gŸ¥ò:­«tÞ¹4î¨Õv¤YI>ZM–PœÜÙº¿Ü±`7¿0§ÝØ©¯@î‘'w ¦Dì½”gÀKŸ•t¥Ô¢y•> endobj -3990 0 obj << +4134 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 -/FontName /YTUKRU+CMSSI10 +/FontName /TUTTIM+CMSSI10 /ItalicAngle -12 /StemV 80 /XHeight 444 /FontBBox [-97 -250 1077 759] /Flags 4 -/CharSet (/fi/quoteright/hyphen/period/slash/C/D/E/F/G/O/P/S/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/l/m/n/o/p/r/s/t/u/v/w/y/endash) -/FontFile 3991 0 R +/CharSet (/fi/quoteright/comma/hyphen/period/slash/C/D/E/F/G/O/P/S/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/l/m/n/o/p/r/s/t/u/v/w/y) +/FontFile 4135 0 R >> endobj -6705 0 obj -[536 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 0 0 0 0 333 278 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 639 722 597 569 667 0 0 0 0 0 0 0 736 639 0 0 556 0 0 0 0 0 0 0 289 0 289 0 0 0 481 517 444 517 444 306 500 517 239 267 0 239 794 517 500 517 0 342 383 361 517 461 683 0 461 0 500 ] +7217 0 obj +[536 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 0 0 0 278 333 278 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 639 722 597 569 667 0 0 0 0 0 0 0 736 639 0 0 556 0 0 0 0 0 0 0 289 0 289 0 0 0 481 517 444 517 444 306 500 517 239 267 0 239 794 517 500 517 0 342 383 361 517 461 683 0 461 ] endobj -3968 0 obj << -/Length1 2113 -/Length2 9913 +4114 0 obj << +/Length1 2134 +/Length2 10127 /Length3 532 -/Length 11050 -/Filter /FlateDecode ->> -stream -xÚí—UX\˶¨‘ Á=ÁšÜÝÝÝ5XC7® Hpw–@î4¸;Á-8÷§³öÞ‹¬}ï}ºßm^ú5fVÕ“¦¢PÕ`9˜‚¥ì]˜Ø˜ÙøJl¬6fVT** èbå`/ tóØøøØb®vè8??'*@ÂÁÑbeaé • ûijC¬Ì€ö% ‹%Ø:‡Ð á`fvñdˆÙÚÔ_á P;ƒ!n`3*deæ0[XÙ£²ü6’³7wðü+ ruüÏâ •ÐB%éPEƒ½­'6GeQv€ÖCMþoHý÷äÒ®¶¶Ê@»ßÓÿµJÿkhgeëùï ;GW0 äCìÿ;Uü/9%0ÈÊÕî¿Gå\€¶Vfbö¶`ë¿BVÎÒV`ª•‹™%Àhë þ+¶ý·táþR`QWÔSRgø÷Žþ5¨ -´²wÑôtü{ÚßÙ1ÛC×båxÃÊÌÊÊM„þýç›á“²7sYÙC7=Q¡gJ\€·l+{Øö€³0Û;¸@/@Å`îAý½¡Ð=g1ÿ+ö/d‡¢Õr@Ñö 9'? s@‡¡sÛížBÐ'W0ÈÔö_»ÿ÷7€ä`k „<…x,Ž`ˆØþ4¾OðÏ«9Y¡©@ØÞlþG”íßÑÿJ†z9Úº:? VfvvÀ§€ÅÒÓÑlÿâþËÆÊô‚ -:Û-Ÿ"¼/0Äá)õu°ÿÍ\PQ÷§q.¨¢‹%üGÆï5vp}Z®ß«låöGT׺ÿ3TÖìö‡+t¯YÀÿ¸g.¨ª½ÕŸ"¼¿ïÙÖá‹ø~OcgõÏ(7Tìä -|ÚfnŽß[vþÝwž‚P±'‚Ö"hm‰'‚–|"hQ©¿‰º:ÒO--óDÐu‘}"¨„ÜA«+<´ºâA«+=´ºòA««üM¼ÐêªO­®öDÐêêO­®ñDÐýÐ|"¨‹ÖA]´Ÿê¢óDPÝ'‚ºèýMÐFÎb -šÙ€]þq¤ù8þŽÿóPóqÿûÁøg:´àÓ©æƒ4}"hA³§‡—z÷ ?ð÷¾ÿ¿OåÕ°ø¡+`ùB—à.Á -U³þ¡N6 Tê -µzêlоÈbÿB­þ@¨•ãøûdþP+Èøû1ù¡V. ÔÊõ„Z¹ýP+÷?Ú ÔÊã„ZyþP+¯?ðw´ý§Müï—¸¸ƒÇ[&èƒÆÄm|Ð}ááâóùgž–½ô™““„6VV^èòÿŽš¹B ÍÍå¯×/´ÂØÜ -úVƒ=Àf¨s3fï­Sê‚‹|¥òǾ ÐÊ[ÔÇ*W·O¶<ük[0 àD¿\¥{[œŽ‹±…°Eîþ‹Ø9ü«·Ú°ô‘¿SlêôÖ›ÉVºW#±îiº’ç¦ã««À}Ì溩ó.X•‰åÁ¢D½ÝYÇ=û¹ª´’šÛH‹0oÜj:2ÞsóèJ§Ûj…UQsP¨c¥:…r†,¹c%Æ?[ ôµAn`X8qøêŠs›œ“ð`p…ƒmÖ2²…T÷0µSÓ?žÚÎëR»u}w1|Û²CXÖH!©—ÂÚ‰—¤ÕÉ\»²W*´ é5ûXõÀÍN¦YɧÕph ÒÇ'¤ä.Ëoøž‰‘α¹" í𶡳ïã¡âü£Ö/;á-ÔÓ‘¶Ž~{óøëfÿk¦à¦U‚RÓ_šÈŒÌú“²’ã™ z—Z±›Þ9˲/½8·ÓØ*ÕYñŽ¢é - ÒS8ãó×á“H¯N˜¾æõÔ|íŒB¬˜ˆ“[:PG‹iµ X_óÄ„©" e9yu„.SJL§¦´âýŒë2¯åÂ.Oû]ë_LÊ~’ž;Ò¡Y§o±ôÞ‹âÊù–\§j‚aULCÐàÝ›Áo[Öœâ>‚Jh4X´ þ7msÄ*çdüa¶Â{,lD!>¶h6n<&·ÜJ0ˆF$eYƒÚn‡´ÖÆÆû¥ ò -¢pßÉ ™®sŽþœ”/À…ä„œ¡Äöš,Ϧ;q8-ÄH²™,u‡;6Ô»ÜXS؉U¦º‡7ČӢ!R±Ñ‡[«Ú…Ü{î-‘f™üžcõ -B´ÇròØÆ´b£á¡4ÅÚÈ7ßÓÂEï„øsz­ì~¬GµÏì($²¹þâ}ì¢ÏDkÆ-BN‰LmÛ„W •Ådo\®ºs9ø<¬Bª-`ãÂÉ®GÈ”­ç½n -Éè¦`?ç{Õ¸Qÿ’µ$ÅL -XÅ„Ûuû€ŠÓ%õÂê•Í+ÞÒ¨ù4TeÆR…½ºÔ°ˆViJåš½Xœm’œä.6^þc¢Pp+w¼ˆ-æÌíx²AeµMÙzó{V‘øÑÚAo"ÆœU9³ëÝ&X=åל)¹.öh÷ßI¾‰‰ãØ8Í×aíëÕÛûâ·”ÑýÀ‹0v"5*Û -m¯zåÜN¬Òˆ&F¨øõe^ÅÇ7g]–³¹‡‡J1™]ꘄ¦\x;b§¤ß©€1TÞ|ØD¹<ó´NÚw/9²ŠnDTÜ°>w¹5‹Kõ>Øx|‘t‘}Ocê<™¹cÊîȹ9Ž`íO§B9C‘W¶°Ðäª^É/V½0áþ%WG\ÍÛÌÄå¸E¹ÆC¼’‡}—ƒŒýÓé}› - ä‡FP ×ÏMã:Cj ü4«Óž Ô…'§äs„å¸ëEhÃÉè²Æž™~4 -˜Î¶¬õe1nÀ½Æ÷˜|'áµañC2)&R{>cûû!ë\8ñO2†´ -** ÄûjD\¡B»4!koÃ[“q ;ã5v\µèõϨ0SwS“ÙLæ'Géd[Æ>®Ä¼‚}pl/Å!¯oó}ɳþÐÌ\–Âټ½‡zscV^vjÓôcU`HlEÒéHÇ¥œh®ÿKvóJÃ&›÷ú[ßžnìâYua™;u}¡ûùþ,$6ŒK‚¯µ[—è†Ë?à ¶b›èdÖgóñª]»ÊÈÝ^Ó¨mõœ}§•MQ7yÛ p<øªØÏ&ŒG—仲“ñ@¾¯'òýÜGÓI?ÔlØI}Ù4ø&@ã`½ðÊÅÒ¥çP©a:Ë7})ƒ°žŠ•¥‚áx;Ð@[|àÙævÐ;‰ÏyÇX€µ´À“%MÓýÄŸhÌD~-ìdTZÂɾ¯ánŒÕÏð‚´‘òYhöÓ=ÖrÚBE·ƒm»õr?ÆúLíc‡x$¾ˆVÎý¡oý]Û¢?Ë+œîŸoåFâ#Q®ðÌ·®H¦s uªÌ:+:Õs5<ˆµl·/.ˆBo¦I½Fƾﹸn¥¿W=nsHÏOÐØBÆAô¸‰Y¼•„µöNå>‡Û^뜒`éÐEP¢ENy†ó¦Án~Ï4µÆí£œ/7¹cúUp)[Ÿ÷åªcÛQ‘»Y@•;Ät9©ãã—èô‰æ>K™)NÏ‚ -;›Ê»q¶î”©·ŽÏªvmÂdãi,JŠyâ>©§9 ¶i[v3Êä×Ï„–´!Dâý¼áG92º…ä~þ*1NòE’…l°fy,Á¡P¼Œåce8  dÒ ‰V%¿ -äÕý’Kiß0FU12K´ó{® cû<ð~Á½Yo?Œ~•ÑY0Ï¡u‡ßËŽÔQÚɪž+Zšþš8XЬD=ÆoPj”åjØ'4ôž5*ŸËÛ@¨,\pÖZæ0I7Ž3͸5áyÓ®ïí„Ö¾—b*¼á8ŠYu,:_^à+Á³öJžã)¡¶‰*­xvÕTµbò9Q»À,¯Éû~±Ué¸Äëi ]ð{†ñ.’äi•Þ· «}2›Qj¯çÌ»wžzúzô.ªq¢‘Ì0ȸ³Ö™J|*Œ{h+ξfw»±o'ªq.Šã{ÑjuÏ/¬ûþ,cñíç&érR8d˜¥@?qé£M6–\ãm_g2Uá´¶VÚG`Bº¯gåÞèI"#Ô/|qS&Ô±§Žƒ—¼LwS³O*ì ›íqqÝyHÉ8ì¾7ˆŸ?ÂÈÓÁ#%s7”öš@ŸBxP¥8÷M)ŽaYr[_®ñ£1‘¯ŠYûOÚ^ª6V;·’^w-=´´ÆeL¯fν_’n0´†çqævò/G»eýªn 4V¸ù1M?šî%Þà ûw÷ ÎFN¤#ÏíÉw} ƒ7X:\€gØÿaæ»êz«âOóørôd»‰3ð£~=D”5ZÃ!Âd( ëëˆ"ÅbYޔΈþu]˜AºwAå´ñ?0« à=ë™ièp©¶Ÿ à‘îч]TÂá-7Ø7´Úq³'žß´åé‚Û1Ýëèj‘„G˜¸¤ Ï‹êÐ ldžÙðÑ«NÜiž7Í!‡Ü~cÜ:Ø}E&ªMGF2Õà‚×Wo›ðUϯ°³|Ø_(þx…êÒ0}ËÜžÛ½@û¤^Vs­jÖWææÀuTYPà¨wÀ>Œ¼V„3Ð0ßhãÝý½ï¦4–!­]½K2ø²â(‚Í6ò¦ Ô¨Ü{[²» ÐH1OÎ F¸ýi®£ó(7¨„7ä:jsIƒùƧ~LÝ@#ø"êX$Ùg‡wd5Éœ% ñ -G’ØÒÔE…îT5{Íí€Vî£|€©wØ|BKS3‹kKÐé:ë8Ëcê»×¨™/ÇAûÅ •|æSÄÒµÃë ‹¾½y;AîmÆœ3Ÿ¼–«+)>ùê&æ ìʲšHKú›0_ØÀ~t¼¹ lQ’t Y¢·àI'ÕË0yAaíÎJk -$ϤÄæëœËÊó9V¿[‹…ˆ>뤡Ó{1?Üü¤ Ú_}ô̹éÃ’µ]Ë~šér³íд{Ìtk“ÓkjÀïÇe¦’ÒÏõÈd^xà~Iàiy@ƒ{#¥"ÈÌÉ/øY…^¿D6zœžoy”?{Ìï+®H»÷‘ˆ` ÿý#<*©Æ"RÄ8­Õâ€\„‡…eÐËðj¸­@¬1–ÃEƒ|Û¾^Ü51‚ûçÏa(u§Ss¸èüûa†F¯Æiù=¦V„ß$Ñ@’’Ë°ðuÕî°}?*W;@èÿƒ¥‘g£@Í/rTY¶l`ϲ¼î+Ÿ%ÙÆ} Ó ñó™õã)8©}ërØ>ý’*iý]}#ᢣH©[‘¥"¨i‚±j—MrºJS ìSɟבiÁþ±$KØÁ>½± ntÊÆÓ-¯ø£Y<”`'^ƒ¼•¯`B æ¨?©ä_¤ßï›S?—P¿1?¥–÷ÇŽŠ—¶ª€¿£måÝè"é°Ài¶k–dFÎ` ™ÕÖžqï:?Z8¤4+}YäN4éEýˆMücyVYLfµ‘¦.l­—?/Z/öf›5JÉl2»`Ÿ€PÑÐB¥&n„¶Ñx#XjÞv—ëWψbš¾Š‚ŸÎƧ2úÑÒ‹¬¶sŠ½ÜÃ?ûû\ÙËeµ;Xø/!jì‰ÞG0ek ¹]ËMæ ¦ .à÷w[#ùsç4¸.é†Ý“ááé%‡»‡µ…H3Ðo}·DVý¡ïÞ_nªƒ g ¤¡¾áà|Õü:èVkgcmK×ǯîeV )\Ähº!$mòtyØ1¿¸'–e ú<»/±A>„ž - -i–ÀÏGH!7eñÇnÃ…s{Rïùutåup¹§t¯€è¯éJpd9î´$õßæÅø‹¶y”:fË¿7ÊÔR„ÔDǤ÷¿¨þ8ž.Kì‰g­œÓA³S0–èÈÖÒéµozð÷Ç÷ ¶Ÿj^Mš¯v±?‹”Aùôe(Æð‚íÄ]Äû )L™¹™Úë´—qŒ€ˆ4€þ«"@fé‘É[™=饖ŠRÖ'|6Ÿ  «É\#­¹1ƒ ú×û³äðný:: -¶W›†&݉%:®vÙÚìšéK¶g¹ØÖë—;×IÜ×ϤÜÆf}O"°hË"ˆ’ôˆ¦> ¿ýâÔ §ÇšnÜ VÀ/0“Ubà%ÌáD'/Þ±úùåf¹pÃÙ’ïi}ö2_( ‘„5ÁlMâ\hb1ÈUø]¥~ \["A¶(¹mÖG«$si»x¦®’ð£ï *ÆÂ¥±Ÿ>?YôN:xuC7†îd%N$d.ú¨§ÑZΩ|òãÅËOå¹Ïʼn(9¿!n»4ˆÒ)3¨*y=—Aê’z7e€4MNˆ¡MàQ¬Š@^ЭY³`¾¡´|Ø©26Ym°ØŽñ,ë~L‹6Œûž⻋ÈÞ€z9q‹=÷sÔY PÒíü«ÛÒƒ‰@²@dÛNP¦àa³ -—»êcОǤ -èB‰˜4«@¦‹¼êï—üÁ8¬~Ïôn!¾Wx}‚›®ˆšvïNÔ ‡}£é{m5o¯ex§µ5áe–dS¤¤T -<ª ó‰smç»70Ó_FgÝ›Ñ+²"àïP®Þä¿®S°QboÉÕt<=0ÓãéCŸ—" ‰ì®y~‚û¦;ÓÉkÈ\¸’~áEz`»ÖTÙ@¬þmcƒ0 ®¥5õÖý%‰FJ½ï:œöC´Sö"iX¾Ï$%’¿Â[ÄûÏbø‡ßw>YPÀñ¸g s:5–M¯î”?À£5æäQ{‰8þ""ɱèæ¦ÏƒCàC‹¨™ªæ÷"{ü ¶Rè³"'wM•¯îøœª´m=—°ËW*ìxÖ— ”­,½Z‰e¬í·5˜ílûÓIW½Y›Šå<†üùÙÄ-÷2IYÒJ@•—3‘Ö=Ã`’ºsÍ0SÕiåX‡pÔÚ%Êéçü[t‚†çã*Ûh6gÞL¸á=·áÈüß8N{ä¶w /§‰oïxœ(d‹ˆobGðhÖÑø\;œ5 Øëž=H"t¦¤g÷X\Y»…R”•Ík4y¬8ä;è=q´¬ðl®Ÿs4Ú¾5bßÃP“Çí•ôb¥Â&}5¶{Z¥ül eo ÑQ·p-ü !È<_³à:¼Ó -s•äó^W…nxŸxmøˆ©,¶ûõ ÝŒªÞ”ºÅcg'Q³œ3æ"H½®¬<݃p=ÅO¤±â^÷~À}./]À–™Å‚òƉÁÀ‚öþšªúµ™Î»”T–ýœ‡íâ-Þ¦w"ÊcÆñ*ÒÝ ˆâËоbëð žáL ¸8oKz¢¬ég¿:êõ'ji.2Â<Ìîëá64©<êµ7¦Ò gŒ¼d„w ¶ÕÀ+Ñ™Ž¿1y-JÉŒ®éYm!“ÙRá3²MN|ö|ØL:½G+zO¯‹"ÃùÕõ»Ç‚Æcs:¤qø’[Žý¨xˆrV#÷_ -À–Û55:B^b´Ë´³H‚ï…½Îjµ7¹‹pëBË™ê>°Îd˜39Ø×ö'2 £ ½9t:ä/0BÞWùȽ<¨­ûÒÝ5NÙÝqìÙç¯(dX–##&äÀ•8näË階7æd¥ y>CGô^V¹ð­0v‡å¨UfkµöŠ&`Cœ)ñ!]úñãÝùŠä—ûyˆ£n-(¶QI×z+6wyÝÅx!ý§;³é¶sÕ›nU£¾¥¯žŽÁcô{L¼(>Eq`©¾Uö$²æ×ÇùÞ.»=o€sÙXÔ,¤!T½QâLóQe%9‚xì_9®ÉZ8ž)ã >¶ žL|dÈ}MEÔi ïü(?ÄñºÛíÆÈd‡e"#Í-îY'ðcâ½\XAEY–¡•E ‹—Ëd -Ïñâ×8]Ö: õ4º(R³KˆÞ'¡æÑÊ0ùùUFŠzŽ¯8p’šFýòV±^Qûz½÷ü•Ú?Ò0~ÔQüÖA;š±ªmŸÔ#[5|¬‘؇›Ì^Az|EyÄ’l Ý<¡ÅñÞUj @Õc¯b§¹C`²FDZZL½0 ôçS˜!z%ŠŒ€­EIr +hÉþQ«fæ·øNŒñpX£”p*–ÁžVîò¾øñ¨ÅØvÚŒiG|?*Ëêx׋˜ &NH(¨Òæ«ê5rݹh¹trN;HíWZù{YÀéÑE¢bÿ/Æã’P1Ôbõ÷©Èíý;¨Â,“ÏDŒ®Š"i6MIƒ%Æ1ÈN›ÉÂl2éN^_§·& &HGùáÌ 4åué<ÞÖÔ‘ž‰1´2"ñ›]Ú&ë+˜nö>Xˆ w³zñ• Ò„¤&†Ów•°F¶4¸øÖ²7+¢çpó¹ÂÒ$El¬KµÁ¯{­ -k»…9?7`~Ѽ!>Ý´ö¶Q(ICDÇË/ÚOI[ÑÁþ¾óÑ& ø®¯fsVý[iÇ­*2¤&f“l&5·kkðƒÑ4)(ÌàO$dôÍ¿Ò•ÙuÊ žÂ½ºÃÈ]±·ßÅþœÇVn@5n¼VõΔjŽFÙµ4oÖàtm»ñÀÄ<ÙŽWÛ-òÞ‘Û"/WV8[yÉ>8dȳ~ßmVjÏr~Ë)µÚ_›bgÓã9DútIWô…~WªèðqÞ©¯«rŒ^Fï3F;Ä¥5šÖÖ«S‘ÃáÃák‚Cä©o¤8D…úï¸BLyͧØ›[Sý4›‰š:®ìY߀Ø{’Å‹MÆü*…^Rì¸ ¦a,Ò2!Š`OeÚ±2Áú½©p5öÅT¨R}¸o—ïj‡IŠTú>í°ã˜EÑbKâwUÐÄk^PÉ3üX×,0Âk|~. »ø /ãô.©ÙÅ &*»é,Àµ%âçÌö«hºX|·ªñ+Š¯pi‘ø¼fé9G ip‚>V!û¹åWU±º»‡HMµUµ±“±è |Uk§äZ[ÎñƒùO•‘R0€ ê½µæ]~e$r•.üÝÏ_í•ïI‘‰lÊ\Ç…b¶Ÿá}«¿ËÛ§x Û2Ç*0oÌ<þ ›’ûBB™Î#dÿgn3Èxî’kO Ð}”(¤,«5yB娾'ZXË:ÕÝ°£DgR"¼øü^\!Jsà• FR„„µ»¾…qjb"g>{[O0ï#2W²†¼Ð»£R|d¼VBy°QÊ3çÆ0­—€}—Ñ·Á¤³G![¸]Ú9Þ-{' -.Ò°gË1§†2%úFÆý߸ ~{”¢ùÈ.$ÙR­èÐM­˜ž©¹`˜m*r¿Gð%I;o u9’˜f*•-·ö¿o‰Ð±BOZ)¨ìÑŸœ¤õë.¢æº–Õƒ~Ú|:‘m.¸+;ibMûF)ŠŒ~¡¡‚Ÿ&Y§sê¸Ó³é¹¢¥>ãK¿åJ÷ä0t‘£tÒahc7 Ž\g#å½ë2._¾sU_æ$¯j]͇hØÐ÷µÕãšµŒ”D ϼN@—‘ˆ*¤¤DqùPà3¸µ. ÔYªÌEËè³y&ø“¾æúŸ¶¢GSìr¹ùÖ»(Á¥ê’™ûZþÆð/Ê}Æœ‹1ÈuˆDSøT¡èMEä°XrÉ  ŸqÓ -0=¶wÝ.-»Z408Š3¾G–¥áãü¥½5LL¼ -[àòá -0'•úÓ‹øBvÝîu”8 áïÊíå³dÄø]—!ôÖü-6Ÿ3æxŒÝƒèœ%“'ïS¦‡\%ßlìí®ú ùmèÔÂÜ´mžÊË×£³\ßÙÅz4Í •Èz¿šaßN“%j|ÌKèÜXÝÛ|o6Ì…fÕ²ü¶ƒ -Ó´üRιÆÁ\¼ÈÍo&I_Ç2ÕP¡9=ó’Oä 6÷Ý>ÀÜBþ|òŠÍ`ž]üý3á‚´Çô+áü&±™ÊïœÉ§Òã$y…FÔ )#QWöʪË?Ù´˜$J‰“½cG1-ßO6H:ðÒ9Å'}yU>+Û9hõ|3S‚ÞD‘Ûï!©`ø!ãË~®Ù¥šÖ4uLŠa랺£içBž Pd{®Ú˜Ñ7ߘF[æuºþåQô80îdû^uŸ|ª{GLdŒ8‰ñ©Ÿ¬é= P5’ØûðØÄÕ¨buh‡PÎu µµ`ê­À~äX—YÁD› ôÚ2ÄT't+Œï²…0W$F¹bNUáxÃèÞ)£±Ì@{SÕç'·6FÜ׬?6Kº³E…ÌÍY{ªTÎWIÝo•²æ¾ûr>ˆ$&ÛæY!á=’¨j_çDþä!1Úµptë¦$žÀ$©gÑ>=qR9[XºÞ£Õ+âƒQ÷ ºé']Œßó‰­ú¼Z'Ôß:ˆ¸Àìff˱ÿ¸ÐBBsÀI»Zíüðµþþ¢€êWòЧBûnR›ÕóÇ$rZy¿…‡ˆ¯í7™çÅmš¤E#¿0†*\.iF#¼ÃÙ#i~]ÄŽ–ÊùëŒîÔœ1'ÜjW}d ‰}Ð7}·Õé7·VØòƒeo6Œ·¤’%ÉZÁ¸Ìº?pëÆ›ã1´eOȽè/hßìk`gö¹¿h³ÀÆò°’ŠwqãVp{ßXã6g‘{Ú1 J\&Ó´àú²kI<Î9(fNæºVxbË€—¡ÁÇŠ?ꆆ<>Fvïm¬BÄì–E ÙŸ5 Ær‰¯xÀ&ÇË&µ#:‘"Ž,\M’ÇÌéÒÂOk"fh¾àÏ’Êšñ'øm}Yë±Ñ‹·ÒZ\‚Ü $!ޤͪÝPxDC[üéº)r9ê¾Q·,ëÏÕæÈöZ³Ý`”ŒÙ-Óý–,:LΉòæ?Ï)äüÚù°Ißå~H0Q¨Šç£*^ý´?‰Æ.Î…hP”?ÜòC[<‹Ç–Ž•µi*e]®` 9S¶z‹,†Â[ó¾Ø\̳\½ïÊxKŠ>`["1~û È°Gu30¹[€³#¶ÿMÿž!¬|¡(6ЙEíš4Ö·-õ>5 ¿Ÿ²OL–Wo†®Ò°'Þò»€aiZq>gE~giGg|Úô\£–¸µ²r""óèËk}ƒ"ÜШ<ú¬o -3u/4Ö?kóbÒ¬ÅÉÜòF_6Iæ}{`hMnÜ—›†þ£R=z©CR›qQ­¬#%™Iô¬Y±Ö‰ü9`Kj-4•t¿è•"™ÁïR™Ä<ÏU¼T5ÏŸü Ö¿L#Êpœ^öNìNRÊÖW¯ÿ¹aÍ­Õê}@º!Õð7ûOWHdÓ*ÍÚž|Z=Ì•>ñàJŒÞZŠf-weÎ9Ï{çX‡ù©½×xóÏ•K8MÚ…‚s(—«Zä}”á˜ü°ÂrÊùóó.ºYÎ껢ƒ_[ÅfÈcZ0E:‡HÙ…èÈoÒÖrëtÈ÷‰}¤0Ü^÷ª±…{á’ëÏ þ®}Áú¾³‡äDЪˆ‡~û.‡•&¨ÇgÇédN±±$«3ø`hI Û«ñP1QRÎíŒÂ®ÿçVvÀš­%#ó¾iw?;1#a’ÿ¨ççó/.ãÔXïòdU™ÂCj!m$›cgÔdÅìw8Y'+˜ÔäÍz®íÔvE åÆ8Ò¯î«`§Ø—¬jÉ¥Ô`^G7rð,©_ƒv»^"^E"FÙIxP *2õJ‰Ç -µe¼l¢‹~LÖ_3m²d ­¯‹ îcxà3_ÕTtP@Pèê£P|iÀOU4qYË!º"RKåŒD¼aË¥ùÝù–†œ­d7K:ã×&ùCˆÂi(U&°‡^ø5MPaDͧž÷S&*þ³·ÂÔ‰Ÿ¨ ºïII‡Ç=Œ¶ôÞmå®&…[ i!›bl/Ùwn³é&£“Á ¢AZZrÒU“O‰Xá9R¥éôÔÅ&$wØ]ª© mQŽIæ~×$j?ŒNýa°8kÌn"ÿá*ŸrÙ Èd -Ñëòµøó‚ mÝ!¦Oþh_ðJˆ7»Ä,BTÔ{aµÉ=Ž¸kþÔÏ^¨/úKŒz¹ŠYÌ„S:n9Á¨+9ÅÆ7(èe7ù‰a½³v¤ -Qá´l1¸….Å‹D”+KÑ|שøŠ<ÔÚ̇ó?»—‰õ¡óèeŸûp+Vï“â¯î·Øž÷«Ç¤éñûÂ0ܼ2ó¸s‘ª˜µõ þËâ-ÉäÁx…F/_‰(À‰°Ÿ›ØhŠØSIª§ž{¼‘D©àQüÁOç˜â1QÑW1Óïü˜ PeXO¬D"¡ÿ¦nϸÎV!-& 5aäêBˆÿð¢/¯†ìf5êå[¸v¹ŽÝ#gþ´÷G’šoçeࢇ³®bäÉ$‰W·h$wo¼¹å€/9àt~ìâ/ôµE]7·ÊË(QhIÇQŠ…5¡¥8úvÇEØp´¥o»XáW……Ø@æS‹/º©Û[sä}¾ì”ñâ=©ÖiIFQþK΀êÛ ›[ÖÿÃêÿŸàÿ‰ ÌlÁ@ˆ‹ƒbƒú?WÍ4dendstream +/Length 11276 +/Filter /FlateDecode +>> +stream +xÚí•e\”Ñö¨i)‘”Jº»¤‘A:```è’FJRJ¤[º»;$$¤SJºãŽçœÿÁsîÇ{?Ýß•/>k¯w¯ç]{¿kh)UÕYÄÍ & ¨­ +‡ @RI]ƒÀÁÊŽNK+é:¡¶R@' €C@€ îlà„­ó rq rq£Ó$¡vî` K'½$ß$>€¸ Èl +´(,A6°=L€:Ô rrgˆC µ?O8Ô@Ž +:À lê0Y€mÑÙþÉÙšC|ÿ ›9ÛýÏ’ ÈÁ& ‡I2`ŠfP[ˆ;À dŽÎ¦ …ÕÁLþoHý÷æ2Έ2ÐæÏöÿèÒÿ¶´CÜÿ•µ±sv9” f ÛÿNÕýSN dv¶ùïU9' l*nkØÿ;Ê€Ý@fª`'SK€9âúGdköß°ÆýCMG[A]B‘é_'úEU ØÖ齻ݿ·ý“ýæxbXÀn=vVvvX"ìïþgð_ŤmM¡f`[Ø•àá€îè°»#ÀØÖ ä¹ÁŒÙXm¡N°G°¦xÌ¡èvælæÿˆý9a~B.BžûOòÓ2l¶7hó‚¥Ø;C@f&žþ¿WxlfPèðâ°ÙLA¶¥ ükƒÿ|š›– +tÙB@æE9þý¯dØ[ÿláhý„ÉÚAœŸ0US¨ ð)Â`³t·³Ù>…xÿ¡†š=…`ÖŽ £åS„Àær€>`/µý›y`öN®Oë<0o'KÐ_u~ê ÏŸÖƒ]þÊ€é:Â.Å¿&ërùËvØ@ÿјª-øoþ?ï þõÀŸmlÀÿå… ‚ìOgÏËõç\@Ž†ÑSæ þD°úO«-ùD°ÂRO+*ýoâƒuGæ‰`¥ß>¬/²O“{"Xu…'‚UW|"Xu¥'‚UW~"Xu•?¬ºêÁª¿{"Xuµ'‚UW"Øy¼"˜‹ÆÁ\4Ÿæ¢õD0í'‚¹èü›`ÓÍÄhj rú{.ÀõïøÞtÞ}-ÿ™+øt«`MžVÐôé‹f‡½½Ù_øçÜÿÂ?·ò/„iXü…°Xþ…°ü5:ØajV!ÌÉú/„Iý5XØaVOC„6,ÙlÿB˜ô/„YÙý…næ_³rø ÿ|&!ÌÊé/„Y9ÿ…0+—¿fåú×l„Y¹ý…0+÷¿fåñþ™¶fÿ3&þ÷_ ¨Û؇Æ °sáãðúÏ< [0웓“‚ vv~XûÿDM`Ïé¿É° +ÿÃæ`ØOä2EŸ›š +}´úRTè-=^„Ä/aQ­\Õ>Ùò<`ö3<$oPÁžq©Rû¦8ù%ÖÒ…ë‰ã§fÏw#2¿ý죧¶\Œ·’=H´O’•Ü7í¨.ö°›j§ÎöyàU¾/ Æéäô¤õî}U¥—z¿ò“®CÏ¥º#å#/Ÿ¶L2D#8°ò5¥N¢}awð¢+N\ ââX€·U0j=ÓÂ1´Ù÷&53öAÿ?ê…iËènHJµÀÂÔNõÀDb;¿SÍÖÕíY TÈÔµeƒ´¤þ…´BBg'FŠ^{&uõÒV)ÜgšSùÀËIþ¾‚3ü³Fý)0PŸš+¨,{\¢~65+™ksYHú¡¾³?ç@qþQãÎæÍúÉh[G‰ ­yÌU“ßKPãŽ*A©É]ù{ TfVÝIY© ÉT& èMÏÌ%ÙWÜÛIï„ÙñvbÉ +õ2S¸óWŸ&Q¨ŽYš¿÷V7wF —ÿ,·¸¯†ÕøÒÚmÕ®’€ží˜ê7æÛ:t†wJËžˆ<Ôáx-ç6Y’/|Z/¢¾ìÅ븢˜öº{7’ÈìWÌ·|µ¯"QÅ60ºÝ¸êÚ²â–ðV¤áõ»n›#Q9# …¼Ùeã@ê$ +ö‚`X»ðßð*Á!’–¥ iºÐ[¥O ÈüÌËʳ;Dã½}‹ +œ.¡%–øE³ó<ؼ:¨¼c,’žvå A:š2H¥A•søšóQÄótHqÔ4-ÝÈ0þÝ×/Ûf}Ê©Xº—™ÓäTˆ +E-Û´Ìð` +r6ü@"·T;£Æº>ÆUþºŸ3’Ÿ1êÓü4ü’,,|’ÌKV1M_1>xÄaGJ,[\®(ÔˆZM¬c~ÝïcscâÛvjë”LÇŸ$'ãPöi¡·Ç‘~E‰ëׄ<3a™…GÔ{›¼¿dºæ0ž¢1+ãÛ:8’uPp.‰¦â³cîQÇõ3owÞ×ý³Ú8Ü1€FáˆHœ– ÅèÎu[!v²zHäºA°Íˆå¼öÚ§Ý|%g–+"Hå|B!¬S3]Q[ÔB‚ÊzøáÉ&‰!*¬%’.B}š‰ …íàäðÕ]L~ÑÏ’;bæTQú€Ã·8r‚Þ¯ži…ækvcéGýÆ׆Ôž­èw5Z•!NÈï½YkË‘G{Œ´ÄQw)®Ñè~yƒØ ,oݼò©-…?¬4.³¥–ÄåÛBø^¢† «½Ozð¸nÆ2g±, +ZtØuˆ÷úÐ~=¼šÝ¸>ÖÇÂ,;ý}-ãUäE1eÈXo“])@+h×6-Mh¡L£à¢–‹=ผ%ÛÞä§ÐàÌ͹ág+­ëžÙÊ€9p±z´H=¢«Lí6D$Ô¿¾4÷û­¥ær¸ÀF=(ÞÓ¢; ˆš÷[ôÓ³ñ«~Ù½:-±SfEXÇN.bÛuûðû­8T¹çŸ¹q‘"g@·Q9ƒª&[ù«<ï@ue­b“*cvš2¢t—Úƒ¡’f~8Qv×BÆ 9uïÀfÚ“0”Bõ1RÆÆyö a­$=óîÕ²gvSWn׼ꖷYÙ^õMPhIÜ-Ï›MüüÐåX‚ûøÁå„T©¥ä룭æ}Q bÙñR‡½ק¢VØVi#»ç‡žèR]hls¯Ëœ©±Èä‰Ç†ü©ùtY'È*EÖGÑ7Ë.r2ÖÆæT¿g)‚täd·ômÚb™‘Ø'ê(cé1fFLØûÄhÚ®Óµs‹s´]ìæßv2ÌÖsm‚Êà +YÄÀz;žcCõò:¹8º‚ø¾SV ©¤Õ C)‰¬)&ñCÆ)”WŽŸ}‹iuºÆ²÷’ÔL½ÎýÆ»†±eÞã÷lÚÓcb«]—1ÏYB–¤D·,ÇfX6þ-dár +®¼ÚŒÝ^kÙк\b¥ê˜où±VÈÔ»^Ægˆ®x|ßâÖ¿Ç£¥˜ð¨¸ ®¶÷P¡ÊdݧxmÍ÷ŠØ–Ï5s“íçÑ·X‰íŸ’`d¼7&‹‡†²FiögÙèv½'Íc î$ŒÏøµ’I ¦cÀ)Ö+Ô˜Iê¿èåÒB~|’K:¦rß«äþŽ¾â©²xƒíöõ‡ +ürƒF!Â{Rmåš7ƒê¬ÕTaG Ÿ=о/–²§ž*¥¬°}À‰ç©Š¹¬•$þ„X +¿”Í4éeÝÒ~ùšõ÷4¯g{üD8õÿl{× :Pò”KeV8ç>$OK…\[o¹ ½°?3ÞäÓršai¹Ãj ÇÇQõ×5=B.Õ[ìA)£I?ð>º¹Ñe¥õ_M‘׉%DYžô¾M$„3jWš&XŸ"ãt%ö•¬'^„"úöv£ˆv¡e#°þô± ¬ÏG/Ë ¸¥ ‹]‡‹Ïô*n«eèÚvã&x¥¸-!kßaöù6Ê5uTç};Ç‹¸øµíе/çèÜGßCõ¶Œ\ Š,ÿÕ¯õ ï8+Ÿ” /œ¾E¨ŠÑ`†Ïã,ÿ¼5ñŒHihv¾ØÊñ6ÜEš¸‰ïi¥1†ÖJ’Ï]º)–ÁW¶ÙriÅÒ7±õbŠA7ÇJþOÆÌ¢9‰Ï c¾þ0¾ ÈÒR |¦‚»Ð˜¥ ¾À{+ëæZ~µ9+;("ÔqÖmALûz¡ %¢E +ó'ÀkMÀè“ÇEª®n§OGk«¿GZ“cóšxWÅÌïA,ÌŒ•e†šõªO¡HØM©( 8µË©vªÀäÓ£GmZiÒÈ•ÛAÏI îR¿œ=Ä»Vy·x”ÞÎöF +—ä'\K²¿Iã$ÌTXø{ÑžYŒš~ÁÙgWbëÈHˆ†`ð«,"^ü]˜pmHùLÑÕö¡i!'Ü&Žµþb“ì ð‘-¥ƒDu°þ&< +=ÀUZ(o¥nzÃÓ×1*ìíºøã€ÒØžsÕm\|Ço¯Ü-Ú| Åý!±tÐ0å-ÞýÒ–¤Ê"Ð]‡’¸±RKö0–¿J1r+qc2ÎwL¡w–ié튤Ï\u«qc˜) þšsÌh¯½øGÔïMÓ–3ŸQ‘:–,Óf£ÂRÛNKŠR« Á«é7!þ„ ŸâÌ´è‹”=6€¥„wÃ-à³–Éaªx¹¿x%)fäχo.êu¶­Äãhýêå Î_i[4uÄ?ǽS^@ T¶–,€Ã ®)ò±ÓtŽ=í£Ï=q8ñ¢¢T44ÕËMˆj$«ónMüB5ºCf=²•ö aÄ¡³ ïÈaÇXx¾Bù X$FfÐNœÖ3ÌàZ©†Ä"F+Ë™•pk À]I5Ò^¥P#|Dö¨=Rð˜†{‹¬±®pÅ+®a¿k¦öK5ÙžDƒÎúŠÆàïii­ðáÑ9wLØÄßÙ. Õɬ¡¤ÙÛ9u&Èc¹Ê©Ë¨ø¡*†;k8ÝÌ«0ï3¡St•sòÓšFÊÝʈÐé&~kªÒÄ-–ðž'Û²·QŸ0×ò³hèUßÃêðÊõÉ0¸ÃH±g¸ª¯6ÖXc½ ôN¿[üXÊòC §Øý’§B*Ä;ÔÆVD™~ã:”ýYåâ™p”Q&ì²ãw&H˜TmÏݾüúœéGG E5RÙ)ÚÕÄ  lkßwçjCîó(2¿WÊ5ï!ñ˹‡è­î&‘.ß ªê];Gz«ÛûGv'‰ú 1Xr –óÛ©'P¶·håÂS„wIä³ç‡É1î^OðBzÛα|ß”P*)Ú&Q"ŽÏ}À¬âRT±—ŠîO}•ª³‹x,Ò^3Ò¶ÄPNÄþvåì /êøiL~úseµì2ßgf ‹ùFGI_Û  +o`üˆîÉK1×ÂðÆí)1J~U}ã唸;¼ôðzÎY "3 !Ñ#ðÛ£znúî„{h_©PÚ¦BÈÛ æÌxª®•và-dHý­×nÙËb3©30ûô‡'°ëòÈj%­HÙf¶/]Vl¯µF>Çd»îóüÃáŠÚâiŒ­ÄNôº©òõäwZLcsÙÙ9$UÈèØ}®X÷¥­+ 7\Ä"ã}_/Y­©í‚²{¤Å÷nGekÔ·Ö{Oà˜xì/îJUñ’biJiÛ{ÄM"o8%Ì¥¬ß¾V¤B}Ÿ¥Ö¥ó¨Êh•%?Þú°qÒù årù£ª3EàhW+1…/’7.ç€Sj®¸¥è~GA‹Ñ2so)òbuîþR<Ötðœ“uÖ1Á¯&HIà²[_b{î ‹ƒÐî¥Nº€‡Ø‡ŸCý5$Éøét‚æ%fÜÂÍÉfÛZí$ÜÛÕå·â§ëz?ï •ô×eésj·hp—Œ„u­òè ßsÝq,¿¨™ÿÆŸ,Ñ#šÏ8->öòïÊlö{³Q°Ü6ßTRÇ1¯Ïëº~!gÎr’‚ìسF<ãûžI#Ý×Ê‚ˆŠ<=l‰àÓêN5å ?úð°ä¨ž‚ŽK§ý=# ·ÉuÌè’S./™f¿zDuÖ/Ö&ˆÆæyÚ¢–å³ø H*FfÿªDTd¶~¹ÕCÑAÝÌ’'ö"¬¹GƨíĆ¥]j^û¼$½UT]yXþìzZÄ­N.S‡¹«ýµQívU!ÜGÝ6J›Ý×2íHSG’þqÀÑ(]²©ÖÓ¢ø Eª^ÉÍ‹Ö}„£ üª/näéIy2¬Ù¶r>…¥‘+ ቼÝاo1!l'óuùhõã›ó†‡ÊÊbœ1¸ Ø€}®!£¨é½'±Yav¾+ƒwŽù§;„ÀÛI’íìL>©íëÌå£"ìB³½Æn}J‰¯×åD%žÛhîÝȬÀrÙ!Îå ƒ5ñªU{Í*$…ï4 ^óéá—#©°~¥à£,%=É›"[âw[¶`2é­ +Éö²Ó¤W²º êgÝM¶©,ë2š’/-Í,ßGjç ý΃bÙÃŒ0§´ðáVâǾ¨%ë"szs'GDn1¹ÕµÏdî²OŸW…›óX0CZ¶ö+{ïôà‹ŒÖ{´ÝâH2Ó¤üLhv%7¿œW¯ñçÛ$2Û¸-;™Ö¦þÆ´¸²<ÞçãY‹¸âphì뀨­õ«*!¾áaÌ] Ñ­¸½˜°~½Dƒæ=p|{#83‰á ߬Ý#Kªšá¼­ý)³Tk‹è)kà[¾*šÝ)VWA´ œ£™R}sú›†ÏNy\²LòZ–ûNs㎃ûÙ0ÜR¬Ó·Y†ÙÈìó •g9CV+QØS8´¾åw¤¬ôí8Ȳ—ߞɩš¼ùᙆ8۶߆–CpNª®po¢)]{ý0ØAüu7Ù­‚w-ÿV0/¤ë¶„ 'ð]¥¥%¢bÉý˺gêp!ÍëFµ²eŠìE…Õâ~æ?±J‘¬ITß¿M\`XÉ“Ú·]pèU^wÍ›ÒpF5}›çL’BÔ\ƒ{eKvÊ5kœlq#OÃJ?:.¥¬ò*€Û‘S˧dt¸DÓ3 J£Ï\ƒ]ª$´ï°`.Oz¬Øí°ñ‚}#äê—`ËÎtÀòU¬ÈÈ¡'¶ˆYh>Ö¬ØôˆS·YßÑi°a,Ÿ;—lîØÐ$@=É„*#öÖþÔ«\…h6äJÌùÜ»º#ß6üÓnèusŠø—Ž¼ANùÏYLßG·»iT‘Ü‹Ö0²nöû¦ ®pmMèóÐÚÜÕçRÕÿ*ý€¼Î'ñ»lp^ïø}W¾ò.]ɼVò·wu*¡^ÂùèÃÆÁÛBë•­üYÜÞsõHrbð|áî‘…)‰‡\¿ÀÁÜÎΦ„¯¯Œ^ixÍvrN—4CÑPnzFNê²ç1”Í]¶•nùºÃòcIª­?ûyp|þÈG¤iÆÃB»)Œ&w“¯«”Hö¾m{»k\wG8%n€( ·½·#î€ì¢å{Œ’l‡Zv‹üiÃM•d” ¹Ëá¬D&¦ sþ9m€.§lÖd`—röM\‘‡<¼÷Ò!ü7o‹X…*ö^É«98CÔ dû´¶Ù… E7àwöó­‹×qSB<îR|ÚÏô'Ëïzò¼NéõÏqï ?¡>„5t;œqJêµH¨ëÝÄÇÛäÈx +ÂL4E.lo~#µ•?iiìyr¼Žô8ùýš×óÎ1(NÅ8#}^Í8|®=¨:ÝLÈ­-ÿs%O­ãÈÚ×УPÀ·–GÕ†VÔ]Á%³—n ž¨¼Ö zc$‘ÃMÇ'ßiÊå—9ÊGlÔ£„fŒIn}@ž÷úcöjHtŽ6ØÛod¯™ÍoÞHÑFâóÔÏüîDOÏéùTöðô3ÊLÓã •öÉ›‹YÛ¸œÊcÑ–íð/ô’ÄqF³Ž´W)ór½¹±çL‚ 3PœÔû ³$æ|Ó~]¤ÒÌdWc¸0í†Wðmœ -—°¯vž’|ÿ”º¦ôNtÉ,=o¯ŒUyª×f?eVrÔ]e5¼22›×Åœ¥u(m³gÖlI%ÜN&…ÁãºG‹LWGðå÷Xg²¿¯vm)R`›”4=ãqÕ™õ¹â¼LÖE-ó±z•º½ªêÎÀ¯sUÛ/ðý ܱjx´ÑC*FškuC܈oÝþkx¤\ Z^!ðìJ…¸ +Ǧµ /âñj zRÖ­(K{Ä£¥×ŠTh3½%¦¤Âs1…g:ñØÁR/ß}$ž$Ð;ù© o.AÄ#×Qå·=×Ûì»0ˆE•Ù¥‡ø¼úÄOܽEl–ù¾×¹ì¾šDŠº@5ýöv,0ÍŠC:!Ó©lòzÖOA?ÊEãªàÔ¼ ­¿l‰[’w¤ØæG þêôåÚ©Ÿ] àÊe t~™õ³Ø7…ˆ×ˆ&IœªÙ?—Ô †Á¦¾¯h©òž›{Ú›Íç’‹Ih +0Ÿ×9%t­„-·eyýÒ“v·tïÈå¯CSã|¬ÒgÆos Z?]Òõ’Wøt!ÿ[þv[Œ  Z]ÀXøö³Ï™¨â÷ämB¬ï+{š{f¨?ò72r^h~ÛùI±«TÍ™q¾Çtñê»ÄL§B¶tæAÙÄ—˜¾èš9-ÖÂLŸ®Ñg—•±¡%E ¸s/®‚ß_•ç;Ôᲈá§-ý‚—Šú-뺳­úýQÑãÈ…íÇô¦(·˜Ly2®!Óat¯Ý ­K²ÁLÕh#/õJ*·´†'VÎQ³Ëhr.â–•f«ïm.öžùy—¾ÎþêT0Çx;<È£móTÓ§˜áø°Ö'*@6„¸¿ª›P…µs.Mûë<ÑÃ\¨ØêzD£œ¯„[¯Ç@‰â.þf jر4Æ•q\ã à$G¶-És{^c^CO5<©¥&q†ÚÁðéÌäµÍ×{ýl +Ü+g—Á_EÛðÚ)¦.¿ˆŽÐ”¾£wCp¹TWra±°P"Z—Ïy87WÛÄäúô˜Õµ¯'$nkyN`w® + ë3> „š#“™B;lfÔ?ÄB­*%ÅAWãÒ~€ú’$ÅÏõ5j+wVì +,NoïZ™2FTgB5Zßç +«Ô¿¢(† ÚŽ`GìÏ&Î{+c% ¬Ò맅‹îÏ}Ôà/4Ù&ÃÒx¯}Ç‘¤Ö{ÑsJ•Y:E:cÕx¶±«|«ÏúƒÀBÝf­ÃÌÇüì‰w©mƒ™Í©~P—Ù[{Ùv½ìöUì¾ÞGe“úÙpù¼sV‚®f'·FÑ2ž™ÒÁˆ_n8¥VàrÔsB~®5ñ–EB-~Ë?có¼ò—ÅdWU3úI'ž‘f€‡bRMGÆã ‚È/å(³»1‚çÏñ%k¿E t4u®¶Jy9VÒ´t†Nö{ÕäÄ;”tÒ•Åî…`vú…Ñ5/Nniu빬/ÈØB.DáÒŠ¾´5KèbpúħêbçÀÔô ÒH:l\M¬ÐG*ÔÂ1ñ¯ËùŽuˆ#Ã$FÅÛvTMR?ð€a€ô•¼ÛÔèkæzª±64ïV…‚!¬ü·'Ÿê˜ó5¾%~FÜ'¤%`ø`•²áz9³%ãà«èýº"B:ŽÊÈ1»ðÂNqXŒÉ“ŽOâõ¸Øº^ëŸ6k½ÀC˜XÝ{Ë +^¯ÛÓìw]©Gþ6¿)ª\*®³ÊϤ«yx-pt¦Ä¯ ·Âð®æšÎ¯xuZaÑB¨…í- ¡fˆGè¯À{% +ÎØ”| +{ä\§ß'¯ž»ìô¢—–î òjUÑ¿¦ãŽÃêÐ ±Üèúï«ãf*2Î?ö3·ã L“XÍ­å¤6 +ÇÞ®|ö4MonL0à3/"ôw“È#-‚4L»Ä¬¶¥™¤ñ]z½òÞ{Iý{§õŒZ\‚B±Ü᯾>¢ÅÆ*ÖµûÌ9µÄ,f‡FP¡\ÞÁ  ýb[ŽzÏÄÕ¡Q–ôѾýÂ.º@îÐ>ÙÿšÊ¯±·c*kJ%Ô¬¬ÂõX5¯¡ÃÇ¡rßb`>,³ùêó‡zLõ¦¢í†]0êö ©¦|!´yPô-æ~¼G/,ô°ÀÌdZvZ_GƯ¸W•p×Òrˆb·Û«1ÈcQd DW@`He˜%ßfäO*§QÓ1®bEüS~1ÒÒƒ¶ß…/'3ZéT$ô +Rùî²ÒP\—ѶW˜¸U@p +›óQ~oßÀÊï瘲“©>¡qfåï´uüaO[3KŠa,”H\Ü䧉ßòÖVïIô•ðñ½~ Òú&ïÛ¥/ÁÄòÇðgÞv×bh_:¤x53?S]Bûwh^6íT®>»¡mX‰jfæï¦Û}Qlò'J"nƒØŠa¼Û™ØEÕ)ž¸ßÍËê/餘ø ³RnZ§Q²@S†ÄGaXtÔŠq"Xá9dÏáÕÂ}ÜÍå®J~KuÅ’ù@N ßÝ»À½$'.¬Ì#Wó³óG©éÏG ×Ì +ÉãHsÊñ«I¤Ó¢ê[-FÔ’|½êѧ´9¶Z¶E¹! s+)y)¡ï+î¬bMŸxÆ_Ä·U3£¸,΃KtRCíe½B1μw]r +œªÅkÛ°LïYªn©³!?¸'>?~ÞÑvÐÐÖ¦WGIl1•IU CÜÄW3ç/:óe?c^ŠñÓ±¤‡JýøÌhýMŒÿ¼õ·|ß?_B7N6y¡9ÖGGèÝ·ðnÝïU_Ôì4)(ÃêÔuÝ‚¢92}M²*ÒÜm÷X_Ì æÑ_ÏuúžÌMZ%gËë¸f¡§`'Ë£7-‰@MϽS.›^—¾ÄmfnøäÉe}tVvrºÜoÉD˜’yÛçkÞ<\j6Ò7¹4“ á–006Å¿Ll,p*šLð´[ïûß%øuUŽlq>VdÞoÍPÌ^w`ï3è&ýá¾x¸à’›»h¬*~6Û<•‹ÒÝ”Y¼læiBëŽðš"œ‡GcÎEo[Ò™×ÔÐ'ë9ãN§"ožÞ’‚»5ѧgô‹ÏààWý +qæºÀÊ}˜@6¶(4ñë)‡AŸ¦Y}ìµ4iK‹Ç«gà4:¥˜¢¯–¤*Ø õÞȳò"YÒHkªHâ¼®?¼Á‘Âùé4àôcfp‰y›¼NMå%¦Ù ÉyK²ËŽ¯2}N¬¦ø.{‹|e„{m|ò«["èNŠævúPnþ’¢m¡‰=ñêôÆÛQÀí6­Õn²v¼HD~£³?R-:ÁÛ‘× ¤© +| ©±‹žÁ&Ö3[«È»BÖ>r!­Mƒ´ 0t I½ š¢”XÍf¢›~¢Y…ŠŸWÎ?5ùö*óòÆn‚d—‰xàÕ桬ÀÝD»ØmJ²‹<ö7ãâý^g´@\{êüMT‹×ÙýõxAš:>ž½ÞV+I¡¥ˆ€—¿y“R7­J_|‹;ÿ0L¼1°0#Sm*—Öô©AÏl³_÷ù7z…j‘rÊÍ÷”¯Õ¿æ—O|fäË•h7øBiRB±ê]L!‰˜º }zþDü2Rœ7È%ãA-ŠØÐÁfê’AeYY÷Ñ+ºÚ + 1ã×Ô3üQïºs·&HË¢kĪB˜æßÙäÕVvµƒ×”§Ð{̶Ê)&}£Ñ¿š¹†r íøõâŠHÿCYÖ4}pÀ‰ü—Ê™|µª“I6ÓLožÐtŽüÛ»Óq–×ÂÑ'J#§Ê2UCqÒ½véÛȉu»~EÍŸ„ošˆY.ö^¹«9M:Ú¨ˆV~J¸¯ÈŠ(½òOú)lø í):ú,û0”"Aòº}ü˜!¤ÚÙÂVsHœUä|¿hŽ¤þòesi¾DÝïïB¤Þ_›Úvçâé0!гŽÔ˜­MfÔ8>TÈLnb—ºÄ#¯#ÂOâ˜>'(Ç°¨NÐ!îìúkQ¢QòSÊ2xBöàÁËPÛÅ&/ +Ndä¡}IùH‰K‰ògh¦™éSÊzŸÝ†jµßQ8"úVû§¤ec³¬z]x¡6DÍÝ\D335ò| QfÉ0í{¤œ-¾°{QUvlŽÎ$M­=¾(yùÆ8Ϥϰ<^X‘¸(4ª¶‡CãlÂ)Ób f»ê‹Í£ÀBÇ©mßw©ühJ}¨ÑƱݦÐåO±¡ºUòdg<«Sq–¶ìŸŸÏ2‹!óíY æî¿[Sø^îÙ󩜩|(f!À¹ê"£Ð26´½¼Â:7iÀœÚÍîKG—”óE#Ö sužBÁϧxF÷ÛA6˜èK„e*û¦«-ÂÈ +ÁÓ{¾ÙGqðíwš=YZ“»ÚgZ–1x Èt/•?ÄâJX¥+\Ê™F„ÏèâË åŒ½ˆ:]Ólì$­³Å¯iŸû 1ÝÇå^Œ~³ºŸJ[wå`5úý¼nQ>ibˆåi‡s\³ä+N‡"DäŸG£þc‚±íûªüJ„ÜÀÐJÖݳ+6>ã2&¹Ñ^á|¢Ð—•'gÇØ §ÖÏ°#ÚrT_ÿ²§É±^+O”3E9JR %Õ÷µ^»[µPrƒË§|t~îŸQˆ¿}YžZø{3… %È£ÒO+nådHeŒ°3\È»wj¨¸õ¬q†B­øõ¦È¾þî/_»Áݳ¨û.¯‡Ú¢ÛÖ€„Šeß4çjôoI°”&J=)ಇR$7¿ù”õî‰ósZfŒs§Y3¹Î`%Éé.Œ·öT—3÷v6˜z¶ƒ¼ø®-2Õ›ÜÔØfãHvƒ÷£¦WËOJž³ÿþCÿÿü?±)tp‚Ú¬ÑÿåºñHendstream endobj -3969 0 obj << +4115 0 obj << /Type /Font /Subtype /Type1 -/Encoding 6699 0 R +/Encoding 7213 0 R /FirstChar 11 /LastChar 123 -/Widths 6706 0 R -/BaseFont /RLWAMR+CMSS10 -/FontDescriptor 3967 0 R +/Widths 7218 0 R +/BaseFont /YXKSBL+CMSS10 +/FontDescriptor 4113 0 R >> endobj -3967 0 obj << +4113 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 -/FontName /RLWAMR+CMSS10 +/FontName /YXKSBL+CMSS10 /ItalicAngle 0 /StemV 78 /XHeight 444 /FontBBox [-61 -250 999 759] /Flags 4 -/CharSet (/ff/fi/fl/ffi/exclam/quotedblright/dollar/percent/quoteright/parenleft/parenright/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash) -/FontFile 3968 0 R +/CharSet (/ff/fi/fl/ffi/exclam/quotedblright/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash) +/FontFile 4114 0 R >> endobj -6706 0 obj -[583 536 536 814 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 319 500 0 500 833 0 278 389 389 0 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 0 667 667 639 722 597 569 667 708 278 0 694 542 875 708 736 639 736 646 556 681 688 667 944 667 667 0 289 0 289 0 0 278 481 517 444 517 444 306 500 517 239 267 489 239 794 517 500 517 517 342 383 361 517 461 683 461 461 435 500 ] +7218 0 obj +[583 536 536 814 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 319 500 0 500 833 0 278 389 389 500 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 0 667 667 639 722 597 569 667 708 278 0 694 542 875 708 736 639 736 646 556 681 688 667 944 667 667 0 289 0 289 0 0 278 481 517 444 517 444 306 500 517 239 267 489 239 794 517 500 517 517 342 383 361 517 461 683 461 461 435 500 ] endobj -6707 0 obj << +7219 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] >> endobj -3965 0 obj << -/Length1 1393 -/Length2 8137 +4111 0 obj << +/Length1 1841 +/Length2 11323 /Length3 532 -/Length 8965 -/Filter /FlateDecode ->> -stream -xÚí”eXÌ )ZZ¤ îîR,¸·R @‚ܽ¸»K)îRܽ¸××÷›ï»{o»wîþÚg“?yÏœ™óΙ™ÐP¨¨³ˆ›BÁÒP['VAP ¨ä`p°²£ÑÐÀ ' ¨­$È ,ààˆ;›8ø|‚ܼ‚Üh4 ÔÎÝÁÂÌÜ @dø;‰ nv°0Ù”@Næ`Ø& k€:ÔÄìäÎ -·¶¨ý=àv;¸€MYÑ88¦&Nc°™…-ÛßJr¶(€ï_aSg»¹€aRz˜$¦h -µµv˜‚!hlÊPX-0Ìäÿ†Ô/.ílm­ ²ù{ùµéKÙXX»ÿϨ³Ø 5;Øþwª6ø_vJ`S g›ÿ•sY[˜ˆÛšYƒìÿ -Y8J[¸MU,œL̵#øŸ8ØÖô¿%`ûGMA¨ ¨Êôï3ýgTdaë¤án÷ŸuÿNÿ‡9~3¬Cn€ì¬ìì°DØ÷ß¿>þW5)[¨©…­€“‡rp¹£ÁnŒxž [S°ìSfcµ…:Á¦`]ñ@ h)'€ uvø;ú¯?€Íj ;ÞGxyl⿉À&ñ›ølÀß›+ù›lRÿ!>v›ôoâ°Éü&.›Üoâ°Éÿ&X¥ß« ü›`Þÿ‡øaT~lcj¿ VAý7Á*hü&ØŽ´~¬žövmÙ@¿ VÝø7Áª›ü‡8ØaåMÿ@ØÁàß}þa>f LÈü„uÜâ„IXý0 ë?¦aóa÷ŒÍö„i@ÿ@˜†ÝÓ°ÿa LÃñ„õÉé„Y9ÿ0+—?fåú9aVn ÌÊýüߟŽ„ÔÍfÂÂÉÃþ÷Þù|<ìÞÿkž¦­…½3XNÀÃÎËàü'jâìà¶uúçß -ö*ÿÍ ØƒÝÀ&h‹sP¡@Ë”†à©¼ÉR$G’´¢ÀÑŽ º4!ÖÃ5¡W3`²sÜ \K‹2œäc… -6SÏ¢q¯ožêlA ¸ß0ñrÓÕQNLõ àsz°m²ÂvÉ·ì™N–¨®Ö]:ª÷9ø¾‡#–ÌÏ=^øXùŽýXDO5¥ÚNFû˜Óª˜ÖÚ[¹?’æA  õÓ¯^?-õ¬N[­`¦ Dä(!̦½û…ÊÎàù9†Æ~èŸÀ‹5Q#€QÐÕûYŠñ=­U®çVÈ·ŒÄû9YéÀþ΃¶Q×´)|5ƒ¤M8{Zñè™ séþ\åÐpZÏT(IŠEAU½Áüèòœx(©5z ©öb/)M%Ý+ž7YÌ‹¬Za?(ØÃÚi£ -¶œiF¢ËJÜrõ¸ítÂÊŸ›’„>pl3Ý£Š™ ­G¢õzÇ:R3dïûí©œ#Œ5Ð%³g Ýú$€cûnêíeRú¨tJUañ9:ÂC£= -ëñ¸8šeç6,^v±Pûž$×sz»Ò…ìb;#Ô;cˆ!•ü_^<œn—M¿!ò/";ÛE¹#û88¬2B°`Çò&Zko‘Íe]­l9g“šºõb'ÝΧèöjxà˜!ùÆÈfȸïq噓. ¸.9ÞÿŒ\ o‚د$Æ$Ñrt¶ ˜Í}$–"àÇŒøÚ·â¿÷^”±Ÿ@|ž%¼H£e3r%þy‰˜¤·í€ÕÚÛ‡à:Î#„œ¸eÑònÏÌQ…7Ÿ|‚ëE„Ì.á1v¬z|Æ?ò1ðˆqdÏ èÀäÔÀãx{YÎÔÊ2by£`:¥„±f'²\E‡ŸR_XÝôñt2› ʳ^ŽìéŠ+¸ƒñõÄðØq[²\|¥×®³‡¥’綆ËnÅâ(K,¾…GM:<5ê†KvàššDØ$QÈü%l“0"%ßåÂI- -Pgl Õña>º†è#.ËΉ—}¯$®37 öß7IlÞ혚QWónÆ*<²³*ýaµñôLz¯¦ƒ+’¡8ý¢™Âoª­Œe·i 5ËðYà‡zµ« 3J‡Ç!ž¾zU?Ýã¸çoÙ¿L -òaÒ?È’áídj‡Éæóõ}ÀjÚ¶9ã:}ëe¿\YUhÿCž¬]B¯p$5Í©ŒÀY…Põv \mÅ‚˜­ã%jªBSYñ0ª-ŸÂ*—î/ïâ#ñ Z¼>kB8úlÕRkŽ -±Å¬ÌÙï¿{íQdˆ·«zUD¥c¾§ØÑ%¹µhiZXiÁãåÉ“ÆK±”Gœ0°òŸùþeD½-ª [ -Y©wÒ¹º‰­‡˜ãR‘ |3l§ï}öSkç®|¹¢wÿTáØ1Ðc |ËmÜÛØ“Ó#û‰¾0y3Ãj$N2Qm[À,3Þœ74õÝEÆñòšÄ¶Ê_fð$o±Ë_¡>å:Wéç«û¦íÉ‘1¶ëndçò—ûõ;Ãx=Šû -Œ¯íï?b; F’þÒ’òáê’e·Ç ßt,u©"g"¢ö:Í]'çrn¤EW¤NÑ™«»iÖ[‰ü~Ðø>5ﾕ òd]_~^VE}\× ñEMj^KÜBÑ#p·¶œäGP¾šŽÿ_B/cå#‰·q¨Ê5fÖ|:꽧3Ó´D)(IÝ"•±Ï Ž+ôž2Q’œóž¦ÛòI/‚xÑË‚Ÿ3¶Å,/²Ò5B¨ïéÑ5u¡Ûª++(u¤ -2d>\ÔKÖx‰»‰¾aRJ»#,6Ý2ËgïcæR|ÆÂÞë2> „æxœDÑnýâf².h6[ïZø&QõvèGf’Š–ÛE'ÜÌh\(«"¶yvä˜ëèЛròÀÊ3¿y Óç…Õ“ìD'YsÛ|‘ÙH!¢àp5íñä¦Ov,vùüô š«ŠE:àÀËqO÷ÍŽ¬1¦U÷aùþáñ€"ÚÅxg‚ÿXF|ŸeJ¯n¿—ÛKƒæ°¸§HïðÓpñGñùì«ôƼ¼¯›à EÅ–ªíq}†bë§Èï Ž¬)Y†Ë‡ŒdJ¼GH7T3MnyËÁ¡L㱌’RAÚãpºØXžÒOnž†ÌOlÔx)©AÔtõ§î"¨oxq>D­r¼h5 ‰åIò£Ñ÷fOï‡45 Ån2>¯©mÞ‚Ú¿|”(+ˆþúå#³Xj³Ë¾‡ÑºeÈ{ïë±ïQH«çÒE/AÅÉyô 9±”Ò.Èû½ü[ÃóöÕx×àÖO¦·oý2_8b&M;—nʉ¢:}¥B–Pô0?Dš¦œ‰(úuxÌh:¢f­®ykߘd¬ïCAÑj&¾¾lðYïGŸ-×½Š--ômª¿°q ãm—µ.½÷”Ž´ÙóZ¬òHqaÐú™eÄ׃õÀóÐà{¬› ¸Ë,eHÚ»p‰—U§MÓÞÞíý-biXÊŸd l㶠ÜE/C;j^,ѶÂmdà"´ä1院íRJÎEÄê[kÜ¿k‘ÒЙ>y jÓ/:©*ÑSÖ'#aõ]JK^´¼Ô"ÜtøÔ-w¶mÊñÕr@‹Bå+‘øù/€PŠe™8.¶q<Û÷›pÝ8NÔÁX÷’a~–›ŸÉ"µû¢U©ZB´­S'1ü¦ÈT8¢§Ae±+'W8fÜß?z±„'+§W -q_v íPhᨴ ”ìòäòŸQ· ¼èú¼Z6ÝÙÄò̽ñþÊ™ÔÑ»K™ÖW¤Úðä¹N‘ýì¡d´uX×ç:ï]NOŒ˜÷"Iõ~&Çœ½QV^¨7fÉê -f{U|àäÓij †îÑòžè¬pöý8ˆ2ü]‡AgÊÌmEÚ«µÑK¦‡æŒ7Æ}µ«ÅŽ…vÜ*B<¯Ú¶¡U¿¼ê47³½iƒDñt’ZÓTèNk*è… SïÊF½Ð8âð;eŒªXWÂÅÜÖ¾fÜ+B`¸®pa7ÇC+KIU)t™ì;}*0 x´;+Õ6+˜¼ÙµKQÓð|(iûúª{ýh‘XöƒöÚÅú@ä¶[9Òçýæ¥Ú,௶Ý¡¬t„:‘áDž‡: .€ŒB† «º-_F½î2k÷ÃËLza5U–Xv¢²HÀ¶íL³|‘šÒÜ­—Ÿ8Cü‡¦RŠËJù8” !f£ƒûƒïq bX …Êmë‚as SW²èDN…KŠßtÜȲ†’æÌ´~’hcM?÷˜d1P4ܵ•Žñ‰½QWEõ2 ðÜ4Èq­ã.K4pïØEýRm¡¿(šQÑzæs›²é0Ñ{3 — †§<àvb}y—&@ë}%ðÚ·7Æa\ù×:#û%˜ÄfÑ-œF`∥í×UóÉ=6nN¯³o1¾ö’ð»¨ÊZ}?ì7A§ûÜ]g€Ÿ*õOÀWž»æ[¥ºaIŒ7¿2oä¶(cÕº õXäç?´KÝ -á4Ú4¾h€»¢vþZÆÈ=0`kþÙe-pK–î~–—p¡e£Ó™1É0i ÿ“%HA‡uqÔŠ¸v|þø®×b,4‘Ðø}Oó*Ïj{q pX¾ó#v¨ øvæÙÂH±šïµj> Áïx(œ—VZ ¾qã«,Mö¯rð † M!WêÔ¯&t -0>oÄW»šö -q±ÐèpªŽ–ãþ¬í’ö||À wÜ€É"s+†çÝò‹Â·pðGûöÖ¢2LVÎÁG\«D©[5mˆ§™'gŽb5%lÁ/ÆÛ/ºZþz.ãa2¯½¡ÉÆ.½ÇõurÈ—ù øüNÄÊ-‡ëk©¬‡¹)Ñ3ÇÁÊæÈ ¨x~GJŽÌ"ÿäòÆ`L”=ˆd©‹)Ä1Íè)B–T¢x¬ŸÔò¥HÊGúÝ|»ÊY{6aNð_pfÕo÷Åb8ÄÖ&%¡–Æ×#wM?@Xë”Q9Iº‘ØñA²=ªÍN_ð¶‹Íl©”$áŠM®hùRŽ˜@Y8Lnº’•žÝ¬4EÜ‹7"‡„ÍLÛ«xhè ù¡oá™5¸ø¹­OS¸ -$î2Ç2€ˆ†7<aûâ {&?ÕürÖW­*zUPr|§ÉZ—pÇ.à‚œ\J€ai‘dØxÜ\“šlhŠ}az™¨Š8ñ \–n+Þü[°Ç‰f¢éÍI®ÆÝàW.ÓÚ©Õ'ªŒ`Ý¥Ï q1j*§ñþš”ÚÃ{X‘_`óC}ýY?TÞµáq¾^¬+QGŽÍŸ+t7i h›ïˆÝdÈï1Ì"6%¶!,5¡­¢i&½Ž&·Ä²Îµ~}y®³˜î¶=F½$Ÿä¨ëN—| $¢‰£®€öåB„×3 4WhšÐ xÇÞ¼ ¨¥:œ2P®¼R|C™jsJ"íÜ#‡=þTHÚñý+o›g§?›wò³bø™F­203iõ÷©ÅORö4J™Õд°)ˆx‡Ä£Ç-€x暎Ùê•»!%>ÛzÂâÚqv´)+ÍïIãVWu=>ª ̶P¾?¼Ô¸È"õk77 "áœãb‘ K(OŽàMÌݹy‹ºp¦Ï´éŽ)Þu¤ë/$SÐQJ¥éàS· wì¼.Ë°‡cHfê¤slæz´(Øaj²ïu\;ÖD—æ)-Š÷ùSèÈÈ&9N"­µ~Õ¬z‡z4œ¿â©Þ…»ä+…žx¯@cTޫ휅BŽU@€D§uJ刊òÉL†ñäXñÔ§šþ}ãyw/x/¢¸ ½û%kCkz°_µÿH¼¥‹¾àBÈQ™öN&"ýa‘Ir·N_£à¡0öƒ=õö”ZZÖ3Pµ /!V½$Y®ËÿÆÂ…X¨¥FñjLÇ!g(‰²K[¸G%„ü -gZxeÃF³¨u–SXA¾°yÛ† 2ed˜`ŽxS%F}Œq0cEïY]-ŸÂ1Í &Øa9ÜѺt¤•kr•Ÿ׎ɨe•)QUU-Åáíž{ß:QK¦ŒzZè° ŬØ];®ê½RÛî'pïuïÀwÌs ¦7@¬”•Bæˆì½“|íââÛLISeý1®¹mþ*½Ê]zÅS¿ógÇ1Mb\u–†Ç²-”ù–õѤ(åj×FñXBMú\XÞó »©W úš¦Ñöe X3°ÈËÝCÿÒQÉ;*‚˜:>O•EñY»„‰qÍôÅ3ø¡bÃÒqÚì‘àö†zôåGþ¢§—”6DHÙ­.)¥ÅÇô5õ[ Œè#Nc+: ÎbQIÝþ-¥Ç*!ôñxÐuÎØïmìÌ”êAúškéu±½‹(¡|í%ÐëþÒ  þ./ÓúÐߪ>eÒØnuÞ -Ah{ñ!Î8X”ãÉ'jUUq*äó¤_K„ˆóR¾}„cNášE›†´Ÿ'p˜VE¶È|>û‰'ö=.Óøâ(w È~æY”ÚEÂÚ¨§`©ÿÃÞÃZØ·ÖðòQ{nN]šW1p¥ŽÅMðéÙI²o߉n;»Ã`zg/à®V/‰¡”€VkeSÇ /,§U_ÿ’*™8 ýÇïÎWÁ—J5Š%Ú\”sx0–ˆ„#Vû|xÉ÷çò»ªÐÑ꤈÷ƒŒÎ¯ •¯'¾$›·zE G(}Îaüð<ÇîqwA^€…ÏWj¡’ÏÉaM15@7Ïd-º®ÑÛlvšÇ&sÁj£]±¨—Ćm?¢´f -—²¹®¨‡SI‰g_ڨʣrgë¨!·3s¾¬P™aßþÀ»> ~¹šó³¹dë'US¸ä<9¹Ó8ì=÷•bÇká‡FÁ]ºP8\Kë’¦ûÅ!rL[¡Š^fK/^~Uå2–؃*YÑ*¶rRËψ‘‡UŽ"›· )Ærrd‡#AgòȘtk’ŽŽ¶Ê$2]>—Rx¥ü†¿zÙh§11´§¤â“sÓD)䬡,Oö,‰%¨Ók¹Ó‰1º; d„©œæúâè–= ÒõOÏâÅ­PJ€‰e ãÝmZÎÊD Z°È"²Bwé*¡ÞnÇ%’‹Zõ/ÍñëŽë/,ßßóÔ*rEM¼*U4ýÖ§8n,𽯷霡|‡Ë¡¢´ð¨Å$¥ÈÈ«£¦pöõMy©Æ^ä“úà|6Çkϧ®FÍò<\›öaOyÍß’Tº—Óî&;“pØ -Çæ4ÅwßYhŠ)]?§ºúÆIÊ ªköŠ7Ѫb±Ÿ$—û¨~d3&Ö;µk–#Š%G$Õ}VYÊ#´ƒ‡Ih?Mb¾žrue¬}dV8l0£ìP/ƒÚ»ƒ‹->àÿèë E‘«x¾L^•Ï´ÓQ4³ D¬+Nq¶ñ¿×+#6ÄÅtiÐînR¸²ej3¾–^:¼¿çŒEgåÔÜv©Ý}–]HT,ö®ìàsŽˆ. ðòx+¼bÔ6E3Ât;.Í:3¾·•5„¯ÁyŒµ§8 ©_{^)¶N‡«>9œãÀçOºÒSsWGœPêmä’‡èIÊ‘åÅê×JÙÅûìÑÄâPö¡(ζ;öDf½åï•á~ÑX‚áÀZèÓza¹î y ÂÏ䬬 -ñÆwZE¤³òÇël·*å8®7Ÿ¸,¶á‡Ê[¹Ü+ ÃÍv‹(¨´öNݲÿ~ÐþÿÿO,`b 98Am@VhÿÝ/îdendstream +/Length 12353 +/Filter /FlateDecode +>> +stream +xÚí•U\]Ëö¥q·àÎÆ]Á]‚»û6îîÜÝÝ‚ÁÝÝ‚'X€à¬÷9÷Oro?v?õ¯á…oÔ\sŒY«VAM®¬Æ,jæ`’r°wefgaçˆ+ˆ«‰³³ØYب©ÅA@W+{  +ˆÀÎËËu³°óعù8ßñqò"QĽœ­,,]tâôqDí@ÎV¦@{€ÐÕdîa +´¨9˜Z\½X¢¶¶Õ¿žp¨‚\@Îî 3$vv€™•©+ÀdaeÄúW${s÷¿d37Ç/¹ƒœ]À¡tàôpD3{[/€È‰UÑì'ù¿ê¿›K¹ÙÚ*íþjÿ¯múß +€vV¶^ÿSâ`çèæ +r(8˜œíÿ»T ô¯t + 3+7»ÿ^•qÚZ™ŠÚ[Ø‚lÿ’¬\¤¬à$Ìà<;7€›‹Íï?ë4ì­œÜ@2ào– \Áñ·jêæ ¾-\ÿþo¾UÿÍæVà;ò™"­.9˜ò°No«ð—,ž©„¥w!Î,ÿ0ñ%ôs&?ËM~Ìç–iuéå›Ð7ÖVUi§r5¬fæ\ÛÍ¢¾Ã>j¬¡+o†Q±é ³ÔàšþÐ7„ÉêC·ËœòkhIZêÃ`÷qxç„ÇÒ,Ž*´aê„hÜB¶¥T4O¡bÄ~O¼qºUi]'¡N\u~’‰-r<‰Öj? u--&~.Ó*‹fä69[dMlé77êñ¸ªJ9ÏBÝcNGíÈ*¾×ÖT~=ÎàEL‘¶búðü\¨èóŽ•/¡'›iÓXÅË<ÄÄ'<Õº†ª$Ÿõkhê"“òµF'ú䶆¢“Þ`hT•^Ú1ù:&88õ¥z@.éH•¡°‰ìSµLÖÀ„×òA>ž#ªšÃ'*'¹8€ 5SÇ]qdÆÓœÁ^euŸBV­ZOÄØ£â™ë¸Ú/Aö0Âè÷Ä:¥O»3¶5xÞ…å  îß’˜|…+Õ7EÕ¡kº¸ ˆ·Ã[,Iñ F7| :|Ž*Ï>J& »ÌX¥Ö´[ ¿-X#"îïù<§h-‚î>*íIT˜€P©>uy:OA±›©z, ­Ìì:3½‚Ú3<駢‚/HêÔtü’A'ñPFtE¶¯úª¨HckÆ–µ­(ñÇN"cÓý«è0¶ý(iGUÚa„ÆÒÌÇÀÑãUí¹)`'Vè´15øÂÉÅiÌ+WÏ™b]Z²Ç+r cÐxÄô²½t\Òé<ÉÉÕEØ‚˜®S¢÷õm• ÆûõÍq~Iß +/»æƒèq Z½‰ÎºJ;™û¾‡ç!9¦ò,~_q;&‚ÉÁpåpÍô>DÛÞö0 õh÷²Wn©ÇÚ†¢:}œ_úPˆÔüý@´Áj~mèùè=K•… ¢0måVöð¶ÿa7áQPÏHôÈ2yÁu›ˆ#|^ƒzOW sÃw›Okü`êIr~h> +PÙғˆ˜Dø>‹µ²DjKvl¯!€òƒ“bü&ìmPè%mÉÙŒ# §bs kè§.û¨úÎÄÜ ÙÒjHá%Áª’Ÿ)×94r!Ô¦&í°øj ¶q¿4õÕ¾†Ç©¾Âû;ƒ¹$f÷f×Gï3ëV½¹«>\þ„Ž&rLÅ<œw }ëë9Ay›¼`™Ð¼¾¸Üæ œ…òÐ|ðÖnõ’¼YѬÜfv4hïc›Õö­cSÖyù8$‹Þ!¾ó!Jõ§C.&¯NÕŸ:/¾‡_Ñ…S`RÄy=¿|LÅ4zÞN Ý?1ýx½¯@Š:ïг–‚ÔÞ„¼ÜJ»»LÛÔ¤±òÁþï!^t€ ²Ö¶% mV±«ó¼Áqõš‰qÂÖ@«‘Ë\ãŠîîD(ÕA[¼Aô\(Ÿ¸¼VZ«Ü¯­\È à)eÖV…µ5‘ûÃû‡Š.±á*™§#qÞsN…ýÚçF¿7-l„™Mÿñ!±BÅaSƒ^È[’ÚÇÕÉûxŸ¢Š1›ÝX²”Ç2FÒ噪+™ÖC}T@Ñß|fXç'ƒ¸b¨8—áž—yá WhlSÌ¡!lV yº·Ã‰¨>îâ'¶Åî8gÿv;a3­œîƒ>aaBÀQüGõpœ¬T‰ÊvèÖ STÊ U…²k2Ž˜]\jh3ñ´З@TƒŸú†ÍB#ëºÊ”EïKQ`mŸ9dðÊ4Ø/ ŽÐz{äž·ÜÏ6gòË špʳ×ÅìË`øñAEY˜;·è&é¥;ÆÎ}>džn ²×c,òõr+Ï{È~¿öûA +õ| Cû"{,î_#¾î†p0C(Uñ¥iªâΔ¼^ЬÓSÆ1++¢ºbÔgv¶M<¸Äz¤ööéI Eßð"µß%øw‡õáüäqë]ˆaª©Aš/Þx£až.AO É +P‡èï´ Ö×ÀïQ„Œ\N9ívN¾MÔ­]¨ÊÍNmD T 9aìŠrYVŠ,"Ê’iŽÖ«zÔ~Ck¤Ÿ¾QÄ}[¼ù¸I.NÌt¦@Ñc<.DGà-‘æ{ŒNãÇ]¼¼ìƒT,pkãêÏX€ñ¹£¥â‚Z3`ƒÏ™›ËÆ¢8oöÓÛ½i½zù&›ø6ž_Ò~~@ׇÁ¥|cô¨v°&-´»‰5ì~YÅß°Cž"Š´¼‰éq¼hE=Æ)…èù|+™…émåMˆmÁ"«ÓÛ1 ’Ýœ™T qÎ扸´Ì ƒÛâÛéU6æ?-['¼¨òŒÁ¡‘@æ[˜Ñ†î¢m­úÛb›‘¹ZØ„¾ô†W ÚtÕÅÌ£~Kµýa Ãcÿ†ÞlH|CMK6£§CJA>ÉÎΈ¹11„ÆcR¡·kÊ Ç¨{: áQÉ)4  H,Î ÉJ“T!BŽ54‡yÝ7}÷ûzéƒÕ&gì€È}+Ϊ˜OèK¥èóá{‡îúòõ§ÙV>¶IôÛ+¨ëÕww&ºæ¶t°óê¤#[ph"íHx/'VÞ1ß¾ÄfÊúÙó¼p1Ð¥‘¦{¢ý‰œàÿ!²¹JTËl}žÈCäŒaÌ}Ä,·*9’|b ¾ö,¡Äàéú ž;Ïõœ²-Æ(âeÃÍk\oœCñ ¼WœüÌZ1W=º gdt¼ºl§?fiè<£ï¹íœ~QWi |áúV®«ßØŠñ ŒL¦½n!mÈÙVbw%F”áÚ,”^´?Ü’Ì2¢ ֽꜾê(:×ÈM¨\÷5ˆ ’/ßí{ýx{9 îUGÉ, ÙgÓÎß_ü`?¢ßên€Ì=r½%\ \ûIõ'o‡‰ÕT¥*Ô­ž„‰ïŽ7…/ÃiÆ©Ê,ôÅí}VÏ î>á9ÓS(† éÙjƒƒÖbÜÈË +âTËž™Žv 8ÂwoÔ·Yû¾­—/§OϤéWœÚÁÅÎjõ¨é\)î‹~.dÌZTa^~um‹/Œ¦· K«ø7$„;Ž;=œCáïbüœY†p([[);&!U_D1ú¹¤rƒÒ{þlt}¹%£|‘.€öfç4öä­öö;nª«†(jÿYJRà.wÇ–î.þö–Xÿ‡öâ•wɈJ_*„ƒé»fOͱæWì(œßµáÊ?¾ïA&NŒ‚v…¡÷¶&’åô7óÔ ÖÖ_{6P/¿%ôûÓ ÖhraJÀ71ØܯmK¥åRç&-Ô‹¢}©Žôòàu®ÐÙcZÀÃÌ.˱µÎ‚Ú뇜µ÷ ôˆ&ñ)?or¦>~V ±OVMA•ÔÈG"žñM_9’„ßZˆñÀb(rÁ³Fµô ¦¡‰ÜÀµ¯vä}Þ<-Y€º¿B²Õ`\¡'ÞYHîù"M +Ýô4²Òµ5õå³–)€ñƒâ¼MÈPhit‰Uñ”!kâúù½ãvAœ„dðì@†òÂ6^YÄh»!‘5EÝOÌ¡þ”§6QæʇTb«²á&9rÂ"ëƒþséXŠ6»–-X#B~q¯c•Ce~bCzñ2Œ……¸|Íeuî7…ù9ÂWo—!?Þ=‡¼éCÈlx 8kQ·ýó.ÈÙüHá ^ÜGì]““ka‰/i£;!BòÚÖÊ ”8šò¿ÚtW_SðgÉÖG€â}×­CÆ\§-S·&ù;rH$Ãp¤*TUS?Éd à_Íœ¬–Z bÔÏg÷®Ó8îSªp,“Œ°"ÀR%ð²–€h§‰Þ ˵¯×,yyRäu& +—»‹õ/›ÉÌGv¤ŽçaÛµ¼‰ÿµGQ¯bQò +_[£t2pß\¥« +äFŒÒù‚=!Æ)¬–\Ê%ØÎĽÅÍùV»†G¡‡ãÇáO~Ëj,cê 5±ü. ídÅG³&‹ý¥7óVý¿èŽúŒ[ÈÖ ®á¿æ,HÀ„"ßòE (9OjñZõ¹h:ô秇E|õ>Kçù6Œ¸ xœ“Ššh!é²È®;ºQÒøý‡=â{N‘ T†ôVBvßZTDÜ!!Ãk)]-ÅÄ6jÄ- lë°áÀøÒÜYÆmñGC‡O‡mჶ+`„<‹m@+v+wéÂl;6 hÌpƒYÕ{'¬¨æ¶\ž±zq÷(¦ˆ=™º¯p“w¹F&’ô Ô¤ÖHs4ferñ3½k'nZ‘ 5Þ±ÔEp1ÄN‹Äë¤ÀªŽÏÓåöRR–S±Ì…žèfîFd:T¢›ôNyïCÀ‹zí’c1Œ?q ‘Ñ «à€VY9ß½cºÁk$¹DAz£ïÏÓï?Êbâ€"f¼êS+”éEd©7$—û#軂鲣ü¡ù'$?6IJBˆËHB wØÆŠ®WÞÚ_«‡PÑ^êZjÆaxPZ&=û¢®X~dc¼Ë¦mœ:†ðïÀB·‰žø;ÎrÃÂKÆe®º=¯FÄgë½ Ë|o„•¶0ï'VÕò¾zMëiÍ«X³ÓÛ‘ŠÔÖ& e8í˜BµÇª5X×KÍœ/ö±¹ž6¸ó_ïçòPf†I£VS¯4&e7²+óåìvdèzóx©î{8¸˜·2_èÙÚ š~¨(õ‚cÜÓ¶´CeN°(ö,±U½‡Mæ9Ò¢³=±­T!r˜ü¦¿“×óy›¡Õʤ÷Òfúñ2Hؼ‚šÓ0ÓYà½Oà„è´§~ušGò4£ýÒ<…©Ìü’ç"¨ZJ„ŸNF'jEÀUŒhÂ)’ΦWÚðY2å±ît$*¯õïó’Ðó†¸#C6C^¢:.²^þÈS®%X7_&,#ïL¶«›'vò›ô×ÒwQ¹‰äñSq0Ók,=?Óc{Ó Þ˜Ý©ºðB,ŠÏN”È­Å +„M<Žmg/–ó(X&¬> 3zvcZg«Ø°]bO—9ýx¾;<þ˜ÜŠÔ“r~{Òƒ‹ü’e]ÓŽÖŒE¡’#{?°wµÂ Q}aã\­<Ù*8(7âqn†t"“4³2ÕÉkîð(1? ï}{åS;¸^ Yj:+[O…~ÆN/?µ€‘Äp çJùYFI£Ø"0έzÆ€&&]w39›‰CÊÙ±q…Uš Å>^ýe@bH~8S;`£ê?mÝñäs¨Ÿ/„yfPî!NëšQ¨2‹u<ØI‹Ð) of¤ª¬O3‡ÓÂÐ3!Ë¢Òñ4êõ•E"hk6³u®ró² 3Þ}õ˜‚Q"ÑÕãzƒÞòn„b° +å†l8"ÇÁÏæE‰Á^tÝ3`îóÃvÞÆB›¯¦œ¬T?²KOÇæ„pdö‰5Ùm×TßøÓl N‰Ï´”ÎdÅ+éÎÄ–ê\¹ÍRÙŒâÁ¼T"×¢‚F©Þ}êî”z®+à…,¡Ãhß™¡§Òª•J!H{OQ +’L‚èÊEÁbùtühoE…ˆ¬ E£1à‰°óÇaâK£Ñiõf~VÓ  f, R˵ߓ ‡JΧR&Ok6€w›eS2;½a£õ¡ñ,ìFY]©pȵ°˜ZÔc†–d­õŽõòçV€z¨`àb×$|çβ.¨03:Eªòe_@mYâ/%{Ú‚•W÷€´“Ïtè4Õð_pà`Ý…ú°u¹ÛÙNË!®hv¾ø9¯Så­ÐÙ ´Ê'#§%’0šÑæ¬,UbÈ^ÑO„¬ð´\Cd;߲ln#§º?p bùZ¿Ue½‡غDæIÔàz_S3X •yˆ&')LJúݳ7›´7ÚØõÃBjF¨_fX®nE:ãäR'Ã׃\§ 3Æ•Q3– ÈÇ !=ЧùkŠZ.é:'ÿÒàÕµÀüäÄíŸ%M[åÿ^º,Êòµly6ZgCœ?àŒÁ} Kst¿Æ5 d#‡dL×i*$]¾7ç«Ê‹g¿ˆÓq&¶Ñƒ£wLIŽöv“ex_šëô9X¯áb'»Ö{ òN¦ï.ÅÕòB< eºæªmAr*Û­ ³ýÚi!ú†8ÿHU^âFq÷+öGF¬8AJ¼Þ*[xºE"¿’wÌxVGñè5"‡ß+á{íŠ&‚UM\# å€Rþñdð³Ü¥Ýµ’68í!®2ö½ÞúÔocŠÉ“"îwÉa8’,ÆŒK +Þ†¬ ßÑ,|O0ÿ¦ãSWô]™`ìTºñ­”_¬Ã; è|ï¼l’U÷ù«ÊUª¬Ëƒèh=Ý+  *l{ï)ÜÕ|V©0gÉûÕ¸n;9Ãöà ò½@.Ù–T ©± ›Á3&Î\«¸%^‘K^ZÈböW¹%þ>Ów4¨Ì.î\—ˆ1†Ì‰ Y¿‡B}ƒk$êN-£ÆÔˆŽøzò]ݳíVyxí÷ÞÄ|ͽ§ºrî;º¹J&3ʶg ™”j£‚ñ®f€!Ñk])ÜZG)’²ñ á V"Až¡€Æ'åKC‰z錯+G +{9—ùH¬ÛÛ({¹ƒ|^?¸§ËfÖìÞßçcãœØ¹]êÄø+3¹‰Sµ¹:újæZjÖþ¢¦D–‘Õ5ÃWœJ#Ý-ôÝW"9­DÄ¥é|²êÕƱdž“IõØõ¸†üÁ5Ÿ$ö> ÁªÄŒžh‚‚ØM_©û5s£ÌêY@x.†¥¹Óß‘;Œj?ú—JC4|x—ˆ\Nà,M2o(€1Ø@ óôÑâî v1÷ +AóëÎþ€‡CÍžçJ—Kxe˜ÑÐÈ‚žCnrä›â!U±Ìî¯Yp"õ¤§Ø% Tclâc¹âÁŽ×Bäsr¶à:ÛÉöýšwæ¥×€vcu쳄óÅ°ôD¥÷Nä—ôà +án&ýg;TÿÝÆ¥C®M<ý%¹(còb E;ôØBäج§|öÔº‡;KJÙœ©ü‚ûîxíÞÇOÚÛÆB#rýÆ?áÖ¹+˜5ÏQDÚ™¨"Ì[´:ûÆS<$‚&ØIXX³éíéǼê7bi³qwjFÒçïëXŸ$$£ËœD{â a`~–|»)}«™B­8ä²eˆW®;‰»û¾ñ ß…¨œ›âÇC|›ÖÅ[>„wîm³‹IÍug LpP«3¬çV£É\ÿ¿ÛÃ,+l„²S†~˜&”j‘ÅÓt,‹²Èoì–ÇÕ÷›¢.waß„ ÐË`ù÷ã3'}+¨¡1N*U­]:^Ånð6ò¿“Ì›áJP³AI©ÀÕ‚Ï8|+¨ŽlàsŸªPÉq£½1,ã£úk¬1‹T‚ƒuš&ò‰8RQ»2ѳ>Åp"ÌAÒ‘bò¡ïéàÛß_½ø#ÿ(5¼æž0±¬ÄBŽdÃçèÕfá„Ö?..øø´Á7:Y˜#J¦Ÿò2çÁïH¨™pÞ,H Ÿ)j^>³·ýyÛM\q&ù l¶ûÝv¡C¸œš»…(+÷ŠDûלä\ìC.’Ø<šAÁÌ”§w?yñ©|]3‡_]&á2?*.QÞ¼úlí^:Pa¹PæÙP).»=ÔõUY)Ú9bݪÐs=à¾2G:Ý­§ñˆ"7Y +Î,榪—’¬—lÎ?ê½½âêÛ(«W¡Wãl]$Öñ øñn8ÛdÆìó'g†AÃuørCö7QU–ESz—Ç÷->ìÎx[(áá!­ÐGžºóþ‹táƒ}Ç¢…Ú·Mź›õÈÂv„/3DbJÔ«…jx¾¿¥žOÏ›æ¾Èc•¡ðDô°¤Çêà%%w'‚BÌšž”Tî¸Ý?h3pž%VWÔ/®Ø}3Q>=óèa¨ÚÏæ"«¼?;\gõÿ4Fpg°jß ›)ë‰?´CH`ÓGJ/ò|>L° ;ÙyÈ;ú,7 +µŒDÀŸ[QÏS«+ã”=SY4ûùW—å 7äí¢ZmÝ£.â%eSøw‘ÄŠ5Ɔ•[‰®B‡èþ¹ù»ÙÖQ*T¼¯¥ø­ð;(ZÞ\•Î;9éÓ†lµ"‚¬4£éµ£¤¡ÆW…Ýͨ¤,_¶Ñ0RŇ+»ÛH܃ŸIPàŸWŸÂŨêníy:¦7Ÿn›IÇ©pùS^Û\CkE¾œ”œ -l’‰Fa^X`3Sø/æ~G…Óýz6›¾FçÔsKH(—B ó?X°Kntúd5– NQø,,,ssB²ˆžÓáó‘6¼fáÃúÐ(´”l6þb¨ÜÝØ3ÑÏ÷‘u‡÷FÌËÕÒ6„±Ä‰9K›û• +MŸD )’Ó +B¾x§ŸYÚ|ß«.˜ +OÕY–Þ#œ0=âÂùU¡¿ñ®3¬ ôLë +…eñ¡…»á:Ã÷Ø&•r®H÷É覨FÁÁDZ§™¥ c‡¦@¤+ˆ¹éÓÅÈÅ÷½| ê !øÂE¯#º†Ëž9˳¨i³ê–Ê]RbóyGíõ^ÿµJ¤Õ…³“èöp¨¸ÓRON© ëZ¦k»žG,"Ù‹þõå7I[Ëìµ ªr:‘þç-öñbc·nÐÔÜIöàPD2n]*Ÿ´ý)Æ­Ç4° +E TÍåÞGÂSÝy&IœAÞ£Ê6_T\~¦ýü–_ó}rѯŸb½ã¬ƒþÊ'LRC–”£¾Ñ ˜ÕwYGú;éd±—µ†öÇIÔÝ帙#Ž@‚d^'³ÜR43bÛEļ‡CWb*^š¬hüþ—á–N¢~öï(*a REâ0Ëæí½3~ +~wwBÁ͆@˜ÉšÝØil·ƒ§¡ÚÌ»9‘¨ÎÚŸ½·°av’‹}¨B¶×‹òÏ‹qRÈu^Cüƒw^“ÅmŽ?ÐÔæI¿UÐõ`–ϵ™õfÁû8~'‡áÑÜ!ð‡ý ‰lµ-à,€g¶Y–à +äøÌ߀ðŠ^Âa:¬gÍÒ´íÞ§û~Ø1bni1†ð4(d“X¼1„·Uèâ[ÝéW=‰0Vo“>ÿnnvÎ?dL˜7óž,~}7Ó[¹8|ÏïSŽ‹¢¯ƒQdýÇÆ ÛŠFnå_3Z]Á4 4d'ˆYAŒËèôÍJ“”ƒ ½ße»_ +¾-q"¢â__²– +*¹–Á-"3”9Æ51‡@†7|KÖoæJ\\-·ùôæÆÞ*_j›0'Ó(í¼_ÿ¾{ŒDëbþMã3¢[ +eÅèù«=cù™Dü3Ú¯ïEø'Ôš×ÅZ2º"½z×…¢Z%0úé#Þ¹Ð3³+ñýO Þ\ûô /ìm”0ï#X2è]ëY¡Ð[*)ÑÅØ-ÞFó\²l“¨.Ë÷·Z|–-JûÞjÊéÚÏÞ £§v„’Ð÷±»×à*´!Éwö'û6uÄ "3qÍä¹ctŸ¢¥Ñ¡ +O“z}I|ÄI§ÙýÓ«5^ü]Úp._kE«t¬Òfí»ó¯* Qkþ +?òg(4k‰ùŸ¾Fõ˜U¯w¨åÃÏŸ98H=%óºã~Ë ÓtA(²‚]göBOí3V´g6ã·Wo”΄5#ˆbQ³±ÐêjdYše³÷{\–]¿ísÉ}&C$Ó…FýÈG¢¸ƒxZ¯üŸ²ôfý˜¤ÔÄeÂœ~¨FeàŠ†ÜÇu˜"ÁC/'Øè¦TÕšÀCÅú÷n®Gë.†Ò\šï£ï?ùGò®žê6)z¹ÀÊq9¤¥0¯ˆY¤õ×ôÁJ#]w9;² 8-a©¦ÉÐ=‰Sã Ÿ|Œ3¦ê¼as¤-Û+œðP¦«ž Ζ*t¶ÙQq€½÷v±HCt]ô/Dô£O,/š æ+@üÚœ=‘Fd€#íj5é¼ßg5Ñç/‚Làí)ñnášR¤0•õ™&ïh-ìZü‡eì#²kÜ¡”½ÄÞùÜ&Kû‚èNm|ç™°Âúµ¦®§q5{M"Š–|aõÚÁÛ BçÙÌ£ â;ú²œC*Åùñ0C臺=œDÝá1ô›“½ b©v½%Ÿߦ“c ÜDdf•C>7B†hSœ®1Ü"îÈ¿âL’;3Ž³H•ßaðŠ›íûê•`*ÉûÏ ú:¬½°dl²(ÜL¹}ÒëÇŽNHK‘¢l½ë§kص“š +}—é+ÓÖZt~©æ™)Ûq‹Õ»ìñæU`žÃSæ“"¹L»¦ÜGø‡Âµ›ý¸q/›„~§¤×‹Û'OÚí®«æºR6H‘uªíM3µõÐr˜F¬G6~EUoöéÂÔ&¿ª™×¨âÎ?e\g®ó¦KMŸ‡ý#,[O‹†ä3Ù£x~®r}_kRa¼ lV6Ub!eIm³Ñ7ÛbóvÚÃË{ÿÇúd’}*ÍçÏ~[»/Uô¹‘e¹¾dm–(JC¨ñT‘þp¶ù¥=Jä$È]Õç°YDŸ&uʃäëÍIdŠéýÄ{m„‰ÑÐ|ÏóŽtö«3¬8ˆÛA°®kqì¬öBx/Ü>òŸß×è™a%µ@mS2æÔÓ;VÒ×,ŠØ:¶J[ò£fx‡ëØËú+-„¹wÙÂ\Ð'§Pisâ¹±óD~4í4ç $ Ä½„Æ0)e \Éð +~ Jµ/­ -®§áŒL™šuL”I‰h.ÿ®yðšZ-=æÔÃî¬n/q ¾=}…Õ!ê0:æ`æ°{b`›Õ¡’>²ž®ÑO^ÿREêf¼â¾*ö’ŽÌRʉã,KE1'–ËFòͧl ¼îß 9Öï8¿`>½`ÀúìrJ:»¬ôH¯™<ØeCO›sŽó+„þ“ÔÖK '$O[q\ª¯?qêSI¶W´ƒRYÔ°ªæw{ÓRÌÐ=9¦skŸŸbW>!ì *!§ýòè„ub9Y<Ýâ¼hˆ-ž}ä\/ ¬k&ˆ‡ÚS±nçH·Ê{æsä+7¨Uòqm‹õüEèÌÌ1'kÜèH}ùŽb +s)PÄ~Â5IpBN;u­ƒ*6ÞëaÁ>„ž_Tâ§Þõb¶rÇj`è"¼ +Ê"]V8œ‡ võŒ5ʾP«ÜZfð¬dÚæÓ¢r@;aîÔÊÂì j1‡ö{O¿Kím„Ìòê½jݶ@4mÀ!×{ü#§"¬>»ÔÏ.åï@×|H\,I@»ñ©è®+—$›ìì™Ð¬­$ªÐžq2ƒ¨œ„ˆõás¨}G†<úÙV†GíG”ÅuÏ|»Cã6$5jI+v +©¾@¼Ÿeádºû¹öm"9!óòÊÌ·ÔàW9;¥7—òîÖãÛœ³õ+™9Å>2áv|6®\†ÕÌQe©$#Šª«Ú³PäòMÑÞ\ÖpÚAäþšWVWПXjƒf'¤Bâ4¿ÌIì4Ê'tw_íE’BímD%m¡ƒqMŸJÍsbvBàõ8Ù'> endobj -3964 0 obj << +4110 0 obj << /Ascent 514 /CapHeight 683 /Descent 0 -/FontName /KSCKLQ+CMCSC10 +/FontName /OSUBKO+CMCSC10 /ItalicAngle 0 /StemV 72 /XHeight 431 /FontBBox [14 -250 1077 750] /Flags 4 -/CharSet (/four/colon/A/B/C/D/E/F/G/I/J/M/N/O/P/R/S/T/V/W/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y) -/FontFile 3965 0 R +/CharSet (/exclam/quotedblright/quoteright/parenleft/parenright/comma/hyphen/period/slash/one/two/three/four/five/six/eight/colon/semicolon/equal/A/B/C/D/E/F/H/I/J/L/M/N/O/P/R/S/T/U/V/W/X/Y/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y) +/FontFile 4111 0 R >> endobj -6708 0 obj -[553 0 0 0 0 0 319 0 0 0 0 0 0 814 771 786 829 742 713 851 0 406 567 0 0 989 814 844 742 0 800 611 786 0 814 1106 0 0 0 0 0 0 0 0 0 613 580 591 624 558 536 641 613 302 0 636 513 747 613 636 558 636 602 458 591 613 613 836 613 613 ] +7220 0 obj +[319 553 0 0 0 0 319 436 436 0 0 319 378 319 553 0 553 553 553 553 553 553 0 553 0 319 319 0 844 0 0 0 814 771 786 829 742 713 0 814 406 567 0 683 989 814 844 742 0 800 611 786 814 814 1106 814 814 0 319 0 319 0 0 0 613 580 591 624 558 536 641 613 302 424 636 513 747 613 636 558 636 602 458 591 613 613 836 613 613 ] endobj -6709 0 obj << +4046 0 obj << +/Length1 2055 +/Length2 14045 +/Length3 532 +/Length 15183 +/Filter /FlateDecode +>> +stream +xÚí·UX\ݺ­‹Ü%háîîîîîP¸»»»Cp w—à‚w 4 »þ¹ÖšÉ\ûòœ«óà¢Þ6¾Ñ[ë_—z "SÕ`³t2J;9º3±1³ñ$”ÄuÙXl̬¬âˆTT®@3w“£¤™;ÀÆÇÇšƒ?€ÿø¹8ùY¹©NÎ>® kw­Ý?E<1 +ÈÂÌ dæntaafÐp²Ý}˜bööõÞp¨Ý€®ž@KfD66€%ÈÂ`´9"²ü“IÎÑÊ Àó_²¥‡óÿ<òººChÿ“iéähï°Z!²(;Ý€à,ÿoÄú߃K{ØÛ+›9ü3ü¿:õ=7sÙûüw…“ƒ³‡;Рäd tuüߥ:Àÿ +'îdÿÙȹ›Ùƒ,Ä­íÖÿ’@nÒ o ¥*ÈÝÂ`efïü—t´üßÀûW]EUE9†ÿ^Ó=T59ºkú8ÿ{تÿÅlÜW7À€Ü^6p!ø÷>ý/3)G 'K£5€‹`æêjæƒÞ=`âø±@Ž–@oÐœ˜…ÙÑÉü +Ü’€•“+â? ÊÆ`±ý£ý 98,àj{3‡?'€ÅÅÃÉhinÿ_«ùï'ÜK'{{3×?€Åèjtü«Œï¿øÏ·9YÁ¥f®@G{ Õ_*Û«ÿ«ÓÌíŸ!Üìþˆà°ÎönpT '³? +€ÅÆÇÙèøGâþWD“å œÚÍÞÌÍæ `ñº:ýÀ“prþ›¹Àéݽþ<ççv·qþUñOg<þô†‹ãŸV{þUŽë^æ38¬Ðó¯¬à%eþG#¸ÀQAáýgÎöN½Ä÷Ï0 ÿT¹Á.àÓöo…ãŸuºýs½üÁÄþØ_ü½%þØXòM¥þM<àîHÿ!p'dÿØVîýþØOñý”þØOùýTþM¼`?Õ?öSÿC`??î¹æ»ký!°»ö»ëü!°»î¿‰ÜLsW3 ; ûì^>Žëÿ¹ù¸ÿû üg9ØâÏ^å[˜ÿ!ð-þMl¬àZþ…ÿ¬æ_øÏ^û Á1¬ÿBðœmþBð¤A!8ší_Îd÷‚CÙÿ…àT®6ð¥Æâø‚S9ý…àTÎá?ûí/§rý ÿÙü!8•û_Nåñ‚Syþ…àT^œÊû/§òù ÿ¹â-ÿ>ílìà,@‡kÿ÷u..îäíÇÄn;;øèƒãqø8¹þ³RË>Pr’àÛ••|@þQ-<\Á×™û¿¾BÁ¾ÿÃV ð7 è ´@ü¶ìd!n›Õù1Pªt¾–Rܺ=Y¹yàk/RØj +¤}Ť‚ ýV“îSM.êì©×3¡[l¿ÚŒôUˆKröÒ둧éQ®o'¡îM®’Ï¡3ùÏ°ïhÝm‹wç\* [SÓõÊF>üý^¬J+©y ¿A1hàÙ2˜ÎÍ£+k¯ÑDÍA¦Žžíò1š3jÓ ==fs.,Ð6ê]ÃúµSæS黢´WˆG ¸¸87‚èw$”µ B‘ЀÎí&>®¡Èý‚ãO…m[g•Xêõwž¥%¼½: )ö»ZHžö%7'j§ÌB“W…Æ´—ú^§ð™ös²n,ßõÂ;ËQÓ'ÆÂs›N°s¥¸ŸfRÞÔåk]Í¡ÕFP»æ“Zf´öA'ÜãŒz¸p»‡c"["¥“ ®£þöýmNÖõ—Å©Ñâ ð¯w„Õ6¾µëì.Ê>ùOr«ÅÅ´·Ìq´°”=Áb×Gʳ¢Ã…ˆç \æÂŒP‡æ Ž¤ˆ` ˆDŽØ˜d@&™çœU3ÿŒCÊx|ÔVƒàÑô¶J›Zjäw„k2/!¯mˆˆí&Pé€o…Ìû^4ÔÛ¡¶¸âHÄfeڮѦu"‰CÿÄvªB³øÀÏ^èÑoHæN½X) c ;ÉU³áóµJ•õêè ¸Û8 Kòïï$„•¯ÆŒE²Y¿¿3tꣶú¤ÏÏtC G?W8©­Í‡ˆæ/ŸsÎ#ºê6wÅL'9‰%Vª§4bPê'Åž9¯HF•|éû ƒŽß£¡cpCÃvüÓŇ³ÖEÿ³€·O{ø„¨ôÑŒ â*ê—mêFeŽ¹5ǦP£aÉ's3ƒ·7|ØÞçIŒ{»Å°—H¾Ç“yJi!`Ñ5#õxÕ%º‡gæçk6ÉÕ3m¹ÛZ³rŸ+)jZ#r`Ón¹fìÑŠj#ÔfHÍR•>ÛJË£7*r<ý†‰dfµ'Ñ:ÀˆGÑsD/Øk¬nñùùTªîSÛbSAÙG½DÓ±c­—HçŸTÖóI ÄßÐ׆ì„Õ³7BegVnQbÍÇ>£ËñTjÔD¿…‰NÁµ´á&¿ÿÉøÒJw%õ»9 ñï2±{á·d²o‹Ã)7v'÷Šf¸†µ^ñ' ÃËzçý&dËÅ¡fùw +:Î]MUípá—è|%Â(çÝWiøÉZeGvzp9N]¾,°L’Ïj.l'§Ýi£ªž„°ÏMKÄؽ ‚"#Íæ‰ý„µG1ϸ¾_·œ*3Ç~éᔳ˺†×9ž) _‰«ãæpHKê=ž®èæìÕ4K0V´v˜]·L3Þ5É’ˆYaÏ9ˆ¿kÏΉÙ8<0’}Ï‹±üĉ%Ód4žî~®/S>\äwö²õi2ÇUe”ªŽŒÃ=½Âúƒ^¦ƒÃ$>¾€ÁsóÁz*ýÙ+1”Ÿ‡¨þÞ–À¡ú|qv÷Ôº˜‚’fˆÆVæûäFGµ'M>jãŒUh^jg6ɯ|•öó† ýÚK«+£—“éÏÆý¸ÌçÑŽ—ß/Œ7ŶÉm2£«æ ¢8ÍßR†bî(p+Ž~d‘h6î'/µÝ©$5¼¶Åìz›Æ(ä} ‰åáwƒ ‘¦ÌuaxeLíf!÷¿)ý¢é`-¼­>ÚQbjZ:¹&——®?=+ô)iŽó{—ÖQ°Ý¿ÚlKŸ×õ›ƒ¶ªc°/·µ/7ð°±|ÏhAÓP}–ÊÛ× Ã"AÇT;üÁ¬Gë’"#¤ág‚Çzƒ*¦Ÿ2;F&ä>7M'\g|jðå¡æœ‰‘±g·„(ìUÜx©Ý~J¿r¾±’¹ÛÿuQ}Îo˜ëýJk?*ÒÆx‰iì¯]›U-/Ž;Çèk¸h†“Ì’·Øèy6”}ÍŠi ¦o{¶XHÍ¢mL¦Êl£qs¼pî<Á‰Y"™_Ë´Ò‘¢½Q»û¥÷M¯[ú#.äo…? +T*%q6–YÜÞT¡ßÝÑ{ù14Œ†=ÜЈڰãã¨_Þ{1ôSPŒ©ŽºãÈú™ºcýö1†‡ï¦íÌdlÄOù¬½ ÚàˆžHÆ©ôòŽdôÄ•ôa–LJ{v2¶Ûè¡*¶“¸¬C„‰×Ož¹T.®!ÊÒ1g +õ­Œ‡N&6a•E‰v"i–ï&ê©QVíxHËIY}„ë`ðªôíR:h»M/‰àÝ©cË4U—‡”/¯DÿRo˜q`ÏŪÊ” anª÷ÞH|½p0»˜À(cA½Ž/µm©Br–§¤ µ9¸Ö+*èº`¬r}Bÿ›)ÎeÊVkaÝæÇ)Ìn“¾ÅýªÃ˜ÏðªôV7bl‰d+͘Ë3;Bë;³‰¾E{dûÝ…'KªâJ5Á˘>åRÑz “”¬tÏ{sPj—$#/æ8yÚd_ñÆ= Ò[áâ$YÊ¡¨Ã’ÿüܸ´6§<š–Ñø¤Èb®ÔØFÙLùôj·®¬Í_äü• !èGß—©v-O|ý=òUÉ/.uf|¦™]|™Uu[¼Àù¢˜.;W¾ÚôIt#=S$rXF´ …+)–¥ÒáR²6EWÃcíô»›kü0¼C‡æZž7"$?\/ßÓØÔþw¥?¨Kú«~"^;űN_ÄlÓát8£EãòG÷Ü;µ Èj‰½Ó·ìàù©[œjßØÿl7"Û'9d´pU?4Êç) «õ©%A;·2™ôcìJ·`ÿcþa¬J<½F¡·Õ sÐb®3Õ`šI‘sm-AòÁÌ”zÆhQïèíè!—î2ù¢'{Hñz½ú§ñ-Ätµ{vÓø’ŠVnâÐ\»]ô†Õñ¦MÆ‚T¾43îtAÌÍçj‡¡äß…kS¥'Eûˆ¼Ó˜±o\#og%¶X¡$#™SHš:e#!áƒØ“çÐã惺;‚³Fæa¡°b¸¨?%ÉwPk$”œ/„KLó±øç‡ò¨T Î"îpßa $* ¼àxµ–5Ù¹¥6¬M£5°œ +ŒVÿ è„Д‹æìý‘ŸE†Ç…Y`NJ‚ÁO×áBeÍ“üˆÑëà½ç1CàŽ/eLÚŽÇ%_kº¨šfGQz/OAQ7õ¥Ï¤î¤›Ô¯¶Þýô~°½¶Òø@ÿ¶BèøZS2ƒ”³ñå 7‚íhQîÂÀ@w:˜¦^˜šh§[,-¦î(úÅý¤c|—¯@öÇc½¯9Hü^þƒ¡Äåt—u@•¸„»íË8s h†_ÙUqnöíÃÚ‡¾ôóòéÁ!=¶Žs +kþʘæéÁÕ³%$}/Zã.'wááÍüÈ1\"óŠìºŠ©™ ü9=Í_î¿_Š÷°û鯢KN” +U<q»PCMp7*†®®É¥ç¾ý@Ú|pütçP¤zŠéQÔ Øã*Þ w&)"“ð¢ù‰|c׸W´›™´Á÷ƘœÐ¾Ž`v5ëBÄÊxh÷[);™&×]{z®n¬¥;Ú\ÀÄ š”äݹäà‡û‘d~}ãç'¨‰½!•£µ¸än>3…&˜äŸÅÓê]ÐDN™.A—½äWðo(ÒÅn¯H©‚_Kú${#?õé°aêRÝ[ó¢tÜY8j/¯]vŸg»+$øz„¿%Z4˜Ì¥‰jºÅv}ÑÇØþZs âìQ vZ£RýoF']%™uñªL2S4Ë÷AP%ÄtL ½ÿÜxÝëáéQ +ãGÖúSC;KxœåuYîc-ïþ3RP•¨Æ¡¦nµ [r‰+ƒ>@ç”M>éúMÒqŠÚÀ!ëZPy”$+p¦ ûÌ7y“Dê7Me3Z^õÀƤá—P~Ão®I¯„Øo‹(0|QF› +ù!R5áaìr¤5ŸNB{t–`Ê…\Á)–Bªp™—Ìë^mØO ;ü-dôF›|› +5ü°ÄÞëç*ˆ±Ž\Xl6 +G-KÉêglôlvöÜ)ÐRØIÛÞNød‰ÀD !vn—nK1Lì¼EŽØTÅYœ‹uœ.¸SÌdô»Ã©(…va4}” üyƒÎoŠ›Ø²Dt¡taŠvÈiSOd«Ô +c88­"P7ÐY1˜ë׎ý8zzû}eQž8(G 2fÈÐy"Ê$væðARkI›ú—˜ý«É¤àÞäÇpZ±Ÿ¿¼>4ËÃ-ÁrXݪ1Æ%b€KŒo|#t,5CjMñažÖ̽vÚgãÀ/¦´eh1LÊØÖñW‰ötï ´™e/1_+hṂȹ6;´°äq›Ï ÿ"“³‚ä™ü8Î鍬rÙ}yé‚õ§yÎ`8}:²=‚a:‰§Kö‰Æñ)>ç>ãNœ™KsM'Ïlì,´?ÙâͳÖ QÜÃéÜ'Ž¸ò˜@éoº]5*Qáé†eU +lÜ{b^«š"òÛó¸E m[§eUsœ`…î °Kcpz}‚“#µBwçž•âqŠ;O²;Šq,Ð_æýsR³Êû÷‡+ 3Ï=öë?º!0‰a`˜"ݹ ü‡óGãw‚íÊ zè0û/@›-%þª£Ü#Ôªû Å ‚áq1‡ŒºC|[ï¿_#2A­ÄÕÍ}ù‰”O,(Ý„WÓq¡"ø¹Gd©z”8´‹,¿H·ùË•üdZ´v!{e«êT ì‚.ƒ=xÓá9 œýÜïJ¬[”WßÞ_¤S²òè<#”ñR€–Ò Z‡ÄyÛÒ (¼ê7¼5â­– +s,QÐ#H`“•ñü”_*·ñ& ;4…cu“væU:…®˜Þo%÷F_Û#á´5¯kKŽ©Ê‹÷}Z¬Î‚Ý1Pf‹ìŽ¦Îš|ö~¥º`ê0a ÕÝÁÞ×#ì‚ApOÛ&Ôøí·"2îpóî£2Ò{;ÐöƒL;Ô‰Ïádù™”:9L•jÍ{±Ë« +S{u_¼ uí#©·§ñŽ©„/,†ÙÛý4¹VeÉ)YLöQ8b¯öŽXD(bz¢ÛX(lEy“«ð[(»³Ý0b_Æ—0|c_‹n$‹¢zäF¦%¡•åìÖáu‘wzé“AÆ-uÑ\Áï{ÀôÕân½ÿt›?úS/y« 04&{²é§M6×$ï@-ðè.Êê5`Öˆ]××£Ž³ùÔ²»ÀÛÒå/iIÙ},gßF!LK ãæ… +¾»“$ÒvÀA㉸׵žÂ5@=[Ú]»ÎfĚƙ O¾CŠ”üŽó˜À`ç¤2F‡ÿë[Ñ»%¬³àÀqkjOŽÛŒ!è‚À…Üø¶övTG û./ê&gðŒI‘|äó96jfj…û°‘6>©VŸ£i¥Æz·¥AtAPy *+¥Õ÷/Ÿðd^´…Ž×P{:dxI]‘l¼¢†r’5èê‹hñ;íf¤«Ú,ÑŸ­ž]áÈÁ¤Qì+›ÐÛrÇRlûþfXçÜ#9È+|a¥£V»|>Tº/J"ûʵ²÷BÑ¥>î¶,Ì!ed¨X¤â'ÐsªØ³{U.ÑIׯ¶¼=¾]^ÖÈùFZä$)z}UªÌÄy9Ÿ„¡T¸Æ€$Ó^1j÷dº™“ñ1ñã7W˜ëfˆ¾ìAìßÈ–øø2ÈR¶¼ãöÁ©ˆóL!Š7ý6Ä{:G­âxî5BüòÝ]uíZÑ7܈[óø​ +ˆX™ó•±Þö¼p<ÙDüsü,_¾^0ÚYG¡wøS0êWMÍ‹« å'WÕŠm“ÌþÐêÑ{ú¸ú‡ug/ÅšYø©¥›=Ø, xÌ9)_\˜d±îXË#4®÷ÎnÇÕ4†£_S‚c÷ ?&&„]7·ŒÃì¬îJx$àµhä$óFg0Ë D Hýž}Íð*õ¶èœütBµÀÛm¿þCeð¹f^:ˆÂR8Û/:ÏgÉÇ"“>£Íl ƒˆ4tG ¼" 7¯Ú ôK|ª~´c–1ÄÈ#›š@—xj.Õÿ1¤ áÆçk3vL’»|äB¹™­6€€F¸‹3Ö ¼Jža?œ{À\ˆœÄ2PNõzñ¸Zæd䜜Uù *Ñižjð·-å"qÙˆ™R"c'ò«[HBüpwÚÍ,°öA»_MÙ›Éáà«^§Œ³ÙÚ_‹+=ÝEÄ¢÷‘{ÜœS ôËðDt ¥nÏÅ^šx—žð‹Û'‘år&Ž…x üWd”(|íd{šûAÖny$/ºõ¯¾T{º.ôFѼ§hªzí8ÞE{*52‚Ò¥ù¶´âlɇÁ.~›&£ ç*^B8a³…ž4œÃ¹J’ bÍ—näê=ÞŸ¼æé^_dÎ"K¿õv¸‘‹2+yÏã»–á OuÎ<Ï™0U£2y-n%îÛ¤]i$7SÂe:'[t¦>‹Fi•¼ÿ]mÍÅXm•vüø=*ý‡TƈqR;<•t>’ï ÀÅÙûGAå“X•'ôE-ÚÚW•9§"S3Ýz/ ÀÍø“%fú‡òéß¼DÂ(ÐLp.óÏwv§üpŒ:uÙ©„½-Ψñš*I 7Ú?)Æ%WÒÇ9vÚÀ.§ÕÕ'ªìó9YEÍQÕ‡bÊñm§§@ßÓªb/´-v¦Ç¤ Z:::ÍÞâ¼Y‹žœ1ž³#M§¿ä8u‘ "¶áîÍQ•úUvþQIGì£&o¢?ãD=~qWòÛÆCÄ(M8)y)}ÖxY~Mè××ÙÝMßœiauf¡‡o S)PMô®¿÷2ý¬FZ•µ>t¡™†¥è9­E¤Ð±‡ž®ído½+žX­„;­!8t î1¢ÅM [¸ã™Š= #TТ|\KŽu|¢&õ—&etO¿¤ñ£²9EÃ0k ¦½i„­3øªª=Ãlá~½ØpÝ–&ëzlBºd|f°Z²C5P¥ (S#0•ih$QÜbÙèBÓúÏf…œ”dryÒ íuµyyiØÛöÈM”í]Ï „¸kÙïŸÏÝzYG,\ã1óƒm°¿½`äShže¨Þ +¶ÚÌâÎåHû’]wkW=.08Ò„Dº3_)Ú;™1ÒUÝàbSú¹n{F–­3æÁ|MpæÏŽ+€ÂUlIJáʆD’ÈÂs”Yàõr# ¿bÄV;Jy€Èòv8ñóy£ùŒVâ eub§ +ñs¢,XçaâæeÎuÒ)ÑËÛîÄ"#yû´zÂÏÌ:‚{ Þ­t+IA¡?fxñr/\`íMKÉRO½FôvC·?é#ß;Ÿ<ñ‘°Ô8¦Y¾ùÙRµc‰o I~a<üÚ÷øRZ§ÙÅ<}ˆ¡'Íô4Êú¡nFgÓÑã.ÜpWÛ¶¤¶kªdÔˆLŸŠò‚òøîRæ.R%eÔt˺1ÖÂÛ¨ˆ~ÁËä|2¦ìÐéï†àg=Ô|gyzçììwúm]–ó +¤³` ßtJµ–PK†üðIíÈ–ú½ŸÓq#ÉÑh¦p´Nö$ê«JÆ^_ ¦ö¼Ö~4R^ ë³G§Séï:ÁIy7ÑŽ–ªì„#¨{³k[Ub$:ÚÒ"§è¦àƒM];òÒÚçà‘ÍTZ¥$wÓ¯¿à  -´ÛMÈ’A|Õ[Ô JÈ"ZÖOS¯ÙÏ +J“ ¢-¡ +RÈ‘Wê:ÕÕ‘…µ›ÁÏ9¸¼¹á8´Ùè¨&Ûè&¹‘c'§õ¥rÎ’®ÌºT*®—ùÒ¯/çø4ø˵„/®Àa&èNv‰ü¯¡C–A3ܽIq1Yg:=Ö:/YÆë¡Çé ¸N´ ¾±‘œàlE¾'•!¼‰Ðט  <-êtxÜË"½±sƒÿ«ë˜o%ÑCðqU†é[MWË͉íOMfþ…¹‚ÙÖPÜvp¢o£C¸P,} Êðj›jE%xkYa9¶ñÍ!£ÊçãªÛŠðˆvµ :Î&TãØX)˜ãÇ+ÛõäpÉä­9¦âú€x)9Û‚|s÷Q±öµ`E™ì\¥‘æ~põŠ•€.F0Š4e¨Í½.Ûb#¿„T=âãxÑÕ-ÛQ¬ÝP#¨ºŒ‘•eZHe$M +šP"…C@Ýü@ÿ ³û>ådªŸÚu5ª:|ëùœ²•iw—¥‘ñ„±-™¡ŸéˆJ[WͶ3¾û™àÈþG# €–'ËÒQÏbúåDj" Ùi>Ÿå³$k›hÅF!6³e+>¢E-FʱºãÓ¯eZå†xS È=rP 7‘^xŒöî!îX„`´ &ðÚ<»ät[!;{›db³‹Û‰Dœš³!÷@¯ŠþîÀ{7Å}sw# Õ_œû6K{¹#-Û”(Ç»¤”¯~¾AÌÈÔ˜ ÷áö …8—“ºCeX¡!ìËá)Žš¯÷±‡A°°Û·!DâLâMˆxÌÕqO’ª›o±{wþžÊG¾äP„ï\j¿4Hsª~kõýÚ`¦îW¾Û­©ŠxL›bßkpE©?ø¥)!dÓ•”2V|_’;/4îû6–™'ŸéÉ"ò‘z¥Æ!è+Ö˜Z|mÀ]™»rSmGá±0ŃhÄ8‚ÞçOOÝ.p,ÃßµíñZ§¸O*ö,»T (H›(4Ô‚V¦uU˜Ph_íHNmX}ÃÃ]dŒ*É=Ãd©#ì‡ä´‡Æ*zYºþ Ï;ÂKªÑÝ„âð2tû'{\}Õ«€ƒþðý¬/’çÈŠ·Š$IÏ«ïñ\?¹¼½†¾¸…÷Æá¬1¤Ê}””º¡ÍÅâĆ€ðñã¼Ë»$„žë¯ +ô<†ôHʨÃû¡lîaýnÒ/÷jÇÄ*M³D"7å÷~|gq +:ù5ÌôR\¢qj‹zâp«-5:’ 5ºÙ+ßîùÞ™1EO!fù=?¨©×"GÛAñí ‹ ÊßÚµpÙÖù>¨¥Ä*õq…‹1ò•ˆå.#¡˜†Ó%¬T} Ïøy«HsíµžêÚòV‡{ÓÃ8pqwÎ!-lc[9àvï¯Î°¼åZKèÕ~ÈÙ#öÕ0“/zžBtÉ^3ع>´ÇX³ÐäæËÀ“”¢ª”ZEë'lü±ôX¥Ë”ûÒ}MÒ5AؽóEÙsŠ e^ |Ú'\ûöʦ%ÁHLNTÞPÖ"jT|1«×t;\—0m9ÓVHmZÐhiUQ>ií©é6ª )~™~/h è5é:u]M"ÛÔšwÅ¿tÌf˜ql²DÑÎ\,}7LJ( €/ÖæÍ”cFDÁ–NOf!P‡ ñ>ÜZ«é'xËìòœë“K3w>ÏÜy@ºÐ¤|Œ]ÍÊÓK¥J󙡪;¼ÝòÝ»™êßE¦Öq%diòtªGÛÅ  zoëL¨(«nƒƒá'Œ$“ Ò27&Ø—;³BÖzmR‚î¿õB^éÅOY#¿î¿zðõ•ÔY(wUÜ»žÆé‹ñ šßäú°û²õ„U¥ åë•ãc‘Ë,Ù©®[×ÇYs÷õêô‹0©Ê14´o*™jQ ÷Еy1ÒçäØç´HÈ$Y‘?žîK4;³ž6~©KFz¶˜•}b^ù8 ±ÒYÔïÜÅ·ªønP$ÁÁš.µû, }£jú8?oÆ~¨\%±›C—#£[SBpÅŽˆ…Zr—¹Sjï!£XóRäõ>ÑGØ-ztÏG h¤m˜ÿ´ì}=*¯†‚òdndŠK_úÚÃ'ÎgTY³?ÜæÖAóx.RÖ·Žñ¡´L„ú[¾©­£Ö€°«a…Ž2è'«¢§ñYœË¶ôÖ*¸ºI›¤èä'¢ÎðEí½3 â™WAʇ:vD`nÃì»>cÿ~•ßWÁoZ’Þñ_tpÔœÚlyp•­}íק)sk4ÖHÜvHQRÛÿäNš³>H–ƒÅ+ÿŒÈ‘¬^{e„P¶/rκ¼7+ËøáÕhºÞBrÇW Õ⛸MžV9ߣÇo`'ÅtVY1’@ ‘¤vucõé'¤¶õ¥!Ç–F¹^Mß›±`ÿRˆ$3…óâØ2B³ÈÊ6”ZêTÙºÊ*Ί_m}ÜØâÊßp6vOöÙ¾ý4ÿª&´1nV#Ð3^dÈ÷I~¬m9&àçZUMѺ?L–HÅlué¡> ú£02ñ6HìøW·ø%s`dtv¸’T†#l‰çÀo]PÝ"Ÿ-±ÉHøA«iYað«ÃmEÓ¼8¾ü#_ÉlH¬ÑÛW¼.¬Z‡“ߌÝPOä ¿ÝHØyp¦+Ì¢®4Dó𨌠‹óI»¬‡uÙé˜pû1ß'ZQÈ}?}³Ï3OØ”ÊÀó A“žÚ‹—Û{ä,·E{¥ŸAtÀM$X½~–| KvcТhgO÷[žÖ}&y7ÎÂÕ˜/?7Iù¼Â=‹ÄäÉ—1TQlÖ,83~”ëøjðø ¹Ï‚ AÔ½G–Ì™ÉTï“k{9ÇnŽGg!H¦@k˸$«ì|t»f9(x‡Ÿ<î;²*»wT5;†´óT8àSYÿ#çkÄ´Y€Bb9²R±eÇ4z¯úF;]}9—KjþEÀÙ@‘-_úðmИ>Ñ=Ń ÁPÄËPZô¾úû«x‘~yXMƒ×ÃUM×Îã °ÎââÁ%;˜ó#œÜÊ©dBDRÝm[Ê 4’þ{~s }…£kg„ìi>œ•jx /„|g"VÄ‹“ìsÚ=X*d=Ê7ªgP7Â|MP]¯!ÌБï¤SïÐM$)â{‘ˆN§fóËðÇÌ;ϧ…G¥L^Ç,S&và"óùRtd‹ã…–·/Ñç‰'3v ¾g"f%ÿˆWœ‹ËÚÁ¼'¾…lÙþ®©ò&l´›2‰&Ä…Luˆ¤_äþpÙ8ÊôÎøqÿø”ÜK±EJ;W£ç{5‹Èæ]Ú ñžDž£Šë{žROv7u3¾v1nç~Ï~뱄EF ù<5àî¤)*hlå£ÿ¨ú’ ð´Ýu^kÛæ?Ð/$ÌÉ@ìGnÅ ŒRÏ|ØD'UЩìЈGoná"âé Snr»6Åîl½ÍáÐÓáÀB¯ÂW“‘B`ÿ¬¶‡c0ê KÏ–~þ¦ÀqÎ.ÓßQ¾«šODCÃÑd¯]©v¿UWC™¥T^zàbgcÕ¤ÇIy„fYL£ã¦å±20O”¿T"³F AfžqDi£39‘Jª‘#ü­ØAkÒEÛä-šÅV²Î‡ónÇÕš0ÆèCáVžo3w‰ÞîÕÞüv˜´jr‚Ö²Ëêý©ñ0©U„_UsnÈ{*¯ +Ñ4² (èi¿¤ç³Ó ™mÚGa£ {~ª Õ€Š†cÚI‰Àèêu¥©žæ@½²ùë4å",Ø5;ÜÎߎ¦ã6^ê’[pïiv%ŽoÒÆjàÚ£æ"Ǫfq_¶3•óõ8Û%-R…Mü•Æ…ÎDJ]õZB/dã’)…û&¿ßúU +~m©ú-Ÿ™ˆ¥Õ€±†<*¶Ñ艩V“±têÿ«Ó5döõü³ ÁÌÔJæí‰nÚtÝ›©.~Gr˨ܯéÖ;™oè¦n0AˆÖK7p8˜6ºb£üTP´ä}{‚æ–3+&Æ.níÓ·e,`ƒ¿.&†ÌK)ÕøJ¾³b.®w˜ +|{E}ÒjoY^sªˆÞÖ©¡Ä­²ê5ÕtN¬™Ÿ#I­¯œOUü¾Å¨šbek$ ÿ<Ñ>>aÐã\1À¿Åiþ)ÄÞåÅç ç‘ŠIÒ%•f‡ä˜n]ÔP”0Ó°…•  >ñNb[(¼_’àž,’fx|‘Jù¢T0â>"/ƒDwÙìG2‰Û¦Ç)‰§ÜF fžö´³Ý:ÛÜKÌt¤S̉õœ I×7¼QÅ¡ê· °°¥Pðrúù°é¡)G$ÞÅ‘3ìf6ÞIJPŽ3CÁ…ë°&Œ³aj-]ö”ŠŸ$?`/1ó—XŸUh _*A.=2î>ssà-2õóK˜Žþþ±“óm:ÌÇAæå™ '³FSMYÇñê·¡eþ•Ÿð=ÔxC&•U'¿;Ëþò²ÁÖÂŒ3ô7¡G‹å™[4úîÍ2ÚeCûÃìâ~Ä$ßl9Bó¯ãÁA(KS_bi˜±½‚tÌk! ÷Ž7“Š ½Tà4¾PØŽH¸*$K¨`ζʺ°–ú¶1s˜-4d_J5æÕà7é}ço;¦z/Ÿé­s‹®ýZz_»Ø¹C>á8V5 "ÇZ¦Ä)|ànµùv@6ƒ¤ÝKÕªÀ­ÚÇ ?À%s ‘ÌÖPOÔ*]g^°NxÇ ‡ç¤24åíÈ’£¶Ú.q¹ñ1mjýk÷/˜KóÅ%èMsc‹ðÎÚÅ,>ã[É|˜Í᜘¾uòiø=še&Ј-ž§¿ç¡Ááìèû¬uÖi-oµ‹’Cð‚ eû]žñòýŸGf˜E.#ò N´  înéÞ GQC£.žtJº…‹×8ãYÏþûE€õ.á/Z6.;,¾YAàQœA¯—ÄFÁÎ ÚœÑk³U?[T>òˆÖ…ÐÔÈ)y€ŠThßï‰~'÷¸ F-³$•ý9œT–Wˆ´‹jq4ÐãÝÉ;RH[óúä–„ç«zÖç/Qûcì«=#£V’4õV9ÅüqŠªtû¼/_¹´Z¥néJguB@)¡6ù3Ûýä7á‘æB'Mò`Ù¯ý‚hÜÝLæÆ~G½Ûvsd Q\vB:5µ,2ÞIæ^Wz~‡Àä½ÉN¹ª³ÇËð|¨' 瀙Â/û¡üÐ~a¾Z¼Lµº®V²‡Ÿü‡LM/±òåÊV…ê*ËW;/ÛËpÊR\ÓMä;ªü=VRL±Ýð󊙃Vó¯hNÊc:ÍéÌѺÚØyÞÔß™J¦¦ºƒ+“\EÃ×/zOC'.]<>°˜-;·¥~ÿ)Á9îó:z¶ãºÂ|o_f tøõ:åx3ß»Âü¸òö:÷€ûŒS¤Á¯Rª¸CÌŒ=c9"iŠ3Ö2â°É.¸=Uº)ï/àœ³Tu)Äó™ðPß܈#§IV"jù ý j¶ãLCÛŠM\íýÑëâ +%ånáŽu÷‘¥`ÕuOMUõ꟮r"ŸVéïý#ròu¾d†MãhÈ œ¬Z7µs„L–í9È2AÖlõËN’ž+!ŒYJÝØviõ¨Ì÷ú4Fú¢£$®ÿ‡õHë¬Ô3_½TBt†—’ÊýýÄù•H06#ãb-±ßÕÙ°öé¼¢£TÓšg¶í¥3V½`¸µ#úÉ#`ôÈè‰c×P¶Ý7PÒÔÑÏLô~——'\8t‰©âMÃMñ¢×ý’:´UÔö‡ ‚ú/(Â|u8æŒËÇD’RÑ= îÀ²’°Ž c˜,ã0ÿwÌ­4Ô*Ä®8ne‹æÀË£±õpÖ¬†Ãùþ>1”èVÙ’+óOJG­ë’;!"K§ÆÎÙh@Íãm-®…™$Ï9gÊN/ñh:ÅÔïïkŽÙ/ éÌG”X*¸ã? xÇ]s­r˜XàbFmgrÑß3ø×#æÎ4º.½f¯Ê¾O{‘ÊïiXÞv´ßý*6x™6ô°ÚÒ{Pl‘ûÒ+,Ú'¹›ƒ“J¯?‚Qø…þZ ΑøÂ_×Cyd‘Ñø‰Ó],ÓUµ4lÝá Òes8&„r)\‚î¶ùÑTéënúòR$Š>¹â÷‰9œqÁ¦ñ'Ū…`VäQw|¦«|˜ôuõ]ôi]íÀO}ƒxÐ=d¹kC¶¥Ÿx1ZL6é +s_hKŠ^KÄ–2Iy¾³—²£ ¤»Þ¥àö¹}6+‚¦„zI Çß?jÊËôÍ ¢’j®©ÌÇÈ7·c©iëAß6¨´nÄp pÖŽ]tîÓä°3h ™/ÇqÝÃÑÊò+ÐTñ¢Òæ*’}óR¿#;™h€Lœ@ÕpÅž0Ê1ÁÎ/Gä‘æ ë®ìRÌFð¡VÜtjÏ)Súz…Á‘9 ¬ß<÷»¸G‚ÕgØ1¶WC+œ¦ã’ uñä¹ËÎc¬­±k§’­üZÑne˜S! ÝÕ…hh4Š¢ºÒs¨=®¹¼eÚÚWq4¸ŸS³Ïåïòª9òv‰,Õhñÿèzg9û:ØXø ÍQ–߇íý¯–ucÝÛ—V觪ÍK$K£”j(kgWw_ô7ü.¶>—žîvz.å#r1õ­Ê®K=›èP³¢Ë˜ÌþE½4 /õçô +’Ï[ Ùu¬—<~0-ÅÊ8«òuóÈ4Àü&ü¡÷×gLVŠ ³óÐ`<Þ.-¼ Š)Žx£¬‚‚ !ž6Å +çüĪãôR4íJÚe<¬G6"©bNˆ¬4@òo~sn4Ôõóú|®5ñŠÔ’Ï‹È®‡ž‹ZD|YÑ*Q„ ñZ>øÞ_$I² +™—âîùÔ4åñ;³WT—Ÿ9¼ï;€AÏi§Šr³(om›¼êÑ9^Ãîþ¼½Ÿ£ÓI£x^¹mVg_·b³ ñ.H{œ®¿ÏÍŒ(Úù,a|Mæɽ·÷T%aýøƒøÿðÿ‰,ìf®îNf®vˆÿêpK†endstream +endobj +4047 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 7213 0 R +/FirstChar 12 +/LastChar 124 +/Widths 7221 0 R +/BaseFont /XLGPLI+CMBX10 +/FontDescriptor 4045 0 R +>> endobj +4045 0 obj << +/Ascent 694 +/CapHeight 686 +/Descent -194 +/FontName /XLGPLI+CMBX10 +/ItalicAngle 0 +/StemV 114 +/XHeight 444 +/FontBBox [-301 -250 1164 946] +/Flags 4 +/CharSet (/fi/exclam/quotedblright/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/H/I/K/L/M/N/O/P/R/S/T/U/V/W/X/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/endash/emdash) +/FontFile 4046 0 R +>> endobj +7221 0 obj +[639 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 350 603 0 575 958 0 319 447 447 575 894 319 383 319 575 575 575 575 575 575 575 575 575 575 575 319 319 0 894 0 543 0 869 818 831 882 756 724 0 900 436 0 901 692 1092 900 864 786 0 863 639 800 885 869 1189 869 0 0 319 0 319 0 0 319 559 639 511 639 527 351 575 639 319 351 607 319 958 639 575 639 607 474 454 447 639 607 831 607 607 0 575 1150 ] +endobj +7222 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/sterling/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] >> endobj -3241 0 obj << -/Length1 2090 -/Length2 17727 +3359 0 obj << +/Length1 2084 +/Length2 17900 /Length3 532 -/Length 18922 -/Filter /FlateDecode ->> -stream -xÚ¬µeX\Ͷp‹»C x£Á-8Á]ƒ;kÜ‚»kpîÁÝ]‚»»»»ëíwŸsv²÷÷÷>Ý?z̪®9jV­¹(Hä•èl €b6ÖôÌ ÌÜaYeIf&3“…°PßÁÌÆZDßÈ `æâbˆ @?@_n6vnfv -€°­«™‰©€J˜úŸIA+ ™¡¾5@VßÁhZÃPß dchtpeZZÿù‡=@h´s1 03ŒÌ @3kÆœ$­mÿ6r´ý¿!' =H -@õ/MjHÒÈÆÚÒ`4F`”³e‚\þÿÐúïÅÅ--åô­þYþ_•úÆõ­Ì,]ÿw†•­£Ð kc´³þï©jÀÿ‘“™9Zý÷¨¤ƒ¾¥™¡ µ‰%@ÏÌÊÀÄú?q3{13 ‘¼™ƒ¡)ÀXßÒø¯8ÐÚè¿M@õû—£°¨²¤°:íÿí¿åõͬ”]m¦?³ÿÅÌT$;3€¨ÊÌ ‰ ÏÿýÒù¯d¢Ö†6FfÖ&6v€¾¾+èˆ àÎ 0³6º€. cFkÐ_ ÊxŒmìþ9WÐÑ3ÿ+ö?ÈB³?ÈúÏèþüÀZÌRßêO4廣ÐÈÀòÎüß#F[ !Ðú¯'€Qß -µ×•íßQ®ÿ]ã?`e- o´¶ÿeþßèM™ëÛÿ³„½ÅŸ HÎÐÆÊJÿO„ Àhêjk -´þbÿ—§™Í!Vº½¥¾½éŸHÜ hgó'r¶±þ›Ù@²ÎÆÙ@š¦vÀ¿füS[G»?ÏÿÛé¯ ]{йÿ›AfÀÿØ%HÌÚìï´œÿìÐÒæÏvØ@bö@+³ÿŒ²ƒt€ßAÏÜ¿#Ÿÿ):ÐþŸ&ó'*àåúC Ü”Xä’Šþ›8@µûC ÔâT‰?’üC ýKý!‹ô¹Èü!‹ì¹Èý!Ë×'ÈEþ²+þ!Pv¥?Ê®ü‡@ÙUþ(»êeWûC ìê”]ãßÄÊ®ù‡@•0°Ó7´:üÇ•æúüïø^jPãdüsw¹@‰ þ(‘áŸ'• ”Éè/üç¼ÿÂîÞ_Jhò‚vnú‚¶þW`íÝü/9Yü… )Ë¿dõ§90ƒº£õ_²²ù AV¶á?7ò/YÙý… +û¿dåð‚¬ÿB•Ó_²rþ«É¬\þB•ë_²rû ÿéyÖFÿ× þßV/$dãâNÏ zžèY@]äÍàbçòüÏ™*Öf §MRÔ(˜˜8Y8ÿ5t´52‡½eA9þÍ@¯ Ðhˆ°8gcÈ`žTTä%š;Q MmO\0ÒX›ÌÃp¼Æƒ1c×0® $ºBD77+AK<•.c42fÛÀ­ôèwWb \@ïGÆ¢ÎNQ‚=7<ÖÖ…ÈìëFµJÝ_$Þ±m =_"»]wj‡®9dæÈÁ=ýU4?÷zíeá=º±ˆøÓˆl7A'³E&¨z°=üt"n“k³˜?€£r‹ù¶ˆÛ½:e±‚œÌ–) 9›ÌûÏDíb¼9ŠÀœjA¼¨žÁ%ñ^Y»JÂ0è4'Ÿ¼ ‡ÌQPðý7¡ù”94&GÉ »0lÆÉÆ`‰r­3ƒÎßÄLiÿ cm\1Tn‡þÌÉf³N{Úë0$äÁôÓ§Qî§(Äãƒ!”ïFã*5,O3¬~3ÙÃüÃĺ&¸´~ØY oLZØ·u#˜Ò°‰g0Ê BŒÍ*퇋éPb²?Ýz¦8ºáž‚ÑTÆÜ9ür¥»x·qT+.3$‘"…uqN¼ ›°ý±É§¾rüN}L¢wØ;°sëDL“âž^" m3Ó÷BXºU&½¢Ò••}|™ Î7nx6&„f•EžëëEpãtì~8q6»¦!æ÷îê´k^tŽŸ9Dc£¢Á‚`³ÖL[,Y@èa¥QôßQ/ ŒU¼Q&h1R¬É˜•ýl…ˆ™6YBYæ È`è—GÏ1âÄ„æÑiƒ÷ ©»¤P>ÄBÜÖ¢ïýé“9øƒº–$êa[Z©züˆJ.Û™ß2£²©cÍìÃL¨8._Ùá‰àmtíG„pÚÊà^^'ùF¨þ#¹o#´nvN—@ŽžViø‰l¤Z'A[v!ÁÖ‚¡Z;ÂΆ:EùIy©|eÆ9Ø·u*2¥Î©òÎ÷û+¢Þ<ϵ{åVØãÁG|OZÑôdNý†žÊÅp!ôö±{¹”¡³P;>ËS¥m“ûφô¦åožÏj\è±ùÀm’»{ððìX]…þ|×µü•ÀüI˜&Ñëë ÁªÞÜ&tŠú“Šõ5SŒKváø`ûÉ'3‘¶# -µÐs¹¤ƳŠÆô„è‡i·Cb{õŒÛÁ·mPÍz^]…,ÎýÇêxÀàqEÈT_›<:h1©4£àn¿"¤í¿Ff6ùÏÙØ$îõù&Í=ZaÊZ¼6O)Ø}|“X5 ™Þ¸¿gE¥ó,Sà¤ï˜MA»\×Óï6œ°–Ì=\£tGü¦¬Îטs¡!Vw[<Ü·³ågA41¸xÇvC¡j(É1Yž¶or>?5‡| >o-ÏÁ4†š›8[6EuÛUžà¦' ó˜ÈAs)ð4y6ña/bˆJ¨¶Y&‹z¦”‹åR⤄ ͹SÓ`Ïä¯YÅKn'x4XyAˆV÷]w<+„ÊXÍ“†§ˆè¼+Ö¤< wæõ{_ÏH(¶~c+ßAíýü‡“éñr™L€â~æþ‡5è4“ª¾ŽE&‰«ö6ä`>ÌÚ¦!=‡Îù ”bÌy™uh€ ;îñ¥–NáqF!^§OÄ*ü1*:4°c£ÕŽuЭaÔé'‰ yò}:·ˆ¡~tÊ»w#¹NäœÛTHæ`e¸ÎIÓ´XÒÌŒ8ê3$›÷.~{òCƒÉxVçÏ–~ °.Á«‡®e6rp›¼µDí÷nÞø%p‰ƒUˆ-[F|“ô×6ù¡9ÀÖ§!"M›²ÈæŸK.µý•G’ÜH«¤Á|- -Åš±nÊžÄYìòzèºO-Ù|Œ È0 ®,QB‹­~ߤÄGaJqƒx¯?´õÔ÷t½!Í’ãËÇ_Q|¸¼ˆaíR[wx·k1÷®â%. >ym™¢ï+>e®ßžÚ7lÕ7ït½„ÒØtÌCÀ/Ó«ƒA"ó1Tû®Ü kƒ2¤zJÞúˉ9n„!ú6¥ã -ÿr$u§NÙ§ú,G_ïÓÛ(=,’Â|íúús3%v›ìà9,-sˆ4‡<²—ô ÈÛ3Zs»3¥•Õíš­ leñПrƃ·๦y”þÄß쫇؃uøЮ·õIçâWd„œúÛþÇ­ví˜B -Ø4mNƒëVË.÷õt”ü'•œ´e®´´÷åøPÃ|?¼¢Šò鼙휬V‘QxŠd÷™ΚÕÙ!Ì¿r”ÆûÙBzÅöêqÙÇñÇ,>(vwº.÷T}RÓÞ&ÓiŠ²Ô,‡ÒÊÍ„:øt˜(ÐTz5¸ùÅÎ<,˜Î*GÕÈ\S9xBÎØ)¿[îû@¯¬ZBT¦Ý_ù½,Ôiv¤í é3ñe¡Ì˜FÕ ™Ș¤6 p[‹ž„ÒPÊLò4¨.veº…£vºØ v³Ù÷ÓLUAl JîDŽå,óÊ|Zs“:à­/a¼sÌ^)¢ÄV˜‡D2+\ð¨Þ×pvM:¨Zí×Àh,| *_†|þ:æ*-¯ÀÜ®¹ýd:NñÆŒœ]Q¢.ßožÎ‡ÅˆiçÄÈ} ýk"®¹ÿZËÕ¸oëã&"!6`IT -ÓrD×O¯2Hð¤Íæ¢ÖÄjXjÖÃɆ^¼¥ÃyÇ£K^ò—öaÅbo´݃2ðY±ðq)OVh€›¥C¥)Б61)–?ad°ž?çÈO˜| -oÖ%Xlf•ƒÉVú'o‚+ôy^§ã5¿D,8w:+¶ªÑT–ׂ,oE¢5Á íÊ؉ݽvÑ•!*åøÃ1¿¯+IO„ot1Æ«Jáä`VŸžVÊŽPÅ>K6îN®Z/XÎA<žº¾M|7M®C±»)í¸eõ4òüŒ·rïÇ«Ñml]Ïû·&‚ -U–ƒ~A˧mQŒøš.ô*röÑ”:íãø26埸p¸Ð_8XgÔÔô>šÙ§˜ÒaÂ3™}EØc‹ˆ®b9Ò®8Ww?^\{QKdÈ|7MÖÊÔ÷’er”^q2#WLœðcþn[Ê(ˆ_#á ¡®ØÌ h§P5ÑvÖm£QŽdÚcNØx/þes¥´m­—È}Ã,%‚tRlpo®St×w, ¨“ÅòPÂ\Ãì¸ØÞ×rÚzÕ£fÞ˜rPÃþ~ú¡aè—Žµþ­Ç·½Zl¹Á²¡3æ˜`…ƒ$”/àoñ©#a‡¼ôÒt•g†„{ÄB†ý¶T* ¦‹ÝM¥öêÉ“éEÜ¡TÙ0ƨ}þ4º!3”‹¸‡Öuýx.·ƒõ»#©'í7HÕ¹ x„ó¦Lõ@ãoV|ífŸuƒ©‘rÃT]q/_"Okæ—¨š£îh>³\g`È\ÇO£O#ú7ùìÈP¹ÎR™b¼Š‘¢Š:éšÒÛC=x>ë2[Ue{‰ï¶%M âGó§ñÄK¢vÑ`yiâÏÞx­œY-ÕÏdm©´c§T´ÂxIÝcü8nøÁaÙHÜðD|œÜÝ¡…ןŸÒMƇK¢VXÞ6øV‚Þ”¨yé°·Gw1€ÏšªÄ¡`ñï”®G¯3½„6å•“×\.K -Q±xëlj2“{èZ^Ï@œ£ ;Ú°Ò’ 2³w-S@êÒí&’ùÚO…ȘðmüïÃŒÔäa V^5™,E‘ÉÞ5Ò‰¶ùÁÈZs\Z>”YecŠ:Ò\üÓäSÏDçÙÕœ¡~n²§sTÿº†˜2Gw€ï°¥»ƒŸ)½æ‰ñnz¬˜üÚŽòY¢„¶[Ztaœ.3òb>„´Æ¹Ì0¾Tglmž:¥X9‘àÑå/Æq) &  ">w·Ҹmñ“ûð¬­ÑkUiÓ/êxnÎ|jÖäU8Ÿ8ì ‰lÈkIÁ<3)îÝt-V¯É›oÔ™†MÞïäm0˜RÉ¥¼›å>Ï.Op3¹¾Aâ%î'_ÁÇJi 9Nêd¥¶ï¦DçÒÊW´'kc”ìègô»}P[k”¬+Þ·³~~‹;r¯ q°7¤ñ ÀM/Ÿj›åÎo¾gŠ}¦:ìbb[•Øœm9h/Üõòf-x±0¥°!¹Yܪ›Rõ‰^¬¼ <ºê›Ÿó^R±’hÉÛíiWmòn¯NN}W×@ú‘›,ÙÖŒwÑJ&W¡róDª- Ž %:´" ŠìádàM`˜ÝC– =Ûáú´–-g–p«G[D6z$Ô;¿Á Y¼™4t;€<LÂ0Äáà“kÎxh6¬ž -¯YöAÖ´Øq¢z[Œèf¶gºhó2-ÈWʼÑÎ8v~ŒHßJ\¹Üô‹Ú æmˆñ1þ;ïdz(î)¦&i¼P¬q§ƒ®U÷9ˆ «ÕeøbÞ“†ª›pSc4c£csâ$ý»;‚‚`^ )0p÷]³%Vk²«‘©èDw£€U4Š¸ -€Øª¤^ÈoîæzÎv“åZ|>Jýö{ÔnDJ:û©Ní©õ ÿ“ã׆´{}˜ˆ5õî­ÌGªåçþ»ŽÛ'|K§ŸÒý¸‹ÍuNußm.[c¤>Û`$M«237R)OBëÏø(gIƸý¬¥•æQ¾_슷£Û!Ò~©!ûÞù‹ßm…Õñ˜»”ŒžyÉÃ3œsºµ˜C¹kVV7çpŠZ¼bŸ´ †“…YñxÕ^;Y4…0´:[‹Å)蜬ˆÎõ'¢cçå³!~Ýâš?ã}¿Ëim<_¹¢É\ý]eõÉ~òzØø’XX9“‘ý¬Räbi‰ëÛc¦cœ!I£ÂÆåÓÚæÊ@…|3x/R)0z±¾lu»ÕaP$Â16–öUÄÞÏ~Ù›¤ú(‚Ù©„«ä1À«–l~Äf_צ~aYçËn×sv?nvr[&m~‘cšW¼`O¥š„¿iA^Ñãl”¨‹?¯ÒfjŸËw,õˆÖüŒ>]+¹BJÏOšÎš@"¶å¼ó‹^YŸ@•]ÆÅ"е$e>Ëgî¶í…6©Ä*¤ÝlN_9à¡0Sð¼æ’C5ì«a¨ÉÞq^çXb ×…A±Ÿ•/_W{íxR]ÑÎ4yRæx/’¥Î·¦ÌE|½5•›¹gr¨ -Æ®X¥)²™«ùÎÞo‰þ>kMû¶ô¯™Ù’£«yǼ¥¦æŠÏwYåžìðà+±ç¢˜W¾|¼¾Â[9Øâ†ð“wÞ6–^à‘¶~gòI´Ã‚°z”V¨2Dsm‚{Ä©+Ðǧɨâ,¶WÁSL “õôÛ$tÒ{±AånzÍ<<ÓzÞ&Px¸­ÓApÑ£ÇTq„þ aN‹5äNQØã÷G©ß×ÓMO^cblðEèù&èÖ)5‰àöZ¢¼áÂí3Gʾv0—#?δI#† c§ …8Nà› -û0U Jj’Æt>’—×-—C(¬TV<ï»ö*ŸZãÞncƒœ…ä>{Š!Ìöb‚³zÍræ÷ã/WýëÅÍĪ;·Æ—[qv»æ[XíÏuhÝq¿óÞ…‹ADÐ Äù A“ÛR• -]ÜõßÇÓÛ©2ŠïBB/èw^ïÀljÌ>PoF¸>í%g§±eÚtñîPϤ,Î…þ¦ ^Ïã„g¿þ›Å€@€òôÙ hHªãC »óšo.X÷gµÑ¡º^ ÄIÚ¬K¸äÁoëŒÛýâ=°ŒÝœtf‰(h±›Þ/Ë‘¥D±·žý¡FT¼3è…5Þh“Q»ŠKà¸-¾UC; šŠ£9˜,©‰Ÿg.Ÿ5é$8&Ãå3 c‡>³›ÿ`g0"uêdqXýÙ´“BžýNÚ•ÞÐÍÊ]ʃŽ¤Ò~à8mØï°Eoz#f¿C}î­,Eo^¡ $Ìg!‰IÞ;%"¢³øµY“~+ J駕tâL'«çævìÄJ¦` @DR$«•0€Ë$¦ÒŸ6í1‚à‚³ˆìɯ2\çûd>ûòuŒù—ÑM زO7ýIX*º ·É+^#–DèØ­bXj9 a<ùÀˆàƒà2Dt–jƒtìhÁG_Es!›4A~vÚlp*mØÎzÛžÂd”jr¾½Çœ@Ow](˜”5·Ù”–fTJSRù«û³)L¡Dƪ%þcÏÊ„ ùdè³(“ðiÕñ7/UƒëíòfR’pÐ\¹^¥Z¡¹‚# :vøì02,4ELÊ=k i½Éo¸g›—Õ¸;¹!˜]½&2ø×…†µgÍ+êN¡P·j8U›êDfi ®x7É:kÛ>ŽHËr\Œï*laêèoýFxaÛÇ€óVCÝŽ °˜ÈL#¡<ù‹Ã ÷š Èc"Y ͧú°èP…Ë‚ùjâž!D¤µ«p‡ $k”äèiy¿†Ž–"tœUå|ˆ{— -£äj9n/]ÂÕ)«ž‚¬B÷cÞøH…<¯=Õï«@îl®t~Îb “ô ß{U|ž%©ëÏÙÿÜòÈûSÿ澉© +e‹µEÎ<Ù³.-/ßoz2€†Ú+r0»ŽøÛî¦'éûë#1)!ïäiK4Þý¯;nH^ë›´]5IÍX?Ìã›ð0µŽEä–ide\V9Œœeàl¦G[óIåW®Ù¨›Â¤u­ ¡|ÞC"iKk°ýïF2ÍÙ8ZCØ[lyt<Þ³Ë82~5³æ:Èë{H¦~«î‰2Ô–^f™zØúoÚ‡lfB$·ú~ÚŽßlxÓL„ù%½è„Ñ"ÏSÉ.ÒvØ7ÈÉfûÀûM§[–ð8ʈ·Vó¥A1{" ïÅ©L~µ  ÚÎùº£¢¦›„ÜV×ÿsEcè€^C&9I±lG\&0`'Ù94ÃKûå·°;<³–ÍüƒIa -¢#g‚ :‰·‹C×€TˆšµÀŽùDæ•ÆÉÏì.èÙ–†OŸ#¢¹¼Ú iB”šknž$\ñˆÀÌVHGkŽ¸¾ÿ¶{2 1g© -¼ìù‘ÛÃ<ã»Õ6Šœ#Sp§8c’¾º*}aO©]Ýk•ï#Ö>”†l@$jߟ]zXU„ò"Ê1^dåöÞ’Zåw ôV0×¢ ¹Ûá^BÅÒ•r ¢¦a¥D,ò‡`Á§æ P7>½r\EI^,‰Jìÿ"zk6öÅÍŽµ´VYpj›Ð¯¦ h Äl»ÜÇÜÍ,>(Á|Š¶UàŸ ð*Ôã©mˆ÷÷ë¡âÈŠ?W£¢K° æÔèåb^X·Ã ª¦wÏU†ÐâGøUO¹Fo3H÷Øâ»\]÷>}1Þ5°náôÆß‚~ßuy-_íú’ Ýl ç‚Êm¨Ÿ‹E˜*‰~5 TØ$hF*€ü9öà™ ?ý3+Ræ‰gÇ „6èúñ(ÿÔí“;ôƒQ^á—†¯Þ(=~ýZGOh¥¾MD6ËÒiV¿žcëUQŠKÜÉ/6:G+^Kyq"ÄpÐaŽæ­|Ý5ŒÊšqk„OOb쾞ødýˆ¬H£n¸Q‹AC)‘‰Ý±Å€†ÕŽ¹`ãôP?¥§§NbŸÙúï0¥• —olLBßsü¡n'ŒÊç:º¶цî’z PÔÀ0‹‚ã¹ÄâÅ‚Éh¬tôÍʳò)z]¤ßEÒfÞ+ò]g˶üuD‹KyÔ6ŸÈ!C49ZŒž“D³Åí?ÅÑ— ÚÒBå Õ _pD6 ~ÜȘ;M?HûÖø™—Ö%Šb8†N1µj‡·>ÊVÝÏZ?ç¦Ì\ì÷VAüø¨ª1&dˆb¡£I^f|P \Š5ZBû@Só|h3¼ωÙ4LO/ Í…FßÒÍPA É‹ú¡a#aØšÓÙ¹’ “·Åfbƒk˜ï¿†[¡ôïVdq0ø [£ð––ag·¼j. -ˆqÈ7겓ňH©‚9­9ÎäÏçVKíJº·ì(ä.5Þ»îÇÆ濪€Ñ+aŽ}o­Åoé£2dÙCM¹Tù«iÞµçšÕ×ê_(‚ÃjΕ°ùø{™ü¯Ä]ãð?õuÝãR·?M`+ ¤üè;Â2'€¾¢)©M`¤O+*ø<‚ÖƒðjÝÉH †Äßò|¬Gl’j#íPøé#à8…‰5‡Áaœþãk¶“ÁËö·âÂꜦÿ´P¸†Ò È&½iÑÒÀ+H¯7¨¶ -˜_-áÒakÝ«f¥˜Ü|-[Jø.“Jùb zà`€Àé«P𠤟hüüÆ ¿ -hn1R ­mèE¥r…üùâ¦ËȤ_+/ÉKUü|ƒõ¾†ÚcôÛ¾2¥i¯’qµ¹õSã÷-rrIÊܩÅvÓËbÙïÁ ¬ÐôúÅE’–GoãÇk~;'JÊ[ oFÆsB‹óÏbX³8à÷[W2\¸w¦÷Uÿ©l›<î>½íêp.ÕSüÉ"ÌøÚî”g·ŸBÄnþsîüÒ¹²n»‚-»7~÷…_ì™kÁhä>«Ï©®r‡6\ YzbÔ«'x67¸-c]–CÛC¶Ž/ÇgÍïökvÃmÚXJdÐ0ò>Øw‰¢·.ø®Ç´-Ôk?j¡íC†´Õ¢ãíÜÓ¨øÕ Î,çÉÀg%”—Ne=ýnA ¹õß´š/m(Öè”Hß¹mÓwQÀÑõ;ÑÖ8ª%5V†?Ý™RÅÒ©^\&^¨ÅÄ-ÓDä€ÇÞ…I6W §dØà>æ~ˆ !O&Chðá4ñt_9g§_#QýŒD;r”˱„¿M'é$È Ú]à©*{¸žRCŠ -|µzš•Ë„LM Û+ÚŸûWSÿÔòXÌÖ¢íÚ™~£¥±4BnÎe$b¨^L_T'Œ2 ·µæ’‘Úÿ^Áè#EYé-jÊðxà€Ìg÷^RˆÔÝã¬4xX±“°NdúŽ óR£ßvv.Ôz QÇùé&b8}…¢¬4”€Öó[fRõpÀ»¯úiúðÇàf–ð-ç-œú¢;—r5ɇ”78ã»!ÚåRp"Œ’ï†äÔ›Í秌ü!þ¶Êj=Á@ûëûÆŽ*œ\ˆöVùaE«$ylë|ïˆMÈlV_µ7ƒ!Bi°: KØÇT9¥Ÿ fR¾½ï‰¶YR÷t›$]W¾Ò¼ó;ÃÒpžÑ“Aìw£û½±®´õ}®YP¤ :uƒ‹i.±r.L–?Vå%—(–­àk"°x>ÐQ ض®Œ®øálUöûø5MòÈ¿ô¥°úq«¨5æVé}õÍ -» Õoã«ôn Ž«Ê¹*~J×Übþn½ìqC†„¾ˆúb;µ=X×½ÜÞ¨†c†üAòM¯…NðÄ‚‹nžÑÊàîd©j ³Åú;yðã¨ÀªæÐ暉4´ãîö'„«î7nqnï VÚ; -*ÈŸm_ •É-e©jdD ½kp~ChsyyjóÝ«ÝéÖAð“Î+¸ÆuˆÌÛùÆd¤„ó`®½‰÷ê·‡ òŠz‰õŽý17Ó0qXkUÉMįç•/àûâÙR²!d,˜x?á)ûá64ýìzÁ¶‡¬¡¬î$yûQl‘å~tÿûðËaFt]iÿÞì Kn*¹yITBþ§ÑÁà¼YÊ03lüÎôwqÉû=N¥OjMYµ¼_DíÚÊÌ&ˆrÔz€÷væ‡EùoJ‘z_iVIí ¸ëðÉÞ”WèIÍ~…L©)M“6ÔÚ_Ÿ–šã9ÓÖlPš‹NNW´˜ê/óŒ”à0±º -+«íÍ•Öfo+…äi甡¢;@nÔ(T9TçÒVÃ÷y¾/uÐäHFíš7ªjçþRìc§ñrºEÀÖÆÐ?ÎÜs:£JÞ]øêÏÄýÄ,-·ó¤¶"¨C©8öçÚqc§5#y)¥·ó¯Œj[$w•Aæã –$ªÄÆñª­ùðÜoBX¨¯š¶ç¸_%'`Òö!Ô3%DÃ(§¬^bp牑û¡tÌsR¿²ÃMWÀqåöç†Ïóvç?váXï"ÑÓ''†ÍÏ/h«Rò4„Ù=ËáÊX]iê®ø˜2·K¸hçM¼øùƒñV4ñ9£³Kõ†m£Å(B_úñ9ïòƒ2_s‹mxƒ‡¥Hhyo4Ì/ÚîžÄ·G̯ÝéÚÝàÁT­‘Æ’2†îB]ÓdI¯ol5ô”š™©çŠ¼ˆå‚غO;3+Qr(}ô| «#79mékòß9Z“šá%ÝRÖ´-ü(òâ±æ)ˆÀc’(=²*ö7 Êvû1 -ÖâªüPè«ÓÀ~K®/²)—–®y76üX¦=\Y.›.WéŽ?KSçƒs‹ÝæJîâR݄Ф¥žÄ°vÛæžÔ[8¹DgùøÝ¡r`Þ ©Ñxî(˜0T<±ßEŸF¢>&ùh£µôÐâQ7GÌ™ðèd ÁÅlÍ9ÏD@ ;Ýi®U{–MÉÀ¬©°Q'_L£Õ°UYõƒMq½*èf¯yãz±6ê -ü¬R”<ðGð»—ò楤TxÁ!¾«…¾/þ -´{#ôŸ»Òä[vKñkGHxx í6~~èÖ '=çùbõæȃ°Öõãø#40,Úè$)zÏ=†üÖÞïÛîÙpKõ:¿ã´3m -kúƒÔäCqû]~ÙäûÜ…¥Ä0ç‰)T§ž[:oS¼íŒŸ fr‘[Ùî´ÝÐ{*tù ”Ö2ê›ÊYúÝ?¤˜,-þz¡paÅÑû¨V®$'s7ùíß,——Pï…¹+’²GÈH‰m †÷Ù^‰}Z+WŒy˜xE6Dž×óµ¬FÕr´ýŽo‡€IÞ9h?U0ÕHLzmI@I¼Nä Œënƒê¦èhU_à('RqJ¨]J@ü¼wù¹„­oe©šï'¬»çEY²ïÕüÒv 5B?}`ŒÓÚä©õ“ÕŒ -:чާKÕûŒ‡íËMÐ]äÕ(µ†\Õ‰'/YŽ!H³bAXž®Ú0ß,šÁõ¦ýãòjo®³ ¢ª7éÁŒQ bOìxÕµMÍ5¿ Z*­‘¾ä1qqA¤0¯içP²»ý>­MkØF‰Ý~’ôײWÛ"dE¦¦U“S†rü´$]]%K{¾ 5‘–í¶ýEʱŽE‚A•o¤â&NZtçlv[4­Z:œÑÏ4¯ÆìžúL¨ÍO9Œð¡DDýò˜YÔʹ2{ ϸ¥Ø×*âg—ÿÎï›ä,¿À°Æ’uÁt/Gùüñlµú¼‹Ò‡Q«)áâ@ŠÒìB«R·%Ôz\~:–-$AQø—–Ô¤d ¥sØIÏY,õm0[$s—ªïhoà±oÞ•,QqZÊŽ¥ò”ÜêNPç'‹¾ÛÞM…_´Ö5–zTÀ“íŒ_¿gjÑ¢œÕ`“b§(yã°û•ðÃgd¾û¨‘ï¡:ÜK©gt¤ÇÏ¥Yγ |Á®Àt¼éÞÌþ…˜í}ö£¶]äiƒ1¥(¢îYðI9¢wŽ¹©ñWúƒmåÐí¼°Ñ<Š«"úA}DÄË„ÇšŠsñ†Y½qMüÁ3,ì$Œ>hz^iBüžÇ_'ç¯Vƒ—_œTàË w—xpNÕ¢l(¿zÞÖëy&šÊ fÉ·²g_ÁÐïÚ]ç:Q¹Ñøæ±ÚrsšœD¼')šBU1†dä¦'·‚³p±gwJÍ54ß„ÆåÇ~‰ê ÐUÙøÁ«ptê=ä"ø”e©ŸSbçü[Op ®¹#Õ0–Ê”c~·€Ù¨8aÄþGsï‡æUå5×Ö€á›V V‚»oÒ=m)Mw§1·ÐkÖ<%o5åû€y—&°m4ýíLsx ŸJZt߀´aYÀðÔ ÖÜ‘SRÍû§r×7#í«ûPwì½.}Ãhß}S&ìê–P;TZN™Ó{{Û^Ï ¸¸Ñe ®ÑÀ_¶ˆüð¶ÀLˆsuÜnc=êµnÙ˜ŠS¶˜"÷aoò‚è©G$YÖú‚œ7q›Küb»DlWú"5“Q¨eæ"O䵫3è°UÇHz$l+‹Õ­c‘w+‚¹…ì¨íQqcü`=™"£‘ÿøè,ÕØÔEí)r“­ )ä=—!'°¢°•œb2Cár45ÃÛiþ¤¾}vœŽ‰:`*Cÿu¾›³‚&õ(Ô ¥yG÷©ÒÜ4‰*ƧÄ3ôŠo5î>&Ϊ -¾c}¼ÁR× ¼Ï<Ù죅H°ài  -'É¿'L{qaÓÃøʺêR,³«ceW6¸±äâÏßË ¼=ßLæÑϪwà¸Gbo Cùã!ŒlÁ36òتÖßàÉG_ª(~G(`5Å4ˆECS&¹Œ5Ø{¡Óû÷Îi»ýˆ!ØÊéàoF|tÅ&鶈SÊå67Š1 hdò.DR»ÖƒkQ´$/zÍ´^6XÁ§ˆÒïtg˦ ð 0'ä·´ ;³FO£ºø†ò.Ÿ\!I•÷+}…¨6DÏ69ÓâqëKm!û(>;|òíJ0Þ´^qñŸ«¸™a³c˜!˜±RÚ68Ée¿<:¼ÁÑ&­;¨[XGmM½}‹YÂKMc%@+zjä×S7ú©sú¶„«öåL¦(÷© ’ò6ûÎÑ Mû^å¾ÛÜÀ9ø*ˆzŒàrà®çM„7%’Õë:æé̹|&¯¢ôKîiü߈ȥSØo¥J€5Ì&«‰ –á Æ“ºŸޤ鱵¯ÆNJD1¥NáKq==W­èˆÆŽ›-Dÿz/5C(¢CÎǾT‚öçËz·Yf²^ÖWùg#XʦýÀ„éîŸ TÎÆFäÒ“´K¡«´ÄÓ¼#ÔÐI[L. EîÜ"âM[(+©Íð_ÞÅ[ÞÓgº •e ë=KÅüB9KK±àÔ^(tíÍ ¹X¢ðJ‘µŸš9ø*5±á¦7bƒ°dÁggZ(|âÖt¨ƒ»¶¤!åÃ7}!©ËÅ47^F>øK -U¡…è;b%IBµ×Oß^x¹âFÓÈd^å÷üðÉLyÖø3{”dv-g<(\»¾µ1zÐønQ º/­ÕÒ5£8!‡=‡¨^‰²®š²Ý³½8&úŽ.—jWåï F‰šº1"ph²d’ÚBÝkááã’i…cC$,Š îv& ßZ¤C£MVƒ`N¿3 þ”‘Kkà{Þ°»íRA—rÍxÝ×”Xõ[ùÎU×ÔÜ÷›;`&>Ü25¨Ý ¸\êu‚“]çæ˜1—B£»4„zæÜ’š?WŽèüTt}ŸQÉ¡šÃO FJ˘t¾ˆuH½¸Y]¼% Ï+Õ…Ñg0#0òå>Ëõêªù¾_åb¦£Z¥ jj]${ïs»™÷ïŠclôÕá1\þÔnM²ôï[`0GÔ0\žº‹ûßy"]b÷|a¦¤±ŽÙ”ر™µôÑI5I#¼í·%À4Ë튢°¤Z)€q„Û¼r‡ËN3—¡W¿·-O”ù&ÎxVœ¼²Ä”î Kévé‹©“m`Õ5Bâ…Ö›2Û7Ç• Q¿1ý²ý©å0o"ä}7bŒ|3`Û¥.IEuuúá”ø:ôB~üfôW Åx ²gn)žrqöƒ«ÈÄ¥FØ ñ;/ß*¦Ò!Ó!·Ô(ç±°ï¦XÛ±s2Õªri\æ©Šº#¡ùè4ûcƒÁœÑ-Ù.Dl;Ñ8¶ïaŸw s¹m¹C7M+H¶ååb!X¶Û³Ùéã~¦Í¦äò¿À<§.€‚. ã²Ô¾ˆ©KjL±>c²F÷˜~¨èûÀLV×”5¥˜cÿf -)ó¼f€òÐCÌØ—PEë&Øܵ.j9|í† yÄh:ø‚/„*¯`óƒ)ñ:Ìi;þ”“¢Ç o?>ªgrŽ;i›1[iÎïão÷½2Fku?°xü[Ô×¼E¥Qò³¼*ÅÍÕA§3k¹(÷P~ÃÚ£bt…¹¸a¸òÚ‚$s‡£¤` ôP²ÄÐòÓךTQëû*ìÂJƒ6@´”~7ÀJ‰Â[BÊ ©Cô0•mÀ›qÌP\á!ÔŠïQ -3 -ð¢I96ÃþÜ¡¦‘ÀòÐf€11³oÓd]ËÁÜ -ÍdìY#Å;mæˆð§ˆ†ñgµµ1ÒQ2Ðìr- -1û:©%-U-LEN¨ÎI¥W-Ñ$VÍ·Ë×øò¾'“¡lþ›®ßá“ú%Ñ -SöVF£®•¢™—)ï­˜eÙ’‰ÝǤß0 :ÛŸT´t[ó"Ñt&o7í9ÆQˆ^®ñjÉñqVäx·É„$žMhLè¤âH› sÓëÆbÕp“dò÷ ¾ öHÕ.W\x=R›£¾Ÿ!|È|ít±Àsû[ð+\ŸYWœrõâ›K2D•Jí_2õò3LCÂ5Hñpª,U•*vì?¼%‡;ßDÔ3Úã÷·sþûHâ±ááPÛ=—Ð…œBŒ€Ów¬í« ¨²$¹ù [¹Ë,-µUPóiH"Û9Ç(«sæβ·2ù%‡ÁV"Zø­GÌ*``GvíåÑš}~íòÃýœ&ꮤA 54LviS|vâT;³ÞÅ.k²‰‹Ü@ T,,¼&¦Õ ÎÖÉg›Ñît‡æé¬Ò¢$EÉ`Öå9p©O0ÕÆôÆâú¶›§O6_½êFBE_ÒhvøÁØÛ"ê“œj§$ã=»îY%g Õ²œŸŽÉËá.;b!0??÷AñgŸÒ5†!½Š¹>=!ô v™@»Mˆÿ‚Í -!l'‹|afj¹:$j•¾ðÅeÅÚHØlåI×TÍk/UZÙV*ÃjÃNêpS ™¹Z±àHÈ «]ÏPþ]<­…õÊ«L‹¿O%â&5T—3Ú¦øfzÛû–PàÜ 5 RÚXJ¤÷X§"&’Á CSz1¢€ÖCKÞL0.Šp÷×BÞM™UíáÌX&ølÄ+‚1Äg)ŽÇz q;FüØ +ù×N#¬¦ƒ¥ºÞ§lEž9¶Õ«ý—NUŒÂgÞµK5¯’ɳª* ÿ@ì­q*—¡šÝ~³Æ/â\ ¸¥œÁ åý ;r Õê¨ÓT®à-/‡¡ˆ¨¼à¤î€ro<Ê„úð{»^—(G”0qæs)WæqÖíKLŽÞдÉÌÁBÌp‹Çpgì>à¨ãxÅ2d€²Tâw¦:Ò+Œò{ï\ýF›qò£ºsœ|îX‡¦ã²üF`©qîi¿‡“äí½­¸T¤p´ŒÝݵºE+8EÜcû­T7­çžàF»Ó e?ZÆÝVŸIZlئ¯sJ¹˜růÞþ'`ÝAZŒäÌÂä-“3=QzÀäk¿ÀW²+Mj¡Ûÿ¯ùþ‡‚aŽãÈ&äqÙ#¢¸Œ"’™™=_[²ÇÙ{t²ŽãÂS莬;îNVFæ =â²÷Þ„'<ÄûÛûy¿ÀFƒsÆ’Mºè5}^º¥¦6ÈŒ–Î_çQ•lÁíq/­·ÄêIÿÉ+rD)ÙÞZä™ðgÔ[=â`²­yœ0âÂL¿&¨ - -šïð‡n0IÔ€Ýü,š]–ì*!f¡ -ûÃñAßfóÕkÏêžÕ“{\Ó7cM•pÒæjŽ0QóóÔÖ¨{^&©ÂòQÙ©Šd¹Ê¨)Yt°D—ÝòQŒ0Ä|j¨ŒQŸ“˜Ág%s^Mö<55H³mȱ¬–½¾]C÷²¿ÂHµÞ>gÀšçTùÔŠDFÛJËàÖª´ù•†)©Š,6[*3.)]ÀÀ¿ü\ijgVíª@>¹BõÓÙj©MÝ@ôù¼Ö[ÝÅËŒE4¾@Ü´÷µ¦–´Z¢¬[Dh-Bï= àûîDºhÖZþ ào*‡ªÍô®Ë ½I¸wi#¹ã;þSÝË}ü&¾sÓ‡ê¾w'·AIŒã9OMn%’Ï°ÍÓxJÖ6zÍ®ÀK»å×£> ¨Ì -‰‰¥%Úûª<çŒââ+ £Çö³o{!äÚÒ×M…VbÎhzèCü÷8_0>0ì*¦+„íþÌ‘t÷…@–KUK´ÃåW+M§îPJ}v}5}Çi!áæÓý‡M]Ô~ë߉H¨J# _4ûÚMa]ÍEó¹ÙgÙNþZŠk@ÇŒ²Uø—ÝÑ©2¶ÿ3,AU殀íའ:µgÛºáL1Ù -©Å?Ö49Fd¹k§n™&ŸñSõv”E’Prá÷К?ì¯7º—ûH÷e©ï3ðDî4åÞè‰ÍúÔzq¢·–§œàC$] ý_e8µ+^ñçaGWþ`³c+Áä$oåŠJŠª<ÍâdtG%$àã‘78{Bì½(1d³H*µåj"€ Ë°_"ßÀ—†R˜¾1“Ѻ7‚þ²¾™&®,}Kobµ¬²¯ú™Wþ¶ÆïÍRáð÷bÑöóá¥å¢~ž£E-×)@‡ùü‘Èéheì)õóAîEDè¨éʧŠO­gîÛ‚¬y<·à×’#ùÓz’ØLòj…(¬hÙ -“"kÉà¤Nô}zøˆÒÂí¡Ï ZÁÿ‹7Ÿëð›ùüUΠ&‹Mc|édžÇ=À‰öG#³©[ƘßS¿ƒ¬“TDÆ0 oloº,Xxvˆ>>jzeçÄ8M¤¸j´ 92’½¥9g~Yé´UM¿¹E±Ð™Kr»)Q¼~÷Ë—ØîB|?H­Å^J.¤•:tÇ Àv×¢~¹7<ËÅÙ· Þ3”u:Òõþ]ïfÞœz»½¸”KÞD—ž¢F¤3©m}­á©n?(#€û;Ù-œè½84y$‰Fqêà7¢˜ì^Ù#2 <˜™eÏR½濎ý¦/„vÞÆv°=;à rášq|½I{ò,¼.‹ï ~«È'.t†n£ËZ²µ˜í··/£h¬~¸Äß>·¡vó¡ªÿf$&…E|w0£q??fþPë6Aä,5`b`öUO@÷Ì^2™óãyþ$0„Z! û@Z6%l¦TÙ3å…Y½8åݯ þÍþ]¾sÉð rcóáÙˆ÷ƒ¹sž€Õó$Ìj:zC¥zs¬ GÏÙ4ùc†*ÆŠä«r“^E&¶O,Ä~òG©6 ¸$1 [âäk¤ÞéK$]ŒÝÿ K6?Rã_Ø ãc™ÅC  Vzg°¹ðNS‡Äæ¡Å¿¼z&l~meÙ.Gß³Í=Fi]dU­Ih²yÆÙ|hhÙŸh=¯–ÐÒ$c{·Þ®Nžë7$]žœ®×ryRzF•¥re¾¿H,)6d9çi{ÔsȚ̲¨†@Z–ÏŒžíq(I?P)ü¥EßR{‹’EñƒT@tZ~¡8y¢ïýRÅZüuAp‰”Æ-3æ17HWVýrÝ[ºQÁšGh×{j»g¶$ìÅo1iâ·qi¢0mñ„3ýeÙ#ÀƒCø,X»ŽEt^_8¼…úý% -´údwÞL<ì!¸xwë8˜b[áÅß±²I+—•ðña{¦£r!1ñ”ÅGºÝ ùíö³[Ût84±¨"±îø¸üΘm–»šËíI”xŸ‹è@»Ü¶â9PJßr,€ÔRÁ!@òîYQlø'¿^cgV’¼4Ì^1R¬Á1ÒÇÞhâƒ; zkñ…~Iifdaµ„ÚªRœ>BÞ“²ÅRP뉼¸67 - ÓÏXà_«îÉ;¦NoÔôÞ¡¨‘Õé Ÿ$TÐŒ k9·óªþèþ5÷Ú#QÑA¨D«Ô—§(­hÂîÚ xë…v’‚—1­ -¿Çx B‰ãþe¾´k\ÚJwP­¢üæà9ëÝmŒ‚êý_Ê'VÝÖFyNåú&RÀ¡;p{ç\Ë?r9Ú4ÍÖ—Ò|3 ã "bɪ32ÿ%úÿÿ«›s`°¿¯s 7ý¿AU‡¸endstream +/Length 19094 +/Filter /FlateDecode +>> +stream +xÚ¬µc|]ݺ¸ÛIc¬°íƶF+¶m6ilÛ¶ÑÆil£±ÑXïzö9g·{ÿ¿¾¿µ>ÌëcŽû÷À¤$UT¡2±3ŠÛÙ:Ó330óDäT¥˜™Ì LL””"Ž@Cg ;[QCg €™›› 4=€þ<ì<Ì”;{G 3sgÀ'ê:q„l€ŽƆ¶9Cgs  h cCk€Š±ÐÙƒ dm Pþç '€2Ð èè +4a@`f˜X;Œ€f¶Œÿ8IÙšÚ8ÿ'lâbÿM®@G'àÓ¿4© I;[k€ ÐQÞ” rùÿCë¿w±¶–7´ùgøUêÿi7´±°öøßv6ö.Î@G€œ ÐÑö¿»jÿGNhbábóß­RΆÖÆB¶fÖ@=3ÛÿÄ-œÄ-Ü&ŠÎÆæSCk'à¿â@[“ÿ6Õï_ŒZ*2’â’´ÿ»´ÿjT4´°uVõ°˜þôþ3ÿaP‘-Ü:L *3ƒ:‚~ÿ÷¤÷_ÉÄlíL,lÍ,ìCGGCÐ&;À‹`aktÝAÆŒ ¶vΠW ÊøLíþYWÐÒ3šþ+ö?ÈB‹?ÈöOëfe0‚³6´ùuqp±sšYÿÏšÿ»…Àht4Úþã0Ú€¢N† ²ý;Êý¿cüçlL  ¶Ö@Ó¿¢Ìÿý¯Î sC§†p²úÉÛÙØþ‰°Í=ìͶBÿò´°û#ÄRw²6t2ÿ‰{íþ@Îv¶À3;HÖÙíO;;HÓÙÜøWjkçâø'ÀúO±]ÿêÒu­û¿düY²ƒÄl-þNËõÏ ­íþL‡$æ´±øÏ(Hèà:sÿŽ°þSt Ó?—ÌŸ ¨ÿÙSÍÖtΤDAW ׿¢Æ.Ž +Ìù_ßWÐäÿØÔôÑÝÆË vƼÁ–)Í¡e¾bSåÐÔN„i%Á?»CÓxN6x1æ[&UÄ×è!è–hÉg2UŒ&¦ì[xÍBÞC^*Œ!KèCÈXÔyé*°Æ'ºúÃ9ƒßQm²"–Iví[h/VÈo7]»¡kd˜9óñξB•-.¼ÞøZùo-#¦šï%#èåtÈ&Õ7cÇžN%ì +ì–‹†qtÓo1ß–ñ¾¯ÏX­!§qGæÈAΧñ½À3Q»›n#0gX‘,kfsK¾×6 ’2Œ¸.(¦-É#s–”8ü@#²œ±„ÆäŒ!=åÍ>Ý©PmtcÐ œš«úÍؘPUÐ#M°sºʬ×ù:† y8{Èôqœç)qδôpÅÁdR­åiŽ-ÐùÛ\Þ˜€à‰¾m vîÒÓã¥Î%ömÓOLØäsÕ$aÆvµî£žå,(q¹TÏþÎïpO¡ˆè j^œ2ßø~á¨-×\eK!E‹´êãœú•¶a…aSÌ(pþÈxL¡wÞ?•vôìEÌ”æ™]!$ë²0ôEX¹U%»¦Õ——{|™+2my6%‚f“C^@ðär{8u³¸¡!ðëëulßqKœ;BcÿDƒÁn«¹\±„ÐÏF£´«YB¯ü[•°ÃD¹!{^ŽÕ/>:sº‚ª*èÍ0¤ˆžoÂ… Í«×!ï-IÚt=B©z„…øK‡¾g<Õ?=zä%u#9TÌÛ¾²Výä•B®·¨cNm[Ï–ÙŸ™HyR±¶ÇÁÏä&/ᬓÁ«ºIêH .êgÚàVDÓü‚>¡<=­Ò&ÉùÏz½$]¹¥f{+„zÝoÎtvÔI,ªOª+Õû(sna>x3ÑéM®µÇp¯`ˆ‹¼Ÿ5îU;aOFz\|hYIJҸ [úk—£„iл'îíä_PFÏ#ù­ÏT~™}sb5¦¿4¯¾|óyÖàæ])ä..ü‘ü`ÀRæ¼MáåsÈË»ks’ú®o]œÄüQ„&ÙWaŽpÝ`a:]óIÍö†)νÉ»Äxr¤ûô£…h×1¥FÄ…<.†é¼ò¡)=úQæí¨ø~3#n7xò/;T‹þWa«‹ I×&^08!Á{Òª*¾”œDe'³ºsÙ„oú@ácëýF“RhFˆÒÍé2ËL-ίYPƒ ~pAéPÔJÄn‰ùãÙnžw4®Ž˜œ‹’˜ä²˜+ýcµR_¹aœxâ“­Ñw Š”ÅÕËŠ¿ÀL{À³ûäôæ/ýVŒß5dÞ2ˆ¿àÖž¾7™bêÒ¬.ˆž´s3¤‰†·ÀÜjíUGcznQü6ÑßÁr§j¿Ò@±ÂoGó£p[ÅÊõhÌÇâS·aD]My—/Èã8f7Qz=ÂÍû"Ū=³"ûÈ-¹:bÊKM"EbB/ÈZ~}i’g¾Æ,Dül#--uÍæ’®£zlŽvB&Vγ[u—Ø{&6å_ ,HͶ=*Íô‚¡€öú 0bwrå)½èûõ¦¿§ìL^G$7´o±×QÍ2 +Lfç r Bè}Âç{[åÇ0#xev–š›éGUŠK†Û«#˜ˆ?¥1¶û|“ò‘ägýLZU´JL J*]ÞÖÛA1í1¾bŦ)JŒÝaÎfÛ\U}¿ûŒ€¹öË¢øûWœ)…ï5a^ϸ>_Jxálʼà]`Ö,šY|ïŸr6åÍ~(Õ_¶¢¯6 ^3bü°:¸œÝ‘<Ä O›úØ…åjjF´[«ˆçÈy PSîQ¹ïQÕ ¿|8Zò~¾é}&ƒC¸x5Þlµ€%KA²îýJ+Ÿx>ó)UVË Ÿ9WÕÈ-©Oùb9ûØëÛ$š•¢†ç^_3z3KXïà,E¢¼c2W82t–ñÖ•­¶u‚$ౌZrÀÉ“x|RŽƒ +Ñ#v¸†4Ï6 ¯^;Ž–Õbב[SßóúýpÒªœÛmõí«ÕŒüÒå?¼cù@_‚.qß¼…,ú•¶P?I +¤azÜ6«B…¿C]£]†è/Þ¨´žÅ!úYu¬0u‡{ȇ#"ú¾„v/C¬í½WuLqìh3vmó\­\$Ôñ2`ÛµtÙ„¦Åê*•îs ÑÿŠn_Þj,§~J”×\Ob#{ðKK<ðÁÎ ¶_g´Ø9ùùý,%(šîÖ‡cÏJ²ò ¬ôR6¨kit£ 7@ŸÅ|ÅnÚ å„™úíª8­¼>}ŸÃsÀh…Ìšé•Rª®623ÃC‹;Cü\b§´|ò©÷kå;Ô2Cúæß·/:êNzÙ÷E$oã_ƒÑîer ´ô…>øö„Æo¨pïRx!¼au,€õõþ›ˆÿB ÎB&×®ªŽ/D?–5€ýq×ÏAdzI®¯f·^²Òßó-›áit–Ö2‰ëT®tïxüD±|¿ž¦…—…û!…¿ÒŽÜIówíóÉ¥A¬Ú˘yØ`L«b„¯ïòè/‹S4ðVèRãÚÜOšLZ¾øO¶ Mõ?Á¢·p•«Ý;,w · ‹U\„¹ÙQ¯r›á!1Þ²I¬ÌÀiźûõMÎ1Œ¦O‘ÃIÁm‰J“¤Ölq!Vn"ò›¿T {F5[Õ: #dt•Üt~*ÿ‰ •;öجóÉâ-Õ©Æü.bl)«¢»x.ÌcHaŽžÆÓ'b¶ÛUÑ=6zbáÓ9ºSJ¿Ð/ÚD/«A½EÑ4¤šÈ•Ð׋߳¶i=z (¾Ûæ&ËÖ”?ûèbþmÖñ|tÐvR¦ïÇ¢èû‡Uù>Ei¯ðS]1ÙôÚ–¯z¬9yã5€x–ò(š÷t­Ž€¶6_NiX¡*ñžDðG›©0_0… 0/ß*ôGuÌŽ¬ot:šAýìœëêëBym!Ìsè/©¸ƒ²ó%âg} Ó²;2Á‡=˜y9ÔØl}¬Iü­à 7áf¶R]qªu H±¥îø»È§“m´á¶eŒ“jˆÀE& Yj||=ŒO3i;«g3õðJ¸z$­§­$`M씆º† ”U¡ñ3‚ÇG8m¦ø­ ?B0~+Pøé,©E@| d¨@•ahíÃW€¢rþ»0#ƒ °$‹vÿb˜¶~0H˜/#ï4›¾¥~ü^Hä¾T¼•ÿ›¨+›‹wÕ6èíäÊŠáB¥ù„ŸþçÄBó@G líÇú½At‚¶ÜÞ5¸ áQ6/{|¼·óÕg!4q¸D—cáz(© 9Þö/òþ©ZË£„¬;« 0­–fnÖm1ßkOñ2ËÓ„HxÍ䡹•xÛ|Úø±—1Ä$Õ»¬ÓÄ|Ò«Å ¨pÒѼ¨i°çŠ6l¥~%y¶ØøBˆÕÞô<+EÈÚ,’E^¤‹ê½+7¤>‰ôy‹ÜÌI*w~a¯Þ…AøÆŠÃÅô•dµJ6Xù çàðt¦Y]Ï2“äuwr?fcÛ¨sïb¶`z9æ¢ì&4ÀŒïäJG¯ôäF)~¨?—ÿ·uøTth`Ï$F§#/êˆg˸ë-N +aÚôûlA#BóøŒßÀVZ“è¹°ìáÚX“«¶y¹”…I +$»ßA0GÚCƒÙd VojÇXŸÐu’ó0÷ª +;¸]áF²™îûw¾ÄpÉÃuˆ{F³¬×.ÅÑÀ5ÖÇQbm»ªèðoÌ©+îCµÎÇR=$’¹Šèú%Oyü=ŒKÈ0I,1ÂË_¤%Æa*ñBùn>tõ7÷÷½!ÍS(&^S~¸¾ŒcëÓØt~wì°ô«ã#)‘ ;}혡,?çiþ5s`2Òih:Ùëq9¥µ?âRˆ€^eЃDîo¬á Ú¢o‡2ªqF ÞYìÊœð“!ö6½ãŠàêgÆn“ª}1,çàÀÓÛ8=,’Òbãææs;v—ÜÈ>,-s¸ §"²¯Ì1 ÔÏ'V +óWoz'ªç {ØÚòQÕœ7_)ÀgCû8뉡¨Ý=Þ±ëè¡Û`ç£Þeqô7yÍ·ÜnݸRJØL† ].£›Në>¯Í,”¢'µüÌU´÷ÕPcü_}cÊŠèü˜]ƒmÖ‘QxËä˜SçÈ,š_9+í!}ã ¸â–Ë‚”{»}Wûêþ™oÓY4e¹Ö£ ™ÕÂ=üzL”hjýÉÚ<.âçÞVLçµã䜼áçTˆÖû“þÐkëÖµ™÷+?¬ +÷ZëúAúO}^ª2¥Q÷Df2¦hŒB†<7b§¡´TrR|ŒêË=˜ná¨]/wƒI€ßÙ'‡èJfê v„¤v£'òWùäŽ?nxJò5Wüd¼sÉ[+£ÂVZ„D²(]ò®?ÐróH9¬[ÒÂh-} ­^…|V˜ðQTâþj¸ýh>IùÆŒ\[S¡©8d™ÅÅ‚éèÊÈs¨[<W†Ÿiÿ·€ØrŒWGµÒé‘ÜA#ô]áš':÷<¼Ý°üÃD|MC»Äï4Îå^æ´“Öߨ— ‘çüTKøplÆaë»ûÜ¿µÖ¨³ Y?ý3ÂHlèC¯£àOoÒ=†¯bWMŃÃþÌÉ6ï次a€káä@ 0§Ã„g²P@Øgÿ[Çr¬#R'x¡éu²¼ñ¢‘Ìónž¦“cè+Ç䬼æbF®™:å%Áüѵ2š]’¸$NÊN]#¸MÙM©n,ªë¦ßE£Í<ºÏ–´õ^^lw­²º@†aü |ÖÖ ™ç7³´(Òi¹Ñ½¸^ÙÝà‰(4 IË[s³çò׎ëŽð«5»ÈÖŒ³¶ÃMƇ–Ñb=gjÃ[ï/û»ÃØò#U£çÌqaFJ‡)(ŸÁ‡ß3~FñÑËÐÕží“ÙR[2_þÞV餉‘6M™UÆñ)ÐÆu0ˆF*|ŽjÏûÈ6¤ißýv¤yïgÆi÷o¤áú‚%|¢Es¦fˆéþn Öý0j¤‚Hu¼«W×賆Åêåᶣ˜;Ú`V–›l Ù›ÄYôY䣠6ÿ]ÙOóŸÌ1^ÅÉPÅ\õ‰ÌéL |žõ™mêò|%ö:BSfFb2y€1{h°|4‰ço|6®BlÖçröŸtãgÔt¢Zøȼâ8—ža‘yH<ðÄü\<ß#J{nXŸ[²Ì&Ç*bÖXÞ¶ø×BßT¨ùè°wBFÆ÷0€ÏÚêV5$`‰½ïTǯsDvÕµÓ7Üî+J1œñÃø›'‡É²Óûè:¾Ï!@œãÐ;ÚÈÊŠ-r‹ws@ÆÊÝ&ÒÅƥȘð]ï[cŒÔ=I6> Ù\eÑé ²©®Å‘èFK„w&¸Ï1¾ÔgïlŸ¹f}X;•äÕ(Çq¯#¤üDráV¥uÛ(ÿáYWkÀ¦Ö"nHÌåÂ’ù̢ͷt<1yÌÙ˜!Þš’ynZ¯íF¼Y›¯È¤7 ›bÈÕÏh>8$½–[u 6×k‘C‘ð÷ô橯D b ?•‚Ô$™«Æ§ +{'Ù¾œIšK ÉŽ]qR°¾l'¾ÞæÅžèý’ä}¢ðÖs½b†}®—€åV‚9ö¹ú˜»™}MLr{žõXˆ“Èw¬˜—7[¡Ë¥¥-©íòNýôºôâÕÕ`à±u_Ý>ð‘‰WÄJÝþšµóÐ¥øîÛËe¨÷ªçÑâ È:ö”#?ÇšóË%^Ëá.µBn…ȧ4‘£ÄFÔב?œ¿ Ž1¢;Á `ȱ£'ñ8ßœ5²çÏíôëŠÊ…#PCÿŒð+j1AC–h'‹XÅŽ χ‘2Œr:ûX2YŒiDeÀkW}3/w™ªÿ%Nü{¾¶h÷2+Ä_ɼÕÅ8qq‚HßIR»ÚVLmŽ ó¶cÇø˜èÀ‡{ÃÓ ÍÔ&ƒ5éúÓ¨/_Ýk¢ÂÊf}U/±œï´¥âÓï(sS4S“K’û;Â’0>+;i0p¯=‹6[òëŸ3±É^&Áëhþ” 5;ñ;T)ƒð<íÍ\Ýf«üT†Ý÷¨ß ©´šPœú¥{ug6·‚NO^Ó2ï a¾mh~ßÉyü´ú^Oçl(\ìøɧ¢ †H×å +×ìÉûãŒB‡Í,óÓ׸8$;Qz†):¢–M*mb¸ý‡Ž?¸(§œŸ‚Uà +=ÌÕÈs]2ˆQ"ØéHá$„.Sæ"þƇLõBRÚdq½ÕM«ÕJkõF€5Ÿû¾ýڧΓ„·ÛøP7ayÜ¿Éqq„ùLp6ßy@þãAâÕzP³„…x}ïÎäj'Î^ßb›Ó…­žß]”Ø(Ä7„„ ÐQh +{@†J©»—áûdV÷ò§ìò»ðð‘KúÝ×;0»‹Ôíwcg¤ð4ö,PÛ^á~=š9TåÐ_”4›y]ñ6° +R= •JWc|èàpÛ(káaÕn°Bœ¦Í½‚Kù²Éø«äaH¢–ñ;W E2 +Zü¶ßËjt%qü­ÏPM„É'¾9ôÒ ?´é’˜½åp¼ŽÁºÑÝ¥$måñ|L–ŒdÖ¹«gm:IÎé(Ålã8ÆQ\S˯ÌÃ&¤ã®½,Îë©m»édÁ)àyïd}Y=8½ñܱ•Bè8@íα–ƒ{ô¶72`Þ;ë@m%zû]°Q68 ‰h\VØþ11UñvCÖ­*U NÊ©E‚"¬§ç‰+¹’=I™¼QÒ.‡pì“á¬y¿Q(7”¸UôÀx\Qñ*8ÿGËù… æba“ß 4â«þß±èO#3°Ð…xÌ^Éñ[±$#&n•#3ªihŒ)† += ­rC„B窷ÈôÀþö øè]\¶Ž±mEè¨Ë§Ö…ífd€Ûõü)«Òÿå=>´ìç)ôloÙ¥’YU{'‘ ˜]eev­ Õ§ Í v¥0”ØÒxäTqŽÜØðÆþ˲I×]îð +cQµ¸ïÑ®~OKXª6«Õ+µ×pF¢QÇ}€C†…Æ £ŒK¿gk k6û÷læl÷²žp'? +³gÐFßï±ÔÄ°ñ¬}MÝ+ÁëY§nWŸÌ,Ä“øNºÉÖµA€#Ú±š°[š1þð^Äþ1ø¢ÓX¿ç,.:ÇûX¸Pñò(Û+æòD¯LNKûé>26Béªdñ«†„Oø1Y£Ñ:Ü©Ñzfañ¨ÒñJô¡ž›Ú²âW£ ïÒ‘TÜ'Ý•+xzU`µ"3uèÌ[¸ŸðÃug†4ƒ)Ü,U..X¬aR^ á®Ë/ +c¤ôƒ ‡ž;ùR ß·1Õcae ì°uÈ[¦ù4e9óÏNÓPûFä5‘|ÙÛö!{}$!#⻓Ú"ëŠÅ¿/¾ãq‡ä³ý¹§¡'…¢ˆyò;*R£§C¹#\Æ;MM#8ŸãÝÕ~Z«À=ó»4eBçR¸ˆï(ˆXÆÚìÀÁD¶=Ga{‡½Ž×o~G6°aÞRïysÉèûñejÓ +¶BÁŸ~å+ìªiè§ w€5 ¥®iÒké䥨!VíJȆ惡Edûê¾üñ‚gÖ±»„¿s6+MGtáJÒ$õswî–×°ÜÕ¢x‚ȹÖ:MÍ냞ïhù8Åú-–Û·ËHé‘&\¥½1é÷ó¡¤>1˜ÅÙxÃ1·ÃÇ'³pK–º«ÞÓ¼‘ê«þÉ(u¦Ùò<ù»$»FMÝîÆ-ìpW’½G!ÊñßÎò8Í儈–¾¤UìUæÕÆ•³x¦§_³ñú™çvºÁÆ‘óeK.”ç̲Ö×eb/¨tëlrBáýÅ»G3‘(€D£Ýó+ëÊP>‚ÒÄyb¦³ËÜ‚[2›²¢¤áæFta/G¼+¨xºJNTÔL¬ôoËü'áXð#ùÃÔ­O¯œ7±eR—Ë¡b’ÅÄoÀÖÁ„ù‰ŽÎ:+Î]3úõÌa­Ñ’¸_î÷qws¤Ë*0c핸&§ƒ}K xëÆ[ƒû?qæÆ_hL|¢Kr ãÒàf^Úvègõ/Ô†Ó| ¬Ÿñ0ŽýÅ ÓoOà5|}3ðôÙtÏȶƒË`+ú}Ïýµz½ïs,4t{˜‘¼;*¶±aQ,Q†|4úõPi›°©2uâÁ'~.657Zö‰w×”6ôæñ¸èÌó£ôƒIaéç?”þÀ!cŒ'´Ê€6b»U™L›âçøf`]Œò +OÚ‹çñšïJa‚(I0td‹%D'ÿ÷FUí„`¢§á'qŽò!D6¤qO¼˜åÐÑt­èäïñ倖õÎ…0Ó¬ˆ@•§§^ÿùæ`¿H•µl÷/ìLÂùAP·S&Õ J=}¿–ÑFï•Rú!P4À0˹ÅÅCÉilô -ªs‹(ÜeÞE3çÞkŠ<Mç«v‚ôÄÊ+y5¶Ÿ( OµC8;LžSÄò$œ>&ÐWŒØÓB +–5Œ]rF·Œà„Og/œef~ieå£u¡‹£SF̨[ÂákŽ±‡Õ dÚ„–'ȧ)³ÿ±S’89®nŠ ®\êbV˜“—n‹–Ô}'ØÖ¾ÑoÁ{jB> ÓßÇÁÂOs©U¿ò{´¤t‚’Eóȸ•¨ +lÍõëüBE¨Y‹g¸r 3‰Ñ ŒCñØQ'”áÝš?dg þÊÊìüŽoÃe) ^$!ÉVS^š81Ù§0.[ÎsÅs¡EçõJÇŠï;NÁ”òWÚÇï}÷G‹DÆj`ô*˜à­gîŒÁZÆ€P‘åï¶~bKIxî\ öÞ¦ÁDUfÛ”äz~]&킆Ó: ÆÔů¹ÏDro_,¯õü•Ûý6ý-\ËiNÓ}¦Gû§‚:8ÏÊ£Z†¯ñPh¨ÎíRÞúÁ€D/w¥÷ï_BüuRp–háZµ9ÍÃùÊôKaAF¯…·[][àûʨӒڹQiG°w<§ŽFH‚¸lrW¬žÛhmºŽJB_aR-H2Dy©óªO‚f—"¥³ +»¡l[Íð¤e4ãÑe¾kÒ¾ë! {âÆËË°EJ¿~~êÕ k´W }5@ýö°ZÖbý ]úÓù;x‹|GÁpãmio,BI· ™¬´¯­M¸W¸U~¶€Ïù–›ÑY“E +Ž[þçìuözì®l%öWiÙxým÷uONµ*U} éØ-š_E2wÄþúXA¾Ñ°VÒvŒ-Éevš.ÔóD%V~xs»D_9ôºáØÔ:œû“š¿¥'û¹ÍíÀ7ÝÙí3±ãÂtâšœ¥–C™cyLÇŸn`8˜ 'o òÊcûœ%)ZãËô¹ öÑ¥hýÑu(ôUÒ4y©’Ù"bÓx«k8¶ƒ‘æË{×ZLƒêŸÛœ‚« +YõIS-]ýj^xã³a£P_ExÔB͵¹˜x/[¤@Ò7 áj¨ï•ñëãT ¶Êpú×Ác,KBèk:‘ðŠÆ$Fú̲ÖEØp´~„WÛ^FB $Žçê0³ ;çÒ¸€“t&¶|çIzÜ×^= +¹PTª„(D8a 9˜2u×ɹ»<‡H¨ —¹¸e`Eï4K¿ÓËa9íà ¯—‘Òô&DS|VÇþ"HÔV?” N)_jAÆwEKÊeØ°:Ç ÜT1^ºw£ÐLUuºM›ôš=¸ñp¾î/HŒfa|ív-tD‡S¤‘#´øs™ùx­]pÐoª³¢ÑŽ]äó­áo³H{I²¨Ž—øêÊaÞgÔÐÆb‚Äl^ fÆås 3’#÷«Ÿ>À54¿„v<–³wèzôfÝÃèh­ü$·ä6µ Ñ,§/kƘÓÛÛrËJ8Ô0úKSÕú‰™3<;#ó;¾—†—"õÅö¹jÖì'$m“™0a^ »Î/„;¯ ªà¸>>Ð|Û'ÉZ£¬ªŒ 4¢õù’“Rÿ[$ø=@ó,k 7¬%jÇíT§¹ƒøνZCê!ý Îôn”vµ2H œ£ÂÁ*Ę‚šr»ýâŒQ <È^U£? ètsßÚS‡SÑÝ©8¦ŒcS(f¿€ +…/"Íà ¨ÈŠ ær€%¥ÿ¨DÂ/Ýã¡L›Ö’³"3å——`Ϫ­)Ðw#ÿù¬-")²qK™¬7Ý~àÔB[³Aê¹o[+¼Õ²j­Â žH&>kóG_¦ùövn&˜«öyúõQxcÚåÑSO¾ú*‘0wo”4áÌÇÛfº¹¯"]‘ÉõšªwQd6ŠØ=¡Ž}R;1}Í°cbˆ½c{ ‘~sÇ­(+ ú ½¼é䊭id­SEÀ‹X]Ü· FszRš¼ÂúãÐC[m» »À¹YKŸ*§HÀ”|QÖDDŽLð§Ì»¡Ž´VWué~7I~H‹:˜í€ËJSÜ5"\#Úa×— ö¼E‚ +J7¸ïj›DZâ{P¢½ÒÁÓÐPHŒxˆßÝÞáZýc?& 7i6 °ÿD¶"èœ +¸Óäu¼ƒ¾î‰³“i~Žú¸t×ÏV‘ý(­Àöz{¦q\!êUûümŠyXXY\<Úíhmü¢kÈ“¿žò§›é<"An;V`Q=[z‚+ù¤ÿ§üw{uÛap1´ R` —Â/òRcKÚvF\4túž‡áÇér­Á5ÛƒnîXªVbà·ê¥…Ïv@ö–ÂÌí4¸k@->/ CQeLKéz÷CØÚ”›2þ‘BѦÄäÏX4!9Ÿ!£è”ͳ&¦×á-@‰ÜYÅ)wrÖpÚg†ÓÕV„}ÑKŒ1òpcÀ×;WúFͲÑ’â²t/‘Ÿê^ÀÇ(=¶?8¨³lg{ÂÌ»Zþº¡ÅëPÏÆ|}žp G+!zý–^ÕëDñ1}ìKœPlìNOøç.9ßfßBYi…¦G7xé/—GˆpµDç/Ò›áOF“!ÔåeßO¼ª9|N‹7ºœ ÑCªJÙDTõt‹çºT¯i¶X˜.(j”]üö8?Þ¹2nÛywÇä#²g#®ªÇkÞM Q°ö8€@ÃN­{­E˜w†¾ú½~ØÌž‡bÝí‘9þyùʡ 5nèUâÞxœÉ×´Ì eê­— Ø Buþýtη8HŽ<6Ê-QS>C_·$Hð¤":@åg‘iË‘$wªGºÕÊ(^­ÐH\gìٷݘ ¯´Jf~tq%x9yƒãm¨å©|¡üb:Ɔ˜ñÜòTBØÀ$\|“½¤žw:ç’？ò+_˜0õ²pRñá4³g¬³»!œN £$û^ž^ã)^UçjáX;y©6[0ç_Ûä,;v›GÊ…}ÐYTu'v›¾·µ+œŽ‰¢LC!ƒ?ÿ(ƒoê#ŽâÃ,Ê^8†£a°?cG}±›C¢Dq…v>ÿ ô´µT,*髆0ž-?X<˜`‰j#j¼{|xã!ƒÙWÁqik£×¦l¤9Sò=Q÷ +~)êyUCI?%>ϿJü²É‘\‘’°QÄõy'ðõ*éC5ý§ÌS»5†§²É± —kåKñé~¼„k }SøÊMgòÂo4Z»¤*1Æ™U«;h¼iÚc¡œû4?­‰(¹"áóhôï|½èŲY!ŸÙ³Qæ!/ÓF>«èò·Ý ?¯[ ð ð²Ì¯YJðôQî7瑯N2{§¯ ½yôý ùíÃö¸^ØÂìîYÂk•Îg)Q¹ï•§ Émh\ŠþmËfLzr5°…Œ"·³º’ õ]¥zYѣƄØó¸!ÉîH…X]?ØZ¼j&üT„ôT°smL‚E7‹S¼¢9ÖqnÂ"ؼiù_÷mx9·J”¨¢±/·‘œÀnñ£`ÜŽs¬w½о#b¸D!i(݉·få‘GæØ +Nj}‹àšïß°DÆ¡ŒÓ™¹ d-ôЋTóSçà6&ÉóÿEZº´rˆÑ°×Û£m˺ÈåP1ø +>!Ž•«7²°+„q0­U¸ÜkßL +ÎæJÿm’i…L_çÇÇ\û¨­HqÌò+*½û°IÛ²¶ß¸Úa&ƒrÊ^wÎj!>x*Öf’˜×ËõdàdwòáL¼Å7•Œv°$Ñž.…|tUÕ[ǯW8Τ¢®`NðúEÍýBìÝøo1Æ<÷üßhÓ&ÚEÊ+V¸Ÿ)Ã/ñöÕÞ3z‘ÍζOq²ÔÖŸ]ê) bg*>b{`ñ4Tëyyêºãx|öi´Y}w”N?ù c{ŽBWØ +|Vþ.ÎUÇÈQ 5qývwJ6ÀÂDͤÒýݘ†‹¦)Sb%hh·N«ê“rÓ:XYqc§¦¯ U÷–™ðtmh(É+Še}_Çiƒž 7¿ºN}úÕt‰‘Ò¾OR"혲âçƒ +(‰æ'ÞÅc"}-äÈȧϲÓ×™¡qVº²J„?fÎôä”#ñ™Ý´Ç[X882'ñÆvæꡦ¶I ÏTŠ²^YyZÉöWù gëå\Ž• HfR`{{2éùP~Ÿõ =¸aúë¹Í £qL\Õí`ØÌR¦,PnËÓgŒLÏ·ÛDuË)d(YoÖ ÈUu¤«å½÷ŒÞö9ë:©$OËÚÆ93mÄç„°Ô#9ìQÁ™¾¼Òg¿ o}¦“¾ ©×Ñ×õ¸zÈ8©Œ$KŸc¿4`Oiï`N¹îtiºç}‡AÑgÐÖ>Õ!ù(ÒáVÄ"ÎØFš%>†ÙEazLàÈM¸—³zG^C«ºƒ“¤ý”z³æ£V?ÔDé ®3 mlSèÿ¹¶@£Wˆ¿‰fÝê¾D\sÝ÷Óۉɖm Æ³‰Ý‰Z^æ†ß[½“ü!‚“|b¸ÈÖ 93pÈ ›T eüé ä¢De²­Û’ˆ¶çtß(‹öÝwî|å[QÁ5÷°Ç‹ò¡¡É›/PÈU±äGLJŠÅõ2CÒm$ŒLM£,í’ÍJ+Õ_…bP¾Ë['mÆŸxÇ5‡0_Rše}™—¿ºÚý/l&JÞH °OíÒ9xžï¡ð, Jv—™,uš§Å•É³gÃÓƒ’øÑ5FÒK©Üj;£´‡ÈŽÔð†œ3•z¤óÚî•#M,ª$¢->æ° )ÿMuŒZC5hùSÚEͯÞöås}ÙÃðõ¯< MfªÌ#ô_%˜Uº0ŸbWý+øãr† ³±ùU_6R²¥“‹÷0FÓö¸}G%QÑGk ¤£zVqV÷§}„ŸXkÓÄEáÐ:»ºN6V]z£ÑtÝƲ­Ì×48ÓÌB[ÏÍw]€µê£í!ÞÛÖ€—þ½Jž÷¹Ÿ|¢$ý6P%cÅ”"îAb’µ©wÓ¨o(Ú+P+õ£U­‰~™‹%k§M^Ef‰=Ç\vÉ1›èÅÕ‡4ε'=¿Óó~ówSÅù)ÄTÎ/ŽM‚ÞE8áAÖ2 8¶âãT¨Ñ=|±ò;ˆÙ¿Rg¨dÃMMöÍHQùä +Ÿë(Ž¾ÓzGÛ8@æ¹ð8rÚäîu’äÐìIågCVÛ Ã=Íña³û‘9ä54\4 V­d¡ ¥sÙœÐñÄ{G£+5»ò ÏݨzƱÒwǸ!O·BZÏRÕ_Ç¡­ ð¸¤cZõZ :Òd° |gº-KÐé_÷úU÷#Y£\Ö=²_T„_ +Á’íI±(‡‰rlf¿?ÂæãV!j._‰VðrÏŠê›/£ôÉïÇ…S–¯Hì%õH\{ˆ÷öÇZ—ôÚÀ‚JÙ-÷•[šÕìï>íyËÕ÷Ô¿ì\'}eùÇúÒòq±ï~òÓúÇôÅ~àÂ=šiܯËS'°§ª9Þô#•†]Xiù ±ÿŽStÚQÇgw"MÇN~]æÆXá%¹j¼¤Â= +ï}ìñùÑÑúSþ^.óÛï%~7Ö$©AbÝý5 ëó¾É4Äôš@ø3Äg­@M9B(²ãI¾1A2º6Ëý¥ØñÙeÞ½+9× ÕÆÔæxÅñ(W Œƒ~k7<ž0±-»0'Ø>%s!É€o—ì8ìëxsÁ V—rM! Ö¤uÕ*ÌnN¸%…ò!1bGÉ—ØSž‚£á;dU ¼˜D›æTLjXæɹsŠSÑ— ?F’îÜ|fxy½_À>Þ*Äx4 +dÝL¿£À®³µB_Õ˜É …qƒqZ'ßõuÀÍÐÉC®9UÖ©‹,šÛVÁ ªjÃÄðÎee­ +/.ÓG‘M«ìx“^TO|?"'=„!a=Tt<™ÚòÔë-ש{;Š}÷8wÇøZc‹4 wON ¡lÈ™&ÛE>?ÖjÒªjÚ^ÐÁèÇÌÇ ûv(°”²GÑ犨¼ƒOYnøûÃibr%ÜÉî4Átcº)¯~ÑÛ­^ƒË¼oã$Øøê×/M|â©éY5\ŸaTûÇŸrVôn—ŸÙ'ôyÚá*×àÀå… ÂS>7NõoÜI•­z@iG¶ªý(è“Óÿ•§âSki>ŽÓ½ˆ€DD‰UIÌÀCðeò‹t”÷£ƒ¤LºÏƒ ÌLä)îâº*û!êèÀÞUùèspÔ I \xA-Ǧ¼~Æ>[Ô—YÿÚƒÌîc'êøŸ"Óºýw§“ÐÜÖˆ¡®{̵v,@v©cO70±6suöñ[œêÂã˜üCnùxù¤pv ­/2É÷¨i%`¾?X$g© ‘K“µß-ü(‰Muf‰ h¹оë>qØÁø·%–þ +]함( õê ‘Qy~˜AòH\38í0úöùØP<¼EãÃJ'îJJYyŸ²‰së$Àn~\¿뇡.֭ϱl–¸Ø\§Ðâfdœ5¸¸¿‡I8kEÓJ%ïƒâê·ÌëY¬b> ÍEbª‚7U‘Dt½ÈÇ^W£+Rœešœ Û$v,žÛ]0èÖÅÓY”lÖÛ“ß ÀIî9‰âVSðG©ŠÛÃ.ð”`Ó‰QR´øˆ¢6àD|Y\€»Iߒʲðiõ±î=Æ^ÕMizüœv ?À?,f@e´Pùî5›®8FŠ”QÇyãóKy‚šÊŽÇ'›RH«²Xé;íÞЭ·0ûWÈQ»}z,í$¿£Ói²§Øá¡ ø$2:-NèÍß +,ÕøP¼ÚCV°ühÄvÍÄ“2aØÕìæÞR[5ÜUœ—3±OÞÞw‹æ±YH"n#«^œf2—›IÝzÓ³r*ÃÂè駾–«I]P¥¹XP÷g£üâFyrì× ŽôÓœ`žøÔmÔŸ€‡QÈ’¡G ø$£Yîè ÷kC‰ñPÝh„f±îùç¾ûX{5á¶ètåÐ&h¥ nFùÑ5ÀRÒnç “raÒg ¨ 2ÐW¡CÀ 4¾:~hªõcÃRΗ#ôz™r¤‡yõõò{ \ßuƒÝSCC¿µÌ¨B)7 Äp[‰ÙàÕìBG¦9‰JÅ×®FÑpþÒþ{lój3iX|dºõ-fGŒg£âF$„ÚâN^ʾ9·¹ãV»Kš!INõx +!CÚx¦ò”ú=nmn~ÁÃâÈ’9^Š‹‹k_Òã›ôø ”™ï‡JãTå‚AFã„‹}5¸Ú;àK¼[Âõ¬Þ5² ݼ*ñ’®AëØé2 Ä’tŸ¿ñoáò~ï)Æ“zhjð6=K¼19*OûÃ]ïë1œoúdJYƒ]!ðkôº­¿Å[–ÒŸË'_ŸåN®ªÜrbúÉh5ÒòòÃÒòDMˬ¬§3=Ôê>M‚…'cŽ²VB[»:?û9‰uÏgúûr•þZCÿÁÌõ ý„&´ÒûMõ»Æ¹{—˜bˆá}4ÉÀ—·rÖ=ï‹>Ãî3³ølh94‡'Z9ÕØ¥b%9ƶøo©Æ㎳5ãiÍ«ã\±¥s"±ÍÕxúû¡q¾Aaûi+þÍá6 *þ²ÏG©i®þûO“oÞ(,ÙL奷D…¼õRCÒhŸ–7ä|Æ0Ä‚‡ÞMVöCóMÃQ½yÑO¨ÙñÂÇk« {·8ó¤Ï`0ÚB2~´î&?…¶ )ÛóD{†í1fòíw¨ïƒ¯Ü¿ôI%ƒÁæ×ûµŽ–c\!·‡+Æð ì Ëd¥eŒ•ES\³Ô±Éý©®¢5¨\gŠYˆÝé׹׊fôì\/ QE’¿áyBiò^þÎ^µ];(ÝË;ß·‹F,æ½€ ¦õm¥%ÇÎàÂkbƒxnê/”•ÀøC—°»¾qºâ¼íLǪ-\V[4¸¾ }ˆÏgë‰H«:¯}â"nolÞ׳Šî+Œ¶LÓè5ÊøñÕôª O8n<óN…=³Ñ¾,4†s¢IßÊŠ¢DãÍÔçíÈœ0q_Lû«ýŒ=æ-n\‰®5V}å [¡HåÑ”dåÖGÿê›®•æë(ˆâÒÄ +rÝ0ÈBn”ŒÛ==bÔÑQú¾„Š„'ü4ª/?>Ž]Õº > ¤B+EI4•\ae‹/D™£ Ï»bŒ1vU¦±?—Ä(Ô¨[ƒM/φ×VÙÊ|Òs^còÐvÚ-˜^ ]äc‰ÆBˆ7©°ÑD9Óì%©é_î@Íô=«lŽ}¿¬} öF¨_{“šnU–ßÓL‘U¶FÓk¸¨ ɸ–$½M °¦[·^TªÔºÈ[h„“ËÜ#dËïê&©­Îã±èUví¬k™‚ù½Õ!ÑU­qÃÍ‹9_fkM½Á‡ýîÐ<JjrZ”ï(ckéøßa“ŒÚ^ qé+¯XH´Ñ yËÑH?TRµ×Ûj«Íè,JÉg˜ ñˆ†°èj{š›A›Sµp×ÙßðäR ]HkäÚ,{³·]¤9 "ò»iÉY=—®Kùü’vs³Ë"*ÏfKì”KoEÚYÙÌ!à»Üò ¼*Ú¦Ãü)8ùŒ‘ß ²BºMS…XN~ê·ÀÒ6XÉ9“DҶ຺_ü’žÚcÂK”i“ב;€Éf»î9}ˆð×O÷zÚDª·Yeì¹ï£úÍʆ´Uää¸ý SätœŒ¼¼9úö…‘ #”Ïçècéø]ýWµ¼zƒäÓbG¼ncGS˜mÒfäéÐä%ž|úBKHœodlKCKœçwš\ÆÊÌ?JÖ5¾‡YÇ™‘0/¾CéH3:±:}Ú ä–Ýuc„Ô.z*h=9-ä—ЈTܨïYoIXºz ö‘ë^UêþÿÚ™ó&Àjsí»j9se‘™sË5ä9+Ö˜ˆeÒ(¹åNîû>çÊ抜9’D1’Š¼ä&4™ß?âýíý¼ÏðÈY8h¾”þdÂBÝŠ„&Íå·Lìež ߧzÝ…:ÓZÚ¯¿IŽg"{äO¬©.E«Vû™#V #˽ʅµÿh¸~ª&¢©~03øŽ×G¼ù»…Nz̶vìÆôñ¬‘I¥´U†¡1=0âSЦ>|ú³iM ™®õŸ K9áX»Äþš•(ùFwž8åq§Íðº„Ó.¹¼ ÐR1…>‹Oëô…½†I=%DöSê‘Öûoëæ•óo5”þôÕg¥V>²1o¿‡vÃ#Ç'Ÿü©Òµ—½ÔŸn³§”ÛÇ^K,ˆZ(±9„ÁSáÁÊæ:/¢µçÔÔ/·cD•¿;?>íŸX²å´F eŸèošÏuR'ßïÓiÝÅñù,ß EŠø•Ç­º¹oÇØ]ëëj U»ª³Zieº˜¨MÌ;›M/×~oïÈTò]î$xÊ.·aRF×µÌ'C1J¼Xç˜Ñr8OªE¤ŽœK™ øNnBéÍvاS[âÙ¦U¢«A2 +4ù ÙD®>/wúA„¦Zí÷¹æóÀ–›ÝcO€jê2W6þÜv‰54SR¯Þ}`E”ò^Q…ŸÖ|ÓöÄa§öyÿšpb6äï;ö²–ÌD“Š¨”;Õb3û HÎÛ±ð«4¸ÚøyÓÝH°ÝŸ½ƒù ør‹œT~EÉåê^qz ðZíJ²hzñŒÆñ«à&†uâF\ÈÑE†4êLü7þŘ,v6~÷ïñŸÂû!(V\»–”Œ®pá½µóšˆ(±ÙñÖ +è´TïæüÐ{ÚºÚÔªÖÀ1Li˜)dÎö +•úÌ¡)Šz•O‰õ9ºo@ûÁ…*êŪ‘·üFS—>ï5Е”4µ‘ÐÓuu ±ôW¡õj +Ã󈌯Z0íëBì7ügi!wÖ¹jŸmv =Ĝե»D ±íÓ¸ðë…ðuŽ"‘u6Òs#)tPæÖÓöO但h¶Š9‰‡/ÒîùäëI +Ï=Èw?KNI+,òÈúðÐÒ¤\sÀ"%!§ˆ]8f¾yD^žú]‘ði˜.º;ÃÌ¡¢I‡.Ä´W°ãVes¿®µoËŠ²š§q|TKñ57K:hÐÆ™'^ª8„8A€_WŽž™Ò õ¨¾õ>³ Q&ªGtZcÃz,âkèEÞ2Åy±Ä“Ñ„¶Há†<.¬lZ«‡¬„_Ãz;~³@'Õá1¼‰¹åÑ’"#k¿”¬Ë‰³¯ùÓ!gRàüÒe{}q±ö:,>‰Kå6Tø’âØUõôÁ ö†rË…«ýTìÅߘ;Só]ÆŸPF80¢zÞèò®¶·aÌ…Ž8£èIrÞ É@½øä‘ +;I“¶~ãËÃN…°ÍÐg|íâ fór1]x +¸rC½î]¡É,³âe÷Š6FŸÁ|#ÿ-Yþ¾Õés„ »êêÛ i(ý2‡ Þb¬†áËÊx‡9æRŠ9ÓØ|mŠ±W(3Ä…–å%B¹¸ÄE^qD­dV:m#Øœfä¶M¤·ž¿éÒ`Š[¨¥ª«=PUíï?åòl¼}’c©¨´·Æ£9ÐJ@‚"ª¢mö]…uQ›"»#5ÓaÕŸȺ9]U†Ú{Tƒ+ùy†™Ínt>a¸´þ¢ÿÆ Ë5cÍ3¯9„lçìæõ#.ˆ¬ü_ö{ÀëiÒGÜV aï™­j¼¤Ž,ûyŽ1ɃÁ>Ùùšöã{iÏ1RÙîxÀ³ë-‘=Sß1+\šÆíåöÊÃÚˆ|M³LJm Ø).í\ ê/§ôÖÓµZzœ<Ø`€ûYÉ +©øÜv_ã/òÎï Uƒ‰Uø´æ¦5`“ß•rQ×:™ÝèÔUÿÚXœ ;:Lêmò0Cm•£—í þPxõ·à»úæÎÃÇáµ€÷Åå>Ž£ âà 8âl7ýãó¡fžaAÚŽBÒ¢ˆó“5#ÈàzvNo=nšå-2ÃŒVªTšªU) õ1Ø\ ~/©äRv¶l B´î@Ó)·œÈ§¹‘Sœ³õð`ñ©¨¢åç¬õšuxè÷˾MR·í¹j;ÉFI§€Ÿ¼Æ¹²A\y~‡Ö—‡òx”†ZÃã®l}ŒŒjdº“9m…º¼‚jçR8Ó,ù +Ø<ŸïH²ä[¹`›ý Þ–"-ª4„ÎvR|e‡xåB¹ógÈD£e¦e*‰÷‰ +)îÛßôß_µÍÑÖâƪ×ÍÅÛí”AÃn&^Èѵ9¡þ„'—ðé[“yÞÔð·Ú±h™b-l¤ÊEoiM?<°PÉ)›†ljÐ¥38ÅQš?ôÓeF±‘4ßžµD“kòJoâ'ì“¥vœ¶÷.k°\â‚*Þ;l ã ½‚Aåv&{í©0fcc ßˬÁ/sèmuÝmÛ²7Y¿íEÁóƒZþV÷³Q¥836š!c—w@³ð¶û—Ýi>÷x~A~Ïü¶ó‰–.ÉaógÖ}²àWçû!ðcÒÕvŠhWº§í1;Š°>·¤²@åï{Éæ?„f•ùl­õ½²$]ùz£f}\˜ëÃæôY©â6âá$w®q%xÿšÅ̦øvÔJÅ]üXîôoì¿‘æΤJ +3~À/šlÄr¬v$P‰V_;oRP­k>—„Œd°3¿ +‘9äþK ÿÿÁÍÙÑÓû±»£' ô/ Xœendstream endobj -3242 0 obj << +3360 0 obj << /Type /Font /Subtype /Type1 -/Encoding 6709 0 R +/Encoding 7222 0 R /FirstChar 11 -/LastChar 123 -/Widths 6710 0 R -/BaseFont /CETICX+CMTI10 -/FontDescriptor 3240 0 R +/LastChar 122 +/Widths 7223 0 R +/BaseFont /YSKHFH+CMTI10 +/FontDescriptor 3358 0 R >> endobj -3240 0 obj << +3358 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /CETICX+CMTI10 +/FontName /YSKHFH+CMTI10 /ItalicAngle -14 /StemV 68 /XHeight 431 /FontBBox [-163 -250 1146 969] /Flags 4 -/CharSet (/ff/fi/ffi/exclam/quotedblright/percent/ampersand/quoteright/parenleft/parenright/asterisk/comma/hyphen/period/slash/zero/one/two/three/four/five/six/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash) -/FontFile 3241 0 R +/CharSet (/ff/fi/ffi/exclam/quotedblright/percent/ampersand/quoteright/parenleft/parenright/asterisk/comma/hyphen/period/slash/zero/one/two/three/four/five/six/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) +/FontFile 3359 0 R >> endobj -6710 0 obj -[613 562 0 882 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 307 514 0 0 818 767 307 409 409 511 0 307 358 307 511 511 511 511 511 511 511 511 0 511 511 307 307 0 767 0 511 0 743 704 716 755 678 653 774 743 386 525 769 627 897 743 767 678 0 729 562 716 743 743 999 743 743 613 307 0 307 0 0 0 511 460 460 511 460 307 460 511 307 307 460 256 818 562 511 511 460 422 409 332 537 460 664 464 486 409 511 ] +7223 0 obj +[613 562 0 882 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 307 514 0 0 818 767 307 409 409 511 0 307 358 307 511 511 511 511 511 511 511 511 0 511 511 307 307 0 767 0 511 0 743 704 716 755 678 653 774 743 386 525 769 627 897 743 767 678 767 729 562 716 743 743 999 743 743 613 307 0 307 0 0 0 511 460 460 511 460 307 460 511 307 307 460 256 818 562 511 511 460 422 409 332 537 460 664 464 486 409 ] endobj -3111 0 obj << -/Length1 1411 -/Length2 8632 +3225 0 obj << +/Length1 1429 +/Length2 8725 /Length3 532 -/Length 9503 -/Filter /FlateDecode ->> -stream -xÚí”U\Ú²æq÷Á&hãî‚»Ch ‘Æ‚{pw·à‚;Á‚C°à®0½÷¹÷°çÜÇ™§ùM÷Kÿ«j­ï[µj5=µª«„¹½)XÖêÂÊÁÆ!RÒPä`p°±cÐÓK9A.{¨4È,ààH¸Z8ay^AnvANX@ÊÞÁÓ biåx#ÅøW@Âì1AJ +°l3-@ÃÞ vñdHØÚÔÿZá P;ƒÜÀælsˆ™ Àl bÿr$µ°ðý+lîêðß)7°“3Ìà Ì$#fÑÜjë 0[`•íaZ`˜“ÿ¦þssYW[[eÝ_ÛÿÝ¥ÿ‘ÙAl=ÿ«ÂÞÎÁÕìP²7;Aÿ³Tü/sJ`sˆ«Ýfå]@¶3 ¨¥-À*ÀÆÍû¯0ÄYâ6W…¸˜Y,@¶Îà¿ã`¨ù5ïo@y }yæÿºÕ¿“ª ÔEÓÓ `®þ›9žÖ#'ˆÀ€Vûþ÷/£ÿ“šÙ›C °±àလœ@ž°ù€À›šƒ=`˜c ÔÞ¶kŒ/ÀÂÞ ã¯KåâÍímmANÅÿqs€fövv çhåé`†>‡`ë`7joþâmAÎVÏ~Ð ìdÿí¡à3;èâþœçေ•øœ …½ë³;.Xâö -˜]gX³þÍ0³Î`·x…5ø¯ ÿwf -ù‡^Ø"‰g‚-|&X±Ô3ÁÎ$ýL°Éü›ø`Ç‘}&Øaäž v·Ï;…ü3ÁÔž ¦®øL0u¥g‚©+?L]åßÄSW}&˜žú3Áô4ž Ö2Íg‚©k=L]û™`ê:ÏS×}&˜ºÞ¿‰6žÀç†rÀæý²öÿÀ¿.éý×íüÏ—$)iïáÍÊË `å„ '¬_ì¾ÿ{¡âè -–—†M;;ŸÿßQ3W''0Ôåï?0Ø+ýo¶€ÀÞ5ì6ÃX˜³7 -¶NýZþA¦pò2£3EziðhWHcºÛÁªÁŒSó„&˜ò?ßR—r¤P4·àY'ý,á3à­ ù?€MȘŸ¡zbv`hŒ0˜Û߃k—±»@µåÐÌ|²H{µæÖ…\£¸ÇÁW@z‰T>?÷xñÁÆol}3Íœv;Ã(·]1¬ýk-näþPξÐ~¡xð¥aÆÕ‹? ¤=+ßm–±Ó¢r•gÓEÐÙ=,6Æ082m¨t“[gÐé–‘éfF¥/îRËsl¿XZòŒYéWÆK¢-þˆj${RP§ãu^¾2õ|£| ÷9Õm˜¨#’›Û‡ÝCX½¦·K”G”iSs"¬I×ÝšfÀm ¯©ÂpãNâ¤gaø›SR·¸—%Þ–‹Ð­$¡˜ŠïŸ©6¡Î¨ÖÍów~kQÅp¦Xˆ¢Õ•Ï¿®ž ö¹ž5´¶GòÐ$ha¶|Ê «Ñ!a¦a¿;áè?¬[ºP?Hó„Ôe;ùJª~ØAw Uãz¡inrä“á*¾^ívVÐRUÊÜà`[Ÿòµú®è.ž´ÓPô´S «L)æ -¡ÜOÊÍoÝ´k=S ’cê©]]6C*>Ùý;”ýT,´ÿ, (Lo5‘9Ö}÷)Úþ”óÊßg±‰ÿøÖG<$·œ§.™®:ȬÎì>(µóIšóõŸ5ßzßoF¿)Œ¥Œò@†á5BkÆn>6Ä^ÁXœ:ùJ;¾Øßì/€q‘ªŒAíp.|›ª¨ékÆÓŽŠpp§èÑ{¹l­_{z¥“Õ'—óÒÊ„ÎÜ®ðÇ7DšOî|䚪&¢å஼L¦“ߧd^õªðÉó¡˜åɹÝȯÌ7¡¸,pjJÚ*œü4ïÚ Àâ nþBæÇx²@/·!Èâ¡V°‹þ{¶ÅCõôi¬v±äÒºÓ÷ß}Ñ9æV!ÑßÔÅ7±9*_Ìõù2æîÚ³ÏÛÀ fÆ/¸aâ™[!ïá|}Ћ²)Î^ƒõv‡'£¶×*m¬ŸdËæ) -îJ¹²ƒ©Ç´"â£d+Þj‚0IùéžfýØ÷"w 7L’67YArx½÷Yp8ÅUšh,\JùÆ? }/‘fôâÆ1m„þh•aFœjŠ¡tŸ@àê_[Yce2?dϽ‚Î[ñžâ&ˆ­yàñY”oO‘E(–^pïù}“ôüY¥¯ý)òŽ­Ú»bIb„âÒéIn~ §pÜ uìÍüì Ä©°n"ªµï…¸bç:ÔLÚŒ<y˳~ª+Þr.']Ìt䆊÷Œ~ÎFå‰å(žÙxóÝV|ñøôãæ}#†'tR¬@Q¶g#nJÒ_#ÓV´î0jkÑMK%]ùƒÞÖòë6!´5ì* Q”øŸNï¥k'wvåÍCý 0Ÿ*|í4ò³òð4ÈH:-·Ôç¿ü¢½ü‘t^ - uå¡%9ºÕz»6q^ÚÅãË´»Ë¯.OX†$ò‡›1ú6óüLš oºL× ‹|!Ô8u¡cý.T+{ MŽÊçOhOe=ìËKB6É, –½%ŠéÛFæýŠ®Ó£Ì1â¤AªCä…á¥áãCÖGxQˆÝ¥XZÛÖn8Y#¤ê£N¬?LË’ïi‰¹{J¤@ª¹“XD™åTñê>AémxÌyûò£–e?"2Ü\$' Ô°e…‹(!zækQ` :=uV¯Ì*°ZíÚsÊ~Aå(°‰–Ã1 ·Þ‰ÜzP¶ôs ->dŸ^ýDù ÔWSü b7wŸ¶Ë¿”¹:¨>¼Ö*Ì] "Ù¶má @öôqÐ[êPoïI"ü(ö¨7ý!.“¡ªîhÎÀ€òÊ"`ˆ>ͼ>åPÿšTR‰YL+jö.¨—åHn­™ÙçÃÓ›¨óÒûA[k§óM#“Ùü…©*ÐÛ%ÇÛÂÈÅYæod8‡TÈà‰±’~RXû ¹ääIÚm•É*èKôWê´„½0ïFÀYær ADbVâMDQÌ9;n÷3¾¦lþG/·ÈEô:Ô–<ëªÊåüÉÕÜ|¸•” ¥‹Mnª„TKo›‘Zþk”©ÕûYö>L5 -ý›‘’#Õ`é)…ТK -¢\hg}˜hØÊËI›×.©Á¾Š$¢ëH1“#'uJ£ó›X^ï­y šd{éViQ Ñ£zð6UØÒ¸-?âRû¶ô|.ËJB<òµ0íýÈãùuPîþ‹ô …QQ¯75±IZ¼£p1ÎýJPÕêÓgNé,uøft²Çõ±qV8B¢”xýä„nÙªËz ôÆ÷¤MÃK¡ùy‰¡…É" *•—NmQ[2áþ¤qôõàn9µ„+ªN½·ýÎ>¨ù,SSçêÌQî|$ÔR¯®Y82~]_Ü(EôùkwΑM€ÜÝ—›-ðACn¢Mf÷Vë­.pÙ/93òÑfö`Õ"¼†5uÁ•ä¦@ªò¢¨OäèºÔÍÛáŽÂ„ú©mHÅ&¬„¿V®²ùËèðºøw¼‡pGh˜—ɸÔbZ“ú€JBˆ¼ÛŒ¹ŸÚþ<¶.kf&˜ýöÕå >QîXãᜮG,îÆ÷+,4ÚZuœx`\W&È^N¨±}EM‰¹ ƾ†Ïónå ‡”¶Êpòìz}ÿ!ÓQW¥Hß{ù6Üüg©W–[wÇ‹F3Õwô ”¢Â ÂKÖtá*v¦¸ÚaU¹W¨¶›®ô÷¢£-Vp^o+)O“;e›ø,þð¾¹ÜÖJw™9³bN¿ïÞ“ú"nxÏ=áŠT¿Œc1%;§ ›ÅQ×v|U$åðÞpK m:¾ÎºYe?›uRDÉ5úžõëißO9¯Õbl‡°ùÚ&á´k=Àz$³Éé¹Ù“ÀÈPIvœ<7ãnŽ´û‰ÿ¸Ï¼¥­†Mã½mt•Ð+ÁhqºLÖÛ¤¥u¦Ô²ˆJà÷"çJÅ{ýhÿGÕ™ŸDäþuð4+-Ã4–aÕ«ÖòOùšX’T7:Ÿ‹Yôߢ]Æ•Z­P -ž*4˜ëpµ~x˜`²Š)§¤L'zS(J$¸cZ={”U9Û½ ]Ò`îY£ç7!¡ fî#6¥Á“¤ÞY"ƒÓè×R0švÄÔ ‡3‘³£˜ô™+dÑšpÀ¸Œ¯ šxI¼aˆéÇsÊæ\²]3;§<84Û`bœCíF)‹•xRP5â…] ø`€RÍ<%¾6Ú}ƒ›ñù>êñHÞ`¿eñÞr=ÅË¡"˜Eê.hèZè$Þ—P M®0–ê‹8| -éË™%ôE)ðgaÔÉGPOI¹êŠçŠY3å%é¾îöaIÅàñyï$\ØÁRX>™¿³éé×JŸ‚ˆà'´(?UIo¢FÌýc7‹»ÕÒ¸±·½(;—ûEB­Éva;¼d=7œ±*~KÅÞm‰ÙÍ”ø¨fÖU z*âaÚý½3„UÔ(&þBò_Ú‚žTH‰^'æù£’˜Àw þIÖv->Ò9m)/þ?&žXMÛ"é-ºI³m?ázµ8Mܲ^™Œ§ ê^À-K…ä¨Uò!Ø›!êg* ÃdnÒŸ‡0Ïã?ÇŸÿäY3Qx?ldy²*>ãZÕ[œÏûV„ƾyšù!léìEP+~IþªŒÄ7q>ñ„½zäï~£ðëß«1Pƺ¿ÔËsš6(HàÒœþÆcižÚï^û4&šÎíT%[þØì™zÝoAÛGE7ÎD»œ«¨kÇEÕ¹½uÕñkóÐ>~ .¬CÖ0Üá^j°áz«ñˆ¬þ뺠-œÇËo.lò“Éä>Z‘õ,¿°ìž„8שïÄ2Dªù^5˜2,‚š[6Rè$•‚Îv6ñ­²Ð.âìÙKÝ}6™xͱHv -1l˜üíð -Ìt8³&r Ä„õ—ճൽI 6kåW 1ɨ›’G]&µ–§"jìQ’(P˜m;)ÔÔv9€_ÃWe¸û!‡.iÕ•¦CJQuƒŒX‰ß$E ÷˜LÌO|_·\¥I~$›û•µ¿r °{DZŸÝ¹ FËÔó -¾÷°›B.Ð -v™È-±ih}°rŽºÙð#ÞâÓ2…µÕ7gí¼GŠŸ+,ù‰©ç#O—Œæ¬Zñ×&>°q³Qsd™²v˜*ŠÙMpñ0kHßÎ}YÜÅ_Â^>Œ×5aNóL†&z+fFhQaç òUu4îâ%‰‰á3åÇ0÷›*}ì!ȉ€Æ’1¨G{#–¢%ûøˆæ21á®^Ï'bZ-LŠCóÞ¿ì5¸6|t±CT–À‘Òy°á5}3{Z÷ª‘\çêЪs†«›sÃäØ¥» -/¸:^ÓRé_p¢¸Ï»\Yº"v$è_‚D7”•ã¬~»TÜÝKúiôœVŸ•ÆÚõR!-àâ( k[ Aâ%î:Ãw5ÚÑqùB}ZHžâPåëå0Y1§zšýë×ô_WfQ.ë#X^~”>fìœR± šr’È Kü þô¨•õfvÙ:«þºô˜÷]€Û[Û"¯¡A9’¾{9¯¾Ï“íì^4F@­™,ß\—„®¢ö£ûM“]t ›hZÉ -áeºByCb2æÎm¿òð’ð]ˆM¢&©§Õ>ÚçÃבŒhOç¤É‘´ÎôqÜ»¿´¤nWè䬣ÉwÑ"INµ›Áµ²}bÙ•–q©n}s¤¹TäPqÈyŒþa-Æ‚broÉl¯«ŠA0Tî© õÀÑ®ÒQúþí ü•)O‚Ü{}]¯° ¶O‚x6?¼*µv™Hä7´ ? _í`X)0¡c‘6C¦»™<==`¡CìpÐË”1³néÈ5‚½¯&A<~,Èj/Ö%„女’õçÎ -¸æTk1÷S|OxÖ3­WèúšTWŸ%íy3ÄÓXA¬­Òš¥í¹ÕÄ&Øt6¡®r`/êÒ›ó ƒÚŠ(Ó %Œ«”lc÷®ûØÒ1²,ÚCßG,TQWkµ\DˆZ‡´í %…¦ ÑX}õD´°kÀ™CpV+´[|)§x]F CjŽZ½>çwÜš^×EÑi\L]'€äÇ1h:¿wxCÔ§]®¦M,Z£€œ'ì‰6‡æp'…ùƒÚyiMºøÕßaªê5ÀúRä0´·„Ÿ~·ñ?ìöÇße7¥˜ºB¶ÑÙ:2צËåÚRáé×ù_!H¾T¶-újú-A…r(…¤ã†ŸCÃÈPZ|MôJNÔL¬†ˆq >2‘D«ß-œ[OD•&³2éΨöCÍ—À0ð¬ßë±:}•ª‰oËÍ4çâb΃Ó±§fµ)¢=Ôiº_môUq%p)Ôl^('ÑVMV†Ï›¾º|bcDì…;[î*{0Maÿ ”Mú»û9;B/ÑE㾬*¸xÜ´ƒ¶fOT6EÄu²ÓÁ0ýuT܃x²d 6ƒLŸåÝ^.k)R‡Àio÷:È¢Xv·³!"ÿQÊl™Û”†—t~gšZÒÕ¤¤>UŽ/.ã¥N´õgŒ_ü¢…N¢Î{ñ÷c‹ ßÓ÷šÍÜ® qÙ×-ïè@Ùt^’6wê-Õø<ä&›<¸ã 4¯7ë®tÜêt’ãYÆ–„’ˆUûsW¬îdÑWRK´‡»DçfÕѯ0›œµR«»îU”|EÒCC?©øÿI¯šH™uÐ9ítœ¨:›!¸BáÊàáuœAêpõ=#ÒDx™ñr»Söªu‹0ª)kb¼•vÃä•KÂxÁûããòšrÔKvjîP½÷ÕVòà=8Ô{_"éÛà·Ú¿ªéèQRM- lœ…m)vŠ8|¾êä ,ÌëÚàÜ; -€ŽK ëJ­ṫð¨ƒKÛb.´–s袾ïÿÚ¾[)' pÆiŒ¹“̦ÐLöå¯ï)¾ŠV¼nx‹u…cÃ8Ì]”FÅfq2'›q2ƒÓTK¾(jS¾Ï¤ú}G|ÑS­£‡ý¸OØÚ3Å<ÞÿÅ/Öêi^ü‹ÕÛ ÔÙ×æ«Ó)§ö1°ÅûáAšV±lP –½ë£m_¥#Šn—£·ñzRW²‰¬!Ù?ý³›‹Þ]â¯WÓ›îûBB'1*¶-×?ã–ê^ç°l1X/Òüö‘š—èP|Çò7*ܵ7,Är£l_šNÕž$Xç«õn«® -kbåÐÄwL§rú–gõ|·SvG£÷Mn*›3.8HNâí [ÈÙÊEÂ'ñnô–œkÅՕצ• '/V¤Ô§×¦¯èºÙi‡r -FØYY½úå xµ_ÒD3Lo DÂÒ|è¦ÅŠ3>ÅÂðH‰_)Ê9Ó0hâ`óÆXÔªMë‘c˜0æWˆ|7‘~Ý¢MT)1dFk:'·ZkÑ{úPÚxvpfŽõÁú"'1~/µê --Ì™ëì-.ŽÙîlZ-Ÿ#nÑ9ã×ÃÖЕOŽÊ^à¢ÕTvAÔèÊÔz!ç|}¥‡„*ŸÔÊS ]CB37b›Bh“ø¬…õ¬VëHüÓ˜l5¼Ä~ÿ£Z‡mKªÇwªGAº—[¿`ð9}.ÿøit´(ÉeÔÿAÈm¾Ø-²1¯˜yægï.ój¸Ýƒ#½+1õ·ÑÂ(MšíR{ÎÇ26ãýHÝÓ¨¦7ÔŽpRAÒÔçSØ9¦/ ðþ¬t’!Mœ´teRlàðzWÖû,=8˜lIw«27§ áê0á ƒ -á1dßtÏ€„&GöÍté=¡1yBQJÇÔYˆî®æI5Óóä¾ÎÂÜÇð¶”,#B™¸cÁïafÙî|¿fq"ˆî:-ö¸¸6úé·Ãâ°èNª#×}E8€€ ¬V…3sEDšúÓ²“Ñϸ}<ŒŸ aüŽÝ,Ë)δlRWÇ$·ÒwßÕv½)w>'Æm-覫IR±:‹p`‘ôgîc}»§OÛ-¡Ãz}4q‚*Ÿy²±…ŸþA„‰ïè)?k’WÒ`M¦Ýâ²´xºdÕ¬í®­%ÉL ò"Ùòù¡L_-ò -Ú~DɅǸÕÃ~t¥;9Ö_é³mPÖMÔøí)Js°ØŸï•1¥;™€†„¿û æ÷U]i~™æï˜2 ú3{7yó (VÞmf£Õa uÞÌ(ï"VŽÃ= ê‘lÈÙßCÁ±eñþh[`–­=—G(7M챎tO7ª*J5ªRlGŒž`.oÓ ß Íaà -ó`u¦ 6û!£#‹ªú¾• -S•Ô}"$­—'B±srX´¼D¸ñh0¶­è˜M…jÛ”·t‘–·Œóöt((pôqÑ\å¬à í­Ê´Ø¯†…¼ãu>ŒÃ噲sµ7( ÎuÄoÉc|槤h¨ -}ø³9‚ºº)äÃA¤z>eÏîÿe17›ÿ…3Ö}Êi€\ý• ‘4§Œ$úm&ͬGc¿.pî«Iø{‘áº-`¨.úD™Dé*sÛÚZ’WoÞÎ Ç.­6kclŠÄ’.¼¤šS4…OØÃb®€`rÄE6ŸÕÊ>žó£k…5Šgïž)͈Od,ëYçÛbi[ŸÝ\D’zi^c·êþbI—¡rc¤/bCÆC(}Œñs­¦øUцÁã#H¶ÍirÎï†/2yƒ“`b<ìq°lÌ›p¬ú¸øV Ƶî 9É 7‘s­+¿Èõ6ÏS$”JºhzB2½¥v^Áä·æPŒ°ZPÕÈçUµ ÉNÒG!)æ˹FÚü”£jU ÃIû9 œWI‚ÏÙœ©Å±æpI%³ D’­Þÿi8Ö_’oš£²{ÃÖ…`bÅa£øµ Å5‰±^¨;oO"ö[^Fðãt"™õŒZ¾ú54Ç;ÿ„  ‹Õ`Ð(jÚT†Úºäª4{0­6‡UmeÑ)œ¥HGˆ«®ZË·XüļµÑ”Ðâ/scžQÂ%Õ¦.¬T_T^2¾0§7Å’Ñs2§_„¥' YÏ~Š¡@ÿ$•Ÿ¾ù½ËeÀLjZkìÊ7à˜—Ô3 «öÈ}ÿ\]7úËÇo´^Û’ÄWඌŽ÷GkÊ#ˆËÅ4ù±$. TüÂ2Ř…·Ã¹²‘o[Îû„t_øËå‹þ1Õ›¬÷U†6àžQ·Õؼ`Ít#ÞyÎÇênu$\³‡·Ú/sO!JŸ@šËšAÎB‡‘™¸Š´ÞMO÷ùò­OämÌï`¬·"ý´¦ñôbÁÍÃR1Œf$6 +Ô A[dÓ_?=bx4°ÝÇþRž„Þð5ÝØÉ×ÈÜ4¾rEàó¢tÆŽ4ŸÿÑoZZiÛ»æJJÐDZ -µû ŸP:ûI>6p3Y{Êâ¨í!OIËE¹¥rGÕäXNµSu‰¿ˆ Ý6;E°®‘Ù£Ãj gPåËBU9/99ª^teJœQKe™ßkÑ«58ùZ:×>€™§åywz„Èëg¥kO}Âó¾Ver¾ñó{>.ªrÂ_Iâ‡×¶Wô?øgC’ÙZ­†79oÏœCâøsÂ齓½HÐ8áòÓúÓÌõ=RŒãÆ°m£P¬v±ª‘šWžX‰¸‚±ðFµ¡QHñàý_áspÃúIYÝ›k9¢/ßø"\oÚŒÓ6ˆo²kÄœ¶•\¦õó'Ø'dÌ*MhÅÈ5”qyÇÅg=ÖW‚(“{ªsÊ™=vuÄŸÌ‚ÿHŽ»Ù™‡;ñÙÒ¹Ïõ¾ò@c +Þä?&]rk¢ÙPñƒ¥¹“—I­’O¤›úüü‡o[²~nDM{¶÷ N%ê +É®i’[nKS¹vc~ÖL‹ü’ô© ŽáÇÀà7“—†ŒÍܵ•žlçO  Lë7PÏfÙ”,°ïÍdâ1|ZDJÓËÊäÇz`cØË %(½žÿC…µ$Šôõxý/¸ðA4k8£`æ{䊣%jšïs<ÐFwØÿ?ÿƒÿ'60³ƒœ\ìí@N6ÿ _Ãë'endstream +/Length 9604 +/Filter /FlateDecode +>> +stream +xÚí”U\Ú²æ‘<$4îÒ8A‚»kÐiO°àîNpww îÜÝ!¸ÃôÞçÞÞsgžæ7Ý/ý¯ªUß·j­Õ”¤Š*ŒBF`8ØÚžÈü‘S‘²€L,È””"¾½ØZTßôäá„L¬Ð<çGv–¬Ð"€ØÆbfbj ¡ý«ˆ d‚˜ê[äôíMAVІú–°¡ÈÞ… di Pþk…@d‚8‚Œ˜@€‘™¡=ÀdbfÌü—#)kc0€ë_a#›ÿN9‚ vPS¨IZÔ¢ØÚÒ`2Ff–Cµ@P'ÿ7LýgsqKKy}«¿Úÿ=¥ÿ‘×·2³tù¯ +°•ƒ= ÖÿYªú—99‘™ƒÕf¥ìõ-Í …¬M,AF&vÎ…ÍìÄÍœAFŠfö†¦c}K;ÐßqµÑïo̪Ò*b2¢ôÿuª'õͬíU]l@–—ê¿øÂÐAÌœÚ,L,,@h!ôûß¿tÿCLÌÚldf ½œ}Dßz? Äø˜Yœ g¨cf&k°=t :7€1‚üס²q˜À––ú¿â‡ØÙ̆`++ý—€ÙÔÅÆdý‚®³ž(Øè%Ä`¶³Ô·3}‰p˜¿ à—€l ú7s°˜í^ò@(›B@ÿ¨`0ƒ^Üq°AfŽÿ¨€Úµƒëß 5krü‡Wè`˜ÿuàÿŽ@­Z›ýÓ÷_{¶¿,ℶz!h á‚.y!èZÑ‚nQìßÄÝ ø A·'ñBЭI¾t_R/U—y!¨ºì AÕå^ª.ÿBPu…7T]ñ… zÊ/ÕSy!èU_ª®öBPuõ‚ªk¼Týó AÕ5ÿM@è…e~1ú˜­ÿÐ,øø×±ý¡¢ÿ:¯ÿù¶„…ÁÎß9YŒ¬Ð ²²AçÅâö¿ªY›Ù:€¤D¡wŒ……‹‡û﨡²¶ÿû/ únÿ›Í /r"ÏMƒ y}Ìãký +ÜÅ²Æ +híˆó|†Z}«y™–y±~CêFUAÎ0}1ÍÍŠ0âŽdJ˜Œ9Vß× +¹ö~WaöÅìEáÍHRA<1<ÐуëKëé@·J Ü™#Ù´©£?™'¿\qlE(“Ýre¾? +zU03ýxîná1¼:‡’`D¾‡¬›Ö$ Rß]‰¼;”gçrúðt’.±ŸæÞw,MX,¢%ò§ÉÁO%ò?¼a¡u6^F&[Ì}Ž¡møý†b!šrî÷¼èùm|Aªe»‰ ÇÁ°©Vq¤0ÒüSop5Á3i"F˱ üLm¼ãns;»+‹3ŸrY.z«‡Ý†ê¨Íg's²^ÇÞôš"µ[¡“Ž¹NHL›à7ŒM{ÞaœO +nOÛ"¼-Á gÒÍ£È+Á90¨?àJCäÏ~-Ÿ~ìv8­jª¿áçuVŪ§7yN÷/ÓÀ§'c¹=öõøœ7WÙGöüªÕrŒX¤rÀæsoƒÊÕ\ÍôÞ‡ÁBeLÍò­ŸÞ %qÓ}}\òWÊã¨è;¢þÐI º2F±<”ë×8ë6:ÛÈWx:Æ«´…‡•ã[[-ú\Sz¶?ô¸+˜@ÔŸæ^ËLnÖØVL¸fo¦{znÏ×1o\}Ó +8*b)J½ + ï¼ã[žEY©ŸVÜ*Ý:uï‰ôDtÓõ“tÊzy3Wô]µU,zß}óAFemÑÈÛNrCû‘Ô >gŽR´9§õn‚±çÚPDL\ÑCž´E–…ùó&T{/©áWG—èc¬òØbzB ï©ã%æÈÝÉÝ‘«DMÉh¨Ìå·/ãÕ±_ã’/»¸¤¸^¦K8^K-ÍÔ¼¶ŸcU¶”9Y7jÝùñ¶ŸË§®ÀƒödŽRbí#ƒ³RæΛû©zgEiÑ?áê9 «‰ûîÐT#Óµ"ßÐNeÁ 4`o1öt·}-{ë8} ݇3/ðšŽzi°ƒ•ú ëõŠ Kªä6GRy—iÂp&þ¦Ås0Ì¥|q3]‡AQ`ˆp*Ær~>©•këì§2jcçZÖ#Õ‡,L ›k^ñW ª‰EÄSbA#vråw6¦×ªë°‰³L]$7¢ÁlÚߊ`Ïè¬t€àᮤha×°w6±`þxývÚéO_­o“µ–£Ó|>s"<üæô-TÒ%äœÏ´QÁ²3uÎ#Y!°nm2?ú!%k×9õ(«.Ëö;%R [î'ÆAA°Âã>£hì0â–)ƒŸæ©GB¦ÊU†Yk/ žã€  æýj36Ö%¸ëÞšñÎJ\ž(Ã./'4ÆÙ¼»F &äÑpú -™¹¢uÇ6„©½¥ñ¡ƒSg°Û¶ÎP…é—/\ƧúHßùdµp×÷ “Ø#ôý÷˜ú½õËîúiɹCÙGåûZ¼(cH`æòL”†"pæËG%ÀHØ„rä#¼bÍ -aÅ})ec²¥rð²v£UƒÚÐU¡v“Íš|)( £™‘£ÒÌìÕóbk‘.ßÔ›B?-žîˆ#‡üÕ„úC§±.ã Ì£v¬¼7Xwnª‡ÃÄ÷$ ™æU”á¬ZîÀ!ïBª²Ý3¿Ç´Pæêx…ÙÄófóñuÜS<ƒÒç+Rå¤zíM—Ã? }á|‘ìÊóp÷„þPXr-©ywUÈx Ôµ†EN@9û•«Ém¹ x~*Ê "Á5£ûfžƒSîu5mð€QúìÞºY‡åófüù>=úRû;ûFGà{A$µV•“l—æéŽøÂP2„‚ñJI×·±Ñ†$ýÕÖ—¼M‰}B*»±,¨‰…˜ãWýÕ0¸“UA $-G VÞåèµ0Ê¡ +`¯³€³çCPã¤{>€×2Ñ$c!„âd.ýõHa¹8¹&u&a½Ÿö!öâ. Ûºû;e벺aدD¦fŸa÷ã4Czx5*‰Zol]ÏÖÃ汤õéõÀÄ|aµ +êú’&ζ®ß#ä]ÂRatírQìù©àiýh)Ã>ýA ®ø™æÆê‚í`øÁrÉ*÷C÷ž®‡ÙDÔf'’(öG ™Å÷^¹Q‘&o8 ˜2×hc1j«·£'áºSA­²ÅB…µ÷ÉgtÍHÝ´™i(˜žƒµ+zn„‹çÛLRÏž˜Ù„Í Äƒ†ëÓì-²ôü>†?̳œÓó±ãŽ'NiWJ¨ÓŠ]±Þô¢]Q•÷Ý Ú Gµµ]”ö…Lô$˜~]âö0¾Ìc,g6?µÏØæˆ8VŽ &Pˆ÷ÜœPŠþ6£#è)6-ço¿Væ W7)‚ņ-Z#%ƒcVÚr 7=³é.Œ„56`)…da×-¶ngg;GL›l-n•þ÷ïývé¸ÎzôiRþå¸ZBJ?0ÖJ’ÑÈ`Í÷mÍÀÁ:ƒ#šŒéŽ@užQ¯÷¼âìÀ%µE£&DbxbfØó´)£ðu.KÎx»^`ÚýÝ^oÄáåŸàת™b}ßoÎ88õƈ +¾‹…CžoÃ+h$š¢wí§·qÈÉàchSjÖ9÷êÑüÏ·L±î¯ð}ŠŠF ó³® z‰àQ“[°çkO:Y–¦$¾ ×ÀãÕšÛ´™€µ‹7Q®ø‡Ë'ô;¦7¦½$ð˜ ++Y‹4¶Ò–<øçÒ½>ÏrË i‘o®¶,ù¿+ÔslF¯HXÈëÇrÎäK$!ÀÜÚuÜBB–’ñõ·A>û!¨¦&m µˆ» Kœê“™o:Ö· {³ž¢#Rè-÷¹fª¢¶ÂÚocÜ®[¯S²Z(Í_B•Ó~ñjµ;ùÑG5íÛµË/ˆô6¯C­ç¦vS•×úšz@÷Ïáè>Ƙ®1å·íÝ™£  J ÝRM7ŒÖMÏ„ÓŽ«*çý’Ì,‹J·nAk0ð»ß|ßPnÝcX¨¸U®'«6Ñd8.¾¯è1¥9ZɪÜÕ4æŠÐšá¦£lM}·Ï$ûL]$‘|I_@Ã}X9¦€ŠUšõ¹*­ÐŒä'̘…ågT2º°÷®wê +ÞõíËn2Ù]±Éú ’JÌu“)$ïŸ<ÄÄ·ëÎÖNí".Ë ÃD·ÂytW©h[-©6p"î”­±D@¬[]‚ˆ›V«Q½¹º‚dÀB!ŒSÁ [²ðÓ)Ýî]ôAmÍ'\Úìnó<£<‹i˜Ù!Çß{Ý7€³”þù#áHy\`ä†ÓåñÍQñ©Úû³r)˜Ë]Ñ Ö#u²mÕ}D±õœ|÷ÚUTfÁ(I„\­Çšü Iè +p„D;âêôëøck¶‘ л-…bé92<Ãstñ_© Òˆ˜×¼!0QãOþÌj_pÀõ©¾üýÆ.ñ¶•äß[u‡­ÍJ?ÆcÅ•Ì2“u>µÁ‹)Ÿ}IPõðð%)Ü«¿ +xÄõ‰=Ÿ%ëÂQø$cµÃ—ý¸„nAëæ®OH4¡6öûÕʲ*DÒzŸD‹hkûšŽû5Щ¨òŽµÆƒª°åUÂÅ Ëâ’P–ŒFC`\Êt¸@QoYŽ–‹Ô«œîñ$ÛwÕ+$Æ3²Ê°ÈçgT»&5pì{C -ouüéÜ° æÒ+EBwÓ£ÏéJî2ÀWy£H–i¸pWc…w$BÕ}çû÷ãÓMþʘs5x ˜#šÈ­]}¢¥0‘rvIo6Û˱Ñ)ùm•éúè›N‡P³ý‚>,ÎîØÄè™ÑõW¾r˜ºwu$ÚC’+]ùNŒŠ>9s'røõy+5ÚŒªÖÍKeíLåF:ÍŒ)!°+l÷zXs“Üy[7~QluGÔeXS«ÕýõHP˜N¼l“©R4´¦1oH"{ý{eÇv†‡­¦HÞÍÃwþ„¶~øÕO54Jf`jÔ`x•|zXප̡=cžõªÞ`ÙÎoG0#ìóä:ÙÖ¤²•íl{q3ÒHtc‚³‰ccéÔÍ¥§;3#NX¿¿6ݤ¬žá,¤7€#úD÷ÚC^‹Þ¯eVIȧ‰!ƤäIrɆNŠ7Dè1ô‡÷l´RšŒ4MlóB#¾}µ×ú„V ê„Qùî ëÖ’já+æ¦bl„7+û¦)8éoîtY*Š9”¾âߌæÐ%^û·ÔkO“¢*)ß ’…:õ-ª¬2Î×­j¦Ÿ4SÍr-lû‘°Î˜Æöꎔ.)-ùƒ€·öåC%ãzÅFs>BóêMè­‚áÞž~ôû"¬åyð\­³Š8ÖD r«Z[ÔT?L +éKj<„¢fË`æ!^Ιž³™ïNUÖ0Btj9»4[hæ&9Ä3ãXàè#ùO¸Kc:ÄÉ&ýÂèßîŽ83aëÏ·åSàǾs,–YJe MF4ÂMe7ïW9áÿñöKʺ€Sÿú}(ö7ý…x¬‘Á åŒÞeÌÂ{YßÎX”Û÷þ=Ö0¨ë¿1·›yÈšÎRÞ¼ÍTE×Ð: +6éc“DØiáaôÞ™=¸ûñ-WÉ.\Ó³6RàRªXŽKj4¦"h=_ïPAmàáÔkÓ5pUÕßvBûÀJ°z(t–—¶ô{ʉ/¡3·ÄÏ=æPµÁªïx»[œB§#œö¼hØ… Ÿžeóc†Ÿ$ÌRß'&nYQ‰¤ød-}åùtÅaN ¾ +–ŒÜàõôr:Ìزñí<ùçI­lx¯ûUÑÀžZH7»íÃÃãÌ Æòñ@ýãB?ᶋxEê1ƒÁk÷qâ1¸ »ÊK…˜ÉÞ:µ„AMð—?ï–Õý)}#r“žƒÍPÕ$’Uع¢ÚïÅl‰÷¼µæSŠ©Î`ÑOçEr~œ¡M$ЬÆtl Ya³ÌÉS0ð>­™ØÖÙÍ ”/eîð6&”)IåÇIâì€U­Rei ÓtGúiÄòäó[Z:"öO +…Êâ±ÑÙ'ǃŽò=š1N/96÷÷;ƃ¶™fÙOdÀ&Ó½ÆEÉ ÄÕpÕˆŽ‰ˆNIåûr›hUù$w~n3G†^É>©Ú–²qeùaOôPvæ#‚!*½+²‡¥.ÑbtË”¦möÙm£Cξ¯¶¯;y‰B“ªj/Ͼ´êðE71± T~Hw¯dðrãNKÌeôÍ,‘6jï—†z$¸ûÄì~REÔÈõ°Ø*—c¦†{â¯>‘/~aŽVÓÁmxÈ¢:é?ÍðI£™bG¥«Ù ôîG(Í_ÜöPD·d)ß–ØEN(Z¥²dÎ[õYç:‹NÖÏÞÀie£™H*@ÕgˆÍÚfîªÒ[gÕÖ§iä`ÆZlÓo§¼c“š²ü¾SÍãåGôý‘r^ÇÇÍ/VìgœyÍWàAlúŸÖÂ(I9E4NŠÔr‘b¤`â·~Tp`SD€°àà˜Y@?q²^Â.PNÙñ+€Ë„“}×o<>ä㶠+ü¢e•t¤ +ÏÈŒ‚ +R(šÊ÷:íOp£žä»õh¸ßpØ#ÈôrOÛ§åÞ€¼ÀR¥ÇÚD©•Éö@m³* ÷d›·OÄ¢€ãÝûþ™tî™vÄš1^öMÍò‰ ø@ª™¬W'nÍöó9FÓùw®~{£ëiz©C¹£¯7ž:û˜Åxg®&áfC¢ËÞMÁ‘yìFG}[Š &GÅ{SZ%H³¤E¨Y æÝx—²Å=;Õ5j™a7L›N‰7KèGø~Nj R Ž_Ï!glaeÇæ‹·> +RõR×ï&tiž[:åYVŽ6É?¥ÊJÁÀLz¤%?Ø-N”£\“ºõ}žK¢VB‡o+ÂÐoëõ‹rÐU£ñtÓ àÎQMÚÞRÏ„R7HìJ¿“´ýœ.†qŒa’ïý{yT|Îo>ï¡HIiL>}œÇwåuË}Á® {Eå¬~ø–HÜ`™ÿ>7d×3žnÃæ㽺¯Ál5éŦñ¼‚m“ÙtáÌ3û\åǺb"ÃVž3Dì|‰a‡½¯»Ð%ñÝøº=@æRö‡¡‚ºbö—lz»ñt €w_D•n‰ß\>ùüÓ½ÏÝwõÈBDƒÉÅVÁ Ìï4MÜt®VQ†\ÐÛ±c3Dêå;xÄ,v“¼ôÏAÜgušw6é&†E‘”Ne‰Næsˆõðt;™‘ØÂQ1ÃÏؤu˜ªbðWb¯³M×ø?½âûæýÊð$›æÞAî)欳[ð¶ÿ ¸î «¹½ÓÉz͵¸i´EuŸð-™‚¡$) iÖ€Ò=9c#Á=›ÿ›&È6¹VïÉqÜmH"³ï2 99vVaïQiȯ“+çCa¢ètøºÇ¬ïìYH“æà’ù6ÚžwŒºa}•Th`²ë-,9'{ô°3­…Ñ +ï_œíiÚÇ5•š-ZŸ£„ŸèéŽÒÜ>d` +F<ÒgÜžhtGïæ‡ÎÙÁáYÓœb³Á!ÑûFV#†j(9Æ[zîuSsF·åV'ë¼ý>¾ëÒ]j'S½ÀÝþ"×rë-ª‰ÔŒg£ êJÑêSÖ°—k(äÍ@Å4KŒêº +†¨‘®VQmw4ö3c8Ö/ÆŠàºøV»òß–êF…$ôP {á¶U¼|Ûlñn´þôçðäíáំGyœMåa[%#¤ŠR2¿nŠwÊ6ÚÖ÷i¾Ê¢}‹LPhUÆqÑ˼Д‰n=Ûÿ5à@¤Ác½+ùªS–cSW7§kU?±TžjͶÊ[éµ}ºˆöȱ@/©å=_’dÅ±Ä úàáòg‚áÌÚ\€‹ýû¾Ç‘¬ón™$ü¸Sã‚t¸`cce+}zW7Û¤S30šä€Ì°lZÚW\׆ÒÔv‹I ƒÇOä÷%ó=nݤòsï\V5¹”Ëh´sr•yÇá>m=5*¾¢lÉ¡d¡#Äk¿ÈébœÉ-¾¨_Ò·Ïs4 8½‘ÎܲcA¶ŸŠïŸ…Ø$ –ÜèºI¦óþµZ|ò<=aõ'Šÿz•ÁÃ@ÚAG…Eâ0¥Užc*ø-ÂÚ8Ùòõz—ÈŒöÉYMt}¹ÊÀÜ8ÈM” h§ +Sc›)(ÔÁ?á˜øµÂœ…¶£,™² EEMñµs#0,©¹¾L:Ý4½2ñ“émA¹¾„fŒÎµ«†O>ªQh)A„“ÿØ·ËÏY¿žÓQnóÇÏië¶dM‡ê"A#‰!FÀ¨Ë÷ÏRé²3kçRJÖo¦ë··–LO‚pø}¢l£Æ6'ÓZ‰¥õÔT†¨ûj‡ Þ÷ÏÁ>Iý©bÙ‘¯DE7;ÐQæJ¿ôý=§1§¿Ò£Ñ>ùM£ÊÛXï•×ì<Æyþ9Gie?L‘çœø¾!=1AéºI„ê³€5A•¶QÒ¯Ô¥/ÌYeúJx)Œ¦Ø`â§WFM‘ŠõÉÛÜî¿0û™¶WyªZ2juÚù7Ê0•½ˆ~}=}lá:¹ ô㳎¢Ò¼Ã¹ªXõé V øŽ(ºËÀ<°°"»öˆaÿ§Õªè »þPÁ‹d6°^é^&¡êYj!Ì)Š4:ìü™;<ÍëãÜñ5cS‘ûj8Ê6L…³Ó6ÈSPZ>ÖYïRþ£žë¾¿ú1QJ†Úë4 qžõü•ï"Í$moýk¬7l÷4F6=ÃêÞ1æUmâΧqÚ6ð' e4Æ1ž‚ÂkÎõ{7´Ž§±í¬©ú”™3:klà©'âžnž_~n›ºˆÐMöú˜mJÈ-Úm§ÙS£µM^¥bÝ®ê( ßÛΣô¦nÈÀÊ,ì‰ÎàœjH¨’õkœ–m/?Ø ý´4¡ò4òÑŽµîuÒˆÂ7a˜Ia/!N¹ö*Jvå5o€o®?î4Î_%á;NŸžÿ’™+ö% “• ûä¾Þp¥òùC%ÛÃ~¿ûÂ×0©JØiåõ³n¿‰p +=­?JdQGº?Ñ:ûõkÿT®ÜœQ䢄YœÒ„ «¢Í¼g‘ð 𭋃Xî“(fĬ°c$ÖŸ!de_‘iiSEššöK?W3~Rö¬zrkžgAQp4Ìtv¢Õ~ Þñ|Ù–БúÙ™©º¹ø:/á÷ÕŠp/ŸKuDlvOö5Ðjä}[ÏU«ÝP¨ø#iílÏBõrÝ|4^ÃÕVÌùÉeI£ÁjOo#nî9 ¼Ñ¦ìz¹†9ºM‰§îºë[~Ü"£<°(“_5®ÈSXËŸ¥"š˜}îׇKÛ‰ôV»ÎoLº¾á—<3Id|´°#9s°‰ mZUš¸'¶Bmù|õæ½uO´Óôaø:a­^™‚Ì9B°éƒú-W£W ¥Lûø‰è>$‰eÚ«¼ŠÉšM¼_Nóž•çÇ{ôy¨ÀŒ®wQ`ÙYÉÂým4ð4YÒ,Æ'ä-Ì»ÓÏ3,D‡r~ûç½¢Qo,ÉGbÕõàF¸ìYWHÖA± +±mQG‚20¿Ä« [•±o3PÊQ¤äDT>Õøño󜸇£&Y‡áïp :ÎÄÀslÅâ5fÎØÝôª0RìâÔZÖc°ó{KÌœa èÃÔ –GSÏÚGoz”'S!:2ÎÊÚ÷›ÓQú¶™t©p½9#‘÷è(6ªøÊàe>ºÂÞð[ÀÞ–„aP¬6Ržtk¾Ïšqˆ‘!Ìá\lBâ¹±é1ž„üØz½0Gj4ÊÍÓýi™ßòikë„1¥Ë¦C¥·ð¢Dâ +?™-i:Ï ’gꊋ¿e~5Š½þeJÞš˜z*ä|sâsâ^‹¶~VõVÔ¿rQÃ6ó7|ȼPí ¥62¢GÇLE3A0wÌ£”?¦ê3bMõâĤ•Ô‰ïü^k›!Ó5†ìwèh©¶: +œw"‰t;œ kLqŠ:Sð‡ƒql]W§ã¯‚QDã““íܬÙŸ±dhœnÞ|'ÝnPûE_õÕN“.kŠ;“Øm5æýyÉϲçÄ^¯ãFßÆq³Óë÷‹kçùêéî!!#Ä.ÜUX'ÁôŽ™;“iÁFÕÕe‘®Ä2sm Íiã],u"\£Ý±ÒÐÈíÚÿh;GDkùF¤DùV‘9Í¢Ä÷Áÿ½TM—öU¥ª?×Ǹ~Àô§·ÜªÖÏŸ³XöœÃ~ŒÒXä,Š)ýäþ~r¯5=xñ–0)6à|òc^!‰îœþ‘¦-ÎíŒç”ìŒáÀVZ6Z~b¿.~BÜk9á?*â¶0Ò=8m ã³éæŒÒ›Ùp3#ĪR iµ˜r¿f1Æ1`4îÁ1ò°ùüÜN’Ã4U6ÕCvaÌ8Ýr÷”]ž áþñ<(BîÇöša§^SøþNÜ¿„_˜h±îAnÔˆ%•PËúš1cþÁnG¢š³'²‹šìXs×,õ >A4|‹Ô[¦;Nâ«Â<øÙ€…Ø|¶Á‘–n`±j¥ú oüËõÎÍCTtu<Ê0 q^1VtŸK´Ã÷‚vÂLŠs¬1ò„a½»â>=Rm9ü‰Ô²/óŸ¾ø¤N¤9Ç8ˆh¼‘¬SžD|WÁ?å ¢ZΧÍXÓáxíXYDžËÖJpóÿ—'è¡ ÑòB*â™kMÂS*hVwÄ{婲Çqu­Ž&'«„ˆ+^i$7ÐJ1á)—cí4#Ra˜ú¾YœO*ÄTþ»Ñ¬®Æ>ã—Ô<>IÚw¸MQ˪‰?+gg!Ÿ3ç5ïXþ?Èÿ¿Áÿ -Aú{°•>Äù=ì`qendstream endobj -3112 0 obj << +3226 0 obj << /Type /Font /Subtype /Type1 -/Encoding 6699 0 R +/Encoding 7213 0 R /FirstChar 36 /LastChar 116 -/Widths 6711 0 R -/BaseFont /WISZIO+CMSL10 -/FontDescriptor 3110 0 R +/Widths 7224 0 R +/BaseFont /TJSEKD+CMSL10 +/FontDescriptor 3224 0 R >> endobj -3110 0 obj << +3224 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /WISZIO+CMSL10 +/FontName /TJSEKD+CMSL10 /ItalicAngle -9 /StemV 79 /XHeight 431 /FontBBox [-62 -250 1123 750] /Flags 4 -/CharSet (/dollar/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/R/S/T/U/V/W/X/Y/e/n/o/s/t) -/FontFile 3111 0 R +/CharSet (/dollar/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/R/S/T/U/V/W/X/Y/e/n/o/s/t) +/FontFile 3225 0 R >> endobj -6711 0 obj -[500 0 0 0 0 0 0 0 278 333 278 500 500 500 500 500 500 500 500 500 500 500 0 0 0 0 0 0 0 750 708 722 764 681 653 785 750 361 0 778 625 917 750 778 681 0 736 556 722 750 750 1028 750 750 0 0 0 0 0 0 0 0 0 0 0 444 0 0 0 0 0 0 0 0 556 500 0 0 0 394 389 ] +7224 0 obj +[500 0 0 0 0 0 0 0 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 0 0 0 0 0 0 750 708 722 764 681 653 785 750 361 0 778 625 917 750 778 681 0 736 556 722 750 750 1028 750 750 0 0 0 0 0 0 0 0 0 0 0 444 0 0 0 0 0 0 0 0 556 500 0 0 0 394 389 ] endobj -2897 0 obj << +2996 0 obj << /Length1 793 /Length2 1151 /Length3 532 -/Length 1729 +/Length 1727 /Filter /FlateDecode >> stream -xÚíRiTSבª¡¬2©¤j=,Œi† !¡€D EÃ(ƒÄÜrKr/^n )ƒˆª²,b£KFQQ*¬*u@©%V¡œH«X>Rµ*Nï‚uu•þ|ï×[ïœ?gû;{ç;›á.g‰a|„c$ bC" “I!. Î\.Á ‰âX ‚DD -=Á*ð<W â{ˆøà©MV“À-€9I±!P¥2©F´T ¥Bä¸EHˆ5°vòFX‹¤!D:³i`TI‚ H2ŠÑ8“š¤˜ -‚·0¬K}—JGˆ4Jp›’É”HÇ4#*' §º!”–ÿ†¬éŃtM˜B;Y~Ê©¿åZTcøƒkSu$B#6¼'C`T§ž•’ - ªcÉ° l8š„ê8%•j RhÒ)ÁàéJ(ÿ¦tpäQa±aî|íT2\bd„!Ü?ÙS1ôgL™D zÇes¹E¤ö»S´fL‰Ã(– x|O  …F ñA&P FôÑSŠ9l '©+€r&¨p‚6ù¯ž\ÀÑ ii“è[€8É“³G¹7‰ýýiþþ¸>“åÁ,ŸjÅ]á|nö_‰‘ºQ‡HŸë%ððâO¡JA 95T”mïbJ9 zDI3ßÄ•Þ[?Ûwz{MŽ¤ªó˜53m¡ñÈÖöóÛN½ÙýÞ׉Ɵ#~·ßfÿzÜ®d$ô¬â÷ÑO‹³L™rζ{“­³b¿|ÖCåp|âŒËem­hî¸g^<˜Úèþð×gwÓÏ[×­¾ *é#3knÝ|õ$'eSGŸÙækØu¨„–Pvfõ^$êŸw‹®N<Æ«psõåùñûŸ9¾6Ó[ït§Ü¶5 - ËdV7Œ>/çp™zU :²ØS*\%Í^èy=ªÜ,>ôq1Æø67…Ê~›=Пßï–æe—„DK#G«pPÖ,ÐøWÓ-‘úÖu-Z_ìbþ`ýš<‡”úNžO1”Ú¸—±6iüã÷%;g>Mxñ¢÷ù›BzËCe¦‹…ó‰Ñî^üÒÝ܇™í\ºõµ/L.± -õW÷H±_H¯ÍÊÂ6íO~ýYÍc2#¼‘ëtóè®fí¾h\»¯ücÙ:÷o›L{â%z aì%ì“þÊGÿºÔRx€—×›t6â–ûåÚ† UŽµù3LMAAUKšfã=þó]|zϵÇFõ.óÅn}Ñõ¹,þÄø¢ã"σÝ/½‡~.‰45Žñ\”c=´eAÊ.öƒˆå™^¿Y­M2tzÕž4ý8oÙ>8"‹µf_ÊñšÐšíZÃc᜽DŽõ «ò¬sOÅM?¨Êˆ"PçºéÙrfcý•ÚǤ]Qø‹Ê$6ëw¶¥#°Áã™é¼³Ÿ®ç{Ç'¿îö=²öPuæîMßZ±hÇzšÈ¦¿g@HO•|^’ófëhO°ÎÆ^ÒÔgÆî3Þù±l9wÈ^çêóÍRßzÝ…Œ­\ÃâÙ«"2¹šX÷Ëþ Ü\©­ubÀNƒ—ýÉnfg“Ìñ{éSgÌÔœZ¸=ˆd~u²ª$Š“3سò”§ ¹z¬R„É—JOk–[̸3sìI‰óà3bóÁk!‚†ò]°ßíŠðu£>w»&t¹ŽWF -:~=ã!SÉÞÄÉ÷&ÍWeôó2šºJØ•ëXn[Ï|šù%ï«Ó…›-æaÒpø;KuûöëŽWC¢lµÐ–h¡ž÷ühLGžÕûÙ«èôXáÒº1ýþºÒÁ¾£;/eD~˜oºëå\*)ymU7ÔnY˜'rhT6Öî¹XYlûI”&€(ÈS¶ÝNܲjXV×pb·Íè:«¸kn~ó¬…;7ÿâôxYº¼âëu¾çyéQç‚ø}~s¾w]\¤&áÄì“CE’êƒÉ÷$=!YÏý~ø~Ï:ptÉ“è³Æ‚üƒêÞ3^åÅÒá+â[­{µ]š¦êÒü=²¹5ëß ¶;Ü~EtÍÎgw{q;cÛ8}ùòuÜ©åNß’Š ÀîÂGÁ-«3`ìH hÖÛèÐæÇÎÍ—úwÝØ5¢Nlè¸^–û+)o O´UíŸEær|Ûf‹…V³ît5öóï’ªc$- ×z¾]³SðÒœÀa&±äÊnþ<ó†§á‡óªèµýÜÿpÑþ_ࢀRƒ(×*ˆÚ¿ß’Ñendstream +xÚíRkPSבª¡Ly©¤jÝ F‰4O !¡€DŒEÃSsNÈ)É9x8¤D|PIUÆ"6:ò¥ÂT¨”ZbZÀi¡ÀX‹T­Š€¯°N§ô罿îܽÿìõ­o¯õío/š[„Œ!‚°õp† “#AR©„Ãä™Í¦ÐhA8,' –°po°B«\/Àæ y^BŸBAXšGRTð¢Oø@¤qD!GTN¨` YC!W¦@`BÏ"µ¬™¸‘ÖÀé0žCL +‡ DA€õp +‚RXš$¨ü70¤M{›Ê€ñtRð˜”I¤HCÕzÁJ +kFvƒI-ÿ YS‹‡hÕêUrÍDùI§þ•—kµþ/¦IÓ0¤ãèTj üFœ†­fjVBÈÕˆB„¦¨aÀà,c²—½Á‘ôDC¡P¥\Oâ0 +MUBú7©ƒ*Š‹õüëk'“r%"õi0`ÿÍžŒ9ǤI8¢ñl&›Í!‰ä~{JœÒLŒ*0AS—ç ä8.×SÈ!"#0p‚B°À:R1‹‰byÎd%†S&þÕ› Xj8=}}p+eböH÷&°?-0Ó^\ÀàòÈVìe>€Ïcgÿ“…"´°$ðØ>|/Þ$ªÐâ8Œ“CEÚö6V"¤Ó0¬ƒË Lá»å“½§¶Uçˆ+;ŽÚÒÓç›oi;·õ¤É—9Ôãët oø1þàÇ­ŽŸ ÇŠ‡Ã¿bAJ^/õ”(Ël±¶v;ší]èåûd3(†’¦]*mmyOs`û]Ë´Ï?¹?½“qζvå=¿‚:\0½úæ—sR7¶÷Z쾄Ü‹)‰¥§WSxeü~(V‰Yª.ÍMØ÷Ôù•…Úr»+õ–½I`,•Ú\7ù½˜Å¦ë”}íÎþÔ…–ØÁ +™pæ|ïkÑe&`õ¾Ÿ›)Ö¿©1\úûÌþNº ßÍôn—$/»8,F52ïh¹“¢zžÚ/´Šj ×µ¬mÖø£òêVç9¥ÖupýŠ8i {hk’Ç^ÒþX´cú“ÄçÏ{ž½6R›( nV®Ç§ÅxúìÈð𢷱©¶W?3»ÅÉU_Ü%Da=vË­šú²šF¥ Vp=×åÆ‘ÏÜ-\Ê=á˜foÙ‡Òµž_7šw'ˆuV‚¸‹èG}»ØlÜÏM + ŠïI>yÓóRMýùÊ`çšüé‰æÆÊE3±îþÀ¹nþÎó}g;ˆ"j§åB—®ð¾êl–o|lÁ1¡÷®¾ƒ?G™†{/ȱÜ5'ÌßÏY²ŠÌb¬Þ›z¬:¼z›FÿH0kÏQAÝCŽMYÖÙ'¢Æx!¨õßøt)½•¶îrÍ#¡0âyE2 8ÓÜ‚âèÀñ1C÷ÌÇëx¾ )¯ºü¯9XeصñÁ£›Ël_GÚõu÷ ¨iâO‹s^oéÕÚ9ŠÛâ-èÝ£¦Ûß÷"‚þÍg:jÝýb¿ZìßL­=ÿËèòÕ ®£2ÒÀVÇyX÷Ó ¦ +M r¸(Oñ°¸š¥ÎßJž¸¢æ¦4㶂vèå‰ÊâhVÎ@÷ò“ÞnÄÊÑ +!*[,9¥^j5íöôÑÇÅ®OñM®†ñëËvB·Ê#ÖŽ”ûÝé×æ:_.hÿù´—T)}/Û“> endobj -2896 0 obj << +2995 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /SVNYNC+CMMI10 +/FontName /XCGAYX+CMMI10 /ItalicAngle -14 /StemV 72 /XHeight 431 /FontBBox [-32 -250 1048 750] /Flags 4 /CharSet (/less/greater) -/FontFile 2897 0 R +/FontFile 2996 0 R >> endobj -6712 0 obj +7225 0 obj [778 0 778 ] endobj -6713 0 obj << +7226 0 obj << /Type /Encoding /Differences [ 0 /minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/arrowright/arrowup/arrowdown/arrowboth/arrownortheast/arrowsoutheast/similarequal/arrowdblleft/arrowdblright/arrowdblup/arrowdbldown/arrowdblboth/arrownorthwest/arrowsouthwest/proportional/prime/infinity/element/owner/triangle/triangleinv/negationslash/mapsto/universal/existential/logicalnot/emptyset/Rfractur/Ifractur/latticetop/perpendicular/aleph/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/union/intersection/unionmulti/logicaland/logicalor/turnstileleft/turnstileright/floorleft/floorright/ceilingleft/ceilingright/braceleft/braceright/angbracketleft/angbracketright/bar/bardbl/arrowbothv/arrowdblbothv/backslash/wreathproduct/radical/coproduct/nabla/integral/unionsq/intersectionsq/subsetsqequal/supersetsqequal/section/dagger/daggerdbl/paragraph/club/diamond/heart/spade/arrowleft 129/.notdef 161/minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus 171/.notdef 173/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/spade 197/.notdef] >> endobj -2894 0 obj << +2993 0 obj << /Length1 842 /Length2 1048 /Length3 532 -/Length 1656 +/Length 1655 /Filter /FlateDecode >> stream -xÚíRkXguí*²Ð5«*ëG1‹€$3Ñ¡R…p1r Ä”ÛZvH&a ™ÁdI-žT*Ð Ô šDxDÄ¥rYŠÆ»\¤e»²‚(¶ŠÅÊ Û]ús÷×>ù3ïyÏw¾3ç}Y"±›·ŒˆCý œtƒÙ°'‹£`ÀlˆÆb Ô(Bb'€=<`à­U˜ ¾'òäñi, ’ôjLO‚ ç9x«P5&EpŒñ¨ŠÒ"J &¤JêÙÀ[©ás'4 Õ êdTƦÁ0aRÄ¡ - §qæ q9ø °L›ôª•Œª5”)°2é (‹2Wê •Ó8!uJ9ù_˜Z,î¯U*CÕœü|J?ë#*L©É TIZUƒ`B†ªñÅÔtÁ\0*ôªÅ]!‰(1©7®P¢À Þ̆6ñ˜ÆÓ¡2FJãQjÐyÅe‹­PñÍáïøùD»¾œë|S„`8¹KŸ„è'ö| ÿTS)©1ˆØSDê}õµ{Ñe~¸”a¸pyîQ«=Ú ªâ½0Àpª¨ŽrÌaãIT4©@N¨isc¥Ö‰GE‹’søq)LHQ%*ÿwxÓKxa¶ÿ©?ãÄ!ÒDÑÄÏÃ?ÃLJÐíuãz7wÊ »>Ÿ—úŸD ŽíÑ¢B_Àƒ h w!©V­Fqr~©¨_ÕrŒŠêP)­·‡¾•™PXŸuÊàwòvÅ2Žå´¹êa¯EKdƒ¡“¥ŠyGäi¤d .·™Ø±f§ô­C õ9ÛœƒïNœ`TÖe/ü(×ÌþJÌÔ]ð›®N#¶=ï}fxóY}ÿðǽŽifúQÙ°Oôɦg}=V+]Â?qyÓŽß[nq÷W«™ú»ºÖ=nH+¼ì%¿ñ· ¡ˆ©ñÏvê¿m7L~CÛ-Oîèp òníHY#{þzèÁæݘýþ7÷±¾ÿB\ª{šmxcï—W“,˜ûGsJž¾jIk¶÷i¿{»-óò'/= É>h­ùþ¦ø;³kHÁïPߦ¥5C ¶×¾‘œ=°û³aªIüì|¾½ïØ{{ʽžI˜9©ìÀú¢¨G¦Æ6«žÆU0c[w¯ oú˜eÈõåÙÜ`mÝdAC|î(‡9øíæë=·L÷ÓUKè¶GÞÛ}ž–Šø¿XžÓ:Ø÷a{T9ø ¾RümMØñ±*˳Öa©×ªÙ4ÉÉ›aA¿7$¯§¯«Uvï þ:ymëéýIVÎ;„=MóþðHís¡®ZdÌáË»bcr¾ˆ»0Óé)ŒÀO/ÿË5Ci×’"É’bC »K~KÏ==ôüæÛëÝê2­÷,–l±HäÌàš#KgÛǬƒþjÑä¿#6ׂgÅÿ{ykVH"à–t]é»Û#tÈÈ?¼qsÑ•1—ŒÖ‰Ù¢Ãþ»îkŸZvvžÊ·9#h¬ÉºgŒj™êUҜݻŽ‹žõ}e¶¶w\±r²aË^f~^ç±ïDí£ƒ½ ?®Ð‹C8 «%LÑô-ŸU¶Ç>ÍðʈٽVßogs­ÞéÆ 6u\{gi\JJã²Ü«-Š׸Š]Èˈ¯®+)e gÖ©œ]cƒ;ÝI3¾¶‡~rçÔÙ°:ÂÌ0+Ã#ÏŸÚßò®`ˆ°yœR†Iþ¸ëÌÙ.Žª)ƒ0¿Þÿ¤î¦i}òÈåŠknxÍê#7Æq®Ñâ¢õzÍNcÅ é½ÎÉÀþ?‘’ÏÆϦjm2Ï9žÞšá¬åEù<”ˆì¦¢·Ò‡Ý?¶›ÔøV%¤þÚÒÖ ¿Îú´z¥Ã3†ïÅÈïÆD­âBÉz{}­‡ÁuØ_šÝ2ÐûQ["T1ð>s¹èûê°c£•:–WÃbï3©Ò7ÒÂþhHZK_S£êÚümÒêVÖ“Ûû­œ·‰º?žâýé¡ Ë÷|m•Ø˜1ÌWtÆDg‡}9z~ºÃKZú׫†’ÎE…ÒEÆ„tÿžžsjðÙ·×¼ÙiZ+|$‘n²H`Ocš"KfÚF­ƒ¾´hn‹É±àYñÿ^Ö’ ¸Å—{ït‹Òó­ßXxyÔ%½e|¦ðpÇ=íËŽàü¢‚Ž“y6§ Õ™wQÍ“=Ê@šs Gç1ñÓÞoÌÖöŽË–OÔoÚÃÌËí8úƒ¸¿¼md 'þçezI;°~%£8‚)žºé»ÂöègéÞéÑ»Vëûìl®Ö9]@'«o/ŽMNnX’s¥¹(þÚOWÐó¹éqUµÅ%#Œ¡ŒšmÓÕS#«l0§Û©ÆWwÓïòOlŸ<VF˜Yý¦³¥hB乓ûšß â6’KÑ éŸwœ>ÓÉV÷-fàæ×û×Þ0­M¾T>íiÍ ¯^yøúÆ5Z\°^«Ùn,?.»Û1Ø÷)ýÂaüÂi²Ææó¬ã©ÍéÎZ^”ï©ØnrçfúÇ'vúa¿Êø”×\=`M¿ñÛÌϪ–;> endobj -2893 0 obj << +2992 0 obj << /Ascent 750 -/CapHeight 683 -/Descent -194 -/FontName /MHCEBZ+CMSY10 -/ItalicAngle -14 -/StemV 85 -/XHeight 431 -/FontBBox [-29 -960 1116 775] -/Flags 4 -/CharSet (/bullet/braceleft/braceright/backslash) -/FontFile 2894 0 R ->> endobj -6714 0 obj -[500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 500 0 0 0 0 0 0 500 ] -endobj -2889 0 obj << -/Length1 2066 -/Length2 14415 -/Length3 532 -/Length 15551 -/Filter /FlateDecode ->> -stream -xÚí·UX̶®‹»k€KpwwwwhÜ݃{p'ÜÝ ¸kp÷à®»ÿ¹ÖšÉ\ûòœ«óà¢ßQ£êûj”5$JªôÂf&@ {Wzff€¨¼ˆ3€™‰I‚BÔhìjå`/fì -ä0ss³$€&  ?v6& -€¨ƒ£—³•…¥+€Z”æŸ$N€°ÐÙÊÔØ oìj ´ajl Pu0µºz1„mm*ÿôp¨]€Îî@3ff€™•©+ÀhaeÀø'i{sç…ÍÜÿ§Éèì2 þ—MȤ™ƒ½­À hŽÀ¨àR‚¼ü¿aë.áfk«`l÷ÏðÿªÔÿÕnlgeëõßvŽn®@g€¼ƒÐÙþ§jÿËœˆƒíÿ%#íjlke*loa 0ýWÈÊEÂÊh¦dåjj 07¶uþ+´7ûß@…û—FQ-Oÿ½¦ÿjT2¶²wUórü÷°ÿdÿ‹™ÿ0¨:ÎVž]&Py™A‰ ßÿù¤ÿ¿ÄÄíM̬ì-,ìcggc/Ðî;À‡`eoô=AŽì\A] ’øÌœþYPf£¹Õ?±ÿB6þŬ¬FPo[c»?!PŠ“›ƒ+ÐÌÄö¿V÷ß-F3[[cç?!N£#ÐÙhÿW÷ðŸ½Ù˜@©ÆÎ@{[ ù_QæÿŽþ¯dmc—†p±ù™u´usùY5u°³3þa0Zz9Zíÿ„8þeÑÊÁìOäÚÅÖØÅòO„ Àè tvøMÂÁøof¹wõøÓÎòíjé ü+ãŸJ;¸ý© ;ë?¥wÿ+d×´ìÿfY û_^AKÌüB°ƒ¬Ú[ým„ëŸ9Û:üÕ‰ûŸaì¬þ3Ê2tr¾GXÿY Ë?×ÍŸ ȃðé‹ü!¶è ‹ý!¨ø¿‰T‰?ª„ÔÉJÿ!žìéÉý!žüé)ü!žâ¿‰ ¤§ô‡@z*¤§ú‡@5WûC uõ?R×øC uÍ?R×ú7qƒŠiâlljtýÝËÍúïøî_nŽÿ>ÿ™’ø³W¹A&4AÓ?ç” 4C³¿ðŸÕü ÿÙk!ȆÅ_š³å_šô_7Èšõ_òdó‚LÙþ… W®fÐ%Çhÿ‚\9ü… WŽá?ûí/¹rþ ÿÙü!È•ë_råö‚\¹ÿ… WäÊó/¹òú A®¼ÿB  Ùÿþÿûfqðô¡gUœžtêAÎØÜl~ÿ™©no:KÒb ‹‰‰t6þ‰šº9ƒn2×½¦ gãØÜ -ôÈž@S„_ ¦¼!ÖiÍaeþâSåдà"-ñ - ½³]ˆÁK à¶Å#²N´ëõZO™˜(ûÐûÄ/.Q¾ÊãçNñéóoûîFû™ÞmZW™ò^{Ž¤÷Á'¨Ís7§ìàŠ3ë£eÉÚ…Ù?Oò”¨ÅÔ`WIÀ¾ëº7~Ï -áàÔ’È´U­§d%QAKw*‹` _ó@KN„Z› ö·‡ký´réÐé†ñT—›ôföh -킱芈¼ü›@0ȯm£‘“ž›ýGØNÎAå·æ²¦ yÆj‚Þ=ÍO/¢žmwzd;íDO;bkÃ|£½ÆAñKüƒóÝo£èkw2Ò®Ìæàº`€E(þÉÃC_B2ëГ8•ã ï*2UÎ&uÊ(íSqãê3;Vw‡CtÚ80[{ƒ‚ë‚#3Î?}m{D›v[-üjÎò#D¾À¾ÕÝ€”[zWÙ­ì²8)x}}’^ÊË£¾fˆ¦†&ï ¾ÜW˜Ríÿ†pj•éÖJÆð-%È®áN”5.4,–5*2Jâ>i^ÌÀse—0¾^Ë·?¶¡Ø¬œŠ6í -IâÁo鱺QoUÐë]l…×…Šr=ÀŸÏ†Ð @Ýþó~å£è€gx#Ñ>ŽA¤÷¾ òç/D“ì#&rÝØØHÈ6R¥tدêþ -ÚÕ´9Ílßò{³ênoDÎ Ó™Nà üº)Í+u¸c诨ah'¿hhp#`ûÊdœr --¹Lž3G‹`J$•iËOY}’ï!Æé?-NìG{í¾‡BCÿЩª©{EÅ|pïäÅVå¤ÓÇ«ÏáÕ2,$±?·°„2}§AY§À:¹l_¤ß/ödo¬ÛèòþºëeDýÙf.ø5ŒûñpŠ\W‚˜{IG9TzFƒææžÚwÉ,¶t¬!h]e\&ÝWBVÑšt…À>nãš[ª<±Klœ(ßg-!ƒ–W'Çúô ÆÀôÓ–`@hû‹7YÛ-g»®¼Ñëþ©@Å«ªÑ²˜¼›ržªçö÷¦…v,A´ç‡¸ÂÎgDe+zØÚîŽ$$ø´FÎí‚pã"Ó| n–PZ¬Oúõ´ëhdì³6gÃóµ›cÊÆ‚ÐƵ­DèèGÚƒ®ªÊÖ4ö¸!C›6‘Ôí¬;QÕókRþe`^#~y_(®- §0?JlÉßb¼`ýªtž‡²M=ŠÁíû|òqŽjØ÷î˜JΞ3î—6 šýXÉ{só/ßØïÝÎóÍŠ~ÌâËßVójÓØ…ǃXí¼ÚüèШã ^UÂ"=É’ÒMeî½Óè7¸Æ“¹Öš¤/5y$6õ4WÄkP2¸ðx:¨‘u„vI -§é­‚Ÿ²SŠý·¿÷º¥ôædÛo^ÙÞÒ×}'Êñµ®ïÞÓÌ(K]ûµI£:.CH»9µimqûÌGȦ¬´Øu„ÞÛïW% ’M¬Ø$‡˜1²>¸úž—Ä´ÔdÝ7šÆ|úœÌiÖò;9ÓV,ü¯|qò:ÕgA‰[fç4·ˆ`4Ôœ&n¯Í[~àÂì’^äiác‘ÖíõêjâÛTG 2}Â";3–i¿”®ó°8èE Õ(3%GF¸Oª|°eÇÔšwË›—z…|ÓYëàrVžDŸmyÔ>Ù'â¡ëp BryT—›þžÏK:Ž÷-·&Ø §Þs°¬µa¨-³!g’tþ]éŽ*1Ô._–ðz|éñQöJüV|© A.ð~9Ì3—!1gz¬ÊÜÇADîBúsCÈ›Jy5þ%¯4&Ø{EøV‘_Î ÍÃN綑â%¹ÿdÈ"XŒ Âòä -SK× [\Áæ.„›Àw÷1…þ[Ú4ÑH Ý0ŒµöZ¹(T¼wÒµæPÓq~ ‹íʦÑfk¨Ž==„éŠ`°¤¹wg~iÛ9DŠ-¿if¨ÖtöUø{GŒ$zÀ$¬ìøÄa/Ù9î6„ýÆ7ðò査z‰¹š-p!E ™Øå?”œÇ9ŽsÙÍekX½¹Ý·ÍêZx6 *£= /ày[æiuî©ê×ú) ŽF^'­;)ÒkÒ?uŽjÓ2ØH†‘½êÓ¼â‘1{tM!º|~‰w&¡lO…3€åD–=Z½|¡Zj¢Ÿ;6BÄ_•ã”•Úÿù{3ÃLDî5ÖeçÝ?¹%²ûF ´®hêÈMØSHE’Ø“nb+²þ(ºË+R[äû’¼iòD^"Íç~ûšåLõu¶¶Ê×Ãs€—2Ìë‚`ë Ù‚1Þ©Qºu$:˜21·/^Q> Dfùƒì°ij;æ êêöùÝŒ-Ľê¡écty5ë™´m¨xûYtxŠÄàkZ°þëáM^ ƒDžµQ­xè¥Ô€;,wü -Fý‰r",™mõÕx¥0ý–~ú;ªž#ôù° ±œzŠ¯Ÿ‰“çh‚=Qj`¢G¼Ó†Ã`—äˮ7ãé9Uà ‹Ou˜$Ë}œOtU•®Þº' -‚¸g&´Ë÷³a{È«é ¿ÔFÿ€êÜìPÞdÐЬ$1?RærÎÃFB?‘\‹4-‰£úÙº_*†½[¹ïdB¬d=§ÌìB) «+6²± -ÌÐ:×s(/¾ijÚ7xª¦˜²¡ ¼ÉH>Ú©©Â%@ÛVq} ©Uì´";HÙñ©^àÛI€DR_2@.Ë 8§—¢’kÏuך&kW¾=µ.žÄUÄC{FéBÚjk5©Iæ¡Ó^Î a¤¹¼ -oûè•)Ü Du+ï°Ëy7ͶEȪÛMÅíð‘\ -q›ð—(j2ežaí]D]xܽ)´8G³•%û˜åmoS:g\Ä.ù~œmZ6?Ï”«Ž³à6“ëKÉ˶G’3ÂÝ’éz’ÚB%‡k¸²„7’tB}àâÚ.ñg=Ò&œž ¥ 8ƒÂòÂ,4Vªð¶n®ùðec.žDò}R´2€¯‹ê ɻǟIF¡'㬦(8~‹cÇgÖ‹o£´Œïå~oKu¡éÈ4ªIzÙè‘òpïó™Ê¨î¶ûd¤F/„ˆ^Ê\/˜NñWåô>¶Mtß%ëi…B -DVº(‡ßêÈ{[\ô:ÿpw®JQ<ÎÕ«BÅšôl“‰álý? `-áÖµâØäòÉËq7Ï–ß!3¥Ìgš²%ì.—¶±)ßÎãs†ÑÜZ§ª›rsOëÎÁ1ÙòÇ[ Ë\³ÞØ8ç×$zSžP«’{°bCñìè2¹+®Ñù2R ès7lj@A°þNô÷,‹d´.&ê@§ù s¤¹"DÒSŸ¸WÇýœ»[´ò˜–Xˆ'V+¨7)~â£ÀÆ-Á9ë)ªŸ{@e‘¾úZ«³øŽ>féÛ–*'] Ï×à£ÉÃÃhÜwÂŒ®zpM7:àÂ#Ú\ðSÅ÷Íí&¯¹G„‡¼i•çÌÚš ïÎß$Gጻ!°uL"uT~<Ôðf¬ðs>*4nnØÆ¡~OÞ‰ W™‚îyJ¢K’Vߔʚ¥ì7ÖdAX¸rß÷ÆAf¸Å3,Å´¨ÀS ;Ç’g¤ûâi3ÉjS—´¶„N^MD”ÿ]ôn°™´ƒ}« üJÖÂZ[3 ¼‡®ÜpYìÖQ“% -/7Á‘ì‚–{Ùì²)†™ª ûáQÁ…êaÕ :5— _-Ž•ÎU¡eU;,?£˜·®€Õº`ÑÞÝ·¤Í¬až…Ù}°54î?ÿ0‡ÛMèEÔë[»²¯ÈÓ¹$vi52Ÿ¢šÚý%¾Œƒ~uAqã‘í×-ý$& “•ÂÑ? I‹˜`æÇ€XÕrÌи=xâf½QDmÙÎ7HÜEó~”ŸzIÛоYA’xøÆùä¹{?ÙümÁ'uäÀW/dÓ"ø%ŸZÒ¨µ’¯‰žðÓ2^Ù÷œ«uÆṬW” k:WÐí2¶=ôê¢äËšÎsréCñýXïWš/k­7à'Tu ç‡9jÊf¦Û2f^E'‚$³°Ý`<ã›Z<ɼiÌXJ)qê´–ß8ìÕXŠ hЧ,Æ)X}ïÕgV;¡˜Â×¹Ž.OÃ9fš/\íaWðõXUeÁ¤ÜRਃ£,G~ìÔyÞ 8òì¬Ýé$¶Oq«•q§ 1¶¸vOIÓÜ+±Š8 (K>.×8‰4™EÆÊžŽß)ÉðôÆ4Çã½çÒGÆç•L é1¸ÿ]@G‡þÖj²v<óýùÇjí4´­Ù^ôõæÁ1'Š{V¥g”4­ûV¥5m[n†„JXÊ·™ ºš¤GÆYZWR´1þZT¯t5À6¼]û_®=©K^%@H8ùîöã²ßr¬@ÙŸÚ"Ãܨ-‹ Û’2C2y3ÃMdu•´P¤µb~×?ßØ‘·‹{J¥Jïv¥ÄgÈÏ#Õ+®õ ŽêÿíILp¨é7+йˆ,L‘›ÎÚVmôKk”>¡'WŠ`9tƒëîëBÜ­üà:ÖÑ*göE˜­¹«9¸*ƒÚîæé:ïél$x’§y ÇkVÏü‚öQUûžö‘…&캨å{Õ9Ôè-øOù¹i˜êÙ—Ä…6ðF‚£ä`a þ÷È÷ܬ¡¼bÅ,ã -ZðÕ )A‹Bcª¯_£W6ä¹Äh›8•>§$ÇHh–}Ù&€‚6 +—¯>Ü|óøä‘SRvå •¼ç…Þ¥ŽðÊ’Àì¯nb˶£{“¡EÕn_þËw:êm‰*ÍÍ.©f$+°wø!4—Ä¡'q½{á4 -×,ïÔnLÛóQ8®µ/-igª0pº| { a®í[‰rUöòÕγj”°úÝ~‹xJí÷›ÔŸa»#oÀ’UqE«¨Z»•j¦=ü9:T¹oL:Áí+ ݘ/{m¦ -Ö´y¼u5lGT:ü$‡àÅ,3== ×p~eëÑ.!ayS“¦ÀW‰º>¯œ½ê2Ž[ùPZ&_’ô ï„M‡¬?xŒ|¹ -5[[ pÝϪÇ?U'Õ‘:u:n¶ÿ Tz4éH…nl@åYÿ*Íì»#Ød÷ù•åý¾NE–Y üÄø‹ËWo3«¹í;8l[±š½›RËk…él¯¸)ÏLhñ€*7C…Øçú)\};  í:UÖNɳ±nPÖ\…ät¡uß‚5SS½ }Øï_>¬èx{†è1Ý÷§º—káç“xË…þÕiû -{֬ьluÒxpÅÐÓÞö»]¨öíW•E6óFr8HŽïnkç-racòC‹uƒcË2 o¼ŠŒ ¦IhydýÝp­H ·ÍxóƒÜâ‹UúÑ_’N^{~ÄÞHÊò¾hú ó(ô!ä#µøRÓß±Ê4ñÀz™aûy«%56¸ÜîŽô%¼f[Ò—,°ñíHO<~»óТ¸(†2r¹³Ò}H0˜(K·úŸ 0zt,K*r8œDdë1c¢“àAvã!÷ΨŽ¥>‰e&+‹+yãBƒ¯guãeU–úŒá‚E&åíb‚µí$aïÆÊ­H'_¨$GgR Ê ³sªˆùÛ47}FsBxBw°;M¹(+üý” /Ì2ÝîY³Ö¨l¸Ö KO"³¬Ç0·¸Ó\{µSëšâ~^V:Ó¿€Ešx“ËZåhSFQmý›ç•×³te¬Ìaõòc:άBô‚Š¯_(ÒÀA¢ó;¾Ô±ÁÁCJSÍ -%ij/£õðÙ‹&O·×–B=- —pmõ‡‚y%fìi¿àÑ›auûžI*0i“aÞ3ÅËÅ}PÛûaÑè¦ý¬^Eã <:}3Ëòå©Éå¡îÉø‹ô””8µõ}wœäN °#§ ÍôËÖª’R 'è•'ù°1 Ÿ9äÔIPr}3,2ˆÅ‚…4'l‘!ª|`5‘IîL/”>´Èos²5¯¡øѯ/?ƒ_esŠýççSæ¢öd!9wzù—ª_ Ð#]EMgK¡IýŠ#«:ADÐò¡ˆ|[RY‚öjssPèKÆ]õ6n)ÊŒâ#t?øiÓê³oköH§Á{ßY±¾ ·{Ö;ä^ÇN,"ßYý‡ðŽòùÌt¯ÔrWÌùÙùy’–*ü¤ANà‡kÁ¯ó•§Öa”ü‰é\?Sm¶Ôœ•”]/äà)•r]âÝU\9§¨tžÖ²Ÿr°û.-9TUäËÞDK¥ÿâ‘{‘&·Ê—Gc!êaKRíçMV Ý^3ê !¨øjÄY°·7ÃrBÎVšA7 Ã°yÃ*•ˆÚj¡vLcÖÝé…è.ŠåË-b ; ÒÃO¥¬ûäɈQ:Ñ1\óÞ¥[ÒJYNoLŽœJ¹“JYLfU-cq5–žƒžo¯ãJÄñz¨úiÕ“(¹ÿ9 -~£§é®°ÖÐx/ ½¤‡Ë}W1QµE6t®4ÌúU¼|<‚»¾Ù!âÇæ±(×¹²0l òyð´ -£KK-®â>C9é]ÍèùBæöøŽo¶ÝÄÇÛ”>"‡âe0ä›o_®²î_NÎȧÌ[•LÞx0ÙÙ”,A³,7_/á½49Ïôs.­¤¬æíOп=‡Áj~t¿BÑ=I"Íë'öF9èa÷V —%ÉYà`Káb¼Š¡þF©ŒSÈ1¢@¯_Âm5³}o£ ÕrŸjßÁ´Caµ»…ØÎ=Ð=ÅÈ­H4‹Õ±LÎÐÛ ¶q𙾻χԆ_j“_Qõmbù €7÷µ¤+ o´>¿Î‡|@ÝÝ¥qù9nÏ©ªç½‰˜˜°$=sÊé°ÒpIòž§/“[˜°çɶ% ò+{¨aõñ`&2e‡è‚Ǹ)æ'mäÄ(øÖsIE´©¹Ü3‹w{ÿK×ÉÂ×Wi5Ú÷[¡O6¦ s=¸¾ðÍñ*i^cŽÞ%QË}µ`_.'Û®d„µoÛ «Šu/j/xr§£ðQÀJ×¼6Êžª[œ{}µ²5ßž QH@ôP+/cózØ ¹C s) ¦¤"˜þ¸ƒüé7Y=á­SA~iáuóAŒ€‡/ÌÀ4æCùc®!ù{Äž‚ûVCíªÍöÒƒ]Ž ‹þ+¹Ov÷tz%v6;¯~ ý·ÒH&Œ“!mQ_6dr%]DLø_²«'@Ûà/Aëßv'EïÀ-2í¾ýè>Ôd¾÷,Q¬þÅþÞÆÕý Š üZʾBÕ)g¼’ÚòëïO*ÉX\Ÿ>YÒãÅ+¡e¥Û H×Ò| «Peˆó¼¶ÙöÛû¦A j œðáú;]±bãÊ=ºƒl†¨K\•ôª(óŠ‹Ä³ŠEž[µÀo}]r°çA¨ìN²dwR{ö>é?hk…¨W«é¸v,Y÷.W—ØÖM›–pE¬Ï9ŒËS§æâšn;{ðhºrDš|t6RhºË÷uO«fôr!!;®®¦UÇ£hs›ÍH–¨¸ŸE§Z -Žšk`píÔÛ u³Zî=j?ª2x ô—¤=¶dDõW<̤èPBæ Ñ9Úy|ãpr 7ÛË*öÞý×ùtJ–á_,¨ôù$b¸óqNÕÇ}Ó XºGU‰Fh¾UoSù¨ƒ«_²¥ä™e°ÊÁÝ„\@“®…ý¬Ó²¾<Ä~ªG™=êlxN¡6V¸xcñPr<æ^a“9ÀFôžóò%CÃz¸‹/ -­e­ž1¯¯›xÑ>væ×›¹(¢’«,8Ln¾ªiŠXz–ð©SÓX‡Ìª®~ (ìFZUû¾B=Nw#<|¸û´[Þa‡LbÜÄü‚’¬!AÑ» -åCÁî>èÜóI ñ—‚ƒ,~½ÐäZiÝ®’}ê|µwïËŽ[f ¥°yλ»‘6£[òÖâDÎïÙÚÑéABàšc†PCöD|úJ@eMEfÑvµd©7FÙï´Ù/¤%ÉÕ’0œÌKOÃûeâd½v@6Fq¦èêŒBò¾Ƴs)‰*‘Éh¸)¡`gsšƒ=¬AÈäyמUìαǖ›ƒÅÍX­Y·d!SIÛuBO–xûì¨`ÊG¥ Wëäø2KSŽ•³’L¨^4¯?F¯ÍpA`:r²=‡(ŽI(X3$Æ¢%‚¤."Ì ÷Í$ö rSb [`Nëg¥×^-†á±QoûIJ¥Ã­VÓõéêù(RTÒ$/±¯WpyNpDàPÞHd㊂uÜ”rÌU¹Ûխ臉¢ñ Õ1Y˜‡bìÏ¿xZÊPü"r„bP¿,ƒ·ç—6ÚûÝ\;œ#ñàÄ-‚” )“XÜ?ýC1 >[qÇóÂáGÂ9*_Œ܇Ÿs`O}@oŒ}v$÷o‘ŒV·ž )ÎþD¾!2XJ *K¨r‡0?!Ξ•¦ MgE4›w#9Y’ …4&˜_°¬Kºøæ)CQ­«Ú³âVžë‹1&±DJÀaô«jQ¡ëB–<„ªêúú¡v=>TéåÜÇ«ãh‰'×Ó3ȉ`›ŽNË!öÏœÜ?Y¢jÅLx[%%Îr•ü2Ù<¯A·€7ª11âÆ1ó„ñ‘;íÆSÔö¹â JšÄl?’|ÄMS!:‡}Sf‹*ͯuöræMµëm¤ÉU#®+«QÑnO *Bù8ÎÑ óÄȃÛcÍýú}Ó¥HP¡JL;P#Lú†º7ÍÈÊ-Í„ó4™Ž9åË­ü P'òb°€°°õü%Æ>ê)ªJ¨PÔ¼dѪìúSÆgèžý®@ënjÛÄuN°Ì¼H¸Ó뉨±Í ÄíÐ2Ò@;ÀP b„OœÌ¢‰©„Q®C4wâù÷¥ñbG®Ù|zäEž R¡ˆêsë{6l\ÖlfÆ™qÁ dq7èƒà+É£¸•[ã;MѧýÚì ì›*ÁõHR榔oÀ¤8k8VÂw]MEg,A%£¤–÷Q»OÕ^MæFî|ižýCçîì,ƒ„ˆ1ùL7²70(1ÙË’®Šûô`(¤åúnŽ†N,ÖW­Ìýw»aâáF¿a¹™Ÿ ®+QWg—N5|S›útkÐb—È)ñ*ªÈö犴2¨v‘/ÉçªèSÄ—J þ2´>qé0ª%Åö¿¡ñˆäý–ïå‡Ä)˵¦ˆïÖ%Vs¶KÖÇR;wG/¢ÿ|¸ \}ï¦y¢tÚSÞ5¢5jÛ/âv›rb­­cû̵îU°•äa¯B çyq -¤«­"Þ¨N*YÃXæxŨA*3¶>q ¬7B+£q"xSùuÂGK¹¥»¡žüüí'k¦ù"T€±¼}WouðN–«|ìì…Ò{˜Ýá‚›Ô:f–Ä’Â3ä9OÞ[’ë%×ÑÂzå•€¨b†Ÿh‘HÉ›p™¨€(ã¥!ò'–<âÁÁu…è}Ðp¾y½ètÏñ˜èzºò¦ïkfù ¨la{zÔròãŽoÏÛñåçÕ±Å{úÌüÁO¨=ÜV} -ðsŧe4I~p†Þù&þ¿Ø¿„Ú#¶h>&kÂroÛÕ¹Þ@­®ßüFƒ©ÖV…î­ÁW€VÛÚº„‘â¢ß6Ÿç§Bù`ݽ¤exÂ._óAÕ2œ*±\¬ºÛ®}ŒJ'A‘W»×vàØbä,úSCBªüfßÆ·^>1Kc¾™x´ŸY£¨F¸Û7¨itöá/iaËûǾÌm¥f¹Éï±rÊfzî„S¨—„*—äÓÚ$™¨“â¾Îó¨%¸éÝØó†BZýÇ7P}3óeÂÞXåÃNCæ[÷)–&žîAŠÜ¹$+B”$œ–ò£»±?^‰Ýb*©k<×âÌÙÞ4K¹#DÜ´õNôî™ìC –~‚$Ú¬¬Œ§Ï³}þÄaA>-Τ»ñ>2Ñw…øL#›€íÝ>ºüÚ°LÞµþæÎŽŒ)¯°,sÒ8+ùc0_‘|JR‚dº1üÁáXºx³¾C¨À5&Ë‚Gi®"ÀqÞ7XÖßP@j$ÂH¯‡søœŒøÑ5u¤Hµ£‘Œp¤ÇH$€éÇ×2.›s¶àÀ¡qmêí7˜å_àvtbçî09çÀ»‡Y…ìM¢ò­g`¯skß6"ƒ AµªÉËÜã)¸|îgYÝÓsÜÕfmï gš¤6iëi]âøÔ‰Êêw¤×Þ S(;u½Þ«3Ç{Ü‹¡´Ãås °Þ -lié ªõ²#ëIðw\ò§N>­¹e -¬V¤ª Ã@ämŽæ¯FàŒÚVºÉ5 mkˆŒ^|/koY Ô0øÜSñËXæg·ÃñAK\Y(’+ª» ¯úºÕ.˜ŸÓî?ä^úÆòÍk««æ‡Ð \™#éÞw16y¦¶å¨ úVÙ/ºˆ"ÅSx-\‹SïE¶žÞ‹q1˜€ýÚ1³#¸—Xlj<™‚ -zE·æ¸õÅà“¨L"ç®5æćéƒP=™K£ý•©Õ(ZÏ!XŒè­p8ÆòxA5õ\RCøä_S¾â -7»ÖQQLçLä©=+(8˜àÐÂR‹Õú„´ÉѶ•‡–¾SIôÆ=Q[&6}¸‡øøY£imGî k$ Ê«ÞyvÞÏç1×Rû Zн|D•§k„«;_žÆcè+Äü‹6÷eéuPmí˜#:ø`9ŠÚþ¨…¹&B.­B)×ï³E(Š¬B]ù®‘²)Î¥.uT¼ÍºP ’€,i„sÇçûñYAËÛ‡g$´/"Ùì*1Ò/…Üψà]ô4[Dè!ž–UtXóÙÍê“ÆÉžuœHlêlNÛ}“1…Þ~笑Œ\ üÊ¿¥ô`Õy뇘Ո¯©ü¬FÓÐ@—ŸMéwÍbá-o”x™‚3‚8kò>[qó ¤ÂZ¼Ì ªKK„F¤%Þ*/i¡û<âC'ðIJ©†ÄX Öc(ó OŒfWÙeN ôâj'õ½ï°¥cl·¬¬ÜygsÕpOÜJf ï”c ?H–3@˜À¹tá샛ÀÕv Ðy=¥!Pž¢èÄðÁÓÁþò¤0-O‹kö^ WŠ”(ÁŠóºùØ{Y&€•´K}P+Hÿž¡â“]GEò…£ã"?üxÁ:SÇUQ+Ýâ·„i¾š2- VF„‡Ç! ¹A 5ŽõÑ›ê§ð<Þ0 -Ù% [+>Âú>[™)©­¯h3˜YkŠÍõâU xÑä5yöi§Æ(©¡Õ#'¹w F>çÞ)Knî'ÉÜö(ÿÅànNJ]FµÇÞ9âh‰»?Æ×RÓ+OxÏù²³\ ô޳Ȇ‡ëSNë³°ì·¡pB*Ày*cB>Àø"¢›úP˜ ¼SžWû³&¿Á•ªöd–Y‡ÜžÓÚpùïÈ<ñ -Ž›(s4oâvxî^V(åî6ê ¿\²aª¡ß–I£Éº$pFµ6Ú -¦¸¾8]É(p3EhElV%²iŒ3ä¤&x[÷0.7î~ÁÐBWæìUÊÀZ˲åÞ.ú2ýÉl™m¹.TkW°(Ë“Äó!kâcJÍO:=DQ¸ìÚƾvŸNÌ·C m¥di#µÒ Å6E„ÏijŽ¥»Œ1¸m]”û°‘whùà“x€ -¢óß"H¢GüŒPÒk‘¥¯ò±.ù'¤59Î…Œ¸©_Še6œ!¬Wô<,£p;ÑÖpŸ›^Ýñ4{ÌN˜ƒl$²Õž‹yn çVQ,F -^‹¥T…ÓJáa0xgTõâ3QïKùžÃ>Þ¨^0´´x´Õ®$Œk^×Pþô…œ-¤ã‘Æ(£³JÑ6(b×™ªè˜D#kA^±‘£OØá¼ã "ŒÏèÏYSÞÔÞ9Ézlò:÷ž)õC½šÙ=ÒïéŠ)¼Dªz‘ºL(ȵoù.—óŒ(¦…CPå’HʬÎ`Rï<ˆ=Å⮇/à"<Þ¦ Å«Ì(›8ÞaSè9›,úxõÿÂ"Zˆ‹ãØ%`[¡ð!¶eúñ…½¶=RÍOÏaavé|x2½…ë‹¡\g̉ìUæ͉‰.w/‘!B~fRjQ”öZû)[áü‘ü†üuq[C0â«I훨güñ8¤ØÌ…f|H©ÂG-,úÆ.º‚Êr -¼4ÈjÉEªÝ -zu;íÓ{í¨‹Ã-m—¨hšñæñž™íïðÂ\©‹jH§3¼ˆèGÞ÷7}VÑ4²¬ ôöEKùíê*ø¶%¨|g³œP×Úæjy|„ßkàœ÷¡Þ»jÞ¯Ä|gýR3åþüøIÛQ_\ZÇÇLÁÈà=£_mª±g#mB¬“iùXÑ8˜=Rûxª²‘ßzÀn¿Ÿ4Åòå N$úÈO\î¿?%0T1¢¸Øù­ÃìUk0Üê •d[D'|+›ʼ´ISRbPä jª ÊËqÌ{l9Ø"L -¦Q‹ngÈxì@2ѯL§¨²âaô&Hdž—5H¢ïë­òéÔfÈ {Ò¢EK!·m [›R¿§õp/3ˆÉ×eÁ³ß3þ@^o!øéõX"lé£qpúVŸ&ag0­YŸ#OÞ©Vß5¢ö5XðÂáše_oîqµH›‘”ŒØiº öq®.ú8– Úšü—Öü^ýîWè)?”5llKê{Ž -/#ª+Ýê®Qóã÷Å!ÆÞÛb÷å2¾¾Á?ZŒÇ^;š4Ï"êºìãfv›®c‘V]Å=ù~"K;ªm©Œ7û*}ä‘Lë•÷sþê}%å_r÷%U\ºXÍ‘ -å+~…ÓZ)Ÿ<{Ý°.åž‚Jû¸J­úYÉw€½]ùh ¦R„P‡†Ö.ðcü•ýg¹@0¤5´t³žén2ÍëDÃï‹ ”«›Žj–×™m³yUé Õ1þ³ï!d*ÝT¡åõ …“^ÄÍúŽ± -¿†ö¿X®±„Cå2š×h _†’ÿêáN2¾…ô.KÆÛ%{R20L{e©hfè—LvÀFI¨é)ó&‡Ëá¿y˜TªDòÒÃIJ€¸#2lÿ‰Wô9îZ)°ü»A³µñ–u^Ñ™’›bÁb‰ˆÇÛ!S\ç™2â{ÖfR!`œ|Ö! ,Õƒ9™4îYR8ãà0uTBeÁëWÆk^*v‘;ü8ìâ]©Ïb"§Ë‹t>ÌfNsˆHI=~㵫²Ãe>»TøRá‘ÄkBTÒF𵜠J±ú.ìLñÒlcÊ‹9œ/X“·~6Ã&bíUibý³uÅÖ$wÚ€S¿½k)J\qw\ÌiËßÁ–h"ï|^Y2Ÿ*¦&æ,ø/E2¼¡ÄÞ)ŒÍØKHÁU¤Ð5äYv´ý~=~P?÷¦oëAPÝÀ°_}ÛXÇQÕLþ>¶kr*C¾Ïìz_ñrAÖÛŒøåäòR²ÿ(Jõ»~‚X+§ðèëíµNÈ<.ÊÇ È£Wª‚2/E%µÕ½Ž××sÉõPŸ-7 +gi<Ôiáäå¯{×eŒLE'¾¨¥ŸO­o ¼Ø·¤Z‰I¹ùf2"å¶Ã't -ö¾£}m)•‰.|]ÊÉûÁ¸~² /¹ˆE&z醌 ¿Þˆ”Z\¿Î˜ÿfϲ݇±ða‡k©˜ 5z;Ò²üPtXFH7w×ÕUj½ÚeƒXµ¶A„ûI¢8y§š#-ö¸'·Qª%‘54T-öÙèÚ”›T‘‡×tæ§8É´OYE¹eèo:ànÒÑpj&pv?eäâ8§Q­äž!RI„*=myO -[f>ÕÌ®éd 9­…újUYº‘ÅJüîGm hÿarbw[¯ÃõâÝ…¯)Ç›aÏõ¹9Gr]ÖgV£[:¦Ñó“ï®T>:“oWg/߆GPε52¯.F0™¤JÊ[p˜™ˆÞÜoi±éå¡ou™°"Ø/hòªèË~f´s-ñLç_v˜±ÒbP›Ð 3>Ü:ŽÜ~ôÒrƒæ‰`)Ì’sf Ýî €™²ŒâKƒhPÕÿt„~ÕqnwBxÖ•7ê¾]UMÖ–øöÓ`˜‡r†åz2cÍÞ;Àf­Ø33ƒ´Ì#yï›Å½ñFâj®]EÒxõ|µkBP‡‡4ŠôÛ•sa"6ÉíJ1ÞRõGÙ™UõÆ!…d·N—cT¸ÉÇ°ž@ÀI@˜‹wéÆí•ÕPˆúY\0ÄÌ’7çq‚ÄO’8Ÿ¾…ÒËŸM¶AzóH_½ïñQd¿Ø“p]F†€?Ö4WvªÑ” Û®:r„ÔëÝÅ;eÃ1ô CÚ°v·0•³”f¹/âÌÄi!.—·¶°ÿpæ5xØ÷~D㥹æ&ë4‰-Ôô[›l(¹PF¾ÉvPcÏÔ%0öš¹í¢Ç¤H ±0LÒƒ¼¶Ù–Mb®Ú6fLèf@P©Ø¢ŽÍÈŠN ¤Wø–¯"'vŠY;@9VÅ÷õ8TzÞœYg®sÝÁÀ§¢’gßæÍcŸB¬6—“ì)Õkïî<.ƒq…ŠÄbþÅ0õÁh%*¿NdU-ŸÐÊ꧷Ðô³»iåì[áÒÍû ½9YÍ`´¾é.Å|½“QƒmÙ&åE)¦b)l0Ò°#£çïoÏÏãvº"K™:’N«Ø(Oç”æÞ}ØhÑÌ®‚×Ì(Aîì6Ú«êëåä0Q°W×#ÊGH•?‡úu -€„¡r®ó(KYø'ŽÌYŽ²R,î¿€}Þ{ü²þ²ØäÙ|©98>ÿMz¡1‰±úä;½»\ã†+NžZvÈõF÷Ä/Ž¼qôˆõön§_Ö+ÅáF…nµ®òq]õ‘HòhÔTp\³¼¯±Jü ·BL -ᯣ\ßlC¯ÏÎBè]2U¿„ÒOŠ r}&ÅÃrâý"üÍòpPË%RÞùŒFO:A šš¤öîŠ:)ThZÐH&½Õ»¿õ—±Í©å‰Ï  ÌELÒâ´ÌË{Obð¢âwt*úÐðÚ©lzD»(4R‚ß–~eAtH]ÖlƒŒ–ÝÏJ­¾¯ GQ~–KµÊÚŠ›ÔrGŸÇ´Ô¦_…Àpû6ÌÙÀe9µ.u´ý8ß÷–Ü«åÀ¿ï\XÖën…/Š]ÑHb÷r“ZcT;C-ŠÌ(² +GLÖ'šª©f_j½dî49¥„íþþ¹Îÿ3Žˆ]°Ò â·žøöy[?.s—<Õ8c¾»æa¬ŒH¥|ó ™h[ú\1¯L³H¥d‚ÀL ƒÆ,Í7ÂêîÛý—Ã{pTüÙº…'§á°9€÷ú=œ-Ö¬HbøÕf隈ÝÂF¸ô†B<3‡­«ï…fEšA?+ÊÌ&€U÷œ5O‰Áâ®YûT“’Ϫ>}gaQ UÔ|ð5œRGFäpæÖ,i;€ñÎÌ>¬ó!åKXUž§[îJKDÒDôŒ`i·ÇÞ £1öÐûSMá1£¯qÙ)¯Àšèý^Ö&ê^úæž @Ÿs=ùÑîé·í·ƒý¡%ÉéÊÜ8MàÁdAeœ»OÇ”ÕfU«¶@ÜÀ™Û¯ìIÀ®ðllï¯Ô++äBŽXIýàËü‘þå#¾—{Ûû›œQ6uó»2¯•?†’’{Ùã“iwÐm,´(ãÖTàà>9ÂOÁ׉N—l8ØT†óݺn¦_*ÛôW8Â\¨ -·l mB± ø§‘ÕOÂFµ ià°“`ä8ÊV™WŽòá÷ôjN%M‡ÅciS~Û¬íÒ-ëøÓÔ¬^7¶v¦èß?å`t ŠYŒÎ6ñìJ®˜6<‡¿VúOÑuçpëÊÒ´rJ}âSË­¨‚ªº»Rª~1„Â"öø® (E«Ö™Ë‹EñÀ:Ô[”c¢öóðâÎ~˧‚dªè–×ó6>øŠ;>YUÎ'Á=u0€‹T¦¡)‡BŒ‹£#Ò嵨#A@{q“[ã73Êú»B²Õ͑ἦ\š…Ý’ãÛÀÀ뤟Jûö.z^à‡@É -&¯ésòPð}—y¦"½P½ƒem„ˆìsó6ùpØÌk­fÉ]–h4—п¥„l7.³žXÐ4Ø gVpôAËÈ›f©b¶ÏØüxÈ ~YL¤£ZYþ^Â醎w8㳒ߺ«½ý)íC®‚ÎŒòE&·É^DþI,tõ-‹ŠSDZ³² uÅL$…D -fåoŽ=c©Pô\ôIõˆÙUsÊð#å ':aÐS¡‘mU˜=&«å0ÑSkQè72¡¥ím>K†zëïž­¦NâÙŠšèø·§××N Ké`Y­+Ðc•ùîg9ˆ‹Ãbã[ssµî&žUŸÏ~1X!k(g|oÇŽ¡P¼“ÎYÆ+ „œ~®¦ÜvGŠ±½é"í⧡‹›ý¾mé6ìñ:LœaÂuž ä5j»˜ÂúNÞM`üz¶ãÈVÝà\ -]Ç]5`‡.AcP[§\G®>\vT-ø³é‹QºwCg‘ÐØô¢+öÁb8x^Öï¹³kæc½[Iä0ªkç}Æ7Ùs"¡×†ÙáX)™í¹™ ƒ^y¯qõ—#-PÆK &Š$ÅqñÐoÙ¢QdSN¿±¨}1¢g*ŸCFúVqFuªÊ71×-4R9Bá6£#ÛJf\ð|i¯¿u¿g?¢JÉgÎg£ßf®@ÿËBpš -’¯$µ…¤ìYœ¿“ý[¥üúNÐP Ìyã5üñÅ"åK3dõ”?,j1DRÙ ˜ jSÏAÚLjAj¯dUÙ–MIÔ¯®ÛZšºgn[(@8DQvTÒ*£,e(ííÁåëƒO¬á`ñ)GKA™T9pAåw& Pmsœ§á×^À׃ãqË|¡ÍJïÕ Yý­2:(‹‰Ô§÷ wÚ·Hï1×ââg´9ЫH¡¯Þ~Å$¡rQŠŒ˜ž+ë=õõÈ:žžßžYÒ¢~Ÿkí{é-'œçgLqÞ³À¸ [”:ÝÕ¢™ž~¾Ò%õ"a(¸µs$u÷D¹Ú2 ]Úæì‡g£©ÏcR?ÁPrdo™7GiÔ”|ˆzU3­Ú­'½×ép‘÷È$óÏ3Íß~V¤w@n2•ª×O?ì×NØT¥99CÇ|o¹½¬/ÎÙ¤­Ä/#Ë%5¬Cš?>8!ðïh/}÷}Ø|«‹$x§9ˆù¦Ø3:ÂΪÕ8¢xòˆdõôQ´•XÉ %2@UÑžŠŒ6s.,ôlíË‹7¢ñxý¶3~iÄ,šÀÁ¶þgIî¡Óizh(B8"Ä'ñRBª˜Û=Vî[IÂïÕ®F3"©`wµ.î½o* Ç‘™ʈÞJÇUðºvD–®lÆÀ]8v%k’$!ì dçL&œ­<ZK¸Òå0v’Ìó l# -îÝ0¨K¬.KlH•;‰\F±Äi»’ÛÌòxÏ1†XïRw44Spá*O~Ä*ªÉLoçïò»ÄsáÑuÜêI½Is»)ñܦußì×TðË^dÝ׳ãˆ6§êQ]úElYŠàŠšQ"3`îoõŠޟ =…Êø¹g&ìe·bØ8L–¿Ý­¹µ&g(Ÿ/ûGn 'aÙ£žM«V[EñhÆ7Êž¢+zZ=<,E>²¿ã([9c®h&o…|W¹ T¨¾WS4²Ô$»®²ùÎä·¥|ï™þþ üÿübS[ ±³«ƒ±³ Âÿ‰=æIendstream -endobj -2890 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 6699 0 R -/FirstChar 12 -/LastChar 124 -/Widths 6715 0 R -/BaseFont /BCXZJZ+CMBX10 -/FontDescriptor 2888 0 R ->> endobj -2888 0 obj << -/Ascent 694 -/CapHeight 686 -/Descent -194 -/FontName /BCXZJZ+CMBX10 -/ItalicAngle 0 -/StemV 114 -/XHeight 444 -/FontBBox [-301 -250 1164 946] +/CapHeight 683 +/Descent -194 +/FontName /SRSJCT+CMSY10 +/ItalicAngle -14 +/StemV 85 +/XHeight 431 +/FontBBox [-29 -960 1116 775] /Flags 4 -/CharSet (/fi/ffi/exclam/quotedblright/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/H/I/K/L/M/N/O/P/R/S/T/U/V/W/X/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash) -/FontFile 2889 0 R +/CharSet (/bullet/braceleft/braceright/backslash) +/FontFile 2993 0 R >> endobj -6715 0 obj -[639 0 958 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 350 603 0 575 958 0 319 447 447 575 894 319 383 319 575 575 575 575 575 575 575 575 575 575 575 319 319 0 894 0 543 0 869 818 831 882 756 724 0 900 436 0 901 692 1092 900 864 786 0 862 639 800 885 869 1189 869 0 0 319 0 319 0 0 319 559 639 511 639 527 351 575 639 319 351 607 319 958 639 575 639 607 474 454 447 639 607 831 607 607 511 0 1150 ] +7227 0 obj +[500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 500 0 0 0 0 0 0 500 ] endobj -6716 0 obj << +7228 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/dieresis/visiblespace 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/dieresis 197/.notdef] >> endobj -2879 0 obj << +2975 0 obj << /Length1 2332 /Length2 15237 /Length3 532 @@ -32048,7 +34920,7 @@ endobj /Filter /FlateDecode >> stream -xÚí·S|o·°ÛhϤ±m46Û3¶m7llÛÆnÒضÝè›ÿw­õ¶ïú÷>Ú¿ä`^ãÏý\ãæ 9‰¢2½‰PÜÎÖ™ž™™ "§¢ÂÌ`f`bF 'q:[ØÙŠ:yÌÜÜ,!{G €™‰‡ô‡@±³÷p´03wP‰Pÿ“Ä ²:ZÚä Í6 >Œ ­ÊvÆ@g€µ5@éŸ'œJ@' £+Є™`baì 0šYØ"0þã$ekjàü¯°‰‹ýÿ4¹@RªiR@’&v¶Ö )£¼èm@ËÿZÿ»sqkkyC›ºÿ×Hý_í†6Öÿagcïâ tÈÙ™mÿwª:ð¿ää€&.6ÿ»UÊÙÐÚÂXÈÖÌ`ú¯…“¸…;ÐDÑÂÙØàìèüWhkò¿@#÷/FEM 5ÚÿžÔ5*ZØ:«xØÿ»×²ÿÅÌ4<Žîm&Ðø2ƒA¿ÿóI÷½LÌÖØÎÄÂÖ ÀÂÎ0tt4ô@-±¼˜¶&@wÐ$ÌÈ`kç z€©#Â?3ÊÊ +xÚí·S|o·°ÛhϤ±m46Û3¶m7llÛÆnÒضÝè›ÿw­õ¶ïú÷>Ú¿ä`^ãÏý\ãæ 9‰¢2½‰PÜÎÖ™ž™™ "§¢ÂÌ`f`bF 'q:[ØÙŠ:yÌÜÜ,!{G €™‰‡ô‡@±³÷p´03wP‰Pÿ“Ä ²:ZÚä Í6 >Œ ­ÊvÆ@g€µ5@éŸ'œJ@' £+Є™`baì 0šYØ"0þã$ekjàü¯°‰‹ýÿ4¹@RªiR@’&v¶Ö )£¼èm@ËÿZÿ»sqkkyC›ºÿ×Hý_í†6Öÿagcïâ tÈÙ™mÿwª:ð¿ää€&.6ÿ»UÊÙÐÚÂXÈÖÌ`ú¯…“¸…;ÐDÑÂÙØàìèüWhkò¿@#÷/FIQeqÚÿžÔ5*ZØ:«xØÿ»×²ÿÅÌ4<Žîm&Ðø2ƒA¿ÿóI÷½LÌÖØÎÄÂÖ ÀÂÎ0tt4ô@-±¼˜¶&@wÐ$ÌÈ`kç z€©#Â?3ÊÊ `5[Úüÿ¯€ÑÁÅÎhbdý'È`´u±1úgæÍlÿ„9Œ&vÖÖ†ŽBœF{ £1ÐÖùOŒ ÀhhŠ:‚FëßQîÿ~Ñ­’ÿ ³1:0tÚZMÿŠ2ÿwô%³€zvú§ '«?APQöÖ.N ’Œíll ÿD@õ˜{Ø›ÿÔÂÆñ/q »?†l Zœ¬ ÌÿD@•xíþ@EØÙÿÍì {g·?íì ogsGà_ eS;—?#ÆÒ5µpý+¤ëšÿ3HÖ èú—+h®ÿ1ì U[‹¿E¸þ©ÙÚ¸ÿéÆÆâ?£ ak ÓŸÁâ\ ÿL>ÈØ쟓øGšƒõŸÉ:ýs:ý ‚Ä ÿ8q€¼…þÈYø|EþHVôDÅþMœ Añ?²“øC 3É?r’úC é?r‘ùC Ù?r‘ûC ù?rQø7q\ÿÈå˹(ý!‹ò¹¨ü!‹ê¹¨ý!‹ú¹hü!‹æ¿‰ä¢õ‡@.FŽ†ÆV@çÿØ7 ƒÑþÏeÌÍúïìÿÜOÜÿÌ “±……±…£±ËŸC¤ì:LŒíÿ,2nŽÿÞÂÿùNP ¶7¨£?ªÁøßÄÌ*Âä/ügíý…ÿl•¿dmö‚\ÍÿB¢Å_R³ü ANV!HÊú/Yý)–tX3Úþ… +»¿deÿþ³þB•ã_øÏÞý AVÎ!ÈÊå/Y¹þ… +·?Ȳrÿ AV!ÈÊó/üïþÏ™afaûg9üåÇÂþßyÿ¹˜A_1þk!8[X›ü×”üß·œ°°»=€žt?p²2ƒö“Ϧ©ÚZ€Ž )QÐÁÈÄÄÅÊò¯¨±‹#è$wþ×÷ Ðýù?ljºl@w 1ÂÒ¼1o°eJSh™¯XÁt94 ¸°Ysœ|}Ïl'bÐb<¸uñ¨ŒÍúwßé˜(ûÐûÄn/øN‘Þ_&Ä/âRçÞö] öÓ=[ñ5®Óå<öìI‚NPÛ›~Ýž²ƒ+̬•%jd]žä)R‰ªÀ®’€õj»6ôfspjˆ§[«†…|§`%QBKu( g [sCKüµ6äk×B»re×á‚ñ».7áMìÉæk ‹pöbó”%X:=.ךŽ¨ÙÓZ”.¬¾¸›‘Ü(£º7­úë¯6Û¥ö‡åîé-嶺^°_/ÛðF4¸C²T°ÓÜNêg°âÈJP'ï…‡â㙘ÿP9ò .®3qÑ›]T·9Â8¥˜L7\ʨL\fP‘©cR˜Ò™ŒžÇV¨«¶^èeöï×ë;ßa-7¥°z€Åº¼œ:ÆÁ4«$žr¾=m‰ @@ -32105,35 +34977,35 @@ T4 Ex"Qýu¢á2s4Ý¥«ÔÇÄ£‘öÜÁ¥UM#v„ í¬Þ‹g¤ŒX5 ƒy·×ï”qÓÔ s^zs½3Q¶9Ã$˜Ò¤˜l[ 5†±‹VÕíÌãTïÎDîºeIæ•qðøkÇjó;Íú"°;e½]ÖßT¬ï>ž[ýæd×¾)Qê³Wx•lõÆGo"/0ó™–ùÐX×xoZnv2¡Áí^õø¾¾â(D:öŠ©R”ÙÇ~á›êgÌlÂFpþn1èá`ÓËÙæ¹'M‚ XøMÂc‡xH/õðÉ5Nˆg6àn¦ Ýlš²?Xõ6ÆÁglkúŒ“ßhË¿aË*Þ@¯Ý5&…Œ®t%•¦§oõUFï0©s8ãŠ;ц¯A߬˜6°«OùÀ¼n%ã0쾂?ÿY‡ðÃ"Ñ·{õY”P¥k›„º!\«foäξÕÖC'aGl_™YZõß3¤îˆ©ËžãÛj·Ê‡%\¾úÍx]c“ðû³:Þ«sŠ§°¥AôæÌ-WÖvê;N<ü‘PjM²æ–ìo3]#eyK©ÎºóvK*åý1㨻æãÒç§6¶@H÷=5ܸ ΰŒ/>EsŠËÝ$6”‰ø+TvI7+âN]E˜ÃÕ±åî•÷™B)ÏIyº'¡{Ø*8#s]0ˆ<ŸÂFÈ« Í­ÌãCœ^1·=à?š{ýZæÃ(Û¼³Ìï`Miµ?„äÚcE5à -d,*¦ÒY¿tÊîªkÅm;7ݪ”|ä=ýõ›®àjî<&—¾ðÛ—x\¼$Áý(Lîz3¬¿-ëj¼Áv8{„BˆZkfä‘XÓLõFjr¦çèkàJ\zhË´«øWéïÒ©çÂ× Dž&pAOóIJCGRfÈ•Ÿ_:MîË·7Ú½ˆ,®¥­¢Cáðiá)‘ÕðÇ¿æë~!ú±ò \}?Â^6ƒoÃÎÓ„ýW토ÀÕý3^Jõkrg­›ÏÀB²<¯âíäý…ÈÍ×£K<ó&Ô¶þ®Íl\or•~ÌZȳèHxí³1j¼qÔú겶,‹W~T]4ý¤Íc°^IþFÎÎéb!«§LŒ4wéBŽ/ÊaÏó”ùM{:Vp¶aõÔ$ÎBW(Rkh ‹ Õso²Z=9†^ç Jè³o‹*KBÒ«–¹J©Ækq¯’ôWƒl‹<xu±äž\éG«NØäDfɵ·Øi?ß-{öñ»gŠW›·í“¼*]‚»ËŠ· ž©Q¿ ¤Íœˆ qÎôË5«6X BÊ`¸R5¨¤ç_E/TOõŸ{ñœòOç\?lŠu\¹½ŸZ²´tJœ=‘íýÞTø}§ L]¾¡(©c¤€è„['1ú=­øÅwb%U·r¯N0¶ô€*y´e–ÊB(ò-íû¹ýÝÔ>—P¢Šmrø>3%Ìèë-#µC1?KõAKJö“ÅéTÓB5³,ß½¤æòrZŠÏ£€—se¥ÒŒ¶ín~†uÕûë¤hÏT€- QíKtÖPár€ ï$N¬µZ7©ãJÂÝéÇ#BË6ÝÅð­£çŠ/”vîaº=û'š¯ßJ–mÔ[tyÇ$\ÑÖ»9í.—kÀ }‘ÆÁ”FøØÏ*3f¬‘u\ìT\'ð4°Íî´ì ØižIm†àü²´ÉåÅ„(– 0†Nçá,"Ø“Fïy¿Ö÷®¦ÿðxm~Ê!׉ìK/g¡ƒƒÀþ–œþaµÍBs •­ò3œègd[¶_Ä«áfûeLÿþÿþ?ѱ5ÐÐÑÙÎÆÐÑ -áÿÎÑ^endstream +áÿÎÑ4endstream endobj -2880 0 obj << +2976 0 obj << /Type /Font /Subtype /Type1 -/Encoding 6716 0 R +/Encoding 7228 0 R /FirstChar 33 /LastChar 126 -/Widths 6717 0 R -/BaseFont /CTPYGV+CMTT10 -/FontDescriptor 2878 0 R +/Widths 7229 0 R +/BaseFont /HDSCFK+CMTT10 +/FontDescriptor 2974 0 R >> endobj -2878 0 obj << +2974 0 obj << /Ascent 611 /CapHeight 611 /Descent -222 -/FontName /CTPYGV+CMTT10 +/FontName /HDSCFK+CMTT10 /ItalicAngle 0 /StemV 69 /XHeight 431 /FontBBox [-4 -235 731 800] /Flags 4 /CharSet (/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde) -/FontFile 2879 0 R +/FontFile 2975 0 R >> endobj -6717 0 obj +7229 0 obj [525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 ] endobj -2875 0 obj << +2971 0 obj << /Length1 2307 /Length2 17225 /Length3 532 @@ -32141,7 +35013,7 @@ endobj /Filter /FlateDecode >> stream -xÚ¬·eT]M¶p»k‚»»»»»;ÜÝ%¸w îî înÁÝ]¿ótßÛIß÷ï7`0Î\U»ö¬Uk¯} 'VR¥6s0H8Ø»Ò330ó‰Ê«031301‰À‘“‹:Œ]­ìÅŒ]ïû|õJ.?M·ÙÝLýµ í#˜Ñ¢†é&eðLÙ‰N¹ÛŠ9Iž··¯ š+üøŽûL£m…7bU]j)MLÅ7q6?a¼H8¯{«é|A³ÀCšä¾÷ì$§<\†²1Xa/©m¼Ý×)”ƒ„ÝZ×_QÏBKÓûóîô­Lë¿eàaðÛ¯;2ÎA*0>G)îαñªæÆ€]‡ #áƒþ\'þ½«Òpž±|-÷è;^V`5¿ l¢Di}–Þ}ž'|7ºéE0H7}Fðp'±€ùnM)ý6?0Kï‰I¥œ¾JÉiN{ïËÀáµÉr¿u¸%-fЄôD¾³’å;ÅãÖ³m‚È”J&Mi5ž]å,Õ°5j­6¸Ì\è8I°ÐîŸjé»B‚iˆÇ© µ"¶Ì~éˆ=†7]P>ó—>¤î‚sõH§!m°¨Dûä»ÆèM² sSa»»Mh©™žl\¨“yÓï´›F‚÷Ý>k¢ñÆã¦Fö€O+?ù€Þ+ˆ¢ÔÙë ³ÙKQ ]æ-]#XÝß n÷²j|5ø#Ÿ<‚d¸“°ÉîFBF1d#~žÓ;µžpÓÂïñ§mXüˆ> Ú…£¼¡„976d¨ÏÝðÏ{"©zè¿Ù§éÝž,¢ùÄqåñŽšHeÊÐú^GõA”fŸ•âOòRᵨyù % ´iÄ;gˆBŸBZyúï“ÆHï³·×ßÝ`#%ü¸lZ¢Vœ^§LŒ¯i¾@¹7ZV`ýÃퟙݕ«¹çÖ¸pœ¹Ú‚Þ‡¹. 3èúμ-Ÿú˜Ó9öĽ)“ÿ zN‡R7íªµáþ>–¥áÚ_i^†HQùóóq’Qº,çÝÀ¤iµ ržeϾ¹¨1…Y.¹'æè·]êá§Iv¨œŠdâP5/ûD…¡D÷5Þä_1Q¶• ݶr¹­£ß20‘"®@šûvñ¡¿Ïu½Ó}SĤ”ïZNŒ‹Å½©g~$1 o•ªÌÕœ–SY¶€Â‚6 Ô»e²Æ€&ˆÐkAÔ©6“OúPŽKàD ™˜øéKoj¹ÓA†õøØKù ëR-+[~±[Ù—Õ]`Ê£™Fƒßê>ã<ãÝk­¾e•Ç‘ ®2ùÓ\'ú¬Þ©•qÿn”Pxtÿ¸áÕÑCüì"À°#×{ù¯w_Ö"3{Ÿk'&I£v¦ëA„%”uÑöùZ[oÁ.Û®MôÓw(õù·ž6ÙŽË¢ÀäP-Ïrx‹rX¡pL%żTmä·©Axz$9£«ò<Ñš‰©E]†Ð5ò9ñ;¯çöŸä» |TÒÜ…³æ^p.ä3>Ê»ßÒƒówCª„¶.¦MÉI]¸í¶ñQêRK+õÍþã+uõ‘u'„b-8ý 7b!]w©º ôô “ˆ`–ðLß­Jœ¥“—ôºcÉ6?@¯BËÅ”x²úcˆ!¬§gY8ž?“Úˆ å.0’f»(%£ #.(8š¦Š[¶©°Y‡cç†M:Ú ? ƒG4®SuôZÛÔª!?@ùk}ï¸w0̲£>Nü‰]| ³Ø3”¾r•x÷µòïæöªg/Ble§O˜k\g,U†iúõQŠÙXÎBb‹GH!AÈä­}©‰zÐ|טd©]æµô”NÕÕ¬ÝÄq·zÍ¢W ->X`ÐÇ N„[5|ÙÃ1^Ë¿|ÒÇ â¾½×—PפV;_k,ö wÈ“OOy˜ä•U´+â#S½€Û²ô'½Ú»Ô:¿ý\Ãv§@u¾FúSË26uø`ü}ÎÛD$*Ã{6ý•ƒrÂO¯dðÇe“½•ƒRו´‡µlòàEUmäó¢2égüu5]¢´L¦Ê1ÇÅ»:/’b­÷J”¤$z›¬=kY>L¨ôi»ž6èŸ[‘³Gzm}ýö¾È½Vwÿg²IÈÛ$ÍMb¸øHYTd+^½D¤XúúÒQ¨†_–óù”–ÙWuÀÄöâvý4&"BÒ¨o ®\2ø²ëé!a ³¸_f}Ð8èc«‚Š«µ,-ÂXØ&†Ä—&¦ë´"àâC£”Á¿UqÔãÆúV±ê{˜Òø1'…!rUÈw3І`6X] ™È2çÒÉ-íÒù—ÿÿ‰À7ˆàìø2…Ÿendstream +>X`ÐÇ N„[5|ÙÃ1^Ë¿|ÒÇ â¾½×—PפV;_k,ö wÈ“OOy˜ä•U´+â#S½€Û²ô'½Ú»Ô:¿ý\Ãv§@u¾FúSË26uø`ü}ÎÛD$*Ã{6ý•ƒrÂO¯dðÇe“½•ƒRו´‡µlòàEUmäó¢2égüu5]¢´L¦Ê1ÇÅ»:/’b­÷J”¤$z›¬=kY>L¨ôi»ž6èŸ[‘³Gzm}ýö¾È½Vwÿg²IÈÛ$ÍMb¸øHYTd+^½D¤XúúÒQ¨†_–óù”–ÙWuÀÄöâvý4&"BÒ¨o ®\2ø²ëé!a ³¸_f}Ð8èc«‚Š«µ,-ÂXØ&†Ä—&¦ë´"àâC£”Á¿UqÔãÆúV±ê{˜Òø1'…!rUÈw3І`6X] ™È2çÒÉ-íÒù—ÿÿ‰À7ˆàìødl…£endstream endobj -2876 0 obj << +2972 0 obj << /Type /Font /Subtype /Type1 -/Encoding 6699 0 R +/Encoding 7213 0 R /FirstChar 11 /LastChar 126 -/Widths 6718 0 R -/BaseFont /AQQDUI+CMR10 -/FontDescriptor 2874 0 R +/Widths 7230 0 R +/BaseFont /UWJHFE+CMR10 +/FontDescriptor 2970 0 R >> endobj -2874 0 obj << +2970 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /AQQDUI+CMR10 +/FontName /UWJHFE+CMR10 /ItalicAngle 0 /StemV 69 /XHeight 431 /FontBBox [-251 -250 1009 969] /Flags 4 /CharSet (/ff/fi/fl/ffi/cedilla/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/circumflex/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/tilde) -/FontFile 2875 0 R +/FontFile 2971 0 R >> endobj -6718 0 obj +7230 0 obj [583 556 556 833 0 0 0 0 0 0 0 0 0 444 0 0 0 0 0 0 0 0 278 500 833 500 833 778 278 389 389 500 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 778 750 708 722 764 681 653 785 750 361 514 778 625 917 750 778 681 778 736 556 722 750 750 1028 750 750 611 278 0 278 500 0 278 500 556 444 556 444 306 500 556 278 306 528 278 833 556 500 556 528 392 394 389 556 528 722 528 528 444 500 1000 0 500 ] endobj -2867 0 obj << -/Length1 899 -/Length2 2415 +2963 0 obj << +/Length1 900 +/Length2 2720 /Length3 532 -/Length 3046 +/Length 3359 /Filter /FlateDecode >> stream -xÚíSWXSk¥\¢R¤‰(ô‚Ô QB¤IQŠ”˜ HB¤PTzSŠ”¨ ÑPDé ÁA©"©”"MEºˆuîõŽ÷qæi¾9ç嬵×^ÿúöþ¼œƒ -K<š 58®[ÛÃ58‘—7&h -ŽH0AS@=®« PÁ>€ €kë!tô`ZyÀ˜JÂùøREc¥o"$€ -I8 šX£)¾`ǃÆD ¤„BØë ö $QA,‡X†œ}pˆú·@o"€üAcƒÿ(QA™ -Pä„T8±D>À‚Þu"ç,“ä¿êWs³`<ÞðÍþÛþVFàð¡ÿƒ) °&bAáWé1ðG6k‹ øµjAAãqÁ°Žl† ±v8 -ÆðFãÉàw$` Á™Û÷ê.(ËcÖ*?öù½f‡Æ(Ž¡º~ÇðŸ˜3.pƒAa08GÈyÿørÿå,S†ˆÅ8BK@“HèPçfpp,€!œÀêP‘Âi83‰¼‰$È·ujêêa ‰øýAèêDø'Ö‚ꔓ?ëZpö%?HM@ÝòO‡qñ?!\ P'ÿjsÚÿ‘€zðO¨Á1ýÿ>P##bH¸BPÓàdÐÕÑZ°ˆ×9pAÁ … '5 †ÔÕüÎb‚I$@ù~ƒ9»ú{ã8›Á`1úgý.VÇGš>)áSæ6ò©I³¹ÓÔ{wó™þóÜøëm‡ƒ”_T8¯•æŠ óï>¹.CNh¤é4{:(-»ocœê5žV'ã<Ÿk:¸gùÌ´pCõ³…-nÛ§/Ú‹3\/}øÇt¢‰ãÿ°ËZÉÊ;«t6ËÅ;Åž«P@ÈÙ‹dÇiÆŽœɸðÛH÷™H¿XZ•¡ÄÆàmk…ùéÇÞ=5t“¤÷i»ºúžû²ð¾èĤC*š»“ -Sòêê××ÊèêŸ ªÒ² Ï èéhmÓÚ½úÚ^ï U^Š„F?;מouRZ1μD–¶qaWò–¡ªóGGU63õΧ¹KU´ÉÂüÅ#Ï-lÉ‚‹úÃÞ +YU±/³Œážè-©ÙÛˆ{G^Á–+NŽäðO¥ß¤çH$´¼¶ë\Wõž½0]Ù!¨\Ÿôú„yµWc°Øî)o&SÇ -ñ•4U¸Ã-žJÀxš¶4ù–ENúè¦òž.§ÕY+}ŒpùšƒîÉ,>ô¦Ÿ–½y-@.Ö •&Yàh×Ü*ccìÔ€œwbW »²æ}–… . Ÿ ñ\HóÍ w„ίÜ<Ö·œW÷°ÛcÖ=ûX]VD^Vg7¹í¹ìºÖàM6Ü^?Šu!®ôC¨–鳜vÐç©Ø®-4sË4‡=nܧQËÔŽ™*çN_±–ÈlÉ– ƒÍf@+DË·Þ_llF©ÍˆÑ)a‚«[˜¥Æù¬ýú¢*¯ú¡ë²@8#1xNýåv^‡ÑŽ¬|3%«s Av"…€”˜ÔVh´&ê ÔUëÇfÅÉ×{µ5@sÁ°ÆðøHË®73u·|²ë]JöÌ|¾jß²€z¹ms†Åû¹é‹Ô¼gµ/DÊÅ6LÂÜ÷Ø"ì²@kc>øÇÌ›Hnç·¶’ fNpþC¡:ä‰eq—„ä@Üm­M{Þ{\ûÜo_z®©WÈðãôƒáªa'£¤Ä™•ìÒüäÀ¼þ†XÝ(£˜BêSIŵìw¼°T„¿P: ´SßçrðŒrmýzwkbW´âEá´™ƒôÃ:KÔ.ߺ7R|ÓynŒ¶¥–¹K–}ðWc3Õ4-rž¼c~£%×°°h`€Y9ü8¥HG¹TÎ=ß]!!Þ>¯ŠS ÜôÈü¹xÞ)ÑA‰Å:{B9­&ÝÖÎÞ@[_IuÕ³C/¢ÙyÜcÝ3¢û•dh¥ ׳:iô©ÛÂço¹Ò[^É;ß?™¥1 vÕÇËm™x¥ ³¾ðÒ؈ѥ²E¶FYI8‘ßÜgcZ›LlºiÊl«ˆ0õ¹m*›;ܧ;2œng%†j{Sæe|q͈v9×PD 3âYÃn¤ŠŸ¡Þ›ÿšÛCRi¢rà Y™ÄŠxqm£¤?4±ùM‹E³½ìÄÕÑ«ÞQZÓ³¤}oÊ]º{¹: wú%u®­‡W‰¦­³>idú/¼ÌÑ”ú©jVɧ ¨›Ó}½¼ŒW¾s†Žù˜%mïJõ¿ìi°¼reÊ¡ç†>ADçú]“¡%ýòw2U¥¥ì¯ºæ} ƒÞ¯2èRà¥î÷·œ¡oÎå ×b³ÄÃ|¬µ¹4:ÄŽöV‹Ô¬nÜšÊ#;'f uù%„Þ›-W³ÅÙ>4ýËD•îUíÎeV T÷E -´š¬xdöKEF¥R.-Îö¸Çv¶… }RnÖ×ÃY¡kÒ4UÂoÏþ’Q#cf@c¥L>ˆÅÉ)"ìï'›>ÈMÞ†B—HªÌvÂú©5Åz}GVM™f¯ïm 3ã3gŠæ¨µ›"Nêªo‰l›.ØWmêy?%ºsfº[A³Ù§l— $GÌ_P.ÂÃMÚkÿâkk ¿Z­˜\GÌ3WRçZ®ªÑ6Ô´Ì>ñIƒ{öc‹û,VLŽ¤¿Š÷ݘÕþrÏ»(ßR¬a틃+GN±IVT.›™ì%6ë<žk+ø5~¬nW¬\B}TȈ¡ã†<¢?%N.¶ž=µýío˜êõD®‹ÎììÃáwm´nÍ¥Œ': BNÉZŠ[¡¼ñÇ+C¨ +ÿl4&xJÕÈ»ù„÷ZíSƒ% TºÿsºÔ\+jE \æÛhfsÁÓØô—Ó´/g>Dñús9ÉölÖ­ðvHh“ 9´7 ,â~œµªR»ßE\çÕ -§”ÿ˫¼M=qÇ=1;µíän^:­P¼Íÿc¾é[åš‹DµJÞÕÝ›œUîAÝ.ÛŽYP!as=ƒOÚæÈÇ6EC-66=7²Iæ¬rKÂÏ)¦uÕx0ê'ÊÍvÑ’¨¸ÓgË“^-%º ïÛE‘»ìüБ>ühÎ{xT—·JeÚÐæürèâåí&F¡×¥w—ˆ6!=¸KÚ“xýÔÆî´ì¿nVÔŒ#‡ynj‡¸÷¨ ЋOéÚ¡ÁÌ›ù rw­˜¹ÕAU¸Š'ãTŸ0jn¨"rŇëMªH%áí Z…épG~g“GTé$ã|—!vúâ|k­WÆR¢1áÅŠ6þ¸:¼'dî뉜If? äH'¢E+=uéò–‹m{Ž¦-¸Ú$<¯mGiÜíßQåƒÈÜUwý÷Ö!û,Ú™øô.æÙH¯Ê¯«3G¹: -Ï?Ïu}¯ûº¯çû½o [eCÎ iŠÃ•! ˆ.`deQ 0»ŒŒ #¢qXc© @tt €a +PM]5m]°» `„ÇÐ(" g$ÿC¤ú# h8 XÁˆ>Hš†pp4’ + 1ÀþÇŠ@Àˆ$# v@ áDÀ ‰BcÙU~2Çzã­?iDþ¯R0’H ÈÑBÊ´ˆ + Þì*Ö8Ú^HZ’ÿP¿š›a0Ö0ÿö?šôe˜?ú_œ?>ˆˆ$V8’€ýUê„ü3›òÿµjN„aÐpC, +ƒÀRè@S4 ‰°Eá>€7 ˆüÉ#±ˆ_CÐúö3‚Š¥™Ó9Å?çù³f Cc‰Bñÿvý!þ‰!cZwhàÁšöþõåþË^&X8ÆÒ„†&#`¡ì´“AC@8@cH€$Ñ«€°8"m @ëI$à#°ÿ§º6 †$à~°? 0 B ù†Ð°‰ü›ÑT°hìß„¦ bøo«*¨@u@Åço¡‰ÿ5iöÿ€4ï Ÿð?; +…âHáÊjꀲ*-”Ž¶6 ¥Žüï:G,: inLû 0XKGý' "XâÏ#LÖ_ØM-IBÂÙ'Çpp½8ß›Í ”(ò« +fz(ê·të†GÃ9®NdÐcî÷žP˜­wÞ¯ÌçãZb^:òU40¥=Âî…釘€ô¼ÑïKÁžKùaTQç­|«ÐE¼äÞÕ5î¶æ‘u z›¡Ù>J¶Ë½ž¢Í'kwmåŒ/,³LKÐuº7vÄij9›æcãëeÕ$ìyò(Iê‰3!<Ù™L3/¯Fù&²¶(N}ĵñî“Y‹³¾_Úy7tÖM°pTÓ;0:î3æñ¥¦™)ªŸL#_/ ¶~ݯ*T1x¥Ö,›ž‡Ñ/Ì‚iš´HeŽö¾‰h,ŠÅNÄ÷[†¨‚ê—ÊŠ§[»t%¯Û +ö@J[g°MÖë­Î1ô•“jM+äâA?9»qs›@6ÿ]½iï¶Ï¹M‰äA"=`G'Yoä™óâ¤fÞ€÷êCfn1_J=VX]xK ¥û­í‹¯JÞï3×ûÙ*XÒÞz»«æ:¬úšb;ĘS¦m©vHX%‹¸%cá&Ý|ª¢VP:7cj#¨Vò‡l‘.‡·`ƒ9³ù‰H¬xfN©¿D¢›aÞ0Á»ÎxÛÇOE­Û´¶Çêµr·. ö¸ïÞæŽ'yì¤ûdö‡n}®vÝ+ ö¼¼üÞ=ωšYûâeàè˜Çžë~›wàYáÖ9„ xvg00T6Ø"‹á©qK^(-ñÆËFÉLÝñꤞ¨—Î,ð³«çˆMkø”[>— +(KfáÑQÇÛ~»¿¾—n€â;qÎ"Ý![˜´t­ÚšX¦™°ZKŸ•üÙJ ­;O< ü>T¬–³c·ý)°3üX­Ò¼ÚVK2âòekÓŠÃJ8Ä©‰¹-žQëíèl“ÕrïÇ×þpÙ}?L벨Q¹H*¶‹m¼'ÅË G­¦r R38¾¦D3Ú»—?•=[Uu÷⧗7@Í0D Ù¾åÆhêÎûà$?ƒæÐÃÙ¦‚æ×=Öð{©A* ĺ‚~¨HîïÌë_6^ìÔØò.­— Ý?æ 0Ðâ;Ö™$ÓêÙûø ŒŒ0‚Ü…Ìt‹Í¯SkPcT9— +ÉõƒûîÃ?v@í|Îàd_7=ýß>töíDI$¶-“Áî’6j¶¹HíÒÅ®M¿dÿ-cAa+KÑ Nü2írQµ¼"ø]R&µ&“ê4ŽHù¸\z0a_ÿh˜ëìǵ®áJa!lÑBüec•'Xñm‰:ÑÐrðb™¼¢kU}2·P¤W Bu;h]¡¥uvòiê@¬Z GÙabÊ%¸U~;INáÒRA<º‹ùUº™ê¹á­¶Eqõs†±: IƒUä›9‹ý¬'|~²‘å8á‡y¼Zø<‹â)™æ­ãĸ¨’òqæ:éçóÁå7–çMÙwÙ…˜ö™Â2–ãîL»ž{0(ë¤Êøm;ã5ê\¯®‹‹²\†`ŒOž$eG+QiF¹z(¿4?źµ:¶´7“Í,†ã UsRž»¡Ãï8Ëù[Õ¥GCOuÏ’Ï›¹WüÞæÍÍ9»ì0_Rè5:—Fi=a•|#ª—žÕ(ñxë_Ò ±Ðg£g–úθ~iF7nOêªPªj÷Sf*NÜ2-€øpâË=õ#›!›'ä0 +oèämb(·ï¨|z= +¼éþ»³fvôÚüÆ4={ IRTmÙx9.$~åª|Ê”õâ`ðÇû«{zš/à|ŠÆ'4ß9õìíÕw‰žLèNF·FÆ1Dy¨QÎ 8¹I ’ƒ|æwÉÂq⌅(ʵCÝ`°/Šaâs¹øþÈni»ƒž\èyi{ÑtÄÍ[OΛ㣵àÎv ÷/µ”}:VŒ`uÿlU>½C)c +ÆÇff‰l=‰4´‚ûÍŸ´t#ß<•3š¿/ÎȘßOÀ ÷j~Ä<Pî©#Â>u3::¦ù–t(Ž{‰fc§˜³sN3i|å¾$Nñb»‘ë¥gy‹{i¤?]`¡ Tnõˆ!oúÕ½”ÇwoÄkë¨#~vÄIMÐÍûxX@½¹<¦›øLÐ.WÍœ×o¿Á‚9£2•ç$W é ´zB9–ÔŸÚÿ¢ÿRv–DWO5l)ªòö<© ô¥0KÊsëd)bÙ:ÚÜ}Ûg) +È%%O©# åœyß:Þ^Ì] 6}R¡?PüüÉÏN:ãwbàã‘šEŒ¨Ô§}Բτq‘¹tûˆYYÚ˜©†NïÔæŨ+éI¬×Ä[z Ïæ­âø]Ã#ô5FŽ-*¾k“¡= ò+ la +Ïò(´£Û òëzi›°XIþaó@ƒSÝ2YH`§±ÆJúy€]s¦|»ÃNŒ²™‘µ™™í å©ÓÎPÌ|~Š¥[æ’žœü±”AúaWãÜ‹6‚¹Ö§#kÝ0&&¸I‹hQs!Çì/Í9¦Yë±íå¾9R’Ád]'¦Ý×e`"©ØPÔÛ”n× ÙÉ0MXÞå S­q¾Žr£ç<æ²ôõÃãÓßIø™,%ö²Ø¹±tÁ©Mï|ÉàÓpÁמ°Å©+£ª×6Å4ÒèdæU[º àÎõêó.Ðmä=ñ¢X®q–!)·ßñ+‘ a·°¶aòÙ²öé6< Çw2šI ù·^ÕíµÍݤ¹7£±¾Á:mÛ_VX‡³Ì}·÷úGaÔ…ÓôUæ·/Xëž‹={z?í`zÉ‘AèÀNâµ~åô±ÝúFÏ®îû3œ§b ‰•rŽMGH ÓS"…¤.^ݺMõ”–Vò½'›¨·œÏu8‹s'Ë(N‰ÉßÉÌ_/¶Ápy܈•­ÁÖö“LúÂ}•—K{bªãqõJ¥ŠjºÅgïN×^ޡ✔v=Cš+N7ëž*¥û~ßu˜üÇ©S=®´ð¼&5ý³™§¹ÚO-À•LªŽ;ã(2…W]Û…®hä%=úöÉØh> œH; vØŽ_¸æ‘µ=Á>¶áÍFc·ëLÎ5çõ;Ý«œ æ§ô0oŸ”m΃†j(ø¤ïq]Flv{ET]·áÏœî\:QÒI§•¯ã¬ …å.€ƒC³ôk~ +Åêñë…è©YgkQÖëÍòL¦Î²0šÓ7¿Ü¼{Gt6÷w“[瘝Ý{~ïˆsHÊ›#&_Æ®»Å‚ÿ‡ûÿüŸ0€c0ç#ø±ÿ ߘÍàendstream endobj -2868 0 obj << +2964 0 obj << /Type /Font /Subtype /Type1 -/Encoding 6699 0 R +/Encoding 7213 0 R /FirstChar 48 -/LastChar 121 -/Widths 6719 0 R -/BaseFont /YAJWSM+CMR12 -/FontDescriptor 2866 0 R +/LastChar 117 +/Widths 7231 0 R +/BaseFont /QQLHWG+CMR12 +/FontDescriptor 2962 0 R >> endobj -2866 0 obj << +2962 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /YAJWSM+CMR12 +/FontName /QQLHWG+CMR12 /ItalicAngle 0 /StemV 65 /XHeight 431 /FontBBox [-34 -251 988 750] /Flags 4 -/CharSet (/zero/one/two/three/J/l/s/t/u/y) -/FontFile 2867 0 R +/CharSet (/zero/two/three/nine/A/g/h/s/t/u) +/FontFile 2963 0 R >> endobj -6719 0 obj -[490 490 490 490 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 503 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 272 0 0 0 0 0 0 386 381 544 0 0 0 517 ] +7231 0 obj +[490 0 490 490 0 0 0 0 0 490 0 0 0 0 0 0 0 734 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 490 544 0 0 0 0 0 0 0 0 0 0 386 381 544 ] endobj -2864 0 obj << -/Length1 2124 -/Length2 13008 +2960 0 obj << +/Length1 2140 +/Length2 13309 /Length3 532 -/Length 14161 -/Filter /FlateDecode ->> -stream -xÚí·UX\Ͷ°‹w ÖXp· ÁÝÝÝw×àœàÜàîww‡àçïoí½Yû¿<çê<§¹éwÌ1«Þ9ªj̆‚DA™^ÐÄÎÈTÌÎÖ™ž™™ ,«¬,¤ÁÌ`f`‚§ v45tÚÙŠ:›r˜¹¸˜‚.æÐun6Vn&x -€°½‡#ÐÜÂ@%LýO'@ÐÆÔhlh 5t¶0µalh P¶3š:{0­­JÿÜáP2u2ut55a€gf˜F¦æ@[xÆœ$mÍìœÿ6q±ÿŸK®¦ŽN )H’R4±³µö˜˜šÁ3ÊÙæ2™ü¿!õ¿s±¶–3´ùgøÿ®Óÿ•ah´öøï;{gSG€¬‰©£íÿNU7ý/=!;ëÿk"IgCk ± ­¹µ)€é¿B@'1 »©‰ÐÙØ`fhídú¯¸©­ÉÿVî_Œ* -¢jBª´ÿ^Ó]V0Ú:«xØÿ{àòÿÅÌï ª#РÍÄÀÄÄ JýýÏ7Ýÿ5¨­± д)Ø9†ŽŽ†ð Ý"v€3hkbê0u932ØÚ9ƒn€Šâ0³s„ÿgIA«Îhö¯Ø! ïÈ -Bë#+AcYÚ¼‡ØŒ.vΦ&FÖÿµÞÿ¾Â`4±³¶6t|qýwòf²1í Mm­MÍþŠ2ÿwô%ƒ þÂÉê=³·vqz€´Œíll ß#ìF { SÛ÷ÈÐ4É{ˆÀèdmèdñù `ô4u´{€ÂÎÖôß̲wv{¿Îòv¶p4ý+㟢ڹ¼×ýŸ²]ÿÊé:üß ’u2uýË´¸Œ¦ÿQvª-ðo‘Ïÿ<³µÝ_7qý3Œ ð?£ ASÃ÷uå`ýg]Lþi5ïA“áût %Áwé½HEø@"ïrý7q‚Š%öN ñw•Iâ@N’ï’‘z'‹ô;\dÞ ä"ûN ¹w¹Èÿ›>ƒ\Þ ä¢øN ¥w¹(¿ÈEå@.ªïrQ{'‹ú;\4Þ ä¢ùoâ¹h½ÈÅÈÑÐØÊÔù?Žë¿ãÿy(@Ý•ñ}«s&2z'ÐDÆï'š 4“É_øÏfø ÿÙª!hBó¿ôä!èÑÿêL g·ü ANV!HÊú/Y½wfPwd´ý AVv!ÈÊþ/üg»þ… +Ç¿ðŸ³ó‚¬œÿB•Ë_²rý AVn5C•û_²òø AVžá?ÍÑÖäzÇÿýR²s÷¢íyzPÏU€ ´=™|þ3QÕ:‰’" ¶ÂÄôTÒ¢Æ.Ž >èü¯÷0hŠÿa3 èõdjênj ¿4ogÌd™ÜRâ+š7Y -MíDZô«#¸>•‡ád}Öñç„Š)ÑZ0š%° õû™t£‰û&^£ ÷ —2cð"Ú &unšò‡sã=ˆ¡ì›Ìðƒ%â]ûŸ´çËd·®ÐU2GÌœ?ðÎ" Jæ_®}­üÆ6—RLÈö¾Ãëf·Ê$™ªnÄŽ>žŠÛåÙ- áè¤Ýb¼.áõ¬M[­"¥rEfËBÎ¥ò=Ã1¯Z” {éÊ! w‘{퉪ÕgÉUÙ–dcoçE®b¶.bnç’‚»+Å&) -½ç -²F×iªBÿP”±‡³ÆàØúÙ”Xœ[tVSé“ÍPV¸ŒfC¶-(ªÐÖGGý\DºÅj3ܸzçcQÛfù×åÎ04_PÀ~?'g¾Qþ@9Ú:j¬‹8 –l®¹ÇPeú ±(׶Q%³ý$}{láwY\«ÈH¸fÇe, Àð£yî«ôaš4­{2á)«_*ŒáÈÓQÅ1¡:Gx¨SŦ0÷ #bŒË%¶4eC%?à*«w ´¸×qaÕ!1±ÁÉ~*Å yQÑg,˜|EõüãÜrþCv”¾–u„W%5ÐhxxˆxZ³3Os*{à;—{½õx¨Èó÷¹K˜‚4[k[%øÒ‡L‹X–~~ÞÏ¿™óŽRõ«¿~h¹ÿ‚2~Ç­lJ˜HUAaq¥Ò¨sj¹²Ò@>kœÆ)¥ãÜgsõò‘i°/錥óÉFQNDºöºçNxºõ¹6ѯ$4“¬‘º:=›h£F˜¡Þ‰µ“NÔ‡P0”FrÉ~_Ó~k!0ó¡'Ä(%FOÐ[ÏÄ~!¯?§³KÍzhöº^0#U¡pîçõ/˜üöJ Ÿà ÞpW!èNìµ -ö˜©½/g´ª¹ŸÆW·]!;pRO -.ÚJgŒÞ¶ºb4mìâ†e²ßúd“Á;È¥êâ.¦ÂÂǽQDNýšûñ;ï—•’”OCÄ–’ŒDÕÒ™†%Í\qåŠè¿ùµW ‘L ?y^èó®VÄÑô%pnóËo¹Kdz—aj: ÕÕ;U -xÁÈkéïÆT“Nädúæ:²ÕêöBò”ö{ŠVÝ’µXªaüNv&Œ¡d‡æZ’Ñ¥P•±…+(›z~nÞOÁ{qÉÂgf"‘ƒmm̈Ó*ú±R¾¼ÅIfùˆ†IkÕÿ ¡²7­‚öT=,áS¤¬qìâr¡‰9‡Ü;Ñáuw”06y<—ÔzÌã‘åù±{uŠ°OÙôé† -± _ŒÔŸ”—¥~›ùBs”úÌõð†ýØ_OëqQÇ+½âÀ%ÐŠï ‡õ¿§q8gºbW6ÝmLÌ j=‘%öV=ŠÆ9ý¦!Aül —N:#×.JÕ=TAP$ýjÓr?¯•OürM»Ho]›qkž}¶µ ¡l±xŒƒ‹m½ökª‹‹õ…å™RæºÜÄ@uÙ§þMÕ¦AQ%)ruðïJ£¦œù©aÀàÇ…à‘éjsL©Ú œ`?ëÇ¥iÄ&"–xáÔ˜½s`e®1kÍñš —§6k«J{'Ú¡:êØzít»¬h= ;oèÌœ¶º±µRËF,ÎÓ•HÿA=6‡{Ã>?nŽ“ÊàÑY[RTKÒž0îÎíAUö¡y8“ݘ[7]»g¹3ɱø÷ÓíšX¹ù/WžLè}úÁQ\AiŒ÷?¬µŽ2¬‹GQF Ž˜aMô9¥imNÛ~ð =aáŠääN¯P÷k¢ÌøùT©*öýˆñq«T7r{~ͬî¯h©õB‡Y­\§ˆhHymê'DÃJ/ËÏÆ ¬ -»¥|Nsh|¼­üTSصnQ㾶§O"p¦]Ut í¡_È»jÏòžy§•ÇS3¬Þ´¬™æ.Ué®Õž'ª-,çõ9ñ'Äá­\]”ÕVõ`T¶°ÓRÉk¾Sê0WRú(yì.%„N~—k;ê+*ÓF¬a~D.û%Êwö ¢€øóiTµ²±T´“«Ãiø‚¤Å*sÑÀ£B0—y¹ Íòï/©9\'gËJ/üZ² -¶–Až¢Å}9IÄÖº¤53mÁmfó·0,„†?%ºÀ×rê•Ð;ÊKnÝ9‹˜}ˆwõmþÂÜ2-D7H’µó2!¿ÐɳzÒˆÂ~¸µÄ.' ©*£¨8F*Ÿ 5áÞ0˜ÿ¼˜Uµûs¢ìº?í|`çµ\L(I†ƒùŸ_ ÛUvÑÕ‘å‚é‹ò¬Ðcu¥OËÉÜ6ÆÛsœgS)ã=˜ÃÆ71z˙ʔú8¾öGE”ø¯žÚ‹iô ¶I·“´Î/D±ÛLsGbT{Q=Xåä¸ä‰)Ä—÷vÈŽg–­üº‘"Qôlù¾ûcäP§:ý±ÿ¤0ÃþÜù×^šØƒ>…T>–ï%åÆ] Î9€ÔðŽ¾atv7…Òéë¥c—kCå)°/4GïZ‘Ì9Z'œö,¡ë¾Ã½Zx̆ƒÞ£‚1…LŸþ!§ò[ zz‚m [>R¡Cí&£')ʈ0‰‡ó+hâªÐï½5rʳë(ŠùÌih&{ƒŽY?ßÇhÕÒ¤«}Ï·æaÇ0FïàÆf§ôøsì¹¾kLJf*p“±ÈXì·Ð/ÇåPhªdç…ût,åðLN®¶¸¼¦`Až ¹6R¾~Ëÿð:P˜Þ߉eh8éÄM/øØtÅS÷¡’A1V½ÊµêóŠ¼DEÀëFæ&ÁüxAͦ³iîRä-ÉÎQσâÔV«µÿÍ·4Ñx² ²Vl|ÈdlÝ$¼ ‰]EÍqd8&úUÄ9‘áK“>$Å× þˆÖH'ÿðÎ]:-%iKøïh§dõ“Â>.µÂ_º{Bk×ByxMݲ‘2BH±tâG|·TYJÆÝ<ŽB\Bór«¦´¬-Yª~Ð9ã Eòaq³fÐă›²ŒÉó2±[•´ò»[Q~ÚûÅÛ»BÒ3®QãÚÀa†íª€ag£¯—5¼ÿ8j²¦’+‡¨ù$††eD¥<5 ¯n×ò$H×ðuSÑÜ~¿Q)›)ÇÃ@éþÖ'D9»Ê¢_0-óû8µ„_ ©íÅ'^5‚­Ÿ§„Ñ>¸¢2¸ª2&_ão[W*ójÃë_|íVŽ ;–ÅÓ‡ÜÝ3Ù«!¯|°¹‚Üf¸OF†ï°úˆú(&,ZøÝvÀËMr°ÐÝÁèô~٘ȟ˜ï–k¨¤^J^©^ƒ¦Q5ÿ2’NÕ+ø.Šú¨©öú#a¾ØÛaF=Á98AäpD³r$[á¸Ç×u ÝH‘»YhÆ= $ÏÛed|øDEg¶Oý&K#™‘`[±A˜šup¨ŸŽôƒv?SSPlvË»àìžD iŠdÿ<ŸWDcÅF‘ƈæ£V¶5Ÿ–ØáÅr•ToF-õˆ”ÂSFªå@K/aœÊ¿áe*,«^ð¼ Èd!l• -ÈØa€úà÷c?2 l­T¸“Æ '*îÞLáqõߌçô°Þ<ÀíÚXÈñãìp/í äÊ÷Ètu¸Á˜0Ž’ÆáHQÛ‰YG -Òóýoè6EúbI;ÒÃ-mãöP+ù÷¼W*:1´’qÉT¹NŽ,-6]Å°/ʱ%„¸$QרÎò½&˜&Ì= J3}f7É¡Úìæ“OË&aʘ]ž7ô‹#VmÆÆÃãQG:2šÏ´vf¼8c¾/RH'·üu¨jÒôj4‡AŽ^¸V]vƒõW±×;ñ8+‡ñŠã-}âOí‚Q3§¡‡ -Oú¾øoÐþ†Áhví‘üJÑ1$— -¯Á·tóæðsÌÊ=»˜©Kºª‚ñ2"¹¤éd‘Ž:0BVŽ¤–?i®õ þàÈö iJ9—ànrÇ‘,.c„ÛkrXçÔ‡ä5X[”)FÿVej~b"kM°Êvΰš@ê5LÇMA&×Ñ% ÆU³þ‚gæ%uáè¦gkæ®ÙóV"ò„£œ¾‹/$EuZë/Ç%ÀۘȹVz{-²rHŸ §]Œ, -Ž«1#€Da3s] 9­þ%æÓûirV›/ÿÄpöýõÖ36$6«îñMc£k·.ò·Ûÿ¬AW*øó‹?aI-zöh+g+OCG¸rÚœ÷Ë'œÕßËdªè²ƒÅºöDþ03ÛWO’‹´â‘Ä¢ãBBªèk6MŠÛ4ëÕ·EÑ£7ïO}tצÏWú¦¦4¨ùCíºl":…«Of=¤‡l”¾ÖO³Ÿü3xûµ‘Ï‹zµpêEëÑÏ‘ØE^œÍûüÙƒû£×­n4ÃGá/â3ù8,&Z.ýÍ&Ò‰¥è”ìñ_ $x†1pyôUú?æfnI>¯®ŠoßÂÈ!jã÷Gä›ï+U¼²xq•Ái®ý¡¯Ô‚XòGu“Úçi…¾ô‚­’ŽguZ¨Z½“èÃ;šLnkõ¤!ð–bÒÇÜ[Ñ“¿ç -àð¥h0?öñœ­éçÌ~:}!(Úõcàb(½ÂNîÅüÑDPrv7.{Î7AÎL¯øa•V<‚ûu¿ŠÚ*ÂrÕñóÉ™}N*¤%Gi ù -|®å€„ME‰Q+ÌO";ªAo<ôMÀx Å -ÁP#ƒt?ìC¶TµtMoá‘×Ù×À{Y Ñ[O¬Ɔ ŒŠä´ó^H ûã“Rˆ€PÁ³‘\³[œ{^ ÒBݾ¤*ê…™îë}ž?|`p—¿ÙRy—ò^Ó¾!–3db›µ“E›h/r7phôÚ*Ô(g¼"1£6³—_¼ËýÄÓP»ƒ”ù—¼bè‚^ -Í´·D²ë,Ý,3m†¯eòöP6­7rIÀ¼òfv¶™ñ˜1Dô$Ü4 )ãð·ÒÎÊ×ù<õ×]Ül©62U!Wô!»$ãëG?½“)ð=æTl*¨dš…f£®†:„hƪbÙ3öÇ ¤úÝõâÚkâ>¢œª™!NÊ.ϱÉÇF'/Ng5g PÞß# 6QºÏ#èT ÀÙ4(ĽŠÑ(mF‡Âè¬6Qnšo冄؂uÌƈb]šC9çŠ"–Ã`÷ ¾W½~Zç燎6¯~h`V·§ñºASʱÚ:@; éÂÅœaúŒ6{íÆöÕ-X&»¿?¬#\‘¦5¡}Ëܢ𧦣 09ä‘Â7ßà‘IUÀC0NHäÄ$¢¼æ¯VÆ;çåñ‚œ‰Ò[£bQ°6A·fÊ]³î5E#Ɖ 'Í™vcW~Êv8DI1ˆo†¼zUL"¶÷‘ôokýÄ6iG{0Ïú#ýW®çîÀÄsgyæž‘~C¯Ÿê:‡/Ír `¢§DJ\ã×þ!ð¨÷´y6[½r½¢‹„C²ð?å~­Löȃ˨¯cý¥¯Û[0š%F œCpåÔ‘.e"D–.ìbêÊë'¨¬ÕÔÜ~?‹õ)²Ä }€KðâúÂpïDû• 5³üa:¬ØÓÈàî±Ý,ó×7ãœ{4¢Yʉhì7òÜ»O¾Â¤îæ{ -‘UÔ2ñÎê3kÒÙøÖ^88JåfäÅNÜK¤”^I¬Oaž`+‚¦s@?k¯ìsj1åÍ.¦sµ²|ÔFØ~Šö#å0®*Hõ«:y¸¦d’Ê™XÀq4c>}Úe5[ä®eÒ'fûÚ²å¾ÿ(ÿñž£ü4Þz[ -ƒû~s¹¡<ý^Õ]J™\Ü,5˦iBCw¸Öu;)_pÝ`ÄÀBu‹oÔñ¹ Õî­ -QÍÞpid#[^³ÿÖ€³ÑJ%é_ áa)I@-9´HÞ7){§ê½(N‘Ô†Q¯F±;ûižÕ¥ò4%ÔˆÏæY!Kx »¦'§é¬ ÿK?äÙj\]¨\æ(>½2óS“Ç.ï´ÙBú6§y¦AÖ˜+ƒÄ Ÿ%KSchæùÓBž´Àptë£í*Ò|ؘ·E£ù„äÑñ&çfê¶>§Bn—Bù௴î¯ü—äèpü("…þmúHgú8;Nã]ÚVO‚¡x|Ï‹´=ç;a5h¿>l•÷Ç֮ׄŸw=áè—æQ›‹¾›×¾ÉÌâ-N¤ë ¸Ê̈´ëÛÂi½ÖeÎÈŒ¹f¾nØD«œûxªc,ì*¤‡dT<̵ê@-éäm<‘Våzàr‡ÈîEgå~óÍsÐ]âà;ùÛÉ‹k½=ïp弄•ã Û­Œnø‹Yù0/ºýE§„H‰¾Y»c³¨‚Ȧ -º'ßE -ý§­œ6òݵ6fðOËrm?z]¹ü°šl¹Ç-Láf¨Â¤u38N÷J&ÞôżÆìN³Û©UV³_ê1«å„ Þß4žC´®èïhª1™ÅœÇlÜ›éí·² …Åèy½]œ¤a.ŽpGC`Å"¨`š… lÞyþ¸XŠ˜ ž)NíÈ0 öx¢«‚yF¼Óƒ}³ŽüÁ[ð«o:35˜Ýƒ»šQ™1wæ¦8\œò°í‡5P;õFó©y†Ãz´¤Ö¦eNÐ*t×>=îxïÑ!ën}}{BäÝÖ¢É,Ê‹C¹ºNË5‡ÝYG³ÂdÝÚ;ˆ‚™€¶®cÇòý6‹º®ÒKÿgÇ ¾”îåÞ'­ô8ÎjÖz*»‹þ¶‘D£M‚Ä·¥Ï¡ñå -Ñaë©dË{ÏÎÂ!^íÙe›É|¿ZõŒ>¥³®ãÑ4¹›œ)ñÏëd¬Öyáàçm'Y`-Ó÷ÜCÈ0Þˆ­­–çV5ö<öÚ}³ ºÑÑkÝ’n¸ö“°ù@h4æa€öÖ -?XG-¸“¶ðÇÇöè”m[³N{ìöž½“½Ú·™mŒdÙ=x„çI’pÓIÛzñ²‰H/E²lÄú4£[˜Lé8¦ç†'L·Q߆ȮnÈüÏ%ÇÁWÆ6¸ß…½.A¶pªÿ¾z¸eàK;ZáŒ`Å»?ËúSt`Ä¥¿×› -4{8Mƒ‹äÕ-¹\˜,÷P*‡nu|Oó—Ùoª‚®¦hD˜þ,òt¡tdaÌ臆û~ª I#›™B/>ÂýÑ»X´ÑïQ $Jï°ö¡ÆኌNX_.éò(uüEËMõÆ7aQ”¤,‡®@K>®$ø¡jŽ Ï^¦ãë,-ñmã¢yyDÒðƸýÞ…»å‘²»wBCYuéPDNWqhÿ Tóè7åÑ‘kWõ›hõ5ˆ¿"+ò*ONjcúH ï»KvȇOa’ïOÕF”-·«w ›kß(ö•T$û³‡ç«X1W™h+™¦‚M—FÛÇGÞäœòáušÔP+Þ¿ÃU#–ùéÀ&8¦%ô³ª/ƒÅ¥;ø}‚Ë8\#}[ ʱFMÌWýw%XSmãî •EÅ«ÀnlNœJ=Vñ,G?i1JõLý<î‘üœw³¤†[+ÍõH ¯Zé'đˬÖü3 òCó©§&c¥ŠpbÚ(ÊÒ0r¸`97EÖƒžgJÝaôÎfþø!·nª½×zW½—¢]Œp}á)nBõ'"¨…1ˆ¨^eØ:¹iÎsý¶¸/ØrÞäTW]s±ŸpZE[šºÅ Ê{‰ƒ—,(ø!‹ã«­6¢÷Î[G¨hÇ(`À4ˆŒ›²ﺻC…^¢Ð!LºÌT+ÃTí]UK”>"mÕèd™,îšÁ$ª\ríõNÿ¼§‚ý$o¸Ï“ð…&lÑpf¶É_m–;ØÆ=UMã…>bƒ8xƒØ¢ö9V™Í›Š´áUãÈ=+"Ð;ry±z䦺^±NR¦­Èˆ(‡¬ˆ3×0¸î§½ŸØPpd+;­)e÷˜Ðc„/—r çêξ›kªÆÀ@>ùà“ñ$ùœ4d6~oT]নO‡$Éc—@–ï'WþïWunã£ê —³žã6@ØvhÜL”ÌímÖ;h ±ú?ÚÝå¬N±CJW+ã²°]ÓAÙ8è Oê›ÕkQ´s-ÌÊNøò‡ÝÆÔwj½hLÙÈ¢WXAß‚ -Ä?®×l×u†þñ›<=Ä°ÿñ±ÊÁ$ÂÏ2y/ˆöÅÒúû‡Ûn»ÈrBäÁ’ùʸØÛ<¥§:dþZ\­’nd!Ýìa=`»Pqƒ>a¤‡^áçÛ¦3­¸ƒ-vXt~œåF4Cd³ F™/Fle‘[ú®§².¯Ú ©|µòO1ZùA´ß\ãGË{š Yò–Êpüì•Ùµ˜BtWçä)ò‰‚RN†´Íˆk‚$ŒúG«¾¿M±øŒ‹à éƘ—“‘ê'¾d×u@ë†/-u@RW,qò²°hßêuÝÕ;åþBŠ‹µB夅Ì&<ï¤3¾þ-TÜ\½^ËAÏ–Ú6Vªéƒ@Y¶B[Ò×^øåšç²H -T/7rŠ6$›K!uŸÌÂá'®Z|á ¶_šôá¨÷>KRçùºdØš‘~¼òË -gܸu|ýa7p§ìÜ]~áò1HŒŒ„8.«œP¥þwÒhËÏxp~ÔX÷mJöWNCžã˜My¿eÌ÷y»d,JÂIš,ø4½˜{L¦qxÖp½?vœxíxI–jΙdP«Ä†«F‹֘ Yíë!!aªá߬°Œ{;ÉÞ\ ž?"´2øÁ8 bí$h8œ8¼&ë!bálãïµ» ÂÛ„]í1 -æZæûÓn¡×t5¹D'>ç¾TeãniâÍÛö3Áp±Æ.ij“ä£R¼”ròiÚþ€Ñ*M™xsŒPùnž¦×â11VF-vÖ° —«EÏd×–üŽà&™nk¼ñïÇW†áŸ+F#YyU~Ïrï£6Â[ŽÈ5 sb{vË/å‘fü(úÉö½¡ÃÑêÀRI0Öù*wÈòKcÎÕnËÄøáïO$Qe”†tL®£-¢¿˜Ùîéð&jX“ÎÌæ‚n˜M æ}ÇÝ<Ç¿nc.)ÍŽ•‡!ïêG8űœlõ^‘Ën÷nõ;ízÊÉuŸ³g›¦méz³k`­ §0ä©ZÉ$ñeš"Ò®4jwÞvÓ)œ]çÔ8·FkÇzœ³wú6ùÚ©SµºŒ îÞÐl ~%“Úó‘`a—»9tž‡šµM[;zûYÜõQÀÍõFŽæäÕ¬+Ï·T;ŠˆÞŒénj°u91{3Ýù4UDö)» înc7„—žV×oܧ†šà’¼:H„‚6àZµ¸çÀ… 8㧗ܨÁ$jN¾¡¹‰‡ÂWÊ5h|MS‰9>òô‚ -ag»¬û•û-#ƒ+?SžEfg] ‡eð<^ê(™œS—5½´ $lÕ&ûó«DK>m¿Ûy«S]ŠÇmö¹,ôR×gý Æ ‡‰®òr]WÓèÌgc‚0Þ(u·rf<©$ùIRIôÙŽ¯œ —Ë7Dû}Gþ‘ ‡P¾„øãúŒ¥´ø¸ÇPïÌ>@‰kúg­9ªˆ€ó°(pP-òzýɇ'å¦õ|à$Úà`j •Ï¡Rïw¦èfÛ5 dì‰ÇíN.>$g¬ý—ú F~0é§0õ³c<{t¶ ÛóÏä^ûSvk Îæ>{æ:¨>îPS“±E!ÿœáÔ•µ¤YŠ0^¥òŽêˆfþ¯±¶Òn&,»Ènüx"ÐÞdJÛÚÈs47dä( -Íö¿ï^ÏÚ}ìµ¾BþèCæ¦Û@%eH£L¡¨ò^¸™ï$åqÕħ*ÈÞØL²Ë1ù0. ¶ +eüÈRs¦”ûØ9ì€Q¹µ^P%•›(y0pÙLºÌš8!v¡Öþò‹‹&LÙñ jÚ§$j¾¯áåekz¨´8,æá³@°þÜÇîØw¾¡œ1²R#ÕêîiC¥|äwFqvB¥6Ô5úóžÖÓ0[m÷D¬Œ7?É2߯"}ÝÎ £ŽueÊ'„b¢ã2ä_eš€ËÝ‘’Ѳ®'â•Ÿ=Ì® -]Ç·´VÄ çŸ.‘ž%ò0;_é6)Šw Ù4:zB!Ó‰/  }¯”ü·ì!GÌ,F8¬—L@ßV1öŸÕ¼uh,½EÉ” éx‚|6ob˜»œüQ—ÆÙ$…éâ÷»±z'ú暶é©d„êRºàÚTáè™´Ö–~ÙŒÑ(ýø¥/ùøV^`MS¸˜Õ ~çÁæF¢gÀ”à‰ »kô?¥šÇŸÒcø8ìüÖ7ÁÚß(yÿ]Ú£n%<{Iº÷œšÂ*Q¹*–¾E¦v–»P/Ï@ó±¼¾ÓŸerJ—ñ á¹}\à™ÈNÒu©öŸíD•‡kãs¤J>ØðÞf$z‚*éêeînÁ8ÊšæÕäôcÁiƒ/1ÂÐ6gÑõ];ŽöKSºù;>Ú±t}¥’eÈBÙ‚I­Ð²$pU^•fï„"°x ܸâmˆGU75ºÿAcõüü­‘ {ÉÐtë÷yh)5*kpútR{Æ»ÖO„z7T£ÍùÅ"ž"|Z E¡Aa‡'vÖþÐ>1Ž}1ÂC_÷HÁ;ÓÏ(xls ¸¦ò{;ò—Ì~4heC®ûÅa 7ð,4  ¡I«ÓZ~žá§ÉÒ #½*׉åÎùÅEO Ñ…r˜hC^×ä8 ¬lüEåÀg6!¼„?“ò÷-†(Ä‘\q›@ Â3À!ÏF«Ç,@äT´ºB¥lSvM™x5jOJvº€Õ°kÍØÒ8ü銆̓7…ª*”ª…á!èœ?¸OLH(S†ƒÁجiÞ¶­ÃG‘…¿ã#0Š#ëXôô‘î;Ouè„D á¯q5¼/!‹´ò˜ß3èÝ -ÂþSHªc²Ü.|Â#9…a¡0Üp=œJ‡˜ž½‡ÍH¸ JÂ}I‚õˆÚW°"ª”u\§þÈêû‘5»{°Ày¡d õ,£oÿ˜O(ò;ÁHî“ýb^OClá* -yÔ­¤ƒÕñº*£À*õ€zX!”ùƒœÕ &ö«ÇIXcîžüŸ2¼ÇLS ~ë_û¤Â\yÀj²›ïÖÜt¡Îô7K›–Á\&Áèä®fìJ¸–íÚd³ÖË[>ÂƘ‹oСâšQLüÚ3ÆqK“IŒÍžŒ•|bmýe½]B¸/æÁv͜蒂ÿ±ª¦Uàk3Pk CJÇå¤nÁESå®dWËô¢óOòÂf­²–C{9‰0&+‡·ŽüØ”©°³?¹Ó¥Ê`OƒàÛ’6lê3jÄ„m¨œ¼uN^ÿb±B–µ"¦ÇÚ„Ñ‚ -ºÙìâyÊþËAÓ V×ð—J¦ÆÚs«\ywÐÔ¬‰Z8Õ÷À<%løÏù¢V×™„HL¡ÄoƘò&Ë<»8ÃÝÀàÉfiˆ‘Õ§\m, ±¶#†÷~¢8¾½ø¬¹£¦¤6‹zÔØÏ_ìqõV™Ȭ)$‚}Ë nXâhâ“ê´®Þà„NûcŒŸL0i¬ÙÍVGŸ Qµ`ûÇŽô†¦†X¶2m¯÷f”7÷?ƪC5p}çI¤ -&ßÌ\ŽSî(…rc•IN4"’lö¼=ì©ùñõÎt¤? ZS¼p¡/™þ±]ÝüáäÞ%mïKw>â›…YhÀ¯1¶•³€Ålè·g•uYk9__‰Eëù65Ol=›.|ßžo!zhÁàpEv§NK÷oßâöÍ–e,òx­ËŒ“¾üPV/£:Êãr—ʉO‹Gõwc hŽÄ•/,Ö?3‰Ÿ´öNûyÜ£óëXšFæé[‚| ïM€KùŽµvdˆbµÿ·óH79|äWLa â‰ØMúË=C²­D…š=öZ˜<8 §r¦×´¬F7 3âò(“Sa´½’\°ÝÖ'ÙÑ_vÚm˜( -6šLKˆ¤7¿œsªfaHÖìüÖµ ¸ÏßÛY˲TJ59a¿CA¬§7,°£œ®PàÓ‘X0&M0?ØÓßoH! Þ]Ó<™^ò'žy`«ÑU·•”rŠö£ ˆþRxEIS³7a^$ÜP(ÎmÛY÷Ki¿0O ¸}¤´€S#ü„Tuçp•nš¬ä@TK8ðånÊ P—Õ“q;9%õ(¼½Š ˜Ï©Iü4ƒ«EieÓ9ÒÃ* b ­âR4õ&A_{÷~çƒu|{ëø0Þäñ‰‘¤¨‚w+*¾vnû“]òíÏã ˜H܉’ À0GÊþ`p w>â)‹!äsYxãÈ÷½pÜ ¯o#zqøøƒø™ãÏ©pÿÀM3f—®¢tiM ÃœÒÚ)O³ëlý`fßñ0˜$6§d *Ã`ŒåL‚ ÔbX¼•yuhÙZTl´jö[ êöf)ö1Ž®“tWîꇚ¨è“R‡ƒÕ–›Ê4ws-øÆ8£nê(„GO>0¶$Z+B7yÎ춗C•a^vÑÔ±V™ÔR:­†¬|áÒdH{<_I~EÍØݳ¦mše+¡Š,OƒJÖÙ–Ž6ÂóqU@¹rèP¸“Ûh°áéɹØ ¯ªJ-S¨ÿeÀ$ÿ¬Íó^öN9>.üY“â®»Šç)éæË]eA˜ÝdÀú&sC@GxÐW‡0†;ØÈþž‚iu]IÏCÆØÁZn£¹ÍŠ|xúÓš—¿_Wí‹—SÒ°c+ëZ®Ffíª¥ÉÀ´3 î$?ª,oÉM’E õ¡.Ó$Äúgû(ÎÌU_\í—YŸ&ÜÐ!ìéRT -Å n ólŸVðqMK=nDÝÄÇ ^£¤öc¨Öþ‚ß¹ï¾ÇÆÈv–¯Ê/¤~›Þ`òÓw'cJèœk! dfh=ÑúNà{ä° ÷Ó\1¬³á’ØhŽÍ2Sª«2¾½.¤— ú˜þÇɾ&:ý§È3Ûûš…D Ú˜3ùF!QÇÔ¤yGé)$è¯Ãyæ—wà+KDƒWèE˜ -Ù]¤WH -pG ¢ÞºB -S9ÀLÏLµ…ý-8ÈÊ æd`YÛOŠZa³µ‡šR–ô#„ñÛZVoʔ˙SØ×ùˆLW3yϵ"Mk£‡•ö3‘²çÝ?„ö¸Ä¹ÆÓÝ%AδÝ0tXÛßS²m ¦Ó¨´ý,î[ù»n¾ÍU»5ˆ8\Îá¼úo-j2j ZëhŸB9n&Éø{‚IˆƒW…SÊO\[‘^>éy)“ùöÌ*ÜyqËåÅŽÇÁx¨6RHÒmµžw¢µbBð€[S׫H÷¸jìfQÄÛ÷’täõ‹G„‡ýü*ébxÛIJݘBWçý™›?¾hã.To7Œxm­D`öæ,Ë6!Ίô”^yŒ‡“FlÑÂ(ø²®LÄW0å ¼YÚ5;JÄÎü\›Ãªoóž¥3âs- ›ÑWé‚LKs´ñ -÷„žL$©¼ Ì#'Òí]98f4d#:.uX¾óß ÿiùCöéÌdÞÔ®»Ò-ø¥DÊC-–\c/ã®_¸t°Ò½ÅxZðÀe& dE¼;vµYÏL»U|ó®PüÁÒtÌr‰ë¢Ô8à³kUÒ’ð‚ðÝ*»~£aû®üyÝu5 ù@ÃX3¹¨:9ˆìׯùÛÿ¢-_\`¬ *Ô‡GûexÃ7:£±žµËh~{´ï­,ÈJÖVKZ‰˜ý'0— Æ]•–•FŠ‹ž@þ‘Š32 ÃíÚ†x¯Á MÙÙq­sñQ|ÒŠ¾s:‘é¸íÛ!O¤1Ñ5:¥@è—µi?Q2¶L‡œ%{2ÇþøåÓÏ9‹xf÷P]óÍCÒ»6u]ßËðU£Û0vð÷ñ|Ý5ÉsWë¿Ÿî ú,Ød8R?{—ÚÂiA»žà#t#ÈygÐ|’uw"¸¦´<+p€ÿ´ÉŠS :"í.|‚ÿ‚íõx=P¡c|7~©¼‡»’€6­¡G­q¨[IM.ŸhäÂÀI‚ß -ñcБiJÚyÒÄÉÞÏ‹ng®³¯LëX¶öÁ­Ô%®ÔÑkÆRìC$1A³É!y21b@ÅùXëàþËñé¼ÿs÷ Älv°(´Q·KéÅgútK¼¶ ¦x«"#Òü™›t‹DQwamö?0<—b¯BanÖ1oIñW¤0¾~0'…)Ñ…æN\’ ”‹µõÿÀ«Â¡8¨üÀž!CÔ)e>Õ“›€vÑõrö¨Á˜ è‡`%Gfmû[Ƭ¬N?MѺ,ƒ‰=Ž8½òB¶v9 #Þ±‡œ8iAUjžéÿáþÿàÿ[›::ÛÙ:ZÁÿÊ‚&Eendstream -endobj -2865 0 obj << +/Length 14465 +/Filter /FlateDecode +>> +stream +xÚí·UXœÍ¶p‹»Kðи»C‚»;Aƒ5Ú¸k ¸»»{ wMpîÜÝõïoí½Yû¿<çê<n³fWšUï|*2e5&S;c ¤­33?@LAMMô+€™‰ŠJÌhälig+nä ä°ññ±D\Ììàqn~N~Vn$*€˜½‡£¥¹…3€VŒîŸ$€ˆ ÐÑÒÄÈ `äl´Ïab¨Ù™X=˜" @õŸO8TN@GW )3ÀÔÒÄ` 4·´EbùÇIÆÖÌÀó_aSûÿr::¥´`I:XÑÔÎä0š!±(ÚׂMþßúß“Kº€@ŠF6ÿLÿßuú¿2Œl,Aÿcgcïâ t(Ø™mÿwªð¿ôDí@ÿ×B2ÎF K[sÀú_!K'IKw ©²¥³‰ÀÌäüWhkú¿À…û—‹Œ´‚‚¶ÿÏô_ÃÊF–¶ÎêöÿžøŸü1Ûƒ+ähéÐeefee'‚ÿç/ýÿµœ„­‰©¥-øRpqŒ<À·L\/6€¥­)Ðt;³0ÛÚ9ƒ?Å`fçˆôÏ‘‚OÅì_±ÿBv0Z¾!AoÈùOòÛ0x<7ÈÈæ-Nqp±sšƒþëüÿ= `1µŒßB|ÿüŸ™œ¬{#G -höW”í¿£ÿ+lläôÏNÖoA°˜=ÈÅé-Ö2±³±1z‹pX,<ì-€¶o!°¡=x";Ó·€Å dädñá°xíÞàMØÙÿÍ\`{g··q.°·³…#𯌊lçòV®ÊléúWX× |þÍ`Y' ë_®àÃfþG!¸Àª¶–‹ðþ³gÝ_âûgËÿŒrƒ.FoçÌÍñϹþi=oA°“ÑÛrÜ`%‘7눾XEìÀâovø7ñ€‹%ùF`©7—IúÀN2o–‘}#°‹Ü]äßì¢ðF`Å7»(ý›xÁ.ÊovQy#°‹ê]ÔÞì¢þF`7»h¾ØEëÀ.ŸÞì¢ýoâ»è¼ØÅØÑÈÄèüÇ¿ãÿùP€»-ËÛUç/düFà…LÞiVðJ¦á?—á/üçªþ…àÍÿBðÎ-þBðÖÿê¬à½[ý…`'ë¿,õWga[½u6p·d±ý ÁVv!ØÊþ/üçºþ…`+Ç¿ðŸgç/[9ÿ…`+—¿låú‚­ÜþjŽ`+÷¿låñ‚­<ÿš£­éÿôŽÿû%!*jçîžóLìàž®øz²úüg¢†­%øI”·VV^pIÿ‰š¸8‚û ó¿ÞËà%þ‡Í,Á¯+ Ðh‚´0kg"h•Ò\æ+Q0QKçDœV8ÒT—&À|¸*€5íØ8®|„ieY‘|,WÅbjƵNÐ âýËK%hó*]^ºü©É¡žÔ@ÎÏt›¬°ÝÒ-ûF†ÓEŠë5×Øjù}6ž|‚ãp˜²¹ÙçK_ë/£ë È©¦ÛÉHú9­òI@ͽµØá‡#)»»…¢<½ôkì—‚ž•IëeÔ4¾ˆè™´OˆlËeX^úŠÈh]”^›ûšuÙŠÕ¶e98a•Ä«ùYñ‹˜?g±{È׿f’‚º¿INP{Ïe¯ÒW‡ÜR•r…qÄýijýbS`wnÑ[NcJ1C_â3žÞ° R®Æ\þâš.â«Ë|åê]ˆKkb[œí÷#oŠÕ°ùŒ +!ù”’íJ žf¸uØDå§dŠ¹ö6sM6°¥$϶Á=«š©=¶8Yß:¢±Ùq÷`ðÁ]çŽBì·õˆ:KÚd$riLˆÞ>2ÆïÒ‡ Ü]Â$Ëb™-½CÅ@Y>âî·š-bþU|-hœwªñ¢^´L™dsÀÒŸ_1¨£ gaNjwhÏÑæüLæs¯…ˆ?%ÏœÃ%`šÚ‚ämU‘Ê˲,bÙû?ðž°ì§}®ù +ßr'„>vï¤ H¤­znq¡Þ wdµ´TO9m’Ê#«çÜgsñLÈú« 阽óñ œŠ¢¸Üw„˼±ÉÖ§ÚÄ/e!a8L l°59”Á›WJ¼û÷„ÂêÒ¤U†¼„ý,;Îc=7¡=⇦eNî)h> Ï!:-yYS¯õ“ßvEòÝêq¼ý¡‰¾{,8SŸº„,ûYsgöøUßóžîAÞâÀ³â»'¨Ã:#÷FH—”ŠóÄYk ÁeN$¢ª¯<]´V[¿ó?ß’Öèÿx¼jDÈÈÚ:CÑÍÝñ½û™Ï4ArsÀv»;ØQ¿ð#‹‰¸ÐÖÿ¶o§»B—ÐhnÂYú }ÒWœO™TòC®÷¹Ò xvT:ñ¤N¦r`@ÁhÍã8m\=±sóc dõ™•…=m8á7“q™óÙÓüöuRY$’•eÑ´RÛA/£§”E_“\¨ó6r,ä5Óòª5ú×MiD6ˆÔ\)ˆZ‰ÃÛ¸Ã'ß•m>ᶘ"?`¼ÌMTCÐKã»]ûöî®îÃU®5G˜l{ bÚP¯ŽaÂÈùàÞ$[BPÚ|¶r"¢²Pü‚27û«µÞ˧Y¯˜t~¬/cæœæL.-÷2µ½b•þú©<;êᡱCœ- W—Î-„D ·¢kHßS¹‰Ð‹d[{‚;â@0ºó,%”Æ‹7ƒ-îS!³¢ð|³©l"Ceôbg߬ÆjíÄ—©2JŠW±âùüîPAwÞß1tdŒ…AžÀ3k‹)¹RÒ E‡Ÿè¥H°¸+µÜVn™HÌ(m¡“¡›ŽôWòò¸‹§HûÉõZ>ãŽßÌc~SfO›×9ÙÁ[I‹ñãýý‡,ê{2j¾~5 ÈÕÄ8'ʤLÆ?u÷Xª4MR„±eÒYG;á3ËAeüô 7ÁËeãm£è5 ‰+1ó€ªèla®vë;´G2’GxÚ¹àU£\ ¼dqLë¯g¨¶JëÕ tÜ0Šj¤¤þ§‡–£5‘Õ¶Å#N\ÍïáV3|#Ê•ªâ6tnhïa–ß-_.¾Þ?¾£¼JM¿Øÿ¹·ýÉM}*#Ɔl2ºægV_dé¤ZDâ¦/ƒýš¸fÆÙá(2€ß'*yQBñ`ôy~Þà8Óg¯_Y×þô<˜6Ÿ«ý‰ 5JP˜×b{o„ù»²f²NUÙ¬ˆ/2”•F6ˆtåÄ3gOcÉ#iåÑ@Ø—¥é‚øÐPŽÁCË!û¾¶Q»€ž,Ý5K’"°ª·a.W–ÐiŠÀ\Fšn÷²ùý)EåóC&vzÍCÖ÷PþìG9-8ï˜1‚-.—Ì‘<—B&óáú‚·êÓyœ–“ŸCcÛyíÅ\fR8'ñæ€ ˜èʹ!Ûi­@ ž^ rBnDì°×N†ßOv þÞ`̵»·ý“VøÂÕ?,6­;ñÉ’ Ù>D|{ÃNC]½ýIsþ¼ùäí.FW´®’C>ß/Ô‡]Ëš¼Ù†~‹¥ó$šª\e/Ö½¹ßi@±‡Ï´³Ó¬1‚Ú2P¾)‘-blT¡ê]kœp|Q{ilOOI: +Cbë¤ÐÌmÏ’>»+¬¯tl•õѾߗ¸?XV.Ô•1Äí¦s(ñ±²ì€•Z’0LU§áj·À{“6¨g¿B[[esî\y¼çŠ8s_/y$ +…ÞS²n|?fùЛ³f$¦;SÈœáÏÇâ+ s?'²½±Â±ßáN‘ᵬáEòÞ×o«XÜhvtiØÑx¯sâ†ÇSQ­Và ò‰ÈJT¡¢Èª®Ö´™Í ä7ý]{!x ŸóPiš%*ÅzÁØ÷5ú†AŸ»œÍ»]ÝœŸUk—Xãó8›kGŠô¥ùLÛ2=c¦œñ•À3hðÊ +ÞÕú+Ç»¤¡SâÛRƤvq ñ(õJl±_O›ÖBé6tñ$áð¸è<Çnâ Hˆ:ÍØËÒ2û À¢à®¬ãŒôrû‡¢¯g¸–i&…š@×½ç-ÞãÙè¦=6åMØcãRM¬frã­¿â8FìÕ»ÈÉó˜äxbÛ4>P¢+Œ‰Û­-Î×ÑÉ¢H:ëK‹qñ8‡“x¥åz‰¸ü‡åHÁ¦ü® +ó(u¨ˆˆü˜FH& }Ü(§ ÿŽBÏùK·º+ÙöÚCyTÂM>ä‹f¢Ÿã¢»‹É‡E|+wãTóSök¤m<±£5ú,%$9–BvÆ~ªœš I~õ“FQeLµËzNS´ß|k^Þ醼DçåÌ…û•ã—ë÷—OGßÓàgdC;ü¸˜4µP,•yN!õà…ð²ô¦òâÜ©ï‘5¹ò˜p7#b8yµßÿ‰äqÛ“NÈ]LÖ›ß Ô!sz¾ hd‘GÜÚánÛ¶c|®tÜpFê¥&f/Žé]uÉ'ÊcþSºcs.@¤=†ŸÚmù‚,B"#¥Š¡•â#IKCoæ–,â7‘"ùɆ&(,â‘R±–Cí0¼Õ&)w ž Áä»(Þ«Tqp>ß¡"nô‘àBi‚—Ø®N¬/8Þˆ,ˆ=ÔÈÔ ÇH{ÈvE”—g ËXÊ‘Æüb ñ(¤E7ì¹FÈ"@G°l•­ÑÁþ…F_;Îaëü}Î ê^O!ÆñžºrÚ1W¾ÜFüäŸG‰mIòÐC)öý³¬ÞCëêr7ÇíçìWº®]rÛxiÌ\ªŸ=¼Êƃ|,úuøΖn´§jÕ*Ð?"¿µJ/f7}¢7·\ùPì¡!Ò=¦#¼'£€TFyõ/v«¢i›”kÅû†e„6íŽ ¢2¡I0ë‰Ö(e›Ço‡ÂwŒg35ä‡ð(£( ¼LÝaiUõäÐ"&UÅMÞ®úÎú‹N³ñæƒð‡kÑ>o§›ÛÄ89jo&èWZªÐƒƒÇ§~Fd:h ñp—½‘™óéu|´zÅ=Ý.V‹qEWÈã‘BÈ4þ¶É-‰æ#²+y]Ç©[f¹4ž§‰}ÁðÅ*¸ð86|úõ!lãÜ~Û D¦ÌÆu2íØ\ÆŸ¢Ó™KïhøRú\9kîšç1w£¹mʾ֌abÏR3U„ RÈ1ÓÞº,j'\);ÒxnCªWº¥ÉDÆe 0,I{B°š¥RcOÉÞüNªùÈZˆ]7Løai:~Bü)\üüõOß%¨,¦«xPÇ4eäÝNé +Ý“¬ ÷#\f{¦Ñ{JÝžÀ†ÒæTsZÿbWÖšæÍSl¶»Ä…£ 1WÙÂ¥ ùìàKxO §Ö’@wšCª¢+|$[ò½Û)ÇÄfríЗYÒÚ-î§2XwC²ŽLlëˆWæ[JÎ4{„ ÓÈ÷Rˆ©<ªÆÖØÞÈm¦lÙÁú3UŽÀ÷w¯1Öïæ ¹s òγžœa€Äl÷Ηó÷Åi»«œ¸±ÐŸ˜­‘QUj{€_–Ô ˜¼R|B„~ô˜ M>!u*qgBÊWrg.¹ë¤žÒÅ+*³X±>¿sx¯x—‹òåHv+H2ÎËÓ6G/‡ŒÝËgÁ¨ÆÐÿú”ÙS‚‡‹‘òp‹JF`ÜÄT×´öhú +ðã~ÝÂôÒÒ(œÀ»ÂöšèÌô•ÐëSµ?ÐK’ùäÈkÉÆØ7u‚ +½0´Õ½{ŸÔm]–™Î,%¨(™³Yçuù+•Å׊N ÷¦=m +R0¿þzfwz]×}Y®c¥á6Mgú´·6#}j½'ÝœnkzP!~N?i¯ú„ü‚‰5„ Œ4žAé@bÑ}ɹ¦ó±Crê5*z_#ñ^–¹ârœÚ”Y0œêAÒic,S¥ÃE¢ðNÝ™QCq-:wù¤ÅL¿*“ÿ¼ÄzÛʺï×ÁéNÞžða²øî&öõØ4¡Æ WªI#讀Ÿ ·Ђïqw«u+ü »©[™UO?5oPÞà¥yñU¢'KÔõi +üp´dkœ  œÞ ¾(—ýü@l<ÎR'rlE"6:D§Uû‚.SM "ý3Jò;)·ÿ1¸Ñv•LÖÙ9b–ÐDú Ý”÷–‚üª¡h;RŽ–òN¸Tï7‡¹Û"7¯ì;ÐûfÏ!á?ж„ôRÛŸ!ÜÆÃc•)ÈMÇ  Ì €È+Ð9dk}¦íº¡œxÃÞÞS…iÌ„3@Ô ÙÖÒPµŠ¸¯<)}PêXȪ¤Tí¬Ã‚™A?—Ç‚¢2¥“_ä¤d˜U§®Î(Ë' §þ8‚J°NJk±ZÜjC7z1¦8âf¯Çž¿I”“Ú¥{ŒÑ3¤[\fW“êÁ>‡j ÿNY|12ß…ÝöVÌLN1g³¸Í$ÿð¼žîÝ·aDˆ„§ „obõ=„¨„¼`i¿ÌÐdl?_(p[(ì©öĉu²c`…¬…á’@ݾƒÑX£ç,5íÂ0+½a ús-MHÛСëKp}Œõ1—@ªz'W®¬|Ê¥'<±Nß^ai`§;oÀÅ“‹WHשÁм;Ý3é(þy+µ"@kdöݳÊÐð^æÆ>1IïC‹¿€ˆí13FK,áŠFN 8/?u'°ã œ"µ,WBÔ<úS¤Z‡,Gyà>Tný‰@¦ožÁß„'ÅûÂá0›¹…ébãùÁiÁ1§6ŽhU¦ËW«¿y·™÷\˜\£uQ¥ù«¬’€”—µ¶Z‚J3Cúçpú§ð›óÙi$ñÎVMqJ¨×Sžë0¹a‰“gr{ hÈ÷ê³ßêÇïðD3œ~ú³«+²žMt˲Ð[P¥\Wåðˆ+Ò‹ÍèL¹áȉ¯•wÏÑ6ìŸaó‰òQ~aPS‡Ïü ݧ°›öíÎÄ9·7H; …] óñ½òˆïº¬ïÈ*¿£Å£NÍêP{ô­ÑâpÖmz²ÌÞf’9-(ZúÏ ÉîQ¶3eËE‡}šôk¼‚BdÕ3ÞeGàfxq÷–AÊ÷ ¢kU‰S©sÿ1£N”_$&%7@h 'ÖZ$ïó /Nhzjk׳ƒÕ÷ÑH‚0|¯’wÒ\Îeúñ3kä˜_Áïu&áÍ£»å“f¥I~Ž¼µ“?8Rì æ¯7ŸÔ°c»×ÅyaÃ?³¡ú¡¹¢™f³ó^y—H¤Å›7oŠ|Áì-^½ú´áÓË!h& q– +ÿe3ʃ7‘Å$³·€T7ò´ªTšá”VïªnYçc j^wÖ© nëélAÍaÐÏ +‹o|ÇR)–—” +„:“;¥ß¤»6y…*¸ÐÙ'CFg×~3³ßœ3™Pe¾“bÅÌFØ p{÷?_g0«Ü‹ +¯ç/,g§ºEãå‘O +¨UÍ°bÆ©Ó°ãûÌÝ/"ØP(J.{”è0!>n!z}ÁèÓó¿†1aȶ0Kz~¤£3nˆT&.®<6ŒL¸Õ±Í}‚&Á’m‡GÌr|’p9¥Ç;&Oø!*ÔñcI¾¿A‚çûˆ® U"vßL']cbP*'fCàU•HÜ=5}ÿ¹õk™Hå‡&6mxúŸõÙÚM'ÈTµj3ˆ4z¦Ì"™s†Ð +Ò<å76+…‰OÛEŠ{S#Z³ b4åßðûBôF>L\“èâËŽÍ®CWqoj˜ºƒÌ‘Ÿ¹R µXÈ—ozæ1ªhjþòoÁ |ª +íͺÃü@*lôŠu‹co6௥‹ý€YÞYgzMÀ1lÇkÔ`…pïÛŒƒÄ,X´ ÚYS—Šs*ÂŽMm½CX"^aE2¨d?î_UéŽ'mQ¾÷«Z>± «“Ý«Äoq22`pr…Ì9#yÒ ÿùc³^þ¢´)õçú[Þ¥Q¥¾wgŸkù»ð”·uH¡<­d]¸Äœ¨J]Ù ‹”‘úú„ë8p@ KÛSI»ˆ+ÞåTVä#ìråíÓãVbÛÓßœ{¢¯†á*”qIÏ„Íãqļ†‘U½£j§÷_Y¦#'UšÄš™qýêLme{|N×B§Ím}îDý6ï¡P«S¥Wk/›»² lã’£Ú”Ô#téàäû5Æû¤c“ô'i·LFç,Ó S¥K¾¬ˆ-ß°0e*¡i3?Wßl^&É6Ç/c„) ½7ìüª‹ö¬_&Ó·ª>:Vt–Kø8¯Uìã(çJ¡CíÃì#¤C_Gˆ.~‡rˆ=}3¡×m«c•7< TöiR¬¡j•Ü/‹¼ÎK€/®’ZerMR‡L€G·„JÝ ý!žP$Æ_Fj¯çiyü½ÚZà¨%ùk§4«ºŽJûsôEï'Âaõë €S€Êç] æ×ç;äÑMhrÓ@5wŠ•ðëw¦¥Ez“['·R= /C{6Äy7›Å–ÂúV‡Á­™Ã Ž‚½Iò~N¢¹ÐØýÒÚëÑ”û¦kºv)I‹-v—X3ßov2ö@‹ÉÅïØ=o S÷M=9egèͽ $ÃéÏN‹ñ« ‰¨qRÃÞYECPY¸z4ÈIQ?=üÞ:ƒ9Ó¾ã‹S:†”é4áÚ_NÈg¬¢çŒp­“U„ç&,{¶ÞzÜ×'ÑrÔǶµEûqÞVÆî­bþ9N£uŸýb^9bO“Uì6žù,:/±øB¤¹¼ùûMãðnÚ(K'<­?½µÒ ‚iUÈH¢´¨“-aĪ¦žµÌ‰œ) nÔ)/´3¦‘µÓ@ˆ'«60UŒ\ôÅ +‹ûO;W̧„m›*ñ2FP¿äÂb»×°è¢´ÈžÐÀ;èqñÈïBŸÑÐ’rä+÷ Ωã½3[ +Ìù¶µjÅ™ ÅZÜÞX0¹ðh«9“²¶Û';n]=ŒÜ€´&æ:DäÈ’„]@¾‡ƒà8Æ'T5+ÉëÇõ±v'üpO´V¹A°®uÀö„&eân'1NÆç鼃d*å¢ë%ͼßiÉ :wWÃÜr¼cí}=Ô~ˆÎQŠ²8fÇ)­\ïWr»ÒuDÕ©3p¯‘õ²¡ß̅У+!g 5ªï–Dz},´¥ ÷Ï?›‡EF'›Në&¸|Ÿ% tRV-BÀѽ»¨]ÔM-R1óÊ?À°Ù˜=™F""!ÜÈ"—{f1®‰ua[Í[  RúÎ$ðá†äï}o*×£ãtôgkºîbvöäÊ?{4—8ó×v*nÿ–©'ÌJ궿o¯¾»ÕwÐl.@®kŸÙ%–ÌŽ«qD§›ãRf–jHÀl öÙ„œ1¸WVÛ…„#;ãN„s^òuÝwëÆòtT…½Ÿ÷ + AF`ëçdZä\µ:Öíß0D0'âÓ*ù‰2*zÄ…|Õñ™!L;÷å<ËóÈÏnhü/yc ÊvÅzÕ¸u95•çì$š w!,¨ª8 ç±”† ›ó ¡ãøú ê'3žhî—ýy¢nkrhM‰ßôÆ0”B÷Où†&UµQÙdHA…gß°ÝkÌÓuï×Ù2¨šæÚò¥æÑðÄa6£w£à#1 €ŒÄÑqß2™É3…J¼æüt‘pοø\çÈòËÄ{ã,CÖÅ—*ýê-þØi¿‰Cáñ=Úu[È´çbÔëê¾U†•‹Å`%Ã,ƒ§ç‚ñ“ŒYC¥§²"—¡Ö(ž½¾_ÅËÏ°‘#×È C„uWý[¢ÍecœØb(uí:¼GB{«¥U?¾ª˜-Ž­&«1ìñªÓ÷K=ÖêãµW™_&0ë–·òóŸ¡2H0ws}+LjÁšoÛí?Ö;Dò€ýÜ´”†V ”+*‡°¥¸„á!¡„@`FZ% +;a|WNÎsº@{,Ä5ê¦"·^~¼ÔD¾e‰¯ÉµÿâšâKNJŠƒøXc*’4¿È§uÝACŸmÅ¢Ö¦½D,Wšß–%¬Ùz7e-™'±ÿ„*¨lrJ\k`­ùiZú2ØWÉüó;â’?3I*«3îÛ³_^lg +pÄê¢SœjÝ+Xy?˜Àe,»È ¡Z«»‹‰>rHÎeîó?“À®}5žNÖ|ÏÐ7%ÛŠ{rø¬Á¢£ ãà Ä:½›F¨r;wŠ9ýXÝ‘dï3Yq"©ÖŽÑ(s¥OgM¨ƒ° º…ÜqDÉí®›àø‘E) +e@¿:°¹ÅËß¾ÝkÂHkyê‰|Y+ö+¦—Ë 8ü¬^¾ÍD·Ëú¼Ç„ó‘¦÷îÏBØn_§„k¤º”ä÷ƒx̦ye¦íâ³ç¶ßB¡â¾>GY³‹iÄ× Mê¯-ŠcCEi‚·ý_ÖMLÑVŠ¬fp>lƒ +ç9lÍ>ŽŸduÊ Ýô¹6Ô†Q6"kVãmÍ¢“²Zèƒ(?z@?R Z­Ô?pM|¯;¤çs^—û1lù¿}Î/ºâðÏŸ‚ÕŽš<ÒÝÄ­«ÉO£1#zûP¤¡öxË›û§Â>s$ÜAá<Ô“·,.b.qVÜ…:šßÎ~11h'Ì|<ñ“ì†?:þ!ÿ=·$z@!Ö¨ø%?h”÷EêéII•"¦XðÍĚܛ|iÓ‚,`¼KSïõªâY/\Ø’Hr«Ö:J˜c|…ô;N2ëÜ}ß*I#pc æì[l[áK/ý÷¬”ê8â³<£«¹³RÊŸ¹íc} «"r[rüxIþ”ãÅnŽ÷£†¥‡G&99Ý&ÙMôu¢*Õº†qRD^ÒµYeGV$Ä[h(ŠShª J¦¤þY:ÐU/G_{Ô›™-ôƒæùÚÏܳ×â®øšÝï·ï<—]ÙÅ3Û“C%®"!kÿhªk/UEáô<áþúÕ»Ö˜GÅɶÏJTÄ×Ìy ê]a¯²,.cÔ•t0ø=šàÞx=zøNò€JúcnÏë’Y±—È6Û>T}d\Ø;„ÆqaVͧs®‘écìMãËŠÚ@·6ƒgÕyûàS·Éœ,ü–¦¸š´éF´gòo2Lðb¿á™rö›ÿ¨8€rÍœqF¸¯0x>8¯Éßf”W–꨿f tœC +³!ÈÌu=wÁ°l¹“0ÐeÞ-þ^a]Ê„_îïn ù¾ñEåVù†˸Uã#}A|¦Gþ[,>7ÂX Í' +ø®“Oâ6PbM8Ôª+Æ‹óìÊV}1(Fó¡j¸t™½˜¾ÍÇ(ë »‹¦R•gÐ}‘g£;±€´â∔úG/ís¯ÊðŒÐ`.>‹×>ûc2@¥f”@!.ê ¹[ÉêJUêδo vÉNý‰ðt‰£ÚGX¾Ž”ñ«¤¨K+qK™Äù>nŸš!’9ça¦ìÜëcn½ ÿD|Ýi¨”‰µdurÖ(íYŒG|©Ÿ@¼ìò‘-ØVÑÓãÁ&Ï(¾wô4Ñš|‰bp&ûJC± +s¨­MBœi6P55øòÃdân 9‰8ØqàùJ¾–;ä:z^Ü°¸˜=)¡_Up`]һܫ ·³æ]N´ZôùKcZN²Í/»Û…9‰RGq÷øÎN|«çÄ¡uü|5…ï×HLEhÕZáéÁzŸ.y>p†fÔ-MS1A¯PsŒÏ¾85X1zÕðŒ üL, fg—â7•A¬fšǪWꀕ>ÓYM½’¿)ÑÆa‚®k‰„ûª³òþyØ zﺬ!Zög øðï×ú긞”;¾S]ß¡CmkפP‹äŠÑ)mÄÝ×)!‡AËËVèñ£<š™Bݧ±óBWΩ8„Y%×çÇ©ùªÓ†ÃcSuºéÒ85^“I´ÉèZc¼_¾‰k‡—êc/øC¬þ˜:)'ÓÉÚÜN1Ë=8î0vìaµ'Å ÝL®¹ŽAtB±ïzªl̾`WœT]è]:)4Û£•6b|¿ƒ´ce}0Vx–ãä2ddßm·Lk$—z€_pÉa?O^~Êpr†V¸È¶¬*´ù…ïìÏØ’Ûé–úJ3yã•ÚÍç癉ýøx*üo,0téÎ7ƒkKNr/¹ç¢§_üˆä5äí8ƒõ‡˜†ž5¹ž°k¯j±GZèú7ZZ…¦;ƒ-Z~!³Þø îz(—*µ*©OšL,<-6©j²âÖZ™NÍ%?+O«hQu<+•¢êÃR<çÄËàÞ¤å\t¡3Vßp;šs ‹¼6¹mèñã*iì‘¥bŠØÏMÓÿ2Šh†¢MÁ¯™"nŸ:]ªVž,ì÷á =³Ä˜TFÿºnVþqÄP¹©ÚDùñ_(PùôdZ¸œ*‰L‚€^º=4úeþÝõ]Åa…Cb™÷ƒâ©ŸäLsÖÞÀ©°@ó•u9ZâçðMïÇí¤~àÛÊ{[³Ñ¸b…güh`A†A#¨gLíi†ì . ëD̬á`Qק§/ÉÝL|ÎÓa®Êå>ï:ÍRS^à‹Ï°‰yø9Á'ûÊ(£fÔ|”¤# ‡K¬kýÀòtß.<î`üèK%ßjÐ~ÎÔUXÌ=ó©øù[*A=Y#*iŠfS´À±2svþ§iíÀb½±ÉdîïAµùý;ïNiÒl~?óŒˆÞ%ÇâàHri‹×su|ï=€žøçü½ik?y¶ÍA]8É|Ìï¬d1”ðÇ)ž?ªr80 +j{±s¬ÂÊx²5L^š‡þ§æ¥ÚÍŸ°”ȨÏ1Œ™M4Ð2% Ôkv$œ³Vô'×6¸N'u-üÃ~[Ö®ø ZÙ° è‘3µj"J™zÝìCNK‰ F²}míbŸ‰$i9¨*rŸ¥ïæK“ž8ïÕùBÛže%¾*‡*‰p¯•°š™ý^Ìþþž®Óð̇ԃúbTãDÄ=þRƒÞ८?gƒœÁ™%ª¢ýJ-¨;“Î’ÍÙl¦aóùÉŃQേöýÆ‹5h¦Ô;¢.œêz‚€ayGÌKŽ3”®mt)O­¾ð9»e¹ÏBšÝ4½3é<_é³£Rõøk¥ y`S¾L—#ckXry¤ï{bïMôÄGAuÔZ‡ÞÿšF¡ì]Ðf×½ç7³Ö8»ýéà¼ë¼+ÅÞŒ`³>‰x’©Ÿ¡‰ ðþ +áWgî­×ËŒ/ïŒ-&g„àm¾é¦ ÒooÀŽµ¨[—.#ˆ'MæÄç€]Zl²Kª"h#кþtLçz!”NëÛ˜^­gýJý(².÷ÌÛœˆ†qñ®«¬•Ï5†ZÄäο¿"»ŽÒ½¨-Çâ‚9·…OP.zP·t:Š,M°_ØzÇ4ˆª¼{ªÜ‘À.9•ªºä¾·¡‰Æ9í•"ªÙÕ +":„í°?Zäu•Òø¢Å¨»4ÇŠ.¼ÙgøXwØOzµ¡§:†¡¥{r‚SËØ“ JzG|Çzñ©¶/ª~?"À€Ç_ìH¦ºáPQœZ¢èþ+$P‚G2~Ï´Æ2‚àL‰ÑWuk¯ªÉh¬†… Iû¼—B«²žòQ±E½lÚ¬žr’³õ}Å6þ ¹Œ6‡jðî=âœw(=¦ágê=dþÌ*¡þnw²@âIn·XÎ`oeÎ3ÂøñîÞzêZã|‹á?,²È¥ÏO¬Gš¼7PÞL ³O=š„,å!ÐdsˆÈW¯Ûn££Sî>D—a%æL<ïM­ ßÛQ+Š‰Šò2z ÉüøXú³ÎCáƒM-NÀÍA].×’cRšé”õ#E$w¿ƒ-S.¡†|ýkÌìƒn=åRiÈ| 4Óó^hjUÜL9¡‰œQ×;.e¤]^©ØRªlqê…5ÜFè?g­SïÔ•müž¤xM·n©N*J?Jö’#ræ qTiëGëg¬ÓäÕ>¹–k²”ÁáÉ´jÿ¢ÐU»¸c±ÌYåûo7áÕ8Õ9‡³=Co¶H”!çe$™ëÙ—iÝ £Œ7K£I,ˆ‚°µiD•‡Ñó›Àˆ¤—‹ˆ™Šx?3fí¼>L{ê8-O8ŒbÃ1=oÓ(ž6_ÜìÐ×¢Y‚­m}Õ¯ß×5˜¢ï;Py)w6üÇö’A¸(¼Ö^0?X扮Ye{–ˆÙÐÔµ1$Ý»üºR; Ó»eIs‹Ém r¾M щýéš¾§ìö’гÁÇvªeÿT–¼@„{Žœô¡ Áïåž’]G™Ý?b]¦+×Ó¢×]R¿_Ï?Wi¤Ö3Ƶß&ù³ëÝErKy“aùùê–¸f_`¬ì±í ÊdÞø9Qu+ou‹41¿gy›0#‰óq½[Àœ¯êÀ°õÇO-o‹¦,Í|‹hÀÇÜßñGþ÷»ãhPÍh'#´Tl”eM ¨D…0Ç5¶mJúÆ'$»±—rHö-4Ê)ajWæré•%]¿–¶‹„!{YÜo¶ó V!vWÒòÊŒ);7¾šÔ™“R-Z]Ÿðfˆ_Œ ½63¾Sï%5]ýúü5dðâ:÷‚>ÔñayYð9P›bÄíÀcíüIÿQóŽýë:^v:cna™?—/*FûÔG¾±b–ÜÅ”uò†m*Å€ea—œ¦ï-ñѶ´‰áš!k/}ˆ£äÉø° +ªÑ œD@¢ý†ª÷¸X%60ú¡¿§5ª«éÞÅßà^Ÿ¥áH–ÖVò:FëY5¾ TÊç0~½ÀÁÜÍHåï¾ý™r`Ü]–õµ¦TŽ‘¢¼·ê6â6÷ýj%¯Û`¹ØŒ%bû+gM×Þ.ÎÚ†Öð#`ABTbÛ?EÂÓ"/õž_ãû{¡öÄ%&˜4%1÷Îy«>¸OÇÊ=–R²|zͬö’O¾¦ÃBü–'"~Ž1$~ŠÑù¦KŽm”s¥.¹(¤Àß•=ÙDc\ÕÒ"3ŸRË®‰âÙ‚Ç +Aö9úsg[;hF°ÆϦ‚²7ܸIlI'™PÎ1`1`ülAžæûñ5˜ãC^jÁú­¿Õ¯¼ËPjØžÏÉ‹,»þõ{pÄäÖvõ–1›×g-Ú¾HòɆ"\ÔÑÆh[wÌCÖÂÛ[“¶™ºÖöµ¿JóƒQ®¢.×°Âp#YË'‡àMöÎ`«Ð…í«^¾7q;f§Âˆ®Á?mqQ÷¤Iká±qzÕ_ƒì𜭾—­”/kg¿N³¹kò)uײ\¸nŸ| Á”1¯GìQ#ÞÄÐÎ¥ +ÄPŸ“‹›W‡k§2¾+ÅzQ1tÞçz]4fºVÌÿ:¯è¢kìÆŸ‘ð%3ìð7Ú’ÓïÂ1w=¿D&BN½hT…3A\á_ïˆ?Õ|üI + /É4¨3ÎÃHî1FC•‘²\f“Gµh‹éå¿}‰ô¡}ØtÅ>­Ðû˜ÂeV9†]Í€’|<çÏšU]ËY2çù,óu£ê›df‰1µä^ùì˜æ§lî‘óWlÜÖØîq) csgêÛ‘( ÜÏòߘlò[t9¤2n8ŒÉØ–È.Â+ñP-y²ˆµš3æCܵZØ¢šI†rñÙ%]-躼x þé +]>S‹6ePâé1Ü™m·ä•õs¾œ,…ždRë ÈöJNX‘êÂÇïÙ³ƒp1÷¾c¹FXÿ¾2ašm®š­>2t¶Ï;ö&òúü©tÒÃåý!ÀùsFÓ/ˆóoÒ¯ÝÞJsÎqwÝt[;ÊD2|ž¤*ÚN;¬ôHVúFª[=gêí^§{þLÓô‹ëvÝK-ÓwSU–èªïìh ¼X󯳮]þÌT ˆèz¢ù*‰/»ôÍå”êGè~Æ}š’²¶&“ÁŽ¿ûðdÚöâ>\‘Õ9!È7ÍWrÁZ°N*äPšÒìô«úóÉm™‹ºÑ~"(Âýëî¢PlŸ„±yüÙçq²\Å®4˜=‘žÄÏk¶ýò¢]šÛù¸u:µ ÷OhÞµI06>cšQ žŠªœY2ã[, \¦”ƒ Ïæ†Û>7ç™2´dQp"°‚;ögüúˆúÁ:däKI«O­üNðs{²Úôå^TáåîKMûsX­LÔ¨·ãŠýî‰0Ûc| +¦ÓüéC3U\QŸø!q1"VK¹¼ûbGʉèʸG+e_K­—Z³®ÏÙ¨x'õW C´ )¬þ/˜¨*Ü|"£Ü ¤|ä _æ>”btÔ¨dS—&Œ®Uò9O–ÓO[†¸Ég}4ÄŸ¦¿„2b#Á×õËyÜ÷Ù4kòÍž·'”ÎÃI~ECŽ“Òª +ØÌdQV’Š}Qî·„ú‰à  ºÈÏŦur¼ù¼>¥,Ùn"1ögfË“Hž#¹P/¼AÐp´F3 è£^÷`çQHÏ`ó¸!úÝò1ç‘W/†|¬ó„„õø·6¶âi±6lzÖ¤C¥=–/zîù9¾ægEµ'úÞˆŠ^c/üNüC¸^& ñ),$Ìx9¯u4û*Vù/p™‹cnª&#'Ù²Òí*…Žn§‚¶¥:°Vµ=ñ³V’H—øŽvt†9 œ½TÙ÷Ç®2=TÇ ¸urݵi:ãªüUyÅ;Hš‰ÚŸÌo€þÞÔzéábù&vÇ3>„RáS¾R¿ãÎX)>c›tžT$4ïc63½DÕ‰éTãÆig¤¤žXj7ÆmžâGcÙš‡Ž½ØWTš³ü}©#¸áâ,½á”#€:EUÖgÊÐ~˜†Õ A/äFȲNÀ-¦1îU½¢ìöÔôœ½hø$;–Ǭ¶2׎Y_ùÊnÂ;ž´*Y¥Ÿo}þAÝÏúÿðéÿŸàÿ˜€€FŽÎv6FŽÖHÿ¼á?endstream +endobj +2961 0 obj << /Type /Font /Subtype /Type1 -/Encoding 6699 0 R +/Encoding 7213 0 R /FirstChar 11 /LastChar 123 -/Widths 6720 0 R -/BaseFont /TPEVBU+CMSSBX10 -/FontDescriptor 2863 0 R +/Widths 7232 0 R +/BaseFont /IHMMYU+CMSSBX10 +/FontDescriptor 2959 0 R >> endobj -2863 0 obj << +2959 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 -/FontName /TPEVBU+CMSSBX10 +/FontName /IHMMYU+CMSSBX10 /ItalicAngle 0 /StemV 136 /XHeight 458 /FontBBox [-71 -250 1099 780] /Flags 4 -/CharSet (/ff/fi/fl/exclam/quotedblright/dollar/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash) -/FontFile 2864 0 R +/CharSet (/ff/fi/fl/ffi/exclam/quotedblright/dollar/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash) +/FontFile 2960 0 R >> endobj -6720 0 obj -[642 586 586 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 367 558 0 550 0 0 306 428 428 550 856 306 367 306 550 550 550 550 550 550 550 550 550 550 550 306 306 0 856 0 519 733 733 733 703 794 642 611 733 794 331 519 764 581 978 794 794 703 794 703 611 733 764 733 1039 733 733 672 343 0 343 0 0 0 525 561 489 561 511 336 550 561 256 286 531 256 867 561 550 561 561 372 422 404 561 500 744 500 500 476 550 ] +7232 0 obj +[642 586 586 892 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 367 558 0 550 0 0 306 428 428 550 856 306 367 306 550 550 550 550 550 550 550 550 550 550 550 306 306 0 856 0 519 733 733 733 703 794 642 611 733 794 331 519 764 581 978 794 794 703 794 703 611 733 764 733 1039 733 733 672 343 0 343 0 0 0 525 561 489 561 511 336 550 561 256 286 531 256 867 561 550 561 561 372 422 404 561 500 744 500 500 476 550 ] endobj -2869 0 obj << +2965 0 obj << /Type /Pages /Count 6 -/Parent 6721 0 R -/Kids [2858 0 R 2871 0 R 2885 0 R 2963 0 R 3038 0 R 3068 0 R] +/Parent 7233 0 R +/Kids [2954 0 R 2967 0 R 2981 0 R 2987 0 R 3025 0 R 3060 0 R] >> endobj -3158 0 obj << +3122 0 obj << /Type /Pages /Count 6 -/Parent 6721 0 R -/Kids [3107 0 R 3160 0 R 3210 0 R 3265 0 R 3318 0 R 3368 0 R] +/Parent 7233 0 R +/Kids [3096 0 R 3134 0 R 3173 0 R 3181 0 R 3221 0 R 3274 0 R] >> endobj -3471 0 obj << +3382 0 obj << /Type /Pages /Count 6 -/Parent 6721 0 R -/Kids [3421 0 R 3473 0 R 3525 0 R 3571 0 R 3624 0 R 3676 0 R] +/Parent 7233 0 R +/Kids [3326 0 R 3384 0 R 3433 0 R 3488 0 R 3543 0 R 3596 0 R] >> endobj -3770 0 obj << +3701 0 obj << /Type /Pages /Count 6 -/Parent 6721 0 R -/Kids [3727 0 R 3772 0 R 3820 0 R 3855 0 R 3859 0 R 3866 0 R] +/Parent 7233 0 R +/Kids [3650 0 R 3703 0 R 3754 0 R 3809 0 R 3856 0 R 3905 0 R] >> endobj -3881 0 obj << +3990 0 obj << /Type /Pages /Count 6 -/Parent 6721 0 R -/Kids [3872 0 R 3883 0 R 3889 0 R 3900 0 R 3913 0 R 3919 0 R] +/Parent 7233 0 R +/Kids [3953 0 R 3992 0 R 3996 0 R 4002 0 R 4007 0 R 4015 0 R] >> endobj -3928 0 obj << +4034 0 obj << /Type /Pages /Count 6 -/Parent 6721 0 R -/Kids [3924 0 R 3930 0 R 3934 0 R 3941 0 R 3949 0 R 3959 0 R] +/Parent 7233 0 R +/Kids [4023 0 R 4036 0 R 4049 0 R 4059 0 R 4066 0 R 4071 0 R] >> endobj -3984 0 obj << +4080 0 obj << /Type /Pages /Count 6 -/Parent 6722 0 R -/Kids [3977 0 R 3987 0 R 3996 0 R 4002 0 R 4010 0 R 4015 0 R] +/Parent 7234 0 R +/Kids [4075 0 R 4082 0 R 4088 0 R 4098 0 R 4107 0 R 4125 0 R] >> endobj -4028 0 obj << +4139 0 obj << /Type /Pages /Count 6 -/Parent 6722 0 R -/Kids [4022 0 R 4030 0 R 4035 0 R 4043 0 R 4051 0 R 4055 0 R] +/Parent 7234 0 R +/Kids [4131 0 R 4141 0 R 4146 0 R 4156 0 R 4160 0 R 4167 0 R] >> endobj -4069 0 obj << +4192 0 obj << /Type /Pages /Count 6 -/Parent 6722 0 R -/Kids [4064 0 R 4071 0 R 4083 0 R 4091 0 R 4098 0 R 4105 0 R] +/Parent 7234 0 R +/Kids [4179 0 R 4194 0 R 4201 0 R 4210 0 R 4221 0 R 4226 0 R] >> endobj -4118 0 obj << +4241 0 obj << /Type /Pages /Count 6 -/Parent 6722 0 R -/Kids [4111 0 R 4120 0 R 4127 0 R 4135 0 R 4140 0 R 4146 0 R] +/Parent 7234 0 R +/Kids [4233 0 R 4243 0 R 4254 0 R 4261 0 R 4269 0 R 4276 0 R] >> endobj -4163 0 obj << +4287 0 obj << /Type /Pages /Count 6 -/Parent 6722 0 R -/Kids [4152 0 R 4165 0 R 4177 0 R 4189 0 R 4197 0 R 4205 0 R] +/Parent 7234 0 R +/Kids [4281 0 R 4289 0 R 4297 0 R 4303 0 R 4307 0 R 4318 0 R] >> endobj -4224 0 obj << +4332 0 obj << /Type /Pages /Count 6 -/Parent 6722 0 R -/Kids [4217 0 R 4226 0 R 4230 0 R 4236 0 R 4248 0 R 4253 0 R] +/Parent 7234 0 R +/Kids [4326 0 R 4334 0 R 4340 0 R 4345 0 R 4349 0 R 4355 0 R] >> endobj -4261 0 obj << +4377 0 obj << /Type /Pages /Count 6 -/Parent 6723 0 R -/Kids [4258 0 R 4263 0 R 4269 0 R 4274 0 R 4281 0 R 4293 0 R] +/Parent 7235 0 R +/Kids [4370 0 R 4379 0 R 4390 0 R 4394 0 R 4402 0 R 4409 0 R] >> endobj -4302 0 obj << +4426 0 obj << /Type /Pages /Count 6 -/Parent 6723 0 R -/Kids [4298 0 R 4304 0 R 4310 0 R 4322 0 R 4329 0 R 4334 0 R] +/Parent 7235 0 R +/Kids [4420 0 R 4428 0 R 4433 0 R 4439 0 R 4448 0 R 4458 0 R] >> endobj -4346 0 obj << +4468 0 obj << /Type /Pages /Count 6 -/Parent 6723 0 R -/Kids [4341 0 R 4348 0 R 4354 0 R 4360 0 R 4365 0 R 4373 0 R] +/Parent 7235 0 R +/Kids [4464 0 R 4470 0 R 4474 0 R 4480 0 R 4485 0 R 4491 0 R] >> endobj -4390 0 obj << +4507 0 obj << /Type /Pages /Count 6 -/Parent 6723 0 R -/Kids [4384 0 R 4392 0 R 4397 0 R 4402 0 R 4407 0 R 4414 0 R] +/Parent 7235 0 R +/Kids [4503 0 R 4509 0 R 4515 0 R 4526 0 R 4534 0 R 4544 0 R] >> endobj -4426 0 obj << +4556 0 obj << /Type /Pages /Count 6 -/Parent 6723 0 R -/Kids [4421 0 R 4429 0 R 4438 0 R 4453 0 R 4458 0 R 4463 0 R] +/Parent 7235 0 R +/Kids [4552 0 R 4558 0 R 4563 0 R 4570 0 R 4576 0 R 4582 0 R] >> endobj -4482 0 obj << +4594 0 obj << /Type /Pages /Count 6 -/Parent 6723 0 R -/Kids [4478 0 R 4484 0 R 4492 0 R 4498 0 R 4506 0 R 4515 0 R] +/Parent 7235 0 R +/Kids [4588 0 R 4597 0 R 4605 0 R 4615 0 R 4626 0 R 4630 0 R] >> endobj -4525 0 obj << +4640 0 obj << /Type /Pages /Count 6 -/Parent 6724 0 R -/Kids [4520 0 R 4527 0 R 4533 0 R 4539 0 R 4545 0 R 4553 0 R] +/Parent 7236 0 R +/Kids [4636 0 R 4643 0 R 4649 0 R 4656 0 R 4663 0 R 4672 0 R] >> endobj -4568 0 obj << +4683 0 obj << /Type /Pages /Count 6 -/Parent 6724 0 R -/Kids [4562 0 R 4570 0 R 4575 0 R 4581 0 R 4592 0 R 4596 0 R] +/Parent 7236 0 R +/Kids [4677 0 R 4686 0 R 4694 0 R 4704 0 R 4715 0 R 4720 0 R] >> endobj -4612 0 obj << +4730 0 obj << /Type /Pages /Count 6 -/Parent 6724 0 R -/Kids [4605 0 R 4614 0 R 4621 0 R 4631 0 R 4640 0 R 4647 0 R] +/Parent 7236 0 R +/Kids [4725 0 R 4732 0 R 4739 0 R 4746 0 R 4753 0 R 4759 0 R] >> endobj -4662 0 obj << +4773 0 obj << /Type /Pages /Count 6 -/Parent 6724 0 R -/Kids [4654 0 R 4664 0 R 4673 0 R 4681 0 R 4686 0 R 4692 0 R] +/Parent 7236 0 R +/Kids [4767 0 R 4775 0 R 4784 0 R 4790 0 R 4795 0 R 4805 0 R] >> endobj -4700 0 obj << +4819 0 obj << /Type /Pages /Count 6 -/Parent 6724 0 R -/Kids [4697 0 R 4702 0 R 4711 0 R 4719 0 R 4724 0 R 4731 0 R] +/Parent 7236 0 R +/Kids [4811 0 R 4821 0 R 4829 0 R 4833 0 R 4838 0 R 4844 0 R] >> endobj -4739 0 obj << +4860 0 obj << /Type /Pages /Count 6 -/Parent 6724 0 R -/Kids [4736 0 R 4741 0 R 4747 0 R 4753 0 R 4766 0 R 4774 0 R] +/Parent 7236 0 R +/Kids [4852 0 R 4863 0 R 4871 0 R 4881 0 R 4890 0 R 4902 0 R] >> endobj -4786 0 obj << +4914 0 obj << /Type /Pages /Count 6 -/Parent 6725 0 R -/Kids [4781 0 R 4788 0 R 4797 0 R 4803 0 R 4812 0 R 4817 0 R] +/Parent 7237 0 R +/Kids [4909 0 R 4916 0 R 4923 0 R 4928 0 R 4933 0 R 4942 0 R] >> endobj -4830 0 obj << +4954 0 obj << /Type /Pages /Count 6 -/Parent 6725 0 R -/Kids [4823 0 R 4832 0 R 4837 0 R 4843 0 R 4857 0 R 4863 0 R] +/Parent 7237 0 R +/Kids [4949 0 R 4956 0 R 4962 0 R 4967 0 R 4971 0 R 4978 0 R] >> endobj -4873 0 obj << +4991 0 obj << /Type /Pages /Count 6 -/Parent 6725 0 R -/Kids [4869 0 R 4875 0 R 4880 0 R 4885 0 R 4893 0 R 4899 0 R] +/Parent 7237 0 R +/Kids [4986 0 R 4993 0 R 4998 0 R 5005 0 R 5014 0 R 5018 0 R] >> endobj -4909 0 obj << +5028 0 obj << /Type /Pages /Count 6 -/Parent 6725 0 R -/Kids [4904 0 R 4911 0 R 4917 0 R 4922 0 R 4930 0 R 4936 0 R] +/Parent 7237 0 R +/Kids [5023 0 R 5030 0 R 5036 0 R 5055 0 R 5062 0 R 5069 0 R] >> endobj -4945 0 obj << +5083 0 obj << /Type /Pages /Count 6 -/Parent 6725 0 R -/Kids [4941 0 R 4947 0 R 4953 0 R 4963 0 R 4967 0 R 4973 0 R] +/Parent 7237 0 R +/Kids [5075 0 R 5085 0 R 5090 0 R 5096 0 R 5104 0 R 5112 0 R] >> endobj -4982 0 obj << +5124 0 obj << /Type /Pages /Count 6 -/Parent 6725 0 R -/Kids [4978 0 R 4984 0 R 4989 0 R 4995 0 R 5000 0 R 5006 0 R] +/Parent 7237 0 R +/Kids [5118 0 R 5126 0 R 5131 0 R 5139 0 R 5144 0 R 5150 0 R] >> endobj -5016 0 obj << +5170 0 obj << /Type /Pages /Count 6 -/Parent 6726 0 R -/Kids [5011 0 R 5018 0 R 5039 0 R 5044 0 R 5048 0 R 5054 0 R] +/Parent 7238 0 R +/Kids [5163 0 R 5172 0 R 5177 0 R 5182 0 R 5186 0 R 5196 0 R] >> endobj -5062 0 obj << +5204 0 obj << /Type /Pages /Count 6 -/Parent 6726 0 R -/Kids [5059 0 R 5064 0 R 5068 0 R 5078 0 R 5088 0 R 5094 0 R] +/Parent 7238 0 R +/Kids [5201 0 R 5206 0 R 5211 0 R 5217 0 R 5223 0 R 5228 0 R] >> endobj -5108 0 obj << +5240 0 obj << /Type /Pages /Count 6 -/Parent 6726 0 R -/Kids [5100 0 R 5110 0 R 5120 0 R 5131 0 R 5136 0 R 5143 0 R] +/Parent 7238 0 R +/Kids [5236 0 R 5242 0 R 5250 0 R 5255 0 R 5260 0 R 5269 0 R] >> endobj -5154 0 obj << +5279 0 obj << /Type /Pages /Count 6 -/Parent 6726 0 R -/Kids [5149 0 R 5157 0 R 5164 0 R 5176 0 R 5186 0 R 5195 0 R] +/Parent 7238 0 R +/Kids [5275 0 R 5281 0 R 5286 0 R 5291 0 R 5296 0 R 5301 0 R] >> endobj -5208 0 obj << +5311 0 obj << /Type /Pages /Count 6 -/Parent 6726 0 R -/Kids [5200 0 R 5210 0 R 5218 0 R 5223 0 R 5231 0 R 5241 0 R] +/Parent 7238 0 R +/Kids [5306 0 R 5313 0 R 5319 0 R 5324 0 R 5328 0 R 5334 0 R] >> endobj -5257 0 obj << +5359 0 obj << /Type /Pages /Count 6 -/Parent 6726 0 R -/Kids [5251 0 R 5261 0 R 5272 0 R 5277 0 R 5282 0 R 5290 0 R] +/Parent 7238 0 R +/Kids [5350 0 R 5364 0 R 5369 0 R 5374 0 R 5379 0 R 5384 0 R] >> endobj -5300 0 obj << +5391 0 obj << /Type /Pages /Count 6 -/Parent 6727 0 R -/Kids [5295 0 R 5302 0 R 5309 0 R 5321 0 R 5333 0 R 5341 0 R] +/Parent 7239 0 R +/Kids [5388 0 R 5393 0 R 5403 0 R 5412 0 R 5420 0 R 5424 0 R] >> endobj -5357 0 obj << +5438 0 obj << /Type /Pages /Count 6 -/Parent 6727 0 R -/Kids [5349 0 R 5359 0 R 5366 0 R 5373 0 R 5378 0 R 5385 0 R] +/Parent 7239 0 R +/Kids [5431 0 R 5440 0 R 5450 0 R 5456 0 R 5464 0 R 5472 0 R] >> endobj -5398 0 obj << +5483 0 obj << /Type /Pages /Count 6 -/Parent 6727 0 R -/Kids [5390 0 R 5400 0 R 5405 0 R 5410 0 R 5420 0 R 5430 0 R] +/Parent 7239 0 R +/Kids [5479 0 R 5485 0 R 5492 0 R 5503 0 R 5509 0 R 5522 0 R] >> endobj -5448 0 obj << +5534 0 obj << /Type /Pages /Count 6 -/Parent 6727 0 R -/Kids [5436 0 R 5450 0 R 5456 0 R 5461 0 R 5469 0 R 5475 0 R] +/Parent 7239 0 R +/Kids [5527 0 R 5536 0 R 5544 0 R 5549 0 R 5556 0 R 5572 0 R] >> endobj -5487 0 obj << +5592 0 obj << /Type /Pages /Count 6 -/Parent 6727 0 R -/Kids [5482 0 R 5489 0 R 5496 0 R 5503 0 R 5511 0 R 5518 0 R] +/Parent 7239 0 R +/Kids [5583 0 R 5595 0 R 5603 0 R 5611 0 R 5617 0 R 5624 0 R] >> endobj -5548 0 obj << +5635 0 obj << /Type /Pages /Count 6 -/Parent 6727 0 R -/Kids [5532 0 R 5550 0 R 5564 0 R 5578 0 R 5605 0 R 5615 0 R] +/Parent 7239 0 R +/Kids [5628 0 R 5638 0 R 5648 0 R 5658 0 R 5671 0 R 5683 0 R] >> endobj -5629 0 obj << +5701 0 obj << /Type /Pages /Count 6 -/Parent 6728 0 R -/Kids [5624 0 R 5631 0 R 5637 0 R 5644 0 R 5654 0 R 5660 0 R] +/Parent 7240 0 R +/Kids [5693 0 R 5705 0 R 5715 0 R 5722 0 R 5731 0 R 5738 0 R] >> endobj -5668 0 obj << +5750 0 obj << /Type /Pages /Count 6 -/Parent 6728 0 R -/Kids [5665 0 R 5670 0 R 5674 0 R 5678 0 R 5682 0 R 5686 0 R] +/Parent 7240 0 R +/Kids [5746 0 R 5752 0 R 5757 0 R 5764 0 R 5774 0 R 5780 0 R] >> endobj -5694 0 obj << +5793 0 obj << /Type /Pages /Count 6 -/Parent 6728 0 R -/Kids [5691 0 R 5696 0 R 5716 0 R 5721 0 R 5729 0 R 5737 0 R] +/Parent 7240 0 R +/Kids [5784 0 R 5796 0 R 5806 0 R 5815 0 R 5820 0 R 5833 0 R] >> endobj -5751 0 obj << +5843 0 obj << /Type /Pages /Count 6 -/Parent 6728 0 R -/Kids [5745 0 R 5754 0 R 5762 0 R 5770 0 R 5777 0 R 5785 0 R] +/Parent 7240 0 R +/Kids [5839 0 R 5845 0 R 5856 0 R 5863 0 R 5870 0 R 5876 0 R] >> endobj -5801 0 obj << +5889 0 obj << /Type /Pages /Count 6 -/Parent 6728 0 R -/Kids [5791 0 R 5803 0 R 5815 0 R 5822 0 R 5829 0 R 5836 0 R] +/Parent 7240 0 R +/Kids [5885 0 R 5891 0 R 5899 0 R 5906 0 R 5919 0 R 5936 0 R] >> endobj -5852 0 obj << +5960 0 obj << /Type /Pages /Count 6 -/Parent 6728 0 R -/Kids [5845 0 R 5854 0 R 5860 0 R 5870 0 R 5877 0 R 5881 0 R] +/Parent 7240 0 R +/Kids [5948 0 R 5962 0 R 5987 0 R 5995 0 R 6002 0 R 6009 0 R] >> endobj -5897 0 obj << +6020 0 obj << /Type /Pages /Count 6 -/Parent 6729 0 R -/Kids [5889 0 R 5899 0 R 5905 0 R 5909 0 R 5915 0 R 5927 0 R] +/Parent 7241 0 R +/Kids [6015 0 R 6022 0 R 6028 0 R 6035 0 R 6042 0 R 6047 0 R] >> endobj -5939 0 obj << +6065 0 obj << /Type /Pages /Count 6 -/Parent 6729 0 R -/Kids [5934 0 R 5941 0 R 5945 0 R 5955 0 R 5961 0 R 5968 0 R] +/Parent 7241 0 R +/Kids [6057 0 R 6067 0 R 6077 0 R 6098 0 R 6107 0 R 6112 0 R] >> endobj -5983 0 obj << +6125 0 obj << /Type /Pages /Count 6 -/Parent 6729 0 R -/Kids [5975 0 R 5985 0 R 5999 0 R 6008 0 R 6016 0 R 6023 0 R] +/Parent 7241 0 R +/Kids [6119 0 R 6128 0 R 6136 0 R 6148 0 R 6154 0 R 6164 0 R] >> endobj -6039 0 obj << +6174 0 obj << /Type /Pages /Count 6 -/Parent 6729 0 R -/Kids [6030 0 R 6041 0 R 6057 0 R 6061 0 R 6083 0 R 6097 0 R] +/Parent 7241 0 R +/Kids [6169 0 R 6176 0 R 6184 0 R 6190 0 R 6198 0 R 6205 0 R] >> endobj -6112 0 obj << +6221 0 obj << /Type /Pages /Count 6 -/Parent 6729 0 R -/Kids [6105 0 R 6114 0 R 6122 0 R 6131 0 R 6135 0 R 6143 0 R] +/Parent 7241 0 R +/Kids [6211 0 R 6223 0 R 6228 0 R 6235 0 R 6243 0 R 6247 0 R] >> endobj -6152 0 obj << +6259 0 obj << /Type /Pages /Count 6 -/Parent 6729 0 R -/Kids [6149 0 R 6154 0 R 6160 0 R 6166 0 R 6172 0 R 6176 0 R] +/Parent 7241 0 R +/Kids [6256 0 R 6261 0 R 6267 0 R 6273 0 R 6278 0 R 6288 0 R] >> endobj -6186 0 obj << +6302 0 obj << /Type /Pages /Count 6 -/Parent 6730 0 R -/Kids [6180 0 R 6188 0 R 6192 0 R 6200 0 R 6207 0 R 6216 0 R] +/Parent 7242 0 R +/Kids [6296 0 R 6304 0 R 6308 0 R 6316 0 R 6322 0 R 6328 0 R] >> endobj -6227 0 obj << +6341 0 obj << /Type /Pages /Count 6 -/Parent 6730 0 R -/Kids [6224 0 R 6229 0 R 6235 0 R 6241 0 R 6248 0 R 6253 0 R] +/Parent 7242 0 R +/Kids [6336 0 R 6343 0 R 6352 0 R 6358 0 R 6371 0 R 6380 0 R] >> endobj -6262 0 obj << +6392 0 obj << /Type /Pages /Count 6 -/Parent 6730 0 R -/Kids [6259 0 R 6264 0 R 6271 0 R 6279 0 R 6283 0 R 6291 0 R] +/Parent 7242 0 R +/Kids [6387 0 R 6394 0 R 6400 0 R 6408 0 R 6417 0 R 6428 0 R] >> endobj -6304 0 obj << +6459 0 obj << /Type /Pages /Count 6 -/Parent 6730 0 R -/Kids [6299 0 R 6306 0 R 6311 0 R 6315 0 R 6324 0 R 6330 0 R] +/Parent 7242 0 R +/Kids [6442 0 R 6461 0 R 6475 0 R 6482 0 R 6489 0 R 6498 0 R] >> endobj -6342 0 obj << +6510 0 obj << /Type /Pages /Count 6 -/Parent 6730 0 R -/Kids [6336 0 R 6344 0 R 6372 0 R 6379 0 R 6383 0 R 6389 0 R] +/Parent 7242 0 R +/Kids [6507 0 R 6512 0 R 6518 0 R 6525 0 R 6530 0 R 6534 0 R] >> endobj -6406 0 obj << +6545 0 obj << /Type /Pages /Count 6 -/Parent 6730 0 R -/Kids [6399 0 R 6408 0 R 6417 0 R 6421 0 R 6428 0 R 6436 0 R] +/Parent 7242 0 R +/Kids [6540 0 R 6547 0 R 6553 0 R 6557 0 R 6561 0 R 6566 0 R] >> endobj -6457 0 obj << +6575 0 obj << /Type /Pages /Count 6 -/Parent 6731 0 R -/Kids [6442 0 R 6459 0 R 6468 0 R 6476 0 R 6487 0 R 6494 0 R] +/Parent 7243 0 R +/Kids [6572 0 R 6577 0 R 6583 0 R 6592 0 R 6599 0 R 6607 0 R] >> endobj -6510 0 obj << +6615 0 obj << /Type /Pages /Count 6 -/Parent 6731 0 R -/Kids [6504 0 R 6512 0 R 6516 0 R 6535 0 R 6548 0 R 6555 0 R] +/Parent 7243 0 R +/Kids [6612 0 R 6617 0 R 6623 0 R 6629 0 R 6635 0 R 6640 0 R] >> endobj -6566 0 obj << +6654 0 obj << /Type /Pages /Count 6 -/Parent 6731 0 R -/Kids [6561 0 R 6568 0 R 6576 0 R 6581 0 R 6589 0 R 6602 0 R] +/Parent 7243 0 R +/Kids [6649 0 R 6656 0 R 6660 0 R 6667 0 R 6677 0 R 6681 0 R] >> endobj -6623 0 obj << +6698 0 obj << /Type /Pages /Count 6 -/Parent 6731 0 R -/Kids [6614 0 R 6625 0 R 6634 0 R 6641 0 R 6650 0 R 6658 0 R] +/Parent 7243 0 R +/Kids [6689 0 R 6700 0 R 6706 0 R 6712 0 R 6717 0 R 6721 0 R] >> endobj -6696 0 obj << +6745 0 obj << +/Type /Pages +/Count 6 +/Parent 7243 0 R +/Kids [6739 0 R 6747 0 R 6752 0 R 6756 0 R 6761 0 R 6774 0 R] +>> endobj +6790 0 obj << /Type /Pages -/Count 1 -/Parent 6731 0 R -/Kids [6663 0 R] +/Count 6 +/Parent 7243 0 R +/Kids [6786 0 R 6792 0 R 6797 0 R 6803 0 R 6807 0 R 6813 0 R] >> endobj -6721 0 obj << +6837 0 obj << +/Type /Pages +/Count 6 +/Parent 7244 0 R +/Kids [6823 0 R 6839 0 R 6846 0 R 6850 0 R 6856 0 R 6863 0 R] +>> endobj +6879 0 obj << +/Type /Pages +/Count 6 +/Parent 7244 0 R +/Kids [6873 0 R 6881 0 R 6888 0 R 6892 0 R 6901 0 R 6908 0 R] +>> endobj +6920 0 obj << +/Type /Pages +/Count 6 +/Parent 7244 0 R +/Kids [6913 0 R 6922 0 R 6936 0 R 6943 0 R 6951 0 R 6959 0 R] +>> endobj +6976 0 obj << +/Type /Pages +/Count 6 +/Parent 7244 0 R +/Kids [6971 0 R 6978 0 R 6988 0 R 6993 0 R 6999 0 R 7003 0 R] +>> endobj +7033 0 obj << +/Type /Pages +/Count 6 +/Parent 7244 0 R +/Kids [7017 0 R 7035 0 R 7041 0 R 7047 0 R 7054 0 R 7058 0 R] +>> endobj +7070 0 obj << +/Type /Pages +/Count 6 +/Parent 7244 0 R +/Kids [7063 0 R 7072 0 R 7076 0 R 7085 0 R 7089 0 R 7101 0 R] +>> endobj +7118 0 obj << +/Type /Pages +/Count 6 +/Parent 7245 0 R +/Kids [7109 0 R 7120 0 R 7128 0 R 7136 0 R 7142 0 R 7150 0 R] +>> endobj +7163 0 obj << +/Type /Pages +/Count 4 +/Parent 7245 0 R +/Kids [7160 0 R 7165 0 R 7170 0 R 7196 0 R] +>> endobj +7233 0 obj << +/Type /Pages +/Count 36 +/Parent 7246 0 R +/Kids [2965 0 R 3122 0 R 3382 0 R 3701 0 R 3990 0 R 4034 0 R] +>> endobj +7234 0 obj << +/Type /Pages +/Count 36 +/Parent 7246 0 R +/Kids [4080 0 R 4139 0 R 4192 0 R 4241 0 R 4287 0 R 4332 0 R] +>> endobj +7235 0 obj << +/Type /Pages +/Count 36 +/Parent 7246 0 R +/Kids [4377 0 R 4426 0 R 4468 0 R 4507 0 R 4556 0 R 4594 0 R] +>> endobj +7236 0 obj << +/Type /Pages +/Count 36 +/Parent 7246 0 R +/Kids [4640 0 R 4683 0 R 4730 0 R 4773 0 R 4819 0 R 4860 0 R] +>> endobj +7237 0 obj << +/Type /Pages +/Count 36 +/Parent 7246 0 R +/Kids [4914 0 R 4954 0 R 4991 0 R 5028 0 R 5083 0 R 5124 0 R] +>> endobj +7238 0 obj << +/Type /Pages +/Count 36 +/Parent 7246 0 R +/Kids [5170 0 R 5204 0 R 5240 0 R 5279 0 R 5311 0 R 5359 0 R] +>> endobj +7239 0 obj << +/Type /Pages +/Count 36 +/Parent 7247 0 R +/Kids [5391 0 R 5438 0 R 5483 0 R 5534 0 R 5592 0 R 5635 0 R] +>> endobj +7240 0 obj << /Type /Pages /Count 36 -/Parent 6732 0 R -/Kids [2869 0 R 3158 0 R 3471 0 R 3770 0 R 3881 0 R 3928 0 R] +/Parent 7247 0 R +/Kids [5701 0 R 5750 0 R 5793 0 R 5843 0 R 5889 0 R 5960 0 R] +>> endobj +7241 0 obj << +/Type /Pages +/Count 36 +/Parent 7247 0 R +/Kids [6020 0 R 6065 0 R 6125 0 R 6174 0 R 6221 0 R 6259 0 R] +>> endobj +7242 0 obj << +/Type /Pages +/Count 36 +/Parent 7247 0 R +/Kids [6302 0 R 6341 0 R 6392 0 R 6459 0 R 6510 0 R 6545 0 R] +>> endobj +7243 0 obj << +/Type /Pages +/Count 36 +/Parent 7247 0 R +/Kids [6575 0 R 6615 0 R 6654 0 R 6698 0 R 6745 0 R 6790 0 R] +>> endobj +7244 0 obj << +/Type /Pages +/Count 36 +/Parent 7247 0 R +/Kids [6837 0 R 6879 0 R 6920 0 R 6976 0 R 7033 0 R 7070 0 R] +>> endobj +7245 0 obj << +/Type /Pages +/Count 10 +/Parent 7248 0 R +/Kids [7118 0 R 7163 0 R] +>> endobj +7246 0 obj << +/Type /Pages +/Count 216 +/Parent 7249 0 R +/Kids [7233 0 R 7234 0 R 7235 0 R 7236 0 R 7237 0 R 7238 0 R] +>> endobj +7247 0 obj << +/Type /Pages +/Count 216 +/Parent 7249 0 R +/Kids [7239 0 R 7240 0 R 7241 0 R 7242 0 R 7243 0 R 7244 0 R] +>> endobj +7248 0 obj << +/Type /Pages +/Count 10 +/Parent 7249 0 R +/Kids [7245 0 R] +>> endobj +7249 0 obj << +/Type /Pages +/Count 442 +/Kids [7246 0 R 7247 0 R 7248 0 R] +>> endobj +7250 0 obj << +/Type /Outlines +/First 7 0 R +/Last 2715 0 R +/Count 6 +>> endobj +2951 0 obj << +/Title 2952 0 R +/A 2949 0 R +/Parent 2943 0 R +/Prev 2947 0 R +>> endobj +2947 0 obj << +/Title 2948 0 R +/A 2945 0 R +/Parent 2943 0 R +/Next 2951 0 R +>> endobj +2943 0 obj << +/Title 2944 0 R +/A 2941 0 R +/Parent 2715 0 R +/Prev 2935 0 R +/First 2947 0 R +/Last 2951 0 R +/Count -2 +>> endobj +2939 0 obj << +/Title 2940 0 R +/A 2937 0 R +/Parent 2935 0 R +>> endobj +2935 0 obj << +/Title 2936 0 R +/A 2933 0 R +/Parent 2715 0 R +/Prev 2887 0 R +/Next 2943 0 R +/First 2939 0 R +/Last 2939 0 R +/Count -1 +>> endobj +2931 0 obj << +/Title 2932 0 R +/A 2929 0 R +/Parent 2887 0 R +/Prev 2927 0 R +>> endobj +2927 0 obj << +/Title 2928 0 R +/A 2925 0 R +/Parent 2887 0 R +/Prev 2923 0 R +/Next 2931 0 R +>> endobj +2923 0 obj << +/Title 2924 0 R +/A 2921 0 R +/Parent 2887 0 R +/Prev 2919 0 R +/Next 2927 0 R +>> endobj +2919 0 obj << +/Title 2920 0 R +/A 2917 0 R +/Parent 2887 0 R +/Prev 2915 0 R +/Next 2923 0 R >> endobj -6722 0 obj << -/Type /Pages -/Count 36 -/Parent 6732 0 R -/Kids [3984 0 R 4028 0 R 4069 0 R 4118 0 R 4163 0 R 4224 0 R] +2915 0 obj << +/Title 2916 0 R +/A 2913 0 R +/Parent 2887 0 R +/Prev 2911 0 R +/Next 2919 0 R >> endobj -6723 0 obj << -/Type /Pages -/Count 36 -/Parent 6732 0 R -/Kids [4261 0 R 4302 0 R 4346 0 R 4390 0 R 4426 0 R 4482 0 R] +2911 0 obj << +/Title 2912 0 R +/A 2909 0 R +/Parent 2887 0 R +/Prev 2907 0 R +/Next 2915 0 R >> endobj -6724 0 obj << -/Type /Pages -/Count 36 -/Parent 6732 0 R -/Kids [4525 0 R 4568 0 R 4612 0 R 4662 0 R 4700 0 R 4739 0 R] +2907 0 obj << +/Title 2908 0 R +/A 2905 0 R +/Parent 2887 0 R +/Prev 2903 0 R +/Next 2911 0 R >> endobj -6725 0 obj << -/Type /Pages -/Count 36 -/Parent 6732 0 R -/Kids [4786 0 R 4830 0 R 4873 0 R 4909 0 R 4945 0 R 4982 0 R] +2903 0 obj << +/Title 2904 0 R +/A 2901 0 R +/Parent 2887 0 R +/Prev 2899 0 R +/Next 2907 0 R >> endobj -6726 0 obj << -/Type /Pages -/Count 36 -/Parent 6732 0 R -/Kids [5016 0 R 5062 0 R 5108 0 R 5154 0 R 5208 0 R 5257 0 R] +2899 0 obj << +/Title 2900 0 R +/A 2897 0 R +/Parent 2887 0 R +/Prev 2895 0 R +/Next 2903 0 R >> endobj -6727 0 obj << -/Type /Pages -/Count 36 -/Parent 6733 0 R -/Kids [5300 0 R 5357 0 R 5398 0 R 5448 0 R 5487 0 R 5548 0 R] +2895 0 obj << +/Title 2896 0 R +/A 2893 0 R +/Parent 2887 0 R +/Prev 2891 0 R +/Next 2899 0 R >> endobj -6728 0 obj << -/Type /Pages -/Count 36 -/Parent 6733 0 R -/Kids [5629 0 R 5668 0 R 5694 0 R 5751 0 R 5801 0 R 5852 0 R] +2891 0 obj << +/Title 2892 0 R +/A 2889 0 R +/Parent 2887 0 R +/Next 2895 0 R >> endobj -6729 0 obj << -/Type /Pages -/Count 36 -/Parent 6733 0 R -/Kids [5897 0 R 5939 0 R 5983 0 R 6039 0 R 6112 0 R 6152 0 R] +2887 0 obj << +/Title 2888 0 R +/A 2885 0 R +/Parent 2715 0 R +/Prev 2819 0 R +/Next 2935 0 R +/First 2891 0 R +/Last 2931 0 R +/Count -11 >> endobj -6730 0 obj << -/Type /Pages -/Count 36 -/Parent 6733 0 R -/Kids [6186 0 R 6227 0 R 6262 0 R 6304 0 R 6342 0 R 6406 0 R] +2883 0 obj << +/Title 2884 0 R +/A 2881 0 R +/Parent 2819 0 R +/Prev 2879 0 R >> endobj -6731 0 obj << -/Type /Pages -/Count 25 -/Parent 6733 0 R -/Kids [6457 0 R 6510 0 R 6566 0 R 6623 0 R 6696 0 R] +2879 0 obj << +/Title 2880 0 R +/A 2877 0 R +/Parent 2819 0 R +/Prev 2871 0 R +/Next 2883 0 R >> endobj -6732 0 obj << -/Type /Pages -/Count 216 -/Parent 6734 0 R -/Kids [6721 0 R 6722 0 R 6723 0 R 6724 0 R 6725 0 R 6726 0 R] +2875 0 obj << +/Title 2876 0 R +/A 2873 0 R +/Parent 2871 0 R >> endobj -6733 0 obj << -/Type /Pages -/Count 169 -/Parent 6734 0 R -/Kids [6727 0 R 6728 0 R 6729 0 R 6730 0 R 6731 0 R] +2871 0 obj << +/Title 2872 0 R +/A 2869 0 R +/Parent 2819 0 R +/Prev 2843 0 R +/Next 2879 0 R +/First 2875 0 R +/Last 2875 0 R +/Count -1 >> endobj -6734 0 obj << -/Type /Pages -/Count 385 -/Kids [6732 0 R 6733 0 R] +2867 0 obj << +/Title 2868 0 R +/A 2865 0 R +/Parent 2843 0 R +/Prev 2863 0 R >> endobj -6735 0 obj << -/Type /Outlines -/First 7 0 R -/Last 2611 0 R -/Count 6 +2863 0 obj << +/Title 2864 0 R +/A 2861 0 R +/Parent 2843 0 R +/Prev 2859 0 R +/Next 2867 0 R +>> endobj +2859 0 obj << +/Title 2860 0 R +/A 2857 0 R +/Parent 2843 0 R +/Prev 2855 0 R +/Next 2863 0 R >> endobj 2855 0 obj << /Title 2856 0 R /A 2853 0 R /Parent 2843 0 R /Prev 2851 0 R +/Next 2859 0 R >> endobj 2851 0 obj << /Title 2852 0 R @@ -32878,313 +35977,318 @@ endobj 2843 0 obj << /Title 2844 0 R /A 2841 0 R -/Parent 2611 0 R -/Prev 2835 0 R +/Parent 2819 0 R +/Prev 2827 0 R +/Next 2871 0 R /First 2847 0 R -/Last 2855 0 R -/Count -3 +/Last 2867 0 R +/Count -6 >> endobj 2839 0 obj << /Title 2840 0 R /A 2837 0 R -/Parent 2835 0 R +/Parent 2827 0 R +/Prev 2835 0 R >> endobj 2835 0 obj << /Title 2836 0 R /A 2833 0 R -/Parent 2611 0 R -/Prev 2787 0 R -/Next 2843 0 R -/First 2839 0 R -/Last 2839 0 R -/Count -1 +/Parent 2827 0 R +/Prev 2831 0 R +/Next 2839 0 R >> endobj 2831 0 obj << /Title 2832 0 R /A 2829 0 R -/Parent 2787 0 R -/Prev 2827 0 R +/Parent 2827 0 R +/Next 2835 0 R >> endobj 2827 0 obj << /Title 2828 0 R /A 2825 0 R -/Parent 2787 0 R +/Parent 2819 0 R /Prev 2823 0 R -/Next 2831 0 R +/Next 2843 0 R +/First 2831 0 R +/Last 2839 0 R +/Count -3 >> endobj 2823 0 obj << /Title 2824 0 R /A 2821 0 R -/Parent 2787 0 R -/Prev 2819 0 R +/Parent 2819 0 R /Next 2827 0 R >> endobj 2819 0 obj << /Title 2820 0 R /A 2817 0 R -/Parent 2787 0 R -/Prev 2815 0 R -/Next 2823 0 R +/Parent 2715 0 R +/Prev 2779 0 R +/Next 2887 0 R +/First 2823 0 R +/Last 2883 0 R +/Count -6 >> endobj 2815 0 obj << /Title 2816 0 R /A 2813 0 R -/Parent 2787 0 R +/Parent 2807 0 R /Prev 2811 0 R -/Next 2819 0 R >> endobj 2811 0 obj << /Title 2812 0 R /A 2809 0 R -/Parent 2787 0 R -/Prev 2807 0 R +/Parent 2807 0 R /Next 2815 0 R >> endobj 2807 0 obj << /Title 2808 0 R /A 2805 0 R -/Parent 2787 0 R -/Prev 2803 0 R -/Next 2811 0 R +/Parent 2779 0 R +/Prev 2799 0 R +/First 2811 0 R +/Last 2815 0 R +/Count -2 >> endobj 2803 0 obj << /Title 2804 0 R /A 2801 0 R -/Parent 2787 0 R -/Prev 2799 0 R -/Next 2807 0 R +/Parent 2799 0 R >> endobj 2799 0 obj << /Title 2800 0 R /A 2797 0 R -/Parent 2787 0 R +/Parent 2779 0 R /Prev 2795 0 R -/Next 2803 0 R +/Next 2807 0 R +/First 2803 0 R +/Last 2803 0 R +/Count -1 >> endobj 2795 0 obj << /Title 2796 0 R /A 2793 0 R -/Parent 2787 0 R +/Parent 2779 0 R /Prev 2791 0 R /Next 2799 0 R >> endobj 2791 0 obj << /Title 2792 0 R /A 2789 0 R -/Parent 2787 0 R +/Parent 2779 0 R +/Prev 2787 0 R /Next 2795 0 R >> endobj 2787 0 obj << /Title 2788 0 R /A 2785 0 R -/Parent 2611 0 R -/Prev 2719 0 R -/Next 2835 0 R -/First 2791 0 R -/Last 2831 0 R -/Count -11 +/Parent 2779 0 R +/Prev 2783 0 R +/Next 2791 0 R >> endobj 2783 0 obj << /Title 2784 0 R /A 2781 0 R -/Parent 2719 0 R -/Prev 2779 0 R +/Parent 2779 0 R +/Next 2787 0 R >> endobj 2779 0 obj << /Title 2780 0 R /A 2777 0 R -/Parent 2719 0 R -/Prev 2771 0 R -/Next 2783 0 R +/Parent 2715 0 R +/Prev 2719 0 R +/Next 2819 0 R +/First 2783 0 R +/Last 2807 0 R +/Count -6 >> endobj 2775 0 obj << /Title 2776 0 R /A 2773 0 R -/Parent 2771 0 R +/Parent 2767 0 R +/Prev 2771 0 R >> endobj 2771 0 obj << /Title 2772 0 R /A 2769 0 R -/Parent 2719 0 R -/Prev 2743 0 R -/Next 2779 0 R -/First 2775 0 R -/Last 2775 0 R -/Count -1 +/Parent 2767 0 R +/Next 2775 0 R >> endobj 2767 0 obj << /Title 2768 0 R /A 2765 0 R -/Parent 2743 0 R -/Prev 2763 0 R +/Parent 2719 0 R +/Prev 2751 0 R +/First 2771 0 R +/Last 2775 0 R +/Count -2 >> endobj 2763 0 obj << /Title 2764 0 R /A 2761 0 R -/Parent 2743 0 R +/Parent 2755 0 R /Prev 2759 0 R -/Next 2767 0 R >> endobj 2759 0 obj << /Title 2760 0 R /A 2757 0 R -/Parent 2743 0 R -/Prev 2755 0 R +/Parent 2755 0 R /Next 2763 0 R >> endobj 2755 0 obj << /Title 2756 0 R /A 2753 0 R -/Parent 2743 0 R -/Prev 2751 0 R -/Next 2759 0 R +/Parent 2751 0 R +/First 2759 0 R +/Last 2763 0 R +/Count -2 >> endobj 2751 0 obj << /Title 2752 0 R /A 2749 0 R -/Parent 2743 0 R +/Parent 2719 0 R /Prev 2747 0 R -/Next 2755 0 R +/Next 2767 0 R +/First 2755 0 R +/Last 2755 0 R +/Count -1 >> endobj 2747 0 obj << /Title 2748 0 R /A 2745 0 R -/Parent 2743 0 R +/Parent 2719 0 R +/Prev 2743 0 R /Next 2751 0 R >> endobj 2743 0 obj << /Title 2744 0 R /A 2741 0 R /Parent 2719 0 R -/Prev 2727 0 R -/Next 2771 0 R -/First 2747 0 R -/Last 2767 0 R -/Count -6 +/Prev 2723 0 R +/Next 2747 0 R >> endobj 2739 0 obj << /Title 2740 0 R /A 2737 0 R -/Parent 2727 0 R +/Parent 2731 0 R /Prev 2735 0 R >> endobj 2735 0 obj << /Title 2736 0 R /A 2733 0 R -/Parent 2727 0 R -/Prev 2731 0 R +/Parent 2731 0 R /Next 2739 0 R >> endobj 2731 0 obj << /Title 2732 0 R /A 2729 0 R -/Parent 2727 0 R -/Next 2735 0 R +/Parent 2723 0 R +/Prev 2727 0 R +/First 2735 0 R +/Last 2739 0 R +/Count -2 >> endobj 2727 0 obj << /Title 2728 0 R /A 2725 0 R -/Parent 2719 0 R -/Prev 2723 0 R -/Next 2743 0 R -/First 2731 0 R -/Last 2739 0 R -/Count -3 +/Parent 2723 0 R +/Next 2731 0 R >> endobj 2723 0 obj << /Title 2724 0 R /A 2721 0 R /Parent 2719 0 R -/Next 2727 0 R +/Next 2743 0 R +/First 2727 0 R +/Last 2731 0 R +/Count -2 >> endobj 2719 0 obj << /Title 2720 0 R /A 2717 0 R -/Parent 2611 0 R -/Prev 2679 0 R -/Next 2787 0 R +/Parent 2715 0 R +/Next 2779 0 R /First 2723 0 R -/Last 2783 0 R -/Count -6 +/Last 2767 0 R +/Count -5 >> endobj 2715 0 obj << /Title 2716 0 R /A 2713 0 R -/Parent 2707 0 R -/Prev 2711 0 R +/Parent 7250 0 R +/Prev 2623 0 R +/First 2719 0 R +/Last 2943 0 R +/Count -6 >> endobj 2711 0 obj << /Title 2712 0 R /A 2709 0 R -/Parent 2707 0 R -/Next 2715 0 R +/Parent 2687 0 R +/Prev 2707 0 R >> endobj 2707 0 obj << /Title 2708 0 R /A 2705 0 R -/Parent 2679 0 R -/Prev 2699 0 R -/First 2711 0 R -/Last 2715 0 R -/Count -2 +/Parent 2687 0 R +/Prev 2703 0 R +/Next 2711 0 R >> endobj 2703 0 obj << /Title 2704 0 R /A 2701 0 R -/Parent 2699 0 R +/Parent 2687 0 R +/Prev 2699 0 R +/Next 2707 0 R >> endobj 2699 0 obj << /Title 2700 0 R /A 2697 0 R -/Parent 2679 0 R +/Parent 2687 0 R /Prev 2695 0 R -/Next 2707 0 R -/First 2703 0 R -/Last 2703 0 R -/Count -1 +/Next 2703 0 R >> endobj 2695 0 obj << /Title 2696 0 R /A 2693 0 R -/Parent 2679 0 R +/Parent 2687 0 R /Prev 2691 0 R /Next 2699 0 R >> endobj 2691 0 obj << /Title 2692 0 R /A 2689 0 R -/Parent 2679 0 R -/Prev 2687 0 R +/Parent 2687 0 R /Next 2695 0 R >> endobj 2687 0 obj << /Title 2688 0 R /A 2685 0 R -/Parent 2679 0 R -/Prev 2683 0 R -/Next 2691 0 R +/Parent 2623 0 R +/Prev 2643 0 R +/First 2691 0 R +/Last 2711 0 R +/Count -6 >> endobj 2683 0 obj << /Title 2684 0 R /A 2681 0 R -/Parent 2679 0 R -/Next 2687 0 R +/Parent 2643 0 R +/Prev 2679 0 R >> endobj 2679 0 obj << /Title 2680 0 R /A 2677 0 R -/Parent 2611 0 R -/Prev 2615 0 R -/Next 2719 0 R -/First 2683 0 R -/Last 2707 0 R -/Count -6 +/Parent 2643 0 R +/Prev 2675 0 R +/Next 2683 0 R >> endobj 2675 0 obj << /Title 2676 0 R /A 2673 0 R -/Parent 2615 0 R -/Prev 2663 0 R +/Parent 2643 0 R +/Prev 2647 0 R +/Next 2679 0 R >> endobj 2671 0 obj << /Title 2672 0 R @@ -33201,9 +36305,8 @@ endobj 2663 0 obj << /Title 2664 0 R /A 2661 0 R -/Parent 2615 0 R -/Prev 2647 0 R -/Next 2675 0 R +/Parent 2647 0 R +/Prev 2659 0 R /First 2667 0 R /Last 2671 0 R /Count -2 @@ -33211,52 +36314,54 @@ endobj 2659 0 obj << /Title 2660 0 R /A 2657 0 R -/Parent 2651 0 R +/Parent 2647 0 R /Prev 2655 0 R +/Next 2663 0 R >> endobj 2655 0 obj << /Title 2656 0 R /A 2653 0 R -/Parent 2651 0 R +/Parent 2647 0 R +/Prev 2651 0 R /Next 2659 0 R >> endobj 2651 0 obj << /Title 2652 0 R /A 2649 0 R /Parent 2647 0 R -/First 2655 0 R -/Last 2659 0 R -/Count -2 +/Next 2655 0 R >> endobj 2647 0 obj << /Title 2648 0 R /A 2645 0 R -/Parent 2615 0 R -/Prev 2643 0 R -/Next 2663 0 R +/Parent 2643 0 R +/Next 2675 0 R /First 2651 0 R -/Last 2651 0 R -/Count -1 +/Last 2663 0 R +/Count -4 >> endobj 2643 0 obj << /Title 2644 0 R /A 2641 0 R -/Parent 2615 0 R -/Prev 2639 0 R -/Next 2647 0 R +/Parent 2623 0 R +/Prev 2627 0 R +/Next 2687 0 R +/First 2647 0 R +/Last 2683 0 R +/Count -4 >> endobj 2639 0 obj << /Title 2640 0 R /A 2637 0 R -/Parent 2615 0 R -/Prev 2619 0 R -/Next 2643 0 R +/Parent 2627 0 R +/Prev 2635 0 R >> endobj 2635 0 obj << /Title 2636 0 R /A 2633 0 R /Parent 2627 0 R /Prev 2631 0 R +/Next 2639 0 R >> endobj 2631 0 obj << /Title 2632 0 R @@ -33267,511 +36372,509 @@ endobj 2627 0 obj << /Title 2628 0 R /A 2625 0 R -/Parent 2619 0 R -/Prev 2623 0 R +/Parent 2623 0 R +/Next 2643 0 R /First 2631 0 R -/Last 2635 0 R -/Count -2 +/Last 2639 0 R +/Count -3 >> endobj 2623 0 obj << /Title 2624 0 R /A 2621 0 R -/Parent 2619 0 R -/Next 2627 0 R +/Parent 7250 0 R +/Prev 2459 0 R +/Next 2715 0 R +/First 2627 0 R +/Last 2687 0 R +/Count -3 >> endobj 2619 0 obj << /Title 2620 0 R /A 2617 0 R -/Parent 2615 0 R -/Next 2639 0 R -/First 2623 0 R -/Last 2627 0 R -/Count -2 +/Parent 2579 0 R +/Prev 2615 0 R >> endobj 2615 0 obj << /Title 2616 0 R /A 2613 0 R -/Parent 2611 0 R -/Next 2679 0 R -/First 2619 0 R -/Last 2675 0 R -/Count -6 +/Parent 2579 0 R +/Prev 2611 0 R +/Next 2619 0 R >> endobj 2611 0 obj << /Title 2612 0 R /A 2609 0 R -/Parent 6735 0 R -/Prev 2535 0 R -/First 2615 0 R -/Last 2843 0 R -/Count -6 +/Parent 2579 0 R +/Prev 2607 0 R +/Next 2615 0 R >> endobj 2607 0 obj << /Title 2608 0 R /A 2605 0 R -/Parent 2583 0 R +/Parent 2579 0 R /Prev 2603 0 R +/Next 2611 0 R >> endobj 2603 0 obj << /Title 2604 0 R /A 2601 0 R -/Parent 2583 0 R +/Parent 2579 0 R /Prev 2599 0 R /Next 2607 0 R >> endobj 2599 0 obj << /Title 2600 0 R /A 2597 0 R -/Parent 2583 0 R +/Parent 2579 0 R /Prev 2595 0 R /Next 2603 0 R >> endobj 2595 0 obj << /Title 2596 0 R /A 2593 0 R -/Parent 2583 0 R +/Parent 2579 0 R /Prev 2591 0 R /Next 2599 0 R >> endobj 2591 0 obj << /Title 2592 0 R /A 2589 0 R -/Parent 2583 0 R +/Parent 2579 0 R /Prev 2587 0 R /Next 2595 0 R >> endobj 2587 0 obj << /Title 2588 0 R /A 2585 0 R -/Parent 2583 0 R +/Parent 2579 0 R +/Prev 2583 0 R /Next 2591 0 R >> endobj 2583 0 obj << /Title 2584 0 R /A 2581 0 R -/Parent 2535 0 R -/Prev 2559 0 R -/First 2587 0 R -/Last 2607 0 R -/Count -6 +/Parent 2579 0 R +/Next 2587 0 R >> endobj 2579 0 obj << /Title 2580 0 R /A 2577 0 R -/Parent 2559 0 R -/Prev 2575 0 R +/Parent 2575 0 R +/First 2583 0 R +/Last 2619 0 R +/Count -10 >> endobj 2575 0 obj << /Title 2576 0 R /A 2573 0 R -/Parent 2559 0 R -/Prev 2571 0 R -/Next 2579 0 R +/Parent 2459 0 R +/Prev 2527 0 R +/First 2579 0 R +/Last 2579 0 R +/Count -1 >> endobj 2571 0 obj << /Title 2572 0 R /A 2569 0 R -/Parent 2559 0 R +/Parent 2563 0 R /Prev 2567 0 R -/Next 2575 0 R >> endobj 2567 0 obj << /Title 2568 0 R /A 2565 0 R -/Parent 2559 0 R -/Prev 2563 0 R +/Parent 2563 0 R /Next 2571 0 R >> endobj 2563 0 obj << /Title 2564 0 R /A 2561 0 R -/Parent 2559 0 R -/Next 2567 0 R +/Parent 2527 0 R +/Prev 2531 0 R +/First 2567 0 R +/Last 2571 0 R +/Count -2 >> endobj 2559 0 obj << /Title 2560 0 R /A 2557 0 R -/Parent 2535 0 R -/Prev 2539 0 R -/Next 2583 0 R -/First 2563 0 R -/Last 2579 0 R -/Count -5 +/Parent 2531 0 R +/Prev 2535 0 R >> endobj 2555 0 obj << /Title 2556 0 R /A 2553 0 R -/Parent 2539 0 R +/Parent 2535 0 R /Prev 2551 0 R >> endobj 2551 0 obj << /Title 2552 0 R /A 2549 0 R -/Parent 2539 0 R +/Parent 2535 0 R /Prev 2547 0 R /Next 2555 0 R >> endobj 2547 0 obj << /Title 2548 0 R /A 2545 0 R -/Parent 2539 0 R +/Parent 2535 0 R /Prev 2543 0 R /Next 2551 0 R >> endobj 2543 0 obj << /Title 2544 0 R /A 2541 0 R -/Parent 2539 0 R +/Parent 2535 0 R +/Prev 2539 0 R /Next 2547 0 R >> endobj 2539 0 obj << /Title 2540 0 R /A 2537 0 R /Parent 2535 0 R -/Next 2559 0 R -/First 2543 0 R -/Last 2555 0 R -/Count -4 +/Next 2543 0 R >> endobj 2535 0 obj << /Title 2536 0 R /A 2533 0 R -/Parent 6735 0 R -/Prev 2419 0 R -/Next 2611 0 R +/Parent 2531 0 R +/Next 2559 0 R /First 2539 0 R -/Last 2583 0 R -/Count -3 +/Last 2555 0 R +/Count -5 >> endobj 2531 0 obj << /Title 2532 0 R /A 2529 0 R -/Parent 2491 0 R -/Prev 2527 0 R +/Parent 2527 0 R +/Next 2563 0 R +/First 2535 0 R +/Last 2559 0 R +/Count -2 >> endobj 2527 0 obj << /Title 2528 0 R /A 2525 0 R -/Parent 2491 0 R -/Prev 2523 0 R -/Next 2531 0 R +/Parent 2459 0 R +/Prev 2463 0 R +/Next 2575 0 R +/First 2531 0 R +/Last 2563 0 R +/Count -2 >> endobj 2523 0 obj << /Title 2524 0 R /A 2521 0 R -/Parent 2491 0 R +/Parent 2511 0 R /Prev 2519 0 R -/Next 2527 0 R >> endobj 2519 0 obj << /Title 2520 0 R /A 2517 0 R -/Parent 2491 0 R +/Parent 2511 0 R /Prev 2515 0 R /Next 2523 0 R >> endobj 2515 0 obj << /Title 2516 0 R /A 2513 0 R -/Parent 2491 0 R -/Prev 2511 0 R +/Parent 2511 0 R /Next 2519 0 R >> endobj 2511 0 obj << /Title 2512 0 R /A 2509 0 R -/Parent 2491 0 R +/Parent 2487 0 R /Prev 2507 0 R -/Next 2515 0 R +/First 2515 0 R +/Last 2523 0 R +/Count -3 >> endobj 2507 0 obj << /Title 2508 0 R /A 2505 0 R -/Parent 2491 0 R +/Parent 2487 0 R /Prev 2503 0 R /Next 2511 0 R >> endobj 2503 0 obj << /Title 2504 0 R /A 2501 0 R -/Parent 2491 0 R +/Parent 2487 0 R /Prev 2499 0 R /Next 2507 0 R >> endobj 2499 0 obj << /Title 2500 0 R /A 2497 0 R -/Parent 2491 0 R +/Parent 2487 0 R /Prev 2495 0 R /Next 2503 0 R >> endobj 2495 0 obj << /Title 2496 0 R /A 2493 0 R -/Parent 2491 0 R +/Parent 2487 0 R +/Prev 2491 0 R /Next 2499 0 R >> endobj 2491 0 obj << /Title 2492 0 R /A 2489 0 R /Parent 2487 0 R -/First 2495 0 R -/Last 2531 0 R -/Count -10 +/Next 2495 0 R >> endobj 2487 0 obj << /Title 2488 0 R /A 2485 0 R -/Parent 2419 0 R -/Prev 2439 0 R +/Parent 2463 0 R +/Prev 2471 0 R /First 2491 0 R -/Last 2491 0 R -/Count -1 +/Last 2511 0 R +/Count -6 >> endobj 2483 0 obj << /Title 2484 0 R /A 2481 0 R -/Parent 2475 0 R +/Parent 2471 0 R /Prev 2479 0 R >> endobj 2479 0 obj << /Title 2480 0 R /A 2477 0 R -/Parent 2475 0 R +/Parent 2471 0 R +/Prev 2475 0 R /Next 2483 0 R >> endobj 2475 0 obj << /Title 2476 0 R /A 2473 0 R -/Parent 2439 0 R -/Prev 2443 0 R -/First 2479 0 R -/Last 2483 0 R -/Count -2 +/Parent 2471 0 R +/Next 2479 0 R >> endobj 2471 0 obj << /Title 2472 0 R /A 2469 0 R -/Parent 2443 0 R -/Prev 2447 0 R +/Parent 2463 0 R +/Prev 2467 0 R +/Next 2487 0 R +/First 2475 0 R +/Last 2483 0 R +/Count -3 >> endobj 2467 0 obj << /Title 2468 0 R /A 2465 0 R -/Parent 2447 0 R -/Prev 2463 0 R +/Parent 2463 0 R +/Next 2471 0 R >> endobj 2463 0 obj << /Title 2464 0 R /A 2461 0 R -/Parent 2447 0 R -/Prev 2459 0 R -/Next 2467 0 R +/Parent 2459 0 R +/Next 2527 0 R +/First 2467 0 R +/Last 2487 0 R +/Count -3 >> endobj 2459 0 obj << /Title 2460 0 R /A 2457 0 R -/Parent 2447 0 R -/Prev 2455 0 R -/Next 2463 0 R +/Parent 7250 0 R +/Prev 463 0 R +/Next 2623 0 R +/First 2463 0 R +/Last 2575 0 R +/Count -3 >> endobj 2455 0 obj << /Title 2456 0 R /A 2453 0 R -/Parent 2447 0 R -/Prev 2451 0 R -/Next 2459 0 R +/Parent 2451 0 R >> endobj 2451 0 obj << /Title 2452 0 R /A 2449 0 R -/Parent 2447 0 R -/Next 2455 0 R +/Parent 463 0 R +/Prev 2439 0 R +/First 2455 0 R +/Last 2455 0 R +/Count -1 >> endobj 2447 0 obj << /Title 2448 0 R /A 2445 0 R -/Parent 2443 0 R -/Next 2471 0 R -/First 2451 0 R -/Last 2467 0 R -/Count -5 +/Parent 2439 0 R +/Prev 2443 0 R >> endobj 2443 0 obj << /Title 2444 0 R /A 2441 0 R /Parent 2439 0 R -/Next 2475 0 R -/First 2447 0 R -/Last 2471 0 R -/Count -2 +/Next 2447 0 R >> endobj 2439 0 obj << /Title 2440 0 R /A 2437 0 R -/Parent 2419 0 R -/Prev 2423 0 R -/Next 2487 0 R +/Parent 463 0 R +/Prev 2407 0 R +/Next 2451 0 R /First 2443 0 R -/Last 2475 0 R +/Last 2447 0 R /Count -2 >> endobj 2435 0 obj << /Title 2436 0 R /A 2433 0 R -/Parent 2423 0 R -/Prev 2431 0 R +/Parent 2431 0 R >> endobj 2431 0 obj << /Title 2432 0 R /A 2429 0 R -/Parent 2423 0 R +/Parent 2407 0 R /Prev 2427 0 R -/Next 2435 0 R +/First 2435 0 R +/Last 2435 0 R +/Count -1 >> endobj 2427 0 obj << /Title 2428 0 R /A 2425 0 R -/Parent 2423 0 R +/Parent 2407 0 R +/Prev 2423 0 R /Next 2431 0 R >> endobj 2423 0 obj << /Title 2424 0 R /A 2421 0 R -/Parent 2419 0 R -/Next 2439 0 R -/First 2427 0 R -/Last 2435 0 R -/Count -3 +/Parent 2407 0 R +/Prev 2419 0 R +/Next 2427 0 R >> endobj 2419 0 obj << /Title 2420 0 R /A 2417 0 R -/Parent 6735 0 R -/Prev 455 0 R -/Next 2535 0 R -/First 2423 0 R -/Last 2487 0 R -/Count -3 +/Parent 2407 0 R +/Prev 2415 0 R +/Next 2423 0 R >> endobj 2415 0 obj << /Title 2416 0 R /A 2413 0 R -/Parent 2411 0 R +/Parent 2407 0 R +/Prev 2411 0 R +/Next 2419 0 R >> endobj 2411 0 obj << /Title 2412 0 R /A 2409 0 R -/Parent 455 0 R -/Prev 2399 0 R -/First 2415 0 R -/Last 2415 0 R -/Count -1 +/Parent 2407 0 R +/Next 2415 0 R >> endobj 2407 0 obj << /Title 2408 0 R /A 2405 0 R -/Parent 2399 0 R -/Prev 2403 0 R +/Parent 463 0 R +/Prev 2335 0 R +/Next 2439 0 R +/First 2411 0 R +/Last 2431 0 R +/Count -6 >> endobj 2403 0 obj << /Title 2404 0 R /A 2401 0 R -/Parent 2399 0 R -/Next 2407 0 R +/Parent 2391 0 R +/Prev 2399 0 R >> endobj 2399 0 obj << /Title 2400 0 R /A 2397 0 R -/Parent 455 0 R -/Prev 2375 0 R -/Next 2411 0 R -/First 2403 0 R -/Last 2407 0 R -/Count -2 +/Parent 2391 0 R +/Prev 2395 0 R +/Next 2403 0 R >> endobj 2395 0 obj << /Title 2396 0 R /A 2393 0 R -/Parent 2375 0 R -/Prev 2391 0 R +/Parent 2391 0 R +/Next 2399 0 R >> endobj 2391 0 obj << /Title 2392 0 R /A 2389 0 R -/Parent 2375 0 R -/Prev 2387 0 R -/Next 2395 0 R +/Parent 2335 0 R +/Prev 2367 0 R +/First 2395 0 R +/Last 2403 0 R +/Count -3 >> endobj 2387 0 obj << /Title 2388 0 R /A 2385 0 R -/Parent 2375 0 R +/Parent 2367 0 R /Prev 2383 0 R -/Next 2391 0 R >> endobj 2383 0 obj << /Title 2384 0 R /A 2381 0 R -/Parent 2375 0 R +/Parent 2367 0 R /Prev 2379 0 R /Next 2387 0 R >> endobj 2379 0 obj << /Title 2380 0 R /A 2377 0 R -/Parent 2375 0 R +/Parent 2367 0 R +/Prev 2375 0 R /Next 2383 0 R >> endobj 2375 0 obj << /Title 2376 0 R /A 2373 0 R -/Parent 455 0 R -/Prev 2303 0 R -/Next 2399 0 R -/First 2379 0 R -/Last 2395 0 R -/Count -5 +/Parent 2367 0 R +/Prev 2371 0 R +/Next 2379 0 R >> endobj 2371 0 obj << /Title 2372 0 R /A 2369 0 R -/Parent 2359 0 R -/Prev 2367 0 R +/Parent 2367 0 R +/Next 2375 0 R >> endobj 2367 0 obj << /Title 2368 0 R /A 2365 0 R -/Parent 2359 0 R -/Prev 2363 0 R -/Next 2371 0 R +/Parent 2335 0 R +/Prev 2347 0 R +/Next 2391 0 R +/First 2371 0 R +/Last 2387 0 R +/Count -5 >> endobj 2363 0 obj << /Title 2364 0 R /A 2361 0 R -/Parent 2359 0 R -/Next 2367 0 R +/Parent 2347 0 R +/Prev 2359 0 R >> endobj 2359 0 obj << /Title 2360 0 R /A 2357 0 R -/Parent 2303 0 R -/Prev 2335 0 R -/First 2363 0 R -/Last 2371 0 R -/Count -3 +/Parent 2347 0 R +/Prev 2355 0 R +/Next 2363 0 R >> endobj 2355 0 obj << /Title 2356 0 R /A 2353 0 R -/Parent 2335 0 R +/Parent 2347 0 R /Prev 2351 0 R +/Next 2359 0 R >> endobj 2351 0 obj << /Title 2352 0 R /A 2349 0 R -/Parent 2335 0 R -/Prev 2347 0 R +/Parent 2347 0 R /Next 2355 0 R >> endobj 2347 0 obj << @@ -33779,7 +36882,10 @@ endobj /A 2345 0 R /Parent 2335 0 R /Prev 2343 0 R -/Next 2351 0 R +/Next 2367 0 R +/First 2351 0 R +/Last 2363 0 R +/Count -4 >> endobj 2343 0 obj << /Title 2344 0 R @@ -33797,48 +36903,46 @@ endobj 2335 0 obj << /Title 2336 0 R /A 2333 0 R -/Parent 2303 0 R -/Prev 2315 0 R -/Next 2359 0 R +/Parent 463 0 R +/Prev 2263 0 R +/Next 2407 0 R /First 2339 0 R -/Last 2355 0 R +/Last 2391 0 R /Count -5 >> endobj 2331 0 obj << /Title 2332 0 R /A 2329 0 R -/Parent 2315 0 R +/Parent 2323 0 R /Prev 2327 0 R >> endobj 2327 0 obj << /Title 2328 0 R /A 2325 0 R -/Parent 2315 0 R -/Prev 2323 0 R +/Parent 2323 0 R /Next 2331 0 R >> endobj 2323 0 obj << /Title 2324 0 R /A 2321 0 R -/Parent 2315 0 R -/Prev 2319 0 R -/Next 2327 0 R +/Parent 2263 0 R +/Prev 2271 0 R +/First 2327 0 R +/Last 2331 0 R +/Count -2 >> endobj 2319 0 obj << /Title 2320 0 R /A 2317 0 R -/Parent 2315 0 R -/Next 2323 0 R +/Parent 2303 0 R +/Prev 2315 0 R >> endobj 2315 0 obj << /Title 2316 0 R /A 2313 0 R /Parent 2303 0 R /Prev 2311 0 R -/Next 2335 0 R -/First 2319 0 R -/Last 2331 0 R -/Count -4 +/Next 2319 0 R >> endobj 2311 0 obj << /Title 2312 0 R @@ -33856,165 +36960,166 @@ endobj 2303 0 obj << /Title 2304 0 R /A 2301 0 R -/Parent 455 0 R -/Prev 2235 0 R -/Next 2375 0 R +/Parent 2271 0 R +/Prev 2299 0 R /First 2307 0 R -/Last 2359 0 R -/Count -5 +/Last 2319 0 R +/Count -4 >> endobj 2299 0 obj << /Title 2300 0 R /A 2297 0 R -/Parent 2295 0 R +/Parent 2271 0 R +/Prev 2295 0 R +/Next 2303 0 R >> endobj 2295 0 obj << /Title 2296 0 R /A 2293 0 R -/Parent 2235 0 R -/Prev 2243 0 R -/First 2299 0 R -/Last 2299 0 R -/Count -1 +/Parent 2271 0 R +/Prev 2283 0 R +/Next 2299 0 R >> endobj 2291 0 obj << /Title 2292 0 R /A 2289 0 R -/Parent 2275 0 R +/Parent 2283 0 R /Prev 2287 0 R >> endobj 2287 0 obj << /Title 2288 0 R /A 2285 0 R -/Parent 2275 0 R -/Prev 2283 0 R +/Parent 2283 0 R /Next 2291 0 R >> endobj 2283 0 obj << /Title 2284 0 R /A 2281 0 R -/Parent 2275 0 R -/Prev 2279 0 R -/Next 2287 0 R +/Parent 2271 0 R +/Prev 2275 0 R +/Next 2295 0 R +/First 2287 0 R +/Last 2291 0 R +/Count -2 >> endobj 2279 0 obj << /Title 2280 0 R /A 2277 0 R /Parent 2275 0 R -/Next 2283 0 R >> endobj 2275 0 obj << /Title 2276 0 R /A 2273 0 R -/Parent 2243 0 R -/Prev 2271 0 R +/Parent 2271 0 R +/Next 2283 0 R /First 2279 0 R -/Last 2291 0 R -/Count -4 +/Last 2279 0 R +/Count -1 >> endobj 2271 0 obj << /Title 2272 0 R /A 2269 0 R -/Parent 2243 0 R +/Parent 2263 0 R /Prev 2267 0 R -/Next 2275 0 R +/Next 2323 0 R +/First 2275 0 R +/Last 2303 0 R +/Count -5 >> endobj 2267 0 obj << /Title 2268 0 R /A 2265 0 R -/Parent 2243 0 R -/Prev 2255 0 R +/Parent 2263 0 R /Next 2271 0 R >> endobj 2263 0 obj << /Title 2264 0 R /A 2261 0 R -/Parent 2255 0 R -/Prev 2259 0 R +/Parent 463 0 R +/Prev 2147 0 R +/Next 2335 0 R +/First 2267 0 R +/Last 2323 0 R +/Count -3 >> endobj 2259 0 obj << /Title 2260 0 R /A 2257 0 R -/Parent 2255 0 R -/Next 2263 0 R +/Parent 2247 0 R +/Prev 2255 0 R >> endobj 2255 0 obj << /Title 2256 0 R /A 2253 0 R -/Parent 2243 0 R -/Prev 2247 0 R -/Next 2267 0 R -/First 2259 0 R -/Last 2263 0 R -/Count -2 +/Parent 2247 0 R +/Prev 2251 0 R +/Next 2259 0 R >> endobj 2251 0 obj << /Title 2252 0 R /A 2249 0 R /Parent 2247 0 R +/Next 2255 0 R >> endobj 2247 0 obj << /Title 2248 0 R /A 2245 0 R -/Parent 2243 0 R -/Next 2255 0 R +/Parent 2147 0 R +/Prev 2227 0 R /First 2251 0 R -/Last 2251 0 R -/Count -1 +/Last 2259 0 R +/Count -3 >> endobj 2243 0 obj << /Title 2244 0 R /A 2241 0 R -/Parent 2235 0 R +/Parent 2227 0 R /Prev 2239 0 R -/Next 2295 0 R -/First 2247 0 R -/Last 2275 0 R -/Count -5 >> endobj 2239 0 obj << /Title 2240 0 R /A 2237 0 R -/Parent 2235 0 R +/Parent 2227 0 R +/Prev 2231 0 R /Next 2243 0 R >> endobj 2235 0 obj << /Title 2236 0 R /A 2233 0 R -/Parent 455 0 R -/Prev 2119 0 R -/Next 2303 0 R -/First 2239 0 R -/Last 2295 0 R -/Count -3 +/Parent 2231 0 R >> endobj 2231 0 obj << /Title 2232 0 R /A 2229 0 R -/Parent 2219 0 R -/Prev 2227 0 R +/Parent 2227 0 R +/Next 2239 0 R +/First 2235 0 R +/Last 2235 0 R +/Count -1 >> endobj 2227 0 obj << /Title 2228 0 R /A 2225 0 R -/Parent 2219 0 R +/Parent 2147 0 R /Prev 2223 0 R -/Next 2231 0 R +/Next 2247 0 R +/First 2231 0 R +/Last 2243 0 R +/Count -3 >> endobj 2223 0 obj << /Title 2224 0 R /A 2221 0 R -/Parent 2219 0 R +/Parent 2147 0 R +/Prev 2219 0 R /Next 2227 0 R >> endobj 2219 0 obj << /Title 2220 0 R /A 2217 0 R -/Parent 2119 0 R -/Prev 2199 0 R -/First 2223 0 R -/Last 2231 0 R -/Count -3 +/Parent 2147 0 R +/Prev 2155 0 R +/Next 2223 0 R >> endobj 2215 0 obj << /Title 2216 0 R @@ -34026,162 +37131,161 @@ endobj /Title 2212 0 R /A 2209 0 R /Parent 2199 0 R -/Prev 2203 0 R +/Prev 2207 0 R /Next 2215 0 R >> endobj 2207 0 obj << /Title 2208 0 R /A 2205 0 R -/Parent 2203 0 R +/Parent 2199 0 R +/Prev 2203 0 R +/Next 2211 0 R >> endobj 2203 0 obj << /Title 2204 0 R /A 2201 0 R /Parent 2199 0 R -/Next 2211 0 R -/First 2207 0 R -/Last 2207 0 R -/Count -1 +/Next 2207 0 R >> endobj 2199 0 obj << /Title 2200 0 R /A 2197 0 R -/Parent 2119 0 R +/Parent 2155 0 R /Prev 2195 0 R -/Next 2219 0 R /First 2203 0 R /Last 2215 0 R -/Count -3 +/Count -4 >> endobj 2195 0 obj << /Title 2196 0 R /A 2193 0 R -/Parent 2119 0 R -/Prev 2191 0 R +/Parent 2155 0 R +/Prev 2179 0 R /Next 2199 0 R >> endobj 2191 0 obj << /Title 2192 0 R /A 2189 0 R -/Parent 2119 0 R -/Prev 2127 0 R -/Next 2195 0 R +/Parent 2179 0 R +/Prev 2187 0 R >> endobj 2187 0 obj << /Title 2188 0 R /A 2185 0 R -/Parent 2171 0 R +/Parent 2179 0 R /Prev 2183 0 R +/Next 2191 0 R >> endobj 2183 0 obj << /Title 2184 0 R /A 2181 0 R -/Parent 2171 0 R -/Prev 2179 0 R +/Parent 2179 0 R /Next 2187 0 R >> endobj 2179 0 obj << /Title 2180 0 R /A 2177 0 R -/Parent 2171 0 R -/Prev 2175 0 R -/Next 2183 0 R +/Parent 2155 0 R +/Prev 2159 0 R +/Next 2195 0 R +/First 2183 0 R +/Last 2191 0 R +/Count -3 >> endobj 2175 0 obj << /Title 2176 0 R /A 2173 0 R -/Parent 2171 0 R -/Next 2179 0 R +/Parent 2159 0 R +/Prev 2171 0 R >> endobj 2171 0 obj << /Title 2172 0 R /A 2169 0 R -/Parent 2127 0 R +/Parent 2159 0 R /Prev 2167 0 R -/First 2175 0 R -/Last 2187 0 R -/Count -4 +/Next 2175 0 R >> endobj 2167 0 obj << /Title 2168 0 R /A 2165 0 R -/Parent 2127 0 R -/Prev 2151 0 R +/Parent 2159 0 R +/Prev 2163 0 R /Next 2171 0 R >> endobj 2163 0 obj << /Title 2164 0 R /A 2161 0 R -/Parent 2151 0 R -/Prev 2159 0 R +/Parent 2159 0 R +/Next 2167 0 R >> endobj 2159 0 obj << /Title 2160 0 R /A 2157 0 R -/Parent 2151 0 R -/Prev 2155 0 R -/Next 2163 0 R +/Parent 2155 0 R +/Next 2179 0 R +/First 2163 0 R +/Last 2175 0 R +/Count -4 >> endobj 2155 0 obj << /Title 2156 0 R /A 2153 0 R -/Parent 2151 0 R -/Next 2159 0 R +/Parent 2147 0 R +/Prev 2151 0 R +/Next 2219 0 R +/First 2159 0 R +/Last 2199 0 R +/Count -4 >> endobj 2151 0 obj << /Title 2152 0 R /A 2149 0 R -/Parent 2127 0 R -/Prev 2131 0 R -/Next 2167 0 R -/First 2155 0 R -/Last 2163 0 R -/Count -3 +/Parent 2147 0 R +/Next 2155 0 R >> endobj 2147 0 obj << /Title 2148 0 R /A 2145 0 R -/Parent 2131 0 R -/Prev 2143 0 R +/Parent 463 0 R +/Prev 2087 0 R +/Next 2263 0 R +/First 2151 0 R +/Last 2247 0 R +/Count -6 >> endobj 2143 0 obj << /Title 2144 0 R /A 2141 0 R -/Parent 2131 0 R -/Prev 2139 0 R -/Next 2147 0 R +/Parent 2139 0 R >> endobj 2139 0 obj << /Title 2140 0 R /A 2137 0 R -/Parent 2131 0 R +/Parent 2087 0 R /Prev 2135 0 R -/Next 2143 0 R +/First 2143 0 R +/Last 2143 0 R +/Count -1 >> endobj 2135 0 obj << /Title 2136 0 R /A 2133 0 R -/Parent 2131 0 R +/Parent 2087 0 R +/Prev 2119 0 R /Next 2139 0 R >> endobj 2131 0 obj << /Title 2132 0 R /A 2129 0 R -/Parent 2127 0 R -/Next 2151 0 R -/First 2135 0 R -/Last 2147 0 R -/Count -4 +/Parent 2119 0 R +/Prev 2127 0 R >> endobj 2127 0 obj << /Title 2128 0 R /A 2125 0 R /Parent 2119 0 R /Prev 2123 0 R -/Next 2191 0 R -/First 2131 0 R -/Last 2171 0 R -/Count -4 +/Next 2131 0 R >> endobj 2123 0 obj << /Title 2124 0 R @@ -34192,12 +37296,12 @@ endobj 2119 0 obj << /Title 2120 0 R /A 2117 0 R -/Parent 455 0 R -/Prev 2059 0 R -/Next 2235 0 R +/Parent 2087 0 R +/Prev 2095 0 R +/Next 2135 0 R /First 2123 0 R -/Last 2219 0 R -/Count -6 +/Last 2131 0 R +/Count -3 >> endobj 2115 0 obj << /Title 2116 0 R @@ -34207,8 +37311,8 @@ endobj 2111 0 obj << /Title 2112 0 R /A 2109 0 R -/Parent 2059 0 R -/Prev 2107 0 R +/Parent 2095 0 R +/Prev 2103 0 R /First 2115 0 R /Last 2115 0 R /Count -1 @@ -34216,52 +37320,55 @@ endobj 2107 0 obj << /Title 2108 0 R /A 2105 0 R -/Parent 2059 0 R -/Prev 2091 0 R -/Next 2111 0 R +/Parent 2103 0 R >> endobj 2103 0 obj << /Title 2104 0 R /A 2101 0 R -/Parent 2091 0 R +/Parent 2095 0 R /Prev 2099 0 R +/Next 2111 0 R +/First 2107 0 R +/Last 2107 0 R +/Count -1 >> endobj 2099 0 obj << /Title 2100 0 R /A 2097 0 R -/Parent 2091 0 R -/Prev 2095 0 R +/Parent 2095 0 R /Next 2103 0 R >> endobj 2095 0 obj << /Title 2096 0 R /A 2093 0 R -/Parent 2091 0 R -/Next 2099 0 R +/Parent 2087 0 R +/Prev 2091 0 R +/Next 2119 0 R +/First 2099 0 R +/Last 2111 0 R +/Count -3 >> endobj 2091 0 obj << /Title 2092 0 R /A 2089 0 R -/Parent 2059 0 R -/Prev 2067 0 R -/Next 2107 0 R -/First 2095 0 R -/Last 2103 0 R -/Count -3 +/Parent 2087 0 R +/Next 2095 0 R >> endobj 2087 0 obj << /Title 2088 0 R /A 2085 0 R -/Parent 2083 0 R +/Parent 463 0 R +/Prev 2055 0 R +/Next 2147 0 R +/First 2091 0 R +/Last 2139 0 R +/Count -5 >> endobj 2083 0 obj << /Title 2084 0 R /A 2081 0 R -/Parent 2067 0 R +/Parent 2055 0 R /Prev 2075 0 R -/First 2087 0 R -/Last 2087 0 R -/Count -1 >> endobj 2079 0 obj << /Title 2080 0 R @@ -34271,8 +37378,8 @@ endobj 2075 0 obj << /Title 2076 0 R /A 2073 0 R -/Parent 2067 0 R -/Prev 2071 0 R +/Parent 2055 0 R +/Prev 2067 0 R /Next 2083 0 R /First 2079 0 R /Last 2079 0 R @@ -34282,39 +37389,39 @@ endobj /Title 2072 0 R /A 2069 0 R /Parent 2067 0 R -/Next 2075 0 R >> endobj 2067 0 obj << /Title 2068 0 R /A 2065 0 R -/Parent 2059 0 R +/Parent 2055 0 R /Prev 2063 0 R -/Next 2091 0 R +/Next 2075 0 R /First 2071 0 R -/Last 2083 0 R -/Count -3 +/Last 2071 0 R +/Count -1 >> endobj 2063 0 obj << /Title 2064 0 R /A 2061 0 R -/Parent 2059 0 R +/Parent 2055 0 R +/Prev 2059 0 R /Next 2067 0 R >> endobj 2059 0 obj << /Title 2060 0 R /A 2057 0 R -/Parent 455 0 R -/Prev 2027 0 R -/Next 2119 0 R -/First 2063 0 R -/Last 2111 0 R -/Count -5 +/Parent 2055 0 R +/Next 2063 0 R >> endobj 2055 0 obj << /Title 2056 0 R /A 2053 0 R -/Parent 2027 0 R -/Prev 2047 0 R +/Parent 463 0 R +/Prev 1951 0 R +/Next 2087 0 R +/First 2059 0 R +/Last 2083 0 R +/Count -5 >> endobj 2051 0 obj << /Title 2052 0 R @@ -34324,9 +37431,8 @@ endobj 2047 0 obj << /Title 2048 0 R /A 2045 0 R -/Parent 2027 0 R -/Prev 2039 0 R -/Next 2055 0 R +/Parent 1951 0 R +/Prev 2043 0 R /First 2051 0 R /Last 2051 0 R /Count -1 @@ -34334,106 +37440,107 @@ endobj 2043 0 obj << /Title 2044 0 R /A 2041 0 R -/Parent 2039 0 R +/Parent 1951 0 R +/Prev 1999 0 R +/Next 2047 0 R >> endobj 2039 0 obj << /Title 2040 0 R /A 2037 0 R -/Parent 2027 0 R +/Parent 2011 0 R /Prev 2035 0 R -/Next 2047 0 R -/First 2043 0 R -/Last 2043 0 R -/Count -1 >> endobj 2035 0 obj << /Title 2036 0 R /A 2033 0 R -/Parent 2027 0 R +/Parent 2011 0 R /Prev 2031 0 R /Next 2039 0 R >> endobj 2031 0 obj << /Title 2032 0 R /A 2029 0 R -/Parent 2027 0 R +/Parent 2011 0 R +/Prev 2027 0 R /Next 2035 0 R >> endobj 2027 0 obj << /Title 2028 0 R /A 2025 0 R -/Parent 455 0 R -/Prev 1923 0 R -/Next 2059 0 R -/First 2031 0 R -/Last 2055 0 R -/Count -5 +/Parent 2011 0 R +/Prev 2023 0 R +/Next 2031 0 R >> endobj 2023 0 obj << /Title 2024 0 R /A 2021 0 R -/Parent 1923 0 R +/Parent 2011 0 R /Prev 2019 0 R +/Next 2027 0 R >> endobj 2019 0 obj << /Title 2020 0 R /A 2017 0 R -/Parent 1923 0 R -/Prev 1971 0 R +/Parent 2011 0 R +/Prev 2015 0 R /Next 2023 0 R >> endobj 2015 0 obj << /Title 2016 0 R /A 2013 0 R -/Parent 1983 0 R -/Prev 2011 0 R +/Parent 2011 0 R +/Next 2019 0 R >> endobj 2011 0 obj << /Title 2012 0 R /A 2009 0 R -/Parent 1983 0 R +/Parent 1999 0 R /Prev 2007 0 R -/Next 2015 0 R +/First 2015 0 R +/Last 2039 0 R +/Count -7 >> endobj 2007 0 obj << /Title 2008 0 R /A 2005 0 R -/Parent 1983 0 R +/Parent 1999 0 R /Prev 2003 0 R /Next 2011 0 R >> endobj 2003 0 obj << /Title 2004 0 R /A 2001 0 R -/Parent 1983 0 R -/Prev 1999 0 R +/Parent 1999 0 R /Next 2007 0 R >> endobj 1999 0 obj << /Title 2000 0 R /A 1997 0 R -/Parent 1983 0 R -/Prev 1995 0 R -/Next 2003 0 R +/Parent 1951 0 R +/Prev 1971 0 R +/Next 2043 0 R +/First 2003 0 R +/Last 2011 0 R +/Count -3 >> endobj 1995 0 obj << /Title 1996 0 R /A 1993 0 R -/Parent 1983 0 R +/Parent 1971 0 R /Prev 1991 0 R -/Next 1999 0 R >> endobj 1991 0 obj << /Title 1992 0 R /A 1989 0 R -/Parent 1983 0 R +/Parent 1971 0 R /Prev 1987 0 R /Next 1995 0 R >> endobj 1987 0 obj << /Title 1988 0 R /A 1985 0 R -/Parent 1983 0 R +/Parent 1971 0 R +/Prev 1983 0 R /Next 1991 0 R >> endobj 1983 0 obj << @@ -34441,9 +37548,7 @@ endobj /A 1981 0 R /Parent 1971 0 R /Prev 1979 0 R -/First 1987 0 R -/Last 2015 0 R -/Count -8 +/Next 1987 0 R >> endobj 1979 0 obj << /Title 1980 0 R @@ -34461,443 +37566,438 @@ endobj 1971 0 obj << /Title 1972 0 R /A 1969 0 R -/Parent 1923 0 R -/Prev 1943 0 R -/Next 2019 0 R +/Parent 1951 0 R +/Prev 1963 0 R +/Next 1999 0 R /First 1975 0 R -/Last 1983 0 R -/Count -3 +/Last 1995 0 R +/Count -6 >> endobj 1967 0 obj << /Title 1968 0 R /A 1965 0 R -/Parent 1943 0 R -/Prev 1963 0 R +/Parent 1963 0 R >> endobj 1963 0 obj << /Title 1964 0 R /A 1961 0 R -/Parent 1943 0 R +/Parent 1951 0 R /Prev 1959 0 R -/Next 1967 0 R +/Next 1971 0 R +/First 1967 0 R +/Last 1967 0 R +/Count -1 >> endobj 1959 0 obj << /Title 1960 0 R /A 1957 0 R -/Parent 1943 0 R +/Parent 1951 0 R /Prev 1955 0 R /Next 1963 0 R >> endobj 1955 0 obj << /Title 1956 0 R /A 1953 0 R -/Parent 1943 0 R -/Prev 1951 0 R +/Parent 1951 0 R /Next 1959 0 R >> endobj 1951 0 obj << /Title 1952 0 R /A 1949 0 R -/Parent 1943 0 R -/Prev 1947 0 R -/Next 1955 0 R +/Parent 463 0 R +/Prev 1903 0 R +/Next 2055 0 R +/First 1955 0 R +/Last 2047 0 R +/Count -7 >> endobj 1947 0 obj << /Title 1948 0 R /A 1945 0 R -/Parent 1943 0 R -/Next 1951 0 R +/Parent 1939 0 R +/Prev 1943 0 R >> endobj 1943 0 obj << /Title 1944 0 R /A 1941 0 R -/Parent 1923 0 R -/Prev 1935 0 R -/Next 1971 0 R -/First 1947 0 R -/Last 1967 0 R -/Count -6 +/Parent 1939 0 R +/Next 1947 0 R >> endobj 1939 0 obj << /Title 1940 0 R /A 1937 0 R -/Parent 1935 0 R +/Parent 1903 0 R +/Prev 1915 0 R +/First 1943 0 R +/Last 1947 0 R +/Count -2 >> endobj 1935 0 obj << /Title 1936 0 R /A 1933 0 R -/Parent 1923 0 R +/Parent 1915 0 R /Prev 1931 0 R -/Next 1943 0 R -/First 1939 0 R -/Last 1939 0 R -/Count -1 >> endobj 1931 0 obj << /Title 1932 0 R /A 1929 0 R -/Parent 1923 0 R +/Parent 1915 0 R /Prev 1927 0 R /Next 1935 0 R >> endobj 1927 0 obj << /Title 1928 0 R /A 1925 0 R -/Parent 1923 0 R +/Parent 1915 0 R +/Prev 1923 0 R /Next 1931 0 R >> endobj 1923 0 obj << /Title 1924 0 R /A 1921 0 R -/Parent 455 0 R -/Prev 1871 0 R -/Next 2027 0 R -/First 1927 0 R -/Last 2023 0 R -/Count -7 +/Parent 1915 0 R +/Prev 1919 0 R +/Next 1927 0 R >> endobj 1919 0 obj << /Title 1920 0 R /A 1917 0 R -/Parent 1871 0 R -/Prev 1907 0 R +/Parent 1915 0 R +/Next 1923 0 R >> endobj 1915 0 obj << /Title 1916 0 R /A 1913 0 R -/Parent 1907 0 R +/Parent 1903 0 R /Prev 1911 0 R +/Next 1939 0 R +/First 1919 0 R +/Last 1935 0 R +/Count -5 >> endobj 1911 0 obj << /Title 1912 0 R /A 1909 0 R -/Parent 1907 0 R +/Parent 1903 0 R +/Prev 1907 0 R /Next 1915 0 R >> endobj 1907 0 obj << /Title 1908 0 R /A 1905 0 R -/Parent 1871 0 R -/Prev 1883 0 R -/Next 1919 0 R -/First 1911 0 R -/Last 1915 0 R -/Count -2 +/Parent 1903 0 R +/Next 1911 0 R >> endobj 1903 0 obj << /Title 1904 0 R /A 1901 0 R -/Parent 1883 0 R -/Prev 1899 0 R +/Parent 463 0 R +/Prev 1363 0 R +/Next 1951 0 R +/First 1907 0 R +/Last 1939 0 R +/Count -4 >> endobj 1899 0 obj << /Title 1900 0 R /A 1897 0 R -/Parent 1883 0 R -/Prev 1895 0 R -/Next 1903 0 R +/Parent 1363 0 R +/Prev 1819 0 R >> endobj 1895 0 obj << /Title 1896 0 R /A 1893 0 R -/Parent 1883 0 R +/Parent 1819 0 R /Prev 1891 0 R -/Next 1899 0 R >> endobj 1891 0 obj << /Title 1892 0 R /A 1889 0 R -/Parent 1883 0 R +/Parent 1819 0 R /Prev 1887 0 R /Next 1895 0 R >> endobj 1887 0 obj << /Title 1888 0 R /A 1885 0 R -/Parent 1883 0 R +/Parent 1819 0 R +/Prev 1883 0 R /Next 1891 0 R >> endobj 1883 0 obj << /Title 1884 0 R /A 1881 0 R -/Parent 1871 0 R +/Parent 1819 0 R /Prev 1879 0 R -/Next 1907 0 R -/First 1887 0 R -/Last 1903 0 R -/Count -5 +/Next 1887 0 R >> endobj 1879 0 obj << /Title 1880 0 R /A 1877 0 R -/Parent 1871 0 R +/Parent 1819 0 R /Prev 1875 0 R /Next 1883 0 R >> endobj 1875 0 obj << /Title 1876 0 R /A 1873 0 R -/Parent 1871 0 R +/Parent 1819 0 R +/Prev 1871 0 R /Next 1879 0 R >> endobj 1871 0 obj << /Title 1872 0 R /A 1869 0 R -/Parent 455 0 R -/Prev 1327 0 R -/Next 1923 0 R -/First 1875 0 R -/Last 1919 0 R -/Count -5 +/Parent 1819 0 R +/Prev 1867 0 R +/Next 1875 0 R >> endobj 1867 0 obj << /Title 1868 0 R /A 1865 0 R -/Parent 1851 0 R +/Parent 1819 0 R /Prev 1863 0 R +/Next 1871 0 R >> endobj 1863 0 obj << /Title 1864 0 R /A 1861 0 R -/Parent 1851 0 R +/Parent 1819 0 R /Prev 1859 0 R /Next 1867 0 R >> endobj 1859 0 obj << /Title 1860 0 R /A 1857 0 R -/Parent 1851 0 R +/Parent 1819 0 R /Prev 1855 0 R /Next 1863 0 R >> endobj 1855 0 obj << /Title 1856 0 R /A 1853 0 R -/Parent 1851 0 R +/Parent 1819 0 R +/Prev 1851 0 R /Next 1859 0 R >> endobj 1851 0 obj << /Title 1852 0 R /A 1849 0 R -/Parent 1327 0 R -/Prev 1835 0 R -/First 1855 0 R -/Last 1867 0 R -/Count -4 +/Parent 1819 0 R +/Prev 1847 0 R +/Next 1855 0 R >> endobj 1847 0 obj << /Title 1848 0 R /A 1845 0 R -/Parent 1835 0 R +/Parent 1819 0 R /Prev 1843 0 R +/Next 1851 0 R >> endobj 1843 0 obj << /Title 1844 0 R /A 1841 0 R -/Parent 1835 0 R +/Parent 1819 0 R /Prev 1839 0 R /Next 1847 0 R >> endobj 1839 0 obj << /Title 1840 0 R /A 1837 0 R -/Parent 1835 0 R +/Parent 1819 0 R +/Prev 1835 0 R /Next 1843 0 R >> endobj 1835 0 obj << /Title 1836 0 R /A 1833 0 R -/Parent 1327 0 R +/Parent 1819 0 R /Prev 1831 0 R -/Next 1851 0 R -/First 1839 0 R -/Last 1847 0 R -/Count -3 +/Next 1839 0 R >> endobj 1831 0 obj << /Title 1832 0 R /A 1829 0 R -/Parent 1327 0 R -/Prev 1815 0 R +/Parent 1819 0 R +/Prev 1827 0 R /Next 1835 0 R >> endobj 1827 0 obj << /Title 1828 0 R /A 1825 0 R -/Parent 1815 0 R +/Parent 1819 0 R /Prev 1823 0 R +/Next 1831 0 R >> endobj 1823 0 obj << /Title 1824 0 R /A 1821 0 R -/Parent 1815 0 R -/Prev 1819 0 R +/Parent 1819 0 R /Next 1827 0 R >> endobj 1819 0 obj << /Title 1820 0 R /A 1817 0 R -/Parent 1815 0 R -/Next 1823 0 R +/Parent 1363 0 R +/Prev 1815 0 R +/Next 1899 0 R +/First 1823 0 R +/Last 1895 0 R +/Count -19 >> endobj 1815 0 obj << /Title 1816 0 R /A 1813 0 R -/Parent 1327 0 R +/Parent 1363 0 R /Prev 1811 0 R -/Next 1831 0 R -/First 1819 0 R -/Last 1827 0 R -/Count -3 +/Next 1819 0 R >> endobj 1811 0 obj << /Title 1812 0 R /A 1809 0 R -/Parent 1327 0 R -/Prev 1779 0 R +/Parent 1363 0 R +/Prev 1807 0 R /Next 1815 0 R >> endobj 1807 0 obj << /Title 1808 0 R /A 1805 0 R -/Parent 1779 0 R -/Prev 1803 0 R +/Parent 1363 0 R +/Prev 1791 0 R +/Next 1811 0 R >> endobj 1803 0 obj << /Title 1804 0 R /A 1801 0 R -/Parent 1779 0 R +/Parent 1791 0 R /Prev 1799 0 R -/Next 1807 0 R >> endobj 1799 0 obj << /Title 1800 0 R /A 1797 0 R -/Parent 1779 0 R +/Parent 1791 0 R /Prev 1795 0 R /Next 1803 0 R >> endobj 1795 0 obj << /Title 1796 0 R /A 1793 0 R -/Parent 1779 0 R -/Prev 1791 0 R +/Parent 1791 0 R /Next 1799 0 R >> endobj 1791 0 obj << /Title 1792 0 R /A 1789 0 R -/Parent 1779 0 R +/Parent 1363 0 R /Prev 1787 0 R -/Next 1795 0 R +/Next 1807 0 R +/First 1795 0 R +/Last 1803 0 R +/Count -3 >> endobj 1787 0 obj << /Title 1788 0 R /A 1785 0 R -/Parent 1779 0 R -/Prev 1783 0 R +/Parent 1363 0 R +/Prev 1755 0 R /Next 1791 0 R >> endobj 1783 0 obj << /Title 1784 0 R /A 1781 0 R -/Parent 1779 0 R -/Next 1787 0 R +/Parent 1755 0 R +/Prev 1779 0 R >> endobj 1779 0 obj << /Title 1780 0 R /A 1777 0 R -/Parent 1327 0 R -/Prev 1735 0 R -/Next 1811 0 R -/First 1783 0 R -/Last 1807 0 R -/Count -7 +/Parent 1755 0 R +/Prev 1775 0 R +/Next 1783 0 R >> endobj 1775 0 obj << /Title 1776 0 R /A 1773 0 R -/Parent 1735 0 R -/Prev 1739 0 R +/Parent 1755 0 R +/Prev 1771 0 R +/Next 1779 0 R >> endobj 1771 0 obj << /Title 1772 0 R /A 1769 0 R -/Parent 1739 0 R +/Parent 1755 0 R /Prev 1767 0 R +/Next 1775 0 R >> endobj 1767 0 obj << /Title 1768 0 R /A 1765 0 R -/Parent 1739 0 R +/Parent 1755 0 R /Prev 1763 0 R /Next 1771 0 R >> endobj 1763 0 obj << /Title 1764 0 R /A 1761 0 R -/Parent 1739 0 R +/Parent 1755 0 R /Prev 1759 0 R /Next 1767 0 R >> endobj 1759 0 obj << /Title 1760 0 R /A 1757 0 R -/Parent 1739 0 R -/Prev 1755 0 R +/Parent 1755 0 R /Next 1763 0 R >> endobj 1755 0 obj << /Title 1756 0 R /A 1753 0 R -/Parent 1739 0 R -/Prev 1751 0 R -/Next 1759 0 R +/Parent 1363 0 R +/Prev 1711 0 R +/Next 1787 0 R +/First 1759 0 R +/Last 1783 0 R +/Count -7 >> endobj 1751 0 obj << /Title 1752 0 R /A 1749 0 R -/Parent 1739 0 R -/Prev 1747 0 R -/Next 1755 0 R +/Parent 1711 0 R +/Prev 1715 0 R >> endobj 1747 0 obj << /Title 1748 0 R /A 1745 0 R -/Parent 1739 0 R +/Parent 1715 0 R /Prev 1743 0 R -/Next 1751 0 R >> endobj 1743 0 obj << /Title 1744 0 R /A 1741 0 R -/Parent 1739 0 R +/Parent 1715 0 R +/Prev 1739 0 R /Next 1747 0 R >> endobj 1739 0 obj << /Title 1740 0 R /A 1737 0 R -/Parent 1735 0 R -/Next 1775 0 R -/First 1743 0 R -/Last 1771 0 R -/Count -8 +/Parent 1715 0 R +/Prev 1735 0 R +/Next 1743 0 R >> endobj 1735 0 obj << /Title 1736 0 R /A 1733 0 R -/Parent 1327 0 R -/Prev 1715 0 R -/Next 1779 0 R -/First 1739 0 R -/Last 1775 0 R -/Count -2 +/Parent 1715 0 R +/Prev 1731 0 R +/Next 1739 0 R >> endobj 1731 0 obj << /Title 1732 0 R /A 1729 0 R /Parent 1715 0 R /Prev 1727 0 R +/Next 1735 0 R >> endobj 1727 0 obj << /Title 1728 0 R @@ -34922,480 +38022,483 @@ endobj 1715 0 obj << /Title 1716 0 R /A 1713 0 R -/Parent 1327 0 R -/Prev 1627 0 R -/Next 1735 0 R +/Parent 1711 0 R +/Next 1751 0 R /First 1719 0 R -/Last 1731 0 R -/Count -4 +/Last 1747 0 R +/Count -8 >> endobj 1711 0 obj << /Title 1712 0 R /A 1709 0 R -/Parent 1627 0 R -/Prev 1647 0 R +/Parent 1363 0 R +/Prev 1691 0 R +/Next 1755 0 R +/First 1715 0 R +/Last 1751 0 R +/Count -2 >> endobj 1707 0 obj << /Title 1708 0 R /A 1705 0 R -/Parent 1647 0 R +/Parent 1691 0 R /Prev 1703 0 R >> endobj 1703 0 obj << /Title 1704 0 R /A 1701 0 R -/Parent 1647 0 R +/Parent 1691 0 R /Prev 1699 0 R /Next 1707 0 R >> endobj 1699 0 obj << /Title 1700 0 R /A 1697 0 R -/Parent 1647 0 R +/Parent 1691 0 R /Prev 1695 0 R /Next 1703 0 R >> endobj 1695 0 obj << /Title 1696 0 R /A 1693 0 R -/Parent 1647 0 R -/Prev 1691 0 R +/Parent 1691 0 R /Next 1699 0 R >> endobj 1691 0 obj << /Title 1692 0 R /A 1689 0 R -/Parent 1647 0 R -/Prev 1687 0 R -/Next 1695 0 R +/Parent 1363 0 R +/Prev 1663 0 R +/Next 1711 0 R +/First 1695 0 R +/Last 1707 0 R +/Count -4 >> endobj 1687 0 obj << /Title 1688 0 R /A 1685 0 R -/Parent 1647 0 R +/Parent 1663 0 R /Prev 1683 0 R -/Next 1691 0 R >> endobj 1683 0 obj << /Title 1684 0 R /A 1681 0 R -/Parent 1647 0 R +/Parent 1663 0 R /Prev 1679 0 R /Next 1687 0 R >> endobj 1679 0 obj << /Title 1680 0 R /A 1677 0 R -/Parent 1647 0 R +/Parent 1663 0 R /Prev 1675 0 R /Next 1683 0 R >> endobj 1675 0 obj << /Title 1676 0 R /A 1673 0 R -/Parent 1647 0 R +/Parent 1663 0 R /Prev 1671 0 R /Next 1679 0 R >> endobj 1671 0 obj << /Title 1672 0 R /A 1669 0 R -/Parent 1647 0 R +/Parent 1663 0 R /Prev 1667 0 R /Next 1675 0 R >> endobj 1667 0 obj << /Title 1668 0 R /A 1665 0 R -/Parent 1647 0 R -/Prev 1663 0 R +/Parent 1663 0 R /Next 1671 0 R >> endobj 1663 0 obj << /Title 1664 0 R /A 1661 0 R -/Parent 1647 0 R -/Prev 1659 0 R -/Next 1667 0 R +/Parent 1363 0 R +/Prev 1595 0 R +/Next 1691 0 R +/First 1667 0 R +/Last 1687 0 R +/Count -6 >> endobj 1659 0 obj << /Title 1660 0 R /A 1657 0 R -/Parent 1647 0 R +/Parent 1595 0 R /Prev 1655 0 R -/Next 1663 0 R >> endobj 1655 0 obj << /Title 1656 0 R /A 1653 0 R -/Parent 1647 0 R +/Parent 1595 0 R /Prev 1651 0 R /Next 1659 0 R >> endobj 1651 0 obj << /Title 1652 0 R /A 1649 0 R -/Parent 1647 0 R +/Parent 1595 0 R +/Prev 1647 0 R /Next 1655 0 R >> endobj 1647 0 obj << /Title 1648 0 R /A 1645 0 R -/Parent 1627 0 R +/Parent 1595 0 R /Prev 1643 0 R -/Next 1711 0 R -/First 1651 0 R -/Last 1707 0 R -/Count -15 +/Next 1651 0 R >> endobj 1643 0 obj << /Title 1644 0 R /A 1641 0 R -/Parent 1627 0 R +/Parent 1595 0 R /Prev 1639 0 R /Next 1647 0 R >> endobj 1639 0 obj << /Title 1640 0 R /A 1637 0 R -/Parent 1627 0 R +/Parent 1595 0 R /Prev 1635 0 R /Next 1643 0 R >> endobj 1635 0 obj << /Title 1636 0 R /A 1633 0 R -/Parent 1627 0 R +/Parent 1595 0 R /Prev 1631 0 R /Next 1639 0 R >> endobj 1631 0 obj << /Title 1632 0 R /A 1629 0 R -/Parent 1627 0 R +/Parent 1595 0 R +/Prev 1627 0 R /Next 1635 0 R >> endobj 1627 0 obj << /Title 1628 0 R /A 1625 0 R -/Parent 1327 0 R -/Prev 1559 0 R -/Next 1715 0 R -/First 1631 0 R -/Last 1711 0 R -/Count -6 +/Parent 1595 0 R +/Prev 1623 0 R +/Next 1631 0 R >> endobj 1623 0 obj << /Title 1624 0 R /A 1621 0 R -/Parent 1559 0 R +/Parent 1595 0 R /Prev 1619 0 R +/Next 1627 0 R >> endobj 1619 0 obj << /Title 1620 0 R /A 1617 0 R -/Parent 1559 0 R +/Parent 1595 0 R /Prev 1615 0 R /Next 1623 0 R >> endobj 1615 0 obj << /Title 1616 0 R /A 1613 0 R -/Parent 1559 0 R +/Parent 1595 0 R /Prev 1611 0 R /Next 1619 0 R >> endobj 1611 0 obj << /Title 1612 0 R /A 1609 0 R -/Parent 1559 0 R +/Parent 1595 0 R /Prev 1607 0 R /Next 1615 0 R >> endobj 1607 0 obj << /Title 1608 0 R /A 1605 0 R -/Parent 1559 0 R +/Parent 1595 0 R /Prev 1603 0 R /Next 1611 0 R >> endobj 1603 0 obj << /Title 1604 0 R /A 1601 0 R -/Parent 1559 0 R +/Parent 1595 0 R /Prev 1599 0 R /Next 1607 0 R >> endobj 1599 0 obj << /Title 1600 0 R /A 1597 0 R -/Parent 1559 0 R -/Prev 1595 0 R +/Parent 1595 0 R /Next 1603 0 R >> endobj 1595 0 obj << /Title 1596 0 R /A 1593 0 R -/Parent 1559 0 R -/Prev 1591 0 R -/Next 1599 0 R +/Parent 1363 0 R +/Prev 1575 0 R +/Next 1663 0 R +/First 1599 0 R +/Last 1659 0 R +/Count -16 >> endobj 1591 0 obj << /Title 1592 0 R /A 1589 0 R -/Parent 1559 0 R +/Parent 1575 0 R /Prev 1587 0 R -/Next 1595 0 R >> endobj 1587 0 obj << /Title 1588 0 R /A 1585 0 R -/Parent 1559 0 R +/Parent 1575 0 R /Prev 1583 0 R /Next 1591 0 R >> endobj 1583 0 obj << /Title 1584 0 R /A 1581 0 R -/Parent 1559 0 R +/Parent 1575 0 R /Prev 1579 0 R /Next 1587 0 R >> endobj 1579 0 obj << /Title 1580 0 R /A 1577 0 R -/Parent 1559 0 R -/Prev 1575 0 R +/Parent 1575 0 R /Next 1583 0 R >> endobj 1575 0 obj << /Title 1576 0 R /A 1573 0 R -/Parent 1559 0 R -/Prev 1571 0 R -/Next 1579 0 R +/Parent 1363 0 R +/Prev 1563 0 R +/Next 1595 0 R +/First 1579 0 R +/Last 1591 0 R +/Count -4 >> endobj 1571 0 obj << /Title 1572 0 R /A 1569 0 R -/Parent 1559 0 R +/Parent 1563 0 R /Prev 1567 0 R -/Next 1575 0 R >> endobj 1567 0 obj << /Title 1568 0 R /A 1565 0 R -/Parent 1559 0 R -/Prev 1563 0 R +/Parent 1563 0 R /Next 1571 0 R >> endobj 1563 0 obj << /Title 1564 0 R /A 1561 0 R -/Parent 1559 0 R -/Next 1567 0 R +/Parent 1363 0 R +/Prev 1551 0 R +/Next 1575 0 R +/First 1567 0 R +/Last 1571 0 R +/Count -2 >> endobj 1559 0 obj << /Title 1560 0 R /A 1557 0 R -/Parent 1327 0 R -/Prev 1539 0 R -/Next 1627 0 R -/First 1563 0 R -/Last 1623 0 R -/Count -16 +/Parent 1551 0 R +/Prev 1555 0 R >> endobj 1555 0 obj << /Title 1556 0 R /A 1553 0 R -/Parent 1539 0 R -/Prev 1551 0 R +/Parent 1551 0 R +/Next 1559 0 R >> endobj 1551 0 obj << /Title 1552 0 R /A 1549 0 R -/Parent 1539 0 R -/Prev 1547 0 R -/Next 1555 0 R +/Parent 1363 0 R +/Prev 1535 0 R +/Next 1563 0 R +/First 1555 0 R +/Last 1559 0 R +/Count -2 >> endobj 1547 0 obj << /Title 1548 0 R /A 1545 0 R -/Parent 1539 0 R +/Parent 1535 0 R /Prev 1543 0 R -/Next 1551 0 R >> endobj 1543 0 obj << /Title 1544 0 R /A 1541 0 R -/Parent 1539 0 R +/Parent 1535 0 R +/Prev 1539 0 R /Next 1547 0 R >> endobj 1539 0 obj << /Title 1540 0 R /A 1537 0 R -/Parent 1327 0 R -/Prev 1527 0 R -/Next 1559 0 R -/First 1543 0 R -/Last 1555 0 R -/Count -4 +/Parent 1535 0 R +/Next 1543 0 R >> endobj 1535 0 obj << /Title 1536 0 R /A 1533 0 R -/Parent 1527 0 R -/Prev 1531 0 R +/Parent 1363 0 R +/Prev 1455 0 R +/Next 1551 0 R +/First 1539 0 R +/Last 1547 0 R +/Count -3 >> endobj 1531 0 obj << /Title 1532 0 R /A 1529 0 R -/Parent 1527 0 R -/Next 1535 0 R +/Parent 1455 0 R +/Prev 1527 0 R >> endobj 1527 0 obj << /Title 1528 0 R /A 1525 0 R -/Parent 1327 0 R -/Prev 1515 0 R -/Next 1539 0 R -/First 1531 0 R -/Last 1535 0 R -/Count -2 +/Parent 1455 0 R +/Prev 1523 0 R +/Next 1531 0 R >> endobj 1523 0 obj << /Title 1524 0 R /A 1521 0 R -/Parent 1515 0 R +/Parent 1455 0 R /Prev 1519 0 R +/Next 1527 0 R >> endobj 1519 0 obj << /Title 1520 0 R /A 1517 0 R -/Parent 1515 0 R +/Parent 1455 0 R +/Prev 1515 0 R /Next 1523 0 R >> endobj 1515 0 obj << /Title 1516 0 R /A 1513 0 R -/Parent 1327 0 R -/Prev 1499 0 R -/Next 1527 0 R -/First 1519 0 R -/Last 1523 0 R -/Count -2 +/Parent 1455 0 R +/Prev 1511 0 R +/Next 1519 0 R >> endobj 1511 0 obj << /Title 1512 0 R /A 1509 0 R -/Parent 1499 0 R +/Parent 1455 0 R /Prev 1507 0 R +/Next 1515 0 R >> endobj 1507 0 obj << /Title 1508 0 R /A 1505 0 R -/Parent 1499 0 R +/Parent 1455 0 R /Prev 1503 0 R /Next 1511 0 R >> endobj 1503 0 obj << /Title 1504 0 R /A 1501 0 R -/Parent 1499 0 R +/Parent 1455 0 R +/Prev 1499 0 R /Next 1507 0 R >> endobj 1499 0 obj << /Title 1500 0 R /A 1497 0 R -/Parent 1327 0 R -/Prev 1419 0 R -/Next 1515 0 R -/First 1503 0 R -/Last 1511 0 R -/Count -3 +/Parent 1455 0 R +/Prev 1495 0 R +/Next 1503 0 R >> endobj 1495 0 obj << /Title 1496 0 R /A 1493 0 R -/Parent 1419 0 R +/Parent 1455 0 R /Prev 1491 0 R +/Next 1499 0 R >> endobj 1491 0 obj << /Title 1492 0 R /A 1489 0 R -/Parent 1419 0 R +/Parent 1455 0 R /Prev 1487 0 R /Next 1495 0 R >> endobj 1487 0 obj << /Title 1488 0 R /A 1485 0 R -/Parent 1419 0 R +/Parent 1455 0 R /Prev 1483 0 R /Next 1491 0 R >> endobj 1483 0 obj << /Title 1484 0 R /A 1481 0 R -/Parent 1419 0 R +/Parent 1455 0 R /Prev 1479 0 R /Next 1487 0 R >> endobj 1479 0 obj << /Title 1480 0 R /A 1477 0 R -/Parent 1419 0 R +/Parent 1455 0 R /Prev 1475 0 R /Next 1483 0 R >> endobj 1475 0 obj << /Title 1476 0 R /A 1473 0 R -/Parent 1419 0 R +/Parent 1455 0 R /Prev 1471 0 R /Next 1479 0 R >> endobj 1471 0 obj << /Title 1472 0 R /A 1469 0 R -/Parent 1419 0 R +/Parent 1455 0 R /Prev 1467 0 R /Next 1475 0 R >> endobj 1467 0 obj << /Title 1468 0 R /A 1465 0 R -/Parent 1419 0 R +/Parent 1455 0 R /Prev 1463 0 R /Next 1471 0 R >> endobj 1463 0 obj << /Title 1464 0 R /A 1461 0 R -/Parent 1419 0 R +/Parent 1455 0 R /Prev 1459 0 R /Next 1467 0 R >> endobj 1459 0 obj << /Title 1460 0 R /A 1457 0 R -/Parent 1419 0 R -/Prev 1455 0 R +/Parent 1455 0 R /Next 1463 0 R >> endobj 1455 0 obj << /Title 1456 0 R /A 1453 0 R -/Parent 1419 0 R -/Prev 1451 0 R -/Next 1459 0 R +/Parent 1363 0 R +/Prev 1419 0 R +/Next 1535 0 R +/First 1459 0 R +/Last 1531 0 R +/Count -19 >> endobj 1451 0 obj << /Title 1452 0 R /A 1449 0 R /Parent 1419 0 R /Prev 1447 0 R -/Next 1455 0 R >> endobj 1447 0 obj << /Title 1448 0 R @@ -35448,185 +38551,184 @@ endobj 1419 0 obj << /Title 1420 0 R /A 1417 0 R -/Parent 1327 0 R -/Prev 1383 0 R -/Next 1499 0 R +/Parent 1363 0 R +/Prev 1395 0 R +/Next 1455 0 R /First 1423 0 R -/Last 1495 0 R -/Count -19 +/Last 1451 0 R +/Count -8 >> endobj 1415 0 obj << /Title 1416 0 R /A 1413 0 R -/Parent 1383 0 R +/Parent 1395 0 R /Prev 1411 0 R >> endobj 1411 0 obj << /Title 1412 0 R /A 1409 0 R -/Parent 1383 0 R +/Parent 1395 0 R /Prev 1407 0 R /Next 1415 0 R >> endobj 1407 0 obj << /Title 1408 0 R /A 1405 0 R -/Parent 1383 0 R +/Parent 1395 0 R /Prev 1403 0 R /Next 1411 0 R >> endobj 1403 0 obj << /Title 1404 0 R /A 1401 0 R -/Parent 1383 0 R +/Parent 1395 0 R /Prev 1399 0 R /Next 1407 0 R >> endobj 1399 0 obj << /Title 1400 0 R /A 1397 0 R -/Parent 1383 0 R -/Prev 1395 0 R +/Parent 1395 0 R /Next 1403 0 R >> endobj 1395 0 obj << /Title 1396 0 R /A 1393 0 R -/Parent 1383 0 R -/Prev 1391 0 R -/Next 1399 0 R +/Parent 1363 0 R +/Prev 1379 0 R +/Next 1419 0 R +/First 1399 0 R +/Last 1415 0 R +/Count -5 >> endobj 1391 0 obj << /Title 1392 0 R /A 1389 0 R -/Parent 1383 0 R +/Parent 1379 0 R /Prev 1387 0 R -/Next 1395 0 R >> endobj 1387 0 obj << /Title 1388 0 R /A 1385 0 R -/Parent 1383 0 R +/Parent 1379 0 R +/Prev 1383 0 R /Next 1391 0 R >> endobj 1383 0 obj << /Title 1384 0 R /A 1381 0 R -/Parent 1327 0 R -/Prev 1359 0 R -/Next 1419 0 R -/First 1387 0 R -/Last 1415 0 R -/Count -8 +/Parent 1379 0 R +/Next 1387 0 R >> endobj 1379 0 obj << /Title 1380 0 R /A 1377 0 R -/Parent 1359 0 R -/Prev 1375 0 R +/Parent 1363 0 R +/Prev 1367 0 R +/Next 1395 0 R +/First 1383 0 R +/Last 1391 0 R +/Count -3 >> endobj 1375 0 obj << /Title 1376 0 R /A 1373 0 R -/Parent 1359 0 R +/Parent 1367 0 R /Prev 1371 0 R -/Next 1379 0 R >> endobj 1371 0 obj << /Title 1372 0 R /A 1369 0 R -/Parent 1359 0 R -/Prev 1367 0 R +/Parent 1367 0 R /Next 1375 0 R >> endobj 1367 0 obj << /Title 1368 0 R /A 1365 0 R -/Parent 1359 0 R -/Prev 1363 0 R -/Next 1371 0 R +/Parent 1363 0 R +/Next 1379 0 R +/First 1371 0 R +/Last 1375 0 R +/Count -2 >> endobj 1363 0 obj << /Title 1364 0 R /A 1361 0 R -/Parent 1359 0 R -/Next 1367 0 R +/Parent 463 0 R +/Prev 1123 0 R +/Next 1903 0 R +/First 1367 0 R +/Last 1899 0 R +/Count -21 >> endobj 1359 0 obj << /Title 1360 0 R /A 1357 0 R -/Parent 1327 0 R -/Prev 1343 0 R -/Next 1383 0 R -/First 1363 0 R -/Last 1379 0 R -/Count -5 +/Parent 1351 0 R +/Prev 1355 0 R >> endobj 1355 0 obj << /Title 1356 0 R /A 1353 0 R -/Parent 1343 0 R -/Prev 1351 0 R +/Parent 1351 0 R +/Next 1359 0 R >> endobj 1351 0 obj << /Title 1352 0 R /A 1349 0 R -/Parent 1343 0 R +/Parent 1123 0 R /Prev 1347 0 R -/Next 1355 0 R +/First 1355 0 R +/Last 1359 0 R +/Count -2 >> endobj 1347 0 obj << /Title 1348 0 R /A 1345 0 R -/Parent 1343 0 R +/Parent 1123 0 R +/Prev 1343 0 R /Next 1351 0 R >> endobj 1343 0 obj << /Title 1344 0 R /A 1341 0 R -/Parent 1327 0 R -/Prev 1331 0 R -/Next 1359 0 R -/First 1347 0 R -/Last 1355 0 R -/Count -3 +/Parent 1123 0 R +/Prev 1339 0 R +/Next 1347 0 R >> endobj 1339 0 obj << /Title 1340 0 R /A 1337 0 R -/Parent 1331 0 R +/Parent 1123 0 R /Prev 1335 0 R +/Next 1343 0 R >> endobj 1335 0 obj << /Title 1336 0 R /A 1333 0 R -/Parent 1331 0 R +/Parent 1123 0 R +/Prev 1315 0 R /Next 1339 0 R >> endobj 1331 0 obj << /Title 1332 0 R /A 1329 0 R -/Parent 1327 0 R -/Next 1343 0 R -/First 1335 0 R -/Last 1339 0 R -/Count -2 +/Parent 1315 0 R +/Prev 1327 0 R >> endobj 1327 0 obj << /Title 1328 0 R /A 1325 0 R -/Parent 455 0 R -/Prev 1079 0 R -/Next 1871 0 R -/First 1331 0 R -/Last 1851 0 R -/Count -19 +/Parent 1315 0 R +/Prev 1323 0 R +/Next 1331 0 R >> endobj 1323 0 obj << /Title 1324 0 R /A 1321 0 R /Parent 1315 0 R /Prev 1319 0 R +/Next 1327 0 R >> endobj 1319 0 obj << /Title 1320 0 R @@ -35637,354 +38739,358 @@ endobj 1315 0 obj << /Title 1316 0 R /A 1313 0 R -/Parent 1079 0 R -/Prev 1311 0 R +/Parent 1123 0 R +/Prev 1283 0 R +/Next 1335 0 R /First 1319 0 R -/Last 1323 0 R -/Count -2 +/Last 1331 0 R +/Count -4 >> endobj 1311 0 obj << /Title 1312 0 R /A 1309 0 R -/Parent 1079 0 R +/Parent 1283 0 R /Prev 1307 0 R -/Next 1315 0 R >> endobj 1307 0 obj << /Title 1308 0 R /A 1305 0 R -/Parent 1079 0 R +/Parent 1283 0 R /Prev 1303 0 R /Next 1311 0 R >> endobj 1303 0 obj << /Title 1304 0 R /A 1301 0 R -/Parent 1079 0 R +/Parent 1283 0 R /Prev 1299 0 R /Next 1307 0 R >> endobj 1299 0 obj << /Title 1300 0 R /A 1297 0 R -/Parent 1079 0 R -/Prev 1279 0 R +/Parent 1283 0 R +/Prev 1295 0 R /Next 1303 0 R >> endobj 1295 0 obj << /Title 1296 0 R /A 1293 0 R -/Parent 1279 0 R +/Parent 1283 0 R /Prev 1291 0 R +/Next 1299 0 R >> endobj 1291 0 obj << /Title 1292 0 R /A 1289 0 R -/Parent 1279 0 R +/Parent 1283 0 R /Prev 1287 0 R /Next 1295 0 R >> endobj 1287 0 obj << /Title 1288 0 R /A 1285 0 R -/Parent 1279 0 R -/Prev 1283 0 R +/Parent 1283 0 R /Next 1291 0 R >> endobj 1283 0 obj << /Title 1284 0 R /A 1281 0 R -/Parent 1279 0 R -/Next 1287 0 R +/Parent 1123 0 R +/Prev 1263 0 R +/Next 1315 0 R +/First 1287 0 R +/Last 1311 0 R +/Count -7 >> endobj 1279 0 obj << /Title 1280 0 R /A 1277 0 R -/Parent 1079 0 R -/Prev 1247 0 R -/Next 1299 0 R -/First 1283 0 R -/Last 1295 0 R -/Count -4 +/Parent 1263 0 R +/Prev 1275 0 R >> endobj 1275 0 obj << /Title 1276 0 R /A 1273 0 R -/Parent 1247 0 R +/Parent 1263 0 R /Prev 1271 0 R +/Next 1279 0 R >> endobj 1271 0 obj << /Title 1272 0 R /A 1269 0 R -/Parent 1247 0 R +/Parent 1263 0 R /Prev 1267 0 R /Next 1275 0 R >> endobj 1267 0 obj << /Title 1268 0 R /A 1265 0 R -/Parent 1247 0 R -/Prev 1263 0 R +/Parent 1263 0 R /Next 1271 0 R >> endobj 1263 0 obj << /Title 1264 0 R /A 1261 0 R -/Parent 1247 0 R -/Prev 1259 0 R -/Next 1267 0 R +/Parent 1123 0 R +/Prev 1215 0 R +/Next 1283 0 R +/First 1267 0 R +/Last 1279 0 R +/Count -4 >> endobj 1259 0 obj << /Title 1260 0 R /A 1257 0 R -/Parent 1247 0 R +/Parent 1223 0 R /Prev 1255 0 R -/Next 1263 0 R >> endobj 1255 0 obj << /Title 1256 0 R /A 1253 0 R -/Parent 1247 0 R +/Parent 1223 0 R /Prev 1251 0 R /Next 1259 0 R >> endobj 1251 0 obj << /Title 1252 0 R /A 1249 0 R -/Parent 1247 0 R +/Parent 1223 0 R +/Prev 1247 0 R /Next 1255 0 R >> endobj 1247 0 obj << /Title 1248 0 R /A 1245 0 R -/Parent 1079 0 R -/Prev 1227 0 R -/Next 1279 0 R -/First 1251 0 R -/Last 1275 0 R -/Count -7 +/Parent 1223 0 R +/Prev 1243 0 R +/Next 1251 0 R >> endobj 1243 0 obj << /Title 1244 0 R /A 1241 0 R -/Parent 1227 0 R +/Parent 1223 0 R /Prev 1239 0 R +/Next 1247 0 R >> endobj 1239 0 obj << /Title 1240 0 R /A 1237 0 R -/Parent 1227 0 R +/Parent 1223 0 R /Prev 1235 0 R /Next 1243 0 R >> endobj 1235 0 obj << /Title 1236 0 R /A 1233 0 R -/Parent 1227 0 R +/Parent 1223 0 R /Prev 1231 0 R /Next 1239 0 R >> endobj 1231 0 obj << /Title 1232 0 R /A 1229 0 R -/Parent 1227 0 R +/Parent 1223 0 R +/Prev 1227 0 R /Next 1235 0 R >> endobj 1227 0 obj << /Title 1228 0 R /A 1225 0 R -/Parent 1079 0 R -/Prev 1179 0 R -/Next 1247 0 R -/First 1231 0 R -/Last 1243 0 R -/Count -4 +/Parent 1223 0 R +/Next 1231 0 R >> endobj 1223 0 obj << /Title 1224 0 R /A 1221 0 R -/Parent 1187 0 R +/Parent 1215 0 R /Prev 1219 0 R +/First 1227 0 R +/Last 1259 0 R +/Count -9 >> endobj 1219 0 obj << /Title 1220 0 R /A 1217 0 R -/Parent 1187 0 R -/Prev 1215 0 R +/Parent 1215 0 R /Next 1223 0 R >> endobj 1215 0 obj << /Title 1216 0 R /A 1213 0 R -/Parent 1187 0 R -/Prev 1211 0 R -/Next 1219 0 R +/Parent 1123 0 R +/Prev 1191 0 R +/Next 1263 0 R +/First 1219 0 R +/Last 1223 0 R +/Count -2 >> endobj 1211 0 obj << /Title 1212 0 R /A 1209 0 R -/Parent 1187 0 R +/Parent 1191 0 R /Prev 1207 0 R -/Next 1215 0 R >> endobj 1207 0 obj << /Title 1208 0 R /A 1205 0 R -/Parent 1187 0 R +/Parent 1191 0 R /Prev 1203 0 R /Next 1211 0 R >> endobj 1203 0 obj << /Title 1204 0 R /A 1201 0 R -/Parent 1187 0 R +/Parent 1191 0 R /Prev 1199 0 R /Next 1207 0 R >> endobj 1199 0 obj << /Title 1200 0 R /A 1197 0 R -/Parent 1187 0 R +/Parent 1191 0 R /Prev 1195 0 R /Next 1203 0 R >> endobj 1195 0 obj << /Title 1196 0 R /A 1193 0 R -/Parent 1187 0 R -/Prev 1191 0 R +/Parent 1191 0 R /Next 1199 0 R >> endobj 1191 0 obj << /Title 1192 0 R /A 1189 0 R -/Parent 1187 0 R -/Next 1195 0 R +/Parent 1123 0 R +/Prev 1163 0 R +/Next 1215 0 R +/First 1195 0 R +/Last 1211 0 R +/Count -5 >> endobj 1187 0 obj << /Title 1188 0 R /A 1185 0 R -/Parent 1179 0 R +/Parent 1163 0 R /Prev 1183 0 R -/First 1191 0 R -/Last 1223 0 R -/Count -9 >> endobj 1183 0 obj << /Title 1184 0 R /A 1181 0 R -/Parent 1179 0 R +/Parent 1163 0 R +/Prev 1179 0 R /Next 1187 0 R >> endobj 1179 0 obj << /Title 1180 0 R /A 1177 0 R -/Parent 1079 0 R -/Prev 1155 0 R -/Next 1227 0 R -/First 1183 0 R -/Last 1187 0 R -/Count -2 +/Parent 1163 0 R +/Prev 1175 0 R +/Next 1183 0 R >> endobj 1175 0 obj << /Title 1176 0 R /A 1173 0 R -/Parent 1155 0 R +/Parent 1163 0 R /Prev 1171 0 R +/Next 1179 0 R >> endobj 1171 0 obj << /Title 1172 0 R /A 1169 0 R -/Parent 1155 0 R +/Parent 1163 0 R /Prev 1167 0 R /Next 1175 0 R >> endobj 1167 0 obj << /Title 1168 0 R /A 1165 0 R -/Parent 1155 0 R -/Prev 1163 0 R +/Parent 1163 0 R /Next 1171 0 R >> endobj 1163 0 obj << /Title 1164 0 R /A 1161 0 R -/Parent 1155 0 R +/Parent 1123 0 R /Prev 1159 0 R -/Next 1167 0 R +/Next 1191 0 R +/First 1167 0 R +/Last 1187 0 R +/Count -6 >> endobj 1159 0 obj << /Title 1160 0 R /A 1157 0 R -/Parent 1155 0 R +/Parent 1123 0 R +/Prev 1147 0 R /Next 1163 0 R >> endobj 1155 0 obj << /Title 1156 0 R /A 1153 0 R -/Parent 1079 0 R -/Prev 1127 0 R -/Next 1179 0 R -/First 1159 0 R -/Last 1175 0 R -/Count -5 +/Parent 1147 0 R +/Prev 1151 0 R >> endobj 1151 0 obj << /Title 1152 0 R /A 1149 0 R -/Parent 1127 0 R -/Prev 1147 0 R +/Parent 1147 0 R +/Next 1155 0 R >> endobj 1147 0 obj << /Title 1148 0 R /A 1145 0 R -/Parent 1127 0 R -/Prev 1143 0 R -/Next 1151 0 R +/Parent 1123 0 R +/Prev 1131 0 R +/Next 1159 0 R +/First 1151 0 R +/Last 1155 0 R +/Count -2 >> endobj 1143 0 obj << /Title 1144 0 R /A 1141 0 R -/Parent 1127 0 R +/Parent 1131 0 R /Prev 1139 0 R -/Next 1147 0 R >> endobj 1139 0 obj << /Title 1140 0 R /A 1137 0 R -/Parent 1127 0 R +/Parent 1131 0 R /Prev 1135 0 R /Next 1143 0 R >> endobj 1135 0 obj << /Title 1136 0 R /A 1133 0 R -/Parent 1127 0 R -/Prev 1131 0 R +/Parent 1131 0 R /Next 1139 0 R >> endobj 1131 0 obj << /Title 1132 0 R /A 1129 0 R -/Parent 1127 0 R -/Next 1135 0 R +/Parent 1123 0 R +/Prev 1127 0 R +/Next 1147 0 R +/First 1135 0 R +/Last 1143 0 R +/Count -3 >> endobj 1127 0 obj << /Title 1128 0 R /A 1125 0 R -/Parent 1079 0 R -/Prev 1123 0 R -/Next 1155 0 R -/First 1131 0 R -/Last 1151 0 R -/Count -6 +/Parent 1123 0 R +/Next 1131 0 R >> endobj 1123 0 obj << /Title 1124 0 R /A 1121 0 R -/Parent 1079 0 R +/Parent 463 0 R /Prev 1111 0 R -/Next 1127 0 R +/Next 1363 0 R +/First 1127 0 R +/Last 1351 0 R +/Count -15 >> endobj 1119 0 obj << /Title 1120 0 R @@ -36001,8 +39107,8 @@ endobj 1111 0 obj << /Title 1112 0 R /A 1109 0 R -/Parent 1079 0 R -/Prev 1087 0 R +/Parent 463 0 R +/Prev 1063 0 R /Next 1123 0 R /First 1115 0 R /Last 1119 0 R @@ -36011,283 +39117,281 @@ endobj 1107 0 obj << /Title 1108 0 R /A 1105 0 R -/Parent 1087 0 R +/Parent 1063 0 R /Prev 1103 0 R >> endobj 1103 0 obj << /Title 1104 0 R /A 1101 0 R -/Parent 1087 0 R -/Prev 1099 0 R +/Parent 1063 0 R +/Prev 1091 0 R /Next 1107 0 R >> endobj 1099 0 obj << /Title 1100 0 R /A 1097 0 R -/Parent 1087 0 R +/Parent 1091 0 R /Prev 1095 0 R -/Next 1103 0 R >> endobj 1095 0 obj << /Title 1096 0 R /A 1093 0 R -/Parent 1087 0 R -/Prev 1091 0 R +/Parent 1091 0 R /Next 1099 0 R >> endobj 1091 0 obj << /Title 1092 0 R /A 1089 0 R -/Parent 1087 0 R -/Next 1095 0 R +/Parent 1063 0 R +/Prev 1075 0 R +/Next 1103 0 R +/First 1095 0 R +/Last 1099 0 R +/Count -2 >> endobj 1087 0 obj << /Title 1088 0 R /A 1085 0 R -/Parent 1079 0 R +/Parent 1075 0 R /Prev 1083 0 R -/Next 1111 0 R -/First 1091 0 R -/Last 1107 0 R -/Count -5 >> endobj 1083 0 obj << /Title 1084 0 R /A 1081 0 R -/Parent 1079 0 R +/Parent 1075 0 R +/Prev 1079 0 R /Next 1087 0 R >> endobj 1079 0 obj << /Title 1080 0 R /A 1077 0 R -/Parent 455 0 R -/Prev 1067 0 R -/Next 1327 0 R -/First 1083 0 R -/Last 1315 0 R -/Count -15 +/Parent 1075 0 R +/Next 1083 0 R >> endobj 1075 0 obj << /Title 1076 0 R /A 1073 0 R -/Parent 1067 0 R +/Parent 1063 0 R /Prev 1071 0 R +/Next 1091 0 R +/First 1079 0 R +/Last 1087 0 R +/Count -3 >> endobj 1071 0 obj << /Title 1072 0 R /A 1069 0 R -/Parent 1067 0 R +/Parent 1063 0 R +/Prev 1067 0 R /Next 1075 0 R >> endobj 1067 0 obj << /Title 1068 0 R /A 1065 0 R -/Parent 455 0 R -/Prev 1023 0 R -/Next 1079 0 R -/First 1071 0 R -/Last 1075 0 R -/Count -2 +/Parent 1063 0 R +/Next 1071 0 R >> endobj 1063 0 obj << /Title 1064 0 R /A 1061 0 R -/Parent 1059 0 R +/Parent 463 0 R +/Prev 1007 0 R +/Next 1111 0 R +/First 1067 0 R +/Last 1107 0 R +/Count -6 >> endobj 1059 0 obj << /Title 1060 0 R /A 1057 0 R -/Parent 1023 0 R -/Prev 1047 0 R -/First 1063 0 R -/Last 1063 0 R -/Count -1 +/Parent 1051 0 R +/Prev 1055 0 R >> endobj 1055 0 obj << /Title 1056 0 R /A 1053 0 R -/Parent 1047 0 R -/Prev 1051 0 R +/Parent 1051 0 R +/Next 1059 0 R >> endobj 1051 0 obj << /Title 1052 0 R /A 1049 0 R -/Parent 1047 0 R -/Next 1055 0 R +/Parent 1007 0 R +/Prev 1047 0 R +/First 1055 0 R +/Last 1059 0 R +/Count -2 >> endobj 1047 0 obj << /Title 1048 0 R /A 1045 0 R -/Parent 1023 0 R -/Prev 1035 0 R -/Next 1059 0 R -/First 1051 0 R -/Last 1055 0 R -/Count -2 +/Parent 1007 0 R +/Prev 1019 0 R +/Next 1051 0 R >> endobj 1043 0 obj << /Title 1044 0 R /A 1041 0 R -/Parent 1035 0 R +/Parent 1019 0 R /Prev 1039 0 R >> endobj 1039 0 obj << /Title 1040 0 R /A 1037 0 R -/Parent 1035 0 R +/Parent 1019 0 R +/Prev 1035 0 R /Next 1043 0 R >> endobj 1035 0 obj << /Title 1036 0 R /A 1033 0 R -/Parent 1023 0 R +/Parent 1019 0 R /Prev 1031 0 R -/Next 1047 0 R -/First 1039 0 R -/Last 1043 0 R -/Count -2 +/Next 1039 0 R >> endobj 1031 0 obj << /Title 1032 0 R /A 1029 0 R -/Parent 1023 0 R +/Parent 1019 0 R /Prev 1027 0 R /Next 1035 0 R >> endobj 1027 0 obj << /Title 1028 0 R /A 1025 0 R -/Parent 1023 0 R +/Parent 1019 0 R +/Prev 1023 0 R /Next 1031 0 R >> endobj 1023 0 obj << /Title 1024 0 R /A 1021 0 R -/Parent 455 0 R -/Prev 967 0 R -/Next 1067 0 R -/First 1027 0 R -/Last 1059 0 R -/Count -5 +/Parent 1019 0 R +/Next 1027 0 R >> endobj 1019 0 obj << /Title 1020 0 R /A 1017 0 R -/Parent 1011 0 R +/Parent 1007 0 R /Prev 1015 0 R +/Next 1047 0 R +/First 1023 0 R +/Last 1043 0 R +/Count -6 >> endobj 1015 0 obj << /Title 1016 0 R /A 1013 0 R -/Parent 1011 0 R +/Parent 1007 0 R +/Prev 1011 0 R /Next 1019 0 R >> endobj 1011 0 obj << /Title 1012 0 R /A 1009 0 R -/Parent 967 0 R -/Prev 1007 0 R -/First 1015 0 R -/Last 1019 0 R -/Count -2 +/Parent 1007 0 R +/Next 1015 0 R >> endobj 1007 0 obj << /Title 1008 0 R /A 1005 0 R -/Parent 967 0 R -/Prev 979 0 R -/Next 1011 0 R +/Parent 463 0 R +/Prev 903 0 R +/Next 1063 0 R +/First 1011 0 R +/Last 1051 0 R +/Count -5 >> endobj 1003 0 obj << /Title 1004 0 R /A 1001 0 R -/Parent 979 0 R -/Prev 999 0 R +/Parent 903 0 R +/Prev 987 0 R >> endobj 999 0 obj << /Title 1000 0 R /A 997 0 R -/Parent 979 0 R +/Parent 987 0 R /Prev 995 0 R -/Next 1003 0 R >> endobj 995 0 obj << /Title 996 0 R /A 993 0 R -/Parent 979 0 R +/Parent 987 0 R /Prev 991 0 R /Next 999 0 R >> endobj 991 0 obj << /Title 992 0 R /A 989 0 R -/Parent 979 0 R -/Prev 987 0 R +/Parent 987 0 R /Next 995 0 R >> endobj 987 0 obj << /Title 988 0 R /A 985 0 R -/Parent 979 0 R +/Parent 903 0 R /Prev 983 0 R -/Next 991 0 R +/Next 1003 0 R +/First 991 0 R +/Last 999 0 R +/Count -3 >> endobj 983 0 obj << /Title 984 0 R /A 981 0 R -/Parent 979 0 R +/Parent 903 0 R +/Prev 971 0 R /Next 987 0 R >> endobj 979 0 obj << /Title 980 0 R /A 977 0 R -/Parent 967 0 R +/Parent 971 0 R /Prev 975 0 R -/Next 1007 0 R -/First 983 0 R -/Last 1003 0 R -/Count -6 >> endobj 975 0 obj << /Title 976 0 R /A 973 0 R -/Parent 967 0 R -/Prev 971 0 R +/Parent 971 0 R /Next 979 0 R >> endobj 971 0 obj << /Title 972 0 R /A 969 0 R -/Parent 967 0 R -/Next 975 0 R +/Parent 903 0 R +/Prev 955 0 R +/Next 983 0 R +/First 975 0 R +/Last 979 0 R +/Count -2 >> endobj 967 0 obj << /Title 968 0 R /A 965 0 R -/Parent 455 0 R -/Prev 871 0 R -/Next 1023 0 R -/First 971 0 R -/Last 1011 0 R -/Count -5 +/Parent 959 0 R +/Prev 963 0 R >> endobj 963 0 obj << /Title 964 0 R /A 961 0 R -/Parent 871 0 R -/Prev 955 0 R +/Parent 959 0 R +/Next 967 0 R >> endobj 959 0 obj << /Title 960 0 R /A 957 0 R /Parent 955 0 R +/First 963 0 R +/Last 967 0 R +/Count -2 >> endobj 955 0 obj << /Title 956 0 R /A 953 0 R -/Parent 871 0 R -/Prev 951 0 R -/Next 963 0 R +/Parent 903 0 R +/Prev 911 0 R +/Next 971 0 R /First 959 0 R /Last 959 0 R /Count -1 @@ -36295,197 +39399,197 @@ endobj 951 0 obj << /Title 952 0 R /A 949 0 R -/Parent 871 0 R -/Prev 939 0 R -/Next 955 0 R +/Parent 915 0 R +/Prev 947 0 R >> endobj 947 0 obj << /Title 948 0 R /A 945 0 R -/Parent 939 0 R +/Parent 915 0 R /Prev 943 0 R +/Next 951 0 R >> endobj 943 0 obj << /Title 944 0 R /A 941 0 R -/Parent 939 0 R +/Parent 915 0 R +/Prev 939 0 R /Next 947 0 R >> endobj 939 0 obj << /Title 940 0 R /A 937 0 R -/Parent 871 0 R -/Prev 923 0 R -/Next 951 0 R -/First 943 0 R -/Last 947 0 R -/Count -2 +/Parent 915 0 R +/Prev 935 0 R +/Next 943 0 R >> endobj 935 0 obj << /Title 936 0 R /A 933 0 R -/Parent 927 0 R +/Parent 915 0 R /Prev 931 0 R +/Next 939 0 R >> endobj 931 0 obj << /Title 932 0 R /A 929 0 R -/Parent 927 0 R +/Parent 915 0 R +/Prev 927 0 R /Next 935 0 R >> endobj 927 0 obj << /Title 928 0 R /A 925 0 R -/Parent 923 0 R -/First 931 0 R -/Last 935 0 R -/Count -2 +/Parent 915 0 R +/Prev 923 0 R +/Next 931 0 R >> endobj 923 0 obj << /Title 924 0 R /A 921 0 R -/Parent 871 0 R -/Prev 879 0 R -/Next 939 0 R -/First 927 0 R -/Last 927 0 R -/Count -1 +/Parent 915 0 R +/Prev 919 0 R +/Next 927 0 R >> endobj 919 0 obj << /Title 920 0 R /A 917 0 R -/Parent 883 0 R -/Prev 915 0 R +/Parent 915 0 R +/Next 923 0 R >> endobj 915 0 obj << /Title 916 0 R /A 913 0 R -/Parent 883 0 R -/Prev 911 0 R -/Next 919 0 R +/Parent 911 0 R +/First 919 0 R +/Last 951 0 R +/Count -9 >> endobj 911 0 obj << /Title 912 0 R /A 909 0 R -/Parent 883 0 R +/Parent 903 0 R /Prev 907 0 R -/Next 915 0 R +/Next 955 0 R +/First 915 0 R +/Last 915 0 R +/Count -1 >> endobj 907 0 obj << /Title 908 0 R /A 905 0 R -/Parent 883 0 R -/Prev 903 0 R +/Parent 903 0 R /Next 911 0 R >> endobj 903 0 obj << /Title 904 0 R /A 901 0 R -/Parent 883 0 R -/Prev 899 0 R -/Next 907 0 R +/Parent 463 0 R +/Prev 791 0 R +/Next 1007 0 R +/First 907 0 R +/Last 1003 0 R +/Count -7 >> endobj 899 0 obj << /Title 900 0 R /A 897 0 R -/Parent 883 0 R +/Parent 887 0 R /Prev 895 0 R -/Next 903 0 R >> endobj 895 0 obj << /Title 896 0 R /A 893 0 R -/Parent 883 0 R +/Parent 887 0 R /Prev 891 0 R /Next 899 0 R >> endobj 891 0 obj << /Title 892 0 R /A 889 0 R -/Parent 883 0 R -/Prev 887 0 R +/Parent 887 0 R /Next 895 0 R >> endobj 887 0 obj << /Title 888 0 R /A 885 0 R -/Parent 883 0 R -/Next 891 0 R +/Parent 791 0 R +/Prev 847 0 R +/First 891 0 R +/Last 899 0 R +/Count -3 >> endobj 883 0 obj << /Title 884 0 R /A 881 0 R -/Parent 879 0 R -/First 887 0 R -/Last 919 0 R -/Count -9 +/Parent 847 0 R +/Prev 879 0 R >> endobj 879 0 obj << /Title 880 0 R /A 877 0 R -/Parent 871 0 R +/Parent 847 0 R /Prev 875 0 R -/Next 923 0 R -/First 883 0 R -/Last 883 0 R -/Count -1 +/Next 883 0 R >> endobj 875 0 obj << /Title 876 0 R /A 873 0 R -/Parent 871 0 R +/Parent 847 0 R +/Prev 863 0 R /Next 879 0 R >> endobj 871 0 obj << /Title 872 0 R /A 869 0 R -/Parent 455 0 R -/Prev 763 0 R -/Next 967 0 R -/First 875 0 R -/Last 963 0 R -/Count -7 +/Parent 863 0 R +/Prev 867 0 R >> endobj 867 0 obj << /Title 868 0 R /A 865 0 R -/Parent 859 0 R -/Prev 863 0 R +/Parent 863 0 R +/Next 871 0 R >> endobj 863 0 obj << /Title 864 0 R /A 861 0 R -/Parent 859 0 R -/Next 867 0 R +/Parent 847 0 R +/Prev 859 0 R +/Next 875 0 R +/First 867 0 R +/Last 871 0 R +/Count -2 >> endobj 859 0 obj << /Title 860 0 R /A 857 0 R -/Parent 763 0 R -/Prev 819 0 R -/First 863 0 R -/Last 867 0 R -/Count -2 +/Parent 847 0 R +/Prev 855 0 R +/Next 863 0 R >> endobj 855 0 obj << /Title 856 0 R /A 853 0 R -/Parent 819 0 R +/Parent 847 0 R /Prev 851 0 R +/Next 859 0 R >> endobj 851 0 obj << /Title 852 0 R /A 849 0 R -/Parent 819 0 R -/Prev 847 0 R +/Parent 847 0 R /Next 855 0 R >> endobj 847 0 obj << /Title 848 0 R /A 845 0 R -/Parent 819 0 R -/Prev 835 0 R -/Next 851 0 R +/Parent 791 0 R +/Prev 831 0 R +/Next 887 0 R +/First 851 0 R +/Last 883 0 R +/Count -7 >> endobj 843 0 obj << /Title 844 0 R @@ -36502,9 +39606,7 @@ endobj 835 0 obj << /Title 836 0 R /A 833 0 R -/Parent 819 0 R -/Prev 831 0 R -/Next 847 0 R +/Parent 831 0 R /First 839 0 R /Last 843 0 R /Count -2 @@ -36512,120 +39614,120 @@ endobj 831 0 obj << /Title 832 0 R /A 829 0 R -/Parent 819 0 R -/Prev 827 0 R -/Next 835 0 R +/Parent 791 0 R +/Prev 815 0 R +/Next 847 0 R +/First 835 0 R +/Last 835 0 R +/Count -1 >> endobj 827 0 obj << /Title 828 0 R /A 825 0 R -/Parent 819 0 R +/Parent 815 0 R /Prev 823 0 R -/Next 831 0 R >> endobj 823 0 obj << /Title 824 0 R /A 821 0 R -/Parent 819 0 R +/Parent 815 0 R +/Prev 819 0 R /Next 827 0 R >> endobj 819 0 obj << /Title 820 0 R /A 817 0 R -/Parent 763 0 R -/Prev 803 0 R -/Next 859 0 R -/First 823 0 R -/Last 855 0 R -/Count -7 +/Parent 815 0 R +/Next 823 0 R >> endobj 815 0 obj << /Title 816 0 R /A 813 0 R -/Parent 807 0 R -/Prev 811 0 R +/Parent 791 0 R +/Prev 799 0 R +/Next 831 0 R +/First 819 0 R +/Last 827 0 R +/Count -3 >> endobj 811 0 obj << /Title 812 0 R /A 809 0 R -/Parent 807 0 R -/Next 815 0 R +/Parent 799 0 R +/Prev 807 0 R >> endobj 807 0 obj << /Title 808 0 R /A 805 0 R -/Parent 803 0 R -/First 811 0 R -/Last 815 0 R -/Count -2 +/Parent 799 0 R +/Prev 803 0 R +/Next 811 0 R >> endobj 803 0 obj << /Title 804 0 R /A 801 0 R -/Parent 763 0 R -/Prev 787 0 R -/Next 819 0 R -/First 807 0 R -/Last 807 0 R -/Count -1 +/Parent 799 0 R +/Next 807 0 R >> endobj 799 0 obj << /Title 800 0 R /A 797 0 R -/Parent 787 0 R +/Parent 791 0 R /Prev 795 0 R +/Next 815 0 R +/First 803 0 R +/Last 811 0 R +/Count -3 >> endobj 795 0 obj << /Title 796 0 R /A 793 0 R -/Parent 787 0 R -/Prev 791 0 R +/Parent 791 0 R /Next 799 0 R >> endobj 791 0 obj << /Title 792 0 R /A 789 0 R -/Parent 787 0 R -/Next 795 0 R +/Parent 463 0 R +/Prev 747 0 R +/Next 903 0 R +/First 795 0 R +/Last 887 0 R +/Count -6 >> endobj 787 0 obj << /Title 788 0 R /A 785 0 R -/Parent 763 0 R -/Prev 771 0 R -/Next 803 0 R -/First 791 0 R -/Last 799 0 R -/Count -3 +/Parent 775 0 R +/Prev 783 0 R >> endobj 783 0 obj << /Title 784 0 R /A 781 0 R -/Parent 771 0 R +/Parent 775 0 R /Prev 779 0 R +/Next 787 0 R >> endobj 779 0 obj << /Title 780 0 R /A 777 0 R -/Parent 771 0 R -/Prev 775 0 R +/Parent 775 0 R /Next 783 0 R >> endobj 775 0 obj << /Title 776 0 R /A 773 0 R -/Parent 771 0 R -/Next 779 0 R +/Parent 747 0 R +/Prev 763 0 R +/First 779 0 R +/Last 787 0 R +/Count -3 >> endobj 771 0 obj << /Title 772 0 R /A 769 0 R /Parent 763 0 R /Prev 767 0 R -/Next 787 0 R -/First 775 0 R -/Last 783 0 R -/Count -3 >> endobj 767 0 obj << /Title 768 0 R @@ -36636,92 +39738,90 @@ endobj 763 0 obj << /Title 764 0 R /A 761 0 R -/Parent 455 0 R -/Prev 723 0 R -/Next 871 0 R +/Parent 747 0 R +/Prev 755 0 R +/Next 775 0 R /First 767 0 R -/Last 859 0 R -/Count -6 +/Last 771 0 R +/Count -2 >> endobj 759 0 obj << /Title 760 0 R /A 757 0 R -/Parent 751 0 R -/Prev 755 0 R +/Parent 755 0 R >> endobj 755 0 obj << /Title 756 0 R /A 753 0 R -/Parent 751 0 R -/Next 759 0 R +/Parent 747 0 R +/Prev 751 0 R +/Next 763 0 R +/First 759 0 R +/Last 759 0 R +/Count -1 >> endobj 751 0 obj << /Title 752 0 R /A 749 0 R -/Parent 723 0 R -/Prev 739 0 R -/First 755 0 R -/Last 759 0 R -/Count -2 +/Parent 747 0 R +/Next 755 0 R >> endobj 747 0 obj << /Title 748 0 R /A 745 0 R -/Parent 739 0 R -/Prev 743 0 R +/Parent 463 0 R +/Prev 595 0 R +/Next 791 0 R +/First 751 0 R +/Last 775 0 R +/Count -4 >> endobj 743 0 obj << /Title 744 0 R /A 741 0 R -/Parent 739 0 R -/Next 747 0 R +/Parent 731 0 R +/Prev 739 0 R >> endobj 739 0 obj << /Title 740 0 R /A 737 0 R -/Parent 723 0 R -/Prev 731 0 R -/Next 751 0 R -/First 743 0 R -/Last 747 0 R -/Count -2 +/Parent 731 0 R +/Prev 735 0 R +/Next 743 0 R >> endobj 735 0 obj << /Title 736 0 R /A 733 0 R /Parent 731 0 R +/Next 739 0 R >> endobj 731 0 obj << /Title 732 0 R /A 729 0 R -/Parent 723 0 R -/Prev 727 0 R -/Next 739 0 R +/Parent 595 0 R +/Prev 647 0 R /First 735 0 R -/Last 735 0 R -/Count -1 +/Last 743 0 R +/Count -3 >> endobj 727 0 obj << /Title 728 0 R /A 725 0 R -/Parent 723 0 R -/Next 731 0 R +/Parent 647 0 R +/Prev 707 0 R >> endobj 723 0 obj << /Title 724 0 R /A 721 0 R -/Parent 455 0 R -/Prev 583 0 R -/Next 763 0 R -/First 727 0 R -/Last 751 0 R -/Count -4 +/Parent 707 0 R +/Prev 719 0 R >> endobj 719 0 obj << /Title 720 0 R /A 717 0 R /Parent 707 0 R /Prev 715 0 R +/Next 723 0 R >> endobj 715 0 obj << /Title 716 0 R @@ -36739,670 +39839,671 @@ endobj 707 0 obj << /Title 708 0 R /A 705 0 R -/Parent 583 0 R -/Prev 623 0 R +/Parent 647 0 R +/Prev 663 0 R +/Next 727 0 R /First 711 0 R -/Last 719 0 R -/Count -3 +/Last 723 0 R +/Count -4 >> endobj 703 0 obj << /Title 704 0 R /A 701 0 R -/Parent 623 0 R -/Prev 683 0 R +/Parent 663 0 R +/Prev 699 0 R >> endobj 699 0 obj << /Title 700 0 R /A 697 0 R -/Parent 683 0 R +/Parent 663 0 R /Prev 695 0 R +/Next 703 0 R >> endobj 695 0 obj << /Title 696 0 R /A 693 0 R -/Parent 683 0 R +/Parent 663 0 R /Prev 691 0 R /Next 699 0 R >> endobj 691 0 obj << /Title 692 0 R /A 689 0 R -/Parent 683 0 R +/Parent 663 0 R /Prev 687 0 R /Next 695 0 R >> endobj 687 0 obj << /Title 688 0 R /A 685 0 R -/Parent 683 0 R +/Parent 663 0 R +/Prev 683 0 R /Next 691 0 R >> endobj 683 0 obj << /Title 684 0 R /A 681 0 R -/Parent 623 0 R -/Prev 639 0 R -/Next 703 0 R -/First 687 0 R -/Last 699 0 R -/Count -4 +/Parent 663 0 R +/Prev 679 0 R +/Next 687 0 R >> endobj 679 0 obj << /Title 680 0 R /A 677 0 R -/Parent 639 0 R +/Parent 663 0 R /Prev 675 0 R +/Next 683 0 R >> endobj 675 0 obj << /Title 676 0 R /A 673 0 R -/Parent 639 0 R +/Parent 663 0 R /Prev 671 0 R /Next 679 0 R >> endobj 671 0 obj << /Title 672 0 R /A 669 0 R -/Parent 639 0 R +/Parent 663 0 R /Prev 667 0 R /Next 675 0 R >> endobj 667 0 obj << /Title 668 0 R /A 665 0 R -/Parent 639 0 R -/Prev 663 0 R +/Parent 663 0 R /Next 671 0 R >> endobj 663 0 obj << /Title 664 0 R /A 661 0 R -/Parent 639 0 R +/Parent 647 0 R /Prev 659 0 R -/Next 667 0 R +/Next 707 0 R +/First 667 0 R +/Last 703 0 R +/Count -10 >> endobj 659 0 obj << /Title 660 0 R /A 657 0 R -/Parent 639 0 R +/Parent 647 0 R /Prev 655 0 R /Next 663 0 R >> endobj 655 0 obj << /Title 656 0 R /A 653 0 R -/Parent 639 0 R +/Parent 647 0 R /Prev 651 0 R /Next 659 0 R >> endobj 651 0 obj << /Title 652 0 R /A 649 0 R -/Parent 639 0 R -/Prev 647 0 R +/Parent 647 0 R /Next 655 0 R >> endobj 647 0 obj << /Title 648 0 R /A 645 0 R -/Parent 639 0 R -/Prev 643 0 R -/Next 651 0 R +/Parent 595 0 R +/Prev 635 0 R +/Next 731 0 R +/First 651 0 R +/Last 727 0 R +/Count -6 >> endobj 643 0 obj << /Title 644 0 R /A 641 0 R -/Parent 639 0 R -/Next 647 0 R +/Parent 635 0 R +/Prev 639 0 R >> endobj 639 0 obj << /Title 640 0 R /A 637 0 R -/Parent 623 0 R -/Prev 635 0 R -/Next 683 0 R -/First 643 0 R -/Last 679 0 R -/Count -10 +/Parent 635 0 R +/Next 643 0 R >> endobj 635 0 obj << /Title 636 0 R /A 633 0 R -/Parent 623 0 R -/Prev 631 0 R -/Next 639 0 R +/Parent 595 0 R +/Prev 611 0 R +/Next 647 0 R +/First 639 0 R +/Last 643 0 R +/Count -2 >> endobj 631 0 obj << /Title 632 0 R /A 629 0 R -/Parent 623 0 R +/Parent 611 0 R /Prev 627 0 R -/Next 635 0 R >> endobj 627 0 obj << /Title 628 0 R /A 625 0 R -/Parent 623 0 R +/Parent 611 0 R +/Prev 615 0 R /Next 631 0 R >> endobj 623 0 obj << /Title 624 0 R /A 621 0 R -/Parent 583 0 R -/Prev 611 0 R -/Next 707 0 R -/First 627 0 R -/Last 703 0 R -/Count -6 +/Parent 615 0 R +/Prev 619 0 R >> endobj 619 0 obj << /Title 620 0 R /A 617 0 R -/Parent 611 0 R -/Prev 615 0 R +/Parent 615 0 R +/Next 623 0 R >> endobj 615 0 obj << /Title 616 0 R /A 613 0 R /Parent 611 0 R -/Next 619 0 R +/Next 627 0 R +/First 619 0 R +/Last 623 0 R +/Count -2 >> endobj 611 0 obj << /Title 612 0 R /A 609 0 R -/Parent 583 0 R -/Prev 591 0 R -/Next 623 0 R +/Parent 595 0 R +/Prev 599 0 R +/Next 635 0 R /First 615 0 R -/Last 619 0 R -/Count -2 +/Last 631 0 R +/Count -3 >> endobj 607 0 obj << /Title 608 0 R /A 605 0 R -/Parent 591 0 R -/Prev 595 0 R +/Parent 599 0 R +/Prev 603 0 R >> endobj 603 0 obj << /Title 604 0 R /A 601 0 R -/Parent 595 0 R -/Prev 599 0 R +/Parent 599 0 R +/Next 607 0 R >> endobj 599 0 obj << /Title 600 0 R /A 597 0 R /Parent 595 0 R -/Next 603 0 R +/Next 611 0 R +/First 603 0 R +/Last 607 0 R +/Count -2 >> endobj 595 0 obj << /Title 596 0 R /A 593 0 R -/Parent 591 0 R -/Next 607 0 R +/Parent 463 0 R +/Prev 467 0 R +/Next 747 0 R /First 599 0 R -/Last 603 0 R -/Count -2 +/Last 731 0 R +/Count -5 >> endobj 591 0 obj << /Title 592 0 R /A 589 0 R -/Parent 583 0 R +/Parent 579 0 R /Prev 587 0 R -/Next 611 0 R -/First 595 0 R -/Last 607 0 R -/Count -2 >> endobj 587 0 obj << /Title 588 0 R /A 585 0 R -/Parent 583 0 R +/Parent 579 0 R +/Prev 583 0 R /Next 591 0 R >> endobj 583 0 obj << /Title 584 0 R /A 581 0 R -/Parent 455 0 R -/Prev 459 0 R -/Next 723 0 R -/First 587 0 R -/Last 707 0 R -/Count -5 +/Parent 579 0 R +/Next 587 0 R >> endobj 579 0 obj << /Title 580 0 R /A 577 0 R -/Parent 571 0 R -/Prev 575 0 R +/Parent 467 0 R +/Prev 559 0 R +/First 583 0 R +/Last 591 0 R +/Count -3 >> endobj 575 0 obj << /Title 576 0 R /A 573 0 R /Parent 571 0 R -/Next 579 0 R >> endobj 571 0 obj << /Title 572 0 R /A 569 0 R -/Parent 459 0 R -/Prev 551 0 R +/Parent 559 0 R +/Prev 567 0 R /First 575 0 R -/Last 579 0 R -/Count -2 +/Last 575 0 R +/Count -1 >> endobj 567 0 obj << /Title 568 0 R /A 565 0 R -/Parent 563 0 R +/Parent 559 0 R +/Prev 563 0 R +/Next 571 0 R >> endobj 563 0 obj << /Title 564 0 R /A 561 0 R -/Parent 551 0 R -/Prev 559 0 R -/First 567 0 R -/Last 567 0 R -/Count -1 +/Parent 559 0 R +/Next 567 0 R >> endobj 559 0 obj << /Title 560 0 R /A 557 0 R -/Parent 551 0 R -/Prev 555 0 R -/Next 563 0 R +/Parent 467 0 R +/Prev 547 0 R +/Next 579 0 R +/First 563 0 R +/Last 571 0 R +/Count -3 >> endobj 555 0 obj << /Title 556 0 R /A 553 0 R -/Parent 551 0 R -/Next 559 0 R +/Parent 547 0 R +/Prev 551 0 R >> endobj 551 0 obj << /Title 552 0 R /A 549 0 R -/Parent 459 0 R -/Prev 539 0 R -/Next 571 0 R -/First 555 0 R -/Last 563 0 R -/Count -3 +/Parent 547 0 R +/Next 555 0 R >> endobj 547 0 obj << /Title 548 0 R /A 545 0 R -/Parent 539 0 R -/Prev 543 0 R +/Parent 467 0 R +/Prev 531 0 R +/Next 559 0 R +/First 551 0 R +/Last 555 0 R +/Count -2 >> endobj 543 0 obj << /Title 544 0 R /A 541 0 R -/Parent 539 0 R -/Next 547 0 R +/Parent 531 0 R +/Prev 539 0 R >> endobj 539 0 obj << /Title 540 0 R /A 537 0 R -/Parent 459 0 R -/Prev 523 0 R -/Next 551 0 R -/First 543 0 R -/Last 547 0 R -/Count -2 +/Parent 531 0 R +/Prev 535 0 R +/Next 543 0 R >> endobj 535 0 obj << /Title 536 0 R /A 533 0 R -/Parent 523 0 R -/Prev 531 0 R +/Parent 531 0 R +/Next 539 0 R >> endobj 531 0 obj << /Title 532 0 R /A 529 0 R -/Parent 523 0 R -/Prev 527 0 R -/Next 535 0 R +/Parent 467 0 R +/Prev 495 0 R +/Next 547 0 R +/First 535 0 R +/Last 543 0 R +/Count -3 >> endobj 527 0 obj << /Title 528 0 R /A 525 0 R -/Parent 523 0 R -/Next 531 0 R +/Parent 495 0 R +/Prev 523 0 R >> endobj 523 0 obj << /Title 524 0 R /A 521 0 R -/Parent 459 0 R -/Prev 487 0 R -/Next 539 0 R -/First 527 0 R -/Last 535 0 R -/Count -3 +/Parent 495 0 R +/Prev 519 0 R +/Next 527 0 R >> endobj 519 0 obj << /Title 520 0 R /A 517 0 R -/Parent 487 0 R +/Parent 495 0 R /Prev 515 0 R +/Next 523 0 R >> endobj 515 0 obj << /Title 516 0 R /A 513 0 R -/Parent 487 0 R +/Parent 495 0 R /Prev 511 0 R /Next 519 0 R >> endobj 511 0 obj << /Title 512 0 R /A 509 0 R -/Parent 487 0 R +/Parent 495 0 R /Prev 507 0 R /Next 515 0 R >> endobj 507 0 obj << /Title 508 0 R /A 505 0 R -/Parent 487 0 R +/Parent 495 0 R /Prev 503 0 R /Next 511 0 R >> endobj 503 0 obj << /Title 504 0 R /A 501 0 R -/Parent 487 0 R +/Parent 495 0 R /Prev 499 0 R /Next 507 0 R >> endobj 499 0 obj << /Title 500 0 R /A 497 0 R -/Parent 487 0 R -/Prev 495 0 R +/Parent 495 0 R /Next 503 0 R >> endobj 495 0 obj << /Title 496 0 R /A 493 0 R -/Parent 487 0 R -/Prev 491 0 R -/Next 499 0 R +/Parent 467 0 R +/Prev 479 0 R +/Next 531 0 R +/First 499 0 R +/Last 527 0 R +/Count -8 >> endobj 491 0 obj << /Title 492 0 R /A 489 0 R -/Parent 487 0 R -/Next 495 0 R +/Parent 479 0 R +/Prev 487 0 R >> endobj 487 0 obj << /Title 488 0 R /A 485 0 R -/Parent 459 0 R -/Prev 471 0 R -/Next 523 0 R -/First 491 0 R -/Last 519 0 R -/Count -8 +/Parent 479 0 R +/Prev 483 0 R +/Next 491 0 R >> endobj 483 0 obj << /Title 484 0 R /A 481 0 R -/Parent 471 0 R -/Prev 479 0 R +/Parent 479 0 R +/Next 487 0 R >> endobj 479 0 obj << /Title 480 0 R /A 477 0 R -/Parent 471 0 R +/Parent 467 0 R /Prev 475 0 R -/Next 483 0 R +/Next 495 0 R +/First 483 0 R +/Last 491 0 R +/Count -3 >> endobj 475 0 obj << /Title 476 0 R /A 473 0 R -/Parent 471 0 R +/Parent 467 0 R +/Prev 471 0 R /Next 479 0 R >> endobj 471 0 obj << /Title 472 0 R /A 469 0 R -/Parent 459 0 R -/Prev 467 0 R -/Next 487 0 R -/First 475 0 R -/Last 483 0 R -/Count -3 +/Parent 467 0 R +/Next 475 0 R >> endobj 467 0 obj << /Title 468 0 R /A 465 0 R -/Parent 459 0 R -/Prev 463 0 R -/Next 471 0 R +/Parent 463 0 R +/Next 595 0 R +/First 471 0 R +/Last 579 0 R +/Count -8 >> endobj 463 0 obj << /Title 464 0 R /A 461 0 R -/Parent 459 0 R -/Next 467 0 R +/Parent 7250 0 R +/Prev 103 0 R +/Next 2459 0 R +/First 467 0 R +/Last 2451 0 R +/Count -20 >> endobj 459 0 obj << /Title 460 0 R /A 457 0 R /Parent 455 0 R -/Next 583 0 R -/First 463 0 R -/Last 571 0 R -/Count -8 >> endobj 455 0 obj << /Title 456 0 R /A 453 0 R -/Parent 6735 0 R -/Prev 99 0 R -/Next 2419 0 R +/Parent 103 0 R +/Prev 427 0 R /First 459 0 R -/Last 2411 0 R -/Count -20 +/Last 459 0 R +/Count -1 >> endobj 451 0 obj << /Title 452 0 R /A 449 0 R -/Parent 447 0 R +/Parent 427 0 R +/Prev 439 0 R >> endobj 447 0 obj << /Title 448 0 R /A 445 0 R -/Parent 99 0 R -/Prev 419 0 R -/First 451 0 R -/Last 451 0 R -/Count -1 +/Parent 439 0 R +/Prev 443 0 R >> endobj 443 0 obj << /Title 444 0 R /A 441 0 R -/Parent 419 0 R -/Prev 431 0 R +/Parent 439 0 R +/Next 447 0 R >> endobj 439 0 obj << /Title 440 0 R /A 437 0 R -/Parent 431 0 R +/Parent 427 0 R /Prev 435 0 R +/Next 451 0 R +/First 443 0 R +/Last 447 0 R +/Count -2 >> endobj 435 0 obj << /Title 436 0 R /A 433 0 R -/Parent 431 0 R +/Parent 427 0 R +/Prev 431 0 R /Next 439 0 R >> endobj 431 0 obj << /Title 432 0 R /A 429 0 R -/Parent 419 0 R -/Prev 427 0 R -/Next 443 0 R -/First 435 0 R -/Last 439 0 R -/Count -2 +/Parent 427 0 R +/Next 435 0 R >> endobj 427 0 obj << /Title 428 0 R /A 425 0 R -/Parent 419 0 R -/Prev 423 0 R -/Next 431 0 R +/Parent 103 0 R +/Prev 331 0 R +/Next 455 0 R +/First 431 0 R +/Last 451 0 R +/Count -4 >> endobj 423 0 obj << /Title 424 0 R /A 421 0 R -/Parent 419 0 R -/Next 427 0 R +/Parent 415 0 R +/Prev 419 0 R >> endobj 419 0 obj << /Title 420 0 R /A 417 0 R -/Parent 99 0 R -/Prev 323 0 R -/Next 447 0 R -/First 423 0 R -/Last 443 0 R -/Count -4 +/Parent 415 0 R +/Next 423 0 R >> endobj 415 0 obj << /Title 416 0 R /A 413 0 R -/Parent 407 0 R -/Prev 411 0 R +/Parent 331 0 R +/Prev 383 0 R +/First 419 0 R +/Last 423 0 R +/Count -2 >> endobj 411 0 obj << /Title 412 0 R /A 409 0 R -/Parent 407 0 R -/Next 415 0 R +/Parent 383 0 R +/Prev 407 0 R >> endobj 407 0 obj << /Title 408 0 R /A 405 0 R -/Parent 323 0 R -/Prev 375 0 R -/First 411 0 R -/Last 415 0 R -/Count -2 +/Parent 383 0 R +/Prev 403 0 R +/Next 411 0 R >> endobj 403 0 obj << /Title 404 0 R /A 401 0 R -/Parent 375 0 R -/Prev 399 0 R +/Parent 383 0 R +/Prev 395 0 R +/Next 407 0 R >> endobj 399 0 obj << /Title 400 0 R /A 397 0 R -/Parent 375 0 R -/Prev 395 0 R -/Next 403 0 R +/Parent 395 0 R >> endobj 395 0 obj << /Title 396 0 R /A 393 0 R -/Parent 375 0 R -/Prev 387 0 R -/Next 399 0 R +/Parent 383 0 R +/Prev 391 0 R +/Next 403 0 R +/First 399 0 R +/Last 399 0 R +/Count -1 >> endobj 391 0 obj << /Title 392 0 R /A 389 0 R -/Parent 387 0 R +/Parent 383 0 R +/Prev 387 0 R +/Next 395 0 R >> endobj 387 0 obj << /Title 388 0 R /A 385 0 R -/Parent 375 0 R -/Prev 383 0 R -/Next 395 0 R -/First 391 0 R -/Last 391 0 R -/Count -1 +/Parent 383 0 R +/Next 391 0 R >> endobj 383 0 obj << /Title 384 0 R /A 381 0 R -/Parent 375 0 R -/Prev 379 0 R -/Next 387 0 R +/Parent 331 0 R +/Prev 371 0 R +/Next 415 0 R +/First 387 0 R +/Last 411 0 R +/Count -6 >> endobj 379 0 obj << /Title 380 0 R /A 377 0 R -/Parent 375 0 R -/Next 383 0 R +/Parent 371 0 R +/Prev 375 0 R >> endobj 375 0 obj << /Title 376 0 R /A 373 0 R -/Parent 323 0 R -/Prev 363 0 R -/Next 407 0 R -/First 379 0 R -/Last 403 0 R -/Count -6 +/Parent 371 0 R +/Next 379 0 R >> endobj 371 0 obj << /Title 372 0 R /A 369 0 R -/Parent 363 0 R -/Prev 367 0 R +/Parent 331 0 R +/Prev 339 0 R +/Next 383 0 R +/First 375 0 R +/Last 379 0 R +/Count -2 >> endobj 367 0 obj << /Title 368 0 R /A 365 0 R -/Parent 363 0 R -/Next 371 0 R +/Parent 355 0 R +/Prev 363 0 R >> endobj 363 0 obj << /Title 364 0 R /A 361 0 R -/Parent 323 0 R -/Prev 331 0 R -/Next 375 0 R -/First 367 0 R -/Last 371 0 R -/Count -2 +/Parent 355 0 R +/Prev 359 0 R +/Next 367 0 R >> endobj 359 0 obj << /Title 360 0 R /A 357 0 R -/Parent 347 0 R -/Prev 355 0 R +/Parent 355 0 R +/Next 363 0 R >> endobj 355 0 obj << /Title 356 0 R /A 353 0 R -/Parent 347 0 R +/Parent 339 0 R /Prev 351 0 R -/Next 359 0 R +/First 359 0 R +/Last 367 0 R +/Count -3 >> endobj 351 0 obj << /Title 352 0 R /A 349 0 R -/Parent 347 0 R +/Parent 339 0 R +/Prev 347 0 R /Next 355 0 R >> endobj 347 0 obj << /Title 348 0 R /A 345 0 R -/Parent 331 0 R +/Parent 339 0 R /Prev 343 0 R -/First 351 0 R -/Last 359 0 R -/Count -3 +/Next 351 0 R >> endobj 343 0 obj << /Title 344 0 R /A 341 0 R -/Parent 331 0 R -/Prev 339 0 R +/Parent 339 0 R /Next 347 0 R >> endobj 339 0 obj << @@ -37410,7 +40511,10 @@ endobj /A 337 0 R /Parent 331 0 R /Prev 335 0 R -/Next 343 0 R +/Next 371 0 R +/First 343 0 R +/Last 355 0 R +/Count -4 >> endobj 335 0 obj << /Title 336 0 R @@ -37421,460 +40525,458 @@ endobj 331 0 obj << /Title 332 0 R /A 329 0 R -/Parent 323 0 R -/Prev 327 0 R -/Next 363 0 R +/Parent 103 0 R +/Prev 271 0 R +/Next 427 0 R /First 335 0 R -/Last 347 0 R -/Count -4 +/Last 415 0 R +/Count -5 >> endobj 327 0 obj << /Title 328 0 R /A 325 0 R -/Parent 323 0 R -/Next 331 0 R +/Parent 311 0 R +/Prev 323 0 R >> endobj 323 0 obj << /Title 324 0 R /A 321 0 R -/Parent 99 0 R -/Prev 263 0 R -/Next 419 0 R -/First 327 0 R -/Last 407 0 R -/Count -5 +/Parent 311 0 R +/Prev 319 0 R +/Next 327 0 R >> endobj 319 0 obj << /Title 320 0 R /A 317 0 R -/Parent 303 0 R +/Parent 311 0 R /Prev 315 0 R +/Next 323 0 R >> endobj 315 0 obj << /Title 316 0 R /A 313 0 R -/Parent 303 0 R -/Prev 311 0 R +/Parent 311 0 R /Next 319 0 R >> endobj 311 0 obj << /Title 312 0 R /A 309 0 R -/Parent 303 0 R -/Prev 307 0 R -/Next 315 0 R +/Parent 271 0 R +/Prev 303 0 R +/First 315 0 R +/Last 327 0 R +/Count -4 >> endobj 307 0 obj << /Title 308 0 R /A 305 0 R /Parent 303 0 R -/Next 311 0 R >> endobj 303 0 obj << /Title 304 0 R /A 301 0 R -/Parent 263 0 R -/Prev 295 0 R +/Parent 271 0 R +/Prev 279 0 R +/Next 311 0 R /First 307 0 R -/Last 319 0 R -/Count -4 +/Last 307 0 R +/Count -1 >> endobj 299 0 obj << /Title 300 0 R /A 297 0 R -/Parent 295 0 R +/Parent 279 0 R +/Prev 295 0 R >> endobj 295 0 obj << /Title 296 0 R /A 293 0 R -/Parent 263 0 R -/Prev 271 0 R -/Next 303 0 R -/First 299 0 R -/Last 299 0 R -/Count -1 +/Parent 279 0 R +/Prev 291 0 R +/Next 299 0 R >> endobj 291 0 obj << /Title 292 0 R /A 289 0 R -/Parent 271 0 R -/Prev 287 0 R +/Parent 279 0 R +/Prev 283 0 R +/Next 295 0 R >> endobj 287 0 obj << /Title 288 0 R /A 285 0 R -/Parent 271 0 R -/Prev 283 0 R -/Next 291 0 R +/Parent 283 0 R >> endobj 283 0 obj << /Title 284 0 R /A 281 0 R -/Parent 271 0 R -/Prev 275 0 R -/Next 287 0 R +/Parent 279 0 R +/Next 291 0 R +/First 287 0 R +/Last 287 0 R +/Count -1 >> endobj 279 0 obj << /Title 280 0 R /A 277 0 R -/Parent 275 0 R +/Parent 271 0 R +/Prev 275 0 R +/Next 303 0 R +/First 283 0 R +/Last 299 0 R +/Count -4 >> endobj 275 0 obj << /Title 276 0 R /A 273 0 R /Parent 271 0 R -/Next 283 0 R -/First 279 0 R -/Last 279 0 R -/Count -1 +/Next 279 0 R >> endobj 271 0 obj << /Title 272 0 R /A 269 0 R -/Parent 263 0 R -/Prev 267 0 R -/Next 295 0 R +/Parent 103 0 R +/Prev 187 0 R +/Next 331 0 R /First 275 0 R -/Last 291 0 R +/Last 311 0 R /Count -4 >> endobj 267 0 obj << /Title 268 0 R /A 265 0 R -/Parent 263 0 R -/Next 271 0 R +/Parent 239 0 R +/Prev 263 0 R >> endobj 263 0 obj << /Title 264 0 R /A 261 0 R -/Parent 99 0 R -/Prev 183 0 R -/Next 323 0 R -/First 267 0 R -/Last 303 0 R -/Count -4 +/Parent 239 0 R +/Prev 259 0 R +/Next 267 0 R >> endobj 259 0 obj << /Title 260 0 R /A 257 0 R -/Parent 235 0 R +/Parent 239 0 R /Prev 255 0 R +/Next 263 0 R >> endobj 255 0 obj << /Title 256 0 R /A 253 0 R -/Parent 235 0 R +/Parent 239 0 R /Prev 251 0 R /Next 259 0 R >> endobj 251 0 obj << /Title 252 0 R /A 249 0 R -/Parent 235 0 R +/Parent 239 0 R /Prev 247 0 R /Next 255 0 R >> endobj 247 0 obj << /Title 248 0 R /A 245 0 R -/Parent 235 0 R +/Parent 239 0 R /Prev 243 0 R /Next 251 0 R >> endobj 243 0 obj << /Title 244 0 R /A 241 0 R -/Parent 235 0 R -/Prev 239 0 R +/Parent 239 0 R /Next 247 0 R >> endobj 239 0 obj << /Title 240 0 R /A 237 0 R -/Parent 235 0 R -/Next 243 0 R +/Parent 187 0 R +/Prev 215 0 R +/First 243 0 R +/Last 267 0 R +/Count -7 >> endobj 235 0 obj << /Title 236 0 R /A 233 0 R -/Parent 183 0 R -/Prev 211 0 R -/First 239 0 R -/Last 259 0 R -/Count -6 +/Parent 215 0 R +/Prev 219 0 R >> endobj 231 0 obj << /Title 232 0 R /A 229 0 R -/Parent 211 0 R -/Prev 215 0 R +/Parent 219 0 R +/Prev 227 0 R >> endobj 227 0 obj << /Title 228 0 R /A 225 0 R -/Parent 215 0 R +/Parent 219 0 R /Prev 223 0 R +/Next 231 0 R >> endobj 223 0 obj << /Title 224 0 R /A 221 0 R -/Parent 215 0 R -/Prev 219 0 R +/Parent 219 0 R /Next 227 0 R >> endobj 219 0 obj << /Title 220 0 R /A 217 0 R /Parent 215 0 R -/Next 223 0 R +/Next 235 0 R +/First 223 0 R +/Last 231 0 R +/Count -3 >> endobj 215 0 obj << /Title 216 0 R /A 213 0 R -/Parent 211 0 R -/Next 231 0 R +/Parent 187 0 R +/Prev 211 0 R +/Next 239 0 R /First 219 0 R -/Last 227 0 R -/Count -3 +/Last 235 0 R +/Count -2 >> endobj 211 0 obj << /Title 212 0 R /A 209 0 R -/Parent 183 0 R +/Parent 187 0 R /Prev 207 0 R -/Next 235 0 R -/First 215 0 R -/Last 231 0 R -/Count -2 +/Next 215 0 R >> endobj 207 0 obj << /Title 208 0 R /A 205 0 R -/Parent 183 0 R -/Prev 203 0 R +/Parent 187 0 R +/Prev 195 0 R /Next 211 0 R >> endobj 203 0 obj << /Title 204 0 R /A 201 0 R -/Parent 183 0 R -/Prev 191 0 R -/Next 207 0 R +/Parent 195 0 R +/Prev 199 0 R >> endobj 199 0 obj << /Title 200 0 R /A 197 0 R -/Parent 191 0 R -/Prev 195 0 R +/Parent 195 0 R +/Next 203 0 R >> endobj 195 0 obj << /Title 196 0 R /A 193 0 R -/Parent 191 0 R -/Next 199 0 R +/Parent 187 0 R +/Prev 191 0 R +/Next 207 0 R +/First 199 0 R +/Last 203 0 R +/Count -2 >> endobj 191 0 obj << /Title 192 0 R /A 189 0 R -/Parent 183 0 R -/Prev 187 0 R -/Next 203 0 R -/First 195 0 R -/Last 199 0 R -/Count -2 +/Parent 187 0 R +/Next 195 0 R >> endobj 187 0 obj << /Title 188 0 R /A 185 0 R -/Parent 183 0 R -/Next 191 0 R +/Parent 103 0 R +/Prev 107 0 R +/Next 271 0 R +/First 191 0 R +/Last 239 0 R +/Count -6 >> endobj 183 0 obj << /Title 184 0 R /A 181 0 R -/Parent 99 0 R -/Prev 103 0 R -/Next 263 0 R -/First 187 0 R -/Last 235 0 R -/Count -6 +/Parent 167 0 R +/Prev 179 0 R >> endobj 179 0 obj << /Title 180 0 R /A 177 0 R -/Parent 163 0 R +/Parent 167 0 R /Prev 175 0 R +/Next 183 0 R >> endobj 175 0 obj << /Title 176 0 R /A 173 0 R -/Parent 163 0 R +/Parent 167 0 R /Prev 171 0 R /Next 179 0 R >> endobj 171 0 obj << /Title 172 0 R /A 169 0 R -/Parent 163 0 R -/Prev 167 0 R +/Parent 167 0 R /Next 175 0 R >> endobj 167 0 obj << /Title 168 0 R /A 165 0 R -/Parent 163 0 R -/Next 171 0 R +/Parent 107 0 R +/Prev 163 0 R +/First 171 0 R +/Last 183 0 R +/Count -4 >> endobj 163 0 obj << /Title 164 0 R /A 161 0 R -/Parent 103 0 R -/Prev 159 0 R -/First 167 0 R -/Last 179 0 R -/Count -4 +/Parent 107 0 R +/Prev 119 0 R +/Next 167 0 R >> endobj 159 0 obj << /Title 160 0 R /A 157 0 R -/Parent 103 0 R -/Prev 115 0 R -/Next 163 0 R +/Parent 155 0 R >> endobj 155 0 obj << /Title 156 0 R /A 153 0 R -/Parent 151 0 R +/Parent 119 0 R +/Prev 147 0 R +/First 159 0 R +/Last 159 0 R +/Count -1 >> endobj 151 0 obj << /Title 152 0 R /A 149 0 R -/Parent 115 0 R -/Prev 143 0 R -/First 155 0 R -/Last 155 0 R -/Count -1 +/Parent 147 0 R >> endobj 147 0 obj << /Title 148 0 R /A 145 0 R -/Parent 143 0 R +/Parent 119 0 R +/Prev 139 0 R +/Next 155 0 R +/First 151 0 R +/Last 151 0 R +/Count -1 >> endobj 143 0 obj << /Title 144 0 R /A 141 0 R -/Parent 115 0 R -/Prev 135 0 R -/Next 151 0 R -/First 147 0 R -/Last 147 0 R -/Count -1 +/Parent 139 0 R >> endobj 139 0 obj << /Title 140 0 R /A 137 0 R -/Parent 135 0 R +/Parent 119 0 R +/Prev 131 0 R +/Next 147 0 R +/First 143 0 R +/Last 143 0 R +/Count -1 >> endobj 135 0 obj << /Title 136 0 R /A 133 0 R -/Parent 115 0 R -/Prev 127 0 R -/Next 143 0 R -/First 139 0 R -/Last 139 0 R -/Count -1 +/Parent 131 0 R >> endobj 131 0 obj << /Title 132 0 R /A 129 0 R -/Parent 127 0 R +/Parent 119 0 R +/Prev 123 0 R +/Next 139 0 R +/First 135 0 R +/Last 135 0 R +/Count -1 >> endobj 127 0 obj << /Title 128 0 R /A 125 0 R -/Parent 115 0 R -/Prev 119 0 R -/Next 135 0 R -/First 131 0 R -/Last 131 0 R -/Count -1 +/Parent 123 0 R >> endobj 123 0 obj << /Title 124 0 R /A 121 0 R /Parent 119 0 R +/Next 131 0 R +/First 127 0 R +/Last 127 0 R +/Count -1 >> endobj 119 0 obj << /Title 120 0 R /A 117 0 R -/Parent 115 0 R -/Next 127 0 R +/Parent 107 0 R +/Prev 115 0 R +/Next 163 0 R /First 123 0 R -/Last 123 0 R -/Count -1 +/Last 155 0 R +/Count -5 >> endobj 115 0 obj << /Title 116 0 R /A 113 0 R -/Parent 103 0 R +/Parent 107 0 R /Prev 111 0 R -/Next 159 0 R -/First 119 0 R -/Last 151 0 R -/Count -5 +/Next 119 0 R >> endobj 111 0 obj << /Title 112 0 R /A 109 0 R -/Parent 103 0 R -/Prev 107 0 R +/Parent 107 0 R /Next 115 0 R >> endobj 107 0 obj << /Title 108 0 R /A 105 0 R /Parent 103 0 R -/Next 111 0 R +/Next 187 0 R +/First 111 0 R +/Last 167 0 R +/Count -5 >> endobj 103 0 obj << /Title 104 0 R /A 101 0 R -/Parent 99 0 R -/Next 183 0 R +/Parent 7250 0 R +/Prev 7 0 R +/Next 463 0 R /First 107 0 R -/Last 163 0 R -/Count -5 +/Last 455 0 R +/Count -6 >> endobj 99 0 obj << /Title 100 0 R /A 97 0 R -/Parent 6735 0 R -/Prev 7 0 R -/Next 455 0 R -/First 103 0 R -/Last 447 0 R -/Count -6 +/Parent 95 0 R >> endobj 95 0 obj << /Title 96 0 R /A 93 0 R -/Parent 91 0 R +/Parent 7 0 R +/Prev 39 0 R +/First 99 0 R +/Last 99 0 R +/Count -1 >> endobj 91 0 obj << /Title 92 0 R /A 89 0 R -/Parent 7 0 R -/Prev 39 0 R -/First 95 0 R -/Last 95 0 R -/Count -1 +/Parent 79 0 R +/Prev 87 0 R >> endobj 87 0 obj << /Title 88 0 R /A 85 0 R /Parent 79 0 R /Prev 83 0 R +/Next 91 0 R >> endobj 83 0 obj << /Title 84 0 R @@ -37888,8 +40990,8 @@ endobj /Parent 39 0 R /Prev 75 0 R /First 83 0 R -/Last 87 0 R -/Count -2 +/Last 91 0 R +/Count -3 >> endobj 75 0 obj << /Title 76 0 R @@ -37960,7 +41062,7 @@ endobj /A 37 0 R /Parent 7 0 R /Prev 11 0 R -/Next 91 0 R +/Next 95 0 R /First 43 0 R /Last 79 0 R /Count -7 @@ -38017,6784 +41119,7299 @@ endobj 7 0 obj << /Title 8 0 R /A 5 0 R -/Parent 6735 0 R -/Next 99 0 R +/Parent 7250 0 R +/Next 103 0 R /First 11 0 R -/Last 91 0 R +/Last 95 0 R /Count -3 >> endobj -6736 0 obj << -/Names [(AccessControls) 2959 0 R (AdvancedNetworkManagement) 3024 0 R (Appendixes) 6519 0 R (Backup) 3030 0 R (CUPS-printing) 3021 0 R (ClientConfig) 2955 0 R (DNSDHCP) 3065 0 R (Doc-Start) 2862 0 R (FastStart) 2949 0 R (Further-Resources) 3066 0 R (InterdomainTrusts) 3018 0 R (IntroSMB) 2947 0 R (Item.1) 3946 0 R (Item.10) 4079 0 R (Item.100) 5705 0 R (Item.101) 5706 0 R (Item.102) 5707 0 R (Item.103) 5708 0 R (Item.104) 5709 0 R (Item.105) 5710 0 R (Item.106) 5711 0 R (Item.107) 5712 0 R (Item.108) 5713 0 R (Item.109) 5978 0 R (Item.11) 4080 0 R (Item.110) 5979 0 R (Item.111) 5980 0 R (Item.112) 5981 0 R (Item.113) 5992 0 R (Item.114) 5993 0 R (Item.115) 5994 0 R (Item.116) 5995 0 R (Item.117) 5996 0 R (Item.118) 5997 0 R (Item.119) 6002 0 R (Item.12) 4157 0 R (Item.120) 6003 0 R (Item.121) 6004 0 R (Item.122) 6028 0 R (Item.123) 6033 0 R (Item.124) 6034 0 R (Item.125) 6035 0 R (Item.126) 6036 0 R (Item.127) 6037 0 R (Item.128) 6038 0 R (Item.129) 6046 0 R (Item.13) 4158 0 R (Item.130) 6047 0 R (Item.131) 6048 0 R (Item.132) 6049 0 R (Item.133) 6050 0 R (Item.134) 6051 0 R (Item.135) 6052 0 R (Item.136) 6053 0 R (Item.137) 6054 0 R (Item.138) 6055 0 R (Item.139) 6064 0 R (Item.14) 4159 0 R (Item.140) 6065 0 R (Item.141) 6066 0 R (Item.142) 6067 0 R (Item.143) 6068 0 R (Item.144) 6069 0 R (Item.145) 6070 0 R (Item.146) 6071 0 R (Item.147) 6072 0 R (Item.148) 6073 0 R (Item.149) 6074 0 R (Item.15) 4160 0 R (Item.150) 6075 0 R (Item.151) 6076 0 R (Item.152) 6077 0 R (Item.153) 6078 0 R (Item.154) 6079 0 R (Item.155) 6080 0 R (Item.156) 6088 0 R (Item.157) 6089 0 R (Item.158) 6090 0 R (Item.159) 6091 0 R (Item.16) 4161 0 R (Item.160) 6092 0 R (Item.161) 6093 0 R (Item.162) 6094 0 R (Item.163) 6117 0 R (Item.164) 6118 0 R (Item.165) 6119 0 R (Item.166) 6120 0 R (Item.167) 6348 0 R (Item.168) 6349 0 R (Item.169) 6350 0 R (Item.17) 4162 0 R (Item.170) 6351 0 R (Item.171) 6352 0 R (Item.172) 6353 0 R (Item.173) 6354 0 R (Item.174) 6355 0 R (Item.175) 6356 0 R (Item.176) 6357 0 R (Item.177) 6358 0 R (Item.178) 6359 0 R (Item.179) 6360 0 R (Item.18) 4242 0 R (Item.180) 6361 0 R (Item.181) 6362 0 R (Item.182) 6363 0 R (Item.183) 6364 0 R (Item.184) 6365 0 R (Item.185) 6366 0 R (Item.186) 6393 0 R (Item.187) 6394 0 R (Item.188) 6395 0 R (Item.189) 6396 0 R (Item.19) 4243 0 R (Item.190) 6432 0 R (Item.191) 6433 0 R (Item.192) 6434 0 R (Item.193) 6439 0 R (Item.194) 6440 0 R (Item.195) 6445 0 R (Item.196) 6446 0 R (Item.197) 6447 0 R (Item.198) 6448 0 R (Item.199) 6449 0 R (Item.2) 3947 0 R (Item.20) 4245 0 R (Item.200) 6450 0 R (Item.201) 6451 0 R (Item.202) 6452 0 R (Item.203) 6453 0 R (Item.204) 6454 0 R (Item.205) 6455 0 R (Item.206) 6456 0 R (Item.207) 6462 0 R (Item.208) 6463 0 R (Item.209) 6464 0 R (Item.21) 4246 0 R (Item.210) 6531 0 R (Item.211) 6532 0 R (Item.212) 6533 0 R (Item.213) 6538 0 R (Item.214) 6539 0 R (Item.22) 4284 0 R (Item.23) 4285 0 R (Item.24) 4286 0 R (Item.25) 4287 0 R (Item.26) 4288 0 R (Item.27) 4289 0 R (Item.28) 4314 0 R (Item.29) 4315 0 R (Item.3) 3962 0 R (Item.30) 4316 0 R (Item.31) 4317 0 R (Item.32) 4380 0 R (Item.33) 4381 0 R (Item.34) 4382 0 R (Item.35) 4548 0 R (Item.36) 4549 0 R (Item.37) 4550 0 R (Item.38) 4627 0 R (Item.39) 4628 0 R (Item.4) 3963 0 R (Item.40) 4634 0 R (Item.41) 4635 0 R (Item.42) 4636 0 R (Item.43) 4670 0 R (Item.44) 4671 0 R (Item.45) 4676 0 R (Item.46) 4677 0 R (Item.47) 4678 0 R (Item.48) 4679 0 R (Item.49) 4847 0 R (Item.5) 4074 0 R (Item.50) 4848 0 R (Item.51) 4849 0 R (Item.52) 4850 0 R (Item.53) 4851 0 R (Item.54) 4852 0 R (Item.55) 4853 0 R (Item.56) 4957 0 R (Item.57) 4958 0 R (Item.58) 4959 0 R (Item.59) 4960 0 R (Item.6) 4075 0 R (Item.60) 5023 0 R (Item.61) 5024 0 R (Item.62) 5025 0 R (Item.63) 5026 0 R (Item.64) 5027 0 R (Item.65) 5028 0 R (Item.66) 5029 0 R (Item.67) 5030 0 R (Item.68) 5031 0 R (Item.69) 5032 0 R (Item.7) 4076 0 R (Item.70) 5033 0 R (Item.71) 5034 0 R (Item.72) 5035 0 R (Item.73) 5036 0 R (Item.74) 5037 0 R (Item.75) 5084 0 R (Item.76) 5085 0 R (Item.77) 5086 0 R (Item.78) 5393 0 R (Item.79) 5394 0 R (Item.8) 4077 0 R (Item.80) 5395 0 R (Item.81) 5396 0 R (Item.82) 5414 0 R (Item.83) 5415 0 R (Item.84) 5416 0 R (Item.85) 5417 0 R (Item.86) 5418 0 R (Item.87) 5424 0 R (Item.88) 5425 0 R (Item.89) 5426 0 R (Item.9) 4078 0 R (Item.90) 5440 0 R (Item.91) 5441 0 R (Item.92) 5442 0 R (Item.93) 5443 0 R (Item.94) 5699 0 R (Item.95) 5700 0 R (Item.96) 5701 0 R (Item.97) 5702 0 R (Item.98) 5703 0 R (Item.99) 5704 0 R (NT4Migration) 3033 0 R (NetworkBrowsing) 2956 0 R (Other-Clients) 3063 0 R (PolicyMgmt) 3025 0 R (Portability) 3062 0 R (ProfileMgmt) 3026 0 R (SWAT) 3034 0 R (SambaHA) 3031 0 R (ServerType) 2950 0 R (StandAloneServer) 2954 0 R (VFS) 3022 0 R (XMLpassdb) 4427 0 R (ads-create-machine-account) 4212 0 R (ads-member) 3985 0 R (ads-test-server) 4214 0 R (ads-test-smbclient) 4215 0 R (browse-force-master) 4308 0 R (bugreport) 3060 0 R (chapter*.1) 3071 0 R (chapter.1) 10 0 R (chapter.10) 458 0 R (chapter.11) 582 0 R (chapter.12) 722 0 R (chapter.13) 762 0 R (chapter.14) 870 0 R (chapter.15) 966 0 R (chapter.16) 1022 0 R (chapter.17) 1066 0 R (chapter.18) 1078 0 R (chapter.19) 1326 0 R (chapter.2) 38 0 R (chapter.20) 1870 0 R (chapter.21) 1922 0 R (chapter.22) 2026 0 R (chapter.23) 2058 0 R (chapter.24) 2118 0 R (chapter.25) 2234 0 R (chapter.26) 2302 0 R (chapter.27) 2374 0 R (chapter.28) 2398 0 R (chapter.29) 2410 0 R (chapter.3) 90 0 R (chapter.30) 2422 0 R (chapter.31) 2438 0 R (chapter.32) 2486 0 R (chapter.33) 2538 0 R (chapter.34) 2558 0 R (chapter.35) 2582 0 R (chapter.36) 2614 0 R (chapter.37) 2678 0 R (chapter.38) 2718 0 R (chapter.39) 2786 0 R (chapter.4) 102 0 R (chapter.40) 2834 0 R (chapter.41) 2842 0 R (chapter.5) 182 0 R (chapter.6) 262 0 R (chapter.7) 322 0 R (chapter.8) 418 0 R (chapter.9) 446 0 R (compiling) 3061 0 R (diagnosis) 3035 0 R (domain-member) 2953 0 R (domain-member-server) 4175 0 R (example.12.3.1) 4558 0 R (example.13.2.1) 4599 0 R (figure.19.1) 5172 0 R (figure.19.10) 5742 0 R (figure.19.11) 5750 0 R (figure.19.12) 5759 0 R (figure.19.13) 5767 0 R (figure.19.14) 5775 0 R (figure.19.15) 5782 0 R (figure.19.2) 5182 0 R (figure.19.3) 5192 0 R (figure.19.4) 5236 0 R (figure.19.5) 5246 0 R (figure.19.6) 5256 0 R (figure.19.7) 5266 0 R (figure.19.8) 5726 0 R (figure.19.9) 5734 0 R (groupmapping) 2958 0 R (id2807070) 3863 0 R (id2807281) 3864 0 R (id2807435) 3870 0 R (id2807504) 3877 0 R (id2807592) 3880 0 R (id2807665) 3887 0 R (id2808200) 3927 0 R (id2808325) 3892 0 R (id2808366) 3895 0 R (id2808403) 3896 0 R (id2808498) 3898 0 R (id2808553) 3903 0 R (id2808597) 3906 0 R (id2808647) 3907 0 R (id2808748) 3908 0 R (id2808811) 3909 0 R (id2808845) 3916 0 R (id2808858) 3917 0 R (id2809073) 3922 0 R (id2810224) 3938 0 R (id2810319) 3939 0 R (id2810403) 3944 0 R (id2810518) 3945 0 R (id2810612) 3952 0 R (id2810652) 3953 0 R (id2810731) 3954 0 R (id2810773) 3955 0 R (id2810795) 3956 0 R (id2811025) 3972 0 R (id2811055) 3980 0 R (id2811112) 3983 0 R (id2811268) 3993 0 R (id2811336) 3994 0 R (id2811513) 3999 0 R (id2811541) 4000 0 R (id2811574) 4005 0 R (id2811602) 4006 0 R (id2811636) 4008 0 R (id2813443) 4013 0 R (id2813747) 4026 0 R (id2813762) 4027 0 R (id2813974) 4033 0 R (id2814294) 4049 0 R (id2814593) 4059 0 R (id2814615) 4060 0 R (id2814630) 4061 0 R (id2814663) 4062 0 R (id2814683) 4067 0 R (id2814718) 4068 0 R (id2814956) 4081 0 R (id2815064) 4086 0 R (id2815072) 4087 0 R (id2815110) 4088 0 R (id2815159) 4089 0 R (id2815230) 4094 0 R (id2815293) 4095 0 R (id2815320) 4096 0 R (id2817486) 4102 0 R (id2817659) 4108 0 R (id2817687) 4109 0 R (id2817836) 4114 0 R (id2817908) 4116 0 R (id2817929) 4117 0 R (id2817955) 4123 0 R (id2818000) 4124 0 R (id2818102) 4125 0 R (id2818163) 4130 0 R (id2818177) 4131 0 R (id2818208) 4132 0 R (id2818241) 4133 0 R (id2818285) 4138 0 R (id2819355) 4143 0 R (id2819470) 4144 0 R (id2819646) 4149 0 R (id2819898) 4156 0 R (id2820094) 4168 0 R (id2820157) 4170 0 R (id2820170) 4171 0 R (id2820236) 4172 0 R (id2820277) 4173 0 R (id2820359) 4181 0 R (id2820370) 4182 0 R (id2820741) 4193 0 R (id2820883) 4202 0 R (id2820966) 4203 0 R (id2821176) 4213 0 R (id2821329) 4220 0 R (id2821351) 4221 0 R (id2821376) 4222 0 R (id2821408) 4223 0 R (id2823423) 4256 0 R (id2823762) 4233 0 R (id2823959) 4234 0 R (id2824031) 4239 0 R (id2824046) 4240 0 R (id2824096) 4241 0 R (id2824309) 4251 0 R (id2825015) 4267 0 R (id2825095) 4272 0 R (id2825205) 4277 0 R (id2825221) 4278 0 R (id2825384) 4279 0 R (id2825515) 4290 0 R (id2825651) 4291 0 R (id2825777) 4296 0 R (id2825999) 4301 0 R (id2826268) 4313 0 R (id2826424) 4318 0 R (id2826442) 4319 0 R (id2826470) 4320 0 R (id2826580) 4325 0 R (id2826640) 4326 0 R (id2826799) 4332 0 R (id2826998) 4337 0 R (id2827023) 4338 0 R (id2827107) 4339 0 R (id2827121) 4344 0 R (id2827188) 4345 0 R (id2827325) 4351 0 R (id2827372) 4352 0 R (id2827479) 4357 0 R (id2827558) 4358 0 R (id2827608) 4363 0 R (id2827725) 4368 0 R (id2827840) 4370 0 R (id2827939) 4376 0 R (id2828039) 4378 0 R (id2828178) 4387 0 R (id2828193) 4388 0 R (id2828222) 4389 0 R (id2831766) 4395 0 R (id2832094) 4400 0 R (id2832158) 4405 0 R (id2832321) 4410 0 R (id2832376) 4411 0 R (id2832412) 4412 0 R (id2832467) 4417 0 R (id2832499) 4418 0 R (id2832764) 4419 0 R (id2832916) 4425 0 R (id2832952) 4432 0 R (id2832992) 4433 0 R (id2833098) 4435 0 R (id2833126) 4436 0 R (id2833278) 4448 0 R (id2833304) 4450 0 R (id2833411) 4456 0 R (id2833599) 4461 0 R (id2833728) 4466 0 R (id2833926) 4481 0 R (id2833962) 4487 0 R (id2834099) 4489 0 R (id2834117) 4523 0 R (id2834466) 4495 0 R (id2834528) 4496 0 R (id2834642) 4502 0 R (id2834662) 4503 0 R (id2834726) 4504 0 R (id2834803) 4530 0 R (id2834928) 4536 0 R (id2835308) 4509 0 R (id2835338) 4510 0 R (id2835447) 4511 0 R (id2835454) 4512 0 R (id2835469) 4513 0 R (id2835530) 4518 0 R (id2841728) 4573 0 R (id2841765) 4578 0 R (id2841784) 4579 0 R (id2842040) 4587 0 R (id2842061) 4588 0 R (id2842136) 4590 0 R (id2842274) 4600 0 R (id2842352) 4601 0 R (id2842907) 4542 0 R (id2843008) 4543 0 R (id2843199) 4551 0 R (id2843264) 4556 0 R (id2843278) 4557 0 R (id2843301) 4559 0 R (id2843346) 4560 0 R (id2843438) 4565 0 R (id2843454) 4566 0 R (id2843515) 4567 0 R (id2843532) 4602 0 R (id2843592) 4608 0 R (id2843803) 4603 0 R (id2843824) 4617 0 R (id2844048) 4610 0 R (id2844072) 4624 0 R (id2844264) 4611 0 R (id2844336) 4619 0 R (id2844350) 4626 0 R (id2844432) 4629 0 R (id2844635) 4637 0 R (id2844643) 4638 0 R (id2844681) 4643 0 R (id2844760) 4644 0 R (id2844882) 4645 0 R (id2844974) 4650 0 R (id2845065) 4651 0 R (id2845110) 4652 0 R (id2845262) 4657 0 R (id2845592) 4667 0 R (id2845668) 4668 0 R (id2845682) 4669 0 R (id2846062) 4684 0 R (id2849674) 4689 0 R (id2849729) 4690 0 R (id2849861) 4695 0 R (id2850152) 4705 0 R (id2850177) 4706 0 R (id2850206) 4707 0 R (id2850232) 4708 0 R (id2850266) 4709 0 R (id2850287) 4714 0 R (id2850328) 4715 0 R (id2850406) 4716 0 R (id2850449) 4717 0 R (id2850507) 4722 0 R (id2850616) 4727 0 R (id2850630) 4728 0 R (id2850693) 4729 0 R (id2850877) 4734 0 R (id2851107) 4744 0 R (id2851134) 4745 0 R (id2851214) 4750 0 R (id2851244) 4751 0 R (id2851318) 4756 0 R (id2851348) 4757 0 R (id2853401) 4769 0 R (id2853434) 4770 0 R (id2853508) 4771 0 R (id2853528) 4772 0 R (id2853598) 4777 0 R (id2853650) 4778 0 R (id2853702) 4779 0 R (id2853758) 4784 0 R (id2853820) 4785 0 R (id2853860) 4791 0 R (id2853885) 4793 0 R (id2853903) 4794 0 R (id2853928) 4795 0 R (id2854737) 4826 0 R (id2854834) 4800 0 R (id2854863) 4801 0 R (id2854947) 4806 0 R (id2854959) 4807 0 R (id2855044) 4808 0 R (id2855080) 4809 0 R (id2855108) 4810 0 R (id2855248) 4815 0 R (id2855381) 4820 0 R (id2855395) 4821 0 R (id2855980) 4840 0 R (id2856048) 4841 0 R (id2856085) 4846 0 R (id2856156) 4854 0 R (id2856389) 4835 0 R (id2857074) 4855 0 R (id2857404) 4860 0 R (id2857512) 4861 0 R (id2857605) 4866 0 R (id2857674) 4867 0 R (id2857763) 4872 0 R (id2858070) 4883 0 R (id2858173) 4896 0 R (id2858187) 4897 0 R (id2858569) 4902 0 R (id2858898) 4907 0 R (id2859119) 4908 0 R (id2859169) 4914 0 R (id2859220) 4915 0 R (id2859695) 4920 0 R (id2859974) 4925 0 R (id2860139) 4928 0 R (id2860291) 4933 0 R (id2860404) 4934 0 R (id2860475) 4939 0 R (id2860706) 4944 0 R (id2860866) 4950 0 R (id2860961) 4951 0 R (id2861145) 4956 0 R (id2861254) 4961 0 R (id2861582) 4970 0 R (id2861734) 4971 0 R (id2861970) 4976 0 R (id2862131) 4981 0 R (id2862231) 4987 0 R (id2862399) 4992 0 R (id2862603) 4993 0 R (id2862714) 4998 0 R (id2862866) 5003 0 R (id2862886) 5004 0 R (id2863084) 5009 0 R (id2863374) 5014 0 R (id2863469) 5015 0 R (id2863610) 5021 0 R (id2863644) 5022 0 R (id2864080) 5042 0 R (id2864383) 5051 0 R (id2864626) 5052 0 R (id2864725) 5057 0 R (id2865070) 5071 0 R (id2865141) 5072 0 R (id2865163) 5073 0 R (id2865209) 5076 0 R (id2865250) 5081 0 R (id2865269) 5082 0 R (id2865293) 5083 0 R (id2865446) 5091 0 R (id2865775) 5097 0 R (id2865820) 5098 0 R (id2865990) 5104 0 R (id2866004) 5105 0 R (id2866017) 5106 0 R (id2866050) 5107 0 R (id2875244) 5113 0 R (id2875251) 5114 0 R (id2875304) 5116 0 R (id2875358) 5118 0 R (id2875438) 5125 0 R (id2875581) 5129 0 R (id2875663) 5134 0 R (id2875781) 5139 0 R (id2875802) 5140 0 R (id2875828) 5141 0 R (id2875865) 5146 0 R (id2875924) 5147 0 R (id2876084) 5152 0 R (id2876178) 5153 0 R (id2876253) 5160 0 R (id2876298) 5161 0 R (id2876363) 5167 0 R (id2876398) 5162 0 R (id2876486) 5179 0 R (id2876534) 5180 0 R (id2876584) 5189 0 R (id2876614) 5190 0 R (id2876696) 5198 0 R (id2876766) 5203 0 R (id2876856) 5206 0 R (id2876878) 5207 0 R (id2877018) 5216 0 R (id2877205) 5221 0 R (id2877322) 5226 0 R (id2877492) 5227 0 R (id2877542) 5234 0 R (id2877578) 5237 0 R (id2877607) 5244 0 R (id2877680) 5247 0 R (id2877710) 5254 0 R (id2877763) 5264 0 R (id2877837) 5267 0 R (id2877857) 5724 0 R (id2877893) 5268 0 R (id2877942) 5732 0 R (id2877977) 5275 0 R (id2878289) 5280 0 R (id2878402) 5285 0 R (id2878417) 5286 0 R (id2878470) 5287 0 R (id2878524) 5288 0 R (id2878740) 5298 0 R (id2878968) 5299 0 R (id2879019) 5740 0 R (id2879124) 5307 0 R (id2879355) 5312 0 R (id2879483) 5324 0 R (id2879559) 5327 0 R (id2879574) 5328 0 R (id2879613) 5329 0 R (id2879649) 5748 0 R (id2879685) 5336 0 R (id2879707) 5757 0 R (id2879747) 5337 0 R (id2879768) 5338 0 R (id2879897) 5765 0 R (id2879932) 5339 0 R (id2880008) 5344 0 R (id2880063) 5346 0 R (id2880104) 5347 0 R (id2880170) 5352 0 R (id2880187) 5353 0 R (id2880221) 5354 0 R (id2880243) 5355 0 R (id2880269) 5356 0 R (id2880323) 5362 0 R (id2880342) 5363 0 R (id2880433) 5364 0 R (id2880480) 5369 0 R (id2880678) 5376 0 R (id2880736) 5381 0 R (id2880768) 5382 0 R (id2880818) 5388 0 R (id2881040) 5397 0 R (id2881221) 5403 0 R (id2881323) 5408 0 R (id2881549) 5413 0 R (id2881644) 5423 0 R (id2881731) 5427 0 R (id2881766) 5428 0 R (id2881784) 5773 0 R (id2881819) 5433 0 R (id2881931) 5434 0 R (id2882066) 5439 0 R (id2882181) 5444 0 R (id2882294) 5453 0 R (id2882383) 5454 0 R (id2882473) 5459 0 R (id2882635) 5464 0 R (id2882652) 5465 0 R (id2882683) 5466 0 R (id2882745) 5467 0 R (id2882784) 5472 0 R (id2882835) 5473 0 R (id2882873) 5478 0 R (id2882928) 5479 0 R (id2882962) 5480 0 R (id2882995) 5485 0 R (id2883045) 5486 0 R (id2883124) 5492 0 R (id2883189) 5493 0 R (id2883222) 5494 0 R (id2883249) 5499 0 R (id2883267) 5500 0 R (id2883288) 5501 0 R (id2883388) 5506 0 R (id2883491) 5507 0 R (id2883562) 5508 0 R (id2883624) 5509 0 R (id2883682) 5514 0 R (id2883749) 5515 0 R (id2883857) 5523 0 R (id2883912) 5527 0 R (id2883936) 5528 0 R (id2883982) 5535 0 R (id2884048) 5536 0 R (id2884183) 5553 0 R (id2884269) 5559 0 R (id2884351) 5567 0 R (id2884420) 5572 0 R (id2884486) 5575 0 R (id2884947) 5613 0 R (id2884978) 5618 0 R (id2885010) 5619 0 R (id2885051) 5621 0 R (id2885123) 5622 0 R (id2885224) 5627 0 R (id2885295) 5628 0 R (id2885344) 5634 0 R (id2885358) 5635 0 R (id2885552) 5640 0 R (id2885598) 5641 0 R (id2885680) 5642 0 R (id2885741) 5647 0 R (id2885759) 5648 0 R (id2885776) 5649 0 R (id2885811) 5650 0 R (id2885824) 5651 0 R (id2885836) 5652 0 R (id2885850) 5657 0 R (id2885858) 5658 0 R (id2886072) 5663 0 R (id2886378) 5689 0 R (id2887500) 5719 0 R (id2887511) 5780 0 R (id2899670) 5788 0 R (id2899688) 5789 0 R (id2899780) 5794 0 R (id2899786) 5795 0 R (id2899825) 5796 0 R (id2899866) 5797 0 R (id2899948) 5799 0 R (id2899967) 5800 0 R (id2900105) 5806 0 R (id2900149) 5807 0 R (id2900171) 5808 0 R (id2900226) 5811 0 R (id2900257) 5813 0 R (id2901154) 5818 0 R (id2901183) 5819 0 R (id2901255) 5820 0 R (id2901315) 5825 0 R (id2901346) 5826 0 R (id2901373) 5827 0 R (id2901408) 5832 0 R (id2901431) 5833 0 R (id2901567) 5834 0 R (id2901639) 5839 0 R (id2901673) 5840 0 R (id2901701) 5841 0 R (id2901730) 5843 0 R (id2901805) 5848 0 R (id2901898) 5850 0 R (id2901960) 5851 0 R (id2902072) 5857 0 R (id2902280) 5858 0 R (id2902359) 5866 0 R (id2902476) 5867 0 R (id2902530) 5868 0 R (id2902771) 5873 0 R (id2902779) 5875 0 R (id2902941) 5885 0 R (id2903059) 5893 0 R (id2903096) 5894 0 R (id2903202) 5896 0 R (id2903426) 5903 0 R (id2903517) 5912 0 R (id2903536) 5913 0 R (id2905838) 5958 0 R (id2905893) 5959 0 R (id2906029) 5918 0 R (id2906218) 5919 0 R (id2906317) 5924 0 R (id2906335) 5925 0 R (id2906546) 5937 0 R (id2906742) 5951 0 R (id2906776) 5953 0 R (id2907676) 5965 0 R (id2907771) 5966 0 R (id2907880) 5971 0 R (id2907904) 5972 0 R (id2908004) 5973 0 R (id2908156) 5982 0 R (id2908257) 5988 0 R (id2908277) 5989 0 R (id2908298) 5990 0 R (id2908342) 5991 0 R (id2908489) 6005 0 R (id2908503) 6006 0 R (id2909710) 6011 0 R (id2909744) 6012 0 R (id2909785) 6013 0 R (id2909798) 6014 0 R (id2909891) 6019 0 R (id2910000) 6020 0 R (id2910039) 6021 0 R (id2910190) 6026 0 R (id2910198) 6027 0 R (id2910692) 6044 0 R (id2910850) 6045 0 R (id2911361) 6081 0 R (id2911426) 6086 0 R (id2911443) 6087 0 R (id2911612) 6095 0 R (id2911634) 6100 0 R (id2911650) 6101 0 R (id2911691) 6102 0 R (id2911749) 6103 0 R (id2911795) 6108 0 R (id2911815) 6109 0 R (id2911913) 6110 0 R (id2911963) 6111 0 R (id2912313) 6125 0 R (id2912457) 6127 0 R (id2912517) 6129 0 R (id2912712) 6138 0 R (id2913021) 6140 0 R (id2913034) 6141 0 R (id2913097) 6146 0 R (id2913318) 6147 0 R (id2917263) 6158 0 R (id2917531) 6163 0 R (id2917548) 6164 0 R (id2917605) 6169 0 R (id2918219) 6183 0 R (id2918250) 6184 0 R (id2918276) 6185 0 R (id2918521) 6195 0 R (id2918579) 6198 0 R (id2918662) 6203 0 R (id2918695) 6204 0 R (id2918895) 6213 0 R (id2918928) 6214 0 R (id2918963) 6219 0 R (id2918995) 6220 0 R (id2919029) 6221 0 R (id2919043) 6222 0 R (id2921165) 6232 0 R (id2921190) 6233 0 R (id2921235) 6238 0 R (id2921291) 6239 0 R (id2921415) 6244 0 R (id2921460) 6245 0 R (id2921502) 6246 0 R (id2921590) 6251 0 R (id2921738) 6256 0 R (id2921783) 6257 0 R (id2922026) 6267 0 R (id2922059) 6268 0 R (id2922084) 6269 0 R (id2922154) 6274 0 R (id2922170) 6275 0 R (id2922202) 6276 0 R (id2922254) 6277 0 R (id2922798) 6327 0 R (id2922827) 6328 0 R (id2922992) 6302 0 R (id2923017) 6303 0 R (id2923143) 6319 0 R (id2923168) 6321 0 R (id2923372) 6286 0 R (id2923574) 6287 0 R (id2923644) 6289 0 R (id2923744) 6294 0 R (id2923789) 6295 0 R (id2924342) 6333 0 R (id2924395) 6334 0 R (id2924456) 6339 0 R (id2924514) 6340 0 R (id2924559) 6309 0 R (id2924779) 6322 0 R (id2925388) 6386 0 R (id2925422) 6387 0 R (id2925477) 6341 0 R (id2925503) 6347 0 R (id2925840) 6367 0 R (id2925858) 6368 0 R (id2925922) 6370 0 R (id2925995) 6375 0 R (id2926164) 6377 0 R (id2927531) 6425 0 R (id2927781) 6392 0 R (id2927895) 6402 0 R (id2927959) 6404 0 R (id2928064) 6405 0 R (id2928128) 6411 0 R (id2928193) 6412 0 R (id2928241) 6413 0 R (id2928293) 6414 0 R (id2928316) 6415 0 R (id2929391) 6426 0 R (id2929568) 6431 0 R (id2930743) 6465 0 R (id2932367) 6471 0 R (id2932509) 6474 0 R (id2932793) 6479 0 R (id2932838) 6483 0 R (id2932990) 6490 0 R (id2933605) 6521 0 R (id2933612) 6522 0 R (id2933642) 6525 0 R (id2933658) 6526 0 R (id2933729) 6497 0 R (id2933951) 6500 0 R (id2933988) 6502 0 R (id2934130) 6507 0 R (id2934238) 6508 0 R (id2934285) 6509 0 R (id2934938) 6571 0 R (id2934971) 6528 0 R (id2935161) 6540 0 R (id2935210) 6545 0 R (id2935346) 6546 0 R (id2935483) 6551 0 R (id2935563) 6552 0 R (id2935596) 6553 0 R (id2935648) 6558 0 R (id2935740) 6559 0 R (id2935944) 6564 0 R (id2936039) 6565 0 R (id2937123) 6592 0 R (id2937469) 6572 0 R (id2937499) 6574 0 R (id2937670) 6579 0 R (id2937714) 6584 0 R (id2937721) 6585 0 R (id2937746) 6586 0 R (id2937754) 6587 0 R (id2938476) 6598 0 R (id2938483) 6599 0 R (id2938562) 6605 0 R (id2938624) 6609 0 R (id2938720) 6610 0 R (id2938728) 6611 0 R (id2938817) 6612 0 R (id2938848) 6617 0 R (id2938893) 6618 0 R (id2938924) 6620 0 R (id2938941) 6621 0 R (id2938988) 6622 0 R (id2939061) 6628 0 R (id2939085) 6629 0 R (id2939196) 6631 0 R (id2940065) 6661 0 R (id2940225) 6666 0 R (id2940228) 6637 0 R (id2940272) 6638 0 R (id2940347) 6639 0 R (id2940391) 6644 0 R (id2940444) 6645 0 R (id2940467) 6646 0 R (id2940524) 6647 0 R (id2940566) 6648 0 R (id2940587) 6653 0 R (id2940612) 6655 0 R (id2940646) 6656 0 R (id2941876) 6691 0 R (id2941944) 6695 0 R (install) 2948 0 R (integrate-ms-networks) 3028 0 R (introduction) 3862 0 R (locking) 2960 0 R (migration) 6318 0 R (msdfs) 3019 0 R (optional) 4266 0 R (page.1) 2861 0 R (page.10) 3267 0 R (page.100) 4455 0 R (page.101) 4460 0 R (page.102) 4465 0 R (page.103) 4480 0 R (page.104) 4486 0 R (page.105) 4494 0 R (page.106) 4500 0 R (page.107) 4508 0 R (page.108) 4517 0 R (page.109) 4522 0 R (page.11) 3320 0 R (page.110) 4529 0 R (page.111) 4535 0 R (page.112) 4541 0 R (page.113) 4547 0 R (page.114) 4555 0 R (page.115) 4564 0 R (page.116) 4572 0 R (page.117) 4577 0 R (page.118) 4583 0 R (page.119) 4594 0 R (page.12) 3370 0 R (page.120) 4598 0 R (page.121) 4607 0 R (page.122) 4616 0 R (page.123) 4623 0 R (page.124) 4633 0 R (page.125) 4642 0 R (page.126) 4649 0 R (page.127) 4656 0 R (page.128) 4666 0 R (page.129) 4675 0 R (page.13) 3423 0 R (page.130) 4683 0 R (page.131) 4688 0 R (page.132) 4694 0 R (page.133) 4699 0 R (page.134) 4704 0 R (page.135) 4713 0 R (page.136) 4721 0 R (page.137) 4726 0 R (page.138) 4733 0 R (page.139) 4738 0 R (page.14) 3475 0 R (page.140) 4743 0 R (page.141) 4749 0 R (page.142) 4755 0 R (page.143) 4768 0 R (page.144) 4776 0 R (page.145) 4783 0 R (page.146) 4790 0 R (page.147) 4799 0 R (page.148) 4805 0 R (page.149) 4814 0 R (page.15) 3527 0 R (page.150) 4819 0 R (page.151) 4825 0 R (page.152) 4834 0 R (page.153) 4839 0 R (page.154) 4845 0 R (page.155) 4859 0 R (page.156) 4865 0 R (page.157) 4871 0 R (page.158) 4877 0 R (page.159) 4882 0 R (page.16) 3573 0 R (page.160) 4887 0 R (page.161) 4895 0 R (page.162) 4901 0 R (page.163) 4906 0 R (page.164) 4913 0 R (page.165) 4919 0 R (page.166) 4924 0 R (page.167) 4932 0 R (page.168) 4938 0 R (page.169) 4943 0 R (page.17) 3626 0 R (page.170) 4949 0 R (page.171) 4955 0 R (page.172) 4965 0 R (page.173) 4969 0 R (page.174) 4975 0 R (page.175) 4980 0 R (page.176) 4986 0 R (page.177) 4991 0 R (page.178) 4997 0 R (page.179) 5002 0 R (page.18) 3678 0 R (page.180) 5008 0 R (page.181) 5013 0 R (page.182) 5020 0 R (page.183) 5041 0 R (page.184) 5046 0 R (page.185) 5050 0 R (page.186) 5056 0 R (page.187) 5061 0 R (page.188) 5066 0 R (page.189) 5070 0 R (page.19) 3729 0 R (page.190) 5080 0 R (page.191) 5090 0 R (page.192) 5096 0 R (page.193) 5102 0 R (page.194) 5112 0 R (page.195) 5122 0 R (page.196) 5133 0 R (page.197) 5138 0 R (page.198) 5145 0 R (page.199) 5151 0 R (page.2) 2873 0 R (page.20) 3774 0 R (page.200) 5159 0 R (page.201) 5166 0 R (page.202) 5178 0 R (page.203) 5188 0 R (page.204) 5197 0 R (page.205) 5202 0 R (page.206) 5212 0 R (page.207) 5220 0 R (page.208) 5225 0 R (page.209) 5233 0 R (page.21) 3822 0 R (page.210) 5243 0 R (page.211) 5253 0 R (page.212) 5263 0 R (page.213) 5274 0 R (page.214) 5279 0 R (page.215) 5284 0 R (page.216) 5292 0 R (page.217) 5297 0 R (page.218) 5304 0 R (page.219) 5311 0 R (page.22) 3857 0 R (page.220) 5323 0 R (page.221) 5335 0 R (page.222) 5343 0 R (page.223) 5351 0 R (page.224) 5361 0 R (page.225) 5368 0 R (page.226) 5375 0 R (page.227) 5380 0 R (page.228) 5387 0 R (page.229) 5392 0 R (page.23) 3861 0 R (page.230) 5402 0 R (page.231) 5407 0 R (page.232) 5412 0 R (page.233) 5422 0 R (page.234) 5432 0 R (page.235) 5438 0 R (page.236) 5452 0 R (page.237) 5458 0 R (page.238) 5463 0 R (page.239) 5471 0 R (page.24) 3868 0 R (page.240) 5477 0 R (page.241) 5484 0 R (page.242) 5491 0 R (page.243) 5498 0 R (page.244) 5505 0 R (page.245) 5513 0 R (page.246) 5520 0 R (page.247) 5534 0 R (page.248) 5552 0 R (page.249) 5566 0 R (page.25) 3874 0 R (page.250) 5580 0 R (page.251) 5607 0 R (page.252) 5617 0 R (page.253) 5626 0 R (page.254) 5633 0 R (page.255) 5639 0 R (page.256) 5646 0 R (page.257) 5656 0 R (page.258) 5662 0 R (page.259) 5667 0 R (page.26) 3885 0 R (page.260) 5672 0 R (page.261) 5676 0 R (page.262) 5680 0 R (page.263) 5684 0 R (page.264) 5688 0 R (page.265) 5693 0 R (page.266) 5698 0 R (page.267) 5718 0 R (page.268) 5723 0 R (page.269) 5731 0 R (page.27) 3891 0 R (page.270) 5739 0 R (page.271) 5747 0 R (page.272) 5756 0 R (page.273) 5764 0 R (page.274) 5772 0 R (page.275) 5779 0 R (page.276) 5787 0 R (page.277) 5793 0 R (page.278) 5805 0 R (page.279) 5817 0 R (page.28) 3902 0 R (page.280) 5824 0 R (page.281) 5831 0 R (page.282) 5838 0 R (page.283) 5847 0 R (page.284) 5856 0 R (page.285) 5862 0 R (page.286) 5872 0 R (page.287) 5879 0 R (page.288) 5883 0 R (page.289) 5891 0 R (page.29) 3915 0 R (page.290) 5901 0 R (page.291) 5907 0 R (page.292) 5911 0 R (page.293) 5917 0 R (page.294) 5929 0 R (page.295) 5936 0 R (page.296) 5943 0 R (page.297) 5947 0 R (page.298) 5957 0 R (page.299) 5963 0 R (page.3) 2887 0 R (page.30) 3921 0 R (page.300) 5970 0 R (page.301) 5977 0 R (page.302) 5987 0 R (page.303) 6001 0 R (page.304) 6010 0 R (page.305) 6018 0 R (page.306) 6025 0 R (page.307) 6032 0 R (page.308) 6043 0 R (page.309) 6059 0 R (page.31) 3926 0 R (page.310) 6063 0 R (page.311) 6085 0 R (page.312) 6099 0 R (page.313) 6107 0 R (page.314) 6116 0 R (page.315) 6124 0 R (page.316) 6133 0 R (page.317) 6137 0 R (page.318) 6145 0 R (page.319) 6151 0 R (page.32) 3932 0 R (page.320) 6156 0 R (page.321) 6162 0 R (page.322) 6168 0 R (page.323) 6174 0 R (page.324) 6178 0 R (page.325) 6182 0 R (page.326) 6190 0 R (page.327) 6194 0 R (page.328) 6202 0 R (page.329) 6209 0 R (page.33) 3936 0 R (page.330) 6218 0 R (page.331) 6226 0 R (page.332) 6231 0 R (page.333) 6237 0 R (page.334) 6243 0 R (page.335) 6250 0 R (page.336) 6255 0 R (page.337) 6261 0 R (page.338) 6266 0 R (page.339) 6273 0 R (page.34) 3943 0 R (page.340) 6281 0 R (page.341) 6285 0 R (page.342) 6293 0 R (page.343) 6301 0 R (page.344) 6308 0 R (page.345) 6313 0 R (page.346) 6317 0 R (page.347) 6326 0 R (page.348) 6332 0 R (page.349) 6338 0 R (page.35) 3951 0 R (page.350) 6346 0 R (page.351) 6374 0 R (page.352) 6381 0 R (page.353) 6385 0 R (page.354) 6391 0 R (page.355) 6401 0 R (page.356) 6410 0 R (page.357) 6419 0 R (page.358) 6423 0 R (page.359) 6430 0 R (page.36) 3961 0 R (page.360) 6438 0 R (page.361) 6444 0 R (page.362) 6461 0 R (page.363) 6470 0 R (page.364) 6478 0 R (page.365) 6489 0 R (page.366) 6496 0 R (page.367) 6506 0 R (page.368) 6514 0 R (page.369) 6518 0 R (page.37) 3979 0 R (page.370) 6537 0 R (page.371) 6550 0 R (page.372) 6557 0 R (page.373) 6563 0 R (page.374) 6570 0 R (page.375) 6578 0 R (page.376) 6583 0 R (page.377) 6591 0 R (page.378) 6604 0 R (page.379) 6616 0 R (page.38) 3989 0 R (page.380) 6627 0 R (page.381) 6636 0 R (page.382) 6643 0 R (page.383) 6652 0 R (page.384) 6660 0 R (page.385) 6665 0 R (page.39) 3998 0 R (page.4) 2965 0 R (page.40) 4004 0 R (page.41) 4012 0 R (page.42) 4017 0 R (page.43) 4024 0 R (page.44) 4032 0 R (page.45) 4037 0 R (page.46) 4045 0 R (page.47) 4053 0 R (page.48) 4057 0 R (page.49) 4066 0 R (page.5) 3040 0 R (page.50) 4073 0 R (page.51) 4085 0 R (page.52) 4093 0 R (page.53) 4100 0 R (page.54) 4107 0 R (page.55) 4113 0 R (page.56) 4122 0 R (page.57) 4129 0 R (page.58) 4137 0 R (page.59) 4142 0 R (page.6) 3070 0 R (page.60) 4148 0 R (page.61) 4154 0 R (page.62) 4167 0 R (page.63) 4179 0 R (page.64) 4191 0 R (page.65) 4199 0 R (page.66) 4207 0 R (page.67) 4219 0 R (page.68) 4228 0 R (page.69) 4232 0 R (page.7) 3109 0 R (page.70) 4238 0 R (page.71) 4250 0 R (page.72) 4255 0 R (page.73) 4260 0 R (page.74) 4265 0 R (page.75) 4271 0 R (page.76) 4276 0 R (page.77) 4283 0 R (page.78) 4295 0 R (page.79) 4300 0 R (page.8) 3162 0 R (page.80) 4306 0 R (page.81) 4312 0 R (page.82) 4324 0 R (page.83) 4331 0 R (page.84) 4336 0 R (page.85) 4343 0 R (page.86) 4350 0 R (page.87) 4356 0 R (page.88) 4362 0 R (page.89) 4367 0 R (page.9) 3212 0 R (page.90) 4375 0 R (page.91) 4386 0 R (page.92) 4394 0 R (page.93) 4399 0 R (page.94) 4404 0 R (page.95) 4409 0 R (page.96) 4416 0 R (page.97) 4423 0 R (page.98) 4431 0 R (page.99) 4440 0 R (pam) 3027 0 R (part.1) 6 0 R (part.2) 98 0 R (part.3) 454 0 R (part.4) 2418 0 R (part.5) 2534 0 R (part.6) 2610 0 R (passdb) 2957 0 R (printing) 3020 0 R (problems) 3036 0 R (samba-bdc) 2952 0 R (samba-pdc) 2951 0 R (section*.2) 5874 0 R (section*.3) 5884 0 R (section*.4) 5892 0 R (section*.5) 5895 0 R (section*.6) 5902 0 R (section.1.1) 14 0 R (section.1.2) 18 0 R (section.1.3) 22 0 R (section.1.4) 26 0 R (section.1.5) 30 0 R (section.1.6) 34 0 R (section.10.1) 462 0 R (section.10.2) 466 0 R (section.10.3) 470 0 R (section.10.4) 486 0 R (section.10.5) 522 0 R (section.10.6) 538 0 R (section.10.7) 550 0 R (section.10.8) 570 0 R (section.11.1) 586 0 R (section.11.2) 590 0 R (section.11.3) 610 0 R (section.11.4) 622 0 R (section.11.5) 706 0 R (section.12.1) 726 0 R (section.12.2) 730 0 R (section.12.3) 738 0 R (section.12.4) 750 0 R (section.13.1) 766 0 R (section.13.2) 770 0 R (section.13.3) 786 0 R (section.13.4) 802 0 R (section.13.5) 818 0 R (section.13.6) 858 0 R (section.14.1) 874 0 R (section.14.2) 878 0 R (section.14.3) 922 0 R (section.14.4) 938 0 R (section.14.5) 950 0 R (section.14.6) 954 0 R (section.14.7) 962 0 R (section.15.1) 970 0 R (section.15.2) 974 0 R (section.15.3) 978 0 R (section.15.4) 1006 0 R (section.15.5) 1010 0 R (section.16.1) 1026 0 R (section.16.2) 1030 0 R (section.16.3) 1034 0 R (section.16.4) 1046 0 R (section.16.5) 1058 0 R (section.17.1) 1070 0 R (section.17.2) 1074 0 R (section.18.1) 1082 0 R (section.18.10) 1278 0 R (section.18.11) 1298 0 R (section.18.12) 1302 0 R (section.18.13) 1306 0 R (section.18.14) 1310 0 R (section.18.15) 1314 0 R (section.18.2) 1086 0 R (section.18.3) 1110 0 R (section.18.4) 1122 0 R (section.18.5) 1126 0 R (section.18.6) 1154 0 R (section.18.7) 1178 0 R (section.18.8) 1226 0 R (section.18.9) 1246 0 R (section.19.1) 1330 0 R (section.19.10) 1558 0 R (section.19.11) 1626 0 R (section.19.12) 1714 0 R (section.19.13) 1734 0 R (section.19.14) 1778 0 R (section.19.15) 1810 0 R (section.19.16) 1814 0 R (section.19.17) 1830 0 R (section.19.18) 1834 0 R (section.19.19) 1850 0 R (section.19.2) 1342 0 R (section.19.3) 1358 0 R (section.19.4) 1382 0 R (section.19.5) 1418 0 R (section.19.6) 1498 0 R (section.19.7) 1514 0 R (section.19.8) 1526 0 R (section.19.9) 1538 0 R (section.2.1) 42 0 R (section.2.2) 46 0 R (section.2.3) 62 0 R (section.2.4) 66 0 R (section.2.5) 70 0 R (section.2.6) 74 0 R (section.2.7) 78 0 R (section.20.1) 1874 0 R (section.20.2) 1878 0 R (section.20.3) 1882 0 R (section.20.4) 1906 0 R (section.20.5) 1918 0 R (section.21.1) 1926 0 R (section.21.2) 1930 0 R (section.21.3) 1934 0 R (section.21.4) 1942 0 R (section.21.5) 1970 0 R (section.21.6) 2018 0 R (section.21.7) 2022 0 R (section.22.1) 2030 0 R (section.22.2) 2034 0 R (section.22.3) 2038 0 R (section.22.4) 2046 0 R (section.22.5) 2054 0 R (section.23.1) 2062 0 R (section.23.2) 2066 0 R (section.23.3) 2090 0 R (section.23.4) 2106 0 R (section.23.5) 2110 0 R (section.24.1) 2122 0 R (section.24.2) 2126 0 R (section.24.3) 2190 0 R (section.24.4) 2194 0 R (section.24.5) 2198 0 R (section.24.6) 2218 0 R (section.25.1) 2238 0 R (section.25.2) 2242 0 R (section.25.3) 2294 0 R (section.26.1) 2306 0 R (section.26.2) 2310 0 R (section.26.3) 2314 0 R (section.26.4) 2334 0 R (section.26.5) 2358 0 R (section.27.1) 2378 0 R (section.27.2) 2382 0 R (section.27.3) 2386 0 R (section.27.4) 2390 0 R (section.27.5) 2394 0 R (section.28.1) 2402 0 R (section.28.2) 2406 0 R (section.29.1) 2414 0 R (section.3.1) 94 0 R (section.30.1) 2426 0 R (section.30.2) 2430 0 R (section.30.3) 2434 0 R (section.31.1) 2442 0 R (section.31.2) 2474 0 R (section.32.1) 2490 0 R (section.33.1) 2542 0 R (section.33.2) 2546 0 R (section.33.3) 2550 0 R (section.33.4) 2554 0 R (section.34.1) 2562 0 R (section.34.2) 2566 0 R (section.34.3) 2570 0 R (section.34.4) 2574 0 R (section.34.5) 2578 0 R (section.35.1) 2586 0 R (section.35.2) 2590 0 R (section.35.3) 2594 0 R (section.35.4) 2598 0 R (section.35.5) 2602 0 R (section.35.6) 2606 0 R (section.36.1) 2618 0 R (section.36.2) 2638 0 R (section.36.3) 2642 0 R (section.36.4) 2646 0 R (section.36.5) 2662 0 R (section.36.6) 2674 0 R (section.37.1) 2682 0 R (section.37.2) 2686 0 R (section.37.3) 2690 0 R (section.37.4) 2694 0 R (section.37.5) 2698 0 R (section.37.6) 2706 0 R (section.38.1) 2722 0 R (section.38.2) 2726 0 R (section.38.3) 2742 0 R (section.38.4) 2770 0 R (section.38.5) 2778 0 R (section.38.6) 2782 0 R (section.39.1) 2790 0 R (section.39.10) 2826 0 R (section.39.11) 2830 0 R (section.39.2) 2794 0 R (section.39.3) 2798 0 R (section.39.4) 2802 0 R (section.39.5) 2806 0 R (section.39.6) 2810 0 R (section.39.7) 2814 0 R (section.39.8) 2818 0 R (section.39.9) 2822 0 R (section.4.1) 106 0 R (section.4.2) 110 0 R (section.4.3) 114 0 R (section.4.4) 158 0 R (section.4.5) 162 0 R (section.40.1) 2838 0 R (section.41.1) 2846 0 R (section.41.2) 2850 0 R (section.41.3) 2854 0 R (section.5.1) 186 0 R (section.5.2) 190 0 R (section.5.3) 202 0 R (section.5.4) 206 0 R (section.5.5) 210 0 R (section.5.6) 234 0 R (section.6.1) 266 0 R (section.6.2) 270 0 R (section.6.3) 294 0 R (section.6.4) 302 0 R (section.7.1) 326 0 R (section.7.2) 330 0 R (section.7.3) 362 0 R (section.7.4) 374 0 R (section.7.5) 406 0 R (section.8.1) 422 0 R (section.8.2) 426 0 R (section.8.3) 430 0 R (section.8.4) 442 0 R (section.9.1) 450 0 R (securing-samba) 2961 0 R (speed) 3064 0 R (subfigure.19.1.1) 5168 0 R (subfigure.19.10.1) 5741 0 R (subfigure.19.11.1) 5749 0 R (subfigure.19.12.1) 5758 0 R (subfigure.19.13.1) 5766 0 R (subfigure.19.14.1) 5774 0 R (subfigure.19.15.1) 5781 0 R (subfigure.19.2.1) 5181 0 R (subfigure.19.3.1) 5191 0 R (subfigure.19.4.1) 5235 0 R (subfigure.19.5.1) 5245 0 R (subfigure.19.6.1) 5255 0 R (subfigure.19.7.1) 5265 0 R (subfigure.19.8.1) 5725 0 R (subfigure.19.9.1) 5733 0 R (subsection.10.3.1) 474 0 R (subsection.10.3.2) 478 0 R (subsection.10.3.3) 482 0 R (subsection.10.4.1) 490 0 R (subsection.10.4.2) 494 0 R (subsection.10.4.3) 498 0 R (subsection.10.4.4) 502 0 R (subsection.10.4.5) 506 0 R (subsection.10.4.6) 510 0 R (subsection.10.4.7) 514 0 R (subsection.10.4.8) 518 0 R (subsection.10.5.1) 526 0 R (subsection.10.5.2) 530 0 R (subsection.10.5.3) 534 0 R (subsection.10.6.1) 542 0 R (subsection.10.6.2) 546 0 R (subsection.10.7.1) 554 0 R (subsection.10.7.2) 558 0 R (subsection.10.7.3) 562 0 R (subsection.10.8.1) 574 0 R (subsection.10.8.2) 578 0 R (subsection.11.2.1) 594 0 R (subsection.11.2.2) 606 0 R (subsection.11.3.1) 614 0 R (subsection.11.3.2) 618 0 R (subsection.11.4.1) 626 0 R (subsection.11.4.2) 630 0 R (subsection.11.4.3) 634 0 R (subsection.11.4.4) 638 0 R (subsection.11.4.5) 682 0 R (subsection.11.4.6) 702 0 R (subsection.11.5.1) 710 0 R (subsection.11.5.2) 714 0 R (subsection.11.5.3) 718 0 R (subsection.12.2.1) 734 0 R (subsection.12.3.1) 742 0 R (subsection.12.3.2) 746 0 R (subsection.12.4.1) 754 0 R (subsection.12.4.2) 758 0 R (subsection.13.2.1) 774 0 R (subsection.13.2.2) 778 0 R (subsection.13.2.3) 782 0 R (subsection.13.3.1) 790 0 R (subsection.13.3.2) 794 0 R (subsection.13.3.3) 798 0 R (subsection.13.4.1) 806 0 R (subsection.13.5.1) 822 0 R (subsection.13.5.2) 826 0 R (subsection.13.5.3) 830 0 R (subsection.13.5.4) 834 0 R (subsection.13.5.5) 846 0 R (subsection.13.5.6) 850 0 R (subsection.13.5.7) 854 0 R (subsection.13.6.1) 862 0 R (subsection.13.6.2) 866 0 R (subsection.14.2.1) 882 0 R (subsection.14.3.1) 926 0 R (subsection.14.4.1) 942 0 R (subsection.14.4.2) 946 0 R (subsection.14.6.1) 958 0 R (subsection.15.3.1) 982 0 R (subsection.15.3.2) 986 0 R (subsection.15.3.3) 990 0 R (subsection.15.3.4) 994 0 R (subsection.15.3.5) 998 0 R (subsection.15.3.6) 1002 0 R (subsection.15.5.1) 1014 0 R (subsection.15.5.2) 1018 0 R (subsection.16.3.1) 1038 0 R (subsection.16.3.2) 1042 0 R (subsection.16.4.1) 1050 0 R (subsection.16.4.2) 1054 0 R (subsection.16.5.1) 1062 0 R (subsection.18.10.1) 1282 0 R (subsection.18.10.2) 1286 0 R (subsection.18.10.3) 1290 0 R (subsection.18.10.4) 1294 0 R (subsection.18.15.1) 1318 0 R (subsection.18.15.2) 1322 0 R (subsection.18.2.1) 1090 0 R (subsection.18.2.2) 1094 0 R (subsection.18.2.3) 1098 0 R (subsection.18.2.4) 1102 0 R (subsection.18.2.5) 1106 0 R (subsection.18.3.1) 1114 0 R (subsection.18.3.2) 1118 0 R (subsection.18.5.1) 1130 0 R (subsection.18.5.2) 1134 0 R (subsection.18.5.3) 1138 0 R (subsection.18.5.4) 1142 0 R (subsection.18.5.5) 1146 0 R (subsection.18.5.6) 1150 0 R (subsection.18.6.1) 1158 0 R (subsection.18.6.2) 1162 0 R (subsection.18.6.3) 1166 0 R (subsection.18.6.4) 1170 0 R (subsection.18.6.5) 1174 0 R (subsection.18.7.1) 1182 0 R (subsection.18.7.2) 1186 0 R (subsection.18.8.1) 1230 0 R (subsection.18.8.2) 1234 0 R (subsection.18.8.3) 1238 0 R (subsection.18.8.4) 1242 0 R (subsection.18.9.1) 1250 0 R (subsection.18.9.2) 1254 0 R (subsection.18.9.3) 1258 0 R (subsection.18.9.4) 1262 0 R (subsection.18.9.5) 1266 0 R (subsection.18.9.6) 1270 0 R (subsection.18.9.7) 1274 0 R (subsection.19.1.1) 1334 0 R (subsection.19.1.2) 1338 0 R (subsection.19.10.1) 1562 0 R (subsection.19.10.10) 1598 0 R (subsection.19.10.11) 1602 0 R (subsection.19.10.12) 1606 0 R (subsection.19.10.13) 1610 0 R (subsection.19.10.14) 1614 0 R (subsection.19.10.15) 1618 0 R (subsection.19.10.16) 1622 0 R (subsection.19.10.2) 1566 0 R (subsection.19.10.3) 1570 0 R (subsection.19.10.4) 1574 0 R (subsection.19.10.5) 1578 0 R (subsection.19.10.6) 1582 0 R (subsection.19.10.7) 1586 0 R (subsection.19.10.8) 1590 0 R (subsection.19.10.9) 1594 0 R (subsection.19.11.1) 1630 0 R (subsection.19.11.2) 1634 0 R (subsection.19.11.3) 1638 0 R (subsection.19.11.4) 1642 0 R (subsection.19.11.5) 1646 0 R (subsection.19.11.6) 1710 0 R (subsection.19.12.1) 1718 0 R (subsection.19.12.2) 1722 0 R (subsection.19.12.3) 1726 0 R (subsection.19.12.4) 1730 0 R (subsection.19.13.1) 1738 0 R (subsection.19.13.2) 1774 0 R (subsection.19.14.1) 1782 0 R (subsection.19.14.2) 1786 0 R (subsection.19.14.3) 1790 0 R (subsection.19.14.4) 1794 0 R (subsection.19.14.5) 1798 0 R (subsection.19.14.6) 1802 0 R (subsection.19.14.7) 1806 0 R (subsection.19.16.1) 1818 0 R (subsection.19.16.2) 1822 0 R (subsection.19.16.3) 1826 0 R (subsection.19.18.1) 1838 0 R (subsection.19.18.2) 1842 0 R (subsection.19.18.3) 1846 0 R (subsection.19.19.1) 1854 0 R (subsection.19.19.2) 1858 0 R (subsection.19.19.3) 1862 0 R (subsection.19.19.4) 1866 0 R (subsection.19.2.1) 1346 0 R (subsection.19.2.2) 1350 0 R (subsection.19.2.3) 1354 0 R (subsection.19.3.1) 1362 0 R (subsection.19.3.2) 1366 0 R (subsection.19.3.3) 1370 0 R (subsection.19.3.4) 1374 0 R (subsection.19.3.5) 1378 0 R (subsection.19.4.1) 1386 0 R (subsection.19.4.2) 1390 0 R (subsection.19.4.3) 1394 0 R (subsection.19.4.4) 1398 0 R (subsection.19.4.5) 1402 0 R (subsection.19.4.6) 1406 0 R (subsection.19.4.7) 1410 0 R (subsection.19.4.8) 1414 0 R (subsection.19.5.1) 1422 0 R (subsection.19.5.10) 1458 0 R (subsection.19.5.11) 1462 0 R (subsection.19.5.12) 1466 0 R (subsection.19.5.13) 1470 0 R (subsection.19.5.14) 1474 0 R (subsection.19.5.15) 1478 0 R (subsection.19.5.16) 1482 0 R (subsection.19.5.17) 1486 0 R (subsection.19.5.18) 1490 0 R (subsection.19.5.19) 1494 0 R (subsection.19.5.2) 1426 0 R (subsection.19.5.3) 1430 0 R (subsection.19.5.4) 1434 0 R (subsection.19.5.5) 1438 0 R (subsection.19.5.6) 1442 0 R (subsection.19.5.7) 1446 0 R (subsection.19.5.8) 1450 0 R (subsection.19.5.9) 1454 0 R (subsection.19.6.1) 1502 0 R (subsection.19.6.2) 1506 0 R (subsection.19.6.3) 1510 0 R (subsection.19.7.1) 1518 0 R (subsection.19.7.2) 1522 0 R (subsection.19.8.1) 1530 0 R (subsection.19.8.2) 1534 0 R (subsection.19.9.1) 1542 0 R (subsection.19.9.2) 1546 0 R (subsection.19.9.3) 1550 0 R (subsection.19.9.4) 1554 0 R (subsection.2.2.1) 50 0 R (subsection.2.2.2) 58 0 R (subsection.2.7.1) 82 0 R (subsection.2.7.2) 86 0 R (subsection.20.3.1) 1886 0 R (subsection.20.3.2) 1890 0 R (subsection.20.3.3) 1894 0 R (subsection.20.3.4) 1898 0 R (subsection.20.3.5) 1902 0 R (subsection.20.4.1) 1910 0 R (subsection.20.4.2) 1914 0 R (subsection.21.3.1) 1938 0 R (subsection.21.4.1) 1946 0 R (subsection.21.4.2) 1950 0 R (subsection.21.4.3) 1954 0 R (subsection.21.4.4) 1958 0 R (subsection.21.4.5) 1962 0 R (subsection.21.4.6) 1966 0 R (subsection.21.5.1) 1974 0 R (subsection.21.5.2) 1978 0 R (subsection.21.5.3) 1982 0 R (subsection.22.3.1) 2042 0 R (subsection.22.4.1) 2050 0 R (subsection.23.2.1) 2070 0 R (subsection.23.2.2) 2074 0 R (subsection.23.2.3) 2082 0 R (subsection.23.3.1) 2094 0 R (subsection.23.3.2) 2098 0 R (subsection.23.3.3) 2102 0 R (subsection.23.5.1) 2114 0 R (subsection.24.2.1) 2130 0 R (subsection.24.2.2) 2150 0 R (subsection.24.2.3) 2166 0 R (subsection.24.2.4) 2170 0 R (subsection.24.5.1) 2202 0 R (subsection.24.5.2) 2210 0 R (subsection.24.5.3) 2214 0 R (subsection.24.6.1) 2222 0 R (subsection.24.6.2) 2226 0 R (subsection.24.6.3) 2230 0 R (subsection.25.2.1) 2246 0 R (subsection.25.2.2) 2254 0 R (subsection.25.2.3) 2266 0 R (subsection.25.2.4) 2270 0 R (subsection.25.2.5) 2274 0 R (subsection.25.3.1) 2298 0 R (subsection.26.3.1) 2318 0 R (subsection.26.3.2) 2322 0 R (subsection.26.3.3) 2326 0 R (subsection.26.3.4) 2330 0 R (subsection.26.4.1) 2338 0 R (subsection.26.4.2) 2342 0 R (subsection.26.4.3) 2346 0 R (subsection.26.4.4) 2350 0 R (subsection.26.4.5) 2354 0 R (subsection.26.5.1) 2362 0 R (subsection.26.5.2) 2366 0 R (subsection.26.5.3) 2370 0 R (subsection.31.1.1) 2446 0 R (subsection.31.1.2) 2470 0 R (subsection.31.2.1) 2478 0 R (subsection.31.2.2) 2482 0 R (subsection.32.1.1) 2494 0 R (subsection.32.1.10) 2530 0 R (subsection.32.1.2) 2498 0 R (subsection.32.1.3) 2502 0 R (subsection.32.1.4) 2506 0 R (subsection.32.1.5) 2510 0 R (subsection.32.1.6) 2514 0 R (subsection.32.1.7) 2518 0 R (subsection.32.1.8) 2522 0 R (subsection.32.1.9) 2526 0 R (subsection.36.1.1) 2622 0 R (subsection.36.1.2) 2626 0 R (subsection.36.4.1) 2650 0 R (subsection.36.5.1) 2666 0 R (subsection.36.5.2) 2670 0 R (subsection.37.5.1) 2702 0 R (subsection.37.6.1) 2710 0 R (subsection.37.6.2) 2714 0 R (subsection.38.2.1) 2730 0 R (subsection.38.2.2) 2734 0 R (subsection.38.2.3) 2738 0 R (subsection.38.3.1) 2746 0 R (subsection.38.3.2) 2750 0 R (subsection.38.3.3) 2754 0 R (subsection.38.3.4) 2758 0 R (subsection.38.3.5) 2762 0 R (subsection.38.3.6) 2766 0 R (subsection.38.4.1) 2774 0 R (subsection.4.3.1) 118 0 R (subsection.4.3.2) 126 0 R (subsection.4.3.3) 134 0 R (subsection.4.3.4) 142 0 R (subsection.4.3.5) 150 0 R (subsection.4.5.1) 166 0 R (subsection.4.5.2) 170 0 R (subsection.4.5.3) 174 0 R (subsection.4.5.4) 178 0 R (subsection.5.2.1) 194 0 R (subsection.5.2.2) 198 0 R (subsection.5.5.1) 214 0 R (subsection.5.5.2) 230 0 R (subsection.5.6.1) 238 0 R (subsection.5.6.2) 242 0 R (subsection.5.6.3) 246 0 R (subsection.5.6.4) 250 0 R (subsection.5.6.5) 254 0 R (subsection.5.6.6) 258 0 R (subsection.6.2.1) 274 0 R (subsection.6.2.2) 282 0 R (subsection.6.2.3) 286 0 R (subsection.6.2.4) 290 0 R (subsection.6.3.1) 298 0 R (subsection.6.4.1) 306 0 R (subsection.6.4.2) 310 0 R (subsection.6.4.3) 314 0 R (subsection.6.4.4) 318 0 R (subsection.7.2.1) 334 0 R (subsection.7.2.2) 338 0 R (subsection.7.2.3) 342 0 R (subsection.7.2.4) 346 0 R (subsection.7.3.1) 366 0 R (subsection.7.3.2) 370 0 R (subsection.7.4.1) 378 0 R (subsection.7.4.2) 382 0 R (subsection.7.4.3) 386 0 R (subsection.7.4.4) 394 0 R (subsection.7.4.5) 398 0 R (subsection.7.4.6) 402 0 R (subsection.7.5.1) 410 0 R (subsection.7.5.2) 414 0 R (subsection.8.3.1) 434 0 R (subsection.8.3.2) 438 0 R (subsubsection.10.7.3.1) 566 0 R (subsubsection.11.2.1.1) 598 0 R (subsubsection.11.2.1.2) 602 0 R (subsubsection.11.4.4.1) 642 0 R (subsubsection.11.4.4.10) 678 0 R (subsubsection.11.4.4.2) 646 0 R (subsubsection.11.4.4.3) 650 0 R (subsubsection.11.4.4.4) 654 0 R (subsubsection.11.4.4.5) 658 0 R (subsubsection.11.4.4.6) 662 0 R (subsubsection.11.4.4.7) 666 0 R (subsubsection.11.4.4.8) 670 0 R (subsubsection.11.4.4.9) 674 0 R (subsubsection.11.4.5.1) 686 0 R (subsubsection.11.4.5.2) 690 0 R (subsubsection.11.4.5.3) 694 0 R (subsubsection.11.4.5.4) 698 0 R (subsubsection.13.4.1.1) 810 0 R (subsubsection.13.4.1.2) 814 0 R (subsubsection.13.5.4.1) 838 0 R (subsubsection.13.5.4.2) 842 0 R (subsubsection.14.2.1.1) 886 0 R (subsubsection.14.2.1.2) 890 0 R (subsubsection.14.2.1.3) 894 0 R (subsubsection.14.2.1.4) 898 0 R (subsubsection.14.2.1.5) 902 0 R (subsubsection.14.2.1.6) 906 0 R (subsubsection.14.2.1.7) 910 0 R (subsubsection.14.2.1.8) 914 0 R (subsubsection.14.2.1.9) 918 0 R (subsubsection.14.3.1.1) 930 0 R (subsubsection.14.3.1.2) 934 0 R (subsubsection.18.7.2.1) 1190 0 R (subsubsection.18.7.2.2) 1194 0 R (subsubsection.18.7.2.3) 1198 0 R (subsubsection.18.7.2.4) 1202 0 R (subsubsection.18.7.2.5) 1206 0 R (subsubsection.18.7.2.6) 1210 0 R (subsubsection.18.7.2.7) 1214 0 R (subsubsection.18.7.2.8) 1218 0 R (subsubsection.18.7.2.9) 1222 0 R (subsubsection.19.11.5.1) 1650 0 R (subsubsection.19.11.5.10) 1686 0 R (subsubsection.19.11.5.11) 1690 0 R (subsubsection.19.11.5.12) 1694 0 R (subsubsection.19.11.5.13) 1698 0 R (subsubsection.19.11.5.14) 1702 0 R (subsubsection.19.11.5.15) 1706 0 R (subsubsection.19.11.5.2) 1654 0 R (subsubsection.19.11.5.3) 1658 0 R (subsubsection.19.11.5.4) 1662 0 R (subsubsection.19.11.5.5) 1666 0 R (subsubsection.19.11.5.6) 1670 0 R (subsubsection.19.11.5.7) 1674 0 R (subsubsection.19.11.5.8) 1678 0 R (subsubsection.19.11.5.9) 1682 0 R (subsubsection.19.13.1.1) 1742 0 R (subsubsection.19.13.1.2) 1746 0 R (subsubsection.19.13.1.3) 1750 0 R (subsubsection.19.13.1.4) 1754 0 R (subsubsection.19.13.1.5) 1758 0 R (subsubsection.19.13.1.6) 1762 0 R (subsubsection.19.13.1.7) 1766 0 R (subsubsection.19.13.1.8) 1770 0 R (subsubsection.2.2.1.1) 54 0 R (subsubsection.21.5.3.1) 1986 0 R (subsubsection.21.5.3.2) 1990 0 R (subsubsection.21.5.3.3) 1994 0 R (subsubsection.21.5.3.4) 1998 0 R (subsubsection.21.5.3.5) 2002 0 R (subsubsection.21.5.3.6) 2006 0 R (subsubsection.21.5.3.7) 2010 0 R (subsubsection.21.5.3.8) 2014 0 R (subsubsection.23.2.2.1) 2078 0 R (subsubsection.23.2.3.1) 2086 0 R (subsubsection.24.2.1.1) 2134 0 R (subsubsection.24.2.1.2) 2138 0 R (subsubsection.24.2.1.3) 2142 0 R (subsubsection.24.2.1.4) 2146 0 R (subsubsection.24.2.2.1) 2154 0 R (subsubsection.24.2.2.2) 2158 0 R (subsubsection.24.2.2.3) 2162 0 R (subsubsection.24.2.4.1) 2174 0 R (subsubsection.24.2.4.2) 2178 0 R (subsubsection.24.2.4.3) 2182 0 R (subsubsection.24.2.4.4) 2186 0 R (subsubsection.24.5.1.1) 2206 0 R (subsubsection.25.2.1.1) 2250 0 R (subsubsection.25.2.2.1) 2258 0 R (subsubsection.25.2.2.2) 2262 0 R (subsubsection.25.2.5.1) 2278 0 R (subsubsection.25.2.5.2) 2282 0 R (subsubsection.25.2.5.3) 2286 0 R (subsubsection.25.2.5.4) 2290 0 R (subsubsection.31.1.1.1) 2450 0 R (subsubsection.31.1.1.2) 2454 0 R (subsubsection.31.1.1.3) 2458 0 R (subsubsection.31.1.1.4) 2462 0 R (subsubsection.31.1.1.5) 2466 0 R (subsubsection.36.1.2.1) 2630 0 R (subsubsection.36.1.2.2) 2634 0 R (subsubsection.36.4.1.1) 2654 0 R (subsubsection.36.4.1.2) 2658 0 R (subsubsection.4.3.1.1) 122 0 R (subsubsection.4.3.2.1) 130 0 R (subsubsection.4.3.3.1) 138 0 R (subsubsection.4.3.4.1) 146 0 R (subsubsection.4.3.5.1) 154 0 R (subsubsection.5.5.1.1) 218 0 R (subsubsection.5.5.1.2) 222 0 R (subsubsection.5.5.1.3) 226 0 R (subsubsection.6.2.1.1) 278 0 R (subsubsection.7.2.4.1) 350 0 R (subsubsection.7.2.4.2) 354 0 R (subsubsection.7.2.4.3) 358 0 R (subsubsection.7.4.3.1) 390 0 R (table.10.1) 4369 0 R (table.10.2) 4371 0 R (table.10.3) 4377 0 R (table.10.4) 4379 0 R (table.11.1) 4524 0 R (table.11.2) 4531 0 R (table.11.3) 4537 0 R (table.13.1) 4589 0 R (table.13.2) 4609 0 R (table.13.3) 4618 0 R (table.13.4) 4625 0 R (table.20.1) 5798 0 R (table.24.1) 6126 0 R (table.24.2) 6128 0 R (table.24.3) 6139 0 R (table.25.1) 6205 0 R (table.31.1) 6369 0 R (table.31.2) 6376 0 R (table.7.1) 4183 0 R (troubleshooting) 6424 0 R (type) 3937 0 R (unicode) 3029 0 R (upgrading-to-3.0) 3032 0 R (winbind) 3023 0 R (winbind-solaris9) 5887 0 R] +7251 0 obj << +/Names [(AccessControls) 3058 0 R (AdvancedNetworkManagement) 3123 0 R (Appendixes) 7006 0 R (Backup) 3129 0 R (CUPS-printing) 3093 0 R (ClientConfig) 3054 0 R (DMB) 4259 0 R (DNSDHCP) 3171 0 R (Doc-Start) 2958 0 R (FastStart) 3019 0 R (Further-Resources) 3179 0 R (InterdomainTrusts) 3090 0 R (IntroSMB) 3017 0 R (Item.1) 4092 0 R (Item.10) 4251 0 R (Item.100) 5859 0 R (Item.101) 5860 0 R (Item.102) 5861 0 R (Item.103) 5866 0 R (Item.104) 5867 0 R (Item.105) 5868 0 R (Item.106) 5873 0 R (Item.107) 5874 0 R (Item.108) 5879 0 R (Item.109) 5880 0 R (Item.11) 4252 0 R (Item.110) 5881 0 R (Item.111) 5882 0 R (Item.112) 6081 0 R (Item.113) 6082 0 R (Item.114) 6083 0 R (Item.115) 6084 0 R (Item.116) 6085 0 R (Item.117) 6086 0 R (Item.118) 6087 0 R (Item.119) 6088 0 R (Item.12) 4363 0 R (Item.120) 6089 0 R (Item.121) 6090 0 R (Item.122) 6091 0 R (Item.123) 6092 0 R (Item.124) 6093 0 R (Item.125) 6094 0 R (Item.126) 6095 0 R (Item.127) 6347 0 R (Item.128) 6348 0 R (Item.129) 6349 0 R (Item.13) 4364 0 R (Item.130) 6350 0 R (Item.131) 6364 0 R (Item.132) 6365 0 R (Item.133) 6366 0 R (Item.134) 6367 0 R (Item.135) 6368 0 R (Item.136) 6369 0 R (Item.137) 6374 0 R (Item.138) 6375 0 R (Item.139) 6376 0 R (Item.14) 4365 0 R (Item.140) 6405 0 R (Item.141) 6406 0 R (Item.142) 6411 0 R (Item.143) 6412 0 R (Item.144) 6413 0 R (Item.145) 6414 0 R (Item.146) 6415 0 R (Item.147) 6422 0 R (Item.148) 6423 0 R (Item.149) 6424 0 R (Item.15) 4366 0 R (Item.150) 6425 0 R (Item.151) 6426 0 R (Item.152) 6431 0 R (Item.153) 6432 0 R (Item.154) 6433 0 R (Item.155) 6434 0 R (Item.156) 6435 0 R (Item.157) 6436 0 R (Item.158) 6437 0 R (Item.159) 6438 0 R (Item.16) 4367 0 R (Item.160) 6439 0 R (Item.161) 6440 0 R (Item.162) 6445 0 R (Item.163) 6446 0 R (Item.164) 6447 0 R (Item.165) 6448 0 R (Item.166) 6449 0 R (Item.167) 6450 0 R (Item.168) 6451 0 R (Item.169) 6452 0 R (Item.17) 4368 0 R (Item.170) 6453 0 R (Item.171) 6454 0 R (Item.172) 6455 0 R (Item.173) 6456 0 R (Item.174) 6465 0 R (Item.175) 6466 0 R (Item.176) 6467 0 R (Item.177) 6468 0 R (Item.178) 6469 0 R (Item.179) 6470 0 R (Item.18) 4451 0 R (Item.180) 6471 0 R (Item.181) 6493 0 R (Item.182) 6494 0 R (Item.183) 6495 0 R (Item.184) 6496 0 R (Item.185) 6726 0 R (Item.186) 6727 0 R (Item.187) 6728 0 R (Item.188) 6729 0 R (Item.189) 6730 0 R (Item.19) 4452 0 R (Item.190) 6731 0 R (Item.191) 6732 0 R (Item.192) 6733 0 R (Item.193) 6734 0 R (Item.194) 6735 0 R (Item.195) 6736 0 R (Item.196) 6737 0 R (Item.197) 6742 0 R (Item.198) 6769 0 R (Item.199) 6770 0 R (Item.2) 4093 0 R (Item.20) 4454 0 R (Item.200) 6778 0 R (Item.201) 6779 0 R (Item.202) 6820 0 R (Item.203) 6821 0 R (Item.204) 6826 0 R (Item.205) 6827 0 R (Item.206) 6828 0 R (Item.207) 6829 0 R (Item.208) 6830 0 R (Item.209) 6831 0 R (Item.21) 4455 0 R (Item.210) 6832 0 R (Item.211) 6860 0 R (Item.212) 6861 0 R (Item.213) 6866 0 R (Item.214) 6867 0 R (Item.215) 6905 0 R (Item.216) 6906 0 R (Item.217) 6911 0 R (Item.218) 6916 0 R (Item.219) 6917 0 R (Item.22) 4495 0 R (Item.220) 6918 0 R (Item.221) 6919 0 R (Item.222) 6925 0 R (Item.223) 6926 0 R (Item.224) 6927 0 R (Item.225) 6928 0 R (Item.226) 6929 0 R (Item.227) 6930 0 R (Item.228) 6931 0 R (Item.229) 6932 0 R (Item.23) 4496 0 R (Item.230) 6933 0 R (Item.231) 6934 0 R (Item.232) 6939 0 R (Item.233) 6940 0 R (Item.234) 6941 0 R (Item.235) 7022 0 R (Item.236) 7023 0 R (Item.237) 7024 0 R (Item.238) 7025 0 R (Item.239) 7026 0 R (Item.24) 4497 0 R (Item.25) 4498 0 R (Item.26) 4499 0 R (Item.27) 4500 0 R (Item.28) 4538 0 R (Item.29) 4539 0 R (Item.3) 4104 0 R (Item.30) 4540 0 R (Item.31) 4541 0 R (Item.32) 4618 0 R (Item.33) 4619 0 R (Item.34) 4620 0 R (Item.35) 4681 0 R (Item.36) 4682 0 R (Item.37) 4689 0 R (Item.38) 4802 0 R (Item.39) 4803 0 R (Item.4) 4105 0 R (Item.40) 4808 0 R (Item.41) 4895 0 R (Item.42) 4896 0 R (Item.43) 4898 0 R (Item.44) 4899 0 R (Item.45) 4900 0 R (Item.46) 4938 0 R (Item.47) 4939 0 R (Item.48) 4940 0 R (Item.49) 4945 0 R (Item.5) 4246 0 R (Item.50) 4946 0 R (Item.51) 4947 0 R (Item.52) 5154 0 R (Item.53) 5155 0 R (Item.54) 5156 0 R (Item.55) 5157 0 R (Item.56) 5158 0 R (Item.57) 5159 0 R (Item.58) 5160 0 R (Item.59) 5265 0 R (Item.6) 4247 0 R (Item.60) 5266 0 R (Item.61) 5267 0 R (Item.62) 5272 0 R (Item.63) 5339 0 R (Item.64) 5340 0 R (Item.65) 5341 0 R (Item.66) 5342 0 R (Item.67) 5343 0 R (Item.68) 5344 0 R (Item.69) 5345 0 R (Item.7) 4248 0 R (Item.70) 5346 0 R (Item.71) 5347 0 R (Item.72) 5353 0 R (Item.73) 5354 0 R (Item.74) 5355 0 R (Item.75) 5356 0 R (Item.76) 5357 0 R (Item.77) 5358 0 R (Item.78) 5409 0 R (Item.79) 5410 0 R (Item.8) 4249 0 R (Item.80) 5415 0 R (Item.81) 5767 0 R (Item.82) 5768 0 R (Item.83) 5769 0 R (Item.84) 5770 0 R (Item.85) 5788 0 R (Item.86) 5789 0 R (Item.87) 5790 0 R (Item.88) 5791 0 R (Item.89) 5792 0 R (Item.9) 4250 0 R (Item.90) 5800 0 R (Item.91) 5801 0 R (Item.92) 5802 0 R (Item.93) 5824 0 R (Item.94) 5825 0 R (Item.95) 5826 0 R (Item.96) 5827 0 R (Item.97) 5849 0 R (Item.98) 5853 0 R (Item.99) 5854 0 R (NT4Migration) 3132 0 R (NetworkBrowsing) 3055 0 R (Other-Clients) 3169 0 R (PolicyMgmt) 3124 0 R (Portability) 3168 0 R (ProfileMgmt) 3125 0 R (RefDocServer) 4443 0 R (SWAT) 3163 0 R (SambaHA) 3130 0 R (ServerType) 3020 0 R (SimplePrintServer) 4446 0 R (StandAloneServer) 3053 0 R (VFS) 3094 0 R (XMLpassdb) 4684 0 R (a_small) 6122 0 R (access1) 4861 0 R (acctmgmttools) 4669 0 R (ads-create-machine-account) 4415 0 R (ads-member) 4405 0 R (ads-test-server) 4418 0 R (ads-test-smbclient) 4417 0 R (browse-force-master) 4524 0 R (browsing1) 4595 0 R (bugreport) 3166 0 R (chapter*.1) 2984 0 R (chapter*.2) 2990 0 R (chapter*.3) 3184 0 R (chapter.1) 10 0 R (chapter.10) 466 0 R (chapter.11) 594 0 R (chapter.12) 746 0 R (chapter.13) 790 0 R (chapter.14) 902 0 R (chapter.15) 1006 0 R (chapter.16) 1062 0 R (chapter.17) 1110 0 R (chapter.18) 1122 0 R (chapter.19) 1362 0 R (chapter.2) 38 0 R (chapter.20) 1902 0 R (chapter.21) 1950 0 R (chapter.22) 2054 0 R (chapter.23) 2086 0 R (chapter.24) 2146 0 R (chapter.25) 2262 0 R (chapter.26) 2334 0 R (chapter.27) 2406 0 R (chapter.28) 2438 0 R (chapter.29) 2450 0 R (chapter.3) 94 0 R (chapter.30) 2462 0 R (chapter.31) 2526 0 R (chapter.32) 2574 0 R (chapter.33) 2626 0 R (chapter.34) 2642 0 R (chapter.35) 2686 0 R (chapter.36) 2718 0 R (chapter.37) 2778 0 R (chapter.38) 2818 0 R (chapter.39) 2886 0 R (chapter.4) 106 0 R (chapter.40) 2934 0 R (chapter.41) 2942 0 R (chapter.5) 186 0 R (chapter.6) 270 0 R (chapter.7) 330 0 R (chapter.8) 426 0 R (chapter.9) 454 0 R (compiling) 3167 0 R (cups1) 6050 0 R (cups2) 6115 0 R (diagnosis) 3164 0 R (domain-example) 4284 0 R (domain-member) 3023 0 R (domain-member-server) 4384 0 R (example.10.4.1) 4512 0 R (example.10.4.2) 4518 0 R (example.10.4.3) 4520 0 R (example.10.4.4) 4529 0 R (example.10.4.5) 4531 0 R (example.11.2.1) 4667 0 R (example.11.4.1) 4735 0 R (example.12.3.1) 4816 0 R (example.13.2.1) 4868 0 R (example.14.3.1) 5008 0 R (example.14.3.2) 5010 0 R (example.17.1.1) 5136 0 R (example.18.3.1) 5168 0 R (example.18.4.1) 5199 0 R (example.18.6.1) 5246 0 R (example.19.10.1) 5741 0 R (example.19.2.1) 5460 0 R (example.19.2.2) 5467 0 R (example.2.2.1) 4032 0 R (example.20.2.1) 6133 0 R (example.20.2.2) 6139 0 R (example.21.5.1) 6218 0 R (example.33.2.1) 6898 0 R (example.38.5.1) 7131 0 R (example.5.3.1) 4224 0 R (example.5.5.1) 4236 0 R (example.6.2.1) 4311 0 R (example.6.3.1) 4323 0 R (example.8.3.1) 4444 0 R (example.8.3.2) 4461 0 R (extbsdpr) 5193 0 R (figure.10.1) 4601 0 R (figure.11.1) 4654 0 R (figure.12.1) 4800 0 R (figure.13.1) 4867 0 R (figure.16.1) 5110 0 R (figure.19.1) 5498 0 R (figure.19.10) 5643 0 R (figure.19.11) 5655 0 R (figure.19.12) 5664 0 R (figure.19.13) 5689 0 R (figure.19.14) 5698 0 R (figure.19.15) 5710 0 R (figure.19.16) 5811 0 R (figure.19.17) 6052 0 R (figure.19.18) 6117 0 R (figure.19.19) 6124 0 R (figure.19.2) 5514 0 R (figure.19.3) 5518 0 R (figure.19.4) 5562 0 R (figure.19.5) 5566 0 R (figure.19.6) 5578 0 R (figure.19.7) 5588 0 R (figure.19.8) 5600 0 R (figure.19.9) 5608 0 R (figure.5.1) 4286 0 R (gdipost) 5489 0 R (groupmapping) 3057 0 R (id2724395) 4000 0 R (id2724477) 4005 0 R (id2777458) 4101 0 R (id2777506) 4102 0 R (id2777537) 4103 0 R (id2777763) 4118 0 R (id2777793) 4119 0 R (id2777864) 4129 0 R (id2783355) 4011 0 R (id2783424) 4013 0 R (id2783512) 4019 0 R (id2783585) 4021 0 R (id2783727) 4026 0 R (id2783771) 4030 0 R (id2783808) 4031 0 R (id2783832) 4033 0 R (id2783945) 4041 0 R (id2783998) 4042 0 R (id2784044) 4044 0 R (id2784101) 4052 0 R (id2784218) 4053 0 R (id2784301) 4054 0 R (id2784334) 4057 0 R (id2784346) 4062 0 R (id2784445) 4063 0 R (id2784464) 4064 0 R (id2792785) 4069 0 R (id2792965) 4079 0 R (id2793060) 4085 0 R (id2793146) 4086 0 R (id2793264) 4091 0 R (id2793356) 4094 0 R (id2793402) 4095 0 R (id2793803) 4213 0 R (id2794289) 4229 0 R (id2794328) 4230 0 R (id2794343) 4231 0 R (id2794392) 4238 0 R (id2794399) 4237 0 R (id2794483) 4239 0 R (id2794521) 4240 0 R (id2794702) 4137 0 R (id2794793) 4138 0 R (id2794985) 4144 0 R (id2795013) 4149 0 R (id2795053) 4150 0 R (id2795089) 4151 0 R (id2795128) 4153 0 R (id2795460) 4163 0 R (id2795674) 4175 0 R (id2795689) 4176 0 R (id2795934) 4197 0 R (id2795985) 6974 0 R (id2796112) 6981 0 R (id2796175) 6984 0 R (id2796212) 6986 0 R (id2796421) 6991 0 R (id2796554) 6996 0 R (id2796601) 6997 0 R (id2796760) 7008 0 R (id2796776) 7009 0 R (id2796806) 7012 0 R (id2796822) 7013 0 R (id2796864) 7015 0 R (id2797054) 7027 0 R (id2797119) 7038 0 R (id2797268) 7039 0 R (id2797446) 7044 0 R (id2797528) 7045 0 R (id2797560) 7050 0 R (id2797613) 7051 0 R (id2797721) 7052 0 R (id2797967) 7061 0 R (id2798131) 7066 0 R (id2798218) 7067 0 R (id2798248) 7069 0 R (id2798511) 4257 0 R (id2798657) 4264 0 R (id2798664) 4265 0 R (id2798723) 4266 0 R (id2798778) 4267 0 R (id2798862) 4272 0 R (id2798935) 4273 0 R (id2798967) 4274 0 R (id2798989) 4279 0 R (id2799149) 4294 0 R (id2799339) 4300 0 R (id2799368) 4301 0 R (id2799511) 4310 0 R (id2799542) 4312 0 R (id2799611) 4314 0 R (id2799632) 4315 0 R (id2799658) 4316 0 R (id2799672) 4321 0 R (id2799806) 4322 0 R (id2799821) 4324 0 R (id2799962) 4329 0 R (id2799976) 4330 0 R (id2800007) 4331 0 R (id2800033) 4337 0 R (id2800078) 4338 0 R (id2800285) 4343 0 R (id2800606) 4352 0 R (id2800898) 4358 0 R (id2801113) 4373 0 R (id2801184) 4374 0 R (id2801197) 4375 0 R (id2801273) 4376 0 R (id2801314) 4382 0 R (id2801395) 4386 0 R (id2801406) 4387 0 R (id2801832) 4397 0 R (id2802016) 4406 0 R (id2802145) 4407 0 R (id2802362) 4416 0 R (id2802519) 4423 0 R (id2802541) 4424 0 R (id2802568) 4425 0 R (id2802600) 4431 0 R (id2802802) 4436 0 R (id2802840) 4437 0 R (id2802923) 4442 0 R (id2802969) 4445 0 R (id2803287) 4462 0 R (id2803444) 4456 0 R (id2803508) 4467 0 R (id2803661) 4478 0 R (id2803750) 4483 0 R (id2804062) 4488 0 R (id2804078) 4489 0 R (id2804314) 4494 0 R (id2804479) 4501 0 R (id2804626) 4506 0 R (id2804876) 4513 0 R (id2804966) 4519 0 R (id2805104) 4521 0 R (id2805161) 4522 0 R (id2805210) 4530 0 R (id2805327) 4532 0 R (id2805559) 4537 0 R (id2805737) 4542 0 R (id2805754) 4547 0 R (id2805790) 4548 0 R (id2805949) 4549 0 R (id2806026) 4555 0 R (id2806214) 4561 0 R (id2806470) 4566 0 R (id2806496) 4567 0 R (id2806580) 4568 0 R (id2806594) 4573 0 R (id2806659) 4574 0 R (id2806823) 4579 0 R (id2806883) 4580 0 R (id2807004) 4585 0 R (id2807091) 4591 0 R (id2807140) 4592 0 R (id2807282) 4602 0 R (id2807395) 4608 0 R (id2807508) 4610 0 R (id2807625) 4612 0 R (id2807781) 4621 0 R (id2807796) 4622 0 R (id2807839) 4623 0 R (id2807881) 4624 0 R (id2808162) 4633 0 R (id2808176) 4634 0 R (id2808278) 4639 0 R (id2808451) 4646 0 R (id2808577) 4647 0 R (id2808754) 4659 0 R (id2808808) 4660 0 R (id2808844) 4661 0 R (id2809030) 4670 0 R (id2809301) 4675 0 R (id2809539) 4690 0 R (id2809580) 4691 0 R (id2809621) 4692 0 R (id2809734) 4697 0 R (id2809762) 4698 0 R (id2809914) 4710 0 R (id2809940) 4712 0 R (id2810050) 4718 0 R (id2810245) 4723 0 R (id2810372) 4728 0 R (id2810548) 4736 0 R (id2810769) 4729 0 R (id2810806) 4737 0 R (id2810965) 4743 0 R (id2810982) 4749 0 R (id2811406) 4751 0 R (id2811472) 4756 0 R (id2811589) 4757 0 R (id2811610) 4762 0 R (id2811679) 4763 0 R (id2811777) 4764 0 R (id2811908) 4770 0 R (id2812298) 4772 0 R (id2812328) 4778 0 R (id2812437) 4779 0 R (id2812444) 4780 0 R (id2812489) 4782 0 R (id2812600) 4787 0 R (id2812829) 4793 0 R (id2813064) 4801 0 R (id2813290) 4809 0 R (id2813357) 4814 0 R (id2813371) 4815 0 R (id2813394) 4817 0 R (id2813450) 4818 0 R (id2813526) 4824 0 R (id2813542) 4825 0 R (id2813610) 4826 0 R (id2813636) 4827 0 R (id2813893) 4836 0 R (id2814031) 4841 0 R (id2814066) 4842 0 R (id2814365) 4855 0 R (id2814385) 4856 0 R (id2814460) 4858 0 R (id2814610) 4869 0 R (id2814687) 4874 0 R (id2814715) 4875 0 R (id2814802) 4876 0 R (id2815136) 4878 0 R (id2815157) 4884 0 R (id2815515) 4879 0 R (id2815537) 4886 0 R (id2815896) 4888 0 R (id2815968) 4893 0 R (id2815981) 4894 0 R (id2816064) 4897 0 R (id2816267) 4905 0 R (id2816275) 4906 0 R (id2816320) 4907 0 R (id2816399) 4912 0 R (id2816530) 4913 0 R (id2816629) 4919 0 R (id2816721) 4920 0 R (id2816765) 4921 0 R (id2816925) 4926 0 R (id2817321) 4931 0 R (id2817402) 4936 0 R (id2817416) 4937 0 R (id2817845) 4952 0 R (id2817897) 4953 0 R (id2818145) 4959 0 R (id2818202) 4960 0 R (id2818344) 4965 0 R (id2818646) 4974 0 R (id2818677) 4975 0 R (id2818706) 4976 0 R (id2818732) 4981 0 R (id2818765) 4982 0 R (id2818786) 4983 0 R (id2818813) 4984 0 R (id2818905) 4989 0 R (id2818962) 4990 0 R (id2819020) 4996 0 R (id2819129) 5001 0 R (id2819142) 5002 0 R (id2819239) 5003 0 R (id2819332) 5009 0 R (id2819473) 5011 0 R (id2819526) 5012 0 R (id2819752) 5021 0 R (id2819779) 5026 0 R (id2819858) 5027 0 R (id2819888) 5033 0 R (id2819961) 5034 0 R (id2820000) 5039 0 R (id2820022) 5042 0 R (id2820054) 5045 0 R (id2820220) 5058 0 R (id2820252) 5059 0 R (id2820326) 5060 0 R (id2820345) 5065 0 R (id2820445) 5066 0 R (id2820504) 5067 0 R (id2820572) 5072 0 R (id2820629) 5073 0 R (id2820717) 5078 0 R (id2820775) 5079 0 R (id2820799) 5081 0 R (id2820818) 5082 0 R (id2820843) 5088 0 R (id2821133) 5093 0 R (id2821162) 5094 0 R (id2821250) 5099 0 R (id2821277) 5100 0 R (id2821349) 5101 0 R (id2821396) 5107 0 R (id2821575) 5115 0 R (id2821759) 5121 0 R (id2821897) 5122 0 R (id2822003) 5129 0 R (id2822073) 5134 0 R (id2822184) 5137 0 R (id2822348) 5142 0 R (id2822468) 5147 0 R (id2822534) 5148 0 R (id2822572) 5153 0 R (id2822644) 5161 0 R (id2822729) 5166 0 R (id2823195) 5167 0 R (id2823223) 5169 0 R (id2823359) 5175 0 R (id2823447) 5180 0 R (id2823780) 5189 0 R (id2824111) 5191 0 R (id2824124) 5192 0 R (id2824616) 5209 0 R (id2825059) 5214 0 R (id2825374) 5215 0 R (id2825432) 5220 0 R (id2825495) 5221 0 R (id2826100) 5226 0 R (id2826430) 5231 0 R (id2826579) 5234 0 R (id2826731) 5239 0 R (id2826844) 5245 0 R (id2826886) 5247 0 R (id2827028) 5248 0 R (id2827315) 5253 0 R (id2827482) 5258 0 R (id2827576) 5263 0 R (id2827774) 5264 0 R (id2827882) 5273 0 R (id2828207) 5278 0 R (id2828357) 5284 0 R (id2828548) 5289 0 R (id2828708) 5294 0 R (id2828808) 5299 0 R (id2828932) 5304 0 R (id2829135) 5309 0 R (id2829246) 5310 0 R (id2829397) 5316 0 R (id2829415) 5317 0 R (id2829611) 5322 0 R (id2829918) 5331 0 R (id2830012) 5332 0 R (id2830180) 5337 0 R (id2830212) 5338 0 R (id2830661) 5367 0 R (id2830963) 5372 0 R (id2831257) 5377 0 R (id2831355) 5382 0 R (id2831642) 5396 0 R (id2831719) 5397 0 R (id2831740) 5398 0 R (id2831785) 5401 0 R (id2831826) 5406 0 R (id2831846) 5407 0 R (id2831870) 5408 0 R (id2832023) 5416 0 R (id2832342) 5427 0 R (id2832388) 5428 0 R (id2832555) 5434 0 R (id2832569) 5435 0 R (id2832576) 5436 0 R (id2832610) 5437 0 R (id2832745) 5443 0 R (id2832752) 5444 0 R (id2832795) 5446 0 R (id2832849) 5448 0 R (id2832942) 5454 0 R (id2833183) 5459 0 R (id2833211) 5461 0 R (id2833358) 5462 0 R (id2833390) 5468 0 R (id2833704) 5469 0 R (id2833724) 5470 0 R (id2833773) 5475 0 R (id2833827) 5476 0 R (id2833894) 5477 0 R (id2834081) 5482 0 R (id2834208) 5488 0 R (id2834376) 5495 0 R (id2834518) 5499 0 R (id2834783) 5515 0 R (id2834909) 5525 0 R (id2834996) 5530 0 R (id2835102) 5533 0 R (id2835124) 5539 0 R (id2835301) 5542 0 R (id2835507) 5547 0 R (id2835657) 5552 0 R (id2835835) 5559 0 R (id2835937) 5563 0 R (id2836046) 5575 0 R (id2836217) 5589 0 R (id2836280) 5590 0 R (id2836432) 5591 0 R (id2836754) 5614 0 R (id2836904) 5615 0 R (id2836918) 5620 0 R (id2836972) 5621 0 R (id2837039) 5622 0 R (id2837271) 5631 0 R (id2837350) 5632 0 R (id2837534) 5634 0 R (id2837752) 5651 0 R (id2838073) 5665 0 R (id2838214) 5676 0 R (id2838291) 5678 0 R (id2838307) 5679 0 R (id2838362) 5686 0 R (id2838432) 5690 0 R (id2838543) 5699 0 R (id2838563) 5700 0 R (id2838773) 5711 0 R (id2838855) 5712 0 R (id2838936) 5719 0 R (id2838985) 5720 0 R (id2839058) 5725 0 R (id2839076) 5726 0 R (id2839110) 5727 0 R (id2839131) 5728 0 R (id2839175) 5729 0 R (id2839236) 5734 0 R (id2839255) 5735 0 R (id2839356) 5736 0 R (id2839383) 5742 0 R (id2839575) 5743 0 R (id2839858) 5749 0 R (id2839998) 5755 0 R (id2840031) 5760 0 R (id2840091) 5762 0 R (id2840358) 5772 0 R (id2840565) 5777 0 R (id2840686) 5778 0 R (id2840908) 5787 0 R (id2841056) 5799 0 R (id2841140) 5803 0 R (id2841219) 5804 0 R (id2841288) 5812 0 R (id2841439) 5818 0 R (id2841571) 5823 0 R (id2841765) 5828 0 R (id2841878) 5836 0 R (id2841986) 5837 0 R (id2842132) 5842 0 R (id2842342) 5848 0 R (id2843363) 5883 0 R (id2843515) 5888 0 R (id2843760) 5894 0 R (id2843839) 5895 0 R (id2843901) 5896 0 R (id2843959) 5897 0 R (id2844095) 5902 0 R (id2844232) 5910 0 R (id2844305) 5914 0 R (id2844328) 5915 0 R (id2844374) 5922 0 R (id2844450) 5923 0 R (id2844614) 5939 0 R (id2844708) 5943 0 R (id2844790) 5951 0 R (id2844861) 5956 0 R (id2844925) 5959 0 R (id2845397) 5998 0 R (id2845440) 5999 0 R (id2845504) 6000 0 R (id2845544) 6006 0 R (id2845624) 6007 0 R (id2845734) 6012 0 R (id2845805) 6013 0 R (id2845852) 6018 0 R (id2845867) 6019 0 R (id2846076) 6025 0 R (id2846134) 6026 0 R (id2846216) 6031 0 R (id2846372) 6032 0 R (id2846429) 6033 0 R (id2846496) 6038 0 R (id2846776) 6045 0 R (id2846877) 6053 0 R (id2846884) 6054 0 R (id2846900) 6055 0 R (id2846946) 6060 0 R (id2847002) 6061 0 R (id2847030) 6062 0 R (id2847256) 6063 0 R (id2847308) 6064 0 R (id2847323) 6070 0 R (id2847352) 6071 0 R (id2847369) 6072 0 R (id2847384) 6073 0 R (id2847407) 6074 0 R (id2847426) 6075 0 R (id2847468) 6080 0 R (id2847742) 6101 0 R (id2847787) 6102 0 R (id2847848) 6103 0 R (id2847957) 6104 0 R (id2847988) 6105 0 R (id2848043) 6110 0 R (id2848213) 6131 0 R (id2848231) 6132 0 R (id2848268) 6134 0 R (id2848367) 6140 0 R (id2848459) 6141 0 R (id2848466) 6142 0 R (id2848508) 6143 0 R (id2848556) 6144 0 R (id2848638) 6146 0 R (id2848657) 6151 0 R (id2848827) 6152 0 R (id2848872) 6157 0 R (id2848894) 6158 0 R (id2848948) 6161 0 R (id2849177) 6167 0 R (id2849272) 6172 0 R (id2849358) 6173 0 R (id2849418) 6179 0 R (id2849449) 6180 0 R (id2849478) 6181 0 R (id2849511) 6182 0 R (id2849534) 6187 0 R (id2849662) 6188 0 R (id2849744) 6193 0 R (id2849777) 6194 0 R (id2849805) 6195 0 R (id2849812) 6196 0 R (id2849880) 6201 0 R (id2849974) 6203 0 R (id2850036) 6208 0 R (id2850244) 6209 0 R (id2850316) 6217 0 R (id2850362) 6219 0 R (id2850473) 6220 0 R (id2850530) 6226 0 R (id2850778) 6231 0 R (id2850785) 6233 0 R (id2850948) 6239 0 R (id2851058) 6251 0 R (id2851095) 6252 0 R (id2851200) 6254 0 R (id2851432) 6265 0 R (id2851540) 6270 0 R (id2851559) 6271 0 R (id2851612) 6276 0 R (id2851721) 6281 0 R (id2851752) 6282 0 R (id2851850) 6291 0 R (id2851868) 6292 0 R (id2852080) 6300 0 R (id2852352) 6314 0 R (id2852385) 6320 0 R (id2852465) 6325 0 R (id2852519) 6326 0 R (id2852630) 6333 0 R (id2852726) 6334 0 R (id2852835) 6339 0 R (id2852858) 6340 0 R (id2852970) 6346 0 R (id2853122) 6355 0 R (id2853228) 6356 0 R (id2853267) 6361 0 R (id2853287) 6362 0 R (id2853331) 6363 0 R (id2853482) 6377 0 R (id2853496) 6378 0 R (id2853596) 6383 0 R (id2853631) 6384 0 R (id2853672) 6385 0 R (id2853684) 6390 0 R (id2853792) 6391 0 R (id2853924) 6397 0 R (id2853991) 6398 0 R (id2854162) 6403 0 R (id2854170) 6404 0 R (id2854706) 6420 0 R (id2854891) 6421 0 R (id2855402) 6457 0 R (id2855486) 6458 0 R (id2855503) 6464 0 R (id2855668) 6472 0 R (id2855682) 6473 0 R (id2855698) 6478 0 R (id2855739) 6479 0 R (id2855797) 6480 0 R (id2855842) 6485 0 R (id2855862) 6486 0 R (id2855961) 6487 0 R (id2856010) 6492 0 R (id2856361) 6501 0 R (id2856505) 6503 0 R (id2856564) 6505 0 R (id2856760) 6515 0 R (id2857072) 6521 0 R (id2857085) 6522 0 R (id2857154) 6523 0 R (id2857368) 6528 0 R (id2857648) 6538 0 R (id2857896) 6543 0 R (id2857914) 6544 0 R (id2857971) 6550 0 R (id2858577) 6564 0 R (id2858608) 6569 0 R (id2858635) 6570 0 R (id2858881) 6580 0 R (id2858959) 6581 0 R (id2859048) 6586 0 R (id2859080) 6587 0 R (id2859293) 6596 0 R (id2859327) 6597 0 R (id2859363) 6602 0 R (id2859395) 6603 0 R (id2859436) 6604 0 R (id2859450) 6605 0 R (id2859536) 6610 0 R (id2859774) 6620 0 R (id2859799) 6621 0 R (id2859863) 6626 0 R (id2859919) 6627 0 R (id2860060) 6632 0 R (id2860104) 6633 0 R (id2860155) 6638 0 R (id2860260) 6643 0 R (id2860292) 6644 0 R (id2860362) 6646 0 R (id2860527) 6652 0 R (id2860590) 6653 0 R (id2860838) 6663 0 R (id2860870) 6664 0 R (id2860902) 6665 0 R (id2861020) 6672 0 R (id2861036) 6673 0 R (id2861071) 6674 0 R (id2861122) 6675 0 R (id2861325) 6684 0 R (id2861369) 6686 0 R (id2861439) 6692 0 R (id2861566) 6693 0 R (id2861596) 6695 0 R (id2861734) 6703 0 R (id2861740) 6704 0 R (id2861854) 6709 0 R (id2861868) 6710 0 R (id2861938) 6715 0 R (id2862077) 6725 0 R (id2862207) 6743 0 R (id2862222) 6744 0 R (id2862348) 6750 0 R (id2862744) 6759 0 R (id2862818) 6764 0 R (id2862825) 6765 0 R (id2862844) 6766 0 R (id2863060) 6768 0 R (id2863109) 6771 0 R (id2863133) 6777 0 R (id2863251) 6781 0 R (id2863275) 6783 0 R (id2863287) 6784 0 R (id2863399) 6789 0 R (id2863466) 6795 0 R (id2863607) 6800 0 R (id2863632) 6801 0 R (id2863843) 6810 0 R (id2863893) 6811 0 R (id2863953) 6816 0 R (id2864016) 6817 0 R (id2864046) 6818 0 R (id2864070) 6819 0 R (id2864282) 6833 0 R (id2864297) 6834 0 R (id2864373) 6836 0 R (id2864444) 6842 0 R (id2864629) 6844 0 R (id2864989) 6853 0 R (id2865028) 6854 0 R (id2865266) 6859 0 R (id2865377) 6869 0 R (id2865439) 6871 0 R (id2865546) 6876 0 R (id2865610) 6877 0 R (id2865674) 6878 0 R (id2865722) 6884 0 R (id2865774) 6885 0 R (id2865797) 6886 0 R (id2865927) 6896 0 R (id2865961) 6897 0 R (id2866010) 6899 0 R (id2866188) 6904 0 R (id2867662) 6946 0 R (id2867683) 6947 0 R (id2867796) 6948 0 R (id2867818) 6954 0 R (id2867870) 6956 0 R (id2867891) 6957 0 R (id2868160) 6962 0 R (id2868187) 6963 0 R (id2868228) 6967 0 R (id2868354) 7079 0 R (id2868398) 7080 0 R (id2868405) 7081 0 R (id2868431) 7082 0 R (id2868438) 7083 0 R (id2868591) 7092 0 R (id2868669) 7098 0 R (id2868676) 7099 0 R (id2868745) 7104 0 R (id2868797) 7107 0 R (id2868897) 7112 0 R (id2868905) 7113 0 R (id2868996) 7114 0 R (id2869025) 7115 0 R (id2869078) 7116 0 R (id2869116) 7117 0 R (id2869133) 7123 0 R (id2869179) 7124 0 R (id2869253) 7125 0 R (id2869277) 7126 0 R (id2869349) 7132 0 R (id2869464) 7133 0 R (id2869596) 7139 0 R (id2869641) 7140 0 R (id2869730) 7145 0 R (id2869780) 7146 0 R (id2869840) 7147 0 R (id2869870) 7148 0 R (id2869954) 7153 0 R (id2870017) 7154 0 R (id2870046) 7155 0 R (id2870071) 7157 0 R (id2870116) 7158 0 R (id2870219) 7168 0 R (id2870286) 7173 0 R (id2870694) 7203 0 R (idmap-diag) 4652 0 R (idmap-group-diag) 4798 0 R (idmapbackend) 4666 0 R (idmapbackendexample) 4668 0 R (install) 3018 0 R (integrate-ms-networks) 3127 0 R (introduction) 3999 0 R (locking) 3088 0 R (machine-trust-accounts) 4177 0 R (migration) 6724 0 R (msdfs) 3091 0 R (optional) 4477 0 R (page.1) 2957 0 R (page.10) 3183 0 R (page.100) 4572 0 R (page.101) 4578 0 R (page.102) 4584 0 R (page.103) 4590 0 R (page.104) 4599 0 R (page.105) 4607 0 R (page.106) 4617 0 R (page.107) 4628 0 R (page.108) 4632 0 R (page.109) 4638 0 R (page.11) 3223 0 R (page.110) 4645 0 R (page.111) 4651 0 R (page.112) 4658 0 R (page.113) 4665 0 R (page.114) 4674 0 R (page.115) 4679 0 R (page.116) 4688 0 R (page.117) 4696 0 R (page.118) 4706 0 R (page.119) 4717 0 R (page.12) 3276 0 R (page.120) 4722 0 R (page.121) 4727 0 R (page.122) 4734 0 R (page.123) 4741 0 R (page.124) 4748 0 R (page.125) 4755 0 R (page.126) 4761 0 R (page.127) 4769 0 R (page.128) 4777 0 R (page.129) 4786 0 R (page.13) 3328 0 R (page.130) 4792 0 R (page.131) 4797 0 R (page.132) 4807 0 R (page.133) 4813 0 R (page.134) 4823 0 R (page.135) 4831 0 R (page.136) 4835 0 R (page.137) 4840 0 R (page.138) 4846 0 R (page.139) 4854 0 R (page.14) 3386 0 R (page.140) 4865 0 R (page.141) 4873 0 R (page.142) 4883 0 R (page.143) 4892 0 R (page.144) 4904 0 R (page.145) 4911 0 R (page.146) 4918 0 R (page.147) 4925 0 R (page.148) 4930 0 R (page.149) 4935 0 R (page.15) 3435 0 R (page.150) 4944 0 R (page.151) 4951 0 R (page.152) 4958 0 R (page.153) 4964 0 R (page.154) 4969 0 R (page.155) 4973 0 R (page.156) 4980 0 R (page.157) 4988 0 R (page.158) 4995 0 R (page.159) 5000 0 R (page.16) 3490 0 R (page.160) 5007 0 R (page.161) 5016 0 R (page.162) 5020 0 R (page.163) 5025 0 R (page.164) 5032 0 R (page.165) 5038 0 R (page.166) 5057 0 R (page.167) 5064 0 R (page.168) 5071 0 R (page.169) 5077 0 R (page.17) 3545 0 R (page.170) 5087 0 R (page.171) 5092 0 R (page.172) 5098 0 R (page.173) 5106 0 R (page.174) 5114 0 R (page.175) 5120 0 R (page.176) 5128 0 R (page.177) 5133 0 R (page.178) 5141 0 R (page.179) 5146 0 R (page.18) 3598 0 R (page.180) 5152 0 R (page.181) 5165 0 R (page.182) 5174 0 R (page.183) 5179 0 R (page.184) 5184 0 R (page.185) 5188 0 R (page.186) 5198 0 R (page.187) 5203 0 R (page.188) 5208 0 R (page.189) 5213 0 R (page.19) 3652 0 R (page.190) 5219 0 R (page.191) 5225 0 R (page.192) 5230 0 R (page.193) 5238 0 R (page.194) 5244 0 R (page.195) 5252 0 R (page.196) 5257 0 R (page.197) 5262 0 R (page.198) 5271 0 R (page.199) 5277 0 R (page.2) 2969 0 R (page.20) 3705 0 R (page.200) 5283 0 R (page.201) 5288 0 R (page.202) 5293 0 R (page.203) 5298 0 R (page.204) 5303 0 R (page.205) 5308 0 R (page.206) 5315 0 R (page.207) 5321 0 R (page.208) 5326 0 R (page.209) 5330 0 R (page.21) 3756 0 R (page.210) 5336 0 R (page.211) 5352 0 R (page.212) 5366 0 R (page.213) 5371 0 R (page.214) 5376 0 R (page.215) 5381 0 R (page.216) 5386 0 R (page.217) 5390 0 R (page.218) 5395 0 R (page.219) 5405 0 R (page.22) 3811 0 R (page.220) 5414 0 R (page.221) 5422 0 R (page.222) 5426 0 R (page.223) 5433 0 R (page.224) 5442 0 R (page.225) 5452 0 R (page.226) 5458 0 R (page.227) 5466 0 R (page.228) 5474 0 R (page.229) 5481 0 R (page.23) 3858 0 R (page.230) 5487 0 R (page.231) 5494 0 R (page.232) 5505 0 R (page.233) 5511 0 R (page.234) 5524 0 R (page.235) 5529 0 R (page.236) 5538 0 R (page.237) 5546 0 R (page.238) 5551 0 R (page.239) 5558 0 R (page.24) 3907 0 R (page.240) 5574 0 R (page.241) 5585 0 R (page.242) 5597 0 R (page.243) 5605 0 R (page.244) 5613 0 R (page.245) 5619 0 R (page.246) 5626 0 R (page.247) 5630 0 R (page.248) 5640 0 R (page.249) 5650 0 R (page.25) 3955 0 R (page.250) 5660 0 R (page.251) 5673 0 R (page.252) 5685 0 R (page.253) 5695 0 R (page.254) 5707 0 R (page.255) 5717 0 R (page.256) 5724 0 R (page.257) 5733 0 R (page.258) 5740 0 R (page.259) 5748 0 R (page.26) 3994 0 R (page.260) 5754 0 R (page.261) 5759 0 R (page.262) 5766 0 R (page.263) 5776 0 R (page.264) 5782 0 R (page.265) 5786 0 R (page.266) 5798 0 R (page.267) 5808 0 R (page.268) 5817 0 R (page.269) 5822 0 R (page.27) 3998 0 R (page.270) 5835 0 R (page.271) 5841 0 R (page.272) 5847 0 R (page.273) 5858 0 R (page.274) 5865 0 R (page.275) 5872 0 R (page.276) 5878 0 R (page.277) 5887 0 R (page.278) 5893 0 R (page.279) 5901 0 R (page.28) 4004 0 R (page.280) 5908 0 R (page.281) 5921 0 R (page.282) 5938 0 R (page.283) 5950 0 R (page.284) 5964 0 R (page.285) 5989 0 R (page.286) 5997 0 R (page.287) 6004 0 R (page.288) 6011 0 R (page.289) 6017 0 R (page.29) 4009 0 R (page.290) 6024 0 R (page.291) 6030 0 R (page.292) 6037 0 R (page.293) 6044 0 R (page.294) 6049 0 R (page.295) 6059 0 R (page.296) 6069 0 R (page.297) 6079 0 R (page.298) 6100 0 R (page.299) 6109 0 R (page.3) 2983 0 R (page.30) 4017 0 R (page.300) 6114 0 R (page.301) 6121 0 R (page.302) 6130 0 R (page.303) 6138 0 R (page.304) 6150 0 R (page.305) 6156 0 R (page.306) 6166 0 R (page.307) 6171 0 R (page.308) 6178 0 R (page.309) 6186 0 R (page.31) 4025 0 R (page.310) 6192 0 R (page.311) 6200 0 R (page.312) 6207 0 R (page.313) 6213 0 R (page.314) 6225 0 R (page.315) 6230 0 R (page.316) 6237 0 R (page.317) 6245 0 R (page.318) 6249 0 R (page.319) 6258 0 R (page.32) 4038 0 R (page.320) 6263 0 R (page.321) 6269 0 R (page.322) 6275 0 R (page.323) 6280 0 R (page.324) 6290 0 R (page.325) 6298 0 R (page.326) 6306 0 R (page.327) 6310 0 R (page.328) 6318 0 R (page.329) 6324 0 R (page.33) 4051 0 R (page.330) 6330 0 R (page.331) 6338 0 R (page.332) 6345 0 R (page.333) 6354 0 R (page.334) 6360 0 R (page.335) 6373 0 R (page.336) 6382 0 R (page.337) 6389 0 R (page.338) 6396 0 R (page.339) 6402 0 R (page.34) 4061 0 R (page.340) 6410 0 R (page.341) 6419 0 R (page.342) 6430 0 R (page.343) 6444 0 R (page.344) 6463 0 R (page.345) 6477 0 R (page.346) 6484 0 R (page.347) 6491 0 R (page.348) 6500 0 R (page.349) 6509 0 R (page.35) 4068 0 R (page.350) 6514 0 R (page.351) 6520 0 R (page.352) 6527 0 R (page.353) 6532 0 R (page.354) 6536 0 R (page.355) 6542 0 R (page.356) 6549 0 R (page.357) 6555 0 R (page.358) 6559 0 R (page.359) 6563 0 R (page.36) 4073 0 R (page.360) 6568 0 R (page.361) 6574 0 R (page.362) 6579 0 R (page.363) 6585 0 R (page.364) 6594 0 R (page.365) 6601 0 R (page.366) 6609 0 R (page.367) 6614 0 R (page.368) 6619 0 R (page.369) 6625 0 R (page.37) 4077 0 R (page.370) 6631 0 R (page.371) 6637 0 R (page.372) 6642 0 R (page.373) 6651 0 R (page.374) 6658 0 R (page.375) 6662 0 R (page.376) 6669 0 R (page.377) 6679 0 R (page.378) 6683 0 R (page.379) 6691 0 R (page.38) 4084 0 R (page.380) 6702 0 R (page.381) 6708 0 R (page.382) 6714 0 R (page.383) 6719 0 R (page.384) 6723 0 R (page.385) 6741 0 R (page.386) 6749 0 R (page.387) 6754 0 R (page.388) 6758 0 R (page.389) 6763 0 R (page.39) 4090 0 R (page.390) 6776 0 R (page.391) 6788 0 R (page.392) 6794 0 R (page.393) 6799 0 R (page.394) 6805 0 R (page.395) 6809 0 R (page.396) 6815 0 R (page.397) 6825 0 R (page.398) 6841 0 R (page.399) 6848 0 R (page.4) 2989 0 R (page.40) 4100 0 R (page.400) 6852 0 R (page.401) 6858 0 R (page.402) 6865 0 R (page.403) 6875 0 R (page.404) 6883 0 R (page.405) 6890 0 R (page.406) 6894 0 R (page.407) 6903 0 R (page.408) 6910 0 R (page.409) 6915 0 R (page.41) 4109 0 R (page.410) 6924 0 R (page.411) 6938 0 R (page.412) 6945 0 R (page.413) 6953 0 R (page.414) 6961 0 R (page.415) 6973 0 R (page.416) 6980 0 R (page.417) 6990 0 R (page.418) 6995 0 R (page.419) 7001 0 R (page.42) 4127 0 R (page.420) 7005 0 R (page.421) 7019 0 R (page.422) 7037 0 R (page.423) 7043 0 R (page.424) 7049 0 R (page.425) 7056 0 R (page.426) 7060 0 R (page.427) 7065 0 R (page.428) 7074 0 R (page.429) 7078 0 R (page.43) 4133 0 R (page.430) 7087 0 R (page.431) 7091 0 R (page.432) 7103 0 R (page.433) 7111 0 R (page.434) 7122 0 R (page.435) 7130 0 R (page.436) 7138 0 R (page.437) 7144 0 R (page.438) 7152 0 R (page.439) 7162 0 R (page.44) 4143 0 R (page.440) 7167 0 R (page.441) 7172 0 R (page.442) 7198 0 R (page.45) 4148 0 R (page.46) 4158 0 R (page.47) 4162 0 R (page.48) 4169 0 R (page.49) 4181 0 R (page.5) 3027 0 R (page.50) 4196 0 R (page.51) 4203 0 R (page.52) 4212 0 R (page.53) 4223 0 R (page.54) 4228 0 R (page.55) 4235 0 R (page.56) 4245 0 R (page.57) 4256 0 R (page.58) 4263 0 R (page.59) 4271 0 R (page.6) 3062 0 R (page.60) 4278 0 R (page.61) 4283 0 R (page.62) 4291 0 R (page.63) 4299 0 R (page.64) 4305 0 R (page.65) 4309 0 R (page.66) 4320 0 R (page.67) 4328 0 R (page.68) 4336 0 R (page.69) 4342 0 R (page.7) 3098 0 R (page.70) 4347 0 R (page.71) 4351 0 R (page.72) 4357 0 R (page.73) 4372 0 R (page.74) 4381 0 R (page.75) 4392 0 R (page.76) 4396 0 R (page.77) 4404 0 R (page.78) 4411 0 R (page.79) 4422 0 R (page.8) 3136 0 R (page.80) 4430 0 R (page.81) 4435 0 R (page.82) 4441 0 R (page.83) 4450 0 R (page.84) 4460 0 R (page.85) 4466 0 R (page.86) 4472 0 R (page.87) 4476 0 R (page.88) 4482 0 R (page.89) 4487 0 R (page.9) 3175 0 R (page.90) 4493 0 R (page.91) 4505 0 R (page.92) 4511 0 R (page.93) 4517 0 R (page.94) 4528 0 R (page.95) 4536 0 R (page.96) 4546 0 R (page.97) 4554 0 R (page.98) 4560 0 R (page.99) 4565 0 R (pam) 3126 0 R (part.1) 6 0 R (part.2) 102 0 R (part.3) 462 0 R (part.4) 2458 0 R (part.5) 2622 0 R (part.6) 2714 0 R (passdb) 3056 0 R (pdc-example) 4219 0 R (pdftoepsonusb) 5662 0 R (pdftosocket) 5653 0 R (post-and-ghost) 5506 0 R (printing) 3092 0 R (problems) 3165 0 R (samba-bdc) 3022 0 R (samba-pdc) 3021 0 R (samba-trusted-domain) 5116 0 R (section*.4) 6232 0 R (section*.5) 6238 0 R (section*.6) 6250 0 R (section*.7) 6253 0 R (section*.8) 6264 0 R (section.1.1) 14 0 R (section.1.2) 18 0 R (section.1.3) 22 0 R (section.1.4) 26 0 R (section.1.5) 30 0 R (section.1.6) 34 0 R (section.10.1) 470 0 R (section.10.2) 474 0 R (section.10.3) 478 0 R (section.10.4) 494 0 R (section.10.5) 530 0 R (section.10.6) 546 0 R (section.10.7) 558 0 R (section.10.8) 578 0 R (section.11.1) 598 0 R (section.11.2) 610 0 R (section.11.3) 634 0 R (section.11.4) 646 0 R (section.11.5) 730 0 R (section.12.1) 750 0 R (section.12.2) 754 0 R (section.12.3) 762 0 R (section.12.4) 774 0 R (section.13.1) 794 0 R (section.13.2) 798 0 R (section.13.3) 814 0 R (section.13.4) 830 0 R (section.13.5) 846 0 R (section.13.6) 886 0 R (section.14.1) 906 0 R (section.14.2) 910 0 R (section.14.3) 954 0 R (section.14.4) 970 0 R (section.14.5) 982 0 R (section.14.6) 986 0 R (section.14.7) 1002 0 R (section.15.1) 1010 0 R (section.15.2) 1014 0 R (section.15.3) 1018 0 R (section.15.4) 1046 0 R (section.15.5) 1050 0 R (section.16.1) 1066 0 R (section.16.2) 1070 0 R (section.16.3) 1074 0 R (section.16.4) 1090 0 R (section.16.5) 1102 0 R (section.16.6) 1106 0 R (section.17.1) 1114 0 R (section.17.2) 1118 0 R (section.18.1) 1126 0 R (section.18.10) 1314 0 R (section.18.11) 1334 0 R (section.18.12) 1338 0 R (section.18.13) 1342 0 R (section.18.14) 1346 0 R (section.18.15) 1350 0 R (section.18.2) 1130 0 R (section.18.3) 1146 0 R (section.18.4) 1158 0 R (section.18.5) 1162 0 R (section.18.6) 1190 0 R (section.18.7) 1214 0 R (section.18.8) 1262 0 R (section.18.9) 1282 0 R (section.19.1) 1366 0 R (section.19.10) 1594 0 R (section.19.11) 1662 0 R (section.19.12) 1690 0 R (section.19.13) 1710 0 R (section.19.14) 1754 0 R (section.19.15) 1786 0 R (section.19.16) 1790 0 R (section.19.17) 1806 0 R (section.19.18) 1810 0 R (section.19.19) 1814 0 R (section.19.2) 1378 0 R (section.19.20) 1818 0 R (section.19.21) 1898 0 R (section.19.3) 1394 0 R (section.19.4) 1418 0 R (section.19.5) 1454 0 R (section.19.6) 1534 0 R (section.19.7) 1550 0 R (section.19.8) 1562 0 R (section.19.9) 1574 0 R (section.2.1) 42 0 R (section.2.2) 46 0 R (section.2.3) 62 0 R (section.2.4) 66 0 R (section.2.5) 70 0 R (section.2.6) 74 0 R (section.2.7) 78 0 R (section.20.1) 1906 0 R (section.20.2) 1910 0 R (section.20.3) 1914 0 R (section.20.4) 1938 0 R (section.21.1) 1954 0 R (section.21.2) 1958 0 R (section.21.3) 1962 0 R (section.21.4) 1970 0 R (section.21.5) 1998 0 R (section.21.6) 2042 0 R (section.21.7) 2046 0 R (section.22.1) 2058 0 R (section.22.2) 2062 0 R (section.22.3) 2066 0 R (section.22.4) 2074 0 R (section.22.5) 2082 0 R (section.23.1) 2090 0 R (section.23.2) 2094 0 R (section.23.3) 2118 0 R (section.23.4) 2134 0 R (section.23.5) 2138 0 R (section.24.1) 2150 0 R (section.24.2) 2154 0 R (section.24.3) 2218 0 R (section.24.4) 2222 0 R (section.24.5) 2226 0 R (section.24.6) 2246 0 R (section.25.1) 2266 0 R (section.25.2) 2270 0 R (section.25.3) 2322 0 R (section.26.1) 2338 0 R (section.26.2) 2342 0 R (section.26.3) 2346 0 R (section.26.4) 2366 0 R (section.26.5) 2390 0 R (section.27.1) 2410 0 R (section.27.2) 2414 0 R (section.27.3) 2418 0 R (section.27.4) 2422 0 R (section.27.5) 2426 0 R (section.27.6) 2430 0 R (section.28.1) 2442 0 R (section.28.2) 2446 0 R (section.29.1) 2454 0 R (section.3.1) 98 0 R (section.30.1) 2466 0 R (section.30.2) 2470 0 R (section.30.3) 2486 0 R (section.31.1) 2530 0 R (section.31.2) 2562 0 R (section.32.1) 2578 0 R (section.33.1) 2630 0 R (section.33.2) 2634 0 R (section.33.3) 2638 0 R (section.34.1) 2646 0 R (section.34.2) 2674 0 R (section.34.3) 2678 0 R (section.34.4) 2682 0 R (section.35.1) 2690 0 R (section.35.2) 2694 0 R (section.35.3) 2698 0 R (section.35.4) 2702 0 R (section.35.5) 2706 0 R (section.35.6) 2710 0 R (section.36.1) 2722 0 R (section.36.2) 2742 0 R (section.36.3) 2746 0 R (section.36.4) 2750 0 R (section.36.5) 2766 0 R (section.37.1) 2782 0 R (section.37.2) 2786 0 R (section.37.3) 2790 0 R (section.37.4) 2794 0 R (section.37.5) 2798 0 R (section.37.6) 2806 0 R (section.38.1) 2822 0 R (section.38.2) 2826 0 R (section.38.3) 2842 0 R (section.38.4) 2870 0 R (section.38.5) 2878 0 R (section.38.6) 2882 0 R (section.39.1) 2890 0 R (section.39.10) 2926 0 R (section.39.11) 2930 0 R (section.39.2) 2894 0 R (section.39.3) 2898 0 R (section.39.4) 2902 0 R (section.39.5) 2906 0 R (section.39.6) 2910 0 R (section.39.7) 2914 0 R (section.39.8) 2918 0 R (section.39.9) 2922 0 R (section.4.1) 110 0 R (section.4.2) 114 0 R (section.4.3) 118 0 R (section.4.4) 162 0 R (section.4.5) 166 0 R (section.40.1) 2938 0 R (section.41.1) 2946 0 R (section.41.2) 2950 0 R (section.5.1) 190 0 R (section.5.2) 194 0 R (section.5.3) 206 0 R (section.5.4) 210 0 R (section.5.5) 214 0 R (section.5.6) 238 0 R (section.6.1) 274 0 R (section.6.2) 278 0 R (section.6.3) 302 0 R (section.6.4) 310 0 R (section.7.1) 334 0 R (section.7.2) 338 0 R (section.7.3) 370 0 R (section.7.4) 382 0 R (section.7.5) 414 0 R (section.8.1) 430 0 R (section.8.2) 434 0 R (section.8.3) 438 0 R (section.8.4) 450 0 R (section.9.1) 458 0 R (securing-samba) 3089 0 R (small1) 5496 0 R (small10) 5641 0 R (small11) 5687 0 R (small12) 5696 0 R (small13) 5708 0 R (small14) 5809 0 R (small2) 5512 0 R (small3) 5516 0 R (small4) 5560 0 R (small5) 5564 0 R (small6) 5576 0 R (small7) 5586 0 R (small8) 5598 0 R (small9) 5606 0 R (speed) 3170 0 R (subfigure.10.1.1) 4600 0 R (subfigure.11.1.1) 4653 0 R (subfigure.12.1.1) 4799 0 R (subfigure.13.1.1) 4866 0 R (subfigure.16.1.1) 5109 0 R (subfigure.19.1.1) 5497 0 R (subfigure.19.10.1) 5642 0 R (subfigure.19.11.1) 5654 0 R (subfigure.19.12.1) 5663 0 R (subfigure.19.13.1) 5688 0 R (subfigure.19.14.1) 5697 0 R (subfigure.19.15.1) 5709 0 R (subfigure.19.16.1) 5810 0 R (subfigure.19.17.1) 6051 0 R (subfigure.19.18.1) 6116 0 R (subfigure.19.19.1) 6123 0 R (subfigure.19.2.1) 5513 0 R (subfigure.19.3.1) 5517 0 R (subfigure.19.4.1) 5561 0 R (subfigure.19.5.1) 5565 0 R (subfigure.19.6.1) 5577 0 R (subfigure.19.7.1) 5587 0 R (subfigure.19.8.1) 5599 0 R (subfigure.19.9.1) 5607 0 R (subfigure.5.1.1) 4285 0 R (subsection.10.3.1) 482 0 R (subsection.10.3.2) 486 0 R (subsection.10.3.3) 490 0 R (subsection.10.4.1) 498 0 R (subsection.10.4.2) 502 0 R (subsection.10.4.3) 506 0 R (subsection.10.4.4) 510 0 R (subsection.10.4.5) 514 0 R (subsection.10.4.6) 518 0 R (subsection.10.4.7) 522 0 R (subsection.10.4.8) 526 0 R (subsection.10.5.1) 534 0 R (subsection.10.5.2) 538 0 R (subsection.10.5.3) 542 0 R (subsection.10.6.1) 550 0 R (subsection.10.6.2) 554 0 R (subsection.10.7.1) 562 0 R (subsection.10.7.2) 566 0 R (subsection.10.7.3) 570 0 R (subsection.10.8.1) 582 0 R (subsection.10.8.2) 586 0 R (subsection.10.8.3) 590 0 R (subsection.11.1.1) 602 0 R (subsection.11.1.2) 606 0 R (subsection.11.2.1) 614 0 R (subsection.11.2.2) 626 0 R (subsection.11.2.3) 630 0 R (subsection.11.3.1) 638 0 R (subsection.11.3.2) 642 0 R (subsection.11.4.1) 650 0 R (subsection.11.4.2) 654 0 R (subsection.11.4.3) 658 0 R (subsection.11.4.4) 662 0 R (subsection.11.4.5) 706 0 R (subsection.11.4.6) 726 0 R (subsection.11.5.1) 734 0 R (subsection.11.5.2) 738 0 R (subsection.11.5.3) 742 0 R (subsection.12.2.1) 758 0 R (subsection.12.3.1) 766 0 R (subsection.12.3.2) 770 0 R (subsection.12.4.1) 778 0 R (subsection.12.4.2) 782 0 R (subsection.12.4.3) 786 0 R (subsection.13.2.1) 802 0 R (subsection.13.2.2) 806 0 R (subsection.13.2.3) 810 0 R (subsection.13.3.1) 818 0 R (subsection.13.3.2) 822 0 R (subsection.13.3.3) 826 0 R (subsection.13.4.1) 834 0 R (subsection.13.5.1) 850 0 R (subsection.13.5.2) 854 0 R (subsection.13.5.3) 858 0 R (subsection.13.5.4) 862 0 R (subsection.13.5.5) 874 0 R (subsection.13.5.6) 878 0 R (subsection.13.5.7) 882 0 R (subsection.13.6.1) 890 0 R (subsection.13.6.2) 894 0 R (subsection.13.6.3) 898 0 R (subsection.14.2.1) 914 0 R (subsection.14.3.1) 958 0 R (subsection.14.4.1) 974 0 R (subsection.14.4.2) 978 0 R (subsection.14.6.1) 990 0 R (subsection.14.6.2) 994 0 R (subsection.14.6.3) 998 0 R (subsection.15.3.1) 1022 0 R (subsection.15.3.2) 1026 0 R (subsection.15.3.3) 1030 0 R (subsection.15.3.4) 1034 0 R (subsection.15.3.5) 1038 0 R (subsection.15.3.6) 1042 0 R (subsection.15.5.1) 1054 0 R (subsection.15.5.2) 1058 0 R (subsection.16.3.1) 1078 0 R (subsection.16.3.2) 1082 0 R (subsection.16.3.3) 1086 0 R (subsection.16.4.1) 1094 0 R (subsection.16.4.2) 1098 0 R (subsection.18.10.1) 1318 0 R (subsection.18.10.2) 1322 0 R (subsection.18.10.3) 1326 0 R (subsection.18.10.4) 1330 0 R (subsection.18.15.1) 1354 0 R (subsection.18.15.2) 1358 0 R (subsection.18.2.1) 1134 0 R (subsection.18.2.2) 1138 0 R (subsection.18.2.3) 1142 0 R (subsection.18.3.1) 1150 0 R (subsection.18.3.2) 1154 0 R (subsection.18.5.1) 1166 0 R (subsection.18.5.2) 1170 0 R (subsection.18.5.3) 1174 0 R (subsection.18.5.4) 1178 0 R (subsection.18.5.5) 1182 0 R (subsection.18.5.6) 1186 0 R (subsection.18.6.1) 1194 0 R (subsection.18.6.2) 1198 0 R (subsection.18.6.3) 1202 0 R (subsection.18.6.4) 1206 0 R (subsection.18.6.5) 1210 0 R (subsection.18.7.1) 1218 0 R (subsection.18.7.2) 1222 0 R (subsection.18.8.1) 1266 0 R (subsection.18.8.2) 1270 0 R (subsection.18.8.3) 1274 0 R (subsection.18.8.4) 1278 0 R (subsection.18.9.1) 1286 0 R (subsection.18.9.2) 1290 0 R (subsection.18.9.3) 1294 0 R (subsection.18.9.4) 1298 0 R (subsection.18.9.5) 1302 0 R (subsection.18.9.6) 1306 0 R (subsection.18.9.7) 1310 0 R (subsection.19.1.1) 1370 0 R (subsection.19.1.2) 1374 0 R (subsection.19.10.1) 1598 0 R (subsection.19.10.10) 1634 0 R (subsection.19.10.11) 1638 0 R (subsection.19.10.12) 1642 0 R (subsection.19.10.13) 1646 0 R (subsection.19.10.14) 1650 0 R (subsection.19.10.15) 1654 0 R (subsection.19.10.16) 1658 0 R (subsection.19.10.2) 1602 0 R (subsection.19.10.3) 1606 0 R (subsection.19.10.4) 1610 0 R (subsection.19.10.5) 1614 0 R (subsection.19.10.6) 1618 0 R (subsection.19.10.7) 1622 0 R (subsection.19.10.8) 1626 0 R (subsection.19.10.9) 1630 0 R (subsection.19.11.1) 1666 0 R (subsection.19.11.2) 1670 0 R (subsection.19.11.3) 1674 0 R (subsection.19.11.4) 1678 0 R (subsection.19.11.5) 1682 0 R (subsection.19.11.6) 1686 0 R (subsection.19.12.1) 1694 0 R (subsection.19.12.2) 1698 0 R (subsection.19.12.3) 1702 0 R (subsection.19.12.4) 1706 0 R (subsection.19.13.1) 1714 0 R (subsection.19.13.2) 1750 0 R (subsection.19.14.1) 1758 0 R (subsection.19.14.2) 1762 0 R (subsection.19.14.3) 1766 0 R (subsection.19.14.4) 1770 0 R (subsection.19.14.5) 1774 0 R (subsection.19.14.6) 1778 0 R (subsection.19.14.7) 1782 0 R (subsection.19.16.1) 1794 0 R (subsection.19.16.2) 1798 0 R (subsection.19.16.3) 1802 0 R (subsection.19.2.1) 1382 0 R (subsection.19.2.2) 1386 0 R (subsection.19.2.3) 1390 0 R (subsection.19.20.1) 1822 0 R (subsection.19.20.10) 1858 0 R (subsection.19.20.11) 1862 0 R (subsection.19.20.12) 1866 0 R (subsection.19.20.13) 1870 0 R (subsection.19.20.14) 1874 0 R (subsection.19.20.15) 1878 0 R (subsection.19.20.16) 1882 0 R (subsection.19.20.17) 1886 0 R (subsection.19.20.18) 1890 0 R (subsection.19.20.19) 1894 0 R (subsection.19.20.2) 1826 0 R (subsection.19.20.3) 1830 0 R (subsection.19.20.4) 1834 0 R (subsection.19.20.5) 1838 0 R (subsection.19.20.6) 1842 0 R (subsection.19.20.7) 1846 0 R (subsection.19.20.8) 1850 0 R (subsection.19.20.9) 1854 0 R (subsection.19.3.1) 1398 0 R (subsection.19.3.2) 1402 0 R (subsection.19.3.3) 1406 0 R (subsection.19.3.4) 1410 0 R (subsection.19.3.5) 1414 0 R (subsection.19.4.1) 1422 0 R (subsection.19.4.2) 1426 0 R (subsection.19.4.3) 1430 0 R (subsection.19.4.4) 1434 0 R (subsection.19.4.5) 1438 0 R (subsection.19.4.6) 1442 0 R (subsection.19.4.7) 1446 0 R (subsection.19.4.8) 1450 0 R (subsection.19.5.1) 1458 0 R (subsection.19.5.10) 1494 0 R (subsection.19.5.11) 1498 0 R (subsection.19.5.12) 1502 0 R (subsection.19.5.13) 1506 0 R (subsection.19.5.14) 1510 0 R (subsection.19.5.15) 1514 0 R (subsection.19.5.16) 1518 0 R (subsection.19.5.17) 1522 0 R (subsection.19.5.18) 1526 0 R (subsection.19.5.19) 1530 0 R (subsection.19.5.2) 1462 0 R (subsection.19.5.3) 1466 0 R (subsection.19.5.4) 1470 0 R (subsection.19.5.5) 1474 0 R (subsection.19.5.6) 1478 0 R (subsection.19.5.7) 1482 0 R (subsection.19.5.8) 1486 0 R (subsection.19.5.9) 1490 0 R (subsection.19.6.1) 1538 0 R (subsection.19.6.2) 1542 0 R (subsection.19.6.3) 1546 0 R (subsection.19.7.1) 1554 0 R (subsection.19.7.2) 1558 0 R (subsection.19.8.1) 1566 0 R (subsection.19.8.2) 1570 0 R (subsection.19.9.1) 1578 0 R (subsection.19.9.2) 1582 0 R (subsection.19.9.3) 1586 0 R (subsection.19.9.4) 1590 0 R (subsection.2.2.1) 50 0 R (subsection.2.2.2) 58 0 R (subsection.2.7.1) 82 0 R (subsection.2.7.2) 86 0 R (subsection.2.7.3) 90 0 R (subsection.20.3.1) 1918 0 R (subsection.20.3.2) 1922 0 R (subsection.20.3.3) 1926 0 R (subsection.20.3.4) 1930 0 R (subsection.20.3.5) 1934 0 R (subsection.20.4.1) 1942 0 R (subsection.20.4.2) 1946 0 R (subsection.21.3.1) 1966 0 R (subsection.21.4.1) 1974 0 R (subsection.21.4.2) 1978 0 R (subsection.21.4.3) 1982 0 R (subsection.21.4.4) 1986 0 R (subsection.21.4.5) 1990 0 R (subsection.21.4.6) 1994 0 R (subsection.21.5.1) 2002 0 R (subsection.21.5.2) 2006 0 R (subsection.21.5.3) 2010 0 R (subsection.21.7.1) 2050 0 R (subsection.22.3.1) 2070 0 R (subsection.22.4.1) 2078 0 R (subsection.23.2.1) 2098 0 R (subsection.23.2.2) 2102 0 R (subsection.23.2.3) 2110 0 R (subsection.23.3.1) 2122 0 R (subsection.23.3.2) 2126 0 R (subsection.23.3.3) 2130 0 R (subsection.23.5.1) 2142 0 R (subsection.24.2.1) 2158 0 R (subsection.24.2.2) 2178 0 R (subsection.24.2.3) 2194 0 R (subsection.24.2.4) 2198 0 R (subsection.24.5.1) 2230 0 R (subsection.24.5.2) 2238 0 R (subsection.24.5.3) 2242 0 R (subsection.24.6.1) 2250 0 R (subsection.24.6.2) 2254 0 R (subsection.24.6.3) 2258 0 R (subsection.25.2.1) 2274 0 R (subsection.25.2.2) 2282 0 R (subsection.25.2.3) 2294 0 R (subsection.25.2.4) 2298 0 R (subsection.25.2.5) 2302 0 R (subsection.25.3.1) 2326 0 R (subsection.25.3.2) 2330 0 R (subsection.26.3.1) 2350 0 R (subsection.26.3.2) 2354 0 R (subsection.26.3.3) 2358 0 R (subsection.26.3.4) 2362 0 R (subsection.26.4.1) 2370 0 R (subsection.26.4.2) 2374 0 R (subsection.26.4.3) 2378 0 R (subsection.26.4.4) 2382 0 R (subsection.26.4.5) 2386 0 R (subsection.26.5.1) 2394 0 R (subsection.26.5.2) 2398 0 R (subsection.26.5.3) 2402 0 R (subsection.27.6.1) 2434 0 R (subsection.30.2.1) 2474 0 R (subsection.30.2.2) 2478 0 R (subsection.30.2.3) 2482 0 R (subsection.30.3.1) 2490 0 R (subsection.30.3.2) 2494 0 R (subsection.30.3.3) 2498 0 R (subsection.30.3.4) 2502 0 R (subsection.30.3.5) 2506 0 R (subsection.30.3.6) 2510 0 R (subsection.31.1.1) 2534 0 R (subsection.31.1.2) 2558 0 R (subsection.31.2.1) 2566 0 R (subsection.31.2.2) 2570 0 R (subsection.32.1.1) 2582 0 R (subsection.32.1.10) 2618 0 R (subsection.32.1.2) 2586 0 R (subsection.32.1.3) 2590 0 R (subsection.32.1.4) 2594 0 R (subsection.32.1.5) 2598 0 R (subsection.32.1.6) 2602 0 R (subsection.32.1.7) 2606 0 R (subsection.32.1.8) 2610 0 R (subsection.32.1.9) 2614 0 R (subsection.34.1.1) 2650 0 R (subsection.34.1.2) 2654 0 R (subsection.34.1.3) 2658 0 R (subsection.34.1.4) 2662 0 R (subsection.36.1.1) 2726 0 R (subsection.36.1.2) 2730 0 R (subsection.36.4.1) 2754 0 R (subsection.36.5.1) 2770 0 R (subsection.36.5.2) 2774 0 R (subsection.37.5.1) 2802 0 R (subsection.37.6.1) 2810 0 R (subsection.37.6.2) 2814 0 R (subsection.38.2.1) 2830 0 R (subsection.38.2.2) 2834 0 R (subsection.38.2.3) 2838 0 R (subsection.38.3.1) 2846 0 R (subsection.38.3.2) 2850 0 R (subsection.38.3.3) 2854 0 R (subsection.38.3.4) 2858 0 R (subsection.38.3.5) 2862 0 R (subsection.38.3.6) 2866 0 R (subsection.38.4.1) 2874 0 R (subsection.4.3.1) 122 0 R (subsection.4.3.2) 130 0 R (subsection.4.3.3) 138 0 R (subsection.4.3.4) 146 0 R (subsection.4.3.5) 154 0 R (subsection.4.5.1) 170 0 R (subsection.4.5.2) 174 0 R (subsection.4.5.3) 178 0 R (subsection.4.5.4) 182 0 R (subsection.5.2.1) 198 0 R (subsection.5.2.2) 202 0 R (subsection.5.5.1) 218 0 R (subsection.5.5.2) 234 0 R (subsection.5.6.1) 242 0 R (subsection.5.6.2) 246 0 R (subsection.5.6.3) 250 0 R (subsection.5.6.4) 254 0 R (subsection.5.6.5) 258 0 R (subsection.5.6.6) 262 0 R (subsection.5.6.7) 266 0 R (subsection.6.2.1) 282 0 R (subsection.6.2.2) 290 0 R (subsection.6.2.3) 294 0 R (subsection.6.2.4) 298 0 R (subsection.6.3.1) 306 0 R (subsection.6.4.1) 314 0 R (subsection.6.4.2) 318 0 R (subsection.6.4.3) 322 0 R (subsection.6.4.4) 326 0 R (subsection.7.2.1) 342 0 R (subsection.7.2.2) 346 0 R (subsection.7.2.3) 350 0 R (subsection.7.2.4) 354 0 R (subsection.7.3.1) 374 0 R (subsection.7.3.2) 378 0 R (subsection.7.4.1) 386 0 R (subsection.7.4.2) 390 0 R (subsection.7.4.3) 394 0 R (subsection.7.4.4) 402 0 R (subsection.7.4.5) 406 0 R (subsection.7.4.6) 410 0 R (subsection.7.5.1) 418 0 R (subsection.7.5.2) 422 0 R (subsection.8.3.1) 442 0 R (subsection.8.3.2) 446 0 R (subsubsection.10.7.3.1) 574 0 R (subsubsection.11.2.1.1) 618 0 R (subsubsection.11.2.1.2) 622 0 R (subsubsection.11.4.4.1) 666 0 R (subsubsection.11.4.4.10) 702 0 R (subsubsection.11.4.4.2) 670 0 R (subsubsection.11.4.4.3) 674 0 R (subsubsection.11.4.4.4) 678 0 R (subsubsection.11.4.4.5) 682 0 R (subsubsection.11.4.4.6) 686 0 R (subsubsection.11.4.4.7) 690 0 R (subsubsection.11.4.4.8) 694 0 R (subsubsection.11.4.4.9) 698 0 R (subsubsection.11.4.5.1) 710 0 R (subsubsection.11.4.5.2) 714 0 R (subsubsection.11.4.5.3) 718 0 R (subsubsection.11.4.5.4) 722 0 R (subsubsection.13.4.1.1) 838 0 R (subsubsection.13.4.1.2) 842 0 R (subsubsection.13.5.4.1) 866 0 R (subsubsection.13.5.4.2) 870 0 R (subsubsection.14.2.1.1) 918 0 R (subsubsection.14.2.1.2) 922 0 R (subsubsection.14.2.1.3) 926 0 R (subsubsection.14.2.1.4) 930 0 R (subsubsection.14.2.1.5) 934 0 R (subsubsection.14.2.1.6) 938 0 R (subsubsection.14.2.1.7) 942 0 R (subsubsection.14.2.1.8) 946 0 R (subsubsection.14.2.1.9) 950 0 R (subsubsection.14.3.1.1) 962 0 R (subsubsection.14.3.1.2) 966 0 R (subsubsection.18.7.2.1) 1226 0 R (subsubsection.18.7.2.2) 1230 0 R (subsubsection.18.7.2.3) 1234 0 R (subsubsection.18.7.2.4) 1238 0 R (subsubsection.18.7.2.5) 1242 0 R (subsubsection.18.7.2.6) 1246 0 R (subsubsection.18.7.2.7) 1250 0 R (subsubsection.18.7.2.8) 1254 0 R (subsubsection.18.7.2.9) 1258 0 R (subsubsection.19.13.1.1) 1718 0 R (subsubsection.19.13.1.2) 1722 0 R (subsubsection.19.13.1.3) 1726 0 R (subsubsection.19.13.1.4) 1730 0 R (subsubsection.19.13.1.5) 1734 0 R (subsubsection.19.13.1.6) 1738 0 R (subsubsection.19.13.1.7) 1742 0 R (subsubsection.19.13.1.8) 1746 0 R (subsubsection.2.2.1.1) 54 0 R (subsubsection.21.5.3.1) 2014 0 R (subsubsection.21.5.3.2) 2018 0 R (subsubsection.21.5.3.3) 2022 0 R (subsubsection.21.5.3.4) 2026 0 R (subsubsection.21.5.3.5) 2030 0 R (subsubsection.21.5.3.6) 2034 0 R (subsubsection.21.5.3.7) 2038 0 R (subsubsection.23.2.2.1) 2106 0 R (subsubsection.23.2.3.1) 2114 0 R (subsubsection.24.2.1.1) 2162 0 R (subsubsection.24.2.1.2) 2166 0 R (subsubsection.24.2.1.3) 2170 0 R (subsubsection.24.2.1.4) 2174 0 R (subsubsection.24.2.2.1) 2182 0 R (subsubsection.24.2.2.2) 2186 0 R (subsubsection.24.2.2.3) 2190 0 R (subsubsection.24.2.4.1) 2202 0 R (subsubsection.24.2.4.2) 2206 0 R (subsubsection.24.2.4.3) 2210 0 R (subsubsection.24.2.4.4) 2214 0 R (subsubsection.24.5.1.1) 2234 0 R (subsubsection.25.2.1.1) 2278 0 R (subsubsection.25.2.2.1) 2286 0 R (subsubsection.25.2.2.2) 2290 0 R (subsubsection.25.2.5.1) 2306 0 R (subsubsection.25.2.5.2) 2310 0 R (subsubsection.25.2.5.3) 2314 0 R (subsubsection.25.2.5.4) 2318 0 R (subsubsection.30.3.6.1) 2514 0 R (subsubsection.30.3.6.2) 2518 0 R (subsubsection.30.3.6.3) 2522 0 R (subsubsection.31.1.1.1) 2538 0 R (subsubsection.31.1.1.2) 2542 0 R (subsubsection.31.1.1.3) 2546 0 R (subsubsection.31.1.1.4) 2550 0 R (subsubsection.31.1.1.5) 2554 0 R (subsubsection.34.1.4.1) 2666 0 R (subsubsection.34.1.4.2) 2670 0 R (subsubsection.36.1.2.1) 2734 0 R (subsubsection.36.1.2.2) 2738 0 R (subsubsection.36.4.1.1) 2758 0 R (subsubsection.36.4.1.2) 2762 0 R (subsubsection.4.3.1.1) 126 0 R (subsubsection.4.3.2.1) 134 0 R (subsubsection.4.3.3.1) 142 0 R (subsubsection.4.3.4.1) 150 0 R (subsubsection.4.3.5.1) 158 0 R (subsubsection.5.5.1.1) 222 0 R (subsubsection.5.5.1.2) 226 0 R (subsubsection.5.5.1.3) 230 0 R (subsubsection.6.2.1.1) 286 0 R (subsubsection.7.2.4.1) 358 0 R (subsubsection.7.2.4.2) 362 0 R (subsubsection.7.2.4.3) 366 0 R (subsubsection.7.4.3.1) 398 0 R (table.10.1) 4603 0 R (table.10.2) 4609 0 R (table.10.3) 4611 0 R (table.10.4) 4613 0 R (table.11.1) 4750 0 R (table.11.2) 4765 0 R (table.11.3) 4771 0 R (table.13.1) 4857 0 R (table.13.2) 4877 0 R (table.13.3) 4885 0 R (table.13.4) 4887 0 R (table.19.1) 5633 0 R (table.20.1) 6145 0 R (table.24.1) 6502 0 R (table.24.2) 6504 0 R (table.24.3) 6516 0 R (table.25.1) 6588 0 R (table.26.1) 6645 0 R (table.26.2) 6647 0 R (table.30.1) 6767 0 R (table.31.1) 6835 0 R (table.31.2) 6843 0 R (table.7.1) 4388 0 R (troubleshooting) 6895 0 R (trusts1) 5108 0 R (type) 4078 0 R (unicode) 3128 0 R (upgrading-to-3.0) 3131 0 R (winbind) 4123 0 R (winbind-solaris9) 6241 0 R] /Limits [(AccessControls) (winbind-solaris9)] >> endobj -6737 0 obj << -/Kids [6736 0 R] +7252 0 obj << +/Kids [7251 0 R] >> endobj -6738 0 obj << -/Dests 6737 0 R +7253 0 obj << +/Dests 7252 0 R >> endobj -6739 0 obj << +7254 0 obj << /Type /Catalog -/Pages 6734 0 R -/Outlines 6735 0 R -/Names 6738 0 R +/Pages 7249 0 R +/Outlines 7250 0 R +/Names 7253 0 R /PageMode /UseOutlines /URI<> /ViewerPreferences<<>> -/OpenAction 2857 0 R +/OpenAction 2953 0 R /PTEX.Fullbanner (This is pdfTeX, Version 3.14159-1.10b) >> endobj -6740 0 obj << +7255 0 obj << /Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfTeX-1.10b)/Keywords() -/CreationDate (D:20030701232500) +/CreationDate (D:20030829000400) >> endobj xref -0 6741 +0 7256 0000000001 65535 f 0000000002 00000 f 0000000003 00000 f 0000000004 00000 f 0000000000 00000 f 0000000009 00000 n -0000294422 00000 n -0002263819 00000 n +0000304322 00000 n +0002541236 00000 n 0000000051 00000 n 0000000091 00000 n -0000298358 00000 n -0002263710 00000 n +0000307620 00000 n +0002541127 00000 n 0000000136 00000 n 0000000178 00000 n -0000298482 00000 n -0002263636 00000 n +0000307744 00000 n +0002541053 00000 n 0000000226 00000 n 0000000259 00000 n -0000298604 00000 n -0002263549 00000 n +0000311647 00000 n +0002540966 00000 n 0000000307 00000 n 0000000341 00000 n -0000303319 00000 n -0002263462 00000 n +0000315702 00000 n +0002540879 00000 n 0000000389 00000 n 0000000428 00000 n -0000308603 00000 n -0002263375 00000 n +0000315826 00000 n +0002540792 00000 n 0000000476 00000 n 0000000514 00000 n -0000308727 00000 n -0002263288 00000 n +0000319923 00000 n +0002540705 00000 n 0000000562 00000 n 0000000593 00000 n -0000310915 00000 n -0002263214 00000 n +0000320047 00000 n +0002540631 00000 n 0000000641 00000 n 0000000677 00000 n -0000314590 00000 n -0002263091 00000 n +0000323197 00000 n +0002540508 00000 n 0000000723 00000 n 0000000773 00000 n -0000314714 00000 n -0002263017 00000 n +0000323321 00000 n +0002540434 00000 n 0000000821 00000 n 0000000874 00000 n -0000314837 00000 n -0002262893 00000 n +0000323445 00000 n +0002540310 00000 n 0000000922 00000 n 0000000975 00000 n -0000314961 00000 n -0002262782 00000 n +0000323569 00000 n +0002540199 00000 n 0000001028 00000 n 0000001074 00000 n -0000315085 00000 n -0002262721 00000 n +0000327143 00000 n +0002540138 00000 n 0000001132 00000 n 0000001194 00000 n -0000319356 00000 n -0002262647 00000 n +0000327266 00000 n +0002540064 00000 n 0000001247 00000 n 0000001276 00000 n -0000319480 00000 n -0002262560 00000 n +0000327389 00000 n +0002539977 00000 n 0000001324 00000 n 0000001394 00000 n -0000319603 00000 n -0002262473 00000 n +0000329813 00000 n +0002539890 00000 n 0000001442 00000 n 0000001500 00000 n -0000319727 00000 n -0002262386 00000 n +0000329937 00000 n +0002539803 00000 n 0000001548 00000 n -0000001644 00000 n -0000319851 00000 n -0002262299 00000 n -0000001692 00000 n -0000001741 00000 n -0000322705 00000 n -0002262188 00000 n -0000001789 00000 n -0000001825 00000 n -0000322829 00000 n -0002262114 00000 n -0000001878 00000 n -0000001948 00000 n -0000323996 00000 n -0002262040 00000 n -0000002001 00000 n -0000002160 00000 n -0000324896 00000 n -0002261930 00000 n -0000002206 00000 n -0000002255 00000 n -0000325020 00000 n -0002261869 00000 n -0000002303 00000 n -0000002330 00000 n -0000325751 00000 n -0002261740 00000 n -0000002373 00000 n -0000002423 00000 n -0000329370 00000 n -0002261623 00000 n -0000002470 00000 n -0000002523 00000 n -0000329495 00000 n -0002261544 00000 n -0000002572 00000 n -0000002617 00000 n -0000329620 00000 n -0002261451 00000 n -0000002666 00000 n -0000002702 00000 n -0000333853 00000 n -0002261319 00000 n -0000002751 00000 n -0000002795 00000 n -0000333977 00000 n -0002261201 00000 n -0000002849 00000 n -0000002894 00000 n -0000337565 00000 n -0002261136 00000 n -0000002953 00000 n -0000003002 00000 n -0000337690 00000 n -0002261004 00000 n -0000003056 00000 n -0000003102 00000 n -0000337815 00000 n -0002260939 00000 n -0000003161 00000 n -0000003210 00000 n -0000337940 00000 n -0002260807 00000 n -0000003264 00000 n -0000003334 00000 n -0000338065 00000 n -0002260742 00000 n -0000003393 00000 n -0000003442 00000 n -0000343638 00000 n -0002260610 00000 n -0000003496 00000 n -0000003563 00000 n -0000347436 00000 n -0002260545 00000 n -0000003622 00000 n -0000003671 00000 n -0000347561 00000 n -0002260427 00000 n -0000003725 00000 n -0000003790 00000 n -0000351297 00000 n -0002260362 00000 n -0000003849 00000 n -0000003898 00000 n -0000351422 00000 n -0002260269 00000 n -0000003947 00000 n -0000004007 00000 n -0000355368 00000 n -0002260151 00000 n -0000004056 00000 n -0000004093 00000 n -0000355493 00000 n -0002260072 00000 n -0000004147 00000 n -0000004199 00000 n -0000358128 00000 n -0002259979 00000 n -0000004253 00000 n -0000004316 00000 n -0000358252 00000 n -0002259886 00000 n -0000004370 00000 n -0000004429 00000 n -0000358377 00000 n -0002259807 00000 n -0000004483 00000 n -0000004557 00000 n -0000362152 00000 n -0002259676 00000 n -0000004604 00000 n -0000004640 00000 n -0000362277 00000 n -0002259597 00000 n -0000004689 00000 n -0000004734 00000 n -0000371231 00000 n -0002259465 00000 n -0000004783 00000 n -0000004831 00000 n -0000371356 00000 n -0002259386 00000 n -0000004885 00000 n -0000004934 00000 n -0000375833 00000 n -0002259307 00000 n -0000004988 00000 n -0000005042 00000 n -0000384401 00000 n -0002259214 00000 n -0000005091 00000 n -0000005153 00000 n -0000389029 00000 n -0002259121 00000 n -0000005202 00000 n -0000005250 00000 n -0000389152 00000 n -0002258989 00000 n -0000005299 00000 n -0000005361 00000 n -0000389277 00000 n -0002258871 00000 n -0000005415 00000 n -0000005469 00000 n -0000389402 00000 n -0002258792 00000 n -0000005528 00000 n -0000005577 00000 n -0000393046 00000 n -0002258699 00000 n -0000005636 00000 n -0000005710 00000 n -0000393171 00000 n -0002258620 00000 n -0000005769 00000 n -0000005832 00000 n -0000398292 00000 n -0002258541 00000 n -0000005886 00000 n -0000005945 00000 n -0000402204 00000 n -0002258423 00000 n -0000005994 00000 n -0000006044 00000 n -0000402328 00000 n -0002258344 00000 n -0000006098 00000 n -0000006167 00000 n -0000402453 00000 n -0002258251 00000 n -0000006221 00000 n -0000006428 00000 n -0000402578 00000 n -0002258158 00000 n -0000006482 00000 n -0000006554 00000 n -0000405160 00000 n -0002258065 00000 n -0000006608 00000 n -0000006721 00000 n -0000405285 00000 n -0002257972 00000 n -0000006775 00000 n -0000006919 00000 n -0000405410 00000 n -0002257893 00000 n -0000006973 00000 n -0000007097 00000 n -0000409591 00000 n -0002257762 00000 n -0000007144 00000 n -0000007187 00000 n -0000409716 00000 n -0002257683 00000 n -0000007236 00000 n -0000007281 00000 n -0000413782 00000 n -0002257551 00000 n -0000007330 00000 n -0000007386 00000 n -0000413907 00000 n -0002257433 00000 n -0000007440 00000 n -0000007501 00000 n -0000418168 00000 n -0002257368 00000 n -0000007560 00000 n -0000007613 00000 n -0000418293 00000 n -0002257275 00000 n -0000007667 00000 n -0000007724 00000 n -0000418418 00000 n -0002257182 00000 n -0000007778 00000 n -0000007854 00000 n -0000422406 00000 n -0002257103 00000 n -0000007908 00000 n -0000007984 00000 n -0000422531 00000 n -0002256971 00000 n -0000008033 00000 n -0000008095 00000 n -0000422656 00000 n -0002256906 00000 n -0000008149 00000 n -0000008196 00000 n -0000426529 00000 n -0002256788 00000 n -0000008245 00000 n -0000008282 00000 n -0000426654 00000 n -0002256709 00000 n -0000008336 00000 n -0000008408 00000 n -0000426778 00000 n -0002256616 00000 n -0000008462 00000 n -0000008542 00000 n -0000426903 00000 n -0002256523 00000 n -0000008596 00000 n +0000001609 00000 n +0000330061 00000 n +0002539716 00000 n +0000001657 00000 n +0000001706 00000 n +0000330185 00000 n +0002539605 00000 n +0000001754 00000 n +0000001790 00000 n +0000332816 00000 n +0002539531 00000 n +0000001843 00000 n +0000001898 00000 n +0000332940 00000 n +0002539444 00000 n +0000001951 00000 n +0000002086 00000 n +0000333064 00000 n +0002539370 00000 n +0000002139 00000 n +0000002198 00000 n +0000333967 00000 n +0002539260 00000 n +0000002244 00000 n +0000002293 00000 n +0000334091 00000 n +0002539198 00000 n +0000002341 00000 n +0000002369 00000 n +0000334822 00000 n +0002539067 00000 n +0000002413 00000 n +0000002463 00000 n +0000338004 00000 n +0002538949 00000 n +0000002510 00000 n +0000002563 00000 n +0000338129 00000 n +0002538870 00000 n +0000002612 00000 n +0000002657 00000 n +0000341503 00000 n +0002538777 00000 n +0000002706 00000 n +0000002742 00000 n +0000341627 00000 n +0002538645 00000 n +0000002791 00000 n +0000002835 00000 n +0000345239 00000 n +0002538527 00000 n +0000002889 00000 n +0000002934 00000 n +0000345490 00000 n +0002538462 00000 n +0000002993 00000 n +0000003042 00000 n +0000345614 00000 n +0002538330 00000 n +0000003096 00000 n +0000003142 00000 n +0000348328 00000 n +0002538265 00000 n +0000003201 00000 n +0000003250 00000 n +0000348453 00000 n +0002538133 00000 n +0000003304 00000 n +0000003374 00000 n +0000348578 00000 n +0002538068 00000 n +0000003433 00000 n +0000003482 00000 n +0000353645 00000 n +0002537936 00000 n +0000003536 00000 n +0000003603 00000 n +0000353770 00000 n +0002537871 00000 n +0000003662 00000 n +0000003711 00000 n +0000357202 00000 n +0002537753 00000 n +0000003765 00000 n +0000003830 00000 n +0000360724 00000 n +0002537688 00000 n +0000003889 00000 n +0000003938 00000 n +0000360849 00000 n +0002537595 00000 n +0000003987 00000 n +0000004028 00000 n +0000364625 00000 n +0002537477 00000 n +0000004077 00000 n +0000004114 00000 n +0000367577 00000 n +0002537398 00000 n +0000004168 00000 n +0000004220 00000 n +0000367702 00000 n +0002537305 00000 n +0000004274 00000 n +0000004337 00000 n +0000367826 00000 n +0002537212 00000 n +0000004391 00000 n +0000004450 00000 n +0000367951 00000 n +0002537133 00000 n +0000004504 00000 n +0000004578 00000 n +0000371005 00000 n +0002537001 00000 n +0000004625 00000 n +0000004661 00000 n +0000375124 00000 n +0002536922 00000 n +0000004710 00000 n +0000004755 00000 n +0000379691 00000 n +0002536790 00000 n +0000004804 00000 n +0000004852 00000 n +0000379816 00000 n +0002536711 00000 n +0000004906 00000 n +0000004955 00000 n +0000388002 00000 n +0002536632 00000 n +0000005009 00000 n +0000005063 00000 n +0000396679 00000 n +0002536539 00000 n +0000005112 00000 n +0000005174 00000 n +0000402641 00000 n +0002536446 00000 n +0000005223 00000 n +0000005271 00000 n +0000402766 00000 n +0002536314 00000 n +0000005320 00000 n +0000005382 00000 n +0000402891 00000 n +0002536196 00000 n +0000005436 00000 n +0000005490 00000 n +0000406131 00000 n +0002536117 00000 n +0000005549 00000 n +0000005598 00000 n +0000406256 00000 n +0002536024 00000 n +0000005657 00000 n +0000005731 00000 n +0000406381 00000 n +0002535945 00000 n +0000005790 00000 n +0000005853 00000 n +0000414489 00000 n +0002535866 00000 n +0000005907 00000 n +0000005966 00000 n +0000417645 00000 n +0002535748 00000 n +0000006015 00000 n +0000006052 00000 n +0000417770 00000 n +0002535669 00000 n +0000006106 00000 n +0000006173 00000 n +0000417895 00000 n +0002535576 00000 n +0000006227 00000 n +0000006309 00000 n +0000418020 00000 n +0002535483 00000 n +0000006363 00000 n +0000006435 00000 n +0000420996 00000 n +0002535390 00000 n +0000006489 00000 n +0000006555 00000 n +0000421121 00000 n +0002535297 00000 n +0000006609 00000 n +0000006651 00000 n +0000421245 00000 n +0002535204 00000 n +0000006705 00000 n +0000006760 00000 n +0000423266 00000 n +0002535125 00000 n +0000006814 00000 n +0000006903 00000 n +0000454152 00000 n +0002534993 00000 n +0000006950 00000 n +0000006993 00000 n +0000454277 00000 n +0002534914 00000 n +0000007042 00000 n +0000007087 00000 n +0000457515 00000 n +0002534782 00000 n +0000007136 00000 n +0000007192 00000 n +0000457640 00000 n +0002534664 00000 n +0000007246 00000 n +0000007307 00000 n +0000465175 00000 n +0002534599 00000 n +0000007366 00000 n +0000007419 00000 n +0000465427 00000 n +0002534506 00000 n +0000007473 00000 n +0000007530 00000 n +0000465552 00000 n +0002534413 00000 n +0000007584 00000 n +0000007660 00000 n +0000465677 00000 n +0002534334 00000 n +0000007714 00000 n +0000007790 00000 n +0000469153 00000 n +0002534202 00000 n +0000007839 00000 n +0000007901 00000 n +0000469278 00000 n +0002534137 00000 n +0000007955 00000 n +0000008002 00000 n +0000472808 00000 n +0002534019 00000 n +0000008051 00000 n +0000008088 00000 n +0000472932 00000 n +0002533940 00000 n +0000008142 00000 n +0000008214 00000 n +0000473056 00000 n +0002533847 00000 n +0000008268 00000 n +0000008348 00000 n +0000475266 00000 n +0002533754 00000 n +0000008402 00000 n +0000008466 00000 n +0000475391 00000 n +0002533675 00000 n +0000008520 00000 n +0000008574 00000 n +0000478301 00000 n +0002533543 00000 n +0000008621 00000 n 0000008660 00000 n -0000428427 00000 n -0002256444 00000 n -0000008714 00000 n -0000008768 00000 n -0000432001 00000 n -0002256313 00000 n -0000008815 00000 n -0000008854 00000 n -0000432126 00000 n -0002256234 00000 n -0000008903 00000 n -0000008948 00000 n -0000432251 00000 n -0002256102 00000 n -0000008997 00000 n -0000009073 00000 n -0000436687 00000 n -0002256023 00000 n -0000009127 00000 n -0000009194 00000 n -0000441726 00000 n -0002255930 00000 n -0000009248 00000 n -0000009336 00000 n -0000446282 00000 n -0002255837 00000 n -0000009390 00000 n -0000009463 00000 n -0000446407 00000 n -0002255719 00000 n -0000009517 00000 n -0000009601 00000 n -0000446532 00000 n -0002255640 00000 n -0000009660 00000 n -0000009716 00000 n -0000446657 00000 n -0002255547 00000 n -0000009775 00000 n -0000009814 00000 n -0000446782 00000 n -0002255468 00000 n -0000009873 00000 n -0000009906 00000 n -0000451374 00000 n -0002255336 00000 n -0000009955 00000 n -0000009999 00000 n -0000451499 00000 n -0002255257 00000 n -0000010053 00000 n -0000010118 00000 n -0000456336 00000 n -0002255178 00000 n -0000010172 00000 n -0000010240 00000 n -0000459404 00000 n -0002255046 00000 n -0000010289 00000 n -0000010340 00000 n -0000459529 00000 n -0002254967 00000 n -0000010394 00000 n -0000010439 00000 n -0000459654 00000 n -0002254874 00000 n -0000010493 00000 n -0000010544 00000 n -0000464042 00000 n -0002254742 00000 n -0000010598 00000 n -0000010651 00000 n -0000464167 00000 n -0002254677 00000 n -0000010710 00000 n -0000010753 00000 n -0000464292 00000 n -0002254584 00000 n -0000010807 00000 n -0000010855 00000 n -0000468254 00000 n -0002254491 00000 n -0000010909 00000 n -0000010957 00000 n -0000468379 00000 n -0002254412 00000 n -0000011011 00000 n -0000011042 00000 n -0000468504 00000 n -0002254294 00000 n -0000011091 00000 n -0000011128 00000 n -0000468629 00000 n -0002254215 00000 n -0000011182 00000 n -0000011242 00000 n -0000468753 00000 n -0002254136 00000 n -0000011296 00000 n -0000011352 00000 n -0000473590 00000 n -0002254005 00000 n -0000011399 00000 n -0000011440 00000 n -0000473715 00000 n -0002253926 00000 n -0000011489 00000 n -0000011534 00000 n -0000473840 00000 n -0002253833 00000 n -0000011583 00000 n -0000011617 00000 n -0000477269 00000 n -0002253701 00000 n -0000011666 00000 n -0000011711 00000 n -0000477394 00000 n -0002253622 00000 n -0000011765 00000 n -0000011821 00000 n -0000477518 00000 n -0002253543 00000 n -0000011875 00000 n -0000011922 00000 n -0000479796 00000 n -0002253464 00000 n -0000011971 00000 n -0000012008 00000 n -0000480771 00000 n -0002253347 00000 n -0000012055 00000 n -0000012115 00000 n -0000480896 00000 n -0002253282 00000 n -0000012164 00000 n -0000012192 00000 n -0000481624 00000 n -0002253147 00000 n -0000012236 00000 n -0000012282 00000 n -0000485104 00000 n -0002253029 00000 n -0000012330 00000 n -0000012394 00000 n -0000485229 00000 n -0002252950 00000 n -0000012444 00000 n -0000012490 00000 n -0000488090 00000 n -0002252857 00000 n -0000012540 00000 n -0000012582 00000 n -0000492290 00000 n -0002252725 00000 n -0000012632 00000 n -0000012667 00000 n -0000492415 00000 n -0002252646 00000 n -0000012722 00000 n -0000012768 00000 n -0000492538 00000 n -0002252553 00000 n -0000012823 00000 n -0000012874 00000 n -0000497088 00000 n -0002252474 00000 n -0000012929 00000 n -0000012980 00000 n -0000497212 00000 n -0002252342 00000 n -0000013030 00000 n -0000013077 00000 n -0000501595 00000 n -0002252263 00000 n -0000013132 00000 n -0000013188 00000 n -0000504535 00000 n -0002252170 00000 n -0000013243 00000 n -0000013296 00000 n -0000508324 00000 n -0002252077 00000 n -0000013351 00000 n -0000013408 00000 n -0000512065 00000 n -0002251984 00000 n -0000013463 00000 n -0000013520 00000 n -0000512442 00000 n -0002251891 00000 n -0000013575 00000 n -0000013632 00000 n -0000512566 00000 n -0002251798 00000 n -0000013687 00000 n -0000013733 00000 n -0000512691 00000 n -0002251705 00000 n -0000013788 00000 n -0000013851 00000 n -0000516723 00000 n -0002251626 00000 n -0000013906 00000 n -0000013972 00000 n -0000516847 00000 n -0002251494 00000 n -0000014022 00000 n -0000014093 00000 n -0000521532 00000 n -0002251415 00000 n -0000014148 00000 n -0000014199 00000 n -0000525010 00000 n -0002251322 00000 n +0000478426 00000 n +0002533464 00000 n +0000008709 00000 n +0000008754 00000 n +0000482028 00000 n +0002533332 00000 n +0000008803 00000 n +0000008879 00000 n +0000484781 00000 n +0002533253 00000 n +0000008933 00000 n +0000009000 00000 n +0000489994 00000 n +0002533160 00000 n +0000009054 00000 n +0000009142 00000 n +0000493562 00000 n +0002533067 00000 n +0000009196 00000 n +0000009269 00000 n +0000493687 00000 n +0002532949 00000 n +0000009323 00000 n +0000009407 00000 n +0000493812 00000 n +0002532870 00000 n +0000009466 00000 n +0000009522 00000 n +0000493937 00000 n +0002532777 00000 n +0000009581 00000 n +0000009620 00000 n +0000497623 00000 n +0002532698 00000 n +0000009679 00000 n +0000009712 00000 n +0000497748 00000 n +0002532566 00000 n +0000009761 00000 n +0000009805 00000 n +0000497873 00000 n +0002532487 00000 n +0000009859 00000 n +0000009924 00000 n +0000504650 00000 n +0002532408 00000 n +0000009978 00000 n +0000010046 00000 n +0000506917 00000 n +0002532276 00000 n +0000010095 00000 n +0000010146 00000 n +0000507042 00000 n +0002532197 00000 n +0000010200 00000 n +0000010245 00000 n +0000507166 00000 n +0002532104 00000 n +0000010299 00000 n +0000010350 00000 n +0000510719 00000 n +0002531972 00000 n +0000010404 00000 n +0000010457 00000 n +0000510844 00000 n +0002531907 00000 n +0000010516 00000 n +0000010559 00000 n +0000514186 00000 n +0002531814 00000 n +0000010613 00000 n +0000010661 00000 n +0000514311 00000 n +0002531721 00000 n +0000010715 00000 n +0000010763 00000 n +0000514436 00000 n +0002531642 00000 n +0000010817 00000 n +0000010848 00000 n +0000514561 00000 n +0002531524 00000 n +0000010897 00000 n +0000010934 00000 n +0000514686 00000 n +0002531445 00000 n +0000010988 00000 n +0000011048 00000 n +0000516986 00000 n +0002531366 00000 n +0000011102 00000 n +0000011158 00000 n +0000520124 00000 n +0002531234 00000 n +0000011205 00000 n +0000011246 00000 n +0000520249 00000 n +0002531155 00000 n +0000011295 00000 n +0000011340 00000 n +0000520374 00000 n +0002531062 00000 n +0000011389 00000 n +0000011423 00000 n +0000523328 00000 n +0002530930 00000 n +0000011472 00000 n +0000011517 00000 n +0000523453 00000 n +0002530851 00000 n +0000011571 00000 n +0000011627 00000 n +0000523705 00000 n +0002530772 00000 n +0000011681 00000 n +0000011728 00000 n +0000526762 00000 n +0002530693 00000 n +0000011777 00000 n +0000011814 00000 n +0000528999 00000 n +0002530575 00000 n +0000011861 00000 n +0000011921 00000 n +0000529124 00000 n +0002530510 00000 n +0000011970 00000 n +0000011998 00000 n +0000529853 00000 n +0002530374 00000 n +0000012042 00000 n +0000012088 00000 n +0000533099 00000 n +0002530256 00000 n +0000012136 00000 n +0000012200 00000 n +0000533224 00000 n +0002530177 00000 n +0000012250 00000 n +0000012296 00000 n +0000536318 00000 n +0002530084 00000 n +0000012346 00000 n +0000012388 00000 n +0000539821 00000 n +0002529952 00000 n +0000012438 00000 n +0000012473 00000 n +0000539946 00000 n +0002529873 00000 n +0000012528 00000 n +0000012574 00000 n +0000543393 00000 n +0002529780 00000 n +0000012629 00000 n +0000012680 00000 n +0000543896 00000 n +0002529701 00000 n +0000012735 00000 n +0000012786 00000 n +0000547504 00000 n +0002529569 00000 n +0000012836 00000 n +0000012883 00000 n +0000551008 00000 n +0002529490 00000 n +0000012938 00000 n +0000012994 00000 n +0000554593 00000 n +0002529397 00000 n +0000013049 00000 n +0000013102 00000 n +0000557862 00000 n +0002529304 00000 n +0000013157 00000 n +0000013214 00000 n +0000561204 00000 n +0002529211 00000 n +0000013269 00000 n +0000013326 00000 n +0000561580 00000 n +0002529118 00000 n +0000013381 00000 n +0000013438 00000 n +0000564294 00000 n +0002529025 00000 n +0000013493 00000 n +0000013539 00000 n +0000564419 00000 n +0002528932 00000 n +0000013594 00000 n +0000013657 00000 n +0000564544 00000 n +0002528853 00000 n +0000013712 00000 n +0000013778 00000 n +0000569178 00000 n +0002528721 00000 n +0000013828 00000 n +0000013899 00000 n +0000572670 00000 n +0002528642 00000 n +0000013954 00000 n +0000014005 00000 n +0000574932 00000 n +0002528549 00000 n +0000014060 00000 n +0000014103 00000 n +0000575057 00000 n +0002528470 00000 n +0000014158 00000 n +0000014204 00000 n +0000575181 00000 n +0002528338 00000 n 0000014254 00000 n -0000014297 00000 n -0000525133 00000 n -0002251243 00000 n -0000014352 00000 n -0000014398 00000 n -0000525258 00000 n -0002251111 00000 n -0000014448 00000 n -0000014486 00000 n -0000528959 00000 n -0002251032 00000 n -0000014541 00000 n -0000014596 00000 n -0000529084 00000 n -0002250953 00000 n -0000014651 00000 n -0000014699 00000 n -0000532489 00000 n -0002250821 00000 n -0000014749 00000 n -0000014804 00000 n -0000532613 00000 n -0002250742 00000 n -0000014859 00000 n -0000014911 00000 n -0000536851 00000 n -0002250649 00000 n -0000014966 00000 n -0000015011 00000 n -0000536976 00000 n -0002250531 00000 n -0000015066 00000 n -0000015116 00000 n -0000540837 00000 n -0002250466 00000 n -0000015176 00000 n -0000015242 00000 n -0000552546 00000 n -0002250348 00000 n -0000015292 00000 n -0000015330 00000 n -0000552671 00000 n -0002250269 00000 n -0000015385 00000 n -0000015484 00000 n -0000552795 00000 n -0002250190 00000 n -0000015539 00000 n -0000015640 00000 n -0000556406 00000 n -0002250058 00000 n -0000015688 00000 n -0000015740 00000 n -0000556531 00000 n -0002249979 00000 n -0000015790 00000 n -0000015836 00000 n -0000560960 00000 n -0002249847 00000 n -0000015886 00000 n -0000015932 00000 n -0000564967 00000 n -0002249729 00000 n -0000015987 00000 n -0000016044 00000 n -0000569068 00000 n -0002249650 00000 n -0000016104 00000 n -0000016166 00000 n -0000569193 00000 n -0002249571 00000 n -0000016226 00000 n -0000016292 00000 n -0000569318 00000 n -0002249492 00000 n -0000016347 00000 n -0000016426 00000 n -0000572796 00000 n -0002249360 00000 n -0000016476 00000 n -0000016525 00000 n -0000572921 00000 n -0002249281 00000 n -0000016580 00000 n -0000016628 00000 n -0000573046 00000 n -0002249202 00000 n -0000016683 00000 n -0000016729 00000 n -0000575869 00000 n -0002249070 00000 n -0000016779 00000 n -0000016821 00000 n -0000580268 00000 n -0002248991 00000 n -0000016876 00000 n -0000016913 00000 n -0000580393 00000 n -0002248898 00000 n -0000016968 00000 n -0000017034 00000 n -0000580518 00000 n -0002248805 00000 n -0000017089 00000 n -0000017122 00000 n -0000580642 00000 n -0002248672 00000 n -0000017177 00000 n -0000017211 00000 n -0000586482 00000 n -0002248593 00000 n -0000017271 00000 n -0000017322 00000 n -0000586607 00000 n -0002248500 00000 n -0000017382 00000 n -0000017463 00000 n -0000589758 00000 n -0002248407 00000 n -0000017523 00000 n -0000017574 00000 n -0000591589 00000 n -0002248314 00000 n -0000017634 00000 n -0000017691 00000 n -0000596265 00000 n -0002248221 00000 n -0000017751 00000 n -0000017797 00000 n -0000598797 00000 n -0002248128 00000 n -0000017857 00000 n -0000017916 00000 n -0000603112 00000 n -0002248035 00000 n -0000017976 00000 n -0000018033 00000 n -0000603237 00000 n -0002247942 00000 n -0000018093 00000 n -0000018166 00000 n -0000605221 00000 n -0002247849 00000 n -0000018226 00000 n -0000018297 00000 n -0000605346 00000 n -0002247770 00000 n -0000018358 00000 n -0000018412 00000 n -0000609512 00000 n -0002247638 00000 n -0000018467 00000 n -0000018499 00000 n -0000609636 00000 n -0002247559 00000 n -0000018559 00000 n -0000018609 00000 n -0000609760 00000 n -0002247466 00000 n -0000018669 00000 n -0000018709 00000 n -0000612768 00000 n -0002247373 00000 n -0000018769 00000 n -0000018845 00000 n -0000612893 00000 n -0002247294 00000 n -0000018905 00000 n -0000018972 00000 n -0000613018 00000 n -0002247215 00000 n -0000019027 00000 n -0000019057 00000 n -0000613143 00000 n -0002247097 00000 n -0000019107 00000 n -0000019145 00000 n -0000613268 00000 n -0002247018 00000 n -0000019200 00000 n -0000019271 00000 n -0000613393 00000 n -0002246925 00000 n +0000014292 00000 n +0000578461 00000 n +0002528259 00000 n +0000014347 00000 n +0000014402 00000 n +0000578586 00000 n +0002528180 00000 n +0000014457 00000 n +0000014505 00000 n +0000581973 00000 n +0002528048 00000 n +0000014555 00000 n +0000014610 00000 n +0000582098 00000 n +0002527969 00000 n +0000014665 00000 n +0000014717 00000 n +0000585624 00000 n +0002527876 00000 n +0000014772 00000 n +0000014817 00000 n +0000590115 00000 n +0002527758 00000 n +0000014872 00000 n +0000014922 00000 n +0000590240 00000 n +0002527693 00000 n +0000014982 00000 n +0000015048 00000 n +0000618911 00000 n +0002527575 00000 n +0000015098 00000 n +0000015136 00000 n +0000619036 00000 n +0002527496 00000 n +0000015191 00000 n +0000015290 00000 n +0000619160 00000 n +0002527403 00000 n +0000015345 00000 n +0000015446 00000 n +0000619285 00000 n +0002527324 00000 n +0000015501 00000 n +0000015571 00000 n +0000623475 00000 n +0002527192 00000 n +0000015619 00000 n +0000015671 00000 n +0000623600 00000 n +0002527074 00000 n +0000015721 00000 n +0000015767 00000 n +0000623725 00000 n +0002526995 00000 n +0000015822 00000 n +0000015881 00000 n +0000627542 00000 n +0002526916 00000 n +0000015936 00000 n +0000015975 00000 n +0000631323 00000 n +0002526784 00000 n +0000016025 00000 n +0000016071 00000 n +0000631448 00000 n +0002526666 00000 n +0000016126 00000 n +0000016183 00000 n +0000643403 00000 n +0002526587 00000 n +0000016243 00000 n +0000016305 00000 n +0000643528 00000 n +0002526508 00000 n +0000016365 00000 n +0000016431 00000 n +0000643653 00000 n +0002526415 00000 n +0000016486 00000 n +0000016565 00000 n +0000647136 00000 n +0002526336 00000 n +0000016620 00000 n +0000016695 00000 n +0000647388 00000 n +0002526204 00000 n +0000016745 00000 n +0000016794 00000 n +0000647512 00000 n +0002526125 00000 n +0000016849 00000 n +0000016897 00000 n +0000650006 00000 n +0002526046 00000 n +0000016952 00000 n +0000016998 00000 n +0000656202 00000 n +0002525914 00000 n +0000017048 00000 n +0000017090 00000 n +0000656327 00000 n +0002525835 00000 n +0000017145 00000 n +0000017182 00000 n +0000656452 00000 n +0002525742 00000 n +0000017237 00000 n +0000017303 00000 n +0000660661 00000 n +0002525649 00000 n +0000017358 00000 n +0000017391 00000 n +0000660786 00000 n +0002525516 00000 n +0000017446 00000 n +0000017480 00000 n +0000665319 00000 n +0002525437 00000 n +0000017540 00000 n +0000017591 00000 n +0000665444 00000 n +0002525344 00000 n +0000017651 00000 n +0000017732 00000 n +0000667679 00000 n +0002525251 00000 n +0000017792 00000 n +0000017843 00000 n +0000669333 00000 n +0002525158 00000 n +0000017903 00000 n +0000017960 00000 n +0000671821 00000 n +0002525065 00000 n +0000018020 00000 n +0000018066 00000 n +0000671946 00000 n +0002524972 00000 n +0000018126 00000 n +0000018185 00000 n +0000675000 00000 n +0002524879 00000 n +0000018245 00000 n +0000018302 00000 n +0000678781 00000 n +0002524786 00000 n +0000018362 00000 n +0000018435 00000 n +0000683211 00000 n +0002524693 00000 n +0000018495 00000 n +0000018566 00000 n +0000685814 00000 n +0002524614 00000 n +0000018627 00000 n +0000018681 00000 n +0000685939 00000 n +0002524482 00000 n +0000018736 00000 n +0000018768 00000 n +0000689278 00000 n +0002524403 00000 n +0000018828 00000 n +0000018878 00000 n +0000689402 00000 n +0002524310 00000 n +0000018938 00000 n +0000018978 00000 n +0000693831 00000 n +0002524217 00000 n +0000019038 00000 n +0000019114 00000 n +0000696585 00000 n +0002524138 00000 n +0000019174 00000 n +0000019241 00000 n +0000696710 00000 n +0002524059 00000 n +0000019296 00000 n 0000019326 00000 n -0000019404 00000 n -0000614646 00000 n -0002246846 00000 n -0000019459 00000 n -0000019512 00000 n -0000626517 00000 n -0002246714 00000 n -0000019560 00000 n -0000019617 00000 n -0000626642 00000 n -0002246635 00000 n -0000019667 00000 n -0000019713 00000 n -0000626767 00000 n -0002246503 00000 n -0000019763 00000 n -0000019798 00000 n -0000630257 00000 n -0002246438 00000 n +0000696835 00000 n +0002523941 00000 n +0000019376 00000 n +0000019414 00000 n +0000696960 00000 n +0002523862 00000 n +0000019469 00000 n +0000019515 00000 n +0000697085 00000 n +0002523769 00000 n +0000019570 00000 n +0000019640 00000 n +0000698378 00000 n +0002523690 00000 n +0000019695 00000 n +0000019748 00000 n +0000701691 00000 n +0002523558 00000 n +0000019796 00000 n 0000019853 00000 n -0000019901 00000 n -0000632490 00000 n -0002246306 00000 n -0000019951 00000 n -0000019997 00000 n -0000632615 00000 n -0002246227 00000 n -0000020052 00000 n -0000020111 00000 n -0000632867 00000 n -0002246148 00000 n -0000020166 00000 n -0000020226 00000 n -0000635391 00000 n -0002246030 00000 n -0000020276 00000 n -0000020314 00000 n -0000635516 00000 n -0002245951 00000 n -0000020369 00000 n -0000020415 00000 n -0000635640 00000 n -0002245872 00000 n -0000020470 00000 n -0000020548 00000 n -0000639278 00000 n -0002245740 00000 n -0000020596 00000 n -0000020660 00000 n -0000639403 00000 n -0002245661 00000 n -0000020710 00000 n -0000020756 00000 n -0000643795 00000 n -0002245529 00000 n -0000020806 00000 n -0000020858 00000 n -0000643920 00000 n -0002245450 00000 n -0000020913 00000 n -0000020989 00000 n -0000648549 00000 n -0002245357 00000 n -0000021044 00000 n -0000021091 00000 n -0000648801 00000 n -0002245278 00000 n -0000021146 00000 n -0000021206 00000 n -0000655110 00000 n -0002245146 00000 n -0000021256 00000 n -0000021313 00000 n -0000655235 00000 n -0002245067 00000 n -0000021368 00000 n -0000021424 00000 n -0000655360 00000 n -0002244974 00000 n -0000021479 00000 n -0000021551 00000 n -0000659177 00000 n -0002244895 00000 n -0000021606 00000 n -0000021655 00000 n -0000659301 00000 n -0002244763 00000 n -0000021705 00000 n -0000021755 00000 n -0000663208 00000 n -0002244659 00000 n -0000021810 00000 n -0000021865 00000 n -0000667274 00000 n -0002244580 00000 n -0000021925 00000 n -0000021984 00000 n -0000667525 00000 n -0002244501 00000 n -0000022044 00000 n -0000022088 00000 n -0000671349 00000 n -0002244369 00000 n -0000022138 00000 n -0000022220 00000 n -0000671474 00000 n -0002244290 00000 n -0000022275 00000 n -0000022353 00000 n -0000675803 00000 n -0002244197 00000 n -0000022408 00000 n -0000022473 00000 n -0000675928 00000 n -0002244104 00000 n -0000022528 00000 n -0000022577 00000 n -0000676052 00000 n -0002243972 00000 n -0000022632 00000 n -0000022696 00000 n -0000680405 00000 n -0002243893 00000 n -0000022756 00000 n -0000022801 00000 n -0000680530 00000 n -0002243814 00000 n -0000022861 00000 n -0000022911 00000 n -0000680654 00000 n -0002243721 00000 n -0000022966 00000 n -0000023032 00000 n -0000685675 00000 n -0002243628 00000 n -0000023087 00000 n -0000023172 00000 n -0000689491 00000 n -0002243549 00000 n -0000023227 00000 n -0000023312 00000 n -0000689616 00000 n -0002243431 00000 n -0000023362 00000 n -0000023400 00000 n -0000689741 00000 n -0002243352 00000 n -0000023455 00000 n -0000023519 00000 n -0000693651 00000 n -0002243273 00000 n -0000023574 00000 n -0000023685 00000 n -0000697225 00000 n -0002243141 00000 n -0000023733 00000 n -0000023779 00000 n -0000697350 00000 n -0002243062 00000 n -0000023829 00000 n -0000023875 00000 n -0000697475 00000 n -0002242930 00000 n -0000023925 00000 n -0000023960 00000 n -0000702287 00000 n -0002242826 00000 n -0000024015 00000 n -0000024072 00000 n -0000710410 00000 n -0002242747 00000 n -0000024132 00000 n -0000024188 00000 n -0000710535 00000 n -0002242654 00000 n -0000024248 00000 n -0000024310 00000 n -0000710659 00000 n -0002242561 00000 n -0000024370 00000 n -0000024432 00000 n -0000710784 00000 n -0002242468 00000 n -0000024492 00000 n -0000024552 00000 n -0000710909 00000 n -0002242375 00000 n -0000024612 00000 n -0000024661 00000 n -0000715004 00000 n -0002242282 00000 n -0000024721 00000 n -0000024765 00000 n -0000715129 00000 n -0002242189 00000 n -0000024825 00000 n -0000024874 00000 n -0000715253 00000 n -0002242096 00000 n -0000024934 00000 n -0000025010 00000 n -0000715377 00000 n -0002242017 00000 n -0000025070 00000 n -0000025133 00000 n -0000719861 00000 n -0002241885 00000 n -0000025183 00000 n -0000025243 00000 n -0000723028 00000 n -0002241781 00000 n -0000025298 00000 n -0000025346 00000 n -0000723153 00000 n -0002241702 00000 n -0000025406 00000 n -0000025452 00000 n -0000723277 00000 n -0002241623 00000 n -0000025512 00000 n -0000025565 00000 n -0000726618 00000 n -0002241491 00000 n -0000025615 00000 n -0000025693 00000 n -0000732106 00000 n -0002241412 00000 n -0000025748 00000 n -0000025802 00000 n -0000732231 00000 n -0002241333 00000 n -0000025857 00000 n -0000025906 00000 n -0000736071 00000 n -0002241240 00000 n -0000025956 00000 n -0000026007 00000 n -0000736195 00000 n -0002241108 00000 n -0000026057 00000 n -0000026095 00000 n -0000740647 00000 n -0002241043 00000 n -0000026150 00000 n -0000026203 00000 n -0000740772 00000 n -0002240964 00000 n -0000026253 00000 n -0000026296 00000 n -0000744256 00000 n -0002240830 00000 n -0000026344 00000 n -0000026381 00000 n -0000744381 00000 n -0002240751 00000 n -0000026431 00000 n -0000026468 00000 n -0000744506 00000 n -0002240658 00000 n -0000026518 00000 n -0000026564 00000 n -0000744631 00000 n -0002240524 00000 n -0000026614 00000 n -0000026693 00000 n -0000744756 00000 n -0002240445 00000 n -0000026748 00000 n -0000026802 00000 n -0000748116 00000 n -0002240352 00000 n -0000026857 00000 n -0000026905 00000 n -0000748241 00000 n -0002240259 00000 n -0000026960 00000 n -0000027013 00000 n -0000748366 00000 n -0002240166 00000 n -0000027068 00000 n -0000027111 00000 n -0000751161 00000 n -0002240071 00000 n -0000027166 00000 n -0000027220 00000 n -0000751285 00000 n -0002239989 00000 n -0000027276 00000 n -0000027319 00000 n -0000755169 00000 n -0002239892 00000 n -0000027370 00000 n -0000027411 00000 n -0000755295 00000 n -0002239768 00000 n -0000027462 00000 n -0000027501 00000 n -0000755421 00000 n -0002239684 00000 n -0000027557 00000 n -0000027638 00000 n -0000755547 00000 n -0002239600 00000 n -0000027694 00000 n -0000027775 00000 n -0000759264 00000 n -0002239462 00000 n -0000027824 00000 n -0000027879 00000 n -0000759390 00000 n -0002239378 00000 n -0000027930 00000 n -0000027977 00000 n -0000759515 00000 n -0002239279 00000 n -0000028028 00000 n -0000028083 00000 n -0000763467 00000 n -0002239139 00000 n -0000028134 00000 n -0000028202 00000 n -0000763591 00000 n -0002239055 00000 n -0000028258 00000 n -0000028349 00000 n -0000763717 00000 n -0002238971 00000 n +0000701816 00000 n +0002523479 00000 n +0000019903 00000 n +0000019949 00000 n +0000711551 00000 n +0002523347 00000 n +0000019999 00000 n +0000020034 00000 n +0000714258 00000 n +0002523282 00000 n +0000020089 00000 n +0000020137 00000 n +0000716460 00000 n +0002523150 00000 n +0000020187 00000 n +0000020233 00000 n +0000716585 00000 n +0002523071 00000 n +0000020288 00000 n +0000020347 00000 n +0000716837 00000 n +0002522992 00000 n +0000020402 00000 n +0000020462 00000 n +0000719464 00000 n +0002522874 00000 n +0000020512 00000 n +0000020550 00000 n +0000719589 00000 n +0002522795 00000 n +0000020605 00000 n +0000020651 00000 n +0000719714 00000 n +0002522702 00000 n +0000020706 00000 n +0000020784 00000 n +0000719838 00000 n +0002522623 00000 n +0000020839 00000 n +0000020910 00000 n +0000724798 00000 n +0002522491 00000 n +0000020958 00000 n +0000021022 00000 n +0000724923 00000 n +0002522412 00000 n +0000021072 00000 n +0000021118 00000 n +0000728641 00000 n +0002522280 00000 n +0000021168 00000 n +0000021220 00000 n +0000728766 00000 n +0002522201 00000 n +0000021275 00000 n +0000021351 00000 n +0000736139 00000 n +0002522108 00000 n +0000021406 00000 n +0000021453 00000 n +0000736391 00000 n +0002522029 00000 n +0000021508 00000 n +0000021568 00000 n +0000751879 00000 n +0002521897 00000 n +0000021618 00000 n +0000021675 00000 n +0000752004 00000 n +0002521818 00000 n +0000021730 00000 n +0000021786 00000 n +0000752255 00000 n +0002521725 00000 n +0000021841 00000 n +0000021913 00000 n +0000752380 00000 n +0002521646 00000 n +0000021968 00000 n +0000022017 00000 n +0000757850 00000 n +0002521514 00000 n +0000022067 00000 n +0000022117 00000 n +0000761483 00000 n +0002521410 00000 n +0000022172 00000 n +0000022227 00000 n +0000761608 00000 n +0002521331 00000 n +0000022287 00000 n +0000022346 00000 n +0000761858 00000 n +0002521252 00000 n +0000022406 00000 n +0000022450 00000 n +0000765516 00000 n +0002521120 00000 n +0000022500 00000 n +0000022582 00000 n +0000765641 00000 n +0002521041 00000 n +0000022637 00000 n +0000022715 00000 n +0000765766 00000 n +0002520948 00000 n +0000022770 00000 n +0000022835 00000 n +0000768805 00000 n +0002520855 00000 n +0000022890 00000 n +0000022939 00000 n +0000768930 00000 n +0002520723 00000 n +0000022994 00000 n +0000023058 00000 n +0000772701 00000 n +0002520644 00000 n +0000023118 00000 n +0000023163 00000 n +0000772826 00000 n +0002520565 00000 n +0000023223 00000 n +0000023273 00000 n +0000772950 00000 n +0002520472 00000 n +0000023328 00000 n +0000023394 00000 n +0000776449 00000 n +0002520379 00000 n +0000023449 00000 n +0000023534 00000 n +0000779752 00000 n +0002520300 00000 n +0000023589 00000 n +0000023674 00000 n +0000782131 00000 n +0002520182 00000 n +0000023724 00000 n +0000023762 00000 n +0000782256 00000 n +0002520103 00000 n +0000023817 00000 n +0000023881 00000 n +0000787243 00000 n +0002520010 00000 n +0000023936 00000 n +0000024047 00000 n +0000787368 00000 n +0002519931 00000 n +0000024102 00000 n +0000024169 00000 n +0000790253 00000 n +0002519797 00000 n +0000024217 00000 n +0000024263 00000 n +0000790378 00000 n +0002519718 00000 n +0000024313 00000 n +0000024359 00000 n +0000790503 00000 n +0002519586 00000 n +0000024409 00000 n +0000024444 00000 n +0000794744 00000 n +0002519482 00000 n +0000024499 00000 n +0000024556 00000 n +0000802635 00000 n +0002519403 00000 n +0000024616 00000 n +0000024672 00000 n +0000802760 00000 n +0002519310 00000 n +0000024732 00000 n +0000024794 00000 n +0000802885 00000 n +0002519217 00000 n +0000024854 00000 n +0000024916 00000 n +0000806553 00000 n +0002519124 00000 n +0000024976 00000 n +0000025036 00000 n +0000806678 00000 n +0002519031 00000 n +0000025096 00000 n +0000025145 00000 n +0000806803 00000 n +0002518938 00000 n +0000025205 00000 n +0000025249 00000 n +0000806928 00000 n +0002518845 00000 n +0000025309 00000 n +0000025358 00000 n +0000810485 00000 n +0002518752 00000 n +0000025418 00000 n +0000025494 00000 n +0000810609 00000 n +0002518673 00000 n +0000025554 00000 n +0000025617 00000 n +0000814510 00000 n +0002518541 00000 n +0000025667 00000 n +0000025727 00000 n +0000817569 00000 n +0002518437 00000 n +0000025782 00000 n +0000025830 00000 n +0000817694 00000 n +0002518358 00000 n +0000025890 00000 n +0000025936 00000 n +0000817819 00000 n +0002518279 00000 n +0000025996 00000 n +0000026049 00000 n +0000821384 00000 n +0002518147 00000 n +0000026099 00000 n +0000026177 00000 n +0000826363 00000 n +0002518068 00000 n +0000026232 00000 n +0000026286 00000 n +0000828673 00000 n +0002517989 00000 n +0000026341 00000 n +0000026390 00000 n +0000828798 00000 n +0002517896 00000 n +0000026440 00000 n +0000026491 00000 n +0000832475 00000 n +0002517763 00000 n +0000026541 00000 n +0000026579 00000 n +0000832600 00000 n +0002517684 00000 n +0000026634 00000 n +0000026687 00000 n +0000837993 00000 n +0002517591 00000 n +0000026742 00000 n +0000026817 00000 n +0000838118 00000 n +0002517511 00000 n +0000026872 00000 n +0000026951 00000 n +0000838242 00000 n +0002517429 00000 n +0000027002 00000 n +0000027046 00000 n +0000841336 00000 n +0002517291 00000 n +0000027095 00000 n +0000027133 00000 n +0000841462 00000 n +0002517207 00000 n +0000027184 00000 n +0000027222 00000 n +0000841588 00000 n +0002517108 00000 n +0000027273 00000 n +0000027320 00000 n +0000841714 00000 n +0002516968 00000 n +0000027371 00000 n +0000027451 00000 n +0000844650 00000 n +0002516884 00000 n +0000027507 00000 n +0000027562 00000 n +0000844776 00000 n +0002516785 00000 n +0000027618 00000 n +0000027667 00000 n +0000844902 00000 n +0002516686 00000 n +0000027723 00000 n +0000027777 00000 n +0000847804 00000 n +0002516587 00000 n +0000027833 00000 n +0000027877 00000 n +0000847930 00000 n +0002516488 00000 n +0000027933 00000 n +0000027987 00000 n +0000850875 00000 n +0002516404 00000 n +0000028043 00000 n +0000028086 00000 n +0000851001 00000 n +0002516305 00000 n +0000028137 00000 n +0000028178 00000 n +0000851127 00000 n +0002516180 00000 n +0000028229 00000 n +0000028268 00000 n +0000851252 00000 n +0002516096 00000 n +0000028324 00000 n 0000028405 00000 n -0000028502 00000 n -0000763842 00000 n -0002238831 00000 n -0000028553 00000 n -0000028619 00000 n -0000763968 00000 n -0002238747 00000 n -0000028675 00000 n -0000028733 00000 n -0000767929 00000 n -0002238663 00000 n -0000028789 00000 n -0000028846 00000 n -0000770347 00000 n -0002238538 00000 n -0000028897 00000 n -0000028936 00000 n -0000770473 00000 n -0002238469 00000 n -0000028992 00000 n -0000029065 00000 n -0000774183 00000 n -0002238330 00000 n -0000029114 00000 n +0000853584 00000 n +0002516012 00000 n +0000028461 00000 n +0000028542 00000 n +0000856939 00000 n +0002515873 00000 n +0000028591 00000 n +0000028646 00000 n +0000857065 00000 n +0002515789 00000 n +0000028697 00000 n +0000028744 00000 n +0000857191 00000 n +0002515690 00000 n +0000028795 00000 n +0000028850 00000 n +0000860544 00000 n +0002515550 00000 n +0000028901 00000 n +0000028969 00000 n +0000860670 00000 n +0002515466 00000 n +0000029025 00000 n +0000029081 00000 n +0000860796 00000 n +0002515367 00000 n +0000029137 00000 n 0000029195 00000 n -0000774309 00000 n -0002238246 00000 n -0000029246 00000 n -0000029293 00000 n -0000776289 00000 n -0002238162 00000 n -0000029344 00000 n -0000029383 00000 n -0000780062 00000 n -0002238022 00000 n -0000029432 00000 n -0000029482 00000 n -0000780188 00000 n -0002237938 00000 n -0000029533 00000 n -0000029580 00000 n -0000780314 00000 n -0002237798 00000 n -0000029631 00000 n -0000029679 00000 n -0000784146 00000 n -0002237714 00000 n -0000029735 00000 n -0000029807 00000 n -0000784712 00000 n -0002237615 00000 n -0000029863 00000 n -0000029932 00000 n -0000784838 00000 n -0002237516 00000 n -0000029988 00000 n -0000030046 00000 n -0000788481 00000 n -0002237417 00000 n -0000030102 00000 n -0000030168 00000 n -0000788606 00000 n -0002237333 00000 n -0000030224 00000 n -0000030279 00000 n -0000791918 00000 n -0002237193 00000 n -0000030330 00000 n -0000030400 00000 n -0000792044 00000 n -0002237109 00000 n -0000030456 00000 n -0000030531 00000 n -0000794414 00000 n -0002237025 00000 n -0000030587 00000 n -0000030646 00000 n -0000800151 00000 n -0002236926 00000 n -0000030697 00000 n -0000030774 00000 n -0000811177 00000 n -0002236786 00000 n -0000030825 00000 n -0000030897 00000 n -0000811303 00000 n -0002236702 00000 n -0000030953 00000 n +0000871731 00000 n +0002515283 00000 n +0000029251 00000 n +0000029308 00000 n +0000875409 00000 n +0002515143 00000 n +0000029359 00000 n +0000029425 00000 n +0000875535 00000 n +0002515059 00000 n +0000029481 00000 n +0000029536 00000 n +0000879277 00000 n +0002514975 00000 n +0000029592 00000 n +0000029648 00000 n +0000879403 00000 n +0002514876 00000 n +0000029699 00000 n +0000029766 00000 n +0000881519 00000 n +0002514792 00000 n +0000029817 00000 n +0000029856 00000 n +0000884434 00000 n +0002514653 00000 n +0000029905 00000 n +0000029986 00000 n +0000884560 00000 n +0002514569 00000 n +0000030037 00000 n +0000030084 00000 n +0000886935 00000 n +0002514485 00000 n +0000030135 00000 n +0000030174 00000 n +0000890260 00000 n +0002514345 00000 n +0000030223 00000 n +0000030273 00000 n +0000890386 00000 n +0002514261 00000 n +0000030324 00000 n +0000030371 00000 n +0000890512 00000 n +0002514121 00000 n +0000030422 00000 n +0000030470 00000 n +0000893988 00000 n +0002514037 00000 n +0000030526 00000 n +0000030598 00000 n +0000894554 00000 n +0002513938 00000 n +0000030654 00000 n +0000030723 00000 n +0000897972 00000 n +0002513854 00000 n +0000030779 00000 n +0000030837 00000 n +0000898098 00000 n +0002513714 00000 n +0000030888 00000 n +0000030945 00000 n +0000900446 00000 n +0002513630 00000 n 0000031001 00000 n -0000816263 00000 n -0002236603 00000 n -0000031057 00000 n -0000031107 00000 n -0000821145 00000 n -0002236504 00000 n -0000031163 00000 n -0000031226 00000 n -0000821271 00000 n -0002236405 00000 n -0000031282 00000 n -0000031324 00000 n -0000825810 00000 n -0002236306 00000 n -0000031380 00000 n -0000031464 00000 n -0000830167 00000 n -0002236222 00000 n -0000031520 00000 n -0000031582 00000 n -0000835221 00000 n -0002236082 00000 n -0000031633 00000 n -0000031698 00000 n -0000835347 00000 n -0002235998 00000 n -0000031754 00000 n -0000031830 00000 n -0000839626 00000 n -0002235899 00000 n -0000031886 00000 n -0000031963 00000 n -0000839751 00000 n -0002235800 00000 n -0000032019 00000 n -0000032077 00000 n -0000843594 00000 n -0002235701 00000 n -0000032133 00000 n -0000032198 00000 n -0000847128 00000 n -0002235617 00000 n -0000032254 00000 n -0000032319 00000 n -0000851850 00000 n -0002235477 00000 n -0000032370 00000 n -0000032431 00000 n -0000851976 00000 n -0002235393 00000 n -0000032487 00000 n -0000032570 00000 n -0000856634 00000 n -0002235268 00000 n -0000032626 00000 n -0000032706 00000 n -0000857011 00000 n -0002235184 00000 n -0000032767 00000 n -0000032825 00000 n -0000863560 00000 n -0002235085 00000 n -0000032886 00000 n -0000032983 00000 n -0000863686 00000 n -0002234986 00000 n -0000033044 00000 n -0000033118 00000 n -0000866461 00000 n -0002234887 00000 n -0000033179 00000 n -0000033263 00000 n -0000869178 00000 n -0002234788 00000 n -0000033324 00000 n -0000033386 00000 n -0000871959 00000 n -0002234689 00000 n -0000033447 00000 n -0000033540 00000 n -0000876366 00000 n -0002234590 00000 n -0000033601 00000 n -0000033673 00000 n -0000876492 00000 n -0002234491 00000 n -0000033734 00000 n -0000033819 00000 n -0000879013 00000 n -0002234407 00000 n -0000033880 00000 n -0000033960 00000 n -0000883361 00000 n -0002234267 00000 n -0000034011 00000 n -0000034118 00000 n -0000883487 00000 n -0002234183 00000 n -0000034174 00000 n -0000034238 00000 n -0000888348 00000 n -0002234084 00000 n -0000034294 00000 n -0000034369 00000 n -0000892647 00000 n -0002233985 00000 n -0000034425 00000 n -0000034493 00000 n -0000892773 00000 n -0002233901 00000 n -0000034549 00000 n -0000034639 00000 n -0000897559 00000 n -0002233761 00000 n -0000034690 00000 n -0000034729 00000 n -0000897685 00000 n -0002233677 00000 n -0000034785 00000 n -0000034865 00000 n -0000902206 00000 n -0002233578 00000 n -0000034921 00000 n -0000034985 00000 n -0000907515 00000 n -0002233479 00000 n -0000035041 00000 n -0000035112 00000 n -0000907641 00000 n -0002233380 00000 n -0000035168 00000 n -0000035253 00000 n -0000911900 00000 n -0002233281 00000 n -0000035309 00000 n -0000035376 00000 n -0000919443 00000 n -0002233182 00000 n -0000035432 00000 n -0000035483 00000 n -0000919569 00000 n -0002233098 00000 n -0000035539 00000 n -0000035630 00000 n -0000919695 00000 n -0002232958 00000 n -0000035682 00000 n -0000035729 00000 n -0000919821 00000 n -0002232874 00000 n -0000035786 00000 n -0000035832 00000 n -0000923822 00000 n -0002232775 00000 n -0000035889 00000 n -0000035950 00000 n -0000923948 00000 n -0002232676 00000 n -0000036007 00000 n -0000036055 00000 n -0000924074 00000 n -0002232592 00000 n -0000036112 00000 n -0000036164 00000 n -0000928870 00000 n -0002232493 00000 n -0000036216 00000 n -0000036297 00000 n -0000933248 00000 n -0002232394 00000 n -0000036349 00000 n -0000036398 00000 n -0000933374 00000 n -0002232295 00000 n -0000036450 00000 n -0000036521 00000 n -0000936499 00000 n -0002232196 00000 n -0000036573 00000 n -0000036658 00000 n -0000936625 00000 n -0002232071 00000 n -0000036710 00000 n -0000036763 00000 n -0000936751 00000 n -0002231987 00000 n -0000036820 00000 n -0000036895 00000 n -0000936877 00000 n -0002231903 00000 n -0000036952 00000 n -0000037052 00000 n -0000941301 00000 n -0002231763 00000 n -0000037101 00000 n -0000037159 00000 n -0000941427 00000 n -0002231638 00000 n -0000037210 00000 n -0000037248 00000 n -0000941553 00000 n -0002231554 00000 n -0000037304 00000 n -0000037353 00000 n -0000941679 00000 n -0002231470 00000 n -0000037409 00000 n -0000037445 00000 n -0000941804 00000 n -0002231330 00000 n -0000037496 00000 n -0000037557 00000 n -0000945844 00000 n -0002231246 00000 n -0000037613 00000 n -0000037672 00000 n -0000945970 00000 n -0002231147 00000 n -0000037728 00000 n -0000037789 00000 n -0000948433 00000 n -0002231063 00000 n -0000037845 00000 n -0000037912 00000 n -0000952054 00000 n -0002230923 00000 n -0000037963 00000 n -0000038011 00000 n -0000952180 00000 n -0002230839 00000 n -0000038067 00000 n -0000038139 00000 n -0000952306 00000 n -0002230740 00000 n -0000038195 00000 n -0000038322 00000 n -0000955803 00000 n -0002230641 00000 n -0000038378 00000 n -0000038452 00000 n -0000955928 00000 n -0002230542 00000 n -0000038508 00000 n -0000038598 00000 n -0000960370 00000 n -0002230458 00000 n -0000038654 00000 n -0000038737 00000 n -0000960496 00000 n -0002230318 00000 n -0000038788 00000 n -0000038905 00000 n -0000964847 00000 n -0002230234 00000 n -0000038961 00000 n -0000039025 00000 n -0000964973 00000 n -0002230135 00000 n -0000039081 00000 n -0000039137 00000 n -0000965099 00000 n -0002230036 00000 n -0000039193 00000 n -0000039261 00000 n -0000998311 00000 n -0002229937 00000 n -0000039317 00000 n -0000039371 00000 n -0001012636 00000 n -0002229838 00000 n -0000039427 00000 n -0000039514 00000 n -0001016878 00000 n -0002229739 00000 n -0000039570 00000 n -0000039650 00000 n -0001021018 00000 n -0002229640 00000 n -0000039706 00000 n -0000039780 00000 n -0001021144 00000 n -0002229556 00000 n -0000039836 00000 n -0000039911 00000 n -0001021270 00000 n -0002229415 00000 n -0000039962 00000 n +0000031076 00000 n +0000902923 00000 n +0002513546 00000 n +0000031132 00000 n +0000031191 00000 n +0000909178 00000 n +0002513447 00000 n +0000031242 00000 n +0000031306 00000 n +0000909304 00000 n +0002513307 00000 n +0000031357 00000 n +0000031429 00000 n +0000909430 00000 n +0002513223 00000 n +0000031485 00000 n +0000031533 00000 n +0000921531 00000 n +0002513124 00000 n +0000031589 00000 n +0000031639 00000 n +0000925568 00000 n +0002513025 00000 n +0000031695 00000 n +0000031758 00000 n +0000925693 00000 n +0002512926 00000 n +0000031814 00000 n +0000031856 00000 n +0000930128 00000 n +0002512827 00000 n +0000031912 00000 n +0000031996 00000 n +0000934067 00000 n +0002512743 00000 n +0000032052 00000 n +0000032114 00000 n +0000938519 00000 n +0002512603 00000 n +0000032165 00000 n +0000032230 00000 n +0000938645 00000 n +0002512519 00000 n +0000032286 00000 n +0000032362 00000 n +0000942698 00000 n +0002512420 00000 n +0000032418 00000 n +0000032495 00000 n +0000945896 00000 n +0002512321 00000 n +0000032551 00000 n +0000032609 00000 n +0000946148 00000 n +0002512222 00000 n +0000032665 00000 n +0000032730 00000 n +0000949947 00000 n +0002512138 00000 n +0000032786 00000 n +0000032851 00000 n +0000953260 00000 n +0002511998 00000 n +0000032902 00000 n +0000032963 00000 n +0000957385 00000 n +0002511914 00000 n +0000033019 00000 n +0000033102 00000 n +0000957511 00000 n +0002511789 00000 n +0000033158 00000 n +0000033238 00000 n +0000961850 00000 n +0002511705 00000 n +0000033299 00000 n +0000033357 00000 n +0000965046 00000 n +0002511606 00000 n +0000033418 00000 n +0000033515 00000 n +0000968328 00000 n +0002511507 00000 n +0000033576 00000 n +0000033650 00000 n +0000970810 00000 n +0002511408 00000 n +0000033711 00000 n +0000033795 00000 n +0000973433 00000 n +0002511309 00000 n +0000033856 00000 n +0000033918 00000 n +0000976182 00000 n +0002511210 00000 n +0000033979 00000 n +0000034072 00000 n +0000979722 00000 n +0002511111 00000 n +0000034133 00000 n +0000034205 00000 n +0000982861 00000 n +0002511012 00000 n +0000034266 00000 n +0000034351 00000 n +0000982987 00000 n +0002510928 00000 n +0000034412 00000 n +0000034474 00000 n +0000986132 00000 n +0002510788 00000 n +0000034525 00000 n +0000034582 00000 n +0000986258 00000 n +0002510704 00000 n +0000034638 00000 n +0000034702 00000 n +0000990230 00000 n +0002510605 00000 n +0000034758 00000 n +0000034833 00000 n +0000997470 00000 n +0002510506 00000 n +0000034889 00000 n +0000034957 00000 n +0000997596 00000 n +0002510422 00000 n +0000035013 00000 n +0000035103 00000 n +0001001330 00000 n +0002510282 00000 n +0000035154 00000 n +0000035193 00000 n +0001001455 00000 n +0002510198 00000 n +0000035249 00000 n +0000035329 00000 n +0001011724 00000 n +0002510099 00000 n +0000035385 00000 n +0000035449 00000 n +0001013902 00000 n +0002510000 00000 n +0000035505 00000 n +0000035576 00000 n +0001017659 00000 n +0002509901 00000 n +0000035632 00000 n +0000035717 00000 n +0001021447 00000 n +0002509802 00000 n +0000035773 00000 n +0000035840 00000 n +0001028451 00000 n +0002509703 00000 n +0000035896 00000 n +0000035947 00000 n +0001028577 00000 n +0002509619 00000 n +0000036003 00000 n +0000036094 00000 n +0001028703 00000 n +0002509479 00000 n +0000036146 00000 n +0000036193 00000 n +0001028829 00000 n +0002509395 00000 n +0000036250 00000 n +0000036296 00000 n +0001031902 00000 n +0002509296 00000 n +0000036353 00000 n +0000036414 00000 n +0001032028 00000 n +0002509197 00000 n +0000036471 00000 n +0000036519 00000 n +0001032154 00000 n +0002509113 00000 n +0000036576 00000 n +0000036628 00000 n +0001036426 00000 n +0002509014 00000 n +0000036680 00000 n +0000036761 00000 n +0001044138 00000 n +0002508915 00000 n +0000036813 00000 n +0000036862 00000 n +0001044264 00000 n +0002508816 00000 n +0000036914 00000 n +0000036983 00000 n +0001046226 00000 n +0002508717 00000 n +0000037035 00000 n +0000037120 00000 n +0001046352 00000 n +0002508592 00000 n +0000037172 00000 n +0000037212 00000 n +0001046478 00000 n +0002508508 00000 n +0000037269 00000 n +0000037344 00000 n +0001046604 00000 n +0002508424 00000 n +0000037401 00000 n +0000037501 00000 n +0001050411 00000 n +0002508284 00000 n +0000037550 00000 n +0000037608 00000 n +0001050537 00000 n +0002508159 00000 n +0000037659 00000 n +0000037697 00000 n +0001050663 00000 n +0002508075 00000 n +0000037753 00000 n +0000037802 00000 n +0001050789 00000 n +0002507991 00000 n +0000037858 00000 n +0000037894 00000 n +0001050915 00000 n +0002507851 00000 n +0000037945 00000 n +0000038006 00000 n +0001054550 00000 n +0002507767 00000 n +0000038062 00000 n +0000038121 00000 n +0001057748 00000 n +0002507668 00000 n +0000038177 00000 n +0000038238 00000 n +0001058001 00000 n +0002507584 00000 n +0000038294 00000 n +0000038361 00000 n +0001060998 00000 n +0002507444 00000 n +0000038412 00000 n +0000038460 00000 n +0001061124 00000 n +0002507360 00000 n +0000038516 00000 n +0000038588 00000 n +0001064569 00000 n +0002507261 00000 n +0000038644 00000 n +0000038771 00000 n +0001064695 00000 n +0002507162 00000 n +0000038827 00000 n +0000038901 00000 n +0001064821 00000 n +0002507063 00000 n +0000038957 00000 n +0000039047 00000 n +0001068298 00000 n +0002506979 00000 n +0000039103 00000 n +0000039186 00000 n +0001072066 00000 n +0002506839 00000 n +0000039237 00000 n +0000039354 00000 n +0001072192 00000 n +0002506755 00000 n +0000039410 00000 n +0000039474 00000 n +0001091522 00000 n +0002506656 00000 n +0000039530 00000 n +0000039586 00000 n +0001091838 00000 n +0002506557 00000 n +0000039642 00000 n +0000039710 00000 n +0001096236 00000 n +0002506458 00000 n +0000039766 00000 n +0000039820 00000 n +0001121749 00000 n +0002506359 00000 n +0000039876 00000 n +0000039963 00000 n +0001125971 00000 n +0002506260 00000 n 0000040019 00000 n -0001026242 00000 n -0002229331 00000 n -0000040075 00000 n -0000040130 00000 n -0001029369 00000 n -0002229232 00000 n -0000040186 00000 n -0000040240 00000 n -0001032576 00000 n -0002229133 00000 n -0000040296 00000 n -0000040343 00000 n -0001032702 00000 n -0002229034 00000 n -0000040399 00000 n -0000040437 00000 n -0001052711 00000 n -0002228935 00000 n -0000040493 00000 n -0000040527 00000 n -0001077201 00000 n -0002228836 00000 n -0000040583 00000 n -0000040621 00000 n -0001133098 00000 n -0002228737 00000 n -0000040677 00000 n -0000040732 00000 n -0001133224 00000 n -0002228638 00000 n -0000040788 00000 n -0000040844 00000 n -0001138202 00000 n -0002228539 00000 n -0000040900 00000 n -0000040941 00000 n -0001141848 00000 n -0002228440 00000 n -0000040998 00000 n -0000041083 00000 n -0001145596 00000 n -0002228341 00000 n -0000041140 00000 n -0000041189 00000 n -0001145722 00000 n -0002228242 00000 n -0000041246 00000 n -0000041285 00000 n -0001145848 00000 n -0002228143 00000 n -0000041342 00000 n -0000041385 00000 n -0001145973 00000 n -0002228044 00000 n -0000041442 00000 n -0000041506 00000 n -0001153147 00000 n -0002227945 00000 n -0000041563 00000 n -0000041652 00000 n -0001153272 00000 n -0002227846 00000 n -0000041709 00000 n -0000041805 00000 n -0001157962 00000 n -0002227747 00000 n -0000041862 00000 n -0000041920 00000 n -0001163425 00000 n -0002227648 00000 n -0000041977 00000 n -0000042036 00000 n -0001167682 00000 n -0002227564 00000 n -0000042093 00000 n -0000042153 00000 n -0001167808 00000 n -0002227424 00000 n -0000042204 00000 n -0000042265 00000 n -0001167934 00000 n -0002227340 00000 n -0000042321 00000 n -0000042391 00000 n -0001168059 00000 n -0002227241 00000 n -0000042447 00000 n -0000042505 00000 n -0001172193 00000 n -0002227157 00000 n -0000042561 00000 n -0000042619 00000 n -0001172318 00000 n -0002227017 00000 n -0000042670 00000 n -0000042760 00000 n -0001172444 00000 n -0002226933 00000 n -0000042816 00000 n -0000042893 00000 n -0001172570 00000 n -0002226849 00000 n -0000042949 00000 n -0000043026 00000 n -0001177101 00000 n -0002226709 00000 n -0000043077 00000 n -0000043197 00000 n -0001177227 00000 n -0002226625 00000 n -0000043253 00000 n -0000043313 00000 n -0001177353 00000 n -0002226541 00000 n -0000043369 00000 n -0000043432 00000 n -0001181511 00000 n -0002226401 00000 n -0000043483 00000 n -0000043557 00000 n -0001181637 00000 n -0002226317 00000 n -0000043613 00000 n -0000043701 00000 n -0001181763 00000 n -0002226218 00000 n -0000043757 00000 n -0000043821 00000 n -0001181888 00000 n -0002226119 00000 n -0000043877 00000 n -0000043929 00000 n -0001182013 00000 n -0002226035 00000 n -0000043985 00000 n -0000044077 00000 n -0001185726 00000 n -0002225894 00000 n -0000044129 00000 n -0000044191 00000 n -0001185852 00000 n -0002225810 00000 n -0000044248 00000 n -0000044308 00000 n -0001185978 00000 n -0002225711 00000 n -0000044365 00000 n -0000044430 00000 n -0001188573 00000 n -0002225612 00000 n -0000044487 00000 n -0000044567 00000 n -0001191233 00000 n -0002225513 00000 n -0000044624 00000 n -0000044689 00000 n -0001194835 00000 n -0002225414 00000 n -0000044746 00000 n -0000044807 00000 n -0001194961 00000 n -0002225315 00000 n -0000044864 00000 n -0000044953 00000 n -0001197095 00000 n -0002225216 00000 n -0000045010 00000 n -0000045063 00000 n -0001201576 00000 n -0002225117 00000 n -0000045120 00000 n -0000045262 00000 n -0001205835 00000 n -0002225018 00000 n -0000045319 00000 n -0000045379 00000 n -0001208307 00000 n -0002224919 00000 n -0000045437 00000 n -0000045503 00000 n -0001211407 00000 n -0002224820 00000 n -0000045561 00000 n -0000045615 00000 n -0001214986 00000 n -0002224721 00000 n -0000045673 00000 n -0000045755 00000 n -0001215301 00000 n -0002224622 00000 n -0000045813 00000 n -0000045870 00000 n -0001215426 00000 n -0002224523 00000 n -0000045928 00000 n -0000045978 00000 n -0001219703 00000 n -0002224424 00000 n -0000046036 00000 n -0000046110 00000 n -0001219829 00000 n -0002224340 00000 n -0000046168 00000 n -0000046256 00000 n -0001223758 00000 n -0002224200 00000 n -0000046308 00000 n -0000046398 00000 n -0001224135 00000 n -0002224116 00000 n -0000046455 00000 n -0000046517 00000 n -0001227869 00000 n -0002224017 00000 n -0000046574 00000 n -0000046639 00000 n -0001227995 00000 n -0002223918 00000 n -0000046696 00000 n -0000046771 00000 n -0001231484 00000 n -0002223819 00000 n -0000046828 00000 n -0000046912 00000 n -0001234547 00000 n -0002223678 00000 n -0000046969 00000 n -0000047055 00000 n -0001234673 00000 n -0002223594 00000 n -0000047117 00000 n -0000047187 00000 n -0001234798 00000 n -0002223495 00000 n -0000047249 00000 n -0000047349 00000 n -0001234924 00000 n -0002223396 00000 n -0000047411 00000 n -0000047512 00000 n -0001237477 00000 n -0002223297 00000 n -0000047574 00000 n -0000047672 00000 n -0001237603 00000 n -0002223198 00000 n -0000047734 00000 n -0000047814 00000 n -0001240068 00000 n -0002223099 00000 n -0000047876 00000 n -0000047971 00000 n -0001240194 00000 n -0002223000 00000 n -0000048033 00000 n -0000048115 00000 n -0001240320 00000 n -0002222901 00000 n -0000048177 00000 n -0000048275 00000 n -0001242399 00000 n -0002222802 00000 n -0000048337 00000 n -0000048448 00000 n -0001242525 00000 n -0002222703 00000 n -0000048511 00000 n -0000048615 00000 n -0001245472 00000 n -0002222604 00000 n -0000048678 00000 n -0000048782 00000 n -0001245598 00000 n -0002222505 00000 n -0000048845 00000 n -0000048942 00000 n -0001245722 00000 n -0002222406 00000 n -0000049005 00000 n -0000049084 00000 n -0001248358 00000 n -0002222307 00000 n -0000049147 00000 n -0000049231 00000 n -0001248482 00000 n -0002222223 00000 n -0000049294 00000 n -0000049392 00000 n -0001248608 00000 n -0002222139 00000 n -0000049449 00000 n -0000049503 00000 n -0001252383 00000 n -0002221999 00000 n -0000049555 00000 n -0000049606 00000 n -0001252509 00000 n -0002221915 00000 n -0000049663 00000 n -0000049714 00000 n -0001252635 00000 n -0002221816 00000 n -0000049771 00000 n -0000049813 00000 n -0001252761 00000 n -0002221717 00000 n -0000049870 00000 n -0000049917 00000 n -0001255816 00000 n -0002221633 00000 n +0000040099 00000 n +0001129754 00000 n +0002506161 00000 n +0000040155 00000 n +0000040229 00000 n +0001129880 00000 n +0002506077 00000 n +0000040285 00000 n +0000040360 00000 n +0001134579 00000 n +0002505936 00000 n +0000040411 00000 n +0000040468 00000 n +0001134705 00000 n +0002505852 00000 n +0000040524 00000 n +0000040579 00000 n +0001137960 00000 n +0002505753 00000 n +0000040635 00000 n +0000040689 00000 n +0001141032 00000 n +0002505654 00000 n +0000040745 00000 n +0000040792 00000 n +0001183442 00000 n +0002505555 00000 n +0000040848 00000 n +0000040886 00000 n +0001183757 00000 n +0002505456 00000 n +0000040942 00000 n +0000040976 00000 n +0001214077 00000 n +0002505357 00000 n +0000041032 00000 n +0000041070 00000 n +0001241812 00000 n +0002505258 00000 n +0000041126 00000 n +0000041181 00000 n +0001241938 00000 n +0002505159 00000 n +0000041237 00000 n +0000041293 00000 n +0001242064 00000 n +0002505060 00000 n +0000041349 00000 n +0000041390 00000 n +0001313330 00000 n +0002504961 00000 n +0000041447 00000 n +0000041532 00000 n +0001313455 00000 n +0002504862 00000 n +0000041589 00000 n +0000041638 00000 n +0001317026 00000 n +0002504763 00000 n +0000041695 00000 n +0000041734 00000 n +0001317152 00000 n +0002504664 00000 n +0000041791 00000 n +0000041834 00000 n +0001317278 00000 n +0002504565 00000 n +0000041891 00000 n +0000041955 00000 n +0001324074 00000 n +0002504466 00000 n +0000042012 00000 n +0000042101 00000 n +0001324325 00000 n +0002504367 00000 n +0000042158 00000 n +0000042254 00000 n +0001371462 00000 n +0002504268 00000 n +0000042311 00000 n +0000042369 00000 n +0001379799 00000 n +0002504169 00000 n +0000042426 00000 n +0000042485 00000 n +0001383840 00000 n +0002504085 00000 n +0000042542 00000 n +0000042602 00000 n +0001383966 00000 n +0002503945 00000 n +0000042653 00000 n +0000042714 00000 n +0001384091 00000 n +0002503861 00000 n +0000042770 00000 n +0000042840 00000 n +0001409283 00000 n +0002503762 00000 n +0000042896 00000 n +0000042954 00000 n +0001409598 00000 n +0002503678 00000 n +0000043010 00000 n +0000043068 00000 n +0001436578 00000 n +0002503538 00000 n +0000043119 00000 n +0000043209 00000 n +0001436704 00000 n +0002503454 00000 n +0000043265 00000 n +0000043342 00000 n +0001464099 00000 n +0002503370 00000 n +0000043398 00000 n +0000043475 00000 n +0001464225 00000 n +0002503230 00000 n +0000043526 00000 n +0000043646 00000 n +0001468166 00000 n +0002503146 00000 n +0000043702 00000 n +0000043762 00000 n +0001468292 00000 n +0002503062 00000 n +0000043818 00000 n +0000043881 00000 n +0001472187 00000 n +0002502922 00000 n +0000043932 00000 n +0000044006 00000 n +0001472313 00000 n +0002502838 00000 n +0000044062 00000 n +0000044150 00000 n +0001472439 00000 n +0002502739 00000 n +0000044206 00000 n +0000044270 00000 n +0001472565 00000 n +0002502640 00000 n +0000044326 00000 n +0000044378 00000 n +0001472691 00000 n +0002502556 00000 n +0000044434 00000 n +0000044526 00000 n +0001476214 00000 n +0002502415 00000 n +0000044578 00000 n +0000044640 00000 n +0001476340 00000 n +0002502331 00000 n +0000044697 00000 n +0000044757 00000 n +0001476466 00000 n +0002502232 00000 n +0000044814 00000 n +0000044879 00000 n +0001479098 00000 n +0002502133 00000 n +0000044936 00000 n +0000045016 00000 n +0001481650 00000 n +0002502034 00000 n +0000045073 00000 n +0000045138 00000 n +0001484452 00000 n +0002501935 00000 n +0000045195 00000 n +0000045256 00000 n +0001487710 00000 n +0002501836 00000 n +0000045313 00000 n +0000045402 00000 n +0001487835 00000 n +0002501737 00000 n +0000045459 00000 n +0000045512 00000 n +0001492674 00000 n +0002501638 00000 n +0000045569 00000 n +0000045685 00000 n +0001496719 00000 n +0002501539 00000 n +0000045742 00000 n +0000045802 00000 n +0001496845 00000 n +0002501440 00000 n +0000045860 00000 n +0000045926 00000 n +0001501607 00000 n +0002501341 00000 n +0000045984 00000 n +0000046038 00000 n +0001504880 00000 n +0002501242 00000 n +0000046096 00000 n +0000046179 00000 n +0001505193 00000 n +0002501143 00000 n +0000046237 00000 n +0000046294 00000 n +0001505319 00000 n +0002501044 00000 n +0000046352 00000 n +0000046402 00000 n +0001552574 00000 n +0002500945 00000 n +0000046460 00000 n +0000046534 00000 n +0001556214 00000 n +0002500861 00000 n +0000046592 00000 n +0000046680 00000 n +0001559535 00000 n +0002500721 00000 n +0000046732 00000 n +0000046822 00000 n +0001559913 00000 n +0002500637 00000 n +0000046879 00000 n +0000046941 00000 n +0001563571 00000 n +0002500538 00000 n +0000046998 00000 n +0000047063 00000 n +0001563697 00000 n +0002500439 00000 n +0000047120 00000 n +0000047195 00000 n +0001566779 00000 n +0002500340 00000 n +0000047252 00000 n +0000047336 00000 n +0001570157 00000 n +0002500241 00000 n +0000047393 00000 n +0000047460 00000 n +0001580682 00000 n +0002500157 00000 n +0000047517 00000 n +0000047571 00000 n +0001583066 00000 n +0002500017 00000 n +0000047623 00000 n +0000047674 00000 n +0001586398 00000 n +0002499933 00000 n +0000047731 00000 n +0000047782 00000 n +0001586524 00000 n +0002499834 00000 n +0000047839 00000 n +0000047881 00000 n +0001586650 00000 n +0002499735 00000 n +0000047938 00000 n +0000047985 00000 n +0001586776 00000 n +0002499651 00000 n +0000048042 00000 n +0000048086 00000 n +0001589529 00000 n +0002499511 00000 n +0000048138 00000 n +0000048206 00000 n +0001595068 00000 n +0002499386 00000 n +0000048263 00000 n +0000048327 00000 n +0001595193 00000 n +0002499302 00000 n +0000048389 00000 n +0000048442 00000 n +0001595319 00000 n +0002499203 00000 n +0000048504 00000 n +0000048574 00000 n +0001602312 00000 n +0002499104 00000 n +0000048636 00000 n +0000048690 00000 n +0001602438 00000 n +0002499005 00000 n +0000048752 00000 n +0000048829 00000 n +0001608179 00000 n +0002498906 00000 n +0000048891 00000 n +0000048955 00000 n +0001608305 00000 n +0002498807 00000 n +0000049017 00000 n +0000049074 00000 n +0001613844 00000 n +0002498708 00000 n +0000049136 00000 n +0000049244 00000 n +0001613970 00000 n +0002498624 00000 n +0000049306 00000 n +0000049369 00000 n +0001614096 00000 n +0002498540 00000 n +0000049426 00000 n +0000049510 00000 n +0001630538 00000 n +0002498400 00000 n +0000049562 00000 n +0000049614 00000 n +0001630664 00000 n +0002498316 00000 n +0000049671 00000 n +0000049717 00000 n +0001630789 00000 n +0002498217 00000 n +0000049774 00000 n +0000049835 00000 n +0001634224 00000 n +0002498118 00000 n +0000049892 00000 n 0000049974 00000 n -0000050018 00000 n -0001255942 00000 n -0002221493 00000 n -0000050070 00000 n -0000050138 00000 n -0001261775 00000 n -0002221368 00000 n -0000050195 00000 n -0000050259 00000 n -0001261901 00000 n -0002221284 00000 n -0000050321 00000 n -0000050374 00000 n -0001262027 00000 n -0002221185 00000 n -0000050436 00000 n -0000050506 00000 n -0001269044 00000 n -0002221086 00000 n -0000050568 00000 n -0000050622 00000 n -0001269170 00000 n -0002220987 00000 n -0000050684 00000 n -0000050761 00000 n -0001275539 00000 n -0002220888 00000 n -0000050823 00000 n -0000050896 00000 n -0001275665 00000 n -0002220789 00000 n -0000050958 00000 n -0000051015 00000 n -0001281729 00000 n -0002220690 00000 n -0000051077 00000 n -0000051185 00000 n -0001281855 00000 n -0002220606 00000 n -0000051247 00000 n -0000051310 00000 n -0001281980 00000 n -0002220522 00000 n -0000051367 00000 n -0000051451 00000 n -0001297295 00000 n -0002220382 00000 n -0000051503 00000 n -0000051555 00000 n -0001301420 00000 n -0002220298 00000 n -0000051612 00000 n -0000051658 00000 n -0001301546 00000 n -0002220199 00000 n -0000051715 00000 n -0000051776 00000 n -0001301672 00000 n -0002220100 00000 n -0000051833 00000 n -0000051915 00000 n -0001301798 00000 n -0002220001 00000 n -0000051972 00000 n -0000052028 00000 n -0001305441 00000 n -0002219902 00000 n -0000052085 00000 n -0000052135 00000 n -0001305566 00000 n -0002219803 00000 n -0000052192 00000 n -0000052240 00000 n -0001308927 00000 n -0002219719 00000 n -0000052297 00000 n -0000052348 00000 n -0001309053 00000 n -0002219620 00000 n -0000052400 00000 n -0000052446 00000 n -0001313270 00000 n -0002219480 00000 n -0000052498 00000 n -0000052574 00000 n -0001313396 00000 n -0002219396 00000 n -0000052631 00000 n -0000052697 00000 n -0001313522 00000 n -0002219297 00000 n -0000052754 00000 n -0000052797 00000 n -0001316015 00000 n -0002219213 00000 n -0000052854 00000 n -0000052903 00000 n -0001316141 00000 n -0002219114 00000 n -0000052955 00000 n -0000053020 00000 n -0001316266 00000 n -0002218974 00000 n -0000053072 00000 n -0000053122 00000 n -0001316392 00000 n -0002218890 00000 n -0000053179 00000 n -0000053235 00000 n -0001316517 00000 n -0002218791 00000 n -0000053292 00000 n -0000053340 00000 n -0001316643 00000 n -0002218707 00000 n -0000053397 00000 n -0000053444 00000 n -0001319801 00000 n -0002218582 00000 n -0000053496 00000 n -0000053531 00000 n -0001319927 00000 n -0002218498 00000 n -0000053588 00000 n -0000053664 00000 n -0001322582 00000 n -0002218399 00000 n -0000053721 00000 n -0000053776 00000 n -0001333246 00000 n -0002218300 00000 n -0000053833 00000 n -0000053928 00000 n -0001348424 00000 n -0002218216 00000 n -0000053985 00000 n -0000054056 00000 n -0001626808 00000 n -0002218077 00000 n -0000054105 00000 n -0000054150 00000 n -0001626934 00000 n -0002217993 00000 n -0000054201 00000 n -0000054248 00000 n -0001627060 00000 n -0002217894 00000 n -0000054299 00000 n -0000054335 00000 n -0001630319 00000 n -0002217754 00000 n -0000054386 00000 n -0000054428 00000 n -0001630445 00000 n -0002217670 00000 n -0000054484 00000 n -0000054517 00000 n -0001630571 00000 n -0002217571 00000 n -0000054573 00000 n -0000054614 00000 n -0001630823 00000 n -0002217472 00000 n +0001634350 00000 n +0002498019 00000 n +0000050031 00000 n +0000050087 00000 n +0001637517 00000 n +0002497920 00000 n +0000050144 00000 n +0000050194 00000 n +0001637643 00000 n +0002497821 00000 n +0000050251 00000 n +0000050299 00000 n +0001641035 00000 n +0002497737 00000 n +0000050356 00000 n +0000050407 00000 n +0001641161 00000 n +0002497638 00000 n +0000050459 00000 n +0000050505 00000 n +0001644801 00000 n +0002497498 00000 n +0000050557 00000 n +0000050633 00000 n +0001644927 00000 n +0002497414 00000 n +0000050690 00000 n +0000050756 00000 n +0001647578 00000 n +0002497315 00000 n +0000050813 00000 n +0000050856 00000 n +0001647703 00000 n +0002497231 00000 n +0000050913 00000 n +0000050962 00000 n +0001647829 00000 n +0002497132 00000 n +0000051014 00000 n +0000051064 00000 n +0001650903 00000 n +0002497033 00000 n +0000051116 00000 n +0000051190 00000 n +0001653812 00000 n +0002496934 00000 n +0000051242 00000 n +0000051295 00000 n +0001686131 00000 n +0002496793 00000 n +0000051347 00000 n +0000051387 00000 n +0001686257 00000 n +0002496709 00000 n +0000051444 00000 n +0000051506 00000 n +0001686383 00000 n +0002496610 00000 n +0000051563 00000 n +0000051655 00000 n +0001690266 00000 n +0002496511 00000 n +0000051712 00000 n +0000051822 00000 n +0001690392 00000 n +0002496412 00000 n +0000051879 00000 n +0000051945 00000 n +0001690517 00000 n +0002496313 00000 n +0000052002 00000 n +0000052087 00000 n +0001690643 00000 n +0002496214 00000 n +0000052144 00000 n +0000052234 00000 n +0001690769 00000 n +0002496115 00000 n +0000052291 00000 n +0000052399 00000 n +0001694287 00000 n +0002496016 00000 n +0000052456 00000 n +0000052538 00000 n +0001694413 00000 n +0002495917 00000 n +0000052595 00000 n +0000052667 00000 n +0001694538 00000 n +0002495818 00000 n +0000052725 00000 n +0000052789 00000 n +0001694664 00000 n +0002495719 00000 n +0000052847 00000 n +0000052952 00000 n +0001694790 00000 n +0002495620 00000 n +0000053010 00000 n +0000053085 00000 n +0001694916 00000 n +0002495521 00000 n +0000053143 00000 n +0000053182 00000 n +0001698316 00000 n +0002495422 00000 n +0000053240 00000 n +0000053322 00000 n +0001703399 00000 n +0002495323 00000 n +0000053380 00000 n +0000053468 00000 n +0001703525 00000 n +0002495224 00000 n +0000053526 00000 n +0000053609 00000 n +0001703651 00000 n +0002495125 00000 n +0000053667 00000 n +0000053757 00000 n +0001703777 00000 n +0002495026 00000 n +0000053815 00000 n +0000053932 00000 n +0001703903 00000 n +0002494942 00000 n +0000053990 00000 n +0000054088 00000 n +0001704801 00000 n +0002494858 00000 n +0000054140 00000 n +0000054209 00000 n +0001837099 00000 n +0002494719 00000 n +0000054258 00000 n +0000054303 00000 n +0001837225 00000 n +0002494635 00000 n +0000054354 00000 n +0000054401 00000 n +0001837351 00000 n +0002494536 00000 n +0000054452 00000 n +0000054488 00000 n +0001840392 00000 n +0002494396 00000 n +0000054539 00000 n +0000054581 00000 n +0001840518 00000 n +0002494312 00000 n +0000054637 00000 n 0000054670 00000 n -0000054711 00000 n -0001630949 00000 n -0002217373 00000 n +0001840644 00000 n +0002494213 00000 n +0000054726 00000 n 0000054767 00000 n -0000054802 00000 n -0001634755 00000 n -0002217289 00000 n -0000054858 00000 n -0000054894 00000 n -0001634881 00000 n -0002217149 00000 n -0000054945 00000 n -0000055002 00000 n -0001635007 00000 n -0002217065 00000 n -0000055058 00000 n -0000055096 00000 n -0001635133 00000 n -0002216981 00000 n -0000055152 00000 n -0000055185 00000 n -0001635259 00000 n -0002216897 00000 n -0000055236 00000 n -0000055275 00000 n -0001638656 00000 n -0002216758 00000 n -0000055324 00000 n -0000055386 00000 n -0001638780 00000 n -0002216674 00000 n -0000055437 00000 n -0000055484 00000 n -0001638904 00000 n -0002216575 00000 n -0000055535 00000 n -0000055573 00000 n -0001639030 00000 n -0002216435 00000 n -0000055624 00000 n -0000055671 00000 n -0001643004 00000 n -0002216366 00000 n +0001840897 00000 n +0002494114 00000 n +0000054823 00000 n +0000054864 00000 n +0001843956 00000 n +0002494015 00000 n +0000054920 00000 n +0000054955 00000 n +0001844082 00000 n +0002493931 00000 n +0000055011 00000 n +0000055047 00000 n +0001847251 00000 n +0002493806 00000 n +0000055098 00000 n +0000055155 00000 n +0001847377 00000 n +0002493722 00000 n +0000055211 00000 n +0000055249 00000 n +0001847502 00000 n +0002493638 00000 n +0000055305 00000 n +0000055338 00000 n +0001850251 00000 n +0002493499 00000 n +0000055387 00000 n +0000055442 00000 n +0001850377 00000 n +0002493415 00000 n +0000055493 00000 n +0000055540 00000 n +0001853920 00000 n +0002493316 00000 n +0000055591 00000 n +0000055629 00000 n +0001854046 00000 n +0002493176 00000 n +0000055680 00000 n 0000055727 00000 n -0000055766 00000 n -0001643130 00000 n -0002216226 00000 n -0000055817 00000 n -0000055860 00000 n -0001643256 00000 n -0002216142 00000 n +0001857593 00000 n +0002493107 00000 n +0000055783 00000 n +0000055822 00000 n +0001857719 00000 n +0002492967 00000 n +0000055873 00000 n 0000055916 00000 n -0000055976 00000 n -0001647425 00000 n -0002216043 00000 n +0001857845 00000 n +0002492883 00000 n +0000055972 00000 n 0000056032 00000 n -0000056095 00000 n -0001647551 00000 n -0002215944 00000 n +0001857970 00000 n +0002492784 00000 n +0000056088 00000 n 0000056151 00000 n -0000056198 00000 n -0001647677 00000 n -0002215845 00000 n +0001861657 00000 n +0002492685 00000 n +0000056207 00000 n 0000056254 00000 n -0000056314 00000 n -0001651985 00000 n -0002215746 00000 n +0001861783 00000 n +0002492586 00000 n +0000056310 00000 n 0000056370 00000 n +0001865588 00000 n +0002492487 00000 n 0000056426 00000 n -0001652111 00000 n -0002215662 00000 n 0000056482 00000 n -0000056524 00000 n -0001652237 00000 n -0002215522 00000 n -0000056575 00000 n +0001865714 00000 n +0002492403 00000 n +0000056538 00000 n +0000056580 00000 n +0001865840 00000 n +0002492263 00000 n 0000056631 00000 n -0001652363 00000 n -0002215438 00000 n 0000056687 00000 n -0000056727 00000 n -0001656845 00000 n -0002215339 00000 n +0001865966 00000 n +0002492179 00000 n +0000056743 00000 n 0000056783 00000 n -0000056823 00000 n -0001656971 00000 n -0002215214 00000 n +0001869746 00000 n +0002492080 00000 n +0000056839 00000 n 0000056879 00000 n -0000056925 00000 n -0001657095 00000 n -0002215130 00000 n -0000056986 00000 n -0000057043 00000 n -0001659917 00000 n -0002215031 00000 n -0000057104 00000 n -0000057204 00000 n -0001660043 00000 n -0002214932 00000 n -0000057265 00000 n -0000057313 00000 n -0001664210 00000 n -0002214833 00000 n -0000057374 00000 n -0000057422 00000 n -0001664336 00000 n -0002214734 00000 n -0000057483 00000 n -0000057552 00000 n -0001664461 00000 n -0002214635 00000 n -0000057613 00000 n -0000057684 00000 n -0001667267 00000 n -0002214536 00000 n -0000057745 00000 n -0000057805 00000 n -0001673992 00000 n -0002214452 00000 n -0000057866 00000 n -0000057921 00000 n -0001680814 00000 n -0002214353 00000 n -0000057972 00000 n -0000058008 00000 n -0001680939 00000 n -0002214269 00000 n -0000058059 00000 n -0000058098 00000 n -0001685044 00000 n -0002214130 00000 n -0000058147 00000 n -0000058198 00000 n -0001685170 00000 n -0002214046 00000 n -0000058249 00000 n -0000058296 00000 n -0001685296 00000 n -0002213947 00000 n -0000058347 00000 n -0000058401 00000 n -0001685421 00000 n -0002213807 00000 n -0000058452 00000 n -0000058503 00000 n -0001685547 00000 n -0002213738 00000 n -0000058559 00000 n -0000058624 00000 n -0001693534 00000 n -0002213598 00000 n -0000058675 00000 n -0000058727 00000 n -0001697773 00000 n -0002213529 00000 n -0000058783 00000 n -0000058852 00000 n -0001697899 00000 n -0002213445 00000 n -0000058903 00000 n -0000058942 00000 n -0001701745 00000 n -0002213306 00000 n -0000058991 00000 n -0000059042 00000 n -0001701871 00000 n -0002213222 00000 n -0000059093 00000 n -0000059140 00000 n -0001701996 00000 n -0002213082 00000 n -0000059191 00000 n -0000059254 00000 n -0001707068 00000 n -0002212998 00000 n -0000059310 00000 n -0000059360 00000 n -0001707194 00000 n -0002212858 00000 n -0000059416 00000 n -0000059474 00000 n -0001711687 00000 n -0002212789 00000 n -0000059535 00000 n -0000059582 00000 n -0001711813 00000 n -0002212664 00000 n -0000059638 00000 n -0000059708 00000 n -0001711939 00000 n -0002212595 00000 n -0000059769 00000 n -0000059836 00000 n -0001716601 00000 n -0002212455 00000 n -0000059887 00000 n -0000059943 00000 n -0001720434 00000 n -0002212371 00000 n -0000059999 00000 n -0000060048 00000 n -0001720560 00000 n -0002212272 00000 n -0000060104 00000 n -0000060148 00000 n -0001720686 00000 n -0002212188 00000 n -0000060204 00000 n -0000060241 00000 n -0001720812 00000 n -0002212089 00000 n -0000060292 00000 n -0000060362 00000 n -0001723889 00000 n -0002211964 00000 n -0000060413 00000 n -0000060452 00000 n -0001724015 00000 n -0002211895 00000 n -0000060508 00000 n -0000060556 00000 n -0001726903 00000 n -0002211756 00000 n -0000060605 00000 n -0000060655 00000 n -0001727029 00000 n -0002211672 00000 n -0000060706 00000 n -0000060753 00000 n -0001727155 00000 n -0002211532 00000 n -0000060804 00000 n +0001869872 00000 n +0002491955 00000 n +0000056935 00000 n +0000056981 00000 n +0001872284 00000 n +0002491871 00000 n +0000057042 00000 n +0000057142 00000 n +0001872410 00000 n +0002491772 00000 n +0000057203 00000 n +0000057251 00000 n +0001876069 00000 n +0002491673 00000 n +0000057312 00000 n +0000057360 00000 n +0001876322 00000 n +0002491574 00000 n +0000057421 00000 n +0000057490 00000 n +0001878602 00000 n +0002491475 00000 n +0000057551 00000 n +0000057622 00000 n +0001880760 00000 n +0002491376 00000 n +0000057683 00000 n +0000057743 00000 n +0001887022 00000 n +0002491292 00000 n +0000057804 00000 n +0000057859 00000 n +0001893654 00000 n +0002491193 00000 n +0000057910 00000 n +0000057946 00000 n +0001893779 00000 n +0002491068 00000 n +0000057997 00000 n +0000058036 00000 n +0001895168 00000 n +0002490999 00000 n +0000058092 00000 n +0000058140 00000 n +0001898531 00000 n +0002490860 00000 n +0000058189 00000 n +0000058240 00000 n +0001898657 00000 n +0002490776 00000 n +0000058291 00000 n +0000058338 00000 n +0001898783 00000 n +0002490677 00000 n +0000058389 00000 n +0000058443 00000 n +0001902379 00000 n +0002490537 00000 n +0000058494 00000 n +0000058545 00000 n +0001902505 00000 n +0002490468 00000 n +0000058601 00000 n +0000058666 00000 n +0001906535 00000 n +0002490328 00000 n +0000058717 00000 n +0000058769 00000 n +0001911048 00000 n +0002490259 00000 n +0000058825 00000 n +0000058894 00000 n +0001912579 00000 n +0002490175 00000 n +0000058945 00000 n +0000058984 00000 n +0001915925 00000 n +0002490036 00000 n +0000059033 00000 n +0000059084 00000 n +0001916051 00000 n +0002489952 00000 n +0000059135 00000 n +0000059182 00000 n +0001916177 00000 n +0002489812 00000 n +0000059233 00000 n +0000059296 00000 n +0001920567 00000 n +0002489728 00000 n +0000059352 00000 n +0000059402 00000 n +0001920693 00000 n +0002489588 00000 n +0000059458 00000 n +0000059516 00000 n +0001925064 00000 n +0002489519 00000 n +0000059577 00000 n +0000059624 00000 n +0001925190 00000 n +0002489394 00000 n +0000059680 00000 n +0000059750 00000 n +0001929017 00000 n +0002489325 00000 n +0000059811 00000 n +0000059878 00000 n +0001933070 00000 n +0002489185 00000 n +0000059929 00000 n +0000059985 00000 n +0001933196 00000 n +0002489101 00000 n +0000060041 00000 n +0000060090 00000 n +0001936467 00000 n +0002489002 00000 n +0000060146 00000 n +0000060190 00000 n +0001936592 00000 n +0002488918 00000 n +0000060246 00000 n +0000060283 00000 n +0001936718 00000 n +0002488819 00000 n +0000060334 00000 n +0000060404 00000 n +0001939746 00000 n +0002488694 00000 n +0000060455 00000 n +0000060494 00000 n +0001939872 00000 n +0002488625 00000 n +0000060550 00000 n +0000060598 00000 n +0001942444 00000 n +0002488486 00000 n +0000060647 00000 n +0000060697 00000 n +0001942570 00000 n +0002488402 00000 n +0000060748 00000 n +0000060795 00000 n +0001942696 00000 n +0002488262 00000 n 0000060846 00000 n -0001727281 00000 n -0002211407 00000 n -0000060902 00000 n -0000060970 00000 n -0001727407 00000 n -0002211323 00000 n -0000061031 00000 n -0000061083 00000 n -0001730819 00000 n -0002211224 00000 n -0000061144 00000 n -0000061203 00000 n -0001730945 00000 n -0002211125 00000 n -0000061264 00000 n -0000061350 00000 n -0001731071 00000 n -0002211041 00000 n -0000061411 00000 n -0000061474 00000 n -0001734842 00000 n -0002210901 00000 n -0000061530 00000 n -0000061606 00000 n -0001734968 00000 n -0002210817 00000 n -0000061667 00000 n -0000061726 00000 n -0001744319 00000 n -0002210718 00000 n -0000061787 00000 n -0000061840 00000 n -0001744445 00000 n -0002210634 00000 n -0000061901 00000 n -0000061959 00000 n -0001750614 00000 n -0002210535 00000 n -0000062015 00000 n -0000062103 00000 n -0001754443 00000 n -0002210410 00000 n -0000062159 00000 n -0000062242 00000 n -0001754569 00000 n -0002210326 00000 n -0000062303 00000 n -0000062369 00000 n -0001755135 00000 n -0002210227 00000 n -0000062430 00000 n -0000062474 00000 n -0001758967 00000 n -0002210128 00000 n -0000062535 00000 n +0000060888 00000 n +0001942822 00000 n +0002488137 00000 n +0000060944 00000 n +0000061012 00000 n +0001945918 00000 n +0002488053 00000 n +0000061073 00000 n +0000061125 00000 n +0001946044 00000 n +0002487954 00000 n +0000061186 00000 n +0000061245 00000 n +0001948625 00000 n +0002487855 00000 n +0000061306 00000 n +0000061392 00000 n +0001948751 00000 n +0002487771 00000 n +0000061453 00000 n +0000061516 00000 n +0001952718 00000 n +0002487631 00000 n +0000061572 00000 n +0000061648 00000 n +0001952844 00000 n +0002487547 00000 n +0000061709 00000 n +0000061768 00000 n +0001960232 00000 n +0002487448 00000 n +0000061829 00000 n +0000061882 00000 n +0001960356 00000 n +0002487364 00000 n +0000061943 00000 n +0000062001 00000 n +0001968337 00000 n +0002487265 00000 n +0000062057 00000 n +0000062145 00000 n +0001968463 00000 n +0002487140 00000 n +0000062201 00000 n +0000062284 00000 n +0001971227 00000 n +0002487056 00000 n +0000062345 00000 n +0000062411 00000 n +0001971793 00000 n +0002486957 00000 n +0000062472 00000 n +0000062516 00000 n +0001971919 00000 n +0002486858 00000 n 0000062577 00000 n -0001759093 00000 n -0002210044 00000 n -0000062638 00000 n -0000062675 00000 n -0001759219 00000 n -0002209945 00000 n -0000062726 00000 n -0000062770 00000 n -0001759345 00000 n -0002209846 00000 n -0000062821 00000 n -0000062879 00000 n -0001763429 00000 n -0002209706 00000 n -0000062930 00000 n -0000062989 00000 n -0001763555 00000 n -0002209581 00000 n -0000063045 00000 n -0000063089 00000 n -0001763681 00000 n -0002209512 00000 n -0000063150 00000 n -0000063229 00000 n -0001763807 00000 n -0002209413 00000 n -0000063285 00000 n -0000063339 00000 n -0001772341 00000 n -0002209329 00000 n -0000063395 00000 n -0000063441 00000 n -0001780665 00000 n -0002209204 00000 n -0000063492 00000 n -0000063531 00000 n -0001780791 00000 n -0002209120 00000 n -0000063587 00000 n -0000063696 00000 n -0001784674 00000 n -0002209021 00000 n -0000063752 00000 n -0000063808 00000 n -0001784800 00000 n -0002208937 00000 n -0000063864 00000 n -0000063920 00000 n -0001790575 00000 n -0002208798 00000 n -0000063969 00000 n -0000064029 00000 n -0001790701 00000 n -0002208714 00000 n -0000064080 00000 n -0000064127 00000 n -0001794912 00000 n -0002208574 00000 n -0000064178 00000 n -0000064224 00000 n -0001795037 00000 n -0002208449 00000 n -0000064280 00000 n -0000064332 00000 n -0001799359 00000 n -0002208380 00000 n -0000064393 00000 n -0000064452 00000 n -0001811756 00000 n -0002208240 00000 n -0000064508 00000 n -0000064565 00000 n -0001811880 00000 n -0002208156 00000 n -0000064626 00000 n -0000064682 00000 n -0001812006 00000 n -0002208072 00000 n -0000064743 00000 n -0000064804 00000 n -0001819237 00000 n -0002207973 00000 n -0000064860 00000 n -0000064914 00000 n -0001819363 00000 n -0002207874 00000 n -0000064970 00000 n -0000065042 00000 n -0001823690 00000 n -0002207749 00000 n -0000065098 00000 n -0000065174 00000 n -0001827255 00000 n -0002207665 00000 n -0000065235 00000 n -0000065303 00000 n -0001827381 00000 n -0002207566 00000 n -0000065364 00000 n -0000065426 00000 n -0001829523 00000 n -0002207467 00000 n -0000065487 00000 n -0000065546 00000 n -0001829649 00000 n -0002207383 00000 n -0000065607 00000 n -0000065680 00000 n -0001829775 00000 n -0002207258 00000 n -0000065731 00000 n -0000065770 00000 n -0001829900 00000 n -0002207189 00000 n -0000065826 00000 n -0000065876 00000 n -0001834366 00000 n -0002207050 00000 n -0000065925 00000 n -0000065991 00000 n -0001834491 00000 n -0002206966 00000 n -0000066042 00000 n -0000066089 00000 n -0001834616 00000 n -0002206867 00000 n -0000066140 00000 n -0000066188 00000 n -0001838437 00000 n -0002206727 00000 n -0000066239 00000 n -0000066307 00000 n -0001838563 00000 n -0002206643 00000 n -0000066363 00000 n -0000066401 00000 n -0001841192 00000 n -0002206544 00000 n -0000066457 00000 n -0000066501 00000 n -0001841318 00000 n -0002206445 00000 n -0000066557 00000 n -0000066599 00000 n -0001841442 00000 n -0002206361 00000 n -0000066655 00000 n -0000066701 00000 n -0001845221 00000 n -0002206221 00000 n -0000066752 00000 n -0000066830 00000 n -0001849389 00000 n -0002206137 00000 n -0000066886 00000 n -0000066936 00000 n -0001849514 00000 n -0002206038 00000 n -0000066992 00000 n -0000067036 00000 n -0001854808 00000 n -0002205939 00000 n -0000067092 00000 n -0000067130 00000 n -0001854933 00000 n -0002205840 00000 n -0000067186 00000 n -0000067224 00000 n -0001855058 00000 n -0002205756 00000 n -0000067280 00000 n -0000067319 00000 n -0001858277 00000 n -0002205631 00000 n -0000067370 00000 n -0000067409 00000 n -0001858403 00000 n -0002205547 00000 n -0000067465 00000 n -0000067521 00000 n -0001858529 00000 n -0002205448 00000 n -0000067577 00000 n -0000067634 00000 n -0001858655 00000 n -0002205364 00000 n -0000067690 00000 n -0000067750 00000 n -0001863877 00000 n -0002205225 00000 n -0000067799 00000 n -0000067839 00000 n -0001864003 00000 n -0002205141 00000 n -0000067890 00000 n -0000067937 00000 n -0001864129 00000 n -0002205042 00000 n -0000067988 00000 n -0000068044 00000 n -0001864255 00000 n -0002204943 00000 n -0000068095 00000 n -0000068139 00000 n -0001867639 00000 n -0002204844 00000 n -0000068190 00000 n -0000068241 00000 n -0001867765 00000 n -0002204760 00000 n -0000068292 00000 n -0000068335 00000 n -0001869182 00000 n -0002204621 00000 n -0000068384 00000 n -0000068431 00000 n -0001869308 00000 n -0002204537 00000 n -0000068482 00000 n -0000068512 00000 n -0001869434 00000 n -0002204453 00000 n -0000068563 00000 n -0000068610 00000 n -0001870325 00000 n -0002204329 00000 n -0000068659 00000 n -0000068708 00000 n -0001870451 00000 n -0002204260 00000 n -0000068759 00000 n -0000068789 00000 n -0001871175 00000 n -0002204121 00000 n -0000068834 00000 n -0000068880 00000 n -0001873487 00000 n -0002203996 00000 n -0000068929 00000 n -0000068992 00000 n -0001873613 00000 n -0002203912 00000 n -0000069043 00000 n -0000069077 00000 n -0001873739 00000 n -0002203813 00000 n -0000069128 00000 n -0000069184 00000 n -0001873865 00000 n -0002203729 00000 n -0000069235 00000 n -0000069277 00000 n -0001877135 00000 n -0002203589 00000 n -0000069326 00000 n -0000069387 00000 n -0001877261 00000 n -0002203464 00000 n -0000069438 00000 n -0000069492 00000 n -0001877387 00000 n -0002203339 00000 n -0000069548 00000 n -0000069586 00000 n -0001881500 00000 n -0002203255 00000 n +0000062619 00000 n +0001975416 00000 n +0002486774 00000 n +0000062680 00000 n +0000062717 00000 n +0001975542 00000 n +0002486675 00000 n +0000062768 00000 n +0000062812 00000 n +0001975668 00000 n +0002486576 00000 n +0000062863 00000 n +0000062921 00000 n +0001979522 00000 n +0002486436 00000 n +0000062972 00000 n +0000063031 00000 n +0001979648 00000 n +0002486311 00000 n +0000063087 00000 n +0000063131 00000 n +0001979772 00000 n +0002486242 00000 n +0000063192 00000 n +0000063271 00000 n +0001983573 00000 n +0002486143 00000 n +0000063327 00000 n +0000063381 00000 n +0001987585 00000 n +0002486059 00000 n +0000063437 00000 n +0000063483 00000 n +0001998052 00000 n +0002485934 00000 n +0000063534 00000 n +0000063573 00000 n +0001998178 00000 n +0002485850 00000 n +0000063629 00000 n +0000063718 00000 n +0001998304 00000 n +0002485751 00000 n +0000063774 00000 n +0000063830 00000 n +0002001705 00000 n +0002485667 00000 n +0000063886 00000 n +0000063942 00000 n +0002007227 00000 n +0002485528 00000 n +0000063991 00000 n +0000064051 00000 n +0002007353 00000 n +0002485444 00000 n +0000064102 00000 n +0000064149 00000 n +0002011384 00000 n +0002485304 00000 n +0000064200 00000 n +0000064246 00000 n +0002011509 00000 n +0002485179 00000 n +0000064302 00000 n +0000064354 00000 n +0002015276 00000 n +0002485110 00000 n +0000064415 00000 n +0000064474 00000 n +0002027574 00000 n +0002484970 00000 n +0000064530 00000 n +0000064587 00000 n +0002030035 00000 n +0002484886 00000 n +0000064648 00000 n +0000064704 00000 n +0002030161 00000 n +0002484802 00000 n +0000064765 00000 n +0000064826 00000 n +0002035764 00000 n +0002484703 00000 n +0000064882 00000 n +0000064936 00000 n +0002035890 00000 n +0002484604 00000 n +0000064992 00000 n +0000065064 00000 n +0002040823 00000 n +0002484479 00000 n +0000065120 00000 n +0000065196 00000 n +0002043614 00000 n +0002484395 00000 n +0000065257 00000 n +0000065325 00000 n +0002043739 00000 n +0002484296 00000 n +0000065386 00000 n +0000065448 00000 n +0002045776 00000 n +0002484197 00000 n +0000065509 00000 n +0000065568 00000 n +0002045902 00000 n +0002484113 00000 n +0000065629 00000 n +0000065702 00000 n +0002046028 00000 n +0002483988 00000 n +0000065753 00000 n +0000065792 00000 n +0002046153 00000 n +0002483904 00000 n +0000065848 00000 n +0000065898 00000 n +0002048416 00000 n +0002483820 00000 n +0000065954 00000 n +0000066023 00000 n +0002052027 00000 n +0002483681 00000 n +0000066072 00000 n +0000066138 00000 n +0002052153 00000 n +0002483597 00000 n +0000066189 00000 n +0000066236 00000 n +0002052278 00000 n +0002483498 00000 n +0000066287 00000 n +0000066335 00000 n +0002055127 00000 n +0002483358 00000 n +0000066386 00000 n +0000066454 00000 n +0002055253 00000 n +0002483274 00000 n +0000066510 00000 n +0000066548 00000 n +0002058718 00000 n +0002483175 00000 n +0000066604 00000 n +0000066648 00000 n +0002058843 00000 n +0002483076 00000 n +0000066704 00000 n +0000066746 00000 n +0002061364 00000 n +0002482992 00000 n +0000066802 00000 n +0000066848 00000 n +0002065704 00000 n +0002482852 00000 n +0000066899 00000 n +0000066977 00000 n +0002069284 00000 n +0002482768 00000 n +0000067033 00000 n +0000067083 00000 n +0002069409 00000 n +0002482669 00000 n +0000067139 00000 n +0000067183 00000 n +0002074420 00000 n +0002482570 00000 n +0000067239 00000 n +0000067277 00000 n +0002074546 00000 n +0002482471 00000 n +0000067333 00000 n +0000067371 00000 n +0002074672 00000 n +0002482387 00000 n +0000067427 00000 n +0000067466 00000 n +0002077732 00000 n +0002482262 00000 n +0000067517 00000 n +0000067556 00000 n +0002077858 00000 n +0002482178 00000 n +0000067612 00000 n +0000067669 00000 n +0002077984 00000 n +0002482079 00000 n +0000067725 00000 n +0000067782 00000 n +0002078110 00000 n +0002481995 00000 n +0000067838 00000 n +0000067898 00000 n +0002083396 00000 n +0002481856 00000 n +0000067947 00000 n +0000067987 00000 n +0002083522 00000 n +0002481772 00000 n +0000068038 00000 n +0000068085 00000 n +0002083648 00000 n +0002481673 00000 n +0000068136 00000 n +0000068192 00000 n +0002087559 00000 n +0002481574 00000 n +0000068243 00000 n +0000068287 00000 n +0002087685 00000 n +0002481475 00000 n +0000068338 00000 n +0000068389 00000 n +0002087811 00000 n +0002481376 00000 n +0000068440 00000 n +0000068483 00000 n +0002089195 00000 n +0002481251 00000 n +0000068534 00000 n +0000068573 00000 n +0002089321 00000 n +0002481182 00000 n +0000068629 00000 n +0000068680 00000 n +0002090593 00000 n +0002481043 00000 n +0000068729 00000 n +0000068776 00000 n +0002090719 00000 n +0002480959 00000 n +0000068827 00000 n +0000068857 00000 n +0002090845 00000 n +0002480875 00000 n +0000068908 00000 n +0000068955 00000 n +0002091719 00000 n +0002480751 00000 n +0000069004 00000 n +0000069053 00000 n +0002091845 00000 n +0002480682 00000 n +0000069104 00000 n +0000069134 00000 n +0002092569 00000 n +0002480543 00000 n +0000069179 00000 n +0000069225 00000 n +0002095276 00000 n +0002480418 00000 n +0000069274 00000 n +0000069337 00000 n +0002095402 00000 n +0002480334 00000 n +0000069388 00000 n +0000069437 00000 n +0002098255 00000 n +0002480194 00000 n +0000069488 00000 n +0000069545 00000 n +0002098381 00000 n +0002480110 00000 n +0000069601 00000 n 0000069647 00000 n -0000069690 00000 n -0001881626 00000 n -0002203156 00000 n -0000069751 00000 n -0000069814 00000 n -0001885799 00000 n -0002203057 00000 n -0000069875 00000 n -0000069918 00000 n -0001885925 00000 n -0002202958 00000 n -0000069979 00000 n -0000070035 00000 n -0001886051 00000 n -0002202874 00000 n -0000070096 00000 n -0000070149 00000 n -0001889855 00000 n -0002202790 00000 n -0000070205 00000 n -0000070259 00000 n -0001891177 00000 n -0002202665 00000 n -0000070310 00000 n -0000070353 00000 n -0001891430 00000 n -0002202581 00000 n -0000070409 00000 n -0000070457 00000 n -0001894676 00000 n -0002202497 00000 n -0000070513 00000 n -0000070569 00000 n -0001899251 00000 n -0002202372 00000 n -0000070618 00000 n -0000070682 00000 n -0001899377 00000 n -0002202261 00000 n -0000070733 00000 n -0000070780 00000 n -0001899502 00000 n -0002202177 00000 n -0000070836 00000 n -0000070885 00000 n -0001903003 00000 n -0002202078 00000 n -0000070941 00000 n -0000070994 00000 n -0001907374 00000 n -0002201979 00000 n -0000071050 00000 n -0000071096 00000 n -0001907500 00000 n -0002201880 00000 n -0000071152 00000 n -0000071195 00000 n -0001907626 00000 n -0002201781 00000 n -0000071251 00000 n -0000071293 00000 n -0001911597 00000 n -0002201682 00000 n -0000071349 00000 n -0000071394 00000 n -0001911723 00000 n -0002201583 00000 n -0000071450 00000 n -0000071493 00000 n -0001911849 00000 n -0002201484 00000 n -0000071549 00000 n -0000071592 00000 n -0001911975 00000 n -0002201385 00000 n -0000071648 00000 n -0000071689 00000 n -0001912101 00000 n -0002201301 00000 n -0000071746 00000 n -0000071799 00000 n -0001912856 00000 n -0002201161 00000 n -0000071844 00000 n -0000071882 00000 n -0001915755 00000 n -0002201036 00000 n -0000071931 00000 n -0000071974 00000 n -0001915881 00000 n -0002200952 00000 n -0000072025 00000 n -0000072063 00000 n -0001916007 00000 n -0002200853 00000 n +0002100248 00000 n +0002480011 00000 n +0000069703 00000 n +0000069745 00000 n +0002103923 00000 n +0002479927 00000 n +0000069801 00000 n +0000069873 00000 n +0002108033 00000 n +0002479802 00000 n +0000069924 00000 n +0000069967 00000 n +0002108159 00000 n +0002479718 00000 n +0000070023 00000 n +0000070060 00000 n +0002108411 00000 n +0002479619 00000 n +0000070116 00000 n +0000070163 00000 n +0002108662 00000 n +0002479520 00000 n +0000070219 00000 n +0000070255 00000 n +0002112157 00000 n +0002479421 00000 n +0000070311 00000 n +0000070373 00000 n +0002112409 00000 n +0002479322 00000 n +0000070429 00000 n +0000070465 00000 n +0002112534 00000 n +0002479197 00000 n +0000070521 00000 n +0000070553 00000 n +0002112660 00000 n +0002479113 00000 n +0000070614 00000 n +0000070654 00000 n +0002115845 00000 n +0002479014 00000 n +0000070715 00000 n +0000070769 00000 n +0002117317 00000 n +0002478930 00000 n +0000070830 00000 n +0000070878 00000 n +0002119891 00000 n +0002478790 00000 n +0000070927 00000 n +0000070988 00000 n +0002120017 00000 n +0002478665 00000 n +0000071039 00000 n +0000071093 00000 n +0002120143 00000 n +0002478540 00000 n +0000071149 00000 n +0000071187 00000 n +0002126989 00000 n +0002478456 00000 n +0000071248 00000 n +0000071291 00000 n +0002127115 00000 n +0002478357 00000 n +0000071352 00000 n +0000071415 00000 n +0002130322 00000 n +0002478258 00000 n +0000071476 00000 n +0000071519 00000 n +0002130448 00000 n +0002478159 00000 n +0000071580 00000 n +0000071636 00000 n +0002130574 00000 n +0002478075 00000 n +0000071697 00000 n +0000071750 00000 n +0002130700 00000 n +0002477991 00000 n +0000071806 00000 n +0000071860 00000 n +0002134086 00000 n +0002477866 00000 n +0000071911 00000 n +0000071954 00000 n +0002134338 00000 n +0002477782 00000 n +0000072010 00000 n +0000072058 00000 n +0002138111 00000 n +0002477698 00000 n 0000072114 00000 n -0000072151 00000 n -0001920013 00000 n -0002200754 00000 n -0000072202 00000 n -0000072237 00000 n -0001933950 00000 n -0002200670 00000 n -0000072288 00000 n +0000072172 00000 n +0002143362 00000 n +0002477573 00000 n +0000072221 00000 n +0000072285 00000 n +0002143488 00000 n +0002477462 00000 n 0000072336 00000 n -0001937777 00000 n -0002200530 00000 n -0000072385 00000 n -0000072445 00000 n -0001937903 00000 n -0002200446 00000 n -0000072496 00000 n -0000072539 00000 n -0001938029 00000 n -0002200347 00000 n -0000072590 00000 n -0000072685 00000 n -0001943371 00000 n -0002200248 00000 n -0000072736 00000 n -0000072773 00000 n -0001943497 00000 n -0002200149 00000 n -0000072824 00000 n -0000072885 00000 n -0001946951 00000 n -0002200065 00000 n -0000072936 00000 n -0000072994 00000 n -0001950944 00000 n -0002199940 00000 n -0000073043 00000 n -0000073081 00000 n -0001951070 00000 n -0002199856 00000 n -0000073132 00000 n -0000073170 00000 n -0001951196 00000 n -0002199757 00000 n -0000073221 00000 n -0000073259 00000 n -0001951322 00000 n -0002199658 00000 n -0000073310 00000 n -0000073348 00000 n -0001955198 00000 n -0002199559 00000 n -0000073399 00000 n -0000073440 00000 n -0001955323 00000 n -0002199460 00000 n -0000073491 00000 n -0000073547 00000 n -0001955449 00000 n -0002199376 00000 n -0000073598 00000 n -0000073631 00000 n -0001956193 00000 n -0002199251 00000 n -0000073676 00000 n -0000073710 00000 n -0001960819 00000 n -0002199126 00000 n -0000073759 00000 n -0000073803 00000 n -0001960945 00000 n -0002199001 00000 n -0000073854 00000 n -0000073912 00000 n -0001961071 00000 n -0002198917 00000 n -0000073968 00000 n -0000074008 00000 n -0001961197 00000 n -0002198792 00000 n -0000074064 00000 n -0000074115 00000 n -0001961323 00000 n -0002198708 00000 n -0000074176 00000 n -0000074223 00000 n -0001961449 00000 n -0002198624 00000 n -0000074284 00000 n -0000074328 00000 n -0001966144 00000 n -0002198525 00000 n -0000074379 00000 n -0000074450 00000 n -0001966270 00000 n -0002198426 00000 n -0000074501 00000 n -0000074558 00000 n -0001966396 00000 n -0002198286 00000 n -0000074609 00000 n -0000074656 00000 n -0001969220 00000 n -0002198176 00000 n -0000074712 00000 n -0000074785 00000 n -0001969346 00000 n -0002198092 00000 n -0000074846 00000 n -0000074919 00000 n -0001969472 00000 n -0002198008 00000 n -0000074980 00000 n -0000075053 00000 n -0001972552 00000 n -0002197868 00000 n -0000075104 00000 n -0000075156 00000 n -0001972678 00000 n -0002197784 00000 n -0000075212 00000 n +0000072383 00000 n +0002143614 00000 n +0002477378 00000 n +0000072439 00000 n +0000072488 00000 n +0002146522 00000 n +0002477279 00000 n +0000072544 00000 n +0000072597 00000 n +0002150102 00000 n +0002477180 00000 n +0000072653 00000 n +0000072699 00000 n +0002150227 00000 n +0002477081 00000 n +0000072755 00000 n +0000072798 00000 n +0002153507 00000 n +0002476982 00000 n +0000072854 00000 n +0000072896 00000 n +0002153633 00000 n +0002476883 00000 n +0000072952 00000 n +0000072997 00000 n +0002153757 00000 n +0002476784 00000 n +0000073053 00000 n +0000073096 00000 n +0002156761 00000 n +0002476685 00000 n +0000073152 00000 n +0000073195 00000 n +0002156887 00000 n +0002476586 00000 n +0000073251 00000 n +0000073292 00000 n +0002157013 00000 n +0002476502 00000 n +0000073349 00000 n +0000073402 00000 n +0002157754 00000 n +0002476362 00000 n +0000073447 00000 n +0000073485 00000 n +0002160230 00000 n +0002476237 00000 n +0000073534 00000 n +0000073577 00000 n +0002160356 00000 n +0002476153 00000 n +0000073628 00000 n +0000073666 00000 n +0002160482 00000 n +0002476054 00000 n +0000073717 00000 n +0000073754 00000 n +0002163909 00000 n +0002475970 00000 n +0000073805 00000 n +0000073840 00000 n +0002181766 00000 n +0002475830 00000 n +0000073889 00000 n +0000073949 00000 n +0002181892 00000 n +0002475705 00000 n +0000074000 00000 n +0000074043 00000 n +0002182018 00000 n +0002475621 00000 n +0000074099 00000 n +0000074154 00000 n +0002182144 00000 n +0002475522 00000 n +0000074210 00000 n +0000074245 00000 n +0002185563 00000 n +0002475423 00000 n +0000074301 00000 n +0000074337 00000 n +0002185689 00000 n +0002475298 00000 n +0000074393 00000 n +0000074448 00000 n +0002185814 00000 n +0002475214 00000 n +0000074509 00000 n +0000074588 00000 n +0002190181 00000 n +0002475130 00000 n +0000074649 00000 n +0000074728 00000 n +0002190307 00000 n +0002475031 00000 n +0000074779 00000 n +0000074816 00000 n +0002190433 00000 n +0002474932 00000 n +0000074867 00000 n +0000074928 00000 n +0002193968 00000 n +0002474848 00000 n +0000074979 00000 n +0000075037 00000 n +0002197423 00000 n +0002474723 00000 n +0000075086 00000 n +0000075124 00000 n +0002197549 00000 n +0002474639 00000 n +0000075175 00000 n +0000075213 00000 n +0002197675 00000 n +0002474540 00000 n 0000075264 00000 n -0001975295 00000 n -0002197700 00000 n -0000075320 00000 n -0000075384 00000 n -0001975420 00000 n -0002197616 00000 n -0000075435 00000 n -0000075474 00000 n -0001979080 00000 n -0002197476 00000 n -0000075523 00000 n -0000075558 00000 n -0001979206 00000 n -0002197392 00000 n -0000075609 00000 n -0000075639 00000 n -0001979332 00000 n -0002197293 00000 n -0000075690 00000 n -0000075724 00000 n -0001979458 00000 n -0002197194 00000 n -0000075775 00000 n -0000075805 00000 n -0001981111 00000 n -0002197095 00000 n -0000075856 00000 n -0000075907 00000 n -0001983696 00000 n -0002196955 00000 n -0000075958 00000 n -0000075987 00000 n -0001983822 00000 n -0002196886 00000 n -0000076043 00000 n -0000076092 00000 n -0001983948 00000 n -0002196761 00000 n -0000076143 00000 n -0000076176 00000 n -0001984073 00000 n -0002196677 00000 n -0000076232 00000 n -0000076280 00000 n -0001984199 00000 n -0002196593 00000 n -0000076336 00000 n -0000076384 00000 n -0001989046 00000 n -0002196453 00000 n -0000076433 00000 n -0000076485 00000 n -0001989172 00000 n -0002196369 00000 n -0000076536 00000 n -0000076580 00000 n -0001989298 00000 n -0002196229 00000 n -0000076631 00000 n -0000076667 00000 n -0001989424 00000 n -0002196145 00000 n -0000076723 00000 n -0000076826 00000 n -0001993992 00000 n -0002196046 00000 n -0000076882 00000 n -0000076990 00000 n -0001994118 00000 n -0002195962 00000 n -0000077046 00000 n -0000077136 00000 n -0001994244 00000 n -0002195822 00000 n -0000077187 00000 n -0000077235 00000 n -0001994370 00000 n -0002195738 00000 n -0000077291 00000 n -0000077357 00000 n -0001994496 00000 n -0002195639 00000 n -0000077413 00000 n -0000077480 00000 n -0001998545 00000 n -0002195540 00000 n -0000077536 00000 n -0000077595 00000 n -0001998671 00000 n -0002195441 00000 n -0000077651 00000 n -0000077705 00000 n -0001998797 00000 n -0002195342 00000 n -0000077761 00000 n -0000077819 00000 n -0001998922 00000 n -0002195258 00000 n -0000077875 00000 n -0000077920 00000 n -0001999048 00000 n -0002195118 00000 n -0000077971 00000 n -0000078012 00000 n -0002002854 00000 n -0002195049 00000 n -0000078068 00000 n -0000078113 00000 n -0002002980 00000 n -0002194950 00000 n -0000078164 00000 n -0000078217 00000 n -0002003105 00000 n -0002194866 00000 n -0000078268 00000 n -0000078308 00000 n -0002006605 00000 n -0002194725 00000 n -0000078357 00000 n -0000078405 00000 n -0002006731 00000 n -0002194641 00000 n -0000078456 00000 n -0000078493 00000 n -0002006857 00000 n -0002194542 00000 n -0000078544 00000 n +0000075302 00000 n +0002197801 00000 n +0002474441 00000 n +0000075353 00000 n +0000075391 00000 n +0002201125 00000 n +0002474342 00000 n +0000075442 00000 n +0000075483 00000 n +0002202835 00000 n +0002474243 00000 n +0000075534 00000 n +0000075590 00000 n +0002202961 00000 n +0002474159 00000 n +0000075641 00000 n +0000075674 00000 n +0002203691 00000 n +0002474034 00000 n +0000075719 00000 n +0000075753 00000 n +0002207009 00000 n +0002473909 00000 n +0000075802 00000 n +0000075846 00000 n +0002207135 00000 n +0002473784 00000 n +0000075897 00000 n +0000075955 00000 n +0002207261 00000 n +0002473700 00000 n +0000076011 00000 n +0000076051 00000 n +0002207387 00000 n +0002473575 00000 n +0000076107 00000 n +0000076158 00000 n +0002207513 00000 n +0002473491 00000 n +0000076219 00000 n +0000076266 00000 n +0002207639 00000 n +0002473407 00000 n +0000076327 00000 n +0000076371 00000 n +0002212440 00000 n +0002473308 00000 n +0000076422 00000 n +0000076493 00000 n +0002214660 00000 n +0002473209 00000 n +0000076544 00000 n +0000076601 00000 n +0002214786 00000 n +0002473069 00000 n +0000076652 00000 n +0000076699 00000 n +0002216962 00000 n +0002472959 00000 n +0000076755 00000 n +0000076828 00000 n +0002217088 00000 n +0002472875 00000 n +0000076889 00000 n +0000076962 00000 n +0002219695 00000 n +0002472791 00000 n +0000077023 00000 n +0000077096 00000 n +0002219821 00000 n +0002472666 00000 n +0000077147 00000 n +0000077199 00000 n +0002219947 00000 n +0002472582 00000 n +0000077255 00000 n +0000077307 00000 n +0002223871 00000 n +0002472498 00000 n +0000077363 00000 n +0000077427 00000 n +0002226904 00000 n +0002472358 00000 n +0000077476 00000 n +0000077511 00000 n +0002227030 00000 n +0002472274 00000 n +0000077562 00000 n +0000077592 00000 n +0002227156 00000 n +0002472175 00000 n +0000077643 00000 n +0000077677 00000 n +0002227281 00000 n +0002472076 00000 n +0000077728 00000 n +0000077758 00000 n +0002231016 00000 n +0002471977 00000 n +0000077809 00000 n +0000077860 00000 n +0002231142 00000 n +0002471837 00000 n +0000077911 00000 n +0000077940 00000 n +0002231268 00000 n +0002471768 00000 n +0000077996 00000 n +0000078045 00000 n +0002231394 00000 n +0002471643 00000 n +0000078096 00000 n +0000078129 00000 n +0002231520 00000 n +0002471559 00000 n +0000078185 00000 n +0000078233 00000 n +0002233057 00000 n +0002471475 00000 n +0000078289 00000 n +0000078337 00000 n +0002236838 00000 n +0002471335 00000 n +0000078386 00000 n +0000078438 00000 n +0002236964 00000 n +0002471251 00000 n +0000078489 00000 n +0000078533 00000 n +0002237089 00000 n +0002471111 00000 n 0000078584 00000 n -0002006983 00000 n -0002194443 00000 n -0000078635 00000 n -0000078670 00000 n -0002010270 00000 n -0002194344 00000 n -0000078721 00000 n -0000078755 00000 n -0002010396 00000 n -0002194245 00000 n -0000078806 00000 n -0000078841 00000 n -0002010521 00000 n -0002194146 00000 n -0000078892 00000 n -0000078926 00000 n -0002010647 00000 n -0002194047 00000 n -0000078977 00000 n -0000079012 00000 n -0002010773 00000 n -0002193948 00000 n -0000079063 00000 n -0000079100 00000 n -0002014107 00000 n -0002193849 00000 n -0000079151 00000 n -0000079190 00000 n -0002014233 00000 n -0002193750 00000 n -0000079242 00000 n -0000079314 00000 n -0002014359 00000 n -0002193666 00000 n -0000079366 00000 n -0000079410 00000 n -0002015279 00000 n -0002193526 00000 n -0000079459 00000 n -0000079515 00000 n -0002015405 00000 n -0002193457 00000 n -0000079566 00000 n -0000079596 00000 n -0002024181 00000 n -0002193332 00000 n -0000079645 00000 n -0000079686 00000 n -0002024307 00000 n -0002193248 00000 n -0000079737 00000 n -0000079771 00000 n -0002024433 00000 n -0002193149 00000 n -0000079822 00000 n -0000079878 00000 n -0002024559 00000 n -0002193065 00000 n -0000079929 00000 n -0000079960 00000 n -0000080328 00000 n -0000080577 00000 n -0000080014 00000 n -0000080451 00000 n -0000080514 00000 n -0002182264 00000 n -0002167812 00000 n -0002182096 00000 n -0002167396 00000 n -0002164064 00000 n -0002167231 00000 n -0002183212 00000 n -0000083111 00000 n -0000082197 00000 n -0000080665 00000 n -0000083048 00000 n -0002163019 00000 n -0002144204 00000 n -0002162854 00000 n -0000082368 00000 n -0002143182 00000 n -0002126389 00000 n -0002143016 00000 n -0000082537 00000 n -0000082709 00000 n -0000082877 00000 n -0000096161 00000 n -0000087241 00000 n -0000083199 00000 n -0000096098 00000 n -0002124428 00000 n -0002108588 00000 n -0002124262 00000 n -0000087826 00000 n -0000088010 00000 n -0002108129 00000 n -0002106186 00000 n -0002107963 00000 n -0002104284 00000 n -0002102269 00000 n -0002104119 00000 n -0000088160 00000 n -0000088332 00000 n -0000088482 00000 n -0000088650 00000 n -0000088821 00000 n -0000088990 00000 n -0000089143 00000 n -0000089312 00000 n -0000089464 00000 n -0000089632 00000 n -0000089804 00000 n -0000089973 00000 n -0000090126 00000 n -0000090295 00000 n -0000090466 00000 n -0000090639 00000 n -0000090792 00000 n -0000090960 00000 n -0000091139 00000 n -0000091296 00000 n -0000091465 00000 n -0000091633 00000 n -0000091804 00000 n -0000091971 00000 n -0000092143 00000 n -0000092303 00000 n -0000092472 00000 n -0000092628 00000 n -0000092797 00000 n -0000092956 00000 n -0000093125 00000 n -0000093275 00000 n -0000093447 00000 n -0000093618 00000 n -0000093787 00000 n -0000093955 00000 n -0000094126 00000 n -0000094282 00000 n -0000094452 00000 n -0000094621 00000 n -0000094779 00000 n -0000094948 00000 n -0000095117 00000 n -0000095267 00000 n -0000095436 00000 n -0000095606 00000 n -0000095773 00000 n -0000095944 00000 n -0000298419 00000 n -0000314651 00000 n -0000324957 00000 n -0000329432 00000 n -0000362214 00000 n -0000409653 00000 n -0000432063 00000 n -0000473652 00000 n -0000480833 00000 n -0000485166 00000 n -0000556468 00000 n -0000626579 00000 n -0000639340 00000 n -0000697287 00000 n -0000744318 00000 n -0000109751 00000 n -0000100544 00000 n -0000096305 00000 n -0000109688 00000 n -0000101147 00000 n -0000101315 00000 n -0000101484 00000 n -0000101645 00000 n -0000101814 00000 n -0000101985 00000 n -0000102134 00000 n -0000102305 00000 n -0000102457 00000 n -0000102630 00000 n -0000102800 00000 n -0000102956 00000 n -0000103129 00000 n -0000103302 00000 n -0000103448 00000 n -0000103620 00000 n -0000103789 00000 n -0000103938 00000 n -0000104113 00000 n -0000104281 00000 n -0000104456 00000 n -0000104628 00000 n -0000104797 00000 n -0000104966 00000 n -0000105135 00000 n -0000105289 00000 n -0000105458 00000 n -0000105612 00000 n -0000105781 00000 n -0000105927 00000 n -0000106096 00000 n -0000106273 00000 n -0000106437 00000 n -0000106605 00000 n -0000106755 00000 n -0000106927 00000 n -0000107100 00000 n -0000107248 00000 n -0000107417 00000 n -0000107568 00000 n -0000107737 00000 n -0000107897 00000 n -0000108069 00000 n -0000108224 00000 n -0000108392 00000 n -0000108540 00000 n -0000108709 00000 n -0000108862 00000 n -0000109030 00000 n -0000109200 00000 n -0000109350 00000 n -0000109519 00000 n -0000759327 00000 n -0000774246 00000 n -0000780125 00000 n -0000941364 00000 n -0001626871 00000 n -0001638719 00000 n -0001685107 00000 n -0001701808 00000 n -0001726966 00000 n -0001790638 00000 n -0001834429 00000 n -0001863940 00000 n -0001869245 00000 n -0001870388 00000 n -0001873550 00000 n -0001877198 00000 n -0001899314 00000 n -0001915818 00000 n -0001937840 00000 n -0000115193 00000 n -0000111685 00000 n -0000109867 00000 n -0000115130 00000 n -0000111991 00000 n -0000112164 00000 n -0000112317 00000 n -0000112489 00000 n -0000112642 00000 n -0000112814 00000 n -0000112969 00000 n -0000113141 00000 n -0000113298 00000 n -0000113467 00000 n -0000113639 00000 n -0000113788 00000 n -0000113965 00000 n -0000114137 00000 n -0000114306 00000 n -0000114456 00000 n -0000114625 00000 n -0000114786 00000 n -0000114958 00000 n -0001951007 00000 n -0001960882 00000 n -0001979143 00000 n -0001989109 00000 n -0002006668 00000 n -0002015342 00000 n -0002024244 00000 n +0000078620 00000 n +0002237215 00000 n +0002471027 00000 n +0000078676 00000 n +0000078770 00000 n +0002241003 00000 n +0002470928 00000 n +0000078826 00000 n +0000078925 00000 n +0002241129 00000 n +0002470844 00000 n +0000078981 00000 n +0000079054 00000 n +0002244318 00000 n +0002470704 00000 n +0000079105 00000 n +0000079153 00000 n +0002244444 00000 n +0002470620 00000 n +0000079209 00000 n +0000079271 00000 n +0002244569 00000 n +0002470521 00000 n +0000079327 00000 n +0000079394 00000 n +0002244694 00000 n +0002470422 00000 n +0000079450 00000 n +0000079511 00000 n +0002244820 00000 n +0002470323 00000 n +0000079567 00000 n +0000079621 00000 n +0002244946 00000 n +0002470224 00000 n +0000079677 00000 n +0000079735 00000 n +0002248258 00000 n +0002470140 00000 n +0000079791 00000 n +0000079836 00000 n +0002248384 00000 n +0002470000 00000 n +0000079887 00000 n +0000079928 00000 n +0002248510 00000 n +0002469931 00000 n +0000079984 00000 n +0000080029 00000 n +0002248636 00000 n +0002469832 00000 n +0000080080 00000 n +0000080133 00000 n +0002251366 00000 n +0002469748 00000 n +0000080184 00000 n +0000080224 00000 n +0002254271 00000 n +0002469607 00000 n +0000080273 00000 n +0000080321 00000 n +0002254397 00000 n +0002469523 00000 n +0000080372 00000 n +0000080409 00000 n +0002254523 00000 n +0002469424 00000 n +0000080460 00000 n +0000080500 00000 n +0002257573 00000 n +0002469325 00000 n +0000080551 00000 n +0000080586 00000 n +0002257699 00000 n +0002469226 00000 n +0000080637 00000 n +0000080671 00000 n +0002257825 00000 n +0002469127 00000 n +0000080722 00000 n +0000080757 00000 n +0002257951 00000 n +0002469028 00000 n +0000080808 00000 n +0000080842 00000 n +0002261270 00000 n +0002468929 00000 n +0000080893 00000 n +0000080928 00000 n +0002261396 00000 n +0002468830 00000 n +0000080979 00000 n +0000081016 00000 n +0002261522 00000 n +0002468731 00000 n +0000081067 00000 n +0000081106 00000 n +0002261646 00000 n +0002468632 00000 n +0000081158 00000 n +0000081230 00000 n +0002261772 00000 n +0002468548 00000 n +0000081282 00000 n +0000081326 00000 n +0002264068 00000 n +0002468408 00000 n +0000081375 00000 n +0000081431 00000 n +0002264194 00000 n +0002468339 00000 n +0000081482 00000 n +0000081512 00000 n +0002271108 00000 n +0002468214 00000 n +0000081561 00000 n +0000081602 00000 n +0002271234 00000 n +0002468130 00000 n +0000081653 00000 n +0000081687 00000 n +0002274202 00000 n +0002468046 00000 n +0000081738 00000 n +0000081794 00000 n +0000082165 00000 n +0000082414 00000 n +0000081848 00000 n +0000082288 00000 n +0000082351 00000 n +0002455763 00000 n +0002441007 00000 n +0002455595 00000 n +0002440598 00000 n +0002436953 00000 n +0002440433 00000 n +0002456717 00000 n +0000084948 00000 n +0000084034 00000 n +0000082502 00000 n +0000084885 00000 n +0002435908 00000 n +0002417093 00000 n +0002435743 00000 n +0000084205 00000 n +0002416071 00000 n +0002399278 00000 n +0002415905 00000 n +0000084374 00000 n +0000084546 00000 n +0000084714 00000 n +0000086093 00000 n +0000085640 00000 n +0000085036 00000 n +0000085967 00000 n +0000086030 00000 n +0000085784 00000 n +0000091728 00000 n +0000088002 00000 n +0000086195 00000 n +0000091602 00000 n +0000091665 00000 n +0000088317 00000 n +0002397800 00000 n +0002395858 00000 n +0002397634 00000 n +0002393956 00000 n +0002391943 00000 n +0002393791 00000 n +0000088467 00000 n +0000088639 00000 n +0000088789 00000 n +0000088961 00000 n +0000089133 00000 n +0000089302 00000 n +0000089453 00000 n +0000089622 00000 n +0000089775 00000 n +0000089947 00000 n +0000090119 00000 n +0000090288 00000 n +0000090439 00000 n +0000090607 00000 n +0000090778 00000 n +0000090951 00000 n +0000091102 00000 n +0000091271 00000 n +0000091450 00000 n +0000307681 00000 n +0000323258 00000 n +0000334028 00000 n +0000338066 00000 n +0000371067 00000 n +0000454214 00000 n +0000478363 00000 n +0000098563 00000 n +0000093980 00000 n +0000091844 00000 n +0000098500 00000 n +0000094340 00000 n +0000094508 00000 n +0000094677 00000 n +0000094848 00000 n +0000095020 00000 n +0000095192 00000 n +0000095351 00000 n +0000095520 00000 n +0000095674 00000 n +0000095843 00000 n +0000096000 00000 n +0000096169 00000 n +0000096341 00000 n +0000096489 00000 n +0000096660 00000 n +0000096831 00000 n +0000097000 00000 n +0000097169 00000 n +0000097340 00000 n +0000097495 00000 n +0000097666 00000 n +0000097835 00000 n +0000097992 00000 n +0000098161 00000 n +0000098330 00000 n +0000520186 00000 n +0000529061 00000 n +0000533161 00000 n +0000623537 00000 n +0000701753 00000 n +0000724860 00000 n +0000105554 00000 n +0000100986 00000 n +0000098665 00000 n +0000105491 00000 n +0000101346 00000 n +0000101494 00000 n +0000101663 00000 n +0000101835 00000 n +0000102004 00000 n +0000102178 00000 n +0000102335 00000 n +0000102507 00000 n +0000102675 00000 n +0000102835 00000 n +0000103004 00000 n +0000103175 00000 n +0000103347 00000 n +0000103524 00000 n +0000103671 00000 n +0000103840 00000 n +0000103990 00000 n +0000104162 00000 n +0000104333 00000 n +0000104489 00000 n +0000104659 00000 n +0000104832 00000 n +0000105004 00000 n +0000105150 00000 n +0000105322 00000 n +0000790315 00000 n +0000841399 00000 n +0000857002 00000 n +0000884497 00000 n +0000890323 00000 n +0001050474 00000 n +0001837162 00000 n +0000112031 00000 n +0000107865 00000 n +0000105656 00000 n +0000111968 00000 n +0000108207 00000 n +0000108375 00000 n +0000108544 00000 n +0000108697 00000 n +0000108866 00000 n +0000109019 00000 n +0000109188 00000 n +0000109334 00000 n +0000109503 00000 n +0000109680 00000 n +0000109844 00000 n +0000110012 00000 n +0000110162 00000 n +0000110334 00000 n +0000110510 00000 n +0000110659 00000 n +0000110828 00000 n +0000110976 00000 n +0000111145 00000 n +0000111304 00000 n +0000111476 00000 n +0000111645 00000 n +0000111816 00000 n +0002456842 00000 n +0001898594 00000 n +0001915988 00000 n +0001942507 00000 n +0002007290 00000 n +0002052090 00000 n +0002083459 00000 n +0002090656 00000 n +0002091782 00000 n +0002095339 00000 n +0002119954 00000 n +0000118954 00000 n +0000114250 00000 n +0000112133 00000 n +0000118891 00000 n +0000114619 00000 n +0000114787 00000 n +0000114934 00000 n +0000115103 00000 n +0000115255 00000 n +0000115427 00000 n +0000115599 00000 n +0000115750 00000 n +0000115921 00000 n +0000116093 00000 n +0000116266 00000 n +0000116418 00000 n +0000116590 00000 n +0000116762 00000 n +0000116913 00000 n +0000117085 00000 n +0000117257 00000 n +0000117410 00000 n +0000117582 00000 n +0000117737 00000 n +0000117907 00000 n +0000118078 00000 n +0000118226 00000 n +0000118403 00000 n +0000118575 00000 n +0000118744 00000 n +0002143425 00000 n +0002160293 00000 n +0002181829 00000 n +0002197486 00000 n +0002207072 00000 n +0002226967 00000 n +0002236901 00000 n +0002254334 00000 n +0002264131 00000 n +0000120364 00000 n +0000119639 00000 n +0000119056 00000 n +0000120301 00000 n +0000119801 00000 n +0000119969 00000 n +0000120129 00000 n +0002271171 00000 n +0000129281 00000 n +0000123232 00000 n +0000120466 00000 n +0000129155 00000 n +0000129218 00000 n +0000123682 00000 n +0000123832 00000 n 0000123985 00000 n -0000118106 00000 n -0000115309 00000 n -0000123859 00000 n -0000123922 00000 n -0000118547 00000 n -0000118697 00000 n -0000118850 00000 n -0000119005 00000 n -0000119159 00000 n -0000119314 00000 n -0000119469 00000 n -0000119623 00000 n -0000119777 00000 n -0000119929 00000 n -0000120084 00000 n -0000120239 00000 n -0000120399 00000 n -0000120564 00000 n -0000120724 00000 n -0000120878 00000 n -0000121033 00000 n -0000121188 00000 n -0000121342 00000 n -0000121497 00000 n -0000121657 00000 n -0000121817 00000 n -0000121970 00000 n -0000122125 00000 n -0000122275 00000 n -0000122428 00000 n -0000122583 00000 n -0000122737 00000 n -0000122891 00000 n -0000123051 00000 n -0000123216 00000 n -0000123375 00000 n -0000123538 00000 n -0000123696 00000 n -0000135403 00000 n -0000127658 00000 n -0000124073 00000 n -0000135340 00000 n -0002101661 00000 n -0002091870 00000 n -0002101495 00000 n -0000128198 00000 n -0000128358 00000 n -0000128523 00000 n -0000128683 00000 n -0000128848 00000 n -0000129003 00000 n -0000129158 00000 n -0000129318 00000 n -0000129478 00000 n -0000129637 00000 n -0000129797 00000 n -0000129949 00000 n -0000130104 00000 n -0000130259 00000 n -0000130419 00000 n -0000130579 00000 n -0000130734 00000 n -0000130889 00000 n -0000131044 00000 n -0000131204 00000 n -0000131368 00000 n -0000131533 00000 n -0000131698 00000 n -0000131857 00000 n -0000132011 00000 n -0000132171 00000 n -0000132331 00000 n -0000132491 00000 n -0000132651 00000 n -0000132810 00000 n -0000132970 00000 n -0000133123 00000 n -0000133278 00000 n -0000133433 00000 n -0000133593 00000 n -0000133758 00000 n -0000133918 00000 n -0000134078 00000 n -0000134238 00000 n -0000134392 00000 n -0000134552 00000 n -0000134707 00000 n -0000134866 00000 n -0000135024 00000 n -0000135182 00000 n -0002183337 00000 n -0000146664 00000 n -0000138783 00000 n -0000135505 00000 n -0000146601 00000 n -0000139332 00000 n -0000139485 00000 n -0000139640 00000 n -0000139795 00000 n -0000139955 00000 n -0000140115 00000 n -0000140275 00000 n -0000140434 00000 n -0000140599 00000 n -0000140764 00000 n -0000140928 00000 n -0000141083 00000 n -0000141243 00000 n -0000141403 00000 n -0000141558 00000 n -0000141718 00000 n -0000141878 00000 n -0000142038 00000 n -0000142203 00000 n -0000142362 00000 n -0000142522 00000 n -0000142682 00000 n -0000142837 00000 n -0000142996 00000 n -0000143156 00000 n -0000143309 00000 n -0000143464 00000 n -0000143619 00000 n -0000143774 00000 n -0000143934 00000 n -0000144093 00000 n -0000144247 00000 n -0000144400 00000 n -0000144554 00000 n -0000144704 00000 n -0000144858 00000 n -0000145014 00000 n -0000145169 00000 n -0000145325 00000 n -0000145486 00000 n +0000124139 00000 n +0000124294 00000 n +0000124449 00000 n +0000124603 00000 n +0000124757 00000 n +0000124912 00000 n +0000125065 00000 n +0000125220 00000 n +0000125375 00000 n +0000125535 00000 n +0000125700 00000 n +0000125859 00000 n +0000126014 00000 n +0000126169 00000 n +0000126324 00000 n +0000126478 00000 n +0000126633 00000 n +0000126793 00000 n +0000126953 00000 n +0000127113 00000 n +0000127266 00000 n +0000127421 00000 n +0000127571 00000 n +0000127724 00000 n +0000127879 00000 n +0000128033 00000 n +0000128187 00000 n +0000128347 00000 n +0000128512 00000 n +0000128671 00000 n +0000128834 00000 n +0000128992 00000 n +0000140516 00000 n +0000132595 00000 n +0000129369 00000 n +0000140453 00000 n +0002391327 00000 n +0002381435 00000 n +0002391161 00000 n +0000133144 00000 n +0000133304 00000 n +0000133469 00000 n +0000133629 00000 n +0000133794 00000 n +0000133949 00000 n +0000134104 00000 n +0000134264 00000 n +0000134424 00000 n +0000134583 00000 n +0000134743 00000 n +0000134895 00000 n +0000135050 00000 n +0000135205 00000 n +0000135365 00000 n +0000135525 00000 n +0000135680 00000 n +0000135835 00000 n +0000135990 00000 n +0000136150 00000 n +0000136314 00000 n +0000136479 00000 n +0000136644 00000 n +0000136803 00000 n +0000136957 00000 n +0000137117 00000 n +0000137277 00000 n +0000137437 00000 n +0000137597 00000 n +0000137757 00000 n +0000137917 00000 n +0000138077 00000 n +0000138230 00000 n +0000138385 00000 n +0000138540 00000 n +0000138699 00000 n +0000138864 00000 n +0000139024 00000 n +0000139184 00000 n +0000139344 00000 n +0000139499 00000 n +0000139659 00000 n +0000139814 00000 n +0000139974 00000 n +0000140133 00000 n +0000140293 00000 n +0000152201 00000 n +0000143977 00000 n +0000140618 00000 n +0000152138 00000 n +0000144544 00000 n +0000144697 00000 n +0000144852 00000 n +0000145007 00000 n +0000145167 00000 n +0000145327 00000 n +0000145487 00000 n 0000145647 00000 n -0000145808 00000 n -0000145964 00000 n -0000146125 00000 n -0000146284 00000 n -0000146443 00000 n -0000158665 00000 n -0000150302 00000 n -0000146766 00000 n -0000158602 00000 n -0000150869 00000 n -0000151030 00000 n -0000151191 00000 n -0000151352 00000 n -0000151513 00000 n -0000151669 00000 n -0000151830 00000 n -0000151991 00000 n -0000152152 00000 n -0000152307 00000 n -0000152468 00000 n -0000152629 00000 n -0000152784 00000 n -0000152945 00000 n -0000153106 00000 n -0000153267 00000 n -0000153433 00000 n -0000153589 00000 n -0000153750 00000 n -0000153910 00000 n -0000154064 00000 n -0000154219 00000 n -0000154374 00000 n -0000154535 00000 n -0000154701 00000 n -0000154867 00000 n -0000155028 00000 n -0002090933 00000 n -0002071722 00000 n -0002090767 00000 n -0000155184 00000 n -0000155345 00000 n -0000155506 00000 n -0000155661 00000 n -0000155821 00000 n -0000155982 00000 n -0000156143 00000 n -0000156303 00000 n -0000156469 00000 n -0000156635 00000 n -0000156800 00000 n -0000156965 00000 n -0000157130 00000 n -0000157295 00000 n -0000157460 00000 n -0000157623 00000 n -0000157788 00000 n -0000157954 00000 n -0000158113 00000 n -0000158276 00000 n -0000158439 00000 n -0000170752 00000 n -0000162339 00000 n -0000158781 00000 n -0000170689 00000 n -0000162915 00000 n -0000163080 00000 n -0000163240 00000 n -0000163395 00000 n -0000163555 00000 n -0000163715 00000 n -0000163875 00000 n -0000164029 00000 n -0000164183 00000 n -0000164338 00000 n -0000164498 00000 n +0000145812 00000 n +0000145976 00000 n +0000146141 00000 n +0000146296 00000 n +0000146455 00000 n +0000146615 00000 n +0000146770 00000 n +0000146930 00000 n +0000147090 00000 n +0000147250 00000 n +0000147415 00000 n +0000147575 00000 n +0000147735 00000 n +0000147894 00000 n +0000148049 00000 n +0000148209 00000 n +0000148369 00000 n +0000148522 00000 n +0000148677 00000 n +0000148832 00000 n +0000148987 00000 n +0000149147 00000 n +0000149307 00000 n +0000149462 00000 n +0000149615 00000 n +0000149770 00000 n +0000149919 00000 n +0000150073 00000 n +0000150229 00000 n +0000150385 00000 n +0000150541 00000 n +0000150701 00000 n +0000150862 00000 n +0000151023 00000 n +0000151179 00000 n +0000151340 00000 n +0000151501 00000 n +0000151662 00000 n +0000151821 00000 n +0000151980 00000 n 0000164652 00000 n -0000164812 00000 n -0000164972 00000 n -0000165127 00000 n -0000165287 00000 n -0000165447 00000 n -0000165601 00000 n -0000165756 00000 n -0000165910 00000 n -0000166070 00000 n -0000166230 00000 n -0000166388 00000 n -0000166542 00000 n -0000166702 00000 n -0000166862 00000 n -0000167022 00000 n -0000167177 00000 n -0000167337 00000 n -0000167502 00000 n -0000167667 00000 n -0000167821 00000 n -0000167980 00000 n -0000168140 00000 n -0000168300 00000 n -0000168459 00000 n -0000168624 00000 n -0000168789 00000 n -0000168949 00000 n -0000169109 00000 n -0000169269 00000 n -0000169424 00000 n -0000169584 00000 n -0000169743 00000 n -0000169897 00000 n -0000170051 00000 n -0000170205 00000 n -0000170363 00000 n -0000170526 00000 n -0000182099 00000 n -0000174195 00000 n -0000170868 00000 n -0000182036 00000 n -0000174744 00000 n -0000174909 00000 n -0000175074 00000 n -0000175239 00000 n -0000175404 00000 n -0000175569 00000 n -0000175734 00000 n -0000175899 00000 n -0000176054 00000 n -0000176213 00000 n -0000176378 00000 n -0000176543 00000 n -0000176697 00000 n -0000176857 00000 n -0000177017 00000 n -0000177172 00000 n -0000177327 00000 n -0000177487 00000 n -0000177642 00000 n -0000177796 00000 n -0000177950 00000 n -0000178105 00000 n -0000178260 00000 n -0000178419 00000 n -0000178578 00000 n -0000178738 00000 n -0000178898 00000 n -0000179058 00000 n -0000179218 00000 n -0000179373 00000 n -0000179528 00000 n -0000179688 00000 n -0000179847 00000 n -0000180001 00000 n -0000180156 00000 n -0000180310 00000 n -0000180465 00000 n -0000180625 00000 n -0000180785 00000 n -0000180940 00000 n -0000181100 00000 n -0000181260 00000 n -0000181415 00000 n -0000181574 00000 n -0000181728 00000 n -0000181882 00000 n -0000194674 00000 n -0000186216 00000 n -0000182201 00000 n -0000194611 00000 n -0000186792 00000 n -0000186946 00000 n -0000187101 00000 n -0000187256 00000 n -0000187416 00000 n -0000187576 00000 n -0000187736 00000 n -0000187896 00000 n -0000188056 00000 n -0000188210 00000 n -0000188370 00000 n -0000188530 00000 n -0000188684 00000 n -0000188839 00000 n -0000188999 00000 n -0000189159 00000 n -0000189319 00000 n -0000189479 00000 n -0000189639 00000 n -0000189799 00000 n -0000189954 00000 n -0000190113 00000 n -0000190273 00000 n -0000190433 00000 n -0000190593 00000 n -0000190752 00000 n -0000190907 00000 n -0000191067 00000 n -0000191227 00000 n -0000191392 00000 n -0000191557 00000 n -0000191722 00000 n -0000191887 00000 n -0000192051 00000 n -0000192216 00000 n -0000192380 00000 n -0000192545 00000 n -0000192710 00000 n -0000192865 00000 n -0000193025 00000 n -0000193185 00000 n -0000193345 00000 n -0000193505 00000 n -0000193659 00000 n -0000193819 00000 n -0000193979 00000 n -0000194138 00000 n -0000194295 00000 n +0000155936 00000 n +0000152303 00000 n +0000164589 00000 n +0000156521 00000 n +0000156682 00000 n +0000156843 00000 n +0000156999 00000 n +0000157160 00000 n +0000157321 00000 n +0000157482 00000 n +0000157638 00000 n +0000157799 00000 n +0000157959 00000 n +0000158115 00000 n +0000158276 00000 n +0000158436 00000 n +0000158597 00000 n +0000158763 00000 n +0000158919 00000 n +0000159080 00000 n +0000159241 00000 n +0000159402 00000 n +0000159556 00000 n +0000159712 00000 n +0000159873 00000 n +0000160033 00000 n +0000160188 00000 n +0000160349 00000 n +0000160515 00000 n +0000160681 00000 n +0000160842 00000 n +0000161003 00000 n +0002380505 00000 n +0002361122 00000 n +0002380339 00000 n +0000161159 00000 n +0000161320 00000 n +0000161480 00000 n +0000161635 00000 n +0000161796 00000 n +0000161957 00000 n +0000162117 00000 n +0000162278 00000 n +0000162444 00000 n +0000162610 00000 n +0000162776 00000 n +0000162942 00000 n +0000163108 00000 n +0000163274 00000 n +0000163440 00000 n +0000163604 00000 n +0000163770 00000 n +0000163937 00000 n +0000164097 00000 n +0000164261 00000 n +0000164425 00000 n +0002456967 00000 n +0000175923 00000 n +0000168128 00000 n +0000164768 00000 n +0000175860 00000 n +0000168668 00000 n +0000168834 00000 n +0000168995 00000 n +0000169151 00000 n +0000169312 00000 n +0000169473 00000 n +0000169634 00000 n +0000169788 00000 n +0000169943 00000 n +0000170099 00000 n +0000170260 00000 n +0000170415 00000 n +0000170576 00000 n +0000170737 00000 n +0000170893 00000 n +0000171054 00000 n +0000171215 00000 n +0000171376 00000 n +0000171530 00000 n +0000171685 00000 n +0000171841 00000 n +0000172002 00000 n +0000172161 00000 n +0000172321 00000 n +0000172477 00000 n +0000172638 00000 n +0000172799 00000 n +0000172960 00000 n +0000173116 00000 n +0000173277 00000 n +0000173443 00000 n +0000173608 00000 n +0000173763 00000 n +0000173924 00000 n +0000174085 00000 n +0000174245 00000 n +0000174406 00000 n +0000174572 00000 n +0000174738 00000 n +0000174899 00000 n +0000175060 00000 n +0000175221 00000 n +0000175377 00000 n +0000175538 00000 n +0000175699 00000 n +0000188415 00000 n +0000179615 00000 n +0000176039 00000 n +0000188352 00000 n +0000180209 00000 n +0000180363 00000 n +0000180519 00000 n +0000180675 00000 n +0000180836 00000 n +0000181002 00000 n +0000181168 00000 n +0000181334 00000 n +0000181500 00000 n +0000181665 00000 n +0000181831 00000 n +0000181997 00000 n +0000182162 00000 n +0000182328 00000 n +0000182484 00000 n +0000182645 00000 n +0000182811 00000 n +0000182977 00000 n +0000183133 00000 n +0000183294 00000 n +0000183455 00000 n +0000183610 00000 n +0000183766 00000 n +0000183927 00000 n +0000184088 00000 n +0000184248 00000 n +0000184404 00000 n +0000184558 00000 n +0000184714 00000 n +0000184870 00000 n +0000185026 00000 n +0000185187 00000 n +0000185347 00000 n +0000185507 00000 n +0000185668 00000 n +0000185829 00000 n +0000185989 00000 n +0000186145 00000 n +0000186301 00000 n +0000186462 00000 n +0000186623 00000 n +0000186777 00000 n +0000186933 00000 n +0000187089 00000 n +0000187244 00000 n +0000187405 00000 n +0000187566 00000 n +0000187726 00000 n +0000187880 00000 n +0000188039 00000 n +0000188198 00000 n +0000201270 00000 n +0000192451 00000 n +0000188517 00000 n +0000201207 00000 n +0000193045 00000 n +0000193201 00000 n +0000193355 00000 n +0000193511 00000 n +0000193667 00000 n +0000193821 00000 n +0000193976 00000 n +0000194131 00000 n +0000194292 00000 n 0000194453 00000 n -0000206694 00000 n -0000198618 00000 n -0000194790 00000 n -0000206631 00000 n -0000199176 00000 n -0000199336 00000 n -0000199492 00000 n -0000199653 00000 n -0000199814 00000 n -0000199975 00000 n -0000200136 00000 n -0000200292 00000 n -0000200447 00000 n -0000200603 00000 n -0000200759 00000 n -0000200914 00000 n -0000201075 00000 n -0000201236 00000 n -0000201390 00000 n -0000201545 00000 n -0000201705 00000 n -0000201865 00000 n -0000202019 00000 n -0000202179 00000 n -0000202339 00000 n -0000202498 00000 n -0000202652 00000 n -0000202812 00000 n -0000202972 00000 n -0000203132 00000 n -0000203292 00000 n -0000203452 00000 n -0000203606 00000 n -0000203765 00000 n -0000203925 00000 n -0000204085 00000 n -0000204244 00000 n -0000204404 00000 n -0000204564 00000 n -0000204724 00000 n -0000204884 00000 n -0000205039 00000 n -0000205199 00000 n -0000205359 00000 n -0000205519 00000 n -0000205677 00000 n -0000205837 00000 n -0000205997 00000 n -0000206156 00000 n -0000206314 00000 n -0000206472 00000 n -0002183462 00000 n -0000219115 00000 n -0000210805 00000 n -0000206810 00000 n -0000219052 00000 n -0000211372 00000 n -0000211533 00000 n -0000211694 00000 n -0000211855 00000 n -0000212016 00000 n -0000212177 00000 n -0000212338 00000 n -0000212499 00000 n -0000212659 00000 n -0000212820 00000 n -0000212975 00000 n -0000213134 00000 n -0000213294 00000 n -0000213454 00000 n -0000213609 00000 n -0000213769 00000 n -0000213929 00000 n -0000214084 00000 n -0000214244 00000 n -0000214403 00000 n -0000214558 00000 n -0000214718 00000 n -0000214878 00000 n -0000215037 00000 n -0000215197 00000 n -0000215353 00000 n -0000215514 00000 n -0000215675 00000 n -0000215836 00000 n -0000215997 00000 n -0000216158 00000 n -0000216318 00000 n -0000216479 00000 n -0000216639 00000 n -0000216800 00000 n -0000216962 00000 n -0000217124 00000 n -0000217286 00000 n -0000217448 00000 n -0000217610 00000 n -0000217772 00000 n -0000217934 00000 n -0000218089 00000 n -0000218250 00000 n -0000218411 00000 n -0000218571 00000 n -0000218729 00000 n -0000218888 00000 n -0000230412 00000 n -0000222999 00000 n -0000219217 00000 n -0000230349 00000 n -0000223512 00000 n -0000223678 00000 n -0000223844 00000 n -0000224010 00000 n -0000224176 00000 n -0000224341 00000 n -0000224507 00000 n -0000224672 00000 n -0000224838 00000 n -0000225005 00000 n -0000225172 00000 n -0000225338 00000 n -0000225505 00000 n -0000225671 00000 n -0000225838 00000 n -0000225999 00000 n -0000226154 00000 n -0000226315 00000 n -0000226476 00000 n -0000226637 00000 n -0000226798 00000 n -0000226954 00000 n -0000227115 00000 n -0000227281 00000 n -0000227447 00000 n -0000227612 00000 n -0000227778 00000 n -0000227944 00000 n -0000228109 00000 n -0000228275 00000 n -0000228441 00000 n -0000228602 00000 n -0000228758 00000 n -0000228919 00000 n -0000229080 00000 n -0000229241 00000 n -0000229401 00000 n -0000229562 00000 n -0000229723 00000 n -0000229883 00000 n -0000230036 00000 n -0000230190 00000 n -0000242428 00000 n -0000233991 00000 n -0000230514 00000 n -0000242365 00000 n -0000234567 00000 n -0000234728 00000 n -0000234889 00000 n -0000235045 00000 n -0000235201 00000 n -0000235362 00000 n -0000235523 00000 n -0000235684 00000 n -0000235840 00000 n -0000236000 00000 n -0000236161 00000 n -0000236321 00000 n -0000236482 00000 n -0000236636 00000 n -0000236791 00000 n -0000236946 00000 n -0000237101 00000 n -0000237261 00000 n -0000237421 00000 n -0000237580 00000 n -0000237740 00000 n -0000237900 00000 n -0000238054 00000 n -0000238213 00000 n -0000238373 00000 n -0000238528 00000 n -0000238682 00000 n -0000238837 00000 n -0000238992 00000 n -0000239147 00000 n -0000239306 00000 n -0000239460 00000 n -0000239620 00000 n -0000239780 00000 n -0000239939 00000 n -0000240099 00000 n -0000240259 00000 n -0000240419 00000 n -0000240574 00000 n -0000240734 00000 n -0000240894 00000 n -0000241054 00000 n -0000241219 00000 n -0000241384 00000 n -0000241549 00000 n -0000241713 00000 n -0000241876 00000 n -0000242039 00000 n -0000242202 00000 n -0000254036 00000 n -0000245776 00000 n -0000242544 00000 n -0000253973 00000 n -0000246343 00000 n -0000246498 00000 n -0000246653 00000 n -0000246807 00000 n -0000246962 00000 n -0000247117 00000 n -0000247272 00000 n -0000247432 00000 n -0000247586 00000 n -0000247746 00000 n -0000247901 00000 n -0000248055 00000 n -0000248210 00000 n -0000248365 00000 n -0000248525 00000 n -0000248685 00000 n -0000248850 00000 n -0000249010 00000 n -0000249175 00000 n -0000249329 00000 n -0000249489 00000 n -0000249649 00000 n -0000249807 00000 n -0000249961 00000 n -0000250116 00000 n -0000250276 00000 n -0000250430 00000 n -0000250585 00000 n -0000250740 00000 n -0000250900 00000 n -0000251064 00000 n -0000251229 00000 n -0000251394 00000 n -0000251557 00000 n -0000251717 00000 n -0000251882 00000 n -0000252047 00000 n -0000252212 00000 n -0000252372 00000 n -0000252532 00000 n -0000252697 00000 n -0000252861 00000 n -0000253026 00000 n -0000253191 00000 n -0000253345 00000 n -0000253499 00000 n -0000253652 00000 n -0000253810 00000 n -0000265598 00000 n -0000257522 00000 n -0000254138 00000 n -0000265535 00000 n -0000258080 00000 n -0000258240 00000 n -0000258400 00000 n -0000258555 00000 n -0000258715 00000 n -0000258875 00000 n -0000259035 00000 n -0000259189 00000 n -0000259344 00000 n -0000259499 00000 n -0000259658 00000 n -0000259823 00000 n -0000259983 00000 n -0000260148 00000 n -0000260313 00000 n -0000260473 00000 n -0000260633 00000 n -0000260793 00000 n -0000260958 00000 n -0000261122 00000 n -0000261287 00000 n -0000261452 00000 n -0000261606 00000 n -0000261765 00000 n -0000261918 00000 n -0000262073 00000 n -0000262228 00000 n -0000262383 00000 n -0000262543 00000 n -0000262703 00000 n -0000262862 00000 n -0000263021 00000 n -0000263176 00000 n -0000263336 00000 n -0000263495 00000 n -0000263655 00000 n -0000263815 00000 n -0000263975 00000 n -0000264130 00000 n -0000264290 00000 n -0000264450 00000 n -0000264610 00000 n -0000264764 00000 n -0000264919 00000 n -0000265074 00000 n -0000265228 00000 n -0000265382 00000 n -0000275327 00000 n -0000268468 00000 n -0000265700 00000 n -0000275264 00000 n -0000268963 00000 n -0000269117 00000 n -0000269272 00000 n -0000269427 00000 n -0000269581 00000 n -0000269736 00000 n -0000269886 00000 n -0000270040 00000 n -0000270195 00000 n -0000270350 00000 n -0000270505 00000 n -0000270659 00000 n -0000270814 00000 n -0000270974 00000 n -0000271138 00000 n -0000271303 00000 n -0000271468 00000 n -0000271633 00000 n -0000271798 00000 n -0000271958 00000 n -0000272113 00000 n -0000272273 00000 n -0000272433 00000 n -0000272587 00000 n -0000272742 00000 n -0000272901 00000 n -0000273061 00000 n -0000273221 00000 n -0000273381 00000 n -0000273541 00000 n -0000273701 00000 n -0000273861 00000 n -0000274021 00000 n -0000274181 00000 n -0000274341 00000 n -0000274491 00000 n -0000274645 00000 n -0000274800 00000 n -0000274954 00000 n -0000275109 00000 n -0002183587 00000 n -0000286081 00000 n -0000278600 00000 n -0000275429 00000 n -0000286018 00000 n -0000279131 00000 n -0000279285 00000 n -0000279440 00000 n -0000279595 00000 n -0000279750 00000 n -0000279905 00000 n -0000280060 00000 n -0000280214 00000 n -0000280369 00000 n -0000280524 00000 n -0000280678 00000 n -0000280833 00000 n -0000280988 00000 n -0000281143 00000 n -0000281293 00000 n -0000281447 00000 n -0000281602 00000 n -0000281762 00000 n -0000281922 00000 n -0000282087 00000 n -0000282252 00000 n -0000282407 00000 n -0000282562 00000 n -0000282716 00000 n -0000282876 00000 n -0000283041 00000 n -0000283205 00000 n -0000283359 00000 n -0000283519 00000 n -0000283679 00000 n -0000283834 00000 n -0000283988 00000 n -0000284143 00000 n -0000284298 00000 n -0000284452 00000 n -0000284607 00000 n -0000284762 00000 n -0000284922 00000 n -0000285076 00000 n -0000285236 00000 n -0000285396 00000 n -0000285550 00000 n -0000285705 00000 n -0000285860 00000 n -0000293812 00000 n -0000288492 00000 n -0000286183 00000 n -0000293749 00000 n -0000288906 00000 n -0000289066 00000 n -0000289226 00000 n -0000289381 00000 n -0000289541 00000 n -0000289701 00000 n -0000289861 00000 n -0000290021 00000 n -0000290180 00000 n -0000290340 00000 n -0000290495 00000 n -0000290654 00000 n -0000290809 00000 n -0000290964 00000 n -0000291118 00000 n -0000291273 00000 n -0000291428 00000 n -0000291583 00000 n -0000291738 00000 n -0000291892 00000 n -0000292047 00000 n -0000292202 00000 n -0000292356 00000 n -0000292510 00000 n -0000292666 00000 n -0000292822 00000 n -0000292976 00000 n -0000293131 00000 n -0000293285 00000 n -0000293439 00000 n -0000293594 00000 n -0000294482 00000 n -0000294236 00000 n -0000293914 00000 n -0000294359 00000 n -0000298727 00000 n -0000298109 00000 n -0000294570 00000 n -0000298232 00000 n -0000298295 00000 n -0000298541 00000 n -0000298665 00000 n -0000303442 00000 n -0000302943 00000 n -0000298843 00000 n -0000303256 00000 n -0000303087 00000 n -0000303379 00000 n -0000308850 00000 n -0000307610 00000 n -0000303558 00000 n -0000308540 00000 n -0000307781 00000 n -0000307952 00000 n -0000308664 00000 n -0000308124 00000 n -0000308332 00000 n -0000308787 00000 n -0002183712 00000 n -0000311039 00000 n -0000310521 00000 n -0000308966 00000 n -0000310852 00000 n -0000310665 00000 n -0000310976 00000 n -0000315209 00000 n -0000313888 00000 n -0000311141 00000 n -0000314527 00000 n -0000314775 00000 n -0000314050 00000 n -0000314216 00000 n -0000314898 00000 n -0000315022 00000 n -0000314369 00000 n -0000315146 00000 n -0000319974 00000 n -0000318479 00000 n -0000315311 00000 n -0000319293 00000 n -0000319417 00000 n -0000318650 00000 n -0000318820 00000 n -0000319540 00000 n -0000319664 00000 n -0000319788 00000 n -0000319911 00000 n -0000318990 00000 n -0000319142 00000 n -0000322952 00000 n -0000322519 00000 n -0000320132 00000 n -0000322642 00000 n -0000322766 00000 n -0000322889 00000 n -0000324120 00000 n -0000323810 00000 n -0000323082 00000 n -0000323933 00000 n -0000324057 00000 n -0000325144 00000 n -0000324710 00000 n -0000324222 00000 n -0000324833 00000 n -0000325081 00000 n -0002183837 00000 n -0000325812 00000 n -0000325565 00000 n -0000325232 00000 n -0000325688 00000 n -0000329744 00000 n -0000329121 00000 n -0000325900 00000 n -0000329244 00000 n -0000329307 00000 n -0000329557 00000 n -0000329682 00000 n -0000334228 00000 n -0000333667 00000 n -0000329846 00000 n -0000333790 00000 n -0000333914 00000 n -0000334039 00000 n -0000334102 00000 n -0000334165 00000 n -0000338189 00000 n -0000337379 00000 n -0000334358 00000 n -0000337502 00000 n -0000337627 00000 n -0000337752 00000 n -0000337877 00000 n -0000338002 00000 n -0000338127 00000 n -0000341613 00000 n -0000343762 00000 n -0000341460 00000 n -0000338319 00000 n -0000343449 00000 n -0000343512 00000 n -0000343575 00000 n -0002070233 00000 n -0002060979 00000 n -0002070066 00000 n -0002059022 00000 n -0002047684 00000 n -0002058856 00000 n -0000343143 00000 n -0000343293 00000 n -0000343699 00000 n -0000342972 00000 n -0000343030 00000 n -0000343120 00000 n -0000347686 00000 n -0000346911 00000 n -0000343935 00000 n -0000347373 00000 n -0000347498 00000 n -0000347064 00000 n -0000347220 00000 n -0000347623 00000 n -0002183962 00000 n -0000459466 00000 n -0000351547 00000 n -0000351111 00000 n -0000347816 00000 n -0000351234 00000 n -0002047036 00000 n -0002040846 00000 n -0002046869 00000 n -0000351359 00000 n -0000351484 00000 n -0000355616 00000 n -0000355182 00000 n -0000351762 00000 n -0000355305 00000 n -0000355430 00000 n -0000355555 00000 n -0000358502 00000 n -0000357764 00000 n -0000355746 00000 n -0000358065 00000 n -0000358190 00000 n -0000358314 00000 n -0000357908 00000 n -0000358439 00000 n -0000362402 00000 n -0000361966 00000 n -0000358632 00000 n -0000362089 00000 n -0000362339 00000 n -0000366995 00000 n -0000366301 00000 n -0000362518 00000 n -0000366932 00000 n -0000366463 00000 n -0000366620 00000 n -0000366776 00000 n -0000371481 00000 n -0000370874 00000 n -0000367168 00000 n -0000371168 00000 n -0000371018 00000 n -0000371293 00000 n -0000371418 00000 n -0002184087 00000 n -0000375958 00000 n -0000375647 00000 n -0000371682 00000 n -0000375770 00000 n -0000375895 00000 n -0000380394 00000 n -0000379524 00000 n -0000376088 00000 n -0000380331 00000 n -0000379695 00000 n -0000379852 00000 n -0000380009 00000 n -0000380167 00000 n -0000384525 00000 n -0000383712 00000 n -0000380553 00000 n -0000384338 00000 n -0000383874 00000 n -0000384029 00000 n -0000384184 00000 n -0000384462 00000 n -0000385792 00000 n -0000385606 00000 n -0000384726 00000 n -0000385729 00000 n -0000389527 00000 n -0000388673 00000 n -0000385894 00000 n -0000388966 00000 n -0000388817 00000 n -0000389091 00000 n -0000389214 00000 n -0000389339 00000 n -0000389464 00000 n -0000393296 00000 n -0000392860 00000 n -0000389728 00000 n -0000392983 00000 n -0000393108 00000 n -0000393233 00000 n -0002184212 00000 n -0000398417 00000 n -0000397665 00000 n -0000393469 00000 n -0000397788 00000 n -0000397851 00000 n -0000397914 00000 n -0000397977 00000 n -0000398040 00000 n -0000398103 00000 n -0000398166 00000 n -0000398229 00000 n -0000398354 00000 n +0000194613 00000 n +0000194769 00000 n +0000194930 00000 n +0000195091 00000 n +0000195247 00000 n +0000195403 00000 n +0000195564 00000 n +0000195725 00000 n +0000195886 00000 n +0000196046 00000 n +0000196207 00000 n +0000196368 00000 n +0000196522 00000 n +0000196682 00000 n +0000196843 00000 n +0000197004 00000 n +0000197165 00000 n +0000197326 00000 n +0000197482 00000 n +0000197643 00000 n +0000197804 00000 n +0000197969 00000 n +0000198134 00000 n +0000198300 00000 n +0000198466 00000 n +0000198631 00000 n +0000198797 00000 n +0000198963 00000 n +0000199129 00000 n +0000199295 00000 n +0000199451 00000 n +0000199612 00000 n +0000199773 00000 n +0000199934 00000 n +0000200094 00000 n +0000200250 00000 n +0000200411 00000 n +0000200571 00000 n +0000200730 00000 n +0000200889 00000 n +0000201048 00000 n +0000213766 00000 n +0000205301 00000 n +0000201386 00000 n +0000213703 00000 n +0000205877 00000 n +0000206038 00000 n +0000206195 00000 n +0000206357 00000 n +0000206519 00000 n +0000206681 00000 n +0000206843 00000 n +0000207000 00000 n +0000207157 00000 n +0000207313 00000 n +0000207470 00000 n +0000207627 00000 n +0000207788 00000 n +0000207950 00000 n +0000208104 00000 n +0000208260 00000 n +0000208421 00000 n +0000208582 00000 n +0000208738 00000 n +0000208899 00000 n +0000209059 00000 n +0000209220 00000 n +0000209376 00000 n +0000209536 00000 n +0000209697 00000 n +0000209858 00000 n +0000210019 00000 n +0000210180 00000 n +0000210336 00000 n +0000210497 00000 n +0000210657 00000 n +0000210817 00000 n +0000210978 00000 n +0000211139 00000 n +0000211299 00000 n +0000211460 00000 n +0000211621 00000 n +0000211777 00000 n +0000211938 00000 n +0000212099 00000 n +0000212260 00000 n +0000212421 00000 n +0000212582 00000 n +0000212741 00000 n +0000212902 00000 n +0000213063 00000 n +0000213223 00000 n +0000213383 00000 n +0000213543 00000 n +0000226559 00000 n +0000217869 00000 n +0000213882 00000 n +0000226496 00000 n +0000218454 00000 n +0000218616 00000 n +0000218778 00000 n +0000218940 00000 n +0000219102 00000 n +0000219264 00000 n +0000219426 00000 n +0000219588 00000 n +0000219744 00000 n +0000219904 00000 n +0000220065 00000 n +0000220226 00000 n +0000220381 00000 n +0000220542 00000 n +0000220703 00000 n +0000220859 00000 n +0000221020 00000 n +0000221181 00000 n +0000221337 00000 n +0000221498 00000 n +0000221658 00000 n +0000221819 00000 n +0000221980 00000 n +0000222137 00000 n +0000222298 00000 n +0000222460 00000 n +0000222622 00000 n +0000222784 00000 n +0000222946 00000 n +0000223108 00000 n +0000223270 00000 n +0000223432 00000 n +0000223593 00000 n +0000223756 00000 n +0000223919 00000 n +0000224081 00000 n +0000224244 00000 n +0000224407 00000 n +0000224570 00000 n +0000224733 00000 n +0000224890 00000 n +0000225052 00000 n +0000225214 00000 n +0000225376 00000 n +0000225537 00000 n +0000225699 00000 n +0000225861 00000 n +0000226017 00000 n +0000226176 00000 n +0000226336 00000 n +0000239184 00000 n +0000230780 00000 n +0000226661 00000 n +0000239121 00000 n +0000231347 00000 n +0000231509 00000 n +0000231666 00000 n +0000231828 00000 n +0000231995 00000 n +0000232162 00000 n +0000232329 00000 n +0000232496 00000 n +0000232663 00000 n +0000232829 00000 n +0000232996 00000 n +0000233162 00000 n +0000233324 00000 n +0000233481 00000 n +0000233643 00000 n +0000233805 00000 n +0000233967 00000 n +0000234129 00000 n +0000234291 00000 n +0000234453 00000 n +0000234614 00000 n +0000234771 00000 n +0000234928 00000 n +0000235090 00000 n +0000235251 00000 n +0000235413 00000 n +0000235570 00000 n +0000235727 00000 n +0000235884 00000 n +0000236041 00000 n +0000236203 00000 n +0000236365 00000 n +0000236526 00000 n +0000236688 00000 n +0000236850 00000 n +0000237011 00000 n +0000237173 00000 n +0000237335 00000 n +0000237497 00000 n +0000237660 00000 n +0000237823 00000 n +0000237986 00000 n +0000238149 00000 n +0000238311 00000 n +0000238474 00000 n +0000238637 00000 n +0000238799 00000 n +0000238960 00000 n +0002457092 00000 n +0000250686 00000 n +0000242582 00000 n +0000239286 00000 n +0000250623 00000 n +0000243140 00000 n +0000243297 00000 n +0000243451 00000 n +0000243607 00000 n +0000243763 00000 n +0000243919 00000 n +0000244080 00000 n +0000244241 00000 n +0000244401 00000 n +0000244562 00000 n +0000244723 00000 n +0000244878 00000 n +0000245039 00000 n +0000245200 00000 n +0000245354 00000 n +0000245510 00000 n +0000245666 00000 n +0000245822 00000 n +0000245983 00000 n +0000246138 00000 n +0000246299 00000 n +0000246460 00000 n +0000246619 00000 n +0000246779 00000 n +0000246940 00000 n +0000247101 00000 n +0000247257 00000 n +0000247418 00000 n +0000247579 00000 n +0000247740 00000 n +0000247905 00000 n +0000248070 00000 n +0000248236 00000 n +0000248402 00000 n +0000248567 00000 n +0000248733 00000 n +0000248899 00000 n +0000249055 00000 n +0000249211 00000 n +0000249372 00000 n +0000249526 00000 n +0000249682 00000 n +0000249837 00000 n +0000249993 00000 n +0000250154 00000 n +0000250309 00000 n +0000250469 00000 n +0000263047 00000 n +0000254202 00000 n +0000250788 00000 n +0000262984 00000 n +0000254796 00000 n +0000254950 00000 n +0000255106 00000 n +0000255262 00000 n +0000255423 00000 n +0000255584 00000 n +0000255750 00000 n +0000255911 00000 n +0000256077 00000 n +0000256232 00000 n +0000256393 00000 n +0000256554 00000 n +0000256714 00000 n +0000256870 00000 n +0000257026 00000 n +0000257187 00000 n +0000257341 00000 n +0000257497 00000 n +0000257653 00000 n +0000257814 00000 n +0000257979 00000 n +0000258145 00000 n +0000258311 00000 n +0000258476 00000 n +0000258636 00000 n +0000258802 00000 n +0000258968 00000 n +0000259134 00000 n +0000259295 00000 n +0000259456 00000 n +0000259622 00000 n +0000259788 00000 n +0000259953 00000 n +0000260118 00000 n +0000260274 00000 n +0000260430 00000 n +0000260585 00000 n +0000260746 00000 n +0000260912 00000 n +0000261073 00000 n +0000261234 00000 n +0000261390 00000 n +0000261551 00000 n +0000261712 00000 n +0000261873 00000 n +0000262027 00000 n +0000262183 00000 n +0000262338 00000 n +0000262497 00000 n +0000262661 00000 n +0000262820 00000 n +0000273618 00000 n +0000266208 00000 n +0000263149 00000 n +0000273555 00000 n +0000266730 00000 n +0000266896 00000 n +0000267057 00000 n +0000267218 00000 n +0000267379 00000 n +0000267545 00000 n +0000267711 00000 n +0000267877 00000 n +0000268043 00000 n +0000268198 00000 n +0000268359 00000 n +0000268520 00000 n +0000268674 00000 n +0000268830 00000 n +0000268986 00000 n +0000269142 00000 n +0000269303 00000 n +0000269464 00000 n +0000269625 00000 n +0000269786 00000 n +0000269941 00000 n +0000270102 00000 n +0000270263 00000 n +0000270423 00000 n +0000270583 00000 n +0000270744 00000 n +0000270900 00000 n +0000271061 00000 n +0000271222 00000 n +0000271383 00000 n +0000271537 00000 n +0000271692 00000 n +0000271847 00000 n +0000272003 00000 n +0000272159 00000 n +0000272314 00000 n +0000272470 00000 n +0000272631 00000 n +0000272785 00000 n +0000272941 00000 n +0000273097 00000 n +0000273251 00000 n +0000273406 00000 n +0000284586 00000 n +0000276790 00000 n +0000273720 00000 n +0000284523 00000 n +0000277330 00000 n +0000277484 00000 n +0000277640 00000 n +0000277796 00000 n +0000277957 00000 n +0000278118 00000 n +0000278279 00000 n +0000278435 00000 n +0000278596 00000 n +0000278756 00000 n +0000278917 00000 n +0000279078 00000 n +0000279238 00000 n +0000279399 00000 n +0000279565 00000 n +0000279731 00000 n +0000279897 00000 n +0000280051 00000 n +0000280207 00000 n +0000280368 00000 n +0000280533 00000 n +0000280699 00000 n +0000280865 00000 n +0000281030 00000 n +0000281195 00000 n +0000281356 00000 n +0000281512 00000 n +0000281673 00000 n +0000281834 00000 n +0000281988 00000 n +0000282144 00000 n +0000282304 00000 n +0000282464 00000 n +0000282625 00000 n +0000282786 00000 n +0000282946 00000 n +0000283107 00000 n +0000283268 00000 n +0000283429 00000 n +0000283590 00000 n +0000283752 00000 n +0000283901 00000 n +0000284055 00000 n +0000284211 00000 n +0000284367 00000 n +0000295326 00000 n +0000287768 00000 n +0000284688 00000 n +0000295263 00000 n +0000288299 00000 n +0000288453 00000 n +0000288609 00000 n +0000288770 00000 n +0000288931 00000 n +0000289092 00000 n +0000289253 00000 n +0000289419 00000 n +0000289585 00000 n +0000289740 00000 n +0000289896 00000 n +0000290052 00000 n +0000290206 00000 n +0000290362 00000 n +0000290518 00000 n +0000290674 00000 n +0000290830 00000 n +0000290986 00000 n +0000291142 00000 n +0000291291 00000 n +0000291445 00000 n +0000291601 00000 n +0000291762 00000 n +0000291923 00000 n +0000292088 00000 n +0000292254 00000 n +0000292410 00000 n +0000292565 00000 n +0000292720 00000 n +0000292881 00000 n +0000293047 00000 n +0000293213 00000 n +0000293369 00000 n +0000293530 00000 n +0000293691 00000 n +0000293845 00000 n +0000294001 00000 n +0000294157 00000 n +0000294313 00000 n +0000294468 00000 n +0000294624 00000 n +0000294785 00000 n +0000294941 00000 n +0000295102 00000 n +0000303712 00000 n +0000297868 00000 n +0000295428 00000 n +0000303649 00000 n +0000298309 00000 n +0000298463 00000 n +0000298619 00000 n +0000298775 00000 n +0000298936 00000 n +0000299097 00000 n +0000299258 00000 n +0000299414 00000 n +0000299575 00000 n +0000299735 00000 n +0000299896 00000 n +0000300057 00000 n +0000300217 00000 n +0000300378 00000 n +0000300534 00000 n +0000300695 00000 n +0000300851 00000 n +0000301007 00000 n +0000301161 00000 n +0000301317 00000 n +0000301472 00000 n +0000301628 00000 n +0000301784 00000 n +0000301939 00000 n +0000302094 00000 n +0000302250 00000 n +0000302406 00000 n +0000302562 00000 n +0000302719 00000 n +0000302876 00000 n +0000303030 00000 n +0000303185 00000 n +0000303339 00000 n +0000303495 00000 n +0002457217 00000 n +0000304382 00000 n +0000304136 00000 n +0000303814 00000 n +0000304259 00000 n +0000307868 00000 n +0000307371 00000 n +0000304470 00000 n +0000307494 00000 n +0000307557 00000 n +0000307805 00000 n +0000311771 00000 n +0000311461 00000 n +0000307970 00000 n +0000311584 00000 n +0000311708 00000 n +0000315950 00000 n +0000315145 00000 n +0000311887 00000 n +0000315639 00000 n +0000315298 00000 n +0000315763 00000 n +0000315467 00000 n +0000315887 00000 n +0000320170 00000 n +0000319313 00000 n +0000316066 00000 n +0000319860 00000 n +0000319466 00000 n +0000319984 00000 n +0000319674 00000 n +0000320107 00000 n +0000323819 00000 n +0000322501 00000 n +0000320286 00000 n +0000323134 00000 n +0000323382 00000 n +0000322663 00000 n +0000322829 00000 n +0000322982 00000 n +0000323506 00000 n +0000323630 00000 n +0000323693 00000 n +0000323757 00000 n +0002457342 00000 n +0000327513 00000 n +0000326433 00000 n +0000323907 00000 n +0000327080 00000 n +0000326595 00000 n +0000326753 00000 n +0000327204 00000 n +0000327326 00000 n +0000326910 00000 n +0000327450 00000 n +0002359232 00000 n +0002343760 00000 n +0002359066 00000 n +0000330309 00000 n +0000329295 00000 n +0000327643 00000 n +0000329750 00000 n +0000329874 00000 n +0000329998 00000 n +0000330122 00000 n +0000329448 00000 n +0000329599 00000 n +0000330246 00000 n +0000333188 00000 n +0000332630 00000 n +0000330425 00000 n +0000332753 00000 n +0000332877 00000 n +0000333001 00000 n +0000333125 00000 n +0000334215 00000 n +0000333781 00000 n +0000333304 00000 n +0000333904 00000 n +0000334152 00000 n +0000334884 00000 n +0000334636 00000 n +0000334303 00000 n +0000334759 00000 n +0000338254 00000 n +0000337755 00000 n +0000334972 00000 n +0000337878 00000 n +0000337941 00000 n +0000338191 00000 n +0002457467 00000 n +0000341751 00000 n +0000341317 00000 n +0000338356 00000 n +0000341440 00000 n +0000341564 00000 n +0000341689 00000 n +0000345739 00000 n +0000345053 00000 n +0000341895 00000 n +0000345176 00000 n +0000345301 00000 n +0000345364 00000 n +0000345427 00000 n +0000345552 00000 n +0000345676 00000 n +0000351745 00000 n +0000348828 00000 n +0000348142 00000 n +0000345855 00000 n +0000348265 00000 n +0000348390 00000 n +0000348515 00000 n +0000348639 00000 n +0000348702 00000 n +0000348765 00000 n +0000353895 00000 n +0000351592 00000 n +0000348958 00000 n +0000353582 00000 n +0002342975 00000 n +0002330332 00000 n +0002342808 00000 n +0002328364 00000 n +0002316799 00000 n +0002328198 00000 n +0000353275 00000 n +0000353425 00000 n +0000353707 00000 n +0000353832 00000 n +0000353104 00000 n +0000353162 00000 n +0000353252 00000 n +0001850314 00000 n +0000357327 00000 n +0000356838 00000 n +0000354068 00000 n +0000357139 00000 n +0000356982 00000 n +0000357264 00000 n +0000360974 00000 n +0000360538 00000 n +0000357457 00000 n +0000360661 00000 n +0002316156 00000 n +0002309932 00000 n +0002315989 00000 n +0000360786 00000 n +0000360911 00000 n +0002457592 00000 n +0000364749 00000 n +0000364439 00000 n +0000361175 00000 n +0000364562 00000 n +0000364686 00000 n +0000368076 00000 n +0000367213 00000 n +0000364865 00000 n +0000367514 00000 n +0000367639 00000 n +0000367763 00000 n +0000367888 00000 n +0000367357 00000 n +0000368013 00000 n +0000424193 00000 n +0000371130 00000 n +0000370819 00000 n +0000368192 00000 n +0000370942 00000 n +0000375249 00000 n +0000374595 00000 n +0000371260 00000 n +0000375061 00000 n +0000375186 00000 n +0000374748 00000 n +0000374904 00000 n +0000379940 00000 n +0000378665 00000 n +0000375436 00000 n +0000379628 00000 n +0000378845 00000 n +0000378999 00000 n +0000379165 00000 n +0000379330 00000 n +0000379480 00000 n +0000379753 00000 n +0000379877 00000 n +0000482090 00000 n +0000384083 00000 n +0000383729 00000 n +0000380070 00000 n +0000384020 00000 n +0002309699 00000 n +0002307641 00000 n +0002309536 00000 n +0002307408 00000 n +0002305339 00000 n +0002307245 00000 n +0002304787 00000 n +0002296876 00000 n +0002304623 00000 n +0000383873 00000 n +0002457717 00000 n +0000388127 00000 n +0000387472 00000 n +0000384241 00000 n +0000387939 00000 n +0000388064 00000 n +0000387625 00000 n +0000387782 00000 n +0000391919 00000 n +0000390889 00000 n +0000388314 00000 n +0000391856 00000 n +0000391069 00000 n +0000391228 00000 n +0000391393 00000 n +0000391548 00000 n +0000391702 00000 n +0000396804 00000 n +0000395672 00000 n +0000392078 00000 n +0000396616 00000 n +0000396741 00000 n +0000395852 00000 n +0000396007 00000 n +0000396161 00000 n +0000396311 00000 n +0000396460 00000 n +0000399623 00000 n +0000399686 00000 n +0000399374 00000 n +0000396976 00000 n +0000399497 00000 n +0000399560 00000 n +0000403016 00000 n +0000402455 00000 n +0000399816 00000 n +0000402578 00000 n 0000402703 00000 n -0000402018 00000 n -0000398575 00000 n -0000402141 00000 n -0000402265 00000 n -0000402390 00000 n -0000402515 00000 n -0000402640 00000 n -0000405535 00000 n -0000404974 00000 n -0000402833 00000 n -0000405097 00000 n -0000405222 00000 n -0000405347 00000 n -0000405472 00000 n -0000409841 00000 n -0000409054 00000 n -0000405651 00000 n -0000409528 00000 n -0000409207 00000 n -0000409778 00000 n -0000409360 00000 n -0000414030 00000 n -0000413596 00000 n -0000409957 00000 n -0000413719 00000 n -0000413844 00000 n -0000413967 00000 n -0000418542 00000 n -0000417808 00000 n -0000414160 00000 n -0000418105 00000 n -0000418230 00000 n -0000417952 00000 n -0000418355 00000 n -0000418480 00000 n -0002184337 00000 n -0000422780 00000 n -0000422220 00000 n -0000418700 00000 n -0000422343 00000 n -0000422468 00000 n -0000422593 00000 n -0000422718 00000 n -0000427028 00000 n -0000426343 00000 n -0000422924 00000 n -0000426466 00000 n -0000426591 00000 n -0000426716 00000 n -0000426840 00000 n -0000426965 00000 n -0000428552 00000 n -0000428241 00000 n -0000427172 00000 n -0000428364 00000 n -0000428489 00000 n -0000432375 00000 n -0000431815 00000 n -0000428668 00000 n -0000431938 00000 n -0000432188 00000 n -0000432313 00000 n -0000436811 00000 n -0000436501 00000 n -0000432505 00000 n -0000436624 00000 n -0000436748 00000 n -0000440680 00000 n -0000442228 00000 n -0000440536 00000 n -0000436969 00000 n -0000441663 00000 n -0000441493 00000 n -0000441788 00000 n -0000441851 00000 n -0000441914 00000 n -0000441977 00000 n -0000442040 00000 n -0000442103 00000 n -0000442166 00000 n -0002184462 00000 n -0000446906 00000 n -0000445720 00000 n -0000442415 00000 n -0000446219 00000 n -0000446344 00000 n -0000445873 00000 n -0000446469 00000 n -0000446594 00000 n -0000446719 00000 n -0000446844 00000 n -0000446059 00000 n -0000451436 00000 n -0000451751 00000 n -0000450256 00000 n -0000447036 00000 n -0000451311 00000 n -0000450436 00000 n -0000451561 00000 n -0000451624 00000 n -0000451687 00000 n -0000450589 00000 n -0000450766 00000 n -0000450944 00000 n -0000451129 00000 n -0000456461 00000 n -0000455607 00000 n -0000451895 00000 n -0000456273 00000 n -0000455769 00000 n -0000456398 00000 n -0000455932 00000 n -0000456122 00000 n -0000459779 00000 n -0000458801 00000 n -0000456591 00000 n -0000459341 00000 n -0000458954 00000 n -0000459128 00000 n -0000459591 00000 n -0000459716 00000 n -0000464417 00000 n -0000463158 00000 n -0000459966 00000 n -0000463979 00000 n -0000463329 00000 n -0000463490 00000 n -0000463652 00000 n -0000463822 00000 n -0000464104 00000 n -0000464229 00000 n -0000464354 00000 n -0000468316 00000 n -0000468878 00000 n -0000468068 00000 n -0000464604 00000 n -0000468191 00000 n -0000468441 00000 n -0000468566 00000 n -0000468691 00000 n -0000468815 00000 n -0002184587 00000 n -0000470109 00000 n -0000469923 00000 n -0000469022 00000 n -0000470046 00000 n -0000473965 00000 n -0000473404 00000 n -0000470253 00000 n -0000473527 00000 n -0000473777 00000 n -0000473902 00000 n -0000477895 00000 n -0000476906 00000 n -0000474081 00000 n -0000477206 00000 n -0000477331 00000 n -0000477455 00000 n -0000477580 00000 n -0000477643 00000 n -0000477706 00000 n -0000477050 00000 n -0000477769 00000 n -0000477832 00000 n -0000479921 00000 n -0000479610 00000 n -0000478025 00000 n -0000479733 00000 n -0000479858 00000 n -0000481021 00000 n -0000480585 00000 n -0000480065 00000 n -0000480708 00000 n -0000480958 00000 n -0000481686 00000 n -0000481438 00000 n -0000481109 00000 n -0000481561 00000 n -0002184712 00000 n -0000485354 00000 n -0000484855 00000 n -0000481774 00000 n -0000484978 00000 n -0000485041 00000 n -0000485291 00000 n -0000488215 00000 n -0000487904 00000 n -0000485513 00000 n -0000488027 00000 n -0000488152 00000 n -0000492662 00000 n -0000492104 00000 n -0000488331 00000 n -0000492227 00000 n -0000492352 00000 n -0000492477 00000 n -0000492600 00000 n -0000497337 00000 n -0000496525 00000 n -0000492792 00000 n -0000496648 00000 n -0000496711 00000 n -0000496774 00000 n -0000496837 00000 n -0000496899 00000 n -0000496962 00000 n -0000497025 00000 n -0000497150 00000 n -0000497274 00000 n -0000501720 00000 n -0000501409 00000 n -0000497495 00000 n -0000501532 00000 n -0000501657 00000 n -0000504659 00000 n -0000504349 00000 n -0000501850 00000 n -0000504472 00000 n -0000504596 00000 n -0002184837 00000 n -0000508449 00000 n -0000507954 00000 n -0000504803 00000 n -0000508261 00000 n -0000508098 00000 n -0000508386 00000 n -0000512816 00000 n -0000511879 00000 n -0000508565 00000 n -0000512002 00000 n -0000512127 00000 n -0000512190 00000 n -0000512253 00000 n -0000512316 00000 n -0000512379 00000 n -0000512504 00000 n -0000512628 00000 n -0000512753 00000 n -0000516971 00000 n -0000516537 00000 n -0000512960 00000 n -0000516660 00000 n -0000516785 00000 n -0000516909 00000 n -0000520654 00000 n -0000521657 00000 n -0000520531 00000 n -0000517101 00000 n -0000521469 00000 n -0000521594 00000 n -0000525382 00000 n -0000524824 00000 n -0000521844 00000 n -0000524947 00000 n -0000525072 00000 n -0000525195 00000 n -0000525320 00000 n -0000529209 00000 n -0000528773 00000 n -0000525512 00000 n -0000528896 00000 n -0000529021 00000 n -0000529146 00000 n -0002184962 00000 n -0000532738 00000 n -0000532303 00000 n -0000529396 00000 n -0000532426 00000 n -0000532550 00000 n -0000532675 00000 n -0000537101 00000 n -0000536665 00000 n -0000532854 00000 n -0000536788 00000 n -0000536913 00000 n -0000537038 00000 n -0000540961 00000 n -0000540651 00000 n -0000537302 00000 n -0000540774 00000 n -0000540899 00000 n -0000545726 00000 n -0000545286 00000 n -0000541077 00000 n -0000545409 00000 n -0000545472 00000 n -0000545535 00000 n -0000545599 00000 n -0000545662 00000 n -0000550307 00000 n -0000549679 00000 n -0000545842 00000 n -0000549802 00000 n -0000549865 00000 n -0000549928 00000 n -0000549991 00000 n -0000550054 00000 n -0000550118 00000 n -0000550181 00000 n -0000550244 00000 n -0000552920 00000 n -0000552360 00000 n -0000550409 00000 n -0000552483 00000 n -0000552608 00000 n -0000552732 00000 n -0000552857 00000 n -0002185087 00000 n -0000556656 00000 n -0000556220 00000 n -0000553036 00000 n -0000556343 00000 n -0000556593 00000 n -0000561084 00000 n -0000560774 00000 n -0000556829 00000 n -0000560897 00000 n -0000561022 00000 n -0000565092 00000 n -0000564781 00000 n -0000561242 00000 n -0000564904 00000 n -0000565029 00000 n -0000569443 00000 n -0000568882 00000 n -0000565265 00000 n -0000569005 00000 n -0000569130 00000 n -0000569255 00000 n -0000569380 00000 n -0000573170 00000 n -0000572610 00000 n -0000569587 00000 n -0000572733 00000 n -0000572858 00000 n -0000572983 00000 n -0000573108 00000 n -0000575994 00000 n -0000575510 00000 n -0000573314 00000 n -0000575806 00000 n -0000575654 00000 n -0000575931 00000 n -0002185212 00000 n -0000613080 00000 n -0000580766 00000 n -0000579876 00000 n -0000576124 00000 n -0000580205 00000 n -0000580330 00000 n -0000580455 00000 n -0000580020 00000 n -0000580580 00000 n -0000580703 00000 n -0000586732 00000 n -0000584620 00000 n -0000580910 00000 n -0000586419 00000 n -0000584836 00000 n -0000585005 00000 n -0000585174 00000 n -0000585368 00000 n -0000585540 00000 n -0000585725 00000 n -0000585927 00000 n -0000586544 00000 n -0000586097 00000 n -0000586669 00000 n -0000586250 00000 n -0000589882 00000 n -0000589572 00000 n -0000586919 00000 n -0000589695 00000 n -0000589819 00000 n -0000591713 00000 n -0000591403 00000 n -0000589998 00000 n -0000591526 00000 n -0000591651 00000 n -0000596390 00000 n -0000594161 00000 n -0000591829 00000 n -0000596202 00000 n -0000596327 00000 n -0000594386 00000 n -0000594569 00000 n -0000594745 00000 n -0000594926 00000 n -0000595106 00000 n -0000595286 00000 n -0000595472 00000 n -0000595656 00000 n -0000595837 00000 n -0000596020 00000 n -0000598922 00000 n -0000598611 00000 n -0000596591 00000 n -0000598734 00000 n -0000598859 00000 n -0002185337 00000 n -0000603362 00000 n -0000602594 00000 n -0000599038 00000 n -0000603049 00000 n -0000603174 00000 n -0000602747 00000 n -0000603299 00000 n -0000602896 00000 n -0000605471 00000 n -0000605035 00000 n -0000603506 00000 n -0000605158 00000 n -0000605283 00000 n -0000605408 00000 n -0000609885 00000 n -0000609123 00000 n -0000605587 00000 n -0000609449 00000 n -0000609267 00000 n -0000609574 00000 n -0000609698 00000 n -0000609822 00000 n -0000613518 00000 n -0000612582 00000 n -0000610058 00000 n -0000612705 00000 n -0000612830 00000 n -0000612955 00000 n -0000613205 00000 n -0000613330 00000 n -0000613455 00000 n -0000614771 00000 n -0000614460 00000 n -0000613662 00000 n -0000614583 00000 n -0000614708 00000 n -0000618607 00000 n -0000618294 00000 n -0000614887 00000 n -0000618417 00000 n -0000618480 00000 n -0000618543 00000 n -0002185462 00000 n -0000620088 00000 n -0000619776 00000 n -0000618737 00000 n -0000619899 00000 n -0000619962 00000 n -0000620024 00000 n -0000623280 00000 n -0000622967 00000 n +0000402828 00000 n +0000402953 00000 n +0000406506 00000 n +0000405819 00000 n +0000403189 00000 n +0000405942 00000 n +0000406005 00000 n +0000406068 00000 n +0000406193 00000 n +0000406318 00000 n +0000406443 00000 n +0002457842 00000 n +0000410747 00000 n +0000410121 00000 n +0000406665 00000 n +0000410244 00000 n +0000410307 00000 n +0000410370 00000 n +0000410432 00000 n +0000410495 00000 n +0000410558 00000 n +0000410621 00000 n +0000410684 00000 n +0000414614 00000 n +0000414135 00000 n +0000410877 00000 n +0000414426 00000 n +0000414551 00000 n +0000414279 00000 n +0000551070 00000 n +0000418145 00000 n +0000417459 00000 n +0000414801 00000 n +0000417582 00000 n +0000417707 00000 n +0000417832 00000 n +0000417957 00000 n +0000418082 00000 n +0000421369 00000 n +0000420810 00000 n +0000418332 00000 n +0000420933 00000 n +0000421058 00000 n +0000421183 00000 n +0000421307 00000 n +0000423391 00000 n +0000423080 00000 n +0000421485 00000 n +0000423203 00000 n +0000423328 00000 n +0000450322 00000 n +0000424070 00000 n +0000423521 00000 n +0000450070 00000 n +0000450133 00000 n +0000450196 00000 n +0000450259 00000 n +0002457967 00000 n +0000454401 00000 n +0000453456 00000 n +0000450475 00000 n +0000454089 00000 n +0000453618 00000 n +0000453769 00000 n +0000454338 00000 n +0000453920 00000 n +0000457764 00000 n +0000457329 00000 n +0000454517 00000 n +0000457452 00000 n +0000457577 00000 n +0000457702 00000 n +0000461672 00000 n +0000461486 00000 n +0000457894 00000 n +0000461609 00000 n +0000465802 00000 n +0000464815 00000 n +0000461788 00000 n +0000465112 00000 n +0000465237 00000 n +0000465300 00000 n +0000465364 00000 n +0000464959 00000 n +0000465489 00000 n +0000465614 00000 n +0000465739 00000 n +0000469530 00000 n +0000468967 00000 n +0000465918 00000 n +0000469090 00000 n +0000469215 00000 n +0000469340 00000 n +0000469403 00000 n +0000469467 00000 n +0000473181 00000 n +0000472622 00000 n +0000469674 00000 n +0000472745 00000 n +0000472870 00000 n +0000472994 00000 n +0000473118 00000 n +0002458092 00000 n +0000475516 00000 n +0000475080 00000 n +0000473354 00000 n +0000475203 00000 n +0000475328 00000 n +0000475453 00000 n +0000478551 00000 n +0000478115 00000 n +0000475632 00000 n +0000478238 00000 n +0000478488 00000 n +0000482153 00000 n +0000481842 00000 n +0000478667 00000 n +0000481965 00000 n +0000484906 00000 n +0000484595 00000 n +0000482283 00000 n +0000484718 00000 n +0000484843 00000 n +0000488277 00000 n +0000490495 00000 n +0000488106 00000 n +0000485050 00000 n +0000489931 00000 n +0000490055 00000 n +0000489090 00000 n +0000489301 00000 n +0000489510 00000 n +0000489721 00000 n +0000490118 00000 n +0000490181 00000 n +0000490244 00000 n +0000490307 00000 n +0000490370 00000 n +0000490433 00000 n +0000494062 00000 n +0000493376 00000 n +0000490682 00000 n +0000493499 00000 n +0000493624 00000 n +0000493749 00000 n +0000493874 00000 n +0000493999 00000 n +0002458217 00000 n +0000498125 00000 n +0000497092 00000 n +0000494192 00000 n +0000497560 00000 n +0000497685 00000 n +0000497245 00000 n +0000497810 00000 n +0000497409 00000 n +0000497935 00000 n +0000497998 00000 n +0000498061 00000 n +0000501048 00000 n +0000500862 00000 n +0000498255 00000 n +0000500985 00000 n +0000504775 00000 n +0000503889 00000 n +0000501164 00000 n +0000504587 00000 n +0000504712 00000 n +0000504051 00000 n +0000504201 00000 n +0000504374 00000 n +0000507291 00000 n +0000506731 00000 n +0000504962 00000 n +0000506854 00000 n +0000506979 00000 n +0000507103 00000 n +0000507228 00000 n +0000510969 00000 n +0000510003 00000 n +0000507478 00000 n +0000510656 00000 n +0000510165 00000 n +0000510327 00000 n +0000510497 00000 n +0000510781 00000 n +0000510906 00000 n +0000514373 00000 n +0000514248 00000 n +0000514811 00000 n +0000514000 00000 n +0000511142 00000 n +0000514123 00000 n +0000514498 00000 n +0000514623 00000 n +0000514748 00000 n +0002458342 00000 n +0000517111 00000 n +0000516800 00000 n +0000514927 00000 n +0000516923 00000 n +0000517048 00000 n +0000520499 00000 n +0000519938 00000 n +0000517255 00000 n +0000520061 00000 n +0000520311 00000 n +0000520436 00000 n +0000523830 00000 n +0000523142 00000 n +0000520601 00000 n +0000523265 00000 n +0000523390 00000 n +0000523515 00000 n +0000523578 00000 n +0000523642 00000 n +0000523767 00000 n +0000526886 00000 n +0000526146 00000 n +0000523946 00000 n +0000526447 00000 n +0000526510 00000 n +0000526573 00000 n +0000526290 00000 n +0000526636 00000 n +0000526699 00000 n +0000526823 00000 n +0000528219 00000 n +0000527909 00000 n +0000527044 00000 n +0000528032 00000 n +0000528095 00000 n +0000528157 00000 n +0000529249 00000 n +0000528813 00000 n +0000528307 00000 n +0000528936 00000 n +0000529186 00000 n +0002458467 00000 n +0000529915 00000 n +0000529667 00000 n +0000529337 00000 n +0000529790 00000 n +0000533349 00000 n +0000532850 00000 n +0000530003 00000 n +0000532973 00000 n +0000533036 00000 n +0000533286 00000 n +0000536443 00000 n +0000536132 00000 n +0000533508 00000 n +0000536255 00000 n +0000536380 00000 n +0000540071 00000 n +0000539635 00000 n +0000536559 00000 n +0000539758 00000 n +0000539883 00000 n +0000540008 00000 n +0000544021 00000 n +0000543207 00000 n +0000540173 00000 n +0000543330 00000 n +0000543455 00000 n +0000543518 00000 n +0000543581 00000 n +0000543644 00000 n +0000543707 00000 n +0000543770 00000 n +0000543833 00000 n +0000543958 00000 n +0000547628 00000 n +0000547318 00000 n +0000544165 00000 n +0000547441 00000 n +0000547565 00000 n +0002458592 00000 n +0000551260 00000 n +0000550822 00000 n +0000547758 00000 n +0000550945 00000 n +0000551133 00000 n +0000551197 00000 n +0000554718 00000 n +0000553973 00000 n +0000551362 00000 n +0000554278 00000 n +0000554341 00000 n +0000554403 00000 n +0000554466 00000 n +0000554530 00000 n +0000554655 00000 n +0000554117 00000 n +0000557924 00000 n +0000557986 00000 n +0000557423 00000 n +0000554834 00000 n +0000557546 00000 n +0000557609 00000 n +0000557672 00000 n +0000557735 00000 n +0000557799 00000 n +0000561705 00000 n +0000561018 00000 n +0000558102 00000 n +0000561141 00000 n +0000561266 00000 n +0000561329 00000 n +0000561392 00000 n +0000561455 00000 n +0000561518 00000 n +0000561642 00000 n +0000564669 00000 n +0000564108 00000 n +0000561821 00000 n +0000564231 00000 n +0000564356 00000 n +0000564481 00000 n +0000564606 00000 n +0000568300 00000 n +0000569303 00000 n +0000568177 00000 n +0000564785 00000 n +0000569115 00000 n +0000569240 00000 n +0002458717 00000 n +0000572795 00000 n +0000572484 00000 n +0000569476 00000 n +0000572607 00000 n +0000572732 00000 n +0000575306 00000 n +0000574746 00000 n +0000572911 00000 n +0000574869 00000 n +0000574994 00000 n +0000575118 00000 n +0000575243 00000 n +0000578711 00000 n +0000578275 00000 n +0000575422 00000 n +0000578398 00000 n +0000578523 00000 n +0000578648 00000 n +0000582223 00000 n +0000581787 00000 n +0000578898 00000 n +0000581910 00000 n +0000582035 00000 n +0000582160 00000 n +0000585749 00000 n +0000585438 00000 n +0000582353 00000 n +0000585561 00000 n +0000585686 00000 n +0000593207 00000 n +0000590365 00000 n +0000589755 00000 n +0000585936 00000 n +0000590052 00000 n +0000590177 00000 n +0000590302 00000 n +0000589899 00000 n +0002458842 00000 n +0000609663 00000 n +0000609980 00000 n +0000593084 00000 n +0000590467 00000 n +0000609600 00000 n +0000609726 00000 n +0000609789 00000 n +0000609853 00000 n +0000609916 00000 n +0000615608 00000 n +0000615041 00000 n +0000610147 00000 n +0000615164 00000 n +0000615227 00000 n +0000615290 00000 n +0000615354 00000 n +0000615417 00000 n +0000615481 00000 n +0000615544 00000 n +0000619410 00000 n +0000618537 00000 n +0000615710 00000 n +0000618660 00000 n +0000618723 00000 n +0000618786 00000 n +0000618848 00000 n +0000618973 00000 n +0000619098 00000 n +0000619222 00000 n +0000619347 00000 n +0000620376 00000 n 0000620190 00000 n -0000623090 00000 n -0000623153 00000 n -0000623216 00000 n -0000626892 00000 n -0000626331 00000 n -0000623382 00000 n -0000626454 00000 n -0000626704 00000 n -0000626829 00000 n -0000630382 00000 n -0000629883 00000 n -0000627065 00000 n -0000630006 00000 n -0000630069 00000 n -0000630132 00000 n -0000630194 00000 n -0000630319 00000 n -0000632990 00000 n -0000632304 00000 n -0000630512 00000 n -0000632427 00000 n -0000632552 00000 n -0000632677 00000 n -0000632740 00000 n -0000632804 00000 n -0000632929 00000 n -0000635764 00000 n -0000635205 00000 n -0000633120 00000 n -0000635328 00000 n -0000635453 00000 n -0000635577 00000 n -0000635701 00000 n -0002185587 00000 n -0000639528 00000 n -0000639092 00000 n -0000635894 00000 n -0000639215 00000 n -0000639465 00000 n -0000644045 00000 n -0000643609 00000 n -0000639658 00000 n -0000643732 00000 n -0000643857 00000 n -0000643982 00000 n -0000648925 00000 n -0000648363 00000 n -0000644203 00000 n -0000648486 00000 n -0002040610 00000 n -0002038736 00000 n -0002040442 00000 n -0000648611 00000 n -0000648674 00000 n -0000648737 00000 n -0000648862 00000 n -0000651116 00000 n -0000650930 00000 n -0000649083 00000 n -0000651053 00000 n -0000655484 00000 n -0000654798 00000 n -0000651218 00000 n -0000654921 00000 n -0000654984 00000 n -0000655047 00000 n -0000655172 00000 n -0000655297 00000 n -0000655422 00000 n -0000659425 00000 n -0000658865 00000 n -0000655600 00000 n -0000658988 00000 n -0000659051 00000 n -0000659114 00000 n -0000659238 00000 n -0000659362 00000 n -0002185712 00000 n -0000663332 00000 n -0000662896 00000 n -0000659555 00000 n -0000663019 00000 n -0000663082 00000 n -0000663145 00000 n -0000663270 00000 n -0000667647 00000 n -0000666962 00000 n -0000663462 00000 n -0000667085 00000 n -0000667148 00000 n -0000667211 00000 n -0000667336 00000 n -0000667399 00000 n -0000667462 00000 n -0000667586 00000 n -0000671599 00000 n -0000670974 00000 n -0000667777 00000 n -0000671097 00000 n -0000671160 00000 n -0000671223 00000 n -0000671286 00000 n -0000671411 00000 n -0000671536 00000 n -0000676176 00000 n -0000675617 00000 n -0000671814 00000 n -0000675740 00000 n -0000675865 00000 n -0000675990 00000 n -0000676114 00000 n -0000680778 00000 n -0000680219 00000 n -0000676391 00000 n -0000680342 00000 n -0000680467 00000 n -0000680591 00000 n -0000680715 00000 n -0000685799 00000 n -0000684707 00000 n -0000680908 00000 n -0000685612 00000 n -0000685737 00000 n -0000684878 00000 n -0000685060 00000 n -0000685240 00000 n -0000685427 00000 n -0002185837 00000 n -0000689992 00000 n -0000689305 00000 n -0000685943 00000 n -0000689428 00000 n -0000689553 00000 n -0000689678 00000 n -0000689803 00000 n -0000689866 00000 n -0000689929 00000 n -0000692080 00000 n -0000691643 00000 n -0000690122 00000 n -0000691766 00000 n -0000691829 00000 n -0000691891 00000 n -0000691954 00000 n -0000692017 00000 n -0000693774 00000 n -0000693465 00000 n -0000692239 00000 n -0000693588 00000 n -0000693712 00000 n -0000697600 00000 n -0000697039 00000 n -0000693975 00000 n -0000697162 00000 n -0000697412 00000 n -0000697537 00000 n -0000702412 00000 n -0000702101 00000 n -0000697759 00000 n -0000702224 00000 n -0000702349 00000 n -0000706762 00000 n -0000706576 00000 n -0000702556 00000 n -0000706699 00000 n -0002185962 00000 n -0000711034 00000 n -0000710224 00000 n -0000706864 00000 n -0000710347 00000 n -0000710472 00000 n -0000710596 00000 n -0000710721 00000 n -0000710846 00000 n -0000710971 00000 n -0000715502 00000 n -0000714818 00000 n -0000711136 00000 n -0000714941 00000 n -0000715066 00000 n -0000715191 00000 n -0000715315 00000 n -0000715439 00000 n -0000719985 00000 n -0000719675 00000 n -0000715632 00000 n -0000719798 00000 n -0000719923 00000 n -0000723402 00000 n -0000722842 00000 n -0000720101 00000 n -0000722965 00000 n -0000723090 00000 n -0000723215 00000 n -0000723339 00000 n -0000726743 00000 n -0000726432 00000 n -0000723518 00000 n -0000726555 00000 n -0000726680 00000 n -0000729114 00000 n -0000728928 00000 n -0000726873 00000 n -0000729051 00000 n -0002186087 00000 n -0000732356 00000 n -0000731920 00000 n -0000729273 00000 n -0000732043 00000 n -0000732168 00000 n -0000732293 00000 n -0000736320 00000 n -0000735885 00000 n -0000732486 00000 n -0000736008 00000 n -0000736132 00000 n -0000736257 00000 n -0000740895 00000 n -0000738904 00000 n -0000736450 00000 n -0000740584 00000 n -0000740709 00000 n -0000740832 00000 n -0000739102 00000 n -0000739313 00000 n -0000739525 00000 n -0000739737 00000 n -0000739949 00000 n -0000740161 00000 n -0000740372 00000 n -0000744880 00000 n -0000744070 00000 n -0000741025 00000 n -0000744193 00000 n -0000744443 00000 n -0000744568 00000 n -0000744693 00000 n -0000744818 00000 n -0000748491 00000 n -0000747930 00000 n -0000744982 00000 n -0000748053 00000 n -0000748178 00000 n -0000748303 00000 n -0000748428 00000 n -0000751410 00000 n -0000750975 00000 n -0000748621 00000 n -0000751098 00000 n -0000751223 00000 n -0000751348 00000 n -0002186212 00000 n -0000755673 00000 n -0000754793 00000 n -0000751526 00000 n -0000755106 00000 n -0000755232 00000 n -0000754937 00000 n -0000755358 00000 n -0000755484 00000 n -0000755610 00000 n -0000759641 00000 n -0000759078 00000 n -0000755789 00000 n -0000759201 00000 n -0000759452 00000 n -0000759578 00000 n -0000764092 00000 n -0000763281 00000 n -0000759743 00000 n -0000763404 00000 n -0000763530 00000 n -0000763654 00000 n -0000763779 00000 n -0000763905 00000 n -0000764030 00000 n -0000768054 00000 n -0000767743 00000 n -0000764194 00000 n -0000767866 00000 n -0000767991 00000 n -0000770599 00000 n -0000770161 00000 n -0000768170 00000 n -0000770284 00000 n -0000770410 00000 n -0000770536 00000 n -0000774435 00000 n -0000773364 00000 n -0000770772 00000 n -0000774120 00000 n -0000774372 00000 n -0000773526 00000 n -0000773762 00000 n -0000773941 00000 n -0002186337 00000 n -0000776415 00000 n -0000776103 00000 n -0000774565 00000 n -0000776226 00000 n -0000776352 00000 n -0000780440 00000 n -0000779876 00000 n -0000776531 00000 n -0000779999 00000 n -0000780251 00000 n -0000780377 00000 n -0000784964 00000 n -0000783960 00000 n -0000780585 00000 n -0000784083 00000 n -0000784209 00000 n -0000784272 00000 n -0000784335 00000 n -0000784398 00000 n -0000784461 00000 n -0000784524 00000 n -0000784587 00000 n -0000784650 00000 n -0000784775 00000 n -0000784901 00000 n -0000788732 00000 n -0000788295 00000 n -0000785179 00000 n -0000788418 00000 n -0000788543 00000 n -0000788669 00000 n -0000792169 00000 n -0000791732 00000 n -0000788904 00000 n -0000791855 00000 n -0000791981 00000 n -0000792106 00000 n -0000794539 00000 n -0000794228 00000 n -0000792299 00000 n -0000794351 00000 n -0000794477 00000 n -0002186462 00000 n -0000797301 00000 n -0000797115 00000 n -0000794726 00000 n -0000797238 00000 n -0000802523 00000 n -0000800277 00000 n -0000799965 00000 n -0000797445 00000 n -0000800088 00000 n -0000800214 00000 n -0000806000 00000 n -0000802400 00000 n -0000800421 00000 n -0000805937 00000 n -0000805766 00000 n -0000805824 00000 n -0000805914 00000 n -0000810301 00000 n -0000811429 00000 n -0000810178 00000 n -0000806187 00000 n -0000811114 00000 n -0000811240 00000 n -0000811366 00000 n -0000816388 00000 n -0000816077 00000 n -0000811630 00000 n -0000816200 00000 n -0000816326 00000 n -0000821396 00000 n -0000820959 00000 n -0000816532 00000 n -0000821082 00000 n -0000821208 00000 n -0000821334 00000 n -0002186587 00000 n -0000825999 00000 n -0000825624 00000 n -0000821512 00000 n -0000825747 00000 n -0000825873 00000 n -0000825936 00000 n -0000830293 00000 n -0000829981 00000 n -0000826143 00000 n -0000830104 00000 n -0000830230 00000 n -0000835473 00000 n -0000834650 00000 n -0000830437 00000 n -0000835158 00000 n -0000835284 00000 n -0000834803 00000 n -0000834983 00000 n -0000835410 00000 n -0000839877 00000 n -0000839440 00000 n -0000835617 00000 n -0000839563 00000 n -0000839689 00000 n -0000839814 00000 n -0000843720 00000 n -0000843408 00000 n -0000840035 00000 n -0000843531 00000 n -0000843657 00000 n -0000847254 00000 n -0000846942 00000 n -0000843921 00000 n -0000847065 00000 n -0000847191 00000 n -0002186712 00000 n -0000852101 00000 n -0000851664 00000 n -0000847455 00000 n -0000851787 00000 n -0000851913 00000 n -0000852039 00000 n -0000857137 00000 n -0000856448 00000 n -0000852259 00000 n -0000856571 00000 n -0000856697 00000 n -0000856760 00000 n -0000856823 00000 n -0000856886 00000 n -0000856948 00000 n -0000857074 00000 n -0000859887 00000 n -0000859701 00000 n -0000857295 00000 n -0000859824 00000 n -0000863812 00000 n -0000863374 00000 n -0000860074 00000 n -0000863497 00000 n -0000863623 00000 n -0000863749 00000 n -0000866587 00000 n -0000866275 00000 n -0000863970 00000 n -0000866398 00000 n -0000866524 00000 n -0000869304 00000 n -0000868992 00000 n -0000866731 00000 n -0000869115 00000 n -0000869241 00000 n -0002186837 00000 n -0000872085 00000 n -0000871773 00000 n -0000869448 00000 n -0000871896 00000 n -0000872022 00000 n -0000876618 00000 n -0000876180 00000 n -0000872215 00000 n -0000876303 00000 n -0000876429 00000 n -0000876555 00000 n -0000879139 00000 n -0000878827 00000 n -0000876776 00000 n -0000878950 00000 n -0000879076 00000 n -0000883613 00000 n -0000883175 00000 n -0000879283 00000 n -0000883298 00000 n -0000883424 00000 n -0000883550 00000 n -0000888474 00000 n -0000888162 00000 n -0000883814 00000 n -0000888285 00000 n -0000888411 00000 n -0000892899 00000 n -0000892461 00000 n -0000888618 00000 n -0000892584 00000 n -0000892710 00000 n -0000892836 00000 n -0002186962 00000 n -0000898753 00000 n -0000897373 00000 n -0000893029 00000 n -0000897496 00000 n -0000897622 00000 n -0000897748 00000 n -0000897811 00000 n -0000897874 00000 n -0000897935 00000 n -0000897997 00000 n -0000898060 00000 n -0000898123 00000 n -0000898186 00000 n -0000898249 00000 n -0000898312 00000 n -0000898375 00000 n -0000898438 00000 n -0000898501 00000 n -0000898564 00000 n -0000898627 00000 n -0000898690 00000 n -0000902332 00000 n -0000902020 00000 n -0000898883 00000 n -0000902143 00000 n -0000902269 00000 n -0000903628 00000 n -0000903442 00000 n -0000902533 00000 n -0000903565 00000 n -0000907766 00000 n -0000907329 00000 n -0000903744 00000 n -0000907452 00000 n -0000907578 00000 n -0000907704 00000 n -0000912026 00000 n -0000911714 00000 n -0000907981 00000 n -0000911837 00000 n -0000911963 00000 n -0000913407 00000 n -0000913221 00000 n -0000912198 00000 n -0000913344 00000 n -0002187087 00000 n -0000915093 00000 n -0000914907 00000 n -0000913509 00000 n -0000915030 00000 n -0000919946 00000 n -0000918865 00000 n -0000915195 00000 n -0000919380 00000 n -0000919506 00000 n -0000919632 00000 n -0000919758 00000 n -0000919018 00000 n -0000919199 00000 n -0000919884 00000 n -0000924388 00000 n -0000923636 00000 n -0000920090 00000 n -0000923759 00000 n -0000923885 00000 n -0000924011 00000 n -0000924137 00000 n -0000924199 00000 n -0000924262 00000 n -0000924325 00000 n -0000928996 00000 n -0000928452 00000 n -0000924532 00000 n -0000928807 00000 n -0000928933 00000 n -0000928596 00000 n -0000933499 00000 n -0000933062 00000 n -0000929154 00000 n -0000933185 00000 n -0000933311 00000 n -0000933436 00000 n -0000937002 00000 n -0000936111 00000 n -0000933657 00000 n -0000936436 00000 n -0000936255 00000 n -0000936562 00000 n -0000936688 00000 n -0000936814 00000 n -0000936939 00000 n -0002187212 00000 n -0000941929 00000 n -0000940744 00000 n -0000937160 00000 n -0000941238 00000 n -0000941490 00000 n -0000941616 00000 n -0000940897 00000 n -0000941742 00000 n -0000941065 00000 n -0000941866 00000 n -0000946096 00000 n -0000945253 00000 n -0000942045 00000 n -0000945781 00000 n -0000945406 00000 n -0000945593 00000 n -0000945907 00000 n -0002036645 00000 n -0002032638 00000 n -0002036478 00000 n -0000946033 00000 n -0000948559 00000 n -0000948247 00000 n -0000946325 00000 n -0000948370 00000 n -0000948496 00000 n -0000952432 00000 n -0000951868 00000 n -0000948675 00000 n -0000951991 00000 n -0000952117 00000 n -0000952243 00000 n -0000952369 00000 n -0000956054 00000 n -0000955617 00000 n -0000952562 00000 n -0000955740 00000 n -0000955865 00000 n -0000955991 00000 n -0000960622 00000 n -0000960184 00000 n -0000956269 00000 n -0000960307 00000 n -0000960433 00000 n -0000960559 00000 n -0002187337 00000 n -0000967989 00000 n -0000965225 00000 n -0000964661 00000 n -0000960766 00000 n -0000964784 00000 n -0000964910 00000 n -0000965036 00000 n -0000965162 00000 n -0000984281 00000 n -0000967866 00000 n -0000965412 00000 n -0000984028 00000 n -0000984091 00000 n -0000984154 00000 n -0002031255 00000 n -0002028991 00000 n -0002031092 00000 n -0000984217 00000 n -0000983840 00000 n -0000986873 00000 n -0000998627 00000 n -0000986750 00000 n -0000984456 00000 n -0000998248 00000 n -0000998374 00000 n -0000998437 00000 n -0000998500 00000 n -0000998563 00000 n -0000998063 00000 n -0001000452 00000 n -0001012951 00000 n -0001000329 00000 n -0000998858 00000 n -0001012573 00000 n -0001012698 00000 n -0001012761 00000 n -0001012824 00000 n -0001012887 00000 n -0001012387 00000 n -0001017004 00000 n -0001016692 00000 n -0001013140 00000 n -0001016815 00000 n -0001016941 00000 n -0001021395 00000 n -0001020442 00000 n -0001017191 00000 n -0001020955 00000 n -0001021081 00000 n -0001020595 00000 n -0001020775 00000 n -0001021207 00000 n -0001021333 00000 n -0002187462 00000 n -0001026368 00000 n -0001025480 00000 n -0001021624 00000 n -0001026179 00000 n -0001025642 00000 n -0001025824 00000 n -0001026001 00000 n -0001026305 00000 n -0001029495 00000 n -0001029183 00000 n -0001026540 00000 n -0001029306 00000 n -0001029432 00000 n -0001032827 00000 n -0001032390 00000 n -0001029710 00000 n -0001032513 00000 n -0001032639 00000 n -0001032765 00000 n -0001034926 00000 n -0001054724 00000 n -0001052836 00000 n -0001034803 00000 n -0001033028 00000 n -0001052459 00000 n -0001052522 00000 n -0001052585 00000 n -0001052648 00000 n -0001052774 00000 n -0001052273 00000 n -0001079461 00000 n -0001077326 00000 n -0001054601 00000 n -0001053025 00000 n -0001076948 00000 n -0001077011 00000 n -0001077074 00000 n -0001077137 00000 n -0001077264 00000 n -0001076760 00000 n -0001108502 00000 n -0001106336 00000 n -0001079338 00000 n -0001077544 00000 n -0001106083 00000 n -0001106146 00000 n -0001106209 00000 n -0001106272 00000 n -0002187587 00000 n -0001105895 00000 n -0001349411 00000 n -0001133349 00000 n -0001108379 00000 n -0001106512 00000 n -0001132845 00000 n -0001132908 00000 n -0001132971 00000 n -0001133034 00000 n -0001133161 00000 n -0001133287 00000 n -0001132657 00000 n -0001387184 00000 n -0001138328 00000 n -0001138016 00000 n -0001133525 00000 n -0001138139 00000 n -0001138265 00000 n -0001141974 00000 n -0001141662 00000 n -0001138472 00000 n -0001141785 00000 n -0001141911 00000 n -0001146099 00000 n -0001145410 00000 n -0001142104 00000 n -0001145533 00000 n -0001145659 00000 n -0001145785 00000 n -0001145911 00000 n -0001146036 00000 n -0001149199 00000 n -0001149013 00000 n -0001146300 00000 n -0001149136 00000 n -0001413617 00000 n -0001153398 00000 n -0001152961 00000 n -0001149414 00000 n -0001153084 00000 n -0001153210 00000 n -0001153335 00000 n -0002187712 00000 n -0001158088 00000 n -0001157380 00000 n -0001153528 00000 n -0001157899 00000 n -0001157533 00000 n -0001157716 00000 n -0001158025 00000 n -0001163551 00000 n -0001162065 00000 n -0001158232 00000 n -0001163362 00000 n -0001163488 00000 n -0001162254 00000 n -0001162435 00000 n -0001162618 00000 n -0001162793 00000 n -0001163004 00000 n -0001163185 00000 n -0001453313 00000 n -0001168185 00000 n -0001167043 00000 n -0001163695 00000 n -0001167619 00000 n -0001167745 00000 n -0001167196 00000 n -0001167408 00000 n -0001167871 00000 n -0001167997 00000 n -0001168122 00000 n -0001476940 00000 n -0001502068 00000 n -0001172696 00000 n -0001172007 00000 n -0001168386 00000 n -0001172130 00000 n -0001172255 00000 n -0001172381 00000 n -0001172507 00000 n -0001172633 00000 n -0001177479 00000 n -0001176715 00000 n -0001172840 00000 n -0001177038 00000 n -0001177164 00000 n -0001176859 00000 n -0001177290 00000 n -0001177416 00000 n -0001182138 00000 n -0001181325 00000 n -0001177637 00000 n -0001181448 00000 n -0001181574 00000 n -0001181700 00000 n -0001181825 00000 n -0001181951 00000 n -0001182076 00000 n -0002187837 00000 n -0001186104 00000 n -0001185540 00000 n -0001182254 00000 n -0001185663 00000 n -0001185789 00000 n -0001185915 00000 n -0001186041 00000 n -0001188699 00000 n -0001187995 00000 n -0001186248 00000 n -0001188510 00000 n -0001188636 00000 n -0001188148 00000 n -0001188328 00000 n -0001191357 00000 n -0001191047 00000 n -0001188829 00000 n -0001191170 00000 n -0001191296 00000 n -0001195087 00000 n -0001194444 00000 n -0001191544 00000 n -0001194772 00000 n -0001194898 00000 n -0001195024 00000 n -0001194588 00000 n -0001197221 00000 n -0001196909 00000 n -0001195274 00000 n -0001197032 00000 n -0001197158 00000 n -0001201702 00000 n -0001201134 00000 n -0001197436 00000 n -0001201257 00000 n -0001201320 00000 n -0001201384 00000 n -0001201448 00000 n -0001201512 00000 n -0001201639 00000 n -0002187962 00000 n -0001205961 00000 n -0001205649 00000 n -0001201931 00000 n -0001205772 00000 n -0001205898 00000 n -0001208433 00000 n -0001208121 00000 n -0001206119 00000 n -0001208244 00000 n -0001208370 00000 n -0001211846 00000 n -0001211221 00000 n -0001208620 00000 n -0001211344 00000 n -0001211469 00000 n -0001211531 00000 n -0001211594 00000 n -0001211657 00000 n -0001211720 00000 n -0001211783 00000 n -0001215551 00000 n -0001214800 00000 n -0001211962 00000 n -0001214923 00000 n -0001215049 00000 n -0001215112 00000 n -0001215175 00000 n -0001215238 00000 n -0001215364 00000 n -0001215489 00000 n -0001219955 00000 n -0001219517 00000 n -0001215738 00000 n -0001219640 00000 n -0001219766 00000 n -0001219892 00000 n -0001224261 00000 n -0001223572 00000 n -0001220156 00000 n -0001223695 00000 n -0001223821 00000 n -0001223884 00000 n -0001223947 00000 n -0001224009 00000 n -0001224072 00000 n -0001224198 00000 n -0002027798 00000 n -0002025797 00000 n -0002027632 00000 n -0002188087 00000 n -0001228120 00000 n -0001227683 00000 n -0001224433 00000 n -0001227806 00000 n -0001227932 00000 n -0001228057 00000 n -0001231610 00000 n -0001231298 00000 n -0001228306 00000 n -0001231421 00000 n -0001231547 00000 n -0001235050 00000 n -0001234361 00000 n -0001231782 00000 n -0001234484 00000 n -0001234610 00000 n -0001234736 00000 n -0001234861 00000 n -0001234987 00000 n -0001237729 00000 n -0001237291 00000 n -0001235194 00000 n -0001237414 00000 n -0001237540 00000 n -0001237666 00000 n -0001240446 00000 n -0001239882 00000 n -0001237873 00000 n -0001240005 00000 n -0001240131 00000 n -0001240257 00000 n -0001240383 00000 n -0001242651 00000 n -0001242213 00000 n -0001240562 00000 n -0001242336 00000 n -0001242462 00000 n -0001242588 00000 n -0002188212 00000 n -0001245846 00000 n -0001245286 00000 n -0001242781 00000 n -0001245409 00000 n -0001245535 00000 n -0001245660 00000 n -0001245784 00000 n -0001248734 00000 n -0001248172 00000 n -0001246004 00000 n -0001248295 00000 n -0001248421 00000 n -0001248545 00000 n -0001248671 00000 n -0001252887 00000 n -0001252197 00000 n -0001248878 00000 n -0001252320 00000 n -0001252446 00000 n -0001252572 00000 n -0001252698 00000 n -0001252824 00000 n -0001256068 00000 n -0001255417 00000 n -0001253031 00000 n -0001255753 00000 n -0001255879 00000 n -0001256005 00000 n -0001255561 00000 n -0001262153 00000 n -0001260159 00000 n -0001256184 00000 n -0001261712 00000 n -0001260357 00000 n -0001260550 00000 n -0001261838 00000 n -0001260743 00000 n -0001260949 00000 n -0001261139 00000 n -0001261964 00000 n -0001262090 00000 n -0001261332 00000 n -0001261517 00000 n -0001269296 00000 n -0001266640 00000 n -0001262340 00000 n -0001268981 00000 n -0001269107 00000 n -0001269233 00000 n -0001266874 00000 n -0001267092 00000 n -0001267309 00000 n -0001267526 00000 n -0001267707 00000 n -0001267884 00000 n -0001268051 00000 n -0001268230 00000 n -0001268406 00000 n -0001268591 00000 n -0001268761 00000 n -0002188337 00000 n -0001275791 00000 n -0001273479 00000 n -0001269426 00000 n -0001275476 00000 n -0001275602 00000 n -0001273686 00000 n -0001273918 00000 n -0001274150 00000 n -0001274382 00000 n -0001274651 00000 n -0001275728 00000 n -0001274920 00000 n -0001275130 00000 n -0001275302 00000 n -0001282106 00000 n -0001280080 00000 n -0001275907 00000 n -0001281666 00000 n -0001281792 00000 n -0001280278 00000 n -0001280493 00000 n -0001280682 00000 n -0001280866 00000 n -0001281917 00000 n -0001281100 00000 n -0001281296 00000 n -0001282043 00000 n +0000619526 00000 n +0000620313 00000 n +0000623850 00000 n +0000623289 00000 n +0000620478 00000 n +0000623412 00000 n +0000623662 00000 n +0000623787 00000 n +0000627667 00000 n +0000627356 00000 n +0000624009 00000 n +0000627479 00000 n +0000627604 00000 n +0002458967 00000 n +0000633262 00000 n +0000631573 00000 n +0000631137 00000 n +0000627783 00000 n +0000631260 00000 n +0000631385 00000 n +0000631510 00000 n +0000640036 00000 n +0000633139 00000 n +0000631689 00000 n +0000639785 00000 n +0000639848 00000 n +0000639911 00000 n +0000639974 00000 n +0000643778 00000 n +0000643217 00000 n +0000640245 00000 n +0000643340 00000 n +0000643465 00000 n +0000643590 00000 n +0000643715 00000 n +0000647637 00000 n +0000646950 00000 n +0000643908 00000 n +0000647073 00000 n +0000647198 00000 n +0000647261 00000 n +0000647325 00000 n +0000647450 00000 n +0000647574 00000 n +0000650130 00000 n +0000649820 00000 n +0000647767 00000 n +0000649943 00000 n +0000650068 00000 n +0000652726 00000 n +0000652240 00000 n +0000650288 00000 n +0000652537 00000 n +0000652384 00000 n +0000652600 00000 n +0000652663 00000 n +0002459092 00000 n +0000696772 00000 n +0000656577 00000 n +0000655953 00000 n +0000652856 00000 n +0000656076 00000 n +0000656139 00000 n +0000656264 00000 n +0000656389 00000 n +0000656514 00000 n +0000660911 00000 n +0000659699 00000 n +0000656707 00000 n +0000660598 00000 n +0000660723 00000 n +0000660848 00000 n +0000659870 00000 n +0000660038 00000 n +0000660233 00000 n +0000660427 00000 n +0000665568 00000 n +0000664193 00000 n +0000661098 00000 n +0000665256 00000 n +0000664373 00000 n +0000664559 00000 n +0000664759 00000 n +0000665381 00000 n +0000664932 00000 n +0000665506 00000 n +0000665085 00000 n +0000667804 00000 n +0000667493 00000 n +0000665698 00000 n +0000667616 00000 n +0000667741 00000 n +0000669458 00000 n +0000669147 00000 n +0000667920 00000 n +0000669270 00000 n +0000669395 00000 n +0000672069 00000 n +0000671635 00000 n +0000669574 00000 n +0000671758 00000 n +0000671883 00000 n +0000672007 00000 n +0002459217 00000 n +0000675125 00000 n +0000674689 00000 n +0000672256 00000 n +0000674812 00000 n +0000674875 00000 n +0000674938 00000 n +0000675062 00000 n +0000678906 00000 n +0000678264 00000 n +0000675227 00000 n +0000678718 00000 n +0000678417 00000 n +0000678843 00000 n +0000678565 00000 n +0000683336 00000 n +0000682898 00000 n +0000679050 00000 n +0000683021 00000 n +0000683084 00000 n +0000683147 00000 n +0000683273 00000 n +0000686064 00000 n +0000685628 00000 n +0000683480 00000 n +0000685751 00000 n +0000685876 00000 n +0000686001 00000 n +0000689654 00000 n +0000689092 00000 n +0000686222 00000 n +0000689215 00000 n +0000689340 00000 n +0000689464 00000 n +0000689527 00000 n +0000689590 00000 n +0000693956 00000 n +0000693518 00000 n +0000689841 00000 n +0000693641 00000 n +0000693704 00000 n +0000693767 00000 n +0000693893 00000 n +0002459342 00000 n +0000697209 00000 n +0000696223 00000 n +0000694072 00000 n +0000696522 00000 n +0000696647 00000 n +0000696897 00000 n +0000697022 00000 n +0000696367 00000 n +0000697146 00000 n +0000698503 00000 n +0000698192 00000 n +0000697339 00000 n +0000698315 00000 n +0000698440 00000 n +0000704099 00000 n +0000701941 00000 n +0000701505 00000 n +0000698619 00000 n +0000701628 00000 n +0000701878 00000 n +0000711801 00000 n +0000703976 00000 n +0000702114 00000 n +0000711298 00000 n +0000711361 00000 n +0000711424 00000 n +0000711487 00000 n +0000711613 00000 n +0000711676 00000 n +0000711739 00000 n +0000714383 00000 n +0000714009 00000 n +0000711968 00000 n +0000714132 00000 n +0000714195 00000 n +0000714320 00000 n +0000716962 00000 n +0000716274 00000 n +0000714513 00000 n +0000716397 00000 n +0000716522 00000 n +0000716647 00000 n +0000716710 00000 n +0000716774 00000 n +0000716899 00000 n +0002459467 00000 n +0000719961 00000 n +0000719278 00000 n +0000717092 00000 n +0000719401 00000 n +0000719526 00000 n +0000719651 00000 n +0000719776 00000 n +0000719899 00000 n +0000721644 00000 n +0000721458 00000 n +0000720091 00000 n +0000721581 00000 n +0000725048 00000 n +0000724612 00000 n +0000721760 00000 n +0000724735 00000 n +0000724985 00000 n +0000728891 00000 n +0000728455 00000 n +0000725178 00000 n +0000728578 00000 n +0000728703 00000 n +0000728828 00000 n +0000733051 00000 n +0000732865 00000 n +0000729035 00000 n +0000732988 00000 n +0002295652 00000 n +0002293374 00000 n +0002295484 00000 n +0000739085 00000 n +0000736516 00000 n +0000735781 00000 n +0000733195 00000 n +0000736076 00000 n +0000736201 00000 n +0000736264 00000 n +0000736327 00000 n +0000736453 00000 n +0000735925 00000 n +0002459592 00000 n +0000747233 00000 n +0000747550 00000 n +0000738962 00000 n +0000736646 00000 n +0000747170 00000 n +0000747296 00000 n +0000747359 00000 n +0000747423 00000 n +0000747487 00000 n +0000752505 00000 n +0000751693 00000 n +0000747717 00000 n +0000751816 00000 n +0000751941 00000 n +0000752065 00000 n +0000752128 00000 n +0000752191 00000 n +0000752317 00000 n +0000752442 00000 n +0000757975 00000 n +0000757411 00000 n +0000752621 00000 n +0000757534 00000 n +0000757597 00000 n +0000757660 00000 n +0000757723 00000 n +0000757786 00000 n +0000757912 00000 n +0000762170 00000 n +0000761297 00000 n +0000758091 00000 n +0000761420 00000 n +0000761545 00000 n +0000761670 00000 n +0000761733 00000 n +0000761795 00000 n +0000761920 00000 n +0000761982 00000 n +0000762045 00000 n +0000762107 00000 n +0000765890 00000 n +0000765330 00000 n +0000762314 00000 n +0000765453 00000 n +0000765578 00000 n +0000765703 00000 n +0000765827 00000 n +0000769055 00000 n +0000768619 00000 n +0000766077 00000 n +0000768742 00000 n +0000768867 00000 n +0000768992 00000 n +0002459717 00000 n +0000773075 00000 n +0000772515 00000 n +0000769199 00000 n +0000772638 00000 n +0000772763 00000 n +0000772887 00000 n +0000773012 00000 n +0000776574 00000 n +0000776263 00000 n +0000773191 00000 n +0000776386 00000 n +0000776511 00000 n +0000779877 00000 n +0000779566 00000 n +0000776718 00000 n +0000779689 00000 n +0000779814 00000 n +0000782569 00000 n +0000781945 00000 n +0000780036 00000 n +0000782068 00000 n +0000782193 00000 n +0000782317 00000 n +0000782380 00000 n +0000782443 00000 n +0000782506 00000 n +0000784222 00000 n +0000783847 00000 n +0000782742 00000 n +0000783970 00000 n +0000784033 00000 n +0000784096 00000 n +0000784159 00000 n +0000787493 00000 n +0000787057 00000 n +0000784381 00000 n +0000787180 00000 n +0000787305 00000 n +0000787430 00000 n +0002459842 00000 n +0000790627 00000 n +0000790067 00000 n +0000787694 00000 n +0000790190 00000 n +0000790440 00000 n +0000790565 00000 n +0000794868 00000 n +0000794558 00000 n +0000790786 00000 n +0000794681 00000 n +0000794805 00000 n +0000799161 00000 n +0000798975 00000 n +0000795012 00000 n +0000799098 00000 n +0000803008 00000 n +0000802449 00000 n +0000799277 00000 n +0000802572 00000 n +0000802697 00000 n +0000802822 00000 n +0000802947 00000 n +0000807053 00000 n +0000806367 00000 n +0000803110 00000 n +0000806490 00000 n +0000806615 00000 n +0000806740 00000 n +0000806865 00000 n +0000806990 00000 n +0000810734 00000 n +0000810299 00000 n +0000807155 00000 n +0000810422 00000 n +0000810546 00000 n +0000810671 00000 n +0002459967 00000 n +0000814635 00000 n +0000814324 00000 n +0000810850 00000 n +0000814447 00000 n +0000814572 00000 n +0000817944 00000 n +0000817383 00000 n +0000814751 00000 n +0000817506 00000 n +0000817631 00000 n +0000817756 00000 n +0000817881 00000 n +0000821509 00000 n +0000820946 00000 n +0000818046 00000 n +0000821069 00000 n +0000821132 00000 n +0000821195 00000 n +0000821258 00000 n +0000821322 00000 n +0000821446 00000 n +0000823730 00000 n +0000823544 00000 n +0000821625 00000 n +0000823667 00000 n +0000826488 00000 n +0000826177 00000 n +0000823889 00000 n +0000826300 00000 n +0000826425 00000 n +0000828923 00000 n +0000828487 00000 n +0000826675 00000 n +0000828610 00000 n +0000828735 00000 n +0000828860 00000 n +0002460092 00000 n +0000832725 00000 n +0000832289 00000 n +0000829039 00000 n +0000832412 00000 n +0000832537 00000 n +0000832662 00000 n +0000838367 00000 n +0000835247 00000 n +0000832855 00000 n +0000837930 00000 n +0000838055 00000 n +0000835490 00000 n +0000835678 00000 n +0000838180 00000 n +0000835865 00000 n +0000836053 00000 n +0000838304 00000 n +0000836240 00000 n +0000836452 00000 n +0000836663 00000 n +0000836875 00000 n +0000837085 00000 n +0000837297 00000 n +0000837508 00000 n +0000837719 00000 n +0000841840 00000 n +0000841150 00000 n +0000838497 00000 n +0000841273 00000 n +0000841525 00000 n +0000841651 00000 n +0000841777 00000 n +0000845028 00000 n +0000844464 00000 n +0000841942 00000 n +0000844587 00000 n +0000844713 00000 n +0000844839 00000 n +0000844965 00000 n +0000848056 00000 n +0000847618 00000 n +0000845144 00000 n +0000847741 00000 n +0000847867 00000 n +0000847993 00000 n +0000851378 00000 n +0000850498 00000 n +0000848158 00000 n +0000850812 00000 n +0000850938 00000 n +0000851064 00000 n +0000850642 00000 n +0000851189 00000 n +0000851315 00000 n +0002460217 00000 n +0000853710 00000 n +0000853398 00000 n +0000851494 00000 n +0000853521 00000 n +0000853647 00000 n +0000857317 00000 n +0000856753 00000 n +0000853812 00000 n +0000856876 00000 n +0000857128 00000 n +0000857254 00000 n +0000860922 00000 n +0000860358 00000 n +0000857419 00000 n +0000860481 00000 n +0000860607 00000 n +0000860733 00000 n +0000860859 00000 n +0000863152 00000 n +0000872046 00000 n +0000863029 00000 n +0000861024 00000 n +0000871668 00000 n +0000871794 00000 n +0000871857 00000 n +0000871920 00000 n +0000871983 00000 n +0000875661 00000 n +0000875223 00000 n +0000872227 00000 n +0000875346 00000 n +0000875472 00000 n +0000875598 00000 n +0000879529 00000 n +0000878908 00000 n +0000875791 00000 n +0000879214 00000 n +0000879340 00000 n +0000879466 00000 n +0000879052 00000 n +0002460342 00000 n +0000881644 00000 n +0000881333 00000 n +0000879688 00000 n +0000881456 00000 n +0000881582 00000 n +0000884813 00000 n +0000883992 00000 n +0000881746 00000 n +0000884371 00000 n +0000884623 00000 n +0000884136 00000 n +0000884686 00000 n +0000884750 00000 n +0000887061 00000 n +0000886749 00000 n +0000884943 00000 n +0000886872 00000 n +0000886998 00000 n +0000890638 00000 n +0000890074 00000 n +0000887191 00000 n +0000890197 00000 n +0000890449 00000 n +0000890575 00000 n +0000894680 00000 n +0000893802 00000 n +0000890783 00000 n +0000893925 00000 n +0000894050 00000 n +0000894113 00000 n +0000894176 00000 n +0000894239 00000 n +0000894302 00000 n +0000894365 00000 n +0000894428 00000 n +0000894491 00000 n +0000894617 00000 n +0000898350 00000 n +0000897786 00000 n +0000894853 00000 n +0000897909 00000 n +0000898035 00000 n +0000898161 00000 n +0000898224 00000 n +0000898287 00000 n +0002460467 00000 n +0000900572 00000 n +0000900260 00000 n +0000898466 00000 n +0000900383 00000 n +0000900509 00000 n +0000903048 00000 n +0000902737 00000 n +0000900688 00000 n +0000902860 00000 n +0000902985 00000 n +0000905377 00000 n +0000905191 00000 n +0000903235 00000 n +0000905314 00000 n +0000909556 00000 n +0000908820 00000 n +0000905521 00000 n +0000909115 00000 n +0000909241 00000 n +0000908964 00000 n +0000909367 00000 n +0000909493 00000 n +0000911888 00000 n +0000916257 00000 n +0000911951 00000 n +0000911638 00000 n +0000909700 00000 n +0000911761 00000 n +0000911824 00000 n +0000917133 00000 n +0000916134 00000 n +0000912053 00000 n +0000917070 00000 n +0002460592 00000 n +0000921656 00000 n +0000921345 00000 n +0000917321 00000 n +0000921468 00000 n +0000921594 00000 n +0000925819 00000 n +0000925382 00000 n +0000921786 00000 n +0000925505 00000 n +0000925631 00000 n +0000925756 00000 n +0000930317 00000 n +0000929942 00000 n +0000925921 00000 n +0000930065 00000 n +0000930191 00000 n +0000930254 00000 n +0000934193 00000 n +0000933881 00000 n +0000930447 00000 n +0000934004 00000 n +0000934130 00000 n +0000938771 00000 n +0000937948 00000 n +0000934337 00000 n +0000938456 00000 n +0000938582 00000 n +0000938101 00000 n +0000938282 00000 n +0000938708 00000 n +0000942824 00000 n +0000942512 00000 n +0000938901 00000 n +0000942635 00000 n +0000942761 00000 n +0002460717 00000 n +0000946274 00000 n +0000945710 00000 n +0000942968 00000 n +0000945833 00000 n +0000945959 00000 n +0000946021 00000 n +0000946085 00000 n +0000946211 00000 n +0000950072 00000 n +0000949761 00000 n +0000946404 00000 n +0000949884 00000 n +0000950009 00000 n +0000953385 00000 n +0000953074 00000 n +0000950245 00000 n +0000953197 00000 n +0000953322 00000 n +0000957825 00000 n +0000957199 00000 n +0000953614 00000 n +0000957322 00000 n +0000957448 00000 n +0000957574 00000 n +0000957637 00000 n +0000957700 00000 n +0000957763 00000 n +0000961976 00000 n +0000961601 00000 n +0000957969 00000 n +0000961724 00000 n +0000961787 00000 n +0000961913 00000 n +0000965172 00000 n +0000964860 00000 n +0000962134 00000 n +0000964983 00000 n +0000965109 00000 n +0002460842 00000 n +0000968453 00000 n +0000968142 00000 n +0000965373 00000 n +0000968265 00000 n +0000968390 00000 n +0000970936 00000 n +0000970624 00000 n +0000968611 00000 n +0000970747 00000 n +0000970873 00000 n +0000973559 00000 n +0000973247 00000 n +0000971080 00000 n +0000973370 00000 n +0000973496 00000 n +0000976308 00000 n +0000975996 00000 n +0000973703 00000 n +0000976119 00000 n +0000976245 00000 n +0000979846 00000 n +0000979536 00000 n +0000976438 00000 n +0000979659 00000 n +0000979785 00000 n +0000983113 00000 n +0000982675 00000 n +0000979990 00000 n +0000982798 00000 n +0000982924 00000 n +0000983050 00000 n +0002460967 00000 n +0000986383 00000 n +0000985946 00000 n +0000983257 00000 n +0000986069 00000 n +0000986195 00000 n +0000986321 00000 n +0000990356 00000 n +0000990044 00000 n +0000986584 00000 n +0000990167 00000 n +0000990293 00000 n +0000994074 00000 n +0000993888 00000 n +0000990500 00000 n +0000994011 00000 n +0000997722 00000 n +0000997284 00000 n +0000994204 00000 n +0000997407 00000 n +0000997533 00000 n +0000997659 00000 n +0001002146 00000 n +0001001144 00000 n +0000997866 00000 n +0001001267 00000 n +0001001392 00000 n +0001001518 00000 n +0001001581 00000 n +0001001643 00000 n +0001001706 00000 n +0001001769 00000 n +0001001832 00000 n +0001001895 00000 n +0001001958 00000 n +0001002021 00000 n +0001002084 00000 n +0001005694 00000 n +0001009549 00000 n +0001005571 00000 n +0001002276 00000 n +0001009108 00000 n +0001009171 00000 n +0001009234 00000 n +0001009297 00000 n +0001009360 00000 n +0001009423 00000 n +0001009486 00000 n +0002461092 00000 n +0001008937 00000 n +0001008995 00000 n +0001009085 00000 n +0001011850 00000 n +0001011538 00000 n +0001009737 00000 n +0001011661 00000 n +0001011787 00000 n +0001014028 00000 n +0001013716 00000 n +0001011980 00000 n +0001013839 00000 n +0001013965 00000 n +0001017785 00000 n +0001017473 00000 n +0001014186 00000 n +0001017596 00000 n +0001017722 00000 n +0001021573 00000 n +0001021261 00000 n +0001017987 00000 n +0001021384 00000 n +0001021510 00000 n +0001022946 00000 n +0001022760 00000 n +0001021731 00000 n +0001022883 00000 n +0001024619 00000 n +0001024433 00000 n +0001023048 00000 n +0001024556 00000 n +0002461217 00000 n +0001028955 00000 n +0001027874 00000 n +0001024721 00000 n +0001028388 00000 n +0001028514 00000 n +0001028640 00000 n +0001028766 00000 n +0001028027 00000 n +0001028208 00000 n +0001028892 00000 n +0001032404 00000 n +0001031716 00000 n +0001029085 00000 n +0001031839 00000 n +0001031965 00000 n +0001032091 00000 n +0001032216 00000 n +0001032279 00000 n +0001032342 00000 n +0001036552 00000 n +0001035727 00000 n +0001032534 00000 n +0001036300 00000 n +0001036363 00000 n +0001036489 00000 n +0001035880 00000 n +0001036091 00000 n +0001040178 00000 n +0001039992 00000 n +0001036696 00000 n +0001040115 00000 n +0001044390 00000 n +0001043751 00000 n +0001040322 00000 n +0001044075 00000 n +0001044201 00000 n +0001044327 00000 n +0001043895 00000 n +0001046730 00000 n +0001046040 00000 n +0001044548 00000 n +0001046163 00000 n +0001046289 00000 n +0001046415 00000 n +0001046541 00000 n +0001046667 00000 n +0002461342 00000 n +0001051040 00000 n +0001049854 00000 n +0001046860 00000 n +0001050348 00000 n +0001050600 00000 n +0001050726 00000 n +0001050007 00000 n +0001050852 00000 n +0001050176 00000 n +0001050978 00000 n +0001054676 00000 n +0001054155 00000 n +0001051142 00000 n +0001054487 00000 n +0001054299 00000 n +0001054613 00000 n +0001058127 00000 n +0001057562 00000 n +0001054892 00000 n +0001057685 00000 n +0001057811 00000 n +0001057874 00000 n +0001057938 00000 n +0001058064 00000 n +0001061250 00000 n +0001060685 00000 n +0001058229 00000 n +0001060808 00000 n +0001060871 00000 n +0001060935 00000 n +0001061061 00000 n +0001061187 00000 n +0001064947 00000 n +0001064383 00000 n +0001061394 00000 n +0001064506 00000 n +0001064632 00000 n +0001064758 00000 n +0001064884 00000 n +0001068424 00000 n +0001068112 00000 n +0001065091 00000 n +0001068235 00000 n +0001068361 00000 n +0002461467 00000 n +0001072318 00000 n +0001071880 00000 n +0001068653 00000 n +0001072003 00000 n +0001072129 00000 n +0001072255 00000 n +0001075420 00000 n +0001091964 00000 n +0001075297 00000 n +0001072448 00000 n +0001091459 00000 n +0001091585 00000 n +0001091648 00000 n +0001091711 00000 n +0001091774 00000 n +0001091901 00000 n +0001091271 00000 n +0001098001 00000 n +0001096362 00000 n +0001096050 00000 n +0001092210 00000 n +0001096173 00000 n +0001096299 00000 n +0001109376 00000 n +0001122064 00000 n +0001097878 00000 n +0001096549 00000 n +0001121497 00000 n +0001121560 00000 n +0001121623 00000 n +0001121686 00000 n +0001121812 00000 n +0001121875 00000 n +0001121938 00000 n +0001122001 00000 n +0001109191 00000 n +0001121311 00000 n +0001126097 00000 n +0001125785 00000 n +0001122269 00000 n +0001125908 00000 n +0001126034 00000 n +0001130006 00000 n +0001129178 00000 n +0001126285 00000 n +0001129691 00000 n +0001129817 00000 n +0001129331 00000 n +0001129511 00000 n +0001129943 00000 n +0002461592 00000 n +0001134831 00000 n +0001134001 00000 n +0001130236 00000 n +0001134516 00000 n +0001134642 00000 n +0001134154 00000 n +0001134338 00000 n +0001134768 00000 n +0001138086 00000 n +0001137774 00000 n +0001134989 00000 n +0001137897 00000 n +0001138023 00000 n +0001141158 00000 n +0001140846 00000 n +0001138315 00000 n +0001140969 00000 n +0001141095 00000 n +0001143622 00000 n +0001161155 00000 n +0001184073 00000 n +0001143499 00000 n +0001141360 00000 n +0001183379 00000 n +0001183505 00000 n +0001183568 00000 n +0001183631 00000 n +0001183694 00000 n +0001183820 00000 n +0001183883 00000 n +0001183946 00000 n +0001184009 00000 n +0001160969 00000 n +0001183191 00000 n +0001187392 00000 n +0001217217 00000 n +0001214393 00000 n +0001187269 00000 n +0001184278 00000 n +0001214014 00000 n +0001214140 00000 n +0001214203 00000 n +0001214266 00000 n +0001214329 00000 n +0001213826 00000 n +0001244582 00000 n +0001284340 00000 n +0001242190 00000 n +0001217094 00000 n +0001214597 00000 n +0001241560 00000 n +0001241623 00000 n +0001241686 00000 n +0001241749 00000 n +0001241875 00000 n +0001242001 00000 n +0001242127 00000 n +0002461717 00000 n +0001241372 00000 n 0001281474 00000 n -0001291972 00000 n -0001286741 00000 n -0001282307 00000 n -0001291909 00000 n -0001287083 00000 n -0001287289 00000 n -0001287495 00000 n -0001287715 00000 n -0001287935 00000 n -0001288141 00000 n -0001288347 00000 n -0001288536 00000 n -0001288726 00000 n -0001288916 00000 n -0001289105 00000 n -0001289295 00000 n -0001289485 00000 n -0001289675 00000 n -0001289868 00000 n -0001290060 00000 n -0001290299 00000 n -0001290539 00000 n -0001290779 00000 n -0001291017 00000 n -0001291257 00000 n -0001291497 00000 n -0001291703 00000 n -0001297421 00000 n -0001295898 00000 n -0001292102 00000 n -0001297232 00000 n -0001296078 00000 n -0001296308 00000 n -0001296539 00000 n -0001296770 00000 n -0001297001 00000 n -0001297358 00000 n -0001301924 00000 n -0001301019 00000 n -0001297579 00000 n -0001301357 00000 n -0001301483 00000 n -0001301609 00000 n -0001301163 00000 n -0001301735 00000 n -0001301861 00000 n -0001305692 00000 n -0001305255 00000 n -0001302068 00000 n -0001305378 00000 n -0001305504 00000 n -0001305629 00000 n -0002188462 00000 n -0001309179 00000 n -0001308741 00000 n -0001305836 00000 n -0001308864 00000 n -0001308990 00000 n -0001309116 00000 n -0001313648 00000 n -0001313084 00000 n -0001309309 00000 n -0001313207 00000 n -0001313333 00000 n -0001313459 00000 n -0001313585 00000 n -0001316767 00000 n -0001315829 00000 n -0001313792 00000 n -0001315952 00000 n -0001316078 00000 n -0001316204 00000 n -0001316329 00000 n -0001316455 00000 n -0001316580 00000 n -0001316706 00000 n -0001320053 00000 n -0001319615 00000 n -0001316940 00000 n -0001319738 00000 n -0001319864 00000 n -0001319990 00000 n -0001322708 00000 n -0001322396 00000 n -0001320197 00000 n -0001322519 00000 n -0001322645 00000 n -0001324077 00000 n -0001323891 00000 n -0001322852 00000 n -0001324014 00000 n -0002188587 00000 n -0001325485 00000 n -0001325299 00000 n -0001324179 00000 n -0001325422 00000 n -0001326757 00000 n -0001326571 00000 n -0001325587 00000 n -0001326694 00000 n -0001327934 00000 n -0001327748 00000 n -0001326859 00000 n -0001327871 00000 n -0001329514 00000 n -0001329328 00000 n -0001328036 00000 n -0001329451 00000 n -0001333371 00000 n -0001333060 00000 n -0001329616 00000 n -0001333183 00000 n -0001333308 00000 n -0001338528 00000 n -0001338342 00000 n -0001333543 00000 n -0001338465 00000 n -0002188712 00000 n -0001344656 00000 n -0001343526 00000 n -0001338714 00000 n -0001343649 00000 n -0001343712 00000 n -0001343775 00000 n -0001343838 00000 n -0001343900 00000 n -0001343963 00000 n -0001344026 00000 n -0001344089 00000 n -0001344152 00000 n -0001344215 00000 n -0001344278 00000 n -0001344341 00000 n -0001344404 00000 n -0001344467 00000 n -0001344530 00000 n -0001344593 00000 n -0001528554 00000 n -0001348550 00000 n -0001348238 00000 n -0001344800 00000 n -0001348361 00000 n -0001348487 00000 n -0001386303 00000 n -0001349288 00000 n -0001348694 00000 n -0001386051 00000 n -0001386114 00000 n -0001386177 00000 n -0001386240 00000 n -0001385863 00000 n -0001412727 00000 n -0001387061 00000 n -0001386465 00000 n -0001412475 00000 n -0001412538 00000 n -0001412601 00000 n -0001412664 00000 n -0001412287 00000 n -0001452437 00000 n -0001413494 00000 n -0001412889 00000 n -0001452185 00000 n -0001452248 00000 n -0001452311 00000 n -0001452374 00000 n -0001451997 00000 n -0001476063 00000 n -0001453190 00000 n -0001452599 00000 n -0001475810 00000 n -0001475873 00000 n -0001475936 00000 n -0001475999 00000 n -0002188837 00000 n -0001475624 00000 n -0001501188 00000 n -0001476817 00000 n -0001476225 00000 n -0001500935 00000 n -0001500998 00000 n -0001501061 00000 n -0001501124 00000 n -0001500747 00000 n -0001526580 00000 n -0001501945 00000 n -0001501350 00000 n -0001526328 00000 n -0001526391 00000 n -0001526454 00000 n -0001526517 00000 n -0001526140 00000 n -0001527694 00000 n -0001527319 00000 n -0001526742 00000 n -0001527442 00000 n -0001527505 00000 n -0001527568 00000 n -0001527631 00000 n -0001624535 00000 n -0001528431 00000 n -0001527855 00000 n -0001624281 00000 n -0001624344 00000 n -0001624407 00000 n -0001624470 00000 n -0001624093 00000 n -0001627185 00000 n -0001626622 00000 n -0001624697 00000 n -0001626745 00000 n -0001626997 00000 n -0001627122 00000 n -0001631075 00000 n -0001630133 00000 n -0001627315 00000 n -0001630256 00000 n -0001630382 00000 n -0001630508 00000 n -0001630633 00000 n -0001630696 00000 n -0001630759 00000 n -0001630886 00000 n -0001631012 00000 n -0002188962 00000 n -0001635385 00000 n -0001633966 00000 n -0001631219 00000 n -0001634692 00000 n -0001634818 00000 n -0001634944 00000 n -0001635070 00000 n -0001634128 00000 n -0001634334 00000 n -0001635196 00000 n -0001634514 00000 n -0001635322 00000 n -0001639156 00000 n -0001638470 00000 n -0001635501 00000 n -0001638593 00000 n -0001638841 00000 n -0001638967 00000 n -0001639093 00000 n -0001643382 00000 n -0001642818 00000 n -0001639272 00000 n -0001642941 00000 n -0001643067 00000 n -0001643193 00000 n -0001643319 00000 n -0001647802 00000 n -0001647239 00000 n -0001643512 00000 n -0001647362 00000 n -0001647488 00000 n -0001647614 00000 n -0001647740 00000 n -0001652488 00000 n -0001651599 00000 n -0001647918 00000 n -0001651922 00000 n -0001652048 00000 n -0001652174 00000 n -0001652300 00000 n -0001651743 00000 n -0001652426 00000 n -0001657219 00000 n -0001656472 00000 n -0001652604 00000 n -0001656782 00000 n -0001656908 00000 n -0001656616 00000 n -0001657034 00000 n -0001657158 00000 n -0002189087 00000 n -0001660169 00000 n -0001659731 00000 n -0001657377 00000 n -0001659854 00000 n -0001659980 00000 n -0001660106 00000 n -0001664587 00000 n -0001663271 00000 n -0001660299 00000 n -0001664147 00000 n -0001663433 00000 n -0001663672 00000 n -0001663911 00000 n -0001664273 00000 n -0001664399 00000 n -0001664524 00000 n -0001667519 00000 n -0001667081 00000 n -0001664703 00000 n -0001667204 00000 n -0001667330 00000 n -0001667393 00000 n -0001667456 00000 n -0001668828 00000 n -0001668642 00000 n -0001667635 00000 n -0001668765 00000 n -0001670833 00000 n -0001670340 00000 n -0001668930 00000 n -0001670644 00000 n -0001670707 00000 n -0001670770 00000 n -0001670484 00000 n -0001984262 00000 n -0001674244 00000 n -0001673680 00000 n -0001670949 00000 n -0001673803 00000 n -0001673866 00000 n -0001673929 00000 n -0001674055 00000 n -0001674118 00000 n -0001674181 00000 n -0002189212 00000 n -0001676961 00000 n -0001676649 00000 n -0001674360 00000 n -0001676772 00000 n -0001676835 00000 n -0001676898 00000 n -0001678146 00000 n -0001677960 00000 n -0001677091 00000 n -0001678083 00000 n -0001681064 00000 n -0001680628 00000 n -0001678248 00000 n -0001680751 00000 n -0001680876 00000 n -0001681001 00000 n -0001685673 00000 n -0001684010 00000 n -0001681194 00000 n -0001684981 00000 n -0001685233 00000 n -0001685359 00000 n -0001684181 00000 n -0001684379 00000 n -0001684578 00000 n -0001684780 00000 n -0001685484 00000 n -0001685610 00000 n -0001690183 00000 n -0001689423 00000 n -0001685789 00000 n -0001690120 00000 n -0001689585 00000 n -0001689759 00000 n -0001689933 00000 n -0001693660 00000 n -0001693158 00000 n -0001690299 00000 n -0001693471 00000 n -0001693597 00000 n -0001693302 00000 n -0002189337 00000 n -0001695178 00000 n -0001694992 00000 n -0001693790 00000 n -0001695115 00000 n -0001698024 00000 n -0001696760 00000 n -0001695280 00000 n -0001697710 00000 n -0001696931 00000 n -0001697122 00000 n -0001697291 00000 n -0001697836 00000 n -0001697500 00000 n -0001697962 00000 n -0001702121 00000 n -0001701559 00000 n -0001698140 00000 n -0001701682 00000 n -0001701934 00000 n -0001702059 00000 n -0001707320 00000 n -0001706629 00000 n -0001702265 00000 n -0001707005 00000 n -0001706773 00000 n -0001707131 00000 n -0001707257 00000 n -0001712064 00000 n -0001711501 00000 n -0001707478 00000 n -0001711624 00000 n -0001711750 00000 n -0001711876 00000 n -0001712002 00000 n -0001716727 00000 n -0001716163 00000 n -0001712208 00000 n -0001716286 00000 n -0001716349 00000 n -0001716412 00000 n -0001716475 00000 n -0001716538 00000 n -0001716664 00000 n -0002189462 00000 n -0001721315 00000 n -0001720248 00000 n -0001716914 00000 n -0001720371 00000 n -0001720497 00000 n -0001720623 00000 n -0001720749 00000 n -0001720875 00000 n -0001720937 00000 n -0001721000 00000 n -0001721063 00000 n -0001721126 00000 n -0001721189 00000 n -0001721252 00000 n -0001724137 00000 n -0001723515 00000 n -0001721431 00000 n -0001723638 00000 n -0001723701 00000 n -0001723764 00000 n -0001723827 00000 n -0001723952 00000 n -0001724074 00000 n -0001727533 00000 n -0001726717 00000 n -0001724267 00000 n -0001726840 00000 n -0001727092 00000 n -0001727218 00000 n -0001727344 00000 n -0001727470 00000 n -0001731197 00000 n -0001730633 00000 n -0001727692 00000 n -0001730756 00000 n -0001730882 00000 n -0001731008 00000 n -0001731134 00000 n -0001735156 00000 n -0001734656 00000 n -0001731398 00000 n -0001734779 00000 n -0001734905 00000 n -0001735031 00000 n -0001735094 00000 n -0001740227 00000 n -0001739664 00000 n -0001735357 00000 n -0001739787 00000 n -0001739850 00000 n -0001739913 00000 n -0001739976 00000 n -0001740039 00000 n -0001740102 00000 n -0001740164 00000 n -0002189587 00000 n -0001745201 00000 n -0001744133 00000 n -0001740385 00000 n -0001744256 00000 n -0001744382 00000 n -0001744508 00000 n -0001744571 00000 n -0001744634 00000 n -0001744697 00000 n -0001744760 00000 n -0001744823 00000 n -0001744886 00000 n -0001744949 00000 n -0001745012 00000 n -0001745075 00000 n -0001745138 00000 n -0001746258 00000 n -0001746072 00000 n -0001745416 00000 n -0001746195 00000 n -0001750739 00000 n -0001749345 00000 n -0001746403 00000 n -0001749468 00000 n -0001749531 00000 n -0001749595 00000 n -0001749658 00000 n -0001749722 00000 n -0001749786 00000 n -0001749850 00000 n -0001749914 00000 n -0001749978 00000 n -0001750042 00000 n -0001750105 00000 n -0001750169 00000 n -0001750233 00000 n -0001750295 00000 n -0001750359 00000 n -0001750423 00000 n -0001750486 00000 n -0001750550 00000 n -0001750677 00000 n -0001755261 00000 n -0001754257 00000 n -0001750926 00000 n -0001754380 00000 n -0001754506 00000 n -0001754631 00000 n -0001754694 00000 n -0001754757 00000 n -0001754820 00000 n -0001754883 00000 n -0001754946 00000 n -0001755009 00000 n -0001755072 00000 n -0001755198 00000 n -0001759471 00000 n -0001758781 00000 n -0001755448 00000 n -0001758904 00000 n -0001759030 00000 n -0001759156 00000 n -0001759282 00000 n -0001759408 00000 n -0001763932 00000 n -0001763243 00000 n -0001759672 00000 n -0001763366 00000 n -0001763492 00000 n -0001763618 00000 n -0001763744 00000 n -0001763870 00000 n -0002189712 00000 n -0001768634 00000 n -0001768196 00000 n -0001764147 00000 n -0001768319 00000 n -0001768382 00000 n -0001768445 00000 n -0001768508 00000 n -0001768571 00000 n -0001772467 00000 n -0001771905 00000 n -0001768764 00000 n -0001772028 00000 n -0001772091 00000 n -0001772154 00000 n -0001772214 00000 n -0001772277 00000 n -0001772404 00000 n -0001776630 00000 n -0001776444 00000 n -0001772668 00000 n -0001776567 00000 n -0001780917 00000 n -0001780356 00000 n -0001776803 00000 n -0001780479 00000 n -0001780542 00000 n -0001780605 00000 n -0001780728 00000 n -0001780854 00000 n -0001784925 00000 n -0001784488 00000 n -0001781075 00000 n -0001784611 00000 n -0001784737 00000 n -0001784862 00000 n -0001786877 00000 n -0001786691 00000 n -0001785027 00000 n -0001786814 00000 n -0002189837 00000 n -0001790827 00000 n -0001790217 00000 n -0001787050 00000 n -0001790512 00000 n -0001790361 00000 n -0001790764 00000 n -0001795163 00000 n -0001794726 00000 n -0001791000 00000 n -0001794849 00000 n -0001794974 00000 n -0001795100 00000 n -0001799485 00000 n -0001798963 00000 n -0001795293 00000 n -0001799296 00000 n -0001799422 00000 n -0001799107 00000 n -0001804411 00000 n -0001804225 00000 n -0001799629 00000 n -0001804348 00000 n -0001809086 00000 n -0001808900 00000 n -0001804541 00000 n -0001809023 00000 n -0001812131 00000 n -0001811570 00000 n -0001809230 00000 n -0001811693 00000 n -0001811818 00000 n -0001811943 00000 n -0001812069 00000 n -0002189962 00000 n -0001814824 00000 n -0001814638 00000 n -0001812261 00000 n -0001814761 00000 n -0001819489 00000 n -0001818647 00000 n -0001814940 00000 n -0001819174 00000 n -0001819300 00000 n -0001818800 00000 n -0001818988 00000 n -0001819426 00000 n -0001823943 00000 n -0001823504 00000 n -0001819676 00000 n -0001823627 00000 n -0001823753 00000 n -0001823816 00000 n -0001823879 00000 n -0001827506 00000 n -0001826510 00000 n -0001824130 00000 n -0001827192 00000 n -0001826672 00000 n -0001826848 00000 n -0001827019 00000 n -0001827318 00000 n -0001827443 00000 n -0001830026 00000 n -0001829337 00000 n -0001827622 00000 n -0001829460 00000 n -0001829586 00000 n -0001829712 00000 n -0001829838 00000 n -0001829963 00000 n -0001831589 00000 n -0001831403 00000 n -0001830142 00000 n -0001831526 00000 n -0002190087 00000 n -0001834742 00000 n -0001834180 00000 n -0001831691 00000 n -0001834303 00000 n -0001834554 00000 n -0001834679 00000 n -0001838689 00000 n -0001838251 00000 n -0001834887 00000 n -0001838374 00000 n -0001838500 00000 n -0001838626 00000 n -0001841567 00000 n -0001841006 00000 n -0001838819 00000 n -0001841129 00000 n -0001841255 00000 n -0001841380 00000 n -0001841504 00000 n -0001845347 00000 n -0001845035 00000 n -0001841697 00000 n -0001845158 00000 n -0001845284 00000 n -0001849640 00000 n -0001849203 00000 n -0001845463 00000 n -0001849326 00000 n -0001849451 00000 n -0001849577 00000 n -0001851811 00000 n -0001851625 00000 n -0001849798 00000 n -0001851748 00000 n -0002190212 00000 n -0001855183 00000 n -0001854622 00000 n -0001851913 00000 n -0001854745 00000 n -0001854871 00000 n -0001854995 00000 n -0001855121 00000 n -0001858781 00000 n -0001858091 00000 n -0001855313 00000 n -0001858214 00000 n -0001858340 00000 n -0001858466 00000 n -0001858592 00000 n -0001858718 00000 n -0001860105 00000 n -0001859919 00000 n -0001858911 00000 n -0001860042 00000 n -0001864379 00000 n -0001863498 00000 n -0001860207 00000 n -0001863814 00000 n -0001864066 00000 n -0001864192 00000 n -0001863642 00000 n -0001864318 00000 n -0001867890 00000 n -0001867005 00000 n -0001864509 00000 n -0001867576 00000 n -0001867702 00000 n -0001867827 00000 n -0001867158 00000 n -0001867367 00000 n -0001869560 00000 n -0001868996 00000 n -0001868034 00000 n -0001869119 00000 n -0001869371 00000 n -0001869497 00000 n -0002190337 00000 n -0001870577 00000 n -0001870139 00000 n -0001869648 00000 n -0001870262 00000 n -0001870514 00000 n -0001871237 00000 n -0001870989 00000 n -0001870665 00000 n -0001871112 00000 n -0001873990 00000 n -0001873067 00000 n -0001871325 00000 n -0001873361 00000 n -0001873424 00000 n -0001873676 00000 n -0001873211 00000 n -0001873802 00000 n -0001873928 00000 n -0001877513 00000 n -0001876949 00000 n -0001874092 00000 n -0001877072 00000 n -0001877324 00000 n -0001877450 00000 n -0001881751 00000 n -0001881314 00000 n -0001877615 00000 n -0001881437 00000 n -0001881563 00000 n -0001881689 00000 n -0001886177 00000 n -0001885613 00000 n -0001881853 00000 n -0001885736 00000 n -0001885862 00000 n -0001885988 00000 n -0001886114 00000 n -0002190462 00000 n -0001891556 00000 n -0001889669 00000 n -0001886321 00000 n -0001889792 00000 n -0001889918 00000 n -0001889981 00000 n -0001890044 00000 n -0001890107 00000 n -0001890170 00000 n -0001890233 00000 n -0001890296 00000 n -0001890359 00000 n -0001890422 00000 n -0001890485 00000 n -0001890547 00000 n -0001890610 00000 n -0001890673 00000 n -0001890736 00000 n -0001890799 00000 n -0001890862 00000 n -0001890925 00000 n -0001890988 00000 n -0001891051 00000 n -0001891114 00000 n -0001891240 00000 n -0001891303 00000 n -0001891366 00000 n -0001891493 00000 n -0001894802 00000 n -0001894363 00000 n -0001891714 00000 n -0001894486 00000 n -0001894549 00000 n -0001894612 00000 n -0001894739 00000 n -0001896263 00000 n -0001896077 00000 n -0001894946 00000 n -0001896200 00000 n -0001899628 00000 n -0001899065 00000 n -0001896365 00000 n -0001899188 00000 n -0001899439 00000 n -0001899565 00000 n -0001903381 00000 n -0001902630 00000 n -0001899801 00000 n -0001902940 00000 n -0001903066 00000 n -0001903129 00000 n -0001903192 00000 n -0001903255 00000 n -0001903318 00000 n -0001902774 00000 n -0001907752 00000 n -0001906995 00000 n -0001903525 00000 n -0001907311 00000 n -0001907437 00000 n -0001907139 00000 n -0001907563 00000 n -0001907689 00000 n -0002190587 00000 n -0001912227 00000 n -0001911411 00000 n -0001907995 00000 n -0001911534 00000 n -0001911660 00000 n -0001911786 00000 n -0001911912 00000 n -0001912038 00000 n -0001912164 00000 n -0001912918 00000 n -0001912670 00000 n -0001912357 00000 n -0001912793 00000 n -0001916133 00000 n -0001915506 00000 n -0001913006 00000 n -0001915629 00000 n -0001915692 00000 n -0001915944 00000 n -0001916070 00000 n -0001920328 00000 n -0001919827 00000 n -0001916306 00000 n -0001919950 00000 n -0001920076 00000 n -0001920139 00000 n -0001920202 00000 n -0001920265 00000 n -0001924461 00000 n -0001924149 00000 n -0001920515 00000 n -0001924272 00000 n -0001924335 00000 n -0001924398 00000 n -0001929671 00000 n -0001928732 00000 n -0001924662 00000 n -0001928855 00000 n -0001928918 00000 n -0001928981 00000 n -0001929044 00000 n -0001929106 00000 n -0001929169 00000 n -0001929232 00000 n -0001929295 00000 n -0001929358 00000 n -0001929421 00000 n -0001929484 00000 n -0001929547 00000 n -0001929609 00000 n -0002190712 00000 n -0001934076 00000 n -0001933405 00000 n -0001929886 00000 n -0001933699 00000 n -0001933762 00000 n -0001933825 00000 n -0001933887 00000 n -0001934013 00000 n -0001933549 00000 n -0001938153 00000 n -0001937224 00000 n -0001934234 00000 n -0001937714 00000 n -0001937966 00000 n -0001937377 00000 n -0001937545 00000 n -0001938091 00000 n -0001943622 00000 n -0001942218 00000 n -0001938255 00000 n -0001943308 00000 n -0001943434 00000 n -0001942398 00000 n -0001942589 00000 n -0001942780 00000 n -0001943559 00000 n -0001942970 00000 n -0001943135 00000 n -0001947077 00000 n -0001946366 00000 n -0001943766 00000 n -0001946888 00000 n -0001947014 00000 n -0001946519 00000 n -0001946690 00000 n -0001951448 00000 n -0001950219 00000 n -0001947221 00000 n -0001950881 00000 n -0001951133 00000 n -0001950381 00000 n -0001950557 00000 n -0001951259 00000 n -0001950728 00000 n -0001951385 00000 n -0001955575 00000 n -0001955012 00000 n -0001951550 00000 n -0001955135 00000 n -0001955260 00000 n -0001955386 00000 n -0001955512 00000 n -0002190837 00000 n -0001956255 00000 n -0001956007 00000 n -0001955705 00000 n -0001956130 00000 n -0001961762 00000 n -0001959458 00000 n -0001956343 00000 n -0001960693 00000 n -0001960756 00000 n -0001959647 00000 n -0001961008 00000 n -0001961134 00000 n -0001959813 00000 n -0001959992 00000 n -0001961260 00000 n -0001961386 00000 n -0001960172 00000 n -0001961512 00000 n -0001960351 00000 n -0001960522 00000 n -0001961575 00000 n -0001961638 00000 n -0001961700 00000 n -0001966521 00000 n -0001965057 00000 n -0001961878 00000 n -0001965955 00000 n -0001966018 00000 n -0001966081 00000 n -0001966207 00000 n -0001965228 00000 n -0001965413 00000 n -0001965600 00000 n -0001965788 00000 n -0001966333 00000 n -0001966459 00000 n -0001969598 00000 n -0001969034 00000 n -0001966637 00000 n -0001969157 00000 n -0001969283 00000 n -0001969409 00000 n -0001969535 00000 n -0001972804 00000 n -0001972366 00000 n -0001969728 00000 n -0001972489 00000 n -0001972615 00000 n -0001972741 00000 n -0001975546 00000 n -0001975109 00000 n -0001972977 00000 n -0001975232 00000 n -0001975357 00000 n -0001975483 00000 n -0002190962 00000 n -0001979584 00000 n -0001978706 00000 n -0001975747 00000 n -0001979017 00000 n -0001979269 00000 n -0001979395 00000 n -0001978850 00000 n -0001979521 00000 n -0001981237 00000 n -0001980925 00000 n -0001979686 00000 n -0001981048 00000 n -0001981174 00000 n -0001984325 00000 n +0001244459 00000 n +0001242366 00000 n +0001281222 00000 n +0001281285 00000 n +0001281348 00000 n +0001281411 00000 n +0001281034 00000 n +0001309883 00000 n +0001284217 00000 n +0001281650 00000 n +0001309631 00000 n +0001309694 00000 n +0001309757 00000 n +0001309820 00000 n +0001309443 00000 n +0001313581 00000 n +0001313144 00000 n +0001310087 00000 n +0001313267 00000 n +0001313393 00000 n +0001313518 00000 n +0001317404 00000 n +0001316840 00000 n +0001313711 00000 n +0001316963 00000 n +0001317089 00000 n +0001317215 00000 n +0001317341 00000 n +0001320280 00000 n +0001320094 00000 n +0001317606 00000 n +0001320217 00000 n +0001324451 00000 n +0001323888 00000 n +0001320495 00000 n +0001324011 00000 n +0001324137 00000 n +0001324199 00000 n +0001324261 00000 n +0001324388 00000 n +0002461842 00000 n +0001327231 00000 n +0001366234 00000 n +0001327087 00000 n +0001324581 00000 n +0001365981 00000 n +0001366044 00000 n +0001366107 00000 n +0001366170 00000 n +0001365799 00000 n +0001365611 00000 n +0001369464 00000 n +0001371778 00000 n +0001369320 00000 n +0001366438 00000 n +0001371399 00000 n +0001371525 00000 n +0001371245 00000 n +0001371588 00000 n +0001371651 00000 n +0001371714 00000 n +0001375331 00000 n +0001379925 00000 n +0001375151 00000 n +0001371974 00000 n +0001379546 00000 n +0001378640 00000 n +0001379609 00000 n +0001379672 00000 n +0001379735 00000 n +0001379862 00000 n +0001378797 00000 n +0001378978 00000 n +0001379161 00000 n +0001379336 00000 n +0001384214 00000 n +0001383045 00000 n +0001380121 00000 n +0001383777 00000 n +0001383207 00000 n +0001383387 00000 n +0001383903 00000 n +0001383565 00000 n +0001384028 00000 n +0001384152 00000 n +0001386723 00000 n +0001412331 00000 n +0001409723 00000 n +0001386600 00000 n +0001384415 00000 n +0001409220 00000 n +0001409346 00000 n +0001409409 00000 n +0001409472 00000 n +0001409535 00000 n +0001409661 00000 n +0001409034 00000 n +0001436828 00000 n +0001412208 00000 n +0001409913 00000 n +0001436326 00000 n +0001436389 00000 n +0001436452 00000 n +0001436515 00000 n +0001436641 00000 n +0001436766 00000 n +0002461967 00000 n +0001436138 00000 n +0001439586 00000 n +0001464351 00000 n +0001439463 00000 n +0001437032 00000 n +0001463846 00000 n +0001463909 00000 n +0001463972 00000 n +0001464035 00000 n +0001464162 00000 n +0001464288 00000 n +0001463658 00000 n +0001468418 00000 n +0001467780 00000 n +0001464541 00000 n +0001468103 00000 n +0001467924 00000 n +0001468229 00000 n +0001468355 00000 n +0001472817 00000 n +0001472001 00000 n +0001468576 00000 n +0001472124 00000 n +0001472250 00000 n +0001472376 00000 n +0001472502 00000 n +0001472628 00000 n +0001472754 00000 n +0001476592 00000 n +0001476028 00000 n +0001472919 00000 n +0001476151 00000 n +0001476277 00000 n +0001476403 00000 n +0001476529 00000 n +0001479224 00000 n +0001478582 00000 n +0001476722 00000 n +0001478908 00000 n +0001478971 00000 n +0001479035 00000 n +0001479161 00000 n +0001478726 00000 n +0001481776 00000 n +0001481464 00000 n +0001479354 00000 n +0001481587 00000 n +0001481713 00000 n +0002462092 00000 n +0001484578 00000 n +0001484266 00000 n +0001481977 00000 n +0001484389 00000 n +0001484515 00000 n +0001487961 00000 n +0001487320 00000 n +0001484751 00000 n +0001487647 00000 n +0001487773 00000 n +0001487464 00000 n +0001487898 00000 n +0001492799 00000 n +0001492059 00000 n +0001488177 00000 n +0001492355 00000 n +0001492418 00000 n +0001492482 00000 n +0001492546 00000 n +0001492610 00000 n +0001492203 00000 n +0001492736 00000 n +0001496971 00000 n +0001496533 00000 n +0001493014 00000 n +0001496656 00000 n +0001496782 00000 n +0001496908 00000 n +0001498731 00000 n +0001498545 00000 n +0001497115 00000 n +0001498668 00000 n +0001502046 00000 n +0001501421 00000 n +0001498890 00000 n +0001501544 00000 n +0001501669 00000 n +0001501731 00000 n +0001501794 00000 n +0001501857 00000 n +0001501920 00000 n +0001501983 00000 n +0002462217 00000 n +0001507687 00000 n +0001505445 00000 n +0001504694 00000 n +0001502162 00000 n +0001504817 00000 n +0001504943 00000 n +0001505006 00000 n +0001505069 00000 n +0001505132 00000 n +0001505256 00000 n +0001505382 00000 n +0001552700 00000 n +0001507564 00000 n +0001505632 00000 n +0001552322 00000 n +0001552385 00000 n +0001552448 00000 n +0001552511 00000 n +0001552637 00000 n +0001552134 00000 n +0001556340 00000 n +0001556028 00000 n +0001552904 00000 n +0001556151 00000 n +0001556277 00000 n +0001560039 00000 n +0001559349 00000 n +0001556541 00000 n +0001559472 00000 n +0001559598 00000 n +0001559661 00000 n +0001559724 00000 n +0001559787 00000 n +0001559850 00000 n +0001559976 00000 n +0002291464 00000 n +0002289463 00000 n +0002291298 00000 n +0001563822 00000 n +0001563385 00000 n +0001560183 00000 n +0001563508 00000 n +0001563634 00000 n +0001563759 00000 n +0001566905 00000 n +0001566593 00000 n +0001564008 00000 n +0001566716 00000 n +0001566842 00000 n +0002462342 00000 n +0001570472 00000 n +0001569971 00000 n +0001567077 00000 n +0001570094 00000 n +0001570220 00000 n +0001570283 00000 n +0002287625 00000 n +0002275471 00000 n +0002287457 00000 n +0001570346 00000 n +0001570409 00000 n +0001573052 00000 n +0001572678 00000 n +0001570644 00000 n +0001572801 00000 n +0001572864 00000 n +0001572927 00000 n +0001572990 00000 n +0001575553 00000 n +0001575178 00000 n +0001573196 00000 n +0001575301 00000 n +0001575364 00000 n +0001575427 00000 n +0001575490 00000 n +0001577610 00000 n +0001577299 00000 n +0001575669 00000 n +0001577422 00000 n +0001577485 00000 n +0001577548 00000 n +0001580808 00000 n +0001580245 00000 n +0001577740 00000 n +0001580368 00000 n +0001580431 00000 n +0001580494 00000 n +0001580557 00000 n +0001580620 00000 n +0001580745 00000 n +0001583192 00000 n +0001582880 00000 n +0001580952 00000 n +0001583003 00000 n +0001583129 00000 n +0002462467 00000 n +0001586902 00000 n +0001586212 00000 n +0001583336 00000 n +0001586335 00000 n +0001586461 00000 n +0001586587 00000 n +0001586713 00000 n +0001586839 00000 n +0001589655 00000 n +0001588927 00000 n +0001587046 00000 n +0001589466 00000 n +0001589592 00000 n +0001589080 00000 n +0001589273 00000 n +0001595445 00000 n +0001593652 00000 n +0001589771 00000 n +0001595005 00000 n +0001593841 00000 n +0001595131 00000 n +0001594034 00000 n +0001594240 00000 n +0001594431 00000 n +0001595256 00000 n +0001595382 00000 n +0001594624 00000 n +0001594809 00000 n +0001602564 00000 n +0001599910 00000 n +0001595632 00000 n +0001602249 00000 n +0001602375 00000 n +0001602501 00000 n +0001600144 00000 n +0001600361 00000 n +0001600576 00000 n +0001600791 00000 n +0001600974 00000 n +0001601151 00000 n +0001601320 00000 n +0001601501 00000 n +0001601677 00000 n +0001601861 00000 n +0001602030 00000 n +0001608431 00000 n +0001606639 00000 n +0001602694 00000 n +0001608116 00000 n +0001608242 00000 n +0001606828 00000 n +0001607058 00000 n +0001607290 00000 n +0001608368 00000 n +0001607559 00000 n +0001607770 00000 n +0001607942 00000 n +0001614222 00000 n +0001612396 00000 n +0001608547 00000 n +0001613781 00000 n +0001613907 00000 n +0001612585 00000 n +0001612800 00000 n +0001612989 00000 n +0001613174 00000 n +0001614033 00000 n +0001613408 00000 n +0001613603 00000 n +0001614159 00000 n +0002462592 00000 n +0001622586 00000 n +0001617852 00000 n +0001614395 00000 n +0001622523 00000 n +0001618176 00000 n +0001618368 00000 n +0001618574 00000 n +0001618777 00000 n +0001618997 00000 n +0001619217 00000 n +0001619423 00000 n +0001619628 00000 n +0001619818 00000 n +0001620009 00000 n +0001620199 00000 n +0001620389 00000 n +0001620579 00000 n +0001620769 00000 n +0001620959 00000 n +0001621151 00000 n +0001621391 00000 n +0001621631 00000 n +0001621871 00000 n +0001622111 00000 n +0001622317 00000 n +0001627429 00000 n +0001626274 00000 n +0001622716 00000 n +0001627366 00000 n +0001626445 00000 n +0001626675 00000 n +0001626904 00000 n +0001627135 00000 n +0001630915 00000 n +0001630352 00000 n +0001627573 00000 n +0001630475 00000 n +0001630601 00000 n +0001630726 00000 n +0001630852 00000 n +0001634476 00000 n +0001633824 00000 n +0001631059 00000 n +0001634161 00000 n +0001633968 00000 n +0001634287 00000 n +0001634413 00000 n +0001637768 00000 n +0001637331 00000 n +0001634606 00000 n +0001637454 00000 n +0001637580 00000 n +0001637705 00000 n +0001641287 00000 n +0001640849 00000 n +0001637912 00000 n +0001640972 00000 n +0001641098 00000 n +0001641224 00000 n +0002462717 00000 n +0001645053 00000 n +0001644615 00000 n +0001641431 00000 n +0001644738 00000 n +0001644864 00000 n +0001644990 00000 n +0001647955 00000 n +0001647392 00000 n +0001645183 00000 n +0001647515 00000 n +0001647641 00000 n +0001647766 00000 n +0001647892 00000 n +0001651029 00000 n +0001650717 00000 n +0001648142 00000 n +0001650840 00000 n +0001650966 00000 n +0001655751 00000 n +0001705744 00000 n +0001653938 00000 n +0001653626 00000 n +0001651159 00000 n +0001653749 00000 n +0001653875 00000 n +0001686509 00000 n +0001655628 00000 n +0001654153 00000 n +0001685878 00000 n +0001685941 00000 n +0001686004 00000 n +0001686067 00000 n +0001686194 00000 n +0001686320 00000 n +0001686446 00000 n +0001690895 00000 n +0001690080 00000 n +0001686677 00000 n +0001690203 00000 n +0001690329 00000 n +0001690454 00000 n +0001690580 00000 n +0001690706 00000 n +0001690832 00000 n +0002462842 00000 n +0001695042 00000 n +0001694101 00000 n +0001691053 00000 n +0001694224 00000 n +0001694350 00000 n +0001694476 00000 n +0001694601 00000 n +0001694727 00000 n +0001694853 00000 n +0001694979 00000 n +0001699386 00000 n +0001698130 00000 n +0001695186 00000 n +0001698253 00000 n +0001698379 00000 n +0001698441 00000 n +0001698504 00000 n +0001698567 00000 n +0001698630 00000 n +0001698693 00000 n +0001698756 00000 n +0001698819 00000 n +0001698882 00000 n +0001698945 00000 n +0001699008 00000 n +0001699071 00000 n +0001699134 00000 n +0001699197 00000 n +0001699260 00000 n +0001699323 00000 n +0001738856 00000 n +0001704029 00000 n +0001703213 00000 n +0001699502 00000 n +0001703336 00000 n +0001703462 00000 n +0001703588 00000 n +0001703714 00000 n +0001703840 00000 n +0001703966 00000 n +0001704927 00000 n +0001704615 00000 n +0001704187 00000 n +0001704738 00000 n +0001704864 00000 n +0001737999 00000 n +0001705621 00000 n +0001705029 00000 n +0001737747 00000 n +0001737810 00000 n +0001737873 00000 n +0001737936 00000 n +0001834836 00000 n +0001738733 00000 n +0001738153 00000 n +0001834583 00000 n +0001834646 00000 n +0001834709 00000 n +0001834772 00000 n +0002462967 00000 n +0001834395 00000 n +0001837603 00000 n +0001836913 00000 n +0001834998 00000 n +0001837036 00000 n +0001837288 00000 n +0001837414 00000 n +0001837477 00000 n +0001837540 00000 n +0001841021 00000 n +0001840079 00000 n +0001837705 00000 n +0001840202 00000 n +0001840265 00000 n +0001840329 00000 n +0001840455 00000 n +0001840581 00000 n +0001840707 00000 n +0001840770 00000 n +0001840833 00000 n +0001840960 00000 n +0001844208 00000 n +0001843770 00000 n +0001841165 00000 n +0001843893 00000 n +0001844019 00000 n +0001844145 00000 n +0001847628 00000 n +0001846465 00000 n +0001844324 00000 n +0001847188 00000 n +0001847314 00000 n +0001847439 00000 n +0001846627 00000 n +0001846831 00000 n +0001847565 00000 n +0001847011 00000 n +0001850503 00000 n +0001850065 00000 n +0001847744 00000 n +0001850188 00000 n +0001850440 00000 n +0001854172 00000 n +0001853734 00000 n +0001850676 00000 n +0001853857 00000 n +0001853983 00000 n +0001854109 00000 n +0002463092 00000 n +0001858096 00000 n +0001857407 00000 n +0001854288 00000 n +0001857530 00000 n +0001857656 00000 n +0001857782 00000 n +0001857908 00000 n +0001858033 00000 n +0001861909 00000 n +0001861471 00000 n +0001858212 00000 n +0001861594 00000 n +0001861720 00000 n +0001861846 00000 n +0001866092 00000 n +0001865402 00000 n +0001862025 00000 n +0001865525 00000 n +0001865651 00000 n +0001865777 00000 n +0001865903 00000 n +0001866029 00000 n +0001869998 00000 n +0001869373 00000 n +0001866194 00000 n +0001869683 00000 n +0001869809 00000 n +0001869517 00000 n +0001869935 00000 n +0001872536 00000 n +0001872098 00000 n +0001870128 00000 n +0001872221 00000 n +0001872347 00000 n +0001872473 00000 n +0001876448 00000 n +0001875131 00000 n +0001872666 00000 n +0001876006 00000 n +0001875293 00000 n +0001875532 00000 n +0001875770 00000 n +0001876132 00000 n +0001876195 00000 n +0001876259 00000 n +0001876385 00000 n +0002463217 00000 n +0001878728 00000 n +0001878416 00000 n +0001876564 00000 n +0001878539 00000 n +0001878665 00000 n +0001881006 00000 n +0001880574 00000 n +0001878844 00000 n +0001880697 00000 n +0001880823 00000 n +0001880884 00000 n +0001880945 00000 n +0001882967 00000 n +0001882475 00000 n +0001881122 00000 n +0001882778 00000 n +0001882841 00000 n +0001882904 00000 n +0001882619 00000 n +0002233120 00000 n +0001884281 00000 n +0001884095 00000 n +0001883083 00000 n +0001884218 00000 n +0001887274 00000 n +0001886710 00000 n +0001884383 00000 n +0001886833 00000 n +0001886896 00000 n +0001886959 00000 n +0001887085 00000 n +0001887148 00000 n +0001887211 00000 n +0001889104 00000 n +0001888918 00000 n +0001887390 00000 n +0001889041 00000 n +0002463342 00000 n +0001890858 00000 n +0001890546 00000 n +0001889220 00000 n +0001890669 00000 n +0001890732 00000 n +0001890795 00000 n +0001893904 00000 n +0001893468 00000 n +0001890974 00000 n +0001893591 00000 n +0001893716 00000 n +0001893841 00000 n +0001895294 00000 n +0001894982 00000 n +0001894034 00000 n +0001895105 00000 n +0001895231 00000 n +0001898909 00000 n +0001897498 00000 n +0001895467 00000 n +0001898468 00000 n +0001898720 00000 n +0001898846 00000 n +0001897669 00000 n +0001897868 00000 n +0001898065 00000 n +0001898267 00000 n +0001902631 00000 n +0001901816 00000 n +0001899025 00000 n +0001902316 00000 n +0001902442 00000 n +0001902568 00000 n +0001901969 00000 n +0001902143 00000 n +0001906660 00000 n +0001905966 00000 n +0001902747 00000 n +0001906472 00000 n +0001906119 00000 n +0001906597 00000 n +0001906303 00000 n +0002463467 00000 n +0001908691 00000 n +0001908505 00000 n +0001906790 00000 n +0001908628 00000 n +0001911174 00000 n +0001910254 00000 n +0001908793 00000 n +0001910985 00000 n +0001910416 00000 n +0001910606 00000 n +0001910776 00000 n +0001911111 00000 n +0001912704 00000 n +0001912162 00000 n +0001911290 00000 n +0001912516 00000 n +0001912306 00000 n +0001912642 00000 n +0001916303 00000 n +0001915739 00000 n +0001912806 00000 n +0001915862 00000 n +0001916114 00000 n +0001916240 00000 n +0001920818 00000 n +0001919888 00000 n +0001916405 00000 n +0001920504 00000 n +0001920041 00000 n +0001920273 00000 n +0001920630 00000 n +0001920756 00000 n +0001925316 00000 n +0001924878 00000 n +0001920976 00000 n +0001925001 00000 n +0001925127 00000 n +0001925253 00000 n +0002463592 00000 n +0001929394 00000 n +0001928831 00000 n +0001925460 00000 n +0001928954 00000 n +0001929080 00000 n +0001929143 00000 n +0001929205 00000 n +0001929268 00000 n +0001929331 00000 n +0001933321 00000 n +0001932884 00000 n +0001929581 00000 n +0001933007 00000 n +0001933133 00000 n +0001933259 00000 n +0001937222 00000 n +0001936281 00000 n +0001933465 00000 n +0001936404 00000 n +0001936530 00000 n +0001936655 00000 n +0001936781 00000 n +0001936844 00000 n +0001936907 00000 n +0001936970 00000 n +0001937033 00000 n +0001937096 00000 n +0001937159 00000 n +0001939998 00000 n +0001939375 00000 n +0001937352 00000 n +0001939498 00000 n +0001939561 00000 n +0001939624 00000 n +0001939687 00000 n +0001939809 00000 n +0001939935 00000 n +0001942947 00000 n +0001942258 00000 n +0001940128 00000 n +0001942381 00000 n +0001942633 00000 n +0001942759 00000 n +0001942885 00000 n +0001946170 00000 n +0001945732 00000 n +0001943092 00000 n +0001945855 00000 n +0001945981 00000 n +0001946107 00000 n +0002463717 00000 n +0001948877 00000 n +0001948439 00000 n +0001946357 00000 n +0001948562 00000 n +0001948688 00000 n +0001948814 00000 n +0001953096 00000 n +0001952532 00000 n +0001949007 00000 n +0001952655 00000 n +0001952781 00000 n +0001952907 00000 n +0001952970 00000 n +0001953033 00000 n +0001956864 00000 n +0001956364 00000 n +0001953283 00000 n +0001956487 00000 n +0001956550 00000 n +0001956613 00000 n +0001956676 00000 n +0001956739 00000 n +0001956802 00000 n +0001960796 00000 n +0001960046 00000 n +0001957051 00000 n +0001960169 00000 n +0001960295 00000 n +0001960419 00000 n +0001960482 00000 n +0001960545 00000 n +0001960608 00000 n +0001960671 00000 n +0001960734 00000 n +0001964483 00000 n +0001963669 00000 n +0001960926 00000 n +0001963792 00000 n +0001963855 00000 n +0001963918 00000 n +0001963981 00000 n +0001964044 00000 n +0001964107 00000 n +0001964170 00000 n +0001964233 00000 n +0001964296 00000 n +0001964359 00000 n +0001964421 00000 n +0001968589 00000 n +0001967396 00000 n +0001964670 00000 n +0001967519 00000 n +0001967582 00000 n +0001967645 00000 n +0001967708 00000 n +0001967771 00000 n +0001967834 00000 n +0001967897 00000 n +0001967959 00000 n +0001968022 00000 n +0001968085 00000 n +0001968148 00000 n +0001968211 00000 n +0001968274 00000 n +0001968400 00000 n +0001968526 00000 n +0002463842 00000 n +0001972045 00000 n +0001971041 00000 n +0001968691 00000 n +0001971164 00000 n +0001971290 00000 n +0001971353 00000 n +0001971416 00000 n +0001971479 00000 n +0001971542 00000 n +0001971604 00000 n +0001971667 00000 n +0001971730 00000 n +0001971856 00000 n +0001971982 00000 n +0001975794 00000 n +0001975230 00000 n +0001972218 00000 n +0001975353 00000 n +0001975479 00000 n +0001975605 00000 n +0001975731 00000 n +0001979898 00000 n +0001979336 00000 n +0001975981 00000 n +0001979459 00000 n +0001979585 00000 n +0001979710 00000 n +0001979835 00000 n +0001983951 00000 n +0001983387 00000 n +0001980099 00000 n 0001983510 00000 n -0001981353 00000 n -0001983633 00000 n -0001983759 00000 n -0001983885 00000 n -0001984010 00000 n -0001984136 00000 n -0001989550 00000 n -0001987673 00000 n -0001984427 00000 n -0001988983 00000 n -0001989235 00000 n -0001987862 00000 n -0001988034 00000 n -0001988224 00000 n -0001988409 00000 n -0001988601 00000 n -0001989361 00000 n -0001989487 00000 n -0001988788 00000 n -0001994622 00000 n -0001993188 00000 n -0001989652 00000 n -0001993929 00000 n -0001994055 00000 n -0001993350 00000 n -0001993548 00000 n -0001993740 00000 n -0001994181 00000 n -0001994307 00000 n -0001994433 00000 n -0001994559 00000 n -0001999174 00000 n -0001998169 00000 n -0001994752 00000 n -0001998482 00000 n -0001998608 00000 n -0001998734 00000 n -0001998313 00000 n -0001998859 00000 n -0001998985 00000 n -0001999111 00000 n -0002191087 00000 n -0002003231 00000 n -0002002261 00000 n -0001999318 00000 n -0002002791 00000 n -0002002917 00000 n -0002003042 00000 n -0002002414 00000 n -0002003168 00000 n -0002002582 00000 n -0002007107 00000 n -0002006419 00000 n -0002003460 00000 n -0002006542 00000 n -0002006794 00000 n -0002006920 00000 n -0002007046 00000 n -0002010899 00000 n -0002010084 00000 n -0002007209 00000 n -0002010207 00000 n -0002010333 00000 n -0002010458 00000 n -0002010584 00000 n -0002010710 00000 n -0002010836 00000 n -0002014485 00000 n -0002013743 00000 n -0002011015 00000 n -0002014044 00000 n -0002014170 00000 n -0002013887 00000 n -0002014296 00000 n -0002014422 00000 n -0002015531 00000 n -0002015093 00000 n -0002014601 00000 n -0002015216 00000 n -0002015468 00000 n -0002024685 00000 n -0002018460 00000 n -0002015619 00000 n -0002024118 00000 n -0002024370 00000 n -0002018838 00000 n -0002019025 00000 n -0002019216 00000 n -0002019386 00000 n -0002019585 00000 n -0002019780 00000 n -0002019969 00000 n -0002020161 00000 n -0002020356 00000 n -0002020541 00000 n -0002020734 00000 n -0002020929 00000 n -0002021128 00000 n -0002021327 00000 n -0002021511 00000 n -0002021720 00000 n -0002021913 00000 n -0002022106 00000 n -0002022301 00000 n -0002022490 00000 n -0002022699 00000 n -0002022891 00000 n -0002023066 00000 n -0002023276 00000 n -0002024496 00000 n -0002023486 00000 n -0002023696 00000 n -0002023907 00000 n -0002024622 00000 n -0002191212 00000 n -0002024801 00000 n -0002028013 00000 n -0002028044 00000 n -0002031474 00000 n -0002031617 00000 n -0002036881 00000 n -0002037072 00000 n -0002040821 00000 n -0002047363 00000 n -0002059554 00000 n -0002059969 00000 n -0002070523 00000 n -0002070773 00000 n -0002091459 00000 n -0002101999 00000 n -0002104497 00000 n -0002104528 00000 n -0002108367 00000 n -0002124960 00000 n -0002125370 00000 n -0002143807 00000 n -0002163621 00000 n -0002167623 00000 n -0002182794 00000 n -0002191292 00000 n -0002191418 00000 n -0002191544 00000 n -0002191670 00000 n -0002191796 00000 n -0002191922 00000 n -0002192048 00000 n -0002192174 00000 n -0002192300 00000 n -0002192426 00000 n -0002192552 00000 n -0002192669 00000 n -0002192796 00000 n -0002192914 00000 n -0002192988 00000 n -0002263929 00000 n -0002312718 00000 n -0002312759 00000 n -0002312799 00000 n -0002313031 00000 n +0001983636 00000 n +0001983699 00000 n +0001983762 00000 n +0001983825 00000 n +0001983888 00000 n +0001987711 00000 n +0001987151 00000 n +0001984095 00000 n +0001987274 00000 n +0001987337 00000 n +0001987400 00000 n +0001987460 00000 n +0001987521 00000 n +0001987648 00000 n +0001991286 00000 n +0001991100 00000 n +0001987841 00000 n +0001991223 00000 n +0002463967 00000 n +0001995166 00000 n +0001994857 00000 n +0001991445 00000 n +0001994980 00000 n +0001995043 00000 n +0001995106 00000 n +0001998430 00000 n +0001997866 00000 n +0001995282 00000 n +0001997989 00000 n +0001998115 00000 n +0001998241 00000 n +0001998367 00000 n +0002001830 00000 n +0002001519 00000 n +0001998574 00000 n +0002001642 00000 n +0002001768 00000 n +0002003866 00000 n +0002003680 00000 n +0002001960 00000 n +0002003803 00000 n +0002007479 00000 n +0002006869 00000 n +0002004025 00000 n +0002007164 00000 n +0002007013 00000 n +0002007416 00000 n +0002011635 00000 n +0002011198 00000 n +0002007638 00000 n +0002011321 00000 n +0002011446 00000 n +0002011572 00000 n +0002464092 00000 n +0002015402 00000 n +0002014879 00000 n +0002011737 00000 n +0002015213 00000 n +0002015339 00000 n +0002015023 00000 n +0002019740 00000 n +0002019554 00000 n +0002015546 00000 n +0002019677 00000 n +0002024037 00000 n +0002023851 00000 n +0002019870 00000 n +0002023974 00000 n +0002027700 00000 n +0002027388 00000 n +0002024167 00000 n +0002027511 00000 n +0002027637 00000 n +0002030286 00000 n +0002029849 00000 n +0002027844 00000 n +0002029972 00000 n +0002030098 00000 n +0002030223 00000 n +0002032065 00000 n +0002031879 00000 n +0002030402 00000 n +0002032002 00000 n +0002464217 00000 n +0002036016 00000 n +0002035578 00000 n +0002032181 00000 n +0002035701 00000 n +0002035827 00000 n +0002035953 00000 n +0002041076 00000 n +0002040259 00000 n +0002036189 00000 n +0002040760 00000 n +0002040886 00000 n +0002040949 00000 n +0002041012 00000 n +0002040412 00000 n +0002040588 00000 n +0002043865 00000 n +0002043231 00000 n +0002041263 00000 n +0002043551 00000 n +0002043375 00000 n +0002043676 00000 n +0002043802 00000 n +0002046278 00000 n +0002045590 00000 n +0002043995 00000 n +0002045713 00000 n +0002045839 00000 n +0002045965 00000 n +0002046090 00000 n +0002046216 00000 n +0002048542 00000 n +0002048230 00000 n +0002046394 00000 n +0002048353 00000 n +0002048479 00000 n +0002049572 00000 n +0002049386 00000 n +0002048672 00000 n +0002049509 00000 n +0002464342 00000 n +0002052404 00000 n +0002051841 00000 n +0002049688 00000 n +0002051964 00000 n +0002052215 00000 n +0002052341 00000 n +0002055379 00000 n +0002054941 00000 n +0002052549 00000 n +0002055064 00000 n +0002055190 00000 n +0002055316 00000 n +0002058967 00000 n +0002058532 00000 n +0002055566 00000 n +0002058655 00000 n +0002058780 00000 n +0002058905 00000 n +0002061490 00000 n +0002061178 00000 n +0002059097 00000 n +0002061301 00000 n +0002061427 00000 n +0002066082 00000 n +0002065518 00000 n +0002061606 00000 n +0002065641 00000 n +0002065767 00000 n +0002065830 00000 n +0002065893 00000 n +0002065957 00000 n +0002066018 00000 n +0002069534 00000 n +0002069098 00000 n +0002066212 00000 n +0002069221 00000 n +0002069346 00000 n +0002069471 00000 n +0002464467 00000 n +0002071587 00000 n +0002071401 00000 n +0002069678 00000 n +0002071524 00000 n +0002074798 00000 n +0002074234 00000 n +0002071689 00000 n +0002074357 00000 n +0002074483 00000 n +0002074609 00000 n +0002074735 00000 n +0002078236 00000 n +0002077199 00000 n +0002074928 00000 n +0002077669 00000 n +0002077352 00000 n +0002077511 00000 n +0002077795 00000 n +0002077921 00000 n +0002078047 00000 n +0002078173 00000 n +0002080091 00000 n +0002079905 00000 n +0002078352 00000 n +0002080028 00000 n +0002083774 00000 n +0002082836 00000 n +0002080207 00000 n +0002083333 00000 n +0002083585 00000 n +0002082989 00000 n +0002083711 00000 n +0002083162 00000 n +0002087937 00000 n +0002086745 00000 n +0002083890 00000 n +0002087496 00000 n +0002087622 00000 n +0002087748 00000 n +0002086907 00000 n +0002087874 00000 n +0002087083 00000 n +0002087291 00000 n +0002464592 00000 n +0002089447 00000 n +0002089009 00000 n +0002088081 00000 n +0002089132 00000 n +0002089258 00000 n +0002089384 00000 n +0002090971 00000 n +0002090407 00000 n +0002089549 00000 n +0002090530 00000 n +0002090782 00000 n +0002090908 00000 n +0002091971 00000 n +0002091533 00000 n +0002091059 00000 n +0002091656 00000 n +0002091908 00000 n +0002092631 00000 n +0002092383 00000 n +0002092059 00000 n +0002092506 00000 n +0002096281 00000 n +0002095027 00000 n +0002092719 00000 n +0002095150 00000 n +0002095213 00000 n +0002095465 00000 n +0002095528 00000 n +0002095591 00000 n +0002095654 00000 n +0002095717 00000 n +0002095780 00000 n +0002095843 00000 n +0002095906 00000 n +0002095969 00000 n +0002096032 00000 n +0002096095 00000 n +0002096157 00000 n +0002096220 00000 n +0002098507 00000 n +0002098006 00000 n +0002096369 00000 n +0002098129 00000 n +0002098192 00000 n +0002098318 00000 n +0002098444 00000 n +0002464717 00000 n +0002100374 00000 n +0002100062 00000 n +0002098623 00000 n +0002100185 00000 n +0002100311 00000 n +0002102075 00000 n +0002101889 00000 n +0002100490 00000 n +0002102012 00000 n +0002104049 00000 n +0002103737 00000 n +0002102177 00000 n +0002103860 00000 n +0002103986 00000 n +0002108788 00000 n +0002107675 00000 n +0002104165 00000 n +0002107970 00000 n +0002108096 00000 n +0002108222 00000 n +0002108285 00000 n +0002108348 00000 n +0002108473 00000 n +0002108536 00000 n +0002108599 00000 n +0002108725 00000 n +0002107819 00000 n +0002112786 00000 n +0002111640 00000 n +0002108918 00000 n +0002112094 00000 n +0002112220 00000 n +0002112283 00000 n +0002112346 00000 n +0002111793 00000 n +0002112472 00000 n +0002111943 00000 n +0002112597 00000 n +0002112723 00000 n +0002115971 00000 n +0002115659 00000 n +0002112902 00000 n +0002115782 00000 n +0002115908 00000 n +0002464842 00000 n +0002117443 00000 n +0002117131 00000 n +0002116101 00000 n +0002117254 00000 n +0002117380 00000 n +0002120269 00000 n +0002119705 00000 n +0002117545 00000 n +0002119828 00000 n +0002120080 00000 n +0002120206 00000 n +0002122994 00000 n +0002122808 00000 n +0002120385 00000 n +0002122931 00000 n +0002127240 00000 n +0002126803 00000 n +0002123096 00000 n +0002126926 00000 n +0002127052 00000 n +0002127177 00000 n +0002130951 00000 n +0002130136 00000 n +0002127342 00000 n +0002130259 00000 n +0002130385 00000 n +0002130511 00000 n +0002130637 00000 n +0002130763 00000 n +0002130826 00000 n +0002130889 00000 n +0002134463 00000 n +0002133459 00000 n +0002131109 00000 n +0002133582 00000 n +0002133645 00000 n +0002133708 00000 n +0002133771 00000 n +0002133834 00000 n +0002133897 00000 n +0002133960 00000 n +0002134023 00000 n +0002134149 00000 n +0002134212 00000 n +0002134275 00000 n +0002134401 00000 n +0002464967 00000 n +0002138237 00000 n +0002137798 00000 n +0002134607 00000 n +0002137921 00000 n +0002137984 00000 n +0002138047 00000 n +0002138174 00000 n +0002140604 00000 n +0002140418 00000 n +0002138367 00000 n +0002140541 00000 n +0002143740 00000 n +0002143176 00000 n +0002140720 00000 n +0002143299 00000 n +0002143551 00000 n +0002143677 00000 n +0002146773 00000 n +0002146336 00000 n +0002143899 00000 n +0002146459 00000 n +0002146585 00000 n +0002146648 00000 n +0002146711 00000 n +0002150353 00000 n +0002149422 00000 n +0002146917 00000 n +0002149913 00000 n +0002149976 00000 n +0002150039 00000 n +0002149575 00000 n +0002150164 00000 n +0002149742 00000 n +0002150290 00000 n +0002153883 00000 n +0002153321 00000 n +0002150582 00000 n +0002153444 00000 n +0002153570 00000 n +0002153696 00000 n +0002153820 00000 n +0002465092 00000 n +0002157139 00000 n +0002156575 00000 n +0002154070 00000 n +0002156698 00000 n +0002156824 00000 n +0002156950 00000 n +0002157076 00000 n +0002157816 00000 n +0002157568 00000 n +0002157255 00000 n +0002157691 00000 n +0002160735 00000 n +0002159981 00000 n +0002157904 00000 n +0002160104 00000 n +0002160167 00000 n +0002160419 00000 n +0002160545 00000 n +0002160608 00000 n +0002160672 00000 n +0002164161 00000 n +0002163723 00000 n +0002160880 00000 n +0002163846 00000 n +0002163972 00000 n +0002164035 00000 n +0002164098 00000 n +0002167544 00000 n +0002167295 00000 n +0002164334 00000 n +0002167418 00000 n +0002167481 00000 n +0002171399 00000 n +0002170962 00000 n +0002167731 00000 n +0002171085 00000 n +0002171148 00000 n +0002171211 00000 n +0002171273 00000 n +0002171336 00000 n +0002465217 00000 n +0002175011 00000 n +0002174198 00000 n +0002171487 00000 n +0002174321 00000 n +0002174384 00000 n +0002174447 00000 n +0002174510 00000 n +0002174572 00000 n +0002174635 00000 n +0002174698 00000 n +0002174761 00000 n +0002174824 00000 n +0002174886 00000 n +0002174949 00000 n +0002178799 00000 n +0002178424 00000 n +0002175226 00000 n +0002178547 00000 n +0002178610 00000 n +0002178673 00000 n +0002178736 00000 n +0002182269 00000 n +0002181390 00000 n +0002178915 00000 n +0002181703 00000 n +0002181955 00000 n +0002182081 00000 n +0002182207 00000 n +0002181534 00000 n +0002185940 00000 n +0002185184 00000 n +0002182385 00000 n +0002185500 00000 n +0002185626 00000 n +0002185328 00000 n +0002185751 00000 n +0002185877 00000 n +0002190559 00000 n +0002189026 00000 n +0002186070 00000 n +0002190118 00000 n +0002190244 00000 n +0002190370 00000 n +0002189206 00000 n +0002189397 00000 n +0002189588 00000 n +0002190496 00000 n +0002189779 00000 n +0002189944 00000 n +0002194094 00000 n +0002193589 00000 n +0002190703 00000 n +0002193905 00000 n +0002194031 00000 n +0002193733 00000 n +0002465342 00000 n +0002197927 00000 n +0002196698 00000 n +0002194238 00000 n +0002197360 00000 n +0002197612 00000 n +0002196860 00000 n +0002197035 00000 n +0002197738 00000 n +0002197207 00000 n +0002197864 00000 n +0002201251 00000 n +0002200939 00000 n +0002198029 00000 n +0002201062 00000 n +0002201188 00000 n +0002203087 00000 n +0002202649 00000 n +0002201381 00000 n +0002202772 00000 n +0002202898 00000 n +0002203024 00000 n +0002203753 00000 n +0002203505 00000 n +0002203203 00000 n +0002203628 00000 n +0002207765 00000 n +0002206007 00000 n +0002203841 00000 n +0002206883 00000 n +0002206946 00000 n +0002206178 00000 n +0002207198 00000 n +0002207324 00000 n +0002206344 00000 n +0002206524 00000 n +0002207450 00000 n +0002207576 00000 n +0002206703 00000 n +0002207702 00000 n +0002212565 00000 n +0002210608 00000 n +0002207867 00000 n +0002212063 00000 n +0002210806 00000 n +0002210977 00000 n +0002212126 00000 n +0002212189 00000 n +0002212252 00000 n +0002212314 00000 n +0002212377 00000 n +0002212503 00000 n +0002211147 00000 n +0002211332 00000 n +0002211516 00000 n +0002211704 00000 n +0002211891 00000 n +0002465467 00000 n +0002214912 00000 n +0002214474 00000 n +0002212695 00000 n +0002214597 00000 n +0002214723 00000 n +0002214849 00000 n +0002217213 00000 n +0002216776 00000 n +0002215028 00000 n +0002216899 00000 n +0002217025 00000 n +0002217151 00000 n +0002220072 00000 n +0002219509 00000 n +0002217343 00000 n +0002219632 00000 n +0002219758 00000 n +0002219884 00000 n +0002220010 00000 n +0002222349 00000 n +0002222163 00000 n +0002220259 00000 n +0002222286 00000 n +0002223997 00000 n +0002223685 00000 n +0002222536 00000 n +0002223808 00000 n +0002223934 00000 n +0002227407 00000 n +0002226530 00000 n +0002224184 00000 n +0002226841 00000 n +0002227093 00000 n +0002227219 00000 n +0002226674 00000 n +0002227344 00000 n +0002465592 00000 n +0002228920 00000 n +0002228734 00000 n +0002227495 00000 n +0002228857 00000 n +0002231645 00000 n +0002230830 00000 n +0002229022 00000 n +0002230953 00000 n +0002231079 00000 n +0002231205 00000 n +0002231331 00000 n +0002231457 00000 n +0002231583 00000 n +0002233183 00000 n +0002232871 00000 n +0002231761 00000 n +0002232994 00000 n +0002237341 00000 n +0002235672 00000 n +0002233285 00000 n +0002236775 00000 n +0002237027 00000 n +0002235852 00000 n +0002236023 00000 n +0002236212 00000 n +0002236396 00000 n +0002236588 00000 n +0002237152 00000 n +0002237278 00000 n +0002241254 00000 n +0002240398 00000 n +0002237457 00000 n +0002240940 00000 n +0002241066 00000 n +0002240551 00000 n +0002240750 00000 n +0002241192 00000 n +0002245072 00000 n +0002244132 00000 n +0002241384 00000 n +0002244255 00000 n +0002244381 00000 n +0002244507 00000 n +0002244631 00000 n +0002244757 00000 n +0002244883 00000 n +0002245009 00000 n +0002465717 00000 n +0002248762 00000 n +0002248072 00000 n +0002245188 00000 n +0002248195 00000 n +0002248321 00000 n +0002248447 00000 n +0002248573 00000 n +0002248699 00000 n +0002251492 00000 n +0002250827 00000 n +0002248878 00000 n +0002251176 00000 n +0002251239 00000 n +0002251303 00000 n +0002251429 00000 n +0002250971 00000 n +0002254648 00000 n +0002254085 00000 n +0002251693 00000 n +0002254208 00000 n +0002254460 00000 n +0002254585 00000 n +0002258077 00000 n +0002257387 00000 n +0002254736 00000 n +0002257510 00000 n +0002257636 00000 n +0002257762 00000 n +0002257888 00000 n +0002258014 00000 n +0002261897 00000 n +0002260906 00000 n +0002258179 00000 n +0002261207 00000 n +0002261333 00000 n +0002261459 00000 n +0002261585 00000 n +0002261050 00000 n +0002261709 00000 n +0002261835 00000 n +0002263301 00000 n +0002263115 00000 n +0002261999 00000 n +0002263238 00000 n +0002465842 00000 n +0002264320 00000 n +0002263882 00000 n +0002263403 00000 n +0002264005 00000 n +0002264257 00000 n +0002271360 00000 n +0002266667 00000 n +0002264408 00000 n +0002271045 00000 n +0002271297 00000 n +0002266991 00000 n +0002267178 00000 n +0002267372 00000 n +0002267543 00000 n +0002267742 00000 n +0002267937 00000 n +0002268125 00000 n +0002268317 00000 n +0002268512 00000 n +0002268697 00000 n +0002268890 00000 n +0002269085 00000 n +0002269284 00000 n +0002269483 00000 n +0002269669 00000 n +0002269878 00000 n +0002270071 00000 n +0002270264 00000 n +0002270459 00000 n +0002270648 00000 n +0002270855 00000 n +0002274328 00000 n +0002272534 00000 n +0002271476 00000 n +0002274139 00000 n +0002272732 00000 n +0002272907 00000 n +0002273117 00000 n +0002273327 00000 n +0002274265 00000 n +0002273507 00000 n +0002273717 00000 n +0002273928 00000 n +0002274458 00000 n +0002288118 00000 n +0002288467 00000 n +0002291679 00000 n +0002291710 00000 n +0002295884 00000 n +0002295929 00000 n +0002305079 00000 n +0002307612 00000 n +0002309903 00000 n +0002316482 00000 n +0002328905 00000 n +0002329322 00000 n +0002343424 00000 n +0002359765 00000 n +0002360173 00000 n +0002381026 00000 n +0002391671 00000 n +0002394169 00000 n +0002394200 00000 n +0002398038 00000 n +0002398259 00000 n +0002416696 00000 n +0002436510 00000 n +0002440826 00000 n +0002456297 00000 n +0002465949 00000 n +0002466075 00000 n +0002466201 00000 n +0002466327 00000 n +0002466453 00000 n +0002466579 00000 n +0002466705 00000 n +0002466831 00000 n +0002466957 00000 n +0002467083 00000 n +0002467209 00000 n +0002467335 00000 n +0002467461 00000 n +0002467551 00000 n +0002467678 00000 n +0002467805 00000 n +0002467886 00000 n +0002467969 00000 n +0002541347 00000 n +0002595197 00000 n +0002595238 00000 n +0002595278 00000 n +0002595510 00000 n trailer << -/Size 6741 -/Root 6739 0 R -/Info 6740 0 R +/Size 7256 +/Root 7254 0 R +/Info 7255 0 R >> startxref -2313187 +2595666 %%EOF diff --git a/docs/docbook/Makefile.in b/docs/docbook/Makefile.in index ba3d0845ef..7169cc90c4 100644 --- a/docs/docbook/Makefile.in +++ b/docs/docbook/Makefile.in @@ -1,16 +1,14 @@ ################################################################# # Makefile.in for Samba Documentation # Authors: James Moore -# Gerald Carter -# Jelmer Vernooij +# Gerald Carter +# Jelmer Vernooij # # Please see http://www.samba.org/samba/cvs.html # for information on getting the latest # source and documentation source files. # - -# Autoconf Variables - +# MANPAGES_NAMES=findsmb.1 smbclient.1 \ smbspool.8 lmhosts.5 \ smbcontrol.1 smbstatus.1 \ @@ -23,24 +21,23 @@ MANPAGES_NAMES=findsmb.1 smbclient.1 \ smbcacls.1 smbsh.1 winbindd.8 \ tdbbackup.8 vfstest.1 \ profiles.1 smbtree.1 ntlm_auth.1 \ - editreg.1 smbcquotas.1 + editreg.1 smbcquotas.1 log2pcap.1 \ + mount.cifs.8 ## This part contains only rules. You shouldn't need to change it ## if you are adding docs -XSLTPROC = @XSLTPROC@ -PDFLATEX = @PDFLATEX@ -LATEX = @LATEX@ +TEXSTYLESHEET = @TEXSTYLESHEET@ +XSLTPROC = @XSLTPROC@ @PAPERSIZE@ --stringparam samba-book 1 --stringparam duplicate_ulinks "@DUPLICATE_ULINKS@" @FONTSIZE@ @CROP@ DVIPS = @DVIPS@ -HTMLDOC = @HTMLDOC@ PNGTOPNM = @PNGTOPNM@ PNMTOPS = @PNMTOPS@ XMLTO = @XMLTO@ SRCDIR = @srcdir@ MANDIR=../manpages -HTMLDIR=../htmldocs MANPROJDOC = manpages PROJDOC = projdoc +MAKEINDEX = @MAKEINDEX@ IMAGEPROJDIR = $(PROJDOC)/imagefiles DEVDOC = devdoc SMBDOTCONFDOC = smbdotconf @@ -50,22 +47,26 @@ DVIDIR = .. TXTDIR = ../textdocs FAQPROJDOC = faq FAQDIR = ../faq +HTMLDIR=../htmldocs +PDFLATEX = TEXINPUTS=xslt/latex:.: @PDFLATEX@ --interaction nonstopmode +LATEX = TEXINPUTS=xslt/latex:.: @LATEX@ --interaction nonstopmode MANPAGES=$(patsubst %,$(MANDIR)/%,$(MANPAGES_NAMES)) MANPAGES_HTML=$(patsubst %,$(HTMLDIR)/%.html,$(MANPAGES_NAMES)) PROJDOC_IMAGES_PNG = $(wildcard $(IMAGEPROJDIR)/*.png) PROJDOC_IMAGES_EPS=$(patsubst %.png,%.eps,$(wildcard $(IMAGEPROJDIR)/*.png)) -PROJDOC_DEPS = $(PROJDOC)/*.xml $(PROJDOC)/attributions.xml +PROJDOC_DEPS = $(PROJDOC)/*.xml $(PROJDOC)/attributions.xml $(MANPROJDOC)/*.xml $(SMBDOTCONFDOC)/smb.conf.5.xml $(SMBDOTCONFDOC)/parameters.all.xml $(SMBDOTCONFDOC)/parameters.global.xml $(SMBDOTCONFDOC)/parameters.service.xml DEVDOC_DEPS = $(DEVDOC)/*.xml $(DEVDOC)/attributions.xml all: @echo "Supported make targets:" + @echo "pdf - Build PDF version of book" + @echo "tex - Build Latex version of book" + @echo "dvi - Build Device Independant File of book" + @echo "ps - Build PostScript version of book" + @echo "everything - Build all of the above" @echo "manpages - Build manpages" - @echo "pdf - Build PDF version of HOWTO Collection and Developers Guide" - @echo "tex - Build Latex version of HOWTO Collection and Developers Guide" - @echo "dvi - Build Device Independant Files of HOWTO Collection and Developers Guide" - @echo "ps - Build PostScript version of HOWTO Collection and Developers Guide" @echo "txt - Build plain text version of HOWTO Collection and Developers Guide" @echo -n "html-single - Build single file HTML version of HOWTO Collection" @echo " and developers guide" @@ -79,106 +80,92 @@ everything: manpages pdf html-single html htmlman htmlfaq txt ps # Global rules -manpages: $(MANDIR) $(MANPAGES) -tex: samba-doc.tex dev-doc.tex pdf: $(PDFDIR) $(PDFDIR)/Samba-HOWTO-Collection.pdf $(PDFDIR)/Samba-Developers-Guide.pdf dvi: $(DVIDIR) $(DVIDIR)/Samba-HOWTO-Collection.dvi $(DVIDIR)/Samba-Developers-Guide.dvi ps: $(PSDIR) $(PSDIR)/Samba-HOWTO-Collection.ps $(PSDIR)/Samba-Developers-Guide.ps -hpdf: $(PDFDIR) $(PDFDIR)/Samba-HOWTO-Collection.pdf txt: $(TXTDIR) $(TXTDIR)/Samba-HOWTO-Collection.txt $(TXTDIR)/Samba-Developers-Guide.txt htmlman: $(HTMLDIR) $(MANPAGES_HTML) CSS htmlfaq: $(HTMLDIR) CSS - @$(XSLTPROC) --stringparam base.dir "$(FAQDIR)/" --stringparam root.filename samba-faq xslt/html-chunk.xsl $(FAQPROJDOC)/sambafaq.xml + $(XSLTPROC) --stringparam base.dir "$(FAQDIR)/" --stringparam root.filename samba-faq xslt/html-chunk.xsl $(FAQPROJDOC)/sambafaq.xml html-single: $(HTMLDIR) CSS $(HTMLDIR)/Samba-HOWTO-Collection.html $(HTMLDIR)/Samba-Developers-Guide.html -html: $(HTMLDIR) CSS $(PROJDOC_DEPS) - @$(XSLTPROC) xslt/html-chunk.xsl $(PROJDOC)/samba-doc.xml +html: $(HTMLDIR) CSS Samba-HOWTO-Collection.xml + $(XSLTPROC) -o $(HTMLDIR) xslt/html-chunk.xsl Samba-HOWTO-Collection.xml +manpages: $(MANDIR) $(MANPAGES) +tex: Samba-HOWTO-Collection.tex Samba-Developers-Guide.tex + +Samba-HOWTO-Collection.xml: $(PROJDOC)/samba-doc.xml $(PROJDOC_DEPS) + $(XSLTPROC) --xinclude --output $@ xslt/expand-sambadoc.xsl $< + +Samba-Developers-Guide.xml: $(DEVDOC)/dev-doc.xml $(DEVDOC_DEPS) + $(XSLTPROC) --xinclude --output $@ xslt/expand-sambadoc.xsl $< + +$(PROJDOC)/attributions.xml: $(PROJDOC)/samba-doc.xml + @echo > $@ # Make sure we don't get recursive dependencies, etc! + $(XSLTPROC) --output $@ xslt/generate-attributions.xsl $< + +$(DEVDOC)/attributions.xml: $(DEVDOC)/dev-doc.xml + @echo > $@ # Make sure we don't get recursive dependencies, etc! + $(XSLTPROC) --output $@ xslt/generate-attributions.xsl $< + +clean: + @rm -f *.xml $(MANPAGES) $(TXTDIR)/*.txt $(PSDIR)/*.ps $(PDFDIR)/*.pdf + @rm -f $(SMBDOTCONFDOC)/parameters.*.xml $(DVIDIR)/*.dvi + @rm -f samba-doc.* dev-doc.* $(PROJDOC)/attributions.xml $(DEVDOC)/attributions.xml + @rm -f $(IMAGEPROJDIR)/*.eps $(MANPROJDOC)/smb.conf.5.xml # Text files $(TXTDIR): mkdir $(TXTDIR) -$(TXTDIR)/Samba-HOWTO-Collection.txt: $(PROJDOC)/samba-doc.xml $(PROJDOC_DEPS) - @echo "Converting samba-doc to plain text..." - @$(XMLTO) txt -o $(TXTDIR) $< - @mv $(TXTDIR)/samba-doc.txt $(TXTDIR)/Samba-HOWTO-Collection.txt - -$(TXTDIR)/Samba-Developers-Guide.txt: $(DEVDOC)/dev-doc.xml $(DEVDOC_DEPS) - @echo "Converting dev-doc to plain text..." - @$(XMLTO) txt -o $(TXTDIR) $< - @mv $(TXTDIR)/dev-doc.txt $(TXTDIR)/Samba-Developers-Guide.txt +$(TXTDIR)/%.txt: %.xml + $(XMLTO) txt -o $(TXTDIR) $< > $@ # Tex files -samba-doc.tex: $(PROJDOC)/samba-doc.xml $(PROJDOC_DEPS) - @echo "Converting samba-doc to LaTeX..." - @$(XSLTPROC) --output $@ xslt/latex.xsl $< +%.tex: %.xml + $(XSLTPROC) --output $@ xslt/latex.xsl $< -dev-doc.tex: $(DEVDOC)/dev-doc.xml $(DEVDOC_DEPS) - @echo "Converting dev-doc to LaTeX..." - @$(XSLTPROC) --output $@ xslt/latex.xsl $< - # Adobe PDF files -$(PDFDIR)/Samba-HOWTO-Collection.pdf: samba-doc.tex $(PROJDOC_IMAGES_PNG) - @echo "Building LaTeX sources via $(PDFLATEX)..." - @$(PDFLATEX) $< | grep 'Rerun to get cross-references right' && \ - $(PDFLATEX) $< | grep 'Rerun to get cross-references right' && \ - $(PDFLATEX) $< || echo - @echo "done" - @mv samba-doc.pdf $@ - -$(PDFDIR)/Samba-Developers-Guide.pdf: dev-doc.tex - @echo "Building LaTeX sources via $(PDFLATEX)..." - @$(PDFLATEX) $< | grep 'Rerun to get cross-references right' && \ - $(PDFLATEX) $< | grep 'Rerun to get cross-references right' && \ - $(PDFLATEX) $< || echo - @echo "done" - @mv dev-doc.pdf $@ +$(PDFDIR)/%.pdf: %.tex + $(PDFLATEX) $< + $(PDFLATEX) $< + $(PDFLATEX) $< + mv $(patsubst %.tex,%.pdf,$<) $@ epsimages: $(PROJDOC_IMAGES_EPS) # DVI files -$(DVIDIR)/Samba-HOWTO-Collection.dvi: samba-doc.tex $(PROJDOC_IMAGES_EPS) - @echo "Building LaTeX sources via $(LATEX)..." - @$(LATEX) $< 2>&1 | grep 'Rerun to get cross-references right' && \ - $(LATEX) $< 2>&1 | grep 'Rerun to get cross-references right' && \ - $(LATEX) $< 2>&1 || echo - @echo "done" - @mv samba-doc.dvi $@ - -$(DVIDIR)/Samba-Developers-Guide.dvi: dev-doc.tex - @echo "Building LaTeX sources via $(LATEX)..." - @$(LATEX) $< 2>&1 | grep 'Rerun to get cross-references right' && \ - $(LATEX) $< 2>&1 | grep 'Rerun to get cross-references right' && \ - $(LATEX) $< 2>&1 || echo - @echo "done" - @mv dev-doc.dvi $@ - -$(IMAGEPROJDIR)/%.eps: $(IMAGEPROJDIR)/%.png - @$(PNGTOPNM) $< | $(PNMTOPS) > $@ +$(DVIDIR)/%.dvi: %.tex epsimages + $(LATEX) $< + $(LATEX) $< + $(LATEX) $< + mv $(patsubst %.tex,%.dvi,$<) $@ -# PostScript files -$(PSDIR)/Samba-HOWTO-Collection.ps: $(DVIDIR)/Samba-HOWTO-Collection.dvi - $(DVIPS) -o $@ $< +%.eps: %.png + $(PNGTOPNM) $< | $(PNMTOPS) > $@ -$(PSDIR)/Samba-Developers-Guide.ps: $(DVIDIR)/Samba-Developers-Guide.dvi +# PostScript files +$(PSDIR)/%.ps: $(DVIDIR)/%.dvi $(DVIPS) -o $@ $< # Single large HTML files $(HTMLDIR): - @mkdir $(HTMLDIR) + mkdir $(HTMLDIR) CSS: $(HTMLDIR) xslt/html/samba.css - @cp xslt/html/samba.css $(HTMLDIR)/ + cp xslt/html/samba.css $(HTMLDIR)/ -$(HTMLDIR)/Samba-HOWTO-Collection.html: $(PROJDOC)/samba-doc.xml $(PROJDOC_DEPS) $(PROJDOC_IMAGES_PNG) - @$(XSLTPROC) --output $@ xslt/html.xsl $< +$(HTMLDIR)/Samba-HOWTO-Collection.html: Samba-HOWTO-Collection.xml $(PROJDOC_DEPS) $(PROJDOC_IMAGES_PNG) + $(XSLTPROC) --output $@ xslt/html.xsl $< -$(HTMLDIR)/Samba-Developers-Guide.html: $(DEVDOC)/dev-doc.xml $(DEVDOC_DEPS) - @$(XSLTPROC) --output $@ xslt/html.xsl $< +$(HTMLDIR)/Samba-Developers-Guide.html: Samba-Developers-Guide.xml $(DEVDOC_DEPS) + $(XSLTPROC) --output $@ xslt/html.xsl $< +$(HTMLDIR)/%.html: %.xml + $(XSLTPROC) --output $@ xslt/html.xsl $< -$(HTMLDIR)/%.html: $(MANPROJDOC)/%.xml - @$(XSLTPROC) --output $@ xslt/html.xsl $< +%.xml: $(MANPROJDOC)/%.xml + $(XSLTPROC) --output $@ xslt/expand-sambadoc.xsl $< # Manpages $(SMBDOTCONFDOC)/parameters.all.xml: $(SMBDOTCONFDOC)/generate-file-list.sh @@ -202,33 +189,15 @@ $(SMBDOTCONFDOC)/parameters.service.xml: $(SMBDOTCONFDOC)/parameters.all.xml $(S generate-context.xsl parameters.all.xml && \ cd .. -$(MANPROJDOC)/smb.conf.5.xml: $(SMBDOTCONFDOC)/smb.conf.5.xml $(SMBDOTCONFDOC)/parameters.all.xml \ - $(SMBDOTCONFDOC)/parameters.global.xml $(SMBDOTCONFDOC)/parameters.service.xml \ - $(SMBDOTCONFDOC)/expand-smb.conf.xsl - @$(XSLTPROC) --xinclude --output $(MANPROJDOC)/smb.conf.5.xml $(SMBDOTCONFDOC)/expand-smb.conf.xsl $(SMBDOTCONFDOC)/smb.conf.5.xml - -$(PROJDOC)/attributions.xml: $(PROJDOC)/samba-doc.xml - @echo > $@ # Make sure we don't get recursive dependencies, etc! - @echo "Generating attributions page" - @$(XSLTPROC) --output $@ xslt/generate-attributions.xsl $< - -$(DEVDOC)/attributions.xml: $(DEVDOC)/dev-doc.xml - @echo > $@ # Make sure we don't get recursive dependencies, etc! - @echo "Generating attributions page" - @$(XSLTPROC) --output $@ xslt/generate-attributions.xsl $< +smb.conf.5.xml: $(SMBDOTCONFDOC)/smb.conf.5.xml $(SMBDOTCONFDOC)/parameters.all.xml \ + $(SMBDOTCONFDOC)/parameters.global.xml $(SMBDOTCONFDOC)/parameters.service.xml + $(XSLTPROC) --xinclude --output $@ xslt/expand-sambadoc.xsl $< $(MANDIR): mkdir $(MANDIR) -$(MANDIR)/%: $(MANPROJDOC)/%.xml - @$(XSLTPROC) xslt/man.xsl $< +$(MANDIR)/%: %.xml + $(XSLTPROC) --output $@ xslt/man.xsl $< undocumented: $(SMBDOTCONFDOC)/parameters.all.xml $(PERL) scripts/find_missing_doc.pl ../.. - -clean: - @rm -f $(MANPAGES) $(MANPAGES_HTML) $(HTMLDIR)/*.html $(HTMLDIR)/*.css $(TXTDIR)/*.txt $(PSDIR)/*.ps $(PDFDIR)/*.pdf - @rm -f $(MANPROJDOC)/smb.conf.5.xml $(SMBDOTCONFDOC)/parameters.*.xml $(DVIDIR)/*.dvi - @rm -f samba-doc.* dev-doc.* $(PROJDOC)/attributions.xml - @rm -f $(IMAGEPROJDIR)/*.eps - diff --git a/docs/docbook/configure b/docs/docbook/configure index 303ea97f57..d51cdfc48c 100755 --- a/docs/docbook/configure +++ b/docs/docbook/configure @@ -11,6 +11,12 @@ ac_help= ac_default_prefix=/usr/local # Any additions from configure.in: +ac_help="$ac_help + --enable-crop Whether to use a crop template" +ac_help="$ac_help + --with-papersize Specify papersize (a4paper,letter) " +ac_help="$ac_help + --with-fontsize Specify the fontsize in points (default: 10.5) " # Initialize some variables set by options. # The variables have the same names as the options, with @@ -525,7 +531,7 @@ fi # Extract the first word of "xsltproc", so it can be a program name with args. set dummy xsltproc; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:529: checking for $ac_word" >&5 +echo "configure:535: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_path_XSLTPROC'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else @@ -563,7 +569,7 @@ fi # Extract the first word of "pdflatex", so it can be a program name with args. set dummy pdflatex; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:567: checking for $ac_word" >&5 +echo "configure:573: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_path_PDFLATEX'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else @@ -598,20 +604,19 @@ fi if test "x$PDFLATEX" = x; then { echo "configure: error: "pdflatex is required"" 1>&2; exit 1; } fi - -# Extract the first word of "xmlto", so it can be a program name with args. -set dummy xmlto; ac_word=$2 +# Extract the first word of "makeindex", so it can be a program name with args. +set dummy makeindex; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:606: checking for $ac_word" >&5 -if eval "test \"`echo '$''{'ac_cv_path_XMLTO'+set}'`\" = set"; then +echo "configure:611: checking for $ac_word" >&5 +if eval "test \"`echo '$''{'ac_cv_path_MAKEINDEX'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else - case "$XMLTO" in + case "$MAKEINDEX" in /*) - ac_cv_path_XMLTO="$XMLTO" # Let the user override the test with a path. + ac_cv_path_MAKEINDEX="$MAKEINDEX" # Let the user override the test with a path. ;; ?:/*) - ac_cv_path_XMLTO="$XMLTO" # Let the user override the test with a dos path. + ac_cv_path_MAKEINDEX="$MAKEINDEX" # Let the user override the test with a dos path. ;; *) IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" @@ -619,7 +624,7 @@ else for ac_dir in $ac_dummy; do test -z "$ac_dir" && ac_dir=. if test -f $ac_dir/$ac_word; then - ac_cv_path_XMLTO="$ac_dir/$ac_word" + ac_cv_path_MAKEINDEX="$ac_dir/$ac_word" break fi done @@ -627,17 +632,52 @@ else ;; esac fi -XMLTO="$ac_cv_path_XMLTO" -if test -n "$XMLTO"; then - echo "$ac_t""$XMLTO" 1>&6 +MAKEINDEX="$ac_cv_path_MAKEINDEX" +if test -n "$MAKEINDEX"; then + echo "$ac_t""$MAKEINDEX" 1>&6 else echo "$ac_t""no" 1>&6 fi +if test "x$MAKEINDEX" = x; then + { echo "configure: error: "makeindex is required"" 1>&2; exit 1; } +fi + +PAPERSIZE="" +TEXSTYLESHEET=xslt/latex.xsl +DUPLICATE_ULINKS="" + +CROP="--stringparam docrop 0" + +# Check whether --enable-crop or --disable-crop was given. +if test "${enable_crop+set}" = set; then + enableval="$enable_crop" + test "$withval" && CROP="--stringparam docrop 1" +fi + + +PAPERSIZE="--stringparam papersize a4paper" + +# Check whether --with-papersize or --without-papersize was given. +if test "${with_papersize+set}" = set; then + withval="$with_papersize" + test "$withval" && PAPERSIZE="--stringparam papersize $withval" +fi + + +FONTSIZE="--stringparam fontsize 10.5" + +# Check whether --with-fontsize or --without-fontsize was given. +if test "${with_fontsize+set}" = set; then + withval="$with_fontsize" + test "$withval" && FONTSIZE="--stringparam fontsize $withval" +fi + + # Extract the first word of "latex", so it can be a program name with args. set dummy latex; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:641: checking for $ac_word" >&5 +echo "configure:681: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_path_LATEX'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else @@ -672,7 +712,7 @@ fi # Extract the first word of "dvips", so it can be a program name with args. set dummy dvips; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:676: checking for $ac_word" >&5 +echo "configure:716: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_path_DVIPS'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else @@ -707,7 +747,7 @@ fi # Extract the first word of "pngtopnm", so it can be a program name with args. set dummy pngtopnm; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:711: checking for $ac_word" >&5 +echo "configure:751: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_path_PNGTOPNM'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else @@ -742,7 +782,7 @@ fi # Extract the first word of "pnmtops", so it can be a program name with args. set dummy pnmtops; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:746: checking for $ac_word" >&5 +echo "configure:786: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_path_PNMTOPS'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else @@ -774,10 +814,85 @@ else echo "$ac_t""no" 1>&6 fi +# Extract the first word of "perl", so it can be a program name with args. +set dummy perl; ac_word=$2 +echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 +echo "configure:821: checking for $ac_word" >&5 +if eval "test \"`echo '$''{'ac_cv_path_PERL'+set}'`\" = set"; then + echo $ac_n "(cached) $ac_c" 1>&6 +else + case "$PERL" in + /*) + ac_cv_path_PERL="$PERL" # Let the user override the test with a path. + ;; + ?:/*) + ac_cv_path_PERL="$PERL" # Let the user override the test with a dos path. + ;; + *) + IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" + ac_dummy="$PATH" + for ac_dir in $ac_dummy; do + test -z "$ac_dir" && ac_dir=. + if test -f $ac_dir/$ac_word; then + ac_cv_path_PERL="$ac_dir/$ac_word" + break + fi + done + IFS="$ac_save_ifs" + ;; +esac +fi +PERL="$ac_cv_path_PERL" +if test -n "$PERL"; then + echo "$ac_t""$PERL" 1>&6 +else + echo "$ac_t""no" 1>&6 +fi + +# Extract the first word of "xmlto", so it can be a program name with args. +set dummy xmlto; ac_word=$2 +echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 +echo "configure:856: checking for $ac_word" >&5 +if eval "test \"`echo '$''{'ac_cv_path_XMLTO'+set}'`\" = set"; then + echo $ac_n "(cached) $ac_c" 1>&6 +else + case "$XMLTO" in + /*) + ac_cv_path_XMLTO="$XMLTO" # Let the user override the test with a path. + ;; + ?:/*) + ac_cv_path_XMLTO="$XMLTO" # Let the user override the test with a dos path. + ;; + *) + IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" + ac_dummy="$PATH" + for ac_dir in $ac_dummy; do + test -z "$ac_dir" && ac_dir=. + if test -f $ac_dir/$ac_word; then + ac_cv_path_XMLTO="$ac_dir/$ac_word" + break + fi + done + IFS="$ac_save_ifs" + ;; +esac +fi +XMLTO="$ac_cv_path_XMLTO" +if test -n "$XMLTO"; then + echo "$ac_t""$XMLTO" 1>&6 +else + echo "$ac_t""no" 1>&6 +fi + DOC_BUILD_DATE=`date '+%d-%m-%Y'` + + + + + trap '' 1 2 15 cat > confcache <<\EOF # This file is a shell script that caches the results of configure @@ -924,12 +1039,19 @@ s%@infodir@%$infodir%g s%@mandir@%$mandir%g s%@XSLTPROC@%$XSLTPROC%g s%@PDFLATEX@%$PDFLATEX%g -s%@XMLTO@%$XMLTO%g +s%@MAKEINDEX@%$MAKEINDEX%g s%@LATEX@%$LATEX%g s%@DVIPS@%$DVIPS%g s%@PNGTOPNM@%$PNGTOPNM%g s%@PNMTOPS@%$PNMTOPS%g +s%@PERL@%$PERL%g +s%@XMLTO@%$XMLTO%g s%@DOC_BUILD_DATE@%$DOC_BUILD_DATE%g +s%@TEXSTYLESHEET@%$TEXSTYLESHEET%g +s%@PAPERSIZE@%$PAPERSIZE%g +s%@DUPLICATE_ULINKS@%$DUPLICATE_ULINKS%g +s%@FONTSIZE@%$FONTSIZE%g +s%@CROP@%$CROP%g CEOF EOF diff --git a/docs/docbook/configure.in b/docs/docbook/configure.in index 25abecafe1..9df4795022 100644 --- a/docs/docbook/configure.in +++ b/docs/docbook/configure.in @@ -8,14 +8,46 @@ AC_PATH_PROG(PDFLATEX, pdflatex) if test "x$PDFLATEX" = x; then AC_MSG_ERROR("pdflatex is required") fi +AC_PATH_PROG(MAKEINDEX, makeindex) +if test "x$MAKEINDEX" = x; then + AC_MSG_ERROR("makeindex is required") +fi + +PAPERSIZE="" +TEXSTYLESHEET=xslt/latex.xsl +DUPLICATE_ULINKS="" + +CROP="--stringparam docrop 0" + +AC_ARG_ENABLE(crop, +[ --enable-crop Whether to use a crop template], +[ test "$withval" && CROP="--stringparam docrop 1" ]) + +PAPERSIZE="--stringparam papersize a4paper" + +AC_ARG_WITH(papersize, +[ --with-papersize Specify papersize (a4paper,letter) ], +[ test "$withval" && PAPERSIZE="--stringparam papersize $withval" ]) + +FONTSIZE="--stringparam fontsize 10.5" + +AC_ARG_WITH(fontsize, +[ --with-fontsize Specify the fontsize in points (default: 10.5) ], +[ test "$withval" && FONTSIZE="--stringparam fontsize $withval" ]) -AC_PATH_PROG(XMLTO, xmlto) AC_PATH_PROG(LATEX, latex) AC_PATH_PROG(DVIPS, dvips) AC_PATH_PROG(PNGTOPNM, pngtopnm) AC_PATH_PROG(PNMTOPS, pnmtops) +AC_PATH_PROG(PERL, perl) +AC_PATH_PROG(XMLTO, xmlto) DOC_BUILD_DATE=`date '+%d-%m-%Y'` AC_SUBST(DOC_BUILD_DATE) +AC_SUBST(TEXSTYLESHEET) +AC_SUBST(PAPERSIZE) +AC_SUBST(DUPLICATE_ULINKS) +AC_SUBST(FONTSIZE) +AC_SUBST(CROP) AC_OUTPUT( Makefile ) diff --git a/docs/docbook/devdoc/dev-doc.xml b/docs/docbook/devdoc/dev-doc.xml index 9236b18986..7000d09c98 100644 --- a/docs/docbook/devdoc/dev-doc.xml +++ b/docs/docbook/devdoc/dev-doc.xml @@ -27,10 +27,6 @@ SAMBA Developers Guide - - SAMBA Team - -

    PAM INTERACTION

    Samba uses PAM for authentication (when presented with a plaintext password), for account checking (is this account disabled?) and for session management. The degree too which samba supports PAM is restricted - by the limitations of the SMB protocol and the obey - pam restricions smb.conf(5) paramater. When this is set, the following restrictions apply: + by the limitations of the SMB protocol and the obey pam restrictions smb.conf(5) paramater. When this is set, the following restrictions apply:

    • Account Validation: All accesses to a samba server are checked against PAM to see if the account is vaild, not disabled and is permitted to diff --git a/docs/htmldocs/smbmount.8.html b/docs/htmldocs/smbmount.8.html index 233dee51d7..64968b5de7 100644 --- a/docs/htmldocs/smbmount.8.html +++ b/docs/htmldocs/smbmount.8.html @@ -1,14 +1,14 @@ smbmount

      Name

      smbmount — mount an smbfs filesystem

      Synopsis

      smbmount {service} {mount-point} [-o options]

      DESCRIPTION

      smbmount mounts a Linux SMB filesystem. It is usually invoked as mount.smbfs by the mount(8) command when using the - "-t smbfs" option. This command only works in Linux, and the kernel must + "-t smbfs" option. This command only works in Linux, and the kernel must support the smbfs filesystem.

      Options to smbmount are specified as a comma-separated list of key=value pairs. It is possible to send options other than those listed here, assuming that smbfs supports them. If you get mount failures, check your kernel log for errors on unknown options.

      smbmount is a daemon. After mounting it keeps running until the mounted smbfs is umounted. It will log things that happen - when in daemon mode using the "machine name" smbmount, so + when in daemon mode using the "machine name" smbmount, so typically this output will end up in log.smbmount. The smbmount process may also be called mount.smbfs.

      Note

      smbmount calls smbmnt(8) to do the actual mount. You @@ -16,8 +16,8 @@ that it can be found.

      OPTIONS

      username=<arg>

      specifies the username to connect as. If this is not given, then the environment variable USER is used. This option can also take the - form "user%password" or "user/workgroup" or - "user/workgroup%password" to allow the password and workgroup + form "user%password" or "user/workgroup" or + "user/workgroup%password" to allow the password and workgroup to be specified as part of the username.

      password=<arg>

      specifies the SMB password. If this option is not given then the environment variable PASSWD is used. If it can find diff --git a/docs/htmldocs/smbpasswd.5.html b/docs/htmldocs/smbpasswd.5.html index 556b637f4f..feb899f946 100644 --- a/docs/htmldocs/smbpasswd.5.html +++ b/docs/htmldocs/smbpasswd.5.html @@ -19,8 +19,8 @@ Note that this password hash is regarded as weak as it is vulnerable to dictionary attacks and if two users choose the same password this entry will be identical (i.e. the password - is not "salted" as the UNIX password is). If the user has a - null password this field will contain the characters "NO PASSWORD" + is not "salted" as the UNIX password is). If the user has a + null password this field will contain the characters "NO PASSWORD" as the start of the hex string. If the hex string is equal to 32 'X' characters then the user's account is marked as disabled and the user will not be able to @@ -43,7 +43,7 @@ password and uses a much higher quality hashing algorithm. However, it is still the case that if two users choose the same password this entry will be identical (i.e. the password is - not "salted" as the UNIX password is).

      WARNING !!. Note that, due to + not "salted" as the UNIX password is).

      WARNING !!. Note that, due to the challenge-response nature of the SMB/CIFS authentication protocol, anyone with a knowledge of this password hash will be able to impersonate the user on the network. For this @@ -59,20 +59,21 @@ 13 characters in length (including the '[' and ']' characters). The contents of this field may be any of the following characters:

      • U - This means - this is a "User" account, i.e. an ordinary user. Only User + this is a "User" account, i.e. an ordinary user. Only User and Workstation Trust accounts are currently supported in the smbpasswd file.

      • N - This means the account has no password (the passwords in the fields LANMAN Password Hash and NT Password Hash are ignored). Note that this will only allow users to log on with no password if the - null passwords parameter is set in the smb.conf(5) config file.

      • D - This means the account + null passwords parameter is set in the + smb.conf(5) config file.

      • D - This means the account is disabled and no SMB/CIFS logins will be allowed for this user.

      • W - This means this account - is a "Workstation Trust" account. This kind of account is used + is a "Workstation Trust" account. This kind of account is used in the Samba PDC code stream to allow Windows NT Workstations and Servers to join a Domain hosted by a Samba PDC.

      Other flags may be added as the code is extended in future. The rest of this field space is filled in with spaces.

      Last Change Time

      This field consists of the time the account was last modified. It consists of the characters 'LCT-' (standing for - "Last Change Time") followed by a numeric encoding of the UNIX time + "Last Change Time") followed by a numeric encoding of the UNIX time in seconds since the epoch (1970) that the last change was made.

      All other colon separated fields are ignored at this time.

      VERSION

      This man page is correct for version 3.0 of the Samba suite.

      SEE ALSO

      smbpasswd(8), Samba(7), and diff --git a/docs/htmldocs/smbpasswd.8.html b/docs/htmldocs/smbpasswd.8.html index 7612fdd775..7c98e4b080 100644 --- a/docs/htmldocs/smbpasswd.8.html +++ b/docs/htmldocs/smbpasswd.8.html @@ -16,7 +16,7 @@ for their new password twice, to ensure that the new password was typed correctly. No passwords will be echoed on the screen whilst being typed. If you have a blank SMB password (specified by - the string "NO PASSWORD" in the smbpasswd file) then just press + the string "NO PASSWORD" in the smbpasswd file) then just press the <Enter> key when asked for your old password.

      smbpasswd can also be used by a normal user to change their SMB password on remote machines, such as Windows NT Primary Domain Controllers. See the (-r) and -U options @@ -64,10 +64,10 @@ HUGE amounts of log data, most of which is extremely cryptic.

      -n

      This option specifies that the username following should have their password set to null (i.e. a blank password) in - the local smbpasswd file. This is done by writing the string "NO - PASSWORD" as the first part of the first password stored in the + the local smbpasswd file. This is done by writing the string "NO + PASSWORD" as the first part of the first password stored in the smbpasswd file.

      Note that to allow users to logon to a Samba server once - the password has been set to "NO PASSWORD" in the smbpasswd + the password has been set to "NO PASSWORD" in the smbpasswd file the administrator must set the following parameter in the [global] section of the smb.conf file :

      null passwords = yes

      This option is only available when running smbpasswd as root.

      -r remote machine name

      This option allows a user to specify what machine @@ -89,7 +89,7 @@ a real password database so it is not possible to change passwords specifying a Win95/98 machine as remote machine target.

      -R name resolve order

      This option allows the user of smbpasswd to determine what name resolution services to use when looking up the NetBIOS - name of the host being connected to.

      The options are :"lmhosts", "host", "wins" and "bcast". They + name of the host being connected to.

      The options are :"lmhosts", "host", "wins" and "bcast". They cause names to be resolved as follows:

      • lmhosts: Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has no name type attached to the NetBIOS name (see the lmhosts(5) for details) then @@ -127,8 +127,7 @@ has been configured to use the experimental --with-ldapsam option. The -w switch is used to specify the password to be used with the - ldap admin - dn. Note that the password is stored in + ldap admin dn. Note that the password is stored in the secrets.tdb and is keyed off of the admin's DN. This means that if the value of ldap admin dn ever changes, the password will need to be @@ -148,10 +147,8 @@ smbd running on the local machine by specifying either allow hosts or deny hosts entry in the smb.conf(5) file and neglecting to - allow "localhost" access to the smbd.

        In addition, the smbpasswd command is only useful if Samba - has been set up to use encrypted passwords. See the document - "LanMan and NT Password Encryption in Samba" in the docs directory for details - on how to do this.

      VERSION

      This man page is correct for version 3.0 of the Samba suite.

      SEE ALSO

      smbpasswd(5), Samba(7).

      AUTHOR

      The original Samba software and related utilities + allow "localhost" access to the smbd.

      In addition, the smbpasswd command is only useful if Samba + has been set up to use encrypted passwords.

      VERSION

      This man page is correct for version 3.0 of the Samba suite.

      SEE ALSO

      smbpasswd(5), Samba(7).

      AUTHOR

      The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

      The original Samba man pages were written by Karl Auer. diff --git a/docs/htmldocs/smbsh.1.html b/docs/htmldocs/smbsh.1.html index 935576af6b..d1360d849d 100644 --- a/docs/htmldocs/smbsh.1.html +++ b/docs/htmldocs/smbsh.1.html @@ -1,4 +1,4 @@ -smbsh

      Name

      smbsh — Allows access to Windows NT filesystem +smbsh

      Name

      smbsh — Allows access to remote SMB shares using UNIX commands

      Synopsis

      smbsh [-W workgroup] [-U username] [-P prefix] [-R <name resolve order>] [-d <debug level>] [-l logfile] [-L libdir]

      DESCRIPTION

      This tool is part of the Samba(7) suite.

      smbsh allows you to access an NT filesystem using UNIX commands such as ls, egrep, and rcp. You must use a @@ -19,8 +19,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

      -d|--debug=debuglevel

      debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -34,12 +33,11 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

      Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

      -R <name resolve order>

      This option is used to determine what naming +override the log level parameter +in the smb.conf file.

      -R <name resolve order>

      This option is used to determine what naming services and in what order to resolve host names to IP addresses. The option takes a space-separated -string of different name resolution options.

      The options are: "lmhosts", "host", "wins" and "bcast". +string of different name resolution options.

      The options are: "lmhosts", "host", "wins" and "bcast". They cause names to be resolved as follows :

      • lmhosts: Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has no name type attached to the @@ -67,11 +65,11 @@ parameter. This is the least reliable of the name resolution methods as it depends on the target host being on a locally connected subnet.

      If this parameter is not set then the name resolve order -defined in the smb.conf(5) file parameter -(name resolve order) will be used.

      The default order is lmhosts, host, wins, bcast. Without -this parameter or any entry in the name resolve order - parameter of the smb.conf(5) file, the name resolution methods -will be attempted in this order.

      -L libdir

      This parameter specifies the location of the +defined in the smb.conf file parameter +(name resolve order) will be used. +

      The default order is lmhosts, host, wins, bcast. Without +this parameter or any entry in the name resolve order parameter of the smb.conf file, the name +resolution methods will be attempted in this order.

      -L libdir

      This parameter specifies the location of the shared libraries used by smbsh. The default value is specified at compile time.

      EXAMPLES

      To use the smbsh command, execute @@ -93,7 +91,7 @@ will be attempted in this order.

      -L libdir command to change directories, vi to edit files, and rcp to copy files.

      VERSION

      This man page is correct for version 3.0 of the Samba suite.

      BUGS

      smbsh works by intercepting the standard libc calls with the dynamically loaded versions in - smbwrapper.o. Not all calls have been "wrapped", so + smbwrapper.o. Not all calls have been "wrapped", so some programs may not function correctly under smbsh .

      Programs which are not dynamically linked cannot make use of smbsh's functionality. Most versions diff --git a/docs/htmldocs/smbspool.8.html b/docs/htmldocs/smbspool.8.html index 186f30ebcf..7366ab458f 100644 --- a/docs/htmldocs/smbspool.8.html +++ b/docs/htmldocs/smbspool.8.html @@ -3,7 +3,7 @@ are position-dependent for compatibility with the Common UNIX Printing System, but you can use smbspool with any printing system or from a program or script.

      DEVICE URI

      smbspool specifies the destination using a Uniform Resource - Identifier ("URI") with a method of "smb". This string can take + Identifier ("URI") with a method of "smb". This string can take a number of forms:

      • smb://server/printer

      • smb://workgroup/server/printer

      • smb://username:password@server/printer

      • smb://username:password@workgroup/server/printer

      smbspool tries to get the URI from argv[0]. If argv[0] contains the name of the program then it looks in the DEVICE_URI environment variable.

      Programs using the exec(2) functions can diff --git a/docs/htmldocs/smbstatus.1.html b/docs/htmldocs/smbstatus.1.html index c1be6234c3..99b152e75c 100644 --- a/docs/htmldocs/smbstatus.1.html +++ b/docs/htmldocs/smbstatus.1.html @@ -7,8 +7,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

      -d|--debug=debuglevel

      debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -22,9 +21,8 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

      Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

      -l|--logfile=logbasename

      File name for log/debug files. The extension +override the log level parameter +in the smb.conf file.

      -l|--logfile=logbasename

      File name for log/debug files. The extension ".client" will be appended. The log file is never removed by the client.

      -v|--verbose

      gives verbose output.

      -L|--locks

      causes smbstatus to only list locks.

      -B|--byterange

      causes smbstatus to include byte range locks. diff --git a/docs/htmldocs/smbtar.1.html b/docs/htmldocs/smbtar.1.html index 30058d1860..95aabf1bc3 100644 --- a/docs/htmldocs/smbtar.1.html +++ b/docs/htmldocs/smbtar.1.html @@ -2,7 +2,7 @@ directly to UNIX tape drives

      Synopsis

      smbtar [-r] [-i] [-a] [-v] {-s server} [-p password] [-x services] [-X] [-N filename] [-b blocksize] [-d directory] [-l loglevel] [-u user] [-t tape] {filenames}

      DESCRIPTION

      This tool is part of the Samba(7) suite.

      smbtar is a very small shell script on top of smbclient(1) which dumps SMB shares directly to tape.

      OPTIONS

      -s server

      The SMB/CIFS server that the share resides upon.

      -x service

      The share name on the server to connect to. - The default is "backup".

      -X

      Exclude mode. Exclude filenames... from tar + The default is "backup".

      -X

      Exclude mode. Exclude filenames... from tar create or restore.

      -d directory

      Change to initial directory before restoring / backing up files.

      -v

      Verbose mode.

      -p password

      The password to use to access a share. Default: none

      -u user

      The user id to connect as. Default: diff --git a/docs/htmldocs/smbtree.1.html b/docs/htmldocs/smbtree.1.html index 6cf24ddf91..cc683838dd 100644 --- a/docs/htmldocs/smbtree.1.html +++ b/docs/htmldocs/smbtree.1.html @@ -1,6 +1,6 @@ smbtree

      Name

      smbtree — A text based smb network browser

      Synopsis

      smbtree [-b] [-D] [-S]

      DESCRIPTION

      This tool is part of the Samba(7) suite.

      smbtree is a smb browser program - in text mode. It is similar to the "Network Neighborhood" found + in text mode. It is similar to the "Network Neighborhood" found on Windows computers. It prints a tree with all the known domains, the servers in those domains and the shares on the servers. @@ -17,8 +17,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

      -d|--debug=debuglevel

      debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -32,10 +31,9 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

      Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

      -l|--logfile=logbasename

      File name for log/debug files. The extension -".client" will be appended. The log file is +override the log level parameter +in the smb.conf file.

      -l|--logfile=logbasename

      File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

      -N

      If specified, this parameter suppresses the normal password prompt from the client to the user. This is useful when diff --git a/docs/htmldocs/speed.html b/docs/htmldocs/speed.html index 626d5e0193..47f19abb70 100644 --- a/docs/htmldocs/speed.html +++ b/docs/htmldocs/speed.html @@ -1,4 +1,4 @@ -Chapter 39. Samba Performance Tuning

      Chapter 39. Samba Performance Tuning
      Prev Part VI. Appendixes Next

      Chapter 39. Samba Performance Tuning

      Paul Cochrane

      Dundee Limb Fitting Centre

      Jelmer R. Vernooij

      The Samba Team

      John H. Terpstra

      Samba Team

      Table of Contents

      Comparisons
      Socket options
      Read size
      Max xmit
      Log level
      Read raw
      Write raw
      Slow Logins
      Client tuning
      Samba performance problem due changing kernel
      Corrupt tdb Files

      Comparisons

      +Chapter 39. Samba Performance Tuning

      Chapter 39. Samba Performance Tuning
      Prev Part VI. Appendixes Next

      Chapter 39. Samba Performance Tuning

      Paul Cochrane

      Dundee Limb Fitting Centre

      Jelmer R. Vernooij

      The Samba Team

      John H. Terpstra

      Samba Team

      Table of Contents

      Comparisons
      Socket options
      Read size
      Max xmit
      Log level
      Read raw
      Write raw
      Slow Logins
      Client tuning
      Samba performance problem due changing kernel
      Corrupt tdb Files

      Comparisons

      The Samba server uses TCP to talk to the client. Thus if you are trying to see if it performs well you should really compare it to programs that use the same protocol. The most readily available @@ -20,14 +20,14 @@ suspect the biggest factor is not Samba vs some other system but the hardware and drivers used on the various systems. Given similar hardware Samba should certainly be competitive in speed with other systems. -

      Socket options

      +

      Socket options

      There are a number of socket options that can greatly affect the performance of a TCP based server like Samba.

      The socket options that Samba uses are settable both on the command line with the -O option, or in the smb.conf file.

      -The socket options section of the smb.conf manual page describes how +The socket options section of the smb.conf manual page describes how to set these and gives recommendations.

      Getting the socket options right can make a big difference to your @@ -36,11 +36,11 @@ much. The correct settings are very dependent on your local network.

      The socket option TCP_NODELAY is the one that seems to make the biggest single difference for most networks. Many people report that -adding socket options = TCP_NODELAY doubles the read +adding socket options = TCP_NODELAY doubles the read performance of a Samba drive. The best explanation I have seen for this is that the Microsoft TCP/IP stack is slow in sending tcp ACKs. -

      Read size

      -The option read size affects the overlap of disk +

      Read size

      +The option read size affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger than this value then the server begins writing @@ -56,10 +56,10 @@ The default value is 16384, but very little experimentation has been done yet to determine the optimal value, and it is likely that the best value will vary greatly between systems anyway. A value over 65536 is pointless and will cause you to allocate memory unnecessarily. -

      Max xmit

      -At startup the client and server negotiate a maximum transmit size, +

      Max xmit

      + At startup the client and server negotiate a maximum transmit size, which limits the size of nearly all SMB commands. You can set the -maximum size that Samba will negotiate using the max xmit = option +maximum size that Samba will negotiate using the max xmit option in smb.conf. Note that this is the maximum size of SMB requests that Samba will accept, but not the maximum size that the *client* will accept. The client maximum receive size is sent to Samba by the client and Samba @@ -70,41 +70,41 @@ clients may perform better with a smaller transmit unit. Trying values of less than 2048 is likely to cause severe problems.

      In most cases the default is the best option. -

      Log level

      -If you set the log level (also known as debug level) higher than 2 +

      Log level

      +If you set the log level (also known as debug level) higher than 2 then you may suffer a large drop in performance. This is because the server flushes the log file after each operation, which can be very expensive. -

      Read raw

      -The read raw operation is designed to be an optimised, low-latency +

      Read raw

      +The read raw operation is designed to be an optimised, low-latency file read operation. A server may choose to not support it, -however. and Samba makes support for read raw optional, with it +however. and Samba makes support for read raw optional, with it being enabled by default.

      -In some cases clients don't handle read raw very well and actually +In some cases clients don't handle read raw very well and actually get lower performance using it than they get using the conventional read operations.

      -So you might like to try read raw = no and see what happens on your +So you might like to try read raw = no and see what happens on your network. It might lower, raise or not affect your performance. Only testing can really tell. -

      Write raw

      -The write raw operation is designed to be an optimised, low-latency +

      Write raw

      +The write raw operation is designed to be an optimised, low-latency file write operation. A server may choose to not support it, -however. and Samba makes support for write raw optional, with it +however. and Samba makes support for write raw optional, with it being enabled by default.

      -Some machines may find write raw slower than normal write, in which +Some machines may find write raw slower than normal write, in which case you may wish to change this option. -

      Slow Logins

      +

      Slow Logins

      Slow logins are almost always due to the password checking time. Using -the lowest practical password level will improve things. -

      Client tuning

      +the lowest practical password level will improve things. +

      Client tuning

      Often a speed problem can be traced to the client. The client (for example Windows for Workgroups) can often be tuned for better TCP performance. Check the sections on the various clients in Samba and Other Clients. -

      Samba performance problem due changing kernel

      +

      Samba performance problem due changing kernel

      Hi everyone. I am running Gentoo on my server and samba 2.2.8a. Recently I changed kernel version from linux-2.4.19-gentoo-r10 to linux-2.4.20-wolk4.0s. And now I have performance issue with samba. Ok @@ -119,7 +119,7 @@ Grab mii-tool and check the duplex settings on the NIC. My guess is that it is a link layer issue, not an application layer problem. Also run ifconfig and verify that the framing error, collisions, etc... look normal for ethernet. -

      Corrupt tdb Files

      +

      Corrupt tdb Files

      Well today it happened, Our first major problem using samba. Our samba PDC server has been hosting 3 TB of data to our 500+ users [Windows NT/XP] for the last 3 years using samba, no problem. @@ -137,4 +137,4 @@ Q2) What I also would like to mention is that the service latency seems a lot lower then before the locks cleanup, any ideas on keeping it top notch?

      A2) Yes! Same answer as for Q1! -

      Prev Up Next
      Chapter 38. Samba and other CIFS clients Home Chapter 40. DNS and DHCP Configuration Guide
      +

      Prev Up Next
      Chapter 38. Samba and other CIFS clients Home Chapter 40. DNS and DHCP Configuration Guide
      diff --git a/docs/htmldocs/swat.8.html b/docs/htmldocs/swat.8.html index e0719dce3d..a7f2eaaf5b 100644 --- a/docs/htmldocs/swat.8.html +++ b/docs/htmldocs/swat.8.html @@ -19,8 +19,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

      -d|--debug=debuglevel

      debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -34,10 +33,9 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

      Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

      -l|--logfile=logbasename

      File name for log/debug files. The extension -".client" will be appended. The log file is +override the log level parameter +in the smb.conf file.

      -l|--logfile=logbasename

      File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

      -h|--help

      Print a summary of command line options.

      INSTALLATION

      Swat is included as binary package with most distributions. The @@ -62,7 +60,7 @@ never removed by the client. and /etc/inetd.conf you need to send a HUP signal to inetd. To do this use kill -1 PID where PID is the process ID of the inetd daemon.

    LAUNCHING

    To launch SWAT just run your favorite web browser and - point it at "http://localhost:901/".

    Note that you can attach to SWAT from any IP connected + point it at "http://localhost:901/".

    Note that you can attach to SWAT from any IP connected machine but connecting from a remote machine leaves your connection open to password sniffing as passwords will be sent in the clear over the wire.

    FILES

    /etc/inetd.conf

    This file must contain suitable startup diff --git a/docs/htmldocs/testprns.1.html b/docs/htmldocs/testprns.1.html index ff7d4efd33..b63483d5de 100644 --- a/docs/htmldocs/testprns.1.html +++ b/docs/htmldocs/testprns.1.html @@ -1,11 +1,11 @@ testprns

    Name

    testprns — check printer name for validity with smbd

    Synopsis

    testprns {printername} [printcapname]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    testprns is a very simple test program to determine whether a given printer name is valid for use in - a service to be provided by smbd(8).

    "Valid" in this context means "can be found in the - printcap specified". This program is very stupid - so stupid in + a service to be provided by smbd(8).

    "Valid" in this context means "can be found in the + printcap specified". This program is very stupid - so stupid in fact that it would be wisest to always specify the printcap file to use.

    OPTIONS

    printername

    The printer name to validate.

    Printer names are taken from the first field in each record in the printcap file, single printer names and sets - of aliases separated by vertical bars ("|") are recognized. + of aliases separated by vertical bars ("|") are recognized. Note that no validation or checking of the printcap syntax is done beyond that required to extract the printer name. It may be that the print spooling system is more forgiving or less @@ -16,9 +16,9 @@ specified at compile time.

    FILES

    /etc/printcap

    This is usually the default printcap file to scan. See printcap (5).

    DIAGNOSTICS

    If a printer is found to be valid, the message - "Printer name <printername> is valid" will be + "Printer name <printername> is valid" will be displayed.

    If a printer is found to be invalid, the message - "Printer name <printername> is not valid" will be + "Printer name <printername> is not valid" will be displayed.

    All messages that would normally be logged during operation of the Samba daemons are logged by this program to the file test.log in the current directory. The diff --git a/docs/htmldocs/troubleshooting.html b/docs/htmldocs/troubleshooting.html index 582beeb6b0..d18399caeb 100644 --- a/docs/htmldocs/troubleshooting.html +++ b/docs/htmldocs/troubleshooting.html @@ -1 +1 @@ -Part V. Troubleshooting

    Part V. Troubleshooting
    Prev   Next

    Troubleshooting

    Table of Contents

    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    Still having troubles?
    34. Analysing and solving samba problems
    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches
    Prev Up Next
    Chapter 32. SWAT - The Samba Web Administration Tool Home Chapter 33. The Samba checklist
    +Part V. Troubleshooting
    Part V. Troubleshooting
    Prev   Next

    Troubleshooting

    Table of Contents

    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    34. Analysing and solving samba problems
    Diagnostics tools
    Debugging with Samba itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches
    Prev Up Next
    Chapter 32. SWAT - The Samba Web Administration Tool Home Chapter 33. The Samba checklist
    diff --git a/docs/htmldocs/type.html b/docs/htmldocs/type.html index 209c177a0b..5322995de4 100644 --- a/docs/htmldocs/type.html +++ b/docs/htmldocs/type.html @@ -1,9 +1,5 @@ -Part II. Server Configuration Basics
    Part II. Server Configuration Basics
    Prev   Next

    Server Configuration Basics

    First Steps in Server Configuration

    +Part II. Server Configuration Basics

    Part II. Server Configuration Basics
    Prev   Next

    Server Configuration Basics

    First Steps in Server Configuration

    Samba can operate in various modes within SMB networks. This HOWTO section contains information on configuring samba to function as the type of server your network requires. Please read this section carefully. -

    Table of Contents

    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Seamless Windows Network Integration
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not -exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    Prev Up Next
    Chapter 3. Fast Start for the Impatient Home Chapter 4. Server Types and Security Modes
    +

    Table of Contents

    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password checking
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    '$' cannot be included in machine name
    Joining domain fails because of existing machine account
    The system can not log you on (C000019B)....
    The machine trust account not accessible
    Account disabled
    Domain Controller Unavailable
    Can not log onto domain member workstation after joining domain
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    I can't join a Windows 2003 PDC
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    Prev Up Next
    Chapter 3. Fast Start for the Impatient Home Chapter 4. Server Types and Security Modes
    diff --git a/docs/htmldocs/unicode.html b/docs/htmldocs/unicode.html index a971602e81..a4f568576d 100644 --- a/docs/htmldocs/unicode.html +++ b/docs/htmldocs/unicode.html @@ -1,4 +1,4 @@ -Chapter 27. Unicode/Charsets
    Chapter 27. Unicode/Charsets
    Prev Part III. Advanced Configuration Next

    Chapter 27. Unicode/Charsets

    Jelmer R. Vernooij

    The Samba Team

    TAKAHASHI Motonobu

    25 March 2003

    Table of Contents

    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets

    Features and Benefits

    +Chapter 27. Unicode/Charsets

    Chapter 27. Unicode/Charsets
    Prev Part III. Advanced Configuration Next

    Chapter 27. Unicode/Charsets

    Jelmer R. Vernooij

    The Samba Team

    TAKAHASHI Motonobu

    25 March 2003

    Table of Contents

    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    Common errors
    CP850.so can't be found

    Features and Benefits

    Every industry eventually matures. One of the great areas of maturation is in the focus that has been given over the past decade to make it possible for anyone anywhere to use a computer. It has not always been that way, in fact, not so long @@ -6,14 +6,13 @@ ago it was common for software to be written for exclusive use in the country of origin.

    Of all the effort that has been brought to bear on providing native language support -for all computer users, the efforts of the Openi18n organisation is deserving of -special mention. For more information about Openi18n please refer to: -http://www.openi18n.org/. +for all computer users, the efforts of the Openi18n organisation is deserving of +special mention.

    Samba-2.x supported a single locale through a mechanism called codepages. Samba-3 is destined to become a truly trans-global file and printer sharing platform. -

    What are charsets and unicode?

    +

    What are charsets and unicode?

    Computers communicate in numbers. In texts, each number will be translated to a corresponding letter. The meaning that will be assigned to a certain number depends on the character set(charset) @@ -30,45 +29,39 @@ is more then all possible characters one could think of. They are called multibyte charsets (because they use more then one byte to store one character).

    -A standardised multibyte charset is unicode, info is available at -www.unicode.org. -A big advantage of using a multibyte charset is that you only need one; no -need to make sure two computers use the same charset when they are + A standardised multibyte charset is unicode. +A big advantage of using a multibyte charset is that you only need one; there +is no need to make sure two computers use the same charset when they are communicating. -

    Old windows clients used to use single-byte charsets, named +

    Old windows clients use single-byte charsets, named 'codepages' by Microsoft. However, there is no support for negotiating the charset to be used in the smb protocol. Thus, you -have to make sure you are using the same charset when talking to an old client. +have to make sure you are using the same charset when talking to an older client. Newer clients (Windows NT, 2K, XP) talk unicode over the wire. -

    Samba and charsets

    +

    Samba and charsets

    As of samba 3.0, samba can (and will) talk unicode over the wire. Internally, samba knows of three kinds of character sets: -

    unix charset

    +

    unix charset

    This is the charset used internally by your operating system. - The default is ASCII, which is fine for most - systems. -

    display charset

    This is the charset samba will use to print messages + The default is UTF-8, which is fine for most + systems. The default in previous samba releases was ASCII. +

    display charset

    This is the charset samba will use to print messages on your screen. It should generally be the same as the unix charset. -

    dos charset

    This is the charset samba uses when communicating with +

    dos charset

    This is the charset samba uses when communicating with DOS and Windows 9x clients. It will talk unicode to all newer clients. The default depends on the charsets you have installed on your system. Run testparm -v | grep "dos charset" to see what the default is on your system. -

    Conversion from old names

    Because previous samba versions did not do any charset conversion, +

    Conversion from old names

    Because previous samba versions did not do any charset conversion, characters in filenames are usually not correct in the unix charset but only -for the local charset used by the DOS/Windows clients.

    The following script from Steve Langasek converts all -filenames from CP850 to the iso8859-15 charset.

    -#find /path/to/share -type f -exec bash -c 'CP="{}"; ISO=`echo -n "$CP" | iconv -f cp850 \ - -t iso8859-15`; if [ "$CP" != "$ISO" ]; then mv "$CP" "$ISO"; fi' \; - -

    Japanese charsets

    Samba doesn't work correctly with Japanese charsets yet. Here are -points of attention when setting it up:

    • You should set mangling method = -hash

    • There are various iconv() implementations around and not +for the local charset used by the DOS/Windows clients.

      Bjoern Jacke has written a utility named convm that can convert whole directory + structures to different charsets with one single command. +

    Japanese charsets

    Samba doesn't work correctly with Japanese charsets yet. Here are +points of attention when setting it up:

    • You should set mangling method = hash

    • There are various iconv() implementations around and not all of them work equally well. glibc2's iconv() has a critical problem in CP932. libiconv-1.8 works with CP932 but still has some problems and -does not work with EUC-JP.

    • You should set dos charset = CP932, not -Shift_JIS, SJIS...

    • Currently only unix charset = CP932 +does not work with EUC-JP.

    • You should set dos charset = CP932, not +Shift_JIS, SJIS...

    • Currently only unix charset = CP932 will work (but still has some problems...) because of iconv() issues. -unix charset = EUC-JP doesn't work well because of -iconv() issues.

    • Currently Samba 3.0 does not support unix charset -= UTF8-MAC/CAP/HEX/JIS*

    More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

    Prev Up Next
    Chapter 26. Integrating MS Windows networks with Samba Home Chapter 28. Samba Backup Techniques
    +unix charset = EUC-JP doesn't work well because of +iconv() issues.

  • Currently Samba 3.0 does not support unix charset = UTF8-MAC/CAP/HEX/JIS*

    • More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

    Common errors

    CP850.so can't be found

    “Samba is complaining about a missing CP850.so file”.

    CP850 is the default dos charset. The dos charset is used to convert data to the codepage used by your dos clients. If you don't have any dos clients, you can safely ignore this message.

    CP850 should be supported by your local iconv implementation. Make sure you have all the required packages installed. If you compiled samba from source, make sure configure found iconv.

    Prev Up Next
    Chapter 26. Integrating MS Windows networks with Samba Home Chapter 28. Samba Backup Techniques
    diff --git a/docs/htmldocs/upgrading-to-3.0.html b/docs/htmldocs/upgrading-to-3.0.html index ac559fa129..e7c1c61234 100644 --- a/docs/htmldocs/upgrading-to-3.0.html +++ b/docs/htmldocs/upgrading-to-3.0.html @@ -1,19 +1,176 @@ -Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    Prev Part IV. Migration and Updating Next

    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0

    Jelmer R. Vernooij

    The Samba Team

    25 October 2002

    Table of Contents

    Charsets
    Obsolete configuration options
    Password Backend

    Charsets

    You might experience problems with special characters -when communicating with old DOS clients. Codepage -support has changed in samba 3.0. Read the chapter -Unicode support for details. -

    Obsolete configuration options

    -In 3.0, the following configuration options have been removed. -

    printer driver (replaced by new driver procedures)
    printer driver file (replaced by new driver procedures)
    printer driver location (replaced by new driver procedures)
    use rhosts
    postscript
    client code page (replaced by dos charset)
    vfs path
    vfs options

    Password Backend

    -Effective with the release of samba-3 it is now imperative that the password backend -be correctly defined in smb.conf. -

    -Those migrating from samba-2.x with plaintext password support need the following: -passdb backend = guest. -

    -Those migrating from samba-2.x with encrypted password support should add to smb.conf -passdb backend = smbpasswd, guest. -

    -LDAP using Samba-2.x systems can continue to operate with the following entry -passdb backend = ldapsam_compat, guest. -

    Prev Up Next
    Part IV. Migration and Updating Home Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    +Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    Prev Part IV. Migration and Updating Next

    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    June 30, 2003

    Table of Contents

    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (changes in behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    Charsets
    LDAP

    New Features in Samba-3

    +Major new features: +

    1. + Active Directory support. This release is able to join a ADS realm + as a member server and authenticate users using LDAP/kerberos. +

    2. + Unicode support. Samba will now negotiate UNICODE on the wire and + internally there is now a much better infrastructure for multi-byte + and UNICODE character sets. +

    3. + New authentication system. The internal authentication system has + been almost completely rewritten. Most of the changes are internal, + but the new auth system is also very configurable. +

    4. + New filename mangling system. The filename mangling system has been + completely rewritten. An internal database now stores mangling maps + persistently. This needs lots of testing. +

    5. + New "net" command. A new "net" command has been added. It is + somewhat similar to the "net" command in windows. Eventually we + plan to replace a bunch of other utilities (such as smbpasswd) + with subcommands in "net", at the moment only a few things are + implemented. +

    6. + Samba now negotiates NT-style status32 codes on the wire. This + improves error handling a lot. +

    7. + Better Windows 2000/XP/2003 printing support including publishing + printer attributes in active directory +

    8. + New loadable RPC modules +

    9. + New dual-daemon winbindd support (-B) for better performance +

    10. + Support for migrating from a Windows NT 4.0 domain to a Samba + domain and maintaining user, group and domain SIDs +

    11. + Support for establishing trust relationships with Windows NT 4.0 + domain controllers +

    12. + Initial support for a distributed Winbind architecture using + an LDAP directory for storing SID to uid/gid mappings +

    13. + Major updates to the Samba documentation tree. +

    +Plus lots of other improvements! +

    Configuration Parameter Changes

    +This section contains a brief listing of changes to smb.conf options +in the 3.0.0 release. Please refer to the smb.conf(5) man page for +complete descriptions of new or modified parameters. +

    Removed Parameters

    (order alphabetically):

    • admin log

    • alternate permissions

    • character set

    • client codepage

    • code page directory

    • coding system

    • domain admin group

    • domain guest group

    • force unknown acl user

    • nt smb support

    • post script

    • printer driver

    • printer driver file

    • printer driver location

    • status

    • total print jobs

    • use rhosts

    • valid chars

    • vfs options

    New Parameters

    (new parameters have been grouped by function):

    Remote management

    • abort shutdown script

    • shutdown script

    User and Group Account Management

    • add group script

    • add machine script

    • add user to group script

    • algorithmic rid base

    • delete group script

    • delete user from group script

    • passdb backend

    • set primary group script

    Authentication

    • auth methods

    • ads server

    • realm

    Protocol Options

    • client lanman auth

    • client NTLMv2 auth

    • client schannel

    • client signing

    • client use spnego

    • disable netbios

    • ntlm auth

    • paranoid server security

    • server schannel

    • smb ports

    • use spnego

    File Service

    • get quota command

    • hide special files

    • hide unwriteable files

    • hostname lookups

    • kernel change notify

    • mangle prefix

    • msdfs proxy

    • set quota command

    • use sendfile

    • vfs objects

    Printing

    • max reported print jobs

    UNICODE and Character Sets

    • display charset

    • dos charset

    • unicode

    • unix charset

    SID to uid/gid Mappings

    • idmap backend

    • idmap gid

    • idmap only

    • idmap uid

    LDAP

    • ldap delete dn

    • ldap group suffix

    • ldap idmap suffix

    • ldap machine suffix

    • ldap passwd sync

    • ldap trust ids

    • ldap user suffix

    General Configuration

    • preload modules

    • privatedir

    Modified Parameters (changes in behavior):

    • encrypt passwords (enabled by default)

    • mangling method (set to 'hash2' by default)

    • passwd chat

    • passwd program

    • restrict anonymous (integer value)

    • security (new 'ads' value)

    • strict locking (enabled by default)

    • winbind cache time (increased to 5 minutes)

    • winbind uid (deprecated in favor of 'idmap uid')

    • winbind gid (deprecated in favor of 'idmap gid')

    New Functionality

    Databases

    + This section contains brief descriptions of any new databases + introduced in Samba 3.0. Please remember to backup your existing + ${lock directory}/*tdb before upgrading to Samba 3.0. Samba will + upgrade databases as they are opened (if necessary), but downgrading + from 3.0 to 2.2 is an unsupported path. +

    Table 30.1. TDB File Descriptions

    NameDescriptionBackup?
    account_policyUser policy settingsyes
    gencacheGeneric caching dbno
    group_mapping

    Mapping table from Windows groups/SID to unix groups

    		yes
    idmap

    new ID map table from SIDS to UNIX uids/gids

    		yes
    namecacheName resolution cache entriesno
    netlogon_unigrp

    Cache of universal group membership obtained when operating + as a member of a Windows domain

    		no
    printing/*.tdb

    Cached output from 'lpq command' created on a per print + service basis

    		no
    registry

    Read-only samba registry skeleton that provides support for + exporting various db tables via the winreg RPCs

    		no

    Changes in Behavior

    + The following issues are known changes in behavior between Samba 2.2 and + Samba 3.0 that may affect certain installations of Samba. +

    1. + When operating as a member of a Windows domain, Samba 2.2 would + map any users authenticated by the remote DC to the 'guest account' + if a uid could not be obtained via the getpwnam() call. Samba 3.0 + rejects the connection as NT_STATUS_LOGON_FAILURE. There is no + current work around to re-establish the 2.2 behavior. +

    2. + When adding machines to a Samba 2.2 controlled domain, the + 'add user script' was used to create the UNIX identity of the + machine trust account. Samba 3.0 introduces a new 'add machine + script' that must be specified for this purpose. Samba 3.0 will + not fall back to using the 'add user script' in the absence of + an 'add machine script' +

    Charsets

    + You might experience problems with special characters when communicating with old DOS + clients. Codepage support has changed in samba 3.0. Read the chapter + Unicode support for details. +

    Passdb Backends and Authentication

    + There have been a few new changes that Samba administrators should be + aware of when moving to Samba 3.0. +

    1. + Encrypted passwords have been enabled by default in order to + inter-operate better with out-of-the-box Windows client + installations. This does mean that either (a) a samba account + must be created for each user, or (b) 'encrypt passwords = no' + must be explicitly defined in smb.conf. +

    2. + Inclusion of new security = ads option for integration + with an Active Directory domain using the native Windows + Kerberos 5 and LDAP protocols. +

    + Samba 3.0 also includes the possibility of setting up chains + of authentication methods + (auth methods) and account + storage backends + (passdb backend). + Please refer to the smb.conf + man page and the chapter about account information databases for details. While both parameters assume sane default + values, it is likely that you will need to understand what the + values actually mean in order to ensure Samba operates correctly. +

    + Certain functions of the smbpasswd(8) tool have been split between the + new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8) + utility. See the respective man pages for details. +

    Charsets

    + You might experience problems with special characters when communicating with old DOS + clients. Codepage support has changed in samba 3.0. Read the chapter + Unicode support for details. +

    LDAP

    + This section outlines the new features affecting Samba / LDAP integration. +

    New Schema

    + A new object class (sambaSamAccount) has been introduced to replace + the old sambaAccount. This change aids us in the renaming of attributes + to prevent clashes with attributes from other vendors. There is a + conversion script (examples/LDAP/convertSambaAccount) to modify and LDIF + file to the new schema. +

    + Example: + 

    +		$ ldapsearch .... -b "ou=people,dc=..." > old.ldif
+		$ convertSambaAccount <DOM SID> old.ldif new.ldif
+

    + The <DOM SID> can be obtained by running 'net getlocalsid <DOMAINNAME> + on the Samba PDC as root. +

    + The old sambaAccount schema may still be used by specifying the + "ldapsam_compat" passdb backend. However, the sambaAccount and + associated attributes have been moved to the historical section of + the schema file and must be uncommented before use if needed. + The 2.2 object class declaration for a sambaAccount has not changed + in the 3.0 samba.schema file. +

    + Other new object classes and their uses include: +

    • + sambaDomain - domain information used to allocate rids + for users and groups as necessary. The attributes are added + in 'ldap suffix' directory entry automatically if + an idmap uid/gid range has been set and the 'ldapsam' + passdb backend has been selected. +

    • + sambaGroupMapping - an object representing the + relationship between a posixGroup and a Windows + group/SID. These entries are stored in the 'ldap + group suffix' and managed by the 'net groupmap' command. +

    • + sambaUnixIdPool - created in the 'ldap idmap suffix' entry + automatically and contains the next available 'idmap uid' and + 'idmap gid' +

    • + sambaIdmapEntry - object storing a mapping between a + SID and a UNIX uid/gid. These objects are created by the + idmap_ldap module as needed. +

    New Suffix for Searching

    + The following new smb.conf parameters have been added to aid in directing + certain LDAP queries when 'passdb backend = ldapsam://...' has been + specified. +

    • ldap suffix - used to search for user and computer accounts

    • ldap user suffix - used to store user accounts

    • ldap machine suffix - used to store machine trust accounts

    • ldap group suffix - location of posixGroup/sambaGroupMapping entries

    • ldap idmap suffix - location of sambaIdmapEntry objects

    + If an 'ldap suffix' is defined, it will be appended to all of the + remaining sub-suffix parameters. In this case, the order of the suffix + listings in smb.conf is important. Always place the 'ldap suffix' first + in the list. +

    + Due to a limitation in Samba's smb.conf parsing, you should not surround + the DN's with quotation marks. +

    IdMap LDAP support

    + Samba 3.0 supports an ldap backend for the idmap subsystem. The + following options would inform Samba that the idmap table should be + stored on the directory server onterose in the "ou=idmap,dc=plainjoe, + dc=org" partition. +

    [global]
    ...
    idmap backend = ldap:ldap://onterose/
    ldap idmap suffix = ou=idmap,dc=plainjoe,dc=org
    idmap uid = 40000-50000
    idmap gid = 40000-50000

    + This configuration allows winbind installations on multiple servers to + share a uid/gid number space, thus avoiding the interoperability problems + with NFS that were present in Samba 2.2. +

    Prev Up Next
    Part IV. Migration and Updating Home Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    diff --git a/docs/htmldocs/vfstest.1.html b/docs/htmldocs/vfstest.1.html index 7b124c070f..2cfbfad283 100644 --- a/docs/htmldocs/vfstest.1.html +++ b/docs/htmldocs/vfstest.1.html @@ -14,8 +14,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -29,10 +28,9 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +override the log level parameter +in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    COMMANDS

    VFS COMMANDS

    • load <module.so> - Load specified VFS module

    • populate <char> <size> - Populate a data buffer with the specified data

    • showdata [<offset> <len>] - Show data currently in data buffer diff --git a/docs/htmldocs/wbinfo.1.html b/docs/htmldocs/wbinfo.1.html index 4aa9ddab12..f5f5af0a27 100644 --- a/docs/htmldocs/wbinfo.1.html +++ b/docs/htmldocs/wbinfo.1.html @@ -1,22 +1,32 @@ -wbinfo

      Name

      wbinfo — Query information from winbind daemon

      Synopsis

      wbinfo [-u] [-g] [-N netbios-name] [-I ip] [-n name] [-s sid] [-U uid] [-G gid] [-S sid] [-Y sid] [-t] [-m] [--sequence] [-r user] [-a user%password] [--set-auth-user user%password] [--get-auth-user] [-p]

      DESCRIPTION

      This tool is part of the Samba(7) suite.

      The wbinfo program queries and returns information +wbinfo

      Name

      wbinfo — Query information from winbind daemon

      Synopsis

      wbinfo [-a user%password] [-c username] [-C groupname] [--domain domain] [-I ip] [-s sid] [-u] [-U uid] [-g] [--get-auth-user] [-G gid] [-m] [-n name] [-N netbios-name] [-o user:group] [-O user:group] [-p] [-r user] [--set-auth-user user%password] [--sequence] [-S sid] [-t] [-x username] [-X groupname] [-Y sid]

      DESCRIPTION

      This tool is part of the Samba(7) suite.

      The wbinfo program queries and returns information created and used by the winbindd(8) daemon.

      The winbindd(8) daemon must be configured and running for the wbinfo program to be able - to return information.

      OPTIONS

      -u

      This option will list all users available - in the Windows NT domain for which the winbindd(8) daemon is operating in. Users in all trusted domains - will also be listed. Note that this operation does not assign - user ids to any users that have not already been seen by winbindd(8) - .

      -g

      This option will list all groups available + to return information.

      OPTIONS

      -a username%password

      Attempt to authenticate a user via winbindd. + This checks both authenticaion methods and reports its results. +

      -c user

      Create a local winbind user. +

      -C group

      Create a local winbindd group. +

      --domain name

      This parameter sets the domain on which any specified + operations will performed. If special domain name '.' is used to represent + the current domain to which winbindd belongs. Currently only the + --sequence, + -u, and -g options honor this parameter. +

      -g

      This option will list all groups available in the Windows NT domain for which the Samba(7) daemon is operating in. Groups in all trusted domains will also be listed. Note that this operation does not assign group ids to any groups that have not already been - seen by winbindd(8).

      -N name

      The -N option - queries winbindd(8) to query the WINS - server for the IP address associated with the NetBIOS name - specified by the name parameter. -

      -I ip

      The -I option + seen by winbindd(8).

      --get-auth-user

      Print username and password used by winbindd + during session setup to a domain controller. Username + and password can be set using '-A'. Only available for + root.

      -G gid

      Try to convert a UNIX group id to a Windows + NT SID. If the gid specified does not refer to one within + the idmap gid range then the operation will fail.

      -I ip

      The -I option queries winbindd(8) to send a node status request to get the NetBIOS name associated with the IP address specified by the ip parameter. +

      -m

      Produce a list of domains trusted by the + Windows NT server winbindd(8) contacts + when resolving names. This list does not include the Windows + NT domain the server is a Primary Domain Controller for.

      -n name

      The -n option queries winbindd(8) for the SID associated with the name specified. Domain names can be specified @@ -24,40 +34,43 @@ For example CWDOM1/Administrator refers to the Administrator user in the domain CWDOM1. If no domain is specified then the domain used is the one specified in the smb.conf(5) workgroup - parameter.

      -s sid

      Use -s to resolve + parameter.

      -N name

      The -N option + queries winbindd(8) to query the WINS + server for the IP address associated with the NetBIOS name + specified by the name parameter. +

      -o user:group

      Add a winbindd local group as a secondary group + for the specified winbindd local user. +

      -O user:group

      Remove a winbindd local group as a secondary group + for the specified winbindd local user. +

      -p

      Check whether winbindd is still alive. + Prints out either 'succeeded' or 'failed'. +

      -r username

      Try to obtain the list of UNIX group ids + to which the user belongs. This only works for users + defined on a Domain Controller. +

      -s sid

      Use -s to resolve a SID to a name. This is the inverse of the -n option above. SIDs must be specified as ASCII strings in the traditional Microsoft format. For example, - S-1-5-21-1455342024-3071081365-2475485837-500.

      -U uid

      Try to convert a UNIX user id to a Windows NT - SID. If the uid specified does not refer to one within - the winbind uid range then the operation will fail.

      -G gid

      Try to convert a UNIX group id to a Windows - NT SID. If the gid specified does not refer to one within - the winbind gid range then the operation will fail.

      -S sid

      Convert a SID to a UNIX user id. If the SID - does not correspond to a UNIX user mapped by winbindd(8) then the operation will fail.

      -Y sid

      Convert a SID to a UNIX group id. If the SID - does not correspond to a UNIX group mapped by winbindd(8) then - the operation will fail.

      -t

      Verify that the workstation trust account - created when the Samba server is added to the Windows NT - domain is working.

      -m

      Produce a list of domains trusted by the - Windows NT server winbindd(8) contacts - when resolving names. This list does not include the Windows - NT domain the server is a Primary Domain Controller for. -

      --sequence

      Show sequence numbers of - all known domains

      -r username

      Try to obtain the list of UNIX group ids - to which the user belongs. This only works for users - defined on a Domain Controller. -

      -a username%password

      Attempt to authenticate a user via winbindd. - This checks both authenticaion methods and reports its results. -

      --set-auth-user username%password

      Store username and password used by winbindd + S-1-5-21-1455342024-3071081365-2475485837-500.

      --set-auth-user username%password

      Store username and password used by winbindd during session setup to a domain controller. This enables winbindd to operate in a Windows 2000 domain with Restrict Anonymous turned on (a.k.a. Permissions compatiable with Windows 2000 servers only). -

      --get-auth-user

      Print username and password used by winbindd - during session setup to a domain controller. Username - and password can be set using '-A'. Only available for - root.

      -p

      Check whether winbindd is still alive. - Prints out either 'succeeded' or 'failed'. -

      -V

      Prints the version number for +

      --sequence

      Show sequence numbers of + all known domains

      -S sid

      Convert a SID to a UNIX user id. If the SID + does not correspond to a UNIX user mapped by winbindd(8) then the operation will fail.

      -t

      Verify that the workstation trust account + created when the Samba server is added to the Windows NT + domain is working.

      -u

      This option will list all users available + in the Windows NT domain for which the winbindd(8) daemon is operating in. Users in all trusted domains + will also be listed. Note that this operation does not assign + user ids to any users that have not already been seen by winbindd(8) + .

      -U uid

      Try to convert a UNIX user id to a Windows NT + SID. If the uid specified does not refer to one within + the idmap uid range then the operation will fail.

      -x user

      Delete an existing local winbind user. +

      -X group

      Delete an existing local winbindd group. +

      -Y sid

      Convert a SID to a UNIX group id. If the SID + does not correspond to a UNIX group mapped by winbindd(8) then + the operation will fail.

      -V

      Prints the version number for smbd.

      -h|--help

      Print a summary of command line options.

      EXIT STATUS

      The wbinfo program returns 0 if the operation succeeded, or 1 if the operation failed. If the winbindd(8) daemon is not working wbinfo will always return diff --git a/docs/htmldocs/winbind.html b/docs/htmldocs/winbind.html index 567e882367..1ee1de9f2f 100644 --- a/docs/htmldocs/winbind.html +++ b/docs/htmldocs/winbind.html @@ -1,14 +1,38 @@ -Chapter 21. Integrated Logon Support using Winbind

      Chapter 21. Integrated Logon Support using Winbind
      Prev Part III. Advanced Configuration Next

      Chapter 21. Integrated Logon Support using Winbind

      Tim Potter

      Samba Team

      Andrew Tridgell

      Samba Team

      Naag Mummaneni

      Jelmer R. Vernooij

      The Samba Team

      John H. Terpstra

      Samba Team

      27 June 2002

      Table of Contents

      Features and Benefits
      Introduction
      What Winbind Provides
      Target Uses
      How Winbind Works
      Microsoft Remote Procedure Calls
      Microsoft Active Directory Services
      Name Service Switch
      Pluggable Authentication Modules
      User and Group ID Allocation
      Result Caching
      Installation and Configuration
      Introduction
      Requirements
      Testing Things Out
      Conclusion
      Common Errors

      Features and Benefits

      Integration of UNIX and Microsoft Windows NT through - a unified logon has been considered a "holy grail" in heterogeneous - computing environments for a long time. We present - winbind, a component of the Samba suite - of programs as a solution to the unified logon problem. Winbind - uses a UNIX implementation - of Microsoft RPC calls, Pluggable Authentication Modules, and the Name - Service Switch to allow Windows NT domain users to appear and operate - as UNIX users on a UNIX machine. This paper describes the winbind - system, explaining the functionality it provides, how it is configured, - and how it works internally.

      Introduction

      It is well known that UNIX and Microsoft Windows NT have +Chapter 21. Winbind: Use of Domain Accounts

      Chapter 21. Winbind: Use of Domain Accounts
      Prev Part III. Advanced Configuration Next

      Chapter 21. Winbind: Use of Domain Accounts

      Tim Potter

      Samba Team

      Andrew Tridgell

      Samba Team

      Naag Mummaneni

      Notes for Solaris

      John Trostel

      SNAP

      Jelmer R. Vernooij

      The Samba Team

      John H. Terpstra

      Samba Team

      27 June 2002

      Table of Contents

      Features and Benefits
      Introduction
      What Winbind Provides
      Target Uses
      How Winbind Works
      Microsoft Remote Procedure Calls
      Microsoft Active Directory Services
      Name Service Switch
      Pluggable Authentication Modules
      User and Group ID Allocation
      Result Caching
      Installation and Configuration
      Introduction
      Requirements
      Testing Things Out
      Conclusion
      Common Errors
      NSCD Problem Warning

      Features and Benefits

      + Integration of UNIX and Microsoft Windows NT through a unified logon has + been considered a "holy grail" in heterogeneous computing environments for + a long time. +

      + There is one other facility without which UNIX and Microsoft Windows network + interoperability would suffer greatly. It is imperative that there be a + mechanism for sharing files across UNIX systems and to be able to assign + domain user and group ownerships with integrity. +

      + winbind is a component of the Samba suite of programs + solves the unified logon problem. Winbind uses a UNIX implementation of Microsoft + RPC calls, Pluggable Authentication Modules, and the Name Service Switch to + allow Windows NT domain users to appear and operate as UNIX users on a UNIX + machine. This chapter describes the winbind system, explaining the functionality + it provides, how it is configured, and how it works internally. +

      + Winbind provides three separate functions: +

      • + Authentication of user credentials (via PAM) +

      • + Identity resolution (via NSS)` +

      • + Windindd maintains a database called winbind_idmap.tdb in which it stores + mappings between UNIX UIDs / GIDs and NT SIDs. This mapping is used only + for users and groups that do not have a local UID/GID. It stored the UID/GID + allocated from the idmap uid/gid range that it has mapped to the NT SID. + If idmap backend has been specified as ldapsam:url + then instead of using a local mapping winbindd will obtain this information + from the LDAP database. +

      Note

      + If winbindd is not running, then smbd (which calls winbindd) will fall back to + using purely local information from /etc/passwd and /etc/group and no dynamic + mapping will be used. +

      Introduction

      It is well known that UNIX and Microsoft Windows NT have different models for representing user and group information and use different technologies for implementing them. This fact has made it difficult to integrate the two systems in a satisfactory @@ -29,7 +53,7 @@ tasks for the system administrator when maintaining users and groups on either system. The winbind system provides a simple and elegant solution to all three components of the unified logon - problem.

      What Winbind Provides

      Winbind unifies UNIX and Windows NT account management by + problem.

      What Winbind Provides

      Winbind unifies UNIX and Windows NT account management by allowing a UNIX box to become a full member of a NT domain. Once this is done the UNIX box will see NT users and groups as if they were native UNIX users and groups, allowing the NT domain @@ -53,7 +77,7 @@ to provide authentication via a NT domain to any PAM enabled applications. This capability solves the problem of synchronizing passwords between systems since all passwords are stored in a single - location (on the domain controller).

      Target Uses

      Winbind is targeted at organizations that have an + location (on the domain controller).

      Target Uses

      Winbind is targeted at organizations that have an existing NT based domain infrastructure into which they wish to put UNIX workstations or servers. Winbind will allow these organizations to deploy UNIX workstations without having to @@ -63,12 +87,12 @@ be used is as a central part of UNIX based appliances. Appliances that provide file and print services to Microsoft based networks will be able to use Winbind to provide seamless integration of - the appliance into the domain.

      How Winbind Works

      The winbind system is designed around a client/server + the appliance into the domain.

      How Winbind Works

      The winbind system is designed around a client/server architecture. A long running winbindd daemon listens on a UNIX domain socket waiting for requests to arrive. These requests are generated by the NSS and PAM clients and processed sequentially.

      The technologies used to implement winbind are described - in detail below.

      Microsoft Remote Procedure Calls

      Over the last few years, efforts have been underway + in detail below.

      Microsoft Remote Procedure Calls

      Over the last few years, efforts have been underway by various Samba Team members to decode various aspects of the Microsoft Remote Procedure Call (MSRPC) system. This system is used for most network related operations between @@ -81,7 +105,7 @@ users or groups. Other MSRPC calls can be used to authenticate NT domain users and to change user passwords. By directly querying a Windows PDC for user and group information, winbind maps the - NT account information onto UNIX user and group names.

      Microsoft Active Directory Services

      + NT account information onto UNIX user and group names.

      Microsoft Active Directory Services

      Since late 2001, Samba has gained the ability to interact with Microsoft Windows 2000 using its 'Native Mode' protocols, rather than the NT4 RPC services. @@ -90,7 +114,7 @@ same way as a Win2k client would, and in so doing provide a much more efficient and effective winbind implementation. -

      Name Service Switch

      The Name Service Switch, or NSS, is a feature that is +

      Name Service Switch

      The Name Service Switch, or NSS, is a feature that is present in many UNIX operating systems. It allows system information such as hostnames, mail aliases and user information to be resolved from different sources. For example, a standalone @@ -112,7 +136,7 @@ the C library looks in /etc/nsswitch.conf for a line which matches the service type being requested, for example the "passwd" service type is used when user or group names - are looked up. This config line species which implementations + are looked up. This config line specifies which implementations of that service should be tried and in what order. If the passwd config line is:

       passwd: files example
@@ -127,7 +151,7 @@ passwd: files example
 		is to put libnss_winbind.so in /lib/ 
 		then add "winbind" into /etc/nsswitch.conf at 
 		the appropriate place. The C library will then call Winbind to 
-		resolve user and group names.

      Pluggable Authentication Modules

      Pluggable Authentication Modules, also known as PAM, + resolve user and group names.

      Pluggable Authentication Modules

      Pluggable Authentication Modules, also known as PAM, is a system for abstracting authentication and authorization technologies. With a PAM module it is possible to specify different authentication methods for different system applications without @@ -152,7 +176,7 @@ passwd: files example is copied to /lib/security/ and the PAM control files for relevant services are updated to allow authentication via winbind. See the PAM documentation - for more details.

      User and Group ID Allocation

      When a user or group is created under Windows NT + for more details.

      User and Group ID Allocation

      When a user or group is created under Windows NT is it allocated a numerical relative identifier (RID). This is slightly different to UNIX which has a range of numbers that are used to identify users, and the same range in which to identify @@ -165,7 +189,7 @@ passwd: files example time, winbind will have mapped all Windows NT users and groups to UNIX user ids and group ids.

      The results of this mapping are stored persistently in an ID mapping database held in a tdb database). This ensures that - RIDs are mapped to UNIX IDs in a consistent way.

      Result Caching

      An active system can generate a lot of user and group + RIDs are mapped to UNIX IDs in a consistent way.

      Result Caching

      An active system can generate a lot of user and group name lookups. To reduce the network cost of these lookups winbind uses a caching scheme based on the SAM sequence number supplied by NT domain controllers. User or group information returned @@ -176,23 +200,12 @@ passwd: files example the PDC and compared against the sequence number of the cached entry. If the sequence numbers do not match, then the cached information is discarded and up to date information is requested directly - from the PDC.

      Installation and Configuration

      -Many thanks to John Trostel jtrostel@snapserver.com -for providing the HOWTO for this section. -

      -This HOWTO describes how to get winbind services up and running -to control access and authenticate users on your Linux box using -the winbind services which come with SAMBA 3.0. -

      Introduction

      + from the PDC.

      Installation and Configuration

      Introduction

      This section describes the procedures used to get winbind up and -running on a RedHat 7.1 system. Winbind is capable of providing access +running. Winbind is capable of providing access and authentication control for Windows Domain users through an NT or Win2K PDC for 'regular' services, such as telnet a nd ftp, as well for SAMBA services. -

      -This HOWTO has been written from a 'RedHat-centric' perspective, so if -you are using another distribution, you may have to modify the instructions -somewhat to fit the way your distribution works.

      • Why should I to this?

        This allows the SAMBA administrator to rely on the @@ -208,7 +221,7 @@ somewhat to fit the way your distribution works. SAMBA server, this HOWTO is for you. That said, I am no NT or PAM expert, so you may find a better or easier way to accomplish these tasks. -

      Requirements

      +

    Requirements

    If you have a Samba configuration file that you are currently using... BACK IT UP! If your system already uses PAM, back up the /etc/pam.d directory @@ -235,33 +248,18 @@ winbind modules, you should have at least the pam libraries resident on your system. For recent RedHat systems (7.1, for instance), that means pam-0.74-22. For best results, it is helpful to also install the development packages in pam-devel-0.74-22. -

    Testing Things Out

    +

    Testing Things Out

    Before starting, it is probably best to kill off all the SAMBA related daemons running on your server. Kill off all smbd, nmbd, and winbindd processes that may be running. To use PAM, you will want to make sure that you have the -standard PAM package (for RedHat) which supplies the /etc/pam.d +standard PAM package which supplies the /etc/pam.d directory structure, including the pam modules are used by pam-aware services, several pam libraries, and the /usr/doc and /usr/man entries for pam. Winbind built better in SAMBA if the pam-devel package was also installed. This package includes the header files needed to compile pam-aware applications. -

    Configure and compile SAMBA

    -The configuration and compilation of SAMBA is pretty straightforward. -The first three steps may not be necessary depending upon -whether or not you have previously built the Samba binaries. -

    -root# autoconf
-root# make clean
-root# rm config.cache
-root# ./configure
-root# make
-root# make install
-

    -This will, by default, install SAMBA in /usr/local/samba. -See the main SAMBA documentation if you want to install SAMBA somewhere else. -It will also build the winbindd executable and libraries. -

    Configure nsswitch.conf and the +

    Configure nsswitch.conf and the winbind libraries on Linux and Solaris

    The libraries needed to run the winbindd daemon through nsswitch need to be copied to their proper locations, so @@ -296,7 +294,7 @@ is faster (and you don't need to reboot) if you do it manually:

    This makes libnss_winbind available to winbindd and echos back a check to you. -

    NSS Winbind on AIX

    (This section is only for those running AIX)

    +

    NSS Winbind on AIX

    (This section is only for those running AIX)

    The winbind AIX identification module gets built as libnss_winbind.so in the nsswitch directory of the samba source. This file can be copied to /usr/lib/security, and the AIX naming convention would indicate that it @@ -316,40 +314,25 @@ Programming Concepts for AIX": "System Management Guide: Operating System and Devices". -

    Configure smb.conf

    +

    Configure smb.conf

    Several parameters are needed in the smb.conf file to control the behavior of winbindd. Configure smb.conf These are described in more detail in the winbindd(8) man page. My smb.conf file was modified to include the following entries in the [global] section: -

    -[global]
-     <...>
-     # separate domain and username with '+', like DOMAIN+username
-     winbind separator = +
-     # use uids from 10000 to 20000 for domain users
-     idmap uid = 10000-20000
-     # use gids from 10000 to 20000 for domain groups
-     idmap gid = 10000-20000
-     # allow enumeration of winbind users and groups
-     winbind enum users = yes
-     winbind enum groups = yes
-     # give winbind users a real shell (only needed if they have telnet access)
-     template homedir = /home/winnt/%D/%U
-     template shell = /bin/bash
-

    Join the SAMBA server to the PDC domain

    +

    Example 21.1. smb.conf for winbind set-up

    [global]
    ...
    # separate domain and username with '+', like DOMAIN+username
    winbind separator = +
    # use uids from 10000 to 20000 for domain users
    idmap uid = 10000-20000
    # use gids from 10000 to 20000 for domain groups
    winbind gid = 10000-20000
    # allow enumeration of winbind users and groups
    winbind enum users = yes
    winbind enum groups = yes
    # give winbind users a real shell (only needed if they have telnet access)
    template homedir = /home/winnt/%D/%U
    template shell = /bin/bash

    Join the SAMBA server to the PDC domain

    Enter the following command to make the SAMBA server join the PDC domain, where DOMAIN is the name of your Windows domain and Administrator is a domain user who has administrative privileges in the domain.

    -root# /usr/local/samba/bin/net join -S PDC -U Administrator +root# /usr/local/samba/bin/net rpc join -S PDC -U Administrator

    The proper response to the command should be: "Joined the domain DOMAIN" where DOMAIN is your DOMAIN name. -

    Start up the winbindd daemon and test it!

    +

    Start up the winbindd daemon and test it!

    Eventually, you will want to modify your smb startup script to automatically invoke the winbindd daemon when the other parts of SAMBA start, but it is possible to test out just the winbind @@ -391,8 +374,7 @@ your PDC. For example, I get the following response: CEO+krbtgt CEO+TsInternetUser

    -Obviously, I have named my domain 'CEO' and my winbind -separator is '+'. + Obviously, I have named my domain 'CEO' and my winbind separator is '+'.

    You can do the same sort of thing to get group information from the PDC: @@ -421,7 +403,7 @@ directories and default shells. The same thing can be done for groups with the command

    root# getent group -

    Fix the init.d startup scripts

    Linux

    +

    Fix the init.d startup scripts

    Linux

    The winbindd daemon needs to start up after the smbd and nmbd daemons are running. To accomplish this task, you need to modify the startup scripts of your system. @@ -487,7 +469,7 @@ stop() { echo "" return $RETVAL } -

    Solaris

    Winbind doesn't work on Solaris 9, see the Portability chapter for details.

    On Solaris, you need to modify the +

    Solaris

    Winbind doesn't work on Solaris 9, see the Portability chapter for details.

    On Solaris, you need to modify the /etc/init.d/samba.server startup script. It usually only starts smbd and nmbd but should now start winbindd too. If you have samba installed in /usr/local/samba/bin, @@ -550,11 +532,11 @@ in the script above with: 

     	/usr/local/samba/bin/winbindd -B

    -

    Restarting

    +

    Restarting

    If you restart the smbd, nmbd, and winbindd daemons at this point, you should be able to connect to the samba server as a domain member just as if you were a local user. -

    Configure Winbind and PAM

    +

    Configure Winbind and PAM

    If you have made it this far, you know that winbindd and samba are working together. If you want to use winbind to provide authentication for other services, keep reading. The pam configuration files need to be altered in @@ -574,7 +556,7 @@ your other pam security modules. On my RedHat system, this was the modules reside in /usr/lib/security.

    root# cp ../samba/source/nsswitch/pam_winbind.so /lib/security -

    Linux/FreeBSD-specific PAM configuration

    +

    Linux/FreeBSD-specific PAM configuration

    The /etc/pam.d/samba file does not need to be changed. I just left this file as it was: 

    @@ -601,7 +583,7 @@ have individual directories for the domain users already present on
 the server, or change the home directory template to a general
 directory for all domain users.  These can be easily set using 
 the smb.conf global entry 
-template homedir.
+template homedir.
 
    
 The /etc/pam.d/ftp file can be changed 
 to allow winbind ftp access in a manner similar to the
@@ -634,10 +616,10 @@ same way.  It now looks like this:
 In this case, I added the 
    auth sufficient /lib/security/pam_winbind.so
     
 lines as before, but also added the 
    required pam_securetty.so
    
 above it, to disallow root logins over the network.  I also added a 
-sufficient /lib/security/pam_unix.so use_first_pass
+
    sufficient /lib/security/pam_unix.so use_first_pass
    
 line after the winbind.so line to get rid of annoying 
 double prompts for passwords.
-
    Solaris-specific configuration

    +

    Solaris-specific configuration

    The /etc/pam.conf needs to be changed. I changed this file so that my Domain users can logon both locally as well as telnet.The following are the changes that I made.You can customize the pam.conf file as per your requirements,but @@ -709,15 +691,15 @@ annoying double prompts for passwords.

    Now restart your Samba and try connecting through your application that you configured in the pam.conf. -

    Conclusion

    The winbind system, through the use of the Name Service +

    Conclusion

    The winbind system, through the use of the Name Service Switch, Pluggable Authentication Modules, and appropriate Microsoft RPC calls have allowed us to provide seamless integration of Microsoft Windows NT domain users on a UNIX system. The result is a great reduction in the administrative - cost of running a mixed UNIX and NT network.

    Common Errors

    Winbind has a number of limitations in its current + cost of running a mixed UNIX and NT network.

    Common Errors

    Winbind has a number of limitations in its current released version that we hope to overcome in future releases:

    • Winbind is currently only available for - the Linux, Solaris and IRIX operating systems, although ports to other operating + the Linux, Solaris, AIX and IRIX operating systems, although ports to other operating systems are certainly possible. For such ports to be feasible, we require the C library of the target operating system to support the Name Service Switch and Pluggable Authentication @@ -729,4 +711,11 @@ configured in the pam.conf. containing this information is corrupted or destroyed.

    • Currently the winbind PAM module does not take into account possible workstation and logon time restrictions that may be been set for Windows NT users, this is - instead up to the PDC to enforce.

    Prev Up Next
    Chapter 20. Stackable VFS modules Home Chapter 22. Advanced Network Management
    + instead up to the PDC to enforce.

    NSCD Problem Warning

    Note

    + Do NOT under ANY circumstances run nscd on any system + on which winbind is running. +

    + If nscd is running on the UNIX/Linux system, then + even though NSSWITCH is correctly configured it will NOT be possible to resolve + domain users and groups for file and directory controls. +

    Prev Up Next
    Chapter 20. Stackable VFS modules Home Chapter 22. Advanced Network Management
    diff --git a/docs/htmldocs/winbindd.8.html b/docs/htmldocs/winbindd.8.html index c1a64d6a00..7b2d6e0261 100644 --- a/docs/htmldocs/winbindd.8.html +++ b/docs/htmldocs/winbindd.8.html @@ -1,5 +1,5 @@ winbindd

    Name

    winbindd — Name Service Switch daemon for resolving names - from NT servers

    Synopsis

    winbindd [-F] [-S] [-i] [-B] [-d <debug level>] [-s <smb config file>] [-n]

    DESCRIPTION

    This program is part of the Samba(7) suite.

    winbindd is a daemon that provides + from NT servers

    Synopsis

    winbindd [-F] [-S] [-i] [-Y] [-d <debug level>] [-s <smb config file>] [-n]

    DESCRIPTION

    This program is part of the Samba(7) suite.

    winbindd is a daemon that provides a service for the Name Service Switch capability that is present in most modern C libraries. The Name Service Switch allows user and system information to be obtained from different databases @@ -55,8 +55,7 @@ configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is -to provide. See -smb.conf(5) for more information. +to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

    -d|--debug=debuglevel

    debuglevel is an integer from 0 to 10. The default value if this parameter is @@ -70,10 +69,9 @@ amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log -level parameter in the -smb.conf(5) file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +override the log level parameter +in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension +".client" will be appended. The log file is never removed by the client.

    -h|--help

    Print a summary of command line options.

    -i

    Tells winbindd to not @@ -88,11 +86,10 @@ never removed by the client. slower. The results will however be more accurate, since results from the cache might not be up-to-date. This might also temporarily hang winbindd if the DC doesn't respond. -

    -B

    Dual daemon mode. This means winbindd will run - as 2 threads. The first will answer all requests from the cache, - thus making responses to clients faster. The other will - update the cache for the query that the first has just responded. - Advantage of this is that responses stay accurate and are faster. +

    -Y

    Single daemon mode. This means winbindd will run + as a single process (the mode of operation in Samba 2.2). Winbindd's + default behavior is to launch a child process that is responsible for + updating expired cache entries.

    NAME AND ID RESOLUTION

    Users and groups on a Windows NT server are assigned a relative id (rid) which is unique for the domain when the user or group is created. To convert the Windows NT user or group @@ -110,16 +107,16 @@ never removed by the client. determine which user and group ids correspond to Windows NT user and group rids.

    CONFIGURATION

    Configuration of the winbindd daemon is done through configuration parameters in the smb.conf(5) file. All parameters should be specified in the - [global] section of smb.conf.

    EXAMPLE SETUP

    To setup winbindd for user and group lookups plus + [global] section of smb.conf.

    EXAMPLE SETUP

    To setup winbindd for user and group lookups plus authentication from a domain controller use something like the following setup. This was tested on a RedHat 6.2 Linux box.

    In /etc/nsswitch.conf put the following: @@ -138,7 +135,7 @@ auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok

    The next step is to join the domain. To do that use the net program like this:

    net join -S PDC -U Administrator

    The username after the -U can be any Domain user that has administrator privileges on the machine. - Substitute the name or IP of your PDC for "PDC".

    Next copy libnss_winbind.so to + Substitute the name or IP of your PDC for "PDC".

    Next copy libnss_winbind.so to /lib and pam_winbind.so to /lib/security. A symbolic link needs to be made from /lib/libnss_winbind.so to @@ -152,8 +149,8 @@ auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok winbind cache time = 10 template shell = /bin/bash template homedir = /home/%D/%U - winbind uid = 10000-20000 - winbind gid = 10000-20000 + idmap uid = 10000-20000 + idmap gid = 10000-20000 workgroup = DOMAIN security = domain password server = * @@ -179,7 +176,7 @@ auth required /lib/security/pam_pwdb.so use_first_pass shadow nullok apply any parameter changes to the running version of winbindd. This signal also clears any cached user and group information. The list of other domains trusted - by winbindd is also reloaded.

    SIGUSR1

    The SIGUSR1 signal will cause + by winbindd is also reloaded.

    SIGUSR2

    The SIGUSR2 signal will cause winbindd to write status information to the winbind log file including information about the number of user and group ids allocated by winbindd.

    Log files are stored in the filename specified by the diff --git a/docs/manpages/Samba.7 b/docs/manpages/Samba.7 index bd0cfa3d48..591e4ca28a 100644 --- a/docs/manpages/Samba.7 +++ b/docs/manpages/Samba.7 @@ -209,7 +209,10 @@ If you have patches to submit, visithttp://devel\&.samba\&.org/ for information .SH "CONTRIBUTORS" .PP -Contributors to the project are now too numerous to mention here but all deserve the thanks of all Samba users\&. To see a full list, look at the\fIchange-log\fR in the source package for the pre-CVS changes and at http://cvs\&.samba\&.org/ for the contributors to Samba post-CVS\&. CVS is the Open Source source code control system used by the Samba Team to develop Samba\&. The project would have been unmanageable without it\&. +Contributors to the project are now too numerous to mention here but all deserve the thanks of all Samba users\&. To see a full list, look at ftp://samba\&.org/pub/samba/alpha/change-log for the pre-CVS changes and at ftp://samba\&.org/pub/samba/alpha/cvs\&.log for the contributors to Samba post-CVS\&. CVS is the Open Source source code control system used by the Samba Team to develop Samba\&. The project would have been unmanageable without it\&. + +.PP +In addition, several commercial organizations now help fund the Samba Team with money and equipment\&. For details see the Samba Web pages at http://samba\&.org/samba/samba-thanks\&.html\&. .SH "AUTHOR" diff --git a/docs/manpages/log2pcap.1 b/docs/manpages/log2pcap.1 new file mode 100644 index 0000000000..60df066260 --- /dev/null +++ b/docs/manpages/log2pcap.1 @@ -0,0 +1,116 @@ +.\"Generated by db2man.xsl. Don't modify this, modify the source. +.de Sh \" Subsection +.br +.if t .Sp +.ne 5 +.PP +\fB\\$1\fR +.PP +.. +.de Sp \" Vertical space (when we can't use .PP) +.if t .sp .5v +.if n .sp +.. +.de Ip \" List item +.br +.ie \\n(.$>=3 .ne \\$3 +.el .ne 3 +.IP "\\$1" \\$2 +.. +.TH "LOG2PCAP" 1 "" "" "" +.SH NAME +log2pcap \- Extract network traces from Samba log files +.SH "SYNOPSIS" + +.nf +\fBlog2pcap\fR [-h] [-q] [logfile] [pcap_file] +.fi + +.SH "DESCRIPTION" + +.PP +This tool is part of the \fBSamba\fR(7) suite\&. + +.PP +\fBlog2pcap\fR reads in a samba log file and generates a pcap file (readable by most sniffers, such as ethereal or tcpdump) based on the packet dumps in the log file\&. + +.PP +The log file must have a \fIlog level\fR of at least \fB5\fR to get the SMB header/parameters right, \fB10\fR to get the first 512 data bytes of the packet and \fB50\fR to get the whole packet\&. + +.SH "OPTIONS" + +.TP +-h +If this parameter is specified the output file will be a hex dump, in a format that is readable by the text2pcap utility\&. + + +.TP +-q +Be quiet\&. No warning messages about missing or incomplete data will be given\&. + + +.TP +logfile +Samba log file\&. log2pcap will try to read the log from stdin if the log file is not specified\&. + + +.TP +pcap_file +Name of the output file to write the pcap (or hexdump) data to\&. If this argument is not specified, output data will be written to stdout\&. + + +.TP +-h|--help +Print a summary of command line options\&. + + +.SH "EXAMPLES" + +.PP +Extract all network traffic from all samba log files: + +.PP + +.nf + + $ cat /var/log/* | log2pcap > trace\&.pcap + .fi + + +.PP +Convert to pcap using text2pcap: + +.PP + +.nf + + $ log2pcap -h samba\&.log | text2pcap -T 139,139 - trace\&.pcap + .fi + + +.SH "VERSION" + +.PP +This man page is correct for version 3\&.0 of the Samba suite\&. + +.SH "BUGS" + +.PP +Only SMB data is extracted from the samba logs, no LDAP, NetBIOS lookup or other data\&. + +.PP +The generated TCP and IP headers don't contain a valid checksum\&. + +.SH "SEE ALSO" + +.PP +\fBtext2pcap\fR(1), \fBethereal\fR(1) + +.SH "AUTHOR" + +.PP +The original Samba software and related utilities were created by Andrew Tridgell\&. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed\&. + +.PP +This manpage was written by Jelmer Vernooij\&. + diff --git a/docs/manpages/mount.cifs.8 b/docs/manpages/mount.cifs.8 new file mode 100644 index 0000000000..9fcabf38a7 --- /dev/null +++ b/docs/manpages/mount.cifs.8 @@ -0,0 +1,186 @@ +.\"Generated by db2man.xsl. Don't modify this, modify the source. +.de Sh \" Subsection +.br +.if t .Sp +.ne 5 +.PP +\fB\\$1\fR +.PP +.. +.de Sp \" Vertical space (when we can't use .PP) +.if t .sp .5v +.if n .sp +.. +.de Ip \" List item +.br +.ie \\n(.$>=3 .ne \\$3 +.el .ne 3 +.IP "\\$1" \\$2 +.. +.TH "MOUNT.CIFS" 8 "" "" "" +.SH NAME +mount.cifs \- mount using the Common Internet File System (CIFS) +.SH "SYNOPSIS" + +.nf +\fBmount.cifs\fR {service} {mount-point} [-o options] +.fi + +.SH "DESCRIPTION" + +.PP +This tool is part of the \fBSamba\fR(7) suite\&. + +.PP +mount\&.cifs mounts a Linux CIFS filesystem\&. It is usually invoked indirectly by the \fBmount\fR(8) command when using the "-t cifs" option\&. This command only works in Linux, and the kernel must support the cifs filesystem\&. The CIFS protocol is the successor to the SMB protocol and is supported by most Windows servers and many other commercial servers and Network Attached Storage appliances as well as by the popular Open Source server Samba\&. + +.PP +The mount\&.cifs utility attaches the UNC name (exported network resource) to the local directory \fBmount-point\fR\&. It is possible to set the mode for mount\&.cifs to setuid root to allow non-root users to mount shares to directories for which they have write permission\&. + +.PP +Options to \fBmount\&.cifs\fR are specified as a comma-separated list of key=value pairs\&. It is possible to send options other than those listed here, assuming that cifs supports them\&. If you get mount failures, check your kernel log for errors on unknown options\&. + +.PP +\fBmount\&.cifs\fR is a daemon\&. After mounting it keeps running until the mounted resource is unmounted (usually via the umount utility) + +.SH "OPTIONS" + +.TP +username=\fIarg\fR +specifies the username to connect as\&. If this is not given, then the environment variable \fBUSER\fR is used\&. This option can also take the form "user%password" or "user/workgroup" or "user/workgroup%password" to allow the password and workgroup to be specified as part of the username\&. + + +.TP +password=\fIarg\fR +specifies the CIFS password\&. If this option is not given then the environment variable \fBPASSWD\fR is used\&. If it can find no password \fBmount\&.cifs\fR will prompt for a passeword, unless the guest option is given\&. + + +Note that password which contain the arguement delimiter character (i\&.e\&. a comma ',') will failed to be parsed correctly on the command line\&. However, the same password defined in the PASSWD environment variable or a credentials file (see below) will be read correctly\&. + + +.TP +credentials=\fIfilename\fR +specifies a file that contains a username and/or password\&. The format of the file is: + + + +.nf + username = value + password = value +.fi +This is preferred over having passwords in plaintext in a shared file, such as \fI/etc/fstab\fR\&. Be sure to protect any credentials file properly\&. + + +.TP +uid=\fIarg\fR +sets the uid that will own all files on the mounted filesystem\&. It may be specified as either a username or a numeric uid\&. This parameter is ignored when the target server supports the CIFS Unix extensions\&. + + +.TP +gid=\fIarg\fR +sets the gid that will own all files on the mounted filesystem\&. It may be specified as either a groupname or a numeric gid\&. This parameter is ignored when the target server supports the CIFS Unix extensions\&. + + +.TP +port=\fIarg\fR +sets the port number on the server to attempt to contact to negotiate CIFS support\&. If the CIFS server is not listening on this port or if it is not specified, the default ports will be tried i\&.e\&. port 445 is tried and if no response then port 139 is tried\&. + + +.TP +file_mode=\fIarg\fR +If the server does not support the CIFS Unix extensions this overrides default file mode which will be used locally\&. + + +.TP +dir_mode=\fIarg\fR +If the server does not support the CIFS Unix extensions this overrides the default mode for directories\&. + + +.TP +ip=\fIarg\fR +sets the destination host or IP address\&. + + +.TP +domain=\fIarg\fR +sets the domain (workgroup) of the user + + +.TP +guest +don't prompt for a password + + +.TP +ro +mount read-only + + +.TP +rw +mount read-write + + +.TP +rsize +default network read size + + +.TP +wsize +default network write size + + +.SH "ENVIRONMENT VARIABLES" + +.PP +The variable \fBUSER\fR may contain the username of the person using the client\&. This information is used only if the protocol level is high enough to support session-level passwords\&. The variable can be used to set both username and password by using the format username%password\&. + +.PP +The variable \fBPASSWD\fR may contain the password of the person using the client\&. This information is used only if the protocol level is high enough to support session-level passwords\&. + +.PP +The variable \fBPASSWD_FILE\fR may contain the pathname of a file to read the password from\&. A single line of input is read and used as the password\&. + +.SH "NOTES" + +.PP +This command may be used only by root\&. + +.SH "CONFIGURATION" + +.PP +The primary mechanism for making configuration changes and for reading debug information for the cifs vfs is via the Linux /proc filesystem\&. In the directory /proc/fs/cifs are various configuration files and pseudo files which can display debug information\&. For more information see the kernel file fs/cifs/README + +.SH "BUGS" + +.PP +Passwords and other options containing , can not be handled\&. For passwords an alternative way of passing them is in a credentials file or in the PASSWD environment\&. + +.PP +The credentials file does not handle usernames or passwords with leading space\&. + +.PP +Note that the typical response to a bug report is suggestion to try the latest version first\&. So please try doing that first, and always include which versions you use of relevant software when reporting bugs (minimum: samba, kernel, distribution) + +.SH "VERSION" + +.PP +This man page is correct for version 3\&.0 of the Samba suite\&. + +.SH "SEE ALSO" + +.PP +Documentation/filesystems/cifs\&.txt and fs/cifs/README in the linux kernel source tree may contain additional options and information\&. + +.SH "AUTHOR" + +.PP +Steve French + +.PP +The syntax and manpage were loosely based on that of smbmount\&. It was converted to Docbook/XML by Jelmer Vernooij\&. + +.PP +The current maintainer of the Linux cifs vfs and the userspace tool \fBmount\&.cifs\fR is Steve French\&. The SAMBA Mailing list is the preferred place to ask questions regarding these programs\&. + diff --git a/docs/manpages/net.8 b/docs/manpages/net.8 index d473503792..70a6090792 100644 --- a/docs/manpages/net.8 +++ b/docs/manpages/net.8 @@ -70,12 +70,12 @@ Port on the target server to connect to (usually 139 or 445)\&. Defaults to tryi .TP -n -This option allows you to override the NetBIOS name that Samba uses for itself\&. This is identical to setting the \fINetBIOS name\fR parameter in the \fBsmb.conf\fR(5) file\&. However, a command line setting will take precedence over settings in \fBsmb.conf\fR(5)\&. +This option allows you to override the NetBIOS name that Samba uses for itself\&. This is identical to setting the \fInetbios name\fR parameter in the \fIsmb\&.conf\fR file\&. However, a command line setting will take precedence over settings in \fIsmb\&.conf\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -104,11 +104,16 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .SH "COMMANDS" +.SS "CHANGESECRETPW" + +.PP +This command allows the Samba machine account password to be set from an external application to a machine account password that has already been stored in Active Directory\&. DO NOT USE this command unless you know exactly what you are doing\&. The use of this command requires that the force flag (-f) be used also\&. There will be NO command prompt\&. Whatever information is piped into stdin, either by typing at the command line or otherwise, will be stored as the literal machine password\&. Do NOT use this without care and attention as it will overwrite a legitimate machine password without warning\&. YOU HAVE BEEN WARNED\&. + .SS "TIME" .PP diff --git a/docs/manpages/nmbd.8 b/docs/manpages/nmbd.8 index 096876bfde..0b63e77ee2 100644 --- a/docs/manpages/nmbd.8 +++ b/docs/manpages/nmbd.8 @@ -89,7 +89,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -103,7 +103,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP @@ -120,7 +120,7 @@ UDP port number is a positive integer value\&. This option changes the default U .TP \fI/etc/inetd\&.conf\fR -If the server is to be run by the \fBinetd\fR meta-daemon, this file must contain suitable startup information for the meta-daemon\&. See the install document for details\&. +If the server is to be run by the \fBinetd\fR meta-daemon, this file must contain suitable startup information for the meta-daemon\&. .TP @@ -128,12 +128,12 @@ If the server is to be run by the \fBinetd\fR meta-daemon, this file must contai or whatever initialization script your system uses)\&. -If running the server as a daemon at startup, this file will need to contain an appropriate startup sequence for the server\&. See the "How to Install and Test SAMBA" document for details\&. +If running the server as a daemon at startup, this file will need to contain an appropriate startup sequence for the server\&. .TP \fI/etc/services\fR -If running the server via the meta-daemon \fBinetd\fR, this file must contain a mapping of service name (e\&.g\&., netbios-ssn) to service port (e\&.g\&., 139) and protocol type (e\&.g\&., tcp)\&. See the "How to Install and Test SAMBA" document for details\&. +If running the server via the meta-daemon \fBinetd\fR, this file must contain a mapping of service name (e\&.g\&., netbios-ssn) to service port (e\&.g\&., 139) and protocol type (e\&.g\&., tcp)\&. .TP @@ -141,10 +141,10 @@ If running the server via the meta-daemon \fBinetd\fR, this file must contain a This is the default location of the \fBsmb.conf\fR(5) server configuration file\&. Other common places that systems install this file are \fI/usr/samba/lib/smb\&.conf\fR and \fI/etc/samba/smb\&.conf\fR\&. -When run as a WINS server (see the \fBwins support\fR parameter in the \fBsmb.conf\fR(5) man page), \fBnmbd\fR will store the WINS database in the file \fIwins\&.dat\fR in the \fIvar/locks\fR directory configured under wherever Samba was configured to install itself\&. +When run as a WINS server (see the \fIwins support\fR parameter in the \fBsmb.conf\fR(5) man page), \fBnmbd\fR will store the WINS database in the file \fIwins\&.dat\fR in the \fIvar/locks\fR directory configured under wherever Samba was configured to install itself\&. -If \fBnmbd\fR is acting as a \fB browse master\fR (see the \fBlocal master\fR parameter in the \fBsmb.conf\fR(5) man page, \fBnmbd\fR will store the browsing database in the file \fIbrowse\&.dat \fR in the \fIvar/locks\fR directory configured under wherever Samba was configured to install itself\&. +If \fBnmbd\fR is acting as a \fB browse master\fR (see the \fIlocal master\fR parameter in the \fBsmb.conf\fR(5) man page, \fBnmbd\fR will store the browsing database in the file \fIbrowse\&.dat \fR in the \fIvar/locks\fR directory configured under wherever Samba was configured to install itself\&. .SH "SIGNALS" diff --git a/docs/manpages/nmblookup.1 b/docs/manpages/nmblookup.1 index 2f16025593..5cc590ae11 100644 --- a/docs/manpages/nmblookup.1 +++ b/docs/manpages/nmblookup.1 @@ -65,7 +65,7 @@ Interpret \fIname\fR as an IP Address and do a node status query on this address .TP -n -This option allows you to override the NetBIOS name that Samba uses for itself\&. This is identical to setting the \fINetBIOS name\fR parameter in the \fBsmb.conf\fR(5) file\&. However, a command line setting will take precedence over settings in \fBsmb.conf\fR(5)\&. +This option allows you to override the NetBIOS name that Samba uses for itself\&. This is identical to setting the \fInetbios name\fR parameter in the \fIsmb\&.conf\fR file\&. However, a command line setting will take precedence over settings in \fIsmb\&.conf\fR\&. .TP @@ -80,7 +80,7 @@ Set the SMB domain of the username\&. This overrides the default domain which is .TP -O socket options -TCP socket options to set on the client socket\&. See the socket options parameter in the \fBsmb.conf\fR(5) manual page for the list of valid options\&. +TCP socket options to set on the client socket\&. See the socket options parameter in the \fIsmb\&.conf\fR manual page for the list of valid options\&. .TP @@ -105,7 +105,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -119,7 +119,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP diff --git a/docs/manpages/ntlm_auth.1 b/docs/manpages/ntlm_auth.1 index 082d9422c8..e234ad7fb8 100644 --- a/docs/manpages/ntlm_auth.1 +++ b/docs/manpages/ntlm_auth.1 @@ -93,7 +93,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -107,7 +107,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP diff --git a/docs/manpages/pdbedit.8 b/docs/manpages/pdbedit.8 index ff0fc1244b..75a655a7e7 100644 --- a/docs/manpages/pdbedit.8 +++ b/docs/manpages/pdbedit.8 @@ -24,9 +24,9 @@ pdbedit \- manage the SAM database .nf \fBpdbedit\fR [-L] [-v] [-w] [-u username] [-f fullname] [-h homedir] [-D drive] [-S - script] [-p profile] [-a] [-m] [-x] [-i passdb-backend] [-e passdb-backend] + script] [-p profile] [-a] [-m] [-r] [-x] [-i passdb-backend] [-e passdb-backend] [-b passdb-backend] [-g] [-d debuglevel] [-s configfile] [-P account-policy] - [-C value] + [-C value] [-c account-control] .fi .SH "DESCRIPTION" @@ -287,7 +287,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -301,7 +301,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP diff --git a/docs/manpages/rpcclient.1 b/docs/manpages/rpcclient.1 index 34cb6a1fa5..0684d74197 100644 --- a/docs/manpages/rpcclient.1 +++ b/docs/manpages/rpcclient.1 @@ -66,7 +66,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -80,7 +80,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP @@ -133,7 +133,7 @@ Be cautious about including passwords in scripts\&. Also, on many systems the co .TP -n -This option allows you to override the NetBIOS name that Samba uses for itself\&. This is identical to setting the \fINetBIOS name\fR parameter in the \fBsmb.conf\fR(5) file\&. However, a command line setting will take precedence over settings in \fBsmb.conf\fR(5)\&. +This option allows you to override the NetBIOS name that Samba uses for itself\&. This is identical to setting the \fInetbios name\fR parameter in the \fIsmb\&.conf\fR file\&. However, a command line setting will take precedence over settings in \fIsmb\&.conf\fR\&. .TP @@ -148,7 +148,7 @@ Set the SMB domain of the username\&. This overrides the default domain which is .TP -O socket options -TCP socket options to set on the client socket\&. See the socket options parameter in the \fBsmb.conf\fR(5) manual page for the list of valid options\&. +TCP socket options to set on the client socket\&. See the socket options parameter in the \fIsmb\&.conf\fR manual page for the list of valid options\&. .TP diff --git a/docs/manpages/samba.7 b/docs/manpages/samba.7 index 50665c700b..3fddca285d 100644 --- a/docs/manpages/samba.7 +++ b/docs/manpages/samba.7 @@ -151,6 +151,11 @@ The \fBnet\fR command is supposed to work similar to the DOS/Windows NET\&.EXE c \fBprofiles\fR is a command-line utility that can be used to replace all occurences of a certain SID with another SID\&. +.TP +\fBlog2pcap\fR(1) +\fBlog2pcap\fR is a utility for generating pcap trace files from Samba log files\&. + + .TP \fBvfstest\fR(1) \fBvfstest\fR is a utility that can be used to test vfs modules\&. diff --git a/docs/manpages/smb.conf.5 b/docs/manpages/smb.conf.5 index 3e0bc555ea..55fdc8be44 100644 --- a/docs/manpages/smb.conf.5 +++ b/docs/manpages/smb.conf.5 @@ -498,6 +498,26 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIchange share command\fR +.TP +\(bu +\fIclient lanman auth\fR + +.TP +\(bu +\fIclient ntlmv2 auth\fR + +.TP +\(bu +\fIclient plaintext auth\fR + +.TP +\(bu +\fIclient schannel\fR + +.TP +\(bu +\fIclient signing\fR + .TP \(bu \fIclient use spnego\fR @@ -508,7 +528,7 @@ Here is a list of all global parameters\&. See the section of each parameter for .TP \(bu -\fIdead time\fR +\fIdeadtime\fR .TP \(bu @@ -516,7 +536,7 @@ Here is a list of all global parameters\&. See the section of each parameter for .TP \(bu -\fIdebug level\fR +\fIdebuglevel\fR .TP \(bu @@ -590,6 +610,10 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIdos charset\fR +.TP +\(bu +\fIenable rid algorithm\fR + .TP \(bu \fIencrypt passwords\fR @@ -602,6 +626,10 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIenumports command\fR +.TP +\(bu +\fIget quota command\fR + .TP \(bu \fIgetwd cache\fR @@ -630,6 +658,10 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIhosts equiv\fR +.TP +\(bu +\fIidmap backend\fR + .TP \(bu \fIidmap gid\fR @@ -650,6 +682,10 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIkeepalive\fR +.TP +\(bu +\fIkernel change notify\fR + .TP \(bu \fIkernel oplocks\fR @@ -674,6 +710,14 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIldap filter\fR +.TP +\(bu +\fIldap group suffix\fR + +.TP +\(bu +\fIldap idmap suffix\fR + .TP \(bu \fIldap machine suffix\fR @@ -698,10 +742,6 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIldap suffix\fR -.TP -\(bu -\fIldap trust ids\fR - .TP \(bu \fIldap user suffix\fR @@ -772,11 +812,11 @@ Here is a list of all global parameters\&. See the section of each parameter for .TP \(bu -\fImangling stack\fR +\fImangled stack\fR .TP \(bu -\fImangling prefix\fR +\fImangle prefix\fR .TP \(bu @@ -866,10 +906,6 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fInis homedir\fR -.TP -\(bu -\fInon unix account range\fR - .TP \(bu \fIntlm auth\fR @@ -1018,6 +1054,10 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIserver schannel\fR +.TP +\(bu +\fIserver signing\fR + .TP \(bu \fIserver string\fR @@ -1026,6 +1066,10 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIset primary group script\fR +.TP +\(bu +\fIset quota command\fR + .TP \(bu \fIshow add printer wizard\fR @@ -1058,10 +1102,6 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIstat cache\fR -.TP -\(bu -\fIstat cache size\fR - .TP \(bu \fIstrip dot\fR @@ -1078,6 +1118,10 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fItemplate homedir\fR +.TP +\(bu +\fItemplate primary group\fR + .TP \(bu \fItemplate shell\fR @@ -1094,10 +1138,6 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fItimestamp logs\fR -.TP -\(bu -\fItotal print jobs\fR - .TP \(bu \fIunicode\fR @@ -1146,6 +1186,10 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIwinbind cache time\fR +.TP +\(bu +\fIwinbind enable local accounts\fR + .TP \(bu \fIwinbind enum groups\fR @@ -1162,13 +1206,17 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIwinbind separator\fR +.TP +\(bu +\fIwinbind trusted domains only\fR + .TP \(bu \fIwinbind uid\fR .TP \(bu -\fIwinbind used default domain\fR +\fIwinbind use default domain\fR .TP \(bu @@ -1176,7 +1224,7 @@ Here is a list of all global parameters\&. See the section of each parameter for .TP \(bu -\fIwins partner\fR +\fIwins partners\fR .TP \(bu @@ -1211,6 +1259,10 @@ Here is a list of all service parameters\&. See the section on each parameter fo .TP 3 \(bu +\fIacl compatibility\fR + +.TP +\(bu \fIadmin users\fR .TP @@ -1581,6 +1633,10 @@ Here is a list of all service parameters\&. See the section on each parameter fo \(bu \fIprint ok\fR +.TP +\(bu +\fIprofile acls\fR + .TP \(bu \fIpublic\fR @@ -1735,6 +1791,17 @@ Default: \fBNone\fR\&. Example: \fBabort shutdown script = /sbin/shutdown -c\fR +.TP +acl compatibility (S) +This parameter specifies what OS ACL semantics should be compatible with\&. Possible values are \fBwinnt\fR for Windows NT 4, \fBwin2k\fR for Windows 2000 and above and \fBauto\fR\&. If you specify \fBauto\fR, the value for this parameter will be based upon the version of the client\&. There should be no reason to change this parameter from the default\&. + + +Default: \fBacl compatibility = Auto\fR + + +Example: \fBacl compatibility = win2k\fR + + .TP add group script (G) This is the full pathname to a script that will be run \fBAS ROOT\fR by \fBsmbd\fR(8) when a new group is requested\&. It will expand any \fI%g\fR to the group name passed\&. This script is only useful for installations using the Windows NT domain administration tools\&. The script is free to create a group with an arbitrary name to circumvent unix group name restrictions\&. In that case the script must print the numeric gid of the created group on stdout\&. @@ -2083,9 +2150,73 @@ Default: \fBnone\fR Example: \fBchange share command = /usr/local/bin/addshare\fR +.TP +client lanman auth (G) +This parameter determines whether or not \fBsmbclient\fR(8) and other samba client tools will attempt to authenticate itself to servers using the weaker LANMAN password hash\&. If disabled, only server which support NT password hashes (e\&.g\&. Windows NT/2000, Samba, etc\&.\&.\&. but not Windows 95/98) will be able to be connected from the Samba client\&. + + +The LANMAN encrypted response is easily broken, due to it's case-insensitive nature, and the choice of algorithm\&. Clients without Windows 95/98 servers are advised to disable this option\&. + + +Disabling this option will also disable the \fBclient plaintext auth\fR option + + +Likewise, if the \fBclient ntlmv2 auth\fR parameter is enabled, then only NTLMv2 logins will be attempted\&. Not all servers support NTLMv2, and most will require special configuration to us it\&. + + +Default : \fBclient lanman auth = yes\fR + + +.TP +client ntlmv2 auth (G) +This parameter determines whether or not \fBsmbclient\fR(8) will attempt to authenticate itself to servers using the NTLMv2 encrypted password response\&. + + +If enabled, only an NTLMv2 and LMv2 response (both much more secure than earlier versions) will be sent\&. Many servers (including NT4 < SP4, Win9x and Samba 2\&.2) are not compatible with NTLMv2\&. + + +If disabled, an NTLM response (and possibly a LANMAN response) will be sent by the client, depending on the value of \fBclient lanman auth\fR\&. + + +Note that some sites (particularly those following 'best practice' security polices) only allow NTLMv2 responses, and not the weaker LM or NTLM\&. + + +Default : \fBclient ntlmv2 auth = no\fR + + +.TP +client plaintext auth (G) +Specifies whether a client should send a plaintext password if the server does not support encrypted passwords\&. + + +Default: \fBclient plaintext auth = yes\fR + + +.TP +client schannel (G) +This controls whether the client offers or even demands the use of the netlogon schannel\&. \fIclient schannel = no\fR does not offer the schannel, \fIserver schannel = auto\fR offers the schannel but does not enforce it, and \fIserver schannel = yes\fR denies access if the server is not able to speak netlogon schannel\&. + + +Default: \fBclient schannel = auto\fR + + +Example: \fBclient schannel = yes\fR + + +.TP +client signing (G) +This controls whether the client offers or requires the server it talks to to use SMB signing\&. Possible values are \fBauto\fR, \fBmandatory\fR and \fBdisabled\fR\&. + + +When set to auto, SMB signing is offered, but not enforced\&. When set to mandatory, SMB signing is required and if set to disabled, SMB signing is not offered either\&. + + +Default: \fBclient signing = auto\fR + + .TP client use spnego (G) -This variable controls controls whether samba clients will try to use Simple and Protected NEGOciation (as specified by rfc2478) with WindowsXP and Windows2000 servers to agree upon an authentication mechanism\&. SPNEGO client support with Sign and Seal is currently broken, so you might want to turn this option off when doing joins to Windows 2003 domains\&. +This variable controls controls whether samba clients will try to use Simple and Protected NEGOciation (as specified by rfc2478) with WindowsXP and Windows2000 servers to agree upon an authentication mechanism\&. SPNEGO client support for SMB Signing is currently broken, so you might want to turn this option off when operating with Windows 2003 domain controllers in particular\&. Default: \fBclient use spnego = yes\fR @@ -2188,7 +2319,7 @@ Example: \fBcsc policy = programs\fR .TP -dead time (G) +deadtime (G) The value of the parameter (a decimal integer) represents the number of minutes of inactivity before a connection is considered dead, and it is disconnected\&. The deadtime only takes effect if the number of open files is zero\&. @@ -2222,7 +2353,7 @@ Default: \fBdebug hires timestamp = no\fR .TP -debug level (G) +debuglevel (G) Synonym for \fI log level\fR\&. @@ -2660,6 +2791,14 @@ Under DOS and Windows, if a user can write to a file they can change the timesta Default: \fBdos filetimes = no\fR +.TP +enable rid algorithm (G) +This option is used to control whether or not smbd in Samba 3\&.0 should fallback to the algorithm used by Samba 2\&.2 to generate user and group RIDs\&. The longterm development goal is to remove the algorithmic mappings of RIDs altogether, but this has proved to be difficult\&. This parameter is mainly provided so that developers can turn the algorithm on and off and see what breaks\&. This parameter should not be disabled by non-developers because certain features in Samba will fail to work without it\&. + + +Default: \fBenable rid algorithm = \fR + + .TP encrypt passwords (G) This boolean controls whether encrypted passwords will be negotiated with the client\&. Note that Windows NT 4\&.0 SP3 and above and also Windows 98 will by default expect encrypted passwords unless a registry entry is changed\&. To use encrypted passwords in Samba see the chapter "User Database" in the Samba HOWTO Collection\&. @@ -2883,6 +3022,62 @@ Default: \fBfstype = NTFS\fR Example: \fBfstype = Samba\fR +.TP +get quota command (G) +The \fBget quota command\fR should only be used whenever there is no operating system API available from the OS that samba can use\&. + + +This parameter should specify the path to a script that queries the quota information for the specified user/group for the partition that the specified directory is on\&. + + +Such a script should take 3 arguments: + + +directory + +type of query + +uid of user or gid of group + +The type of query can be one of : + + +1 - user quotas + +2 - user default quotas (uid = -1) + +3 - group quotas + +4 - group default quotas (gid = -1) + +This script should print its output according to the following format: + + +Line 1 - quota flags (0 = no quotas, 1 = quotas enabled, 2 = quotas enabled and enforced) + +Line 2 - number of currently used blocks + +Line 3 - the softlimit number of blocks + +Line 4 - the hardlimit number of blocks + +Line 5 - currently used number of inodes + +Line 6 - the softlimit number of inodes + +Line 7 - the hardlimit number of inodes + +Line 8(optional) - the number of bytes in a block(default is 1024) + +See also the \fIset quota command\fR parameter\&. + + +Default: \fBget quota command = \fR + + +Example: \fBget quota command = /usr/local/sbin/query_quota\fR + + .TP getwd cache (G) This is a tuning option\&. When this is enabled a caching algorithm will be used to reduce the time taken for getwd() calls\&. This can have a significant impact on performance, especially when the \fIwide links\fR parameter is set to \fBno\fR\&. @@ -3034,7 +3229,7 @@ host msdfs (G) This boolean parameter is only available if Samba has been configured and compiled with the \fB --with-msdfs\fR option\&. If set to \fByes\fR, Samba will act as a Dfs server, and allow Dfs-aware clients to browse Dfs trees hosted on the server\&. -See also the \fI msdfs root\fR share level parameter\&. For more information on setting up a Dfs tree on Samba, refer to msdfs_setup\&.html\&. +See also the \fI msdfs root\fR share level parameter\&. For more information on setting up a Dfs tree on Samba, refer to ???\&. Default: \fBhost msdfs = no\fR @@ -3136,6 +3331,17 @@ Default: \fBno host equivalences\fR Example: \fBhosts equiv = /etc/hosts.equiv\fR +.TP +idmap backend (G) +The purpose of the idmap backend parameter is to allow idmap to NOT use the local idmap tdb file to obtain SID to UID / GID mappings, but instead to obtain them from a common LDAP backend\&. This way all domain members and controllers will have the same UID and GID to SID mappings\&. This avoids the risk of UID / GID inconsistencies across UNIX / Linux systems that are sharing information over protocols other than SMB/CIFS (ie: NFS)\&. + + +Default: \fBidmap backend = \fR + + +Example: \fBidmap backend = ldap:ldap://ldapslave.example.com\fR + + .TP idmap gid (G) The idmap gid parameter specifies the range of group ids that are allocated for the purpose of mapping UNX groups to NT group SIDs\&. This range of group ids should have no existing local or NIS groups within it as strange conflicts can occur otherwise\&. @@ -3280,6 +3486,17 @@ Default: \fBkeepalive = 300\fR Example: \fBkeepalive = 600\fR +.TP +kernel change notify (G) +This parameter specifies whether Samba should ask the kernel for change notifications in directories so that SMB clients can refresh whenever the data on the server changes\&. + + +This parameter is only usd when your kernel supports change notification to user programs, using the F_NOTIFY fcntl\&. + + +Default: \fBYes\fR + + .TP kernel oplocks (G) For UNIXes that support kernel based \fIoplocks\fR (currently only IRIX and the Linux 2\&.4 kernel), this parameter allows the use of them to be turned on or off\&. @@ -3343,6 +3560,28 @@ This parameter specifies the RFC 2254 compliant LDAP search filter\&. The defaul Default: \fBldap filter = (&(uid=%u)(objectclass=sambaAccount))\fR +.TP +ldap group suffix (G) +This parameters specifies the suffix that is used for groups when these are added to the LDAP directory\&. If this parameter is unset, the value of \fIldap suffix\fR will be used instead\&. + + +Default: \fBnone\fR + + +Example: \fBdc=samba,ou=Groups\fR + + +.TP +ldap idmap suffix (G) +This parameters specifies the suffix that is used when storing idmap mappings\&. If this parameter is unset, the value of \fIldap suffix\fR will be used instead\&. + + +Default: \fBnone\fR + + +Example: \fBdc=samba,ou=Idmap\fR + + .TP ldap machine suffix (G) It specifies where machines should be added to the ldap tree\&. @@ -3421,20 +3660,9 @@ Specifies where user and machine accounts are added to the tree\&. Can be overri Default: \fBnone\fR -.TP -ldap trust ids (G) -Normally, Samba validates each entry in the LDAP server against getpwnam()\&. This allows LDAP to be used for Samba with the unix system using NIS (for example) and also ensures that Samba does not present accounts that do not otherwise exist\&. - - -This option is used to disable this functionality, and instead to rely on the presence of the appropriate attributes in LDAP directly, which can result in a significant performance boost in some situations\&. Setting this option to yes effectivly assumes that the local machine is running \fBnss_ldap\fR against the same LDAP server\&. - - -Default: \fBldap trust ids = No\fR - - .TP ldap user suffix (G) -It specifies where users are added to the tree\&. +This parameter specifies where users are added to the tree\&. If this parameter is not specified, the value from \fBldap suffix\fR\&. Default: \fBnone\fR @@ -3554,7 +3782,7 @@ lock spin count (G) This parameter controls the number of times that smbd should attempt to gain a byte range lock on the behalf of a client request\&. Experiments have shown that Windows 2k servers do not reply with a failure if the lock could not be immediately granted, but try a few more times in case the lock could later be aquired\&. This behavior is used to support PC database formats such as MS Access and FoxPro\&. -Default: \fBlock spin count = 2\fR +Default: \fBlock spin count = 3\fR .TP @@ -3676,8 +3904,14 @@ The script must be a relative path to the [netlogon] service\&. If the [netlogon \fI/usr/local/samba/netlogon/STARTUP\&.BAT\fR -The contents of the batch file are entirely your choice\&. A suggested command would be to add \fBNET TIME \\SERVER /SET /YES\fR, to force every machine to synchronize clocks with the same time server\&. Another use would be to add \fBNET USE U: \\SERVER\UTILS\fR for commonly used utilities, or \fB NET USE Q: \\SERVER\ISO9001_QA\fR for example\&. +The contents of the batch file are entirely your choice\&. A + suggested command would be to add \fBNET TIME \\SERVER /SET + /YES\fR, to force every machine to synchronize clocks with + the same time server\&. Another use would be to add \fBNET USE + U: \\SERVER\UTILS\fR for commonly used utilities, or .nf + \fBNET USE Q: \\\\SERVER\\ISO9001_QA\fR.fi + for example\&. Note that it is particularly important not to allow write access to the [netlogon] share, or to grant users write permission on the batch files in a secure environment, as this would allow the batch files to be arbitrarily modified and security to be breached\&. @@ -3838,7 +4072,7 @@ Example 2: \fBlprm command = /usr/bin/cancel %p-%j\fR .TP machine password timeout (G) -If a Samba server is a member of a Windows NT Domain (see the security = domain) parameter) then periodically a running smbd(8) process will try and change the MACHINE ACCOUNT PASSWORD stored in the TDB called \fIprivate/secrets\&.tdb \fR\&. This parameter specifies how often this password will be changed, in seconds\&. The default is one week (expressed in seconds), the same as a Windows NT Domain member server\&. +If a Samba server is a member of a Windows NT Domain (see the security = domain) parameter) then periodically a running smbd process will try and change the MACHINE ACCOUNT PASSWORD stored in the TDB called \fIprivate/secrets\&.tdb \fR\&. This parameter specifies how often this password will be changed, in seconds\&. The default is one week (expressed in seconds), the same as a Windows NT Domain member server\&. See also \fBsmbpasswd\fR(8), and the security = domain) parameter\&. @@ -3947,7 +4181,7 @@ Default: \fBmangled names = yes\fR .TP -mangling stack (G) +mangled stack (G) This parameter controls the number of mangled names that should be cached in the Samba server \fBsmbd\fR(8)\&. @@ -3967,10 +4201,13 @@ Example: \fBmangled stack = 100\fR .TP -mangling prefix (G) +mangle prefix (G) controls the number of prefix characters from the original name used when generating the mangled names\&. A larger value will give a weaker hash and therefore more name collisions\&. The minimum value is 1 and the maximum value is 6\&. +mangle prefix is effective only when mangling method is hash2\&. + + Default: \fBmangle prefix = 1\fR @@ -3979,7 +4216,7 @@ Example: \fBmangle prefix = 4\fR .TP mangling char (S) -This controls what character is used as the \fBmagic\fR character in name mangling\&. The default is a '~' but this may interfere with some software\&. Use this option to set it to whatever you prefer\&. +This controls what character is used as the \fBmagic\fR character in name mangling\&. The default is a '~' but this may interfere with some software\&. Use this option to set it to whatever you prefer\&. This is effective only when mangling method is hash\&. Default: \fBmangling char = ~\fR @@ -4347,7 +4584,7 @@ Example: \fBmsdfs proxy = \\\\otherserver\\someshare\fR .TP msdfs root (S) -This boolean parameter is only available if Samba is configured and compiled with the \fB --with-msdfs\fR option\&. If set to \fByes\fR, Samba treats the share as a Dfs root and allows clients to browse the distributed file system tree rooted at the share directory\&. Dfs links are specified in the share directory by symbolic links of the form \fImsdfs:serverA\\\\shareA,serverB\\\\shareB\fR and so on\&. For more information on setting up a Dfs tree on Samba, refer to "Hosting a Microsoft Distributed File System tree on Samba" document\&. +This boolean parameter is only available if Samba is configured and compiled with the \fB --with-msdfs\fR option\&. If set to \fByes\fR, Samba treats the share as a Dfs root and allows clients to browse the distributed file system tree rooted at the share directory\&. Dfs links are specified in the share directory by symbolic links of the form \fImsdfs:serverA\\\\shareA,serverB\\\\shareB\fR and so on\&. For more information on setting up a Dfs tree on Samba, refer to ???\&. See also \fIhost msdfs\fR @@ -4403,7 +4640,7 @@ DC lookups will still be done via DNS, but fallbacks to netbios names will not i .TP netbios aliases (G) -This is a list of NetBIOS names that nmbd(8) will advertise as additional names by which the Samba server is known\&. This allows one machine to appear in browse lists under multiple names\&. If a machine is acting as a browse server or logon server none of these names will be advertised as either browse server or logon servers, only the primary name of the machine will be advertised with these capabilities\&. +This is a list of NetBIOS names that nmbd will advertise as additional names by which the Samba server is known\&. This allows one machine to appear in browse lists under multiple names\&. If a machine is acting as a browse server or logon server none of these names will be advertised as either browse server or logon servers, only the primary name of the machine will be advertised with these capabilities\&. See also \fInetbios name\fR\&. @@ -4451,19 +4688,6 @@ Note that for this option to work there must be a working NIS system and the Sam Default: \fBnis homedir = no\fR -.TP -non unix account range (G) -The non unix account range parameter specifies the range of 'user ids' that are allocated by the various 'non unix account' passdb backends\&. These backends allow the storage of passwords for users who don't exist in /etc/passwd\&. This is most often used for machine account creation\&. This range of ids should have no existing local or NIS users within it as strange conflicts can occur otherwise\&. - - -These userids never appear on the system and Samba will never 'become' these users\&. They are used only to ensure that the algorithmic RID mapping does not conflict with normal users\&. - -Default: \fBnon unix account range = \fR - - -Example: \fBnon unix account range = 10000-20000\fR - - .TP nt acl support (S) This boolean parameter controls whether \fBsmbd\fR(8) will attempt to map UNIX permissions into Windows NT access control lists\&. This parameter was formally a global parameter in releases prior to 2\&.2\&.2\&. @@ -4590,7 +4814,7 @@ The parameter is used to define the absolute path to a file containing a mapping For example, a valid entry using the HP LaserJet 5 printer driver would appear as \fBHP LaserJet 5L = LASERJET.HP LaserJet 5L\fR\&. -The need for the file is due to the printer driver namespace problem described in the Samba Printing HOWTO\&. For more details on OS/2 clients, please refer to the OS2-Client-HOWTO containing in the Samba documentation\&. +The need for the file is due to the printer driver namespace problem described in ???\&. For more details on OS/2 clients, please refer to ???\&. Default: \fBos2 driver map = \fR @@ -4648,19 +4872,19 @@ This option allows the administrator to chose which backends to retrieve and sto This parameter is in two parts, the backend's name, and a 'location' string that has meaning only to that particular backed\&. These are separated by a : character\&. -Available backends can include: .TP 3 \(bu \fBsmbpasswd\fR - The default smbpasswd backend\&. Takes a path to the smbpasswd file as an optional argument\&. .TP \(bu \fBtdbsam\fR - The TDB based password storage backend\&. Takes a path to the TDB as an optional argument (defaults to passdb\&.tdb in the \fIprivate dir\fR directory\&. .TP \(bu \fBldapsam\fR - The LDAP based passdb backend\&. Takes an LDAP URL as an optional argument (defaults to \fBldap://localhost\fR) LDAP connections should be secured where possible\&. This may be done using either Start-TLS (see \fIldap ssl\fR) or by specifying \fIldaps://\fR in the URL argument\&. .TP \(bu \fBnisplussam\fR - The NIS+ based passdb backend\&. Takes name NIS domain as an optional argument\&. Only works with sun NIS+ servers\&. .TP \(bu \fBmysql\fR - The MySQL based passdb backend\&. Takes an identifier as argument\&. Read the Samba HOWTO Collection for configuration details\&. .TP \(bu \fBguest\fR - Very simple backend that only provides one user: the guest user\&. Only maps the NT guest user to the \fIguest account\fR\&. Required in pretty much all situations\&. .LP +Available backends can include: .TP 3 \(bu \fBsmbpasswd\fR - The default smbpasswd backend\&. Takes a path to the smbpasswd file as an optional argument\&. .TP \(bu \fBtdbsam\fR - The TDB based password storage backend\&. Takes a path to the TDB as an optional argument (defaults to passdb\&.tdb in the \fIprivate dir\fR directory\&. .TP \(bu \fBldapsam\fR - The LDAP based passdb backend\&. Takes an LDAP URL as an optional argument (defaults to \fBldap://localhost\fR) LDAP connections should be secured where possible\&. This may be done using either Start-TLS (see \fIldap ssl\fR) or by specifying \fIldaps://\fR in the URL argument\&. .TP \(bu \fBnisplussam\fR - The NIS+ based passdb backend\&. Takes name NIS domain as an optional argument\&. Only works with sun NIS+ servers\&. .TP \(bu \fBmysql\fR - The MySQL based passdb backend\&. Takes an identifier as argument\&. Read the Samba HOWTO Collection for configuration details\&. .LP Default: \fBpassdb backend = smbpasswd\fR -Example: \fBpassdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd guest\fR +Example: \fBpassdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd\fR -Example: \fBpassdb backend = ldapsam:ldaps://ldap.example.com guest\fR +Example: \fBpassdb backend = ldapsam:ldaps://ldap.example.com\fR -Example: \fBpassdb backend = mysql:my_plugin_args tdbsam:/etc/samba/private/passdb.tdb guest\fR +Example: \fBpassdb backend = mysql:my_plugin_args tdbsam\fR .TP @@ -4711,7 +4935,7 @@ The name of a program that can be used to set UNIX user passwords\&. Any occurre Also note that many passwd programs insist in \fBreasonable \fR passwords, such as a minimum length, or the inclusion of mixed case chars and digits\&. This can pose a problem as some clients (such as Windows for Workgroups) uppercase the password before sending it\&. -\fBNote\fR that if the \fIunix password sync\fR parameter is set to \fByes \fR then this program is called \fBAS ROOT\fR before the SMB password in the \fBsmbpasswd\fR(5) file is changed\&. If this UNIX password change fails, then \fBsmbd\fR will fail to change the SMB password also (this is by design)\&. +\fBNote\fR that if the \fIunix password sync\fR parameter is set to \fByes \fR then this program is called \fBAS ROOT\fR before the SMB password in the smbpasswd file is changed\&. If this UNIX password change fails, then \fBsmbd\fR will fail to change the SMB password also (this is by design)\&. If the \fIunix password sync\fR parameter is set this parameter \fBMUST USE ABSOLUTE PATHS\fR for \fBALL\fR programs called, and must be examined for security implications\&. Note that by default \fIunix password sync\fR is set to \fBno\fR\&. @@ -4945,9 +5169,6 @@ preload modules (G) This is a list of paths to modules that should be loaded into smbd before a client connects\&. This improves the speed of smbd when reacting to new connections somewhat\&. -It is recommended to only use this option on heavy-performance servers\&. - - Default: \fBpreload modules = \fR @@ -5144,6 +5365,20 @@ This parameters defines the directory smbd will use for storing such files as \f Default :\fBprivate dir = ${prefix}/private\fR +.TP +profile acls (S) +This boolean parameter controls whether \fBsmbd\fR(8) This boolean parameter was added to fix the problems that people have been having with storing user profiles on Samba shares from Windows 2000 or Windows XP clients\&. New versions of Windows 2000 or Windows XP service packs do security ACL checking on the owner and ability to write of the profile directory stored on a local workstation when copied from a Samba share\&. + + +When not in domain mode with winbindd then the security info copied onto the local workstation has no meaning to the logged in user (SID) on that workstation so the profile storing fails\&. Adding this parameter onto a share used for profile storage changes two things about the returned Windows ACL\&. Firstly it changes the owner and group owner of all reported files and directories to be BUILTIN\\\\Administrators, BUILTIN\\\\Users respectively (SIDs S-1-5-32-544, S-1-5-32-545)\&. Secondly it adds an ACE entry of "Full Control" to the SID BUILTIN\\\\Users to every returned ACL\&. This will allow any Windows 2000 or XP workstation user to access the profile\&. + + +Note that if you have multiple users logging on to a workstation then in order to prevent them from being able to access each others profiles you must remove the "Bypass traverse checking" advanced user right\&. This will prevent access to other users profile directories as the top level profile directory (named after the user) is created by the workstation profile code and has an ACL restricting entry to the directory tree to the owning user\&. + + +Default: \fBprofile acls = no\fR + + .TP protocol (G) Synonym for \fImax protocol\fR\&. @@ -5301,7 +5536,7 @@ the above line would cause \fBnmbd\fR to announce itself to the two given IP add The IP addresses you choose would normally be the broadcast addresses of the remote networks, but can also be the IP addresses of known browse masters if your network config is that stable\&. -See the documentation file BROWSING in the \fIdocs/\fR directory\&. +See ???\&. Default: \fBremote announce = \fR @@ -5510,11 +5745,9 @@ See also the \fIpassword server\fR parameter and the \fIencrypted passwords\fR p In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an NT box\&. If this fails it will revert to \fBsecurity = user\fR\&. It expects the \fIencrypted passwords\fR parameter to be set to \fByes\fR, unless the remote server does not support them\&. However note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, it must have a valid \fIsmbpasswd\fR file to check users against\&. See the chapter about the User Database in the Samba HOWTO Collection for details on how to set this up\&. -\fBNote\fR this mode of operation has significant pitfalls, due to the fact that is activly initiates a man-in-the-middle attack on the remote SMB server\&. In particular, this mode of operation can cause significant resource consuption on the PDC, as it must maintain an active connection for the duration of the user's session\&. Furthermore, if this connection is lost, there is no way to reestablish it, and futher authenticaions to the Samba server may fail\&. (From a single client, till it disconnects)\&. - - -\fBNote\fR that from the client's point of view \fBsecurity = server\fR is the same as \fBsecurity = user\fR\&. It only affects how the server deals with the authentication, it does not in any way affect what the client sees\&. +This mode of operation has significant pitfalls, due to the fact that is activly initiates a man-in-the-middle attack on the remote SMB server\&. In particular, this mode of operation can cause significant resource consuption on the PDC, as it must maintain an active connection for the duration of the user's session\&. Furthermore, if this connection is lost, there is no way to reestablish it, and futher authenticaions to the Samba server may fail\&. (From a single client, till it disconnects)\&. +From the client's point of view \fBsecurity = server\fR is the same as \fBsecurity = user\fR\&. It only affects how the server deals with the authentication, it does not in any way affect what the client sees\&. \fBNote\fR that the name of the resource being requested is \fBnot\fR sent to the server until after the server has successfully authenticated the client\&. This is why guest shares don't work in user level security without allowing the server to automatically map unknown users into the \fIguest account\fR\&. See the \fImap to guest\fR parameter for details on doing this\&. @@ -5525,6 +5758,21 @@ See also the section NOTE ABOUT USERNAME/PASSWORD VALIDATION\&. See also the \fIpassword server\fR parameter and the \fIencrypted passwords\fR parameter\&. +\fBSECURITY = ADS\fR + + +In this mode, Samba will act as a domain member in an ADS realm\&. To operate in this mode, the machine running Samba will need to have Kerberos installed and configured and Samba will need to be joined to the ADS realm using the net utility\&. + + +Note that this mode does NOT make Samba operate as a Active Directory Domain Controller\&. + + +Read the chapter about Domain Membership in the HOWTO for details\&. + + +See also the \fIads server \fR parameter, the \fIrealm \fR paramter and the \fIencrypted passwords\fR parameter\&. + + Default: \fBsecurity = USER\fR @@ -5568,6 +5816,17 @@ Default: \fBserver schannel = auto\fR Example: \fBserver schannel = yes\fR +.TP +server signing (G) +This controls whether the server offers or requires the client it talks to to use SMB signing\&. Possible values are \fBauto\fR, \fBmandatory\fR and \fBdisabled\fR\&. + + +When set to auto, SMB signing is offered, but not enforced\&. When set to mandatory, SMB signing is required and if set to disabled, SMB signing is not offered either\&. + + +Default: \fBclient signing = False\fR + + .TP server string (G) This controls what string will show up in the printer comment box in print manager and next to the IPC connection in \fBnet view\fR\&. It can be any string that you wish to show to your users\&. @@ -5610,6 +5869,45 @@ Default: \fBNo default value\fR Example: \fBset primary group script = /usr/sbin/usermod -g '%g' '%u'\fR +.TP +set quota command (G) +The \fBset quota command\fR should only be used whenever there is no operating system API available from the OS that samba can use\&. + + +This parameter should specify the path to a script that can set quota for the specified arguments\&. + + +The specified script should take the following arguments: + + +1 - quota type .TP 3 \(bu 1 - user quotas .TP \(bu 2 - user default quotas (uid = -1) .TP \(bu 3 - group quotas .TP \(bu 4 - group default quotas (gid = -1) .LP + +2 - id (uid for user, gid for group, -1 if N/A) + +3 - quota state (0 = disable, 1 = enable, 2 = enable and enforce) + +4 - block softlimit + +5 - block hardlimit + +6 - inode softlimit + +7 - inode hardlimit + +8(optional) - block size, defaults to 1024 + +The script should output at least one line of data\&. + + +See also the \fIget quota command\fR parameter\&. + + +Default: \fBset quota command = \fR + + +Example: \fBset quota command = /usr/local/sbin/set_quota\fR + + .TP share modes (S) This enables or disables the honoring of the \fIshare modes\fR during a file open\&. These modes are used by clients to gain exclusive read or write access to a file\&. @@ -5680,7 +5978,7 @@ This command will be run as the user connected to the server\&. Default: \fBNone\fR\&. -Example: \fBabort shutdown script = /usr/local/samba/sbin/shutdown %m %t %r %f\fR +Example: \fBshutdown script = /usr/local/samba/sbin/shutdown %m %t %r %f\fR Shutdown script example: @@ -5835,14 +6133,6 @@ This parameter determines if \fBsmbd\fR(8) will use a cache in order to speed up Default: \fBstat cache = yes\fR -.TP -stat cache size (G) -This parameter determines the number of entries in the \fIstat cache\fR\&. You should never need to change this parameter\&. - - -Default: \fBstat cache size = 50\fR - - .TP strict allocate (S) This is a boolean that controls the handling of disk space allocation in the server\&. When this is set to \fByes\fR the server will change from UNIX behaviour of not committing real disk storage blocks when a file is extended to the Windows behaviour of actually forcing the disk system to allocate real storage blocks when a file is created or extended to be a given size\&. In UNIX terminology this means that Samba will stop creating sparse files\&. This can be slow on some systems\&. @@ -5928,6 +6218,14 @@ When filling out the user information for a Windows NT user, the \fBwinbindd\fR( Default: \fBtemplate homedir = /home/%D/%U\fR +.TP +template primary group (G) +This option defines the default primary group for each user created by \fBwinbindd\fR(8)'s local account management functions (similar to the 'add user script')\&. + + +Default: \fBtemplate primary group = nobody\fR + + .TP template shell (G) When filling out the user information for a Windows NT user, the \fBwinbindd\fR(8) daemon uses this parameter to fill in the login shell for that user\&. @@ -5960,17 +6258,6 @@ timestamp logs (G) Synonym for \fI debug timestamp\fR\&. -.TP -total print jobs (G) -This parameter accepts an integer value which defines a limit on the maximum number of print jobs that will be accepted system wide at any given time\&. If a print job is submitted by a client which will exceed this number, then \fBsmbd\fR(8) will return an error indicating that no space is available on the server\&. The default value of 0 means that no such limit exists\&. This parameter can be used to prevent a server from exceeding its capacity and is designed as a printing throttle\&. See also \fImax print jobs\fR\&. - - -Default: \fBtotal print jobs = 0\fR - - -Example: \fBtotal print jobs = 5000\fR - - .TP unicode (G) Specifies whether Samba should try to use unicode on the wire by default\&. Note: This does NOT mean that samba will assume that the unix machine uses unicode! @@ -5995,7 +6282,7 @@ unix extensions (G) This boolean parameter controls whether Samba implments the CIFS UNIX extensions, as defined by HP\&. These extensions enable Samba to better serve UNIX CIFS clients by supporting features such as symbolic links, hard links, etc\&.\&.\&. These extensions require a similarly enabled client, and are of no current use to Windows clients\&. -Default: \fBunix extensions = no\fR +Default: \fBunix extensions = yes\fR .TP @@ -6339,7 +6626,15 @@ winbind cache time (G) This parameter specifies the number of seconds the \fBwinbindd\fR(8) daemon will cache user and group information before querying a Windows NT server again\&. -Default: \fBwinbind cache type = 15\fR +Default: \fBwinbind cache type = 300\fR + + +.TP +winbind enable local accounts (G) +This parameter controls whether or not winbindd will act as a stand in replacement for the various account management hooks in smb\&.conf (e\&.g\&. 'add user script')\&. If enabled, winbindd will support the creation of local users and groups as another source of UNIX account information available via getpwnam() or getgrgid(), etc\&.\&.\&. + + +Default: \fBwinbind enable local accounts = yes\fR .TP @@ -6392,6 +6687,14 @@ Default: \fBwinbind separator = '\'\fR Example: \fBwinbind separator = +\fR +.TP +winbind trusted domains only (G) +This parameter is designed to allow Samba servers that are members of a Samba controlled domain to use UNIX accounts distributed vi NIS, rsync, or LDAP as the uid's for winbindd users in the hosts primary domain\&. Therefore, the user 'SAMBA\\user1' would be mapped to the account 'user1' in /etc/passwd instead of allocating a new uid for him or her\&. + + +Default: \fBwinbind trusted domains only = \fR + + .TP winbind uid (G) This parameter is now an alias for \fBidmap uid\fR @@ -6407,7 +6710,7 @@ Example: \fBwinbind uid = 10000-20000\fR .TP -winbind used default domain (G) +winbind use default domain (G) This parameter specifies whether the \fBwinbindd\fR(8) daemon should operate on users without domain component in their username\&. Users without a domain component are treated as is part of the winbindd server's own domain\&. While this does not benifit Windows users, it makes SSH, FTP and e-mail function in a way much closer to the way they would in a native unix system\&. @@ -6442,7 +6745,7 @@ An example script that calls the BIND dynamic DNS update program \fBnsupdate\fR .TP -wins partner (G) +wins partners (G) A space separated list of partners' IP addresses for WINS replication\&. WINS partners are always defined as push/pull partners as defining only one way WINS replication is unreliable\&. WINS replication is currently experimental and unreliable between samba servers\&. @@ -6473,7 +6776,7 @@ If you want to work in multiple namespaces, you can give every wins server a 'ta You need to set up Samba to point to a WINS server if you have multiple subnets and wish cross-subnet browsing to work correctly\&. -See the documentation file Browsing in the samba howto collection\&. +See the ???\&. Default: \fBnot enabled\fR diff --git a/docs/manpages/smbcacls.1 b/docs/manpages/smbcacls.1 index 9df06dff9b..cb9fcfb884 100644 --- a/docs/manpages/smbcacls.1 +++ b/docs/manpages/smbcacls.1 @@ -103,7 +103,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -117,7 +117,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP diff --git a/docs/manpages/smbclient.1 b/docs/manpages/smbclient.1 index 3f5718a2fa..8de0c58a6d 100644 --- a/docs/manpages/smbclient.1 +++ b/docs/manpages/smbclient.1 @@ -113,20 +113,6 @@ See the \fImessage command\fR parameter in the \fBsmb.conf\fR(5) for a descripti This number is the TCP port number that will be used when making connections to the server\&. The standard (well-known) TCP port number for an SMB/CIFS server is 139, which is the default\&. -.TP --l logfilename -If specified, \fIlogfilename\fR specifies a base filename into which operational data from the running client will be logged\&. - - -The default base name is specified at compile time\&. - - -The base name is used to generate actual log file names\&. For example, if the name specified was "log", the debug file would be \fIlog\&.client\fR\&. - - -The log file generated is never removed by the client\&. - - .TP -h|--help Print a summary of command line options\&. @@ -176,7 +162,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -190,7 +176,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP @@ -243,7 +229,7 @@ Be cautious about including passwords in scripts\&. Also, on many systems the co .TP -n -This option allows you to override the NetBIOS name that Samba uses for itself\&. This is identical to setting the \fINetBIOS name\fR parameter in the \fBsmb.conf\fR(5) file\&. However, a command line setting will take precedence over settings in \fBsmb.conf\fR(5)\&. +This option allows you to override the NetBIOS name that Samba uses for itself\&. This is identical to setting the \fInetbios name\fR parameter in the \fIsmb\&.conf\fR file\&. However, a command line setting will take precedence over settings in \fIsmb\&.conf\fR\&. .TP @@ -258,7 +244,7 @@ Set the SMB domain of the username\&. This overrides the default domain which is .TP -O socket options -TCP socket options to set on the client socket\&. See the socket options parameter in the \fBsmb.conf\fR(5) manual page for the list of valid options\&. +TCP socket options to set on the client socket\&. See the socket options parameter in the \fIsmb\&.conf\fR manual page for the list of valid options\&. .TP diff --git a/docs/manpages/smbcontrol.1 b/docs/manpages/smbcontrol.1 index 44d419f919..cec003a672 100644 --- a/docs/manpages/smbcontrol.1 +++ b/docs/manpages/smbcontrol.1 @@ -47,7 +47,7 @@ Print a summary of command line options\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -196,6 +196,11 @@ drvupgrade Force clients of printers using specified driver to update their local version of the driver\&. Can only be sent to smbd\&. +.TP +reload-config +Force daemon to reload smb\&.conf configuration file\&. Can be sent to \fBsmbd\fR, \fBnmbd\fR, or \fBwinbindd\fR\&. + + .SH "VERSION" .PP diff --git a/docs/manpages/smbcquotas.1 b/docs/manpages/smbcquotas.1 index e8288977f8..e270fe3b4a 100644 --- a/docs/manpages/smbcquotas.1 +++ b/docs/manpages/smbcquotas.1 @@ -88,7 +88,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -102,7 +102,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP diff --git a/docs/manpages/smbd.8 b/docs/manpages/smbd.8 index c7c0fac777..07b563af5c 100644 --- a/docs/manpages/smbd.8 +++ b/docs/manpages/smbd.8 @@ -76,7 +76,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -90,7 +90,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP @@ -134,7 +134,7 @@ This parameter is not normally specified except in the above situation\&. .TP \fI/etc/inetd\&.conf\fR -If the server is to be run by the \fBinetd\fR meta-daemon, this file must contain suitable startup information for the meta-daemon\&. See the "How to Install and Test SAMBA" document for details\&. +If the server is to be run by the \fBinetd\fR meta-daemon, this file must contain suitable startup information for the meta-daemon\&. .TP @@ -142,12 +142,12 @@ If the server is to be run by the \fBinetd\fR meta-daemon, this file must contai or whatever initialization script your system uses)\&. -If running the server as a daemon at startup, this file will need to contain an appropriate startup sequence for the server\&. See the "How to Install and Test SAMBA" document for details\&. +If running the server as a daemon at startup, this file will need to contain an appropriate startup sequence for the server\&. .TP \fI/etc/services\fR -If running the server via the meta-daemon \fBinetd\fR, this file must contain a mapping of service name (e\&.g\&., netbios-ssn) to service port (e\&.g\&., 139) and protocol type (e\&.g\&., tcp)\&. See the "How to Install and Test SAMBA" document for details\&. +If running the server via the meta-daemon \fBinetd\fR, this file must contain a mapping of service name (e\&.g\&., netbios-ssn) to service port (e\&.g\&., 139) and protocol type (e\&.g\&., tcp)\&. .TP @@ -173,7 +173,7 @@ If no printer name is specified to printable services, most systems will use the .SH "PAM INTERACTION" .PP -Samba uses PAM for authentication (when presented with a plaintext password), for account checking (is this account disabled?) and for session management\&. The degree too which samba supports PAM is restricted by the limitations of the SMB protocol and the \fIobey pam restricions\fR \fBsmb.conf\fR(5) paramater\&. When this is set, the following restrictions apply: +Samba uses PAM for authentication (when presented with a plaintext password), for account checking (is this account disabled?) and for session management\&. The degree too which samba supports PAM is restricted by the limitations of the SMB protocol and the \fIobey pam restrictions\fR \fBsmb.conf\fR(5) paramater\&. When this is set, the following restrictions apply: .TP 3 \(bu diff --git a/docs/manpages/smbpasswd.8 b/docs/manpages/smbpasswd.8 index a7973871c4..e0c8ca5109 100644 --- a/docs/manpages/smbpasswd.8 +++ b/docs/manpages/smbpasswd.8 @@ -197,7 +197,7 @@ This specifies the username for all of the \fBroot only\fR options to operate on Since \fBsmbpasswd\fR works in client-server mode communicating with a local smbd for a non-root user then the smbd daemon must be running for this to work\&. A common problem is to add a restriction to the hosts that may access the \fB smbd\fR running on the local machine by specifying either \fIallow hosts\fR or \fIdeny hosts\fR entry in the \fBsmb.conf\fR(5) file and neglecting to allow "localhost" access to the smbd\&. .PP -In addition, the smbpasswd command is only useful if Samba has been set up to use encrypted passwords\&. See the document "LanMan and NT Password Encryption in Samba" in the docs directory for details on how to do this\&. +In addition, the smbpasswd command is only useful if Samba has been set up to use encrypted passwords\&. .SH "VERSION" diff --git a/docs/manpages/smbsh.1 b/docs/manpages/smbsh.1 index 0e2c4a3a85..3b9e507246 100644 --- a/docs/manpages/smbsh.1 +++ b/docs/manpages/smbsh.1 @@ -19,7 +19,7 @@ .. .TH "SMBSH" 1 "" "" "" .SH NAME -smbsh \- Allows access to Windows NT filesystem using UNIX commands +smbsh \- Allows access to remote SMB shares using UNIX commands .SH "SYNOPSIS" .nf @@ -54,7 +54,7 @@ This option allows the user to set the directory prefix for SMB access\&. The de .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -68,7 +68,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP @@ -87,10 +87,10 @@ The options are: "lmhosts", "host", "wins" and "bcast"\&. They cause names to be \fBbcast\fR: Do a broadcast on each of the known local interfaces listed in the \fIinterfaces\fR parameter\&. This is the least reliable of the name resolution methods as it depends on the target host being on a locally connected subnet\&. -If this parameter is not set then the name resolve order defined in the \fBsmb.conf\fR(5) file parameter (\fIname resolve order\fR) will be used\&. +If this parameter is not set then the name resolve order defined in the \fIsmb\&.conf\fR file parameter (\fIname resolve order\fR) will be used\&. -The default order is lmhosts, host, wins, bcast\&. Without this parameter or any entry in the \fIname resolve order \fR parameter of the \fBsmb.conf\fR(5) file, the name resolution methods will be attempted in this order\&. +The default order is lmhosts, host, wins, bcast\&. Without this parameter or any entry in the \fIname resolve order\fR parameter of the \fIsmb\&.conf\fR file, the name resolution methods will be attempted in this order\&. .TP diff --git a/docs/manpages/smbstatus.1 b/docs/manpages/smbstatus.1 index 7e349dcd19..21b05a2429 100644 --- a/docs/manpages/smbstatus.1 +++ b/docs/manpages/smbstatus.1 @@ -54,7 +54,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -68,7 +68,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP diff --git a/docs/manpages/smbtree.1 b/docs/manpages/smbtree.1 index 0cc984c24a..84c2399c77 100644 --- a/docs/manpages/smbtree.1 +++ b/docs/manpages/smbtree.1 @@ -58,7 +58,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -72,7 +72,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP diff --git a/docs/manpages/swat.8 b/docs/manpages/swat.8 index 36d855e725..26e5376bf6 100644 --- a/docs/manpages/swat.8 +++ b/docs/manpages/swat.8 @@ -59,7 +59,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -73,7 +73,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP diff --git a/docs/manpages/vfstest.1 b/docs/manpages/vfstest.1 index a6d01fba57..3400c6b570 100644 --- a/docs/manpages/vfstest.1 +++ b/docs/manpages/vfstest.1 @@ -58,7 +58,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -72,7 +72,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP diff --git a/docs/manpages/wbinfo.1 b/docs/manpages/wbinfo.1 index 9bbecb29a4..6c5ca93e19 100644 --- a/docs/manpages/wbinfo.1 +++ b/docs/manpages/wbinfo.1 @@ -23,9 +23,8 @@ wbinfo \- Query information from winbind daemon .SH "SYNOPSIS" .nf -\fBwbinfo\fR [-u] [-g] [-N netbios-name] [-I ip] [-n name] [-s sid] [-U uid] [-G gid] - [-S sid] [-Y sid] [-t] [-m] [--sequence] [-r user] [-a user%password] - [--set-auth-user user%password] [--get-auth-user] [-p] +\fBwbinfo\fR [-a user%password] [-c username] [-C groupname] [--domain domain] [-I ip] [-s sid] [-u] [-U uid] [-g] [--get-auth-user] [-G gid] [-m] [-n name] [-N netbios-name] [-o user:group] [-O user:group] [-p] [-r user] [--set-auth-user user%password] [--sequence] [-S sid] [-t] [-x username] [-X groupname] [-Y sid] + .fi .SH "DESCRIPTION" @@ -42,8 +41,23 @@ The \fBwinbindd\fR(8) daemon must be configured and running for the \fBwbinfo\fR .SH "OPTIONS" .TP --u -This option will list all users available in the Windows NT domain for which the \fBwinbindd\fR(8) daemon is operating in\&. Users in all trusted domains will also be listed\&. Note that this operation does not assign user ids to any users that have not already been seen by \fBwinbindd\fR(8) \&. +-a username%password +Attempt to authenticate a user via winbindd\&. This checks both authenticaion methods and reports its results\&. + + +.TP +-c user +Create a local winbind user\&. + + +.TP +-C group +Create a local winbindd group\&. + + +.TP +--domain name +This parameter sets the domain on which any specified operations will performed\&. If special domain name '\&.' is used to represent the current domain to which winbindd belongs\&. Currently only the \fB--sequence\fR, \fB-u\fR, and \fB-g\fR options honor this parameter\&. .TP @@ -52,8 +66,13 @@ This option will list all groups available in the Windows NT domain for which th .TP --N name -The \fI-N\fR option queries \fBwinbindd\fR(8) to query the WINS server for the IP address associated with the NetBIOS name specified by the \fIname\fR parameter\&. +--get-auth-user +Print username and password used by winbindd during session setup to a domain controller\&. Username and password can be set using '-A'\&. Only available for root\&. + + +.TP +-G gid +Try to convert a UNIX group id to a Windows NT SID\&. If the gid specified does not refer to one within the idmap gid range then the operation will fail\&. .TP @@ -61,44 +80,49 @@ The \fI-N\fR option queries \fBwinbindd\fR(8) to query the WINS server for the I The \fI-I\fR option queries \fBwinbindd\fR(8) to send a node status request to get the NetBIOS name associated with the IP address specified by the \fIip\fR parameter\&. +.TP +-m +Produce a list of domains trusted by the Windows NT server \fBwinbindd\fR(8) contacts when resolving names\&. This list does not include the Windows NT domain the server is a Primary Domain Controller for\&. + + .TP -n name The \fI-n\fR option queries \fBwinbindd\fR(8) for the SID associated with the name specified\&. Domain names can be specified before the user name by using the winbind separator character\&. For example CWDOM1/Administrator refers to the Administrator user in the domain CWDOM1\&. If no domain is specified then the domain used is the one specified in the \fBsmb.conf\fR(5) \fIworkgroup \fR parameter\&. .TP --s sid -Use \fI-s\fR to resolve a SID to a name\&. This is the inverse of the \fI-n \fR option above\&. SIDs must be specified as ASCII strings in the traditional Microsoft format\&. For example, S-1-5-21-1455342024-3071081365-2475485837-500\&. +-N name +The \fI-N\fR option queries \fBwinbindd\fR(8) to query the WINS server for the IP address associated with the NetBIOS name specified by the \fIname\fR parameter\&. .TP --U uid -Try to convert a UNIX user id to a Windows NT SID\&. If the uid specified does not refer to one within the winbind uid range then the operation will fail\&. +-o user:group +Add a winbindd local group as a secondary group for the specified winbindd local user\&. .TP --G gid -Try to convert a UNIX group id to a Windows NT SID\&. If the gid specified does not refer to one within the winbind gid range then the operation will fail\&. +-O user:group +Remove a winbindd local group as a secondary group for the specified winbindd local user\&. .TP --S sid -Convert a SID to a UNIX user id\&. If the SID does not correspond to a UNIX user mapped by \fBwinbindd\fR(8) then the operation will fail\&. +-p +Check whether winbindd is still alive\&. Prints out either 'succeeded' or 'failed'\&. .TP --Y sid -Convert a SID to a UNIX group id\&. If the SID does not correspond to a UNIX group mapped by \fBwinbindd\fR(8) then the operation will fail\&. +-r username +Try to obtain the list of UNIX group ids to which the user belongs\&. This only works for users defined on a Domain Controller\&. .TP --t -Verify that the workstation trust account created when the Samba server is added to the Windows NT domain is working\&. +-s sid +Use \fI-s\fR to resolve a SID to a name\&. This is the inverse of the \fI-n \fR option above\&. SIDs must be specified as ASCII strings in the traditional Microsoft format\&. For example, S-1-5-21-1455342024-3071081365-2475485837-500\&. .TP --m -Produce a list of domains trusted by the Windows NT server \fBwinbindd\fR(8) contacts when resolving names\&. This list does not include the Windows NT domain the server is a Primary Domain Controller for\&. +--set-auth-user username%password +Store username and password used by winbindd during session setup to a domain controller\&. This enables winbindd to operate in a Windows 2000 domain with Restrict Anonymous turned on (a\&.k\&.a\&. Permissions compatiable with Windows 2000 servers only)\&. .TP @@ -107,28 +131,38 @@ Show sequence numbers of all known domains .TP --r username -Try to obtain the list of UNIX group ids to which the user belongs\&. This only works for users defined on a Domain Controller\&. +-S sid +Convert a SID to a UNIX user id\&. If the SID does not correspond to a UNIX user mapped by \fBwinbindd\fR(8) then the operation will fail\&. .TP --a username%password -Attempt to authenticate a user via winbindd\&. This checks both authenticaion methods and reports its results\&. +-t +Verify that the workstation trust account created when the Samba server is added to the Windows NT domain is working\&. .TP ---set-auth-user username%password -Store username and password used by winbindd during session setup to a domain controller\&. This enables winbindd to operate in a Windows 2000 domain with Restrict Anonymous turned on (a\&.k\&.a\&. Permissions compatiable with Windows 2000 servers only)\&. +-u +This option will list all users available in the Windows NT domain for which the \fBwinbindd\fR(8) daemon is operating in\&. Users in all trusted domains will also be listed\&. Note that this operation does not assign user ids to any users that have not already been seen by \fBwinbindd\fR(8) \&. .TP ---get-auth-user -Print username and password used by winbindd during session setup to a domain controller\&. Username and password can be set using '-A'\&. Only available for root\&. +-U uid +Try to convert a UNIX user id to a Windows NT SID\&. If the uid specified does not refer to one within the idmap uid range then the operation will fail\&. .TP --p -Check whether winbindd is still alive\&. Prints out either 'succeeded' or 'failed'\&. +-x user +Delete an existing local winbind user\&. + + +.TP +-X group +Delete an existing local winbindd group\&. + + +.TP +-Y sid +Convert a SID to a UNIX group id\&. If the SID does not correspond to a UNIX group mapped by \fBwinbindd\fR(8) then the operation will fail\&. .TP diff --git a/docs/manpages/winbindd.8 b/docs/manpages/winbindd.8 index 31ed3ba332..14621e1356 100644 --- a/docs/manpages/winbindd.8 +++ b/docs/manpages/winbindd.8 @@ -23,7 +23,7 @@ winbindd \- Name Service Switch daemon for resolving names from NT servers .SH "SYNOPSIS" .nf -\fBwinbindd\fR [-F] [-S] [-i] [-B] [-d ] [-s ] [-n] +\fBwinbindd\fR [-F] [-S] [-i] [-Y] [-d ] [-s ] [-n] .fi .SH "DESCRIPTION" @@ -89,7 +89,7 @@ Prints the version number for \fBsmbd\fR\&. .TP -s -The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fI smb\&.conf(5)\fR for more information\&. The default configuration file name is determined at compile time\&. +The file specified contains the configuration details required by the server\&. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See \fIsmb\&.conf\fR for more information\&. The default configuration file name is determined at compile time\&. .TP @@ -103,7 +103,7 @@ The higher this value, the more detail will be logged to the log files about the Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. -Note that specifying this parameter here will override the log level parameter in the \fIsmb\&.conf(5)\fR file\&. +Note that specifying this parameter here will override the \fIlog level\fR parameter in the \fIsmb\&.conf\fR file\&. .TP @@ -127,8 +127,8 @@ Disable caching\&. This means winbindd will always have to wait for a response f .TP --B -Dual daemon mode\&. This means winbindd will run as 2 threads\&. The first will answer all requests from the cache, thus making responses to clients faster\&. The other will update the cache for the query that the first has just responded\&. Advantage of this is that responses stay accurate and are faster\&. +-Y +Single daemon mode\&. This means winbindd will run as a single process (the mode of operation in Samba 2\&.2)\&. Winbindd's default behavior is to launch a child process that is responsible for updating expired cache entries\&. .SH "NAME AND ID RESOLUTION" @@ -153,11 +153,11 @@ Configuration of the \fBwinbindd\fR daemon is done through configuration paramet .TP \(bu -\fIwinbind uid\fR +\fIidmap uid\fR .TP \(bu -\fIwinbind gid\fR +\fIidmap gid\fR .TP \(bu @@ -240,8 +240,8 @@ Finally, setup a \fBsmb.conf\fR(5) containing directives like the following: winbind cache time = 10 template shell = /bin/bash template homedir = /home/%D/%U - winbind uid = 10000-20000 - winbind gid = 10000-20000 + idmap uid = 10000-20000 + idmap gid = 10000-20000 workgroup = DOMAIN security = domain password server = * @@ -279,8 +279,8 @@ Reload the \fBsmb.conf\fR(5) file and apply any parameter changes to the running .TP -SIGUSR1 -The SIGUSR1 signal will cause \fB winbindd\fR to write status information to the winbind log file including information about the number of user and group ids allocated by \fBwinbindd\fR\&. +SIGUSR2 +The SIGUSR2 signal will cause \fB winbindd\fR to write status information to the winbind log file including information about the number of user and group ids allocated by \fBwinbindd\fR\&. Log files are stored in the filename specified by the log file parameter\&. -- cgit From b968848a1697dfc7216e1802883b5f7e55025111 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 03:11:56 +0000 Subject: removing files not in 3.0 (This used to be commit d5c32f8881f33667c9bfa067cb7f2113bd55c724) --- docs/announce | 153 -- docs/docbook/faq/config.xml | 37 - docs/docbook/faq/printing.xml | 38 - docs/docbook/manpages/profiles.1.sgml | 86 - docs/docbook/smbdotconf/base/adsserver.xml | 15 - docs/docbook/smbdotconf/expand-smb.conf.xsl | 87 - docs/docbook/smbdotconf/ldap/ldaptrustids.xml | 23 - .../docbook/smbdotconf/printing/totalprintjobs.xml | 22 - .../smbdotconf/security/nonunixaccountrange.xml | 25 - docs/docbook/smbdotconf/smb.conf.5.xml | 14 +- docs/docbook/smbdotconf/tuning/statcachesize.xml | 12 - docs/docbook/smbdotconf/vfs/vfsoptions.xml | 12 - docs/docbook/smbdotconf/vfs/vfspath.xml | 13 - docs/docbook/xslt/db2latex/VERSION.xml | 21 - docs/docbook/xslt/db2latex/abstract.mod.xsl | 92 - docs/docbook/xslt/db2latex/admonition.mod.xsl | 222 -- docs/docbook/xslt/db2latex/authorgroup.mod.xsl | 78 - docs/docbook/xslt/db2latex/biblio.mod.xsl | 605 ----- docs/docbook/xslt/db2latex/block.mod.xsl | 174 -- docs/docbook/xslt/db2latex/book-article.mod.xsl | 540 ---- docs/docbook/xslt/db2latex/bridgehead.mod.xsl | 71 - docs/docbook/xslt/db2latex/callout.mod.xsl | 61 - docs/docbook/xslt/db2latex/citation.mod.xsl | 63 - docs/docbook/xslt/db2latex/common/ca.xml | 100 - docs/docbook/xslt/db2latex/common/common.xsl | 1927 -------------- docs/docbook/xslt/db2latex/common/cs.xml | 110 - docs/docbook/xslt/db2latex/common/da.xml | 98 - docs/docbook/xslt/db2latex/common/de.xml | 102 - docs/docbook/xslt/db2latex/common/el.xml | 104 - docs/docbook/xslt/db2latex/common/en.xml | 107 - docs/docbook/xslt/db2latex/common/es.xml | 98 - docs/docbook/xslt/db2latex/common/et.xml | 104 - docs/docbook/xslt/db2latex/common/fi.xml | 98 - docs/docbook/xslt/db2latex/common/fr.xml | 114 - docs/docbook/xslt/db2latex/common/hu.xml | 94 - docs/docbook/xslt/db2latex/common/id.xml | 104 - docs/docbook/xslt/db2latex/common/it.xml | 103 - docs/docbook/xslt/db2latex/common/ja.xml | 104 - docs/docbook/xslt/db2latex/common/ko.xml | 96 - docs/docbook/xslt/db2latex/common/l10n.dtd | 25 - docs/docbook/xslt/db2latex/common/l10n.xml | 59 - docs/docbook/xslt/db2latex/common/l10n.xsl | 248 -- docs/docbook/xslt/db2latex/common/nl.xml | 105 - docs/docbook/xslt/db2latex/common/no.xml | 97 - docs/docbook/xslt/db2latex/common/pl.xml | 96 - docs/docbook/xslt/db2latex/common/pt.xml | 98 - docs/docbook/xslt/db2latex/common/pt_br.xml | 98 - docs/docbook/xslt/db2latex/common/ro.xml | 104 - docs/docbook/xslt/db2latex/common/ru.xml | 113 - docs/docbook/xslt/db2latex/common/sk.xml | 104 - docs/docbook/xslt/db2latex/common/sl.xml | 104 - docs/docbook/xslt/db2latex/common/sv.xml | 99 - docs/docbook/xslt/db2latex/common/zh_cn.xml | 95 - docs/docbook/xslt/db2latex/common/zh_tw.xml | 98 - docs/docbook/xslt/db2latex/component.mod.xsl | 91 - docs/docbook/xslt/db2latex/dedication.mod.xsl | 126 - docs/docbook/xslt/db2latex/dingbat.mod.xsl | 69 - docs/docbook/xslt/db2latex/docbook.xsl | 149 -- docs/docbook/xslt/db2latex/email.mod.xsl | 62 - docs/docbook/xslt/db2latex/errors.mod.xsl | 16 - docs/docbook/xslt/db2latex/example.mod.xsl | 76 - docs/docbook/xslt/db2latex/figure.mod.xsl | 127 - docs/docbook/xslt/db2latex/font.mod.xsl | 55 - docs/docbook/xslt/db2latex/footnote.mod.xsl | 82 - docs/docbook/xslt/db2latex/formal.mod.xsl | 173 -- docs/docbook/xslt/db2latex/glossary.mod.xsl | 218 -- docs/docbook/xslt/db2latex/graphic.mod.xsl | 87 - docs/docbook/xslt/db2latex/html.mod.xsl | 15 - docs/docbook/xslt/db2latex/index.mod.xsl | 213 -- docs/docbook/xslt/db2latex/info.mod.xsl | 66 - docs/docbook/xslt/db2latex/inline.mod.xsl | 523 ---- docs/docbook/xslt/db2latex/keywords.mod.xsl | 59 - docs/docbook/xslt/db2latex/labelid.mod.xsl | 476 ---- docs/docbook/xslt/db2latex/latex.mapping.dtd | 13 - docs/docbook/xslt/db2latex/latex.mapping.xml | 290 -- docs/docbook/xslt/db2latex/latex.mapping.xsl | 174 -- docs/docbook/xslt/db2latex/lists.mod.xsl | 452 ---- docs/docbook/xslt/db2latex/mathelem.mod.xsl | 222 -- docs/docbook/xslt/db2latex/mathml/ent/isoamsa.ent | 173 -- docs/docbook/xslt/db2latex/mathml/ent/isoamsb.ent | 146 -- docs/docbook/xslt/db2latex/mathml/ent/isoamsc.ent | 49 - docs/docbook/xslt/db2latex/mathml/ent/isoamsn.ent | 117 - docs/docbook/xslt/db2latex/mathml/ent/isoamso.ent | 77 - docs/docbook/xslt/db2latex/mathml/ent/isoamsr.ent | 205 -- docs/docbook/xslt/db2latex/mathml/ent/isobox.ent | 67 - docs/docbook/xslt/db2latex/mathml/ent/isocyr1.ent | 94 - docs/docbook/xslt/db2latex/mathml/ent/isocyr2.ent | 53 - docs/docbook/xslt/db2latex/mathml/ent/isodia.ent | 41 - docs/docbook/xslt/db2latex/mathml/ent/isogrk1.ent | 75 - docs/docbook/xslt/db2latex/mathml/ent/isogrk2.ent | 46 - docs/docbook/xslt/db2latex/mathml/ent/isogrk3.ent | 70 - docs/docbook/xslt/db2latex/mathml/ent/isogrk4.ent | 69 - docs/docbook/xslt/db2latex/mathml/ent/isolat1.ent | 89 - docs/docbook/xslt/db2latex/mathml/ent/isolat2.ent | 148 -- docs/docbook/xslt/db2latex/mathml/ent/isomfrk.ent | 79 - docs/docbook/xslt/db2latex/mathml/ent/isomopf.ent | 53 - docs/docbook/xslt/db2latex/mathml/ent/isomscr.ent | 79 - docs/docbook/xslt/db2latex/mathml/ent/isonum.ent | 103 - docs/docbook/xslt/db2latex/mathml/ent/isopub.ent | 111 - docs/docbook/xslt/db2latex/mathml/ent/isotech.ent | 183 -- docs/docbook/xslt/db2latex/mathml/ent/mmlalias.ent | 529 ---- docs/docbook/xslt/db2latex/mathml/ent/mmlextra.ent | 134 - .../xslt/db2latex/mathml/latex.entities.dtd | 7 - .../xslt/db2latex/mathml/latex.entities.xml | 12 - .../mathml/mathml.content.constsymb.mod.xsl | 99 - .../mathml/mathml.content.functions.mod.xsl | 723 ----- .../xslt/db2latex/mathml/mathml.content.mod.xsl | 97 - .../db2latex/mathml/mathml.content.token.mod.xsl | 230 -- docs/docbook/xslt/db2latex/mathml/mathml.mod.xsl | 49 - .../db2latex/mathml/mathml.presentation.mod.xsl | 491 ---- docs/docbook/xslt/db2latex/mediaobject.mod.xsl | 224 -- docs/docbook/xslt/db2latex/msgset.mod.xsl | 76 - docs/docbook/xslt/db2latex/normalize-scape.mod.xsl | 398 --- docs/docbook/xslt/db2latex/para.mod.xsl | 74 - docs/docbook/xslt/db2latex/part-chap-app.mod.xsl | 132 - docs/docbook/xslt/db2latex/pi.mod.xsl | 181 -- docs/docbook/xslt/db2latex/preamble.mod.xsl | 810 ------ docs/docbook/xslt/db2latex/preface.mod.xsl | 109 - docs/docbook/xslt/db2latex/procedure.mod.xsl | 162 -- docs/docbook/xslt/db2latex/qandaset.mod.xsl | 406 --- docs/docbook/xslt/db2latex/refentry.mod.xsl | 184 -- docs/docbook/xslt/db2latex/revision.mod.xsl | 215 -- docs/docbook/xslt/db2latex/sections.mod.xsl | 147 -- docs/docbook/xslt/db2latex/set.mod.xsl | 50 - docs/docbook/xslt/db2latex/sgmltag.mod.xsl | 154 -- docs/docbook/xslt/db2latex/synop-oop.mod.xsl | 689 ----- docs/docbook/xslt/db2latex/synop-struct.mod.xsl | 246 -- docs/docbook/xslt/db2latex/table.mod.xsl | 743 ------ docs/docbook/xslt/db2latex/texmath.mod.xsl | 117 - docs/docbook/xslt/db2latex/vars.mod.xsl | 937 ------- docs/docbook/xslt/db2latex/verbatim.mod.xsl | 144 - docs/docbook/xslt/db2latex/xref.mod.xsl | 657 ----- docs/faq/FAQ-Config.html | 16 - docs/faq/FAQ-Printing.html | 16 - docs/htmldocs/ads.html | 467 ---- docs/htmldocs/advancednetworkmanagement.html | 555 ---- docs/htmldocs/appendixes.html | 140 - docs/htmldocs/browsing-quick.html | 805 ------ docs/htmldocs/cups-printing.html | 2773 -------------------- docs/htmldocs/domain-security.html | 427 --- docs/htmldocs/groupprofiles.html | 568 ---- docs/htmldocs/improved-browsing.html | 1094 -------- docs/htmldocs/index.html | 76 - docs/htmldocs/interdomaintrusts.html | 451 ---- docs/htmldocs/introsmb.html | 659 ----- docs/htmldocs/nt4migration.html | 356 --- docs/htmldocs/other-clients.html | 734 ------ docs/htmldocs/policymgmt.html | 758 ------ docs/htmldocs/portability.html | 418 --- docs/htmldocs/profilemgmt.html | 1753 ------------- docs/htmldocs/samba-howto-collection.html | 1394 ---------- docs/htmldocs/securitylevels.html | 212 -- docs/htmldocs/servertype.html | 368 --- docs/htmldocs/swat.html | 233 -- docs/htmldocs/unix-permissions.html | 194 -- docs/htmldocs/vfs.html | 490 ---- docs/textdocs/README.NOW | 6 - docs/textdocs/README.jis | 149 -- 158 files changed, 6 insertions(+), 37763 deletions(-) delete mode 100644 docs/announce delete mode 100644 docs/docbook/faq/config.xml delete mode 100644 docs/docbook/faq/printing.xml delete mode 100644 docs/docbook/manpages/profiles.1.sgml delete mode 100644 docs/docbook/smbdotconf/base/adsserver.xml delete mode 100644 docs/docbook/smbdotconf/expand-smb.conf.xsl delete mode 100644 docs/docbook/smbdotconf/ldap/ldaptrustids.xml delete mode 100644 docs/docbook/smbdotconf/printing/totalprintjobs.xml delete mode 100644 docs/docbook/smbdotconf/security/nonunixaccountrange.xml delete mode 100644 docs/docbook/smbdotconf/tuning/statcachesize.xml delete mode 100644 docs/docbook/smbdotconf/vfs/vfsoptions.xml delete mode 100644 docs/docbook/smbdotconf/vfs/vfspath.xml delete mode 100644 docs/docbook/xslt/db2latex/VERSION.xml delete mode 100644 docs/docbook/xslt/db2latex/abstract.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/admonition.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/authorgroup.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/biblio.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/block.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/book-article.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/bridgehead.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/callout.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/citation.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/common/ca.xml delete mode 100644 docs/docbook/xslt/db2latex/common/common.xsl delete mode 100644 docs/docbook/xslt/db2latex/common/cs.xml delete mode 100644 docs/docbook/xslt/db2latex/common/da.xml delete mode 100644 docs/docbook/xslt/db2latex/common/de.xml delete mode 100644 docs/docbook/xslt/db2latex/common/el.xml delete mode 100644 docs/docbook/xslt/db2latex/common/en.xml delete mode 100644 docs/docbook/xslt/db2latex/common/es.xml delete mode 100644 docs/docbook/xslt/db2latex/common/et.xml delete mode 100644 docs/docbook/xslt/db2latex/common/fi.xml delete mode 100644 docs/docbook/xslt/db2latex/common/fr.xml delete mode 100644 docs/docbook/xslt/db2latex/common/hu.xml delete mode 100644 docs/docbook/xslt/db2latex/common/id.xml delete mode 100644 docs/docbook/xslt/db2latex/common/it.xml delete mode 100644 docs/docbook/xslt/db2latex/common/ja.xml delete mode 100644 docs/docbook/xslt/db2latex/common/ko.xml delete mode 100644 docs/docbook/xslt/db2latex/common/l10n.dtd delete mode 100644 docs/docbook/xslt/db2latex/common/l10n.xml delete mode 100644 docs/docbook/xslt/db2latex/common/l10n.xsl delete mode 100644 docs/docbook/xslt/db2latex/common/nl.xml delete mode 100644 docs/docbook/xslt/db2latex/common/no.xml delete mode 100644 docs/docbook/xslt/db2latex/common/pl.xml delete mode 100644 docs/docbook/xslt/db2latex/common/pt.xml delete mode 100644 docs/docbook/xslt/db2latex/common/pt_br.xml delete mode 100644 docs/docbook/xslt/db2latex/common/ro.xml delete mode 100644 docs/docbook/xslt/db2latex/common/ru.xml delete mode 100644 docs/docbook/xslt/db2latex/common/sk.xml delete mode 100644 docs/docbook/xslt/db2latex/common/sl.xml delete mode 100644 docs/docbook/xslt/db2latex/common/sv.xml delete mode 100644 docs/docbook/xslt/db2latex/common/zh_cn.xml delete mode 100644 docs/docbook/xslt/db2latex/common/zh_tw.xml delete mode 100644 docs/docbook/xslt/db2latex/component.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/dedication.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/dingbat.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/docbook.xsl delete mode 100644 docs/docbook/xslt/db2latex/email.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/errors.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/example.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/figure.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/font.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/footnote.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/formal.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/glossary.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/graphic.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/html.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/index.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/info.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/inline.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/keywords.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/labelid.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/latex.mapping.dtd delete mode 100644 docs/docbook/xslt/db2latex/latex.mapping.xml delete mode 100644 docs/docbook/xslt/db2latex/latex.mapping.xsl delete mode 100644 docs/docbook/xslt/db2latex/lists.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/mathelem.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isoamsa.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isoamsb.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isoamsc.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isoamsn.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isoamso.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isoamsr.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isobox.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isocyr1.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isocyr2.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isodia.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isogrk1.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isogrk2.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isogrk3.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isogrk4.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isolat1.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isolat2.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isomfrk.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isomopf.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isomscr.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isonum.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isopub.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/isotech.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/mmlalias.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/ent/mmlextra.ent delete mode 100644 docs/docbook/xslt/db2latex/mathml/latex.entities.dtd delete mode 100644 docs/docbook/xslt/db2latex/mathml/latex.entities.xml delete mode 100644 docs/docbook/xslt/db2latex/mathml/mathml.content.constsymb.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/mathml/mathml.content.functions.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/mathml/mathml.content.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/mathml/mathml.content.token.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/mathml/mathml.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/mathml/mathml.presentation.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/mediaobject.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/msgset.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/normalize-scape.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/para.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/part-chap-app.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/pi.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/preamble.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/preface.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/procedure.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/qandaset.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/refentry.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/revision.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/sections.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/set.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/sgmltag.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/synop-oop.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/synop-struct.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/table.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/texmath.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/vars.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/verbatim.mod.xsl delete mode 100644 docs/docbook/xslt/db2latex/xref.mod.xsl delete mode 100644 docs/faq/FAQ-Config.html delete mode 100644 docs/faq/FAQ-Printing.html delete mode 100644 docs/htmldocs/ads.html delete mode 100644 docs/htmldocs/advancednetworkmanagement.html delete mode 100644 docs/htmldocs/appendixes.html delete mode 100644 docs/htmldocs/browsing-quick.html delete mode 100644 docs/htmldocs/cups-printing.html delete mode 100644 docs/htmldocs/domain-security.html delete mode 100644 docs/htmldocs/groupprofiles.html delete mode 100644 docs/htmldocs/improved-browsing.html delete mode 100755 docs/htmldocs/index.html delete mode 100644 docs/htmldocs/interdomaintrusts.html delete mode 100644 docs/htmldocs/introsmb.html delete mode 100644 docs/htmldocs/nt4migration.html delete mode 100644 docs/htmldocs/other-clients.html delete mode 100644 docs/htmldocs/policymgmt.html delete mode 100644 docs/htmldocs/portability.html delete mode 100644 docs/htmldocs/profilemgmt.html delete mode 100644 docs/htmldocs/samba-howto-collection.html delete mode 100644 docs/htmldocs/securitylevels.html delete mode 100644 docs/htmldocs/servertype.html delete mode 100644 docs/htmldocs/swat.html delete mode 100644 docs/htmldocs/unix-permissions.html delete mode 100644 docs/htmldocs/vfs.html delete mode 100644 docs/textdocs/README.NOW delete mode 100644 docs/textdocs/README.jis diff --git a/docs/announce b/docs/announce deleted file mode 100644 index 7310bdd737..0000000000 --- a/docs/announce +++ /dev/null @@ -1,153 +0,0 @@ -This document is out of date - - - Announcing Samba version 2.2 - ============================ - -What is Samba? --------------- - -Samba is a SMB file server that runs on Unix and other operating -systems. It allows these operating systems (currently Unix, Netware, -OS/2 and AmigaDOS) to act as a file and print server for SMB and CIFS -clients. There are many Lan-Manager compatible clients such as -LanManager for DOS, Windows for Workgroups, Windows NT, Windows 95, -Linux smbfs, OS/2, Pathworks and more. - -The package also includes a SMB client for accessing other SMB servers, -and an advanced netbios/WINS nameserver for browsing support. - - -What can it do for me? ----------------------- - -If you have any PCs running SMB clients, such as a PC running Windows -for Workgroups, then you can mount file space or printers on a Samba -host, so that directories, files and printers on the host are -available on the PC. - -If you have any SMB servers such as Windows NT Server, Warp Server or -Pathworks you may be able to replace them by or supplement them with -Samba. One of Samba's big strengths is integration, so you can use it -to tie together your Unix (or VMS etc) hosts and PC clients. If you -are tired of the insecurity, expense and instability of PCNFS then Samba -may be for you. - -The client part of the package will also allow you to attach to other -SMB-based servers (such as windows NT and windows for workgroups) so -that you can copy files to and from your unix host. The client also -allows you to access a SMB printer (such as one attached to an OS/2 or -WfWg server) from Unix, using an entry in /etc/printcap, or by -explicitly specifying the command used to print files. - - -What are its features? ------------------------- - -Samba supports many features that are not supported in other SMB -implementations (all of which are commercial). These include host as -well as username/password security, a client, automatic home directory -exporting, automatic printer exporting, dead connection timeouts, -umask support, guest connections, name mangling and hidden and system -attribute mapping. Look at the FAQs included with the package for -a full list of features. - - -What's new since 2.0? ---------------------- - -Lots of stuff. See the change log and man pages for details. -In particular, please check the WHATSNEW.txt file in the root directory -of each release. This file has current change/update information. - - -Where can I get a client for my PC? ------------------------------------ - -There is a free client for MS-DOS based PCs available from -ftp.microsoft.com in the directory bussys/Clients/MSCLIENT/. Please -read the licencing information before downloading. The add-on 32-bit -TCP/IP Windows for Workgroups client is also very good. Windows 95/98/ME, -Windows NT/2000 and OS/2 come with suitable clients by default. - - -What network protocols are supported? -------------------------------------- - -Currently only TCP/IP is supported. There has been some discussion -about ports to other protocols but nothing is yet available. - -There is a free TCP/IP implementation for Windows for Workgroups -available from ftp.microsoft.com (it's small, fast and quite reliable). - - -How much does it cost? ----------------------- - -Samba software is free software. It is available under the -GNU Public licence in source code form at no cost. Please read the -file COPYING that comes with the package for more information. - - -What operating systems does it support? ---------------------------------------- - -The code has been written to be as portable as possible. It has been -"ported" to many unixes, which mostly required changing only a few -lines of code. It has been run (to my knowledge) on at least these -unixes: - -Linux, SunOS, Solaris, SVR4, Ultrix, OSF1, AIX, BSDI, NetBSD, -Sequent, HP-UX, SGI, FreeBSD, NeXT, ISC, A/UX, SCO, Intergraph, -Silicon Graphics Inc., Domain/OS and DGUX. - -Some of these have received more testing than others. If it doesn't -work with your unix then it should be easy to fix. It has also been ported -to Netware, OS/2 and the Amiga. A VMS port is available too. See the web site -for more details. - - -Who wrote it? -------------- - -Many people on the internet have contributed to the development of -Samba. The maintainer and original author is Andrew Tridgell, but -large parts of the package were contributed by several people from all -over the world. Please look at the file `change-log' for information -on who did what bits. - - -Where can I get it? -------------------- - -The package is available via anonymous ftp from samba.org in -the directory pub/samba/. - - -What about SMBServer? ---------------------- - -Samba used to be known as SMBServer, until it was pointed out that -Syntax, who make a commercial Unix SMB based server, have trademarked -that name. The name was then changed to Samba. Also, in 1992 a very -early incarnation of Samba was distributed as nbserver. - -If you see any copies of nbserver or smbserver on ftp sites please let -me or the ftp archive maintainer know, as I want to get them deleted. - - -Where can I get more info? ---------------------------- - -Please join the mailing list if you want to discuss the development or -use of Samba. To join the mailing list, please read the instructions -at http://lists.samba.org/ - -There is also often quite a bit of discussion about Samba on the -newsgroup comp.protocols.smb. - -A WWW site with lots of Samba info can be found at -http://samba.org/samba/ - -The Samba Team (Contact: samba@samba.org) -March 2001 diff --git a/docs/docbook/faq/config.xml b/docs/docbook/faq/config.xml deleted file mode 100644 index 2c17c86c4e..0000000000 --- a/docs/docbook/faq/config.xml +++ /dev/null @@ -1,37 +0,0 @@ - -Configuration problems - - -I have set 'force user' and samba still makes 'root' the owner of all the files I touch! - -When you have a user in 'admin users', samba will always do file operations for -this user as 'root', even if 'force user' has been set. - - - - -I have just installed samba and I'm trying to log in from Windows, but samba refuses all logins! - - -Newer windows clients(NT4, 2000, XP) send encrypted passwords. Samba can't compare these -passwords to the unix password database, so it needs it's own user database. You can -add users to this database using "smbpasswd -a user-name". - - - -See also the "User database" chapter of the samba HOWTO Collection. - - - - -How can I make samba use netbios scope ID's - -By default Samba uses a blank scope ID. This means -all your windows boxes must also have a blank scope ID. -If you really want to use a non-blank scope ID then you will -need to use the 'netbios scope' smb.conf option. -All your PCs will need to have the same setting for -this to work. Scope ID's are not recommended. - - - diff --git a/docs/docbook/faq/printing.xml b/docs/docbook/faq/printing.xml deleted file mode 100644 index be2acbd905..0000000000 --- a/docs/docbook/faq/printing.xml +++ /dev/null @@ -1,38 +0,0 @@ - - - - - RonanWaide - - - -Printing problems - - -setdriver or cupsaddsmb failes - -setdriver expects the following setup: - - -you are a printer admin, or root. this is the smb.conf printer admin group, not the Printer Operators group in NT. I've not tried the latter, but I don't believe it will work based on the current code. -printer admins has to be defined in [global] -upload the driver files to \\server\print$\w32x86 and win40 as appropriate. DON'T put them in the 0 or 2 subdirectories. -Make sure that the user you're connecting as is able to write to the print$ directories -Use adddriver (with appropriate parameters) to create the driver. note, this will not just update samba's notion of drivers, it will also move the files from the w32x86 and win40 directories to an appropriate subdirectory (based on driver version, I think, but not important enough for me to find out) -Use setdriver to associate the driver with a printer - - - - -The setdriver call will fail if the printer doesn't already exist in -samba's view of the world. Either create the printer in cups and -restart samba, or create an add printer command (see smb.conf doco) -and use RPC calls to create a printer. NB the add printer command MUST -return a single line of text indicating which port the printer was -added on. If it doesn't, Samba won't reload the printer -definitions. Although samba doesn't really support the notion of -ports, suitable add printer command and enumport command settings can -allow you pretty good remote control of the samba printer setup. - - - diff --git a/docs/docbook/manpages/profiles.1.sgml b/docs/docbook/manpages/profiles.1.sgml deleted file mode 100644 index 6fd2b6fd86..0000000000 --- a/docs/docbook/manpages/profiles.1.sgml +++ /dev/null @@ -1,86 +0,0 @@ - %globalentities; -]> - - - - profiles - 1 - - - - - profiles - A utility to report and change SIDs in registry files - - - - - - profiles - -v - -c SID - -n SID - file - - - - - DESCRIPTION - - This tool is part of the Samba - 7 suite. - - profiles is a utility that - reports and changes SIDs in windows registry files. It currently only - supports NT. - - - - - - OPTIONS - - - - file - Registry file to view or edit. - - - - - -v,--verbose - Increases verbosity of messages. - - - - - -c SID1 -n SID2 - Change all occurences of SID1 in file by SID2. - - - - &stdarg.help; - - - - - - VERSION - - This man page is correct for version 3.0 of the Samba - suite. - - - - AUTHOR - - The original Samba software and related utilities - were created by Andrew Tridgell. Samba is now developed - by the Samba Team as an Open Source project similar - to the way the Linux kernel is developed. - - The profiles man page was written by Jelmer Vernooij. - - - diff --git a/docs/docbook/smbdotconf/base/adsserver.xml b/docs/docbook/smbdotconf/base/adsserver.xml deleted file mode 100644 index 4dd2a4b635..0000000000 --- a/docs/docbook/smbdotconf/base/adsserver.xml +++ /dev/null @@ -1,15 +0,0 @@ - - - If this option is specified, samba does not try to figure out what - ads server to use itself, but uses the specified ads server. Either one - DNS name or IP address can be used. - - Default: ads server = - - Example: ads server = 192.168.1.2 - - - diff --git a/docs/docbook/smbdotconf/expand-smb.conf.xsl b/docs/docbook/smbdotconf/expand-smb.conf.xsl deleted file mode 100644 index 62fc4a9ccf..0000000000 --- a/docs/docbook/smbdotconf/expand-smb.conf.xsl +++ /dev/null @@ -1,87 +0,0 @@ - - - - - - - - - - - - -<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" - "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [ - -<!ENTITY % globalentities SYSTEM './../global.ent'> %globalentities; -]> - - - - - - - - - - - - - - - - - - - Processing samba:parameter ( - - ) - - - - - - - - - - - - - - - ( - - ) - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/smbdotconf/ldap/ldaptrustids.xml b/docs/docbook/smbdotconf/ldap/ldaptrustids.xml deleted file mode 100644 index 36bbcb2fb4..0000000000 --- a/docs/docbook/smbdotconf/ldap/ldaptrustids.xml +++ /dev/null @@ -1,23 +0,0 @@ - - - - Normally, Samba validates each entry in the LDAP server - against getpwnam(). This allows LDAP to be used for Samba with - the unix system using NIS (for example) and also ensures that - Samba does not present accounts that do not otherwise exist. - - - This option is used to disable this functionality, and - instead to rely on the presence of the appropriate attributes - in LDAP directly, which can result in a significant performance - boost in some situations. Setting this option to yes effectivly - assumes that the local machine is running nss_ldap against the same LDAP - server. - - Default: ldap trust ids = No - - diff --git a/docs/docbook/smbdotconf/printing/totalprintjobs.xml b/docs/docbook/smbdotconf/printing/totalprintjobs.xml deleted file mode 100644 index ccdb137a69..0000000000 --- a/docs/docbook/smbdotconf/printing/totalprintjobs.xml +++ /dev/null @@ -1,22 +0,0 @@ - - - This parameter accepts an integer value which defines - a limit on the maximum number of print jobs that will be accepted - system wide at any given time. If a print job is submitted - by a client which will exceed this number, then smbd - 8 will return an - error indicating that no space is available on the server. The - default value of 0 means that no such limit exists. This parameter - can be used to prevent a server from exceeding its capacity and is - designed as a printing throttle. See also - max print jobs. - - - Default: total print jobs = 0 - - Example: total print jobs = 5000 - - diff --git a/docs/docbook/smbdotconf/security/nonunixaccountrange.xml b/docs/docbook/smbdotconf/security/nonunixaccountrange.xml deleted file mode 100644 index 4004af2d94..0000000000 --- a/docs/docbook/smbdotconf/security/nonunixaccountrange.xml +++ /dev/null @@ -1,25 +0,0 @@ - - - The non unix account range parameter specifies - the range of 'user ids' that are allocated by the various 'non unix - account' passdb backends. These backends allow - the storage of passwords for users who don't exist in /etc/passwd. - This is most often used for machine account creation. - This range of ids should have no existing local or NIS users within - it as strange conflicts can occur otherwise. - - - These userids never appear on the system and Samba will never - 'become' these users. They are used only to ensure that the algorithmic - RID mapping does not conflict with normal users. - - - - Default: non unix account range = <empty string> - - Example: non unix account range = 10000-20000 - - diff --git a/docs/docbook/smbdotconf/smb.conf.5.xml b/docs/docbook/smbdotconf/smb.conf.5.xml index db8eb81c28..2a5d190f69 100644 --- a/docs/docbook/smbdotconf/smb.conf.5.xml +++ b/docs/docbook/smbdotconf/smb.conf.5.xml @@ -396,10 +396,10 @@ alias|alias|alias|alias... the architecture of the remote machine. Only some are recognized, and those may not be 100% reliable. It currently recognizes Samba, WfWg, Win95, - WinNT, Win2k, WinXP, and Win2K3. Anything else will be known as + WinNT and Win2k. Anything else will be known as "UNKNOWN". If it gets it wrong then sending a level - 3 log to samba-technical@samba.org - should allow it to be fixed. + 3 log to samba@samba.org + should allow it to be fixed. @@ -507,11 +507,9 @@ alias|alias|alias|alias... case sensitive = yes/no - controls whether filenames are case sensitive. - Windows clients will break if you enable - this parameter. It is only included for case insentive - file systems (such as VFAT) and performance testing. - Default no. + controls whether filenames are case sensitive. If + they aren't then Samba must do a filename search and match on passed + names. Default no. diff --git a/docs/docbook/smbdotconf/tuning/statcachesize.xml b/docs/docbook/smbdotconf/tuning/statcachesize.xml deleted file mode 100644 index 0c8d4e0c72..0000000000 --- a/docs/docbook/smbdotconf/tuning/statcachesize.xml +++ /dev/null @@ -1,12 +0,0 @@ - - - This parameter determines the number of - entries in the stat cache. You should - never need to change this parameter. - - Default: stat cache size = 50 - - diff --git a/docs/docbook/smbdotconf/vfs/vfsoptions.xml b/docs/docbook/smbdotconf/vfs/vfsoptions.xml deleted file mode 100644 index d07ec461e2..0000000000 --- a/docs/docbook/smbdotconf/vfs/vfsoptions.xml +++ /dev/null @@ -1,12 +0,0 @@ - - - This parameter allows parameters to be passed - to the vfs layer at initialization time. - See also - vfs object. - - Default: no value - - diff --git a/docs/docbook/smbdotconf/vfs/vfspath.xml b/docs/docbook/smbdotconf/vfs/vfspath.xml deleted file mode 100644 index c6718a0076..0000000000 --- a/docs/docbook/smbdotconf/vfs/vfspath.xml +++ /dev/null @@ -1,13 +0,0 @@ - - - This parameter specifies the directory - to look in for vfs modules. The name of every vfs object - will be prepended by this directory. - - Default: vfs path = - - Example: vfs path = /usr/lib/samba/vfs - - diff --git a/docs/docbook/xslt/db2latex/VERSION.xml b/docs/docbook/xslt/db2latex/VERSION.xml deleted file mode 100644 index 70bbf95e88..0000000000 --- a/docs/docbook/xslt/db2latex/VERSION.xml +++ /dev/null @@ -1,21 +0,0 @@ - - - - -0.7.1 -0.7 - - - - HEAD - - - - - - - diff --git a/docs/docbook/xslt/db2latex/abstract.mod.xsl b/docs/docbook/xslt/db2latex/abstract.mod.xsl deleted file mode 100644 index a9bc2e02ce..0000000000 --- a/docs/docbook/xslt/db2latex/abstract.mod.xsl +++ /dev/null @@ -1,92 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000200120022003 - Ramon Casellas - - - Abstract <filename>abstract.mod.xsl</filename> - -

    Introduction - This file abstract.mod.xsl contains a single - XSL template for abstract. - - Calls map.begin. - Processes children with xsl:apply-templates. - Calls map.end - The abstract/title template is empty. - -
    - - - - - - - - - - - - Abstract XSL template. - - Calls template (map.begin), - to output the opening command (by default): - - % -------------------------------------------- - % Abstract - % -------------------------------------------- - \begin{abstract} - - Calls "apply-templates" for all the children, and calls template - (map.end) to output the closing - command. - Remarks and Bugs - - The title of the abstract is lost. - The template for abstract/title is defined EMPTY. - - - - Default Behaviour - - Fill - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/admonition.mod.xsl b/docs/docbook/xslt/db2latex/admonition.mod.xsl deleted file mode 100644 index 56042a610e..0000000000 --- a/docs/docbook/xslt/db2latex/admonition.mod.xsl +++ /dev/null @@ -1,222 +0,0 @@ - - - - - - - - - - - - - Ramon Casellas - James Devenish - - 2000200120022003 - Ramon Casellas - - - - Admonition XSL Variables and Templates <filename>admonition.mod.xsl</filename> - - -
    Introduction - DocBook includes admonitions, which are set off from the main text. -
    - Pertinent Variables - - - - - - - -     -     - - - - - - Declares a new environment to be used for admonitions - (warning, tip, important, caution, note). - - - - A LaTeX environment is emitted. That environment has two mandatory parameters. - Instances of the environment are customised for each admonition via those parameters. - Instances will be typeset as boxed areas in the document flow. - - - The first argument is the filename for graphics (e.g $latex.admonition.path/warning). - The second argument is the admonition title or the associated generic text. - - - It requires the LaTeX fancybox package. - It also uses graphics, by default. - - - Processing the <sgmltag class="element">warning</sgmltag> admonition - When processing the admonition, the following code is generated: - - - - - - - - -% ---------------------------------------------- -% Define a new LaTeX environment (adminipage) -% ---------------------------------------------- -\newenvironment{admminipage}% -{ % this code corresponds to the \begin{adminipage} command - \begin{Sbox}% - \begin{minipage}% -} %done -{ % this code corresponds to the \end{adminipage} command - \end{minipage} - \end{Sbox} - \fbox{\TheSbox} -} %done -% ---------------------------------------------- -% Define a new LaTeX length (admlength) -% ---------------------------------------------- -\newlength{\admlength} -% ---------------------------------------------- -% Define a new LaTeX environment (admonition) -% With 2 parameters: -% #1 The file (e.g. note.pdf) -% #2 The caption -% ---------------------------------------------- -\newenvironment{admonition}[2] -{ % this code corresponds to the \begin{admonition} command - \hspace{0mm}\newline\hspace*\fill\newline - \noindent - \setlength{\fboxsep}{5pt} - \setlength{\admlength}{\linewidth} - \addtolength{\admlength}{-10\fboxsep} - \addtolength{\admlength}{-10\fboxrule} - \admminipage{\admlength} - {\bfseries \sc\large{#2}} - \newline - \\[1mm] - \sffamily - - - % - - \includegraphics[ ]{#1} - \addtolength{\admlength}{-1cm} - \addtolength{\admlength}{-20pt} - \begin{minipage}[lt]{\admlength} - \parskip=0.5\baselineskip \advance\parskip by 0pt plus 2pt -} %done -{ % this code corresponds to the \end{admonition} command - \vspace{5mm} - \end{minipage} - \endadmminipage - \vspace{.5em} - \par -} - - - - - - - - - Choose an admonition graphic - - For each admonition element (note, warning, caution, top, important), - this template chooses the graphics filename. If the admonition element is - not known, the note graphic is used. - - - - - - - - - note - warning - caution - tip - important - note - - - - - - - - XSL Template for admonitions - - Uses the . - - An admonition will look something like this. - Remarks and Bugs - - - - There can be excessive whitespace between - the bottom of the admonition area and a subsequent paragraph. - - - - - - - - - - - admonition - - { - / - - }{ - - - - - - - - - - - } - - - - - admonition - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/authorgroup.mod.xsl b/docs/docbook/xslt/db2latex/authorgroup.mod.xsl deleted file mode 100644 index 6ec7460def..0000000000 --- a/docs/docbook/xslt/db2latex/authorgroup.mod.xsl +++ /dev/null @@ -1,78 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Authorgroup <filename>authorgroup.mod.xsl</filename> - -
    Introduction - Pertinent Variables - - - - -
    -     -     - - - - - - Authorgroup XSL template. - - - - - - - - - \and - - - - - - - - - - - AuthorInitials XSL template. - - - - - - - - - -     - diff --git a/docs/docbook/xslt/db2latex/biblio.mod.xsl b/docs/docbook/xslt/db2latex/biblio.mod.xsl deleted file mode 100644 index 9524015b1e..0000000000 --- a/docs/docbook/xslt/db2latex/biblio.mod.xsl +++ /dev/null @@ -1,605 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000200120022003 - Ramon Casellas - - - - Bibliography related XSL Variables and Templates <filename>biblio.mod.xsl</filename> - - -
    Introduction - This reference describes the templates and parameters relevant - to formatting DocBook bibliography markup. -
    -
    All Vs. Cited mode - Using this option, only the biblioentries that have been - cited somewhere in the document are output. Otherwise (in All mode) - all bibentries found are output (as the HTML stylesheets do). -
    -     -     - - - - - - - - - - bibliography XSL template - - Remarks and Bugs - - - - - - - - - DB2LaTeX: Processing BIBLIOGRAPHY - DB2LaTeX: Output Mode : - % ------------------------------------------- - % - % Bibliography - % - % ------------------------------------------- - \bibliography{} - - \begin{thebibliography}{ - - } - - - - - - - - - - - - - - - - - - - - - - - - - - \end{thebibliography} - - - - - - - - - - - - - - - bibliography XSL template - - Remarks and Bugs - - - - - - - - - DB2LaTeX: Processing BIBLIOGRAPHY - BIBLIODIV - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - bibliography XSL template - - Remarks and Bugs - - - - - - - - - - - - - - - - - - - - - - bibliography XSL template - - Remarks and Bugs - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - % -------------- biblioentry - - - \bibitem - - - \bibitem[ - - - - ] - - - { - - }\docbooktolatexbibaux{ - - }{ - - } \hypertarget{ - - }{\emph{ }} - - - - - - - . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ldquo - - - - rdquo - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - copyright - - - - - - - - - , - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/block.mod.xsl b/docs/docbook/xslt/db2latex/block.mod.xsl deleted file mode 100644 index 49aba64ca2..0000000000 --- a/docs/docbook/xslt/db2latex/block.mod.xsl +++ /dev/null @@ -1,174 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000200120022003 - Ramon Casellas - - - Block Objects <filename>block.mod.xsl</filename> - -
    Introduction - Sundry block-formatted objects. -
    -     -     - - - - - - Generic handler for block-formatted objects. - - - - Calls and then applies templates. - - - - - - - - - - - - A quotation set off from the main text (not inline). - - - - Uses the LaTeX quote environment. - If an attribution is present, it will be set at the end. - - - - - - \begin{quote} - - - \end{quote} - - - - - A short inscription that occurs at the beginning of a section, chapter, or document. - - - - Uses the LaTeX quote environment. - If an attribution is present, it will be set at the end. - - - - - - \begin{quote} - - - \end{quote} - - - - - This template produces no output. - - - - The attribution element only occurs within - and . - However, the templates for those elements use a mode mechanism. - Therefore, this template is intentionally suppressed and a replacement exists. - See instead. - - - - - - - - - The source of a block quote or epigraph. - - - - Starts a new line with right-aligned text preceded by an em dash. - - - - - - \hspace*\fill--- - - - - - - A block of text that is isolated from the main flow. - - - - This is formatted as a plain block. - - - - - - - - - - - Title lines for sundry block elements. - - - - This is formatted as a line on its own. - - - - - - - - - - - - Acknowledgements in an Article. - - - - This is formatted as a plain block. - - - - - - - - - -     - diff --git a/docs/docbook/xslt/db2latex/book-article.mod.xsl b/docs/docbook/xslt/db2latex/book-article.mod.xsl deleted file mode 100644 index 042ec556aa..0000000000 --- a/docs/docbook/xslt/db2latex/book-article.mod.xsl +++ /dev/null @@ -1,540 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Books and Articles <filename>book-article.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - - Book XSL Template - - Most DocBook documents are either articles or books, so the book - XSL template is one classical entry point - when processign docbook documents. - - Tasks - - - - - - Remarks and Bugs - - - - - - - - colwidth - - The CALS column width specification. - - - - - - :Outputs the LaTeX Code corresponding to a book. - - - - - - - - - - - - - - - - \title{ - - - - - - - - - - - } - - \author{ - - - - - - - - - \and - - - - - } - - - - \setcounter{tocdepth}{} - \setcounter{secnumdepth}{} - - - - - - \InputIfFileExists{ - }{\typeout{WARNING: Using cover page - - }} - - - - - - - - - - - - - - - - - - - - - - \bfseries - \\[12pt]\normalsize - \bfseries - \\[12pt]\normalsize - - - - - - - - - - - - - - - - Article XSL Template - - Most DocBook documents are either articles or books, so the article - XSL template is one classical entry point - when processign docbook documents. - - Tasks - - Calls generate.latex.article.preamble. - Outputs \title, \author, \date, getting the information from its children. - Calls latex.article.begindocument. - Calls latex.article.maketitle. - Applies templates. - Calls latex.article.end template. - - - - Remarks and Bugs - - EMPTY templates: article/title and article/subtitle - - - - - - - colwidth - - The CALS column width specification. - - - - - - Outputs the LaTeX Code corresponding to an article. - - - - - - - \makeatletter\if@openright\cleardoublepage\else\clearpage\fi - - \makeatother - - - - - - - - - - - - - - - \begin{center}{ - - { - - }}\par - - - - \textsf{ - - - - \and - - - }\par - - - \textsf{ - - }\par - - - \textsf{ - - - - \and - - - }\par - - - \textsf{ - - }\par - - - \textsf{ - - - - \and - - - }\par - - - - \end{center} - - - - - - - - - - - - - - - - - - - - - - - - - - - - \title{ - - { - - }} - - - - - - \date{ - - } - - \author{ - - - - - - - - - - - - \and - - - - - - - - \and - - - - - - - - \and - - - - - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - copyright - - - - - - - - - - - - - , - - - - - - , - - - - - - - - - - - - - - - - - - legalnotice - - - - - - - - - - - \vspace{-.3em} - \if@twocolumn - \noindent\small{\itshape - - }\/\bfseries---$\!$% - \else - \noindent\begin{center}\small\bfseries - - \end{center}\quotation\small - \fi - - \vspace{0.6em}\par\if@twocolumn\else\endquotation\fi - \normalsize\rmfamily - - - - - - - - - - - - - - \tableofcontents - - - - - - - - \listoffigures - - - \listoftables - - - \listoffigures - \listoftables - - - - - \listoffigures - \listoftables - - - - - - - - - - - - - - Choose the preferred page style for document body - - - If no page style is preferred by the user, the defaults will be - "empty" for articles, "plain" for books, or "fancy" (if the - fancyhdr packages is permitted). - - Pertinent Variables - - - - - - - - - \pagestyle{ - - - - - fancy - plain - - - empty - - } - - -     - diff --git a/docs/docbook/xslt/db2latex/bridgehead.mod.xsl b/docs/docbook/xslt/db2latex/bridgehead.mod.xsl deleted file mode 100644 index a09ca15dda..0000000000 --- a/docs/docbook/xslt/db2latex/bridgehead.mod.xsl +++ /dev/null @@ -1,71 +0,0 @@ - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - BridgeHead <filename>bridgehead.mod.xsl</filename> - -
    Introduction - Handle the bridgehead element. -
    -     -     - - - - - A free-floating heading. - - - - Renders un-numbered section headings. - For renderas values of sect1, sect2, and sect3, LaTeX star commands (such as \section*) are used. - Otherwise, a bold heading is put on a line of its own. - - - - - - - - \ - sub - subsub - section*{ - - } - - - - - - \noindent{\bfseries } \\ - - - - - -     diff --git a/docs/docbook/xslt/db2latex/callout.mod.xsl b/docs/docbook/xslt/db2latex/callout.mod.xsl deleted file mode 100644 index ab67cf8e23..0000000000 --- a/docs/docbook/xslt/db2latex/callout.mod.xsl +++ /dev/null @@ -1,61 +0,0 @@ - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Callout <filename>callout.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - - - - - - - - - - ( - - ) - - -     diff --git a/docs/docbook/xslt/db2latex/citation.mod.xsl b/docs/docbook/xslt/db2latex/citation.mod.xsl deleted file mode 100644 index 46c69af0eb..0000000000 --- a/docs/docbook/xslt/db2latex/citation.mod.xsl +++ /dev/null @@ -1,63 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Citation <filename>citation.mod.xsl</filename> - -
    Introduction - This file contais a single (and simple!) XSL template, that maps the - citation SGML tag to the LaTeX \cite{} - command. -
    -     -     - - - - - - Citation XSL template. - - Outputs a simple \cite{ } Command, - containing the result of processing the citation's children - - - - - - - - - \docbooktolatexcite{ - - }{} - - -     - - diff --git a/docs/docbook/xslt/db2latex/common/ca.xml b/docs/docbook/xslt/db2latex/common/ca.xml deleted file mode 100644 index fec3efff1a..0000000000 --- a/docs/docbook/xslt/db2latex/common/ca.xml +++ /dev/null @@ -1,100 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/common.xsl b/docs/docbook/xslt/db2latex/common/common.xsl deleted file mode 100644 index 2506bd71ed..0000000000 --- a/docs/docbook/xslt/db2latex/common/common.xsl +++ /dev/null @@ -1,1927 +0,0 @@ - - - - - - - - - Ramon - Casellas - - - 19992000 - Norman Walsh - - -Common Template Reference - - -
    Introduction - -This is technical reference documentation for the DocBook XSL -Stylesheets; it documents (some of) the parameters, templates, and -other elements of the stylesheets. - -This is not intended to be user documentation. -It is provided for developers writing customization layers for the -stylesheets, and for anyone who's interested in how it -works. - -Although I am trying to be thorough, this documentation is known -to be incomplete. Don't forget to read the source, too :-) -
    -     - -     - - - - - - - - - - - -Tests if a given node is a component-level element - - -This template returns '1' if the specified node is a component -(Chapter, Appendix, etc.), and '0' otherwise. - - - - -node - -The node which is to be tested. - - - - - - -This template returns '1' if the specified node is a component -(Chapter, Appendix, etc.), and '0' otherwise. - - - - - - - 1 - 0 - - - - - - -Tests if a given node is a section-level element - - -This template returns '1' if the specified node is a section -(Section, Sect1, Sect2, etc.), and '0' otherwise. - - - - -node - -The node which is to be tested. - - - - - - -This template returns '1' if the specified node is a section -(Section, Sect1, Sect2, etc.), and '0' otherwise. - - - - - - - 1 - 0 - - - - - - -Returns the hierarchical level of a section. - - -This template calculates the hierarchical level of a section. -Hierarchically, components are top level, so a -sect1 is at level 2, sect3 is -at level 3, etc. - -Recursive sections are calculated down to the sixth level. - - - - -node - -The section node for which the level should be calculated. -Defaults to the context node. - - - - - - -The section level, 2, 3, etc. - - - - - - - - 2 - 3 - 4 - 5 - 6 - - - 6 - 5 - 4 - 3 - 2 - - - - - 3 - 4 - 5 - 6 - 6 - - - 6 - 5 - 4 - 3 - - - 2 - - - 2 - - - - -Returns the hierarchical level of a QandASet. - - -This template calculates the hierarchical level of a QandASet. - - - - -The level, 1, 2, etc. - - - - - - - - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - . - - - - - - - - - - - - - - - - - - - - - , - - - - - - - - - - - - - - - - - - - - , - - - and - - - - - - - - - - - - -[ -] -{ -} - - -[ -] -... - - - | -4pi - - - - - -Provides access to element labels - -Processing an element in the -label.content mode produces the -element label. -If the label is non-null, either because the -label attribute was present on the -element or the stylesheet automatically generated a label, trailing -punctuation is automatically added. - - - - - - Request for label of unexpected element: - - - - - - . - - - - - - - - . - - - - - - - - - - - - - - . - - - - - - - - - - - - - - . - - - - - - - - - - - - - - . - - - - - - - - - - - - - - . - - - - - - - - . - - - - - - - - . - - - - - - - - - - - - - - . - - - - - - - - . - - - - - . - - - - - - - - - - - - - - - - - - - - . - - - - - - - - - - - - - - - - - . - - - - - - - - - - . - - - - - - - - - - - - - - - - - . - - - - . - - - - - - - - - - - - - - - - - - - - - - - label.content: this can't happen! - - - - - - - - - . - - - - - - - - - - - - - - . - - - - - - - - - - - - - - . - - - - - - - - - - - - - - - - - - - - - - - - . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - . - - - - - - - - . - - - - - - - - - - - . - - - - - - - - - - - - - - - . - - - - - - - - - - -Returns true if $section should be labelled - -Returns true if the specified section should be labelled. -By default, this template simply returns $section.autolabel, but -custom stylesheets may override it to get more selective behavior. - - - - - - - -Provides access to element titles - -Processing an element in the -title.content mode produces the -title of the element. This does not include the label. If -text-only is true, the text of the title -is returned, without inline markup, otherwise inline markup is processed -(in the default mode). By default, text-only -is false. - - - - - - - - - - - - - - - - - Request for title of unexpected element: - - - ???TITLE??? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - REFENTRY WITHOUT TITLE??? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Provides access to element subtitles - -Processing an element in the -subtitle.content mode produces the -subtitle of the element. If -text-only is true, the text of the title -is returned, without inline markup, otherwise inline markup is processed -(in the default mode). By default, text-only -is false. - - - - - - - Request for subtitle of unexpected element: - - - ???SUBTITLE??? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Provides reference text for an element - -Processing an element in the -title.ref mode produces the -label and title of the element. - - - - -text-only - - If -text-only is true, the text of the title -is returned, without inline markup, otherwise inline markup is processed -(in the default mode). By default, text-only -is false. - - -label-wrapper - -If label-wrapper is not the emtpy string, -it must be the name of an element. The element so named will be wrapped -around labels on output. - - -title-wrapper - -If title.wrapper is not the emtpy string, -it must be the name of an element. The element so named will be wrapped -around titles on output. - - -label-wrapper-class - -If a label-wrapper is provided and -label-wrapper-class is not the emtpy string, -it be used as the value for a class -attribute on the label-wrapper element. -This is a dirty hack because it only makes sense for the HTML -stylesheet (there's no class attribute -on the FO elements). What I'd really like to do is pass an attribute -set as a parameter, but I can't. - - -title-wrapper-class - -If a title-wrapper is provided and -title-wrapper-class is not the emtpy string, -it be used as the value for a class -attribute on the title-wrapper element. -This is a dirty hack because it only makes sense for the HTML -stylesheet (there's no class attribute -on the FO elements). What I'd really like to do is pass an attribute -set as a parameter, but I can't. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - %g - - - - - - - - - - - - - - - - - - - - - - %t - - - - - - - - - - - - - - - - - - - - - - - - - - - - %n - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Selects an appropriate media object from a list - - -This template examines a list of media objects (usually the -children of a mediaobject or inlinemediaobject) and processes -the "right" object. - -This template relies on a template named "is.acceptable.mediaobject" -to determine if a given object is an acceptable graphic. The semantics -of media objects is that the first acceptable graphic should be used. - - -If no acceptable object is located, nothing happens. - - - - -olist - -The node list of potential objects to examine. - - - - - - -Calls <xsl:apply-templates> on the selected object. - - - - - - 1 - - - - - - - - - 0 - - - - 1 - - - - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Returns '1' if the specified media object is recognized. - - -This template examines a media object and returns '1' if the -object is recognized as a graphic. - - - - -object - -The media object to consider. - - - - - - -0 or 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1 - 1 - 0 - - - - - - 1 - - - - - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - . - - - - - - - - - - - - . - - - - - - - - - - - - - - - - -Warn users about references to non-unique IDs - -If passed an ID in linkend, -check.id.unique prints -a warning message to the user if either the ID does not exist or -the ID is not unique. - - - - - - - - - - - - Error: no ID for constraint linkend: - - . - - - - - - Warning: multiple "IDs" for constraint linkend: - - . - - - - - - -Warn users about incorrectly typed references - -If passed an ID in linkend, -check.idref.targets makes sure that the element -pointed to by the link is one of the elements listed in -element-list and warns the user otherwise. - - - - - - - - - - - - - - Error: linkend ( - - ) points to " - - " not (one of): - - - - - - - - - -     - diff --git a/docs/docbook/xslt/db2latex/common/cs.xml b/docs/docbook/xslt/db2latex/common/cs.xml deleted file mode 100644 index 81c9c5a9cb..0000000000 --- a/docs/docbook/xslt/db2latex/common/cs.xml +++ /dev/null @@ -1,110 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/da.xml b/docs/docbook/xslt/db2latex/common/da.xml deleted file mode 100644 index 959050230f..0000000000 --- a/docs/docbook/xslt/db2latex/common/da.xml +++ /dev/null @@ -1,98 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/de.xml b/docs/docbook/xslt/db2latex/common/de.xml deleted file mode 100644 index 8c458b0f5e..0000000000 --- a/docs/docbook/xslt/db2latex/common/de.xml +++ /dev/null @@ -1,102 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/el.xml b/docs/docbook/xslt/db2latex/common/el.xml deleted file mode 100644 index ad93032047..0000000000 --- a/docs/docbook/xslt/db2latex/common/el.xml +++ /dev/null @@ -1,104 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/en.xml b/docs/docbook/xslt/db2latex/common/en.xml deleted file mode 100644 index 2e8500135f..0000000000 --- a/docs/docbook/xslt/db2latex/common/en.xml +++ /dev/null @@ -1,107 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/es.xml b/docs/docbook/xslt/db2latex/common/es.xml deleted file mode 100644 index 78483dfb65..0000000000 --- a/docs/docbook/xslt/db2latex/common/es.xml +++ /dev/null @@ -1,98 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/et.xml b/docs/docbook/xslt/db2latex/common/et.xml deleted file mode 100644 index 4c63adbe7a..0000000000 --- a/docs/docbook/xslt/db2latex/common/et.xml +++ /dev/null @@ -1,104 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/fi.xml b/docs/docbook/xslt/db2latex/common/fi.xml deleted file mode 100644 index 5d25725512..0000000000 --- a/docs/docbook/xslt/db2latex/common/fi.xml +++ /dev/null @@ -1,98 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/fr.xml b/docs/docbook/xslt/db2latex/common/fr.xml deleted file mode 100644 index bf53bc57d6..0000000000 --- a/docs/docbook/xslt/db2latex/common/fr.xml +++ /dev/null @@ -1,114 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/hu.xml b/docs/docbook/xslt/db2latex/common/hu.xml deleted file mode 100644 index d37e06ff8a..0000000000 --- a/docs/docbook/xslt/db2latex/common/hu.xml +++ /dev/null @@ -1,94 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/id.xml b/docs/docbook/xslt/db2latex/common/id.xml deleted file mode 100644 index f85b02154b..0000000000 --- a/docs/docbook/xslt/db2latex/common/id.xml +++ /dev/null @@ -1,104 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/it.xml b/docs/docbook/xslt/db2latex/common/it.xml deleted file mode 100644 index a7e1063ef4..0000000000 --- a/docs/docbook/xslt/db2latex/common/it.xml +++ /dev/null @@ -1,103 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/ja.xml b/docs/docbook/xslt/db2latex/common/ja.xml deleted file mode 100644 index 9180e8e186..0000000000 --- a/docs/docbook/xslt/db2latex/common/ja.xml +++ /dev/null @@ -1,104 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/ko.xml b/docs/docbook/xslt/db2latex/common/ko.xml deleted file mode 100644 index 06dd7cb217..0000000000 --- a/docs/docbook/xslt/db2latex/common/ko.xml +++ /dev/null @@ -1,96 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/l10n.dtd b/docs/docbook/xslt/db2latex/common/l10n.dtd deleted file mode 100644 index 0336baf208..0000000000 --- a/docs/docbook/xslt/db2latex/common/l10n.dtd +++ /dev/null @@ -1,25 +0,0 @@ - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/l10n.xml b/docs/docbook/xslt/db2latex/common/l10n.xml deleted file mode 100644 index a7ef90e905..0000000000 --- a/docs/docbook/xslt/db2latex/common/l10n.xml +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -]> - -&ca; -&cs; -&da; -&de; -⪙ -&en; -&es; -&et; -&fi; -&fr; -&hu; -&id; -⁢ -&ja; -&ko; -&nl; -&no; -&pl; -&pt; -&pt_br; -&ro; -&ru; -&sk; -&sl; -&sv; -&zh_cn; -&zh_tw; - diff --git a/docs/docbook/xslt/db2latex/common/l10n.xsl b/docs/docbook/xslt/db2latex/common/l10n.xsl deleted file mode 100644 index a8b526fc60..0000000000 --- a/docs/docbook/xslt/db2latex/common/l10n.xsl +++ /dev/null @@ -1,248 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - _ - - - - - - - - - - - - - - - - - - - - - - - - - No " - - " cross reference text for " - - " exists and no default specified. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - No " - - " localization of " - - " exists; using "en". - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Editedby - - - - - - by - - - - - bullet - - - - - - - - - - - - No " - - " localization of dingbat - - exists; using "en". - - - - - - - - - - - - - startquote - - - - - - endquote - - - - - - nestedstartquote - - - - - - nestedendquote - - - - - - nav-prev - - - - - - nav-next - - - - - - nav-home - - - - - - nav-up - - - - - diff --git a/docs/docbook/xslt/db2latex/common/nl.xml b/docs/docbook/xslt/db2latex/common/nl.xml deleted file mode 100644 index 56ead54d30..0000000000 --- a/docs/docbook/xslt/db2latex/common/nl.xml +++ /dev/null @@ -1,105 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/no.xml b/docs/docbook/xslt/db2latex/common/no.xml deleted file mode 100644 index b3aba44fde..0000000000 --- a/docs/docbook/xslt/db2latex/common/no.xml +++ /dev/null @@ -1,97 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/pl.xml b/docs/docbook/xslt/db2latex/common/pl.xml deleted file mode 100644 index 8582bbebe8..0000000000 --- a/docs/docbook/xslt/db2latex/common/pl.xml +++ /dev/null @@ -1,96 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/pt.xml b/docs/docbook/xslt/db2latex/common/pt.xml deleted file mode 100644 index af0c22f4b4..0000000000 --- a/docs/docbook/xslt/db2latex/common/pt.xml +++ /dev/null @@ -1,98 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/pt_br.xml b/docs/docbook/xslt/db2latex/common/pt_br.xml deleted file mode 100644 index cf63d1ebf2..0000000000 --- a/docs/docbook/xslt/db2latex/common/pt_br.xml +++ /dev/null @@ -1,98 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/ro.xml b/docs/docbook/xslt/db2latex/common/ro.xml deleted file mode 100644 index a59ffd8217..0000000000 --- a/docs/docbook/xslt/db2latex/common/ro.xml +++ /dev/null @@ -1,104 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/ru.xml b/docs/docbook/xslt/db2latex/common/ru.xml deleted file mode 100644 index a097cd419b..0000000000 --- a/docs/docbook/xslt/db2latex/common/ru.xml +++ /dev/null @@ -1,113 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/sk.xml b/docs/docbook/xslt/db2latex/common/sk.xml deleted file mode 100644 index 0c2fbc85fb..0000000000 --- a/docs/docbook/xslt/db2latex/common/sk.xml +++ /dev/null @@ -1,104 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/sl.xml b/docs/docbook/xslt/db2latex/common/sl.xml deleted file mode 100644 index fca0f5e348..0000000000 --- a/docs/docbook/xslt/db2latex/common/sl.xml +++ /dev/null @@ -1,104 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/sv.xml b/docs/docbook/xslt/db2latex/common/sv.xml deleted file mode 100644 index 27b45cce15..0000000000 --- a/docs/docbook/xslt/db2latex/common/sv.xml +++ /dev/null @@ -1,99 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/zh_cn.xml b/docs/docbook/xslt/db2latex/common/zh_cn.xml deleted file mode 100644 index ef373b4a33..0000000000 --- a/docs/docbook/xslt/db2latex/common/zh_cn.xml +++ /dev/null @@ -1,95 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/common/zh_tw.xml b/docs/docbook/xslt/db2latex/common/zh_tw.xml deleted file mode 100644 index 7168114f49..0000000000 --- a/docs/docbook/xslt/db2latex/common/zh_tw.xml +++ /dev/null @@ -1,98 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/component.mod.xsl b/docs/docbook/xslt/db2latex/component.mod.xsl deleted file mode 100644 index aedcadb550..0000000000 --- a/docs/docbook/xslt/db2latex/component.mod.xsl +++ /dev/null @@ -1,91 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Component <filename>component.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - {\sc } - - - - - - - - {\sc } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -     - diff --git a/docs/docbook/xslt/db2latex/dedication.mod.xsl b/docs/docbook/xslt/db2latex/dedication.mod.xsl deleted file mode 100644 index d8150bdd7f..0000000000 --- a/docs/docbook/xslt/db2latex/dedication.mod.xsl +++ /dev/null @@ -1,126 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Dedication <filename>dedication.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - -\sc - - - - - -\newpage -% ------------------------------------------------------------- -% Dedication -% ------------------------------------------------------------- - - - - - - - - - - - -{ - - - - - - - - - dedication - - - -} - - - - - - - - - - - - - - - - - { - - - - } - - - - - - - - - - - - - - \paragraph*{} - - - -     - diff --git a/docs/docbook/xslt/db2latex/dingbat.mod.xsl b/docs/docbook/xslt/db2latex/dingbat.mod.xsl deleted file mode 100644 index 84b579515a..0000000000 --- a/docs/docbook/xslt/db2latex/dingbat.mod.xsl +++ /dev/null @@ -1,69 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000200120022003 - Ramon Casellas - - - Dingbats <filename>dingbat.mod.xsl</filename> - -
    Introduction -
    -     -     - - - - - bullet - - - - - - - bullet - - $\bullet$ - \copyright{} - \texttrademark{} - \textregistered{} - ~ - `` - '' - ` - ' - --- - --- - -- - -- - - [dingbat?] - - - - -     diff --git a/docs/docbook/xslt/db2latex/docbook.xsl b/docs/docbook/xslt/db2latex/docbook.xsl deleted file mode 100644 index 56e000cd02..0000000000 --- a/docs/docbook/xslt/db2latex/docbook.xsl +++ /dev/null @@ -1,149 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ################################################################################ - XSLT stylesheets DocBook - LaTeX 2e - Reqs: LaTeX 2e installation common packages - ################################################################################ - WWW : http://db2latex.sourceforge.net - SUMMARY : http://www.sourceforge.net/projects/db2latex - AUTHOR : Ramon Casellas casellas@infres.enst.fr - AUTHOR : James Devenish j-devenish@users.sf.net - USING : - ################################################################################ - - - - - - - - - - - - - SAXON 6.4.X - - - SAXON 6.2.X - - - SAXON - - - XALAN - - - XALAN - - - libxslt/xsltproc - - - XT - - - UNKNOWN - - - - - - diff --git a/docs/docbook/xslt/db2latex/email.mod.xsl b/docs/docbook/xslt/db2latex/email.mod.xsl deleted file mode 100644 index 6461334ac8..0000000000 --- a/docs/docbook/xslt/db2latex/email.mod.xsl +++ /dev/null @@ -1,62 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Email <filename>email.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - XSL template for email - - Outputs the mail in {\texttt }. Calls the normalize-scape template in order to get a - normalized email string. It does not process email content model. - Remarks and Bugs - - - - - - - - \texttt{< - - - - >} - - -     diff --git a/docs/docbook/xslt/db2latex/errors.mod.xsl b/docs/docbook/xslt/db2latex/errors.mod.xsl deleted file mode 100644 index 37b273c01d..0000000000 --- a/docs/docbook/xslt/db2latex/errors.mod.xsl +++ /dev/null @@ -1,16 +0,0 @@ - - - - - - - DB2LaTeX: Need to process XPath match - [] - - [/] - - diff --git a/docs/docbook/xslt/db2latex/example.mod.xsl b/docs/docbook/xslt/db2latex/example.mod.xsl deleted file mode 100644 index fb973a27e7..0000000000 --- a/docs/docbook/xslt/db2latex/example.mod.xsl +++ /dev/null @@ -1,76 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Example <filename>example.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - \caption{ - - } - - - - \captionswapskip{} - - \captionswapskip{} - - - - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/figure.mod.xsl b/docs/docbook/xslt/db2latex/figure.mod.xsl deleted file mode 100644 index 823877aa17..0000000000 --- a/docs/docbook/xslt/db2latex/figure.mod.xsl +++ /dev/null @@ -1,127 +0,0 @@ - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Figures and InformalFigures <filename>figure.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - XSL template for figure|informalfigure - - Outputs \begin{figure}, - applies templates and outputs \end{figure}. - Remarks and Bugs - - The figure.title can be typset in italics by specifying $latex.figure.title.style (\itshape would be common). - If a figure.mediaobject.caption exists, it will be typeset after the figure.title (but only if there is a single figure.mediaobject.caption). - - - - - - - - - -\caption{{ - -{ - -}} - - . - - -} - - - - - - - - - - - \captionswapskip{} - - \captionswapskip{} - - - - - - - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/font.mod.xsl b/docs/docbook/xslt/db2latex/font.mod.xsl deleted file mode 100644 index 20e2814520..0000000000 --- a/docs/docbook/xslt/db2latex/font.mod.xsl +++ /dev/null @@ -1,55 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Font <filename>font.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - Document Font - - Possible values: default, times, palatcm, charter, helvet, palatino, avant, newcent, bookman - - - - - palatino - - - -     diff --git a/docs/docbook/xslt/db2latex/footnote.mod.xsl b/docs/docbook/xslt/db2latex/footnote.mod.xsl deleted file mode 100644 index 6e7d39a36a..0000000000 --- a/docs/docbook/xslt/db2latex/footnote.mod.xsl +++ /dev/null @@ -1,82 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - FootNotes <filename>footnote.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - \begingroup\catcode`\#=12\footnote{ - - }\endgroup\docbooktolatexmakefootnoteref{ - - } - - - - Construct a footnote that copes with URLs - This template exists in this file so that all - the footnote-generating templates are close to each other. However, - it is actually a part of the ulink template in xref.mod.xsl - - - - - - \begingroup\catcode`\#=12\footnote{ - - - - - }\endgroup\docbooktolatexmakefootnoteref{ - - } - - - - - - - - - - - \docbooktolatexusefootnoteref{ - - } - - -     diff --git a/docs/docbook/xslt/db2latex/formal.mod.xsl b/docs/docbook/xslt/db2latex/formal.mod.xsl deleted file mode 100644 index 6908119225..0000000000 --- a/docs/docbook/xslt/db2latex/formal.mod.xsl +++ /dev/null @@ -1,173 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Formal Objects <filename>formal.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - before - - - - - - - - - - - - - - - - - - - - - - - \caption{ - - } - - - - \captionswapskip{} - - \captionswapskip{} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/glossary.mod.xsl b/docs/docbook/xslt/db2latex/glossary.mod.xsl deleted file mode 100644 index f429187aee..0000000000 --- a/docs/docbook/xslt/db2latex/glossary.mod.xsl +++ /dev/null @@ -1,218 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - Glossary <filename>glossary.mod.xsl</filename> - -
    Introduction - This reference applies to the glossary element name. Altough LaTeX - provides some glossary support, the better glossary management support - motivates the bypass of the LaTeX \makeglossary - command. -
    -     -     - - - - - - - Glossary XSL template / entry point - The glossary element is the entry point - to a docbook glossary. The DB2LaTeX processing of the element is quite straight- - forward. First thing is to check whether the document is a book or article. In - both cases two new LaTeX commands are defined. \dbglossary - and \dbglossdiv. In the former case, they are mapped to - \chapter* and \section*. In the second - case to \section* and \subsection*. - - - Call template map.begin. - Apply Templates for Preamble, GlossDivs and GlossEntries (serial). - Call template map.end. - - Remarks and Bugs - - Template for glossary/glossaryinfo is EMPTY. - Template for glossary/title | glossary/subtitle is EMPTY. - Template for glossary/titleabbrev is EMPTY. - - - - - - - - - - - - \newcommand{\dbglossary}[1]{\chapter*{#1}}% - \newcommand{\dbglossdiv}[1]{\section*{#1}}% - - - \newcommand{\dbglossary}[1]{\section*{#1}}% - \newcommand{\dbglossdiv}[1]{\subsection*{#1}}% - - - - - - - - - - - - - - - - - - - - - - - - Glossary Division and Glossary Lists XSL templates. - T.B.D - - - Call template map.begin. - Apply Templates. - Call template map.end. - - Remarks and Bugs - - Template for glossdiv/glossaryinfo is EMPTY. - - - - - - - - - - - - - - - - - - - Glossary Entry XSL template / entry point - - T.B.D. - - - Apply Templates. - - Remarks and Bugs - - Explicit Templates for glossentry/glossterm - Explicit Templates for glossentry/acronym - Explicit Templates for glossentry/abbrev - Explicit Templates for glossentry/glossdef - Explicit Templates for glossentry/glosssee - Explicit Templates for glossentry/glossseealso - Template for glossentry/revhistory is EMPTY. - - - - - - - - - - - - - \item[ - - \hypertarget{ - - } - - { - - - - }] - - - - ( \texttt { } ) - - - - [ ] - - - - - - - - - - - - - - - - - - - \hyperlink{ - }{} - - - - - - - . - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/graphic.mod.xsl b/docs/docbook/xslt/db2latex/graphic.mod.xsl deleted file mode 100644 index 1c9845c93e..0000000000 --- a/docs/docbook/xslt/db2latex/graphic.mod.xsl +++ /dev/null @@ -1,87 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Graphics <filename>graphic.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - - - \includegraphics{ } - - - - \includegraphics{ } - - - - - - - - - - \includegraphics{ - - - - } - - - - - - - - - - - \includegraphics{ - - - - } - - -     - diff --git a/docs/docbook/xslt/db2latex/html.mod.xsl b/docs/docbook/xslt/db2latex/html.mod.xsl deleted file mode 100644 index a94ac3c80f..0000000000 --- a/docs/docbook/xslt/db2latex/html.mod.xsl +++ /dev/null @@ -1,15 +0,0 @@ - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/index.mod.xsl b/docs/docbook/xslt/db2latex/index.mod.xsl deleted file mode 100644 index 0ca975bd50..0000000000 --- a/docs/docbook/xslt/db2latex/index.mod.xsl +++ /dev/null @@ -1,213 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Index <filename>index.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - -1 - - - - - - - - - - - - - - \printindex - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Error: Only one attribut (@class or @zone) is in indexterm possible! - - - - - \index{ - - |(} - - - - - Error: No indexterm with - id=' - ' found! - Check your attributs id/startref in your indexterms! - - - - - \index{ - - |)} - - - - - \index{ - Simple case: - - } - - - - - - - - - WARNING: Element '' in indexterm not supported! - - - - - - - - - - -! - - - - -! - - - - -|see{ - -} - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/info.mod.xsl b/docs/docbook/xslt/db2latex/info.mod.xsl deleted file mode 100644 index a2a35d4629..0000000000 --- a/docs/docbook/xslt/db2latex/info.mod.xsl +++ /dev/null @@ -1,66 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Info <filename>info.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/inline.mod.xsl b/docs/docbook/xslt/db2latex/inline.mod.xsl deleted file mode 100644 index 5a6d8cc214..0000000000 --- a/docs/docbook/xslt/db2latex/inline.mod.xsl +++ /dev/null @@ -1,523 +0,0 @@ - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - Inline <filename>inline.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - - - \docbookhyphenatedot - - - - {\texttt{ - - { - - }}} - - - - - - - {\bfseries - - } - - - - - - - {\em - - } - - - - \docbookhyphenatedot - - - - {\texttt\bfseries{ - - { - - }}} - - - - \docbookhyphenatedot - - - - {\texttt\itshape{ - - { - - }}} - - - - - - - $^\text{ - - }$ - - - - - - - $_\text{ - - }$ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \docbookhyphenatefilename - - - - - - - - - - - - - ( - - ) - - - - - - - - - - - , - - - - - - - , - - - - - {\sffamily \bfseries - - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - A span of text - - This is a regular inline sequence. - However, if the role attribute is 'tex' or 'latex', the content - will be output without LaTeX active-character escaping. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - trademark - - - - - - - - - - - - - - - - - + - -- - -- - -- - - -- - - - - - - - - - - - - - - - ( - - ) - - - - - - - - - - - - - - - - - - - - - $\to$ - - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -     - diff --git a/docs/docbook/xslt/db2latex/keywords.mod.xsl b/docs/docbook/xslt/db2latex/keywords.mod.xsl deleted file mode 100644 index 80d5457199..0000000000 --- a/docs/docbook/xslt/db2latex/keywords.mod.xsl +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Keywords <filename>keywords.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - - - , - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/labelid.mod.xsl b/docs/docbook/xslt/db2latex/labelid.mod.xsl deleted file mode 100644 index 5305e07c5a..0000000000 --- a/docs/docbook/xslt/db2latex/labelid.mod.xsl +++ /dev/null @@ -1,476 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Labels <filename>labelid.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - Marks the current object with a label. - - This template marks the current object with a - \label{.}. The passed argument indicates the object whose - id attribute is used to generate the label. - In this sense, in most cases its the current node itself. - If the used object has not an id attribute, a unique id is - obtained by means of the generate-id function. - Moreover, if we are using the hyperref package, a hypertarget is - also defined for this object. - - - - object - The node whose id is to be used. - - - - - This template returns the id that has been used to label the - object. - - - - - \label{ - - } - - - - - - - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/latex.mapping.dtd b/docs/docbook/xslt/db2latex/latex.mapping.dtd deleted file mode 100644 index 361ce5a18d..0000000000 --- a/docs/docbook/xslt/db2latex/latex.mapping.dtd +++ /dev/null @@ -1,13 +0,0 @@ - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/latex.mapping.xml b/docs/docbook/xslt/db2latex/latex.mapping.xml deleted file mode 100644 index 1616774046..0000000000 --- a/docs/docbook/xslt/db2latex/latex.mapping.xml +++ /dev/null @@ -1,290 +0,0 @@ - - - - - - - - - - - - - - % -------------------------------------------- - % Abstract - % -------------------------------------------- - \begin{abstract} - - - - - \begin{admonition}%title% NOTICE: see the db2latex FAQ w.r.t db2latex variable $latex.admonition.path - - - - % ------------------------------------------------------------- - % Appendixes start here - % ------------------------------------------------------------- - \appendix - - - - - % ------------------------------------------------------------- - % appendix: %title - % ------------------------------------------------------------- - \dbappendix{%title} - \label{%id}\hypertarget{%id}{}% - - - - - % ------------------------------------------------------------- - % Chapter %title - % ------------------------------------------------------------- - \chapter{%title} - \label{%id}\hypertarget{%id}{}% - - - - - % figure ------------------------------------------------------ - \begin{figure}[hbt] - \begin{center}% - \hypertarget{%id}{}% - - - - - - % keywords ------------------------------------------------------ - \begin{keywords} - - - - - % table ------------------------------------------------------ - \begin{table}[hbt] - \begin{center}% - \hypertarget{%id}{}% - - - - - % tabular ------------------------------------------------------ - \begin{center} - \label{%id}\hypertarget{%id}{}% - - - - \begin{dbequation} - \begin{center} - - - - % ------------------------------------------------------------- - % - % GLOSSARY %title - % - % ------------------------------------------------------------- - \dbglossary{%title} - \label{%id}\hypertarget{%id}{}% - - - - % - % ------------------------------------------------------------- - \dbglossdiv{%title} - \label{%id}\hypertarget{%id}{}% - \noindent% - \begin{description}% - - - - % ------------------------------------------------------------- - % - % PART %title - % - % ------------------------------------------------------------- - \part{%title} - \label{%id}\hypertarget{%id}{}% - - - - % - % ------------------------------------------------------------- - % Refentry - % ------------------------------------------------------------- - \section*{%title} - \label{%id}\hypertarget{%id}{}% - - - - % - % ------------------------------------------------------------- - % Reference - % ------------------------------------------------------------- - \chapter*{%title} - \label{%id}\hypertarget{%id}{}% - - - - - % ------------------------ - % RevHistory - % ------------------------ - \pagebreak - \section*{%title} - \label{%id}\hypertarget{%id}{}% - \begin{center} - \begin{tt} - \begin{tabular}{|l||l|l|} \hline - - - - - - - - - % ------------------------ - % Section - \section{%title} - \label{%id}\hypertarget{%id}{}% - - - - \subsection{%title} - \label{%id}\hypertarget{%id}{}% - - - - \subsubsection{%title} - \label{%id}\hypertarget{%id}{}% - - - - \subparagraph*{%title} - \label{%id}\hypertarget{%id}{}% - - - - \subparagraph*{%title} - \label{%id}\hypertarget{%id}{}% - - - - \subparagraph*{%title} - \label{%id}\hypertarget{%id}{}% - - - - \subsubsection*{\small{%title}} - \label{%id}\hypertarget{%id}{}% - - - - - - - - - - - - - - - - - \end{abstract} - - - - - \end{admonition} - - - - - - \end{document} - - - - - - - \label{%id}\hypertarget{%id}{}% - \end{example} - - - - - \label{%id} - \end{center} - \end{figure} - - - - \label{%id}\hypertarget{%id}{}% - \end{center} - \end{dbequation} - - - - - - - - \end{description}% - - - - - \end{keywords} - - - - - - - \label{%id} - \end{center} - \end{table} - - - - - \end{center} - - - - - \label{%id}\hypertarget{%id}{}% - \end{center} - \end{program} - - - - - \end{tabular} - \end{tt} - \end{center} - % ------------------------ - % End RevHistory - % ------------------------ - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/latex.mapping.xsl b/docs/docbook/xslt/db2latex/latex.mapping.xsl deleted file mode 100644 index 2ab53de9bf..0000000000 --- a/docs/docbook/xslt/db2latex/latex.mapping.xsl +++ /dev/null @@ -1,174 +0,0 @@ - - - - - - - - - - - - - - - - RamonCasellas - - - 2000 2001 2002 2003 - Ramon Casellas - - - The DB2LaTeX mapping system <filename>latex.mapping.xsl</filename> - -
    Introduction - The DB2LaTeX mapping system centralizes mapping docbook tags (e.g. chapter) - to LaTeX commands \chapter. It used an auxiliary file, latex.mapping.xml - that defines how the mapping is to be done. -
    -     -     - - - - - - - - - - Remarks and Bugs - - - - Default Behaviour - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - %id - - - - %title - - - - - - - - - - - - %id - - - - %title - - - - - - - - - - - - - - - - - - - - - - - begin - - - - - - - - - - - - - - - - - end - - - - - - - - - - - - - - - - - - -     - diff --git a/docs/docbook/xslt/db2latex/lists.mod.xsl b/docs/docbook/xslt/db2latex/lists.mod.xsl deleted file mode 100644 index cdd093b3d0..0000000000 --- a/docs/docbook/xslt/db2latex/lists.mod.xsl +++ /dev/null @@ -1,452 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Lists <filename>lists.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - {\sc - - } - - - - - - \begin{itemize} - - \end{itemize} - - - - - - - - - - - - - - - - \begin{enumerate} - - - [1] - [A] - [a] - [I] - [i] - - - - \end{enumerate} - - - - - - - - - \noindent - \begin{description} - - \end{description} - - - - - %--- Item - \item - - - - - - - - - - \item[]\mbox{} % mbox is a trick to induce different typesetting decisions - - - - - - , - - - - - - - - - - - - - - - - - - l - - - - - - - - - - - - - - - - - , - - - - - - - - - - - - 1 - - - - \begin{tabular*}{\linewidth}{ - - - - } - - - - \end{tabular*} - - - - - - - 1 - 1 - - - - - - - - - \\ - - - - - - - - - - 1 - 1 - - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1 - - - - - \begin{tabular*}{\linewidth}{ - - - - - } - - - - \end{tabular*} - - - - - - - 1 - 1 - - - - - - - - - - - \\ - - - - - - - - - - - - - 1 - 1 - 1 - - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - {\sc - - } \\ - - - - - - - - - - - - - - \\ - - - - - - - - - - - - - - { \em - - :} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    - - - -
    -
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - callout ??? - - - - \href{ - - }{ - } - - - callout ??? - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathelem.mod.xsl b/docs/docbook/xslt/db2latex/mathelem.mod.xsl deleted file mode 100644 index 2b085aa98d..0000000000 --- a/docs/docbook/xslt/db2latex/mathelem.mod.xsl +++ /dev/null @@ -1,222 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Math Elements <filename>mathelems.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - \begin{hypothesis}[ - - - - ] - - - \end{rem} - - - - - \begin{rem}[ - - - - ] - - - \end{rem} - - - - - - \begin{exm}[ - - - - ] - - - \end{exm} - - - - - - \begin{prop}[ - - - - ] - - - \end{prop} - - - - - - \begin{thm}[ - - - - ] - - - \end{thm} - - - - - - - \begin{defn}[ - - - - ] - - - \end{defn} - - - - - - - \begin{lem}[ - - - - ] - - - \end{lem} - - - - - - \begin{proof} - - - \end{proof} - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isoamsa.ent b/docs/docbook/xslt/db2latex/mathml/ent/isoamsa.ent deleted file mode 100644 index 5ecf4db216..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isoamsa.ent +++ /dev/null @@ -1,173 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isoamsb.ent b/docs/docbook/xslt/db2latex/mathml/ent/isoamsb.ent deleted file mode 100644 index 08e646c2bd..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isoamsb.ent +++ /dev/null @@ -1,146 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isoamsc.ent b/docs/docbook/xslt/db2latex/mathml/ent/isoamsc.ent deleted file mode 100644 index cce399cf9d..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isoamsc.ent +++ /dev/null @@ -1,49 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isoamsn.ent b/docs/docbook/xslt/db2latex/mathml/ent/isoamsn.ent deleted file mode 100644 index cddeba066e..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isoamsn.ent +++ /dev/null @@ -1,117 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isoamso.ent b/docs/docbook/xslt/db2latex/mathml/ent/isoamso.ent deleted file mode 100644 index 8ac4bdb619..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isoamso.ent +++ /dev/null @@ -1,77 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isoamsr.ent b/docs/docbook/xslt/db2latex/mathml/ent/isoamsr.ent deleted file mode 100644 index 7fec582555..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isoamsr.ent +++ /dev/null @@ -1,205 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isobox.ent b/docs/docbook/xslt/db2latex/mathml/ent/isobox.ent deleted file mode 100644 index 630edc5597..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isobox.ent +++ /dev/null @@ -1,67 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isocyr1.ent b/docs/docbook/xslt/db2latex/mathml/ent/isocyr1.ent deleted file mode 100644 index 4bcc9e416e..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isocyr1.ent +++ /dev/null @@ -1,94 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isocyr2.ent b/docs/docbook/xslt/db2latex/mathml/ent/isocyr2.ent deleted file mode 100644 index 67c477b24d..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isocyr2.ent +++ /dev/null @@ -1,53 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isodia.ent b/docs/docbook/xslt/db2latex/mathml/ent/isodia.ent deleted file mode 100644 index ba6496300f..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isodia.ent +++ /dev/null @@ -1,41 +0,0 @@ - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isogrk1.ent b/docs/docbook/xslt/db2latex/mathml/ent/isogrk1.ent deleted file mode 100644 index 63b9f14ce8..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isogrk1.ent +++ /dev/null @@ -1,75 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isogrk2.ent b/docs/docbook/xslt/db2latex/mathml/ent/isogrk2.ent deleted file mode 100644 index 424786cabb..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isogrk2.ent +++ /dev/null @@ -1,46 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isogrk3.ent b/docs/docbook/xslt/db2latex/mathml/ent/isogrk3.ent deleted file mode 100644 index fa03355048..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isogrk3.ent +++ /dev/null @@ -1,70 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isogrk4.ent b/docs/docbook/xslt/db2latex/mathml/ent/isogrk4.ent deleted file mode 100644 index 71f834042b..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isogrk4.ent +++ /dev/null @@ -1,69 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isolat1.ent b/docs/docbook/xslt/db2latex/mathml/ent/isolat1.ent deleted file mode 100644 index 849d360aea..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isolat1.ent +++ /dev/null @@ -1,89 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isolat2.ent b/docs/docbook/xslt/db2latex/mathml/ent/isolat2.ent deleted file mode 100644 index 3049be7f1f..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isolat2.ent +++ /dev/null @@ -1,148 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isomfrk.ent b/docs/docbook/xslt/db2latex/mathml/ent/isomfrk.ent deleted file mode 100644 index 397212a643..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isomfrk.ent +++ /dev/null @@ -1,79 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isomopf.ent b/docs/docbook/xslt/db2latex/mathml/ent/isomopf.ent deleted file mode 100644 index 806b2fb4fe..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isomopf.ent +++ /dev/null @@ -1,53 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isomscr.ent b/docs/docbook/xslt/db2latex/mathml/ent/isomscr.ent deleted file mode 100644 index a1bb39c36c..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isomscr.ent +++ /dev/null @@ -1,79 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isonum.ent b/docs/docbook/xslt/db2latex/mathml/ent/isonum.ent deleted file mode 100644 index e5a7002fb4..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isonum.ent +++ /dev/null @@ -1,103 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isopub.ent b/docs/docbook/xslt/db2latex/mathml/ent/isopub.ent deleted file mode 100644 index 5591fc390e..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isopub.ent +++ /dev/null @@ -1,111 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/isotech.ent b/docs/docbook/xslt/db2latex/mathml/ent/isotech.ent deleted file mode 100644 index dc1fc01354..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/isotech.ent +++ /dev/null @@ -1,183 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/mmlalias.ent b/docs/docbook/xslt/db2latex/mathml/ent/mmlalias.ent deleted file mode 100644 index f5901b3846..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/mmlalias.ent +++ /dev/null @@ -1,529 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/ent/mmlextra.ent b/docs/docbook/xslt/db2latex/mathml/ent/mmlextra.ent deleted file mode 100644 index e76de448cc..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/ent/mmlextra.ent +++ /dev/null @@ -1,134 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/latex.entities.dtd b/docs/docbook/xslt/db2latex/mathml/latex.entities.dtd deleted file mode 100644 index 7ec703e2c7..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/latex.entities.dtd +++ /dev/null @@ -1,7 +0,0 @@ - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/latex.entities.xml b/docs/docbook/xslt/db2latex/mathml/latex.entities.xml deleted file mode 100644 index e5290aba10..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/latex.entities.xml +++ /dev/null @@ -1,12 +0,0 @@ - - - - - \delta - \kappa - \pi - - - \beta - \sphat - \hat - diff --git a/docs/docbook/xslt/db2latex/mathml/mathml.content.constsymb.mod.xsl b/docs/docbook/xslt/db2latex/mathml/mathml.content.constsymb.mod.xsl deleted file mode 100644 index 585c744109..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/mathml.content.constsymb.mod.xsl +++ /dev/null @@ -1,99 +0,0 @@ - - %mmlalias; - %mmlextra; -]> - - - - - - - \bbold Z - - - - - \bbold R - - - - - \bbold Q - - - - - \bbold N - - - - - \bbold C - - - - - \bbold P - &#x1D547; - - - - - - - - - - - \textrm{e} - - - - - \textrm{i} - - - - \NaN - - - - - true - - - - - false - - - - - \empty - - - - - \pi - - - - - \Gamma - - - - - \infty - - - diff --git a/docs/docbook/xslt/db2latex/mathml/mathml.content.functions.mod.xsl b/docs/docbook/xslt/db2latex/mathml/mathml.content.functions.mod.xsl deleted file mode 100644 index f197ca1924..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/mathml.content.functions.mod.xsl +++ /dev/null @@ -1,723 +0,0 @@ - - %mmlalias; - %mmlextra; -]> - - - - - - - - - - - - - - {} - - - - - - - - - - - - - - - - - - - - - - - {} - {} - - - {} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - integer part of - - - - - - - - - - / - - - - - - - - - - - - - - - - { - - - {} - - - - - - !(fact) - } - - - - - - { \frac - { - - } - { - - } - } - - - - - - - { - - - \max_{ - - - , - - - } - - - \max - - - \left\{ - - , - RCAS: MathML mml:apply[mml:min] Applying templates to - - - - - | - - \right\} - } - - - - - - - { - - - \min_{ - - - , - - - } - - - \min - - - \left\{ - - RCAS: MathML mml:apply[mml:min] Applying templates to - - , - - - - - | - - \right\} - } - - - - - - - - - - - - -{ - - - - - - - - \left( \right) - - - - - - - - - - - - - \left( - - \right) - - - - - - - -} - - - - - - - - - - - - - - - - - - - - + - - - + - - - - - - - - + - - - - + - - - - - - - { - - - \left( - - \rigth) - - - - - - }^{ - - } - - - - - - - - - - - - - - mod - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - gcd - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - xor - - - - - xor - - - xor - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - , - - - - - , - - - - : - - - : - - - - - - - - { - - \in - - } - - - - - { - - \notin - - } - - - - - - - - - , - - - - - , - - - - : - - - : - - - - - - - - || - - - - - - - - - - - - - - arg - - - - - - - &#x0211C; - - - - - - - - - &#x02111; - - - - - - - - - lcm - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/mathml.content.mod.xsl b/docs/docbook/xslt/db2latex/mathml/mathml.content.mod.xsl deleted file mode 100644 index d93ea22393..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/mathml.content.mod.xsl +++ /dev/null @@ -1,97 +0,0 @@ - - %mmlalias; - %mmlextra; -]> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \left( - \right) - - - - - - \left( - \right] - - - - - - \left[ - \right) - - - - - - \left[ - \right] - - - - - - - - - - - - - - - , - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/mathml.content.token.mod.xsl b/docs/docbook/xslt/db2latex/mathml/mathml.content.token.mod.xsl deleted file mode 100644 index 1f3f566763..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/mathml.content.token.mod.xsl +++ /dev/null @@ -1,230 +0,0 @@ - - %mmlalias; - %mmlextra; -]> - - - - - - - - - - - { - { - - - - - - - - - - - + - - - \dot\textrm{i} - - - \textrm{Polar}(, - - ) - - - \frac{}{ - - } - - - - - - } - - _{} - - } - - - - - - - - - - - - - { - - - \textrm{} - - - \textrm{} - - - - - -\textrm{ - - - - - - - - - } - \dot\textrm{i} - - - +\textrm{ - - - - - - - - - } - \dot\textrm{i} - - - } - - - \dot\textrm{} - - - - - - - { - Polar - - - - - - - - - - - - - } - - - - - - - - - - { - - - - - - / - - - - - - } - - - - - - - - - - - - - - - - - - - - - - - {} - - - - - - - - - - - - - - - - - { - - \left( - - - - \right) - } - - - - - - - - - { } - - - \textrm{ } - - - - - - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/mathml.mod.xsl b/docs/docbook/xslt/db2latex/mathml/mathml.mod.xsl deleted file mode 100644 index f37edfb4ed..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/mathml.mod.xsl +++ /dev/null @@ -1,49 +0,0 @@ - - %mmlalias; - %mmlextra; -]> - - - - - - - - - \begin{displaymath} - - \end{displaymath} - - - - \begin{math} - - \end{math} - - - - \begin{displaymath} - - \end{displaymath} - - - - - \section{ } - - - - diff --git a/docs/docbook/xslt/db2latex/mathml/mathml.presentation.mod.xsl b/docs/docbook/xslt/db2latex/mathml/mathml.presentation.mod.xsl deleted file mode 100644 index ce3c7c9a4d..0000000000 --- a/docs/docbook/xslt/db2latex/mathml/mathml.presentation.mod.xsl +++ /dev/null @@ -1,491 +0,0 @@ - - %mmlalias; - %mmlextra; -]> - - - - - - { } - - - - - - - - - - - - - - - - - - \textrm{e} - - - \textrm{i} - - - \infty - - - - { - - } - - - - \textrm - - { - - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \thinspace - - - \thinspace - - - \int - - - \prod - - - \sum - - - \sphat - - - \longrightarrow - - - \in - - - | - - - \textrm{d} - - - {\left( - - - \right)} - - - {\left\{ - - - \right\}} - - - {\left[ - - - \right]} - - - \max - - - \min - - - - - - - - - \operatorname{ - - } - - - - - - - \textrm{ - - } - - - - - RCAS mtext, - \textrm{ - - } - - - - - - \textrm{\hspace{ - - }} - - - Warning: mspace support does not include height or depth. - - - - - - - - - - ^{} - - - - - _{} - - - - - - - - _{} - - ^{} - - - - {} - - _{} - - ^{} - - - - - - - - - - { - - _{ - - }} - - - - - - - - - - - - - - - { - - { - - }} - - - { - - ^{ - - }} - - - - - { - - ^{ - - }} - - - - - - - - - { - - _{ - - } - ^{ - - }} - - - - - - - - - - - {\left( - - - {\left\{ - - - {\left[\, - - - {\left( - - - - - - \right)} - - - \right\}} - - - \,\right]} - - - \right)} - - - - - - - - - - - - - \frac[1pt]{ - - - \frac[1.1pt]{ - - - \frac[1.2pt]{ - - - \frac[]{ - - - - - \frac{ - - - - - }{ - - - } - - - - - - \sqrt{ - - } - - - - - - \sqrt[]{ - } - - - - - - - - - - - - - c - - - - - - - - - - - - -\begin{array}{ - -}\hline - -\end{array} - - - - - - - - - - & - - - - \\ \hline - - - - \\ \hline - - - - - - - - - - - - \textrm{e} - - - \textrm{i} - - - \textrm{ } - - - - diff --git a/docs/docbook/xslt/db2latex/mediaobject.mod.xsl b/docs/docbook/xslt/db2latex/mediaobject.mod.xsl deleted file mode 100644 index bfdd2c8c87..0000000000 --- a/docs/docbook/xslt/db2latex/mediaobject.mod.xsl +++ /dev/null @@ -1,224 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - MediaObjects <filename>mediaobject.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - XSL template for images. - - - Remarks and Bugs - - If both @width and @scale are given but @scalefit='0', whitespace is added to the left and right in order to match the specified width. - If @width is given and either @scalefit=1 or no @scale is given, then the image is scale to @width. Otherwise, @scale is used, if it is present. - If this is not the only imagedata within the figure, this will be rendered as a 'subfigure', including the caption of its enclosing mediaobject. - - - - - - - - - - - - - - - - - - \textwidth - - - - - - - - \makebox[] - - { - - - \subfigure[ - - - - ] - - {\includegraphics[ - - - scale= - - - - width= - - - height= - - - - ,angle=270 - - ]{ - - - - - - - - - }}} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/msgset.mod.xsl b/docs/docbook/xslt/db2latex/msgset.mod.xsl deleted file mode 100644 index 52ad63a87c..0000000000 --- a/docs/docbook/xslt/db2latex/msgset.mod.xsl +++ /dev/null @@ -1,76 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    - - - : - - -

    -     - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/normalize-scape.mod.xsl b/docs/docbook/xslt/db2latex/normalize-scape.mod.xsl deleted file mode 100644 index 058695d71d..0000000000 --- a/docs/docbook/xslt/db2latex/normalize-scape.mod.xsl +++ /dev/null @@ -1,398 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - 2000200120022003 - Ramon Casellas - - - Normalize and Scape strings. - -
    Introduction - -
    -     -     - - - - - - Abstract XSL template. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - /\- - / - - - - - - - - - - - /\- - / - - - - - - - - - - - - - - - - - - - - - - \textless{} - < - - - \textgreater{} - > - - - \textasciitilde{} - ~ - - - \^{} - ^ - - - \& - & - - - \# - # - - - \_ - _ - - - \$ - $ - - - \% - % - - - \{ - { - - - \} - } - - - \textbackslash \ - \textbackslash - - - \textbackslash - \ - - - - - - - - - - - - - - - - - - - - - \textasciitilde{} - ~ - - - \^{} - ^ - - - \& - & - - - \# - # - - - \_ - _ - - - \$ - $ - - - \% - % - - - \docbooktolatexgobble\string\{ - { - - - \docbooktolatexgobble\string\} - } - - - \docbooktolatexgobble\string\\ - \ - - - - - - - - - - - - - - - - - - - \& - & - - - \% - % - - - \{ - { - - - \{ - { - - - \docbooktolatexgobble\string\\ - \ - - - - - - - - - - - - - - Escape the ] character in LaTeX optional arguments (experimental) - - - - - - - {\rbrack} - ] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/para.mod.xsl b/docs/docbook/xslt/db2latex/para.mod.xsl deleted file mode 100644 index 64d6d8f01d..0000000000 --- a/docs/docbook/xslt/db2latex/para.mod.xsl +++ /dev/null @@ -1,74 +0,0 @@ - - - - - - - - - - - $Id: para.mod.xsl,v 1.1 2003/04/30 21:39:49 ab Exp $ - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - Paragraphs <filename>para.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - - - - - - - \textbf{ - - } - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/part-chap-app.mod.xsl b/docs/docbook/xslt/db2latex/part-chap-app.mod.xsl deleted file mode 100644 index 38c15e9331..0000000000 --- a/docs/docbook/xslt/db2latex/part-chap-app.mod.xsl +++ /dev/null @@ -1,132 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - Parts, Chapters and Appendixes <filename>part-chap-app.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - - - - - - - - - - - - - - - XSL template for Chapters. - - This is the main entry point for a chapter subtree. - This template processes any chapter. Outputs \chapter{title}, calls - templates and apply-templates. Since chapters only apply in books, - some assumptions could be done in order to optimize the stylesheet behaviour. - - Remarks and Bugs - - - EMPTY templates: chapter/title, - chapter/titleabbrev, - chapter/subtitle, - chapter/docinfo|chapterinfo. - - - - Affected by map. - - - - - - - - - - - - - - - - - - - - - - - - - \newcommand{\dbappendix}[1]{\chapter{#1}}% - - - \newcommand{\dbappendix}[1]{\section{#1}}% - - - - appendixes - - - - - - - - - - - - -     - diff --git a/docs/docbook/xslt/db2latex/pi.mod.xsl b/docs/docbook/xslt/db2latex/pi.mod.xsl deleted file mode 100644 index a4409583c8..0000000000 --- a/docs/docbook/xslt/db2latex/pi.mod.xsl +++ /dev/null @@ -1,181 +0,0 @@ - - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 200120022003 - Ramon Casellas - - - - Processing Instructions - - -
    Introduction - -
    -     -     - - - - Processing Instruction XSL template. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    - - - - - - - - - - - - - - - - - - -
    - - - - - - - - - - - - - - No cmdsynopsis elements matched dbcmdlist PI, perhaps it's nested too deep? - - - -
    - - - -
    -     - - - - - - - - - - - - -
    - - - - - - - - - - - - - - - - - - -
    - - - - - -     -     -     - - - - - - No funcsynopsis elements matched dbfunclist PI, perhaps it's nested too deep? - - - -
    - - - -
    -     - - - - diff --git a/docs/docbook/xslt/db2latex/preamble.mod.xsl b/docs/docbook/xslt/db2latex/preamble.mod.xsl deleted file mode 100644 index ec9e5a8afc..0000000000 --- a/docs/docbook/xslt/db2latex/preamble.mod.xsl +++ /dev/null @@ -1,810 +0,0 @@ - - - - - - - - - - - - Ramon Casellas - James Devenish - - 2000200120022003 - Ramon Casellas - - - - Variables and Templates used in LaTeX Preamble Generation - - -
    Introduction - This section described the variables and templates that are used in the generation of - the outtput LaTeX preamble. Basically, the LaTeX preamble depends on the XML document, that is, - on whether it is an article or a book. -
    - -
    Flow -
    Articles - -
    -
    Books - -
    -
    -     -     - - - - - - - - Top level template, called by article template, - responsible of generating the LaTeX preamble according to user - XSL variables and templates. - - - Overview - If the xsl:variable latex.override - is empty, the template outputs latex.article.preamblestart - and calls generate.latex.common.preamble. Otherwise, - it outputs the value of latex.override and - exists. - - - Ramon Casellas casellas@aist.enst.fr - - - - - - - - - - - - - - - - - - - - - - - Top level template, called by book template, - responsible of generating the LaTeX preamble according to user - XSL variables and templates. - - - Overview - If the xsl:variable latex.override - is empty, the template outputs latex.book.preamblestart - and calls generate.latex.common.preamble. Otherwise, - it outputs the value of latex.override and - exists. - - - Ramon Casellas casellas@aist.enst.fr - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Generated Document class for articles. - - - - - % -------------------------------------------- - % Autogenerated LaTeX file for articles - % -------------------------------------------- - \ifx\pdfoutput\undefined - \documentclass[spanish,french,english,a4paper,10pt,twoside,twocolumn]{article} - \else - \documentclass[pdftex,spanish,french,english,a4paper,10pt,twoside,twocolumn]{article} - \fi - - - - - - % -------------------------------------------- - % Autogenerated LaTeX file for articles - % -------------------------------------------- - \ifx\pdfoutput\undefined - \documentclass[ - - , - - , - - ]{ - - - article - - } - \else - \documentclass[pdftex, - - , - - , - - ]{ - - - article - - } - \fi - - - - Generated Document class for books. - - - - - % ------------------------------------------------------------ - % Autogenerated LaTeX file for books - % ------------------------------------------------------------ - \ifx\pdfoutput\undefined - \documentclass[spanish,french,english,a4paper,twoside,openright,10pt,final]{report} - \else - \documentclass[pdftex,spanish,french,english,a4paper,twoside,openright,10pt,final]{report} - \fi - - - - - - % ------------------------------------------------------------ - % Autogenerated LaTeX file for books - % ------------------------------------------------------------ - \ifx\pdfoutput\undefined - \documentclass[ - - , - - , - - ]{ - - - report - - } - \else - \documentclass[pdftex, - - , - - , - - ]{ - - - report - - } - \fi - - - - - - Common LaTeX preamble shared by articles and books, and other - document classes. Most of the packages and package options are managed here - - - - The LaTeX preamble, after the document class and before the \begin{document} - command. - - - - - - - - - \usepackage{graphicx} - - - - - - - - - \usepackage{fancyhdr} - - - - \renewcommand{\headrulewidth}{0.4pt} - \renewcommand{\footrulewidth}{0.4pt} - - - % ---------------------- - % Most Common Packages - % ---------------------- - \usepackage{makeidx} - \usepackage{varioref} - \usepackage{latexsym} - \usepackage{enumerate} - - - \usepackage{fancybox} - - \usepackage{float} - \usepackage{ragged2e} - - \usepackage[]{babel} - - - - \usepackage{fancyvrb} - \makeatletter\@namedef{FV@fontfamily@default}{\def\FV@FontScanPrep{}\def\FV@FontFamily{}}\makeatother - - \fvset{obeytabs=true,tabsize= - - } - - - \usepackage{isolatin1} - \usepackage{parskip} - \usepackage{rotating} - \usepackage{subfigure} - \usepackage{tabularx} - \usepackage{umoline} - \usepackage{url} - - - - % --------------- - % Document Font - % --------------- - \usepackage{} - - - \def\keywords{\vspace{-.3em} - \if@twocolumn - \small{\itshape - - keywords - - }\/\bfseries---$\!$% - \else - \begin{center}\small\bfseries - - keywords - - \end{center}\quotation\small - \fi} - \def\endkeywords{\vspace{0.6em}\par\if@twocolumn\else\endquotation\fi - \normalsize\rmfamily} - - - - - - - - - - - % -------------------------------------------- - % $latex.caption.swapskip enabled for $formal.title.placement support - \newlength{\docbooktolatextempskip} - \newcommand{\captionswapskip}{\setlength{\docbooktolatextempskip}{\abovecaptionskip} - \setlength{\abovecaptionskip}{\belowcaptionskip} - \setlength{\belowcaptionskip}{\docbooktolatextempskip}} - - - \newcommand{\captionswapskip}{} - - - - % -------------------------------------------- - % Better linebreaks - \newcommand{\docbookhyphenatedot}[1]{{\hyphenchar\font=`\.\relax #1\hyphenchar\font=`\-}} - \newcommand{\docbookhyphenatefilename}[1]{{\hyphenchar\font=`\.\relax #1\hyphenchar\font=`\-}} - \newcommand{\docbookhyphenateurl}[1]{{\hyphenchar\font=`\/\relax #1\hyphenchar\font=`\-}} - - - - - Unavoidable LaTeX preamble shared by articles and books - - Contains custom commands that you just can't get rid of! - - - - % -------------------------------------------- - \makeatletter - - \newcommand{\href}[1]{{}} - \newcommand{\hyperlink}[1]{{}} - \newcommand{\hypertarget}[2]{#2} - - - \usepackage[ - - ]{ucs} - - - \catcode`\&=\active\def&{\@ifnextchar##{\@docbooktolatexunicode\@gobble}{\&}} - - - - \def\@docbooktolatexunicode#1;{\edef\@dbtemp{#1}\unichar{\@dbtemp}} - - - \usepackage[utf8]{inputenc} - - s -% Blame j-devenish (at) users.sourceforge.net -% In any other LaTeX context, this would probably go into a style file. -\newcommand{\docbooktolatexusefootnoteref}[1]{\@ifundefined{@fn@label@#1}% - {\hbox{\@textsuperscript{\normalfont ?}}% - \@latex@warning{Footnote label `#1' was not defined}}% - {\@nameuse{@fn@label@#1}}} -\newcommand{\docbooktolatexmakefootnoteref}[1]{% - \protected@write\@auxout{}% - {\global\string\@namedef{@fn@label@#1}{\@makefnmark}}% - \@namedef{@fn@label@#1}{\hbox{\@textsuperscript{\normalfont ?}}}% - } -% -------------------------------------------- -% Hacks for honouring row/entry/@align -% (\hspace not effective when in paragraph mode) -% Naming convention for these macros is: -% 'docbooktolatex' 'align' {alignment-type} {position-within-entry} -% where r = right, l = left, c = centre -\newcommand{\docbooktolatexalignrl}{\protect\ifvmode\raggedleft\else\hfill\fi} -\newcommand{\docbooktolatexalignrr}{\protect} -\newcommand{\docbooktolatexalignll}{\protect\ifvmode\raggedright\else\fi} -\newcommand{\docbooktolatexalignlr}{\protect\ifvmode\else\hspace*\fill\fi} -\newcommand{\docbooktolatexaligncl}{\protect\ifvmode\centering\else\hfill\fi} -\newcommand{\docbooktolatexaligncr}{\protect\ifvmode\else\hspace*\fill\fi} -\ifx\captionswapskip\@undefined\newcommand{\captionswapskip}{}\fi -\makeatother -]]> - - - - - - - - - - - - - - % -------------------------------------------- - % Commands to manage/style/create floats - % figures, tables, algorithms, examples, eqn - % -------------------------------------------- - \floatstyle{ruled} - \restylefloat{figure} - \floatstyle{ruled} - \restylefloat{table} - \floatstyle{ruled} - \newfloat{program}{ht}{lop}[section] - \floatstyle{ruled} - \newfloat{example}{ht}{loe}[section] - \floatname{example}{ - - example - - } - \floatstyle{ruled} - \newfloat{dbequation}{ht}{loe}[section] - \floatname{dbequation}{ - - equation - - } - \floatstyle{boxed} - \newfloat{algorithm}{ht}{loa}[section] - \floatname{algorithm}{Algorithm} - - - - - - - - - - - Default Value: - - \usepackage{ifthen} - % -------------------------------------------- - % Check for PDFLaTeX/LaTeX - % -------------------------------------------- - \newif\ifpdf - \ifx\pdfoutput\undefined - \pdffalse % we are not running PDFLaTeX - \else - \pdfoutput=1 % we are running PDFLaTeX - \pdftrue - \fi - % -------------------------------------------- - % Load graphicx package with pdf if needed - % -------------------------------------------- - \ifpdf - \usepackage[pdftex]{graphicx} - \pdfcompresslevel=9 - \else - \usepackage{graphicx} - \fi - - - - Ramon Casellas casellas@aist.enst.fr - - - - - \usepackage{ifthen} - % -------------------------------------------- - % Check for PDFLaTeX/LaTeX - % -------------------------------------------- - \newif\ifpdf - \ifx\pdfoutput\undefined - \pdffalse % we are not running PDFLaTeX - \else - \pdfoutput=1 % we are running PDFLaTeX - \pdftrue - \fi - % -------------------------------------------- - % Load graphicx package with pdf if needed - % -------------------------------------------- - \ifpdf - \usepackage[pdftex]{graphicx} - \pdfcompresslevel=9 - \else - \usepackage{graphicx} - \fi - - - - - - - Manage the part of the preamble that handles the hyperref package. - - This template outputs the LaTeX code \usepackage[...]{hyperref} - in order to use hyperlinks, backrefs and other goodies. If PDF support is activated, - outputs laTeX code to detect whether the document is being compiled with - pdflatex or latex to supply the - right parameters (pdftex, dvips, etc). - To Do The package options should be optained - from XSL variables. - Default Value with PDF support - - % -------------------------------------------- - % Load hyperref package with pdf if needed - % -------------------------------------------- - \ifpdf - \usepackage[pdftex,bookmarksnumbered,colorlinks,backref, bookmarks, breaklinks, linktocpage]{hyperref} - \else - \usepackage[dvips,bookmarksnumbered,colorlinks,backref, bookmarks, breaklinks, linktocpage]{hyperref} - \fi - % -------------------------------------------- - - - Default Value without PDF support - - % -------------------------------------------- - % Load hyperref package - % -------------------------------------------- - \usepackage[dvips,bookmarksnumbered,colorlinks,backref, bookmarks, breaklinks, linktocpage]{hyperref} - - - - - - - - - % -------------------------------------------- - % Load hyperref package with pdf if needed - % -------------------------------------------- - \ifpdf - \usepackage[pdftex, - - , - - ]{hyperref} - \else - \usepackage[dvips, - - , - - ]{hyperref} - \fi - % -------------------------------------------- - - - % -------------------------------------------- - % Load hyperref package - % -------------------------------------------- - \usepackage[dvips, - - , - - ]{hyperref} - - - - - - - - - - - - - - - - - - - - - Manage the math related preamble - - - - - - - % -------------------------------------------- - % Math support - % -------------------------------------------- - \usepackage{amsmath,amsthm, amsfonts, amssymb, amsxtra,amsopn} - %\newtheorem{thm}{Theorem}[section] - %\newtheorem{cor}[section]{Corollary} - %\newtheorem{lem}[section]{Lemma} - %\newtheorem{defn}[section]{Definition} - %\newtheorem{prop}[section]{Proposition} - %\newtheorem{ax}{Axiom} - %\newtheorem{theorem}[section]{Theorem} - %\newtheorem{corollary}{Corollary} - %\newtheorem{lemma}{Lemma} - %\newtheorem{proposition}{Proposition} - %\theoremstyle{definition} - %\newtheorem{definition}{Definition} - %\theoremstyle{remark} - %\newtheorem{rem}{Remark} - %\newtheorem*{notation}{Notation} - %\newcommand{\ntt}{\normalfont\ttfamily} - %\newcommand{\thmref}[1]{Theorem~\ref{#1}} - %\newcommand{\secref}[1]{\S\ref{#1}} - %\newcommand{\lemref}[1]{Lemma~\ref{#1}} - \newcommand{\bysame}{\mbox{\rule{3em}{.4pt}}\,} - \newcommand{\A}{\mathcal{A}} - \newcommand{\B}{\mathcal{B}} - \newcommand{\XcY}{{(X,Y)}} - \newcommand{\SX}{{S_X}} - \newcommand{\SY}{{S_Y}} - \newcommand{\SXY}{{S_{X,Y}}} - \newcommand{\SXgYy}{{S_{X|Y}(y)}} - \newcommand{\Cw}[1]{{\hat C_#1(X|Y)}} - \newcommand{\G}{{G(X|Y)}} - \newcommand{\PY}{{P_{\mathcal{Y}}}} - \newcommand{\X}{\mathcal{X}} - \newcommand{\wt}{\widetilde} - \newcommand{\wh}{\widehat} - % -------------------------------------------- - %\DeclareMathOperator{\per}{per} - \DeclareMathOperator{\cov}{cov} - \DeclareMathOperator{\non}{non} - \DeclareMathOperator{\cf}{cf} - \DeclareMathOperator{\add}{add} - \DeclareMathOperator{\Cham}{Cham} - \DeclareMathOperator{\IM}{Im} - \DeclareMathOperator{\esssup}{ess\,sup} - \DeclareMathOperator{\meas}{meas} - \DeclareMathOperator{\seg}{seg} - % -------------------------------------------- - - - - - - - - - Declared graphic extensions - -This template checks whether the user has overriden grafic.default.extension -Otherwise, declares .pdf, .png, .jpg if using pdflatex and .eps if using latex. - - - - \DeclareGraphicsExtensions{ - - . - - - } - - - - - \ifpdf - \DeclareGraphicsExtensions{.pdf,.png,.jpg} - \else - \DeclareGraphicsExtensions{.eps} - \fi - - - \DeclareGraphicsExtensions{.eps} - - - - - - - -]]> - - - - - - - - - \DeclareGraphicsExtensions{ - - . - - - } - - - - - \ifpdf - \DeclareGraphicsExtensions{.pdf,.png,.jpg} - \else - \DeclareGraphicsExtensions{.eps} - \fi - - - \DeclareGraphicsExtensions{.eps} - - - - - - - - - - \catcode`\&=4 &\catcode`\&=\active - - - & - - - -     - diff --git a/docs/docbook/xslt/db2latex/preface.mod.xsl b/docs/docbook/xslt/db2latex/preface.mod.xsl deleted file mode 100644 index d56c0ec5cb..0000000000 --- a/docs/docbook/xslt/db2latex/preface.mod.xsl +++ /dev/null @@ -1,109 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Preface <filename>preface.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - -\newpage -% ------------------------------------------------------------- -% Preface -% ------------------------------------------------------------- -\chapter*{ - - - - - - - - preface - - - -} - - - - - - - - - - - - - - - - - - - - - \section*{ - -} - - - - - - \subsection*{ - -} - - - - - - \subsubsection*{ - -} - - - - -     - diff --git a/docs/docbook/xslt/db2latex/procedure.mod.xsl b/docs/docbook/xslt/db2latex/procedure.mod.xsl deleted file mode 100644 index c53cf39c68..0000000000 --- a/docs/docbook/xslt/db2latex/procedure.mod.xsl +++ /dev/null @@ -1,162 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Procedures <filename>procedure.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - -Procedure XSL Template. - - - - - - - - - - - - - - - - - \begin{enumerate} - - \end{enumerate} - - - \begin{enumerate} - - \end{enumerate} - - - - - - - - - - - { - - { - - - - - - - - - }} - - - - - - - -Step XSL Template. - - - - - - - - - - - \item{{ - - { - - }} - - - \item{ - - - - } - - - - - - - - - - - - - - - - - -SubSteps XSL Template. - - - - \begin{enumerate} - - \end{enumerate} - -]]> - - - - - - \begin{enumerate} - - \end{enumerate} - - -     - diff --git a/docs/docbook/xslt/db2latex/qandaset.mod.xsl b/docs/docbook/xslt/db2latex/qandaset.mod.xsl deleted file mode 100644 index c93d56e6b3..0000000000 --- a/docs/docbook/xslt/db2latex/qandaset.mod.xsl +++ /dev/null @@ -1,406 +0,0 @@ - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - QandaSet <filename>qandaset.mod.xsl</filename> - -
    - Introduction -
    -     -     - - - - - - - - - - - - - - - - - - - % ------------------------------------------------------------- - % QandASet - % ------------------------------------------------------------- - - - \subsubsection*{ - - - \subsection*{ - - - \section*{ - - - \chapter*{ - - - - - - - - F.A.Q. - - - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - % ----------- - % QandADiv - % ----------- - \noindent\begin{minipage}{\linewidth} - \vspace{0.25em}\hrule\vspace{0.25em} - - - \paragraph*{ - - - \subsubsection*{ - - - \subsection*{ - - - \section*{ - - - - - - - - F.A.Q. Part - - - } - - - \hrule\vspace{0.25em} - \end{minipage} - - - - - - - - \noindent{} - - .~ - - \newline - - \vspace{0.25em}\hrule - - - \vspace{1em} - \noindent{} - - .~ - - \newline - - - - - \vspace{1em} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\textbf{Q:}~\textit{ - -} - - - - - - - - - - - - -\noindent\textbf{A:}~ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - question - answer - qandadiv - qandaset - - - - - - - - - - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/refentry.mod.xsl b/docs/docbook/xslt/db2latex/refentry.mod.xsl deleted file mode 100644 index 52d2b297d5..0000000000 --- a/docs/docbook/xslt/db2latex/refentry.mod.xsl +++ /dev/null @@ -1,184 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - References and Entries <filename>refentry.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ( - - ) - - - - - - - - - - - - - - - - - \subsection*{ - - - - } - - - - , - - - - - - $-$ - - - - - - - - - - - : - - - - - - - - - - - \subsection*{Synopsis} - - - - - - - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/revision.mod.xsl b/docs/docbook/xslt/db2latex/revision.mod.xsl deleted file mode 100644 index a041aed5c3..0000000000 --- a/docs/docbook/xslt/db2latex/revision.mod.xsl +++ /dev/null @@ -1,215 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - Revision Management <filename>revision.mod.xsl</filename> - -
    Introduction - - This file defines the DB2LaTeX XSL templates for revision - and its children. The basic mapping is to output a LaTeX table and a table - row for each revision. - -
    -     -     - - - - - - - - - revhistory XSL template - - User variables - - latex.output.revhistory - - - This XSL template depends on the value of latex.output.revhistory. - If this variable is "1", the XSL template calls map.begin, then - applies templates and finally calls map.end - - - - - - RCAS: Processing Revision History - - - - - - - - - - - - - - revhistory/revision XSL template - - Each revhistory/revision corresponds to a LaTeX table row (see revhistory) - containing the revision number, the date, author initials and the description/ - remarks of the revision. - - - - - - - - - - - - - - - - & - - & - - - - nbsp - - - - - - - - \\ \hline - - - \multicolumn{3}{|l|}{ - - - } \\ \hline - - - - - - - - - - - revision/authorinitials XSL template - - Applies templates and outputs a "comma" if the node position is not - last() - - - - - - - - , - - - - - - - - - - - revision/revnumber XSL template - - Applies templates. - - - - - - - - - - - - - - - - - revision/date XSL template - - Applies templates. - - - - - - - - - - - - - - - revision/revremark XSL template - - Applies templates. - - - - - - - - - - - - - - - revision/revdescription XSL template - - Applies templates. - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/sections.mod.xsl b/docs/docbook/xslt/db2latex/sections.mod.xsl deleted file mode 100644 index 2e74ce3890..0000000000 --- a/docs/docbook/xslt/db2latex/sections.mod.xsl +++ /dev/null @@ -1,147 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Sections <filename>sections.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - DB2LaTeX: recursive section|simplesect > 5 Not well Supported - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - DB2LaTeX: recursive section|simplesect > 5 Not well Supported - - - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/set.mod.xsl b/docs/docbook/xslt/db2latex/set.mod.xsl deleted file mode 100644 index 8f87fb1071..0000000000 --- a/docs/docbook/xslt/db2latex/set.mod.xsl +++ /dev/null @@ -1,50 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Sets <filename>set.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - -     - diff --git a/docs/docbook/xslt/db2latex/sgmltag.mod.xsl b/docs/docbook/xslt/db2latex/sgmltag.mod.xsl deleted file mode 100644 index 893a2b6d4d..0000000000 --- a/docs/docbook/xslt/db2latex/sgmltag.mod.xsl +++ /dev/null @@ -1,154 +0,0 @@ - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - SGML Tags <filename>sgmltag.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - - - - - - - - element - - - - - - - - - - - - - - - - - </ - - > - - - - - - - \& - - ; - - - - - - - \&\# - - ; - - - - - - - \% - - ; - - - - - - - <? - - ?> - - - - - - - <? - - ?> - - - - - - - < - - > - - - - - - - < - - /> - - - - - - - <!-- - - --> - - - - - - - - - -     - diff --git a/docs/docbook/xslt/db2latex/synop-oop.mod.xsl b/docs/docbook/xslt/db2latex/synop-oop.mod.xsl deleted file mode 100644 index 93b29c1229..0000000000 --- a/docs/docbook/xslt/db2latex/synop-oop.mod.xsl +++ /dev/null @@ -1,689 +0,0 @@ - - ]> - - - - - - - - - - - - - - - - - - - - - - - - - Unrecognized language on classsynopsis: - - - - - - - - - - - - - - - 
    -	    
-	    
-		 extends
-		
-		
-		    &RE;    
-		
-	    
-	    
-		implements
-		
-		
-		    &RE;    
-		
-	    
-	    
-		throws
-		
-	    
-	     {&RE;&RE;
-	    
-	    }
-
    -     - - - - - - - - - , - - - - - - - - - - - - - - - - - - - - , - - - - - - - - - , - - - - - - - - - , - - - - - - - - - - - ; - - - - - - - - - - - - - - - - - - - - = - - - - - - - void - - - - - - - - - - - - - - 0 - - ,&RE; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ( - - - - ) - - &RE; throws - - - ; - - - - - - - 
    -	    
-	    
-		: 
-		
-		
-		    &RE;    
-		
-	    
-	    
-		 implements
-		
-		
-		    &RE;    
-		
-	    
-	    
-		 throws
-		
-	    
-	     {&RE;&RE;
-	    
-	    }
-
    -     - - - - - - - - , - - - - - - - - - - - - - - - - , - - - - - - - - - , - - - - - - - - - , - - - - - - - - - - - ; - - - - - - - - - - - - - - - - - - - - = - - - - - - - void - - - - - - - - - - - - , - - - - - - - - - - - - - - - - - - - - - - - - - - - - ( - - ) - - &RE; throws - - - ; - - - - - - - 
    -	    interface 
-	    
-	    
-		: 
-		
-		
-		    &RE;    
-		
-	    
-	    
-		 implements
-		
-		
-		    &RE;    
-		
-	    
-	    
-		 throws
-		
-	    
-	     {&RE;&RE;
-	    
-	    }
-
    -     - - - - - - - - , - - - - - - - - - - - - - - - - , - - - - - - - - - , - - - - - - - - - , - - - - - - - - - - - ; - - - - - - - - - - - - - - - - - - - - = - - - - - - - void - - - - - - - - - - - - , - - - - - - - - - - - - - - - - - - - - - - - - - - - - ( - - ) - - &RE; raises( - - ) - - ; - - - - - - - - - - - 
    -	    package 
-	    
-	    ;&RE;
-
-	    
-		@ISA = (
-		
-		);&RE;
-	    
-
-	    
-
    -     - - - - - - - - , - - - - - - - - - - - - - - - - , - - - - - - - - - , - - - - - - - - - , - - - - - - - - - - - ; - - - - - - - - - - - - - - - - - - - - = - - - - - - - void - - - - - - - - - - - , - - - - - - - - - - - - - - - sub - - - { ... }; - - -     diff --git a/docs/docbook/xslt/db2latex/synop-struct.mod.xsl b/docs/docbook/xslt/db2latex/synop-struct.mod.xsl deleted file mode 100644 index 1ffe2fc463..0000000000 --- a/docs/docbook/xslt/db2latex/synop-struct.mod.xsl +++ /dev/null @@ -1,246 +0,0 @@ - - - - - - - - - - - - - \begin{list}{}{\setlength{\itemindent}{-\leftmargin}\setlength{\parsep}{0mm}} - - \item\textbf{ - - } - - \item\raggedright\texttt{ - - } - \end{list} - - - - - - - - - - {\itshape - - } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - {\em ( ) } - - - - - - - - - - -

    - - ( - - ) - - - -

    -     - - - - - - - - - - - - - - - - - - - - - - - - - - - \textbf{ } - - - - - - - - - - - - (void); - - - (); - - - - - - ( ... ); - - - - - - - ( - - - - - - - - - - - , - - - ); - - - - - - - - - - - - - - - - - , - - - - - - - \newline - - ; - - - - ( - - ) - - -     diff --git a/docs/docbook/xslt/db2latex/table.mod.xsl b/docs/docbook/xslt/db2latex/table.mod.xsl deleted file mode 100644 index 0edb4ad2cc..0000000000 --- a/docs/docbook/xslt/db2latex/table.mod.xsl +++ /dev/null @@ -1,743 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - Tables <filename>table.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - - XSL template for docbook tables. - - - Remarks and Bugs - - - - Default Behaviour - - - - - - - - - - - - - - \caption{ - - } - - - - \captionswapskip{} - - \captionswapskip{} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >{ - - - \hsize= - - \hsize - - - \RaggedRight - \RaggedLeft - \Centering - Table column char alignment is not supported. - - } - - - X - - - p{} - - - - | - - - - - l - r - c - X - cTable column char alignment is not supported. - c - - - | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >{\RaggedRight} - >{\RaggedLeft} - >{\Centering} - Table column char alignment is not supported. - - p{} - - | - - - - - l - r - c - l - cTable column char alignment is not supported. - c - - - | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - all - - - - - - - - - - - 1 - - - - 1 - - - - 1 - - - 0 - - - - - - 1 - - - - \begin{tabularx}{\linewidth}{ - - - \begin{minipage}{\linewidth} - \begin{tabular}{ - - - - | - - - - - - - - - - - - - - - - - - - - | - - } - - \hline - - - - - - \hline - - - - \end{tabularx} - - - \end{tabular} - \end{minipage} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \tabularnewline - - - - - - - - - - - - - - - - - - - \hline - - - - - - - - - - \tabularnewline - - - - - - - - - - - - - - - - - - -1 - - - - \multicolumn{ - - |}{ - - l - r - c - cTable entry char alignment is not supported. - c - - - } - - - - - \docbooktolatexalignll - \docbooktolatexalignrl - \docbooktolatexaligncl - Table entry char alignment is not supported. - - - { - - \rotatebox{90} - entry[@rotate='1' and @align!=''] probably doesn't work. - - { - - The morerows attribute is not supported. - - - - }} - - - - \docbooktolatexalignlr - \docbooktolatexalignrr - \docbooktolatexaligncr - - - - - - - - - - - - - - - - - - td - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -   - - - - - - - - - - - - - - - - - - - - - - - - - - - 1 - - 1 - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1 - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/texmath.mod.xsl b/docs/docbook/xslt/db2latex/texmath.mod.xsl deleted file mode 100644 index 47036c56ac..0000000000 --- a/docs/docbook/xslt/db2latex/texmath.mod.xsl +++ /dev/null @@ -1,117 +0,0 @@ - - - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - - LaTeX Only Commands <filename>texmath.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - \ensuremath{ - - } - - - \begin{displaymath} - - - \end{displaymath} - - - - - - - - - - - - - - - - \input{} - - - - \input{} - - - - - \input{} - - - - - - - - \input{} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/vars.mod.xsl b/docs/docbook/xslt/db2latex/vars.mod.xsl deleted file mode 100644 index e20fb59ce2..0000000000 --- a/docs/docbook/xslt/db2latex/vars.mod.xsl +++ /dev/null @@ -1,937 +0,0 @@ - - - - - - - - - - - - CasellasRamon - DevenishJames - - - 2000200120022003 - Ramon Casellas - - - - XSL Variables and Parameters - - -
    Introduction - - This is technical reference documentation for the DocBook XSL - Stylesheets. It documents (some of) the parameters, templates, and - other elements of the stylesheets. -
    -     -     - - - - java - - - - kr - - 0 - - - - Display comment elements? - - Control the display of comments and remarks. - - - - - - - - - - - - - number - , - - Cull table-of-contents entries that are deeply nested - - Specifies the maximum depth before sections are omitted from the table of contents. - - - 4 - - - Control the automatic numbering of section, parts, and chapters - - - Specifies the maximum depth before sections cease to be uniquely numbered. - This is passed to LaTeX using the secnumdepth counter. - Therefore, it is possible to use a value of 0 (zero) to disable section numbering. - A value of -1 will disable the numbering of parts and chapters, too. - - - - 4 - - 1 - - - - Control mediaobject selection methods - - This controls how DB2LaTeX behaves when a figure contains - multiple mediaobjects. When enabled, DB2LaTeX will choose - the mediaobject with the "LaTeX" or "TeX" role, if present. Otherwise, the first mediaobject - is chosen. - - - 1 - - - Control mediaobject selection methods - - When is enabled, this variable - can be used to specify the mediaobject role that your document uses for LaTeX output. - DB2LaTeX will try to use this role before using the "LaTeX" or "TeX" roles. - For example, some authors may choose to set this to "PDF". - - - - - - Specifies where formal object titles should occur - - - Titles for the formal object types (figure, example, quation, table, and procedure) - can be placed before or after those objects. The keyword before - is recognised. All other strings qualify as after. - - - - - figure not_before - example before - equation not_before - table before - procedure before - - - - Control the appearance of page numbers in cross references - - - When enabled, xrefs will include page - numbers after their generated cross-reference text. - - - - 0 - - - Control the display of URLs after ulinks - - - When this option is enabled, and a ulink has a URL that is different - from the displayed content, the URL will be typeset after the content. - If the URL and content are identical, only one of them will appear. - Otherwise, the URL is hyperlinked and the content is not. - - - - 0 - - - Control the generation of footnotes for ulinks - - - When this option is enabled, a ulink that has content different to its - URL will have an associated footnote. The contents of the footnote - will be the URL. If the ulink is within a footnote, the URL is shown - after the content. - - - - 0 - - - - - Override DB2LaTeX's preamble with a custom preamble. - - - When this variable is set, the entire DB2LaTeX premable will be superseded. - You should not normally need or want to use this. - It may cause LaTeX typesetting problems. This is a last resort or - expert feature. - - - - - - - Control Unicode character handling. - - - Normally, XSLT processors will convert SGML character entities into - Unicode characters and DB2LaTeX doesn't have much chance to do anything - toward converting them to LaTeX equivalents. We do not yet know how we - can solve this problem best. - - - Proposed values: 'catcode', 'unicode', 'extension'. - Currently only 'catcode' is supported. All other values will - cause no special handling except for certain mappings in MathML. - In future, perhaps the 'unicode' LaTeX package could be of assistance. - 'Extension' could be an XSLT extension that handles the characters - using a mapping table. - - - - - - - Control the escaping of alt text - - - Text within alt elements is assumed to - be valid LaTeX and is passed through unescaped by default. If this is not - appropriate for your document, set this variable to something other than - '1'. - - - - 1 - - - Control the use of alt text - - - By default, DB2LaTeX assumes that alt - text should be typeset in preference to any - mediaobjects. - - - - 1 - - - - - Whether to apply templates for section titles. - - - Controls whether section titles will be generated by - applying templates or by conversion to string values. - When enabled, templates will be applied. This enables template - expression in titles but may have problematic side-effects such - as nested links. - - - - This variable does not influence all title - elements. Some may have their own variables or not be configurable. - - - - - 1 - - - - - - - Whether to apply templates for admonition titles. - - - Controls whether admonition titles will be generated by - applying templates or by conversion to string values. - When enabled, templates will be applied. - - - - 1 - - - - - - - - Control imagedata selection. - - This controls how DB2LaTeX behaves when a mediaobject contains - multiple imagedata. When non-empty, DB2LaTeX will exclude - imagedata that have a format no listed within this variable. - - - - - - - - - - - Improved typesetting of captions - - - DB2LaTeX supports $formal.title.placement - as a mechanism for choosing whether captions will appear above or below the objects they describe. - - However, LaTeX will often produce an ugly result when captions occur - above their corresponding content. This usually arises because of - unsuitable \abovecaptionskip and \belowcaptionskip. - - - This variable, when set to '1', authorises DB2LaTeX to swap the caption - 'skip' lengths when a caption is placed above its - corresponding content. This is enabled by default. - - - - 1 - - - - - - - DB2LaTeX allows using an (externally generated) cover page - - - You may supply a LaTeX file that will supersede DB2LaTeX's default - cover page or title. If the value of this variable is non-empty, the - generated LaTeX code includes \input{filename}. Otherwise, it uses the - \maketitle command. - - - Bear in mind that using an external cover page breaks the - "encapsulation" of DocBook. Further revisions of these stylesheets - will add chunking support, and the automation of the cover file - generation. - - - - title - - - - - - DB2LaTeX document class - - - This variable is normally empty and the stylesheets will determine - the correct document class according to whether the document is a - book or an article. If you wish to use your own document class, - put its non-empty value in this variable. It will apply for both - books and articles. - - - - - - - DB2LaTeX document class options - - - These are the first options to be passed to \documentclass - The common options are set to french,english by default. - They will be augmented or superseded by article/book options (see $latex.documentclass.article and $latex.documentclass.book) and pdftex/dvips options (see $latex.documentclass.pdftex and $latex.documentclass.dvips). - - - - french,english - - - DB2LaTeX document class options for articles - - - The article options are set to a4paper,10pt,twoside,twocolumn by default. - These are the intermediate options to be passed to \documentclass, - between the common options and the pdftex/dvips options. - - - - a4paper,10pt,twoside,twocolumn - - - DB2LaTeX document class options for books - - - The book options are set to a4paper,10pt,twoside,openright by default. - These are the intermediate options to be passed to \documentclass, - between the common options and the pdftex/dvips options. - - - - a4paper,10pt,twoside,openright - - - DB2LaTeX document class options for pdfTeX output - - - The pdfTeX options are empty by default. - These are the last options to be passed to \documentclass - and override the common/article/book options. - - - - - - - DB2LaTeX document class options for dvips output - - - The dvips options are empty by default. - These are the last options to be passed to \documentclass - and override the common/article/book options. - - - - - - - LaTeX location for admonition graphics - - The file path that will be passed to LaTeX in order to find admonition graphics. - An empty value suppresses the use of admonition graphics. - If your figures are in the current directory then use a value of - . (i.e. the full stop or period on its own) to signify this. - - - figures - - - - DB2LaTeX graphics admonitions size - - - Is passed as an optional parameter for \includegraphics and - can take on any such legal values (or be empty). - - - - width=1cm - - - - - - - Control which references are cited in the bibliography - - - The DB2LaTeX generated bibliography (bibitems) may either - include all biblioentries found in the document, or only thee ones explicitly - cited with citation. - - Two values are possible: all or cited. - - - all - - - - - Control the output of the \bibliography{.bib}. - - - The value of this parameter is output. - An example is citations.bib, - if your BibTeX file has that name. - - - - - - - Adjust bibliography formatting - - The environment bibliography accepts a parameter that indicates - the widest label, which is used to correctly format the bibliography - output. The value of this parameter is output inside the - \begin{thebibliography[]} LaTeX command. - - - WIDELABEL - - - - - Choose whether to use the unicode LaTeX package - See the unicode documentation for details. - - 0 - - - Select the optional parameter(s) for the unicode LaTeX package - See the unicode documentation for details. - - - - - Select the optional parameter for the babel LaTeX package - See the babel documentation for details. - - french - - - Toggle the use of the isolatin1 LaTeX package - - 1 - - - Toggle the use of the hyperref LaTeX package - This is used extensively for hyperlinking within documents. - - 1 - - - Toggle the use of the fancybox LaTeX package - This is essential for admonitions. - - 1 - - - Toggle the use of the fancyvrb LaTeX package - Provides support for tabbed whitespace in verbatim environments. - See also . - - 1 - - - Choose indentation for tabs in verbatim environments - When is enabled, - this variable sets the width of a tab in terms of an equivalent number of spaces. - - 3 - - - Toggle the use of the fancyhdr LaTeX package - Provides page headers and footers. Disabling support for - this package will make headers and footer go away. - - 1 - - - Toggle the use of the parskip LaTeX package - Support a block paragraph style as opposed to - indented. - - 0 - - - Toggle the use of the subfigure LaTeX package - Used to provide nice layout of multiple mediaobjects in figures. - - 1 - - - Toggle the use of the rotating LaTeX package - - 1 - - - Toggle the use of the tabularx LaTeX package - Used to provide certain table features. Has some incompatabilities - with packages, but also solves some conflicts that the regular tabular - environment has. - - 1 - - - Toggle the use of the umoline LaTeX package - Provide underlining. - - 0 - - - Toggle the use of the url LaTeX package - Provide partial support for hyperlinks. - - 1 - - - Toggle the use of the makeidx LaTeX package - Support index generation. - - 1 - - - DB2LaTeX hyphenation linebreak tricks - - - Usually, LaTeX does not perform hyphenation in teletype (monospace) - text. This can lead to formatting problems. But certain monospace texts, such as - URLs and filenames, have natural breakpoints such as full stops - and slashes. DB2LaTeX's tttricks exploit a hyphenation trick in - order to provide line wrapping in the middle of monospace text. Set this to '1' - to enable these tricks (they are not enabled by default). See also the FAQ. - - - - 0 - - - DB2LaTeX hyperref options - - - The hyperref options are set to bookmarksnumbered,colorlinks,backref, bookmarks, breaklinks, linktocpage by default. - You may wish to specify additional options using latex.hyperref.param.pdftex - or latex.hyperref.param.dvips. - - - - bookmarksnumbered,colorlinks,backref, bookmarks, breaklinks, linktocpage - - - DB2LaTeX hyperref options for pdfTeX output - - - This variable is empty by default. See the hyperref documentation for further information. - - - - pdfstartview=FitH - - - DB2LaTeX hyperref options for dvips output - - - This variable is empty by default. See the hyperref documentation for further information. - - - - - - Left Header - Center Header - Right Header - Left Footer - Center Footer - Right Footer - - - Control the style of step titles - - Step titles are typeset in small caps but if - this option is set to a LaTeX command, such as \itshape{}, then - that command will precede the title and it will be typeset accordingly. - - - \bf - - - Control the style of article titles within books - - - - \Large\textbf - - - Control the style of article titles - - - - \textbf - - - Override DB2LaTeX's choice of LaTeX page numbering style - - By default, DB2LaTeX will choose the 'plain' or 'fancy' page styles, - depending on . If non-empty, this - variable overrides the automatic selection. An example would be the literal - string 'empty', to eliminate headers and page numbers. - - - - - - Control the style of procedure titles - - Procedure titles are typeset in small caps but if - this option is set to a LaTeX command, such as \itshape{}, then - that command will precede the title and it will be typeset accordingly. - - - \sc - - - Control the style of figure titles - - Figure titles are typeset in the default typeface (usually 'roman') but if - this option is set to a LaTeX command, such as \itshape{}, then - that command will precede the title and it will be typeset accordingly. - - - - - - Controls the output of LaTeX commands to support the generation - of PDF files. - - If this parameter is set to 1, the stylesheets generate code to - detect if it is either latex or pdflatex - the shell command that is being used to compile the LaTeX text file. Some - packages (graphicx, hyperref) are used - with the right parameters. Finally, the graphic extensions declared, to use in - \includegraphics commands depends also on which command is - being used. If this parameter is set to zero, such code is not generated (which - does not mean that the file cannot compile with pdflatex, but some strange issues - may appear). DEFAULT: 1 Only more code is generated. - - - - 1 - - - - - Format the output of tabular headings. - - - - - - - - - - - Controls the output of LaTeX packages and commands to support - documents with math commands and environments.. - - If this parameter is set to 1, the stylesheets generate code to - DEFAULT: 1 Only more code is generated. - - - - 1 - - - - - Controls if the revision history table is generated as the first document - table. - - - If this parameter is set to 1, the stylesheets generate code to - DEFAULT: 1 Only more code is generated. - - - - 1 - - - - - - - - - - - - - All purpose commands to change text width, height, counters, etc. - Defaults to a two-sided margin layout. - - - - - - \usepackage{anysize} - \marginsize{3cm}{2cm}{1.25cm}{1.25cm} - - - - - Begin document command - - - - - - \begin{document} - - - - - - - - - LaTeX code that is output after the author (e.g. - \makeindex, \makeglossary - - - - - - % -------------------------------------------- - \makeindex - \makeglossary - % -------------------------------------------- - - - - - - - - LaTeX code that is output at the end of the document - \end{document} - - - - - - % -------------------------------------------- - % End of document - % -------------------------------------------- - \end{document} - - - - - - - - - - - - - - - - The begin document - The value of this variable is output from the article template - after the author command. The default value - (shown below) is just the begin document command. Users of the XSL LaTeX - stylesheet may override this parameter in order to output what they want. - - \begin{document} - - - \begin{document} - - - - - Controls what is output after the LaTeX preamble. - - Default values decrease edge margins and allow a large quantity of figures to be set on each page. - - - - - - \usepackage{anysize} - \marginsize{2cm}{2cm}{2cm}{2cm} - \renewcommand\floatpagefraction{.9} - \renewcommand\topfraction{.9} - \renewcommand\bottomfraction{.9} - \renewcommand\textfraction{.1} - - - - - - - - The \maketitle for books and articles. - - Some users may wish to override or eliminate \maketitle. - Does not apply to articles within books. - By default, uses LaTeX \maketitle with the 'empty' pagestyle - for the first page. The page style of subsequent pages is determined by - . - - - - {\maketitle - - \thispagestyle{empty}} - - - - - Controls what is output at the end of the article. Basically the \end{document} - command, with some markup comments. - - - - - - % -------------------------------------------- - % End of document - % -------------------------------------------- - \end{document} - - - - -     - diff --git a/docs/docbook/xslt/db2latex/verbatim.mod.xsl b/docs/docbook/xslt/db2latex/verbatim.mod.xsl deleted file mode 100644 index 549883869b..0000000000 --- a/docs/docbook/xslt/db2latex/verbatim.mod.xsl +++ /dev/null @@ -1,144 +0,0 @@ - - - - - - - - - - - - - - Ramon Casellas - James Devenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - Verbatim <filename>verbatim.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - Template for literal - - Template for literal template - - - - - - {\verb - - } - - - - - - - - - - Auxiliary template to output verbatim LaTeX code in verbatim mode - - Takes into account whether the user is using fancyvrb or not. It allows - veratim line numbering and other fancy stuff. - In order to use a small or large font, you may also wanto to use - the role attribute : - - - - - ]]> - - - - - - - - Problem with inside table entries. - \texttt{ - - } - - - - \begin{Verbatim}[ - - ,numbers=left - - - ,fontfamily=default - - - - - ,fontsize=\small - - - ,fontsize=\large - - - - ] - - - - - - - - - - \end{Verbatim} - - - \begin{verbatim} - - \end{verbatim} - - - - - - - - - - - - Environments in which whitespace is significant - - - Known Bugs - Templates are not applied within programlistings. - - - - - - - -     diff --git a/docs/docbook/xslt/db2latex/xref.mod.xsl b/docs/docbook/xslt/db2latex/xref.mod.xsl deleted file mode 100644 index 82289b19df..0000000000 --- a/docs/docbook/xslt/db2latex/xref.mod.xsl +++ /dev/null @@ -1,657 +0,0 @@ - - - - - - - - - - - - - - - CasellasRamon - JamesDevenish - - - 2000 2001 2002 2003 - Ramon Casellas - - - -Xref, Cross References <filename>xref.mod.xsl</filename> - -
    Introduction - -
    -     -     - - - - - - - Anchor XSL template - - The anchor element - The DB2LaTeX processing of the element is quite straightforward : - Map to a \label. - - - - - - \hypertarget{ - - }{} - - - - - - - - - Auxiliary named template - - This template returns 1 if there exists somewhere an xref - whose linkend is the target's id. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Auxiliary named template - - Called to process an xreflabel...you might use this to make - xreflabels come out in the right font for different targets, - for example. - - - - - - - - - - - - - - - - - Xref and Link XSL Template - - - - - - - - - - - - - XRef to nonexistent id: - XrefId[? - - ?] - - - - - - - - - - - - - - - - - - - - Endterm points to nonexistent ID: - - - [NONEXISTENT ID] - - - - - - - - - - - - - - - {[ - - - - ]} - - - - - - - - - - - - - - - - - - [%p] - - - - - - - - - Choose hyperlink syntax - - Will use hyperref, if it is available. Otherwise, just outputs - unlinked text. If the destination is a citation, a backreference is - emitted (even though it is technically a hyperlink, not a citation). - If the 'text' arises from an @endterm, then the 'optional argument' - syntax of \cite is used. - - - - - - - - - - \docbooktolatexcite - { - - }{ - - - - } - - - - \hyperlink{ - - } - - { - - \docbooktolatexbackcite{ - - } - - - } - - - - - - Insert page number into xrefs - - - - - - %p - - - - \pageref*{ - - } - - - - - - - - - - - - - - - - - Numbering template - - - Let LaTeX manage the numbering. Otherwise sty files that - do specify another numberic (e.g I,II) get messed - - - - - - - {\ref*{}} - - - - - - - - - - - - FIXME - - - FIXME - - - - - - - - - - - - %g %n - - - - - - - - - - - - - - - - - [Don't know what gentext to create for xref to: " - - "] - - UNKGENTEXT - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - [ - - - - - - - - - ] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - {\em } - - - - - - - - - - - - - - - - - A link that addresses its target by means of a URL (Uniform Resource Locator) - - - Pertinent Variables - - - - - - - - - - - - - \docbookhyphenateurl - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \href{ - - - - } - { - - } - - - - - - - - - - OLink XSL template - - - - - - - - - - - - - - - - - - - - - - - - - - - {\em } - - - - - - - - - - - - - - - - - - - - - - - - \url{ - - } - - - \href{ - - - - }{\texttt{ - - - - - }} - - - - - - - Escape and hyphenate a string as a teletype URL. - - - This template typsets teletype text using slash.hyphen if - $latex.hyphenation.tttricks is disabled. - Has two parameters: 'hyphenation' and 'string'. - - - - - - - - - - - - { - - } - - - - - - - - -     diff --git a/docs/faq/FAQ-Config.html b/docs/faq/FAQ-Config.html deleted file mode 100644 index 785522ec4e..0000000000 --- a/docs/faq/FAQ-Config.html +++ /dev/null @@ -1,16 +0,0 @@ - -Chapter 3. Configuration problems
    Chapter 3. Configuration problems
    Prev   Next

    Chapter 3. Configuration problems

    Table of Contents

    I have set 'force user' and samba still makes 'root' the owner of all the files I touch!
    I have just installed samba and I'm trying to log in from Windows, but samba refuses all logins!
    How can I make samba use netbios scope ID's

    I have set 'force user' and samba still makes 'root' the owner of all the files I touch!

    -When you have a user in 'admin users', samba will always do file operations for -this user as 'root', even if 'force user' has been set. -

    I have just installed samba and I'm trying to log in from Windows, but samba refuses all logins!

    -Newer windows clients(NT4, 2000, XP) send encrypted passwords. Samba can't compare these -passwords to the unix password database, so it needs it's own user database. You can -add users to this database using "smbpasswd -a user-name". -

    -See also the "User database" chapter of the samba HOWTO Collection. -

    How can I make samba use netbios scope ID's

    By default Samba uses a blank scope ID. This means -all your windows boxes must also have a blank scope ID. -If you really want to use a non-blank scope ID then you will -need to use the 'netbios scope' smb.conf option. -All your PCs will need to have the same setting for -this to work. Scope ID's are not recommended.

    Prev Up Next
    Chapter 2. Compiling and installing Samba on a Unix host Home Chapter 4. Specific client application problems
    diff --git a/docs/faq/FAQ-Printing.html b/docs/faq/FAQ-Printing.html deleted file mode 100644 index a924d40cd5..0000000000 --- a/docs/faq/FAQ-Printing.html +++ /dev/null @@ -1,16 +0,0 @@ - -Chapter 7. Printing problems
    Chapter 7. Printing problems
    Prev   

    Chapter 7. Printing problems

    Ronan Waide

    Table of Contents

    setdriver or cupsaddsmb failes

    setdriver or cupsaddsmb failes

    -setdriver expects the following setup: - -

    you are a printer admin, or root. this is the smb.conf printer admin group, not the Printer Operators group in NT. I've not tried the latter, but I don't believe it will work based on the current code.
    printer admins has to be defined in [global]
    upload the driver files to \\server\print$\w32x86 and win40 as appropriate. DON'T put them in the 0 or 2 subdirectories.
    Make sure that the user you're connecting as is able to write to the print$ directories
    Use adddriver (with appropriate parameters) to create the driver. note, this will not just update samba's notion of drivers, it will also move the files from the w32x86 and win40 directories to an appropriate subdirectory (based on driver version, I think, but not important enough for me to find out)
    Use setdriver to associate the driver with a printer

    -

    -The setdriver call will fail if the printer doesn't already exist in -samba's view of the world. Either create the printer in cups and -restart samba, or create an add printer command (see smb.conf doco) -and use RPC calls to create a printer. NB the add printer command MUST -return a single line of text indicating which port the printer was -added on. If it doesn't, Samba won't reload the printer -definitions. Although samba doesn't really support the notion of -ports, suitable add printer command and enumport command settings can -allow you pretty good remote control of the samba printer setup. -

    Prev Up 
    Chapter 6. Features Home 
    diff --git a/docs/htmldocs/ads.html b/docs/htmldocs/ads.html deleted file mode 100644 index b7468eb091..0000000000 --- a/docs/htmldocs/ads.html +++ /dev/null @@ -1,467 +0,0 @@ - -Samba as a ADS domain member
    SAMBA Project Documentation
    PrevNext

    Chapter 9. Samba as a ADS domain member

    This is a rough guide to setting up Samba 3.0 with kerberos authentication against a -Windows2000 KDC.

    9.1. Setup your smb.conf

    You must use at least the following 3 options in smb.conf:

      realm = YOUR.KERBEROS.REALM
-  security = ADS
-  encrypt passwords = yes

    In case samba can't figure out your ads server using your realm name, use the -ads server option in smb.conf: -

      ads server = your.kerberos.server

    You do *not* need a smbpasswd file, and older clients will - be authenticated as if security = domain, - although it won't do any harm - and allows you to have local users not in the domain. - I expect that the above required options will change soon when we get better - active directory integration.

    9.2. Setup your /etc/krb5.conf

    The minimal configuration for krb5.conf is:

    [realms]
-    YOUR.KERBEROS.REALM = {
-	kdc = your.kerberos.server
-    }

    Test your config by doing a kinit USERNAME@REALM and making sure that - your password is accepted by the Win2000 KDC.

    The realm must be uppercase.

    You also must ensure that you can do a reverse DNS lookup on the IP -address of your KDC. Also, the name that this reverse lookup maps to -must either be the netbios name of the KDC (ie. the hostname with no -domain attached) or it can alternatively be the netbios name -followed by the realm.

    The easiest way to ensure you get this right is to add a -/etc/hosts entry mapping the IP address of your KDC to -its netbios name. If you don't get this right then you will get a -"local error" when you try to join the realm.

    If all you want is kerberos support in smbclient then you can skip -straight to Test with smbclient now. -Creating a computer account -and testing your servers -is only needed if you want kerberos -support for smbd and winbindd.

    9.3. Create the computer account

    As a user that has write permission on the Samba private directory -(usually root) run: -net ads join

    9.3.1. Possible errors

    "ADS support not compiled in"

    Samba must be reconfigured (remove config.cache) and recompiled (make clean all install) after the kerberos libs and headers are installed.

    9.4. Test your server setup

    On a Windows 2000 client try net use * \\server\share. You should -be logged in with kerberos without needing to know a password. If -this fails then run klist tickets. Did you get a ticket for the -server? Does it have an encoding type of DES-CBC-MD5 ?

    9.5. Testing with smbclient

    On your Samba server try to login to a Win2000 server or your Samba -server using smbclient and kerberos. Use smbclient as usual, but -specify the -k option to choose kerberos authentication.

    9.6. Notes

    You must change administrator password at least once after DC -install, to create the right encoding types

    w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in - their defaults DNS setup. Maybe fixed in service packs?

    PrevHomeNext
    Samba Backup Domain Controller to Samba Domain ControlUpSamba as a NT4 or Win2k domain member
    \ No newline at end of file diff --git a/docs/htmldocs/advancednetworkmanagement.html b/docs/htmldocs/advancednetworkmanagement.html deleted file mode 100644 index b55eed16bc..0000000000 --- a/docs/htmldocs/advancednetworkmanagement.html +++ /dev/null @@ -1,555 +0,0 @@ - -Advanced Network Manangement
    SAMBA Project Documentation
    PrevNext

    Chapter 16. Advanced Network Manangement

    This section attempts to document peripheral issues that are of great importance to network -administrators who want to improve network resource access control, to automate the user -environment, and to make their lives a little easier.

    16.1. Configuring Samba Share Access Controls

    This section deals with how to configure Samba per share access control restrictions. -By default samba sets no restrictions on the share itself. Restrictions on the share itself -can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can -connect to a share. In the absence of specific restrictions the default setting is to allow -the global user Everyone Full Control (ie: Full control, Change and Read).

    At this time Samba does NOT provide a tool for configuring access control setting on the Share -itself. Samba does have the capacity to store and act on access control settings, but the only -way to create those settings is to use either the NT4 Server Manager or the Windows 200x MMC for -Computer Management.

    Samba stores the per share access control settings in a file called share_info.tdb. -The location of this file on your system will depend on how samba was compiled. The default location -for samba's tdb files is under /usr/local/samba/var. If the tdbdump -utility has been compiled and installed on your system then you can examine the contents of this file -by: tdbdump share_info.tdb.

    16.1.1. Share Permissions Management

    The best tool for the task is platform dependant. Choose the best tool for your environmemt.

    16.1.1.1. Windows NT4 Workstation/Server

    The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. -Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. -You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below.

    Instructions

    1. Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu -select Computer, then click on the Shared Directories entry.

    2. Now click on the share that you wish to manage, then click on the Properties tab, next click on - the Permissions tab. Now you can Add or change access control settings as you wish.

    16.1.1.2. Windows 200x/XP

    On MS Windows NT4/200x/XP system access control lists on the share itself are set using native -tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder, -then select 'Sharing', then click on 'Permissions'. The default Windows NT4/200x permission allows -Everyone Full Control on the Share.

    MS Windows 200x and later all comes with a tool called the 'Computer Management' snap-in for the -Microsoft Management Console (MMC). This tool is located by clicking on Control Panel -> -Administrative Tools -> Computer Management.

    Instructions

    1. After launching the MMC with the Computer Management snap-in, click on the menu item 'Action', - select 'Connect to another computer'. If you are not logged onto a domain you will be prompted - to enter a domain login user identifier and a password. This will authenticate you to the domain. - If you where already logged in with administrative privilidge this step is not offered.

    2. If the Samba server is not shown in the Select Computer box, then type in the name of the target -Samba server in the field 'Name:'. Now click on the [+] next to 'System Tools', then on the [+] -next to 'Shared Folders' in the left panel.

    3. Now in the right panel, double-click on the share you wish to set access control permissions on. -Then click on the tab 'Share Permissions'. It is now possible to add access control entities -to the shared folder. Do NOT forget to set what type of access (full control, change, read) you -wish to assign for each entry.

    Be careful. If you take away all permissions from the Everyone user without removing this user -then effectively no user will be able to access the share. This is a result of what is known as -ACL precidence. ie: Everyone with NO ACCESS means that MaryK who is part of the group Everyone -will have no access even if this user is given explicit full control access.

    16.2. Remote Server Administration

    How do I get 'User Manager' and 'Server Manager'?

    Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains', -the 'Server Manager'?

    Microsoft distributes a version of these tools called nexus for installation on Windows 9x / Me -systems. The tools set includes:

    • Server Manager

    • User Manager for Domains

    • Event Viewer

    Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE

    The Windows NT 4.0 version of the 'User Manager for -Domains' and 'Server Manager' are available from Microsoft via ftp -from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE

    16.3. Network Logon Script Magic

    This section needs work. Volunteer contributions most welcome. Please send your patches or updates -to John Terpstra.

    There are several opportunities for creating a custom network startup configuration environment.

    No Logon Script
    Simple universal Logon Script that applies to all users
    Use of a conditional Logon Script that applies per user or per group attirbutes
    Use of Samba's Preexec and Postexec functions on access to the NETLOGON share to create - a custom Logon Script and then execute it.
    User of a tool such as KixStart

    The Samba source code tree includes two logon script generation/execution tools. See examples directory genlogon and ntlogon subdirectories.

    The following listings are from the genlogon directory.

    This is the genlogon.pl file: - -

    	#!/usr/bin/perl
-	#
-	# genlogon.pl
-	#
-	# Perl script to generate user logon scripts on the fly, when users
-	# connect from a Windows client.  This script should be called from smb.conf
-	# with the %U, %G and %L parameters. I.e:
-	#
-	#       root preexec = genlogon.pl %U %G %L
-	#
-	# The script generated will perform
-	# the following:
-	#
-	# 1. Log the user connection to /var/log/samba/netlogon.log
-	# 2. Set the PC's time to the Linux server time (which is maintained
-	#    daily to the National Institute of Standard's Atomic clock on the
-	#    internet.
-	# 3. Connect the user's home drive to H: (H for Home).
-	# 4. Connect common drives that everyone uses.
-	# 5. Connect group-specific drives for certain user groups.
-	# 6. Connect user-specific drives for certain users.
-	# 7. Connect network printers.
-
-	# Log client connection
-	#($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
-	($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
-	open LOG, ">>/var/log/samba/netlogon.log";
-	print LOG "$mon/$mday/$year $hour:$min:$sec - User $ARGV[0] logged into $ARGV[1]\n";
-	close LOG;
-
-	# Start generating logon script
-	open LOGON, ">/shared/netlogon/$ARGV[0].bat";
-	print LOGON "\@ECHO OFF\r\n";
-
-	# Connect shares just use by Software Development group
-	if ($ARGV[1] eq "SOFTDEV" || $ARGV[0] eq "softdev")
-	{
-		print LOGON "NET USE M: \\\\$ARGV[2]\\SOURCE\r\n";
-	}
-
-	# Connect shares just use by Technical Support staff
-	if ($ARGV[1] eq "SUPPORT" || $ARGV[0] eq "support")
-	{
-		print LOGON "NET USE S: \\\\$ARGV[2]\\SUPPORT\r\n";
-	}
-
-	# Connect shares just used by Administration staff
-	If ($ARGV[1] eq "ADMIN" || $ARGV[0] eq "admin")
-	{
-		print LOGON "NET USE L: \\\\$ARGV[2]\\ADMIN\r\n";
-		print LOGON "NET USE K: \\\\$ARGV[2]\\MKTING\r\n";
-	}
-
-	# Now connect Printers.  We handle just two or three users a little
-	# differently, because they are the exceptions that have desktop
-	# printers on LPT1: - all other user's go to the LaserJet on the
-	# server.
-	if ($ARGV[0] eq 'jim'
-	    || $ARGV[0] eq 'yvonne')
-	{
-		print LOGON "NET USE LPT2: \\\\$ARGV[2]\\LJET3\r\n";
-		print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
-	}
-	else
-	{
-		print LOGON "NET USE LPT1: \\\\$ARGV[2]\\LJET3\r\n";
-		print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
-	}
-
-	# All done! Close the output file.
-	close LOGON;

    Those wishing to use more elaborate or capable logon processing system should check out the following sites:

    http://www.craigelachie.org/rhacer/ntlogon
    http://www.kixtart.org

    PrevHomeNext
    Unified Logons between Windows NT and UNIX using WinbindUpSystem and Account Policies
    \ No newline at end of file diff --git a/docs/htmldocs/appendixes.html b/docs/htmldocs/appendixes.html deleted file mode 100644 index 8015702c51..0000000000 --- a/docs/htmldocs/appendixes.html +++ /dev/null @@ -1,140 +0,0 @@ - -Appendixes
    SAMBA Project Documentation
    PrevNext

    IV. Appendixes

    PrevHomeNext
    Unicode/Charsets How to compile SAMBA
    \ No newline at end of file diff --git a/docs/htmldocs/browsing-quick.html b/docs/htmldocs/browsing-quick.html deleted file mode 100644 index 4611db7195..0000000000 --- a/docs/htmldocs/browsing-quick.html +++ /dev/null @@ -1,805 +0,0 @@ - -Quick Cross Subnet Browsing / Cross Workgroup Browsing guide
    SAMBA Project Documentation
    PrevNext

    Chapter 3. Quick Cross Subnet Browsing / Cross Workgroup Browsing guide

    This document should be read in conjunction with Browsing and may -be taken as the fast track guide to implementing browsing across subnets -and / or across workgroups (or domains). WINS is the best tool for resolution -of NetBIOS names to IP addesses. WINS is NOT involved in browse list handling -except by way of name to address mapping.

    MS Windows 2000 and later can be configured to operate with NO NetBIOS -over TCP/IP. Samba-3 and later also supports this mode of operation.

    3.1. Discussion

    Firstly, all MS Windows networking is based on SMB (Server Message -Block) based messaging. SMB messaging may be implemented using NetBIOS or -without NetBIOS. Samba implements NetBIOS by encapsulating it over TCP/IP. -MS Windows products can do likewise. NetBIOS based networking uses broadcast -messaging to affect browse list management. When running NetBIOS over -TCP/IP this uses UDP based messaging. UDP messages can be broadcast or unicast.

    Normally, only unicast UDP messaging can be forwarded by routers. The -remote announce -parameter to smb.conf helps to project browse announcements -to remote network segments via unicast UDP. Similarly, the -remote browse sync parameter of smb.conf -implements browse list collation using unicast UDP.

    Secondly, in those networks where Samba is the only SMB server technology -wherever possible nmbd should be configured on one (1) machine as the WINS -server. This makes it easy to manage the browsing environment. If each network -segment is configured with it's own Samba WINS server, then the only way to -get cross segment browsing to work is by using the -remote announce and the remote browse sync -parameters to your smb.conf file.

    If only one WINS server is used for an entire multi-segment network then -the use of the remote announce and the -remote browse sync parameters should NOT be necessary.

    As of Samba 3 WINS replication is being worked on. The bulk of the code has -been committed, but it still needs maturation.

    Right now samba WINS does not support MS-WINS replication. This means that -when setting up Samba as a WINS server there must only be one nmbd configured -as a WINS server on the network. Some sites have used multiple Samba WINS -servers for redundancy (one server per subnet) and then used -remote browse sync and remote announce -to affect browse list collation across all -segments. Note that this means clients will only resolve local names, -and must be configured to use DNS to resolve names on other subnets in -order to resolve the IP addresses of the servers they can see on other -subnets. This setup is not recommended, but is mentioned as a practical -consideration (ie: an 'if all else fails' scenario).

    Lastly, take note that browse lists are a collection of unreliable broadcast -messages that are repeated at intervals of not more than 15 minutes. This means -that it will take time to establish a browse list and it can take up to 45 -minutes to stabilise, particularly across network segments.

    3.2. How browsing functions and how to deploy stable and -dependable browsing using Samba

    As stated above, MS Windows machines register their NetBIOS names -(i.e.: the machine name for each service type in operation) on start -up. Also, as stated above, the exact method by which this name registration -takes place is determined by whether or not the MS Windows client/server -has been given a WINS server address, whether or not LMHOSTS lookup -is enabled, or if DNS for NetBIOS name resolution is enabled, etc.

    In the case where there is no WINS server all name registrations as -well as name lookups are done by UDP broadcast. This isolates name -resolution to the local subnet, unless LMHOSTS is used to list all -names and IP addresses. In such situations Samba provides a means by -which the samba server name may be forcibly injected into the browse -list of a remote MS Windows network (using the -remote announce parameter).

    Where a WINS server is used, the MS Windows client will use UDP -unicast to register with the WINS server. Such packets can be routed -and thus WINS allows name resolution to function across routed networks.

    During the startup process an election will take place to create a -local master browser if one does not already exist. On each NetBIOS network -one machine will be elected to function as the domain master browser. This -domain browsing has nothing to do with MS security domain control. -Instead, the domain master browser serves the role of contacting each local -master browser (found by asking WINS or from LMHOSTS) and exchanging browse -list contents. This way every master browser will eventually obtain a complete -list of all machines that are on the network. Every 11-15 minutes an election -is held to determine which machine will be the master browser. By the nature of -the election criteria used, the machine with the highest uptime, or the -most senior protocol version, or other criteria, will win the election -as domain master browser.

    Clients wishing to browse the network make use of this list, but also depend -on the availability of correct name resolution to the respective IP -address/addresses.

    Any configuration that breaks name resolution and/or browsing intrinsics -will annoy users because they will have to put up with protracted -inability to use the network services.

    Samba supports a feature that allows forced synchonisation -of browse lists across routed networks using the remote -browse sync parameter in the smb.conf file. -This causes Samba to contact the local master browser on a remote network and -to request browse list synchronisation. This effectively bridges -two networks that are separated by routers. The two remote -networks may use either broadcast based name resolution or WINS -based name resolution, but it should be noted that the remote -browse sync parameter provides browse list synchronisation - and -that is distinct from name to address resolution, in other -words, for cross subnet browsing to function correctly it is -essential that a name to address resolution mechanism be provided. -This mechanism could be via DNS, /etc/hosts, -and so on.

    3.3. Use of the Remote Announce parameter

    The remote announce parameter of -smb.conf can be used to forcibly ensure -that all the NetBIOS names on a network get announced to a remote network. -The syntax of the remote announce parameter is: -

    	remote announce = a.b.c.d [e.f.g.h] ...
    -_or_ -
    	remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...
    - -where: -

    a.b.c.d and -e.f.g.h

    is either the LMB (Local Master Browser) IP address -or the broadcst address of the remote network. -ie: the LMB is at 192.168.1.10, or the address -could be given as 192.168.1.255 where the netmask -is assumed to be 24 bits (255.255.255.0). -When the remote announcement is made to the broadcast -address of the remote network every host will receive -our announcements. This is noisy and therefore -undesirable but may be necessary if we do NOT know -the IP address of the remote LMB.

    WORKGROUP

    is optional and can be either our own workgroup -or that of the remote network. If you use the -workgroup name of the remote network then our -NetBIOS machine names will end up looking like -they belong to that workgroup, this may cause -name resolution problems and should be avoided.

    3.4. Use of the Remote Browse Sync parameter

    The remote browse sync parameter of -smb.conf is used to announce to -another LMB that it must synchronise it's NetBIOS name list with our -Samba LMB. It works ONLY if the Samba server that has this option is -simultaneously the LMB on it's network segment.

    The syntax of the remote browse sync parameter is: - -

    remote browse sync = a.b.c.d
    - -where a.b.c.d is either the IP address of the remote LMB or else is the network broadcast address of the remote segment.

    3.5. Use of WINS

    Use of WINS (either Samba WINS _or_ MS Windows NT Server WINS) is highly -recommended. Every NetBIOS machine registers it's name together with a -name_type value for each of of several types of service it has available. -eg: It registers it's name directly as a unique (the type 0x03) name. -It also registers it's name if it is running the lanmanager compatible -server service (used to make shares and printers available to other users) -by registering the server (the type 0x20) name.

    All NetBIOS names are up to 15 characters in length. The name_type variable -is added to the end of the name - thus creating a 16 character name. Any -name that is shorter than 15 characters is padded with spaces to the 15th -character. ie: All NetBIOS names are 16 characters long (including the -name_type information).

    WINS can store these 16 character names as they get registered. A client -that wants to log onto the network can ask the WINS server for a list -of all names that have registered the NetLogon service name_type. This saves -broadcast traffic and greatly expedites logon processing. Since broadcast -name resolution can not be used across network segments this type of -information can only be provided via WINS _or_ via statically configured -lmhosts files that must reside on all clients in the -absence of WINS.

    WINS also serves the purpose of forcing browse list synchronisation by all -LMB's. LMB's must synchronise their browse list with the DMB (domain master -browser) and WINS helps the LMB to identify it's DMB. By definition this -will work only within a single workgroup. Note that the domain master browser -has NOTHING to do with what is referred to as an MS Windows NT Domain. The -later is a reference to a security environment while the DMB refers to the -master controller for browse list information only.

    Use of WINS will work correctly only if EVERY client TCP/IP protocol stack -has been configured to use the WINS server/s. Any client that has not been -configured to use the WINS server will continue to use only broadcast based -name registration so that WINS may NEVER get to know about it. In any case, -machines that have not registered with a WINS server will fail name to address -lookup attempts by other clients and will therefore cause workstation access -errors.

    To configure Samba as a WINS server just add -wins support = yes to the smb.conf -file [globals] section.

    To configure Samba to register with a WINS server just add -"wins server = a.b.c.d" to your smb.conf file [globals] section.

    Never use both wins support = yes together -with wins server = a.b.c.d -particularly not using it's own IP address. -Specifying both will cause nmbd to refuse to start!

    3.5.1. WINS Replication

    Samba-3 permits WINS replication through the use of the wrepld utility. -This tool is not currently capable of being used as it is still in active development. -As soon as this tool becomes moderately functional we will prepare man pages and enhance this -section of the documentation to provide usage and technical details.

    3.5.2. Static WINS Entries

    New to Samba-3 is a tool called winsedit that may be used to add -static WINS entries to the WINS database. This tool can be used also to modify entries -existing in the WINS database.

    The development of the winsedit tool was made necessary due to the migration -of the older style wins.dat file into a new tdb binary backend data store.

    3.6. Do NOT use more than one (1) protocol on MS Windows machines

    A very common cause of browsing problems results from installing more than -one protocol on an MS Windows machine.

    Every NetBIOS machine takes part in a process of electing the LMB (and DMB) -every 15 minutes. A set of election criteria is used to determine the order -of precidence for winning this election process. A machine running Samba or -Windows NT will be biased so that the most suitable machine will predictably -win and thus retain it's role.

    The election process is "fought out" so to speak over every NetBIOS network -interface. In the case of a Windows 9x machine that has both TCP/IP and IPX -installed and has NetBIOS enabled over both protocols the election will be -decided over both protocols. As often happens, if the Windows 9x machine is -the only one with both protocols then the LMB may be won on the NetBIOS -interface over the IPX protocol. Samba will then lose the LMB role as Windows -9x will insist it knows who the LMB is. Samba will then cease to function -as an LMB and thus browse list operation on all TCP/IP only machines will -fail.

    Windows 95, 98, 98se, Me are referred to generically as Windows 9x. -The Windows NT4, 2000, XP and 2003 use common protocols. These are roughly -referred to as the WinNT family, but it should be recognised that 2000 and -XP/2003 introduce new protocol extensions that cause them to behave -differently from MS Windows NT4. Generally, where a server does NOT support -the newer or extended protocol, these will fall back to the NT4 protocols.

    The safest rule of all to follow it this - USE ONLY ONE PROTOCOL!

    3.7. Name Resolution Order

    Resolution of NetBIOS names to IP addresses can take place using a number -of methods. The only ones that can provide NetBIOS name_type information -are:

    WINS: the best tool!
    LMHOSTS: is static and hard to maintain.
    Broadcast: uses UDP and can not resolve names across remote segments.

    Alternative means of name resolution includes:

    /etc/hosts: is static, hard to maintain, and lacks name_type info
    DNS: is a good choice but lacks essential name_type info.

    Many sites want to restrict DNS lookups and want to avoid broadcast name -resolution traffic. The "name resolve order" parameter is of great help here. -The syntax of the "name resolve order" parameter is: -

    name resolve order = wins lmhosts bcast host
    -_or_ -
    name resolve order = wins lmhosts  	(eliminates bcast and host)
    -The default is: -
    name  resolve order = host lmhost wins bcast
    . -where "host" refers the the native methods used by the Unix system -to implement the gethostbyname() function call. This is normally -controlled by /etc/host.conf, /etc/nsswitch.conf and /etc/resolv.conf.

    PrevHomeNext
    How to Install and Test SAMBAUpUser information database
    \ No newline at end of file diff --git a/docs/htmldocs/cups-printing.html b/docs/htmldocs/cups-printing.html deleted file mode 100644 index 8dd4a94f4f..0000000000 --- a/docs/htmldocs/cups-printing.html +++ /dev/null @@ -1,2773 +0,0 @@ - -CUPS Printing Support
    SAMBA Project Documentation
    PrevNext

    Chapter 14. CUPS Printing Support

    14.1. Introduction

    The Common Unix Print System (CUPS) has become very popular, but to many it is -a very mystical tool. There is a great deal of uncertainty regarding CUPS and how -it works. The result is seen in a large number of posting on the samba mailing lists -expressing frustration when MS Windows printers appear not to work with a CUPS -backr-end.

    This is a good time to point out how CUPS can be used and what it does. CUPS is more -than just a print spooling system - it is a complete printer management system that -complies with HTTP and IPP protocols. It can be managed remotely via a web browser -and it can print using http and ipp protocols.

    CUPS allows to creation of RAW printers (ie: NO file format translation) as well as -SMART printers (ie: CUPS does file format conversion as required for the printer). In -many ways this gives CUPS similar capabilities to the MS Windows print monitoring -system. Of course, if you are a CUPS advocate, you would agrue that CUPS is better! -In any case, let us now move on to explore how one may configure CUPS for interfacing -with MS Windows print clients via Samba.

    CUPS is a newcomer in the UNIX printing scene, -which has convinced many people upon first trial already. However, it has quite a few -new features, which make it different from other, more traditional printing systems.

    14.2. Configuring smb.conf for CUPS

    Printing with CUPS in the most basic smb.conf -setup in Samba-3 only needs two settings: printing = cups and -printcap = cups. While CUPS itself doesn't need a printcap -anymore, the cupsd.conf configuration file knows two directives -(example: Printcap /etc/printcap and PrintcapFormat -BSD), which control if such a file should be created for the -convenience of third party applications. Make sure it is set! For details see -man cupsd.conf and other CUPS-related documentation.

    If SAMBA is compiled against libcups, then printcap = cups uses the -CUPS API to list printers, submit jobs, etc. Otherwise it maps to the System V commands -with an additional -oraw option for printing. On a Linux system, -you can use the ldd command to find out details (ldd may not be -present on other OS platforms, or its function may be embodied by a different command):

    transmeta:/home/kurt # ldd `which smbd`
-        libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000)
-        libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000)
-        libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000)
-        libdl.so.2 => /lib/libdl.so.2 (0x401e8000)
-        libnsl.so.1 => /lib/libnsl.so.1 (0x401ec000)
-        libpam.so.0 => /lib/libpam.so.0 (0x40202000)
-        libc.so.6 => /lib/libc.so.6 (0x4020b000)
-        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

    The line "libcups.so.2 => /usr/lib/libcups.so.2 -(0x40123000)" shows there is CUPS support compiled into this version of -Samba. If this is the case, and printing = cups is set, then any -otherwise manually set print command in smb.conf is ignored.

    14.3. CUPS - RAW Print Through Mode

    When used in raw print through mode is will be necessary to use the printer -vendor's drivers in each Windows client PC.

    When CUPS printers are configured for RAW print-through mode operation it is the -responsibility of the Samba client to fully render the print job (file) in a format -that is suitable for direct delivery to the printer. In this case CUPS will NOT -do any print file format conversion work.

    The CUPS files that need to be correctly set for RAW mode printers to work are: - -

    • /etc/cups/mime.types

    • /etc/cups/mime.convs

    - -Both contain entries that must be uncommented to allow RAW mode -operation.

    Firstly, to enable CUPS based printing from Samba the following options must be -enabled in your smb.conf file [globals] section: - -

    • printing = CUPS

    • printcap = CUPS

    - -When these parameters are specified the print directives in smb.conf (as well as in -samba itself) will be ignored because samba will directly interface with CUPS through -it's application program interface (API) - so long as Samba has been compiled with -CUPS library (libcups) support. If samba has NOT been compiled with CUPS support then -printing will use the System V AT&T command set with the -oraw -option automatically passing through.

    Cupsomatic (an enhanced printing utility that is part of some CUPS implementations) -on the Samba/CUPS server does *not* add any features if a file is really -printed "raw". However, if you have loaded the driver for the Windows client from -the CUPS server, using the "cupsaddsmb" utility, and if this driver is one using -a "Foomatic" PPD, the PJL header in question is already added on the Windows client, -at the time when the driver initially generated the PostScript data and CUPS in true -"-oraw" manner doesn't remove this PJL header and passes the file "as is" to its -printer communication backend.

    NOTE: editing in the "mime.convs" and the "mime.types" file does not *enforce* -"raw" printing, it only *allows* it.

    Print files that arrive from MS Windows printing are "auto-typed" by CUPS. This aids -the process of determining proper treatment while in the print queue system. - -

    • Files generated by PCL drivers and directed at PCK printers get auto-typed as - application/octet-stream. Unknown file format types also - get auto-typed with this tag. -

    • Files generated by a Postscript driver and directed at a Postscript printer - are auto-typed depending on the auto-detected most suitable MIME type as: - -

      • * application/postscript

      • * application/vnd.cups-postscript

      -

    "application/postscript" first goes thru the "pstops" filter (where the page counting -and accounting takes place). The outcome will be of MIME type -"application/vnd.cups-postscript". The pstopsfilter reads and uses information from -the PPD and inserts user-provided options into the PostScript file. As a consequence, -the filtered file could possibly have an unwanted PJL header.

    "application/postscript" will be all files with a ".ps", ".ai", ".eps" suffix or which -have as their first character string one of "%!" or ">04<%".

    "application/vnd.cups-postscript" will files which contain the string -"LANGUAGE=POSTSCRIPT" (or similar variations with different capitalization) in the -first 512 bytes, and also contain the "PJL super escape code" in the first 128 bytes -(">1B<%-12345X"). Very likely, most PostScript files generated on Windows using a CUPS -or other PPD, will have to be auto-typed as "vnd.cups-postscript". A file produced -with a "Generic PostScript driver" will just be tagged "application/postscript".

    Once the file is in "application/vnd.cups-postscript" format, either "pstoraster" -or "cupsomatic" will take over (depending on the printer configuration, as -determined by the PPD in use).

    A printer queue with *no* PPD associated to it is a "raw" printer and all files -will go directly there as received by the spooler. The exeptions are file types -"application/octet-stream" which need "passthrough feature" enabled. -"Raw" queues don't do any filtering at all, they hand the file directly to the -CUPS backend. This backend is responsible for the sending of the data to the device -(as in the "device URI" notation as lpd://, socket://, smb://, ipp://, http://, -parallel:/, serial:/, usb:/ etc.)

    "cupsomatic"/Foomatic are *not* native CUPS drivers and they don't ship with CUPS. -They are a Third Party add-on, developed at Linuxprinting.org. As such, they are -a brilliant hack to make all models (driven by Ghostscript drivers/filters in -traditional spoolers) also work via CUPS, with the same (good or bad!) quality -as in these other spoolers. "cupsomatic" is only a vehicle to execute a ghostscript -commandline at that stage in the CUPS filtering chain, where "normally" the native -CUPS "pstoraster" filter would kick in. cupsomatic by-passes pstoraster, "kidnaps" -the printfile from CUPS away and re-directs it to go through Ghostscipt. CUPS accepts this, -because the associated CUPS-O-Matic-/Foomatic-PPD specifies:

       *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"

    This line persuades CUPS to hand the file to cupsomatic, once it has successfully -converted it to the MIME type "application/vnd.cups-postscript". This conversion will not -happen for Jobs arriving from Windows which are auto-typed "application/octet-stream", -with the according changes in "/etc/cups/mime.types" in place.

    CUPS is widely configurable and flexible, even regarding its filtering mechanism. -Another workaround in some situations would be to have -in "/etc/cups/mime.types" entries as follows:

       application/postscript           application/vnd.cups-raw  0  -
-   application/vnd.cups-postscript  application/vnd.cups-raw  0  -

    This would prevent all Postscript files from being filtered (rather, they will go -thru the virtual "nullfilter" denoted with "-"). This could only be useful for -PS printers. If you want to print PS code on non-PS printers an entry as follows -could be useful:

       */*           application/vnd.cups-raw  0  -

    and would effectively send *all* files to the backend without further processing.

    Lastly, you could have the following entry:

       application/vnd.cups-postscript  application/vnd.cups-raw  0  my_PJL_stripping_filter

    You will need to write a "my_PJL_stripping_filter" (could be a shellscript) that -parses the PostScript and removes the unwanted PJL. This would need to conform to -CUPS filter design (mainly, receive and pass the parameters printername, job-id, -username, jobtitle, copies, print options and possibly the filename). It would -be installed as world executable into "/usr/lib/cups/filters/" and will be called -by CUPS if it encounters a MIME type "application/vnd.cups-postscript".

    CUPS can handle "-o job-hold-until=indefinite". This keeps the job in the queue -"on hold". It will only be printed upon manual release by the printer operator. -This is a requirement in many "central reproduction departments", where a few -operators manage the jobs of hundreds of users on some big machine, where no -user is allowed to have direct access. (The operators often need to load the -proper paper type before running the 10.000 page job requested by marketing -for the mailing, etc.).

    14.4. CUPS as a network PostScript RIP -- CUPS drivers working on server, Adobe -PostScript driver with CUPS-PPDs downloaded to clients

    CUPS is perfectly able to use PPD files (PostScript -Printer Descriptions). PPDs can control all print device options. They -are usually provided by the manufacturer -- if you own a PostSript printer, -that is. PPD files are always a component of PostScript printer drivers on MS -Windows or Apple Mac OS systems. They are ASCII files containing -user-selectable print options, mapped to appropriate PostScript, PCL or PJL -commands for the target printer. Printer driver GUI dialogs translate these -options "on-the-fly" into buttons and drop-down lists for the user to -select.

    CUPS can load, without any conversions, the PPD file from -any Windows (NT is recommended) PostScript driver and handle the options. -There is a web browser interface to the print options (select -http://localhost:631/printers/ and click on one "Configure Printer" button -to see it), a commandline interface (see man lpoptions or -try if you have lphelp on your system) plus some different GUI frontends on Linux -UNIX, which can present PPD options to the users. PPD options are normally -meant to become evaluated by the PostScript RIP on the real PostScript -printer.

    CUPS doesn't stop at "real" PostScript printers in its -usage of PPDs. The CUPS developers have extended the PPD concept, to also -describe available device and driver options for non-PostScript printers -through CUPS-PPDs.

    This is logical, as CUPS includes a fully featured -PostScript interpreter (RIP). This RIP is based on Ghostscript. It can -process all received PostScript (and additionally many other file formats) -from clients. All CUPS-PPDs geared to non-PostScript printers contain an -additional line, starting with the keyword *cupsFilter. -This line -tells the CUPS print system which printer-specific filter to use for the -interpretation of the accompanying PostScript. Thus CUPS lets all its -printers appear as PostScript devices to its clients, because it can act as a -PostScript RIP for those printers, processing the received PostScript code -into a proper raster print format.

    CUPS-PPDs can also be used on Windows-Clients, on top of a -PostScript driver (recommended is the Adobe one).

    This feature enables CUPS to do a few tricks no other -spooler can do:

    • act as a networked PostScript RIP (Raster Image Processor), handling - printfiles from all client platforms in a uniform way;

    • act as a central accounting and billing server, as all files are passed - through the pstops Filter and are therefor logged in - the CUPS page_log. - NOTE: this - can not happen with "raw" print jobs, which always remain unfiltered - per definition;

    • enable clients to consolidate on a single PostScript driver, even for - many different target printers.

    14.5. Windows Terminal Servers (WTS) as CUPS clients

    This setup may be of special interest to people -experiencing major problems in WTS environments. WTS need often a multitude -of non-PostScript drivers installed to run their clients' variety of -different printer models. This often imposes the price of much increased -instability. In many cases, in an attempt to overcome this problem, site -administrators have resorted to restrict the allowed drivers installed on -their WTS to one generic PCL- and one PostScript driver. This however -restricts the clients in the amount of printer options available for them -- -often they can't get out more then simplex prints from one standard paper -tray, while their devices could do much better, if driven by a different -driver!

    Using an Adobe PostScript driver, enabled with a CUPS-PPD, -seems to be a very elegant way to overcome all these shortcomings. The -PostScript driver is not known to cause major stability problems on WTS (even -if used with many different PPDs). The clients will be able to (again) chose -paper trays, duplex printing and other settings. However, there is a certain -price for this too: a CUPS server acting as a PostScript RIP for its clients -requires more CPU and RAM than just to act as a "raw spooling" device. Plus, -this setup is not yet widely tested, although the first feedbacks look very -promising...

    14.6. Setting up CUPS for driver download

    The cupsadsmb utility (shipped with all current -CUPS versions) makes the sharing of any (or all) installed CUPS printers very -easy. Prior to using it, you need the following settings in smb.conf:

    [global]
-		 load printers = yes
-		 printing = cups
-		 printcap name = cups
-
-	[printers]
-		 comment = All Printers
-		 path = /var/spool/samba
-		 browseable = no
-		 public = yes
-		 guest ok = yes
-		 writable = no
-		 printable = yes
-		 printer admin = root
-
-	[print$]
-		 comment = Printer Drivers
-		 path = /etc/samba/drivers
-		 browseable = yes
-		 guest ok = no
-		 read only = yes
-		 write list = root
-

    For licensing reasons the necessary files of the Adobe -Postscript driver can not be distributed with either Samba or CUPS. You need -to download them yourself from the Adobe website. Once extracted, create a -drivers directory in the CUPS data directory (usually -/usr/share/cups/). Copy the Adobe files using -UPPERCASE filenames, to this directory as follows:

    		ADFONTS.MFM
-		ADOBEPS4.DRV
-		ADOBEPS4.HLP
-		ADOBEPS5.DLL
-		ADOBEPSU.DLL
-		ADOBEPSU.HLP
-		DEFPRTR2.PPD
-		ICONLIB.DLL
-

    Users of the ESP Print Pro software are able to install -their "Samba Drivers" package for this purpose with no problem.

    14.7. Sources of CUPS drivers / PPDs

    On the internet you can find now many thousand CUPS-PPD -files (with their companion filters), in many national languages, -supporting more than 1.000 non-PostScript models.

    NOTE: the cupsomatic trick from Linuxprinting.org is -working different from the other drivers. While the other drivers take the -generic CUPS raster (produced by CUPS' own pstoraster PostScript RIP) as -their input, cupsomatic "kidnaps" the PostScript inside CUPS, before -RIP-ping, deviates it to an external Ghostscript installation (which now -becomes the RIP) and gives it back to a CUPS backend once Ghostscript is -finished. -- CUPS versions from 1.1.15 and later will provide their pstoraster -PostScript RIP function again inside a system-wide Ghostscript -installation rather than in "their own" pstoraster filter. (This -CUPS-enabling Ghostscript version may be installed either as a -patch to GNU or AFPL Ghostscript, or as a complete ESP Ghostscript package). -However, this will not change the cupsomatic approach of guiding the printjob -along a different path through the filtering system than the standard CUPS -way...

    Once you installed a printer inside CUPS with one of the -recommended methods (the lpadmin command, the web browser interface or one of -the available GUI wizards), you can use cupsaddsmb to share the -printer via Samba. cupsaddsmb prepares the driver files for -comfortable client download and installation upon their first contact with -this printer share.

    14.7.1. cupsaddsmb

    The cupsaddsmb command copies the needed files -for convenient Windows client installations from the previously prepared CUPS -data directory to your [print$] share. Additionally, the PPD -associated with this printer is copied from /etc/cups/ppd/ to -[print$].

    root#  cupsaddsmb -U root infotec_IS2027
-Password for root required to access localhost via SAMBA: [type in password 'secret']

    To share all printers and drivers, use the -a -parameter instead of a printer name.

    Probably you want to see what's going on. Use the --v parameter to get a more verbose output:

    Probably you want to see what's going on. Use the --v parameter to get a more verbose output:

    Note: The following line shave been wrapped so that information is not lost.
- 
-root#  cupsaddsmb -v -U root infotec_IS2027
-    Password for root required to access localhost via SAMBA:
-    Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir W32X86;put
-       /var/spool/cups/tmp/3cd1cc66376c0 W32X86/infotec_IS2027.PPD;put /usr/share/cups/drivers/
-       ADOBEPS5.DLL W32X86/ADOBEPS5.DLL;put /usr/share/cups/drivers/ADOBEPSU.DLLr
-       W32X86/ADOBEPSU.DLL;put /usr/share/cups/drivers/ADOBEPSU.HLP W32X86/ADOBEPSU.HLP'
-    added interface ip=10.160.16.45 bcast=10.160.31.255 nmask=255.255.240.0
-    added interface ip=192.168.182.1 bcast=192.168.182.255 nmask=255.255.255.0
-    added interface ip=172.16.200.1 bcast=172.16.200.255 nmask=255.255.255.0
-    Domain=[TUX-NET] OS=[Unix] Server=[Samba 2.2.3a.200204262025cvs]
-    NT_STATUS_OBJECT_NAME_COLLISION making remote directory \W32X86
-    putting file /var/spool/cups/tmp/3cd1cc66376c0 as \W32X86/infotec_IS2027.PPD (17394.6 kb/s)
-      (average 17395.2 kb/s)
-    putting file /usr/share/cups/drivers/ADOBEPS5.DLL as \W32X86/ADOBEPS5.DLL (10877.4 kb/s)
-      (average 11343.0 kb/s)
-    putting file /usr/share/cups/drivers/ADOBEPSU.DLL as \W32X86/ADOBEPSU.DLL (5095.2 kb/s)
-      (average 9260.4 kb/s)
-    putting file /usr/share/cups/drivers/ADOBEPSU.HLP as \W32X86/ADOBEPSU.HLP (8828.7 kb/s)
-      (average 9247.1 kb/s)
-
-    Running command: smbclient //localhost/print\$ -N -U'root%secret' -c 'mkdir WIN40;put
-      /var/spool/cups/tmp/3cd1cc66376c0 WIN40/infotec_IS2027.PPD;put
-      /usr/share/cups/drivers/ADFONTS.MFM WIN40/ADFONTS.MFM;put
-      /usr/share/cups/drivers/ADOBEPS4.DRV WIN40/ADOBEPS4.DRV;put
-      /usr/share/cups/drivers/ADOBEPS4.HLP WIN40/ADOBEPS4.HLP;put
-      /usr/share/cups/drivers/DEFPRTR2.PPD WIN40/DEFPRTR2.PPD;put
-      /usr/share/cups/drivers/ICONLIB.DLL WIN40/ICONLIB.DLL;put
-      /usr/share/cups/drivers/PSMON.DLL WIN40/PSMON.DLL;'
-    added interface ip=10.160.16.45 bcast=10.160.31.255 nmask=255.255.240.0
-    added interface ip=192.168.182.1 bcast=192.168.182.255 nmask=255.255.255.0
-    added interface ip=172.16.200.1 bcast=172.16.200.255 nmask=255.255.255.0
-    Domain=[TUX-NET] OS=[Unix] Server=[Samba 2.2.3a.200204262025cvs]
-    NT_STATUS_OBJECT_NAME_COLLISION making remote directory \WIN40
-    putting file /var/spool/cups/tmp/3cd1cc66376c0 as \WIN40/infotec_IS2027.PPD (26091.5 kb/s)
-      (average 26092.8 kb/s)
-    putting file /usr/share/cups/drivers/ADFONTS.MFM as \WIN40/ADFONTS.MFM (11241.6 kb/s)
-      (average 11812.9 kb/s)
-    putting file /usr/share/cups/drivers/ADOBEPS4.DRV as \WIN40/ADOBEPS4.DRV (16640.6 kb/s)
-      (average 14679.3 kb/s)
-    putting file /usr/share/cups/drivers/ADOBEPS4.HLP as \WIN40/ADOBEPS4.HLP (11285.6 kb/s)
-      (average 14281.5 kb/s)
-    putting file /usr/share/cups/drivers/DEFPRTR2.PPD as \WIN40/DEFPRTR2.PPD (823.5 kb/s)
-      (average 12944.0 kb/s)
-    putting file /usr/share/cups/drivers/ICONLIB.DLL as \WIN40/ICONLIB.DLL (19226.2 kb/s)
-      (average 13169.7 kb/s)
-    putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL (18666.1 kb/s)
-      (average 13266.7 kb/s)
-
-    Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows NT x86"
-       "infotec_IS2027:ADOBEPS5.DLL:infotec_IS2027.PPD:ADOBEPSU.DLL:ADOBEPSU.HLP:NULL:RAW:NULL"'
-    cmd = adddriver "Windows NT x86" "infotec_IS2027:ADOBEPS5.DLL:infotec_IS2027.PPD:ADOBEPSU.DLL:
-       ADOBEPSU.HLP:NULL:RAW:NULL"
-    Printer Driver infotec_IS2027 successfully installed.
-
-    Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows 4.0"
-       "infotec_IS2027:ADOBEPS4.DRV:infotec_IS2027.PPD:NULL:ADOBEPS4.HLP:PSMON.DLL:RAW:
-       ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
-    cmd = adddriver "Windows 4.0" "infotec_IS2027:ADOBEPS4.DRV:infotec_IS2027.PPD:NULL:
-       ADOBEPS4.HLP:PSMON.DLL:RAW:ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"
-    Printer Driver infotec_IS2027 successfully installed.
-
-    Running command: rpcclient localhost -N -U'root%secret'
-       -c 'setdriver infotec_IS2027 infotec_IS2027'
-    cmd = setdriver infotec_IS2027 infotec_IS2027
-    Succesfully set infotec_IS2027 to driver infotec_IS2027.
-
-    root#

    If you look closely, you'll discover your root password was transfered unencrypted over -the wire, so beware! Also, if you look further her, you'll discover error messages like -NT_STATUS_OBJECT_NAME_COLLISION in between. They occur, because -the directories WIN40 and W32X86 already -existed in the [print$] driver download share (from a previous driver -installation). They are harmless here.

    Now your printer is prepared for the clients to use. From -a client, browse to the CUPS/Samba server, open the "Printers" -share, right-click on this printer and select "Install..." or -"Connect..." (depending on the Windows version you use). Now their -should be a new printer in your client's local "Printers" folder, -named (in my case) "infotec_IS2027 on kdebitshop"

    NOTE: -cupsaddsmb will only reliably work i -with CUPS version 1.1.15 or higher -and Samba from 2.2.4. If it doesn't work, or if the automatic printer -driver download to the clients doesn't succeed, you can still manually -install the CUPS printer PPD on top of the Adobe PostScript driver on -clients and then point the client's printer queue to the Samba printer -share for connection, should you desire to use the CUPS networked -PostScript RIP functions.

    14.8. The CUPS Filter Chains

    The following diagrams reveal how CUPS handles print jobs.

    #########################################################################
-#
-# CUPS in and of itself has this (general) filter chain (CAPITAL
-# letters are FILE-FORMATS or MIME types, other are filters (this is
-# true for pre-1.1.15 of pre-4.3 versions of CUPS and ESP PrintPro):
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      |
-#      V
-#     somethingtops
-#      |
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      |
-#      V
-#     pstops
-#      |
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT
-#      |
-#      |
-#      V
-#     pstoraster   # as shipped with CUPS, independent from any Ghostscipt
-#      |           # installation on the system
-#      |  (= "postscipt interpreter")
-#      |
-#      V
-# APPLICATION/VND.CUPS-RASTER
-#      |
-#      |
-#      V
-#     rastertosomething  (f.e. Gimp-Print filters may be plugged in here)
-#      |   (= "raster driver")
-#      |
-#      V
-# SOMETHING-DEVICE-SPECIFIC
-#      |
-#      |
-#      V
-#     backend
-#
-#
-# ESP PrintPro has some enhanced "rastertosomething" filters as compared to
-# CUPS, and also a somewhat improved "pstoraster" filter.
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
    #########################################################################
-#
-# This is how "cupsomatic" comes into play:
-# =========================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      |
-#      V
-#    somethingtops
-#      |
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      |
-#      V
-#    pstops
-#      |
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
-#      |                                          |
-#      |                                          V
-#      V                                         cupsomatic
-#    pstoraster                                  (constructs complicated
-#      |  (= "postscipt interpreter")            Ghostscript commandline
-#      |                                         to let the file be
-#      V                                         processed by a
-# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
-#      |                                         call...)
-#      |                                          |
-#      V                                          |
-#    rastertosomething                          V
-#      |    (= "raster driver")     +-------------------------+
-#      |                            | Ghostscript at work.... |
-#      V                            |                         |
-# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
-#      |                                          |
-#      |                                          |
-#      V                                          |
-#    backend >------------------------------------+
-#      |
-#      |
-#      V
-#    THE PRINTER
-#
-#
-# Note, that cupsomatic "kidnaps" the printfile after the
-# "APPLICATION/VND.CUPS-POSTSCRPT" stage and deviates it through
-# the CUPS-external, systemwide Ghostscript installation, bypassing the
-# "pstoraster" filter (therefor also bypassing the CUPS-raster-drivers
-# "rastertosomething", and hands the rasterized file directly to the CUPS
-# backend...
-#
-# cupsomatic is not made by the CUPS developers. It is an independent
-# contribution to printing development, made by people from
-# Linuxprinting.org. (see also http://www.cups.org/cups-help.html)
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
    #########################################################################
-#
-# And this is how it works for ESP PrintPro from 4.3:
-# ===================================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      |
-#      V
-#     somethingtops
-#      |
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      |
-#      V
-#     pstops
-#      |
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT
-#      |
-#      |
-#      V
-#     gsrip
-#      |  (= "postscipt interpreter")
-#      |
-#      V
-# APPLICATION/VND.CUPS-RASTER
-#      |
-#      |
-#      V
-#     rastertosomething  (f.e. Gimp-Print filters may be plugged in here)
-#      |   (= "raster driver")
-#      |
-#      V
-# SOMETHING-DEVICE-SPECIFIC
-#      |
-#      |
-#      V
-#     backend
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
    #########################################################################
-#
-# This is how "cupsomatic" would come into play with ESP PrintPro:
-# ================================================================
-#
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      |
-#      V
-#    somethingtops
-#      |
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      |
-#      V
-#    pstops
-#      |
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT ----------------+
-#      |                                          |
-#      |                                          V
-#      V                                         cupsomatic
-#    gsrip                                       (constructs complicated
-#      |  (= "postscipt interpreter")            Ghostscript commandline
-#      |                                         to let the file be
-#      V                                         processed by a
-# APPLICATION/VND.CUPS-RASTER                    "-sDEVICE=s.th."
-#      |                                         call...)
-#      |                                          |
-#      V                                          |
-#    rastertosomething                          V
-#      |   (= "raster driver")      +-------------------------+
-#      |                            | Ghostscript at work.... |
-#      V                            |                         |
-# SOMETHING-DEVICE-SPECIFIC         *-------------------------+
-#      |                                          |
-#      |                                          |
-#      V                                          |
-#    backend >------------------------------------+
-#      |
-#      |
-#      V
-#    THE PRINTER
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
    #########################################################################
-#
-# And this is how it works for CUPS from 1.1.15:
-# ==============================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      |
-#      V
-#     somethingtops
-#      |
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      |
-#      V
-#     pstops
-#      |
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT-----+
-#                                     |
-#                  +------------------v------------------------------+
-#                  | Ghostscript                                     |
-#                  | at work...                                      |
-#                  | (with                                           |
-#                  | "-sDEVICE=cups")                                |
-#                  |                                                 |
-#                  |         (= "postscipt interpreter")             |
-#                  |                                                 |
-#                  +------------------v------------------------------+
-#                                     |
-#                                     |
-# APPLICATION/VND.CUPS-RASTER >-------+
-#      |
-#      |
-#      V
-#     rastertosomething
-#      |   (= "raster driver")
-#      |
-#      V
-# SOMETHING-DEVICE-SPECIFIC
-#      |
-#      |
-#      V
-#     backend
-#
-#
-# NOTE: since version 1.1.15 CUPS "outsourced" the pstoraster process to
-#       Ghostscript. GNU Ghostscript needs to be patched to handle the
-#       CUPS requirement; ESP Ghostscript has this builtin. In any case,
-#       "gs -h" needs to show up a "cups" device. pstoraster is now a
-#       calling an appropriate "gs -sDEVICE=cups..." commandline to do
-#       the job. It will output "application/vnd.cup-raster", which will
-#       be finally processed by a CUPS raster driver "rastertosomething"
-#       Note the difference to "cupsomatic", which will *not* output
-#       CUPS-raster, but a final version of the printfile, ready to be
-#       sent to the printer. cupsomatic also doesn't use the "cups"
-#       devicemode in Ghostscript, but one of the classical devicemodes....
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-#########################################################################
    #########################################################################
-#
-# And this is how it works for CUPS from 1.1.15, with cupsomatic included:
-# ========================================================================
-#
-# SOMETHNG-FILEFORMAT
-#      |
-#      |
-#      V
-#     somethingtops
-#      |
-#      |
-#      V
-# APPLICATION/POSTSCRIPT
-#      |
-#      |
-#      V
-#     pstops
-#      |
-#      |
-#      V
-# APPLICATION/VND.CUPS-POSTSCRIPT-----+
-#                                     |
-#                  +------------------v------------------------------+
-#                  | Ghostscript        . Ghostscript at work....    |
-#                  | at work...         . (with "-sDEVICE=           |
-#                  | (with              .            s.th."        |
-#                  | "-sDEVICE=cups")   .                            |
-#                  |                    .                            |
-#                  | (CUPS standard)    .      (cupsomatic)          |
-#                  |                    .                            |
-#                  |          (= "postscript interpreter")           |
-#                  |                    .                            |
-#                  +------------------v--------------v---------------+
-#                                     |              |
-#                                     |              |
-# APPLICATION/VND.CUPS-RASTER >-------+              |
-#      |                                             |
-#      |                                             |
-#      V                                             |
-#     rastertosomething                            |
-#      |   (= "raster driver")                       |
-#      |                                             |
-#      V                                             |
-# SOMETHING-DEVICE-SPECIFIC >------------------------+
-#      |
-#      |
-#      V
-#     backend
-#
-#
-# NOTE: Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to
-#       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
-#
-##########################################################################

    14.9. CUPS Print Drivers and Devices

    CUPS ships with good support for HP LaserJet type printers. You can install -the driver as follows: - -

    • lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd -

    - -(The "-m" switch will retrieve the "laserjet.ppd" from the standard repository -for not-yet-installed-PPDs, which CUPS typically stores in -/usr/share/cups/model. Alternatively, you may use -"-P /absolute/filesystem/path/to/where/there/is/PPD/your.ppd").

    14.9.1. Further printing steps

    Always also consult the database on linuxprinting.org for all recommendations -about which driver is best used for each printer:

    http://www.linuxprinting.org/printer_list.cgi

    There select your model and click on "Show". You'll arrive at a page listing -all drivers working with your model. There will always be *one* -recommended one. Try this one first. In your case -("HP LaserJet 4 Plus"), you'll arrive here:

    http://www.linuxprinting.org/show_printer.cgi?recnum=75104

    The recommended driver is "ljet4". It has a link to the page for the ljet4 -driver too:

    http://www.linuxprinting.org/show_driver.cgi?driver=ljet4

    On the driver's page, you'll find important and detailed info about how to use -that driver within the various available spoolers. You can generate a PPD for -CUPS. The PPD contains all the info about how to use your model and the driver; -this is, once installed, working transparently for the user -- you'll only -need to choose resolution, paper size etc. from the web-based menu or from -the print dialog GUI or from the commandline...

    On the driver's page, choose to use the "PPD-O-Matic" online PPD generator -program. Select your model and click "Generate PPD file". When you safe the -appearing ASCII text file, don't use "cut'n'past" (as it could possiblly corrupt -line endings and tabs), but use "Save as..." in your browser's menu. Save it -at "/some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"

    Then install the printer:

        "lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E \
-          -P /some/path/on/your/filesystem/somewhere/my-name-for-my-printer.ppd"

    Note, that for all the "Foomatic-PPDs" from Linuxprinting.org, you also need -a special "CUPS filter" named "cupsomatic". Get the latest version of -"cupsomatic" from:

    http://www.linuxprinting.org/cupsomatic

    This needs to be copied to /usr/lib/cups/filter/cupsomatic -and be made world executable. This filter is needed to read and act upon the -specially encoded Foomatic comments, embedded in the printfile, which in turn -are used to construct (transparently for you, the user) the complicated -ghostscript command line needed for your printer/driver combo.

    You can have a look at all the options for the Ghostscript commandline supported -by your printer and the ljet4 driver by going to the section "Execution details", -selecting your model (Laserjet 4 Plus) and clicking on "Show execution details". -This will bring up this web page:

    http://www.linuxprinting.org/execution.cgi?driver=ljet4&printer=75104&.submit=Show+execution+details

    The ingenious thing is that the database is kept current. If there -is a bug fix and an improvement somewhere in the database, you will -always get the most current and stable and feature-rich driver by following -the steps described above.

    Till Kamppeter from MandrakeSoft is doing an excellent job here that too few -people are aware of. (So if you use it often, please send him a note showing -your appreciation).

    The latest and greatest improvement now is support for "custom page sizes" -for all those printers which support it.

    "cupsomatic" is documented here:

    http://www.linuxprinting.org/cups-doc.html

    More printing tutorial info may be found here:

    http://www.linuxprinting.org/kpfeifle/LinuxKongress2002/Tutorial/

    Note, that *all* the Foomatic drivers listed on Linuxprinting.org (now -approaching the "all-time high" number of 1.000 for the supported models) -are using a special filtering chain involving Ghostscript, as described -in this document.

    Summary - You need:

    A "foomatic+something" PPD is not enough to print with CUPS (but it is *one* important component)
    The "cupsomatic" filter script (Perl) in /usr/lib/cups/filters/
    Perl to make cupsomatic run
    Ghostscript (because it is called and controlled by the PPD/cupsomatic combo in a way to fit your printermodel/driver combo.
    Ghostscript *must*, depending on the driver/model, contain support for a certain "device" (as shown by "gs -h")

    In the case of the "hpijs" driver, you need a Ghostscript version, which -has "ijs" amongst its supported devices in "gs -h". In the case of -"hpijs+foomatic", a valid ghostscript commandline would be reading like this:

           gs -q -dBATCH -dPARANOIDSAFER -dQUIET -dNOPAUSE -sDEVICE=ijs       \
-             -sIjsServer=hpijsPageSize -dDuplex=Duplex Model        \
-             -rResolution,PS:MediaPosition=InputSlot -dIjsUseOutputFD \
-             -sOutputFile=- -

    Note, that with CUPS and the "hpijs+foomatic" PPD (plus Perl and cupsomatic) -you don't need to remember this. You can choose the available print options -thru a GUI print command (like "glp" from ESP's commercially supported -PrintPro software, or KDE's "kprinter", or GNOME's "gtklp" or the independent -"xpp") or the CUPS web interface via human-readable drop-down selection -menus.

    If you use "ESP Ghostscript" (also under the GPL, provided by Easy Software -Products, the makers of CUPS, downloadable from -http://www.cups.org/software.html, -co-maintained by the developers of linuxprinting.org), you are guaranteed to -have in use the most uptodate, bug-fixed, enhanced and stable version of a Free -Ghostscript. It contains support for ~300 devices, whereas plain vanilla -GNU Ghostscript 7.05 only has ~200.

    If you print only one CUPS test page, from the web interface and when you try to -print a windows test page, it acts like the job was never sent: - -

    Can you print "standard" jobs from the CUPS machine?
    Are the jobs from Windows visible in the Web interface on CUPS (http://localhost:631/)?
    Most important: What kind of printer driver are you using on the Windows clients?

    - -You can try to get a more detailed debugging info by setting "LogLevel debug" in -/etc/cups/cupsd.conf, re-start cupsd and investigate /var/log/cups/error_log -for the whereabouts of your Windows-originating printjobs:

    what does the "auto-typing" line say? which is the "MIME type" CUPS thinks is arriving from the Windows clients?
    are there "filter" available for this MIME type?
    are there "filter rules" defined in "/etc/cups/mime.convs" for this MIME type?

    14.10. Limiting the number of pages users can print

    The feature you want is dependent on the real print subsystem you're using. -Samba's part is always to receive the job files from the clients (filtered -*or* unfiltered) and hand it over to this printing subsystem.

    Of course one could "hack" things with one's own scripts.

    But there is CUPS (Common Unix Printing System). CUPS supports "quotas". -Quotas can be based on sizes of jobs or on the number of pages or both, -and are spanning any time period you want.

    This is an example command how root would set a print quota in CUPS, -assuming an existing printer named "quotaprinter":

      lpadmin -p quotaprinter -o job-quota-period=604800 -o job-k-limit=1024 \
-       -o job-page-limit=100

    This would limit every single user to print 100 pages or 1024 KB of -data (whichever comes first) within the last 604.800 seconds ( = 1 week).

    For CUPS to count correctly, the printfile needs to pass the CUPS "pstops" filter, -otherwise it uses a "dummy" count of "1". Some printfiles don't pass it -(eg: image files) but then those are mostly 1 page jobs anyway. This also means, -proprietary drivers for the target printer running on the client computers and -CUPS/Samba then spooling these files as "raw" (i.e. leaving them untouched, not -filtering them), will be counted as "1-pagers" too!

    You need to send PostScript from the clients (i.e. run a PostScript driver there) -for having the chance to get accounting done. If the printer is a non-PostScript model, -you need to let CUPS do the job to convert the file to a print-ready format for the -target printer. This will be working for currently ~1.000 different printer models, see

         http://www.linuxprinting.org/printer_list.cgi

    Before CUPS-1.1.16 your only option was to use the Adobe PostScript -Driver on the Windows clients. The output of this driver was not always -passed thru the "pstops" filter on the CUPS/Samba side, and therefor was -not counted correctly (the reason is that it often --- depending on the -"PPD" being used --- did write a "PJL"-header in front of the real -PostScript which made CUPS to skip the pstops and go directy to -the "pstoraster" stage).

    From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver -for Windows NT/2K/XP clients" (it is tagged in the download area of -http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). -It is *not* working for Win9x/ME clients. But it:

    it guarantees to not write an PJL-header
    it guarantees to still read and support all PJL-options named in the driver PPD with its own means
    it guarantees the file going thru the "pstops" filter on the CUPS/Samba server
    it guarantees to page-count correctly the printfile

    You can read more about the setup of this combination in the -manpage for "cupsaddsmb" (only present with CUPS installed, only -current with CUPS 1.1.16).

    These are the items CUPS logs in the "page_log" for every single *page* of a job:

    Printer name
    User name
    Job ID
    Time of printing
    the page number
    the number of copies
    a billing info string (optional)

    Here is an extract of my CUPS server's page_log file to illustrate -the format and included items:

    infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 1 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 2 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 3 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 4 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 5 2 #marketing - infotec_IS2027 kurt 40 [22/Nov/2002:13:18:03 +0100] 6 2 #marketing

    This was Job ID "40", printed on "infotec_IS2027" by user "kurt", a 6-page job -printed in 2 copies and billed to "#marketing"...

    What flaws or shortcomings are there?

    the ones named above
    CUPS really counts the job pages being *processsed in software* - (going thru the "RIP") rather than the physical sheets successfully - leaving the printing device -- if there is a jam while printing - the 5th sheet out of 1000 and the job is aborted by the printer, - the "page count" will still show the figure of 1000 for that job -
    all quotas are the same for all users (no flexibility to give the - boss a higher quota than the clerk) no support for groups -
    no means to read out the current balance or "used-up" number of current quota -
    a user having used up 99 sheets of 100 quota will still be able to send and print a 1.000 sheet job -
    a user being denied a job because of a filled-up quota doesn't get a meaningful - error message from CUPS other than "client-error-not-possible". -

    But this is the best system out there currently. And there are -huge improvements under development:

    page counting will go into the "backends" (these talk - directly to the printer and will increase the count in sync with the - actual printing process -- a jam at the 5th sheet will lead to a stop in the counting)
    quotas will be handled more flexibly
    probably there will be support for users to inquire their "accounts" in advance
    probably there will be support for some other tools around this topic

    Other than the current stage of the CUPS development, I don't -know any other ready-to-use tool which you could consider.

    You can download the driver files from -http://www.cups.org/software.html. -It is a separate package from the CUPS base software files, tagged as "CUPS 1.1.16 -Windows NT/2k/XP Printer Driver for SAMBA (tar.gz, 192k)". The filename to -download is "cups-samba-1.1.16.tar.gz". Upon untar-/unzip-ping it will reveal -the files:

    cups-samba.install - cups-samba.license - cups-samba.readme - cups-samba.remove - cups-samba.ss - -

    These have been packaged with the ESP meta packager software "EPM". The -*.install and *.remove files are simple shell script, which untars the -*.ss (which is nothing else than a tar-archive) and puts its contents -into /usr/share/cups/drivers/. Its contents are 3 files:

    cupsdrvr.dll - cupsui.dll - cups.hlp - -

    Due to a bug one CUPS release puts the cups.hlp -into /usr/share/drivers/ instead of -/usr/share/cups/drivers/. To work around this, copy/move -the file after running the "./cups-samba.install" script manually to the right place:

    cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/ - -

    This new CUPS PostScript driver is currently binary-only, but free -no source code is provided (yet). The reason is this: it has -been developed with the help of the Microsoft Driver Developer Kit (DDK) -and compiled with Microsoft Visual Studio 6. It is not clear to the driver -developers if they are allowed to distribute the whole of the source code -as Free Software. However, they will likely release the "diff" in source -code under the GPL, so anybody with a license of Visual Studio and a DDK -will be able to compile for him/herself.

    Once you have run the install script (and possibly manually moved the -"cups.hlp" file to "/usr/share/cups/drivers/"), the driver is ready to be -put into Samba's [print$] share (which often maps to "/etc/samba/drivers/" -and contains a subdir tree with WIN40 and W32X86 branches), by running -"cupsaddsmb" (see also "man cupsaddsmb" for CUPS 1.1.16). [Don't forget to -put root into the smbpasswd file by running "smbpasswd" should you run -this whole procedure for the first time.] Once the driver files are in the -[print$] share, they are ready to be downloaded and installed by the -Win NT/2k/XP clients.

    Win 9x/ME clients won't work with this driver. For these you'd - still need to use the ADOBE*.* drivers as previously. -

    It is not harming if you've still the ADOBE*.* driver files from - previous installations in the "/usr/share/cups/drivers/" directory. - The new cupsaddsmb (from 1.1.16) will automatically use the - "newest" installed driver (which here then is the CUPS drivers). -

    Should your Win clients have had the old ADOBE*.* files and the - Adobe PostScript drivers installed, the download and installation - of the new CUPS PostScript driver for Windows NT/2k/XP will fail - at first. -

    It is not enough to "delete" the printer (as the driver files - will still be kept by the clients and re-used if you try to - re-install the printer). To really get rid of the Adobe driver - files on the clients, open the "Printers" folder (possibly via - "Start --> Settings --> Control Panel --> Printers"), right-click - onto the folder background and select "Server Properties". A - new dialog opens; select the "Drivers" tab; on the list select - the driver you want to delete and click on the "Delete" button. - (This will only work if there is no single printer left which - uses that particular driver -- you need to "delete" all printers - using this driver in the "Printers" folder first.) -

    Once you have successfully downloaded the CUPS PostScript driver - to a client, you can easily switch all printers to this one - by proceeding as described elsewhere in the "Samba HOWTO - Collection" to change a driver for an existing printer. -

    What are the benefits with the "CUPS PostScript driver for Windows NT/2k/XP" -as compared to the Adobe drivers?

    • no hassle with the Adobe EULA -

    • no hassle with the question "where do I get the ADOBE*.* driver files from?" -

    • the Adobe drivers (depending on the printer PPD associated with them) - often put a PJL header in front of the core PostScript part of the print - file (thus the file starts with "1B%-12345X" or "escape%-12345X" - instead of "%!PS"). This leads to the CUPS daemon autotyping the - arriving file as a print-ready file, not requiring a pass thru the - "pstops" filter (to speak more technical, it is not regarded as the - generic MIME type "application/postscript", but as the more special - MIME type "application/cups.vnd-postscript"), which therefore also - leads to the page accounting in "/var/log/cups/page_log" not receiving - the exact mumber of pages; instead the dummy page number of "1" is - logged in a standard setup) -

    • the Adobe driver has more options to "mis-configure" the PostScript - generated by it (like setting it inadvertedly to "Optimize for Speed", - instead of "Optimize for Portability", which could lead to CUPS being - unable to process it) -

    • the CUPS PostScript driver output sent by Windows clients to the CUPS - server will be guaranteed to be auto-typed as generic MIME type - "application/postscript", thusly passing thru the CUPS "pstops" filter - and logging the correct number of pages in the page_log for accounting - and quota purposes -

    • the CUPS PostScript driver supports the sending of additional print - options by the Win NT/2k/XP clients, such as naming the CUPS standard - banner pages (or the custom ones, should they be installed at the time - of driver download), using the CUPS "page-label" option, setting a - job-priority and setting the scheduled time of printing (with the option - to support additional useful IPP job attributes in the future). -

    • the CUPS PostScript driver supports the inclusion of the new - "*cupsJobTicket" comments at the beginnig of the PostScript file (which - could be used in the future for all sort of beneficial extensions on - the CUPS side, but which will not disturb any other application as those - will regard it as a comment and simply ignore it). -

    • the CUPS PostScript driver will be the heart of the fully fledged CUPS - IPP client for Windows NT/2k/XP to be released soon (probably alongside - the first Beta release for CUPS 1.2). -

    14.11. Advanced Postscript Printing from MS Windows

    Let the Windows Clients use a PostScript driver to deliver poistscript to -the samba print server (just like any Linux or Unix Client would also use -PostScript to send to the server)

    Make the Unix printing subsystem to which Samba sends the job convert the -incoming PostScript files to the native print format of the target printers -(would be PCL if you have an HP printer)

    Now if you are afraid that this would just mean using a *Generic* PostScript -driver for the clients that has no Simplex/Duplex selection, and no paper tray -choice, but you need them to be able to set up print jobs, with all the bells -and whistles of your printers:-

    Not possible with traditional spooling systems
    But perfectly supported by CUPS (which uses "PPD" files to - describe how to control the print options for PostScript and - non-PostScript devices alike... -

    CUPS PPDs are working perfectly on Windows clients who use Adobe PostScript -drivers (or the new CUPS PostScript driver for Windows NT/2K/XP). Clients can use -them to setup the job to their liking and CUPS will use the received job options -to make the (PCL-, ESC/P- or PostScript-) printer behave as required.

    If you want to have the additional benefit of page count logging and accounting -then the CUPS PostScript driver is the best choice (better than the Adobe one).

    If you want to make the drivers downloadable for the clients then "cupsaddsmb" is -your friend. It will setup the [print$] share on the Samba host to be ready to serve -the clients for a "point and print" driver installation.

    What strings are attached?

    There are some. But, given the sheer CPU power you can buy nowadays, -these can be overcome easily. The strings:

    Well, if the CUPS/Samba side will have to print to many printers serving many users, -you probably will need to set up a second server (which can do automatic load balancing -with the first one, plus a degree of fail-over mechanism). Converting the incoming -PostScript jobs, "interpreting" them for non-PostScript printers, amounts to the work -of a "RIP" (Raster Image Processor) done in software. This requires more CPU and RAM -than for the mere "raw spooling" task your current setup is solving. It all depends -on the avarage and peak printing load the server should be able to handle.

    14.12. Auto-Deletion of CUPS spool files

    Samba print files pass thru two "spool" directories. One the incoming directory -managed by Samba, (set eg: in the path = /var/spool/samba directive in the [printers] -section of smb.conf). Second is the spool directory of your UNIX print subsystem. -For CUPS it is normally "/var/spool/cups/", as set by the cupsd.conf directive -"RequestRoot /var/spool/cups".

    I am not sure, which one of your directories keeps the files. From what you say, -it is most likely the Samba part.

    For the CUPS part, you may want to consult:

    http://localhost:631/sam.html#PreserveJobFiles
    http://localhost:631/sam.html#PreserveJobHistory
    http://localhost:631/sam.html#MaxJobs

    There are the settings described for your CUPS daemon, which could lead to completed -job files not being deleted.

    "PreserveJobHistory Yes" -- keeps some details of jobs in -cupsd's mind (well it keeps the "c12345", "c12346" etc. files -in the CUPS spool directory, which do a similar job as the -old-fashioned BSD-LPD control files). This is set to "Yes" -as a default.

    "PreserveJobFiles Yes" -- keeps the job files themselves in -cupsd's mind (well it keeps the "d12345", "d12346" etc. files -in the CUPS spool directory...). This is set to "No" as the -CUPS default.

    "MaxJobs 500" -- this directive controls the maximum number -of jobs that are kept in memory. Once the number of jobs -reaches the limit, the oldest completed job is automatically -purged from the system to make room for the new one. If all -of the known jobs are still pending or active then the new -job will be rejected. Setting the maximum to 0 disables this -functionality. The default setting is 0.

    (There are also additional settings for "MaxJobsPerUser" and -"MaxJobsPerPrinter"...)

    For everything to work as announced, you need to have three things:

    a Samba-smbd which is compiled against "libcups" (Check on Linux by running ldd `which smbd`) -
    a Samba-smb.conf setting of printing = cups -
    another Samba-smb.conf setting of printcap = cups -

    Note, that in this case all other manually set printing-related -commands (like "print command", "lpq command", "lprm command", -"lppause command" or "lpresume command") are ignored and they -should normally have no influence what-so-ever on your printing.

    If you want to do things manually, replace the "printing = cups" -by "printing = bsd". Then your manually set commands may work -(haven't tested this), and a "print command = lp -d %P %s; rm %s" -may do what you need.

    You forgot to mention the CUPS version you're using. If you did -set things up as described in the man pages, then the Samba -spool files should be deleted. Otherwise it may be a bug. On -the CUPS side, you can control the behaviour as described -above.

    If you have more problems, post the output of these commands:

    grep -v ^# /etc/cups/cupsd.conf | grep -v ^$ - grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"

    (adapt paths as needed). These commands sanitize the files -and cut out the empty lines and lines with comments, providing -the "naked settings" in a compact way.

    PrevHomeNext
    Printing SupportUpUnified Logons between Windows NT and UNIX using Winbind
    \ No newline at end of file diff --git a/docs/htmldocs/domain-security.html b/docs/htmldocs/domain-security.html deleted file mode 100644 index ddbc4624b8..0000000000 --- a/docs/htmldocs/domain-security.html +++ /dev/null @@ -1,427 +0,0 @@ - -Samba as a NT4 or Win2k domain member
    SAMBA Project Documentation
    PrevNext

    Chapter 9. Samba as a NT4 or Win2k domain member

    9.1. Joining an NT Domain with Samba 3.0

    Assume you have a Samba 3.0 server with a NetBIOS name of - SERV1 and are joining an or Win2k NT domain called - DOM, which has a PDC with a NetBIOS name - of DOMPDC and two backup domain controllers - with NetBIOS names DOMBDC1 and DOMBDC2 - .

    Firstly, you must edit your smb.conf file to tell Samba it should - now use domain security.

    Change (or add) your security = line in the [global] section - of your smb.conf to read:

    security = domain

    Next change the workgroup = line in the [global] section to read:

    workgroup = DOM

    as this is the name of the domain we are joining.

    You must also have the parameter encrypt passwords set to yes - in order for your users to authenticate to the NT PDC.

    Finally, add (or modify) a password server = line in the [global] - section to read:

    password server = DOMPDC DOMBDC1 DOMBDC2

    These are the primary and backup domain controllers Samba - will attempt to contact in order to authenticate users. Samba will - try to contact each of these servers in order, so you may want to - rearrange this list in order to spread out the authentication load - among domain controllers.

    Alternatively, if you want smbd to automatically determine - the list of Domain controllers to use for authentication, you may - set this line to be :

    password server = *

    This method, allows Samba to use exactly the same - mechanism that NT does. This - method either broadcasts or uses a WINS database in order to - find domain controllers to authenticate against.

    In order to actually join the domain, you must run this - command:

    root# net rpc join -S DOMPDC - -UAdministrator%password

    as we are joining the domain DOM and the PDC for that domain - (the only machine that has write access to the domain SAM database) - is DOMPDC. The Administrator%password is - the login name and password for an account which has the necessary - privilege to add machines to the domain. If this is successful - you will see the message:

    Joined domain DOM. - or Joined 'SERV1' to realm 'MYREALM' -

    in your terminal window. See the net(8) man page for more details.

    This process joins the server to thedomain - without having to create the machine trust account on the PDC - beforehand.

    This command goes through the machine account password - change protocol, then writes the new (random) machine account - password for this Samba server into a file in the same directory - in which an smbpasswd file would be stored - normally :

    /usr/local/samba/private/secrets.tdb

    This file is created and owned by root and is not - readable by any other user. It is the key to the domain-level - security for your system, and should be treated as carefully - as a shadow password file.

    Finally, restart your Samba daemons and get ready for - clients to begin using domain security!

    9.2. Why is this better than security = server?

    Currently, domain security in Samba doesn't free you from - having to create local Unix users to represent the users attaching - to your server. This means that if domain user DOM\fred - attaches to your domain security Samba server, there needs - to be a local Unix user fred to represent that user in the Unix - filesystem. This is very similar to the older Samba security mode - security = server, - where Samba would pass through the authentication request to a Windows - NT server in the same way as a Windows 95 or Windows 98 server would. -

    Please refer to the Winbind - paper for information on a system to automatically - assign UNIX uids and gids to Windows NT Domain users and groups. - This code is available in development branches only at the moment, - but will be moved to release branches soon.

    The advantage to domain-level security is that the - authentication in domain-level security is passed down the authenticated - RPC channel in exactly the same way that an NT server would do it. This - means Samba servers now participate in domain trust relationships in - exactly the same way NT servers do (i.e., you can add Samba servers into - a resource domain and have the authentication passed on from a resource - domain PDC to an account domain PDC.

    In addition, with security = server every Samba - daemon on a server has to keep a connection open to the - authenticating server for as long as that daemon lasts. This can drain - the connection resources on a Microsoft NT server and cause it to run - out of available connections. With security = domain, - however, the Samba daemons connect to the PDC/BDC only for as long - as is necessary to authenticate the user, and then drop the connection, - thus conserving PDC connection resources.

    And finally, acting in the same manner as an NT server - authenticating to a PDC means that as part of the authentication - reply, the Samba server gets the user identification information such - as the user SID, the list of NT groups the user belongs to, etc.

    Much of the text of this document - was first published in the Web magazine - LinuxWorld as the article Doing - the NIS/NT Samba.

    PrevHomeNext
    Samba as a ADS domain memberUpAdvanced Configuration
    \ No newline at end of file diff --git a/docs/htmldocs/groupprofiles.html b/docs/htmldocs/groupprofiles.html deleted file mode 100644 index 9c25717238..0000000000 --- a/docs/htmldocs/groupprofiles.html +++ /dev/null @@ -1,568 +0,0 @@ - -Creating Group Prolicy Files
    SAMBA Project Documentation
    PrevNext

    Chapter 21. Creating Group Prolicy Files

    21.1. Windows '9x

    You need the Win98 Group Policy Editor to -set Group Profiles up under Windows '9x. It can be found on the Original -full product Win98 installation CD under -tools/reskit/netadmin/poledit. You install this -using the Add/Remove Programs facility and then click on the 'Have Disk' -tab.

    Use the Group Policy Editor to create a policy file that specifies the -location of user profiles and/or the My Documents etc. -stuff. You then save these settings in a file called -Config.POL that needs to be placed in -the root of the [NETLOGON] share. If your Win98 is configured to log onto -the Samba Domain, it will automatically read this file and update the -Win9x/Me registry of the machine that is logging on.

    All of this is covered in the Win98 Resource Kit documentation.

    If you do not do it this way, then every so often Win9x/Me will check the -integrity of the registry and will restore it's settings from the back-up -copy of the registry it stores on each Win9x/Me machine. Hence, you will -occasionally notice things changing back to the original settings.

    The following all refers to Windows NT/200x profile migration - not to policies. -We need a separate section on policies (NTConfig.Pol) for NT4/200x.

    21.2. Windows NT 4

    Unfortunately, the Resource Kit info is Win NT4 or 200x specific.

    Here is a quick guide:

    • On your NT4 Domain Controller, right click on 'My Computer', then -select the tab labelled 'User Profiles'.

    • Select a user profile you want to migrate and click on it.

      I am using the term "migrate" lossely. You can copy a profile to -create a group profile. You can give the user 'Everyone' rights to the -profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC.

    • Click the 'Copy To' button.

    • In the box labelled 'Copy Profile to' add your new path, eg: -c:\temp\foobar

    • Click on the button labelled 'Change' in the "Permitted to use" box.

    • Click on the group 'Everyone' and then click OK. This closes the -'chose user' box.

    • Now click OK.

    Follow the above for every profile you need to migrate.

    21.2.1. Side bar Notes

    You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page.

    With Samba-3.0.0 alpha code you can import all you NT4 domain accounts -using the net samsync method. This way you can retain your profile -settings as well as all your users.

    21.2.2. Mandatory profiles

    The above method can be used to create mandatory profiles also. To convert -a group profile into a mandatory profile simply locate the NTUser.DAT file -in the copied profile and rename it to NTUser.MAN.

    21.2.3. moveuser.exe

    The W2K professional resource kit has moveuser.exe. moveuser.exe changes -the security of a profile from one user to another. This allows the account -domain to change, and/or the user name to change.

    21.2.4. Get SID

    You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 -Resource Kit.

    Windows NT 4.0 stores the local profile information in the registry under -the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

    Under the ProfileList key, there will be subkeys named with the SIDs of the -users who have logged on to this computer. (To find the profile information -for the user whose locally cached profile you want to move, find the SID for -the user with the GetSID.exe utility.) Inside of the appropriate user's -subkey, you will see a string value named ProfileImagePath.

    21.3. Windows 2000/XP

    You must first convert the profile from a local profile to a domain -profile on the MS Windows workstation as follows:

    • Log on as the LOCAL workstation administrator.

    • Right click on the 'My Computer' Icon, select 'Properties'

    • Click on the 'User Profiles' tab

    • Select the profile you wish to convert (click on it once)

    • Click on the button 'Copy To'

    • In the "Permitted to use" box, click on the 'Change' button.

    • Click on the 'Look in" area that lists the machine name, when you click -here it will open up a selection box. Click on the domain to which the -profile must be accessible.

      You will need to log on if a logon box opens up. Eg: In the connect -as: MIDEARTH\root, password: mypassword.

    • To make the profile capable of being used by anyone select 'Everyone'

    • Click OK. The Selection box will close.

    • Now click on the 'Ok' button to create the profile in the path you -nominated.

    Done. You now have a profile that can be editted using the samba-3.0.0 -profiles tool.

    Under NT/2K the use of mandotory profiles forces the use of MS Exchange -storage of mail data. That keeps desktop profiles usable.

    • This is a security check new to Windows XP (or maybe only -Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is:

      "Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders"

      ...and it should be set to "Enabled". -Does the new version of samba have an Active Directory analogue? If so, -then you may be able to set the policy through this.

      If you cannot set group policies in samba, then you may be able to set -the policy locally on each machine. If you want to try this, then do -the following (N.B. I don't know for sure that this will work in the -same way as a domain group policy):

    • On the XP workstation log in with an Administrator account.

    • Click: "Start", "Run"

    • Type: "mmc"

    • Click: "OK"

    • A Microsoft Management Console should appear.

    • Click: File, "Add/Remove Snap-in...", "Add"

    • Double-Click: "Group Policy"

    • Click: "Finish", "Close"

    • Click: "OK"

    • In the "Console Root" window:

    • Expand: "Local Computer Policy", "Computer Configuration",

    • "Administrative Templates", "System", "User Profiles"

    • Double-Click: "Do not check for user ownership of Roaming Profile

    • Folders"

    • Select: "Enabled"

    • Click: OK"

    • Close the whole console. You do not need to save the settings (this -refers to the console settings rather than the policies you have -changed).

    • Reboot

    PrevHomeNext
    Samba performance issuesUpSecuring Samba
    \ No newline at end of file diff --git a/docs/htmldocs/improved-browsing.html b/docs/htmldocs/improved-browsing.html deleted file mode 100644 index 209dfaaf54..0000000000 --- a/docs/htmldocs/improved-browsing.html +++ /dev/null @@ -1,1094 +0,0 @@ - -Improved browsing in samba
    SAMBA Project Documentation
    PrevNext

    Chapter 24. Improved browsing in samba

    24.1. Overview of browsing

    SMB networking provides a mechanism by which clients can access a list -of machines in a network, a so-called browse list. This list -contains machines that are ready to offer file and/or print services -to other machines within the network. Thus it does not include -machines which aren't currently able to do server tasks. The browse -list is heavily used by all SMB clients. Configuration of SMB -browsing has been problematic for some Samba users, hence this -document.

    MS Windows 2000 and later, as with Samba 3 and later, can be -configured to not use NetBIOS over TCP/IP. When configured this way -it is imperative that name resolution (using DNS/LDAP/ADS) be correctly -configured and operative. Browsing will NOT work if name resolution -from SMB machine names to IP addresses does not function correctly.

    Where NetBIOS over TCP/IP is enabled use of a WINS server is highly -recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. -WINS allows remote segment clients to obtain NetBIOS name_type information -that can NOT be provided by any other means of name resolution.

    24.2. Browsing support in samba

    Samba facilitates browsing. The browsing is supported by nmbd -and is also controlled by options in the smb.conf file. -Samba can act as a local browse master for a workgroup and the ability -for samba to support domain logons and scripts is now available.

    Samba can also act as a domain master browser for a workgroup. This -means that it will collate lists from local browse masters into a -wide area network server list. In order for browse clients to -resolve the names they may find in this list, it is recommended that -both samba and your clients use a WINS server.

    Note that you should NOT set Samba to be the domain master for a -workgroup that has the same name as an NT Domain: on each wide area -network, you must only ever have one domain master browser per workgroup, -regardless of whether it is NT, Samba or any other type of domain master -that is providing this service.

    Nmbd can be configured as a WINS server, but it is not -necessary to specifically use samba as your WINS server. MS Windows -NT4, Server or Advanced Server 2000 or 2003 can be configured as -your WINS server. In a mixed NT/2000/2003 server and samba environment on -a Wide Area Network, it is recommended that you use the Microsoft -WINS server capabilities. In a samba-only environment, it is -recommended that you use one and only one Samba server as your WINS server.

    To get browsing to work you need to run nmbd as usual, but will need -to use the workgroup option in smb.conf -to control what workgroup Samba becomes a part of.

    Samba also has a useful option for a Samba server to offer itself for -browsing on another subnet. It is recommended that this option is only -used for 'unusual' purposes: announcements over the internet, for -example. See remote announce in the -smb.conf man page.

    24.3. Problem resolution

    If something doesn't work then hopefully the log.nmb file will help -you track down the problem. Try a debug level of 2 or 3 for finding -problems. Also note that the current browse list usually gets stored -in text form in a file called browse.dat.

    Note that if it doesn't work for you, then you should still be able to -type the server name as \\SERVER in filemanager then -hit enter and filemanager should display the list of available shares.

    Some people find browsing fails because they don't have the global -guest account set to a valid account. Remember that the -IPC$ connection that lists the shares is done as guest, and thus you must -have a valid guest account.

    MS Windows 2000 and upwards (as with Samba) can be configured to disallow -anonymous (ie: Guest account) access to the IPC$ share. In that case, the -MS Windows 2000/XP/2003 machine acting as an SMB/CIFS client will use the -name of the currently logged in user to query the IPC$ share. MS Windows -9X clients are not able to do this and thus will NOT be able to browse -server resources.

    The other big problem people have is that their broadcast address, -netmask or IP address is wrong (specified with the "interfaces" option -in smb.conf)

    24.4. Browsing across subnets

    Since the release of Samba 1.9.17(alpha1) Samba has been -updated to enable it to support the replication of browse lists -across subnet boundaries. New code and options have been added to -achieve this. This section describes how to set this feature up -in different settings.

    To see browse lists that span TCP/IP subnets (ie. networks separated -by routers that don't pass broadcast traffic) you must set up at least -one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing -NetBIOS name to IP address translation to be done by doing a direct -query of the WINS server. This is done via a directed UDP packet on -port 137 to the WINS server machine. The reason for a WINS server is -that by default, all NetBIOS name to IP address translation is done -by broadcasts from the querying machine. This means that machines -on one subnet will not be able to resolve the names of machines on -another subnet without using a WINS server.

    Remember, for browsing across subnets to work correctly, all machines, -be they Windows 95, Windows NT, or Samba servers must have the IP address -of a WINS server given to them by a DHCP server, or by manual configuration -(for Win95 and WinNT, this is in the TCP/IP Properties, under Network -settings) for Samba this is in the smb.conf file.

    24.4.1. How does cross subnet browsing work ?

    Cross subnet browsing is a complicated dance, containing multiple -moving parts. It has taken Microsoft several years to get the code -that achieves this correct, and Samba lags behind in some areas. -Samba is capable of cross subnet browsing when configured correctly.

    Consider a network set up as follows :

                                       (DMB)
-             N1_A      N1_B        N1_C       N1_D        N1_E
-              |          |           |          |           |
-          -------------------------------------------------------
-            |          subnet 1                       |
-          +---+                                      +---+
-          |R1 | Router 1                  Router 2   |R2 |
-          +---+                                      +---+
-            |                                          |
-            |  subnet 2              subnet 3          |
-  --------------------------       ------------------------------------
-  |     |     |      |               |        |         |           |
- N2_A  N2_B  N2_C   N2_D           N3_A     N3_B      N3_C        N3_D 
-                    (WINS)

    Consisting of 3 subnets (1, 2, 3) connected by two routers -(R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines -on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume -for the moment that all these machines are configured to be in the -same workgroup (for simplicities sake). Machine N1_C on subnet 1 -is configured as Domain Master Browser (ie. it will collate the -browse lists for the workgroup). Machine N2_D is configured as -WINS server and all the other machines are configured to register -their NetBIOS names with it.

    As all these machines are booted up, elections for master browsers -will take place on each of the three subnets. Assume that machine -N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on -subnet 3 - these machines are known as local master browsers for -their particular subnet. N1_C has an advantage in winning as the -local master browser on subnet 1 as it is set up as Domain Master -Browser.

    On each of the three networks, machines that are configured to -offer sharing services will broadcast that they are offering -these services. The local master browser on each subnet will -receive these broadcasts and keep a record of the fact that -the machine is offering a service. This list of records is -the basis of the browse list. For this case, assume that -all the machines are configured to offer services so all machines -will be on the browse list.

    For each network, the local master browser on that network is -considered 'authoritative' for all the names it receives via -local broadcast. This is because a machine seen by the local -master browser via a local broadcast must be on the same -network as the local master browser and thus is a 'trusted' -and 'verifiable' resource. Machines on other networks that -the local master browsers learn about when collating their -browse lists have not been directly seen - these records are -called 'non-authoritative'.

    At this point the browse lists look as follows (these are -the machines you would see in your network neighborhood if -you looked in it on a particular network right now).

    Subnet           Browse Master   List
-------           -------------   ----
-Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E
-
-Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
-
-Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D

    Note that at this point all the subnets are separate, no -machine is seen across any of the subnets.

    Now examine subnet 2. As soon as N2_B has become the local -master browser it looks for a Domain master browser to synchronize -its browse list with. It does this by querying the WINS server -(N2_D) for the IP address associated with the NetBIOS name -WORKGROUP>1B<. This name was registerd by the Domain master -browser (N1_C) with the WINS server as soon as it was booted.

    Once N2_B knows the address of the Domain master browser it -tells it that is the local master browser for subnet 2 by -sending a MasterAnnouncement packet as a UDP port 138 packet. -It then synchronizes with it by doing a NetServerEnum2 call. This -tells the Domain Master Browser to send it all the server -names it knows about. Once the domain master browser receives -the MasterAnnouncement packet it schedules a synchronization -request to the sender of that packet. After both synchronizations -are done the browse lists look like :

    Subnet           Browse Master   List
-------           -------------   ----
-Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E, 
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*)
-
-Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
-
-Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D
-
-Servers with a (*) after them are non-authoritative names.

    At this point users looking in their network neighborhood on -subnets 1 or 2 will see all the servers on both, users on -subnet 3 will still only see the servers on their own subnet.

    The same sequence of events that occured for N2_B now occurs -for the local master browser on subnet 3 (N3_D). When it -synchronizes browse lists with the domain master browser (N1_A) -it gets both the server entries on subnet 1, and those on -subnet 2. After N3_D has synchronized with N1_C and vica-versa -the browse lists look like.

    Subnet           Browse Master   List
-------           -------------   ----
-Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E, 
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*),
-                                 N3_A(*), N3_B(*), N3_C(*), N3_D(*)
-
-Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
-
-Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*),
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*)
-
-Servers with a (*) after them are non-authoritative names.

    At this point users looking in their network neighborhood on -subnets 1 or 3 will see all the servers on all sunbets, users on -subnet 2 will still only see the servers on subnets 1 and 2, but not 3.

    Finally, the local master browser for subnet 2 (N2_B) will sync again -with the domain master browser (N1_C) and will recieve the missing -server entries. Finally - and as a steady state (if no machines -are removed or shut off) the browse lists will look like :

    Subnet           Browse Master   List
-------           -------------   ----
-Subnet1          N1_C            N1_A, N1_B, N1_C, N1_D, N1_E, 
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*),
-                                 N3_A(*), N3_B(*), N3_C(*), N3_D(*)
-
-Subnet2          N2_B            N2_A, N2_B, N2_C, N2_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
-                                 N3_A(*), N3_B(*), N3_C(*), N3_D(*)
-
-Subnet3          N3_D            N3_A, N3_B, N3_C, N3_D
-                                 N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*),
-                                 N2_A(*), N2_B(*), N2_C(*), N2_D(*)
-	
-Servers with a (*) after them are non-authoritative names.

    Synchronizations between the domain master browser and local -master browsers will continue to occur, but this should be a -steady state situation.

    If either router R1 or R2 fails the following will occur:

    1. Names of computers on each side of the inaccessible network fragments - will be maintained for as long as 36 minutes, in the network neighbourhood - lists. -

    2. Attempts to connect to these inaccessible computers will fail, but the - names will not be removed from the network neighbourhood lists. -

    3. If one of the fragments is cut off from the WINS server, it will only - be able to access servers on its local subnet, by using subnet-isolated - broadcast NetBIOS name resolution. The effects are similar to that of - losing access to a DNS server. -

    24.5. Setting up a WINS server

    Either a Samba machine or a Windows NT Server machine may be set up -as a WINS server. To set a Samba machine to be a WINS server you must -add the following option to the smb.conf file on the selected machine : -in the [globals] section add the line

    wins support = yes

    Versions of Samba prior to 1.9.17 had this parameter default to -yes. If you have any older versions of Samba on your network it is -strongly suggested you upgrade to a recent version, or at the very -least set the parameter to 'no' on all these machines.

    Machines with wins support = yes will keep a list of -all NetBIOS names registered with them, acting as a DNS for NetBIOS names.

    You should set up only ONE wins server. Do NOT set the -wins support = yes option on more than one Samba -server.

    To set up a Windows NT Server as a WINS server you need to set up -the WINS service - see your NT documentation for details. Note that -Windows NT WINS Servers can replicate to each other, allowing more -than one to be set up in a complex subnet environment. As Microsoft -refuse to document these replication protocols Samba cannot currently -participate in these replications. It is possible in the future that -a Samba->Samba WINS replication protocol may be defined, in which -case more than one Samba machine could be set up as a WINS server -but currently only one Samba server should have the -wins support = yes parameter set.

    After the WINS server has been configured you must ensure that all -machines participating on the network are configured with the address -of this WINS server. If your WINS server is a Samba machine, fill in -the Samba machine IP address in the "Primary WINS Server" field of -the "Control Panel->Network->Protocols->TCP->WINS Server" dialogs -in Windows 95 or Windows NT. To tell a Samba server the IP address -of the WINS server add the following line to the [global] section of -all smb.conf files :

    wins server = >name or IP address<

    where >name or IP address< is either the DNS name of the WINS server -machine or its IP address.

    Note that this line MUST NOT BE SET in the smb.conf file of the Samba -server acting as the WINS server itself. If you set both the -wins support = yes option and the -wins server = <name> option then -nmbd will fail to start.

    There are two possible scenarios for setting up cross subnet browsing. -The first details setting up cross subnet browsing on a network containing -Windows 95, Samba and Windows NT machines that are not configured as -part of a Windows NT Domain. The second details setting up cross subnet -browsing on networks that contain NT Domains.

    24.6. Setting up Browsing in a WORKGROUP

    To set up cross subnet browsing on a network containing machines -in up to be in a WORKGROUP, not an NT Domain you need to set up one -Samba server to be the Domain Master Browser (note that this is *NOT* -the same as a Primary Domain Controller, although in an NT Domain the -same machine plays both roles). The role of a Domain master browser is -to collate the browse lists from local master browsers on all the -subnets that have a machine participating in the workgroup. Without -one machine configured as a domain master browser each subnet would -be an isolated workgroup, unable to see any machines on any other -subnet. It is the presense of a domain master browser that makes -cross subnet browsing possible for a workgroup.

    In an WORKGROUP environment the domain master browser must be a -Samba server, and there must only be one domain master browser per -workgroup name. To set up a Samba server as a domain master browser, -set the following option in the [global] section of the smb.conf file :

    domain master = yes

    The domain master browser should also preferrably be the local master -browser for its own subnet. In order to achieve this set the following -options in the [global] section of the smb.conf file :

    domain master = yes
-local master = yes
-preferred master = yes
-os level = 65

    The domain master browser may be the same machine as the WINS -server, if you require.

    Next, you should ensure that each of the subnets contains a -machine that can act as a local master browser for the -workgroup. Any MS Windows NT/2K/XP/2003 machine should be -able to do this, as will Windows 9x machines (although these -tend to get rebooted more often, so it's not such a good idea -to use these). To make a Samba server a local master browser -set the following options in the [global] section of the -smb.conf file :

    domain master = no
-local master = yes
-preferred master = yes
-os level = 65

    Do not do this for more than one Samba server on each subnet, -or they will war with each other over which is to be the local -master browser.

    The local master parameter allows Samba to act as a -local master browser. The preferred master causes nmbd -to force a browser election on startup and the os level -parameter sets Samba high enough so that it should win any browser elections.

    If you have an NT machine on the subnet that you wish to -be the local master browser then you can disable Samba from -becoming a local master browser by setting the following -options in the [global] section of the -smb.conf file :

    domain master = no
-local master = no
-preferred master = no
-os level = 0

    24.7. Setting up Browsing in a DOMAIN

    If you are adding Samba servers to a Windows NT Domain then -you must not set up a Samba server as a domain master browser. -By default, a Windows NT Primary Domain Controller for a Domain -name is also the Domain master browser for that name, and many -things will break if a Samba server registers the Domain master -browser NetBIOS name (DOMAIN<1B>) -with WINS instead of the PDC.

    For subnets other than the one containing the Windows NT PDC -you may set up Samba servers as local master browsers as -described. To make a Samba server a local master browser set -the following options in the [global] section -of the smb.conf file :

    domain master = no
-local master = yes
-preferred master = yes
-os level = 65

    If you wish to have a Samba server fight the election with machines -on the same subnet you may set the os level parameter -to lower levels. By doing this you can tune the order of machines that -will become local master browsers if they are running. For -more details on this see the section Forcing samba to be the master browser -below.

    If you have Windows NT machines that are members of the domain -on all subnets, and you are sure they will always be running then -you can disable Samba from taking part in browser elections and -ever becoming a local master browser by setting following options -in the [global] section of the smb.conf -file :

    domain master = no - local master = no - preferred master = no - os level = 0

    24.8. Forcing samba to be the master

    Who becomes the master browser is determined by an election -process using broadcasts. Each election packet contains a number of parameters -which determine what precedence (bias) a host should have in the -election. By default Samba uses a very low precedence and thus loses -elections to just about anyone else.

    If you want Samba to win elections then just set the os level global -option in smb.conf to a higher number. It defaults to 0. Using 34 -would make it win all elections over every other system (except other -samba systems!)

    A os level of 2 would make it beat WfWg and Win95, but not MS Windows -NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32.

    The maximum os level is 255

    If you want samba to force an election on startup, then set the -preferred master global option in smb.conf to "yes". Samba will -then have a slight advantage over other potential master browsers -that are not preferred master browsers. Use this parameter with -care, as if you have two hosts (whether they are windows 95 or NT or -samba) on the same local subnet both set with preferred master to -"yes", then periodically and continually they will force an election -in order to become the local master browser.

    If you want samba to be a domain master browser, then it is -recommended that you also set preferred master to "yes", because -samba will not become a domain master browser for the whole of your -LAN or WAN if it is not also a local master browser on its own -broadcast isolated subnet.

    It is possible to configure two samba servers to attempt to become -the domain master browser for a domain. The first server that comes -up will be the domain master browser. All other samba servers will -attempt to become the domain master browser every 5 minutes. They -will find that another samba server is already the domain master -browser and will fail. This provides automatic redundancy, should -the current domain master browser fail.

    24.9. Making samba the domain master

    The domain master is responsible for collating the browse lists of -multiple subnets so that browsing can occur between subnets. You can -make samba act as the domain master by setting domain master = yes -in smb.conf. By default it will not be a domain master.

    Note that you should NOT set Samba to be the domain master for a -workgroup that has the same name as an NT Domain.

    When samba is the domain master and the master browser it will listen -for master announcements (made roughly every twelve minutes) from local -master browsers on other subnets and then contact them to synchronise -browse lists.

    If you want samba to be the domain master then I suggest you also set -the os level high enough to make sure it wins elections, and set -preferred master to "yes", to get samba to force an election on -startup.

    Note that all your servers (including samba) and clients should be -using a WINS server to resolve NetBIOS names. If your clients are only -using broadcasting to resolve NetBIOS names, then two things will occur:

    1. your local master browsers will be unable to find a domain master - browser, as it will only be looking on the local subnet. -

    2. if a client happens to get hold of a domain-wide browse list, and - a user attempts to access a host in that list, it will be unable to - resolve the NetBIOS name of that host. -

    If, however, both samba and your clients are using a WINS server, then:

    1. your local master browsers will contact the WINS server and, as long as - samba has registered that it is a domain master browser with the WINS - server, your local master browser will receive samba's ip address - as its domain master browser. -

    2. when a client receives a domain-wide browse list, and a user attempts - to access a host in that list, it will contact the WINS server to - resolve the NetBIOS name of that host. as long as that host has - registered its NetBIOS name with the same WINS server, the user will - be able to see that host. -

    24.10. Note about broadcast addresses

    If your network uses a "0" based broadcast address (for example if it -ends in a 0) then you will strike problems. Windows for Workgroups -does not seem to support a 0's broadcast and you will probably find -that browsing and name lookups won't work.

    24.11. Multiple interfaces

    Samba now supports machines with multiple network interfaces. If you -have multiple interfaces then you will need to use the interfaces -option in smb.conf to configure them.

    PrevHomeNext
    Integrating MS Windows networks with SambaUpSecuring Samba
    \ No newline at end of file diff --git a/docs/htmldocs/index.html b/docs/htmldocs/index.html deleted file mode 100755 index f7bc47b7c8..0000000000 --- a/docs/htmldocs/index.html +++ /dev/null @@ -1,76 +0,0 @@ -SAMBA Project Documentation
    SAMBA Project Documentation
       Next

    SAMBA Project Documentation

    Edited by

    Jelmer R. Vernooij

    John H. Terpstra

    Gerald (Jerry) Carter

    -This documentation is distributed under the GNU General Public License (GPL) -version 2. A copy of the license is included with the Samba source -distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt -

    Attributions.  -

    Introduction to Samba
    How to Install and Test SAMBA
    Fast Start for the Impatient
    Server Types and Security Modes
    Domain Control
    Backup Domain Control
    Domain Membership
    Stand-Alone Servers
    MS Windows Network Configuration Guide
    Samba / MS Windows Network Browsing Guide
    Account Information Databases
    Mapping MS Windows and Unix Groups
    File, Directory and Share Access Controls
    File and Record Locking
    Securing Samba
    Interdomain Trust Relationships
    Hosting a Microsoft Distributed File System tree on Samba
    Classical Printing Support
    CUPS Printing Support in Samba 3.0
    Stackable VFS modules

    • Jelmer Vernooij <jelmer@samba.org>

    • John Terpstra <jht@samba.org>

    • Tim Potter

    • Simo Sorce (original vfs_skel README)

    • Alexander Bokovoy (original vfs_netatalk docs)

    • Stefan Metzmacher (Update for multiple modules)

    Integrated Logon Support using Winbind
    Advanced Network Management
    System and Account Policies
    Desktop Profile Management
    PAM based Distributed Authentication
    Integrating MS Windows networks with Samba
    Unicode/Charsets
    Samba Backup Techniques
    High Availability Options
    Upgrading from Samba-2.x to Samba-3.0.0
    Migration from NT4 PDC to Samba-3 PDC
    SWAT - The Samba Web Administration Tool
    The Samba checklist
    Analysing and solving samba problems
    Reporting Bugs
    How to compile SAMBA
    Portability
    Samba and other CIFS clients
    Samba Performance Tuning
    DNS and DHCP Configuration Guide
    Further Resources

    - -

    Monday April 21, 2003

    Abstract

    -This book is a collection of HOWTOs added to Samba documentation over the years. -Samba is always under development, and so is its' documentation. This release of the -documentation represents a major revision or layout as well as contents. -The most recent version of this document can be found at -http://www.samba.org/ -on the "Documentation" page. Please send updates to -Jelmer Vernooij, -John H. Terpstra or -Gerald (Jerry) Carter. -

    -The Samba-Team would like to express sincere thanks to the many people who have with -or without their knowledge contributed to this update. The size and scope of this -project would not have been possible without significant community contribution. A not -insignificant number of ideas for inclusion (if not content itself) has been obtained -from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. -Please keep publishing your Unofficial HOWTOs - they are a source of inspiration and -application knowledge that is most to be desired by many Samba users and administrators. -

    Table of Contents

    I. General Installation
    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
    What If Things Don't Work?
    Common Errors
    Why are so many smbd processes eating memory?
    I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs
    3. Fast Start for the Impatient
    Note
    II. Server Configuration Basics
    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Seamless Windows Network Integration
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Problems and Errors
    I cannot include a '$' in a machine name
    I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.
    The system can not log you on (C000019B)....
    The machine trust account for this computer either does not -exist or is not accessible.
    When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled.
    Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    III. Advanced Configuration
    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    11. Account Information Databases
    Features and Benefits
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and Unix
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon - Users not in Samba SAM
    Users are being added to the wrong backend database
    auth methods does not work
    12. Mapping MS Windows and Unix Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with Unix File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and Unix Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute - mapping
    Common Errors
    Users can not write to a public share
    I have set force user and Samba still makes root the owner of all the files - I touch!
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    NT4 as the Trusting Domain (ie. creating the trusted account)
    NT4 as the Trusted Domain (ie. creating trusted account's password)
    Configuring Samba NT-style Domain Trusts
    Samba-3 as the Trusting Domain
    Samba-3 as the Trusted Domain
    Common Errors
    Tell me about Trust Relationships using Samba
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    Parameters for Backwards Compatibility
    Parameters no longer in use
    A simple Configuration to Print with Samba-3
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print with Samba-3
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various Unix Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba-3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with -rpcclient
    "The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure)
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a -different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba-3
    Publishing Printer Information in Active Directory or LDAP
    Common Errors and Problems
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for -CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for -application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download
    GDI on Windows -- PostScript on Unix
    Windows Drivers, GDI and EMF
    Unix Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and -native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print -Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many -Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel -Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for -cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Caveats to be considered
    What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsm completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the -Client
    Installing PostScript Driver Files manually (using -rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Commandline Driver Installation in 15 little Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    When not to use Samba to print to -CUPS
    In Case of Trouble.....
    Where to find Documentation
    How to ask for Help
    Where to find Help
    Appendix
    Printing from CUPS to Windows attached -Printers
    More CUPS filtering Chains
    Trouble Shooting Guidelines to fix typical Samba printing -Problems
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    Common Errors
    21. Integrated Logon Support using Winbind
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    How does one set up roaming profiles for just one (or a few) user/s or group/s?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure Unix/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    My Boomerang Won't Come Back
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    IV. Migration and Updating
    30. Upgrading from Samba-2.x to Samba-3.0.0
    Charsets
    Obsolete configuration options
    Password Backend
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    V. Troubleshooting
    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    Still having troubles?
    34. Analysing and solving samba problems
    Diagnostics tools
    Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches
    VI. Appendixes
    36. How to compile SAMBA
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    Common Errors
    37. Portability
    HPUX
    SCO Unix
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
    How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
    How do I get printer driver download working - for OS/2 clients?
    Windows for Workgroups
    Use latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configure WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Books
    Index

    List of Figures

    19.1. Windows Printing to a local Printer
    19.2. Printing to a Postscript Printer
    19.3. Ghostscript as a RIP for non-postscript printers
    19.4. Prefiltering in CUPS to form Postscript
    19.5. Adding Device-specific Print Options
    19.6. Postscript to intermediate Raster format
    19.7. CUPS-raster production using Ghostscript
    19.8. Image format to CUPS-raster format conversion
    19.9. Raster to Printer Specific formats
    19.10. cupsomatic/foomatic processing versus Native CUPS
    19.11. Print Driver execution on the Client
    19.12. Print Driver execution on the Server
    19.13. Printing via CUPS/samba server
    19.14. cupsaddsmb flowchart
    19.15. CUPS Printing Overview

    List of Tables

    7.1. Assumptions
    10.1. Browse subnet example 1
    10.2. Browse subnet example 2
    10.3. Browse subnet example 3
    10.4. Browse subnet example 4
    11.1. Attributes in the sambaSamAccount objectclass (LDAP)
    11.2. Basic smb.conf options for MySQL passdb backend
    11.3. MySQL field names for MySQL passdb backend
    13.1. Managing directories with unix and windows
    13.2. User and Group Based Controls
    13.3. File and Directory Permission Based Controls
    13.4. Other Controls
    20.1. Extended Auditing Log Information
    24.1. User Shell Folder registry keys default values
    24.2. Defaults of profile settings registry keys
    24.3. Defaults of default user profile paths registry keys
    25.1. Options recognized by pam_smbpass
    31.1. The 3 Major Site Types
    31.2. Nature of the Conversion Choices

    List of Examples

    12.1. smbgrpadd.sh
    13.1. Example File
       Next
       Part I. General Installation
    diff --git a/docs/htmldocs/interdomaintrusts.html b/docs/htmldocs/interdomaintrusts.html deleted file mode 100644 index c9fe4a533f..0000000000 --- a/docs/htmldocs/interdomaintrusts.html +++ /dev/null @@ -1,451 +0,0 @@ - -Interdomain Trust Relationships
    SAMBA Project Documentation
    PrevNext

    Chapter 19. Interdomain Trust Relationships

    Samba-3 supports NT4 style domain trust relationships. This is feature that many sites -will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to -adopt Active Directory or an LDAP based authentication back end. This section explains -some background information regarding trust relationships and how to create them. It is now -possible for Samba-3 to NT4 trust (and vice versa), as well as Samba3 to Samba3 trusts.

    19.1. Trust Relationship Background

    MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure. -The limitations of this architecture as it affects the scalability of MS Windows networking -in large organisations is well known. Additionally, the flat-name space that results from -this design significantly impacts the delegation of administrative responsibilities in -large and diverse organisations.

    Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means -of circumventing the limitations of the older technologies. Not every organisation is ready -or willing to embrace ADS. For small companies the older NT4 style domain security paradigm -is quite adequate, there thus remains an entrenched user base for whom there is no direct -desire to go through a disruptive change to adopt ADS.

    Microsoft introduced with MS Windows NT the ability to allow differing security domains -to affect a mechanism so that users from one domain may be given access rights and privileges -in another domain. The language that describes this capability is couched in terms of -Trusts. Specifically, one domain will trust the users -from another domain. The domain from which users are available to another security domain is -said to be a trusted domain. The domain in which those users have assigned rights and privileges -is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only, -thus if users in both domains are to have privileges and rights in each others' domain, then it is -necessary to establish two (2) relationships, one in each direction.

    In an NT4 style MS security domain, all trusts are non-transitive. This means that if there -are three (3) domains (let's call them RED, WHITE, and BLUE) where RED and WHITE have a trust -relationship, and WHITE and BLUE have a trust relationship, then it holds that there is no -implied trust between the RED and BLUE domains. ie: Relationships are explicit and not -transitive.

    New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way -by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE -domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is -an inherent feature of ADS domains. Samba-3 implements MS Windows NT4 -style Interdomain trusts and interoperates with MS Windows 200x ADS -security domains in similar manner to MS Windows NT4 style domains.

    19.2. Native MS Windows NT4 Trusts Configuration

    There are two steps to creating an interdomain trust relationship.

    19.2.1. NT4 as the Trusting Domain (ie. creating the trusted account)

    For MS Windows NT4, all domain trust relationships are configured using the Domain User Manager. -To affect a two way trust relationship it is necessary for each domain administrator to make -available (for use by an external domain) it's security resources. This is done from the Domain -User Manager Policies entry on the menu bar. From the Policy menu, select Trust Relationships, then -next to the lower box that is labelled "Permitted to Trust this Domain" are two buttons, "Add" and -"Remove". The "Add" button will open a panel in which needs to be entered the remote domain that -will be able to assign user rights to your domain. In addition it is necessary to enter a password -that is specific to this trust relationship. The password needs to be -typed twice (for standard confirmation).

    19.2.2. NT4 as the Trusted Domain (ie. creating trusted account's password)

    A trust relationship will work only when the other (trusting) domain makes the appropriate connections -with the trusted domain. To consumate the trust relationship the administrator will launch the -Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the -"Add" button that is next to the box that is labelled "Trusted Domains". A panel will open in -which must be entered the name of the remote domain as well as the password assigned to that trust.

    19.3. Configuring Samba NT-style Domain Trusts

    This description is meant to be a fairly short introduction about how to set up a Samba server so -that it could participate in interdomain trust relationships. Trust relationship support in Samba -is in its early stage, so lot of things don't work yet.

    Each of the procedures described below is treated as they were performed with Windows NT4 Server on -one end. The remote end could just as well be another Samba-3 domain. It can be clearly seen, after -reading this document, that combining Samba-specific parts of what's written below leads to trust -between domains in purely Samba environment.

    19.3.1. Samba-3 as the Trusting Domain

    In order to set Samba PDC to be trusted party of the relationship first you need -to create special account for the domain that will be the trusting party. To do that, -you can use the 'smbpasswd' utility. Creating the trusted domain account is very -similiar to creating a trusted machine account. Suppose, your domain is -called SAMBA, and the remote domain is called RUMBA. The first step -will be to issue this command from your favourite shell:

        deity# smbpasswd -a -i rumba
-    	New SMB password: XXXXXXXX
-    	Retype SMB password: XXXXXXXX
-    	Added user rumba$
    - -where -a means to add a new account into the -passdb database and -i means: ''create this -account with the InterDomain trust flag''

    The account name will be 'rumba$' (the name of the remote domain)

    After issuing this command you'll be asked to enter the password for -the account. You can use any password you want, but be aware that Windows NT will -not change this password until 7 days following account creation. -After the command returns successfully, you can look at the entry for new account -(in the way depending on your configuration) and see that account's name is -really RUMBA$ and it has 'I' flag in the flags field. Now you're ready to confirm -the trust by establishing it from Windows NT Server.

    Open 'User Manager for Domains' and from menu 'Policies' select 'Trust Relationships...'. -Right beside 'Trusted domains' list box press 'Add...' button. You will be prompted for -the trusted domain name and the relationship password. Type in SAMBA, as this is -your domain name, and the password used at the time of account creation. -Press OK and, if everything went without incident, you will see 'Trusted domain relationship -successfully established' message.

    19.3.2. Samba-3 as the Trusted Domain

    This time activities are somewhat reversed. Again, we'll assume that your domain -controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA.

    The very first thing requirement is to add an account for the SAMBA domain on RUMBA's PDC.

    Launch the Domain User Manager, then from the menu select 'Policies', 'Trust Relationships'. -Now, next to 'Trusted Domains' box press the 'Add' button, and type in the name of the trusted -domain (SAMBA) and password securing the relationship.

    The password can be arbitrarily chosen. It is easy to change it the password -from Samba server whenever you want. After confirming the password your account is -ready for use. Now it's Samba's turn.

    Using your favourite shell while being logged in as root, issue this command:

    deity# net rpc trustdom establish rumba

    You will be prompted for the password you just typed on your Windows NT4 Server box. -Don not worry if you see an error message that mentions a returned code of -NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the -password you gave is correct and the NT4 Server says the account is -ready for interdomain connection and not for ordinary -connection. After that, be patient it can take a while (especially -in large networks), you should see the 'Success' message. Congratulations! Your trust -relationship has just been established.

    Note that you have to run this command as root because you must have write access to -the secrets.tdb file.

    PrevHomeNext
    Desktop Profile ManagementUpPAM Configuration for Centrally Managed Authentication
    \ No newline at end of file diff --git a/docs/htmldocs/introsmb.html b/docs/htmldocs/introsmb.html deleted file mode 100644 index 52db6a8a95..0000000000 --- a/docs/htmldocs/introsmb.html +++ /dev/null @@ -1,659 +0,0 @@ - -Introduction to Samba
    SAMBA Project Documentation
    PrevNext

    Chapter 1. Introduction to Samba

    "If you understand what you're doing, you're not learning anything." --- Anonymous

    Samba is a file and print server for Windows-based clients using TCP/IP as the underlying -transport protocol. In fact, it can support any SMB/CIFS-enabled client. One of Samba's big -strengths is that you can use it to blend your mix of Windows and Linux machines together -without requiring a separate Windows NT/2000/2003 Server. Samba is actively being developed -by a global team of about 30 active programmers and was originally developed by Andrew Tridgell.

    1.1. Background

    Once long ago, there was a buzzword referred to as DCE/RPC. This stood for Distributed -Computing Environment/Remote Procedure Calls and conceptually was a good idea. It was -originally developed by Apollo/HP as NCA 1.0 (Network Computing Architecture) and only -ran over UDP. When there was a need to run it over TCP so that it would be compatible -with DECnet 3.0, it was redesigned, submitted to The Open Group, and officially became -known as DCE/RPC. Microsoft came along and decided, rather than pay $20 per seat to -license this technology, to reimplement DCE/RPC themselves as MSRPC. From this, the -concept continued in the form of SMB (Server Message Block, or the "what") using the -NetBIOS (Network Basic Input/Output System, or the "how") compatibility layer. You can -run SMB (i.e., transport) over several different protocols; many different implementations -arose as a result, including NBIPX (NetBIOS over IPX, NwLnkNb, or NWNBLink) and NBT -(NetBIOS over TCP/IP, or NetBT). As the years passed, NBT became the most common form -of implementation until the advance of "Direct-Hosted TCP" -- the Microsoft marketing -term for eliminating NetBIOS entirely and running SMB by itself across TCP port 445 -only. As of yet, direct-hosted TCP has yet to catch on.

    Perhaps the best summary of the origins of SMB are voiced in the 1997 article titled, CIFS: -Common Insecurities Fail Scrutiny:

    Several megabytes of NT-security archives, random whitepapers, RFCs, the CIFS spec, the Samba -stuff, a few MS knowledge-base articles, strings extracted from binaries, and packet dumps have -been dutifully waded through during the information-gathering stages of this project, and there -are *still* many missing pieces... While often tedious, at least the way has been generously -littered with occurrences of clapping hand to forehead and muttering 'crikey, what are they -thinking?

    1.2. Terminology

    • SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol. -

    • CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently - decided that SMB needed the word "Internet" in it, so they changed it to CIFS. -

    • Direct-Hosted: A method of providing file/printer sharing services over port 445/tcp - only using DNS for name resolution instead of WINS. -

    • IPC: Acronym for "Inter-Process Communication". A method to communicate specific - information between programs. -

    • Marshalling: - A method of serializing (i.e., sequential ordering of) variable data - suitable for transmission via a network connection or storing in a file. The source - data can be re-created using a similar process called unmarshalling. -

    • NetBIOS: Acronym for "Network Basic Input/Output System". This is not a protocol; - it is a method of communication across an existing protocol. This is a standard which - was originally developed for IBM by Sytek in 1983. To exaggerate the analogy a bit, - it can help to think of this in comparison your computer's BIOS -- it controls the - essential functions of your input/output hardware -- whereas NetBIOS controls the - essential functions of your input/output traffic via the network. Again, this is a bit - of an exaggeration but it should help that paradigm shift. What is important to realize - is that NetBIOS is a transport standard, not a protocol. Unfortunately, even technically - brilliant people tend to interchange NetBIOS with terms like NetBEUI without a second - thought; this will cause no end (and no doubt) of confusion. -

    • NetBEUI: Acronym for the "NetBIOS Extended User Interface". Unlike NetBIOS, NetBEUI - is a protocol, not a standard. It is also not routable, so traffic on one side of a - router will be unable to communicate with the other side. Understanding NetBEUI is - not essential to deciphering SMB; however it helps to point out that it is not the - same as NetBIOS and to improve your score in trivia at parties. NetBEUI was originally - referred to by Microsoft as "NBF", or "The Windows NT NetBEUI Frame protocol driver". - It is not often heard from these days. -

    • NBT: Acronym for "NetBIOS over TCP"; also known as "NetBT". Allows the continued use - of NetBIOS traffic proxied over TCP/IP. As a result, NetBIOS names are made - to IP addresses and NetBIOS name types are conceptually equivalent to TCP/IP ports. - This is how file and printer sharing are accomplished in Windows 95/98/ME. They - traditionally rely on three ports: NetBIOS Name Service (nbname) via UDP port 137, - NetBIOS Datagram Service (nbdatagram) via UDP port 138, and NetBIOS Session Service - (nbsession) via TCP port 139. All name resolution is done via WINS, NetBIOS broadcasts, - and DNS. NetBIOS over TCP is documented in RFC 1001 (Concepts and methods) and RFC 1002 - (Detailed specifications). -

    • W2K: Acronym for Windows 2000 Professional or Server -

    • W3K: Acronym for Windows 2003 Server -

    If you plan on getting help, make sure to subscribe to the Samba Mailing List (available at -http://www.samba.org). Optionally, you could just search mailing.unix.samba at http://groups.google.com

    1.3. Related Projects

    Currently, there are two projects that are directly related to Samba: SMBFS and CIFS network -client file systems for Linux, both available in the Linux kernel itself.

    • SMBFS (Server Message Block File System) allows you to mount SMB shares (the protocol - that Microsoft Windows and OS/2 Lan Manager use to share files and printers - over local networks) and access them just like any other Unix directory. This is useful - if you just want to mount such filesystems without being a SMBFS server. -

    • CIFS (Common Internet File System) is the successor to SMB, and is actively being worked - on in the upcoming version of the Linux kernel. The intent of this module is to - provide advanced network file system functionality including support for dfs (heirarchical - name space), secure per-user session establishment, safe distributed caching (oplock), - optional packet signing, Unicode and other internationalization improvements, and optional - Winbind (nsswitch) integration. -

    Again, it's important to note that these are implementations for client filesystems, and have -nothing to do with acting as a file and print server for SMB/CIFS clients.

    1.4. SMB Methodology

    Traditionally, SMB uses UDP port 137 (NetBIOS name service, or netbios-ns), -UDP port 138 (NetBIOS datagram service, or netbios-dgm), and TCP port 139 (NetBIOS -session service, or netbios-ssn). Anyone looking at their network with a good -packet sniffer will be amazed at the amount of traffic generated by just opening -up a single file. In general, SMB sessions are established in the following order:

    • "TCP Connection" - establish 3-way handshake (connection) to port 139/tcp - or 445/tcp. -

    • "NetBIOS Session Request" - using the following "Calling Names": The local - machine's NetBIOS name plus the 16th character 0x00; The server's NetBIOS - name plus the 16th character 0x20 -

    • "SMB Negotiate Protocol" - determine the protocol dialect to use, which will - be one of the following: PC Network Program 1.0 (Core) - share level security - mode only; Microsoft Networks 1.03 (Core Plus) - share level security - mode only; Lanman1.0 (LAN Manager 1.0) - uses Challenge/Response - Authentication; Lanman2.1 (LAN Manager 2.1) - uses Challenge/Response - Authentication; NT LM 0.12 (NT LM 0.12) - uses Challenge/Response - Authentication -

    • SMB Session Startup. Passwords are encrypted (or not) according to one of - the following methods: Null (no encryption); Cleartext (no encryption); LM - and NTLM; NTLM; NTLMv2 -

    • SMB Tree Connect: Connect to a share name (e.g., \\servername\share); Connect - to a service type (e.g., IPC$ named pipe) -

    A good way to examine this process in depth is to try out SecurityFriday's SWB program -at http://www.securityfriday.com/ToolDownload/SWB/swb_doc.html. It allows you to -walk through the establishment of a SMB/CIFS session step by step.

    1.5. Additional Resources

    • CIFS: Common Insecurities Fail Scrutiny by "Hobbit", - http://hr.uoregon.edu/davidrl/cifs.txt -

    • Doing the Samba on Windows by Financial Review, - http://afr.com/it/2002/10/01/FFXDF43AP6D.html -

    • Implementing CIFS by Christopher R. Hertel, - http://ubiqx.org/cifs/ -

    • Just What Is SMB? by Richard Sharpe, - http://samba.anu.edu.au/cifs/docs/what-is-smb.html -

    • Opening Windows Everywhere by Mike Warfield, - http://www.linux-mag.com/1999-05/samba_01.html -

    • SMB HOWTO by David Wood, - http://www.tldp.org/HOWTO/SMB-HOWTO.html -

    • SMB/CIFS by The Root by "ledin", - http://www.phrack.org/phrack/60/p60-0x0b.txt -

    • The Story of Samba by Christopher R. Hertel, - http://www.linux-mag.com/1999-09/samba_01.html -

    • The Unofficial Samba HOWTO by David Lechnyr, - http://hr.uoregon.edu/davidrl/samba/ -

    • Understanding the Network Neighborhood by Christopher R. Hertel, - http://www.linux-mag.com/2001-05/smb_01.html -

    • Using Samba as a PDC by Andrew Bartlett, - http://www.linux-mag.com/2002-02/samba_01.html -

    1.6. Epilogue

    "What's fundamentally wrong is that nobody ever had any taste when they -did it. Microsoft has been very much into making the user interface look good, -but internally it's just a complete mess. And even people who program for Microsoft -and who have had years of experience, just don't know how it works internally. -Worse, nobody dares change it. Nobody dares to fix bugs because it's such a -mess that fixing one bug might just break a hundred programs that depend on -that bug. And Microsoft isn't interested in anyone fixing bugs -- they're interested -in making money. They don't have anybody who takes pride in Windows 95 as an -operating system.

    People inside Microsoft know it's a bad operating system and they still -continue obviously working on it because they want to get the next version out -because they want to have all these new features to sell more copies of the -system.

    The problem with that is that over time, when you have this kind of approach, -and because nobody understands it, because nobody REALLY fixes bugs (other than -when they're really obvious), the end result is really messy. You can't trust -it because under certain circumstances it just spontaneously reboots or just -halts in the middle of something that shouldn't be strange. Normally it works -fine and then once in a blue moon for some completely unknown reason, it's dead, -and nobody knows why. Not Microsoft, not the experienced user and certainly -not the completely clueless user who probably sits there shivering thinking -"What did I do wrong?" when they didn't do anything wrong at all.

    That's what's really irritating to me."

    -- Linus Torvalds, from an interview with BOOT Magazine, Sept 1998 -(http://hr.uoregon.edu/davidrl/boot.txt)

    1.7. Miscellaneous

    This chapter was lovingly handcrafted on a Dell Latitude C400 laptop running Slackware Linux 9.0, -in case anyone asks.

    This chapter is Copyright © 2003 David Lechnyr (david at lechnyr dot com). -Permission is granted to copy, distribute and/or modify this document under the terms -of the GNU Free Documentation License, Version 1.2 or any later version published by the Free -Software Foundation. A copy of the license is available at http://www.gnu.org/licenses/fdl.txt.

    PrevHomeNext
    General installationUpHow to Install and Test SAMBA
    \ No newline at end of file diff --git a/docs/htmldocs/nt4migration.html b/docs/htmldocs/nt4migration.html deleted file mode 100644 index 2079c1b6c4..0000000000 --- a/docs/htmldocs/nt4migration.html +++ /dev/null @@ -1,356 +0,0 @@ - -Migration from NT4 PDC to Samba-3 PDC
    SAMBA Project Documentation
    PrevNext

    Chapter 28. Migration from NT4 PDC to Samba-3 PDC

    This is a rough guide to assist those wishing to migrate from NT4 domain control to -Samba-3 based domain control.

    28.1. Planning and Getting Started

    In the IT world there is often a saying that all problems are encountered because of -poor planning. The corrollary to this saying is that not all problems can be anticpated -and planned for. Then again, good planning will anticpate most show stopper type situations.

    Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control -environment would do well to develop a detailed migration plan. So here are a few pointers to -help migration get under way.

    28.1.1. Objectives

    The key objective for most organisations will be to make the migration from MS Windows NT4 -to Samba-3 domain control as painless as possible. One of the challenges you may experience -in your migration process may well be one of convincing management that the new environment -should remain in place. Many who have introduced open source technologies have experienced -pressure to return to a Microsoft based platform solution at the first sign of trouble.

    It is strongly advised that before attempting a migration to a Samba-3 controlled network -that every possible effort be made to gain all-round commitment to the change. Firstly, you -should know precisely why the change is important for the organisation. -Possible motivations to make a change include:

    • Improve network manageability

    • Obtain better user level functionality

    • Reduce network operating costs

    • Reduce exposure caused by Microsoft withdrawal of NT4 support

    • Avoid MS License 6 implications

    • Reduce organisation's dependency on Microsoft

    It is vital that oit be well recognised that Samba-3 is NOT MS Windows NT4. Samba-3 offers -an alternative solution that is both different from MS Windows NT4 and that offers some -advantages compared with it. It should also be recognised that Samba-3 lacks many of the -features that Microsoft has promoted as core values in migration from MS Windows NT4 to -MS Windows 2000 and beyond (with or without Active Directory services).

    What are the features the Samba-3 can NOT provide?

    Active Directory Server
    Group Policy Objects (in Active Direcrtory)
    Machine Policy objects
    Logon Scripts in Active Directorty
    Software Application and Access Controls in Active Directory

    28.1.2. Steps In Migration Process

    This is not a definitive ste-by-step process yet - just a place holder so the info -is not lost. - -1. You will have an NT4 PDC that has the users, groups, policies and profiles to be migrated - -2. Samba-3 set up as a DC with netlogon share, profile share, etc. - -3. Process: - a. Create a BDC account for the samba server using NT Server Manager - - Samba must NOT be running - - b. rpcclient NT4PDC -U Administrator%passwd - lsaquery - - Note the SID returned by step b. - - c. net getsid -S NT4PDC -w DOMNAME -U Administrator%passwd - - Note the SID in step c. - - d. net getlocalsid - - Note the SID, now check that all three SIDS reported are the same! - - e. net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd - - f. net rpc vampire -S NT4PDC -U administrator%passwd - - g. pdbedit -l - - Note - did the users migrate? - - h. initGrps.sh DOMNAME - - i. smbgroupedit -v - - Now check that all groups are recognised - - j. net rpc campire -S NT4PDC -U administrator%passwd - - k. pdbedit -lv - - Note - check that all group membership has been migrated. - - -Now it is time to migrate all the profiles, then migrate all policy files. - -Moe later.

    PrevHomeNext
    How to compile SAMBAUpPortability
    \ No newline at end of file diff --git a/docs/htmldocs/other-clients.html b/docs/htmldocs/other-clients.html deleted file mode 100644 index 36513c672a..0000000000 --- a/docs/htmldocs/other-clients.html +++ /dev/null @@ -1,734 +0,0 @@ - -Samba and other CIFS clients
    SAMBA Project Documentation
    PrevNext

    Chapter 30. Samba and other CIFS clients

    This chapter contains client-specific information.

    30.1. Macintosh clients?

    Yes. Thursby now have a CIFS Client / Server called DAVE - see

    They test it against Windows 95, Windows NT and samba for -compatibility issues. At the time of writing, DAVE was at version -1.0.1. The 1.0.0 to 1.0.1 update is available as a free download from -the Thursby web site (the speed of finder copies has been greatly -enhanced, and there are bug-fixes included).

    -Alternatives - There are two free implementations of AppleTalk for -several kinds of UNIX machnes, and several more commercial ones. -These products allow you to run file services and print services -natively to Macintosh users, with no additional support required on -the Macintosh. The two free omplementations are -Netatalk, and -CAP. -What Samba offers MS -Windows users, these packages offer to Macs. For more info on these -packages, Samba, and Linux (and other UNIX-based systems) see -http://www.eats.com/linux_mac_win.html

    30.2. OS2 Client

    30.2.1. How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?

    A more complete answer to this question can be - found on http://carol.wins.uva.nl/~leeuw/samba/warp.html.

    Basically, you need three components:

    • The File and Print Client ('IBM Peer') -

    • TCP/IP ('Internet support') -

    • The "NetBIOS over TCP/IP" driver ('TCPBEUI') -

    Installing the first two together with the base operating - system on a blank system is explained in the Warp manual. If Warp - has already been installed, but you now want to install the - networking support, use the "Selective Install for Networking" - object in the "System Setup" folder.

    Adding the "NetBIOS over TCP/IP" driver is not described - in the manual and just barely in the online documentation. Start - MPTS.EXE, click on OK, click on "Configure LAPS" and click - on "IBM OS/2 NETBIOS OVER TCP/IP" in 'Protocols'. This line - is then moved to 'Current Configuration'. Select that line, - click on "Change number" and increase it from 0 to 1. Save this - configuration.

    If the Samba server(s) is not on your local subnet, you - can optionally add IP names and addresses of these servers - to the "Names List", or specify a WINS server ('NetBIOS - Nameserver' in IBM and RFC terminology). For Warp Connect you - may need to download an update for 'IBM Peer' to bring it on - the same level as Warp 4. See the webpage mentioned above.

    30.2.2. How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?

    You can use the free Microsoft LAN Manager 2.2c Client - for OS/2 from - ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/. - See http://carol.wins.uva.nl/~leeuw/lanman.html for - more information on how to install and use this client. In - a nutshell, edit the file \OS2VER in the root directory of - the OS/2 boot partition and add the lines:

    		20=setup.exe
-		20=netwksta.sys
-		20=netvdd.sys
-

    before you install the client. Also, don't use the - included NE2000 driver because it is buggy. Try the NE2000 - or NS2000 driver from - ftp://ftp.cdrom.com/pub/os2/network/ndis/ instead. -

    30.2.3. Are there any other issues when OS/2 (any version) - is used as a client?

    When you do a NET VIEW or use the "File and Print - Client Resource Browser", no Samba servers show up. This can - be fixed by a patch from http://carol.wins.uva.nl/~leeuw/samba/fix.html. - The patch will be included in a later version of Samba. It also - fixes a couple of other problems, such as preserving long - filenames when objects are dragged from the Workplace Shell - to the Samba server.

    30.2.4. How do I get printer driver download working - for OS/2 clients?

    First, create a share called [PRINTDRV] that is - world-readable. Copy your OS/2 driver files there. Note - that the .EA_ files must still be separate, so you will need - to use the original install files, and not copy an installed - driver from an OS/2 system.

    Install the NT driver first for that printer. Then, - add to your smb.conf a parameter, os2 driver map = - filename". Then, in the file - specified by filename, map the - name of the NT driver name to the OS/2 driver name as - follows:

    nt driver name = os2 "driver - name"."device name", e.g.: - HP LaserJet 5L = LASERJET.HP LaserJet 5L

    You can have multiple drivers mapped in this file.

    If you only specify the OS/2 driver name, and not the - device name, the first attempt to download the driver will - actually download the files, but the OS/2 client will tell - you the driver is not available. On the second attempt, it - will work. This is fixed simply by adding the device name - to the mapping, after which it will work on the first attempt. -

    30.3. Windows for Workgroups

    30.3.1. Use latest TCP/IP stack from Microsoft

    Use the latest TCP/IP stack from microsoft if you use Windows -for workgroups.

    The early TCP/IP stacks had lots of bugs.

    -Microsoft has released an incremental upgrade to their TCP/IP 32-Bit -VxD drivers. The latest release can be found on their ftp site at -ftp.microsoft.com, located in /peropsys/windows/public/tcpip/wfwt32.exe. -There is an update.txt file there that describes the problems that were -fixed. New files include WINSOCK.DLL, TELNET.EXE, WSOCK.386, VNBT.386, -WSTCP.386, TRACERT.EXE, NETSTAT.EXE, and NBTSTAT.EXE.

    30.3.2. Delete .pwl files after password change

    WfWg does a lousy job with passwords. I find that if I change my -password on either the unix box or the PC the safest thing to do is to -delete the .pwl files in the windows directory. The PC will complain about not finding the files, but will soon get over it, allowing you to enter the new password.

    -If you don't do this you may find that WfWg remembers and uses the old -password, even if you told it a new one.

    -Often WfWg will totally ignore a password you give it in a dialog box.

    30.3.3. Configure WfW password handling

    There is a program call admincfg.exe -on the last disk (disk 8) of the WFW 3.11 disk set. To install it -type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE Then add an icon -for it via the "Progam Manager" "New" Menu. This program allows you -to control how WFW handles passwords. ie disable Password Caching etc -for use with security = user

    30.3.4. Case handling of passwords

    Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf(5) information on password level to specify what characters samba should try to uppercase when checking.

    30.3.5. Use TCP/IP as default protocol

    To support print queue reporting you may find -that you have to use TCP/IP as the default protocol under -WfWg. For some reason if you leave Netbeui as the default -it may break the print queue reporting on some systems. -It is presumably a WfWg bug.

    30.4. Windows '95/'98

    When using Windows 95 OEM SR2 the following updates are recommended where Samba -is being used. Please NOTE that the above change will affect you once these -updates have been installed.

    -There are more updates than the ones mentioned here. You are referred to the -Microsoft Web site for all currently available updates to your specific version -of Windows 95.

    1. Kernel Update: KRNLUPD.EXE

    2. Ping Fix: PINGUPD.EXE

    3. RPC Update: RPCRTUPD.EXE

    4. TCP/IP Update: VIPUPD.EXE

    5. Redirector Update: VRDRUPD.EXE

    Also, if using MS OutLook it is desirable to install the OLEUPD.EXE fix. This -fix may stop your machine from hanging for an extended period when exiting -OutLook and you may also notice a significant speedup when accessing network -neighborhood services.

    30.5. Windows 2000 Service Pack 2

    -There are several annoyances with Windows 2000 SP2. One of which -only appears when using a Samba server to host user profiles -to Windows 2000 SP2 clients in a Windows domain. This assumes -that Samba is a member of the domain, but the problem will -likely occur if it is not.

    -In order to server profiles successfully to Windows 2000 SP2 -clients (when not operating as a PDC), Samba must have -nt acl support = no -added to the file share which houses the roaming profiles. -If this is not done, then the Windows 2000 SP2 client will -complain about not being able to access the profile (Access -Denied) and create multiple copies of it on disk (DOMAIN.user.001, -DOMAIN.user.002, etc...). See the -smb.conf(5) man page -for more details on this option. Also note that the -nt acl support parameter was formally a global parameter in -releases prior to Samba 2.2.2.

    -The following is a minimal profile share:

    	[profile]
-		path = /export/profile
-		create mask = 0600
-		directory mask = 0700
-		nt acl support = no
-		read only = no

    The reason for this bug is that the Win2k SP2 client copies -the security descriptor for the profile which contains -the Samba server's SID, and not the domain SID. The client -compares the SID for SAMBA\user and realizes it is -different that the one assigned to DOMAIN\user. Hence the reason -for the "access denied" message.

    By disabling the nt acl support parameter, Samba will send -the Win2k client a response to the QuerySecurityDescriptor -trans2 call which causes the client to set a default ACL -for the profile. This default ACL includes

    DOMAIN\user "Full Control"

    This bug does not occur when using winbind to -create accounts on the Samba host for Domain users.

    30.6. Windows NT 3.1

    If you have problems communicating across routers with Windows -NT 3.1 workstations, read this Microsoft Knowledge Base article.

    PrevHomeNext
    PortabilityUpSWAT - The Samba Web Admininistration Tool
    \ No newline at end of file diff --git a/docs/htmldocs/policymgmt.html b/docs/htmldocs/policymgmt.html deleted file mode 100644 index 5d0c9b19f9..0000000000 --- a/docs/htmldocs/policymgmt.html +++ /dev/null @@ -1,758 +0,0 @@ - -System and Account Policies
    SAMBA Project Documentation
    PrevNext

    Chapter 17. System and Account Policies

    17.1. Creating and Managing System Policies

    Under MS Windows platforms, particularly those following the release of MS Windows -NT4 and MS Windows 95) it is possible to create a type of file that would be placed -in the NETLOGON share of a domain controller. As the client logs onto the network -this file is read and the contents initiate changes to the registry of the client -machine. This file allows changes to be made to those parts of the registry that -affect users, groups of users, or machines.

    For MS Windows 9x/Me this file must be called Config.POL and may -be generated using a tool called poledit.exe, better known as the -Policy Editor. The policy editor was provided on the Windows 98 installation CD, but -dissappeared again with the introduction of MS Windows Me (Millenium Edition). From -comments from MS Windows network administrators it would appear that this tool became -a part of the MS Windows Me Resource Kit.

    MS Windows NT4 Server products include the System Policy Editor -under the Start -> Programs -> Administrative Tools menu item. -For MS Windows NT4 and later clients this file must be called NTConfig.POL.

    New with the introduction of MS Windows 2000 was the Microsoft Management Console -or MMC. This tool is the new wave in the ever changing landscape of Microsoft -methods for management of network access and security. Every new Microsoft product -or technology seems to obsolete the old rules and to introduce newer and more -complex tools and methods. To Microsoft's credit though, the MMC does appear to -be a step forward, but improved functionality comes at a great price.

    Before embarking on the configuration of network and system policies it is highly -advisable to read the documentation available from Microsoft's web site regarding -Implementing Profiles and Policies in Windows NT 4.0 from http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp available from Microsoft. -There are a large number of documents in addition to this old one that should also -be read and understood. Try searching on the Microsoft web site for "Group Policies".

    What follows is a very brief discussion with some helpful notes. The information provided -here is incomplete - you are warned.

    17.1.1. Windows 9x/Me Policies

    You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. -It can be found on the Original full product Win98 installation CD under -tools/reskit/netadmin/poledit. Install this using the -Add/Remove Programs facility and then click on the 'Have Disk' tab.

    Use the Group Policy Editor to create a policy file that specifies the location of -user profiles and/or the My Documents etc. stuff. Then -save these settings in a file called Config.POL that needs to -be placed in the root of the [NETLOGON] share. If Win98 is configured to log onto -the Samba Domain, it will automatically read this file and update the Win9x/Me registry -of the machine as it logs on.

    Further details are covered in the Win98 Resource Kit documentation.

    If you do not take the right steps, then every so often Win9x/Me will check the -integrity of the registry and will restore it's settings from the back-up -copy of the registry it stores on each Win9x/Me machine. Hence, you will -occasionally notice things changing back to the original settings.

    Install the group policy handler for Win9x to pick up group policies. Look on the -Win98 CD in \tools\reskit\netadmin\poledit. -Install group policies on a Win9x client by double-clicking -grouppol.inf. Log off and on again a couple of times and see -if Win98 picks up group policies. Unfortunately this needs to be done on every -Win9x/Me machine that uses group policies.

    17.1.2. Windows NT4 Style Policy Files

    To create or edit ntconfig.pol you must use the NT Server -Policy Editor, poledit.exe which is included with NT4 Server -but not NT Workstation. There is a Policy Editor on a NT4 -Workstation but it is not suitable for creating Domain Policies. -Further, although the Windows 95 Policy Editor can be installed on an NT4 -Workstation/Server, it will not work with NT clients. However, the files from -the NT Server will run happily enough on an NT4 Workstation.

    You need poledit.exe, common.adm and winnt.adm. -It is convenient to put the two *.adm files in the c:\winnt\inf -directory which is where the binary will look for them unless told otherwise. Note also that that -directory is normally 'hidden'.

    The Windows NT policy editor is also included with the Service Pack 3 (and -later) for Windows NT 4.0. Extract the files using servicepackname /x, -i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, -poledit.exe and the associated template files (*.adm) should -be extracted as well. It is also possible to downloaded the policy template -files for Office97 and get a copy of the policy editor. Another possible -location is with the Zero Administration Kit available for download from Microsoft.

    17.1.2.1. Registry Tattoos

    With NT4 style registry based policy changes, a large number of settings are not - automatically reversed as the user logs off. Since the settings that were in the - NTConfig.POL file were applied to the client machine registry and that apply to the - hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known - as tattooing. It can have serious consequences down-stream and the administrator must - be extremely careful not to lock out the ability to manage the machine at a later date. -

    17.1.3. MS Windows 200x / XP Professional Policies

    Windows NT4 System policies allows setting of registry parameters specific to -users, groups and computers (client workstations) that are members of the NT4 -style domain. Such policy file will work with MS Windows 2000 / XP clients also.

    New to MS Windows 2000 Microsoft introduced a new style of group policy that confers -a superset of capabilities compared with NT4 style policies. Obviously, the tool used -to create them is different, and the mechanism for implementing them is much changed.

    The older NT4 style registry based policies are known as Administrative Templates -in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security -configurations, enforce Internet Explorer browser settings, change and redirect aspects of the -users' desktop (including: the location of My Documents files (directory), as -well as intrinsics of where menu items will appear in the Start menu). An additional new -feature is the ability to make available particular software Windows applications to particular -users and/or groups.

    Remember: NT4 policy files are named NTConfig.POL and are stored in the root -of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password -and selects the domain name to which the logon will attempt to take place. During the logon -process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating -server, modifies the local registry values according to the settings in this file.

    Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of -a Windows 200x policy file is stored in the Active Directory itself and the other part is stored -in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active -Directory domain controllers. The part that is stored in the Active Directory itself is called the -group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is -known as the group policy template (GPT).

    With NT4 clients the policy file is read and executed upon only aas each user log onto the network. -MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine -startup (machine specific part) and when the user logs onto the network the user specific part -is applied. In MS Windows 200x style policy management each machine and/or user may be subject -to any number of concurently applicable (and applied) policy sets (GPOs). Active Directory allows -the administrator to also set filters over the policy settings. No such equivalent capability -exists with NT4 style policy files.

    17.1.3.1. Administration of Win2K / XP Policies

    Instructions

    Instead of using the tool called "The System Policy Editor", commonly called Poledit (from the -executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console -(MMC) snap-in as follows:

    1. Go to the Windows 200x / XP menu Start->Programs->Administrative Tools - and select the MMC snap-in called "Active Directory Users and Computers"

    2. Select the domain or organizational unit (OU) that you wish to manage, then right click -to open the context menu for that object, select the properties item.

    3. Now left click on the Group Policy tab, then left click on the New tab. Type a name -for the new policy you will create.

    4. Now left click on the Edit tab to commence the steps needed to create the GPO.

    All policy configuration options are controlled through the use of policy administrative -templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. -Beware however, since the .adm files are NOT interchangible across NT4 and Windows 200x. -The later introduces many new features as well as extended definition capabilities. It is -well beyond the scope of this documentation to explain how to program .adm files, for that -the adminsitrator is referred to the Microsoft Windows Resource Kit for your particular -version of MS Windows.

    The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used -to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you -use this powerful tool. Please refer to the resource kit manuals for specific usage information.

    17.2. Managing Account/User Policies

    Policies can define a specific user's settings or the settings for a group of users. The resulting -policy file contains the registry settings for all users, groups, and computers that will be using -the policy file. Separate policy files for each user, group, or computer are not not necessary.

    If you create a policy that will be automatically downloaded from validating domain controllers, -you should name the file NTconfig.POL. As system administrator, you have the option of renaming the -policy file and, by modifying the Windows NT-based workstation, directing the computer to update -the policy from a manual path. You can do this by either manually changing the registry or by using -the System Policy Editor. This path can even be a local path such that each machine has its own policy file, -but if a change is necessary to all machines, this change must be made individually to each workstation.

    When a Windows NT4/200x/XP machine logs onto the network the NETLOGON share on the authenticating domain -controller for the presence of the NTConfig.POL file. If one exists it is downloaded, parsed and then -applied to the user's part of the registry.

    MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally, -acquire policy settings through Group Policy Objects (GPOs) that are defined and stored in Active Directory -itself. The key benefit of using AS GPOs is that they impose no registry tatooing effect. -This has considerable advanage compared with the use of NTConfig.POL (NT4) style policy updates.

    Inaddition to user access controls that may be imposed or applied via system and/or group policies -in a manner that works in conjunction with user profiles, the user management environment under -MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied. -Common restrictions that are frequently used includes:

    Logon Hours
    Password Aging
    Permitted Logon from certain machines only
    Account type (Local or Global)
    User Rights

    17.2.1. With Windows NT4/200x

    The tools that may be used to configure these types of controls from the MS Windows environment are: -The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). -Under MS Windows 200x/XP this is done using the Microsoft Managment Console (MMC) with approapriate -"snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor.

    17.2.2. With a Samba PDC

    With a Samba Domain Controller, the new tools for managing of user account and policy information includes: -smbpasswd, pdbedit, smbgroupedit, net, rpcclient.. The administrator should read the -man pages for these tools and become familiar with their use.

    17.3. System Startup and Logon Processing Overview

    The following attempts to document the order of processing of system and user policies following a system -reboot and as part of the user logon:

    1. Network starts, then Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming - Convention Provider (MUP) start -

    2. Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded - and applied. The list may include GPOs that: -

      Apply to the location of machines in a Directory
      Apply only when settings have changed
      Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.

      - No desktop user interface is presented until the above have been processed. -

    3. Execution of start-up scripts (hidden and synchronous by defaut). -

    4. A keyboard action to affect start of logon (Ctrl-Alt-Del). -

    5. User credentials are validated, User profile is loaded (depends on policy settings). -

    6. An ordered list of User GPOs is obtained. The list contents depends on what is configured in respsect of: - -

      Is user a domain member, thus subject to particular policies
      Loopback enablement, and the state of the loopback policy (Merge or Replace)
      Location of the Active Directory itself
      Has the list of GPOs changed. No processing is needed if not changed.

      -

    7. User Policies are applied from Active Directory. Note: There are several types. -

    8. Logon scripts are run. New to Win2K and Active Directory, logon scripts may be obtained based on Group - Policy objects (hidden and executed synchronously). NT4 style logon scripts are then run in a normal - window. -

    9. The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like and NT4 - Domain) machine (system) policies are applied at start-up, User policies are applied at logon. -

    PrevHomeNext
    Advanced Network ManangementUpDesktop Profile Management
    \ No newline at end of file diff --git a/docs/htmldocs/portability.html b/docs/htmldocs/portability.html deleted file mode 100644 index ac3e5b9adb..0000000000 --- a/docs/htmldocs/portability.html +++ /dev/null @@ -1,418 +0,0 @@ - -Portability
    SAMBA Project Documentation
    PrevNext

    Chapter 29. Portability

    Table of Contents
    29.1. HPUX
    29.2. SCO Unix
    29.3. DNIX
    29.4. RedHat Linux Rembrandt-II
    29.5. AIX
    29.6. Solaris

    Samba works on a wide range of platforms but the interface all the -platforms provide is not always compatible. This chapter contains -platform-specific information about compiling and using samba.

    29.1. HPUX

    HP's implementation of supplementary groups is, er, non-standard (for -hysterical reasons). There are two group files, /etc/group and -/etc/logingroup; the system maps UIDs to numbers using the former, but -initgroups() reads the latter. Most system admins who know the ropes -symlink /etc/group to /etc/logingroup (hard link doesn't work for reasons -too stupid to go into here). initgroups() will complain if one of the -groups you're in in /etc/logingroup has what it considers to be an invalid -ID, which means outside the range [0..UID_MAX], where UID_MAX is (I think) -60000 currently on HP-UX. This precludes -2 and 65534, the usual 'nobody' -GIDs.

    If you encounter this problem, make sure that the programs that are failing -to initgroups() be run as users not in any groups with GIDs outside the -allowed range.

    This is documented in the HP manual pages under setgroups(2) and passwd(4).

    On HPUX you must use gcc or the HP Ansi compiler. The free compiler -that comes with HP-UX is not Ansi compliant and cannot compile -Samba.

    29.2. SCO Unix

    -If you run an old version of SCO Unix then you may need to get important -TCP/IP patches for Samba to work correctly. Without the patch, you may -encounter corrupt data transfers using samba.

    The patch you need is UOD385 Connection Drivers SLS. It is available from -SCO (ftp.sco.com, directory SLS, files uod385a.Z and uod385a.ltr.Z).

    29.3. DNIX

    DNIX has a problem with seteuid() and setegid(). These routines are -needed for Samba to work correctly, but they were left out of the DNIX -C library for some reason.

    For this reason Samba by default defines the macro NO_EID in the DNIX -section of includes.h. This works around the problem in a limited way, -but it is far from ideal, some things still won't work right.

    -To fix the problem properly you need to assemble the following two -functions and then either add them to your C library or link them into -Samba.

    -put this in the file setegid.s:

            .globl  _setegid
-_setegid:
-        moveq   #47,d0
-        movl    #100,a0
-        moveq   #1,d1
-        movl    4(sp),a1
-        trap    #9
-        bccs    1$
-        jmp     cerror
-1$:
-        clrl    d0
-        rts

    put this in the file seteuid.s:

            .globl  _seteuid
-_seteuid:
-        moveq   #47,d0
-        movl    #100,a0
-        moveq   #0,d1
-        movl    4(sp),a1
-        trap    #9
-        bccs    1$
-        jmp     cerror
-1$:
-        clrl    d0
-        rts

    after creating the above files you then assemble them using

    as seteuid.s

    as setegid.s

    that should produce the files seteuid.o and -setegid.o

    then you need to add these to the LIBSM line in the DNIX section of -the Samba Makefile. Your LIBSM line will then look something like this:

    LIBSM = setegid.o seteuid.o -ln

    -You should then remove the line:

    #define NO_EID

    from the DNIX section of includes.h

    29.4. RedHat Linux Rembrandt-II

    By default RedHat Rembrandt-II during installation adds an -entry to /etc/hosts as follows: -

    	127.0.0.1 loopback "hostname"."domainname"

    This causes Samba to loop back onto the loopback interface. -The result is that Samba fails to communicate correctly with -the world and therefor may fail to correctly negotiate who -is the master browse list holder and who is the master browser.

    Corrective Action: Delete the entry after the word loopback - in the line starting 127.0.0.1

    29.5. AIX

    29.5.1. Sequential Read Ahead

    Disabling Sequential Read Ahead using vmtune -r 0 improves -samba performance significally.

    29.6. Solaris

    Some people have been experiencing problems with F_SETLKW64/fcntl -when running samba on solaris. The built in file locking mechanism was -not scalable. Performance would degrade to the point where processes would -get into loops of trying to lock a file. It woul try a lock, then fail, -then try again. The lock attempt was failing before the grant was -occurring. So the visible manifestation of this would be a handful of -processes stealing all of the CPU, and when they were trussed they would -be stuck if F_SETLKW64 loops.

    Sun released patches for Solaris 2.6, 8, and 9. The patch for Solaris 7 -has not been released yet.

    The patch revision for 2.6 is 105181-34 -for 8 is 108528-19 -and for 9 is 112233-04

    After the install of these patches it is recommended to reconfigure -and rebuild samba.

    Thanks to Joe Meslovich for reporting

    PrevHomeNext
    Migration from NT4 PDC to Samba-3 PDCUpSamba and other CIFS clients
    \ No newline at end of file diff --git a/docs/htmldocs/profilemgmt.html b/docs/htmldocs/profilemgmt.html deleted file mode 100644 index 7357336193..0000000000 --- a/docs/htmldocs/profilemgmt.html +++ /dev/null @@ -1,1753 +0,0 @@ - -Desktop Profile Management
    SAMBA Project Documentation
    PrevNext

    Chapter 18. Desktop Profile Management

    Table of Contents
    18.1. Roaming Profiles
    18.1.1. Samba Configuration for Profile Handling
    18.1.1.1. NT4/200x User Profiles
    18.1.1.2. Windows 9x / Me User Profiles
    18.1.1.3. Mixed Windows 9x / Me and Windows NT4/200x User Profiles
    18.1.2. Windows Client Profile Configuration Information
    18.1.2.1. Windows 9x / Me Profile Setup
    18.1.2.2. Windows NT4 Workstation
    18.1.2.3. Windows 2000/XP Professional
    18.1.3. Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    18.1.4. Profile Migration from Windows NT4/200x Server to Samba
    18.1.4.1. Windows NT4 Profile Management Tools
    18.1.4.2. Side bar Notes
    18.1.4.3. moveuser.exe
    18.1.4.4. Get SID
    18.2. Mandatory profiles
    18.3. Creating/Managing Group Profiles
    18.4. Default Profile for Windows Users
    18.4.1. MS Windows 9x/Me
    18.4.2. MS Windows NT4 Workstation
    18.4.3. MS Windows 200x/XP

    18.1. Roaming Profiles

    Roaming profiles support is different for Win9x / Me and Windows NT4/200x.

    Before discussing how to configure roaming profiles, it is useful to see how -Windows 9x / Me and Windows NT4/200x clients implement these features.

    Windows 9x / Me clients send a NetUserGetInfo request to the server to get the user's -profiles location. However, the response does not have room for a separate -profiles location field, only the user's home share. This means that Win9X/Me -profiles are restricted to being stored in the user's home directory.

    Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields, -including a separate field for the location of the user's profiles.

    18.1.1. Samba Configuration for Profile Handling

    This section documents how to configure Samba for MS Windows client profile support.

    18.1.1.1. NT4/200x User Profiles

    To support Windowns NT4/200x clients, in the [global] section of smb.conf set the -following (for example):

    	logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath
    - - This is typically implemented like: - -
    		logon path = \\%L\Profiles\%u
    -where %L translates to the name of the Samba server and %u translates to the user name

    The default for this option is \\%N\%U\profile, namely \\sambaserver\username\profile. -The \\N%\%U service is created automatically by the [homes] service. If you are using -a samba server for the profiles, you _must_ make the share specified in the logon path -browseable. Please refer to the man page for smb.conf in respect of the different -symantics of %L and %N, as well as %U and %u.

    MS Windows NT/2K clients at times do not disconnect a connection to a server -between logons. It is recommended to NOT use the homes -meta-service name as part of the profile share path.

    18.1.1.2. Windows 9x / Me User Profiles

    To support Windows 9x / Me clients, you must use the "logon home" parameter. Samba has -now been fixed so that net use /home now works as well, and it, too, relies -on the logon home parameter.

    By using the logon home parameter, you are restricted to putting Win9x / Me -profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your smb.conf file:

    	logon home = \\%L\%U\.profiles

    then your Windows 9x / Me clients will dutifully put their clients in a subdirectory -of your home directory called .profiles (thus making them hidden).

    Not only that, but net use/home will also work, because of a feature in -Windows 9x / Me. It removes any directory stuff off the end of the home directory area -and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for logon home.

    18.1.1.3. Mixed Windows 9x / Me and Windows NT4/200x User Profiles

    You can support profiles for both Win9X and WinNT clients by setting both the -logon home and logon path parameters. For example:

    	logon home = \\%L\%u\.profiles
-	logon path = \\%L\profiles\%u

    18.1.2. Windows Client Profile Configuration Information

    18.1.2.1. Windows 9x / Me Profile Setup

    When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders "Start Menu", "Desktop", "Programs" and "Nethood". -These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options "preserve case = yes", "short preserve case = yes" and -"case sensitive = no" in order to maintain capital letters in shortcuts -in any of the profile folders.

    The user.DAT file contains all the user's preferences. If you wish to -enforce a set of preferences, rename their user.DAT file to user.MAN, -and deny them write access to this file.

    1. On the Windows 9x / Me machine, go to Control Panel -> Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer - to reboot. -

    2. On the Windows 9x / Me machine, go to Control Panel -> Network -> - Client for Microsoft Networks -> Preferences. Select 'Log on to - NT Domain'. Then, ensure that the Primary Logon is 'Client for - Microsoft Networks'. Press OK, and this time allow the computer - to reboot. -

    Under Windows 9x / Me Profiles are downloaded from the Primary Logon. -If you have the Primary Logon as 'Client for Novell Networks', then -the profiles and logon script will be downloaded from your Novell -Server. If you have the Primary Logon as 'Windows Logon', then the -profiles will be loaded from the local machine - a bit against the -concept of roaming profiles, it would seem!

    You will now find that the Microsoft Networks Login box contains -[user, password, domain] instead of just [user, password]. Type in -the samba server's domain name (or any other domain known to exist, -but bear in mind that the user will be authenticated against this -domain and profiles downloaded from it, if that domain logon server -supports it), user name and user's password.

    Once the user has been successfully validated, the Windows 9x / Me machine -will inform you that 'The user has not logged on before' and asks you -if you wish to save the user's preferences? Select 'yes'.

    Once the Windows 9x / Me client comes up with the desktop, you should be able -to examine the contents of the directory specified in the "logon path" -on the samba server and verify that the "Desktop", "Start Menu", -"Programs" and "Nethood" folders have been created.

    These folders will be cached locally on the client, and updated when -the user logs off (if you haven't made them read-only by then). -You will find that if the user creates further folders or short-cuts, -that the client will merge the profile contents downloaded with the -contents of the profile directory already on the local client, taking -the newest folders and short-cuts from each set.

    If you have made the folders / files read-only on the samba server, -then you will get errors from the Windows 9x / Me machine on logon and logout, as -it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the Windows 9x / Me machine, check the Unix file -permissions and ownership rights on the profile directory contents, -on the samba server.

    If you have problems creating user profiles, you can reset the user's -local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time".

    1. instead of logging in under the [user, password, domain] dialog, - press escape. -

    2. run the regedit.exe program, and look in: -

      HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList -

      you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. - - [Exit the registry editor]. - -

    3. WARNING - before deleting the contents of the - directory listed in the ProfilePath (this is likely to be - c:\windows\profiles\username), ask them if they - have any important files stored on their desktop or in their start menu. - Delete the contents of the directory ProfilePath (making a backup if any - of the files are needed). -

      This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. -

    4. search for the user's .PWL password-caching file in the c:\windows - directory, and delete it. -

    5. log off the windows 9x / Me client. -

    6. check the contents of the profile path (see "logon path" described - above), and delete the user.DAT or user.MAN file for the user, - making a backup if required. -

    If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as ethereal or netmon.exe, and -look for error messages.

    If you have access to an Windows NT4/200x server, then first set up roaming profiles -and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine -the example packet traces provided with Windows NT4/200x server, and see what the -differences are with the equivalent samba trace.

    18.1.2.2. Windows NT4 Workstation

    When a user first logs in to a Windows NT Workstation, the profile -NTuser.DAT is created. The profile location can be now specified -through the "logon path" parameter.

    There is a parameter that is now available for use with NT Profiles: -"logon drive". This should be set to H: or any other drive, and -should be used in conjunction with the new "logon home" parameter.

    The entry for the NT4 profile is a _directory_ not a file. The NT -help on profiles mentions that a directory is also created with a .PDS -extension. The user, while logging in, must have write permission to -create the full profile path (and the folder with the .PDS extension -for those situations where it might be created.)

    In the profile directory, Windows NT4 creates more folders than Windows 9x / Me. -It creates "Application Data" and others, as well as "Desktop", "Nethood", -"Start Menu" and "Programs". The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and -its purpose is currently unknown.

    You can use the System Control Panel to copy a local profile onto -a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN -turns a profile into a mandatory one.

    The case of the profile is significant. The file must be called -NTuser.DAT or, for a mandatory profile, NTuser.MAN.

    18.1.2.3. Windows 2000/XP Professional

    You must first convert the profile from a local profile to a domain -profile on the MS Windows workstation as follows:

    • Log on as the LOCAL workstation administrator. -

    • Right click on the 'My Computer' Icon, select 'Properties' -

    • Click on the 'User Profiles' tab -

    • Select the profile you wish to convert (click on it once) -

    • Click on the button 'Copy To' -

    • In the "Permitted to use" box, click on the 'Change' button. -

    • Click on the 'Look in" area that lists the machine name, when you click - here it will open up a selection box. Click on the domain to which the - profile must be accessible. -

      You will need to log on if a logon box opens up. Eg: In the connect - as: MIDEARTH\root, password: mypassword.

    • To make the profile capable of being used by anyone select 'Everyone' -

    • Click OK. The Selection box will close. -

    • Now click on the 'Ok' button to create the profile in the path you - nominated. -

    Done. You now have a profile that can be editted using the samba-3.0.0 -profiles tool.

    Under NT/2K the use of mandotory profiles forces the use of MS Exchange -storage of mail data. That keeps desktop profiles usable.

    • This is a security check new to Windows XP (or maybe only -Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is:

      "Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders"

      ...and it should be set to "Enabled". -Does the new version of samba have an Active Directory analogue? If so, -then you may be able to set the policy through this.

      If you cannot set group policies in samba, then you may be able to set -the policy locally on each machine. If you want to try this, then do -the following (N.B. I don't know for sure that this will work in the -same way as a domain group policy):

    • On the XP workstation log in with an Administrator account.

    • Click: "Start", "Run"

    • Type: "mmc"

    • Click: "OK"

    • A Microsoft Management Console should appear.

    • Click: File, "Add/Remove Snap-in...", "Add"

    • Double-Click: "Group Policy"

    • Click: "Finish", "Close"

    • Click: "OK"

    • In the "Console Root" window:

    • Expand: "Local Computer Policy", "Computer Configuration",

    • "Administrative Templates", "System", "User Profiles"

    • Double-Click: "Do not check for user ownership of Roaming Profile

    • Folders"

    • Select: "Enabled"

    • Click: OK"

    • Close the whole console. You do not need to save the settings (this - refers to the console settings rather than the policies you have - changed).

    • Reboot

    18.1.3. Sharing Profiles between W9x/Me and NT4/200x/XP workstations

    Sharing of desktop profiles between Windows versions is NOT recommended. -Desktop profiles are an evolving phenomenon and profiles for later versions -of MS Windows clients add features that may interfere with earlier versions -of MS Windows clients. Probably the more salient reason to NOT mix profiles -is that when logging off an earlier version of MS Windows the older format -of profile contents may overwrite information that belongs to the newer -version resulting in loss of profile information content when that user logs -on again with the newer version of MS Windows.

    If you then want to share the same Start Menu / Desktop with W9x/Me, you will -need to specify a common location for the profiles. The smb.conf parameters -that need to be common are logon path and -logon home.

    If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory.

    18.1.4. Profile Migration from Windows NT4/200x Server to Samba

    There is nothing to stop you specifying any path that you like for the -location of users' profiles. Therefore, you could specify that the -profile be stored on a samba server, or any other SMB server, as long as -that SMB server supports encrypted passwords.

    18.1.4.1. Windows NT4 Profile Management Tools

    Unfortunately, the Resource Kit information is specific to the version of MS Windows -NT4/200x. The correct resource kit is required for each platform.

    Here is a quick guide:

    • On your NT4 Domain Controller, right click on 'My Computer', then -select the tab labelled 'User Profiles'.

    • Select a user profile you want to migrate and click on it.

      I am using the term "migrate" lossely. You can copy a profile to -create a group profile. You can give the user 'Everyone' rights to the -profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC.

    • Click the 'Copy To' button.

    • In the box labelled 'Copy Profile to' add your new path, eg: - c:\temp\foobar

    • Click on the button labelled 'Change' in the "Permitted to use" box.

    • Click on the group 'Everyone' and then click OK. This closes the - 'chose user' box.

    • Now click OK.

    Follow the above for every profile you need to migrate.

    18.1.4.2. Side bar Notes

    You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page.

    With Samba-3.0.0 alpha code you can import all you NT4 domain accounts -using the net samsync method. This way you can retain your profile -settings as well as all your users.

    18.1.4.3. moveuser.exe

    The W2K professional resource kit has moveuser.exe. moveuser.exe changes -the security of a profile from one user to another. This allows the account -domain to change, and/or the user name to change.

    18.1.4.4. Get SID

    You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 -Resource Kit.

    Windows NT 4.0 stores the local profile information in the registry under -the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

    Under the ProfileList key, there will be subkeys named with the SIDs of the -users who have logged on to this computer. (To find the profile information -for the user whose locally cached profile you want to move, find the SID for -the user with the GetSID.exe utility.) Inside of the appropriate user's -subkey, you will see a string value named ProfileImagePath.

    18.2. Mandatory profiles

    A Mandatory Profile is a profile that the user does NOT have the ability to overwrite. -During the user's session it may be possible to change the desktop environment, but -as the user logs out all changes made will be lost. If it is desired to NOT allow the -user any ability to change the desktop environment then this must be done through -policy settings. See previous chapter.

    Under NO circumstances should the profile directory (or it's contents) be made read-only -as this may render the profile un-usable.

    For MS Windows NT4/200x/XP the above method can be used to create mandatory profiles -also. To convert a group profile into a mandatory profile simply locate the NTUser.DAT -file in the copied profile and rename it to NTUser.MAN.

    For MS Windows 9x / Me it is the User.DAT file that must be renamed to User.MAN to -affect a mandatory profile.

    18.3. Creating/Managing Group Profiles

    Most organisations are arranged into departments. There is a nice benenfit in -this fact since usually most users in a department will require the same desktop -applications and the same desktop layout. MS Windows NT4/200x/XP will allow the -use of Group Profiles. A Group Profile is a profile that is created firstly using -a template (example) user. Then using the profile migration tool (see above) the -profile is assigned access rights for the user group that needs to be given access -to the group profile.

    The next step is rather important. PLEASE NOTE: Instead of assigning a group profile -to users (ie: Using User Manager) on a "per user" basis, the group itself is assigned -the now modified profile.

    Be careful with group profiles, if the user who is a member of a group also - has a personal profile, then the result will be a fusion (merge) of the two. -

    18.4. Default Profile for Windows Users

    MS Windows 9x / Me and NT4/200x/XP will use a default profile for any user for whom -a profile does not already exist. Armed with a knowledge of where the default profile -is located on the Windows workstation, and knowing which registry keys affect the path -from which the default profile is created, it is possible to modify the default profile -to one that has been optimised for the site. This has significant administrative -advantages.

    18.4.1. MS Windows 9x/Me

    To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System -Policy Editor or change the registry directly.

    To enable default per user profiles in Windows 9x / Me, launch the System Policy Editor, then -select File -> Open Registry, then click on the Local Computer icon, click on Windows 98 System, -select User Profiles, click on the enable box. Do not forget to save the registry changes.

    To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive -HKEY_LOCAL_MACHINE\Network\Logon. Now add a DWORD type key with the name -"User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0.

    18.4.1.1. How User Profiles Are Handled in Windows 9x / Me?

    When a user logs on to a Windows 9x / Me machine, the local profile path, -HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList, is checked -for an existing entry for that user:

    If the user has an entry in this registry location, Windows 9x / Me checks for a locally cached -version of the user profile. Windows 9x / Me also checks the user's home directory (or other -specified directory if the location has been modified) on the server for the User Profile. -If a profile exists in both locations, the newer of the two is used. If the User Profile exists -on the server, but does not exist on the local machine, the profile on the server is downloaded -and used. If the User Profile only exists on the local machine, that copy is used.

    If a User Profile is not found in either location, the Default User Profile from the Windows 9x / Me -machine is used and is copied to a newly created folder for the logged on user. At log off, any -changes that the user made are written to the user's local profile. If the user has a roaming -profile, the changes are written to the user's profile on the server.

    18.4.2. MS Windows NT4 Workstation

    On MS Windows NT4 the default user profile is obtained from the location -%SystemRoot%\Profiles which in a default installation will translate to -C:\WinNT\Profiles. Under this directory on a clean install there will be -three (3) directories: Administrator, All Users, Default User.

    The All Users directory contains menu settings that are common across all -system users. The Default User directory contains menu entries that are -customisable per user depending on the profile settings chosen/created.

    When a new user first logs onto an MS Windows NT4 machine a new profile is created from:

    All Users settings
    Default User settings (contains the default NTUser.DAT file)

    When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain -the following steps are followed in respect of profile handling:

    1. The users' account information which is obtained during the logon process contains - the location of the users' desktop profile. The profile path may be local to the - machine or it may be located on a network share. If there exists a profile at the location - of the path from the user account, then this profile is copied to the location - %SystemRoot%\Profiles\%USERNAME%. This profile then inherits the - settings in the All Users profile in the %SystemRoot%\Profiles - location. -

    2. If the user account has a profile path, but at it's location a profile does not exist, - then a new profile is created in the %SystemRoot%\Profiles\%USERNAME% - directory from reading the Default User profile. -

    3. If the NETLOGON share on the authenticating server (logon server) contains a policy file - (NTConfig.POL) then it's contents are applied to the NTUser.DAT - which is applied to the HKEY_CURRENT_USER part of the registry. -

    4. When the user logs out, if the profile is set to be a roaming profile it will be written - out to the location of the profile. The NTuser.DAT file is then - re-created from the contents of the HKEY_CURRENT_USER contents. - Thus, should there not exist in the NETLOGON share an NTConfig.POL at the - next logon, the effect of the provious NTConfig.POL will still be held - in the profile. The effect of this is known as tatooing. -

    MS Windows NT4 profiles may be Local or Roaming. A Local profile -will stored in the %SystemRoot%\Profiles\%USERNAME% location. A roaming profile will -also remain stored in the same way, unless the following registry key is created:

    	HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\
-	"DeleteRoamingCache"=dword:00000001
    - -In which case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be -deleted on logout.

    Under MS Windows NT4 default locations for common resources (like My Documents -may be redirected to a network share by modifying the following registry keys. These changes may be affected -via use of the System Policy Editor (to do so may require that you create your owns template extension -for the policy editor to allow this to be done through the GUI. Another way to do this is by way of first -creating a default user profile, then while logged in as that user, run regedt32 to edit the key settings.

    The Registry Hive key that affects the behaviour of folders that are part of the default user profile -are controlled by entries on Windows NT4 is:

            HKEY_CURRENT_USER
-                \Software
-                        \Microsoft
-                                \Windows
-                                        \CurrentVersion
-                                                \Explorer
-                                                        \User Shell Folders\

    The above hive key contains a list of automatically managed folders. The default entries are:

            Name            Default Value
-        --------------  -----------------------------------------
-        AppData         %USERPROFILE%\Application Data
-        Desktop         %USERPROFILE%\Desktop
-        Favorites       %USERPROFILE%\Favorites
-        NetHood         %USERPROFILE%\NetHood
-        PrintHood       %USERPROFILE%\PrintHood
-        Programs        %USERPROFILE%\Start Menu\Programs
-        Recent          %USERPROFILE%\Recent
-        SendTo          %USERPROFILE%\SendTo
-        Start Menu      %USERPROFILE%\Start Menu
-        Startup         %USERPROFILE%\Start Menu\Programs\Startup
-
    -

    The registry key that contains the location of the default profile settings is: - -

    	HKEY_LOCAL_MACHINE
-		\SOFTWARE
-			\Microsoft
-				\Windows
-					\CurrentVersion
-						\Explorer
-							\User Shell Folders
    - -The default entries are: - -
    	Common Desktop		%SystemRoot%\Profiles\All Users\Desktop
-	Common Programs		%SystemRoot%\Profiles\All Users\Programs
-	Common Start Menu	%SystemRoot%\Profiles\All Users\Start Menu
-	Common Startu	p	%SystemRoot%\Profiles\All Users\Start Menu\Progams\Startup

    18.4.3. MS Windows 200x/XP

    MS Windows XP Home Edition does use default per user profiles, but can not participate - in domain security, can not log onto an NT/ADS style domain, and thus can obtain the profile - only from itself. While there are benefits in doing this the beauty of those MS Windows - clients that CAN participate in domain logon processes allows the administrator to create - a global default profile and to enforce it through the use of Group Policy Objects (GPOs). -

    When a new user first logs onto MS Windows 200x/XP machine the default profile is obtained from -C:\Documents and Settings\Default User. The administrator can modify (or change -the contents of this location and MS Windows 200x/XP will gladly user it. This is far from the optimum -arrangement since it will involve copying a new default profile to every MS Windows 200x/XP client -workstation.

    When MS Windows 200x/XP participate in a domain security context, and if the default user -profile is not found, then the client will search for a default profile in the NETLOGON share -of the authenticating server. ie: In MS Windows parlance: -%LOGONSERVER%\NETLOGON\Default User and if one exits there it will copy this -to the workstation to the C:\Documents and Settings\ under the Windows -login name of the user.

    This path translates, in Samba parlance, to the smb.conf [NETLOGON] share. The directory - should be created at the root of this share and msut be called Default Profile. -

    If a default profile does not exist in this location then MS Windows 200x/XP will use the local -default profile.

    On loging out, the users' desktop profile will be stored to the location specified in the registry -settings that pertain to the user. If no specific policies have been created, or passed to the client -during the login process (as Samba does automatically), then the user's profile will be written to -the local machine only under the path C:\Documents and Settings\%USERNAME%.

    Those wishing to modify the default behaviour can do so through up to three methods:

    • Modify the registry keys on the local machine manually and place the new default profile in the - NETLOGON share root - NOT recommended as it is maintenance intensive. -

    • Create an NT4 style NTConfig.POL file that specified this behaviour and locate this file - in the root of the NETLOGON share along with the new default profile. -

    • Create a GPO that enforces this through Active Directory, and place the new default profile - in the NETLOGON share. -

    The Registry Hive key that affects the behaviour of folders that are part of the default user profile -are controlled by entries on Windows 200x/XP is:

    	HKEY_CURRENT_USER
-		\Software
-			\Microsoft
-				\Windows
-					\CurrentVersion
-						\Explorer
-							\User Shell Folders\

    The above hive key contains a list of automatically managed folders. The default entries are:

    	Name		Default Value
-	--------------	-----------------------------------------
-	AppData		%USERPROFILE%\Application Data
-	Cache		%USERPROFILE%\Local Settings\Temporary Internet Files
-	Cookies		%USERPROFILE%\Cookies
-	Desktop		%USERPROFILE%\Desktop
-	Favorites	%USERPROFILE%\Favorites
-	History		%USERPROFILE%\Local Settings\History
-	Local AppData	%USERPROFILE%\Local Settings\Application Data
-	Local Settings	%USERPROFILE%\Local Settings
-	My Pictures	%USERPROFILE%\My Documents\My Pictures
-	NetHood		%USERPROFILE%\NetHood
-	Personal	%USERPROFILE%\My Documents
-	PrintHood	%USERPROFILE%\PrintHood
-	Programs	%USERPROFILE%\Start Menu\Programs
-	Recent		%USERPROFILE%\Recent
-	SendTo		%USERPROFILE%\SendTo
-	Start Menu	%USERPROFILE%\Start Menu
-	Startup		%USERPROFILE%\Start Menu\Programs\Startup
-	Templates	%USERPROFILE%\Templates
-
    -

    There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all -the others are of type REG_EXPAND_SZ.

    It makes a huge difference to the speed of handling roaming user profiles if all the folders are -stored on a dedicated location on a network server. This means that it will NOT be necessary to -write Outlook PST file over the network for every login and logout.

    To set this to a network location you could use the following examples: - -

    	%LOGONSERVER%\%USERNAME%\Default Folders
    - -This would store the folders in the user's home directory under a directory called "Default Folders" - -You could also use: - -
    	\\SambaServer\FolderShare\%USERNAME%
    - -in which case the default folders will be stored in the server named SambaServer -in the share called FolderShare under a directory that has the name of the MS Windows -user as seen by the Linux/Unix file system.

    Please note that once you have created a default profile share, you MUST migrate a user's profile -(default or custom) to it.

    MS Windows 200x/XP profiles may be Local or Roaming. -A roaming profile will be cached locally unless the following registry key is created:

    	HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\
-	"DeleteRoamingCache"=dword:00000001
    - -In which case, the local cache copy will be deleted on logout.

    PrevHomeNext
    System and Account PoliciesUpInterdomain Trust Relationships
    \ No newline at end of file diff --git a/docs/htmldocs/samba-howto-collection.html b/docs/htmldocs/samba-howto-collection.html deleted file mode 100644 index 3d2a95873e..0000000000 --- a/docs/htmldocs/samba-howto-collection.html +++ /dev/null @@ -1,1394 +0,0 @@ - -SAMBA Project Documentation

    SAMBA Project Documentation

    SAMBA Team

    Edited by

    Jelmer R. Vernooij

    John H. Terpstra

    Gerald (Jerry) Carter

    This book is a collection of HOWTOs added to Samba documentation over the years. -Samba is always under development, and so is it's documentation. -The most recent version of this document -can be found at http://www.samba.org/ -on the "Documentation" page. Please send updates to jerry@samba.org or -jelmer@samba.org.

    This documentation is distributed under the GNU General Public License (GPL) -version 2. A copy of the license is included with the Samba source -distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt

    Table of Contents
    I. General installation
    1. Introduction to Samba
    1.1. Background
    1.2. Terminology
    1.3. Related Projects
    1.4. SMB Methodology
    1.5. Additional Resources
    1.6. Epilogue
    1.7. Miscellaneous
    2. How to Install and Test SAMBA
    2.1. Obtaining and installing samba
    2.2. Configuring samba
    2.3. Try listing the shares available on your - server
    2.4. Try connecting with the unix client
    2.5. Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
    2.6. What If Things Don't Work?
    3. Quick Cross Subnet Browsing / Cross Workgroup Browsing guide
    3.1. Discussion
    3.2. How browsing functions and how to deploy stable and -dependable browsing using Samba
    3.3. Use of the Remote Announce parameter
    3.4. Use of the Remote Browse Sync parameter
    3.5. Use of WINS
    3.6. Do NOT use more than one (1) protocol on MS Windows machines
    3.7. Name Resolution Order
    4. User information database
    4.1. Introduction
    4.2. Important Notes About Security
    4.3. The smbpasswd Command
    4.4. Plain text
    4.5. TDB
    4.6. LDAP
    4.7. MySQL
    4.8. XML
    II. Type of installation
    5. Nomenclature of Server Types
    5.1. Stand Alone Server
    5.2. Domain Member Server
    5.3. Domain Controller
    6. Samba as Stand-Alone Server
    6.1. User and Share security level
    7. Samba as an NT4 or Win2k Primary Domain Controller
    7.1. Prerequisite Reading
    7.2. Background
    7.3. Configuring the Samba Domain Controller
    7.4. Creating Machine Trust Accounts and Joining Clients to the Domain
    7.5. Common Problems and Errors
    7.6. Domain Control for Windows 9x/ME
    8. Samba Backup Domain Controller to Samba Domain Control
    8.1. Prerequisite Reading
    8.2. Background
    8.3. What qualifies a Domain Controller on the network?
    8.4. Can Samba be a Backup Domain Controller to an NT PDC?
    8.5. How do I set up a Samba BDC?
    9. Samba as a ADS domain member
    9.1. Setup your smb.conf
    9.2. Setup your /etc/krb5.conf
    9.3. Create the computer account
    9.4. Test your server setup
    9.5. Testing with smbclient
    9.6. Notes
    10. Samba as a NT4 or Win2k domain member
    10.1. Joining an NT Domain with Samba 3.0
    10.2. Why is this better than security = server?
    III. Advanced Configuration
    11. UNIX Permission Bits and Windows NT Access Control Lists
    11.1. Viewing and changing UNIX permissions using the NT - security dialogs
    11.2. How to view file security on a Samba share
    11.3. Viewing file ownership
    11.4. Viewing file or directory permissions
    11.5. Modifying file or directory permissions
    11.6. Interaction with the standard Samba create mask - parameters
    11.7. Interaction with the standard Samba file attribute - mapping
    12. Configuring Group Mapping
    13. Printing Support
    13.1. Introduction
    13.2. Configuration
    13.3. The Imprints Toolset
    13.4. Diagnosis
    14. CUPS Printing Support
    14.1. Introduction
    14.2. Configuring smb.conf for CUPS
    14.3. CUPS - RAW Print Through Mode
    14.4. CUPS as a network PostScript RIP -- CUPS drivers working on server, Adobe -PostScript driver with CUPS-PPDs downloaded to clients
    14.5. Windows Terminal Servers (WTS) as CUPS clients
    14.6. Setting up CUPS for driver download
    14.7. Sources of CUPS drivers / PPDs
    14.8. The CUPS Filter Chains
    14.9. CUPS Print Drivers and Devices
    14.10. Limiting the number of pages users can print
    14.11. Advanced Postscript Printing from MS Windows
    14.12. Auto-Deletion of CUPS spool files
    15. Unified Logons between Windows NT and UNIX using Winbind
    15.1. Abstract
    15.2. Introduction
    15.3. What Winbind Provides
    15.4. How Winbind Works
    15.5. Installation and Configuration
    15.6. Limitations
    15.7. Conclusion
    16. Advanced Network Manangement
    16.1. Configuring Samba Share Access Controls
    16.2. Remote Server Administration
    16.3. Network Logon Script Magic
    17. System and Account Policies
    17.1. Creating and Managing System Policies
    17.2. Managing Account/User Policies
    17.3. System Startup and Logon Processing Overview
    18. Desktop Profile Management
    18.1. Roaming Profiles
    18.2. Mandatory profiles
    18.3. Creating/Managing Group Profiles
    18.4. Default Profile for Windows Users
    19. Interdomain Trust Relationships
    19.1. Trust Relationship Background
    19.2. Native MS Windows NT4 Trusts Configuration
    19.3. Configuring Samba NT-style Domain Trusts
    20. PAM Configuration for Centrally Managed Authentication
    20.1. Samba and PAM
    20.2. Distributed Authentication
    20.3. PAM Configuration in smb.conf
    21. Stackable VFS modules
    21.1. Introduction and configuration
    21.2. Included modules
    21.3. VFS modules available elsewhere
    22. Hosting a Microsoft Distributed File System tree on Samba
    22.1. Instructions
    23. Integrating MS Windows networks with Samba
    23.1. Name Resolution in a pure Unix/Linux world
    23.2. Name resolution as used within MS Windows networking
    24. Improved browsing in samba
    24.1. Overview of browsing
    24.2. Browsing support in samba
    24.3. Problem resolution
    24.4. Browsing across subnets
    24.5. Setting up a WINS server
    24.6. Setting up Browsing in a WORKGROUP
    24.7. Setting up Browsing in a DOMAIN
    24.8. Forcing samba to be the master
    24.9. Making samba the domain master
    24.10. Note about broadcast addresses
    24.11. Multiple interfaces
    25. Securing Samba
    25.1. Introduction
    25.2. Using host based protection
    25.3. Using interface protection
    25.4. Using a firewall
    25.5. Using a IPC$ share deny
    25.6. Upgrading Samba
    26. Unicode/Charsets
    26.1. What are charsets and unicode?
    26.2. Samba and charsets
    26.3. Conversion from old names
    26.4. Japanese charsets
    IV. Appendixes
    27. How to compile SAMBA
    27.1. Access Samba source code via CVS
    27.2. Accessing the samba sources via rsync and ftp
    27.3. Verifying Samba's PGP signature
    27.4. Building the Binaries
    27.5. Starting the smbd and nmbd
    28. Migration from NT4 PDC to Samba-3 PDC
    28.1. Planning and Getting Started
    28.2. Managing Samba-3 Domain Control
    29. Portability
    29.1. HPUX
    29.2. SCO Unix
    29.3. DNIX
    29.4. RedHat Linux Rembrandt-II
    29.5. AIX
    29.6. Solaris
    30. Samba and other CIFS clients
    30.1. Macintosh clients?
    30.2. OS2 Client
    30.3. Windows for Workgroups
    30.4. Windows '95/'98
    30.5. Windows 2000 Service Pack 2
    30.6. Windows NT 3.1
    31. SWAT - The Samba Web Admininistration Tool
    31.1. SWAT Features and Benefits
    32. Samba performance issues
    32.1. Comparisons
    32.2. Socket options
    32.3. Read size
    32.4. Max xmit
    32.5. Log level
    32.6. Read raw
    32.7. Write raw
    32.8. Slow Clients
    32.9. Slow Logins
    32.10. Client tuning
    33. The samba checklist
    33.1. Introduction
    33.2. Assumptions
    33.3. The tests
    33.4. Still having troubles?
    34. Analysing and solving samba problems
    34.1. Diagnostics tools
    34.2. Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
    34.3. Useful URL's
    34.4. Getting help from the mailing lists
    34.5. How to get off the mailinglists
    35. Reporting Bugs
    35.1. Introduction
    35.2. General info
    35.3. Debug levels
    35.4. Internal errors
    35.5. Attaching to a running process
    35.6. Patches
      Next
      General installation
    \ No newline at end of file diff --git a/docs/htmldocs/securitylevels.html b/docs/htmldocs/securitylevels.html deleted file mode 100644 index ddfb22536b..0000000000 --- a/docs/htmldocs/securitylevels.html +++ /dev/null @@ -1,212 +0,0 @@ - -Chapter 4. Samba as Stand-Alone Server
    Chapter 4. Samba as Stand-Alone Server
    Prev Part II. Server Configuration Basics Next

    Chapter 4. Samba as Stand-Alone Server

    Andrew Tridgell

    Samba Team

    <tridge@samba.org>

    Jelmer R. Vernooij

    The Samba Team

    <jelmer@samba.org>

    Table of Contents

    User and Share security level
    User Level Security
    Share Level Security
    Server Level Security
    Domain Level Security
    ADS Level Security

    -In this section the function and purpose of Samba's security -modes are described. -

    User and Share security level

    -A SMB server tells the client at startup what "security level" it is -running. There are two options "share level" and "user level". Which -of these two the client receives affects the way the client then tries -to authenticate itself. It does not directly affect (to any great -extent) the way the Samba server does security. I know this is -strange, but it fits in with the client/server approach of SMB. In SMB -everything is initiated and controlled by the client, and the server -can only tell the client what is available and whether an action is -allowed. -

    User Level Security

    -I'll describe user level security first, as its simpler. In user level -security the client will send a "session setup" command directly after -the protocol negotiation. This contains a username and password. The -server can either accept or reject that username/password -combination. Note that at this stage the server has no idea what -share the client will eventually try to connect to, so it can't base -the "accept/reject" on anything other than: -

    1. the username/password

    2. the machine that the client is coming from

    -If the server accepts the username/password then the client expects to -be able to mount any share (using a "tree connection") without -specifying a password. It expects that all access rights will be as -the username/password specified in the "session setup". -

    -It is also possible for a client to send multiple "session setup" -requests. When the server responds it gives the client a "uid" to use -as an authentication tag for that username/password. The client can -maintain multiple authentication contexts in this way (WinDD is an -example of an application that does this) -

    Share Level Security

    -Ok, now for share level security. In share level security the client -authenticates itself separately for each share. It will send a -password along with each "tree connection" (share mount). It does not -explicitly send a username with this operation. The client is -expecting a password to be associated with each share, independent of -the user. This means that samba has to work out what username the -client probably wants to use. It is never explicitly sent the -username. Some commercial SMB servers such as NT actually associate -passwords directly with shares in share level security, but samba -always uses the unix authentication scheme where it is a -username/password that is authenticated, not a "share/password". -

    -Many clients send a "session setup" even if the server is in share -level security. They normally send a valid username but no -password. Samba records this username in a list of "possible -usernames". When the client then does a "tree connection" it also adds -to this list the name of the share they try to connect to (useful for -home directories) and any users listed in the user = smb.conf -line. The password is then checked in turn against these "possible -usernames". If a match is found then the client is authenticated as -that user. -

    Server Level Security

    -Finally "server level" security. In server level security the samba -server reports to the client that it is in user level security. The -client then does a "session setup" as described earlier. The samba -server takes the username/password that the client sends and attempts -to login to the "password server" by sending exactly the same -username/password that it got from the client. If that server is in -user level security and accepts the password then samba accepts the -clients connection. This allows the samba server to use another SMB -server as the "password server". -

    -You should also note that at the very start of all this, where the -server tells the client what security level it is in, it also tells -the client if it supports encryption. If it does then it supplies the -client with a random "cryptkey". The client will then send all -passwords in encrypted form. You have to compile samba with encryption -enabled to support this feature, and you have to maintain a separate -smbpasswd file with SMB style encrypted passwords. It is -cryptographically impossible to translate from unix style encryption -to SMB style encryption, although there are some fairly simple management -schemes by which the two could be kept in sync. -

    -"security = server" means that Samba reports to clients that -it is running in "user mode" but actually passes off all authentication -requests to another "user mode" server. This requires an additional -parameter "password server =" that points to the real authentication server. -That real authentication server can be another Samba server or can be a -Windows NT server, the later natively capable of encrypted password support. -

    Note

    -Server level security is incompatible with what is known -as schannel or "sign and seal" protocols. This means that -if you want to use server level security you must disable -the use of "sign and seal" on all machines on your network. -

    Configuring Samba for Seemless Windows Network Integration

    -MS Windows clients may use encrypted passwords as part of a challenege/response -authentication model (a.k.a. NTLMv1) or alone, or clear text strings for simple -password based authentication. It should be realized that with the SMB protocol -the password is passed over the network either in plain text or encrypted, but -not both in the same authentication request. -

    -When encrypted passwords are used a password that has been entered by the user -is encrypted in two ways: -

    • An MD4 hash of the UNICODE of the password - string. This is known as the NT hash. -

    • The password is converted to upper case, - and then padded or trucated to 14 bytes. This string is - then appended with 5 bytes of NULL characters and split to - form two 56 bit DES keys to encrypt a "magic" 8 byte value. - The resulting 16 bytes for the LanMan hash. -

    -MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0 -pre-service pack 3 will use either mode of password authentication. All -versions of MS Windows that follow these versions no longer support plain -text passwords by default. -

    -MS Windows clients have a habit of dropping network mappings that have been idle -for 10 minutes or longer. When the user attempts to use the mapped drive -connection that has been dropped, the client re-establishes the connection using -a cached copy of the password. -

    -When Microsoft changed the default password mode, support was dropped for caching -of the plain text password. This means that when the registry parameter is changed -to re-enable use of plain text passwords it appears to work, but when a dropped -service connection mapping attempts to revalidate it will fail if the remote -authentication server does not support encrypted passwords. This means that it -is definitely not a good idea to re-enable plain text password support in such clients. -

    -The following parameters can be used to work around the issue of Windows 9x client -upper casing usernames and password before transmitting them to the SMB server -when using clear text authentication. -

    -	passsword level = integer
-	username level = integer
-

    -By default Samba will lower case the username before attempting to lookup the user -in the database of local system accounts. Because UNIX usernames conventionally -only contain lower case character, the username level parameter -is rarely needed. -

    -However, passwords on UNIX systems often make use of mixed case characters. -This means that in order for a user on a Windows 9x client to connect to a Samba -server using clear text authentication, the password level -must be set to the maximum number of upper case letter which could -appear is a password. Note that the server OS uses the traditional DES version -of crypt(), a password level of 8 will result in case -insensitive passwords as seen from Windows users. This will also result in longer -login times as Samba has to compute the permutations of the password string and -try them one by one until a match is located (or all combinations fail). -

    -The best option to adopt is to enable support for encrypted passwords -where ever Samba is used. There are three configuration possibilities -for support of encrypted passwords: -

    Use MS Windows NT as an authentication server

    -This method involves the additions of the following parameters in the smb.conf file: -

    -	encrypt passwords = Yes
-	security = server
-	password server = "NetBIOS_name_of_PDC"
-

    -There are two ways of identifying whether or not a username and -password pair was valid or not. One uses the reply information provided -as part of the authentication messaging process, the other uses -just an error code. -

    -The down-side of this mode of configuration is the fact that -for security reasons Samba will send the password server a bogus -username and a bogus password and if the remote server fails to -reject the username and password pair then an alternative mode -of identification of validation is used. Where a site uses password -lock out after a certain number of failed authentication attempts -this will result in user lockouts. -

    -Use of this mode of authentication does require there to be -a standard Unix account for the user, this account can be blocked -to prevent logons by other than MS Windows clients. -

    Domain Level Security

    -When samba is operating in security = domain mode this means that -the Samba server has a domain security trust account (a machine account) and will cause -all authentication requests to be passed through to the domain controllers. -

    Samba as a member of an MS Windows NT security domain

    -This method involves addition of the following parameters in the smb.conf file: -

    -	encrypt passwords = Yes
-	security = domain
-	workgroup = "name of NT domain"
-	password server = *
-

    -The use of the "*" argument to password server will cause samba to locate the -domain controller in a way analogous to the way this is done within MS Windows NT. -This is the default behaviour. -

    -In order for this method to work the Samba server needs to join the -MS Windows NT security domain. This is done as follows: -

    • On the MS Windows NT domain controller using - the Server Manager add a machine account for the Samba server. -

    • Next, on the Linux system execute: - smbpasswd -r PDC_NAME -j DOMAIN_NAME (samba 2.x) - - net join -U administrator%password (samba-3) -

    -Use of this mode of authentication does require there to be a standard Unix account -for the user in order to assign a uid once the account has been authenticated by -the remote Windows DC. This account can be blocked to prevent logons by clients other than -MS Windows through things such as setting an invalid shell in the -/etc/passwd entry. -

    -An alternative to assigning UIDs to Windows users on a Samba member server is -presented in the Winbind Overview chapter -in this HOWTO collection. -

    ADS Level Security

    -For information about the configuration option please refer to the entire section entitled -Samba as an ADS Domain Member. -

    Prev Up Next
    Chapter 3. Nomenclature of Server Types Home Chapter 5.  -Samba as an NT4 or Win2k Primary Domain Controller -
    diff --git a/docs/htmldocs/servertype.html b/docs/htmldocs/servertype.html deleted file mode 100644 index 42a7604797..0000000000 --- a/docs/htmldocs/servertype.html +++ /dev/null @@ -1,368 +0,0 @@ - -Nomenclature of Server Types
    SAMBA Project Documentation
    PrevNext

    Chapter 5. Nomenclature of Server Types

    Adminstrators of Microsoft networks often refer to there being three -different type of servers:

    • Stand Alone Server

    • Domain Member Server

    • Domain Controller

      • Primary Domain Controller

      • Backup Domain Controller

      • ADS Domain Controller

    A network administrator who is familiar with these terms and who -wishes to migrate to or use Samba will want to know what these terms mean -within a Samba context.

    5.1. Stand Alone Server

    The term stand alone server means that the server -will provide local authentication and access control for all resources -that are available from it. In general this means that there will be a -local user database. In more technical terms, it means that resources -on the machine will either be made available in either SHARE mode or in -USER mode. SHARE mode and USER mode security are documented under -discussions regarding "security mode". The smb.conf configuration parameters -that control security mode are: "security = user" and "security = share".

    No special action is needed other than to create user accounts. Stand-alone -servers do NOT provide network logon services, meaning that machines that -use this server do NOT perform a domain logon but instead make use only of -the MS Windows logon which is local to the MS Windows workstation/server.

    Samba tends to blur the distinction a little in respect of what is -a stand alone server. This is because the authentication database may be -local or on a remote server, even if from the samba protocol perspective -the samba server is NOT a member of a domain security context.

    Through the use of PAM (Pluggable Authentication Modules) and nsswitch -(the name service switcher) the source of authentication may reside on -another server. We would be inclined to call this the authentication server. -This means that the samba server may use the local Unix/Linux system -password database (/etc/passwd or /etc/shadow), may use a local smbpasswd -file (/etc/samba/smbpasswd or /usr/local/samba/lib/private/smbpasswd), or -may use an LDAP back end, or even via PAM and Winbind another CIFS/SMB -server for authentication.

    5.2. Domain Member Server

    This mode of server operation involves the samba machine being made a member -of a domain security context. This means by definition that all user authentication -will be done from a centrally defined authentication regime. The authentication -regime may come from an NT3/4 style (old domain technology) server, or it may be -provided from an Active Directory server (ADS) running on MS Windows 2000 or later.

    Of course it should be clear that the authentication back end itself could be from any -distributed directory architecture server that is supported by Samba. This can be -LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory Server, etc.

    Please refer to the section on Howto configure Samba as a Primary Domain Controller -and for more information regarding how to create a domain machine account for a -domain member server as well as for information regading how to enable the samba -domain member machine to join the domain and to be fully trusted by it.

    5.3. Domain Controller

    Over the years public perceptions of what Domain Control really is has taken on an -almost mystical nature. Before we branch into a brief overview of what Domain Control -is the following types of controller are known:

    5.3.1. Domain Controller Types

    Primary Domain Controller
    Backup Domain Controller
    ADS Domain Controller

    The Primary Domain Controller or PDC plays an important role in the MS -Windows NT3 and NT4 Domain Control architecture, but not in the manner that so many -expect. The PDC seeds the Domain Control database (a part of the Windows registry) and -it plays a key part in synchronisation of the domain authentication database.

    New to Samba-3.0.0 is the ability to use a back-end file that holds the same type of data as -the NT4 style SAM (Security Account Manager) database (one of the registry files). -The samba-3.0.0 SAM can be specified via the smb.conf file parameter "passwd backend" and -valid options include smbpasswd tdbsam ldapsam nisplussam plugin unixsam. -The smbpasswd, tdbsam and ldapsam options can have a "_nua" suffix to indicate that No Unix -Accounts need to be created. In other words, the Samba SAM will be independant of Unix/Linux -system accounts, provided a uid range is defined from which SAM accounts can be created.

    The Backup Domain Controller or BDC plays a key role in servicing network -authentication requests. The BDC is biased to answer logon requests so that on a network segment -that has a BDC and a PDC the BDC will be most likely to service network logon requests. The PDC will -answer network logon requests when the BDC is too busy (high load). A BDC can be promoted to -a PDC. If the PDC is on line at the time that the BDC is promoted to PDC the previous PDC is -automatically demoted to a BDC.

    At this time Samba is NOT capable of acting as an ADS Domain Controller.

    PrevHomeNext
    Type of installationUpSamba as Stand-Alone Server
    \ No newline at end of file diff --git a/docs/htmldocs/swat.html b/docs/htmldocs/swat.html deleted file mode 100644 index e70fac5403..0000000000 --- a/docs/htmldocs/swat.html +++ /dev/null @@ -1,233 +0,0 @@ - -SWAT - The Samba Web Admininistration Tool
    SAMBA Project Documentation
    PrevNext

    Chapter 31. SWAT - The Samba Web Admininistration Tool

    This is a rough guide to SWAT.

    31.1. SWAT Features and Benefits

    You must use at least the following ...

    31.1.2. Global Settings

    Document steps right here!

    31.1.3. The SWAT Wizard

    Lots of blah blah here.

    31.1.4. Share Settings

    Document steps right here!

    31.1.5. Printing Settings

    Document steps right here!

    31.1.6. The Status Page

    Document steps right here!

    31.1.7. The Password Change Page

    Document steps right here!

    PrevHomeNext
    Samba and other CIFS clientsUpSamba performance issues
    \ No newline at end of file diff --git a/docs/htmldocs/unix-permissions.html b/docs/htmldocs/unix-permissions.html deleted file mode 100644 index e9a3b5e671..0000000000 --- a/docs/htmldocs/unix-permissions.html +++ /dev/null @@ -1,194 +0,0 @@ - -Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists
    Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists
    Prev Part III. Advanced Configuration Next

    Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists

    Jeremy Allison

    Samba Team

    <jra@samba.org>

    12 Apr 1999

    Table of Contents

    Viewing and changing UNIX permissions using the NT - security dialogs
    How to view file security on a Samba share
    Viewing file ownership
    Viewing file or directory permissions
    File Permissions
    Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute - mapping

    Viewing and changing UNIX permissions using the NT - security dialogs

    Windows NT clients can use their native security settings - dialog box to view and modify the underlying UNIX permissions.

    Note that this ability is careful not to compromise - the security of the UNIX host Samba is running on, and - still obeys all the file permission rules that a Samba - administrator can set.

    Note

    - All access to Unix/Linux system file via Samba is controlled at - the operating system file access control level. When trying to - figure out file access problems it is vitally important to identify - the identity of the Windows user as it is presented by Samba at - the point of file access. This can best be determined from the - Samba log files. -

    How to view file security on a Samba share

    From an NT4/2000/XP client, single-click with the right - mouse button on any file or directory in a Samba mounted - drive letter or UNC path. When the menu pops-up, click - on the Properties entry at the bottom of - the menu. This brings up the file properties dialog - box. Click on the tab Security and you - will see three buttons, Permissions, - Auditing, and Ownership. - The Auditing button will cause either - an error message A requested privilege is not held - by the client to appear if the user is not the - NT Administrator, or a dialog which is intended to allow an - Administrator to add auditing requirements to a file if the - user is logged on as the NT Administrator. This dialog is - non-functional with a Samba share at this time, as the only - useful button, the Add button will not currently - allow a list of users to be seen.

    Viewing file ownership

    Clicking on the "Ownership" button - brings up a dialog box telling you who owns the given file. The - owner name will be of the form :

    "SERVER\user (Long name)"

    Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database). Click on the Close - button to remove this dialog.

    If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone".

    The Take Ownership button will not allow - you to change the ownership of this file to yourself (clicking on - it will display a dialog box complaining that the user you are - currently logged onto the NT client cannot be found). The reason - for this is that changing the ownership of a file is a privileged - operation in UNIX, available only to the root - user. As clicking on this button causes NT to attempt to change - the ownership of a file to the current user logged into the NT - client this will not work with Samba at this time.

    There is an NT chown command that will work with Samba - and allow a user with Administrator privilege connected - to a Samba server as root to change the ownership of - files on both a local NTFS filesystem or remote mounted NTFS - or Samba drive. This is available as part of the Seclib - NT security library written by Jeremy Allison of - the Samba Team, available from the main Samba ftp site.

    Viewing file or directory permissions

    The third button is the "Permissions" - button. Clicking on this brings up a dialog box that shows both - the permissions and the UNIX owner of the file or directory. - The owner is displayed in the form :

    "SERVER\user (Long name)"

    Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database).

    If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone" and the - permissions will be shown as NT "Full Control".

    The permissions field is displayed differently for files - and directories, so I'll describe the way file permissions - are displayed first.

    File Permissions

    The standard UNIX user/group/world triple and - the corresponding "read", "write", "execute" permissions - triples are mapped by Samba into a three element NT ACL - with the 'r', 'w', and 'x' bits mapped into the corresponding - NT permissions. The UNIX world permissions are mapped into - the global NT group Everyone, followed - by the list of permissions allowed for UNIX world. The UNIX - owner and group permissions are displayed as an NT - user icon and an NT local - group icon respectively followed by the list - of permissions allowed for the UNIX user and group.

    As many UNIX permission sets don't map into common - NT names such as "read", - "change" or "full control" then - usually the permissions will be prefixed by the words - "Special Access" in the NT display list.

    But what happens if the file has no permissions allowed - for a particular UNIX user group or world component ? In order - to allow "no permissions" to be seen and modified then Samba - overloads the NT "Take Ownership" ACL attribute - (which has no meaning in UNIX) and reports a component with - no permissions as having the NT "O" bit set. - This was chosen of course to make it look like a zero, meaning - zero permissions. More details on the decision behind this will - be given below.

    Directory Permissions

    Directories on an NT NTFS file system have two - different sets of permissions. The first set of permissions - is the ACL set on the directory itself, this is usually displayed - in the first set of parentheses in the normal "RW" - NT style. This first set of permissions is created by Samba in - exactly the same way as normal file permissions are, described - above, and is displayed in the same way.

    The second set of directory permissions has no real meaning - in the UNIX permissions world and represents the - "inherited" permissions that any file created within - this directory would inherit.

    Samba synthesises these inherited permissions for NT by - returning as an NT ACL the UNIX permission mode that a new file - created by Samba on this share would receive.

    Modifying file or directory permissions

    Modifying file and directory permissions is as simple - as changing the displayed permissions in the dialog box, and - clicking the OK button. However, there are - limitations that a user needs to be aware of, and also interactions - with the standard Samba permission masks and mapping of DOS - attributes that need to also be taken into account.

    If the parameter nt acl support - is set to false then any attempt to set - security permissions will fail with an "Access Denied" - message.

    The first thing to note is that the "Add" - button will not return a list of users in Samba (it will give - an error message of "The remote procedure call failed - and did not execute"). This means that you can only - manipulate the current user/group/world permissions listed in - the dialog box. This actually works quite well as these are the - only permissions that UNIX actually has.

    If a permission triple (either user, group, or world) - is removed from the list of permissions in the NT dialog box, - then when the "OK" button is pressed it will - be applied as "no permissions" on the UNIX side. If you then - view the permissions again the "no permissions" entry will appear - as the NT "O" flag, as described above. This - allows you to add permissions back to a file or directory once - you have removed them from a triple component.

    As UNIX supports only the "r", "w" and "x" bits of - an NT ACL then if other NT security attributes such as "Delete - access" are selected then they will be ignored when applied on - the Samba server.

    When setting permissions on a directory the second - set of permissions (in the second set of parentheses) is - by default applied to all files within that directory. If this - is not what you want you must uncheck the "Replace - permissions on existing files" checkbox in the NT - dialog before clicking "OK".

    If you wish to remove all permissions from a - user/group/world component then you may either highlight the - component and click the "Remove" button, - or set the component to only have the special "Take - Ownership" permission (displayed as "O" - ) highlighted.

    Interaction with the standard Samba create mask - parameters

    There are four parameters - to control interaction with the standard Samba create mask parameters. - These are :

    security mask

    force security mode

    directory security mask

    force directory security mode

    Once a user clicks "OK" to apply the - permissions Samba maps the given permissions into a user/group/world - r/w/x triple set, and then will check the changed permissions for a - file against the bits set in the - security mask parameter. Any bits that - were changed that are not set to '1' in this parameter are left alone - in the file permissions.

    Essentially, zero bits in the security mask - mask may be treated as a set of bits the user is not - allowed to change, and one bits are those the user is allowed to change. -

    If not set explicitly this parameter is set to the same value as - the create mask - parameter. To allow a user to modify all the - user/group/world permissions on a file, set this parameter - to 0777.

    Next Samba checks the changed permissions for a file against - the bits set in the - force security mode parameter. Any bits - that were changed that correspond to bits set to '1' in this parameter - are forced to be set.

    Essentially, bits set in the force security mode - parameter may be treated as a set of bits that, when - modifying security on a file, the user has always set to be 'on'.

    If not set explicitly this parameter is set to the same value - as the force - create mode parameter. - To allow a user to modify all the user/group/world permissions on a file - with no restrictions set this parameter to 000.

    The security mask and force - security mode parameters are applied to the change - request in that order.

    For a directory Samba will perform the same operations as - described above for a file except using the parameter - directory security mask instead of security - mask, and force directory security mode - parameter instead of force security mode - .

    The directory security mask parameter - by default is set to the same value as the directory mask - parameter and the force directory security - mode parameter by default is set to the same value as - the force directory mode parameter.

    In this way Samba enforces the permission restrictions that - an administrator can set on a Samba share, whilst still allowing users - to modify the permission bits within that restriction.

    If you want to set up a share that allows users full control - in modifying the permission bits on their files and directories and - doesn't force any particular bits to be set 'on', then set the following - parameters in the smb.conf file in that share specific section :

    security mask = 0777

    force security mode = 0

    directory security mask = 0777

    force directory security mode = 0

    Interaction with the standard Samba file attribute - mapping

    Samba maps some of the DOS attribute bits (such as "read - only") into the UNIX permissions of a file. This means there can - be a conflict between the permission bits set via the security - dialog and the permission bits set by the file attribute mapping. -

    One way this can show up is if a file has no UNIX read access - for the owner it will show up as "read only" in the standard - file attributes tabbed dialog. Unfortunately this dialog is - the same one that contains the security info in another tab.

    What this can mean is that if the owner changes the permissions - to allow themselves read access using the security dialog, clicks - "OK" to get back to the standard attributes tab - dialog, and then clicks "OK" on that dialog, then - NT will set the file permissions back to read-only (as that is what - the attributes still say in the dialog). This means that after setting - permissions and clicking "OK" to get back to the - attributes dialog you should always hit "Cancel" - rather than "OK" to ensure that your changes - are not overridden.

    Prev Up Next
    Chapter 10. User information database Home Chapter 12. Configuring Group Mapping
    diff --git a/docs/htmldocs/vfs.html b/docs/htmldocs/vfs.html deleted file mode 100644 index fcaca133fe..0000000000 --- a/docs/htmldocs/vfs.html +++ /dev/null @@ -1,490 +0,0 @@ - -Stackable VFS modules
    SAMBA Project Documentation
    PrevNext

    Chapter 21. Stackable VFS modules

    Table of Contents
    21.1. Introduction and configuration
    21.2. Included modules
    21.2.1. audit
    21.2.2. extd_audit
    21.2.3. recycle
    21.2.4. netatalk
    21.3. VFS modules available elsewhere
    21.3.1. DatabaseFS
    21.3.2. vscan

    21.1. Introduction and configuration

    Since samba 3.0, samba supports stackable VFS(Virtual File System) modules. -Samba passes each request to access the unix file system thru the loaded VFS modules. -This chapter covers all the modules that come with the samba source and references to -some external modules.

    You may have problems to compile these modules, as shared libraries are -compiled and linked in different ways on different systems. -They currently have been tested against GNU/linux and IRIX.

    To use the VFS modules, create a share similar to the one below. The -important parameter is the vfs object parameter which must point to -the exact pathname of the shared library objects. For example, to log all access -to files and use a recycle bin: - -

           [audit]
-                comment = Audited /data directory
-                path = /data
-                vfs object = /path/to/audit.so /path/to/recycle.so
-                writeable = yes
-                browseable = yes

    The modules are used in the order they are specified.

    Further documentation on writing VFS modules for Samba can be found in -the Samba Developers Guide.

    21.2. Included modules

    21.2.1. audit

    A simple module to audit file access to the syslog -facility. The following operations are logged: -

    share
    connect/disconnect
    directory opens/create/remove
    file open/close/rename/unlink/chmod

    21.2.2. extd_audit

    This module is identical with the audit module above except -that it sends audit logs to both syslog as well as the smbd log file/s. The -loglevel for this module is set in the smb.conf file. At loglevel = 0, only file -and directory deletions and directory and file creations are logged. At loglevel = 1 -file opens are renames and permission changes are logged , while at loglevel = 2 file -open and close calls are logged also.

    21.2.3. recycle

    A recycle-bin like modules. When used any unlink call -will be intercepted and files moved to the recycle -directory instead of beeing deleted.

    Supported options: -

    vfs_recycle_bin:repository

    FIXME

    vfs_recycle_bin:keeptree

    FIXME

    vfs_recycle_bin:versions

    FIXME

    vfs_recycle_bin:touch

    FIXME

    vfs_recycle_bin:maxsize

    FIXME

    vfs_recycle_bin:exclude

    FIXME

    vfs_recycle_bin:exclude_dir

    FIXME

    vfs_recycle_bin:noversions

    FIXME

    21.2.4. netatalk

    A netatalk module, that will ease co-existence of samba and -netatalk file sharing services.

    Advantages compared to the old netatalk module: -

    it doesn't care about creating of .AppleDouble forks, just keeps ones in sync
    if share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically

    21.3. VFS modules available elsewhere

    This section contains a listing of various other VFS modules that -have been posted but don't currently reside in the Samba CVS -tree for one reason ot another (e.g. it is easy for the maintainer -to have his or her own CVS tree).

    No statemets about the stability or functionality any module -should be implied due to its presence here.

    21.3.1. DatabaseFS

    URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php

    By Eric Lorimer.

    I have created a VFS module which implements a fairly complete read-only -filesystem. It presents information from a database as a filesystem in -a modular and generic way to allow different databases to be used -(originally designed for organizing MP3s under directories such as -"Artists," "Song Keywords," etc... I have since applied it to a student -roster database very easily). The directory structure is stored in the -database itself and the module makes no assumptions about the database -structure beyond the table it requires to run.

    Any feedback would be appreciated: comments, suggestions, patches, -etc... If nothing else, hopefully it might prove useful for someone -else who wishes to create a virtual filesystem.

    21.3.2. vscan

    URL: http://www.openantivirus.org/

    samba-vscan is a proof-of-concept module for Samba, which -uses the VFS (virtual file system) features of Samba 2.2.x/3.0 -alphaX. Of couse, Samba has to be compiled with VFS support. -samba-vscan supports various virus scanners and is maintained -by Rainer Link.

    PrevHomeNext
    PAM Configuration for Centrally Managed AuthenticationUpHosting a Microsoft Distributed File System tree on Samba
    \ No newline at end of file diff --git a/docs/textdocs/README.NOW b/docs/textdocs/README.NOW deleted file mode 100644 index dda607097b..0000000000 --- a/docs/textdocs/README.NOW +++ /dev/null @@ -1,6 +0,0 @@ -All old text documents have been converted to docbook. -To create ASCII versions of the official documentation -run the following command in ../docbook/: - - $ make txt - diff --git a/docs/textdocs/README.jis b/docs/textdocs/README.jis deleted file mode 100644 index 50ff0cced7..0000000000 --- a/docs/textdocs/README.jis +++ /dev/null @@ -1,149 +0,0 @@ -$B!|(B samba $BF|K\8lBP1~$K$D$$$F(B - -1. $BL\E*(B - - $BF|K\8lBP1~$O!"(B - - (1) MS-Windows $B>e$G!"4A;z%U%!%$%kL>$r$I$&$7$F$b07$&I,MW$N$"$k%"%W%j%1!<%7%g%s$,$A$c(B - $B$s$HF0:n$9$k!#Nc$($P!"(BMS-WORD 5 $B$J$I$O!"%$%s%9%H!<%k;~$K4A;z$N%U%!%$%kL>$r>!l9g$K$A$c$s$HBP1~$G$-$k$h$&$K$9$k!#(B - - (2) UNIX $B$O!":G6a$G$O$[$H$s$I$N$b$N$,(B 8 bits $B$N%U%!%$%kL>$r%5%]!<%H$7$F$$$^$9$,!"(B - $BCf$K$O!"$3$l$r%5%]!<%H$7$F$$$J$$$b$N$b$"$j$^$9!#$3$N$h$&$J>l9g$G$b!"(B(1)$B$NL\E*(B - $B$,K~B-$G$-$k$h$&$K$9$k!#(B - - $B$rL\E*$H$7$F$$$^$9!#$=$N$?$a!"F|K\8lBP1~$O!"I,MW:G>.8B$7$+9T$J$C$F$*$j$^$;$s!#(B - - $BF|K\8lBP1~$7$?(B samba $B$rMxMQ$9$k$?$a$K$O!"%3%s%Q%$%k$9$k;~$K!"I,$:!"(BKANJI $B$NDj5A$rDI(B - $B2C$7$F$/$@$5$$!#$3$N%*%W%7%g%s$r;XDj$7$F$$$J$$>l9g$O!"F|K\8l$N%U%!%$%kL>$r@5$7$/07(B - $B$&$3$H$O$G$-$^$;$s!#!J%3%s%Q%$%k$K$D$$$F$O!"2<5-(B 3. $B$r;2>H$7$F2<$5$$!K(B - -2. $BMxMQJ}K!(B - -(1) $BDI2C$7$?%Q%i%a!<%?(B - - smb.conf $B%U%!%$%k$N(B global $B%;%/%7%g%s$K0J2<$N%Q%i%a!<%?$r@_Dj$G$-$k$h$&$K$7$^$7$?!#(B - - [global] - .... - coding system = <$B%3!<%I7O(B> - - $B$3$3$G;XDj$5$l$?%3!<%I7O$,(B UNIX $B>e$N%U%!%$%k%7%9%F%`$N%U%!%$%kL>$N%3!<%I$K$J$j$^$9!#(B - $B@_Dj$G$-$k$b$N$O!"A0$O!"(B':83:49:83:74:83:42:83:58' $B$N$h$&$K!"(B':' $B$N8e$K#27e(B - $B$N(B16$B?J?t$rB3$1$k7A<0$K$J$j$^$9!#(B - $B$3$3$G!"(B':' $B$rB>$NJ8;z$KJQ99$7$?$$>l9g$O!"(Bhex $B$N8e$m$K$=$NJ8;z$r;XDj$7$^$9!#(B - $BNc$($P!"(B@$B$rJQ$o$j$K;H$$$?$$>l9g$O!"(B'hex@'$B$N$h$&$K;XDj$7$^$9!#(B - cap: 7 bits $B$N(B ASCII $B%3!<%I0J30$N%3!<%I$r0J2<$N7A<0$GI=$9J}<0$H$$$&E@$G$O(B - hex$B$HF1MM$G$9$,!"(BCAP (The Columbia AppleTalk Package)$B$H8_49@-$r;}$DJQ49(B - $BJ}<0$H$J$C$F$$$^$9!#(Bhex$B$H$N0c$$$O(B0x80$B0J>e$N%3!<%I$N$_(B':80'$B$N$h$&$KJQ49(B - $B$5$l!"$=$NB>$O(BASCII$B%3!<%I$G8=$5$l$^$9!#(B - $BNc$($P!"(B'$B%*%U%#%9(B'$B$H$$$&L>A0$O!"(B':83I:83t:83B:83X'$B$H$J$j$^$9!#(B - - JIS $B%3!<%I$K$D$$$F$O!"0J2<$NI=$r;2>H$7$F2<$5$$!#(B - $B(#(!(!(!(((!(!(!(!(((!(!(!(!(((!(!(!(!(((!(!(!(!(((!(!(!(!(((!(!(!(!(!(!(!(!(!($(B - $B(";XDj(B $B("4A;z3+;O("4A;z=*N;("%+%J3+;O("%+%J=*N;("1Q?t3+;O("Hw9M(B $B("(B - $B('(!(!(!(+(!(!(!(!(+(!(!(!(!(+(!(!(!(!(+(!(!(!(!(+(!(!(!(!(+(!(!(!(!(!(!(!(!(!()(B - $B("(Bjis7 $B("(B\E$B $B("(B\E(J $B("(B0x0e $B("(B0x0f $B("(B\E(J $B("(Bjis 7$BC10LId9f(B $B("(B - $B("(Bjunet $B("(B\E$B $B("(B\E(J $B("(B\E(I $B("(B\E(J $B("(B\E(J $B("(B7bits $B%3!<%I(B $B("(B - $B("(Bjis8 $B("(B\E$B $B("(B\E(J $B("(B-- $B("(B-- $B("(B\E(J $B("(Bjis 8$BC10LId9f(B $B("(B - $B("(Bj7bb $B("(B\E$B $B("(B\E(B $B("(B0x0e $B("(B0x0f $B("(B\E(B $B("(B $B("(B - $B("(Bj7bj $B("(B\E$B $B("(B\E(J $B("(B0x0e $B("(B0x0f $B("(B\E(J $B("(Bjis7$B$HF1$8(B $B("(B - $B("(Bj7bh $B("(B\E$B $B("(B\E(H $B("(B0x0e $B("(B0x0f $B("(B\E(H $B("(B $B("(B - $B("(Bj7@b $B("(B\E$@ $B("(B\E(B $B("(B0x0e $B("(B0x0f $B("(B\E(B $B("(B $B("(B - $B("(Bj7@j $B("(B\E$@ $B("(B\E(J $B("(B0x0e $B("(B0x0f $B("(B\E(J $B("(B $B("(B - $B("(Bj7@h $B("(B\E$@ $B("(B\E(H $B("(B0x0e $B("(B0x0f $B("(B\E(H $B("(B $B("(B - $B("(Bj8bb $B("(B\E$B $B("(B\E(B $B("(B-- $B("(B-- $B("(B\E(B $B("(B $B("(B - $B("(Bj8bj $B("(B\E$B $B("(B\E(J $B("(B-- $B("(B-- $B("(B\E(J $B("(Bjis8$B$HF1$8(B $B("(B - $B("(Bj8bh $B("(B\E$B $B("(B\E(H $B("(B-- $B("(B-- $B("(B\E(H $B("(B $B("(B - $B("(Bj8@b $B("(B\E@@ $B("(B\E(B $B("(B-- $B("(B-- $B("(B\E(B $B("(B $B("(B - $B("(Bj8@j $B("(B\E$@ $B("(B\E(J $B("(B-- $B("(B-- $B("(B\E(J $B("(B $B("(B - $B("(Bj8@h $B("(B\E$@ $B("(B\E(H $B("(B-- $B("(B-- $B("(B\E(H $B("(B $B("(B - $B("(Bjubb $B("(B\E$B $B("(B\E(B $B("(B\E(I $B("(B\E(B $B("(B\E(B $B("(B $B("(B - $B("(Bjubj $B("(B\E$B $B("(B\E(J $B("(B\E(I $B("(B\E(J $B("(B\E(J $B("(Bjunet$B$HF1$8(B $B("(B - $B("(Bjubh $B("(B\E$B $B("(B\E(H $B("(B\E(I $B("(B\E(H $B("(B\E(H $B("(B $B("(B - $B("(Bju@b $B("(B\E$@ $B("(B\E(B $B("(B\E(I $B("(B\E(B $B("(B\E(B $B("(B $B("(B - $B("(Bju@j $B("(B\E$@ $B("(B\E(J $B("(B\E(I $B("(B\E(J $B("(B\E(J $B("(B $B("(B - $B("(Bju@h $B("(B\E$@ $B("(B\E(H $B("(B\E(I $B("(B\E(H $B("(B\E(H $B("(B $B("(B - $B(&(!(!(!(*(!(!(!(!(*(!(!(!(!(*(!(!(!(!(*(!(!(!(!(*(!(!(!(!(*(!(!(!(!(!(!(!(!(!(%(B - - $B$$$:$l$N>l9g$b!"$9$G$KB8:_$7$F$$$kL>A0$KBP$7$F$O!"4A;z$N3+;O=*N;%7!<%1%s%9$O!"0J2<(B - $B$N$b$N$rG'<1$7$^$9!#(B - $B4A;z$N;O$^$j(B: \E$B $B$+(B \E$@ - $B4A;z$N=*$j(B: \E(J $B$+(B \E(B $B$+(B \E(H - -(2) smbclient $B$N%*%W%7%g%s(B - - $B%/%i%$%"%s%H%W%m%0%i%`$G$b!"4A;z$d2>L>$r4^$s$@%U%!%$%k$r07$($k$h$&$K!" - - $B$3$3$G!"(B<$B%?!<%_%J%k%3!<%I7O(B>$B$K;XDj$G$-$k$b$N$O!">e$N(B<$B%3!<%I7O(B>$B$HF1$8$b$N$G$9!#(B - -(3) $B%G%U%)%k%H(B - - $B%G%U%)%k%H$N%3!<%I7O$O!"%3%s%Q%$%k;~$K7h$^$j$^$9!#(B - -3. $B%3%s%Q%$%k;~$N@_Dj(B - - Makefile $B$K@_Dj$9$k9`L\$r0J2<$K<($7$^$9!#(B - -(1) KANJI $B%U%i%0(B - - $B%3%s%Q%$%k%*%W%7%g%s$K(B -DKANJI=\"$B%3!<%I7O(B\" $B$r;XDj$7$^$9!#$3$N%3!<%I7O$O(B 2. $B$G;X(B - $BDj$9$k$b$N$HF1$8$G$9!#Nc$($P!"(B-DKANJI=\"euc\" $B$r(BFLAGSM $B$K@_Dj$9$k$H(B UNIX $B>e$N%U%!(B - $B%$%kL>$O!"(BEUC $B%3!<%I$K$J$j$^$9!#$3$3$G;XDj$7$?%3!<%I7O$O!"%5!<%P5Z$S%/%i%$%"%s%H(B - $B%W%m%0%i%`$N%G%U%)%k%H$KCM$J$j$^$9!#(B - - $B>0!"%*%W%7%g%sCf$N(B \ $B$d(B " $B$bK:$l$:$K;XDj$7$F2<$5$$!#(B - -3. $B@)8B;v9`(B - -(1) $B4A;z%3!<%I(B - smbd $B$rF0:n$5$;$k%[%9%H$N(B UNIX $B$,%5%]!<%H$7$F$$$J$$4A;z%3!<%I$O!"MxMQ$G$-$J$$$3$H$,(B - $B$"$j$^$9!#JQ$JF0:n$r$9$k$h$&$J$i(B hex $B$N;XDj$r$9$k$N$,NI$$$G$7$g$&!#(B - -(2) smbclient $B%3%^%s%I(B - $B%7%U%H%3!<%I$J$I$N4X78$G!"4A;z$d2>L>$r4^$s$@%U%!%$%kL>$N(B ls $B$NI=<($,Mp$l$k$3$H$,$"$j(B - $B$^$9!#(B - -(3) $B%o%$%k%I%+!<%I$K$D$$$F(B - $B$A$c$s$H$7$?%9%Z%C%/$,$h$/$o$+$i$J$+$C$?$N$G$9$,!"0l1~!"(BDOS/V $B$NF0:n$HF1$8F0:n$r9T$J(B - $B$&$h$&$K$J$C$F$$$^$9!#(B - -(4) $B%m%s%0%U%!%$%kL>$K$D$$$F(B - Windows NT/95 $B$G$O!"%m%s%0%U%!%$%kL>$,07$($^$9!#%m%s%0%U%!%$%kL>$r(B 8.3 $B%U%)!<%^%C%H(B - $B$G07$&$?$a$K!"(Bmangling $B$7$F$$$^$9$,!"$3$NJ}K!$O!"(BNT $B$d(B 95 $B$,9T$J$C$F$$$k(B mangling $B$H(B - $B$O0[$J$j$^$9$N$GCm0U$7$F2<$5$$!#(B - -4. $B>c32Ey$N%l%]!<%H$K$D$$$F(B - - $BF|K\8l$N%U%!%$%kL>$K4X$7$F!"J8;z2=$1Ey$N>c32$,$"$l$P!";d$K%l%]!<%H$7$FD:$1$l$P9,$$$G(B -$B$9!#$?$@$7!"%*%j%8%J%k$+$i$NLdBjE@$d@\Ld$$9g$o$;$k(B -$B$+!"$b$7$/$O%a!<%j%s%0%j%9%H$J$I$X%l%]!<%H$9$k$h$&$K$7$F2<$5$$!#(B - -$B%l%]!<%H$5$l$k>l9g!"MxMQ$5$l$F$$$k4D6-(B(UNIX $B5Z$S(B PC $BB&$N(BOS$B$J$I(B)$B$H$G$-$^$7$?$i@_Dj%U%!(B -$B%$%k$d%m%0$J$I$rE:IU$7$FD:$1$k$H9,$$$G$9!#(B - -5. $B$=$NB>(B - - $B%3!<%IJQ49$O0J2<$NJ}!9$,:n$i$l$?%W%m%0%i%`$rMxMQ$7$F$$$^$9!#(B - - hex $B7A<0(B $BBgLZ!wBgDM!&C^GH(B $B;a(B - cap $B7A<0(B $BI%ED(B $BF;O:(B (michiro@po.iijnet.or.jp)(michiro@dms.toppan.co.jp)$B;a(B - - $B$=$NB>!"$?$/$5$s$NJ}!9$+$i$$$m$$$m$H8f65<($$$?$@$-$"$j$,$H$&$4$6$$$^$7$?!#:#8e$H$b$h(B -$B$m$7$/$*4j$$CW$7$^$9!#(B - -1994$BG/(B10$B7n(B28$BF|(B $BBh#1HG(B -1995$BG/(B 8$B7n(B16$BF|(B $BBh#2HG(B -1995$BG/(B11$B7n(B24$BF|(B $BBh#3HG(B -1996$BG/(B 5$B7n(B13$BF|(B $BBh#4HG(B - -$BF#ED(B $B?r(B fujita@ainix.isac.co.jp - -- cgit From 07643607a706464089bb4b5a8bd902742591b864 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 03:16:06 +0000 Subject: adding missing files from 3.0 (This used to be commit 20c57840f847e82be9880a730aea15feb29b6848) --- docs/docbook/projdoc/imagefiles/.cvsignore | 1 + docs/docbook/projdoc/imagefiles/10small.png | Bin 0 -> 46666 bytes docs/docbook/projdoc/imagefiles/11small.png | Bin 0 -> 27817 bytes docs/docbook/projdoc/imagefiles/12small.png | Bin 0 -> 29508 bytes docs/docbook/projdoc/imagefiles/13small.png | Bin 0 -> 30506 bytes docs/docbook/projdoc/imagefiles/14small.png | Bin 0 -> 56042 bytes docs/docbook/projdoc/imagefiles/1small.png | Bin 0 -> 20739 bytes docs/docbook/projdoc/imagefiles/2small.png | Bin 0 -> 15016 bytes docs/docbook/projdoc/imagefiles/3small.png | Bin 0 -> 15785 bytes docs/docbook/projdoc/imagefiles/4small.png | Bin 0 -> 22370 bytes docs/docbook/projdoc/imagefiles/5small.png | Bin 0 -> 27857 bytes docs/docbook/projdoc/imagefiles/6small.png | Bin 0 -> 32612 bytes docs/docbook/projdoc/imagefiles/7small.png | Bin 0 -> 29350 bytes docs/docbook/projdoc/imagefiles/8small.png | Bin 0 -> 45259 bytes docs/docbook/projdoc/imagefiles/9small.png | Bin 0 -> 30509 bytes docs/docbook/projdoc/imagefiles/a_small.png | Bin 0 -> 115304 bytes docs/docbook/projdoc/imagefiles/access1 | Bin 0 -> 1583 bytes docs/docbook/projdoc/imagefiles/access1.png | Bin 0 -> 9839 bytes docs/docbook/projdoc/imagefiles/browsing1 | Bin 0 -> 2974 bytes docs/docbook/projdoc/imagefiles/browsing1.png | Bin 0 -> 20288 bytes docs/docbook/projdoc/imagefiles/cups1 | Bin 0 -> 1999 bytes docs/docbook/projdoc/imagefiles/cups1.png | Bin 0 -> 38328 bytes docs/docbook/projdoc/imagefiles/cups2 | Bin 0 -> 2175 bytes docs/docbook/projdoc/imagefiles/cups2.png | Bin 0 -> 41184 bytes docs/docbook/projdoc/imagefiles/domain | Bin 0 -> 1586 bytes docs/docbook/projdoc/imagefiles/domain.png | Bin 0 -> 35745 bytes docs/docbook/projdoc/imagefiles/idmap | Bin 0 -> 1172 bytes docs/docbook/projdoc/imagefiles/idmap-gid2sid.dia | Bin 0 -> 2368 bytes docs/docbook/projdoc/imagefiles/idmap-gid2sid.png | Bin 0 -> 21240 bytes docs/docbook/projdoc/imagefiles/idmap-groups.dia | Bin 0 -> 1234 bytes docs/docbook/projdoc/imagefiles/idmap-groups.png | Bin 0 -> 9175 bytes docs/docbook/projdoc/imagefiles/idmap-sid2gid.dia | Bin 0 -> 2401 bytes docs/docbook/projdoc/imagefiles/idmap-sid2gid.png | Bin 0 -> 21274 bytes docs/docbook/projdoc/imagefiles/idmap-sid2uid.dia | Bin 0 -> 2810 bytes docs/docbook/projdoc/imagefiles/idmap-sid2uid.png | Bin 0 -> 26948 bytes .../projdoc/imagefiles/idmap-store-gid2sid.dia | Bin 0 -> 1401 bytes .../projdoc/imagefiles/idmap-store-gid2sid.png | Bin 0 -> 6795 bytes docs/docbook/projdoc/imagefiles/idmap-uid2sid.dia | Bin 0 -> 2843 bytes docs/docbook/projdoc/imagefiles/idmap-uid2sid.png | Bin 0 -> 23928 bytes docs/docbook/projdoc/imagefiles/idmap.png | Bin 0 -> 8542 bytes .../projdoc/imagefiles/idmap_winbind_no_loop.png | Bin 0 -> 9172 bytes docs/docbook/projdoc/imagefiles/pdftoepsonusb | Bin 0 -> 1148 bytes docs/docbook/projdoc/imagefiles/pdftoepsonusb.png | Bin 0 -> 4265 bytes docs/docbook/projdoc/imagefiles/pdftosocket | Bin 0 -> 893 bytes docs/docbook/projdoc/imagefiles/pdftosocket.png | Bin 0 -> 2138 bytes docs/docbook/projdoc/imagefiles/trusts1 | Bin 0 -> 1274 bytes docs/docbook/projdoc/imagefiles/trusts1.png | Bin 0 -> 12716 bytes docs/docbook/scripts/find_missing_doc.pl | 57 +++++++++++++++++++++ 48 files changed, 58 insertions(+) create mode 100644 docs/docbook/projdoc/imagefiles/.cvsignore create mode 100644 docs/docbook/projdoc/imagefiles/10small.png create mode 100644 docs/docbook/projdoc/imagefiles/11small.png create mode 100644 docs/docbook/projdoc/imagefiles/12small.png create mode 100644 docs/docbook/projdoc/imagefiles/13small.png create mode 100644 docs/docbook/projdoc/imagefiles/14small.png create mode 100644 docs/docbook/projdoc/imagefiles/1small.png create mode 100644 docs/docbook/projdoc/imagefiles/2small.png create mode 100644 docs/docbook/projdoc/imagefiles/3small.png create mode 100644 docs/docbook/projdoc/imagefiles/4small.png create mode 100644 docs/docbook/projdoc/imagefiles/5small.png create mode 100644 docs/docbook/projdoc/imagefiles/6small.png create mode 100644 docs/docbook/projdoc/imagefiles/7small.png create mode 100644 docs/docbook/projdoc/imagefiles/8small.png create mode 100644 docs/docbook/projdoc/imagefiles/9small.png create mode 100644 docs/docbook/projdoc/imagefiles/a_small.png create mode 100644 docs/docbook/projdoc/imagefiles/access1 create mode 100644 docs/docbook/projdoc/imagefiles/access1.png create mode 100644 docs/docbook/projdoc/imagefiles/browsing1 create mode 100644 docs/docbook/projdoc/imagefiles/browsing1.png create mode 100644 docs/docbook/projdoc/imagefiles/cups1 create mode 100644 docs/docbook/projdoc/imagefiles/cups1.png create mode 100644 docs/docbook/projdoc/imagefiles/cups2 create mode 100644 docs/docbook/projdoc/imagefiles/cups2.png create mode 100644 docs/docbook/projdoc/imagefiles/domain create mode 100644 docs/docbook/projdoc/imagefiles/domain.png create mode 100644 docs/docbook/projdoc/imagefiles/idmap create mode 100644 docs/docbook/projdoc/imagefiles/idmap-gid2sid.dia create mode 100644 docs/docbook/projdoc/imagefiles/idmap-gid2sid.png create mode 100755 docs/docbook/projdoc/imagefiles/idmap-groups.dia create mode 100755 docs/docbook/projdoc/imagefiles/idmap-groups.png create mode 100644 docs/docbook/projdoc/imagefiles/idmap-sid2gid.dia create mode 100644 docs/docbook/projdoc/imagefiles/idmap-sid2gid.png create mode 100644 docs/docbook/projdoc/imagefiles/idmap-sid2uid.dia create mode 100644 docs/docbook/projdoc/imagefiles/idmap-sid2uid.png create mode 100644 docs/docbook/projdoc/imagefiles/idmap-store-gid2sid.dia create mode 100644 docs/docbook/projdoc/imagefiles/idmap-store-gid2sid.png create mode 100644 docs/docbook/projdoc/imagefiles/idmap-uid2sid.dia create mode 100644 docs/docbook/projdoc/imagefiles/idmap-uid2sid.png create mode 100644 docs/docbook/projdoc/imagefiles/idmap.png create mode 100755 docs/docbook/projdoc/imagefiles/idmap_winbind_no_loop.png create mode 100644 docs/docbook/projdoc/imagefiles/pdftoepsonusb create mode 100644 docs/docbook/projdoc/imagefiles/pdftoepsonusb.png create mode 100644 docs/docbook/projdoc/imagefiles/pdftosocket create mode 100644 docs/docbook/projdoc/imagefiles/pdftosocket.png create mode 100644 docs/docbook/projdoc/imagefiles/trusts1 create mode 100644 docs/docbook/projdoc/imagefiles/trusts1.png create mode 100755 docs/docbook/scripts/find_missing_doc.pl diff --git a/docs/docbook/projdoc/imagefiles/.cvsignore b/docs/docbook/projdoc/imagefiles/.cvsignore new file mode 100644 index 0000000000..f7b5423899 --- /dev/null +++ b/docs/docbook/projdoc/imagefiles/.cvsignore @@ -0,0 +1 @@ +*.eps diff --git a/docs/docbook/projdoc/imagefiles/10small.png b/docs/docbook/projdoc/imagefiles/10small.png new file mode 100644 index 0000000000..56a9b0cd67 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/10small.png differ diff --git a/docs/docbook/projdoc/imagefiles/11small.png b/docs/docbook/projdoc/imagefiles/11small.png new file mode 100644 index 0000000000..18f5d9e4dd Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/11small.png differ diff --git a/docs/docbook/projdoc/imagefiles/12small.png b/docs/docbook/projdoc/imagefiles/12small.png new file mode 100644 index 0000000000..5bdf809c1b Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/12small.png differ diff --git a/docs/docbook/projdoc/imagefiles/13small.png b/docs/docbook/projdoc/imagefiles/13small.png new file mode 100644 index 0000000000..536b2fc2c2 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/13small.png differ diff --git a/docs/docbook/projdoc/imagefiles/14small.png b/docs/docbook/projdoc/imagefiles/14small.png new file mode 100644 index 0000000000..89054249c0 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/14small.png differ diff --git a/docs/docbook/projdoc/imagefiles/1small.png b/docs/docbook/projdoc/imagefiles/1small.png new file mode 100644 index 0000000000..c4905163c9 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/1small.png differ diff --git a/docs/docbook/projdoc/imagefiles/2small.png b/docs/docbook/projdoc/imagefiles/2small.png new file mode 100644 index 0000000000..5fd9071349 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/2small.png differ diff --git a/docs/docbook/projdoc/imagefiles/3small.png b/docs/docbook/projdoc/imagefiles/3small.png new file mode 100644 index 0000000000..22a39bae52 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/3small.png differ diff --git a/docs/docbook/projdoc/imagefiles/4small.png b/docs/docbook/projdoc/imagefiles/4small.png new file mode 100644 index 0000000000..6b7f1b1fd4 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/4small.png differ diff --git a/docs/docbook/projdoc/imagefiles/5small.png b/docs/docbook/projdoc/imagefiles/5small.png new file mode 100644 index 0000000000..b23e1fc2c7 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/5small.png differ diff --git a/docs/docbook/projdoc/imagefiles/6small.png b/docs/docbook/projdoc/imagefiles/6small.png new file mode 100644 index 0000000000..35a646d826 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/6small.png differ diff --git a/docs/docbook/projdoc/imagefiles/7small.png b/docs/docbook/projdoc/imagefiles/7small.png new file mode 100644 index 0000000000..d182677510 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/7small.png differ diff --git a/docs/docbook/projdoc/imagefiles/8small.png b/docs/docbook/projdoc/imagefiles/8small.png new file mode 100644 index 0000000000..08aca66386 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/8small.png differ diff --git a/docs/docbook/projdoc/imagefiles/9small.png b/docs/docbook/projdoc/imagefiles/9small.png new file mode 100644 index 0000000000..90c2cde327 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/9small.png differ diff --git a/docs/docbook/projdoc/imagefiles/a_small.png b/docs/docbook/projdoc/imagefiles/a_small.png new file mode 100644 index 0000000000..a6622ef6cf Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/a_small.png differ diff --git a/docs/docbook/projdoc/imagefiles/access1 b/docs/docbook/projdoc/imagefiles/access1 new file mode 100644 index 0000000000..7fd2673800 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/access1 differ diff --git a/docs/docbook/projdoc/imagefiles/access1.png b/docs/docbook/projdoc/imagefiles/access1.png new file mode 100644 index 0000000000..0d070a6109 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/access1.png differ diff --git a/docs/docbook/projdoc/imagefiles/browsing1 b/docs/docbook/projdoc/imagefiles/browsing1 new file mode 100644 index 0000000000..8235df45f6 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/browsing1 differ diff --git a/docs/docbook/projdoc/imagefiles/browsing1.png b/docs/docbook/projdoc/imagefiles/browsing1.png new file mode 100644 index 0000000000..bfe76dcb63 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/browsing1.png differ diff --git a/docs/docbook/projdoc/imagefiles/cups1 b/docs/docbook/projdoc/imagefiles/cups1 new file mode 100644 index 0000000000..e4cd3b1239 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/cups1 differ diff --git a/docs/docbook/projdoc/imagefiles/cups1.png b/docs/docbook/projdoc/imagefiles/cups1.png new file mode 100644 index 0000000000..cbe646a5fa Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/cups1.png differ diff --git a/docs/docbook/projdoc/imagefiles/cups2 b/docs/docbook/projdoc/imagefiles/cups2 new file mode 100644 index 0000000000..9dfb60f335 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/cups2 differ diff --git a/docs/docbook/projdoc/imagefiles/cups2.png b/docs/docbook/projdoc/imagefiles/cups2.png new file mode 100644 index 0000000000..d0713c07ca Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/cups2.png differ diff --git a/docs/docbook/projdoc/imagefiles/domain b/docs/docbook/projdoc/imagefiles/domain new file mode 100644 index 0000000000..a994d423e2 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/domain differ diff --git a/docs/docbook/projdoc/imagefiles/domain.png b/docs/docbook/projdoc/imagefiles/domain.png new file mode 100644 index 0000000000..82d299b086 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/domain.png differ diff --git a/docs/docbook/projdoc/imagefiles/idmap b/docs/docbook/projdoc/imagefiles/idmap new file mode 100644 index 0000000000..555933978b Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap differ diff --git a/docs/docbook/projdoc/imagefiles/idmap-gid2sid.dia b/docs/docbook/projdoc/imagefiles/idmap-gid2sid.dia new file mode 100644 index 0000000000..b3b1d88c50 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap-gid2sid.dia differ diff --git a/docs/docbook/projdoc/imagefiles/idmap-gid2sid.png b/docs/docbook/projdoc/imagefiles/idmap-gid2sid.png new file mode 100644 index 0000000000..b8cf5d2257 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap-gid2sid.png differ diff --git a/docs/docbook/projdoc/imagefiles/idmap-groups.dia b/docs/docbook/projdoc/imagefiles/idmap-groups.dia new file mode 100755 index 0000000000..04da158c53 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap-groups.dia differ diff --git a/docs/docbook/projdoc/imagefiles/idmap-groups.png b/docs/docbook/projdoc/imagefiles/idmap-groups.png new file mode 100755 index 0000000000..e5c214574f Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap-groups.png differ diff --git a/docs/docbook/projdoc/imagefiles/idmap-sid2gid.dia b/docs/docbook/projdoc/imagefiles/idmap-sid2gid.dia new file mode 100644 index 0000000000..e6e5107698 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap-sid2gid.dia differ diff --git a/docs/docbook/projdoc/imagefiles/idmap-sid2gid.png b/docs/docbook/projdoc/imagefiles/idmap-sid2gid.png new file mode 100644 index 0000000000..daadfc1f90 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap-sid2gid.png differ diff --git a/docs/docbook/projdoc/imagefiles/idmap-sid2uid.dia b/docs/docbook/projdoc/imagefiles/idmap-sid2uid.dia new file mode 100644 index 0000000000..91e00530a6 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap-sid2uid.dia differ diff --git a/docs/docbook/projdoc/imagefiles/idmap-sid2uid.png b/docs/docbook/projdoc/imagefiles/idmap-sid2uid.png new file mode 100644 index 0000000000..3acc07bd11 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap-sid2uid.png differ diff --git a/docs/docbook/projdoc/imagefiles/idmap-store-gid2sid.dia b/docs/docbook/projdoc/imagefiles/idmap-store-gid2sid.dia new file mode 100644 index 0000000000..957613b6f3 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap-store-gid2sid.dia differ diff --git a/docs/docbook/projdoc/imagefiles/idmap-store-gid2sid.png b/docs/docbook/projdoc/imagefiles/idmap-store-gid2sid.png new file mode 100644 index 0000000000..911c996329 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap-store-gid2sid.png differ diff --git a/docs/docbook/projdoc/imagefiles/idmap-uid2sid.dia b/docs/docbook/projdoc/imagefiles/idmap-uid2sid.dia new file mode 100644 index 0000000000..de6ccaacb3 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap-uid2sid.dia differ diff --git a/docs/docbook/projdoc/imagefiles/idmap-uid2sid.png b/docs/docbook/projdoc/imagefiles/idmap-uid2sid.png new file mode 100644 index 0000000000..f30c632500 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap-uid2sid.png differ diff --git a/docs/docbook/projdoc/imagefiles/idmap.png b/docs/docbook/projdoc/imagefiles/idmap.png new file mode 100644 index 0000000000..b090ced632 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap.png differ diff --git a/docs/docbook/projdoc/imagefiles/idmap_winbind_no_loop.png b/docs/docbook/projdoc/imagefiles/idmap_winbind_no_loop.png new file mode 100755 index 0000000000..5393f6a192 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/idmap_winbind_no_loop.png differ diff --git a/docs/docbook/projdoc/imagefiles/pdftoepsonusb b/docs/docbook/projdoc/imagefiles/pdftoepsonusb new file mode 100644 index 0000000000..2f846ee8d4 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/pdftoepsonusb differ diff --git a/docs/docbook/projdoc/imagefiles/pdftoepsonusb.png b/docs/docbook/projdoc/imagefiles/pdftoepsonusb.png new file mode 100644 index 0000000000..b80efe9f16 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/pdftoepsonusb.png differ diff --git a/docs/docbook/projdoc/imagefiles/pdftosocket b/docs/docbook/projdoc/imagefiles/pdftosocket new file mode 100644 index 0000000000..53b6b7117c Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/pdftosocket differ diff --git a/docs/docbook/projdoc/imagefiles/pdftosocket.png b/docs/docbook/projdoc/imagefiles/pdftosocket.png new file mode 100644 index 0000000000..ea4a9dae93 Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/pdftosocket.png differ diff --git a/docs/docbook/projdoc/imagefiles/trusts1 b/docs/docbook/projdoc/imagefiles/trusts1 new file mode 100644 index 0000000000..95cbbaa42f Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/trusts1 differ diff --git a/docs/docbook/projdoc/imagefiles/trusts1.png b/docs/docbook/projdoc/imagefiles/trusts1.png new file mode 100644 index 0000000000..72aa60d4cc Binary files /dev/null and b/docs/docbook/projdoc/imagefiles/trusts1.png differ diff --git a/docs/docbook/scripts/find_missing_doc.pl b/docs/docbook/scripts/find_missing_doc.pl new file mode 100755 index 0000000000..2875cf77b8 --- /dev/null +++ b/docs/docbook/scripts/find_missing_doc.pl @@ -0,0 +1,57 @@ +#!/usr/bin/perl + +my %doc; + +$topdir = (shift @ARGV) or $topdir = "."; + +################################################## +# Reading links from manpage + +$curdir = $ENV{PWD}; + +chdir($topdir."/docs/docbook/smbdotconf"); + +open(IN,"xsltproc --xinclude --param smb.context ALL generate-context.xsl parameters.all.xml|"); + +while() { + if( /([^<]*)<\/parameter><\/link><\/para><\/listitem>/g ){ + $doc{$2} = $1; + } +} + +close(IN); + +chdir($curdir); + +################################################# +# Reading entries from source code + + +open(SOURCE,"$topdir/source/param/loadparm.c") or die("Can't open $topdir/source/param/loadparm.c: $!"); + +while ($ln = ) { + last if $ln =~ m/^static\ struct\ parm_struct\ parm_table.*/; +} #burn through the preceding lines + +while ($ln = ) { + last if $ln =~ m/^\s*\}\;\s*$/; + #pull in the param names only + next if $ln =~ m/.*P_SEPARATOR.*/; + next unless $ln =~ /\s*\{\"(.*)\".*/; + + if($doc{lc($1)}) { + $doc{lc($1)} = "FOUND"; + } else { + print "$1 is not documented!\n"; + } +} +close SOURCE; + +################################################## +# Trying to find missing references + +foreach (keys %doc) { + if($doc{$_} cmp "FOUND") { + print "$_ is documented but is not a configuration option!\n"; + } +} -- cgit From 3cf6eaebd6c57974d33934bf9647b0ab9f50f88e Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 03:18:20 +0000 Subject: syncing packaging files from 3.0 (This used to be commit ccc2a0d3840f88625cf89d6739320728e830ef87) --- packaging/Debian/README | 19 +- packaging/Debian/debian/README.build-upstream | 19 +- packaging/Debian/debian/changelog | 26 +- packaging/Debian/debian/control | 12 +- packaging/Debian/debian/patches/VERSION.patch | 8 + .../Debian/debian/patches/documentation.patch | 33 - packaging/Debian/debian/patches/fhs.patch | 101 +- .../Debian/debian/patches/installswat.sh.patch | 26 +- packaging/Debian/debian/patches/krb5-vars.patch | 51 +- .../Debian/debian/patches/nmbd-signalling.patch | 28 +- packaging/Debian/debian/patches/samba.patch | 4 +- .../debian/patches/smbclient-tar.patch.unused | 43 + .../Debian/debian/patches/smbstatus-locking.patch | 2 +- packaging/Debian/debian/po/es.po | 9 +- packaging/Debian/debian/po/fr.po | 4 +- packaging/Debian/debian/po/nl.po | 302 ++++++ packaging/Debian/debian/po/pt_BR.po | 11 +- packaging/Debian/debian/po/templates.pot | 3 +- packaging/Debian/debian/python2.3-samba.files | 1 + packaging/Debian/debian/rules | 24 +- packaging/Debian/debian/samba-doc.docs | 2 - packaging/Debian/debian/samba.pamd | 8 +- packaging/Debian/debian/scripts/patch-source | 18 +- packaging/Debian/debian/scripts/unpatch-source | 8 +- packaging/Mandrake/mount.cifs.8 | 181 ++++ packaging/Mandrake/samba2.spec.tmpl | 203 ++-- packaging/README | 20 +- packaging/RedHat/filter-requires-samba_rh8.sh | 2 + packaging/RedHat/filter-requires-samba_rh9.sh | 2 + packaging/RedHat/makerpms.sh.tmpl | 49 +- packaging/RedHat/samba.spec.tmpl | 58 +- packaging/RedHat/smb.conf | 2 +- packaging/RedHat/smb.init | 2 +- packaging/RedHat/winbind.init | 11 +- packaging/SGI/mkrelease.sh | 2 + packaging/SGI/spec.pl | 16 +- packaging/Solaris/makepkg.sh.tmpl | 164 ++++ packaging/SuSE/samba-mutual-auth.diff | 247 +++++ packaging/SuSE/samba-vscan-0.3.2b.tar.bz2 | Bin 0 -> 69479 bytes packaging/SuSE/samba3-3.0.0-Makefiles-heimdal.diff | 22 + packaging/SuSE/samba3-3.0.0-heimdal-06.diff | 14 + packaging/SuSE/samba3-3.0.0-pdb.diff | 13 + packaging/SuSE/samba3-Makefile.diff | 16 + packaging/SuSE/samba3-com_err.diff | 60 ++ packaging/SuSE/samba3-net_ads_password.diff | 58 ++ packaging/SuSE/samba3-smbwrapper.diff | 11 + packaging/SuSE/samba3-vscan.diff | 269 ++++++ packaging/SuSE/samba3.spec | 1007 ++++++++++---------- packaging/bin/update-pkginfo | 14 +- 49 files changed, 2314 insertions(+), 891 deletions(-) create mode 100644 packaging/Debian/debian/patches/VERSION.patch create mode 100644 packaging/Debian/debian/patches/smbclient-tar.patch.unused create mode 100644 packaging/Debian/debian/po/nl.po create mode 100644 packaging/Debian/debian/python2.3-samba.files create mode 100644 packaging/Mandrake/mount.cifs.8 create mode 100755 packaging/RedHat/filter-requires-samba_rh8.sh create mode 100755 packaging/RedHat/filter-requires-samba_rh9.sh create mode 100755 packaging/Solaris/makepkg.sh.tmpl create mode 100644 packaging/SuSE/samba-mutual-auth.diff create mode 100755 packaging/SuSE/samba-vscan-0.3.2b.tar.bz2 create mode 100644 packaging/SuSE/samba3-3.0.0-Makefiles-heimdal.diff create mode 100644 packaging/SuSE/samba3-3.0.0-heimdal-06.diff create mode 100644 packaging/SuSE/samba3-3.0.0-pdb.diff create mode 100644 packaging/SuSE/samba3-Makefile.diff create mode 100644 packaging/SuSE/samba3-com_err.diff create mode 100644 packaging/SuSE/samba3-net_ads_password.diff create mode 100644 packaging/SuSE/samba3-smbwrapper.diff create mode 100644 packaging/SuSE/samba3-vscan.diff diff --git a/packaging/Debian/README b/packaging/Debian/README index 0a1d68ba37..40dd310366 100644 --- a/packaging/Debian/README +++ b/packaging/Debian/README @@ -3,9 +3,14 @@ Building Samba Packages for Debian GNU/Linux Building Debian packages is not as hard as some people might think. The following instructions will allow you to build your own Samba Debian -packages. These instructions, and the files in packaging/Debian/, should -be current as of Samba 3.0beta3, and should allow you to build Debian -packages for Debian unstable. +packages. These instructions, and the files in packaging/Debian/, are +current as of Samba 3.0.0rc2, and allow you to build Debian packages +for Debian unstable (so you need some development packages available +only in Debian unstable.) If you are using something newer than 3.0.0rc2 +you might want to try to follow the instructions to see if patches +apply cleanly. If some patches don't apply cleanly please e-mail +samba@packages.debian.org since we might have fixed patches that we have +not yet integrated into upstream Samba. We try to maintain as much compatibility with previous releases of Debian as possible, so it is possible that the files in @@ -32,11 +37,11 @@ devscripts, etc.): libpam0g-dev libreadline4-dev libcupsys2-dev - libacl1-dev | acl-dev (>= 2.0.0) + libacl1-dev, libacl1 (>= 2.2.11-1) libkrb5-dev libldap2-dev po-debconf - python-dev (>= 2.2) + python2.3-dev Notes regarding the packages required to build Samba Debian packages: @@ -44,12 +49,12 @@ devscripts, etc.): That's fine; the configure script won't detect CUPS support and the resulting binaries won't support CUPS. - * The list above is current as of samba-3.0.0beta3, but it can get + * The list above is current as of samba-3.0.0rc2, but it can get out of date. The best way to check what packages are required to build the samba packages on Debian is to look for the Build-Depends: field in the file debian/control. -1) cd samba[-]. For example, "cd samba-3.0.0beta3". +1) cd samba[-]. For example, "cd samba-3.0.0rc2". 2) cp -a packaging/Debian/debian/ debian It's important that you copy instead of symlink because the build tools in Potato have a problem that prevents the build to work with diff --git a/packaging/Debian/debian/README.build-upstream b/packaging/Debian/debian/README.build-upstream index 0a1d68ba37..40dd310366 100644 --- a/packaging/Debian/debian/README.build-upstream +++ b/packaging/Debian/debian/README.build-upstream @@ -3,9 +3,14 @@ Building Samba Packages for Debian GNU/Linux Building Debian packages is not as hard as some people might think. The following instructions will allow you to build your own Samba Debian -packages. These instructions, and the files in packaging/Debian/, should -be current as of Samba 3.0beta3, and should allow you to build Debian -packages for Debian unstable. +packages. These instructions, and the files in packaging/Debian/, are +current as of Samba 3.0.0rc2, and allow you to build Debian packages +for Debian unstable (so you need some development packages available +only in Debian unstable.) If you are using something newer than 3.0.0rc2 +you might want to try to follow the instructions to see if patches +apply cleanly. If some patches don't apply cleanly please e-mail +samba@packages.debian.org since we might have fixed patches that we have +not yet integrated into upstream Samba. We try to maintain as much compatibility with previous releases of Debian as possible, so it is possible that the files in @@ -32,11 +37,11 @@ devscripts, etc.): libpam0g-dev libreadline4-dev libcupsys2-dev - libacl1-dev | acl-dev (>= 2.0.0) + libacl1-dev, libacl1 (>= 2.2.11-1) libkrb5-dev libldap2-dev po-debconf - python-dev (>= 2.2) + python2.3-dev Notes regarding the packages required to build Samba Debian packages: @@ -44,12 +49,12 @@ devscripts, etc.): That's fine; the configure script won't detect CUPS support and the resulting binaries won't support CUPS. - * The list above is current as of samba-3.0.0beta3, but it can get + * The list above is current as of samba-3.0.0rc2, but it can get out of date. The best way to check what packages are required to build the samba packages on Debian is to look for the Build-Depends: field in the file debian/control. -1) cd samba[-]. For example, "cd samba-3.0.0beta3". +1) cd samba[-]. For example, "cd samba-3.0.0rc2". 2) cp -a packaging/Debian/debian/ debian It's important that you copy instead of symlink because the build tools in Potato have a problem that prevents the build to work with diff --git a/packaging/Debian/debian/changelog b/packaging/Debian/debian/changelog index a3d27b56d4..e29eeaf920 100644 --- a/packaging/Debian/debian/changelog +++ b/packaging/Debian/debian/changelog @@ -1,11 +1,23 @@ -samba (3.0.0beta3-0.1) unstable; urgency=low +samba (3.0.0beta2+3.0.0rc3-1) unstable; urgency=low * Local build. - -- Debian User Tue, 15 Jul 2003 11:05:39 -0400 + -- Debian User Mon, 8 Sep 2003 13:33:21 -0400 -samba (3.0.0beta2-2) unstable; urgency=low +samba (3.0.0beta2+3.0.0rc2-1) unstable; urgency=low + * New upstream release. + * Incorporate Dutch debconf translations; thanks to Bart Cornelis + . (closes: #207824) + * Link against libgnutls7 instead of libgnutls5. (closes: #208151) + + -- Eloy A. Paris Tue, 2 Sep 2003 21:37:13 -0400 + +samba (3.0.0beta2+3.0.0rc1-1) unstable; urgency=low + + * New upstream version (skipped samba 3.0.0beta3 due to time + constraints.) This ugly version number will go away when the final + Samba 3.0.0 is released. * Drag new unpackaged tools into the packages: smbcquotas (smbclient), vfs modules (samba), smbtree(1) manpage (smbclient), tdbbackup(8) manpage (samba). (closes: #151158) @@ -17,8 +29,12 @@ samba (3.0.0beta2-2) unstable; urgency=low path (closes: #185439) - add support for ${misc:Depends} in control for those packages with init scripts + * Add versioned dependency on libpam-runtime and change + /etc/pam.d/samba to use the new common PAM config blocks. + * New python2.3-samba package (old python2.2-samba is no more.) + (closes: #206171) - -- Steve Langasek Sat, 12 Jul 2003 19:27:31 -0500 + -- Eloy A. Paris Mon, 25 Aug 2003 17:05:14 -0400 samba (3.0.0beta2-1) unstable; urgency=low @@ -468,7 +484,7 @@ samba (2.2.3a-7) unstable; urgency=medium running before the upgrade starts. * Tweak the wording of debconf templates. * Incorporate debconf translations for French, Spanish and Portuguese; - thanks to Carlos Valdivia Yagüe (es), + thanks to Carlos Valdivia Yagüe (es), Andre Luis Lopes (pt_BR), and Philippe Batailler and Denis Barbier (fr). (closes: #142657, #142659, #141551, #141699, #141682) diff --git a/packaging/Debian/debian/control b/packaging/Debian/debian/control index ddbf9e8e3a..7bfb41b79d 100644 --- a/packaging/Debian/debian/control +++ b/packaging/Debian/debian/control @@ -3,12 +3,12 @@ Section: net Priority: optional Maintainer: Eloy A. Paris Uploaders: Steve Langasek -Build-Depends: debhelper (>= 4.1.13), libpam0g-dev, libreadline4-dev, libcupsys2-dev, autoconf, libacl1-dev (>= 2.2.11-1), libacl1 (>= 2.2.11-1), libkrb5-dev, libldap2-dev, po-debconf, python-dev (>= 2.2) +Build-Depends: debhelper (>= 4.1.13), libpam0g-dev, libreadline4-dev, libcupsys2-dev, autoconf, libacl1-dev (>= 2.2.11-1), libacl1 (>= 2.2.11-1), libkrb5-dev, libldap2-dev, po-debconf, python2.3-dev Standards-Version: 3.5.10 Package: samba Architecture: any -Depends: samba-common (= ${Source-Version}), netbase, logrotate, ${shlibs:Depends}, ${misc:Depends} +Depends: samba-common (= ${Source-Version}), netbase, logrotate, ${shlibs:Depends}, ${misc:Depends}, libpam-runtime (>= 0.76-13.1), libpam-modules Replaces: samba-common (<= 2.0.5a-2) Suggests: samba-doc Description: a LanManager-like file and printer server for Unix @@ -32,7 +32,7 @@ Description: a LanManager-like file and printer server for Unix libsmbclient - Shared library that allows applications to talk to SMB servers libsmbclient-dev - libsmbclient shared libraries winbind: Service to resolve user and group information from Windows NT servers - python2.2-samba: Python bindings that allow access to various aspects of Samba + python2.3-samba: Python bindings that allow access to various aspects of Samba . It is possible to install a subset of these packages depending on your particular needs. For example, to access other SMB servers you @@ -175,14 +175,14 @@ Description: service to resolve user and group information from Windows NT serve Windows NT server. The service can also provide authentication services via an associated PAM module. -Package: python2.2-samba +Package: python2.3-samba Section: python Priority: optional Architecture: any -Depends: ${shlibs:Depends}, python2.2 +Depends: ${shlibs:Depends}, python2.3 Description: Python bindings that allow access to various aspects of Samba The Samba Python bindings allow you to access various aspects of Samba. At the moment their status is "experimental" but they have been reported to work well. . - See /usr/share/doc/python2.2-samba/examples for a couple of examples. + See /usr/share/doc/python2.3-samba/examples for a couple of examples. diff --git a/packaging/Debian/debian/patches/VERSION.patch b/packaging/Debian/debian/patches/VERSION.patch new file mode 100644 index 0000000000..0f5c129c56 --- /dev/null +++ b/packaging/Debian/debian/patches/VERSION.patch @@ -0,0 +1,8 @@ +--- samba-3.0.0rc2/source/VERSION.orig 2003-09-02 21:56:11.000000000 -0400 ++++ samba-3.0.0rc2/source/VERSION 2003-09-02 21:56:30.000000000 -0400 +@@ -120,4 +120,4 @@ + # e.g. SAMBA_VERSION_VENDOR_SUFFIX=vendor_version() # + # -> "CVS 3.0.0rc2-VendorVersion" # + ######################################################## +-SAMBA_VERSION_VENDOR_SUFFIX= ++SAMBA_VERSION_VENDOR_SUFFIX="Debian" diff --git a/packaging/Debian/debian/patches/documentation.patch b/packaging/Debian/debian/patches/documentation.patch index 65f7421ab4..c5e66232f9 100644 --- a/packaging/Debian/debian/patches/documentation.patch +++ b/packaging/Debian/debian/patches/documentation.patch @@ -1,36 +1,3 @@ -diff -uNr samba-2.999+3.0.alpha21.orig/docs/htmldocs/using_samba/ch06_05.html samba-2.999+3.0.alpha21/docs/htmldocs/using_samba/ch06_05.html ---- samba-2.999+3.0.alpha21.orig/docs/htmldocs/using_samba/ch06_05.html 2000-07-30 02:38:29.000000000 -0500 -+++ samba-2.999+3.0.alpha21/docs/htmldocs/using_samba/ch06_05.html 2002-12-16 23:15:46.000000000 -0600 -@@ -102,13 +102,13 @@ - WARNING: You will need to use at least Samba 2.1 to ensure that PDC functionality for Windows NT clients is present. Prior to Samba 2.1, only limited user authentication for NT clients was present. At the time this book went to press, Samba 2.0.5 was the latest version, but Samba 2.1 was available through CVS download. Instructions on downloading alpha versions of Samba are given in Appendix E, Downloading Samba with CVS.

    - As before, you need to ensure that Samba is a primary domain controller for the current workgroup and is using user-level security. However, you must also ensure that Samba is using encrypted passwords. In other words, alter the - [global] options the previous example to include the --encrypted -+encrypt - passwords - = - yes option, as shown here: 

    - [global]
- 	workgroup = SIMPLE
--	encrypted passwords = yes
-+	encrypt passwords = yes
- 	domain logons = yes
- 
- 	security = user
    ---- samba-2.2.2.cvs20020120.orig/swat/README -+++ samba-2.2.2.cvs20020120/swat/README -@@ -1,3 +1,11 @@ -+[Debian-specific Note: you can safely skip the installation notes in -+this document. swat was configured for you when the package was -+installed. For security reasons, swat is not enabled. To enable it, you -+need to edit /etc/inetd.conf, uncomment the swat entry, and reload -+inetd. Please note that the file locations given in this file are not -+correct for the Debian version of swat. The correct file locations are -+given in swat's man page.] -+ - This is a brief description of how to install and use the Samba Web - Administration Tool on your machine. - --- samba_3_0/docs/manpages/swat.8.orig 2003-06-06 16:16:24.000000000 -0400 +++ samba_3_0/docs/manpages/swat.8 2003-06-06 16:25:13.000000000 -0400 @@ -89,6 +89,13 @@ diff --git a/packaging/Debian/debian/patches/fhs.patch b/packaging/Debian/debian/patches/fhs.patch index b5c7c6c676..1c90499a83 100644 --- a/packaging/Debian/debian/patches/fhs.patch +++ b/packaging/Debian/debian/patches/fhs.patch @@ -1,7 +1,7 @@ diff -uNr samba-3.0.0beta2.orig/source/Makefile.in samba-3.0.0beta2/source/Makefile.in --- samba-3.0.0beta2.orig/source/Makefile.in 2003-07-02 23:26:46.000000000 -0500 +++ samba-3.0.0beta2/source/Makefile.in 2003-07-02 23:19:46.000000000 -0500 -@@ -68,6 +68,7 @@ +@@ -67,6 +67,7 @@ CONFIGDIR = @configdir@ VARDIR = @localstatedir@ MANDIR = @mandir@ @@ -9,7 +9,7 @@ diff -uNr samba-3.0.0beta2.orig/source/Makefile.in samba-3.0.0beta2/source/Makef # The permissions to give the executables INSTALLPERMS = 0755 -@@ -91,6 +92,13 @@ +@@ -90,6 +91,13 @@ # the directory where lock files go LOCKDIR = @lockdir@ @@ -23,7 +23,7 @@ diff -uNr samba-3.0.0beta2.orig/source/Makefile.in samba-3.0.0beta2/source/Makef # the directory where pid files go PIDDIR = @piddir@ # man pages language(s) -@@ -115,7 +123,7 @@ +@@ -114,7 +122,7 @@ PATH_FLAGS4 = $(PATH_FLAGS3) -DSWATDIR=\"$(SWATDIR)\" -DLOCKDIR=\"$(LOCKDIR)\" -DPIDDIR=\"$(PIDDIR)\" PATH_FLAGS5 = $(PATH_FLAGS4) -DLIBDIR=\"$(LIBDIR)\" \ -DLOGFILEBASE=\"$(LOGFILEBASE)\" -DSHLIBEXT=\"@SHLIBEXT@\" @@ -32,7 +32,7 @@ diff -uNr samba-3.0.0beta2.orig/source/Makefile.in samba-3.0.0beta2/source/Makef PATH_FLAGS = $(PATH_FLAGS6) $(PASSWD_FLAGS) # Note that all executable programs now provide for an optional executable suffix. -@@ -1123,7 +1131,7 @@ +@@ -1203,7 +1211,7 @@ @$(SHELL) $(srcdir)/script/installscripts.sh $(INSTALLPERMS) $(DESTDIR)$(BINDIR) $(SCRIPTS) installdat: installdirs @@ -192,7 +192,7 @@ diff -uNr samba-3.0.0beta2.orig/source/lib/account_pol.c samba-3.0.0beta2/source diff -uNr samba-3.0.0beta2.orig/source/lib/util.c samba-3.0.0beta2/source/lib/util.c --- samba-3.0.0beta2.orig/source/lib/util.c 2003-07-02 23:26:47.000000000 -0500 +++ samba-3.0.0beta2/source/lib/util.c 2003-07-02 23:19:02.000000000 -0500 -@@ -2252,6 +2252,61 @@ +@@ -2190,6 +2190,61 @@ } /** @@ -298,38 +298,36 @@ diff -uNr samba-3.0.0beta2.orig/source/libsmb/samlogon_cache.c samba-3.0.0beta2/ TDB_DEFAULT, O_RDWR, 0600); if (!tdb) { DEBUG(5, ("netsamlogon_clear_cached_user: failed to open cache\n")); -diff -uNr samba-3.0.0beta2.orig/source/nmbd/nmbd_serverlistdb.c samba-3.0.0beta2/source/nmbd/nmbd_serverlistdb.c ---- samba-3.0.0beta2.orig/source/nmbd/nmbd_serverlistdb.c 2003-07-02 23:26:47.000000000 -0500 -+++ samba-3.0.0beta2/source/nmbd/nmbd_serverlistdb.c 2003-07-02 23:19:02.000000000 -0500 -@@ -343,7 +343,7 @@ +--- samba_3_0/source/nmbd/nmbd_serverlistdb.c.orig 2003-09-08 10:53:13.000000000 -0400 ++++ samba_3_0/source/nmbd/nmbd_serverlistdb.c 2003-09-08 11:22:03.000000000 -0400 +@@ -327,7 +327,7 @@ - updatecount++; + updatecount++; -- pstrcpy(fname,lp_lockdir()); -+ pstrcpy(fname,dyn_CACHEDIR()); - trim_string(fname,NULL,"/"); - pstrcat(fname,"/"); - pstrcat(fname,SERVER_LIST); -diff -uNr samba-3.0.0beta2.orig/source/nmbd/nmbd_winsserver.c samba-3.0.0beta2/source/nmbd/nmbd_winsserver.c ---- samba-3.0.0beta2.orig/source/nmbd/nmbd_winsserver.c 2003-07-02 23:26:47.000000000 -0500 -+++ samba-3.0.0beta2/source/nmbd/nmbd_winsserver.c 2003-07-02 23:19:02.000000000 -0500 -@@ -230,7 +230,7 @@ - - add_samba_names_to_subnet(wins_server_subnet); - -- if((fp = x_fopen(lock_path(WINS_LIST),O_RDONLY,0)) == NULL) -+ if((fp = x_fopen(state_path(WINS_LIST),O_RDONLY,0)) == NULL) - { - DEBUG(2,("initialise_wins: Can't open wins database file %s. Error was %s\n", - WINS_LIST, strerror(errno) )); -@@ -1836,7 +1836,7 @@ - } - } +- pstrcpy(fname,lp_lockdir()); ++ pstrcpy(fname,dyn_CACHEDIR()); + trim_char(fname,'\0' ,'/'); + pstrcat(fname,"/"); + pstrcat(fname,SERVER_LIST); +--- samba-3.0.0rc2/source/nmbd/nmbd_winsserver.c.orig 2003-08-28 17:42:44.000000000 -0400 ++++ samba-3.0.0rc2/source/nmbd/nmbd_winsserver.c 2003-08-31 08:09:11.000000000 -0400 +@@ -228,7 +228,7 @@ + + add_samba_names_to_subnet(wins_server_subnet); + +- if((fp = x_fopen(lock_path(WINS_LIST),O_RDONLY,0)) == NULL) { ++ if((fp = x_fopen(state_path(WINS_LIST),O_RDONLY,0)) == NULL) { + DEBUG(2,("initialise_wins: Can't open wins database file %s. Error was %s\n", + WINS_LIST, strerror(errno) )); + return True; +@@ -1759,7 +1759,7 @@ + } + } -- slprintf(fname,sizeof(fname)-1,"%s/%s", lp_lockdir(), WINS_LIST); -+ slprintf(fname,sizeof(fname)-1,"%s/%s", dyn_STATEDIR(), WINS_LIST); - all_string_sub(fname,"//", "/", 0); - slprintf(fnamenew,sizeof(fnamenew)-1,"%s.%u", fname, (unsigned int)sys_getpid()); +- slprintf(fname,sizeof(fname)-1,"%s/%s", lp_lockdir(), WINS_LIST); ++ slprintf(fname,sizeof(fname)-1,"%s/%s", dyn_STATEDIR(), WINS_LIST); + all_string_sub(fname,"//", "/", 0); + slprintf(fnamenew,sizeof(fnamenew)-1,"%s.%u", fname, (unsigned int)sys_getpid()); diff -uNr samba-3.0.0beta2.orig/source/nsswitch/winbindd_cache.c samba-3.0.0beta2/source/nsswitch/winbindd_cache.c --- samba-3.0.0beta2.orig/source/nsswitch/winbindd_cache.c 2003-07-02 23:26:47.000000000 -0500 @@ -346,7 +344,7 @@ diff -uNr samba-3.0.0beta2.orig/source/nsswitch/winbindd_cache.c samba-3.0.0beta diff -uNr samba-3.0.0beta2.orig/source/nsswitch/winbindd_util.c samba-3.0.0beta2/source/nsswitch/winbindd_util.c --- samba-3.0.0beta2.orig/source/nsswitch/winbindd_util.c 2003-07-01 15:44:25.000000000 -0500 +++ samba-3.0.0beta2/source/nsswitch/winbindd_util.c 2003-07-02 23:19:02.000000000 -0500 -@@ -747,7 +747,7 @@ +@@ -813,7 +813,7 @@ SMB_STRUCT_STAT stbuf; TDB_CONTEXT *idmap_tdb; @@ -368,24 +366,24 @@ diff -uNr samba-3.0.0beta2.orig/source/param/loadparm.c samba-3.0.0beta2/source/ char *szLockDir; char *szPidDir; char *szRootdir; -@@ -1055,8 +1058,13 @@ - {"config file", P_STRING, P_GLOBAL, &Globals.szConfigFile, NULL, NULL, FLAG_HIDE}, - {"preload", P_STRING, P_GLOBAL, &Globals.szAutoServices, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - {"auto services", P_STRING, P_GLOBAL, &Globals.szAutoServices, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, +@@ -1082,8 +1082,13 @@ + {"config file", P_STRING, P_GLOBAL, &Globals.szConfigFile, NULL, NULL, FLAG_HIDE}, + {"preload", P_STRING, P_GLOBAL, &Globals.szAutoServices, NULL, NULL, FLAG_ADVANCED}, + {"auto services", P_STRING, P_GLOBAL, &Globals.szAutoServices, NULL, NULL, FLAG_ADVANCED}, +#ifdef FHS_COMPATIBLE ++ {"lock directory", P_STRING, P_GLOBAL, &Globals.szLockDirStub, NULL, NULL, 0}, + {"lock dir", P_STRING, P_GLOBAL, &Globals.szLockDirStub, NULL, NULL, 0}, -+ {"lock directory", P_STRING, P_GLOBAL, &Globals.szLockDirStub, NULL, NULL, 0}, +#else + {"lock directory", P_STRING, P_GLOBAL, &Globals.szLockDir, NULL, NULL, FLAG_ADVANCED}, {"lock dir", P_STRING, P_GLOBAL, &Globals.szLockDir, NULL, NULL, FLAG_HIDE}, - {"lock directory", P_STRING, P_GLOBAL, &Globals.szLockDir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, +#endif - {"pid directory", P_STRING, P_GLOBAL, &Globals.szPidDir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"pid directory", P_STRING, P_GLOBAL, &Globals.szPidDir, NULL, NULL, FLAG_ADVANCED}, #ifdef WITH_UTMP - {"utmp directory", P_STRING, P_GLOBAL, &Globals.szUtmpDir, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, + {"utmp directory", P_STRING, P_GLOBAL, &Globals.szUtmpDir, NULL, NULL, FLAG_ADVANCED}, diff -uNr samba-3.0.0beta2.orig/source/passdb/pdb_tdb.c samba-3.0.0beta2/source/passdb/pdb_tdb.c --- samba-3.0.0beta2.orig/source/passdb/pdb_tdb.c 2003-07-02 23:26:47.000000000 -0500 +++ samba-3.0.0beta2/source/passdb/pdb_tdb.c 2003-07-02 23:19:02.000000000 -0500 -@@ -526,10 +526,7 @@ +@@ -501,10 +501,7 @@ if (location) { tdb_state->tdbsam_location = talloc_strdup(pdb_context->mem_ctx, location); } else { @@ -425,7 +423,7 @@ diff -uNr samba-3.0.0beta2.orig/source/passdb/secrets.c samba-3.0.0beta2/source/ diff -uNr samba-3.0.0beta2.orig/source/printing/nt_printing.c samba-3.0.0beta2/source/printing/nt_printing.c --- samba-3.0.0beta2.orig/source/printing/nt_printing.c 2003-07-02 23:26:47.000000000 -0500 +++ samba-3.0.0beta2/source/printing/nt_printing.c 2003-07-02 23:19:02.000000000 -0500 -@@ -287,28 +287,28 @@ +@@ -293,28 +293,28 @@ if (tdb_drivers) tdb_close(tdb_drivers); @@ -525,7 +523,7 @@ diff -uNr samba-3.0.0beta2.orig/source/rpc_server/srv_srvsvc_nt.c samba-3.0.0bet diff -uNr samba-3.0.0beta2.orig/source/sam/idmap_tdb.c samba-3.0.0beta2/source/sam/idmap_tdb.c --- samba-3.0.0beta2.orig/source/sam/idmap_tdb.c 2003-07-01 15:44:26.000000000 -0500 +++ samba-3.0.0beta2/source/sam/idmap_tdb.c 2003-07-02 23:19:02.000000000 -0500 -@@ -495,7 +495,7 @@ +@@ -487,7 +487,7 @@ BOOL tdb_is_new = False; /* use the old database if present */ @@ -570,14 +568,3 @@ diff -uNr samba-3.0.0beta2.orig/source/wrepld/process.c samba-3.0.0beta2/source/ if (!tdb) { DEBUG(2,("send_entry_request: Can't open wins database file %s. Error was %s\n", WINS_LIST, strerror(errno) )); return; ---- samba_3_0/source/nsswitch/winbindd_acct.c.orig 2003-07-15 13:03:59.000000000 -0400 -+++ samba_3_0/source/nsswitch/winbindd_acct.c 2003-07-15 13:04:42.000000000 -0400 -@@ -73,7 +73,7 @@ - - /* Nope. Try to open it */ - -- if (!(account_tdb = tdb_open_log(lock_path("winbindd_idmap.tdb"), 0, -+ if (!(account_tdb = tdb_open_log(state_path("winbindd_idmap.tdb"), 0, - TDB_DEFAULT, O_RDWR | O_CREAT, 0600))) - { - /* last chance -- maybe idmap has already opened it */ diff --git a/packaging/Debian/debian/patches/installswat.sh.patch b/packaging/Debian/debian/patches/installswat.sh.patch index ff5f23a1cf..b425e3bef7 100644 --- a/packaging/Debian/debian/patches/installswat.sh.patch +++ b/packaging/Debian/debian/patches/installswat.sh.patch @@ -1,5 +1,5 @@ ---- samba-3.0alpha23.orig/source/script/installswat.sh 2001-10-17 16:00:14.000000000 -0400 -+++ samba-3.0alpha23/source/script/installswat.sh 2003-04-06 03:18:29.000000000 -0400 +--- samba_3_0/source/script/installswat.sh.orig 2003-08-28 18:03:10.000000000 -0400 ++++ samba_3_0/source/script/installswat.sh 2003-08-28 18:11:14.000000000 -0400 @@ -9,7 +9,7 @@ echo Installing the Samba Web Administration Tool @@ -36,7 +36,7 @@ FNAME=$SWATDIR/$ln/help/`basename $f` echo $FNAME if [ "x$BOOKDIR" = "x" ]; then -@@ -49,31 +45,31 @@ +@@ -49,26 +45,24 @@ cp $f $FNAME || echo Cannot install $FNAME. Does $USER have privileges? rm -f $f chmod 0644 $FNAME @@ -62,23 +62,15 @@ cp $f $FNAME || echo Cannot install $FNAME. Does $USER have privileges? chmod 0644 $FNAME + done ++ done +# Install html documentation +for f in $SRCDIR../docs/htmldocs/*.html; do -+ FNAME=$SWATDIR/help/`basename $f` -+ echo $FNAME -+ ln -s ../../../doc/samba-doc/htmldocs/`basename $f` $FNAME || echo Cannot install $FNAME. Does $USER have privileges? -+# chmod 0644 $FNAME ++ FNAME=$SWATDIR/help/`basename $f` ++ echo $FNAME ++ ln -s ../../../doc/samba-doc/htmldocs/`basename $f` $FNAME || echo Cannot install $FNAME. Does $USER have privileges? ++ chmod 0644 $FNAME done - # Install Using Samba book - --if [ "x$BOOKDIR" != "x" ]; then -+# For Debian we do not install anything here, we just create a symlink -+# pointing to /usr/share/doc/samba-doc/htmldocs/using_samba/ in -+# debian/rules (peloy@debian.org) -+if /bin/false; then - - # Create directories - + # Install Using Samba book (but only if it is there) diff --git a/packaging/Debian/debian/patches/krb5-vars.patch b/packaging/Debian/debian/patches/krb5-vars.patch index 28ee4855d8..d6eadfd91b 100644 --- a/packaging/Debian/debian/patches/krb5-vars.patch +++ b/packaging/Debian/debian/patches/krb5-vars.patch @@ -486,7 +486,7 @@ diff -uNr samba-3.0.0beta2.orig/source/configure.in samba-3.0.0beta2/source/conf # now check for gssapi headers. This is also done here to allow for # different kerberos include paths -@@ -2250,62 +2355,45 @@ +@@ -2250,64 +2365,46 @@ ################################################################## # we might need the k5crypto and com_err libraries on some systems @@ -505,19 +505,8 @@ diff -uNr samba-3.0.0beta2.orig/source/configure.in samba-3.0.0beta2/source/conf # Heimdal checks. On static Heimdal gssapi must be linked before krb5. - AC_CHECK_LIB(gssapi, gss_display_status, [LIBS="$LIBS -lgssapi -lkrb5"; -- AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) + AC_CHECK_LIB_EXT(gssapi, KRB5_LIBS, gss_display_status, [KRB5_LIBS="$KRB5_LIBS -lgssapi -lkrb5"; -+ AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) -+ -+ ######################################################## -+ # now see if we can find the krb5 libs in standard paths -+ # or as specified above -+ AC_CHECK_LIB_EXT(krb5, KRB5_LIBS, krb5_mk_req_extended) -+ -+ ######################################################## -+ # now see if we can find the gssapi libs in standard paths -+ AC_CHECK_LIB_EXT(gssapi_krb5, KRB5_LIBS,gss_display_status,[],[], -+ AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])) + AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) - AC_CHECK_LIB(krb5, krb5_set_real_time, - [AC_DEFINE(HAVE_KRB5_SET_REAL_TIME,1, @@ -562,27 +551,41 @@ diff -uNr samba-3.0.0beta2.orig/source/configure.in samba-3.0.0beta2/source/conf - AC_CHECK_LIB(krb5, krb5_free_ktypes, - [AC_DEFINE(HAVE_KRB5_FREE_KTYPES,1, - [Whether krb5_free_ktypes is available])]) +- AC_CHECK_LIB(krb5, krb5_principal_get_comp_string, +- [AC_DEFINE(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING,1, +- [Whether krb5_principal_get_comp_string is available])]) ++ ######################################################## ++ # now see if we can find the krb5 libs in standard paths ++ # or as specified above ++ AC_CHECK_LIB_EXT(krb5, KRB5_LIBS, krb5_mk_req_extended) ++ ++ ######################################################## ++ # now see if we can find the gssapi libs in standard paths ++ AC_CHECK_LIB_EXT(gssapi_krb5, KRB5_LIBS,gss_display_status,[],[], ++ AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])) ++ + AC_CHECK_FUNC_EXT(krb5_set_real_time, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_set_default_in_tkt_etypes, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_set_default_tgs_ktypes, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_principal2salt, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_use_enctype, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_string_to_key, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_string_to_key, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_get_pw_salt, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_string_to_key_salt, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_string_to_key_salt, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_auth_con_setkey, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_auth_con_setuseruserkey, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_auth_con_setuseruserkey, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_locate_kdc, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_get_permitted_enctypes, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_get_default_in_tkt_etypes, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_get_permitted_enctypes, $KRB5_LIBS) ++ AC_CHECK_FUNC_EXT(krb5_get_default_in_tkt_etypes, $KRB5_LIBS) + AC_CHECK_FUNC_EXT(krb5_free_ktypes, $KRB5_LIBS) - ++ AC_CHECK_FUNC_EXT(krb5_principal_get_comp_string, $KRB5_LIBS) ++ + LIBS="$LIBS $KRB5_LIBS" -+ - AC_CACHE_CHECK([for addrtype in krb5_address], - samba_cv_HAVE_ADDRTYPE_IN_KRB5_ADDRESS,[ - AC_TRY_COMPILE([#include ], -@@ -2365,87 +2453,21 @@ ++ + AC_CACHE_CHECK([for the krb5_princ_component macro], + samba_cv_HAVE_KRB5_PRINC_COMPONENT,[ + AC_TRY_LINK([#include ], +@@ -2380,87 +2468,21 @@ [Whether the ENCTYPE_ARCFOUR_HMAC_MD5 key type is available]) fi diff --git a/packaging/Debian/debian/patches/nmbd-signalling.patch b/packaging/Debian/debian/patches/nmbd-signalling.patch index c34f7e75fb..ca04cce3bf 100644 --- a/packaging/Debian/debian/patches/nmbd-signalling.patch +++ b/packaging/Debian/debian/patches/nmbd-signalling.patch @@ -1,20 +1,20 @@ diff -uNr samba-2.999+3.0.alpha21.orig/source/nmbd/nmbd_subnetdb.c samba-2.999+3.0.alpha21/source/nmbd/nmbd_subnetdb.c --- samba-2.999+3.0.alpha21.orig/source/nmbd/nmbd_subnetdb.c 2002-11-26 20:54:19.000000000 -0600 +++ samba-2.999+3.0.alpha21/source/nmbd/nmbd_subnetdb.c 2002-12-16 23:34:13.000000000 -0600 -@@ -230,12 +230,16 @@ - extern struct in_addr loopback_ip; +@@ -214,12 +214,16 @@ + extern struct in_addr loopback_ip; - if(num_interfaces == 0) { -+ void (*old_handler)(int); + if(num_interfaces == 0) { ++ void (*old_handler)(int); + - DEBUG(0,("create_subnets: No local interfaces !\n")); - DEBUG(0,("create_subnets: Waiting for an interface to appear ...\n")); -+ old_handler = CatchSignal( SIGTERM, SIGNAL_CAST SIG_DFL ); - while (iface_count() == 0) { - sleep(5); - load_interfaces(); - } -+ CatchSignal( SIGTERM, SIGNAL_CAST old_handler ); - } + DEBUG(0,("create_subnets: No local interfaces !\n")); + DEBUG(0,("create_subnets: Waiting for an interface to appear ...\n")); ++ old_handler = CatchSignal( SIGTERM, SIGNAL_CAST SIG_DFL ); + while (iface_count() == 0) { + sleep(5); + load_interfaces(); + } ++ CatchSignal( SIGTERM, SIGNAL_CAST old_handler ); + } - num_interfaces = iface_count(); + num_interfaces = iface_count(); diff --git a/packaging/Debian/debian/patches/samba.patch b/packaging/Debian/debian/patches/samba.patch index bface14166..2ea25bb328 100644 --- a/packaging/Debian/debian/patches/samba.patch +++ b/packaging/Debian/debian/patches/samba.patch @@ -49,7 +49,7 @@ diff -uNr samba-3.0.0beta1.orig/source/script/installbin.sh samba-3.0.0beta1/sou diff -uNr samba-3.0.0beta1.orig/source/smbd/service.c samba-3.0.0beta1/source/smbd/service.c --- samba-3.0.0beta1.orig/source/smbd/service.c 2003-06-07 12:57:39.000000000 -0500 +++ samba-3.0.0beta1/source/smbd/service.c 2003-06-30 20:12:57.000000000 -0500 -@@ -880,6 +880,9 @@ +@@ -885,6 +885,9 @@ file_close_conn(conn); dptr_closecnum(conn); @@ -59,7 +59,7 @@ diff -uNr samba-3.0.0beta1.orig/source/smbd/service.c samba-3.0.0beta1/source/sm /* execute any "postexec = " line */ if (*lp_postexec(SNUM(conn)) && change_to_user(conn, vuid)) { -@@ -899,8 +902,5 @@ +@@ -904,8 +907,5 @@ smbrun(cmd,NULL); } diff --git a/packaging/Debian/debian/patches/smbclient-tar.patch.unused b/packaging/Debian/debian/patches/smbclient-tar.patch.unused new file mode 100644 index 0000000000..e2a4c3ce2c --- /dev/null +++ b/packaging/Debian/debian/patches/smbclient-tar.patch.unused @@ -0,0 +1,43 @@ +diff -uNr samba-3.0.0beta2.orig/source/client/client.c samba-3.0.0beta2/source/client/client.c +--- samba-3.0.0beta2.orig/source/client/client.c 2003-07-01 22:36:24.000000000 -0500 ++++ samba-3.0.0beta2/source/client/client.c 2003-07-06 15:17:36.000000000 -0500 +@@ -2773,6 +2773,7 @@ + int opt; + pstring query_host; + BOOL message = False; ++ char* tar_args = NULL; + extern char tar_type; + pstring term_code; + static const char *new_name_resolve_order = NULL; +@@ -2816,7 +2817,7 @@ + max_protocol = interpret_protocol(poptGetOptArg(pc), max_protocol); + break; + case 'T': +- if (!tar_parseargs(argc, argv, poptGetOptArg(pc), optind)) { ++ if (!(tar_args = poptGetOptArg(pc))) { + poptPrintUsage(pc, stderr, 0); + exit(1); + } +@@ -2917,6 +2917,22 @@ + pstrcpy(cmdline_auth_info.password,poptGetArg(pc)); + } + ++ /* The tar command may take a number of string options; pass ++ everything we have left to tar_parseargs(). */ ++ if (tar_args) { ++ const char **argv2 = poptGetArgs(pc); ++ int argc2 = 0; ++ ++ if (argv2) { ++ while (argv2[argc2]) argc2++; ++ } ++ ++ if (!tar_parseargs(argc2, argv2, tar_args, 0)) { ++ poptPrintUsage(pc, stderr, 0); ++ exit(1); ++ } ++ } ++ + init_names(); + + if(new_name_resolve_order) diff --git a/packaging/Debian/debian/patches/smbstatus-locking.patch b/packaging/Debian/debian/patches/smbstatus-locking.patch index fe720c8187..d37896a369 100644 --- a/packaging/Debian/debian/patches/smbstatus-locking.patch +++ b/packaging/Debian/debian/patches/smbstatus-locking.patch @@ -1,7 +1,7 @@ diff -uNr samba-2.999+3.0.alpha21.orig/source/utils/status.c samba-2.999+3.0.alpha21/source/utils/status.c --- samba-2.999+3.0.alpha21.orig/source/utils/status.c 2002-11-26 20:54:22.000000000 -0600 +++ samba-2.999+3.0.alpha21/source/utils/status.c 2002-12-16 23:37:14.000000000 -0600 -@@ -635,6 +635,16 @@ +@@ -630,6 +630,16 @@ if (!shares_only) { int ret; diff --git a/packaging/Debian/debian/po/es.po b/packaging/Debian/debian/po/es.po index 1c5854b480..0d1d1a770d 100644 --- a/packaging/Debian/debian/po/es.po +++ b/packaging/Debian/debian/po/es.po @@ -14,14 +14,14 @@ msgid "" msgstr "" "Project-Id-Version: Samba for Debian 3.0.0beta2-1\n" -"POT-Creation-Date: 2003-07-02 21:50-0500\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2003-08-30 19:08-0500\n" "PO-Revision-Date: 2003-07-02 21:51-0500\n" "Last-Translator: Steve Langasek \n" "Language-Team: Spanish \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" -"Report-Msgid-Bugs-To: \n" #. Description #: ../samba-common.templates:3 @@ -39,9 +39,8 @@ msgid "" msgstr "" "Actualmente hay una opción de \"character set\" en smb.conf. En Samba 3.0 " "esta opción ha sido reemplazado por una opción nueva: \"unix charset\". Por " -"favor, indique el juego de caracteres que desea usar para esta opción " -"nueva, que controla cómo Samba interpretará los nombres en el sistema de " -"ficheros." +"favor, indique el juego de caracteres que desea usar para esta opción nueva, " +"que controla cómo Samba interpretará los nombres en el sistema de ficheros." #. Description #: ../samba-common.templates:3 diff --git a/packaging/Debian/debian/po/fr.po b/packaging/Debian/debian/po/fr.po index 130a92ee11..6be14c19b4 100644 --- a/packaging/Debian/debian/po/fr.po +++ b/packaging/Debian/debian/po/fr.po @@ -14,14 +14,14 @@ msgid "" msgstr "" "Project-Id-Version: Samba for Debian 3.0.0beta2-1\n" -"POT-Creation-Date: 2003-07-02 21:50-0500\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2003-08-30 19:08-0500\n" "PO-Revision-Date: 2003-07-02 21:52-0500\n" "Last-Translator: Steve Langasek \n" "Language-Team: French \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=ISO-8859-15\n" "Content-Transfer-Encoding: 8bit\n" -"Report-Msgid-Bugs-To: \n" #. Description #: ../samba-common.templates:3 diff --git a/packaging/Debian/debian/po/nl.po b/packaging/Debian/debian/po/nl.po new file mode 100644 index 0000000000..61e8742dbb --- /dev/null +++ b/packaging/Debian/debian/po/nl.po @@ -0,0 +1,302 @@ +# +# Translators, if you are not familiar with the PO format, gettext +# documentation is worth reading, especially sections dedicated to +# this format, e.g. by running: +# info -n '(gettext)PO Files' +# info -n '(gettext)Header Entry' +# +# Some information specific to po-debconf are available at +# /usr/share/doc/po-debconf/README-trans +# or http://www.debian.org/intl/l10n/po-debconf/README-trans +# +# Developers do not need to manually edit POT or PO files. +# +msgid "" +msgstr "" +"Project-Id-Version: samba\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2003-08-30 19:08-0500\n" +"PO-Revision-Date: 2003-08-30 02:03+0100\n" +"Last-Translator: Bart Cornelis \n" +"Language-Team: dutch \n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=iso-8859-1\n" +"Content-Transfer-Encoding: 8bit\n" + +#. Description +#: ../samba-common.templates:3 +msgid "Character Set for Unix filesystem" +msgstr "Karakterset voor Unix bestandsysteem" + +#. Description +#: ../samba-common.templates:3 +msgid "" +"You currently have a \"character set\" configured in your smb.conf. In " +"Samba 3.0, this option is replaced by a new option, \"unix charset\". Please " +"specify the character set you wish to use for theis new option, which " +"controls how Samba interprets filenames on the file system." +msgstr "" +"U heeft momenteel een \"karakterset\" ingesteld in uw smb.conf. In Samba 3.0 " +"werd deze optie vervangen door een nieuwe \"unix karakterset\" optie. " +"Gelieve de karakterset die u voor deze nieuwe optie wil gebruiken aan te " +"geven, deze bepaald hoe Samba de bestandsnamen in het bestandsysteem " +"interpreteerd." + +#. Description +#: ../samba-common.templates:3 +msgid "If you leave this option blank, your smb.conf will not be changed." +msgstr "" +"Uw smb.conf bestand wordt niet aangepast indien u deze optie leeg laat." + +#. Description +#: ../samba-common.templates:13 +msgid "Character Set for DOS clients" +msgstr "Karakterset voor DOS-clients" + +#. Description +#: ../samba-common.templates:13 +msgid "" +"You currently have a \"client code page\" set in your smb.conf. In Samba " +"3.0, this option is replaced by the option \"dos charset\". Please specify " +"the character set you wish to use for this new option. In most cases, the " +"default chosen for you will be sufficient. Note that this option is not " +"needed to support Windows clients, it is only for DOS clients. If you leave " +"this option blank, your smb.conf will not be changed." +msgstr "" +"U heeft momenteel een \"client code pagina\" ingesteld in uw smb.conf. In " +"Samba 3.0 werd deze optie vervangen door de optie \"dos karakterset\". " +"Gelieve de karakterset die u voor deze nieuwe optie wilt gebruiken aan te " +"geven. In de meeste gevallen zal het standaard ingevulde antwoord voldoen. " +"Merk op dat deze optie niet nodig is voor ondersteuning van Windows-clients, " +"enkel voor DOS-clients. Uw smb.conf wordt niet veranderd wanneer u deze " +"optie blank laat." + +#. Description +#: ../samba-common.templates:24 +msgid "Modify smb.conf to use WINS settings from DHCP?" +msgstr "smb.conf aanpassen om de WINS instellingen van DHCP te gebruiken?" + +#. Description +#: ../samba-common.templates:24 +msgid "" +"If your computer gets IP address information from a DHCP server on the " +"network, the DHCP server may also provide information about WINS servers " +"(\"NetBIOS name servers\") present on the network. This requires a change " +"to your smb.conf file so that DHCP-provided WINS settings will automatically " +"be read from /etc/samba/dhcp.conf." +msgstr "" +"Indien uw computer zijn ip-addres informatie van een DHCP-server op het " +"netwerk haalt, voorziet deze mogelijks ook informatie betreffende de op het " +"netwerk aanwezige WINS-servers (\"NetBIOS naam servers\").\" Dit vereist een " +"verandering aan uw smb.conf bestand, opdat de door DHCP doorgegeven WINS " +"instellingen automatisch gelezen worden van /etc/samba/dhcp.conf." + +#. Description +#: ../samba-common.templates:24 +msgid "" +"You must have the dhcp3-client package installed to take advantage of this " +"feature." +msgstr "" +"U dient het dhcp3-client-pakket geïnstalleert te hebben om van deze optie " +"gebruik te maken." + +#. Description +#: ../samba-common.templates:37 +msgid "Configure smb.conf through debconf?" +msgstr "Configuratie in smb.conf met debconf beheren?" + +#. Description +#: ../samba-common.templates:37 +msgid "" +"The rest of the configuration of Samba deals with questions that affect " +"parameters in /etc/samba/smb.conf, which is the file used to configure the " +"Samba programs (nmbd and smbd.) Your current smb.conf contains an 'include' " +"line or an option that spans multiple lines, which could confuse debconf and " +"require you to edit your smb.conf by hand to get it working again." +msgstr "" +"De resterende Samba configuratie beslaat parameters in /etc/samba/smb.conf, " +"het configuratiebestand dat gebruikt wordt voor de Samba programmas (nmbd en " +"smbd). Uw huidige smb.conf bevat een 'include' regel of een optie die " +"meerdere regels beslaat, dit kan debconf mogelijks in verwarring brenngen. " +"Indien debconf in verwarring raakt dient u uw smb.conf handmatig aan te " +"passen om samba terug werkend te krijgen." + +#. Description +#: ../samba-common.templates:37 +msgid "" +"If you don't use debconf to configure smb.conf, you will have to handle any " +"configuration changes yourself, and will not be able to take advantage of " +"periodic configuration enhancements. Therefore, use of debconf is " +"recommended if possible." +msgstr "" +"Indien u geen gebruik maakt van debconf voor het beheer van smb.conf dient u " +"alle configuratie instellingen zelf te doen, en zult u geen voordeel halen " +"uit de periodieke configuratie verbeteringen. Het gebruik van debconf wordt " +"dan ook aangeraden. " + +#. Description +#: ../samba-common.templates:52 +msgid "Workgroup/Domain Name?" +msgstr "Werkgroep/Domeinnaam?" + +#. Description +#: ../samba-common.templates:52 +msgid "" +"This controls what workgroup your server will appear to be in when queried " +"by clients. Note that this parameter also controls the Domain name used with " +"the security=domain setting." +msgstr "" +"Dit bepaald van welke werkgroep uw server deel zal lijken uit te maken bij " +"het beantwoorden van vragen door clients. Merk op dat deze parameter ook de " +"domeinnaam die gebruikt wordt voor de security=domein instelling bepaald." + +#. Description +#: ../samba-common.templates:60 +msgid "Use password encryption?" +msgstr "Wachtwoord versleuteling gebruiken?" + +#. Description +#: ../samba-common.templates:60 +msgid "" +"Recent Windows clients communicate with SMB servers using encrypted " +"passwords. If you want to use clear text passwords you will need to change a " +"parameter in your Windows registry. It is recommended that you use encrypted " +"passwords. If you do, make sure you have a valid /etc/samba/smbpasswd file " +"and that you set passwords in there for each user using the smbpasswd " +"command." +msgstr "" +"Recente Windows clients maken gebruik van versleutelde wachtwoorden voor de " +"communicatie met SMB-servers. Indien u onversleutelde tekst wachtwoorden " +"wilt gebruiken dient u een parameter te veranderen in de Windows registry. " +"Het gebruik van versleutelde wachtwoorden wordt aangeraden. Indien u dit " +"doet zorg er dan voor dat u een geldig /etc/samba/smbpasswd bestand heeft en " +"dat u de wachtwoorden daar voor elke gebruiker met behulp van smbpasswd " +"insteld. " + +#. Description +#: ../samba.templates:4 +msgid "Create samba password database, /var/lib/samba/passdb.tdb?" +msgstr "Samba wachtwoord database, /var/lib/samba/passdb.tdb, aanmaken?" + +#. Description +#: ../samba.templates:4 +msgid "" +"To be compatible with the defaults in most versions of Windows, Samba must " +"be configured to use encrypted passwords. This requires user passwords to " +"be stored in a file separate from /etc/passwd. This file can be created " +"automatically, but the passwords must be added manually (by you or the user) " +"by running smbpasswd, and you must arrange to keep it up-to-date in the " +"future. If you do not create it, you will have to reconfigure samba (and " +"probably your client machines) to use plaintext passwords. See /usr/share/" +"doc/samba-doc/htmldocs/ENCRYPTION.html from the samba-doc package for more " +"details." +msgstr "" +"Om compatibel te zijn met de standaard instellingen van de meeste " +"Windowsversies dient Samba gebruik te maken van versleutelde wachtwoorden. " +"Dit vereist dat de gebruikerswachtwoorden opgeslagen worden in een bestand " +"dat verschilt van /etc/passwd. Dit bestand kan automatisch aangemaakt " +"worden, maar de wachtwoorden dienen handmatig (door de gebuiker) toegevoegt " +"te worden met het smbpasswd commando. U dient dit bestand in de toekomst ook " +"aktueel te houden. Indien u dit bestand niet aanmaakt zult u samba (en naar " +"alle waarschijnlijkheid de client machines) moeten herconfigureren zodat " +"deze onversleutelde wachtwoorden gebruiken. Zie /usr/share/doc/samba-doc/" +"htmldocs/ENCRYPTION.html uit het samba-doc pakket voor meer details." + +#. Description +#: ../samba.templates:17 +msgid "Samba's log files have moved." +msgstr "Samba's log bestanden zijn verhuisd." + +#. Description +#: ../samba.templates:17 +msgid "" +"Starting with the first packages of Samba 2.2 for Debian the log files for " +"both Samba daemons (nmbd and smbd) are now stored in /var/log/samba/. The " +"names of the files are log.nmbd and log.smbd, for nmbd and smbd respectively." +msgstr "" +"Vanaf de eerste Debian pakketten vaan Samba versie 2.2 zijn de log bestanden " +"van beide Samba daemons (nmbd en smbd) opgeslagen in /var/log/samba/. De log " +"bestanden voor nmbd en smbd zijn, respectievelijk, log.nmbd en log.smbd." + +#. Description +#: ../samba.templates:17 +msgid "" +"The old log files that were in /var/log/ will be moved to the new location " +"for you." +msgstr "" +"De oude logbestanden in /var/log worden voor u naar de nieuwe locatie " +"verplaatst." + +#. Description +#: ../samba.templates:28 +msgid "Running nmbd from inetd is no longer supported" +msgstr "nmbd vanuit inetd draaien wordt niet langer ondersteund" + +#. Description +#: ../samba.templates:28 +msgid "" +"Your system was previously configured to start nmbd and smbd from inetd. As " +"of version 2.999+3.0.alpha20-4, nmbd will no longer be started from inetd. " +"If you have modified your /etc/init.d/samba startup script, you may need to " +"adjust it by hand now so that nmbd will start." +msgstr "" +"Uw systeem was geconfigureerd om nmbd en smbd vanuit inetd te starten. Vanaf " +"versie 2.999+3.0.alpha20-4 kan nmbd niet langer door inetd gestart worden. " +"Indien u uw /etc/init.d/samba startup-script aangepast had, dient u dit " +"mogelijks aan te passen opdat nmbd zou starten." + +#. Choices +#: ../samba.templates:36 +msgid "daemons, inetd" +msgstr "daemons, inetd" + +#. Description +#: ../samba.templates:38 +msgid "How do you want to run Samba?" +msgstr "Hoe wilt u Samba draaien?" + +#. Description +#: ../samba.templates:38 +msgid "" +"The Samba daemon smbd can run as a normal daemon or from inetd. Running as a " +"daemon is the recommended approach." +msgstr "" +"De Samba daemon smbd kan als een normale daemon of via inetd draaien. Als " +"een daemon is de aangeraden aanpak." + +#. Description +#: ../samba.templates:45 +msgid "Move /etc/samba/smbpasswd to /var/lib/samba/passdb.tdb?" +msgstr "/etc/samba/smbpasswd verplaatsen naar /var/lib/samba/passdb.tdb?" + +#. Description +#: ../samba.templates:45 +msgid "" +"Samba 3.0 introduces a newer, more complete SAM database interface which " +"supersedes the /etc/samba/smbpasswd file. Would you like your existing " +"smbpasswd file to be migrated to /var/lib/samba/passdb.tdb for you? If you " +"plan to use another pdb backend (e.g., LDAP) instead, you should answer 'no' " +"here." +msgstr "" +"Samba 3.0 introduceert een nieuwe, meer complete SAM databaseinterface die " +"het /etc/samba/smbpasswd bestand overstijgt. \"Wilt u dat ik uw bestaand " +"smbpasswd bestand voor u naar /var/lib/samba/passdb.tdb migreer? Indien u " +"van plan bent om, in plaats hiervan, een ander pdb-backend (e.g. LDAP) te " +"gebruiken dient u hier 'nee' te antwoorden." + +#. Description +#: ../swat.templates:3 +msgid "Your smb.conf will be re-written!" +msgstr "Uw smb.conf wordt herschreven!" + +#. Description +#: ../swat.templates:3 +msgid "" +"SWAT will rewrite your smb.conf file. It will rearrange the entries and " +"delete all comments, include= and copy= options. If you have a carefully " +"crafted smb.conf then back it up or don't use SWAT!" +msgstr "" +"SWAT zal uw smb.conf bestand herschrijven. Het zal de ingangen anders " +"schikken en alle comments, include= en copy= opties verwijderen. Als u een, " +"met veel zorg, handmatig opgebouwd smb.conf bestand heeft, maak dan een " +"reservekopie of zie van het gebruik van SWAT af! " diff --git a/packaging/Debian/debian/po/pt_BR.po b/packaging/Debian/debian/po/pt_BR.po index 63ffd9a983..2af42a562b 100644 --- a/packaging/Debian/debian/po/pt_BR.po +++ b/packaging/Debian/debian/po/pt_BR.po @@ -14,14 +14,14 @@ msgid "" msgstr "" "Project-Id-Version: samba_3.0.0beta2-1\n" -"POT-Creation-Date: 2003-07-02 21:50-0500\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2003-08-30 19:08-0500\n" "PO-Revision-Date: 2003-07-02 21:56-0500\n" "Last-Translator: Steve Langasek \n" "Language-Team: Debian-BR Project \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=ISO-8859-1\n" "Content-Transfer-Encoding: 8bit\n" -"Report-Msgid-Bugs-To: \n" #. Description #: ../samba-common.templates:3 @@ -39,10 +39,9 @@ msgid "" msgstr "" "Atualmente existe um \"conjunto de caracteres\" (\"character set\") " "configurado em seu arquivo smb.conf. No Samba 3.0, esta opção foi " -"substituída por uma nova opção, \"unix charset\". Por favor especifique " -"o conjunto de caracteres a ser usado para essa nova opção, a qual " -"controla como o Samba interpreta nomes de arquivos no sistema de " -"arquivos." +"substituída por uma nova opção, \"unix charset\". Por favor especifique o " +"conjunto de caracteres a ser usado para essa nova opção, a qual controla " +"como o Samba interpreta nomes de arquivos no sistema de arquivos." #. Description #: ../samba-common.templates:3 diff --git a/packaging/Debian/debian/po/templates.pot b/packaging/Debian/debian/po/templates.pot index b636ba2e48..465f4719b0 100644 --- a/packaging/Debian/debian/po/templates.pot +++ b/packaging/Debian/debian/po/templates.pot @@ -15,7 +15,8 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" -"POT-Creation-Date: 2003-07-02 21:50-0500\n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2003-08-30 19:08-0500\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" diff --git a/packaging/Debian/debian/python2.3-samba.files b/packaging/Debian/debian/python2.3-samba.files new file mode 100644 index 0000000000..82759d81b8 --- /dev/null +++ b/packaging/Debian/debian/python2.3-samba.files @@ -0,0 +1 @@ +usr/lib/python2.3/site-packages/ diff --git a/packaging/Debian/debian/rules b/packaging/Debian/debian/rules index 0539484089..a59aebeb9c 100755 --- a/packaging/Debian/debian/rules +++ b/packaging/Debian/debian/rules @@ -41,7 +41,6 @@ endif DESTDIR=`pwd`/debian/tmp SWATDIR=`pwd`/debian/swat -SAMBABOOK=`pwd`/debian/swat IVARS = BASEDIR=$(DESTDIR)/usr \ prefix=$(DESTDIR)/usr \ @@ -52,7 +51,6 @@ IVARS = BASEDIR=$(DESTDIR)/usr \ VARDIR=$(DESTDIR)/var \ INCLUDEDIR=$(DESTDIR)/usr/include \ SWATDIR=$(SWATDIR)/usr/share/samba/swat \ - SAMBABOOK=$(SAMBABOOK)/usr/share/samba/swat/using_samba \ CODEPAGEDIR=$(DESTDIR)/usr/share/samba/ \ PRIVATEDIR=$(DESTDIR)/etc/samba \ CONFIGDIR=$(DESTDIR)/etc/samba @@ -92,7 +90,6 @@ configure-stamp: --with-smbmount \ --with-pam \ --with-syslog \ - --with-sambabook \ --with-utmp \ --with-readline \ --with-pam_smbpass \ @@ -103,7 +100,7 @@ configure-stamp: --with-acl-support \ --with-tdbsam \ --with-ldap \ - --with-python=python2.2) + --with-python=python2.3) touch configure-stamp @@ -142,7 +139,7 @@ install: build $(DESTDIR)/lib/security $(DESTDIR)/sbin \ $(DESTDIR)/usr/lib/cups/backend $(DESTDIR)/usr/share/samba \ $(DESTDIR)/etc/pam.d $(DESTDIR)/etc/dhcp3/dhclient-enter-hooks.d \ - $(DESTDIR)/usr/lib/python2.2/site-packages + $(DESTDIR)/usr/lib/python2.3/site-packages # Add here commands to install the package into debian/tmp. $(MAKE) -C source install $(IVARS) @@ -187,14 +184,6 @@ install: build # Erich Schubert in #109509): ln -s ../../../bin/smbspool $(DESTDIR)/usr/lib/cups/backend/smb - # To avoid duplication of a large number of files, the swat package - # does not contain the "Using Samba" book nor the HTML docs. - # Instead, these are provided by the samba-doc package and - # are accessed through symlinks provided in the swat package. - # Here we create the symlink for the book, and the symlinks - # for the HTML files are created by the script installswat.sh. - ln -s ../../doc/samba-doc/htmldocs/using_samba $(SAMBABOOK)/usr/share/samba/swat/using_samba - # Install man pages for files without man pages in the upstream sources install -m 0644 debian/mksmbpasswd.8 $(DESTDIR)/usr/share/man/man8/mksmbpasswd.8 @@ -217,7 +206,12 @@ install: build install -m755 debian/samba-common.dhcp $(DESTDIR)/etc/dhcp3/dhclient-enter-hooks.d/samba # Install the Python modules - cp source/build/lib.*/samba/*.so $(DESTDIR)/usr/lib/python2.2/site-packages/ + # + # Hmmm... need to figure this out. We have lib.linux-i686-2.2 + # and lib.linux-i686-2.3 directories. Using only the stuff from + # the 2.3 directory for now. peloy.- + #cp source/build/lib.*/samba/*.so $(DESTDIR)/usr/lib/python2.3/site-packages/ + cp source/build/lib.linux-i686-2.3/samba/*.so $(DESTDIR)/usr/lib/python2.3/site-packages/ dh_movefiles @@ -262,7 +256,7 @@ binary-arch: build install dh_installdebconf dh_installdocs -A debian/README.build # dh_installexamples is not available in Debian Potato... - [ -x /usr/bin/dh_installexamples ] && DH_OPTIONS= dh_installexamples -v -ppython2.2-samba source/python/examples/* + [ -x /usr/bin/dh_installexamples ] && DH_OPTIONS= dh_installexamples -v -ppython2.3-samba source/python/examples/* # dh_installmenu # dh_installlogrotate is not available in Debian Potato... if [ -x /usr/bin/dh_installlogrotate ]; then \ diff --git a/packaging/Debian/debian/samba-doc.docs b/packaging/Debian/debian/samba-doc.docs index 68753e54f0..4d2cec2ee2 100644 --- a/packaging/Debian/debian/samba-doc.docs +++ b/packaging/Debian/debian/samba-doc.docs @@ -1,9 +1,7 @@ README docs/Samba-HOWTO-Collection.pdf docs/THANKS -docs/announce docs/history -docs/textdocs/ docs/faq/ docs/htmldocs/ docs/Registry/ diff --git a/packaging/Debian/debian/samba.pamd b/packaging/Debian/debian/samba.pamd index 1a5a14c708..e2c7a99356 100644 --- a/packaging/Debian/debian/samba.pamd +++ b/packaging/Debian/debian/samba.pamd @@ -1,5 +1,3 @@ -auth required pam_unix.so nullok -account required pam_unix.so -session required pam_unix.so -password required pam_unix.so - +@include common-auth +@include common-account +@include common-session diff --git a/packaging/Debian/debian/scripts/patch-source b/packaging/Debian/debian/scripts/patch-source index aabcbf709c..a8559b4167 100755 --- a/packaging/Debian/debian/scripts/patch-source +++ b/packaging/Debian/debian/scripts/patch-source @@ -4,11 +4,23 @@ for patch in debian/patches/*.patch; do echo '->'`basename $patch`: - patch -p1 < $patch + patch -p1 --ignore-whitespace < $patch done -cat debian/changelog | perl -pi -e '($version) = =~/\((.*)\)/; \ - s/\".*\"/\"$version for Debian\"/' source/include/version.h +# This code is currently not used because it creates a long version +# number string. For now we're sticking to -Debian, +# as in 3.0.0rc2-Debian. peloy@debian.org.- + +# ---- Begin unused code ---- +# Get Debian version number from 1st line of the Debian changelog +#DEBIAN_VERSION=`sed -n -e '1s/^.*(\(.*\)).*$/\1/p' debian/changelog` + +# Insert Debian version number in source/VERSION, which will then be +# used to create source/include/version.h. +#TMPFILE=source/VERSION.debian +#sed -e "s/^\(SAMBA_VERSION_VENDOR_SUFFIX=\).*$/\1\"Debian-${DEBIAN_VERSION}\"/" source/VERSION > ${TMPFILE} +#mv -f ${TMPFILE} source/VERSION +# ---- End unused code ---- # Regenerate configure only if it is older than configure.in [ source/configure -ot source/configure.in ] && (cd source && sh ./autogen.sh) diff --git a/packaging/Debian/debian/scripts/unpatch-source b/packaging/Debian/debian/scripts/unpatch-source index 0f577d362f..d3681cfa50 100755 --- a/packaging/Debian/debian/scripts/unpatch-source +++ b/packaging/Debian/debian/scripts/unpatch-source @@ -5,10 +5,14 @@ # We want to reverse the patches in the opposite order we applied # them, hence the 'ls|sort -r'. for patch in `ls debian/patches/*.patch | sort -r`; do - patch -p1 -R < $patch + patch -p1 -R --ignore-whitespace < $patch done -perl -pi -e's/-.* for Debian//' source/include/version.h +# Unused code. See comment in the patch-source script. + +#TMPFILE=source/VERSION.debian +#sed -e "s/^\(SAMBA_VERSION_VENDOR_SUFFIX=\).*$/\1/" source/VERSION > ${TMPFILE} +#mv -f ${TMPFILE} source/VERSION # Regenerate configure only if it is older than configure.in [ source/configure -ot source/configure.in ] && (cd source && autoheader && autoconf) diff --git a/packaging/Mandrake/mount.cifs.8 b/packaging/Mandrake/mount.cifs.8 new file mode 100644 index 0000000000..7ab1be305c --- /dev/null +++ b/packaging/Mandrake/mount.cifs.8 @@ -0,0 +1,181 @@ +.\" This manpage has been automatically generated by docbook2man +.\" from a DocBook document. This tool can be found at: +.\" +.\" Please send any bug reports, improvements, comments, patches, +.\" etc. to Steve Cheng . +.TH "MOUNT.CIFS" "8" "03 August 2002" "" "" +.SH NAME +mount.cifs \- mount using the Common Internet File System (CIFS) +.SH SYNOPSIS + +\fBmount.cifs\fR \fBservice\fR \fBmount-point\fR [ \fB-o options\fR] + +.SH "DESCRIPTION" +.PP +\fBmount.cifs\fR mounts a Linux CIFS filesystem. It +is usually invoked as \fBmount.cifs\fR by +the \fBmount(8)\fR command when using the +"-t cifs" option. This command only works in Linux, and the kernel must +support the cifs filesystem. The CIFS protocol is the successor to the +SMB protocol and is supported by most Windows servers and many other +commercial servers and Network Attached Storage appliances as well as +by the popular Open Source server Samba. +.PP +Options to \fBmount.cifs\fR are specified as a comma-separated +list of key=value pairs. It is possible to send options other +than those listed here, assuming that cifs supports them. If +you get mount failures, check your kernel log for errors on +unknown options. +.PP +\fBmount.cifs\fR is a daemon. After mounting it keeps running until +the mounted cifs is umounted. It will log things that happen +when in daemon mode using the "machine name" mount.cifs, so +typically this output will end up in +\fIlog.mount.cifs\fR. +.SH "OPTIONS" +.TP +\fBusername=\fR +specifies the username to connect as. If +this is not given, then the environment variable \fB USER\fR is used. This option can also take the +form "user%password" or "user/workgroup" or +"user/workgroup%password" to allow the password and workgroup +to be specified as part of the username. +.TP +\fBpassword=\fR +specifies the CIFS password. If this +option is not given then the environment variable +\fBPASSWD\fR is used. If it can find +no password \fBmount.cifs\fR will prompt +for a passeword, unless the guest option is +given. + +Note that password which contain the arguement delimiter +character (i.e. a comma ',') will failed to be parsed correctly +on the command line. However, the same password defined +in the PASSWD environment variable or a credentials file (see +below) will be read correctly. +.TP +\fBcredentials=\fR +specifies a file that contains a username +and/or password. The format of the file is: + + +.nf + username = + password = + +.fi + +This is preferred over having passwords in plaintext in a +shared file, such as \fI/etc/fstab\fR. Be sure to protect any +credentials file properly. +.TP +\fBuid=\fR +sets the uid that will own all files on +the mounted filesystem. +It may be specified as either a username or a numeric uid. +.TP +\fBgid=\fR +sets the gid that will own all files on +the mounted filesystem. +It may be specified as either a groupname or a numeric +gid. +.TP +\fBport=\fR +sets the remote cifs port number. By default +port 445 is tried then if no response port 139 is tried. +.TP +\fBfmask=\fR +sets the file mask. This determines the +permissions that remote files have in the local filesystem. +The default is based on the current umask. +.TP +\fBdmask=\fR +sets the directory mask. This determines the +permissions that remote directories have in the local filesystem. +The default is based on the current umask. +.TP +\fBdebug=\fR +sets the debug level. This is useful for +tracking down cifs connection problems. A suggested value to +start with is 4. If set too high there will be a lot of +output, possibly hiding the useful output. +.TP +\fBip=\fR +sets the destination host or IP address. +.TP +\fBdomain=\fR +sets the domain (workgroup) of the user +.TP +\fBguest\fR +don't prompt for a password +.TP +\fBro\fR +mount read-only +.TP +\fBrw\fR +mount read-write +.TP +\fBiocharset=\fR +sets the charset used by the Linux side for codepage +to charset translations (NLS). Argument should be the +name of a charset, like iso8859-1. (Note: only kernel +2.4.0 or later) +.TP +\fBcodepage=\fR +sets the codepage the server uses. See the iocharset +option. Example value cp850. (Note: only kernel 2.4.0 +or later) +.TP +\fBttl=\fR +how long a directory listing is cached in milliseconds +(also affects visibility of file size and date +changes). A higher value means that changes on the +server take longer to be noticed but it can give +better performance on large directories, especially +over long distances. Default is 1000ms but something +like 10000ms (10 seconds) is probably more reasonable +in many cases. +(Note: only kernel 2.4.2 or later) +.SH "ENVIRONMENT VARIABLES" +.PP +The variable \fBUSER\fR may contain the username of the +person using the client. This information is used only if the +protocol level is high enough to support session-level +passwords. The variable can be used to set both username and +password by using the format username%password. +.PP +The variable \fBPASSWD\fR may contain the password of the +person using the client. This information is used only if the +protocol level is high enough to support session-level +passwords. +.PP +The variable \fBPASSWD_FILE\fR may contain the pathname +of a file to read the password from. A single line of input is +read and used as the password. +.SH "BUGS" +.PP +Passwords and other options containing , can not be handled. +For passwords an alternative way of passing them is in a credentials +file or in the PASSWD environment. +.PP +The credentials file does not handle usernames or passwords with +leading space. +.PP +Note that the typical response to a bug report is suggestion +to try the latest version first. So please try doing that first, +and always include which versions you use of relevant software +when reporting bugs (minimum: samba, kernel, distribution) +.SH "SEE ALSO" +.PP +Documentation/filesystems/cifs.txt in the linux kernel +source tree may contain additional options and information. +.SH "AUTHOR" +.PP +Steve French +The syntax and manpage were loosely based on that of smbmount. +.PP +The current maintainer of the Linux cifs vfs and the userspace +tool \fBmount.cifs\fR is Steve French . +The SAMBA Mailing list +is the preferred place to ask questions regarding these programs. diff --git a/packaging/Mandrake/samba2.spec.tmpl b/packaging/Mandrake/samba2.spec.tmpl index 5d8e03438e..c55da187de 100644 --- a/packaging/Mandrake/samba2.spec.tmpl +++ b/packaging/Mandrake/samba2.spec.tmpl @@ -13,7 +13,7 @@ # cvs should be submitted for inclusion in samba cvs. %define pkg_name samba -%define ver 3.0.0beta2 +%define ver 3.0.0beta3 %define rel 3mdk %define vscanver 0.3.3beta1 %define libsmbmajor 0 @@ -72,17 +72,22 @@ %define build_scanners 0 # CUPS supports functionality for 'printcap name = cups' (9.0 and later): %define build_cupspc 0 +# releases that have chrpath available in main +%define build_chrpath 0 # Set defaults for each version %if %build_mdk92 %define build_cupspc 1 +%define build_chrpath 1 %endif %if %build_mdk91 %define build_cupspc 1 +%define build_chrpath 1 %endif %if %build_mdk90 +%define build_chrpath 1 %endif %if %build_mdk82 @@ -171,6 +176,9 @@ %define message_bugzilla() %(echo -e -n "Please file bug reports for this package at Mandrake bugzilla \\n(http://qa.mandrakesoft.com) under the product name %{1}") %define message_system %(echo -e -n "NOTE: This is a prerelease of samba-%{samba_major}, not intended for production\\n use. Rather these packages are provided, parallel installable\\nwith samba-2.2.x, for testing purposes") +#check gcc version to disable some optimisations on gcc-3.3.1 +%define gcc331 %(gcc -dumpversion|awk '{if ($1>3.3) print 1; else print 0}') + %ifarch alpha %define build_expsam xml %else @@ -223,13 +231,12 @@ Source7: README.%{name}-mandrake-rpm Source8: samba-vscan-%{vscanver}.tar.bz2 %endif Source10: samba-print-pdf.sh.bz2 +Source11: mount.cifs.8.bz2 Patch1: smbw.patch.bz2 -Patch2: samba-2.2.0-gawk.patch.bz2 Patch3: samba-2.2.0-buildroot.patch.bz2 Patch4: samba-3.0-smbmount-sbin.patch.bz2 %if !%have_pversion # Version specific patches: current version -Patch100: samba-3.0.0beta2-mandrake-packaging.patch.bz2 %else # Version specific patches: upcoming version %endif @@ -255,6 +262,9 @@ BuildRequires: libldap-devel %if %build_ads BuildRequires: libldap-devel krb5-devel %endif +%if %build_chrpath +BuildRequires: chrpath +%endif BuildRoot: %{_tmppath}/%{name}-root Prefix: /usr Prereq: /sbin/chkconfig /bin/mktemp /usr/bin/killall @@ -748,13 +758,11 @@ echo -e "\n%{name}-%{version}-%{release}\n">>%{SOURCE7} %endif #%patch111 -p1 %patch1 -p1 -b .smbw -%patch2 -p1 -b .gawk %patch3 -p1 -b .buildroot %patch4 -p1 -b .sbin # Version specific patches: current version %if !%have_pversion echo "Applying patches for current version: %{ver}" -%patch100 -p1 -b .mdk %else # Version specific patches: upcoming version echo "Applying patches for new versions: %{pversion}" @@ -795,21 +803,27 @@ perl -pi -e 's/^# define SAMBA_VERSION_MAJOR 2/# define SAMBA_VERSION_MAJOR 3/g' perl -pi -e 's/%{pkg_name}/%{name}/g' source/auth/pampass.c %endif +#remove cvs internal files from docs: +find docs examples -name '.cvsignore' -exec rm -f {} \; + %build #%serverbuild (cd source -CFLAGS="$RPM_OPT_FLAGS" +CFLAGS=`echo "$RPM_OPT_FLAGS"|sed -e 's/-g//g'` +%if %gcc331 +#CFLAGS=`echo "$CFLAGS"|sed -e 's/-O2/-Os/g'` +%endif # Don't use --with-fhs now, since it overrides libdir, it sets configdir, # lockdir,piddir logfilebase,privatedir and swatdir %configure --prefix=%{_prefix} \ - --sysconfdir=/etc/%{name} \ + --sysconfdir=%{_sysconfdir}/%{name} \ --localstatedir=/var \ --libdir=%{_libdir}/%{name} \ - --with-privatedir=/etc/%{name} \ + --with-privatedir=%{_sysconfdir}/%{name} \ --with-lockdir=/var/cache/%{name} \ --with-piddir=/var/run/%{name} \ --with-swatdir=%{_datadir}/swat%{samba_major} \ - --with-configdir=/etc/%{name} \ + --with-configdir=%{_sysconfdir}/%{name} \ --with-logfilebase=/var/log/%{name} \ %if !%build_ads --with-ads=no \ @@ -846,7 +860,7 @@ perl -pi -e 's/-g //g' Makefile %endif make proto_exists -%make all libsmbclient smbfilter wins modules %{!?_without_test: torture debug2html} bin/editreg +%make all libsmbclient smbfilter wins modules %{!?_without_test: torture debug2html} bin/editreg client/mount.cifs # Build VFS modules (experimental) @@ -906,7 +920,7 @@ mkdir -p $RPM_BUILD_ROOT chmod a+r docs -R # Any entries here mean samba makefile is *really* broken: -mkdir -p $RPM_BUILD_ROOT/etc/%{name} +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/%{name} mkdir -p $RPM_BUILD_ROOT/%{_datadir} mkdir -p $RPM_BUILD_ROOT%{_libdir}/%{name}/vfs @@ -917,8 +931,8 @@ install -m755 source/bin/editreg %{buildroot}/%{_bindir} #need to stay mkdir -p $RPM_BUILD_ROOT/sbin -mkdir -p $RPM_BUILD_ROOT/etc/{logrotate.d,pam.d,xinetd.d} -mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/{logrotate.d,pam.d,xinetd.d} +mkdir -p $RPM_BUILD_ROOT/%{_initrddir} mkdir -p $RPM_BUILD_ROOT/var/cache/%{name} mkdir -p $RPM_BUILD_ROOT/var/log/%{name} mkdir -p $RPM_BUILD_ROOT/var/run/%{name} @@ -975,20 +989,20 @@ done # Install other stuff -# install -m644 examples/VFS/recycle/recycle.conf $RPM_BUILD_ROOT/etc/samba/ - install -m644 packaging/Mandrake/smbusers $RPM_BUILD_ROOT/etc/%{name}/smbusers +# install -m644 examples/VFS/recycle/recycle.conf $RPM_BUILD_ROOT%{_sysconfdir}/samba/ + install -m644 packaging/Mandrake/smbusers $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/smbusers install -m755 packaging/Mandrake/smbprint $RPM_BUILD_ROOT/%{_bindir} #install -m755 packaging/RedHat/smbadduser $RPM_BUILD_ROOT/usr/bin install -m755 packaging/Mandrake/findsmb $RPM_BUILD_ROOT/%{_bindir} - install -m755 packaging/Mandrake/smb.init $RPM_BUILD_ROOT/etc/rc.d/init.d/smb%{samba_major} + install -m755 packaging/Mandrake/smb.init $RPM_BUILD_ROOT/%{_initrddir}/smb%{samba_major} install -m755 packaging/Mandrake/smb.init $RPM_BUILD_ROOT/%{_sbindir}/%{name} - install -m755 packaging/Mandrake/winbind.init $RPM_BUILD_ROOT/etc/rc.d/init.d/winbind%{samba_major} -# install -m755 packaging/Mandrake/wrepld.init $RPM_BUILD_ROOT/etc/rc.d/init.d/wrepld%{samba_major} + install -m755 packaging/Mandrake/winbind.init $RPM_BUILD_ROOT/%{_initrddir}/winbind%{samba_major} +# install -m755 packaging/Mandrake/wrepld.init $RPM_BUILD_ROOT/%{_initrddir}/wrepld%{samba_major} install -m755 packaging/Mandrake/winbind.init $RPM_BUILD_ROOT/%{_sbindir}/winbind%{samba_major} - install -m644 packaging/Mandrake/samba.pamd $RPM_BUILD_ROOT/etc/pam.d/%{name} - install -m644 packaging/Mandrake/system-auth-winbind.pamd $RPM_BUILD_ROOT/etc/pam.d/system-auth-winbind%{samba_major} + install -m644 packaging/Mandrake/samba.pamd $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/%{name} + install -m644 packaging/Mandrake/system-auth-winbind.pamd $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/system-auth-winbind%{samba_major} # - install -m644 %{SOURCE1} $RPM_BUILD_ROOT/etc/logrotate.d/%{name} + install -m644 %{SOURCE1} $RPM_BUILD_ROOT/%{_sysconfdir}/logrotate.d/%{name} # install -m644 packaging/Mandrake/samba-slapd-include.conf $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/samba-slapd.include # Install smbldap-tools scripts: @@ -1018,15 +1032,15 @@ install -m755 examples/LDAP/convertSambaAccount $RPM_BUILD_ROOT/%{_datadir}/%{na # make a conf file for winbind from the default one: cat packaging/Mandrake/smb.conf|sed -e 's/^; winbind/ winbind/g;s/^; obey pam/ obey pam/g; s/^; printer admin = @"D/ printer admin = @"D/g;s/^; password server = \*/ password server = \*/g;s/^; template/ template/g; s/^ security = user/ security = domain/g' > packaging/Mandrake/smb-winbind.conf - install -m644 packaging/Mandrake/smb-winbind.conf $RPM_BUILD_ROOT/etc/%{name}/smb-winbind.conf + install -m644 packaging/Mandrake/smb-winbind.conf $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/smb-winbind.conf # Some inline fixes for smb.conf for non-winbind use -install -m644 packaging/Mandrake/smb.conf $RPM_BUILD_ROOT/etc/%{name}/smb.conf +install -m644 packaging/Mandrake/smb.conf $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/smb.conf cat packaging/Mandrake/smb.conf | \ -sed -e 's/^; printer admin = @adm/ printer admin = @adm/g' >$RPM_BUILD_ROOT/etc/%{name}/smb.conf +sed -e 's/^; printer admin = @adm/ printer admin = @adm/g' >$RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/smb.conf %if %build_cupspc -perl -pi -e 's/printcap name = lpstat/printcap name = cups/g' $RPM_BUILD_ROOT/etc/%{name}/smb.conf -perl -pi -e 's/printcap name = lpstat/printcap name = cups/g' $RPM_BUILD_ROOT/etc/%{name}/smb-winbind.conf +perl -pi -e 's/printcap name = lpstat/printcap name = cups/g' $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/smb.conf +perl -pi -e 's/printcap name = lpstat/printcap name = cups/g' $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/smb-winbind.conf %endif # Link smbmount to /sbin/mount.smb and /sbin/mount.smbfs @@ -1035,7 +1049,12 @@ perl -pi -e 's/printcap name = lpstat/printcap name = cups/g' $RPM_BUILD_ROOT/et ln -s ..%{_bindir}/smbmount%{samba_major} mount.smb%{samba_major} ln -s ..%{_bindir}/smbmount%{samba_major} mount.smbfs%{samba_major} ) - echo 127.0.0.1 localhost > $RPM_BUILD_ROOT/etc/%{name}/lmhosts + +#install mount.cifs +install -m755 source/client/mount.cifs %{buildroot}/sbin +bzcat %{SOURCE11} > %{buildroot}/%{_mandir}/man8/mount.cifs.8 + + echo 127.0.0.1 localhost > $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/lmhosts # Link smbspool to CUPS (does not require installed CUPS) @@ -1044,8 +1063,8 @@ perl -pi -e 's/printcap name = lpstat/printcap name = cups/g' $RPM_BUILD_ROOT/et # xinetd support - mkdir -p $RPM_BUILD_ROOT/etc/xinetd.d - install -m644 %{SOURCE3} $RPM_BUILD_ROOT/etc/xinetd.d/swat%{samba_major} + mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/xinetd.d + install -m644 %{SOURCE3} $RPM_BUILD_ROOT/%{_sysconfdir}/xinetd.d/swat%{samba_major} # menu support @@ -1075,6 +1094,10 @@ bzcat %{SOURCE6} > $RPM_BUILD_ROOT%{_miconsdir}/swat%{samba_major}.png bzcat %{SOURCE10}> $RPM_BUILD_ROOT%{_datadir}/%{name}/scripts/print-pdf +%if %build_chrpath +find %{buildroot}/%{_lib} %{buildroot}/%{_bindir} %{buildroot}/%{_sbindir} %{buildroot}/%{_libdir} -type f -exec chrpath -d {} \; +%endif + # Fix configs when not building system samba: %if !%build_system # Work around non-existent but claimed --program-suffix support :-( @@ -1095,15 +1118,15 @@ for OLD in $FILES; do done # Replace paths in config files and init scripts: for i in smb winbind;do - perl -pi -e 's,/subsys/'$i',/subsys/'$i'%{samba_major},g' $RPM_BUILD_ROOT/etc/rc.d/init.d/${i}%{samba_major} + perl -pi -e 's,/subsys/'$i',/subsys/'$i'%{samba_major},g' $RPM_BUILD_ROOT/%{_initrddir}/${i}%{samba_major} done -for i in /etc/%{name}/smb.conf /etc/rc.d/init.d/smb%{samba_major} %{_sbindir}/%{name} /etc/rc.d/init.d/winbind%{samba_major} %{_sbindir}/winbind%{samba_major} /etc/logrotate.d/%{name} /etc/xinetd.d/swat%{samba_major} /etc/rc.d/init.d/wrepld%{samba_major}; do +for i in %{_sysconfdir}/%{name}/smb.conf %{_initrddir}/smb%{samba_major} %{_sbindir}/%{name} %{_initrddir}/winbind%{samba_major} %{_sbindir}/winbind%{samba_major} /%{_sysconfdir}/logrotate.d/%{name} /%{_sysconfdir}/xinetd.d/swat%{samba_major} %{_initrddir}/wrepld%{samba_major}; do perl -pi -e 's,/%{pkg_name},/%{name},g; s,smbd,%{_sbindir}/smbd%{samba_major},g; s,nmbd,%{_sbindir}/nmbd%{samba_major},g; s,winbindd,%{_sbindir}/winbindd%{samba_major},g; s,/usr/sbin/swat,%{_sbindir}/swat%{samba_major},g;s,wrepld,%{_sbindir}/wrepld%{samba_major},g' $RPM_BUILD_ROOT/$i; done # Fix pam files -perl -pi -e 's/winbind/winbind%{samba_major}/g' $RPM_BUILD_ROOT/etc/pam.d/system-auth-winbind%{samba_major} +perl -pi -e 's/winbind/winbind%{samba_major}/g' $RPM_BUILD_ROOT/%{_sysconfdir}/pam.d/system-auth-winbind%{samba_major} # Fix xinetd file for swat: -perl -pi -e 's,/usr/sbin,%{_sbindir},g' $RPM_BUILD_ROOT/etc/xinetd.d/swat%{samba_major} +perl -pi -e 's,/usr/sbin,%{_sbindir},g' $RPM_BUILD_ROOT/%{_sysconfdir}/xinetd.d/swat%{samba_major} %endif #Clean up unpackaged files: @@ -1145,12 +1168,12 @@ fi %post common # Basic migration script for pre-2.2.1 users, -# since smb config moved from /etc to /etc/samba +# since smb config moved from /etc to %{_sysconfdir}/samba -# Let's create a proper /etc/samba/smbpasswd file -[ -f /etc/%{name}/smbpasswd ] || { +# Let's create a proper %{_sysconfdir}/samba/smbpasswd file +[ -f %{_sysconfdir}/%{name}/smbpasswd ] || { echo "Creating password file for samba..." - touch /etc/%{name}/smbpasswd + touch %{_sysconfdir}/%{name}/smbpasswd } # And this too, in case we don't have smbd to create it for us @@ -1159,46 +1182,46 @@ fi } # Let's define the proper paths for config files -perl -pi -e 's/(\/etc\/)(smb)/\1%{name}\/\2/' /etc/%{name}/smb.conf +perl -pi -e 's/(\/etc\/)(smb)/\1%{name}\/\2/' %{_sysconfdir}/%{name}/smb.conf # Let's replace lpstat with cups in older smb.conf: %if %build_cupspc echo "Updating samba printing configuration if necessary..." -perl -pi -e 's/= lpstat/= cups/' /etc/%{name}/smb.conf +perl -pi -e 's/= lpstat/= cups/' %{_sysconfdir}/%{name}/smb.conf %endif # Fix the logrotate.d file from smb and nmb to smbd and nmbd -if [ -f /etc/logrotate.d/samba ]; then - perl -pi -e 's/smb /smbd /' /etc/logrotate.d/samba - perl -pi -e 's/nmb /nmbd /' /etc/logrotate.d/samba +if [ -f %{_sysconfdir}/logrotate.d/samba ]; then + perl -pi -e 's/smb /smbd /' %{_sysconfdir}/logrotate.d/samba + perl -pi -e 's/nmb /nmbd /' %{_sysconfdir}/logrotate.d/samba fi # And not loose our machine account SID -[ -f /etc/MACHINE.SID ] && mv -f /etc/MACHINE.SID /etc/%{name}/ ||: +[ -f %{_sysconfdir}/MACHINE.SID ] && mv -f %{_sysconfdir}/MACHINE.SID %{_sysconfdir}/%{name}/ ||: %if %build_winbind %post winbind if [ $1 = 1 ]; then /sbin/chkconfig winbind%{samba_major} on - cp -af /etc/nsswitch.conf /etc/nsswitch.conf.rpmsave - cp -af /etc/nsswitch.conf /etc/nsswitch.conf.rpmtemp + cp -af %{_sysconfdir}/nsswitch.conf %{_sysconfdir}/nsswitch.conf.rpmsave + cp -af %{_sysconfdir}/nsswitch.conf %{_sysconfdir}/nsswitch.conf.rpmtemp for i in passwd group;do - grep ^$i /etc/nsswitch.conf |grep -v 'winbind%{samba_major}' >/dev/null + grep ^$i %{_sysconfdir}/nsswitch.conf |grep -v 'winbind%{samba_major}' >/dev/null if [ $? = 0 ];then - echo "Adding a winbind%{samba_major} entry to the $i section of /etc/nsswitch.conf" - awk '/^'$i'/ {print $0 " winbind%{samba_major}"};!/^'$i'/ {print}' /etc/nsswitch.conf.rpmtemp >/etc/nsswitch.conf; - cp -af /etc/nsswitch.conf /etc/nsswitch.conf.rpmtemp + echo "Adding a winbind%{samba_major} entry to the $i section of %{_sysconfdir}/nsswitch.conf" + awk '/^'$i'/ {print $0 " winbind%{samba_major}"};!/^'$i'/ {print}' %{_sysconfdir}/nsswitch.conf.rpmtemp >%{_sysconfdir}/nsswitch.conf; + cp -af %{_sysconfdir}/nsswitch.conf %{_sysconfdir}/nsswitch.conf.rpmtemp else - echo "$i entry found in /etc/nsswitch.conf" + echo "$i entry found in %{_sysconfdir}/nsswitch.conf" fi done - if [ -f /etc/nsswitch.conf.rpmtemp ];then rm -f /etc/nsswitch.conf.rpmtemp;fi + if [ -f %{_sysconfdir}/nsswitch.conf.rpmtemp ];then rm -f %{_sysconfdir}/nsswitch.conf.rpmtemp;fi fi %preun winbind if [ $1 = 0 ]; then - echo "Removing winbind%{samba_major} entries from /etc/nsswitch.conf" - perl -pi -e 's/ winbind%{samba_major}//' /etc/nsswitch.conf + echo "Removing winbind%{samba_major} entries from %{_sysconfdir}/nsswitch.conf" + perl -pi -e 's/ winbind%{samba_major}//' %{_sysconfdir}/nsswitch.conf /sbin/chkconfig winbind%{samba_major} reset fi @@ -1207,13 +1230,13 @@ fi %if %build_wins %post -n nss_wins%{samba_major} if [ $1 = 1 ]; then - cp -af /etc/nsswitch.conf /etc/nsswitch.conf.rpmsave - grep '^hosts' /etc/nsswitch.conf |grep -v 'wins%{samba_major}' >/dev/null + cp -af %{_sysconfdir}/nsswitch.conf %{_sysconfdir}/nsswitch.conf.rpmsave + grep '^hosts' %{_sysconfdir}/nsswitch.conf |grep -v 'wins%{samba_major}' >/dev/null if [ $? = 0 ];then - echo "Adding a wins entry to the hosts section of /etc/nsswitch.conf" - awk '/^hosts/ {print $0 " wins%{samba_major}"};!/^hosts/ {print}' /etc/nsswitch.conf.rpmsave >/etc/nsswitch.conf; + echo "Adding a wins entry to the hosts section of %{_sysconfdir}/nsswitch.conf" + awk '/^hosts/ {print $0 " wins%{samba_major}"};!/^hosts/ {print}' %{_sysconfdir}/nsswitch.conf.rpmsave >%{_sysconfdir}/nsswitch.conf; else - echo "wins entry found in /etc/nsswitch.conf" + echo "wins entry found in %{_sysconfdir}/nsswitch.conf" fi # else # echo "Upgrade, leaving nsswitch.conf intact" @@ -1221,10 +1244,10 @@ fi %preun -n nss_wins%{samba_major} if [ $1 = 0 ]; then - echo "Removing wins entry from /etc/nsswitch.conf" - perl -pi -e 's/ wins%{samba_major}//' /etc/nsswitch.conf + echo "Removing wins entry from %{_sysconfdir}/nsswitch.conf" + perl -pi -e 's/ wins%{samba_major}//' %{_sysconfdir}/nsswitch.conf #else -# echo "Leaving /etc/nsswitch.conf intact" +# echo "Leaving %{_sysconfdir}/nsswitch.conf intact" fi %endif %build_wins @@ -1260,8 +1283,8 @@ fi %postun swat # Remove swat entry from xinetd -if [ $1 = 0 -a -f /etc/xinetd.conf ] ; then -rm -f /etc/xinetd.d/swat%{samba_major} +if [ $1 = 0 -a -f %{_sysconfdir}/xinetd.conf ] ; then +rm -f %{_sysconfdir}/xinetd.d/swat%{samba_major} service xinetd reload &>/dev/null || : fi @@ -1280,7 +1303,7 @@ fi if [ $1 != 0 ]; then [ ! -d /var/lock/samba ] && mkdir -m 0755 /var/lock/samba ||: [ ! -d /var/spool/samba ] && mkdir -m 1777 /var/spool/samba ||: - [ -f /etc/inetd.conf ] && chmod 644 /etc/services /etc/inetd.conf ||: + [ -f %{_sysconfdir}/inetd.conf ] && chmod 644 %{_sysconfdir}/services %{_sysconfdir}/inetd.conf ||: fi %files server @@ -1302,13 +1325,12 @@ fi %{_libdir}/%{name}/vfs/*.so %dir %{_libdir}/%{name}/pdb -#/usr/share/swat -%attr(-,root,root) %config(noreplace) /etc/%{name}/smbusers -%attr(-,root,root) %config %{_initrddir}/smb%{samba_major} -#%attr(-,root,root) %config %{_initrddir}/wrepld%{samba_major} -%attr(-,root,root) %config(noreplace) /etc/logrotate.d/%{name} -%attr(-,root,root) %config(noreplace) /etc/pam.d/%{name} -#%attr(-,root,root) %config(noreplace) /etc/%{name}/samba-slapd.include +%attr(-,root,root) %config(noreplace) %{_sysconfdir}/%{name}/smbusers +%attr(-,root,root) %config(noreplace) %{_initrddir}/smb%{samba_major} +#%attr(-,root,root) %config(noreplace) %{_initrddir}/wrepld%{samba_major} +%attr(-,root,root) %config(noreplace) %{_sysconfdir}/logrotate.d/%{name} +%attr(-,root,root) %config(noreplace) %{_sysconfdir}/pam.d/%{name} +#%attr(-,root,root) %config(noreplace) %{_sysconfdir}/%{name}/samba-slapd.include %{_mandir}/man1/smbstatus*.1* %{_mandir}/man5/smbpasswd*.5* %{_mandir}/man7/samba*.7* @@ -1319,9 +1341,10 @@ fi %{_mandir}/man8/tdbbackup*.8* %{_mandir}/man1/profiles*.1* %{_mandir}/man1/editreg*.1* -%attr(775,root,root) %dir %{_localstatedir}/%{name}/netlogon -%attr(775,root,root) %dir %{_localstatedir}/%{name}/profiles -%attr(775,root,root) %dir %{_localstatedir}/%{name}/printers +%attr(775,root,adm) %dir %{_localstatedir}/%{name}/netlogon +%attr(755,root,root) %dir %{_localstatedir}/%{name}/profiles +%attr(755,root,root) %dir %{_localstatedir}/%{name}/printers +%attr(775,root,adm) %dir %{_localstatedir}/%{name}/printers/* %attr(1777,root,root) %dir /var/spool/%{name} %dir %{_datadir}/%{name} %dir %{_datadir}/%{name}/scripts @@ -1341,36 +1364,38 @@ fi %doc README.%{name}-mandrake-rpm %doc docs %doc examples -%doc swat/README -%attr(-,root,root) %{_datadir}/swat%{samba_major}/using_samba/* +%attr(-,root,root) %{_datadir}/swat%{samba_major}/using_samba/ %files swat %defattr(-,root,root) -%config(noreplace) /etc/xinetd.d/swat%{samba_major} +%config(noreplace) %{_sysconfdir}/xinetd.d/swat%{samba_major} #%attr(-,root,root) /sbin/* %{_sbindir}/swat%{samba_major} %{_menudir}/%{name}-swat %{_miconsdir}/*.png %{_liconsdir}/*.png %{_iconsdir}/*.png -%attr(-,root,root) %{_datadir}/swat%{samba_major}/help/* -%attr(-,root,root) %{_datadir}/swat%{samba_major}/images/* -%attr(-,root,root) %{_datadir}/swat%{samba_major}/include/* +%attr(-,root,root) %{_datadir}/swat%{samba_major}/help/ +%attr(-,root,root) %{_datadir}/swat%{samba_major}/images/ +%attr(-,root,root) %{_datadir}/swat%{samba_major}/include/ %lang(ja) %{_datadir}/swat%{samba_major}/lang/ja %lang(tr) %{_datadir}/swat%{samba_major}/lang/tr %{_mandir}/man8/swat*.8* +%doc swat/README %files client %defattr(-,root,root) %ifnarch alpha /sbin/mount.smb%{samba_major} /sbin/mount.smbfs%{samba_major} +/sbin/mount.cifs %attr(755,root,root) %{_bindir}/smbmount%{samba_major} %attr(4755,root,root) %{_bindir}/smbumount%{samba_major} %attr(4755,root,root) %{_bindir}/smbmnt%{samba_major} %{_mandir}/man8/smbmnt*.8* %{_mandir}/man8/smbmount*.8* %{_mandir}/man8/smbumount*.8* +%{_mandir}/man8/mount.cifs*.8* %else %exclude %{_bindir}/smb*m*nt%{samba_major} %exclude %{_mandir}/man8/smb*m*nt*.8* @@ -1432,6 +1457,7 @@ fi %{_mandir}/man1/smbtree*.1* %{_mandir}/man1/ntlm_auth*.1* %{_mandir}/man7/Samba*.7* +%dir %{_datadir}/swat%{samba_major} %if %build_winbind %files winbind @@ -1441,8 +1467,8 @@ fi %{_bindir}/wbinfo%{samba_major} %attr(755,root,root) /%{_lib}/security/pam_winbind* %attr(755,root,root) /%{_lib}/libnss_winbind%{samba_major}* -%attr(-,root,root) %config /etc/rc.d/init.d/winbind%{samba_major} -%attr(-,root,root) %config(noreplace) /etc/pam.d/system-auth-winbind* +%attr(-,root,root) %config(noreplace) %{_initrddir}/winbind%{samba_major} +%attr(-,root,root) %config(noreplace) %{_sysconfdir}/pam.d/system-auth-winbind* %{_mandir}/man8/winbindd*.8* %{_mandir}/man1/wbinfo*.1* %endif @@ -1567,6 +1593,19 @@ fi %exclude %{_mandir}/man1/smbsh*.1* %changelog +* Mon Jul 28 2003 Buchan Milne 3.0.0-0.beta3.3mdk +- Rebuild for kerberos-1.3 on cooker +- Put printer directories back +- Add mount.cifs +- Go back to standard optimisations + +* Thu Jul 17 2003 Buchan Milne 3.0.0-0.beta3.2mdk +- beta3 +- remove -g from cflags to avoid large static libraries +- drop optimisation from O2 to O1 for gcc 3.3.1 +- own some directories for distriblint's benefit +- use chrpath on distro's that have it to drastically reduce rpmlint score + * Mon Jul 14 2003 Buchan Milne 3.0.0-0.beta2.3mdk - place non-conditional excludes at the end of files list, to prevent causing rpm in Mandrake <=8.2 from segfaulting when processing files. diff --git a/packaging/README b/packaging/README index 1cf147f3f9..74445508e0 100644 --- a/packaging/README +++ b/packaging/README @@ -3,6 +3,7 @@ Date: November 16, 1998 Updates: First Release - 19970819 19981116 20030329 + 20030905 =============================================================================== Note: @@ -17,19 +18,10 @@ packages for distribution via the official samba ftp sites. The files contained here are intended for use only by those wishing to build distribution packages and are NOT considered suitable material for anyone who wants to just install Samba from the pristine source files contained under -the ~/source directory. +the ../source directory. All contributions / modifications / additions / etc. to the packaging files -should be sent to samba-patches@samba.org with the subject marked: - PACKAGING: [add|mod|contrib] Your subject. - -Should you, or anyone you know of, have package build instructions and/or files -that may be of use to the wider community of Samba users please mail the above -account with subject: PACKAGING: [avail] OS xxxxxxxxxx -where xxxxxxxxxx is the operating system platform that may be contributed. - -We will contact the person who is offering to contribute package build details -to ensure that their contribution can be included in the official Samba sources. +should be logged in https://bugzilla.samba.org/. In the event that anyone wishes to contribute package build information please indicate in your response how we may access a suitable system to ensure our @@ -38,9 +30,3 @@ ability to keep the binary distribution itself current with the released source. The future of cooperatively developed software such as Samba depends on the willingness of all partners to share the fruit of their labours. -If you have a compelling need for binary packages for your platform and it is -not available from this packaging repository please notify jht@samba.org. We -can not guarrantee our ability to satisfy your need, but your feedback may help -us to find a solution. - -- John T. diff --git a/packaging/RedHat/filter-requires-samba_rh8.sh b/packaging/RedHat/filter-requires-samba_rh8.sh new file mode 100755 index 0000000000..8428a6ad01 --- /dev/null +++ b/packaging/RedHat/filter-requires-samba_rh8.sh @@ -0,0 +1,2 @@ +#!/bin/sh +/usr/lib/rpm/find-requires $* | egrep -v '(Net::LDAP|CGI)' diff --git a/packaging/RedHat/filter-requires-samba_rh9.sh b/packaging/RedHat/filter-requires-samba_rh9.sh new file mode 100755 index 0000000000..8378523bce --- /dev/null +++ b/packaging/RedHat/filter-requires-samba_rh9.sh @@ -0,0 +1,2 @@ +#!/bin/sh +/usr/lib/rpm/perl.req $* | egrep -v '(Net::LDAP|CGI)' diff --git a/packaging/RedHat/makerpms.sh.tmpl b/packaging/RedHat/makerpms.sh.tmpl index dc82033b06..a37e03a144 100644 --- a/packaging/RedHat/makerpms.sh.tmpl +++ b/packaging/RedHat/makerpms.sh.tmpl @@ -12,16 +12,9 @@ # Note: Under this directory rpm expects to find the same directories that are under the # /usr/src/redhat directory # -if [ -r ~/.rpmmacros ]; then - TOPDIR=`awk '/topdir/ {print $2}' < ~/.rpmmacros` - if [ z$TOPDIR != "z" ]; then - SPECDIR=${TOPDIR}/SPECS - SRCDIR=${TOPDIR}/SOURCES - fi -fi -SPECDIR=${SPECDIR:-/usr/src/redhat/SPECS} -SRCDIR=${SRCDIR:-/usr/src/redhat/SOURCES} +SPECDIR=`rpm --eval %_specdir` +SRCDIR=`rpm --eval %_sourcedir` # At this point the SPECDIR and SRCDIR vaiables must have a value! @@ -29,28 +22,18 @@ USERID=`id -u` GRPID=`id -g` VERSION='PVERSION' SPECFILE="samba3.spec" - RPMVER=`rpm --version | awk '{print $3}'` RPM="rpm" echo The RPM Version on this machine is: $RPMVER +## +## fix the mandir macro +## case $RPMVER in - 2*) - echo Building for RPM v2.x - sed -e "s/MANDIR_MACRO/\%\{prefix\}\/man/g" < samba.spec > $SPECFILE - ;; - 3*) - echo Building for RPM v3.x + [23]*) sed -e "s/MANDIR_MACRO/\%\{prefix\}\/man/g" < samba.spec > $SPECFILE ;; - 4.0*) - ## catch rpm v4.0.x first - echo Building for RPM v4.0 - sed -e "s/MANDIR_MACRO/\%\{_mandir\}/g" < samba.spec > $SPECFILE - ;; - 4.*) - echo Building for RPM v4.1 or later - RPM="rpmbuild" + 4*) sed -e "s/MANDIR_MACRO/\%\{_mandir\}/g" < samba.spec > $SPECFILE ;; *) @@ -59,16 +42,30 @@ case $RPMVER in ;; esac +## +## now catch the right command to build an RPM (defaults ro 'rpm' +## +case $RPMVER in + 4.[12]*) + RPM="rpmbuild" + ;; +esac + +echo "RPM build command is \"$RPM\"" + ( cd ../../source; if [ -f Makefile ]; then make distclean; fi ) ( cd ../../.. ; chown -R ${USERID}.${GRPID} samba-${VERSION} ) ( cd ../../.. ; tar --exclude=CVS -cf - samba-${VERSION}/. | bzip2 > ${SRCDIR}/samba-${VERSION}.tar.bz2 ) -cp -av $SPECFILE ${SPECDIR} +/bin/cp -p filter-requires-samba_rh8.sh ${SRCDIR} +/bin/cp -p filter-requires-samba_rh9.sh ${SRCDIR} +chmod 755 ${SRCDIR}/filter-requires-samba_rh?.sh +/bin/cp -av $SPECFILE ${SPECDIR} echo Getting Ready to build release package cd ${SPECDIR} -${RPM} -ba -v --clean --rmsource $SPECFILE +${RPM} -ba --clean --rmsource $SPECFILE echo Done. diff --git a/packaging/RedHat/samba.spec.tmpl b/packaging/RedHat/samba.spec.tmpl index 4c5a480a27..26e86aa61d 100644 --- a/packaging/RedHat/samba.spec.tmpl +++ b/packaging/RedHat/samba.spec.tmpl @@ -1,3 +1,6 @@ +## grab the major and minor version of rpm +%define rpm_version `rpm --version | awk '{print $3}' | awk -F. '{print $1$2}'` + Summary: Samba SMB client and server Name: samba Version: PVERSION @@ -5,9 +8,15 @@ Release: PRELEASE License: GNU GPL version 2 Group: Networking Source: http://download.samba.org/samba/ftp/samba-%{version}.tar.bz2 + +# Don't depend on Net::LDAP +# one filter for RH 8 and one for 9 +Source998: filter-requires-samba_rh8.sh +Source999: filter-requires-samba_rh9.sh + Packager: Gerald Carter [Samba-Team] Requires: pam >= 0.72 kernel >= 2.2.1 glibc >= 2.1.2 -Prereq: chkconfig fileutils +Prereq: chkconfig fileutils /sbin/ldconfig Provides: samba = %{version} Obsoletes: samba-common, samba-client, samba-swat BuildRoot: %{_tmppath}/%{name}-%{version}-root @@ -37,6 +46,19 @@ docs directory for implementation details. %setup %build + +# Working around perl dependency problem from docs +# Only > RH 8.0 seems to care here + +echo "rpm_version == %{rpm_version}" +if [ "%{rpm_version}" == "42" ]; then + %define __perl_requires %{SOURCE999} + echo "%{__perl_requires}" +elif [ "%{rpm_version}" == "41" ]; then + %define __find_requires %{SOURCE998} + echo "%{__find_requires}" +fi + ## Build main Samba source cd source @@ -94,7 +116,7 @@ mkdir -p $RPM_BUILD_ROOT%{prefix}/{lib,include} # Install standard binary files for i in nmblookup smbclient smbpasswd smbstatus testparm testprns \ rpcclient smbspool smbcacls smbcontrol wbinfo smbmnt net \ - smbcacls pdbedit tdbbackup smbtree + smbcacls pdbedit tdbbackup smbtree ntlm_auth smbcquotas do install -m755 source/bin/$i $RPM_BUILD_ROOT%{prefix}/bin done @@ -123,7 +145,7 @@ make DESTDIR=$RPM_BUILD_ROOT \ LIBDIR=%{prefix}/lib/samba \ VARDIR=/var \ SBINDIR=%{prefix}/sbin \ - BINDIR=$%{prefix}/bin \ + BINDIR=%{prefix}/bin \ MANDIR=MANDIR_MACRO \ SWATDIR=%{prefix}/share/swat \ SAMBABOOK=%{prefix}/share/swat/using_samba \ @@ -147,22 +169,7 @@ install -m 755 source/bin/libsmbclient.so $RPM_BUILD_ROOT%{prefix}/lib/ install -m 755 source/bin/libsmbclient.a $RPM_BUILD_ROOT%{prefix}/lib/ install -m 644 source/include/libsmbclient.h $RPM_BUILD_ROOT%{prefix}/include/ -# Install SWAT helper files -#for i in swat/help/*.html docs/htmldocs/*.html -#do -# install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/help -#done -#for i in swat/images/*.gif -#do -# install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/images -#done -#for i in swat/include/*.html -#do -# install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/include -#done - # Install the miscellany -install -m755 swat/README $RPM_BUILD_ROOT%{prefix}/share/swat/README install -m755 packaging/RedHat/smbprint $RPM_BUILD_ROOT%{prefix}/bin install -m755 packaging/RedHat/smb.init $RPM_BUILD_ROOT/etc/rc.d/init.d/smb install -m755 packaging/RedHat/winbind.init $RPM_BUILD_ROOT/etc/rc.d/init.d/winbind @@ -287,15 +294,13 @@ else rm -f /etc/samba/samba.stack fi -# Create winbind nss client symlink - -if [ -e /lib/libnss_winbind.so ]; then - ln -sf /lib/libnss_winbind.so /lib/libnss_winbind.so.2 -fi +## call ldconfig to create the version symlink for libsmbclient.so +/sbin/ldconfig %preun if [ $1 = 0 ] ; then /sbin/chkconfig --del smb + /sbin/chkconfig --del winbind # We want to remove the browse.dat and wins.dat files so they can not interfer with a new version of samba! if [ -e /var/cache/samba/browse.dat ]; then @@ -366,12 +371,13 @@ if [ $1 = 0 ] ; then fi fi +/sbin/ldconfig + %files %defattr(-,root,root) %doc README COPYING Manifest Read-Manifest-Now %doc WHATSNEW.txt Roadmap %doc docs -%doc swat/README %doc examples %{prefix}/sbin/smbd %{prefix}/sbin/nmbd @@ -399,12 +405,15 @@ fi %{prefix}/bin/smbcontrol %{prefix}/bin/wbinfo %{prefix}/bin/net +%{prefix}/bin/ntlm_auth +%{prefix}/bin/smbcquotas %{prefix}/bin/smbcacls %{prefix}/bin/pdbedit %{prefix}/bin/tdbbackup %{prefix}/bin/smbtree %attr(755,root,root) /lib/libnss_wins.s* %attr(755,root,root) %{prefix}/lib/samba/vfs/*.so +%attr(755,root,root) %{prefix}/lib/samba/charset/*.so #%attr(755,root,root) %{prefix}/lib/samba/pdb/*.so %attr(755,root,root) %{prefix}/lib/samba/*.dat %{prefix}/include/libsmbclient.h @@ -417,7 +426,6 @@ fi %{prefix}/share/swat/lang/*/images/* %{prefix}/share/swat/lang/*/include/*.html %{prefix}/share/swat/using_samba/* -%{prefix}/share/swat/README %config(noreplace) /etc/samba/lmhosts %config(noreplace) /etc/samba/smb.conf %config(noreplace) /etc/samba/smbusers diff --git a/packaging/RedHat/smb.conf b/packaging/RedHat/smb.conf index 71ff946388..5786ec5d04 100644 --- a/packaging/RedHat/smb.conf +++ b/packaging/RedHat/smb.conf @@ -66,7 +66,7 @@ ; smb passwd file = /etc/samba/smbpasswd # The following are needed to allow password changing from Windows to -# update the Linux sytsem password also. +# update the Linux system password also. # NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above. # NOTE2: You do NOT need these to allow workstations to change only # the encrypted SMB passwords. They allow the Unix password diff --git a/packaging/RedHat/smb.init b/packaging/RedHat/smb.init index f50da2c6b2..79f4f322d0 100755 --- a/packaging/RedHat/smb.init +++ b/packaging/RedHat/smb.init @@ -1,6 +1,6 @@ #!/bin/sh # -# chkconfig: 345 91 35 +# chkconfig: 345 81 35 # description: Starts and stops the Samba smbd and nmbd daemons \ # used to provide SMB network services. diff --git a/packaging/RedHat/winbind.init b/packaging/RedHat/winbind.init index 17ddbd502b..1635dca93b 100644 --- a/packaging/RedHat/winbind.init +++ b/packaging/RedHat/winbind.init @@ -1,6 +1,6 @@ #!/bin/sh # -# chkconfig: 345 81 45 +# chkconfig: 345 91 45 # description: Starts and stops the Samba winbind daemon to provide \ # user and group information from a domain controller to linux. @@ -19,16 +19,11 @@ fi # Check that networking is up. [ ${NETWORKING} = "no" ] && exit 0 +CONFIG=/etc/samba/smb.conf + # Check that smb.conf exists. [ -f $CONFIG ] || exit 0 -RETVAL=0 - -CONFIG=/usr/local/samba/lib/smb.conf -PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/samba/sbin:/usr/local/samba/bin -export PATH - - start() { echo -n "Starting Winbind services: " RETVAL=1 diff --git a/packaging/SGI/mkrelease.sh b/packaging/SGI/mkrelease.sh index 6ba486c673..89854300aa 100755 --- a/packaging/SGI/mkrelease.sh +++ b/packaging/SGI/mkrelease.sh @@ -114,6 +114,8 @@ if [ $errstat -ne 0 ]; then echo "Error $errstat creating samba.idb\n"; exit $errstat; fi +sort +4 samba.idb > xxx +mv xxx samba.idb if [ ! -d bins ]; then mkdir bins diff --git a/packaging/SGI/spec.pl b/packaging/SGI/spec.pl index 4541eb04ec..d581db7043 100755 --- a/packaging/SGI/spec.pl +++ b/packaging/SGI/spec.pl @@ -4,15 +4,21 @@ # information in the version.h file in the source tree open (VER,'../../source/include/version.h') || die "Unable to open version.h\n"; -($_ = ) =~ s/"//g; +while ( ) { + chomp; + if ( /SAMBA_VERSION_OFFICIAL_STRING/ ) { + s/^.*SAMBA_VERSION_OFFICIAL_STRING "//; + s/".*$//; + $SambaVersion = $_; + } +} close (VER); -@foo = split(' '); -splice(@foo,0,2); -$_ = $foo[0]; # create the package name -$vername = " id \"Samba Version ".$_."\"\n"; +$vername = " id \"Samba Version ".$SambaVersion."\"\n"; +$_ = $SambaVersion; +s/^.* //; $patch = 0; #create the subsystem version numbers if (/alpha/) { diff --git a/packaging/Solaris/makepkg.sh.tmpl b/packaging/Solaris/makepkg.sh.tmpl new file mode 100755 index 0000000000..55a2da2c6a --- /dev/null +++ b/packaging/Solaris/makepkg.sh.tmpl @@ -0,0 +1,164 @@ +#!/bin/sh +# +# Copyright (C) Shirish A Kalele 2000 +# +# Builds a Samba package from the samba distribution. +# By default, the package will be built to install samba in /usr/local +# Change the INSTALL_BASE variable to change this: will modify the pkginfo +# and samba.server files to point to the new INSTALL_BASE +# +INSTALL_BASE=/usr/local + +add_dynamic_entries() +{ + # Add the binaries, docs and SWAT files + + echo "#\n# Binaries \n#" + cd $DISTR_BASE/source/bin + for binfile in * + do + if [ -f $binfile ]; then + echo f none samba/bin/$binfile=source/bin/$binfile 0755 root other + fi + done + + # Add the scripts to bin/ + echo "#\n# Scripts \n#" + cd $DISTR_BASE/source/script + for shfile in * + do + if [ -f $shfile ]; then + echo f none samba/bin/$shfile=source/script/$shfile 0755 root other + fi + done + + # add libraries to /lib for winbind + echo "#\n# Libraries \n#" + if [ -f $DISTR_BASE/source/nsswitch/libnss_winbind.so ] ; then + echo f none /usr/lib/libnss_winbind.so=source/nsswitch/libnss_winbind.so 0755 root other + echo s none /usr/lib/libnss_winbind.so.1=/usr/lib/libnss_winbind.so 0755 root other + echo s none /usr/lib/libnss_winbind.so.2=/usr/lib/libnss_winbind.so 0755 root other + echo s none /usr/lib/nss_winbind.so.1=/usr/lib/libnss_winbind.so 0755 root other + echo s none /usr/lib/nss_winbind.so.2=/usr/lib/libnss_winbind.so 0755 root other + fi + + # Add the manpages + echo "#\n# man pages \n#" + echo d none /usr ? ? ? + echo d none /usr/share ? ? ? + echo d none /usr/share/man ? ? ? + + # Create directories for man page sections if nonexistent + cd $DISTR_BASE/docs/manpages + for i in 1 2 3 4 5 6 7 8 9 + do + manpages=`ls *.$i 2>/dev/null` + if [ $? -eq 0 ] + then + echo d none /usr/share/man/man$i ? ? ? + for manpage in $manpages + do + echo f none /usr/share/man/man${i}/${manpage}=docs/manpages/$manpage 0644 root other + done + fi + done + + echo "#\n# HTML documentation \n#" + cd $DISTR_BASE + list=`find docs/htmldocs -type d | grep -v "/CVS$"` + for docdir in $list + do + if [ -d $docdir ]; then + echo d none samba/$docdir 0755 root other + fi + done + + list=`find docs/htmldocs -type f | grep -v /CVS/` + for htmldoc in $list + do + if [ -f $htmldoc ]; then + echo f none samba/$htmldoc=$htmldoc 0644 root other + fi + done + + # Create a symbolic link to the Samba book in docs/ for beginners + echo 's none samba/docs/samba_book=htmldocs/using_samba' + + echo "#\n# Text Docs \n#" + echo d none samba/docs/textdocs 0755 root other + cd $DISTR_BASE/docs/textdocs + for textdoc in * + do + if [ -f $textdoc ]; then + echo f none samba/docs/textdocs/$textdoc=docs/textdocs/$textdoc 0644 root other + fi + done + echo "#\n# SWAT \n#" + cd $DISTR_BASE + list=`find swat -type d | grep -v "/CVS$"` + for i in $list + do + echo "d none samba/$i 0755 root other" + done + list=`find swat -type f | grep -v /CVS/` + for i in $list + do + echo "f none samba/$i=$i 0644 root other" + done + echo "#\n# HTML documentation for SWAT\n#" + cd $DISTR_BASE/docs/htmldocs + for htmldoc in * + do + if [ -f $htmldoc ]; then + echo f none samba/swat/help/$htmldoc=docs/htmldocs/$htmldoc 0644 root other + fi + done + + echo "#\n# Using Samba Book files for SWAT\n#" + cd $DISTR_BASE/docs/htmldocs + +# set up a symbolic link instead of duplicating the book tree + echo 's none samba/swat/using_samba=../docs/htmldocs/using_samba' + +} + +if [ $# = 0 ] +then + # Try to guess the distribution base.. + CURR_DIR=`pwd` + DISTR_BASE=`echo $CURR_DIR | sed 's|\(.*\)/packaging.*|\1|'` + echo "Assuming Samba distribution is rooted at $DISTR_BASE.." +else + DISTR_BASE=$1 +fi + +# +if [ ! -d $DISTR_BASE ]; then + echo "Source build directory $DISTR_BASE does not exist." + exit 1 +fi + +# Set up the prototype file from prototype.master +if [ -f prototype ]; then + rm prototype +fi + +# Setup version from version.h +VERSION=PVERSION +sed -e "s|__VERSION__|$VERSION|" -e "s|__ARCH__|`uname -p`|" -e "s|__BASEDIR__|$INSTALL_BASE|g" pkginfo.master >pkginfo + +sed -e "s|__BASEDIR__|$INSTALL_BASE|g" inetd.conf.master >inetd.conf +sed -e "s|__BASEDIR__|$INSTALL_BASE|g" samba.server.master >samba.server + +cp prototype.master prototype + +# Add the dynamic part to the prototype file +(add_dynamic_entries >> prototype) + +# Create the package +pkgmk -o -d /tmp -b $DISTR_BASE -f prototype +if [ $? = 0 ] +then + pkgtrans /tmp samba.pkg samba +fi +echo The samba package is in /tmp diff --git a/packaging/SuSE/samba-mutual-auth.diff b/packaging/SuSE/samba-mutual-auth.diff new file mode 100644 index 0000000000..865f91682a --- /dev/null +++ b/packaging/SuSE/samba-mutual-auth.diff @@ -0,0 +1,247 @@ +--- source/configure.in 22 Feb 2003 12:19:18 -0000 1.409 ++++ source/configure.in 24 Feb 2003 06:04:25 -0000 +@@ -627,6 +627,15 @@ + fi + + ############################################ ++# support for using Kerberos keytab instead of secrets database ++ ++AC_ARG_ENABLE(keytab, ++[ --enable-keytab Turn on support for Kerberos keytabs in lieu of secrets DB (default=no)], ++ [if eval "test x$enable_keytab = xyes"; then ++ AC_DEFINE(USE_KEYTAB,1,[Use Kerberos keytab]) ++ fi]) ++ ++############################################ + # we need dlopen/dlclose/dlsym/dlerror for PAM, the password database plugins and the plugin loading code + AC_SEARCH_LIBS(dlopen, [dl]) + # dlopen/dlclose/dlsym/dlerror will be checked again later and defines will be set then +--- source/passdb/secrets.c 1 Feb 2003 04:39:15 -0000 1.54 ++++ source/passdb/secrets.c 24 Feb 2003 06:04:26 -0000 +@@ -221,6 +221,72 @@ + return True; + } + ++#ifdef USE_KEYTAB ++/************************************************************************ ++ Read local secret from the keytab ++************************************************************************/ ++ ++static BOOL secrets_fetch_keytab_password(uint8 ret_pwd[16], time_t *pass_last_set_time) ++{ ++ char spn[MAXHOSTNAMELEN + 2], *p; ++ krb5_context context; ++ krb5_error_code ret; ++ krb5_principal princ; ++ krb5_keyblock *key; ++ ++ ret = krb5_init_context(&context); ++ if (ret) { ++ DEBUG(1, ("secrets_fetch_keytab_password: failed to initialize Kerberos context\n")); ++ return False; ++ } ++ ++ spn[sizeof(spn) - 1] = '\0'; ++ if (gethostname(spn, sizeof(spn) - 2) < 0) { ++ DEBUG(1, ("secrets_fetch_keytab_password: could not determine local hostname\n")); ++ krb5_free_context(context); ++ return False; ++ } ++ ++ for (p = spn; *p && *p != '.'; p++) ++ *p = toupper(*p); ++ *p++ = '$'; ++ *p = '\0'; ++ ++ ret = krb5_parse_name(context, spn, &princ); ++ if (ret) { ++ DEBUG(1, ("secrets_fetch_keytab_password: failed to parse name %s\n", spn)); ++ krb5_free_context(context); ++ return False; ++ } ++ ++#ifdef ENCTYPE_ARCFOUR_HMAC ++ ret = krb5_kt_read_service_key(context, NULL, princ, 0, ENCTYPE_ARCFOUR_HMAC, &key); ++#elif defined(HAVE_ENCTYPE_ARCFOUR_HMAC_MD5) ++ ret = krb5_kt_read_service_key(context, NULL, princ, 0, ENCTYPE_ARCFOUR_HMAC_MD5, &key); ++#else ++#error ENCTYPE_ARCFOUR_HMAC or ENCTYPE_ARCFOUR_HMAC_MD5 required for keytab secret storage ++#endif ++ if (ret) { ++ DEBUG(1, ("secrets_fetch_keytab_password: failed to read secret for %s\n", spn)); ++ krb5_free_context(context); ++ return False; ++ } ++ if (key->keyvalue.length != 16) { ++ DEBUG(1, ("secrets_fetch_keytab_password: key is incorrect length\n")); ++ krb5_free_context(context); ++ return False; ++ } ++ ++ memcpy(ret_pwd, key->keyvalue.data, key->keyvalue.length); ++ time(pass_last_set_time); /* XXX */ ++ ++ krb5_free_keyblock(context, key); ++ krb5_free_context(context); ++ ++ return True; ++} ++#endif /* USE_KEYTAB */ ++ + /************************************************************************ + Routine to get the trust account password for a domain. + The user of this function must have locked the trust password file using +@@ -243,6 +309,12 @@ + pass_last_set_time = 0; + return True; + } ++ ++#ifdef USE_KEYTAB ++ if (is_myworkgroup(domain)) { ++ return secrets_fetch_keytab_password(ret_pwd, pass_last_set_time); ++ } ++#endif /* USE_KEYTAB */ + + if (!(pass = secrets_fetch(trust_keystr(domain), &size))) { + DEBUG(5, ("secrets_fetch failed!\n")); + +--- source/libsmb/clikrb5.c 2003-07-02 00:32:55.000000000 +0200 ++++ source/libsmb/clikrb5.c 2003-07-02 00:37:22.000000000 +0200 +@@ -316,11 +316,13 @@ + krb5_enctype enc_types[] = { + #ifdef ENCTYPE_ARCFOUR_HMAC + ENCTYPE_ARCFOUR_HMAC, ++#elif defined(HAVE_ENCTYPE_ARCFOUR_HMAC_MD5) ++ ENCTYPE_ARCFOUR_HMAC_MD5, + #endif + ENCTYPE_DES_CBC_MD5, + ENCTYPE_DES_CBC_CRC, + ENCTYPE_NULL}; +- ++ + retval = krb5_init_context(&context); + if (retval) { + DEBUG(1,("krb5_init_context failed (%s)\n", +@@ -367,24 +369,26 @@ + + BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, uint8 session_key[16]) + { +-#ifdef ENCTYPE_ARCFOUR_HMAC + krb5_keyblock *skey; +-#endif + BOOL ret = False; + + memset(session_key, 0, 16); + +-#ifdef ENCTYPE_ARCFOUR_HMAC ++#if defined(ENCTYPE_ARCFOUR_HMAC) || defined(HAVE_ENCTYPE_ARCFOUR_HMAC_MD5) + if (krb5_auth_con_getremotesubkey(context, auth_context, &skey) == 0 && skey != NULL) { + if (KRB5_KEY_TYPE(skey) == ++# ifdef ENCTYPE_ARCFOUR_HMAC + ENCTYPE_ARCFOUR_HMAC ++# else ++ ENCTYPE_ARCFOUR_HMAC_MD5 ++# endif /* ENCTYPE_ARCFOUR_HMAC */ + && KRB5_KEY_LENGTH(skey) == 16) { + memcpy(session_key, KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey)); + ret = True; + } + krb5_free_keyblock(context, skey); + } +-#endif /* ENCTYPE_ARCFOUR_HMAC */ ++#endif /* ENCTYPE_ARCFOUR_HMAC || HAVE_ENCTYPE_ARCFOUR_HMAC_MD5 */ + + return ret; + } +@@ -395,5 +399,12 @@ + DEBUG(0,("NO KERBEROS SUPPORT\n")); + return data_blob(NULL, 0); + } ++BOOL krb5_get_smb_session_key(krb5_context context, krb5_auth_context ac, uint8 session_key[16]) ++ { ++ DEBUG(0,("NO KERBEROS SUPPORT\n")); ++ memset(session_key, 0, 16); ++ return False; ++ } ++ //#endif + + #endif +--- source/libads/kerberos_verify.c 2003-06-28 23:40:55.000000000 +0200 ++++ source/libads/kerberos_verify.c 2003-07-02 00:50:13.000000000 +0200 +@@ -38,7 +38,9 @@ + krb5_keytab keytab = NULL; + krb5_data packet; + krb5_ticket *tkt = NULL; +- int ret, i; ++ int ret; ++#ifndef USE_KEYTAB ++ int i; + krb5_keyblock * key; + krb5_principal host_princ; + char *host_princ_s; +@@ -46,8 +48,10 @@ + char *password_s; + krb5_data password; + krb5_enctype *enctypes = NULL; ++#endif /* USE_KEYTAB */ + BOOL auth_ok = False; + ++#ifndef USE_KEYTAB + if (!secrets_init()) { + DEBUG(1,("secrets_init failed\n")); + return NT_STATUS_LOGON_FAILURE; +@@ -61,6 +65,7 @@ + + password.data = password_s; + password.length = strlen(password_s); ++#endif /* USE_KEYTAB */ + + ret = krb5_init_context(&context); + if (ret) { +@@ -82,7 +87,16 @@ + DEBUG(1,("krb5_auth_con_init failed (%s)\n", error_message(ret))); + return NT_STATUS_LOGON_FAILURE; + } ++#ifdef USE_KEYTAB ++ packet.length = ticket->length; ++ packet.data = (krb5_pointer)ticket->data; + ++ if (!(ret = krb5_rd_req(context, &auth_context, &packet, ++ NULL, keytab, NULL, &tkt))) { ++ auth_ok = True; ++ } ++ ++#else + fstrcpy(myname, global_myname()); + strlower(myname); + asprintf(&host_princ_s, "HOST/%s@%s", myname, lp_realm()); +@@ -121,6 +135,9 @@ + } + } + ++ SAFE_FREE(key); ++#endif /* USE_KEYTAB */ ++ + if (!auth_ok) { + DEBUG(3,("krb5_rd_req with auth failed (%s)\n", + error_message(ret))); +--- source/Makefile.in 2003-07-01 23:35:49.000000000 +0200 ++++ source/Makefile.in 2003-07-02 01:20:09.000000000 +0200 +@@ -806,7 +806,7 @@ + + bin/pdbedit@EXEEXT@: $(PDBEDIT_OBJ) @BUILD_POPT@ bin/.dummy + @echo Linking $@ +- @$(CC) $(FLAGS) -o $@ $(IDMAP_LIBS) $(PDBEDIT_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(PASSDBLIBS) ++ @$(CC) $(FLAGS) -o $@ $(IDMAP_LIBS) $(PDBEDIT_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(PASSDBLIBS) $(KRB5LIBS) + + bin/samtest@EXEEXT@: $(SAMTEST_OBJ) @BUILD_POPT@ bin/.dummy + @echo Linking $@ +@@ -1062,7 +1062,7 @@ + + bin/wbinfo@EXEEXT@: $(WBINFO_OBJ) @BUILD_POPT@ bin/.dummy + @echo Linking $@ +- @$(LINK) -o $@ $(WBINFO_OBJ) $(LIBS) @POPTLIBS@ ++ @$(LINK) -o $@ $(WBINFO_OBJ) $(LIBS) @POPTLIBS@ $(KRB5LIBS) + + bin/ntlm_auth@EXEEXT@: $(NTLM_AUTH_OBJ) $(PARAM_OBJ) $(LIB_OBJ) \ + $(UBIQX_OBJ) @BUILD_POPT@ bin/.dummy diff --git a/packaging/SuSE/samba-vscan-0.3.2b.tar.bz2 b/packaging/SuSE/samba-vscan-0.3.2b.tar.bz2 new file mode 100755 index 0000000000..2680bed82f Binary files /dev/null and b/packaging/SuSE/samba-vscan-0.3.2b.tar.bz2 differ diff --git a/packaging/SuSE/samba3-3.0.0-Makefiles-heimdal.diff b/packaging/SuSE/samba3-3.0.0-Makefiles-heimdal.diff new file mode 100644 index 0000000000..13da47e740 --- /dev/null +++ b/packaging/SuSE/samba3-3.0.0-Makefiles-heimdal.diff @@ -0,0 +1,22 @@ +--- examples/pdb/Makefile Thu Sep 5 02:11:41 2002 ++++ examples/pdb/Makefile Thu Sep 5 02:11:59 2002 +@@ -8,7 +8,7 @@ + SAMBA_INCL = ../../source/include + UBIQX_SRC = ../../source/ubiqx + SMBWR_SRC = ../../source/smbwrapper +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -Wall -g ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -Wall -g -I/usr/include/heimdal + PDB_OBJS = pdb_test.so + + # Default target +--- examples/VFS/Makefile.in 2003-06-04 15:13:41.000000000 +0200 ++++ examples/VFS/Makefile.in 2003-06-04 22:07:03.000000000 +0200 +@@ -7,7 +7,7 @@ + SAMBA_SOURCE = @SAMBA_SOURCE@ + SHLIBEXT = @SHLIBEXT@ + OBJEXT = @OBJEXT@ +-FLAGS = $(CFLAGS) -Iinclude -I$(SAMBA_SOURCE)/include -I$(SAMBA_SOURCE)/ubiqx -I$(SAMBA_SOURCE)/smbwrapper -I. $(CPPFLAGS) -I$(SAMBA_SOURCE) ++FLAGS = $(CFLAGS) -Iinclude -I$(SAMBA_SOURCE)/include -I$(SAMBA_SOURCE)/ubiqx -I$(SAMBA_SOURCE)/smbwrapper -I. $(CPPFLAGS) -I$(SAMBA_SOURCE) -I/usr/include/heimdal + + + prefix = @prefix@ diff --git a/packaging/SuSE/samba3-3.0.0-heimdal-06.diff b/packaging/SuSE/samba3-3.0.0-heimdal-06.diff new file mode 100644 index 0000000000..87dd3e1824 --- /dev/null +++ b/packaging/SuSE/samba3-3.0.0-heimdal-06.diff @@ -0,0 +1,14 @@ +--- source/include/ads.h 2003-06-10 08:51:03.000000000 +0200 ++++ source/include/ads.h 2003-06-22 23:14:24.000000000 +0200 +@@ -215,9 +215,11 @@ + #define ENCTYPE_ARCFOUR_HMAC ENCTYPE_ARCFOUR_HMAC_MD5 + #endif + ++#if 0 + /* The older versions of heimdal that don't have this + define don't seem to use it anyway. I'm told they + always use a subkey */ + #ifndef AP_OPTS_USE_SUBKEY + #define AP_OPTS_USE_SUBKEY 0 + #endif ++#endif diff --git a/packaging/SuSE/samba3-3.0.0-pdb.diff b/packaging/SuSE/samba3-3.0.0-pdb.diff new file mode 100644 index 0000000000..0c811b57c5 --- /dev/null +++ b/packaging/SuSE/samba3-3.0.0-pdb.diff @@ -0,0 +1,13 @@ +--- examples/pdb/pdb_test.c 26 Sep 2002 18:37:54 -0000 1.1.2.3 ++++ examples/pdb/pdb_test.c 22 Apr 2003 20:06:31 -0000 +@@ -142,8 +142,6 @@ + int init_module(void); + + int init_module() { +- if(smb_register_passdb("testsam", testsam_init, PASSDB_INTERFACE_VERSION)) +- return 0; +- +- return 1; ++ smb_register_passdb(PASSDB_INTERFACE_VERSION, "testsam", testsam_init); ++ return True; + } diff --git a/packaging/SuSE/samba3-Makefile.diff b/packaging/SuSE/samba3-Makefile.diff new file mode 100644 index 0000000000..bc1ad142d9 --- /dev/null +++ b/packaging/SuSE/samba3-Makefile.diff @@ -0,0 +1,16 @@ +--- source/Makefile.in 2003-04-23 10:43:06.000000000 +0200 ++++ source/Makefile.in 2003-04-23 10:45:39.000000000 +0200 +@@ -673,6 +673,13 @@ + @echo "Using FLAGS = $(FLAGS)" + @echo " FLAGS32 = $(FLAGS32)" + @echo " LIBS = $(LIBS)" ++ @echo " TERMLIBS = $(TERMLIBS)" ++ @echo " PRINTLIBS = $(PRINTLIBS)" ++ @echo " AUTHLIBS = $(AUTHLIBS)" ++ @echo " ACLLIBS = $(ACLLIBS)" ++ @echo " PASSDBLIBS = $(PASSDBLIBS)" ++ @echo " ADSLIBS = $(ADSLIBS)" ++ @echo " KRB5LIBS = $(KRB5_LIBS)" + @echo " LDSHFLAGS = $(LDSHFLAGS)" + @echo " LDFLAGS = $(LDFLAGS)" + diff --git a/packaging/SuSE/samba3-com_err.diff b/packaging/SuSE/samba3-com_err.diff new file mode 100644 index 0000000000..c5d04cebe1 --- /dev/null +++ b/packaging/SuSE/samba3-com_err.diff @@ -0,0 +1,60 @@ +--- source/libads/kerberos.c 23 Oct 2002 00:02:26 -0000 1.18 ++++ source/libads/kerberos.c 1 Jul 2003 21:30:17 -0000 +@@ -126,6 +126,7 @@ + return KRB5_LIBOS_CANTREADPWD; + } + ++ initialize_krb5_error_table(); + ret = kerberos_kinit_password(s, ads->auth.password, ads->auth.time_offset); + + if (ret) { +--- source/libads/kerberos_verify.c 6 Jun 2003 14:53:22 -0000 1.10.2.1 ++++ source/libads/kerberos_verify.c 1 Jul 2003 21:30:17 -0000 +@@ -62,6 +62,7 @@ + password.data = password_s; + password.length = strlen(password_s); + ++ initialize_krb5_error_table(); + ret = krb5_init_context(&context); + if (ret) { + DEBUG(1,("krb5_init_context failed (%s)\n", error_message(ret))); +--- source/libads/krb5_setpw.c 6 Jun 2003 14:53:22 -0000 1.16.2.1 ++++ source/libads/krb5_setpw.c 1 Jul 2003 21:30:17 -0000 +@@ -470,6 +470,7 @@ + krb5_creds creds, *credsp; + krb5_ccache ccache; + ++ initialize_krb5_error_table(); + ret = krb5_init_context(&context); + if (ret) { + DEBUG(1,("Failed to init krb5 context (%s)\n", error_message(ret))); +@@ -584,6 +585,7 @@ + krb5_creds creds; + char *chpw_princ = NULL, *password; + ++ initialize_krb5_error_table(); + ret = krb5_init_context(&context); + if (ret) { + DEBUG(1,("Failed to init krb5 context (%s)\n", error_message(ret))); +--- source/libsmb/clikrb5.c 1 Jul 2003 14:40:37 -0000 1.36.2.2 ++++ source/libsmb/clikrb5.c 1 Jul 2003 21:30:20 -0000 +@@ -320,7 +320,8 @@ + ENCTYPE_DES_CBC_MD5, + ENCTYPE_DES_CBC_CRC, + ENCTYPE_NULL}; +- ++ ++ initialize_krb5_error_table(); + retval = krb5_init_context(&context); + if (retval) { + DEBUG(1,("krb5_init_context failed (%s)\n", +--- source/utils/net_lookup.c 1 Jul 2003 14:40:47 -0000 1.8.2.1 ++++ source/utils/net_lookup.c 1 Jul 2003 21:30:24 -0000 +@@ -177,6 +177,7 @@ + krb5_data realm; + char **realms; + ++ initialize_krb5_error_table(); + rc = krb5_init_context(&ctx); + if (rc) { + DEBUG(1,("krb5_init_context failed (%s)\n", diff --git a/packaging/SuSE/samba3-net_ads_password.diff b/packaging/SuSE/samba3-net_ads_password.diff new file mode 100644 index 0000000000..cc800fb7bf --- /dev/null +++ b/packaging/SuSE/samba3-net_ads_password.diff @@ -0,0 +1,58 @@ +Index: source/utils/net_ads.c +=================================================================== +RCS file: /cvsroot/samba/source/utils/net_ads.c,v +retrieving revision 1.37.2.22 +diff -u -r1.37.2.22 net_ads.c +--- source/utils/net_ads.c 10 Jun 2003 04:15:55 -0000 1.37.2.22 ++++ source/utils/net_ads.c 20 Jun 2003 19:59:36 -0000 +@@ -44,9 +44,9 @@ + "\n\tdump the machine account details to stdout\n" + "\nnet ads lookup"\ + "\n\tperform a CLDAP search on the server\n" +-"\nnet ads password -Uadmin_username@realm%%admin_pass"\ ++"\nnet ads password -Uadmin_username@realm%%admin_pass"\ + "\n\tchange a user's password using an admin account"\ +-"\n\t(note: use realm in UPPERCASE)\n"\ ++"\n\t(note: use realm in UPPERCASE, prompts if password is obmitted)\n"\ + "\nnet ads changetrustpw"\ + "\n\tchange the trust account password of this machine in the AD tree\n"\ + "\nnet ads printer [info | publish | remove] "\ +@@ -909,7 +909,7 @@ + } + + +- if (argc != 1) { ++ if (argc < 1) { + d_printf("ERROR: You must say which username to change password for\n"); + return -1; + } +@@ -941,22 +941,24 @@ + return -1; + } + +- asprintf(&prompt, "Enter new password for %s:", user); +- +- new_password = getpass(prompt); ++ if (argv[1]) { ++ new_password = (char *)argv[1]; ++ } else { ++ asprintf(&prompt, "Enter new password for %s:", user); ++ new_password = getpass(prompt); ++ free(prompt); ++ } + + ret = kerberos_set_password(ads->auth.kdc_server, auth_principal, + auth_password, user, new_password, ads->auth.time_offset); + if (!ADS_ERR_OK(ret)) { + d_printf("Password change failed :-( ...\n"); + ads_destroy(&ads); +- free(prompt); + return -1; + } + + d_printf("Password change for %s completed.\n", user); + ads_destroy(&ads); +- free(prompt); + + return 0; + } diff --git a/packaging/SuSE/samba3-smbwrapper.diff b/packaging/SuSE/samba3-smbwrapper.diff new file mode 100644 index 0000000000..0f7b391de0 --- /dev/null +++ b/packaging/SuSE/samba3-smbwrapper.diff @@ -0,0 +1,11 @@ +--- source/smbwrapper/smbsh.c.orig 2003-05-04 19:47:39.000000000 +0200 ++++ source/smbwrapper/smbsh.c 2003-05-04 19:47:47.000000000 +0200 +@@ -36,7 +36,7 @@ + int main(int argc, char *argv[]) + { + char *p, *u; +- const char *libd = dyn_BINDIR; ++ const char *libd = dyn_LIBDIR; + pstring line, wd; + int opt; + extern char *optarg; diff --git a/packaging/SuSE/samba3-vscan.diff b/packaging/SuSE/samba3-vscan.diff new file mode 100644 index 0000000000..330b470af2 --- /dev/null +++ b/packaging/SuSE/samba3-vscan.diff @@ -0,0 +1,269 @@ +--- examples/VFS/samba-vscan-0.3.2b/fprot/Makefile 2003-01-14 00:42:15.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/fprot/Makefile 2003-04-09 20:21:37.000000000 +0200 +@@ -14,7 +14,7 @@ + SMBWR_SRC = ../../../../source/smbwrapper + SMBVS_INCL = ../include + SMBVS_GLB = ../global +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC -I/usr/include/heimdal + VFS_OBJS = vscan-fprotd.so + SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c $(SMBVS_GLB)/vscan-fileaccesslog.c vscan-fprotd.c vscan-fprotd_core.c vscan-fprotd.h vscan-fprotd_core.h + OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-fileaccesslog.lo vscan-fprotd.lo vscan-fprotd_core.lo +--- examples/VFS/samba-vscan-0.3.2b/fprot/vscan-fprotd.c 2003-02-21 21:37:44.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/fprot/vscan-fprotd.c 2003-04-09 20:25:25.000000000 +0200 +@@ -432,14 +432,14 @@ + rc = vscan_do_infected_file_action(&default_vfs_ops, conn, filepath, quarantine_dir, quarantine_prefix, infected_file_action); + + /* add/update file. mark file as infected! */ +- lrufiles_add(filepath, stat_buf.st_mtime, TRUE); ++ lrufiles_add(filepath, stat_buf.st_mtime, True); + + /* virus found, deny acces */ + errno = EACCES; + return -1; + } else if ( retval == 0 ) { + /* file is clean, add to lrufiles */ +- lrufiles_add(filepath, stat_buf.st_mtime, FALSE); ++ lrufiles_add(filepath, stat_buf.st_mtime, False); + } + } + +--- examples/VFS/samba-vscan-0.3.2b/fprot/vscan-fprotd_core.c 2003-01-25 18:40:57.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/fprot/vscan-fprotd_core.c 2003-04-09 20:23:31.000000000 +0200 +@@ -110,7 +110,7 @@ + pstring fprotdCommand; /* the command line to be send to daemon */ + char *str; + FILE *fpin, *fpout; +- bool received_data = FALSE; /* indicates, if any response from deamon was received */ ++ bool received_data = False; /* indicates, if any response from deamon was received */ + + /* open stream sockets */ + fpin = fdopen(sockfd, "r"); +@@ -159,7 +159,7 @@ + + while ( (fgets(recvline, MAXLINE, fpin)) != NULL ) { + +- received_data = TRUE; ++ received_data = True; + + /* ignore the HTTP response header, remove any leading + white spaces */ +--- examples/VFS/samba-vscan-0.3.2b/icap/Makefile 2003-01-30 00:53:02.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/icap/Makefile 2003-04-09 20:21:37.000000000 +0200 +@@ -15,7 +15,7 @@ + SMBWR_SRC = ../../../../source/smbwrapper + SMBVS_INCL = ../include + SMBVS_GLB = ../global +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC -I/usr/include/heimdal + VFS_OBJS = vscan-icap.so + SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c $(SMBVS_GLB)/vscan-fileaccesslog.c vscan-icap.c vscan-icap_core.c vscan-icap.h vscan-icap_core.h + OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-fileaccesslog.lo vscan-icap.lo vscan-icap_core.lo +--- examples/VFS/samba-vscan-0.3.2b/icap/vscan-icap.c 2003-02-21 21:37:50.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/icap/vscan-icap.c 2003-04-09 20:32:20.000000000 +0200 +@@ -413,14 +413,14 @@ + rc = vscan_do_infected_file_action(&default_vfs_ops, conn, filepath, quarantine_dir, quarantine_prefix, infected_file_action); + + /* add/update file. mark file as infected! */ +- lrufiles_add(filepath, stat_buf.st_mtime, TRUE); ++ lrufiles_add(filepath, stat_buf.st_mtime, True); + + /* virus found, deny acces */ + errno = EACCES; + return -1; + } else if ( retval == 0 ) { + /* file is clean, add to lrufiles */ +- lrufiles_add(filepath, stat_buf.st_mtime, FALSE); ++ lrufiles_add(filepath, stat_buf.st_mtime, False); + } + } + +--- examples/VFS/samba-vscan-0.3.2b/icap/vscan-icap_core.c 2003-01-15 00:19:18.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/icap/vscan-icap_core.c 2003-04-09 20:30:56.000000000 +0200 +@@ -114,8 +114,8 @@ + char buf[BUFLEN]; + char recvline[MAXLINE + 1]; + char *str; +- bool first_line = FALSE; /* first line we've received? */ +- bool infected = FALSE; /* an infected found? */ ++ bool first_line = False; /* first line we've received? */ ++ bool infected = False; /* an infected found? */ + + + /* get file length */ +@@ -213,7 +213,7 @@ + /* set line buffering */ + setvbuf(fpin, (char *)NULL, _IOLBF, 0); + +- first_line = TRUE; ++ first_line = True; + while ( (fgets(recvline, MAXLINE, fpin)) != NULL ) { + str = recvline; + if ( first_line ) { +@@ -226,7 +226,7 @@ + return(0); + } + else if ( strncmp("403", str, 3) == 0 ) { +- infected = TRUE; ++ infected = True; + } else { + if ( verbose_file_logging ) + vscan_syslog("ERROR: file %s not found, not readable or an error occured", scan_file); +@@ -241,7 +241,7 @@ + return(-1); + } + +- first_line = FALSE; ++ first_line = False; + } + if ( infected ) { + if ( strncmp("X-Infection-Found", str, 17) == 0 ) { +--- examples/VFS/samba-vscan-0.3.2b/include/vscan-global.h 2002-11-25 16:48:10.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/include/vscan-global.h 2003-04-09 20:21:37.000000000 +0200 +@@ -93,7 +93,7 @@ + */ + + #ifndef SAMBA_VERSION_MAJOR +-# define SAMBA_VERSION_MAJOR 2 ++# define SAMBA_VERSION_MAJOR 3 + #endif + + #ifndef SAMBA_VERSION_MINOR +--- examples/VFS/samba-vscan-0.3.2b/kaspersky/Makefile 2003-02-20 15:41:32.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/kaspersky/Makefile 2003-04-09 20:21:37.000000000 +0200 +@@ -23,9 +23,9 @@ + VFS_OBJS = vscan-kavp.so + + ifdef USE_DEBUG +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC -I/usr/include/heimdal + else +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC -I/usr/include/heimdal + endif + + ifndef USE_KAVPSHAREDLIB +--- examples/VFS/samba-vscan-0.3.2b/mks/Makefile 2003-01-19 18:09:53.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/mks/Makefile 2003-04-09 20:21:37.000000000 +0200 +@@ -16,10 +16,10 @@ + SMBWR_SRC = ../../../../source/smbwrapper + SMBVS_INCL = ../include + SMBVS_GLB = ../global +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC -I/usr/include/heimdal + + ifdef USE_INCLMKSDLIB +-CFLAGS=-I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -D_USE_INCL_MKSD_LIB=1 -fPIC ++CFLAGS=-I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -D_USE_INCL_MKSD_LIB=1 -fPIC -I/usr/include/heimdal + endif + + VFS_OBJS = vscan-mksd.so +--- examples/VFS/samba-vscan-0.3.2b/mks/vscan-mksd.c 2003-02-21 21:37:50.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/mks/vscan-mksd.c 2003-04-09 20:38:16.000000000 +0200 +@@ -393,14 +393,14 @@ + rc = vscan_do_infected_file_action(&default_vfs_ops, conn, filepath, quarantine_dir, quarantine_prefix, infected_file_action); + + /* add/update file. mark file as infected! */ +- lrufiles_add(filepath, stat_buf.st_mtime, TRUE); ++ lrufiles_add(filepath, stat_buf.st_mtime, True); + + /* virus found, deny acces */ + errno = EACCES; + return -1; + } else if ( retval == 0 ) { + /* file is clean, add to lrufiles */ +- lrufiles_add(filepath, stat_buf.st_mtime, FALSE); ++ lrufiles_add(filepath, stat_buf.st_mtime, False); + } + } + +--- examples/VFS/samba-vscan-0.3.2b/openantivirus/Makefile 2003-01-30 00:53:08.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/openantivirus/Makefile 2003-04-09 20:21:37.000000000 +0200 +@@ -15,7 +15,7 @@ + SMBWR_SRC = ../../../../source/smbwrapper + SMBVS_INCL = ../include + SMBVS_GLB = ../global +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC -I/usr/include/heimdal + VFS_OBJS = vscan-oav.so + SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c $(SMBVS_GLB)/vscan-fileaccesslog.c vscan-oav.c vscan-oav_core.c vscan-oav.h vscan-oav_core.h + OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-fileaccesslog.lo vscan-oav.lo vscan-oav_core.lo +--- examples/VFS/samba-vscan-0.3.2b/openantivirus/vscan-oav.c 2003-02-21 21:37:51.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/openantivirus/vscan-oav.c 2003-04-09 20:40:53.000000000 +0200 +@@ -417,14 +417,14 @@ + rc = vscan_do_infected_file_action(&default_vfs_ops, conn, filepath, quarantine_dir, quarantine_prefix, infected_file_action); + + /* add/update file. mark file as infected! */ +- lrufiles_add(filepath, stat_buf.st_mtime, TRUE); ++ lrufiles_add(filepath, stat_buf.st_mtime, True); + + /* virus found, deny acces */ + errno = EACCES; + return -1; + } else if ( retval == 0 ) { + /* file is clean, add to lrufiles */ +- lrufiles_add(filepath, stat_buf.st_mtime, FALSE); ++ lrufiles_add(filepath, stat_buf.st_mtime, False); + } + } + +--- examples/VFS/samba-vscan-0.3.2b/sophos/Makefile 2003-01-30 00:53:08.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/sophos/Makefile 2003-04-09 20:21:37.000000000 +0200 +@@ -15,7 +15,7 @@ + SMBWR_SRC = ../../../../source/smbwrapper + SMBVS_INCL = ../include + SMBVS_GLB = ../global +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC -I/usr/include/heimdal + VFS_OBJS = vscan-sophos.so + SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c $(SMBVS_GLB)/vscan-fileaccesslog.c vscan-sophos.c vscan-sophos_core.c vscan-sophos.h vscan-sophos_core.h + OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-fileaccesslog.lo vscan-sophos.lo vscan-sophos_core.lo +--- examples/VFS/samba-vscan-0.3.2b/sophos/vscan-sophos.c 2003-02-21 21:37:51.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/sophos/vscan-sophos.c 2003-04-09 20:43:11.000000000 +0200 +@@ -399,14 +399,14 @@ + rc = vscan_do_infected_file_action(&default_vfs_ops, conn, filepath, quarantine_dir, quarantine_prefix, infected_file_action); + + /* add/update file. mark file as infected! */ +- lrufiles_add(filepath, stat_buf.st_mtime, TRUE); ++ lrufiles_add(filepath, stat_buf.st_mtime, True); + + /* deny access */ + errno = EACCES; + return -1; + } else if ( retval == 0 ) { + /* file is clean, add to lrufiles */ +- lrufiles_add(filepath, stat_buf.st_mtime, FALSE); ++ lrufiles_add(filepath, stat_buf.st_mtime, False); + } + } + +--- examples/VFS/samba-vscan-0.3.2b/trend/Makefile 2003-01-30 01:03:38.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/trend/Makefile 2003-04-09 20:21:37.000000000 +0200 +@@ -15,7 +15,7 @@ + SMBWR_SRC = ../../../../source/smbwrapper + SMBVS_INCL = ../include + SMBVS_GLB = ../global +-CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC ++CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -fPIC -I/usr/include/heimdal + VFS_OBJS = vscan-trend.so + SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c $(SMBVS_GLB)/vscan-fileaccesslog.c vscan-trend.c vscan-trend_core.c vscan-trend.h vscan-trend_core.h + OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-fileaccesslog.lo vscan-trend.lo vscan-trend_core.lo +--- examples/VFS/samba-vscan-0.3.2b/trend/vscan-trend.c 2003-02-21 21:37:52.000000000 +0100 ++++ examples/VFS/samba-vscan-0.3.2b/trend/vscan-trend.c 2003-04-09 20:46:07.000000000 +0200 +@@ -409,14 +409,14 @@ + rc = vscan_do_infected_file_action(&default_vfs_ops, conn, filepath, quarantine_dir, quarantine_prefix, infected_file_action); + + /* add/update file. mark file as infected! */ +- lrufiles_add(filepath, stat_buf.st_mtime, TRUE); ++ lrufiles_add(filepath, stat_buf.st_mtime, True); + + /* deny access */ + errno = EACCES; + return -1; + } else if ( retval == 0 ) { + /* file is clean, add to lrufiles */ +- lrufiles_add(filepath, stat_buf.st_mtime, FALSE); ++ lrufiles_add(filepath, stat_buf.st_mtime, False); + } + } + diff --git a/packaging/SuSE/samba3.spec b/packaging/SuSE/samba3.spec index dd2860b801..1b620e60c2 100644 --- a/packaging/SuSE/samba3.spec +++ b/packaging/SuSE/samba3.spec @@ -1,764 +1,765 @@ # -# spec file for package samba (Version HEAD) CVS -# -# Copyright (c) 2002 SuSE Linux AG, Nuernberg, Germany. +# spec file for package samba3 (Version 3.0.0rc1cvs) +# +# Copyright (c) 2003 SuSE Linux AG, Nuernberg, Germany. # This file and all modifications and additions to the pristine # package are under the same license as the package itself. # -# packaged by Guenther Deschner - work is not finished yet ! - -# neededforbuild acl acl-devel attr attr-devel autoconf automake heimdal-devel heimdal-lib libxml2 libxml2-devel mysql-devel mysql-shared openldap2 openldap2-client openldap2-devel openssl openssl-devel popt popt-devel python python-devel readline readline-devel -# usedforbuild aaa_base aaa_version acl attr bash bind9-utils bison cpio cpp cyrus-sasl db devs diffutils e2fsprogs file filesystem fileutils fillup findutils flex gawk gdbm-devel glibc glibc-devel glibc-locale gpm grep groff gzip kbd less libgcc libstdc++ libxcrypt m4 make man mktemp modutils ncurses ncurses-devel net-tools netcfg pam pam-devel pam-modules patch permissions ps rcs readline sed sendmail sh-utils shadow strace syslogd sysvinit tar texinfo textutils timezone unzip util-linux vim zlib-devel acl-devel attr-devel autoconf automake binutils bzip2 cracklib gcc gdbm gettext heimdal-devel heimdal-lib libtool libxml2 libxml2-devel mysql-devel mysql-shared openldap2 openldap2-client openldap2-devel openssl openssl-devel perl popt popt-devel python python-devel readline-devel rpm zlib - - -Vendor: SuSE Linux AG, GS Berlin, Germany -Distribution: SuSE Linux 8.1 (i386) -Name: samba -Packager: gd@suse.de -License: GPL -Group: Productivity/Networking/Samba -Url: http://www.samba.org -Provides: samba smbfs -Obsoletes: samba-classic samba-ldap -Autoreqprov: on -%define smbwrap 0 -%define mit_kerberos 0 -%define heimdal_kerberos 1 -%define devel 0 -%define head 0 -%define python 1 -%define netatalk 0 -%define newsam 0 -%define samba_ver 3.0.0 -Requires: samba-client = %{samba_ver} -Version: 3.0.0 -Release: %(date +%%j) -Summary: An SMB file server for Unix -Source: %{name}-%{version}.tar.bz2 -Source10: %{name}-%{version}.files.tar.bz2 -Source50: http://prdownloads.sourceforge.net/openantivirus/samba-vscan-%{vscan_ver}.tar.bz2 -Patch1: %{name}-%{version}-pdb.diff -Patch10: %{name}-%{version}-net_ads.diff -Patch22: %{name}-%{version}-msdfs.diff -Patch30: %{name}-%{version}-python.diff -BuildRoot: %{_tmppath}/%{name}-%{version}-buildroot -%define DOCDIR %{_defaultdocdir}/%{name} -%define SWATDIR %{_datadir}/samba/swat -%define vscan_ver 0.3.1 -%define vscan_modules fprot kaspersky mks openantivirus sophos trend -Patch51: %{name}-%{version}-vscan.diff +# Please submit bugfixes or comments via http://www.suse.de/feedback/ +# +# Note: The Samba3 tarball should be called: samba3-3.0.0.tar.bz2 +# +# neededforbuild XFree86-libs autoconf automake cups-devel cups-libs dialog docbook-utils docbook-xsl-stylesheets docbook_4 ed freetype2 ghostscript-fonts-std ghostscript-library ghostscript-x11 glib heimdal heimdal-devel heimdal-lib iso_ent libacl libacl-devel libattr libattr-devel libgimpprint libpng libtiff libxml2 libxml2-devel libxslt mysql-devel mysql-shared openldap2 openldap2-client openldap2-devel openssl openssl-devel popt popt-devel python python-devel readline readline-devel te_etex te_latex te_pdf tetex xmlcharent +# usedforbuild aaa_base acl attr bash bind9-utils bison coreutils cpio cpp cvs cyrus-sasl2 db devs diffutils e2fsprogs file filesystem fillup findutils flex gawk gdbm-devel glibc glibc-devel glibc-locale gpm grep groff gzip info insserv kbd less libacl libattr libgcc libstdc++ libxcrypt m4 make man mktemp modutils ncurses ncurses-devel net-tools netcfg pam pam-devel pam-modules patch permissions ps rcs readline sed sendmail shadow strace syslogd sysvinit tar texinfo timezone unzip util-linux vim zlib zlib-devel XFree86-libs autoconf automake binutils bzip2 cracklib cups-devel cups-libs dialog docbook-utils docbook-xsl-stylesheets docbook_4 ed freetype2 gcc gdbm gettext ghostscript-fonts-std ghostscript-library ghostscript-x11 glib heimdal heimdal-devel heimdal-lib iso_ent libacl-devel libattr-devel libgimpprint libpng libtiff libtool libxml2 libxml2-devel libxslt mysql-devel mysql-shared openldap2 openldap2-client openldap2-devel openssl openssl-devel perl popt popt-devel python python-devel readline-devel rpm te_ams te_etex te_latex te_pdf tetex xmlcharent + +Name: samba3 +License: GPL +Group: Productivity/Networking/Samba +Url: http://www.samba.org +Provides: samba smbfs samba3 +Requires: samba3-client +Obsoletes: samba-classic samba-ldap +Autoreqprov: on +%define krb_heimdal_05 0 +%define new_heimdal /opt/heimdal +%define new_sasl /opt/sasl +%define new_openldap /opt/openldap +%define new_glibc 0 +Version: 3.0.0 +Release: %(date +%%j) +%define head 0 +%define samba_ver 3.0.0 +%define samba_release 0 +%define ul_version 0 +%define suse_ver 820 +%define python_ver python2.2 +%if %{suse_ver} > 810 +%define new_glibc 1 +%endif +%if %{suse_ver} > 821 +%define python_ver python2.3 +%endif +%define make_cifsvfs 1 +%define make_devel 0 +%define make_doc 0 +%define make_python 1 +%define make_shared_mod 0 +%define make_smbwrap 1 +# vscan has not yet updated to the new vfs-api +%define make_vscan 0 +%define make_wrepld 1 +%define use_keytab 0 +Summary: samba3 +Source: %{name}-%{version}.tar.bz2 +Source10: %{name}-%{version}.files.tar.bz2 +Source50: samba-vscan-%{vscan_ver}.tar.bz2 +Patch1: %{name}-%{version}-Makefiles-heimdal.diff +Patch2: samba-mutual-auth.diff +Patch29: %{name}-com_err.diff +Patch30: %{name}-%{version}-heimdal-06.diff +Patch31: %{name}-%{version}-pdb.diff +Patch32: %{name}-net_ads_password.diff +Patch33: %{name}-Makefile.diff +Patch34: %{name}-smbwrapper.diff +Patch51: %{name}-vscan.diff +BuildRoot: %{_tmppath}/%{name}-%{version}-build +%define DOCDIR %{_defaultdocdir}/%{name} +%define DOCBOOKDIR %{_defaultdocdir}/%{name}/docbook +%define SWATDIR %{_datadir}/samba/swat +%define vscan_ver 0.3.2b +%define vscan_modules fprot icap mks openantivirus sophos trend +#not pdb_nisplussam +%define pdb_modules pdb_xml,pdb_mysql,pdb_ldap,pdb_smbpasswd,pdb_tdbsam,pdb_unix,pdb_guest,pdb_nisplussam +%define rpc_modules rpc_lsa,rpc_samr,rpc_reg,rpc_wks,rpc_net,rpc_dfs,rpc_srv,rpc_spoolss +%define auth_modules auth_rhosts,auth_sam,auth_unix,auth_winbind,auth_server,auth_domain,auth_builtin +%define vfs_modules vfs_recycle,vfs_audit,vfs_extd_audit,vfs_netatalk,vfs_fake_perms +%define idmap_modules idmap_winbind,idmap_ldap,idmap_tdb +%define charset_modules charset_weird %package client -Summary: Samba client utilities -Autoreqprov: on -Requires: cups-libs -Obsoletes: smbclnt samba-classic-client samba-ldap-client -Group: Productivity/Networking/Samba - +Summary: samba3-client +Autoreqprov: on +Requires: cups-libs +Obsoletes: smbclnt samba-classic-client samba-ldap-client +Provides: samba-client samba3-client +Group: Productivity/Networking/Samba %package winbind -Requires: samba-client samba -Summary: Samba Winbind-package -Autoreqprov: on -Group: Productivity/Networking/Samba - +Requires: samba-client samba +Summary: samba3-winbind +Autoreqprov: on +Group: Productivity/Networking/Samba %package utils -Summary: Samba Testing Utilities -Autoreqprov: on -Group: Productivity/Networking/Samba - +Summary: samba3-utils +Autoreqprov: on +Group: Productivity/Networking/Samba %package doc -Summary: Samba Documentation -Autoreqprov: on -Group: Productivity/Networking/Samba - +Summary: samba3-doc +Autoreqprov: on +Group: Productivity/Networking/Samba +%package docbook +Summary: samba3-docbook +Autoreqprov: on +Group: Productivity/Networking/Samba %package pdb -Summary: Samba PDB-Modules -Autoreqprov: on -Group: Productivity/Networking/Samba - -%package vfs -Summary: Samba VFS-Modules -Autoreqprov: on -Group: Productivity/Networking/Samba - -%if %{newsam} > 0 -%package sam -Summary: Samba SAM-Modules -Autoreqprov: on -Group: Productivity/Networking/Samba +Summary: samba3-pdb +Autoreqprov: on +Group: Productivity/Networking/Samba +%if %{make_cifsvfs} +%package cifsmount +Summary: samba3-cifsmount +Autoreqprov: on +Group: Productivity/Networking/Samba +Url: http://us1.samba.org/samba/Linux_CIFS_client.html %endif - +%if %{make_vscan} %package vscan -Summary: Samba VFS-Modules for Virusscanners -Autoreqprov: on -Group: Productivity/Networking/Samba -Version: 0.3.1 - +Summary: samba3-vscan +Autoreqprov: on +Group: Productivity/Networking/Samba +Version: 0.3.2a +Release: 0 +Url: http://www.openantivirus.org/ +%endif +%if %{make_wrepld} +%package wrepld +Summary: samba3-wrepld +Autoreqprov: on +Group: Productivity/Networking/Samba +%endif +%if %{make_python} %package python -Summary: Samba Python-Modules -Autoreqprov: on -Group: Productivity/Networking/Samba - - - - -%changelog -* Sat Nov 3 2001 - gd@suse.de -- start - - +Summary: samba3-python +Autoreqprov: on +Group: Productivity/Networking/Samba +%endif +%package -n libsmbclient +Summary: Samba client library +Autoreqprov: on +Group: System/Libraries +%package -n libsmbclient-devel +Summary: Libraries and header files to develop programs with smbclient support +Autoreqprov: on +Group: Development/Libraries/C and C++ %prep [ $RPM_BUILD_ROOT = "/" ] && (echo "your buildroot is /" && exit 0) || rm -rf $RPM_BUILD_ROOT mkdir $RPM_BUILD_ROOT - %setup -n %{name}-%{samba_ver} %setup -T -D -a 50 cp -ar samba-vscan-%{vscan_ver} examples/VFS/ - # untar my configs %setup -T -D -a 10 - -%if %{heimdal_kerberos} > 0 +########### +### PATCHES +########### +# Makefiles-heimdal.diff %patch1 +%if %{use_keytab} +# luke howards keytab-patch +%patch2 +%endif +# some com_err fixes +%patch29 +%if %{suse_ver} > 821 +%patch30 +%endif +# vscan patch %patch51 +# net ads password +%patch32 +# temp Makefile (show more libs) +%patch33 +# temp pdb-test.c +%patch31 +# smbwrapper should use LIBDIR not BINDIR +%patch34 +#find . -name CVS -print | xargs rm -rf +#find . -name ".cvsignore" -print | xargs rm -rf +find . -name "*.gd" -print | xargs rm -rvf +find . -name "*.orig" -print | xargs rm -rvf +%if %{ul_version} >= 1 + echo '#define VERSION "%samba_ver-UL"' > source/include/version.h +%else + echo '#define VERSION "%samba_ver-SuSE"' > source/include/version.h %endif -#%patch10 -#%patch22 -#%patch30 - -find . -name CVS -print | xargs rm -rf -find . -name ".cvsignore" -print | xargs rm -rf -find . -name "'*.gd'" -print | xargs rm -rvf -find . -name "'*.orig'" -print | xargs rm -rvf %build %{name}-%{samba_ver} %{?suse_update_config:%{suse_update_config -f}} cd source ./autogen.sh -libtoolize --force --copy -autoconf export CFLAGS="$RPM_OPT_FLAGS -Wall -O -D_GNU_SOURCE -D_LARGEFILE64_SOURCE" +# debugging symbols +%if %{make_devel} +export CFLAGS="$RPM_OPT_FLAGS -g -Wall -O -D_GNU_SOURCE -D_LARGEFILE64_SOURCE" +%endif +%if %{krb_heimdal_05} +export CFLAGS="$CFLAGS -I./include -I%{new_heimdal}/include " +export CFLAGS="$CFLAGS -I%{new_openldap}/include " +export CFLAGS="$CFLAGS -I%{new_sasl}/include " +export LDFLAGS="$LDFLAGS -Wl,-rpath %{new_heimdal}/lib" +export LDFLAGS="$LDFLAGS -Wl,-rpath %{new_openldap}/lib" +export LDFLAGS="$LDFLAGS -Wl,-rpath %{new_sasl}/lib" +%endif %ifarch ppc64 export CFLAGS="$CFLAGS -mminimal-toc" %endif -CONF_OPTS_BASIC="\ - --prefix=/usr \ - --libdir=/etc/samba \ +CONF_OPTS="\ + --enable-cups \ + --libdir=/usr/lib/samba \ --localstatedir=/var/lib/samba \ --mandir=%{_mandir} \ + --prefix=/usr \ --sbindir=/usr/sbin \ - --with-privatedir=/etc/samba \ - --with-piddir=/var/run/samba \ - --with-codepagedir=/usr/share/samba/codepages \ - --with-swatdir=/usr/share/samba/swat \ - --with-smbmount \ + --sysconfdir=/etc/samba \ + --with-acl-support \ --with-automount \ - --enable-cups \ + --with-configdir=/etc/samba \ + --with-lockdir=/var/lib/samba \ + --with-logfilebase=/var/log/samba \ --with-msdfs \ - --with-vfs \ --with-pam \ --with-pam_smbpass \ + --with-piddir=/var/run/samba \ + --with-privatedir=/etc/samba \ + --with-quotas \ + --with-smbmount \ + --with-swatdir=/usr/share/samba/swat \ + --with-syslog \ --with-utmp \ + --with-vfs \ --with-winbind \ --with-tdbsam \ - --with-ldapsam \ -%if %{smbwrap} + --with-expsam=xml,mysql \ + --with-profiling-data \ +%if %{use_keytab} + --enable-keytab \ +%endif +%if %{make_smbwrap} --with-smbwrapper \ %endif - --with-quotas \ - --with-acl-support \ - --with-python=python2.2 \ - --with-syslog \ -" -CONF_OPTS_HEAD="\ - --with-sam \ -" -CONF_OPTS_HEIMDAL_KERBEROS="\ - --with-krb5impl=heimdal \ -" -CONF_OPTS_HEIMDAL_51_KERBEROS="\ - --with-krb5impl=heimdal \ - --with-krb5includes=/opt/heimdal-0.5.1/include \ - --with-krb5libs=/opt/heimdal-0.5.1/lib \ -" -CONF_OPTS_MIT_KERBEROS="\ - --with-krb5impl=mit \ - --with-krb5includes=/usr/kerberos/include \ - --with-krb5libs=/usr/kerberos/lib \ -" -CONF_OPTS_DEVEL="\ +%if %{make_python} + --with-python=%{python_ver} \ +%endif +%if %{make_shared_mod} + --with-shared-modules=%{pdb_modules},%{rpc_modules} \ +%endif +%if %{make_devel} --enable-developer \ --enable-krb5developer \ - --with-profiling-data \ +%endif " -CONF_OPTS="$CONF_OPTS_BASIC" -%if %{head} > 0 -CONF_OPTS="$CONF_OPTS $CONF_OPTS_HEAD" -%endif -%if %{heimdal_kerberos} > 0 -CONF_OPTS="$CONF_OPTS $CONF_OPTS_HEIMDAL_KERBEROS" -%endif -%if %{mit_kerberos} > 0 -CONF_OPTS="$CONF_OPTS $CONF_OPTS_MIT_KERBEROS" -%endif -%if %{devel} > 0 -CONF_OPTS="$CONF_OPTS $CONF_OPTS_DEVEL" -%endif - +# --with-nisplus-home \ +# make sure we have a chance to find the krb5-config-tool +export PATH="$PATH:/usr/lib/heimdal/bin" ./configure $CONF_OPTS - -### --with-ldapsam is now standard! -### --with-sendfile-support ---default now -# --with-nisplussam \ -# --with-nisplus_home \ - -# with the new passdb-code we can finaly compile several passdb-backends -# and make our choice at runtime. -# HEAD and thus alpha21 no longer need this -#make proto - make \ - LOCKDIR=/var/lib/samba \ - LOGFILEBASE=/var/log/samba \ - SBINDIR=/usr/sbin \ all \ torture \ nsswitch/libnss_wins.so \ debug2html \ libsmbclient \ - bin/profiles \ - everything - + everything \ + bin/editreg # everything = nsswitch smbwrapper smbtorture debug2html smbfilter nsswitch/libnss_wins.so - -%if %{newsam} > 0 -make bin/samtest -%endif make modules - make -C tdb tdbdump tdbtest tdbtool tdbtorture -# tdbbackup is now in main Makefile - make talloctort - -# VFS,PDB and SAM -EXAMPLEDIRS="pdb" +%if %{make_wrepld} +make bin/wrepld +%endif +%if %{make_doc} +pushd `pwd` +cd ../docs/docbook +autoconf -f +./configure +# gracefully ignore errors... +make -i manpages html html-single pdf htmlfaq htmlman +# ps is not necessary, txt neither +# everything = manpages ps pdf html-single html htmlman txt htmlfaq +popd +%endif +# make examples in VFS,PDB +pushd `pwd` +cd ../examples/VFS/ +sh -x autogen.sh +./configure +popd +EXAMPLEDIRS="pdb VFS" for i in $EXAMPLEDIRS; do make -C ../examples/$i; done - +%if %{make_vscan} export USE_KAVPSHAREDLIB=0 +export USE_INCLMKSDLIB=1 for module in %{vscan_modules}; do - make -C ../examples/VFS/%{name}-vscan-%{vscan_ver}/${module}; + make -C ../examples/VFS/samba-vscan-%{vscan_ver}/${module}; done - -# tim potters python -%if %{python} > 0 +%endif +%if %{make_python} make python_ext %endif - - +%if %{make_cifsvfs} +cd client +export CFLAGS="$RPM_OPT_FLAGS -Wall -O -D_GNU_SOURCE -D_LARGEFILE64_SOURCE" +gcc mount.cifs.c -o mount.cifs +cd .. +%endif %install - mkdir -p \ - $RPM_BUILD_ROOT/usr/{bin,sbin} \ - $RPM_BUILD_ROOT/usr/share/{man,samba/{scripts,swat}} \ - $RPM_BUILD_ROOT/usr/lib/samba/{vfs,pdb,sam,vscan} \ - $RPM_BUILD_ROOT/usr/lib/python2.2/lib-dynload \ - $RPM_BUILD_ROOT/usr/include \ - $RPM_BUILD_ROOT/etc/{pam.d,init.d,samba} \ - $RPM_BUILD_ROOT/var/adm \ - $RPM_BUILD_ROOT/sbin \ - $RPM_BUILD_ROOT/lib/security \ $RPM_BUILD_ROOT/%{DOCDIR} \ $RPM_BUILD_ROOT/%{DOCDIR}-vscan \ - $RPM_BUILD_ROOT/var/spool/samba \ + $RPM_BUILD_ROOT/%{DOCDIR}/docbook \ + $RPM_BUILD_ROOT/etc/{pam.d,init.d,samba} \ + $RPM_BUILD_ROOT/lib/security \ + $RPM_BUILD_ROOT/sbin \ + $RPM_BUILD_ROOT/usr/include \ + $RPM_BUILD_ROOT/usr/lib/%{python_ver}/lib-dynload \ + $RPM_BUILD_ROOT/usr/lib/samba/{vfs,pdb,vscan,rpc,auth,charset,idmap} \ + $RPM_BUILD_ROOT/usr/share/{man,samba/swat} \ + $RPM_BUILD_ROOT/usr/{bin,sbin} \ + $RPM_BUILD_ROOT/var/adm \ + $RPM_BUILD_ROOT/var/lib/samba/{netlogon,drivers/{W32X86,WIN40,W32ALPHA,W32MIPS,W32PPC},profiles} \ $RPM_BUILD_ROOT/var/log/samba \ $RPM_BUILD_ROOT/var/run/samba \ - $RPM_BUILD_ROOT/var/lib/samba/{netlogon,drivers/{W32X86,WIN40,W32ALPHA,W32MIPS,W32PPC},profiles} - + $RPM_BUILD_ROOT/var/spool/samba cd source/ make install \ - LIBDIR=$RPM_BUILD_ROOT/etc/samba \ + LIBDIR=$RPM_BUILD_ROOT/usr/lib/samba \ LOGFILEBASE=$RPM_BUILD_ROOT/var/log/samba \ CONFIGFILE=$RPM_BUILD_ROOT/etc/samba/smb.conf \ LMHOSTSFILE=$RPM_BUILD_ROOT/etc/samba/lmhosts \ SWATDIR=$RPM_BUILD_ROOT/usr/share/samba/swat \ SBINDIR=$RPM_BUILD_ROOT/usr/sbin \ - LOCKDIR=$RPM_BUILD_ROOT/var/lock/samba \ - CODEPAGEDIR=$RPM_BUILD_ROOT/usr/share/samba/codepages \ + LOCKDIR=$RPM_BUILD_ROOT/var/lib/samba \ DRIVERFILE=$RPM_BUILD_ROOT/etc/samba/printers.def \ BINDIR=$RPM_BUILD_ROOT/usr/bin \ SMB_PASSWD_FILE=$RPM_BUILD_ROOT/etc/samba/smbpasswd \ - TDB_PASSWD_FILE=$RPM_BUILD_ROOT/etc/samba/smbpasswd.tdb \ MANDIR=$RPM_BUILD_ROOT/usr/share/man +make installmodules \ + LIBDIR=$RPM_BUILD_ROOT/usr/lib/samba cd .. - # utility scripts -%if %{head} > 0 +%if %{head} scripts="creategroup cvslog.pl scancvslog.pl" %else scripts="scancvslog.pl" %endif +mkdir -p examples/scripts for i in $scripts; do - cp -a source/script/$i $RPM_BUILD_ROOT/usr/share/samba/scripts/ + cp -a source/script/$i examples/scripts/ done - -# move the man-pages (ugly lang thing, fixed in alpha16) -#mv $RPM_BUILD_ROOT/usr/share/man/lang/* $RPM_BUILD_ROOT/usr/share/man/ - # configuration files +%if %{ul_version} >= 1 + SUFFIX="UnitedLinux" +%else + SUFFIX="SuSE" +%endif +cat smb.conf.vendor | egrep -v '(^$$|^#)' > smb.conf +mv smb.conf.vendor examples/smb.conf.${SUFFIX} install -m 644 smb.conf* $RPM_BUILD_ROOT/etc/samba/ -install -m 644 shares.conf $RPM_BUILD_ROOT/etc/samba/ install -m 644 lmhosts $RPM_BUILD_ROOT/etc/samba/ +install -m 644 smbusers $RPM_BUILD_ROOT/etc/samba/ install -m 600 smbpasswd -o root -g root $RPM_BUILD_ROOT/etc/samba/ - +install -m 600 smbfstab -o root -g root $RPM_BUILD_ROOT/etc/samba/ # pam install -m 644 samba.pamd $RPM_BUILD_ROOT/etc/pam.d/samba - # sambamount ln -sf /usr/bin/smbmount $RPM_BUILD_ROOT/sbin/mount.smbfs - +#cifsmount +%if %{make_cifsvfs} +install -m755 source/client/mount.cifs $RPM_BUILD_ROOT/sbin +%endif # start scripts install rc.smb $RPM_BUILD_ROOT/etc/init.d/smb ln -sf ../../etc/init.d/smb $RPM_BUILD_ROOT/usr/sbin/rcsmb +install rc.nmb $RPM_BUILD_ROOT/etc/init.d/nmb +ln -sf ../../etc/init.d/nmb $RPM_BUILD_ROOT/usr/sbin/rcnmb install rc.smbfs $RPM_BUILD_ROOT/etc/init.d/smbfs ln -sf ../../etc/init.d/smbfs $RPM_BUILD_ROOT/usr/sbin/rcsmbfs install rc.winbind $RPM_BUILD_ROOT/etc/init.d/winbind ln -sf ../../etc/init.d/winbind $RPM_BUILD_ROOT/usr/sbin/rcwinbind +%if %{make_wrepld} install rc.wrepl $RPM_BUILD_ROOT/etc/init.d/wrepl ln -sf ../../etc/init.d/wrepl $RPM_BUILD_ROOT/usr/sbin/rcwrepl - -#### disabled for 8.0 -### rc.config fragment -mkdir -p $RPM_BUILD_ROOT/var/adm/fillup-templates -cp rc.config.samba $RPM_BUILD_ROOT/var/adm/fillup-templates -cp rc.config.winbind $RPM_BUILD_ROOT/var/adm/fillup-templates -cp rc.config.wrepl $RPM_BUILD_ROOT/var/adm/fillup-templates - +cp -a source/bin/wrepld $RPM_BUILD_ROOT/usr/sbin/ +%endif # libnss_wins.so -cp source/nsswitch/libnss_wins.so $RPM_BUILD_ROOT/lib/libnss_wins.so -ln -sf /lib/libnss_wins.so $RPM_BUILD_ROOT/lib/libnss_wins.so.2 - +cp source/nsswitch/libnss_wins.so $RPM_BUILD_ROOT/lib/libnss_wins.so.2 +ln -sf /lib/libnss_wins.so.2 $RPM_BUILD_ROOT/lib/libnss_wins.so # winbind stuff cp -a source/nsswitch/pam_winbind.so $RPM_BUILD_ROOT/lib/security/ -cp -a source/nsswitch/libnss_winbind.so $RPM_BUILD_ROOT/lib/ +cp -a source/nsswitch/libnss_winbind.so $RPM_BUILD_ROOT/lib/libnss_winbind.so.2 cp -a source/bin/winbindd $RPM_BUILD_ROOT/usr/sbin/ -ln -sf /lib/libnss_winbind.so $RPM_BUILD_ROOT/lib/libnss_winbind.so.2 - +ln -s /lib/libnss_winbind.so.2 $RPM_BUILD_ROOT/lib/libnss_winbind.so # pam_smbpass cp -a source/bin/pam_smbpass.so $RPM_BUILD_ROOT/lib/security/ - # smbfilter cp -a source/bin/smbfilter $RPM_BUILD_ROOT/usr/bin/ - - -%{?suse_check} - -## install libsmbclient -install -m0755 source/bin/{libsmbclient.so,libsmbclient.a} $RPM_BUILD_ROOT/%{_libdir} -ln -s /usr/lib/libsmbclient.so $RPM_BUILD_ROOT/%{_libdir}/libsmbclient.so.0 +# editreg +cp -a source/bin/editreg $RPM_BUILD_ROOT/usr/bin/ +# install libsmbclient +install -m0755 source/bin/libsmbclient.a $RPM_BUILD_ROOT/%{_libdir} +install -m0755 source/bin/libsmbclient.so $RPM_BUILD_ROOT/%{_libdir}/libsmbclient.so.0 +ln -s /usr/lib/libsmbclient.so.0 $RPM_BUILD_ROOT/%{_libdir}/libsmbclient.so install -m0644 source/include/libsmbclient.h $RPM_BUILD_ROOT/%{_includedir} - +# install nsswitch-headers (for squid, etc.) +mkdir -p $RPM_BUILD_ROOT/%{_includedir}/samba/nsswitch +cp source/nsswitch/*.h $RPM_BUILD_ROOT/%{_includedir}/samba/nsswitch/ # install smbtorture and other test-programs install -m0755 source/bin/smbtorture $RPM_BUILD_ROOT/usr/bin/ install -m0755 source/bin/talloctort $RPM_BUILD_ROOT/usr/bin/ install -m0755 source/bin/{msgtest,masktest,locktest*} $RPM_BUILD_ROOT/usr/bin/ install -m0755 source/bin/{vfstest,nsstest} $RPM_BUILD_ROOT/usr/bin/ -%if %{head} > 0 -%if %{newsam} > 0 -install -m0755 source/bin/samtest $RPM_BUILD_ROOT/usr/bin/ -%endif -%endif - # install tdb tools install -m0755 source/tdb/{tdbdump,tdbtest,tdbtool,tdbtorture} $RPM_BUILD_ROOT/usr/bin/ - - # install VFS-modules -%if %{head} > 0 -install -m0755 source/bin/developer.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ -#install -m0755 examples/VFS/block/block.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ -#install -m0755 examples/VFS/skel.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ -%else -#install -m0755 examples/VFS/block/block.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ -#install -m0755 examples/VFS/skel.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ -%endif -install -m0755 source/bin/vfs_audit.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ -install -m0755 source/bin/vfs_extd_audit.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ -install -m0755 source/bin/vfs_recycle.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ -%if %{netatalk} -install -m0755 source/bin/vfs_netatalk.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ -%endif - +install -m0755 examples/VFS/*.so $RPM_BUILD_ROOT/%{_libdir}/samba/vfs/ # install PDB-modules -%if %{head} > 0 -install -m0755 source/bin/xml.so $RPM_BUILD_ROOT/%{_libdir}/samba/pdb/ -install -m0755 source/bin/mysql.so $RPM_BUILD_ROOT/%{_libdir}/samba/pdb/ -%else -install -m0755 source/bin/pdb_xml.so $RPM_BUILD_ROOT/%{_libdir}/samba/pdb/ -install -m0755 source/bin/pdb_mysql.so $RPM_BUILD_ROOT/%{_libdir}/samba/pdb/ -%endif install -m0755 examples/pdb/pdb_test.so $RPM_BUILD_ROOT/%{_libdir}/samba/pdb/ - -# install SAM-modules -%if %{head} > 0 -%if %{newsam} > 0 -install -m0755 examples/sam/sam_skel.so $RPM_BUILD_ROOT/%{_libdir}/samba/sam/ -%endif -%endif - +%if %{make_vscan} # install VSCAN-vfs-modules -install -m0755 examples/VFS/%{name}-vscan-%{vscan_ver}/*/*.so $RPM_BUILD_ROOT/%{_libdir}/samba/vscan/ - +install -m0755 examples/VFS/samba-vscan-%{vscan_ver}/*/*.so $RPM_BUILD_ROOT/%{_libdir}/samba/vscan/ +%endif # make examples clean VFS="$RPM_BUILD_DIR/%{name}-%{samba_ver}/examples/VFS" -VSCAN="$VFS/%{name}-vscan-%{vscan_ver}" +VSCAN="$VFS/samba-vscan-%{vscan_ver}" PDB="$RPM_BUILD_DIR/%{name}-%{samba_ver}/examples/pdb" -%if %{head} > 0 -%if %{newsam} > 0 -SAM="$RPM_BUILD_DIR/%{name}-%{samba_ver}/examples/sam" -%endif -%endif -dirs="$PDB $SAM" +dirs="$PDB $SAM $VFS" (for i in $dirs; do make -C $i clean; done) +%if %{make_vscan} (for i in %{vscan_modules}; do make -C $VSCAN/$i clean; done) - -%if %{python} > 0 +%endif # install python -cp -a source/build/lib.*/samba $RPM_BUILD_ROOT/usr/lib/python2.2/lib-dynload/ +%if %{make_python} +cp -a source/build/lib.*/samba $RPM_BUILD_ROOT/usr/lib/%{python_ver}/lib-dynload/ +find source/python -name CVS -print | xargs rm -rf +find source/python -name ".cvsignore" -print | xargs rm -rf %endif - # whats this ? install -m0755 source/bin/debug2html $RPM_BUILD_ROOT/usr/bin/ - -%if %{smbwrap} # install smbwrapper +%if %{make_smbwrap} install -m0755 source/bin/smbwrapper.so $RPM_BUILD_ROOT/%{_libdir}/samba/ install -m0755 source/bin/smbsh $RPM_BUILD_ROOT/usr/bin/ %endif - -# finally obsolete with alpha17 makefile -# install unicode-codepages -#install -m0755 source/codepages/{lowcase,upcase,valid}.dat $RPM_BUILD_ROOT/etc/samba/ - +############## # cleanup docs -rm -rf docs/*.[0-9] -chmod 644 `find docs examples -type f` -chmod 755 `find docs examples -type d` +############## +#chmod 644 `find docs examples -type f` +#chmod 755 `find docs examples -type d` +#find . -name CVS -print | xargs rm -rf +#find . -name ".cvsignore" -print | xargs rm -rf mv COPYING Manifest README Read-Manifest-Now Roadmap WHATSNEW.txt $RPM_BUILD_ROOT/%{DOCDIR}/ cp source/msdfs/README $RPM_BUILD_ROOT/%{DOCDIR}/README.msdfs -#cp source/nsswitch/README $RPM_BUILD_ROOT/%{DOCDIR}/README.nsswitch cp source/smbwrapper/README $RPM_BUILD_ROOT/%{DOCDIR}/README.smbwrapper +%if %{ul_version} >= 1 + SUFFIX="UnitedLinux" +%else + SUFFIX="SuSE" +%endif +cp README.vendor ${RPM_BUILD_ROOT}/%{DOCDIR}/README.${SUFFIX} +# pam_smbpass is missing +cp -a source/pam_smbpass/samples examples/pam_smbpass/ +cp -a source/pam_smbpass/{CHANGELOG,INSTALL,README,TODO} examples/pam_smbpass/ +# prepare docbook package +cp -a docs/docbook/* $RPM_BUILD_ROOT/%{DOCBOOKDIR} +#make -C $RPM_BUILD_ROOT/%{DOCBOOKDIR} clean +rm -rf $RPM_BUILD_ROOT/%{DOCBOOKDIR}/autom4te.cache +rm -rf $RPM_BUILD_ROOT/%{DOCBOOKDIR}/config.* +# this is empty +rm -rf docs/yodldocs +rm -rf examples/VFS/samba-vscan-%{vscan_ver} +# zip manpages at least +gzip -f docs/manpages/*.[1-9] cp -a docs/* $RPM_BUILD_ROOT/%{DOCDIR} cp -a examples/ $RPM_BUILD_ROOT/%{DOCDIR} # save space... -rm -r \ - $RPM_BUILD_ROOT/%{SWATDIR}/using_samba +rm -r $RPM_BUILD_ROOT/%{SWATDIR}/using_samba ln -s %{DOCDIR}/htmldocs/using_samba $RPM_BUILD_ROOT/%{SWATDIR} - +# hm... +cp $RPM_BUILD_ROOT/%{SWATDIR}/help/welcome.html $RPM_BUILD_ROOT/%{DOCDIR}/htmldocs/ +rm -r $RPM_BUILD_ROOT/%{SWATDIR}/help +ln -s %{DOCDIR}/htmldocs $RPM_BUILD_ROOT/%{SWATDIR}/help +# remove cvs +find $RPM_BUILD_ROOT/%{DOCDIR} -name CVS -print | xargs rm -rf +find $RPM_BUILD_ROOT/%{DOCDIR} -name ".cvsignore" -print | xargs rm -rf +# finally build a file-list +for file in $( find ${RPM_BUILD_ROOT}%{DOCDIR} -maxdepth 1); do + # exclude %{DOCDIR} and docbook + case "${file#${RPM_BUILD_ROOT}}" in + %{DOCDIR}|%{DOCDIR}/docbook) continue ;; + esac + echo "%doc ${file#${RPM_BUILD_ROOT}}" >> ${RPM_BUILD_DIR}/%{name}-%{samba_ver}/filelist-doc +done %post -###### disabled for 8.1 -###echo "Updating etc/rc.config..." -##if [ -x bin/fillup ] ; then -## bin/fillup -q -d = etc/rc.config var/adm/fillup-templates/rc.config.samba -## bin/fillup -q -d = etc/rc.config var/adm/fillup-templates/rc.config.winbind -##else -## echo "ERROR: fillup not found. This should not happen. Please compare" -## echo "etc/rc.config and var/adm/fillup-templates/rc.config.samba and" -## echo "var/adm/fillup-templates/rc.config.winbind and update by hand." -##fi +%{fillup_and_insserv smb} mkdir -p $RPM_BUILD_ROOT/var/adm/notify/messages cat << EOF > var/adm/notify/messages/samba-notify Achtung! - This is %{name}-%{samba_ver}. Please do not run on production systems. - You have been warned. EOF -# Initialize runlevel links -# -%{fillup_and_insserv smb} -#sbin/insserv /etc/init.d/smb - %post client -#sbin/insserv /etc/init.d/smbfs %{fillup_and_insserv -fpy smbfs} %{fillup_only -ans samba client} +%post winbind +%{fillup_and_insserv winbind} + %postun %{insserv_cleanup} -#sbin/insserv /etc/init.d/ %postun client %{insserv_cleanup} -#sbin/insserv /etc/init.d/ - -%post winbind -%{fillup_and_insserv winbind} -#sbin/insserv /etc/init.d/winbind %postun winbind %{insserv_cleanup} -#sbin/insserv /etc/init.d/ %clean #make -C source realclean %files -%config(noreplace) /etc/samba/smbpasswd -%config /etc/pam.d/samba +#/usr/bin/addtosmbpass +#/usr/bin/convert_smbpasswd +%dir /etc/samba +%dir /usr/lib/samba +%config /etc/init.d/nmb %config /etc/init.d/smb -%config /etc/init.d/wrepl -#/usr/bin/make_printerdef -/usr/bin/addtosmbpass -/usr/bin/convert_smbpasswd -/usr/bin/ntlm_auth -/usr/bin/profiles -/usr/bin/smbfilter -/usr/bin/smbpasswd -/usr/bin/smbstatus -/usr/bin/testparm -/usr/bin/testprns -#%doc %{_mandir}/man1/smbrun.1.gz -%doc %{_mandir}/man1/smbsh.1.gz +%config /etc/pam.d/samba +%config(noreplace) /etc/samba/smbpasswd +%config(noreplace) /etc/samba/smbusers +%doc %{_mandir}/man1/smbcontrol.1.gz %doc %{_mandir}/man1/smbstatus.1.gz %doc %{_mandir}/man1/testparm.1.gz %doc %{_mandir}/man1/testprns.1.gz %doc %{_mandir}/man5/smbpasswd.5.gz %doc %{_mandir}/man7/samba.7.gz %doc %{_mandir}/man8/nmbd.8.gz +%doc %{_mandir}/man8/pdbedit.8.gz %doc %{_mandir}/man8/smbd.8.gz %doc %{_mandir}/man8/smbpasswd.8.gz %doc %{_mandir}/man8/swat.8.gz +%doc %{_mandir}/man8/tdbbackup.8.gz +%{_includedir}/samba +/lib/security/pam_smbpass.so +/usr/bin/pdbedit +/usr/bin/smbcontrol +/usr/bin/smbpasswd +/usr/bin/smbstatus +/usr/bin/tdbbackup +/usr/bin/tdbdump +/usr/bin/tdbtest +/usr/bin/tdbtool +/usr/bin/testparm +/usr/bin/testprns +/usr/lib/samba/rpc +/usr/lib/samba/vfs /usr/sbin/nmbd +/usr/sbin/rcnmb +/usr/sbin/rcsmb /usr/sbin/smbd /usr/sbin/swat -/usr/sbin/wrepld -/usr/sbin/rcsmb -/usr/sbin/rcwrepl -#/var/adm/fillup-templates/rc.config.samba +/usr/share/samba +/var/lib/samba /var/log/samba -/var/spool/samba /var/run/samba -/var/lib/samba -/usr/share/samba -/lib/security/pam_smbpass.so +/var/spool/samba %files client -%config(noreplace) /etc/samba/smb.conf -%config(noreplace) /etc/samba/lmhosts -/etc/samba/lowcase.dat -/etc/samba/upcase.dat -/etc/samba/valid.dat %config /etc/init.d/smbfs -/usr/sbin/rcsmbfs +%config(noreplace) /etc/samba/lmhosts +%config(noreplace) /etc/samba/smb.conf +%config(noreplace) /etc/samba/smbfstab +%dir /etc/samba +%dir /usr/lib/samba +%doc %{_mandir}/man1/editreg.1.gz +%doc %{_mandir}/man1/findsmb.1.gz +%doc %{_mandir}/man1/nmblookup.1.gz +%doc %{_mandir}/man1/profiles.1.gz +%doc %{_mandir}/man1/rpcclient.1.gz +%doc %{_mandir}/man1/smbcacls.1.gz +%doc %{_mandir}/man1/smbclient.1.gz +%doc %{_mandir}/man1/smbcquotas.1.gz +%doc %{_mandir}/man1/smbtar.1.gz +%doc %{_mandir}/man1/smbtree.1.gz +%doc %{_mandir}/man5/lmhosts.5.gz +%doc %{_mandir}/man5/smb.conf.5.gz +%doc %{_mandir}/man7/Samba.7.gz +%doc %{_mandir}/man8/net.8.gz +%doc %{_mandir}/man8/smbmnt.8.gz +%doc %{_mandir}/man8/smbmount.8.gz +%doc %{_mandir}/man8/smbspool.8.gz +%doc %{_mandir}/man8/smbumount.8.gz /sbin/mount.smbfs +/usr/bin/editreg /usr/bin/findsmb /usr/bin/net /usr/bin/nmblookup -/usr/bin/pdbedit +/usr/bin/profiles /usr/bin/rpcclient /usr/bin/smbcacls -/usr/bin/smbcontrol /usr/bin/smbclient +/usr/bin/smbcquotas +/usr/bin/smbfilter /usr/bin/smbmnt /usr/bin/smbmount -%if %{smbwrap} -/usr/bin/smbsh -%endif -/usr/bin/smbumount /usr/bin/smbspool /usr/bin/smbtar /usr/bin/smbtree -%doc %{_mandir}/man1/nmblookup.1.gz -%doc %{_mandir}/man1/rpcclient.1.gz -%doc %{_mandir}/man1/smbclient.1.gz -%doc %{_mandir}/man1/smbcacls.1.gz -%doc %{_mandir}/man1/smbcontrol.1.gz -%doc %{_mandir}/man1/smbtar.1.gz -%doc %{_mandir}/man5/lmhosts.5.gz -%doc %{_mandir}/man5/smb.conf.5.gz -%doc %{_mandir}/man8/net.8.gz -%doc %{_mandir}/man8/pdbedit.8.gz -%doc %{_mandir}/man8/smbmnt.8.gz -%doc %{_mandir}/man8/smbmount.8.gz -%doc %{_mandir}/man8/smbspool.8.gz -%doc %{_mandir}/man8/smbumount.8.gz -/usr/include/libsmbclient.h -%if %{smbwrap} +/usr/bin/smbumount +/usr/lib/samba/lowcase.dat +/usr/lib/samba/upcase.dat +/usr/lib/samba/valid.dat +/usr/sbin/rcsmbfs +%if %{make_smbwrap} +/usr/bin/smbsh +%doc %{_mandir}/man1/smbsh.1.gz /usr/lib/samba/smbwrapper.so %endif -/usr/lib/libsmbclient.a -/usr/lib/libsmbclient.so -/usr/lib/libsmbclient.so.0 %files winbind -%config(noreplace) /etc/samba/smb.conf.winbind %config /etc/init.d/winbind +%config(noreplace) /etc/samba/smb.conf +%dir /etc/samba %doc %{_mandir}/man1/wbinfo.1.gz %doc %{_mandir}/man8/winbindd.8.gz -/usr/bin/wbinfo -%if %{head} > 0 +%doc %{_mandir}/man1/ntlm_auth.1.gz +/lib/libnss_winbind.so* +/lib/libnss_wins.so* +/lib/security/pam_winbind.so /usr/bin/ntlm_auth -%endif -/usr/sbin/winbindd +/usr/bin/wbinfo /usr/sbin/rcwinbind -#/var/adm/fillup-templates/rc.config.winbind -/lib/security/pam_winbind.so -/lib/libnss_winbind.so -/lib/libnss_winbind.so.2 -/lib/libnss_wins.so -/lib/libnss_wins.so.2 +/usr/sbin/winbindd %files utils -/usr/bin/smbtorture -/usr/bin/msgtest -/usr/bin/masktest +%doc %{_mandir}/man1/vfstest.1.gz +/usr/bin/debug2html /usr/bin/locktest /usr/bin/locktest2 -/usr/bin/debug2html +/usr/bin/masktest +/usr/bin/msgtest +/usr/bin/nsstest +/usr/bin/smbtorture /usr/bin/talloctort -/usr/bin/tdbbackup -/usr/bin/tdbdump -/usr/bin/tdbtest -/usr/bin/tdbtool /usr/bin/tdbtorture /usr/bin/vfstest -/usr/bin/nsstest -%if %{head} > 0 -%if %{newsam} > 0 -/usr/bin/samtest -%endif -/usr/bin/profiles -/usr/bin/editreg -%endif -%doc %{_mandir}/man1/vfstest.1.gz -%files doc -%docdir %{DOCDIR} -%{DOCDIR} +%files doc -f filelist-doc +%dir /usr/share/doc/packages/samba3 + +%files docbook +%docdir %{DOCBOOKDIR} +%{DOCBOOKDIR} +%dir /usr/share/doc/packages/samba3 %files pdb /usr/lib/samba/pdb -%doc examples/pdb/* - -%files vfs -/usr/lib/samba/vfs -%doc examples/VFS/README* -%doc examples/VFS/Makefile* -#doc examples/VFS/audit* -#%doc examples/VFS/block* -#doc examples/VFS/netatalk* -#doc examples/VFS/recycle* -%doc examples/VFS/skel* +%doc examples/pdb/{Makefile,README,pdb_test.c} +%doc examples/pdb/{mysql/mysql.dump,mysql/smb.conf} +%if %{make_cifsvfs} -%if %{newsam} > 0 -%files sam -/usr/lib/samba/sam -%if %{head} > 0 -%doc examples/sam/* +%files cifsmount +/sbin/mount.cifs %endif +%if %{make_wrepld} + +%files wrepld +%config /etc/init.d/wrepl +/usr/sbin/rcwrepl +/usr/sbin/wrepld %endif +%if %{make_vscan} %files vscan /usr/lib/samba/vscan -%doc %{name}-vscan-%{vscan_ver}/{AUTHORS,COPYING,ChangeLog,FAQ,NEWS,README,TODO} - +%doc samba-vscan-%{vscan_ver}/{AUTHORS,COPYING,ChangeLog,FAQ,NEWS,README,TODO} +%endif +%if %{make_python} %files python %doc source/python/README -%if %{python} > 0 -/usr/lib/python2.2/lib-dynload/samba %doc source/python/examples %doc source/python/gprinterdata %doc source/python/gtdbtool %doc source/python/gtkdictbrowser.py -%if %{head} > 0 -%doc source/python/gtkdictbrowser.pyc -%doc source/python/printerdata.pyc -%endif +/usr/lib/%{python_ver}/lib-dynload/samba %endif -%description -Samba is a suite of programs which work together to allow clients to -access Unix filespace and printers via the SMB protocol (Server Message -Block). -In practice, this means that you can redirect disks and printers to -Unix disks and printers from LAN Manager clients, Windows for -Workgroups 3.11 clients, Windows'95 clients, Windows NT clients -and OS/2 clients. There is -also a Unix client program supplied as part of the suite which allows -Unix users to use an ftp-like interface to access filespace and -printers on any other SMB server. -Samba includes the following programs (in summary): -* smbd, the SMB server. This handles actual connections from clients. -* nmbd, the Netbios name server, which helps clients locate servers. -* smbclient, the Unix-hosted client program. -* smbrun, a little 'glue' program to help the server run external -programs. -* testprns, a program to test server access to printers. -* testparm, a program to test the Samba configuration file for correctness. -* smb.conf, the Samba configuration file. -* smbprint, a sample script to allow a Unix host to use smbclient -to print to an SMB server. -The suite is supplied with full source and is GPLed. -This package expects its config file under /etc/smb.conf . +%files -n libsmbclient +%{_libdir}/libsmbclient.so.* -Authors: --------- - Andrew Tridgell - Karl Auer - Jeremy Allison +%files -n libsmbclient-devel +%{_includedir}/libsmbclient.h +%{_libdir}/libsmbclient.a +%{_libdir}/libsmbclient.so -SuSE series: n +%description +samba3 %description client -This package contains all programs, that are needed to act as a samba -client. This includes also smbmount, of course. - -Authors: --------- - Andrew Tridgell - Karl Auer - Jeremy Allison - -SuSE series: n +samba3-client %description winbind -This is the winbind-daemon and the wbinfo-tool. +samba3-winbind + %description utils -Some of the debug-tools for developpers. -Contains: - - debug2html - - locktest - - locktest2 - - masktest - - msgtest - - smbtorture - - talloctort - - several tdb-tools +samba3-utils + %description doc -The Samba Documentation. +samba3-doc + + +%description docbook +samba3-docbook -%description vfs -The Samba VFS-Modules. %description pdb -The Samba PDB-Modules. +samba3-pdb + +%if %{make_cifsvfs} + +%description cifsmount +samba3-cifsmount -%if %{newsam} > 0 -%description sam -The Samba SAM-Modules. %endif +%if %{make_vscan} %description vscan -The Samba VFS-Modules for Virusscanners. +samba3-vscan + +%endif +%if %{make_python} %description python -The Samba python-Modules. +samba3-python + +%endif +%if %{make_wrepld} + +%description wrepld +samba3-wrepld + +%endif + +%description -n libsmbclient +This package includes the libsmbclient library. + +Authors: +-------- + The Samba Team + + +%description -n libsmbclient-devel +This package contains static libraries and header files needed to develop +programs which make use of the smbclient programming interface. + +Authors: +-------- + The Samba Team + + diff --git a/packaging/bin/update-pkginfo b/packaging/bin/update-pkginfo index 8432173cc8..47f3c3c306 100755 --- a/packaging/bin/update-pkginfo +++ b/packaging/bin/update-pkginfo @@ -8,13 +8,9 @@ if [ $# -ne 2 ]; then exit 1 fi -for f in */*/*.tmpl; do - f2=`echo $f | sed s/.tmpl//g` - echo $f2 - sed -e s/PVERSION/$VERSION/g -e s/PRELEASE/$RELEASE/g < $f > $f2 -done -for f in */*.tmpl; do - f2=`echo $f | sed s/.tmpl//g` - echo $f2 - sed -e s/PVERSION/$VERSION/g -e s/PRELEASE/$RELEASE/g < $f > $f2 +for f in `du -a | awk '{print $2}' | grep \.tmpl$`; do + f2=`echo $f | sed s/.tmpl//g` + echo $f2 + sed -e s/PVERSION/$VERSION/g -e s/PRELEASE/$RELEASE/g < $f > $f2 done + -- cgit From dbfcec04a1691659743f8f6ab065b8212fd9a5dd Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 03:25:53 +0000 Subject: syncing packaging files from 3.0 (This used to be commit 9374755ad3b844a86642a7ea1795ec2b8ab736b2) --- packaging/Caldera/OpenLinux/.cvsignore | 6 - packaging/Caldera/OpenLinux/README.Public | 9 - packaging/Caldera/OpenLinux/README.home | 15 - packaging/Caldera/OpenLinux/README.profiles | 10 - packaging/Caldera/OpenLinux/findsmb | 141 -- packaging/Caldera/OpenLinux/makerpms.sh.tmpl | 54 - .../OpenLinux/samba-3.0.0.pre-install.patch | 12 - packaging/Caldera/OpenLinux/samba.daemon | 7 - packaging/Caldera/OpenLinux/samba.init | 66 - packaging/Caldera/OpenLinux/samba.init-lsb | 145 -- packaging/Caldera/OpenLinux/samba.logrotate | 12 - packaging/Caldera/OpenLinux/samba.pam | 49 - packaging/Caldera/OpenLinux/samba3.spec.tmpl | 455 ----- packaging/Caldera/OpenLinux/smb.conf | 51 - packaging/Caldera/OpenLinux/smb.conf.sample | 315 ---- packaging/Caldera/OpenLinux/smbadduser.perl | 146 -- packaging/Caldera/OpenLinux/smbprint | 77 - packaging/Caldera/OpenLinux/smbusers | 3 - packaging/Caldera/OpenLinux/updatesmbpasswd.perl | 10 - packaging/Caldera/OpenServer/Clean | 22 - packaging/Caldera/OpenServer/Compile | 48 - packaging/Caldera/OpenServer/Configure | 73 - packaging/Caldera/OpenServer/Install | 156 -- packaging/Caldera/OpenServer/Makevol | 10 - packaging/Caldera/OpenServer/Package | 13 - packaging/Caldera/OpenServer/README | 44 - packaging/Caldera/OpenServer/findsmb | 141 -- packaging/Caldera/OpenServer/pkg/Clean | 3 - packaging/Caldera/OpenServer/pkg/Install | 1 - packaging/Caldera/OpenServer/pkg/MakeSSO | 25 - packaging/Caldera/OpenServer/pkg/Packem | 15 - packaging/Caldera/OpenServer/pkg/Remove | 16 - packaging/Caldera/OpenServer/pkg/cdmt.config | 34 - packaging/Caldera/OpenServer/pkg/cntl/ccs | 108 -- packaging/Caldera/OpenServer/pkg/input/Samba.cmpnt | 25 - packaging/Caldera/OpenServer/pkg/input/Samba.pkg | 1905 -------------------- packaging/Caldera/OpenServer/pkg/input/Samba.prd | 6 - packaging/Caldera/OpenServer/samba-2.2-osr5.patch | 29 - packaging/Caldera/OpenServer/smb.conf | 291 --- packaging/Caldera/OpenServer/smb.init | 76 - packaging/Caldera/OpenServer/smbadduser | 73 - packaging/Caldera/OpenServer/smbprint | 77 - packaging/Caldera/OpenServer/smbusers | 3 - packaging/Caldera/UnixWare/Clean | 22 - packaging/Caldera/UnixWare/Compile | 52 - packaging/Caldera/UnixWare/Configure | 67 - packaging/Caldera/UnixWare/Install | 146 -- packaging/Caldera/UnixWare/Makepkg | 10 - packaging/Caldera/UnixWare/Package | 40 - packaging/Caldera/UnixWare/README | 54 - packaging/Caldera/UnixWare/findsmb | 141 -- packaging/Caldera/UnixWare/pkg/admin | 1 - packaging/Caldera/UnixWare/pkg/pkginfo | 10 - packaging/Caldera/UnixWare/pkg/postinstall | 56 - packaging/Caldera/UnixWare/pkg/postremove | 30 - packaging/Caldera/UnixWare/pkg/prototype | 310 ---- .../Caldera/UnixWare/samba-2.2-uw7-prototype.patch | 11 - packaging/Caldera/UnixWare/samba-2.2-uw7.patch | 200 -- packaging/Caldera/UnixWare/smb.conf | 291 --- packaging/Caldera/UnixWare/smb.init | 76 - packaging/Caldera/UnixWare/smbadduser | 73 - packaging/Caldera/UnixWare/smbprint | 77 - packaging/Caldera/UnixWare/smbusers | 3 - packaging/Digital/Instructions | 55 - packaging/Digital/PackageDate | 1 - packaging/Digital/Packager | 2 - packaging/Digital/Packaging-instructions | 14 - packaging/Digital/package-prep | 30 - packaging/Digital/samba.init | 34 - packaging/Digital/setup.sh | 24 - packaging/Digital/skeleton.tar | Bin 30720 -> 0 bytes 71 files changed, 6607 deletions(-) delete mode 100644 packaging/Caldera/OpenLinux/.cvsignore delete mode 100644 packaging/Caldera/OpenLinux/README.Public delete mode 100644 packaging/Caldera/OpenLinux/README.home delete mode 100644 packaging/Caldera/OpenLinux/README.profiles delete mode 100755 packaging/Caldera/OpenLinux/findsmb delete mode 100644 packaging/Caldera/OpenLinux/makerpms.sh.tmpl delete mode 100644 packaging/Caldera/OpenLinux/samba-3.0.0.pre-install.patch delete mode 100644 packaging/Caldera/OpenLinux/samba.daemon delete mode 100755 packaging/Caldera/OpenLinux/samba.init delete mode 100755 packaging/Caldera/OpenLinux/samba.init-lsb delete mode 100644 packaging/Caldera/OpenLinux/samba.logrotate delete mode 100644 packaging/Caldera/OpenLinux/samba.pam delete mode 100644 packaging/Caldera/OpenLinux/samba3.spec.tmpl delete mode 100644 packaging/Caldera/OpenLinux/smb.conf delete mode 100644 packaging/Caldera/OpenLinux/smb.conf.sample delete mode 100755 packaging/Caldera/OpenLinux/smbadduser.perl delete mode 100755 packaging/Caldera/OpenLinux/smbprint delete mode 100644 packaging/Caldera/OpenLinux/smbusers delete mode 100755 packaging/Caldera/OpenLinux/updatesmbpasswd.perl delete mode 100755 packaging/Caldera/OpenServer/Clean delete mode 100755 packaging/Caldera/OpenServer/Compile delete mode 100755 packaging/Caldera/OpenServer/Configure delete mode 100755 packaging/Caldera/OpenServer/Install delete mode 100755 packaging/Caldera/OpenServer/Makevol delete mode 100755 packaging/Caldera/OpenServer/Package delete mode 100644 packaging/Caldera/OpenServer/README delete mode 100755 packaging/Caldera/OpenServer/findsmb delete mode 100755 packaging/Caldera/OpenServer/pkg/Clean delete mode 100755 packaging/Caldera/OpenServer/pkg/Install delete mode 100755 packaging/Caldera/OpenServer/pkg/MakeSSO delete mode 100755 packaging/Caldera/OpenServer/pkg/Packem delete mode 100755 packaging/Caldera/OpenServer/pkg/Remove delete mode 100644 packaging/Caldera/OpenServer/pkg/cdmt.config delete mode 100755 packaging/Caldera/OpenServer/pkg/cntl/ccs delete mode 100644 packaging/Caldera/OpenServer/pkg/input/Samba.cmpnt delete mode 100644 packaging/Caldera/OpenServer/pkg/input/Samba.pkg delete mode 100644 packaging/Caldera/OpenServer/pkg/input/Samba.prd delete mode 100644 packaging/Caldera/OpenServer/samba-2.2-osr5.patch delete mode 100644 packaging/Caldera/OpenServer/smb.conf delete mode 100755 packaging/Caldera/OpenServer/smb.init delete mode 100755 packaging/Caldera/OpenServer/smbadduser delete mode 100755 packaging/Caldera/OpenServer/smbprint delete mode 100644 packaging/Caldera/OpenServer/smbusers delete mode 100755 packaging/Caldera/UnixWare/Clean delete mode 100755 packaging/Caldera/UnixWare/Compile delete mode 100755 packaging/Caldera/UnixWare/Configure delete mode 100755 packaging/Caldera/UnixWare/Install delete mode 100755 packaging/Caldera/UnixWare/Makepkg delete mode 100755 packaging/Caldera/UnixWare/Package delete mode 100644 packaging/Caldera/UnixWare/README delete mode 100755 packaging/Caldera/UnixWare/findsmb delete mode 100644 packaging/Caldera/UnixWare/pkg/admin delete mode 100644 packaging/Caldera/UnixWare/pkg/pkginfo delete mode 100755 packaging/Caldera/UnixWare/pkg/postinstall delete mode 100755 packaging/Caldera/UnixWare/pkg/postremove delete mode 100644 packaging/Caldera/UnixWare/pkg/prototype delete mode 100644 packaging/Caldera/UnixWare/samba-2.2-uw7-prototype.patch delete mode 100644 packaging/Caldera/UnixWare/samba-2.2-uw7.patch delete mode 100644 packaging/Caldera/UnixWare/smb.conf delete mode 100755 packaging/Caldera/UnixWare/smb.init delete mode 100755 packaging/Caldera/UnixWare/smbadduser delete mode 100755 packaging/Caldera/UnixWare/smbprint delete mode 100644 packaging/Caldera/UnixWare/smbusers delete mode 100644 packaging/Digital/Instructions delete mode 100644 packaging/Digital/PackageDate delete mode 100644 packaging/Digital/Packager delete mode 100644 packaging/Digital/Packaging-instructions delete mode 100755 packaging/Digital/package-prep delete mode 100755 packaging/Digital/samba.init delete mode 100755 packaging/Digital/setup.sh delete mode 100644 packaging/Digital/skeleton.tar diff --git a/packaging/Caldera/OpenLinux/.cvsignore b/packaging/Caldera/OpenLinux/.cvsignore deleted file mode 100644 index 062afa2b04..0000000000 --- a/packaging/Caldera/OpenLinux/.cvsignore +++ /dev/null @@ -1,6 +0,0 @@ -convertsmbpasswd.perl -make_smbpasswd.perl -makerpms.sh -samba2.spec -samba2.spec-lsb -samba3.spec diff --git a/packaging/Caldera/OpenLinux/README.Public b/packaging/Caldera/OpenLinux/README.Public deleted file mode 100644 index 00f41f3738..0000000000 --- a/packaging/Caldera/OpenLinux/README.Public +++ /dev/null @@ -1,9 +0,0 @@ -This directory is exported to any windows computer, if the daemon -"SMB server processes (samba)" is started and the distributed -configuration is used. So be careful about any data you put into -this directory. - -The default configuration restricts the access rights to read only -access. - -2000-03-13, Klaus Singvogel, Caldera (Deutschland) GmbH. diff --git a/packaging/Caldera/OpenLinux/README.home b/packaging/Caldera/OpenLinux/README.home deleted file mode 100644 index 5a893eb0e1..0000000000 --- a/packaging/Caldera/OpenLinux/README.home +++ /dev/null @@ -1,15 +0,0 @@ -This directory $HOME/Samba is exported to any windows computer, if -the daemon "SMB server processes (samba)" is started and the distributed -configuration is used. So be careful about the data you put into this -directory. - -Note: Only the user of this account can connect to this share. The -shares name is equal to the users Linux account, e.g. -\\your_linuxmachine\\your_linuxaccount - -If you want to have the files public accessible use the public browseable -share instead. It's currently /srv/samba/Public, but have a look at file -/etc/samba.d/smb.conf to get the latest name. - - -2000-03-13, Klaus Singvogel, Caldera (Deutschland) GmbH. diff --git a/packaging/Caldera/OpenLinux/README.profiles b/packaging/Caldera/OpenLinux/README.profiles deleted file mode 100644 index b629e10966..0000000000 --- a/packaging/Caldera/OpenLinux/README.profiles +++ /dev/null @@ -1,10 +0,0 @@ -This directory is used to store the roaming Profiles of your Windows -users. For more information install the package samba-doc and read the -file /usr/share/doc/packages/samba-2.0.7/docs/textdocs/DOMAIN.txt - -The default configuration sets the access rights to read/write for -anyone. If you see a problem in this, disable the Profiles support in -your samba configuration: either edit file /etc/samba.d/smb.conf or -use swat (http://localhost:901/). - -2000-03-13, Klaus Singvogel, Caldera (Deutschland) GmbH. diff --git a/packaging/Caldera/OpenLinux/findsmb b/packaging/Caldera/OpenLinux/findsmb deleted file mode 100755 index f70d18dcbd..0000000000 --- a/packaging/Caldera/OpenLinux/findsmb +++ /dev/null @@ -1,141 +0,0 @@ -#!/usr/bin/perl -# -# Prints info on all smb responding machines on a subnet. -# This script needs to be run on a machine without nmbd running and be -# run as root to get correct info from WIN95 clients. -# -# syntax: -# findsmb [subnet broadcast address] -# -# with no agrument it will list machines on the current subnet -# -# There will be a "+" in front of the workgroup name for machines that are -# local master browsers for that workgroup. There will be an "*" in front -# of the workgroup name for machines that are the domain master browser for -# that workgroup. -# - -$SAMBABIN = "/usr/bin"; - -for ($i = 0; $i < 2; $i++) { # test for -d option and broadcast address - $_ = shift; - if (m/-d|-D/) { - $DEBUG = 1; - } else { - if ($_) { - $BCAST = "-B $_"; - } - } -} - -sub ipsort # do numeric sort on last field of IP address -{ - @t1 = split(/\./,$a); - @t2 = split(/\./,$b); - @t1[3] <=> @t2[3]; -} - -# look for all machines that respond to a name lookup - -open(NMBLOOKUP,"$SAMBABIN/nmblookup $BCAST '*'|") || - die("Can't run nmblookup '*'.\n"); - -# get rid of all lines that are not a response IP address, -# strip everything but IP address and sort by last field in address - -@ipaddrs = sort ipsort grep(s/ \*<00>.*$//,); - -# print header info - -print "\nIP ADDR NETBIOS NAME WORKGROUP/OS/VERSION $BCAST\n"; -print "---------------------------------------------------------------------\n"; - -foreach $ip (@ipaddrs) # loop through each IP address found -{ - $ip =~ s/\n//; # strip newline from IP address - -# find the netbios names registered by each machine - - open(NMBLOOKUP,"$SAMBABIN/nmblookup -r -A $ip|") || - die("Can't get nmb name list.\n"); - @nmblookup = ; - close NMBLOOKUP; - -# get the first <00> name - - @name = grep(/<00>/,@nmblookup); - $_ = @name[0]; - if ($_) { # we have a netbios name - if (/GROUP/) { # is it a group name - ($name, $aliases, $type, $length, @addresses) = - gethostbyaddr(pack('C4',split('\.',$ip)),2); - if (! $name) { # could not get name - $name = "unknown nis name"; - } - } else { - /(.{1,15})\s+<00>\s+/; - $name = $1; - } - -# do an smbclient command on the netbios name. - - open(SMB,"$SAMBABIN/smbclient -N -L $name -I $ip -U% |") || - die("Can't do smbclient command.\n"); - @smb = ; - close SMB; - - if ($DEBUG) { # if -d flag print results of nmblookup and smbclient - print "===============================================================\n"; - print @nmblookup; - print @smb; - } - -# look for the OS= string - - @info = grep(/OS=/,@smb); - $_ = @info[0]; - if ($_) { # we found response - s/Domain=|OS=|Server=|\n//g; # strip out descriptions to make line shorter - - } else { # no OS= string in response (WIN95 client) - -# for WIN95 clients get workgroup name from nmblookup response - @name = grep(/<00> - /,@nmblookup); - $_ = @name[0]; - if ($_) { - /(.{1,15})\s+<00>\s+/; - $_ = "[$1]"; - } else { - $_ = "Unknown Workgroup"; - } - } - -# see if machine registered a local master browser name - if (grep(/<1d>/,@nmblookup)) { - $master = '+'; # indicate local master browser - if (grep(/<1b>/,@nmblookup)) { # how about domain master browser? - $master = '*'; # indicate domain master browser - } - } else { - $master = ' '; # not a browse master - } - -# line up info in 3 columns - - print "$ip".' 'x(16-length($ip))."$name".' 'x(14-length($name))."$master"."$_\n"; - - } else { # no netbios name found -# try getting the host name - ($name, $aliases, $type, $length, @addresses) = - gethostbyaddr(pack('C4',split('\.',$ip)),2); - if (! $name) { # could not get name - $name = "unknown nis name"; - } - if ($DEBUG) { # if -d flag print results of nmblookup - print "===============================================================\n"; - print @nmblookup; - } - print "$ip".' 'x(16-length($ip))."$name\n"; - } -} - diff --git a/packaging/Caldera/OpenLinux/makerpms.sh.tmpl b/packaging/Caldera/OpenLinux/makerpms.sh.tmpl deleted file mode 100644 index 3b8eda4d5c..0000000000 --- a/packaging/Caldera/OpenLinux/makerpms.sh.tmpl +++ /dev/null @@ -1,54 +0,0 @@ -#!/bin/sh -# Copyright (C) 1998 John H Terpstra, 2000 Klaus Singvogel -# -SPECDIR=${SPECDIR:-/usr/src/OpenLinux/SPECS} -SRCDIR=${SRCDIR:-/usr/src/OpenLinux/SOURCES} -USERID=`id -u` -GRPID=`id -g` -devel=0; -old=0; - -# Do some argument parsing... -if [ z$1 = z"devel" ]; then - devel=1; - shift -fi -if [ z$1 = z"old" ]; then - old=1; - shift -fi -if [ z$1 = z"team" ]; then - team=1; - shift -fi - -# Start preparing the packages... -if [ $devel -ne 0 ]; then - ( cd ../../../.. ; chown -R ${USERID}.${GRPID} samba3; mv samba3 samba-PVERSION ) - ( cd ../../../.. ; tar czvf ${SRCDIR}/samba-PVERSION.tar.gz samba-PVERSION; mv samba-PVERSION samba3 ) -else - ( cd ../../../.. ; chown -R ${USERID}.${GRPID} samba-PVERSION ) - ( cd ../../../.. ; tar czvf ${SRCDIR}/samba-PVERSION.tar.gz samba-PVERSION ) -fi - -cp -af *.spec *.spec-lsb $SPECDIR -#if [ $team -ne 0 ]; then -# cp *.spec-team $SPECDIR -#fi -for i in `ls *.patch` -do - cp $i $SRCDIR/ -done -# Start building the package -cd $SPECDIR -#if [ $old -eq 0 ]; then -#mv -f samba2.spec samba2.spec-nonlsb -#ln -f samba2.spec-lsb samba3.spec -#fi -if [ $team -ne 0 ]; then -# mv -f samba3.spec samba3.spec-lsb -# ln -f samba3.spec-team samba3.spec - rpm -ba -v samba3.spec -else - rpm -ba -v --rmsource --clean samba3.spec -fi diff --git a/packaging/Caldera/OpenLinux/samba-3.0.0.pre-install.patch b/packaging/Caldera/OpenLinux/samba-3.0.0.pre-install.patch deleted file mode 100644 index f6571a2763..0000000000 --- a/packaging/Caldera/OpenLinux/samba-3.0.0.pre-install.patch +++ /dev/null @@ -1,12 +0,0 @@ ---- samba/source/script/installbin.sh.orig Mon Dec 13 14:27:43 1999 -+++ samba/source/script/installbin.sh Fri Jun 16 15:06:13 2000 -@@ -34,7 +34,8 @@ - - # this is a special case, mount needs this in a specific location - if [ $p2 = smbmount ]; then -- ln -sf $BINDIR/$p2 /sbin/mount.smbfs -+ cp -p $BINDIR/$p2 /sbin/mount.smbfs -+ ln -s /sbin/mount.smbfs $BINDIR/$p2 - fi - done - diff --git a/packaging/Caldera/OpenLinux/samba.daemon b/packaging/Caldera/OpenLinux/samba.daemon deleted file mode 100644 index 78c357005e..0000000000 --- a/packaging/Caldera/OpenLinux/samba.daemon +++ /dev/null @@ -1,7 +0,0 @@ -IDENT=samba -DESCRIPTIVE="SMB server processes (samba)" -CONFIGURED="no" -ONBOOT="no" -OPTIONS_SMB="-D" -OPTIONS_NMB="-D" -OPTIONS_WINBD="" diff --git a/packaging/Caldera/OpenLinux/samba.init b/packaging/Caldera/OpenLinux/samba.init deleted file mode 100755 index 37955e1555..0000000000 --- a/packaging/Caldera/OpenLinux/samba.init +++ /dev/null @@ -1,66 +0,0 @@ -#!/bin/sh -# -# description: Starts and stops the Samba smbd and nmbd daemons -# used to provide SMB network services. - -NAME_S=smbd -DAEMON_S=/usr/sbin/$NAME_S -NAME_N=nmbd -DAEMON_N=/usr/sbin/$NAME_N -NAME_W=winbindd -DAEMON_W=/usr/sbin/winbindd - -# Source function library. -. /etc/rc.d/init.d/functions - -# Source networking configuration. -. /etc/sysconfig/network - -# See how we were called. -case "$1" in - start) - [ -e $SVIlock ] && exit 1 - [ ${NETWORKING} = "no" ] && exit 2 - [ -x $DAEMON_S -a -x $DAEMON_N ] || exit 2 - - #[ "$CONFIGURED" != "no" -a "$CONFIGURED" != "false" ] || { - SVIemptyConfig /etc/samba.d/smb.conf && { - echo "$DESCRIPTIVE: not configured! Skipped..." - exit 2 - } - - echo -n "Starting $IDENT: " - ssd -S -n $NAME_S -x $DAEMON_S -- $OPTIONS_SMB - ssd -S -n $NAME_N -x $DAEMON_N -- $OPTIONS_NMB - ssd -S -n $NAME_W -x $DAEMON_W -- $OPTIONS_WINBD - - echo "." - touch $SVIlock - ;; - - stop) - [ -e $SVIlock ] || exit 0 - - echo -n "Stopping $IDENT: " - ssd -K -p /var/lock/samba.d/$NAME_W.pid -n $NAME_W #-x $DAEMON_W - ssd -K -p /var/lock/samba.d/$NAME_N.pid -n $NAME_N #-x $DAEMON_N - ssd -K -p /var/lock/samba.d/$NAME_S.pid -n $NAME_S #-x $DAEMON_S - - echo "." - rm -f $SVIlock - ;; - - restart) - echo -n "Restarting $IDENT: " - $0 stop - $0 start - exit $? - ;; - - *) - echo "Usage: $SVIscript {start|restart|stop}" - exit 1 - ;; -esac - -exit 0 diff --git a/packaging/Caldera/OpenLinux/samba.init-lsb b/packaging/Caldera/OpenLinux/samba.init-lsb deleted file mode 100755 index 615e17b21f..0000000000 --- a/packaging/Caldera/OpenLinux/samba.init-lsb +++ /dev/null @@ -1,145 +0,0 @@ -#!/bin/bash -# -# -### BEGIN INIT INFO -# Provides: $samba -# Required-Start: $network -# Required-Stop: $network -# Default-Start: 2 3 4 5 -# Default-Stop: 0 1 6 -# Description: samba -# Starts and stops the Samba smbd and nmbd daemons -# used to provide SMB network services. -### END INIT INFO -# -# Written by Miquel van Smoorenburg . -# Modified for Debian GNU/Linux by Ian Murdock . -# Modified for OpenLinux by Raymund Will -# Adapted for samba by Klaus Singvogel - -NAME_S=smbd -DAEMON_S=/usr/sbin/$NAME_S -NAME_N=nmbd -DAEMON_N=/usr/sbin/$NAME_N -NAME_W=winbindd -DAEMON_W=/usr/sbin/$NAME_W - -config_file=/etc/samba.d/smb.conf - -# Source function library (and set vital variables). -. @SVIdir@/functions - -status() { - [ -e $1 ] || return 3; # lock / pid file doesn't exist, seems to be stopped - - i=`cat "$1"` - state=`egrep '^State' /proc/$i/status 2>/dev/null| sed 's#.* \(.\).*#\1#'` - if [ x$state = x -o x$state = xZ ]; then - return 2 # no such process (or zombie) --> dead - fi - return 0 # seems to be up and running -} - -# this function is dedicated to Jan Terpstra. -- Klaus Singvogel, Sep. 2001. -WinbdConfig() { - # returns 0 if winbindd is not configured, - # and 1 if winbindd is configured. - - local config_file=$1; shift # file to check - - # check if "winbind uid" is set in samba config file - egrep -q '[^#]*winbind uid' $config_file || return 0 - - found=0; - # We also need to check if least one PAM module control file does - # NOT have pam_winbind.so commented out - for i in /etc/pam.d/*; do - if [ ! -f $i ]; then next; fi - egrep -q '[^#]*pam_winbind.so' $i && found=1 && break; - done - - if [ $found != 0 ]; then - # if so, ensure that in /etc/nsswitch.conf we have for - # "passwd", "shadow", "group" an entry for "winbind" - egrep -q '^passwd:.*winbind' /etc/nsswitch.conf && return 1 - egrep -q '^shadow:.*winbind' /etc/nsswitch.conf && return 1 - egrep -q '^group:.*winbind' /etc/nsswitch.conf && return 1 - fi - - return 0 -} - -case "$1" in - start) - [ ! -e $SVIlock ] || exit 0 - [ -x $DAEMON_S -a -x $DAEMON_N ] || exit 5 - SVIemptyConfig $config_file && exit 6 - - echo -n "Starting $SVIsubsys services: " - ssd -S -n $NAME_S -x $DAEMON_S -- $OPTIONS_SMB - WinbdConfig $config_file || ssd -S -n $NAME_W -x $DAEMON_W -- $OPTIONS_WINBD - ssd -S -n $NAME_N -x $DAEMON_N -- $OPTIONS_NMB - ret=$? - - echo "." - touch $SVIlock - ;; - - stop) - [ -e $SVIlock ] || exit 0 - - echo -n "Stopping $SVIsubsys services: " - ssd -K -p /var/lock/samba.d/$NAME_S.pid -n $NAME_S #-x $DAEMON_S - ssd -K -p /var/lock/samba.d/$NAME_W.pid -n $NAME_W #-x $DAEMON_W - ssd -K -p /var/lock/samba.d/$NAME_N.pid -n $NAME_N #-x $DAEMON_N - - ret=$? - - echo "." - rm -f $SVIlock - ;; - - force-reload) - [ -e $SVIlock ] || exit 0 - $0 restart - ret=$? - ;; - - reload) - echo -n "Reloading $SVIsubsys service configuration: " - # nmbd has no config file to reload - ssd -K --signal 1 -p /var/lock/samba.d/$NAME_N.pid -n $NAME_N #-x $DAEMON_N - ssd -K --signal 1 -p /var/lock/samba.d/$NAME_W.pid -n $NAME_W #-x $DAEMON_W - ssd -K --signal 1 -p /var/lock/samba.d/$NAME_S.pid -n $NAME_S #-x $DAEMON_S - ret=$? - echo "." - ;; - - restart) - $0 stop - $0 start - ret=$? - ;; - - status) - echo -n "Checking status of $SVIsubsys service: " - status /var/lock/samba.d/$NAME_N.pid - ret=$? - if [ $ret -eq 0 ]; then - echo -n "$NAME_N " - status /var/lock/samba.d/$NAME_S.pid - ret=$? - [ $ret -eq 0 ] && echo -n "$NAME_S" - fi - echo "." - ;; - - *) - echo "Usage: $SVIscript {start|stop|restart|force-reload|reload|status}" - ret=2 - ;; - -esac - -exit $ret - diff --git a/packaging/Caldera/OpenLinux/samba.logrotate b/packaging/Caldera/OpenLinux/samba.logrotate deleted file mode 100644 index 46611f83d8..0000000000 --- a/packaging/Caldera/OpenLinux/samba.logrotate +++ /dev/null @@ -1,12 +0,0 @@ -/var/log/samba.d/nmbd { - postrotate - /usr/bin/killall -HUP nmbd - endscript -} - -/var/log/samba.d/smbd { - postrotate - /usr/bin/killall -HUP smbd - endscript -} - diff --git a/packaging/Caldera/OpenLinux/samba.pam b/packaging/Caldera/OpenLinux/samba.pam deleted file mode 100644 index 821c9046a6..0000000000 --- a/packaging/Caldera/OpenLinux/samba.pam +++ /dev/null @@ -1,49 +0,0 @@ -#%PAM-1.0 -#[For version 1.0 syntax, the above header is optional] -# -# The PAM configuration file for the `samba' service -# -# Note: Only one section should be active at a time. -# Uncomment only those features needed. The default is a minimal implementation. -# -# -------------------------------------------------------------------------------- -# This example uses the standard System Files (/etc/passwd,/etc/shadow,/etc/group) -# and uses a very vanila PAM configuration -# -# auth requisite pam_securetty.so -# auth requisite pam_nologin.so -# auth optional pam_env.so -auth required pam_pwdb.so nullok nodelay # audit -account required pam_pwdb.so nodelay # audit -# session required pam_mkhomedir.so -session required pam_pwdb.so nodelay -password required pam_pwdb.so nodelay # shadow md5 audit -# -# -------------------------------------------------------------------------------- -# This example uses PAM smbpass -# -# auth requisite pam_securetty.so -# auth requisite pam_nologin.so -# auth optional pam_env.so -# auth required pam_smbpass.so nodelay -# account required pam_pwdb.so nodelay # audit -# account sufficient pam_winbind.so -# session required pam_mkhomedir.so -# session required pam_pwdb.so nodelay -# password required pam_pwdb.so shadow md5 -# password required pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf -# -# -------------------------------------------------------------------------------- -# This example uses PAM WinBind -# -# auth requisite pam_securetty.so -# auth requisite pam_nologin.so -# auth optional pam_env.so -# auth sufficient pam_winbind.so -# auth sufficient pam_pwdb.so shadow nullok use_first_pass -# account required pam_pwdb.so nodelay # audit -# account sufficient pam_winbind.so -# session required pam_mkhomedir.so -# session required pam_pwdb.so nodelay -# password required pam_pwdb.so shadow md5 -# diff --git a/packaging/Caldera/OpenLinux/samba3.spec.tmpl b/packaging/Caldera/OpenLinux/samba3.spec.tmpl deleted file mode 100644 index f5c9071591..0000000000 --- a/packaging/Caldera/OpenLinux/samba3.spec.tmpl +++ /dev/null @@ -1,455 +0,0 @@ -%define Version PVERSION -%define date PRELEASE -%define Vendor Caldera -%define Dist OpenLinux -%define EtcSamba /etc/samba.d - -Name : samba -Version : %{Version} -Release : %{date} -Group : Server/Network - -Summary : Samba SMB client and server. - -Copyright : Andrew Tridgell, John H Terpstra; GPL Version 2 -Packager : Klaus Singvogel -#Icon : Caldera-daemon.gif -URL : http://samba.org/samba - -Requires : libpam >= 0.66, SysVinit-scripts >= 1.04-6 - - -BuildRoot : /tmp/%{Name}-%{Version} - -Source: ftp://ftp.samba.org/pub/samba/%{Name}-%{Version}.tar.gz - - -%Package doc -Group : Server/Network - -Summary : Documentation on SAMBA. - - -%Package -n smbfs -Group : System/Network - -Summary : Mount and unmount commands for SMB filesystems (smbfs). - - -%Package -n swat -Group : Administration/Network -Requires : setup >= 2.0-2, tcp_wrappers - -Summary : Samba Web Adminsitration Tool. - -%Package -n libsmbclient -Group : System/Network - -Summary : Samba Client Library. - -%Description -Samba provides an SMB server which can be used to provide network -services to SMB (sometimes called "Lan Manager") clients, including -various versions of MS Windows, OS/2, and other Linux machines. - -%Description -l de -Samba stellt einen SMB Server zur Verfügung, mit dem Netzwerkdienste für SMB -(auch "Lan Manager" genannt) Clients bereitgestellt werden können. Dies -schließt verschiedene Versionen von MS Windows, OS/2 und andere Linux -Maschinen ein. - -%Description -l es -Samba dispone de un servidor SMB que puede utilizarse para proporcionar -servicios de red a clientes SMB (a veces conocido como "Lan Manager"), -incluyendo varias versiones de MS Windows, OS/2 y otras máquinas Linux. - -%Description -l fr -Samba fournit un serveur SMB qui peut être utilisé pour fournir des services -de réseau aux clients SMB (parfois appelés "Lan Manager"), comportant -diverses versions de MS Windows, OS/2 et d'autres machines Linux. - -%Description -l it -Samba fornisce un server SMB che può essere usato per fornire servizi -di rete a client SMB (talvolta chiamato "Lan Manager"), comprese varie -versioni di MS Windows, OS/2 e altre macchine Linux. - -%Description -l pt -O Samba fornece um servidor de SMB que pode ser usado para fornecer serviços de -rede aos clientes de SMB (denominado por vezes como "Lan Manager"), incluindo -várias versões do Windows, OS/2 e outras máquinas Linux. - -%Description doc -This package contains extensive SAMBA documentation, including a FAQ, -comprehensive usage documentation, and a number of examples. - -%Description -l de doc -Dieses Paket enthält eine ausführliche SAMBA Dokumentation, inklusive -einer FAQ, umfassender Gebrauchsdokumentation und einer Reihe von -Beispielen. - -%Description -l es doc -Este paquete contiene una extensa documentación sobre SAMBA, incluyendo -FAQ (Preguntas de Uso Frecuente), documentación sobre el uso y algunos -ejemplos. - -%Description -l fr doc -Ce paquetage contient une documentation complète sur Samba, y compris -une FAQ détaillée de son utilisation et un certain nombre d'exemples. - -%Description -l it doc -Questo pacchetto contiene la documentazione su SAMBA tra cui una FAQ -una esaustiva documentazione d'uso e un certo numero di esempi. - -%Description -l pt doc -Este pacote contém alguma documentação extensa sobre o SAMBA, incluindo a FAQ, -alguma documentação compreensiva sobre a utilização e alguns exemplos. - -%Description -n smbfs -This package includes the tools necessary to mount filesystems from -SMB servers. - -%Description -l de -n smbfs -Dieses Paket enthält die nötigen Tools, um Dateisysteme von SMB-Servern -zu mounten. - -%Description -l es -n smbfs -este paqeute incluye las herramientas necesarias para montar sistemas de -ficheros de servidores SMB. - -%Description -l fr -n smbfs -Ce paquetage contient les outils nécessaires pour monter des systèmes -de fichiers sur des serveurs SMB. - -%Description -l it -n smbfs -Questo pacchetto contiene gli strumenti necessari per montare filesystem -da server SMB. - -%Description -l pt -n smbfs -Este pacote contém as ferramentas necessárias para montar sistema de -ficheiros de servidores SMB. - -%Description -n swat -SWAT allows a Samba administrator to configure the complex smb.conf -file via a Web browser. It also provides links to all the configurable -options in the smb.conf file allowing an administrator to easily look -up the effects of any change. - -%Description -l de -n swat -Mit SWAT kann ein Samba-Administrator die komplexe smb.conf -Datei mit Hilfe eines Web-Browsers konfigurieren. Es stellt auch Links zu -allen konfigurierbaren Optionen in der smb.conf Datei bereit, wodurch ein -Administrator die Auswirkungen einer Änderung leicht nachvollziehen kann. - -%Description -l es -n swat -SWAT permite a un administrador de Samba configurar el complejo fichero -smb.conf mediante una navegador web. También proporciona enlaces a todas las -opciones configurables en el fichero smb.conf, permitiendo al administrador -comprobar fácilmente los efectos de cualquier cambio. - -%Description -l fr -n swat -SWAT permet à un administrateur Samba de configurer le fichier smb.conf -complexe via un navigateur Web. Il fournit également des liens d'aide pour -toutes les options configurables dans le fichier smb.conf permettant à un -administrateur de consulter aisément les effets d'une modification. - -%Description -l it -n swat -SWAT permette ad un amministratore Samba di configurare il complesso file -smb.conf attraverso un browser Web. SWAT ha anche dei link di aiuto per -tutte le opzioni di configurazione del file smb.conf. - -%Description -l pt -n swat -O SWAT permite a um administrador de Samba configurar o complexo ficheiro -smb.conf através de uma interface Web. Fornece também referências para -todas as opções configuraveis no smb.conf, permitindo a um admnistrador -verificar rapidamente o efeite de qualquer alteração. - -%Description -n libsmbclient -SMB Client Library allows for POSIX like SMB client calls providing developers -a clean and stable API for SMB client application development. - - -%Prep -%setup - -for i in {cvs.,change-}log; do [ ! -f ../$i ] || mv ../$i source; done - -mv swat/help/welcome.html docs -%{fixUP} -vT docs -e ' - s:/usr/local/samba/bin/(smb(client|run)):/usr/bin/$1:g + - s:/usr/local/samba/bin/((s|n)mbd|swat):/usr/sbin/$1:g + - s:/usr/local/samba/var/locks:/var/lock/samba.d: + - s:/usr/local/samba/(var|lib)/log:/var/log/samba.d/smb: + - s:/usr/local/samba/swat:/usr/share/samba/swat:g + - s:/usr/local/samba/lib:%{EtcSamba}:g; -' -mv docs/welcome.html swat/help -for i in docs/*/smb.conf.5*; do - %{fixUP} -vT $i -e ' - s:users\.map:smbusers:g + - s:SAMBA_INSTALL_DIRECTORY/lib:%{EtcSamba}: + - s:None \(set in compile\)\.:(see above).: + - s:/usr/local/:/usr/:g; - ' -done -# End of DirtyHack(TM) - - -%Build -cd source -rm configure -autoconf - -CFLAGS="$RPM_OPT_FLAGS" LDFLAGS="-s" ./configure \ - --prefix=/usr \ - --localstatedir=/var \ - --libdir=/usr/lib/samba \ - --sbindir=/usr/sbin \ - --with-configdir='%{EtcSamba}' \ - --with-privatedir='$(LIBDIR)' \ - --with-lockdir=/var/lock/samba.d \ - --with-swatdir=/usr/share/swat \ - --with-smbmount \ - --with-pam \ - --with-tdbsam \ - --with-ldapsam \ - --with-krb5=/usr/athena \ - --with-winbind \ - --with-utmp \ - --with-quotas \ - --with-vfs \ - --with-msdfs \ - --with-profile \ - --with-syslog \ - --with-netatalk \ - --with-smbwrapper \ - --with-libsmbclient \ - --with-acl-support \ - --with-sambabook=/usr/share/swat/using_samba - -make all nsswitch/libnss_wins.so nsswitch/libnss_winbind.so torture nsswitch/pam_winbind.so modules everything pam_smbpass -(cd tdb; make tdbdump tdbtest tdbtorture tdbtool) - -%Install -%{mkDESTDIR} -VVS=packaging/%{Vendor}/%{Dist} - -mkdir -p $DESTDIR/etc/{{rc.d/init,logrotate,pam}.d,sysconfig/daemons} -mkdir -p $DESTDIR%{EtcSamba} -mkdir -p $DESTDIR/etc/skel/Samba -mkdir -p $DESTDIR/home/samba -mkdir -p $DESTDIR/lib/security -mkdir -p $DESTDIR/%{LSBservedir}/{netlogon,profiles,Public} -mkdir -p $DESTDIR%{NKinetdir} -mkdir -p $DESTDIR/{sbin,bin,usr/{sbin,bin}} -mkdir -p $DESTDIR/%{SVIdir} -mkdir -p $DESTDIR/usr/{include,lib/samba/vfs} -mkdir -p $DESTDIR/usr/share/samba/codepages/src -mkdir -p $DESTDIR/usr/share/swat/using_samba/{gifs,figs} -mkdir -p $DESTDIR/var/{lo{ck,g}/samba.d,spool/samba} - -make -C source DESTDIR=$RPM_BUILD_ROOT install-everything installclientlib - -strip $DESTDIR/usr/bin/smb{mount,mnt,umount} -# Add links for mount.smbfs -( cd $DESTDIR/sbin; ln -s /usr/bin/smbmount mount.smbfs; \ - ln -s /usr/bin/smbumount umount.smbfs ) - -# First install /usr/bin progs -for i in smbfilter debug2html -do - install -m 755 source/bin/$i $DESTDIR/usr/bin -done -# Next install /usr/sbin progs -for i in talloctort locktest locktest2 masktest msgtest smbtorture -do - install -m 755 source/bin/$i $DESTDIR/usr/sbin -done -for i in tdbdump tdbtest tdbtorture tdbtool -do - install -m 755 source/tdb/$i $DESTDIR/usr/sbin -done - -# Install the nsswitch library extension file -cp -p source/nsswitch/libnss_wins.so $DESTDIR/lib -cp -p source/nsswitch/libnss_winbind.so $DESTDIR/lib -cp -p source/nsswitch/pam_winbind.so $DESTDIR/lib/security -cp -p source/bin/pam_smbpass.so $DESTDIR/lib/security -# Make link for wins resolver -( cd $DESTDIR/lib; ln -s libnss_wins.so libnss_wins.so.2 ) - -# Add libsmbclient.a support stuff -install -m 755 source/bin/libsmbclient.a $DESTDIR/usr/lib - -# Add smbwrapper support -install -m 755 source/bin/smbsh $DESTDIR/usr/bin -install -m 755 source/bin/smbwrapper.so $DESTDIR/usr/lib - -# Ancilliary support files -cp -p $VVS/samba.init $DESTDIR/etc/rc.d/init.d/samba -ln -s /etc/rc.d/init.d/samba $DESTDIR/usr/sbin -cp -p $VVS/smb.conf.sample $DESTDIR%{EtcSamba}/smb.conf.sample -cp -p $VVS/smbusers $DESTDIR%{EtcSamba} -cp -p $VVS/findsmb $DESTDIR/usr/bin -cp -p $VVS/samba.daemon $DESTDIR/etc/sysconfig/daemons/samba -cp -p $VVS/samba.pam $DESTDIR/etc/pam.d/samba -cp -p $VVS/samba.logrotate $DESTDIR/etc/logrotate.d/samba - -cat <<-'EoH' > $DESTDIR%{EtcSamba}/lmhosts - 127.0.0.1 localhost -EoH - -# lsb has new way of inetd configuration -cat <$DESTDIR%{NKinetdir}/swat -swat stream tcp nowait.400 root /usr/sbin/tcpd swat -EoI - -pushd $DESTDIR/usr/sbin -rm -f *.so -popd - - -DOCD="$DESTDIR/%{_defaultdocdir}/samba-%{Version}"; mkdir -p $DOCD -ln -sf ../Copyrights/GPL-2.0 $DOCD/COPYING -cp -p README Manifest Read-Manifest-Now WHATSNEW.txt Roadmap $DOCD -cp -a docs examples $DOCD - -mv $DOCD/docs/htmldocs/wfw_slip.htm $DOCD/docs/wfw_slip.html - -rm -rf $DOCD/docs/{htmldocs,manpages,yodldocs} -rm -rf $DOCD/examples/{svr4-startup,printing} -rm -rf $DOCD/CVS $DOCD/*/CVS $DOCD/*/*/CVS $DOCD/*/*/*/CVS - -cp -p swat/README $DOCD/README.swat - -# This is the O'Reily Samba Book - on-line -for i in docs/htmldocs/using_samba/*.html -do -install -m644 $i $DESTDIR/usr/share/swat/using_samba -done -for i in docs/htmldocs/using_samba/figs/*.gif -do -install -m644 $i $DESTDIR/usr/share/swat/using_samba/figs -done -for i in docs/htmldocs/using_samba/gifs/*.gif -do -install -m644 $i $DESTDIR/usr/share/swat/using_samba/gifs -done - -%{fixUP} -vT $DOCD/examples -e 's:/usr/local/bin/:/usr/bin/:g;' -%{fixUP} -T $DESTDIR/%{SVIdir} -e 's:\@SVIdir\@:%{SVIdir}:' -%{fixUP} -vT $DOCD/examples -e 's:/usr/local/bin/:/usr/bin/:g;' -%{fixUP} -vT $DESTDIR/%{EtcSamba} -e 's:\@samba_home\@:%{LSBservedir}:' - -%{fixManPages} -( cd $DESTDIR/usr/share/man/lang; \ - cp -a . $DESTDIR/usr/share/man/en; \ - cd ..; \ - rm -rf lang ) - -%{mkLists} -c samba -cat << 'EOF' | %{mkLists} -d samba -Samba base -/lib/$ base -%{LSBservedir} config-IGNORED -^/(etc|var|home|tmp) config-IGNORED -swat swat -%{_defaultdocdir}/samba-[^/]+/$ base -%{_defaultdocdir}/samba- doc -tmp IGNORED -man IGNORED -/src/$ IGNORED -/usr/private/$ IGNORED -@default@ -EOF -cat << 'EOF' | %{mkLists} -f -a samba -\.old$ IGNORED -Samba/README.txt base -^/etc config-IGNORED -%{_defaultdocdir}/samba-[^/]+/(COPYING|README$) base -libnss_* base -pam_* base -vfs_* base -pdb_* base -smbsh base -smbwrapper.so base -%{_defaultdocdir}/samba-[^/]+/(COPYING|README$) base -%{_defaultdocdir}/samba- doc -smb(mount|mnt|umount) smbfs -mount.smbfs smbfs -swat swat -libsmbclient libsmbclient -@default@ -EOF - - -%Clean -%{rmDESTDIR} - - -%Post -/usr/lib/LSB/init-install %{Name} -ldconfig - -%Post -n swat -%{NKinetdReload} -perl -pi -e '$s=1 if /^swat/; - print "swat:ALL EXCEPT 127.0.0.1\n" if eof && ! $s' /etc/hosts.deny - - -%PostUn -test "$1" = "0" || exit 0 -/usr/lib/LSB/init-remove %{Name} -# We want to remove the browse.dat and wins.dat files so they can not -# interfer with a new version of samba! -rm -f /var/lock/samba/browse.dat -rm -f /var/lock/samba/{brlock,connections,locking,messages}.tdb -if [ -e /var/lock/samba.d/namelist.debug ]; then - rm -f /var/lock/samba.d/namelist.debug -fi -rm -f /var/lock/samba/unexpected.tdb -rm -f /var/lock/samba/{smbd,nmbd}.pid - -# Note: We MUST keep: -# winbindd_*, sshare_info*, printing*, ntdrivers* - - -%PostUn -n swat -#$no lsb: lisa --inetd disable swat $1 -test "$1" = "0" || exit 0 -%{SVIdir}/inet reload -[ -x /usr/sbin/swat ]||perl -ni -e '/^swat\s*\:/||print' /etc/hosts.deny - - -%Files -f files-samba-base -%defattr(-,root,root) -%config %attr(0755,root,root) %{SVIdir}/samba -%config %attr(644,root,root) /etc/sysconfig/daemons/samba -%config %attr(644,root,root) /etc/pam.d/samba -%config %attr(644,root,root) /etc/logrotate.d/samba -%config %attr(-,root,root) %{EtcSamba} -%dir %attr(755,root,root) /var/lock/samba.d -%dir %attr(755,root,root) /var/log/samba.d -%dir %attr(1777,root,root) /var/spool/samba -%dir %attr(755,root,root) %{LSBservedir} -%dir %attr(755,root,root) %{LSBservedir}/netlogon -%dir %attr(755,root,root) %{LSBservedir}/profiles -%dir %attr(755,root,root) %{LSBservedir}/Public - -%Files doc -f files-samba-doc -%defattr(-,root,root) - -%Files -n smbfs -f files-samba-smbfs -%defattr(-,root,root) - - -%Files -n swat -f files-samba-swat -%defattr(-,root,root) -%config %attr(644,root,root) %{NKinetdir}/swat - -%Files -n libsmbclient -f files-samba-libsmbclient -%defattr(-,root,root) - -%ChangeLog -* Mon Mar 11 2002 John H Terpstra -- Make this work - diff --git a/packaging/Caldera/OpenLinux/smb.conf b/packaging/Caldera/OpenLinux/smb.conf deleted file mode 100644 index e62c7bf1e4..0000000000 --- a/packaging/Caldera/OpenLinux/smb.conf +++ /dev/null @@ -1,51 +0,0 @@ -# Samba config file created using SWAT -# from localhost (127.0.0.1) - -# Global parameters -[global] - workgroup = MYGROUP - server string = Samba Server on Caldera OpenLinux - encrypt passwords = Yes - username map = /etc/samba.d/smbusers - password level = 8 - username level = 8 - log file = /var/log/samba.d/smb.%m - max log size = 200 - socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 - logon path = \\%L\Profiles\%U - dns proxy = No - printing = cups - -[homes] - comment = Home Directories - path = %H/Samba - username = %S - valid users = %S - writeable = Yes - create mask = 0750 - only user = Yes - browseable = No - -[netlogon] - comment = Samba Network Logon Service - path = @samba_home@/netlogon - guest ok = Yes - share modes = No - -[profiles] - path = @samba_home@/profiles - writeable = Yes - guest ok = Yes - browseable = No - -[printers] - comment = All Printers - path = /var/spool/samba - create mask = 0700 - printable = Yes - browseable = No - -[public] - comment = Public Stuff - path = @samba_home@/Public - write list = @users diff --git a/packaging/Caldera/OpenLinux/smb.conf.sample b/packaging/Caldera/OpenLinux/smb.conf.sample deleted file mode 100644 index cec5a8a8b2..0000000000 --- a/packaging/Caldera/OpenLinux/smb.conf.sample +++ /dev/null @@ -1,315 +0,0 @@ -# This is the main Samba configuration file. You should read the -# smb.conf(5) manual page in order to understand the options listed -# here. Samba has a huge number of configurable options (perhaps too -# many!) most of which are not shown in this example -# -# Any line which starts with a ; (semi-colon) or a # (hash) -# is a comment and is ignored. In this example we will use a # -# for commentry and a ; for parts of the config file that you -# may wish to enable -# -# NOTE: Whenever you modify this file you should run the command "testparm" -# to check that you have not many any basic syntactic errors. -# -#======================= Global Settings ===================================== -[global] - -# workgroup = NT-Domain-Name or Workgroup-Name - workgroup = MYGROUP - -# server string is the equivalent of the NT Description field - server string = Samba Server on Caldera OpenLinux - -# This option is important for security. It allows you to restrict -# connections to machines which are on your local network. The -# following example restricts access to two C class networks and -# the "loopback" interface. For more examples of the syntax see -# the smb.conf man page -; hosts allow = 192.168.1. 192.168.2. 127. - -# If you want to automatically load your printer list rather -# than setting them up individually then you'll need this - load printers = yes - -# you may wish to override the location of the printcap file -; printcap name = /etc/printcap - -# It should not be necessary to specify the print system type unless -# it is non-standard. Currently supported print systems include: -# bsd, sysv, plp, lprng, aix, hpux, qnx - printing = cups - -# Uncomment this if you want a guest account, you must add this to /etc/passwd -# otherwise the user "nobody" is used -; guest account = pcguest - -# this tells Samba to use a separate log file for each machine -# that connects - log file = /var/log/samba.d/smb.%m - -# Put a capping on the size of the log files (in Kb). - max log size = 200 - -# Security mode. Most people will want user level security. See -# security_level.txt for details. - security = user -# Use password server option only with security = server -; password server = - -# Password Level allows matching of _n_ characters of the password for -# all combinations of upper and lower case. - password level = 8 - username level = 8 - -# You may wish to use password encryption. Please read -# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation. -# Do not enable this option unless you have read those documents - encrypt passwords = yes - smb passwd file = /etc/samba.d/smbpasswd - -# The following are needed to allow password changing from Windows to -# update the Linux sytsem password also. -# NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above. -# NOTE2: You do NOT need these to allow workstations to change only -# the encrypted SMB passwords. They allow the Unix password -# to be kept in sync with the SMB password. -; unix password sync = Yes -; passwd program = /usr/bin/passwd %u -; passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* %n\n *passwd:*all*authentication*tokens*updated*successfully* - -# Unix users can map to different SMB User names - username map = /etc/samba.d/smbusers - -# Using the following line enables you to customise your configuration -# on a per machine basis. The %m gets replaced with the netbios name -# of the machine that is connecting -; include = /etc/samba.d/smb.conf.%m - -# Most people will find that this option gives better performance. -# See speed.txt and the manual pages for details - socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 - -# Configure Samba to use multiple interfaces -# If you have multiple network interfaces then you must list them -# here. See the man page for details. -; interfaces = 192.168.12.2/24 192.168.13.2/24 - -# Configure remote browse list synchronisation here -# request announcement to, or browse list sync from: -# a specific host or from / to a whole subnet (see below) -; remote browse sync = 192.168.3.25 192.168.5.255 -# Cause this host to announce itself to local subnets here -; remote announce = 192.168.1.255 192.168.2.44 - -# Browser Control Options: -# set local master to no if you don't want Samba to become a master -# browser on your network. Otherwise the normal election rules apply -; local master = no - -# OS Level determines the precedence of this server in master browser -# elections. The default value should be reasonable - os level = 20 - -# Domain Master specifies Samba to be the Domain Master Browser. This -# allows Samba to collate browse lists between subnets. Don't use this -# if you already have a Windows NT domain controller doing this job -; domain master = yes - -# Preferred Master causes Samba to force a local browser election on startup -# and gives it a slightly higher chance of winning the election -; preferred master = yes - -# Use only if you have an NT server on your network that has been -# configured at install time to be a primary domain controller. -; domain controller = - -# Enable this if you want Samba to be a domain logon server for -# Windows95 workstations. -; domain logons = yes - -# if you enable domain logons then you may want a per-machine or -# per user logon script -# run a specific logon batch file per workstation (machine) -; logon script = %m.bat -# run a specific logon batch file per username -; logon script = %U.bat - -# Where to store roving profiles (only for Win95 and WinNT) -# %L substitutes for this servers netbios name, %U is username -# You must uncomment the [Profiles] share below - logon path = \\%L\Profiles\%U - -# All NetBIOS names must be resolved to IP Addresses -# 'Name Resolve Order' allows the named resolution mechanism to be specified -# the default order is "host lmhosts wins bcast". "host" means use the unix -# system gethostbyname() function call that will use either /etc/hosts OR -# DNS or NIS depending on the settings of /etc/host.config, /etc/nsswitch.conf -# and the /etc/resolv.conf file. "host" therefore is system configuration -# dependant. This parameter is most often of use to prevent DNS lookups -# in order to resolve NetBIOS names to IP Addresses. Use with care! -# The example below excludes use of name resolution for machines that are NOT -# on the local network segment -# - OR - are not deliberately to be known via lmhosts or via WINS. -; name resolve order = wins lmhosts bcast - -# Windows Internet Name Serving Support Section: -# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server -; wins support = yes - -# WINS Server - Tells the NMBD components of Samba to be a WINS Client -# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both -; wins server = w.x.y.z - -# WINS Proxy - Tells Samba to answer name resolution queries on -# behalf of a non WINS capable client, for this to work there must be -# at least one WINS Server on the network. The default is NO. -; wins proxy = yes - -# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names -# via DNS nslookups. The built-in default for versions 1.9.17 is yes, -# this has been changed in version 1.9.18 to no. - dns proxy = no - -# Case Preservation can be handy - system default is _no_ -# NOTE: These can be set on a per share basis -; preserve case = no -; short preserve case = no -# Default case is normally upper case for all DOS files -; default case = lower -# Be very careful with case sensitivity - it can break things! -; case sensitive = no - -#============================ Share Definitions ============================== -[homes] - comment = Home Directories -; this gives access to a 'Public' sub-directory in each user's home... -; (it is named 'public' as it is intended to be used by other sharing -; technologies (like NetWare, appletalk) too and may get disclosed due -; to weak protocols! -- hmm, are there less secure protocols than NFS? :) - path = %H/Samba - valid users = %S - users = %S - only user = yes - browseable = no - writable = yes - create mask = 0750 - -# Un-comment the following and create the netlogon directory for Domain Logons -[netlogon] - comment = Samba Network Logon Service - path = @samba_home@/netlogon - guest ok = yes - writable = no - share modes = no - - -# Un-comment the following to provide a specific roving profile share -# the default is to use the user's home directory -[profiles] - path = @samba_home@/profiles - writeable = yes - browseable = no - guest ok = yes - - -# NOTE: If you have a BSD-style print system there is no need to -# specifically define each individual printer -[printers] - comment = All Printers - path = /var/spool/samba - browseable = no -# Set public = yes to allow user 'guest account' to print - guest ok = no - writable = no - printable = yes - create mask = 0700 - -# A publicly accessible directory, but read only, except for people in -# the "users" group -[public] - comment = Public Stuff - path = @samba_home@/public - browseable = yes - read only = yes - public = no - printable = no -; writable = yes -# access may be controlled by these options -; read list = user1, user2, @group -; valid users = user1, user3 -; write list = @users - -# Other examples. -# -# This one is useful for people to share files, BUT -# access to '/tmp' or '/var/tmp' should *not* be given lightly, -# as this can (still) pose a security threat! -# Better use a dedicate sub-directory to /(var/)tmp or something -# like a [public] share! -[tmp] - comment = Temporary file space - path = /tmp - browseable = yes - read only = yes - public = no - printable = no - -# A private printer, usable only by fred. Spool data will be placed in fred's -# home directory. Note that fred must have write access to the spool directory, -# wherever it is. -;[fredsprn] -; comment = Fred's Printer -; valid users = fred -; path = /homes/fred -; printer = freds_printer -; public = no -; writable = no -; printable = yes - -# A private directory, usable only by fred. Note that fred requires write -# access to the directory. -;[fredsdir] -; comment = Fred's Service -; path = /usr/somewhere/private -; valid users = fred -; public = no -; writable = yes -; printable = no - -# a service which has a different directory for each machine that connects -# this allows you to tailor configurations to incoming machines. You could -# also use the %u option to tailor it by user name. -# The %m gets replaced with the machine name that is connecting. -;[pchome] -; comment = PC Directories -; path = /usr/pc/%m -; public = no -; writable = yes - -# A publicly accessible directory, read/write to all users. Note that all files -# created in the directory by users will be owned by the default user, so -# any user with access can delete any other user's files. Obviously this -# directory must be writable by the default user. Another user could of course -# be specified, in which case all files would be owned by that user instead. -;[public] -; path = /usr/somewhere/else/public -; public = yes -; only guest = yes -; writable = yes -; printable = no - -# The following two entries demonstrate how to share a directory so that two -# users can place files there that will be owned by the specific users. In this -# setup, the directory should be writable by both users and should have the -# sticky bit set on it to prevent abuse. Obviously this could be extended to -# as many users as required. -;[myshare] -; comment = Mary's and Fred's stuff -; path = /usr/somewhere/shared -; valid users = mary fred -; public = no -; writable = yes -; printable = no -; create mask = 0765 - - diff --git a/packaging/Caldera/OpenLinux/smbadduser.perl b/packaging/Caldera/OpenLinux/smbadduser.perl deleted file mode 100755 index 61bec2320d..0000000000 --- a/packaging/Caldera/OpenLinux/smbadduser.perl +++ /dev/null @@ -1,146 +0,0 @@ -#!/usr/bin/perl -w -# -# smbadduser - Written by Mike Zakharoff -# perl-rewrite by Raymund Will -# - -$smbpasswd = "/etc/samba.d/smbpasswd"; -$user_map = "/etc/samba.d/smbusers"; -# -# Set to site specific passwd command -# -$passwd = "cat /etc/passwd |"; -#$passwd = "niscat passwd.org_dir |"; -if ( -e "/var/run/ypbind.pid" ) { - $passwd = "(cat /etc/passwd; ypcat passwd ) |"; -} - -$line = "-" x 58; -if ($#ARGV < 0) { - print < ) { - next unless (/^[A-Za-z0-9_]+:/); - @t = split(/:/); - $U{$t[0]} = join( ":", ($t[0], $t[2], $X, $X, $t[4], $t[5], $t[6])); - } - close( IN); -} -# get all smb passwords (later skip already existent) -%S = (); -$Cs = ""; -if ( -r $smbpasswd ) { - open( IN, $smbpasswd) || die( "ERROR: open($smbpasswd): $!\n"); - while ( ) { - if ( /^\#/ ) { - $Cs .= $_; next; - } elsif ( ! /^([A-Za-z0-9_]+):/ ) { - chop; print STDERR "ERROR: $_: invalid smbpasswd entry!\n"; next; - } - $S{$1} = $_; - } - close( IN); -} -# get all map entries -%M = (); -$Cm = ""; -if ( -r $user_map ) { - open( IN, $user_map) || die( "ERROR: open($user_map): $!\n"); - while ( ) { - if ( /^\#/ ) { - $Cm .= $_; next; - } elsif ( ! /^([A-Za-z0-9_]+)\s*=\s*(\S.+\S)\s*/ ) { - chop; print STDERR "ERROR: $_: invalid user-map entry!\n"; next; - } - $M{$1} = $2; - } - close( IN); -} -# check parameter syntax -%N = (); -{ - foreach ( @ARGV ) { - my ( $u, $s, @R) = split(/:/); - if ( $#R >= 0 ) { - print STDERR "ERROR: $_: Must use unixid[:ntid] SKIPPING...\n"; - next; - } - $s = $u unless ( defined( $s) ); - if ( ! exists( $U{$u}) ) { - print STDERR "ERROR: $u: Not in passwd database SKIPPING...\n"; - next; - } - if ( exists( $S{$u}) ) { - print STDERR "ERROR: $u: Already in smbpasswd database SKIPPING...\n"; - next; - } - print "Adding: $u to $smbpasswd\n"; - $S{$u} = $U{$u}; - if ( $u ne $s ) { - if ( exists( $M{$u}) ) { - if ( $M{$u} !~ /\b$s\b/ ) { - print "Adding: $s to $u in $user_map\n"; - $M{$u} .= " $s"; - } - } else { - print "Mapping: $s to $u in $user_map\n"; - $M{$u} = $s; - } - } - $N{$u} = $s; - } -} -# rewrite $smbpasswd -{ - open( OUT, "> $smbpasswd.new") || die( "ERROR: open($smbpasswd.new): $!\n"); - $Cs = "#\n# SMB password file.\n#\n" unless ( $Cs ); - print OUT $Cs; - foreach ( sort( keys( %S)) ) { - print OUT $S{$_}; - } - close( OUT); - rename( $smbpasswd, $smbpasswd . "-"); - rename( $smbpasswd . ".new", $smbpasswd) || die; -} -# rewrite $user_map -{ - open( OUT, "> $user_map.new") || die( "ERROR: open($user_map.new): $!\n"); - $Cm = "# Unix_name = SMB_name1 SMB_name2 ...\n" unless ( $Cm ); - print OUT $Cm; - foreach ( sort( keys( %M)) ) { - print OUT "$_ = $M{$_}\n"; - } - close( OUT); - rename( $user_map, $user_map . "-"); - rename( $user_map . ".new", $user_map) || die; -} -# call 'smbpasswd' for each new -{ - foreach ( sort( keys( %N)) ) { - print $line . "\n"; - print "ENTER password for $_\n"; - system( "smbpasswd $_"); - } -} - diff --git a/packaging/Caldera/OpenLinux/smbprint b/packaging/Caldera/OpenLinux/smbprint deleted file mode 100755 index 5d66aa1377..0000000000 --- a/packaging/Caldera/OpenLinux/smbprint +++ /dev/null @@ -1,77 +0,0 @@ -#!/bin/sh - -# This script is an input filter for printcap printing on a unix machine. It -# uses the smbclient program to print the file to the specified smb-based -# server and service. -# For example you could have a printcap entry like this -# -# smb:lp=/dev/null:sd=/usr/spool/smb:sh:if=/usr/local/samba/smbprint -# -# which would create a unix printer called "smb" that will print via this -# script. You will need to create the spool directory /usr/spool/smb with -# appropriate permissions and ownerships for your system. - -# Set these to the server and service you wish to print to -# In this example I have a WfWg PC called "lapland" that has a printer -# exported called "printer" with no password. - -# -# Script further altered by hamiltom@ecnz.co.nz (Michael Hamilton) -# so that the server, service, and password can be read from -# a /var/spool/lpd/PRINTNAME/.config file. -# -# In order for this to work the /etc/printcap entry must include an -# accounting file (af=...): -# -# cdcolour:\ -# :cm=CD IBM Colorjet on 6th:\ -# :sd=/var/spool/lpd/cdcolour:\ -# :af=/var/spool/lpd/cdcolour/acct:\ -# :if=/usr/local/etc/smbprint:\ -# :mx=0:\ -# :lp=/dev/null: -# -# The /usr/var/spool/lpd/PRINTNAME/.config file should contain: -# server=PC_SERVER -# service=PR_SHARENAME -# password="password" -# -# E.g. -# server=PAULS_PC -# service=CJET_371 -# password="" - -# -# Debugging log file, change to /dev/null if you like. -# -# logfile=/tmp/smb-print.log -logfile=/dev/null - - -# -# The last parameter to the filter is the accounting file name. -# Extract the directory name from the file name. -# Concat this with /.config to get the config file. -# -eval acct_file=\${$#} -spool_dir=`dirname $acct_file` -config_file=$spool_dir/.config - -# Should read the following variables set in the config file: -# server -# service -# password -eval `cat $config_file` - -# -# Some debugging help, change the >> to > if you want to save space. -# -echo "server $server, service $service" >> $logfile - -( -# NOTE You may wish to add the line `echo translate' if you want automatic -# CR/LF translation when printing. -# echo translate - echo "print -" - cat -) | /usr/bin/smbclient "//$server/$service" $password -U $server -N -P >> $logfile 2>&1 diff --git a/packaging/Caldera/OpenLinux/smbusers b/packaging/Caldera/OpenLinux/smbusers deleted file mode 100644 index ae3389f53f..0000000000 --- a/packaging/Caldera/OpenLinux/smbusers +++ /dev/null @@ -1,3 +0,0 @@ -# Unix_name = SMB_name1 SMB_name2 ... -root = administrator admin -nobody = guest pcguest smbguest diff --git a/packaging/Caldera/OpenLinux/updatesmbpasswd.perl b/packaging/Caldera/OpenLinux/updatesmbpasswd.perl deleted file mode 100755 index 60f572b490..0000000000 --- a/packaging/Caldera/OpenLinux/updatesmbpasswd.perl +++ /dev/null @@ -1,10 +0,0 @@ -#!/usr/bin/perl -w -while ( <> ) { - print; - @V = split(/:/); - $_ = $V[3]; - if ( $V[0] !~ /^\#/ && !(/^[0-9A-F]{32}$/ || /^X{32}$/ || /^\*{32}$/) ) { - $V[3] = "X" x 32; - } - print( join( ':', @V)); -} diff --git a/packaging/Caldera/OpenServer/Clean b/packaging/Caldera/OpenServer/Clean deleted file mode 100755 index fe4eed2527..0000000000 --- a/packaging/Caldera/OpenServer/Clean +++ /dev/null @@ -1,22 +0,0 @@ -#!/bin/sh -# -# Cleanup after having configured, compiled, installed and packaged. -# Careful - running this script attempts to restore this hierarchy to -# freshly unpacked source -# -# Invoke as "./Clean -n" to get this script to tell you what it would do -# without doing anything -# - -V= -[ "$1" = "-n" ] && V=echo - -[ -d dist ] && $V rm -rf dist -[ -f ../../../source/Makefile ] && { - $V cd ../../../source - $V rm -f bin/locktest bin/masktest bin/smbsh bin/debug2html \ - bin/locktest2 bin/smbfilter bin/smbtorture - $V make clean - $V make distclean - $V rm -f mout* -} diff --git a/packaging/Caldera/OpenServer/Compile b/packaging/Caldera/OpenServer/Compile deleted file mode 100755 index cba414ec74..0000000000 --- a/packaging/Caldera/OpenServer/Compile +++ /dev/null @@ -1,48 +0,0 @@ -#!/bin/ksh -# -# invoke with -n as the first argument to get this script to tell -# you what it would do without doing anything -# - -V= -[ "$1" = "-n" ] && V=echo - -CC="gcc -I/usr/local/include -L/usr/local/lib" -CFLAGS="-O3 -I/usr/local/include -L/usr/local/lib" -CXX="g++" -CXXFLAGS="-O3 -I/usr/local/include/stl -I/usr/local/include -L/usr/local/lib" -RANLIB=true -MAKE=/usr/local/bin/make -if [ "$V" = "echo" ] -then - echo "exporting the following shell variables:" - echo "CC=$CC" - echo "CXX=$CXX" - echo "RANLIB=$RANLIB" - echo "MAKE=$MAKE" - echo "CFLAGS=$CFLAGS" - echo "CXXFLAGS=$CXXFLAGS" -else - export CC CXX RANLIB MAKE CFLAGS CXXFLAGS -fi - -if [ "$V" = "echo" ] -then - echo "cd ../../../source" - echo "rm -f mout-1 mout-2 mout-3 mout-4" - echo "make all 2>&1 | tee mout-1" - echo "make smbfilter smbtorture debug2html 2>&1 | tee mout-2" - echo "make bin/smbspool smbwrapper bin/wbinfo 2>&1 | tee mout-3" - echo "make masktest locktest locktest2 2>&1 | tee mout-3" -else - cd ../../../source - rm -f mout-1 mout-2 mout-3 mout-4 - make all 2>&1 | tee mout-1 - make smbfilter smbtorture debug2html 2>&1 | tee mout-2 - make bin/smbspool smbwrapper bin/wbinfo 2>&1 | tee mout-3 - make masktest locktest locktest2 2>&1 | tee mout-3 -fi -# -# Not building : -# nsswitch - no -# rpctorture - improper use of client_info struct, dunno diff --git a/packaging/Caldera/OpenServer/Configure b/packaging/Caldera/OpenServer/Configure deleted file mode 100755 index 65a4f1186f..0000000000 --- a/packaging/Caldera/OpenServer/Configure +++ /dev/null @@ -1,73 +0,0 @@ -#!/bin/ksh -# -# invoke with -n as the first argument to get this script to tell -# you what it would do without doing anything -# - -V= -[ "$1" = "-n" ] && V=echo - -CC="gcc -I/usr/local/include -L/usr/local/lib" -CFLAGS="-O3 -I/usr/local/include -L/usr/local/lib" -CXX="g++" -CXXFLAGS="-O3 -I/usr/local/include/stl -I/usr/local/include -L/usr/local/lib" -RANLIB=true -MAKE=/usr/local/bin/make -PREFIX=/usr/local/samba -if [ "$V" = "echo" ] -then - echo "exporting the following shell variables:" - echo "CC=$CC" - echo "CXX=$CXX" - echo "RANLIB=$RANLIB" - echo "MAKE=$MAKE" - echo "CFLAGS=$CFLAGS" - echo "CXXFLAGS=$CXXFLAGS" - echo "PREFIX=$PREFIX" -else - export CC CXX RANLIB MAKE CFLAGS CXXFLAGS PREFIX -fi - -cd ../../../source -[ -f mout-config ] && { - if [ "$V" = "echo" ] - then - echo "mv mout-config mout-config$$" - else - mv mout-config mout-config$$ - fi -} -if [ "$V" = "echo" ] -then - echo "./configure \ - --prefix=${PREFIX} \ - --with-profile \ - --with-syslog \ - --with-utmp \ - --with-vfs \ - --with-msdfs \ - --with-netatalk \ - --with-sambabook=${PREFIX}/swat/using_samba \ - 2>&1 | tee mout-config" -else - ./configure \ - --prefix=${PREFIX} \ - --with-profile \ - --with-syslog \ - --with-utmp \ - --with-vfs \ - --with-msdfs \ - --with-netatalk \ - --with-sambabook=${PREFIX}/swat/using_samba \ - 2>&1 | tee mout-config -fi - -cat >> include/config.h < /tmp/nouser$$ -cp /tmp/nouser$$ include/local.h -rm -f /tmp/nouser$$ diff --git a/packaging/Caldera/OpenServer/Install b/packaging/Caldera/OpenServer/Install deleted file mode 100755 index ab27b6f67f..0000000000 --- a/packaging/Caldera/OpenServer/Install +++ /dev/null @@ -1,156 +0,0 @@ -#!/bin/ksh -# -# invoke with -n as the first argument to get this script to tell -# you what it would do without doing anything -# - -V= -[ "$1" = "-n" ] && V=echo - -# Make sure we pick up the install binary from /usr/local/bin -# rather than /etc/install -PATH=/usr/local/bin:$PATH -export PATH - -PREFIX=/usr/local/samba -HERE=`pwd` -PKGDIR=packaging/Caldera/OpenServer - -BUILD_ROOT=${HERE}/dist -BLDFIX=${BUILD_ROOT}/${PREFIX} -$V rm -rf $BUILD_ROOT -$V mkdir -p $BUILD_ROOT/etc/init.d -$V mkdir -p ${BLDFIX}/bin -$V mkdir -p ${BLDFIX}/sbin -$V mkdir -p ${BLDFIX}/swat/using_samba/gifs -$V mkdir -p ${BLDFIX}/swat/using_samba/figs -$V mkdir -p ${BLDFIX}/swat/images -$V mkdir -p ${BLDFIX}/swat/help -$V mkdir -p ${BLDFIX}/swat/include -$V mkdir -p ${BLDFIX}/man/man.1 -$V mkdir -p ${BLDFIX}/man/man.5 -$V mkdir -p ${BLDFIX}/man/man.7 -$V mkdir -p ${BLDFIX}/man/man.8 -$V mkdir -p ${BLDFIX}/var/locks -$V mkdir -p ${BLDFIX}/lib/codepages/src - -# Copy into the dist tree the custom data files -for i in Clean Install MakeSSO Packem Remove cdmt.config -do - $V cp pkg/$i ${BUILD_ROOT} -done -for i in cntl input -do - $V rm -rf ${BUILD_ROOT}/$i - $V cp -r pkg/$i ${BUILD_ROOT}/$i -done - -cd ../../.. - -# Install standard binary files -for i in nmblookup smbclient smbpasswd smbstatus testparm testprns \ - make_smbcodepage make_unicodemap make_printerdef rpcclient smbspool \ - smbsh -do -$V install -m755 -s source/bin/$i ${BLDFIX}/bin -done -for i in mksmbpasswd.sh smbtar -do -$V install -m755 source/script/$i ${BLDFIX}/bin -done - -# Install secure binary files -for i in smbd nmbd swat debug2html smbtorture smbfilter locktest2 masktest -do -$V install -m755 -s source/bin/$i ${BLDFIX}/sbin -done - - -# Install level 1 man pages -for i in *.1 -do -$V install -m644 docs/manpages/$i ${BLDFIX}/man/man.1 -done - -# Install codepage source files -for i in 437 737 775 850 852 861 866 932 936 949 950 1251 -do -$V install -m644 source/codepages/codepage_def.$i ${BLDFIX}/lib/codepages/src -done -for i in 437 737 850 852 861 866 932 936 949 950 ISO8859-1 ISO8859-2 ISO8859-5 ISO8859-7 KOI8-R -do -$V install -m644 source/codepages/CP$i.TXT ${BLDFIX}/lib/codepages/src -done - -# Install SWAT helper files -for i in swat/help/*.html docs/htmldocs/*.html -do -$V install -m644 $i ${BLDFIX}/swat/help -done -for i in swat/images/*.gif -do -$V install -m644 $i ${BLDFIX}/swat/images -done -for i in swat/include/*.html -do -$V install -m644 $i ${BLDFIX}/swat/include -done - -# This is the O'Reily Samba Book - on-line -for i in docs/htmldocs/using_samba/*.html -do -$V install -m644 $i ${BLDFIX}/swat/using_samba -done -for i in docs/htmldocs/using_samba/figs/*.gif -do -$V install -m644 $i ${BLDFIX}/swat/using_samba/figs -done -for i in docs/htmldocs/using_samba/gifs/*.gif -do -$V install -m644 $i ${BLDFIX}/swat/using_samba/gifs -done - -# Install the miscellany -$V install -m644 swat/README ${BLDFIX}/swat -$V install -m644 docs/manpages/smb.conf.5 ${BLDFIX}/man/man.5 -$V install -m644 docs/manpages/lmhosts.5 ${BLDFIX}/man/man.5 -$V install -m644 docs/manpages/smbpasswd.5 ${BLDFIX}/man/man.5 -$V install -m644 docs/manpages/samba.7 ${BLDFIX}/man/man.7 -$V install -m644 docs/manpages/smbd.8 ${BLDFIX}/man/man.8 -$V install -m644 docs/manpages/nmbd.8 ${BLDFIX}/man/man.8 -$V install -m644 docs/manpages/smbpasswd.8 ${BLDFIX}/man/man.8 -$V install -m644 docs/manpages/swat.8 ${BLDFIX}/man/man.8 -$V install -m644 docs/manpages/smbmount.8 ${BLDFIX}/man/man.8 -$V install -m644 docs/manpages/smbmnt.8 ${BLDFIX}/man/man.8 -$V install -m644 docs/manpages/smbumount.8 ${BLDFIX}/man/man.8 -$V install -m644 ${PKGDIR}/smb.conf ${BLDFIX}/lib/smb.conf -$V install -m644 ${PKGDIR}/smbusers $BUILD_ROOT/etc/smbusers -$V install -m755 ${PKGDIR}/smbprint ${BLDFIX}/bin -$V install -m755 ${PKGDIR}/findsmb ${BLDFIX}/bin -$V install -m755 ${PKGDIR}/smbadduser ${BLDFIX}/bin -$V install -m755 ${PKGDIR}/smb.init $BUILD_ROOT/etc/init.d/samba - -# The following is now done in the postinstall script -# -# if [ "$V" = "echo" ] -# then -# echo "echo 127.0.0.1 localhost > $BUILD_ROOT/etc/lmhosts" -# else -# echo 127.0.0.1 localhost > $BUILD_ROOT/etc/lmhosts -# fi -# -# Build codepage load files -# $V cd ${BLDFIX}/lib/codepages -# for i in 437 737 775 850 852 861 866 932 936 949 950 1251 -# do -# $V ${PREFIX}/bin/make_smbcodepage c $i \ -# ${BLDFIX}/lib/codepages/src/codepage_def.$i \ -# ${BLDFIX}/lib/codepages/codepage.$i -# done -# for i in 437 737 850 852 861 866 932 936 949 950 \ -# ISO8859-1 ISO8859-2 ISO8859-5 ISO8859-7 KOI8-R -# do -# $V ${PREFIX}/bin/make_unicodemap $i \ -# ${BLDFIX}/lib/codepages/src/CP$i.TXT \ -# ${BLDFIX}/lib/codepages/unicode_map.$i -# done diff --git a/packaging/Caldera/OpenServer/Makevol b/packaging/Caldera/OpenServer/Makevol deleted file mode 100755 index dc57b246ef..0000000000 --- a/packaging/Caldera/OpenServer/Makevol +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/ksh -# -# invoke with -n as the first argument to get this script to tell -# you what it would do without doing anything -# - -./Configure $* -./Compile $* -./Install $* -./Package $* diff --git a/packaging/Caldera/OpenServer/Package b/packaging/Caldera/OpenServer/Package deleted file mode 100755 index c954e55e1e..0000000000 --- a/packaging/Caldera/OpenServer/Package +++ /dev/null @@ -1,13 +0,0 @@ -#!/bin/ksh -# -# Now create the actual custom installable media images -# -# invoke with -n as the first argument to get this script to tell -# you what it would do without doing anything -# - -V= -[ "$1" = "-n" ] && V=echo - -$V cd dist -$V ./MakeSSO diff --git a/packaging/Caldera/OpenServer/README b/packaging/Caldera/OpenServer/README deleted file mode 100644 index 794bf54604..0000000000 --- a/packaging/Caldera/OpenServer/README +++ /dev/null @@ -1,44 +0,0 @@ -Preparation Date: April 13, 2001 -Preparer: Ronald Joe Record - -Instructions: Preparing Samba Packages for SCO OpenServer -=============================================================== - -We provide support only for current versions of SCO OpenServer - -The file samba-2.2-osr5.patch is a patch file suitable for use -with the patch command as follows: - - # cd ../../../source - # patch -p 0 -i ../packaging/Caldera/OpenServer/samba-2.2-osr5.patch - -The files modified by this patch are: - utils/torture.c - utils/locktest.c - utils/locktest2.c - -This patch should only be necessary until these changes are accepted -back into the 2.2 source tree. Until then, this patch must be applied -prior to building Samba 2.2 on SCO OpenServer 5. - -To produce the custom installable media images simply type (in this directory): - # ./Makevol - -The resultant samba media images should reside in the ./dist subdirectory. -To install from the media images, issue the command (as root): - - # cd dist - # ./Install - -Alternately, each of the steps in building the media images may be performed -individually by invoking each of the following: - - # ./Configure - # ./Compile - # ./Install - # ./Package - -If files are added or deleted from the SCO OpenServer Samba distribution then -the prototype file in the pkg directory should be appropriately modified. -The files in the pkg subdirectory were initially created using the mkpkg -package from SCO Skunkware (see http://www.sco.com/skunkware). diff --git a/packaging/Caldera/OpenServer/findsmb b/packaging/Caldera/OpenServer/findsmb deleted file mode 100755 index c87fdb5190..0000000000 --- a/packaging/Caldera/OpenServer/findsmb +++ /dev/null @@ -1,141 +0,0 @@ -#!/usr/local/bin/perl -# -# Prints info on all smb responding machines on a subnet. -# This script needs to be run on a machine without nmbd running and be -# run as root to get correct info from WIN95 clients. -# -# syntax: -# findsmb [subnet broadcast address] -# -# with no agrument it will list machines on the current subnet -# -# There will be a "+" in front of the workgroup name for machines that are -# local master browsers for that workgroup. There will be an "*" in front -# of the workgroup name for machines that are the domain master browser for -# that workgroup. -# - -$SAMBABIN = "/usr/local/samba/bin"; - -for ($i = 0; $i < 2; $i++) { # test for -d option and broadcast address - $_ = shift; - if (m/-d|-D/) { - $DEBUG = 1; - } else { - if ($_) { - $BCAST = "-B $_"; - } - } -} - -sub ipsort # do numeric sort on last field of IP address -{ - @t1 = split(/\./,$a); - @t2 = split(/\./,$b); - @t1[3] <=> @t2[3]; -} - -# look for all machines that respond to a name lookup - -open(NMBLOOKUP,"$SAMBABIN/nmblookup $BCAST '*'|") || - die("Can't run nmblookup '*'.\n"); - -# get rid of all lines that are not a response IP address, -# strip everything but IP address and sort by last field in address - -@ipaddrs = sort ipsort grep(s/ \*<00>.*$//,); - -# print header info - -print "\nIP ADDR NETBIOS NAME WORKGROUP/OS/VERSION $BCAST\n"; -print "---------------------------------------------------------------------\n"; - -foreach $ip (@ipaddrs) # loop through each IP address found -{ - $ip =~ s/\n//; # strip newline from IP address - -# find the netbios names registered by each machine - - open(NMBLOOKUP,"$SAMBABIN/nmblookup -r -A $ip|") || - die("Can't get nmb name list.\n"); - @nmblookup = ; - close NMBLOOKUP; - -# get the first <00> name - - @name = grep(/<00>/,@nmblookup); - $_ = @name[0]; - if ($_) { # we have a netbios name - if (/GROUP/) { # is it a group name - ($name, $aliases, $type, $length, @addresses) = - gethostbyaddr(pack('C4',split('\.',$ip)),2); - if (! $name) { # could not get name - $name = "unknown nis name"; - } - } else { - /(.{1,15})\s+<00>\s+/; - $name = $1; - } - -# do an smbclient command on the netbios name. - - open(SMB,"$SAMBABIN/smbclient -N -L $name -I $ip -U% |") || - die("Can't do smbclient command.\n"); - @smb = ; - close SMB; - - if ($DEBUG) { # if -d flag print results of nmblookup and smbclient - print "===============================================================\n"; - print @nmblookup; - print @smb; - } - -# look for the OS= string - - @info = grep(/OS=/,@smb); - $_ = @info[0]; - if ($_) { # we found response - s/Domain=|OS=|Server=|\n//g; # strip out descriptions to make line shorter - - } else { # no OS= string in response (WIN95 client) - -# for WIN95 clients get workgroup name from nmblookup response - @name = grep(/<00> - /,@nmblookup); - $_ = @name[0]; - if ($_) { - /(.{1,15})\s+<00>\s+/; - $_ = "[$1]"; - } else { - $_ = "Unknown Workgroup"; - } - } - -# see if machine registered a local master browser name - if (grep(/<1d>/,@nmblookup)) { - $master = '+'; # indicate local master browser - if (grep(/<1b>/,@nmblookup)) { # how about domain master browser? - $master = '*'; # indicate domain master browser - } - } else { - $master = ' '; # not a browse master - } - -# line up info in 3 columns - - print "$ip".' 'x(16-length($ip))."$name".' 'x(14-length($name))."$master"."$_\n"; - - } else { # no netbios name found -# try getting the host name - ($name, $aliases, $type, $length, @addresses) = - gethostbyaddr(pack('C4',split('\.',$ip)),2); - if (! $name) { # could not get name - $name = "unknown nis name"; - } - if ($DEBUG) { # if -d flag print results of nmblookup - print "===============================================================\n"; - print @nmblookup; - } - print "$ip".' 'x(16-length($ip))."$name\n"; - } -} - diff --git a/packaging/Caldera/OpenServer/pkg/Clean b/packaging/Caldera/OpenServer/pkg/Clean deleted file mode 100755 index fa68f18118..0000000000 --- a/packaging/Caldera/OpenServer/pkg/Clean +++ /dev/null @@ -1,3 +0,0 @@ -#!/bin/sh - -rm -rf archives sso usr diff --git a/packaging/Caldera/OpenServer/pkg/Install b/packaging/Caldera/OpenServer/pkg/Install deleted file mode 100755 index ef0f61f33e..0000000000 --- a/packaging/Caldera/OpenServer/pkg/Install +++ /dev/null @@ -1 +0,0 @@ -custom -p SKUNK2000:Samba -i -z `pwd`/archives/FLOPPY diff --git a/packaging/Caldera/OpenServer/pkg/MakeSSO b/packaging/Caldera/OpenServer/pkg/MakeSSO deleted file mode 100755 index 538aaf58f7..0000000000 --- a/packaging/Caldera/OpenServer/pkg/MakeSSO +++ /dev/null @@ -1,25 +0,0 @@ -: -# MakeSSO -# - -rm -rf archives sso - - CDMT_DIR=`pwd`; export CDMT_DIR - Samba_DIR=`pwd`; export Samba_DIR - cdmtParse - if test $? != 0 - then - exit 1 - fi - - cdmtCompress - if test $? != 0 - then - exit 1 - fi - - cdmtArchive - if test $? != 0 - then - exit 1 - fi diff --git a/packaging/Caldera/OpenServer/pkg/Packem b/packaging/Caldera/OpenServer/pkg/Packem deleted file mode 100755 index a1b67e972d..0000000000 --- a/packaging/Caldera/OpenServer/pkg/Packem +++ /dev/null @@ -1,15 +0,0 @@ -#!/bin/sh - -P=`pwd` -PKGTAR=`basename $P`-VOLS.tar -PKGDIST=`basename $P`-dist.tar.gz - -DIRS=usr -[ -d etc ] && DIRS="etc usr" -cd archives/FLOPPY -tar cf ../../$PKGTAR VOL* -cd ../.. -tar cf - $DIRS | /usr/local/bin/gzip -9 > $PKGDIST -[ -f $PKGTAR ] && rm -rf archives -[ -f $PKGDIST ] && rm -rf $DIRS -rm -rf sso diff --git a/packaging/Caldera/OpenServer/pkg/Remove b/packaging/Caldera/OpenServer/pkg/Remove deleted file mode 100755 index ea6102ac38..0000000000 --- a/packaging/Caldera/OpenServer/pkg/Remove +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/sh -# -# Generic command-line Software Manger (custom) removal from -# media images. Based on the installation script by Phil Hollenback -# (philiph@sco.com) and Ron Record (rr@sco.com) -# - -# Set this to be the full pathname to the directory -# where your media images are: -VDIR=`pwd`/archives/FLOPPY -VOLS=$VDIR/VOL.000.000 - -component=`grep "component" < $VOLS | head -1 | cut -d= -f2 | cut -d: -f1` -package=`grep "component" < $VOLS | head -1 | cut -d= -f2 | cut -d: -f2` - -custom -p $component:$package -r diff --git a/packaging/Caldera/OpenServer/pkg/cdmt.config b/packaging/Caldera/OpenServer/pkg/cdmt.config deleted file mode 100644 index e11c1961f2..0000000000 --- a/packaging/Caldera/OpenServer/pkg/cdmt.config +++ /dev/null @@ -1,34 +0,0 @@ -MACROS: - -DEFAULT_EXEC_MODE = 0755 - -DEFAULT_FILE_MODE = 0644 -DEFAULT_FILE_OWNER = bin -DEFAULT_FILE_GROUP = bin - -DEFAULT_DIR_MODE = 0755 -DEFAULT_DIR_OWNER = bin -DEFAULT_DIR_GROUP = bin - -DEFAULT_FIFO_MODE = 0644 -DEFAULT_FIFO_OWNER = bin -DEFAULT_FIFO_GROUP = bin - -DEFAULT_DISTTREEROOT_SHARED = $CDMT_DIR -DEFAULT_DISTTREEROOT_CLIENT = $CDMT_DIR - -CONFIG: - removeFiles = FALSE - removalPrompt = FALSE - archiveMedia = FLOPPY - compress = TRUE - ssoDir = sso - -FLOPPY_MEDIA: - device = /dev/rfd0 - volumeSize = 8000 - distVendor = SCO - distVersion = 2.2 - distCode = SKUNK2000 - paperLabel = "SCO Skunkware Samba 2.2" - diff --git a/packaging/Caldera/OpenServer/pkg/cntl/ccs b/packaging/Caldera/OpenServer/pkg/cntl/ccs deleted file mode 100755 index 0cb22490e4..0000000000 --- a/packaging/Caldera/OpenServer/pkg/cntl/ccs +++ /dev/null @@ -1,108 +0,0 @@ -#!/bin/sh -# -# Postinstallscript written by Ron Record (rr@sco.com) -# - -scriptname="$0" -step="$1" -keywords="$2" -pkglist="$3" - -# Source in the standard functions library, ccsSetup.sh -. ccsSetup.sh - -ccs_return_value=0 - -SPOOL=/var/spool/samba -SVCS=/etc/services -INET=/etc/inetd.conf -LMHOST=/etc/lmhosts -PREFIX=/usr/local/samba - -# -# Create /var/spool/samba, create an initial /etc/lmhosts, build the -# codepages and setup swat to be run out of inetd on port 901 -# -PostExport() -{ - [ -d $SPOOL ] || { - mkdir -p $SPOOL - chmod 1777 $SPOOL - } - if [ -f $LMHOST ] - then - grep localhost $LMHOST > /dev/null || { - echo 127.0.0.1 localhost >> $LMHOST - } - else - echo 127.0.0.1 localhost > $LMHOST - fi - - cd ${PREFIX}/lib/codepages - for i in 437 737 775 850 852 861 866 932 936 949 950 1251 - do - ${PREFIX}/bin/make_smbcodepage c $i \ - ${PREFIX}/lib/codepages/src/codepage_def.$i \ - ${PREFIX}/lib/codepages/codepage.$i - done - for i in 437 737 850 852 861 866 932 936 949 950 \ - ISO8859-1 ISO8859-2 ISO8859-5 ISO8859-7 KOI8-R - do - ${PREFIX}/bin/make_unicodemap $i \ - ${PREFIX}/lib/codepages/src/CP$i.TXT \ - ${PREFIX}/lib/codepages/unicode_map.$i - done - - grep swat $SVCS > /dev/null || { - echo "swat 901/tcp # Samba Web Administration Tool " >> $SVCS - } - - grep swat $INET > /dev/null || { - echo "swat stream tcp nowait root /usr/local/samba/bin/swat swat " >> $INET - } - - kill -1 `ps -e | grep inetd | awk ' { print $1 } '` -} - -DisableStop() -{ - /etc/init.d/samba disable > /dev/null 2>&1 - /etc/init.d/samba stop > /dev/null 2>&1 -} - -# -# Remove /var/spool/samba and delete inetd entries for swat -# -PostUnexport() -{ - [ -d $SPOOL ] && { - rm -rf $SPOOL - } - - grep swat $SVCS > /dev/null && { - B=`basename $SVCS` - T=$B$$ - grep -v swat $SVCS > /tmp/$T - cp /tmp/$T $SVCS - rm -f /tmp/$T - } - - grep swat $INET > /dev/null || { - B=`basename $INET` - T=$B$$ - grep -v swat $INET > /tmp/$T - cp /tmp/$T $INET - rm -f /tmp/$T - } - - kill -1 `ps -e | grep inetd | awk ' { print $1 } '` -} - -case "$step" in - POST_EXPORT) PostExport ;; - PRE_UNEXPORT) DisableStop ;; - POST_UNEXPORT) PostUnexport ;; -esac - -exit $ccs_return_value - diff --git a/packaging/Caldera/OpenServer/pkg/input/Samba.cmpnt b/packaging/Caldera/OpenServer/pkg/input/Samba.cmpnt deleted file mode 100644 index 245f6d12ce..0000000000 --- a/packaging/Caldera/OpenServer/pkg/input/Samba.cmpnt +++ /dev/null @@ -1,25 +0,0 @@ - -COMP:SKUNK2000:Samba: -description = "Samba - A Windows SMB/CIFS fileserver for UNIX" -version = 2.2 -subpackages = Samba -required = Samba -dependencies = -distTreeRootSHARED = $Samba_DIR -distTreeRootCLIENT = $Samba_DIR -pkgFiles = $Samba_DIR/input/Samba.pkg - -FILE_DEFAULT: -mode = $DEFAULT_FILE_MODE -owner = $DEFAULT_FILE_OWNER -group = $DEFAULT_FILE_GROUP - -DIR_DEFAULT: -mode = $DEFAULT_DIR_MODE -owner = $DEFAULT_DIR_OWNER -group = $DEFAULT_DIR_GROUP - -FIFO_DEFAULT: -mode = $DEFAULT_FIFO_MODE -owner = $DEFAULT_FIFO_OWNER -group = $DEFAULT_FIFO_GROUP diff --git a/packaging/Caldera/OpenServer/pkg/input/Samba.pkg b/packaging/Caldera/OpenServer/pkg/input/Samba.pkg deleted file mode 100644 index ea76e74a61..0000000000 --- a/packaging/Caldera/OpenServer/pkg/input/Samba.pkg +++ /dev/null @@ -1,1905 +0,0 @@ - -PKG:Control: -description = "Control package" -dependencies = -distTreeRootSHARED = $Samba_DIR -distTreeRootCLIENT = $Samba_DIR - -DIR:Control:SHARED:cntl: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Control:SHARED:cntl/ccs: -mode = 0755 -owner = root -group = sys -flags = - -PKG:Samba: -description = "Samba - A Windows SMB/CIFS fileserver for UNIX" -dependencies = -distTreeRootSHARED = $Samba_DIR -distTreeRootCLIENT = $Samba_DIR - -DIR:Samba:SHARED:etc: -mode = 0755 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:etc/init.d: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:etc/init.d/samba: -mode = 0755 -owner = root -group = sys -flags = -exportPath = /etc/init.d/samba - -FILE:Samba:SHARED:etc/smbusers: -mode = 0644 -owner = root -group = sys -flags = -exportPath = /etc/smbusers - -DIR:Samba:SHARED:usr: -mode = 0755 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local: -mode = 0755 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba: -mode = 0755 -owner = root -group = sys -flags = -exportPath = /usr/local/samba - -DIR:Samba:SHARED:usr/local/samba/bin: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/nmblookup: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/smbclient: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/smbpasswd: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/smbstatus: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/testparm: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/testprns: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/make_smbcodepage: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/make_unicodemap: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/make_printerdef: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/rpcclient: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/smbspool: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/smbsh: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/mksmbpasswd.sh: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/smbtar: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/smbprint: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/findsmb: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/bin/smbadduser: -mode = 0755 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/sbin: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/sbin/smbd: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/sbin/nmbd: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/sbin/swat: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/sbin/debug2html: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/sbin/smbtorture: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/sbin/smbfilter: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/sbin/locktest2: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/sbin/masktest: -mode = 0755 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/swat: -mode = 0755 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/swat/using_samba: -mode = 0755 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/swat/using_samba/gifs: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/gifs/index.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/gifs/samba.s.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/gifs/txthome.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/gifs/txtnexta.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/gifs/txtpreva.gif: -mode = 0644 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/swat/using_samba/figs: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0101.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0102.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0103.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0104.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0105.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0106.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0107.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0108.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0109.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0110.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0111.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0112.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0113.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0114.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0201.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0202.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0203.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0204.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0301.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0302.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0303.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0304.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0305.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0306.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0307.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0308.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0309.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0310.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0311.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0312.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0313.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0314.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0315.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0316.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0317.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0318.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0319.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0320.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0321.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0322.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0323.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0324.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0325.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0326.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0327.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0328.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0401.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0402.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0403.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0404.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0405.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0406.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0407.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0501.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0502.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0503.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0504.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0505.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0506.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0507.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0508.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0601.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0602.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0603.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0604.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0605.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0606.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0701.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0702.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0703.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0704.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0705.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0706.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0707.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0708.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0709.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0801.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0802.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0803.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0804.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0805.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0901.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0902.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0903.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0904.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.0905.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.aa01.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.ab01.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/figs/sam.ab02.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/appa_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/appa_02.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/appa_03.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/appa_04.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/appa_05.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/appb_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/appb_02.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/appb_03.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/appc_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/appd_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/appe_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/appf_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch01_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch01_02.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch01_03.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch01_04.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch01_05.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch01_06.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch01_07.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch01_08.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch02_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch02_02.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch02_03.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch02_04.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch02_05.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch02_06.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch03_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch03_02.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch03_03.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch04_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch04_02.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch04_03.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch04_04.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch04_05.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch04_06.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch04_07.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch04_08.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch05_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch05_02.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch05_03.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch05_04.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch05_05.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch06_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch06_02.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch06_03.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch06_04.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch06_05.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch06_06.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch07_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch07_02.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch07_03.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch08_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch08_02.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch08_03.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch08_04.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch08_05.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch08_06.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch08_07.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch09_01.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch09_02.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/ch09_03.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/index.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/inx.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/licenseinfo.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/using_samba/this_edition.html: -mode = 0644 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/swat/images: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/images/globals.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/images/home.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/images/passwd.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/images/printers.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/images/samba.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/images/shares.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/images/status.gif: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/images/viewconfig.gif: -mode = 0644 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/swat/help: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/welcome.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/DOMAIN_MEMBER.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/NT_Security.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/OS2-Client-HOWTO.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/Samba-HOWTO-Collection.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/UNIX_INSTALL.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/findsmb.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/lmhosts.5.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/make_smbcodepage.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/msdfs_setup.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/nmbd.8.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/nmblookup.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/printer_driver2.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/rpcclient.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/samba-pdc-faq.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/samba-pdc-howto.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/samba.7.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smb.conf.5.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbcacls.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbclient.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbcontrol.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbd.8.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbmnt.8.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbmount.8.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbpasswd.5.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbpasswd.8.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbrun.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbsh.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbspool.8.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbstatus.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbtar.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/smbumount.8.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/swat.8.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/testparm.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/testprns.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/wbinfo.1.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/winbind.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/help/winbindd.8.html: -mode = 0644 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/swat/include: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/include/footer.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/include/header.html: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/swat/README: -mode = 0644 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/man: -mode = 0755 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/man/man.1: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/findsmb.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/make_smbcodepage.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/make_unicodemap.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/nmblookup.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/rpcclient.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/smbcacls.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/smbclient.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/smbcontrol.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/smbrun.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/smbsh.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/smbstatus.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/smbtar.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/testparm.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/testprns.1: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.1/wbinfo.1: -mode = 0644 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/man/man.5: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.5/smb.conf.5: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.5/lmhosts.5: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.5/smbpasswd.5: -mode = 0644 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/man/man.7: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.7/samba.7: -mode = 0644 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/man/man.8: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.8/smbd.8: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.8/nmbd.8: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.8/smbpasswd.8: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.8/swat.8: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.8/smbmount.8: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.8/smbmnt.8: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/man/man.8/smbumount.8: -mode = 0644 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/var: -mode = 0755 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/var/locks: -mode = 0755 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/lib: -mode = 0755 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/lib/codepages: -mode = 0755 -owner = root -group = sys -flags = - -DIR:Samba:SHARED:usr/local/samba/lib/codepages/src: -mode = 0755 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/codepage_def.437: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/codepage_def.737: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/codepage_def.775: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/codepage_def.850: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/codepage_def.852: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/codepage_def.861: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/codepage_def.866: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/codepage_def.932: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/codepage_def.936: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/codepage_def.949: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/codepage_def.950: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/codepage_def.1251: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CP437.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CP737.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CP850.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CP852.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CP861.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CP866.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CP932.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CP936.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CP949.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CP950.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CPISO8859-1.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CPISO8859-2.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CPISO8859-5.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CPISO8859-7.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/codepages/src/CPKOI8-R.TXT: -mode = 0644 -owner = root -group = sys -flags = - -FILE:Samba:SHARED:usr/local/samba/lib/smb.conf: -mode = 0644 -owner = root -group = sys -flags = diff --git a/packaging/Caldera/OpenServer/pkg/input/Samba.prd b/packaging/Caldera/OpenServer/pkg/input/Samba.prd deleted file mode 100644 index e31c8bfe8e..0000000000 --- a/packaging/Caldera/OpenServer/pkg/input/Samba.prd +++ /dev/null @@ -1,6 +0,0 @@ -PROD:SKUNK2000:Samba: -description = "Samba - A Windows SMB/CIFS fileserver for UNIX" -version = 2.2 -packages = SKUNK2000:Samba -required = SKUNK2000:Samba -cmpntFiles = Samba.cmpnt diff --git a/packaging/Caldera/OpenServer/samba-2.2-osr5.patch b/packaging/Caldera/OpenServer/samba-2.2-osr5.patch deleted file mode 100644 index fb71d9298b..0000000000 --- a/packaging/Caldera/OpenServer/samba-2.2-osr5.patch +++ /dev/null @@ -1,29 +0,0 @@ ---- utils/torture.c.00 Fri Mar 30 13:53:26 2001 -+++ utils/torture.c Fri Apr 13 15:06:04 2001 -@@ -2703,7 +2703,11 @@ - - dbf = stdout; - -+#if defined(_SCO_DS) /* SCO OpenServer */ -+ setvbuf(stdout, NULL, _IONBF, 0); -+#else - setbuffer(stdout, NULL, 0); -+#endif - - charset_initialise(); - ---- utils/locktest.c.00 Fri Sep 29 13:18:14 2000 -+++ utils/locktest.c Fri Apr 13 17:54:11 2001 -@@ -384,8 +384,12 @@ - recorded[n].conn = random() % NCONNECTIONS; - recorded[n].f = random() % NFILES; - recorded[n].start = LOCKBASE + ((unsigned)random() % (LOCKRANGE-1)); -+#if defined(_SCO_DS) /* OpenServer */ -+ recorded[n].len = 1; -+#else - recorded[n].len = 1 + - random() % (LOCKRANGE-(recorded[n].start-LOCKBASE)); -+#endif - recorded[n].start *= RANGE_MULTIPLE; - recorded[n].len *= RANGE_MULTIPLE; - recorded[n].r1 = random() % 100; diff --git a/packaging/Caldera/OpenServer/smb.conf b/packaging/Caldera/OpenServer/smb.conf deleted file mode 100644 index 717c4efb17..0000000000 --- a/packaging/Caldera/OpenServer/smb.conf +++ /dev/null @@ -1,291 +0,0 @@ -# This is the main Samba configuration file. You should read the -# smb.conf(5) manual page in order to understand the options listed -# here. Samba has a huge number of configurable options (perhaps too -# many!) most of which are not shown in this example -# -# Any line which starts with a ; (semi-colon) or a # (hash) -# is a comment and is ignored. In this example we will use a # -# for commentry and a ; for parts of the config file that you -# may wish to enable -# -# NOTE: Whenever you modify this file you should run the command "testparm" -# to check that you have not many any basic syntactic errors. -# -#======================= Global Settings ===================================== -[global] - -# workgroup = NT-Domain-Name or Workgroup-Name - workgroup = MYGROUP - -# server string is the equivalent of the NT Description field - server string = Samba Server - -# This option is important for security. It allows you to restrict -# connections to machines which are on your local network. The -# following example restricts access to two C class networks and -# the "loopback" interface. For more examples of the syntax see -# the smb.conf man page -; hosts allow = 192.168.1. 192.168.2. 127. - -# if you want to automatically load your printer list rather -# than setting them up individually then you'll need this - printcap name = lpstat - load printers = yes - -# It should not be necessary to spell out the print system type unless -# yours is non-standard. Currently supported print systems include: -# bsd, sysv, plp, lprng, aix, hpux, qnx - printing = sysv - -# Uncomment this if you want a guest account, you must add this to /etc/passwd -# otherwise the user "nouser" is used -; guest account = pcguest - -# this tells Samba to use a separate log file for each machine -# that connects - log file = /usr/local/samba/var/log.%m - -# Put a capping on the size of the log files (in Kb). - max log size = 50 - -# Security mode. Most people will want user level security. See -# security_level.txt for details. - security = user -# Use password server option only with security = server -; password server = - -# Password Level allows matching of _n_ characters of the password for -# all combinations of upper and lower case. -; password level = 8 -; username level = 8 - -# You may wish to use password encryption. Please read -# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation. -# Do not enable this option unless you have read those documents -; encrypt passwords = yes -; smb passwd file = /etc/smbpasswd - -# The following are needed to allow password changing from Windows to -# update the Linux sytsem password also. -# NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above. -# NOTE2: You do NOT need these to allow workstations to change only -# the encrypted SMB passwords. They allow the Unix password -# to be kept in sync with the SMB password. -; unix password sync = Yes -; passwd program = /usr/bin/passwd %u -; passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* %n\n *passwd:*all*authentication*tokens*updated*successfully* - -# Unix users can map to different SMB User names -; username map = /etc/smbusers - -# Using the following line enables you to customise your configuration -# on a per machine basis. The %m gets replaced with the netbios name -# of the machine that is connecting -; include = /etc/smb.conf.%m - -# Most people will find that this option gives better performance. -# See speed.txt and the manual pages for details - socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 - -# Configure Samba to use multiple interfaces -# If you have multiple network interfaces then you must list them -# here. See the man page for details. -; interfaces = 192.168.12.2/24 192.168.13.2/24 - -# Configure remote browse list synchronisation here -# request announcement to, or browse list sync from: -# a specific host or from / to a whole subnet (see below) -; remote browse sync = 192.168.3.25 192.168.5.255 -# Cause this host to announce itself to local subnets here -; remote announce = 192.168.1.255 192.168.2.44 - -# Browser Control Options: -# set local master to no if you don't want Samba to become a master -# browser on your network. Otherwise the normal election rules apply -; local master = no - -# OS Level determines the precedence of this server in master browser -# elections. The default value should be reasonable -; os level = 33 - -# Domain Master specifies Samba to be the Domain Master Browser. This -# allows Samba to collate browse lists between subnets. Don't use this -# if you already have a Windows NT domain controller doing this job -; domain master = yes - -# Preferred Master causes Samba to force a local browser election on startup -# and gives it a slightly higher chance of winning the election -; preferred master = yes - -# Use only if you have an NT server on your network that has been -# configured at install time to be a primary domain controller. -; domain controller = - -# Enable this if you want Samba to be a domain logon server for -# Windows95 workstations. -; domain logons = yes - -# if you enable domain logons then you may want a per-machine or -# per user logon script -# run a specific logon batch file per workstation (machine) -; logon script = %m.bat -# run a specific logon batch file per username -; logon script = %U.bat - -# Where to store roving profiles (only for Win95 and WinNT) -# %L substitutes for this servers netbios name, %U is username -# You must uncomment the [Profiles] share below -; logon path = \\%L\Profiles\%U - -# All NetBIOS names must be resolved to IP Addresses -# 'Name Resolve Order' allows the named resolution mechanism to be specified -# the default order is "host lmhosts wins bcast". "host" means use the unix -# system gethostbyname() function call that will use either /etc/hosts OR -# DNS or NIS depending on the settings of /etc/host.config, /etc/nsswitch.conf -# and the /etc/resolv.conf file. "host" therefore is system configuration -# dependant. This parameter is most often of use to prevent DNS lookups -# in order to resolve NetBIOS names to IP Addresses. Use with care! -# The example below excludes use of name resolution for machines that are NOT -# on the local network segment -# - OR - are not deliberately to be known via lmhosts or via WINS. -; name resolve order = wins lmhosts bcast - -# Windows Internet Name Serving Support Section: -# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server -; wins support = yes - -# WINS Server - Tells the NMBD components of Samba to be a WINS Client -# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both -; wins server = w.x.y.z - -# WINS Proxy - Tells Samba to answer name resolution queries on -# behalf of a non WINS capable client, for this to work there must be -# at least one WINS Server on the network. The default is NO. -; wins proxy = yes - -# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names -# via DNS nslookups. The built-in default for versions 1.9.17 is yes, -# this has been changed in version 1.9.18 to no. - dns proxy = no - -# Case Preservation can be handy - system default is _no_ -# NOTE: These can be set on a per share basis -; preserve case = no -; short preserve case = no -# Default case is normally upper case for all DOS files -; default case = lower -# Be very careful with case sensitivity - it can break things! -; case sensitive = no - -#============================ Share Definitions ============================== -[homes] - comment = Home Directories - browseable = no - writable = yes - -# Un-comment the following and create the netlogon directory for Domain Logons -; [netlogon] -; comment = Network Logon Service -; path = /home/netlogon -; guest ok = yes -; writable = no -; share modes = no - - -# Un-comment the following to provide a specific roving profile share -# the default is to use the user's home directory -;[Profiles] -; path = /home/profiles -; browseable = no -; guest ok = yes - - -# NOTE: If you have a BSD-style print system there is no need to -# specifically define each individual printer -[printers] - comment = All Printers - path = /var/spool/samba - browseable = no -# Set public = yes to allow user 'guest account' to print - guest ok = no - writable = no - printable = yes - -# This one is useful for people to share files -;[tmp] -; comment = Temporary file space -; path = /tmp -; read only = no -; public = yes - -# A publicly accessible directory, but read only, except for people in -# the "staff" group -;[public] -; comment = Public Stuff -; path = /home/samba -; public = yes -; writable = yes -; printable = no -; write list = @staff - -# Other examples. -# -# A private printer, usable only by fred. Spool data will be placed in fred's -# home directory. Note that fred must have write access to the spool directory, -# wherever it is. -;[fredsprn] -; comment = Fred's Printer -; valid users = fred -; path = /homes/fred -; printer = freds_printer -; public = no -; writable = no -; printable = yes - -# A private directory, usable only by fred. Note that fred requires write -# access to the directory. -;[fredsdir] -; comment = Fred's Service -; path = /usr/somewhere/private -; valid users = fred -; public = no -; writable = yes -; printable = no - -# a service which has a different directory for each machine that connects -# this allows you to tailor configurations to incoming machines. You could -# also use the %u option to tailor it by user name. -# The %m gets replaced with the machine name that is connecting. -;[pchome] -; comment = PC Directories -; path = /usr/pc/%m -; public = no -; writable = yes - -# A publicly accessible directory, read/write to all users. Note that all files -# created in the directory by users will be owned by the default user, so -# any user with access can delete any other user's files. Obviously this -# directory must be writable by the default user. Another user could of course -# be specified, in which case all files would be owned by that user instead. -;[public] -; path = /usr/somewhere/else/public -; public = yes -; only guest = yes -; writable = yes -; printable = no - -# The following two entries demonstrate how to share a directory so that two -# users can place files there that will be owned by the specific users. In this -# setup, the directory should be writable by both users and should have the -# sticky bit set on it to prevent abuse. Obviously this could be extended to -# as many users as required. -;[myshare] -; comment = Mary's and Fred's stuff -; path = /usr/somewhere/shared -; valid users = mary fred -; public = no -; writable = yes -; printable = no -; create mask = 0765 - - diff --git a/packaging/Caldera/OpenServer/smb.init b/packaging/Caldera/OpenServer/smb.init deleted file mode 100755 index ce6c6fa4b3..0000000000 --- a/packaging/Caldera/OpenServer/smb.init +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/sh -#ident "@(#)samba.server 1.0 96/06/19 TK" /* SVr4.0 1.1.13.1*/ -# -# Please send info on modifications to knuutila@cs.utu.fi -# -# This file should have uid root, gid sys and chmod 744 -# -# Modified 17-Jul-99 by Ron Record (rr@sco.com) for use in SCO Skunkware -# - -SAMBADIR=/usr/local/samba -RCSCRIPT=/etc/rc2.d/S99samba - -if [ ! -d /usr/bin ] -then # /usr not mounted - exit -fi - -killproc() { # kill the named process(es) - if [ -f $SAMBADIR/var/locks/$1.pid ] - then - kill `cat $SAMBADIR/var/locks/$1.pid` - else - pid=`/usr/bin/ps -e | - /usr/bin/grep $1 | - /usr/bin/sed -e 's/^ *//' -e 's/ .*//'` - [ "$pid" != "" ] && kill $pid - fi -} - -start() { -# -# Edit these lines to suit your installation (paths, workgroup, host) -# - $SAMBADIR/sbin/smbd -D -s $SAMBADIR/lib/smb.conf - $SAMBADIR/sbin/nmbd -D -s $SAMBADIR/lib/smb.conf -} - -stop() { - killproc nmbd - killproc smbd -} - -# Start/stop processes required for samba server - -case "$1" in - -'start') - start - ;; -'stop') - stop - ;; -'restart') - stop - start - ;; -'enable') - if [ -h $RCSCRIPT ] ; then - echo "Samba is already enabled." - else - echo "Enabling Samba ... \c" - rm -f $RCSCRIPT - ln -s /etc/init.d/samba $RCSCRIPT - echo "Done" - fi - ;; -'disable') - echo "Disabling Samba ... \c" - rm -f $RCSCRIPT - echo "Done" - ;; -*) - echo "Usage: /etc/init.d/samba { start | stop | restart | enable | disable }" - ;; -esac diff --git a/packaging/Caldera/OpenServer/smbadduser b/packaging/Caldera/OpenServer/smbadduser deleted file mode 100755 index 2f38bf28f1..0000000000 --- a/packaging/Caldera/OpenServer/smbadduser +++ /dev/null @@ -1,73 +0,0 @@ -#!/bin/csh -# -# smbadduser - Written by Mike Zakharoff -# -unalias * -set path = ($path) - -set smbpasswd = /etc/smbpasswd -set user_map = /etc/smbusers -# -# Set to site specific passwd command -# -set passwd = "cat /etc/passwd" -#set passwd = "niscat passwd.org_dir" -#set passwd = "ypcat passwd" - -set line = "----------------------------------------------------------" -if ($#argv == 0) then - echo $line - echo "Written: Mike Zakharoff email: michael.j.zakharoff@boeing.com" - echo "" - echo " 1) Updates $smbpasswd" - echo " 2) Updates $user_map" - echo " 3) Executes smbpasswd for each new user" - echo "" - echo "smbadduser unixid:ntid unixid:ntid ..." - echo "" - echo "Example: smbadduser zak:zakharoffm johns:smithj" - echo $line - exit 1 -endif - -touch $smbpasswd $user_map -set new = () -foreach one ($argv) - echo $one | grep ':' >& /dev/null - if ($status != 0) then - echo "ERROR: Must use unixid:ntid like -> zak:zakharoffm" - continue - endif - set unix = `echo $one | awk -F: '{print $1}'` - set ntid = `echo $one | awk -F: '{print $2}'` - - set usr = `eval $passwd | awk -F: '$1==USR {print $1}' USR=$unix` - if ($#usr != 1) then - echo "ERROR: $unix Not in passwd database SKIPPING..." - continue - endif - set tmp = `cat $smbpasswd | awk -F: '$1==USR {print $1}' USR=$unix` - if ($#tmp != 0) then - echo "ERROR: $unix is already in $smbpasswd SKIPPING..." - continue - endif - - echo "Adding: $unix to $smbpasswd" - eval $passwd | \ - awk -F: '$1==USR { \ - printf( "%s:%s:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:%s:%s:%s\n", $1, $3, $5, $6, $7) }' USR=$unix >> $smbpasswd - if ($unix != $ntid) then - echo "Adding: {$unix = $ntid} to $user_map" - echo "$unix = $ntid" >> $user_map - endif - set new = ($new $unix) -end - -# -# Enter password for new users -# -foreach one ($new) - echo $line - echo "ENTER password for $one" - smbpasswd $one -end diff --git a/packaging/Caldera/OpenServer/smbprint b/packaging/Caldera/OpenServer/smbprint deleted file mode 100755 index ec083eede6..0000000000 --- a/packaging/Caldera/OpenServer/smbprint +++ /dev/null @@ -1,77 +0,0 @@ -#!/bin/sh - -# This script is an input filter for printcap printing on a unix machine. It -# uses the smbclient program to print the file to the specified smb-based -# server and service. -# For example you could have a printcap entry like this -# -# smb:lp=/dev/null:sd=/usr/spool/smb:sh:if=/usr/local/samba/smbprint -# -# which would create a unix printer called "smb" that will print via this -# script. You will need to create the spool directory /usr/spool/smb with -# appropriate permissions and ownerships for your system. - -# Set these to the server and service you wish to print to -# In this example I have a WfWg PC called "lapland" that has a printer -# exported called "printer" with no password. - -# -# Script further altered by hamiltom@ecnz.co.nz (Michael Hamilton) -# so that the server, service, and password can be read from -# a /var/spool/lpd/PRINTNAME/.config file. -# -# In order for this to work the /etc/printcap entry must include an -# accounting file (af=...): -# -# cdcolour:\ -# :cm=CD IBM Colorjet on 6th:\ -# :sd=/var/spool/lpd/cdcolour:\ -# :af=/var/spool/lpd/cdcolour/acct:\ -# :if=/usr/local/etc/smbprint:\ -# :mx=0:\ -# :lp=/dev/null: -# -# The /usr/var/spool/lpd/PRINTNAME/.config file should contain: -# server=PC_SERVER -# service=PR_SHARENAME -# password="password" -# -# E.g. -# server=PAULS_PC -# service=CJET_371 -# password="" - -# -# Debugging log file, change to /dev/null if you like. -# -# logfile=/tmp/smb-print.log -logfile=/dev/null - - -# -# The last parameter to the filter is the accounting file name. -# Extract the directory name from the file name. -# Concat this with /.config to get the config file. -# -eval acct_file=\${$#} -spool_dir=`dirname $acct_file` -config_file=$spool_dir/.config - -# Should read the following variables set in the config file: -# server -# service -# password -eval `cat $config_file` - -# -# Some debugging help, change the >> to > if you want to same space. -# -echo "server $server, service $service" >> $logfile - -( -# NOTE You may wish to add the line `echo translate' if you want automatic -# CR/LF translation when printing. -# echo translate - echo "print -" - cat -) | /usr/bin/smbclient "\\\\$server\\$service" $password -U $server -N -P >> $logfile diff --git a/packaging/Caldera/OpenServer/smbusers b/packaging/Caldera/OpenServer/smbusers deleted file mode 100644 index 08f611826a..0000000000 --- a/packaging/Caldera/OpenServer/smbusers +++ /dev/null @@ -1,3 +0,0 @@ -# Unix_name = SMB_name1 SMB_name2 ... -root = administrator admin -nouser = guest pcguest smbguest diff --git a/packaging/Caldera/UnixWare/Clean b/packaging/Caldera/UnixWare/Clean deleted file mode 100755 index fe4eed2527..0000000000 --- a/packaging/Caldera/UnixWare/Clean +++ /dev/null @@ -1,22 +0,0 @@ -#!/bin/sh -# -# Cleanup after having configured, compiled, installed and packaged. -# Careful - running this script attempts to restore this hierarchy to -# freshly unpacked source -# -# Invoke as "./Clean -n" to get this script to tell you what it would do -# without doing anything -# - -V= -[ "$1" = "-n" ] && V=echo - -[ -d dist ] && $V rm -rf dist -[ -f ../../../source/Makefile ] && { - $V cd ../../../source - $V rm -f bin/locktest bin/masktest bin/smbsh bin/debug2html \ - bin/locktest2 bin/smbfilter bin/smbtorture - $V make clean - $V make distclean - $V rm -f mout* -} diff --git a/packaging/Caldera/UnixWare/Compile b/packaging/Caldera/UnixWare/Compile deleted file mode 100755 index 2867e4d5ad..0000000000 --- a/packaging/Caldera/UnixWare/Compile +++ /dev/null @@ -1,52 +0,0 @@ -#!/bin/ksh -# -# invoke with -n as the first argument to get this script to tell -# you what it would do without doing anything -# - -V= -[ "$1" = "-n" ] && V=echo - -CC="cc -Kthread -Kalloca -I/usr/local/include -L/usr/local/lib" -CPP="$CC -E" -CFLAGS="-Xa -Dasm=__asm -DANSICPP -O3" -LDFLAGS="-L/usr/local/lib" -CXX="CC -I/usr/local/include" -CXXFLAGS="-O3 -I/usr/local/include/stl -L/usr/local/lib" -RANLIB=true -MAKE=/usr/local/bin/make -if [ "$V" = "echo" ] -then - echo "exporting the following shell variables:" - echo "CC=$CC" - echo "CPP=$CPP" - echo "CXX=$CXX" - echo "RANLIB=$RANLIB" - echo "MAKE=$MAKE" - echo "CFLAGS=$CFLAGS" - echo "CXXFLAGS=$CXXFLAGS" - echo "LDFLAGS=$LDFLAGS" -else - export CC CPP CXX RANLIB MAKE CFLAGS CXXFLAGS LDFLAGS -fi - -if [ "$V" = "echo" ] -then - echo "cd ../../../source" - echo "rm -f mout-1 mout-2 mout-3 mout-4" - echo "make all 2>&1 | tee mout-1" - echo "make smbfilter smbtorture debug2html 2>&1 | tee mout-2" - echo "make bin/smbspool smbwrapper bin/wbinfo 2>&1 | tee mout-3" - echo "make masktest locktest locktest2 2>&1 | tee mout-3" -else - cd ../../../source - rm -f mout-1 mout-2 mout-3 mout-4 - make all 2>&1 | tee mout-1 - make smbfilter smbtorture debug2html 2>&1 | tee mout-2 - make bin/smbspool smbwrapper bin/wbinfo 2>&1 | tee mout-3 - make masktest locktest locktest2 2>&1 | tee mout-3 -fi -# -# Not building : -# nsswitch - no -# rpctorture - improper use of client_info struct, dunno diff --git a/packaging/Caldera/UnixWare/Configure b/packaging/Caldera/UnixWare/Configure deleted file mode 100755 index e5a7fbba4d..0000000000 --- a/packaging/Caldera/UnixWare/Configure +++ /dev/null @@ -1,67 +0,0 @@ -#!/bin/ksh -# -# invoke with -n as the first argument to get this script to tell -# you what it would do without doing anything -# - -V= -[ "$1" = "-n" ] && V=echo - -CC="cc -Kthread -Kalloca -I/usr/local/include -L/usr/local/lib" -CPP="$CC -E" -CFLAGS="-Xa -Dasm=__asm -DANSICPP -O3" -LDFLAGS="-L/usr/local/lib" -CXX="CC -I/usr/local/include" -CXXFLAGS="-O3 -I/usr/local/include/stl -L/usr/local/lib" -RANLIB=true -MAKE=/usr/local/bin/make -PREFIX=/usr/local/samba -if [ "$V" = "echo" ] -then - echo "exporting the following shell variables:" - echo "CC=$CC" - echo "CPP=$CPP" - echo "CXX=$CXX" - echo "RANLIB=$RANLIB" - echo "MAKE=$MAKE" - echo "CFLAGS=$CFLAGS" - echo "CXXFLAGS=$CXXFLAGS" - echo "LDFLAGS=$LDFLAGS" - echo "PREFIX=$PREFIX" -else - export CC CPP CXX RANLIB MAKE CFLAGS CXXFLAGS LDFLAGS PREFIX -fi - -cd ../../../source -[ -f mout-config ] && { - if [ "$V" = "echo" ] - then - echo "mv mout-config mout-config$$" - else - mv mout-config mout-config$$ - fi -} -if [ "$V" = "echo" ] -then - echo "./configure \ - --prefix=${PREFIX} \ - --with-profile \ - --with-syslog \ - --with-utmp \ - --with-vfs \ - --with-msdfs \ - --with-netatalk \ - --with-sambabook=${PREFIX}/swat/using_samba \ - 2>&1 | tee mout-config" -else - ./configure \ - --prefix=${PREFIX} \ - --with-profile \ - --with-syslog \ - --with-utmp \ - --with-vfs \ - --with-msdfs \ - --with-netatalk \ - --with-sambabook=${PREFIX}/swat/using_samba \ - 2>&1 | tee mout-config -fi diff --git a/packaging/Caldera/UnixWare/Install b/packaging/Caldera/UnixWare/Install deleted file mode 100755 index 3fffc37d25..0000000000 --- a/packaging/Caldera/UnixWare/Install +++ /dev/null @@ -1,146 +0,0 @@ -#!/bin/ksh -# -# invoke with -n as the first argument to get this script to tell -# you what it would do without doing anything -# - -V= -[ "$1" = "-n" ] && V=echo - -PREFIX=/usr/local/samba -HERE=`pwd` -PKGDIR=packaging/Caldera/UnixWare - -BUILD_ROOT=${HERE}/dist -BLDFIX=${BUILD_ROOT}/${PREFIX} -$V rm -rf $BUILD_ROOT -$V mkdir -p $BUILD_ROOT/etc/init.d -$V mkdir -p ${BLDFIX}/bin -$V mkdir -p ${BLDFIX}/sbin -$V mkdir -p ${BLDFIX}/swat/using_samba/gifs -$V mkdir -p ${BLDFIX}/swat/using_samba/figs -$V mkdir -p ${BLDFIX}/swat/images -$V mkdir -p ${BLDFIX}/swat/help -$V mkdir -p ${BLDFIX}/swat/include -$V mkdir -p ${BLDFIX}/man/man1 -$V mkdir -p ${BLDFIX}/man/man5 -$V mkdir -p ${BLDFIX}/man/man7 -$V mkdir -p ${BLDFIX}/man/man8 -$V mkdir -p ${BLDFIX}/var/locks -$V mkdir -p ${BLDFIX}/lib/codepages/src - -# Copy into the dist tree the pkg data files -for i in pkg/* -do - [ -f $i ] && $V cp $i ${BUILD_ROOT} -done - -cd ../../.. - -# Install standard binary files -for i in nmblookup smbclient smbpasswd smbstatus testparm testprns \ - make_smbcodepage make_unicodemap make_printerdef rpcclient smbspool \ - smbsh smbwrapper.so -do -$V install -m755 -s source/bin/$i ${BLDFIX}/bin -done -for i in mksmbpasswd.sh smbtar -do -$V install -m755 source/script/$i ${BLDFIX}/bin -done - -# Install secure binary files -for i in smbd nmbd swat debug2html smbtorture smbfilter locktest2 masktest -do -$V install -m755 -s source/bin/$i ${BLDFIX}/sbin -done - - -# Install level 1 man pages -for i in *.1 -do -$V install -m644 docs/manpages/$i ${BLDFIX}/man/man1 -done - -# Install codepage source files -for i in 437 737 775 850 852 861 866 932 936 949 950 1251 -do -$V install -m644 source/codepages/codepage_def.$i ${BLDFIX}/lib/codepages/src -done -for i in 437 737 850 852 861 866 932 936 949 950 ISO8859-1 ISO8859-2 ISO8859-5 ISO8859-7 KOI8-R -do -$V install -m644 source/codepages/CP$i.TXT ${BLDFIX}/lib/codepages/src -done - -# Install SWAT helper files -for i in swat/help/*.html docs/htmldocs/*.html -do -$V install -m644 $i ${BLDFIX}/swat/help -done -for i in swat/images/*.gif -do -$V install -m644 $i ${BLDFIX}/swat/images -done -for i in swat/include/*.html -do -$V install -m644 $i ${BLDFIX}/swat/include -done - -# This is the O'Reily Samba Book - on-line -for i in docs/htmldocs/using_samba/*.html -do -$V install -m644 $i ${BLDFIX}/swat/using_samba -done -for i in docs/htmldocs/using_samba/figs/*.gif -do -$V install -m644 $i ${BLDFIX}/swat/using_samba/figs -done -for i in docs/htmldocs/using_samba/gifs/*.gif -do -$V install -m644 $i ${BLDFIX}/swat/using_samba/gifs -done - -# Install the miscellany -$V install -m644 swat/README ${BLDFIX}/swat -$V install -m644 docs/manpages/smb.conf.5 ${BLDFIX}/man/man5 -$V install -m644 docs/manpages/lmhosts.5 ${BLDFIX}/man/man5 -$V install -m644 docs/manpages/smbpasswd.5 ${BLDFIX}/man/man5 -$V install -m644 docs/manpages/samba.7 ${BLDFIX}/man/man7 -$V install -m644 docs/manpages/smbd.8 ${BLDFIX}/man/man8 -$V install -m644 docs/manpages/nmbd.8 ${BLDFIX}/man/man8 -$V install -m644 docs/manpages/smbpasswd.8 ${BLDFIX}/man/man8 -$V install -m644 docs/manpages/swat.8 ${BLDFIX}/man/man8 -$V install -m644 docs/manpages/smbmount.8 ${BLDFIX}/man/man8 -$V install -m644 docs/manpages/smbmnt.8 ${BLDFIX}/man/man8 -$V install -m644 docs/manpages/smbumount.8 ${BLDFIX}/man/man8 -$V install -m644 ${PKGDIR}/smb.conf ${BLDFIX}/lib/smb.conf -$V install -m644 ${PKGDIR}/smbusers $BUILD_ROOT/etc/smbusers -$V install -m755 ${PKGDIR}/smbprint ${BLDFIX}/bin -$V install -m755 ${PKGDIR}/findsmb ${BLDFIX}/bin -$V install -m755 ${PKGDIR}/smbadduser ${BLDFIX}/bin -$V install -m755 ${PKGDIR}/smb.init $BUILD_ROOT/etc/init.d/samba - -# The following is now done in the postinstall script -# -# if [ "$V" = "echo" ] -# then -# echo "echo 127.0.0.1 localhost > $BUILD_ROOT/etc/lmhosts" -# else -# echo 127.0.0.1 localhost > $BUILD_ROOT/etc/lmhosts -# fi -# -# Build codepage load files -# $V cd ${BLDFIX}/lib/codepages -# for i in 437 737 775 850 852 861 866 932 936 949 950 1251 -# do -# $V ${PREFIX}/bin/make_smbcodepage c $i \ -# ${BLDFIX}/lib/codepages/src/codepage_def.$i \ -# ${BLDFIX}/lib/codepages/codepage.$i -# done -# for i in 437 737 850 852 861 866 932 936 949 950 \ -# ISO8859-1 ISO8859-2 ISO8859-5 ISO8859-7 KOI8-R -# do -# $V ${PREFIX}/bin/make_unicodemap $i \ -# ${BLDFIX}/lib/codepages/src/CP$i.TXT \ -# ${BLDFIX}/lib/codepages/unicode_map.$i -# done diff --git a/packaging/Caldera/UnixWare/Makepkg b/packaging/Caldera/UnixWare/Makepkg deleted file mode 100755 index dc57b246ef..0000000000 --- a/packaging/Caldera/UnixWare/Makepkg +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/ksh -# -# invoke with -n as the first argument to get this script to tell -# you what it would do without doing anything -# - -./Configure $* -./Compile $* -./Install $* -./Package $* diff --git a/packaging/Caldera/UnixWare/Package b/packaging/Caldera/UnixWare/Package deleted file mode 100755 index f225b8eb7e..0000000000 --- a/packaging/Caldera/UnixWare/Package +++ /dev/null @@ -1,40 +0,0 @@ -#!/bin/ksh -# -# Now create the actual pkgadd installable datastream -# -# invoke with -n as the first argument to get this script to tell -# you what it would do without doing anything -# - -V= -[ "$1" = "-n" ] && V=echo - -$V cd dist -PKGNAME=samba -PKGBLD=`pwd` -[ "$V" = "echo" ] && PKGBLD=$PKGBLD/dist - -PKGCOMPRESS="-c" -#PKGBLOCKLIM=2876 -PKGBLOCKLIM=6200 - -############################################################################## -# -# make filesystem-type package in directory ./$PKGNAME/ -# (source files reside in ./root) -# -# don't use PKGBLOCKLIM for now -# -$V pkgmk -o $PKGCOMPRESS -d $PKGBLD -r $PKGBLD -#pkgmk -o $PKGCOMPRESS -l $PKGBLOCKLIM -d $PKGBLD -r $PKGBLD -#pkgmk -o $PKGCOMPRESS -l $PKGBLOCKLIM -d $PKGBLD -r $PKGBLD/root - -# -# make $PKGNAME.pkg datastream-type package -# -$V pkgtrans -s $PKGBLD $PKGBLD/$PKGNAME.pkg $PKGNAME - -# -# remove filesystem-type package -# -#rm -rf $PKGBLD/$PKGNAME diff --git a/packaging/Caldera/UnixWare/README b/packaging/Caldera/UnixWare/README deleted file mode 100644 index 74f8dc53d5..0000000000 --- a/packaging/Caldera/UnixWare/README +++ /dev/null @@ -1,54 +0,0 @@ -Preparation Date: December 28, 2000 -Preparer: Ronald Joe Record - -Instructions: Preparing Samba Packages for UnixWare -=============================================================== - -We provide support only for current versions of UnixWare. - -The file samba-2.2-uw7.patch is a patch file suitable for use -with the patch command as follows: - - # cd ../../../source - # patch -p 0 -i ../packaging/Caldera/UnixWare/samba-2.2-uw7.patch - -The files modified by this patch are: - smbwrapper/smbw.c - tdb/tdb.c - utils/torture.c - utils/locktest.c - utils/locktest2.c - utils/masktest.c - utils/smbcacls.c - ltconfig - configure.in - -This patch should only be necessary until these changes are accepted -back into the 2.2 source tree. Until then, this patch must be applied -prior to building Samba 2.2 on UnixWare 7. After applying the patch it -is then necessary to run autoconf again and regenerate the configure file: - - # cd ../../../source - # autoconf - -To produce the pkgadd installable datastream simply type (in this directory): - # ./Makepkg - -The resultant samba.pkg should reside in the ./dist subdirectory. -To install from this pkgadd datastream, issue the command (as root): - - # cd dist - # pkgadd -d `pwd`/samba.pkg all - -Alternately, each of the steps in building the datastream may be performed -individually by invoking each of the following: - - # ./Configure - # ./Compile - # ./Install - # ./Package - -If files are added or deleted from the UnixWare Samba distribution then -the prototype file in the pkg directory should be appropriately modified. -The files in the pkg subdirectory were initially created using the mkpkg -package from SCO Skunkware (see http://www.sco.com/skunkware). diff --git a/packaging/Caldera/UnixWare/findsmb b/packaging/Caldera/UnixWare/findsmb deleted file mode 100755 index c87fdb5190..0000000000 --- a/packaging/Caldera/UnixWare/findsmb +++ /dev/null @@ -1,141 +0,0 @@ -#!/usr/local/bin/perl -# -# Prints info on all smb responding machines on a subnet. -# This script needs to be run on a machine without nmbd running and be -# run as root to get correct info from WIN95 clients. -# -# syntax: -# findsmb [subnet broadcast address] -# -# with no agrument it will list machines on the current subnet -# -# There will be a "+" in front of the workgroup name for machines that are -# local master browsers for that workgroup. There will be an "*" in front -# of the workgroup name for machines that are the domain master browser for -# that workgroup. -# - -$SAMBABIN = "/usr/local/samba/bin"; - -for ($i = 0; $i < 2; $i++) { # test for -d option and broadcast address - $_ = shift; - if (m/-d|-D/) { - $DEBUG = 1; - } else { - if ($_) { - $BCAST = "-B $_"; - } - } -} - -sub ipsort # do numeric sort on last field of IP address -{ - @t1 = split(/\./,$a); - @t2 = split(/\./,$b); - @t1[3] <=> @t2[3]; -} - -# look for all machines that respond to a name lookup - -open(NMBLOOKUP,"$SAMBABIN/nmblookup $BCAST '*'|") || - die("Can't run nmblookup '*'.\n"); - -# get rid of all lines that are not a response IP address, -# strip everything but IP address and sort by last field in address - -@ipaddrs = sort ipsort grep(s/ \*<00>.*$//,); - -# print header info - -print "\nIP ADDR NETBIOS NAME WORKGROUP/OS/VERSION $BCAST\n"; -print "---------------------------------------------------------------------\n"; - -foreach $ip (@ipaddrs) # loop through each IP address found -{ - $ip =~ s/\n//; # strip newline from IP address - -# find the netbios names registered by each machine - - open(NMBLOOKUP,"$SAMBABIN/nmblookup -r -A $ip|") || - die("Can't get nmb name list.\n"); - @nmblookup = ; - close NMBLOOKUP; - -# get the first <00> name - - @name = grep(/<00>/,@nmblookup); - $_ = @name[0]; - if ($_) { # we have a netbios name - if (/GROUP/) { # is it a group name - ($name, $aliases, $type, $length, @addresses) = - gethostbyaddr(pack('C4',split('\.',$ip)),2); - if (! $name) { # could not get name - $name = "unknown nis name"; - } - } else { - /(.{1,15})\s+<00>\s+/; - $name = $1; - } - -# do an smbclient command on the netbios name. - - open(SMB,"$SAMBABIN/smbclient -N -L $name -I $ip -U% |") || - die("Can't do smbclient command.\n"); - @smb = ; - close SMB; - - if ($DEBUG) { # if -d flag print results of nmblookup and smbclient - print "===============================================================\n"; - print @nmblookup; - print @smb; - } - -# look for the OS= string - - @info = grep(/OS=/,@smb); - $_ = @info[0]; - if ($_) { # we found response - s/Domain=|OS=|Server=|\n//g; # strip out descriptions to make line shorter - - } else { # no OS= string in response (WIN95 client) - -# for WIN95 clients get workgroup name from nmblookup response - @name = grep(/<00> - /,@nmblookup); - $_ = @name[0]; - if ($_) { - /(.{1,15})\s+<00>\s+/; - $_ = "[$1]"; - } else { - $_ = "Unknown Workgroup"; - } - } - -# see if machine registered a local master browser name - if (grep(/<1d>/,@nmblookup)) { - $master = '+'; # indicate local master browser - if (grep(/<1b>/,@nmblookup)) { # how about domain master browser? - $master = '*'; # indicate domain master browser - } - } else { - $master = ' '; # not a browse master - } - -# line up info in 3 columns - - print "$ip".' 'x(16-length($ip))."$name".' 'x(14-length($name))."$master"."$_\n"; - - } else { # no netbios name found -# try getting the host name - ($name, $aliases, $type, $length, @addresses) = - gethostbyaddr(pack('C4',split('\.',$ip)),2); - if (! $name) { # could not get name - $name = "unknown nis name"; - } - if ($DEBUG) { # if -d flag print results of nmblookup - print "===============================================================\n"; - print @nmblookup; - } - print "$ip".' 'x(16-length($ip))."$name\n"; - } -} - diff --git a/packaging/Caldera/UnixWare/pkg/admin b/packaging/Caldera/UnixWare/pkg/admin deleted file mode 100644 index fe2438c770..0000000000 --- a/packaging/Caldera/UnixWare/pkg/admin +++ /dev/null @@ -1 +0,0 @@ -basedir=ask diff --git a/packaging/Caldera/UnixWare/pkg/pkginfo b/packaging/Caldera/UnixWare/pkg/pkginfo deleted file mode 100644 index c4d8bff0bb..0000000000 --- a/packaging/Caldera/UnixWare/pkg/pkginfo +++ /dev/null @@ -1,10 +0,0 @@ -PKG="samba" -NAME="Samba - A Windows SMB/CIFS fileserver for UNIX" -VERSION="2.2" -VENDOR="SCO" -HOTLINE="1-800-SCO-UNIX" -EMAIL="rr@sco.com" -CATEGORY="skunkware" -CLASSES="samba" -ARCH="i386" -BASEDIR=/ diff --git a/packaging/Caldera/UnixWare/pkg/postinstall b/packaging/Caldera/UnixWare/pkg/postinstall deleted file mode 100755 index 4e202ae354..0000000000 --- a/packaging/Caldera/UnixWare/pkg/postinstall +++ /dev/null @@ -1,56 +0,0 @@ -#!/bin/sh -# -# Create /var/spool/samba, setup swat to be run out of inetd on port 901, -# initialize the lmhosts file and create the codepage load files -# -# Written 10-Aug-1999 by Ronald Joe Record (rr@sco.com) -# - -SPOOL=/var/spool/samba -SVCS=/etc/services -INET=/etc/inetd.conf -PREFIX=/usr/local/samba -LMHOST=/etc/lmhosts - -[ -d $SPOOL ] || { - mkdir -p $SPOOL - chmod 1777 $SPOOL -} - -grep swat $SVCS > /dev/null || { - echo "swat 901/tcp # Samba Web Administration Tool " >> $SVCS -} - -grep swat $INET > /dev/null || { - echo "swat stream tcp nowait root /usr/local/samba/bin/swat swat " >> $INET -} - -if [ -f $LMHOST ] -then - grep localhost $LMHOST > /dev/null || { - echo 127.0.0.1 localhost >> $LMHOST - } -else - echo 127.0.0.1 localhost > $LMHOST -fi - -# -# Build codepage load files -# - -cd ${PREFIX}/lib/codepages -for i in 437 737 775 850 852 861 866 932 936 949 950 1251 -do - ${PREFIX}/bin/make_smbcodepage c $i \ - ${PREFIX}/lib/codepages/src/codepage_def.$i \ - ${PREFIX}/lib/codepages/codepage.$i -done -for i in 437 737 850 852 861 866 932 936 949 950 \ - ISO8859-1 ISO8859-2 ISO8859-5 ISO8859-7 KOI8-R -do - ${PREFIX}/bin/make_unicodemap $i \ - ${PREFIX}/lib/codepages/src/CP$i.TXT \ - ${PREFIX}/lib/codepages/unicode_map.$i -done - -kill -1 `ps -e | grep inetd | awk ' { print $1 } '` diff --git a/packaging/Caldera/UnixWare/pkg/postremove b/packaging/Caldera/UnixWare/pkg/postremove deleted file mode 100755 index dc81d6fa85..0000000000 --- a/packaging/Caldera/UnixWare/pkg/postremove +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/sh -# -# Remove /var/spool/samba and delete inetd entries for swat -# - -SPOOL=/var/spool/samba -SVCS=/etc/services -INET=/etc/inetd.conf - -[ -d $SPOOL ] && { - rm -rf $SPOOL -} - -grep swat $SVCS > /dev/null && { - B=`basename $SVCS` - T=$B$$ - grep -v swat $SVCS > /tmp/$T - cp /tmp/$T $SVCS - rm -f /tmp/$T -} - -grep swat $INET > /dev/null || { - B=`basename $INET` - T=$B$$ - grep -v swat $INET > /tmp/$T - cp /tmp/$T $INET - rm -f /tmp/$T -} - -kill -1 `ps -e | grep inetd | awk ' { print $1 } '` diff --git a/packaging/Caldera/UnixWare/pkg/prototype b/packaging/Caldera/UnixWare/pkg/prototype deleted file mode 100644 index 13a64b6feb..0000000000 --- a/packaging/Caldera/UnixWare/pkg/prototype +++ /dev/null @@ -1,310 +0,0 @@ -i admin=admin -i pkginfo=pkginfo -i postinstall=postinstall -i postremove=postremove - -d samba etc 0755 root sys -d samba etc/init.d 0755 root sys -f samba etc/init.d/samba 0755 root sys -f samba etc/smbusers 0644 root sys -d samba usr 0755 root sys -d samba usr/local 0755 root sys -d samba usr/local/samba 0755 root sys -d samba usr/local/samba/bin 0755 root sys -f samba usr/local/samba/bin/nmblookup 0755 root sys -f samba usr/local/samba/bin/smbclient 0755 root sys -f samba usr/local/samba/bin/smbpasswd 0755 root sys -f samba usr/local/samba/bin/smbstatus 0755 root sys -f samba usr/local/samba/bin/testparm 0755 root sys -f samba usr/local/samba/bin/testprns 0755 root sys -f samba usr/local/samba/bin/make_smbcodepage 0755 root sys -f samba usr/local/samba/bin/make_unicodemap 0755 root sys -f samba usr/local/samba/bin/make_printerdef 0755 root sys -f samba usr/local/samba/bin/rpcclient 0755 root sys -f samba usr/local/samba/bin/smbspool 0755 root sys -f samba usr/local/samba/bin/smbsh 0755 root sys -f samba usr/local/samba/bin/smbwrapper.so 0755 root sys -f samba usr/local/samba/bin/mksmbpasswd.sh 0755 root sys -f samba usr/local/samba/bin/smbtar 0755 root sys -f samba usr/local/samba/bin/smbprint 0755 root sys -f samba usr/local/samba/bin/findsmb 0755 root sys -f samba usr/local/samba/bin/smbadduser 0755 root sys -d samba usr/local/samba/sbin 0755 root sys -f samba usr/local/samba/sbin/smbd 0755 root sys -f samba usr/local/samba/sbin/nmbd 0755 root sys -f samba usr/local/samba/sbin/swat 0755 root sys -f samba usr/local/samba/sbin/debug2html 0755 root sys -f samba usr/local/samba/sbin/smbtorture 0755 root sys -f samba usr/local/samba/sbin/smbfilter 0755 root sys -f samba usr/local/samba/sbin/locktest2 0755 root sys -f samba usr/local/samba/sbin/masktest 0755 root sys -d samba usr/local/samba/swat 0755 root sys -d samba usr/local/samba/swat/using_samba 0755 root sys -d samba usr/local/samba/swat/using_samba/gifs 0755 root sys -f samba usr/local/samba/swat/using_samba/gifs/index.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/gifs/samba.s.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/gifs/txthome.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/gifs/txtnexta.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/gifs/txtpreva.gif 0644 root sys -d samba usr/local/samba/swat/using_samba/figs 0755 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0101.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0102.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0103.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0104.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0105.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0106.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0107.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0108.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0109.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0110.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0111.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0112.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0113.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0114.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0201.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0202.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0203.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0204.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0301.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0302.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0303.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0304.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0305.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0306.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0307.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0308.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0309.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0310.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0311.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0312.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0313.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0314.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0315.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0316.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0317.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0318.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0319.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0320.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0321.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0322.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0323.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0324.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0325.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0326.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0327.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0328.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0401.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0402.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0403.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0404.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0405.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0406.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0407.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0501.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0502.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0503.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0504.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0505.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0506.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0507.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0508.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0601.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0602.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0603.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0604.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0605.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0606.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0701.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0702.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0703.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0704.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0705.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0706.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0707.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0708.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0709.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0801.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0802.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0803.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0804.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0805.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0901.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0902.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0903.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0904.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.0905.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.aa01.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.ab01.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/figs/sam.ab02.gif 0644 root sys -f samba usr/local/samba/swat/using_samba/appa_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/appa_02.html 0644 root sys -f samba usr/local/samba/swat/using_samba/appa_03.html 0644 root sys -f samba usr/local/samba/swat/using_samba/appa_04.html 0644 root sys -f samba usr/local/samba/swat/using_samba/appa_05.html 0644 root sys -f samba usr/local/samba/swat/using_samba/appb_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/appb_02.html 0644 root sys -f samba usr/local/samba/swat/using_samba/appb_03.html 0644 root sys -f samba usr/local/samba/swat/using_samba/appc_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/appd_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/appe_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/appf_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch01_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch01_02.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch01_03.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch01_04.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch01_05.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch01_06.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch01_07.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch01_08.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch02_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch02_02.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch02_03.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch02_04.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch02_05.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch02_06.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch03_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch03_02.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch03_03.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch04_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch04_02.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch04_03.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch04_04.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch04_05.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch04_06.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch04_07.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch04_08.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch05_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch05_02.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch05_03.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch05_04.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch05_05.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch06_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch06_02.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch06_03.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch06_04.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch06_05.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch06_06.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch07_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch07_02.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch07_03.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch08_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch08_02.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch08_03.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch08_04.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch08_05.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch08_06.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch08_07.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch09_01.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch09_02.html 0644 root sys -f samba usr/local/samba/swat/using_samba/ch09_03.html 0644 root sys -f samba usr/local/samba/swat/using_samba/index.html 0644 root sys -f samba usr/local/samba/swat/using_samba/inx.html 0644 root sys -f samba usr/local/samba/swat/using_samba/licenseinfo.html 0644 root sys -f samba usr/local/samba/swat/using_samba/this_edition.html 0644 root sys -d samba usr/local/samba/swat/images 0755 root sys -f samba usr/local/samba/swat/images/globals.gif 0644 root sys -f samba usr/local/samba/swat/images/home.gif 0644 root sys -f samba usr/local/samba/swat/images/passwd.gif 0644 root sys -f samba usr/local/samba/swat/images/printers.gif 0644 root sys -f samba usr/local/samba/swat/images/samba.gif 0644 root sys -f samba usr/local/samba/swat/images/shares.gif 0644 root sys -f samba usr/local/samba/swat/images/status.gif 0644 root sys -f samba usr/local/samba/swat/images/viewconfig.gif 0644 root sys -d samba usr/local/samba/swat/help 0755 root sys -f samba usr/local/samba/swat/help/welcome.html 0644 root sys -f samba usr/local/samba/swat/help/DOMAIN_MEMBER.html 0644 root sys -f samba usr/local/samba/swat/help/NT_Security.html 0644 root sys -f samba usr/local/samba/swat/help/findsmb.1.html 0644 root sys -f samba usr/local/samba/swat/help/lmhosts.5.html 0644 root sys -f samba usr/local/samba/swat/help/make_smbcodepage.1.html 0644 root sys -f samba usr/local/samba/swat/help/nmbd.8.html 0644 root sys -f samba usr/local/samba/swat/help/nmblookup.1.html 0644 root sys -f samba usr/local/samba/swat/help/rpcclient.1.html 0644 root sys -f samba usr/local/samba/swat/help/samba-pdc-faq.html 0644 root sys -f samba usr/local/samba/swat/help/samba-pdc-howto.html 0644 root sys -f samba usr/local/samba/swat/help/samba.7.html 0644 root sys -f samba usr/local/samba/swat/help/smb.conf.5.html 0644 root sys -f samba usr/local/samba/swat/help/smbclient.1.html 0644 root sys -f samba usr/local/samba/swat/help/smbcontrol.1.html 0644 root sys -f samba usr/local/samba/swat/help/smbd.8.html 0644 root sys -f samba usr/local/samba/swat/help/smbpasswd.5.html 0644 root sys -f samba usr/local/samba/swat/help/smbpasswd.8.html 0644 root sys -f samba usr/local/samba/swat/help/smbrun.1.html 0644 root sys -f samba usr/local/samba/swat/help/smbsh.1.html 0644 root sys -f samba usr/local/samba/swat/help/smbspool.8.html 0644 root sys -f samba usr/local/samba/swat/help/smbstatus.1.html 0644 root sys -f samba usr/local/samba/swat/help/smbtar.1.html 0644 root sys -f samba usr/local/samba/swat/help/swat.8.html 0644 root sys -f samba usr/local/samba/swat/help/testparm.1.html 0644 root sys -f samba usr/local/samba/swat/help/testprns.1.html 0644 root sys -f samba usr/local/samba/swat/help/wbinfo.1.html 0644 root sys -f samba usr/local/samba/swat/help/winbindd.8.html 0644 root sys -d samba usr/local/samba/swat/include 0755 root sys -f samba usr/local/samba/swat/include/footer.html 0644 root sys -f samba usr/local/samba/swat/include/header.html 0644 root sys -f samba usr/local/samba/swat/README 0644 root sys -d samba usr/local/samba/man 0755 root sys -d samba usr/local/samba/man/man1 0755 root sys -f samba usr/local/samba/man/man1/findsmb.1 0644 root sys -f samba usr/local/samba/man/man1/make_smbcodepage.1 0644 root sys -f samba usr/local/samba/man/man1/make_unicodemap.1 0644 root sys -f samba usr/local/samba/man/man1/nmblookup.1 0644 root sys -f samba usr/local/samba/man/man1/smbclient.1 0644 root sys -f samba usr/local/samba/man/man1/smbcontrol.1 0644 root sys -f samba usr/local/samba/man/man1/smbrun.1 0644 root sys -f samba usr/local/samba/man/man1/smbsh.1 0644 root sys -f samba usr/local/samba/man/man1/smbstatus.1 0644 root sys -f samba usr/local/samba/man/man1/smbtar.1 0644 root sys -f samba usr/local/samba/man/man1/testparm.1 0644 root sys -f samba usr/local/samba/man/man1/testprns.1 0644 root sys -f samba usr/local/samba/man/man1/wbinfo.1 0644 root sys -d samba usr/local/samba/man/man5 0755 root sys -f samba usr/local/samba/man/man5/smb.conf.5 0644 root sys -f samba usr/local/samba/man/man5/lmhosts.5 0644 root sys -f samba usr/local/samba/man/man5/smbpasswd.5 0644 root sys -d samba usr/local/samba/man/man7 0755 root sys -f samba usr/local/samba/man/man7/samba.7 0644 root sys -d samba usr/local/samba/man/man8 0755 root sys -f samba usr/local/samba/man/man8/smbd.8 0644 root sys -f samba usr/local/samba/man/man8/nmbd.8 0644 root sys -f samba usr/local/samba/man/man8/smbpasswd.8 0644 root sys -f samba usr/local/samba/man/man8/swat.8 0644 root sys -f samba usr/local/samba/man/man8/smbmount.8 0644 root sys -f samba usr/local/samba/man/man8/smbmnt.8 0644 root sys -f samba usr/local/samba/man/man8/smbumount.8 0644 root sys -d samba usr/local/samba/var 0755 root sys -d samba usr/local/samba/var/locks 0755 root sys -d samba usr/local/samba/lib 0755 root sys -d samba usr/local/samba/lib/codepages 0755 root sys -d samba usr/local/samba/lib/codepages/src 0755 root sys -f samba usr/local/samba/lib/codepages/src/codepage_def.437 0644 root sys -f samba usr/local/samba/lib/codepages/src/codepage_def.737 0644 root sys -f samba usr/local/samba/lib/codepages/src/codepage_def.775 0644 root sys -f samba usr/local/samba/lib/codepages/src/codepage_def.850 0644 root sys -f samba usr/local/samba/lib/codepages/src/codepage_def.852 0644 root sys -f samba usr/local/samba/lib/codepages/src/codepage_def.861 0644 root sys -f samba usr/local/samba/lib/codepages/src/codepage_def.866 0644 root sys -f samba usr/local/samba/lib/codepages/src/codepage_def.932 0644 root sys -f samba usr/local/samba/lib/codepages/src/codepage_def.936 0644 root sys -f samba usr/local/samba/lib/codepages/src/codepage_def.949 0644 root sys -f samba usr/local/samba/lib/codepages/src/codepage_def.950 0644 root sys -f samba usr/local/samba/lib/codepages/src/codepage_def.1251 0644 root sys -f samba usr/local/samba/lib/codepages/src/CP437.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CP737.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CP850.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CP852.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CP861.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CP866.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CP932.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CP936.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CP949.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CP950.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CPISO8859-1.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CPISO8859-2.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CPISO8859-5.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CPISO8859-7.TXT 0644 root sys -f samba usr/local/samba/lib/codepages/src/CPKOI8-R.TXT 0644 root sys -f samba usr/local/samba/lib/smb.conf 0644 root sys -d samba usr/local/man 0755 root sys -d samba usr/local/man/html 0755 root sys -s samba usr/local/man/html/samba=/usr/local/samba/swat/using_samba diff --git a/packaging/Caldera/UnixWare/samba-2.2-uw7-prototype.patch b/packaging/Caldera/UnixWare/samba-2.2-uw7-prototype.patch deleted file mode 100644 index 7678379b06..0000000000 --- a/packaging/Caldera/UnixWare/samba-2.2-uw7-prototype.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- packaging/Caldera/UnixWare/pkg/prototype.00 Tue Jan 9 05:40:47 2001 -+++ packaging/Caldera/UnixWare/pkg/prototype Fri Apr 13 14:44:33 2001 -@@ -220,7 +220,7 @@ - f samba usr/local/samba/swat/help/make_smbcodepage.1.html 0644 root sys - f samba usr/local/samba/swat/help/nmbd.8.html 0644 root sys - f samba usr/local/samba/swat/help/nmblookup.1.html 0644 root sys --f samba usr/local/samba/swat/help/rpcclient.8.html 0644 root sys -+f samba usr/local/samba/swat/help/rpcclient.1.html 0644 root sys - f samba usr/local/samba/swat/help/samba-pdc-faq.html 0644 root sys - f samba usr/local/samba/swat/help/samba-pdc-howto.html 0644 root sys - f samba usr/local/samba/swat/help/samba.7.html 0644 root sys diff --git a/packaging/Caldera/UnixWare/samba-2.2-uw7.patch b/packaging/Caldera/UnixWare/samba-2.2-uw7.patch deleted file mode 100644 index c4412e542e..0000000000 --- a/packaging/Caldera/UnixWare/samba-2.2-uw7.patch +++ /dev/null @@ -1,200 +0,0 @@ ---- smbwrapper/smbw.c.orig Mon Jan 8 12:37:48 2001 -+++ smbwrapper/smbw.c Fri Apr 13 13:09:00 2001 -@@ -22,6 +22,11 @@ - #include "includes.h" - #include "realcalls.h" - -+#if defined(__USLC__) && defined(HAVE_SYS_ACL_H) -+#define GETACL ACL_GET -+#define GETACLCNT ACL_CNT -+#endif -+ - pstring smbw_cwd; - - static struct smbw_file *smbw_files; -@@ -1462,7 +1467,11 @@ - /***************************************************** - say no to acls - *******************************************************/ -+#if defined(__USLC__) -+ int smbw_acl(const char *pathp, int cmd, int nentries, void *aclbufp) -+#else - int smbw_acl(const char *pathp, int cmd, int nentries, aclent_t *aclbufp) -+#endif - { - if (cmd == GETACL || cmd == GETACLCNT) return 0; - errno = ENOSYS; -@@ -1474,7 +1483,11 @@ - /***************************************************** - say no to acls - *******************************************************/ -+#if defined(__USLC__) -+ int smbw_facl(int fd, int cmd, int nentries, void *aclbufp) -+#else - int smbw_facl(int fd, int cmd, int nentries, aclent_t *aclbufp) -+#endif - { - if (cmd == GETACL || cmd == GETACLCNT) return 0; - errno = ENOSYS; ---- tdb/tdb.c.orig Fri Apr 13 05:58:34 2001 -+++ tdb/tdb.c Fri Apr 13 13:34:18 2001 -@@ -856,7 +856,11 @@ - { - TDB_DATA key, dbuf; - struct list_struct rec; -+#if defined(__USLC__) -+ struct tdb_traverse_lock tl = { (struct tdb_traverse_lock *)0, 0, 0 }; -+#else - struct tdb_traverse_lock tl = { NULL, 0, 0 }; -+#endif - int ret, count = 0; - - /* This was in the initializaton, above, but the IRIX compiler ---- utils/torture.c.orig Fri Mar 30 13:53:26 2001 -+++ utils/torture.c Fri Apr 13 13:09:01 2001 -@@ -2703,7 +2703,11 @@ - - dbf = stdout; - -+#if defined(__USLC__) -+ setbuf(stdout, NULL); -+#else - setbuffer(stdout, NULL, 0); -+#endif - - charset_initialise(); - ---- utils/locktest.c.orig Fri Sep 29 13:18:14 2000 -+++ utils/locktest.c Fri Apr 13 13:09:01 2001 -@@ -34,7 +34,7 @@ - - #define FILENAME "\\locktest.dat" - #define LOCKRANGE 1000 --#define LOCKBASE 0; -+#define LOCKBASE 0 - - /* - #define LOCKBASE (0x40000000 - 50) -@@ -59,6 +59,7 @@ - char needed; - }; - -+#ifndef __USLC__ - static struct record preset[] = { - #if 0 - {36, 5, 0, 0, 0, 8, 1}, -@@ -67,6 +68,7 @@ - {99, 11, 0, 0, 7, 1, 1}, - #endif - }; -+#endif /* __USLC__) */ - - static struct record *recorded; - -@@ -378,20 +380,23 @@ - recorded = (struct record *)malloc(sizeof(*recorded) * numops); - - for (n=0; n - -# Password Level allows matching of _n_ characters of the password for -# all combinations of upper and lower case. -; password level = 8 -; username level = 8 - -# You may wish to use password encryption. Please read -# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation. -# Do not enable this option unless you have read those documents -; encrypt passwords = yes -; smb passwd file = /etc/smbpasswd - -# The following are needed to allow password changing from Windows to -# update the Linux sytsem password also. -# NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above. -# NOTE2: You do NOT need these to allow workstations to change only -# the encrypted SMB passwords. They allow the Unix password -# to be kept in sync with the SMB password. -; unix password sync = Yes -; passwd program = /usr/bin/passwd %u -; passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* %n\n *passwd:*all*authentication*tokens*updated*successfully* - -# Unix users can map to different SMB User names -; username map = /etc/smbusers - -# Using the following line enables you to customise your configuration -# on a per machine basis. The %m gets replaced with the netbios name -# of the machine that is connecting -; include = /etc/smb.conf.%m - -# Most people will find that this option gives better performance. -# See speed.txt and the manual pages for details - socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 - -# Configure Samba to use multiple interfaces -# If you have multiple network interfaces then you must list them -# here. See the man page for details. -; interfaces = 192.168.12.2/24 192.168.13.2/24 - -# Configure remote browse list synchronisation here -# request announcement to, or browse list sync from: -# a specific host or from / to a whole subnet (see below) -; remote browse sync = 192.168.3.25 192.168.5.255 -# Cause this host to announce itself to local subnets here -; remote announce = 192.168.1.255 192.168.2.44 - -# Browser Control Options: -# set local master to no if you don't want Samba to become a master -# browser on your network. Otherwise the normal election rules apply -; local master = no - -# OS Level determines the precedence of this server in master browser -# elections. The default value should be reasonable -; os level = 33 - -# Domain Master specifies Samba to be the Domain Master Browser. This -# allows Samba to collate browse lists between subnets. Don't use this -# if you already have a Windows NT domain controller doing this job -; domain master = yes - -# Preferred Master causes Samba to force a local browser election on startup -# and gives it a slightly higher chance of winning the election -; preferred master = yes - -# Use only if you have an NT server on your network that has been -# configured at install time to be a primary domain controller. -; domain controller = - -# Enable this if you want Samba to be a domain logon server for -# Windows95 workstations. -; domain logons = yes - -# if you enable domain logons then you may want a per-machine or -# per user logon script -# run a specific logon batch file per workstation (machine) -; logon script = %m.bat -# run a specific logon batch file per username -; logon script = %U.bat - -# Where to store roving profiles (only for Win95 and WinNT) -# %L substitutes for this servers netbios name, %U is username -# You must uncomment the [Profiles] share below -; logon path = \\%L\Profiles\%U - -# All NetBIOS names must be resolved to IP Addresses -# 'Name Resolve Order' allows the named resolution mechanism to be specified -# the default order is "host lmhosts wins bcast". "host" means use the unix -# system gethostbyname() function call that will use either /etc/hosts OR -# DNS or NIS depending on the settings of /etc/host.config, /etc/nsswitch.conf -# and the /etc/resolv.conf file. "host" therefore is system configuration -# dependant. This parameter is most often of use to prevent DNS lookups -# in order to resolve NetBIOS names to IP Addresses. Use with care! -# The example below excludes use of name resolution for machines that are NOT -# on the local network segment -# - OR - are not deliberately to be known via lmhosts or via WINS. -; name resolve order = wins lmhosts bcast - -# Windows Internet Name Serving Support Section: -# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server -; wins support = yes - -# WINS Server - Tells the NMBD components of Samba to be a WINS Client -# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both -; wins server = w.x.y.z - -# WINS Proxy - Tells Samba to answer name resolution queries on -# behalf of a non WINS capable client, for this to work there must be -# at least one WINS Server on the network. The default is NO. -; wins proxy = yes - -# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names -# via DNS nslookups. The built-in default for versions 1.9.17 is yes, -# this has been changed in version 1.9.18 to no. - dns proxy = no - -# Case Preservation can be handy - system default is _no_ -# NOTE: These can be set on a per share basis -; preserve case = no -; short preserve case = no -# Default case is normally upper case for all DOS files -; default case = lower -# Be very careful with case sensitivity - it can break things! -; case sensitive = no - -#============================ Share Definitions ============================== -[homes] - comment = Home Directories - browseable = no - writable = yes - -# Un-comment the following and create the netlogon directory for Domain Logons -; [netlogon] -; comment = Network Logon Service -; path = /home/netlogon -; guest ok = yes -; writable = no -; share modes = no - - -# Un-comment the following to provide a specific roving profile share -# the default is to use the user's home directory -;[Profiles] -; path = /home/profiles -; browseable = no -; guest ok = yes - - -# NOTE: If you have a BSD-style print system there is no need to -# specifically define each individual printer -[printers] - comment = All Printers - path = /var/spool/samba - browseable = no -# Set public = yes to allow user 'guest account' to print - guest ok = no - writable = no - printable = yes - -# This one is useful for people to share files -;[tmp] -; comment = Temporary file space -; path = /tmp -; read only = no -; public = yes - -# A publicly accessible directory, but read only, except for people in -# the "staff" group -;[public] -; comment = Public Stuff -; path = /home/samba -; public = yes -; writable = yes -; printable = no -; write list = @staff - -# Other examples. -# -# A private printer, usable only by fred. Spool data will be placed in fred's -# home directory. Note that fred must have write access to the spool directory, -# wherever it is. -;[fredsprn] -; comment = Fred's Printer -; valid users = fred -; path = /homes/fred -; printer = freds_printer -; public = no -; writable = no -; printable = yes - -# A private directory, usable only by fred. Note that fred requires write -# access to the directory. -;[fredsdir] -; comment = Fred's Service -; path = /usr/somewhere/private -; valid users = fred -; public = no -; writable = yes -; printable = no - -# a service which has a different directory for each machine that connects -# this allows you to tailor configurations to incoming machines. You could -# also use the %u option to tailor it by user name. -# The %m gets replaced with the machine name that is connecting. -;[pchome] -; comment = PC Directories -; path = /usr/pc/%m -; public = no -; writable = yes - -# A publicly accessible directory, read/write to all users. Note that all files -# created in the directory by users will be owned by the default user, so -# any user with access can delete any other user's files. Obviously this -# directory must be writable by the default user. Another user could of course -# be specified, in which case all files would be owned by that user instead. -;[public] -; path = /usr/somewhere/else/public -; public = yes -; only guest = yes -; writable = yes -; printable = no - -# The following two entries demonstrate how to share a directory so that two -# users can place files there that will be owned by the specific users. In this -# setup, the directory should be writable by both users and should have the -# sticky bit set on it to prevent abuse. Obviously this could be extended to -# as many users as required. -;[myshare] -; comment = Mary's and Fred's stuff -; path = /usr/somewhere/shared -; valid users = mary fred -; public = no -; writable = yes -; printable = no -; create mask = 0765 - - diff --git a/packaging/Caldera/UnixWare/smb.init b/packaging/Caldera/UnixWare/smb.init deleted file mode 100755 index ce6c6fa4b3..0000000000 --- a/packaging/Caldera/UnixWare/smb.init +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/sh -#ident "@(#)samba.server 1.0 96/06/19 TK" /* SVr4.0 1.1.13.1*/ -# -# Please send info on modifications to knuutila@cs.utu.fi -# -# This file should have uid root, gid sys and chmod 744 -# -# Modified 17-Jul-99 by Ron Record (rr@sco.com) for use in SCO Skunkware -# - -SAMBADIR=/usr/local/samba -RCSCRIPT=/etc/rc2.d/S99samba - -if [ ! -d /usr/bin ] -then # /usr not mounted - exit -fi - -killproc() { # kill the named process(es) - if [ -f $SAMBADIR/var/locks/$1.pid ] - then - kill `cat $SAMBADIR/var/locks/$1.pid` - else - pid=`/usr/bin/ps -e | - /usr/bin/grep $1 | - /usr/bin/sed -e 's/^ *//' -e 's/ .*//'` - [ "$pid" != "" ] && kill $pid - fi -} - -start() { -# -# Edit these lines to suit your installation (paths, workgroup, host) -# - $SAMBADIR/sbin/smbd -D -s $SAMBADIR/lib/smb.conf - $SAMBADIR/sbin/nmbd -D -s $SAMBADIR/lib/smb.conf -} - -stop() { - killproc nmbd - killproc smbd -} - -# Start/stop processes required for samba server - -case "$1" in - -'start') - start - ;; -'stop') - stop - ;; -'restart') - stop - start - ;; -'enable') - if [ -h $RCSCRIPT ] ; then - echo "Samba is already enabled." - else - echo "Enabling Samba ... \c" - rm -f $RCSCRIPT - ln -s /etc/init.d/samba $RCSCRIPT - echo "Done" - fi - ;; -'disable') - echo "Disabling Samba ... \c" - rm -f $RCSCRIPT - echo "Done" - ;; -*) - echo "Usage: /etc/init.d/samba { start | stop | restart | enable | disable }" - ;; -esac diff --git a/packaging/Caldera/UnixWare/smbadduser b/packaging/Caldera/UnixWare/smbadduser deleted file mode 100755 index 2f38bf28f1..0000000000 --- a/packaging/Caldera/UnixWare/smbadduser +++ /dev/null @@ -1,73 +0,0 @@ -#!/bin/csh -# -# smbadduser - Written by Mike Zakharoff -# -unalias * -set path = ($path) - -set smbpasswd = /etc/smbpasswd -set user_map = /etc/smbusers -# -# Set to site specific passwd command -# -set passwd = "cat /etc/passwd" -#set passwd = "niscat passwd.org_dir" -#set passwd = "ypcat passwd" - -set line = "----------------------------------------------------------" -if ($#argv == 0) then - echo $line - echo "Written: Mike Zakharoff email: michael.j.zakharoff@boeing.com" - echo "" - echo " 1) Updates $smbpasswd" - echo " 2) Updates $user_map" - echo " 3) Executes smbpasswd for each new user" - echo "" - echo "smbadduser unixid:ntid unixid:ntid ..." - echo "" - echo "Example: smbadduser zak:zakharoffm johns:smithj" - echo $line - exit 1 -endif - -touch $smbpasswd $user_map -set new = () -foreach one ($argv) - echo $one | grep ':' >& /dev/null - if ($status != 0) then - echo "ERROR: Must use unixid:ntid like -> zak:zakharoffm" - continue - endif - set unix = `echo $one | awk -F: '{print $1}'` - set ntid = `echo $one | awk -F: '{print $2}'` - - set usr = `eval $passwd | awk -F: '$1==USR {print $1}' USR=$unix` - if ($#usr != 1) then - echo "ERROR: $unix Not in passwd database SKIPPING..." - continue - endif - set tmp = `cat $smbpasswd | awk -F: '$1==USR {print $1}' USR=$unix` - if ($#tmp != 0) then - echo "ERROR: $unix is already in $smbpasswd SKIPPING..." - continue - endif - - echo "Adding: $unix to $smbpasswd" - eval $passwd | \ - awk -F: '$1==USR { \ - printf( "%s:%s:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:%s:%s:%s\n", $1, $3, $5, $6, $7) }' USR=$unix >> $smbpasswd - if ($unix != $ntid) then - echo "Adding: {$unix = $ntid} to $user_map" - echo "$unix = $ntid" >> $user_map - endif - set new = ($new $unix) -end - -# -# Enter password for new users -# -foreach one ($new) - echo $line - echo "ENTER password for $one" - smbpasswd $one -end diff --git a/packaging/Caldera/UnixWare/smbprint b/packaging/Caldera/UnixWare/smbprint deleted file mode 100755 index ec083eede6..0000000000 --- a/packaging/Caldera/UnixWare/smbprint +++ /dev/null @@ -1,77 +0,0 @@ -#!/bin/sh - -# This script is an input filter for printcap printing on a unix machine. It -# uses the smbclient program to print the file to the specified smb-based -# server and service. -# For example you could have a printcap entry like this -# -# smb:lp=/dev/null:sd=/usr/spool/smb:sh:if=/usr/local/samba/smbprint -# -# which would create a unix printer called "smb" that will print via this -# script. You will need to create the spool directory /usr/spool/smb with -# appropriate permissions and ownerships for your system. - -# Set these to the server and service you wish to print to -# In this example I have a WfWg PC called "lapland" that has a printer -# exported called "printer" with no password. - -# -# Script further altered by hamiltom@ecnz.co.nz (Michael Hamilton) -# so that the server, service, and password can be read from -# a /var/spool/lpd/PRINTNAME/.config file. -# -# In order for this to work the /etc/printcap entry must include an -# accounting file (af=...): -# -# cdcolour:\ -# :cm=CD IBM Colorjet on 6th:\ -# :sd=/var/spool/lpd/cdcolour:\ -# :af=/var/spool/lpd/cdcolour/acct:\ -# :if=/usr/local/etc/smbprint:\ -# :mx=0:\ -# :lp=/dev/null: -# -# The /usr/var/spool/lpd/PRINTNAME/.config file should contain: -# server=PC_SERVER -# service=PR_SHARENAME -# password="password" -# -# E.g. -# server=PAULS_PC -# service=CJET_371 -# password="" - -# -# Debugging log file, change to /dev/null if you like. -# -# logfile=/tmp/smb-print.log -logfile=/dev/null - - -# -# The last parameter to the filter is the accounting file name. -# Extract the directory name from the file name. -# Concat this with /.config to get the config file. -# -eval acct_file=\${$#} -spool_dir=`dirname $acct_file` -config_file=$spool_dir/.config - -# Should read the following variables set in the config file: -# server -# service -# password -eval `cat $config_file` - -# -# Some debugging help, change the >> to > if you want to same space. -# -echo "server $server, service $service" >> $logfile - -( -# NOTE You may wish to add the line `echo translate' if you want automatic -# CR/LF translation when printing. -# echo translate - echo "print -" - cat -) | /usr/bin/smbclient "\\\\$server\\$service" $password -U $server -N -P >> $logfile diff --git a/packaging/Caldera/UnixWare/smbusers b/packaging/Caldera/UnixWare/smbusers deleted file mode 100644 index ae3389f53f..0000000000 --- a/packaging/Caldera/UnixWare/smbusers +++ /dev/null @@ -1,3 +0,0 @@ -# Unix_name = SMB_name1 SMB_name2 ... -root = administrator admin -nobody = guest pcguest smbguest diff --git a/packaging/Digital/Instructions b/packaging/Digital/Instructions deleted file mode 100644 index f764ad350d..0000000000 --- a/packaging/Digital/Instructions +++ /dev/null @@ -1,55 +0,0 @@ -Copyright (C) 1997-1998 John H Terpstra -E-mail: jht@samba.org - -Subject: Installation Instructions for Digital Unix v4.0 --------------------------------------------------------- - -1) cd / -2) tar xvf [path-to-]/install.tar -3) cd /usr/local/samba/lib -4) vi smb.conf - -Now modify smb.conf to reflect your site needs. - -5) samba start - -To stop samba: - - samba stop - -You could install samba to run from the system start-up scripts -(recommended) by running ./setup.sh - -Start / Stop Samba as follows:- - - samba [start | stop] - - -Subject: Encrypted password support ------------------------------------ - -Encrypted password support is quite distinct from Digital Enhanced -Security Mode operation of the Unix system. Encrypted passwords -applies to the SMB connections serviced by this machine, not to -local user logons. Local user logons are services by the security -system chosen by your system administrator. - -Digital Unix knows of either BASIC or ENHANCED security mode -operation. BASIC mode uses the traditional /etc/passwd database -containing Unix crypted passwords. ENHANCED mode uses a TCB database. -Samba-1.9.18p10 has been modified so that if OSF1_ENH_SEC is defined -at compile time then a password check will be made first using ENHANCED -mode and if that fails then it will try BASIC mode. This is the case -for this binary distribution - you need not recompile. In other -words: this binary distribution will work with either security mode. - -To enable SMB encrypted password support do the following: - -1) Put /usr/local/samba/bin in your PATH -2) Edit /usr/local/samba/lib/smb.conf and uncomment the - line "encrypt passwd = yes" -3) Execute: smbpasswd -a "username" "password" - -The above will create your /usr/local/samba/private/smbpasswd file -in which will be the NT and LanMAN hashed passwords. - diff --git a/packaging/Digital/PackageDate b/packaging/Digital/PackageDate deleted file mode 100644 index 360e4148aa..0000000000 --- a/packaging/Digital/PackageDate +++ /dev/null @@ -1 +0,0 @@ -November 14, 1998, Australia/Sydney diff --git a/packaging/Digital/Packager b/packaging/Digital/Packager deleted file mode 100644 index 75252978dc..0000000000 --- a/packaging/Digital/Packager +++ /dev/null @@ -1,2 +0,0 @@ -Date: November 14, 1998 -Packager: John H Terpstra diff --git a/packaging/Digital/Packaging-instructions b/packaging/Digital/Packaging-instructions deleted file mode 100644 index 77eafd312f..0000000000 --- a/packaging/Digital/Packaging-instructions +++ /dev/null @@ -1,14 +0,0 @@ -The package building files should be located in a directory -called: samba-2.0.0 - -Step Directions -==== ============================================ -1. Copy the samba distribution tarball into the packaging directory -2. Make sure you have a installed on your system the GNU gzip/gunzip files -3. Edit "package-prep" script as required -4. Run "package-prep" - -If all goes well, you should now have a usable distribution package. - -Note: Update the Instructions file as required. - diff --git a/packaging/Digital/package-prep b/packaging/Digital/package-prep deleted file mode 100755 index 2daee8b69e..0000000000 --- a/packaging/Digital/package-prep +++ /dev/null @@ -1,30 +0,0 @@ -tar xvf skeleton.tar -NOWDIR=`pwd`; -( cd /usr/local; - if [ -x man ]; then mv man man.orig; fi - if [ -x samba ]; then mv samba samba.orig; fi - ln -sf $NOWDIR/usr/local/man man; - ln -sf $NOWDIR/usr/local/samba samba; ) -gunzip samba-2.0.0.tar.gz -tar xvf samba-2.0.0.tar -cd samba-2.0.0/source -./configure -make -make install -cd $NOWDIR/usr/local/samba -cp -pr man ../ -rm -rf man -cd $NOWDIR -tar cvf install.tar usr var -cd samba-2.0.0/source -rm -f ../source/bin/* -make clean -cd ../.. -tar cvf samba-2.0.0.tar samba-2.0.0 -rm -rf samba-2.0.0 -rm -rf usr var -cd .. -find samba-2.0.0 -print | cpio -o > samba-2.0.0-OSF1-v4.0-beta5.cpio -gzip samba-2.0.0-OSF1-v4.0-beta5.cpio -cd samba-2.0.0 -tar xvf install.tar diff --git a/packaging/Digital/samba.init b/packaging/Digital/samba.init deleted file mode 100755 index 6a74244089..0000000000 --- a/packaging/Digital/samba.init +++ /dev/null @@ -1,34 +0,0 @@ -#!/bin/sh -# -if [ ! -d /usr/bin ]; then - echo "The /usr file system is not mounted." - exit 1 -fi - -killproc() { - pid=`/bin/ps ax | grep -w $1 | sed -e 's/^ *//' -e 's/ .*//'` - echo "Stopping $1 now." - [ "$pid" != "" ] && kill -15 $pid - echo $pid -} - - -# Start/stop processes required for samba server - -case "$1" in - - 'start') - echo "Starting Samba" - /usr/local/samba/bin/smbd - /usr/local/samba/bin/nmbd - echo "Done." - ;; - 'stop') - killproc smbd - killproc nmbd - ;; - *) - echo "Usage: /sbin/init.d/samba.init [ start | stop ]" - ;; -esac -exit 0 diff --git a/packaging/Digital/setup.sh b/packaging/Digital/setup.sh deleted file mode 100755 index 81b04878bb..0000000000 --- a/packaging/Digital/setup.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/sh - -echo "Setting up for SWAT - The Samba Web Administration Tool" - -echo 'swat 901/tcp' >> /etc/services -uniq /etc/services /tmp/tempserv -cp /tmp/tempserv /etc/services -rm /tmp/tempserv -echo 'swat stream tcp nowait.400 root /usr/local/samba/bin/swat swat' >> /etc/inetd.conf -uniq /etc/inetd.conf /tmp/tempinetd -cp /tmp/tempinetd /etc/inetd.conf -rm /tmp/tempinetd -echo "Creating Symbolic Links for Start up Scripts" -cp -f samba.init /sbin/init.d -chown bin.bin /sbin/init.d/samba.init -chmod 750 /sbin/init.d/samba.init -ln -sf /sbin/init.d/samba.init /sbin/rc0.d/K01samba -ln -sf /sbin/init.d/samba.init /sbin/rc2.d/K91samba -ln -sf /sbin/init.d/samba.init /sbin/rc3.d/S91samba -echo "Done. Now settting up samba command" -ln /sbin/init.d/samba.init /sbin/samba -echo "Done." -echo "To start / stop samba:" -echo " execute: samba [start | stop] diff --git a/packaging/Digital/skeleton.tar b/packaging/Digital/skeleton.tar deleted file mode 100644 index 92598d0c5e..0000000000 Binary files a/packaging/Digital/skeleton.tar and /dev/null differ -- cgit From e774da88c0059452c9a51d3e86caca9cba2549a0 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 03:40:35 +0000 Subject: syncing packaging files from 3.0 (This used to be commit f7f8954ba4e7efd3c9d586e9cfe7431054afe906) --- packaging/PHT/TurboLinux/.cvsignore | 3 - packaging/PHT/TurboLinux/README | 11 - packaging/PHT/TurboLinux/findsmb | 141 --------- packaging/PHT/TurboLinux/makerpms.sh.tmpl | 14 - packaging/PHT/TurboLinux/samba.log | 11 - packaging/PHT/TurboLinux/samba.pamd | 11 - packaging/PHT/TurboLinux/samba2.spec.tmpl | 502 ------------------------------ packaging/PHT/TurboLinux/smb.conf | 291 ----------------- packaging/PHT/TurboLinux/smb.init | 49 --- packaging/PHT/TurboLinux/smbadduser | 73 ----- packaging/PHT/TurboLinux/smbprint | 77 ----- packaging/PHT/TurboLinux/smbusers | 3 - packaging/PHT/TurboLinux/smbw.patch | 10 - 13 files changed, 1196 deletions(-) delete mode 100644 packaging/PHT/TurboLinux/.cvsignore delete mode 100644 packaging/PHT/TurboLinux/README delete mode 100755 packaging/PHT/TurboLinux/findsmb delete mode 100644 packaging/PHT/TurboLinux/makerpms.sh.tmpl delete mode 100644 packaging/PHT/TurboLinux/samba.log delete mode 100644 packaging/PHT/TurboLinux/samba.pamd delete mode 100644 packaging/PHT/TurboLinux/samba2.spec.tmpl delete mode 100644 packaging/PHT/TurboLinux/smb.conf delete mode 100755 packaging/PHT/TurboLinux/smb.init delete mode 100755 packaging/PHT/TurboLinux/smbadduser delete mode 100755 packaging/PHT/TurboLinux/smbprint delete mode 100644 packaging/PHT/TurboLinux/smbusers delete mode 100644 packaging/PHT/TurboLinux/smbw.patch diff --git a/packaging/PHT/TurboLinux/.cvsignore b/packaging/PHT/TurboLinux/.cvsignore deleted file mode 100644 index 0238ed8cae..0000000000 --- a/packaging/PHT/TurboLinux/.cvsignore +++ /dev/null @@ -1,3 +0,0 @@ -makefile-path.patch -makerpms.sh -samba2.spec diff --git a/packaging/PHT/TurboLinux/README b/packaging/PHT/TurboLinux/README deleted file mode 100644 index 867ff01811..0000000000 --- a/packaging/PHT/TurboLinux/README +++ /dev/null @@ -1,11 +0,0 @@ -Preparation Date: October 25, 1998 -Preparer: John H Terpstra - -Instructions: Preparing Samba Packages for TurboLinux -=============================================================== - -We provide support only for current versions of TurboLinux. - -To produce the RPMS simply type: - sh makerpms.sh - diff --git a/packaging/PHT/TurboLinux/findsmb b/packaging/PHT/TurboLinux/findsmb deleted file mode 100755 index f70d18dcbd..0000000000 --- a/packaging/PHT/TurboLinux/findsmb +++ /dev/null @@ -1,141 +0,0 @@ -#!/usr/bin/perl -# -# Prints info on all smb responding machines on a subnet. -# This script needs to be run on a machine without nmbd running and be -# run as root to get correct info from WIN95 clients. -# -# syntax: -# findsmb [subnet broadcast address] -# -# with no agrument it will list machines on the current subnet -# -# There will be a "+" in front of the workgroup name for machines that are -# local master browsers for that workgroup. There will be an "*" in front -# of the workgroup name for machines that are the domain master browser for -# that workgroup. -# - -$SAMBABIN = "/usr/bin"; - -for ($i = 0; $i < 2; $i++) { # test for -d option and broadcast address - $_ = shift; - if (m/-d|-D/) { - $DEBUG = 1; - } else { - if ($_) { - $BCAST = "-B $_"; - } - } -} - -sub ipsort # do numeric sort on last field of IP address -{ - @t1 = split(/\./,$a); - @t2 = split(/\./,$b); - @t1[3] <=> @t2[3]; -} - -# look for all machines that respond to a name lookup - -open(NMBLOOKUP,"$SAMBABIN/nmblookup $BCAST '*'|") || - die("Can't run nmblookup '*'.\n"); - -# get rid of all lines that are not a response IP address, -# strip everything but IP address and sort by last field in address - -@ipaddrs = sort ipsort grep(s/ \*<00>.*$//,); - -# print header info - -print "\nIP ADDR NETBIOS NAME WORKGROUP/OS/VERSION $BCAST\n"; -print "---------------------------------------------------------------------\n"; - -foreach $ip (@ipaddrs) # loop through each IP address found -{ - $ip =~ s/\n//; # strip newline from IP address - -# find the netbios names registered by each machine - - open(NMBLOOKUP,"$SAMBABIN/nmblookup -r -A $ip|") || - die("Can't get nmb name list.\n"); - @nmblookup = ; - close NMBLOOKUP; - -# get the first <00> name - - @name = grep(/<00>/,@nmblookup); - $_ = @name[0]; - if ($_) { # we have a netbios name - if (/GROUP/) { # is it a group name - ($name, $aliases, $type, $length, @addresses) = - gethostbyaddr(pack('C4',split('\.',$ip)),2); - if (! $name) { # could not get name - $name = "unknown nis name"; - } - } else { - /(.{1,15})\s+<00>\s+/; - $name = $1; - } - -# do an smbclient command on the netbios name. - - open(SMB,"$SAMBABIN/smbclient -N -L $name -I $ip -U% |") || - die("Can't do smbclient command.\n"); - @smb = ; - close SMB; - - if ($DEBUG) { # if -d flag print results of nmblookup and smbclient - print "===============================================================\n"; - print @nmblookup; - print @smb; - } - -# look for the OS= string - - @info = grep(/OS=/,@smb); - $_ = @info[0]; - if ($_) { # we found response - s/Domain=|OS=|Server=|\n//g; # strip out descriptions to make line shorter - - } else { # no OS= string in response (WIN95 client) - -# for WIN95 clients get workgroup name from nmblookup response - @name = grep(/<00> - /,@nmblookup); - $_ = @name[0]; - if ($_) { - /(.{1,15})\s+<00>\s+/; - $_ = "[$1]"; - } else { - $_ = "Unknown Workgroup"; - } - } - -# see if machine registered a local master browser name - if (grep(/<1d>/,@nmblookup)) { - $master = '+'; # indicate local master browser - if (grep(/<1b>/,@nmblookup)) { # how about domain master browser? - $master = '*'; # indicate domain master browser - } - } else { - $master = ' '; # not a browse master - } - -# line up info in 3 columns - - print "$ip".' 'x(16-length($ip))."$name".' 'x(14-length($name))."$master"."$_\n"; - - } else { # no netbios name found -# try getting the host name - ($name, $aliases, $type, $length, @addresses) = - gethostbyaddr(pack('C4',split('\.',$ip)),2); - if (! $name) { # could not get name - $name = "unknown nis name"; - } - if ($DEBUG) { # if -d flag print results of nmblookup - print "===============================================================\n"; - print @nmblookup; - } - print "$ip".' 'x(16-length($ip))."$name\n"; - } -} - diff --git a/packaging/PHT/TurboLinux/makerpms.sh.tmpl b/packaging/PHT/TurboLinux/makerpms.sh.tmpl deleted file mode 100644 index c389bf1a68..0000000000 --- a/packaging/PHT/TurboLinux/makerpms.sh.tmpl +++ /dev/null @@ -1,14 +0,0 @@ -#!/bin/sh -# Copyright (C) 1998 John H Terpstra, 1999 K Spoon -# -SPECDIR=/usr/src/turbo/SPECS -SRCDIR=/usr/src/turbo/SOURCES -USERID=`id -u` -GRPID=`id -g` - -( cd ../../../.. ; chown -R ${USERID}.${GRPID} ${SRCDIR}/samba-PVERSION ) -( cd ../../../.. ; tar czvf ${SRCDIR}/samba-PVERSION.tar.gz samba-PVERSION ) -cp -a *.spec $SPECDIR -cp -a *.patch smb.* samba.log $SRCDIR -cd $SPECDIR -rpm -ba -v samba2.spec diff --git a/packaging/PHT/TurboLinux/samba.log b/packaging/PHT/TurboLinux/samba.log deleted file mode 100644 index c5f2a5b45b..0000000000 --- a/packaging/PHT/TurboLinux/samba.log +++ /dev/null @@ -1,11 +0,0 @@ -/var/log/samba/log.nmb { - postrotate - /usr/bin/killall -HUP nmbd - endrotate -} - -/var/log/samba/log.smb { - postrotate - /usr/bin/killall -HUP smbd - endrotate -} diff --git a/packaging/PHT/TurboLinux/samba.pamd b/packaging/PHT/TurboLinux/samba.pamd deleted file mode 100644 index 225ab724ec..0000000000 --- a/packaging/PHT/TurboLinux/samba.pamd +++ /dev/null @@ -1,11 +0,0 @@ -#%PAM-1.0 -#[For version 1.0 syntax, the above header is optional] -# -# The PAM configuration file for the `samba' service -# -auth required /lib/security/pam_pwdb.so nullok nodelay # shadow audit -# auth required /lib/security/pam_smbpass.so nodelay -account required /lib/security/pam_pwdb.so audit nodelay -session required /lib/security/pam_pwdb.so nodelay -password required /lib/security/pam_pwdb.so # shadow md5 -#password required /lib/security/pam_smbpass.so nodelay smbconf=/etc/samba.d/smb.conf diff --git a/packaging/PHT/TurboLinux/samba2.spec.tmpl b/packaging/PHT/TurboLinux/samba2.spec.tmpl deleted file mode 100644 index 0633f62a7e..0000000000 --- a/packaging/PHT/TurboLinux/samba2.spec.tmpl +++ /dev/null @@ -1,502 +0,0 @@ -Summary: Samba SMB client and server -Name: samba -Version: PVERSION -Release: PRELEASE -Copyright: GNU GPL version 2 -Group: Networking -Source: ftp://samba.org/pub/samba/samba-PVERSION.tar.gz -Patch: smbw.patch -Requires: pam >= 0.64 kernel >= 2.2.1 glibc >= 2.1.2 -Prereq: chkconfig fileutils -BuildRoot: /var/tmp/samba -Prefix: /usr - -%package debugtools -Version: PVERSION -Release: PRELEASE -Group: Networking -Summary: Programs to debug Samba and to test SMB client integrity - -%package -n smbfs -Version: PVERSION -Release: PRELEASE -Group: Utilities/File -Summary: Programs to mount SMB shares. - -%description -Samba provides an SMB server which can be used to provide -network services to SMB (sometimes called "Lan Manager") -clients, including various versions of MS Windows, OS/2, -and other Linux machines. Samba also provides some SMB -clients, which complement the built-in SMB filesystem -in Linux. Samba uses NetBIOS over TCP/IP (NetBT) protocols -and does NOT need NetBEUI (Microsoft Raw NetBIOS frame) -protocol. - -Samba-2.2 features working NT Domain Control capability and -includes the SWAT (Samba Web Administration Tool) that -allows samba's smb.conf file to be remotely managed using your -favourite web browser. For the time being this is being -enabled on TCP port 901 via inetd. - -Users are advised to use Samba-2.2 as a Windows NT4 -Domain Controller only on networks that do NOT have a Windows -NT Domain Controller. This release does NOT as yet have -Backup Domain control ability. - -Please refer to the WHATSNEW.txt document for fixup information. -This binary release includes encrypted password support. - -Please read the smb.conf file and ENCRYPTION.txt in the -docs directory for implementation details. - -NOTE: TurboLinux uses PAM which has integrated support -for Shadow passwords and quotas. Do NOT recompile with the -SHADOW_PWD option enabled. - - -%description -n smbfs -This package includes the tools necessary to mount filesystems from -SMB servers. - -Smbmount and smbumount are an interface to the SMB filesystem. Smbfs is -a filesystem which understands the SMB protocol. This is the protocol -Windows for Workgroups, Windows NT or Lan Manager use to talk to each -other. It was inspired by samba, the program by Andrew Tridgell that -turns any unix site into a file server for DOS or Windows clients. See -http://samba.org/samba for this interesting program suite and lots of -more information on SMB and NetBIOS over TCP/IP. There you also find -explanation for conceps like NetBIOS name or share. - -%changelog -* Tue Mar 27 2001 John H Terpstra -- Fixes to make 2.2 compile - -* Sat Nov 04 2000 John H Terpstra -- Put Symlink for libnss_wins.so back into main install section - -* Fri Nov 3 2000 Uros Prestor -- ported to IA-64 - -* Mon Oct 09 2000 John H Terpstra -- Started move to Samba-2.2.0 -- Added nsswitch wins support - -* Mon May 29 2000 John H Terpstra -- moved linkage of libnss_wins.so.2 to %post -- added removal step to %postun - -* Fri Apr 14 2000 John H Terpstra -- Added unicode pages - -* Sat Apr 08 2000 John H Terpsta -- Added nsswitch stuff -- Fixed some typos -- Changed hard link for smbmount to symlink - -* Sun Apr 02 2000 John H Terpstra -- Updated for samba-2.0.7 -- Added codepages 775 1251 -- Added configure options "--with-profile --with-utmp - --with-netatalk --with-sambabook=/usr/share/swat/using_samba" -- added using_samba book - -* Fri Oct 29 1999 Kelley Spoon -- get rid of the rc?.d directories -- -j flags for make command to (hopefully) speed up on - SMP systems -- discoverd that John had already made the changes I - was going to do... -- Wait! He forgot to move the man pages into /usr/share! - Cool... I get to do something substantial. - -* Sun Oct 16 1999 John H Terspstra -- changed mount.smb to link to smbmount -- removed smbwrappers as it is broken with glibc-2.1.x - -* Sun May 09 1999 John H Terpstra -- Added smbtorture et al. - -* Wed Mar 10 1999 Scott Stone -- This package now builds smbfs stuff -- Added xinetd autosetup in the post install section -- (todo: add remove of xinetd stuff in postuninstall section) - -* Sun Feb 28 1999 Jeremy Allison - - Removed smbrun binary and tidied up some loose ends - -* Sun Oct 25 1998 John H Terpstra - - Added modifier to /config specifier so that smb.conf, - lmhosts and smbusers never get lost - -* Sat Oct 24 1998 John H Terpstra - - removed README.smbsh file from docs area - -* Mon Oct 05 1998 John H Terpstra - - Added rpcclient to binaries list - - Added smbwrapper stuff - -* Fri Aug 21 1998 John H Terpstra - - Updated for Samba version 2.0 building - -* Tue Jul 07 1998 Erik Troan - - updated postun triggerscript to check $0 - - clear /etc/codepages from %preun instead of %postun - -* Sat Jul 04 1998 John H Terpstra - - fixed codepage preservation during update via -Uvh - -* Mon Jun 08 1998 Erik Troan - - made the %postun script a tad less agressive; no reason to remove - the logs or lock file - - the %postun and %preun should only exectute if this is the final - removal - - migrated %triggerpostun from Red Hat's samba package to work around - packaging problems in some Red Hat samba releases - -* Sun Apr 26 1998 John H Terpstra - - Tidy up for early alpha releases - - added findsmb from SGI packaging - -* Thu Apr 09 1998 John H Terpstra - - Updated spec file - - Included new codepage.936 - -* Sat Mar 20 1998 John H Terpstra - - Added swat facility - -* Sat Jan 24 1998 John H Terpstra - - Many optimisations (some suggested by Manoj Kasichainula - - Use of chkconfig in place of individual symlinks to /etc/rc.d/init/smb - - Compounded make line - - Updated smb.init restart mechanism - - Use compound mkdir -p line instead of individual calls to mkdir - - Fixed smb.conf file path for log files - - Fixed smb.conf file path for incoming smb print spool directory - - Added a number of options to smb.conf file - - Added smbadduser command (missed from all previous RPMs) - Doooh! - - Added smbuser file and smb.conf file updates for username map - -%prep -%setup -%patch -p1 - - -%build -cd source - -%ifarch ia64 -libtoolize --copy --force # get it to recognize IA-64 -%endif - -autoconf -autoheader -NUMCPU=`grep processor /proc/cpuinfo | wc -l` -CFLAGS="$RPM_OPT_FLAGS $EXTRA" ./configure \ - --prefix=%{prefix} \ - --libdir=/etc/samba \ - --with-lockdir=/var/lock/samba \ - --with-privatedir=/etc \ - --with-swatdir=%{prefix}/share/swat \ - --with-quotas \ - --with-smbmount \ - --with-pam \ - --with-pam_smbpass \ - --with-profile \ - --with-syslog \ - --with-utmp \ - --with-netatalk \ - --with-sambabook=%{prefix}/share/swat/using_samba - -make -j${NUMCPU} all smbfilter nsswitch/libnss_wins.so -make -j${NUMCPU} debug2html - - -%install -rm -rf $RPM_BUILD_ROOT -mkdir -p $RPM_BUILD_ROOT/sbin -mkdir -p $RPM_BUILD_ROOT%{prefix}/share/samba/codepages/src -mkdir -p $RPM_BUILD_ROOT/etc/samba -mkdir -p $RPM_BUILD_ROOT/etc/{logrotate.d,pam.d} -mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d -mkdir -p $RPM_BUILD_ROOT/lib -mkdir -p $RPM_BUILD_ROOT/home/samba -mkdir -p $RPM_BUILD_ROOT%{prefix}/{bin,sbin} -mkdir -p $RPM_BUILD_ROOT%{prefix}/share/swat/using_samba/{gifs,figs} -mkdir -p $RPM_BUILD_ROOT%{prefix}/share/swat/{images,help,include} -mkdir -p $RPM_BUILD_ROOT%{prefix}/share/man/{man1,man5,man7,man8} -mkdir -p $RPM_BUILD_ROOT/var/lock/samba -mkdir -p $RPM_BUILD_ROOT/var/log/samba -mkdir -p $RPM_BUILD_ROOT/var/spool/samba - -# Install standard binary files -for i in nmblookup smbclient smbpasswd smbstatus testparm testprns \ - make_smbcodepage make_unicodemap make_printerdef rpcclient smbspool -do -install -m755 -s source/bin/$i $RPM_BUILD_ROOT%{prefix}/bin -done -for i in mksmbpasswd.sh smbtar -do -install -m755 source/script/$i $RPM_BUILD_ROOT%{prefix}/bin -done - -# Install secure binary files -for i in smbd nmbd swat smbmount smbumount smbmnt debug2html smbfilter -do -install -m755 -s source/bin/$i $RPM_BUILD_ROOT/usr/sbin -done - - -# Install level 1 man pages -for i in *.1 -do -install -m644 docs/manpages/$i $RPM_BUILD_ROOT%{prefix}/share/man/man1 -done - -# Install codepage source files -for i in 437 737 775 850 852 861 866 932 936 949 950 1251 -do -install -m644 source/codepages/codepage_def.$i $RPM_BUILD_ROOT%{prefix}/samba/codepages/src -done -for i in 437 737 850 852 861 866 932 936 949 950 ISO8859-1 ISO8859-2 ISO8859-5 ISO8859-7 KOI8-R -do -install -m644 source/codepages/CP$i.TXT $RPM_BUILD_ROO%{prefix}/samba/codepages/src -done - -# Install the nsswitch library extension file -install -m755 source/nsswitch/libnss_wins.so $RPM_BUILD_ROOT/lib -# Make link for wins resolver -( cd $RPM_BUILD_ROOT/lib; ln -s libnss_wins.so libnss_wins.so.2; ) - -# Install PAM pam_smbpass.so -install -m644 source/bin/pam_smbpass.so $RPM_BUILD_ROOT/lib/security - -# Install SWAT helper files -for i in swat/help/*.html docs/htmldocs/*.html -do -install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/help -done -for i in swat/images/*.gif -do -install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/images -done -for i in swat/include/*.html -do -install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/include -done - -# This is the O'Reily Samba Book - on-line -for i in docs/htmldocs/using_samba/*.html -do -install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/using_samba -done -for i in docs/htmldocs/using_samba/figs/*.gif -do -install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/using_samba/figs -done -for i in docs/htmldocs/using_samba/gifs/*.gif -do -install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/using_samba/gifs -done - -# Install the miscellany -install -m644 swat/README $RPM_BUILD_ROOT%{prefix}/share/swat -install -m644 docs/manpages/smb.conf.5 $RPM_BUILD_ROOT%{prefix}/share/man/man5 -install -m644 docs/manpages/lmhosts.5 $RPM_BUILD_ROOT%{prefix}/share/man/man5 -install -m644 docs/manpages/smbpasswd.5 $RPM_BUILD_ROOT%{prefix}/share/man/man5 -install -m644 docs/manpages/samba.7 $RPM_BUILD_ROOT%{prefix}/share/man/man7 -install -m644 docs/manpages/smbd.8 $RPM_BUILD_ROOT%{prefix}/share/man/man8 -install -m644 docs/manpages/nmbd.8 $RPM_BUILD_ROOT%{prefix}/share/man/man8 -install -m644 docs/manpages/smbpasswd.8 $RPM_BUILD_ROOT%{prefix}/share/man/man8 -install -m644 docs/manpages/swat.8 $RPM_BUILD_ROOT%{prefix}/share/man/man8 -install -m644 docs/manpages/smbmount.8 $RPM_BUILD_ROOT%{prefix}/share/man/man8 -install -m644 docs/manpages/smbmnt.8 $RPM_BUILD_ROOT%{prefix}/share/man/man8 -install -m644 docs/manpages/smbumount.8 $RPM_BUILD_ROOT%{prefix}/share/man/man8 -install -m644 packaging/PHT/TurboLinux/smb.conf $RPM_BUILD_ROOT/etc/samba/smb.conf -install -m644 packaging/PHT/TurboLinux/smbusers $RPM_BUILD_ROOT/etc/samba/smbusers -install -m755 packaging/PHT/TurboLinux/smbprint $RPM_BUILD_ROOT%{prefix}/bin -install -m755 packaging/PHT/TurboLinux/findsmb $RPM_BUILD_ROOT%{prefix}/bin -install -m755 packaging/PHT/TurboLinux/smb.init $RPM_BUILD_ROOT/etc/rc.d/init.d/smb -install -m755 packaging/PHT/TurboLinux/smb.init $RPM_BUILD_ROOT%{prefix}/sbin/samba -install -m644 packaging/PHT/TurboLinux/samba.pamd $RPM_BUILD_ROOT/etc/pam.d/samba -install -m644 packaging/PHT/TurboLinux/samba.log $RPM_BUILD_ROOT/etc/logrotate.d/samba -echo 127.0.0.1 localhost > $RPM_BUILD_ROOT/etc/lmhosts - -# Link smbmount to /sbin/mount.smb and /sbin/mount.smbfs -ln -sf %{prefix}/sbin/smbmount $RPM_BUILD_ROOT/sbin/mount.smb -ln -sf %{prefix}/sbin/smbmount $RPM_BUILD_ROOT/sbin/mount.smbfs - -%clean -rm -rf $RPM_BUILD_ROOT - -%post -/sbin/chkconfig --add smb -/sbin/chkconfig smb off - -# Build codepage load files -cd %{prefix}/share/samba -for i in 437 737 775 850 852 861 866 932 936 949 950 1251 -do -%{prefix}/bin/make_smbcodepage c $i %{prefix}/share/samba/codepages/src/codepage_def.$i %{prefix}/share/samba/codepages/codepage.$i -done -for i in 437 737 850 852 861 866 932 936 949 950 ISO8859-1 ISO8859-2 ISO8859-5 ISO8859-7 KOI8-R -do -%{prefix}/bin/make_unicodemap $i %{prefix}/share/samba/codepages/src/CP$i.TXT %{prefix}/share/samba/codepages/unicode_map.$i -done - -# Add swat entry to /etc/services if not already there -if !( grep ^[:space:]*swat /etc/services > /dev/null ) then - echo 'swat 901/tcp # Add swat service used via inetd' >> /etc/services -fi - -# Add swat entry to /etc/inetd.conf if needed -if !( grep ^[:space:]*swat /etc/inetd.conf > /dev/null ) then - echo '#swat stream tcp nowait.400 root %{prefix}/sbin/swat swat' >> /etc/inetd.conf - killall -1 inetd || : -fi - -# Now create the xinetd.conf file from our inetd.conf file, back up orig first. -if [ -f /etc/xinetd.conf ]; then - mv /etc/xinetd.conf /etc/xinetd.conf.presamba - /usr/sbin/itox --daemon_dir /usr/sbin < /etc/inetd.conf > /etc/xinetd.conf -fi - - -%preun -if [ $1 = 0 ] ; then - /sbin/chkconfig --del smb - - for n in %{prefix}/share/samba/codepages/*; do - if [ $n != %{prefix}/share/samba/codepages/src ]; then - rm -rf $n - fi - done - # We want to remove the browse.dat and wins.dat files so they can not interfer with a new version of samba! - if [ -e /var/lock/samba/browse.dat ]; then - rm -f /var/lock/samba/browse.dat - fi - if [ -e /var/lock/samba/wins.dat ]; then - rm -f /var/lock/samba/wins.dat - fi -fi - -%postun -# Only delete remnants of samba if this is the final deletion. -if [ $1 = 0 ] ; then - if [ -x /etc/pam.d/samba ]; then - rm -f /etc/pam.d/samba - fi - if [ -e /var/log/samba ]; then - rm -rf /var/log/samba - fi - -# Note: We MUST keep: -# winbindd_*, sshare_info*, printing*, ntdrivers* - - if [ -x /var/lock/samba ]; then - rm -f /var/lock/samba/browse.dat - rm -f /var/lock/samba/{brlock,connections,locking,messages}.tdb - if [ -e /var/lock/samba.d/namelist.debug ]; then - rm -f /var/lock/samba.d/namelist.debug - fi - rm -f /var/lock/samba/unexpected.tdb - rm -f /var/lock/samba/{smbd,nmbd}.pid - fi - - # Remove swat entries from /etc/inetd.conf and /etc/services - cd /etc - tmpfile=/etc/tmp.$$ - sed -e '/^[:space:]*swat.*$/d' /etc/inetd.conf > $tmpfile - mv $tmpfile inetd.conf - sed -e '/#swat.*$/d' /etc/inetd.conf > $tmpfile - mv $tmpfile inetd.conf - sed -e '/^[:space:]*swat.*$/d' /etc/services > $tmpfile - mv $tmpfile services - - # Recreate xinetd.conf file from /etc/inetd.conf - mv /etc/xinetd.conf /etc/xinetd.conf.samba - /usr/sbin/itox --daemon_dir /usr/sbin < /etc/inetd.conf > /etc/xinetd.conf -fi - - -%triggerpostun -- samba < samba-2.0.0 -if [ $0 != 0 ]; then - /sbin/chkconfig --add smb -fi - - -%files -%doc README COPYING Manifest Read-Manifest-Now -%doc WHATSNEW.txt Roadmap -%doc docs -%doc swat/README -%doc examples -%attr(-,root,root) %{prefix}/sbin/smbd -%attr(-,root,root) %{prefix}/sbin/nmbd -%attr(-,root,root) %{prefix}/sbin/swat -%attr(-,root,root) %{prefix}/sbin/debug2html -%attr(0750,root,root) %{prefix}/sbin/samba -%attr(-,root,root) %{prefix}/bin/smbclient -%attr(-,root,root) %{prefix}/bin/rpcclient -%attr(-,root,root) %{prefix}/bin/testparm -%attr(-,root,root) %{prefix}/bin/testprns -%attr(-,root,root) %{prefix}/bin/findsmb -%attr(-,root,root) %{prefix}/bin/smbstatus -%attr(-,root,root) %{prefix}/bin/nmblookup -%attr(-,root,root) %{prefix}/bin/make_smbcodepage -%attr(-,root,root) %{prefix}/bin/make_unicodemap -%attr(-,root,root) %{prefix}/bin/make_printerdef -%attr(-,root,root) %{prefix}/bin/smbpasswd -%attr(-,root,root) %{prefix}/bin/smbtar -%attr(-,root,root) %{prefix}/bin/smbprint -%attr(-,root,root) %{prefix}/bin/smbspool -%attr(-,root,root) %{prefix}/bin/smbadduser -%attr(755,root,root) /lib/libnss_wins.s* -%attr(755,root,root) /lib/security/pam_smbpass.so -%attr(-,root,root) %{prefix}/share/swat/help/* -%attr(-,root,root) %{prefix}/share/swat/images/* -%attr(-,root,root) %{prefix}/share/swat/include/header.html -%attr(-,root,root) %{prefix}/share/swat/include/footer.html -%attr(-,root,root) %{prefix}/share/swat/using_samba/* -%attr(-,root,root) %config(noreplace) /etc/samba/lmhosts -%attr(-,root,root) %config(noreplace) /etc/samba/smb.conf -%attr(-,root,root) %config(noreplace) /etc/samba/smbusers -%attr(-,root,root) /etc/rc.d/init.d/smb -%attr(-,root,root) /etc/logrotate.d/samba -%attr(-,root,root) /etc/pam.d/samba -%attr(-,root,root) %{prefix}/share/samba/codepages/src/codepage_def.* -%attr(-,root,root) %{prefix}/share/samba/codepages/src/CP* -# %attr(-,root,root) %{prefix}/share/man/man1/smbsh.1 -%attr(-,root,root) %{prefix}/share/man/man1/make_smbcodepage.1 -%attr(-,root,root) %{prefix}/share/man/man1/make_unicodemap.1 -%attr(-,root,root) %{prefix}/share/man/man1/nmblookup.1 -%attr(-,root,root) %{prefix}/share/man/man1/smbclient.1 -%attr(-,root,root) %{prefix}/share/man/man1/smbrun.1 -%attr(-,root,root) %{prefix}/share/man/man1/smbstatus.1 -%attr(-,root,root) %{prefix}/share/man/man1/smbtar.1 -%attr(-,root,root) %{prefix}/share/man/man1/testparm.1 -%attr(-,root,root) %{prefix}/share/man/man1/testprns.1 -%attr(-,root,root) %{prefix}/share/man/man5/lmhosts.5 -%attr(-,root,root) %{prefix}/share/man/man5/smb.conf.5 -%attr(-,root,root) %{prefix}/share/man/man5/smbpasswd.5 -%attr(-,root,root) %{prefix}/share/man/man7/samba.7 -%attr(-,root,root) %{prefix}/share/man/man8/nmbd.8 -%attr(-,root,root) %{prefix}/share/man/man8/smbd.8 -%attr(-,root,root) %{prefix}/share/man/man8/smbpasswd.8 -%attr(-,root,root) %{prefix}/share/man/man8/swat.8 -%attr(-,root,nobody) %dir /home/samba -%attr(-,root,root) %dir %{prefix}/share/samba/codepages -%attr(-,root,root) %dir %{prefix}/share/samba/codepages/src -%attr(-,root,root) %dir /var/lock/samba -%attr(-,root,root) %dir /var/log/samba -%attr(1777,root,root) %dir /var/spool/samba - -%files -n smbfs -%attr(-,root,root) %{prefix}/sbin/smbmount -%attr(-,root,root) %{prefix}/sbin/smbumount -%attr(-,root,root) %{prefix}/sbin/smbmnt -%attr(-,root,root) /sbin/mount.smb -%attr(-,root,root) /sbin/mount.smbfs -%attr(-,root,root) %{prefix}/share/man/man8/smbmnt.8 -%attr(-,root,root) %{prefix}/share/man/man8/smbmount.8 -%attr(-,root,root) %{prefix}/share/man/man8/smbumount.8 diff --git a/packaging/PHT/TurboLinux/smb.conf b/packaging/PHT/TurboLinux/smb.conf deleted file mode 100644 index e07d15c93e..0000000000 --- a/packaging/PHT/TurboLinux/smb.conf +++ /dev/null @@ -1,291 +0,0 @@ -# This is the main Samba configuration file. You should read the -# smb.conf(5) manual page in order to understand the options listed -# here. Samba has a huge number of configurable options (perhaps too -# many!) most of which are not shown in this example -# -# Any line which starts with a ; (semi-colon) or a # (hash) -# is a comment and is ignored. In this example we will use a # -# for commentry and a ; for parts of the config file that you -# may wish to enable -# -# NOTE: Whenever you modify this file you should run the command "testparm" -# to check that you have not many any basic syntactic errors. -# -#======================= Global Settings ===================================== -[global] - -# workgroup = NT-Domain-Name or Workgroup-Name - workgroup = MYGROUP - -# server string is the equivalent of the NT Description field - server string = Samba Server - -# This option is important for security. It allows you to restrict -# connections to machines which are on your local network. The -# following example restricts access to two C class networks and -# the "loopback" interface. For more examples of the syntax see -# the smb.conf man page -; hosts allow = 192.168.1. 192.168.2. 127. - -# if you want to automatically load your printer list rather -# than setting them up individually then you'll need this - printcap name = /etc/printcap - load printers = yes - -# It should not be necessary to spell out the print system type unless -# yours is non-standard. Currently supported print systems include: -# bsd, sysv, plp, lprng, aix, hpux, qnx -; printing = bsd - -# Uncomment this if you want a guest account, you must add this to /etc/passwd -# otherwise the user "nobody" is used -; guest account = pcguest - -# this tells Samba to use a separate log file for each machine -# that connects - log file = /var/log/samba/log.%m - -# Put a capping on the size of the log files (in Kb). - max log size = 50 - -# Security mode. Most people will want user level security. See -# security_level.txt for details. - security = user -# Use password server option only with security = server -; password server = - -# Password Level allows matching of _n_ characters of the password for -# all combinations of upper and lower case. -; password level = 8 -; username level = 8 - -# You may wish to use password encryption. Please read -# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation. -# Do not enable this option unless you have read those documents -; encrypt passwords = yes -; smb passwd file = /etc/smbpasswd - -# The following are needed to allow password changing from Windows to -# update the Linux sytsem password also. -# NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above. -# NOTE2: You do NOT need these to allow workstations to change only -# the encrypted SMB passwords. They allow the Unix password -# to be kept in sync with the SMB password. -; unix password sync = Yes -; passwd program = /usr/bin/passwd %u -; passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* %n\n *passwd:*all*authentication*tokens*updated*successfully* - -# Unix users can map to different SMB User names -; username map = /etc/smbusers - -# Using the following line enables you to customise your configuration -# on a per machine basis. The %m gets replaced with the netbios name -# of the machine that is connecting -; include = /etc/smb.conf.%m - -# Most people will find that this option gives better performance. -# See speed.txt and the manual pages for details - socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 - -# Configure Samba to use multiple interfaces -# If you have multiple network interfaces then you must list them -# here. See the man page for details. -; interfaces = 192.168.12.2/24 192.168.13.2/24 - -# Configure remote browse list synchronisation here -# request announcement to, or browse list sync from: -# a specific host or from / to a whole subnet (see below) -; remote browse sync = 192.168.3.25 192.168.5.255 -# Cause this host to announce itself to local subnets here -; remote announce = 192.168.1.255 192.168.2.44 - -# Browser Control Options: -# set local master to no if you don't want Samba to become a master -# browser on your network. Otherwise the normal election rules apply -; local master = no - -# OS Level determines the precedence of this server in master browser -# elections. The default value should be reasonable -; os level = 33 - -# Domain Master specifies Samba to be the Domain Master Browser. This -# allows Samba to collate browse lists between subnets. Don't use this -# if you already have a Windows NT domain controller doing this job -; domain master = yes - -# Preferred Master causes Samba to force a local browser election on startup -# and gives it a slightly higher chance of winning the election -; preferred master = yes - -# Use only if you have an NT server on your network that has been -# configured at install time to be a primary domain controller. -; domain controller = - -# Enable this if you want Samba to be a domain logon server for -# Windows95 workstations. -; domain logons = yes - -# if you enable domain logons then you may want a per-machine or -# per user logon script -# run a specific logon batch file per workstation (machine) -; logon script = %m.bat -# run a specific logon batch file per username -; logon script = %U.bat - -# Where to store roving profiles (only for Win95 and WinNT) -# %L substitutes for this servers netbios name, %U is username -# You must uncomment the [Profiles] share below -; logon path = \\%L\Profiles\%U - -# All NetBIOS names must be resolved to IP Addresses -# 'Name Resolve Order' allows the named resolution mechanism to be specified -# the default order is "host lmhosts wins bcast". "host" means use the unix -# system gethostbyname() function call that will use either /etc/hosts OR -# DNS or NIS depending on the settings of /etc/host.config, /etc/nsswitch.conf -# and the /etc/resolv.conf file. "host" therefore is system configuration -# dependant. This parameter is most often of use to prevent DNS lookups -# in order to resolve NetBIOS names to IP Addresses. Use with care! -# The example below excludes use of name resolution for machines that are NOT -# on the local network segment -# - OR - are not deliberately to be known via lmhosts or via WINS. -; name resolve order = wins lmhosts bcast - -# Windows Internet Name Serving Support Section: -# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server -; wins support = yes - -# WINS Server - Tells the NMBD components of Samba to be a WINS Client -# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both -; wins server = w.x.y.z - -# WINS Proxy - Tells Samba to answer name resolution queries on -# behalf of a non WINS capable client, for this to work there must be -# at least one WINS Server on the network. The default is NO. -; wins proxy = yes - -# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names -# via DNS nslookups. The built-in default for versions 1.9.17 is yes, -# this has been changed in version 1.9.18 to no. - dns proxy = no - -# Case Preservation can be handy - system default is _no_ -# NOTE: These can be set on a per share basis -; preserve case = no -; short preserve case = no -# Default case is normally upper case for all DOS files -; default case = lower -# Be very careful with case sensitivity - it can break things! -; case sensitive = no - -#============================ Share Definitions ============================== -[homes] - comment = Home Directories - browseable = no - writable = yes - -# Un-comment the following and create the netlogon directory for Domain Logons -; [netlogon] -; comment = Network Logon Service -; path = /home/netlogon -; guest ok = yes -; writable = no -; share modes = no - - -# Un-comment the following to provide a specific roving profile share -# the default is to use the user's home directory -;[Profiles] -; path = /home/profiles -; browseable = no -; guest ok = yes - - -# NOTE: If you have a BSD-style print system there is no need to -# specifically define each individual printer -[printers] - comment = All Printers - path = /var/spool/samba - browseable = no -# Set public = yes to allow user 'guest account' to print - guest ok = no - writable = no - printable = yes - -# This one is useful for people to share files -;[tmp] -; comment = Temporary file space -; path = /tmp -; read only = no -; public = yes - -# A publicly accessible directory, but read only, except for people in -# the "staff" group -;[public] -; comment = Public Stuff -; path = /home/samba -; public = yes -; writable = yes -; printable = no -; write list = @staff - -# Other examples. -# -# A private printer, usable only by fred. Spool data will be placed in fred's -# home directory. Note that fred must have write access to the spool directory, -# wherever it is. -;[fredsprn] -; comment = Fred's Printer -; valid users = fred -; path = /homes/fred -; printer = freds_printer -; public = no -; writable = no -; printable = yes - -# A private directory, usable only by fred. Note that fred requires write -# access to the directory. -;[fredsdir] -; comment = Fred's Service -; path = /usr/somewhere/private -; valid users = fred -; public = no -; writable = yes -; printable = no - -# a service which has a different directory for each machine that connects -# this allows you to tailor configurations to incoming machines. You could -# also use the %u option to tailor it by user name. -# The %m gets replaced with the machine name that is connecting. -;[pchome] -; comment = PC Directories -; path = /usr/pc/%m -; public = no -; writable = yes - -# A publicly accessible directory, read/write to all users. Note that all files -# created in the directory by users will be owned by the default user, so -# any user with access can delete any other user's files. Obviously this -# directory must be writable by the default user. Another user could of course -# be specified, in which case all files would be owned by that user instead. -;[public] -; path = /usr/somewhere/else/public -; public = yes -; only guest = yes -; writable = yes -; printable = no - -# The following two entries demonstrate how to share a directory so that two -# users can place files there that will be owned by the specific users. In this -# setup, the directory should be writable by both users and should have the -# sticky bit set on it to prevent abuse. Obviously this could be extended to -# as many users as required. -;[myshare] -; comment = Mary's and Fred's stuff -; path = /usr/somewhere/shared -; valid users = mary fred -; public = no -; writable = yes -; printable = no -; create mask = 0765 - - diff --git a/packaging/PHT/TurboLinux/smb.init b/packaging/PHT/TurboLinux/smb.init deleted file mode 100755 index 6529977d23..0000000000 --- a/packaging/PHT/TurboLinux/smb.init +++ /dev/null @@ -1,49 +0,0 @@ -#!/bin/sh -# -# chkconfig: 345 91 35 -# description: Starts and stops the Samba smbd and nmbd daemons \ -# used to provide SMB network services. - -# Source function library. -. /etc/rc.d/init.d/functions - -# Source networking configuration. -. /etc/sysconfig/network - -# Check that networking is up. -[ ${NETWORKING} = "no" ] && exit 0 - -# Check that smb.conf exists. -[ -f /etc/smb.conf ] || exit 0 - -# See how we were called. -case "$1" in - start) - echo -n "Starting SMB services: " - daemon smbd -D - daemon nmbd -D - echo - touch /var/lock/subsys/smb - ;; - stop) - echo -n "Shutting down SMB services: " - killproc smbd - killproc nmbd - rm -f /var/lock/subsys/smb - echo "" - ;; - status) - status smbd - status nmbd - ;; - restart) - echo -n "Restarting SMB services: " - $0 stop - $0 start - echo "done." - ;; - *) - echo "Usage: smb {start|stop|restart|status}" - exit 1 -esac - diff --git a/packaging/PHT/TurboLinux/smbadduser b/packaging/PHT/TurboLinux/smbadduser deleted file mode 100755 index 2f38bf28f1..0000000000 --- a/packaging/PHT/TurboLinux/smbadduser +++ /dev/null @@ -1,73 +0,0 @@ -#!/bin/csh -# -# smbadduser - Written by Mike Zakharoff -# -unalias * -set path = ($path) - -set smbpasswd = /etc/smbpasswd -set user_map = /etc/smbusers -# -# Set to site specific passwd command -# -set passwd = "cat /etc/passwd" -#set passwd = "niscat passwd.org_dir" -#set passwd = "ypcat passwd" - -set line = "----------------------------------------------------------" -if ($#argv == 0) then - echo $line - echo "Written: Mike Zakharoff email: michael.j.zakharoff@boeing.com" - echo "" - echo " 1) Updates $smbpasswd" - echo " 2) Updates $user_map" - echo " 3) Executes smbpasswd for each new user" - echo "" - echo "smbadduser unixid:ntid unixid:ntid ..." - echo "" - echo "Example: smbadduser zak:zakharoffm johns:smithj" - echo $line - exit 1 -endif - -touch $smbpasswd $user_map -set new = () -foreach one ($argv) - echo $one | grep ':' >& /dev/null - if ($status != 0) then - echo "ERROR: Must use unixid:ntid like -> zak:zakharoffm" - continue - endif - set unix = `echo $one | awk -F: '{print $1}'` - set ntid = `echo $one | awk -F: '{print $2}'` - - set usr = `eval $passwd | awk -F: '$1==USR {print $1}' USR=$unix` - if ($#usr != 1) then - echo "ERROR: $unix Not in passwd database SKIPPING..." - continue - endif - set tmp = `cat $smbpasswd | awk -F: '$1==USR {print $1}' USR=$unix` - if ($#tmp != 0) then - echo "ERROR: $unix is already in $smbpasswd SKIPPING..." - continue - endif - - echo "Adding: $unix to $smbpasswd" - eval $passwd | \ - awk -F: '$1==USR { \ - printf( "%s:%s:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:%s:%s:%s\n", $1, $3, $5, $6, $7) }' USR=$unix >> $smbpasswd - if ($unix != $ntid) then - echo "Adding: {$unix = $ntid} to $user_map" - echo "$unix = $ntid" >> $user_map - endif - set new = ($new $unix) -end - -# -# Enter password for new users -# -foreach one ($new) - echo $line - echo "ENTER password for $one" - smbpasswd $one -end diff --git a/packaging/PHT/TurboLinux/smbprint b/packaging/PHT/TurboLinux/smbprint deleted file mode 100755 index ec083eede6..0000000000 --- a/packaging/PHT/TurboLinux/smbprint +++ /dev/null @@ -1,77 +0,0 @@ -#!/bin/sh - -# This script is an input filter for printcap printing on a unix machine. It -# uses the smbclient program to print the file to the specified smb-based -# server and service. -# For example you could have a printcap entry like this -# -# smb:lp=/dev/null:sd=/usr/spool/smb:sh:if=/usr/local/samba/smbprint -# -# which would create a unix printer called "smb" that will print via this -# script. You will need to create the spool directory /usr/spool/smb with -# appropriate permissions and ownerships for your system. - -# Set these to the server and service you wish to print to -# In this example I have a WfWg PC called "lapland" that has a printer -# exported called "printer" with no password. - -# -# Script further altered by hamiltom@ecnz.co.nz (Michael Hamilton) -# so that the server, service, and password can be read from -# a /var/spool/lpd/PRINTNAME/.config file. -# -# In order for this to work the /etc/printcap entry must include an -# accounting file (af=...): -# -# cdcolour:\ -# :cm=CD IBM Colorjet on 6th:\ -# :sd=/var/spool/lpd/cdcolour:\ -# :af=/var/spool/lpd/cdcolour/acct:\ -# :if=/usr/local/etc/smbprint:\ -# :mx=0:\ -# :lp=/dev/null: -# -# The /usr/var/spool/lpd/PRINTNAME/.config file should contain: -# server=PC_SERVER -# service=PR_SHARENAME -# password="password" -# -# E.g. -# server=PAULS_PC -# service=CJET_371 -# password="" - -# -# Debugging log file, change to /dev/null if you like. -# -# logfile=/tmp/smb-print.log -logfile=/dev/null - - -# -# The last parameter to the filter is the accounting file name. -# Extract the directory name from the file name. -# Concat this with /.config to get the config file. -# -eval acct_file=\${$#} -spool_dir=`dirname $acct_file` -config_file=$spool_dir/.config - -# Should read the following variables set in the config file: -# server -# service -# password -eval `cat $config_file` - -# -# Some debugging help, change the >> to > if you want to same space. -# -echo "server $server, service $service" >> $logfile - -( -# NOTE You may wish to add the line `echo translate' if you want automatic -# CR/LF translation when printing. -# echo translate - echo "print -" - cat -) | /usr/bin/smbclient "\\\\$server\\$service" $password -U $server -N -P >> $logfile diff --git a/packaging/PHT/TurboLinux/smbusers b/packaging/PHT/TurboLinux/smbusers deleted file mode 100644 index ae3389f53f..0000000000 --- a/packaging/PHT/TurboLinux/smbusers +++ /dev/null @@ -1,3 +0,0 @@ -# Unix_name = SMB_name1 SMB_name2 ... -root = administrator admin -nobody = guest pcguest smbguest diff --git a/packaging/PHT/TurboLinux/smbw.patch b/packaging/PHT/TurboLinux/smbw.patch deleted file mode 100644 index 0abbfdf73f..0000000000 --- a/packaging/PHT/TurboLinux/smbw.patch +++ /dev/null @@ -1,10 +0,0 @@ ---- samba-2.0.0/source/smbwrapper/smbsh.in.orig Mon Oct 5 22:37:01 1998 -+++ samba-2.0.0/source/smbwrapper/smbsh.in Mon Oct 5 22:37:51 1998 -@@ -1,6 +1,6 @@ - #! /bin/sh - --SMBW_LIBDIR=${SMBW_LIBDIR-@builddir@/smbwrapper} -+SMBW_LIBDIR=${SMBW_LIBDIR-/usr/bin} - - if [ ! -f ${SMBW_LIBDIR}/smbwrapper.so ]; then - echo You need to set LIBDIR in smbsh -- cgit From 9d2a516f0617747d4af2bbe9667c71766da2b7f4 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 03:45:18 +0000 Subject: removing unneeded files (This used to be commit b2a36ae3967591296e755b3e7a85a851ba382608) --- packaging/SuSE/5.2/samba-1.9.18p5.dif | 234 ------------------ packaging/SuSE/5.2/samba.spec | 119 ---------- packaging/SuSE/7.1/samba-2.2.0-alpha0.dif | 224 ------------------ packaging/SuSE/7.1/samba.pamd | 3 - packaging/SuSE/7.1/samba.spec | 381 ------------------------------ packaging/SuSE/samba-3.0.0-msdfs.diff | 97 -------- packaging/SuSE/samba-3.0.0-net_ads.diff | 140 ----------- packaging/SuSE/samba-3.0.0-pdb.diff | 11 - packaging/SuSE/samba-3.0.0-python.diff | 44 ---- packaging/SuSE/samba-3.0.0-vscan.diff | 80 ------- packaging/SuSE/samba-vscan-0.3.1.tar.bz2 | Bin 51383 -> 0 bytes 11 files changed, 1333 deletions(-) delete mode 100644 packaging/SuSE/5.2/samba-1.9.18p5.dif delete mode 100644 packaging/SuSE/5.2/samba.spec delete mode 100644 packaging/SuSE/7.1/samba-2.2.0-alpha0.dif delete mode 100644 packaging/SuSE/7.1/samba.pamd delete mode 100644 packaging/SuSE/7.1/samba.spec delete mode 100644 packaging/SuSE/samba-3.0.0-msdfs.diff delete mode 100644 packaging/SuSE/samba-3.0.0-net_ads.diff delete mode 100644 packaging/SuSE/samba-3.0.0-pdb.diff delete mode 100644 packaging/SuSE/samba-3.0.0-python.diff delete mode 100644 packaging/SuSE/samba-3.0.0-vscan.diff delete mode 100644 packaging/SuSE/samba-vscan-0.3.1.tar.bz2 diff --git a/packaging/SuSE/5.2/samba-1.9.18p5.dif b/packaging/SuSE/5.2/samba-1.9.18p5.dif deleted file mode 100644 index 39b13f010d..0000000000 --- a/packaging/SuSE/5.2/samba-1.9.18p5.dif +++ /dev/null @@ -1,234 +0,0 @@ ---- Makefile.Linux -+++ Makefile.Linux 1998/05/06 15:58:42 -@@ -0,0 +1,35 @@ -+# -+# -+# Makefile.Linux to integrate package into source tree of S.u.S.E.-Linux -+# -+# Copyright (C) 1996 S.u.S.E. GmbH Fuerth, Germany. -+# -+# Please send bug-fixes or comments to feedback@suse.de. -+# -+# Author: Florian La Roche -+# Volker Lendecke -+# -+# -+ -+doc=/usr/doc/packages/samba -+ -+compile: -+ make -C source -+ -+install: -+ make install -C source -+ mkdir -p $(doc) -+ cp -a docs/* $(doc) -+ rm -rf $(doc)/*.[0-9] -+ cp -R examples $(doc) -+ chmod 644 `find $(doc) -type f` -+ chmod 755 `find $(doc) -type d` -+ install -m 644 smb.conf /etc/smb.conf -+ install rc /sbin/init.d/smb -+ install -m 755 source/mksmbpasswd.sh /usr/bin/mksmbpasswd.sh -+ ln -sf ../smb /sbin/init.d/rc2.d/S20smb -+ ln -sf ../smb /sbin/init.d/rc2.d/K20smb -+ ln -sf ../smb /sbin/init.d/rc3.d/S20smb -+ ln -sf ../smb /sbin/init.d/rc3.d/K20smb -+ mkdir -p /var/adm/fillup-templates -+ cp rc.config.samba /var/adm/fillup-templates ---- doinst.sh -+++ doinst.sh 1998/05/06 15:54:52 -@@ -0,0 +1,15 @@ -+# -+# install/doinst.sh - to be done after extraction -+# -+# Copyright (c) 1997 S.u.S.E. GmbH Fuerth, Germany. -+# -+# -+echo "Updating etc/rc.config..." -+if [ -x bin/fillup ] ; then -+ bin/fillup -q -d = etc/rc.config var/adm/fillup-templates/rc.config.samba -+else -+ echo "ERROR: fillup not found. This should not happen. Please compare" -+ echo "etc/rc.config and var/adm/fillup-templates/rc.config.samba and" -+ echo "update by hand." -+fi -+ ---- rc -+++ rc 1998/05/06 15:54:52 -@@ -0,0 +1,32 @@ -+#! /bin/sh -+# Copyright (c) 1996 StarDivision GmbH. All rights reserved. -+# Copyright (c) 1996 S.u.S.E. Gmbh Fuerth, Germany. All rights reserved. -+# -+# Author: Bastian Epting, StarDivision GmbH -+# Florian La Roche, -+# Volker Lendecke, -+# -+ -+. /etc/rc.config -+ -+test "$START_SMB" = "yes" || exit 0 -+ -+case "$1" in -+ start) -+ echo -n "Starting SMB services." -+ /usr/sbin/nmbd -D -+ /usr/sbin/smbd -D -+ echo -+ ;; -+ stop) -+ echo -n "Shutting down SMB services." -+ killproc -TERM /usr/sbin/nmbd -+ killproc -TERM /usr/sbin/smbd -+ echo -+ ;; -+ *) -+ echo "Usage: $0 {start|stop}" -+ exit 1 -+esac -+ -+exit 0 ---- rc.config.samba -+++ rc.config.samba 1998/05/06 15:54:52 -@@ -0,0 +1,5 @@ -+# -+# start samba? ("yes" or "no") -+# Windows 95 / NT - File- and Printservices -+# -+START_SMB="no" ---- smb.conf -+++ smb.conf 1998/05/06 15:54:52 -@@ -0,0 +1,48 @@ -+[global] -+ workgroup = arbeitsgruppe -+ guest account = nobody -+ keep alive = 30 -+ os level = 2 -+ security = user -+ printing = bsd -+ printcap name = /etc/printcap -+ load printers = yes -+ -+; Please uncomment the following entry and replace the -+; ip number and netmask with the correct numbers for -+; your ethernet interface. -+; interfaces = 192.168.1.1/255.255.255.0 -+ -+; If you want Samba to act as a wins server, please set -+; 'wins support = yes' -+ wins support = no -+ -+; If you want Samba to use an existing wins server, -+; please uncomment the following line and replace -+; the dummy with the wins server's ip number. -+; wins server = 192.168.1.1 -+ -+[homes] -+ comment = Heimatverzeichnis -+ browseable = no -+ read only = no -+ create mode = 0750 -+ -+; The following share gives all users access to the Server's CD drive, -+; assuming it is mounted under /cd. To enable this share, please remove -+; the semicolons before the lines -+; -+; [cdrom] -+; comment = Linux CD-ROM -+; path = /cd -+; read only = yes -+; locking = no -+ -+[printers] -+ comment = All Printers -+ browseable = no -+ printable = yes -+ public = no -+ read only = yes -+ create mode = 0700 -+ directory = /tmp ---- source/Makefile -+++ source/Makefile 1998/05/06 15:54:52 -@@ -5,11 +5,11 @@ - ########################################################################### - - # The base directory for all samba files --BASEDIR = /usr/local/samba -+BASEDIR = /usr - - # The base manpages directory to put the man pages in - # Note: $(MANDIR)/man1, $(MANDIR)/man5 and $(MANDIR)/man8 must exist. --MANDIR = /usr/local/man -+MANDIR = /usr/man - - # The directories to put things in. If you use multiple - # architectures or share the samba binaries across NFS then -@@ -18,16 +18,16 @@ - # normally only applies to nmbd and smbd - # SBINDIR implies a secure binary directory - BINDIR = $(BASEDIR)/bin --SBINDIR = $(BASEDIR)/bin --LIBDIR = $(BASEDIR)/lib --VARDIR = $(BASEDIR)/var -+SBINDIR = $(BASEDIR)/sbin -+LIBDIR = $(BASEDIR)/lib/samba -+VARDIR = /var/log - - # The permissions to give the executables - INSTALLPERMS = 0755 - - # Add any optimisation or debugging flags here - # add -DSYSLOG for syslog support --FLAGS1 = -O -+FLAGS1 = -O2 - LIBS1 = - - # You will need to use a ANSI C compiler. This means under SunOS 4 you can't -@@ -47,15 +47,15 @@ - # or in smb.conf (see smb.conf(5)) - SMBLOGFILE = $(VARDIR)/log.smb - NMBLOGFILE = $(VARDIR)/log.nmb --CONFIGFILE = $(LIBDIR)/smb.conf --LMHOSTSFILE = $(LIBDIR)/lmhosts --DRIVERFILE = $(LIBDIR)/printers.def -+CONFIGFILE = /etc/smb.conf -+LMHOSTSFILE = /etc/lmhosts -+DRIVERFILE = /etc/printers.def - SMB_PASSWD = $(BINDIR)/smbpasswd --SMB_PASSWD_FILE = $(BASEDIR)/private/smbpasswd --WEB_ROOT = $(BASEDIR) -+SMB_PASSWD_FILE = /etc/smbpasswd -+WEB_ROOT = /etc - - # the directory where lock files go --LOCKDIR = $(VARDIR)/locks -+LOCKDIR = /var/lock - - # The directory where code page definition files go - CODEPAGEDIR = $(LIBDIR)/codepages -@@ -206,7 +206,7 @@ - # contributed by Andrew.Tridgell@anu.edu.au - # add -DLINUX_BIGCRYPT is you have shadow passwords but don't have the - # right libraries and includes --# FLAGSM = -DLINUX -DSHADOW_PWD -DFAST_SHARE_MODES -+FLAGSM = -DLINUX -DSHADOW_PWD -DFAST_SHARE_MODES - # LIBSM = -lshadow - - # Use this for Linux without shadow passwords or for any Linux ---- source/includes.h -+++ source/includes.h 1998/05/06 15:54:52 -@@ -244,13 +244,6 @@ - #define USE_SETFS - #endif - #endif --#ifdef SHADOW_PWD --#if _LINUX_C_LIB_VERSION_MAJOR < 5 --#ifndef crypt --#define crypt pw_encrypt --#endif --#endif --#endif - #endif - - #ifdef SUNOS4 diff --git a/packaging/SuSE/5.2/samba.spec b/packaging/SuSE/5.2/samba.spec deleted file mode 100644 index 5f20875c9e..0000000000 --- a/packaging/SuSE/5.2/samba.spec +++ /dev/null @@ -1,119 +0,0 @@ -# -# spec file for package samba (Version 1.9.18p1) -# -# Copyright (c) 1997 S.u.S.E. GmbH Fuerth, Germany. -# -# please send bugfixes or comments to feedback@suse.de. -# - -Vendor: S.u.S.E. GmbH, Fuerth, Germany -Distribution: S.u.S.E. Linux 5.1 (i386) -Name: samba -Release: 1 -Copyright: 1992-98 Andrew Tridgell, Karl Auer, Jeremy Allison -Group: -Provides: samba smbfs -Requires: -Conflicts: -Autoreqprov: on -Packager: feedback@suse.de - -Version: 1.9.18p5 -Summary: Samba is a file server for Unix, similar to LanManager. -Source: samba-1.9.18p5.tar.gz -Source1: smbfs-2.0.2.tar.gz -Patch: samba-1.9.18p5.dif -Patch1: smbfs-2.0.2.dif -%prep -%setup -%patch -%setup -T -n smbfs-2.0.2 -b1 -%patch -P 1 -%build -cd ../samba-1.9.18p5 -make -f Makefile.Linux compile -cd ../smbfs-2.0.2 -make -f Makefile.Linux compile -%install -cd ../samba-1.9.18p5 -make -f Makefile.Linux install -cd ../smbfs-2.0.2 -make -f Makefile.Linux install -Check -%post -echo "Updating etc/rc.config..." -if [ -x bin/fillup ] ; then - bin/fillup -q -d = etc/rc.config var/adm/fillup-templates/rc.config.samba -else - echo "ERROR: fillup not found. This should not happen. Please compare" - echo "etc/rc.config and var/adm/fillup-templates/rc.config.samba and" - echo "update by hand." -fi -%files -%docdir /usr/doc/packages/samba -/usr/doc/packages/samba -%config /etc/smb.conf -/usr/lib/samba/codepages -/sbin/init.d/rc2.d/K20smb -/sbin/init.d/rc2.d/S20smb -/sbin/init.d/rc3.d/K20smb -/sbin/init.d/rc3.d/S20smb -%config /sbin/init.d/smb -/usr/bin/addtosmbpass -/usr/bin/mksmbpasswd.sh -/usr/bin/make_printerdef -/usr/bin/make_smbcodepage -/usr/bin/nmblookup -/usr/bin/smbclient -/usr/bin/smbmount -/usr/bin/smbpasswd -/usr/bin/smbstatus -/usr/bin/smbtar -/usr/bin/smbumount -/usr/bin/testparm -/usr/bin/testprns -%doc /usr/man/man1/smbclient.1.gz -%doc /usr/man/man1/smbrun.1.gz -%doc /usr/man/man1/smbstatus.1.gz -%doc /usr/man/man1/smbtar.1.gz -%doc /usr/man/man1/testparm.1.gz -%doc /usr/man/man1/testprns.1.gz -%doc /usr/man/man1/make_smbcodepage.1.gz -%doc /usr/man/man5/smb.conf.5.gz -%doc /usr/man/man7/samba.7.gz -%doc /usr/man/man8/nmbd.8.gz -%doc /usr/man/man8/smbd.8.gz -%doc /usr/man/man8/smbmount.8.gz -%doc /usr/man/man8/smbumount.8.gz -%doc /usr/man/man8/smbmnt.8.gz -%doc /usr/man/man8/smbpasswd.8.gz -/usr/sbin/nmbd -/usr/sbin/smbd -/var/adm/fillup-templates/rc.config.samba -%description -Samba is a suite of programs which work together to allow clients to -access Unix filespace and printers via the SMB protocol (Seerver Message -Block). -CAUTION: The samba daemons are started by the init script -/sbin/init.d/samba, not by inetd. The entries for /usr/sbin/smbd -and /usr/sbin/nmbd must be commented out in /etc/inetd.conf. -In practice, this means that you can redirect disks and printers to -Unix disks and printers from LAN Manager clients, Windows for -Workgroups 3.11 clients, Windows'95 clients, Windows NT clients -and OS/2 clients. There is -also a Unix client program supplied as part of the suite which allows -Unix users to use an ftp-like interface to access filespace and -printers on any other SMB server. -Samba includes the following programs (in summary): -* smbd, the SMB server. This handles actual connections from clients. -* nmbd, the Netbios name server, which helps clients locate servers. -* smbclient, the Unix-hosted client program. -* testprns, a program to test server access to printers. -* testparm, a program to test the Samba configuration file for correctness. -* smb.conf, the Samba configuration file. -* smbprint, a sample script to allow a Unix host to use smbclient -to print to an SMB server. -The suite is supplied with full source and is GPLed. -This package expects its config file under /etc/smb.conf . -Documentation: /usr/doc/packages/samba - diff --git a/packaging/SuSE/7.1/samba-2.2.0-alpha0.dif b/packaging/SuSE/7.1/samba-2.2.0-alpha0.dif deleted file mode 100644 index 75bfdf18c6..0000000000 --- a/packaging/SuSE/7.1/samba-2.2.0-alpha0.dif +++ /dev/null @@ -1,224 +0,0 @@ ---- lmhosts -+++ lmhosts 2000/08/28 07:32:33 -@@ -0,0 +1,8 @@ -+# This file provides the same function that the -+# lmhosts file does for Windows. -+# It provides another way to map netbios names to ip addresses. -+# See the section on 'name resolve order' in the manual page to -+# smb.conf for more information. -+ -+# Sample entry: -+# 192.168.1.1 samba ---- mount.smbfs -+++ mount.smbfs 2000/08/28 07:32:55 -@@ -0,0 +1,14 @@ -+#!/bin/sh -+# -+# Copyright (c) 1999 SuSE GmbH Nuernberg, Germany. All rights reserved. -+# -+# Author: Carsten Hoeger -+# -+# /sbin/mount.smbfs -+# -+# I'm called by the mount-command and smbmount want's to get -+# called by me, so lets do it. -+# -+# P.S.: This is a very very raw solution and I don't know, if this -+# is intentionally. -+smbmount "$@" ---- rc -+++ rc 2000/08/28 07:32:33 -@@ -0,0 +1,53 @@ -+#! /bin/sh -+# Copyright (c) 1996 StarDivision GmbH. All rights reserved. -+# Copyright (c) 1996 S.u.S.E. Gmbh Fuerth, Germany. All rights reserved. -+# -+# Author: Bastian Epting, StarDivision GmbH -+# Florian La Roche, -+# Volker Lendecke, -+# -+ -+. /etc/rc.config -+ -+# Determine the base and follow a runlevel link name. -+base=${0##*/} -+link=${base#*[SK][0-9][0-9]} -+ -+# Force execution if not called by a runlevel directory. -+test $link = $base && START_SMB=yes -+test "$START_SMB" = "yes" || exit 0 -+ -+# The echo return value for success (defined in /etc/rc.config). -+return=$rc_done -+case "$1" in -+ start) -+ echo -n "Starting SMB services:" -+ startproc /usr/sbin/nmbd -D || return=$rc_failed -+ startproc /usr/sbin/smbd -D || return=$rc_failed -+ echo -e "$return" -+ ;; -+ stop) -+ echo -n "Shutting down SMB services:" -+ killproc -TERM /usr/sbin/nmbd || return=$rc_failed -+ killproc -TERM /usr/sbin/smbd || return=$rc_failed -+ echo -e "$return" -+ ;; -+ restart|reload) -+ echo -n "Reloading SMB services:" -+ killproc -HUP /usr/sbin/nmbd || return=$rc_failed -+ killproc -HUP /usr/sbin/smbd || return=$rc_failed -+ echo -e "$return" -+ ;; -+ status) -+ echo -n "Checking for service smb: " -+ checkproc /usr/sbin/nmbd && echo -n "OK " || echo -n "No process " -+ checkproc /usr/sbin/smbd && echo "OK " || echo "No process" -+ ;; -+ *) -+ echo "Usage: $0 {start|stop|restart|reload|status}" -+ exit 1 -+esac -+ -+# Inform the caller not only verbosely and set an exit status. -+test "$return" = "$rc_done" || exit 1 -+exit 0 ---- rc.config.samba -+++ rc.config.samba 2000/08/28 07:32:33 -@@ -0,0 +1,5 @@ -+# -+# start samba? ("yes" or "no") -+# Windows 95 / NT - File- and Printservices -+# -+START_SMB="no" ---- smb.conf -+++ smb.conf 2000/08/28 07:32:33 -@@ -0,0 +1,80 @@ -+; -+; /etc/smb.conf -+; -+; Copyright (c) 1999 SuSE GmbH Nuernberg, Germany. -+; -+[global] -+ workgroup = arbeitsgruppe -+ guest account = nobody -+ keep alive = 30 -+ os level = 2 -+ kernel oplocks = false -+ security = user -+ -+; Uncomment the following, if you want to use an existing -+; NT-Server to authenticate users, but don't forget that -+; you also have to create them locally!!! -+; security = server -+; password server = 192.168.1.10 -+; encrypt passwords = yes -+ -+ printing = bsd -+ printcap name = /etc/printcap -+ load printers = yes -+ -+ socket options = TCP_NODELAY -+ -+ map to guest = Bad User -+ -+; Uncomment this, if you want to integrate your server -+; into an existing net e.g. with NT-WS to prevent nettraffic -+; local master = no -+ -+; Please uncomment the following entry and replace the -+; ip number and netmask with the correct numbers for -+; your ethernet interface. -+; interfaces = 192.168.1.1/255.255.255.0 -+ -+; If you want Samba to act as a wins server, please set -+; 'wins support = yes' -+ wins support = no -+ -+; If you want Samba to use an existing wins server, -+; please uncomment the following line and replace -+; the dummy with the wins server's ip number. -+; wins server = 192.168.1.1 -+ -+; Do you wan't samba to act as a logon-server for -+; your windows 95/98 clients, so uncomment the -+; following: -+; logon script =%U.bat -+; domain logons = yes -+; domain master = yes -+; [netlogon] -+; path = /netlogon -+ -+ -+[homes] -+ comment = Heimatverzeichnis -+ browseable = no -+ read only = no -+ create mode = 0750 -+ -+; The following share gives all users access to the Server's CD drive, -+; assuming it is mounted under /cd. To enable this share, please remove -+; the semicolons before the lines -+; -+; [cdrom] -+; comment = Linux CD-ROM -+; path = /cdrom -+; read only = yes -+; locking = no -+ -+[printers] -+ comment = All Printers -+ browseable = no -+ printable = yes -+ public = no -+ read only = yes -+ create mode = 0700 -+ directory = /tmp ---- smbfs -+++ smbfs 2000/08/28 07:32:33 -@@ -0,0 +1,40 @@ -+#! /bin/bash -+# Copyright (c) 1996 SuSE GmbH Nuernberg, Germany. All rights reserved. -+# -+# Author: Thomas Fehr , 1999 -+# -+# /sbin/init.d/smbfs -+# -+ -+smbfs=no -+if [ `cat /proc/mounts | grep " smbfs " | wc -l` -gt 0 ] -+then -+ smbfs=yes -+fi -+ -+return=$rc_done -+case "$1" in -+ start|reload) -+ ;; -+ stop) -+ if [ "$smbfs" = "yes" ] -+ then -+ echo -n "Remove SMB File System" -+ # -+ # Unmount in background because during long timeouts -+ # -+ umount -at smbfs & -+ sleep 2 -+ echo -e "$return" -+ fi -+ ;; -+ restart) -+ $0 stop && $0 start || return=$rc_failed -+ ;; -+ status) -+ ;; -+ *) -+ echo "Usage: $0 {start|stop|status|reload|restart}" -+ exit 1 -+esac -+exit 0 ---- smbpasswd -+++ smbpasswd 2000/08/28 07:32:33 -@@ -0,0 +1,3 @@ -+# Sample smbpasswd file. -+# To use this, set 'encrypt passwords = yes' in the [global]-section -+# of /etc/smb.conf diff --git a/packaging/SuSE/7.1/samba.pamd b/packaging/SuSE/7.1/samba.pamd deleted file mode 100644 index d9e7088bea..0000000000 --- a/packaging/SuSE/7.1/samba.pamd +++ /dev/null @@ -1,3 +0,0 @@ -#%PAM-1.0 -auth required /lib/security/pam_unix.so -account required /lib/security/pam_unix.so diff --git a/packaging/SuSE/7.1/samba.spec b/packaging/SuSE/7.1/samba.spec deleted file mode 100644 index 60d8099edb..0000000000 --- a/packaging/SuSE/7.1/samba.spec +++ /dev/null @@ -1,381 +0,0 @@ -# -# spec file for package samba (Version 2.0.7) -# -# Copyright (c) 2000 SuSE GmbH Nuernberg, Germany. -# -# please send bugfixes or comments to feedback@suse.de. -# - -# neededforbuild automake openldap -# usedforbuild aaa_base aaa_dir autoconf automake base bash bindutil binutils bison bzip compress cpio cracklib devs diff ext2fs file fileutil find flex gawk gcc gdbm gettext gpm gppshare groff gzip kbd less libc libtool libz lx_suse make mktemp modules ncurses net_tool netcfg nkita nkitb nssv1 openldap pam patch perl pgp ps rcs rpm sendmail sh_utils shadow shlibs strace syslogd sysvinit texinfo textutil timezone unzip util vim xdevel xf86 xshared - -Vendor: SuSE GmbH, Nuernberg, Germany -Distribution: SuSE Linux 7.1a (i386) -Name: samba -Release: 0 -Packager: feedback@suse.de - -Copyright: 1992-95 Andrew Tridgell, Karl Auer, Jeremy Allison -Group: Networking/Daemons -Url: http://www.samba.org -Provides: samba smbfs -Requires: smbclnt -Autoreqprov: on -Version: 2.2 -Summary: An SMB file server for Unix -Source: samba-2.2.0-alpha0.tar.gz -Source1: samba.pamd -Patch: samba-2.2.0-alpha0.dif -%package -n smbclnt -Summary: Samba client utilities -Autoreqprov: on -Group: Networking -%prep -%setup -n samba-2.2.0-alpha0 -%patch - -%build -cd source -%{?suse_update_config:%{suse_update_config -f}} -LIBS=-lnsl \ -./configure --prefix=/usr --libdir=/etc \ - --with-privatedir=/etc --localstatedir=/var/log \ - --with-smbmount --with-pam \ - --mandir=%{_mandir} \ - --with-swatdir=/usr/lib/samba/swat \ - --with-sambabook=/usr/lib/samba/swat/using_samba -cd .. -make LOCKDIR=/var/lock/samba SBINDIR=/usr/sbin \ - CODEPAGEDIR=/usr/lib/samba/codepages -C source - -%install -mkdir -p /usr/lib/samba -make install LOCKDIR=/var/lock/samba SBINDIR=/usr/sbin \ - CODEPAGEDIR=/usr/lib/samba/codepages -C source -# cleanup docs -rm -rf docs/*.[0-9] -chmod 644 `find docs examples -type f` -chmod 755 `find docs examples -type d` -#utility scripts -mkdir -p /usr/lib/samba/scripts -cp -a source/script/* /usr/lib/samba/scripts -# configuration files -install -m 644 smb.conf /etc/smb.conf -install -m 644 lmhosts /etc/lmhosts -install -m 600 smbpasswd -o root -g root /etc/smbpasswd -install -d 755 /etc/pam.d -install -m 644 $RPM_SOURCE_DIR/samba.pamd /etc/pam.d/samba -install -m 755 mount.smbfs /sbin/mount.smbfs -# start script -install rc /sbin/init.d/smb -ln -sf ../smb /sbin/init.d/rc2.d/S20smb -ln -sf ../smb /sbin/init.d/rc2.d/K20smb -ln -sf ../smb /sbin/init.d/rc3.d/S20smb -ln -sf ../smb /sbin/init.d/rc3.d/K20smb -ln -sf ../../sbin/init.d/smb /usr/sbin/rcsmb -install smbfs /sbin/init.d/smbfs -ln -sf ../smbfs /sbin/init.d/rc2.d/S21smbfs -ln -sf ../smbfs /sbin/init.d/rc2.d/K19smbfs -ln -sf ../smbfs /sbin/init.d/rc3.d/S21smbfs -ln -sf ../smbfs /sbin/init.d/rc3.d/K19smbfs -ln -sf ../../sbin/init.d/smbfs /usr/sbin/rcsmbfs -# rc.config fragment -mkdir -p /var/adm/fillup-templates -cp rc.config.samba /var/adm/fillup-templates -%{?suse_check} - -%post -echo "Updating etc/rc.config..." -if [ -x bin/fillup ] ; then - bin/fillup -q -d = etc/rc.config var/adm/fillup-templates/rc.config.samba -else - echo "ERROR: fillup not found. This should not happen. Please compare" - echo "etc/rc.config and var/adm/fillup-templates/rc.config.samba and" - echo "update by hand." -fi -if grep -q '^[#[:space:]]*swat' etc/inetd.conf ; then - echo /etc/inetd.conf is up to date -else - echo updating inetd.conf - cat >> etc/inetd.conf << EOF -# swat is the Samba Web Administration Tool -swat stream tcp nowait.400 root /usr/sbin/swat swat -EOF -fi -if grep -q '^swat' etc/services ; then - echo /etc/services is up to date -else - echo updating services - cat >> etc/services << EOF -swat 901/tcp # swat is the Samba Web Administration Tool -EOF -fi -mkdir -p var/adm/notify/messages -cat << EOF > var/adm/notify/messages/samba-notify -Achtung! -======== -Die Syntax des smbmount Kommandos hat sich geaendert! -smbmount kann nicht mehr direkt aufgerufen werden. Es wird von einem -Shellscript /sbin/mount.smbfs aufgerufen, welches wiederum von mount -aufgerufen wird. -Hier ein Beispielaufruf: -mount -t smbfs -o username=uname,password=passwd //smbserv/share /destination -***************************************************************************** -Attention! -========== -The syntax of smbmount has changed! -smbmount can not be called direct anymore. It will be called by a shell -script /sbin/mount.smbfs, which will be called by mount. -A sample call to smbfs: -mount -t smbfs -o username=uname,password=passwd //smbserv/share /destination -EOF - -%files -%config(noreplace) /etc/smb.conf -%config(noreplace) /etc/lmhosts -%config(noreplace) /etc/smbpasswd -%config /etc/pam.d/samba -/usr/lib/samba -/sbin/init.d/rc2.d/K20smb -/sbin/init.d/rc2.d/S20smb -/sbin/init.d/rc3.d/K20smb -/sbin/init.d/rc3.d/S20smb -%config /sbin/init.d/smb -/usr/bin/addtosmbpass -/usr/bin/convert_smbpasswd -/usr/bin/make_printerdef -/usr/bin/make_smbcodepage -/usr/bin/make_unicodemap -/usr/bin/smbpasswd -/usr/bin/smbstatus -/usr/bin/testparm -/usr/bin/testprns -%doc docs/* examples -%doc %{_mandir}/man1/make_smbcodepage.1.gz -%doc %{_mandir}/man1/make_unicodemap.1.gz -%doc %{_mandir}/man1/smbrun.1.gz -%doc %{_mandir}/man1/smbsh.1.gz -%doc %{_mandir}/man1/smbstatus.1.gz -%doc %{_mandir}/man1/testparm.1.gz -%doc %{_mandir}/man1/testprns.1.gz -%doc %{_mandir}/man5/lmhosts.5.gz -%doc %{_mandir}/man5/smb.conf.5.gz -%doc %{_mandir}/man5/smbpasswd.5.gz -%doc %{_mandir}/man7/samba.7.gz -%doc %{_mandir}/man8/nmbd.8.gz -%doc %{_mandir}/man8/smbd.8.gz -%doc %{_mandir}/man8/smbpasswd.8.gz -%doc %{_mandir}/man8/swat.8.gz -/usr/sbin/nmbd -/usr/sbin/rcsmb -/usr/sbin/smbd -/usr/sbin/swat -/var/adm/fillup-templates/rc.config.samba - -%files -n smbclnt -/sbin/init.d/rc2.d/K19smbfs -/sbin/init.d/rc2.d/S21smbfs -/sbin/init.d/rc3.d/K19smbfs -/sbin/init.d/rc3.d/S21smbfs -%config /sbin/init.d/smbfs -/usr/sbin/rcsmbfs -/sbin/mount.smbfs -/usr/bin/nmblookup -/usr/bin/rpcclient -/usr/bin/smbclient -/usr/bin/smbmnt -/usr/bin/smbmount -/usr/bin/smbumount -/usr/bin/smbspool -/usr/bin/smbtar -%doc %{_mandir}/man1/nmblookup.1.gz -%doc %{_mandir}/man1/smbclient.1.gz -%doc %{_mandir}/man1/smbtar.1.gz -%doc %{_mandir}/man8/smbmnt.8.gz -%doc %{_mandir}/man8/smbmount.8.gz -%doc %{_mandir}/man8/smbspool.8.gz -%doc %{_mandir}/man8/smbumount.8.gz - -%description -Samba is a suite of programs which work together to allow clients to -access Unix filespace and printers via the SMB protocol (Server Message -Block). -In practice, this means that you can redirect disks and printers to -Unix disks and printers from LAN Manager clients, Windows for -Workgroups 3.11 clients, Windows'95 clients, Windows NT clients -and OS/2 clients. There is -also a Unix client program supplied as part of the suite which allows -Unix users to use an ftp-like interface to access filespace and -printers on any other SMB server. -Samba includes the following programs (in summary): -* smbd, the SMB server. This handles actual connections from clients. -* nmbd, the Netbios name server, which helps clients locate servers. -* smbclient, the Unix-hosted client program. -* smbrun, a little 'glue' program to help the server run external -programs. -* testprns, a program to test server access to printers. -* testparm, a program to test the Samba configuration file for correctness. -* smb.conf, the Samba configuration file. -* smbprint, a sample script to allow a Unix host to use smbclient -to print to an SMB server. -The suite is supplied with full source and is GPLed. -This package expects its config file under /etc/smb.conf . - -Authors: --------- - Andrew Tridgell - Karl Auer - Jeremy Allison - -SuSE series: n - - -%description -n smbclnt -This package contains all programs, that are needed to act as a samba -client. This includes also smbmount, of course. - -Authors: --------- - Andrew Tridgell - Karl Auer - Jeremy Allison - -SuSE series: n - - -%changelog -n samba -* Mon Aug 28 2000 - choeger@suse.de -- changed $* to "$@" in mount.smbfs to make it also - possible to mount shares with spaces -* Mon Jul 31 2000 - choeger@suse.de -- improvement for rcsmb -- fix for spec-file to compile with NIS netgroups -* Thu Jul 20 2000 - choeger@suse.de -- added smbfs initscript that has been removed - by an error -* Tue Jul 11 2000 - choeger@suse.de -- split package into client and server parts - client package name: smbclnt -* Wed Apr 26 2000 - choeger@suse.de -- new version, 2.0.7 -* Thu Apr 06 2000 - ro@suse.de -- removed pam,cracklib from neededforbuild: build handles this -* Wed Apr 05 2000 - bk@suse.de -- s390 team added config.{sub,guess} update macro for s390 -* Mon Mar 27 2000 - choeger@suse.de -- fixed bug in specfile - the multilined configure call missed a "" :-( -* Thu Mar 09 2000 - choeger@suse.de -- fixed typo in specfile -* Wed Mar 01 2000 - choeger@suse.de -- added %{_mandir} -* Tue Feb 08 2000 - choeger@suse.de -- removed /sbin/init.d/smbfs because it is no longer needed -* Mon Jan 03 2000 - choeger@suse.de -- bugfix for ipc.c - to make roaming profiles work again. -* Tue Nov 30 1999 - choeger@suse.de -- changed kernel oplocks = off to - kernel oplocks = false -* Tue Nov 16 1999 - choeger@suse.de -- added kernel oplocks = off in smb.conf -* Fri Nov 12 1999 - choeger@suse.de -- new version, 2.0.6 -* Fri Nov 05 1999 - choeger@suse.de -- Fix for the smbmount lost-connection problem - _seems_ to work... -* Fri Oct 29 1999 - choeger@suse.de -- removed comment sign in /etc/inetd.conf for swat -* Mon Sep 13 1999 - bs@suse.de -- ran old prepare_spec on spec file to switch to new prepare_spec. -* Tue Aug 10 1999 - fehr@suse.de -- set execute permissions for mksmbpasswd.sh and changesmbpasswd.sh -* Thu Jul 29 1999 - fehr@suse.de -- fixed typo in /sbin/init.d/smbfs -* Thu Jul 22 1999 - fehr@suse.de -- changed to new version 2.0.5a -* Wed Jul 21 1999 - fehr@suse.de -- changed to new version 2.0.5 -* Tue Jul 20 1999 - fehr@suse.de -- install /sbin/init.d/smbfs -- changed to new version 2.0.5pre4 -* Mon Jul 19 1999 - fehr@suse.de -- add /sbin/init.d/smbfs -- changed to new version 2.0.5pre3 -* Fri Jul 02 1999 - fehr@suse.de -- removed "umount -a -t smbfs" from start sscript -* Tue Jun 22 1999 - kukuk@suse.de -- 2.0.4b changed default values, enable PAM again -* Fri Jun 18 1999 - kukuk@suse.de -- changed to new version 2.0.4b -* Mon Jun 14 1999 - kukuk@suse.de -- Enable PAM, add samba.pamd -* Mon May 03 1999 - fehr@suse.de -- add umount -a -t smbfs to shutdown sequence of samba -* Thu Mar 11 1999 - ro@suse.de -- smbmount: define NR_OPEN to 1024 if undefined (GLIBC-2.1) -* Wed Mar 10 1999 - choeger@suse.de -- some enhancements for smb.conf -* Wed Mar 10 1999 - choeger@suse.de -- new version 2.0.3 and smbmount now seems to work -* Tue Mar 09 1999 - ro@suse.de -- use samba-2.0.2 for STABLE -- use smbfs-2.1 with kernel 2.2.2 -* Sun Feb 28 1999 - ro@suse.de -- for glibc-2.1 strncat uses strcat for one subcase, so don't - redefine strcat to "ERROR" for glibc-2.1 -* Mon Feb 15 1999 - fehr@suse.de -- fix for umount problem from Volker -* Tue Feb 09 1999 - fehr@suse.de -- changed to version 2.0.2 of samba -* Fri Jan 15 1999 - bs@suse.de -- replaced /sbin/init.d/smb with newer style version (again) -* Fri Jan 15 1999 - fehr@suse.de -- switched to new version 2.0.0 -* Wed Jan 13 1999 - bs@suse.de -- fixed entry in inetd.conf -* Wed Jan 13 1999 - bs@suse.de -- replaced /sbin/init.d/smb with newer style version -* Mon Jan 11 1999 - vl@suse.de -- make 2.0.0beta5 package of samba -* Mon Aug 24 1998 - vl@suse.de -- changed to version 1.9.18p10 -* Mon Jun 29 1998 - vl@suse.de -- changed to version 1.9.18p8 -* Mon Apr 20 1998 - vl@suse.de -- changed to version 1.9.18p4 -* Thu Feb 19 1998 - vl@suse.de -- changed to version 1.9.18p3 -* Tue Feb 03 1998 - vl@suse.de -- changed to version 1.9.18p2 -- fixed some problems in spec-file, some files were missing :-( -- fixed smbfs-2.0.2/Makefile.Linux -* Tue Jan 13 1998 - vl@suse.de -- changed to version 1.9.18p1 -* Fri Jan 09 1998 - vl@suse.de -- changed to version 1.9.18 -* Tue Dec 02 1997 - bs@suse.de -- disable samba by default in /etc/rc.config -* Mon Oct 06 1997 - fehr@suse.de -- package prepared for automatic building -* Mon Sep 29 1997 - fehr@suse.de -- updated to version 1.9.17p2 due to security hole. -* Wed Jul 16 1997 - fehr@suse.de -- add fillup-template for rc.config and install it in doinst.sh -* Fri Jun 27 1997 - bs@suse.de -- update to smbfs-2.0.2, due to security hole. -* Tue Jun 17 1997 - fehr@suse.de -- changed init-skript to recognize entry START_SMB of rc.config -* Mon Jun 02 1997 - vl@suse.de -- update to version 1.9.16p11 -- Starting Samba from /sbin/init.d, not from inetd.conf -* Sun Feb 02 1997 - vl@suse.de -- update to version 1.9.16p10 -- Adapted /etc/smb.conf.sample to 4.4.1 manual -* Thu Jan 02 1997 - florian@suse.de -- update to version 1.9.16p9 -- configuration file is now /etc/smb.conf -- smbd and nmbd are now in /usr/sbin -- added start-script /sbin/init.d/smb and entry in /etc/rc.config -* Thu Jan 02 1997 - florian@suse.de -- Update auf neue Version 1.9.16p6. diff --git a/packaging/SuSE/samba-3.0.0-msdfs.diff b/packaging/SuSE/samba-3.0.0-msdfs.diff deleted file mode 100644 index 1e688e64c4..0000000000 --- a/packaging/SuSE/samba-3.0.0-msdfs.diff +++ /dev/null @@ -1,97 +0,0 @@ ---- source/param/loadparm.c Wed Oct 9 21:17:05 2002 -+++ source/param/loadparm.c Mon Oct 14 16:33:08 2002 -@@ -386,6 +386,8 @@ - BOOL bInheritPerms; - BOOL bInheritACLS; - BOOL bMSDfsRoot; -+ BOOL bMSDfsProxy; -+ char *bMSDfsLinkName; - BOOL bUseClientDriver; - BOOL bDefaultDevmode; - BOOL bNTAclSupport; -@@ -508,6 +510,8 @@ - False, /* bInheritPerms */ - False, /* bInheritACLS */ - False, /* bMSDfsRoot */ -+ False, /* bMSDfsProxy */ -+ NULL, /* bMSDfsLinkName */ - False, /* bUseClientDriver */ - False, /* bDefaultDevmode */ - True, /* bNTAclSupport */ -@@ -1079,6 +1083,8 @@ - - - {"msdfs root", P_BOOL, P_LOCAL, &sDefault.bMSDfsRoot, NULL, NULL, FLAG_SHARE}, -+ {"msdfs proxy", P_BOOL, P_LOCAL, &sDefault.bMSDfsProxy, NULL, NULL, FLAG_SHARE}, -+ {"msdfs link name", P_STRING, P_LOCAL, &sDefault.bMSDfsLinkName, NULL, NULL, FLAG_SHARE}, - {"host msdfs", P_BOOL, P_GLOBAL, &Globals.bHostMSDfs, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER}, - - {"Winbind options", P_SEP, P_SEPARATOR}, -@@ -1730,6 +1736,8 @@ - FN_LOCAL_STRING(lp_veto_oplocks, szVetoOplockFiles) - FN_LOCAL_STRING(lp_driverlocation, szPrinterDriverLocation) - FN_LOCAL_BOOL(lp_msdfs_root, bMSDfsRoot) -+FN_LOCAL_BOOL(lp_msdfs_proxy, bMSDfsProxy) -+FN_LOCAL_STRING(lp_msdfs_link_name, bMSDfsLinkName) - FN_LOCAL_BOOL(lp_autoloaded, autoloaded) - FN_LOCAL_BOOL(lp_preexec_close, bPreexecClose) - FN_LOCAL_BOOL(lp_rootpreexec_close, bRootpreexecClose) ---- source/msdfs/msdfs.c Tue Jul 2 08:34:24 2002 -+++ source/msdfs/msdfs.c Mon Oct 14 16:49:57 2002 -@@ -600,12 +600,38 @@ - int reply_size = 0; - char *pathnamep = pathname; - -+ struct connection_struct conns; -+ struct connection_struct* conn = &conns; -+ int snum; -+ pstring conn_path; -+ struct dfs_path dpi; -+ -+ struct junction_map junction2; -+ parse_dfs_path(pathname, &dpi); -+ pstrcpy(junction2.service_name, dpi.servicename); -+ snum = lp_servicenumber(junction2.service_name); -+ create_conn_struct(conn, snum, conn_path); -+ -+ - ZERO_STRUCT(junction); - - /* get the junction entry */ - if (!pathnamep) - return -1; - -+ if (lp_msdfs_proxy(SNUM(conn))) { -+ DEBUG(10,("running in proxy mode\n")); -+ pstrcpy(pathnamep, "\\"); -+ pstrcat(pathnamep, dpi.hostname); -+ pstrcat(pathnamep, "\\"); -+ pstrcat(pathnamep, dpi.servicename); -+ pstrcat(pathnamep, "\\"); -+ pstrcat(pathnamep, (char *) lp_msdfs_link_name(SNUM(conn))); -+ } else { -+ DEBUG(10,("running in normal mode\n")); -+ } -+ -+ - /* Trim pathname sent by client so it begins with only one backslash. - Two backslashes confuse some dfs clients - */ -@@ -631,6 +657,17 @@ - } - } - -+ if ( lp_msdfs_proxy(SNUM(conn)) ) { -+ DEBUG(10,("running in proxy mode\n")); -+ pstrcpy ( pathnamep, "\\" ); -+ pstrcat ( pathnamep, dpi.hostname); -+ pstrcat ( pathnamep, "\\" ); -+ pstrcat ( pathnamep, dpi.servicename); -+ } else { -+ DEBUG(10,("running in normal mode\n")); -+ } -+ -+ - /* create the referral depeding on version */ - DEBUG(10,("max_referral_level :%d\n",max_referral_level)); - if(max_referral_level<2 || max_referral_level>3) diff --git a/packaging/SuSE/samba-3.0.0-net_ads.diff b/packaging/SuSE/samba-3.0.0-net_ads.diff deleted file mode 100644 index b1224c0cef..0000000000 --- a/packaging/SuSE/samba-3.0.0-net_ads.diff +++ /dev/null @@ -1,140 +0,0 @@ -diff -Nur source/utils/net.c source/utils/net.c ---- source/utils/net.c Fri Sep 27 09:42:34 2002 -+++ source/utils/net.c Tue Oct 1 12:22:00 2002 -@@ -68,6 +68,7 @@ - int opt_port = 0; - int opt_maxusers = -1; - char *opt_comment = ""; -+char *opt_container = "cn=Users"; - int opt_flags = -1; - int opt_jobid = 0; - int opt_timeout = 0; -@@ -459,6 +460,7 @@ - {"myname", 'n', POPT_ARG_STRING, &opt_requester_name}, - {"conf", 's', POPT_ARG_STRING, &servicesf}, - {"server", 'S', POPT_ARG_STRING, &opt_host}, -+ {"container", 'c', POPT_ARG_STRING, &opt_container}, - {"comment", 'C', POPT_ARG_STRING, &opt_comment}, - {"maxusers", 'M', POPT_ARG_INT, &opt_maxusers}, - {"flags", 'F', POPT_ARG_INT, &opt_flags}, -diff -Nur source/utils/net.h source/utils/net.h ---- source/utils/net.h Tue Jun 25 04:29:09 2002 -+++ source/utils/net.h Tue Oct 1 12:19:51 2002 -@@ -38,10 +38,8 @@ - - extern int opt_maxusers; - extern char *opt_comment; -+extern char *opt_container; - extern int opt_flags; -- --extern char *opt_comment; -- - extern char *opt_target_workgroup; - extern int opt_long_list_entries; - extern int opt_reboot; -diff -Nur source/utils/net_ads.c source/utils/net_ads.c ---- source/utils/net_ads.c Tue Sep 17 14:15:52 2002 -+++ source/utils/net_ads.c Tue Oct 1 12:33:44 2002 -@@ -255,7 +255,7 @@ - goto done; - } - -- status = ads_add_user_acct(ads, argv[0], opt_comment); -+ status = ads_add_user_acct(ads, argv[0], opt_container, opt_comment); - - if (!ADS_ERR_OK(status)) { - d_printf("Could not add user %s: %s\n", argv[0], -@@ -431,7 +431,7 @@ - goto done; - } - -- status = ads_add_group_acct(ads, argv[0], opt_comment); -+ status = ads_add_group_acct(ads, argv[0], opt_container, opt_comment); - - if (ADS_ERR_OK(status)) { - d_printf("Group %s added\n", argv[0]); -diff -Nur source/utils/net_help.c source/utils/net_help.c ---- source/utils/net_help.c Tue Sep 24 20:10:30 2002 -+++ source/utils/net_help.c Tue Oct 1 13:01:50 2002 -@@ -69,14 +69,14 @@ - "\n\tDelete specified user\n"); - d_printf("\nnet [] user INFO [misc. options] [targets]"\ - "\n\tList the domain groups of the specified user\n"); -- d_printf("\nnet [] user ADD [password] "\ -+ d_printf("\nnet [] user ADD [password] [-c container] "\ - "[-F user flags] [misc. options]"\ - " [targets]\n\tAdd specified user\n"); - - net_common_methods_usage(argc, argv); - net_common_flags_usage(argc, argv); -- d_printf( -- "\t-C or --comment=\tdescriptive comment (for add only)\n"); -+ d_printf("\t-C or --comment=\tdescriptive comment (for add only)\n"); -+ d_printf("\t-c or --container=\tLDAP container, defaults to cn=Users (for add in ADS only)\n"); - return -1; - } - -@@ -85,12 +85,12 @@ - "\n\tList user groups\n\n"); - d_printf("net [] group DELETE [misc. options] [targets]"\ - "\n\tDelete specified group\n"); -- d_printf("\nnet [] group ADD [-C comment]"\ -+ d_printf("\nnet [] group ADD [-C comment] [-c container]"\ - " [misc. options] [targets]\n\tCreate specified group\n"); - net_common_methods_usage(argc, argv); - net_common_flags_usage(argc, argv); -- d_printf( -- "\t-C or --comment=\tdescriptive comment (for add only)\n"); -+ d_printf("\t-C or --comment=\tdescriptive comment (for add only)\n"); -+ d_printf("\t-c or --container=\tLDAP container, defaults to cn=Users (for add in ADS only)\n"); - return -1; - } - -diff -Nur source/libads/ldap_user.c source/libads/ldap_user.c ---- source/libads/ldap_user.c Wed Aug 7 12:33:22 2002 -+++ source/libads/ldap_user.c Tue Oct 1 12:46:08 2002 -@@ -38,7 +38,7 @@ - } - - ADS_STATUS ads_add_user_acct(ADS_STRUCT *ads, const char *user, -- const char *fullname) -+ const char *container, const char *fullname) - { - TALLOC_CTX *ctx; - ADS_MODLIST mods; -@@ -57,7 +60,7 @@ - - if (!(upn = talloc_asprintf(ctx, "%s@%s", user, ads->config.realm))) - goto done; -- if (!(new_dn = talloc_asprintf(ctx, "cn=%s,cn=Users,%s", name, -+ if (!(new_dn = talloc_asprintf(ctx, "cn=%s,%s,%s", name, container, - ads->config.bind_path))) - goto done; - if (!(controlstr = talloc_asprintf(ctx, "%u", UF_NORMAL_ACCOUNT))) -@@ -80,7 +83,7 @@ - } - - ADS_STATUS ads_add_group_acct(ADS_STRUCT *ads, const char *group, -- const char *comment) -+ const char *container, const char *comment) - { - TALLOC_CTX *ctx; - ADS_MODLIST mods; -@@ -93,7 +96,7 @@ - - status = ADS_ERROR(LDAP_NO_MEMORY); - -- if (!(new_dn = talloc_asprintf(ctx, "cn=%s,cn=Users,%s", group, -+ if (!(new_dn = talloc_asprintf(ctx, "cn=%s,%s,%s", group, container, - ads->config.bind_path))) - goto done; - if (!(mods = ads_init_mods(ctx))) -@@ -102,7 +105,7 @@ - ads_mod_str(ctx, &mods, "cn", group); - ads_mod_strlist(ctx, &mods, "objectClass",objectClass); - ads_mod_str(ctx, &mods, "name", group); -- if (comment) -+ if (comment && *comment) - ads_mod_str(ctx, &mods, "description", comment); - ads_mod_str(ctx, &mods, "sAMAccountName", group); - status = ads_gen_add(ads, new_dn, mods); diff --git a/packaging/SuSE/samba-3.0.0-pdb.diff b/packaging/SuSE/samba-3.0.0-pdb.diff deleted file mode 100644 index 4f767c4ac4..0000000000 --- a/packaging/SuSE/samba-3.0.0-pdb.diff +++ /dev/null @@ -1,11 +0,0 @@ ---- examples/pdb/Makefile Thu Sep 5 02:11:41 2002 -+++ examples/pdb/Makefile Thu Sep 5 02:11:59 2002 -@@ -8,7 +8,7 @@ - SAMBA_INCL = ../../source/include - UBIQX_SRC = ../../source/ubiqx - SMBWR_SRC = ../../source/smbwrapper --CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -Wall -g -+CFLAGS = -I/usr/include/heimdal -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -Wall -g - PDB_OBJS = pdb_test.so - - # Default target diff --git a/packaging/SuSE/samba-3.0.0-python.diff b/packaging/SuSE/samba-3.0.0-python.diff deleted file mode 100644 index 8c5931e444..0000000000 --- a/packaging/SuSE/samba-3.0.0-python.diff +++ /dev/null @@ -1,44 +0,0 @@ ---- source/python/py_common.c 2002-12-22 03:07:40.000000000 +0100 -+++ source/python/py_common.c 2002-11-29 11:50:22.000000000 +0100 -@@ -45,9 +45,6 @@ - - void py_samba_init(void) - { -- extern pstring global_myname; -- char *p; -- - if (initialised) - return; - -@@ -59,11 +56,7 @@ - /* Misc other stuff */ - - load_interfaces(); -- -- fstrcpy(global_myname, myhostname()); -- p = strchr(global_myname, '.'); -- if (p) -- *p = 0; -+ init_names(); - - initialised = True; - } ---- source/python/py_smb.c 2002-11-27 03:54:20.000000000 +0100 -+++ source/python/py_smb.c 2002-11-29 11:50:22.000000000 +0100 -@@ -61,7 +61,6 @@ - static char *kwlist[] = { "called", "calling", NULL }; - char *calling_name = NULL, *called_name; - struct nmb_name calling, called; -- extern pstring global_myname; - BOOL result; - - if (!PyArg_ParseTupleAndKeywords(args, kw, "s|s", kwlist, &called_name, -@@ -69,7 +68,7 @@ - return NULL; - - if (!calling_name) -- calling_name = global_myname; -+ calling_name = global_myname(); - - make_nmb_name(&calling, calling_name, 0x00); - make_nmb_name(&called, called_name, 0x20); diff --git a/packaging/SuSE/samba-3.0.0-vscan.diff b/packaging/SuSE/samba-3.0.0-vscan.diff deleted file mode 100644 index cb860e3ffb..0000000000 --- a/packaging/SuSE/samba-3.0.0-vscan.diff +++ /dev/null @@ -1,80 +0,0 @@ ---- examples/VFS/samba-vscan-0.3.1/fprot/Makefile 2002-11-26 15:20:17.000000000 +0100 -+++ examples/VFS/samba-vscan-0.3.1/fprot/Makefile 2002-12-19 13:26:19.000000000 +0100 -@@ -14,7 +14,7 @@ - SMBWR_SRC = ../../../../source/smbwrapper - SMBVS_INCL = ../include - SMBVS_GLB = ../global --CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -+CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal - VFS_OBJS = vscan-fprotd.so - SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c vscan-fprotd.c vscan-fprotd_core.c vscan-fprotd.h vscan-fprotd_core.h - OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-fprotd.lo vscan-fprotd_core.lo ---- examples/VFS/samba-vscan-0.3.1/include/vscan-global.h 2002-11-25 16:48:10.000000000 +0100 -+++ examples/VFS/samba-vscan-0.3.1/include/vscan-global.h 2002-12-19 13:26:34.000000000 +0100 -@@ -93,7 +93,7 @@ - */ - - #ifndef SAMBA_VERSION_MAJOR --# define SAMBA_VERSION_MAJOR 2 -+# define SAMBA_VERSION_MAJOR 3 - #endif - - #ifndef SAMBA_VERSION_MINOR ---- examples/VFS/samba-vscan-0.3.1/kaspersky/Makefile 2002-11-28 17:40:35.000000000 +0100 -+++ examples/VFS/samba-vscan-0.3.1/kaspersky/Makefile 2002-12-19 13:27:23.000000000 +0100 -@@ -23,9 +23,9 @@ - VFS_OBJS = vscan-kavp.so - - ifdef USE_DEBUG --CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -+CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal - else --CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -+CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal - endif - - ifndef USE_KAVPSHAREDLIB ---- examples/VFS/samba-vscan-0.3.1/mks/Makefile 2002-11-26 16:29:55.000000000 +0100 -+++ examples/VFS/samba-vscan-0.3.1/mks/Makefile 2002-12-19 13:27:53.000000000 +0100 -@@ -13,7 +13,7 @@ - SMBWR_SRC = ../../../../source/smbwrapper - SMBVS_INCL = ../include - SMBVS_GLB = ../global --CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -+CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal - VFS_OBJS = vscan-mksd.so - SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c vscan-mksd.c vscan-mksd_core.c vscan-mksd.h vscan-mksd_core.h mks.h mks_c.c - OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-mksd.lo vscan-mksd_core.lo mks_c.lo ---- examples/VFS/samba-vscan-0.3.1/openantivirus/Makefile 2002-11-27 19:24:03.000000000 +0100 -+++ examples/VFS/samba-vscan-0.3.1/openantivirus/Makefile 2002-12-19 13:28:10.000000000 +0100 -@@ -15,7 +15,7 @@ - SMBWR_SRC = ../../../../source/smbwrapper - SMBVS_INCL = ../include - SMBVS_GLB = ../global --CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -+CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal - VFS_OBJS = vscan-oav.so - SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c vscan-oav.c vscan-oav_core.c vscan-oav.h vscan-oav_core.h - OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-oav.lo vscan-oav_core.lo ---- examples/VFS/samba-vscan-0.3.1/sophos/Makefile 2002-11-27 19:24:03.000000000 +0100 -+++ examples/VFS/samba-vscan-0.3.1/sophos/Makefile 2002-12-19 13:29:20.000000000 +0100 -@@ -15,7 +15,7 @@ - SMBWR_SRC = ../../../../source/smbwrapper - SMBVS_INCL = ../include - SMBVS_GLB = ../global --CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -+CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal - VFS_OBJS = vscan-sophos.so - SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c vscan-sophos.c vscan-sophos_core.c vscan-sophos.h vscan-sophos_core.h - OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-sophos.lo vscan-sophos_core.lo ---- examples/VFS/samba-vscan-0.3.1/trend/Makefile 2002-11-27 19:24:03.000000000 +0100 -+++ examples/VFS/samba-vscan-0.3.1/trend/Makefile 2002-12-19 13:29:31.000000000 +0100 -@@ -15,7 +15,7 @@ - SMBWR_SRC = ../../../../source/smbwrapper - SMBVS_INCL = ../include - SMBVS_GLB = ../global --CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -+CFLAGS = -I$(SAMBA_SRC) -I$(SAMBA_INCL) -I$(UBIQX_SRC) -I$(SMBWR_SRC) -I$(SMBVS_INCL) -Wall -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/heimdal - VFS_OBJS = vscan-trend.so - SOURCES = $(SMBVS_GLB)/vscan-functions.c $(SMBVS_GLB)/vscan-message.c $(SMBVS_GLB)/vscan-quarantine.c vscan-trend.c vscan-trend_core.c vscan-trend.h vscan-trend_core.h - OBJS = vscan-functions.lo vscan-message.lo vscan-quarantine.lo vscan-trend.lo vscan-trend_core.lo diff --git a/packaging/SuSE/samba-vscan-0.3.1.tar.bz2 b/packaging/SuSE/samba-vscan-0.3.1.tar.bz2 deleted file mode 100644 index 5639279374..0000000000 Binary files a/packaging/SuSE/samba-vscan-0.3.1.tar.bz2 and /dev/null differ -- cgit From edb6755f4591cdab4ce2eb5cbec158191807dcd3 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 03:51:06 +0000 Subject: syncing examples (This used to be commit d31b5df82648767203ecee6ecb10030caa477250) --- examples/LDAP/README | 61 +- examples/LDAP/convertSambaAccount | 132 +++- examples/LDAP/ldapsync.pl | 5 + examples/LDAP/samba-nds.schema | 151 ++++ examples/LDAP/samba-schema-netscapeds4.x | 158 +++-- examples/LDAP/samba-schema-netscapeds5.x | 109 +-- examples/LDAP/samba.schema | 7 +- examples/LDAP/smbldap-tools/AUTHORS | 0 examples/LDAP/smbldap-tools/CONTRIBUTORS | 29 + examples/LDAP/smbldap-tools/COPYING | 340 +++++++++ examples/LDAP/smbldap-tools/ChangeLog | 30 + examples/LDAP/smbldap-tools/FILES | 43 ++ examples/LDAP/smbldap-tools/INFRASTRUCTURE | 84 +++ examples/LDAP/smbldap-tools/INSTALL | 28 + examples/LDAP/smbldap-tools/Makefile | 35 + examples/LDAP/smbldap-tools/NEWS | 0 examples/LDAP/smbldap-tools/README | 87 +++ examples/LDAP/smbldap-tools/TODO | 28 + examples/LDAP/smbldap-tools/cgi/README | 27 + examples/LDAP/smbldap-tools/cgi/ldappass.cgi | 202 ++++++ examples/LDAP/smbldap-tools/mkntpwd/Makefile | 62 ++ examples/LDAP/smbldap-tools/mkntpwd/getopt.c | 756 +++++++++++++++++++++ examples/LDAP/smbldap-tools/mkntpwd/getopt.h | 133 ++++ examples/LDAP/smbldap-tools/mkntpwd/md4.c | 171 +++++ examples/LDAP/smbldap-tools/mkntpwd/mkntpwd.c | 253 +++++++ examples/LDAP/smbldap-tools/mkntpwd/mkntpwd.h | 17 + examples/LDAP/smbldap-tools/mkntpwd/smbdes.c | 337 +++++++++ examples/LDAP/smbldap-tools/smbldap-groupadd.pl | 84 +++ examples/LDAP/smbldap-tools/smbldap-groupdel.pl | 93 +++ examples/LDAP/smbldap-tools/smbldap-groupmod.pl | 209 ++++++ examples/LDAP/smbldap-tools/smbldap-groupshow.pl | 72 ++ .../LDAP/smbldap-tools/smbldap-migrate-accounts.pl | 234 +++++++ .../LDAP/smbldap-tools/smbldap-migrate-groups.pl | 225 ++++++ examples/LDAP/smbldap-tools/smbldap-passwd.pl | 216 ++++++ examples/LDAP/smbldap-tools/smbldap-populate.pl | 301 ++++++++ examples/LDAP/smbldap-tools/smbldap-tools.spec | 171 +++++ examples/LDAP/smbldap-tools/smbldap-useradd.pl | 460 +++++++++++++ examples/LDAP/smbldap-tools/smbldap-userdel.pl | 122 ++++ examples/LDAP/smbldap-tools/smbldap-usermod.pl | 403 +++++++++++ examples/LDAP/smbldap-tools/smbldap-usershow.pl | 69 ++ examples/LDAP/smbldap-tools/smbldap_conf.pm | 281 ++++++++ examples/LDAP/smbldap-tools/smbldap_tools.pm | 710 +++++++++++++++++++ examples/VFS/shadow_copy_test.c | 83 +++ examples/VFS/skel_opaque.c | 8 +- examples/VFS/skel_transparent.c | 8 +- examples/printing/prtpub.c | 2 +- examples/sam/Makefile.in | 28 - examples/sam/README | 29 - examples/sam/sam_skel.c | 250 ------- examples/smb.conf.default | 39 +- examples/wins_hook/README | 8 + examples/wins_hook/dns_update | 94 +++ 52 files changed, 6980 insertions(+), 504 deletions(-) create mode 100644 examples/LDAP/samba-nds.schema create mode 100644 examples/LDAP/smbldap-tools/AUTHORS create mode 100644 examples/LDAP/smbldap-tools/CONTRIBUTORS create mode 100644 examples/LDAP/smbldap-tools/COPYING create mode 100644 examples/LDAP/smbldap-tools/ChangeLog create mode 100644 examples/LDAP/smbldap-tools/FILES create mode 100644 examples/LDAP/smbldap-tools/INFRASTRUCTURE create mode 100644 examples/LDAP/smbldap-tools/INSTALL create mode 100644 examples/LDAP/smbldap-tools/Makefile create mode 100644 examples/LDAP/smbldap-tools/NEWS create mode 100644 examples/LDAP/smbldap-tools/README create mode 100644 examples/LDAP/smbldap-tools/TODO create mode 100644 examples/LDAP/smbldap-tools/cgi/README create mode 100755 examples/LDAP/smbldap-tools/cgi/ldappass.cgi create mode 100644 examples/LDAP/smbldap-tools/mkntpwd/Makefile create mode 100644 examples/LDAP/smbldap-tools/mkntpwd/getopt.c create mode 100644 examples/LDAP/smbldap-tools/mkntpwd/getopt.h create mode 100644 examples/LDAP/smbldap-tools/mkntpwd/md4.c create mode 100644 examples/LDAP/smbldap-tools/mkntpwd/mkntpwd.c create mode 100644 examples/LDAP/smbldap-tools/mkntpwd/mkntpwd.h create mode 100644 examples/LDAP/smbldap-tools/mkntpwd/smbdes.c create mode 100755 examples/LDAP/smbldap-tools/smbldap-groupadd.pl create mode 100755 examples/LDAP/smbldap-tools/smbldap-groupdel.pl create mode 100755 examples/LDAP/smbldap-tools/smbldap-groupmod.pl create mode 100755 examples/LDAP/smbldap-tools/smbldap-groupshow.pl create mode 100755 examples/LDAP/smbldap-tools/smbldap-migrate-accounts.pl create mode 100644 examples/LDAP/smbldap-tools/smbldap-migrate-groups.pl create mode 100755 examples/LDAP/smbldap-tools/smbldap-passwd.pl create mode 100755 examples/LDAP/smbldap-tools/smbldap-populate.pl create mode 100755 examples/LDAP/smbldap-tools/smbldap-tools.spec create mode 100755 examples/LDAP/smbldap-tools/smbldap-useradd.pl create mode 100755 examples/LDAP/smbldap-tools/smbldap-userdel.pl create mode 100755 examples/LDAP/smbldap-tools/smbldap-usermod.pl create mode 100755 examples/LDAP/smbldap-tools/smbldap-usershow.pl create mode 100644 examples/LDAP/smbldap-tools/smbldap_conf.pm create mode 100755 examples/LDAP/smbldap-tools/smbldap_tools.pm create mode 100644 examples/VFS/shadow_copy_test.c delete mode 100644 examples/sam/Makefile.in delete mode 100644 examples/sam/README delete mode 100644 examples/sam/sam_skel.c create mode 100644 examples/wins_hook/README create mode 100644 examples/wins_hook/dns_update diff --git a/examples/LDAP/README b/examples/LDAP/README index c7ff16ad08..2f4b4f2a05 100644 --- a/examples/LDAP/README +++ b/examples/LDAP/README @@ -1,26 +1,11 @@ !== -!== README File for storing smbpasswd in LDAP +!== README File for various LDAP examples !== !== written by Gerald Carter !== -This is a quick and dirty means of converting smbpasswd entries -to sambaAccount entriues in an LDAP directory. - - -Pre-requisites for import_smbpasswd.pl & export_smbpasswd.pl --------------------------------------------------------------- -These two scripts are modified versions of -[import|export]_smbpasswd.pl rewritten to use the Net::LDAP -perl module available from - - http://perl-ldap.sourceforge.net - - - - -OpenLDAP 2.0.x --------------- +OpenLDAP 2.x +------------ A sample schema file (samba.schema) has been included for use with OpenLDAP 2.0.x. The OIDs used in this file are owned by @@ -50,39 +35,31 @@ nis.schema and cosine.schema in your slapd.conf file. You must restart the LDAP server for these new included schema files to become active. +SunOne/Netscape DS +------------------ -import_smbpasswd.pl ----------------------- - -Make sure you customize the local site variable in the perl script -(i.e. ldapserver, rootdn, rootpw, etc...). The script reads from -standard input and requires that user entries already exist -in your directories containing the 'objectclass: posixAccount' -value pair. For more information on this object and related schema, -refer to RFC2307 and http://www.padl.com/software.html). +The schema file has not been updated for the sambaSamAccount +objectclass. -The following will import an smbpasswd file into an LDAP directory - $ cat smbpasswd | import_smbpasswd.pl +Novell eDirectory +----------------- +The schema file has not been updated for the sambaSamAccount +objectclass. -export_smbpasswd.pl ----------------------- -Make sure you customize the local site variable in the perl script -(i.e. ldapserver, rootdn, rootpw, etc...). You can then generate -an smbpasswd file by executing - - $ export_smbpasswd.pl > smbpasswd - -NOTE: Server side (or client side) search limites may prevent -all users from being listed. Check you directory server documentation -for details. +smbldap-tools/ +-------------- +This is a collection of perl scripts (wrapped around the standard +OpenLDAP command line tools) for managing Samba and posix accounts +in an LDAP directory. See the README file included with the scripts +for more details. -ldapsync.pl & ldapchgpasswd.pl ------------------------------- +ldapsync.pl +----------- For more information on these scripts, see http://www.mami.net/univr/tng-ldap/howto/ diff --git a/examples/LDAP/convertSambaAccount b/examples/LDAP/convertSambaAccount index 223c43eada..d2770c75a6 100755 --- a/examples/LDAP/convertSambaAccount +++ b/examples/LDAP/convertSambaAccount @@ -5,24 +5,52 @@ ## ## Copyright Gerald (Jerry) Carter 2003 ## -## Usage: convertSambaAccount +## Usage: convertSambaAccount --sid= \ +## --input= --output= \ +## --changetype=[modify|add] ## use strict; use Net::LDAP::LDIF; +use Getopt::Long; -my ( $domain, $domsid ); + +############################################################################## +## local variables + +my ( $domain, $domsid, $changetype ); my ( $ldif, $ldif2 ); my ( $entry, @objclasses, $obj ); my ( $is_samba_account, $is_samba_group ); my ( %attr_map, %group_attr_map, $key ); +my ( @dels, $deletion, @adds, $addition ); +my ( $result, %options ); -if ( $#ARGV != 2 ) { - print "Usage: convertSambaAccount domain_sid input_ldif output_ldif\n"; - exit 1; + +############################################################################## +## Print the option usage + +sub usage { + + print "convertSambaAccount \n"; + print "Options:\n"; + print " --help print this help message\n"; + print " --input input LDIF filename\n"; + print " --output output LDIF filename\n"; + print " --sid domain SID\n"; + print " --changetype [modify|add] (default is 'add')\n"; } + +############################################################################## +## MAIN DRIVER ## +############################################################################## + +## +## hashes to map old attribute names to new ones +## + %attr_map = ( lmPassword => 'sambaLMPassword', ntPassword => 'sambaNTPassword', @@ -46,12 +74,60 @@ if ( $#ARGV != 2 ) { ntGroupType => 'sambaGroupType', ); -$domsid = $ARGV[0]; +## +## process command line args +## + +$result = GetOptions(\%options, + "help", + "input=s", + "output=s", + "sid=s", + "changetype=s"); + +if (!$result && ($#ARGV != -1)) { + usage(); + exit 1; +} + +if ( defined($options{'help'}) ) { + usage(); + exit 0; +} + + +if ( !defined( $options{'sid'} ) ) { + print "You must provide a domain sid\n"; + exit 1; +} + +$domsid = $options{'sid'}; -$ldif = Net::LDAP::LDIF->new ($ARGV[1], "r") - or die $!; -$ldif2 = Net::LDAP::LDIF->new ($ARGV[2], "w") - or die $!; +$changetype = 'add'; +if ( defined( $options{'changetype'} ) ) { + $changetype = $options{'changetype'}; +} + +## +## open files +## + +$ldif = Net::LDAP::LDIF->new ($options{'input'}, "r") or die $!; + +if ( "$changetype" eq "add" ) { + $ldif2 = Net::LDAP::LDIF->new ($options{'output'}, "w") or die $!; +} +elsif ( "$changetype" eq "modify" ) { + open( OUTPUT, ">$options{'output'}" ) or die $!; +} +else { + print "Bad changetype!\n"; + exit 1; +} + +## +## process LDIF +## while ( !$ldif->eof ) { undef ( $entry ); @@ -71,6 +147,8 @@ while ( !$ldif->eof ) { @objclasses = $entry->get_value( "objectClass" ); undef ( $is_samba_account ); undef ( $is_samba_group ); + @adds = (); + @dels = (); foreach $obj ( @objclasses ) { if ( "$obj" eq "sambaAccount" ) { $is_samba_account = 1; @@ -84,6 +162,8 @@ while ( !$ldif->eof ) { ## start editing the sambaAccount ## + @dels = ( 'objectclass: sambaAccount', 'rid' ); + @adds = ('objectclass: sambaSamAccount', "sambaSID: " . ${domsid} . "-" . ${entry}->get_value( 'rid' ) ); $entry->delete( 'objectclass' => [ 'sambaAccount' ] ); $entry->add( 'objectclass' => 'sambaSamAccount' ); @@ -91,6 +171,8 @@ while ( !$ldif->eof ) { $entry->delete( 'rid' ); if ( $entry->get_value( "primaryGroupID" ) ) { + push @adds, "sambaPrimaryGroupSID: " . $domsid."-".$entry->get_value( "primaryGroupID" ); + push @dels, "primaryGroupID"; $entry->add( 'sambaPrimaryGroupSID' => $domsid."-".$entry->get_value( "primaryGroupID" ) ); $entry->delete( 'primaryGroupID' ); } @@ -98,6 +180,8 @@ while ( !$ldif->eof ) { foreach $key ( keys %attr_map ) { if ( defined($entry->get_value($key)) ) { + push @adds, "$attr_map{$key}: " . $entry->get_value($key); + push @dels, "$key"; $entry->add( $attr_map{$key} => $entry->get_value($key) ); $entry->delete( $key ); } @@ -105,13 +189,39 @@ while ( !$ldif->eof ) { } elsif ( defined ( $is_samba_group ) ) { foreach $key ( keys %group_attr_map ) { if ( defined($entry->get_value($key)) ) { + push @adds, "$group_attr_map{$key}: " . $entry->get_value($key); + push @dels, "$key"; $entry->add( $group_attr_map{$key} => $entry->get_value($key) ); $entry->delete( $key ); } } } - $ldif2->write_entry( $entry ); + ## see if we should write full entries or only the changes + + if ( "$changetype" eq "add" ) { + $ldif2->write_entry( $entry ); + } + else { + if ( defined ( $is_samba_account ) || defined ( $is_samba_group ) ){ + if ( @adds + @dels > 0 ) { + print OUTPUT "dn: " . $entry->dn . "\n"; + foreach $addition (@adds) { + $addition =~ /(^\w+):/; + print OUTPUT "add: " . $1 . "\n"; + print OUTPUT "$addition\n-\n"; + } + foreach $deletion (@dels) { + if ( $deletion =~ /^(\w+):\s(.*)/ ) { + print OUTPUT "delete: $1\n$1: $2\n-\n"; + } else { + print OUTPUT "delete: $deletion\n-\n" + } + } + print OUTPUT "\n" + } + } + } } diff --git a/examples/LDAP/ldapsync.pl b/examples/LDAP/ldapsync.pl index fecc594c2d..c112bcc34c 100644 --- a/examples/LDAP/ldapsync.pl +++ b/examples/LDAP/ldapsync.pl @@ -8,6 +8,11 @@ # modified to change lmpassword and ntpassword for samba # 05/01/2001 mami@arena.sci.univr.it # modified for being also a /bin/passwd replacement +# +# ACHTUNG!! For servers that support the LDAP Modify password +# extended op (e.g. OpenLDAP), see the "ldap password +# sync" option in smb.conf(5). +# $basedn = "ou=Students,dc=univr, dc=it"; $binddn = "uid=root,dc=univr,dc=it"; diff --git a/examples/LDAP/samba-nds.schema b/examples/LDAP/samba-nds.schema new file mode 100644 index 0000000000..8369c8404e --- /dev/null +++ b/examples/LDAP/samba-nds.schema @@ -0,0 +1,151 @@ +## +## Schema file for Novell eDirectory 8.7.x by Uli Iske +## Schema for storing Samba's smbpasswd file in LDAP +## OIDs are owned by the Samba Team +## +####################################################################### +## Attributes used by Samba 3.0 schema ## +####################################################################### + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Password' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 hash of the unicode password' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Account Flags' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.27 NAME 'sambaPwdLastSet' DESC 'Timestamp of the last password update' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.28 NAME 'sambaPwdCanChange' DESC 'Timestamp of when the user is allowed to update the password' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.29 NAME 'sambaPwdMustChange' DESC 'Timestamp of when the password will expire' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.30 NAME 'sambaLogonTime' DESC 'Timestamp of last logon' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.31 NAME 'sambaLogoffTime' DESC 'Timestamp of last logoff' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.32 NAME 'sambaKickoffTime' DESC 'Timestamp of when the user will be logged off automatically' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' DESC 'Driver letter of home directory mapping' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' DESC 'Logon script path' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' DESC 'Roaming profile path' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations' DESC 'List of user workstations the user is allowed to logon to' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' DESC 'Home directory UNC path' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' DESC 'Windows NT domain to which the user belongs' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' DESC 'Security ID' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' DESC 'Primary Group Security ID' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.19 NAME 'sambaGroupType' DESC 'NT Group Type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.21 NAME 'sambaNextUserRid' DESC 'Next NT rid to give our for users' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.22 NAME 'sambaNextGroupRid' DESC 'Next NT rid to give out for groups' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.39 NAME 'sambaNextRid' DESC 'Next NT rid to give out for anything' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +dn: cn=schema +changetype: modify +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.40 NAME 'sambaAlgorithmicRidBase' DESC 'Base at which the samba RID generation algorithm should operate' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +####################################################################### +## objectClasses used by Samba 3.0 schema ## +####################################################################### +dn: cn=schema +changetype: modify +add: objectClasses +objectClasses: ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' DESC 'Samba 3.0 Auxilary SAM Account' SUP top AUXILIARY MUST ( uid $ sambaSID ) MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $sambaLogonTime $ sambaLogoffTime $sambaKickoffTime $sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $sambaProfilePath $ description $ sambaUserWorkstations $sambaPrimaryGroupSID $ sambaDomainName )) + +dn: cn=schema +changetype: modify +add: objectClasses +objectClasses: ( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' DESC 'Samba Group Mapping' SUP top AUXILIARY MUST ( gidNumber $ sambaSID $ sambaGroupType ) MAY ( displayName $ description )) + +dn: cn=schema +changetype: modify +add: objectClasses +objectClasses: ( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' DESC 'Samba Domain Information' SUP top STRUCTURAL MUST ( sambaDomainName $sambaSID ) MAY ( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $sambaAlgorithmicRidBase ) ) + +dn: cn=schema +changetype: modify +add: objectClasses +objectClasses: ( 1.3.6.1.4.1.7165.1.2.2.7 NAME 'sambaUnixIdPool' DESC 'Pool for allocating UNIX uids/gids' SUP top AUXILIARY MUST ( uidNumber $ gidNumber ) ) + +dn: cn=schema +changetype: modify +add: objectClasses +objectClasses: ( 1.3.6.1.4.1.7165.1.2.2.8 NAME 'sambaIdmapEntry' DESC 'Mapping from a SID to an ID' SUP top AUXILIARY MUST ( sambaSID ) MAY ( uidNumber $ gidNumber ) ) + +dn: cn=schema +changetype: modify +add: objectClasses +objectClasses: ( 1.3.6.1.4.1.7165.1.2.2.9 NAME 'sambaSidEntry' DESC 'Structural Class for a SID' SUP top STRUCTURAL MUST ( sambaSID ) ) diff --git a/examples/LDAP/samba-schema-netscapeds4.x b/examples/LDAP/samba-schema-netscapeds4.x index c5a11b8b66..9f40966418 100644 --- a/examples/LDAP/samba-schema-netscapeds4.x +++ b/examples/LDAP/samba-schema-netscapeds4.x @@ -1,54 +1,112 @@ # -# LDAP Schema file for SAMBA attribute storage -# This file is suitable for usage with Netscape Directory Server 4.1x -# Adapted by Scott Lawson with help from Ron Creamer -# +# LDAP Schema file for SAMBA 3.0 attribute storage +# For Netscape Directory Server 4.1x +# Prepared by Osman Demirhan + +attribute sambaLMPassword 1.3.6.1.4.1.7165.2.1.24 cis single +attribute sambaNTPassword 1.3.6.1.4.1.7165.2.1.25 cis single +attribute sambaAcctFlags 1.3.6.1.4.1.7165.2.1.26 cis single +attribute sambaPwdLastSet 1.3.6.1.4.1.7165.2.1.27 int single +attribute sambaPwdCanChange 1.3.6.1.4.1.7165.2.1.28 int single +attribute sambaPwdMustChange 1.3.6.1.4.1.7165.2.1.29 int single +attribute sambaLogonTime 1.3.6.1.4.1.7165.2.1.30 int single +attribute sambaLogoffTime 1.3.6.1.4.1.7165.2.1.31 int single +attribute sambaKickoffTime 1.3.6.1.4.1.7165.2.1.32 int single +attribute sambaHomeDrive 1.3.6.1.4.1.7165.2.1.33 cis single +attribute sambaLogonScript 1.3.6.1.4.1.7165.2.1.34 cis single +attribute sambaProfilePath 1.3.6.1.4.1.7165.2.1.35 cis single +attribute sambaUserWorkstations 1.3.6.1.4.1.7165.2.1.36 cis single +attribute sambaHomePath 1.3.6.1.4.1.7165.2.1.37 cis single +attribute sambaDomainName 1.3.6.1.4.1.7165.2.1.38 cis single +attribute sambaSID 1.3.6.1.4.1.7165.2.1.20 cis single +attribute sambaPrimaryGroupSID 1.3.6.1.4.1.7165.2.1.23 cis single +attribute sambaGroupType 1.3.6.1.4.1.7165.2.1.19 int single +attribute sambaNextUserRid 1.3.6.1.4.1.7165.2.1.21 int single +attribute sambaNextGroupRid 1.3.6.1.4.1.7165.2.1.22 int single +attribute sambaNextRid 1.3.6.1.4.1.7165.2.1.39 int single +attribute sambaAlgorithmicRidBase 1.3.6.1.4.1.7165.2.1.40 int single + +objectclass sambaSamAccount + oid + 1.3.6.1.4.1.7165.2.2.6 + superior + top + requires + objectClass, + uid, + sambaSID + allows + cn, + sambaLMPassword, + sambaNTPassword, + sambaPwdLastSet, + sambaLogonTime, + sambaLogoffTime, + sambaKickoffTime, + sambaPwdCanChange, + sambaPwdMustChange, + sambaAcctFlags, + displayName, + sambaHomePath, + sambaHomeDrive, + sambaLogonScript, + sambaProfilePath, + description, + sambaUserWorkstations, + sambaPrimaryGroupSID, + sambaDomainName + +objectclass sambaGroupMapping + oid + 1.3.6.1.4.1.7165.2.2.4 + superior + top + requires + gidNumber, + sambaSID, + sambaGroupType + allows + displayName, + description + +objectclass sambaDomain + oid + 1.3.6.1.4.1.7165.2.2.5 + superior + top + requires + sambaDomainName, + sambaSID + allows + sambaNextRid, + sambaNextGroupRid, + sambaNextUserRid, + sambaAlgorithmicRidBase -attribute lmPassword 1.3.6.1.4.1.7165.2.1.1 cis single -attribute ntPassword 1.3.6.1.4.1.7165.2.1.2 cis single -attribute acctFlags 1.3.6.1.4.1.7165.2.1.4 cis single -attribute pwdLastSet 1.3.6.1.4.1.7165.2.1.3 int single -attribute logonTime 1.3.6.1.4.1.7165.2.1.5 int single -attribute logoffTime 1.3.6.1.4.1.7165.2.1.6 int single -attribute kickoffTime 1.3.6.1.4.1.7165.2.1.7 int single -attribute pwdCanChange 1.3.6.1.4.1.7165.2.1.8 int single -attribute pwdMustChange 1.3.6.1.4.1.7165.2.1.9 int single -attribute homedrive 1.3.6.1.4.1.7165.2.1.10 cis single -attribute scriptPath 1.3.6.1.4.1.7165.2.1.11 cis single -attribute profilePath 1.3.6.1.4.1.7165.2.1.12 cis single -attribute userWorkstations 1.3.6.1.4.1.7165.2.1.13 cis single -attribute rid 1.3.6.1.4.1.7165.2.1.14 int single -attribute primaryGroupID 1.3.6.1.4.1.7165.2.1.15 int single -attribute smbHome 1.3.6.1.4.1.7165.2.1.17 cis single -attribute domain 1.3.6.1.4.1.7165.2.1.18 cis single +objectclass sambaUnixIdPool + oid + 1.3.6.1.4.1.7165.1.2.2.7 + superior + top + requires + uidNumber, + gidNumber -objectclass sambaAccount - oid - 1.3.1.5.1.4.1.7165.2.2.2 - superior - top - requires - objectClass, - uid, - rid - allows - cn, - lmPassword, - ntPassword, - pwdLastSet, - logonTime, - logoffTime, - KickoffTime, - pwdCanChange, - pwdMustChange, - acctFlags, - displayName, - smbHome, - homeDrive, - scriptPath, - profilePath, - description, - userWorkstations, - primaryGroupID, - domain +objectclass sambaIdmapEntry + oid + 1.3.6.1.4.1.7165.1.2.2.8 + superior + top + requires + sambaSID + allows + uidNumber, + gidNumber +objectclass sambaSidEntry + oid + 1.3.6.1.4.1.7165.1.2.2.9 + superior + top + requires + sambaSID diff --git a/examples/LDAP/samba-schema-netscapeds5.x b/examples/LDAP/samba-schema-netscapeds5.x index 0abc9d82e2..37c3347465 100644 --- a/examples/LDAP/samba-schema-netscapeds5.x +++ b/examples/LDAP/samba-schema-netscapeds5.x @@ -1,74 +1,35 @@ -## -## submitted by Martin.Dehn@comparex.de -## -## Experiement sambaAccount schema file Netscape DS 5.0 -## -## INSTALL-DIRECTORY/slapd-your_name/config/schema/samba-schema-netscapeds5.ldif -## -dn: cn=schema -objectClass: top -objectClass: ldapSubentry -objectClass: subschema -cn: schema -aci: (target="ldap:///cn=schema")(targetattr !="aci")(version 3.0;acl "anonymo - us, no acis"; allow (read, search, compare) userdn = "ldap:///anyone";) -aci: (targetattr = "*")(version 3.0; acl "Configuration Administrator"; allow - (all) userdn = "ldap:///uid=admin,ou=Administrators, ou=TopologyManagement, - o=NetscapeRoot";) -aci: (targetattr = "*")(version 3.0; acl "Local Directory Administrators Group - "; allow (all) groupdn = "ldap:///cn=Directory Administrators, dc=samba,dc=org";) -aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow (all)groupdn = "ld - ap:///cn=slapd-sambaldap, cn=iPlanet Directory Server, cn=Server Group, cn=iPlanetDirectory.samba.org, ou=samba.org, o=NetscapeRoot";) -modifiersName: cn=directory manager -modifyTimestamp: 20020322124844Z -objectClasses: ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTUR - AL MAY ( acctFlags $ domain $ homeDrive $ kickoffTime $ lmPassword $ logofft - ime $ logonTime $ ntPassword $ primaryGroupID $ profilePath $ pwdCanChange $ - pwdLastSet $ pwdMustChange $ rid $ scriptPath $ smbHome $ userWorkstations - ) X-ORIGIN 'user defined' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.11 NAME 'scriptPath' DESC 'NT script pa - th' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined - ' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.5 NAME 'logonTime' DESC 'NT logon time' - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.12 NAME 'profilePath' DESC 'NT profile - path' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defin - ed' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.8 NAME 'pwdCanChange' DESC 'NT passwd c - an change' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user - defined' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.17 NAME 'smbHome' DESC 'smbHome' SYNTAX - 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.3 NAME 'pwdLastSet' SYNTAX 1.3.6.1.4.1 - .1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.18 NAME 'domain' DESC 'Windows NT domai - n Samba' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user de - fined' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.10 NAME 'homeDrive' DESC 'NT home drive - ' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' - ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.6 NAME 'logofftime' DESC 'logoff Time' - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.15 NAME 'primaryGroupID' DESC 'NT Group - RID' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defin - ed' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.1 NAME 'lmPassword' DESC 'LanManager Pa - sswd' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defin - ed' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.9 NAME 'pwdMustChange' DESC 'NT pwdmust - chnage' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user def - ined' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.4 NAME 'acctFlags' DESC 'Account Flags' - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.13 NAME 'userWorkstations' DESC 'userWo - rkstations' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user - defined' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.7 NAME 'kickoffTime' DESC 'NT kickoff T - ime' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user define - d' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.14 NAME 'rid' DESC 'rid' SYNTAX 1.3.6.1 - .4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) -attributeTypes: ( 1.3.6.1.4.1.7165.2.1.2 NAME 'ntPassword' DESC 'NT Passwd' SY - NTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' ) -nsSchemaCSN: 3c9b282c000000000000 - +## +## Garren Chew +## +## Samba 3.0 schema file for Netscape DS 5.x +## +## INSTALL-DIRECTORY/slapd-your_name/config/schema/samba-schema-netscapeds5.ldif + +objectClasses: ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY DESC 'Samba 3.0 Auxilary SAM Account' MUST ( uid $ sambaSID ) MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $ sambaProfilePath $ description $ sambaUserWorkstations $ sambaPrimaryGroupSID $ sambaDomainName ) X-ORIGIN 'user defined' ) +objectClasses: ( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' SUP top AUXILIARY DESC 'Samba Group Mapping' MUST ( gidNumber $ sambaSID $ sambaGroupType ) MAY ( displayName $ description ) X-ORIGIN 'user defined' ) +objectClasses: ( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' SUP top STRUCTURAL DESC 'Samba Domain Information' MUST ( sambaDomainName $ sambaSID ) MAY ( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ sambaAlgorithmicRidBase ) X-ORIGIN 'user defined' ) +objectClasses: ( 1.3.6.1.4.1.7165.1.2.2.7 NAME 'sambaUnixIdPool' SUP top AUXILIARY DESC 'Pool for allocating UNIX uids/gids' MUST ( uidNumber $ gidNumber ) X-ORIGIN 'user defined' ) +objectClasses: ( 1.3.6.1.4.1.7165.1.2.2.8 NAME 'sambaIdmapEntry' SUP top AUXILIARY DESC 'Mapping from a SID to an ID' MUST ( sambaSID ) MAY ( uidNumber $ gidNumber ) X-ORIGIN 'user defined' ) +objectClasses: ( 1.3.6.1.4.1.7165.1.2.2.9 NAME 'sambaSidEntry' SUP top STRUCTURAL DESC 'Structural Class for a SID' MUST ( sambaSID ) X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 hash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Account Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{16} SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.27 NAME 'sambaPwdLastSet' DESC 'Timestamp of the last password update' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.28 NAME 'sambaPwdCanChange' DESC 'Timestamp of when the user is allowed to update the password' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.29 NAME 'sambaPwdMustChange' DESC 'Timestamp of when the password will expire' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.30 NAME 'sambaLogonTime' DESC 'Timestamp of last logon' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.31 NAME 'sambaLogoffTime' DESC 'Timestamp of last logoff' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.32 NAME 'sambaKickoffTime' DESC 'Timestamp of when the user will be logged off automatically' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' DESC 'Driver letter of home directory mapping' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' DESC 'Logon script path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' DESC 'Roaming profile path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations' DESC 'List of user workstations the user is allowed to logon to' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' DESC 'Home directory UNC path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' DESC 'Windows NT domain to which the user belongs' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' DESC 'Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' DESC 'Primary Group Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.19 NAME 'sambaGroupType' DESC 'NT Group Type' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.21 NAME 'sambaNextUserRid' DESC 'Next NT rid to give our for users' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.22 NAME 'sambaNextGroupRid' DESC 'Next NT rid to give out for groups' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.39 NAME 'sambaNextRid' DESC 'Next NT rid to give out for anything' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) +attributeTypes: ( 1.3.6.1.4.1.7165.2.1.40 NAME 'sambaAlgorithmicRidBase' DESC 'Base at which the samba RID generation algorithm should operate' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' ) diff --git a/examples/LDAP/samba.schema b/examples/LDAP/samba.schema index 6e8387f16e..14cd720588 100644 --- a/examples/LDAP/samba.schema +++ b/examples/LDAP/samba.schema @@ -1,10 +1,11 @@ ## -## schema file for OpenLDAP 2.0.x -## Schema for storing Samba's smbpasswd file in LDAP +## schema file for OpenLDAP 2.x +## Schema for storing Samba user accounts and group maps in LDAP ## OIDs are owned by the Samba Team ## -## Prerequisite schemas - uid (cosine.schema) +## Prerequisite schemas - uid (cosine.schema) ## - displayName (inetorgperson.schema) +## - gidNumber (nis.schema) ## ## 1.3.6.1.4.1.7165.2.1.x - attributetypes ## 1.3.6.1.4.1.7165.2.2.x - objectclasses diff --git a/examples/LDAP/smbldap-tools/AUTHORS b/examples/LDAP/smbldap-tools/AUTHORS new file mode 100644 index 0000000000..e69de29bb2 diff --git a/examples/LDAP/smbldap-tools/CONTRIBUTORS b/examples/LDAP/smbldap-tools/CONTRIBUTORS new file mode 100644 index 0000000000..1b308a7266 --- /dev/null +++ b/examples/LDAP/smbldap-tools/CONTRIBUTORS @@ -0,0 +1,29 @@ +# $Source: /data/src/mirror/cvs/samba/examples/LDAP/smbldap-tools/CONTRIBUTORS,v $ +# +## Authors and actives contributors to SMBLDAP-TOOLS + +Have contributed directly to this tools, or are always in charge of +some aspects of it developments (alphabetical order): + . Terry Davis + . David Le Corfec + . Olivier Lemaire + . Jérôme Tournier + +Many thanks to contributors for bug report and patches: + . Gert-Jan Braas + bug report for 2.2.3 samba.schema + . Jody Haynes + originaly passwd.pl + . Brad Langhorst + package relocatability + . Mirko Manea + originaly useradd.pl + . Alain Richard + bug report and Perl tips + . Roland Schulz + bug report for smbldap-passwd + . Xavier Boschian + bug report for smbldap-populate + . Christophe DUBREUIL + Net::LDAP support in smbldap_tools.pm +# - The End diff --git a/examples/LDAP/smbldap-tools/COPYING b/examples/LDAP/smbldap-tools/COPYING new file mode 100644 index 0000000000..32d0e6014a --- /dev/null +++ b/examples/LDAP/smbldap-tools/COPYING @@ -0,0 +1,340 @@ + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc. + 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Library General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) 19yy + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + + +Also add information on how to contact you by electronic and paper mail. + +If the program is interactive, make it output a short notice like this +when it starts in an interactive mode: + + Gnomovision version 69, Copyright (C) 19yy name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, the commands you use may +be called something other than `show w' and `show c'; they could even be +mouse-clicks or menu items--whatever suits your program. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + + , 1 April 1989 + Ty Coon, President of Vice + +This General Public License does not permit incorporating your program into +proprietary programs. If your program is a subroutine library, you may +consider it more useful to permit linking proprietary applications with the +library. If this is what you want to do, use the GNU Library General +Public License instead of this License. diff --git a/examples/LDAP/smbldap-tools/ChangeLog b/examples/LDAP/smbldap-tools/ChangeLog new file mode 100644 index 0000000000..76b8b3f3c6 --- /dev/null +++ b/examples/LDAP/smbldap-tools/ChangeLog @@ -0,0 +1,30 @@ +# $Source: /data/src/mirror/cvs/samba/examples/LDAP/smbldap-tools/ChangeLog,v $ +# +## ChangeLog for SMBLDAP-TOOLS + +* 2002-07-24: top and account objectclasses replaced with inetorgperson +* 2002-06-03: notes to webmin.idealx.org (idxldapaccounts) +* 2002-06-01: release 0.7. tested with 2.2.4 +* 2002-05-31: fixed smbldap-populate compliance to smbldap_conf + cleaned up smbldap_conf to be more readable + some more documentation + bugfixes on smbldap-passwd and smbldap-populate +* 2002-05-16: modified default mode on homes: now 700 +* 2002-05-13: fixed spec (relocation and reqs) +* 2002-03-02: fixed 2.2.3 sambaAccount bug with smbldap-useradd.pl + (rid is now mandatory in the sambaAccount objectClass) +* 2002-02-14: just modified default populate for Administrator +* 2002-02-05: release 0.6. enable/disable user in usermod +* 2002-02-04: release 0.5. added smbldap-migrate-groups to migrate NT groups + from a net group dump. added samba parameters to smbldap-useradd + and smbldap-usermod. +* 2002-01-12: added smbldap-migrate-accounts to migrate users/machines + accounts from a PWDUMP dump +* 2001-12-13: added smbldap-populate to create the initial base +* 2001-12-13: initial release 0.1 +* 2001-12-12: fixed the SPEC file for RedHat +* 2001-12-03: cleaned the code and use strict; +* 2001-11-20: initial needs (for testing purpose on Samba-2.2.2 an Samba-TNG) + + +# - The End diff --git a/examples/LDAP/smbldap-tools/FILES b/examples/LDAP/smbldap-tools/FILES new file mode 100644 index 0000000000..48ee571b29 --- /dev/null +++ b/examples/LDAP/smbldap-tools/FILES @@ -0,0 +1,43 @@ +# $Source: /data/src/mirror/cvs/samba/examples/LDAP/smbldap-tools/FILES,v $ +# +## File listing for SMBLDAP-TOOLS + +CONTRIBUTORS : authors and contributors +COPYING : licence +FILES : this file listing +README : introduction and usage +TODO : feature request and bug report list +ChangeLog : changelog + +Core: +=-=-= +smbldap-groupadd.pl : to add a new group + (objectclass: posixGroup) +smbldap-groupdel.pl : to delete a group + (objectclass: posixGroup) +smbldap-groupmod.pl : to modify a group (mostly used to add user to a group) + (objectclass: posixGroup) +smbldap-groupshow.pl : to view a group + (objectclass: posixGroup) +smbldap_conf.pm : global configuration datas +smbldap_tools.pm : functions +smbldap-useradd.pl : to add a new user + (objectclass: posixAccount and/or sambaAccount) +smbldap-userdel.pl : to delete a user + (objectclass: posixAccount and/or sambaAccount) +smbldap-usermod.pl : to modify an user datas + (objectclass: posixAccount and/or sambaAccount) +smbldap-usershow.pl : to view an user datas + (objectclass: posixAccount and/or sambaAccount) +smbldap-passwd.pl : to sync passwd (Unix and Samba) + (a replacement for the system passwd utility) +smbldap-populate.pl : to add a builtin ldif to initialize your LDAP master for + smbldap use, or to add a specified ldif +smbldap-tools.spec : SPEC file for RedHat RPM package format + +Migration: +=-=-=-=-=- +smbldap-migrate-accounts.pl : add NT sam entries from pwdump to ldap +smbldap-migrate-groups.pl : add any LDAP posixGroups from the output of the 'net group' NT command + +# - The End diff --git a/examples/LDAP/smbldap-tools/INFRASTRUCTURE b/examples/LDAP/smbldap-tools/INFRASTRUCTURE new file mode 100644 index 0000000000..75b80bb4c8 --- /dev/null +++ b/examples/LDAP/smbldap-tools/INFRASTRUCTURE @@ -0,0 +1,84 @@ +# $Source: /data/src/mirror/cvs/samba/examples/LDAP/smbldap-tools/INFRASTRUCTURE,v $ +# +## Some notes about the architecture + + +Global Architecture for smbdlap-tools +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= + +smbldap-tools help you manage users and groups for Unix and Samba, +using LDAP. They may be used in any context, and are kept relatively +simplier enought to let you customize them to you needs. + +They need the following objectClasses to work: + . sambaAccount: from samba.schema for Samba 2.2 branch + . posixAccount and posixGroup : from nis.schema + . organizationalUnit and dcObject: from core.schema + +They will probably use in a near future some additional objectClasses +to support : + . mail features (sendmail/postfix/qmail/courier). + . conform to RFC2307 best practices (and so some maps too like merging + Netbios computers (sambaAccounts) with ipHosts + +For ease of visualization of the LDAP objects by human standards, we +used a DIT like this one : + . dc=IDEALX,dc=org : the company/organization suffix + . ou=Users : to store users accounts + . ou=Computers : to store computers accounts + . ou=Groups : to store system groups +Of course, you're free to use a different naming scheme and DIT (see +smbldap_conf.pm). + + +Built in groups initial population +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= + +smbldap-populate.pl populate the LDAP directory with some built in groups +using gidNumber according to Well Know RID of Windows NT4 Srv. In fact, As +far a Samba 2.2.x is concerned, only the 'Domain Admins' (gidNumber 512) have +real inpact on the Samba and Windows population. To activate this group as +the Domain Administrators Group, use the following smb.conf directive (see +man smb.conf for more): + + domain admin group = " @"Domain Admins" " + +Other built in groups are really cosmetic ones with Samba 2.2.x. We did not +removed them because one of these days, we whish to use Samba 3.0 where +Windows Group Support should be operational. + +Why these specific gidNumbers ? +It's about unix/windows mapping of numerical ids with Samba. Ids below 1024 +are NT special ids. In fact, 512 is the RID (Windows uid/gid) for the +"Domain Administrators" NT group. The magic number is found in Samba sources +and possibly other Samba/Windows documentations. + +The goal is to have a set of Unix users who are Domain Administrators and can +modify Samba datas (eg. LDAP content), with commandline tools or within +Windows via Samba. + +Say you want to add a NT4 ws to an NT domain (controlled by a samba/ldap +server). You give the domain administrator's login and password in the +appropriate ws settings, then the ws contacts the samba server, which checks +the credentials and use them as unix user to run the smbldap-tools (if I +remember). Giving 512 as a RID to a LDAP entry marks it as a domain admin +for Samba (thus Windows). Using nss_ldap, you also have an account with +gid 512. + + +Known BUGS and WORKAROUND used +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= + +The 2.2.2 has at least a bug : rid/primaryGroupID are read as hex in LDAP, +but written as decimal. Fixed in CVS by reading as decimal. By default +smbldap-useradd.pl writes decimal to LDAP. Use -x to support the odd +behaviour. + +The samba-2.2.4-ldapbindnotuid0.patch is not a perfect solution however +as the check is there because Samba store admin credentials to establish the +LDAP connection. The uid == 0 check was to ensure that a normal user could +not get write access to the LDAP backend. A more logical situation should be +done for 2.2.5 by checking if the user is a member of the domain admin group +(reported to Jerremy and Gerald 2002-05-28). + +# - The End diff --git a/examples/LDAP/smbldap-tools/INSTALL b/examples/LDAP/smbldap-tools/INSTALL new file mode 100644 index 0000000000..f4c72751a7 --- /dev/null +++ b/examples/LDAP/smbldap-tools/INSTALL @@ -0,0 +1,28 @@ +# $Source: /data/src/mirror/cvs/samba/examples/LDAP/smbldap-tools/INSTALL,v $ +# +## How To Install SMBLDAP-TOOLS + +Quick & Dirty: +=-=-=-=-=-=-=- + . Copy all those scripts in /usr/local/sbin/ + . Modify smbldap_conf.pm to match your configuration + . If not already done : "smbpasswd -w secret" to set up + the ldap admin password in secrets.tdb + . Either add /usr/local/sbin in $PERLLIB or run the scripts + from this directory, or make a symlink from /usr/local/sbin/*.pm + to /usr/lib/perl5/. + . to allow a domain admin to add user using "add user script" in smb.conf : + chmod 753 smbldap_conf.pm + chmod 750 smbldap-useradd.pl + chgrp 512 smbldap_conf.pm smbldap-useradd.pl (512 = 0x200 = Domain Admins) + Have your admin belong to this group + In smb.conf : domain admin group = " @"Domain Admins" " + +RedHat RPM: +=-=-=-=-=-= +Install smbldap-tools-0.7-1.i386.rpm +Modify /usr/local/sbin/smbldap_conf.pm to match you configuration +If not already done : "smbpasswd -w secret" to set up +the ldap admin password in secrets.tdb + +# - The End diff --git a/examples/LDAP/smbldap-tools/Makefile b/examples/LDAP/smbldap-tools/Makefile new file mode 100644 index 0000000000..3e5eac427d --- /dev/null +++ b/examples/LDAP/smbldap-tools/Makefile @@ -0,0 +1,35 @@ +PACKAGE=smbldap-tools +RELEASE=0.7 +DESTDIR = $(PACKAGE)-$(RELEASE) + +dist: distclean $(DESTDIR).tgz + +$(DESTDIR).tgz: .diststamp + rm -rf $(DESTDIR) + mkdir $(DESTDIR) + # copy files + cp CONTRIBUTORS $(DESTDIR) + cp COPYING $(DESTDIR) + cp ChangeLog $(DESTDIR) + cp FILES $(DESTDIR) + cp INSTALL $(DESTDIR) + cp README $(DESTDIR) + cp TODO $(DESTDIR) + cp INFRASTRUCTURE $(DESTDIR) + tar cf mkntpwd.tar mkntpwd + gzip mkntpwd.tar + cp mkntpwd.tar.gz $(DESTDIR) + cp smbldap-*.pl $(DESTDIR) + cp smbldap_*.pm $(DESTDIR) + # copy directories + tar cvzf $(DESTDIR).tgz $(DESTDIR) + rm -rf $(DESTDIR) + touch .diststamp + +.diststamp: + +distclean: + rm -f *~ + rm -f $(DESTDIR).tgz + rm -f mkntpwd.tar.gz + diff --git a/examples/LDAP/smbldap-tools/NEWS b/examples/LDAP/smbldap-tools/NEWS new file mode 100644 index 0000000000..e69de29bb2 diff --git a/examples/LDAP/smbldap-tools/README b/examples/LDAP/smbldap-tools/README new file mode 100644 index 0000000000..add0175c0c --- /dev/null +++ b/examples/LDAP/smbldap-tools/README @@ -0,0 +1,87 @@ +# $Source: /data/src/mirror/cvs/samba/examples/LDAP/smbldap-tools/README,v $ +# + +Latest version may be found at http://samba.idealx.org/ + + +What those tools are for? +=-=-=-=-=-=-=-=-=-=-=-=-= + +A collection of scripts, «over» user{add,del,mod} and group{add,del,mod} +system tools to manipulate users and groups stored in LDAP directory, +for DEN system like SAMBA-LDAP and pam/nss_ldap systems. + +Additionnaly, some scripts are designed to ease your migration from +a Windows NT 4.0 PDC Server to a Samba-LDAP PDC Server (Killer?;-): +smbldap-populate, smbldap-migrate-groups, smbldap-migrate-accounts. + +They are currently used with Samba 2.2.4, therefore you may (will) have +to make some fixes for Samba TNG and Samba 3.0. Hint: contribs welcome :) + +In the future, some other function may come (like backup and restore, +Novell migration tools, samba system activity report, dealing with +mail functions, compliance to RFC2307...): consult TODO. + + +What do SMBLDAP-TOOLS provide? +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= +Those tools provide the following functions : + . populate LDAP database with a basic LDIF + . add a user or group + . delete a user or group + . modify all users or groups data (all attributes types stored in + posixAccount and sambaAccount object class) +Taking care of : + . staying compatible with all standard system tools options + (user/group{add,del,mod}) + . be extensible for future developments + (manipulation of shadow account options, for example) + . error management, in the way system tools do +Constraints : + . usage of PERL (portability) + . all options must be placed in an external configuration file + . english localization + +The current release uses the "mkntpwd" program, in mkntpwd.tar.gz +in the current directory. It comes from +http://www.demog.berkeley.edu/~aperrin/tips/src/mkntpwd.tar.gz +It allows to not use smbpasswd (if $with_smbpasswd == 0 in smbldap_conf.pm) + +What do SMBLDAP-TOOLS deliver? +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- +Contents : + . scripts (see FILES) + . user documentation in pod format, included in the sources + (or just use the -? option) + +These tools aim at delivering the same functionality as the corresponding +system tools. However they may not be all implemented yet. +Current limitations : + . no shadow support + . cannot change uid with usermod + . no UTF-8 support (thus ASCII-7 only) + + +How to generate documentation? +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= +Just issue the following command: + perldoc name_of_script.pl (ex: perldoc smbldap-useradd.pl) + +Where can I find the latest release of those scripts? +=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= + +Just fire any web browser to http://samba.IDEALX.org/ +and/or contact samba@IDEALX.org + +Additionnaly, you will find an useful Webmin module +at http://webmin.IDEALX.org/ if interested in a graphical +user interface to manager user and groups accounts via Webmin +for your Samba+LDAP PDC. + +Let us know if these tools helped you, or if we should enhance +them with some functions you want them to support. + +Sincerly, + LEM + +# - The End diff --git a/examples/LDAP/smbldap-tools/TODO b/examples/LDAP/smbldap-tools/TODO new file mode 100644 index 0000000000..71e6695299 --- /dev/null +++ b/examples/LDAP/smbldap-tools/TODO @@ -0,0 +1,28 @@ +# $Source: /data/src/mirror/cvs/samba/examples/LDAP/smbldap-tools/TODO,v $ +# +## TODO list - First In, Last in the list... +## (BF: Bug Report / FR: Feature Request) + + +FR * add 'LDAP port' for both slave and master LDAP server in smbldap_conf.pm +FR * use RFC2307 best practices (Luke, next time you visit Paris, have a + beer at IDEALX'cantina ;-) +FR * add mail (sendmail/postfix/qmail/courier) support +FR * bugfix, really : allow non-root users to change passwd + (currently the config must be unreadable because of bindpasswd) +FR * make smbldap-tools to use system configuration files + (/etc/login.defs and /etc/ldap.conf for example) +FR * rewrite smbldap-tools using perl-ldap. In fact, this 0.x + release use ldap system tools (ldapadd,ldapdelete,ldapmodify) +FR * add shadowAccounts manipulation support +FR * internationalize the SMBLDAP-TOOLS +FR * add smbldap-sar : Samba System Activity Report to help + supporting Samba/LDAP sysadmin activity +FR * add smbldap-backup/smbldap-restore to backup and restore + a SAM (in LDAP) database. No sorcery, just LDIF, but usefull + for non-LDAP gurus +FR * adding migration tools from migration from W2K and NetWare to Samba-LDAP +FR * adapt smbldap-tools to use Samba 3.0 + + +# - The End diff --git a/examples/LDAP/smbldap-tools/cgi/README b/examples/LDAP/smbldap-tools/cgi/README new file mode 100644 index 0000000000..7a4fc0c02b --- /dev/null +++ b/examples/LDAP/smbldap-tools/cgi/README @@ -0,0 +1,27 @@ +Description: + A cgi to allow users to change their passwords via a web browser. + +Installation: + Drop this into a cgi-enabled directory on your webserver. + Edit it and change the CONFIGURATION section to suit your environment. + READ THE NOTES SECTION. + +Notes: This script will run as the user who runs your web server. So, to invoke the smbpasswd call, you must implement sudo. + Example of /etc/sudoers: + + # Host alias specification + # User alias specification + User_Alias PASSWD = apache + # Cmnd alias specification + Cmnd_Alias PASSWD = /usr/bin/smbpasswd + # User privilege specification + root ALL=(ALL) ALL + PASSWD ALL= NOPASSWD: PASSWD + + This concept is probably very insecure and broken. That is why this is a 0.1 release. :) + + +Feel free to drop me suggestions. I am a perl learner so I am always open to suggestions. + +Terry Davis +tdavis@approbation.org diff --git a/examples/LDAP/smbldap-tools/cgi/ldappass.cgi b/examples/LDAP/smbldap-tools/cgi/ldappass.cgi new file mode 100755 index 0000000000..4a5ecb8f3a --- /dev/null +++ b/examples/LDAP/smbldap-tools/cgi/ldappass.cgi @@ -0,0 +1,202 @@ +#!/usr/bin/perl + +################################################################################ +# +# changepass.pl - A program to allow users to change their passwords +# via a web browser. +# Terry Davis +# +# URLs +# Net::LDAP - http:// +# usermod and this file - http://www.cloudamster.com/cloudmaster/projects +# +# Release History: +# Version 0.1 - initial write +# +# ToDo: +# ... the ToDo section is on the ToDo list... +# +# Limitations: +# The password cannot contain single and double quotes.....welcome to quoting hell.... +# +# Notes: +# This code is largely based on work done by Danny Sauer - http://www.cloudamster.com/cloudmaster/projects +# His work is not licensed and is marked as 'freely distributable'. +# Thank you to Danny for his hard work on the initial work. +# +################################################################################ + +use CGI qw(:standard); +use Net::LDAP; + +# CONFIGURATION SECTION +$masterLDAP = "ldap.idealx.org"; +$basedn = "dc=IDEALX,dc=org"; +$masterPw = ""; +$masterDN = "cn=manager,$basedn"; +$ldap_path = "/usr/bin"; +$ldap_opts = "-x"; +$ldappasswd = "$ldap_path/ldappasswd $ldap_opts -h $masterLDAP -D '$masterDN' -w '$masterPw'"; +$usersdn = "ou=Users,$basedn"; +# END CONFIGURATION + + + +# DONT EDIT ANYTHING BELOW THIS LINE +$logtag = "Login:"; +$passtag = "Current password:"; +$npasstag1 = "New password:"; +$npasstag2 = "Retype new pasword:"; +$error = ""; +$color = ""; +$stopcolor = ""; + +if(param()){ + nologin() unless ($username = param('login')); + nopass() unless ($oldpass = param('oldpass')); + nonewpass(1) unless ($newpass1 = param('newpass')); + nonewpass(2) unless ($newpass2 = param('newpass2')); + verifyuser($username) or die "bad user"; + verifypass($username, $oldpass) or die "bad pass"; + testnewpass($newpass1, $newpass2) or die "bad new pass"; + changepass($username, $newpass1) or die "couldn't change pass"; + printsuccess(); +}else{ + printpage(); +} +exit(0); + +sub verifyuser{ + local $user = shift; + $ldap = Net::LDAP->new($masterLDAP) or die "can't make new LDAP object: $@"; + $ldap->bind(); + if (0 < $ldap->search(base => $basedn, filter => "(uid=$user)")->count){ + return 1; + } + $logtag = $color . $logtag . $color; + $error = "No such user"; + printpage(); + return 0; +} + +sub verifypass{ + $uid = shift; + $pass = shift; + $ldap = Net::LDAP->new($masterLDAP) or die "can't make new LDAP object: $@"; + $binddn = "uid=$uid,ou=People,$basedn"; + return 1 if($ldap->bind( $binddn, password => $pass)->code == 0); + if($ldap->bind()){ + $passtag = $color . $passtag . $color; + $error = "Incorrect password"; + printpage(); + return 0; + }else{ + print header, start_html(-title=>"LDAP dead"); + print h2("
    The LDAP server is temporarily unavailable."), + p,"Please try again later
    "; + return 0; + }die "Something (or someone) is defective, contact your friendly Systems Administrator"; +} + +sub testnewpass{ + $p1 = shift; $p2 = shift; + if ($p1 ne $p2){ + $npasstag1 = $color . $npasstag1 . $color; + $npasstag2 = $color . $npasstag2 . $color; + $error = "Passwords don't match ($p1 vs $p2)"; + printpage(); + return 0; + } + if ($p1 =~ /"/ ){ + $npasstag1 = $color . $npasstag1 . $color; + $npasstag2 = $color . $npasstag2 . $color; + $error = "Passwords cannot contain double quotes. Sorry"; + printpage(); + return 0; + } + if ($p1 =~ /'/ ){ + $npasstag1 = $color . $npasstag1 . $color; + $npasstag2 = $color . $npasstag2 . $color; + $error = "Passwords cannot contain single quotes. Sorry"; + printpage(); + return 0; + } + return 1; +} + +sub changepass{ + local $user = shift; + local $newpass = shift; + local $dn = "uid=$user,$usersdn"; + system "$ldappasswd $dn -s '$newpass' > /dev/null"; + `/usr/bin/sudo /usr/bin/smbpasswd $user "$newpass"`; + exit(1); +} + +sub nologin{ + $logtag = $color . $logtag . $color; + $error = "You need to enter a Login Name"; + printpage(); + exit(1); +} + +sub nopass{ + $passtag = $color . $passtag . $color; + $error = "Please enter your old password"; + printpage(); + exit(1); +} + +sub nonewpass{ + $f=shift; + $npasstag1 = $color . $npasstag1 . $color if($f==1); + $npasstag2 = $color . $npasstag2 . $color if($f==2); + $error = "You need to enter your new password"; + $error .= " twice" if($f==2); + printpage(); + exit(1); +} + +sub printpage{ + print header, + start_html(-title=> "Password Change Page", + -author=> 'tdavis@birddog.com', + -BGCOLOR=> 'WHITE'), + h3('Password Change Page'), + startform(-method=>'POST'), + "", + "", + "
    ", + $logtag, + "", + textfield(-name=>'login', -default=>$login, + -size=>15, -maxlength=>20), + "
    ", + $passtag, + "", + password_field(-name=>'oldpass', -size=>15, -maxlength=>25), + "
    ", + $npasstag1, + "", + password_field(-name=>'newpass', -size=>15, -maxlength=>25), + "
    ", + $npasstag2, + "", + password_field(-name=>'newpass2', -size=>15, -maxlength=>25), + "
    ", + submit(-name=>"change"),reset(), + "
    ", + "", + endform(), + "$error", + end_html; +} + +sub printsuccess(){ + print header, + start_html(-title=> "Success", + -BGCOLOR=> 'WHITE'), + h1("Password Succesfully Changed"), + "
    ", + end_html; +} diff --git a/examples/LDAP/smbldap-tools/mkntpwd/Makefile b/examples/LDAP/smbldap-tools/mkntpwd/Makefile new file mode 100644 index 0000000000..23c9d471b0 --- /dev/null +++ b/examples/LDAP/smbldap-tools/mkntpwd/Makefile @@ -0,0 +1,62 @@ +# Makefile for l0phtcrack - mudge@l0pht.com 11/1/96 + +# C compiler +#CC=cc +CC=gcc + +# Uncomment the following to add symbols to the code for debugging +#DEBUG=-g -Wall -D_DEBUG +#DEBUG=-D_DEBUG + +# Optimization for the compiler +#OPTIMIZE= +OPTIMIZE=-O2 + +# Choose your architecture +# note that if you are on a big-endian machine like SUN's +# I haven't tweaked the mem-cmp's and md4 stuff to be in +# the correct order yet. You're on your own right now. +# +# FreeBSD +ARCH=-DMPU8086 +STATIC= +XLIBS= +# +# SUNOS +#ARCH=-DBIGENDIAN +#STATIC= +#OPTIMIZE=-O2 +#XLIBS= +# +# ULTRA_SPARC w/ native compiler +#ARCH=-DBIGENDIAN +#STATIC= +#OPTIMIZE=-fast -xO4 -xdepend -xchip=ultra -xarch=v8plus +#XLIBS= +# +# SunOS/Solaris w/gcc +#ARCH=-DBIGENDIAN -DTEST +#STATIC= +#OPTIMIZE=-O2 +#XLIBS= +# +# NeXTStep 3.2 +#CC=cc +#ARCH=-DBIGENDIAN +#STATIC=-Bstatic +#OPTIMIZE= +#XLIBS= + +CFLAGS= $(DEBUG) $(OPTIMIZE) $(ARCH) $(VISUAL) $(PERMUTE) $(STATIC) + +OBJS = getopt.o md4.o mkntpwd.o smbdes.o + +mkntpwd: $(OBJS) + $(CC) $(CFLAGS) $(XLIBS) -o mkntpwd $(OBJS) + +clean: + rm -f core *.o mkntpwd + +install: mkntpwd + install -m 555 mkntpwd $(PREFIX)/sbin/mkntpwd + diff --git a/examples/LDAP/smbldap-tools/mkntpwd/getopt.c b/examples/LDAP/smbldap-tools/mkntpwd/getopt.c new file mode 100644 index 0000000000..5b2e7a9100 --- /dev/null +++ b/examples/LDAP/smbldap-tools/mkntpwd/getopt.c @@ -0,0 +1,756 @@ +/* Getopt for GNU. + NOTE: getopt is now part of the C library, so if you don't know what + "Keep this file name-space clean" means, talk to roland@gnu.ai.mit.edu + before changing it! + + Copyright (C) 1987, 88, 89, 90, 91, 92, 93, 94 + Free Software Foundation, Inc. + +This file is part of the GNU C Library. Its master source is NOT part of +the C library, however. The master source lives in /gd/gnu/lib. + +The GNU C Library is free software; you can redistribute it and/or +modify it under the terms of the GNU Library General Public License as +published by the Free Software Foundation; either version 2 of the +License, or (at your option) any later version. + +The GNU C Library is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +Library General Public License for more details. + +You should have received a copy of the GNU Library General Public +License along with the GNU C Library; see the file COPYING.LIB. If +not, write to the Free Software Foundation, Inc., 675 Mass Ave, +Cambridge, MA 02139, USA. */ + +/* This tells Alpha OSF/1 not to define a getopt prototype in . + Ditto for AIX 3.2 and . */ +#ifndef _NO_PROTO +#define _NO_PROTO +#endif + +#ifdef HAVE_CONFIG_H +#include +#endif + +#if !defined (__STDC__) || !__STDC__ +/* This is a separate conditional since some stdc systems + reject `defined (const)'. */ +#ifndef const +#define const +#endif +#endif + +#include + +#ifdef WIN32 +#include +#endif + +/* Comment out all this code if we are using the GNU C Library, and are not + actually compiling the library itself. This code is part of the GNU C + Library, but also included in many other GNU distributions. Compiling + and linking in this code is a waste when using the GNU C library + (especially if it is a shared library). Rather than having every GNU + program understand `configure --with-gnu-libc' and omit the object files, + it is simpler to just do this in the source for each such file. */ + +#if defined (_LIBC) || !defined (__GNU_LIBRARY__) + + +/* This needs to come after some library #include + to get __GNU_LIBRARY__ defined. */ +#ifdef __GNU_LIBRARY__ +/* Don't include stdlib.h for non-GNU C libraries because some of them + contain conflicting prototypes for getopt. */ +#include +#endif /* GNU C library. */ + +/* This version of `getopt' appears to the caller like standard Unix `getopt' + but it behaves differently for the user, since it allows the user + to intersperse the options with the other arguments. + + As `getopt' works, it permutes the elements of ARGV so that, + when it is done, all the options precede everything else. Thus + all application programs are extended to handle flexible argument order. + + Setting the environment variable POSIXLY_CORRECT disables permutation. + Then the behavior is completely standard. + + GNU application programs can use a third alternative mode in which + they can distinguish the relative order of options and other arguments. */ + +#include "getopt.h" + +/* For communication from `getopt' to the caller. + When `getopt' finds an option that takes an argument, + the argument value is returned here. + Also, when `ordering' is RETURN_IN_ORDER, + each non-option ARGV-element is returned here. */ + +char *optarg = NULL; + +/* Index in ARGV of the next element to be scanned. + This is used for communication to and from the caller + and for communication between successive calls to `getopt'. + + On entry to `getopt', zero means this is the first call; initialize. + + When `getopt' returns EOF, this is the index of the first of the + non-option elements that the caller should itself scan. + + Otherwise, `optind' communicates from one call to the next + how much of ARGV has been scanned so far. */ + +/* XXX 1003.2 says this must be 1 before any call. */ +int optind = 0; + +/* The next char to be scanned in the option-element + in which the last option character we returned was found. + This allows us to pick up the scan where we left off. + + If this is zero, or a null string, it means resume the scan + by advancing to the next ARGV-element. */ + +static char *nextchar; + +/* Callers store zero here to inhibit the error message + for unrecognized options. */ + +int opterr = 1; + +/* Set to an option character which was unrecognized. + This must be initialized on some systems to avoid linking in the + system's own getopt implementation. */ + +int optopt = '?'; + +/* Describe how to deal with options that follow non-option ARGV-elements. + + If the caller did not specify anything, + the default is REQUIRE_ORDER if the environment variable + POSIXLY_CORRECT is defined, PERMUTE otherwise. + + REQUIRE_ORDER means don't recognize them as options; + stop option processing when the first non-option is seen. + This is what Unix does. + This mode of operation is selected by either setting the environment + variable POSIXLY_CORRECT, or using `+' as the first character + of the list of option characters. + + PERMUTE is the default. We permute the contents of ARGV as we scan, + so that eventually all the non-options are at the end. This allows options + to be given in any order, even with programs that were not written to + expect this. + + RETURN_IN_ORDER is an option available to programs that were written + to expect options and other ARGV-elements in any order and that care about + the ordering of the two. We describe each non-option ARGV-element + as if it were the argument of an option with character code 1. + Using `-' as the first character of the list of option characters + selects this mode of operation. + + The special argument `--' forces an end of option-scanning regardless + of the value of `ordering'. In the case of RETURN_IN_ORDER, only + `--' can cause `getopt' to return EOF with `optind' != ARGC. */ + +static enum +{ + REQUIRE_ORDER, PERMUTE, RETURN_IN_ORDER +} ordering; + +/* Value of POSIXLY_CORRECT environment variable. */ +static char *posixly_correct; + +#ifdef __GNU_LIBRARY__ +/* We want to avoid inclusion of string.h with non-GNU libraries + because there are many ways it can cause trouble. + On some systems, it contains special magic macros that don't work + in GCC. */ +#include +#define my_index strchr +#else + +/* Avoid depending on library functions or files + whose names are inconsistent. */ + +char *getenv (); + +static char * +my_index (str, chr) + const char *str; + int chr; +{ + while (*str) + { + if (*str == chr) + return (char *) str; + str++; + } + return 0; +} + +/* If using GCC, we can safely declare strlen this way. + If not using GCC, it is ok not to declare it. */ +#ifdef __GNUC__ +/* Note that Motorola Delta 68k R3V7 comes with GCC but not stddef.h. + That was relevant to code that was here before. */ +#if !defined (__STDC__) || !__STDC__ +/* gcc with -traditional declares the built-in strlen to return int, + and has done so at least since version 2.4.5. -- rms. */ +extern int strlen (const char *); +#endif /* not __STDC__ */ +#endif /* __GNUC__ */ + +#endif /* not __GNU_LIBRARY__ */ + +/* Handle permutation of arguments. */ + +/* Describe the part of ARGV that contains non-options that have + been skipped. `first_nonopt' is the index in ARGV of the first of them; + `last_nonopt' is the index after the last of them. */ + +static int first_nonopt; +static int last_nonopt; + +/* Exchange two adjacent subsequences of ARGV. + One subsequence is elements [first_nonopt,last_nonopt) + which contains all the non-options that have been skipped so far. + The other is elements [last_nonopt,optind), which contains all + the options processed since those non-options were skipped. + + `first_nonopt' and `last_nonopt' are relocated so that they describe + the new indices of the non-options in ARGV after they are moved. */ + +static void +exchange (argv) + char **argv; +{ + int bottom = first_nonopt; + int middle = last_nonopt; + int top = optind; + char *tem; + + /* Exchange the shorter segment with the far end of the longer segment. + That puts the shorter segment into the right place. + It leaves the longer segment in the right place overall, + but it consists of two parts that need to be swapped next. */ + + while (top > middle && middle > bottom) + { + if (top - middle > middle - bottom) + { + /* Bottom segment is the short one. */ + int len = middle - bottom; + register int i; + + /* Swap it with the top part of the top segment. */ + for (i = 0; i < len; i++) + { + tem = argv[bottom + i]; + argv[bottom + i] = argv[top - (middle - bottom) + i]; + argv[top - (middle - bottom) + i] = tem; + } + /* Exclude the moved bottom segment from further swapping. */ + top -= len; + } + else + { + /* Top segment is the short one. */ + int len = top - middle; + register int i; + + /* Swap it with the bottom part of the bottom segment. */ + for (i = 0; i < len; i++) + { + tem = argv[bottom + i]; + argv[bottom + i] = argv[middle + i]; + argv[middle + i] = tem; + } + /* Exclude the moved top segment from further swapping. */ + bottom += len; + } + } + + /* Update records for the slots the non-options now occupy. */ + + first_nonopt += (optind - last_nonopt); + last_nonopt = optind; +} + +/* Initialize the internal data when the first call is made. */ + +static const char * +_getopt_initialize (optstring) + const char *optstring; +{ + /* Start processing options with ARGV-element 1 (since ARGV-element 0 + is the program name); the sequence of previously skipped + non-option ARGV-elements is empty. */ + + first_nonopt = last_nonopt = optind = 1; + + nextchar = NULL; + + posixly_correct = getenv ("POSIXLY_CORRECT"); + + /* Determine how to handle the ordering of options and nonoptions. */ + + if (optstring[0] == '-') + { + ordering = RETURN_IN_ORDER; + ++optstring; + } + else if (optstring[0] == '+') + { + ordering = REQUIRE_ORDER; + ++optstring; + } + else if (posixly_correct != NULL) + ordering = REQUIRE_ORDER; + else + ordering = PERMUTE; + + return optstring; +} + +/* Scan elements of ARGV (whose length is ARGC) for option characters + given in OPTSTRING. + + If an element of ARGV starts with '-', and is not exactly "-" or "--", + then it is an option element. The characters of this element + (aside from the initial '-') are option characters. If `getopt' + is called repeatedly, it returns successively each of the option characters + from each of the option elements. + + If `getopt' finds another option character, it returns that character, + updating `optind' and `nextchar' so that the next call to `getopt' can + resume the scan with the following option character or ARGV-element. + + If there are no more option characters, `getopt' returns `EOF'. + Then `optind' is the index in ARGV of the first ARGV-element + that is not an option. (The ARGV-elements have been permuted + so that those that are not options now come last.) + + OPTSTRING is a string containing the legitimate option characters. + If an option character is seen that is not listed in OPTSTRING, + return '?' after printing an error message. If you set `opterr' to + zero, the error message is suppressed but we still return '?'. + + If a char in OPTSTRING is followed by a colon, that means it wants an arg, + so the following text in the same ARGV-element, or the text of the following + ARGV-element, is returned in `optarg'. Two colons mean an option that + wants an optional arg; if there is text in the current ARGV-element, + it is returned in `optarg', otherwise `optarg' is set to zero. + + If OPTSTRING starts with `-' or `+', it requests different methods of + handling the non-option ARGV-elements. + See the comments about RETURN_IN_ORDER and REQUIRE_ORDER, above. + + Long-named options begin with `--' instead of `-'. + Their names may be abbreviated as long as the abbreviation is unique + or is an exact match for some defined option. If they have an + argument, it follows the option name in the same ARGV-element, separated + from the option name by a `=', or else the in next ARGV-element. + When `getopt' finds a long-named option, it returns 0 if that option's + `flag' field is nonzero, the value of the option's `val' field + if the `flag' field is zero. + + The elements of ARGV aren't really const, because we permute them. + But we pretend they're const in the prototype to be compatible + with other systems. + + LONGOPTS is a vector of `struct option' terminated by an + element containing a name which is zero. + + LONGIND returns the index in LONGOPT of the long-named option found. + It is only valid when a long-named option has been found by the most + recent call. + + If LONG_ONLY is nonzero, '-' as well as '--' can introduce + long-named options. */ + +int +_getopt_internal (argc, argv, optstring, longopts, longind, long_only) + int argc; + char *const *argv; + const char *optstring; + const struct option *longopts; + int *longind; + int long_only; +{ + optarg = NULL; + + if (optind == 0) + optstring = _getopt_initialize (optstring); + + if (nextchar == NULL || *nextchar == '\0') + { + /* Advance to the next ARGV-element. */ + + if (ordering == PERMUTE) + { + /* If we have just processed some options following some non-options, + exchange them so that the options come first. */ + + if (first_nonopt != last_nonopt && last_nonopt != optind) + exchange ((char **) argv); + else if (last_nonopt != optind) + first_nonopt = optind; + + /* Skip any additional non-options + and extend the range of non-options previously skipped. */ + + while (optind < argc + && (argv[optind][0] != '-' || argv[optind][1] == '\0')) + optind++; + last_nonopt = optind; + } + + /* The special ARGV-element `--' means premature end of options. + Skip it like a null option, + then exchange with previous non-options as if it were an option, + then skip everything else like a non-option. */ + + if (optind != argc && !strcmp (argv[optind], "--")) + { + optind++; + + if (first_nonopt != last_nonopt && last_nonopt != optind) + exchange ((char **) argv); + else if (first_nonopt == last_nonopt) + first_nonopt = optind; + last_nonopt = argc; + + optind = argc; + } + + /* If we have done all the ARGV-elements, stop the scan + and back over any non-options that we skipped and permuted. */ + + if (optind == argc) + { + /* Set the next-arg-index to point at the non-options + that we previously skipped, so the caller will digest them. */ + if (first_nonopt != last_nonopt) + optind = first_nonopt; + return EOF; + } + + /* If we have come to a non-option and did not permute it, + either stop the scan or describe it to the caller and pass it by. */ + + if ((argv[optind][0] != '-' || argv[optind][1] == '\0')) + { + if (ordering == REQUIRE_ORDER) + return EOF; + optarg = argv[optind++]; + return 1; + } + + /* We have found another option-ARGV-element. + Skip the initial punctuation. */ + + nextchar = (argv[optind] + 1 + + (longopts != NULL && argv[optind][1] == '-')); + } + + /* Decode the current option-ARGV-element. */ + + /* Check whether the ARGV-element is a long option. + + If long_only and the ARGV-element has the form "-f", where f is + a valid short option, don't consider it an abbreviated form of + a long option that starts with f. Otherwise there would be no + way to give the -f short option. + + On the other hand, if there's a long option "fubar" and + the ARGV-element is "-fu", do consider that an abbreviation of + the long option, just like "--fu", and not "-f" with arg "u". + + This distinction seems to be the most useful approach. */ + + if (longopts != NULL + && (argv[optind][1] == '-' + || (long_only && (argv[optind][2] || !my_index (optstring, argv[optind][1]))))) + { + char *nameend; + const struct option *p; + const struct option *pfound = NULL; + int exact = 0; + int ambig = 0; + int indfound = 0; /* set to zero by Anton */ + int option_index; + + for (nameend = nextchar; *nameend && *nameend != '='; nameend++) + /* Do nothing. */ ; + + /* Test all long options for either exact match + or abbreviated matches. */ + for (p = longopts, option_index = 0; p->name; p++, option_index++) + if (!strncmp(p->name, nextchar, nameend - nextchar)) + { + if ((unsigned int)(nameend - nextchar) == (unsigned int)strlen (p->name)) + { + /* Exact match found. */ + pfound = p; + indfound = option_index; + exact = 1; + break; + } + else if (pfound == NULL) + { + /* First nonexact match found. */ + pfound = p; + indfound = option_index; + } + else + /* Second or later nonexact match found. */ + ambig = 1; + } + + if (ambig && !exact) + { + if (opterr) + fprintf (stderr, "%s: option `%s' is ambiguous\n", + argv[0], argv[optind]); + nextchar += strlen (nextchar); + optind++; + return '?'; + } + + if (pfound != NULL) + { + option_index = indfound; + optind++; + if (*nameend) + { + /* Don't test has_arg with >, because some C compilers don't + allow it to be used on enums. */ + if (pfound->has_arg) + optarg = nameend + 1; + else + { + if (opterr) + { + if (argv[optind - 1][1] == '-') + /* --option */ + fprintf (stderr, + "%s: option `--%s' doesn't allow an argument\n", + argv[0], pfound->name); + else + /* +option or -option */ + fprintf (stderr, + "%s: option `%c%s' doesn't allow an argument\n", + argv[0], argv[optind - 1][0], pfound->name); + } + nextchar += strlen (nextchar); + return '?'; + } + } + else if (pfound->has_arg == 1) + { + if (optind < argc) + optarg = argv[optind++]; + else + { + if (opterr) + fprintf (stderr, "%s: option `%s' requires an argument\n", + argv[0], argv[optind - 1]); + nextchar += strlen (nextchar); + return optstring[0] == ':' ? ':' : '?'; + } + } + nextchar += strlen (nextchar); + if (longind != NULL) + *longind = option_index; + if (pfound->flag) + { + *(pfound->flag) = pfound->val; + return 0; + } + return pfound->val; + } + + /* Can't find it as a long option. If this is not getopt_long_only, + or the option starts with '--' or is not a valid short + option, then it's an error. + Otherwise interpret it as a short option. */ + if (!long_only || argv[optind][1] == '-' + || my_index (optstring, *nextchar) == NULL) + { + if (opterr) + { + if (argv[optind][1] == '-') + /* --option */ + fprintf (stderr, "%s: unrecognized option `--%s'\n", + argv[0], nextchar); + else + /* +option or -option */ + fprintf (stderr, "%s: unrecognized option `%c%s'\n", + argv[0], argv[optind][0], nextchar); + } + nextchar = (char *) ""; + optind++; + return '?'; + } + } + + /* Look at and handle the next short option-character. */ + + { + char c = *nextchar++; + char *temp = my_index (optstring, c); + + /* Increment `optind' when we start to process its last character. */ + if (*nextchar == '\0') + ++optind; + + if (temp == NULL || c == ':') + { + if (opterr) + { + if (posixly_correct) + /* 1003.2 specifies the format of this message. */ + fprintf (stderr, "%s: illegal option -- %c\n", argv[0], c); + else + fprintf (stderr, "%s: invalid option -- %c\n", argv[0], c); + } + optopt = c; + return '?'; + } + if (temp[1] == ':') + { + if (temp[2] == ':') + { + /* This is an option that accepts an argument optionally. */ + if (*nextchar != '\0') + { + optarg = nextchar; + optind++; + } + else + optarg = NULL; + nextchar = NULL; + } + else + { + /* This is an option that requires an argument. */ + if (*nextchar != '\0') + { + optarg = nextchar; + /* If we end this ARGV-element by taking the rest as an arg, + we must advance to the next element now. */ + optind++; + } + else if (optind == argc) + { + if (opterr) + { + /* 1003.2 specifies the format of this message. */ + fprintf (stderr, "%s: option requires an argument -- %c\n", + argv[0], c); + } + optopt = c; + if (optstring[0] == ':') + c = ':'; + else + c = '?'; + } + else + /* We already incremented `optind' once; + increment it again when taking next ARGV-elt as argument. */ + optarg = argv[optind++]; + nextchar = NULL; + } + } + return c; + } +} + +int +getopt (argc, argv, optstring) + int argc; + char *const *argv; + const char *optstring; +{ + return _getopt_internal (argc, argv, optstring, + (const struct option *) 0, + (int *) 0, + 0); +} + +#endif /* _LIBC or not __GNU_LIBRARY__. */ + +#ifdef TEST + +/* Compile with -DTEST to make an executable for use in testing + the above definition of `getopt'. */ + +int +main (argc, argv) + int argc; + char **argv; +{ + int c; + int digit_optind = 0; + + while (1) + { + int this_option_optind = optind ? optind : 1; + + c = getopt (argc, argv, "abc:d:0123456789"); + if (c == EOF) + break; + + switch (c) + { + case '0': + case '1': + case '2': + case '3': + case '4': + case '5': + case '6': + case '7': + case '8': + case '9': + if (digit_optind != 0 && digit_optind != this_option_optind) + printf ("digits occur in two different argv-elements.\n"); + digit_optind = this_option_optind; + printf ("option %c\n", c); + break; + + case 'a': + printf ("option a\n"); + break; + + case 'b': + printf ("option b\n"); + break; + + case 'c': + printf ("option c with value `%s'\n", optarg); + break; + + case '?': + break; + + default: + printf ("?? getopt returned character code 0%o ??\n", c); + } + } + + if (optind < argc) + { + printf ("non-option ARGV-elements: "); + while (optind < argc) + printf ("%s ", argv[optind++]); + printf ("\n"); + } + + exit (0); +} + +#endif /* TEST */ diff --git a/examples/LDAP/smbldap-tools/mkntpwd/getopt.h b/examples/LDAP/smbldap-tools/mkntpwd/getopt.h new file mode 100644 index 0000000000..f3696d955d --- /dev/null +++ b/examples/LDAP/smbldap-tools/mkntpwd/getopt.h @@ -0,0 +1,133 @@ +/* Declarations for getopt. + Copyright (C) 1989, 90, 91, 92, 93, 94 Free Software Foundation, Inc. + +This file is part of the GNU C Library. Its master source is NOT part of +the C library, however. The master source lives in /gd/gnu/lib. + +The GNU C Library is free software; you can redistribute it and/or +modify it under the terms of the GNU Library General Public License as +published by the Free Software Foundation; either version 2 of the +License, or (at your option) any later version. + +The GNU C Library is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +Library General Public License for more details. + +You should have received a copy of the GNU Library General Public +License along with the GNU C Library; see the file COPYING.LIB. If +not, write to the Free Software Foundation, Inc., 675 Mass Ave, +Cambridge, MA 02139, USA. */ + +#ifndef _GETOPT_H +#define _GETOPT_H 1 + +#ifdef __cplusplus +extern "C" { +#endif + +/* For communication from `getopt' to the caller. + When `getopt' finds an option that takes an argument, + the argument value is returned here. + Also, when `ordering' is RETURN_IN_ORDER, + each non-option ARGV-element is returned here. */ + +extern char *optarg; + +/* Index in ARGV of the next element to be scanned. + This is used for communication to and from the caller + and for communication between successive calls to `getopt'. + + On entry to `getopt', zero means this is the first call; initialize. + + When `getopt' returns EOF, this is the index of the first of the + non-option elements that the caller should itself scan. + + Otherwise, `optind' communicates from one call to the next + how much of ARGV has been scanned so far. */ + +extern int optind; + +/* Callers store zero here to inhibit the error message `getopt' prints + for unrecognized options. */ + +extern int opterr; + +/* Set to an option character which was unrecognized. */ + +extern int optopt; + +/* Describe the long-named options requested by the application. + The LONG_OPTIONS argument to getopt_long or getopt_long_only is a vector + of `struct option' terminated by an element containing a name which is + zero. + + The field `has_arg' is: + no_argument (or 0) if the option does not take an argument, + required_argument (or 1) if the option requires an argument, + optional_argument (or 2) if the option takes an optional argument. + + If the field `flag' is not NULL, it points to a variable that is set + to the value given in the field `val' when the option is found, but + left unchanged if the option is not found. + + To have a long-named option do something other than set an `int' to + a compiled-in constant, such as set a value from `optarg', set the + option's `flag' field to zero and its `val' field to a nonzero + value (the equivalent single-letter option character, if there is + one). For long options that have a zero `flag' field, `getopt' + returns the contents of the `val' field. */ + +struct option +{ +#if defined (__STDC__) && __STDC__ + const char *name; +#else + char *name; +#endif + /* has_arg can't be an enum because some compilers complain about + type mismatches in all the code that assumes it is an int. */ + int has_arg; + int *flag; + int val; +}; + +/* Names for the values of the `has_arg' field of `struct option'. */ + +#define no_argument 0 +#define required_argument 1 +#define optional_argument 2 + +#if defined (__STDC__) && __STDC__ +#ifdef __GNU_LIBRARY__ +/* Many other libraries have conflicting prototypes for getopt, with + differences in the consts, in stdlib.h. To avoid compilation + errors, only prototype getopt for the GNU C library. */ +extern int getopt (int argc, char *const *argv, const char *shortopts); +#else /* not __GNU_LIBRARY__ */ +extern int getopt (); +#endif /* __GNU_LIBRARY__ */ +extern int getopt_long (int argc, char *const *argv, const char *shortopts, + const struct option *longopts, int *longind); +extern int getopt_long_only (int argc, char *const *argv, + const char *shortopts, + const struct option *longopts, int *longind); + +/* Internal only. Users should not call this directly. */ +extern int _getopt_internal (int argc, char *const *argv, + const char *shortopts, + const struct option *longopts, int *longind, + int long_only); +#else /* not __STDC__ */ +extern int getopt (); +extern int getopt_long (); +extern int getopt_long_only (); + +extern int _getopt_internal (); +#endif /* __STDC__ */ + +#ifdef __cplusplus +} +#endif + +#endif /* _GETOPT_H */ diff --git a/examples/LDAP/smbldap-tools/mkntpwd/md4.c b/examples/LDAP/smbldap-tools/mkntpwd/md4.c new file mode 100644 index 0000000000..1c9c2e6ecd --- /dev/null +++ b/examples/LDAP/smbldap-tools/mkntpwd/md4.c @@ -0,0 +1,171 @@ +/* + Unix SMB/Netbios implementation. + Version 1.9. + a implementation of MD4 designed for use in the SMB authentication protocol + Copyright (C) Andrew Tridgell 1997 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + + +/* NOTE: This code makes no attempt to be fast! + + It assumes that a int is at least 32 bits long +*/ + +typedef unsigned int uint32; + +static uint32 A, B, C, D; + +static uint32 F(uint32 X, uint32 Y, uint32 Z) +{ + return (X&Y) | ((~X)&Z); +} + +static uint32 G(uint32 X, uint32 Y, uint32 Z) +{ + return (X&Y) | (X&Z) | (Y&Z); +} + +static uint32 H(uint32 X, uint32 Y, uint32 Z) +{ + return X^Y^Z; +} + +static uint32 lshift(uint32 x, int s) +{ + x &= 0xFFFFFFFF; + return ((x<>(32-s)); +} + +#define ROUND1(a,b,c,d,k,s) a = lshift(a + F(b,c,d) + X[k], s) +#define ROUND2(a,b,c,d,k,s) a = lshift(a + G(b,c,d) + X[k] + (uint32)0x5A827999,s) +#define ROUND3(a,b,c,d,k,s) a = lshift(a + H(b,c,d) + X[k] + (uint32)0x6ED9EBA1,s) + +/* this applies md4 to 64 byte chunks */ +static void mdfour64(uint32 *M) +{ + int j; + uint32 AA, BB, CC, DD; + uint32 X[16]; + + for (j=0;j<16;j++) + X[j] = M[j]; + + AA = A; BB = B; CC = C; DD = D; + + ROUND1(A,B,C,D, 0, 3); ROUND1(D,A,B,C, 1, 7); + ROUND1(C,D,A,B, 2, 11); ROUND1(B,C,D,A, 3, 19); + ROUND1(A,B,C,D, 4, 3); ROUND1(D,A,B,C, 5, 7); + ROUND1(C,D,A,B, 6, 11); ROUND1(B,C,D,A, 7, 19); + ROUND1(A,B,C,D, 8, 3); ROUND1(D,A,B,C, 9, 7); + ROUND1(C,D,A,B, 10, 11); ROUND1(B,C,D,A, 11, 19); + ROUND1(A,B,C,D, 12, 3); ROUND1(D,A,B,C, 13, 7); + ROUND1(C,D,A,B, 14, 11); ROUND1(B,C,D,A, 15, 19); + + ROUND2(A,B,C,D, 0, 3); ROUND2(D,A,B,C, 4, 5); + ROUND2(C,D,A,B, 8, 9); ROUND2(B,C,D,A, 12, 13); + ROUND2(A,B,C,D, 1, 3); ROUND2(D,A,B,C, 5, 5); + ROUND2(C,D,A,B, 9, 9); ROUND2(B,C,D,A, 13, 13); + ROUND2(A,B,C,D, 2, 3); ROUND2(D,A,B,C, 6, 5); + ROUND2(C,D,A,B, 10, 9); ROUND2(B,C,D,A, 14, 13); + ROUND2(A,B,C,D, 3, 3); ROUND2(D,A,B,C, 7, 5); + ROUND2(C,D,A,B, 11, 9); ROUND2(B,C,D,A, 15, 13); + + ROUND3(A,B,C,D, 0, 3); ROUND3(D,A,B,C, 8, 9); + ROUND3(C,D,A,B, 4, 11); ROUND3(B,C,D,A, 12, 15); + ROUND3(A,B,C,D, 2, 3); ROUND3(D,A,B,C, 10, 9); + ROUND3(C,D,A,B, 6, 11); ROUND3(B,C,D,A, 14, 15); + ROUND3(A,B,C,D, 1, 3); ROUND3(D,A,B,C, 9, 9); + ROUND3(C,D,A,B, 5, 11); ROUND3(B,C,D,A, 13, 15); + ROUND3(A,B,C,D, 3, 3); ROUND3(D,A,B,C, 11, 9); + ROUND3(C,D,A,B, 7, 11); ROUND3(B,C,D,A, 15, 15); + + A += AA; B += BB; C += CC; D += DD; + + A &= 0xFFFFFFFF; B &= 0xFFFFFFFF; + C &= 0xFFFFFFFF; D &= 0xFFFFFFFF; + + for (j=0;j<16;j++) + X[j] = 0; +} + +static void copy64(uint32 *M, unsigned char *in) +{ + int i; + + for (i=0;i<16;i++) + M[i] = (in[i*4+3]<<24) | (in[i*4+2]<<16) | + (in[i*4+1]<<8) | (in[i*4+0]<<0); +} + +static void copy4(unsigned char *out,uint32 x) +{ + out[0] = x&0xFF; + out[1] = (x>>8)&0xFF; + out[2] = (x>>16)&0xFF; + out[3] = (x>>24)&0xFF; +} + +/* produce a md4 message digest from data of length n bytes */ +void mdfour(unsigned char *out, unsigned char *in, int n) +{ + unsigned char buf[128]; + uint32 M[16]; + uint32 b = n * 8; + int i; + + A = 0x67452301; + B = 0xefcdab89; + C = 0x98badcfe; + D = 0x10325476; + + while (n > 64) { + copy64(M, in); + mdfour64(M); + in += 64; + n -= 64; + } + + for (i=0;i<128;i++) + buf[i] = 0; + memcpy(buf, in, n); + buf[n] = 0x80; + + if (n <= 55) { + copy4(buf+56, b); + copy64(M, buf); + mdfour64(M); + } else { + copy4(buf+120, b); + copy64(M, buf); + mdfour64(M); + copy64(M, buf+64); + mdfour64(M); + } + + for (i=0;i<128;i++) + buf[i] = 0; + copy64(M, buf); + + copy4(out, A); + copy4(out+4, B); + copy4(out+8, C); + copy4(out+12, D); + + A = B = C = D = 0; +} + + diff --git a/examples/LDAP/smbldap-tools/mkntpwd/mkntpwd.c b/examples/LDAP/smbldap-tools/mkntpwd/mkntpwd.c new file mode 100644 index 0000000000..0c7d61e134 --- /dev/null +++ b/examples/LDAP/smbldap-tools/mkntpwd/mkntpwd.c @@ -0,0 +1,253 @@ +/* + This code is based on work from + L0phtcrack 1.5 06.02.97 mudge@l0pht.com + + The code also contains sources from: + . routines from the samba code source + md4.c smbdes.c + + Anton Roeckseisen (anton@genua.de) + +*/ + +/* + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "mkntpwd.h" + +void str_to_key(unsigned char *,unsigned char *); +void usage(char *); +int PutUniCode(char *dst,char *src); +void printlanhash(char *tmp); +void mdfour(unsigned char *out, unsigned char *in, int n); +void E_P16(unsigned char *p14,unsigned char *p16); + + +void main(int argc, char **argv) { + extern char *optarg; + int c; + + int printlan = 0; + char lanpwd[LMPASSWDLEN+1]; + int printnt = 0; + char inputfile[FILENAMEBUFFER+1] = ""; + FILE* InputFilePtr; + int just_pwd = 0; + int i; + char hashout[17]; + + char ntpasswd[NTPASSWDLEN+1]; + char *hold; + unsigned char *p16; + int uni_len; + char passwd[NTPASSWDLEN+1]; + + if (argc==1) + usage(argv[0]); + + if (argc==2) + just_pwd=1; + else + just_pwd=0; + + lanpwd[0] = '\0'; + ntpasswd[0] = '\0'; + + while ( (c = getopt(argc, argv, "L:N:f:")) != EOF){ + switch(c) { + case 'L': + printlan++; + strncpy(lanpwd,optarg,LMPASSWDLEN); + lanpwd[LMPASSWDLEN]='\0'; + for (i=0;i0 && passwd[strlen(passwd)-1]=='\n') + passwd[strlen(passwd)-1]='\0'; + + /* create LANMAN-password (shorter) */ + strncpy(lanpwd,passwd,LMPASSWDLEN); + lanpwd[LMPASSWDLEN]='\0'; + for (i=0;i1 && just_pwd==1) { + strncpy(lanpwd,argv[1],LMPASSWDLEN); + lanpwd[LMPASSWDLEN]='\0'; + for (i=0;i0) { + memset(hashout,'\0',17); + E_P16((uchar *)lanpwd,hashout); + printlanhash(hashout); + } + + if (printnt >0) { + + if (printlan>0) printf(":"); + + memset(ntpasswd, '\0', sizeof(ntpasswd)); + + if (passwd[strlen(passwd)-1] == '\n') /* strip the \n - this + is done in LowerString for the case sensitive + check */ + passwd[strlen(passwd)-1] = '\0'; + + hold = (char *)malloc(NTPASSWDLEN * 2); /* grab space for + unicode */ + if (hold == NULL){ + fprintf(stderr, "out of memory...crackntdialog hold\n"); + exit(1); + } + + uni_len = PutUniCode(hold, passwd); /* convert to + unicode and return correct + unicode length for md4 */ + + p16 = (unsigned char*)malloc(17); /* grab space for md4 hash */ + if (p16 == NULL){ + fprintf(stderr, "out of memory...crackntdialect p16\n"); + exit(1); + } + + memset(p16,'\0',17); + mdfour(p16,hold, uni_len); + + printlanhash(p16); + + free(p16); + free(hold); + } + + printf("\n"); + + exit(0); + +} + +/*****************************************************************************/ +/*****************************************************************************/ +/*****************************************************************************/ + +void usage(char *progname){ + char *p; + + p = strrchr(progname, '\\'); + if (p == NULL) + p = progname; + else + p++; + + fprintf(stderr, "Usage: %s [-L lanmgrpwd] [-N ntpasswd]\n",p); + fprintf(stderr, " %s password\n",p); + fprintf(stderr, " %s -f [-] [filename]\n\n",p); + fprintf(stderr, " -L lanmgrpasswd LanManager cleartextpwd <= 14 chars\n"); + fprintf(stderr, " -N ntpasswd NT cleartextpwd <=128 chars (usually <=14)\n\n"); + fprintf(stderr, " with both options present the encrypted LanManager-Pwd is \n"); + fprintf(stderr, " printed first, followed by a ':' and the encrypted NT-Pwd.\n\n"); + fprintf(stderr, " The second usage behaves like %s -L pwd -N pwd\n\n",p); + fprintf(stderr, " The third usage reads the password from STDIN or a File. Printout\n"); + fprintf(stderr, " is the same as second.\n\n"); + fprintf(stderr, "anton@genua.de\n\n"); + exit(1); +} + + +/******************************************************************* +write a string in unicoode format +********************************************************************/ +int PutUniCode(char *dst,char *src) +{ + int ret = 0; + while (*src) { + dst[ret++] = src[0]; + dst[ret++] = 0; + src++; + } + dst[ret++]=0; + dst[ret++]=0; + return(ret-2); /* the way they do the md4 hash they don't represent + the last null. ie 'A' becomes just 0x41 0x00 - not + 0x41 0x00 0x00 0x00 */ +} + +/* + print binary buffer as hex-string +*/ +void printlanhash(char *tmp) { + + int i; + unsigned char c; + char outbuffer[33]; + + + /* build string from binary hash */ + for(i=0;i<16;i++) { + c=tmp[i]; + sprintf(outbuffer+2*i,"%x",(c>>4) & 0x0f); + sprintf(outbuffer+2*i+1,"%x",c & 0x0f); + } + + /* convert to uppercase */ + for(i=0;i<32;i++) + outbuffer[i] = toupper(outbuffer[i]); + outbuffer[32]='\0'; + + /* print out hex-string */ + printf("%s",outbuffer); +} + + diff --git a/examples/LDAP/smbldap-tools/mkntpwd/mkntpwd.h b/examples/LDAP/smbldap-tools/mkntpwd/mkntpwd.h new file mode 100644 index 0000000000..9a020b8d28 --- /dev/null +++ b/examples/LDAP/smbldap-tools/mkntpwd/mkntpwd.h @@ -0,0 +1,17 @@ +#include +#include +#include +#include +#include + +typedef short int16; +typedef int int32; +typedef unsigned short uint16; +typedef unsigned int uint32; +typedef unsigned char uchar; + +#define MAX_STRING 255 +#define MAX_WORD 128 +#define LMPASSWDLEN 14 +#define NTPASSWDLEN 128 +#define FILENAMEBUFFER 128 diff --git a/examples/LDAP/smbldap-tools/mkntpwd/smbdes.c b/examples/LDAP/smbldap-tools/mkntpwd/smbdes.c new file mode 100644 index 0000000000..e4f8280f9b --- /dev/null +++ b/examples/LDAP/smbldap-tools/mkntpwd/smbdes.c @@ -0,0 +1,337 @@ +/* + Unix SMB/Netbios implementation. + Version 1.9. + + a partial implementation of DES designed for use in the + SMB authentication protocol + + Copyright (C) Andrew Tridgell 1997 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + + +/* NOTES: + + This code makes no attempt to be fast! In fact, it is a very + slow implementation + + This code is NOT a complete DES implementation. It implements only + the minimum necessary for SMB authentication, as used by all SMB + products (including every copy of Microsoft Windows95 ever sold) + + In particular, it can only do a unchained forward DES pass. This + means it is not possible to use this code for encryption/decryption + of data, instead it is only useful as a "hash" algorithm. + + There is no entry point into this code that allows normal DES operation. + + I believe this means that this code does not come under ITAR + regulations but this is NOT a legal opinion. If you are concerned + about the applicability of ITAR regulations to this code then you + should confirm it for yourself (and maybe let me know if you come + up with a different answer to the one above) +*/ + + + +static int perm1[56] = {57, 49, 41, 33, 25, 17, 9, + 1, 58, 50, 42, 34, 26, 18, + 10, 2, 59, 51, 43, 35, 27, + 19, 11, 3, 60, 52, 44, 36, + 63, 55, 47, 39, 31, 23, 15, + 7, 62, 54, 46, 38, 30, 22, + 14, 6, 61, 53, 45, 37, 29, + 21, 13, 5, 28, 20, 12, 4}; + +static int perm2[48] = {14, 17, 11, 24, 1, 5, + 3, 28, 15, 6, 21, 10, + 23, 19, 12, 4, 26, 8, + 16, 7, 27, 20, 13, 2, + 41, 52, 31, 37, 47, 55, + 30, 40, 51, 45, 33, 48, + 44, 49, 39, 56, 34, 53, + 46, 42, 50, 36, 29, 32}; + +static int perm3[64] = {58, 50, 42, 34, 26, 18, 10, 2, + 60, 52, 44, 36, 28, 20, 12, 4, + 62, 54, 46, 38, 30, 22, 14, 6, + 64, 56, 48, 40, 32, 24, 16, 8, + 57, 49, 41, 33, 25, 17, 9, 1, + 59, 51, 43, 35, 27, 19, 11, 3, + 61, 53, 45, 37, 29, 21, 13, 5, + 63, 55, 47, 39, 31, 23, 15, 7}; + +static int perm4[48] = { 32, 1, 2, 3, 4, 5, + 4, 5, 6, 7, 8, 9, + 8, 9, 10, 11, 12, 13, + 12, 13, 14, 15, 16, 17, + 16, 17, 18, 19, 20, 21, + 20, 21, 22, 23, 24, 25, + 24, 25, 26, 27, 28, 29, + 28, 29, 30, 31, 32, 1}; + +static int perm5[32] = { 16, 7, 20, 21, + 29, 12, 28, 17, + 1, 15, 23, 26, + 5, 18, 31, 10, + 2, 8, 24, 14, + 32, 27, 3, 9, + 19, 13, 30, 6, + 22, 11, 4, 25}; + + +static int perm6[64] ={ 40, 8, 48, 16, 56, 24, 64, 32, + 39, 7, 47, 15, 55, 23, 63, 31, + 38, 6, 46, 14, 54, 22, 62, 30, + 37, 5, 45, 13, 53, 21, 61, 29, + 36, 4, 44, 12, 52, 20, 60, 28, + 35, 3, 43, 11, 51, 19, 59, 27, + 34, 2, 42, 10, 50, 18, 58, 26, + 33, 1, 41, 9, 49, 17, 57, 25}; + + +static int sc[16] = {1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1}; + +static int sbox[8][4][16] = { + {{14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7}, + {0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8}, + {4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0}, + {15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13}}, + + {{15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10}, + {3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5}, + {0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15}, + {13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9}}, + + {{10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8}, + {13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1}, + {13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7}, + {1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12}}, + + {{7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15}, + {13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9}, + {10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4}, + {3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14}}, + + {{2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9}, + {14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6}, + {4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14}, + {11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3}}, + + {{12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11}, + {10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8}, + {9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6}, + {4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13}}, + + {{4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1}, + {13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6}, + {1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2}, + {6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12}}, + + {{13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7}, + {1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2}, + {7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8}, + {2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11}}}; + +static void permute(char *out, char *in, int *p, int n) +{ + int i; + for (i=0;i>1; + key[1] = ((str[0]&0x01)<<6) | (str[1]>>2); + key[2] = ((str[1]&0x03)<<5) | (str[2]>>3); + key[3] = ((str[2]&0x07)<<4) | (str[3]>>4); + key[4] = ((str[3]&0x0F)<<3) | (str[4]>>5); + key[5] = ((str[4]&0x1F)<<2) | (str[5]>>6); + key[6] = ((str[5]&0x3F)<<1) | (str[6]>>7); + key[7] = str[6]&0x7F; + for (i=0;i<8;i++) { + key[i] = (key[i]<<1); + } +} + + +static void smbhash(unsigned char *out, unsigned char *in, unsigned char *key) +{ + int i; + char outb[64]; + char inb[64]; + char keyb[64]; + unsigned char key2[8]; + + str_to_key(key, key2); + + for (i=0;i<64;i++) { + inb[i] = (in[i/8] & (1<<(7-(i%8)))) ? 1 : 0; + keyb[i] = (key2[i/8] & (1<<(7-(i%8)))) ? 1 : 0; + outb[i] = 0; + } + + dohash(outb, inb, keyb); + + for (i=0;i<8;i++) { + out[i] = 0; + } + + for (i=0;i<64;i++) { + if (outb[i]) + out[i/8] |= (1<<(7-(i%8))); + } +} + +void E_P16(unsigned char *p14,unsigned char *p16) +{ + unsigned char sp8[8] = {0x4b, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25}; + smbhash(p16, sp8, p14); + smbhash(p16+8, sp8, p14+7); +} + +void E_P24(unsigned char *p21, unsigned char *c8, unsigned char *p24) +{ + smbhash(p24, c8, p21); + smbhash(p24+8, c8, p21+7); + smbhash(p24+16, c8, p21+14); +} + +void cred_hash1(unsigned char *out,unsigned char *in,unsigned char *key) +{ + unsigned char buf[8]; + + smbhash(buf, in, key); + smbhash(out, buf, key+9); +} + +void cred_hash2(unsigned char *out,unsigned char *in,unsigned char *key) +{ + unsigned char buf[8]; + static unsigned char key2[8]; + + smbhash(buf, in, key); + key2[0] = key[7]; + smbhash(out, buf, key2); +} + diff --git a/examples/LDAP/smbldap-tools/smbldap-groupadd.pl b/examples/LDAP/smbldap-tools/smbldap-groupadd.pl new file mode 100755 index 0000000000..ee804b34d3 --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap-groupadd.pl @@ -0,0 +1,84 @@ +#!/usr/bin/perl + +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2001-2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + +# Purpose of smbldap-groupadd : group (posix) add + +use strict; +use smbldap_tools; + +use Getopt::Std; +my %Options; + +my $ok = getopts('og:?', \%Options); +if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { + print "Usage: $0 [-go?] groupname\n"; + print " -g gid\n"; + print " -o gid is not unique\n"; + print " -? show this help message\n"; + exit (1); +} + +my $_groupName = $ARGV[0]; + +if (defined(get_group_dn($_groupName))) { + print "$0: group $_groupName exists\n"; + exit (6); +} + +my $_groupGidNumber = $Options{'g'}; + +if (!group_add($_groupName, $_groupGidNumber, $Options{'o'})) { + print "$0: error adding group $_groupName\n"; + exit (6); +} + +exit(0); + +######################################## + +=head1 NAME + + smbldap-groupadd.pl - Create a new group + +=head1 SYNOPSIS + + smbldap-groupadd.pl [-g gid [-o]] group + +=head1 DESCRIPTION + The smbldap-groupadd.pl command creates a new group account using + the values specified on the command line and the default values + from the system. The new group will be entered into the system + files as needed. The options which apply to the groupadd command are + + -g gid The numerical value of the group's ID. This value must be + unique, unless the -o option is used. The value must be non- + negative. The default is to use the smallest ID value greater + than 1000 and greater than every other group. + +=head1 SEE ALSO + + groupadd(1) + +=cut + +#' + diff --git a/examples/LDAP/smbldap-tools/smbldap-groupdel.pl b/examples/LDAP/smbldap-tools/smbldap-groupdel.pl new file mode 100755 index 0000000000..3d072585b2 --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap-groupdel.pl @@ -0,0 +1,93 @@ +#!/usr/bin/perl + +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2001-2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + +# Purpose of smbldap-groupdel : group (posix) deletion + +use strict; +use smbldap_tools; +use smbldap_conf; + +##################### + +use Getopt::Std; +my %Options; + +my $ok = getopts('?', \%Options); +if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { + print "Usage: $0 groupname\n"; + print " -? show this help message\n"; + exit (1); +} + +my $_groupName = $ARGV[0]; + +my $dn_line; +if (!defined($dn_line = get_group_dn($_groupName))) { + print "$0: group $_groupName doesn't exist\n"; + exit (6); +} + +my $dn = get_dn_from_line($dn_line); + +my $rc = system "$ldapdelete $dn >/dev/null"; +die "$0: error while deleting group $_groupName\n" + unless ($rc == 0); + +my $nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1"; + +if ($nscd_status == 0) { + system "/etc/init.d/nscd restart > /dev/null 2>&1"; +} + +#if (defined($dn_line = get_group_dn($_groupName))) { +# print "$0: failed to delete group\n"; +# exit (7); +#} + + +exit (0); + +############################################################ + +=head1 NAME + + smbldap-groupdel.pl - Delete a group + +=head1 SYNOPSIS + + smbldap-groupdel.pl group + +=head1 DESCRIPTION + + The smbldap-groupdel.pl command modifies the system account files, + deleting all entries that refer to group. The named group must exist. + + You must manually check all filesystems to insure that no files remain + with the named group as the file group ID. + +=head1 SEE ALSO + + groupdel(1) + +=cut + +#' diff --git a/examples/LDAP/smbldap-tools/smbldap-groupmod.pl b/examples/LDAP/smbldap-tools/smbldap-groupmod.pl new file mode 100755 index 0000000000..7b5a46b06e --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap-groupmod.pl @@ -0,0 +1,209 @@ +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2001-2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + +# Purpose of smbldap-groupmod : group (posix) modification + + +use strict; +use smbldap_tools; +use smbldap_conf; + + +##################### + +use Getopt::Std; +my %Options; + +my $ok = getopts('og:n:m:x:?', \%Options); +if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { + print "Usage: $0 [-g gid [-o]] [-n name] [-m members(,)] [-x members (,)] groupname\n"; + print " -g new gid\n"; + print " -o gid is not unique\n"; + print " -n new group name\n"; + print " -m add members (comma delimited)\n"; + print " -x delete members (comma delimted)\n"; + print " -? show this help message\n"; + exit (1); +} + +my $groupName = $ARGV[0]; + +if (!defined(get_group_dn($groupName))) { + print "$0: group $groupName doesn't exist\n"; + exit (6); +} + +my $newname = $Options{'n'}; + +my $nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1"; + +if ($nscd_status == 0) { + system "/etc/init.d/nscd restart > /dev/null 2>&1"; +} + +my $gid = getgrnam($groupName); + +my $tmp; +if (defined($tmp = $Options{'g'}) and $tmp =~ /\d+/) { + if (!defined($Options{'o'})) { + if (defined(getgrgid($tmp))) { + print "$0: gid $tmp exists\n"; + exit (6); + } + } + if (!($gid == $tmp)) { + my $tmpldif = +"dn: cn=$groupName,$groupsdn +changetype: modify +replace: gidNumber +gidNumber: $tmp + +"; + die "$0: error while modifying group $groupName\n" + unless (do_ldapmodify($tmpldif) == 0); + undef $tmpldif; + + } +} + +if (defined($newname)) { + my $FILE="|$ldapmodrdn >/dev/null"; + open (FILE, $FILE) || die "$!\n"; + print FILE </dev/null 2>&1"; + +if ($nscd_status == 0) { + system "/etc/init.d/nscd restart > /dev/null 2>&1"; +} + +exit (0); + +############################################################ + +=head1 NAME + + smbldap-groupmod.pl - Modify a group + +=head1 SYNOPSIS + + smbldap-groupmod.pl [-g gid [-o]] [-n group_name ] group + +=head1 DESCRIPTION + + The smbldap-groupmod.pl command modifies the system account files to + reflect the changes that are specified on the command line. + The options which apply to the smbldap-groupmod command are + + -g gid The numerical value of the group's ID. This value must be + unique, unless the -o option is used. The value must be non- + negative. Any files which the old group ID is the file + group ID must have the file group ID changed manually. + + -n group_name + The name of the group will be changed from group to group_name. + + -m members + The members to be added to the group in comma-delimeted form. + + -x members + The members to be removed from the group in comma-delimted form. + +=head1 EXAMPLES + + smbldap-groupmod.pl -g 253 development + This will change the GID of the 'development' group to '253'. + + smbldap-groupmod.pl -n Idiots Managers + This will change the name of the 'Managers' group to 'Idiots'. + + smbldap-groupmod.pl -m "jdoe,jsmith" "Domain Admins" + This will add 'jdoe' and 'jsmith' to the 'Domain Admins' group. + + smbldap-groupmod.pl -x "jdoe,jsmith" "Domain Admins" + This will remove 'jdoe' and 'jsmith' from the 'Domain Admins' group. + +=head1 SEE ALSO + + groupmod(1) + +=cut + +#' diff --git a/examples/LDAP/smbldap-tools/smbldap-groupshow.pl b/examples/LDAP/smbldap-tools/smbldap-groupshow.pl new file mode 100755 index 0000000000..bc5b4d98fb --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap-groupshow.pl @@ -0,0 +1,72 @@ +#!/usr/bin/perl + +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2001-2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + +# Purpose of smbldap-groupshow : user (posix,shadow,samba) display +# +# History : +# . originally by David Le Corfec + +use strict; +use smbldap_tools; + +use Getopt::Std; +my %Options; + +my $ok = getopts('?', \%Options); + +if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { + print "Usage: $0 [-?] group\n"; + print " -? show this help message\n"; + exit (1); +} + +# Read only first @ARGV +my $group = $ARGV[0]; + +my $lines = read_group($group); +if (!defined($lines)) { + print "$0: group $group doesn't exist\n"; + exit (1); +} + +print "$lines\n"; + +exit(0); + +############################################################ + +=head1 NAME + + smbldap-groupshow.pl - Display group informations + +=head1 SYNOPSIS + + smbldap-groupshow.pl groupname + +=head1 DESCRIPTION + + The smbldap-groupshow.pl command displays informations + associated with the given group. + +=cut + +#' diff --git a/examples/LDAP/smbldap-tools/smbldap-migrate-accounts.pl b/examples/LDAP/smbldap-tools/smbldap-migrate-accounts.pl new file mode 100755 index 0000000000..0d0efa384c --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap-migrate-accounts.pl @@ -0,0 +1,234 @@ +#!/usr/bin/perl + +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + +# Purpose of smbldap-migrate-accounts : add NT sam entries from pwdump +# to ldap + +use strict; +use Getopt::Std; +use smbldap_tools; +use smbldap_conf; + +# smbldap-migrate.pl (-? for help) +# +# Read pwdump entries on stdin, and add them to the ldap server. +# Output uncreated/unmodified entries (see parameters -C -U) +# in pwdump format to stdout. +# Errors, debug and stats are output to stderr. + +sub modify_account +{ + my ($login, $basedn, $lmpwd, $ntpwd, $gecos, $homedir) = @_; + + my $tmpldif = +"dn: uid=$login,$basedn +changetype: modify +lmpassword: $lmpwd +ntpassword: $ntpwd +gecos: $gecos +sambaHomePath: $homedir + +"; + + die "$0: error while modifying user $login\n" + unless (do_ldapmodify($tmpldif) == 0); + undef $tmpldif; +} + +##################### + + +my %Options; + +my $ok = getopts('awA:CUW:?', \%Options); + +if ( (!$ok) || ($Options{'?'}) ) { + print "Usage: $0 [-awAWCU?]\n"; + print " -a process only people, ignore computers\n"; + print " -w process only computers, ignore persons\n"; + print " -A option string passed verbatim to smbldap-useradd for persons\n"; + print " -W option string passed verbatim to smbldap-useradd for computers\n"; + print " -C if entry not found, don't create it and log it to stdout (default: create it)\n"; + print " -U if entry found, don't update it and log it to stdout (default: update it)\n"; + print " -? show this help message\n"; + exit (1); +} + +my %processed = ( 'user' => 0, 'machine' => 0); +my %created = ( 'user' => 0, 'machine' => 0); +my %updated = ( 'user' => 0, 'machine' => 0); +my %logged = ( 'user' => 0, 'machine' => 0); +my %errors = ( 'user' => 0, 'machine' => 0); +my %existing = ( 'user' => 0, 'machine' => 0); +my $specialskipped = 0; + +while (<>) +{ + my ($login, $rid, $lmpwd, $ntpwd, $gecos, $homedir, $b) = split(/:/, $_); + my $usertype; + my $userbasedn; + + my $entry_type = 'user'; + + if ($login =~ m/.*\$$/ ) { # computer + $processed{'machine'}++; + $entry_type = 'machine'; + if (defined($Options{'a'})) { + print STDERR "ignoring $login\n"; + next; + } + + $usertype = "-w $Options{'W'}"; + $userbasedn = $computersdn; + } + else { # people + $processed{'user'}++; + if (defined($Options{'w'})) { + print STDERR "ignoring $login\n"; + next; + } + if ($rid < 1000) { + $specialskipped++; + print STDERR "$login seems to be a special Win account (rid=$rid), skipping\n"; + next; + } + + $usertype = "-a $Options{'A'}"; + $userbasedn = $usersdn; + } + + # normalize homedir +# uncomment to replace configured share with share from pwdump +# if ($homedir eq "") { + $homedir = $_userSmbHome; +# } + + # normalize gecos + if (!($gecos eq "")) { + $gecos =~ tr/ÁÀÂÄáàâäÇçÉÈÊËÆéèêëæÍÌÏÎíìîÏÑñÓÒÔÖóòôöÚÙÜÛúùüûÝýÿ/AAAAaaaaCcEEEEEeeeeeIIIIiiiiNnOOOOooooUUUUuuuuYyy/; + } else { + $gecos = $_userGecos; + } + + my $user_exists = is_samba_user($login); + + if (!$user_exists) { + if (!defined($Options{'C'})) { + # uid doesn't exist and we want to create it + my $addcmd = "/usr/local/sbin/smbldap-useradd.pl $usertype $login > /dev/null"; + print STDERR "$addcmd\n"; + my $r = system "$addcmd"; + if ($r != 0) { + print STDERR "error adding $login, skipping\n"; + next; + } + # lem modif... a retirer si pb + if ($entry_type eq "user") + { + modify_account($login, $userbasedn, $lmpwd, $ntpwd, $gecos, $homedir); + } + + $created{$entry_type}++; + } + else { # uid doesn't exist and no create => log + print "$_"; + $logged{$entry_type}++; + } + } + else { # account exists + $existing{$entry_type}++; + if (!defined($Options{'U'})) { # exists and modify + modify_account($login, $userbasedn, $lmpwd, $ntpwd, $gecos, $homedir); + $updated{$entry_type}++; + } + else { # exists and log + print "$_"; + $logged{$entry_type}++; + } + } +} + +my $sum; + +$sum = $processed{'user'} + $processed{'machine'}; +print STDERR "processed: all=$sum user=$processed{'user'} machine=$processed{'machine'}\n"; + +$sum = $existing{'user'} + $existing{'machine'}; +print STDERR "existing: all=$sum user=$existing{'user'} machine=$existing{'machine'}\n"; + +$sum = $created{'user'} + $created{'machine'}; +print STDERR "created: all=$sum user=$created{'user'} machine=$created{'machine'}\n"; + +$sum = $updated{'user'} + $updated{'machine'}; +print STDERR "updated: all=$sum user=$updated{'user'} machine=$updated{'machine'}\n"; + +$sum = $logged{'user'} + $logged{'machine'}; +print STDERR "logged: all=$sum user=$logged{'user'} machine=$logged{'machine'}\n"; + +print STDERR "special users skipped: $specialskipped\n"; + + +######################################## + +=head1 NAME + + smbldap-migrate.pl - Migrate NT accounts to LDAP + +=head1 SYNOPSIS + + smbldap-migrate.pl [-a] [-w] [-A opts] [-W opts] [-C] [-U] [-?] + +=head1 DESCRIPTION + + This command reads from stdin account entries as created by pwdump, + a tool to dump an user database on NT. + Depending of the options, some account entries may be output on + stdout. All errors and informations are sent to stderr. + + -a process only people, ignore computers + + -w process only computers, ignore persons + + -A opts + a string containing arguments to pass verbatim to + smbldap-useradd when adding users, eg "-m -x". + You don't have to specify -a in this string. + + -W opts + a string containing arguments to pass verbatim to + smbldap-useradd when adding computers, eg "-m -x". + You don't have to specify -w in this string. + + -C if NT account not found in LDAP, don't create it and log it to stdout + (default: create it) + + -U if NT account found in LDAP, don't update it and log it to stdout + (default: update it) + + -? show the help message + +=cut + +#' + +# The End + diff --git a/examples/LDAP/smbldap-tools/smbldap-migrate-groups.pl b/examples/LDAP/smbldap-tools/smbldap-migrate-groups.pl new file mode 100644 index 0000000000..0d3dd07d50 --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap-migrate-groups.pl @@ -0,0 +1,225 @@ +#!/usr/bin/perl + +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + +# Purpose of smbldap-migrate-groups : to parse a Windows +# group dump and populate Unix groups +# Reads group dump on stdin + + +use strict; +use smbldap_tools; +use smbldap_conf; +use Getopt::Std; + + + +sub process_rec_group +{ + my ($group, $mb) = @_; + my @members; + + if (!(@members = group_get_members($group))) { + return 0; + } + + foreach my $m (@members) { + if ( !($m =~ m/^\*/) ) { + push @{$mb}, $m; + } else { + my $gname = $m; + $gname =~ s/^.//; + if (!process_rec_group($gname, $mb)) { + print "recursive group not added : $gname\n"; + } + } + } +} + + +# given a group dn and a list of members, update the group +sub modify_group +{ + my ($group, $dn_line, @members, $recgroup) = @_; + my $m; + my @new_mb; + + foreach $m (@members) { + if ( ($m =~ m/^\*/) ) { + my $gname = $m; + $gname =~ s/^.//; + if (!$recgroup) { + print "recursive group not added : $gname\n"; + } else { + if (!process_rec_group($gname, \@new_mb)) { + print "recursive group not added : $gname\n"; + } + } + } else { + push @new_mb, $m; + } + } + + # new_mb contains flat members from group dump + # now append them to existing members + push @new_mb, group_get_members($group); + # uniq them + my %saw; + @saw{@new_mb} = (); + @new_mb = keys %saw; + + my $nmb = $#new_mb + 1; + print STDERR "Group $group now has $nmb member(s)\n"; + + my $mbs; + foreach $m (@new_mb) { + $mbs .= "memberUid: $m\n"; + } + + my $mods="$dn_line +changetype: modify +replace: memberUid +$mbs +"; + + #print "$mods\n"; + my $tmpldif = +"$mods +"; + + die "$0: error while modifying group $group\n" + unless (do_ldapmodify($tmpldif) == 0); + undef $tmpldif; +} + +sub display_group +{ + my ($group, @members) = @_; + + print "Group name $group\n"; + print "Members\n"; + my $m; + my $i = 0; + foreach $m (@members) { + print "$m "; + if ($i % 5 == 0) { + print "\n"; + } + $i++; + } +} + +sub process_group +{ + my ($group, @members, $nocreate, $noupdate, $recgroup) = @_; + + my $dn_line; + if (!defined($dn_line = get_group_dn($group))) { + # group not found, create it ? + if (!$nocreate) { + system "/usr/local/sbin/smbldap-groupadd.pl \"$group\"; sleep 5"; + if (!defined($dn_line = get_group_dn($group))) { + return 1; + } + modify_group($group, $dn_line, @members, $recgroup); + } else { + # don't create + print "not created:\n"; + display_group($group, @members); + } + } else { + # group found, update it ? + if (!$noupdate) { + modify_group($group, $dn_line, @members, $recgroup); + } else { + # don't update + print "not updated:\n"; + display_group($group, @members); + } + } +} + +################################################### + +my %Options; + +my $ok = getopts('CUr?', \%Options); +if ( (!$ok) || ($Options{'?'}) ) { + print "Usage: $0 [-CUr?] < group_dump\n"; + print " -C don't create group if it doesn't exist\n"; + print " -U don't update group if it exists\n"; + print " -r recursively process groups\n"; + exit(1); +} + +my $group_name; +my $group_desc; +my $has_members = 0; +my @members = (); + +while (<>) +{ + my $line = $_; + chomp($line); + next if ( $line =~ m/^\s*$/ ); + + if ($group_name eq "") { + if ( $line =~ m/^Group name\s+(.+).$/ ) { + $group_name = $1; + next; + } + } + if ($group_desc eq "") { + if ( $line =~ m/^Comment\s+(.*)$/ ) { + $group_desc = $1; + next; + } + } + next if ( $line =~ m/^-+.$/ ); + if (!$has_members) { + if ( $line =~ m/^Members/ ) { + $has_members = 1; + next; + } + } else { + if ( $line =~ m/^The command completed successfully/ ) { + last; + } else { + push(@members, split(/\s+/, $line)); + next; + } + } + + #print; +} + +if ( $#members > -1) { + process_group($group_name, @members, $Options{'C'}, $Options{'U'}, $Options{'r'}); +} + +#print "gn=$group_name\n"; +#print "gd=$group_desc\n"; +#my $m; +#foreach $m (@members) +#{ +# print "$m "; +#} +#print "\n"; diff --git a/examples/LDAP/smbldap-tools/smbldap-passwd.pl b/examples/LDAP/smbldap-tools/smbldap-passwd.pl new file mode 100755 index 0000000000..29aee97c50 --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap-passwd.pl @@ -0,0 +1,216 @@ +#!/usr/bin/perl + +# LDAP to unix password sync script for samba +# +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2001-2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + +# Purpose : +# . ldap-unix passwd sync for SAMBA-2.2.2 + LDAP +# . may also replace /bin/passwd + +use strict; +use smbldap_tools; +use smbldap_conf; + +my $user; +my $oldpass; +my $ret; + +my $arg; + +foreach $arg (@ARGV) { + if ($< != 0) { + die "Only root can specify parameters\n"; + } else { + if ( ($arg eq '-?') || ($arg eq '--help') ) { + print "Usage: $0 [username]\n"; + print " -?, --help show this help message\n"; + exit (6); + } elsif (substr($arg,0) ne '-') { + $user = $arg; + } + $oldpass = 1; + } +} + +if (!defined($user)) { + $user=$ENV{"USER"}; +} + +# test existence of user in LDAP +my $dn_line; +if (!defined($dn_line = get_user_dn($user))) { + print "$0: user $user doesn't exist\n"; + exit (10); +} + +my $dn = get_dn_from_line($dn_line); + +my $samba = is_samba_user($user); + +print "Changing password for $user\n"; + +# non-root user +if (!defined($oldpass)) { + # prompt for current password + system "stty -echo"; + print "(current) UNIX password: "; + chomp($oldpass=); + print "\n"; + system "stty echo"; + + if (!is_user_valid($user, $dn, $oldpass)) { + print "Authentication failure\n"; + exit (10); + } +} + +# prompt for new password + +my $pass; +my $pass2; + +system "stty -echo"; +print "New password : "; +chomp($pass=); +print "\n"; +system "stty echo"; + +system "stty -echo"; +print "Retype new password : "; +chomp($pass2=); +print "\n"; +system "stty echo"; + +if ($pass ne $pass2) { + print "New passwords don't match!\n"; + exit (10); +} + +# only modify smb passwords if smb user +if ($samba == 1) { + if (!$with_smbpasswd) { +# generate LanManager and NT clear text passwords + if ($mk_ntpasswd eq '') { + print "Either set \$with_smbpasswd = 1 or specify \$mk_ntpasswd\n"; + exit(1); + } + my $ntpwd = `$mk_ntpasswd '$pass'`; + chomp(my $sambaLMPassword = substr($ntpwd, 0, index($ntpwd, ':'))); + chomp(my $sambaNTPassword = substr($ntpwd, index($ntpwd, ':')+1)); + +# change nt/lm passwords + my $tmpldif = +"$dn_line +changetype: modify +replace: sambaLMPassword +sambaLMPassword: $sambaLMPassword +- +changetype: modify +replace: sambaNTPassword +sambaNTPassword: $sambaNTPassword +- + +"; + die "$0: error while modifying password for $user\n" + unless (do_ldapmodify($tmpldif) == 0); + undef $tmpldif; + } + else { + if ($< != 0) { + my $FILE="|$smbpasswd -s >/dev/null"; + open (FILE, $FILE) || die "$!\n"; + print FILE < /dev/null"; +if ($ret == 0) { + print "all authentication tokens updated successfully\n"; +} else { + return $ret; +} + +exit 0; + + +# - The End + +=head1 NAME + +smbldap-passwd.pl - change user password + +=head1 SYNOPSIS + + smbldap-passwd.pl [name] + +=head1 DESCRIPTION + + smbldap-passwd.pl changes passwords for user accounts. A normal user + may only change the password for their own account, the super user may + change the password for any account. + + Password Changes + The user is first prompted for their old password, if one is present. + This password is then tested against the stored password by binding + to the server. The user has only one chance to enter the correct pass- + word. The super user is permitted to bypass this step so that forgot- + ten passwords may be changed. + + The user is then prompted for a replacement password. As a general + guideline, passwords should consist of 6 to 8 characters including + one or more from each of following sets: + + Lower case alphabetics + + Upper case alphabetics + + Digits 0 thru 9 + + Punctuation marks + + passwd will prompt again and compare the second entry against the first. + Both entries are require to match in order for the password to be + changed. + +=head1 SEE ALSO + + passwd(1) + +=cut + +#' diff --git a/examples/LDAP/smbldap-tools/smbldap-populate.pl b/examples/LDAP/smbldap-tools/smbldap-populate.pl new file mode 100755 index 0000000000..1676017c67 --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap-populate.pl @@ -0,0 +1,301 @@ +#!/usr/bin/perl + +# Populate a LDAP base for Samba-LDAP usage +# +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2001-2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + +# Purpose : +# . Create an initial LDAP database suitable for Samba 2.2 +# . For lazy people, replace ldapadd (with only an ldif parameter) + +use strict; +use smbldap_tools; +use smbldap_conf; + +use Getopt::Std; + +use vars qw(%oc); + +# objectclass of the suffix +%oc = ( + "ou" => "organizationalUnit", + "o" => "organization", + "dc" => "dcObject", +); + + +my %Options; + +my $ok = getopts('a:b:?', \%Options); +if ( (!$ok) || ($Options{'?'}) ) { + print "Usage: $0 [-ab?] [ldif]\n"; + print " -a administrator login name (default: Administrator)\n"; + print " -b guest login name (default: nobody)\n"; + print " -? show this help message\n"; + print " ldif file to add to ldap (default: suffix, Groups,"; + print " Users, Computers and builtin users )\n"; + exit (1); +} + +my $_ldifName; + +if (@ARGV >= 1) { + $_ldifName = $ARGV[0]; +} + +my $adminName = $Options{'a'}; +if (!defined($adminName)) { + $adminName = "Administrator"; +} + +my $guestName = $Options{'b'}; +if (!defined($guestName)) { + $guestName = "nobody"; +} + +if (!defined($_ldifName)) { + my $attr; + my $val; + my $objcl; + + if ($suffix =~ m/([^=]+)=([^,]+)/) { + $attr = $1; + $val = $2; + $objcl = $oc{$attr} if (exists $oc{$attr}); + if (!defined($objcl)) { + $objcl = "myhardcodedobjectclass"; + } + } else { + die "can't extract first attr and value from suffix $suffix"; + } + #print "$attr=$val\n"; + my ($organisation,$ext) = ($suffix =~ m/dc=(\w+),dc=(\w+)$/); + + #my $FILE="|cat"; + my $FILE="|$ldapadd -c"; + open (FILE, $FILE) || die "$!\n"; + + print FILE < +Source0: smbldap-groupadd.pl +Source1: smbldap-groupdel.pl +Source2: smbldap-groupmod.pl +Source3: smbldap-groupshow.pl +Source4: smbldap-passwd.pl +Source5: smbldap-useradd.pl +Source6: smbldap-userdel.pl +Source7: smbldap-usermod.pl +Source8: smbldap-usershow.pl +Source9: smbldap_conf.pm +Source10: smbldap_tools.pm +Source11: CONTRIBUTORS +Source12: COPYING +Source13: ChangeLog +Source14: FILES +Source15: README +Source16: TODO +Source17: mkntpwd.tar.gz +Source18: smbldap-populate.pl +Source19: smbldap-migrate-accounts.pl +Source20: smbldap-migrate-groups.pl +Source21: INFRA +BuildRoot: /%{_tmppath}/%{name} +Prefix: /usr/local +BuildRequires: perl >= 5.6 +Requires: perl >= 5.6, openldap, openldap-clients, samba + +%description +In settings with OpenLDAP and Samba-LDAP servers, this collection is +useful to add, modify and delete users and groups, and to change +Unix and Samba passwords. In those context they replace the system +tools to manage users, groups and passwords. + +%prep + +%setup -c -T + +%build +tar zxvf %{SOURCE17} +cd mkntpwd +make + +%install +rm -rf $RPM_BUILD_ROOT +mkdir -p $RPM_BUILD_ROOT/%{prefix}/sbin +mkdir -p $RPM_BUILD_ROOT/%{prefix}/share +mkdir -p $RPM_BUILD_ROOT/usr/share/doc +mkdir -p $RPM_BUILD_ROOT/usr/share/doc/smbldap-tools + +cd mkntpwd ; make PREFIX=$RPM_BUILD_ROOT/%{prefix} install + +install -m 550 %{SOURCE0} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap-groupadd.pl +install -m 550 %{SOURCE1} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap-groupdel.pl +install -m 550 %{SOURCE2} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap-groupmod.pl +install -m 555 %{SOURCE3} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap-groupshow.pl +install -m 555 %{SOURCE4} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap-passwd.pl +install -m 550 %{SOURCE5} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap-useradd.pl +install -m 550 %{SOURCE6} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap-userdel.pl +install -m 550 %{SOURCE7} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap-usermod.pl +install -m 555 %{SOURCE8} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap-usershow.pl +install -m 550 %{SOURCE18} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap-populate.pl +install -m 751 %{SOURCE9} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap_conf.pm +install -m 555 %{SOURCE10} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap_tools.pm +install -m 550 %{SOURCE19} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap-migrate-accounts.pl +install -m 550 %{SOURCE20} $RPM_BUILD_ROOT/%{prefix}/sbin/smbldap-migrate-groups.pl + +install -m 644 %{SOURCE11} $RPM_BUILD_ROOT/usr/share/doc/smbldap-tools/CONTRIBUTORS +install -m 644 %{SOURCE12} $RPM_BUILD_ROOT/usr/share/doc/smbldap-tools/COPYING +install -m 644 %{SOURCE13} $RPM_BUILD_ROOT/usr/share/doc/smbldap-tools/ChangeLog +install -m 644 %{SOURCE14} $RPM_BUILD_ROOT/usr/share/doc/smbldap-tools/FILES +install -m 644 %{SOURCE15} $RPM_BUILD_ROOT/usr/share/doc/smbldap-tools/README +install -m 644 %{SOURCE16} $RPM_BUILD_ROOT/usr/share/doc/smbldap-tools/TODO +install -m 644 %{SOURCE21} $RPM_BUILD_ROOT/usr/share/doc/smbldap-tools/INFRA + +%clean +rm -rf $RPM_BUILD_ROOT + +%post +ln -sf %{prefix}/sbin/smbldap_tools.pm /usr/lib/perl5/site_perl/smbldap_tools.pm +ln -sf %{prefix}/sbin/smbldap_conf.pm /usr/lib/perl5/site_perl/smbldap_conf.pm +chgrp 512 %{prefix}/sbin/smbldap-useradd.pl %{prefix}/sbin/smbldap_conf.pm || echo "An error occured while changing groups of smbldap-useradd.pl and smbldap_conf.pm in /usr/local/sbin. For proper operations, please ensure that they have the same posix group as the Samba domain administrator if there's a local Samba PDC." +perl -i -pe 's/_SLAVELDAP_/localhost/' %{prefix}/sbin/smbldap_conf.pm +perl -i -pe 's/_MASTERLDAP_/localhost/' %{prefix}/sbin/smbldap_conf.pm +perl -i -pe 's/_SUFFIX_/dc=IDEALX,dc=org/' %{prefix}/sbin/smbldap_conf.pm +perl -i -pe 's/_USERS_/Users/' %{prefix}/sbin/smbldap_conf.pm +perl -i -pe 's/_COMPUTERS_/Computers/' %{prefix}/sbin/smbldap_conf.pm +perl -i -pe 's/_GROUPS_/Groups/' %{prefix}/sbin/smbldap_conf.pm +perl -i -pe 's/_LOGINSHELL_/\/bin\/bash/' %{prefix}/sbin/smbldap_conf.pm +perl -i -pe 's/_HOMEPREFIX_/\/home\//' %{prefix}/sbin/smbldap_conf.pm +perl -i -pe 's/_BINDDN_/cn=Manager,\$suffix/' %{prefix}/sbin/smbldap_conf.pm +perl -i -pe 's/_BINDPW_/secret/' %{prefix}/sbin/smbldap_conf.pm +perl -i -pe 's/_PDCNAME_/PDC-SRV/' %{prefix}/sbin/smbldap_conf.pm +perl -i -pe 's/_HOMEDRIVE_/H/' %{prefix}/sbin/smbldap_conf.pm + +# FIXME: links should not be removed on upgrade +#%postun +#if [ $1 = 0 ] ; then +# rm -f /usr/lib/perl5/site_perl/smbldap_tools.pm +# rm -f /usr/lib/perl5/site_perl/smbldap_conf.pm +#fi + +%files +%defattr(-,root,root) +%{prefix}/sbin/*.pl +%{prefix}/sbin/smbldap_tools.pm +%config %{prefix}/sbin/smbldap_conf.pm +%{prefix}/sbin/mkntpwd +%doc /usr/share/doc/%{name}/ + + +%changelog +* Fri Aug 22 2003 Jerome Tournier 0.8-1 +- support for Samba3.0 + +* Thu Sep 26 2002 Gérald Macinenti 0.7-2 +- top and account objectclasses replaced by InetOrgPerson + +* Sat Jun 1 2002 Olivier Lemaire 0.7-1 +- some bugfixes about smbldap-populate +- bugfixed the smbpasswd call in smbldap-useradd +- cleaned up the smbldap_conf +- more documentation + +* Tue Apr 30 2002 Brad Langhorst 0.6-2 +- changed requires samba-common to samba +- replaced /usr/local with %{prefix} to allow relocation + +* Tue Feb 5 2002 David Le Corfec 0.6-1 +- v0.6 + +* Mon Feb 4 2002 David Le Corfec 0.5-1 +- v0.5 + +* Mon Jan 14 2002 David Le Corfec 0.3-4 +- internal changes +- should upgrade smoothly from now on + +* Mon Jan 14 2002 David Le Corfec 0.2-1 +- added migration scripts + +* Fri Dec 28 2001 David Le Corfec 0.1-5 +- numeric group for chmod + +* Thu Dec 27 2001 David Le Corfec 0.1-4 +- misc bugfixes + +* Mon Dec 18 2001 David Le Corfec 0.1-3 +- changed files attrs for domain admins to add users +- added smbldap-populate.pl + +* Fri Dec 14 2001 David Le Corfec +- added mkntpwd + +* Wed Dec 12 2001 Olivier Lemaire +- Spec file was generated, and tested atomically. diff --git a/examples/LDAP/smbldap-tools/smbldap-useradd.pl b/examples/LDAP/smbldap-tools/smbldap-useradd.pl new file mode 100755 index 0000000000..99c9525e82 --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap-useradd.pl @@ -0,0 +1,460 @@ +#!/usr/bin/perl + +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + +# Purpose of smbldap-useradd : user (posix,shadow,samba) add + +use strict; +use smbldap_tools; +use smbldap_conf; + +##################### + +use Getopt::Std; +my %Options; + +my $ok = getopts('axnmwPG:u:g:d:s:c:k:A:B:C:D:E:F:H:?', \%Options); + +if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { + print "Usage: $0 [-awmugdsckGPABCDEFH?] username\n"; + print " -a is a Windows User (otherwise, Posix stuff only)\n"; + print " -w is a Windows Workstation (otherwise, Posix stuff only)\n"; + print " -x creates rid and primaryGroupID in hex instead of decimal\n"; + print " -u uid\n"; + print " -g gid\n"; + print " -G supplementary comma-separated groups\n"; + print " -n do not create a group\n"; + print " -d home\n"; + print " -s shell\n"; + print " -c gecos\n"; + print " -m creates home directory and copies /etc/skel\n"; + print " -k skeleton dir (with -m)\n"; + print " -P ends by invoking smbldap-passwd.pl\n"; + print " -A can change password ? 0 if no, 1 if yes\n"; + print " -B must change password ? 0 if no, 1 if yes\n"; + print " -C sambaHomePath (SMB home share, like '\\\\PDC-SRV\\homes')\n"; + print " -D sambaHomeDrive (letter associated with home share, like 'H:')\n"; + print " -E sambaLogonScript (DOS script to execute on login)\n"; + print " -F sambaProfilePath (profile directory, like '\\\\PDC-SRV\\profiles\\foo')\n"; + print " -H sambaAcctFlags (samba account control bits like '[NDHTUMWSLKI]')\n"; + print " -? show this help message\n"; + exit (1); +} + +# cause problems when dealing with getpwuid because of the +# negative ttl and ldap modification +my $nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1"; + +if ($nscd_status == 0) { + system "/etc/init.d/nscd stop > /dev/null 2>&1"; +} + +# Read options +my $userUidNumber = $Options{'u'}; +if (!defined($userUidNumber)) { + # find first unused uid starting from $UID_START + while (defined(getpwuid($UID_START))) { + $UID_START++; + } + $userUidNumber = $UID_START; +} elsif (getpwuid($userUidNumber)) { die "Uid already exists.\n"; } + +if ($nscd_status == 0) { + system "/etc/init.d/nscd start > /dev/null 2>&1"; +} + + +# as rid we use 2 * uid + 1000 +my $userRid = 2 * $userUidNumber + 1000; +if (defined($Options{'x'})) { + $userRid= sprint("%x", $userRid); +} + +my $createGroup = 0; +my $userGidNumber = $Options{'g'}; +# gid not specified ? +if (!defined($userGidNumber)) { + # windows machine => $_defaultComputerGid + if (defined($Options{'w'})) { + $userGidNumber = $_defaultComputerGid; +# } elsif (!defined($Options{'n'})) { + # create new group (redhat style) + # find first unused gid starting from $GID_START +# while (defined(getgrgid($GID_START))) { +# $GID_START++; +# } +# $userGidNumber = $GID_START; + +# $createGroup = 1; + + } else { + # user will have gid = $_defaultUserGid + $userGidNumber = $_defaultUserGid; + } +} else { + my $gid; + if (($gid = parse_group($userGidNumber)) < 0) { + print "$0: unknown group $userGidNumber\n"; + exit (6); + } + $userGidNumber = $gid; +} + +# as grouprid we use 2 * gid + 1001 +my $userGroupRid = 2 * $userGidNumber + 1001; +if (defined($Options{'x'})) { + $userGroupRid = sprint("%x", $userGroupRid); +} +# Read only first @ARGV +my $userName = $ARGV[0]; + +# user must not exist in LDAP (should it be nss-wide ?) +my ($rc, $dn) = get_user_dn2($userName); +if ($rc and defined($dn)) { + print "$0: user $userName exists\n"; + exit (9); +} elsif (!$rc) { + print "$0: error in get_user_dn2\n"; + exit(10); +} + +my $userHomeDirectory; +my $tmp; +if (!defined($userHomeDirectory = $Options{'d'})) +{ + $userHomeDirectory = $_userHomePrefix."/".$userName; +} +$_userLoginShell = $tmp if (defined($tmp = $Options{'s'})); +$_userGecos = $tmp if (defined($tmp = $Options{'c'})); +$_skeletonDir = $tmp if (defined($tmp = $Options{'k'})); + +######################## + +# MACHINE ACCOUNT +if (defined($tmp = $Options{'w'})) { + + # add a trailing dollar if missing + if ($userName =~ /[^\$]$/s) { + $userName .= "\$"; + } + + #print "About to create machine $userName:\n"; + + if (!add_posix_machine ($userName, $userUidNumber, $userGidNumber)) { + die "$0: error while adding posix account\n"; + } + + if (!$with_smbpasswd) { + if (!add_samba_machine_mkntpwd($userName, $userUidNumber)) { + die "$0: error while adding samba account\n"; + } + } else { + if (!add_samba_machine($userName)) { + die "$0: error while adding samba account\n"; + } + + my $tmpldif = +"dn: uid=$userName,$computersdn +changetype: modify +sambaAcctFlags: [W ] + +"; + die "$0: error while modifying accountflags of $userName\n" + unless (do_ldapmodify($tmpldif) == 0); + undef $tmpldif; + } + + exit 0; +} + +####################### + +# USER ACCOUNT + +# add posix account first + +my $tmpldif = +"dn: uid=$userName,$usersdn +objectclass: inetOrgPerson +objectclass: posixAccount +cn: $userName +sn: $userName +uid: $userName +uidNumber: $userUidNumber +gidNumber: $userGidNumber +homeDirectory: $userHomeDirectory +loginShell: $_userLoginShell +gecos: $_userGecos +description: $_userGecos +userPassword: {crypt}x + +"; + +die "$0: error while adding posix user $userName\n" + unless (do_ldapadd($tmpldif) == 0); + +undef $tmpldif; + +#if ($createGroup) { +# group_add($userName, $userGidNumber); +#} + +group_add_user($userGidNumber, $userName); + +my $grouplist; +# adds to supplementary groups +if (defined($grouplist = $Options{'G'})) { + add_grouplist_user($grouplist, $userName); +} + +# If user was created successfully then we should create his/her home dir +if (defined($tmp = $Options{'m'})) { + unless ( $userName =~ /\$$/ ) { + if ( !(-e $userHomeDirectory) ) { + system "mkdir $userHomeDirectory 2>/dev/null"; + system "cp -a $_skeletonDir/.[a-z,A-Z]* $_skeletonDir/* $userHomeDirectory 2>/dev/null"; + system "chown -R $userUidNumber:$userGidNumber $userHomeDirectory 2>/dev/null"; + system "chmod 700 $userHomeDirectory 2>/dev/null"; + } + } +} + + +# Add Samba user infos +if (defined($Options{'a'})) { + if (!$with_smbpasswd) { + + my $winmagic = 2147483647; + my $valpwdcanchange = 0; + my $valpwdmustchange = $winmagic; + my $valacctflags = "[UX]"; + + if (defined($tmp = $Options{'A'})) { + if ($tmp != 0) { + $valpwdcanchange = "0"; + } else { + $valpwdcanchange = "$winmagic"; + } + } + + if (defined($tmp = $Options{'B'})) { + if ($tmp != 0) { + $valpwdmustchange = "0"; + } else { + $valpwdmustchange = "$winmagic"; + } + } + + if (defined($tmp = $Options{'H'})) { + $valacctflags = "$tmp"; + } + + my $tmpldif = +"dn: uid=$userName,$usersdn +changetype: modify +objectClass: inetOrgPerson +objectclass: posixAccount +objectClass: sambaSAMAccount +sambaPwdLastSet: 0 +sambaLogonTime: 0 +sambaLogoffTime: 2147483647 +sambaKickoffTime: 2147483647 +sambaPwdCanChange: $valpwdcanchange +sambaPwdMustChange: $valpwdmustchange +displayName: $_userGecos +sambaAcctFlags: $valacctflags +sambaSID: $smbldap_conf::SID-$userRid + +"; + + die "$0: error while adding samba account to posix user $userName\n" + unless (do_ldapmodify($tmpldif) == 0); + + undef $tmpldif; + } else { + my $FILE="|smbpasswd -s -a $userName >/dev/null" ; + open (FILE, $FILE) || die "$!\n"; + print FILE < 2) + + -c comment + The new user's comment field (gecos). + + -d home_dir + The new user will be created using home_dir as the value for the + user's login directory. The default is to append the login name + to default_home and use that as the login directory name. + + -g initial_group + The group name or number of the user's initial login group. The + group name must exist. A group number must refer to an already + existing group. The default group number is 1. + + -G group,[...] + A list of supplementary groups which the user is also a member + of. Each group is separated from the next by a comma, with no + intervening whitespace. The groups are subject to the same + restrictions as the group given with the -g option. The default + is for the user to belong only to the initial group. + + -m The user's home directory will be created if it does not exist. + The files contained in skeleton_dir will be copied to the home + directory if the -k option is used, otherwise the files con­ + tained in /etc/skel will be used instead. Any directories con­ + tained in skeleton_dir or /etc/skel will be created in the + user's home directory as well. The -k option is only valid in + conjunction with the -m option. The default is to not create + the directory and to not copy any files. + + -s shell + The name of the user's login shell. The default is to leave + this field blank, which causes the system to select the default + login shell. + + -u uid The numerical value of the user's ID. This value must be + unique, unless the -o option is used. The value must be non- + negative. The default is to use the smallest ID value greater + than 1000 and greater than every other user. + + -P ends by invoking smbldap-passwd.pl + + -A can change password ? 0 if no, 1 if yes + + -B must change password ? 0 if no, 1 if yes + + -C sambaHomePath (SMB home share, like '\\\\PDC-SRV\\homes') + + -D sambaHomeDrive (letter associated with home share, like 'H:') + + -E sambaLogonScript, relative to the [netlogon] share (DOS script to execute on login, like 'foo.bat') + + -F sambaProfilePath (profile directory, like '\\\\PDC-SRV\\profiles\\foo') + + -H sambaAcctFlags, spaces and trailing bracket are ignored (samba account control bits like '[NDHTUMWSLKI]') + +=head1 SEE ALSO + + useradd(1) + +=cut + +#' diff --git a/examples/LDAP/smbldap-tools/smbldap-userdel.pl b/examples/LDAP/smbldap-tools/smbldap-userdel.pl new file mode 100755 index 0000000000..435be4fdd0 --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap-userdel.pl @@ -0,0 +1,122 @@ +#!/usr/bin/perl + +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2001-2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + +# Purpose of smbldap-userdel : user (posix,shadow,samba) deletion + +use strict; +use smbldap_tools; + + +##################### + +use Getopt::Std; +my %Options; + +my $ok = getopts('r?', \%Options); + +if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { + print "Usage: $0 [-r?] username\n"; + print " -r remove home directory\n"; + exit (1); +} + +# Read only first @ARGV +my $user = $ARGV[0]; + +my $dn; +# user must not exist in LDAP +if (!defined($dn=get_user_dn($user))) { + print "$0: user $user does not exist\n"; + exit (6); +} + +if ($< != 0) { + print "You must be root to delete an user\n"; + exit (1); +} + +my $homedir; +if (defined($Options{'r'})) { + $homedir=get_homedir($user); +} + +# remove user from groups +my $groups = find_groups_of $user; +my @grplines = split(/\n/, $groups); + +my $grp; +foreach $grp (@grplines) { + my $gname = ""; + if ( $grp =~ /dn: cn=([^,]+),/) { + $gname = $1; + #print "xx $gname\n"; + } + if ($gname ne "") { + group_remove_member($gname, $user); + } +} + +# XXX +delete_user($user); + +# delete dir -- be sure that homeDir is not a strange value +if (defined($Options{'r'})) { + if ($homedir !~ /^\/dev/ and $homedir !~ /^\/$/) { + system "rm -rf $homedir"; + } +} + +my $nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1"; + +if ($nscd_status == 0) { + system "/etc/init.d/nscd restart > /dev/null 2>&1"; +} + +exit (0); + +############################################################ + +=head1 NAME + + smbldap-userdel.pl - Delete a user account and related files + +=head1 SYNOPSIS + + smbldap-userdel.pl [-r] login + +=head1 DESCRIPTION + + The smbldap-userdel.pl command modifies the system + account files, deleting all entries that refer to login. + The named user must exist. + + -r Files in the user's home directory will be removed along with + the home directory itself. Files located in other file + systems will have to be searched for and deleted manually. + +=head1 SEE ALSO + + userdel(1) + +=cut + +#' diff --git a/examples/LDAP/smbldap-tools/smbldap-usermod.pl b/examples/LDAP/smbldap-tools/smbldap-usermod.pl new file mode 100755 index 0000000000..dffb95bace --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap-usermod.pl @@ -0,0 +1,403 @@ +#!/usr/bin/perl + +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2001-2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + +# Purpose of smbldap-usermod : user (posix,shadow,samba) modification + +use strict; +use smbldap_tools; +use smbldap_conf; + + +##################### + +use Getopt::Std; +my %Options; +my $nscd_status; + +my $ok = getopts('A:B:C:D:E:F:H:IJxme:f:u:g:G:d:l:s:c:ok:?', \%Options); +if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { + print "Usage: $0 [-awmugdsckxABCDEFGHI?] username\n"; + print " -c gecos\n"; + print " -d home directory\n"; + #print " -m move home directory\n"; + #print " -e expire date (YYYY-MM-DD)\n"; + #print " -f inactive days\n"; + print " -u uid\n"; + print " -o uid can be non unique\n"; + print " -g gid\n"; + print " -G supplementary groups (comma separated)\n"; + print " -l login name\n"; + print " -s shell\n"; + print " -x creates rid and primaryGroupID in hex instead of decimal (for Samba 2.2.2 unpatched only)\n"; + print " -A can change password ? 0 if no, 1 if yes\n"; + print " -B must change password ? 0 if no, 1 if yes\n"; + print " -C sambaHomePath (SMB home share, like '\\\\PDC-SRV\\homes')\n"; + print " -D sambaHomeDrive (letter associated with home share, like 'H:')\n"; + print " -E sambaLogonScript (DOS script to execute on login)\n"; + print " -F sambaProfilePath (profile directory, like '\\\\PDC-SRV\\profiles\\foo')\n"; + print " -H sambaAcctFlags (samba account control bits like '[NDHTUMWSLKI]')\n"; + print " -I disable an user. Can't be used with -H or -J\n"; + print " -J enable an user. Can't be used with -H or -I\n"; + print " -? show this help message\n"; + exit (1); +} + +if ($< != 0) { + print "You must be root to modify an user\n"; + exit (1); +} + +# Read only first @ARGV +my $user = $ARGV[0]; + +# Read user datas +my $lines = read_user($user); +if (!defined($lines)) { + print "$0: user $user doesn't exist\n"; + exit (1); +} + +#print "$lines\n"; +my $dn_line; +if ( $lines =~ /(^dn: .*)/ ) { + $dn_line = $1; +} + +chomp($dn_line); + +my $samba = 0; +if ($lines =~ m/objectClass: sambaAccount/) { + $samba = 1; +} + +############ + +my $tmp; +my $mods; + +# Process options +my $changed_uid; +my $_userUidNumber; +my $_userRid; +if (defined($tmp = $Options{'u'})) { + if (defined($Options{'o'})) { + $nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1"; + + if ($nscd_status == 0) { + system "/etc/init.d/nscd stop > /dev/null 2>&1"; + } + + if (getpwuid($tmp)) { + if ($nscd_status == 0) { + system "/etc/init.d/nscd start > /dev/null 2>&1"; + } + + print "$0: uid number $tmp exists\n"; + exit (6); + } + if ($nscd_status == 0) { + system "/etc/init.d/nscd start > /dev/null 2>&1"; + } + + } + $_userUidNumber = $tmp; + # as rid we use 2 * uid + 1000 + my $_userRid = 2 * $_userUidNumber + 1000; + if (defined($Options{'x'})) { + $_userRid= sprint("%x", $_userRid); + } + $mods .= "uidNumber: $_userUidNumber\n"; + if ($samba) { + $mods .= "rid: $_userRid\n"; + } + $changed_uid = 1; +} + +my $changed_gid; +my $_userGidNumber; +my $_userGroupRid; +if (defined($tmp = $Options{'g'})) { + $_userGidNumber = parse_group($tmp); + if ($_userGidNumber < 0) { + print "$0: group $tmp doesn't exist\n"; + exit (6); + } +# as grouprid we use 2 * gid + 1001 + my $_userGroupRid = 2 * $_userGidNumber + 1001; + if (defined($Options{'x'})) { + $_userGroupRid = sprint("%x", $_userGroupRid); + } + $mods .= "gidNumber: $_userGidNumber\n"; + if ($samba) { + $mods .= "primaryGroupID: $_userGroupRid\n"; + } + $changed_gid = 1; +} + +my $changed_shell; +my $_userLoginShell; +if (defined($tmp = $Options{'s'})) { + $_userLoginShell = $tmp; + $mods .= "loginShell: $_userLoginShell\n"; + $changed_shell = 1; +} + +my $changed_gecos; +my $_userGecos; +if (defined($tmp = $Options{'c'})) { + $_userGecos = $tmp; + $mods .= "gecos: $_userGecos\n"; + $changed_gecos = 1; +} + +my $changed_homedir; +my $newhomedir; +if (defined($tmp = $Options{'d'})) { + $newhomedir = $tmp; + $mods .= "homeDirectory: $newhomedir\n"; + $changed_homedir = 1; +} + + +if (defined($tmp = $Options{'G'})) { + + # remove user from old groups + my $groups = find_groups_of $user; + my @grplines = split(/\n/, $groups); + + my $grp; + foreach $grp (@grplines) { + my $gname = ""; + if ( $grp =~ /dn: cn=([^,]+),/) { + $gname = $1; + #print "xx $gname\n"; + } + if ($gname ne "") { + group_remove_member($gname, $user); + } + } + + # add user to new groups + add_grouplist_user($tmp, $user); +} + +# +# A : sambaPwdCanChange +# B : sambaPwdMustChange +# C : sambaHomePath +# D : sambaHomeDrive +# E : sambaLogonScript +# F : sambaProfilePath +# H : sambaAcctFlags + +my $attr; +my $winmagic = 2147483647; + +if (defined($tmp = $Options{'A'})) { + $attr = "sambaPwdCanChange"; + if ($tmp != 0) { + $mods .= "$attr: 0\n"; + } else { + $mods .= "$attr: $winmagic\n"; + } +} + +if (defined($tmp = $Options{'B'})) { + $attr = "sambaPwdMustChange"; + if ($tmp != 0) { + $mods .= "$attr: 0\n"; + } else { + $mods .= "$attr: $winmagic\n"; + } +} + +if (defined($tmp = $Options{'C'})) { + $attr = "sambaHomePath"; + #$tmp =~ s/\\/\\\\/g; + $mods .= "$attr: $tmp\n"; +} + +if (defined($tmp = $Options{'D'})) { + $attr = "sambaHomeDrive"; + $tmp = $tmp.":" unless ($tmp =~ /:/); + $mods .= "$attr: $tmp\n"; +} + +if (defined($tmp = $Options{'E'})) { + $attr = "sambaLogonScript"; + #$tmp =~ s/\\/\\\\/g; + $mods .= "$attr: $tmp\n"; +} + +if (defined($tmp = $Options{'F'})) { + $attr = "sambaProfilePath"; + #$tmp =~ s/\\/\\\\/g; + $mods .= "$attr: $tmp\n"; +} + +if (defined($tmp = $Options{'H'})) { + $attr = "sambaAcctFlags"; + #$tmp =~ s/\\/\\\\/g; + $mods .= "$attr: $tmp\n"; +} elsif (defined($tmp = $Options{'I'})) { + my $flags; + + if ( $lines =~ /^sambaAcctFlags: (.*)/m ) { + $flags = $1; + } + + chomp($flags); + + if ( !($flags =~ /D/) ) { + my $letters; + if ($flags =~ /(\w+)/) { + $letters = $1; + } + $mods .= "sambaAcctFlags: \[D$letters\]\n"; + } +} elsif (defined($tmp = $Options{'J'})) { + my $flags; + + if ( $lines =~ /^sambaAcctFlags: (.*)/m ) { + $flags = $1; + } + + chomp($flags); + + if ( $flags =~ /D/ ) { + my $letters; + if ($flags =~ /(\w+)/) { + $letters = $1; + } + $letters =~ s/D//; + $mods .= "sambaAcctFlags: \[$letters\]\n"; + } +} + +if ($mods ne '') { + #print "----\n$dn_line\n$mods\n----\n"; + + my $tmpldif = +"$dn_line +changetype: modify +$mods +"; + + die "$0: error while modifying user $user\n" + unless (do_ldapmodify($tmpldif) == 0); + + undef $tmpldif; +} + +$nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1"; + +if ($nscd_status == 0) { + system "/etc/init.d/nscd restart > /dev/null 2>&1"; +} + + +############################################################ + +=head1 NAME + + smbldap-usermod.pl - Modify a user account + +=head1 SYNOPSIS + + smbldap-usermod.pl [-c comment] [-d home_dir] + [-g initial_group] [-G group[,...]] + [-l login_name] [-p passwd] + [-s shell] [-u uid [ -o]] [-x] + [-A canchange] [-B mustchange] [-C smbhome] + [-D homedrive] [-E scriptpath] [-F profilepath] + [-H acctflags] login + +=head1 DESCRIPTION + + The smbldap-usermod.pl command modifies the system account files + to reflect the changes that are specified on the command line. + The options which apply to the usermod command are + + -c comment + The new value of the user's comment field (gecos). + + -d home_dir + The user's new login directory. + + -g initial_group + The group name or number of the user's new initial login group. + The group name must exist. A group number must refer to an + already existing group. The default group number is 1. + + -G group,[...] + A list of supplementary groups which the user is also a member + of. Each group is separated from the next by a comma, with no + intervening whitespace. The groups are subject to the same + restrictions as the group given with the -g option. If the user + is currently a member of a group which is not listed, the user + will be removed from the group + + -l login_name + The name of the user will be changed from login to login_name. + Nothing else is changed. In particular, the user's home direc­ + tory name should probably be changed to reflect the new login + name. + + -s shell + The name of the user's new login shell. Setting this field to + blank causes the system to select the default login shell. + + -u uid The numerical value of the user's ID. This value must be + unique, unless the -o option is used. The value must be non- + negative. Any files which the user owns and which are + located in the directory tree rooted at the user's home direc­ + tory will have the file user ID changed automatically. Files + outside of the user's home directory must be altered manually. + + -x Creates rid and primaryGroupID in hex instead of decimal (for + Samba 2.2.2 unpatched only - higher versions always use decimal) + + -A can change password ? 0 if no, 1 if yes + + -B must change password ? 0 if no, 1 if yes + + -C sambaHomePath (SMB home share, like '\\\\PDC-SRV\\homes') + + -D sambaHomeDrive (letter associated with home share, like 'H:') + + -E sambaLogonScript, relative to the [netlogon] share (DOS script to execute on login, like 'foo.bat') + + -F sambaProfilePath (profile directory, like '\\\\PDC-SRV\\profiles\\foo') + + -H sambaAcctFlags, spaces and trailing bracket are ignored (samba account control bits like '[NDHTUMWSLKI]') + + -I disable user. Can't be used with -H or -J + + -J enable user. Can't be used with -H or -I + +=head1 SEE ALSO + + usermod(1) + +=cut + +#' diff --git a/examples/LDAP/smbldap-tools/smbldap-usershow.pl b/examples/LDAP/smbldap-tools/smbldap-usershow.pl new file mode 100755 index 0000000000..b05f087620 --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap-usershow.pl @@ -0,0 +1,69 @@ +#!/usr/bin/perl + +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2001-2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + +# Purpose of smbldap-userdisplay : user (posix,shadow,samba) display + +use strict; +use smbldap_tools; + +use Getopt::Std; +my %Options; + +my $ok = getopts('?', \%Options); + +if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { + print "Usage: $0 [-?] username\n"; + print " -? show this help message\n"; + exit (1); +} + +# Read only first @ARGV +my $user = $ARGV[0]; + +my $lines = read_user($user); +if (!defined($lines)) { + print "$0: user $user doesn't exist\n"; + exit (1); +} + +print "$lines\n"; + +exit(0); + +############################################################ + +=head1 NAME + + smbldap-usershow.pl - Show a user account informations + +=head1 SYNOPSIS + + smbldap-usershow.pl login + +=head1 DESCRIPTION + + The smbldap-usershow.pl command displays the informations + associated with the login. The named user must exist. + +=cut + +#' diff --git a/examples/LDAP/smbldap-tools/smbldap_conf.pm b/examples/LDAP/smbldap-tools/smbldap_conf.pm new file mode 100644 index 0000000000..dd1d772ea7 --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap_conf.pm @@ -0,0 +1,281 @@ +#!/usr/bin/perl +use strict; +package smbldap_conf; + +# smbldap-tools.conf : Q & D configuration file for smbldap-tools + +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2001-2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + +# Purpose : +# . be the configuration file for all smbldap-tools scripts + +use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS +$UID_START $GID_START $smbpasswd $slaveLDAP $masterLDAP +$slavePort $masterPort $ldapSSL $slaveURI $masterURI $with_smbpasswd $mk_ntpasswd +$ldap_path $ldap_opts $ldapsearch $ldapsearchnobind +$ldapmodify $ldappasswd $ldapadd $ldapdelete $ldapmodrdn +$suffix $usersdn $computersdn +$groupsdn $scope $binddn $bindpasswd +$slaveDN $slavePw $masterDN $masterPw +$_userLoginShell $_userHomePrefix $_userGecos +$_defaultUserGid $_defaultComputerGid +$_skeletonDir $_userSmbHome +$_userProfile $_userHomeDrive +$_userScript $usersou $computersou $groupsou +); + +use Exporter; +$VERSION = 1.00; +@ISA = qw(Exporter); + +@EXPORT = qw( +$UID_START $GID_START $smbpasswd $slaveLDAP $masterLDAP +$slavePort $masterPort $ldapSSL $slaveURI $masterURI $with_smbpasswd $mk_ntpasswd +$ldap_path $ldap_opts $ldapsearch $ldapsearchnobind $ldapmodify $ldappasswd +$ldapadd $ldapdelete $ldapmodrdn $suffix $usersdn +$computersdn $groupsdn $scope $binddn $bindpasswd +$slaveDN $slavePw $masterDN $masterPw +$_userLoginShell $_userHomePrefix $_userGecos +$_defaultUserGid $_defaultComputerGid $_skeletonDir +$_userSmbHome $_userProfile $_userHomeDrive $_userScript +$usersou $computersou $groupsou +); + + +############################################################################## +# +# General Configuration +# +############################################################################## + +# +# UID and GID starting at... +# + +$UID_START = 1000; +$GID_START = 1000; + +# Put your own SID +# to obtain this number do: # net getlocalsid +our $SID='S-1-5-21-636805976-1992644568-3666589737'; + +############################################################################## +# +# LDAP Configuration +# +############################################################################## + +# Notes: to use to dual ldap servers backend for Samba, you must patch +# Samba with the dual-head patch from IDEALX. If not using this patch +# just use the same server for slaveLDAP and masterLDAP. +# +# Slave LDAP : needed for read operations +# +# Ex: $slaveLDAP = "127.0.0.1"; +$slaveLDAP = "127.0.0.1"; + +$slavePort = "389"; + +# +# Master LDAP : needed for write operations +# +# Ex: $masterLDAP = "127.0.0.1"; +$masterLDAP = "127.0.0.1"; + + +# +# Master Port +# 389 636 +# Ex: $masterPort = " +$masterPort = "389"; + +# +# Use SSL for LDAP +# +$ldapSSL = "0"; + +# +# LDAP Suffix +# +# Ex: $suffix = "dc=IDEALX,dc=ORG"; +$suffix = "dc=IDEALX,dc=ORG"; + + +# +# Where are stored Users +# +# Ex: $usersdn = "ou=Users,$suffix"; for ou=Users,dc=IDEALX,dc=ORG +$usersou = q(_USERS_); + +$usersdn = "ou=$usersou,$suffix"; + +# +# Where are stored Computers +# +# Ex: $computersdn = "ou=Computers,$suffix"; for ou=Computers,dc=IDEALX,dc=ORG +$computersou = q(_COMPUTERS_); + +$computersdn = "ou=$computersou,$suffix"; + +# +# Where are stored Groups +# +# Ex $groupsdn = "ou=Groups,$suffix"; for ou=Groups,dc=IDEALX,dc=ORG +$groupsou = q(_GROUPS_); + +$groupsdn = "ou=$groupsou,$suffix"; + +# +# Default scope Used +# +$scope = "sub"; + +# +# Credential Configuration +# +# Bind DN used +# Ex: $binddn = "cn=Manager,$suffix"; for cn=Manager,dc=IDEALX,dc=org +$binddn = "cn=Manager,$suffix"; +# +# Bind DN passwd used +# Ex: $bindpasswd = 'secret'; for 'secret' +$bindpasswd = "secret"; + +# +# Notes: if using dual ldap patch, you can specify to different configuration +# By default, we will use the same DN (so it will work for standard Samba +# release) +# +$slaveDN = $binddn; +$slavePw = $bindpasswd; +$masterDN = $binddn; +$masterPw = $bindpasswd; + +############################################################################## +# +# Unix Accounts Configuration +# +############################################################################## + +# Login defs +# +# Default Login Shell +# +# Ex: $_userLoginShell = q(/bin/bash); +$_userLoginShell = q(_LOGINSHELL_); + +# +# Home directory prefix (without username) +# +#Ex: $_userHomePrefix = q(/home/); +$_userHomePrefix = q(_HOMEPREFIX_); + +# +# Gecos +# +$_userGecos = q(System User); + +# +# Default User (POSIX and Samba) GID +# +$_defaultUserGid = 100; + +# +# Default Computer (Samba) GID +# +$_defaultComputerGid = 553; + +# +# Skel dir +# +$_skeletonDir = q(/etc/skel); + +############################################################################## +# +# SAMBA Configuration +# +############################################################################## + +# +# The UNC path to home drives location without the username last extension +# (will be dynamically prepended) +# Ex: q(\\\\My-PDC-netbios-name\\homes) for \\My-PDC-netbios-name\homes +$_userSmbHome = q(\\\\_PDCNAME_\\homes); + +# +# The UNC path to profiles locations without the username last extension +# (will be dynamically prepended) +# Ex: q(\\\\My-PDC-netbios-name\\profiles) for \\My-PDC-netbios-name\profiles +$_userProfile = q(\\\\_PDCNAME_\\profiles\\); + +# +# The default Home Drive Letter mapping +# (will be automatically mapped at logon time if home directory exist) +# Ex: q(U:) for U: +$_userHomeDrive = q(_HOMEDRIVE_); + +# +# The default user netlogon script name +# if not used, will be automatically username.cmd +# +#$_userScript = q(startup.cmd); # make sure script file is edited under dos + + +############################################################################## +# +# SMBLDAP-TOOLS Configuration (default are ok for a RedHat) +# +############################################################################## + +# Allows not to use smbpasswd (if $with_smbpasswd == 0 in smbldap_conf.pm) but +# prefer mkntpwd... most of the time, it's a wise choice :-) +$with_smbpasswd = 0; +$smbpasswd = "/usr/bin/smbpasswd"; +$mk_ntpasswd = "/usr/local/sbin/mkntpwd"; + +if ( $ldapSSL eq "0" ) { + $slaveURI = "ldap://$slaveLDAP:$slavePort"; + $masterURI = "ldap://$masterLDAP:$masterPort"; +} +elsif ( $ldapSSL eq "1" ) { + $slaveURI = "ldaps://$slaveLDAP:$slavePort"; + $masterURI = "ldaps://$masterLDAP:$masterPort"; +} +else { + die "ldapSSL option must be either 0 or 1.\n"; +} + + +$ldap_path = "/usr/bin"; +$ldap_opts = "-x"; +$ldapsearch = "$ldap_path/ldapsearch $ldap_opts -H $slaveURI -D '$slaveDN' -w '$slavePw'"; +$ldapsearchnobind = "$ldap_path/ldapsearch $ldap_opts -H $slaveURI"; +$ldapmodify = "$ldap_path/ldapmodify $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; +$ldappasswd = "$ldap_path/ldappasswd $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; +$ldapadd = "$ldap_path/ldapadd $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; +$ldapdelete = "$ldap_path/ldapdelete $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; +$ldapmodrdn = "$ldap_path/ldapmodrdn $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; + + + +1; + +# - The End diff --git a/examples/LDAP/smbldap-tools/smbldap_tools.pm b/examples/LDAP/smbldap-tools/smbldap_tools.pm new file mode 100755 index 0000000000..ad6ef74eb6 --- /dev/null +++ b/examples/LDAP/smbldap-tools/smbldap_tools.pm @@ -0,0 +1,710 @@ +#! /usr/bin/perl +use strict; +package smbldap_tools; +use smbldap_conf; +use Net::LDAP; + +# This code was developped by IDEALX (http://IDEALX.org/) and +# contributors (their names can be found in the CONTRIBUTORS file). +# +# Copyright (C) 2001-2002 IDEALX +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, +# USA. + + +# ugly funcs using global variables and spawning openldap clients + +use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS); +use Exporter; +$VERSION = 1.00; + +@ISA = qw(Exporter); + +@EXPORT = qw( +get_user_dn +get_group_dn +is_samba_user +is_user_valid +get_dn_from_line +add_posix_machine +add_samba_machine +add_samba_machine_mkntpwd +group_add_user +add_grouplist_user +disable_user +delete_user +group_add +get_homedir +read_user +read_group +find_groups_of +parse_group +group_remove_member +group_get_members +do_ldapadd +do_ldapmodify +get_user_dn2 +); + +# dn_line = get_user_dn($username) +# where dn_line is like "dn: a=b,c=d" + +#sub ldap_search +#{ +#my ($local_base,$local_scope,$local_filtre)=@_; +#} + + + +sub get_user_dn +{ + my $user = shift; + my $dn=''; + my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; + $ldap->bind ; + my $mesg = $ldap->search ( base => $suffix, + scope => $scope, + filter => "(&(objectclass=posixAccount)(uid=$user))" + ); + $mesg->code && die $mesg->error; + foreach my $entry ($mesg->all_entries) { + $dn= $entry->dn;} + $ldap->unbind; + chomp($dn); + if ($dn eq '') { + return undef; + } + $dn="dn: ".$dn; + return $dn; +} + + +sub get_user_dn2 ## migré +{ + my $user = shift; + my $dn=''; + my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; + $ldap->bind ; + my $mesg = $ldap->search ( base => $suffix, + scope => $scope, + filter => "(&(objectclass=posixAccount)(uid=$user))" + ); + # $mesg->code && warn $mesg->error; + if ($mesg->code) + { + print("Code erreur : ",$mesg->code,"\n"); + print("Message d'erreur : ",$mesg->error,"\n"); + return (0,undef); + } + + foreach my $entry ($mesg->all_entries) { + $dn= $entry->dn; + } + $ldap->unbind; + chomp($dn); + if ($dn eq '') { + return (1,undef); + } + $dn="dn: ".$dn; + return (1,$dn); +} + + +sub get_group_dn + { + my $group = shift; + my $dn=''; + my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; + $ldap->bind ; + my $mesg = $ldap->search ( base => $groupsdn, + scope => $scope, + filter => "(&(objectclass=posixGroup)(|(cn=$group)(gidNumber=$group)))" + ); + $mesg->code && die $mesg->error; + foreach my $entry ($mesg->all_entries) { + $dn= $entry->dn;} + $ldap->unbind; + chomp($dn); + if ($dn eq '') { + return undef; + } + $dn="dn: ".$dn; + return $dn; + } + +# return (success, dn) +# bool = is_samba_user($username) +sub is_samba_user + { + my $user = shift; + my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; + $ldap->bind ; + my $mesg = $ldap->search ( base => $suffix, + scope => $scope, + filter => "(&(objectClass=sambaSamAccount)(uid=$user))" + ); + $mesg->code && die $mesg->error; + $ldap->unbind; + return ($mesg->count ne 0); + } + + +# try to bind with user dn and password to validate current password +sub is_user_valid + { + my ($user, $dn, $pass) = @_; + my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; + my $mesg= $ldap->bind (dn => $dn, password => $pass ); + if ($mesg->code eq 0) + { + $ldap->unbind; + return 1; + } + else + { + if($ldap->bind()) { + $ldap->unbind; + return 0; + } else { + print ("Le serveur LDAP est indisponible.\nVérifier le serveur, les câblages, ..."); + $ldap->unbind; + return 0; + } die "Problème : Contacter votre administrateur"; + } +} + +# dn = get_dn_from_line ($dn_line) +# helper to get "a=b,c=d" from "dn: a=b,c=d" +sub get_dn_from_line + { + my $dn = shift; + $dn =~ s/^dn: //; + return $dn; + } + +# success = add_posix_machine($user, $uid, $gid) +sub add_posix_machine + { + my ($user, $uid, $gid) = @_; + my $tmpldif = + "dn: uid=$user,$computersdn +objectclass: inetOrgPerson +objectclass: posixAccount +sn: $user +cn: $user +uid: $user +uidNumber: $uid +gidNumber: $gid +homeDirectory: /dev/null +loginShell: /bin/false +description: Computer + +"; + + die "$0: error while adding posix account to machine $user\n" + unless (do_ldapadd($tmpldif) == 0); + undef $tmpldif; + return 1; + } + +# success = add_samba_machine($computername) +sub add_samba_machine +{ + my $user = shift; + system "smbpasswd -a -m $user"; + return 1; +} + +sub add_samba_machine_mkntpwd + { + my ($user, $uid) = @_; + my $sambaSID = 2 * $uid + 1000; + my $name = $user; + $name =~ s/.$//s; + + if ($mk_ntpasswd eq '') { + print "Either set \$with_smbpasswd = 1 or specify \$mk_ntpasswd\n"; + return 0; + } + + my $ntpwd = `$mk_ntpasswd '$name'`; + chomp(my $lmpassword = substr($ntpwd, 0, index($ntpwd, ':'))); + chomp(my $ntpassword = substr($ntpwd, index($ntpwd, ':')+1)); + + my $tmpldif = + "dn: uid=$user,$computersdn +changetype: modify +objectclass: inetOrgPerson +objectclass: posixAccount +objectClass: sambaSamAccount +sambaPwdLastSet: 0 +sambaLogonTime: 0 +sambaLogoffTime: 2147483647 +sambaKickoffTime: 2147483647 +sambaPwdCanChange: 0 +sambaPwdMustChange: 2147483647 +sambaAcctFlags: [W ] +sambaLMPassword: $lmpassword +sambaNTPassword: $ntpassword +sambaSID: $smbldap_conf::SID-$sambaSID +sambaPrimaryGroupSID: $smbldap_conf::SID-0 + +"; + + die "$0: error while adding samba account to $user\n" + unless (do_ldapmodify($tmpldif) == 0); + undef $tmpldif; + + return 1; + } + + + +sub group_add_user + { + my ($group, $userid) = @_; + my $members=''; + my $dn_line = get_group_dn($group); + if (!defined($dn_line)) { + return 1; + } + my $dn = get_dn_from_line($dn_line); + + my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; + $ldap->bind ; + my $mesg = $ldap->search ( base =>$dn, scope => "base", filter => "(objectClass=*)" ); + $mesg->code && die $mesg->error; + foreach my $entry ($mesg->all_entries){ + foreach my $attr ($entry->attributes) + { + if ($attr=~/\bmemberUid\b/){ + foreach my $ent($entry->get_value($attr)) { $members.= $attr.": ".$ent."\n"; } + } + } + } + $ldap->unbind; + chomp($members); + # user already member ? + if ($members =~ m/^memberUid: $userid/) { + return 2; + } + my $mods = ""; + if ($members ne '') { + $mods="$dn_line +changetype: modify +replace: memberUid +$members +memberUid: $userid + +"; + } else { + $mods="$dn_line +changetype: modify +add: memberUid +memberUid: $userid + +"; + } + #print "$mods\n"; + my $tmpldif = + "$mods +"; + + die "$0: error while modifying group $group\n" + unless (do_ldapmodify($tmpldif) == 0); + undef $tmpldif; + return 0; + } + +sub add_grouplist_user + { + my ($grouplist, $user) = @_; + my @array = split(/,/, $grouplist); + foreach my $group (@array) { + group_add_user($group, $user); + } + } + +# XXX FIXME : sambaAcctFlags |= D, and not sambaAcctFlags = D +sub disable_user + { + my $user = shift; + my $dn_line; + + if (!defined($dn_line = get_user_dn($user))) { + print "$0: user $user doesn't exist\n"; + exit (10); + } + + my $tmpldif = + "dn: $dn_line +changetype: modify +replace: userPassword +userPassword: {crypt}!x + +"; + + die "$0: error while modifying user $user\n" + unless (do_ldapmodify($tmpldif) == 0); + undef $tmpldif; + + if (is_samba_user($user)) { + + my $tmpldif = + "dn: $dn_line +changetype: modify +replace: sambaAcctFlags +sambaAcctFlags: [D ] + +"; + + die "$0: error while modifying user $user\n" + unless (do_ldapmodify($tmpldif) == 0); + undef $tmpldif; + } + } + +# delete_user($user) +sub delete_user + { + my $user = shift; + my $dn_line; + + if (!defined($dn_line = get_user_dn($user))) { + print "$0: user $user doesn't exist\n"; + exit (10); + } + + my $dn = get_dn_from_line($dn_line); + system "$ldapdelete $dn >/dev/null"; + } + +# $success = group_add($groupname, $group_gid, $force_using_existing_gid) +sub group_add + { + my ($gname, $gid, $force) = @_; + my $nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1"; + if ($nscd_status == 0) { + system "/etc/init.d/nscd stop > /dev/null 2>&1"; + } + if (!defined($gid)) { + while (defined(getgrgid($GID_START))) { + $GID_START++; + } + $gid = $GID_START; + } else { + if (!defined($force)) { + if (defined(getgrgid($gid))) { + return 0; + } + } + } + if ($nscd_status == 0) { + system "/etc/init.d/nscd start > /dev/null 2>&1"; + } + my $tmpldif = + "dn: cn=$gname,$groupsdn +objectclass: posixGroup +cn: $gname +gidNumber: $gid + +"; + + die "$0: error while adding posix group $gname\n" + unless (do_ldapadd($tmpldif) == 0); + undef $tmpldif; + return 1; + } + +# $homedir = get_homedir ($user) +sub get_homedir + { + my $user = shift; + my $homeDir=''; + # my $homeDir=`$ldapsearch -b '$suffix' -s '$scope' '(&(objectclass=posixAccount)(uid=$user))' | grep "^homeDirectory:"`; + my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; + $ldap->bind ; + my $mesg = $ldap->search ( base =>$suffix, scope => $scope, filter => "(&(objectclass=posixAccount)(uid=$user))" ); + $mesg->code && die $mesg->error; + foreach my $entry ($mesg->all_entries){ + foreach my $attr ($entry->attributes) + { + if ($attr=~/\bhomeDirectory\b/){ + foreach my $ent($entry->get_value($attr)) { + $homeDir.= $attr.": ".$ent."\n"; + } + } + } + } + $ldap->unbind; + chomp $homeDir; + if ($homeDir eq '') { + return undef; + } + $homeDir =~ s/^homeDirectory: //; + return $homeDir; + } + +# search for an user +sub read_user + { + my $user = shift; + my $lines =''; + my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; + $ldap->bind ; + my $mesg = $ldap->search ( # perform a search + base => $suffix, + scope => $scope, + filter => "(&(objectclass=posixAccount)(uid=$user))" + ); + + $mesg->code && die $mesg->error; + foreach my $entry ($mesg->all_entries) { + $lines.= "dn: " . $entry->dn."\n"; + foreach my $attr ($entry->attributes) { + { + $lines.= $attr.": ".join(',', $entry->get_value($attr))."\n"; + } + } + } + $ldap->unbind; # take down sessio(n + chomp $lines; + if ($lines eq '') { + return undef; + } + return $lines; + } + +# search for a group +sub read_group + { + my $user = shift; + my $lines =''; + my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; + $ldap->bind ; + my $mesg = $ldap->search ( # perform a search + base => $groupsdn, + scope => $scope, + filter => "(&(objectclass=posixGroup)(cn=$user))" + ); + + $mesg->code && die $mesg->error; + foreach my $entry ($mesg->all_entries) { + $lines.= "dn: " . $entry->dn."\n"; + foreach my $attr ($entry->attributes) { + { + $lines.= $attr.": ".join(',', $entry->get_value($attr))."\n"; + } + } + } + + $ldap->unbind; # take down sessio(n + chomp $lines; + if ($lines eq '') { + return undef; + } + return $lines; + } + +# find groups of a given user +##### MODIFIE ######## +sub find_groups_of + { + my $user = shift; + my $lines =''; + my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; + $ldap->bind ; + my $mesg = $ldap->search ( # perform a search + base => $groupsdn, + scope => $scope, + filter => "(&(objectclass=posixGroup)(memberuid=$user))" + ); + $mesg->code && die $mesg->error; + foreach my $entry ($mesg->all_entries) { + $lines.= "dn: ".$entry->dn."\n"; + } + $ldap->unbind; + chomp($lines); + if ($lines eq '') {return undef; } + return $lines; + } + +# return the gidnumber for a group given as name or gid +# -1 : bad group name +# -2 : bad gidnumber +sub parse_group + { + my $userGidNumber = shift; + if ($userGidNumber =~ /[^\d]/ ) { + my $gname = $userGidNumber; + my $gidnum = getgrnam($gname); + if ($gidnum !~ /\d+/) { + return -1; + } else { + $userGidNumber = $gidnum; + } + } elsif (!defined(getgrgid($userGidNumber))) { + return -2; + } + return $userGidNumber; + } + +# remove $user from $group +sub group_remove_member + { + my ($group, $user) = @_; + my $members=''; + my $grp_line = get_group_dn($group); + if (!defined($grp_line)) { + return 0; + } + + my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; + $ldap->bind ; + my $mesg = $ldap->search ( base => $groupsdn, + scope => $scope, + filter => "(&(objectclass=posixgroup)(cn=$group))" + ); + $mesg->code && die $mesg->error; + foreach my $entry ($mesg->all_entries){ + foreach my $attr ($entry->attributes) + { + if ($attr=~/\bmemberUid\b/){ + foreach my $ent($entry->get_value($attr)) { + $members.= $attr.": ".$ent."\n"; + } + } + } + } + #print "Valeurs de members :\n$members"; + $ldap->unbind; + # my $members = `$ldapsearch -b '$groupsdn' -s '$scope' '(&(objectclass=posixgroup)(cn=$group))' | grep -i "^memberUid:"`; + # print "avant ---\n$members\n"; + $members =~ s/memberUid: $user\n//; + #print "après ---\n$members\n"; + chomp($members); + + my $header; + if ($members eq '') { + $header = "changetype: modify\n"; + $header .= "delete: memberUid"; + } else { + $header = "changetype: modify\n"; + $header .= "replace: memberUid"; + } + + my $tmpldif = +"$grp_line +$header +$members +"; + + #print "Valeur du tmpldif : \n$tmpldif"; + die "$0: error while modifying group $group\n" + unless (do_ldapmodify($tmpldif) == 0); + undef $tmpldif; + + $ldap->unbind; + return 1; + } + +sub group_get_members + { + my ($group) = @_; + my $members; + my @resultat; + my $grp_line = get_group_dn($group); + if (!defined($grp_line)) { return 0; } + + my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; + $ldap->bind ; + my $mesg = $ldap->search ( base => $groupsdn, + scope => $scope, + filter => "(&(objectclass=posixgroup)(cn=$group))" + ); + $mesg->code && die $mesg->error; + foreach my $entry ($mesg->all_entries){ + foreach my $attr ($entry->attributes){ + if ($attr=~/\bmemberUid\b/){ + foreach my $ent($entry->get_value($attr)) { push (@resultat,$ent); } + } + } + } + return @resultat; + } + +sub file_write { + my ($filename, $filecontent) = @_; + local *FILE; + open (FILE, "> $filename") || + die "Cannot open $filename for writing: $!\n"; + print FILE $filecontent; + close FILE; +} + +# wrapper for ldapadd +sub do_ldapadd2 + { + my $ldif = shift; + my $tempfile = "/tmp/smbldapadd.$$"; + file_write($tempfile, $ldif); + + my $rc = system "$ldapadd < $tempfile >/dev/null"; + unlink($tempfile); + return $rc; + } + +sub do_ldapadd + { + my $ldif = shift; + my $FILE = "|$ldapadd >/dev/null"; + open (FILE, $FILE) || die "$!\n"; + print FILE </dev/null"; + unlink($tempfile); + return $rc; + } + +sub do_ldapmodify + { + my $ldif = shift; + my $FILE = "|$ldapmodify -r >/dev/null"; + open (FILE, $FILE) || die "$!\n"; + print FILE <num_volumes = num; + + if (labels) { + shadow_copy_data->labels = (SHADOW_COPY_LABEL *)talloc_zero(shadow_copy_data->mem_ctx,(num)*sizeof(SHADOW_COPY_LABEL)); + for (i=0;ilabels[i], sizeof(SHADOW_COPY_LABEL), "@GMT-2003.08.05-12.%02u.00",i); + } + } else { + shadow_copy_data->labels = NULL; + } + + return 0; +} + +/* VFS operations structure */ + +static vfs_op_tuple shadow_copy_test_ops[] = { + {SMB_VFS_OP(test_get_shadow_copy_data), SMB_VFS_OP_GET_SHADOW_COPY_DATA,SMB_VFS_LAYER_OPAQUE}, + + {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} +}; + +NTSTATUS init_module(void) +{ + return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "shadow_copy_test", shadow_copy_test_ops); +} diff --git a/examples/VFS/skel_opaque.c b/examples/VFS/skel_opaque.c index e507dc1094..de82801d85 100644 --- a/examples/VFS/skel_opaque.c +++ b/examples/VFS/skel_opaque.c @@ -66,6 +66,11 @@ static int skel_set_quota(vfs_handle_struct *handle, connection_struct *conn, en return vfswrap_set_quota(NULL, conn, qtype, id, dq); } +static int skel_get_shadow_copy_data(vfs_handle_struct *handle, files_struct *fsp, SHADOW_COPY_DATA *shadow_copy_data, BOOL labels) +{ + return vfswrap_get_shadow_copy_data(NULL, fsp, shadow_copy_data, labels); +} + static DIR *skel_opendir(vfs_handle_struct *handle, connection_struct *conn, const char *fname) { return vfswrap_opendir(NULL, conn, fname); @@ -468,7 +473,8 @@ static vfs_op_tuple skel_op_tuples[] = { {SMB_VFS_OP(skel_disk_free), SMB_VFS_OP_DISK_FREE, SMB_VFS_LAYER_OPAQUE}, {SMB_VFS_OP(skel_get_quota), SMB_VFS_OP_GET_QUOTA, SMB_VFS_LAYER_OPAQUE}, {SMB_VFS_OP(skel_set_quota), SMB_VFS_OP_SET_QUOTA, SMB_VFS_LAYER_OPAQUE}, - + {SMB_VFS_OP(skel_get_shadow_copy_data), SMB_VFS_OP_GET_SHADOW_COPY_DATA,SMB_VFS_LAYER_OPAQUE}, + /* Directory operations */ {SMB_VFS_OP(skel_opendir), SMB_VFS_OP_OPENDIR, SMB_VFS_LAYER_OPAQUE}, diff --git a/examples/VFS/skel_transparent.c b/examples/VFS/skel_transparent.c index b2db76c9f9..7a326741c5 100644 --- a/examples/VFS/skel_transparent.c +++ b/examples/VFS/skel_transparent.c @@ -65,6 +65,11 @@ static int skel_set_quota(vfs_handle_struct *handle, connection_struct *conn, en return SMB_VFS_NEXT_SET_QUOTA(handle, conn, qtype, id, dq); } +static int skel_get_shadow_copy_data(vfs_handle_struct *handle, files_struct *fsp, SHADOW_COPY_DATA *shadow_copy_data, BOOL labels) +{ + return SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data, labels); +} + static DIR *skel_opendir(vfs_handle_struct *handle, connection_struct *conn, const char *fname) { return SMB_VFS_NEXT_OPENDIR(handle, conn, fname); @@ -437,7 +442,8 @@ static vfs_op_tuple skel_op_tuples[] = { {SMB_VFS_OP(skel_disk_free), SMB_VFS_OP_DISK_FREE, SMB_VFS_LAYER_TRANSPARENT}, {SMB_VFS_OP(skel_get_quota), SMB_VFS_OP_GET_QUOTA, SMB_VFS_LAYER_TRANSPARENT}, {SMB_VFS_OP(skel_set_quota), SMB_VFS_OP_SET_QUOTA, SMB_VFS_LAYER_TRANSPARENT}, - + {SMB_VFS_OP(skel_get_shadow_copy_data), SMB_VFS_OP_GET_SHADOW_COPY_DATA,SMB_VFS_LAYER_TRANSPARENT}, + /* Directory operations */ {SMB_VFS_OP(skel_opendir), SMB_VFS_OP_OPENDIR, SMB_VFS_LAYER_TRANSPARENT}, diff --git a/examples/printing/prtpub.c b/examples/printing/prtpub.c index 0815b1ae66..ea71e03d07 100644 --- a/examples/printing/prtpub.c +++ b/examples/printing/prtpub.c @@ -1,6 +1,6 @@ /* * Set printer capabilities in DsDriver Keys on remote printer - * Copyright (C) Jim McDonough 2002. + * Copyright (C) Jim McDonough 2002. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by diff --git a/examples/sam/Makefile.in b/examples/sam/Makefile.in deleted file mode 100644 index d5df346a8c..0000000000 --- a/examples/sam/Makefile.in +++ /dev/null @@ -1,28 +0,0 @@ -CC = @CC@ -CFLAGS = @CFLAGS@ -CPPFLAGS = @CPPFLAGS@ -LDFLAGS = @LDFLAGS@ -LDSHFLAGS = -shared -srcdir = @builddir@ -FLAGS = $(CFLAGS) -Iinclude -I$(srcdir)/include -I$(srcdir)/ubiqx -I$(srcdir)/smbwrapper -I. $(CPPFLAGS) -I$(srcdir) - -SAM_OBJS = sam_skel.so - -# Default target - -default: $(SAM_OBJS) - -# Pattern rules - -%.so: %.o - $(CC) $(LDSHFLAGS) $(LDFLAGS) -o $@ $< - -%.o: %.c - $(CC) $(FLAGS) -c $< - -# Misc targets - -clean: - rm -rf .libs - rm -f core *~ *% *.bak \ - $(SAM_OBJ) $(SAM_OBJS) diff --git a/examples/sam/README b/examples/sam/README deleted file mode 100644 index 9e9fbb26db..0000000000 --- a/examples/sam/README +++ /dev/null @@ -1,29 +0,0 @@ -README for Samba SAM Database examples -==================================================== -26-08-2002 Stefan (metze) Metzmacher - -Every module MUST have a sam_version() function. - -this is defined in include/sam.h: -#define SAM_MODULE_VERSIONING_MAGIC \ -int sam_version(void)\ -{\ - return SAM_INTERFACE_VERSION;\ -} - -You MUST add this line inside a module: -SAM_MODULE_VERSIONING_MAGIC - - -The sam_skel.c file in this directory contains a very basic example of -a SAM plugin. It just prints the name of the function that is executed using -DEBUG. Maybe it's nice to include some of the arguments to the function in the -future too.. - -New SAM plugins should go into the samba lib directory, (/usr/lib/samba/ -for most distributions) and should be prefixed with 'sam_' and should go into the -subdir sam/. The SAM subsystem will search in /usr/lib/samba/sam and fall back to -/usr/lib/samba/ . -An example path would be: -/usr/lib/samba/sam/sam_skel.so - diff --git a/examples/sam/sam_skel.c b/examples/sam/sam_skel.c deleted file mode 100644 index da3a375894..0000000000 --- a/examples/sam/sam_skel.c +++ /dev/null @@ -1,250 +0,0 @@ -/* - Unix SMB/CIFS implementation. - this is a skeleton for SAM backend modules. - - Copyright (C) Stefan (metze) Metzmacher 2002 - Copyright (C) Jelmer Vernooij 2002 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" - -static int sam_skel_debug_level = DBGC_SAM; - -#undef DBGC_CLASS -#define DBGC_CLASS sam_skel_debug_level - -/* define the version of the SAM interface */ -SAM_MODULE_VERSIONING_MAGIC - -/* General API */ - -NTSTATUS sam_skel_get_sec_desc(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, const DOM_SID *sid, SEC_DESC **sd) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_set_sec_desc(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, const DOM_SID *sid, const SEC_DESC *sd) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -NTSTATUS sam_skel_lookup_sid(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, const DOM_SID *sid, char **name, uint32 *type) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_lookup_name(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, const char *name, DOM_SID **sid, uint32 *type) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -/* Domain API */ - -NTSTATUS sam_skel_update_domain(const SAM_METHODS *sam_methods, const SAM_DOMAIN_HANDLE *domain) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_get_domain_handle(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, SAM_DOMAIN_HANDLE **domain) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -/* Account API */ - -NTSTATUS sam_skel_create_account(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, const char *group_name, uint16 acct_ctrl, SAM_ACCOUNT_HANDLE **account) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_add_account(const SAM_METHODS *sam_methods, const SAM_ACCOUNT_HANDLE *account) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_update_account(const SAM_METHODS *sam_methods, const SAM_ACCOUNT_HANDLE *account) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_delete_account(const SAM_METHODS *sam_methods, const SAM_ACCOUNT_HANDLE *account) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_enum_accounts(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint16 acct_ctrl, uint32 *account_count, SAM_ACCOUNT_ENUM **accounts) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -NTSTATUS sam_skel_get_account_by_sid(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, const DOM_SID *accountsid, SAM_ACCOUNT_HANDLE **account) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_get_account_by_name(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, const char *name, SAM_ACCOUNT_HANDLE **account) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -/* Group API */ - -NTSTATUS sam_skel_create_group(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, const char *account_name, uint16 group_ctrl, SAM_GROUP_HANDLE **group) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_add_group(const SAM_METHODS *sam_methods, const SAM_GROUP_HANDLE *group) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_update_group(const SAM_METHODS *sam_methods, const SAM_GROUP_HANDLE *group) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_delete_group(const SAM_METHODS *sam_methods, const SAM_GROUP_HANDLE *group) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_enum_groups(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint16 group_ctrl, uint32 *groups_count, SAM_GROUP_ENUM **groups) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_get_group_by_sid(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, const DOM_SID *groupsid, SAM_GROUP_HANDLE **group) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_get_group_by_name(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, const char *name, SAM_GROUP_HANDLE **group) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -NTSTATUS sam_skel_add_member_to_group(const SAM_METHODS *sam_methods, const SAM_GROUP_HANDLE *group, const SAM_GROUP_MEMBER *member) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_delete_member_from_group(const SAM_METHODS *sam_methods, const SAM_GROUP_HANDLE *group, const SAM_GROUP_MEMBER *member) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_skel_enum_groupmembers(const SAM_METHODS *sam_methods, const SAM_GROUP_HANDLE *group, uint32 *members_count, SAM_GROUP_MEMBER **members) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -NTSTATUS sam_skel_get_groups_of_sid(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, const DOM_SID **sids, uint16 group_ctrl, uint32 *group_count, SAM_GROUP_ENUM **groups) -{ - DEBUG(0,("sam_skel: %s was called!\n",__FUNCTION__)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_init(SAM_METHODS *sam_methods, const char *module_params) -{ - /* Functions your SAM module doesn't provide should be set - * to NULL */ - - sam_methods->sam_get_sec_desc = sam_skel_get_sec_desc; - sam_methods->sam_set_sec_desc = sam_skel_set_sec_desc; - - sam_methods->sam_lookup_sid = sam_skel_lookup_sid; - sam_methods->sam_lookup_name = sam_skel_lookup_name; - - /* Domain API */ - - sam_methods->sam_update_domain = sam_skel_update_domain; - sam_methods->sam_get_domain_handle = sam_skel_get_domain_handle; - - /* Account API */ - - sam_methods->sam_create_account = sam_skel_create_account; - sam_methods->sam_add_account = sam_skel_add_account; - sam_methods->sam_update_account = sam_skel_update_account; - sam_methods->sam_delete_account = sam_skel_delete_account; - sam_methods->sam_enum_accounts = sam_skel_enum_accounts; - - sam_methods->sam_get_account_by_sid = sam_skel_get_account_by_sid; - sam_methods->sam_get_account_by_name = sam_skel_get_account_by_name; - - /* Group API */ - - sam_methods->sam_create_group = sam_skel_create_group; - sam_methods->sam_add_group = sam_skel_add_group; - sam_methods->sam_update_group = sam_skel_update_group; - sam_methods->sam_delete_group = sam_skel_delete_group; - sam_methods->sam_enum_groups = sam_skel_enum_groups; - sam_methods->sam_get_group_by_sid = sam_skel_get_group_by_sid; - sam_methods->sam_get_group_by_name = sam_skel_get_group_by_name; - - sam_methods->sam_add_member_to_group = sam_skel_add_member_to_group; - sam_methods->sam_delete_member_from_group = sam_skel_delete_member_from_group; - sam_methods->sam_enum_groupmembers = sam_skel_enum_groupmembers; - - sam_methods->sam_get_groups_of_sid = sam_skel_get_groups_of_sid; - - sam_methods->free_private_data = NULL; - - - sam_skel_debug_level = debug_add_class("sam_skel"); - if (sam_skel_debug_level == -1) { - sam_skel_debug_level = DBGC_SAM; - DEBUG(0, ("sam_skel: Couldn't register custom debugging class!\n")); - } else DEBUG(2, ("sam_skel: Debug class number of 'sam_skel': %d\n", sam_skel_debug_level)); - - if(module_params) - DEBUG(0, ("Starting 'sam_skel' with parameters '%s' for domain %s\n", module_params, sam_methods->domain_name)); - else - DEBUG(0, ("Starting 'sam_skel' for domain %s without paramters\n", sam_methods->domain_name)); - - return NT_STATUS_OK; -} diff --git a/examples/smb.conf.default b/examples/smb.conf.default index 0603623c28..e7fac80884 100644 --- a/examples/smb.conf.default +++ b/examples/smb.conf.default @@ -23,6 +23,11 @@ # server string is the equivalent of the NT Description field server string = Samba Server +# Security mode. Defines in which mode Samba will operate. Possible +# values are share, user, server, domain and ads. Most people will want +# user level security. See the HOWTO Collection for details. + security = user + # This option is important for security. It allows you to restrict # connections to machines which are on your local network. The # following example restricts access to two C class networks and @@ -44,8 +49,8 @@ # It should not be necessary to specify the print system type unless # it is non-standard. Currently supported print systems include: -# bsd, sysv, plp, lprng, aix, hpux, qnx, cups -; printing = bsd +# bsd, cups, sysv, plp, lprng, aix, hpux, qnx +; printing = cups # Uncomment this if you want a guest account, you must add this to /etc/passwd # otherwise the user "nobody" is used @@ -58,10 +63,6 @@ # Put a capping on the size of the log files (in Kb). max log size = 50 -# Security mode. Most people will want user level security. See -# security_level.txt for details. - security = user - # Use password server option only with security = server # The argument list may include: # password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name] @@ -69,13 +70,14 @@ # password server = * ; password server = -# Note: Do NOT use the now deprecated option of "domain controller" -# This option is no longer implemented. +# Use the realm option only with security = ads +# Specifies the Active Directory realm the host is part of +; realm = MY_REALM -# You may wish to use password encryption. Please read -# the 'User database' chapter in the Samba HOWTO Collection -# Do not enable this option unless you have read those documents -; encrypt passwords = yes +# Backend to store user information in. New installations should +# use either tdbsam or ldapsam. smbpasswd is available for backwards +# compatibility. tdbsam requires no further configuration. +; passdb backend = tdbsam # Using the following line enables you to customise your configuration # on a per machine basis. The %m gets replaced with the netbios name @@ -144,10 +146,19 @@ ; wins proxy = yes # DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names -# via DNS nslookups. The built-in default for versions 1.9.17 is yes, -# this has been changed in version 1.9.18 to no. +# via DNS nslookups. The default is NO. dns proxy = no +# These scripts are used on a domain controller or stand-alone +# machine to add or delete corresponding unix accounts +; add user script = /usr/sbin/useradd %u +; add group script = /usr/sbin/groupadd %g +; add machine script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %u +; delete user script = /usr/sbin/userdle %u +; delete user from group script = /usr/sbin/deluser %u %g +; delete group script = /usr/sbin/groupdel %g + + #============================ Share Definitions ============================== [homes] comment = Home Directories diff --git a/examples/wins_hook/README b/examples/wins_hook/README new file mode 100644 index 0000000000..1147f57e22 --- /dev/null +++ b/examples/wins_hook/README @@ -0,0 +1,8 @@ +This is an example script for doing dynamic DNS updates from the WINS +database. You use this by putting the full path to the script in the +"wins hook" option in smb.conf. Remember to mark the script executable +and to set the right domain at the top of the script. + +See the BIND documentation for how to enable dynamic DNS +updates. Remember to restrict the updates as far as you can to reduce +the security risks inherent in dynamic DNS. diff --git a/examples/wins_hook/dns_update b/examples/wins_hook/dns_update new file mode 100644 index 0000000000..a4c1a79ab9 --- /dev/null +++ b/examples/wins_hook/dns_update @@ -0,0 +1,94 @@ +#!/bin/sh +# +# Example script for "wins hook". This attempts to update the DNS with +# new A records for the NETBIOS name that Samba passes us. We do this +# the simple way, by deleting all DNS records for the name and then +# readding all the expected 'A' records. +# +# Written by Stephen Rothwell +# + +# +# Configurable things +# +# The domain in which to create names +# YOU MUST CHANGE THIS +# N.B. include the trailing dot +# +# It is a good idea to use a subdomain of your primary domain to ensure +# that rogue machines can't take over (or delete) important names on +# your network. +DOMAIN=wins.example.com. + +# +# The DNS TTL to give the records (in seconds) +# +TTL=3600 +# +# NETBIOS name types that we want to create DNS records for: +# 20 is server +# 00 is workstation +# 03 is user +# +USEFUL_TYPES="20 00 03" +# +# The name of a cache file to use to avoid continual updates +# of the same name and IP addresses. If you comment this out +# then the cache is not kept at all. +# +#CACHE_FILE=/usr/local/samba/var/wins_update.cache + +if [ $# -lt 4 ]; then + echo "Usage: $0 op name type ttl [ip_addr ...]" 1>&2 + echo " op is one of add, refresh, delete" 1>&2 + echo " name is the NETBIOS name" 1>&2 + echo " type is the NETBIOS name type" 1>&2 + echo " ttl is the NETBIOS time to live" 1>&2 + echo " ip_addr's are the remaining IP addresses for this name" 1>&2 + exit 1 +fi + +NSUPDATE=`which nsupdate` +[ -x "$NSUPDATE" ] || NSUPDATE=/usr/bin/nsupdate +[ -x "$NSUPDATE" ] || NSUPDATE=/sbin/nsupdate +[ -x "$NSUPDATE" ] || NSUPDATE=/usr/sbin/nsupdate +[ -x "$NSUPDATE" ] || { + echo "Cannot find nsupdate." 1>&2 + exit 1 +} + +OP=$1 +NAME=$2 +TYPE=$3 +WINS_TTL=$4 +shift 4 +IP_ADDRS="$@" + +do_update=0 +for i in $USEFUL_TYPES +do + [ "$TYPE" = "$i" ] && do_update=1 +done +[ $do_update = 1 ] || exit 0 + +if [ -n "$CACHE_FILE" ]; then + if [ -r "$CACHE_FILE" ]; then + fgrep -q -x -i "$NAME $IP_ADDRS" "$CACHE_FILE" && + exit 0 + grep -v -i "^$NAME " "$CACHE_FILE" >"$CACHE_FILE".$$ + fi + echo "$NAME $IP_ADDRS" >>"$CACHE_FILE".$$ + mv "$CACHE_FILE" "$CACHE_FILE".old 2>/dev/null + mv "$CACHE_FILE".$$ "$CACHE_FILE" +fi + +{ + echo update delete $NAME.$DOMAIN + for i in $IP_ADDRS + do + echo update add $NAME.$DOMAIN $TTL A $i + done + echo +} 2>/dev/null | $NSUPDATE >/dev/null 2>&1 & + +exit 0 -- cgit From 1a15f2ee0b3da27ada20493798148a26d09346b9 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 03:55:56 +0000 Subject: adding files from 3.0 (This used to be commit 953ada19904900c6f6ef65fa0006a695657b3d0b) --- testsuite/build_farm/template/basicsmb.smb.conf.domain | 2 ++ testsuite/build_farm/template/basicsmb.smb.conf.hostsdeny | 1 + testsuite/build_farm/template/basicsmb.smb.conf.server | 3 +++ testsuite/build_farm/template/basicsmb.smb.conf.share | 1 + testsuite/build_farm/template/basicsmb.smb.conf.user | 1 + testsuite/build_farm/torture-XCOPY.test | 2 ++ 6 files changed, 10 insertions(+) create mode 100644 testsuite/build_farm/template/basicsmb.smb.conf.domain create mode 100644 testsuite/build_farm/template/basicsmb.smb.conf.hostsdeny create mode 100644 testsuite/build_farm/template/basicsmb.smb.conf.server create mode 100644 testsuite/build_farm/template/basicsmb.smb.conf.share create mode 100644 testsuite/build_farm/template/basicsmb.smb.conf.user create mode 100644 testsuite/build_farm/torture-XCOPY.test diff --git a/testsuite/build_farm/template/basicsmb.smb.conf.domain b/testsuite/build_farm/template/basicsmb.smb.conf.domain new file mode 100644 index 0000000000..8b9728838e --- /dev/null +++ b/testsuite/build_farm/template/basicsmb.smb.conf.domain @@ -0,0 +1,2 @@ +security=domain +password server=user diff --git a/testsuite/build_farm/template/basicsmb.smb.conf.hostsdeny b/testsuite/build_farm/template/basicsmb.smb.conf.hostsdeny new file mode 100644 index 0000000000..3fce0bdbf4 --- /dev/null +++ b/testsuite/build_farm/template/basicsmb.smb.conf.hostsdeny @@ -0,0 +1 @@ + hosts deny = 127. \ No newline at end of file diff --git a/testsuite/build_farm/template/basicsmb.smb.conf.server b/testsuite/build_farm/template/basicsmb.smb.conf.server new file mode 100644 index 0000000000..016f84cd35 --- /dev/null +++ b/testsuite/build_farm/template/basicsmb.smb.conf.server @@ -0,0 +1,3 @@ +security=server +password server=user +smb passwd file=NON_EXISTANT_FILE diff --git a/testsuite/build_farm/template/basicsmb.smb.conf.share b/testsuite/build_farm/template/basicsmb.smb.conf.share new file mode 100644 index 0000000000..8e69cc199a --- /dev/null +++ b/testsuite/build_farm/template/basicsmb.smb.conf.share @@ -0,0 +1 @@ + security = share diff --git a/testsuite/build_farm/template/basicsmb.smb.conf.user b/testsuite/build_farm/template/basicsmb.smb.conf.user new file mode 100644 index 0000000000..9d294b9c39 --- /dev/null +++ b/testsuite/build_farm/template/basicsmb.smb.conf.user @@ -0,0 +1 @@ + security = user diff --git a/testsuite/build_farm/torture-XCOPY.test b/testsuite/build_farm/torture-XCOPY.test new file mode 100644 index 0000000000..94cc797976 --- /dev/null +++ b/testsuite/build_farm/torture-XCOPY.test @@ -0,0 +1,2 @@ +. torture_setup.fns +test_torture "XCOPY" -- cgit From 3d7cb49747a9a7f5cdec0ee05c6270ec3604202f Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 03:56:39 +0000 Subject: syncing files (This used to be commit c74c2903fb8bd38f8469b3c3b549ac8a431f36dd) --- examples/LDAP/export_smbpasswd.pl | 64 ---- examples/LDAP/import_smbpasswd.pl | 119 ------ examples/LDAP/ldapchpasswd | 152 -------- examples/LDAP/smbldap-tools/CONTRIBUTORS | 2 - examples/LDAP/smbldap-tools/ChangeLog | 2 - examples/LDAP/smbldap-tools/FILES | 2 - examples/LDAP/smbldap-tools/INFRASTRUCTURE | 2 - examples/LDAP/smbldap-tools/INSTALL | 2 - examples/LDAP/smbldap-tools/README | 3 - examples/LDAP/smbldap-tools/TODO | 2 - examples/LDAP/smbldap-tools/smbldap-tools.spec | 1 - examples/VFS/Makefile | 23 -- examples/VFS/skel.c | 467 ----------------------- examples/sam/.cvsignore | 1 - testsuite/build_farm/basicsmb.smb.conf.domain | 2 - testsuite/build_farm/basicsmb.smb.conf.hostsdeny | 1 - testsuite/build_farm/basicsmb.smb.conf.server | 3 - testsuite/build_farm/basicsmb.smb.conf.share | 1 - testsuite/build_farm/basicsmb.smb.conf.user | 1 - 19 files changed, 850 deletions(-) delete mode 100644 examples/LDAP/export_smbpasswd.pl delete mode 100644 examples/LDAP/import_smbpasswd.pl delete mode 100644 examples/LDAP/ldapchpasswd delete mode 100644 examples/VFS/Makefile delete mode 100644 examples/VFS/skel.c delete mode 100644 examples/sam/.cvsignore delete mode 100644 testsuite/build_farm/basicsmb.smb.conf.domain delete mode 100644 testsuite/build_farm/basicsmb.smb.conf.hostsdeny delete mode 100644 testsuite/build_farm/basicsmb.smb.conf.server delete mode 100644 testsuite/build_farm/basicsmb.smb.conf.share delete mode 100644 testsuite/build_farm/basicsmb.smb.conf.user diff --git a/examples/LDAP/export_smbpasswd.pl b/examples/LDAP/export_smbpasswd.pl deleted file mode 100644 index e4f120bf02..0000000000 --- a/examples/LDAP/export_smbpasswd.pl +++ /dev/null @@ -1,64 +0,0 @@ -#!/usr/bin/perl -## -## Example script to export ldap entries into an smbpasswd file format -## using the Mozilla PerLDAP module. -## -## writen by jerry@samba.org -## -## ported to Net::LDAP by dkrovich@slackworks.com - -use Net::LDAP; - -###################################################### -## Set these values to whatever you need for your site -## - -$DN="dc=samba,dc=my-domain,dc=com"; -$ROOTDN="cn=Manager,dc=my-domain,dc=com"; -$rootpw = "secret"; -$LDAPSERVER="localhost"; - -## -## end local site variables -###################################################### - -$ldap = Net::LDAP->new($LDAPSERVER) or die "Unable to connect to LDAP server $LDAPSERVER"; - -print "##\n"; -print "## Autogenerated smbpasswd file via ldapsearch\n"; -print "## from $LDAPSERVER ($DN)\n"; -print "##\n"; - -## scheck for the existence of the posixAccount first -$result = $ldap->search ( base => "$DN", - scope => "sub", - filter => "(objectclass=sambaAccount)" - ); - - - -## loop over the entries we found -while ( $entry = $result->shift_entry() ) { - - @uid = $entry->get_value("uid"); - @uidNumber = $entry->get_value("uidNumber"); - @lm_pw = $entry->get_value("lmpassword"); - @nt_pw = $entry->get_value("ntpassword"); - @acct = $entry->get_value("acctFlags"); - @pwdLastSet = $entry->get_value("pwdLastSet"); - - if (($#uid+1) && ($#uidNumber+1)) { - - $lm_pw[0] = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" if (! ($#lm_pw+1)); - $nt_pw[0] = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" if (! ($#nt_pw+1)); - $acct[0] = "[DU ]" if (! ($#acct+1)); - $pwdLastSet[0] = "FFFFFFFF" if (! ($#pwdLastSet+1)); - - print "$uid[0]:$uidNumber[0]:$lm_pw[0]:$nt_pw[0]:$acct[0]:LCT-$pwdLastSet[0]\n"; - } - -} - -$ldap->unbind(); -exit 0; - diff --git a/examples/LDAP/import_smbpasswd.pl b/examples/LDAP/import_smbpasswd.pl deleted file mode 100644 index 61ad33c809..0000000000 --- a/examples/LDAP/import_smbpasswd.pl +++ /dev/null @@ -1,119 +0,0 @@ -#!/usr/bin/perl -## -## Example script of how you could import a smbpasswd file into an LDAP -## directory using the Mozilla PerLDAP module. -## -## writen by jerry@samba.org -## -## ported to Net::LDAP by dkrovich@slackworks.com - -use Net::LDAP; - -################################################# -## set these to a value appropriate for your site -## - -$DN="ou=people,dc=plainjoe,dc=org"; -$ROOTDN="cn=Manager,dc=plainjoe,dc=org"; -# If you use perl special character in your -# rootpw, escape them: -# $rootpw = "secr\@t" instead of $rootpw = "secr@t" -$rootpw = "n0pass"; -$LDAPSERVER="scooby"; - -## -## end local site variables -################################################# - -$ldap = Net::LDAP->new($LDAPSERVER) or die "Unable to connect to LDAP server $LDAPSERVER"; - -## Bind as $ROOTDN so you can do updates -$mesg = $ldap->bind($ROOTDN, password => $rootpw); -$mesg->error() if $mesg->code(); - -while ( $string = ) { - chomp ($string); - - ## Get the account info from the smbpasswd file - @smbentry = split (/:/, $string); - - ## Check for the existence of a system account - @getpwinfo = getpwnam($smbentry[0]); - if (! @getpwinfo ) { - print STDERR "**$smbentry[0] does not have a system account... \n"; - next; - } - ## Calculate RID = uid*2 +1000 - $rid=@getpwinfo[2]*2+1000; - - ## check and see if account info already exists in LDAP. - $result = $ldap->search ( base => "$DN", - scope => "sub", - filter => "(uid=$smbentry[0])" - ); - - ## If no LDAP entry exists, create one. - if ( $result->count == 0 ) { - $new_entry = Net::LDAP::Entry->new(); - $new_entry->add( dn => "uid=$smbentry[0],$DN", - uid => $smbentry[0], - rid => $rid, - lmPassword => $smbentry[2], - ntPassword => $smbentry[3], - acctFlags => $smbentry[4], - cn => $smbentry[0], - pwdLastSet => hex(substr($smbentry[5],4)), - objectclass => 'sambaAccount' ); - - $result = $ldap->add( $new_entry ); - $result->error() if $result->code(); - print "Adding [uid=" . $smbentry[0] . "," . $DN . "]\n"; - - ## Otherwise, supplement/update the existing entry. - } - elsif ($result->count == 1) - { - # Put the search results into an entry object - $entry = $result->entry(0); - - print "Updating [" . $entry->dn . "]\n"; - - ## Add the objectclass: sambaAccount attribute if it's not there - @values = $entry->get_value( "objectclass" ); - $flag = 1; - foreach $item (@values) { - print "$item\n"; - if ( "$item" eq "sambaAccount" ) { - $flag = 0; - } - } - if ( $flag ) { - ## Adding sambaAccount objectclass requires adding at least rid: - ## uid attribute already exists we know since we searched on it - $entry->add(objectclass => "sambaAccount", - rid => $rid ); - } - - ## Set the other attribute values - $entry->replace(rid => $rid, - lmPassword => $smbentry[2], - ntPassword => $smbentry[3], - acctFlags => $smbentry[4], - pwdLastSet => hex(substr($smbentry[5],4))); - - ## Apply changes to the LDAP server - $updatemesg = $entry->update($ldap); - $updatemesg->error() if $updatemesg->code(); - - ## If we get here, the LDAP search returned more than one value - ## which shouldn't happen under normal circumstances. - } else { - print STDERR "LDAP search returned more than one entry for $smbentry[0]... skipping!\n"; - next; - } -} - -$ldap->unbind(); -exit 0; - - diff --git a/examples/LDAP/ldapchpasswd b/examples/LDAP/ldapchpasswd deleted file mode 100644 index 0776d9bed1..0000000000 --- a/examples/LDAP/ldapchpasswd +++ /dev/null @@ -1,152 +0,0 @@ -#!/usr/bin/perl -w - -# LDAP to unix password sync script for samba-tng -# originally by Jody Haynes -# 2000/12/12 milos@interactivesi.com -# modified for use with MD5 passwords -# 2000/12/16 mami@arena.sci.univr.it -# modified to change lmpassword and ntpassword for samba -# 2001/01/05 mami@arena.sci.univr.it -# modified for being also a /bin/passwd replacement -# 2001/01/29 mami@arena.sci.univr.it -# now there are two small programs: ldapchpasswd to -# change password from unix and ldapsync.pl to sync -# from NT/2000. ldapchpasswd do not need clear password. -# 2001/01/31 mami@arena.sci.univr.it -# add server parameter to ldap commands -# 2001/06/20 mami@arena.sci.univr.it -# add pwdlastset and shadowlastchange update - -$basedn = "ou=Students,dc=univr, dc=it"; -$binddn = "uid=root,dc=univr,dc=it"; -$scope = "sub"; -$server = "my_server"; - -foreach $arg (@ARGV) { - if ($< != 0) { - die "Only root can specify parameters\n"; - } else { - if ( ($arg eq '-?') || ($arg eq '--help') ) { - print "Usage: $0 [-o] [username]\n"; - print " -o, --without-old-password do not ask for old password (root only)\n"; - print " -?, --help show this help message\n"; - exit (-1); - } elsif ( ($arg eq '-o') || ($arg eq '--without-old-password') ) { - $oldpass = 1; - } elsif (substr($arg,0) ne '-') { - $user = $arg; - if (!defined(getpwnam($user))) { - die "$0: Unknown user name '$user'\n"; ; - } - } - } -} - -if (!defined($user)) { - $user=$ENV{"USER"}; -} - -# current user's dn -my $dn = ''; - -if ($< == 0) { - system "stty -echo"; - print "LDAP password for root DN: "; - chomp($passwd=); - print "\n"; - system "stty echo"; - # Find dn for user $user binding as root's dn - chomp($dn=`ldapsearch -h '$server' -b '$basedn' -s '$scope' -D '$binddn' -w '$passwd' '(uid=$user)'|head -1`); - if ( ($dn eq '') || ($passwd eq '') ) { - print "Wrong LDAP password for root DN!\n"; - exit (-1); - } -} else { - if (!defined($oldpass)) { - system "stty -echo"; - print "Old password for user $user: "; - chomp($oldpass=); - print "\n"; - system "stty echo"; - - # Find path to uid - chomp($path_to_uid=`ldapsearch -h '$server' -b '$basedn' -s '$scope' '(uid=$user)'|head -1`); - # Find old password for user $user binding as self - chomp($dn=`ldapsearch -h '$server' -b '$basedn' -s '$scope' -D '$path_to_uid' -w '$oldpass' '(uid=$user)'|head -1`); - - if ( ($dn eq '') || ($oldpass eq '') ) { - print "Wrong password for user $user!\n"; - exit (-1); - } - } -} - -system "stty -echo"; -print "New password for user $user: "; -chomp($pass=); -print "\n"; -system "stty echo"; - -system "stty -echo"; -print "Retype new password for user $user: "; -chomp($pass2=); -print "\n"; -system "stty echo"; - -if ( ($pass ne $pass2) || (length($pass)<1) ) { - die "Wrong password!\n"; -} else { -# MD5 password -$random = join '', ('.', '/', 0..9, 'A'..'Z', 'a'..'z')[rand 64, rand 64, rand 64, rand 64, rand 64, rand 64, rand 64, rand 64]; -$bsalt = "\$1\$"; $esalt = "\$"; -$modsalt = $bsalt.$random.$esalt; -$password = crypt($pass, $modsalt); - -# LanManager and NT clear text passwords -$ntpwd = `/usr/local/sbin/mkntpwd '$pass'`; -chomp($lmpassword = substr($ntpwd, 0, index($ntpwd, ':'))); -chomp($ntpassword = substr($ntpwd, index($ntpwd, ':')+1)); - -#$FILE="|/usr/bin/ldapmodify -h '$server' -D '$binddn' -w $passwd"; -if ($< != 0) { - $FILE="|/usr/bin/ldapmodify -h '$server' -D '$dn' -w '$oldpass'"; -} else { - $FILE="|/usr/bin/ldapmodify -h '$server' -D '$binddn' -w '$passwd'"; -} - -# Chenge time -$shadowlastchange=int(time/24/3600); -$pwdlastset=sprintf('%x',time); - -open FILE or die; - -print FILE < -#include -#ifdef HAVE_UTIME_H -#include -#endif -#ifdef HAVE_DIRENT_H -#include -#endif -#ifdef HAVE_FCNTL_H -#include -#endif -#include -#include - -#include -#include - -static struct vfs_ops default_vfs_ops; /* For passthrough operation */ -static struct smb_vfs_handle_struct *skel_handle; /* use skel_handle->data for storing per-instance private data */ - -static int skel_connect(struct connection_struct *conn, const char *service, const char *user) -{ - return default_vfs_ops.connect(conn, service, user); -} - -static void skel_disconnect(struct connection_struct *conn) -{ - default_vfs_ops.disconnect(conn); -} - -static SMB_BIG_UINT skel_disk_free(struct connection_struct *conn, const char *path, - BOOL small_query, SMB_BIG_UINT *bsize, - SMB_BIG_UINT *dfree, SMB_BIG_UINT *dsize) -{ - return default_vfs_ops.disk_free(conn, path, small_query, bsize, - dfree, dsize); -} - -static DIR *skel_opendir(struct connection_struct *conn, const char *fname) -{ - return default_vfs_ops.opendir(conn, fname); -} - -static struct dirent *skel_readdir(struct connection_struct *conn, DIR *dirp) -{ - return default_vfs_ops.readdir(conn, dirp); -} - -static int skel_mkdir(struct connection_struct *conn, const char *path, mode_t mode) -{ - return default_vfs_ops.mkdir(conn, path, mode); -} - -static int skel_rmdir(struct connection_struct *conn, const char *path) -{ - return default_vfs_ops.rmdir(conn, path); -} - -static int skel_closedir(struct connection_struct *conn, DIR *dir) -{ - return default_vfs_ops.closedir(conn, dir); -} - -static int skel_open(struct connection_struct *conn, const char *fname, int flags, mode_t mode) -{ - return default_vfs_ops.open(conn, fname, flags, mode); -} - -static int skel_close(struct files_struct *fsp, int fd) -{ - return default_vfs_ops.close(fsp, fd); -} - -static ssize_t skel_read(struct files_struct *fsp, int fd, void *data, size_t n) -{ - return default_vfs_ops.read(fsp, fd, data, n); -} - -static ssize_t skel_write(struct files_struct *fsp, int fd, const void *data, size_t n) -{ - return default_vfs_ops.write(fsp, fd, data, n); -} - -static SMB_OFF_T skel_lseek(struct files_struct *fsp, int filedes, SMB_OFF_T offset, int whence) -{ - return default_vfs_ops.lseek(fsp, filedes, offset, whence); -} - -static int skel_rename(struct connection_struct *conn, const char *old, const char *new) -{ - return default_vfs_ops.rename(conn, old, new); -} - -static int skel_fsync(struct files_struct *fsp, int fd) -{ - return default_vfs_ops.fsync(fsp, fd); -} - -static int skel_stat(struct connection_struct *conn, const char *fname, SMB_STRUCT_STAT *sbuf) -{ - return default_vfs_ops.stat(conn, fname, sbuf); -} - -static int skel_fstat(struct files_struct *fsp, int fd, SMB_STRUCT_STAT *sbuf) -{ - return default_vfs_ops.fstat(fsp, fd, sbuf); -} - -static int skel_lstat(struct connection_struct *conn, const char *path, SMB_STRUCT_STAT *sbuf) -{ - return default_vfs_ops.lstat(conn, path, sbuf); -} - -static int skel_unlink(struct connection_struct *conn, const char *path) -{ - return default_vfs_ops.unlink(conn, path); -} - -static int skel_chmod(struct connection_struct *conn, const char *path, mode_t mode) -{ - return default_vfs_ops.chmod(conn, path, mode); -} - -static int skel_fchmod(struct files_struct *fsp, int fd, mode_t mode) -{ - return default_vfs_ops.fchmod(fsp, fd, mode); -} - -static int skel_chown(struct connection_struct *conn, const char *path, uid_t uid, gid_t gid) -{ - return default_vfs_ops.chown(conn, path, uid, gid); -} - -static int skel_fchown(struct files_struct *fsp, int fd, uid_t uid, gid_t gid) -{ - return default_vfs_ops.fchown(fsp, fd, uid, gid); -} - -static int skel_chdir(struct connection_struct *conn, const char *path) -{ - return default_vfs_ops.chdir(conn, path); -} - -static char *skel_getwd(struct connection_struct *conn, char *buf) -{ - return default_vfs_ops.getwd(conn, buf); -} - -static int skel_utime(struct connection_struct *conn, const char *path, struct utimbuf *times) -{ - return default_vfs_ops.utime(conn, path, times); -} - -static int skel_ftruncate(struct files_struct *fsp, int fd, SMB_OFF_T offset) -{ - return default_vfs_ops.ftruncate(fsp, fd, offset); -} - -static BOOL skel_lock(struct files_struct *fsp, int fd, int op, SMB_OFF_T offset, SMB_OFF_T count, int type) -{ - return default_vfs_ops.lock(fsp, fd, op, offset, count, type); -} - -static BOOL skel_symlink(struct connection_struct *conn, const char *oldpath, const char *newpath) -{ - return default_vfs_ops.symlink(conn, oldpath, newpath); -} - -static BOOL skel_readlink(struct connection_struct *conn, const char *path, char *buf, size_t bufsiz) -{ - return default_vfs_ops.readlink(conn, path, buf, bufsiz); -} - -static int skel_link(struct connection_struct *conn, const char *oldpath, const char *newpath) -{ - return default_vfs_ops.link(conn, oldpath, newpath); -} - -static int skel_mknod(struct connection_struct *conn, const char *path, mode_t mode, SMB_DEV_T dev) -{ - return default_vfs_ops.mknod(conn, path, mode, dev); -} - -static char *skel_realpath(struct connection_struct *conn, const char *path, char *resolved_path) -{ - return default_vfs_ops.realpath(conn, path, resolved_path); -} - -static size_t skel_fget_nt_acl(struct files_struct *fsp, int fd, struct security_descriptor_info **ppdesc) -{ - return default_vfs_ops.fget_nt_acl(fsp, fd, ppdesc); -} - -static size_t skel_get_nt_acl(struct files_struct *fsp, const char *name, struct security_descriptor_info **ppdesc) -{ - return default_vfs_ops.get_nt_acl(fsp, name, ppdesc); -} - -static BOOL skel_fset_nt_acl(struct files_struct *fsp, int fd, uint32 security_info_sent, struct security_descriptor_info *psd) -{ - return default_vfs_ops.fset_nt_acl(fsp, fd, security_info_sent, psd); -} - -static BOOL skel_set_nt_acl(struct files_struct *fsp, const char *name, uint32 security_info_sent, struct security_descriptor_info *psd) -{ - return default_vfs_ops.set_nt_acl(fsp, name, security_info_sent, psd); -} - -static BOOL skel_chmod_acl(struct connection_struct *conn, const char *name, mode_t mode) -{ - /* If the underlying VFS doesn't have ACL support... */ - if (!default_vfs_ops.chmod_acl) { - errno = ENOSYS; - return -1; - } - return default_vfs_ops.chmod_acl(conn, name, mode); -} - -static BOOL skel_fchmod_acl(struct files_struct *fsp, int fd, mode_t mode) -{ - /* If the underlying VFS doesn't have ACL support... */ - if (!default_vfs_ops.fchmod_acl) { - errno = ENOSYS; - return -1; - } - return default_vfs_ops.fchmod_acl(fsp, fd, mode); -} - -static int skel_sys_acl_get_entry(struct connection_struct *conn, SMB_ACL_T theacl, int entry_id, SMB_ACL_ENTRY_T *entry_p) -{ - return default_vfs_ops.sys_acl_get_entry(conn, theacl, entry_id, entry_p); -} - -static int skel_sys_acl_get_tag_type(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_TAG_T *tag_type_p) -{ - return default_vfs_ops.sys_acl_get_tag_type(conn, entry_d, tag_type_p); -} - -static int skel_sys_acl_get_permset(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d, SMB_ACL_PERMSET_T *permset_p) -{ - return default_vfs_ops.sys_acl_get_permset(conn, entry_d, permset_p); -} - -static void *skel_sys_acl_get_qualifier(struct connection_struct *conn, SMB_ACL_ENTRY_T entry_d) -{ - return default_vfs_ops.sys_acl_get_qualifier(conn, entry_d); -} - -static SMB_ACL_T skel_sys_acl_get_file(struct connection_struct *conn, const char *path_p, SMB_ACL_TYPE_T type) -{ - return default_vfs_ops.sys_acl_get_file(conn, path_p, type); -} - -static SMB_ACL_T skel_sys_acl_get_fd(struct files_struct *fsp, int fd) -{ - return default_vfs_ops.sys_acl_get_fd(fsp, fd); -} - -static int skel_sys_acl_clear_perms(struct connection_struct *conn, SMB_ACL_PERMSET_T permset) -{ - return default_vfs_ops.sys_acl_clear_perms(conn, permset); -} - -static int skel_sys_acl_add_perm(struct connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm) -{ - return default_vfs_ops.sys_acl_add_perm(conn, permset, perm); -} - -static char *skel_sys_acl_to_text(struct connection_struct *conn, SMB_ACL_T theacl, ssize_t *plen) -{ - return default_vfs_ops.sys_acl_to_text(conn, theacl, plen); -} - -static SMB_ACL_T skel_sys_acl_init(struct connection_struct *conn, int count) -{ - return default_vfs_ops.sys_acl_init(conn, count); -} - -static int skel_sys_acl_create_entry(struct connection_struct *conn, SMB_ACL_T *pacl, SMB_ACL_ENTRY_T *pentry) -{ - return default_vfs_ops.sys_acl_create_entry(conn, pacl, pentry); -} - -static int skel_sys_acl_set_tag_type(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_TAG_T tagtype) -{ - return default_vfs_ops.sys_acl_set_tag_type(conn, entry, tagtype); -} - -static int skel_sys_acl_set_qualifier(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, void *qual) -{ - return default_vfs_ops.sys_acl_set_qualifier(conn, entry, qual); -} - -static int skel_sys_acl_set_permset(struct connection_struct *conn, SMB_ACL_ENTRY_T entry, SMB_ACL_PERMSET_T permset) -{ - return default_vfs_ops.sys_acl_set_permset(conn, entry, permset); -} - -static int skel_sys_acl_valid(struct connection_struct *conn, SMB_ACL_T theacl ) -{ - return default_vfs_ops.sys_acl_valid(conn, theacl ); -} - -static int skel_sys_acl_set_file(struct connection_struct *conn, const char *name, SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl) -{ - return default_vfs_ops.sys_acl_set_file(conn, name, acltype, theacl); -} - -static int skel_sys_acl_set_fd(struct files_struct *fsp, int fd, SMB_ACL_T theacl) -{ - return default_vfs_ops.sys_acl_set_fd(fsp, fd, theacl); -} - -static int skel_sys_acl_delete_def_file(struct connection_struct *conn, const char *path) -{ - return default_vfs_ops.sys_acl_delete_def_file(conn, path); -} - -static int skel_sys_acl_get_perm(struct connection_struct *conn, SMB_ACL_PERMSET_T permset, SMB_ACL_PERM_T perm) -{ - return default_vfs_ops.sys_acl_get_perm(conn, permset, perm); -} - -static int skel_sys_acl_free_text(struct connection_struct *conn, char *text) -{ - return default_vfs_ops.sys_acl_free_text(conn, text); -} - -static int skel_sys_acl_free_acl(struct connection_struct *conn, SMB_ACL_T posix_acl) -{ - return default_vfs_ops.sys_acl_free_acl(conn, posix_acl); -} - -static int skel_sys_acl_free_qualifier(struct connection_struct *conn, void *qualifier, SMB_ACL_TAG_T tagtype) -{ - return default_vfs_ops.sys_acl_free_qualifier(conn, qualifier, tagtype); -} - - -/* VFS operations structure */ - -static vfs_op_tuple skel_ops[] = { - - /* Disk operations */ - - {skel_connect, SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_TRANSPARENT}, - {skel_disconnect, SMB_VFS_OP_DISCONNECT, SMB_VFS_LAYER_TRANSPARENT}, - {skel_disk_free, SMB_VFS_OP_DISK_FREE, SMB_VFS_LAYER_TRANSPARENT}, - - /* Directory operations */ - - {skel_opendir, SMB_VFS_OP_OPENDIR, SMB_VFS_LAYER_TRANSPARENT}, - {skel_readdir, SMB_VFS_OP_READDIR, SMB_VFS_LAYER_TRANSPARENT}, - {skel_mkdir, SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_TRANSPARENT}, - {skel_rmdir, SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_TRANSPARENT}, - {skel_closedir, SMB_VFS_OP_CLOSEDIR, SMB_VFS_LAYER_TRANSPARENT}, - - /* File operations */ - - {skel_open, SMB_VFS_OP_OPEN, SMB_VFS_LAYER_TRANSPARENT}, - {skel_close, SMB_VFS_OP_CLOSE, SMB_VFS_LAYER_TRANSPARENT}, - {skel_read, SMB_VFS_OP_READ, SMB_VFS_LAYER_TRANSPARENT}, - {skel_write, SMB_VFS_OP_WRITE, SMB_VFS_LAYER_TRANSPARENT}, - {skel_lseek, SMB_VFS_OP_LSEEK, SMB_VFS_LAYER_TRANSPARENT}, - {skel_rename, SMB_VFS_OP_RENAME, SMB_VFS_LAYER_TRANSPARENT}, - {skel_fsync, SMB_VFS_OP_FSYNC, SMB_VFS_LAYER_TRANSPARENT}, - {skel_stat, SMB_VFS_OP_STAT, SMB_VFS_LAYER_TRANSPARENT}, - {skel_fstat, SMB_VFS_OP_FSTAT, SMB_VFS_LAYER_TRANSPARENT}, - {skel_lstat, SMB_VFS_OP_LSTAT, SMB_VFS_LAYER_TRANSPARENT}, - {skel_unlink, SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_TRANSPARENT}, - {skel_chmod, SMB_VFS_OP_CHMOD, SMB_VFS_LAYER_TRANSPARENT}, - {skel_fchmod, SMB_VFS_OP_FCHMOD, SMB_VFS_LAYER_TRANSPARENT}, - {skel_chown, SMB_VFS_OP_CHOWN, SMB_VFS_LAYER_TRANSPARENT}, - {skel_fchown, SMB_VFS_OP_FCHOWN, SMB_VFS_LAYER_TRANSPARENT}, - {skel_chdir, SMB_VFS_OP_CHDIR, SMB_VFS_LAYER_TRANSPARENT}, - {skel_getwd, SMB_VFS_OP_GETWD, SMB_VFS_LAYER_TRANSPARENT}, - {skel_utime, SMB_VFS_OP_UTIME, SMB_VFS_LAYER_TRANSPARENT}, - {skel_ftruncate, SMB_VFS_OP_FTRUNCATE, SMB_VFS_LAYER_TRANSPARENT}, - {skel_lock, SMB_VFS_OP_LOCK, SMB_VFS_LAYER_TRANSPARENT}, - {skel_symlink, SMB_VFS_OP_SYMLINK, SMB_VFS_LAYER_TRANSPARENT}, - {skel_readlink, SMB_VFS_OP_READLINK, SMB_VFS_LAYER_TRANSPARENT}, - {skel_link, SMB_VFS_OP_LINK, SMB_VFS_LAYER_TRANSPARENT}, - {skel_mknod, SMB_VFS_OP_MKNOD, SMB_VFS_LAYER_TRANSPARENT}, - {skel_realpath, SMB_VFS_OP_REALPATH, SMB_VFS_LAYER_TRANSPARENT}, - - /* NT File ACL operations */ - - {skel_fget_nt_acl, SMB_VFS_OP_FGET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT}, - {skel_get_nt_acl, SMB_VFS_OP_GET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT}, - {skel_fset_nt_acl, SMB_VFS_OP_FSET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT}, - {skel_set_nt_acl, SMB_VFS_OP_SET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT}, - - /* POSIX ACL operations */ - - {skel_chmod_acl, SMB_VFS_OP_CHMOD_ACL, SMB_VFS_LAYER_TRANSPARENT}, - {skel_fchmod_acl, SMB_VFS_OP_FCHMOD_ACL, SMB_VFS_LAYER_TRANSPARENT}, - - {skel_sys_acl_get_entry, SMB_VFS_OP_SYS_ACL_GET_ENTRY, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_get_tag_type, SMB_VFS_OP_SYS_ACL_GET_TAG_TYPE, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_get_permset, SMB_VFS_OP_SYS_ACL_GET_PERMSET, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_get_qualifier, SMB_VFS_OP_SYS_ACL_GET_QUALIFIER, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_get_file, SMB_VFS_OP_SYS_ACL_GET_FILE, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_get_fd, SMB_VFS_OP_SYS_ACL_GET_FD, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_clear_perms, SMB_VFS_OP_SYS_ACL_CLEAR_PERMS, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_add_perm, SMB_VFS_OP_SYS_ACL_ADD_PERM, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_to_text, SMB_VFS_OP_SYS_ACL_TO_TEXT, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_init, SMB_VFS_OP_SYS_ACL_INIT, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_create_entry, SMB_VFS_OP_SYS_ACL_CREATE_ENTRY, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_set_tag_type, SMB_VFS_OP_SYS_ACL_SET_TAG_TYPE, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_set_qualifier, SMB_VFS_OP_SYS_ACL_SET_QUALIFIER, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_set_permset, SMB_VFS_OP_SYS_ACL_SET_PERMSET, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_valid, SMB_VFS_OP_SYS_ACL_VALID, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_set_file, SMB_VFS_OP_SYS_ACL_SET_FILE, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_set_fd, SMB_VFS_OP_SYS_ACL_SET_FD, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_delete_def_file, SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_get_perm, SMB_VFS_OP_SYS_ACL_GET_PERM, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_free_text, SMB_VFS_OP_SYS_ACL_FREE_TEXT, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_free_acl, SMB_VFS_OP_SYS_ACL_FREE_ACL, SMB_VFS_LAYER_TRANSPARENT}, - {skel_sys_acl_free_qualifier, SMB_VFS_OP_SYS_ACL_FREE_QUALIFIER, SMB_VFS_LAYER_TRANSPARENT}, - - {NULL, SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} -}; - -/* VFS initialisation - return initialized vfs_op_tuple array back to Samba */ - -static vfs_op_tuple *skel_init(const struct vfs_ops *def_vfs_ops, - struct smb_vfs_handle_struct *vfs_handle) -{ - DEBUG(3, ("Initialising default vfs hooks\n")); - - memcpy(&default_vfs_ops, def_vfs_ops, sizeof(struct vfs_ops)); - - /* Remember vfs_handle for further allocation and referencing of private - information in vfs_handle->data - */ - skel_handle = vfs_handle; - return skel_ops; -} - -NTSTATUS init_module(void) -{ - return smb_register_vfs("skel", skel_init, SMB_VFS_INTERFACE_VERSION); -} diff --git a/examples/sam/.cvsignore b/examples/sam/.cvsignore deleted file mode 100644 index f3c7a7c5da..0000000000 --- a/examples/sam/.cvsignore +++ /dev/null @@ -1 +0,0 @@ -Makefile diff --git a/testsuite/build_farm/basicsmb.smb.conf.domain b/testsuite/build_farm/basicsmb.smb.conf.domain deleted file mode 100644 index 8b9728838e..0000000000 --- a/testsuite/build_farm/basicsmb.smb.conf.domain +++ /dev/null @@ -1,2 +0,0 @@ -security=domain -password server=user diff --git a/testsuite/build_farm/basicsmb.smb.conf.hostsdeny b/testsuite/build_farm/basicsmb.smb.conf.hostsdeny deleted file mode 100644 index 3fce0bdbf4..0000000000 --- a/testsuite/build_farm/basicsmb.smb.conf.hostsdeny +++ /dev/null @@ -1 +0,0 @@ - hosts deny = 127. \ No newline at end of file diff --git a/testsuite/build_farm/basicsmb.smb.conf.server b/testsuite/build_farm/basicsmb.smb.conf.server deleted file mode 100644 index 016f84cd35..0000000000 --- a/testsuite/build_farm/basicsmb.smb.conf.server +++ /dev/null @@ -1,3 +0,0 @@ -security=server -password server=user -smb passwd file=NON_EXISTANT_FILE diff --git a/testsuite/build_farm/basicsmb.smb.conf.share b/testsuite/build_farm/basicsmb.smb.conf.share deleted file mode 100644 index 8e69cc199a..0000000000 --- a/testsuite/build_farm/basicsmb.smb.conf.share +++ /dev/null @@ -1 +0,0 @@ - security = share diff --git a/testsuite/build_farm/basicsmb.smb.conf.user b/testsuite/build_farm/basicsmb.smb.conf.user deleted file mode 100644 index 9d294b9c39..0000000000 --- a/testsuite/build_farm/basicsmb.smb.conf.user +++ /dev/null @@ -1 +0,0 @@ - security = user -- cgit From 4093bf7ff8c8861cf7b941945ede53a8ec5bb6c8 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 04:07:32 +0000 Subject: sync 3.0 into HEAD for the last time (This used to be commit c17a7dc9a190156a069da3e861c18fd3f81224ad) --- source3/.cvsignore | 1 + source3/Makefile.in | 229 ++- source3/VERSION | 123 ++ source3/aclocal.m4 | 157 +- source3/auth/auth.c | 8 +- source3/auth/auth_domain.c | 3 - source3/auth/auth_rhosts.c | 2 +- source3/auth/auth_sam.c | 87 +- source3/auth/auth_util.c | 126 +- source3/auth/auth_winbind.c | 2 +- source3/auth/pampass.c | 8 +- source3/autogen.sh | 5 + source3/bin/.cvsignore | 2 + source3/client/client.c | 439 +++--- source3/client/clitar.c | 27 +- source3/client/mount.cifs.c | 62 +- source3/client/smbmnt.c | 6 +- source3/client/smbmount.c | 6 +- source3/configure.in | 273 +++- source3/groupdb/mapping.c | 34 +- source3/include/.cvsignore | 1 + source3/include/ads.h | 2 +- source3/include/charset.h | 87 ++ source3/include/includes.h | 10 +- source3/include/nameserv.h | 367 +++-- source3/include/ntdomain.h | 20 +- source3/include/ntioctl.h | 19 + source3/include/ntlmssp.h | 1 + source3/include/ntquotas.h | 2 +- source3/include/rpc_dce.h | 8 +- source3/include/rpc_ds.h | 13 + source3/include/rpc_lsa.h | 6 + source3/include/rpc_samr.h | 14 +- source3/include/rpc_spoolss.h | 6 + source3/include/safe_string.h | 1 + source3/include/secrets.h | 17 + source3/include/smb.h | 12 +- source3/include/smb_macros.h | 6 + source3/include/spnego.h | 65 + source3/include/trans2.h | 2 + source3/include/version.h | 9 +- source3/include/vfs.h | 9 +- source3/include/vfs_macros.h | 3 + source3/intl/lang_tdb.c | 4 +- source3/lib/access.c | 3 +- source3/lib/afs.c | 248 +++ source3/lib/charcnv.c | 331 +++- source3/lib/dummyroot.c | 33 + source3/lib/fault.c | 2 +- source3/lib/gencache.c | 9 +- source3/lib/hash.c | 15 +- source3/lib/module.c | 30 +- source3/lib/ms_fnmatch.c | 82 +- source3/lib/popt_common.c | 35 +- source3/lib/readline.c | 4 +- source3/lib/replace1.c | 42 + source3/lib/smbldap.c | 27 + source3/lib/substitute.c | 31 +- source3/lib/system.c | 159 +- source3/lib/util.c | 81 +- source3/lib/util_file.c | 5 + source3/lib/util_sid.c | 2 +- source3/lib/util_str.c | 202 ++- source3/lib/version.c | 42 + source3/libads/ads_status.c | 2 +- source3/libads/authdata.c | 7 +- source3/libads/kerberos_verify.c | 165 +- source3/libads/krb5_setpw.c | 17 +- source3/libads/ldap.c | 6 +- source3/libads/ldap_utils.c | 5 +- source3/libads/sasl.c | 18 +- source3/libsmb/cliconnect.c | 114 +- source3/libsmb/clientgen.c | 7 +- source3/libsmb/clifile.c | 5 +- source3/libsmb/clikrb5.c | 20 +- source3/libsmb/climessage.c | 2 +- source3/libsmb/cliprint.c | 5 +- source3/libsmb/clirap.c | 10 +- source3/libsmb/clirap2.c | 63 +- source3/libsmb/clireadwrite.c | 2 +- source3/libsmb/clisecdesc.c | 4 +- source3/libsmb/clispnego.c | 3 + source3/libsmb/namequery.c | 2 +- source3/libsmb/namequery_dc.c | 16 +- source3/libsmb/nmblib.c | 34 +- source3/libsmb/ntlmssp.c | 102 +- source3/libsmb/ntlmssp_parse.c | 3 +- source3/libsmb/ntlmssp_sign.c | 24 +- source3/libsmb/smb_signing.c | 160 +- source3/libsmb/smbencrypt.c | 4 +- source3/libsmb/spnego.c | 343 +++++ source3/libsmb/trusts_util.c | 9 +- source3/locking/locking.c | 32 +- source3/modules/CP437.c | 136 ++ source3/modules/CP850.c | 122 ++ source3/modules/getdate.c | 2460 ++++++++++++++++++++++++++++++ source3/modules/getdate.h | 46 + source3/modules/getdate.y | 1115 ++++++++++++++ source3/modules/vfs_cap.c | 448 ++++++ source3/modules/vfs_default_quota.c | 180 +++ source3/modules/vfs_readonly.c | 98 ++ source3/modules/vfs_recycle.c | 5 +- source3/msdfs/README | 32 - source3/msdfs/msdfs.c | 85 +- source3/nmbd/asyncdns.c | 73 +- source3/nmbd/nmbd.c | 208 ++- source3/nmbd/nmbd_become_dmb.c | 522 ++++--- source3/nmbd/nmbd_become_lmb.c | 688 +++++---- source3/nmbd/nmbd_browserdb.c | 10 +- source3/nmbd/nmbd_browsesync.c | 845 +++++------ source3/nmbd/nmbd_elections.c | 530 ++++--- source3/nmbd/nmbd_incomingdgrams.c | 1086 +++++++------- source3/nmbd/nmbd_incomingrequests.c | 606 ++++---- source3/nmbd/nmbd_lmhosts.c | 91 +- source3/nmbd/nmbd_logonnames.c | 195 +-- source3/nmbd/nmbd_mynames.c | 184 ++- source3/nmbd/nmbd_namelistdb.c | 800 +++++----- source3/nmbd/nmbd_namequery.c | 414 +++-- source3/nmbd/nmbd_nameregister.c | 42 +- source3/nmbd/nmbd_nodestatus.c | 68 +- source3/nmbd/nmbd_packets.c | 2499 +++++++++++++++---------------- source3/nmbd/nmbd_processlogon.c | 813 +++++----- source3/nmbd/nmbd_responserecordsdb.c | 318 ++-- source3/nmbd/nmbd_sendannounce.c | 765 +++++----- source3/nmbd/nmbd_serverlistdb.c | 520 +++---- source3/nmbd/nmbd_subnetdb.c | 395 +++-- source3/nmbd/nmbd_synclists.c | 40 +- source3/nmbd/nmbd_winsproxy.c | 260 ++-- source3/nmbd/nmbd_winsserver.c | 2661 ++++++++++++++++----------------- source3/nmbd/nmbd_workgroupdb.c | 364 +++-- source3/nsswitch/pam_winbind.h | 5 +- source3/nsswitch/wb_client.c | 74 + source3/nsswitch/wbinfo.c | 74 +- source3/nsswitch/winbindd.c | 8 +- source3/nsswitch/winbindd_acct.c | 15 +- source3/nsswitch/winbindd_ads.c | 74 +- source3/nsswitch/winbindd_cache.c | 8 +- source3/nsswitch/winbindd_cm.c | 126 +- source3/nsswitch/winbindd_group.c | 12 + source3/nsswitch/winbindd_misc.c | 30 +- source3/nsswitch/winbindd_nss.h | 1 + source3/nsswitch/winbindd_pam.c | 36 +- source3/nsswitch/winbindd_rpc.c | 4 +- source3/nsswitch/winbindd_sid.c | 18 +- source3/nsswitch/winbindd_user.c | 14 +- source3/nsswitch/winbindd_util.c | 131 +- source3/nsswitch/wins.c | 110 +- source3/param/loadparm.c | 65 +- source3/passdb/lookup_sid.c | 488 ++++++ source3/passdb/passdb.c | 105 +- source3/passdb/pdb_interface.c | 4 +- source3/passdb/pdb_ldap.c | 21 +- source3/passdb/pdb_mysql.c | 4 +- source3/passdb/pdb_plugin.c | 8 +- source3/passdb/pdb_tdb.c | 6 +- source3/passdb/secrets.c | 61 +- source3/printing/lpq_parse.c | 8 +- source3/printing/nt_printing.c | 39 +- source3/python/py_lsa.c | 43 +- source3/python/py_smb.c | 25 +- source3/python/py_spoolss_drivers.c | 5 +- source3/python/py_winbind.c | 10 +- source3/rpc_client/cli_netlogon.c | 21 +- source3/rpc_client/cli_pipe.c | 25 +- source3/rpc_client/cli_spoolss.c | 10 +- source3/rpc_parse/parse_echo.c | 8 +- source3/rpc_parse/parse_net.c | 22 +- source3/rpc_parse/parse_prs.c | 16 +- source3/rpc_parse/parse_reg.c | 2 +- source3/rpc_parse/parse_samr.c | 12 +- source3/rpc_parse/parse_spoolss.c | 10 +- source3/rpc_server/srv_dfs.c | 16 +- source3/rpc_server/srv_dfs_nt.c | 4 +- source3/rpc_server/srv_echo.c | 27 +- source3/rpc_server/srv_lsa.c | 43 +- source3/rpc_server/srv_lsa_ds.c | 93 ++ source3/rpc_server/srv_lsa_ds_nt.c | 127 ++ source3/rpc_server/srv_lsa_nt.c | 2 +- source3/rpc_server/srv_netlog.c | 13 +- source3/rpc_server/srv_pipe.c | 209 ++- source3/rpc_server/srv_pipe_hnd.c | 2 + source3/rpc_server/srv_reg.c | 18 +- source3/rpc_server/srv_samr.c | 49 +- source3/rpc_server/srv_samr_nt.c | 112 +- source3/rpc_server/srv_spoolss.c | 13 +- source3/rpc_server/srv_spoolss_nt.c | 26 +- source3/rpc_server/srv_srvsvc.c | 16 +- source3/rpc_server/srv_util.c | 11 +- source3/rpc_server/srv_wkssvc.c | 15 +- source3/rpcclient/cmd_ds.c | 2 +- source3/rpcclient/cmd_netlogon.c | 86 +- source3/rpcclient/cmd_spoolss.c | 44 +- source3/rpcclient/rpcclient.c | 12 +- source3/sam/idmap_ldap.c | 352 +++-- source3/sam/idmap_tdb.c | 41 +- source3/sam/idmap_util.c | 51 +- source3/script/.cvsignore | 1 + source3/script/find_missing_doc.pl | 90 -- source3/script/findsmb.in | 210 +-- source3/script/gap.awk | 39 + source3/script/gaptab.awk | 48 + source3/script/gen-8bit-gap.awk | 18 + source3/script/gen-8bit-gap.sh.in | 49 + source3/script/installmodules.sh | 9 - source3/script/installswat.sh | 18 +- source3/script/linkmodules.sh | 12 + source3/script/mkproto.awk | 14 - source3/script/mkproto.sh | 2 +- source3/script/mkversion.sh | 87 ++ source3/smbadduser | 14 +- source3/smbadduser.in | 79 + source3/smbd/blocking.c | 2 +- source3/smbd/change_trust_pw.c | 5 + source3/smbd/chgpasswd.c | 113 +- source3/smbd/fileio.c | 22 +- source3/smbd/filename.c | 4 +- source3/smbd/files.c | 28 + source3/smbd/lanman.c | 131 +- source3/smbd/mangle_hash2.c | 49 +- source3/smbd/message.c | 2 +- source3/smbd/notify.c | 2 +- source3/smbd/nttrans.c | 189 ++- source3/smbd/open.c | 13 +- source3/smbd/password.c | 5 +- source3/smbd/process.c | 17 +- source3/smbd/reply.c | 307 +++- source3/smbd/sec_ctx.c | 2 +- source3/smbd/server.c | 2 +- source3/smbd/service.c | 9 +- source3/smbd/sesssetup.c | 22 +- source3/smbd/statcache.c | 15 +- source3/smbd/trans2.c | 253 +++- source3/smbd/uid.c | 465 +----- source3/smbd/utmp.c | 10 +- source3/smbd/vfs-wrap.c | 66 +- source3/smbd/vfs.c | 6 +- source3/tdb/tdb.c | 49 +- source3/torture/cmd_vfs.c | 15 +- source3/torture/masktest.c | 2 +- source3/torture/rpctorture.c | 4 +- source3/torture/smbiconv.c | 16 +- source3/utils/log2pcaphex.c | 294 ++++ source3/utils/net.c | 111 +- source3/utils/net_ads.c | 91 +- source3/utils/net_ads_cldap.c | 28 +- source3/utils/net_groupmap.c | 17 +- source3/utils/net_help.c | 10 +- source3/utils/net_lookup.c | 38 +- source3/utils/net_rpc.c | 34 +- source3/utils/net_rpc_samsync.c | 37 +- source3/utils/nmblookup.c | 2 +- source3/utils/ntlm_auth.c | 474 ++++-- source3/utils/profiles.c | 2 +- source3/utils/smbcacls.c | 4 +- source3/utils/smbgroupedit.c | 405 ----- source3/utils/status.c | 2 +- source3/utils/testparm.c | 21 + source3/web/statuspage.c | 2 +- source3/web/swat.c | 11 +- source3/wrepld/server.c | 2 +- 260 files changed, 20170 insertions(+), 11647 deletions(-) create mode 100644 source3/VERSION create mode 100644 source3/include/spnego.h create mode 100644 source3/lib/afs.c create mode 100644 source3/lib/dummyroot.c create mode 100644 source3/lib/replace1.c create mode 100644 source3/lib/version.c create mode 100644 source3/libsmb/spnego.c create mode 100644 source3/modules/CP437.c create mode 100644 source3/modules/CP850.c create mode 100644 source3/modules/getdate.c create mode 100644 source3/modules/getdate.h create mode 100644 source3/modules/getdate.y create mode 100644 source3/modules/vfs_cap.c create mode 100644 source3/modules/vfs_default_quota.c create mode 100644 source3/modules/vfs_readonly.c delete mode 100644 source3/msdfs/README create mode 100644 source3/passdb/lookup_sid.c create mode 100644 source3/rpc_server/srv_lsa_ds.c create mode 100644 source3/rpc_server/srv_lsa_ds_nt.c delete mode 100755 source3/script/find_missing_doc.pl create mode 100644 source3/script/gap.awk create mode 100644 source3/script/gaptab.awk create mode 100644 source3/script/gen-8bit-gap.awk create mode 100755 source3/script/gen-8bit-gap.sh.in create mode 100755 source3/script/linkmodules.sh create mode 100755 source3/script/mkversion.sh create mode 100644 source3/smbadduser.in create mode 100644 source3/utils/log2pcaphex.c delete mode 100644 source3/utils/smbgroupedit.c diff --git a/source3/.cvsignore b/source3/.cvsignore index 074a88cef2..31dd2c3a7a 100644 --- a/source3/.cvsignore +++ b/source3/.cvsignore @@ -28,3 +28,4 @@ testtmp trace.out typescript* configure +smbadduser diff --git a/source3/Makefile.in b/source3/Makefile.in index 4674fd07ae..f7ec500d06 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -3,7 +3,7 @@ # Copyright Andrew Tridgell 1992-1998 # Copyright (C) 2001 by Martin Pool # Copyright Andrew Bartlett 2002 -# Copyright (C) 2003 Jim McDonough +# Copyright (C) 2003 Jim McDonough # Copyright (C) 2002-2003 Jelmer Vernooij ########################################################################### @@ -27,13 +27,13 @@ PERL=@PERL@ TERMLDFLAGS=@TERMLDFLAGS@ TERMLIBS=@TERMLIBS@ -PRINTLIBS=@PRINTLIBS@ -AUTHLIBS=@AUTHLIBS@ -ACLLIBS=@ACLLIBS@ -PASSDBLIBS=@PASSDBLIBS@ +PRINT_LIBS=@PRINT_LIBS@ +AUTH_LIBS=@AUTH_LIBS@ +ACL_LIBS=@ACL_LIBS@ +PASSDB_LIBS=@PASSDB_LIBS@ IDMAP_LIBS=@IDMAP_LIBS@ KRB5LIBS=@KRB5_LIBS@ -LDAPLIBS=@LDAP_LIBS@ +LDAP_LIBS=@LDAP_LIBS@ LINK=$(CC) $(FLAGS) $(LDFLAGS) @@ -51,7 +51,7 @@ SHELL=/bin/sh # /bin/sh on some platforms. I guess it's not a big problem -- mbp # See the autoconf manual "Installation Directory Variables" for a -# discussion of thesubtle use of these variables. +# discussion of the subtle use of these variables. BASEDIR= @prefix@ BINDIR = @bindir@ @@ -139,7 +139,8 @@ TORTURE_PROGS = bin/smbtorture@EXEEXT@ bin/msgtest@EXEEXT@ \ BIN_PROGS = $(BIN_PROGS1) $(BIN_PROGS2) $(BIN_PROGS3) @EXTRA_BIN_PROGS@ -EVERYTHING_PROGS = bin/debug2html@EXEEXT@ bin/smbfilter@EXEEXT@ bin/talloctort@EXEEXT@ +EVERYTHING_PROGS = bin/debug2html@EXEEXT@ bin/smbfilter@EXEEXT@ bin/talloctort@EXEEXT@ \ + bin/log2pcap@EXEEXT@ SHLIBS = @SHLIB_PROGS@ @LIBSMBCLIENT@ @@ -162,7 +163,7 @@ TDB_OBJ = $(TDBBASE_OBJ) tdb/tdbutil.o tdb/tdbback.o SMBLDAP_OBJ = @SMBLDAP@ -LIB_OBJ = lib/charcnv.o lib/debug.o lib/fault.o \ +LIB_OBJ = lib/version.o lib/charcnv.o lib/debug.o lib/fault.o \ lib/getsmbpass.o lib/interface.o lib/md4.o \ lib/interfaces.o lib/pidfile.o lib/replace.o lib/replace1.o \ lib/signal.o lib/system.o lib/sendfile.o lib/time.o \ @@ -186,6 +187,8 @@ LIB_SMBD_OBJ = lib/system_smbd.o lib/util_smbd.o READLINE_OBJ = lib/readline.o +# Also depends on $(SECRETS_OBJ) $(LIBSAMBA_OBJ) +# Be sure to include them into your application POPT_LIB_OBJ = lib/popt_common.o UBIQX_OBJ = ubiqx/ubi_BinTree.o ubiqx/ubi_Cache.o ubiqx/ubi_SplayTree.o \ @@ -242,6 +245,8 @@ RPC_SAMR_OBJ = rpc_server/srv_samr.o rpc_server/srv_samr_nt.o \ RPC_REG_OBJ = rpc_server/srv_reg.o rpc_server/srv_reg_nt.o +RPC_LSA_DS_OBJ = rpc_server/srv_lsa_ds.o rpc_server/srv_lsa_ds_nt.o + RPC_SVC_OBJ = rpc_server/srv_srvsvc.o rpc_server/srv_srvsvc_nt.o RPC_WKS_OBJ = rpc_server/srv_wkssvc.o rpc_server/srv_wkssvc_nt.o @@ -278,11 +283,13 @@ PASSDB_GET_SET_OBJ = passdb/pdb_get_set.o PASSDB_OBJ = $(PASSDB_GET_SET_OBJ) passdb/passdb.o passdb/pdb_interface.o \ passdb/machine_sid.o passdb/util_sam_sid.o passdb/pdb_compat.o \ - passdb/privileges.o @PDB_STATIC@ + passdb/privileges.o passdb/lookup_sid.o @PDB_STATIC@ XML_OBJ = passdb/pdb_xml.o MYSQL_OBJ = passdb/pdb_mysql.o -DEVEL_HELP_OBJ = modules/weird.o +DEVEL_HELP_WEIRD_OBJ = modules/weird.o +DEVEL_HELP_CP850_OBJ = modules/CP850.o +DEVEL_HELP_CP437_OBJ = modules/CP437.o GROUPDB_OBJ = groupdb/mapping.o @@ -300,6 +307,8 @@ VFS_FAKE_PERMS_OBJ = modules/vfs_fake_perms.o VFS_RECYCLE_OBJ = modules/vfs_recycle.o VFS_NETATALK_OBJ = modules/vfs_netatalk.o VFS_DEFAULT_QUOTA_OBJ = modules/vfs_default_quota.o +VFS_READONLY_OBJ = modules/vfs_readonly.o modules/getdate.o +VFS_CAP_OBJ = modules/vfs_cap.o PLAINTEXT_AUTH_OBJ = auth/pampass.o auth/pass_check.o @@ -338,7 +347,7 @@ SMBD_OBJ_SRV = smbd/files.o smbd/chgpasswd.o smbd/connection.o \ smbd/process.o smbd/service.o smbd/error.o \ printing/printfsp.o lib/util_seaccess.o \ lib/sysquotas.o smbd/change_trust_pw.o smbd/fake_file.o \ - smbd/quotas.o smbd/ntquotas.o \ + smbd/quotas.o smbd/ntquotas.o lib/afs.o \ $(MANGLE_OBJ) @VFS_STATIC@ SMBD_OBJ_BASE = $(PARAM_OBJ) $(SMBD_OBJ_SRV) $(MSDFS_OBJ) $(LIBSMB_OBJ) \ @@ -396,18 +405,20 @@ SMBSH_OBJ = smbwrapper/smbsh.o smbwrapper/shared.o \ STATUS_OBJ = utils/status.o $(LOCKING_OBJ) $(PARAM_OBJ) \ $(UBIQX_OBJ) $(PROFILE_OBJ) $(LIB_OBJ) $(POPT_LIB_OBJ) \ - lib/dummyroot.o libsmb/errormap.o + $(SECRETS_OBJ) $(LIBSAMBA_OBJ) lib/dummyroot.o libsmb/errormap.o SMBCONTROL_OBJ = utils/smbcontrol.o $(LOCKING_OBJ) $(PARAM_OBJ) \ $(UBIQX_OBJ) $(PROFILE_OBJ) $(LIB_OBJ) $(POPT_LIB_OBJ) \ + $(SECRETS_OBJ) $(LIBSAMBA_OBJ) \ printing/notify.o printing/printing_db.o lib/dummyroot.o libsmb/errormap.o SMBTREE_OBJ = utils/smbtree.o $(LOCKING_OBJ) $(PARAM_OBJ) \ $(UBIQX_OBJ) $(PROFILE_OBJ) $(LIB_OBJ) $(LIBSMB_OBJ) \ - $(KRBCLIENT_OBJ) $(POPT_LIB_OBJ) + $(KRBCLIENT_OBJ) $(POPT_LIB_OBJ) $(SECRETS_OBJ) TESTPARM_OBJ = utils/testparm.o \ - $(PARAM_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) $(POPT_LIB_OBJ) + $(PARAM_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) $(POPT_LIB_OBJ) \ + $(SECRETS_OBJ) $(LIBSAMBA_OBJ) TESTPRNS_OBJ = utils/testprns.o $(PARAM_OBJ) $(PRINTING_OBJ) $(UBIQX_OBJ) \ $(LIB_OBJ) @@ -435,7 +446,7 @@ RPCCLIENT_OBJ = $(RPCCLIENT_OBJ1) \ $(LIBADS_OBJ) $(SECRETS_OBJ) $(POPT_LIB_OBJ) \ $(SMBLDAP_OBJ) $(DCUTIL_OBJ) lib/dummyroot.o -PAM_WINBIND_OBJ = nsswitch/pam_winbind.po nsswitch/wb_common.po lib/replace1.po lib/snprintf.po +PAM_WINBIND_PICOBJ = nsswitch/pam_winbind.po nsswitch/wb_common.po lib/replace1.po lib/snprintf.po SMBW_OBJ1 = smbwrapper/smbw.o \ smbwrapper/smbw_dir.o smbwrapper/smbw_stat.o \ @@ -469,7 +480,7 @@ CLIENT_OBJ1 = client/client.o client/clitar.o CLIENT_OBJ = $(CLIENT_OBJ1) $(PARAM_OBJ) $(LIBSMB_OBJ) $(UBIQX_OBJ) \ $(LIB_OBJ) $(KRBCLIENT_OBJ) \ - $(READLINE_OBJ) $(POPT_LIB_OBJ) + $(READLINE_OBJ) $(POPT_LIB_OBJ) $(SECRETS_OBJ) NET_OBJ1 = utils/net.o utils/net_ads.o utils/net_ads_cldap.o utils/net_help.o \ utils/net_rap.o utils/net_rpc.o utils/net_rpc_samsync.o \ @@ -481,20 +492,20 @@ NET_OBJ = $(NET_OBJ1) $(PARAM_OBJ) $(SECRETS_OBJ) $(LIBSMB_OBJ) \ $(KRBCLIENT_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) \ $(LIBMSRPC_OBJ) $(IDMAP_OBJ) \ $(LIBADS_OBJ) $(LIBADS_SERVER_OBJ) $(POPT_LIB_OBJ) \ - $(SMBLDAP_OBJ) $(DCUTIL_OBJ) lib/dummyroot.o lib/server_mutex.o + $(SMBLDAP_OBJ) $(DCUTIL_OBJ) lib/dummyroot.o lib/server_mutex.o lib/afs.o CUPS_OBJ = client/smbspool.o $(PARAM_OBJ) $(LIBSMB_OBJ) $(UBIQX_OBJ) \ - $(LIB_OBJ) $(KRBCLIENT_OBJ) + $(LIB_OBJ) $(KRBCLIENT_OBJ) $(SECRETS_OBJ) MOUNT_OBJ = client/smbmount.o \ $(PARAM_OBJ) $(LIBSMB_OBJ) $(KRBCLIENT_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) -MNT_OBJ = client/smbmnt.o +MNT_OBJ = client/smbmnt.o lib/version.o lib/snprintf.o UMOUNT_OBJ = client/smbumount.o NMBLOOKUP_OBJ = utils/nmblookup.o $(PARAM_OBJ) $(UBIQX_OBJ) $(LIBNMB_OBJ) \ - $(LIB_OBJ) $(POPT_LIB_OBJ) + $(LIB_OBJ) $(POPT_LIB_OBJ) $(SECRETS_OBJ) $(LIBSAMBA_OBJ) SMBTORTURE_OBJ1 = torture/torture.o torture/nbio.o torture/scanner.o torture/utable.o \ torture/denytest.o torture/mangle_test.o @@ -516,7 +527,9 @@ NSSTEST_OBJ = torture/nsstest.o $(PARAM_OBJ) $(LIBSMB_OBJ) $(KRBCLIENT_OBJ) \ VFSTEST_OBJ = torture/cmd_vfs.o torture/vfstest.o $(SMBD_OBJ_BASE) $(READLINE_OBJ) -SMBICONV_OBJ = $(PARAM_OBJ) torture/smbiconv.o $(LIB_OBJ) $(UBIQX_OBJ) $(POPT_LIB_OBJ) +SMBICONV_OBJ = $(PARAM_OBJ) torture/smbiconv.o $(LIB_OBJ) $(UBIQX_OBJ) $(POPT_LIB_OBJ) $(SECRETS_OBJ) $(LIBSAMBA_OBJ) + +LOG2PCAP_OBJ = utils/log2pcaphex.o LOCKTEST2_OBJ = torture/locktest2.o $(PARAM_OBJ) $(LOCKING_OBJ) $(LIBSMB_OBJ) \ $(KRBCLIENT_OBJ) $(UBIQX_OBJ) $(LIB_OBJ) @@ -558,12 +571,12 @@ PROTO_OBJ = $(SMBD_OBJ_MAIN) \ $(PASSDB_OBJ) $(GROUPDB_OBJ) $(MSDFS_OBJ) \ $(READLINE_OBJ) $(PROFILE_OBJ) $(LIBADS_OBJ) $(LIBADS_SERVER_OBJ) \ $(LIB_SMBD_OBJ) $(SAM_OBJ) $(REGISTRY_OBJ) $(POPT_LIB_OBJ) \ - $(RPC_LSA_OBJ) $(RPC_NETLOG_OBJ) $(RPC_SAMR_OBJ) $(RPC_REG_OBJ) \ + $(RPC_LSA_OBJ) $(RPC_NETLOG_OBJ) $(RPC_SAMR_OBJ) $(RPC_REG_OBJ) $(RPC_LSA_DS_OBJ) \ $(RPC_SVC_OBJ) $(RPC_WKS_OBJ) $(RPC_DFS_OBJ) $(RPC_SPOOLSS_OBJ) \ $(RPC_ECHO_OBJ) $(SMBLDAP_OBJ) $(IDMAP_OBJ) libsmb/spnego.o WINBIND_WINS_NSS_OBJ = nsswitch/wins.o $(PARAM_OBJ) $(UBIQX_OBJ) \ - $(LIBSMB_OBJ) $(LIB_OBJ) $(NSSWINS_OBJ) + $(LIBSMB_OBJ) $(LIB_OBJ) $(NSSWINS_OBJ) $(KRBCLIENT_OBJ) WINBIND_WINS_NSS_PICOBJS = $(WINBIND_WINS_NSS_OBJ:.o=.po) @@ -572,9 +585,8 @@ LIBSMBCLIENT_PICOBJS = $(LIBSMBCLIENT_OBJ:.o=.po) PAM_SMBPASS_OBJ_0 = pam_smbpass/pam_smb_auth.o pam_smbpass/pam_smb_passwd.o \ pam_smbpass/pam_smb_acct.o pam_smbpass/support.o \ - libsmb/smbencrypt.o libsmb/smbdes.o libsmb/nterr.o \ - $(PARAM_OBJ) $(LIB_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ) \ - $(SECRETS_OBJ) $(UBIQX_OBJ) + lib/dummyroot.o $(PARAM_OBJ) $(LIB_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ) \ + $(SECRETS_OBJ) $(UBIQX_OBJ) $(SMBLDAP_OBJ) $(LIBSAMBA_OBJ) PAM_SMBPASS_PICOOBJ = $(PAM_SMBPASS_OBJ_0:.o=.po) @@ -617,7 +629,10 @@ POPT_OBJS=popt/findme.o popt/popt.o popt/poptconfig.o \ TDBBACKUP_OBJ = tdb/tdbbackup.o tdb/tdbback.o $(TDBBASE_OBJ) NTLM_AUTH_OBJ = utils/ntlm_auth.o $(LIBSAMBA_OBJ) $(POPT_LIB_OBJ) \ - libsmb/asn1.o libsmb/spnego.o + libsmb/asn1.o libsmb/spnego.o libsmb/clikrb5.o libads/kerberos.o \ + libads/kerberos_verify.o $(SECRETS_OBJ) lib/server_mutex.o \ + libads/authdata.o rpc_parse/parse_prs.o rpc_parse/parse_misc.o \ + libsmb/doserr.o ###################################################################### # now the rules... @@ -660,7 +675,8 @@ wins : SHOWFLAGS @WINBIND_WINS_NSS@ modules: SHOWFLAGS proto_exists $(MODULES) -everything: all libsmbclient debug2html smbfilter talloctort modules torture +everything: all libsmbclient debug2html smbfilter talloctort modules torture \ + $(EVERYTHING_PROGS) .SUFFIXES: .SUFFIXES: .c .o .po .lo @@ -694,7 +710,6 @@ MAKEDIR = || exec false; \ # rebuild it's a bit hard. dynconfig.o: dynconfig.c Makefile - @$(MAKE) modules_clean @echo Compiling $*.c @$(CC) $(FLAGS) $(PATH_FLAGS) -c $< -o $@ @@ -706,6 +721,18 @@ dynconfig.po: dynconfig.c Makefile @BROKEN_CC@ -mv `echo $@ | sed -e 's%^.*/%%g' -e 's%\.po$$%.o%'` $@ @POBAD_CC@ @mv $*.po.o $@ +lib/version.o: lib/version.c include/version.h + @echo Compiling $*.c + @$(CC) -I. -I$(srcdir) $(FLAGS) $(PATH_FLAGS) -c $< -o $@ + +lib/version.po: lib/version.c include/version.h + @if (: >> $@ || : > $@) >/dev/null 2>&1; then rm -f $@; else \ + dir=`echo $@ | sed 's,/[^/]*$$,,;s,^$$,.,'` $(MAKEDIR); fi + @echo Compiling $*.c with @PICFLAG@ + @$(CC) -I. -I$(srcdir) $(FLAGS) $(PATH_FLAGS) @PICFLAG@ -c $< -o $*.@PICSUFFIX@ +@BROKEN_CC@ -mv `echo $@ | sed -e 's%^.*/%%g' -e 's%\.po$$%.o%'` $@ +@POBAD_CC@ @mv $*.po.o $@ + smbd/build_options.o: smbd/build_options.c Makefile include/config.h include/build_env.h include/proto.h @echo Compiling $*.c @$(CC) $(FLAGS) $(PATH_FLAGS) -c $< -o $@ @@ -729,12 +756,12 @@ bin/.dummy: bin/smbd@EXEEXT@: $(SMBD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBD_OBJ) $(KRB5LIBS) $(LDAPLIBS) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ - $(AUTHLIBS) $(ACLLIBS) $(PASSDBLIBS) $(LIBS) @POPTLIBS@ + @$(CC) $(FLAGS) -o $@ $(SMBD_OBJ) $(KRB5LIBS) $(LDAP_LIBS) $(LDFLAGS) $(DYNEXP) $(PRINT_LIBS) \ + $(AUTH_LIBS) $(ACL_LIBS) $(PASSDB_LIBS) $(LIBS) @POPTLIBS@ bin/nmbd@EXEEXT@: $(NMBD_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAP_LIBS) bin/wrepld@EXEEXT@: $(WREPL_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @@ -742,20 +769,20 @@ bin/wrepld@EXEEXT@: $(WREPL_OBJ) @BUILD_POPT@ bin/.dummy bin/swat@EXEEXT@: $(SWAT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SWAT_OBJ) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ - $(AUTHLIBS) $(LIBS) $(PASSDBLIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(SWAT_OBJ) $(LDFLAGS) $(DYNEXP) $(PRINT_LIBS) \ + $(AUTH_LIBS) $(LIBS) $(PASSDB_LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAP_LIBS) bin/rpcclient@EXEEXT@: $(RPCCLIENT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(RPCCLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(PASSDB_LIBS) $(RPCCLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAP_LIBS) bin/smbclient@EXEEXT@: $(CLIENT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAP_LIBS) bin/net@EXEEXT@: $(NET_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) $(PASSDBLIBS) + @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAP_LIBS) $(PASSDB_LIBS) bin/profiles@EXEEXT@: $(PROFILES_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @@ -767,11 +794,11 @@ bin/editreg@EXEEXT@: $(EDITREG_OBJ) @BUILD_POPT@ bin/.dummy bin/smbspool@EXEEXT@: $(CUPS_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(CUPS_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(CUPS_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAP_LIBS) bin/smbmount@EXEEXT@: $(MOUNT_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(MOUNT_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(MOUNT_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAP_LIBS) bin/smbmnt@EXEEXT@: $(MNT_OBJ) bin/.dummy @echo Linking $@ @@ -787,39 +814,42 @@ bin/testparm@EXEEXT@: $(TESTPARM_OBJ) @BUILD_POPT@ bin/.dummy bin/testprns@EXEEXT@: $(TESTPRNS_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(TESTPRNS_OBJ) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) $(LIBS) + @$(CC) $(FLAGS) -o $@ $(TESTPRNS_OBJ) $(LDFLAGS) $(DYNEXP) $(PRINT_LIBS) $(LIBS) bin/smbstatus@EXEEXT@: $(STATUS_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(STATUS_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ + @$(CC) $(FLAGS) -o $@ $(STATUS_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) \ + @POPTLIBS@ bin/smbcontrol@EXEEXT@: $(SMBCONTROL_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) -DUSING_SMBCONTROL $(FLAGS) -o $@ $(SMBCONTROL_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ + @$(CC) -DUSING_SMBCONTROL $(FLAGS) -o $@ $(SMBCONTROL_OBJ) $(DYNEXP) \ + $(LDFLAGS) $(LIBS) \ + @POPTLIBS@ bin/smbtree@EXEEXT@: $(SMBTREE_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBTREE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(SMBTREE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAP_LIBS) bin/smbpasswd@EXEEXT@: $(SMBPASSWD_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBPASSWD_OBJ) $(PASSDBLIBS) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(SMBPASSWD_OBJ) $(PASSDB_LIBS) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) $(LDAP_LIBS) bin/pdbedit@EXEEXT@: $(PDBEDIT_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(PDBEDIT_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(PASSDBLIBS) + @$(CC) $(FLAGS) -o $@ $(PDBEDIT_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(PASSDB_LIBS) bin/samtest@EXEEXT@: $(SAMTEST_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SAMTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(PASSDBLIBS) $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(SAMTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(PASSDB_LIBS) $(KRB5LIBS) $(LDAP_LIBS) bin/nmblookup@EXEEXT@: $(NMBLOOKUP_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NMBLOOKUP_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(NMBLOOKUP_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(LDAP_LIBS) bin/smbtorture@EXEEXT@: $(SMBTORTURE_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBTORTURE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(SMBTORTURE_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) $(LDAP_LIBS) $(SECRETS_OBJ) bin/talloctort@EXEEXT@: $(TALLOCTORT_OBJ) bin/.dummy @echo Linking $@ @@ -827,43 +857,47 @@ bin/talloctort@EXEEXT@: $(TALLOCTORT_OBJ) bin/.dummy bin/masktest@EXEEXT@: $(MASKTEST_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(MASKTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(MASKTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAP_LIBS) $(SECRETS_OBJ) bin/msgtest@EXEEXT@: $(MSGTEST_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(MSGTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(MSGTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAP_LIBS) bin/smbcacls@EXEEXT@: $(SMBCACLS_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBCACLS_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(SMBCACLS_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAP_LIBS) bin/smbcquotas@EXEEXT@: $(SMBCQUOTAS_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBCQUOTAS_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(SMBCQUOTAS_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAP_LIBS) bin/locktest@EXEEXT@: $(LOCKTEST_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(LOCKTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(LOCKTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAP_LIBS) bin/nsstest@EXEEXT@: $(NSSTEST_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(NSSTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(NSSTEST_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAP_LIBS) bin/vfstest@EXEEXT@: $(VFSTEST_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(VFSTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(PRINTLIBS) $(AUTHLIBS) $(ACLLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(VFSTEST_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(PRINT_LIBS) $(AUTH_LIBS) $(ACL_LIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAP_LIBS) bin/smbiconv@EXEEXT@: $(SMBICONV_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @$(CC) $(FLAGS) -o $@ $(SMBICONV_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(LIBS) @POPTLIBS@ +bin/log2pcap@EXEEXT@: $(LOG2PCAP_OBJ) @BUILD_POPT@ bin/.dummy + @echo Linking $@ + @$(CC) $(FLAGS) -o $@ $(LOG2PCAP_OBJ) $(LDFLAGS) @POPTLIBS@ $(LIBS) + bin/locktest2@EXEEXT@: $(LOCKTEST2_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(LOCKTEST2_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(LOCKTEST2_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAP_LIBS) bin/rpctorture@EXEEXT@: $(RPCTORTURE_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(RPCTORTURE_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(RPCTORTURE_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAP_LIBS) bin/debug2html@EXEEXT@: $(DEBUG2HTML_OBJ) bin/.dummy @echo Linking $@ @@ -871,11 +905,11 @@ bin/debug2html@EXEEXT@: $(DEBUG2HTML_OBJ) bin/.dummy bin/smbfilter@EXEEXT@: $(SMBFILTER_OBJ) bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBFILTER_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(SMBFILTER_OBJ) $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAP_LIBS) bin/smbw_sample@EXEEXT@: $(SMBW_OBJ) utils/smbw_sample.o bin/.dummy @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SMBW_OBJ) utils/smbw_sample.o $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) + @$(CC) $(FLAGS) -o $@ $(SMBW_OBJ) utils/smbw_sample.o $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAP_LIBS) bin/smbsh@EXEEXT@: $(SMBSH_OBJ) bin/.dummy @echo Linking $@ @@ -884,13 +918,13 @@ bin/smbsh@EXEEXT@: $(SMBSH_OBJ) bin/.dummy bin/smbwrapper.@SHLIBEXT@: $(PICOBJS) bin/.dummy @echo Linking shared library $@ @$(SHLD) $(LDSHFLAGS) -o $@ $(PICOBJS) $(LIBS) \ - $(KRB5LIBS) $(LDAPLIBS) \ + $(KRB5LIBS) $(LDAP_LIBS) \ @SONAMEFLAG@`basename $@` bin/libsmbclient.@SHLIBEXT@: $(LIBSMBCLIENT_PICOBJS) @echo Linking libsmbclient shared library $@ @$(SHLD) $(LDSHFLAGS) -o $@ $(LIBSMBCLIENT_PICOBJS) $(LDFLAGS) $(LIBS) \ - $(KRB5LIBS) $(LDAPLIBS) \ + $(KRB5LIBS) $(LDAP_LIBS) \ @SONAMEFLAG@`basename $@`.$(LIBSMBCLIENT_MAJOR) bin/libsmbclient.a: $(LIBSMBCLIENT_PICOBJS) @@ -901,7 +935,7 @@ bin/libsmbclient.a: $(LIBSMBCLIENT_PICOBJS) bin/libbigballofmud.@SHLIBEXT@: $(LIBBIGBALLOFMUD_PICOBJS) @echo Linking bigballofmud shared library $@ @$(SHLD) $(LDSHFLAGS) -o $@ $(LIBBIGBALLOFMUD_PICOBJS) $(LIBS) \ - $(PASSDBLIBS) $(IDMAP_LIBS) $(KRB5LIBS) $(LDAPLIBS) \ + $(PASSDB_LIBS) $(IDMAP_LIBS) $(KRB5LIBS) $(LDAP_LIBS) \ @SONAMEFLAG@`basename $@`.$(LIBBIGBALLOFMUD_MAJOR) ln -snf libbigballofmud.so bin/libbigballofmud.so.0 @@ -942,6 +976,11 @@ bin/librpc_winreg.@SHLIBEXT@: $(RPC_REG_OBJ) @$(SHLD) $(LDSHFLAGS) -o $@ $(RPC_REG_OBJ) -lc \ @SONAMEFLAG@`basename $@` +bin/librpc_lsa_ds.@SHLIBEXT@: $(RPC_LSA_DS_OBJ) + @echo "Linking $@" + @$(SHLD) $(LDSHFLAGS) -o $@ $(RPC_LSA_DS_OBJ) -lc \ + @SONAMEFLAG@`basename $@` + bin/librpc_spoolss.@SHLIBEXT@: $(RPC_SPOOLSS_OBJ) @echo "Linking $@" @$(SHLD) $(LDSHFLAGS) -o $@ $(RPC_SPOOLSS_OBJ) -lc \ @@ -959,7 +998,10 @@ bin/librpc_echo.@SHLIBEXT@: $(RPC_ECHO_OBJ) bin/winbindd@EXEEXT@: $(WINBINDD_OBJ) @BUILD_POPT@ bin/.dummy @echo "Linking $@" - @$(LINK) -o $@ $(WINBINDD_OBJ) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) + @$(LINK) -o $@ $(WINBINDD_OBJ) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAP_LIBS) + +# Please don't add .o files to libnss_winbind, libnss_wins, or the pam_winbind +# libraries. Add to the appropriate PICOBJ variable instead. @WINBIND_NSS@: $(WINBIND_NSS_PICOBJS) @echo "Linking $@" @@ -969,12 +1011,12 @@ bin/winbindd@EXEEXT@: $(WINBINDD_OBJ) @BUILD_POPT@ bin/.dummy @WINBIND_WINS_NSS@: $(WINBIND_WINS_NSS_PICOBJS) @echo "Linking $@" @$(SHLD) $(LDSHFLAGS) -o $@ $(WINBIND_WINS_NSS_PICOBJS) \ - $(KRBCLIENT_OBJ) $(LDAPLIBS) $(KRB5LIBS) -lc \ + $(LDAP_LIBS) $(KRB5LIBS) -lc \ @SONAMEFLAG@`basename $@` -nsswitch/pam_winbind.@SHLIBEXT@: $(PAM_WINBIND_OBJ) bin/.dummy +nsswitch/pam_winbind.@SHLIBEXT@: $(PAM_WINBIND_PICOBJ) bin/.dummy @echo "Linking $@" - @$(SHLD) $(LDSHFLAGS) -o $@ $(PAM_WINBIND_OBJ) \ + @$(SHLD) $(LDSHFLAGS) -o $@ $(PAM_WINBIND_PICOBJ) \ @SONAMEFLAG@`basename $@` -lpam bin/rhosts.@SHLIBEXT@: $(AUTH_RHOSTS_OBJ:.o=.po) @@ -989,7 +1031,7 @@ bin/domain.@SHLIBEXT@: $(AUTH_DOMAIN_OBJ:.o=.po) @echo "Building plugin $@" @$(SHLD) $(LDSHFLAGS) -o $@ $(AUTH_DOMAIN_OBJ:.o=.po) @SONAMEFLAG@`basename $@` -bin/server.@SHLIBEXT@: $(AUTH_SERVER_OBJ:.o=.po) +bin/smbserver.@SHLIBEXT@: $(AUTH_SERVER_OBJ:.o=.po) @echo "Building plugin $@" @$(SHLD) $(LDSHFLAGS) -o $@ $(AUTH_SERVER_OBJ:.o=.po) @SONAMEFLAG@`basename $@` @@ -1012,7 +1054,7 @@ bin/mysql.@SHLIBEXT@: $(MYSQL_OBJ:.o=.po) bin/ldapsam.@SHLIBEXT@: passdb/pdb_ldap.po @echo "Building plugin $@" - @$(SHLD) $(LDSHFLAGS) $(LDAPLIBS) -o $@ passdb/pdb_ldap.po \ + @$(SHLD) $(LDSHFLAGS) $(LDAP_LIBS) -o $@ passdb/pdb_ldap.po \ @SONAMEFLAG@`basename $@` bin/tdbsam.@SHLIBEXT@: passdb/pdb_tdb.po @@ -1025,9 +1067,19 @@ bin/smbpasswd.@SHLIBEXT@: passdb/pdb_smbpasswd.po @$(SHLD) $(LDSHFLAGS) -o $@ passdb/pdb_smbpasswd.po \ @SONAMEFLAG@`basename $@` -bin/weird.@SHLIBEXT@: $(DEVEL_HELP_OBJ:.o=.po) +bin/weird.@SHLIBEXT@: $(DEVEL_HELP_WEIRD_OBJ:.o=.po) + @echo "Building plugin $@" + @$(SHLD) $(LDSHFLAGS) -o $@ $(DEVEL_HELP_WEIRD_OBJ:.o=.po) \ + @SONAMEFLAG@`basename $@` + +bin/CP850.@SHLIBEXT@: $(DEVEL_HELP_CP850_OBJ:.o=.po) @echo "Building plugin $@" - @$(SHLD) $(LDSHFLAGS) -o $@ $(DEVEL_HELP_OBJ:.o=.po) \ + @$(SHLD) $(LDSHFLAGS) -o $@ $(DEVEL_HELP_CP850_OBJ:.o=.po) \ + @SONAMEFLAG@`basename $@` + +bin/CP437.@SHLIBEXT@: $(DEVEL_HELP_CP437_OBJ:.o=.po) + @echo "Building plugin $@" + @$(SHLD) $(LDSHFLAGS) -o $@ $(DEVEL_HELP_CP437_OBJ:.o=.po) \ @SONAMEFLAG@`basename $@` bin/xml.@SHLIBEXT@: $(XML_OBJ:.o=.po) @@ -1065,6 +1117,16 @@ bin/default_quota.@SHLIBEXT@: $(VFS_DEFAULT_QUOTA_OBJ:.o=.po) @$(SHLD) $(LDSHFLAGS) -o $@ $(VFS_DEFAULT_QUOTA_OBJ:.o=.po) \ @SONAMEFLAG@`basename $@` +bin/readonly.@SHLIBEXT@: $(VFS_READONLY_OBJ:.o=.po) + @echo "Building plugin $@" + @$(SHLD) $(LDSHFLAGS) -o $@ $(VFS_READONLY_OBJ:.o=.po) \ + @SONAMEFLAG@`basename $@` + +bin/cap.@SHLIBEXT@: $(VFS_CAP_OBJ:.o=.po) + @echo "Building plugin $@" + @$(SHLD) $(LDSHFLAGS) -o $@ $(VFS_CAP_OBJ:.o=.po) \ + @SONAMEFLAG@`basename $@` + bin/wbinfo@EXEEXT@: $(WBINFO_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @$(LINK) -o $@ $(WBINFO_OBJ) $(LIBS) @POPTLIBS@ @@ -1073,11 +1135,11 @@ bin/ntlm_auth@EXEEXT@: $(NTLM_AUTH_OBJ) $(PARAM_OBJ) $(LIB_OBJ) \ $(UBIQX_OBJ) @BUILD_POPT@ bin/.dummy @echo Linking $@ @$(LINK) -o $@ $(NTLM_AUTH_OBJ) $(PARAM_OBJ) $(LIB_OBJ) \ - $(UBIQX_OBJ) $(LIBS) @POPTLIBS@ + $(UBIQX_OBJ) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAP_LIBS) bin/pam_smbpass.@SHLIBEXT@: $(PAM_SMBPASS_PICOOBJ) @echo "Linking shared library $@" - @$(SHLD) $(LDSHFLAGS) -o $@ $(PAM_SMBPASS_PICOOBJ) -lpam $(DYNEXP) $(LIBS) -lc + @$(SHLD) $(LDSHFLAGS) -o $@ $(PAM_SMBPASS_PICOOBJ) -lpam $(DYNEXP) $(LIBS) -lc $(LDAP_LIBS) $(KRB5LIBS) bin/libmsrpc.a: $(LIBMSRPC_PICOBJ) @-$(AR) -rc $@ $(LIBMSRPC_PICOBJ) @@ -1099,7 +1161,7 @@ bin/t_push_ucs2@EXEEXT@: bin/libbigballofmud.@SHLIBEXT@ torture/t_push_ucs2.o bin/t_snprintf@EXEEXT@: lib/snprintf.c $(CC) $(FLAGS) -o $@ -DTEST_SNPRINTF lib/snprintf.c -lm -install: installbin installman installscripts installdat installswat installmodules +install: installbin installman installscripts installdat installswat installmodules @INSTALLCLIENT@ install-everything: install installmodules @@ -1129,6 +1191,13 @@ installmodules: modules installdirs @$(SHELL) $(srcdir)/script/installmodules.sh $(INSTALLPERMS) $(DESTDIR)$(BASEDIR) $(DESTDIR)$(IDMAPLIBDIR) $(IDMAP_MODULES) @$(SHELL) $(srcdir)/script/installmodules.sh $(INSTALLPERMS) $(DESTDIR)$(BASEDIR) $(DESTDIR)$(CHARSETLIBDIR) $(CHARSET_MODULES) @$(SHELL) $(srcdir)/script/installmodules.sh $(INSTALLPERMS) $(DESTDIR)$(BASEDIR) $(DESTDIR)$(AUTHLIBDIR) $(AUTH_MODULES) + @# These symlinks are required for the 'probing' of modules. + @# This mechanism should go at some point.. + @$(SHELL) $(srcdir)/script/linkmodules.sh $(DESTDIR)$(PDBLIBDIR) ldapsam.@SHLIBEXT@ ldapsam_compat.@SHLIBEXT@ + @$(SHELL) $(srcdir)/script/linkmodules.sh $(DESTDIR)$(AUTHLIBDIR) rhosts.@SHLIBEXT@ hostsequiv.@SHLIBEXT@ + @$(SHELL) $(srcdir)/script/linkmodules.sh $(DESTDIR)$(AUTHLIBDIR) sam.@SHLIBEXT@ sam_ignoredomain.@SHLIBEXT@ + @$(SHELL) $(srcdir)/script/linkmodules.sh $(DESTDIR)$(AUTHLIBDIR) domain.@SHLIBEXT@ trustdomain.@SHLIBEXT@ ntdomain.@SHLIBEXT@ + @$(SHELL) $(srcdir)/script/linkmodules.sh $(DESTDIR)$(AUTHLIBDIR) builtin.@SHLIBEXT@ guest.@SHLIBEXT@ fixed_challenge.@SHLIBEXT@ name_to_ntstatus.@SHLIBEXT@ installscripts: installdirs @$(SHELL) $(srcdir)/script/installscripts.sh $(INSTALLPERMS) $(DESTDIR)$(BINDIR) $(SCRIPTS) @@ -1160,7 +1229,7 @@ python_ext: $(PYTHON_PICOBJS) fi PYTHON_OBJS="$(PYTHON_PICOBJS)" \ PYTHON_CFLAGS="$(CFLAGS) $(CPPFLAGS) $(FLAGS)" \ - LIBS="$(LIBS) $(PASSDBLIBS) $(IDMAP_LIBS) $(KRB5LIBS) $(LDAPLIBS)" \ + LIBS="$(LIBS) $(PASSDB_LIBS) $(IDMAP_LIBS) $(KRB5LIBS) $(LDAP_LIBS)" \ $(PYTHON) python/setup.py build python_install: $(PYTHON_PICOBJS) @@ -1223,11 +1292,6 @@ clean: delheaders python_clean $(TOPFILES) $(BIN_PROGS) $(SBIN_PROGS) $(MODULES) $(TORTURE_PROGS) \ $(LIBSMBCLIENT) $(EVERYTHING_PROGS) .headers.stamp -# This is quite ugly actually.. But we need to make -# sure the changes to include/config.h are used. -modules_clean: - @-rm -f auth/auth.o passdb/pdb_interface.o smbd/server.o lib/iconv.o smbd/vfs.o sam/idmap.o - # Making this target will just make sure that the prototype files # exist, not necessarily that they are up to date. Since they're # removed by "make clean" this will always be run when you do anything @@ -1315,6 +1379,11 @@ distclean: realclean -rm -f config.status config.cache so_locations -rm -rf .deps +realdistclean: distclean + -rm -f include/config.h.in + -rm -f include/version.h + -rm -f configure + # this target is really just for my use. It only works on a limited # range of machines and is used to produce a list of potentially # dead (ie. unused) functions in the code. (tridge) diff --git a/source3/VERSION b/source3/VERSION new file mode 100644 index 0000000000..9cf8b11ef1 --- /dev/null +++ b/source3/VERSION @@ -0,0 +1,123 @@ +######################################################## +# SAMBA Version # +# # +# script/mkversion.sh # +# will use this file to create # +# include/version.h # +# # +######################################################## + +######################################################## +# This are the main SAMBA version numbers # +# # +# .. # +# # +# e.g. SAMBA_VERSION_MAJOR=3 # +# SAMBA_VERSION_MINOR=0 # +# SAMBA_VERSION_RELEASE=0 # +# -> "3.0.0" # +######################################################## +SAMBA_VERSION_MAJOR=3 +SAMBA_VERSION_MINOR=0 +SAMBA_VERSION_RELEASE=1 + +######################################################## +# If a official release has a serious bug # +# a security release will have 'a' sufffix # +# # +# so SAMBA's version will be # +# .. # +# # +# e.g. SAMBA_VERSION_PRE_RELEASE=a # +# -> "2.2.8a" # +######################################################## +SAMBA_VERSION_REVISION= + +######################################################## +# For 'pre' releases the version will be # +# # +# ..pre # +# # +# e.g. SAMBA_VERSION_PRE_RELEASE=1 # +# -> "2.2.9pre1" # +######################################################## +SAMBA_VERSION_PRE_RELEASE=1 + +######################################################## +# For 'rc' releases the version will be # +# # +# ..rc # +# # +# e.g. SAMBA_VERSION_RC_RELEASE=1 # +# -> "3.0.0rc1" # +######################################################## +SAMBA_VERSION_RC_RELEASE= + +######################################################## +# For 'beta' releases the version will be # +# # +# ..beta # +# # +# e.g. SAMBA_VERSION_BETA_RELEASE=3 # +# -> "3.0.0beta3" # +######################################################## +SAMBA_VERSION_BETA_RELEASE= + +######################################################## +# For 'alpha' releases the version will be # +# # +# ..alpha # +# # +# e.g. SAMBA_VERSION_ALPHA_RELEASE=1 # +# -> "4.0.0alpha1" # +######################################################## +SAMBA_VERSION_ALPHA_RELEASE= + +######################################################## +# For 'test' releases the version will be # +# # +# ..test # +# # +# e.g. SAMBA_VERSION_TEST_RELEASE=1 # +# -> "4.0.0test1" # +######################################################## +SAMBA_VERSION_TEST_RELEASE= + +######################################################## +# To mark CVS snapshots this should be set to 'yes' # +# in the development BRANCH, and set to 'no' only in # +# the SAMBA_X_X_RELEASE BRANCH # +# # +# ..[...]cvs # +# # +# e.g. SAMBA_VERSION_IS_CVS_SNAPSHOT=yes # +# -> "CVS 3.0.0rc2" # +######################################################## +SAMBA_VERSION_IS_CVS_SNAPSHOT=yes + +######################################################## +# This can be set by vendors if they want... # +# This can be a string constant or a function which # +# returns a string (const char *) # +# # +# ..[...]- # +# # +# Note the '-' is automaticaly added # +# # +# e.g. SAMBA_VERSION_VENDOR_SUFFIX="VendorVersion" # +# -> "CVS 3.0.0rc2-VendorVersion" # +# # +# Note: If you want to use a function, # +# then patch lib/version.c and add this function # +# there, because the symbol must be available in # +# binary. # +# # +# const char *vendor_version(void) # +# { # +# return "VendorVersion"; # +# } # +# # +# e.g. SAMBA_VERSION_VENDOR_SUFFIX=vendor_version() # +# -> "CVS 3.0.0rc2-VendorVersion" # +######################################################## +SAMBA_VERSION_VENDOR_SUFFIX= diff --git a/source3/aclocal.m4 b/source3/aclocal.m4 index 3a49f7e249..52396e56d6 100644 --- a/source3/aclocal.m4 +++ b/source3/aclocal.m4 @@ -54,6 +54,7 @@ AC_DEFUN(SMB_MODULE, $4_MODULES="$$4_MODULES $3" AC_MSG_RESULT([shared]) [$6] + string_shared_modules="$string_shared_modules $1" elif test x"$DEST" = xSTATIC; then [init_static_modules_]translit([$4], [A-Z], [a-z])="$[init_static_modules_]translit([$4], [A-Z], [a-z]) $1_init();" string_static_modules="$string_static_modules $1" @@ -62,6 +63,7 @@ AC_DEFUN(SMB_MODULE, [$5] AC_MSG_RESULT([static]) else + string_ignored_modules="$string_ignored_modules $1" AC_MSG_RESULT([not]) fi ]) @@ -71,6 +73,7 @@ AC_DEFUN(SMB_SUBSYSTEM, AC_SUBST($1_STATIC) AC_SUBST($1_MODULES) AC_DEFINE_UNQUOTED([static_init_]translit([$1], [A-Z], [a-z]), [{$init_static_modules_]translit([$1], [A-Z], [a-z])[}], [Static init functions]) + ifelse([$2], , :, [touch $2]) ]) dnl AC_PROG_CC_FLAG(flag) @@ -448,8 +451,6 @@ AC_ARG_WITH(mysql-prefix,[ --with-mysql-prefix=PFX Prefix where MYSQL is inst mysql_prefix="$withval", mysql_prefix="") AC_ARG_WITH(mysql-exec-prefix,[ --with-mysql-exec-prefix=PFX Exec prefix where MYSQL is installed (optional)], mysql_exec_prefix="$withval", mysql_exec_prefix="") -AC_ARG_ENABLE(mysqltest, [ --disable-mysqltest Do not try to compile and run a test MYSQL program], - , enable_mysqltest=yes) if test x$mysql_exec_prefix != x ; then mysql_args="$mysql_args --exec-prefix=$mysql_exec_prefix" @@ -466,143 +467,21 @@ AC_ARG_ENABLE(mysqltest, [ --disable-mysqltest Do not try to compile and AC_REQUIRE([AC_CANONICAL_TARGET]) AC_PATH_PROG(MYSQL_CONFIG, mysql_config, no) - min_mysql_version=ifelse([$1], ,0.11.0,$1) - AC_MSG_CHECKING(for MYSQL - version >= $min_mysql_version) + AC_MSG_CHECKING(for MYSQL) no_mysql="" if test "$MYSQL_CONFIG" = "no" ; then - no_mysql=yes + MYSQL_CFLAGS="" + MYSQL_LIBS="" + AC_MSG_RESULT(no) + ifelse([$2], , :, [$2]) else MYSQL_CFLAGS=`$MYSQL_CONFIG $mysqlconf_args --cflags | sed -e "s/'//g"` MYSQL_LIBS=`$MYSQL_CONFIG $mysqlconf_args --libs | sed -e "s/'//g"` - - mysql_major_version=`$MYSQL_CONFIG $mysql_args --version | \ - sed 's/\([[0-9]]*\).\([[0-9]]*\).\([[0-9]]*\)/\1/'` - mysql_minor_version=`$MYSQL_CONFIG $mysql_args --version | \ - sed 's/\([[0-9]]*\).\([[0-9]]*\).\([[0-9]]*\)/\2/'` - mysql_micro_version=`$MYSQL_CONFIG $mysql_config_args --version | \ - sed 's/\([[0-9]]*\).\([[0-9]]*\).\([[0-9]]*\)/\3/'` - if test "x$enable_mysqltest" = "xyes" ; then - ac_save_CFLAGS="$CFLAGS" - ac_save_LIBS="$LIBS" - CFLAGS="$CFLAGS $MYSQL_CFLAGS" - LIBS="$LIBS $MYSQL_LIBS" -dnl -dnl Now check if the installed MYSQL is sufficiently new. (Also sanity -dnl checks the results of mysql_config to some extent -dnl - rm -f conf.mysqltest - AC_TRY_RUN([ -#include -#include -#include -#include - -char* -my_strdup (char *str) -{ - char *new_str; - - if (str) - { - new_str = (char *)malloc ((strlen (str) + 1) * sizeof(char)); - strcpy (new_str, str); - } - else - new_str = NULL; - - return new_str; -} - -int main (int argc, char *argv[]) -{ -int major, minor, micro; - char *tmp_version; - - /* This hangs on some systems (?) - system ("touch conf.mysqltest"); - */ - { FILE *fp = fopen("conf.mysqltest", "a"); if ( fp ) fclose(fp); } - - /* HP/UX 9 (%@#!) writes to sscanf strings */ - tmp_version = my_strdup("$min_mysql_version"); - if (sscanf(tmp_version, "%d.%d.%d", &major, &minor, µ) != 3) { - printf("%s, bad version string\n", "$min_mysql_version"); - exit(1); - } - - if (($mysql_major_version > major) || - (($mysql_major_version == major) && ($mysql_minor_version > minor)) || - (($mysql_major_version == major) && ($mysql_minor_version == minor) && ($mysql_micro_version >= micro))) - { - return 0; - } - else - { - printf("\n*** 'mysql_config --version' returned %d.%d.%d, but the minimum version\n", $mysql_major_version, $mysql_minor_version, $mysql_micro_version); - printf("*** of MYSQL required is %d.%d.%d. If mysql_config is correct, then it is\n", major, minor, micro); - printf("*** best to upgrade to the required version.\n"); - printf("*** If mysql_config was wrong, set the environment variable MYSQL_CONFIG\n"); - printf("*** to point to the correct copy of mysql_config, and remove the file\n"); - printf("*** config.cache before re-running configure\n"); - return 1; - } -} - -],, no_mysql=yes,[echo $ac_n "cross compiling; assumed OK... $ac_c"]) - CFLAGS="$ac_save_CFLAGS" - LIBS="$ac_save_LIBS" - fi - fi - if test "x$no_mysql" = x ; then - AC_MSG_RESULT(yes) - ifelse([$2], , :, [$2]) - else - AC_MSG_RESULT(no) - if test "$MYSQL_CONFIG" = "no" ; then - echo "*** The mysql_config script installed by MYSQL could not be found" - echo "*** If MYSQL was installed in PREFIX, make sure PREFIX/bin is in" - echo "*** your path, or set the MYSQL_CONFIG environment variable to the" - echo "*** full path to mysql_config." - else - if test -f conf.mysqltest ; then - : - else - echo "*** Could not run MYSQL test program, checking why..." - CFLAGS="$CFLAGS $MYSQL_CFLAGS" - LIBS="$LIBS $MYSQL_LIBS" - AC_TRY_LINK([ -#include -#include - -int main(int argc, char *argv[]) -{ return 0; } -#undef main -#define main K_and_R_C_main -], [ return 0; ], - [ echo "*** The test program compiled, but did not run. This usually means" - echo "*** that the run-time linker is not finding MYSQL or finding the wrong" - echo "*** version of MYSQL. If it is not finding MYSQL, you'll need to set your" - echo "*** LD_LIBRARY_PATH environment variable, or edit /etc/ld.so.conf to point" - echo "*** to the installed location Also, make sure you have run ldconfig if that" - echo "*** is required on your system" - echo "***" - echo "*** If you have an old version installed, it is best to remove it, although" - echo "*** you may also be able to get things to work by modifying LD_LIBRARY_PATH"], - [ echo "*** The test program failed to compile or link. See the file config.log for the" - echo "*** exact error that occured. This usually means MYSQL was incorrectly installed" - echo "*** or that you have moved MYSQL since it was installed. In the latter case, you" - echo "*** may want to edit the mysql_config script: $MYSQL_CONFIG" ]) - CFLAGS="$ac_save_CFLAGS" - LIBS="$ac_save_LIBS" - fi - fi - MYSQL_CFLAGS="" - MYSQL_LIBS="" - ifelse([$3], , :, [$3]) + AC_MSG_RESULT(yes) + ifelse([$1], , :, [$1]) fi AC_SUBST(MYSQL_CFLAGS) AC_SUBST(MYSQL_LIBS) - rm -f conf.mysqltest ]) dnl Removes -I/usr/include/? from given variable @@ -733,6 +612,22 @@ AC_DEFUN(jm_ICONV, fi ]) +AC_DEFUN(rjs_CHARSET,[ + dnl Find out if we can convert from $1 to UCS2-LE + AC_MSG_CHECKING([can we convert from $1 to UCS2-LE?]) + AC_TRY_RUN([ +#include <$jm_cv_include> +main(){ + iconv_t cd = iconv_open("$1", "UCS-2LE"); + if (cd == 0 || cd == (iconv_t)-1) { + return -1; + } + return 0; +} + ],ICONV_CHARSET=$1,ICONV_CHARSET=no,ICONV_CHARSET=cross) + AC_MSG_RESULT($ICONV_CHARSET) +]) + dnl CFLAGS_ADD_DIR(CFLAGS, $INCDIR) dnl This function doesn't add -I/usr/include into CFLAGS AC_DEFUN(CFLAGS_ADD_DIR,[ diff --git a/source3/auth/auth.c b/source3/auth/auth.c index 8316c4b617..553d9a686e 100644 --- a/source3/auth/auth.c +++ b/source3/auth/auth.c @@ -131,7 +131,7 @@ static const uint8 *get_ntlm_challenge(struct auth_context *auth_context) DEBUG(5, ("auth_context challenge created by %s\n", challenge_set_by)); DEBUG(5, ("challenge is: \n")); - dump_data(5, auth_context->challenge.data, auth_context->challenge.length); + dump_data(5, (const char *)auth_context->challenge.data, auth_context->challenge.length); SMB_ASSERT(auth_context->challenge.length == 8); @@ -228,7 +228,7 @@ static NTSTATUS check_ntlm_password(const struct auth_context *auth_context, auth_context->challenge_set_by)); DEBUG(10, ("challenge is: \n")); - dump_data(5, auth_context->challenge.data, auth_context->challenge.length); + dump_data(5, (const char *)auth_context->challenge.data, auth_context->challenge.length); #ifdef DEBUG_PASSWORD DEBUG(100, ("user_info has passwords of length %d and %d\n", @@ -373,10 +373,10 @@ BOOL load_auth_module(struct auth_context *auth_context, if (p) { *p = 0; module_params = p+1; - trim_string(module_params, " ", " "); + trim_char(module_params, ' ', ' '); } - trim_string(module_name, " ", " "); + trim_char(module_name, ' ', ' '); entry = auth_find_backend_entry(module_name); diff --git a/source3/auth/auth_domain.c b/source3/auth/auth_domain.c index aacea261fe..43e7597cd9 100644 --- a/source3/auth/auth_domain.c +++ b/source3/auth/auth_domain.c @@ -26,9 +26,6 @@ extern BOOL global_machine_password_needs_changing; -extern userdom_struct current_user_info; - - /** * Connect to a remote server for domain security authenticaion. * diff --git a/source3/auth/auth_rhosts.c b/source3/auth/auth_rhosts.c index fab2d551f2..b295df9328 100644 --- a/source3/auth/auth_rhosts.c +++ b/source3/auth/auth_rhosts.c @@ -40,7 +40,7 @@ static BOOL check_user_equiv(const char *user, const char *remote, const char *e if (! lines) return False; for (i=0; lines[i]; i++) { char *buf = lines[i]; - trim_string(buf," "," "); + trim_char(buf,' ',' '); if (buf[0] != '#' && buf[0] != '\n') { diff --git a/source3/auth/auth_sam.c b/source3/auth/auth_sam.c index fb66d53cd4..ce97bd7df2 100644 --- a/source3/auth/auth_sam.c +++ b/source3/auth/auth_sam.c @@ -27,8 +27,9 @@ #define DBGC_CLASS DBGC_AUTH /**************************************************************************** -core of smb password checking routine. + Core of smb password checking routine. ****************************************************************************/ + static BOOL smb_pwd_check_ntlmv1(const DATA_BLOB *nt_response, const uchar *part_passwd, const DATA_BLOB *sec_blob, @@ -54,8 +55,7 @@ static BOOL smb_pwd_check_ntlmv1(const DATA_BLOB *nt_response, } SMBOWFencrypt(part_passwd, sec_blob->data, p24); - if (user_sess_key != NULL) - { + if (user_sess_key != NULL) { SMBsesskeygen_ntv1(part_passwd, NULL, user_sess_key); } @@ -74,12 +74,11 @@ static BOOL smb_pwd_check_ntlmv1(const DATA_BLOB *nt_response, return (memcmp(p24, nt_response->data, 24) == 0); } - /**************************************************************************** -core of smb password checking routine. (NTLMv2, LMv2) - -Note: The same code works with both NTLMv2 and LMv2. + Core of smb password checking routine. (NTLMv2, LMv2) + Note: The same code works with both NTLMv2 and LMv2. ****************************************************************************/ + static BOOL smb_pwd_check_ntlmv2(const DATA_BLOB *ntv2_response, const uchar *part_passwd, const DATA_BLOB *sec_blob, @@ -92,8 +91,7 @@ static BOOL smb_pwd_check_ntlmv2(const DATA_BLOB *ntv2_response, uchar client_response[16]; DATA_BLOB client_key_data; - if (part_passwd == NULL) - { + if (part_passwd == NULL) { DEBUG(10,("No password set - DISALLOWING access\n")); /* No password set - always False */ return False; @@ -121,8 +119,7 @@ static BOOL smb_pwd_check_ntlmv2(const DATA_BLOB *ntv2_response, } SMBOWFencrypt_ntv2(kr, sec_blob, &client_key_data, value_from_encryption); - if (user_sess_key != NULL) - { + if (user_sess_key != NULL) { SMBsesskeygen_ntv2(kr, value_from_encryption, user_sess_key); } @@ -142,11 +139,11 @@ static BOOL smb_pwd_check_ntlmv2(const DATA_BLOB *ntv2_response, return (memcmp(value_from_encryption, client_response, 16) == 0); } - /**************************************************************************** Do a specific test for an smb password being correct, given a smb_password and the lanman and NT responses. ****************************************************************************/ + static NTSTATUS sam_password_ok(const struct auth_context *auth_context, TALLOC_CTX *mem_ctx, SAM_ACCOUNT *sampass, @@ -158,15 +155,11 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, uint32 auth_flags; acct_ctrl = pdb_get_acct_ctrl(sampass); - if (acct_ctrl & ACB_PWNOTREQ) - { - if (lp_null_passwords()) - { + if (acct_ctrl & ACB_PWNOTREQ) { + if (lp_null_passwords()) { DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", pdb_get_username(sampass))); return(NT_STATUS_OK); - } - else - { + } else { DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", pdb_get_username(sampass))); return(NT_STATUS_LOGON_FAILURE); } @@ -191,8 +184,7 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, nt_pw, &auth_context->challenge, user_info->smb_name.str, user_info->client_domain.str, - user_sess_key)) - { + user_sess_key)) { return NT_STATUS_OK; } @@ -201,9 +193,7 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, nt_pw, &auth_context->challenge, user_info->smb_name.str, "", - user_sess_key)) - - { + user_sess_key)) { return NT_STATUS_OK; } else { DEBUG(3,("sam_password_ok: NTLMv2 password check failed\n")); @@ -218,8 +208,7 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, DEBUG(4,("sam_password_ok: Checking NT MD4 password\n")); if (smb_pwd_check_ntlmv1(&user_info->nt_resp, nt_pw, &auth_context->challenge, - user_sess_key)) - { + user_sess_key)) { return NT_STATUS_OK; } else { DEBUG(3,("sam_password_ok: NT MD4 password check failed for user %s\n",pdb_get_username(sampass))); @@ -247,8 +236,7 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, DEBUG(4,("sam_password_ok: Checking LM password\n")); if (smb_pwd_check_ntlmv1(&user_info->lm_resp, lm_pw, &auth_context->challenge, - user_sess_key)) - { + user_sess_key)) { return NT_STATUS_OK; } } @@ -268,8 +256,7 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, nt_pw, &auth_context->challenge, user_info->smb_name.str, user_info->client_domain.str, - user_sess_key)) - { + user_sess_key)) { return NT_STATUS_OK; } @@ -278,8 +265,7 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, nt_pw, &auth_context->challenge, user_info->smb_name.str, "", - user_sess_key)) - { + user_sess_key)) { return NT_STATUS_OK; } @@ -287,12 +273,10 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, - I think this is related to Win9X pass-though authentication */ DEBUG(4,("sam_password_ok: Checking NT MD4 password in LM field\n")); - if (lp_ntlm_auth()) - { + if (lp_ntlm_auth()) { if (smb_pwd_check_ntlmv1(&user_info->lm_resp, nt_pw, &auth_context->challenge, - user_sess_key)) - { + user_sess_key)) { return NT_STATUS_OK; } DEBUG(3,("sam_password_ok: LM password, NT MD4 password in LM field and LMv2 failed for user %s\n",pdb_get_username(sampass))); @@ -313,6 +297,7 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context, Do a specific test for a SAM_ACCOUNT being vaild for this connection (ie not disabled, expired and the like). ****************************************************************************/ + static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx, SAM_ACCOUNT *sampass, const auth_usersupplied_info *user_info) @@ -325,16 +310,22 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx, /* Quit if the account was disabled. */ if (acct_ctrl & ACB_DISABLED) { - DEBUG(1,("Account for user '%s' was disabled.\n", pdb_get_username(sampass))); + DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", pdb_get_username(sampass))); return NT_STATUS_ACCOUNT_DISABLED; } + /* Quit if the account was locked out. */ + if (acct_ctrl & ACB_AUTOLOCK) { + DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", pdb_get_username(sampass))); + return NT_STATUS_ACCOUNT_LOCKED_OUT; + } + /* Test account expire time */ kickoff_time = pdb_get_kickoff_time(sampass); if (kickoff_time != 0 && time(NULL) > kickoff_time) { - DEBUG(1,("Account for user '%s' has expired.\n", pdb_get_username(sampass))); - DEBUG(3,("Account expired at '%ld' unix time.\n", (long)kickoff_time)); + DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", pdb_get_username(sampass))); + DEBUG(3,("sam_account_ok: Account expired at '%ld' unix time.\n", (long)kickoff_time)); return NT_STATUS_ACCOUNT_EXPIRED; } @@ -344,14 +335,14 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx, /* check for immediate expiry "must change at next logon" */ if (must_change_time == 0 && last_set_time != 0) { - DEBUG(1,("Account for user '%s' password must change!.\n", pdb_get_username(sampass))); + DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", pdb_get_username(sampass))); return NT_STATUS_PASSWORD_MUST_CHANGE; } /* check for expired password */ if (must_change_time < time(NULL) && must_change_time != 0) { - DEBUG(1,("Account for user '%s' password expired!.\n", pdb_get_username(sampass))); - DEBUG(1,("Password expired at '%s' (%ld) unix time.\n", http_timestring(must_change_time), (long)must_change_time)); + DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", pdb_get_username(sampass))); + DEBUG(1,("sam_account_ok: Password expired at '%s' (%ld) unix time.\n", http_timestring(must_change_time), (long)must_change_time)); return NT_STATUS_PASSWORD_EXPIRED; } } @@ -359,8 +350,8 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx, /* Test workstation. Workstation list is comma separated. */ workstation_list = talloc_strdup(mem_ctx, pdb_get_workstations(sampass)); - - if (!workstation_list) return NT_STATUS_NO_MEMORY; + if (!workstation_list) + return NT_STATUS_NO_MEMORY; if (*workstation_list) { BOOL invalid_ws = True; @@ -369,7 +360,7 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx, fstring tok; while (next_token(&s, tok, ",", sizeof(tok))) { - DEBUG(10,("checking for workstation match %s and %s (len=%d)\n", + DEBUG(10,("sam_account_ok: checking for workstation match %s and %s (len=%d)\n", tok, user_info->wksta_name.str, user_info->wksta_name.len)); if(strequal(tok, user_info->wksta_name.str)) { invalid_ws = False; @@ -399,7 +390,6 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx, return NT_STATUS_OK; } - /**************************************************************************** check if a username/password is OK assuming the password is a 24 byte SMB hash supplied in the user_info structure @@ -434,9 +424,8 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context, ret = pdb_getsampwnam(sampass, user_info->internal_username.str); unbecome_root(); - if (ret == False) - { - DEBUG(3,("Couldn't find user '%s' in passdb file.\n", user_info->internal_username.str)); + if (ret == False) { + DEBUG(3,("check_sam_security: Couldn't find user '%s' in passdb file.\n", user_info->internal_username.str)); pdb_free_sam(&sampass); return NT_STATUS_NO_SUCH_USER; } diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c index 5403ee8c39..952aa8ba59 100644 --- a/source3/auth/auth_util.c +++ b/source3/auth/auth_util.c @@ -216,8 +216,8 @@ NTSTATUS make_user_info_map(auth_usersupplied_info **user_info, client_domain, smb_name, wksta_name)); /* don't allow "" as a domain, fixes a Win9X bug - where it doens't supply a domain for logon script - 'net use' commands.*/ + where it doens't supply a domain for logon script + 'net use' commands. */ if ( *client_domain ) domain = client_domain; @@ -227,7 +227,7 @@ NTSTATUS make_user_info_map(auth_usersupplied_info **user_info, /* do what win2k does. Always map unknown domains to our own and let the "passdb backend" handle unknown users. */ - if ( !is_trusted_domain(domain) ) + if ( !is_trusted_domain(domain) && !strequal(domain, get_global_sam_name()) ) domain = get_default_sam_name(); /* we know that it is a trusted domain (and we are allowing them) or it is our domain */ @@ -393,7 +393,7 @@ BOOL make_user_info_for_reply(auth_usersupplied_info **user_info, dump_data(100, plaintext_password.data, plaintext_password.length); #endif - SMBencrypt( (const uchar *)plaintext_password.data, (const uchar*)chal, local_lm_response); + SMBencrypt( (const char *)plaintext_password.data, (const uchar*)chal, local_lm_response); local_lm_blob = data_blob(local_lm_response, 24); /* We can't do an NT hash here, as the password needs to be @@ -646,43 +646,66 @@ NT_USER_TOKEN *create_nt_token(uid_t uid, gid_t gid, int ngroups, gid_t *groups, * of groups. ******************************************************************************/ -static NTSTATUS get_user_groups_from_local_sam(const char *username, uid_t uid, gid_t gid, - int *n_groups, DOM_SID **groups, gid_t **unix_groups) +static NTSTATUS get_user_groups(const char *username, uid_t uid, gid_t gid, + int *n_groups, DOM_SID **groups, gid_t **unix_groups) { - int n_unix_groups; - int i; + int n_unix_groups; + int i; *n_groups = 0; *groups = NULL; + + /* Try winbind first */ - n_unix_groups = groups_max(); - if ((*unix_groups = malloc( sizeof(gid_t) * n_unix_groups ) ) == NULL) { - DEBUG(0, ("get_user_groups_from_local_sam: Out of memory allocating unix group list\n")); - return NT_STATUS_NO_MEMORY; + if ( strchr(username, *lp_winbind_separator()) ) { + n_unix_groups = winbind_getgroups( username, unix_groups ); + + DEBUG(10,("get_user_groups: winbind_getgroups(%s): result = %s\n", username, + n_unix_groups == -1 ? "FAIL" : "SUCCESS")); + + if ( n_unix_groups == -1 ) + return NT_STATUS_NO_SUCH_USER; /* what should this return value be? */ } - - if (sys_getgrouplist(username, gid, *unix_groups, &n_unix_groups) == -1) { - gid_t *groups_tmp; - groups_tmp = Realloc(*unix_groups, sizeof(gid_t) * n_unix_groups); - if (!groups_tmp) { - SAFE_FREE(*unix_groups); + else { + /* fallback to getgrouplist() */ + + n_unix_groups = groups_max(); + + if ((*unix_groups = malloc( sizeof(gid_t) * n_unix_groups ) ) == NULL) { + DEBUG(0, ("get_user_groups: Out of memory allocating unix group list\n")); return NT_STATUS_NO_MEMORY; } - *unix_groups = groups_tmp; - + if (sys_getgrouplist(username, gid, *unix_groups, &n_unix_groups) == -1) { - DEBUG(0, ("get_user_groups_from_local_sam: failed to get the unix group list\n")); - SAFE_FREE(*unix_groups); - return NT_STATUS_NO_SUCH_USER; /* what should this return value be? */ + + gid_t *groups_tmp; + + groups_tmp = Realloc(*unix_groups, sizeof(gid_t) * n_unix_groups); + + if (!groups_tmp) { + SAFE_FREE(*unix_groups); + return NT_STATUS_NO_MEMORY; + } + *unix_groups = groups_tmp; + + if (sys_getgrouplist(username, gid, *unix_groups, &n_unix_groups) == -1) { + DEBUG(0, ("get_user_groups: failed to get the unix group list\n")); + SAFE_FREE(*unix_groups); + return NT_STATUS_NO_SUCH_USER; /* what should this return value be? */ + } } } debug_unix_user_token(DBGC_CLASS, 5, uid, gid, n_unix_groups, *unix_groups); + /* now setup the space for storing the SIDS */ + if (n_unix_groups > 0) { + *groups = malloc(sizeof(DOM_SID) * n_unix_groups); + if (!*groups) { - DEBUG(0, ("get_user_group_from_local_sam: malloc() failed for DOM_SID list!\n")); + DEBUG(0, ("get_user_group: malloc() failed for DOM_SID list!\n")); SAFE_FREE(*unix_groups); return NT_STATUS_NO_MEMORY; } @@ -692,7 +715,8 @@ static NTSTATUS get_user_groups_from_local_sam(const char *username, uid_t uid, for (i = 0; i < *n_groups; i++) { if (!NT_STATUS_IS_OK(gid_to_sid(&(*groups)[i], (*unix_groups)[i]))) { - DEBUG(1, ("get_user_groups_from_local_sam: failed to convert gid %ld to a sid!\n", (long int)(*unix_groups)[i+1])); + DEBUG(1, ("get_user_groups: failed to convert gid %ld to a sid!\n", + (long int)(*unix_groups)[i+1])); SAFE_FREE(*groups); SAFE_FREE(*unix_groups); return NT_STATUS_NO_SUCH_USER; @@ -743,10 +767,9 @@ static NTSTATUS add_user_groups(auth_serversupplied_info **server_info, BOOL is_guest; uint32 rid; - nt_status = get_user_groups_from_local_sam(pdb_get_username(sampass), - uid, gid, - &n_groupSIDs, &groupSIDs, - &unix_groups); + nt_status = get_user_groups(pdb_get_username(sampass), uid, gid, + &n_groupSIDs, &groupSIDs, &unix_groups); + if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(4,("get_user_groups_from_local_sam failed\n")); free_server_info(server_info); @@ -1068,11 +1091,11 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, /* Store the user group information in the server_info returned to the caller. */ - nt_status = get_user_groups_from_local_sam((*server_info)->unix_name, + nt_status = get_user_groups((*server_info)->unix_name, uid, gid, &n_lgroupSIDs, &lgroupSIDs, &unix_groups); - if ( !NT_STATUS_IS_OK(nt_status) ) - { - DEBUG(4,("get_user_groups_from_local_sam failed\n")); + + if ( !NT_STATUS_IS_OK(nt_status) ) { + DEBUG(4,("get_user_groups failed\n")); return nt_status; } @@ -1080,9 +1103,9 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, (*server_info)->n_groups = n_lgroupSIDs; /* Create a 'combined' list of all SIDs we might want in the SD */ - all_group_SIDs = malloc(sizeof(DOM_SID) * - (n_lgroupSIDs + info3->num_groups2 + - info3->num_other_sids)); + + all_group_SIDs = malloc(sizeof(DOM_SID) * (info3->num_groups2 +info3->num_other_sids)); + if (!all_group_SIDs) { DEBUG(0, ("malloc() failed for DOM_SID list!\n")); SAFE_FREE(lgroupSIDs); @@ -1090,20 +1113,30 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, return NT_STATUS_NO_MEMORY; } +#if 0 /* JERRY -- no such thing as local groups in current code */ /* Copy the 'local' sids */ memcpy(all_group_SIDs, lgroupSIDs, sizeof(DOM_SID) * n_lgroupSIDs); SAFE_FREE(lgroupSIDs); +#endif /* and create (by appending rids) the 'domain' sids */ + for (i = 0; i < info3->num_groups2; i++) { - sid_copy(&all_group_SIDs[i+n_lgroupSIDs], &(info3->dom_sid.sid)); - if (!sid_append_rid(&all_group_SIDs[i+n_lgroupSIDs], info3->gids[i].g_rid)) { + + sid_copy(&all_group_SIDs[i], &(info3->dom_sid.sid)); + + if (!sid_append_rid(&all_group_SIDs[i], info3->gids[i].g_rid)) { + nt_status = NT_STATUS_INVALID_PARAMETER; + DEBUG(3,("could not append additional group rid 0x%x\n", info3->gids[i].g_rid)); + SAFE_FREE(lgroupSIDs); free_server_info(server_info); + return nt_status; + } } @@ -1113,19 +1146,20 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx, http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp */ - for (i = 0; i < info3->num_other_sids; i++) - sid_copy(&all_group_SIDs[ - n_lgroupSIDs + info3->num_groups2 + i], + for (i = 0; i < info3->num_other_sids; i++) { + sid_copy(&all_group_SIDs[info3->num_groups2 + i], &info3->other_sids[i].sid); + } /* Where are the 'global' sids... */ /* can the user be guest? if yes, where is it stored? */ - if (!NT_STATUS_IS_OK( - nt_status = create_nt_user_token( - &user_sid, &group_sid, - n_lgroupSIDs + info3->num_groups2 + info3->num_other_sids, - all_group_SIDs, False, &token))) { + + nt_status = create_nt_user_token(&user_sid, &group_sid, + info3->num_groups2 + info3->num_other_sids, + all_group_SIDs, False, &token); + + if ( !NT_STATUS_IS_OK(nt_status) ) { DEBUG(4,("create_nt_user_token failed\n")); SAFE_FREE(all_group_SIDs); free_server_info(server_info); diff --git a/source3/auth/auth_winbind.c b/source3/auth/auth_winbind.c index aa8f345a5b..cae7aadd0c 100644 --- a/source3/auth/auth_winbind.c +++ b/source3/auth/auth_winbind.c @@ -36,7 +36,7 @@ static NTSTATUS get_info3_from_ndr(TALLOC_CTX *mem_ctx, struct winbindd_response if (!prs_init(&ps, len, mem_ctx, UNMARSHALL)) { return NT_STATUS_NO_MEMORY; } - prs_copy_data_in(&ps, info3_ndr, len); + prs_copy_data_in(&ps, (char *)info3_ndr, len); prs_set_offset(&ps,0); if (!net_io_user_info3("", info3, &ps, 1, 3)) { DEBUG(2, ("get_info3_from_ndr: could not parse info3 struct!\n")); diff --git a/source3/auth/pampass.c b/source3/auth/pampass.c index d666e439b0..3239686a20 100644 --- a/source3/auth/pampass.c +++ b/source3/auth/pampass.c @@ -230,7 +230,7 @@ static struct chat_struct *make_pw_chat(char *p) special_char_sub(prompt); fstrcpy(t->prompt, prompt); strlower_m(t->prompt); - trim_string(t->prompt, " ", " "); + trim_char(t->prompt, ' ', ' '); if (!next_token(&p, reply, NULL, sizeof(fstring))) break; @@ -241,7 +241,7 @@ static struct chat_struct *make_pw_chat(char *p) special_char_sub(reply); fstrcpy(t->reply, reply); strlower_m(t->reply); - trim_string(t->reply, " ", " "); + trim_char(t->reply, ' ', ' '); } return list; @@ -304,7 +304,7 @@ static int smb_pam_passchange_conv(int num_msg, case PAM_PROMPT_ECHO_ON: DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: PAM said: %s\n", msg[replies]->msg)); fstrcpy(current_prompt, msg[replies]->msg); - trim_string(current_prompt, " ", " "); + trim_char(current_prompt, ' ', ' '); for (t=pw_chat; t; t=t->next) { DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: trying to match |%s| to |%s|\n", @@ -335,7 +335,7 @@ static int smb_pam_passchange_conv(int num_msg, case PAM_PROMPT_ECHO_OFF: DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: PAM said: %s\n", msg[replies]->msg)); fstrcpy(current_prompt, msg[replies]->msg); - trim_string(current_prompt, " ", " "); + trim_char(current_prompt, ' ', ' '); for (t=pw_chat; t; t=t->next) { DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: trying to match |%s| to |%s|\n", diff --git a/source3/autogen.sh b/source3/autogen.sh index 2d91173f4a..6042b82cdc 100755 --- a/source3/autogen.sh +++ b/source3/autogen.sh @@ -55,6 +55,11 @@ $AUTOHEADER || exit 1 echo "$0: running $AUTOCONF" $AUTOCONF || exit 1 +echo "$0: running script/mkversion.sh" +./script/mkversion.sh || exit 1 + +rm -rf autom4te.cache autom4te-2.53.cache + echo "Now run ./configure and then make." exit 0 diff --git a/source3/bin/.cvsignore b/source3/bin/.cvsignore index 770100fd31..31af1fe22d 100644 --- a/source3/bin/.cvsignore +++ b/source3/bin/.cvsignore @@ -37,6 +37,7 @@ smbstatus smbtorture smbtree smbumount +smbiconv swat t_push_ucs2 t_snprintf @@ -47,6 +48,7 @@ tdbbackup testparm testprns vfstest +log2pcap wbinfo winbindd wrepld diff --git a/source3/client/client.c b/source3/client/client.c index ec29f44e6e..ecece8942e 100644 --- a/source3/client/client.c +++ b/source3/client/client.c @@ -102,9 +102,10 @@ static double dir_total; static struct cli_state *do_connect(const char *server, const char *share); /**************************************************************************** -write to a local file with CR/LF->LF translation if appropriate. return the -number taken from the buffer. This may not equal the number written. + Write to a local file with CR/LF->LF translation if appropriate. Return the + number taken from the buffer. This may not equal the number written. ****************************************************************************/ + static int writefile(int f, char *b, int n) { int i; @@ -129,9 +130,10 @@ static int writefile(int f, char *b, int n) } /**************************************************************************** - read from a file with LF->CR/LF translation if appropriate. return the - number read. read approx n bytes. + Read from a file with LF->CR/LF translation if appropriate. Return the + number read. read approx n bytes. ****************************************************************************/ + static int readfile(char *b, int n, XFILE *f) { int i; @@ -156,10 +158,10 @@ static int readfile(char *b, int n, XFILE *f) return(i); } - /**************************************************************************** -send a message + Send a message. ****************************************************************************/ + static void send_message(void) { int total_len = 0; @@ -206,11 +208,10 @@ static void send_message(void) } } - - /**************************************************************************** -check the space on a device + Check the space on a device. ****************************************************************************/ + static int do_dskattr(void) { int total, bsize, avail; @@ -227,8 +228,9 @@ static int do_dskattr(void) } /**************************************************************************** -show cd/pwd + Show cd/pwd. ****************************************************************************/ + static int cmd_pwd(void) { d_printf("Current directory is %s",service); @@ -236,10 +238,10 @@ static int cmd_pwd(void) return 0; } - /**************************************************************************** -change directory - inner section + Change directory - inner section. ****************************************************************************/ + static int do_cd(char *newdir) { char *p = newdir; @@ -276,8 +278,9 @@ static int do_cd(char *newdir) } /**************************************************************************** -change directory + Change directory. ****************************************************************************/ + static int cmd_cd(void) { fstring buf; @@ -291,13 +294,14 @@ static int cmd_cd(void) return rc; } - /******************************************************************* - decide if a file should be operated on - ********************************************************************/ + Decide if a file should be operated on. +********************************************************************/ + static BOOL do_this_one(file_info *finfo) { - if (finfo->mode & aDIR) return(True); + if (finfo->mode & aDIR) + return(True); if (*fileselection && !mask_match(finfo->name,fileselection,False)) { @@ -319,8 +323,9 @@ static BOOL do_this_one(file_info *finfo) } /**************************************************************************** - display info about a file - ****************************************************************************/ + Display info about a file. +****************************************************************************/ + static void display_finfo(file_info *finfo) { if (do_this_one(finfo)) { @@ -334,10 +339,10 @@ static void display_finfo(file_info *finfo) } } - /**************************************************************************** - accumulate size of a file - ****************************************************************************/ + Accumulate size of a file. +****************************************************************************/ + static void do_du(file_info *finfo) { if (do_this_one(finfo)) { @@ -354,8 +359,8 @@ static long do_list_queue_end = 0; static void (*do_list_fn)(file_info *); /**************************************************************************** -functions for do_list_queue - ****************************************************************************/ + Functions for do_list_queue. +****************************************************************************/ /* * The do_list_queue is a NUL-separated list of strings stored in a @@ -368,6 +373,7 @@ functions for do_list_queue * Functions check to ensure that do_list_queue is non-NULL before * accessing it. */ + static void reset_do_list_queue(void) { SAFE_FREE(do_list_queue); @@ -396,14 +402,11 @@ static void adjust_do_list_queue(void) * If the starting point of the queue is more than half way through, * move everything toward the beginning. */ - if (do_list_queue && (do_list_queue_start == do_list_queue_end)) - { + if (do_list_queue && (do_list_queue_start == do_list_queue_end)) { DEBUG(4,("do_list_queue is empty\n")); do_list_queue_start = do_list_queue_end = 0; *do_list_queue = '\0'; - } - else if (do_list_queue_start > (do_list_queue_size / 2)) - { + } else if (do_list_queue_start > (do_list_queue_size / 2)) { DEBUG(4,("sliding do_list_queue backward\n")); memmove(do_list_queue, do_list_queue + do_list_queue_start, @@ -411,15 +414,13 @@ static void adjust_do_list_queue(void) do_list_queue_end -= do_list_queue_start; do_list_queue_start = 0; } - } static void add_to_do_list_queue(const char* entry) { char *dlq; long new_end = do_list_queue_end + ((long)strlen(entry)) + 1; - while (new_end > do_list_queue_size) - { + while (new_end > do_list_queue_size) { do_list_queue_size *= 2; DEBUG(4,("enlarging do_list_queue to %d\n", (int)do_list_queue_size)); @@ -428,16 +429,13 @@ static void add_to_do_list_queue(const char* entry) d_printf("failure enlarging do_list_queue to %d bytes\n", (int)do_list_queue_size); reset_do_list_queue(); - } - else - { + } else { do_list_queue = dlq; memset(do_list_queue + do_list_queue_size / 2, 0, do_list_queue_size / 2); } } - if (do_list_queue) - { + if (do_list_queue) { safe_strcpy_base(do_list_queue + do_list_queue_end, entry, do_list_queue, do_list_queue_size); do_list_queue_end = new_end; @@ -453,8 +451,7 @@ static char *do_list_queue_head(void) static void remove_do_list_queue_head(void) { - if (do_list_queue_end > do_list_queue_start) - { + if (do_list_queue_end > do_list_queue_start) { do_list_queue_start += strlen(do_list_queue_head()) + 1; adjust_do_list_queue(); DEBUG(4,("removed head of do_list_queue (start=%d, end=%d)\n", @@ -468,8 +465,9 @@ static int do_list_queue_empty(void) } /**************************************************************************** -a helper for do_list - ****************************************************************************/ + A helper for do_list. +****************************************************************************/ + static void do_list_helper(file_info *f, const char *mask, void *state) { if (f->mode & aDIR) { @@ -489,7 +487,8 @@ static void do_list_helper(file_info *f, const char *mask, void *state) pstrcpy(mask2, mask); p = strrchr_m(mask2,'\\'); - if (!p) return; + if (!p) + return; p[1] = 0; pstrcat(mask2, f->name); pstrcat(mask2,"\\*"); @@ -503,16 +502,15 @@ static void do_list_helper(file_info *f, const char *mask, void *state) } } - /**************************************************************************** -a wrapper around cli_list that adds recursion - ****************************************************************************/ + A wrapper around cli_list that adds recursion. +****************************************************************************/ + void do_list(const char *mask,uint16 attribute,void (*fn)(file_info *),BOOL rec, BOOL dirs) { static int in_do_list = 0; - if (in_do_list && rec) - { + if (in_do_list && rec) { fprintf(stderr, "INTERNAL ERROR: do_list called recursively when the recursive flag is true\n"); exit(1); } @@ -523,13 +521,11 @@ void do_list(const char *mask,uint16 attribute,void (*fn)(file_info *),BOOL rec, do_list_dirs = dirs; do_list_fn = fn; - if (rec) - { + if (rec) { init_do_list_queue(); add_to_do_list_queue(mask); - while (! do_list_queue_empty()) - { + while (! do_list_queue_empty()) { /* * Need to copy head so that it doesn't become * invalid inside the call to cli_list. This @@ -541,30 +537,24 @@ void do_list(const char *mask,uint16 attribute,void (*fn)(file_info *),BOOL rec, pstrcpy(head, do_list_queue_head()); cli_list(cli, head, attribute, do_list_helper, NULL); remove_do_list_queue_head(); - if ((! do_list_queue_empty()) && (fn == display_finfo)) - { + if ((! do_list_queue_empty()) && (fn == display_finfo)) { char* next_file = do_list_queue_head(); char* save_ch = 0; if ((strlen(next_file) >= 2) && (next_file[strlen(next_file) - 1] == '*') && - (next_file[strlen(next_file) - 2] == '\\')) - { + (next_file[strlen(next_file) - 2] == '\\')) { save_ch = next_file + strlen(next_file) - 2; *save_ch = '\0'; } d_printf("\n%s\n",next_file); - if (save_ch) - { + if (save_ch) { *save_ch = '\\'; } } } - } - else - { - if (cli_list(cli, mask, attribute, do_list_helper, NULL) == -1) - { + } else { + if (cli_list(cli, mask, attribute, do_list_helper, NULL) == -1) { d_printf("%s listing %s\n", cli_errstr(cli), mask); } } @@ -574,8 +564,9 @@ void do_list(const char *mask,uint16 attribute,void (*fn)(file_info *),BOOL rec, } /**************************************************************************** - get a directory listing - ****************************************************************************/ + Get a directory listing. +****************************************************************************/ + static int cmd_dir(void) { uint16 attribute = aDIR | aSYSTEM | aHIDDEN; @@ -595,8 +586,7 @@ static int cmd_dir(void) pstrcpy(mask,p); else pstrcat(mask,p); - } - else { + } else { pstrcat(mask,"*"); } @@ -609,10 +599,10 @@ static int cmd_dir(void) return rc; } - /**************************************************************************** - get a directory listing - ****************************************************************************/ + Get a directory listing. +****************************************************************************/ + static int cmd_du(void) { uint16 attribute = aDIR | aSYSTEM | aHIDDEN; @@ -645,10 +635,10 @@ static int cmd_du(void) return rc; } - /**************************************************************************** - get a file from rname to lname - ****************************************************************************/ + Get a file from rname to lname +****************************************************************************/ + static int do_get(char *rname, char *lname, BOOL reget) { int handle = 0, fnum; @@ -718,7 +708,8 @@ static int do_get(char *rname, char *lname, BOOL reget) while (1) { int n = cli_read(cli, fnum, data, nread + start, read_size); - if (n <= 0) break; + if (n <= 0) + break; if (writefile(handle,data, n) != n) { d_printf("Error writing local file\n"); @@ -770,10 +761,10 @@ static int do_get(char *rname, char *lname, BOOL reget) return rc; } - /**************************************************************************** - get a file - ****************************************************************************/ + Get a file. +****************************************************************************/ + static int cmd_get(void) { pstring lname; @@ -797,10 +788,10 @@ static int cmd_get(void) return do_get(rname, lname, False); } - /**************************************************************************** - do a mget operation on one file - ****************************************************************************/ + Do an mget operation on one file. +****************************************************************************/ + static void do_mget(file_info *finfo) { pstring rname; @@ -823,7 +814,8 @@ static void do_mget(file_info *finfo) slprintf(quest,sizeof(pstring)-1, "Get file %s? ",finfo->name); - if (prompt && !yesno(quest)) return; + if (prompt && !yesno(quest)) + return; if (!(finfo->mode & aDIR)) { pstrcpy(rname,cur_dir); @@ -863,10 +855,10 @@ static void do_mget(file_info *finfo) pstrcpy(cur_dir,saved_curdir); } - /**************************************************************************** -view the file using the pager + View the file using the pager. ****************************************************************************/ + static int cmd_more(void) { fstring rname,lname,pager_cmd; @@ -904,11 +896,10 @@ static int cmd_more(void) return rc; } - - /**************************************************************************** -do a mget command + Do a mget command. ****************************************************************************/ + static int cmd_mget(void) { uint16 attribute = aSYSTEM | aHIDDEN; @@ -946,10 +937,10 @@ static int cmd_mget(void) return 0; } - /**************************************************************************** -make a directory of name "name" + Make a directory of name "name". ****************************************************************************/ + static BOOL do_mkdir(char *name) { if (!cli_mkdir(cli, name)) { @@ -962,8 +953,9 @@ static BOOL do_mkdir(char *name) } /**************************************************************************** -show 8.3 name of a file + Show 8.3 name of a file. ****************************************************************************/ + static BOOL do_altname(char *name) { fstring altname; @@ -977,10 +969,10 @@ static BOOL do_altname(char *name) return(True); } - /**************************************************************************** Exit client. ****************************************************************************/ + static int cmd_quit(void) { cli_shutdown(cli); @@ -989,10 +981,10 @@ static int cmd_quit(void) return 0; } - /**************************************************************************** - make a directory - ****************************************************************************/ + Make a directory. +****************************************************************************/ + static int cmd_mkdir(void) { pstring mask; @@ -1014,7 +1006,7 @@ static int cmd_mkdir(void) *ddir2 = 0; pstrcpy(ddir,mask); - trim_string(ddir,".",NULL); + trim_char(ddir,'.','\0'); p = strtok(ddir,"/\\"); while (p) { pstrcat(ddir2,p); @@ -1031,10 +1023,10 @@ static int cmd_mkdir(void) return 0; } - /**************************************************************************** - show alt name - ****************************************************************************/ + Show alt name. +****************************************************************************/ + static int cmd_altname(void) { pstring name; @@ -1054,10 +1046,10 @@ static int cmd_altname(void) return 0; } - /**************************************************************************** - put a single file - ****************************************************************************/ + Put a single file. +****************************************************************************/ + static int do_put(char *rname, char *lname, BOOL reput) { int fnum; @@ -1111,7 +1103,6 @@ static int do_put(char *rname, char *lname, BOOL reput) d_printf("Error opening local file %s\n",lname); return 1; } - DEBUG(1,("putting file %s as %s ",lname, rname)); @@ -1183,11 +1174,10 @@ static int do_put(char *rname, char *lname, BOOL reput) return rc; } - - /**************************************************************************** - put a file - ****************************************************************************/ + Put a file. +****************************************************************************/ + static int cmd_put(void) { pstring lname; @@ -1226,7 +1216,7 @@ static int cmd_put(void) } /************************************* - File list structure + File list structure. *************************************/ static struct file_list { @@ -1236,15 +1226,14 @@ static struct file_list { } *file_list; /**************************************************************************** - Free a file_list structure + Free a file_list structure. ****************************************************************************/ static void free_file_list (struct file_list * list) { struct file_list *tmp; - while (list) - { + while (list) { tmp = list; DLIST_REMOVE(list, list); SAFE_FREE(tmp->file_path); @@ -1253,9 +1242,10 @@ static void free_file_list (struct file_list * list) } /**************************************************************************** - seek in a directory/file list until you get something that doesn't start with - the specified name - ****************************************************************************/ + Seek in a directory/file list until you get something that doesn't start with + the specified name. +****************************************************************************/ + static BOOL seek_list(struct file_list *list, char *name) { while (list) { @@ -1270,8 +1260,9 @@ static BOOL seek_list(struct file_list *list, char *name) } /**************************************************************************** - set the file selection mask - ****************************************************************************/ + Set the file selection mask. +****************************************************************************/ + static int cmd_select(void) { pstrcpy(fileselection,""); @@ -1284,6 +1275,7 @@ static int cmd_select(void) Recursive file matching function act as find match must be always set to True when calling this function ****************************************************************************/ + static int file_find(struct file_list **list, const char *directory, const char *expression, BOOL match) { @@ -1296,11 +1288,14 @@ static int file_find(struct file_list **list, const char *directory, const char *dname; dir = opendir(directory); - if (!dir) return -1; + if (!dir) + return -1; while ((dname = readdirname(dir))) { - if (!strcmp("..", dname)) continue; - if (!strcmp(".", dname)) continue; + if (!strcmp("..", dname)) + continue; + if (!strcmp(".", dname)) + continue; if (asprintf(&path, "%s/%s", directory, dname) <= 0) { continue; @@ -1344,8 +1339,9 @@ static int file_find(struct file_list **list, const char *directory, } /**************************************************************************** - mput some files - ****************************************************************************/ + mput some files. +****************************************************************************/ + static int cmd_mput(void) { fstring buf; @@ -1425,10 +1421,10 @@ static int cmd_mput(void) return 0; } - /**************************************************************************** - cancel a print job - ****************************************************************************/ + Cancel a print job. +****************************************************************************/ + static int do_cancel(int job) { if (cli_printjob_del(cli, job)) { @@ -1440,10 +1436,10 @@ static int do_cancel(int job) } } - /**************************************************************************** - cancel a print job - ****************************************************************************/ + Cancel a print job. +****************************************************************************/ + static int cmd_cancel(void) { fstring buf; @@ -1461,10 +1457,10 @@ static int cmd_cancel(void) return 0; } - /**************************************************************************** - print a file - ****************************************************************************/ + Print a file. +****************************************************************************/ + static int cmd_print(void) { pstring lname; @@ -1489,18 +1485,19 @@ static int cmd_print(void) return do_put(rname, lname, False); } - /**************************************************************************** - show a print queue entry + Show a print queue entry. ****************************************************************************/ + static void queue_fn(struct print_job_info *p) { d_printf("%-6d %-9d %s\n", (int)p->id, (int)p->size, p->name); } /**************************************************************************** - show a print queue + Show a print queue. ****************************************************************************/ + static int cmd_queue(void) { cli_print_queue(cli, queue_fn); @@ -1509,8 +1506,9 @@ static int cmd_queue(void) } /**************************************************************************** -delete some files + Delete some files. ****************************************************************************/ + static void do_del(file_info *finfo) { pstring mask; @@ -1527,8 +1525,9 @@ static void do_del(file_info *finfo) } /**************************************************************************** -delete some files + Delete some files. ****************************************************************************/ + static int cmd_del(void) { pstring mask; @@ -1553,6 +1552,7 @@ static int cmd_del(void) /**************************************************************************** ****************************************************************************/ + static int cmd_open(void) { pstring mask; @@ -1573,8 +1573,9 @@ static int cmd_open(void) /**************************************************************************** -remove a directory + Remove a directory. ****************************************************************************/ + static int cmd_rmdir(void) { pstring mask; @@ -1739,8 +1740,9 @@ static int cmd_chown(void) } /**************************************************************************** -rename some files + Rename some file. ****************************************************************************/ + static int cmd_rename(void) { pstring src,dest; @@ -1766,10 +1768,10 @@ static int cmd_rename(void) return 0; } - /**************************************************************************** -toggle the prompt flag + Toggle the prompt flag. ****************************************************************************/ + static int cmd_prompt(void) { prompt = !prompt; @@ -1778,10 +1780,10 @@ static int cmd_prompt(void) return 1; } - /**************************************************************************** -set the newer than time + Set the newer than time. ****************************************************************************/ + static int cmd_newer(void) { fstring buf; @@ -1806,8 +1808,9 @@ static int cmd_newer(void) } /**************************************************************************** -set the archive level + Set the archive level. ****************************************************************************/ + static int cmd_archive(void) { fstring buf; @@ -1821,8 +1824,9 @@ static int cmd_archive(void) } /**************************************************************************** -toggle the lowercaseflag + Toggle the lowercaseflag. ****************************************************************************/ + static int cmd_lowercase(void) { lowercase = !lowercase; @@ -1831,12 +1835,10 @@ static int cmd_lowercase(void) return 0; } - - - /**************************************************************************** -toggle the recurse flag + Toggle the recurse flag. ****************************************************************************/ + static int cmd_recurse(void) { recurse = !recurse; @@ -1846,8 +1848,9 @@ static int cmd_recurse(void) } /**************************************************************************** -toggle the translate flag + Toggle the translate flag. ****************************************************************************/ + static int cmd_translate(void) { translation = !translation; @@ -1857,10 +1860,10 @@ static int cmd_translate(void) return 0; } - /**************************************************************************** -do a printmode command + Do a printmode command. ****************************************************************************/ + static int cmd_printmode(void) { fstring buf; @@ -1877,8 +1880,7 @@ static int cmd_printmode(void) } } - switch(printmode) - { + switch(printmode) { case 0: fstrcpy(mode,"text"); break; @@ -1888,7 +1890,7 @@ static int cmd_printmode(void) default: slprintf(mode,sizeof(mode)-1,"%d",printmode); break; - } + } DEBUG(2,("the printmode is now %s\n",mode)); @@ -1896,8 +1898,9 @@ static int cmd_printmode(void) } /**************************************************************************** - do the lcd command + Do the lcd command. ****************************************************************************/ + static int cmd_lcd(void) { fstring buf; @@ -1911,8 +1914,9 @@ static int cmd_lcd(void) } /**************************************************************************** - get a file restarting at end of local file + Get a file restarting at end of local file. ****************************************************************************/ + static int cmd_reget(void) { pstring local_name; @@ -1937,8 +1941,9 @@ static int cmd_reget(void) } /**************************************************************************** - put a file restarting at end of local file + Put a file restarting at end of local file. ****************************************************************************/ + static int cmd_reput(void) { pstring local_name; @@ -1971,10 +1976,10 @@ static int cmd_reput(void) return do_put(remote_name, local_name, True); } - /**************************************************************************** - list a share name + List a share name. ****************************************************************************/ + static void browse_fn(const char *name, uint32 m, const char *comment, void *state) { @@ -2000,10 +2005,10 @@ static void browse_fn(const char *name, uint32 m, name,typestr,comment); } - /**************************************************************************** -try and browse available connections on a host + Try and browse available connections on a host. ****************************************************************************/ + static BOOL browse_host(BOOL sort) { int ret; @@ -2018,8 +2023,9 @@ static BOOL browse_host(BOOL sort) } /**************************************************************************** -list a server name + List a server name. ****************************************************************************/ + static void server_fn(const char *name, uint32 m, const char *comment, void *state) { @@ -2027,11 +2033,13 @@ static void server_fn(const char *name, uint32 m, } /**************************************************************************** -try and browse available connections on a host + Try and browse available connections on a host. ****************************************************************************/ + static BOOL list_servers(char *wk_grp) { - if (!cli->server_domain) return False; + if (!cli->server_domain) + return False; d_printf("\n\tServer Comment\n"); d_printf("\t--------- -------\n"); @@ -2062,8 +2070,7 @@ static struct int (*fn)(void); const char *description; char compl_args[2]; /* Completion argument info */ -} commands[] = -{ +} commands[] = { {"?",cmd_help,"[command] give help on a command",{COMPL_NONE,COMPL_NONE}}, {"altname",cmd_altname," show alt name",{COMPL_NONE,COMPL_NONE}}, {"archive",cmd_archive,"\n0=ignore archive bit\n1=only get archive files\n2=only get archive files and reset archive bit\n3=get all files and reset archive bit",{COMPL_NONE,COMPL_NONE}}, @@ -2117,11 +2124,11 @@ static struct {NULL,NULL,NULL,{COMPL_NONE,COMPL_NONE}} }; - /******************************************************************* - lookup a command string in the list of commands, including - abbreviations - ******************************************************************/ + Lookup a command string in the list of commands, including + abbreviations. +******************************************************************/ + static int process_tok(fstring tok) { int i = 0, matches = 0; @@ -2149,8 +2156,9 @@ static int process_tok(fstring tok) } /**************************************************************************** -help + Help. ****************************************************************************/ + static int cmd_help(void) { int i=0,j; @@ -2172,8 +2180,9 @@ static int cmd_help(void) } /**************************************************************************** -process a -c command string + Process a -c command string. ****************************************************************************/ + static int process_command_string(char *cmd) { pstring line; @@ -2198,7 +2207,8 @@ static int process_command_string(char *cmd) line[1000] = '\0'; cmd += strlen(cmd); } else { - if (p - cmd > 999) p = cmd + 999; + if (p - cmd > 999) + p = cmd + 999; strncpy(line, cmd, p - cmd); line[p - cmd] = '\0'; cmd = p + 1; @@ -2403,8 +2413,9 @@ cleanup: } /**************************************************************************** -make sure we swallow keepalives during idle time + Make sure we swallow keepalives during idle time. ****************************************************************************/ + static void readline_callback(void) { fd_set fds; @@ -2414,7 +2425,8 @@ static void readline_callback(void) t = time(NULL); - if (t - last_t < 5) return; + if (t - last_t < 5) + return; last_t = t; @@ -2442,10 +2454,10 @@ static void readline_callback(void) cli_chkpath(cli, "\\"); } - /**************************************************************************** -process commands on stdin + Process commands on stdin. ****************************************************************************/ + static void process_stdin(void) { const char *ptr; @@ -2485,10 +2497,10 @@ static void process_stdin(void) } } - /***************************************************** -return a connection to a server + Return a connection to a server. *******************************************************/ + static struct cli_state *do_connect(const char *server, const char *share) { struct cli_state *c; @@ -2560,6 +2572,7 @@ static struct cli_state *do_connect(const char *server, const char *share) char *pass = getpass("Password: "); if (pass) { pstrcpy(password, pass); + got_pass = 1; } } @@ -2602,10 +2615,10 @@ static struct cli_state *do_connect(const char *server, const char *share) return c; } - /**************************************************************************** - process commands from the client + Process commands from the client. ****************************************************************************/ + static int process(char *base_directory) { int rc = 0; @@ -2628,8 +2641,9 @@ static int process(char *base_directory) } /**************************************************************************** -handle a -L query + Handle a -L query. ****************************************************************************/ + static int do_host_query(char *query_host) { cli = do_connect(query_host, "IPC$"); @@ -2637,6 +2651,22 @@ static int do_host_query(char *query_host) return 1; browse_host(True); + + if (port != 139) { + + /* Workgroups simply don't make sense over anything + else but port 139... */ + + cli_shutdown(cli); + port = 139; + cli = do_connect(query_host, "IPC$"); + } + + if (cli == NULL) { + d_printf("NetBIOS over TCP disabled -- no workgroup available\n"); + return 1; + } + list_servers(lp_workgroup()); cli_shutdown(cli); @@ -2646,8 +2676,9 @@ static int do_host_query(char *query_host) /**************************************************************************** -handle a tar operation + Handle a tar operation. ****************************************************************************/ + static int do_tar_op(char *base_directory) { int ret; @@ -2671,8 +2702,9 @@ static int do_tar_op(char *base_directory) } /**************************************************************************** -handle a message operation + Handle a message operation. ****************************************************************************/ + static int do_message_op(void) { struct in_addr ip; @@ -2715,6 +2747,7 @@ static int do_message_op(void) * We don't actually do anything yet -- we just stash the name in a * global variable and do the query when all options have been read. **/ + static void remember_query_host(const char *arg, pstring query_host) { @@ -2729,12 +2762,13 @@ static void remember_query_host(const char *arg, } } - /**************************************************************************** main program ****************************************************************************/ + int main(int argc,char *argv[]) { + extern BOOL AllowDebugChange; fstring base_directory; int opt; pstring query_host; @@ -2745,6 +2779,7 @@ static void remember_query_host(const char *arg, poptContext pc; char *p; int rc = 0; + fstring new_workgroup; struct poptOption long_options[] = { POPT_AUTOHELP @@ -2775,14 +2810,17 @@ static void remember_query_host(const char *arg, *query_host = 0; *base_directory = 0; + + /* initialize the workgroup name so we can determine whether or + not it was set by a command line option */ + + set_global_myworkgroup( "" ); - setup_logging(argv[0],True); + /* set default debug level to 0 regardless of what smb.conf sets */ + DEBUGLEVEL_CLASS[DBGC_ALL] = 0; + dbf = x_stderr; + x_setbuf( x_stderr, NULL ); - if (!lp_load(dyn_CONFIGFILE,True,False,False)) { - fprintf(stderr, "%s: Can't load %s - run testparm to debug it\n", - argv[0], dyn_CONFIGFILE); - } - pc = poptGetContext("smbclient", argc, (const char **) argv, long_options, POPT_CONTEXT_KEEP_FIRST); poptSetOtherOptionHelp(pc, "service "); @@ -2798,7 +2836,8 @@ static void remember_query_host(const char *arg, */ name_type = 0x03; pstrcpy(desthost,poptGetOptArg(pc)); - if( 0 == port ) port = 139; + if( 0 == port ) + port = 139; message = True; break; case 'I': @@ -2853,7 +2892,29 @@ static void remember_query_host(const char *arg, poptGetArg(pc); + /* + * Don't load debug level from smb.conf. It should be + * set by cmdline arg or remain default (0) + */ + AllowDebugChange = False; + + /* save the workgroup... + + FIXME!! do we need to do tyhis for other options as well + (or maybe a generic way to keep lp_load() from overwriting + everything)? */ + + fstrcpy( new_workgroup, lp_workgroup() ); + + if (!lp_load(dyn_CONFIGFILE,True,False,False)) { + fprintf(stderr, "%s: Can't load %s - run testparm to debug it\n", + argv[0], dyn_CONFIGFILE); + } + load_interfaces(); + + if ( strlen(new_workgroup) != 0 ) + set_global_myworkgroup( new_workgroup ); if(poptPeekArg(pc)) { pstrcpy(service,poptGetArg(pc)); @@ -2890,7 +2951,7 @@ static void remember_query_host(const char *arg, use_kerberos = cmdline_auth_info.use_kerberos; got_pass = cmdline_auth_info.got_pass; - DEBUG( 3, ( "Client started (version %s).\n", VERSION ) ); + DEBUG(3,("Client started (version %s).\n", SAMBA_VERSION_STRING)); if (tar_type) { if (cmdstr) diff --git a/source3/client/clitar.c b/source3/client/clitar.c index 5295de8010..b01de5b8e7 100644 --- a/source3/client/clitar.c +++ b/source3/client/clitar.c @@ -122,7 +122,7 @@ static void writetarheader(int f, const char *aname, SMB_BIG_UINT size, time_t static void do_atar(char *rname,char *lname,file_info *finfo1); static void do_tar(file_info *finfo); static void oct_it(SMB_BIG_UINT value, int ndgs, char *p); -static void fixtarname(char *tptr, const char *fp, int l); +static void fixtarname(char *tptr, const char *fp, size_t l); static int dotarbuf(int f, char *b, int n); static void dozerobuf(int f, int n); static void dotareof(int f); @@ -171,7 +171,10 @@ static void writetarheader(int f, const char *aname, SMB_BIG_UINT size, time_t m memset(hb.dummy, 0, sizeof(hb.dummy)); l=strlen(aname); - if (l >= NAMSIZ - 1) { + /* We will be prepending a '.' in fixtarheader so use +2 to + * take care of the . and terminating zero. JRA. + */ + if (l+2 >= NAMSIZ) { /* write a GNU tar style long header */ char *b; b = (char *)malloc(l+TBLOCK+100); @@ -181,15 +184,14 @@ static void writetarheader(int f, const char *aname, SMB_BIG_UINT size, time_t m } writetarheader(f, "/./@LongLink", l+2, 0, " 0 \0", 'L'); memset(b, 0, l+TBLOCK+100); - fixtarname(b, aname, l); + fixtarname(b, aname, l+2); i = strlen(b)+1; DEBUG(5, ("File name in tar file: %s, size=%d, \n", b, (int)strlen(b))); dotarbuf(f, b, TBLOCK*(((i-1)/TBLOCK)+1)); SAFE_FREE(b); } - /* use l + 1 to do the null too */ - fixtarname(hb.dbuf.name, aname, (l >= NAMSIZ) ? NAMSIZ : l + 1); + fixtarname(hb.dbuf.name, aname, (l+2 >= NAMSIZ) ? NAMSIZ : l + 2); if (lowercase) strlower_m(hb.dbuf.name); @@ -419,13 +421,14 @@ static void dotareof(int f) (Un)mangle DOS pathname, make nonabsolute ****************************************************************************/ -static void fixtarname(char *tptr, const char *fp, int l) +static void fixtarname(char *tptr, const char *fp, size_t l) { /* add a '.' to start of file name, convert from ugly dos \'s in path * to lovely unix /'s :-} */ *tptr++='.'; + l--; - safe_strcpy(tptr, fp, l); + StrnCpy(tptr, fp, l-1); string_replace(tptr, '\\', '/'); } @@ -1477,7 +1480,7 @@ accordingly. static int read_inclusion_file(char *filename) { XFILE *inclusion = NULL; - char buf[MAXPATHLEN + 1]; + char buf[PATH_MAX + 1]; char *inclusion_buffer = NULL; int inclusion_buffer_size = 0; int inclusion_buffer_sofar = 0; @@ -1487,7 +1490,7 @@ static int read_inclusion_file(char *filename) int error = 0; clipn = 0; - buf[MAXPATHLEN] = '\0'; /* guarantee null-termination */ + buf[PATH_MAX] = '\0'; /* guarantee null-termination */ if ((inclusion = x_fopen(filename, O_RDONLY, 0)) == NULL) { /* XXX It would be better to include a reason for failure, but without * autoconf, it's hard to use strerror, sys_errlist, etc. @@ -1583,7 +1586,7 @@ static int read_inclusion_file(char *filename) Parse tar arguments. Sets tar_type, tar_excl, etc. ***************************************************************************/ -int tar_parseargs(int argc, char *argv[], char *Optarg, int Optind) +int tar_parseargs(int argc, char *argv[], const char *Optarg, int Optind) { int newOptind = Optind; char tar_clipfl='\0'; @@ -1775,6 +1778,10 @@ int tar_parseargs(int argc, char *argv[], char *Optarg, int Optind) if (tarhandle == 1) { dbf = x_stderr; } + if (!argv[Optind]) { + DEBUG(0,("Must specify tar filename\n")); + return 0; + } if (!strcmp(argv[Optind], "-")) { newOptind++; } diff --git a/source3/client/mount.cifs.c b/source3/client/mount.cifs.c index 9592dbdf96..7ab17a2b02 100755 --- a/source3/client/mount.cifs.c +++ b/source3/client/mount.cifs.c @@ -32,6 +32,15 @@ static char * user_name = NULL; char * mountpassword = NULL; +/* BB finish BB + + cifs_umount + open nofollow - avoid symlink exposure? + get owner of dir see if matches self or if root + call system(umount argv) etc. + +BB end finish BB */ + void mount_cifs_usage() { printf("\nUsage: %s remotetarget dir\n", thisprogram); @@ -155,17 +164,36 @@ int parse_options(char * options) if (value && *value) { got_gid = 1; } - } /* else if (strnicmp(data, "file_mode", 4) == 0) { - if (value && *value) { - vol->file_mode = - simple_strtoul(value, &value, 0); + /* fmask and dmask synonyms for people used to smbfs syntax */ + } else if (strcmp(data, "file_mode") == 0 || strcmp(data, "fmask")==0) { + if (!value || !*value) { + printf ("Option '%s' requires a numerical argument\n", data); + return 1; } - } else if (strnicmp(data, "dir_mode", 3) == 0) { - if (value && *value) { - vol->dir_mode = - simple_strtoul(value, &value, 0); + + if (value[0] != '0') { + printf ("WARNING: '%s' not expressed in octal.\n", data); } - } else if (strnicmp(data, "port", 4) == 0) { + + if (strcmp (data, "fmask") == 0) { + printf ("WARNING: CIFS mount option 'fmask' is deprecated. Use 'file_mode' instead.\n"); + data = "file_mode"; + } + } else if (strcmp(data, "dir_mode") == 0 || strcmp(data, "dmask")==0) { + if (!value || !*value) { + printf ("Option '%s' requires a numerical argument\n", data); + return 1; + } + + if (value[0] != '0') { + printf ("WARNING: '%s' not expressed in octal.\n", data); + } + + if (strcmp (data, "dmask") == 0) { + printf ("WARNING: CIFS mount option 'dmask' is deprecated. Use 'dir_mode' instead.\n"); + data = "dir_mode"; + } + } /* else if (strnicmp(data, "port", 4) == 0) { if (value && *value) { vol->port = simple_strtoul(value, &value, 0); @@ -446,18 +474,28 @@ int main(int argc, char ** argv) /* canonicalize the path in argv[1]? */ + /* BB save off path and pop after mount returns */ + if(chdir(mountpoint)) { + printf("mount error: can not change directory into mount target %s\n",mountpoint); + } + if(stat (mountpoint, &statbuf)) { printf("mount error: mount point %s does not exist\n",mountpoint); return -1; } + if (S_ISDIR(statbuf.st_mode) == 0) { printf("mount error: mount point %s is not a directory\n",mountpoint); return -1; } - if(geteuid()) { - printf("mount error: permission denied, not superuser and cifs.mount not installed SUID\n"); - return -1; + if((getuid() != 0) && (geteuid() == 0)) { + if((statbuf.st_uid == getuid()) && (S_IRWXU == statbuf.st_mode & S_IRWXU)) { + printf("setuid mount allowed\n"); + } else { + printf("mount error: permission denied, not superuser and cifs.mount not installed SUID\n"); + return -1; + } } ipaddr = parse_server(share_name); diff --git a/source3/client/smbmnt.c b/source3/client/smbmnt.c index ce406179cf..c04be3b7af 100644 --- a/source3/client/smbmnt.c +++ b/source3/client/smbmnt.c @@ -38,7 +38,7 @@ help(void) { printf("\n"); printf("Usage: smbmnt mount-point [options]\n"); - printf("Version %s\n\n",VERSION); + printf("Version %s\n\n",SAMBA_VERSION_STRING); printf("-s share share name on server\n" "-r mount read-only\n" "-u uid mount as uid\n" @@ -94,9 +94,9 @@ parse_args(int argc, char *argv[], struct smb_mount_data *data, char **share) static char * fullpath(const char *p) { - char path[MAXPATHLEN]; + char path[PATH_MAX+1]; - if (strlen(p) > MAXPATHLEN-1) { + if (strlen(p) > PATH_MAX) { return NULL; } diff --git a/source3/client/smbmount.c b/source3/client/smbmount.c index 343d4f2675..6e8d9f5bca 100644 --- a/source3/client/smbmount.c +++ b/source3/client/smbmount.c @@ -428,7 +428,7 @@ static void send_fs_socket(char *the_service, char *mount_point, struct cli_stat **/ static void init_mount(void) { - char mount_point[MAXPATHLEN+1]; + char mount_point[PATH_MAX+1]; pstring tmp; pstring svc2; struct cli_state *c; @@ -663,7 +663,7 @@ static void usage(void) { printf("Usage: mount.smbfs service mountpoint [-o options,...]\n"); - printf("Version %s\n\n",VERSION); + printf("Version %s\n\n",SAMBA_VERSION_STRING); printf( "Options:\n\ @@ -923,7 +923,7 @@ static void parse_mount_smb(int argc, char **argv) read_credentials_file(credentials); } - DEBUG(3,("mount.smbfs started (version %s)\n", VERSION)); + DEBUG(3,("mount.smbfs started (version %s)\n", SAMBA_VERSION_STRING)); if (*workgroup == 0) { pstrcpy(workgroup,lp_workgroup()); diff --git a/source3/configure.in b/source3/configure.in index f964bc719f..a2e04b5d48 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -145,14 +145,15 @@ AC_SUBST(PICFLAG) AC_SUBST(PICSUFFIX) AC_SUBST(POBAD_CC) AC_SUBST(SHLIBEXT) +AC_SUBST(INSTALLCLIENT) AC_SUBST(INSTALLCLIENTCMD_SH) AC_SUBST(INSTALLCLIENTCMD_A) AC_SUBST(LIBSMBCLIENT_SHARED) AC_SUBST(LIBSMBCLIENT) -AC_SUBST(PRINTLIBS) -AC_SUBST(AUTHLIBS) -AC_SUBST(ACLLIBS) -AC_SUBST(PASSDBLIBS) +AC_SUBST(PRINT_LIBS) +AC_SUBST(AUTH_LIBS) +AC_SUBST(ACL_LIBS) +AC_SUBST(PASSDB_LIBS) AC_SUBST(IDMAP_LIBS) AC_SUBST(KRB5_LIBS) AC_SUBST(LDAP_LIBS) @@ -284,10 +285,10 @@ DYNEXP= dnl Add modules that have to be built by default here dnl These have to be built static: -default_static_modules="pdb_smbpasswd pdb_tdbsam rpc_lsa rpc_samr rpc_reg rpc_wks rpc_net rpc_dfs rpc_srv rpc_spoolss auth_rhosts auth_sam auth_unix auth_winbind auth_server auth_domain auth_builtin" +default_static_modules="pdb_smbpasswd pdb_tdbsam rpc_lsa rpc_samr rpc_reg rpc_lsa_ds rpc_wks rpc_net rpc_dfs rpc_srv rpc_spoolss auth_rhosts auth_sam auth_unix auth_winbind auth_server auth_domain auth_builtin" dnl These are preferably build shared, and static if dlopen() is not available -default_shared_modules="vfs_recycle vfs_audit vfs_extd_audit vfs_netatalk vfs_fake_perms vfs_default_quota" +default_shared_modules="vfs_recycle vfs_audit vfs_extd_audit vfs_netatalk vfs_fake_perms vfs_default_quota vfs_readonly vfs_cap charset_CP850 charset_CP437" if test "x$developer" = xyes; then default_static_modules="$default_static_modules rpc_echo" @@ -358,8 +359,11 @@ case "$host_os" in # recommendations on large file support, however it makes the # compile work using gcc 2.7 and 2.8, whereas using the Sun # recommendation makes the compile fail on gcc2.7. JRA. +# +# Solaris uses SYSV printing. Make sure to set that here. --jerry # *solaris*) + AC_DEFINE(SYSV, 1, [Whether to enable System V compatibility]) case `uname -r` in 5.0*|5.1*|5.2*|5.3*|5.5*) AC_MSG_RESULT([no large file support]) @@ -390,6 +394,16 @@ case "$host_os" in esac ;; # +# IRIX uses SYSV printing. Make sure to set that here +# + *irix*) + AC_DEFINE(SYSV, 1, [Whether to enable System V compatibility]) + ;; + *freebsd*) + AC_DEFINE(FREEBSD, 1, [Whether the host os is FreeBSD]) + ;; + +# # VOS may need to have POSIX support and System V compatibility enabled. # *vos*) @@ -407,7 +421,7 @@ case "$host_os" in *) CPPFLAGS="$CPPFLAGS -D_SYSV" AC_DEFINE(_SYSV, 1, [Whether to enable System V compatibility]) - esac + esac ;; # # Tests needed for SINIX large file support. @@ -591,7 +605,7 @@ if test x$enable_cups != xno; then AC_DEFINE(HAVE_CUPS,1,[Whether we have CUPS]) CFLAGS="$CFLAGS `$CUPS_CONFIG --cflags`" LDFLAGS="$LDFLAGS `$CUPS_CONFIG --ldflags`" - PRINTLIBS="$PRINTLIBS `$CUPS_CONFIG --libs`" + PRINT_LIBS="$PRINT_LIBS `$CUPS_CONFIG --libs`" fi fi @@ -1090,6 +1104,8 @@ if test "$enable_shared" = "yes"; then LDSHFLAGS="-B symbolic -b -z" SONAMEFLAG="+h " PICFLAG="+z" + elif test "${GCC}" = "yes"; then + PICFLAG="-fPIC" fi DYNEXP="-Wl,-E" AC_DEFINE(STAT_ST_BLOCKSIZE,8192,[The size of a block]) @@ -1533,7 +1549,8 @@ AC_ARG_WITH(libiconv, AC_MSG_ERROR(I won't take no for an answer) else if test "$withval" != "yes" ; then - LOOK_DIRS="$withval $LOOK_DIRS" + ICONV_PATH_SPEC=yes + LOOK_DIRS="$withval" fi fi ]) @@ -1543,51 +1560,108 @@ for i in $LOOK_DIRS ; do save_LIBS=$LIBS save_LDFLAGS=$LDFLAGS save_CPPFLAGS=$CPPFLAGS - CPPFLAGS="-I$i/include" - LDFLAGS="-L$i/lib" + CPPFLAGS="$CPPFLAGS -I$i/include" +dnl This is here to handle -withval stuff for --with-libiconv + if test x"$ICONV_PATH_SPEC" = "xyes" ; then + LDFLAGS="-L$i/lib" + fi LIBS= export LDFLAGS LIBS CPPFLAGS dnl Try to find iconv(3) jm_ICONV($i) - CPPFLAGS=$save_CPPFLAGS if test "$ICONV_FOUND" = yes; then - LDFLAGS=$save_LDFLAGS LIB_ADD_DIR(LDFLAGS, "$i/lib") CFLAGS_ADD_DIR(CPPFLAGS, "$i/include") LIBS="$save_LIBS $LIBS" ICONV_LOCATION=$i export LDFLAGS LIBS CPPFLAGS - break - else - LDFLAGS=$save_LDFLAGS - LIBS=$save_LIBS - export LDFLAGS LIBS CPPFLAGS +dnl Now, check for a working iconv ... we want to do it here because +dnl there might be a working iconv further down the list of LOOK_DIRS + + ############ + # check for iconv in libc + ic_save_LIBS="$LIBS" + if test x"$ICONV_PATH_SPEC" = "xyes" ; then + LIBS="$LIBS -L$ICONV_LOCATION/lib" + fi +dnl AC_CACHE_CHECK([for working iconv],samba_cv_HAVE_NATIVE_ICONV,[ + default_dos_charset=no + default_display_charset=no + default_unix_charset=no + echo + + # check for default dos charset name + for j in CP850 IBM850 ; do + rjs_CHARSET($j) + if test x"$ICONV_CHARSET" = x"$j"; then + default_dos_charset="\"$j\"" + break + fi + done + # check for default display charset name + for j in ASCII 646 ; do + rjs_CHARSET($j) + if test x"$ICONV_CHARSET" = x"$j"; then + default_display_charset="\"$j\"" + break + fi + done + # check for default unix charset name + for j in UTF-8 UTF8 ; do + rjs_CHARSET($j) + if test x"$ICONV_CHARSET" = x"$j"; then + default_unix_charset="\"$j\"" + break + fi + done + + if test "$default_dos_charset" != "no" -a \ + "$default_dos_charset" != "cross" -a \ + "$default_display_charset" != "no" -a \ + "$default_display_charset" != "cross" -a \ + "$default_unix_charset" != "no" -a \ + "$default_unix_charset" != "cross" + then + samba_cv_HAVE_NATIVE_ICONV=yes + else if test "$default_dos_charset" = "cross" -o \ + "$default_display_charset" = "cross" -o \ + "$default_unix_charset" = "cross" + then + samba_cv_HAVE_NATIVE_ICONV=cross + else + samba_cv_HAVE_NATIVE_ICONV=no + fi + fi +dnl ]) + + LIBS="$ic_save_LIBS" + if test x"$samba_cv_HAVE_NATIVE_ICONV" = x"yes"; then + CPPFLAGS=$save_CPPFLAGS + CFLAGS_ADD_DIR(CPPFLAGS, "$i/include") + export CPPFLAGS + AC_DEFINE(HAVE_NATIVE_ICONV,1,[Whether to use native iconv]) + AC_DEFINE_UNQUOTED(DEFAULT_DOS_CHARSET,$default_dos_charset,[Default dos charset name]) + AC_DEFINE_UNQUOTED(DEFAULT_DISPLAY_CHARSET,$default_display_charset,[Default display charset name]) + AC_DEFINE_UNQUOTED(DEFAULT_UNIX_CHARSET,$default_unix_charset,[Default unix charset name]) + break + fi +dnl We didn't find a working iconv, so keep going fi +dnl We only need to clean these up here for the next pass through the loop + CPPFLAGS=$save_CPPFLAGS + LDFLAGS=$save_LDFLAGS + LIBS=$save_LIBS + export LDFLAGS LIBS CPPFLAGS done -############ -# check for iconv in libc -ic_save_LIBS="$LIBS" -LIBS="$LIBS -L$ICONV_LOCATION/lib" -AC_CACHE_CHECK([for working iconv],samba_cv_HAVE_NATIVE_ICONV,[ -AC_TRY_RUN([ -#include <$jm_cv_include> -main() { - iconv_t cd = iconv_open("ASCII", "UCS-2LE"); - if (cd == 0 || cd == (iconv_t)-1) return -1; - return 0; -} -], -samba_cv_HAVE_NATIVE_ICONV=yes,samba_cv_HAVE_NATIVE_ICONV=no,samba_cv_HAVE_NATIVE_ICONV=cross)]) -if test x"$samba_cv_HAVE_NATIVE_ICONV" = x"yes"; then - AC_DEFINE(HAVE_NATIVE_ICONV,1,[Whether to use native iconv]) -fi -LIBS="$ic_save_LIBS" if test x"$ICONV_FOUND" = x"no" -o x"$samba_cv_HAVE_NATIVE_ICONV" != x"yes" ; then AC_MSG_WARN([Sufficient support for iconv function was not found. Install libiconv from http://freshmeat.net/projects/libiconv/ for better charset compatibility!]) + AC_DEFINE_UNQUOTED(DEFAULT_DOS_CHARSET,"CP850",[Default dos charset name]) + AC_DEFINE_UNQUOTED(DEFAULT_DISPLAY_CHARSET,"ASCII",[Default display charset name]) + AC_DEFINE_UNQUOTED(DEFAULT_UNIX_CHARSET,"UTF8",[Default unix charset name]) fi @@ -2109,6 +2183,22 @@ AC_ARG_WITH(afs, AC_MSG_RESULT(no) ) +#################################################### +# check for Linux-specific AFS fake-kaserver support +AC_MSG_CHECKING(whether to use AFS fake-kaserver) +AC_ARG_WITH(fake-kaserver, +[ --with-fake-kaserver Include AFS fake-kaserver support (default=no) ], +[ case "$withval" in + yes) + AC_MSG_RESULT(yes) + AC_DEFINE(WITH_FAKE_KASERVER,1,[Whether to include AFS fake-kaserver support]) + ;; + *) + AC_MSG_RESULT(no) + ;; + esac ], + AC_MSG_RESULT(no) +) ################################################# # check for the DFS clear-text auth system @@ -2471,12 +2561,32 @@ if test x"$with_ads_support" != x"no"; then [krb5_enctype enctype; enctype = ENCTYPE_ARCFOUR_HMAC_MD5;], samba_cv_HAVE_ENCTYPE_ARCFOUR_HMAC_MD5=yes, samba_cv_HAVE_ENCTYPE_ARCFOUR_HMAC_MD5=no)]) - - if test x"$samba_cv_HAVE_ENCTYPE_ARCFOUR_HMAC_MD5" = x"yes"; then + AC_CACHE_CHECK([for KEYTYPE_ARCFOUR_56], + samba_cv_HAVE_KEYTYPE_ARCFOUR_56,[ + AC_TRY_COMPILE([#include ], + [krb5_keytype keytype; keytype = KEYTYPE_ARCFOUR_56;], + samba_cv_HAVE_KEYTYPE_ARCFOUR_56=yes, + samba_cv_HAVE_KEYTYPE_ARCFOUR_56=no)]) +# Heimdals with KEYTYPE_ARCFOUR but not KEYTYPE_ARCFOUR_56 are broken +# w.r.t. arcfour and windows, so we must not enable it here + if test x"$samba_cv_HAVE_ENCTYPE_ARCFOUR_HMAC_MD5" = x"yes" -a\ + x"$samba_cv_HAVE_KEYTYPE_ARCFOUR_56" = x"yes"; then AC_DEFINE(HAVE_ENCTYPE_ARCFOUR_HMAC_MD5,1, [Whether the ENCTYPE_ARCFOUR_HMAC_MD5 key type is available]) fi + AC_CACHE_CHECK([for AP_OPTS_USE_SUBKEY], + samba_cv_HAVE_AP_OPTS_USE_SUBKEY,[ + AC_TRY_COMPILE([#include ], + [krb5_flags ap_options; ap_options = AP_OPTS_USE_SUBKEY;], + samba_cv_HAVE_AP_OPTS_USE_SUBKEY=yes, + samba_cv_HAVE_AP_OPTS_USE_SUBKEY=no)]) + + if test x"$samba_cv_HAVE_AP_OPTS_USE_SUBKEY" = x"yes"; then + AC_DEFINE(HAVE_AP_OPTS_USE_SUBKEY,1, + [Whether the AP_OPTS_USE_SUBKEY ap option is available]) + fi + AC_CACHE_CHECK([for the krb5_princ_component macro], samba_cv_HAVE_KRB5_PRINC_COMPONENT,[ AC_TRY_LINK([#include ], @@ -2489,6 +2599,28 @@ if test x"$with_ads_support" != x"no"; then [Whether krb5_princ_component is available]) fi + AC_CACHE_CHECK([for memory keytab support], + samba_cv_HAVE_MEMORY_KEYTAB,[ + AC_TRY_RUN([ +#include + main() + { + krb5_context context; + krb5_keytab keytab; + + krb5_init_context(&context); + if (krb5_kt_resolve(context, "MEMORY:", &keytab)) + exit(0); + exit(1); + }], + samba_cv_HAVE_MEMORY_KEYTAB=no, + samba_cv_HAVE_MEMORY_KEYTAB=yes)]) + + if test x"$samba_cv_HAVE_MEMORY_KEYTAB" = x"yes"; then + AC_DEFINE(HAVE_MEMORY_KEYTAB,1, + [Whether in-memory keytabs are supported]) + fi + if test x"$ac_cv_lib_ext_krb5_krb5_mk_req_extended" = x"yes"; then AC_DEFINE(HAVE_KRB5,1,[Whether to have KRB5 support]) @@ -2530,7 +2662,7 @@ AC_ARG_WITH(expsam, ;; mysql) ## pdb_mysql - AM_PATH_MYSQL([0.11.0],[default_shared_modules="$default_shared_modules pdb_mysql"],[]) + AM_PATH_MYSQL([default_shared_modules="$default_shared_modules pdb_mysql"],[]) CFLAGS="$CFLAGS $MYSQL_CFLAGS" ;; no) @@ -2596,8 +2728,15 @@ AC_ARG_WITH(pam, [ case "$withval" in yes) AC_MSG_RESULT(yes) + if test x"$ac_cv_header_security_pam_appl_h" = x"no"; then + if test x"$ac_cv_header_security_pam_modules_h" = x"no"; then + if test x"$ac_cv_header_security__pam_macros_h" = x"no"; then + AC_MSG_ERROR(--with-pam specified but no PAM headers found) + fi + fi + fi AC_DEFINE(WITH_PAM,1,[Whether to include PAM support]) - AUTHLIBS="$AUTHLIBS -lpam" + AUTH_LIBS="$AUTH_LIBS -lpam" with_pam_for_crypt=yes ;; *) @@ -2619,13 +2758,16 @@ AC_ARG_WITH(pam_smbpass, yes) AC_MSG_RESULT(yes) -# Conditions under which pam_smbpass should not be built. + # Conditions under which pam_smbpass should not be built. if test x$PICFLAG = x; then - AC_MSG_RESULT([No support for PIC code - disabling pam_smbpass]) + AC_MSG_ERROR([No support for PIC code]) + elif test x"$ac_cv_header_security_pam_appl_h" = x"no"; then + AC_MSG_ERROR([No security/pam_appl.h found]) elif test x$ac_cv_lib_pam_pam_get_data = xno; then - AC_MSG_RESULT([No libpam found -- disabling pam_smbpass]) + AC_MSG_ERROR([No libpam found]) else + AUTH_LIBS="$AUTH_LIBS -lpam" SHLIB_PROGS="$SHLIB_PROGS bin/pam_smbpass.$SHLIBEXT" fi ;; @@ -2640,7 +2782,7 @@ AC_ARG_WITH(pam_smbpass, ############################################### # test for where we get crypt() from AC_SEARCH_LIBS(crypt, [crypt], - [test "$ac_cv_search_crypt" = "none required" || AUTHLIBS="-lcrypt $AUTHLIBS" + [test "$ac_cv_search_crypt" = "none required" || AUTH_LIBS="-lcrypt $AUTH_LIBS" AC_DEFINE(HAVE_CRYPT,1,[Whether the system has the crypt() function])]) ## @@ -2652,7 +2794,7 @@ AC_SEARCH_LIBS(crypt, [crypt], if test $with_pam_for_crypt = no; then AC_CACHE_CHECK([for a crypt that needs truncated salt],samba_cv_HAVE_TRUNCATED_SALT,[ crypt_LIBS="$LIBS" -LIBS="$AUTHLIBS $LIBS" +LIBS="$AUTH_LIBS $LIBS" AC_TRY_RUN([#include "${srcdir-.}/tests/crypttest.c"], samba_cv_HAVE_TRUNCATED_SALT=no,samba_cv_HAVE_TRUNCATED_SALT=yes,samba_cv_HAVE_TRUNCATED_SALT=cross) LIBS="$crypt_LIBS"]) @@ -3085,6 +3227,7 @@ AC_ARG_WITH(manpages-langs, INSTALLCLIENTCMD_SH=: INSTALLCLIENTCMD_A=: +INSTALLCLIENT= LIBSMBCLIENT_SHARED= LIBSMBCLIENT= AC_MSG_CHECKING(whether to build the libsmbclient shared library) @@ -3097,6 +3240,8 @@ AC_ARG_WITH(libsmbclient, *) if test $BLDSHARED = true; then INSTALLCLIENTCMD_SH="\$(INSTALLCMD)" + ## build the static version of libsmbclient as well + INSTALLCLIENTCMD_A="\$(INSTALLCMD)" LIBSMBCLIENT_SHARED=bin/libsmbclient.$SHLIBEXT LIBSMBCLIENT=libsmbclient AC_MSG_RESULT(yes) @@ -3108,6 +3253,7 @@ AC_ARG_WITH(libsmbclient, INSTALLCLIENTCMD_A="\$(INSTALLCMD)" LIBSMBCLIENT=libsmbclient fi + INSTALLCLIENT=installclientlib ;; esac ], [ @@ -3125,6 +3271,7 @@ AC_ARG_WITH(libsmbclient, INSTALLCLIENTCMD_A="\$(INSTALLCMD)" LIBSMBCLIENT=libsmbclient fi] + INSTALLCLIENT=installclientlib ) @@ -3392,7 +3539,7 @@ AC_ARG_WITH(acl-support, *osf*) AC_MSG_RESULT(Using Tru64 ACLs) AC_DEFINE(HAVE_TRU64_ACLS,1,[Whether Tru64 ACLs are available]) - ACLLIBS="$ACLLIBS -lpacl" + ACL_LIBS="$ACL_LIBS -lpacl" ;; *freebsd5*) AC_MSG_RESULT(Using FreeBSD posix ACLs) @@ -3400,8 +3547,8 @@ AC_ARG_WITH(acl-support, AC_DEFINE(HAVE_ACL_GET_PERM_NP,1,[Whether acl_get_perm_np() is available]) ;; *linux*) - AC_CHECK_LIB(attr,getxattr,[ACLLIBS="$ACLLIBS -lattr"]) - AC_CHECK_LIB(acl,acl_get_file,[ACLLIBS="$ACLLIBS -lacl"]) + AC_CHECK_LIB(attr,getxattr,[ACL_LIBS="$ACL_LIBS -lattr"]) + AC_CHECK_LIB(acl,acl_get_file,[ACL_LIBS="$ACL_LIBS -lacl"]) AC_CACHE_CHECK([for ACL support],samba_cv_HAVE_POSIX_ACLS,[ acl_LIBS=$LIBS LIBS="$LIBS -lacl" @@ -3427,7 +3574,7 @@ samba_cv_HAVE_ACL_GET_PERM_NP=yes,samba_cv_HAVE_ACL_GET_PERM_NP=no) fi ;; *) - AC_CHECK_LIB(acl,acl_get_file,[ACLLIBS="$ACLLIBS -lacl"]) + AC_CHECK_LIB(acl,acl_get_file,[ACL_LIBS="$ACL_LIBS -lacl"]) AC_CACHE_CHECK([for ACL support],samba_cv_HAVE_POSIX_ACLS,[ acl_LIBS=$LIBS LIBS="$LIBS -lacl" @@ -3910,22 +4057,23 @@ fi ]) ## contributed pdb_modules SMB_MODULE(pdb_xml, passdb/pdb_xml.o, "bin/xml.$SHLIBEXT", PDB, - [ PASSDBLIBS="$PASSDBLIBS $XML_LIBS" ] ) + [ PASSDB_LIBS="$PASSDB_LIBS $XML_LIBS" ] ) SMB_MODULE(pdb_mysql, passdb/pdb_mysql.o, "bin/mysql.$SHLIBEXT", PDB, - [ PASSDBLIBS="$PASSDBLIBS $MYSQL_LIBS" ] ) + [ PASSDB_LIBS="$PASSDB_LIBS $MYSQL_LIBS" ] ) ## end of contributed pdb_modules ########################################################################### SMB_MODULE(pdb_ldap, passdb/pdb_ldap.o, "bin/ldapsam.$SHLIBEXT", PDB, - [ PASSDBLIBS="$PASSDBLIBS $LDAP_LIBS" ] ) + [ PASSDB_LIBS="$PASSDB_LIBS $LDAP_LIBS" ] ) SMB_MODULE(pdb_smbpasswd, passdb/pdb_smbpasswd.o, "bin/smbpasswd.$SHLIBEXT", PDB) SMB_MODULE(pdb_tdbsam, passdb/pdb_tdb.o, "bin/tdbsam.$SHLIBEXT", PDB) SMB_MODULE(pdb_guest, passdb/pdb_guest.o, "bin/guest.$SHLIBEXT", PDB) -SMB_SUBSYSTEM(PDB) +SMB_SUBSYSTEM(PDB,passdb/pdb_interface.c) SMB_MODULE(rpc_lsa, \$(RPC_LSA_OBJ), "bin/librpc_lsarpc.$SHLIBEXT", RPC) SMB_MODULE(rpc_reg, \$(RPC_REG_OBJ), "bin/librpc_winreg.$SHLIBEXT", RPC) +SMB_MODULE(rpc_lsa_ds, \$(RPC_LSA_DS_OBJ), "bin/librpc_lsa_ds.$SHLIBEXT", RPC) SMB_MODULE(rpc_wks, \$(RPC_WKS_OBJ), "bin/librpc_wkssvc.$SHLIBEXT", RPC) SMB_MODULE(rpc_net, \$(RPC_NETLOG_OBJ), "bin/librpc_NETLOGON.$SHLIBEXT", RPC) SMB_MODULE(rpc_dfs, \$(RPC_DFS_OBJ), "bin/librpc_netdfs.$SHLIBEXT", RPC) @@ -3933,23 +4081,25 @@ SMB_MODULE(rpc_srv, \$(RPC_SVC_OBJ), "bin/librpc_srvsvc.$SHLIBEXT", RPC) SMB_MODULE(rpc_spoolss, \$(RPC_SPOOLSS_OBJ), "bin/librpc_spoolss.$SHLIBEXT", RPC) SMB_MODULE(rpc_samr, \$(RPC_SAMR_OBJ), "bin/librpc_samr.$SHLIBEXT", RPC) SMB_MODULE(rpc_echo, \$(RPC_ECHO_OBJ), "bin/librpc_echo.$SHLIBEXT", RPC) -SMB_SUBSYSTEM(RPC) +SMB_SUBSYSTEM(RPC,smbd/server.c) SMB_MODULE(idmap_ldap, sam/idmap_ldap.o, "bin/idmap_ldap.$SHLIBEXT", IDMAP) SMB_MODULE(idmap_tdb, sam/idmap_tdb.o, "bin/idmap_tdb.$SHLIBEXT", IDMAP) -SMB_SUBSYSTEM(IDMAP) +SMB_SUBSYSTEM(IDMAP,sam/idmap.c) SMB_MODULE(charset_weird, modules/weird.o, "bin/weird.$SHLIBEXT", CHARSET) -SMB_SUBSYSTEM(CHARSET) +SMB_MODULE(charset_CP850, modules/CP850.o, "bin/CP850.$SHLIBEXT", CHARSET) +SMB_MODULE(charset_CP437, modules/CP437.o, "bin/CP437.$SHLIBEXT", CHARSET) +SMB_SUBSYSTEM(CHARSET,lib/iconv.c) SMB_MODULE(auth_rhosts, \$(AUTH_RHOSTS_OBJ), "bin/rhosts.$SHLIBEXT", AUTH) SMB_MODULE(auth_sam, \$(AUTH_SAM_OBJ), "bin/sam.$SHLIBEXT", AUTH) SMB_MODULE(auth_unix, \$(AUTH_UNIX_OBJ), "bin/unix.$SHLIBEXT", AUTH) SMB_MODULE(auth_winbind, \$(AUTH_WINBIND_OBJ), "bin/winbind.$SHLIBEXT", AUTH) -SMB_MODULE(auth_server, \$(AUTH_SERVER_OBJ), "bin/server.$SHLIBEXT", AUTH) +SMB_MODULE(auth_server, \$(AUTH_SERVER_OBJ), "bin/smbserver.$SHLIBEXT", AUTH) SMB_MODULE(auth_domain, \$(AUTH_DOMAIN_OBJ), "bin/domain.$SHLIBEXT", AUTH) SMB_MODULE(auth_builtin, \$(AUTH_BUILTIN_OBJ), "bin/builtin.$SHLIBEXT", AUTH) -SMB_SUBSYSTEM(AUTH) +SMB_SUBSYSTEM(AUTH,auth/auth.c) SMB_MODULE(vfs_recycle, \$(VFS_RECYCLE_OBJ), "bin/recycle.$SHLIBEXT", VFS) SMB_MODULE(vfs_audit, \$(VFS_AUDIT_OBJ), "bin/audit.$SHLIBEXT", VFS) @@ -3957,7 +4107,9 @@ SMB_MODULE(vfs_extd_audit, \$(VFS_EXTD_AUDIT_OBJ), "bin/extd_audit.$SHLIBEXT", V SMB_MODULE(vfs_netatalk, \$(VFS_NETATALK_OBJ), "bin/netatalk.$SHLIBEXT", VFS) SMB_MODULE(vfs_fake_perms, \$(VFS_FAKE_PERMS_OBJ), "bin/fake_perms.$SHLIBEXT", VFS) SMB_MODULE(vfs_default_quota, \$(VFS_DEFAULT_QUOTA_OBJ), "bin/default_quota.$SHLIBEXT", VFS) -SMB_SUBSYSTEM(VFS) +SMB_MODULE(vfs_readonly, \$(VFS_READONLY_OBJ), "bin/readonly.$SHLIBEXT", VFS) +SMB_MODULE(vfs_cap, \$(VFS_CAP_OBJ), "bin/cap.$SHLIBEXT", VFS) +SMB_SUBSYSTEM(VFS,smbd/vfs.c) AC_DEFINE_UNQUOTED(STRING_STATIC_MODULES, "$string_static_modules", [String list of builtin modules]) @@ -3979,6 +4131,7 @@ fi if test x"$with_ldap_support" != x"no"; then AC_MSG_RESULT([ LDAP_LIBS = $LDAP_LIBS]) fi +AC_MSG_RESULT([ AUTH_LIBS = $AUTH_LIBS]) ################################################# # final configure stuff @@ -4000,7 +4153,7 @@ dnl Remove -I/usr/include/? from CFLAGS and CPPFLAGS CFLAGS_REMOVE_USR_INCLUDE(CFLAGS) CFLAGS_REMOVE_USR_INCLUDE(CPPFLAGS) -AC_OUTPUT(include/stamp-h Makefile script/findsmb) +AC_OUTPUT(include/stamp-h Makefile script/findsmb smbadduser script/gen-8bit-gap.sh) ################################################# # Print very concise instructions on building/use diff --git a/source3/groupdb/mapping.c b/source3/groupdb/mapping.c index cd903fa28b..7a07b5c344 100644 --- a/source3/groupdb/mapping.c +++ b/source3/groupdb/mapping.c @@ -234,7 +234,7 @@ static BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map) TDB_DATA kbuf, dbuf; pstring key; fstring string_sid; - int ret; + int ret = 0; if(!init_group_mapping()) { DEBUG(0,("failed to initialize group mapping")); @@ -257,6 +257,11 @@ static BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map) &map->gid, &map->sid_name_use, &map->nt_name, &map->comment); SAFE_FREE(dbuf.dptr); + + if ( ret == -1 ) { + DEBUG(3,("get_group_map_from_sid: tdb_unpack failure\n")); + return False; + } sid_copy(&map->sid, &sid); @@ -299,6 +304,11 @@ static BOOL get_group_map_from_gid(gid_t gid, GROUP_MAP *map) SAFE_FREE(dbuf.dptr); + if ( ret == -1 ) { + DEBUG(3,("get_group_map_from_gid: tdb_unpack failure\n")); + return False; + } + if (gid==map->gid) { SAFE_FREE(kbuf.dptr); return True; @@ -343,6 +353,11 @@ static BOOL get_group_map_from_ntname(const char *name, GROUP_MAP *map) &map->gid, &map->sid_name_use, &map->nt_name, &map->comment); SAFE_FREE(dbuf.dptr); + + if ( ret == -1 ) { + DEBUG(3,("get_group_map_from_ntname: tdb_unpack failure\n")); + return False; + } if (StrCaseCmp(name, map->nt_name)==0) { SAFE_FREE(kbuf.dptr); @@ -429,6 +444,11 @@ static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap, SAFE_FREE(dbuf.dptr); + if ( ret == -1 ) { + DEBUG(3,("enum_group_mapping: tdb_unpack failure\n")); + continue; + } + /* list only the type or everything if UNKNOWN */ if (sid_name_use!=SID_NAME_UNKNOWN && sid_name_use!=map.sid_name_use) { DEBUG(11,("enum_group_mapping: group %s is not of the requested type\n", map.nt_name)); @@ -510,8 +530,9 @@ BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map) } DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid)); - - if ( (grp=getgrgid(map->gid)) == NULL) { + + grp = getgrgid(map->gid); + if ( !grp ) { DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n")); return False; } @@ -553,9 +574,12 @@ BOOL get_local_group_from_sid(DOM_SID sid, GROUP_MAP *map) sid_peek_rid(&sid, &alias_rid); map->gid=pdb_group_rid_to_gid(alias_rid); - - if ((grp=getgrgid(map->gid)) == NULL) + + grp = getgrgid(map->gid); + if ( !grp ) { + DEBUG(3,("get_local_group_from_sid: No unix group for [%ul]\n", map->gid)); return False; + } map->sid_name_use=SID_NAME_ALIAS; diff --git a/source3/include/.cvsignore b/source3/include/.cvsignore index bff248727f..7dff121f14 100644 --- a/source3/include/.cvsignore +++ b/source3/include/.cvsignore @@ -4,3 +4,4 @@ stamp-h proto.h wrepld_proto.h config.h.in +version.h diff --git a/source3/include/ads.h b/source3/include/ads.h index 0961c9581c..b85ad21fba 100644 --- a/source3/include/ads.h +++ b/source3/include/ads.h @@ -218,6 +218,6 @@ typedef void **ADS_MODLIST; /* The older versions of heimdal that don't have this define don't seem to use it anyway. I'm told they always use a subkey */ -#ifndef AP_OPTS_USE_SUBKEY +#ifndef HAVE_AP_OPTS_USE_SUBKEY #define AP_OPTS_USE_SUBKEY 0 #endif diff --git a/source3/include/charset.h b/source3/include/charset.h index f999a9cf72..7a9b12ef55 100644 --- a/source3/include/charset.h +++ b/source3/include/charset.h @@ -38,3 +38,90 @@ struct charset_functions { struct charset_functions *prev, *next; }; +/* + * This is auxiliary struct used by source/script/gen-8-bit-gap.sh script + * during generation of an encoding table for charset module + * */ + +struct charset_gap_table { + uint16 start; + uint16 end; + int32 idx; +}; + +/* + * Define stub for charset module which implements 8-bit encoding with gaps. + * Encoding tables for such module should be produced from glibc's CHARMAPs + * using script source/script/gen-8bit-gap.sh + * CHARSETNAME is CAPITALIZED charset name + * + * */ +#define SMB_GENERATE_CHARSET_MODULE_8_BIT_GAP(CHARSETNAME) \ +static size_t CHARSETNAME ## _push(void *cd, char **inbuf, size_t *inbytesleft, \ + char **outbuf, size_t *outbytesleft) \ +{ \ + while (*inbytesleft >= 2 && *outbytesleft >= 1) { \ + int i; \ + int done = 0; \ + \ + uint16 ch = SVAL(*inbuf,0); \ + \ + for (i=0; from_idx[i].start != 0xffff; i++) { \ + if ((from_idx[i].start <= ch) && (from_idx[i].end >= ch)) { \ + ((unsigned char*)(*outbuf))[0] = from_ucs2[from_idx[i].idx+ch]; \ + (*inbytesleft) -= 2; \ + (*outbytesleft) -= 1; \ + (*inbuf) += 2; \ + (*outbuf) += 1; \ + done = 1; \ + break; \ + } \ + } \ + if (!done) { \ + errno = EINVAL; \ + return -1; \ + } \ + \ + } \ + \ + if (*inbytesleft == 1) { \ + errno = EINVAL; \ + return -1; \ + } \ + \ + if (*inbytesleft > 1) { \ + errno = E2BIG; \ + return -1; \ + } \ + \ + return 0; \ +} \ + \ +static size_t CHARSETNAME ## _pull(void *cd, char **inbuf, size_t *inbytesleft, \ + char **outbuf, size_t *outbytesleft) \ +{ \ + while (*inbytesleft >= 1 && *outbytesleft >= 2) { \ + *(uint16*)(*outbuf) = to_ucs2[((unsigned char*)(*inbuf))[0]]; \ + (*inbytesleft) -= 1; \ + (*outbytesleft) -= 2; \ + (*inbuf) += 1; \ + (*outbuf) += 2; \ + } \ + \ + if (*inbytesleft > 0) { \ + errno = E2BIG; \ + return -1; \ + } \ + \ + return 0; \ +} \ + \ +struct charset_functions CHARSETNAME ## _functions = \ + {#CHARSETNAME, CHARSETNAME ## _pull, CHARSETNAME ## _push}; \ + \ +NTSTATUS charset_ ## CHARSETNAME ## _init(void) \ +{ \ + return smb_register_charset(& CHARSETNAME ## _functions); \ +} \ + + diff --git a/source3/include/includes.h b/source3/include/includes.h index eb7f73b9d3..29bb53980f 100644 --- a/source3/include/includes.h +++ b/source3/include/includes.h @@ -437,6 +437,10 @@ #include #endif +#if HAVE_SYS_ATTRIBUTES_H +#include +#endif + #if HAVE_ATTR_XATTR_H #include #endif @@ -958,10 +962,6 @@ struct smb_ldap_privates; #define SYNC_DNS 1 #endif -#ifndef MAXPATHLEN -#define MAXPATHLEN 256 -#endif - #ifndef SEEK_SET #define SEEK_SET 0 #endif @@ -1278,7 +1278,7 @@ time_t timegm(struct tm *tm); #if defined(HAVE_KRB5) -#ifndef KRB5_SET_REAL_TIME +#ifndef HAVE_KRB5_SET_REAL_TIME krb5_error_code krb5_set_real_time(krb5_context context, int32_t seconds, int32_t microseconds); #endif diff --git a/source3/include/nameserv.h b/source3/include/nameserv.h index 14561cf44d..1e867d620b 100644 --- a/source3/include/nameserv.h +++ b/source3/include/nameserv.h @@ -176,124 +176,116 @@ enum name_source {LMHOSTS_NAME, REGISTER_NAME, SELF_NAME, DNS_NAME, enum node_type {B_NODE=0, P_NODE=1, M_NODE=2, NBDD_NODE=3}; enum packet_type {NMB_PACKET, DGRAM_PACKET}; -enum master_state -{ - MST_NONE, - MST_POTENTIAL, - MST_BACKUP, - MST_MSB, - MST_BROWSER, - MST_UNBECOMING_MASTER +enum master_state { + MST_NONE, + MST_POTENTIAL, + MST_BACKUP, + MST_MSB, + MST_BROWSER, + MST_UNBECOMING_MASTER }; -enum domain_state -{ - DOMAIN_NONE, - DOMAIN_WAIT, - DOMAIN_MST +enum domain_state { + DOMAIN_NONE, + DOMAIN_WAIT, + DOMAIN_MST }; -enum logon_state -{ - LOGON_NONE, - LOGON_WAIT, - LOGON_SRV +enum logon_state { + LOGON_NONE, + LOGON_WAIT, + LOGON_SRV }; struct subnet_record; -struct nmb_data -{ - uint16 nb_flags; /* Netbios flags. */ - int num_ips; /* Number of ip entries. */ - struct in_addr *ip; /* The ip list for this name. */ +struct nmb_data { + uint16 nb_flags; /* Netbios flags. */ + int num_ips; /* Number of ip entries. */ + struct in_addr *ip; /* The ip list for this name. */ - enum name_source source; /* Where the name came from. */ + enum name_source source; /* Where the name came from. */ - time_t death_time; /* The time the record must be removed (do not remove if 0). */ - time_t refresh_time; /* The time the record should be refreshed. */ + time_t death_time; /* The time the record must be removed (do not remove if 0). */ + time_t refresh_time; /* The time the record should be refreshed. */ - SMB_BIG_UINT id; /* unique id */ - struct in_addr wins_ip; /* the adress of the wins server this record comes from */ + SMB_BIG_UINT id; /* unique id */ + struct in_addr wins_ip; /* the adress of the wins server this record comes from */ - int wins_flags; /* similar to the netbios flags but different ! */ + int wins_flags; /* similar to the netbios flags but different ! */ }; /* This structure represents an entry in a local netbios name list. */ -struct name_record - { - ubi_trNode node[1]; - struct subnet_record *subnet; - struct nmb_name name; /* The netbios name. */ - struct nmb_data data; /* The netbios data. */ - }; +struct name_record { + ubi_trNode node[1]; + struct subnet_record *subnet; + struct nmb_name name; /* The netbios name. */ + struct nmb_data data; /* The netbios data. */ +}; /* Browser cache for synchronising browse lists. */ -struct browse_cache_record - { - ubi_dlNode node[1]; - pstring lmb_name; - pstring work_group; - struct in_addr ip; - time_t sync_time; - time_t death_time; /* The time the record must be removed. */ - }; +struct browse_cache_record { + ubi_dlNode node[1]; + nstring lmb_name; + nstring work_group; + struct in_addr ip; + time_t sync_time; + time_t death_time; /* The time the record must be removed. */ +}; /* This is used to hold the list of servers in my domain, and is contained within lists of domains. */ -struct server_record -{ - struct server_record *next; - struct server_record *prev; +struct server_record { + struct server_record *next; + struct server_record *prev; - struct subnet_record *subnet; + struct subnet_record *subnet; - struct server_info_struct serv; - time_t death_time; + struct server_info_struct serv; + time_t death_time; }; /* A workgroup structure. It contains a list of servers. */ -struct work_record -{ - struct work_record *next; - struct work_record *prev; +struct work_record { + struct work_record *next; + struct work_record *prev; - struct subnet_record *subnet; + struct subnet_record *subnet; - struct server_record *serverlist; + struct server_record *serverlist; - /* Stage of development from non-local-master up to local-master browser. */ - enum master_state mst_state; + /* Stage of development from non-local-master up to local-master browser. */ + enum master_state mst_state; - /* Stage of development from non-domain-master to domain-master browser. */ - enum domain_state dom_state; + /* Stage of development from non-domain-master to domain-master browser. */ + enum domain_state dom_state; - /* Stage of development from non-logon-server to logon server. */ - enum logon_state log_state; + /* Stage of development from non-logon-server to logon server. */ + enum logon_state log_state; - /* Work group info. */ - fstring work_group; - int token; /* Used when communicating with backup browsers. */ - fstring local_master_browser_name; /* Current local master browser. */ + /* Work group info. */ + nstring work_group; + int token; /* Used when communicating with backup browsers. */ + nstring local_master_browser_name; /* Current local master browser. */ - /* Announce info. */ - time_t lastannounce_time; - int announce_interval; - BOOL needannounce; + /* Announce info. */ + time_t lastannounce_time; + int announce_interval; + BOOL needannounce; - /* Timeout time for this workgroup. 0 means permanent. */ - time_t death_time; + /* Timeout time for this workgroup. 0 means permanent. */ + time_t death_time; - /* Election info */ - BOOL RunningElection; - BOOL needelection; - int ElectionCount; - uint32 ElectionCriterion; + /* Election info */ + BOOL RunningElection; + BOOL needelection; + int ElectionCount; + uint32 ElectionCriterion; - /* Domain master browser info. Used for efficient syncs. */ - struct nmb_name dmb_name; - struct in_addr dmb_addr; + /* Domain master browser info. Used for efficient syncs. */ + struct nmb_name dmb_name; + struct in_addr dmb_addr; }; /* typedefs needed to define copy & free functions for userdata. */ @@ -305,10 +297,10 @@ typedef void (*userdata_free_fn)(struct userdata_struct *); /* Structure to define any userdata passed around. */ struct userdata_struct { - userdata_copy_fn copy_fn; - userdata_free_fn free_fn; - unsigned int userdata_len; - char data[16]; /* 16 is to ensure alignment/padding on all systems */ + userdata_copy_fn copy_fn; + userdata_free_fn free_fn; + unsigned int userdata_len; + char data[16]; /* 16 is to ensure alignment/padding on all systems */ }; struct response_record; @@ -382,33 +374,32 @@ typedef void (*node_status_fail_function)( struct subnet_record *, /* Initiated name queries are recorded in this list to track any responses. */ -struct response_record -{ - struct response_record *next; - struct response_record *prev; +struct response_record { + struct response_record *next; + struct response_record *prev; - uint16 response_id; + uint16 response_id; - /* Callbacks for packets received or not. */ - response_function resp_fn; - timeout_response_function timeout_fn; + /* Callbacks for packets received or not. */ + response_function resp_fn; + timeout_response_function timeout_fn; - /* Callbacks for the request succeeding or not. */ - success_function success_fn; - fail_function fail_fn; + /* Callbacks for the request succeeding or not. */ + success_function success_fn; + fail_function fail_fn; - struct packet_struct *packet; + struct packet_struct *packet; - struct userdata_struct *userdata; + struct userdata_struct *userdata; - int num_msgs; + int num_msgs; - time_t repeat_time; - time_t repeat_interval; - int repeat_count; + time_t repeat_time; + time_t repeat_interval; + int repeat_count; - /* Recursion protection. */ - BOOL in_expiration_processing; + /* Recursion protection. */ + BOOL in_expiration_processing; }; /* A subnet structure. It contains a list of workgroups and netbios names. */ @@ -420,42 +411,41 @@ struct response_record */ enum subnet_type { - NORMAL_SUBNET = 0, /* Subnet listed in interfaces list. */ - UNICAST_SUBNET = 1, /* Subnet for unicast packets. */ - REMOTE_BROADCAST_SUBNET = 2, /* Subnet for remote broadcasts. */ - WINS_SERVER_SUBNET = 3 /* Only created if we are a WINS server. */ + NORMAL_SUBNET = 0, /* Subnet listed in interfaces list. */ + UNICAST_SUBNET = 1, /* Subnet for unicast packets. */ + REMOTE_BROADCAST_SUBNET = 2, /* Subnet for remote broadcasts. */ + WINS_SERVER_SUBNET = 3 /* Only created if we are a WINS server. */ }; -struct subnet_record -{ - struct subnet_record *next; - struct subnet_record *prev; +struct subnet_record { + struct subnet_record *next; + struct subnet_record *prev; - char *subnet_name; /* For Debug identification. */ - enum subnet_type type; /* To catagorize the subnet. */ + char *subnet_name; /* For Debug identification. */ + enum subnet_type type; /* To catagorize the subnet. */ - struct work_record *workgrouplist; /* List of workgroups. */ - ubi_trRoot namelist[1]; /* List of netbios names. */ - struct response_record *responselist; /* List of responses expected. */ + struct work_record *workgrouplist; /* List of workgroups. */ + ubi_trRoot namelist[1]; /* List of netbios names. */ + struct response_record *responselist; /* List of responses expected. */ - BOOL namelist_changed; - BOOL work_changed; + BOOL namelist_changed; + BOOL work_changed; - struct in_addr bcast_ip; - struct in_addr mask_ip; - struct in_addr myip; - int nmb_sock; /* socket to listen for unicast 137. */ - int dgram_sock; /* socket to listen for unicast 138. */ + struct in_addr bcast_ip; + struct in_addr mask_ip; + struct in_addr myip; + int nmb_sock; /* socket to listen for unicast 137. */ + int dgram_sock; /* socket to listen for unicast 138. */ }; /* A resource record. */ struct res_rec { - struct nmb_name rr_name; - int rr_type; - int rr_class; - int ttl; - int rdlength; - char rdata[MAX_DGRAM_SIZE]; + struct nmb_name rr_name; + int rr_type; + int rr_class; + int ttl; + int rdlength; + char rdata[MAX_DGRAM_SIZE]; }; /* Define these so we can pass info back to caller of name_query */ @@ -467,35 +457,34 @@ struct res_rec { #define NM_FLAGS_B 0x01 /* Broadcast */ /* An nmb packet. */ -struct nmb_packet -{ - struct { - int name_trn_id; - int opcode; - BOOL response; - struct { - BOOL bcast; - BOOL recursion_available; - BOOL recursion_desired; - BOOL trunc; - BOOL authoritative; - } nm_flags; - int rcode; - int qdcount; - int ancount; - int nscount; - int arcount; - } header; - - struct { - struct nmb_name question_name; - int question_type; - int question_class; - } question; - - struct res_rec *answers; - struct res_rec *nsrecs; - struct res_rec *additional; +struct nmb_packet { + struct { + int name_trn_id; + int opcode; + BOOL response; + struct { + BOOL bcast; + BOOL recursion_available; + BOOL recursion_desired; + BOOL trunc; + BOOL authoritative; + } nm_flags; + int rcode; + int qdcount; + int ancount; + int nscount; + int arcount; + } header; + + struct { + struct nmb_name question_name; + int question_type; + int question_class; + } question; + + struct res_rec *answers; + struct res_rec *nsrecs; + struct res_rec *additional; }; /* msg_type field options - from rfc1002. */ @@ -511,23 +500,23 @@ struct nmb_packet /* A datagram - this normally contains SMB data in the data[] array. */ struct dgram_packet { - struct { - int msg_type; - struct { - enum node_type node_type; - BOOL first; - BOOL more; - } flags; - int dgm_id; - struct in_addr source_ip; - int source_port; - int dgm_length; - int packet_offset; - } header; - struct nmb_name source_name; - struct nmb_name dest_name; - int datasize; - char data[MAX_DGRAM_SIZE]; + struct { + int msg_type; + struct { + enum node_type node_type; + BOOL first; + BOOL more; + } flags; + int dgm_id; + struct in_addr source_ip; + int source_port; + int dgm_length; + int packet_offset; + } header; + struct nmb_name source_name; + struct nmb_name dest_name; + int datasize; + char data[MAX_DGRAM_SIZE]; }; /* Define a structure used to queue packets. This will be a linked @@ -535,18 +524,18 @@ struct dgram_packet { struct packet_struct { - struct packet_struct *next; - struct packet_struct *prev; - BOOL locked; - struct in_addr ip; - int port; - int fd; - time_t timestamp; - enum packet_type packet_type; - union { - struct nmb_packet nmb; - struct dgram_packet dgram; - } packet; + struct packet_struct *next; + struct packet_struct *prev; + BOOL locked; + struct in_addr ip; + int port; + int fd; + time_t timestamp; + enum packet_type packet_type; + union { + struct nmb_packet nmb; + struct dgram_packet dgram; + } packet; }; /* NETLOGON opcodes */ diff --git a/source3/include/ntdomain.h b/source3/include/ntdomain.h index b6ab4fd0c5..ccbc190c59 100644 --- a/source3/include/ntdomain.h +++ b/source3/include/ntdomain.h @@ -165,10 +165,21 @@ struct dcinfo }; +typedef struct pipe_rpc_fns { + + struct pipe_rpc_fns *next, *prev; + + /* RPC function table associated with the current rpc_bind (associated by context) */ + + struct api_struct *cmds; + int n_cmds; + uint32 context_id; + +} PIPE_RPC_FNS; + /* * DCE/RPC-specific samba-internal-specific handling of data on * NamedPipes. - * */ typedef struct pipes_struct @@ -180,7 +191,12 @@ typedef struct pipes_struct fstring name; fstring pipe_srv_name; - + + /* linked list of rpc dispatch tables associated + with the open rpc contexts */ + + PIPE_RPC_FNS *contexts; + RPC_HDR hdr; /* Incoming RPC header. */ RPC_HDR_REQ hdr_req; /* Incoming request header. */ diff --git a/source3/include/ntioctl.h b/source3/include/ntioctl.h index 17791fde18..9814c88e5e 100644 --- a/source3/include/ntioctl.h +++ b/source3/include/ntioctl.h @@ -23,6 +23,8 @@ we only need the sparse flag */ +#ifndef _NTIOCTL_H +#define _NTIOCTL_H /* IOCTL information */ /* List of ioctl function codes that look to be of interest to remote clients like this. */ @@ -53,6 +55,8 @@ #define FSCTL_SIS_COPYFILE 0x00090100 #define FSCTL_SIS_LINK_FILES 0x0009C104 +#define FSCTL_GET_SHADOW_COPY_DATA 0x00144064 /* KJC -- Shadow Copy information */ + #if 0 #define FSCTL_SECURITY_ID_CHECK #define FSCTL_DISMOUNT_VOLUME @@ -66,3 +70,18 @@ #define IO_REPARSE_TAG_MOUNT_POINT 0xA0000003 #define IO_REPARSE_TAG_HSM 0xC0000004 #define IO_REPARSE_TAG_SIS 0x80000007 + + +/* For FSCTL_GET_SHADOW_COPY_DATA ...*/ +typedef char SHADOW_COPY_LABEL[25]; + +typedef struct shadow_copy_data { + TALLOC_CTX *mem_ctx; + /* Total number of shadow volumes currently mounted */ + uint32 num_volumes; + /* Concatenated list of labels */ + SHADOW_COPY_LABEL *labels; +} SHADOW_COPY_DATA; + + +#endif /* _NTIOCTL_H */ diff --git a/source3/include/ntlmssp.h b/source3/include/ntlmssp.h index 562e4853cc..f1b1bc25e4 100644 --- a/source3/include/ntlmssp.h +++ b/source3/include/ntlmssp.h @@ -100,6 +100,7 @@ typedef struct ntlmssp_client_state char *domain; char *workstation; char *password; + char *server_domain; const char *(*get_global_myname)(void); const char *(*get_domain)(void); diff --git a/source3/include/ntquotas.h b/source3/include/ntquotas.h index 1425e59bb8..dac1173770 100644 --- a/source3/include/ntquotas.h +++ b/source3/include/ntquotas.h @@ -72,7 +72,7 @@ typedef struct _SMB_NTQUOTA_STRUCT { SMB_BIG_UINT usedspace; SMB_BIG_UINT softlim; SMB_BIG_UINT hardlim; - enum SMB_QUOTA_TYPE qflags; + uint32 qflags; DOM_SID sid; } SMB_NTQUOTA_STRUCT; diff --git a/source3/include/rpc_dce.h b/source3/include/rpc_dce.h index dc82f45368..2e4a418bb7 100644 --- a/source3/include/rpc_dce.h +++ b/source3/include/rpc_dce.h @@ -78,8 +78,8 @@ enum netsec_direction #define AUTH_PIPE_NETSEC 0x0008 /* Maximum PDU fragment size. */ -#define MAX_PDU_FRAG_LEN 0x1630 -/* #define MAX_PDU_FRAG_LEN 0x10b8 this is what w2k sets */ +/* #define MAX_PDU_FRAG_LEN 0x1630 this is what wnt sets */ +#define MAX_PDU_FRAG_LEN 0x10b8 /* this is what w2k sets */ /* * Actual structure of a DCE UUID @@ -136,8 +136,8 @@ typedef struct rpc_hdr_info typedef struct rpc_hdr_req_info { uint32 alloc_hint; /* allocation hint - data size (bytes) minus header and tail. */ - uint16 context_id; /* 0 - presentation context identifier */ - uint16 opnum; /* opnum */ + uint16 context_id; /* presentation context identifier */ + uint16 opnum; /* opnum */ } RPC_HDR_REQ; diff --git a/source3/include/rpc_ds.h b/source3/include/rpc_ds.h index 7350fdba1f..e2622be532 100644 --- a/source3/include/rpc_ds.h +++ b/source3/include/rpc_ds.h @@ -27,6 +27,7 @@ /* Opcodes available on PIPE_LSARPC_DS */ #define DS_GETPRIMDOMINFO 0x00 +#define DS_NOP 0xFF /* no op -- placeholder */ /* Opcodes available on PIPE_NETLOGON */ @@ -35,11 +36,23 @@ /* macros for RPC's */ +/* DSROLE_PRIMARY_DOMAIN_INFO_BASIC */ + +/* flags */ + #define DSROLE_PRIMARY_DS_RUNNING 0x00000001 #define DSROLE_PRIMARY_DS_MIXED_MODE 0x00000002 #define DSROLE_UPGRADE_IN_PROGRESS 0x00000004 #define DSROLE_PRIMARY_DOMAIN_GUID_PRESENT 0x01000000 +/* machine role */ + +#define DSROLE_STANDALONE_SRV 2 +#define DSROLE_DOMAIN_MEMBER_SRV 3 +#define DSROLE_BDC 4 +#define DSROLE_PDC 5 + + typedef struct { uint16 machine_role; diff --git a/source3/include/rpc_lsa.h b/source3/include/rpc_lsa.h index 135fd76d6c..fa49d76c88 100644 --- a/source3/include/rpc_lsa.h +++ b/source3/include/rpc_lsa.h @@ -27,6 +27,12 @@ /* Opcodes available on PIPE_LSARPC */ +#if 0 /* UNIMPLEMENTED */ + +#define LSA_LOOKUPSIDS2 0x39 + +#endif + #define LSA_CLOSE 0x00 #define LSA_DELETE 0x01 #define LSA_ENUM_PRIVS 0x02 diff --git a/source3/include/rpc_samr.h b/source3/include/rpc_samr.h index 8ec274176a..4d9ad0b2e1 100644 --- a/source3/include/rpc_samr.h +++ b/source3/include/rpc_samr.h @@ -127,7 +127,7 @@ SamrTestPrivateFunctionsUser #define SAMR_UNKNOWN_2a 0x2a #define SAMR_UNKNOWN_2b 0x2b #define SAMR_GET_USRDOM_PWINFO 0x2c -#define SAMR_UNKNOWN_2D 0x2d +#define SAMR_REMOVE_USER_FOREIGN_DOMAIN 0x2d #define SAMR_UNKNOWN_2E 0x2e /* looks like an alias for SAMR_QUERY_DOMAIN_INFO */ #define SAMR_UNKNOWN_2f 0x2f #define SAMR_QUERY_DISPINFO3 0x30 /* Alias for SAMR_QUERY_DISPINFO @@ -1786,21 +1786,21 @@ typedef struct r_samr_chgpasswd_user_info } SAMR_R_CHGPASSWD_USER; -/* SAMR_Q_UNKNOWN_2D */ -typedef struct q_samr_unknown_2d_info +/* SAMR_Q_REMOVE_USER_FOREIGN_DOMAIN */ +typedef struct q_samr_remove_user_foreign_domain_info { POLICY_HND dom_pol; /* policy handle */ DOM_SID2 sid; /* SID */ -} SAMR_Q_UNKNOWN_2D; +} SAMR_Q_REMOVE_USER_FOREIGN_DOMAIN; -/* SAMR_R_UNKNOWN_2D - probably an open */ -typedef struct r_samr_unknown_2d_info +/* SAMR_R_REMOVE_USER_FOREIGN_DOMAIN */ +typedef struct r_samr_remove_user_foreign_domain_info { NTSTATUS status; /* return status */ -} SAMR_R_UNKNOWN_2D; +} SAMR_R_REMOVE_USER_FOREIGN_DOMAIN; diff --git a/source3/include/rpc_spoolss.h b/source3/include/rpc_spoolss.h index c2e3d92787..f96b4fa96a 100755 --- a/source3/include/rpc_spoolss.h +++ b/source3/include/rpc_spoolss.h @@ -1302,6 +1302,12 @@ typedef struct s_port_info_2 } PORT_INFO_2; +/* Port Type bits */ +#define PORT_TYPE_WRITE 0x0001 +#define PORT_TYPE_READ 0x0002 +#define PORT_TYPE_REDIRECTED 0x0004 +#define PORT_TYPE_NET_ATTACHED 0x0008 + typedef struct spool_q_enumports { uint32 name_ptr; diff --git a/source3/include/safe_string.h b/source3/include/safe_string.h index 6656f4f6bb..07578b2424 100644 --- a/source3/include/safe_string.h +++ b/source3/include/safe_string.h @@ -124,6 +124,7 @@ size_t __unsafe_string_function_usage_here_char__(void); #define pstrcat(d,s) safe_strcat((d), (s),sizeof(pstring)-1) #define fstrcpy(d,s) safe_strcpy((d),(s),sizeof(fstring)-1) #define fstrcat(d,s) safe_strcat((d),(s),sizeof(fstring)-1) +#define nstrcpy(d,s) safe_strcpy((d), (s),sizeof(nstring)-1) /* the addition of the DEVELOPER checks in safe_strcpy means we must * update a lot of code. To make this a little easier here are some diff --git a/source3/include/secrets.h b/source3/include/secrets.h index dacfef26ea..cb4fbd043a 100644 --- a/source3/include/secrets.h +++ b/source3/include/secrets.h @@ -77,5 +77,22 @@ typedef struct trustdom { DOM_SID sid; } TRUSTDOM; +/* + * Format of an OpenAFS keyfile + */ + +#define SECRETS_AFS_MAXKEYS 8 + +struct afs_key { + uint32 kvno; + char key[8]; +}; + +struct afs_keyfile { + uint32 nkeys; + struct afs_key entry[SECRETS_AFS_MAXKEYS]; +}; + +#define SECRETS_AFS_KEYFILE "SECRETS/AFS_KEYFILE" #endif /* _SECRETS_H */ diff --git a/source3/include/smb.h b/source3/include/smb.h index deeb61034d..8c6f47f23f 100644 --- a/source3/include/smb.h +++ b/source3/include/smb.h @@ -390,7 +390,9 @@ typedef struct files_struct SMB_OFF_T pos; SMB_BIG_UINT size; SMB_BIG_UINT initial_allocation_size; /* Faked up initial allocation on disk. */ + SMB_BIG_UINT position_information; mode_t mode; + uint16 file_pid; uint16 vuid; write_bmpx_struct *wbmpx_ptr; write_cache *wcp; @@ -1482,17 +1484,19 @@ struct cnotify_fns { #include "smb_macros.h" +typedef char nstring[16]; + /* A netbios name structure. */ struct nmb_name { - char name[17]; - char scope[64]; - unsigned int name_type; + nstring name; + char scope[64]; + unsigned int name_type; }; /* A netbios node status array element. */ struct node_status { - char name[16]; + nstring name; unsigned char type; unsigned char flags; }; diff --git a/source3/include/smb_macros.h b/source3/include/smb_macros.h index 21ccdf295c..178fd9c358 100644 --- a/source3/include/smb_macros.h +++ b/source3/include/smb_macros.h @@ -77,6 +77,12 @@ #define OPEN_CONN(conn) ((conn) && (conn)->open) #define IS_IPC(conn) ((conn) && (conn)->ipc) #define IS_PRINT(conn) ((conn) && (conn)->printer) +#define FSP_BELONGS_CONN(fsp,conn) do {\ + extern struct current_user current_user;\ + if (!((fsp) && (conn) && ((conn)==(fsp)->conn) && (current_user.vuid==(fsp)->vuid))) \ + return(ERROR_DOS(ERRDOS,ERRbadfid));\ + } while(0) + #define FNUM_OK(fsp,c) (OPEN_FSP(fsp) && (c)==(fsp)->conn && current_user.vuid==(fsp)->vuid) #define CHECK_FSP(fsp,conn) do {\ diff --git a/source3/include/spnego.h b/source3/include/spnego.h new file mode 100644 index 0000000000..b6492ee3c8 --- /dev/null +++ b/source3/include/spnego.h @@ -0,0 +1,65 @@ +/* + Unix SMB/CIFS implementation. + + RFC2478 Compliant SPNEGO implementation + + Copyright (C) Jim McDonough 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#ifndef SAMBA_SPNEGO_H +#define SAMBA_SPNEGO_H + +#define SPNEGO_DELEG_FLAG 0x01 +#define SPNEGO_MUTUAL_FLAG 0x02 +#define SPNEGO_REPLAY_FLAG 0x04 +#define SPNEGO_SEQUENCE_FLAG 0x08 +#define SPNEGO_ANON_FLAG 0x10 +#define SPNEGO_CONF_FLAG 0x20 +#define SPNEGO_INTEG_FLAG 0x40 +#define SPNEGO_REQ_FLAG 0x80 + +#define SPNEGO_NEG_TOKEN_INIT 0 +#define SPNEGO_NEG_TOKEN_TARG 1 + +typedef enum _spnego_negResult { + SPNEGO_ACCEPT_COMPLETED = 0, + SPNEGO_ACCEPT_INCOMPLETE = 1, + SPNEGO_REJECT = 2 +} negResult_t; + +typedef struct spnego_negTokenInit { + const char **mechTypes; + int reqFlags; + DATA_BLOB mechToken; + DATA_BLOB mechListMIC; +} negTokenInit_t; + +typedef struct spnego_negTokenTarg { + uint8 negResult; + const char *supportedMech; + DATA_BLOB responseToken; + DATA_BLOB mechListMIC; +} negTokenTarg_t; + +typedef struct spnego_spnego { + int type; + negTokenInit_t negTokenInit; + negTokenTarg_t negTokenTarg; +} SPNEGO_DATA; + +#endif diff --git a/source3/include/trans2.h b/source3/include/trans2.h index eb5b1bc79f..168e647721 100644 --- a/source3/include/trans2.h +++ b/source3/include/trans2.h @@ -230,6 +230,8 @@ Byte offset Type name description #define SMB_FIND_FILE_FULL_DIRECTORY_INFO 0x102 #define SMB_FIND_FILE_NAMES_INFO 0x103 #define SMB_FIND_FILE_BOTH_DIRECTORY_INFO 0x104 +#define SMB_FIND_FILE_LEVEL_261 0x105 +#define SMB_FIND_FILE_LEVEL_262 0x106 #define SMB_SET_FILE_BASIC_INFO 0x101 #define SMB_SET_FILE_DISPOSITION_INFO 0x102 diff --git a/source3/include/version.h b/source3/include/version.h index 68bc140daf..51e8c408e6 100644 --- a/source3/include/version.h +++ b/source3/include/version.h @@ -1 +1,8 @@ -#define VERSION "3.0.0rc1" +/* Autogenerated by script/mkversion.sh */ +#define SAMBA_VERSION_MAJOR 3 +#define SAMBA_VERSION_MINOR 0 +#define SAMBA_VERSION_RELEASE 1 +#define SAMBA_VERSION_PRE_RELEASE 1 +#define SAMBA_VERSION_IS_CVS_SNAPSHOT 1 +#define SAMBA_VERSION_OFFICIAL_STRING "CVS 3.0.1pre1" +#define SAMBA_VERSION_STRING samba_version_string() diff --git a/source3/include/vfs.h b/source3/include/vfs.h index 452f4dc23b..dd489702aa 100644 --- a/source3/include/vfs.h +++ b/source3/include/vfs.h @@ -50,8 +50,8 @@ /* Changed to version 6 for the new module system, fixed cascading and quota functions. --metze */ /* Changed to version 7 to include the get_nt_acl info parameter. JRA. */ /* Changed to version 8 includes EA calls. JRA. */ - -#define SMB_VFS_INTERFACE_VERSION 8 +/* Changed to version 9 to include the get_shadow_data call. --metze */ +#define SMB_VFS_INTERFACE_VERSION 9 /* to bug old modules witch are trying to compile with the old functions */ @@ -91,6 +91,8 @@ typedef enum _vfs_op_type { SMB_VFS_OP_DISK_FREE, SMB_VFS_OP_GET_QUOTA, SMB_VFS_OP_SET_QUOTA, + SMB_VFS_OP_GET_SHADOW_COPY_DATA, + /* Directory operations */ @@ -196,6 +198,7 @@ struct vfs_ops { SMB_BIG_UINT *dfree, SMB_BIG_UINT *dsize); int (*get_quota)(struct vfs_handle_struct *handle, struct connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *qt); int (*set_quota)(struct vfs_handle_struct *handle, struct connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *qt); + int (*get_shadow_copy_data)(struct vfs_handle_struct *handle, struct files_struct *fsp, SHADOW_COPY_DATA *shadow_copy_data, BOOL labels); /* Directory operations */ @@ -293,6 +296,7 @@ struct vfs_ops { struct vfs_handle_struct *disk_free; struct vfs_handle_struct *get_quota; struct vfs_handle_struct *set_quota; + struct vfs_handle_struct *get_shadow_copy_data; /* Directory operations */ @@ -379,6 +383,7 @@ struct vfs_ops { struct vfs_handle_struct *setxattr; struct vfs_handle_struct *lsetxattr; struct vfs_handle_struct *fsetxattr; + } handles; }; diff --git a/source3/include/vfs_macros.h b/source3/include/vfs_macros.h index fdbc1516e3..c4f63c352e 100644 --- a/source3/include/vfs_macros.h +++ b/source3/include/vfs_macros.h @@ -33,6 +33,7 @@ #define SMB_VFS_DISK_FREE(conn, path, small_query, bsize, dfree ,dsize) ((conn)->vfs.ops.disk_free((conn)->vfs.handles.disk_free, (conn), (path), (small_query), (bsize), (dfree), (dsize))) #define SMB_VFS_GET_QUOTA(conn, qtype, id, qt) ((conn)->vfs.ops.get_quota((conn)->vfs.handles.get_quota, (conn), (qtype), (id), (qt))) #define SMB_VFS_SET_QUOTA(conn, qtype, id, qt) ((conn)->vfs.ops.set_quota((conn)->vfs.handles.set_quota, (conn), (qtype), (id), (qt))) +#define SMB_VFS_GET_SHADOW_COPY_DATA(fsp,shadow_copy_data,labels) ((fsp)->conn->vfs.ops.get_shadow_copy_data((fsp)->conn->vfs.handles.get_shadow_copy_data,(fsp),(shadow_copy_data),(labels))) /* Directory operations */ #define SMB_VFS_OPENDIR(conn, fname) ((conn)->vfs.ops.opendir((conn)->vfs.handles.opendir, (conn), (fname))) @@ -128,6 +129,7 @@ #define SMB_VFS_OPAQUE_DISK_FREE(conn, path, small_query, bsize, dfree ,dsize) ((conn)->vfs_opaque.ops.disk_free((conn)->vfs_opaque.handles.disk_free, (conn), (path), (small_query), (bsize), (dfree), (dsize))) #define SMB_VFS_OPAQUE_GET_QUOTA(conn, qtype, id, qt) ((conn)->vfs_opaque.ops.get_quota((conn)->vfs_opaque.handles.get_quota, (conn), (qtype), (id), (qt))) #define SMB_VFS_OPAQUE_SET_QUOTA(conn, qtype, id, qt) ((conn)->vfs_opaque.ops.set_quota((conn)->vfs_opaque.handles.set_quota, (conn), (qtype), (id), (qt))) +#define SMB_VFS_OPAQUE_GET_SHADOW_COPY_DATA(fsp,shadow_copy_data,labels) ((fsp)->conn->vfs_opaque.ops.get_shadow_copy_data((fsp)->conn->vfs_opaque.handles.get_shadow_copy_data,(fsp),(shadow_copy_data),(labels))) /* Directory operations */ #define SMB_VFS_OPAQUE_OPENDIR(conn, fname) ((conn)->vfs_opaque.ops.opendir((conn)->vfs_opaque.handles.opendir, (conn), (fname))) @@ -223,6 +225,7 @@ #define SMB_VFS_NEXT_DISK_FREE(handle, conn, path, small_query, bsize, dfree ,dsize) ((handle)->vfs_next.ops.disk_free((handle)->vfs_next.handles.disk_free, (conn), (path), (small_query), (bsize), (dfree), (dsize))) #define SMB_VFS_NEXT_GET_QUOTA(handle, conn, qtype, id, qt) ((handle)->vfs_next.ops.get_quota((handle)->vfs_next.handles.get_quota, (conn), (qtype), (id), (qt))) #define SMB_VFS_NEXT_SET_QUOTA(handle, conn, qtype, id, qt) ((handle)->vfs_next.ops.set_quota((handle)->vfs_next.handles.set_quota, (conn), (qtype), (id), (qt))) +#define SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp, shadow_copy_data ,labels) ((handle)->vfs_next.ops.get_shadow_copy_data((handle)->vfs_next.handles.get_shadow_copy_data,(fsp),(shadow_copy_data),(labels))) /* Directory operations */ #define SMB_VFS_NEXT_OPENDIR(handle, conn, fname) ((handle)->vfs_next.ops.opendir((handle)->vfs_next.handles.opendir, (conn), (fname))) diff --git a/source3/intl/lang_tdb.c b/source3/intl/lang_tdb.c index 87ef4e39c7..f12b9b6f15 100644 --- a/source3/intl/lang_tdb.c +++ b/source3/intl/lang_tdb.c @@ -53,8 +53,8 @@ static BOOL load_msg(const char *msg_file) } if (msgid && strncmp(lines[i], "msgstr \"", 8) == 0) { msgstr = lines[i] + 8; - trim_string(msgid, NULL, "\""); - trim_string(msgstr, NULL, "\""); + trim_char(msgid, '\0', '\"'); + trim_char(msgstr, '\0', '\"'); if (*msgstr == 0) { msgstr = msgid; } diff --git a/source3/lib/access.c b/source3/lib/access.c index c30b3c33cc..a874c8b1e2 100644 --- a/source3/lib/access.c +++ b/source3/lib/access.c @@ -281,13 +281,12 @@ static BOOL only_ipaddrs_in_list(const char** list) } if (!is_ipaddress(*list)) { - char *p; /* * if we failed, make sure that it was not because the token * was a network/netmask pair. Only network/netmask pairs * have a '/' in them */ - if ((p=strchr_m(*list, '/')) == NULL) { + if ((strchr_m(*list, '/')) == NULL) { only_ip = False; DEBUG(3,("only_ipaddrs_in_list: list has non-ip address (%s)\n", *list)); break; diff --git a/source3/lib/afs.c b/source3/lib/afs.c new file mode 100644 index 0000000000..b96703e986 --- /dev/null +++ b/source3/lib/afs.c @@ -0,0 +1,248 @@ +/* + * Unix SMB/CIFS implementation. + * Generate AFS tickets + * Copyright (C) Volker Lendecke 2003 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "includes.h" + +#ifdef WITH_FAKE_KASERVER + +#include +#include +#include +#include +#include +#include + +_syscall5(int, afs_syscall, int, subcall, + char *, path, + int, cmd, + char *, cmarg, + int, follow); + +char *afs_cell(void) +{ + static char *cell = NULL; + + if (cell == NULL) { + cell = strdup(lp_realm()); + strlower_m(cell); + } + + return cell; +} + +struct ClearToken { + uint32 AuthHandle; + char HandShakeKey[8]; + uint32 ViceId; + uint32 BeginTimestamp; + uint32 EndTimestamp; +}; + +/* + Put an AFS token into the Kernel so that it can authenticate against + the AFS server. This assumes correct local uid settings. + + This is currently highly Linux and OpenAFS-specific. The correct API + call for this would be ktc_SetToken. But to do that we would have to + import a REALLY big bunch of libraries which I would currently like + to avoid. +*/ + +static BOOL afs_settoken(char *username, const struct ClearToken *ctok, + char *v4tkt_data, int v4tkt_length) +{ + int ret; + struct { + char *in, *out; + uint16 in_size, out_size; + } iob; + + char buf[1024]; + char *p = buf; + int tmp; + + memcpy(p, &v4tkt_length, sizeof(uint32)); + p += sizeof(uint32); + memcpy(p, v4tkt_data, v4tkt_length); + p += v4tkt_length; + + tmp = sizeof(struct ClearToken); + memcpy(p, &tmp, sizeof(uint32)); + p += sizeof(uint32); + memcpy(p, ctok, tmp); + p += tmp; + + tmp = 0; + + memcpy(p, &tmp, sizeof(uint32)); + p += sizeof(uint32); + + tmp = strlen(afs_cell()); + if (tmp >= MAXKTCREALMLEN) { + DEBUG(1, ("Realm too long\n")); + return False; + } + + strncpy(p, afs_cell(), tmp); + p += tmp; + *p = 0; + p +=1; + + iob.in = buf; + iob.in_size = PTR_DIFF(p,buf); + iob.out = buf; + iob.out_size = sizeof(buf); + +#if 0 + file_save("/tmp/ioctlbuf", iob.in, iob.in_size); +#endif + + ret = afs_syscall(AFSCALL_PIOCTL, 0, VIOCSETTOK, (char *)&iob, 0); + + DEBUG(10, ("afs VIOCSETTOK returned %d\n", ret)); + return (ret == 0); +} + +/* + This routine takes a radical approach completely defeating the + Kerberos idea of security and using AFS simply as an intelligent + file backend. Samba has persuaded itself somehow that the user is + actually correctly identified and then we create a ticket that the + AFS server hopefully accepts using its KeyFile that the admin has + kindly stored to our secrets.tdb. + + Thanks to the book "Network Security -- PRIVATE Communication in a + PUBLIC World" by Charlie Kaufman, Radia Perlman and Mike Speciner + Kerberos 4 tickets are not really hard to construct. + + For the comments "Alice" is the User to be auth'ed, and "Bob" is the + AFS server. */ + +BOOL afs_login(char *username) +{ + fstring ticket; + char *p = ticket; + uint32 len; + struct afs_key key; + + struct ClearToken ct; + + uint32 now; /* I assume time() returns 32 bit */ + + des_key_schedule key_schedule; + + DEBUG(10, ("Trying to log into AFS for user %s@%s\n", + username, afs_cell())); + + if (!secrets_init()) + return False; + + if (!secrets_fetch_afs_key(afs_cell(), &key)) { + DEBUG(5, ("Could not fetch AFS service key\n")); + return False; + } + + ct.AuthHandle = key.kvno; + + /* Build the ticket. This is going to be encrypted, so in our + way we fill in ct while we still have the unencrypted + form. */ + + p = ticket; + + /* The byte-order */ + *p = 1; + p += 1; + + /* "Alice", the client username */ + strncpy(p, username, sizeof(ticket)-PTR_DIFF(p,ticket)-1); + p += strlen(p)+1; + strncpy(p, "", sizeof(ticket)-PTR_DIFF(p,ticket)-1); + p += strlen(p)+1; + strncpy(p, afs_cell(), sizeof(ticket)-PTR_DIFF(p,ticket)-1); + p += strlen(p)+1; + + ct.ViceId = getuid(); + DEBUG(10, ("Creating Token for uid %d\n", ct.ViceId)); + + /* Alice's network layer address. At least Openafs-1.2.10 + ignores this, so we fill in a dummy value here. */ + SIVAL(p, 0, 0); + p += 4; + + /* We need to create a session key */ + generate_random_buffer(p, 8, False); + + /* Our client code needs the the key in the clear, it does not + know the server-key ... */ + memcpy(ct.HandShakeKey, p, 8); + + p += 8; + + /* Ticket lifetime. We fake everything here, so go as long as + possible. This is in 5-minute intervals, so 255 is 21 hours + and 15 minutes.*/ + *p = 255; + p += 1; + + /* Ticket creation time */ + now = time(NULL); + SIVAL(p, 0, now); + ct.BeginTimestamp = now; + + ct.EndTimestamp = now + (255*60*5); + if (((ct.EndTimestamp - ct.BeginTimestamp) & 1) == 1) { + ct.BeginTimestamp += 1; /* Lifetime must be even */ + } + p += 4; + + /* And here comes Bob's name and instance, in this case the + AFS server. */ + strncpy(p, "afs", sizeof(ticket)-PTR_DIFF(p,ticket)-1); + p += strlen(p)+1; + strncpy(p, "", sizeof(ticket)-PTR_DIFF(p,ticket)-1); + p += strlen(p)+1; + + /* And zero-pad to a multiple of 8 bytes */ + len = PTR_DIFF(p, ticket); + if (len & 7) { + uint32 extra_space = 8-(len & 7); + memset(p, 0, extra_space); + p+=extra_space; + } + len = PTR_DIFF(p, ticket); + + des_key_sched((const_des_cblock *)key.key, key_schedule); + des_pcbc_encrypt(ticket, ticket, + len, key_schedule, (C_Block *)key.key, 1); + + ZERO_STRUCT(key); + + return afs_settoken(username, &ct, ticket, len); +} + +#else + +BOOL afs_login(char *username) +{ + return True; +} + +#endif /* WITH_FAKE_KASERVER */ diff --git a/source3/lib/charcnv.c b/source3/lib/charcnv.c index ca5e378970..5f3cf64a68 100644 --- a/source3/lib/charcnv.c +++ b/source3/lib/charcnv.c @@ -40,7 +40,7 @@ static smb_iconv_t conv_handles[NUM_CHARSETS][NUM_CHARSETS]; - +static BOOL conv_silent; /* Should we do a debug if the conversion fails ? */ /** * Return the name of a charset to give to iconv(). @@ -141,21 +141,28 @@ void init_iconv(void) /* XXX: Does this really get called every time the dos * codepage changes? */ /* XXX: Is the did_reload test too strict? */ + conv_silent = True; init_doschar_table(); init_valid_table(); + conv_silent = False; } } /** * Convert string from one encoding to another, making error checking etc + * Slow path version - uses (slow) iconv. * * @param src pointer to source string (multibyte or singlebyte) * @param srclen length of the source string in bytes * @param dest pointer to destination string (multibyte or singlebyte) * @param destlen maximal length allowed for string * @returns the number of bytes occupied in the destination + * + * Ensure the srclen contains the terminating zero. + * **/ -size_t convert_string(charset_t from, charset_t to, + +static size_t convert_string_internal(charset_t from, charset_t to, void const *src, size_t srclen, void *dest, size_t destlen) { @@ -165,18 +172,14 @@ size_t convert_string(charset_t from, charset_t to, char* outbuf = (char*)dest; smb_iconv_t descriptor; - if (srclen == (size_t)-1) - srclen = strlen(src)+1; - lazy_initialize_conv(); descriptor = conv_handles[from][to]; if (descriptor == (smb_iconv_t)-1 || descriptor == (smb_iconv_t)0) { - /* conversion not supported, use as is */ - size_t len = MIN(srclen,destlen); - memcpy(dest,src,len); - return len; + if (!conv_silent) + DEBUG(0,("convert_string_internal: Conversion not supported.\n")); + goto use_as_is; } i_len=srclen; @@ -187,67 +190,208 @@ size_t convert_string(charset_t from, charset_t to, switch(errno) { case EINVAL: reason="Incomplete multibyte sequence"; - break; + if (!conv_silent) + DEBUG(3,("convert_string_internal: Conversion error: %s(%s)\n",reason,inbuf)); + goto use_as_is; case E2BIG: reason="No more room"; - DEBUG(0, ("convert_string: Required %lu, available %lu\n", - (unsigned long)srclen, (unsigned long)destlen)); + if (!conv_silent) + DEBUG(3, ("convert_string_internal: Required %lu, available %lu\n", + (unsigned long)srclen, (unsigned long)destlen)); /* we are not sure we need srclen bytes, may be more, may be less. We only know we need more than destlen bytes ---simo */ break; case EILSEQ: - reason="Illegal multibyte sequence"; - break; + reason="Illegal multibyte sequence"; + if (!conv_silent) + DEBUG(3,("convert_string_internal: Conversion error: %s(%s)\n",reason,inbuf)); + goto use_as_is; + default: + if (!conv_silent) + DEBUG(0,("convert_string_internal: Conversion error: %s(%s)\n",reason,inbuf)); + break; } /* smb_panic(reason); */ } return destlen-o_len; + + use_as_is: + + /* conversion not supported, use as is */ + { + size_t len = MIN(srclen,destlen); + if (len) + memcpy(dest,src,len); + return len; + } +} + +/** + * Convert string from one encoding to another, making error checking etc + * Fast path version - handles ASCII first. + * + * @param src pointer to source string (multibyte or singlebyte) + * @param srclen length of the source string in bytes + * @param dest pointer to destination string (multibyte or singlebyte) + * @param destlen maximal length allowed for string + * @returns the number of bytes occupied in the destination + * + * Ensure the srclen contains the terminating zero. + * + * This function has been hand-tuned to provide a fast path. + * Don't change unless you really know what you are doing. JRA. + **/ + +size_t convert_string(charset_t from, charset_t to, + void const *src, size_t srclen, + void *dest, size_t destlen) +{ + if (srclen == 0) + return 0; + + if (from != CH_UCS2 && to != CH_UCS2) { + const unsigned char *p = (const unsigned char *)src; + unsigned char *q = (unsigned char *)dest; + unsigned char lastp; + size_t retval = 0; + + /* If all characters are ascii, fast path here. */ + while (srclen && destlen) { + if ((lastp = *p) <= 0x7f) { + *q++ = *p++; + if (srclen != (size_t)-1) { + srclen--; + } + destlen--; + retval++; + if (!lastp) + break; + } else { + if (srclen == (size_t)-1) { + srclen = strlen(p)+1; + } + return retval + convert_string_internal(from, to, p, srclen, q, destlen); + } + } + return retval; + } else if (from == CH_UCS2 && to != CH_UCS2) { + const unsigned char *p = (const unsigned char *)src; + unsigned char *q = (unsigned char *)dest; + size_t retval = 0; + unsigned char lastp; + + /* If all characters are ascii, fast path here. */ + while ((srclen >= 2) && destlen) { + if ((lastp = *p) <= 0x7f && p[1] == 0) { + *q++ = *p; + if (srclen != (size_t)-1) { + srclen -= 2; + } + p += 2; + destlen--; + retval++; + if (!lastp) + break; + } else { + if (srclen == (size_t)-1) { + srclen = strlen_w((const void *)p)+2; + } + return retval + convert_string_internal(from, to, p, srclen, q, destlen); + } + } + return retval; + } else if (from != CH_UCS2 && to == CH_UCS2) { + const unsigned char *p = (const unsigned char *)src; + unsigned char *q = (unsigned char *)dest; + size_t retval = 0; + unsigned char lastp; + + /* If all characters are ascii, fast path here. */ + while (srclen && (destlen >= 2)) { + if ((lastp = *p) <= 0x7F) { + *q++ = *p++; + *q++ = '\0'; + if (srclen != (size_t)-1) { + srclen--; + } + destlen -= 2; + retval += 2; + if (!lastp) + break; + } else { + if (srclen == (size_t)-1) { + srclen = strlen(p)+1; + } + return retval + convert_string_internal(from, to, p, srclen, q, destlen); + } + } + return retval; + } + return convert_string_internal(from, to, src, srclen, dest, destlen); } /** * Convert between character sets, allocating a new buffer for the result. * + * @param ctx TALLOC_CTX to use to allocate with. If NULL use malloc. * @param srclen length of source buffer. * @param dest always set at least to NULL * @note -1 is not accepted for srclen. * * @returns Size in bytes of the converted string; or -1 in case of error. + * + * Ensure the srclen contains the terminating zero. **/ -size_t convert_string_allocate(charset_t from, charset_t to, +size_t convert_string_allocate(TALLOC_CTX *ctx, charset_t from, charset_t to, void const *src, size_t srclen, void **dest) { - size_t i_len, o_len, destlen; + size_t i_len, o_len, destlen = MAX(srclen, 512); size_t retval; const char *inbuf = (const char *)src; - char *outbuf, *ob; + char *outbuf = NULL, *ob = NULL; smb_iconv_t descriptor; *dest = NULL; if (src == NULL || srclen == (size_t)-1) return (size_t)-1; + if (srclen == 0) + return 0; lazy_initialize_conv(); descriptor = conv_handles[from][to]; if (descriptor == (smb_iconv_t)-1 || descriptor == (smb_iconv_t)0) { - /* conversion not supported, return -1*/ - DEBUG(3, ("convert_string_allocate: conversion not supported!\n")); - return -1; + if (!conv_silent) + DEBUG(0,("convert_string_allocate: Conversion not supported.\n")); + goto use_as_is; } - destlen = MAX(srclen, 512); - outbuf = NULL; convert: - destlen = destlen * 2; - ob = (char *)Realloc(outbuf, destlen); + if ((destlen*2) < destlen) { + /* wrapped ! abort. */ + if (!conv_silent) + DEBUG(0, ("convert_string_allocate: destlen wrapped !\n")); + if (!ctx) + SAFE_FREE(outbuf); + return (size_t)-1; + } else { + destlen = destlen * 2; + } + + if (ctx) + ob = (char *)talloc_realloc(ctx, ob, destlen); + else + ob = (char *)Realloc(ob, destlen); + if (!ob) { DEBUG(0, ("convert_string_allocate: realloc failed!\n")); - SAFE_FREE(outbuf); + if (!ctx) + SAFE_FREE(outbuf); return (size_t)-1; } else { outbuf = ob; @@ -262,27 +406,59 @@ convert: switch(errno) { case EINVAL: reason="Incomplete multibyte sequence"; - break; + if (!conv_silent) + DEBUG(3,("convert_string_allocate: Conversion error: %s(%s)\n",reason,inbuf)); + goto use_as_is; case E2BIG: goto convert; case EILSEQ: reason="Illegal multibyte sequence"; - break; + if (!conv_silent) + DEBUG(3,("convert_string_allocate: Conversion error: %s(%s)\n",reason,inbuf)); + goto use_as_is; } - DEBUG(0,("Conversion error: %s(%s)\n",reason,inbuf)); + if (!conv_silent) + DEBUG(0,("Conversion error: %s(%s)\n",reason,inbuf)); /* smb_panic(reason); */ return (size_t)-1; } destlen = destlen - o_len; - *dest = (char *)Realloc(ob,destlen); + if (ctx) + *dest = (char *)talloc_realloc(ctx,ob,destlen); + else + *dest = (char *)Realloc(ob,destlen); if (destlen && !*dest) { DEBUG(0, ("convert_string_allocate: out of memory!\n")); - SAFE_FREE(ob); + if (!ctx) + SAFE_FREE(ob); return (size_t)-1; } return destlen; + + use_as_is: + + /* conversion not supported, use as is */ + { + if (srclen && (destlen != srclen)) { + destlen = srclen; + if (ctx) + ob = (char *)talloc_realloc(ctx, ob, destlen); + else + ob = (char *)Realloc(ob, destlen); + if (!ob) { + DEBUG(0, ("convert_string_allocate: realloc failed!\n")); + if (!ctx) + SAFE_FREE(outbuf); + return (size_t)-1; + } + } + if (srclen && ob) + memcpy(ob,(const char *)src,srclen); + *dest = (char *)ob; + return srclen; + } } @@ -298,17 +474,12 @@ convert: static size_t convert_string_talloc(TALLOC_CTX *ctx, charset_t from, charset_t to, void const *src, size_t srclen, void **dest) { - void *alloced_string; size_t dest_len; - /* FIXME: Ridiculous to allocate two buffers and then copy the string! */ - *dest = NULL; - dest_len=convert_string_allocate(from, to, src, srclen, &alloced_string); + dest_len=convert_string_allocate(ctx, from, to, src, srclen, dest); if (dest_len == (size_t)-1) return (size_t)-1; - *dest = talloc_memdup(ctx, alloced_string, dest_len); - SAFE_FREE(alloced_string); if (*dest == NULL) return (size_t)-1; return dest_len; @@ -335,29 +506,49 @@ size_t unix_strupper(const char *src, size_t srclen, char *dest, size_t destlen) /** strdup() a unix string to upper case. + Max size is pstring. **/ char *strdup_upper(const char *s) { - size_t size; - smb_ucs2_t *buffer; - char *out_buffer; - - size = push_ucs2_allocate(&buffer, s); - if (size == -1) { - return NULL; + pstring out_buffer; + const unsigned char *p = (const unsigned char *)s; + unsigned char *q = (unsigned char *)out_buffer; + + /* this is quite a common operation, so we want it to be + fast. We optimise for the ascii case, knowing that all our + supported multi-byte character sets are ascii-compatible + (ie. they match for the first 128 chars) */ + + while (1) { + if (*p & 0x80) + break; + *q++ = toupper(*p); + if (!*p) + break; + p++; + if (p - ( const unsigned char *)s >= sizeof(pstring)) + break; } - strupper_w(buffer); - - size = pull_ucs2_allocate(&out_buffer, buffer); - SAFE_FREE(buffer); + if (*p) { + /* MB case. */ + size_t size; + wpstring buffer; + size = convert_string(CH_UNIX, CH_UCS2, s, -1, buffer, sizeof(buffer)); + if (size == -1) { + return NULL; + } - if (size == -1) { - return NULL; - } + strupper_w(buffer); - return out_buffer; + size = convert_string(CH_UCS2, CH_UNIX, buffer, sizeof(buffer), out_buffer, sizeof(out_buffer)); + if (size == -1) { + return NULL; + } + } + + return strdup(out_buffer); } size_t unix_strlower(const char *src, size_t srclen, char *dest, size_t destlen) @@ -365,7 +556,7 @@ size_t unix_strlower(const char *src, size_t srclen, char *dest, size_t destlen) size_t size; smb_ucs2_t *buffer; - size = convert_string_allocate(CH_UNIX, CH_UCS2, src, srclen, + size = convert_string_allocate(NULL, CH_UNIX, CH_UCS2, src, srclen, (void **) &buffer); if (size == -1) { smb_panic("failed to create UCS2 buffer"); @@ -459,6 +650,11 @@ size_t push_ascii_pstring(void *dest, const char *src) return push_ascii(dest, src, sizeof(pstring), STR_TERMINATE); } +size_t push_ascii_nstring(void *dest, const char *src) +{ + return push_ascii(dest, src, sizeof(nstring), STR_TERMINATE); +} + /** * Copy a string from a dos codepage source to a unix char* destination. * @@ -512,6 +708,11 @@ size_t pull_ascii_fstring(char *dest, const void *src) return pull_ascii(dest, src, sizeof(fstring), -1, STR_TERMINATE); } +size_t pull_ascii_nstring(char *dest, const void *src) +{ + return pull_ascii(dest, src, sizeof(nstring), sizeof(nstring), STR_TERMINATE); +} + /** * Copy a string from a char* src to a unicode destination. * @@ -528,22 +729,26 @@ size_t pull_ascii_fstring(char *dest, const void *src) * @param dest_len is the maximum length allowed in the * destination. If dest_len is -1 then no maxiumum is used. **/ + size_t push_ucs2(const void *base_ptr, void *dest, const char *src, size_t dest_len, int flags) { size_t len=0; - size_t src_len = strlen(src); + size_t src_len; /* treat a pstring as "unlimited" length */ if (dest_len == (size_t)-1) dest_len = sizeof(pstring); if (flags & STR_TERMINATE) - src_len++; + src_len = (size_t)-1; + else + src_len = strlen(src); if (ucs2_align(base_ptr, dest, flags)) { *(char *)dest = 0; dest = (void *)((char *)dest + 1); - if (dest_len) dest_len--; + if (dest_len) + dest_len--; len++; } @@ -599,7 +804,7 @@ size_t push_ucs2_allocate(smb_ucs2_t **dest, const char *src) size_t src_len = strlen(src)+1; *dest = NULL; - return convert_string_allocate(CH_UNIX, CH_UCS2, src, src_len, (void **)dest); + return convert_string_allocate(NULL, CH_UNIX, CH_UCS2, src, src_len, (void **)dest); } /** @@ -667,7 +872,7 @@ size_t push_utf8_allocate(char **dest, const char *src) size_t src_len = strlen(src)+1; *dest = NULL; - return convert_string_allocate(CH_UNIX, CH_UTF8, src, src_len, (void **)dest); + return convert_string_allocate(NULL, CH_UNIX, CH_UTF8, src, src_len, (void **)dest); } /** @@ -695,9 +900,8 @@ size_t pull_ucs2(const void *base_ptr, char *dest, const void *src, size_t dest_ } if (flags & STR_TERMINATE) { - if (src_len == (size_t)-1) { - src_len = strlen_w(src)*2 + 2; - } else { + /* src_len -1 is the default for null terminated strings. */ + if (src_len != (size_t)-1) { size_t len = strnlen_w(src, src_len/2); if (len < src_len/2) len++; @@ -755,7 +959,7 @@ size_t pull_ucs2_allocate(char **dest, const smb_ucs2_t *src) { size_t src_len = (strlen_w(src)+1) * sizeof(smb_ucs2_t); *dest = NULL; - return convert_string_allocate(CH_UCS2, CH_UNIX, src, src_len, (void **)dest); + return convert_string_allocate(NULL, CH_UCS2, CH_UNIX, src, src_len, (void **)dest); } /** @@ -785,7 +989,7 @@ size_t pull_utf8_allocate(void **dest, const char *src) { size_t src_len = strlen(src)+1; *dest = NULL; - return convert_string_allocate(CH_UTF8, CH_UNIX, src, src_len, dest); + return convert_string_allocate(NULL, CH_UTF8, CH_UNIX, src, src_len, dest); } /** @@ -845,8 +1049,10 @@ size_t push_string_fn(const char *function, unsigned int line, const void *base_ size_t pull_string_fn(const char *function, unsigned int line, const void *base_ptr, char *dest, const void *src, size_t dest_len, size_t src_len, int flags) { +#ifdef DEVELOPER if (dest_len != (size_t)-1) clobber_region(function, line, dest, dest_len); +#endif if (!(flags & STR_ASCII) && \ ((flags & STR_UNICODE || \ @@ -865,4 +1071,3 @@ size_t align_string(const void *base_ptr, const char *p, int flags) } return 0; } - diff --git a/source3/lib/dummyroot.c b/source3/lib/dummyroot.c new file mode 100644 index 0000000000..c8465cb791 --- /dev/null +++ b/source3/lib/dummyroot.c @@ -0,0 +1,33 @@ +/* + Unix SMB/CIFS implementation. + RPC pipe client + + Copyright (C) Tim Potter 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +/* Stupid dummy functions required due to the horrible dependency mess + in Samba. */ + +void become_root(void) +{ + return; +} + +void unbecome_root(void) +{ + return; +} diff --git a/source3/lib/fault.c b/source3/lib/fault.c index a9e1b7bbb9..df7830ef83 100644 --- a/source3/lib/fault.c +++ b/source3/lib/fault.c @@ -34,7 +34,7 @@ static void fault_report(int sig) counter++; DEBUG(0,("===============================================================\n")); - DEBUG(0,("INTERNAL ERROR: Signal %d in pid %d (%s)",sig,(int)sys_getpid(),VERSION)); + DEBUG(0,("INTERNAL ERROR: Signal %d in pid %d (%s)",sig,(int)sys_getpid(),SAMBA_VERSION_STRING)); DEBUG(0,("\nPlease read the appendix Bugs of the Samba HOWTO collection\n")); DEBUG(0,("===============================================================\n")); diff --git a/source3/lib/gencache.c b/source3/lib/gencache.c index f3740e3e12..da8808af16 100644 --- a/source3/lib/gencache.c +++ b/source3/lib/gencache.c @@ -121,10 +121,11 @@ BOOL gencache_set(const char *keystr, const char *value, time_t timeout) keybuf.dsize = strlen(keystr)+1; databuf.dptr = strdup(valstr); databuf.dsize = strlen(valstr)+1; - DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout \ - = %s (%d seconds %s)\n", keybuf.dptr, value, ctime(&timeout), - (int)(timeout - time(NULL)), timeout > time(NULL) ? "ahead" : "in the past")); - + DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout =" + " %s (%d seconds %s)\n", keybuf.dptr, value,ctime(&timeout), + (int)(timeout - time(NULL)), + timeout > time(NULL) ? "ahead" : "in the past")); + ret = tdb_store(cache, keybuf, databuf, 0); SAFE_FREE(valstr); SAFE_FREE(keybuf.dptr); diff --git a/source3/lib/hash.c b/source3/lib/hash.c index c7b1493b4c..18b6534dec 100644 --- a/source3/lib/hash.c +++ b/source3/lib/hash.c @@ -84,21 +84,20 @@ BOOL hash_table_init(hash_table *table, unsigned num_buckets, compare_function c * For the last few chars that cannot be int'ed, use char instead. * The function returns the bucket index number for the hashed * key. + * JRA. Use a djb-algorithm hash for speed. ************************************************************** */ static int string_hash(int hash_size, const char *key) { - u32 value; /* Used to compute the hash value. */ - u32 i; /* Used to cycle through random values. */ - - for (value = 0x238F13AF, i=0; key[i]; i++) - value = (value + (key[i] << (i*5 % 24))); - - return (1103515243 * value + 12345) % hash_size; + u32 n = 0; + const char *p; + for (p = key; *p != '\0'; p++) { + n = ((n << 5) + n) ^ (u32)(*p); + } + return (n % hash_size); } - /* ************************************************************************* * Search the hash table for the entry in the hash chain. * The function returns the pointer to the diff --git a/source3/lib/module.c b/source3/lib/module.c index ac4fe57a2c..e2c6f6dcf5 100644 --- a/source3/lib/module.c +++ b/source3/lib/module.c @@ -23,7 +23,11 @@ #include "includes.h" #ifdef HAVE_DLOPEN -NTSTATUS smb_load_module(const char *module_name) + +/* Load a dynamic module. Only log a level 0 error if we are not checking + for the existence of a module (probling). */ + +static NTSTATUS do_smb_load_module(const char *module_name, BOOL is_probe) { void *handle; init_module_function *init; @@ -37,17 +41,21 @@ NTSTATUS smb_load_module(const char *module_name) handle = sys_dlopen(module_name, RTLD_LAZY); if(!handle) { - DEBUG(0, ("Error loading module '%s': %s\n", module_name, sys_dlerror())); + int level = is_probe ? 2 : 0; + DEBUG(level, ("Error loading module '%s': %s\n", module_name, + sys_dlerror())); + return NT_STATUS_UNSUCCESSFUL; } - init = sys_dlsym(handle, "init_module"); + init = (init_module_function *)sys_dlsym(handle, "init_module"); /* we must check sys_dlerror() to determine if it worked, because sys_dlsym() can validly return NULL */ error = sys_dlerror(); if (error) { - DEBUG(0, ("Error trying to resolve symbol 'init_module' in %s: %s\n", module_name, error)); + DEBUG(0, ("Error trying to resolve symbol 'init_module' in %s: %s\n", + module_name, error)); return NT_STATUS_UNSUCCESSFUL; } @@ -58,6 +66,11 @@ NTSTATUS smb_load_module(const char *module_name) return status; } +NTSTATUS smb_load_module(const char *module_name) +{ + return do_smb_load_module(module_name, False); +} + /* Load all modules in list and return number of * modules that has been successfully loaded */ int smb_load_modules(const char **modules) @@ -85,8 +98,11 @@ NTSTATUS smb_probe_module(const char *subsystem, const char *module) /* if we make any 'samba multibyte string' calls here, we break for loading string modules */ + + DEBUG(5, ("Probing module '%s'\n", module)); + if (module[0] == '/') - return smb_load_module(module); + return do_smb_load_module(module, True); pstrcpy(full_path, lib_path(subsystem)); pstrcat(full_path, "/"); @@ -94,9 +110,9 @@ NTSTATUS smb_probe_module(const char *subsystem, const char *module) pstrcat(full_path, "."); pstrcat(full_path, shlib_ext()); - DEBUG(5, ("Probing module %s: Trying to load from %s\n", module, full_path)); + DEBUG(5, ("Probing module '%s': Trying to load from %s\n", module, full_path)); - return smb_load_module(full_path); + return do_smb_load_module(full_path, True); } #else /* HAVE_DLOPEN */ diff --git a/source3/lib/ms_fnmatch.c b/source3/lib/ms_fnmatch.c index 106efa5bbc..24232c3b52 100644 --- a/source3/lib/ms_fnmatch.c +++ b/source3/lib/ms_fnmatch.c @@ -35,7 +35,8 @@ of the protocol. This is not yet perfect, but its a lot better than what we had */ static int ms_fnmatch_lanman_core(const smb_ucs2_t *pattern, - const smb_ucs2_t *string) + const smb_ucs2_t *string, + BOOL case_sensitive) { const smb_ucs2_t *p = pattern, *n = string; smb_ucs2_t c; @@ -61,8 +62,8 @@ static int ms_fnmatch_lanman_core(const smb_ucs2_t *pattern, case UCS2_CHAR('>'): if (! *n) goto next; if (n[0] == UCS2_CHAR('.')) { - if (! n[1] && ms_fnmatch_lanman_core(p, n+1) == 0) goto match; - if (ms_fnmatch_lanman_core(p, n) == 0) goto match; + if (! n[1] && ms_fnmatch_lanman_core(p, n+1, case_sensitive) == 0) goto match; + if (ms_fnmatch_lanman_core(p, n, case_sensitive) == 0) goto match; goto nomatch; } n++; @@ -72,13 +73,13 @@ static int ms_fnmatch_lanman_core(const smb_ucs2_t *pattern, if (! *n) goto next; if (! *p) goto match; for (; *n; n++) { - if (ms_fnmatch_lanman_core(p, n) == 0) goto match; + if (ms_fnmatch_lanman_core(p, n, case_sensitive) == 0) goto match; } break; case UCS2_CHAR('<'): for (; *n; n++) { - if (ms_fnmatch_lanman_core(p, n) == 0) goto match; + if (ms_fnmatch_lanman_core(p, n, case_sensitive) == 0) goto match; if (*n == UCS2_CHAR('.') && !strchr_w(n+1,UCS2_CHAR('.'))) { n++; @@ -88,13 +89,17 @@ static int ms_fnmatch_lanman_core(const smb_ucs2_t *pattern, break; case UCS2_CHAR('"'): - if (*n == 0 && ms_fnmatch_lanman_core(p, n) == 0) goto match; + if (*n == 0 && ms_fnmatch_lanman_core(p, n, case_sensitive) == 0) goto match; if (*n != UCS2_CHAR('.')) goto nomatch; n++; break; default: - if (c != *n) goto nomatch; + if (case_sensitive) { + if (c != *n) goto nomatch; + } else { + if (tolower_w(c) != tolower_w(*n)) goto nomatch; + } n++; } } @@ -108,7 +113,7 @@ static int ms_fnmatch_lanman_core(const smb_ucs2_t *pattern, return -1; next: - if (ms_fnmatch_lanman_core(p, n) == 0) goto match; + if (ms_fnmatch_lanman_core(p, n, case_sensitive) == 0) goto match; goto nomatch; match: @@ -118,7 +123,8 @@ next: return 0; } -static int ms_fnmatch_lanman1(const smb_ucs2_t *pattern, const smb_ucs2_t *string) +static int ms_fnmatch_lanman1(const smb_ucs2_t *pattern, + const smb_ucs2_t *string, BOOL case_sensitive) { if (!strpbrk_wa(pattern, "?*<>\"")) { smb_ucs2_t s[] = {UCS2_CHAR('.'), 0}; @@ -129,11 +135,11 @@ static int ms_fnmatch_lanman1(const smb_ucs2_t *pattern, const smb_ucs2_t *strin if (strcmp_wa(string,"..") == 0 || strcmp_wa(string,".") == 0) { smb_ucs2_t dot[] = {UCS2_CHAR('.'), 0}; smb_ucs2_t dotdot[] = {UCS2_CHAR('.'), UCS2_CHAR('.'), 0}; - return ms_fnmatch_lanman_core(pattern, dotdot) && - ms_fnmatch_lanman_core(pattern, dot); + return ms_fnmatch_lanman_core(pattern, dotdot, case_sensitive) && + ms_fnmatch_lanman_core(pattern, dot, case_sensitive); } - return ms_fnmatch_lanman_core(pattern, string); + return ms_fnmatch_lanman_core(pattern, string, case_sensitive); } @@ -145,13 +151,14 @@ static int ms_fnmatch_lanman1(const smb_ucs2_t *pattern, const smb_ucs2_t *strin Returns 0 on match, -1 on fail. */ -static int ms_fnmatch_w(const smb_ucs2_t *pattern, const smb_ucs2_t *string, int protocol) +static int ms_fnmatch_w(const smb_ucs2_t *pattern, const smb_ucs2_t *string, + int protocol, BOOL case_sensitive) { const smb_ucs2_t *p = pattern, *n = string; smb_ucs2_t c; if (protocol <= PROTOCOL_LANMAN2) { - return ms_fnmatch_lanman1(pattern, string); + return ms_fnmatch_lanman1(pattern, string, case_sensitive); } while ((c = *p++)) { @@ -163,23 +170,23 @@ static int ms_fnmatch_w(const smb_ucs2_t *pattern, const smb_ucs2_t *string, int case UCS2_CHAR('>'): if (n[0] == UCS2_CHAR('.')) { - if (! n[1] && ms_fnmatch_w(p, n+1, protocol) == 0) return 0; - if (ms_fnmatch_w(p, n, protocol) == 0) return 0; + if (! n[1] && ms_fnmatch_w(p, n+1, protocol, case_sensitive) == 0) return 0; + if (ms_fnmatch_w(p, n, protocol, case_sensitive) == 0) return 0; return -1; } - if (! *n) return ms_fnmatch_w(p, n, protocol); + if (! *n) return ms_fnmatch_w(p, n, protocol, case_sensitive); n++; break; case UCS2_CHAR('*'): for (; *n; n++) { - if (ms_fnmatch_w(p, n, protocol) == 0) return 0; + if (ms_fnmatch_w(p, n, protocol, case_sensitive) == 0) return 0; } break; case UCS2_CHAR('<'): for (; *n; n++) { - if (ms_fnmatch_w(p, n, protocol) == 0) return 0; + if (ms_fnmatch_w(p, n, protocol, case_sensitive) == 0) return 0; if (*n == UCS2_CHAR('.') && !strchr_wa(n+1,'.')) { n++; break; @@ -188,13 +195,17 @@ static int ms_fnmatch_w(const smb_ucs2_t *pattern, const smb_ucs2_t *string, int break; case UCS2_CHAR('"'): - if (*n == 0 && ms_fnmatch_w(p, n, protocol) == 0) return 0; + if (*n == 0 && ms_fnmatch_w(p, n, protocol, case_sensitive) == 0) return 0; if (*n != UCS2_CHAR('.')) return -1; n++; break; default: - if (c != *n) return -1; + if (case_sensitive) { + if (c != *n) return -1; + } else { + if (tolower_w(c) != tolower_w(*n)) return -1; + } n++; } } @@ -204,22 +215,35 @@ static int ms_fnmatch_w(const smb_ucs2_t *pattern, const smb_ucs2_t *string, int return -1; } - -int ms_fnmatch(const char *pattern, const char *string, int protocol) +int ms_fnmatch(const char *pattern, const char *string, int protocol, + BOOL case_senstive) { - wpstring p, s; + wpstring buffer_pattern, buffer_string; int ret; + size_t size; + + size = push_ucs2(NULL, buffer_pattern, pattern, sizeof(buffer_pattern), STR_TERMINATE); + if (size == (size_t)-1) { + return -1; + /* Not quite the right answer, but finding the right one + under this failure case is expensive, and it's pretty close */ + } + + size = push_ucs2(NULL, buffer_string, string, sizeof(buffer_string), STR_TERMINATE); + if (size == (size_t)-1) { + return -1; + /* Not quite the right answer, but finding the right one + under this failure case is expensive, and it's pretty close */ + } - pstrcpy_wa(p, pattern); - pstrcpy_wa(s, string); + ret = ms_fnmatch_w(buffer_pattern, buffer_string, protocol, case_senstive); + DEBUG(10,("ms_fnmatch(%s,%s) -> %d\n", pattern, string, ret)); - ret = ms_fnmatch_w(p, s, protocol); -/* DEBUG(0,("ms_fnmatch(%s,%s) -> %d\n", pattern, string, ret)); */ return ret; } /* a generic fnmatch function - uses for non-CIFS pattern matching */ int gen_fnmatch(const char *pattern, const char *string) { - return ms_fnmatch(pattern, string, PROTOCOL_NT1); + return ms_fnmatch(pattern, string, PROTOCOL_NT1, True); } diff --git a/source3/lib/popt_common.c b/source3/lib/popt_common.c index af1cbcfe80..9a5a112022 100644 --- a/source3/lib/popt_common.c +++ b/source3/lib/popt_common.c @@ -69,7 +69,7 @@ static void popt_common_callback(poptContext con, break; case 'V': - printf( "Version %s\n", VERSION ); + printf( "Version %s\n", SAMBA_VERSION_STRING); exit(0); break; @@ -119,6 +119,7 @@ struct poptOption popt_common_connection[] = { { "netbiosname", 'n', POPT_ARG_STRING, NULL, 'n', "Primary netbios name", "NETBIOSNAME" }, { "workgroup", 'W', POPT_ARG_STRING, NULL, 'W', "Set the workgroup name", "WORKGROUP" }, { "scope", 'i', POPT_ARG_STRING, NULL, 'i', "Use this Netbios scope", "SCOPE" }, + POPT_TABLEEND }; @@ -259,6 +260,7 @@ static void get_credentials_file(const char *file, struct user_auth_info *info) * -k,--use-kerberos * -N,--no-pass * -S,--signing + * -P --machine-pass */ @@ -335,7 +337,8 @@ static void popt_common_credentials_callback(poptContext con, cmdline_auth_info.signing_state = -1; if (strequal(arg, "off") || strequal(arg, "no") || strequal(arg, "false")) cmdline_auth_info.signing_state = False; - else if (strequal(arg, "on") || strequal(arg, "yes") || strequal(arg, "true")) + else if (strequal(arg, "on") || strequal(arg, "yes") || strequal(arg, "true") || + strequal(arg, "auto") ) cmdline_auth_info.signing_state = True; else if (strequal(arg, "force") || strequal(arg, "required") || strequal(arg, "forced")) cmdline_auth_info.signing_state = Required; @@ -345,6 +348,33 @@ static void popt_common_credentials_callback(poptContext con, } } break; + case 'P': + { + char *opt_password = NULL; + /* it is very useful to be able to make ads queries as the + machine account for testing purposes and for domain leave */ + + if (!secrets_init()) { + d_printf("ERROR: Unable to open secrets database\n"); + exit(1); + } + + opt_password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); + + if (!opt_password) { + d_printf("ERROR: Unable to fetch machine password\n"); + exit(1); + } + pstr_sprintf(cmdline_auth_info.username, "%s$", + global_myname()); + pstrcpy(cmdline_auth_info.password,opt_password); + SAFE_FREE(opt_password); + + /* machine accounts only work with kerberos */ + cmdline_auth_info.use_kerberos = True; + cmdline_auth_info.got_pass = True; + } + break; } } @@ -357,5 +387,6 @@ struct poptOption popt_common_credentials[] = { { "kerberos", 'k', POPT_ARG_NONE, &cmdline_auth_info.use_kerberos, 'k', "Use kerberos (active directory) authentication" }, { "authentication-file", 'A', POPT_ARG_STRING, NULL, 'A', "Get the credentials from a file", "FILE" }, { "signing", 'S', POPT_ARG_STRING, NULL, 'S', "Set the client signing state", "on|off|required" }, + {"machine-pass", 'P', POPT_ARG_NONE, NULL, 'P', "Use stored machine account password" }, POPT_TABLEEND }; diff --git a/source3/lib/readline.c b/source3/lib/readline.c index ceb02ef749..78b99fd7fb 100644 --- a/source3/lib/readline.c +++ b/source3/lib/readline.c @@ -51,7 +51,7 @@ ****************************************************************************/ static char *smb_readline_replacement(char *prompt, void (*callback)(void), - char **(completion_fn)(char *text, int start, int end)) + char **(completion_fn)(const char *text, int start, int end)) { fd_set fds; static pstring line; @@ -83,7 +83,7 @@ static char *smb_readline_replacement(char *prompt, void (*callback)(void), ****************************************************************************/ char *smb_readline(char *prompt, void (*callback)(void), - char **(completion_fn)(char *text, int start, int end)) + char **(completion_fn)(const char *text, int start, int end)) { #if HAVE_LIBREADLINE if (isatty(x_fileno(x_stdin))) { diff --git a/source3/lib/replace1.c b/source3/lib/replace1.c new file mode 100644 index 0000000000..e1be56eb12 --- /dev/null +++ b/source3/lib/replace1.c @@ -0,0 +1,42 @@ +/* + Unix SMB/CIFS implementation. + replacement routines for broken systems + Copyright (C) Andrew Tridgell 1992-1998 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" + + void replace1_dummy(void); + void replace1_dummy(void) {} + +#ifndef HAVE_SETENV + int setenv(const char *name, const char *value, int overwrite) +{ + char *p = NULL; + int ret = -1; + + asprintf(&p, "%s=%s", name, value); + + if (overwrite || getenv(name)) { + if (p) ret = putenv(p); + } else { + ret = 0; + } + + return ret; +} +#endif diff --git a/source3/lib/smbldap.c b/source3/lib/smbldap.c index 3f56d066ec..1ce03491da 100644 --- a/source3/lib/smbldap.c +++ b/source3/lib/smbldap.c @@ -1172,6 +1172,9 @@ static NTSTATUS add_new_domain_info(struct smbldap_state *ldap_state, LDAPMessage *result = NULL; int num_result; char **attr_list; + uid_t u_low, u_high; + gid_t g_low, g_high; + uint32 rid_low, rid_high; slprintf (filter, sizeof (filter) - 1, "(&(%s=%s)(objectclass=%s))", get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN), @@ -1217,6 +1220,30 @@ static NTSTATUS add_new_domain_info(struct smbldap_state *ldap_state, smbldap_set_mod(&mods, LDAP_MOD_ADD, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_ALGORITHMIC_RID_BASE), algorithmic_rid_base_string); smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_DOMINFO); + + /* add the sambaNext[User|Group]Rid attributes if the idmap ranges are set. + TODO: fix all the places where the line between idmap and normal operations + needed by smbd gets fuzzy --jerry 2003-08-11 */ + + if ( lp_idmap_uid(&u_low, &u_high) && lp_idmap_gid(&g_low, &g_high) + && get_free_rid_range(&rid_low, &rid_high) ) + { + fstring rid_str; + + fstr_sprintf( rid_str, "%i", rid_high|USER_RID_TYPE ); + DEBUG(10,("setting next available user rid [%s]\n", rid_str)); + smbldap_set_mod(&mods, LDAP_MOD_ADD, + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_USERRID), + rid_str); + + fstr_sprintf( rid_str, "%i", rid_high|GROUP_RID_TYPE ); + DEBUG(10,("setting next available group rid [%s]\n", rid_str)); + smbldap_set_mod(&mods, LDAP_MOD_ADD, + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_GROUPRID), + rid_str); + + } + switch(ldap_op) { diff --git a/source3/lib/substitute.c b/source3/lib/substitute.c index c0d0096806..28466e43f2 100644 --- a/source3/lib/substitute.c +++ b/source3/lib/substitute.c @@ -57,7 +57,7 @@ void set_local_machine_name(const char* local_name, BOOL perm) already_perm = perm; fstrcpy(tmp_local_machine,local_name); - trim_string(tmp_local_machine," "," "); + trim_char(tmp_local_machine,' ',' '); alpha_strcpy(local_machine,tmp_local_machine,SAFE_NETBIOS_CHARS,sizeof(local_machine)-1); strlower_m(local_machine); } @@ -79,7 +79,7 @@ void set_remote_machine_name(const char* remote_name, BOOL perm) already_perm = perm; fstrcpy(tmp_remote_machine,remote_name); - trim_string(tmp_remote_machine," "," "); + trim_char(tmp_remote_machine,' ',' '); alpha_strcpy(remote_machine,tmp_remote_machine,SAFE_NETBIOS_CHARS,sizeof(remote_machine)-1); strlower_m(remote_machine); } @@ -98,23 +98,36 @@ const char* get_local_machine_name(void) return local_machine; } +/******************************************************************* + Setup the string used by %U substitution. +********************************************************************/ -/* - setup the string used by %U substitution -*/ void sub_set_smb_name(const char *name) { fstring tmp; /* don't let anonymous logins override the name */ - if (! *name) return; + if (! *name) + return; fstrcpy(tmp,name); - trim_string(tmp," "," "); + trim_char(tmp,' ',' '); strlower_m(tmp); alpha_strcpy(smb_user_name,tmp,SAFE_NETBIOS_CHARS,sizeof(smb_user_name)-1); } +/******************************************************************* + Setup the strings used by substitutions. Called per packet. Ensure + %U name is set correctly also. +********************************************************************/ + +void set_current_user_info(const userdom_struct *pcui) +{ + current_user_info = *pcui; + /* The following is safe as current_user_info.smb_name + * has already been sanitised in register_vuid. */ + fstrcpy(smb_user_name, current_user_info.smb_name); +} /******************************************************************* Given a pointer to a %$(NAME) expand it as an environment variable. @@ -384,7 +397,7 @@ void standard_sub_basic(const char *smb_name, char *str,size_t len) string_sub(p,"%m", get_remote_machine_name(),l); break; case 'v' : - string_sub(p,"%v", VERSION,l); + string_sub(p,"%v", SAMBA_VERSION_STRING,l); break; case '$' : p += expand_env_var(p,l); @@ -539,7 +552,7 @@ char *alloc_sub_basic(const char *smb_name, const char *str) t = realloc_string_sub(t, "%m", remote_machine); break; case 'v' : - t = realloc_string_sub(t, "%v", VERSION); + t = realloc_string_sub(t, "%v", SAMBA_VERSION_STRING); break; case '$' : t = realloc_expand_env_var(t, p); /* Expand environment variables */ diff --git a/source3/lib/system.c b/source3/lib/system.c index a7024c852d..b020a20373 100644 --- a/source3/lib/system.c +++ b/source3/lib/system.c @@ -1263,6 +1263,16 @@ ssize_t sys_getxattr (const char *path, const char *name, void *value, size_t si { #if defined(HAVE_GETXATTR) return getxattr(path, name, value, size); +#elif defined(HAVE_ATTR_GET) + int retval, flags = 0; + int valuelength = (int)size; + char *attrname = strchr(name,'.') +1; + + if (strncmp(name, "system", 6) == 0) flags |= ATTR_ROOT; + + retval = attr_get(path, attrname, (char *)value, &valuelength, flags); + + return retval ? retval : valuelength; #else errno = ENOSYS; return -1; @@ -1273,6 +1283,16 @@ ssize_t sys_lgetxattr (const char *path, const char *name, void *value, size_t s { #if defined(HAVE_LGETXATTR) return lgetxattr(path, name, value, size); +#elif defined(HAVE_ATTR_GET) + int retval, flags = ATTR_DONTFOLLOW; + int valuelength = (int)size; + char *attrname = strchr(name,'.') +1; + + if (strncmp(name, "system", 6) == 0) flags |= ATTR_ROOT; + + retval = attr_get(path, attrname, (char *)value, &valuelength, flags); + + return retval ? retval : valuelength; #else errno = ENOSYS; return -1; @@ -1283,16 +1303,96 @@ ssize_t sys_fgetxattr (int filedes, const char *name, void *value, size_t size) { #if defined(HAVE_FGETXATTR) return fgetxattr(filedes, name, value, size); +#elif defined(HAVE_ATTR_GETF) + int retval, flags = 0; + int valuelength = (int)size; + char *attrname = strchr(name,'.') +1; + + if (strncmp(name, "system", 6) == 0) flags |= ATTR_ROOT; + + retval = attr_getf(filedes, attrname, (char *)value, &valuelength, flags); + + return retval ? retval : valuelength; #else errno = ENOSYS; return -1; #endif } +#if defined(HAVE_ATTR_LIST) +static char attr_buffer[ATTR_MAX_VALUELEN]; + +static ssize_t irix_attr_list(const char *path, int filedes, char *list, size_t size, int flags) +{ + int retval = 0, index; + attrlist_cursor_t *cursor = 0; + int total_size = 0; + attrlist_t * al = (attrlist_t *)attr_buffer; + attrlist_ent_t *ae; + size_t ent_size, left = size; + char *bp = list; + + while (True) { + if (filedes) + retval = attr_listf(filedes, attr_buffer, ATTR_MAX_VALUELEN, flags, cursor); + else + retval = attr_list(path, attr_buffer, ATTR_MAX_VALUELEN, flags, cursor); + if (retval) break; + for (index = 0; index < al->al_count; index++) { + ae = ATTR_ENTRY(attr_buffer, index); + ent_size = strlen(ae->a_name) + sizeof("user."); + if (left >= ent_size) { + strncpy(bp, "user.", sizeof("user.")); + strncat(bp, ae->a_name, ent_size - sizeof("user.")); + bp += ent_size; + left -= ent_size; + } else if (size) { + errno = ERANGE; + retval = -1; + break; + } + total_size += ent_size; + } + if (al->al_more == 0) break; + } + if (retval == 0) { + flags |= ATTR_ROOT; + cursor = 0; + while (True) { + if (filedes) + retval = attr_listf(filedes, attr_buffer, ATTR_MAX_VALUELEN, flags, cursor); + else + retval = attr_list(path, attr_buffer, ATTR_MAX_VALUELEN, flags, cursor); + if (retval) break; + for (index = 0; index < al->al_count; index++) { + ae = ATTR_ENTRY(attr_buffer, index); + ent_size = strlen(ae->a_name) + sizeof("system."); + if (left >= ent_size) { + strncpy(bp, "system.", sizeof("system.")); + strncat(bp, ae->a_name, ent_size - sizeof("system.")); + bp += ent_size; + left -= ent_size; + } else if (size) { + errno = ERANGE; + retval = -1; + break; + } + total_size += ent_size; + } + if (al->al_more == 0) break; + } + } + return (ssize_t)(retval ? retval : total_size); +} + +#endif + ssize_t sys_listxattr (const char *path, char *list, size_t size) { #if defined(HAVE_LISTXATTR) return listxattr(path, list, size); +#elif defined(HAVE_ATTR_LIST) + return irix_attr_list(path, 0, list, size, 0); #else errno = ENOSYS; return -1; @@ -1301,8 +1401,10 @@ ssize_t sys_listxattr (const char *path, char *list, size_t size) ssize_t sys_llistxattr (const char *path, char *list, size_t size) { -#if defined(HAVE_GETXATTR) +#if defined(HAVE_LLISTXATTR) return llistxattr(path, list, size); +#elif defined(HAVE_ATTR_LIST) + return irix_attr_list(path, 0, list, size, ATTR_DONTFOLLOW); #else errno = ENOSYS; return -1; @@ -1313,6 +1415,8 @@ ssize_t sys_flistxattr (int filedes, char *list, size_t size) { #if defined(HAVE_FLISTXATTR) return flistxattr(filedes, list, size); +#elif defined(HAVE_ATTR_LISTF) + return irix_attr_list(NULL, filedes, list, size, 0); #else errno = ENOSYS; return -1; @@ -1323,6 +1427,13 @@ int sys_removexattr (const char *path, const char *name) { #if defined(HAVE_REMOVEXATTR) return removexattr(path, name); +#elif defined(HAVE_ATTR_REMOVE) + int flags = 0; + char *attrname = strchr(name,'.') +1; + + if (strncmp(name, "system", 6) == 0) flags |= ATTR_ROOT; + + return attr_remove(path, attrname, flags); #else errno = ENOSYS; return -1; @@ -1333,6 +1444,13 @@ int sys_lremovexattr (const char *path, const char *name) { #if defined(HAVE_LREMOVEXATTR) return lremovexattr(path, name); +#elif defined(HAVE_ATTR_REMOVE) + int flags = ATTR_DONTFOLLOW; + char *attrname = strchr(name,'.') +1; + + if (strncmp(name, "system", 6) == 0) flags |= ATTR_ROOT; + + return attr_remove(path, attrname, flags); #else errno = ENOSYS; return -1; @@ -1343,16 +1461,37 @@ int sys_fremovexattr (int filedes, const char *name) { #if defined(HAVE_FREMOVEXATTR) return fremovexattr(filedes, name); +#elif defined(HAVE_ATTR_REMOVEF) + int flags = 0; + char *attrname = strchr(name,'.') +1; + + if (strncmp(name, "system", 6) == 0) flags |= ATTR_ROOT; + + return attr_removef(filedes, attrname, flags); #else errno = ENOSYS; return -1; #endif } +#if !defined(HAVE_SETXATTR) +#define XATTR_CREATE 0x1 /* set value, fail if attr already exists */ +#define XATTR_REPLACE 0x2 /* set value, fail if attr does not exist */ +#endif + int sys_setxattr (const char *path, const char *name, const void *value, size_t size, int flags) { #if defined(HAVE_SETXATTR) return setxattr(path, name, value, size, flags); +#elif defined(HAVE_ATTR_SET) + int myflags = 0; + char *attrname = strchr(name,'.') +1; + + if (strncmp(name, "system", 6) == 0) myflags |= ATTR_ROOT; + if (flags & XATTR_CREATE) myflags |= ATTR_CREATE; + if (flags & XATTR_REPLACE) myflags |= ATTR_REPLACE; + + return attr_set(path, attrname, (const char *)value, size, myflags); #else errno = ENOSYS; return -1; @@ -1363,6 +1502,15 @@ int sys_lsetxattr (const char *path, const char *name, const void *value, size_t { #if defined(HAVE_LSETXATTR) return lsetxattr(path, name, value, size, flags); +#elif defined(HAVE_ATTR_SET) + int myflags = ATTR_DONTFOLLOW; + char *attrname = strchr(name,'.') +1; + + if (strncmp(name, "system", 6) == 0) myflags |= ATTR_ROOT; + if (flags & XATTR_CREATE) myflags |= ATTR_CREATE; + if (flags & XATTR_REPLACE) myflags |= ATTR_REPLACE; + + return attr_set(path, attrname, (const char *)value, size, myflags); #else errno = ENOSYS; return -1; @@ -1373,6 +1521,15 @@ int sys_fsetxattr (int filedes, const char *name, const void *value, size_t size { #if defined(HAVE_FSETXATTR) return fsetxattr(filedes, name, value, size, flags); +#elif defined(HAVE_ATTR_SETF) + int myflags = 0; + char *attrname = strchr(name,'.') +1; + + if (strncmp(name, "system", 6) == 0) myflags |= ATTR_ROOT; + if (flags & XATTR_CREATE) myflags |= ATTR_CREATE; + if (flags & XATTR_REPLACE) myflags |= ATTR_REPLACE; + + return attr_setf(filedes, attrname, (const char *)value, size, myflags); #else errno = ENOSYS; return -1; diff --git a/source3/lib/util.c b/source3/lib/util.c index eaa232a549..766c5041b4 100644 --- a/source3/lib/util.c +++ b/source3/lib/util.c @@ -261,7 +261,7 @@ BOOL init_names(void) } fstrcpy( local_machine, global_myname() ); - trim_string( local_machine, " ", " " ); + trim_char( local_machine, ' ', ' ' ); p = strchr( local_machine, ' ' ); if (p) *p = 0; @@ -311,7 +311,7 @@ BOOL in_group(gid_t group, gid_t current_gid, int ngroups, const gid_t *groups) static const char *Atoic(const char *p, int *n, const char *c) { - if (!isdigit((const int)*p)) { + if (!isdigit((int)*p)) { DEBUG(5, ("Atoic: malformed number\n")); return NULL; } @@ -605,68 +605,6 @@ void unix_clean_name(char *s) trim_string(s,NULL,"/.."); } -/******************************************************************* - Convert '\' to '/'. - Reduce a file name, removing or reducing /../ , /./ , // elements. - Remove also any trailing . and / - Return a new allocated string. -********************************************************************/ - -smb_ucs2_t *unix_clean_path(const smb_ucs2_t *s) -{ - smb_ucs2_t *ns; - smb_ucs2_t *p, *r, *t; - - DEBUG(3, ("unix_clean_path\n")); /* [%unicode]\n")); */ - if(!s) - return NULL; - - /* convert '\' to '/' */ - ns = strdup_w(s); - if (!ns) - return NULL; - unix_format_w(ns); - - /* remove all double slashes */ - p = ns; - ns = all_string_sub_wa(p, "//", "/"); - SAFE_FREE(p); - if (!ns) - return NULL; - - /* remove any /./ */ - p = ns; - ns = all_string_sub_wa(p, "/./", "/"); - SAFE_FREE(p); - if (!ns) - return NULL; - - /* reduce any /../ */ - t = ns; - while (*t && (r = strstr_wa(t, "/.."))) { - t = &(r[3]); - if (*t == UCS2_CHAR('/') || *t == 0) { - *r = 0; - p = strrchr_w(ns, UCS2_CHAR('/')); - if (!p) - p = ns; - if (*t == 0) - *p = 0; - else - memmove(p, t, (strlen_w(t) + 1) * sizeof(smb_ucs2_t)); - t = p; - } - } - - /* remove any leading ./ trailing /. */ - trim_string_wa(ns, "./", "/."); - - /* remove any leading and trailing / */ - trim_string_wa(ns, "/", "/"); - - return ns; -} - /**************************************************************************** Make a dir struct. ****************************************************************************/ @@ -2205,7 +2143,7 @@ char *lock_path(const char *name) static pstring fname; pstrcpy(fname,lp_lockdir()); - trim_string(fname,"","/"); + trim_char(fname,'\0','/'); if (!directory_exist(fname,NULL)) mkdir(fname,0755); @@ -2225,7 +2163,7 @@ char *pid_path(const char *name) static pstring fname; pstrcpy(fname,lp_piddir()); - trim_string(fname,"","/"); + trim_char(fname,'\0','/'); if (!directory_exist(fname,NULL)) mkdir(fname,0755); @@ -2335,21 +2273,12 @@ BOOL ms_has_wild_w(const smb_ucs2_t *s) BOOL mask_match(const char *string, char *pattern, BOOL is_case_sensitive) { - fstring p2, s2; - if (strcmp(string,"..") == 0) string = "."; if (strcmp(pattern,".") == 0) return False; - if (is_case_sensitive) - return ms_fnmatch(pattern, string, Protocol) == 0; - - fstrcpy(p2, pattern); - fstrcpy(s2, string); - strlower_m(p2); - strlower_m(s2); - return ms_fnmatch(p2, s2, Protocol) == 0; + return ms_fnmatch(pattern, string, Protocol, is_case_sensitive) == 0; } /********************************************************* diff --git a/source3/lib/util_file.c b/source3/lib/util_file.c index 638a6ca342..bd505ac921 100644 --- a/source3/lib/util_file.c +++ b/source3/lib/util_file.c @@ -20,6 +20,11 @@ #include "includes.h" +#ifndef MAP_FAILED +#define MAP_FAILED ((void *)-1) +#endif + + static int gotalarm; /*************************************************************** diff --git a/source3/lib/util_sid.c b/source3/lib/util_sid.c index 00f14d7d26..fbb393770d 100644 --- a/source3/lib/util_sid.c +++ b/source3/lib/util_sid.c @@ -93,7 +93,7 @@ static const struct { {SID_NAME_UNKNOWN, "UNKNOWN"}, {SID_NAME_COMPUTER, "Computer"}, - {0, NULL} + {(enum SID_NAME_USE)0, NULL} }; const char *sid_type_lookup(uint32 sid_type) diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c index 7569a39e6a..82b312e241 100644 --- a/source3/lib/util_str.c +++ b/source3/lib/util_str.c @@ -37,7 +37,7 @@ **/ BOOL next_token(const char **ptr,char *buff, const char *sep, size_t bufsize) { - const char *s; + char *s; char *pbuf; BOOL quoted; size_t len=1; @@ -45,7 +45,7 @@ BOOL next_token(const char **ptr,char *buff, const char *sep, size_t bufsize) if (!ptr) return(False); - s = *ptr; + s = (char *)*ptr; /* default to simple separators */ if (!sep) @@ -88,7 +88,7 @@ BOOL next_token_nr(const char **ptr,char *buff, const char *sep, size_t bufsize) { BOOL ret; if (!ptr) - ptr = (const char **)&last_ptr; + ptr = &last_ptr; ret = next_token(ptr, buff, sep, bufsize); last_ptr = *ptr; @@ -109,7 +109,7 @@ void set_first_token(char *ptr) char **toktocliplist(int *ctok, const char *sep) { - char *s=last_ptr; + char *s=(char *)last_ptr; int ictok=0; char **ret, **iret; @@ -132,7 +132,7 @@ char **toktocliplist(int *ctok, const char *sep) } while(*s); *ctok=ictok; - s=last_ptr; + s=(char *)last_ptr; if (!(ret=iret=malloc(ictok*sizeof(char *)))) return NULL; @@ -364,9 +364,27 @@ BOOL strisnormal(const char *s) void string_replace(pstring s,char oldc,char newc) { - push_ucs2(NULL, tmpbuf,s, sizeof(tmpbuf), STR_TERMINATE); + unsigned char *p; + + /* this is quite a common operation, so we want it to be + fast. We optimise for the ascii case, knowing that all our + supported multi-byte character sets are ascii-compatible + (ie. they match for the first 128 chars) */ + + for (p = (unsigned char *)s; *p; p++) { + if (*p & 0x80) /* mb string - slow path. */ + break; + if (*p == oldc) + *p = newc; + } + + if (!*p) + return; + + /* Slow (mb) path. */ + push_ucs2(NULL, tmpbuf, p, sizeof(tmpbuf), STR_TERMINATE); string_replace_w(tmpbuf, UCS2_CHAR(oldc), UCS2_CHAR(newc)); - pull_ucs2(NULL, s, tmpbuf, -1, sizeof(tmpbuf), STR_TERMINATE); + pull_ucs2(NULL, p, tmpbuf, -1, sizeof(tmpbuf), STR_TERMINATE); } /** @@ -406,6 +424,59 @@ size_t str_ascii_charnum(const char *s) return strlen(tmpbuf2); } +BOOL trim_char(char *s,char cfront,char cback) +{ + BOOL ret = False; + char *ep; + char *fp = s; + + /* Ignore null or empty strings. */ + if (!s || (s[0] == '\0')) + return False; + + if (cfront) { + while (*fp && *fp == cfront) + fp++; + if (!*fp) { + /* We ate the string. */ + s[0] = '\0'; + return True; + } + if (fp != s) + ret = True; + } + + ep = fp + strlen(fp) - 1; + if (cback) { + /* Attempt ascii only. Bail for mb strings. */ + while ((ep >= fp) && (*ep == cback)) { + ret = True; + if ((ep > fp) && (((unsigned char)ep[-1]) & 0x80)) { + /* Could be mb... bail back to tim_string. */ + char fs[2], bs[2]; + if (cfront) { + fs[0] = cfront; + fs[1] = '\0'; + } + bs[0] = cback; + bs[1] = '\0'; + return trim_string(s, cfront ? fs : NULL, bs); + } else { + ep--; + } + } + if (ep < fp) { + /* We ate the string. */ + s[0] = '\0'; + return True; + } + } + + ep[1] = '\0'; + memmove(s, fp, ep-fp+2); + return ret; +} + /** Trim the specified elements off the front and back of a string. **/ @@ -428,7 +499,9 @@ BOOL trim_string(char *s,const char *front,const char *back) if (front_len) { while (len && strncmp(s, front, front_len)==0) { - memcpy(s, s+front_len, (len-front_len)+1); + /* Must use memmove here as src & dest can + * easily overlap. Found by valgrind. JRA. */ + memmove(s, s+front_len, (len-front_len)+1); len -= front_len; ret=True; } @@ -501,7 +574,9 @@ char *safe_strcpy_fn(const char *fn, int line, char *dest,const char *src, size_ return NULL; } +#ifdef DEVELOPER clobber_region(fn,line,dest, maxlength+1); +#endif if (!src) { *dest = 0; @@ -540,7 +615,9 @@ char *safe_strcat_fn(const char *fn, int line, char *dest, const char *src, size src_len = strnlen(src, maxlength + 1); dest_len = strnlen(dest, maxlength + 1); +#ifdef DEVELOPER clobber_region(fn, line, dest + dest_len, maxlength + 1 - dest_len); +#endif if (src_len + dest_len > maxlength) { DEBUG(0,("ERROR: string overflow by %d in safe_strcat [%.50s]\n", @@ -567,7 +644,9 @@ char *alpha_strcpy_fn(const char *fn, int line, char *dest, const char *src, con { size_t len, i; +#ifdef DEVELOPER clobber_region(fn, line, dest, maxlength); +#endif if (!dest) { DEBUG(0,("ERROR: NULL dest in alpha_strcpy\n")); @@ -607,7 +686,9 @@ char *StrnCpy_fn(const char *fn, int line,char *dest,const char *src,size_t n) { char *d = dest; +#ifdef DEVELOPER clobber_region(fn, line, dest, n+1); +#endif if (!dest) return(NULL); @@ -637,8 +718,9 @@ static char *strncpyn(char *dest, const char *src, size_t n, char c) char *p; size_t str_len; +#ifdef DEVELOPER clobber_region(dest, n+1); - +#endif p = strchr_m(src, c); if (p == NULL) { DEBUG(5, ("strncpyn: separator character (%c) not found\n", c)); @@ -910,6 +992,7 @@ char *realloc_string_sub(char *string, const char *pattern, const char *insert) while ((p = strstr(s,pattern))) { if (ld > 0) { + int offset = PTR_DIFF(s,string); char *t = Realloc(string, ls + ld + 1); if (!t) { DEBUG(0, ("realloc_string_sub: out of memory!\n")); @@ -917,7 +1000,7 @@ char *realloc_string_sub(char *string, const char *pattern, const char *insert) return NULL; } string = t; - p = t + (p - s); + p = t + offset + (p - s); } if (li != lp) { memmove(p+li,p+lp,strlen(p+lp)+1); @@ -1098,6 +1181,19 @@ char *strchr_m(const char *s, char c) pstring s2; smb_ucs2_t *p; + /* this is quite a common operation, so we want it to be + fast. We optimise for the ascii case, knowing that all our + supported multi-byte character sets are ascii-compatible + (ie. they match for the first 128 chars) */ + + while (*s && (((unsigned char)s[0]) & 0x80)) { + if (*s == c) + return s; + } + + if (!*s) + return NULL; + push_ucs2(NULL, ws, s, sizeof(ws), STR_TERMINATE); p = strchr_w(ws, UCS2_CHAR(c)); if (!p) @@ -1109,17 +1205,53 @@ char *strchr_m(const char *s, char c) char *strrchr_m(const char *s, char c) { - wpstring ws; - pstring s2; - smb_ucs2_t *p; + /* this is quite a common operation, so we want it to be + fast. We optimise for the ascii case, knowing that all our + supported multi-byte character sets are ascii-compatible + (ie. they match for the first 128 chars). Also, in Samba + we only search for ascii characters in 'c' and that + in all mb character sets with a compound character + containing c, if 'c' is not a match at position + p, then p[-1] > 0x7f. JRA. */ - push_ucs2(NULL, ws, s, sizeof(ws), STR_TERMINATE); - p = strrchr_w(ws, UCS2_CHAR(c)); - if (!p) - return NULL; - *p = 0; - pull_ucs2_pstring(s2, ws); - return (char *)(s+strlen(s2)); + { + size_t len = strlen(s); + const char *cp = s; + BOOL got_mb = False; + + if (len == 0) + return NULL; + cp += (len - 1); + do { + if (c == *cp) { + /* Could be a match. Part of a multibyte ? */ + if ((cp > s) && (((unsigned char)cp[-1]) & 0x80)) { + /* Yep - go slow :-( */ + got_mb = True; + break; + } + /* No - we have a match ! */ + return cp; + } + } while (cp-- != s); + if (!got_mb) + return NULL; + } + + /* String contained a non-ascii char. Slow path. */ + { + wpstring ws; + pstring s2; + smb_ucs2_t *p; + + push_ucs2(NULL, ws, s, sizeof(ws), STR_TERMINATE); + p = strrchr_w(ws, UCS2_CHAR(c)); + if (!p) + return NULL; + *p = 0; + pull_ucs2_pstring(s2, ws); + return (char *)(s+strlen(s2)); + } } /*********************************************************************** @@ -1409,6 +1541,35 @@ void str_list_free(char ***list) SAFE_FREE(*list); } +/****************************************************************************** + version of standard_sub_basic() for string lists; uses alloc_sub_basic() + for the work + *****************************************************************************/ + +BOOL str_list_sub_basic( char **list, const char *smb_name ) +{ + char *s, *tmpstr; + + while ( *list ) { + s = *list; + tmpstr = alloc_sub_basic(smb_name, s); + if ( !tmpstr ) { + DEBUG(0,("str_list_sub_basic: alloc_sub_basic() return NULL!\n")); + return False; + } + + *list = tmpstr; + + list++; + } + + return True; +} + +/****************************************************************************** + substritute a specific pattern in a string list + *****************************************************************************/ + BOOL str_list_substitute(char **list, const char *pattern, const char *insert) { char *p, *s, *t; @@ -1464,6 +1625,7 @@ BOOL str_list_substitute(char **list, const char *pattern, const char *insert) } } + list++; } diff --git a/source3/lib/version.c b/source3/lib/version.c new file mode 100644 index 0000000000..99f836c2d5 --- /dev/null +++ b/source3/lib/version.c @@ -0,0 +1,42 @@ +/* + Unix SMB/CIFS implementation. + Samba Version functions + + Copyright (C) Stefan Metzmacher 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" + +const char *samba_version_string(void) +{ +#ifndef SAMBA_VERSION_VENDOR_SUFFIX + return SAMBA_VERSION_OFFICIAL_STRING; +#else + static fstring samba_version; + static BOOL init_samba_version; + + if (init_samba_version) + return samba_version; + + snprintf(samba_version,sizeof(samba_version),"%s-%s", + SAMBA_VERSION_OFFICIAL_STRING, + SAMBA_VERSION_VENDOR_SUFFIX); + + init_samba_version = True; + return samba_version; +#endif +} diff --git a/source3/libads/ads_status.c b/source3/libads/ads_status.c index 80fdb99eac..11f9d66b92 100644 --- a/source3/libads/ads_status.c +++ b/source3/libads/ads_status.c @@ -87,7 +87,7 @@ NTSTATUS ads_ntstatus(ADS_STATUS status) */ const char *ads_errstr(ADS_STATUS status) { - int msg_ctx; + uint32 msg_ctx; static char *ret; SAFE_FREE(ret); diff --git a/source3/libads/authdata.c b/source3/libads/authdata.c index 50a9ef2718..29170af377 100644 --- a/source3/libads/authdata.c +++ b/source3/libads/authdata.c @@ -39,6 +39,7 @@ static DATA_BLOB unwrap_pac(DATA_BLOB *auth_data) asn1_end_tag(&data); asn1_end_tag(&data); asn1_end_tag(&data); + asn1_free(&data); return pac_contents; } @@ -422,7 +423,7 @@ static BOOL pac_io_pac_signature_data(const char *desc, if (!prs_uint32("type", ps, depth, &data->type)) return False; if (UNMARSHALLING(ps)) { - data->signature = prs_alloc_mem(ps, siglen); + data->signature = (unsigned char *)prs_alloc_mem(ps, siglen); if (!data->signature) { DEBUG(3, ("No memory available\n")); return False; @@ -600,9 +601,11 @@ PAC_DATA *decode_pac_data(DATA_BLOB *auth_data, TALLOC_CTX *ctx) DEBUG(5,("dump_pac_data\n")); prs_init(&ps, pac_data_blob.length, ctx, UNMARSHALL); - prs_copy_data_in(&ps, pac_data_blob.data, pac_data_blob.length); + prs_copy_data_in(&ps, (char *)pac_data_blob.data, pac_data_blob.length); prs_set_offset(&ps, 0); + data_blob_free(&pac_data_blob); + pac_data = (PAC_DATA *) talloc_zero(ctx, sizeof(PAC_DATA)); pac_io_pac_data("pac data", pac_data, &ps, 0); diff --git a/source3/libads/kerberos_verify.c b/source3/libads/kerberos_verify.c index 48b61cd1f2..4ae89aa01f 100644 --- a/source3/libads/kerberos_verify.c +++ b/source3/libads/kerberos_verify.c @@ -4,6 +4,8 @@ Copyright (C) Andrew Tridgell 2001 Copyright (C) Remus Koos 2001 Copyright (C) Luke Howard 2003 + Copyright (C) Guenther Deschner 2003 + Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -24,11 +26,132 @@ #ifdef HAVE_KRB5 +static void free_keytab(krb5_context context, krb5_keytab keytab) +{ + int ret=0; + + if (keytab) + ret = krb5_kt_close(context, keytab); + if (ret) { + DEBUG(3, ("krb5_kt_close failed (%s)\n", + error_message(ret))); + } +} + +#ifdef HAVE_MEMORY_KEYTAB +static krb5_error_code create_keytab(krb5_context context, + krb5_principal host_princ, + char *host_princ_s, + krb5_data password, + krb5_enctype *enctypes, + krb5_keytab *keytab, + char *keytab_name) +{ + krb5_keytab_entry entry; + krb5_kvno kvno = 1; + krb5_error_code ret; + krb5_keyblock *key; + int i; + + DEBUG(10,("creating keytab: %s\n", keytab_name)); + ret = krb5_kt_resolve(context, keytab_name, keytab); + if (ret) + return ret; + + if (!(key = (krb5_keyblock *)malloc(sizeof(*key)))) { + return ENOMEM; + } + + /* add keytab entries for all encryption types */ + for ( i=0; enctypes[i]; i++ ) { + + if (create_kerberos_key_from_string(context, host_princ, &password, key, enctypes[i])) { + continue; + } + + entry.principal = host_princ; + entry.vno = kvno; + /* this will have to be detected in configure...heimdal + calls it keyblock, MIT calls it key, but it does not + matter we are creating keytabs with MIT */ + entry.keyblock = *key; + + DEBUG(10,("adding keytab-entry for (%s) with encryption type (%d)\n", + host_princ_s, enctypes[i])); + ret = krb5_kt_add_entry(context, *keytab, &entry); + if (ret) { + DEBUG(1,("adding entry to keytab failed (%s)\n", + error_message(ret))); + free_keytab(context, *keytab); + return ret; + } + } + krb5_free_keyblock(context, key); + + return 0; +} +#endif + +static BOOL setup_keytab(krb5_context context, + krb5_principal host_princ, + char *host_princ_s, + krb5_data password, + krb5_enctype *enctypes, + krb5_keytab *keytab) +{ + char *keytab_name = NULL; + krb5_error_code ret; + + /* check if we have to setup a keytab - not currently enabled + I've put this in so that the else block below functions + the same way that it will when this code is turned on */ + if (0 /* will later be *lp_keytab() */) { + + /* use a file-keytab */ + asprintf(&keytab_name, "%s:%s", + "" + /* KRB5_KT_FILE_PREFIX, "FILE" or + "WRFILE" depending on HEeimdal or MIT */, + "" /* will later be lp_keytab() */); + + DEBUG(10,("will use filebased keytab: %s\n", keytab_name)); + ret = krb5_kt_resolve(context, keytab_name, keytab); + if (ret) { + DEBUG(3,("cannot resolve keytab name %s (%s)\n", + keytab_name, + error_message(ret))); + SAFE_FREE(keytab_name); + return False; + } + + } + +#if defined(HAVE_MEMORY_KEYTAB) + else { + + /* setup a in-memory-keytab */ + asprintf(&keytab_name, "MEMORY:"); + + ret = create_keytab(context, host_princ, host_princ_s, password, enctypes, + keytab, keytab_name); + if (ret) { + DEBUG(3,("unable to create MEMORY: keytab (%s)\n", + error_message(ret))); + SAFE_FREE(keytab_name); + return False; + } + } +#endif + SAFE_FREE(keytab_name); + return True; +} + + /* verify an incoming ticket and parse out the principal name and authorization_data if available */ -NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, +NTSTATUS ads_verify_ticket(const char *realm, const DATA_BLOB *ticket, char **principal, DATA_BLOB *auth_data, DATA_BLOB *ap_rep, uint8 session_key[16]) @@ -79,7 +202,7 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, return NT_STATUS_LOGON_FAILURE; } - ret = krb5_set_default_realm(context, ads->auth.realm); + ret = krb5_set_default_realm(context, realm); if (ret) { DEBUG(1,("ads_verify_ticket: krb5_set_default_realm failed (%s)\n", error_message(ret))); sret = NT_STATUS_LOGON_FAILURE; @@ -128,11 +251,6 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, /* CIFS doesn't use addresses in tickets. This would breat NAT. JRA */ - if (!(key = (krb5_keyblock *)malloc(sizeof(*key)))) { - sret = NT_STATUS_NO_MEMORY; - goto out; - } - if ((ret = get_kerberos_allowed_etypes(context, &enctypes))) { DEBUG(1,("ads_verify_ticket: krb5_get_permitted_enctypes failed (%s)\n", error_message(ret))); @@ -149,22 +267,40 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, goto out; } + if (!setup_keytab(context, host_princ, host_princ_s, password, + enctypes, &keytab)) { + DEBUG(3,("ads_verify_ticket: unable to setup keytab\n")); + sret = NT_STATUS_LOGON_FAILURE; + goto out; + } + /* We need to setup a auth context with each possible encoding type in turn. */ for (i=0;enctypes[i];i++) { + if (!(key = (krb5_keyblock *)malloc(sizeof(*key)))) { + sret = NT_STATUS_NO_MEMORY; + goto out; + } + if (create_kerberos_key_from_string(context, host_princ, &password, key, enctypes[i])) { continue; } krb5_auth_con_setuseruserkey(context, auth_context, key); + krb5_free_keyblock(context, key); + packet.length = ticket->length; packet.data = (krb5_pointer)ticket->data; if (!(ret = krb5_rd_req(context, &auth_context, &packet, - NULL, keytab, NULL, &tkt))) { +#ifdef HAVE_MEMORY_KEYTAB + host_princ, +#else + NULL, +#endif + keytab, NULL, &tkt))) { DEBUG(10,("ads_verify_ticket: enc type [%u] decrypted message !\n", (unsigned int)enctypes[i] )); - free_kerberos_etypes(context, enctypes); auth_ok = True; break; } @@ -217,8 +353,13 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, file_save("/tmp/authdata.dat", tkt->enc_part2->authorization_data[0]->contents, tkt->enc_part2->authorization_data[0]->length); + } #endif + + /* get rid of all resources associated with the keytab */ + if (keytab) free_keytab(context, keytab); + if ((ret = krb5_unparse_name(context, get_principal_from_tkt(tkt), principal))) { DEBUG(3,("ads_verify_ticket: krb5_unparse_name failed (%s)\n", @@ -237,8 +378,12 @@ NTSTATUS ads_verify_ticket(ADS_STRUCT *ads, const DATA_BLOB *ticket, if (!NT_STATUS_IS_OK(sret)) data_blob_free(ap_rep); - SAFE_FREE(host_princ_s); + krb5_free_principal(context, host_princ); + if (tkt != NULL) + krb5_free_ticket(context, tkt); + free_kerberos_etypes(context, enctypes); SAFE_FREE(password_s); + SAFE_FREE(host_princ_s); if (auth_context) krb5_auth_con_free(context, auth_context); diff --git a/source3/libads/krb5_setpw.c b/source3/libads/krb5_setpw.c index 80ef6cdf01..9cf15221a8 100644 --- a/source3/libads/krb5_setpw.c +++ b/source3/libads/krb5_setpw.c @@ -143,7 +143,7 @@ static krb5_error_code build_kpasswd_request(uint16 pversion, else return EINVAL; - encoded_setpw.data = setpw.data; + encoded_setpw.data = (char *)setpw.data; encoded_setpw.length = setpw.length; ret = krb5_mk_priv(context, auth_context, @@ -664,25 +664,22 @@ ADS_STATUS kerberos_set_password(const char *kpasswd_server, * @return status of password change **/ ADS_STATUS ads_set_machine_password(ADS_STRUCT *ads, - const char *hostname, + const char *machine_account, const char *password) { ADS_STATUS status; - char *host = strdup(hostname); - char *principal; - - strlower_m(host); + char *principal = NULL; /* - we need to use the '$' form of the name here, as otherwise the - server might end up setting the password for a user instead + we need to use the '$' form of the name here (the machine account name), + as otherwise the server might end up setting the password for a user + instead */ - asprintf(&principal, "%s$@%s", host, ads->config.realm); + asprintf(&principal, "%s@%s", machine_account, ads->config.realm); status = ads_krb5_set_password(ads->auth.kdc_server, principal, password, ads->auth.time_offset); - free(host); free(principal); return status; diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c index 5a12288b16..e925750e0a 100644 --- a/source3/libads/ldap.c +++ b/source3/libads/ldap.c @@ -1045,7 +1045,7 @@ static ADS_STATUS ads_add_machine_acct(ADS_STRUCT *ads, const char *hostname, ads_mod_str(ctx, &mods, "dNSHostName", hostname); ads_mod_str(ctx, &mods, "userAccountControl", controlstr); ads_mod_str(ctx, &mods, "operatingSystem", "Samba"); - ads_mod_str(ctx, &mods, "operatingSystemVersion", VERSION); + ads_mod_str(ctx, &mods, "operatingSystemVersion", SAMBA_VERSION_STRING); ret = ads_gen_add(ads, new_dn, mods); @@ -1777,7 +1777,7 @@ ADS_STATUS ads_USN(ADS_STRUCT *ads, uint32 *usn) ADS_STATUS status; void *res; - status = ads_do_search(ads, "", LDAP_SCOPE_BASE, "(objectclass=*)", attrs, &res); + status = ads_do_search_retry(ads, "", LDAP_SCOPE_BASE, "(objectclass=*)", attrs, &res); if (!ADS_ERR_OK(status)) return status; if (ads_count_replies(ads, res) != 1) { @@ -1900,7 +1900,7 @@ ADS_STATUS ads_domain_sid(ADS_STRUCT *ads, DOM_SID *sid) void *res; ADS_STATUS rc; - rc = ads_do_search(ads, ads->config.bind_path, LDAP_SCOPE_BASE, "(objectclass=*)", + rc = ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_BASE, "(objectclass=*)", attrs, &res); if (!ADS_ERR_OK(rc)) return rc; if (!ads_pull_sid(ads, res, "objectSid", sid)) { diff --git a/source3/libads/ldap_utils.c b/source3/libads/ldap_utils.c index 6855600288..1fa9ebfc97 100644 --- a/source3/libads/ldap_utils.c +++ b/source3/libads/ldap_utils.c @@ -73,7 +73,10 @@ ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path, int scope } free(bp); - DEBUG(1,("ads reopen failed after error %s\n", ads_errstr(status))); + if (!ADS_ERR_OK(status)) + DEBUG(1,("ads reopen failed after error %s\n", + ads_errstr(status))); + return status; } diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c index 910ff3f4dc..5122803597 100644 --- a/source3/libads/sasl.c +++ b/source3/libads/sasl.c @@ -60,7 +60,7 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads) msg1 = gen_negTokenTarg(mechs, blob); data_blob_free(&blob); - cred.bv_val = msg1.data; + cred.bv_val = (char *)msg1.data; cred.bv_len = msg1.length; rc = ldap_sasl_bind_s(ads->ld, NULL, "GSS-SPNEGO", &cred, NULL, NULL, &scred); @@ -106,7 +106,7 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads) data_blob_free(&blob); /* now send the auth packet and we should be done */ - cred.bv_val = auth.data; + cred.bv_val = (char *)auth.data; cred.bv_len = auth.length; rc = ldap_sasl_bind_s(ads->ld, NULL, "GSS-SPNEGO", &cred, NULL, NULL, &scred); @@ -134,7 +134,7 @@ static ADS_STATUS ads_sasl_spnego_krb5_bind(ADS_STRUCT *ads, const char *princip } /* now send the auth packet and we should be done */ - cred.bv_val = blob.data; + cred.bv_val = (char *)blob.data; cred.bv_len = blob.length; rc = ldap_sasl_bind_s(ads->ld, NULL, "GSS-SPNEGO", &cred, NULL, NULL, &scred); @@ -227,13 +227,13 @@ failed: */ static ADS_STATUS ads_sasl_gssapi_bind(ADS_STRUCT *ads) { - int minor_status; + uint32 minor_status; gss_name_t serv_name; gss_buffer_desc input_name; gss_ctx_id_t context_handle; gss_OID mech_type = GSS_C_NULL_OID; gss_buffer_desc output_token, input_token; - OM_uint32 ret_flags, conf_state; + uint32 ret_flags, conf_state; struct berval cred; struct berval *scred; int i=0; @@ -328,7 +328,7 @@ static ADS_STATUS ads_sasl_gssapi_bind(ADS_STRUCT *ads) gss_release_name(&minor_status, &serv_name); gss_rc = gss_unwrap(&minor_status,context_handle,&input_token,&output_token, - &conf_state,NULL); + (int *)&conf_state,NULL); if (gss_rc) { status = ADS_ERROR_GSS(gss_rc, minor_status); goto failed; @@ -353,13 +353,13 @@ static ADS_STATUS ads_sasl_gssapi_bind(ADS_STRUCT *ads) *p++ = max_msg_size>>16; *p++ = max_msg_size>>8; *p++ = max_msg_size; - snprintf(p, strlen(ads->config.bind_path)+4, "dn:%s", ads->config.bind_path); - p += strlen(p); + snprintf((char *)p, strlen(ads->config.bind_path)+4, "dn:%s", ads->config.bind_path); + p += strlen((const char *)p); output_token.length = PTR_DIFF(p, output_token.value); gss_rc = gss_wrap(&minor_status, context_handle,0,GSS_C_QOP_DEFAULT, - &output_token, &conf_state, + &output_token, (int *)&conf_state, &input_token); if (gss_rc) { status = ADS_ERROR_GSS(gss_rc, minor_status); diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c index 94fe04a480..48bcb61f92 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c @@ -190,7 +190,7 @@ static BOOL cli_session_setup_plaintext(struct cli_state *cli, const char *user, char *p; fstring lanman; - fstr_sprintf( lanman, "Samba %s", VERSION ); + fstr_sprintf( lanman, "Samba %s", SAMBA_VERSION_STRING); set_message(cli->outbuf,13,0,True); SCVAL(cli->outbuf,smb_com,SMBsesssetupX); @@ -247,7 +247,8 @@ static void set_cli_session_key (struct cli_state *cli, DATA_BLOB session_key) } /**************************************************************************** - do a NT1 NTLM/LM encrypted session setup + do a NT1 NTLM/LM encrypted session setup - for when extended security + is not negotiated. @param cli client state to create do session setup on @param user username @param pass *either* cleartext password (passlen !=24) or LM response. @@ -267,7 +268,9 @@ static BOOL cli_session_setup_nt1(struct cli_state *cli, const char *user, BOOL ret = False; char *p; - if (passlen != 24) { + if (passlen == 0) { + /* do nothing - guest login */ + } else if (passlen != 24) { if (lp_client_ntlmv2_auth()) { DATA_BLOB server_chal; DATA_BLOB names_blob; @@ -351,7 +354,7 @@ static BOOL cli_session_setup_nt1(struct cli_state *cli, const char *user, goto end; } - show_msg(cli->inbuf); + /* show_msg(cli->inbuf); */ if (cli_is_error(cli)) { ret = False; @@ -610,6 +613,7 @@ static BOOL cli_session_setup_ntlmssp(struct cli_state *cli, const char *user, } while (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)); if (NT_STATUS_IS_OK(nt_status)) { + fstrcpy(cli->server_domain, ntlmssp_state->server_domain); set_cli_session_key(cli, ntlmssp_state->session_key); } @@ -619,7 +623,7 @@ static BOOL cli_session_setup_ntlmssp(struct cli_state *cli, const char *user, if (!NT_STATUS_IS_OK(ntlmssp_client_end(&ntlmssp_state))) { return False; } - + return (NT_STATUS_IS_OK(nt_status)); } @@ -627,8 +631,8 @@ static BOOL cli_session_setup_ntlmssp(struct cli_state *cli, const char *user, Do a spnego encrypted session setup. ****************************************************************************/ -static BOOL cli_session_setup_spnego(struct cli_state *cli, const char *user, - const char *pass, const char *workgroup) +BOOL cli_session_setup_spnego(struct cli_state *cli, const char *user, + const char *pass, const char *workgroup) { char *principal; char *OIDs[ASN1_MAX_OIDS]; @@ -677,7 +681,7 @@ static BOOL cli_session_setup_spnego(struct cli_state *cli, const char *user, * and do not store results */ if (got_kerberos_mechanism && cli->use_kerberos) { - if (*pass) { + if (pass && *pass) { int ret; use_in_memory_ccache(); @@ -1024,22 +1028,27 @@ BOOL cli_negprot(struct cli_state *cli) smb_buflen(cli->inbuf)-8, STR_UNICODE|STR_NOALIGN); } - if ((cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED)) { - /* Fail if signing is mandatory and we don't want to support it. */ + /* + * As signing is slow we only turn it on if either the client or + * the server require it. JRA. + */ + + if (cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) { + /* Fail if server says signing is mandatory and we don't want to support it. */ if (!cli->sign_info.allow_smb_signing) { DEBUG(1,("cli_negprot: SMB signing is mandatory and we have disabled it.\n")); return False; } cli->sign_info.negotiated_smb_signing = True; - } - - if ((cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) && cli->sign_info.allow_smb_signing) + cli->sign_info.mandatory_signing = True; + } else if (cli->sign_info.mandatory_signing && cli->sign_info.allow_smb_signing) { + /* Fail if client says signing is mandatory and the server doesn't support it. */ + if (!(cli->sec_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED)) { + DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n")); + return False; + } cli->sign_info.negotiated_smb_signing = True; - - /* Fail if signing is mandatory and the server doesn't support it. */ - if (cli->sign_info.mandatory_signing && !(cli->sign_info.negotiated_smb_signing)) { - DEBUG(1,("cli_negprot: SMB signing is mandatory and the server doesn't support it.\n")); - return False; + cli->sign_info.mandatory_signing = True; } } else if (cli->protocol >= PROTOCOL_LANMAN1) { @@ -1223,7 +1232,7 @@ BOOL cli_connect(struct cli_state *cli, const char *host, struct in_addr *ip) Initialise client credentials for authenticated pipe access. ****************************************************************************/ -static void init_creds(struct ntuser_creds *creds, const char* username, +void init_creds(struct ntuser_creds *creds, const char* username, const char* domain, const char* password) { ZERO_STRUCTP(creds); @@ -1239,30 +1248,21 @@ static void init_creds(struct ntuser_creds *creds, const char* username, } /** - establishes a connection right up to doing tconX, password specified. + establishes a connection to after the negprot. @param output_cli A fully initialised cli structure, non-null only on success @param dest_host The netbios name of the remote host @param dest_ip (optional) The the destination IP, NULL for name based lookup @param port (optional) The destination port (0 for default) - @param service (optional) The share to make the connection to. Should be 'unqualified' in any way. - @param service_type The 'type' of serivice. - @param user Username, unix string - @param domain User's domain - @param password User's password, unencrypted unix string. @param retry BOOL. Did this connection fail with a retryable error ? -*/ -NTSTATUS cli_full_connection(struct cli_state **output_cli, - const char *my_name, - const char *dest_host, - struct in_addr *dest_ip, int port, - const char *service, const char *service_type, - const char *user, const char *domain, - const char *password, int flags, - int signing_state, - BOOL *retry) +*/ +NTSTATUS cli_start_connection(struct cli_state **output_cli, + const char *my_name, + const char *dest_host, + struct in_addr *dest_ip, int port, + int signing_state, int flags, + BOOL *retry) { - struct ntuser_creds creds; NTSTATUS nt_status; struct nmb_name calling; struct nmb_name called; @@ -1295,7 +1295,7 @@ NTSTATUS cli_full_connection(struct cli_state **output_cli, again: - DEBUG(3,("Connecting to host=%s share=%s\n", dest_host, service)); + DEBUG(3,("Connecting to host=%s\n", dest_host)); if (!cli_connect(cli, dest_host, &ip)) { DEBUG(1,("cli_full_connection: failed to connect to %s (%s)\n", @@ -1336,6 +1336,46 @@ again: return nt_status; } + *output_cli = cli; + return NT_STATUS_OK; +} + + +/** + establishes a connection right up to doing tconX, password specified. + @param output_cli A fully initialised cli structure, non-null only on success + @param dest_host The netbios name of the remote host + @param dest_ip (optional) The the destination IP, NULL for name based lookup + @param port (optional) The destination port (0 for default) + @param service (optional) The share to make the connection to. Should be 'unqualified' in any way. + @param service_type The 'type' of serivice. + @param user Username, unix string + @param domain User's domain + @param password User's password, unencrypted unix string. + @param retry BOOL. Did this connection fail with a retryable error ? +*/ + +NTSTATUS cli_full_connection(struct cli_state **output_cli, + const char *my_name, + const char *dest_host, + struct in_addr *dest_ip, int port, + const char *service, const char *service_type, + const char *user, const char *domain, + const char *password, int flags, + int signing_state, + BOOL *retry) +{ + struct ntuser_creds creds; + NTSTATUS nt_status; + struct cli_state *cli = NULL; + + nt_status = cli_start_connection(&cli, my_name, dest_host, + dest_ip, port, signing_state, flags, retry); + + if (!NT_STATUS_IS_OK(nt_status)) { + return nt_status; + } + if (!cli_session_setup(cli, user, password, strlen(password)+1, password, strlen(password)+1, domain)) { diff --git a/source3/libsmb/clientgen.c b/source3/libsmb/clientgen.c index bc5f1462cc..0a134f715d 100644 --- a/source3/libsmb/clientgen.c +++ b/source3/libsmb/clientgen.c @@ -299,9 +299,12 @@ struct cli_state *cli_initialise(struct cli_state *cli) memset(cli->outbuf, 0, cli->bufsize); memset(cli->inbuf, 0, cli->bufsize); + +#if defined(DEVELOPER) /* just because we over-allocate, doesn't mean it's right to use it */ clobber_region(FUNCTION_MACRO, __LINE__, cli->outbuf+cli->bufsize, SAFETY_MARGIN); clobber_region(FUNCTION_MACRO, __LINE__, cli->inbuf+cli->bufsize, SAFETY_MARGIN); +#endif /* initialise signing */ cli_null_set_signing(cli); @@ -339,7 +342,9 @@ void cli_nt_session_close(struct cli_state *cli) ntlmssp_client_end(&cli->ntlmssp_pipe_state); } - cli_close(cli, cli->nt_pipe_fnum); + if (cli->nt_pipe_fnum != 0) + cli_close(cli, cli->nt_pipe_fnum); + cli->nt_pipe_fnum = 0; cli->pipe_idx = -1; } diff --git a/source3/libsmb/clifile.c b/source3/libsmb/clifile.c index f021076a46..c7f0cdb84b 100644 --- a/source3/libsmb/clifile.c +++ b/source3/libsmb/clifile.c @@ -951,8 +951,9 @@ BOOL cli_chkpath(struct cli_state *cli, const char *path) char *p; pstrcpy(path2,path); - trim_string(path2,NULL,"\\"); - if (!*path2) *path2 = '\\'; + trim_char(path2,'\0','\\'); + if (!*path2) + *path2 = '\\'; memset(cli->outbuf,'\0',smb_size); set_message(cli->outbuf,0,0,True); diff --git a/source3/libsmb/clikrb5.c b/source3/libsmb/clikrb5.c index beac8cb2c1..1fccc04a01 100644 --- a/source3/libsmb/clikrb5.c +++ b/source3/libsmb/clikrb5.c @@ -74,7 +74,7 @@ { pkaddr->addrtype = ADDRTYPE_INET; pkaddr->length = sizeof(((struct sockaddr_in *)paddr)->sin_addr); - pkaddr->contents = (char *)&(((struct sockaddr_in *)paddr)->sin_addr); + pkaddr->contents = (krb5_octet *)&(((struct sockaddr_in *)paddr)->sin_addr); } #else __ERROR__XX__UNKNOWN_ADDRTYPE @@ -97,7 +97,9 @@ return ret; } krb5_use_enctype(context, &eblock, enctype); - return krb5_string_to_key(context, &eblock, key, password, &salt); + ret = krb5_string_to_key(context, &eblock, key, password, &salt); + SAFE_FREE(salt.data); + return ret; } #elif defined(HAVE_KRB5_GET_PW_SALT) && defined(HAVE_KRB5_STRING_TO_KEY_SALT) int create_kerberos_key_from_string(krb5_context context, @@ -369,29 +371,27 @@ failed: BOOL get_krb5_smb_session_key(krb5_context context, krb5_auth_context auth_context, uint8 session_key[16], BOOL remote) { -#ifdef ENCTYPE_ARCFOUR_HMAC krb5_keyblock *skey; -#endif - BOOL ret = False; krb5_error_code err; + BOOL ret = False; memset(session_key, 0, 16); -#ifdef ENCTYPE_ARCFOUR_HMAC if (remote) err = krb5_auth_con_getremotesubkey(context, auth_context, &skey); else err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey); if (err == 0 && skey != NULL) { - if (KRB5_KEY_TYPE(skey) == - ENCTYPE_ARCFOUR_HMAC - && KRB5_KEY_LENGTH(skey) == 16) { + DEBUG(10, ("Got KRB5 session key of length %d\n", KRB5_KEY_LENGTH(skey))); + if (KRB5_KEY_LENGTH(skey) == 16) { memcpy(session_key, KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey)); + dump_data_pw("KRB5 Session Key:\n", session_key, 16); ret = True; } krb5_free_keyblock(context, skey); + } else { + DEBUG(10, ("KRB5 error getting session key %d\n", err)); } -#endif /* ENCTYPE_ARCFOUR_HMAC */ return ret; } diff --git a/source3/libsmb/climessage.c b/source3/libsmb/climessage.c index 8ce8416487..035088212c 100644 --- a/source3/libsmb/climessage.c +++ b/source3/libsmb/climessage.c @@ -87,7 +87,7 @@ int cli_message_text_build(struct cli_state *cli, char *msg, int len, int grp) p = smb_buf(cli->outbuf); *p++ = 1; - if ((lendos = convert_string_allocate(CH_UNIX, CH_DOS, msg,len, (void **) &msgdos)) < 0 || !msgdos) { + if ((lendos = convert_string_allocate(NULL,CH_UNIX, CH_DOS, msg,len, (void **) &msgdos)) < 0 || !msgdos) { DEBUG(3,("Conversion failed, sending message in UNIX charset\n")); SSVAL(p, 0, len); p += 2; memcpy(p, msg, len); diff --git a/source3/libsmb/cliprint.c b/source3/libsmb/cliprint.c index f302c045a5..2fb0e59aca 100644 --- a/source3/libsmb/cliprint.c +++ b/source3/libsmb/cliprint.c @@ -55,7 +55,7 @@ int cli_print_queue(struct cli_state *cli, char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt, rprcnt; + unsigned int rdrcnt, rprcnt; pstring param; int result_code=0; int i = -1; @@ -125,7 +125,8 @@ int cli_printjob_del(struct cli_state *cli, int job) char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt, ret = -1; + unsigned int rdrcnt,rprcnt; + int ret = -1; pstring param; memset(param,'\0',sizeof(param)); diff --git a/source3/libsmb/clirap.c b/source3/libsmb/clirap.c index a307ac6ccf..79ad38fc8c 100644 --- a/source3/libsmb/clirap.c +++ b/source3/libsmb/clirap.c @@ -76,7 +76,7 @@ BOOL cli_NetWkstaUserLogon(struct cli_state *cli,char *user, char *workstation) char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt; + unsigned int rdrcnt,rprcnt; pstring param; memset(param, 0, sizeof(param)); @@ -137,7 +137,7 @@ int cli_RNetShareEnum(struct cli_state *cli, void (*fn)(const char *, uint32, co char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt; + unsigned int rdrcnt,rprcnt; pstring param; int count = -1; @@ -211,7 +211,7 @@ BOOL cli_NetServerEnum(struct cli_state *cli, char *workgroup, uint32 stype, { char *rparam = NULL; char *rdata = NULL; - int rdrcnt,rprcnt; + unsigned int rdrcnt,rprcnt; char *p; pstring param; int uLevel = 1; @@ -256,7 +256,7 @@ BOOL cli_NetServerEnum(struct cli_state *cli, char *workgroup, uint32 stype, const char *cmnt = comment_offset?(rdata+comment_offset):""; pstring s1, s2; - if (comment_offset < 0 || comment_offset > rdrcnt) continue; + if (comment_offset < 0 || comment_offset > (int)rdrcnt) continue; stype = IVAL(p,18) & ~SV_TYPE_LOCAL_LIST_ONLY; @@ -290,7 +290,7 @@ BOOL cli_oem_change_password(struct cli_state *cli, const char *user, const char unsigned int param_len = 0; char *rparam = NULL; char *rdata = NULL; - int rprcnt, rdrcnt; + unsigned int rprcnt, rdrcnt; pstring dos_new_password; if (strlen(user) >= sizeof(fstring)-1) { diff --git a/source3/libsmb/clirap2.c b/source3/libsmb/clirap2.c index 669b33860d..12a3d63aff 100644 --- a/source3/libsmb/clirap2.c +++ b/source3/libsmb/clirap2.c @@ -153,7 +153,8 @@ int cli_NetGroupDelete(struct cli_state *cli, const char *group_name ) char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt, res; + unsigned int rdrcnt,rprcnt; + int res; char param[WORDSIZE /* api number */ +sizeof(RAP_NetGroupDel_REQ) /* parm string */ +1 /* no ret string */ @@ -204,7 +205,8 @@ int cli_NetGroupAdd(struct cli_state *cli, RAP_GROUP_INFO_1 * grinfo ) char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt,res; + unsigned int rdrcnt,rprcnt; + int res; char param[WORDSIZE /* api number */ +sizeof(RAP_NetGroupAdd_REQ) /* req string */ +sizeof(RAP_GROUP_INFO_L1) /* return string */ @@ -272,7 +274,7 @@ int cli_RNetGroupEnum(struct cli_state *cli, void (*fn)(const char *, const char char *p; char *rparam = NULL; char *rdata = NULL; - int rprcnt, rdrcnt; + unsigned int rprcnt, rdrcnt; int res = -1; @@ -332,7 +334,8 @@ int cli_NetGroupDelUser(struct cli_state * cli, const char *group_name, const ch char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt,res; + unsigned int rdrcnt,rprcnt; + int res; char param[WORDSIZE /* api number */ +sizeof(RAP_NetGroupDelUser_REQ) /* parm string */ +1 /* no ret string */ @@ -390,7 +393,8 @@ int cli_NetGroupAddUser(struct cli_state * cli, const char *group_name, const ch char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt,res; + unsigned int rdrcnt,rprcnt; + int res; char param[WORDSIZE /* api number */ +sizeof(RAP_NetGroupAddUser_REQ) /* parm string */ +1 /* no ret string */ @@ -446,7 +450,7 @@ int cli_NetGroupGetUsers(struct cli_state * cli, const char *group_name, void (* char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt; + unsigned int rdrcnt,rprcnt; int res = -1; char param[WORDSIZE /* api number */ +sizeof(RAP_NetGroupGetUsers_REQ)/* parm string */ @@ -501,7 +505,7 @@ int cli_NetUserGetGroups(struct cli_state * cli, const char *user_name, void (*f char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt; + unsigned int rdrcnt,rprcnt; int res = -1; char param[WORDSIZE /* api number */ +sizeof(RAP_NetUserGetGroups_REQ)/* parm string */ @@ -560,7 +564,8 @@ int cli_NetUserDelete(struct cli_state *cli, const char * user_name ) char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt, res; + unsigned int rdrcnt,rprcnt; + int res; char param[WORDSIZE /* api number */ +sizeof(RAP_NetGroupDel_REQ) /* parm string */ +1 /* no ret string */ @@ -614,7 +619,8 @@ int cli_NetUserAdd(struct cli_state *cli, RAP_USER_INFO_1 * userinfo ) char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt,res; + unsigned int rdrcnt,rprcnt; + int res; char param[WORDSIZE /* api number */ +sizeof(RAP_NetUserAdd2_REQ) /* req string */ +sizeof(RAP_USER_INFO_L1) /* data string */ @@ -702,7 +708,7 @@ int cli_RNetUserEnum(struct cli_state *cli, void (*fn)(const char *, const char char *p; char *rparam = NULL; char *rdata = NULL; - int rprcnt, rdrcnt; + unsigned int rprcnt, rdrcnt; int res = -1; @@ -770,7 +776,7 @@ int cli_NetFileClose(struct cli_state *cli, uint32 file_id ) char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt; + unsigned int rdrcnt,rprcnt; char param[WORDSIZE /* api number */ +sizeof(RAP_WFileClose2_REQ) /* req string */ +1 /* no ret string */ @@ -816,7 +822,8 @@ int cli_NetFileGetInfo(struct cli_state *cli, uint32 file_id, void (*fn)(const c char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt, res; + unsigned int rdrcnt,rprcnt; + int res; char param[WORDSIZE /* api number */ +sizeof(RAP_WFileGetInfo2_REQ) /* req string */ +sizeof(RAP_FILE_INFO_L3) /* return string */ @@ -893,7 +900,7 @@ int cli_NetFileEnum(struct cli_state *cli, char * user, char * base_path, void ( char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt; + unsigned int rdrcnt,rprcnt; char param[WORDSIZE /* api number */ +sizeof(RAP_WFileEnum2_REQ) /* req string */ +sizeof(RAP_FILE_INFO_L3) /* return string */ @@ -965,7 +972,8 @@ int cli_NetShareAdd(struct cli_state *cli, RAP_SHARE_INFO_2 * sinfo ) char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt,res; + unsigned int rdrcnt,rprcnt; + int res; char param[WORDSIZE /* api number */ +sizeof(RAP_WShareAdd_REQ) /* req string */ +sizeof(RAP_SHARE_INFO_L2) /* return string */ @@ -1035,7 +1043,8 @@ int cli_NetShareDelete(struct cli_state *cli, const char * share_name ) char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt, res; + unsigned int rdrcnt,rprcnt; + int res; char param[WORDSIZE /* api number */ +sizeof(RAP_WShareDel_REQ) /* req string */ +1 /* no ret string */ @@ -1097,7 +1106,7 @@ BOOL cli_get_pdc_name(struct cli_state *cli, char *workgroup, char *pdc_name) { char *rparam = NULL; char *rdata = NULL; - int rdrcnt,rprcnt; + unsigned int rdrcnt,rprcnt; char *p; char param[WORDSIZE /* api number */ +sizeof(RAP_NetServerEnum2_REQ) /* req string */ @@ -1177,7 +1186,7 @@ BOOL cli_get_server_domain(struct cli_state *cli) { char *rparam = NULL; char *rdata = NULL; - int rdrcnt,rprcnt; + unsigned int rdrcnt,rprcnt; char *p; char param[WORDSIZE /* api number */ +sizeof(RAP_WWkstaGetInfo_REQ) /* req string */ @@ -1242,7 +1251,7 @@ BOOL cli_get_server_type(struct cli_state *cli, uint32 *pstype) { char *rparam = NULL; char *rdata = NULL; - int rdrcnt,rprcnt; + unsigned int rdrcnt,rprcnt; char *p; char param[WORDSIZE /* api number */ +sizeof(RAP_WserverGetInfo_REQ) /* req string */ @@ -1309,7 +1318,7 @@ BOOL cli_ns_check_server_type(struct cli_state *cli, char *workgroup, uint32 sty { char *rparam = NULL; char *rdata = NULL; - int rdrcnt,rprcnt; + unsigned int rdrcnt,rprcnt; char *p; char param[WORDSIZE /* api number */ +sizeof(RAP_NetServerEnum2_REQ) /* req string */ @@ -1378,7 +1387,7 @@ BOOL cli_NetWkstaUserLogoff(struct cli_state *cli,char *user, char *workstation) char *rparam = NULL; char *rdata = NULL; char *p; - int rdrcnt,rprcnt; + unsigned int rdrcnt,rprcnt; char param[WORDSIZE /* api number */ +sizeof(RAP_NetWkstaUserLogoff_REQ) /* req string */ +sizeof(RAP_USER_LOGOFF_INFO_L1) /* return string */ @@ -1436,7 +1445,7 @@ int cli_NetPrintQEnum(struct cli_state *cli, char *p; char *rparam = NULL; char *rdata = NULL; - int rprcnt, rdrcnt; + unsigned int rprcnt, rdrcnt; int res = -1; @@ -1540,7 +1549,7 @@ int cli_NetPrintQGetInfo(struct cli_state *cli, const char *printer, char *p; char *rparam = NULL; char *rdata = NULL; - int rprcnt, rdrcnt; + unsigned int rprcnt, rdrcnt; int res = -1; @@ -1639,7 +1648,7 @@ int cli_RNetServiceEnum(struct cli_state *cli, void (*fn)(const char *, const ch char *p; char *rparam = NULL; char *rdata = NULL; - int rprcnt, rdrcnt; + unsigned int rprcnt, rdrcnt; int res = -1; @@ -1708,7 +1717,7 @@ int cli_NetSessionEnum(struct cli_state *cli, void (*fn)(char *, char *, uint16, char *p; char *rparam = NULL; char *rdata = NULL; - int rprcnt, rdrcnt; + unsigned int rprcnt, rdrcnt; int res = -1; memset(param, '\0', sizeof(param)); @@ -1784,7 +1793,7 @@ int cli_NetSessionGetInfo(struct cli_state *cli, const char *workstation, void ( char *p; char *rparam = NULL; char *rdata = NULL; - int rprcnt, rdrcnt; + unsigned int rprcnt, rdrcnt; int res = -1; @@ -1858,7 +1867,7 @@ int cli_NetSessionDel(struct cli_state *cli, const char *workstation) char *p; char *rparam = NULL; char *rdata = NULL; - int rprcnt, rdrcnt; + unsigned int rprcnt, rdrcnt; int res; memset(param, '\0', sizeof(param)); @@ -1903,7 +1912,7 @@ int cli_NetConnectionEnum(struct cli_state *cli, const char *qualifier, void (*f char *p; char *rparam = NULL; char *rdata = NULL; - int rprcnt, rdrcnt; + unsigned int rprcnt, rdrcnt; int res = -1; memset(param, '\0', sizeof(param)); diff --git a/source3/libsmb/clireadwrite.c b/source3/libsmb/clireadwrite.c index 0715aa7f1a..8eac7d07d8 100644 --- a/source3/libsmb/clireadwrite.c +++ b/source3/libsmb/clireadwrite.c @@ -326,7 +326,7 @@ ssize_t cli_write(struct cli_state *cli, int issued = 0; int received = 0; int mpx = MAX(cli->max_mux-1, 1); - int block = (cli->max_xmit - (smb_size+32)) & ~1023; + int block = cli->max_xmit - (smb_size+32); int blocks = (size + (block-1)) / block; while (received < blocks) { diff --git a/source3/libsmb/clisecdesc.c b/source3/libsmb/clisecdesc.c index d86a9022a6..548cd6ec18 100644 --- a/source3/libsmb/clisecdesc.c +++ b/source3/libsmb/clisecdesc.c @@ -28,7 +28,7 @@ SEC_DESC *cli_query_secdesc(struct cli_state *cli, int fnum, { char param[8]; char *rparam=NULL, *rdata=NULL; - int rparam_count=0, rdata_count=0; + unsigned int rparam_count=0, rdata_count=0; prs_struct pd; SEC_DESC *psd = NULL; @@ -78,7 +78,7 @@ BOOL cli_set_secdesc(struct cli_state *cli, int fnum, SEC_DESC *sd) { char param[8]; char *rparam=NULL, *rdata=NULL; - int rparam_count=0, rdata_count=0; + unsigned int rparam_count=0, rdata_count=0; uint32 sec_info = 0; TALLOC_CTX *mem_ctx; prs_struct pd; diff --git a/source3/libsmb/clispnego.c b/source3/libsmb/clispnego.c index b0570b09b6..63076a1a1c 100644 --- a/source3/libsmb/clispnego.c +++ b/source3/libsmb/clispnego.c @@ -331,6 +331,9 @@ DATA_BLOB spnego_gen_negTokenTarg(const char *principal, int time_offset, unsign /* get a kerberos ticket for the service and extract the session key */ tkt = cli_krb5_get_ticket(principal, time_offset, session_key_krb5); + if (tkt.data == NULL) + return tkt; + /* wrap that up in a nice GSS-API wrapping */ tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ); diff --git a/source3/libsmb/namequery.c b/source3/libsmb/namequery.c index 9875f77c72..1de7413711 100644 --- a/source3/libsmb/namequery.c +++ b/source3/libsmb/namequery.c @@ -61,7 +61,7 @@ static struct node_status *parse_node_status(char *p, int *num_names) p++; for (i=0;i< *num_names;i++) { StrnCpy(ret[i].name,p,15); - trim_string(ret[i].name,NULL," "); + trim_char(ret[i].name,'\0',' '); ret[i].type = CVAL(p,15); ret[i].flags = p[16]; p += 18; diff --git a/source3/libsmb/namequery_dc.c b/source3/libsmb/namequery_dc.c index c9d45a7acc..a596f00ddb 100644 --- a/source3/libsmb/namequery_dc.c +++ b/source3/libsmb/namequery_dc.c @@ -161,18 +161,28 @@ BOOL get_dc_name(const char *domain, fstring srv_name, struct in_addr *ip_out) { struct in_addr dc_ip; BOOL ret; + BOOL our_domain = False; zero_ip(&dc_ip); ret = False; - if (lp_security() == SEC_ADS) + + if ( strequal(lp_workgroup(), domain) || strequal(lp_realm(), domain) ) + our_domain = True; + + /* always try to obey what the admin specified in smb.conf. + If it is not our domain, assume that domain names with periods + in them are realm names */ + + if ( (our_domain && lp_security()==SEC_ADS) || strchr_m(domain, '.') ) { ret = ads_dc_name(domain, &dc_ip, srv_name); - + } + if (!ret) { /* fall back on rpc methods if the ADS methods fail */ ret = rpc_dc_name(domain, srv_name, &dc_ip); } - + *ip_out = dc_ip; return ret; diff --git a/source3/libsmb/nmblib.c b/source3/libsmb/nmblib.c index 6ee05f0104..ff38245435 100644 --- a/source3/libsmb/nmblib.c +++ b/source3/libsmb/nmblib.c @@ -310,21 +310,24 @@ static int put_nmb_name(char *buf,int offset,struct nmb_name *name) } /******************************************************************* - useful for debugging messages - ******************************************************************/ + Useful for debugging messages. +******************************************************************/ + char *nmb_namestr(struct nmb_name *n) { - static int i=0; - static fstring ret[4]; - char *p = ret[i]; - - if (!n->scope[0]) - slprintf(p,sizeof(fstring)-1, "%s<%02x>",n->name,n->name_type); - else - slprintf(p,sizeof(fstring)-1, "%s<%02x>.%s",n->name,n->name_type,n->scope); - - i = (i+1)%4; - return(p); + static int i=0; + static fstring ret[4]; + fstring name; + char *p = ret[i]; + + pull_ascii_fstring(name, n->name); + if (!n->scope[0]) + slprintf(p,sizeof(fstring)-1, "%s<%02x>",name,n->name_type); + else + slprintf(p,sizeof(fstring)-1, "%s<%02x>.%s",name,n->name_type,n->scope); + + i = (i+1)%4; + return(p); } /******************************************************************* @@ -820,10 +823,9 @@ static int build_dgram(char *buf,struct packet_struct *p) void make_nmb_name( struct nmb_name *n, const char *name, int type) { memset( (char *)n, '\0', sizeof(struct nmb_name) ); - push_ascii(n->name, name, 16, STR_TERMINATE|STR_UPPER); + push_ascii(n->name, name, sizeof(n->name), STR_TERMINATE|STR_UPPER); n->name_type = (unsigned int)type & 0xFF; - StrnCpy( n->scope, global_scope(), 63 ); - strupper_m( n->scope ); + push_ascii(n->scope, global_scope(), 64, STR_TERMINATE); } /******************************************************************* diff --git a/source3/libsmb/ntlmssp.c b/source3/libsmb/ntlmssp.c index a50ae9b70f..42bf18d1d2 100644 --- a/source3/libsmb/ntlmssp.c +++ b/source3/libsmb/ntlmssp.c @@ -140,7 +140,7 @@ static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state, &cliname, &domname)) { DEBUG(1, ("ntlmssp_server_negotiate: failed to parse NTLMSSP:\n")); - dump_data(2, request.data, request.length); + dump_data(2, (const char *)request.data, request.length); return NT_STATUS_INVALID_PARAMETER; } @@ -172,6 +172,9 @@ static NTSTATUS ntlmssp_server_negotiate(struct ntlmssp_state *ntlmssp_state, target_name = ntlmssp_target_name(ntlmssp_state, neg_flags, &chal_flags); + if (target_name == NULL) + return NT_STATUS_INVALID_PARAMETER; + /* This should be a 'netbios domain -> DNS domain' mapping */ dnsdomname[0] = '\0'; get_mydomname(dnsdomname); @@ -273,7 +276,7 @@ static NTSTATUS ntlmssp_server_auth(struct ntlmssp_state *ntlmssp_state, &sess_key, &neg_flags)) { DEBUG(1, ("ntlmssp_server_auth: failed to parse NTLMSSP:\n")); - dump_data(2, request.data, request.length); + dump_data(2, (const char *)request.data, request.length); return NT_STATUS_INVALID_PARAMETER; } @@ -412,6 +415,8 @@ static NTSTATUS ntlmssp_client_initial(struct ntlmssp_client_state *ntlmssp_stat if (ntlmssp_state->use_ntlmv2) { ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2; } + + ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2; /* generate the ntlmssp negotiate packet */ msrpc_gen(next_request, "CddAA", @@ -446,16 +451,7 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st DATA_BLOB lm_response = data_blob(NULL, 0); DATA_BLOB nt_response = data_blob(NULL, 0); DATA_BLOB session_key = data_blob(NULL, 0); - uint8 datagram_sess_key[16]; - size_t datagram_sess_key_len; - -#if 0 /* until we know what flag to tigger it on */ - generate_random_buffer(datagram_sess_key, sizeof(datagram_sess_key), False); - datagram_sess_key_len = sizeof(datagram_sess_key); -#else - ZERO_STRUCT(datagram_sess_key); - datagram_sess_key_len = 0; -#endif + DATA_BLOB encrypted_session_key = data_blob(NULL, 0); if (!msrpc_parse(&reply, "CdBd", "NTLMSSP", @@ -463,7 +459,7 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st &server_domain_blob, &chal_flags)) { DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n")); - dump_data(2, reply.data, reply.length); + dump_data(2, (const char *)reply.data, reply.length); return NT_STATUS_INVALID_PARAMETER; } @@ -489,7 +485,9 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st } else { chal_parse_string = "CdAdbdd"; } + auth_gen_string = "CdBBAAABd"; + ntlmssp_state->unicode = False; ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_UNICODE; ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM; @@ -513,6 +511,10 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_128; } + if (!(chal_flags & NTLMSSP_NEGOTIATE_KEY_EXCH)) { + ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_KEY_EXCH; + } + DEBUG(3, ("NTLMSSP: Set final flags:\n")); debug_ntlmssp_flags(ntlmssp_state->neg_flags); @@ -525,17 +527,22 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st &unkn1, &unkn2, &struct_blob)) { DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#2)\n")); - dump_data(2, reply.data, reply.length); + dump_data(2, (const char *)reply.data, reply.length); return NT_STATUS_INVALID_PARAMETER; } + ntlmssp_state->server_domain = talloc_strdup(ntlmssp_state->mem_ctx, + server_domain); + SAFE_FREE(server_domain); if (challenge_blob.length != 8) { data_blob_free(&struct_blob); return NT_STATUS_INVALID_PARAMETER; } - if (ntlmssp_state->use_ntlmv2) { + if (!ntlmssp_state->password) { + /* do nothing - blobs are zero length */ + } else if (ntlmssp_state->use_ntlmv2) { if (!struct_blob.length) { /* be lazy, match win2k - we can't do NTLMv2 without it */ @@ -554,7 +561,38 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st data_blob_free(&struct_blob); return NT_STATUS_NO_MEMORY; } + } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) { + struct MD5Context md5_session_nonce_ctx; + uchar nt_hash[16]; + uchar session_nonce[16]; + uchar session_nonce_hash[16]; + uchar nt_session_key[16]; + E_md4hash(ntlmssp_state->password, nt_hash); + + lm_response = data_blob(NULL, 24); + generate_random_buffer(lm_response.data, 8, False); + memset(lm_response.data+8, 0, 16); + + memcpy(session_nonce, challenge_blob.data, 8); + memcpy(&session_nonce[8], lm_response.data, 8); + + MD5Init(&md5_session_nonce_ctx); + MD5Update(&md5_session_nonce_ctx, challenge_blob.data, 8); + MD5Update(&md5_session_nonce_ctx, lm_response.data, 8); + MD5Final(session_nonce_hash, &md5_session_nonce_ctx); + + nt_response = data_blob(NULL, 24); + SMBNTencrypt(ntlmssp_state->password, + session_nonce_hash, + nt_response.data); + + session_key = data_blob(NULL, 16); + + SMBsesskeygen_ntv1(nt_hash, NULL, nt_session_key); + hmac_md5(nt_session_key, session_nonce, sizeof(session_nonce), session_key.data); } else { + + uchar lm_hash[16]; uchar nt_hash[16]; E_deshash(ntlmssp_state->password, lm_hash); @@ -565,15 +603,15 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st lm_response = data_blob(NULL, 24); SMBencrypt(ntlmssp_state->password,challenge_blob.data, lm_response.data); - } + } nt_response = data_blob(NULL, 24); SMBNTencrypt(ntlmssp_state->password,challenge_blob.data, nt_response.data); - + session_key = data_blob(NULL, 16); if ((ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) - && lp_client_lanman_auth()) { + && lp_client_lanman_auth()) { SMBsesskeygen_lmv1(lm_hash, lm_response.data, session_key.data); } else { @@ -582,6 +620,18 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st } data_blob_free(&struct_blob); + /* Key exchange encryptes a new client-generated session key with + the password-derived key */ + if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) { + uint8 client_session_key[16]; + + generate_random_buffer(client_session_key, sizeof(client_session_key), False); + encrypted_session_key = data_blob(client_session_key, sizeof(client_session_key)); + SamOEMhash(encrypted_session_key.data, session_key.data, encrypted_session_key.length); + data_blob_free(&session_key); + session_key = data_blob(client_session_key, sizeof(client_session_key)); + } + /* this generates the actual auth packet */ if (!msrpc_gen(next_request, auth_gen_string, "NTLMSSP", @@ -591,7 +641,7 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st ntlmssp_state->domain, ntlmssp_state->user, ntlmssp_state->get_global_myname(), - datagram_sess_key, datagram_sess_key_len, + encrypted_session_key.data, encrypted_session_key.length, ntlmssp_state->neg_flags)) { data_blob_free(&lm_response); @@ -600,6 +650,8 @@ static NTSTATUS ntlmssp_client_challenge(struct ntlmssp_client_state *ntlmssp_st return NT_STATUS_NO_MEMORY; } + data_blob_free(&encrypted_session_key); + data_blob_free(&ntlmssp_state->chal); data_blob_free(&ntlmssp_state->lm_resp); data_blob_free(&ntlmssp_state->nt_resp); @@ -638,6 +690,8 @@ NTSTATUS ntlmssp_client_start(NTLMSSP_CLIENT_STATE **ntlmssp_state) (*ntlmssp_state)->neg_flags = NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_NTLM | + NTLMSSP_NEGOTIATE_NTLM2 | + NTLMSSP_NEGOTIATE_KEY_EXCH | NTLMSSP_REQUEST_TARGET; (*ntlmssp_state)->ref_count = 1; @@ -706,9 +760,13 @@ NTSTATUS ntlmssp_set_username(NTLMSSP_CLIENT_STATE *ntlmssp_state, const char *u NTSTATUS ntlmssp_set_password(NTLMSSP_CLIENT_STATE *ntlmssp_state, const char *password) { - ntlmssp_state->password = talloc_strdup(ntlmssp_state->mem_ctx, password); - if (!ntlmssp_state->password) { - return NT_STATUS_NO_MEMORY; + if (!password) { + ntlmssp_state->password = NULL; + } else { + ntlmssp_state->password = talloc_strdup(ntlmssp_state->mem_ctx, password); + if (!ntlmssp_state->password) { + return NT_STATUS_NO_MEMORY; + } } return NT_STATUS_OK; } diff --git a/source3/libsmb/ntlmssp_parse.c b/source3/libsmb/ntlmssp_parse.c index 3c6da349e4..60cb4ab04a 100644 --- a/source3/libsmb/ntlmssp_parse.c +++ b/source3/libsmb/ntlmssp_parse.c @@ -153,7 +153,8 @@ BOOL msrpc_gen(DATA_BLOB *blob, SSVAL(blob->data, head_ofs, n); head_ofs += 2; SSVAL(blob->data, head_ofs, n); head_ofs += 2; SIVAL(blob->data, head_ofs, data_ofs); head_ofs += 4; - memcpy(blob->data+data_ofs, b, n); + if (n && b) /* don't follow null pointers... */ + memcpy(blob->data+data_ofs, b, n); data_ofs += n; break; case 'd': diff --git a/source3/libsmb/ntlmssp_sign.c b/source3/libsmb/ntlmssp_sign.c index ecaef808c9..ff2f97c2e8 100644 --- a/source3/libsmb/ntlmssp_sign.c +++ b/source3/libsmb/ntlmssp_sign.c @@ -91,8 +91,8 @@ static void calc_ntlmv2_hash(unsigned char hash[16], char digest[16], MD5Init(&ctx3); MD5Update(&ctx3, session_key.data, session_key.length); - MD5Update(&ctx3, constant, strlen(constant)); - MD5Final(digest, &ctx3); + MD5Update(&ctx3, (const unsigned char *)constant, strlen(constant)); + MD5Final((unsigned char *)digest, &ctx3); calc_hash(hash, digest, 16); } @@ -113,8 +113,8 @@ static NTSTATUS ntlmssp_make_packet_signature(NTLMSSP_CLIENT_STATE *ntlmssp_stat uchar digest[16]; SIVAL(seq_num, 0, ntlmssp_state->ntlmssp_seq_num); - hmac_md5_init_limK_to_64(ntlmssp_state->cli_sign_const, 16, &ctx); - hmac_md5_update(seq_num, 4, &ctx); + hmac_md5_init_limK_to_64((const unsigned char *)(ntlmssp_state->cli_sign_const), 16, &ctx); + hmac_md5_update((const unsigned char *)seq_num, 4, &ctx); hmac_md5_update(data, length, &ctx); hmac_md5_final(digest, &ctx); @@ -132,7 +132,7 @@ static NTSTATUS ntlmssp_make_packet_signature(NTLMSSP_CLIENT_STATE *ntlmssp_stat } } else { uint32 crc; - crc = crc32_calc_buffer(data, length); + crc = crc32_calc_buffer((const char *)data, length); if (!msrpc_gen(sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmssp_seq_num)) { return NT_STATUS_NO_MEMORY; } @@ -183,10 +183,10 @@ NTSTATUS ntlmssp_client_check_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, if (memcmp(sig->data+sig->length - 8, local_sig.data+local_sig.length - 8, 8) != 0) { DEBUG(5, ("BAD SIG: wanted signature of\n")); - dump_data(5, local_sig.data, local_sig.length); + dump_data(5, (const char *)local_sig.data, local_sig.length); DEBUG(5, ("BAD SIG: got signature of\n")); - dump_data(5, sig->data, sig->length); + dump_data(5, (const char *)(sig->data), sig->length); DEBUG(0, ("NTLMSSP packet check failed due to invalid signature!\n")); return NT_STATUS_ACCESS_DENIED; @@ -216,8 +216,8 @@ NTSTATUS ntlmssp_client_seal_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, uchar digest[16]; SIVAL(seq_num, 0, ntlmssp_state->ntlmssp_seq_num); - hmac_md5_init_limK_to_64(ntlmssp_state->cli_sign_const, 16, &ctx); - hmac_md5_update(seq_num, 4, &ctx); + hmac_md5_init_limK_to_64((const unsigned char *)(ntlmssp_state->cli_sign_const), 16, &ctx); + hmac_md5_update((const unsigned char *)seq_num, 4, &ctx); hmac_md5_update(data, length, &ctx); hmac_md5_final(digest, &ctx); @@ -236,7 +236,7 @@ NTSTATUS ntlmssp_client_seal_packet(NTLMSSP_CLIENT_STATE *ntlmssp_state, NTLMSSPcalc_ap(ntlmssp_state->cli_sign_hash, sig->data+4, sig->length-4); } else { uint32 crc; - crc = crc32_calc_buffer(data, length); + crc = crc32_calc_buffer((const char *)data, length); if (!msrpc_gen(sig, "dddd", NTLMSSP_SIGN_VERSION, 0, crc, ntlmssp_state->ntlmssp_seq_num)) { return NT_STATUS_NO_MEMORY; } @@ -335,7 +335,7 @@ NTSTATUS ntlmssp_client_sign_init(NTLMSSP_CLIENT_STATE *ntlmssp_state) DEBUG(5, ("NTLMSSP Sign/Seal - using LM KEY\n")); - calc_hash(ntlmssp_state->ntlmssp_hash, ntlmssp_state->session_key.data, 8); + calc_hash(ntlmssp_state->ntlmssp_hash, (const char *)(ntlmssp_state->session_key.data), 8); dump_data_pw("NTLMSSP hash:\n", ntlmssp_state->ntlmssp_hash, sizeof(ntlmssp_state->ntlmssp_hash)); } else { @@ -347,7 +347,7 @@ NTSTATUS ntlmssp_client_sign_init(NTLMSSP_CLIENT_STATE *ntlmssp_state) DEBUG(5, ("NTLMSSP Sign/Seal - using NT KEY\n")); - calc_hash(ntlmssp_state->ntlmssp_hash, ntlmssp_state->session_key.data, 16); + calc_hash(ntlmssp_state->ntlmssp_hash, (const char *)(ntlmssp_state->session_key.data), 16); dump_data_pw("NTLMSSP hash:\n", ntlmssp_state->ntlmssp_hash, sizeof(ntlmssp_state->ntlmssp_hash)); } diff --git a/source3/libsmb/smb_signing.c b/source3/libsmb/smb_signing.c index 4167452953..08ff655a3f 100644 --- a/source3/libsmb/smb_signing.c +++ b/source3/libsmb/smb_signing.c @@ -25,6 +25,7 @@ struct outstanding_packet_lookup { uint16 mid; uint32 reply_seq_num; + BOOL deferred_packet; struct outstanding_packet_lookup *prev, *next; }; @@ -43,7 +44,7 @@ struct smb_basic_signing_context { }; static void store_sequence_for_reply(struct outstanding_packet_lookup **list, - uint16 mid, uint32 reply_seq_num) + uint16 mid, uint32 reply_seq_num, BOOL deferred_pkt) { struct outstanding_packet_lookup *t; struct outstanding_packet_lookup *tmp; @@ -54,19 +55,25 @@ static void store_sequence_for_reply(struct outstanding_packet_lookup **list, DLIST_ADD_END(*list, t, tmp); t->mid = mid; t->reply_seq_num = reply_seq_num; - DEBUG(10,("store_sequence_for_reply: stored seq = %u mid = %u\n", + t->deferred_packet = deferred_pkt; + + DEBUG(10,("store_sequence_for_reply: stored %sseq = %u mid = %u\n", + deferred_pkt ? "deferred " : "", (unsigned int)reply_seq_num, (unsigned int)mid )); } static BOOL get_sequence_for_reply(struct outstanding_packet_lookup **list, - uint16 mid, uint32 *reply_seq_num) + uint16 mid, uint32 *reply_seq_num, BOOL *def) { struct outstanding_packet_lookup *t; for (t = *list; t; t = t->next) { if (t->mid == mid) { *reply_seq_num = t->reply_seq_num; - DEBUG(10,("get_sequence_for_reply: found seq = %u mid = %u\n", + if (def) + *def = t->deferred_packet; + DEBUG(10,("get_sequence_for_reply: found %sseq = %u mid = %u\n", + (t->deferred_packet) ? "deferred " : "", (unsigned int)t->reply_seq_num, (unsigned int)t->mid )); DLIST_REMOVE(*list, t); SAFE_FREE(t); @@ -76,6 +83,22 @@ static BOOL get_sequence_for_reply(struct outstanding_packet_lookup **list, return False; } +/*********************************************************** + A reply is pending if there is a non-deferred packet on the queue. +************************************************************/ + +static BOOL is_reply_pending(struct outstanding_packet_lookup *list) +{ + for (; list; list = list->next) { + if (!list->deferred_packet) { + DEBUG(10,("is_reply_pending: True.\n")); + return True; + } + } + DEBUG(10,("is_reply_pending: False.\n")); + return False; +} + /*********************************************************** SMB signing - Common code before we set a new signing implementation ************************************************************/ @@ -188,7 +211,7 @@ static void free_signing_context(struct smb_sign_info *si) } -static BOOL signing_good(char *inbuf, struct smb_sign_info *si, BOOL good) +static BOOL signing_good(char *inbuf, struct smb_sign_info *si, BOOL good, uint32 seq) { if (good && !si->doing_signing) { si->doing_signing = True; @@ -200,7 +223,8 @@ static BOOL signing_good(char *inbuf, struct smb_sign_info *si, BOOL good) /* W2K sends a bad first signature but the sign engine is on.... JRA. */ if (data->send_seq_num > 1) - DEBUG(1, ("signing_good: SMB signature check failed!\n")); + DEBUG(1, ("signing_good: SMB signature check failed on seq %u!\n", + (unsigned int)seq )); return False; } else { @@ -290,10 +314,10 @@ static void client_sign_outgoing_message(char *outbuf, struct smb_sign_info *si) else send_seq_num = data->send_seq_num; - simple_packet_signature(data, outbuf, send_seq_num, calc_md5_mac); + simple_packet_signature(data, (const unsigned char *)outbuf, send_seq_num, calc_md5_mac); DEBUG(10, ("client_sign_outgoing_message: sent SMB signature of\n")); - dump_data(10, calc_md5_mac, 8); + dump_data(10, (const char *)calc_md5_mac, 8); memcpy(&outbuf[smb_ss_field], calc_md5_mac, 8); @@ -306,7 +330,7 @@ static void client_sign_outgoing_message(char *outbuf, struct smb_sign_info *si) data->send_seq_num++; store_sequence_for_reply(&data->outstanding_packet_list, SVAL(outbuf,smb_mid), - data->send_seq_num); + data->send_seq_num, False); data->send_seq_num++; } @@ -318,6 +342,7 @@ static BOOL client_check_incoming_message(char *inbuf, struct smb_sign_info *si) { BOOL good; uint32 reply_seq_number; + uint32 saved_seq; unsigned char calc_md5_mac[16]; unsigned char *server_sent_mac; @@ -335,29 +360,30 @@ static BOOL client_check_incoming_message(char *inbuf, struct smb_sign_info *si) reply_seq_number = data->trans_info->reply_seq_num; } else if (!get_sequence_for_reply(&data->outstanding_packet_list, SVAL(inbuf, smb_mid), - &reply_seq_number)) { + &reply_seq_number, NULL)) { DEBUG(1, ("client_check_incoming_message: failed to get sequence number %u for reply.\n", (unsigned int) SVAL(inbuf, smb_mid) )); return False; } - simple_packet_signature(data, inbuf, reply_seq_number, calc_md5_mac); + saved_seq = reply_seq_number; + simple_packet_signature(data, (const unsigned char *)inbuf, reply_seq_number, calc_md5_mac); - server_sent_mac = &inbuf[smb_ss_field]; + server_sent_mac = (unsigned char *)&inbuf[smb_ss_field]; good = (memcmp(server_sent_mac, calc_md5_mac, 8) == 0); if (!good) { DEBUG(5, ("client_check_incoming_message: BAD SIG: wanted SMB signature of\n")); - dump_data(5, calc_md5_mac, 8); + dump_data(5, (const char *)calc_md5_mac, 8); DEBUG(5, ("client_check_incoming_message: BAD SIG: got SMB signature of\n")); - dump_data(5, server_sent_mac, 8); + dump_data(5, (const char *)server_sent_mac, 8); #if 1 /* JRATEST */ { int i; reply_seq_number -= 5; for (i = 0; i < 10; i++, reply_seq_number++) { - simple_packet_signature(data, inbuf, reply_seq_number, calc_md5_mac); + simple_packet_signature(data, (const unsigned char *)inbuf, reply_seq_number, calc_md5_mac); if (memcmp(server_sent_mac, calc_md5_mac, 8) == 0) { DEBUG(0,("client_check_incoming_message: out of seq. seq num %u matches.\n", reply_seq_number )); @@ -369,9 +395,9 @@ static BOOL client_check_incoming_message(char *inbuf, struct smb_sign_info *si) } else { DEBUG(10, ("client_check_incoming_message:: seq %u: got good SMB signature of\n", (unsigned int)reply_seq_number)); - dump_data(10, server_sent_mac, 8); + dump_data(10, (const char *)server_sent_mac, 8); } - return signing_good(inbuf, si, good); + return signing_good(inbuf, si, good, saved_seq); } /*********************************************************** @@ -428,12 +454,12 @@ BOOL cli_simple_set_signing(struct cli_state *cli, const uchar user_session_key[ memcpy(&data->mac_key.data[0], user_session_key, 16); DEBUG(10, ("cli_simple_set_signing: user_session_key\n")); - dump_data(10, user_session_key, 16); + dump_data(10, (const char *)user_session_key, 16); if (response.length) { memcpy(&data->mac_key.data[16],response.data, response.length); DEBUG(10, ("cli_simple_set_signing: response_data\n")); - dump_data(10, response.data, response.length); + dump_data(10, (const char *)response.data, response.length); } else { DEBUG(10, ("cli_simple_set_signing: NULL response_data\n")); } @@ -584,17 +610,6 @@ BOOL cli_check_sign_mac(struct cli_state *cli) return True; } -static BOOL packet_is_oplock_break(char *buf) -{ - if (CVAL(buf,smb_com) != SMBlockingX) - return False; - - if (CVAL(buf,smb_vwv3) != LOCKING_ANDX_OPLOCK_RELEASE) - return False; - - return True; -} - /*********************************************************** SMB signing - Server implementation - send the MAC. ************************************************************/ @@ -608,25 +623,6 @@ static void srv_sign_outgoing_message(char *outbuf, struct smb_sign_info *si) uint16 mid; if (!si->doing_signing) { - if (si->allow_smb_signing && si->negotiated_smb_signing) { - mid = SVAL(outbuf, smb_mid); - - was_deferred_packet = get_sequence_for_reply(&data->outstanding_packet_list, - mid, &send_seq_number); - if (!was_deferred_packet) { - /* - * Is this an outgoing oplock break ? If so, store the - * mid in the outstanding list. - */ - - if (packet_is_oplock_break(outbuf)) { - store_sequence_for_reply(&data->outstanding_packet_list, - mid, data->send_seq_num); - } - - data->send_seq_num++; - } - } return; } @@ -643,7 +639,7 @@ static void srv_sign_outgoing_message(char *outbuf, struct smb_sign_info *si) mid = SVAL(outbuf, smb_mid); /* See if this is a reply for a deferred packet. */ - was_deferred_packet = get_sequence_for_reply(&data->outstanding_packet_list, mid, &send_seq_number); + get_sequence_for_reply(&data->outstanding_packet_list, mid, &send_seq_number, &was_deferred_packet); if (data->trans_info && (data->trans_info->mid == mid)) { /* This is a reply in a trans stream. Use the sequence @@ -651,10 +647,10 @@ static void srv_sign_outgoing_message(char *outbuf, struct smb_sign_info *si) send_seq_number = data->trans_info->send_seq_num; } - simple_packet_signature(data, outbuf, send_seq_number, calc_md5_mac); + simple_packet_signature(data, (const unsigned char *)outbuf, send_seq_number, calc_md5_mac); DEBUG(10, ("srv_sign_outgoing_message: seq %u: sent SMB signature of\n", (unsigned int)send_seq_number)); - dump_data(10, calc_md5_mac, 8); + dump_data(10, (const char *)calc_md5_mac, 8); memcpy(&outbuf[smb_ss_field], calc_md5_mac, 8); @@ -662,7 +658,7 @@ static void srv_sign_outgoing_message(char *outbuf, struct smb_sign_info *si) Uncomment this to test if the remote server actually verifies signatures...*/ if (!was_deferred_packet) { - if (!data->trans_info) { + if (!data->trans_info) { /* Always increment if not in a trans stream. */ data->send_seq_num++; } else if ((data->trans_info->send_seq_num == data->send_seq_num) || (data->trans_info->mid != mid)) { @@ -670,7 +666,23 @@ static void srv_sign_outgoing_message(char *outbuf, struct smb_sign_info *si) * packet that doesn't belong to this stream (different mid). */ data->send_seq_num++; } - } + } +} + +/*********************************************************** + Is an incoming packet an oplock break reply ? +************************************************************/ + +static BOOL is_oplock_break(char *inbuf) +{ + if (CVAL(inbuf,smb_com) != SMBlockingX) + return False; + + if (!(CVAL(inbuf,smb_vwv3) & LOCKING_ANDX_OPLOCK_RELEASE)) + return False; + + DEBUG(10,("is_oplock_break: Packet is oplock break\n")); + return True; } /*********************************************************** @@ -682,6 +694,7 @@ static BOOL srv_check_incoming_message(char *inbuf, struct smb_sign_info *si) BOOL good; struct smb_basic_signing_context *data = si->signing_context; uint32 reply_seq_number = data->send_seq_num; + uint32 saved_seq; unsigned char calc_md5_mac[16]; unsigned char *server_sent_mac; uint mid; @@ -703,30 +716,37 @@ static BOOL srv_check_incoming_message(char *inbuf, struct smb_sign_info *si) } else { /* We always increment the sequence number. */ data->send_seq_num++; - /* Oplock break requests store an outgoing mid in the packet list. */ - if (packet_is_oplock_break(inbuf)) - get_sequence_for_reply(&data->outstanding_packet_list, mid, &reply_seq_number); + + /* If we get an asynchronous oplock break reply and there + * isn't a reply pending we need to re-sync the sequence + * number. + */ + if (is_oplock_break(inbuf) && !is_reply_pending(data->outstanding_packet_list)) + data->send_seq_num++; } - simple_packet_signature(data, inbuf, reply_seq_number, calc_md5_mac); + saved_seq = reply_seq_number; + simple_packet_signature(data, (const unsigned char *)inbuf, reply_seq_number, calc_md5_mac); - server_sent_mac = &inbuf[smb_ss_field]; + server_sent_mac = (unsigned char *)&inbuf[smb_ss_field]; good = (memcmp(server_sent_mac, calc_md5_mac, 8) == 0); if (!good) { - DEBUG(5, ("srv_check_incoming_message: BAD SIG: wanted SMB signature of\n")); - dump_data(5, calc_md5_mac, 8); + DEBUG(5, ("srv_check_incoming_message: BAD SIG: seq %u wanted SMB signature of\n", + (unsigned int)saved_seq)); + dump_data(5, (const char *)calc_md5_mac, 8); - DEBUG(5, ("srv_check_incoming_message: BAD SIG: got SMB signature of\n")); - dump_data(5, server_sent_mac, 8); + DEBUG(5, ("srv_check_incoming_message: BAD SIG: seq %u got SMB signature of\n", + (unsigned int)saved_seq)); + dump_data(5, (const char *)server_sent_mac, 8); #if 1 /* JRATEST */ { int i; reply_seq_number -= 5; for (i = 0; i < 10; i++, reply_seq_number++) { - simple_packet_signature(data, inbuf, reply_seq_number, calc_md5_mac); + simple_packet_signature(data, (const unsigned char *)inbuf, reply_seq_number, calc_md5_mac); if (memcmp(server_sent_mac, calc_md5_mac, 8) == 0) { DEBUG(0,("srv_check_incoming_message: out of seq. seq num %u matches.\n", reply_seq_number )); @@ -737,10 +757,10 @@ static BOOL srv_check_incoming_message(char *inbuf, struct smb_sign_info *si) #endif /* JRATEST */ } else { - DEBUG(10, ("srv_check_incoming_message: seq %u: got good SMB signature of\n", (unsigned int)reply_seq_number)); - dump_data(10, server_sent_mac, 8); + DEBUG(10, ("srv_check_incoming_message: seq %u: (current is %u) got good SMB signature of\n", (unsigned int)reply_seq_number, (unsigned int)data->send_seq_num)); + dump_data(10, (const char *)server_sent_mac, 8); } - return signing_good(inbuf, si, good); + return signing_good(inbuf, si, good, saved_seq); } /*********************************************************** @@ -800,7 +820,7 @@ void srv_calculate_sign_mac(char *outbuf) Called by server to defer an outgoing packet. ************************************************************/ -void srv_defer_sign_response(uint16 mid) +void srv_defer_sign_response(uint16 mid, BOOL deferred_packet) { struct smb_basic_signing_context *data; @@ -813,7 +833,7 @@ void srv_defer_sign_response(uint16 mid) return; store_sequence_for_reply(&data->outstanding_packet_list, - mid, data->send_seq_num); + mid, data->send_seq_num, deferred_packet); data->send_seq_num++; } @@ -837,7 +857,7 @@ void srv_cancel_sign_response(uint16 mid) DEBUG(10,("srv_cancel_sign_response: for mid %u\n", (unsigned int)mid )); - while (get_sequence_for_reply(&data->outstanding_packet_list, mid, &dummy_seq)) + while (get_sequence_for_reply(&data->outstanding_packet_list, mid, &dummy_seq,NULL)) ; } diff --git a/source3/libsmb/smbencrypt.c b/source3/libsmb/smbencrypt.c index 7a1a2d7d18..ec31bb5dba 100644 --- a/source3/libsmb/smbencrypt.c +++ b/source3/libsmb/smbencrypt.c @@ -81,7 +81,7 @@ void E_deshash(const char *passwd, uchar p16[16]) push_ascii(dospwd, passwd, sizeof(dospwd), STR_UPPER|STR_TERMINATE); /* Only the fisrt 14 chars are considered, password need not be null terminated. */ - E_P16(dospwd, p16); + E_P16((const unsigned char *)dospwd, p16); ZERO_STRUCT(dospwd); } @@ -247,7 +247,7 @@ BOOL make_oem_passwd_hash(char data[516], const char *passwd, uchar old_pw_hash[ return True; } -/* Does the md5 encryption from the NT hash for NTLMv2. */ +/* Does the md5 encryption from the Key Response for NTLMv2. */ void SMBOWFencrypt_ntv2(const uchar kr[16], const DATA_BLOB *srv_chal, const DATA_BLOB *cli_chal, diff --git a/source3/libsmb/spnego.c b/source3/libsmb/spnego.c new file mode 100644 index 0000000000..50caf7b4c0 --- /dev/null +++ b/source3/libsmb/spnego.c @@ -0,0 +1,343 @@ +/* + Unix SMB/CIFS implementation. + + RFC2478 Compliant SPNEGO implementation + + Copyright (C) Jim McDonough 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_AUTH + +static BOOL read_negTokenInit(ASN1_DATA *asn1, negTokenInit_t *token) +{ + ZERO_STRUCTP(token); + + asn1_start_tag(asn1, ASN1_CONTEXT(0)); + asn1_start_tag(asn1, ASN1_SEQUENCE(0)); + + while (!asn1->has_error && 0 < asn1_tag_remaining(asn1)) { + int i; + + switch (asn1->data[asn1->ofs]) { + /* Read mechTypes */ + case ASN1_CONTEXT(0): + asn1_start_tag(asn1, ASN1_CONTEXT(0)); + asn1_start_tag(asn1, ASN1_SEQUENCE(0)); + + token->mechTypes = malloc(sizeof(*token->mechTypes)); + for (i = 0; !asn1->has_error && + 0 < asn1_tag_remaining(asn1); i++) { + token->mechTypes = + realloc(token->mechTypes, (i + 2) * + sizeof(*token->mechTypes)); + asn1_read_OID(asn1, token->mechTypes + i); + } + token->mechTypes[i] = NULL; + + asn1_end_tag(asn1); + asn1_end_tag(asn1); + break; + /* Read reqFlags */ + case ASN1_CONTEXT(1): + asn1_start_tag(asn1, ASN1_CONTEXT(1)); + asn1_read_Integer(asn1, &token->reqFlags); + token->reqFlags |= SPNEGO_REQ_FLAG; + asn1_end_tag(asn1); + break; + /* Read mechToken */ + case ASN1_CONTEXT(2): + asn1_start_tag(asn1, ASN1_CONTEXT(2)); + asn1_read_OctetString(asn1, &token->mechToken); + asn1_end_tag(asn1); + break; + /* Read mecListMIC */ + case ASN1_CONTEXT(3): + asn1_start_tag(asn1, ASN1_CONTEXT(3)); + if (asn1->data[asn1->ofs] == ASN1_OCTET_STRING) { + asn1_read_OctetString(asn1, + &token->mechListMIC); + } else { + /* RFC 2478 says we have an Octet String here, + but W2k sends something different... */ + char *mechListMIC; + asn1_push_tag(asn1, ASN1_SEQUENCE(0)); + asn1_push_tag(asn1, ASN1_CONTEXT(0)); + asn1_read_GeneralString(asn1, &mechListMIC); + asn1_pop_tag(asn1); + asn1_pop_tag(asn1); + + token->mechListMIC = + data_blob(mechListMIC, strlen(mechListMIC)); + SAFE_FREE(mechListMIC); + } + asn1_end_tag(asn1); + break; + default: + asn1->has_error = True; + break; + } + } + + asn1_end_tag(asn1); + asn1_end_tag(asn1); + + return !asn1->has_error; +} + +static BOOL write_negTokenInit(ASN1_DATA *asn1, negTokenInit_t *token) +{ + asn1_push_tag(asn1, ASN1_CONTEXT(0)); + asn1_push_tag(asn1, ASN1_SEQUENCE(0)); + + /* Write mechTypes */ + if (token->mechTypes && *token->mechTypes) { + int i; + + asn1_push_tag(asn1, ASN1_CONTEXT(0)); + asn1_push_tag(asn1, ASN1_SEQUENCE(0)); + for (i = 0; token->mechTypes[i]; i++) { + asn1_write_OID(asn1, token->mechTypes[i]); + } + asn1_pop_tag(asn1); + asn1_pop_tag(asn1); + } + + /* write reqFlags */ + if (token->reqFlags & SPNEGO_REQ_FLAG) { + int flags = token->reqFlags & ~SPNEGO_REQ_FLAG; + + asn1_push_tag(asn1, ASN1_CONTEXT(1)); + asn1_write_Integer(asn1, flags); + asn1_pop_tag(asn1); + } + + /* write mechToken */ + if (token->mechToken.data) { + asn1_push_tag(asn1, ASN1_CONTEXT(2)); + asn1_write_OctetString(asn1, token->mechToken.data, + token->mechToken.length); + asn1_pop_tag(asn1); + } + + /* write mechListMIC */ + if (token->mechListMIC.data) { + asn1_push_tag(asn1, ASN1_CONTEXT(3)); +#if 0 + /* This is what RFC 2478 says ... */ + asn1_write_OctetString(asn1, token->mechListMIC.data, + token->mechListMIC.length); +#else + /* ... but unfortunately this is what Windows + sends/expects */ + asn1_push_tag(asn1, ASN1_SEQUENCE(0)); + asn1_push_tag(asn1, ASN1_CONTEXT(0)); + asn1_push_tag(asn1, ASN1_GENERAL_STRING); + asn1_write(asn1, token->mechListMIC.data, + token->mechListMIC.length); + asn1_pop_tag(asn1); + asn1_pop_tag(asn1); + asn1_pop_tag(asn1); +#endif + asn1_pop_tag(asn1); + } + + asn1_pop_tag(asn1); + asn1_pop_tag(asn1); + + return !asn1->has_error; +} + +static BOOL read_negTokenTarg(ASN1_DATA *asn1, negTokenTarg_t *token) +{ + ZERO_STRUCTP(token); + + asn1_start_tag(asn1, ASN1_CONTEXT(1)); + asn1_start_tag(asn1, ASN1_SEQUENCE(0)); + + while (!asn1->has_error && 0 < asn1_tag_remaining(asn1)) { + switch (asn1->data[asn1->ofs]) { + case ASN1_CONTEXT(0): + asn1_start_tag(asn1, ASN1_CONTEXT(0)); + asn1_start_tag(asn1, ASN1_ENUMERATED); + asn1_read_uint8(asn1, &token->negResult); + asn1_end_tag(asn1); + asn1_end_tag(asn1); + break; + case ASN1_CONTEXT(1): + asn1_start_tag(asn1, ASN1_CONTEXT(1)); + asn1_read_OID(asn1, &token->supportedMech); + asn1_end_tag(asn1); + break; + case ASN1_CONTEXT(2): + asn1_start_tag(asn1, ASN1_CONTEXT(2)); + asn1_read_OctetString(asn1, &token->responseToken); + asn1_end_tag(asn1); + break; + case ASN1_CONTEXT(3): + asn1_start_tag(asn1, ASN1_CONTEXT(3)); + asn1_read_OctetString(asn1, &token->mechListMIC); + asn1_end_tag(asn1); + break; + default: + asn1->has_error = True; + break; + } + } + + asn1_end_tag(asn1); + asn1_end_tag(asn1); + + return !asn1->has_error; +} + +static BOOL write_negTokenTarg(ASN1_DATA *asn1, negTokenTarg_t *token) +{ + asn1_push_tag(asn1, ASN1_CONTEXT(1)); + asn1_push_tag(asn1, ASN1_SEQUENCE(0)); + + asn1_push_tag(asn1, ASN1_CONTEXT(0)); + asn1_write_enumerated(asn1, token->negResult); + asn1_pop_tag(asn1); + + if (token->supportedMech) { + asn1_push_tag(asn1, ASN1_CONTEXT(1)); + asn1_write_OID(asn1, token->supportedMech); + asn1_pop_tag(asn1); + } + + if (token->responseToken.data) { + asn1_push_tag(asn1, ASN1_CONTEXT(2)); + asn1_write_OctetString(asn1, token->responseToken.data, + token->responseToken.length); + asn1_pop_tag(asn1); + } + + if (token->mechListMIC.data) { + asn1_push_tag(asn1, ASN1_CONTEXT(3)); + asn1_write_OctetString(asn1, token->mechListMIC.data, + token->mechListMIC.length); + asn1_pop_tag(asn1); + } + + asn1_pop_tag(asn1); + asn1_pop_tag(asn1); + + return !asn1->has_error; +} + +ssize_t read_spnego_data(DATA_BLOB data, SPNEGO_DATA *token) +{ + ASN1_DATA asn1; + ssize_t ret = -1; + + ZERO_STRUCTP(token); + ZERO_STRUCT(asn1); + asn1_load(&asn1, data); + + switch (asn1.data[asn1.ofs]) { + case ASN1_APPLICATION(0): + asn1_start_tag(&asn1, ASN1_APPLICATION(0)); + asn1_check_OID(&asn1, OID_SPNEGO); + if (read_negTokenInit(&asn1, &token->negTokenInit)) { + token->type = SPNEGO_NEG_TOKEN_INIT; + } + asn1_end_tag(&asn1); + break; + case ASN1_CONTEXT(1): + if (read_negTokenTarg(&asn1, &token->negTokenTarg)) { + token->type = SPNEGO_NEG_TOKEN_TARG; + } + break; + default: + break; + } + + if (!asn1.has_error) ret = asn1.ofs; + asn1_free(&asn1); + + return ret; +} + +ssize_t write_spnego_data(DATA_BLOB *blob, SPNEGO_DATA *spnego) +{ + ASN1_DATA asn1; + ssize_t ret = -1; + + ZERO_STRUCT(asn1); + + switch (spnego->type) { + case SPNEGO_NEG_TOKEN_INIT: + asn1_push_tag(&asn1, ASN1_APPLICATION(0)); + asn1_write_OID(&asn1, OID_SPNEGO); + write_negTokenInit(&asn1, &spnego->negTokenInit); + asn1_pop_tag(&asn1); + break; + case SPNEGO_NEG_TOKEN_TARG: + write_negTokenTarg(&asn1, &spnego->negTokenTarg); + break; + default: + asn1.has_error = True; + break; + } + + if (!asn1.has_error) { + *blob = data_blob(asn1.data, asn1.length); + ret = asn1.ofs; + } + asn1_free(&asn1); + + return ret; +} + +BOOL free_spnego_data(SPNEGO_DATA *spnego) +{ + BOOL ret = True; + + if (!spnego) goto out; + + switch(spnego->type) { + case SPNEGO_NEG_TOKEN_INIT: + if (spnego->negTokenInit.mechTypes) { + int i; + for (i = 0; spnego->negTokenInit.mechTypes[i]; i++) { + free(spnego->negTokenInit.mechTypes[i]); + } + free(spnego->negTokenInit.mechTypes); + } + data_blob_free(&spnego->negTokenInit.mechToken); + data_blob_free(&spnego->negTokenInit.mechListMIC); + break; + case SPNEGO_NEG_TOKEN_TARG: + if (spnego->negTokenTarg.supportedMech) { + free(spnego->negTokenTarg.supportedMech); + } + data_blob_free(&spnego->negTokenTarg.responseToken); + data_blob_free(&spnego->negTokenTarg.mechListMIC); + break; + default: + ret = False; + break; + } + ZERO_STRUCTP(spnego); +out: + return ret; +} + diff --git a/source3/libsmb/trusts_util.c b/source3/libsmb/trusts_util.c index 610f4b3c03..4e02b29f92 100644 --- a/source3/libsmb/trusts_util.c +++ b/source3/libsmb/trusts_util.c @@ -35,16 +35,15 @@ static NTSTATUS just_change_the_password(struct cli_state *cli, TALLOC_CTX *mem_ uint32 sec_channel_type) { NTSTATUS result; - uint32 neg_flags = 0x000001ff; - result = cli_nt_setup_creds(cli, sec_channel_type, orig_trust_passwd_hash, &neg_flags, 2); - - if (!NT_STATUS_IS_OK(result)) { + /* ensure that schannel uses the right domain */ + fstrcpy(cli->domain, lp_workgroup()); + if (! NT_STATUS_IS_OK(result = cli_nt_establish_netlogon(cli, sec_channel_type, orig_trust_passwd_hash))) { DEBUG(3,("just_change_the_password: unable to setup creds (%s)!\n", nt_errstr(result))); return result; } - + result = cli_net_srv_pwset(cli, mem_ctx, global_myname(), new_trust_passwd_hash); if (!NT_STATUS_IS_OK(result)) { diff --git a/source3/locking/locking.c b/source3/locking/locking.c index 4475f1446f..91bc20af90 100644 --- a/source3/locking/locking.c +++ b/source3/locking/locking.c @@ -419,10 +419,10 @@ int get_share_modes(connection_struct *conn, struct locking_data *data; int num_share_modes; share_mode_entry *shares = NULL; - + TDB_DATA key = locking_key(dev, inode); *pp_shares = NULL; - dbuf = tdb_fetch(tdb, locking_key(dev, inode)); + dbuf = tdb_fetch(tdb, key); if (!dbuf.dptr) return 0; @@ -469,7 +469,7 @@ int get_share_modes(connection_struct *conn, /* The record has shrunk a bit */ dbuf.dsize -= del_count * sizeof(share_mode_entry); - if (tdb_store(tdb, locking_key(dev, inode), dbuf, TDB_REPLACE) == -1) { + if (tdb_store(tdb, key, dbuf, TDB_REPLACE) == -1) { SAFE_FREE(shares); SAFE_FREE(dbuf.dptr); return 0; @@ -544,12 +544,13 @@ ssize_t del_share_entry( SMB_DEV_T dev, SMB_INO_T inode, int i, del_count=0; share_mode_entry *shares; ssize_t count = 0; + TDB_DATA key = locking_key(dev, inode); if (ppse) *ppse = NULL; /* read in the existing share modes */ - dbuf = tdb_fetch(tdb, locking_key(dev, inode)); + dbuf = tdb_fetch(tdb, key); if (!dbuf.dptr) return -1; @@ -590,10 +591,10 @@ ssize_t del_share_entry( SMB_DEV_T dev, SMB_INO_T inode, /* store it back in the database */ if (data->u.num_share_mode_entries == 0) { - if (tdb_delete(tdb, locking_key(dev, inode)) == -1) + if (tdb_delete(tdb, key) == -1) count = -1; } else { - if (tdb_store(tdb, locking_key(dev, inode), dbuf, TDB_REPLACE) == -1) + if (tdb_store(tdb, key, dbuf, TDB_REPLACE) == -1) count = -1; } } @@ -630,10 +631,11 @@ BOOL set_share_mode(files_struct *fsp, uint16 port, uint16 op_type) struct locking_data *data; char *p=NULL; int size; + TDB_DATA key = locking_key_fsp(fsp); BOOL ret = True; /* read in the existing share modes if any */ - dbuf = tdb_fetch(tdb, locking_key_fsp(fsp)); + dbuf = tdb_fetch(tdb, key); if (!dbuf.dptr) { size_t offset; /* we'll need to create a new record */ @@ -658,7 +660,7 @@ BOOL set_share_mode(files_struct *fsp, uint16 port, uint16 op_type) fill_share_mode(p + sizeof(*data), fsp, port, op_type); dbuf.dptr = p; dbuf.dsize = size; - if (tdb_store(tdb, locking_key_fsp(fsp), dbuf, TDB_REPLACE) == -1) + if (tdb_store(tdb, key, dbuf, TDB_REPLACE) == -1) ret = False; print_share_mode_table((struct locking_data *)p); @@ -688,7 +690,7 @@ BOOL set_share_mode(files_struct *fsp, uint16 port, uint16 op_type) SAFE_FREE(dbuf.dptr); dbuf.dptr = p; dbuf.dsize = size; - if (tdb_store(tdb, locking_key_fsp(fsp), dbuf, TDB_REPLACE) == -1) + if (tdb_store(tdb, key, dbuf, TDB_REPLACE) == -1) ret = False; print_share_mode_table((struct locking_data *)p); SAFE_FREE(p); @@ -709,9 +711,10 @@ static BOOL mod_share_mode( SMB_DEV_T dev, SMB_INO_T inode, share_mode_entry *en share_mode_entry *shares; BOOL need_store=False; BOOL ret = True; + TDB_DATA key = locking_key(dev, inode); /* read in the existing share modes */ - dbuf = tdb_fetch(tdb, locking_key(dev, inode)); + dbuf = tdb_fetch(tdb, key); if (!dbuf.dptr) return False; @@ -729,10 +732,10 @@ static BOOL mod_share_mode( SMB_DEV_T dev, SMB_INO_T inode, share_mode_entry *en /* if the mod fn was called then store it back */ if (need_store) { if (data->u.num_share_mode_entries == 0) { - if (tdb_delete(tdb, locking_key(dev, inode)) == -1) + if (tdb_delete(tdb, key) == -1) ret = False; } else { - if (tdb_store(tdb, locking_key(dev, inode), dbuf, TDB_REPLACE) == -1) + if (tdb_store(tdb, key, dbuf, TDB_REPLACE) == -1) ret = False; } } @@ -808,9 +811,10 @@ BOOL modify_delete_flag( SMB_DEV_T dev, SMB_INO_T inode, BOOL delete_on_close) struct locking_data *data; int i; share_mode_entry *shares; + TDB_DATA key = locking_key(dev, inode); /* read in the existing share modes */ - dbuf = tdb_fetch(tdb, locking_key(dev, inode)); + dbuf = tdb_fetch(tdb, key); if (!dbuf.dptr) return False; @@ -826,7 +830,7 @@ BOOL modify_delete_flag( SMB_DEV_T dev, SMB_INO_T inode, BOOL delete_on_close) /* store it back */ if (data->u.num_share_mode_entries) { - if (tdb_store(tdb, locking_key(dev,inode), dbuf, TDB_REPLACE)==-1) { + if (tdb_store(tdb, key, dbuf, TDB_REPLACE)==-1) { SAFE_FREE(dbuf.dptr); return False; } diff --git a/source3/modules/CP437.c b/source3/modules/CP437.c new file mode 100644 index 0000000000..b7e7409746 --- /dev/null +++ b/source3/modules/CP437.c @@ -0,0 +1,136 @@ +/* + * Conversion table for CP437 charset also known as IBM437 + * + * Copyright (C) Alexander Bokovoy 2003 + * + * Conversion tables are generated using GNU libc 2.2.5's + * localedata/charmaps/IBM437 table and source/script/gen-8bit-gap.sh script + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "includes.h" + +static const uint16 to_ucs2[256] = { + 0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006, 0x0007, + 0x0008, 0x0009, 0x000A, 0x000B, 0x000C, 0x000D, 0x000E, 0x000F, + 0x0010, 0x0011, 0x0012, 0x0013, 0x0014, 0x0015, 0x0016, 0x0017, + 0x0018, 0x0019, 0x001A, 0x001B, 0x001C, 0x001D, 0x001E, 0x001F, + 0x0020, 0x0021, 0x0022, 0x0023, 0x0024, 0x0025, 0x0026, 0x0027, + 0x0028, 0x0029, 0x002A, 0x002B, 0x002C, 0x002D, 0x002E, 0x002F, + 0x0030, 0x0031, 0x0032, 0x0033, 0x0034, 0x0035, 0x0036, 0x0037, + 0x0038, 0x0039, 0x003A, 0x003B, 0x003C, 0x003D, 0x003E, 0x003F, + 0x0040, 0x0041, 0x0042, 0x0043, 0x0044, 0x0045, 0x0046, 0x0047, + 0x0048, 0x0049, 0x004A, 0x004B, 0x004C, 0x004D, 0x004E, 0x004F, + 0x0050, 0x0051, 0x0052, 0x0053, 0x0054, 0x0055, 0x0056, 0x0057, + 0x0058, 0x0059, 0x005A, 0x005B, 0x005C, 0x005D, 0x005E, 0x005F, + 0x0060, 0x0061, 0x0062, 0x0063, 0x0064, 0x0065, 0x0066, 0x0067, + 0x0068, 0x0069, 0x006A, 0x006B, 0x006C, 0x006D, 0x006E, 0x006F, + 0x0070, 0x0071, 0x0072, 0x0073, 0x0074, 0x0075, 0x0076, 0x0077, + 0x0078, 0x0079, 0x007A, 0x007B, 0x007C, 0x007D, 0x007E, 0x007F, + 0x00C7, 0x00FC, 0x00E9, 0x00E2, 0x00E4, 0x00E0, 0x00E5, 0x00E7, + 0x00EA, 0x00EB, 0x00E8, 0x00EF, 0x00EE, 0x00EC, 0x00C4, 0x00C5, + 0x00C9, 0x00E6, 0x00C6, 0x00F4, 0x00F6, 0x00F2, 0x00FB, 0x00F9, + 0x00FF, 0x00D6, 0x00DC, 0x00A2, 0x00A3, 0x00A5, 0x20A7, 0x0192, + 0x00E1, 0x00ED, 0x00F3, 0x00FA, 0x00F1, 0x00D1, 0x00AA, 0x00BA, + 0x00BF, 0x2310, 0x00AC, 0x00BD, 0x00BC, 0x00A1, 0x00AB, 0x00BB, + 0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x2561, 0x2562, 0x2556, + 0x2555, 0x2563, 0x2551, 0x2557, 0x255D, 0x255C, 0x255B, 0x2510, + 0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x255E, 0x255F, + 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x2567, + 0x2568, 0x2564, 0x2565, 0x2559, 0x2558, 0x2552, 0x2553, 0x256B, + 0x256A, 0x2518, 0x250C, 0x2588, 0x2584, 0x258C, 0x2590, 0x2580, + 0x03B1, 0x00DF, 0x0393, 0x03C0, 0x03A3, 0x03C3, 0x00B5, 0x03C4, + 0x03A6, 0x0398, 0x03A9, 0x03B4, 0x221E, 0x03C6, 0x03B5, 0x2229, + 0x2261, 0x00B1, 0x2265, 0x2264, 0x2320, 0x2321, 0x00F7, 0x2248, + 0x00B0, 0x2219, 0x00B7, 0x221A, 0x207F, 0x00B2, 0x25A0, 0x00A0, +}; + +static const struct charset_gap_table from_idx[] = { + { 0x0000, 0x007f, 0 }, + { 0x00a0, 0x00c9, -32 }, + { 0x00d1, 0x00ff, -39 }, + { 0x0192, 0x0192, -185 }, + { 0x0393, 0x0398, -697 }, + { 0x03a3, 0x03a9, -707 }, + { 0x03b1, 0x03b5, -714 }, + { 0x03c0, 0x03c6, -724 }, + { 0x207f, 0x207f, -8076 }, + { 0x20a7, 0x20a7, -8115 }, + { 0x2219, 0x221e, -8484 }, + { 0x2229, 0x2229, -8494 }, + { 0x2248, 0x2248, -8524 }, + { 0x2261, 0x2265, -8548 }, + { 0x2310, 0x2310, -8718 }, + { 0x2320, 0x2321, -8733 }, + { 0x2500, 0x2502, -9211 }, + { 0x250c, 0x251c, -9220 }, + { 0x2524, 0x2524, -9227 }, + { 0x252c, 0x252c, -9234 }, + { 0x2534, 0x2534, -9241 }, + { 0x253c, 0x253c, -9248 }, + { 0x2550, 0x256c, -9267 }, + { 0x2580, 0x2593, -9286 }, + { 0x25a0, 0x25a0, -9298 }, + { 0xffff, 0xffff, 0 } +}; + +static const unsigned char from_ucs2[] = { + + '\x00', '\x01', '\x02', '\x03', '\x04', '\x05', '\x06', '\x07', + '\x08', '\x09', '\x0a', '\x0b', '\x0c', '\x0d', '\x0e', '\x0f', + '\x10', '\x11', '\x12', '\x13', '\x14', '\x15', '\x16', '\x17', + '\x18', '\x19', '\x1a', '\x1b', '\x1c', '\x1d', '\x1e', '\x1f', + '\x20', '\x21', '\x22', '\x23', '\x24', '\x25', '\x26', '\x27', + '\x28', '\x29', '\x2a', '\x2b', '\x2c', '\x2d', '\x2e', '\x2f', + '\x30', '\x31', '\x32', '\x33', '\x34', '\x35', '\x36', '\x37', + '\x38', '\x39', '\x3a', '\x3b', '\x3c', '\x3d', '\x3e', '\x3f', + '\x40', '\x41', '\x42', '\x43', '\x44', '\x45', '\x46', '\x47', + '\x48', '\x49', '\x4a', '\x4b', '\x4c', '\x4d', '\x4e', '\x4f', + '\x50', '\x51', '\x52', '\x53', '\x54', '\x55', '\x56', '\x57', + '\x58', '\x59', '\x5a', '\x5b', '\x5c', '\x5d', '\x5e', '\x5f', + '\x60', '\x61', '\x62', '\x63', '\x64', '\x65', '\x66', '\x67', + '\x68', '\x69', '\x6a', '\x6b', '\x6c', '\x6d', '\x6e', '\x6f', + '\x70', '\x71', '\x72', '\x73', '\x74', '\x75', '\x76', '\x77', + '\x78', '\x79', '\x7a', '\x7b', '\x7c', '\x7d', '\x7e', '\x7f', + '\xff', '\xad', '\x9b', '\x9c', '\x00', '\x9d', '\x00', '\x00', + '\x00', '\x00', '\xa6', '\xae', '\xaa', '\x00', '\x00', '\x00', + '\xf8', '\xf1', '\xfd', '\x00', '\x00', '\xe6', '\x00', '\xfa', + '\x00', '\x00', '\xa7', '\xaf', '\xac', '\xab', '\x00', '\xa8', + '\x00', '\x00', '\x00', '\x00', '\x8e', '\x8f', '\x92', '\x80', + '\x00', '\x90', '\xa5', '\x00', '\x00', '\x00', '\x00', '\x99', + '\x00', '\x00', '\x00', '\x00', '\x00', '\x9a', '\x00', '\x00', + '\xe1', '\x85', '\xa0', '\x83', '\x00', '\x84', '\x86', '\x91', + '\x87', '\x8a', '\x82', '\x88', '\x89', '\x8d', '\xa1', '\x8c', + '\x8b', '\x00', '\xa4', '\x95', '\xa2', '\x93', '\x00', '\x94', + '\xf6', '\x00', '\x97', '\xa3', '\x96', '\x81', '\x00', '\x00', + '\x98', '\x9f', '\xe2', '\x00', '\x00', '\x00', '\x00', '\xe9', + '\xe4', '\x00', '\x00', '\xe8', '\x00', '\x00', '\xea', '\xe0', + '\x00', '\x00', '\xeb', '\xee', '\xe3', '\x00', '\x00', '\xe5', + '\xe7', '\x00', '\xed', '\xfc', '\x9e', '\xf9', '\xfb', '\x00', + '\x00', '\x00', '\xec', '\xef', '\xf7', '\xf0', '\x00', '\x00', + '\xf3', '\xf2', '\xa9', '\xf4', '\xf5', '\xc4', '\x00', '\xb3', + '\xda', '\x00', '\x00', '\x00', '\xbf', '\x00', '\x00', '\x00', + '\xc0', '\x00', '\x00', '\x00', '\xd9', '\x00', '\x00', '\x00', + '\xc3', '\xb4', '\xc2', '\xc1', '\xc5', '\xcd', '\xba', '\xd5', + '\xd6', '\xc9', '\xb8', '\xb7', '\xbb', '\xd4', '\xd3', '\xc8', + '\xbe', '\xbd', '\xbc', '\xc6', '\xc7', '\xcc', '\xb5', '\xb6', + '\xb9', '\xd1', '\xd2', '\xcb', '\xcf', '\xd0', '\xca', '\xd8', + '\xd7', '\xce', '\xdf', '\x00', '\x00', '\x00', '\xdc', '\x00', + '\x00', '\x00', '\xdb', '\x00', '\x00', '\x00', '\xdd', '\x00', + '\x00', '\x00', '\xde', '\xb0', '\xb1', '\xb2', '\xfe', +}; + +SMB_GENERATE_CHARSET_MODULE_8_BIT_GAP(CP437) diff --git a/source3/modules/CP850.c b/source3/modules/CP850.c new file mode 100644 index 0000000000..311d651068 --- /dev/null +++ b/source3/modules/CP850.c @@ -0,0 +1,122 @@ +/* + * Conversion table for CP850 charset also known as IBM850. + * + * Copyright (C) Alexander Bokovoy 2003 + * + * Conversion tables are generated using GNU libc 2.2.5's + * localedata/charmaps/IBM850 table and source/script/gen-8bit-gap.sh script + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "includes.h" + +static const uint16 to_ucs2[256] = { + 0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006, 0x0007, + 0x0008, 0x0009, 0x000A, 0x000B, 0x000C, 0x000D, 0x000E, 0x000F, + 0x0010, 0x0011, 0x0012, 0x0013, 0x0014, 0x0015, 0x0016, 0x0017, + 0x0018, 0x0019, 0x001A, 0x001B, 0x001C, 0x001D, 0x001E, 0x001F, + 0x0020, 0x0021, 0x0022, 0x0023, 0x0024, 0x0025, 0x0026, 0x0027, + 0x0028, 0x0029, 0x002A, 0x002B, 0x002C, 0x002D, 0x002E, 0x002F, + 0x0030, 0x0031, 0x0032, 0x0033, 0x0034, 0x0035, 0x0036, 0x0037, + 0x0038, 0x0039, 0x003A, 0x003B, 0x003C, 0x003D, 0x003E, 0x003F, + 0x0040, 0x0041, 0x0042, 0x0043, 0x0044, 0x0045, 0x0046, 0x0047, + 0x0048, 0x0049, 0x004A, 0x004B, 0x004C, 0x004D, 0x004E, 0x004F, + 0x0050, 0x0051, 0x0052, 0x0053, 0x0054, 0x0055, 0x0056, 0x0057, + 0x0058, 0x0059, 0x005A, 0x005B, 0x005C, 0x005D, 0x005E, 0x005F, + 0x0060, 0x0061, 0x0062, 0x0063, 0x0064, 0x0065, 0x0066, 0x0067, + 0x0068, 0x0069, 0x006A, 0x006B, 0x006C, 0x006D, 0x006E, 0x006F, + 0x0070, 0x0071, 0x0072, 0x0073, 0x0074, 0x0075, 0x0076, 0x0077, + 0x0078, 0x0079, 0x007A, 0x007B, 0x007C, 0x007D, 0x007E, 0x007F, + 0x00C7, 0x00FC, 0x00E9, 0x00E2, 0x00E4, 0x00E0, 0x00E5, 0x00E7, + 0x00EA, 0x00EB, 0x00E8, 0x00EF, 0x00EE, 0x00EC, 0x00C4, 0x00C5, + 0x00C9, 0x00E6, 0x00C6, 0x00F4, 0x00F6, 0x00F2, 0x00FB, 0x00F9, + 0x00FF, 0x00D6, 0x00DC, 0x00F8, 0x00A3, 0x00D8, 0x00D7, 0x0192, + 0x00E1, 0x00ED, 0x00F3, 0x00FA, 0x00F1, 0x00D1, 0x00AA, 0x00BA, + 0x00BF, 0x00AE, 0x00AC, 0x00BD, 0x00BC, 0x00A1, 0x00AB, 0x00BB, + 0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x00C1, 0x00C2, 0x00C0, + 0x00A9, 0x2563, 0x2551, 0x2557, 0x255D, 0x00A2, 0x00A5, 0x2510, + 0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x00E3, 0x00C3, + 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x00A4, + 0x00F0, 0x00D0, 0x00CA, 0x00CB, 0x00C8, 0x0131, 0x00CD, 0x00CE, + 0x00CF, 0x2518, 0x250C, 0x2588, 0x2584, 0x00A6, 0x00CC, 0x2580, + 0x00D3, 0x00DF, 0x00D4, 0x00D2, 0x00F5, 0x00D5, 0x00B5, 0x00FE, + 0x00DE, 0x00DA, 0x00DB, 0x00D9, 0x00FD, 0x00DD, 0x00AF, 0x00B4, + 0x00AD, 0x00B1, 0x2017, 0x00BE, 0x00B6, 0x00A7, 0x00F7, 0x00B8, + 0x00B0, 0x00A8, 0x00B7, 0x00B9, 0x00B3, 0x00B2, 0x25A0, 0x00A0, +}; + +static const struct charset_gap_table from_idx[] = { + /* start, end, idx */ + { 0x0000, 0x007f, 0 }, + { 0x00a0, 0x00ff, -32 }, + { 0x0131, 0x0131, -81 }, + { 0x0192, 0x0192, -177 }, + { 0x2017, 0x2017, -7989 }, + { 0x2500, 0x2502, -9245 }, + { 0x250c, 0x251c, -9254 }, + { 0x2524, 0x2524, -9261 }, + { 0x252c, 0x252c, -9268 }, + { 0x2534, 0x2534, -9275 }, + { 0x253c, 0x253c, -9282 }, + { 0x2550, 0x256c, -9301 }, + { 0x2580, 0x2588, -9320 }, + { 0x2591, 0x2593, -9328 }, + { 0x25a0, 0x25a0, -9340 }, + { 0xffff, 0xffff, 0 } +}; +static const unsigned char from_ucs2[] = { + + '\x00', '\x01', '\x02', '\x03', '\x04', '\x05', '\x06', '\x07', + '\x08', '\x09', '\x0a', '\x0b', '\x0c', '\x0d', '\x0e', '\x0f', + '\x10', '\x11', '\x12', '\x13', '\x14', '\x15', '\x16', '\x17', + '\x18', '\x19', '\x1a', '\x1b', '\x1c', '\x1d', '\x1e', '\x1f', + '\x20', '\x21', '\x22', '\x23', '\x24', '\x25', '\x26', '\x27', + '\x28', '\x29', '\x2a', '\x2b', '\x2c', '\x2d', '\x2e', '\x2f', + '\x30', '\x31', '\x32', '\x33', '\x34', '\x35', '\x36', '\x37', + '\x38', '\x39', '\x3a', '\x3b', '\x3c', '\x3d', '\x3e', '\x3f', + '\x40', '\x41', '\x42', '\x43', '\x44', '\x45', '\x46', '\x47', + '\x48', '\x49', '\x4a', '\x4b', '\x4c', '\x4d', '\x4e', '\x4f', + '\x50', '\x51', '\x52', '\x53', '\x54', '\x55', '\x56', '\x57', + '\x58', '\x59', '\x5a', '\x5b', '\x5c', '\x5d', '\x5e', '\x5f', + '\x60', '\x61', '\x62', '\x63', '\x64', '\x65', '\x66', '\x67', + '\x68', '\x69', '\x6a', '\x6b', '\x6c', '\x6d', '\x6e', '\x6f', + '\x70', '\x71', '\x72', '\x73', '\x74', '\x75', '\x76', '\x77', + '\x78', '\x79', '\x7a', '\x7b', '\x7c', '\x7d', '\x7e', '\x7f', + '\xff', '\xad', '\xbd', '\x9c', '\xcf', '\xbe', '\xdd', '\xf5', + '\xf9', '\xb8', '\xa6', '\xae', '\xaa', '\xf0', '\xa9', '\xee', + '\xf8', '\xf1', '\xfd', '\xfc', '\xef', '\xe6', '\xf4', '\xfa', + '\xf7', '\xfb', '\xa7', '\xaf', '\xac', '\xab', '\xf3', '\xa8', + '\xb7', '\xb5', '\xb6', '\xc7', '\x8e', '\x8f', '\x92', '\x80', + '\xd4', '\x90', '\xd2', '\xd3', '\xde', '\xd6', '\xd7', '\xd8', + '\xd1', '\xa5', '\xe3', '\xe0', '\xe2', '\xe5', '\x99', '\x9e', + '\x9d', '\xeb', '\xe9', '\xea', '\x9a', '\xed', '\xe8', '\xe1', + '\x85', '\xa0', '\x83', '\xc6', '\x84', '\x86', '\x91', '\x87', + '\x8a', '\x82', '\x88', '\x89', '\x8d', '\xa1', '\x8c', '\x8b', + '\xd0', '\xa4', '\x95', '\xa2', '\x93', '\xe4', '\x94', '\xf6', + '\x9b', '\x97', '\xa3', '\x96', '\x81', '\xec', '\xe7', '\x98', + '\xd5', '\x9f', '\xf2', '\xc4', '\x00', '\xb3', '\xda', '\x00', + '\x00', '\x00', '\xbf', '\x00', '\x00', '\x00', '\xc0', '\x00', + '\x00', '\x00', '\xd9', '\x00', '\x00', '\x00', '\xc3', '\xb4', + '\xc2', '\xc1', '\xc5', '\xcd', '\xba', '\x00', '\x00', '\xc9', + '\x00', '\x00', '\xbb', '\x00', '\x00', '\xc8', '\x00', '\x00', + '\xbc', '\x00', '\x00', '\xcc', '\x00', '\x00', '\xb9', '\x00', + '\x00', '\xcb', '\x00', '\x00', '\xca', '\x00', '\x00', '\xce', + '\xdf', '\x00', '\x00', '\x00', '\xdc', '\x00', '\x00', '\x00', + '\xdb', '\xb0', '\xb1', '\xb2', '\xfe', +}; + +SMB_GENERATE_CHARSET_MODULE_8_BIT_GAP(CP850) + diff --git a/source3/modules/getdate.c b/source3/modules/getdate.c new file mode 100644 index 0000000000..491c51294e --- /dev/null +++ b/source3/modules/getdate.c @@ -0,0 +1,2460 @@ +/* A Bison parser, made by GNU Bison 1.875a. */ + +/* Skeleton parser for Yacc-like parsing with Bison, + Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003 Free Software Foundation, Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2, or (at your option) + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 59 Temple Place - Suite 330, + Boston, MA 02111-1307, USA. */ + +/* As a special exception, when this file is copied by Bison into a + Bison output file, you may use that output file without restriction. + This special exception was added by the Free Software Foundation + in version 1.24 of Bison. */ + +/* Written by Richard Stallman by simplifying the original so called + ``semantic'' parser. */ + +/* All symbols defined below should begin with yy or YY, to avoid + infringing on user name space. This should be done even for local + variables, as they might otherwise be expanded by user macros. + There are some unavoidable exceptions within include files to + define necessary library symbols; they are noted "INFRINGES ON + USER NAME SPACE" below. */ + +/* Identify Bison output. */ +#define YYBISON 1 + +/* Skeleton name. */ +#define YYSKELETON_NAME "yacc.c" + +/* Pure parsers. */ +#define YYPURE 1 + +/* Using locations. */ +#define YYLSP_NEEDED 0 + + + +/* Tokens. */ +#ifndef YYTOKENTYPE +# define YYTOKENTYPE + /* Put the tokens into the symbol table, so that GDB and other debuggers + know about them. */ + enum yytokentype { + tAGO = 258, + tDST = 259, + tDAY = 260, + tDAY_UNIT = 261, + tDAYZONE = 262, + tHOUR_UNIT = 263, + tLOCAL_ZONE = 264, + tMERIDIAN = 265, + tMINUTE_UNIT = 266, + tMONTH = 267, + tMONTH_UNIT = 268, + tSEC_UNIT = 269, + tYEAR_UNIT = 270, + tZONE = 271, + tSNUMBER = 272, + tUNUMBER = 273 + }; +#endif +#define tAGO 258 +#define tDST 259 +#define tDAY 260 +#define tDAY_UNIT 261 +#define tDAYZONE 262 +#define tHOUR_UNIT 263 +#define tLOCAL_ZONE 264 +#define tMERIDIAN 265 +#define tMINUTE_UNIT 266 +#define tMONTH 267 +#define tMONTH_UNIT 268 +#define tSEC_UNIT 269 +#define tYEAR_UNIT 270 +#define tZONE 271 +#define tSNUMBER 272 +#define tUNUMBER 273 + + + + +/* Copy the first part of user declarations. */ +#line 1 "getdate.y" + +/* Parse a string into an internal time stamp. + Copyright (C) 1999, 2000, 2002 Free Software Foundation, Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2, or (at your option) + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software Foundation, + Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ + +/* Originally written by Steven M. Bellovin while + at the University of North Carolina at Chapel Hill. Later tweaked by + a couple of people on Usenet. Completely overhauled by Rich $alz + and Jim Berets in August, 1990. + + Modified by Paul Eggert in August 1999 to do + the right thing about local DST. Unlike previous versions, this + version is reentrant. */ + +#ifdef HAVE_CONFIG_H +# include +# ifdef HAVE_ALLOCA_H +# include +# endif +#endif + +/* Since the code of getdate.y is not included in the Emacs executable + itself, there is no need to #define static in this file. Even if + the code were included in the Emacs executable, it probably + wouldn't do any harm to #undef it here; this will only cause + problems if we try to write to a static variable, which I don't + think this code needs to do. */ +#ifdef emacs +# undef static +#endif + +#include + +#if HAVE_STDLIB_H +# include /* for `free'; used by Bison 1.27 */ +#endif + +#if STDC_HEADERS || (! defined isascii && ! HAVE_ISASCII) +# define IN_CTYPE_DOMAIN(c) 1 +#else +# define IN_CTYPE_DOMAIN(c) isascii (c) +#endif + +#define ISSPACE(c) (IN_CTYPE_DOMAIN (c) && isspace (c)) +#define ISALPHA(c) (IN_CTYPE_DOMAIN (c) && isalpha (c)) +#define ISLOWER(c) (IN_CTYPE_DOMAIN (c) && islower (c)) +#define ISDIGIT_LOCALE(c) (IN_CTYPE_DOMAIN (c) && isdigit (c)) + +/* ISDIGIT differs from ISDIGIT_LOCALE, as follows: + - Its arg may be any int or unsigned int; it need not be an unsigned char. + - It's guaranteed to evaluate its argument exactly once. + - It's typically faster. + POSIX says that only '0' through '9' are digits. Prefer ISDIGIT to + ISDIGIT_LOCALE unless it's important to use the locale's definition + of `digit' even when the host does not conform to POSIX. */ +#define ISDIGIT(c) ((unsigned) (c) - '0' <= 9) + +#if STDC_HEADERS || HAVE_STRING_H +# include +#endif + +#if __GNUC__ < 2 || (__GNUC__ == 2 && __GNUC_MINOR__ < 8) || __STRICT_ANSI__ +# define __attribute__(x) +#endif + +#ifndef ATTRIBUTE_UNUSED +# define ATTRIBUTE_UNUSED __attribute__ ((__unused__)) +#endif + +#define EPOCH_YEAR 1970 +#define TM_YEAR_BASE 1900 + +#define HOUR(x) ((x) * 60) + +/* An integer value, and the number of digits in its textual + representation. */ +typedef struct +{ + int value; + int digits; +} textint; + +/* An entry in the lexical lookup table. */ +typedef struct +{ + char const *name; + int type; + int value; +} table; + +/* Meridian: am, pm, or 24-hour style. */ +enum { MERam, MERpm, MER24 }; + +/* Information passed to and from the parser. */ +typedef struct +{ + /* The input string remaining to be parsed. */ + const char *input; + + /* N, if this is the Nth Tuesday. */ + int day_ordinal; + + /* Day of week; Sunday is 0. */ + int day_number; + + /* tm_isdst flag for the local zone. */ + int local_isdst; + + /* Time zone, in minutes east of UTC. */ + int time_zone; + + /* Style used for time. */ + int meridian; + + /* Gregorian year, month, day, hour, minutes, and seconds. */ + textint year; + int month; + int day; + int hour; + int minutes; + int seconds; + + /* Relative year, month, day, hour, minutes, and seconds. */ + int rel_year; + int rel_month; + int rel_day; + int rel_hour; + int rel_minutes; + int rel_seconds; + + /* Counts of nonterminals of various flavors parsed so far. */ + int dates_seen; + int days_seen; + int local_zones_seen; + int rels_seen; + int times_seen; + int zones_seen; + + /* Table of local time zone abbrevations, terminated by a null entry. */ + table local_time_zone_table[3]; +} parser_control; + +#define PC (* (parser_control *) parm) +#define YYLEX_PARAM parm +#define YYPARSE_PARAM parm + +static int yyerror (); +static int yylex (); + + + +/* Enabling traces. */ +#ifndef YYDEBUG +# define YYDEBUG 0 +#endif + +/* Enabling verbose error messages. */ +#ifdef YYERROR_VERBOSE +# undef YYERROR_VERBOSE +# define YYERROR_VERBOSE 1 +#else +# define YYERROR_VERBOSE 0 +#endif + +#if ! defined (YYSTYPE) && ! defined (YYSTYPE_IS_DECLARED) +#line 172 "getdate.y" +typedef union YYSTYPE { + int intval; + textint textintval; +} YYSTYPE; +/* Line 191 of yacc.c. */ +#line 281 "getdate.c" +# define yystype YYSTYPE /* obsolescent; will be withdrawn */ +# define YYSTYPE_IS_DECLARED 1 +# define YYSTYPE_IS_TRIVIAL 1 +#endif + + + +/* Copy the second part of user declarations. */ + + +/* Line 214 of yacc.c. */ +#line 293 "getdate.c" + +#if ! defined (yyoverflow) || YYERROR_VERBOSE + +/* The parser invokes alloca or malloc; define the necessary symbols. */ + +# if YYSTACK_USE_ALLOCA +# define YYSTACK_ALLOC alloca +# else +# ifndef YYSTACK_USE_ALLOCA +# if defined (alloca) || defined (_ALLOCA_H) +# define YYSTACK_ALLOC alloca +# else +# ifdef __GNUC__ +# define YYSTACK_ALLOC __builtin_alloca +# endif +# endif +# endif +# endif + +# ifdef YYSTACK_ALLOC + /* Pacify GCC's `empty if-body' warning. */ +# define YYSTACK_FREE(Ptr) do { /* empty */; } while (0) +# else +# if defined (__STDC__) || defined (__cplusplus) +# include /* INFRINGES ON USER NAME SPACE */ +# define YYSIZE_T size_t +# endif +# define YYSTACK_ALLOC malloc +# define YYSTACK_FREE free +# endif +#endif /* ! defined (yyoverflow) || YYERROR_VERBOSE */ + + +#if (! defined (yyoverflow) \ + && (! defined (__cplusplus) \ + || (YYSTYPE_IS_TRIVIAL))) + +/* A type that is properly aligned for any stack member. */ +union yyalloc +{ + short yyss; + YYSTYPE yyvs; + }; + +/* The size of the maximum gap between one aligned stack and the next. */ +# define YYSTACK_GAP_MAXIMUM (sizeof (union yyalloc) - 1) + +/* The size of an array large to enough to hold all stacks, each with + N elements. */ +# define YYSTACK_BYTES(N) \ + ((N) * (sizeof (short) + sizeof (YYSTYPE)) \ + + YYSTACK_GAP_MAXIMUM) + +/* Copy COUNT objects from FROM to TO. The source and destination do + not overlap. */ +# ifndef YYCOPY +# if 1 < __GNUC__ +# define YYCOPY(To, From, Count) \ + __builtin_memcpy (To, From, (Count) * sizeof (*(From))) +# else +# define YYCOPY(To, From, Count) \ + do \ + { \ + register YYSIZE_T yyi; \ + for (yyi = 0; yyi < (Count); yyi++) \ + (To)[yyi] = (From)[yyi]; \ + } \ + while (0) +# endif +# endif + +/* Relocate STACK from its old location to the new one. The + local variables YYSIZE and YYSTACKSIZE give the old and new number of + elements in the stack, and YYPTR gives the new location of the + stack. Advance YYPTR to a properly aligned location for the next + stack. */ +# define YYSTACK_RELOCATE(Stack) \ + do \ + { \ + YYSIZE_T yynewbytes; \ + YYCOPY (&yyptr->Stack, Stack, yysize); \ + Stack = &yyptr->Stack; \ + yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \ + yyptr += yynewbytes / sizeof (*yyptr); \ + } \ + while (0) + +#endif + +#if defined (__STDC__) || defined (__cplusplus) + typedef signed char yysigned_char; +#else + typedef short yysigned_char; +#endif + +/* YYFINAL -- State number of the termination state. */ +#define YYFINAL 2 +/* YYLAST -- Last index in YYTABLE. */ +#define YYLAST 52 + +/* YYNTOKENS -- Number of terminals. */ +#define YYNTOKENS 22 +/* YYNNTS -- Number of nonterminals. */ +#define YYNNTS 12 +/* YYNRULES -- Number of rules. */ +#define YYNRULES 54 +/* YYNRULES -- Number of states. */ +#define YYNSTATES 64 + +/* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX. */ +#define YYUNDEFTOK 2 +#define YYMAXUTOK 273 + +#define YYTRANSLATE(YYX) \ + ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK) + +/* YYTRANSLATE[YYLEX] -- Bison symbol number corresponding to YYLEX. */ +static const unsigned char yytranslate[] = +{ + 0, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 20, 2, 2, 21, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 19, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, + 2, 2, 2, 2, 2, 2, 1, 2, 3, 4, + 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, + 15, 16, 17, 18 +}; + +#if YYDEBUG +/* YYPRHS[YYN] -- Index of the first RHS symbol of rule number YYN in + YYRHS. */ +static const unsigned char yyprhs[] = +{ + 0, 0, 3, 4, 7, 9, 11, 13, 15, 17, + 19, 21, 24, 29, 34, 41, 48, 50, 53, 55, + 57, 60, 62, 65, 68, 72, 78, 82, 86, 89, + 94, 97, 101, 104, 106, 109, 112, 114, 117, 120, + 122, 125, 128, 130, 133, 136, 138, 141, 144, 146, + 149, 152, 154, 156, 157 +}; + +/* YYRHS -- A `-1'-separated list of the rules' RHS. */ +static const yysigned_char yyrhs[] = +{ + 23, 0, -1, -1, 23, 24, -1, 25, -1, 26, + -1, 27, -1, 29, -1, 28, -1, 30, -1, 32, + -1, 18, 10, -1, 18, 19, 18, 33, -1, 18, + 19, 18, 17, -1, 18, 19, 18, 19, 18, 33, + -1, 18, 19, 18, 19, 18, 17, -1, 9, -1, + 9, 4, -1, 16, -1, 7, -1, 16, 4, -1, + 5, -1, 5, 20, -1, 18, 5, -1, 18, 21, + 18, -1, 18, 21, 18, 21, 18, -1, 18, 17, + 17, -1, 18, 12, 17, -1, 12, 18, -1, 12, + 18, 20, 18, -1, 18, 12, -1, 18, 12, 18, + -1, 31, 3, -1, 31, -1, 18, 15, -1, 17, + 15, -1, 15, -1, 18, 13, -1, 17, 13, -1, + 13, -1, 18, 6, -1, 17, 6, -1, 6, -1, + 18, 8, -1, 17, 8, -1, 8, -1, 18, 11, + -1, 17, 11, -1, 11, -1, 18, 14, -1, 17, + 14, -1, 14, -1, 18, -1, -1, 10, -1 +}; + +/* YYRLINE[YYN] -- source line where rule number YYN was defined. */ +static const unsigned short yyrline[] = +{ + 0, 188, 188, 190, 194, 196, 198, 200, 202, 204, + 206, 210, 217, 224, 232, 239, 251, 253, 258, 260, + 262, 267, 272, 277, 285, 290, 310, 317, 325, 330, + 336, 341, 350, 359, 363, 365, 367, 369, 371, 373, + 375, 377, 379, 381, 383, 385, 387, 389, 391, 393, + 395, 397, 402, 439, 440 +}; +#endif + +#if YYDEBUG || YYERROR_VERBOSE +/* YYTNME[SYMBOL-NUM] -- String name of the symbol SYMBOL-NUM. + First, the terminals, then, starting at YYNTOKENS, nonterminals. */ +static const char *const yytname[] = +{ + "$end", "error", "$undefined", "tAGO", "tDST", "tDAY", "tDAY_UNIT", + "tDAYZONE", "tHOUR_UNIT", "tLOCAL_ZONE", "tMERIDIAN", "tMINUTE_UNIT", + "tMONTH", "tMONTH_UNIT", "tSEC_UNIT", "tYEAR_UNIT", "tZONE", "tSNUMBER", + "tUNUMBER", "':'", "','", "'/'", "$accept", "spec", "item", "time", + "local_zone", "zone", "day", "date", "rel", "relunit", "number", + "o_merid", 0 +}; +#endif + +# ifdef YYPRINT +/* YYTOKNUM[YYLEX-NUM] -- Internal token number corresponding to + token YYLEX-NUM. */ +static const unsigned short yytoknum[] = +{ + 0, 256, 257, 258, 259, 260, 261, 262, 263, 264, + 265, 266, 267, 268, 269, 270, 271, 272, 273, 58, + 44, 47 +}; +# endif + +/* YYR1[YYN] -- Symbol number of symbol that rule YYN derives. */ +static const unsigned char yyr1[] = +{ + 0, 22, 23, 23, 24, 24, 24, 24, 24, 24, + 24, 25, 25, 25, 25, 25, 26, 26, 27, 27, + 27, 28, 28, 28, 29, 29, 29, 29, 29, 29, + 29, 29, 30, 30, 31, 31, 31, 31, 31, 31, + 31, 31, 31, 31, 31, 31, 31, 31, 31, 31, + 31, 31, 32, 33, 33 +}; + +/* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN. */ +static const unsigned char yyr2[] = +{ + 0, 2, 0, 2, 1, 1, 1, 1, 1, 1, + 1, 2, 4, 4, 6, 6, 1, 2, 1, 1, + 2, 1, 2, 2, 3, 5, 3, 3, 2, 4, + 2, 3, 2, 1, 2, 2, 1, 2, 2, 1, + 2, 2, 1, 2, 2, 1, 2, 2, 1, 2, + 2, 1, 1, 0, 1 +}; + +/* YYDEFACT[STATE-NAME] -- Default rule to reduce with in state + STATE-NUM when YYTABLE doesn't specify something else to do. Zero + means the default is an error. */ +static const unsigned char yydefact[] = +{ + 2, 0, 1, 21, 42, 19, 45, 16, 48, 0, + 39, 51, 36, 18, 0, 52, 3, 4, 5, 6, + 8, 7, 9, 33, 10, 22, 17, 28, 20, 41, + 44, 47, 38, 50, 35, 23, 40, 43, 11, 46, + 30, 37, 49, 34, 0, 0, 0, 32, 0, 27, + 31, 26, 53, 24, 29, 54, 13, 0, 12, 0, + 53, 25, 15, 14 +}; + +/* YYDEFGOTO[NTERM-NUM]. */ +static const yysigned_char yydefgoto[] = +{ + -1, 1, 16, 17, 18, 19, 20, 21, 22, 23, + 24, 58 +}; + +/* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing + STATE-NUM. */ +#define YYPACT_NINF -17 +static const yysigned_char yypact[] = +{ + -17, 0, -17, 1, -17, -17, -17, 19, -17, -14, + -17, -17, -17, 32, 26, 14, -17, -17, -17, -17, + -17, -17, -17, 27, -17, -17, -17, 22, -17, -17, + -17, -17, -17, -17, -17, -17, -17, -17, -17, -17, + -16, -17, -17, -17, 29, 25, 30, -17, 31, -17, + -17, -17, 28, 23, -17, -17, -17, 33, -17, 34, + -7, -17, -17, -17 +}; + +/* YYPGOTO[NTERM-NUM]. */ +static const yysigned_char yypgoto[] = +{ + -17, -17, -17, -17, -17, -17, -17, -17, -17, -17, + -17, -10 +}; + +/* YYTABLE[YYPACT[STATE-NUM]]. What to do in state STATE-NUM. If + positive, shift that token. If negative, reduce the rule which + number is the opposite. If zero, do what YYDEFACT says. + If YYTABLE_NINF, syntax error. */ +#define YYTABLE_NINF -1 +static const unsigned char yytable[] = +{ + 2, 49, 50, 55, 27, 3, 4, 5, 6, 7, + 62, 8, 9, 10, 11, 12, 13, 14, 15, 35, + 36, 25, 37, 26, 38, 39, 40, 41, 42, 43, + 47, 44, 29, 45, 30, 46, 28, 31, 55, 32, + 33, 34, 48, 52, 59, 56, 51, 57, 53, 54, + 63, 60, 61 +}; + +static const unsigned char yycheck[] = +{ + 0, 17, 18, 10, 18, 5, 6, 7, 8, 9, + 17, 11, 12, 13, 14, 15, 16, 17, 18, 5, + 6, 20, 8, 4, 10, 11, 12, 13, 14, 15, + 3, 17, 6, 19, 8, 21, 4, 11, 10, 13, + 14, 15, 20, 18, 21, 17, 17, 19, 18, 18, + 60, 18, 18 +}; + +/* YYSTOS[STATE-NUM] -- The (internal number of the) accessing + symbol of state STATE-NUM. */ +static const unsigned char yystos[] = +{ + 0, 23, 0, 5, 6, 7, 8, 9, 11, 12, + 13, 14, 15, 16, 17, 18, 24, 25, 26, 27, + 28, 29, 30, 31, 32, 20, 4, 18, 4, 6, + 8, 11, 13, 14, 15, 5, 6, 8, 10, 11, + 12, 13, 14, 15, 17, 19, 21, 3, 20, 17, + 18, 17, 18, 18, 18, 10, 17, 19, 33, 21, + 18, 18, 17, 33 +}; + +#if ! defined (YYSIZE_T) && defined (__SIZE_TYPE__) +# define YYSIZE_T __SIZE_TYPE__ +#endif +#if ! defined (YYSIZE_T) && defined (size_t) +# define YYSIZE_T size_t +#endif +#if ! defined (YYSIZE_T) +# if defined (__STDC__) || defined (__cplusplus) +# include /* INFRINGES ON USER NAME SPACE */ +# define YYSIZE_T size_t +# endif +#endif +#if ! defined (YYSIZE_T) +# define YYSIZE_T unsigned int +#endif + +#define yyerrok (yyerrstatus = 0) +#define yyclearin (yychar = YYEMPTY) +#define YYEMPTY (-2) +#define YYEOF 0 + +#define YYACCEPT goto yyacceptlab +#define YYABORT goto yyabortlab +#define YYERROR goto yyerrlab1 + + +/* Like YYERROR except do call yyerror. This remains here temporarily + to ease the transition to the new meaning of YYERROR, for GCC. + Once GCC version 2 has supplanted version 1, this can go. */ + +#define YYFAIL goto yyerrlab + +#define YYRECOVERING() (!!yyerrstatus) + +#define YYBACKUP(Token, Value) \ +do \ + if (yychar == YYEMPTY && yylen == 1) \ + { \ + yychar = (Token); \ + yylval = (Value); \ + yytoken = YYTRANSLATE (yychar); \ + YYPOPSTACK; \ + goto yybackup; \ + } \ + else \ + { \ + yyerror ("syntax error: cannot back up");\ + YYERROR; \ + } \ +while (0) + +#define YYTERROR 1 +#define YYERRCODE 256 + +/* YYLLOC_DEFAULT -- Compute the default location (before the actions + are run). */ + +#ifndef YYLLOC_DEFAULT +# define YYLLOC_DEFAULT(Current, Rhs, N) \ + Current.first_line = Rhs[1].first_line; \ + Current.first_column = Rhs[1].first_column; \ + Current.last_line = Rhs[N].last_line; \ + Current.last_column = Rhs[N].last_column; +#endif + +/* YYLEX -- calling `yylex' with the right arguments. */ + +#ifdef YYLEX_PARAM +# define YYLEX yylex (&yylval, YYLEX_PARAM) +#else +# define YYLEX yylex (&yylval) +#endif + +/* Enable debugging if requested. */ +#if YYDEBUG + +# ifndef YYFPRINTF +# include /* INFRINGES ON USER NAME SPACE */ +# define YYFPRINTF fprintf +# endif + +# define YYDPRINTF(Args) \ +do { \ + if (yydebug) \ + YYFPRINTF Args; \ +} while (0) + +# define YYDSYMPRINT(Args) \ +do { \ + if (yydebug) \ + yysymprint Args; \ +} while (0) + +# define YYDSYMPRINTF(Title, Token, Value, Location) \ +do { \ + if (yydebug) \ + { \ + YYFPRINTF (stderr, "%s ", Title); \ + yysymprint (stderr, \ + Token, Value); \ + YYFPRINTF (stderr, "\n"); \ + } \ +} while (0) + +/*------------------------------------------------------------------. +| yy_stack_print -- Print the state stack from its BOTTOM up to its | +| TOP (cinluded). | +`------------------------------------------------------------------*/ + +#if defined (__STDC__) || defined (__cplusplus) +static void +yy_stack_print (short *bottom, short *top) +#else +static void +yy_stack_print (bottom, top) + short *bottom; + short *top; +#endif +{ + YYFPRINTF (stderr, "Stack now"); + for (/* Nothing. */; bottom <= top; ++bottom) + YYFPRINTF (stderr, " %d", *bottom); + YYFPRINTF (stderr, "\n"); +} + +# define YY_STACK_PRINT(Bottom, Top) \ +do { \ + if (yydebug) \ + yy_stack_print ((Bottom), (Top)); \ +} while (0) + + +/*------------------------------------------------. +| Report that the YYRULE is going to be reduced. | +`------------------------------------------------*/ + +#if defined (__STDC__) || defined (__cplusplus) +static void +yy_reduce_print (int yyrule) +#else +static void +yy_reduce_print (yyrule) + int yyrule; +#endif +{ + int yyi; + unsigned int yylineno = yyrline[yyrule]; + YYFPRINTF (stderr, "Reducing stack by rule %d (line %u), ", + yyrule - 1, yylineno); + /* Print the symbols being reduced, and their result. */ + for (yyi = yyprhs[yyrule]; 0 <= yyrhs[yyi]; yyi++) + YYFPRINTF (stderr, "%s ", yytname [yyrhs[yyi]]); + YYFPRINTF (stderr, "-> %s\n", yytname [yyr1[yyrule]]); +} + +# define YY_REDUCE_PRINT(Rule) \ +do { \ + if (yydebug) \ + yy_reduce_print (Rule); \ +} while (0) + +/* Nonzero means print parse trace. It is left uninitialized so that + multiple parsers can coexist. */ +int yydebug; +#else /* !YYDEBUG */ +# define YYDPRINTF(Args) +# define YYDSYMPRINT(Args) +# define YYDSYMPRINTF(Title, Token, Value, Location) +# define YY_STACK_PRINT(Bottom, Top) +# define YY_REDUCE_PRINT(Rule) +#endif /* !YYDEBUG */ + + +/* YYINITDEPTH -- initial size of the parser's stacks. */ +#ifndef YYINITDEPTH +# define YYINITDEPTH 200 +#endif + +/* YYMAXDEPTH -- maximum size the stacks can grow to (effective only + if the built-in stack extension method is used). + + Do not make this value too large; the results are undefined if + SIZE_MAX < YYSTACK_BYTES (YYMAXDEPTH) + evaluated with infinite-precision integer arithmetic. */ + +#if YYMAXDEPTH == 0 +# undef YYMAXDEPTH +#endif + +#ifndef YYMAXDEPTH +# define YYMAXDEPTH 10000 +#endif + + + +#if YYERROR_VERBOSE + +# ifndef yystrlen +# if defined (__GLIBC__) && defined (_STRING_H) +# define yystrlen strlen +# else +/* Return the length of YYSTR. */ +static YYSIZE_T +# if defined (__STDC__) || defined (__cplusplus) +yystrlen (const char *yystr) +# else +yystrlen (yystr) + const char *yystr; +# endif +{ + register const char *yys = yystr; + + while (*yys++ != '\0') + continue; + + return yys - yystr - 1; +} +# endif +# endif + +# ifndef yystpcpy +# if defined (__GLIBC__) && defined (_STRING_H) && defined (_GNU_SOURCE) +# define yystpcpy stpcpy +# else +/* Copy YYSRC to YYDEST, returning the address of the terminating '\0' in + YYDEST. */ +static char * +# if defined (__STDC__) || defined (__cplusplus) +yystpcpy (char *yydest, const char *yysrc) +# else +yystpcpy (yydest, yysrc) + char *yydest; + const char *yysrc; +# endif +{ + register char *yyd = yydest; + register const char *yys = yysrc; + + while ((*yyd++ = *yys++) != '\0') + continue; + + return yyd - 1; +} +# endif +# endif + +#endif /* !YYERROR_VERBOSE */ + + + +#if YYDEBUG +/*--------------------------------. +| Print this symbol on YYOUTPUT. | +`--------------------------------*/ + +#if defined (__STDC__) || defined (__cplusplus) +static void +yysymprint (FILE *yyoutput, int yytype, YYSTYPE *yyvaluep) +#else +static void +yysymprint (yyoutput, yytype, yyvaluep) + FILE *yyoutput; + int yytype; + YYSTYPE *yyvaluep; +#endif +{ + /* Pacify ``unused variable'' warnings. */ + (void) yyvaluep; + + if (yytype < YYNTOKENS) + { + YYFPRINTF (yyoutput, "token %s (", yytname[yytype]); +# ifdef YYPRINT + YYPRINT (yyoutput, yytoknum[yytype], *yyvaluep); +# endif + } + else + YYFPRINTF (yyoutput, "nterm %s (", yytname[yytype]); + + switch (yytype) + { + default: + break; + } + YYFPRINTF (yyoutput, ")"); +} + +#endif /* ! YYDEBUG */ +/*-----------------------------------------------. +| Release the memory associated to this symbol. | +`-----------------------------------------------*/ + +#if defined (__STDC__) || defined (__cplusplus) +static void +yydestruct (int yytype, YYSTYPE *yyvaluep) +#else +static void +yydestruct (yytype, yyvaluep) + int yytype; + YYSTYPE *yyvaluep; +#endif +{ + /* Pacify ``unused variable'' warnings. */ + (void) yyvaluep; + + switch (yytype) + { + + default: + break; + } +} + + +/* Prevent warnings from -Wmissing-prototypes. */ + +#ifdef YYPARSE_PARAM +# if defined (__STDC__) || defined (__cplusplus) +int yyparse (void *YYPARSE_PARAM); +# else +int yyparse (); +# endif +#else /* ! YYPARSE_PARAM */ +#if defined (__STDC__) || defined (__cplusplus) +int yyparse (void); +#else +int yyparse (); +#endif +#endif /* ! YYPARSE_PARAM */ + + + + + + +/*----------. +| yyparse. | +`----------*/ + +#ifdef YYPARSE_PARAM +# if defined (__STDC__) || defined (__cplusplus) +int yyparse (void *YYPARSE_PARAM) +# else +int yyparse (YYPARSE_PARAM) + void *YYPARSE_PARAM; +# endif +#else /* ! YYPARSE_PARAM */ +#if defined (__STDC__) || defined (__cplusplus) +int +yyparse (void) +#else +int +yyparse () + +#endif +#endif +{ + /* The lookahead symbol. */ +int yychar; + +/* The semantic value of the lookahead symbol. */ +YYSTYPE yylval; + +/* Number of syntax errors so far. */ +int yynerrs; + + register int yystate; + register int yyn; + int yyresult; + /* Number of tokens to shift before error messages enabled. */ + int yyerrstatus; + /* Lookahead token as an internal (translated) token number. */ + int yytoken = 0; + + /* Three stacks and their tools: + `yyss': related to states, + `yyvs': related to semantic values, + `yyls': related to locations. + + Refer to the stacks thru separate pointers, to allow yyoverflow + to reallocate them elsewhere. */ + + /* The state stack. */ + short yyssa[YYINITDEPTH]; + short *yyss = yyssa; + register short *yyssp; + + /* The semantic value stack. */ + YYSTYPE yyvsa[YYINITDEPTH]; + YYSTYPE *yyvs = yyvsa; + register YYSTYPE *yyvsp; + + + +#define YYPOPSTACK (yyvsp--, yyssp--) + + YYSIZE_T yystacksize = YYINITDEPTH; + + /* The variables used to return semantic value and location from the + action routines. */ + YYSTYPE yyval; + + + /* When reducing, the number of symbols on the RHS of the reduced + rule. */ + int yylen; + + YYDPRINTF ((stderr, "Starting parse\n")); + + yystate = 0; + yyerrstatus = 0; + yynerrs = 0; + yychar = YYEMPTY; /* Cause a token to be read. */ + + /* Initialize stack pointers. + Waste one element of value and location stack + so that they stay on the same level as the state stack. + The wasted elements are never initialized. */ + + yyssp = yyss; + yyvsp = yyvs; + + goto yysetstate; + +/*------------------------------------------------------------. +| yynewstate -- Push a new state, which is found in yystate. | +`------------------------------------------------------------*/ + yynewstate: + /* In all cases, when you get here, the value and location stacks + have just been pushed. so pushing a state here evens the stacks. + */ + yyssp++; + + yysetstate: + *yyssp = yystate; + + if (yyss + yystacksize - 1 <= yyssp) + { + /* Get the current used size of the three stacks, in elements. */ + YYSIZE_T yysize = yyssp - yyss + 1; + +#ifdef yyoverflow + { + /* Give user a chance to reallocate the stack. Use copies of + these so that the &'s don't force the real ones into + memory. */ + YYSTYPE *yyvs1 = yyvs; + short *yyss1 = yyss; + + + /* Each stack pointer address is followed by the size of the + data in use in that stack, in bytes. This used to be a + conditional around just the two extra args, but that might + be undefined if yyoverflow is a macro. */ + yyoverflow ("parser stack overflow", + &yyss1, yysize * sizeof (*yyssp), + &yyvs1, yysize * sizeof (*yyvsp), + + &yystacksize); + + yyss = yyss1; + yyvs = yyvs1; + } +#else /* no yyoverflow */ +# ifndef YYSTACK_RELOCATE + goto yyoverflowlab; +# else + /* Extend the stack our own way. */ + if (YYMAXDEPTH <= yystacksize) + goto yyoverflowlab; + yystacksize *= 2; + if (YYMAXDEPTH < yystacksize) + yystacksize = YYMAXDEPTH; + + { + short *yyss1 = yyss; + union yyalloc *yyptr = + (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize)); + if (! yyptr) + goto yyoverflowlab; + YYSTACK_RELOCATE (yyss); + YYSTACK_RELOCATE (yyvs); + +# undef YYSTACK_RELOCATE + if (yyss1 != yyssa) + YYSTACK_FREE (yyss1); + } +# endif +#endif /* no yyoverflow */ + + yyssp = yyss + yysize - 1; + yyvsp = yyvs + yysize - 1; + + + YYDPRINTF ((stderr, "Stack size increased to %lu\n", + (unsigned long int) yystacksize)); + + if (yyss + yystacksize - 1 <= yyssp) + YYABORT; + } + + YYDPRINTF ((stderr, "Entering state %d\n", yystate)); + + goto yybackup; + +/*-----------. +| yybackup. | +`-----------*/ +yybackup: + +/* Do appropriate processing given the current state. */ +/* Read a lookahead token if we need one and don't already have one. */ +/* yyresume: */ + + /* First try to decide what to do without reference to lookahead token. */ + + yyn = yypact[yystate]; + if (yyn == YYPACT_NINF) + goto yydefault; + + /* Not known => get a lookahead token if don't already have one. */ + + /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol. */ + if (yychar == YYEMPTY) + { + YYDPRINTF ((stderr, "Reading a token: ")); + yychar = YYLEX; + } + + if (yychar <= YYEOF) + { + yychar = yytoken = YYEOF; + YYDPRINTF ((stderr, "Now at end of input.\n")); + } + else + { + yytoken = YYTRANSLATE (yychar); + YYDSYMPRINTF ("Next token is", yytoken, &yylval, &yylloc); + } + + /* If the proper action on seeing token YYTOKEN is to reduce or to + detect an error, take that action. */ + yyn += yytoken; + if (yyn < 0 || YYLAST < yyn || yycheck[yyn] != yytoken) + goto yydefault; + yyn = yytable[yyn]; + if (yyn <= 0) + { + if (yyn == 0 || yyn == YYTABLE_NINF) + goto yyerrlab; + yyn = -yyn; + goto yyreduce; + } + + if (yyn == YYFINAL) + YYACCEPT; + + /* Shift the lookahead token. */ + YYDPRINTF ((stderr, "Shifting token %s, ", yytname[yytoken])); + + /* Discard the token being shifted unless it is eof. */ + if (yychar != YYEOF) + yychar = YYEMPTY; + + *++yyvsp = yylval; + + + /* Count tokens shifted since error; after three, turn off error + status. */ + if (yyerrstatus) + yyerrstatus--; + + yystate = yyn; + goto yynewstate; + + +/*-----------------------------------------------------------. +| yydefault -- do the default action for the current state. | +`-----------------------------------------------------------*/ +yydefault: + yyn = yydefact[yystate]; + if (yyn == 0) + goto yyerrlab; + goto yyreduce; + + +/*-----------------------------. +| yyreduce -- Do a reduction. | +`-----------------------------*/ +yyreduce: + /* yyn is the number of a rule to reduce with. */ + yylen = yyr2[yyn]; + + /* If YYLEN is nonzero, implement the default value of the action: + `$$ = $1'. + + Otherwise, the following line sets YYVAL to garbage. + This behavior is undocumented and Bison + users should not rely upon it. Assigning to YYVAL + unconditionally makes the parser a bit smaller, and it avoids a + GCC warning that YYVAL may be used uninitialized. */ + yyval = yyvsp[1-yylen]; + + + YY_REDUCE_PRINT (yyn); + switch (yyn) + { + case 4: +#line 195 "getdate.y" + { PC.times_seen++; } + break; + + case 5: +#line 197 "getdate.y" + { PC.local_zones_seen++; } + break; + + case 6: +#line 199 "getdate.y" + { PC.zones_seen++; } + break; + + case 7: +#line 201 "getdate.y" + { PC.dates_seen++; } + break; + + case 8: +#line 203 "getdate.y" + { PC.days_seen++; } + break; + + case 9: +#line 205 "getdate.y" + { PC.rels_seen++; } + break; + + case 11: +#line 211 "getdate.y" + { + PC.hour = yyvsp[-1].textintval.value; + PC.minutes = 0; + PC.seconds = 0; + PC.meridian = yyvsp[0].intval; + } + break; + + case 12: +#line 218 "getdate.y" + { + PC.hour = yyvsp[-3].textintval.value; + PC.minutes = yyvsp[-1].textintval.value; + PC.seconds = 0; + PC.meridian = yyvsp[0].intval; + } + break; + + case 13: +#line 225 "getdate.y" + { + PC.hour = yyvsp[-3].textintval.value; + PC.minutes = yyvsp[-1].textintval.value; + PC.meridian = MER24; + PC.zones_seen++; + PC.time_zone = yyvsp[0].textintval.value % 100 + (yyvsp[0].textintval.value / 100) * 60; + } + break; + + case 14: +#line 233 "getdate.y" + { + PC.hour = yyvsp[-5].textintval.value; + PC.minutes = yyvsp[-3].textintval.value; + PC.seconds = yyvsp[-1].textintval.value; + PC.meridian = yyvsp[0].intval; + } + break; + + case 15: +#line 240 "getdate.y" + { + PC.hour = yyvsp[-5].textintval.value; + PC.minutes = yyvsp[-3].textintval.value; + PC.seconds = yyvsp[-1].textintval.value; + PC.meridian = MER24; + PC.zones_seen++; + PC.time_zone = yyvsp[0].textintval.value % 100 + (yyvsp[0].textintval.value / 100) * 60; + } + break; + + case 16: +#line 252 "getdate.y" + { PC.local_isdst = yyvsp[0].intval; } + break; + + case 17: +#line 254 "getdate.y" + { PC.local_isdst = yyvsp[-1].intval < 0 ? 1 : yyvsp[-1].intval + 1; } + break; + + case 18: +#line 259 "getdate.y" + { PC.time_zone = yyvsp[0].intval; } + break; + + case 19: +#line 261 "getdate.y" + { PC.time_zone = yyvsp[0].intval + 60; } + break; + + case 20: +#line 263 "getdate.y" + { PC.time_zone = yyvsp[-1].intval + 60; } + break; + + case 21: +#line 268 "getdate.y" + { + PC.day_ordinal = 1; + PC.day_number = yyvsp[0].intval; + } + break; + + case 22: +#line 273 "getdate.y" + { + PC.day_ordinal = 1; + PC.day_number = yyvsp[-1].intval; + } + break; + + case 23: +#line 278 "getdate.y" + { + PC.day_ordinal = yyvsp[-1].textintval.value; + PC.day_number = yyvsp[0].intval; + } + break; + + case 24: +#line 286 "getdate.y" + { + PC.month = yyvsp[-2].textintval.value; + PC.day = yyvsp[0].textintval.value; + } + break; + + case 25: +#line 291 "getdate.y" + { + /* Interpret as YYYY/MM/DD if the first value has 4 or more digits, + otherwise as MM/DD/YY. + The goal in recognizing YYYY/MM/DD is solely to support legacy + machine-generated dates like those in an RCS log listing. If + you want portability, use the ISO 8601 format. */ + if (4 <= yyvsp[-4].textintval.digits) + { + PC.year = yyvsp[-4].textintval; + PC.month = yyvsp[-2].textintval.value; + PC.day = yyvsp[0].textintval.value; + } + else + { + PC.month = yyvsp[-4].textintval.value; + PC.day = yyvsp[-2].textintval.value; + PC.year = yyvsp[0].textintval; + } + } + break; + + case 26: +#line 311 "getdate.y" + { + /* ISO 8601 format. YYYY-MM-DD. */ + PC.year = yyvsp[-2].textintval; + PC.month = -yyvsp[-1].textintval.value; + PC.day = -yyvsp[0].textintval.value; + } + break; + + case 27: +#line 318 "getdate.y" + { + /* e.g. 17-JUN-1992. */ + PC.day = yyvsp[-2].textintval.value; + PC.month = yyvsp[-1].intval; + PC.year.value = -yyvsp[0].textintval.value; + PC.year.digits = yyvsp[0].textintval.digits; + } + break; + + case 28: +#line 326 "getdate.y" + { + PC.month = yyvsp[-1].intval; + PC.day = yyvsp[0].textintval.value; + } + break; + + case 29: +#line 331 "getdate.y" + { + PC.month = yyvsp[-3].intval; + PC.day = yyvsp[-2].textintval.value; + PC.year = yyvsp[0].textintval; + } + break; + + case 30: +#line 337 "getdate.y" + { + PC.day = yyvsp[-1].textintval.value; + PC.month = yyvsp[0].intval; + } + break; + + case 31: +#line 342 "getdate.y" + { + PC.day = yyvsp[-2].textintval.value; + PC.month = yyvsp[-1].intval; + PC.year = yyvsp[0].textintval; + } + break; + + case 32: +#line 351 "getdate.y" + { + PC.rel_seconds = -PC.rel_seconds; + PC.rel_minutes = -PC.rel_minutes; + PC.rel_hour = -PC.rel_hour; + PC.rel_day = -PC.rel_day; + PC.rel_month = -PC.rel_month; + PC.rel_year = -PC.rel_year; + } + break; + + case 34: +#line 364 "getdate.y" + { PC.rel_year += yyvsp[-1].textintval.value * yyvsp[0].intval; } + break; + + case 35: +#line 366 "getdate.y" + { PC.rel_year += yyvsp[-1].textintval.value * yyvsp[0].intval; } + break; + + case 36: +#line 368 "getdate.y" + { PC.rel_year += yyvsp[0].intval; } + break; + + case 37: +#line 370 "getdate.y" + { PC.rel_month += yyvsp[-1].textintval.value * yyvsp[0].intval; } + break; + + case 38: +#line 372 "getdate.y" + { PC.rel_month += yyvsp[-1].textintval.value * yyvsp[0].intval; } + break; + + case 39: +#line 374 "getdate.y" + { PC.rel_month += yyvsp[0].intval; } + break; + + case 40: +#line 376 "getdate.y" + { PC.rel_day += yyvsp[-1].textintval.value * yyvsp[0].intval; } + break; + + case 41: +#line 378 "getdate.y" + { PC.rel_day += yyvsp[-1].textintval.value * yyvsp[0].intval; } + break; + + case 42: +#line 380 "getdate.y" + { PC.rel_day += yyvsp[0].intval; } + break; + + case 43: +#line 382 "getdate.y" + { PC.rel_hour += yyvsp[-1].textintval.value * yyvsp[0].intval; } + break; + + case 44: +#line 384 "getdate.y" + { PC.rel_hour += yyvsp[-1].textintval.value * yyvsp[0].intval; } + break; + + case 45: +#line 386 "getdate.y" + { PC.rel_hour += yyvsp[0].intval; } + break; + + case 46: +#line 388 "getdate.y" + { PC.rel_minutes += yyvsp[-1].textintval.value * yyvsp[0].intval; } + break; + + case 47: +#line 390 "getdate.y" + { PC.rel_minutes += yyvsp[-1].textintval.value * yyvsp[0].intval; } + break; + + case 48: +#line 392 "getdate.y" + { PC.rel_minutes += yyvsp[0].intval; } + break; + + case 49: +#line 394 "getdate.y" + { PC.rel_seconds += yyvsp[-1].textintval.value * yyvsp[0].intval; } + break; + + case 50: +#line 396 "getdate.y" + { PC.rel_seconds += yyvsp[-1].textintval.value * yyvsp[0].intval; } + break; + + case 51: +#line 398 "getdate.y" + { PC.rel_seconds += yyvsp[0].intval; } + break; + + case 52: +#line 403 "getdate.y" + { + if (PC.dates_seen + && ! PC.rels_seen && (PC.times_seen || 2 < yyvsp[0].textintval.digits)) + PC.year = yyvsp[0].textintval; + else + { + if (4 < yyvsp[0].textintval.digits) + { + PC.dates_seen++; + PC.day = yyvsp[0].textintval.value % 100; + PC.month = (yyvsp[0].textintval.value / 100) % 100; + PC.year.value = yyvsp[0].textintval.value / 10000; + PC.year.digits = yyvsp[0].textintval.digits - 4; + } + else + { + PC.times_seen++; + if (yyvsp[0].textintval.digits <= 2) + { + PC.hour = yyvsp[0].textintval.value; + PC.minutes = 0; + } + else + { + PC.hour = yyvsp[0].textintval.value / 100; + PC.minutes = yyvsp[0].textintval.value % 100; + } + PC.seconds = 0; + PC.meridian = MER24; + } + } + } + break; + + case 53: +#line 439 "getdate.y" + { yyval.intval = MER24; } + break; + + case 54: +#line 441 "getdate.y" + { yyval.intval = yyvsp[0].intval; } + break; + + + } + +/* Line 999 of yacc.c. */ +#line 1593 "getdate.c" + + yyvsp -= yylen; + yyssp -= yylen; + + + YY_STACK_PRINT (yyss, yyssp); + + *++yyvsp = yyval; + + + /* Now `shift' the result of the reduction. Determine what state + that goes to, based on the state we popped back to and the rule + number reduced by. */ + + yyn = yyr1[yyn]; + + yystate = yypgoto[yyn - YYNTOKENS] + *yyssp; + if (0 <= yystate && yystate <= YYLAST && yycheck[yystate] == *yyssp) + yystate = yytable[yystate]; + else + yystate = yydefgoto[yyn - YYNTOKENS]; + + goto yynewstate; + + +/*------------------------------------. +| yyerrlab -- here on detecting error | +`------------------------------------*/ +yyerrlab: + /* If not already recovering from an error, report this error. */ + if (!yyerrstatus) + { + ++yynerrs; +#if YYERROR_VERBOSE + yyn = yypact[yystate]; + + if (YYPACT_NINF < yyn && yyn < YYLAST) + { + YYSIZE_T yysize = 0; + int yytype = YYTRANSLATE (yychar); + char *yymsg; + int yyx, yycount; + + yycount = 0; + /* Start YYX at -YYN if negative to avoid negative indexes in + YYCHECK. */ + for (yyx = yyn < 0 ? -yyn : 0; + yyx < (int) (sizeof (yytname) / sizeof (char *)); yyx++) + if (yycheck[yyx + yyn] == yyx && yyx != YYTERROR) + yysize += yystrlen (yytname[yyx]) + 15, yycount++; + yysize += yystrlen ("syntax error, unexpected ") + 1; + yysize += yystrlen (yytname[yytype]); + yymsg = (char *) YYSTACK_ALLOC (yysize); + if (yymsg != 0) + { + char *yyp = yystpcpy (yymsg, "syntax error, unexpected "); + yyp = yystpcpy (yyp, yytname[yytype]); + + if (yycount < 5) + { + yycount = 0; + for (yyx = yyn < 0 ? -yyn : 0; + yyx < (int) (sizeof (yytname) / sizeof (char *)); + yyx++) + if (yycheck[yyx + yyn] == yyx && yyx != YYTERROR) + { + const char *yyq = ! yycount ? ", expecting " : " or "; + yyp = yystpcpy (yyp, yyq); + yyp = yystpcpy (yyp, yytname[yyx]); + yycount++; + } + } + yyerror (yymsg); + YYSTACK_FREE (yymsg); + } + else + yyerror ("syntax error; also virtual memory exhausted"); + } + else +#endif /* YYERROR_VERBOSE */ + yyerror ("syntax error"); + } + + + + if (yyerrstatus == 3) + { + /* If just tried and failed to reuse lookahead token after an + error, discard it. */ + + /* Return failure if at end of input. */ + if (yychar == YYEOF) + { + /* Pop the error token. */ + YYPOPSTACK; + /* Pop the rest of the stack. */ + while (yyss < yyssp) + { + YYDSYMPRINTF ("Error: popping", yystos[*yyssp], yyvsp, yylsp); + yydestruct (yystos[*yyssp], yyvsp); + YYPOPSTACK; + } + YYABORT; + } + + YYDSYMPRINTF ("Error: discarding", yytoken, &yylval, &yylloc); + yydestruct (yytoken, &yylval); + yychar = YYEMPTY; + + } + + /* Else will try to reuse lookahead token after shifting the error + token. */ + goto yyerrlab1; + + +/*----------------------------------------------------. +| yyerrlab1 -- error raised explicitly by an action. | +`----------------------------------------------------*/ +yyerrlab1: + yyerrstatus = 3; /* Each real token shifted decrements this. */ + + for (;;) + { + yyn = yypact[yystate]; + if (yyn != YYPACT_NINF) + { + yyn += YYTERROR; + if (0 <= yyn && yyn <= YYLAST && yycheck[yyn] == YYTERROR) + { + yyn = yytable[yyn]; + if (0 < yyn) + break; + } + } + + /* Pop the current state because it cannot handle the error token. */ + if (yyssp == yyss) + YYABORT; + + YYDSYMPRINTF ("Error: popping", yystos[*yyssp], yyvsp, yylsp); + yydestruct (yystos[yystate], yyvsp); + yyvsp--; + yystate = *--yyssp; + + YY_STACK_PRINT (yyss, yyssp); + } + + if (yyn == YYFINAL) + YYACCEPT; + + YYDPRINTF ((stderr, "Shifting error token, ")); + + *++yyvsp = yylval; + + + yystate = yyn; + goto yynewstate; + + +/*-------------------------------------. +| yyacceptlab -- YYACCEPT comes here. | +`-------------------------------------*/ +yyacceptlab: + yyresult = 0; + goto yyreturn; + +/*-----------------------------------. +| yyabortlab -- YYABORT comes here. | +`-----------------------------------*/ +yyabortlab: + yyresult = 1; + goto yyreturn; + +#ifndef yyoverflow +/*----------------------------------------------. +| yyoverflowlab -- parser overflow comes here. | +`----------------------------------------------*/ +yyoverflowlab: + yyerror ("parser stack overflow"); + yyresult = 2; + /* Fall through. */ +#endif + +yyreturn: +#ifndef yyoverflow + if (yyss != yyssa) + YYSTACK_FREE (yyss); +#endif + return yyresult; +} + + +#line 444 "getdate.y" + + +/* Include this file down here because bison inserts code above which + may define-away `const'. We want the prototype for get_date to have + the same signature as the function definition. */ +#include "modules/getdate.h" + +#ifndef gmtime +struct tm *gmtime (); +#endif +#ifndef localtime +struct tm *localtime (); +#endif +#ifndef mktime +time_t mktime (); +#endif + +static table const meridian_table[] = +{ + { "AM", tMERIDIAN, MERam }, + { "A.M.", tMERIDIAN, MERam }, + { "PM", tMERIDIAN, MERpm }, + { "P.M.", tMERIDIAN, MERpm }, + { 0, 0, 0 } +}; + +static table const dst_table[] = +{ + { "DST", tDST, 0 } +}; + +static table const month_and_day_table[] = +{ + { "JANUARY", tMONTH, 1 }, + { "FEBRUARY", tMONTH, 2 }, + { "MARCH", tMONTH, 3 }, + { "APRIL", tMONTH, 4 }, + { "MAY", tMONTH, 5 }, + { "JUNE", tMONTH, 6 }, + { "JULY", tMONTH, 7 }, + { "AUGUST", tMONTH, 8 }, + { "SEPTEMBER",tMONTH, 9 }, + { "SEPT", tMONTH, 9 }, + { "OCTOBER", tMONTH, 10 }, + { "NOVEMBER", tMONTH, 11 }, + { "DECEMBER", tMONTH, 12 }, + { "SUNDAY", tDAY, 0 }, + { "MONDAY", tDAY, 1 }, + { "TUESDAY", tDAY, 2 }, + { "TUES", tDAY, 2 }, + { "WEDNESDAY",tDAY, 3 }, + { "WEDNES", tDAY, 3 }, + { "THURSDAY", tDAY, 4 }, + { "THUR", tDAY, 4 }, + { "THURS", tDAY, 4 }, + { "FRIDAY", tDAY, 5 }, + { "SATURDAY", tDAY, 6 }, + { 0, 0, 0 } +}; + +static table const time_units_table[] = +{ + { "YEAR", tYEAR_UNIT, 1 }, + { "MONTH", tMONTH_UNIT, 1 }, + { "FORTNIGHT",tDAY_UNIT, 14 }, + { "WEEK", tDAY_UNIT, 7 }, + { "DAY", tDAY_UNIT, 1 }, + { "HOUR", tHOUR_UNIT, 1 }, + { "MINUTE", tMINUTE_UNIT, 1 }, + { "MIN", tMINUTE_UNIT, 1 }, + { "SECOND", tSEC_UNIT, 1 }, + { "SEC", tSEC_UNIT, 1 }, + { 0, 0, 0 } +}; + +/* Assorted relative-time words. */ +static table const relative_time_table[] = +{ + { "TOMORROW", tMINUTE_UNIT, 24 * 60 }, + { "YESTERDAY",tMINUTE_UNIT, - (24 * 60) }, + { "TODAY", tMINUTE_UNIT, 0 }, + { "NOW", tMINUTE_UNIT, 0 }, + { "LAST", tUNUMBER, -1 }, + { "THIS", tUNUMBER, 0 }, + { "NEXT", tUNUMBER, 1 }, + { "FIRST", tUNUMBER, 1 }, +/*{ "SECOND", tUNUMBER, 2 }, */ + { "THIRD", tUNUMBER, 3 }, + { "FOURTH", tUNUMBER, 4 }, + { "FIFTH", tUNUMBER, 5 }, + { "SIXTH", tUNUMBER, 6 }, + { "SEVENTH", tUNUMBER, 7 }, + { "EIGHTH", tUNUMBER, 8 }, + { "NINTH", tUNUMBER, 9 }, + { "TENTH", tUNUMBER, 10 }, + { "ELEVENTH", tUNUMBER, 11 }, + { "TWELFTH", tUNUMBER, 12 }, + { "AGO", tAGO, 1 }, + { 0, 0, 0 } +}; + +/* The time zone table. This table is necessarily incomplete, as time + zone abbreviations are ambiguous; e.g. Australians interpret "EST" + as Eastern time in Australia, not as US Eastern Standard Time. + You cannot rely on getdate to handle arbitrary time zone + abbreviations; use numeric abbreviations like `-0500' instead. */ +static table const time_zone_table[] = +{ + { "GMT", tZONE, HOUR ( 0) }, /* Greenwich Mean */ + { "UT", tZONE, HOUR ( 0) }, /* Universal (Coordinated) */ + { "UTC", tZONE, HOUR ( 0) }, + { "WET", tZONE, HOUR ( 0) }, /* Western European */ + { "WEST", tDAYZONE, HOUR ( 0) }, /* Western European Summer */ + { "BST", tDAYZONE, HOUR ( 0) }, /* British Summer */ + { "ART", tZONE, -HOUR ( 3) }, /* Argentina */ + { "BRT", tZONE, -HOUR ( 3) }, /* Brazil */ + { "BRST", tDAYZONE, -HOUR ( 3) }, /* Brazil Summer */ + { "NST", tZONE, -(HOUR ( 3) + 30) }, /* Newfoundland Standard */ + { "NDT", tDAYZONE,-(HOUR ( 3) + 30) }, /* Newfoundland Daylight */ + { "AST", tZONE, -HOUR ( 4) }, /* Atlantic Standard */ + { "ADT", tDAYZONE, -HOUR ( 4) }, /* Atlantic Daylight */ + { "CLT", tZONE, -HOUR ( 4) }, /* Chile */ + { "CLST", tDAYZONE, -HOUR ( 4) }, /* Chile Summer */ + { "EST", tZONE, -HOUR ( 5) }, /* Eastern Standard */ + { "EDT", tDAYZONE, -HOUR ( 5) }, /* Eastern Daylight */ + { "CST", tZONE, -HOUR ( 6) }, /* Central Standard */ + { "CDT", tDAYZONE, -HOUR ( 6) }, /* Central Daylight */ + { "MST", tZONE, -HOUR ( 7) }, /* Mountain Standard */ + { "MDT", tDAYZONE, -HOUR ( 7) }, /* Mountain Daylight */ + { "PST", tZONE, -HOUR ( 8) }, /* Pacific Standard */ + { "PDT", tDAYZONE, -HOUR ( 8) }, /* Pacific Daylight */ + { "AKST", tZONE, -HOUR ( 9) }, /* Alaska Standard */ + { "AKDT", tDAYZONE, -HOUR ( 9) }, /* Alaska Daylight */ + { "HST", tZONE, -HOUR (10) }, /* Hawaii Standard */ + { "HAST", tZONE, -HOUR (10) }, /* Hawaii-Aleutian Standard */ + { "HADT", tDAYZONE, -HOUR (10) }, /* Hawaii-Aleutian Daylight */ + { "SST", tZONE, -HOUR (12) }, /* Samoa Standard */ + { "WAT", tZONE, HOUR ( 1) }, /* West Africa */ + { "CET", tZONE, HOUR ( 1) }, /* Central European */ + { "CEST", tDAYZONE, HOUR ( 1) }, /* Central European Summer */ + { "MET", tZONE, HOUR ( 1) }, /* Middle European */ + { "MEZ", tZONE, HOUR ( 1) }, /* Middle European */ + { "MEST", tDAYZONE, HOUR ( 1) }, /* Middle European Summer */ + { "MESZ", tDAYZONE, HOUR ( 1) }, /* Middle European Summer */ + { "EET", tZONE, HOUR ( 2) }, /* Eastern European */ + { "EEST", tDAYZONE, HOUR ( 2) }, /* Eastern European Summer */ + { "CAT", tZONE, HOUR ( 2) }, /* Central Africa */ + { "SAST", tZONE, HOUR ( 2) }, /* South Africa Standard */ + { "EAT", tZONE, HOUR ( 3) }, /* East Africa */ + { "MSK", tZONE, HOUR ( 3) }, /* Moscow */ + { "MSD", tDAYZONE, HOUR ( 3) }, /* Moscow Daylight */ + { "IST", tZONE, (HOUR ( 5) + 30) }, /* India Standard */ + { "SGT", tZONE, HOUR ( 8) }, /* Singapore */ + { "KST", tZONE, HOUR ( 9) }, /* Korea Standard */ + { "JST", tZONE, HOUR ( 9) }, /* Japan Standard */ + { "GST", tZONE, HOUR (10) }, /* Guam Standard */ + { "NZST", tZONE, HOUR (12) }, /* New Zealand Standard */ + { "NZDT", tDAYZONE, HOUR (12) }, /* New Zealand Daylight */ + { 0, 0, 0 } +}; + +/* Military time zone table. */ +static table const military_table[] = +{ + { "A", tZONE, -HOUR ( 1) }, + { "B", tZONE, -HOUR ( 2) }, + { "C", tZONE, -HOUR ( 3) }, + { "D", tZONE, -HOUR ( 4) }, + { "E", tZONE, -HOUR ( 5) }, + { "F", tZONE, -HOUR ( 6) }, + { "G", tZONE, -HOUR ( 7) }, + { "H", tZONE, -HOUR ( 8) }, + { "I", tZONE, -HOUR ( 9) }, + { "K", tZONE, -HOUR (10) }, + { "L", tZONE, -HOUR (11) }, + { "M", tZONE, -HOUR (12) }, + { "N", tZONE, HOUR ( 1) }, + { "O", tZONE, HOUR ( 2) }, + { "P", tZONE, HOUR ( 3) }, + { "Q", tZONE, HOUR ( 4) }, + { "R", tZONE, HOUR ( 5) }, + { "S", tZONE, HOUR ( 6) }, + { "T", tZONE, HOUR ( 7) }, + { "U", tZONE, HOUR ( 8) }, + { "V", tZONE, HOUR ( 9) }, + { "W", tZONE, HOUR (10) }, + { "X", tZONE, HOUR (11) }, + { "Y", tZONE, HOUR (12) }, + { "Z", tZONE, HOUR ( 0) }, + { 0, 0, 0 } +}; + + + +static int +to_hour (int hours, int meridian) +{ + switch (meridian) + { + case MER24: + return 0 <= hours && hours < 24 ? hours : -1; + case MERam: + return 0 < hours && hours < 12 ? hours : hours == 12 ? 0 : -1; + case MERpm: + return 0 < hours && hours < 12 ? hours + 12 : hours == 12 ? 12 : -1; + default: + abort (); + } + /* NOTREACHED */ + return 0; +} + +static int +to_year (textint textyear) +{ + int year = textyear.value; + + if (year < 0) + year = -year; + + /* XPG4 suggests that years 00-68 map to 2000-2068, and + years 69-99 map to 1969-1999. */ + if (textyear.digits == 2) + year += year < 69 ? 2000 : 1900; + + return year; +} + +static table const * +lookup_zone (parser_control const *pc, char const *name) +{ + table const *tp; + + /* Try local zone abbreviations first; they're more likely to be right. */ + for (tp = pc->local_time_zone_table; tp->name; tp++) + if (strcmp (name, tp->name) == 0) + return tp; + + for (tp = time_zone_table; tp->name; tp++) + if (strcmp (name, tp->name) == 0) + return tp; + + return 0; +} + +#if ! HAVE_TM_GMTOFF +/* Yield the difference between *A and *B, + measured in seconds, ignoring leap seconds. + The body of this function is taken directly from the GNU C Library; + see src/strftime.c. */ +static int +tm_diff (struct tm const *a, struct tm const *b) +{ + /* Compute intervening leap days correctly even if year is negative. + Take care to avoid int overflow in leap day calculations, + but it's OK to assume that A and B are close to each other. */ + int a4 = (a->tm_year >> 2) + (TM_YEAR_BASE >> 2) - ! (a->tm_year & 3); + int b4 = (b->tm_year >> 2) + (TM_YEAR_BASE >> 2) - ! (b->tm_year & 3); + int a100 = a4 / 25 - (a4 % 25 < 0); + int b100 = b4 / 25 - (b4 % 25 < 0); + int a400 = a100 >> 2; + int b400 = b100 >> 2; + int intervening_leap_days = (a4 - b4) - (a100 - b100) + (a400 - b400); + int years = a->tm_year - b->tm_year; + int days = (365 * years + intervening_leap_days + + (a->tm_yday - b->tm_yday)); + return (60 * (60 * (24 * days + (a->tm_hour - b->tm_hour)) + + (a->tm_min - b->tm_min)) + + (a->tm_sec - b->tm_sec)); +} +#endif /* ! HAVE_TM_GMTOFF */ + +static table const * +lookup_word (parser_control const *pc, char *word) +{ + char *p; + char *q; + size_t wordlen; + table const *tp; + int i; + int abbrev; + + /* Make it uppercase. */ + for (p = word; *p; p++) + if (ISLOWER ((unsigned char) *p)) + *p = toupper ((unsigned char) *p); + + for (tp = meridian_table; tp->name; tp++) + if (strcmp (word, tp->name) == 0) + return tp; + + /* See if we have an abbreviation for a month. */ + wordlen = strlen (word); + abbrev = wordlen == 3 || (wordlen == 4 && word[3] == '.'); + + for (tp = month_and_day_table; tp->name; tp++) + if ((abbrev ? strncmp (word, tp->name, 3) : strcmp (word, tp->name)) == 0) + return tp; + + if ((tp = lookup_zone (pc, word))) + return tp; + + if (strcmp (word, dst_table[0].name) == 0) + return dst_table; + + for (tp = time_units_table; tp->name; tp++) + if (strcmp (word, tp->name) == 0) + return tp; + + /* Strip off any plural and try the units table again. */ + if (word[wordlen - 1] == 'S') + { + word[wordlen - 1] = '\0'; + for (tp = time_units_table; tp->name; tp++) + if (strcmp (word, tp->name) == 0) + return tp; + word[wordlen - 1] = 'S'; /* For "this" in relative_time_table. */ + } + + for (tp = relative_time_table; tp->name; tp++) + if (strcmp (word, tp->name) == 0) + return tp; + + /* Military time zones. */ + if (wordlen == 1) + for (tp = military_table; tp->name; tp++) + if (word[0] == tp->name[0]) + return tp; + + /* Drop out any periods and try the time zone table again. */ + for (i = 0, p = q = word; (*p = *q); q++) + if (*q == '.') + i = 1; + else + p++; + if (i && (tp = lookup_zone (pc, word))) + return tp; + + return 0; +} + +static int +yylex (YYSTYPE *lvalp, parser_control *pc) +{ + unsigned char c; + int count; + + for (;;) + { + while (c = *pc->input, ISSPACE (c)) + pc->input++; + + if (ISDIGIT (c) || c == '-' || c == '+') + { + char const *p; + int sign; + int value; + if (c == '-' || c == '+') + { + sign = c == '-' ? -1 : 1; + c = *++pc->input; + if (! ISDIGIT (c)) + /* skip the '-' sign */ + continue; + } + else + sign = 0; + p = pc->input; + value = 0; + do + { + value = 10 * value + c - '0'; + c = *++p; + } + while (ISDIGIT (c)); + lvalp->textintval.value = sign < 0 ? -value : value; + lvalp->textintval.digits = p - pc->input; + pc->input = p; + return sign ? tSNUMBER : tUNUMBER; + } + + if (ISALPHA (c)) + { + char buff[20]; + char *p = buff; + table const *tp; + + do + { + if (p < buff + sizeof buff - 1) + *p++ = c; + c = *++pc->input; + } + while (ISALPHA (c) || c == '.'); + + *p = '\0'; + tp = lookup_word (pc, buff); + if (! tp) + return '?'; + lvalp->intval = tp->value; + return tp->type; + } + + if (c != '(') + return *pc->input++; + count = 0; + do + { + c = *pc->input++; + if (c == '\0') + return c; + if (c == '(') + count++; + else if (c == ')') + count--; + } + while (count > 0); + } +} + +/* Do nothing if the parser reports an error. */ +static int +yyerror (char *s ATTRIBUTE_UNUSED) +{ + return 0; +} + +/* Parse a date/time string P. Return the corresponding time_t value, + or (time_t) -1 if there is an error. P can be an incomplete or + relative time specification; if so, use *NOW as the basis for the + returned time. */ +time_t +get_date (const char *p, const time_t *now) +{ + time_t Start = now ? *now : time (0); + struct tm *tmp = localtime (&Start); + struct tm tm; + struct tm tm0; + parser_control pc; + + if (! tmp) + return -1; + + pc.input = p; + pc.year.value = tmp->tm_year + TM_YEAR_BASE; + pc.year.digits = 4; + pc.month = tmp->tm_mon + 1; + pc.day = tmp->tm_mday; + pc.hour = tmp->tm_hour; + pc.minutes = tmp->tm_min; + pc.seconds = tmp->tm_sec; + tm.tm_isdst = tmp->tm_isdst; + + pc.meridian = MER24; + pc.rel_seconds = 0; + pc.rel_minutes = 0; + pc.rel_hour = 0; + pc.rel_day = 0; + pc.rel_month = 0; + pc.rel_year = 0; + pc.dates_seen = 0; + pc.days_seen = 0; + pc.rels_seen = 0; + pc.times_seen = 0; + pc.local_zones_seen = 0; + pc.zones_seen = 0; + +#if HAVE_STRUCT_TM_TM_ZONE + pc.local_time_zone_table[0].name = tmp->tm_zone; + pc.local_time_zone_table[0].type = tLOCAL_ZONE; + pc.local_time_zone_table[0].value = tmp->tm_isdst; + pc.local_time_zone_table[1].name = 0; + + /* Probe the names used in the next three calendar quarters, looking + for a tm_isdst different from the one we already have. */ + { + int quarter; + for (quarter = 1; quarter <= 3; quarter++) + { + time_t probe = Start + quarter * (90 * 24 * 60 * 60); + struct tm *probe_tm = localtime (&probe); + if (probe_tm && probe_tm->tm_zone + && probe_tm->tm_isdst != pc.local_time_zone_table[0].value) + { + { + pc.local_time_zone_table[1].name = probe_tm->tm_zone; + pc.local_time_zone_table[1].type = tLOCAL_ZONE; + pc.local_time_zone_table[1].value = probe_tm->tm_isdst; + pc.local_time_zone_table[2].name = 0; + } + break; + } + } + } +#else +#if HAVE_TZNAME + { +# ifndef tzname + extern char *tzname[]; +# endif + int i; + for (i = 0; i < 2; i++) + { + pc.local_time_zone_table[i].name = tzname[i]; + pc.local_time_zone_table[i].type = tLOCAL_ZONE; + pc.local_time_zone_table[i].value = i; + } + pc.local_time_zone_table[i].name = 0; + } +#else + pc.local_time_zone_table[0].name = 0; +#endif +#endif + + if (pc.local_time_zone_table[0].name && pc.local_time_zone_table[1].name + && ! strcmp (pc.local_time_zone_table[0].name, + pc.local_time_zone_table[1].name)) + { + /* This locale uses the same abbrevation for standard and + daylight times. So if we see that abbreviation, we don't + know whether it's daylight time. */ + pc.local_time_zone_table[0].value = -1; + pc.local_time_zone_table[1].name = 0; + } + + if (yyparse (&pc) != 0 + || 1 < pc.times_seen || 1 < pc.dates_seen || 1 < pc.days_seen + || 1 < (pc.local_zones_seen + pc.zones_seen) + || (pc.local_zones_seen && 1 < pc.local_isdst)) + return -1; + + tm.tm_year = to_year (pc.year) - TM_YEAR_BASE + pc.rel_year; + tm.tm_mon = pc.month - 1 + pc.rel_month; + tm.tm_mday = pc.day + pc.rel_day; + if (pc.times_seen || (pc.rels_seen && ! pc.dates_seen && ! pc.days_seen)) + { + tm.tm_hour = to_hour (pc.hour, pc.meridian); + if (tm.tm_hour < 0) + return -1; + tm.tm_min = pc.minutes; + tm.tm_sec = pc.seconds; + } + else + { + tm.tm_hour = tm.tm_min = tm.tm_sec = 0; + } + + /* Let mktime deduce tm_isdst if we have an absolute time stamp, + or if the relative time stamp mentions days, months, or years. */ + if (pc.dates_seen | pc.days_seen | pc.times_seen | pc.rel_day + | pc.rel_month | pc.rel_year) + tm.tm_isdst = -1; + + /* But if the input explicitly specifies local time with or without + DST, give mktime that information. */ + if (pc.local_zones_seen) + tm.tm_isdst = pc.local_isdst; + + tm0 = tm; + + Start = mktime (&tm); + + if (Start == (time_t) -1) + { + + /* Guard against falsely reporting errors near the time_t boundaries + when parsing times in other time zones. For example, if the min + time_t value is 1970-01-01 00:00:00 UTC and we are 8 hours ahead + of UTC, then the min localtime value is 1970-01-01 08:00:00; if + we apply mktime to 1970-01-01 00:00:00 we will get an error, so + we apply mktime to 1970-01-02 08:00:00 instead and adjust the time + zone by 24 hours to compensate. This algorithm assumes that + there is no DST transition within a day of the time_t boundaries. */ + if (pc.zones_seen) + { + tm = tm0; + if (tm.tm_year <= EPOCH_YEAR - TM_YEAR_BASE) + { + tm.tm_mday++; + pc.time_zone += 24 * 60; + } + else + { + tm.tm_mday--; + pc.time_zone -= 24 * 60; + } + Start = mktime (&tm); + } + + if (Start == (time_t) -1) + return Start; + } + + if (pc.days_seen && ! pc.dates_seen) + { + tm.tm_mday += ((pc.day_number - tm.tm_wday + 7) % 7 + + 7 * (pc.day_ordinal - (0 < pc.day_ordinal))); + tm.tm_isdst = -1; + Start = mktime (&tm); + if (Start == (time_t) -1) + return Start; + } + + if (pc.zones_seen) + { + int delta = pc.time_zone * 60; +#ifdef HAVE_TM_GMTOFF + delta -= tm.tm_gmtoff; +#else + struct tm *gmt = gmtime (&Start); + if (! gmt) + return -1; + delta -= tm_diff (&tm, gmt); +#endif + if ((Start < Start - delta) != (delta < 0)) + return -1; /* time_t overflow */ + Start -= delta; + } + + /* Add relative hours, minutes, and seconds. Ignore leap seconds; + i.e. "+ 10 minutes" means 600 seconds, even if one of them is a + leap second. Typically this is not what the user wants, but it's + too hard to do it the other way, because the time zone indicator + must be applied before relative times, and if mktime is applied + again the time zone will be lost. */ + { + time_t t0 = Start; + long d1 = 60 * 60 * (long) pc.rel_hour; + time_t t1 = t0 + d1; + long d2 = 60 * (long) pc.rel_minutes; + time_t t2 = t1 + d2; + int d3 = pc.rel_seconds; + time_t t3 = t2 + d3; + if ((d1 / (60 * 60) ^ pc.rel_hour) + | (d2 / 60 ^ pc.rel_minutes) + | ((t0 + d1 < t0) ^ (d1 < 0)) + | ((t1 + d2 < t1) ^ (d2 < 0)) + | ((t2 + d3 < t2) ^ (d3 < 0))) + return -1; + Start = t3; + } + + return Start; +} + +#if TEST + +#include + +int +main (int ac, char **av) +{ + char buff[BUFSIZ]; + time_t d; + + printf ("Enter date, or blank line to exit.\n\t> "); + fflush (stdout); + + buff[BUFSIZ - 1] = 0; + while (fgets (buff, BUFSIZ - 1, stdin) && buff[0]) + { + d = get_date (buff, 0); + if (d == (time_t) -1) + printf ("Bad format - couldn't convert.\n"); + else + printf ("%s", ctime (&d)); + printf ("\t> "); + fflush (stdout); + } + return 0; +} +#endif /* defined TEST */ + + diff --git a/source3/modules/getdate.h b/source3/modules/getdate.h new file mode 100644 index 0000000000..674c474f11 --- /dev/null +++ b/source3/modules/getdate.h @@ -0,0 +1,46 @@ +/* Copyright (C) 1995, 1997, 1998 Free Software Foundation, Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2, or (at your option) + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software Foundation, + Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ + +#if HAVE_CONFIG_H +# include +#endif + +#ifndef PARAMS +# if defined PROTOTYPES || (defined __STDC__ && __STDC__) +# define PARAMS(Args) Args +# else +# define PARAMS(Args) () +# endif +#endif + +#ifdef vms +# include +# include +#else +# include +# if TIME_WITH_SYS_TIME +# include +# include +# else +# if HAVE_SYS_TIME_H +# include +# else +# include +# endif +# endif +#endif /* defined (vms) */ + +time_t get_date PARAMS ((const char *p, const time_t *now)); diff --git a/source3/modules/getdate.y b/source3/modules/getdate.y new file mode 100644 index 0000000000..aab37f4d23 --- /dev/null +++ b/source3/modules/getdate.y @@ -0,0 +1,1115 @@ +%{ +/* Parse a string into an internal time stamp. + Copyright (C) 1999, 2000, 2002 Free Software Foundation, Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2, or (at your option) + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software Foundation, + Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ + +/* Originally written by Steven M. Bellovin while + at the University of North Carolina at Chapel Hill. Later tweaked by + a couple of people on Usenet. Completely overhauled by Rich $alz + and Jim Berets in August, 1990. + + Modified by Paul Eggert in August 1999 to do + the right thing about local DST. Unlike previous versions, this + version is reentrant. */ + +#ifdef HAVE_CONFIG_H +# include +# ifdef HAVE_ALLOCA_H +# include +# endif +#endif + +/* Since the code of getdate.y is not included in the Emacs executable + itself, there is no need to #define static in this file. Even if + the code were included in the Emacs executable, it probably + wouldn't do any harm to #undef it here; this will only cause + problems if we try to write to a static variable, which I don't + think this code needs to do. */ +#ifdef emacs +# undef static +#endif + +#include + +#if HAVE_STDLIB_H +# include /* for `free'; used by Bison 1.27 */ +#endif + +#if STDC_HEADERS || (! defined isascii && ! HAVE_ISASCII) +# define IN_CTYPE_DOMAIN(c) 1 +#else +# define IN_CTYPE_DOMAIN(c) isascii (c) +#endif + +#define ISSPACE(c) (IN_CTYPE_DOMAIN (c) && isspace (c)) +#define ISALPHA(c) (IN_CTYPE_DOMAIN (c) && isalpha (c)) +#define ISLOWER(c) (IN_CTYPE_DOMAIN (c) && islower (c)) +#define ISDIGIT_LOCALE(c) (IN_CTYPE_DOMAIN (c) && isdigit (c)) + +/* ISDIGIT differs from ISDIGIT_LOCALE, as follows: + - Its arg may be any int or unsigned int; it need not be an unsigned char. + - It's guaranteed to evaluate its argument exactly once. + - It's typically faster. + POSIX says that only '0' through '9' are digits. Prefer ISDIGIT to + ISDIGIT_LOCALE unless it's important to use the locale's definition + of `digit' even when the host does not conform to POSIX. */ +#define ISDIGIT(c) ((unsigned) (c) - '0' <= 9) + +#if STDC_HEADERS || HAVE_STRING_H +# include +#endif + +#if __GNUC__ < 2 || (__GNUC__ == 2 && __GNUC_MINOR__ < 8) || __STRICT_ANSI__ +# define __attribute__(x) +#endif + +#ifndef ATTRIBUTE_UNUSED +# define ATTRIBUTE_UNUSED __attribute__ ((__unused__)) +#endif + +#define EPOCH_YEAR 1970 +#define TM_YEAR_BASE 1900 + +#define HOUR(x) ((x) * 60) + +/* An integer value, and the number of digits in its textual + representation. */ +typedef struct +{ + int value; + int digits; +} textint; + +/* An entry in the lexical lookup table. */ +typedef struct +{ + char const *name; + int type; + int value; +} table; + +/* Meridian: am, pm, or 24-hour style. */ +enum { MERam, MERpm, MER24 }; + +/* Information passed to and from the parser. */ +typedef struct +{ + /* The input string remaining to be parsed. */ + const char *input; + + /* N, if this is the Nth Tuesday. */ + int day_ordinal; + + /* Day of week; Sunday is 0. */ + int day_number; + + /* tm_isdst flag for the local zone. */ + int local_isdst; + + /* Time zone, in minutes east of UTC. */ + int time_zone; + + /* Style used for time. */ + int meridian; + + /* Gregorian year, month, day, hour, minutes, and seconds. */ + textint year; + int month; + int day; + int hour; + int minutes; + int seconds; + + /* Relative year, month, day, hour, minutes, and seconds. */ + int rel_year; + int rel_month; + int rel_day; + int rel_hour; + int rel_minutes; + int rel_seconds; + + /* Counts of nonterminals of various flavors parsed so far. */ + int dates_seen; + int days_seen; + int local_zones_seen; + int rels_seen; + int times_seen; + int zones_seen; + + /* Table of local time zone abbrevations, terminated by a null entry. */ + table local_time_zone_table[3]; +} parser_control; + +#define PC (* (parser_control *) parm) +#define YYLEX_PARAM parm +#define YYPARSE_PARAM parm + +static int yyerror (); +static int yylex (); + +%} + +/* We want a reentrant parser. */ +%pure_parser + +/* This grammar has 13 shift/reduce conflicts. */ +%expect 13 + +%union +{ + int intval; + textint textintval; +} + +%token tAGO tDST + +%token tDAY tDAY_UNIT tDAYZONE tHOUR_UNIT tLOCAL_ZONE tMERIDIAN +%token tMINUTE_UNIT tMONTH tMONTH_UNIT tSEC_UNIT tYEAR_UNIT tZONE + +%token tSNUMBER tUNUMBER + +%type o_merid + +%% + +spec: + /* empty */ + | spec item + ; + +item: + time + { PC.times_seen++; } + | local_zone + { PC.local_zones_seen++; } + | zone + { PC.zones_seen++; } + | date + { PC.dates_seen++; } + | day + { PC.days_seen++; } + | rel + { PC.rels_seen++; } + | number + ; + +time: + tUNUMBER tMERIDIAN + { + PC.hour = $1.value; + PC.minutes = 0; + PC.seconds = 0; + PC.meridian = $2; + } + | tUNUMBER ':' tUNUMBER o_merid + { + PC.hour = $1.value; + PC.minutes = $3.value; + PC.seconds = 0; + PC.meridian = $4; + } + | tUNUMBER ':' tUNUMBER tSNUMBER + { + PC.hour = $1.value; + PC.minutes = $3.value; + PC.meridian = MER24; + PC.zones_seen++; + PC.time_zone = $4.value % 100 + ($4.value / 100) * 60; + } + | tUNUMBER ':' tUNUMBER ':' tUNUMBER o_merid + { + PC.hour = $1.value; + PC.minutes = $3.value; + PC.seconds = $5.value; + PC.meridian = $6; + } + | tUNUMBER ':' tUNUMBER ':' tUNUMBER tSNUMBER + { + PC.hour = $1.value; + PC.minutes = $3.value; + PC.seconds = $5.value; + PC.meridian = MER24; + PC.zones_seen++; + PC.time_zone = $6.value % 100 + ($6.value / 100) * 60; + } + ; + +local_zone: + tLOCAL_ZONE + { PC.local_isdst = $1; } + | tLOCAL_ZONE tDST + { PC.local_isdst = $1 < 0 ? 1 : $1 + 1; } + ; + +zone: + tZONE + { PC.time_zone = $1; } + | tDAYZONE + { PC.time_zone = $1 + 60; } + | tZONE tDST + { PC.time_zone = $1 + 60; } + ; + +day: + tDAY + { + PC.day_ordinal = 1; + PC.day_number = $1; + } + | tDAY ',' + { + PC.day_ordinal = 1; + PC.day_number = $1; + } + | tUNUMBER tDAY + { + PC.day_ordinal = $1.value; + PC.day_number = $2; + } + ; + +date: + tUNUMBER '/' tUNUMBER + { + PC.month = $1.value; + PC.day = $3.value; + } + | tUNUMBER '/' tUNUMBER '/' tUNUMBER + { + /* Interpret as YYYY/MM/DD if the first value has 4 or more digits, + otherwise as MM/DD/YY. + The goal in recognizing YYYY/MM/DD is solely to support legacy + machine-generated dates like those in an RCS log listing. If + you want portability, use the ISO 8601 format. */ + if (4 <= $1.digits) + { + PC.year = $1; + PC.month = $3.value; + PC.day = $5.value; + } + else + { + PC.month = $1.value; + PC.day = $3.value; + PC.year = $5; + } + } + | tUNUMBER tSNUMBER tSNUMBER + { + /* ISO 8601 format. YYYY-MM-DD. */ + PC.year = $1; + PC.month = -$2.value; + PC.day = -$3.value; + } + | tUNUMBER tMONTH tSNUMBER + { + /* e.g. 17-JUN-1992. */ + PC.day = $1.value; + PC.month = $2; + PC.year.value = -$3.value; + PC.year.digits = $3.digits; + } + | tMONTH tUNUMBER + { + PC.month = $1; + PC.day = $2.value; + } + | tMONTH tUNUMBER ',' tUNUMBER + { + PC.month = $1; + PC.day = $2.value; + PC.year = $4; + } + | tUNUMBER tMONTH + { + PC.day = $1.value; + PC.month = $2; + } + | tUNUMBER tMONTH tUNUMBER + { + PC.day = $1.value; + PC.month = $2; + PC.year = $3; + } + ; + +rel: + relunit tAGO + { + PC.rel_seconds = -PC.rel_seconds; + PC.rel_minutes = -PC.rel_minutes; + PC.rel_hour = -PC.rel_hour; + PC.rel_day = -PC.rel_day; + PC.rel_month = -PC.rel_month; + PC.rel_year = -PC.rel_year; + } + | relunit + ; + +relunit: + tUNUMBER tYEAR_UNIT + { PC.rel_year += $1.value * $2; } + | tSNUMBER tYEAR_UNIT + { PC.rel_year += $1.value * $2; } + | tYEAR_UNIT + { PC.rel_year += $1; } + | tUNUMBER tMONTH_UNIT + { PC.rel_month += $1.value * $2; } + | tSNUMBER tMONTH_UNIT + { PC.rel_month += $1.value * $2; } + | tMONTH_UNIT + { PC.rel_month += $1; } + | tUNUMBER tDAY_UNIT + { PC.rel_day += $1.value * $2; } + | tSNUMBER tDAY_UNIT + { PC.rel_day += $1.value * $2; } + | tDAY_UNIT + { PC.rel_day += $1; } + | tUNUMBER tHOUR_UNIT + { PC.rel_hour += $1.value * $2; } + | tSNUMBER tHOUR_UNIT + { PC.rel_hour += $1.value * $2; } + | tHOUR_UNIT + { PC.rel_hour += $1; } + | tUNUMBER tMINUTE_UNIT + { PC.rel_minutes += $1.value * $2; } + | tSNUMBER tMINUTE_UNIT + { PC.rel_minutes += $1.value * $2; } + | tMINUTE_UNIT + { PC.rel_minutes += $1; } + | tUNUMBER tSEC_UNIT + { PC.rel_seconds += $1.value * $2; } + | tSNUMBER tSEC_UNIT + { PC.rel_seconds += $1.value * $2; } + | tSEC_UNIT + { PC.rel_seconds += $1; } + ; + +number: + tUNUMBER + { + if (PC.dates_seen + && ! PC.rels_seen && (PC.times_seen || 2 < $1.digits)) + PC.year = $1; + else + { + if (4 < $1.digits) + { + PC.dates_seen++; + PC.day = $1.value % 100; + PC.month = ($1.value / 100) % 100; + PC.year.value = $1.value / 10000; + PC.year.digits = $1.digits - 4; + } + else + { + PC.times_seen++; + if ($1.digits <= 2) + { + PC.hour = $1.value; + PC.minutes = 0; + } + else + { + PC.hour = $1.value / 100; + PC.minutes = $1.value % 100; + } + PC.seconds = 0; + PC.meridian = MER24; + } + } + } + ; + +o_merid: + /* empty */ + { $$ = MER24; } + | tMERIDIAN + { $$ = $1; } + ; + +%% + +/* Include this file down here because bison inserts code above which + may define-away `const'. We want the prototype for get_date to have + the same signature as the function definition. */ +#include "modules/getdate.h" + +#ifndef gmtime +struct tm *gmtime (); +#endif +#ifndef localtime +struct tm *localtime (); +#endif +#ifndef mktime +time_t mktime (); +#endif + +static table const meridian_table[] = +{ + { "AM", tMERIDIAN, MERam }, + { "A.M.", tMERIDIAN, MERam }, + { "PM", tMERIDIAN, MERpm }, + { "P.M.", tMERIDIAN, MERpm }, + { 0, 0, 0 } +}; + +static table const dst_table[] = +{ + { "DST", tDST, 0 } +}; + +static table const month_and_day_table[] = +{ + { "JANUARY", tMONTH, 1 }, + { "FEBRUARY", tMONTH, 2 }, + { "MARCH", tMONTH, 3 }, + { "APRIL", tMONTH, 4 }, + { "MAY", tMONTH, 5 }, + { "JUNE", tMONTH, 6 }, + { "JULY", tMONTH, 7 }, + { "AUGUST", tMONTH, 8 }, + { "SEPTEMBER",tMONTH, 9 }, + { "SEPT", tMONTH, 9 }, + { "OCTOBER", tMONTH, 10 }, + { "NOVEMBER", tMONTH, 11 }, + { "DECEMBER", tMONTH, 12 }, + { "SUNDAY", tDAY, 0 }, + { "MONDAY", tDAY, 1 }, + { "TUESDAY", tDAY, 2 }, + { "TUES", tDAY, 2 }, + { "WEDNESDAY",tDAY, 3 }, + { "WEDNES", tDAY, 3 }, + { "THURSDAY", tDAY, 4 }, + { "THUR", tDAY, 4 }, + { "THURS", tDAY, 4 }, + { "FRIDAY", tDAY, 5 }, + { "SATURDAY", tDAY, 6 }, + { 0, 0, 0 } +}; + +static table const time_units_table[] = +{ + { "YEAR", tYEAR_UNIT, 1 }, + { "MONTH", tMONTH_UNIT, 1 }, + { "FORTNIGHT",tDAY_UNIT, 14 }, + { "WEEK", tDAY_UNIT, 7 }, + { "DAY", tDAY_UNIT, 1 }, + { "HOUR", tHOUR_UNIT, 1 }, + { "MINUTE", tMINUTE_UNIT, 1 }, + { "MIN", tMINUTE_UNIT, 1 }, + { "SECOND", tSEC_UNIT, 1 }, + { "SEC", tSEC_UNIT, 1 }, + { 0, 0, 0 } +}; + +/* Assorted relative-time words. */ +static table const relative_time_table[] = +{ + { "TOMORROW", tMINUTE_UNIT, 24 * 60 }, + { "YESTERDAY",tMINUTE_UNIT, - (24 * 60) }, + { "TODAY", tMINUTE_UNIT, 0 }, + { "NOW", tMINUTE_UNIT, 0 }, + { "LAST", tUNUMBER, -1 }, + { "THIS", tUNUMBER, 0 }, + { "NEXT", tUNUMBER, 1 }, + { "FIRST", tUNUMBER, 1 }, +/*{ "SECOND", tUNUMBER, 2 }, */ + { "THIRD", tUNUMBER, 3 }, + { "FOURTH", tUNUMBER, 4 }, + { "FIFTH", tUNUMBER, 5 }, + { "SIXTH", tUNUMBER, 6 }, + { "SEVENTH", tUNUMBER, 7 }, + { "EIGHTH", tUNUMBER, 8 }, + { "NINTH", tUNUMBER, 9 }, + { "TENTH", tUNUMBER, 10 }, + { "ELEVENTH", tUNUMBER, 11 }, + { "TWELFTH", tUNUMBER, 12 }, + { "AGO", tAGO, 1 }, + { 0, 0, 0 } +}; + +/* The time zone table. This table is necessarily incomplete, as time + zone abbreviations are ambiguous; e.g. Australians interpret "EST" + as Eastern time in Australia, not as US Eastern Standard Time. + You cannot rely on getdate to handle arbitrary time zone + abbreviations; use numeric abbreviations like `-0500' instead. */ +static table const time_zone_table[] = +{ + { "GMT", tZONE, HOUR ( 0) }, /* Greenwich Mean */ + { "UT", tZONE, HOUR ( 0) }, /* Universal (Coordinated) */ + { "UTC", tZONE, HOUR ( 0) }, + { "WET", tZONE, HOUR ( 0) }, /* Western European */ + { "WEST", tDAYZONE, HOUR ( 0) }, /* Western European Summer */ + { "BST", tDAYZONE, HOUR ( 0) }, /* British Summer */ + { "ART", tZONE, -HOUR ( 3) }, /* Argentina */ + { "BRT", tZONE, -HOUR ( 3) }, /* Brazil */ + { "BRST", tDAYZONE, -HOUR ( 3) }, /* Brazil Summer */ + { "NST", tZONE, -(HOUR ( 3) + 30) }, /* Newfoundland Standard */ + { "NDT", tDAYZONE,-(HOUR ( 3) + 30) }, /* Newfoundland Daylight */ + { "AST", tZONE, -HOUR ( 4) }, /* Atlantic Standard */ + { "ADT", tDAYZONE, -HOUR ( 4) }, /* Atlantic Daylight */ + { "CLT", tZONE, -HOUR ( 4) }, /* Chile */ + { "CLST", tDAYZONE, -HOUR ( 4) }, /* Chile Summer */ + { "EST", tZONE, -HOUR ( 5) }, /* Eastern Standard */ + { "EDT", tDAYZONE, -HOUR ( 5) }, /* Eastern Daylight */ + { "CST", tZONE, -HOUR ( 6) }, /* Central Standard */ + { "CDT", tDAYZONE, -HOUR ( 6) }, /* Central Daylight */ + { "MST", tZONE, -HOUR ( 7) }, /* Mountain Standard */ + { "MDT", tDAYZONE, -HOUR ( 7) }, /* Mountain Daylight */ + { "PST", tZONE, -HOUR ( 8) }, /* Pacific Standard */ + { "PDT", tDAYZONE, -HOUR ( 8) }, /* Pacific Daylight */ + { "AKST", tZONE, -HOUR ( 9) }, /* Alaska Standard */ + { "AKDT", tDAYZONE, -HOUR ( 9) }, /* Alaska Daylight */ + { "HST", tZONE, -HOUR (10) }, /* Hawaii Standard */ + { "HAST", tZONE, -HOUR (10) }, /* Hawaii-Aleutian Standard */ + { "HADT", tDAYZONE, -HOUR (10) }, /* Hawaii-Aleutian Daylight */ + { "SST", tZONE, -HOUR (12) }, /* Samoa Standard */ + { "WAT", tZONE, HOUR ( 1) }, /* West Africa */ + { "CET", tZONE, HOUR ( 1) }, /* Central European */ + { "CEST", tDAYZONE, HOUR ( 1) }, /* Central European Summer */ + { "MET", tZONE, HOUR ( 1) }, /* Middle European */ + { "MEZ", tZONE, HOUR ( 1) }, /* Middle European */ + { "MEST", tDAYZONE, HOUR ( 1) }, /* Middle European Summer */ + { "MESZ", tDAYZONE, HOUR ( 1) }, /* Middle European Summer */ + { "EET", tZONE, HOUR ( 2) }, /* Eastern European */ + { "EEST", tDAYZONE, HOUR ( 2) }, /* Eastern European Summer */ + { "CAT", tZONE, HOUR ( 2) }, /* Central Africa */ + { "SAST", tZONE, HOUR ( 2) }, /* South Africa Standard */ + { "EAT", tZONE, HOUR ( 3) }, /* East Africa */ + { "MSK", tZONE, HOUR ( 3) }, /* Moscow */ + { "MSD", tDAYZONE, HOUR ( 3) }, /* Moscow Daylight */ + { "IST", tZONE, (HOUR ( 5) + 30) }, /* India Standard */ + { "SGT", tZONE, HOUR ( 8) }, /* Singapore */ + { "KST", tZONE, HOUR ( 9) }, /* Korea Standard */ + { "JST", tZONE, HOUR ( 9) }, /* Japan Standard */ + { "GST", tZONE, HOUR (10) }, /* Guam Standard */ + { "NZST", tZONE, HOUR (12) }, /* New Zealand Standard */ + { "NZDT", tDAYZONE, HOUR (12) }, /* New Zealand Daylight */ + { 0, 0, 0 } +}; + +/* Military time zone table. */ +static table const military_table[] = +{ + { "A", tZONE, -HOUR ( 1) }, + { "B", tZONE, -HOUR ( 2) }, + { "C", tZONE, -HOUR ( 3) }, + { "D", tZONE, -HOUR ( 4) }, + { "E", tZONE, -HOUR ( 5) }, + { "F", tZONE, -HOUR ( 6) }, + { "G", tZONE, -HOUR ( 7) }, + { "H", tZONE, -HOUR ( 8) }, + { "I", tZONE, -HOUR ( 9) }, + { "K", tZONE, -HOUR (10) }, + { "L", tZONE, -HOUR (11) }, + { "M", tZONE, -HOUR (12) }, + { "N", tZONE, HOUR ( 1) }, + { "O", tZONE, HOUR ( 2) }, + { "P", tZONE, HOUR ( 3) }, + { "Q", tZONE, HOUR ( 4) }, + { "R", tZONE, HOUR ( 5) }, + { "S", tZONE, HOUR ( 6) }, + { "T", tZONE, HOUR ( 7) }, + { "U", tZONE, HOUR ( 8) }, + { "V", tZONE, HOUR ( 9) }, + { "W", tZONE, HOUR (10) }, + { "X", tZONE, HOUR (11) }, + { "Y", tZONE, HOUR (12) }, + { "Z", tZONE, HOUR ( 0) }, + { 0, 0, 0 } +}; + + + +static int +to_hour (int hours, int meridian) +{ + switch (meridian) + { + case MER24: + return 0 <= hours && hours < 24 ? hours : -1; + case MERam: + return 0 < hours && hours < 12 ? hours : hours == 12 ? 0 : -1; + case MERpm: + return 0 < hours && hours < 12 ? hours + 12 : hours == 12 ? 12 : -1; + default: + abort (); + } + /* NOTREACHED */ + return 0; +} + +static int +to_year (textint textyear) +{ + int year = textyear.value; + + if (year < 0) + year = -year; + + /* XPG4 suggests that years 00-68 map to 2000-2068, and + years 69-99 map to 1969-1999. */ + if (textyear.digits == 2) + year += year < 69 ? 2000 : 1900; + + return year; +} + +static table const * +lookup_zone (parser_control const *pc, char const *name) +{ + table const *tp; + + /* Try local zone abbreviations first; they're more likely to be right. */ + for (tp = pc->local_time_zone_table; tp->name; tp++) + if (strcmp (name, tp->name) == 0) + return tp; + + for (tp = time_zone_table; tp->name; tp++) + if (strcmp (name, tp->name) == 0) + return tp; + + return 0; +} + +#if ! HAVE_TM_GMTOFF +/* Yield the difference between *A and *B, + measured in seconds, ignoring leap seconds. + The body of this function is taken directly from the GNU C Library; + see src/strftime.c. */ +static int +tm_diff (struct tm const *a, struct tm const *b) +{ + /* Compute intervening leap days correctly even if year is negative. + Take care to avoid int overflow in leap day calculations, + but it's OK to assume that A and B are close to each other. */ + int a4 = (a->tm_year >> 2) + (TM_YEAR_BASE >> 2) - ! (a->tm_year & 3); + int b4 = (b->tm_year >> 2) + (TM_YEAR_BASE >> 2) - ! (b->tm_year & 3); + int a100 = a4 / 25 - (a4 % 25 < 0); + int b100 = b4 / 25 - (b4 % 25 < 0); + int a400 = a100 >> 2; + int b400 = b100 >> 2; + int intervening_leap_days = (a4 - b4) - (a100 - b100) + (a400 - b400); + int years = a->tm_year - b->tm_year; + int days = (365 * years + intervening_leap_days + + (a->tm_yday - b->tm_yday)); + return (60 * (60 * (24 * days + (a->tm_hour - b->tm_hour)) + + (a->tm_min - b->tm_min)) + + (a->tm_sec - b->tm_sec)); +} +#endif /* ! HAVE_TM_GMTOFF */ + +static table const * +lookup_word (parser_control const *pc, char *word) +{ + char *p; + char *q; + size_t wordlen; + table const *tp; + int i; + int abbrev; + + /* Make it uppercase. */ + for (p = word; *p; p++) + if (ISLOWER ((unsigned char) *p)) + *p = toupper ((unsigned char) *p); + + for (tp = meridian_table; tp->name; tp++) + if (strcmp (word, tp->name) == 0) + return tp; + + /* See if we have an abbreviation for a month. */ + wordlen = strlen (word); + abbrev = wordlen == 3 || (wordlen == 4 && word[3] == '.'); + + for (tp = month_and_day_table; tp->name; tp++) + if ((abbrev ? strncmp (word, tp->name, 3) : strcmp (word, tp->name)) == 0) + return tp; + + if ((tp = lookup_zone (pc, word))) + return tp; + + if (strcmp (word, dst_table[0].name) == 0) + return dst_table; + + for (tp = time_units_table; tp->name; tp++) + if (strcmp (word, tp->name) == 0) + return tp; + + /* Strip off any plural and try the units table again. */ + if (word[wordlen - 1] == 'S') + { + word[wordlen - 1] = '\0'; + for (tp = time_units_table; tp->name; tp++) + if (strcmp (word, tp->name) == 0) + return tp; + word[wordlen - 1] = 'S'; /* For "this" in relative_time_table. */ + } + + for (tp = relative_time_table; tp->name; tp++) + if (strcmp (word, tp->name) == 0) + return tp; + + /* Military time zones. */ + if (wordlen == 1) + for (tp = military_table; tp->name; tp++) + if (word[0] == tp->name[0]) + return tp; + + /* Drop out any periods and try the time zone table again. */ + for (i = 0, p = q = word; (*p = *q); q++) + if (*q == '.') + i = 1; + else + p++; + if (i && (tp = lookup_zone (pc, word))) + return tp; + + return 0; +} + +static int +yylex (YYSTYPE *lvalp, parser_control *pc) +{ + unsigned char c; + int count; + + for (;;) + { + while (c = *pc->input, ISSPACE (c)) + pc->input++; + + if (ISDIGIT (c) || c == '-' || c == '+') + { + char const *p; + int sign; + int value; + if (c == '-' || c == '+') + { + sign = c == '-' ? -1 : 1; + c = *++pc->input; + if (! ISDIGIT (c)) + /* skip the '-' sign */ + continue; + } + else + sign = 0; + p = pc->input; + value = 0; + do + { + value = 10 * value + c - '0'; + c = *++p; + } + while (ISDIGIT (c)); + lvalp->textintval.value = sign < 0 ? -value : value; + lvalp->textintval.digits = p - pc->input; + pc->input = p; + return sign ? tSNUMBER : tUNUMBER; + } + + if (ISALPHA (c)) + { + char buff[20]; + char *p = buff; + table const *tp; + + do + { + if (p < buff + sizeof buff - 1) + *p++ = c; + c = *++pc->input; + } + while (ISALPHA (c) || c == '.'); + + *p = '\0'; + tp = lookup_word (pc, buff); + if (! tp) + return '?'; + lvalp->intval = tp->value; + return tp->type; + } + + if (c != '(') + return *pc->input++; + count = 0; + do + { + c = *pc->input++; + if (c == '\0') + return c; + if (c == '(') + count++; + else if (c == ')') + count--; + } + while (count > 0); + } +} + +/* Do nothing if the parser reports an error. */ +static int +yyerror (char *s ATTRIBUTE_UNUSED) +{ + return 0; +} + +/* Parse a date/time string P. Return the corresponding time_t value, + or (time_t) -1 if there is an error. P can be an incomplete or + relative time specification; if so, use *NOW as the basis for the + returned time. */ +time_t +get_date (const char *p, const time_t *now) +{ + time_t Start = now ? *now : time (0); + struct tm *tmp = localtime (&Start); + struct tm tm; + struct tm tm0; + parser_control pc; + + if (! tmp) + return -1; + + pc.input = p; + pc.year.value = tmp->tm_year + TM_YEAR_BASE; + pc.year.digits = 4; + pc.month = tmp->tm_mon + 1; + pc.day = tmp->tm_mday; + pc.hour = tmp->tm_hour; + pc.minutes = tmp->tm_min; + pc.seconds = tmp->tm_sec; + tm.tm_isdst = tmp->tm_isdst; + + pc.meridian = MER24; + pc.rel_seconds = 0; + pc.rel_minutes = 0; + pc.rel_hour = 0; + pc.rel_day = 0; + pc.rel_month = 0; + pc.rel_year = 0; + pc.dates_seen = 0; + pc.days_seen = 0; + pc.rels_seen = 0; + pc.times_seen = 0; + pc.local_zones_seen = 0; + pc.zones_seen = 0; + +#if HAVE_STRUCT_TM_TM_ZONE + pc.local_time_zone_table[0].name = tmp->tm_zone; + pc.local_time_zone_table[0].type = tLOCAL_ZONE; + pc.local_time_zone_table[0].value = tmp->tm_isdst; + pc.local_time_zone_table[1].name = 0; + + /* Probe the names used in the next three calendar quarters, looking + for a tm_isdst different from the one we already have. */ + { + int quarter; + for (quarter = 1; quarter <= 3; quarter++) + { + time_t probe = Start + quarter * (90 * 24 * 60 * 60); + struct tm *probe_tm = localtime (&probe); + if (probe_tm && probe_tm->tm_zone + && probe_tm->tm_isdst != pc.local_time_zone_table[0].value) + { + { + pc.local_time_zone_table[1].name = probe_tm->tm_zone; + pc.local_time_zone_table[1].type = tLOCAL_ZONE; + pc.local_time_zone_table[1].value = probe_tm->tm_isdst; + pc.local_time_zone_table[2].name = 0; + } + break; + } + } + } +#else +#if HAVE_TZNAME + { +# ifndef tzname + extern char *tzname[]; +# endif + int i; + for (i = 0; i < 2; i++) + { + pc.local_time_zone_table[i].name = tzname[i]; + pc.local_time_zone_table[i].type = tLOCAL_ZONE; + pc.local_time_zone_table[i].value = i; + } + pc.local_time_zone_table[i].name = 0; + } +#else + pc.local_time_zone_table[0].name = 0; +#endif +#endif + + if (pc.local_time_zone_table[0].name && pc.local_time_zone_table[1].name + && ! strcmp (pc.local_time_zone_table[0].name, + pc.local_time_zone_table[1].name)) + { + /* This locale uses the same abbrevation for standard and + daylight times. So if we see that abbreviation, we don't + know whether it's daylight time. */ + pc.local_time_zone_table[0].value = -1; + pc.local_time_zone_table[1].name = 0; + } + + if (yyparse (&pc) != 0 + || 1 < pc.times_seen || 1 < pc.dates_seen || 1 < pc.days_seen + || 1 < (pc.local_zones_seen + pc.zones_seen) + || (pc.local_zones_seen && 1 < pc.local_isdst)) + return -1; + + tm.tm_year = to_year (pc.year) - TM_YEAR_BASE + pc.rel_year; + tm.tm_mon = pc.month - 1 + pc.rel_month; + tm.tm_mday = pc.day + pc.rel_day; + if (pc.times_seen || (pc.rels_seen && ! pc.dates_seen && ! pc.days_seen)) + { + tm.tm_hour = to_hour (pc.hour, pc.meridian); + if (tm.tm_hour < 0) + return -1; + tm.tm_min = pc.minutes; + tm.tm_sec = pc.seconds; + } + else + { + tm.tm_hour = tm.tm_min = tm.tm_sec = 0; + } + + /* Let mktime deduce tm_isdst if we have an absolute time stamp, + or if the relative time stamp mentions days, months, or years. */ + if (pc.dates_seen | pc.days_seen | pc.times_seen | pc.rel_day + | pc.rel_month | pc.rel_year) + tm.tm_isdst = -1; + + /* But if the input explicitly specifies local time with or without + DST, give mktime that information. */ + if (pc.local_zones_seen) + tm.tm_isdst = pc.local_isdst; + + tm0 = tm; + + Start = mktime (&tm); + + if (Start == (time_t) -1) + { + + /* Guard against falsely reporting errors near the time_t boundaries + when parsing times in other time zones. For example, if the min + time_t value is 1970-01-01 00:00:00 UTC and we are 8 hours ahead + of UTC, then the min localtime value is 1970-01-01 08:00:00; if + we apply mktime to 1970-01-01 00:00:00 we will get an error, so + we apply mktime to 1970-01-02 08:00:00 instead and adjust the time + zone by 24 hours to compensate. This algorithm assumes that + there is no DST transition within a day of the time_t boundaries. */ + if (pc.zones_seen) + { + tm = tm0; + if (tm.tm_year <= EPOCH_YEAR - TM_YEAR_BASE) + { + tm.tm_mday++; + pc.time_zone += 24 * 60; + } + else + { + tm.tm_mday--; + pc.time_zone -= 24 * 60; + } + Start = mktime (&tm); + } + + if (Start == (time_t) -1) + return Start; + } + + if (pc.days_seen && ! pc.dates_seen) + { + tm.tm_mday += ((pc.day_number - tm.tm_wday + 7) % 7 + + 7 * (pc.day_ordinal - (0 < pc.day_ordinal))); + tm.tm_isdst = -1; + Start = mktime (&tm); + if (Start == (time_t) -1) + return Start; + } + + if (pc.zones_seen) + { + int delta = pc.time_zone * 60; +#ifdef HAVE_TM_GMTOFF + delta -= tm.tm_gmtoff; +#else + struct tm *gmt = gmtime (&Start); + if (! gmt) + return -1; + delta -= tm_diff (&tm, gmt); +#endif + if ((Start < Start - delta) != (delta < 0)) + return -1; /* time_t overflow */ + Start -= delta; + } + + /* Add relative hours, minutes, and seconds. Ignore leap seconds; + i.e. "+ 10 minutes" means 600 seconds, even if one of them is a + leap second. Typically this is not what the user wants, but it's + too hard to do it the other way, because the time zone indicator + must be applied before relative times, and if mktime is applied + again the time zone will be lost. */ + { + time_t t0 = Start; + long d1 = 60 * 60 * (long) pc.rel_hour; + time_t t1 = t0 + d1; + long d2 = 60 * (long) pc.rel_minutes; + time_t t2 = t1 + d2; + int d3 = pc.rel_seconds; + time_t t3 = t2 + d3; + if ((d1 / (60 * 60) ^ pc.rel_hour) + | (d2 / 60 ^ pc.rel_minutes) + | ((t0 + d1 < t0) ^ (d1 < 0)) + | ((t1 + d2 < t1) ^ (d2 < 0)) + | ((t2 + d3 < t2) ^ (d3 < 0))) + return -1; + Start = t3; + } + + return Start; +} + +#if TEST + +#include + +int +main (int ac, char **av) +{ + char buff[BUFSIZ]; + time_t d; + + printf ("Enter date, or blank line to exit.\n\t> "); + fflush (stdout); + + buff[BUFSIZ - 1] = 0; + while (fgets (buff, BUFSIZ - 1, stdin) && buff[0]) + { + d = get_date (buff, 0); + if (d == (time_t) -1) + printf ("Bad format - couldn't convert.\n"); + else + printf ("%s", ctime (&d)); + printf ("\t> "); + fflush (stdout); + } + return 0; +} +#endif /* defined TEST */ diff --git a/source3/modules/vfs_cap.c b/source3/modules/vfs_cap.c new file mode 100644 index 0000000000..0526276acb --- /dev/null +++ b/source3/modules/vfs_cap.c @@ -0,0 +1,448 @@ +/* + * CAP VFS module for Samba 3.x Version 0.3 + * + * Copyright (C) Tim Potter, 1999-2000 + * Copyright (C) Alexander Bokovoy, 2002-2003 + * Copyright (C) Stefan (metze) Metzmacher, 2003 + * Copyright (C) TAKAHASHI Motonobu (monyo), 2003 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + + +#include "includes.h" + +/* cap functions */ +static char *capencode(char *to, const char *from); +static char *capdecode(char *to, const char *from); + +static SMB_BIG_UINT cap_disk_free(vfs_handle_struct *handle, connection_struct *conn, const char *path, + BOOL small_query, SMB_BIG_UINT *bsize, + SMB_BIG_UINT *dfree, SMB_BIG_UINT *dsize) +{ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_DISK_FREE(handle, conn, cappath, small_query, bsize, + dfree, dsize); +} + +static DIR *cap_opendir(vfs_handle_struct *handle, connection_struct *conn, const char *fname) +{ + pstring capname; + capencode(capname, fname); + return SMB_VFS_NEXT_OPENDIR(handle, conn, capname); +} + +static struct dirent *cap_readdir(vfs_handle_struct *handle, connection_struct *conn, DIR *dirp) +{ + struct dirent *result; + DEBUG(3,("cap: cap_readdir\n")); + result = SMB_VFS_NEXT_READDIR(handle, conn, dirp); + if (result) { + DEBUG(3,("cap: cap_readdir: %s\n", result->d_name)); + capdecode(result->d_name, result->d_name); + } + return result; +} + +static int cap_mkdir(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) +{ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_MKDIR(handle, conn, cappath, mode); +} + +static int cap_rmdir(vfs_handle_struct *handle, connection_struct *conn, const char *path) +{ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_RMDIR(handle, conn, cappath); +} + +static int cap_open(vfs_handle_struct *handle, connection_struct *conn, const char *fname, int flags, mode_t mode) +{ + pstring capname; + DEBUG(3,("cap: cap_open for %s\n", fname)); + capencode(capname, fname); + return SMB_VFS_NEXT_OPEN(handle, conn, capname, flags, mode); +} + +static int cap_rename(vfs_handle_struct *handle, connection_struct *conn, const char *old, const char *new) +{ + pstring capold, capnew; + capencode(capold, old); + capencode(capnew, new); + + return SMB_VFS_NEXT_RENAME(handle, conn, capold, capnew); +} + +static int cap_stat(vfs_handle_struct *handle, connection_struct *conn, const char *fname, SMB_STRUCT_STAT *sbuf) +{ + pstring capname; + capencode(capname, fname); + return SMB_VFS_NEXT_STAT(handle, conn, capname, sbuf); +} + +static int cap_lstat(vfs_handle_struct *handle, connection_struct *conn, const char *path, SMB_STRUCT_STAT *sbuf) +{ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_LSTAT(handle, conn, cappath, sbuf); +} + +static int cap_unlink(vfs_handle_struct *handle, connection_struct *conn, const char *path) +{ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_UNLINK(handle, conn, cappath); +} + +static int cap_chmod(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode) +{ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_CHMOD(handle, conn, cappath, mode); +} + +static int cap_chown(vfs_handle_struct *handle, connection_struct *conn, const char *path, uid_t uid, gid_t gid) +{ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_CHOWN(handle, conn, cappath, uid, gid); +} + +static int cap_chdir(vfs_handle_struct *handle, connection_struct *conn, const char *path) +{ + pstring cappath; + DEBUG(3,("cap: cap_chdir for %s\n", path)); + capencode(cappath, path); + return SMB_VFS_NEXT_CHDIR(handle, conn, cappath); +} + +static int cap_utime(vfs_handle_struct *handle, connection_struct *conn, const char *path, struct utimbuf *times) +{ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_UTIME(handle, conn, cappath, times); +} + + +static BOOL cap_symlink(vfs_handle_struct *handle, connection_struct *conn, const char *oldpath, const char *newpath) +{ + pstring capoldpath, capnewpath; + capencode(capoldpath, oldpath); + capencode(capnewpath, newpath); + return SMB_VFS_NEXT_SYMLINK(handle, conn, capoldpath, capnewpath); +} + +static BOOL cap_readlink(vfs_handle_struct *handle, connection_struct *conn, const char *path, char *buf, size_t bufsiz) +{ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_READLINK(handle, conn, cappath, buf, bufsiz); +} + +static int cap_link(vfs_handle_struct *handle, connection_struct *conn, const char *oldpath, const char *newpath) +{ + pstring capoldpath, capnewpath; + capencode(capoldpath, oldpath); + capencode(capnewpath, newpath); + return SMB_VFS_NEXT_LINK(handle, conn, capoldpath, capnewpath); +} + +static int cap_mknod(vfs_handle_struct *handle, connection_struct *conn, const char *path, mode_t mode, SMB_DEV_T dev) +{ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_MKNOD(handle, conn, cappath, mode, dev); +} + +static char *cap_realpath(vfs_handle_struct *handle, connection_struct *conn, const char *path, char *resolved_path) +{ + /* monyo need capencode'ed and capdecode'ed? */ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_REALPATH(handle, conn, path, resolved_path); +} + +static BOOL cap_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp, const char *name, uint32 security_info_sent, struct security_descriptor_info *psd) +{ + pstring capname; + capencode(capname, name); + return SMB_VFS_NEXT_SET_NT_ACL(handle, fsp, capname, security_info_sent, psd); +} + +static int cap_chmod_acl(vfs_handle_struct *handle, connection_struct *conn, const char *name, mode_t mode) +{ + pstring capname; + capencode(capname, name); + + /* If the underlying VFS doesn't have ACL support... */ + if (!handle->vfs_next.ops.chmod_acl) { + errno = ENOSYS; + return -1; + } + return SMB_VFS_NEXT_CHMOD_ACL(handle, conn, capname, mode); +} + +static SMB_ACL_T cap_sys_acl_get_file(vfs_handle_struct *handle, connection_struct *conn, const char *path_p, SMB_ACL_TYPE_T type) +{ + pstring cappath_p; + capencode(cappath_p, path_p); + return SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, conn, cappath_p, type); +} + +static int cap_sys_acl_set_file(vfs_handle_struct *handle, connection_struct *conn, const char *name, SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl) +{ + pstring capname; + capencode(capname, name); + return SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, conn, capname, acltype, theacl); +} + +static int cap_sys_acl_delete_def_file(vfs_handle_struct *handle, connection_struct *conn, const char *path) +{ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, conn, cappath); +} + +static ssize_t cap_getxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, void *value, size_t size) +{ + pstring cappath, capname; + capencode(cappath, path); + capencode(capname, name); + return SMB_VFS_NEXT_GETXATTR(handle, conn, cappath, capname, value, size); +} + +static ssize_t cap_lgetxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, void *value, size_t +size) +{ + pstring cappath, capname; + capencode(cappath, path); + capencode(capname, name); + return SMB_VFS_NEXT_LGETXATTR(handle, conn, cappath, capname, value, size); +} + +static ssize_t cap_fgetxattr(vfs_handle_struct *handle, struct files_struct *fsp,int fd, const char *name, void *value, size_t size) +{ + pstring capname; + capencode(capname, name); + return SMB_VFS_NEXT_FGETXATTR(handle, fsp, fd, capname, value, size); +} + +static ssize_t cap_listxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, char *list, size_t size) +{ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_LISTXATTR(handle, conn, cappath, list, size); +} + +static ssize_t cap_llistxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, char *list, size_t size) +{ + pstring cappath; + capencode(cappath, path); + return SMB_VFS_NEXT_LLISTXATTR(handle, conn, cappath, list, size); +} + +static int cap_removexattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name) +{ + pstring cappath, capname; + capencode(cappath, path); + capencode(capname, name); + return SMB_VFS_NEXT_REMOVEXATTR(handle, conn, cappath, capname); +} + +static int cap_lremovexattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name) +{ + pstring cappath, capname; + capencode(cappath, path); + capencode(capname, name); + return SMB_VFS_NEXT_LREMOVEXATTR(handle, conn, cappath, capname); +} + +static int cap_fremovexattr(vfs_handle_struct *handle, struct files_struct *fsp,int fd, const char *name) +{ + pstring capname; + capencode(capname, name); + return SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, fd, capname); +} + +static int cap_setxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, const void *value, size_t size, int flags) +{ + pstring cappath, capname; + capencode(cappath, path); + capencode(capname, name); + return SMB_VFS_NEXT_SETXATTR(handle, conn, cappath, capname, value, size, flags); +} + +static int cap_lsetxattr(vfs_handle_struct *handle, struct connection_struct *conn,const char *path, const char *name, const void *value, size_t size, int flags) +{ + pstring cappath, capname; + capencode(cappath, path); + capencode(capname, name); + return SMB_VFS_NEXT_LSETXATTR(handle, conn, cappath, capname, value, size, flags); +} + +static int cap_fsetxattr(vfs_handle_struct *handle, struct files_struct *fsp,int fd, const char *name, const void *value, size_t size, int flags) +{ + pstring capname; + capencode(capname, name); + return SMB_VFS_NEXT_FSETXATTR(handle, fsp, fd, capname, value, size, flags); +} + +/* VFS operations structure */ + +static vfs_op_tuple cap_op_tuples[] = { + + /* Disk operations */ + + {SMB_VFS_OP(cap_disk_free), SMB_VFS_OP_DISK_FREE, SMB_VFS_LAYER_TRANSPARENT}, + + /* Directory operations */ + + {SMB_VFS_OP(cap_opendir), SMB_VFS_OP_OPENDIR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_readdir), SMB_VFS_OP_READDIR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_mkdir), SMB_VFS_OP_MKDIR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_rmdir), SMB_VFS_OP_RMDIR, SMB_VFS_LAYER_TRANSPARENT}, + + /* File operations */ + + {SMB_VFS_OP(cap_open), SMB_VFS_OP_OPEN, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_rename), SMB_VFS_OP_RENAME, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_stat), SMB_VFS_OP_STAT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_lstat), SMB_VFS_OP_LSTAT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_unlink), SMB_VFS_OP_UNLINK, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_chmod), SMB_VFS_OP_CHMOD, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_chown), SMB_VFS_OP_CHOWN, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_chdir), SMB_VFS_OP_CHDIR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_utime), SMB_VFS_OP_UTIME, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_symlink), SMB_VFS_OP_SYMLINK, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_readlink), SMB_VFS_OP_READLINK, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_link), SMB_VFS_OP_LINK, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_mknod), SMB_VFS_OP_MKNOD, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_realpath), SMB_VFS_OP_REALPATH, SMB_VFS_LAYER_TRANSPARENT}, + + /* NT File ACL operations */ + + {SMB_VFS_OP(cap_set_nt_acl), SMB_VFS_OP_SET_NT_ACL, SMB_VFS_LAYER_TRANSPARENT}, + + /* POSIX ACL operations */ + + {SMB_VFS_OP(cap_chmod_acl), SMB_VFS_OP_CHMOD_ACL, SMB_VFS_LAYER_TRANSPARENT}, + + {SMB_VFS_OP(cap_sys_acl_get_file), SMB_VFS_OP_SYS_ACL_GET_FILE, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_sys_acl_set_file), SMB_VFS_OP_SYS_ACL_SET_FILE, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_sys_acl_delete_def_file), SMB_VFS_OP_SYS_ACL_DELETE_DEF_FILE, SMB_VFS_LAYER_TRANSPARENT}, + + /* EA operations. */ + {SMB_VFS_OP(cap_getxattr), SMB_VFS_OP_GETXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_lgetxattr), SMB_VFS_OP_LGETXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_fgetxattr), SMB_VFS_OP_FGETXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_listxattr), SMB_VFS_OP_LISTXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_llistxattr), SMB_VFS_OP_LLISTXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_removexattr), SMB_VFS_OP_REMOVEXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_lremovexattr), SMB_VFS_OP_LREMOVEXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_fremovexattr), SMB_VFS_OP_FREMOVEXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_setxattr), SMB_VFS_OP_SETXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_lsetxattr), SMB_VFS_OP_LSETXATTR, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(cap_fsetxattr), SMB_VFS_OP_FSETXATTR, SMB_VFS_LAYER_TRANSPARENT}, + + {NULL, SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} +}; + +NTSTATUS vfs_cap_init(void) +{ + return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "cap", cap_op_tuples); +} + +/* For CAP functions */ +#define hex_tag ':' +#define hex2bin(c) hex2bin_table[(unsigned char)(c)] +#define bin2hex(c) bin2hex_table[(unsigned char)(c)] +#define is_hex(s) ((s)[0] == hex_tag) + +static unsigned char hex2bin_table[256] = { +0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x00 */ +0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x10 */ +0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x20 */ +0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 0, 0, 0, 0, 0, /* 0x30 */ +0000, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0000, /* 0x40 */ +0000, 0000, 0000, 0000, 0000, 0000, 0000, 0000, +0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x50 */ +0000, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0000, /* 0x60 */ +0000, 0000, 0000, 0000, 0000, 0000, 0000, 0000, +0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x70 */ +0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x80 */ +0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0x90 */ +0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0xa0 */ +0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0xb0 */ +0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0xc0 */ +0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0xd0 */ +0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0xe0 */ +0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 /* 0xf0 */ +}; +static unsigned char bin2hex_table[256] = "0123456789abcdef"; + +/******************************************************************* + original code -> ":xx" - CAP format +********************************************************************/ +static char *capencode(char *to, const char *from) +{ + pstring cvtbuf; + char *out; + + if (to == from) { + from = pstrcpy ((char *) cvtbuf, from); + } + + for (out = to; *from && (out - to < sizeof(pstring)-7);) { + /* buffer husoku error */ + if ((unsigned char)*from >= 0x80) { + *out++ = hex_tag; + *out++ = bin2hex (((*from)>>4)&0x0f); + *out++ = bin2hex ((*from)&0x0f); + from++; + } + else { + *out++ = *from++; + } + } + *out = '\0'; + return to; +} + +/******************************************************************* + CAP -> original code +********************************************************************/ +/* ":xx" -> a byte */ +static char *capdecode(char *to, const char *from) +{ + pstring cvtbuf; + char *out; + + if (to == from) { + from = pstrcpy ((char *) cvtbuf, from); + } + for (out = to; *from && (out - to < sizeof(pstring)-3);) { + if (is_hex(from)) { + *out++ = (hex2bin (from[1])<<4) | (hex2bin (from[2])); + from += 3; + } else { + *out++ = *from++; + } + } + *out = '\0'; + return to; +} diff --git a/source3/modules/vfs_default_quota.c b/source3/modules/vfs_default_quota.c new file mode 100644 index 0000000000..1294a51533 --- /dev/null +++ b/source3/modules/vfs_default_quota.c @@ -0,0 +1,180 @@ +/* + * Store default Quotas in a specified quota record + * + * Copyright (C) Stefan (metze) Metzmacher 2003 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "includes.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_VFS + +#define DEFAULT_QUOTA_NAME "default_quota" + +#define DEFAULT_QUOTA_UID_DEFAULT 0 +#define DEFAULT_QUOTA_UID_NOLIMIT_DEFAULT True +#define DEFAULT_QUOTA_GID_DEFAULT 0 +#define DEFAULT_QUOTA_GID_NOLIMIT_DEFAULT True + +#define DEFAULT_QUOTA_UID(handle) \ + (uid_t)lp_parm_int(SNUM((handle)->conn),DEFAULT_QUOTA_NAME,"uid",DEFAULT_QUOTA_UID_DEFAULT) + +#define DEFAULT_QUOTA_UID_NOLIMIT(handle) \ + lp_parm_bool(SNUM((handle)->conn),DEFAULT_QUOTA_NAME,"uid nolimit",DEFAULT_QUOTA_UID_NOLIMIT_DEFAULT) + +#define DEFAULT_QUOTA_GID(handle) \ + (gid_t)lp_parm_int(SNUM((handle)->conn),DEFAULT_QUOTA_NAME,"gid",DEFAULT_QUOTA_GID_DEFAULT) + +#define DEFAULT_QUOTA_GID_NOLIMIT(handle) \ + lp_parm_bool(SNUM((handle)->conn),DEFAULT_QUOTA_NAME,"gid nolimit",DEFAULT_QUOTA_GID_NOLIMIT_DEFAULT) + +static int default_quota_get_quota(vfs_handle_struct *handle, connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dq) +{ + int ret = -1; + + if ((ret=SMB_VFS_NEXT_GET_QUOTA(handle, conn, qtype, id, dq))!=0) { + return ret; + } + + switch (qtype) { + case SMB_USER_QUOTA_TYPE: + /* we use id.uid == 0 for default quotas */ + if ((id.uid==DEFAULT_QUOTA_UID(handle)) && + DEFAULT_QUOTA_UID_NOLIMIT(handle)) { + SMB_QUOTAS_SET_NO_LIMIT(dq); + } + break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_QUOTA_TYPE: + /* we use id.gid == 0 for default quotas */ + if ((id.gid==DEFAULT_QUOTA_GID(handle)) && + DEFAULT_QUOTA_GID_NOLIMIT(handle)) { + SMB_QUOTAS_SET_NO_LIMIT(dq); + } + break; +#endif /* HAVE_GROUP_QUOTA */ + case SMB_USER_FS_QUOTA_TYPE: + { + unid_t qid; + uint32 qflags = dq->qflags; + qid.uid = DEFAULT_QUOTA_UID(handle); + SMB_VFS_NEXT_GET_QUOTA(handle, conn, SMB_USER_QUOTA_TYPE, qid, dq); + dq->qflags = qflags; + } + break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_FS_QUOTA_TYPE: + { + unid_t qid; + uint32 qflags = dq->qflags; + qid.gid = DEFAULT_QUOTA_GID(handle); + SMB_VFS_NEXT_GET_QUOTA(handle, conn, SMB_GROUP_QUOTA_TYPE, qid, dq); + dq->qflags = qflags; + } + break; +#endif /* HAVE_GROUP_QUOTA */ + default: + errno = ENOSYS; + return -1; + break; + } + + return ret; +} + +static int default_quota_set_quota(vfs_handle_struct *handle, connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dq) +{ + int ret = -1; + + switch (qtype) { + case SMB_USER_QUOTA_TYPE: + /* we use id.uid == 0 for default quotas */ + if ((id.uid==DEFAULT_QUOTA_UID(handle)) && + DEFAULT_QUOTA_UID_NOLIMIT(handle)) { + return -1; + } + break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_QUOTA_TYPE: + /* we use id.gid == 0 for default quotas */ + if ((id.gid==DEFAULT_QUOTA_GID(handle)) && + DEFAULT_QUOTA_GID_NOLIMIT(handle)) { + return -1; + } + break; +#endif /* HAVE_GROUP_QUOTA */ + case SMB_USER_FS_QUOTA_TYPE: + break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_FS_QUOTA_TYPE: + break; +#endif /* HAVE_GROUP_QUOTA */ + default: + errno = ENOSYS; + return -1; + break; + } + + if ((ret=SMB_VFS_NEXT_SET_QUOTA(handle, conn, qtype, id, dq))!=0) { + return ret; + } + + switch (qtype) { + case SMB_USER_QUOTA_TYPE: + break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_QUOTA_TYPE: + break; +#endif /* HAVE_GROUP_QUOTA */ + case SMB_USER_FS_QUOTA_TYPE: + { + unid_t qid; + qid.uid = DEFAULT_QUOTA_UID(handle); + ret = SMB_VFS_NEXT_SET_QUOTA(handle, conn, SMB_USER_QUOTA_TYPE, qid, dq); + } + break; +#ifdef HAVE_GROUP_QUOTA + case SMB_GROUP_FS_QUOTA_TYPE: + { + unid_t qid; + qid.gid = DEFAULT_QUOTA_GID(handle); + ret = SMB_VFS_NEXT_SET_QUOTA(handle, conn, SMB_GROUP_QUOTA_TYPE, qid, dq); + } + break; +#endif /* HAVE_GROUP_QUOTA */ + default: + errno = ENOSYS; + return -1; + break; + } + + return ret; +} + +/* VFS operations structure */ + +static vfs_op_tuple default_quota_ops[] = { + {SMB_VFS_OP(default_quota_get_quota), SMB_VFS_OP_GET_QUOTA, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(default_quota_set_quota), SMB_VFS_OP_SET_QUOTA, SMB_VFS_LAYER_TRANSPARENT}, + + {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} +}; + +NTSTATUS vfs_default_quota_init(void) +{ + return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, DEFAULT_QUOTA_NAME, default_quota_ops); +} diff --git a/source3/modules/vfs_readonly.c b/source3/modules/vfs_readonly.c new file mode 100644 index 0000000000..ee9e40c2fc --- /dev/null +++ b/source3/modules/vfs_readonly.c @@ -0,0 +1,98 @@ +/* + Unix SMB/Netbios implementation. + Version 1.9. + VFS module to perform read-only limitation based on a time period + Copyright (C) Alexander Bokovoy 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + + This work was sponsored by Optifacio Software Services, Inc. +*/ + +#include "includes.h" +#include "getdate.h" + +/* + This module performs a read-only limitation for specified share + (or all of them if it is loaded in a [global] section) based on period + definition in smb.conf. You can stack this module multiple times under + different names to get multiple limit intervals. + + The module uses get_date() function from coreutils' date utility to parse + specified dates according to date(1) rules. Look into info page for date(1) + to understand the syntax. + + The module accepts one parameter: + + readonly: period = "begin date","end date" + + where "begin date" and "end date" are mandatory and should comply with date(1) + syntax for date strings. + + Example: + + readonly: period = "today 14:00","today 15:00" + + Default: + + readonly: period = "today 0:0:0","tomorrow 0:0:0" + + The default covers whole day thus making the share readonly + + */ + +#define MODULE_NAME "readonly" +static int readonly_connect(vfs_handle_struct *handle, + connection_struct *conn, + const char *service, + const char *user) +{ + const char *period_def[] = {"today 0:0:0", "tomorrow 0:0:0"}; + + const char **period = lp_parm_string_list(SNUM(handle->conn), + (handle->param ? handle->param : MODULE_NAME), + "period", period_def); + + if (period && period[0] && period[1]) { + time_t current_time = time(NULL); + time_t begin_period = get_date(period[0], ¤t_time); + time_t end_period = get_date(period[1], ¤t_time); + + if ((current_time >= begin_period) && (current_time <= end_period)) { + conn->read_only = True; + } + + return SMB_VFS_NEXT_CONNECT(handle, conn, service, user); + + } else { + + return 1; + + } +} + + +/* VFS operations structure */ + +static vfs_op_tuple readonly_op_tuples[] = { + /* Disk operations */ + {SMB_VFS_OP(readonly_connect), SMB_VFS_OP_CONNECT, SMB_VFS_LAYER_TRANSPARENT}, + {SMB_VFS_OP(NULL), SMB_VFS_OP_NOOP, SMB_VFS_LAYER_NOOP} +}; + +NTSTATUS vfs_readonly_init(void) +{ + return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, MODULE_NAME, readonly_op_tuples); +} diff --git a/source3/modules/vfs_recycle.c b/source3/modules/vfs_recycle.c index e725daedba..b1b2ac0353 100644 --- a/source3/modules/vfs_recycle.c +++ b/source3/modules/vfs_recycle.c @@ -336,7 +336,7 @@ static int recycle_unlink(vfs_handle_struct *handle, connection_struct *conn, co repository = alloc_sub_conn(conn, recycle_repository(handle)); ALLOC_CHECK(repository, done); /* shouldn't we allow absolute path names here? --metze */ - trim_string(repository, "/", "/"); + trim_char(repository, '/', '/'); if(!repository || *(repository) == '\0') { DEBUG(3, ("recycle: repository path not set, purging %s...\n", file_name)); @@ -455,7 +455,8 @@ static int recycle_unlink(vfs_handle_struct *handle, connection_struct *conn, co /* rename file we move to recycle bin */ i = 1; while (recycle_file_exist(handle, final_name)) { - snprintf(final_name, PATH_MAX -1, "%s/Copy #%d of %s", temp_name, i++, base); + SAFE_FREE(final_name); + asprintf(&final_name, "%s/Copy #%d of %s", temp_name, i++, base); } DEBUG(10, ("recycle: Moving %s to %s\n", file_name, final_name)); diff --git a/source3/msdfs/README b/source3/msdfs/README deleted file mode 100644 index 0e924b31dc..0000000000 --- a/source3/msdfs/README +++ /dev/null @@ -1,32 +0,0 @@ -Setting up MS Dfs in Samba -kalele@veritas.com March 2000 - -Currently, MS Dfs support is a configure time parameter (--with-msdfs). Can be changed later to always compile it in.. - -To have a server announce itself as a Dfs server, add a "host msdfs=yes" entry to smb.conf. - -To make a share a Dfs root, add a "msdfs root=yes" entry to the share definition -in the smb.conf file. -e.g. -[pub] - path = /export/publicsmb - msdfs root = yes - -To create dfs volumes/junctions in the share, create symbolic links of the -format msdfs:server1\share1,server2\share2 and so on. - -In the above example, create a dfs volume "dfsstorage" in the [pub] share as: -cd /export/publicsmb -ln -s msdfs:serverA\\share dfsstorage - -Clicking on dfsstorage from a dfs-aware client will show you the contents of -\\serverA\share - -Shares with "msdfs root = no" (which is the default) entries are served as normal -shares and the client stops talking Dfs with Samba after a tconX. - -NOTES: -* Windows clients need to be rebooted if a non-dfs root is made a dfs root or - vice versa. A better option is to introduce a new share and make it the dfs root. -* Currently there's a restriction that msdfs symlink names should be all - lowercase. diff --git a/source3/msdfs/msdfs.c b/source3/msdfs/msdfs.c index ce6e64d915..4c86cd0f94 100644 --- a/source3/msdfs/msdfs.c +++ b/source3/msdfs/msdfs.c @@ -40,7 +40,7 @@ static BOOL parse_dfs_path(char* pathname, struct dfs_path* pdp) ZERO_STRUCTP(pdp); - trim_string(temp,"\\","\\"); + trim_char(temp,'\\','\\'); DEBUG(10,("temp in parse_dfs_path: .%s. after trimming \\'s\n",temp)); /* now tokenize */ @@ -87,8 +87,16 @@ static BOOL create_conn_struct( connection_struct *conn, int snum, char *path) conn->connectpath = path; pstring_sub(conn->connectpath , "%S", lp_servicename(snum)); + /* needed for smbd_vfs_init() */ + + if ( (conn->mem_ctx=talloc_init("connection_struct")) == NULL ) { + DEBUG(0,("talloc_init(connection_struct) failed!\n")); + return False; + } + if (!smbd_vfs_init(conn)) { DEBUG(0,("create_conn_struct: smbd_vfs_init failed.\n")); + talloc_destroy( conn->mem_ctx ); return False; } return True; @@ -267,7 +275,7 @@ static BOOL resolve_dfs_path(char* dfspath, struct dfs_path* dp, char *q; pstring buf; pstrcpy(buf, dfspath); - trim_string(buf, NULL, "\\"); + trim_char(buf, '\0', '\\'); for (; consumed_level; consumed_level--) { q = strrchr(buf, '\\'); if (q) *q = 0; @@ -339,6 +347,7 @@ BOOL get_referred_path(char *pathname, struct junction_map* jn, struct connection_struct* conn = &conns; pstring conn_path; int snum; + BOOL ret = False; BOOL self_referral = False; @@ -381,16 +390,15 @@ BOOL get_referred_path(char *pathname, struct junction_map* jn, if (!lp_msdfs_root(SNUM(conn))) { DEBUG(3,("get_referred_path: .%s. in dfs path %s is not a dfs root.\n", dp.servicename, pathname)); - return False; + goto out; } if (*lp_msdfs_proxy(snum) != '\0') { struct referral* ref; jn->referral_count = 1; - if ((ref = (struct referral*) malloc(sizeof(struct referral))) - == NULL) { + if ((ref = (struct referral*) malloc(sizeof(struct referral))) == NULL) { DEBUG(0, ("malloc failed for referral\n")); - return False; + goto out; } pstrcpy(ref->alternate_path, lp_msdfs_proxy(snum)); @@ -401,7 +409,8 @@ BOOL get_referred_path(char *pathname, struct junction_map* jn, jn->referral_list = ref; if (consumedcntp) *consumedcntp = strlen(pathname); - return True; + ret = True; + goto out; } /* If not remote & not a self referral, return False */ @@ -410,7 +419,7 @@ BOOL get_referred_path(char *pathname, struct junction_map* jn, self_referralp, consumedcntp)) { if (!*self_referralp) { DEBUG(3,("get_referred_path: No valid referrals for path %s\n", pathname)); - return False; + goto out; } } @@ -418,10 +427,9 @@ BOOL get_referred_path(char *pathname, struct junction_map* jn, if (*self_referralp) { struct referral* ref; jn->referral_count = 1; - if((ref = (struct referral*) malloc(sizeof(struct referral))) - == NULL) { + if((ref = (struct referral*) malloc(sizeof(struct referral))) == NULL) { DEBUG(0,("malloc failed for referral\n")); - return False; + goto out; } pstrcpy(ref->alternate_path,pathname); @@ -431,8 +439,12 @@ BOOL get_referred_path(char *pathname, struct junction_map* jn, if (consumedcntp) *consumedcntp = strlen(pathname); } - - return True; + + ret = True; +out: + talloc_destroy( conn->mem_ctx ); + + return ret; } static int setup_ver2_dfs_referral(char* pathname, char** ppdata, @@ -758,6 +770,7 @@ BOOL create_msdfs_link(struct junction_map* jn, BOOL exists) connection_struct *conn = &conns; int i=0; BOOL insert_comma = False; + BOOL ret = False; if(!junction_to_local_path(jn, path, sizeof(path), conn)) return False; @@ -767,7 +780,7 @@ BOOL create_msdfs_link(struct junction_map* jn, BOOL exists) for(i=0; ireferral_count; i++) { char* refpath = jn->referral_list[i].alternate_path; - trim_string(refpath, "\\", "\\"); + trim_char(refpath, '\\', '\\'); if(*refpath == '\0') { if (i == 0) insert_comma = False; @@ -786,14 +799,20 @@ BOOL create_msdfs_link(struct junction_map* jn, BOOL exists) if(exists) if(SMB_VFS_UNLINK(conn,path)!=0) - return False; + goto out; if(SMB_VFS_SYMLINK(conn, msdfs_link, path) < 0) { DEBUG(1,("create_msdfs_link: symlink failed %s -> %s\nError: %s\n", path, msdfs_link, strerror(errno))); - return False; + goto out; } - return True; + + + ret = True; + +out: + talloc_destroy( conn->mem_ctx ); + return ret; } BOOL remove_msdfs_link(struct junction_map* jn) @@ -801,14 +820,16 @@ BOOL remove_msdfs_link(struct junction_map* jn) pstring path; connection_struct conns; connection_struct *conn = &conns; + BOOL ret = False; - if(!junction_to_local_path(jn, path, sizeof(path), conn)) - return False; - - if(SMB_VFS_UNLINK(conn, path)!=0) - return False; - - return True; + if( junction_to_local_path(jn, path, sizeof(path), conn) ) { + if( SMB_VFS_UNLINK(conn, path) == 0 ) + ret = True; + + talloc_destroy( conn->mem_ctx ); + } + + return ret; } static BOOL form_junctions(int snum, struct junction_map* jn, int* jn_count) @@ -821,6 +842,7 @@ static BOOL form_junctions(int snum, struct junction_map* jn, int* jn_count) connection_struct conns; connection_struct *conn = &conns; struct referral *ref = NULL; + BOOL ret = False; pstrcpy(connect_path,lp_pathname(snum)); @@ -846,7 +868,7 @@ static BOOL form_junctions(int snum, struct junction_map* jn, int* jn_count) = (struct referral*) malloc(sizeof(struct referral)); if (jn[cnt].referral_list == NULL) { DEBUG(0, ("Malloc failed!\n")); - return False; + goto out; } ref->proximity = 0; @@ -854,7 +876,8 @@ static BOOL form_junctions(int snum, struct junction_map* jn, int* jn_count) if (*lp_msdfs_proxy(snum) != '\0') { pstrcpy(ref->alternate_path, lp_msdfs_proxy(snum)); *jn_count = ++cnt; - return True; + ret = True; + goto out; } slprintf(ref->alternate_path, sizeof(pstring)-1, @@ -864,7 +887,7 @@ static BOOL form_junctions(int snum, struct junction_map* jn, int* jn_count) /* Now enumerate all dfs links */ dirp = SMB_VFS_OPENDIR(conn, connect_path); if(!dirp) - return False; + goto out; while((dname = vfs_readdirname(conn, dirp)) != NULL) { pstring pathreal; @@ -883,7 +906,9 @@ static BOOL form_junctions(int snum, struct junction_map* jn, int* jn_count) SMB_VFS_CLOSEDIR(conn,dirp); *jn_count = cnt; - return True; +out: + talloc_destroy(conn->mem_ctx); + return ret; } int enum_msdfs_links(struct junction_map* jn) @@ -892,9 +917,9 @@ int enum_msdfs_links(struct junction_map* jn) int jn_count = 0; if(!lp_host_msdfs()) - return -1; + return 0; - for(i=0;*lp_servicename(i);i++) { + for(i=0;i < lp_numservices();i++) { if(lp_msdfs_root(i)) form_junctions(i,jn,&jn_count); } diff --git a/source3/nmbd/asyncdns.c b/source3/nmbd/asyncdns.c index c86ee69a09..6d5d487b11 100644 --- a/source3/nmbd/asyncdns.c +++ b/source3/nmbd/asyncdns.c @@ -26,26 +26,25 @@ static struct name_record *add_dns_result(struct nmb_name *question, struct in_addr addr) { - int name_type = question->name_type; - char *qname = question->name; - + int name_type = question->name_type; + nstring qname; + + pull_ascii_nstring(qname, question->name); - if (!addr.s_addr) { - /* add the fail to WINS cache of names. give it 1 hour in the cache */ - DEBUG(3,("add_dns_result: Negative DNS answer for %s\n", qname)); - (void)add_name_to_subnet( wins_server_subnet, qname, name_type, - NB_ACTIVE, 60*60, DNSFAIL_NAME, 1, &addr ); - return( NULL ); - } - - /* add it to our WINS cache of names. give it 2 hours in the cache */ - DEBUG(3,("add_dns_result: DNS gave answer for %s of %s\n", qname, inet_ntoa(addr))); - - return( add_name_to_subnet( wins_server_subnet, qname, name_type, - NB_ACTIVE, 2*60*60, DNS_NAME, 1, &addr ) ); -} + if (!addr.s_addr) { + /* add the fail to WINS cache of names. give it 1 hour in the cache */ + DEBUG(3,("add_dns_result: Negative DNS answer for %s\n", qname)); + (void)add_name_to_subnet( wins_server_subnet, qname, name_type, + NB_ACTIVE, 60*60, DNSFAIL_NAME, 1, &addr ); + return( NULL ); + } + /* add it to our WINS cache of names. give it 2 hours in the cache */ + DEBUG(3,("add_dns_result: DNS gave answer for %s of %s\n", qname, inet_ntoa(addr))); + return( add_name_to_subnet( wins_server_subnet, qname, name_type, + NB_ACTIVE, 2*60*60, DNS_NAME, 1, &addr ) ); +} #ifndef SYNC_DNS @@ -70,6 +69,7 @@ static struct packet_struct *dns_current; return the fd used to gather async dns replies. This is added to the select loop ****************************************************************************/ + int asyncdns_fd(void) { return fd_in; @@ -110,7 +110,7 @@ static void asyncdns_process(void) static void sig_term(int sig) { - _exit(0); + _exit(0); } /*************************************************************************** @@ -224,10 +224,10 @@ void run_dns_queue(void) if (query_current(&r)) { DEBUG(3,("DNS calling send_wins_name_query_response\n")); in_dns = 1; - if(namerec == NULL) - send_wins_name_query_response(NAM_ERR, dns_current, NULL); - else - send_wins_name_query_response(0,dns_current,namerec); + if(namerec == NULL) + send_wins_name_query_response(NAM_ERR, dns_current, NULL); + else + send_wins_name_query_response(0,dns_current,namerec); in_dns = 0; } @@ -245,10 +245,10 @@ void run_dns_queue(void) if (nmb_name_equal(question, &r.name)) { DEBUG(3,("DNS calling send_wins_name_query_response\n")); in_dns = 1; - if(namerec == NULL) - send_wins_name_query_response(NAM_ERR, p, NULL); - else - send_wins_name_query_response(0,p,namerec); + if(namerec == NULL) + send_wins_name_query_response(NAM_ERR, p, NULL); + else + send_wins_name_query_response(0,p,namerec); in_dns = 0; p->locked = False; @@ -269,7 +269,8 @@ void run_dns_queue(void) if (dns_queue) { dns_current = dns_queue; dns_queue = dns_queue->next; - if (dns_queue) dns_queue->prev = NULL; + if (dns_queue) + dns_queue->prev = NULL; dns_current->next = NULL; if (!write_child(dns_current)) { @@ -277,12 +278,12 @@ void run_dns_queue(void) return; } } - } /*************************************************************************** queue a DNS query ****************************************************************************/ + BOOL queue_dns_query(struct packet_struct *p,struct nmb_name *question, struct name_record **n) { @@ -315,11 +316,14 @@ BOOL queue_dns_query(struct packet_struct *p,struct nmb_name *question, /*************************************************************************** we use this when we can't do async DNS lookups ****************************************************************************/ + BOOL queue_dns_query(struct packet_struct *p,struct nmb_name *question, struct name_record **n) { - char *qname = question->name; struct in_addr dns_ip; + nstring qname; + + pull_ascii_nstring(qname, question->name); DEBUG(3,("DNS search for %s - ", nmb_namestr(question))); @@ -332,18 +336,19 @@ BOOL queue_dns_query(struct packet_struct *p,struct nmb_name *question, BlockSignals(True, SIGTERM); *n = add_dns_result(question, dns_ip); - if(*n == NULL) - send_wins_name_query_response(NAM_ERR, p, NULL); - else - send_wins_name_query_response(0, p, *n); + if(*n == NULL) + send_wins_name_query_response(NAM_ERR, p, NULL); + else + send_wins_name_query_response(0, p, *n); return False; } /*************************************************************************** With sync dns there is no child to kill on SIGTERM. ****************************************************************************/ + void kill_async_dns_child(void) { - return; + return; } #endif diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c index 2801e54551..25ba07c8a7 100644 --- a/source3/nmbd/nmbd.c +++ b/source3/nmbd/nmbd.c @@ -231,7 +231,8 @@ static BOOL reload_interfaces(time_t t) DEBUG(2,("Found new interface %s\n", inet_ntoa(iface->ip))); subrec = make_normal_subnet(iface); - if (subrec) register_my_workgroup_one_subnet(subrec); + if (subrec) + register_my_workgroup_one_subnet(subrec); } } @@ -303,6 +304,7 @@ static BOOL reload_nmbd_services(BOOL test) * We use buf here to return BOOL result to process() when reload_interfaces() * detects that there are no subnets. **************************************************************************** */ + static void msg_reload_nmbd_services(int msg_type, pid_t src, void *buf, size_t len) { write_browse_list( 0, True ); @@ -650,126 +652,120 @@ static BOOL open_sockets(BOOL isdaemon, int port) log_stdout = True; } - if ( log_stdout && Fork ) { - DEBUG(0,("ERROR: Can't log to stdout (-S) unless daemon is in foreground (-F) or interactive (-i)\n")); - exit(1); - } + if ( log_stdout && Fork ) { + DEBUG(0,("ERROR: Can't log to stdout (-S) unless daemon is in foreground (-F) or interactive (-i)\n")); + exit(1); + } - setup_logging( argv[0], log_stdout ); + setup_logging( argv[0], log_stdout ); - reopen_logs(); + reopen_logs(); - DEBUG( 0, ( "Netbios nameserver version %s started.\n", VERSION ) ); - DEBUGADD( 0, ( "Copyright Andrew Tridgell and the Samba Team 1994-2003\n" ) ); + DEBUG( 0, ( "Netbios nameserver version %s started.\n", SAMBA_VERSION_STRING) ); + DEBUGADD( 0, ( "Copyright Andrew Tridgell and the Samba Team 1994-2003\n" ) ); - if ( !reload_nmbd_services(False) ) - return(-1); + if ( !reload_nmbd_services(False) ) + return(-1); - if(!init_names()) - return -1; + if(!init_names()) + return -1; - reload_nmbd_services( True ); + reload_nmbd_services( True ); - if (strequal(lp_workgroup(),"*")) - { - DEBUG(0,("ERROR: a workgroup name of * is no longer supported\n")); - exit(1); - } + if (strequal(lp_workgroup(),"*")) { + DEBUG(0,("ERROR: a workgroup name of * is no longer supported\n")); + exit(1); + } - set_samba_nb_type(); + set_samba_nb_type(); - if (!is_daemon && !is_a_socket(0)) - { - DEBUG(0,("standard input is not a socket, assuming -D option\n")); - is_daemon = True; - } + if (!is_daemon && !is_a_socket(0)) { + DEBUG(0,("standard input is not a socket, assuming -D option\n")); + is_daemon = True; + } - if (is_daemon && !opt_interactive) - { - DEBUG( 2, ( "Becoming a daemon.\n" ) ); - become_daemon(Fork); - } + if (is_daemon && !opt_interactive) { + DEBUG( 2, ( "Becoming a daemon.\n" ) ); + become_daemon(Fork); + } #if HAVE_SETPGID - /* - * If we're interactive we want to set our own process group for - * signal management. - */ - if (opt_interactive) - setpgid( (pid_t)0, (pid_t)0 ); + /* + * If we're interactive we want to set our own process group for + * signal management. + */ + if (opt_interactive) + setpgid( (pid_t)0, (pid_t)0 ); #endif #ifndef SYNC_DNS - /* Setup the async dns. We do it here so it doesn't have all the other - stuff initialised and thus chewing memory and sockets */ - if(lp_we_are_a_wins_server() && lp_dns_proxy()) { - start_async_dns(); - } + /* Setup the async dns. We do it here so it doesn't have all the other + stuff initialised and thus chewing memory and sockets */ + if(lp_we_are_a_wins_server() && lp_dns_proxy()) { + start_async_dns(); + } #endif - if (!directory_exist(lp_lockdir(), NULL)) { - mkdir(lp_lockdir(), 0755); - } - - pidfile_create("nmbd"); - message_init(); - message_register(MSG_FORCE_ELECTION, nmbd_message_election); - message_register(MSG_WINS_NEW_ENTRY, nmbd_wins_new_entry); - message_register(MSG_SHUTDOWN, nmbd_terminate); - message_register(MSG_SMB_CONF_UPDATED, msg_reload_nmbd_services); - - DEBUG( 3, ( "Opening sockets %d\n", global_nmb_port ) ); - - if ( !open_sockets( is_daemon, global_nmb_port ) ) { - kill_async_dns_child(); - return 1; - } - - /* Determine all the IP addresses we have. */ - load_interfaces(); - - /* Create an nmbd subnet record for each of the above. */ - if( False == create_subnets() ) - { - DEBUG(0,("ERROR: Failed when creating subnet lists. Exiting.\n")); - kill_async_dns_child(); - exit(1); - } - - /* Load in any static local names. */ - load_lmhosts_file(dyn_LMHOSTSFILE); - DEBUG(3,("Loaded hosts file %s\n", dyn_LMHOSTSFILE)); - - /* If we are acting as a WINS server, initialise data structures. */ - if( !initialise_wins() ) - { - DEBUG( 0, ( "nmbd: Failed when initialising WINS server.\n" ) ); - kill_async_dns_child(); - exit(1); - } - - /* - * Register nmbd primary workgroup and nmbd names on all - * the broadcast subnets, and on the WINS server (if specified). - * Also initiate the startup of our primary workgroup (start - * elections if we are setup as being able to be a local - * master browser. - */ - - if( False == register_my_workgroup_and_names() ) - { - DEBUG(0,("ERROR: Failed when creating my my workgroup. Exiting.\n")); - kill_async_dns_child(); - exit(1); - } - - /* We can only take signals in the select. */ - BlockSignals( True, SIGTERM ); - - process(); - - if (dbf) - x_fclose(dbf); - kill_async_dns_child(); - return(0); + if (!directory_exist(lp_lockdir(), NULL)) { + mkdir(lp_lockdir(), 0755); + } + + pidfile_create("nmbd"); + message_init(); + message_register(MSG_FORCE_ELECTION, nmbd_message_election); + message_register(MSG_WINS_NEW_ENTRY, nmbd_wins_new_entry); + message_register(MSG_SHUTDOWN, nmbd_terminate); + message_register(MSG_SMB_CONF_UPDATED, msg_reload_nmbd_services); + + DEBUG( 3, ( "Opening sockets %d\n", global_nmb_port ) ); + + if ( !open_sockets( is_daemon, global_nmb_port ) ) { + kill_async_dns_child(); + return 1; + } + + /* Determine all the IP addresses we have. */ + load_interfaces(); + + /* Create an nmbd subnet record for each of the above. */ + if( False == create_subnets() ) { + DEBUG(0,("ERROR: Failed when creating subnet lists. Exiting.\n")); + kill_async_dns_child(); + exit(1); + } + + /* Load in any static local names. */ + load_lmhosts_file(dyn_LMHOSTSFILE); + DEBUG(3,("Loaded hosts file %s\n", dyn_LMHOSTSFILE)); + + /* If we are acting as a WINS server, initialise data structures. */ + if( !initialise_wins() ) { + DEBUG( 0, ( "nmbd: Failed when initialising WINS server.\n" ) ); + kill_async_dns_child(); + exit(1); + } + + /* + * Register nmbd primary workgroup and nmbd names on all + * the broadcast subnets, and on the WINS server (if specified). + * Also initiate the startup of our primary workgroup (start + * elections if we are setup as being able to be a local + * master browser. + */ + + if( False == register_my_workgroup_and_names() ) { + DEBUG(0,("ERROR: Failed when creating my my workgroup. Exiting.\n")); + kill_async_dns_child(); + exit(1); + } + + /* We can only take signals in the select. */ + BlockSignals( True, SIGTERM ); + + process(); + + if (dbf) + x_fclose(dbf); + kill_async_dns_child(); + return(0); } diff --git a/source3/nmbd/nmbd_become_dmb.c b/source3/nmbd/nmbd_become_dmb.c index 2e76e51f45..46d37fbb81 100644 --- a/source3/nmbd/nmbd_become_dmb.c +++ b/source3/nmbd/nmbd_become_dmb.c @@ -3,7 +3,7 @@ NBT netbios routines and daemon - version 2 Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -37,36 +37,37 @@ static void become_domain_master_fail(struct subnet_record *subrec, struct response_record *rrec, struct nmb_name *fail_name) { - struct work_record *work = find_workgroup_on_subnet(subrec, fail_name->name); - struct server_record *servrec; - - if(!work) - { - DEBUG(0,("become_domain_master_fail: Error - cannot find \ -workgroup %s on subnet %s\n", fail_name->name, subrec->subnet_name)); - return; - } - - /* Set the state back to DOMAIN_NONE. */ - work->dom_state = DOMAIN_NONE; - - if((servrec = find_server_in_workgroup( work, global_myname())) == NULL) - { - DEBUG(0,("become_domain_master_fail: Error - cannot find server %s \ + nstring failname; + struct work_record *work; + struct server_record *servrec; + + pull_ascii_nstring(failname, fail_name->name); + work = find_workgroup_on_subnet(subrec, failname); + if(!work) { + DEBUG(0,("become_domain_master_fail: Error - cannot find \ +workgroup %s on subnet %s\n", failname, subrec->subnet_name)); + return; + } + + /* Set the state back to DOMAIN_NONE. */ + work->dom_state = DOMAIN_NONE; + + if((servrec = find_server_in_workgroup( work, global_myname())) == NULL) { + DEBUG(0,("become_domain_master_fail: Error - cannot find server %s \ in workgroup %s on subnet %s\n", - global_myname(), work->work_group, subrec->subnet_name)); - return; - } + global_myname(), work->work_group, subrec->subnet_name)); + return; + } - /* Update our server status. */ - servrec->serv.type &= ~SV_TYPE_DOMAIN_MASTER; + /* Update our server status. */ + servrec->serv.type &= ~SV_TYPE_DOMAIN_MASTER; - /* Tell the namelist writer to write out a change. */ - subrec->work_changed = True; + /* Tell the namelist writer to write out a change. */ + subrec->work_changed = True; - DEBUG(0,("become_domain_master_fail: Failed to become a domain master browser for \ + DEBUG(0,("become_domain_master_fail: Failed to become a domain master browser for \ workgroup %s on subnet %s. Couldn't register name %s.\n", - work->work_group, subrec->subnet_name, nmb_namestr(fail_name))); + work->work_group, subrec->subnet_name, nmb_namestr(fail_name))); } /**************************************************************************** @@ -79,115 +80,112 @@ static void become_domain_master_stage2(struct subnet_record *subrec, uint16 nb_flags, int ttl, struct in_addr registered_ip) { - struct work_record *work = find_workgroup_on_subnet( subrec, registered_name->name); - struct server_record *servrec; - - if(!work) - { - DEBUG(0,("become_domain_master_stage2: Error - cannot find \ -workgroup %s on subnet %s\n", registered_name->name, subrec->subnet_name)); - return; - } - - if((servrec = find_server_in_workgroup( work, global_myname())) == NULL) - { - DEBUG(0,("become_domain_master_stage2: Error - cannot find server %s \ + nstring regname; + struct work_record *work; + struct server_record *servrec; + + pull_ascii_nstring(regname, registered_name->name); + work = find_workgroup_on_subnet( subrec, regname); + + if(!work) { + DEBUG(0,("become_domain_master_stage2: Error - cannot find \ +workgroup %s on subnet %s\n", regname, subrec->subnet_name)); + return; + } + + if((servrec = find_server_in_workgroup( work, global_myname())) == NULL) { + DEBUG(0,("become_domain_master_stage2: Error - cannot find server %s \ in workgroup %s on subnet %s\n", - global_myname(), registered_name->name, subrec->subnet_name)); - work->dom_state = DOMAIN_NONE; - return; - } - - /* Set the state in the workgroup structure. */ - work->dom_state = DOMAIN_MST; /* Become domain master. */ - - /* Update our server status. */ - servrec->serv.type |= (SV_TYPE_NT|SV_TYPE_DOMAIN_MASTER); - - /* Tell the namelist writer to write out a change. */ - subrec->work_changed = True; - - if( DEBUGLVL( 0 ) ) - { - dbgtext( "*****\n\nSamba server %s ", global_myname() ); - dbgtext( "is now a domain master browser for " ); - dbgtext( "workgroup %s ", work->work_group ); - dbgtext( "on subnet %s\n\n*****\n", subrec->subnet_name ); - } - - if( subrec == unicast_subnet ) - { - struct nmb_name nmbname; - struct in_addr my_first_ip; - - /* Put our name and first IP address into the - workgroup struct as domain master browser. This - will stop us syncing with ourself if we are also - a local master browser. */ - - make_nmb_name(&nmbname, global_myname(), 0x20); - - work->dmb_name = nmbname; - /* Pick the first interface ip address as the domain master browser ip. */ - my_first_ip = *iface_n_ip(0); - - putip((char *)&work->dmb_addr, &my_first_ip); - - /* We successfully registered by unicast with the - WINS server. We now expect to become the domain - master on the local subnets. If this fails, it's - probably a 1.9.16p2 to 1.9.16p11 server's fault. - - This is a configuration issue that should be addressed - by the network administrator - you shouldn't have - several machines configured as a domain master browser - for the same WINS scope (except if they are 1.9.17 or - greater, and you know what you're doing. - - see docs/DOMAIN.txt. - - */ - become_domain_master_browser_bcast(work->work_group); - } - else - { - /* - * Now we are a domain master on a broadcast subnet, we need to add - * the WORKGROUP<1b> name to the unicast subnet so that we can answer - * unicast requests sent to this name. This bug wasn't found for a while - * as it is strange to have a DMB without using WINS. JRA. - */ - insert_permanent_name_into_unicast(subrec, registered_name, nb_flags); - } + global_myname(), regname, subrec->subnet_name)); + work->dom_state = DOMAIN_NONE; + return; + } + + /* Set the state in the workgroup structure. */ + work->dom_state = DOMAIN_MST; /* Become domain master. */ + + /* Update our server status. */ + servrec->serv.type |= (SV_TYPE_NT|SV_TYPE_DOMAIN_MASTER); + + /* Tell the namelist writer to write out a change. */ + subrec->work_changed = True; + + if( DEBUGLVL( 0 ) ) { + dbgtext( "*****\n\nSamba server %s ", global_myname() ); + dbgtext( "is now a domain master browser for " ); + dbgtext( "workgroup %s ", work->work_group ); + dbgtext( "on subnet %s\n\n*****\n", subrec->subnet_name ); + } + + if( subrec == unicast_subnet ) { + struct nmb_name nmbname; + struct in_addr my_first_ip; + + /* Put our name and first IP address into the + workgroup struct as domain master browser. This + will stop us syncing with ourself if we are also + a local master browser. */ + + make_nmb_name(&nmbname, global_myname(), 0x20); + + work->dmb_name = nmbname; + /* Pick the first interface ip address as the domain master browser ip. */ + my_first_ip = *iface_n_ip(0); + + putip((char *)&work->dmb_addr, &my_first_ip); + + /* We successfully registered by unicast with the + WINS server. We now expect to become the domain + master on the local subnets. If this fails, it's + probably a 1.9.16p2 to 1.9.16p11 server's fault. + + This is a configuration issue that should be addressed + by the network administrator - you shouldn't have + several machines configured as a domain master browser + for the same WINS scope (except if they are 1.9.17 or + greater, and you know what you're doing. + + see docs/DOMAIN.txt. + + */ + become_domain_master_browser_bcast(work->work_group); + } else { + /* + * Now we are a domain master on a broadcast subnet, we need to add + * the WORKGROUP<1b> name to the unicast subnet so that we can answer + * unicast requests sent to this name. This bug wasn't found for a while + * as it is strange to have a DMB without using WINS. JRA. + */ + insert_permanent_name_into_unicast(subrec, registered_name, nb_flags); + } } /**************************************************************************** Start the name registration process when becoming a Domain Master Browser on a subnet. - ****************************************************************************/ +****************************************************************************/ -static void become_domain_master_stage1(struct subnet_record *subrec, char *wg_name) +static void become_domain_master_stage1(struct subnet_record *subrec, const char *wg_name) { - struct work_record *work; + struct work_record *work; - DEBUG(2,("become_domain_master_stage1: Becoming domain master browser for \ + DEBUG(2,("become_domain_master_stage1: Becoming domain master browser for \ workgroup %s on subnet %s\n", wg_name, subrec->subnet_name)); - /* First, find the workgroup on the subnet. */ - if((work = find_workgroup_on_subnet( subrec, wg_name )) == NULL) - { - DEBUG(0,("become_domain_master_stage1: Error - unable to find workgroup %s on subnet %s.\n", - wg_name, subrec->subnet_name)); - return; - } - - DEBUG(3,("become_domain_master_stage1: go to first stage: register <1b> name\n")); - work->dom_state = DOMAIN_WAIT; - - /* WORKGROUP<1b> is the domain master browser name. */ - register_name(subrec, work->work_group,0x1b,samba_nb_type, - become_domain_master_stage2, - become_domain_master_fail, NULL); + /* First, find the workgroup on the subnet. */ + if((work = find_workgroup_on_subnet( subrec, wg_name )) == NULL) { + DEBUG(0,("become_domain_master_stage1: Error - unable to find workgroup %s on subnet %s.\n", + wg_name, subrec->subnet_name)); + return; + } + + DEBUG(3,("become_domain_master_stage1: go to first stage: register <1b> name\n")); + work->dom_state = DOMAIN_WAIT; + + /* WORKGROUP<1b> is the domain master browser name. */ + register_name(subrec, work->work_group,0x1b,samba_nb_type, + become_domain_master_stage2, + become_domain_master_fail, NULL); } /**************************************************************************** @@ -202,37 +200,35 @@ static void become_domain_master_query_success(struct subnet_record *subrec, struct nmb_name *nmbname, struct in_addr ip, struct res_rec *rrec) { - /* If the given ip is not ours, then we can't become a domain - controler as the name is already registered. - */ - - /* BUG note. Samba 1.9.16p11 servers seem to return the broadcast - address or zero ip for this query. Pretend this is ok. */ - - if(ismyip(ip) || ip_equal(allones_ip, ip) || is_zero_ip(ip)) - { - if( DEBUGLVL( 3 ) ) - { - dbgtext( "become_domain_master_query_success():\n" ); - dbgtext( "Our address (%s) ", inet_ntoa(ip) ); - dbgtext( "returned in query for name %s ", nmb_namestr(nmbname) ); - dbgtext( "(domain master browser name) " ); - dbgtext( "on subnet %s.\n", subrec->subnet_name ); - dbgtext( "Continuing with domain master code.\n" ); - } - - become_domain_master_stage1(subrec, nmbname->name); - } - else - { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "become_domain_master_query_success:\n" ); - dbgtext( "There is already a domain master browser at " ); - dbgtext( "IP %s for workgroup %s ", inet_ntoa(ip), nmbname->name ); - dbgtext( "registered on subnet %s.\n", subrec->subnet_name ); - } - } + nstring name; + pull_ascii_nstring(name, nmbname->name); + + /* If the given ip is not ours, then we can't become a domain + controler as the name is already registered. + */ + + /* BUG note. Samba 1.9.16p11 servers seem to return the broadcast + address or zero ip for this query. Pretend this is ok. */ + + if(ismyip(ip) || ip_equal(allones_ip, ip) || is_zero_ip(ip)) { + if( DEBUGLVL( 3 ) ) { + dbgtext( "become_domain_master_query_success():\n" ); + dbgtext( "Our address (%s) ", inet_ntoa(ip) ); + dbgtext( "returned in query for name %s ", nmb_namestr(nmbname) ); + dbgtext( "(domain master browser name) " ); + dbgtext( "on subnet %s.\n", subrec->subnet_name ); + dbgtext( "Continuing with domain master code.\n" ); + } + + become_domain_master_stage1(subrec, name); + } else { + if( DEBUGLVL( 0 ) ) { + dbgtext( "become_domain_master_query_success:\n" ); + dbgtext( "There is already a domain master browser at " ); + dbgtext( "IP %s for workgroup %s ", inet_ntoa(ip), name ); + dbgtext( "registered on subnet %s.\n", subrec->subnet_name ); + } + } } /**************************************************************************** @@ -245,18 +241,21 @@ static void become_domain_master_query_fail(struct subnet_record *subrec, struct response_record *rrec, struct nmb_name *question_name, int fail_code) { - /* If the query was unicast, and the error is not NAM_ERR (name didn't exist), - then this is a failure. Otherwise, not finding the name is what we want. */ - if((subrec == unicast_subnet) && (fail_code != NAM_ERR)) - { - DEBUG(0,("become_domain_master_query_fail: Error %d returned when \ + nstring name; + + /* If the query was unicast, and the error is not NAM_ERR (name didn't exist), + then this is a failure. Otherwise, not finding the name is what we want. */ + + if((subrec == unicast_subnet) && (fail_code != NAM_ERR)) { + DEBUG(0,("become_domain_master_query_fail: Error %d returned when \ querying WINS server for name %s.\n", - fail_code, nmb_namestr(question_name))); - return; - } + fail_code, nmb_namestr(question_name))); + return; + } - /* Otherwise - not having the name allows us to register it. */ - become_domain_master_stage1(subrec, question_name->name); + /* Otherwise - not having the name allows us to register it. */ + pull_ascii_nstring(name, question_name->name); + become_domain_master_stage1(subrec, name); } /**************************************************************************** @@ -265,47 +264,43 @@ querying WINS server for name %s.\n", static void become_domain_master_browser_bcast(const char *workgroup_name) { - struct subnet_record *subrec; - - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - struct work_record *work = find_workgroup_on_subnet(subrec, workgroup_name); - - if (work && (work->dom_state == DOMAIN_NONE)) - { - struct nmb_name nmbname; - make_nmb_name(&nmbname,workgroup_name,0x1b); - - /* - * Check for our name on the given broadcast subnet first, only initiate - * further processing if we cannot find it. - */ - - if (find_name_on_subnet(subrec, &nmbname, FIND_SELF_NAME) == NULL) - { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "become_domain_master_browser_bcast:\n" ); - dbgtext( "Attempting to become domain master browser on " ); - dbgtext( "workgroup %s on subnet %s\n", - workgroup_name, subrec->subnet_name ); - } - - /* Send out a query to establish whether there's a - domain controller on the local subnet. If not, - we can become a domain controller. - */ - - DEBUG(0,("become_domain_master_browser_bcast: querying subnet %s \ + struct subnet_record *subrec; + + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + struct work_record *work = find_workgroup_on_subnet(subrec, workgroup_name); + + if (work && (work->dom_state == DOMAIN_NONE)) { + struct nmb_name nmbname; + make_nmb_name(&nmbname,workgroup_name,0x1b); + + /* + * Check for our name on the given broadcast subnet first, only initiate + * further processing if we cannot find it. + */ + + if (find_name_on_subnet(subrec, &nmbname, FIND_SELF_NAME) == NULL) { + if( DEBUGLVL( 0 ) ) { + dbgtext( "become_domain_master_browser_bcast:\n" ); + dbgtext( "Attempting to become domain master browser on " ); + dbgtext( "workgroup %s on subnet %s\n", + workgroup_name, subrec->subnet_name ); + } + + /* Send out a query to establish whether there's a + domain controller on the local subnet. If not, + we can become a domain controller. + */ + + DEBUG(0,("become_domain_master_browser_bcast: querying subnet %s \ for domain master browser on workgroup %s\n", subrec->subnet_name, workgroup_name)); - query_name(subrec, nmbname.name, nmbname.name_type, - become_domain_master_query_success, - become_domain_master_query_fail, - NULL); - } - } - } + query_name(subrec, workgroup_name, nmbname.name_type, + become_domain_master_query_success, + become_domain_master_query_fail, + NULL); + } + } + } } /**************************************************************************** @@ -314,46 +309,43 @@ for domain master browser on workgroup %s\n", subrec->subnet_name, workgroup_nam static void become_domain_master_browser_wins(const char *workgroup_name) { - struct work_record *work; + struct work_record *work; - work = find_workgroup_on_subnet(unicast_subnet, workgroup_name); + work = find_workgroup_on_subnet(unicast_subnet, workgroup_name); - if (work && (work->dom_state == DOMAIN_NONE)) - { - struct nmb_name nmbname; + if (work && (work->dom_state == DOMAIN_NONE)) { + struct nmb_name nmbname; - make_nmb_name(&nmbname,workgroup_name,0x1b); + make_nmb_name(&nmbname,workgroup_name,0x1b); - /* - * Check for our name on the unicast subnet first, only initiate - * further processing if we cannot find it. - */ + /* + * Check for our name on the unicast subnet first, only initiate + * further processing if we cannot find it. + */ - if (find_name_on_subnet(unicast_subnet, &nmbname, FIND_SELF_NAME) == NULL) - { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "become_domain_master_browser_wins:\n" ); - dbgtext( "Attempting to become domain master browser " ); - dbgtext( "on workgroup %s, subnet %s.\n", - workgroup_name, unicast_subnet->subnet_name ); - } + if (find_name_on_subnet(unicast_subnet, &nmbname, FIND_SELF_NAME) == NULL) { + if( DEBUGLVL( 0 ) ) { + dbgtext( "become_domain_master_browser_wins:\n" ); + dbgtext( "Attempting to become domain master browser " ); + dbgtext( "on workgroup %s, subnet %s.\n", + workgroup_name, unicast_subnet->subnet_name ); + } - /* Send out a query to establish whether there's a - domain master broswer registered with WINS. If not, - we can become a domain master browser. - */ + /* Send out a query to establish whether there's a + domain master broswer registered with WINS. If not, + we can become a domain master browser. + */ - DEBUG(0,("become_domain_master_browser_wins: querying WINS server from IP %s \ + DEBUG(0,("become_domain_master_browser_wins: querying WINS server from IP %s \ for domain master browser name %s on workgroup %s\n", - inet_ntoa(unicast_subnet->myip), nmb_namestr(&nmbname), workgroup_name)); - - query_name(unicast_subnet, nmbname.name, nmbname.name_type, - become_domain_master_query_success, - become_domain_master_query_fail, - NULL); - } - } + inet_ntoa(unicast_subnet->myip), nmb_namestr(&nmbname), workgroup_name)); + + query_name(unicast_subnet, workgroup_name, nmbname.name_type, + become_domain_master_query_success, + become_domain_master_query_fail, + NULL); + } + } } /**************************************************************************** @@ -363,34 +355,32 @@ for domain master browser name %s on workgroup %s\n", void add_domain_names(time_t t) { - static time_t lastrun = 0; - - if ((lastrun != 0) && (t < lastrun + (CHECK_TIME_ADD_DOM_NAMES * 60))) - return; - - lastrun = t; - - /* Do the "internet group" - <1c> names. */ - if (lp_domain_logons()) - add_logon_names(); - - /* Do the domain master names. */ - if(lp_domain_master()) - { - if(we_are_a_wins_client()) - { - /* We register the WORKGROUP<1b> name with the WINS - server first, and call add_domain_master_bcast() - only if this is successful. - - This results in domain logon services being gracefully provided, - as opposed to the aggressive nature of 1.9.16p2 to 1.9.16p11. - 1.9.16p2 to 1.9.16p11 - due to a bug in namelogon.c, - cannot provide domain master / domain logon services. - */ - become_domain_master_browser_wins(lp_workgroup()); - } - else - become_domain_master_browser_bcast(lp_workgroup()); - } + static time_t lastrun = 0; + + if ((lastrun != 0) && (t < lastrun + (CHECK_TIME_ADD_DOM_NAMES * 60))) + return; + + lastrun = t; + + /* Do the "internet group" - <1c> names. */ + if (lp_domain_logons()) + add_logon_names(); + + /* Do the domain master names. */ + if(lp_domain_master()) { + if(we_are_a_wins_client()) { + /* We register the WORKGROUP<1b> name with the WINS + server first, and call add_domain_master_bcast() + only if this is successful. + + This results in domain logon services being gracefully provided, + as opposed to the aggressive nature of 1.9.16p2 to 1.9.16p11. + 1.9.16p2 to 1.9.16p11 - due to a bug in namelogon.c, + cannot provide domain master / domain logon services. + */ + become_domain_master_browser_wins(lp_workgroup()); + } else { + become_domain_master_browser_bcast(lp_workgroup()); + } + } } diff --git a/source3/nmbd/nmbd_become_lmb.c b/source3/nmbd/nmbd_become_lmb.c index d390bf72e9..2370c7ba36 100644 --- a/source3/nmbd/nmbd_become_lmb.c +++ b/source3/nmbd/nmbd_become_lmb.c @@ -3,7 +3,7 @@ NBT netbios routines and daemon - version 2 Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -33,21 +33,20 @@ extern uint16 samba_nb_type; /* Samba's NetBIOS name type. */ void insert_permanent_name_into_unicast( struct subnet_record *subrec, struct nmb_name *nmbname, uint16 nb_type ) { - struct name_record *namerec; - - if((namerec = find_name_on_subnet(unicast_subnet, nmbname, FIND_SELF_NAME)) == NULL) - { - /* The name needs to be created on the unicast subnet. */ - (void)add_name_to_subnet( unicast_subnet, nmbname->name, - nmbname->name_type, nb_type, - PERMANENT_TTL, PERMANENT_NAME, 1, &subrec->myip); - } - else - { - /* The name already exists on the unicast subnet. Add our local - IP for the given broadcast subnet to the name. */ - add_ip_to_name_record( namerec, subrec->myip); - } + nstring name; + struct name_record *namerec; + + if((namerec = find_name_on_subnet(unicast_subnet, nmbname, FIND_SELF_NAME)) == NULL) { + pull_ascii_nstring(name, nmbname->name); + /* The name needs to be created on the unicast subnet. */ + (void)add_name_to_subnet( unicast_subnet, name, + nmbname->name_type, nb_type, + PERMANENT_TTL, PERMANENT_NAME, 1, &subrec->myip); + } else { + /* The name already exists on the unicast subnet. Add our local + IP for the given broadcast subnet to the name. */ + add_ip_to_name_record( namerec, subrec->myip); + } } /******************************************************************* @@ -57,15 +56,14 @@ void insert_permanent_name_into_unicast( struct subnet_record *subrec, static void remove_permanent_name_from_unicast( struct subnet_record *subrec, struct nmb_name *nmbname ) { - struct name_record *namerec; - - if((namerec = find_name_on_subnet(unicast_subnet, nmbname, FIND_SELF_NAME)) != NULL) - { - /* Remove this broadcast subnet IP address from the name. */ - remove_ip_from_name_record( namerec, subrec->myip); - if(namerec->data.num_ips == 0) - remove_name_from_namelist( unicast_subnet, namerec); - } + struct name_record *namerec; + + if((namerec = find_name_on_subnet(unicast_subnet, nmbname, FIND_SELF_NAME)) != NULL) { + /* Remove this broadcast subnet IP address from the name. */ + remove_ip_from_name_record( namerec, subrec->myip); + if(namerec->data.num_ips == 0) + remove_name_from_namelist( unicast_subnet, namerec); + } } /******************************************************************* @@ -73,60 +71,58 @@ static void remove_permanent_name_from_unicast( struct subnet_record *subrec, state back to potential browser, or none. ******************************************************************/ -static void reset_workgroup_state( struct subnet_record *subrec, char *workgroup_name, +static void reset_workgroup_state( struct subnet_record *subrec, const char *workgroup_name, BOOL force_new_election ) { - struct work_record *work; - struct server_record *servrec; - struct nmb_name nmbname; + struct work_record *work; + struct server_record *servrec; + struct nmb_name nmbname; - if((work = find_workgroup_on_subnet( subrec, workgroup_name)) == NULL) - { - DEBUG(0,("reset_workgroup_state: Error - cannot find workgroup %s on \ + if((work = find_workgroup_on_subnet( subrec, workgroup_name)) == NULL) { + DEBUG(0,("reset_workgroup_state: Error - cannot find workgroup %s on \ subnet %s.\n", workgroup_name, subrec->subnet_name )); - return; - } + return; + } - if((servrec = find_server_in_workgroup( work, global_myname())) == NULL) - { - DEBUG(0,("reset_workgroup_state: Error - cannot find server %s \ + if((servrec = find_server_in_workgroup( work, global_myname())) == NULL) { + DEBUG(0,("reset_workgroup_state: Error - cannot find server %s \ in workgroup %s on subnet %s\n", - global_myname(), work->work_group, subrec->subnet_name)); - work->mst_state = lp_local_master() ? MST_POTENTIAL : MST_NONE; - return; - } + global_myname(), work->work_group, subrec->subnet_name)); + work->mst_state = lp_local_master() ? MST_POTENTIAL : MST_NONE; + return; + } - /* Update our server status - remove any master flag and replace - it with the potential browser flag. */ - servrec->serv.type &= ~SV_TYPE_MASTER_BROWSER; - servrec->serv.type |= (lp_local_master() ? SV_TYPE_POTENTIAL_BROWSER : 0); + /* Update our server status - remove any master flag and replace + it with the potential browser flag. */ + servrec->serv.type &= ~SV_TYPE_MASTER_BROWSER; + servrec->serv.type |= (lp_local_master() ? SV_TYPE_POTENTIAL_BROWSER : 0); - /* Tell the namelist writer to write out a change. */ - subrec->work_changed = True; + /* Tell the namelist writer to write out a change. */ + subrec->work_changed = True; - /* Reset our election flags. */ - work->ElectionCriterion &= ~0x4; + /* Reset our election flags. */ + work->ElectionCriterion &= ~0x4; - work->mst_state = lp_local_master() ? MST_POTENTIAL : MST_NONE; + work->mst_state = lp_local_master() ? MST_POTENTIAL : MST_NONE; - /* Forget who the local master browser was for - this workgroup. */ + /* Forget who the local master browser was for + this workgroup. */ - set_workgroup_local_master_browser_name( work, ""); + set_workgroup_local_master_browser_name( work, ""); - /* - * Ensure the IP address of this subnet is not registered as one - * of the IP addresses of the WORKGROUP<1d> name on the unicast - * subnet. This undoes what we did below when we became a local - * master browser. - */ + /* + * Ensure the IP address of this subnet is not registered as one + * of the IP addresses of the WORKGROUP<1d> name on the unicast + * subnet. This undoes what we did below when we became a local + * master browser. + */ - make_nmb_name(&nmbname, work->work_group, 0x1d); + make_nmb_name(&nmbname, work->work_group, 0x1d); - remove_permanent_name_from_unicast( subrec, &nmbname); + remove_permanent_name_from_unicast( subrec, &nmbname); - if(force_new_election) - work->needelection = True; + if(force_new_election) + work->needelection = True; } /******************************************************************* @@ -138,24 +134,25 @@ static void unbecome_local_master_success(struct subnet_record *subrec, struct nmb_name *released_name, struct in_addr released_ip) { - BOOL force_new_election = False; + BOOL force_new_election = False; + nstring relname; - memcpy((char *)&force_new_election, userdata->data, sizeof(BOOL)); + memcpy((char *)&force_new_election, userdata->data, sizeof(BOOL)); - DEBUG(3,("unbecome_local_master_success: released name %s.\n", - nmb_namestr(released_name))); + DEBUG(3,("unbecome_local_master_success: released name %s.\n", + nmb_namestr(released_name))); - /* Now reset the workgroup and server state. */ - reset_workgroup_state( subrec, released_name->name, force_new_election ); + /* Now reset the workgroup and server state. */ + pull_ascii_nstring(relname, released_name->name); + reset_workgroup_state( subrec, relname, force_new_election ); - if( DEBUGLVL( 0 ) ) - { - dbgtext( "*****\n\n" ); - dbgtext( "Samba name server %s ", global_myname() ); - dbgtext( "has stopped being a local master browser " ); - dbgtext( "for workgroup %s ", released_name->name ); - dbgtext( "on subnet %s\n\n*****\n", subrec->subnet_name ); - } + if( DEBUGLVL( 0 ) ) { + dbgtext( "*****\n\n" ); + dbgtext( "Samba name server %s ", global_myname() ); + dbgtext( "has stopped being a local master browser " ); + dbgtext( "for workgroup %s ", relname ); + dbgtext( "on subnet %s\n\n*****\n", subrec->subnet_name ); + } } @@ -166,67 +163,66 @@ static void unbecome_local_master_success(struct subnet_record *subrec, static void unbecome_local_master_fail(struct subnet_record *subrec, struct response_record *rrec, struct nmb_name *fail_name) { - struct name_record *namerec; - struct userdata_struct *userdata = rrec->userdata; - BOOL force_new_election = False; + struct name_record *namerec; + struct userdata_struct *userdata = rrec->userdata; + BOOL force_new_election = False; + nstring failname; - memcpy((char *)&force_new_election, userdata->data, sizeof(BOOL)); + memcpy((char *)&force_new_election, userdata->data, sizeof(BOOL)); - DEBUG(0,("unbecome_local_master_fail: failed to release name %s. \ + DEBUG(0,("unbecome_local_master_fail: failed to release name %s. \ Removing from namelist anyway.\n", nmb_namestr(fail_name))); - /* Do it anyway. */ - namerec = find_name_on_subnet(subrec, fail_name, FIND_SELF_NAME); - if(namerec) - remove_name_from_namelist(subrec, namerec); - - /* Now reset the workgroup and server state. */ - reset_workgroup_state( subrec, fail_name->name, force_new_election ); - - if( DEBUGLVL( 0 ) ) - { - dbgtext( "*****\n\n" ); - dbgtext( "Samba name server %s ", global_myname() ); - dbgtext( "has stopped being a local master browser " ); - dbgtext( "for workgroup %s ", fail_name->name ); - dbgtext( "on subnet %s\n\n*****\n", subrec->subnet_name ); - } + /* Do it anyway. */ + namerec = find_name_on_subnet(subrec, fail_name, FIND_SELF_NAME); + if(namerec) + remove_name_from_namelist(subrec, namerec); + + /* Now reset the workgroup and server state. */ + pull_ascii_nstring(failname, fail_name->name); + reset_workgroup_state( subrec, failname, force_new_election ); + + if( DEBUGLVL( 0 ) ) { + dbgtext( "*****\n\n" ); + dbgtext( "Samba name server %s ", global_myname() ); + dbgtext( "has stopped being a local master browser " ); + dbgtext( "for workgroup %s ", failname ); + dbgtext( "on subnet %s\n\n*****\n", subrec->subnet_name ); + } } /******************************************************************* Utility function to remove the WORKGROUP<1d> name. ******************************************************************/ -static void release_1d_name( struct subnet_record *subrec, char *workgroup_name, +static void release_1d_name( struct subnet_record *subrec, const char *workgroup_name, BOOL force_new_election) { - struct nmb_name nmbname; - struct name_record *namerec; - - make_nmb_name(&nmbname, workgroup_name, 0x1d); - if((namerec = find_name_on_subnet( subrec, &nmbname, FIND_SELF_NAME))!=NULL) - { - struct userdata_struct *userdata; - size_t size = sizeof(struct userdata_struct) + sizeof(BOOL); - - if((userdata = (struct userdata_struct *)malloc(size)) == NULL) - { - DEBUG(0,("release_1d_name: malloc fail.\n")); - return; - } - - userdata->copy_fn = NULL; - userdata->free_fn = NULL; - userdata->userdata_len = sizeof(BOOL); - memcpy((char *)userdata->data, &force_new_election, sizeof(BOOL)); - - release_name(subrec, namerec, - unbecome_local_master_success, - unbecome_local_master_fail, - userdata); - - zero_free(userdata, size); - } + struct nmb_name nmbname; + struct name_record *namerec; + + make_nmb_name(&nmbname, workgroup_name, 0x1d); + if((namerec = find_name_on_subnet( subrec, &nmbname, FIND_SELF_NAME))!=NULL) { + struct userdata_struct *userdata; + size_t size = sizeof(struct userdata_struct) + sizeof(BOOL); + + if((userdata = (struct userdata_struct *)malloc(size)) == NULL) { + DEBUG(0,("release_1d_name: malloc fail.\n")); + return; + } + + userdata->copy_fn = NULL; + userdata->free_fn = NULL; + userdata->userdata_len = sizeof(BOOL); + memcpy((char *)userdata->data, &force_new_election, sizeof(BOOL)); + + release_name(subrec, namerec, + unbecome_local_master_success, + unbecome_local_master_fail, + userdata); + + zero_free(userdata, size); + } } /******************************************************************* @@ -238,11 +234,11 @@ static void release_msbrowse_name_success(struct subnet_record *subrec, struct nmb_name *released_name, struct in_addr released_ip) { - DEBUG(4,("release_msbrowse_name_success: Released name %s on subnet %s\n.", - nmb_namestr(released_name), subrec->subnet_name )); + DEBUG(4,("release_msbrowse_name_success: Released name %s on subnet %s\n.", + nmb_namestr(released_name), subrec->subnet_name )); - /* Remove the permanent MSBROWSE name added into the unicast subnet. */ - remove_permanent_name_from_unicast( subrec, released_name); + /* Remove the permanent MSBROWSE name added into the unicast subnet. */ + remove_permanent_name_from_unicast( subrec, released_name); } /******************************************************************* @@ -253,18 +249,18 @@ static void release_msbrowse_name_fail( struct subnet_record *subrec, struct response_record *rrec, struct nmb_name *fail_name) { - struct name_record *namerec; + struct name_record *namerec; - DEBUG(4,("release_msbrowse_name_fail: Failed to release name %s on subnet %s\n.", - nmb_namestr(fail_name), subrec->subnet_name )); + DEBUG(4,("release_msbrowse_name_fail: Failed to release name %s on subnet %s\n.", + nmb_namestr(fail_name), subrec->subnet_name )); - /* Release the name anyway. */ - namerec = find_name_on_subnet(subrec, fail_name, FIND_SELF_NAME); - if(namerec) - remove_name_from_namelist(subrec, namerec); + /* Release the name anyway. */ + namerec = find_name_on_subnet(subrec, fail_name, FIND_SELF_NAME); + if(namerec) + remove_name_from_namelist(subrec, namerec); - /* Remove the permanent MSBROWSE name added into the unicast subnet. */ - remove_permanent_name_from_unicast( subrec, fail_name); + /* Remove the permanent MSBROWSE name added into the unicast subnet. */ + remove_permanent_name_from_unicast( subrec, fail_name); } /******************************************************************* @@ -275,50 +271,48 @@ static void release_msbrowse_name_fail( struct subnet_record *subrec, void unbecome_local_master_browser(struct subnet_record *subrec, struct work_record *work, BOOL force_new_election) { - struct name_record *namerec; - struct nmb_name nmbname; + struct name_record *namerec; + struct nmb_name nmbname; /* Sanity check. */ - DEBUG(2,("unbecome_local_master_browser: unbecoming local master for workgroup %s \ + DEBUG(2,("unbecome_local_master_browser: unbecoming local master for workgroup %s \ on subnet %s\n",work->work_group, subrec->subnet_name)); - if(find_server_in_workgroup( work, global_myname()) == NULL) - { - DEBUG(0,("unbecome_local_master_browser: Error - cannot find server %s \ + if(find_server_in_workgroup( work, global_myname()) == NULL) { + DEBUG(0,("unbecome_local_master_browser: Error - cannot find server %s \ in workgroup %s on subnet %s\n", - global_myname(), work->work_group, subrec->subnet_name)); - work->mst_state = lp_local_master() ? MST_POTENTIAL : MST_NONE; - return; - } + global_myname(), work->work_group, subrec->subnet_name)); + work->mst_state = lp_local_master() ? MST_POTENTIAL : MST_NONE; + return; + } - /* Set the state to unbecoming. */ - work->mst_state = MST_UNBECOMING_MASTER; - - /* - * Release the WORKGROUP<1d> name asap to allow another machine to - * claim it. - */ - - release_1d_name( subrec, work->work_group, force_new_election); - - /* Deregister any browser names we may have. */ - make_nmb_name(&nmbname, MSBROWSE, 0x1); - if((namerec = find_name_on_subnet( subrec, &nmbname, FIND_SELF_NAME))!=NULL) - { - release_name(subrec, namerec, - release_msbrowse_name_success, - release_msbrowse_name_fail, - NULL); - } - - /* - * Ensure we have sent and processed these release packets - * before returning - we don't want to process any election - * packets before dealing with the 1d release. - */ - - retransmit_or_expire_response_records(time(NULL)); + /* Set the state to unbecoming. */ + work->mst_state = MST_UNBECOMING_MASTER; + + /* + * Release the WORKGROUP<1d> name asap to allow another machine to + * claim it. + */ + + release_1d_name( subrec, work->work_group, force_new_election); + + /* Deregister any browser names we may have. */ + make_nmb_name(&nmbname, MSBROWSE, 0x1); + if((namerec = find_name_on_subnet( subrec, &nmbname, FIND_SELF_NAME))!=NULL) { + release_name(subrec, namerec, + release_msbrowse_name_success, + release_msbrowse_name_fail, + NULL); + } + + /* + * Ensure we have sent and processed these release packets + * before returning - we don't want to process any election + * packets before dealing with the 1d release. + */ + + retransmit_or_expire_response_records(time(NULL)); } /**************************************************************************** @@ -332,104 +326,107 @@ static void become_local_master_stage2(struct subnet_record *subrec, uint16 nb_flags, int ttl, struct in_addr registered_ip) { - int i = 0; - struct server_record *sl; - struct work_record *work = find_workgroup_on_subnet( subrec, registered_name->name); - struct server_record *servrec; - - if(!work) - { - DEBUG(0,("become_local_master_stage2: Error - cannot find \ -workgroup %s on subnet %s\n", registered_name->name, subrec->subnet_name)); - return; - } - - if((servrec = find_server_in_workgroup( work, global_myname())) == NULL) - { - DEBUG(0,("become_local_master_stage2: Error - cannot find server %s \ + int i = 0; + struct server_record *sl; + struct work_record *work; + struct server_record *servrec; + nstring regname; + + pull_ascii_nstring(regname, registered_name->name); + work = find_workgroup_on_subnet( subrec, regname); + + if(!work) { + DEBUG(0,("become_local_master_stage2: Error - cannot find \ +workgroup %s on subnet %s\n", regname, subrec->subnet_name)); + return; + } + + if((servrec = find_server_in_workgroup( work, global_myname())) == NULL) { + DEBUG(0,("become_local_master_stage2: Error - cannot find server %s \ in workgroup %s on subnet %s\n", - global_myname(), registered_name->name, subrec->subnet_name)); - work->mst_state = lp_local_master() ? MST_POTENTIAL : MST_NONE; - return; - } + global_myname(), regname, subrec->subnet_name)); + work->mst_state = lp_local_master() ? MST_POTENTIAL : MST_NONE; + return; + } - DEBUG(3,("become_local_master_stage2: registered as master browser for workgroup %s \ + DEBUG(3,("become_local_master_stage2: registered as master browser for workgroup %s \ on subnet %s\n", work->work_group, subrec->subnet_name)); - work->mst_state = MST_BROWSER; /* registering WORKGROUP(1d) succeeded */ - - /* update our server status */ - servrec->serv.type |= SV_TYPE_MASTER_BROWSER; - servrec->serv.type &= ~SV_TYPE_POTENTIAL_BROWSER; - - /* Tell the namelist writer to write out a change. */ - subrec->work_changed = True; - - /* Add this name to the workgroup as local master browser. */ - set_workgroup_local_master_browser_name( work, global_myname()); - - /* Count the number of servers we have on our list. If it's - less than 10 (just a heuristic) request the servers - to announce themselves. - */ - for( sl = work->serverlist; sl != NULL; sl = sl->next) - i++; - - if (i < 10) - { - /* Ask all servers on our local net to announce to us. */ - broadcast_announce_request(subrec, work); - } - - /* - * Now we are a local master on a broadcast subnet, we need to add - * the WORKGROUP<1d> name to the unicast subnet so that we can answer - * unicast requests sent to this name. We can create this name directly on - * the unicast subnet as a WINS server always returns true when registering - * this name, and discards the registration. We use the number of IP - * addresses registered to this name as a reference count, as we - * remove this broadcast subnet IP address from it when we stop becoming a local - * master browser for this broadcast subnet. - */ - - insert_permanent_name_into_unicast( subrec, registered_name, nb_flags); - - /* Reset the announce master browser timer so that we try and tell a domain - master browser as soon as possible that we are a local master browser. */ - reset_announce_timer(); - - if( DEBUGLVL( 0 ) ) - { - dbgtext( "*****\n\n" ); - dbgtext( "Samba name server %s ", global_myname() ); - dbgtext( "is now a local master browser " ); - dbgtext( "for workgroup %s ", work->work_group ); - dbgtext( "on subnet %s\n\n*****\n", subrec->subnet_name ); - } - + work->mst_state = MST_BROWSER; /* registering WORKGROUP(1d) succeeded */ + + /* update our server status */ + servrec->serv.type |= SV_TYPE_MASTER_BROWSER; + servrec->serv.type &= ~SV_TYPE_POTENTIAL_BROWSER; + + /* Tell the namelist writer to write out a change. */ + subrec->work_changed = True; + + /* Add this name to the workgroup as local master browser. */ + set_workgroup_local_master_browser_name( work, global_myname()); + + /* Count the number of servers we have on our list. If it's + less than 10 (just a heuristic) request the servers + to announce themselves. + */ + for( sl = work->serverlist; sl != NULL; sl = sl->next) + i++; + + if (i < 10) { + /* Ask all servers on our local net to announce to us. */ + broadcast_announce_request(subrec, work); + } + + /* + * Now we are a local master on a broadcast subnet, we need to add + * the WORKGROUP<1d> name to the unicast subnet so that we can answer + * unicast requests sent to this name. We can create this name directly on + * the unicast subnet as a WINS server always returns true when registering + * this name, and discards the registration. We use the number of IP + * addresses registered to this name as a reference count, as we + * remove this broadcast subnet IP address from it when we stop becoming a local + * master browser for this broadcast subnet. + */ + + insert_permanent_name_into_unicast( subrec, registered_name, nb_flags); + + /* Reset the announce master browser timer so that we try and tell a domain + master browser as soon as possible that we are a local master browser. */ + reset_announce_timer(); + + if( DEBUGLVL( 0 ) ) { + dbgtext( "*****\n\n" ); + dbgtext( "Samba name server %s ", global_myname() ); + dbgtext( "is now a local master browser " ); + dbgtext( "for workgroup %s ", work->work_group ); + dbgtext( "on subnet %s\n\n*****\n", subrec->subnet_name ); + } } /**************************************************************************** Failed to register the WORKGROUP<1d> name. ****************************************************************************/ + static void become_local_master_fail2(struct subnet_record *subrec, struct response_record *rrec, struct nmb_name *fail_name) { - struct work_record *work = find_workgroup_on_subnet( subrec, fail_name->name); + nstring failname; + struct work_record *work; - DEBUG(0,("become_local_master_fail2: failed to register name %s on subnet %s. \ + DEBUG(0,("become_local_master_fail2: failed to register name %s on subnet %s. \ Failed to become a local master browser.\n", nmb_namestr(fail_name), subrec->subnet_name)); - if(!work) - { - DEBUG(0,("become_local_master_fail2: Error - cannot find \ -workgroup %s on subnet %s\n", fail_name->name, subrec->subnet_name)); - return; - } + pull_ascii_nstring(failname, fail_name->name); + work = find_workgroup_on_subnet( subrec, failname); - /* Roll back all the way by calling unbecome_local_master_browser(). */ - unbecome_local_master_browser(subrec, work, False); + if(!work) { + DEBUG(0,("become_local_master_fail2: Error - cannot find \ +workgroup %s on subnet %s\n", failname, subrec->subnet_name)); + return; + } + + /* Roll back all the way by calling unbecome_local_master_browser(). */ + unbecome_local_master_browser(subrec, work, False); } /**************************************************************************** @@ -442,35 +439,34 @@ static void become_local_master_stage1(struct subnet_record *subrec, uint16 nb_flags, int ttl, struct in_addr registered_ip) { - char *work_name = userdata->data; - struct work_record *work = find_workgroup_on_subnet( subrec, work_name); - - if(!work) - { - DEBUG(0,("become_local_master_stage1: Error - cannot find \ -workgroup %s on subnet %s\n", work_name, subrec->subnet_name)); - return; - } - - DEBUG(3,("become_local_master_stage1: go to stage 2: register the %s<1d> name.\n", - work->work_group)); - - work->mst_state = MST_MSB; /* Registering MSBROWSE was successful. */ - - /* - * We registered the MSBROWSE name on a broadcast subnet, now need to add - * the MSBROWSE name to the unicast subnet so that we can answer - * unicast requests sent to this name. We create this name directly on - * the unicast subnet. - */ - - insert_permanent_name_into_unicast( subrec, registered_name, nb_flags); - - /* Attempt to register the WORKGROUP<1d> name. */ - register_name(subrec, work->work_group,0x1d,samba_nb_type, - become_local_master_stage2, - become_local_master_fail2, - NULL); + char *work_name = userdata->data; + struct work_record *work = find_workgroup_on_subnet( subrec, work_name); + + if(!work) { + DEBUG(0,("become_local_master_stage1: Error - cannot find \ + %s on subnet %s\n", work_name, subrec->subnet_name)); + return; + } + + DEBUG(3,("become_local_master_stage1: go to stage 2: register the %s<1d> name.\n", + work->work_group)); + + work->mst_state = MST_MSB; /* Registering MSBROWSE was successful. */ + + /* + * We registered the MSBROWSE name on a broadcast subnet, now need to add + * the MSBROWSE name to the unicast subnet so that we can answer + * unicast requests sent to this name. We create this name directly on + * the unicast subnet. + */ + + insert_permanent_name_into_unicast( subrec, registered_name, nb_flags); + + /* Attempt to register the WORKGROUP<1d> name. */ + register_name(subrec, work->work_group,0x1d,samba_nb_type, + become_local_master_stage2, + become_local_master_fail2, + NULL); } /**************************************************************************** @@ -481,29 +477,27 @@ static void become_local_master_fail1(struct subnet_record *subrec, struct response_record *rrec, struct nmb_name *fail_name) { - char *work_name = rrec->userdata->data; - struct work_record *work = find_workgroup_on_subnet(subrec, work_name); + char *work_name = rrec->userdata->data; + struct work_record *work = find_workgroup_on_subnet(subrec, work_name); - if(!work) - { - DEBUG(0,("become_local_master_fail1: Error - cannot find \ + if(!work) { + DEBUG(0,("become_local_master_fail1: Error - cannot find \ workgroup %s on subnet %s\n", work_name, subrec->subnet_name)); - return; - } + return; + } - if(find_server_in_workgroup(work, global_myname()) == NULL) - { - DEBUG(0,("become_local_master_fail1: Error - cannot find server %s \ + if(find_server_in_workgroup(work, global_myname()) == NULL) { + DEBUG(0,("become_local_master_fail1: Error - cannot find server %s \ in workgroup %s on subnet %s\n", - global_myname(), work->work_group, subrec->subnet_name)); - return; - } + global_myname(), work->work_group, subrec->subnet_name)); + return; + } - reset_workgroup_state( subrec, work->work_group, False ); + reset_workgroup_state( subrec, work->work_group, False ); - DEBUG(0,("become_local_master_fail1: Failed to become a local master browser for \ + DEBUG(0,("become_local_master_fail1: Failed to become a local master browser for \ workgroup %s on subnet %s. Couldn't register name %s.\n", - work->work_group, subrec->subnet_name, nmb_namestr(fail_name))); + work->work_group, subrec->subnet_name, nmb_namestr(fail_name))); } /****************************************************************** @@ -517,61 +511,57 @@ workgroup %s on subnet %s. Couldn't register name %s.\n", void become_local_master_browser(struct subnet_record *subrec, struct work_record *work) { - struct userdata_struct *userdata; - size_t size = sizeof(struct userdata_struct) + sizeof(fstring) + 1; - - /* Sanity check. */ - if (!lp_local_master()) - { - DEBUG(0,("become_local_master_browser: Samba not configured as a local master browser.\n")); - return; - } - - if(!AM_POTENTIAL_MASTER_BROWSER(work)) - { - DEBUG(2,("become_local_master_browser: Awaiting potential browser state. Current state is %d\n", - work->mst_state )); - return; - } - - if(find_server_in_workgroup( work, global_myname()) == NULL) - { - DEBUG(0,("become_local_master_browser: Error - cannot find server %s \ + struct userdata_struct *userdata; + size_t size = sizeof(struct userdata_struct) + sizeof(fstring) + 1; + + /* Sanity check. */ + if (!lp_local_master()) { + DEBUG(0,("become_local_master_browser: Samba not configured as a local master browser.\n")); + return; + } + + if(!AM_POTENTIAL_MASTER_BROWSER(work)) { + DEBUG(2,("become_local_master_browser: Awaiting potential browser state. Current state is %d\n", + work->mst_state )); + return; + } + + if(find_server_in_workgroup( work, global_myname()) == NULL) { + DEBUG(0,("become_local_master_browser: Error - cannot find server %s \ in workgroup %s on subnet %s\n", - global_myname(), work->work_group, subrec->subnet_name)); - return; - } + global_myname(), work->work_group, subrec->subnet_name)); + return; + } - DEBUG(2,("become_local_master_browser: Starting to become a master browser for workgroup \ + DEBUG(2,("become_local_master_browser: Starting to become a master browser for workgroup \ %s on subnet %s\n", work->work_group, subrec->subnet_name)); - DEBUG(3,("become_local_master_browser: first stage - attempt to register ^1^2__MSBROWSE__^2^1\n")); - work->mst_state = MST_BACKUP; /* an election win was successful */ + DEBUG(3,("become_local_master_browser: first stage - attempt to register ^1^2__MSBROWSE__^2^1\n")); + work->mst_state = MST_BACKUP; /* an election win was successful */ - work->ElectionCriterion |= 0x5; + work->ElectionCriterion |= 0x5; - /* Tell the namelist writer to write out a change. */ - subrec->work_changed = True; + /* Tell the namelist writer to write out a change. */ + subrec->work_changed = True; - /* Setup the userdata_struct. */ - if((userdata = (struct userdata_struct *)malloc(size)) == NULL) - { - DEBUG(0,("become_local_master_browser: malloc fail.\n")); - return; - } + /* Setup the userdata_struct. */ + if((userdata = (struct userdata_struct *)malloc(size)) == NULL) { + DEBUG(0,("become_local_master_browser: malloc fail.\n")); + return; + } - userdata->copy_fn = NULL; - userdata->free_fn = NULL; - userdata->userdata_len = strlen(work->work_group)+1; - overmalloc_safe_strcpy(userdata->data, work->work_group, size - sizeof(*userdata) - 1); + userdata->copy_fn = NULL; + userdata->free_fn = NULL; + userdata->userdata_len = strlen(work->work_group)+1; + overmalloc_safe_strcpy(userdata->data, work->work_group, size - sizeof(*userdata) - 1); - /* Register the special browser group name. */ - register_name(subrec, MSBROWSE, 0x01, samba_nb_type|NB_GROUP, - become_local_master_stage1, - become_local_master_fail1, - userdata); + /* Register the special browser group name. */ + register_name(subrec, MSBROWSE, 0x01, samba_nb_type|NB_GROUP, + become_local_master_stage1, + become_local_master_fail1, + userdata); - zero_free(userdata, size); + zero_free(userdata, size); } /*************************************************************** @@ -583,7 +573,7 @@ in workgroup %s on subnet %s\n", void set_workgroup_local_master_browser_name( struct work_record *work, const char *newname) { - DEBUG(5,("set_workgroup_local_master_browser_name: setting local master name to '%s' \ + DEBUG(5,("set_workgroup_local_master_browser_name: setting local master name to '%s' \ for workgroup %s.\n", newname, work->work_group )); #if 0 @@ -600,5 +590,5 @@ local_master_browser_name for workgroup %s to workgroup name.\n", } #endif - fstrcpy(work->local_master_browser_name, newname); + nstrcpy(work->local_master_browser_name, newname); } diff --git a/source3/nmbd/nmbd_browserdb.c b/source3/nmbd/nmbd_browserdb.c index 4a302ddfd4..443edf599d 100644 --- a/source3/nmbd/nmbd_browserdb.c +++ b/source3/nmbd/nmbd_browserdb.c @@ -80,8 +80,8 @@ void update_browser_death_time( struct browse_cache_record *browc ) * * ************************************************************************** ** */ -struct browse_cache_record *create_browser_in_lmb_cache( char *work_name, - char *browser_name, +struct browse_cache_record *create_browser_in_lmb_cache( const char *work_name, + const char *browser_name, struct in_addr ip ) { struct browse_cache_record *browc; @@ -106,8 +106,8 @@ struct browse_cache_record *create_browser_in_lmb_cache( char *work_name, /* Allow the new lmb to miss an announce period before we remove it. */ browc->death_time = now + ( (CHECK_TIME_MST_ANNOUNCE + 2) * 60 ); - pstrcpy( browc->lmb_name, browser_name); - pstrcpy( browc->work_group, work_name); + nstrcpy( browc->lmb_name, browser_name); + nstrcpy( browc->work_group, work_name); strupper_m( browc->lmb_name ); strupper_m( browc->work_group ); @@ -134,7 +134,7 @@ struct browse_cache_record *create_browser_in_lmb_cache( char *work_name, * * ************************************************************************** ** */ -struct browse_cache_record *find_browser_in_lmb_cache( char *browser_name ) +struct browse_cache_record *find_browser_in_lmb_cache( const char *browser_name ) { struct browse_cache_record *browc; diff --git a/source3/nmbd/nmbd_browsesync.c b/source3/nmbd/nmbd_browsesync.c index 26d4735744..6cde88651f 100644 --- a/source3/nmbd/nmbd_browsesync.c +++ b/source3/nmbd/nmbd_browsesync.c @@ -3,7 +3,7 @@ NBT netbios routines and daemon - version 2 Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -29,74 +29,70 @@ extern ubi_dlList lmb_browserlist[]; /**************************************************************************** As a domain master browser, do a sync with a local master browser. **************************************************************************/ + static void sync_with_lmb(struct browse_cache_record *browc) { - struct work_record *work; - - if( !(work = find_workgroup_on_subnet(unicast_subnet, browc->work_group)) ) - { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "sync_with_lmb:\n" ); - dbgtext( "Failed to get a workgroup for a local master browser " ); - dbgtext( "cache entry workgroup " ); - dbgtext( "%s, server %s\n", browc->work_group, browc->lmb_name ); - } - return; - } + struct work_record *work; - /* We should only be doing this if we are a domain master browser for - the given workgroup. Ensure this is so. */ - - if(!AM_DOMAIN_MASTER_BROWSER(work)) - { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "sync_with_lmb:\n" ); - dbgtext( "We are trying to sync with a local master browser " ); - dbgtext( "%s for workgroup %s\n", browc->lmb_name, browc->work_group ); - dbgtext( "and we are not a domain master browser on this workgroup.\n" ); - dbgtext( "Error!\n" ); - } - return; - } + if( !(work = find_workgroup_on_subnet(unicast_subnet, browc->work_group)) ) { + if( DEBUGLVL( 0 ) ) { + dbgtext( "sync_with_lmb:\n" ); + dbgtext( "Failed to get a workgroup for a local master browser " ); + dbgtext( "cache entry workgroup " ); + dbgtext( "%s, server %s\n", browc->work_group, browc->lmb_name ); + } + return; + } - if( DEBUGLVL( 2 ) ) - { - dbgtext( "sync_with_lmb:\n" ); - dbgtext( "Initiating sync with local master browser " ); - dbgtext( "%s<0x20> at IP %s ", browc->lmb_name, inet_ntoa(browc->ip) ); - dbgtext( "for workgroup %s\n", browc->work_group ); - } + /* We should only be doing this if we are a domain master browser for + the given workgroup. Ensure this is so. */ - sync_browse_lists(work, browc->lmb_name, 0x20, browc->ip, True, True); + if(!AM_DOMAIN_MASTER_BROWSER(work)) { + if( DEBUGLVL( 0 ) ) { + dbgtext( "sync_with_lmb:\n" ); + dbgtext( "We are trying to sync with a local master browser " ); + dbgtext( "%s for workgroup %s\n", browc->lmb_name, browc->work_group ); + dbgtext( "and we are not a domain master browser on this workgroup.\n" ); + dbgtext( "Error!\n" ); + } + return; + } + + if( DEBUGLVL( 2 ) ) { + dbgtext( "sync_with_lmb:\n" ); + dbgtext( "Initiating sync with local master browser " ); + dbgtext( "%s<0x20> at IP %s ", browc->lmb_name, inet_ntoa(browc->ip) ); + dbgtext( "for workgroup %s\n", browc->work_group ); + } + + sync_browse_lists(work, browc->lmb_name, 0x20, browc->ip, True, True); - browc->sync_time += (CHECK_TIME_DMB_TO_LMB_SYNC * 60); + browc->sync_time += (CHECK_TIME_DMB_TO_LMB_SYNC * 60); } /**************************************************************************** Sync or expire any local master browsers. **************************************************************************/ + void dmb_expire_and_sync_browser_lists(time_t t) { - static time_t last_run = 0; - struct browse_cache_record *browc; + static time_t last_run = 0; + struct browse_cache_record *browc; - /* Only do this every 20 seconds. */ - if (t - last_run < 20) - return; + /* Only do this every 20 seconds. */ + if (t - last_run < 20) + return; - last_run = t; + last_run = t; - expire_lmb_browsers(t); + expire_lmb_browsers(t); - for( browc = (struct browse_cache_record *)ubi_dlFirst( lmb_browserlist ); - browc; - browc = (struct browse_cache_record *)ubi_dlNext( browc ) ) - { - if (browc->sync_time < t) - sync_with_lmb(browc); - } + for( browc = (struct browse_cache_record *)ubi_dlFirst( lmb_browserlist ); + browc; + browc = (struct browse_cache_record *)ubi_dlNext( browc ) ) { + if (browc->sync_time < t) + sync_with_lmb(browc); + } } /**************************************************************************** @@ -105,46 +101,43 @@ As a local master browser, send an announce packet to the domain master browser. static void announce_local_master_browser_to_domain_master_browser( struct work_record *work) { - pstring outbuf; - fstring myname; - char *p; - - if(ismyip(work->dmb_addr)) - { - if( DEBUGLVL( 2 ) ) - { - dbgtext( "announce_local_master_browser_to_domain_master_browser:\n" ); - dbgtext( "We are both a domain and a local master browser for " ); - dbgtext( "workgroup %s. ", work->work_group ); - dbgtext( "Do not announce to ourselves.\n" ); - } - return; - } + pstring outbuf; + fstring myname; + char *p; + + if(ismyip(work->dmb_addr)) { + if( DEBUGLVL( 2 ) ) { + dbgtext( "announce_local_master_browser_to_domain_master_browser:\n" ); + dbgtext( "We are both a domain and a local master browser for " ); + dbgtext( "workgroup %s. ", work->work_group ); + dbgtext( "Do not announce to ourselves.\n" ); + } + return; + } - memset(outbuf,'\0',sizeof(outbuf)); - p = outbuf; - SCVAL(p,0,ANN_MasterAnnouncement); - p++; + memset(outbuf,'\0',sizeof(outbuf)); + p = outbuf; + SCVAL(p,0,ANN_MasterAnnouncement); + p++; - fstrcpy(myname, global_myname()); - strupper_m(myname); - myname[15]='\0'; - push_pstring_base(p, myname, outbuf); + fstrcpy(myname, global_myname()); + strupper_m(myname); + myname[15]='\0'; + /* The call below does CH_UNIX -> CH_DOS conversion. JRA */ + push_pstring_base(p, myname, outbuf); - p = skip_string(p,1); + p = skip_string(p,1); - if( DEBUGLVL( 4 ) ) - { - dbgtext( "announce_local_master_browser_to_domain_master_browser:\n" ); - dbgtext( "Sending local master announce to " ); - dbgtext( "%s for workgroup %s.\n", nmb_namestr(&work->dmb_name), - work->work_group ); - } + if( DEBUGLVL( 4 ) ) { + dbgtext( "announce_local_master_browser_to_domain_master_browser:\n" ); + dbgtext( "Sending local master announce to " ); + dbgtext( "%s for workgroup %s.\n", nmb_namestr(&work->dmb_name), + work->work_group ); + } - send_mailslot(True, BROWSE_MAILSLOT, outbuf,PTR_DIFF(p,outbuf), + send_mailslot(True, BROWSE_MAILSLOT, outbuf,PTR_DIFF(p,outbuf), global_myname(), 0x0, work->dmb_name.name, 0x0, work->dmb_addr, FIRST_SUBNET->myip, DGRAM_PORT); - } /**************************************************************************** @@ -153,17 +146,19 @@ As a local master browser, do a sync with a domain master browser. static void sync_with_dmb(struct work_record *work) { - if( DEBUGLVL( 2 ) ) - { - dbgtext( "sync_with_dmb:\n" ); - dbgtext( "Initiating sync with domain master browser " ); - dbgtext( "%s ", nmb_namestr(&work->dmb_name) ); - dbgtext( "at IP %s ", inet_ntoa(work->dmb_addr) ); - dbgtext( "for workgroup %s\n", work->work_group ); - } + nstring dmb_name; + + if( DEBUGLVL( 2 ) ) { + dbgtext( "sync_with_dmb:\n" ); + dbgtext( "Initiating sync with domain master browser " ); + dbgtext( "%s ", nmb_namestr(&work->dmb_name) ); + dbgtext( "at IP %s ", inet_ntoa(work->dmb_addr) ); + dbgtext( "for workgroup %s\n", work->work_group ); + } - sync_browse_lists(work, work->dmb_name.name, work->dmb_name.name_type, - work->dmb_addr, False, True); + pull_ascii_nstring(dmb_name, work->dmb_name.name); + sync_browse_lists(work, dmb_name, work->dmb_name.name_type, + work->dmb_addr, False, True); } /**************************************************************************** @@ -175,78 +170,69 @@ static void domain_master_node_status_success(struct subnet_record *subrec, struct res_rec *answers, struct in_addr from_ip) { - struct work_record *work = find_workgroup_on_subnet( subrec, userdata->data); - - if( work == NULL ) - { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "domain_master_node_status_success:\n" ); - dbgtext( "Unable to find workgroup " ); - dbgtext( "%s on subnet %s.\n", userdata->data, subrec->subnet_name ); - } - return; - } + struct work_record *work = find_workgroup_on_subnet( subrec, userdata->data); - if( DEBUGLVL( 3 ) ) - { - dbgtext( "domain_master_node_status_success:\n" ); - dbgtext( "Success in node status for workgroup " ); - dbgtext( "%s from ip %s\n", work->work_group, inet_ntoa(from_ip) ); - } + if( work == NULL ) { + if( DEBUGLVL( 0 ) ) { + dbgtext( "domain_master_node_status_success:\n" ); + dbgtext( "Unable to find workgroup " ); + dbgtext( "%s on subnet %s.\n", userdata->data, subrec->subnet_name ); + } + return; + } + + if( DEBUGLVL( 3 ) ) { + dbgtext( "domain_master_node_status_success:\n" ); + dbgtext( "Success in node status for workgroup " ); + dbgtext( "%s from ip %s\n", work->work_group, inet_ntoa(from_ip) ); + } /* Go through the list of names found at answers->rdata and look for the first SERVER<0x20> name. */ - if(answers->rdata != NULL) - { - char *p = answers->rdata; - int numnames = CVAL(p, 0); + if(answers->rdata != NULL) { + char *p = answers->rdata; + int numnames = CVAL(p, 0); - p += 1; + p += 1; - while (numnames--) - { - char qname[17]; - uint16 nb_flags; - int name_type; + while (numnames--) { + nstring qname; + uint16 nb_flags; + int name_type; - StrnCpy(qname,p,15); - name_type = CVAL(p,15); - nb_flags = get_nb_flags(&p[16]); - trim_string(qname,NULL," "); + pull_ascii_nstring(qname, p); + name_type = CVAL(p,15); + nb_flags = get_nb_flags(&p[16]); + trim_char(qname,'\0',' '); - p += 18; + p += 18; - if(!(nb_flags & NB_GROUP) && (name_type == 0x20)) - { - struct nmb_name nmbname; + if(!(nb_flags & NB_GROUP) && (name_type == 0x20)) { + struct nmb_name nmbname; - make_nmb_name(&nmbname, qname, name_type); + make_nmb_name(&nmbname, qname, name_type); - /* Copy the dmb name and IP address - into the workgroup struct. */ + /* Copy the dmb name and IP address + into the workgroup struct. */ - work->dmb_name = nmbname; - putip((char *)&work->dmb_addr, &from_ip); + work->dmb_name = nmbname; + putip((char *)&work->dmb_addr, &from_ip); - /* Do the local master browser announcement to the domain - master browser name and IP. */ - announce_local_master_browser_to_domain_master_browser( work ); + /* Do the local master browser announcement to the domain + master browser name and IP. */ + announce_local_master_browser_to_domain_master_browser( work ); - /* Now synchronise lists with the domain master browser. */ - sync_with_dmb(work); - break; - } - } - } - else - if( DEBUGLVL( 0 ) ) - { - dbgtext( "domain_master_node_status_success:\n" ); - dbgtext( "Failed to find a SERVER<0x20> name in reply from IP " ); - dbgtext( "%s.\n", inet_ntoa(from_ip) ); - } + /* Now synchronise lists with the domain master browser. */ + sync_with_dmb(work); + break; + } + } + } else if( DEBUGLVL( 0 ) ) { + dbgtext( "domain_master_node_status_success:\n" ); + dbgtext( "Failed to find a SERVER<0x20> name in reply from IP " ); + dbgtext( "%s.\n", inet_ntoa(from_ip) ); + } } /**************************************************************************** @@ -256,16 +242,15 @@ static void domain_master_node_status_success(struct subnet_record *subrec, static void domain_master_node_status_fail(struct subnet_record *subrec, struct response_record *rrec) { - struct userdata_struct *userdata = rrec->userdata; - - if( DEBUGLVL( 0 ) ) - { - dbgtext( "domain_master_node_status_fail:\n" ); - dbgtext( "Doing a node status request to the domain master browser\n" ); - dbgtext( "for workgroup %s ", userdata ? userdata->data : "NULL" ); - dbgtext( "at IP %s failed.\n", inet_ntoa(rrec->packet->ip) ); - dbgtext( "Cannot sync browser lists.\n" ); - } + struct userdata_struct *userdata = rrec->userdata; + + if( DEBUGLVL( 0 ) ) { + dbgtext( "domain_master_node_status_fail:\n" ); + dbgtext( "Doing a node status request to the domain master browser\n" ); + dbgtext( "for workgroup %s ", userdata ? userdata->data : "NULL" ); + dbgtext( "at IP %s failed.\n", inet_ntoa(rrec->packet->ip) ); + dbgtext( "Cannot sync browser lists.\n" ); + } } /**************************************************************************** @@ -276,100 +261,99 @@ static void find_domain_master_name_query_success(struct subnet_record *subrec, struct userdata_struct *userdata_in, struct nmb_name *q_name, struct in_addr answer_ip, struct res_rec *rrec) { - /* - * Unfortunately, finding the IP address of the Domain Master Browser, - * as we have here, is not enough. We need to now do a sync to the - * SERVERNAME<0x20> NetBIOS name, as only recent NT servers will - * respond to the SMBSERVER name. To get this name from IP - * address we do a Node status request, and look for the first - * NAME<0x20> in the response, and take that as the server name. - * We also keep a cache of the Domain Master Browser name for this - * workgroup in the Workgroup struct, so that if the same IP addess - * is returned every time, we don't need to do the node status - * request. - */ - - struct work_record *work; - struct nmb_name nmbname; - struct userdata_struct *userdata; - size_t size = sizeof(struct userdata_struct) + sizeof(fstring)+1; - - if( !(work = find_workgroup_on_subnet(subrec, q_name->name)) ) - { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "find_domain_master_name_query_success:\n" ); - dbgtext( "Failed to find workgroup %s\n", q_name->name ); - } - return; + /* + * Unfortunately, finding the IP address of the Domain Master Browser, + * as we have here, is not enough. We need to now do a sync to the + * SERVERNAME<0x20> NetBIOS name, as only recent NT servers will + * respond to the SMBSERVER name. To get this name from IP + * address we do a Node status request, and look for the first + * NAME<0x20> in the response, and take that as the server name. + * We also keep a cache of the Domain Master Browser name for this + * workgroup in the Workgroup struct, so that if the same IP addess + * is returned every time, we don't need to do the node status + * request. + */ + + struct work_record *work; + struct nmb_name nmbname; + struct userdata_struct *userdata; + size_t size = sizeof(struct userdata_struct) + sizeof(fstring)+1; + nstring qname; + + pull_ascii_nstring(qname, q_name->name); + if( !(work = find_workgroup_on_subnet(subrec, qname)) ) { + if( DEBUGLVL( 0 ) ) { + dbgtext( "find_domain_master_name_query_success:\n" ); + dbgtext( "Failed to find workgroup %s\n", qname); + } + return; } /* First check if we already have a dmb for this workgroup. */ - if(!is_zero_ip(work->dmb_addr) && ip_equal(work->dmb_addr, answer_ip)) - { - /* Do the local master browser announcement to the domain - master browser name and IP. */ - announce_local_master_browser_to_domain_master_browser( work ); + if(!is_zero_ip(work->dmb_addr) && ip_equal(work->dmb_addr, answer_ip)) { + /* Do the local master browser announcement to the domain + master browser name and IP. */ + announce_local_master_browser_to_domain_master_browser( work ); - /* Now synchronise lists with the domain master browser. */ - sync_with_dmb(work); - return; - } - else - zero_ip(&work->dmb_addr); - - /* Now initiate the node status request. */ - - /* We used to use the name "*",0x0 here, but some Windows - * servers don't answer that name. However we *know* they - * have the name workgroup#1b (as we just looked it up). - * So do the node status request on this name instead. - * Found at LBL labs. JRA. - */ - - make_nmb_name(&nmbname,work->work_group,0x1b); - - /* Put the workgroup name into the userdata so we know - what workgroup we're talking to when the reply comes - back. */ - - /* Setup the userdata_struct - this is copied so we can use - a stack variable for this. */ - if((userdata = (struct userdata_struct *)malloc(size)) == NULL) - { - DEBUG(0, ("find_domain_master_name_query_success: malloc fail.\n")); - return; - } + /* Now synchronise lists with the domain master browser. */ + sync_with_dmb(work); + return; + } else { + zero_ip(&work->dmb_addr); + } - userdata->copy_fn = NULL; - userdata->free_fn = NULL; - userdata->userdata_len = strlen(work->work_group)+1; - overmalloc_safe_strcpy(userdata->data, work->work_group, size - sizeof(*userdata) - 1); + /* Now initiate the node status request. */ - node_status( subrec, &nmbname, answer_ip, - domain_master_node_status_success, - domain_master_node_status_fail, - userdata); + /* We used to use the name "*",0x0 here, but some Windows + * servers don't answer that name. However we *know* they + * have the name workgroup#1b (as we just looked it up). + * So do the node status request on this name instead. + * Found at LBL labs. JRA. + */ - zero_free(userdata, size); + make_nmb_name(&nmbname,work->work_group,0x1b); + + /* Put the workgroup name into the userdata so we know + what workgroup we're talking to when the reply comes + back. */ + + /* Setup the userdata_struct - this is copied so we can use + a stack variable for this. */ + + if((userdata = (struct userdata_struct *)malloc(size)) == NULL) { + DEBUG(0, ("find_domain_master_name_query_success: malloc fail.\n")); + return; + } + + userdata->copy_fn = NULL; + userdata->free_fn = NULL; + userdata->userdata_len = strlen(work->work_group)+1; + overmalloc_safe_strcpy(userdata->data, work->work_group, size - sizeof(*userdata) - 1); + + node_status( subrec, &nmbname, answer_ip, + domain_master_node_status_success, + domain_master_node_status_fail, + userdata); + + zero_free(userdata, size); } /**************************************************************************** Function called when a query for a WORKGROUP<1b> name fails. ****************************************************************************/ + static void find_domain_master_name_query_fail(struct subnet_record *subrec, struct response_record *rrec, struct nmb_name *question_name, int fail_code) { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "find_domain_master_name_query_fail:\n" ); - dbgtext( "Unable to find the Domain Master Browser name " ); - dbgtext( "%s for the workgroup %s.\n", - nmb_namestr(question_name), question_name->name ); - dbgtext( "Unable to sync browse lists in this workgroup.\n" ); - } + if( DEBUGLVL( 0 ) ) { + dbgtext( "find_domain_master_name_query_fail:\n" ); + dbgtext( "Unable to find the Domain Master Browser name " ); + dbgtext( "%s for the workgroup %s.\n", + nmb_namestr(question_name), question_name->name ); + dbgtext( "Unable to sync browse lists in this workgroup.\n" ); + } } /**************************************************************************** @@ -381,27 +365,20 @@ full domain browse lists from it onto the given subnet. void announce_and_sync_with_domain_master_browser( struct subnet_record *subrec, struct work_record *work) { - struct nmb_name nmbname; - - /* Only do this if we are using a WINS server. */ - if(we_are_a_wins_client() == False) - { - if( DEBUGLVL( 10 ) ) - { - dbgtext( "announce_and_sync_with_domain_master_browser:\n" ); - dbgtext( "Ignoring, as we are not a WINS client.\n" ); - } - return; - } - - make_nmb_name(&nmbname,work->work_group,0x1b); + /* Only do this if we are using a WINS server. */ + if(we_are_a_wins_client() == False) { + if( DEBUGLVL( 10 ) ) { + dbgtext( "announce_and_sync_with_domain_master_browser:\n" ); + dbgtext( "Ignoring, as we are not a WINS client.\n" ); + } + return; + } - /* First, query for the WORKGROUP<1b> name from the WINS server. */ - query_name(unicast_subnet, nmbname.name, nmbname.name_type, + /* First, query for the WORKGROUP<1b> name from the WINS server. */ + query_name(unicast_subnet, work->work_group, 0x1b, find_domain_master_name_query_success, find_domain_master_name_query_fail, NULL); - } /**************************************************************************** @@ -421,89 +398,81 @@ static void get_domain_master_name_node_status_success(struct subnet_record *sub struct res_rec *answers, struct in_addr from_ip) { - struct work_record *work; - fstring server_name; + struct work_record *work; + fstring server_name; - server_name[0] = 0; + server_name[0] = 0; - if( DEBUGLVL( 3 ) ) - { - dbgtext( "get_domain_master_name_node_status_success:\n" ); - dbgtext( "Success in node status from ip %s\n", inet_ntoa(from_ip) ); - } + if( DEBUGLVL( 3 ) ) { + dbgtext( "get_domain_master_name_node_status_success:\n" ); + dbgtext( "Success in node status from ip %s\n", inet_ntoa(from_ip) ); + } - /* - * Go through the list of names found at answers->rdata and look for - * the first WORKGROUP<0x1b> name. - */ - - if(answers->rdata != NULL) - { - char *p = answers->rdata; - int numnames = CVAL(p, 0); - - p += 1; - - while (numnames--) - { - char qname[17]; - uint16 nb_flags; - int name_type; - - StrnCpy(qname,p,15); - name_type = CVAL(p,15); - nb_flags = get_nb_flags(&p[16]); - trim_string(qname,NULL," "); - - p += 18; - - if(!(nb_flags & NB_GROUP) && (name_type == 0x00) && - server_name[0] == 0) { - /* this is almost certainly the server netbios name */ - fstrcpy(server_name, qname); - continue; - } - - if(!(nb_flags & NB_GROUP) && (name_type == 0x1b)) - { - if( DEBUGLVL( 5 ) ) - { - dbgtext( "get_domain_master_name_node_status_success:\n" ); - dbgtext( "%s(%s) ", server_name, inet_ntoa(from_ip) ); - dbgtext( "is a domain master browser for workgroup " ); - dbgtext( "%s. Adding this name.\n", qname ); - } - - /* - * If we don't already know about this workgroup, add it - * to the workgroup list on the unicast_subnet. - */ - if((work = find_workgroup_on_subnet( subrec, qname)) == NULL) - { - struct nmb_name nmbname; - /* - * Add it - with an hour in the cache. - */ - if(!(work= create_workgroup_on_subnet(subrec, qname, 60*60))) - return; - - /* remember who the master is */ - fstrcpy(work->local_master_browser_name, server_name); - make_nmb_name(&nmbname, server_name, 0x20); - work->dmb_name = nmbname; - work->dmb_addr = from_ip; - } - break; - } - } - } - else - if( DEBUGLVL( 0 ) ) - { - dbgtext( "get_domain_master_name_node_status_success:\n" ); - dbgtext( "Failed to find a WORKGROUP<0x1b> name in reply from IP " ); - dbgtext( "%s.\n", inet_ntoa(from_ip) ); - } + /* + * Go through the list of names found at answers->rdata and look for + * the first WORKGROUP<0x1b> name. + */ + + if(answers->rdata != NULL) { + char *p = answers->rdata; + int numnames = CVAL(p, 0); + + p += 1; + + while (numnames--) { + nstring qname; + uint16 nb_flags; + int name_type; + + pull_ascii_nstring(qname, p); + name_type = CVAL(p,15); + nb_flags = get_nb_flags(&p[16]); + trim_char(qname,'\0',' '); + + p += 18; + + if(!(nb_flags & NB_GROUP) && (name_type == 0x00) && + server_name[0] == 0) { + /* this is almost certainly the server netbios name */ + fstrcpy(server_name, qname); + continue; + } + + if(!(nb_flags & NB_GROUP) && (name_type == 0x1b)) { + if( DEBUGLVL( 5 ) ) { + dbgtext( "get_domain_master_name_node_status_success:\n" ); + dbgtext( "%s(%s) ", server_name, inet_ntoa(from_ip) ); + dbgtext( "is a domain master browser for workgroup " ); + dbgtext( "%s. Adding this name.\n", qname ); + } + + /* + * If we don't already know about this workgroup, add it + * to the workgroup list on the unicast_subnet. + */ + + if((work = find_workgroup_on_subnet( subrec, qname)) == NULL) { + struct nmb_name nmbname; + /* + * Add it - with an hour in the cache. + */ + if(!(work= create_workgroup_on_subnet(subrec, qname, 60*60))) + return; + + /* remember who the master is */ + nstrcpy(work->local_master_browser_name, server_name); + make_nmb_name(&nmbname, server_name, 0x20); + work->dmb_name = nmbname; + work->dmb_addr = from_ip; + } + break; + } + } + } else if( DEBUGLVL( 0 ) ) { + dbgtext( "get_domain_master_name_node_status_success:\n" ); + dbgtext( "Failed to find a WORKGROUP<0x1b> name in reply from IP " ); + dbgtext( "%s.\n", inet_ntoa(from_ip) ); + } } /**************************************************************************** @@ -513,13 +482,12 @@ static void get_domain_master_name_node_status_success(struct subnet_record *sub static void get_domain_master_name_node_status_fail(struct subnet_record *subrec, struct response_record *rrec) { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "get_domain_master_name_node_status_fail:\n" ); - dbgtext( "Doing a node status request to the domain master browser " ); - dbgtext( "at IP %s failed.\n", inet_ntoa(rrec->packet->ip) ); - dbgtext( "Cannot get workgroup name.\n" ); - } + if( DEBUGLVL( 0 ) ) { + dbgtext( "get_domain_master_name_node_status_fail:\n" ); + dbgtext( "Doing a node status request to the domain master browser " ); + dbgtext( "at IP %s failed.\n", inet_ntoa(rrec->packet->ip) ); + dbgtext( "Cannot get workgroup name.\n" ); + } } /**************************************************************************** @@ -530,58 +498,53 @@ static void find_all_domain_master_names_query_success(struct subnet_record *sub struct userdata_struct *userdata_in, struct nmb_name *q_name, struct in_addr answer_ip, struct res_rec *rrec) { - /* - * We now have a list of all the domain master browsers for all workgroups - * that have registered with the WINS server. Now do a node status request - * to each one and look for the first 1b name in the reply. This will be - * the workgroup name that we will add to the unicast subnet as a 'non-local' - * workgroup. - */ - - struct nmb_name nmbname; - struct in_addr send_ip; - int i; - - if( DEBUGLVL( 5 ) ) - { - dbgtext( "find_all_domain_master_names_query_succes:\n" ); - dbgtext( "Got answer from WINS server of %d ", (rrec->rdlength / 6) ); - dbgtext( "IP addresses for Domain Master Browsers.\n" ); - } + /* + * We now have a list of all the domain master browsers for all workgroups + * that have registered with the WINS server. Now do a node status request + * to each one and look for the first 1b name in the reply. This will be + * the workgroup name that we will add to the unicast subnet as a 'non-local' + * workgroup. + */ + + struct nmb_name nmbname; + struct in_addr send_ip; + int i; + + if( DEBUGLVL( 5 ) ) { + dbgtext( "find_all_domain_master_names_query_succes:\n" ); + dbgtext( "Got answer from WINS server of %d ", (rrec->rdlength / 6) ); + dbgtext( "IP addresses for Domain Master Browsers.\n" ); + } - for(i = 0; i < rrec->rdlength / 6; i++) - { - /* Initiate the node status requests. */ - make_nmb_name(&nmbname, "*", 0); - - putip((char *)&send_ip, (char *)&rrec->rdata[(i*6) + 2]); - - /* - * Don't send node status requests to ourself. - */ - - if(ismyip( send_ip )) - { - if( DEBUGLVL( 5 ) ) - { - dbgtext( "find_all_domain_master_names_query_succes:\n" ); - dbgtext( "Not sending node status to our own IP " ); - dbgtext( "%s.\n", inet_ntoa(send_ip) ); - } - continue; - } - - if( DEBUGLVL( 5 ) ) - { - dbgtext( "find_all_domain_master_names_query_success:\n" ); - dbgtext( "Sending node status request to IP %s.\n", inet_ntoa(send_ip) ); - } - - node_status( subrec, &nmbname, send_ip, - get_domain_master_name_node_status_success, - get_domain_master_name_node_status_fail, - NULL); - } + for(i = 0; i < rrec->rdlength / 6; i++) { + /* Initiate the node status requests. */ + make_nmb_name(&nmbname, "*", 0); + + putip((char *)&send_ip, (char *)&rrec->rdata[(i*6) + 2]); + + /* + * Don't send node status requests to ourself. + */ + + if(ismyip( send_ip )) { + if( DEBUGLVL( 5 ) ) { + dbgtext( "find_all_domain_master_names_query_succes:\n" ); + dbgtext( "Not sending node status to our own IP " ); + dbgtext( "%s.\n", inet_ntoa(send_ip) ); + } + continue; + } + + if( DEBUGLVL( 5 ) ) { + dbgtext( "find_all_domain_master_names_query_success:\n" ); + dbgtext( "Sending node status request to IP %s.\n", inet_ntoa(send_ip) ); + } + + node_status( subrec, &nmbname, send_ip, + get_domain_master_name_node_status_success, + get_domain_master_name_node_status_fail, + NULL); + } } /**************************************************************************** @@ -591,13 +554,12 @@ static void find_all_domain_master_names_query_fail(struct subnet_record *subrec struct response_record *rrec, struct nmb_name *question_name, int fail_code) { - if( DEBUGLVL( 10 ) ) - { - dbgtext( "find_domain_master_name_query_fail:\n" ); - dbgtext( "WINS server did not reply to a query for name " ); - dbgtext( "%s.\nThis means it ", nmb_namestr(question_name) ); - dbgtext( "is probably not a Samba 1.9.18 or above WINS server.\n" ); - } + if( DEBUGLVL( 10 ) ) { + dbgtext( "find_domain_master_name_query_fail:\n" ); + dbgtext( "WINS server did not reply to a query for name " ); + dbgtext( "%s.\nThis means it ", nmb_namestr(question_name) ); + dbgtext( "is probably not a Samba 1.9.18 or above WINS server.\n" ); + } } /**************************************************************************** @@ -608,43 +570,39 @@ static void find_all_domain_master_names_query_fail(struct subnet_record *subrec <1b> name in the reply - this is the workgroup name. Add this to the unicast subnet. This is expensive, so we only do this every 15 minutes. **************************************************************************/ + void collect_all_workgroup_names_from_wins_server(time_t t) { - static time_t lastrun = 0; - struct work_record *work; - struct nmb_name nmbname; - - /* Only do this if we are using a WINS server. */ - if(we_are_a_wins_client() == False) - return; - - /* Check to see if we are a domain master browser on the unicast subnet. */ - if((work = find_workgroup_on_subnet( unicast_subnet, lp_workgroup())) == NULL) - { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "collect_all_workgroup_names_from_wins_server:\n" ); - dbgtext( "Cannot find my workgroup %s ", lp_workgroup() ); - dbgtext( "on subnet %s.\n", unicast_subnet->subnet_name ); - } - return; - } + static time_t lastrun = 0; + struct work_record *work; - if(!AM_DOMAIN_MASTER_BROWSER(work)) - return; + /* Only do this if we are using a WINS server. */ + if(we_are_a_wins_client() == False) + return; - if ((lastrun != 0) && (t < lastrun + (15 * 60))) - return; - - lastrun = t; + /* Check to see if we are a domain master browser on the unicast subnet. */ + if((work = find_workgroup_on_subnet( unicast_subnet, lp_workgroup())) == NULL) { + if( DEBUGLVL( 0 ) ) { + dbgtext( "collect_all_workgroup_names_from_wins_server:\n" ); + dbgtext( "Cannot find my workgroup %s ", lp_workgroup() ); + dbgtext( "on subnet %s.\n", unicast_subnet->subnet_name ); + } + return; + } + + if(!AM_DOMAIN_MASTER_BROWSER(work)) + return; - make_nmb_name(&nmbname,"*",0x1b); + if ((lastrun != 0) && (t < lastrun + (15 * 60))) + return; + + lastrun = t; - /* First, query for the *<1b> name from the WINS server. */ - query_name(unicast_subnet, nmbname.name, nmbname.name_type, - find_all_domain_master_names_query_success, - find_all_domain_master_names_query_fail, - NULL); + /* First, query for the *<1b> name from the WINS server. */ + query_name(unicast_subnet, "*", 0x1b, + find_all_domain_master_names_query_success, + find_all_domain_master_names_query_fail, + NULL); } @@ -656,6 +614,7 @@ To prevent exponential network traffic with large numbers of workgroups we use a randomised system where sync probability is inversely proportional to the number of known workgroups **************************************************************************/ + void sync_all_dmbs(time_t t) { static time_t lastrun = 0; @@ -669,7 +628,8 @@ void sync_all_dmbs(time_t t) /* Check to see if we are a domain master browser on the unicast subnet. */ work = find_workgroup_on_subnet(unicast_subnet, lp_workgroup()); - if (!work) return; + if (!work) + return; if (!AM_DOMAIN_MASTER_BROWSER(work)) return; @@ -679,15 +639,18 @@ void sync_all_dmbs(time_t t) /* count how many syncs we might need to do */ for (work=unicast_subnet->workgrouplist; work; work = work->next) { - if (strcmp(lp_workgroup(), work->work_group)) { + if (strncmp(lp_workgroup(), work->work_group, sizeof(nstring))) { count++; } } /* sync with a probability of 1/count */ for (work=unicast_subnet->workgrouplist; work; work = work->next) { - if (strcmp(lp_workgroup(), work->work_group)) { - if (((unsigned)sys_random()) % count != 0) continue; + if (strncmp(lp_workgroup(), work->work_group, sizeof(nstring))) { + nstring dmb_name; + + if (((unsigned)sys_random()) % count != 0) + continue; lastrun = t; @@ -699,13 +662,15 @@ void sync_all_dmbs(time_t t) 0x20); } + pull_ascii_nstring(dmb_name, work->dmb_name.name); + DEBUG(3,("Initiating DMB<->DMB sync with %s(%s)\n", - work->dmb_name.name, - inet_ntoa(work->dmb_addr))); + dmb_name, inet_ntoa(work->dmb_addr))); + sync_browse_lists(work, - work->dmb_name.name, + dmb_name, work->dmb_name.name_type, work->dmb_addr, False, False); } } -} +} diff --git a/source3/nmbd/nmbd_elections.c b/source3/nmbd/nmbd_elections.c index b948eb9d04..fabc0eddca 100644 --- a/source3/nmbd/nmbd_elections.c +++ b/source3/nmbd/nmbd_elections.c @@ -3,7 +3,7 @@ NBT netbios routines and daemon - version 2 Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -29,32 +29,36 @@ extern time_t StartupTime; /**************************************************************************** Send an election datagram packet. **************************************************************************/ + static void send_election_dgram(struct subnet_record *subrec, const char *workgroup_name, uint32 criterion, int timeup,const char *server_name) { - pstring outbuf; - char *p; - - DEBUG(2,("send_election_dgram: Sending election packet for workgroup %s on subnet %s\n", - workgroup_name, subrec->subnet_name )); - - memset(outbuf,'\0',sizeof(outbuf)); - p = outbuf; - SCVAL(p,0,ANN_Election); /* Election opcode. */ - p++; - - SCVAL(p,0,((criterion == 0 && timeup == 0) ? 0 : ELECTION_VERSION)); - SIVAL(p,1,criterion); - SIVAL(p,5,timeup*1000); /* ms - Despite what the spec says. */ - p += 13; - pstrcpy_base(p, server_name, outbuf); - strupper_m(p); - p = skip_string(p,1); + pstring outbuf; + fstring srv_name; + char *p; + + DEBUG(2,("send_election_dgram: Sending election packet for workgroup %s on subnet %s\n", + workgroup_name, subrec->subnet_name )); + + memset(outbuf,'\0',sizeof(outbuf)); + p = outbuf; + SCVAL(p,0,ANN_Election); /* Election opcode. */ + p++; + + SCVAL(p,0,((criterion == 0 && timeup == 0) ? 0 : ELECTION_VERSION)); + SIVAL(p,1,criterion); + SIVAL(p,5,timeup*1000); /* ms - Despite what the spec says. */ + p += 13; + fstrcpy(srv_name, server_name); + strupper_m(srv_name); + /* The following call does UNIX -> DOS charset conversion. */ + pstrcpy_base(p, srv_name, outbuf); + p = skip_string(p,1); - send_mailslot(False, BROWSE_MAILSLOT, outbuf, PTR_DIFF(p,outbuf), - global_myname(), 0, - workgroup_name, 0x1e, - subrec->bcast_ip, subrec->myip, DGRAM_PORT); + send_mailslot(False, BROWSE_MAILSLOT, outbuf, PTR_DIFF(p,outbuf), + global_myname(), 0, + workgroup_name, 0x1e, + subrec->bcast_ip, subrec->myip, DGRAM_PORT); } /******************************************************************* @@ -66,8 +70,10 @@ static void check_for_master_browser_success(struct subnet_record *subrec, struct nmb_name *answer_name, struct in_addr answer_ip, struct res_rec *rrec) { - DEBUG(3,("check_for_master_browser_success: Local master browser for workgroup %s exists at \ -IP %s (just checking).\n", answer_name->name, inet_ntoa(answer_ip) )); + nstring aname; + pull_ascii_nstring(aname, answer_name->name); + DEBUG(3,("check_for_master_browser_success: Local master browser for workgroup %s exists at \ +IP %s (just checking).\n", aname, inet_ntoa(answer_ip) )); } /******************************************************************* @@ -79,41 +85,39 @@ static void check_for_master_browser_fail( struct subnet_record *subrec, struct nmb_name *question_name, int fail_code) { - char *workgroup_name = question_name->name; - struct work_record *work = find_workgroup_on_subnet(subrec, workgroup_name); - - if(work == NULL) - { - DEBUG(0,("check_for_master_browser_fail: Unable to find workgroup %s on subnet %s.=\n", - workgroup_name, subrec->subnet_name )); - return; - } - - if (strequal(work->work_group, lp_workgroup())) - { - - if (lp_local_master()) - { - /* We have discovered that there is no local master - browser, and we are configured to initiate - an election that we will participate in. - */ - DEBUG(2,("check_for_master_browser_fail: Forcing election on workgroup %s subnet %s\n", - work->work_group, subrec->subnet_name )); - - /* Setting this means we will participate when the - election is run in run_elections(). */ - work->needelection = True; - } - else - { - /* We need to force an election, because we are configured - not to become the local master, but we still need one, - having detected that one doesn't exist. - */ - send_election_dgram(subrec, work->work_group, 0, 0, ""); - } - } + nstring workgroup_name; + struct work_record *work; + + pull_ascii_nstring(workgroup_name,question_name->name); + + work = find_workgroup_on_subnet(subrec, workgroup_name); + if(work == NULL) { + DEBUG(0,("check_for_master_browser_fail: Unable to find workgroup %s on subnet %s.=\n", + workgroup_name, subrec->subnet_name )); + return; + } + + if (strnequal(work->work_group, lp_workgroup(), sizeof(nstring)-1)) { + + if (lp_local_master()) { + /* We have discovered that there is no local master + browser, and we are configured to initiate + an election that we will participate in. + */ + DEBUG(2,("check_for_master_browser_fail: Forcing election on workgroup %s subnet %s\n", + work->work_group, subrec->subnet_name )); + + /* Setting this means we will participate when the + election is run in run_elections(). */ + work->needelection = True; + } else { + /* We need to force an election, because we are configured + not to become the local master, but we still need one, + having detected that one doesn't exist. + */ + send_election_dgram(subrec, work->work_group, 0, 0, ""); + } + } } /******************************************************************* @@ -123,36 +127,33 @@ static void check_for_master_browser_fail( struct subnet_record *subrec, void check_master_browser_exists(time_t t) { - static time_t lastrun=0; - struct subnet_record *subrec; - const char *workgroup_name = lp_workgroup(); - - if (!lastrun) - lastrun = t; - - if (t < (lastrun + (CHECK_TIME_MST_BROWSE * 60))) - return; - - lastrun = t; - - dump_workgroups(False); - - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - struct work_record *work; - - for (work = subrec->workgrouplist; work; work = work->next) - { - if (strequal(work->work_group, workgroup_name) && !AM_LOCAL_MASTER_BROWSER(work)) - { - /* Do a name query for the local master browser on this net. */ - query_name( subrec, work->work_group, 0x1d, - check_for_master_browser_success, - check_for_master_browser_fail, - NULL); - } - } - } + static time_t lastrun=0; + struct subnet_record *subrec; + const char *workgroup_name = lp_workgroup(); + + if (!lastrun) + lastrun = t; + + if (t < (lastrun + (CHECK_TIME_MST_BROWSE * 60))) + return; + + lastrun = t; + + dump_workgroups(False); + + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + struct work_record *work; + + for (work = subrec->workgrouplist; work; work = work->next) { + if (strnequal(work->work_group, workgroup_name, sizeof(nstring)-1) && !AM_LOCAL_MASTER_BROWSER(work)) { + /* Do a name query for the local master browser on this net. */ + query_name( subrec, work->work_group, 0x1d, + check_for_master_browser_success, + check_for_master_browser_fail, + NULL); + } + } + } } /******************************************************************* @@ -161,56 +162,52 @@ void check_master_browser_exists(time_t t) void run_elections(time_t t) { - static time_t lastime = 0; + static time_t lastime = 0; - struct subnet_record *subrec; + struct subnet_record *subrec; - /* Send election packets once every 2 seconds - note */ - if (lastime && (t - lastime < 2)) - return; + /* Send election packets once every 2 seconds - note */ + if (lastime && (t - lastime < 2)) + return; - lastime = t; + lastime = t; - START_PROFILE(run_elections); - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - struct work_record *work; - - for (work = subrec->workgrouplist; work; work = work->next) - { - if (work->RunningElection) - { - /* - * We can only run an election for a workgroup if we have - * registered the WORKGROUP<1e> name, as that's the name - * we must listen to. - */ - struct nmb_name nmbname; - - make_nmb_name(&nmbname, work->work_group, 0x1e); - if(find_name_on_subnet( subrec, &nmbname, FIND_SELF_NAME)==NULL) { - DEBUG(8,("run_elections: Cannot send election packet yet as name %s not \ + START_PROFILE(run_elections); + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + struct work_record *work; + + for (work = subrec->workgrouplist; work; work = work->next) { + if (work->RunningElection) { + /* + * We can only run an election for a workgroup if we have + * registered the WORKGROUP<1e> name, as that's the name + * we must listen to. + */ + struct nmb_name nmbname; + + make_nmb_name(&nmbname, work->work_group, 0x1e); + if(find_name_on_subnet( subrec, &nmbname, FIND_SELF_NAME)==NULL) { + DEBUG(8,("run_elections: Cannot send election packet yet as name %s not \ yet registered on subnet %s\n", nmb_namestr(&nmbname), subrec->subnet_name )); - continue; - } + continue; + } - send_election_dgram(subrec, work->work_group, work->ElectionCriterion, - t - StartupTime, global_myname()); + send_election_dgram(subrec, work->work_group, work->ElectionCriterion, + t - StartupTime, global_myname()); - if (work->ElectionCount++ >= 4) - { - /* Won election (4 packets were sent out uncontested. */ - DEBUG(2,("run_elections: >>> Won election for workgroup %s on subnet %s <<<\n", - work->work_group, subrec->subnet_name )); - - work->RunningElection = False; - - become_local_master_browser(subrec, work); - } - } - } - } - END_PROFILE(run_elections); + if (work->ElectionCount++ >= 4) { + /* Won election (4 packets were sent out uncontested. */ + DEBUG(2,("run_elections: >>> Won election for workgroup %s on subnet %s <<<\n", + work->work_group, subrec->subnet_name )); + + work->RunningElection = False; + + become_local_master_browser(subrec, work); + } + } + } + } + END_PROFILE(run_elections); } /******************************************************************* @@ -218,44 +215,42 @@ yet registered on subnet %s\n", nmb_namestr(&nmbname), subrec->subnet_name )); ******************************************************************/ static BOOL win_election(struct work_record *work, int version, - uint32 criterion, int timeup, char *server_name) + uint32 criterion, int timeup, const char *server_name) { - int mytimeup = time(NULL) - StartupTime; - uint32 mycriterion = work->ElectionCriterion; - - /* If local master is false then never win - in election broadcasts. */ - if(!lp_local_master()) - { - DEBUG(3,("win_election: Losing election as local master == False\n")); - return False; - } + int mytimeup = time(NULL) - StartupTime; + uint32 mycriterion = work->ElectionCriterion; + + /* If local master is false then never win in election broadcasts. */ + if(!lp_local_master()) { + DEBUG(3,("win_election: Losing election as local master == False\n")); + return False; + } - DEBUG(4,("win_election: election comparison: %x:%x %x:%x %d:%d %s:%s\n", - version, ELECTION_VERSION, - criterion, mycriterion, - timeup, mytimeup, - server_name, global_myname())); - - if (version > ELECTION_VERSION) - return(False); - if (version < ELECTION_VERSION) - return(True); + DEBUG(4,("win_election: election comparison: %x:%x %x:%x %d:%d %s:%s\n", + version, ELECTION_VERSION, + criterion, mycriterion, + timeup, mytimeup, + server_name, global_myname())); + + if (version > ELECTION_VERSION) + return(False); + if (version < ELECTION_VERSION) + return(True); - if (criterion > mycriterion) - return(False); - if (criterion < mycriterion) - return(True); - - if (timeup > mytimeup) - return(False); - if (timeup < mytimeup) - return(True); - - if (strcasecmp(global_myname(), server_name) > 0) - return(False); + if (criterion > mycriterion) + return(False); + if (criterion < mycriterion) + return(True); + + if (timeup > mytimeup) + return(False); + if (timeup < mytimeup) + return(True); + + if (strcasecmp(global_myname(), server_name) > 0) + return(False); - return(True); + return(True); } /******************************************************************* @@ -264,66 +259,63 @@ static BOOL win_election(struct work_record *work, int version, void process_election(struct subnet_record *subrec, struct packet_struct *p, char *buf) { - struct dgram_packet *dgram = &p->packet.dgram; - int version = CVAL(buf,0); - uint32 criterion = IVAL(buf,1); - int timeup = IVAL(buf,5)/1000; - char *server_name = buf+13; - struct work_record *work; - char *workgroup_name = dgram->dest_name.name; - - START_PROFILE(election); - server_name[15] = 0; - - DEBUG(3,("process_election: Election request from %s at IP %s on subnet %s for workgroup %s.\n", - server_name,inet_ntoa(p->ip), subrec->subnet_name, workgroup_name )); - - DEBUG(5,("process_election: vers=%d criterion=%08x timeup=%d\n", version,criterion,timeup)); - - if(( work = find_workgroup_on_subnet(subrec, workgroup_name)) == NULL) - { - DEBUG(0,("process_election: Cannot find workgroup %s on subnet %s.\n", - workgroup_name, subrec->subnet_name )); - goto done; - } - - if (!strequal(work->work_group, lp_workgroup())) - { - DEBUG(3,("process_election: ignoring election request for workgroup %s on subnet %s as this \ + struct dgram_packet *dgram = &p->packet.dgram; + int version = CVAL(buf,0); + uint32 criterion = IVAL(buf,1); + int timeup = IVAL(buf,5)/1000; + nstring server_name; + struct work_record *work; + nstring workgroup_name; + + pull_ascii_nstring(server_name, buf+13); + pull_ascii_nstring(workgroup_name, dgram->dest_name.name); + + START_PROFILE(election); + server_name[15] = 0; + + DEBUG(3,("process_election: Election request from %s at IP %s on subnet %s for workgroup %s.\n", + server_name,inet_ntoa(p->ip), subrec->subnet_name, workgroup_name )); + + DEBUG(5,("process_election: vers=%d criterion=%08x timeup=%d\n", version,criterion,timeup)); + + if(( work = find_workgroup_on_subnet(subrec, workgroup_name)) == NULL) { + DEBUG(0,("process_election: Cannot find workgroup %s on subnet %s.\n", + workgroup_name, subrec->subnet_name )); + goto done; + } + + if (!strnequal(work->work_group, lp_workgroup(), sizeof(nstring)-1)) { + DEBUG(3,("process_election: ignoring election request for workgroup %s on subnet %s as this \ is not my workgroup.\n", work->work_group, subrec->subnet_name )); - goto done; - } - - if (win_election(work, version,criterion,timeup,server_name)) - { - /* We take precedence over the requesting server. */ - if (!work->RunningElection) - { - /* We weren't running an election - start running one. */ - - work->needelection = True; - work->ElectionCount=0; - } - - /* Note that if we were running an election for this workgroup on this - subnet already, we just ignore the server we take precedence over. */ - } - else - { - /* We lost. Stop participating. */ - work->needelection = False; - - if (work->RunningElection || AM_LOCAL_MASTER_BROWSER(work)) - { - work->RunningElection = False; - DEBUG(3,("process_election: >>> Lost election for workgroup %s on subnet %s <<<\n", - work->work_group, subrec->subnet_name )); - if (AM_LOCAL_MASTER_BROWSER(work)) - unbecome_local_master_browser(subrec, work, False); - } - } + goto done; + } + + if (win_election(work, version,criterion,timeup,server_name)) { + /* We take precedence over the requesting server. */ + if (!work->RunningElection) { + /* We weren't running an election - start running one. */ + + work->needelection = True; + work->ElectionCount=0; + } + + /* Note that if we were running an election for this workgroup on this + subnet already, we just ignore the server we take precedence over. */ + } else { + /* We lost. Stop participating. */ + work->needelection = False; + + if (work->RunningElection || AM_LOCAL_MASTER_BROWSER(work)) { + work->RunningElection = False; + DEBUG(3,("process_election: >>> Lost election for workgroup %s on subnet %s <<<\n", + work->work_group, subrec->subnet_name )); + if (AM_LOCAL_MASTER_BROWSER(work)) + unbecome_local_master_browser(subrec, work, False); + } + } done: - END_PROFILE(election); + + END_PROFILE(election); } /**************************************************************************** @@ -335,57 +327,53 @@ done: BOOL check_elections(void) { - struct subnet_record *subrec; - BOOL run_any_election = False; - - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - struct work_record *work; - for (work = subrec->workgrouplist; work; work = work->next) - { - run_any_election |= work->RunningElection; - - /* - * Start an election if we have any chance of winning. - * Note this is a change to the previous code, that would - * only run an election if nmbd was in the potential browser - * state. We need to run elections in any state if we're told - * to. JRA. - */ - - if (work->needelection && !work->RunningElection && lp_local_master()) - { - /* - * We can only run an election for a workgroup if we have - * registered the WORKGROUP<1e> name, as that's the name - * we must listen to. - */ - struct nmb_name nmbname; - - make_nmb_name(&nmbname, work->work_group, 0x1e); - if(find_name_on_subnet( subrec, &nmbname, FIND_SELF_NAME)==NULL) { - DEBUG(8,("check_elections: Cannot send election packet yet as name %s not \ + struct subnet_record *subrec; + BOOL run_any_election = False; + + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + struct work_record *work; + for (work = subrec->workgrouplist; work; work = work->next) { + run_any_election |= work->RunningElection; + + /* + * Start an election if we have any chance of winning. + * Note this is a change to the previous code, that would + * only run an election if nmbd was in the potential browser + * state. We need to run elections in any state if we're told + * to. JRA. + */ + + if (work->needelection && !work->RunningElection && lp_local_master()) { + /* + * We can only run an election for a workgroup if we have + * registered the WORKGROUP<1e> name, as that's the name + * we must listen to. + */ + struct nmb_name nmbname; + + make_nmb_name(&nmbname, work->work_group, 0x1e); + if(find_name_on_subnet( subrec, &nmbname, FIND_SELF_NAME)==NULL) { + DEBUG(8,("check_elections: Cannot send election packet yet as name %s not \ yet registered on subnet %s\n", nmb_namestr(&nmbname), subrec->subnet_name )); - continue; - } - - DEBUG(3,("check_elections: >>> Starting election for workgroup %s on subnet %s <<<\n", - work->work_group, subrec->subnet_name )); - - work->ElectionCount = 0; - work->RunningElection = True; - work->needelection = False; - } - } - } - return run_any_election; -} + continue; + } + DEBUG(3,("check_elections: >>> Starting election for workgroup %s on subnet %s <<<\n", + work->work_group, subrec->subnet_name )); + work->ElectionCount = 0; + work->RunningElection = True; + work->needelection = False; + } + } + } + return run_any_election; +} /**************************************************************************** -process a internal Samba message forcing an election + Process a internal Samba message forcing an election. ***************************************************************************/ + void nmbd_message_election(int msg_type, pid_t src, void *buf, size_t len) { struct subnet_record *subrec; @@ -393,7 +381,7 @@ void nmbd_message_election(int msg_type, pid_t src, void *buf, size_t len) for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { struct work_record *work; for (work = subrec->workgrouplist; work; work = work->next) { - if (strequal(work->work_group, lp_workgroup())) { + if (strnequal(work->work_group, lp_workgroup(), sizeof(nstring)-1)) { work->needelection = True; work->ElectionCount=0; work->mst_state = lp_local_master() ? MST_POTENTIAL : MST_NONE; diff --git a/source3/nmbd/nmbd_incomingdgrams.c b/source3/nmbd/nmbd_incomingdgrams.c index 80465ada0d..f646e39716 100644 --- a/source3/nmbd/nmbd_incomingdgrams.c +++ b/source3/nmbd/nmbd_incomingdgrams.c @@ -95,102 +95,99 @@ void tell_become_backup(void) void process_host_announce(struct subnet_record *subrec, struct packet_struct *p, char *buf) { - struct dgram_packet *dgram = &p->packet.dgram; - int ttl = IVAL(buf,1)/1000; - char *announce_name = buf+5; - uint32 servertype = IVAL(buf,23); - char *comment = buf+31; - struct work_record *work; - struct server_record *servrec; - const char *work_name; - char *source_name = dgram->source_name.name; - - START_PROFILE(host_announce); - comment[43] = 0; + struct dgram_packet *dgram = &p->packet.dgram; + int ttl = IVAL(buf,1)/1000; + nstring announce_name; + uint32 servertype = IVAL(buf,23); + fstring comment; + struct work_record *work; + struct server_record *servrec; + nstring work_name; + nstring source_name; + + START_PROFILE(host_announce); + + pull_ascii_fstring(comment, buf+31); + comment[42] = 0; - DEBUG(3,("process_host_announce: from %s<%02x> IP %s to \ + pull_ascii_nstring(announce_name, buf+5); + pull_ascii_nstring(source_name, dgram->source_name.name); + + DEBUG(3,("process_host_announce: from %s<%02x> IP %s to \ %s for server %s.\n", source_name, source_name[15], inet_ntoa(p->ip), - nmb_namestr(&dgram->dest_name),announce_name)); + nmb_namestr(&dgram->dest_name),announce_name)); - DEBUG(5,("process_host_announce: ttl=%d server type=%08x comment=%s\n", - ttl, servertype,comment)); + DEBUG(5,("process_host_announce: ttl=%d server type=%08x comment=%s\n", + ttl, servertype,comment)); - /* Filter servertype to remove impossible bits. */ - servertype &= ~(SV_TYPE_LOCAL_LIST_ONLY|SV_TYPE_DOMAIN_ENUM); + /* Filter servertype to remove impossible bits. */ + servertype &= ~(SV_TYPE_LOCAL_LIST_ONLY|SV_TYPE_DOMAIN_ENUM); - /* A host announcement must be sent to the name WORKGROUP<1d>. */ - if(dgram->dest_name.name_type != 0x1d) - { - DEBUG(2,("process_host_announce: incorrect name type for destination from IP %s \ + /* A host announcement must be sent to the name WORKGROUP<1d>. */ + if(dgram->dest_name.name_type != 0x1d) { + DEBUG(2,("process_host_announce: incorrect name type for destination from IP %s \ (was %02x) should be 0x1d. Allowing packet anyway.\n", - inet_ntoa(p->ip), dgram->dest_name.name_type)); - /* Change it so it was. */ - dgram->dest_name.name_type = 0x1d; - } - - /* For a host announce the workgroup name is the destination name. */ - work_name = dgram->dest_name.name; - - /* - * Syntax servers version 5.1 send HostAnnounce packets to - * *THE WRONG NAME*. They send to LOCAL_MASTER_BROWSER_NAME<00> - * instead of WORKGROUP<1d> name. So to fix this we check if - * the workgroup name is our own name, and if so change it - * to be our primary workgroup name. - */ - - if(strequal(work_name, global_myname())) - work_name = lp_workgroup(); - - /* - * We are being very agressive here in adding a workgroup - * name on the basis of a host announcing itself as being - * in that workgroup. Maybe we should wait for the workgroup - * announce instead ? JRA. - */ - - work = find_workgroup_on_subnet(subrec, work_name); - - if(servertype != 0) - { - if (work ==NULL ) - { - /* We have no record of this workgroup. Add it. */ - if((work = create_workgroup_on_subnet(subrec, work_name, ttl))==NULL) - goto done; - } + inet_ntoa(p->ip), dgram->dest_name.name_type)); + /* Change it so it was. */ + dgram->dest_name.name_type = 0x1d; + } + + /* For a host announce the workgroup name is the destination name. */ + pull_ascii_nstring(work_name, dgram->dest_name.name); + + /* + * Syntax servers version 5.1 send HostAnnounce packets to + * *THE WRONG NAME*. They send to LOCAL_MASTER_BROWSER_NAME<00> + * instead of WORKGROUP<1d> name. So to fix this we check if + * the workgroup name is our own name, and if so change it + * to be our primary workgroup name. + */ + + if(strequal(work_name, global_myname())) + nstrcpy(work_name,lp_workgroup()); + + /* + * We are being very agressive here in adding a workgroup + * name on the basis of a host announcing itself as being + * in that workgroup. Maybe we should wait for the workgroup + * announce instead ? JRA. + */ + + work = find_workgroup_on_subnet(subrec, work_name); + + if(servertype != 0) { + if (work ==NULL ) { + /* We have no record of this workgroup. Add it. */ + if((work = create_workgroup_on_subnet(subrec, work_name, ttl))==NULL) + goto done; + } - if((servrec = find_server_in_workgroup( work, announce_name))==NULL) - { - /* If this server is not already in the workgroup, add it. */ - create_server_on_workgroup(work, announce_name, - servertype|SV_TYPE_LOCAL_LIST_ONLY, - ttl, comment); - } - else - { - /* Update the record. */ - servrec->serv.type = servertype|SV_TYPE_LOCAL_LIST_ONLY; - update_server_ttl( servrec, ttl); - fstrcpy(servrec->serv.comment,comment); - } - } - else - { - /* - * This server is announcing it is going down. Remove it from the - * workgroup. - */ - if(!is_myname(announce_name) && (work != NULL) && - ((servrec = find_server_in_workgroup( work, announce_name))!=NULL) - ) - { - remove_server_from_workgroup( work, servrec); - } - } - subrec->work_changed = True; + if((servrec = find_server_in_workgroup( work, announce_name))==NULL) { + /* If this server is not already in the workgroup, add it. */ + create_server_on_workgroup(work, announce_name, + servertype|SV_TYPE_LOCAL_LIST_ONLY, + ttl, comment); + } else { + /* Update the record. */ + servrec->serv.type = servertype|SV_TYPE_LOCAL_LIST_ONLY; + update_server_ttl( servrec, ttl); + fstrcpy(servrec->serv.comment,comment); + } + } else { + /* + * This server is announcing it is going down. Remove it from the + * workgroup. + */ + if(!is_myname(announce_name) && (work != NULL) && + ((servrec = find_server_in_workgroup( work, announce_name))!=NULL)) { + remove_server_from_workgroup( work, servrec); + } + } + + subrec->work_changed = True; done: - END_PROFILE(host_announce); + + END_PROFILE(host_announce); } /******************************************************************* @@ -199,53 +196,55 @@ done: void process_workgroup_announce(struct subnet_record *subrec, struct packet_struct *p, char *buf) { - struct dgram_packet *dgram = &p->packet.dgram; - int ttl = IVAL(buf,1)/1000; - char *workgroup_announce_name = buf+5; - uint32 servertype = IVAL(buf,23); - char *master_name = buf+31; - struct work_record *work; - char *source_name = dgram->source_name.name; - - START_PROFILE(workgroup_announce); - master_name[43] = 0; - - DEBUG(3,("process_workgroup_announce: from %s<%02x> IP %s to \ + struct dgram_packet *dgram = &p->packet.dgram; + int ttl = IVAL(buf,1)/1000; + nstring workgroup_announce_name; + nstring master_name; + uint32 servertype = IVAL(buf,23); + struct work_record *work; + nstring source_name; + nstring dest_name; + + START_PROFILE(workgroup_announce); + + pull_ascii_nstring(workgroup_announce_name,buf+5); + pull_ascii_nstring(master_name,buf+31); + pull_ascii_nstring(source_name,dgram->source_name.name); + pull_ascii_nstring(dest_name,dgram->dest_name.name); + + DEBUG(3,("process_workgroup_announce: from %s<%02x> IP %s to \ %s for workgroup %s.\n", source_name, source_name[15], inet_ntoa(p->ip), - nmb_namestr(&dgram->dest_name),workgroup_announce_name)); - - DEBUG(5,("process_workgroup_announce: ttl=%d server type=%08x master browser=%s\n", - ttl, servertype, master_name)); - - /* Workgroup announcements must only go to the MSBROWSE name. */ - if (!strequal(dgram->dest_name.name, MSBROWSE) || (dgram->dest_name.name_type != 0x1)) - { - DEBUG(0,("process_workgroup_announce: from IP %s should be to __MSBROWSE__<0x01> not %s\n", - inet_ntoa(p->ip), nmb_namestr(&dgram->dest_name))); - goto done; - } + nmb_namestr(&dgram->dest_name),workgroup_announce_name)); + + DEBUG(5,("process_workgroup_announce: ttl=%d server type=%08x master browser=%s\n", + ttl, servertype, master_name)); + + /* Workgroup announcements must only go to the MSBROWSE name. */ + if (!strequal(dest_name, MSBROWSE) || (dgram->dest_name.name_type != 0x1)) { + DEBUG(0,("process_workgroup_announce: from IP %s should be to __MSBROWSE__<0x01> not %s\n", + inet_ntoa(p->ip), nmb_namestr(&dgram->dest_name))); + goto done; + } + + if ((work = find_workgroup_on_subnet(subrec, workgroup_announce_name))==NULL) { + /* We have no record of this workgroup. Add it. */ + if((work = create_workgroup_on_subnet(subrec, workgroup_announce_name, ttl))==NULL) + goto done; + } else { + /* Update the workgroup death_time. */ + update_workgroup_ttl(work, ttl); + } + + if(*work->local_master_browser_name == '\0') { + /* Set the master browser name. */ + set_workgroup_local_master_browser_name( work, master_name ); + } + + subrec->work_changed = True; - if ((work = find_workgroup_on_subnet(subrec, workgroup_announce_name))==NULL) - { - /* We have no record of this workgroup. Add it. */ - if((work = create_workgroup_on_subnet(subrec, workgroup_announce_name, ttl))==NULL) - goto done; - } - else - { - /* Update the workgroup death_time. */ - update_workgroup_ttl(work, ttl); - } - - if(*work->local_master_browser_name == '\0') - { - /* Set the master browser name. */ - set_workgroup_local_master_browser_name( work, master_name ); - } - - subrec->work_changed = True; done: - END_PROFILE(workgroup_announce); + + END_PROFILE(workgroup_announce); } /******************************************************************* @@ -254,117 +253,110 @@ done: void process_local_master_announce(struct subnet_record *subrec, struct packet_struct *p, char *buf) { - struct dgram_packet *dgram = &p->packet.dgram; - int ttl = IVAL(buf,1)/1000; - char *server_name = buf+5; - uint32 servertype = IVAL(buf,23); - char *comment = buf+31; - char *work_name; - struct work_record *work; - struct server_record *servrec; - char *source_name = dgram->source_name.name; - - START_PROFILE(local_master_announce); - comment[43] = 0; - - DEBUG(3,("process_local_master_announce: from %s<%02x> IP %s to \ + struct dgram_packet *dgram = &p->packet.dgram; + int ttl = IVAL(buf,1)/1000; + nstring server_name; + uint32 servertype = IVAL(buf,23); + fstring comment; + nstring work_name; + struct work_record *work; + struct server_record *servrec; + nstring source_name; + + START_PROFILE(local_master_announce); + + pull_ascii_nstring(server_name,buf+5); + pull_ascii_fstring(comment, buf+31); + comment[42] = 0; + pull_ascii_nstring(source_name, dgram->source_name.name); + pull_ascii_nstring(work_name, dgram->dest_name.name); + + DEBUG(3,("process_local_master_announce: from %s<%02x> IP %s to \ %s for server %s.\n", source_name, source_name[15], inet_ntoa(p->ip), - nmb_namestr(&dgram->dest_name),server_name)); + nmb_namestr(&dgram->dest_name),server_name)); - DEBUG(5,("process_local_master_announce: ttl=%d server type=%08x comment=%s\n", - ttl, servertype, comment)); + DEBUG(5,("process_local_master_announce: ttl=%d server type=%08x comment=%s\n", + ttl, servertype, comment)); - /* A local master announcement must be sent to the name WORKGROUP<1e>. */ - if(dgram->dest_name.name_type != 0x1e) - { - DEBUG(0,("process_local_master_announce: incorrect name type for destination from IP %s \ + /* A local master announcement must be sent to the name WORKGROUP<1e>. */ + if(dgram->dest_name.name_type != 0x1e) { + DEBUG(0,("process_local_master_announce: incorrect name type for destination from IP %s \ (was %02x) should be 0x1e. Ignoring packet.\n", - inet_ntoa(p->ip), dgram->dest_name.name_type)); - goto done; - } - - /* Filter servertype to remove impossible bits. */ - servertype &= ~(SV_TYPE_LOCAL_LIST_ONLY|SV_TYPE_DOMAIN_ENUM); - - /* For a local master announce the workgroup name is the destination name. */ - work_name = dgram->dest_name.name; - - if ((work = find_workgroup_on_subnet(subrec, work_name))==NULL) - { - /* Don't bother adding if it's a local master release announce. */ - if(servertype == 0) - goto done; - - /* We have no record of this workgroup. Add it. */ - if((work = create_workgroup_on_subnet(subrec, work_name, ttl))==NULL) - goto done; - } - - /* If we think we're the local master browser for this workgroup, - we should never have got this packet. We don't see our own - packets. - */ - if(AM_LOCAL_MASTER_BROWSER(work)) - { - DEBUG(0,("process_local_master_announce: Server %s at IP %s is announcing itself as \ + inet_ntoa(p->ip), dgram->dest_name.name_type)); + goto done; + } + + /* Filter servertype to remove impossible bits. */ + servertype &= ~(SV_TYPE_LOCAL_LIST_ONLY|SV_TYPE_DOMAIN_ENUM); + + /* For a local master announce the workgroup name is the destination name. */ + + if ((work = find_workgroup_on_subnet(subrec, work_name))==NULL) { + /* Don't bother adding if it's a local master release announce. */ + if(servertype == 0) + goto done; + + /* We have no record of this workgroup. Add it. */ + if((work = create_workgroup_on_subnet(subrec, work_name, ttl))==NULL) + goto done; + } + + /* If we think we're the local master browser for this workgroup, + we should never have got this packet. We don't see our own + packets. + */ + if(AM_LOCAL_MASTER_BROWSER(work)) { + DEBUG(0,("process_local_master_announce: Server %s at IP %s is announcing itself as \ a local master browser for workgroup %s and we think we are master. Forcing election.\n", - server_name, inet_ntoa(p->ip), work_name)); + server_name, inet_ntoa(p->ip), work_name)); - /* Samba nmbd versions 1.9.17 to 1.9.17p4 have a bug in that when - they have become a local master browser once, they will never - stop sending local master announcements. To fix this we send - them a reset browser packet, with level 0x2 on the __SAMBA__ - name that only they should be listening to. */ + /* Samba nmbd versions 1.9.17 to 1.9.17p4 have a bug in that when + they have become a local master browser once, they will never + stop sending local master announcements. To fix this we send + them a reset browser packet, with level 0x2 on the __SAMBA__ + name that only they should be listening to. */ - send_browser_reset( 0x2, "__SAMBA__" , 0x20, p->ip); - - /* We should demote ourself and force an election. */ - - unbecome_local_master_browser( subrec, work, True); - - /* The actual election requests are handled in - nmbd_election.c */ - goto done; - } - - /* Find the server record on this workgroup. If it doesn't exist, add it. */ - - if(servertype != 0) - { - if((servrec = find_server_in_workgroup( work, server_name))==NULL) - { - /* If this server is not already in the workgroup, add it. */ - create_server_on_workgroup(work, server_name, - servertype|SV_TYPE_LOCAL_LIST_ONLY, - ttl, comment); - } - else - { - /* Update the record. */ - servrec->serv.type = servertype|SV_TYPE_LOCAL_LIST_ONLY; - update_server_ttl(servrec, ttl); - fstrcpy(servrec->serv.comment,comment); - } - - set_workgroup_local_master_browser_name( work, server_name ); - } - else - { - /* - * This server is announcing it is going down. Remove it from the - * workgroup. - */ - if(!is_myname(server_name) && (work != NULL) && - ((servrec = find_server_in_workgroup( work, server_name))!=NULL) - ) - { - remove_server_from_workgroup( work, servrec); - } - } - - subrec->work_changed = True; + send_browser_reset( 0x2, "__SAMBA__" , 0x20, p->ip); + + /* We should demote ourself and force an election. */ + + unbecome_local_master_browser( subrec, work, True); + + /* The actual election requests are handled in nmbd_election.c */ + goto done; + } + + /* Find the server record on this workgroup. If it doesn't exist, add it. */ + + if(servertype != 0) { + if((servrec = find_server_in_workgroup( work, server_name))==NULL) { + /* If this server is not already in the workgroup, add it. */ + create_server_on_workgroup(work, server_name, + servertype|SV_TYPE_LOCAL_LIST_ONLY, + ttl, comment); + } else { + /* Update the record. */ + servrec->serv.type = servertype|SV_TYPE_LOCAL_LIST_ONLY; + update_server_ttl(servrec, ttl); + fstrcpy(servrec->serv.comment,comment); + } + + set_workgroup_local_master_browser_name( work, server_name ); + } else { + /* + * This server is announcing it is going down. Remove it from the + * workgroup. + */ + if(!is_myname(server_name) && (work != NULL) && + ((servrec = find_server_in_workgroup( work, server_name))!=NULL)) { + remove_server_from_workgroup( work, servrec); + } + } + + subrec->work_changed = True; done: - END_PROFILE(local_master_announce); + + END_PROFILE(local_master_announce); } /******************************************************************* @@ -377,50 +369,49 @@ done: void process_master_browser_announce(struct subnet_record *subrec, struct packet_struct *p,char *buf) { - char *local_master_name = buf; - struct work_record *work; - struct browse_cache_record *browrec; + nstring local_master_name; + struct work_record *work; + struct browse_cache_record *browrec; - START_PROFILE(master_browser_announce); - local_master_name[15] = 0; + START_PROFILE(master_browser_announce); + + pull_ascii_nstring(local_master_name,buf); - DEBUG(3,("process_master_browser_announce: Local master announce from %s IP %s.\n", - local_master_name, inet_ntoa(p->ip))); + DEBUG(3,("process_master_browser_announce: Local master announce from %s IP %s.\n", + local_master_name, inet_ntoa(p->ip))); - if (!lp_domain_master()) - { - DEBUG(0,("process_master_browser_announce: Not configured as domain \ + if (!lp_domain_master()) { + DEBUG(0,("process_master_browser_announce: Not configured as domain \ master - ignoring master announce.\n")); - goto done; - } + goto done; + } - if((work = find_workgroup_on_subnet(subrec, lp_workgroup())) == NULL) - { - DEBUG(0,("process_master_browser_announce: Cannot find workgroup %s on subnet %s\n", - lp_workgroup(), subrec->subnet_name)); - goto done; - } - - if(!AM_DOMAIN_MASTER_BROWSER(work)) - { - DEBUG(0,("process_master_browser_announce: Local master announce made to us from \ + if((work = find_workgroup_on_subnet(subrec, lp_workgroup())) == NULL) { + DEBUG(0,("process_master_browser_announce: Cannot find workgroup %s on subnet %s\n", + lp_workgroup(), subrec->subnet_name)); + goto done; + } + + if(!AM_DOMAIN_MASTER_BROWSER(work)) { + DEBUG(0,("process_master_browser_announce: Local master announce made to us from \ %s IP %s and we are not a domain master browser.\n", local_master_name, inet_ntoa(p->ip))); - goto done; - } + goto done; + } - /* Add this host as a local master browser entry on the browse lists. - This causes a sync request to be made to it at a later date. - */ + /* Add this host as a local master browser entry on the browse lists. + This causes a sync request to be made to it at a later date. + */ + + if((browrec = find_browser_in_lmb_cache( local_master_name )) == NULL) { + /* Add it. */ + create_browser_in_lmb_cache( work->work_group, local_master_name, p->ip); + } else { + update_browser_death_time(browrec); + } - if((browrec = find_browser_in_lmb_cache( local_master_name )) == NULL) - { - /* Add it. */ - create_browser_in_lmb_cache( work->work_group, local_master_name, p->ip); - } - else - update_browser_death_time(browrec); done: - END_PROFILE(master_browser_announce); + + END_PROFILE(master_browser_announce); } /******************************************************************* @@ -429,123 +420,117 @@ done: void process_lm_host_announce(struct subnet_record *subrec, struct packet_struct *p, char *buf) { - struct dgram_packet *dgram = &p->packet.dgram; - uint32 servertype = IVAL(buf,1); - int osmajor=CVAL(buf,5); /* major version of node software */ - int osminor=CVAL(buf,6); /* minor version of node software */ - int ttl = SVAL(buf,7); - char *announce_name = buf+9; - struct work_record *work; - struct server_record *servrec; - const char *work_name; - char *source_name = dgram->source_name.name; - pstring comment; - char *s = buf+9; - - START_PROFILE(lm_host_announce); - s = skip_string(s,1); - StrnCpy(comment, s, 43); - - DEBUG(3,("process_lm_host_announce: LM Announcement from %s<%02x> IP %s to \ -%s for server %s.\n", source_name, source_name[15], inet_ntoa(p->ip), - nmb_namestr(&dgram->dest_name),announce_name)); - - DEBUG(5,("process_lm_host_announce: os=(%d,%d) ttl=%d server type=%08x comment=%s\n", - osmajor, osminor, ttl, servertype,comment)); - - if ((osmajor < 36) || (osmajor > 38) || (osminor !=0)) - { - DEBUG(5,("process_lm_host_announce: LM Announcement packet does not \ + struct dgram_packet *dgram = &p->packet.dgram; + uint32 servertype = IVAL(buf,1); + int osmajor=CVAL(buf,5); /* major version of node software */ + int osminor=CVAL(buf,6); /* minor version of node software */ + int ttl = SVAL(buf,7); + nstring announce_name; + struct work_record *work; + struct server_record *servrec; + nstring work_name; + nstring source_name; + fstring comment; + char *s = buf+9; + + START_PROFILE(lm_host_announce); + s = skip_string(s,1); + pull_ascii(comment, s, sizeof(fstring), 43, STR_TERMINATE); + + pull_ascii_nstring(announce_name,buf+9); + pull_ascii_nstring(source_name,dgram->source_name.name); + /* For a LanMan host announce the workgroup name is the destination name. */ + pull_ascii_nstring(work_name,dgram->dest_name.name); + + DEBUG(3,("process_lm_host_announce: LM Announcement from %s IP %s to \ +%s for server %s.\n", nmb_namestr(&dgram->source_name), inet_ntoa(p->ip), + nmb_namestr(&dgram->dest_name),announce_name)); + + DEBUG(5,("process_lm_host_announce: os=(%d,%d) ttl=%d server type=%08x comment=%s\n", + osmajor, osminor, ttl, servertype,comment)); + + if ((osmajor < 36) || (osmajor > 38) || (osminor !=0)) { + DEBUG(5,("process_lm_host_announce: LM Announcement packet does not \ originate from OS/2 Warp client. Ignoring packet.\n")); - /* Could have been from a Windows machine (with its LM Announce enabled), - or a Samba server. Then don't disrupt the current browse list. */ - goto done; - } + /* Could have been from a Windows machine (with its LM Announce enabled), + or a Samba server. Then don't disrupt the current browse list. */ + goto done; + } - /* Filter servertype to remove impossible bits. */ - servertype &= ~(SV_TYPE_LOCAL_LIST_ONLY|SV_TYPE_DOMAIN_ENUM); + /* Filter servertype to remove impossible bits. */ + servertype &= ~(SV_TYPE_LOCAL_LIST_ONLY|SV_TYPE_DOMAIN_ENUM); - /* A LanMan host announcement must be sent to the name WORKGROUP<00>. */ - if(dgram->dest_name.name_type != 0x00) - { - DEBUG(2,("process_lm_host_announce: incorrect name type for destination from IP %s \ + /* A LanMan host announcement must be sent to the name WORKGROUP<00>. */ + if(dgram->dest_name.name_type != 0x00) { + DEBUG(2,("process_lm_host_announce: incorrect name type for destination from IP %s \ (was %02x) should be 0x00. Allowing packet anyway.\n", - inet_ntoa(p->ip), dgram->dest_name.name_type)); - /* Change it so it was. */ - dgram->dest_name.name_type = 0x00; - } - - /* For a LanMan host announce the workgroup name is the destination name. */ - work_name = dgram->dest_name.name; - - /* - * Syntax servers version 5.1 send HostAnnounce packets to - * *THE WRONG NAME*. They send to LOCAL_MASTER_BROWSER_NAME<00> - * instead of WORKGROUP<1d> name. So to fix this we check if - * the workgroup name is our own name, and if so change it - * to be our primary workgroup name. This code is probably - * not needed in the LanMan announce code, but it won't hurt. - */ - - if(strequal(work_name, global_myname())) - work_name = lp_workgroup(); - - /* - * We are being very agressive here in adding a workgroup - * name on the basis of a host announcing itself as being - * in that workgroup. Maybe we should wait for the workgroup - * announce instead ? JRA. - */ + inet_ntoa(p->ip), dgram->dest_name.name_type)); + /* Change it so it was. */ + dgram->dest_name.name_type = 0x00; + } + + /* + * Syntax servers version 5.1 send HostAnnounce packets to + * *THE WRONG NAME*. They send to LOCAL_MASTER_BROWSER_NAME<00> + * instead of WORKGROUP<1d> name. So to fix this we check if + * the workgroup name is our own name, and if so change it + * to be our primary workgroup name. This code is probably + * not needed in the LanMan announce code, but it won't hurt. + */ + + if(strequal(work_name, global_myname())) + nstrcpy(work_name,lp_workgroup()); + + /* + * We are being very agressive here in adding a workgroup + * name on the basis of a host announcing itself as being + * in that workgroup. Maybe we should wait for the workgroup + * announce instead ? JRA. + */ + + work = find_workgroup_on_subnet(subrec, work_name); + + if(servertype != 0) { + if (work == NULL) { + /* We have no record of this workgroup. Add it. */ + if((work = create_workgroup_on_subnet(subrec, work_name, ttl))==NULL) + goto done; + } + + if((servrec = find_server_in_workgroup( work, announce_name))==NULL) { + /* If this server is not already in the workgroup, add it. */ + create_server_on_workgroup(work, announce_name, + servertype|SV_TYPE_LOCAL_LIST_ONLY, + ttl, comment); + } else { + /* Update the record. */ + servrec->serv.type = servertype|SV_TYPE_LOCAL_LIST_ONLY; + update_server_ttl( servrec, ttl); + fstrcpy(servrec->serv.comment,comment); + } + } else { + /* + * This server is announcing it is going down. Remove it from the + * workgroup. + */ + if(!is_myname(announce_name) && (work != NULL) && + ((servrec = find_server_in_workgroup( work, announce_name))!=NULL)) { + remove_server_from_workgroup( work, servrec); + } + } + + subrec->work_changed = True; + found_lm_clients = True; - work = find_workgroup_on_subnet(subrec, work_name); - - if(servertype != 0) - { - if (work == NULL) - { - /* We have no record of this workgroup. Add it. */ - if((work = create_workgroup_on_subnet(subrec, work_name, ttl))==NULL) - goto done; - } - - if((servrec = find_server_in_workgroup( work, announce_name))==NULL) - { - /* If this server is not already in the workgroup, add it. */ - create_server_on_workgroup(work, announce_name, - servertype|SV_TYPE_LOCAL_LIST_ONLY, - ttl, comment); - } - else - { - /* Update the record. */ - servrec->serv.type = servertype|SV_TYPE_LOCAL_LIST_ONLY; - update_server_ttl( servrec, ttl); - fstrcpy(servrec->serv.comment,comment); - } - } - else - { - /* - * This server is announcing it is going down. Remove it from the - * workgroup. - */ - if(!is_myname(announce_name) && (work != NULL) && - ((servrec = find_server_in_workgroup( work, announce_name))!=NULL) - ) - { - remove_server_from_workgroup( work, servrec); - } - } - - subrec->work_changed = True; - found_lm_clients = True; done: - END_PROFILE(lm_host_announce); + + END_PROFILE(lm_host_announce); } /**************************************************************************** Send a backup list response. *****************************************************************************/ + static void send_backup_list_response(struct subnet_record *subrec, struct work_record *work, struct nmb_name *send_to_name, @@ -553,40 +538,41 @@ static void send_backup_list_response(struct subnet_record *subrec, uint32 token, struct in_addr sendto_ip, int port) { - char outbuf[1024]; - char *p, *countptr; - unsigned int count = 0; + char outbuf[1024]; + char *p, *countptr; + unsigned int count = 0; + nstring send_to_namestr; #if 0 struct server_record *servrec; #endif - fstring myname; + fstring myname; - memset(outbuf,'\0',sizeof(outbuf)); + memset(outbuf,'\0',sizeof(outbuf)); - DEBUG(3,("send_backup_list_response: sending backup list for workgroup %s to %s IP %s\n", - work->work_group, nmb_namestr(send_to_name), inet_ntoa(sendto_ip))); + DEBUG(3,("send_backup_list_response: sending backup list for workgroup %s to %s IP %s\n", + work->work_group, nmb_namestr(send_to_name), inet_ntoa(sendto_ip))); - p = outbuf; + p = outbuf; - SCVAL(p,0,ANN_GetBackupListResp); /* Backup list response opcode. */ - p++; + SCVAL(p,0,ANN_GetBackupListResp); /* Backup list response opcode. */ + p++; - countptr = p; - p++; + countptr = p; + p++; - SIVAL(p,0,token); /* The sender's unique info. */ - p += 4; + SIVAL(p,0,token); /* The sender's unique info. */ + p += 4; - /* We always return at least one name - our own. */ - count = 1; - fstrcpy(myname, global_myname()); - strupper_m(myname); - myname[15]='\0'; - push_pstring_base(p, myname, outbuf); + /* We always return at least one name - our own. */ + count = 1; + fstrcpy(myname, global_myname()); + strupper_m(myname); + myname[15]='\0'; + push_pstring_base(p, myname, outbuf); - p = skip_string(p,1); + p = skip_string(p,1); - /* Look for backup browsers in this workgroup. */ + /* Look for backup browsers in this workgroup. */ #if 0 /* we don't currently send become_backup requests so we should never @@ -624,16 +610,18 @@ static void send_backup_list_response(struct subnet_record *subrec, } #endif - SCVAL(countptr, 0, count); + SCVAL(countptr, 0, count); + + pull_ascii_nstring(send_to_namestr, send_to_name->name); - DEBUG(4,("send_backup_list_response: sending response to %s<00> IP %s with %d servers.\n", - send_to_name->name, inet_ntoa(sendto_ip), count)); + DEBUG(4,("send_backup_list_response: sending response to %s<00> IP %s with %d servers.\n", + send_to_namestr, inet_ntoa(sendto_ip), count)); - send_mailslot(True, BROWSE_MAILSLOT, - outbuf,PTR_DIFF(p,outbuf), - global_myname(), 0, - send_to_name->name,0, - sendto_ip, subrec->myip, port); + send_mailslot(True, BROWSE_MAILSLOT, + outbuf,PTR_DIFF(p,outbuf), + global_myname(), 0, + send_to_namestr,0, + sendto_ip, subrec->myip, port); } /******************************************************************* @@ -649,80 +637,74 @@ static void send_backup_list_response(struct subnet_record *subrec, void process_get_backup_list_request(struct subnet_record *subrec, struct packet_struct *p,char *buf) { - struct dgram_packet *dgram = &p->packet.dgram; - struct work_record *work; - unsigned char max_number_requested = CVAL(buf,0); - uint32 token = IVAL(buf,1); /* Sender's key index for the workgroup. */ - int name_type = dgram->dest_name.name_type; - char *workgroup_name = dgram->dest_name.name; - struct subnet_record *search_subrec = subrec; - - START_PROFILE(get_backup_list); - DEBUG(3,("process_get_backup_list_request: request from %s IP %s to %s.\n", - nmb_namestr(&dgram->source_name), inet_ntoa(p->ip), - nmb_namestr(&dgram->dest_name))); + struct dgram_packet *dgram = &p->packet.dgram; + struct work_record *work; + unsigned char max_number_requested = CVAL(buf,0); + uint32 token = IVAL(buf,1); /* Sender's key index for the workgroup. */ + int name_type = dgram->dest_name.name_type; + nstring workgroup_name; + struct subnet_record *search_subrec = subrec; + + START_PROFILE(get_backup_list); + pull_ascii_nstring(workgroup_name, dgram->dest_name.name); + + DEBUG(3,("process_get_backup_list_request: request from %s IP %s to %s.\n", + nmb_namestr(&dgram->source_name), inet_ntoa(p->ip), + nmb_namestr(&dgram->dest_name))); - /* We have to be a master browser, or a domain master browser - for the requested workgroup. That means it must be our - workgroup. */ - - if(strequal(workgroup_name, lp_workgroup()) == False) - { - DEBUG(7,("process_get_backup_list_request: Ignoring announce request for workgroup %s.\n", - workgroup_name)); - goto done; - } - - if((work = find_workgroup_on_subnet(search_subrec, workgroup_name)) == NULL) - { - DEBUG(0,("process_get_backup_list_request: Cannot find workgroup %s on \ + /* We have to be a master browser, or a domain master browser + for the requested workgroup. That means it must be our + workgroup. */ + + if(strequal(workgroup_name, lp_workgroup()) == False) { + DEBUG(7,("process_get_backup_list_request: Ignoring announce request for workgroup %s.\n", + workgroup_name)); + goto done; + } + + if((work = find_workgroup_on_subnet(search_subrec, workgroup_name)) == NULL) { + DEBUG(0,("process_get_backup_list_request: Cannot find workgroup %s on \ subnet %s.\n", workgroup_name, search_subrec->subnet_name)); - goto done; - } + goto done; + } - /* - * If the packet was sent to WORKGROUP<1b> instead - * of WORKGROUP<1d> then it was unicast to us a domain master - * browser. Change search subrec to unicast. - */ + /* + * If the packet was sent to WORKGROUP<1b> instead + * of WORKGROUP<1d> then it was unicast to us a domain master + * browser. Change search subrec to unicast. + */ - if(name_type == 0x1b) - { - /* We must be a domain master browser in order to - process this packet. */ + if(name_type == 0x1b) { + /* We must be a domain master browser in order to + process this packet. */ - if(!AM_DOMAIN_MASTER_BROWSER(work)) - { - DEBUG(0,("process_get_backup_list_request: domain list requested for workgroup %s \ + if(!AM_DOMAIN_MASTER_BROWSER(work)) { + DEBUG(0,("process_get_backup_list_request: domain list requested for workgroup %s \ and I am not a domain master browser.\n", workgroup_name)); - goto done; - } + goto done; + } - search_subrec = unicast_subnet; - } - else if (name_type == 0x1d) - { - /* We must be a local master browser in order to - process this packet. */ + search_subrec = unicast_subnet; + } else if (name_type == 0x1d) { + /* We must be a local master browser in order to process this packet. */ - if(!AM_LOCAL_MASTER_BROWSER(work)) - { - DEBUG(0,("process_get_backup_list_request: domain list requested for workgroup %s \ + if(!AM_LOCAL_MASTER_BROWSER(work)) { + DEBUG(0,("process_get_backup_list_request: domain list requested for workgroup %s \ and I am not a local master browser.\n", workgroup_name)); - goto done; - } - } - else - { - DEBUG(0,("process_get_backup_list_request: Invalid name type %x - should be 0x1b or 0x1d.\n", - name_type)); - goto done; - } + goto done; + } + } else { + DEBUG(0,("process_get_backup_list_request: Invalid name type %x - should be 0x1b or 0x1d.\n", + name_type)); + goto done; + } + + send_backup_list_response(subrec, work, &dgram->source_name, + max_number_requested, token, p->ip, p->port); - send_backup_list_response(subrec, work, &dgram->source_name, - max_number_requested, token, p->ip, p->port); done: - END_PROFILE(get_backup_list); + + END_PROFILE(get_backup_list); } /******************************************************************* @@ -738,49 +720,46 @@ done: void process_reset_browser(struct subnet_record *subrec, struct packet_struct *p,char *buf) { - struct dgram_packet *dgram = &p->packet.dgram; - int state = CVAL(buf,0); - struct subnet_record *sr; + struct dgram_packet *dgram = &p->packet.dgram; + int state = CVAL(buf,0); + struct subnet_record *sr; - START_PROFILE(reset_browser); - DEBUG(1,("process_reset_browser: received diagnostic browser reset \ -request from %s IP %s state=0x%X\n", - nmb_namestr(&dgram->source_name), inet_ntoa(p->ip), state)); + START_PROFILE(reset_browser); - /* Stop being a local master browser on all our broadcast subnets. */ - if (state & 0x1) - { - for (sr = FIRST_SUBNET; sr; sr = NEXT_SUBNET_EXCLUDING_UNICAST(sr)) - { - struct work_record *work; - for (work = sr->workgrouplist; work; work = work->next) - { - if (AM_LOCAL_MASTER_BROWSER(work)) - unbecome_local_master_browser(sr, work, True); - } - } - } + DEBUG(1,("process_reset_browser: received diagnostic browser reset \ +request from %s IP %s state=0x%X\n", + nmb_namestr(&dgram->source_name), inet_ntoa(p->ip), state)); + + /* Stop being a local master browser on all our broadcast subnets. */ + if (state & 0x1) { + for (sr = FIRST_SUBNET; sr; sr = NEXT_SUBNET_EXCLUDING_UNICAST(sr)) { + struct work_record *work; + for (work = sr->workgrouplist; work; work = work->next) { + if (AM_LOCAL_MASTER_BROWSER(work)) + unbecome_local_master_browser(sr, work, True); + } + } + } - /* Discard our browse lists. */ - if (state & 0x2) - { - /* - * Calling expire_workgroups_and_servers with a -1 - * time causes all servers not marked with a PERMANENT_TTL - * on the workgroup lists to be discarded, and all - * workgroups with empty server lists to be discarded. - * This means we keep our own server names and workgroup - * as these have a PERMANENT_TTL. - */ - - expire_workgroups_and_servers(-1); - } + /* Discard our browse lists. */ + if (state & 0x2) { + /* + * Calling expire_workgroups_and_servers with a -1 + * time causes all servers not marked with a PERMANENT_TTL + * on the workgroup lists to be discarded, and all + * workgroups with empty server lists to be discarded. + * This means we keep our own server names and workgroup + * as these have a PERMANENT_TTL. + */ + + expire_workgroups_and_servers(-1); + } - /* Request to stop browsing altogether. */ - if (state & 0x4) - DEBUG(1,("process_reset_browser: ignoring request to stop being a browser.\n")); + /* Request to stop browsing altogether. */ + if (state & 0x4) + DEBUG(1,("process_reset_browser: ignoring request to stop being a browser.\n")); - END_PROFILE(reset_browser); + END_PROFILE(reset_browser); } /******************************************************************* @@ -793,33 +772,34 @@ request from %s IP %s state=0x%X\n", void process_announce_request(struct subnet_record *subrec, struct packet_struct *p, char *buf) { - struct dgram_packet *dgram = &p->packet.dgram; - struct work_record *work; - char *workgroup_name = dgram->dest_name.name; + struct dgram_packet *dgram = &p->packet.dgram; + struct work_record *work; + nstring workgroup_name; - START_PROFILE(announce_request); - DEBUG(3,("process_announce_request: Announce request from %s IP %s to %s.\n", - nmb_namestr(&dgram->source_name), inet_ntoa(p->ip), - nmb_namestr(&dgram->dest_name))); - - /* We only send announcement requests on our workgroup. */ - if(strequal(workgroup_name, lp_workgroup()) == False) - { - DEBUG(7,("process_announce_request: Ignoring announce request for workgroup %s.\n", - workgroup_name)); - goto done; - } - - if((work = find_workgroup_on_subnet(subrec, workgroup_name)) == NULL) - { - DEBUG(0,("process_announce_request: Unable to find workgroup %s on subnet !\n", - workgroup_name)); - goto done; - } + START_PROFILE(announce_request); - work->needannounce = True; + pull_ascii_nstring(workgroup_name, dgram->dest_name.name); + DEBUG(3,("process_announce_request: Announce request from %s IP %s to %s.\n", + nmb_namestr(&dgram->source_name), inet_ntoa(p->ip), + nmb_namestr(&dgram->dest_name))); + + /* We only send announcement requests on our workgroup. */ + if(strequal(workgroup_name, lp_workgroup()) == False) { + DEBUG(7,("process_announce_request: Ignoring announce request for workgroup %s.\n", + workgroup_name)); + goto done; + } + + if((work = find_workgroup_on_subnet(subrec, workgroup_name)) == NULL) { + DEBUG(0,("process_announce_request: Unable to find workgroup %s on subnet !\n", + workgroup_name)); + goto done; + } + + work->needannounce = True; done: - END_PROFILE(lm_host_announce); + + END_PROFILE(lm_host_announce); } /******************************************************************* @@ -833,30 +813,32 @@ done: void process_lm_announce_request(struct subnet_record *subrec, struct packet_struct *p, char *buf) { - struct dgram_packet *dgram = &p->packet.dgram; - char *workgroup_name = dgram->dest_name.name; + struct dgram_packet *dgram = &p->packet.dgram; + nstring workgroup_name; - START_PROFILE(lm_announce_request); - DEBUG(3,("process_lm_announce_request: Announce request from %s IP %s to %s.\n", - nmb_namestr(&dgram->source_name), inet_ntoa(p->ip), - nmb_namestr(&dgram->dest_name))); + START_PROFILE(lm_announce_request); - /* We only send announcement requests on our workgroup. */ - if(strequal(workgroup_name, lp_workgroup()) == False) - { - DEBUG(7,("process_lm_announce_request: Ignoring announce request for workgroup %s.\n", - workgroup_name)); - goto done; - } + pull_ascii_nstring(workgroup_name, dgram->dest_name.name); + DEBUG(3,("process_lm_announce_request: Announce request from %s IP %s to %s.\n", + nmb_namestr(&dgram->source_name), inet_ntoa(p->ip), + nmb_namestr(&dgram->dest_name))); - if(find_workgroup_on_subnet(subrec, workgroup_name) == NULL) - { - DEBUG(0,("process_announce_request: Unable to find workgroup %s on subnet !\n", - workgroup_name)); - goto done; - } + /* We only send announcement requests on our workgroup. */ + if(strequal(workgroup_name, lp_workgroup()) == False) { + DEBUG(7,("process_lm_announce_request: Ignoring announce request for workgroup %s.\n", + workgroup_name)); + goto done; + } + + if(find_workgroup_on_subnet(subrec, workgroup_name) == NULL) { + DEBUG(0,("process_announce_request: Unable to find workgroup %s on subnet !\n", + workgroup_name)); + goto done; + } + + found_lm_clients = True; - found_lm_clients = True; done: - END_PROFILE(lm_host_announce); + + END_PROFILE(lm_host_announce); } diff --git a/source3/nmbd/nmbd_incomingrequests.c b/source3/nmbd/nmbd_incomingrequests.c index a3faf5e104..dd999fbdf7 100644 --- a/source3/nmbd/nmbd_incomingrequests.c +++ b/source3/nmbd/nmbd_incomingrequests.c @@ -3,7 +3,7 @@ NBT netbios routines and daemon - version 2 Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -33,18 +33,18 @@ Send a name release response. static void send_name_release_response(int rcode, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - char rdata[6]; + struct nmb_packet *nmb = &p->packet.nmb; + char rdata[6]; - memcpy(&rdata[0], &nmb->additional->rdata[0], 6); + memcpy(&rdata[0], &nmb->additional->rdata[0], 6); - reply_netbios_packet(p, /* Packet to reply to. */ - rcode, /* Result code. */ - NMB_REL, /* nmbd type code. */ - NMB_NAME_RELEASE_OPCODE, /* opcode. */ - 0, /* ttl. */ - rdata, /* data to send. */ - 6); /* data length. */ + reply_netbios_packet(p, /* Packet to reply to. */ + rcode, /* Result code. */ + NMB_REL, /* nmbd type code. */ + NMB_NAME_RELEASE_OPCODE, /* opcode. */ + 0, /* ttl. */ + rdata, /* data to send. */ + 6); /* data length. */ } /**************************************************************************** @@ -55,76 +55,74 @@ Ignore it if it's not one of our names. void process_name_release_request(struct subnet_record *subrec, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - struct in_addr owner_ip; - struct nmb_name *question = &nmb->question.question_name; - BOOL bcast = nmb->header.nm_flags.bcast; - uint16 nb_flags = get_nb_flags(nmb->additional->rdata); - BOOL group = (nb_flags & NB_GROUP) ? True : False; - struct name_record *namerec; - int rcode = 0; + struct nmb_packet *nmb = &p->packet.nmb; + struct in_addr owner_ip; + struct nmb_name *question = &nmb->question.question_name; + nstring qname; + BOOL bcast = nmb->header.nm_flags.bcast; + uint16 nb_flags = get_nb_flags(nmb->additional->rdata); + BOOL group = (nb_flags & NB_GROUP) ? True : False; + struct name_record *namerec; + int rcode = 0; - putip((char *)&owner_ip,&nmb->additional->rdata[2]); + putip((char *)&owner_ip,&nmb->additional->rdata[2]); - if(!bcast) - { - /* We should only get broadcast name release packets here. - Anyone trying to release unicast should be going to a WINS - server. If the code gets here, then either we are not a wins - server and they sent it anyway, or we are a WINS server and - the request was malformed. Either way, log an error here. - and send an error reply back. - */ - DEBUG(0,("process_name_release_request: unicast name release request \ + if(!bcast) { + /* We should only get broadcast name release packets here. + Anyone trying to release unicast should be going to a WINS + server. If the code gets here, then either we are not a wins + server and they sent it anyway, or we are a WINS server and + the request was malformed. Either way, log an error here. + and send an error reply back. + */ + DEBUG(0,("process_name_release_request: unicast name release request \ received for name %s from IP %s on subnet %s. Error - should be sent to WINS server\n", - nmb_namestr(question), inet_ntoa(owner_ip), subrec->subnet_name)); + nmb_namestr(question), inet_ntoa(owner_ip), subrec->subnet_name)); - send_name_release_response(FMT_ERR, p); - return; - } + send_name_release_response(FMT_ERR, p); + return; + } - DEBUG(3,("process_name_release_request: Name release on name %s, \ + DEBUG(3,("process_name_release_request: Name release on name %s, \ subnet %s from owner IP %s\n", - nmb_namestr(&nmb->question.question_name), - subrec->subnet_name, inet_ntoa(owner_ip))); + nmb_namestr(&nmb->question.question_name), + subrec->subnet_name, inet_ntoa(owner_ip))); - /* If someone is releasing a broadcast group name, just ignore it. */ - if( group && !ismyip(owner_ip) ) - return; - - /* - * Code to work around a bug in FTP OnNet software NBT implementation. - * They do a broadcast name release for WORKGROUP<0> and WORKGROUP<1e> - * names and *don't set the group bit* !!!!! - */ - - if( !group && !ismyip(owner_ip) && strequal(question->name, lp_workgroup()) && - ((question->name_type == 0x0) || (question->name_type == 0x1e))) - { - DEBUG(6,("process_name_release_request: FTP OnNet bug workaround. Ignoring \ + /* If someone is releasing a broadcast group name, just ignore it. */ + if( group && !ismyip(owner_ip) ) + return; + + /* + * Code to work around a bug in FTP OnNet software NBT implementation. + * They do a broadcast name release for WORKGROUP<0> and WORKGROUP<1e> + * names and *don't set the group bit* !!!!! + */ + + pull_ascii_nstring(qname, question->name); + if( !group && !ismyip(owner_ip) && strequal(qname, lp_workgroup()) && + ((question->name_type == 0x0) || (question->name_type == 0x1e))) { + DEBUG(6,("process_name_release_request: FTP OnNet bug workaround. Ignoring \ group release name %s from IP %s on subnet %s with no group bit set.\n", - nmb_namestr(question), inet_ntoa(owner_ip), subrec->subnet_name )); - return; - } - - namerec = find_name_on_subnet(subrec, &nmb->question.question_name, FIND_ANY_NAME); - - /* We only care about someone trying to release one of our names. */ - if( namerec - && ( (namerec->data.source == SELF_NAME) - || (namerec->data.source == PERMANENT_NAME) ) ) - { - rcode = ACT_ERR; - DEBUG(0, ("process_name_release_request: Attempt to release name %s from IP %s \ + nmb_namestr(question), inet_ntoa(owner_ip), subrec->subnet_name )); + return; + } + + namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); + + /* We only care about someone trying to release one of our names. */ + if( namerec && ( (namerec->data.source == SELF_NAME) + || (namerec->data.source == PERMANENT_NAME) ) ) { + rcode = ACT_ERR; + DEBUG(0, ("process_name_release_request: Attempt to release name %s from IP %s \ on subnet %s being rejected as it is one of our names.\n", - nmb_namestr(&nmb->question.question_name), inet_ntoa(owner_ip), subrec->subnet_name)); - } + nmb_namestr(&nmb->question.question_name), inet_ntoa(owner_ip), subrec->subnet_name)); + } - if(rcode == 0) - return; + if(rcode == 0) + return; - /* Send a NAME RELEASE RESPONSE (pos/neg) see rfc1002.txt 4.2.10-11 */ - send_name_release_response(rcode, p); + /* Send a NAME RELEASE RESPONSE (pos/neg) see rfc1002.txt 4.2.10-11 */ + send_name_release_response(rcode, p); } /**************************************************************************** @@ -133,18 +131,18 @@ Send a name registration response. static void send_name_registration_response(int rcode, int ttl, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - char rdata[6]; + struct nmb_packet *nmb = &p->packet.nmb; + char rdata[6]; - memcpy(&rdata[0], &nmb->additional->rdata[0], 6); + memcpy(&rdata[0], &nmb->additional->rdata[0], 6); - reply_netbios_packet(p, /* Packet to reply to. */ - rcode, /* Result code. */ - NMB_REG, /* nmbd type code. */ - NMB_NAME_REG_OPCODE, /* opcode. */ - ttl, /* ttl. */ - rdata, /* data to send. */ - 6); /* data length. */ + reply_netbios_packet(p, /* Packet to reply to. */ + rcode, /* Result code. */ + NMB_REG, /* nmbd type code. */ + NMB_NAME_REG_OPCODE, /* opcode. */ + ttl, /* ttl. */ + rdata, /* data to send. */ + 6); /* data length. */ } /**************************************************************************** @@ -154,38 +152,34 @@ Process a name refresh request on a broadcast subnet. void process_name_refresh_request(struct subnet_record *subrec, struct packet_struct *p) { - - struct nmb_packet *nmb = &p->packet.nmb; - struct nmb_name *question = &nmb->question.question_name; - BOOL bcast = nmb->header.nm_flags.bcast; - struct in_addr from_ip; + struct nmb_packet *nmb = &p->packet.nmb; + struct nmb_name *question = &nmb->question.question_name; + BOOL bcast = nmb->header.nm_flags.bcast; + struct in_addr from_ip; - putip((char *)&from_ip,&nmb->additional->rdata[2]); - - if(!bcast) - { - /* We should only get broadcast name refresh packets here. - Anyone trying to refresh unicast should be going to a WINS - server. If the code gets here, then either we are not a wins - server and they sent it anyway, or we are a WINS server and - the request was malformed. Either way, log an error here. - and send an error reply back. - */ - DEBUG(0,("process_name_refresh_request: unicast name registration request \ + putip((char *)&from_ip,&nmb->additional->rdata[2]); + + if(!bcast) { + /* We should only get broadcast name refresh packets here. + Anyone trying to refresh unicast should be going to a WINS + server. If the code gets here, then either we are not a wins + server and they sent it anyway, or we are a WINS server and + the request was malformed. Either way, log an error here. + and send an error reply back. + */ + DEBUG(0,("process_name_refresh_request: unicast name registration request \ received for name %s from IP %s on subnet %s.\n", - nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); - DEBUG(0,("Error - should be sent to WINS server\n")); + nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); + DEBUG(0,("Error - should be sent to WINS server\n")); - send_name_registration_response(FMT_ERR, 0, p); - return; - } + send_name_registration_response(FMT_ERR, 0, p); + return; + } - /* Just log a message. We really don't care about broadcast name - refreshes. */ + /* Just log a message. We really don't care about broadcast name refreshes. */ - DEBUG(3,("process_name_refresh_request: Name refresh for name %s \ + DEBUG(3,("process_name_refresh_request: Name refresh for name %s \ IP %s on subnet %s\n", nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); - } /**************************************************************************** @@ -195,92 +189,83 @@ Process a name registration request on a broadcast subnet. void process_name_registration_request(struct subnet_record *subrec, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - struct nmb_name *question = &nmb->question.question_name; - BOOL bcast = nmb->header.nm_flags.bcast; - uint16 nb_flags = get_nb_flags(nmb->additional->rdata); - BOOL group = (nb_flags & NB_GROUP) ? True : False; - struct name_record *namerec = NULL; - int ttl = nmb->additional->ttl; - struct in_addr from_ip; + struct nmb_packet *nmb = &p->packet.nmb; + struct nmb_name *question = &nmb->question.question_name; + BOOL bcast = nmb->header.nm_flags.bcast; + uint16 nb_flags = get_nb_flags(nmb->additional->rdata); + BOOL group = (nb_flags & NB_GROUP) ? True : False; + struct name_record *namerec = NULL; + int ttl = nmb->additional->ttl; + struct in_addr from_ip; - putip((char *)&from_ip,&nmb->additional->rdata[2]); + putip((char *)&from_ip,&nmb->additional->rdata[2]); - if(!bcast) - { - /* We should only get broadcast name registration packets here. - Anyone trying to register unicast should be going to a WINS - server. If the code gets here, then either we are not a wins - server and they sent it anyway, or we are a WINS server and - the request was malformed. Either way, log an error here. - and send an error reply back. - */ - DEBUG(0,("process_name_registration_request: unicast name registration request \ + if(!bcast) { + /* We should only get broadcast name registration packets here. + Anyone trying to register unicast should be going to a WINS + server. If the code gets here, then either we are not a wins + server and they sent it anyway, or we are a WINS server and + the request was malformed. Either way, log an error here. + and send an error reply back. + */ + DEBUG(0,("process_name_registration_request: unicast name registration request \ received for name %s from IP %s on subnet %s. Error - should be sent to WINS server\n", - nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); + nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); - send_name_registration_response(FMT_ERR, 0, p); - return; - } + send_name_registration_response(FMT_ERR, 0, p); + return; + } - DEBUG(3,("process_name_registration_request: Name registration for name %s \ + DEBUG(3,("process_name_registration_request: Name registration for name %s \ IP %s on subnet %s\n", nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); - /* See if the name already exists. */ - namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); + /* See if the name already exists. */ + namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); - /* - * If the name being registered exists and is a WINS_PROXY_NAME - * then delete the WINS proxy name entry so we don't reply erroneously - * later to queries. - */ - - if((namerec != NULL) && (namerec->data.source == WINS_PROXY_NAME)) - { - remove_name_from_namelist( subrec, namerec ); - namerec = NULL; - } - - if (!group) - { - /* Unique name. */ - - if( (namerec != NULL) - && ( (namerec->data.source == SELF_NAME) - || (namerec->data.source == PERMANENT_NAME) - || NAME_GROUP(namerec) ) ) - { - /* No-one can register one of Samba's names, nor can they - register a name that's a group name as a unique name */ - - send_name_registration_response(ACT_ERR, 0, p); - return; - } - else if(namerec != NULL) - { - /* Update the namelist record with the new information. */ - namerec->data.ip[0] = from_ip; - update_name_ttl(namerec, ttl); - - DEBUG(3,("process_name_registration_request: Updated name record %s \ + /* + * If the name being registered exists and is a WINS_PROXY_NAME + * then delete the WINS proxy name entry so we don't reply erroneously + * later to queries. + */ + + if((namerec != NULL) && (namerec->data.source == WINS_PROXY_NAME)) { + remove_name_from_namelist( subrec, namerec ); + namerec = NULL; + } + + if (!group) { + /* Unique name. */ + + if( (namerec != NULL) + && ( (namerec->data.source == SELF_NAME) + || (namerec->data.source == PERMANENT_NAME) + || NAME_GROUP(namerec) ) ) { + /* No-one can register one of Samba's names, nor can they + register a name that's a group name as a unique name */ + + send_name_registration_response(ACT_ERR, 0, p); + return; + } else if(namerec != NULL) { + /* Update the namelist record with the new information. */ + namerec->data.ip[0] = from_ip; + update_name_ttl(namerec, ttl); + + DEBUG(3,("process_name_registration_request: Updated name record %s \ with IP %s on subnet %s\n",nmb_namestr(&namerec->name),inet_ntoa(from_ip), subrec->subnet_name)); - return; - } - } - else - { - /* Group name. */ - - if( (namerec != NULL) - && !NAME_GROUP(namerec) - && ( (namerec->data.source == SELF_NAME) - || (namerec->data.source == PERMANENT_NAME) ) ) - { - /* Disallow group names when we have a unique name. */ - send_name_registration_response(ACT_ERR, 0, p); - return; - } - } + return; + } + } else { + /* Group name. */ + + if( (namerec != NULL) + && !NAME_GROUP(namerec) + && ( (namerec->data.source == SELF_NAME) + || (namerec->data.source == PERMANENT_NAME) ) ) { + /* Disallow group names when we have a unique name. */ + send_name_registration_response(ACT_ERR, 0, p); + return; + } + } } /**************************************************************************** @@ -290,147 +275,150 @@ We put our own names first, then in alphabetical order. static int status_compare(char *n1,char *n2) { - int l1,l2,l3; - - /* It's a bit tricky because the names are space padded */ - for (l1=0;l1<15 && n1[l1] && n1[l1] != ' ';l1++) ; - for (l2=0;l2<15 && n2[l2] && n2[l2] != ' ';l2++) ; - l3 = strlen(global_myname()); - - if ((l1==l3) && strncmp(n1,global_myname(),l3) == 0 && - (l2!=l3 || strncmp(n2,global_myname(),l3) != 0)) - return -1; - - if ((l2==l3) && strncmp(n2,global_myname(),l3) == 0 && - (l1!=l3 || strncmp(n1,global_myname(),l3) != 0)) - return 1; - - return memcmp(n1,n2,18); + nstring name1, name2; + int l1,l2,l3; + + pull_ascii_nstring(name1, n1); + pull_ascii_nstring(name2, n2); + n1 = name1; + n2 = name2; + + /* It's a bit tricky because the names are space padded */ + for (l1=0;l1<15 && n1[l1] && n1[l1] != ' ';l1++) + ; + for (l2=0;l2<15 && n2[l2] && n2[l2] != ' ';l2++) + ; + l3 = strlen(global_myname()); + + if ((l1==l3) && strncmp(n1,global_myname(),l3) == 0 && + (l2!=l3 || strncmp(n2,global_myname(),l3) != 0)) + return -1; + + if ((l2==l3) && strncmp(n2,global_myname(),l3) == 0 && + (l1!=l3 || strncmp(n1,global_myname(),l3) != 0)) + return 1; + + return memcmp(n1,n2,sizeof(nstring)); } - /**************************************************************************** Process a node status query ****************************************************************************/ void process_node_status_request(struct subnet_record *subrec, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - char *qname = nmb->question.question_name.name; - int ques_type = nmb->question.question_name.name_type; - char rdata[MAX_DGRAM_SIZE]; - char *countptr, *buf, *bufend, *buf0; - int names_added,i; - struct name_record *namerec; - - DEBUG(3,("process_node_status_request: status request for name %s from IP %s on \ -subnet %s.\n", nmb_namestr(&nmb->question.question_name), inet_ntoa(p->ip), - subrec->subnet_name)); - - if((namerec = find_name_on_subnet(subrec, &nmb->question.question_name, - FIND_SELF_NAME)) == 0) - { - DEBUG(1,("process_node_status_request: status request for name %s from IP %s on \ + struct nmb_packet *nmb = &p->packet.nmb; + nstring qname; + int ques_type = nmb->question.question_name.name_type; + char rdata[MAX_DGRAM_SIZE]; + char *countptr, *buf, *bufend, *buf0; + int names_added,i; + struct name_record *namerec; + + pull_ascii_nstring(qname, nmb->question.question_name.name); + + DEBUG(3,("process_node_status_request: status request for name %s from IP %s on \ +subnet %s.\n", nmb_namestr(&nmb->question.question_name), inet_ntoa(p->ip), subrec->subnet_name)); + + if((namerec = find_name_on_subnet(subrec, &nmb->question.question_name, FIND_SELF_NAME)) == 0) { + DEBUG(1,("process_node_status_request: status request for name %s from IP %s on \ subnet %s - name not found.\n", nmb_namestr(&nmb->question.question_name), - inet_ntoa(p->ip), subrec->subnet_name)); + inet_ntoa(p->ip), subrec->subnet_name)); - return; - } + return; + } - /* this is not an exact calculation. the 46 is for the stats buffer - and the 60 is to leave room for the header etc */ - bufend = &rdata[MAX_DGRAM_SIZE] - (18 + 46 + 60); - countptr = buf = rdata; - buf += 1; - buf0 = buf; - - names_added = 0; - - namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); - - while (buf < bufend) - { - if( (namerec->data.source == SELF_NAME) - || (namerec->data.source == PERMANENT_NAME) ) - { - int name_type = namerec->name.name_type; - - if (!strequal(namerec->name.name,"*") && - !strequal(namerec->name.name,"__SAMBA__") && - (name_type < 0x1b || name_type >= 0x20 || - ques_type < 0x1b || ques_type >= 0x20 || - strequal(qname, namerec->name.name))) - { - /* Start with the name. */ - memset(buf,'\0',18); - slprintf(buf, 17, "%-15.15s",namerec->name.name); - strupper_m(buf); - - /* Put the name type and netbios flags in the buffer. */ - buf[15] = name_type; - set_nb_flags( &buf[16],namerec->data.nb_flags ); - buf[16] |= NB_ACTIVE; /* all our names are active */ - - buf += 18; - - names_added++; - } - } - - /* Remove duplicate names. */ - if (names_added > 1) { - qsort( buf0, names_added, 18, QSORT_CAST status_compare ); - } - - for( i=1; i < names_added ; i++ ) - { - if (memcmp(buf0 + 18*i,buf0 + 18*(i-1),16) == 0) - { - names_added--; - if (names_added == i) - break; - memmove(buf0 + 18*i,buf0 + 18*(i+1),18*(names_added-i)); - i--; - } - } - - buf = buf0 + 18*names_added; - - namerec = (struct name_record *)ubi_trNext( namerec ); - - if (!namerec) - { - /* End of the subnet specific name list. Now - add the names on the unicast subnet . */ - struct subnet_record *uni_subrec = unicast_subnet; - - if (uni_subrec != subrec) - { - subrec = uni_subrec; - namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); - } - } - if (!namerec) - break; - - } + /* this is not an exact calculation. the 46 is for the stats buffer + and the 60 is to leave room for the header etc */ + bufend = &rdata[MAX_DGRAM_SIZE] - (18 + 46 + 60); + countptr = buf = rdata; + buf += 1; + buf0 = buf; + + names_added = 0; + + namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); + + while (buf < bufend) { + if( (namerec->data.source == SELF_NAME) || (namerec->data.source == PERMANENT_NAME) ) { + int name_type = namerec->name.name_type; + nstring name; + + pull_ascii_nstring(name, namerec->name.name); + strupper_m(name); + if (!strequal(name,"*") && + !strequal(name,"__SAMBA__") && + (name_type < 0x1b || name_type >= 0x20 || + ques_type < 0x1b || ques_type >= 0x20 || + strequal(qname, name))) { + /* Start with the name. */ + nstring tmp_name; + memset(tmp_name,'\0',sizeof(tmp_name)); + snprintf(tmp_name, sizeof(tmp_name), "%-15.15s",name); + push_ascii_nstring(buf, tmp_name); + + /* Put the name type and netbios flags in the buffer. */ + + buf[15] = name_type; + set_nb_flags( &buf[16],namerec->data.nb_flags ); + buf[16] |= NB_ACTIVE; /* all our names are active */ + + buf += 18; + + names_added++; + } + } + + /* Remove duplicate names. */ + if (names_added > 1) { + qsort( buf0, names_added, 18, QSORT_CAST status_compare ); + } + + for( i=1; i < names_added ; i++ ) { + if (memcmp(buf0 + 18*i,buf0 + 18*(i-1),16) == 0) { + names_added--; + if (names_added == i) + break; + memmove(buf0 + 18*i,buf0 + 18*(i+1),18*(names_added-i)); + i--; + } + } + + buf = buf0 + 18*names_added; + + namerec = (struct name_record *)ubi_trNext( namerec ); + + if (!namerec) { + /* End of the subnet specific name list. Now + add the names on the unicast subnet . */ + struct subnet_record *uni_subrec = unicast_subnet; + + if (uni_subrec != subrec) { + subrec = uni_subrec; + namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); + } + } + if (!namerec) + break; + + } - SCVAL(countptr,0,names_added); + SCVAL(countptr,0,names_added); - /* We don't send any stats as they could be used to attack - the protocol. */ - memset(buf,'\0',46); + /* We don't send any stats as they could be used to attack + the protocol. */ + memset(buf,'\0',46); - buf += 46; + buf += 46; - /* Send a NODE STATUS RESPONSE */ - reply_netbios_packet(p, /* Packet to reply to. */ - 0, /* Result code. */ - NMB_STATUS, /* nmbd type code. */ - NMB_NAME_QUERY_OPCODE, /* opcode. */ - 0, /* ttl. */ - rdata, /* data to send. */ - PTR_DIFF(buf,rdata)); /* data length. */ + /* Send a NODE STATUS RESPONSE */ + reply_netbios_packet(p, /* Packet to reply to. */ + 0, /* Result code. */ + NMB_STATUS, /* nmbd type code. */ + NMB_NAME_QUERY_OPCODE, /* opcode. */ + 0, /* ttl. */ + rdata, /* data to send. */ + PTR_DIFF(buf,rdata)); /* data length. */ } diff --git a/source3/nmbd/nmbd_lmhosts.c b/source3/nmbd/nmbd_lmhosts.c index 3c067d8ed4..b14e13f3a4 100644 --- a/source3/nmbd/nmbd_lmhosts.c +++ b/source3/nmbd/nmbd_lmhosts.c @@ -28,50 +28,46 @@ /**************************************************************************** Load a lmhosts file. ****************************************************************************/ + void load_lmhosts_file(char *fname) { - pstring name; - int name_type; - struct in_addr ipaddr; - XFILE *fp = startlmhosts( fname ); - - if (!fp) { - DEBUG(2,("load_lmhosts_file: Can't open lmhosts file %s. Error was %s\n", - fname, strerror(errno))); - return; - } + pstring name; + int name_type; + struct in_addr ipaddr; + XFILE *fp = startlmhosts( fname ); + + if (!fp) { + DEBUG(2,("load_lmhosts_file: Can't open lmhosts file %s. Error was %s\n", + fname, strerror(errno))); + return; + } - while (getlmhostsent(fp, name, &name_type, &ipaddr) ) - { - struct subnet_record *subrec = NULL; - enum name_source source = LMHOSTS_NAME; - - /* We find a relevent subnet to put this entry on, then add it. */ - /* Go through all the broadcast subnets and see if the mask matches. */ - for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - if(same_net(ipaddr, subrec->bcast_ip, subrec->mask_ip)) - break; - } + while (getlmhostsent(fp, name, &name_type, &ipaddr) ) { + struct subnet_record *subrec = NULL; + enum name_source source = LMHOSTS_NAME; + + /* We find a relevent subnet to put this entry on, then add it. */ + /* Go through all the broadcast subnets and see if the mask matches. */ + for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + if(same_net(ipaddr, subrec->bcast_ip, subrec->mask_ip)) + break; + } - /* If none match add the name to the remote_broadcast_subnet. */ - if(subrec == NULL) - subrec = remote_broadcast_subnet; - - if(name_type == -1) - { - /* Add the (0) and (0x20) names directly into the namelist for this subnet. */ - (void)add_name_to_subnet(subrec,name,0x00,(uint16)NB_ACTIVE,PERMANENT_TTL,source,1,&ipaddr); - (void)add_name_to_subnet(subrec,name,0x20,(uint16)NB_ACTIVE,PERMANENT_TTL,source,1,&ipaddr); - } - else - { - /* Add the given name type to the subnet namelist. */ - (void)add_name_to_subnet(subrec,name,name_type,(uint16)NB_ACTIVE,PERMANENT_TTL,source,1,&ipaddr); - } - } + /* If none match add the name to the remote_broadcast_subnet. */ + if(subrec == NULL) + subrec = remote_broadcast_subnet; + + if(name_type == -1) { + /* Add the (0) and (0x20) names directly into the namelist for this subnet. */ + (void)add_name_to_subnet(subrec,name,0x00,(uint16)NB_ACTIVE,PERMANENT_TTL,source,1,&ipaddr); + (void)add_name_to_subnet(subrec,name,0x20,(uint16)NB_ACTIVE,PERMANENT_TTL,source,1,&ipaddr); + } else { + /* Add the given name type to the subnet namelist. */ + (void)add_name_to_subnet(subrec,name,name_type,(uint16)NB_ACTIVE,PERMANENT_TTL,source,1,&ipaddr); + } + } - endlmhosts(fp); + endlmhosts(fp); } /**************************************************************************** @@ -82,17 +78,16 @@ void load_lmhosts_file(char *fname) BOOL find_name_in_lmhosts(struct nmb_name *nmbname, struct name_record **namerecp) { - struct name_record *namerec; + struct name_record *namerec; - *namerecp = NULL; + *namerecp = NULL; - if((namerec = find_name_on_subnet(remote_broadcast_subnet, nmbname, - FIND_ANY_NAME))==NULL) - return False; + if((namerec = find_name_on_subnet(remote_broadcast_subnet, nmbname, FIND_ANY_NAME))==NULL) + return False; - if(!NAME_IS_ACTIVE(namerec) || (namerec->data.source != LMHOSTS_NAME)) - return False; + if(!NAME_IS_ACTIVE(namerec) || (namerec->data.source != LMHOSTS_NAME)) + return False; - *namerecp = namerec; - return True; + *namerecp = namerec; + return True; } diff --git a/source3/nmbd/nmbd_logonnames.c b/source3/nmbd/nmbd_logonnames.c index b73586aa45..f79fc56f7b 100644 --- a/source3/nmbd/nmbd_logonnames.c +++ b/source3/nmbd/nmbd_logonnames.c @@ -3,7 +3,7 @@ NBT netbios routines and daemon - version 2 Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -29,38 +29,40 @@ extern uint16 samba_nb_type; /* Samba's NetBIOS type. */ /**************************************************************************** Fail to become a Logon server on a subnet. - ****************************************************************************/ +****************************************************************************/ + static void become_logon_server_fail(struct subnet_record *subrec, struct response_record *rrec, struct nmb_name *fail_name) { - struct work_record *work = find_workgroup_on_subnet(subrec, fail_name->name); - struct server_record *servrec; - - if(!work) - { - DEBUG(0,("become_logon_server_fail: Error - cannot find \ -workgroup %s on subnet %s\n", fail_name->name, subrec->subnet_name)); - return; - } - - if((servrec = find_server_in_workgroup( work, global_myname())) == NULL) - { - DEBUG(0,("become_logon_server_fail: Error - cannot find server %s \ + nstring failname; + struct work_record *work; + struct server_record *servrec; + + pull_ascii_nstring(failname, fail_name->name); + work = find_workgroup_on_subnet(subrec, failname); + if(!work) { + DEBUG(0,("become_logon_server_fail: Error - cannot find \ +workgroup %s on subnet %s\n", failname, subrec->subnet_name)); + return; + } + + if((servrec = find_server_in_workgroup( work, global_myname())) == NULL) { + DEBUG(0,("become_logon_server_fail: Error - cannot find server %s \ in workgroup %s on subnet %s\n", - global_myname(), fail_name->name, subrec->subnet_name)); - work->log_state = LOGON_NONE; - return; - } + global_myname(), failname, subrec->subnet_name)); + work->log_state = LOGON_NONE; + return; + } - /* Set the state back to LOGON_NONE. */ - work->log_state = LOGON_NONE; + /* Set the state back to LOGON_NONE. */ + work->log_state = LOGON_NONE; - servrec->serv.type &= ~SV_TYPE_DOMAIN_CTRL; + servrec->serv.type &= ~SV_TYPE_DOMAIN_CTRL; - DEBUG(0,("become_logon_server_fail: Failed to become a domain master for \ + DEBUG(0,("become_logon_server_fail: Failed to become a domain master for \ workgroup %s on subnet %s. Couldn't register name %s.\n", - work->work_group, subrec->subnet_name, nmb_namestr(fail_name))); + work->work_group, subrec->subnet_name, nmb_namestr(fail_name))); } @@ -74,49 +76,51 @@ static void become_logon_server_success(struct subnet_record *subrec, uint16 nb_flags, int ttl, struct in_addr registered_ip) { - struct work_record *work = find_workgroup_on_subnet( subrec, registered_name->name); - struct server_record *servrec; - - if(!work) - { - DEBUG(0,("become_logon_server_success: Error - cannot find \ -workgroup %s on subnet %s\n", registered_name->name, subrec->subnet_name)); - return; - } - - if((servrec = find_server_in_workgroup( work, global_myname())) == NULL) - { - DEBUG(0,("become_logon_server_success: Error - cannot find server %s \ + nstring reg_name; + struct work_record *work; + struct server_record *servrec; + + pull_ascii_nstring(reg_name, registered_name->name); + work = find_workgroup_on_subnet( subrec, reg_name); + if(!work) { + DEBUG(0,("become_logon_server_success: Error - cannot find \ +workgroup %s on subnet %s\n", reg_name, subrec->subnet_name)); + return; + } + + if((servrec = find_server_in_workgroup( work, global_myname())) == NULL) { + DEBUG(0,("become_logon_server_success: Error - cannot find server %s \ in workgroup %s on subnet %s\n", - global_myname(), registered_name->name, subrec->subnet_name)); - work->log_state = LOGON_NONE; - return; - } - - /* Set the state in the workgroup structure. */ - work->log_state = LOGON_SRV; /* Become domain master. */ - - /* Update our server status. */ - servrec->serv.type |= (SV_TYPE_NT|SV_TYPE_DOMAIN_MEMBER); - /* To allow Win95 policies to load we need to set type domain - controller. - */ - servrec->serv.type |= SV_TYPE_DOMAIN_CTRL; - - /* Tell the namelist writer to write out a change. */ - subrec->work_changed = True; - - /* - * Add the WORKGROUP<1C> name to the UNICAST subnet with the IP address - * for this subnet so we will respond to queries on this name. - */ - { - struct nmb_name nmbname; - make_nmb_name(&nmbname,lp_workgroup(),0x1c); - insert_permanent_name_into_unicast(subrec, &nmbname, 0x1c); - } - - DEBUG(0,("become_logon_server_success: Samba is now a logon server \ + global_myname(), reg_name, subrec->subnet_name)); + work->log_state = LOGON_NONE; + return; + } + + /* Set the state in the workgroup structure. */ + work->log_state = LOGON_SRV; /* Become domain master. */ + + /* Update our server status. */ + servrec->serv.type |= (SV_TYPE_NT|SV_TYPE_DOMAIN_MEMBER); + /* To allow Win95 policies to load we need to set type domain + controller. + */ + servrec->serv.type |= SV_TYPE_DOMAIN_CTRL; + + /* Tell the namelist writer to write out a change. */ + subrec->work_changed = True; + + /* + * Add the WORKGROUP<1C> name to the UNICAST subnet with the IP address + * for this subnet so we will respond to queries on this name. + */ + + { + struct nmb_name nmbname; + make_nmb_name(&nmbname,lp_workgroup(),0x1c); + insert_permanent_name_into_unicast(subrec, &nmbname, 0x1c); + } + + DEBUG(0,("become_logon_server_success: Samba is now a logon server \ for workgroup %s on subnet %s\n", work->work_group, subrec->subnet_name)); } @@ -128,45 +132,42 @@ for workgroup %s on subnet %s\n", work->work_group, subrec->subnet_name)); static void become_logon_server(struct subnet_record *subrec, struct work_record *work) { - DEBUG(2,("become_logon_server: Atempting to become logon server for workgroup %s \ + DEBUG(2,("become_logon_server: Atempting to become logon server for workgroup %s \ on subnet %s\n", work->work_group,subrec->subnet_name)); - DEBUG(3,("become_logon_server: go to first stage: register %s<1c> name\n", - work->work_group)); - work->log_state = LOGON_WAIT; + DEBUG(3,("become_logon_server: go to first stage: register %s<1c> name\n", + work->work_group)); + work->log_state = LOGON_WAIT; - register_name(subrec, work->work_group,0x1c,samba_nb_type|NB_GROUP, - become_logon_server_success, - become_logon_server_fail, NULL); + register_name(subrec, work->work_group,0x1c,samba_nb_type|NB_GROUP, + become_logon_server_success, + become_logon_server_fail, NULL); } /***************************************************************************** Add the internet group <1c> logon names by unicast and broadcast. ****************************************************************************/ + void add_logon_names(void) { - struct subnet_record *subrec; - - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) - { - struct work_record *work = find_workgroup_on_subnet(subrec, lp_workgroup()); - - if (work && (work->log_state == LOGON_NONE)) - { - struct nmb_name nmbname; - make_nmb_name(&nmbname,lp_workgroup(),0x1c); - - if (find_name_on_subnet(subrec, &nmbname, FIND_SELF_NAME) == NULL) - { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "add_domain_logon_names:\n" ); - dbgtext( "Attempting to become logon server " ); - dbgtext( "for workgroup %s ", lp_workgroup() ); - dbgtext( "on subnet %s\n", subrec->subnet_name ); - } - become_logon_server(subrec, work); - } - } - } + struct subnet_record *subrec; + + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) { + struct work_record *work = find_workgroup_on_subnet(subrec, lp_workgroup()); + + if (work && (work->log_state == LOGON_NONE)) { + struct nmb_name nmbname; + make_nmb_name(&nmbname,lp_workgroup(),0x1c); + + if (find_name_on_subnet(subrec, &nmbname, FIND_SELF_NAME) == NULL) { + if( DEBUGLVL( 0 ) ) { + dbgtext( "add_domain_logon_names:\n" ); + dbgtext( "Attempting to become logon server " ); + dbgtext( "for workgroup %s ", lp_workgroup() ); + dbgtext( "on subnet %s\n", subrec->subnet_name ); + } + become_logon_server(subrec, work); + } + } + } } diff --git a/source3/nmbd/nmbd_mynames.c b/source3/nmbd/nmbd_mynames.c index dd66821839..f02fbe1640 100644 --- a/source3/nmbd/nmbd_mynames.c +++ b/source3/nmbd/nmbd_mynames.c @@ -3,7 +3,7 @@ NBT netbios routines and daemon - version 2 Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -27,20 +27,21 @@ extern uint16 samba_nb_type; /* Samba's NetBIOS type. */ /**************************************************************************** Fail funtion when registering my netbios names. - **************************************************************************/ +**************************************************************************/ static void my_name_register_failed(struct subnet_record *subrec, struct response_record *rrec, struct nmb_name *nmbname) { - DEBUG(0,("my_name_register_failed: Failed to register my name %s on subnet %s.\n", - nmb_namestr(nmbname), subrec->subnet_name)); + DEBUG(0,("my_name_register_failed: Failed to register my name %s on subnet %s.\n", + nmb_namestr(nmbname), subrec->subnet_name)); } /**************************************************************************** Add my workgroup and my given names to one subnet Also add the magic Samba names. - **************************************************************************/ +**************************************************************************/ + void register_my_workgroup_one_subnet(struct subnet_record *subrec) { int i; @@ -84,111 +85,104 @@ Exiting.\n", lp_workgroup(), subrec->subnet_name)); static void insert_refresh_name_into_unicast( struct subnet_record *subrec, struct nmb_name *nmbname, uint16 nb_type ) { - struct name_record *namerec; - - if (!we_are_a_wins_client()) { - insert_permanent_name_into_unicast(subrec, nmbname, nb_type); - return; - } - - if((namerec = find_name_on_subnet(unicast_subnet, nmbname, FIND_SELF_NAME)) == NULL) - { - /* The name needs to be created on the unicast subnet. */ - (void)add_name_to_subnet( unicast_subnet, nmbname->name, - nmbname->name_type, nb_type, - MIN(lp_max_ttl(), MAX_REFRESH_TIME), SELF_NAME, 1, &subrec->myip); - } - else - { - /* The name already exists on the unicast subnet. Add our local - IP for the given broadcast subnet to the name. */ - add_ip_to_name_record( namerec, subrec->myip); - } + struct name_record *namerec; + + if (!we_are_a_wins_client()) { + insert_permanent_name_into_unicast(subrec, nmbname, nb_type); + return; + } + + if((namerec = find_name_on_subnet(unicast_subnet, nmbname, FIND_SELF_NAME)) == NULL) { + nstring name; + pull_ascii_nstring(name, nmbname->name); + /* The name needs to be created on the unicast subnet. */ + (void)add_name_to_subnet( unicast_subnet, name, + nmbname->name_type, nb_type, + MIN(lp_max_ttl(), MAX_REFRESH_TIME), SELF_NAME, 1, &subrec->myip); + } else { + /* The name already exists on the unicast subnet. Add our local + IP for the given broadcast subnet to the name. */ + add_ip_to_name_record( namerec, subrec->myip); + } } /**************************************************************************** Add my workgroup and my given names to the subnet lists. Also add the magic Samba names. - **************************************************************************/ +**************************************************************************/ BOOL register_my_workgroup_and_names(void) { - struct subnet_record *subrec; - int i; - - for(subrec = FIRST_SUBNET; - subrec; - subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) - { - register_my_workgroup_one_subnet(subrec); - } - - /* We still need to add the magic Samba - names and the netbios names to the unicast subnet directly. This is - to allow unicast node status requests and queries to still work - in a broadcast only environment. */ - - add_samba_names_to_subnet(unicast_subnet); - - for (i=0; my_netbios_names(i); i++) - { - for(subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - /* - * Ensure all the IP addresses are added if we are multihomed. - */ - struct nmb_name nmbname; - - make_nmb_name(&nmbname, my_netbios_names(i),0x20); - insert_refresh_name_into_unicast(subrec, &nmbname, samba_nb_type); - - make_nmb_name(&nmbname, my_netbios_names(i),0x3); - insert_refresh_name_into_unicast(subrec, &nmbname, samba_nb_type); - - make_nmb_name(&nmbname, my_netbios_names(i),0x0); - insert_refresh_name_into_unicast(subrec, &nmbname, samba_nb_type); - } - } - - /* - * Add the WORKGROUP<0> and WORKGROUP<1e> group names to the unicast subnet - * also for the same reasons. - */ - - for(subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - /* - * Ensure all the IP addresses are added if we are multihomed. - */ - struct nmb_name nmbname; - - make_nmb_name(&nmbname, lp_workgroup(), 0x0); - insert_refresh_name_into_unicast(subrec, &nmbname, samba_nb_type|NB_GROUP); - - make_nmb_name(&nmbname, lp_workgroup(), 0x1e); - insert_refresh_name_into_unicast(subrec, &nmbname, samba_nb_type|NB_GROUP); - } - - /* - * We need to add the Samba names to the remote broadcast subnet, - * as NT 4.x does directed broadcast requests to the *<0x0> name. - */ - add_samba_names_to_subnet(remote_broadcast_subnet); - - return True; + struct subnet_record *subrec; + int i; + + for(subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) { + register_my_workgroup_one_subnet(subrec); + } + + /* We still need to add the magic Samba + names and the netbios names to the unicast subnet directly. This is + to allow unicast node status requests and queries to still work + in a broadcast only environment. */ + + add_samba_names_to_subnet(unicast_subnet); + + for (i=0; my_netbios_names(i); i++) { + for(subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + /* + * Ensure all the IP addresses are added if we are multihomed. + */ + struct nmb_name nmbname; + + make_nmb_name(&nmbname, my_netbios_names(i),0x20); + insert_refresh_name_into_unicast(subrec, &nmbname, samba_nb_type); + + make_nmb_name(&nmbname, my_netbios_names(i),0x3); + insert_refresh_name_into_unicast(subrec, &nmbname, samba_nb_type); + + make_nmb_name(&nmbname, my_netbios_names(i),0x0); + insert_refresh_name_into_unicast(subrec, &nmbname, samba_nb_type); + } + } + + /* + * Add the WORKGROUP<0> and WORKGROUP<1e> group names to the unicast subnet + * also for the same reasons. + */ + + for(subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + /* + * Ensure all the IP addresses are added if we are multihomed. + */ + struct nmb_name nmbname; + + make_nmb_name(&nmbname, lp_workgroup(), 0x0); + insert_refresh_name_into_unicast(subrec, &nmbname, samba_nb_type|NB_GROUP); + + make_nmb_name(&nmbname, lp_workgroup(), 0x1e); + insert_refresh_name_into_unicast(subrec, &nmbname, samba_nb_type|NB_GROUP); + } + + /* + * We need to add the Samba names to the remote broadcast subnet, + * as NT 4.x does directed broadcast requests to the *<0x0> name. + */ + + add_samba_names_to_subnet(remote_broadcast_subnet); + + return True; } /**************************************************************************** Remove all the names we registered. **************************************************************************/ + void release_wins_names(void) { struct subnet_record *subrec = unicast_subnet; struct name_record *namerec, *nextnamerec; - for (namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); - namerec; - namerec = nextnamerec) { + for (namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); namerec; namerec = nextnamerec) { nextnamerec = (struct name_record *)ubi_trNext( namerec ); if( (namerec->data.source == SELF_NAME) && !NAME_IS_DEREGISTERING(namerec) ) @@ -199,12 +193,14 @@ void release_wins_names(void) /******************************************************************* Refresh our registered names with WINS - ******************************************************************/ +******************************************************************/ + void refresh_my_names(time_t t) { struct name_record *namerec; - if (wins_srv_count() < 1) return; + if (wins_srv_count() < 1) + return; for (namerec = (struct name_record *)ubi_trFirst(unicast_subnet->namelist); namerec; diff --git a/source3/nmbd/nmbd_namelistdb.c b/source3/nmbd/nmbd_namelistdb.c index 3f6d2f3b64..d1c9afd608 100644 --- a/source3/nmbd/nmbd_namelistdb.c +++ b/source3/nmbd/nmbd_namelistdb.c @@ -3,7 +3,7 @@ NBT netbios routines and daemon - version 2 Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -26,152 +26,149 @@ uint16 samba_nb_type = 0; /* samba's NetBIOS name type */ -/* ************************************************************************** ** - * Set Samba's NetBIOS name type. - * ************************************************************************** ** - */ +/************************************************************************** + Set Samba's NetBIOS name type. +***************************************************************************/ + void set_samba_nb_type(void) - { - if( lp_wins_support() || wins_srv_count() ) - samba_nb_type = NB_HFLAG; /* samba is a 'hybrid' node type. */ - else - samba_nb_type = NB_BFLAG; /* samba is broadcast-only node type. */ - } /* set_samba_nb_type */ - -/* ************************************************************************** ** - * Convert a NetBIOS name to upper case. - * ************************************************************************** ** - */ +{ + if( lp_wins_support() || wins_srv_count() ) + samba_nb_type = NB_HFLAG; /* samba is a 'hybrid' node type. */ + else + samba_nb_type = NB_BFLAG; /* samba is broadcast-only node type. */ +} + +/*************************************************************************** + Convert a NetBIOS name to upper case. +***************************************************************************/ + static void upcase_name( struct nmb_name *target, struct nmb_name *source ) - { - int i; - - if( NULL != source ) - (void)memcpy( target, source, sizeof( struct nmb_name ) ); - - strupper_m( target->name ); - strupper_m( target->scope ); - - /* fudge... We're using a byte-by-byte compare, so we must be sure that - * unused space doesn't have garbage in it. - */ - for( i = strlen( target->name ); i < sizeof( target->name ); i++ ) - target->name[i] = '\0'; - for( i = strlen( target->scope ); i < sizeof( target->scope ); i++ ) - target->scope[i] = '\0'; - } /* upcase_name */ - -/* ************************************************************************** ** - * Add a new or overwrite an existing namelist entry. - * ************************************************************************** ** - */ +{ + int i; + nstring targ; + fstring scope; + + if( NULL != source ) + memcpy( target, source, sizeof( struct nmb_name ) ); + + pull_ascii_nstring(targ, target->name); + strupper_m( targ ); + push_ascii_nstring( target->name, targ); + + pull_ascii(scope, target->scope, 64, -1, STR_TERMINATE); + strupper_m( scope ); + push_ascii(target->scope, scope, 64, STR_TERMINATE); + + /* fudge... We're using a byte-by-byte compare, so we must be sure that + * unused space doesn't have garbage in it. + */ + + for( i = strlen( target->name ); i < sizeof( target->name ); i++ ) + target->name[i] = '\0'; + for( i = strlen( target->scope ); i < sizeof( target->scope ); i++ ) + target->scope[i] = '\0'; +} + +/************************************************************************** + Add a new or overwrite an existing namelist entry. +***************************************************************************/ + static void update_name_in_namelist( struct subnet_record *subrec, struct name_record *namerec ) - { - struct name_record *oldrec = NULL; - - (void)ubi_trInsert( subrec->namelist, namerec, &(namerec->name), &oldrec ); - if( oldrec ) - { - SAFE_FREE( oldrec->data.ip ); - SAFE_FREE( oldrec ); - } - } /* update_name_in_namelist */ - -/* ************************************************************************** ** - * Remove a name from the namelist. - * ************************************************************************** ** - */ -void remove_name_from_namelist( struct subnet_record *subrec, - struct name_record *namerec ) - { - (void)ubi_trRemove( subrec->namelist, namerec ); +{ + struct name_record *oldrec = NULL; - SAFE_FREE(namerec->data.ip); + ubi_trInsert( subrec->namelist, namerec, &(namerec->name), &oldrec ); + if( oldrec ) { + SAFE_FREE( oldrec->data.ip ); + SAFE_FREE( oldrec ); + } +} - ZERO_STRUCTP(namerec); - SAFE_FREE(namerec); +/************************************************************************** + Remove a name from the namelist. +***************************************************************************/ + +void remove_name_from_namelist( struct subnet_record *subrec, + struct name_record *namerec ) +{ + ubi_trRemove( subrec->namelist, namerec ); + SAFE_FREE(namerec->data.ip); + ZERO_STRUCTP(namerec); + SAFE_FREE(namerec); + subrec->namelist_changed = True; +} - subrec->namelist_changed = True; - } /* remove_name_from_namelist */ +/************************************************************************** + Find a name in a subnet. +**************************************************************************/ -/* ************************************************************************** ** - * Find a name in a subnet. - * ************************************************************************** ** - */ struct name_record *find_name_on_subnet( struct subnet_record *subrec, struct nmb_name *nmbname, BOOL self_only ) - { - struct nmb_name uc_name[1]; - struct name_record *name_ret; - - upcase_name( uc_name, nmbname ); - name_ret = (struct name_record *)ubi_trFind( subrec->namelist, uc_name ); - if( name_ret ) - { - /* Self names only - these include permanent names. */ - if( self_only - && (name_ret->data.source != SELF_NAME) - && (name_ret->data.source != PERMANENT_NAME) ) - { - DEBUG( 9, - ( "find_name_on_subnet: on subnet %s - self name %s NOT FOUND\n", - subrec->subnet_name, nmb_namestr(nmbname) ) ); - return( NULL ); - } - DEBUG( 9, ("find_name_on_subnet: on subnet %s - found name %s source=%d\n", - subrec->subnet_name, nmb_namestr(nmbname), name_ret->data.source) ); - return( name_ret ); - } - DEBUG( 9, - ( "find_name_on_subnet: on subnet %s - name %s NOT FOUND\n", - subrec->subnet_name, nmb_namestr(nmbname) ) ); - return( NULL ); - } /* find_name_on_subnet */ - -/* ************************************************************************** ** - * Find a name over all known broadcast subnets. - * ************************************************************************** ** - */ +{ + struct nmb_name uc_name[1]; + struct name_record *name_ret; + + upcase_name( uc_name, nmbname ); + name_ret = (struct name_record *)ubi_trFind( subrec->namelist, uc_name ); + if( name_ret ) { + /* Self names only - these include permanent names. */ + if( self_only && (name_ret->data.source != SELF_NAME) && (name_ret->data.source != PERMANENT_NAME) ) { + DEBUG( 9, ( "find_name_on_subnet: on subnet %s - self name %s NOT FOUND\n", + subrec->subnet_name, nmb_namestr(nmbname) ) ); + return( NULL ); + } + + DEBUG( 9, ("find_name_on_subnet: on subnet %s - found name %s source=%d\n", + subrec->subnet_name, nmb_namestr(nmbname), name_ret->data.source) ); + return( name_ret ); + } + + DEBUG( 9, ( "find_name_on_subnet: on subnet %s - name %s NOT FOUND\n", + subrec->subnet_name, nmb_namestr(nmbname) ) ); + return( NULL ); +} + +/************************************************************************** + Find a name over all known broadcast subnets. +************************************************************************/ + struct name_record *find_name_for_remote_broadcast_subnet( struct nmb_name *nmbname, BOOL self_only ) - { - struct subnet_record *subrec; - struct name_record *namerec = NULL; - - for( subrec = FIRST_SUBNET; - subrec; - subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec) ) - { - if( NULL != (namerec = find_name_on_subnet(subrec, nmbname, self_only)) ) - break; - } - - return( namerec ); - } /* find_name_for_remote_broadcast_subnet */ +{ + struct subnet_record *subrec; + struct name_record *namerec = NULL; + + for( subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec) ) { + if( NULL != (namerec = find_name_on_subnet(subrec, nmbname, self_only)) ) + break; + } + + return( namerec ); +} -/* ************************************************************************** ** - * Update the ttl of an entry in a subnet name list. - * ************************************************************************** ** - */ +/************************************************************************** + Update the ttl of an entry in a subnet name list. +***************************************************************************/ + void update_name_ttl( struct name_record *namerec, int ttl ) { - time_t time_now = time(NULL); + time_t time_now = time(NULL); - if( namerec->data.death_time != PERMANENT_TTL ) - namerec->data.death_time = time_now + ttl; + if( namerec->data.death_time != PERMANENT_TTL ) + namerec->data.death_time = time_now + ttl; - namerec->data.refresh_time = time_now + MIN((ttl/2), MAX_REFRESH_TIME); + namerec->data.refresh_time = time_now + MIN((ttl/2), MAX_REFRESH_TIME); + + namerec->subnet->namelist_changed = True; +} - namerec->subnet->namelist_changed = True; -} /* update_name_ttl */ +/************************************************************************** + Add an entry to a subnet name list. +***********************************************************************/ -/* ************************************************************************** ** - * Add an entry to a subnet name list. - * ************************************************************************** ** - */ struct name_record *add_name_to_subnet( struct subnet_record *subrec, const char *name, int type, @@ -181,70 +178,66 @@ struct name_record *add_name_to_subnet( struct subnet_record *subrec, int num_ips, struct in_addr *iplist) { - struct name_record *namerec; - time_t time_now = time(NULL); + struct name_record *namerec; + time_t time_now = time(NULL); - namerec = (struct name_record *)malloc( sizeof(*namerec) ); - if( NULL == namerec ) - { - DEBUG( 0, ( "add_name_to_subnet: malloc fail.\n" ) ); - return( NULL ); - } + namerec = (struct name_record *)malloc( sizeof(*namerec) ); + if( NULL == namerec ) { + DEBUG( 0, ( "add_name_to_subnet: malloc fail.\n" ) ); + return( NULL ); + } - memset( (char *)namerec, '\0', sizeof(*namerec) ); - namerec->data.ip = (struct in_addr *)malloc( sizeof(struct in_addr) - * num_ips ); - if( NULL == namerec->data.ip ) - { - DEBUG( 0, ( "add_name_to_subnet: malloc fail when creating ip_flgs.\n" ) ); + memset( (char *)namerec, '\0', sizeof(*namerec) ); + namerec->data.ip = (struct in_addr *)malloc( sizeof(struct in_addr) * num_ips ); + if( NULL == namerec->data.ip ) { + DEBUG( 0, ( "add_name_to_subnet: malloc fail when creating ip_flgs.\n" ) ); + ZERO_STRUCTP(namerec); + SAFE_FREE(namerec); + return NULL; + } - ZERO_STRUCTP(namerec); - SAFE_FREE(namerec); - return NULL; - } + namerec->subnet = subrec; - namerec->subnet = subrec; + make_nmb_name(&namerec->name, name, type); + upcase_name(&namerec->name, NULL ); - make_nmb_name(&namerec->name, name, type); - upcase_name(&namerec->name, NULL ); + /* Enter the name as active. */ + namerec->data.nb_flags = nb_flags | NB_ACTIVE; + namerec->data.wins_flags = WINS_ACTIVE; - /* Enter the name as active. */ - namerec->data.nb_flags = nb_flags | NB_ACTIVE; - namerec->data.wins_flags = WINS_ACTIVE; + /* If it's our primary name, flag it as so. */ + if( strequal( my_netbios_names(0), name ) ) + namerec->data.nb_flags |= NB_PERM; - /* If it's our primary name, flag it as so. */ - if( strequal( my_netbios_names(0), name ) ) - namerec->data.nb_flags |= NB_PERM; + /* Copy the IPs. */ + namerec->data.num_ips = num_ips; + memcpy( (namerec->data.ip), iplist, num_ips * sizeof(struct in_addr) ); - /* Copy the IPs. */ - namerec->data.num_ips = num_ips; - memcpy( (namerec->data.ip), iplist, num_ips * sizeof(struct in_addr) ); + /* Data source. */ + namerec->data.source = source; - /* Data source. */ - namerec->data.source = source; + /* Setup the death_time and refresh_time. */ + if( ttl == PERMANENT_TTL ) + namerec->data.death_time = PERMANENT_TTL; + else + namerec->data.death_time = time_now + ttl; - /* Setup the death_time and refresh_time. */ - if( ttl == PERMANENT_TTL ) - namerec->data.death_time = PERMANENT_TTL; - else - namerec->data.death_time = time_now + ttl; + namerec->data.refresh_time = time_now + MIN((ttl/2), MAX_REFRESH_TIME); - namerec->data.refresh_time = time_now + MIN((ttl/2), MAX_REFRESH_TIME); + /* Now add the record to the name list. */ + update_name_in_namelist( subrec, namerec ); - /* Now add the record to the name list. */ - update_name_in_namelist( subrec, namerec ); - - DEBUG( 3, ( "add_name_to_subnet: Added netbios name %s with first IP %s \ + DEBUG( 3, ( "add_name_to_subnet: Added netbios name %s with first IP %s \ ttl=%d nb_flags=%2x to subnet %s\n", - nmb_namestr( &namerec->name ), - inet_ntoa( *iplist ), - ttl, - (unsigned int)nb_flags, - subrec->subnet_name ) ); + nmb_namestr( &namerec->name ), + inet_ntoa( *iplist ), + ttl, + (unsigned int)nb_flags, + subrec->subnet_name ) ); - subrec->namelist_changed = True; + subrec->namelist_changed = True; - return(namerec); + return(namerec); } /******************************************************************* @@ -258,14 +251,17 @@ void standard_success_register(struct subnet_record *subrec, struct nmb_name *nmbname, uint16 nb_flags, int ttl, struct in_addr registered_ip) { - struct name_record *namerec; - - namerec = find_name_on_subnet( subrec, nmbname, FIND_SELF_NAME ); - if( NULL == namerec ) - (void)add_name_to_subnet( subrec, nmbname->name, nmbname->name_type, - nb_flags, ttl, SELF_NAME, 1, ®istered_ip ); - else - update_name_ttl( namerec, ttl ); + struct name_record *namerec; + + namerec = find_name_on_subnet( subrec, nmbname, FIND_SELF_NAME ); + if( NULL == namerec ) { + nstring name; + pull_ascii_nstring(name, nmbname->name); + add_name_to_subnet( subrec, name, nmbname->name_type, + nb_flags, ttl, SELF_NAME, 1, ®istered_ip ); + } else { + update_name_ttl( namerec, ttl ); + } } /******************************************************************* @@ -279,17 +275,16 @@ void standard_fail_register( struct subnet_record *subrec, struct response_record *rrec, struct nmb_name *nmbname ) { - struct name_record *namerec; + struct name_record *namerec; - namerec = find_name_on_subnet( subrec, nmbname, FIND_SELF_NAME ); + namerec = find_name_on_subnet( subrec, nmbname, FIND_SELF_NAME ); - DEBUG( 0, ( "standard_fail_register: Failed to register/refresh name %s \ -on subnet %s\n", - nmb_namestr(nmbname), subrec->subnet_name) ); + DEBUG( 0, ( "standard_fail_register: Failed to register/refresh name %s \ +on subnet %s\n", nmb_namestr(nmbname), subrec->subnet_name) ); - /* Remove the name from the subnet. */ - if( namerec ) - remove_name_from_namelist(subrec, namerec); + /* Remove the name from the subnet. */ + if( namerec ) + remove_name_from_namelist(subrec, namerec); } /******************************************************************* @@ -298,13 +293,13 @@ on subnet %s\n", static void remove_nth_ip_in_record( struct name_record *namerec, int ind) { - if( ind != namerec->data.num_ips ) - memmove( (char *)(&namerec->data.ip[ind]), - (char *)(&namerec->data.ip[ind+1]), - ( namerec->data.num_ips - ind - 1) * sizeof(struct in_addr) ); + if( ind != namerec->data.num_ips ) + memmove( (char *)(&namerec->data.ip[ind]), + (char *)(&namerec->data.ip[ind+1]), + ( namerec->data.num_ips - ind - 1) * sizeof(struct in_addr) ); - namerec->data.num_ips--; - namerec->subnet->namelist_changed = True; + namerec->data.num_ips--; + namerec->subnet->namelist_changed = True; } /******************************************************************* @@ -313,13 +308,13 @@ static void remove_nth_ip_in_record( struct name_record *namerec, int ind) BOOL find_ip_in_name_record( struct name_record *namerec, struct in_addr ip ) { - int i; + int i; - for(i = 0; i < namerec->data.num_ips; i++) - if(ip_equal( namerec->data.ip[i], ip)) - return True; + for(i = 0; i < namerec->data.num_ips; i++) + if(ip_equal( namerec->data.ip[i], ip)) + return True; - return False; + return False; } /******************************************************************* @@ -328,30 +323,26 @@ BOOL find_ip_in_name_record( struct name_record *namerec, struct in_addr ip ) void add_ip_to_name_record( struct name_record *namerec, struct in_addr new_ip ) { - struct in_addr *new_list; + struct in_addr *new_list; - /* Don't add one we already have. */ - if( find_ip_in_name_record( namerec, new_ip ) ) - return; + /* Don't add one we already have. */ + if( find_ip_in_name_record( namerec, new_ip ) ) + return; - new_list = (struct in_addr *)malloc( (namerec->data.num_ips + 1) - * sizeof(struct in_addr) ); - if( NULL == new_list ) - { - DEBUG(0,("add_ip_to_name_record: Malloc fail !\n")); - return; - } - - memcpy( (char *)new_list, - (char *)namerec->data.ip, - namerec->data.num_ips * sizeof(struct in_addr) ); - new_list[namerec->data.num_ips] = new_ip; - - SAFE_FREE(namerec->data.ip); - namerec->data.ip = new_list; - namerec->data.num_ips += 1; - - namerec->subnet->namelist_changed = True; + new_list = (struct in_addr *)malloc( (namerec->data.num_ips + 1) * sizeof(struct in_addr) ); + if( NULL == new_list ) { + DEBUG(0,("add_ip_to_name_record: Malloc fail !\n")); + return; + } + + memcpy( (char *)new_list, (char *)namerec->data.ip, namerec->data.num_ips * sizeof(struct in_addr) ); + new_list[namerec->data.num_ips] = new_ip; + + SAFE_FREE(namerec->data.ip); + namerec->data.ip = new_list; + namerec->data.num_ips += 1; + + namerec->subnet->namelist_changed = True; } /******************************************************************* @@ -361,16 +352,16 @@ void add_ip_to_name_record( struct name_record *namerec, struct in_addr new_ip ) void remove_ip_from_name_record( struct name_record *namerec, struct in_addr remove_ip ) { - /* Try and find the requested ip address - remove it. */ - int i; - int orig_num = namerec->data.num_ips; - - for(i = 0; i < orig_num; i++) - if( ip_equal( remove_ip, namerec->data.ip[i]) ) - { - remove_nth_ip_in_record( namerec, i); - break; - } + /* Try and find the requested ip address - remove it. */ + int i; + int orig_num = namerec->data.num_ips; + + for(i = 0; i < orig_num; i++) { + if( ip_equal( remove_ip, namerec->data.ip[i]) ) { + remove_nth_ip_in_record( namerec, i); + break; + } + } } /******************************************************************* @@ -384,85 +375,67 @@ void standard_success_release( struct subnet_record *subrec, struct nmb_name *nmbname, struct in_addr released_ip ) { - struct name_record *namerec; - - namerec = find_name_on_subnet( subrec, nmbname, FIND_ANY_NAME ); - - if( namerec == NULL ) - { - DEBUG( 0, ( "standard_success_release: Name release for name %s IP %s \ -on subnet %s. Name was not found on subnet.\n", - nmb_namestr(nmbname), - inet_ntoa(released_ip), - subrec->subnet_name) ); - return; - } - else - { - int orig_num = namerec->data.num_ips; - - remove_ip_from_name_record( namerec, released_ip ); - - if( namerec->data.num_ips == orig_num ) - DEBUG( 0, ( "standard_success_release: Name release for name %s IP %s \ -on subnet %s. This ip is not known for this name.\n", - nmb_namestr(nmbname), - inet_ntoa(released_ip), - subrec->subnet_name ) ); - } - - if( namerec->data.num_ips == 0 ) - remove_name_from_namelist( subrec, namerec ); + struct name_record *namerec; + + namerec = find_name_on_subnet( subrec, nmbname, FIND_ANY_NAME ); + if( namerec == NULL ) { + DEBUG( 0, ( "standard_success_release: Name release for name %s IP %s \ +on subnet %s. Name was not found on subnet.\n", nmb_namestr(nmbname), inet_ntoa(released_ip), + subrec->subnet_name) ); + return; + } else { + int orig_num = namerec->data.num_ips; + + remove_ip_from_name_record( namerec, released_ip ); + + if( namerec->data.num_ips == orig_num ) + DEBUG( 0, ( "standard_success_release: Name release for name %s IP %s \ +on subnet %s. This ip is not known for this name.\n", nmb_namestr(nmbname), inet_ntoa(released_ip), subrec->subnet_name ) ); + } + + if( namerec->data.num_ips == 0 ) + remove_name_from_namelist( subrec, namerec ); } /******************************************************************* Expires old names in a subnet namelist. - ******************************************************************/ +******************************************************************/ void expire_names_on_subnet(struct subnet_record *subrec, time_t t) { - struct name_record *namerec; - struct name_record *next_namerec; - - for( namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); - namerec; - namerec = next_namerec ) - { - next_namerec = (struct name_record *)ubi_trNext( namerec ); - if( (namerec->data.death_time != PERMANENT_TTL) - && (namerec->data.death_time < t) ) - { - if( namerec->data.source == SELF_NAME ) - { - DEBUG( 3, ( "expire_names_on_subnet: Subnet %s not expiring SELF \ -name %s\n", - subrec->subnet_name, nmb_namestr(&namerec->name) ) ); - namerec->data.death_time += 300; - namerec->subnet->namelist_changed = True; - continue; - } - DEBUG(3,("expire_names_on_subnet: Subnet %s - removing expired name %s\n", - subrec->subnet_name, nmb_namestr(&namerec->name))); + struct name_record *namerec; + struct name_record *next_namerec; + + for( namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); namerec; namerec = next_namerec ) { + next_namerec = (struct name_record *)ubi_trNext( namerec ); + if( (namerec->data.death_time != PERMANENT_TTL) && (namerec->data.death_time < t) ) { + if( namerec->data.source == SELF_NAME ) { + DEBUG( 3, ( "expire_names_on_subnet: Subnet %s not expiring SELF \ +name %s\n", subrec->subnet_name, nmb_namestr(&namerec->name) ) ); + namerec->data.death_time += 300; + namerec->subnet->namelist_changed = True; + continue; + } + + DEBUG(3,("expire_names_on_subnet: Subnet %s - removing expired name %s\n", + subrec->subnet_name, nmb_namestr(&namerec->name))); - remove_name_from_namelist( subrec, namerec ); - } - } + remove_name_from_namelist( subrec, namerec ); + } + } } /******************************************************************* Expires old names in all subnet namelists. - ******************************************************************/ +******************************************************************/ void expire_names(time_t t) { - struct subnet_record *subrec; - - for( subrec = FIRST_SUBNET; - subrec; - subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec) ) - { - expire_names_on_subnet( subrec, t ); - } + struct subnet_record *subrec; + + for( subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec) ) { + expire_names_on_subnet( subrec, t ); + } } /**************************************************************************** @@ -475,46 +448,39 @@ void expire_names(time_t t) void add_samba_names_to_subnet( struct subnet_record *subrec ) { - struct in_addr *iplist = &subrec->myip; - int num_ips = 1; - - /* These names are added permanently (ttl of zero) and will NOT be - refreshed. */ - - if( (subrec == unicast_subnet) - || (subrec == wins_server_subnet) - || (subrec == remote_broadcast_subnet) ) - { - struct subnet_record *bcast_subrecs; - int i; - /* Create an IP list containing all our known subnets. */ - - num_ips = iface_count(); - iplist = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr) ); - if( NULL == iplist ) - { - DEBUG(0,("add_samba_names_to_subnet: Malloc fail !\n")); - return; - } - - for( bcast_subrecs = FIRST_SUBNET, i = 0; - bcast_subrecs; - bcast_subrecs = NEXT_SUBNET_EXCLUDING_UNICAST(bcast_subrecs), i++ ) - iplist[i] = bcast_subrecs->myip; - - } - - (void)add_name_to_subnet(subrec,"*",0x0,samba_nb_type, PERMANENT_TTL, - PERMANENT_NAME, num_ips, iplist); - (void)add_name_to_subnet(subrec,"*",0x20,samba_nb_type,PERMANENT_TTL, - PERMANENT_NAME, num_ips, iplist); - (void)add_name_to_subnet(subrec,"__SAMBA__",0x20,samba_nb_type,PERMANENT_TTL, - PERMANENT_NAME, num_ips, iplist); - (void)add_name_to_subnet(subrec,"__SAMBA__",0x00,samba_nb_type,PERMANENT_TTL, - PERMANENT_NAME, num_ips, iplist); - - if(iplist != &subrec->myip) - SAFE_FREE(iplist); + struct in_addr *iplist = &subrec->myip; + int num_ips = 1; + + /* These names are added permanently (ttl of zero) and will NOT be refreshed. */ + + if( (subrec == unicast_subnet) || (subrec == wins_server_subnet) || (subrec == remote_broadcast_subnet) ) { + struct subnet_record *bcast_subrecs; + int i; + + /* Create an IP list containing all our known subnets. */ + + num_ips = iface_count(); + iplist = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr) ); + if( NULL == iplist ) { + DEBUG(0,("add_samba_names_to_subnet: Malloc fail !\n")); + return; + } + + for( bcast_subrecs = FIRST_SUBNET, i = 0; bcast_subrecs; bcast_subrecs = NEXT_SUBNET_EXCLUDING_UNICAST(bcast_subrecs), i++ ) + iplist[i] = bcast_subrecs->myip; + } + + add_name_to_subnet(subrec,"*",0x0,samba_nb_type, PERMANENT_TTL, + PERMANENT_NAME, num_ips, iplist); + add_name_to_subnet(subrec,"*",0x20,samba_nb_type,PERMANENT_TTL, + PERMANENT_NAME, num_ips, iplist); + add_name_to_subnet(subrec,"__SAMBA__",0x20,samba_nb_type,PERMANENT_TTL, + PERMANENT_NAME, num_ips, iplist); + add_name_to_subnet(subrec,"__SAMBA__",0x00,samba_nb_type,PERMANENT_TTL, + PERMANENT_NAME, num_ips, iplist); + + if(iplist != &subrec->myip) + SAFE_FREE(iplist); } /**************************************************************************** @@ -524,68 +490,65 @@ void add_samba_names_to_subnet( struct subnet_record *subrec ) static void dump_subnet_namelist( struct subnet_record *subrec, XFILE *fp) { - struct name_record *namerec; - const char *src_type; - struct tm *tm; - int i; - - x_fprintf(fp, "Subnet %s\n----------------------\n", subrec->subnet_name); - for( namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); - namerec; - namerec = (struct name_record *)ubi_trNext( namerec ) ) - { - x_fprintf(fp,"\tName = %s\t", nmb_namestr(&namerec->name)); - switch(namerec->data.source) - { - case LMHOSTS_NAME: - src_type = "LMHOSTS_NAME"; - break; - case WINS_PROXY_NAME: - src_type = "WINS_PROXY_NAME"; - break; - case REGISTER_NAME: - src_type = "REGISTER_NAME"; - break; - case SELF_NAME: - src_type = "SELF_NAME"; - break; - case DNS_NAME: - src_type = "DNS_NAME"; - break; - case DNSFAIL_NAME: - src_type = "DNSFAIL_NAME"; - break; - case PERMANENT_NAME: - src_type = "PERMANENT_NAME"; - break; - default: - src_type = "unknown!"; - break; - } - x_fprintf(fp,"Source = %s\nb_flags = %x\t", src_type, namerec->data.nb_flags); - - if(namerec->data.death_time != PERMANENT_TTL) - { - tm = LocalTime(&namerec->data.death_time); - x_fprintf(fp, "death_time = %s\t", asctime(tm)); - } - else - x_fprintf(fp, "death_time = PERMANENT\t"); - - if(namerec->data.refresh_time != PERMANENT_TTL) - { - tm = LocalTime(&namerec->data.refresh_time); - x_fprintf(fp, "refresh_time = %s\n", asctime(tm)); - } - else - x_fprintf(fp, "refresh_time = PERMANENT\n"); - - x_fprintf(fp, "\t\tnumber of IPS = %d", namerec->data.num_ips); - for(i = 0; i < namerec->data.num_ips; i++) - x_fprintf(fp, "\t%s", inet_ntoa(namerec->data.ip[i])); - - x_fprintf(fp, "\n\n"); - } + struct name_record *namerec; + const char *src_type; + struct tm *tm; + int i; + + x_fprintf(fp, "Subnet %s\n----------------------\n", subrec->subnet_name); + for( namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); namerec; + namerec = (struct name_record *)ubi_trNext( namerec ) ) { + + x_fprintf(fp,"\tName = %s\t", nmb_namestr(&namerec->name)); + switch(namerec->data.source) { + case LMHOSTS_NAME: + src_type = "LMHOSTS_NAME"; + break; + case WINS_PROXY_NAME: + src_type = "WINS_PROXY_NAME"; + break; + case REGISTER_NAME: + src_type = "REGISTER_NAME"; + break; + case SELF_NAME: + src_type = "SELF_NAME"; + break; + case DNS_NAME: + src_type = "DNS_NAME"; + break; + case DNSFAIL_NAME: + src_type = "DNSFAIL_NAME"; + break; + case PERMANENT_NAME: + src_type = "PERMANENT_NAME"; + break; + default: + src_type = "unknown!"; + break; + } + + x_fprintf(fp,"Source = %s\nb_flags = %x\t", src_type, namerec->data.nb_flags); + + if(namerec->data.death_time != PERMANENT_TTL) { + tm = LocalTime(&namerec->data.death_time); + x_fprintf(fp, "death_time = %s\t", asctime(tm)); + } else { + x_fprintf(fp, "death_time = PERMANENT\t"); + } + + if(namerec->data.refresh_time != PERMANENT_TTL) { + tm = LocalTime(&namerec->data.refresh_time); + x_fprintf(fp, "refresh_time = %s\n", asctime(tm)); + } else { + x_fprintf(fp, "refresh_time = PERMANENT\n"); + } + + x_fprintf(fp, "\t\tnumber of IPS = %d", namerec->data.num_ips); + for(i = 0; i < namerec->data.num_ips; i++) + x_fprintf(fp, "\t%s", inet_ntoa(namerec->data.ip[i])); + + x_fprintf(fp, "\n\n"); + } } /**************************************************************************** @@ -595,30 +558,27 @@ static void dump_subnet_namelist( struct subnet_record *subrec, XFILE *fp) void dump_all_namelists(void) { - XFILE *fp; - struct subnet_record *subrec; + XFILE *fp; + struct subnet_record *subrec; - fp = x_fopen(lock_path("namelist.debug"),O_WRONLY|O_CREAT|O_TRUNC, 0644); + fp = x_fopen(lock_path("namelist.debug"),O_WRONLY|O_CREAT|O_TRUNC, 0644); - if (!fp) - { - DEBUG(0,("dump_all_namelists: Can't open file %s. Error was %s\n", - "namelist.debug",strerror(errno))); - return; - } + if (!fp) { + DEBUG(0,("dump_all_namelists: Can't open file %s. Error was %s\n", + "namelist.debug",strerror(errno))); + return; + } - for( subrec = FIRST_SUBNET; - subrec; - subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec) ) - dump_subnet_namelist( subrec, fp ); + for( subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec) ) + dump_subnet_namelist( subrec, fp ); - if( !we_are_a_wins_client() ) - dump_subnet_namelist( unicast_subnet, fp ); + if( !we_are_a_wins_client() ) + dump_subnet_namelist( unicast_subnet, fp ); - if( remote_broadcast_subnet->namelist != NULL ) - dump_subnet_namelist( remote_broadcast_subnet, fp ); + if( remote_broadcast_subnet->namelist != NULL ) + dump_subnet_namelist( remote_broadcast_subnet, fp ); - if( wins_server_subnet != NULL ) - dump_subnet_namelist( wins_server_subnet, fp ); - x_fclose( fp ); + if( wins_server_subnet != NULL ) + dump_subnet_namelist( wins_server_subnet, fp ); + x_fclose( fp ); } diff --git a/source3/nmbd/nmbd_namequery.c b/source3/nmbd/nmbd_namequery.c index 8995e9ac52..1b07852f11 100644 --- a/source3/nmbd/nmbd_namequery.c +++ b/source3/nmbd/nmbd_namequery.c @@ -3,7 +3,7 @@ NBT netbios routines and daemon - version 2 Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -31,106 +31,95 @@ static void query_name_response( struct subnet_record *subrec, struct response_record *rrec, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - BOOL success = False; - struct nmb_name *question_name = - &rrec->packet->packet.nmb.question.question_name; - struct in_addr answer_ip; - - zero_ip(&answer_ip); - - /* Ensure we don't retry the query but leave the response record cleanup - to the timeout code. We may get more answer responses in which case - we should mark the name in conflict.. */ - rrec->repeat_count = 0; - - if(rrec->num_msgs == 1) - { - /* This is the first response. */ - - if(nmb->header.opcode == NMB_WACK_OPCODE) - { - /* WINS server is telling us to wait. Pretend we didn't get - the response but don't send out any more query requests. */ - - if( DEBUGLVL( 5 ) ) - { - dbgtext( "query_name_response: " ); - dbgtext( "WACK from WINS server %s ", inet_ntoa(p->ip) ); - dbgtext( "in querying name %s ", nmb_namestr(question_name) ); - dbgtext( "on subnet %s.\n", subrec->subnet_name ); - } + struct nmb_packet *nmb = &p->packet.nmb; + BOOL success = False; + struct nmb_name *question_name = &rrec->packet->packet.nmb.question.question_name; + struct in_addr answer_ip; + + zero_ip(&answer_ip); + + /* Ensure we don't retry the query but leave the response record cleanup + to the timeout code. We may get more answer responses in which case + we should mark the name in conflict.. */ + rrec->repeat_count = 0; + + if(rrec->num_msgs == 1) { + /* This is the first response. */ + + if(nmb->header.opcode == NMB_WACK_OPCODE) { + /* WINS server is telling us to wait. Pretend we didn't get + the response but don't send out any more query requests. */ + + if( DEBUGLVL( 5 ) ) { + dbgtext( "query_name_response: " ); + dbgtext( "WACK from WINS server %s ", inet_ntoa(p->ip) ); + dbgtext( "in querying name %s ", nmb_namestr(question_name) ); + dbgtext( "on subnet %s.\n", subrec->subnet_name ); + } - rrec->repeat_count = 0; - /* How long we should wait for. */ - rrec->repeat_time = p->timestamp + nmb->answers->ttl; - rrec->num_msgs--; - return; - } - else if(nmb->header.rcode != 0) - { - success = False; - - if( DEBUGLVL( 5 ) ) - { - dbgtext( "query_name_response: On subnet %s ", subrec->subnet_name ); - dbgtext( "- negative response from IP %s ", inet_ntoa(p->ip) ); - dbgtext( "for name %s. ", nmb_namestr(question_name) ); - dbgtext( "Error code was %d.\n", nmb->header.rcode ); - } - } - else - { - if (!nmb->answers) - { - dbgtext( "query_name_response: On subnet %s ", subrec->subnet_name ); - dbgtext( "IP %s ", inet_ntoa(p->ip) ); - dbgtext( "returned a success response with no answer\n" ); - return; - } - - success = True; - - putip((char *)&answer_ip,&nmb->answers->rdata[2]); - if( DEBUGLVL( 5 ) ) - { - dbgtext( "query_name_response: On subnet %s ", subrec->subnet_name ); - dbgtext( "- positive response from IP %s ", inet_ntoa(p->ip) ); - dbgtext( "for name %s. ", nmb_namestr(question_name) ); - dbgtext( "IP of that name is %s\n", inet_ntoa(answer_ip) ); - } - - /* Interestingly, we could add these names to our namelists, and - change nmbd to a model that checked its own name cache first, - before sending out a query. This is a task for another day, though. - */ - } - } - else if( rrec->num_msgs > 1) - { - if( DEBUGLVL( 0 ) ) - { - if (nmb->answers) - putip( (char *)&answer_ip, &nmb->answers->rdata[2] ); - dbgtext( "query_name_response: " ); - dbgtext( "Multiple (%d) responses ", rrec->num_msgs ); - dbgtext( "received for a query on subnet %s ", subrec->subnet_name ); - dbgtext( "for name %s.\nThis response ", nmb_namestr(question_name) ); - dbgtext( "was from IP %s, reporting ", inet_ntoa(p->ip) ); - dbgtext( "an IP address of %s.\n", inet_ntoa(answer_ip) ); - } - - /* We have already called the success or fail function, so we - don't call again here. Leave the response record around in - case we get more responses. */ - - return; - } + rrec->repeat_count = 0; + /* How long we should wait for. */ + rrec->repeat_time = p->timestamp + nmb->answers->ttl; + rrec->num_msgs--; + return; + } else if(nmb->header.rcode != 0) { + + success = False; + + if( DEBUGLVL( 5 ) ) { + dbgtext( "query_name_response: On subnet %s ", subrec->subnet_name ); + dbgtext( "- negative response from IP %s ", inet_ntoa(p->ip) ); + dbgtext( "for name %s. ", nmb_namestr(question_name) ); + dbgtext( "Error code was %d.\n", nmb->header.rcode ); + } + } else { + if (!nmb->answers) { + dbgtext( "query_name_response: On subnet %s ", subrec->subnet_name ); + dbgtext( "IP %s ", inet_ntoa(p->ip) ); + dbgtext( "returned a success response with no answer\n" ); + return; + } + + success = True; + + putip((char *)&answer_ip,&nmb->answers->rdata[2]); + + if( DEBUGLVL( 5 ) ) { + dbgtext( "query_name_response: On subnet %s ", subrec->subnet_name ); + dbgtext( "- positive response from IP %s ", inet_ntoa(p->ip) ); + dbgtext( "for name %s. ", nmb_namestr(question_name) ); + dbgtext( "IP of that name is %s\n", inet_ntoa(answer_ip) ); + } + + /* Interestingly, we could add these names to our namelists, and + change nmbd to a model that checked its own name cache first, + before sending out a query. This is a task for another day, though. + */ + } + } else if( rrec->num_msgs > 1) { + + if( DEBUGLVL( 0 ) ) { + if (nmb->answers) + putip( (char *)&answer_ip, &nmb->answers->rdata[2] ); + dbgtext( "query_name_response: " ); + dbgtext( "Multiple (%d) responses ", rrec->num_msgs ); + dbgtext( "received for a query on subnet %s ", subrec->subnet_name ); + dbgtext( "for name %s.\nThis response ", nmb_namestr(question_name) ); + dbgtext( "was from IP %s, reporting ", inet_ntoa(p->ip) ); + dbgtext( "an IP address of %s.\n", inet_ntoa(answer_ip) ); + } + + /* We have already called the success or fail function, so we + don't call again here. Leave the response record around in + case we get more responses. */ + + return; + } - if(success && rrec->success_fn) - (*(query_name_success_function)rrec->success_fn)(subrec, rrec->userdata, question_name, answer_ip, nmb->answers); - else if( rrec->fail_fn) - (*(query_name_fail_function)rrec->fail_fn)(subrec, rrec, question_name, nmb->header.rcode); + if(success && rrec->success_fn) + (*(query_name_success_function)rrec->success_fn)(subrec, rrec->userdata, question_name, answer_ip, nmb->answers); + else if( rrec->fail_fn) + (*(query_name_fail_function)rrec->fail_fn)(subrec, rrec, question_name, nmb->header.rcode); } @@ -141,32 +130,30 @@ static void query_name_response( struct subnet_record *subrec, static void query_name_timeout_response(struct subnet_record *subrec, struct response_record *rrec) { - struct nmb_packet *sent_nmb = &rrec->packet->packet.nmb; - /* We can only fail here, never succeed. */ - BOOL failed = True; - struct nmb_name *question_name = &sent_nmb->question.question_name; - - if(rrec->num_msgs != 0) - { - /* We got at least one response, and have called the success/fail - function already. */ - - failed = False; - } - - if(failed) - { - if( DEBUGLVL( 5 ) ) - { - dbgtext( "query_name_timeout_response: No response to " ); - dbgtext( "query for name %s ", nmb_namestr(question_name) ); - dbgtext( "on subnet %s.\n", subrec->subnet_name ); - } - if(rrec->fail_fn) - (*(query_name_fail_function)rrec->fail_fn)(subrec, rrec, question_name, 0); - } - - remove_response_record(subrec, rrec); + struct nmb_packet *sent_nmb = &rrec->packet->packet.nmb; + /* We can only fail here, never succeed. */ + BOOL failed = True; + struct nmb_name *question_name = &sent_nmb->question.question_name; + + if(rrec->num_msgs != 0) { + /* We got at least one response, and have called the success/fail + function already. */ + + failed = False; + } + + if(failed) { + if( DEBUGLVL( 5 ) ) { + dbgtext( "query_name_timeout_response: No response to " ); + dbgtext( "query for name %s ", nmb_namestr(question_name) ); + dbgtext( "on subnet %s.\n", subrec->subnet_name ); + } + + if(rrec->fail_fn) + (*(query_name_fail_function)rrec->fail_fn)(subrec, rrec, question_name, 0); + } + + remove_response_record(subrec, rrec); } /**************************************************************************** @@ -177,98 +164,83 @@ static void query_name_timeout_response(struct subnet_record *subrec, static BOOL query_local_namelists(struct subnet_record *subrec, struct nmb_name *nmbname, struct name_record **namerecp) { - struct name_record *namerec; + struct name_record *namerec; - *namerecp = NULL; + *namerecp = NULL; - if(find_name_in_lmhosts(nmbname, namerecp)) - return True; + if(find_name_in_lmhosts(nmbname, namerecp)) + return True; - if((namerec = find_name_on_subnet(subrec, nmbname, FIND_ANY_NAME))==NULL) - return False; - - if( NAME_IS_ACTIVE(namerec) - && ( (namerec->data.source == SELF_NAME) - || (namerec->data.source == LMHOSTS_NAME) ) ) - { - *namerecp = namerec; - return True; - } - return False; + if((namerec = find_name_on_subnet(subrec, nmbname, FIND_ANY_NAME))==NULL) + return False; + + if( NAME_IS_ACTIVE(namerec) && ( (namerec->data.source == SELF_NAME) || (namerec->data.source == LMHOSTS_NAME) ) ) { + *namerecp = namerec; + return True; + } + return False; } /**************************************************************************** Try and query for a name. ****************************************************************************/ -BOOL query_name(struct subnet_record *subrec, char *name, int type, +BOOL query_name(struct subnet_record *subrec, const char *name, int type, query_name_success_function success_fn, query_name_fail_function fail_fn, struct userdata_struct *userdata) { - struct nmb_name nmbname; - struct name_record *namerec; - - make_nmb_name(&nmbname, name, type); - - /* - * We need to check our local namelists first. - * It may be an magic name, lmhosts name or just - * a name we have registered. - */ - - if(query_local_namelists(subrec, &nmbname, &namerec) == True) - { - struct res_rec rrec; - int i; - - memset((char *)&rrec, '\0', sizeof(struct res_rec)); - - /* Fake up the needed res_rec just in case it's used. */ - rrec.rr_name = nmbname; - rrec.rr_type = RR_TYPE_NB; - rrec.rr_class = RR_CLASS_IN; - rrec.ttl = PERMANENT_TTL; - rrec.rdlength = namerec->data.num_ips * 6; - if(rrec.rdlength > MAX_DGRAM_SIZE) - { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "query_name: nmbd internal error - " ); - dbgtext( "there are %d ip addresses ", namerec->data.num_ips ); - dbgtext( "for name %s.\n", nmb_namestr(&nmbname) ); - } - return False; - } - - for( i = 0; i < namerec->data.num_ips; i++) - { - set_nb_flags( &rrec.rdata[i*6], namerec->data.nb_flags ); - putip( &rrec.rdata[(i*6) + 2], (char *)&namerec->data.ip[i]); - } - - /* Call the success function directly. */ - if(success_fn) - (*(query_name_success_function)success_fn)(subrec, userdata, &nmbname, namerec->data.ip[0], &rrec); - return False; - } - - if(queue_query_name( subrec, - query_name_response, - query_name_timeout_response, - success_fn, - fail_fn, - userdata, - &nmbname) == NULL) - { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "query_name: Failed to send packet " ); - dbgtext( "trying to query name %s\n", nmb_namestr(&nmbname) ); - } - return True; - } - return False; + struct nmb_name nmbname; + struct name_record *namerec; + + make_nmb_name(&nmbname, name, type); + + /* + * We need to check our local namelists first. + * It may be an magic name, lmhosts name or just + * a name we have registered. + */ + + if(query_local_namelists(subrec, &nmbname, &namerec) == True) { + struct res_rec rrec; + int i; + + memset((char *)&rrec, '\0', sizeof(struct res_rec)); + + /* Fake up the needed res_rec just in case it's used. */ + rrec.rr_name = nmbname; + rrec.rr_type = RR_TYPE_NB; + rrec.rr_class = RR_CLASS_IN; + rrec.ttl = PERMANENT_TTL; + rrec.rdlength = namerec->data.num_ips * 6; + if(rrec.rdlength > MAX_DGRAM_SIZE) { + if( DEBUGLVL( 0 ) ) { + dbgtext( "query_name: nmbd internal error - " ); + dbgtext( "there are %d ip addresses ", namerec->data.num_ips ); + dbgtext( "for name %s.\n", nmb_namestr(&nmbname) ); + } + return False; + } + + for( i = 0; i < namerec->data.num_ips; i++) { + set_nb_flags( &rrec.rdata[i*6], namerec->data.nb_flags ); + putip( &rrec.rdata[(i*6) + 2], (char *)&namerec->data.ip[i]); + } + + /* Call the success function directly. */ + if(success_fn) + (*(query_name_success_function)success_fn)(subrec, userdata, &nmbname, namerec->data.ip[0], &rrec); + return False; + } + + if(queue_query_name( subrec, query_name_response, query_name_timeout_response, success_fn, fail_fn, userdata, &nmbname) == NULL) { + if( DEBUGLVL( 0 ) ) { + dbgtext( "query_name: Failed to send packet " ); + dbgtext( "trying to query name %s\n", nmb_namestr(&nmbname) ); + } + return True; + } + return False; } /**************************************************************************** @@ -276,29 +248,21 @@ BOOL query_name(struct subnet_record *subrec, char *name, int type, ****************************************************************************/ BOOL query_name_from_wins_server(struct in_addr ip_to, - char *name, int type, + const char *name, int type, query_name_success_function success_fn, query_name_fail_function fail_fn, struct userdata_struct *userdata) { - struct nmb_name nmbname; - - make_nmb_name(&nmbname, name, type); - - if(queue_query_name_from_wins_server( ip_to, - query_name_response, - query_name_timeout_response, - success_fn, - fail_fn, - userdata, - &nmbname) == NULL) - { - if( DEBUGLVL( 0 ) ) - { - dbgtext( "query_name_from_wins_server: Failed to send packet " ); - dbgtext( "trying to query name %s\n", nmb_namestr(&nmbname) ); - } - return True; - } - return False; + struct nmb_name nmbname; + + make_nmb_name(&nmbname, name, type); + + if(queue_query_name_from_wins_server( ip_to, query_name_response, query_name_timeout_response, success_fn, fail_fn, userdata, &nmbname) == NULL) { + if( DEBUGLVL( 0 ) ) { + dbgtext( "query_name_from_wins_server: Failed to send packet " ); + dbgtext( "trying to query name %s\n", nmb_namestr(&nmbname) ); + } + return True; + } + return False; } diff --git a/source3/nmbd/nmbd_nameregister.c b/source3/nmbd/nmbd_nameregister.c index 7bf2584053..0397f56512 100644 --- a/source3/nmbd/nmbd_nameregister.c +++ b/source3/nmbd/nmbd_nameregister.c @@ -3,7 +3,7 @@ NBT netbios routines and daemon - version 2 Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -85,7 +85,9 @@ static void register_name_response(struct subnet_record *subrec, */ #if 1 /* OLD_SAMBA_SERVER_HACK */ - if((nmb->header.rcode == ACT_ERR) && strequal(lp_workgroup(), answer_name->name) && + nstring ans_name; + pull_ascii_nstring(ans_name, answer_name->name); + if((nmb->header.rcode == ACT_ERR) && strequal(lp_workgroup(), ans_name) && (answer_name->name_type == 0x1b)) { /* Pretend we did not get this. */ rrec->num_msgs--; @@ -161,10 +163,10 @@ static void register_name_response(struct subnet_record *subrec, remove_response_record(subrec, rrec); } - /**************************************************************************** Deal with a timeout of a WINS registration request ****************************************************************************/ + static void wins_registration_timeout(struct subnet_record *subrec, struct response_record *rrec) { @@ -233,7 +235,6 @@ static void wins_registration_timeout(struct subnet_record *subrec, us trying to register with each of our failover wins servers */ } - /**************************************************************************** Deal with a timeout when registering one of our names. ****************************************************************************/ @@ -290,10 +291,10 @@ static void register_name_timeout_response(struct subnet_record *subrec, remove_response_record(subrec, rrec); } - /**************************************************************************** -initiate one multi-homed name registration packet + Initiate one multi-homed name registration packet. ****************************************************************************/ + static void multihomed_register_one(struct nmb_name *nmbname, uint16 nb_flags, register_name_success_function success_fn, @@ -336,11 +337,11 @@ static void multihomed_register_one(struct nmb_name *nmbname, free(userdata); } - /**************************************************************************** -we have finished the registration of one IP and need to see if we have -any more IPs left to register with this group of wins server for this name + We have finished the registration of one IP and need to see if we have + any more IPs left to register with this group of wins server for this name. ****************************************************************************/ + static void wins_next_registration(struct response_record *rrec) { struct nmb_packet *sent_nmb = &rrec->packet->packet.nmb; @@ -388,6 +389,7 @@ static void wins_next_registration(struct response_record *rrec) /**************************************************************************** Try and register one of our names on the unicast subnet - multihomed. ****************************************************************************/ + static void multihomed_register_name(struct nmb_name *nmbname, uint16 nb_flags, register_name_success_function success_fn, register_name_fail_function fail_fn) @@ -416,6 +418,7 @@ static void multihomed_register_name(struct nmb_name *nmbname, uint16 nb_flags, struct subnet_record *subrec; char **wins_tags; struct in_addr *ip_list; + nstring name; for(subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec) ) num_ips++; @@ -431,7 +434,8 @@ static void multihomed_register_name(struct nmb_name *nmbname, uint16 nb_flags, ip_list[i] = subrec->myip; } - add_name_to_subnet(unicast_subnet, nmbname->name, nmbname->name_type, + pull_ascii_nstring(name, nmbname->name); + add_name_to_subnet(unicast_subnet, name, nmbname->name_type, nb_flags, lp_max_ttl(), SELF_NAME, num_ips, ip_list); @@ -456,10 +460,10 @@ static void multihomed_register_name(struct nmb_name *nmbname, uint16 nb_flags, SAFE_FREE(ip_list); } - /**************************************************************************** Try and register one of our names. ****************************************************************************/ + void register_name(struct subnet_record *subrec, const char *name, int type, uint16 nb_flags, register_name_success_function success_fn, @@ -467,8 +471,18 @@ void register_name(struct subnet_record *subrec, struct userdata_struct *userdata) { struct nmb_name nmbname; - - make_nmb_name(&nmbname, name, type); + nstring nname; + + if (strlen(name)+1 > sizeof(nstring)) { + memcpy(nname, name,sizeof(nstring)-1); + nname[sizeof(nstring)-1] = '\0'; + DEBUG(0,("register_name: NetBIOS name %s is too long. Truncating to %s\n", + name, nname)); + } else { + nstrcpy(nname,name); + } + + make_nmb_name(&nmbname, nname, type); /* Always set the NB_ACTIVE flag on the name we are registering. Doesn't make sense without it. @@ -498,10 +512,10 @@ void register_name(struct subnet_record *subrec, } } - /**************************************************************************** Try and refresh one of our names. This is *only* called for WINS refresh ****************************************************************************/ + void wins_refresh_name(struct name_record *namerec) { int t; diff --git a/source3/nmbd/nmbd_nodestatus.c b/source3/nmbd/nmbd_nodestatus.c index 993e4d9d17..0ea5d6a818 100644 --- a/source3/nmbd/nmbd_nodestatus.c +++ b/source3/nmbd/nmbd_nodestatus.c @@ -3,7 +3,7 @@ NBT netbios routines and daemon - version 2 Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -26,52 +26,52 @@ /**************************************************************************** Deal with a successful node status response. ****************************************************************************/ + static void node_status_response(struct subnet_record *subrec, struct response_record *rrec, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - struct nmb_name *question_name = &rrec->packet->packet.nmb.question.question_name; - struct nmb_name *answer_name = &nmb->answers->rr_name; + struct nmb_packet *nmb = &p->packet.nmb; + struct nmb_name *question_name = &rrec->packet->packet.nmb.question.question_name; + struct nmb_name *answer_name = &nmb->answers->rr_name; - /* Sanity check. Ensure that the answer name in the incoming packet is the - same as the requested name in the outgoing packet. */ + /* Sanity check. Ensure that the answer name in the incoming packet is the + same as the requested name in the outgoing packet. */ - if(!nmb_name_equal(question_name, answer_name)) - { - DEBUG(0,("node_status_response: Answer name %s differs from question \ + if(!nmb_name_equal(question_name, answer_name)) { + DEBUG(0,("node_status_response: Answer name %s differs from question \ name %s.\n", nmb_namestr(answer_name), nmb_namestr(question_name))); - return; - } + return; + } - DEBUG(5,("node_status_response: response from name %s on subnet %s.\n", - nmb_namestr(answer_name), subrec->subnet_name)); + DEBUG(5,("node_status_response: response from name %s on subnet %s.\n", + nmb_namestr(answer_name), subrec->subnet_name)); - /* Just send the whole answer resource record for the success function - to parse. */ - if(rrec->success_fn) - (*(node_status_success_function)rrec->success_fn)(subrec, rrec->userdata, nmb->answers, p->ip); + /* Just send the whole answer resource record for the success function to parse. */ + if(rrec->success_fn) + (*(node_status_success_function)rrec->success_fn)(subrec, rrec->userdata, nmb->answers, p->ip); - /* Ensure we don't retry. */ - remove_response_record(subrec, rrec); + /* Ensure we don't retry. */ + remove_response_record(subrec, rrec); } /**************************************************************************** Deal with a timeout when requesting a node status. ****************************************************************************/ + static void node_status_timeout_response(struct subnet_record *subrec, struct response_record *rrec) { - struct nmb_packet *sent_nmb = &rrec->packet->packet.nmb; - struct nmb_name *question_name = &sent_nmb->question.question_name; + struct nmb_packet *sent_nmb = &rrec->packet->packet.nmb; + struct nmb_name *question_name = &sent_nmb->question.question_name; - DEBUG(5,("node_status_timeout_response: failed to get node status from name %s on subnet %s\n", - nmb_namestr(question_name), subrec->subnet_name)); + DEBUG(5,("node_status_timeout_response: failed to get node status from name %s on subnet %s\n", + nmb_namestr(question_name), subrec->subnet_name)); - if( rrec->fail_fn) - (*rrec->fail_fn)(subrec, rrec); + if( rrec->fail_fn) + (*rrec->fail_fn)(subrec, rrec); - /* Ensure we don't retry. */ - remove_response_record(subrec, rrec); + /* Ensure we don't retry. */ + remove_response_record(subrec, rrec); } /**************************************************************************** @@ -82,13 +82,11 @@ BOOL node_status(struct subnet_record *subrec, struct nmb_name *nmbname, struct in_addr send_ip, node_status_success_function success_fn, node_status_fail_function fail_fn, struct userdata_struct *userdata) { - if(queue_node_status( subrec, - node_status_response, node_status_timeout_response, - success_fn, fail_fn, userdata, nmbname, send_ip)==NULL) - { - DEBUG(0,("node_status: Failed to send packet trying to get node status for \ + if(queue_node_status( subrec, node_status_response, node_status_timeout_response, + success_fn, fail_fn, userdata, nmbname, send_ip)==NULL) { + DEBUG(0,("node_status: Failed to send packet trying to get node status for \ name %s, IP address %s\n", nmb_namestr(nmbname), inet_ntoa(send_ip))); - return True; - } - return False; + return True; + } + return False; } diff --git a/source3/nmbd/nmbd_packets.c b/source3/nmbd/nmbd_packets.c index 6c3446d6c8..72eb1b5019 100644 --- a/source3/nmbd/nmbd_packets.c +++ b/source3/nmbd/nmbd_packets.c @@ -3,7 +3,7 @@ NBT netbios routines and daemon - version 2 Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -50,13 +50,13 @@ Utility function to find the specific fd to send a packet out on. static int find_subnet_fd_for_address( struct in_addr local_ip ) { - struct subnet_record *subrec; + struct subnet_record *subrec; - for( subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - if(ip_equal(local_ip, subrec->myip)) - return subrec->nmb_sock; + for( subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) + if(ip_equal(local_ip, subrec->myip)) + return subrec->nmb_sock; - return ClientNMB; + return ClientNMB; } /*************************************************************************** @@ -65,13 +65,13 @@ Utility function to find the specific fd to send a mailslot packet out on. static int find_subnet_mailslot_fd_for_address( struct in_addr local_ip ) { - struct subnet_record *subrec; + struct subnet_record *subrec; - for( subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - if(ip_equal(local_ip, subrec->myip)) - return subrec->dgram_sock; + for( subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) + if(ip_equal(local_ip, subrec->myip)) + return subrec->dgram_sock; - return ClientDGRAM; + return ClientDGRAM; } /*************************************************************************** @@ -80,13 +80,13 @@ Get/Set problematic nb_flags as network byte order 16 bit int. uint16 get_nb_flags(char *buf) { - return ((((uint16)*buf)&0xFFFF) & NB_FLGMSK); + return ((((uint16)*buf)&0xFFFF) & NB_FLGMSK); } void set_nb_flags(char *buf, uint16 nb_flags) { - *buf++ = ((nb_flags & NB_FLGMSK) & 0xFF); - *buf = '\0'; + *buf++ = ((nb_flags & NB_FLGMSK) & 0xFF); + *buf = '\0'; } /*************************************************************************** @@ -95,37 +95,34 @@ Dumps out the browse packet data. static void debug_browse_data(char *outbuf, int len) { - int i,j; - - DEBUG( 4, ( "debug_browse_data():\n" ) ); - for (i = 0; i < len; i+= 16) - { - DEBUGADD( 4, ( "%3x char ", i ) ); - - for (j = 0; j < 16; j++) - { - unsigned char x; - if (i+j >= len) - break; - - x = outbuf[i+j]; - if (x < 32 || x > 127) - x = '.'; + int i,j; + + DEBUG( 4, ( "debug_browse_data():\n" ) ); + for (i = 0; i < len; i+= 16) { + DEBUGADD( 4, ( "%3x char ", i ) ); + + for (j = 0; j < 16; j++) { + unsigned char x; + if (i+j >= len) + break; + + x = outbuf[i+j]; + if (x < 32 || x > 127) + x = '.'; - DEBUGADD( 4, ( "%c", x ) ); - } + DEBUGADD( 4, ( "%c", x ) ); + } - DEBUGADD( 4, ( "%*s hex", 16-j, "" ) ); + DEBUGADD( 4, ( "%*s hex", 16-j, "" ) ); - for (j = 0; j < 16; j++) - { - if (i+j >= len) - break; - DEBUGADD( 4, ( " %02x", (unsigned char)outbuf[i+j] ) ); - } + for (j = 0; j < 16; j++) { + if (i+j >= len) + break; + DEBUGADD( 4, ( " %02x", (unsigned char)outbuf[i+j] ) ); + } - DEBUGADD( 4, ("\n") ); - } + DEBUGADD( 4, ("\n") ); + } } /*************************************************************************** @@ -136,13 +133,11 @@ static uint16 name_trn_id=0; static uint16 generate_name_trn_id(void) { - - if (!name_trn_id) - { - name_trn_id = ((unsigned)time(NULL)%(unsigned)0x7FFF) + ((unsigned)sys_getpid()%(unsigned)100); - } - name_trn_id = (name_trn_id+1) % (unsigned)0x7FFF; - return name_trn_id; + if (!name_trn_id) { + name_trn_id = ((unsigned)time(NULL)%(unsigned)0x7FFF) + ((unsigned)sys_getpid()%(unsigned)100); + } + name_trn_id = (name_trn_id+1) % (unsigned)0x7FFF; + return name_trn_id; } /*************************************************************************** @@ -151,28 +146,25 @@ static uint16 generate_name_trn_id(void) static BOOL send_netbios_packet(struct packet_struct *p) { - BOOL loopback_this_packet = False; - - /* Check if we are sending to or from ourselves as a WINS server. */ - if(ismyip(p->ip) && (p->port == global_nmb_port)) - loopback_this_packet = True; - - if(loopback_this_packet) - { - struct packet_struct *lo_packet = NULL; - DEBUG(5,("send_netbios_packet: sending packet to ourselves.\n")); - if((lo_packet = copy_packet(p)) == NULL) - return False; - queue_packet(lo_packet); - } - else if (!send_packet(p)) - { - DEBUG(0,("send_netbios_packet: send_packet() to IP %s port %d failed\n", - inet_ntoa(p->ip),p->port)); - return False; - } + BOOL loopback_this_packet = False; + + /* Check if we are sending to or from ourselves as a WINS server. */ + if(ismyip(p->ip) && (p->port == global_nmb_port)) + loopback_this_packet = True; + + if(loopback_this_packet) { + struct packet_struct *lo_packet = NULL; + DEBUG(5,("send_netbios_packet: sending packet to ourselves.\n")); + if((lo_packet = copy_packet(p)) == NULL) + return False; + queue_packet(lo_packet); + } else if (!send_packet(p)) { + DEBUG(0,("send_netbios_packet: send_packet() to IP %s port %d failed\n", + inet_ntoa(p->ip),p->port)); + return False; + } - return True; + return True; } /*************************************************************************** @@ -188,45 +180,44 @@ static struct packet_struct *create_and_init_netbios_packet(struct nmb_name *nmb BOOL bcast, BOOL rec_des, struct in_addr to_ip) { - struct packet_struct *packet = NULL; - struct nmb_packet *nmb = NULL; - - /* Allocate the packet_struct we will return. */ - if((packet = (struct packet_struct *)malloc(sizeof(*packet))) == NULL) - { - DEBUG(0,("create_and_init_netbios_packet: malloc fail (1) for packet struct.\n")); - return NULL; - } + struct packet_struct *packet = NULL; + struct nmb_packet *nmb = NULL; + + /* Allocate the packet_struct we will return. */ + if((packet = (struct packet_struct *)malloc(sizeof(*packet))) == NULL) { + DEBUG(0,("create_and_init_netbios_packet: malloc fail (1) for packet struct.\n")); + return NULL; + } - memset((char *)packet,'\0',sizeof(*packet)); + memset((char *)packet,'\0',sizeof(*packet)); - nmb = &packet->packet.nmb; + nmb = &packet->packet.nmb; - nmb->header.name_trn_id = generate_name_trn_id(); - nmb->header.response = False; - nmb->header.nm_flags.recursion_desired = rec_des; - nmb->header.nm_flags.recursion_available = False; - nmb->header.nm_flags.trunc = False; - nmb->header.nm_flags.authoritative = False; - nmb->header.nm_flags.bcast = bcast; + nmb->header.name_trn_id = generate_name_trn_id(); + nmb->header.response = False; + nmb->header.nm_flags.recursion_desired = rec_des; + nmb->header.nm_flags.recursion_available = False; + nmb->header.nm_flags.trunc = False; + nmb->header.nm_flags.authoritative = False; + nmb->header.nm_flags.bcast = bcast; - nmb->header.rcode = 0; - nmb->header.qdcount = 1; - nmb->header.ancount = 0; - nmb->header.nscount = 0; - - nmb->question.question_name = *nmbname; - nmb->question.question_type = QUESTION_TYPE_NB_QUERY; - nmb->question.question_class = QUESTION_CLASS_IN; - - packet->ip = to_ip; - packet->port = NMB_PORT; - packet->fd = ClientNMB; - packet->timestamp = time(NULL); - packet->packet_type = NMB_PACKET; - packet->locked = False; + nmb->header.rcode = 0; + nmb->header.qdcount = 1; + nmb->header.ancount = 0; + nmb->header.nscount = 0; + + nmb->question.question_name = *nmbname; + nmb->question.question_type = QUESTION_TYPE_NB_QUERY; + nmb->question.question_class = QUESTION_CLASS_IN; + + packet->ip = to_ip; + packet->port = NMB_PORT; + packet->fd = ClientNMB; + packet->timestamp = time(NULL); + packet->packet_type = NMB_PACKET; + packet->locked = False; - return packet; /* Caller must free. */ + return packet; /* Caller must free. */ } /*************************************************************************** @@ -283,20 +274,20 @@ static BOOL create_and_init_additional_record(struct packet_struct *packet, static BOOL initiate_name_query_packet( struct packet_struct *packet) { - struct nmb_packet *nmb = NULL; + struct nmb_packet *nmb = NULL; - nmb = &packet->packet.nmb; + nmb = &packet->packet.nmb; - nmb->header.opcode = NMB_NAME_QUERY_OPCODE; - nmb->header.arcount = 0; + nmb->header.opcode = NMB_NAME_QUERY_OPCODE; + nmb->header.arcount = 0; - nmb->header.nm_flags.recursion_desired = True; + nmb->header.nm_flags.recursion_desired = True; - DEBUG(4,("initiate_name_query_packet: sending query for name %s (bcast=%s) to IP %s\n", - nmb_namestr(&nmb->question.question_name), - BOOLSTR(nmb->header.nm_flags.bcast), inet_ntoa(packet->ip))); + DEBUG(4,("initiate_name_query_packet: sending query for name %s (bcast=%s) to IP %s\n", + nmb_namestr(&nmb->question.question_name), + BOOLSTR(nmb->header.nm_flags.bcast), inet_ntoa(packet->ip))); - return send_netbios_packet( packet ); + return send_netbios_packet( packet ); } /*************************************************************************** @@ -305,20 +296,20 @@ static BOOL initiate_name_query_packet( struct packet_struct *packet) static BOOL initiate_name_query_packet_from_wins_server( struct packet_struct *packet) { - struct nmb_packet *nmb = NULL; + struct nmb_packet *nmb = NULL; - nmb = &packet->packet.nmb; + nmb = &packet->packet.nmb; - nmb->header.opcode = NMB_NAME_QUERY_OPCODE; - nmb->header.arcount = 0; + nmb->header.opcode = NMB_NAME_QUERY_OPCODE; + nmb->header.arcount = 0; - nmb->header.nm_flags.recursion_desired = False; + nmb->header.nm_flags.recursion_desired = False; - DEBUG(4,("initiate_name_query_packet_from_wins_server: sending query for name %s (bcast=%s) to IP %s\n", - nmb_namestr(&nmb->question.question_name), - BOOLSTR(nmb->header.nm_flags.bcast), inet_ntoa(packet->ip))); + DEBUG(4,("initiate_name_query_packet_from_wins_server: sending query for name %s (bcast=%s) to IP %s\n", + nmb_namestr(&nmb->question.question_name), + BOOLSTR(nmb->header.nm_flags.bcast), inet_ntoa(packet->ip))); - return send_netbios_packet( packet ); + return send_netbios_packet( packet ); } /*************************************************************************** @@ -328,21 +319,21 @@ static BOOL initiate_name_query_packet_from_wins_server( struct packet_struct *p static BOOL initiate_name_register_packet( struct packet_struct *packet, uint16 nb_flags, struct in_addr *register_ip) { - struct nmb_packet *nmb = &packet->packet.nmb; + struct nmb_packet *nmb = &packet->packet.nmb; - nmb->header.opcode = NMB_NAME_REG_OPCODE; - nmb->header.arcount = 1; + nmb->header.opcode = NMB_NAME_REG_OPCODE; + nmb->header.arcount = 1; - nmb->header.nm_flags.recursion_desired = True; + nmb->header.nm_flags.recursion_desired = True; - if(create_and_init_additional_record(packet, nb_flags, register_ip) == False) - return False; + if(create_and_init_additional_record(packet, nb_flags, register_ip) == False) + return False; - DEBUG(4,("initiate_name_register_packet: sending registration for name %s (bcast=%s) to IP %s\n", - nmb_namestr(&nmb->additional->rr_name), - BOOLSTR(nmb->header.nm_flags.bcast), inet_ntoa(packet->ip))); + DEBUG(4,("initiate_name_register_packet: sending registration for name %s (bcast=%s) to IP %s\n", + nmb_namestr(&nmb->additional->rr_name), + BOOLSTR(nmb->header.nm_flags.bcast), inet_ntoa(packet->ip))); - return send_netbios_packet( packet ); + return send_netbios_packet( packet ); } /*************************************************************************** @@ -380,21 +371,21 @@ for name %s IP %s (bcast=%s) to IP %s\n", static BOOL initiate_name_refresh_packet( struct packet_struct *packet, uint16 nb_flags, struct in_addr *refresh_ip) { - struct nmb_packet *nmb = &packet->packet.nmb; + struct nmb_packet *nmb = &packet->packet.nmb; - nmb->header.opcode = NMB_NAME_REFRESH_OPCODE_8; - nmb->header.arcount = 1; + nmb->header.opcode = NMB_NAME_REFRESH_OPCODE_8; + nmb->header.arcount = 1; - nmb->header.nm_flags.recursion_desired = False; + nmb->header.nm_flags.recursion_desired = False; - if(create_and_init_additional_record(packet, nb_flags, refresh_ip) == False) - return False; + if(create_and_init_additional_record(packet, nb_flags, refresh_ip) == False) + return False; - DEBUG(4,("initiate_name_refresh_packet: sending refresh for name %s (bcast=%s) to IP %s\n", - nmb_namestr(&nmb->additional->rr_name), - BOOLSTR(nmb->header.nm_flags.bcast), inet_ntoa(packet->ip))); + DEBUG(4,("initiate_name_refresh_packet: sending refresh for name %s (bcast=%s) to IP %s\n", + nmb_namestr(&nmb->additional->rr_name), + BOOLSTR(nmb->header.nm_flags.bcast), inet_ntoa(packet->ip))); - return send_netbios_packet( packet ); + return send_netbios_packet( packet ); } /*************************************************************************** @@ -404,21 +395,21 @@ static BOOL initiate_name_refresh_packet( struct packet_struct *packet, static BOOL initiate_name_release_packet( struct packet_struct *packet, uint16 nb_flags, struct in_addr *release_ip) { - struct nmb_packet *nmb = &packet->packet.nmb; + struct nmb_packet *nmb = &packet->packet.nmb; - nmb->header.opcode = NMB_NAME_RELEASE_OPCODE; - nmb->header.arcount = 1; + nmb->header.opcode = NMB_NAME_RELEASE_OPCODE; + nmb->header.arcount = 1; - nmb->header.nm_flags.recursion_desired = False; + nmb->header.nm_flags.recursion_desired = False; - if(create_and_init_additional_record(packet, nb_flags, release_ip) == False) - return False; + if(create_and_init_additional_record(packet, nb_flags, release_ip) == False) + return False; - DEBUG(4,("initiate_name_release_packet: sending release for name %s (bcast=%s) to IP %s\n", - nmb_namestr(&nmb->additional->rr_name), - BOOLSTR(nmb->header.nm_flags.bcast), inet_ntoa(packet->ip))); + DEBUG(4,("initiate_name_release_packet: sending release for name %s (bcast=%s) to IP %s\n", + nmb_namestr(&nmb->additional->rr_name), + BOOLSTR(nmb->header.nm_flags.bcast), inet_ntoa(packet->ip))); - return send_netbios_packet( packet ); + return send_netbios_packet( packet ); } /*************************************************************************** @@ -427,20 +418,20 @@ static BOOL initiate_name_release_packet( struct packet_struct *packet, static BOOL initiate_node_status_packet( struct packet_struct *packet ) { - struct nmb_packet *nmb = &packet->packet.nmb; + struct nmb_packet *nmb = &packet->packet.nmb; - nmb->header.opcode = NMB_NAME_QUERY_OPCODE; - nmb->header.arcount = 0; + nmb->header.opcode = NMB_NAME_QUERY_OPCODE; + nmb->header.arcount = 0; - nmb->header.nm_flags.recursion_desired = False; + nmb->header.nm_flags.recursion_desired = False; - nmb->question.question_type = QUESTION_TYPE_NB_STATUS; + nmb->question.question_type = QUESTION_TYPE_NB_STATUS; - DEBUG(4,("initiate_node_status_packet: sending node status request for name %s to IP %s\n", - nmb_namestr(&nmb->question.question_name), - inet_ntoa(packet->ip))); + DEBUG(4,("initiate_node_status_packet: sending node status request for name %s to IP %s\n", + nmb_namestr(&nmb->question.question_name), + inet_ntoa(packet->ip))); - return send_netbios_packet( packet ); + return send_netbios_packet( packet ); } /**************************************************************************** @@ -456,13 +447,12 @@ static BOOL initiate_node_status_packet( struct packet_struct *packet ) static BOOL assert_check_subnet(struct subnet_record *subrec) { - if( subrec == remote_broadcast_subnet) - { - DEBUG(0,("assert_check_subnet: Attempt to send packet on remote broadcast subnet. \ + if( subrec == remote_broadcast_subnet) { + DEBUG(0,("assert_check_subnet: Attempt to send packet on remote broadcast subnet. \ This is a bug.\n")); - return True; - } - return False; + return True; + } + return False; } /**************************************************************************** @@ -478,46 +468,42 @@ struct response_record *queue_register_name( struct subnet_record *subrec, struct nmb_name *nmbname, uint16 nb_flags) { - struct packet_struct *p; - struct response_record *rrec; - - if(assert_check_subnet(subrec)) - return NULL; - - /* note that all name registration requests have RD set (rfc1002 - - section 4.2.2 */ - if ((p = create_and_init_netbios_packet(nmbname, (subrec != unicast_subnet), True, - subrec->bcast_ip)) == NULL) - return NULL; - - if(initiate_name_register_packet( p, nb_flags, - iface_ip(subrec->bcast_ip)) == False) - { - p->locked = False; - free_packet(p); - return NULL; - } - - if((rrec = make_response_record(subrec, /* subnet record. */ - p, /* packet we sent. */ - resp_fn, /* function to call on response. */ - timeout_fn, /* function to call on timeout. */ - (success_function)success_fn, /* function to call on operation success. */ - (fail_function)fail_fn, /* function to call on operation fail. */ - userdata)) == NULL) - { - p->locked = False; - free_packet(p); - return NULL; - } - - return rrec; -} + struct packet_struct *p; + struct response_record *rrec; + + if(assert_check_subnet(subrec)) + return NULL; + + /* note that all name registration requests have RD set (rfc1002 - section 4.2.2 */ + if ((p = create_and_init_netbios_packet(nmbname, (subrec != unicast_subnet), True, + subrec->bcast_ip)) == NULL) + return NULL; + + if(initiate_name_register_packet( p, nb_flags, iface_ip(subrec->bcast_ip)) == False) { + p->locked = False; + free_packet(p); + return NULL; + } + + if((rrec = make_response_record(subrec, /* subnet record. */ + p, /* packet we sent. */ + resp_fn, /* function to call on response. */ + timeout_fn, /* function to call on timeout. */ + (success_function)success_fn, /* function to call on operation success. */ + (fail_function)fail_fn, /* function to call on operation fail. */ + userdata)) == NULL) { + p->locked = False; + free_packet(p); + return NULL; + } + return rrec; +} /**************************************************************************** Queue a refresh name packet to the broadcast address of a subnet. ****************************************************************************/ + void queue_wins_refresh(struct nmb_name *nmbname, response_function resp_fn, timeout_response_function timeout_fn, @@ -648,47 +634,44 @@ struct response_record *queue_release_name( struct subnet_record *subrec, struct in_addr release_ip, struct in_addr dest_ip) { - struct packet_struct *p; - struct response_record *rrec; - - if(assert_check_subnet(subrec)) - return NULL; - - if ((p = create_and_init_netbios_packet(nmbname, (subrec != unicast_subnet), False, - dest_ip)) == NULL) - return NULL; - - if(initiate_name_release_packet( p, nb_flags, &release_ip) == False) - { - p->locked = False; - free_packet(p); - return NULL; - } - - if((rrec = make_response_record(subrec, /* subnet record. */ - p, /* packet we sent. */ - resp_fn, /* function to call on response. */ - timeout_fn, /* function to call on timeout. */ - (success_function)success_fn, /* function to call on operation success. */ - (fail_function)fail_fn, /* function to call on operation fail. */ - userdata)) == NULL) - { - p->locked = False; - free_packet(p); - return NULL; - } - - /* - * For a broadcast release packet, only send once. - * This will cause us to remove the name asap. JRA. - */ - - if (subrec != unicast_subnet) { - rrec->repeat_count = 0; - rrec->repeat_time = 0; - } - - return rrec; + struct packet_struct *p; + struct response_record *rrec; + + if(assert_check_subnet(subrec)) + return NULL; + + if ((p = create_and_init_netbios_packet(nmbname, (subrec != unicast_subnet), False, dest_ip)) == NULL) + return NULL; + + if(initiate_name_release_packet( p, nb_flags, &release_ip) == False) { + p->locked = False; + free_packet(p); + return NULL; + } + + if((rrec = make_response_record(subrec, /* subnet record. */ + p, /* packet we sent. */ + resp_fn, /* function to call on response. */ + timeout_fn, /* function to call on timeout. */ + (success_function)success_fn, /* function to call on operation success. */ + (fail_function)fail_fn, /* function to call on operation fail. */ + userdata)) == NULL) { + p->locked = False; + free_packet(p); + return NULL; + } + + /* + * For a broadcast release packet, only send once. + * This will cause us to remove the name asap. JRA. + */ + + if (subrec != unicast_subnet) { + rrec->repeat_count = 0; + rrec->repeat_time = 0; + } + + return rrec; } /**************************************************************************** @@ -703,80 +686,80 @@ struct response_record *queue_query_name( struct subnet_record *subrec, struct userdata_struct *userdata, struct nmb_name *nmbname) { - struct packet_struct *p; - struct response_record *rrec; - struct in_addr to_ip; + struct packet_struct *p; + struct response_record *rrec; + struct in_addr to_ip; - if(assert_check_subnet(subrec)) - return NULL; + if(assert_check_subnet(subrec)) + return NULL; - to_ip = subrec->bcast_ip; + to_ip = subrec->bcast_ip; - /* queries to the WINS server turn up here as queries to IP 0.0.0.0 - These need to be handled a bit differently */ - if (subrec->type == UNICAST_SUBNET && is_zero_ip(to_ip)) { - /* what we really need to do is loop over each of our wins - * servers and wins server tags here, but that just doesn't - * fit our architecture at the moment (userdata may already - * be used when we get here). For now we just query the first - * active wins server on the first tag. */ - char **tags = wins_srv_tags(); - if (!tags) { - return NULL; - } - to_ip = wins_srv_ip_tag(tags[0], to_ip); - wins_srv_tags_free(tags); - } - - if(( p = create_and_init_netbios_packet(nmbname, - (subrec != unicast_subnet), - (subrec == unicast_subnet), - to_ip)) == NULL) - return NULL; - - if(lp_bind_interfaces_only()) { - int i; - - DEBUG(10,("queue_query_name: bind_interfaces_only is set, looking for suitable source IP\n")); - for(i = 0; i < iface_count(); i++) { - struct in_addr *ifip = iface_n_ip(i); - - if(ifip == NULL) { - DEBUG(0,("queue_query_name: interface %d has NULL IP address !\n", i)); - continue; - } - - if (ip_equal(*ifip,loopback_ip)) { - DEBUG(5,("queue_query_name: ignoring loopback interface (%d)\n", i)); - continue; - } - - DEBUG(10,("queue_query_name: using source IP %s\n",inet_ntoa(*ifip))); - p->fd = find_subnet_fd_for_address( *ifip ); - break; - } - } - - if(initiate_name_query_packet( p ) == False) { - p->locked = False; - free_packet(p); - return NULL; - } - - if((rrec = make_response_record(subrec, /* subnet record. */ - p, /* packet we sent. */ - resp_fn, /* function to call on response. */ - timeout_fn, /* function to call on timeout. */ - (success_function)success_fn, /* function to call on operation success. */ - (fail_function)fail_fn, /* function to call on operation fail. */ - userdata)) == NULL) - { - p->locked = False; - free_packet(p); - return NULL; - } - - return rrec; + /* queries to the WINS server turn up here as queries to IP 0.0.0.0 + These need to be handled a bit differently */ + if (subrec->type == UNICAST_SUBNET && is_zero_ip(to_ip)) { + /* What we really need to do is loop over each of our wins + * servers and wins server tags here, but that just doesn't + * fit our architecture at the moment (userdata may already + * be used when we get here). For now we just query the first + * active wins server on the first tag. + */ + char **tags = wins_srv_tags(); + if (!tags) { + return NULL; + } + to_ip = wins_srv_ip_tag(tags[0], to_ip); + wins_srv_tags_free(tags); + } + + if(( p = create_and_init_netbios_packet(nmbname, + (subrec != unicast_subnet), + (subrec == unicast_subnet), + to_ip)) == NULL) + return NULL; + + if(lp_bind_interfaces_only()) { + int i; + + DEBUG(10,("queue_query_name: bind_interfaces_only is set, looking for suitable source IP\n")); + for(i = 0; i < iface_count(); i++) { + struct in_addr *ifip = iface_n_ip(i); + + if(ifip == NULL) { + DEBUG(0,("queue_query_name: interface %d has NULL IP address !\n", i)); + continue; + } + + if (ip_equal(*ifip,loopback_ip)) { + DEBUG(5,("queue_query_name: ignoring loopback interface (%d)\n", i)); + continue; + } + + DEBUG(10,("queue_query_name: using source IP %s\n",inet_ntoa(*ifip))); + p->fd = find_subnet_fd_for_address( *ifip ); + break; + } + } + + if(initiate_name_query_packet( p ) == False) { + p->locked = False; + free_packet(p); + return NULL; + } + + if((rrec = make_response_record(subrec, /* subnet record. */ + p, /* packet we sent. */ + resp_fn, /* function to call on response. */ + timeout_fn, /* function to call on timeout. */ + (success_function)success_fn, /* function to call on operation success. */ + (fail_function)fail_fn, /* function to call on operation fail. */ + userdata)) == NULL) { + p->locked = False; + free_packet(p); + return NULL; + } + + return rrec; } /**************************************************************************** @@ -791,33 +774,31 @@ struct response_record *queue_query_name_from_wins_server( struct in_addr to_ip, struct userdata_struct *userdata, struct nmb_name *nmbname) { - struct packet_struct *p; - struct response_record *rrec; - - if ((p = create_and_init_netbios_packet(nmbname, False, False, to_ip)) == NULL) - return NULL; - - if(initiate_name_query_packet_from_wins_server( p ) == False) - { - p->locked = False; - free_packet(p); - return NULL; - } - - if((rrec = make_response_record(wins_server_subnet, /* subnet record. */ - p, /* packet we sent. */ - resp_fn, /* function to call on response. */ - timeout_fn, /* function to call on timeout. */ - (success_function)success_fn, /* function to call on operation success. */ - (fail_function)fail_fn, /* function to call on operation fail. */ - userdata)) == NULL) - { - p->locked = False; - free_packet(p); - return NULL; - } - - return rrec; + struct packet_struct *p; + struct response_record *rrec; + + if ((p = create_and_init_netbios_packet(nmbname, False, False, to_ip)) == NULL) + return NULL; + + if(initiate_name_query_packet_from_wins_server( p ) == False) { + p->locked = False; + free_packet(p); + return NULL; + } + + if((rrec = make_response_record(wins_server_subnet, /* subnet record. */ + p, /* packet we sent. */ + resp_fn, /* function to call on response. */ + timeout_fn, /* function to call on timeout. */ + (success_function)success_fn, /* function to call on operation success. */ + (fail_function)fail_fn, /* function to call on operation fail. */ + userdata)) == NULL) { + p->locked = False; + free_packet(p); + return NULL; + } + + return rrec; } /**************************************************************************** @@ -833,45 +814,41 @@ struct response_record *queue_node_status( struct subnet_record *subrec, struct nmb_name *nmbname, struct in_addr send_ip) { - struct packet_struct *p; - struct response_record *rrec; + struct packet_struct *p; + struct response_record *rrec; - /* Sanity check. */ - if(subrec != unicast_subnet) - { - DEBUG(0,("queue_register_multihomed_name: should only be done on \ + /* Sanity check. */ + if(subrec != unicast_subnet) { + DEBUG(0,("queue_register_multihomed_name: should only be done on \ unicast subnet. subnet is %s\n.", subrec->subnet_name )); - return NULL; - } - - if(assert_check_subnet(subrec)) - return NULL; - - if(( p = create_and_init_netbios_packet(nmbname, False, False, - send_ip)) == NULL) - return NULL; - - if(initiate_node_status_packet(p) == False) - { - p->locked = False; - free_packet(p); - return NULL; - } - - if((rrec = make_response_record(subrec, /* subnet record. */ - p, /* packet we sent. */ - resp_fn, /* function to call on response. */ - timeout_fn, /* function to call on timeout. */ - (success_function)success_fn, /* function to call on operation success. */ - (fail_function)fail_fn, /* function to call on operation fail. */ - userdata)) == NULL) - { - p->locked = False; - free_packet(p); - return NULL; - } - - return rrec; + return NULL; + } + + if(assert_check_subnet(subrec)) + return NULL; + + if(( p = create_and_init_netbios_packet(nmbname, False, False, send_ip)) == NULL) + return NULL; + + if(initiate_node_status_packet(p) == False) { + p->locked = False; + free_packet(p); + return NULL; + } + + if((rrec = make_response_record(subrec, /* subnet record. */ + p, /* packet we sent. */ + resp_fn, /* function to call on response. */ + timeout_fn, /* function to call on timeout. */ + (success_function)success_fn, /* function to call on operation success. */ + (fail_function)fail_fn, /* function to call on operation fail. */ + userdata)) == NULL) { + p->locked = False; + free_packet(p); + return NULL; + } + + return rrec; } /**************************************************************************** @@ -882,169 +859,145 @@ void reply_netbios_packet(struct packet_struct *orig_packet, int rcode, enum netbios_reply_type_code rcv_code, int opcode, int ttl, char *data,int len) { - struct packet_struct packet; - struct nmb_packet *nmb = NULL; - struct res_rec answers; - struct nmb_packet *orig_nmb = &orig_packet->packet.nmb; - BOOL loopback_this_packet = False; - const char *packet_type = "unknown"; + struct packet_struct packet; + struct nmb_packet *nmb = NULL; + struct res_rec answers; + struct nmb_packet *orig_nmb = &orig_packet->packet.nmb; + BOOL loopback_this_packet = False; + const char *packet_type = "unknown"; - /* Check if we are sending to or from ourselves. */ - if(ismyip(orig_packet->ip) && (orig_packet->port == global_nmb_port)) - loopback_this_packet = True; + /* Check if we are sending to or from ourselves. */ + if(ismyip(orig_packet->ip) && (orig_packet->port == global_nmb_port)) + loopback_this_packet = True; - nmb = &packet.packet.nmb; - - /* Do a partial copy of the packet. We clear the locked flag and - the resource record pointers. */ - packet = *orig_packet; /* Full structure copy. */ - packet.locked = False; - nmb->answers = NULL; - nmb->nsrecs = NULL; - nmb->additional = NULL; - - switch (rcv_code) - { - case NMB_STATUS: - { - packet_type = "nmb_status"; - nmb->header.nm_flags.recursion_desired = False; - nmb->header.nm_flags.recursion_available = False; - break; - } - case NMB_QUERY: - { - packet_type = "nmb_query"; - nmb->header.nm_flags.recursion_desired = True; - nmb->header.nm_flags.recursion_available = True; - break; - } - case NMB_REG: - case NMB_REG_REFRESH: - { - packet_type = "nmb_reg"; - nmb->header.nm_flags.recursion_desired = True; - nmb->header.nm_flags.recursion_available = True; - break; - } - case NMB_REL: - { - packet_type = "nmb_rel"; - nmb->header.nm_flags.recursion_desired = False; - nmb->header.nm_flags.recursion_available = False; - break; - } - case NMB_WAIT_ACK: - { - packet_type = "nmb_wack"; - nmb->header.nm_flags.recursion_desired = False; - nmb->header.nm_flags.recursion_available = False; - break; - } - case WINS_REG: - { - packet_type = "wins_reg"; - nmb->header.nm_flags.recursion_desired = True; - nmb->header.nm_flags.recursion_available = True; - break; - } - case WINS_QUERY: - { - packet_type = "wins_query"; - nmb->header.nm_flags.recursion_desired = True; - nmb->header.nm_flags.recursion_available = True; - break; - } - - default: - { - DEBUG(0,("reply_netbios_packet: Unknown packet type: %s %s to ip %s\n", - packet_type, nmb_namestr(&orig_nmb->question.question_name), - inet_ntoa(packet.ip))); - - return; - } - } - - DEBUG(4,("reply_netbios_packet: sending a reply of packet type: %s %s to ip %s \ -for id %hu\n", - packet_type, nmb_namestr(&orig_nmb->question.question_name), - inet_ntoa(packet.ip), orig_nmb->header.name_trn_id)); - - nmb->header.name_trn_id = orig_nmb->header.name_trn_id; - nmb->header.opcode = opcode; - nmb->header.response = True; - nmb->header.nm_flags.bcast = False; - nmb->header.nm_flags.trunc = False; - nmb->header.nm_flags.authoritative = True; + nmb = &packet.packet.nmb; + + /* Do a partial copy of the packet. We clear the locked flag and + the resource record pointers. */ + packet = *orig_packet; /* Full structure copy. */ + packet.locked = False; + nmb->answers = NULL; + nmb->nsrecs = NULL; + nmb->additional = NULL; + + switch (rcv_code) { + case NMB_STATUS: + packet_type = "nmb_status"; + nmb->header.nm_flags.recursion_desired = False; + nmb->header.nm_flags.recursion_available = False; + break; + case NMB_QUERY: + packet_type = "nmb_query"; + nmb->header.nm_flags.recursion_desired = True; + nmb->header.nm_flags.recursion_available = True; + break; + case NMB_REG: + case NMB_REG_REFRESH: + packet_type = "nmb_reg"; + nmb->header.nm_flags.recursion_desired = True; + nmb->header.nm_flags.recursion_available = True; + break; + case NMB_REL: + packet_type = "nmb_rel"; + nmb->header.nm_flags.recursion_desired = False; + nmb->header.nm_flags.recursion_available = False; + break; + case NMB_WAIT_ACK: + packet_type = "nmb_wack"; + nmb->header.nm_flags.recursion_desired = False; + nmb->header.nm_flags.recursion_available = False; + break; + case WINS_REG: + packet_type = "wins_reg"; + nmb->header.nm_flags.recursion_desired = True; + nmb->header.nm_flags.recursion_available = True; + break; + case WINS_QUERY: + packet_type = "wins_query"; + nmb->header.nm_flags.recursion_desired = True; + nmb->header.nm_flags.recursion_available = True; + break; + default: + DEBUG(0,("reply_netbios_packet: Unknown packet type: %s %s to ip %s\n", + packet_type, nmb_namestr(&orig_nmb->question.question_name), + inet_ntoa(packet.ip))); + return; + } + + DEBUG(4,("reply_netbios_packet: sending a reply of packet type: %s %s to ip %s \ +for id %hu\n", packet_type, nmb_namestr(&orig_nmb->question.question_name), + inet_ntoa(packet.ip), orig_nmb->header.name_trn_id)); + + nmb->header.name_trn_id = orig_nmb->header.name_trn_id; + nmb->header.opcode = opcode; + nmb->header.response = True; + nmb->header.nm_flags.bcast = False; + nmb->header.nm_flags.trunc = False; + nmb->header.nm_flags.authoritative = True; - nmb->header.rcode = rcode; - nmb->header.qdcount = 0; - nmb->header.ancount = 1; - nmb->header.nscount = 0; - nmb->header.arcount = 0; + nmb->header.rcode = rcode; + nmb->header.qdcount = 0; + nmb->header.ancount = 1; + nmb->header.nscount = 0; + nmb->header.arcount = 0; - memset((char*)&nmb->question,'\0',sizeof(nmb->question)); + memset((char*)&nmb->question,'\0',sizeof(nmb->question)); - nmb->answers = &answers; - memset((char*)nmb->answers,'\0',sizeof(*nmb->answers)); + nmb->answers = &answers; + memset((char*)nmb->answers,'\0',sizeof(*nmb->answers)); - nmb->answers->rr_name = orig_nmb->question.question_name; - nmb->answers->rr_type = orig_nmb->question.question_type; - nmb->answers->rr_class = orig_nmb->question.question_class; - nmb->answers->ttl = ttl; + nmb->answers->rr_name = orig_nmb->question.question_name; + nmb->answers->rr_type = orig_nmb->question.question_type; + nmb->answers->rr_class = orig_nmb->question.question_class; + nmb->answers->ttl = ttl; - if (data && len) - { - nmb->answers->rdlength = len; - memcpy(nmb->answers->rdata, data, len); - } + if (data && len) { + nmb->answers->rdlength = len; + memcpy(nmb->answers->rdata, data, len); + } - packet.packet_type = NMB_PACKET; - /* Ensure we send out on the same fd that the original - packet came in on to give the correct source IP address. */ - packet.fd = orig_packet->fd; - packet.timestamp = time(NULL); + packet.packet_type = NMB_PACKET; + /* Ensure we send out on the same fd that the original + packet came in on to give the correct source IP address. */ + packet.fd = orig_packet->fd; + packet.timestamp = time(NULL); - debug_nmb_packet(&packet); + debug_nmb_packet(&packet); - if(loopback_this_packet) - { - struct packet_struct *lo_packet; - DEBUG(5,("reply_netbios_packet: sending packet to ourselves.\n")); - if((lo_packet = copy_packet(&packet)) == NULL) - return; - queue_packet(lo_packet); - } - else if (!send_packet(&packet)) - { - DEBUG(0,("reply_netbios_packet: send_packet to IP %s port %d failed\n", - inet_ntoa(packet.ip),packet.port)); - } + if(loopback_this_packet) { + struct packet_struct *lo_packet; + DEBUG(5,("reply_netbios_packet: sending packet to ourselves.\n")); + if((lo_packet = copy_packet(&packet)) == NULL) + return; + queue_packet(lo_packet); + } else if (!send_packet(&packet)) { + DEBUG(0,("reply_netbios_packet: send_packet to IP %s port %d failed\n", + inet_ntoa(packet.ip),packet.port)); + } } /******************************************************************* Queue a packet into a packet queue ******************************************************************/ + static void queue_packet(struct packet_struct *packet) { - struct packet_struct *p; - - if (!packet_queue) - { - packet->prev = NULL; - packet->next = NULL; - packet_queue = packet; - return; - } + struct packet_struct *p; + + if (!packet_queue) { + packet->prev = NULL; + packet->next = NULL; + packet_queue = packet; + return; + } - /* find the bottom */ - for (p=packet_queue;p->next;p=p->next) - ; + /* find the bottom */ + for (p=packet_queue;p->next;p=p->next) + ; - p->next = packet; - packet->next = NULL; - packet->prev = p; + p->next = packet; + packet->next = NULL; + packet->prev = p; } /**************************************************************************** @@ -1053,184 +1006,153 @@ static void queue_packet(struct packet_struct *packet) static struct subnet_record *find_subnet_for_dgram_browse_packet(struct packet_struct *p) { - struct subnet_record *subrec; - - /* Go through all the broadcast subnets and see if the mask matches. */ - for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - if(same_net(p->ip, subrec->bcast_ip, subrec->mask_ip)) - return subrec; - } - - /* If the subnet record is the remote announce broadcast subnet, - hack it here to be the first subnet. This is really gross and - is needed due to people turning on port 137/138 broadcast - forwarding on their routers. May fire and brimstone rain - down upon them... - */ - - return FIRST_SUBNET; + struct subnet_record *subrec; + + /* Go through all the broadcast subnets and see if the mask matches. */ + for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + if(same_net(p->ip, subrec->bcast_ip, subrec->mask_ip)) + return subrec; + } + + /* If the subnet record is the remote announce broadcast subnet, + hack it here to be the first subnet. This is really gross and + is needed due to people turning on port 137/138 broadcast + forwarding on their routers. May fire and brimstone rain + down upon them... + */ + + return FIRST_SUBNET; } /**************************************************************************** Dispatch a browse frame from port 138 to the correct processing function. ****************************************************************************/ + static void process_browse_packet(struct packet_struct *p, char *buf,int len) { - struct dgram_packet *dgram = &p->packet.dgram; - int command = CVAL(buf,0); - struct subnet_record *subrec = find_subnet_for_dgram_browse_packet(p); - - /* Drop the packet if it's a different NetBIOS scope, or - the source is from one of our names. */ - - if (!strequal(dgram->dest_name.scope, global_scope())) - { - DEBUG(7,("process_browse_packet: Discarding datagram from IP %s. Scope (%s) \ -mismatch with our scope (%s).\n", inet_ntoa(p->ip), dgram->dest_name.scope, global_scope())); - return; - } - - if (is_myname(dgram->source_name.name)) - { - DEBUG(0,("process_browse_packet: Discarding datagram from IP %s. Source name \ + struct dgram_packet *dgram = &p->packet.dgram; + int command = CVAL(buf,0); + struct subnet_record *subrec = find_subnet_for_dgram_browse_packet(p); + char scope[64]; + nstring src_name; + + /* Drop the packet if it's a different NetBIOS scope, or the source is from one of our names. */ + pull_ascii(scope, dgram->dest_name.scope, 64, 64, STR_TERMINATE); + if (!strequal(scope, global_scope())) { + DEBUG(7,("process_browse_packet: Discarding datagram from IP %s. Scope (%s) \ +mismatch with our scope (%s).\n", inet_ntoa(p->ip), scope, global_scope())); + return; + } + + pull_ascii_nstring(src_name, dgram->source_name.name); + if (is_myname(src_name)) { + DEBUG(0,("process_browse_packet: Discarding datagram from IP %s. Source name \ %s is one of our names !\n", inet_ntoa(p->ip), nmb_namestr(&dgram->source_name))); - return; - } - - switch (command) - { - case ANN_HostAnnouncement: - { - debug_browse_data(buf, len); - process_host_announce(subrec, p, buf+1); - break; - } - case ANN_DomainAnnouncement: - { - debug_browse_data(buf, len); - process_workgroup_announce(subrec, p, buf+1); - break; - } - case ANN_LocalMasterAnnouncement: - { - debug_browse_data(buf, len); - process_local_master_announce(subrec, p, buf+1); - break; - } - case ANN_AnnouncementRequest: - { - debug_browse_data(buf, len); - process_announce_request(subrec, p, buf+1); - break; - } - case ANN_Election: - { - debug_browse_data(buf, len); - process_election(subrec, p, buf+1); - break; - } - case ANN_GetBackupListReq: - { - debug_browse_data(buf, len); - process_get_backup_list_request(subrec, p, buf+1); - break; - } - case ANN_GetBackupListResp: - { - debug_browse_data(buf, len); - /* We never send ANN_GetBackupListReq so we - should never get these. */ - DEBUG(0,("process_browse_packet: Discarding GetBackupListResponse \ + return; + } + + switch (command) { + case ANN_HostAnnouncement: + debug_browse_data(buf, len); + process_host_announce(subrec, p, buf+1); + break; + case ANN_DomainAnnouncement: + debug_browse_data(buf, len); + process_workgroup_announce(subrec, p, buf+1); + break; + case ANN_LocalMasterAnnouncement: + debug_browse_data(buf, len); + process_local_master_announce(subrec, p, buf+1); + break; + case ANN_AnnouncementRequest: + debug_browse_data(buf, len); + process_announce_request(subrec, p, buf+1); + break; + case ANN_Election: + debug_browse_data(buf, len); + process_election(subrec, p, buf+1); + break; + case ANN_GetBackupListReq: + debug_browse_data(buf, len); + process_get_backup_list_request(subrec, p, buf+1); + break; + case ANN_GetBackupListResp: + debug_browse_data(buf, len); + /* We never send ANN_GetBackupListReq so we should never get these. */ + DEBUG(0,("process_browse_packet: Discarding GetBackupListResponse \ packet from %s IP %s\n", nmb_namestr(&dgram->source_name), inet_ntoa(p->ip))); - break; - } - case ANN_ResetBrowserState: - { - debug_browse_data(buf, len); - process_reset_browser(subrec, p, buf+1); - break; - } - case ANN_MasterAnnouncement: - { - /* Master browser datagrams must be processed - on the unicast subnet. */ - subrec = unicast_subnet; - - debug_browse_data(buf, len); - process_master_browser_announce(subrec, p, buf+1); - break; - } - case ANN_BecomeBackup: - { - /* - * We don't currently implement this. Log it just in case. - */ - debug_browse_data(buf, len); - DEBUG(10,("process_browse_packet: On subnet %s ignoring browse packet \ -command ANN_BecomeBackup from %s IP %s to %s\n", - subrec->subnet_name, nmb_namestr(&dgram->source_name), - inet_ntoa(p->ip), nmb_namestr(&dgram->dest_name))); - break; - } - default: - { - debug_browse_data(buf, len); - DEBUG(0,("process_browse_packet: On subnet %s ignoring browse packet \ -command code %d from %s IP %s to %s\n", - subrec->subnet_name, command, nmb_namestr(&dgram->source_name), - inet_ntoa(p->ip), nmb_namestr(&dgram->dest_name))); - } - } + break; + case ANN_ResetBrowserState: + debug_browse_data(buf, len); + process_reset_browser(subrec, p, buf+1); + break; + case ANN_MasterAnnouncement: + /* Master browser datagrams must be processed on the unicast subnet. */ + subrec = unicast_subnet; + + debug_browse_data(buf, len); + process_master_browser_announce(subrec, p, buf+1); + break; + case ANN_BecomeBackup: + /* + * We don't currently implement this. Log it just in case. + */ + debug_browse_data(buf, len); + DEBUG(10,("process_browse_packet: On subnet %s ignoring browse packet \ +command ANN_BecomeBackup from %s IP %s to %s\n", subrec->subnet_name, nmb_namestr(&dgram->source_name), + inet_ntoa(p->ip), nmb_namestr(&dgram->dest_name))); + break; + default: + debug_browse_data(buf, len); + DEBUG(0,("process_browse_packet: On subnet %s ignoring browse packet \ +command code %d from %s IP %s to %s\n", subrec->subnet_name, command, nmb_namestr(&dgram->source_name), + inet_ntoa(p->ip), nmb_namestr(&dgram->dest_name))); + break; + } } /**************************************************************************** Dispatch a LanMan browse frame from port 138 to the correct processing function. ****************************************************************************/ + static void process_lanman_packet(struct packet_struct *p, char *buf,int len) { - struct dgram_packet *dgram = &p->packet.dgram; - int command = SVAL(buf,0); - struct subnet_record *subrec = find_subnet_for_dgram_browse_packet(p); - - /* Drop the packet if it's a different NetBIOS scope, or - the source is from one of our names. */ - - if (!strequal(dgram->dest_name.scope, global_scope())) - { - DEBUG(7,("process_lanman_packet: Discarding datagram from IP %s. Scope (%s) \ -mismatch with our scope (%s).\n", inet_ntoa(p->ip), dgram->dest_name.scope, global_scope())); - return; - } - - if (is_myname(dgram->source_name.name)) - { - DEBUG(0,("process_lanman_packet: Discarding datagram from IP %s. Source name \ + struct dgram_packet *dgram = &p->packet.dgram; + int command = SVAL(buf,0); + struct subnet_record *subrec = find_subnet_for_dgram_browse_packet(p); + char scope[64]; + nstring src_name; + + /* Drop the packet if it's a different NetBIOS scope, or the source is from one of our names. */ + + pull_ascii(scope, dgram->dest_name.scope, 64, 64, STR_TERMINATE); + if (!strequal(scope, global_scope())) { + DEBUG(7,("process_lanman_packet: Discarding datagram from IP %s. Scope (%s) \ +mismatch with our scope (%s).\n", inet_ntoa(p->ip), scope, global_scope())); + return; + } + + pull_ascii_nstring(src_name, dgram->source_name.name); + if (is_myname(src_name)) { + DEBUG(0,("process_lanman_packet: Discarding datagram from IP %s. Source name \ %s is one of our names !\n", inet_ntoa(p->ip), nmb_namestr(&dgram->source_name))); - return; - } - - switch (command) - { - case ANN_HostAnnouncement: - { - debug_browse_data(buf, len); - process_lm_host_announce(subrec, p, buf+1); - break; - } - case ANN_AnnouncementRequest: - { - process_lm_announce_request(subrec, p, buf+1); - break; - } - default: - { - DEBUG(0,("process_lanman_packet: On subnet %s ignoring browse packet \ -command code %d from %s IP %s to %s\n", - subrec->subnet_name, command, nmb_namestr(&dgram->source_name), - inet_ntoa(p->ip), nmb_namestr(&dgram->dest_name))); - } - } + return; + } + + switch (command) { + case ANN_HostAnnouncement: + debug_browse_data(buf, len); + process_lm_host_announce(subrec, p, buf+1); + break; + case ANN_AnnouncementRequest: + process_lm_announce_request(subrec, p, buf+1); + break; + default: + DEBUG(0,("process_lanman_packet: On subnet %s ignoring browse packet \ +command code %d from %s IP %s to %s\n", subrec->subnet_name, command, nmb_namestr(&dgram->source_name), + inet_ntoa(p->ip), nmb_namestr(&dgram->dest_name))); + break; + } } /**************************************************************************** @@ -1241,104 +1163,94 @@ command code %d from %s IP %s to %s\n", static BOOL listening(struct packet_struct *p,struct nmb_name *nbname) { - struct subnet_record *subrec = NULL; + struct subnet_record *subrec = NULL; - for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - if(same_net(p->ip, subrec->bcast_ip, subrec->mask_ip)) - break; - } + for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + if(same_net(p->ip, subrec->bcast_ip, subrec->mask_ip)) + break; + } - if(subrec == NULL) - subrec = unicast_subnet; + if(subrec == NULL) + subrec = unicast_subnet; - return (find_name_on_subnet(subrec, nbname, FIND_SELF_NAME) != NULL); + return (find_name_on_subnet(subrec, nbname, FIND_SELF_NAME) != NULL); } /**************************************************************************** Process udp 138 datagrams ****************************************************************************/ + static void process_dgram(struct packet_struct *p) { - char *buf; - char *buf2; - int len; - struct dgram_packet *dgram = &p->packet.dgram; - - /* If we aren't listening to the destination name then ignore the packet */ - if (!listening(p,&dgram->dest_name)) - { - unexpected_packet(p); - DEBUG(5,("process_dgram: ignoring dgram packet sent to name %s from %s\n", - nmb_namestr(&dgram->dest_name), inet_ntoa(p->ip))); - return; - } - - if (dgram->header.msg_type != 0x10 && - dgram->header.msg_type != 0x11 && - dgram->header.msg_type != 0x12) - { - unexpected_packet(p); - /* Don't process error packets etc yet */ - DEBUG(5,("process_dgram: ignoring dgram packet sent to name %s from IP %s as it is \ -an error packet of type %x\n", - nmb_namestr(&dgram->dest_name), inet_ntoa(p->ip), dgram->header.msg_type)); - return; - } - - buf = &dgram->data[0]; - buf -= 4; /* XXXX for the pseudo tcp length - - someday I need to get rid of this */ - - if (CVAL(buf,smb_com) != SMBtrans) - return; - - len = SVAL(buf,smb_vwv11); - buf2 = smb_base(buf) + SVAL(buf,smb_vwv12); - - if (len <= 0) - return; - - if (buf2 + len > buf + sizeof(dgram->data)) { - DEBUG(2,("process_dgram: datagram from %s to %s IP %s for %s len=%d too long.\n", + char *buf; + char *buf2; + int len; + struct dgram_packet *dgram = &p->packet.dgram; + + /* If we aren't listening to the destination name then ignore the packet */ + if (!listening(p,&dgram->dest_name)) { + unexpected_packet(p); + DEBUG(5,("process_dgram: ignoring dgram packet sent to name %s from %s\n", + nmb_namestr(&dgram->dest_name), inet_ntoa(p->ip))); + return; + } + + if (dgram->header.msg_type != 0x10 && dgram->header.msg_type != 0x11 && dgram->header.msg_type != 0x12) { + unexpected_packet(p); + /* Don't process error packets etc yet */ + DEBUG(5,("process_dgram: ignoring dgram packet sent to name %s from IP %s as it is \ +an error packet of type %x\n", nmb_namestr(&dgram->dest_name), inet_ntoa(p->ip), dgram->header.msg_type)); + return; + } + + buf = &dgram->data[0]; + buf -= 4; /* XXXX for the pseudo tcp length - someday I need to get rid of this */ + + if (CVAL(buf,smb_com) != SMBtrans) + return; + + len = SVAL(buf,smb_vwv11); + buf2 = smb_base(buf) + SVAL(buf,smb_vwv12); + + if (len <= 0) + return; + + if (buf2 + len > buf + sizeof(dgram->data)) { + DEBUG(2,("process_dgram: datagram from %s to %s IP %s for %s len=%d too long.\n", + nmb_namestr(&dgram->source_name),nmb_namestr(&dgram->dest_name), + inet_ntoa(p->ip), smb_buf(buf),len)); + len = (buf + sizeof(dgram->data)) - buf; + } + + DEBUG(4,("process_dgram: datagram from %s to %s IP %s for %s of type %d len=%d\n", nmb_namestr(&dgram->source_name),nmb_namestr(&dgram->dest_name), - inet_ntoa(p->ip), smb_buf(buf),len)); - len = (buf + sizeof(dgram->data)) - buf; - } + inet_ntoa(p->ip), smb_buf(buf),CVAL(buf2,0),len)); - DEBUG(4,("process_dgram: datagram from %s to %s IP %s for %s of type %d len=%d\n", - nmb_namestr(&dgram->source_name),nmb_namestr(&dgram->dest_name), - inet_ntoa(p->ip), smb_buf(buf),CVAL(buf2,0),len)); + /* Datagram packet received for the browser mailslot */ + if (strequal(smb_buf(buf),BROWSE_MAILSLOT)) { + process_browse_packet(p,buf2,len); + return; + } - - /* Datagram packet received for the browser mailslot */ - if (strequal(smb_buf(buf),BROWSE_MAILSLOT)) - { - process_browse_packet(p,buf2,len); - return; - } - - /* Datagram packet received for the LAN Manager mailslot */ - if (strequal(smb_buf(buf),LANMAN_MAILSLOT)) { - process_lanman_packet(p,buf2,len); - return; - } - - /* Datagram packet received for the domain logon mailslot */ - if (strequal(smb_buf(buf),NET_LOGON_MAILSLOT)) - { - process_logon_packet(p,buf2,len,NET_LOGON_MAILSLOT); - return; - } - - /* Datagram packet received for the NT domain logon mailslot */ - if (strequal(smb_buf(buf),NT_LOGON_MAILSLOT)) - { - process_logon_packet(p,buf2,len,NT_LOGON_MAILSLOT); - return; - } - - unexpected_packet(p); + /* Datagram packet received for the LAN Manager mailslot */ + if (strequal(smb_buf(buf),LANMAN_MAILSLOT)) { + process_lanman_packet(p,buf2,len); + return; + } + + /* Datagram packet received for the domain logon mailslot */ + if (strequal(smb_buf(buf),NET_LOGON_MAILSLOT)) { + process_logon_packet(p,buf2,len,NET_LOGON_MAILSLOT); + return; + } + + /* Datagram packet received for the NT domain logon mailslot */ + if (strequal(smb_buf(buf),NT_LOGON_MAILSLOT)) { + process_logon_packet(p,buf2,len,NT_LOGON_MAILSLOT); + return; + } + + unexpected_packet(p); } /**************************************************************************** @@ -1347,52 +1259,49 @@ an error packet of type %x\n", static BOOL validate_nmb_response_packet( struct nmb_packet *nmb ) { - BOOL ignore = False; - - switch (nmb->header.opcode) - { - case NMB_NAME_REG_OPCODE: - case NMB_NAME_REFRESH_OPCODE_8: /* ambiguity in rfc1002 about which is correct. */ - case NMB_NAME_REFRESH_OPCODE_9: /* WinNT uses 8 by default. */ - if (nmb->header.ancount == 0) - { - DEBUG(0,("validate_nmb_response_packet: Bad REG/REFRESH Packet. ")); - ignore = True; - } - break; - - case NMB_NAME_QUERY_OPCODE: - if ((nmb->header.ancount != 0) && (nmb->header.ancount != 1)) - { - DEBUG(0,("validate_nmb_response_packet: Bad QUERY Packet. ")); - ignore = True; - } - break; - case NMB_NAME_RELEASE_OPCODE: - if (nmb->header.ancount == 0) - { - DEBUG(0,("validate_nmb_response_packet: Bad RELEASE Packet. ")); - ignore = True; - } - break; - case NMB_WACK_OPCODE: - /* Check WACK response here. */ - if (nmb->header.ancount != 1) - { - DEBUG(0,("validate_nmb_response_packet: Bad WACK Packet. ")); - ignore = True; - } - break; - default: - DEBUG(0,("validate_nmb_response_packet: Ignoring packet with unknown opcode %d.\n", - nmb->header.opcode)); - return True; - } - - if(ignore) - DEBUG(0,("Ignoring response packet with opcode %d.\n", nmb->header.opcode)); - - return ignore; + BOOL ignore = False; + + switch (nmb->header.opcode) { + case NMB_NAME_REG_OPCODE: + case NMB_NAME_REFRESH_OPCODE_8: /* ambiguity in rfc1002 about which is correct. */ + case NMB_NAME_REFRESH_OPCODE_9: /* WinNT uses 8 by default. */ + if (nmb->header.ancount == 0) { + DEBUG(0,("validate_nmb_response_packet: Bad REG/REFRESH Packet. ")); + ignore = True; + } + break; + + case NMB_NAME_QUERY_OPCODE: + if ((nmb->header.ancount != 0) && (nmb->header.ancount != 1)) { + DEBUG(0,("validate_nmb_response_packet: Bad QUERY Packet. ")); + ignore = True; + } + break; + + case NMB_NAME_RELEASE_OPCODE: + if (nmb->header.ancount == 0) { + DEBUG(0,("validate_nmb_response_packet: Bad RELEASE Packet. ")); + ignore = True; + } + break; + + case NMB_WACK_OPCODE: + /* Check WACK response here. */ + if (nmb->header.ancount != 1) { + DEBUG(0,("validate_nmb_response_packet: Bad WACK Packet. ")); + ignore = True; + } + break; + default: + DEBUG(0,("validate_nmb_response_packet: Ignoring packet with unknown opcode %d.\n", + nmb->header.opcode)); + return True; + } + + if(ignore) + DEBUG(0,("Ignoring response packet with opcode %d.\n", nmb->header.opcode)); + + return ignore; } /**************************************************************************** @@ -1401,48 +1310,43 @@ static BOOL validate_nmb_response_packet( struct nmb_packet *nmb ) static BOOL validate_nmb_packet( struct nmb_packet *nmb ) { - BOOL ignore = False; - - switch (nmb->header.opcode) - { - case NMB_NAME_REG_OPCODE: - case NMB_NAME_REFRESH_OPCODE_8: /* ambiguity in rfc1002 about which is correct. */ - case NMB_NAME_REFRESH_OPCODE_9: /* WinNT uses 8 by default. */ - case NMB_NAME_MULTIHOMED_REG_OPCODE: - if (nmb->header.qdcount==0 || nmb->header.arcount==0) - { - DEBUG(0,("validate_nmb_packet: Bad REG/REFRESH Packet. ")); - ignore = True; - } - break; - - case NMB_NAME_QUERY_OPCODE: - if ((nmb->header.qdcount == 0) || - ((nmb->question.question_type != QUESTION_TYPE_NB_QUERY) && - (nmb->question.question_type != QUESTION_TYPE_NB_STATUS))) - { - DEBUG(0,("validate_nmb_packet: Bad QUERY Packet. ")); - ignore = True; - } - break; - - case NMB_NAME_RELEASE_OPCODE: - if (nmb->header.qdcount==0 || nmb->header.arcount==0) - { - DEBUG(0,("validate_nmb_packet: Bad RELEASE Packet. ")); - ignore = True; - } - break; - default: - DEBUG(0,("validate_nmb_packet: Ignoring packet with unknown opcode %d.\n", - nmb->header.opcode)); - return True; - } - - if(ignore) - DEBUG(0,("validate_nmb_packet: Ignoring request packet with opcode %d.\n", nmb->header.opcode)); - - return ignore; + BOOL ignore = False; + + switch (nmb->header.opcode) { + case NMB_NAME_REG_OPCODE: + case NMB_NAME_REFRESH_OPCODE_8: /* ambiguity in rfc1002 about which is correct. */ + case NMB_NAME_REFRESH_OPCODE_9: /* WinNT uses 8 by default. */ + case NMB_NAME_MULTIHOMED_REG_OPCODE: + if (nmb->header.qdcount==0 || nmb->header.arcount==0) { + DEBUG(0,("validate_nmb_packet: Bad REG/REFRESH Packet. ")); + ignore = True; + } + break; + + case NMB_NAME_QUERY_OPCODE: + if ((nmb->header.qdcount == 0) || ((nmb->question.question_type != QUESTION_TYPE_NB_QUERY) && + (nmb->question.question_type != QUESTION_TYPE_NB_STATUS))) { + DEBUG(0,("validate_nmb_packet: Bad QUERY Packet. ")); + ignore = True; + } + break; + + case NMB_NAME_RELEASE_OPCODE: + if (nmb->header.qdcount==0 || nmb->header.arcount==0) { + DEBUG(0,("validate_nmb_packet: Bad RELEASE Packet. ")); + ignore = True; + } + break; + default: + DEBUG(0,("validate_nmb_packet: Ignoring packet with unknown opcode %d.\n", + nmb->header.opcode)); + return True; + } + + if(ignore) + DEBUG(0,("validate_nmb_packet: Ignoring request packet with opcode %d.\n", nmb->header.opcode)); + + return ignore; } /**************************************************************************** @@ -1452,58 +1356,53 @@ static BOOL validate_nmb_packet( struct nmb_packet *nmb ) static struct subnet_record *find_subnet_for_nmb_packet( struct packet_struct *p, struct response_record **pprrec) { - struct nmb_packet *nmb = &p->packet.nmb; - struct response_record *rrec = NULL; - struct subnet_record *subrec = NULL; - - if(pprrec != NULL) - *pprrec = NULL; - - if(nmb->header.response) - { - /* It's a response packet. Find a record for it or it's an error. */ - - rrec = find_response_record( &subrec, nmb->header.name_trn_id); - if(rrec == NULL) - { - DEBUG(3,("find_subnet_for_nmb_packet: response record not found for response id %hu\n", - nmb->header.name_trn_id)); - unexpected_packet(p); - return NULL; - } - - if(subrec == NULL) - { - DEBUG(0,("find_subnet_for_nmb_packet: subnet record not found for response id %hu\n", - nmb->header.name_trn_id)); - return NULL; - } - - if(pprrec != NULL) - *pprrec = rrec; - return subrec; - } - - /* Try and see what subnet this packet belongs to. */ - - /* WINS server ? */ - if(packet_is_for_wins_server(p)) - return wins_server_subnet; - - /* If it wasn't a broadcast packet then send to the UNICAST subnet. */ - if(nmb->header.nm_flags.bcast == False) - return unicast_subnet; - - /* Go through all the broadcast subnets and see if the mask matches. */ - for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - if(same_net(p->ip, subrec->bcast_ip, subrec->mask_ip)) - return subrec; - } - - /* If none match it must have been a directed broadcast - assign - the remote_broadcast_subnet. */ - return remote_broadcast_subnet; + struct nmb_packet *nmb = &p->packet.nmb; + struct response_record *rrec = NULL; + struct subnet_record *subrec = NULL; + + if(pprrec != NULL) + *pprrec = NULL; + + if(nmb->header.response) { + /* It's a response packet. Find a record for it or it's an error. */ + + rrec = find_response_record( &subrec, nmb->header.name_trn_id); + if(rrec == NULL) { + DEBUG(3,("find_subnet_for_nmb_packet: response record not found for response id %hu\n", + nmb->header.name_trn_id)); + unexpected_packet(p); + return NULL; + } + + if(subrec == NULL) { + DEBUG(0,("find_subnet_for_nmb_packet: subnet record not found for response id %hu\n", + nmb->header.name_trn_id)); + return NULL; + } + + if(pprrec != NULL) + *pprrec = rrec; + return subrec; + } + + /* Try and see what subnet this packet belongs to. */ + + /* WINS server ? */ + if(packet_is_for_wins_server(p)) + return wins_server_subnet; + + /* If it wasn't a broadcast packet then send to the UNICAST subnet. */ + if(nmb->header.nm_flags.bcast == False) + return unicast_subnet; + + /* Go through all the broadcast subnets and see if the mask matches. */ + for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + if(same_net(p->ip, subrec->bcast_ip, subrec->mask_ip)) + return subrec; + } + + /* If none match it must have been a directed broadcast - assign the remote_broadcast_subnet. */ + return remote_broadcast_subnet; } /**************************************************************************** @@ -1512,79 +1411,71 @@ static struct subnet_record *find_subnet_for_nmb_packet( struct packet_struct *p static void process_nmb_request(struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - struct subnet_record *subrec = NULL; - - debug_nmb_packet(p); - - /* Ensure we have a good packet. */ - if(validate_nmb_packet(nmb)) - return; - - /* Allocate a subnet to this packet - if we cannot - fail. */ - if((subrec = find_subnet_for_nmb_packet(p, NULL))==NULL) - return; - - switch (nmb->header.opcode) - { - case NMB_NAME_REG_OPCODE: - if(subrec == wins_server_subnet) - wins_process_name_registration_request(subrec, p); - else - process_name_registration_request(subrec, p); - break; - - case NMB_NAME_REFRESH_OPCODE_8: /* ambiguity in rfc1002 about which is correct. */ - case NMB_NAME_REFRESH_OPCODE_9: - if(subrec == wins_server_subnet) - wins_process_name_refresh_request(subrec, p); - else - process_name_refresh_request(subrec, p); - break; - - case NMB_NAME_MULTIHOMED_REG_OPCODE: - if(subrec == wins_server_subnet) - wins_process_multihomed_name_registration_request(subrec, p); - else - { - DEBUG(0,("process_nmb_request: Multihomed registration request must be \ + struct nmb_packet *nmb = &p->packet.nmb; + struct subnet_record *subrec = NULL; + + debug_nmb_packet(p); + + /* Ensure we have a good packet. */ + if(validate_nmb_packet(nmb)) + return; + + /* Allocate a subnet to this packet - if we cannot - fail. */ + if((subrec = find_subnet_for_nmb_packet(p, NULL))==NULL) + return; + + switch (nmb->header.opcode) { + case NMB_NAME_REG_OPCODE: + if(subrec == wins_server_subnet) + wins_process_name_registration_request(subrec, p); + else + process_name_registration_request(subrec, p); + break; + + case NMB_NAME_REFRESH_OPCODE_8: /* ambiguity in rfc1002 about which is correct. */ + case NMB_NAME_REFRESH_OPCODE_9: + if(subrec == wins_server_subnet) + wins_process_name_refresh_request(subrec, p); + else + process_name_refresh_request(subrec, p); + break; + + case NMB_NAME_MULTIHOMED_REG_OPCODE: + if(subrec == wins_server_subnet) { + wins_process_multihomed_name_registration_request(subrec, p); + } else { + DEBUG(0,("process_nmb_request: Multihomed registration request must be \ directed at a WINS server.\n")); - } - break; - - case NMB_NAME_QUERY_OPCODE: - switch (nmb->question.question_type) - { - case QUESTION_TYPE_NB_QUERY: - { - if(subrec == wins_server_subnet) - wins_process_name_query_request(subrec, p); - else - process_name_query_request(subrec, p); - break; - } - case QUESTION_TYPE_NB_STATUS: - { - if(subrec == wins_server_subnet) - { - DEBUG(0,("process_nmb_request: NB_STATUS request directed at WINS server is \ + } + break; + + case NMB_NAME_QUERY_OPCODE: + switch (nmb->question.question_type) { + case QUESTION_TYPE_NB_QUERY: + if(subrec == wins_server_subnet) + wins_process_name_query_request(subrec, p); + else + process_name_query_request(subrec, p); + break; + case QUESTION_TYPE_NB_STATUS: + if(subrec == wins_server_subnet) { + DEBUG(0,("process_nmb_request: NB_STATUS request directed at WINS server is \ not allowed.\n")); - break; - } - else - process_node_status_request(subrec, p); - break; - } - } - break; + break; + } else { + process_node_status_request(subrec, p); + } + break; + } + break; - case NMB_NAME_RELEASE_OPCODE: - if(subrec == wins_server_subnet) - wins_process_name_release_request(subrec, p); - else - process_name_release_request(subrec, p); - break; - } + case NMB_NAME_RELEASE_OPCODE: + if(subrec == wins_server_subnet) + wins_process_name_release_request(subrec, p); + else + process_name_release_request(subrec, p); + break; + } } /**************************************************************************** @@ -1594,65 +1485,61 @@ not allowed.\n")); static void process_nmb_response(struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - struct subnet_record *subrec = NULL; - struct response_record *rrec = NULL; + struct nmb_packet *nmb = &p->packet.nmb; + struct subnet_record *subrec = NULL; + struct response_record *rrec = NULL; - debug_nmb_packet(p); + debug_nmb_packet(p); - if(validate_nmb_response_packet(nmb)) - return; + if(validate_nmb_response_packet(nmb)) + return; - if((subrec = find_subnet_for_nmb_packet(p, &rrec))==NULL) - return; + if((subrec = find_subnet_for_nmb_packet(p, &rrec))==NULL) + return; - if(rrec == NULL) - { - DEBUG(0,("process_nmb_response: response packet received but no response record \ + if(rrec == NULL) { + DEBUG(0,("process_nmb_response: response packet received but no response record \ found for id = %hu. Ignoring packet.\n", nmb->header.name_trn_id)); - return; - } + return; + } - /* Increment the number of responses received for this record. */ - rrec->num_msgs++; - /* Ensure we don't re-send the request. */ - rrec->repeat_count = 0; + /* Increment the number of responses received for this record. */ + rrec->num_msgs++; + /* Ensure we don't re-send the request. */ + rrec->repeat_count = 0; - /* Call the response received function for this packet. */ - (*rrec->resp_fn)(subrec, rrec, p); + /* Call the response received function for this packet. */ + (*rrec->resp_fn)(subrec, rrec, p); } - /******************************************************************* Run elements off the packet queue till its empty ******************************************************************/ void run_packet_queue(void) { - struct packet_struct *p; - - while ((p = packet_queue)) - { - packet_queue = p->next; - if (packet_queue) - packet_queue->prev = NULL; - p->next = p->prev = NULL; - - switch (p->packet_type) - { - case NMB_PACKET: - if(p->packet.nmb.header.response) - process_nmb_response(p); - else - process_nmb_request(p); - break; - - case DGRAM_PACKET: - process_dgram(p); - break; - } - free_packet(p); - } + struct packet_struct *p; + + while ((p = packet_queue)) { + packet_queue = p->next; + if (packet_queue) + packet_queue->prev = NULL; + p->next = p->prev = NULL; + + switch (p->packet_type) { + case NMB_PACKET: + if(p->packet.nmb.header.response) + process_nmb_response(p); + else + process_nmb_request(p); + break; + + case DGRAM_PACKET: + process_dgram(p); + break; + } + free_packet(p); + } } /******************************************************************* @@ -1665,66 +1552,54 @@ void run_packet_queue(void) void retransmit_or_expire_response_records(time_t t) { - struct subnet_record *subrec; + struct subnet_record *subrec; - for (subrec = FIRST_SUBNET; subrec; - subrec = get_next_subnet_maybe_unicast_or_wins_server(subrec)) - { - struct response_record *rrec, *nextrrec; + for (subrec = FIRST_SUBNET; subrec; subrec = get_next_subnet_maybe_unicast_or_wins_server(subrec)) { + struct response_record *rrec, *nextrrec; - for (rrec = subrec->responselist; rrec; rrec = nextrrec) - { - nextrrec = rrec->next; + for (rrec = subrec->responselist; rrec; rrec = nextrrec) { + nextrrec = rrec->next; - if (rrec->repeat_time <= t) - { - if (rrec->repeat_count > 0) - { - /* Resend while we have a non-zero repeat_count. */ - if(!send_packet(rrec->packet)) - { - DEBUG(0,("retransmit_or_expire_response_records: Failed to resend packet id %hu \ -to IP %s on subnet %s\n", rrec->response_id, inet_ntoa(rrec->packet->ip), - subrec->subnet_name)); - } - rrec->repeat_time = t + rrec->repeat_interval; - rrec->repeat_count--; - } - else - { - DEBUG(4,("retransmit_or_expire_response_records: timeout for packet id %hu to IP %s \ -on subnet %s\n", rrec->response_id, inet_ntoa(rrec->packet->ip), - subrec->subnet_name)); - - /* - * Check the flag in this record to prevent recursion if we end - * up in this function again via the timeout function call. - */ - - if(!rrec->in_expiration_processing) - { - - /* - * Set the recursion protection flag in this record. - */ - - rrec->in_expiration_processing = True; - - /* Call the timeout function. This will deal with removing the - timed out packet. */ - if(rrec->timeout_fn) - (*rrec->timeout_fn)(subrec, rrec); - else - { - /* We must remove the record ourself if there is - no timeout function. */ - remove_response_record(subrec, rrec); - } - } /* !rrec->in_expitation_processing */ - } /* rrec->repeat_count > 0 */ - } /* rrec->repeat_time <= t */ - } /* end for rrec */ - } /* end for subnet */ + if (rrec->repeat_time <= t) { + if (rrec->repeat_count > 0) { + /* Resend while we have a non-zero repeat_count. */ + if(!send_packet(rrec->packet)) { + DEBUG(0,("retransmit_or_expire_response_records: Failed to resend packet id %hu \ +to IP %s on subnet %s\n", rrec->response_id, inet_ntoa(rrec->packet->ip), subrec->subnet_name)); + } + rrec->repeat_time = t + rrec->repeat_interval; + rrec->repeat_count--; + } else { + DEBUG(4,("retransmit_or_expire_response_records: timeout for packet id %hu to IP %s \ +on subnet %s\n", rrec->response_id, inet_ntoa(rrec->packet->ip), subrec->subnet_name)); + + /* + * Check the flag in this record to prevent recursion if we end + * up in this function again via the timeout function call. + */ + + if(!rrec->in_expiration_processing) { + + /* + * Set the recursion protection flag in this record. + */ + + rrec->in_expiration_processing = True; + + /* Call the timeout function. This will deal with removing the + timed out packet. */ + if(rrec->timeout_fn) { + (*rrec->timeout_fn)(subrec, rrec); + } else { + /* We must remove the record ourself if there is + no timeout function. */ + remove_response_record(subrec, rrec); + } + } /* !rrec->in_expitation_processing */ + } /* rrec->repeat_count > 0 */ + } /* rrec->repeat_time <= t */ + } /* end for rrec */ + } /* end for subnet */ } /**************************************************************************** @@ -1734,68 +1609,63 @@ on subnet %s\n", rrec->response_id, inet_ntoa(rrec->packet->ip), static BOOL create_listen_fdset(fd_set **ppset, int **psock_array, int *listen_number) { - int *sock_array = NULL; - struct subnet_record *subrec = NULL; - int count = 0; - int num = 0; - fd_set *pset = (fd_set *)malloc(sizeof(fd_set)); - - if(pset == NULL) - { - DEBUG(0,("create_listen_fdset: malloc fail !\n")); - return True; - } - - /* Check that we can add all the fd's we need. */ - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - count++; - - if((count*2) + 2 > FD_SETSIZE) - { - DEBUG(0,("create_listen_fdset: Too many file descriptors needed (%d). We can \ + int *sock_array = NULL; + struct subnet_record *subrec = NULL; + int count = 0; + int num = 0; + fd_set *pset = (fd_set *)malloc(sizeof(fd_set)); + + if(pset == NULL) { + DEBUG(0,("create_listen_fdset: malloc fail !\n")); + return True; + } + + /* Check that we can add all the fd's we need. */ + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) + count++; + + if((count*2) + 2 > FD_SETSIZE) { + DEBUG(0,("create_listen_fdset: Too many file descriptors needed (%d). We can \ only use %d.\n", (count*2) + 2, FD_SETSIZE)); - return True; - } - - if((sock_array = (int *)malloc(((count*2) + 2)*sizeof(int))) == NULL) - { - DEBUG(0,("create_listen_fdset: malloc fail for socket array.\n")); - return True; - } - - FD_ZERO(pset); - - /* Add in the broadcast socket on 137. */ - FD_SET(ClientNMB,pset); - sock_array[num++] = ClientNMB; - - /* Add in the 137 sockets on all the interfaces. */ - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - FD_SET(subrec->nmb_sock,pset); - sock_array[num++] = subrec->nmb_sock; - } - - /* Add in the broadcast socket on 138. */ - FD_SET(ClientDGRAM,pset); - sock_array[num++] = ClientDGRAM; - - /* Add in the 138 sockets on all the interfaces. */ - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - FD_SET(subrec->dgram_sock,pset); - sock_array[num++] = subrec->dgram_sock; - } - - *listen_number = (count*2) + 2; - - SAFE_FREE(*ppset); - SAFE_FREE(*psock_array); - - *ppset = pset; - *psock_array = sock_array; + return True; + } + + if((sock_array = (int *)malloc(((count*2) + 2)*sizeof(int))) == NULL) { + DEBUG(0,("create_listen_fdset: malloc fail for socket array.\n")); + return True; + } + + FD_ZERO(pset); + + /* Add in the broadcast socket on 137. */ + FD_SET(ClientNMB,pset); + sock_array[num++] = ClientNMB; + + /* Add in the 137 sockets on all the interfaces. */ + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + FD_SET(subrec->nmb_sock,pset); + sock_array[num++] = subrec->nmb_sock; + } + + /* Add in the broadcast socket on 138. */ + FD_SET(ClientDGRAM,pset); + sock_array[num++] = ClientDGRAM; + + /* Add in the 138 sockets on all the interfaces. */ + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + FD_SET(subrec->dgram_sock,pset); + sock_array[num++] = subrec->dgram_sock; + } + + *listen_number = (count*2) + 2; + + SAFE_FREE(*ppset); + SAFE_FREE(*psock_array); + + *ppset = pset; + *psock_array = sock_array; - return False; + return False; } /**************************************************************************** @@ -1805,214 +1675,211 @@ only use %d.\n", (count*2) + 2, FD_SETSIZE)); BOOL listen_for_packets(BOOL run_election) { - static fd_set *listen_set = NULL; - static int listen_number = 0; - static int *sock_array = NULL; - int i; - - fd_set fds; - int selrtn; - struct timeval timeout; + static fd_set *listen_set = NULL; + static int listen_number = 0; + static int *sock_array = NULL; + int i; + + fd_set fds; + int selrtn; + struct timeval timeout; #ifndef SYNC_DNS - int dns_fd; + int dns_fd; #endif - if(listen_set == NULL || rescan_listen_set) - { - if(create_listen_fdset(&listen_set, &sock_array, &listen_number)) - { - DEBUG(0,("listen_for_packets: Fatal error. unable to create listen set. Exiting.\n")); - return True; - } - rescan_listen_set = False; - } + if(listen_set == NULL || rescan_listen_set) { + if(create_listen_fdset(&listen_set, &sock_array, &listen_number)) { + DEBUG(0,("listen_for_packets: Fatal error. unable to create listen set. Exiting.\n")); + return True; + } + rescan_listen_set = False; + } - memcpy((char *)&fds, (char *)listen_set, sizeof(fd_set)); + memcpy((char *)&fds, (char *)listen_set, sizeof(fd_set)); #ifndef SYNC_DNS - dns_fd = asyncdns_fd(); - if (dns_fd != -1) { - FD_SET(dns_fd, &fds); - } + dns_fd = asyncdns_fd(); + if (dns_fd != -1) { + FD_SET(dns_fd, &fds); + } #endif + /* + * During elections and when expecting a netbios response packet we + * need to send election packets at tighter intervals. + * Ideally it needs to be the interval (in ms) between time now and + * the time we are expecting the next netbios packet. + */ - /* - * During elections and when expecting a netbios response packet we - * need to send election packets at tighter intervals. - * Ideally it needs to be the interval (in ms) between time now and - * the time we are expecting the next netbios packet. - */ - - timeout.tv_sec = (run_election||num_response_packets) ? 1 : NMBD_SELECT_LOOP; - timeout.tv_usec = 0; + timeout.tv_sec = (run_election||num_response_packets) ? 1 : NMBD_SELECT_LOOP; + timeout.tv_usec = 0; - /* Prepare for the select - allow certain signals. */ + /* Prepare for the select - allow certain signals. */ - BlockSignals(False, SIGTERM); + BlockSignals(False, SIGTERM); - selrtn = sys_select(FD_SETSIZE,&fds,NULL,NULL,&timeout); + selrtn = sys_select(FD_SETSIZE,&fds,NULL,NULL,&timeout); - /* We can only take signals when we are in the select - block them again here. */ + /* We can only take signals when we are in the select - block them again here. */ - BlockSignals(True, SIGTERM); + BlockSignals(True, SIGTERM); - if(selrtn == -1) { - return False; - } + if(selrtn == -1) { + return False; + } #ifndef SYNC_DNS - if (dns_fd != -1 && FD_ISSET(dns_fd,&fds)) { - run_dns_queue(); - } + if (dns_fd != -1 && FD_ISSET(dns_fd,&fds)) { + run_dns_queue(); + } #endif - for(i = 0; i < listen_number; i++) { - if (i < (listen_number/2)) { - /* Processing a 137 socket. */ - if (FD_ISSET(sock_array[i],&fds)) { - struct packet_struct *packet = read_packet(sock_array[i], NMB_PACKET); - if (packet) { - /* - * If we got a packet on the broadcast socket and interfaces - * only is set then check it came from one of our local nets. - */ - if(lp_bind_interfaces_only() && (sock_array[i] == ClientNMB) && - (!is_local_net(packet->ip))) { - DEBUG(7,("discarding nmb packet sent to broadcast socket from %s:%d\n", - inet_ntoa(packet->ip),packet->port)); - free_packet(packet); - } else if ((ip_equal(loopback_ip, packet->ip) || - ismyip(packet->ip)) && packet->port == global_nmb_port && - packet->packet.nmb.header.nm_flags.bcast) { - DEBUG(7,("discarding own bcast packet from %s:%d\n", - inet_ntoa(packet->ip),packet->port)); - free_packet(packet); - } else { - /* Save the file descriptor this packet came in on. */ - packet->fd = sock_array[i]; - queue_packet(packet); - } - } - } - } else { - /* Processing a 138 socket. */ - if (FD_ISSET(sock_array[i],&fds)) { - struct packet_struct *packet = read_packet(sock_array[i], DGRAM_PACKET); - if (packet) { - /* - * If we got a packet on the broadcast socket and interfaces - * only is set then check it came from one of our local nets. - */ - if(lp_bind_interfaces_only() && (sock_array[i] == ClientDGRAM) && - (!is_local_net(packet->ip))) { - DEBUG(7,("discarding dgram packet sent to broadcast socket from %s:%d\n", - inet_ntoa(packet->ip),packet->port)); - free_packet(packet); - } else if ((ip_equal(loopback_ip, packet->ip) || - ismyip(packet->ip)) && packet->port == DGRAM_PORT) { - DEBUG(7,("discarding own dgram packet from %s:%d\n", - inet_ntoa(packet->ip),packet->port)); - free_packet(packet); - } else { - /* Save the file descriptor this packet came in on. */ - packet->fd = sock_array[i]; - queue_packet(packet); - } - } - } - } /* end processing 138 socket. */ - } /* end for */ - return False; + for(i = 0; i < listen_number; i++) { + if (i < (listen_number/2)) { + /* Processing a 137 socket. */ + if (FD_ISSET(sock_array[i],&fds)) { + struct packet_struct *packet = read_packet(sock_array[i], NMB_PACKET); + if (packet) { + /* + * If we got a packet on the broadcast socket and interfaces + * only is set then check it came from one of our local nets. + */ + if(lp_bind_interfaces_only() && (sock_array[i] == ClientNMB) && + (!is_local_net(packet->ip))) { + DEBUG(7,("discarding nmb packet sent to broadcast socket from %s:%d\n", + inet_ntoa(packet->ip),packet->port)); + free_packet(packet); + } else if ((ip_equal(loopback_ip, packet->ip) || + ismyip(packet->ip)) && packet->port == global_nmb_port && + packet->packet.nmb.header.nm_flags.bcast) { + DEBUG(7,("discarding own bcast packet from %s:%d\n", + inet_ntoa(packet->ip),packet->port)); + free_packet(packet); + } else { + /* Save the file descriptor this packet came in on. */ + packet->fd = sock_array[i]; + queue_packet(packet); + } + } + } + } else { + /* Processing a 138 socket. */ + if (FD_ISSET(sock_array[i],&fds)) { + struct packet_struct *packet = read_packet(sock_array[i], DGRAM_PACKET); + if (packet) { + /* + * If we got a packet on the broadcast socket and interfaces + * only is set then check it came from one of our local nets. + */ + if(lp_bind_interfaces_only() && (sock_array[i] == ClientDGRAM) && + (!is_local_net(packet->ip))) { + DEBUG(7,("discarding dgram packet sent to broadcast socket from %s:%d\n", + inet_ntoa(packet->ip),packet->port)); + free_packet(packet); + } else if ((ip_equal(loopback_ip, packet->ip) || + ismyip(packet->ip)) && packet->port == DGRAM_PORT) { + DEBUG(7,("discarding own dgram packet from %s:%d\n", + inet_ntoa(packet->ip),packet->port)); + free_packet(packet); + } else { + /* Save the file descriptor this packet came in on. */ + packet->fd = sock_array[i]; + queue_packet(packet); + } + } + } + } /* end processing 138 socket. */ + } /* end for */ + return False; } /**************************************************************************** Construct and send a netbios DGRAM. **************************************************************************/ + BOOL send_mailslot(BOOL unique, const char *mailslot,char *buf, size_t len, const char *srcname, int src_type, const char *dstname, int dest_type, struct in_addr dest_ip,struct in_addr src_ip, int dest_port) { - BOOL loopback_this_packet = False; - struct packet_struct p; - struct dgram_packet *dgram = &p.packet.dgram; - char *ptr,*p2; - char tmp[4]; - - memset((char *)&p,'\0',sizeof(p)); - - if(ismyip(dest_ip) && (dest_port == DGRAM_PORT)) /* Only if to DGRAM_PORT */ - loopback_this_packet = True; - - /* generate_name_trn_id(); */ /* Not used, so gone, RJS */ - - /* DIRECT GROUP or UNIQUE datagram. */ - dgram->header.msg_type = unique ? 0x10 : 0x11; - dgram->header.flags.node_type = M_NODE; - dgram->header.flags.first = True; - dgram->header.flags.more = False; - dgram->header.dgm_id = generate_name_trn_id(); - dgram->header.source_ip = src_ip; - dgram->header.source_port = DGRAM_PORT; - dgram->header.dgm_length = 0; /* Let build_dgram() handle this. */ - dgram->header.packet_offset = 0; + BOOL loopback_this_packet = False; + struct packet_struct p; + struct dgram_packet *dgram = &p.packet.dgram; + char *ptr,*p2; + char tmp[4]; + + memset((char *)&p,'\0',sizeof(p)); + + if(ismyip(dest_ip) && (dest_port == DGRAM_PORT)) /* Only if to DGRAM_PORT */ + loopback_this_packet = True; + + /* generate_name_trn_id(); */ /* Not used, so gone, RJS */ + + /* DIRECT GROUP or UNIQUE datagram. */ + dgram->header.msg_type = unique ? 0x10 : 0x11; + dgram->header.flags.node_type = M_NODE; + dgram->header.flags.first = True; + dgram->header.flags.more = False; + dgram->header.dgm_id = generate_name_trn_id(); + dgram->header.source_ip = src_ip; + dgram->header.source_port = DGRAM_PORT; + dgram->header.dgm_length = 0; /* Let build_dgram() handle this. */ + dgram->header.packet_offset = 0; - make_nmb_name(&dgram->source_name,srcname,src_type); - make_nmb_name(&dgram->dest_name,dstname,dest_type); - - ptr = &dgram->data[0]; - - /* Setup the smb part. */ - ptr -= 4; /* XXX Ugliness because of handling of tcp SMB length. */ - memcpy(tmp,ptr,4); - set_message(ptr,17,23 + len,True); - memcpy(ptr,tmp,4); - - SCVAL(ptr,smb_com,SMBtrans); - SSVAL(ptr,smb_vwv1,len); - SSVAL(ptr,smb_vwv11,len); - SSVAL(ptr,smb_vwv12,70 + strlen(mailslot)); - SSVAL(ptr,smb_vwv13,3); - SSVAL(ptr,smb_vwv14,1); - SSVAL(ptr,smb_vwv15,1); - SSVAL(ptr,smb_vwv16,2); - p2 = smb_buf(ptr); - safe_strcpy_base(p2, mailslot, dgram->data, sizeof(dgram->data)); - p2 = skip_string(p2,1); + make_nmb_name(&dgram->source_name,srcname,src_type); + make_nmb_name(&dgram->dest_name,dstname,dest_type); + + ptr = &dgram->data[0]; + + /* Setup the smb part. */ + ptr -= 4; /* XXX Ugliness because of handling of tcp SMB length. */ + memcpy(tmp,ptr,4); + set_message(ptr,17,23 + len,True); + memcpy(ptr,tmp,4); + + SCVAL(ptr,smb_com,SMBtrans); + SSVAL(ptr,smb_vwv1,len); + SSVAL(ptr,smb_vwv11,len); + SSVAL(ptr,smb_vwv12,70 + strlen(mailslot)); + SSVAL(ptr,smb_vwv13,3); + SSVAL(ptr,smb_vwv14,1); + SSVAL(ptr,smb_vwv15,1); + SSVAL(ptr,smb_vwv16,2); + p2 = smb_buf(ptr); + safe_strcpy_base(p2, mailslot, dgram->data, sizeof(dgram->data)); + p2 = skip_string(p2,1); - if (((p2+len) > dgram->data+sizeof(dgram->data)) || ((p2+len) < p2)) { - DEBUG(0, ("send_mailslot: Cannot write beyond end of packet\n")); - return False; - } else { - memcpy(p2,buf,len); - p2 += len; - } - - dgram->datasize = PTR_DIFF(p2,ptr+4); /* +4 for tcp length. */ - - p.ip = dest_ip; - p.port = dest_port; - p.fd = find_subnet_mailslot_fd_for_address( src_ip ); - p.timestamp = time(NULL); - p.packet_type = DGRAM_PACKET; - - DEBUG(4,("send_mailslot: Sending to mailslot %s from %s IP %s ", mailslot, - nmb_namestr(&dgram->source_name), inet_ntoa(src_ip))); - DEBUG(4,("to %s IP %s\n", nmb_namestr(&dgram->dest_name), inet_ntoa(dest_ip))); - - debug_browse_data(buf, len); - - if(loopback_this_packet) - { - struct packet_struct *lo_packet = NULL; - DEBUG(5,("send_mailslot: sending packet to ourselves.\n")); - if((lo_packet = copy_packet(&p)) == NULL) - return False; - queue_packet(lo_packet); - return True; - } - else - return(send_packet(&p)); + if (((p2+len) > dgram->data+sizeof(dgram->data)) || ((p2+len) < p2)) { + DEBUG(0, ("send_mailslot: Cannot write beyond end of packet\n")); + return False; + } else { + memcpy(p2,buf,len); + p2 += len; + } + + dgram->datasize = PTR_DIFF(p2,ptr+4); /* +4 for tcp length. */ + + p.ip = dest_ip; + p.port = dest_port; + p.fd = find_subnet_mailslot_fd_for_address( src_ip ); + p.timestamp = time(NULL); + p.packet_type = DGRAM_PACKET; + + DEBUG(4,("send_mailslot: Sending to mailslot %s from %s IP %s ", mailslot, + nmb_namestr(&dgram->source_name), inet_ntoa(src_ip))); + DEBUG(4,("to %s IP %s\n", nmb_namestr(&dgram->dest_name), inet_ntoa(dest_ip))); + + debug_browse_data(buf, len); + + if(loopback_this_packet) { + struct packet_struct *lo_packet = NULL; + DEBUG(5,("send_mailslot: sending packet to ourselves.\n")); + if((lo_packet = copy_packet(&p)) == NULL) + return False; + queue_packet(lo_packet); + return True; + } else { + return(send_packet(&p)); + } } diff --git a/source3/nmbd/nmbd_processlogon.c b/source3/nmbd/nmbd_processlogon.c index bc3540af70..2a6a6b66d1 100644 --- a/source3/nmbd/nmbd_processlogon.c +++ b/source3/nmbd/nmbd_processlogon.c @@ -3,7 +3,7 @@ NBT netbios routines and daemon - version 2 Copyright (C) Andrew Tridgell 1994-1998 Copyright (C) Luke Kenneth Casson Leighton 1994-1998 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 Copyright (C) Jim McDonough 2002 This program is free software; you can redistribute it and/or modify @@ -35,6 +35,7 @@ struct sam_database_info { /**************************************************************************** Send a message to smbd to do a sam delta sync **************************************************************************/ + static void send_repl_message(uint32 low_serial) { TDB_CONTEXT *tdb; @@ -64,432 +65,452 @@ Process a domain logon packet void process_logon_packet(struct packet_struct *p, char *buf,int len, const char *mailslot) { - struct dgram_packet *dgram = &p->packet.dgram; - pstring my_name; - fstring reply_name; - pstring outbuf; - int code; - uint16 token = 0; - uint32 ntversion = 0; - uint16 lmnttoken = 0; - uint16 lm20token = 0; - uint32 domainsidsize; - BOOL short_request = False; - char *getdc; - char *uniuser; /* Unicode user name. */ - pstring ascuser; - char *unicomp; /* Unicode computer name. */ - - memset(outbuf, 0, sizeof(outbuf)); - - if (!lp_domain_logons()) - { - DEBUG(3,("process_logon_packet: Logon packet received from IP %s and domain \ + struct dgram_packet *dgram = &p->packet.dgram; + pstring my_name; + fstring reply_name; + pstring outbuf; + int code; + uint16 token = 0; + uint32 ntversion = 0; + uint16 lmnttoken = 0; + uint16 lm20token = 0; + uint32 domainsidsize; + BOOL short_request = False; + char *getdc; + char *uniuser; /* Unicode user name. */ + pstring ascuser; + char *unicomp; /* Unicode computer name. */ + + memset(outbuf, 0, sizeof(outbuf)); + + if (!lp_domain_logons()) { + DEBUG(3,("process_logon_packet: Logon packet received from IP %s and domain \ logons are not enabled.\n", inet_ntoa(p->ip) )); - return; - } - - pstrcpy(my_name, global_myname()); - - code = SVAL(buf,0); - DEBUG(1,("process_logon_packet: Logon from %s: code = 0x%x\n", inet_ntoa(p->ip), code)); - - switch (code) - { - case 0: - { - char *q = buf + 2; - char *machine = q; - char *user = skip_string(machine,1); - - getdc = skip_string(user,1); - q = skip_string(getdc,1); - token = SVAL(q,3); - - fstrcpy(reply_name,my_name); - - DEBUG(3,("process_logon_packet: Domain login request from %s at IP %s user=%s token=%x\n", - machine,inet_ntoa(p->ip),user,token)); - - q = outbuf; - SSVAL(q, 0, 6); - q += 2; - - fstrcpy(reply_name, "\\\\"); - fstrcat(reply_name, my_name); - fstrcpy(q, reply_name); q = skip_string(q, 1); /* PDC name */ - - SSVAL(q, 0, token); - q += 2; - - dump_data(4, outbuf, PTR_DIFF(q, outbuf)); - - send_mailslot(True, getdc, - outbuf,PTR_DIFF(q,outbuf), - global_myname(), 0x0, - machine, - dgram->source_name.name_type, - p->ip, *iface_ip(p->ip), p->port); - break; - } - - case QUERYFORPDC: - { - char *q = buf + 2; - char *machine = q; - - if (!lp_domain_master()) - { - /* We're not Primary Domain Controller -- ignore this */ - return; - } - - getdc = skip_string(machine,1); - q = skip_string(getdc,1); - q = ALIGN2(q, buf); - - /* at this point we can work out if this is a W9X or NT style - request. Experiments show that the difference is wether the - packet ends here. For a W9X request we now end with a pair of - bytes (usually 0xFE 0xFF) whereas with NT we have two further - strings - the following is a simple way of detecting this */ - if (len - PTR_DIFF(q, buf) <= 3) { - short_request = True; - } else { - unicomp = q; - - /* A full length (NT style) request */ - q = skip_unibuf(unicomp, PTR_DIFF(buf + len, unicomp)); - - if (len - PTR_DIFF(q, buf) > 8) { + return; + } + + pstrcpy(my_name, global_myname()); + + code = SVAL(buf,0); + DEBUG(1,("process_logon_packet: Logon from %s: code = 0x%x\n", inet_ntoa(p->ip), code)); + + switch (code) { + case 0: + { + fstring mach_str, user_str, getdc_str; + char *q = buf + 2; + char *machine = q; + char *user = skip_string(machine,1); + + getdc = skip_string(user,1); + q = skip_string(getdc,1); + token = SVAL(q,3); + + fstrcpy(reply_name,my_name); + + pull_ascii_fstring(mach_str, machine); + pull_ascii_fstring(user_str, user); + pull_ascii_fstring(getdc_str, getdc); + + DEBUG(3,("process_logon_packet: Domain login request from %s at IP %s user=%s token=%x\n", + mach_str,inet_ntoa(p->ip),user_str,token)); + + q = outbuf; + SSVAL(q, 0, 6); + q += 2; + + fstrcpy(reply_name, "\\\\"); + fstrcat(reply_name, my_name); + push_ascii_fstring(q, reply_name); + q = skip_string(q, 1); /* PDC name */ + + SSVAL(q, 0, token); + q += 2; + + dump_data(4, outbuf, PTR_DIFF(q, outbuf)); + + send_mailslot(True, getdc_str, + outbuf,PTR_DIFF(q,outbuf), + global_myname(), 0x0, + mach_str, + dgram->source_name.name_type, + p->ip, *iface_ip(p->ip), p->port); + break; + } + + case QUERYFORPDC: + { + fstring mach_str, getdc_str; + nstring source_name; + char *q = buf + 2; + char *machine = q; + + if (!lp_domain_master()) { + /* We're not Primary Domain Controller -- ignore this */ + return; + } + + getdc = skip_string(machine,1); + q = skip_string(getdc,1); + q = ALIGN2(q, buf); + + /* At this point we can work out if this is a W9X or NT style + request. Experiments show that the difference is wether the + packet ends here. For a W9X request we now end with a pair of + bytes (usually 0xFE 0xFF) whereas with NT we have two further + strings - the following is a simple way of detecting this */ + + if (len - PTR_DIFF(q, buf) <= 3) { + short_request = True; + } else { + unicomp = q; + + /* A full length (NT style) request */ + q = skip_unibuf(unicomp, PTR_DIFF(buf + len, unicomp)); + + if (len - PTR_DIFF(q, buf) > 8) { + /* with NT5 clients we can sometimes + get additional data - a length specificed string + containing the domain name, then 16 bytes of + data (no idea what it is) */ + int dom_len = CVAL(q, 0); + q++; + if (dom_len != 0) { + q += dom_len + 1; + } + q += 16; + } + ntversion = IVAL(q, 0); + lmnttoken = SVAL(q, 4); + lm20token = SVAL(q, 6); + } + + /* Construct reply. */ + q = outbuf; + SSVAL(q, 0, QUERYFORPDC_R); + q += 2; + + fstrcpy(reply_name,my_name); + push_ascii_fstring(q, reply_name); + q = skip_string(q, 1); /* PDC name */ + + /* PDC and domain name */ + if (!short_request) { + /* Make a full reply */ + q = ALIGN2(q, outbuf); + + q += dos_PutUniCode(q, my_name, sizeof(pstring), True); /* PDC name */ + q += dos_PutUniCode(q, lp_workgroup(),sizeof(pstring), True); /* Domain name*/ + SIVAL(q, 0, 1); /* our nt version */ + SSVAL(q, 4, 0xffff); /* our lmnttoken */ + SSVAL(q, 6, 0xffff); /* our lm20token */ + q += 8; + } + + /* RJS, 21-Feb-2000, we send a short reply if the request was short */ + + pull_ascii_fstring(mach_str, machine); + + DEBUG(3,("process_logon_packet: GETDC request from %s at IP %s, \ +reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n", + mach_str,inet_ntoa(p->ip), reply_name, lp_workgroup(), + QUERYFORPDC_R, (uint32)ntversion, (uint32)lmnttoken, + (uint32)lm20token )); + + dump_data(4, outbuf, PTR_DIFF(q, outbuf)); + + pull_ascii_fstring(getdc_str, getdc); + pull_ascii_nstring(source_name, dgram->source_name.name); + + send_mailslot(True, getdc_str, + outbuf,PTR_DIFF(q,outbuf), + global_myname(), 0x0, + source_name, + dgram->source_name.name_type, + p->ip, *iface_ip(p->ip), p->port); + return; + } + + case SAMLOGON: + + { + fstring getdc_str; + nstring source_name; + char *q = buf + 2; + fstring asccomp; + + q += 2; + unicomp = q; + uniuser = skip_unibuf(unicomp, PTR_DIFF(buf+len, unicomp)); + getdc = skip_unibuf(uniuser,PTR_DIFF(buf+len, uniuser)); + q = skip_string(getdc,1); + q += 4; /* Account Control Bits - indicating username type */ + domainsidsize = IVAL(q, 0); + q += 4; + + DEBUG(3,("process_logon_packet: SAMLOGON sidsize %d, len = %d\n", domainsidsize, len)); + + if (domainsidsize < (len - PTR_DIFF(q, buf)) && (domainsidsize != 0)) { + q += domainsidsize; + q = ALIGN4(q, buf); + } + + DEBUG(3,("process_logon_packet: len = %d PTR_DIFF(q, buf) = %d\n", len, PTR_DIFF(q, buf) )); + + if (len - PTR_DIFF(q, buf) > 8) { /* with NT5 clients we can sometimes - get additional data - a length specificed string - containing the domain name, then 16 bytes of - data (no idea what it is) */ + get additional data - a length specificed string + containing the domain name, then 16 bytes of + data (no idea what it is) */ int dom_len = CVAL(q, 0); q++; - if (dom_len != 0) { + if (dom_len < (len - PTR_DIFF(q, buf)) && (dom_len != 0)) { q += dom_len + 1; } q += 16; - } - ntversion = IVAL(q, 0); - lmnttoken = SVAL(q, 4); - lm20token = SVAL(q, 6); - } - - /* Construct reply. */ - q = outbuf; - SSVAL(q, 0, QUERYFORPDC_R); - q += 2; - - fstrcpy(reply_name,my_name); - fstrcpy(q, reply_name); - q = skip_string(q, 1); /* PDC name */ - - /* PDC and domain name */ - if (!short_request) /* Make a full reply */ - { - q = ALIGN2(q, outbuf); - - q += dos_PutUniCode(q, my_name, sizeof(pstring), True); /* PDC name */ - q += dos_PutUniCode(q, lp_workgroup(),sizeof(pstring), True); /* Domain name*/ - SIVAL(q, 0, 1); /* our nt version */ - SSVAL(q, 4, 0xffff); /* our lmnttoken */ - SSVAL(q, 6, 0xffff); /* our lm20token */ - q += 8; - } - - /* RJS, 21-Feb-2000, we send a short reply if the request was short */ - - DEBUG(3,("process_logon_packet: GETDC request from %s at IP %s, \ -reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n", - machine,inet_ntoa(p->ip), reply_name, lp_workgroup(), - QUERYFORPDC_R, (uint32)ntversion, (uint32)lmnttoken, - (uint32)lm20token )); - - dump_data(4, outbuf, PTR_DIFF(q, outbuf)); - - send_mailslot(True, getdc, - outbuf,PTR_DIFF(q,outbuf), - global_myname(), 0x0, - dgram->source_name.name, - dgram->source_name.name_type, - p->ip, *iface_ip(p->ip), p->port); - return; - } - - case SAMLOGON: - { - char *q = buf + 2; - fstring asccomp; - - q += 2; - unicomp = q; - uniuser = skip_unibuf(unicomp, PTR_DIFF(buf+len, unicomp)); - getdc = skip_unibuf(uniuser,PTR_DIFF(buf+len, uniuser)); - q = skip_string(getdc,1); - q += 4; /* Account Control Bits - indicating username type */ - domainsidsize = IVAL(q, 0); - q += 4; - - DEBUG(3,("process_logon_packet: SAMLOGON sidsize %d, len = %d\n", domainsidsize, len)); - - if (domainsidsize < (len - PTR_DIFF(q, buf)) && (domainsidsize != 0)) { - q += domainsidsize; - q = ALIGN4(q, buf); - } - - DEBUG(3,("process_logon_packet: len = %d PTR_DIFF(q, buf) = %d\n", len, PTR_DIFF(q, buf) )); - - if (len - PTR_DIFF(q, buf) > 8) { - /* with NT5 clients we can sometimes - get additional data - a length specificed string - containing the domain name, then 16 bytes of - data (no idea what it is) */ - int dom_len = CVAL(q, 0); - q++; - if (dom_len < (len - PTR_DIFF(q, buf)) && (dom_len != 0)) { - q += dom_len + 1; - } - q += 16; - } - - ntversion = IVAL(q, 0); - lmnttoken = SVAL(q, 4); - lm20token = SVAL(q, 6); - q += 8; - - DEBUG(3,("process_logon_packet: SAMLOGON sidsize %d ntv %d\n", domainsidsize, ntversion)); - - /* - * we respond regadless of whether the machine is in our password - * database. If it isn't then we let smbd send an appropriate error. - * Let's ignore the SID. - */ - pull_ucs2_pstring(ascuser, uniuser); - pull_ucs2_fstring(asccomp, unicomp); - DEBUG(3,("process_logon_packet: SAMLOGON user %s\n", ascuser)); - - fstrcpy(reply_name, "\\\\"); /* Here it wants \\LOGONSERVER. */ - fstrcat(reply_name, my_name); - - DEBUG(3,("process_logon_packet: SAMLOGON request from %s(%s) for %s, returning logon svr %s domain %s code %x token=%x\n", - asccomp,inet_ntoa(p->ip), ascuser, reply_name, lp_workgroup(), - SAMLOGON_R ,lmnttoken)); - - /* Construct reply. */ - - q = outbuf; - /* we want the simple version unless we are an ADS PDC..which means */ - /* never, at least for now */ - if ((ntversion < 11) || (SEC_ADS != lp_security()) || (ROLE_DOMAIN_PDC != lp_server_role())) { - if (SVAL(uniuser, 0) == 0) { - SSVAL(q, 0, SAMLOGON_UNK_R); /* user unknown */ - } else { - SSVAL(q, 0, SAMLOGON_R); - } + } + + ntversion = IVAL(q, 0); + lmnttoken = SVAL(q, 4); + lm20token = SVAL(q, 6); + q += 8; + + DEBUG(3,("process_logon_packet: SAMLOGON sidsize %d ntv %d\n", domainsidsize, ntversion)); + + /* + * we respond regadless of whether the machine is in our password + * database. If it isn't then we let smbd send an appropriate error. + * Let's ignore the SID. + */ + pull_ucs2_pstring(ascuser, uniuser); + pull_ucs2_fstring(asccomp, unicomp); + DEBUG(3,("process_logon_packet: SAMLOGON user %s\n", ascuser)); + + fstrcpy(reply_name, "\\\\"); /* Here it wants \\LOGONSERVER. */ + fstrcat(reply_name, my_name); + + DEBUG(3,("process_logon_packet: SAMLOGON request from %s(%s) for %s, returning logon svr %s domain %s code %x token=%x\n", + asccomp,inet_ntoa(p->ip), ascuser, reply_name, lp_workgroup(), + SAMLOGON_R ,lmnttoken)); + + /* Construct reply. */ + + q = outbuf; + /* we want the simple version unless we are an ADS PDC..which means */ + /* never, at least for now */ + if ((ntversion < 11) || (SEC_ADS != lp_security()) || (ROLE_DOMAIN_PDC != lp_server_role())) { + if (SVAL(uniuser, 0) == 0) { + SSVAL(q, 0, SAMLOGON_UNK_R); /* user unknown */ + } else { + SSVAL(q, 0, SAMLOGON_R); + } - q += 2; + q += 2; - q += dos_PutUniCode(q, reply_name,sizeof(pstring), True); - q += dos_PutUniCode(q, ascuser, sizeof(pstring), True); - q += dos_PutUniCode(q, lp_workgroup(),sizeof(pstring), True); - } + q += dos_PutUniCode(q, reply_name,sizeof(pstring), True); + q += dos_PutUniCode(q, ascuser, sizeof(pstring), True); + q += dos_PutUniCode(q, lp_workgroup(),sizeof(pstring), True); + } #ifdef HAVE_ADS - else { - GUID domain_guid; - pstring domain; - pstring hostname; - char *component, *dc, *q1; - uint8 size; - char *q_orig = q; - int str_offset; - - get_mydomname(domain); - get_myname(hostname); + else { + GUID domain_guid; + pstring domain; + pstring hostname; + char *component, *dc, *q1; + uint8 size; + char *q_orig = q; + int str_offset; + + get_mydomname(domain); + get_myname(hostname); - if (SVAL(uniuser, 0) == 0) { - SIVAL(q, 0, SAMLOGON_AD_UNK_R); /* user unknown */ - } else { - SIVAL(q, 0, SAMLOGON_AD_R); - } - q += 4; + if (SVAL(uniuser, 0) == 0) { + SIVAL(q, 0, SAMLOGON_AD_UNK_R); /* user unknown */ + } else { + SIVAL(q, 0, SAMLOGON_AD_R); + } + q += 4; - SIVAL(q, 0, ADS_PDC|ADS_GC|ADS_LDAP|ADS_DS| - ADS_KDC|ADS_TIMESERV|ADS_CLOSEST|ADS_WRITABLE); - q += 4; + SIVAL(q, 0, ADS_PDC|ADS_GC|ADS_LDAP|ADS_DS| + ADS_KDC|ADS_TIMESERV|ADS_CLOSEST|ADS_WRITABLE); + q += 4; - /* Push Domain GUID */ - if (False == secrets_fetch_domain_guid(domain, &domain_guid)) { - DEBUG(2, ("Could not fetch DomainGUID for %s\n", domain)); - return; - } - memcpy(q, &domain_guid, sizeof(domain_guid)); - q += sizeof(domain_guid); - - /* Forest */ - str_offset = q - q_orig; - dc = domain; - q1 = q; - while ((component = strtok(dc, "."))) { - dc = NULL; - size = push_ascii(&q[1], component, -1, 0); - SCVAL(q, 0, size); - q += (size + 1); - } + /* Push Domain GUID */ + if (False == secrets_fetch_domain_guid(domain, &domain_guid)) { + DEBUG(2, ("Could not fetch DomainGUID for %s\n", domain)); + return; + } + memcpy(q, &domain_guid, sizeof(domain_guid)); + q += sizeof(domain_guid); + + /* Forest */ + str_offset = q - q_orig; + dc = domain; + q1 = q; + while ((component = strtok(dc, "."))) { + dc = NULL; + size = push_ascii(&q[1], component, -1, 0); + SCVAL(q, 0, size); + q += (size + 1); + } - /* Unk0 */ - SCVAL(q, 0, 0); q++; - - /* Domain */ - SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F)); - SCVAL(q, 1, str_offset & 0xFF); - q += 2; - - /* Hostname */ - size = push_ascii(&q[1], hostname, -1, 0); - SCVAL(q, 0, size); - q += (size + 1); - SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F)); - SCVAL(q, 1, str_offset & 0xFF); - q += 2; - - /* NETBIOS of domain */ - size = push_ascii(&q[1], lp_workgroup(), -1, STR_UPPER); - SCVAL(q, 0, size); - q += (size + 1); - - /* Unk1 */ - SCVAL(q, 0, 0); q++; - - /* NETBIOS of hostname */ - size = push_ascii(&q[1], my_name, -1, 0); - SCVAL(q, 0, size); - q += (size + 1); - - /* Unk2 */ - SCVAL(q, 0, 0); q++; - - /* User name */ - if (SVAL(uniuser, 0) != 0) { - size = push_ascii(&q[1], ascuser, -1, 0); - SCVAL(q, 0, size); - q += (size + 1); - } + /* Unk0 */ + SCVAL(q, 0, 0); + q++; - q_orig = q; - /* Site name */ - size = push_ascii(&q[1], "Default-First-Site-Name", -1, 0); - SCVAL(q, 0, size); - q += (size + 1); - - /* Site name (2) */ - str_offset = q - q_orig; - SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F)); - SCVAL(q, 1, str_offset & 0xFF); - q += 2; - - SCVAL(q, 0, PTR_DIFF(q,q1)); - SCVAL(q, 1, 0x10); /* unknown */ - - SIVAL(q, 0, 0x00000002); q += 4; /* unknown */ - SIVAL(q, 0, (iface_ip(p->ip))->s_addr); q += 4; - SIVAL(q, 0, 0x00000000); q += 4; /* unknown */ - SIVAL(q, 0, 0x00000000); q += 4; /* unknown */ - } + /* Domain */ + SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F)); + SCVAL(q, 1, str_offset & 0xFF); + q += 2; + + /* Hostname */ + size = push_ascii(&q[1], hostname, -1, 0); + SCVAL(q, 0, size); + q += (size + 1); + SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F)); + SCVAL(q, 1, str_offset & 0xFF); + q += 2; + + /* NETBIOS of domain */ + size = push_ascii(&q[1], lp_workgroup(), -1, STR_UPPER); + SCVAL(q, 0, size); + q += (size + 1); + + /* Unk1 */ + SCVAL(q, 0, 0); + q++; + + /* NETBIOS of hostname */ + size = push_ascii(&q[1], my_name, -1, 0); + SCVAL(q, 0, size); + q += (size + 1); + + /* Unk2 */ + SCVAL(q, 0, 0); + q++; + + /* User name */ + if (SVAL(uniuser, 0) != 0) { + size = push_ascii(&q[1], ascuser, -1, 0); + SCVAL(q, 0, size); + q += (size + 1); + } + + q_orig = q; + /* Site name */ + size = push_ascii(&q[1], "Default-First-Site-Name", -1, 0); + SCVAL(q, 0, size); + q += (size + 1); + + /* Site name (2) */ + str_offset = q - q_orig; + SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F)); + SCVAL(q, 1, str_offset & 0xFF); + q += 2; + + SCVAL(q, 0, PTR_DIFF(q,q1)); + SCVAL(q, 1, 0x10); /* unknown */ + + SIVAL(q, 0, 0x00000002); + q += 4; /* unknown */ + SIVAL(q, 0, (iface_ip(p->ip))->s_addr); + q += 4; + SIVAL(q, 0, 0x00000000); + q += 4; /* unknown */ + SIVAL(q, 0, 0x00000000); + q += 4; /* unknown */ + } #endif - /* tell the client what version we are */ - SIVAL(q, 0, ((ntversion < 11) || (SEC_ADS != lp_security())) ? 1 : 13); - /* our ntversion */ - SSVAL(q, 4, 0xffff); /* our lmnttoken */ - SSVAL(q, 6, 0xffff); /* our lm20token */ - q += 8; - - dump_data(4, outbuf, PTR_DIFF(q, outbuf)); - - send_mailslot(True, getdc, - outbuf,PTR_DIFF(q,outbuf), - global_myname(), 0x0, - dgram->source_name.name, - dgram->source_name.name_type, - p->ip, *iface_ip(p->ip), p->port); - break; - } - - /* Announce change to UAS or SAM. Send by the domain controller when a - replication event is required. */ - - case SAM_UAS_CHANGE: { - struct sam_database_info *db_info; - char *q = buf + 2; - int i, db_count; - uint32 low_serial; + /* tell the client what version we are */ + SIVAL(q, 0, ((ntversion < 11) || (SEC_ADS != lp_security())) ? 1 : 13); + /* our ntversion */ + SSVAL(q, 4, 0xffff); /* our lmnttoken */ + SSVAL(q, 6, 0xffff); /* our lm20token */ + q += 8; + + dump_data(4, outbuf, PTR_DIFF(q, outbuf)); + + pull_ascii_fstring(getdc_str, getdc); + pull_ascii_nstring(source_name, dgram->source_name.name); + + send_mailslot(True, getdc, + outbuf,PTR_DIFF(q,outbuf), + global_myname(), 0x0, + dgram->source_name.name, + dgram->source_name.name_type, + p->ip, *iface_ip(p->ip), p->port); + break; + } + + /* Announce change to UAS or SAM. Send by the domain controller when a + replication event is required. */ + + case SAM_UAS_CHANGE: + { + struct sam_database_info *db_info; + char *q = buf + 2; + int i, db_count; + uint32 low_serial; - /* Header */ + /* Header */ - low_serial = IVAL(q, 0); q += 4; /* Low serial number */ + low_serial = IVAL(q, 0); q += 4; /* Low serial number */ - q += 4; /* Date/time */ - q += 4; /* Pulse */ - q += 4; /* Random */ + q += 4; /* Date/time */ + q += 4; /* Pulse */ + q += 4; /* Random */ - /* Domain info */ + /* Domain info */ - q = skip_string(q, 1); /* PDC name */ - q = skip_string(q, 1); /* Domain name */ - q = skip_unibuf(q, PTR_DIFF(buf + len, q)); /* Unicode PDC name */ - q = skip_unibuf(q, PTR_DIFF(buf + len, q)); /* Unicode domain name */ + q = skip_string(q, 1); /* PDC name */ + q = skip_string(q, 1); /* Domain name */ + q = skip_unibuf(q, PTR_DIFF(buf + len, q)); /* Unicode PDC name */ + q = skip_unibuf(q, PTR_DIFF(buf + len, q)); /* Unicode domain name */ - /* Database info */ + /* Database info */ - db_count = SVAL(q, 0); q += 2; + db_count = SVAL(q, 0); q += 2; - db_info = (struct sam_database_info *) - malloc(sizeof(struct sam_database_info) * db_count); - - if (db_info == NULL) { - DEBUG(3, ("out of memory allocating info for %d databases\n", - db_count)); - return; - } + db_info = (struct sam_database_info *) + malloc(sizeof(struct sam_database_info) * db_count); + + if (db_info == NULL) { + DEBUG(3, ("out of memory allocating info for %d databases\n", db_count)); + return; + } - for (i = 0; i < db_count; i++) { - db_info[i].index = IVAL(q, 0); - db_info[i].serial_lo = IVAL(q, 4); - db_info[i].serial_hi = IVAL(q, 8); - db_info[i].date_lo = IVAL(q, 12); - db_info[i].date_hi = IVAL(q, 16); - q += 20; - } - - /* Domain SID */ - - q += IVAL(q, 0) + 4; /* 4 byte length plus data */ + for (i = 0; i < db_count; i++) { + db_info[i].index = IVAL(q, 0); + db_info[i].serial_lo = IVAL(q, 4); + db_info[i].serial_hi = IVAL(q, 8); + db_info[i].date_lo = IVAL(q, 12); + db_info[i].date_hi = IVAL(q, 16); + q += 20; + } + + /* Domain SID */ + + q += IVAL(q, 0) + 4; /* 4 byte length plus data */ - q += 2; /* Alignment? */ - - /* Misc other info */ + q += 2; /* Alignment? */ - q += 4; /* NT version (0x1) */ - q += 2; /* LMNT token (0xff) */ - q += 2; /* LM20 token (0xff) */ + /* Misc other info */ - SAFE_FREE(db_info); /* Not sure whether we need to do anything - useful with these */ + q += 4; /* NT version (0x1) */ + q += 2; /* LMNT token (0xff) */ + q += 2; /* LM20 token (0xff) */ - /* Send message to smbd */ + SAFE_FREE(db_info); /* Not sure whether we need to do anything useful with these */ - send_repl_message(low_serial); + /* Send message to smbd */ - break; - } + send_repl_message(low_serial); + break; + } - default: - { - DEBUG(3,("process_logon_packet: Unknown domain request %d\n",code)); - return; - } - } + default: + DEBUG(3,("process_logon_packet: Unknown domain request %d\n",code)); + return; + } } diff --git a/source3/nmbd/nmbd_responserecordsdb.c b/source3/nmbd/nmbd_responserecordsdb.c index 7e8c8025ae..30c0c12950 100644 --- a/source3/nmbd/nmbd_responserecordsdb.c +++ b/source3/nmbd/nmbd_responserecordsdb.c @@ -34,27 +34,26 @@ int num_response_packets = 0; static void add_response_record(struct subnet_record *subrec, struct response_record *rrec) { - struct response_record *rrec2; + struct response_record *rrec2; - num_response_packets++; /* count of total number of packets still around */ + num_response_packets++; /* count of total number of packets still around */ - DEBUG(4,("add_response_record: adding response record id:%hu to subnet %s. num_records:%d\n", - rrec->response_id, subrec->subnet_name, num_response_packets)); + DEBUG(4,("add_response_record: adding response record id:%hu to subnet %s. num_records:%d\n", + rrec->response_id, subrec->subnet_name, num_response_packets)); - if (!subrec->responselist) - { - subrec->responselist = rrec; - rrec->prev = NULL; - rrec->next = NULL; - return; - } + if (!subrec->responselist) { + subrec->responselist = rrec; + rrec->prev = NULL; + rrec->next = NULL; + return; + } - for (rrec2 = subrec->responselist; rrec2->next; rrec2 = rrec2->next) - ; + for (rrec2 = subrec->responselist; rrec2->next; rrec2 = rrec2->next) + ; - rrec2->next = rrec; - rrec->next = NULL; - rrec->prev = rrec2; + rrec2->next = rrec; + rrec->next = NULL; + rrec->prev = rrec2; } /*************************************************************************** @@ -64,32 +63,31 @@ static void add_response_record(struct subnet_record *subrec, void remove_response_record(struct subnet_record *subrec, struct response_record *rrec) { - if (rrec->prev) - rrec->prev->next = rrec->next; - if (rrec->next) - rrec->next->prev = rrec->prev; - - if (subrec->responselist == rrec) - subrec->responselist = rrec->next; - - if(rrec->userdata) - { - if(rrec->userdata->free_fn) { - (*rrec->userdata->free_fn)(rrec->userdata); - } else { - ZERO_STRUCTP(rrec->userdata); - SAFE_FREE(rrec->userdata); - } - } - - /* Ensure we can delete. */ - rrec->packet->locked = False; - free_packet(rrec->packet); - - ZERO_STRUCTP(rrec); - SAFE_FREE(rrec); - - num_response_packets--; /* count of total number of packets still around */ + if (rrec->prev) + rrec->prev->next = rrec->next; + if (rrec->next) + rrec->next->prev = rrec->prev; + + if (subrec->responselist == rrec) + subrec->responselist = rrec->next; + + if(rrec->userdata) { + if(rrec->userdata->free_fn) { + (*rrec->userdata->free_fn)(rrec->userdata); + } else { + ZERO_STRUCTP(rrec->userdata); + SAFE_FREE(rrec->userdata); + } + } + + /* Ensure we can delete. */ + rrec->packet->locked = False; + free_packet(rrec->packet); + + ZERO_STRUCTP(rrec); + SAFE_FREE(rrec); + + num_response_packets--; /* count of total number of packets still around */ } /**************************************************************************** @@ -104,77 +102,70 @@ struct response_record *make_response_record( struct subnet_record *subrec, fail_function fail_fn, struct userdata_struct *userdata) { - struct response_record *rrec; - struct nmb_packet *nmb = &p->packet.nmb; - - if (!(rrec = (struct response_record *)malloc(sizeof(*rrec)))) - { - DEBUG(0,("make_response_queue_record: malloc fail for response_record.\n")); - return NULL; - } - - memset((char *)rrec, '\0', sizeof(*rrec)); - - rrec->response_id = nmb->header.name_trn_id; - - rrec->resp_fn = resp_fn; - rrec->timeout_fn = timeout_fn; - rrec->success_fn = success_fn; - rrec->fail_fn = fail_fn; - - rrec->packet = p; - - if(userdata) - { - /* Intelligent userdata. */ - if(userdata->copy_fn) - { - if((rrec->userdata = (*userdata->copy_fn)(userdata)) == NULL) - { - DEBUG(0,("make_response_queue_record: copy fail for userdata.\n")); - ZERO_STRUCTP(rrec); - SAFE_FREE(rrec); - return NULL; - } - } - else - { - /* Primitive userdata, do a memcpy. */ - if((rrec->userdata = (struct userdata_struct *) - malloc(sizeof(struct userdata_struct)+userdata->userdata_len)) == NULL) - { - DEBUG(0,("make_response_queue_record: malloc fail for userdata.\n")); - ZERO_STRUCTP(rrec); - SAFE_FREE(rrec); - return NULL; - } - rrec->userdata->copy_fn = userdata->copy_fn; - rrec->userdata->free_fn = userdata->free_fn; - rrec->userdata->userdata_len = userdata->userdata_len; - memcpy(rrec->userdata->data, userdata->data, userdata->userdata_len); - } - } - else - rrec->userdata = NULL; - - rrec->num_msgs = 0; - - if(!nmb->header.nm_flags.bcast) - rrec->repeat_interval = 5; /* 5 seconds for unicast packets. */ - else - rrec->repeat_interval = 1; /* XXXX should be in ms */ - rrec->repeat_count = 3; /* 3 retries */ - rrec->repeat_time = time(NULL) + rrec->repeat_interval; /* initial retry time */ - - /* This packet is not being processed. */ - rrec->in_expiration_processing = False; - - /* Lock the packet so we won't lose it while it's on the list. */ - p->locked = True; - - add_response_record(subrec, rrec); - - return rrec; + struct response_record *rrec; + struct nmb_packet *nmb = &p->packet.nmb; + + if (!(rrec = (struct response_record *)malloc(sizeof(*rrec)))) { + DEBUG(0,("make_response_queue_record: malloc fail for response_record.\n")); + return NULL; + } + + memset((char *)rrec, '\0', sizeof(*rrec)); + + rrec->response_id = nmb->header.name_trn_id; + + rrec->resp_fn = resp_fn; + rrec->timeout_fn = timeout_fn; + rrec->success_fn = success_fn; + rrec->fail_fn = fail_fn; + + rrec->packet = p; + + if(userdata) { + /* Intelligent userdata. */ + if(userdata->copy_fn) { + if((rrec->userdata = (*userdata->copy_fn)(userdata)) == NULL) { + DEBUG(0,("make_response_queue_record: copy fail for userdata.\n")); + ZERO_STRUCTP(rrec); + SAFE_FREE(rrec); + return NULL; + } + } else { + /* Primitive userdata, do a memcpy. */ + if((rrec->userdata = (struct userdata_struct *) + malloc(sizeof(struct userdata_struct)+userdata->userdata_len)) == NULL) { + DEBUG(0,("make_response_queue_record: malloc fail for userdata.\n")); + ZERO_STRUCTP(rrec); + SAFE_FREE(rrec); + return NULL; + } + rrec->userdata->copy_fn = userdata->copy_fn; + rrec->userdata->free_fn = userdata->free_fn; + rrec->userdata->userdata_len = userdata->userdata_len; + memcpy(rrec->userdata->data, userdata->data, userdata->userdata_len); + } + } else { + rrec->userdata = NULL; + } + + rrec->num_msgs = 0; + + if(!nmb->header.nm_flags.bcast) + rrec->repeat_interval = 5; /* 5 seconds for unicast packets. */ + else + rrec->repeat_interval = 1; /* XXXX should be in ms */ + rrec->repeat_count = 3; /* 3 retries */ + rrec->repeat_time = time(NULL) + rrec->repeat_interval; /* initial retry time */ + + /* This packet is not being processed. */ + rrec->in_expiration_processing = False; + + /* Lock the packet so we won't lose it while it's on the list. */ + p->locked = True; + + add_response_record(subrec, rrec); + + return rrec; } /**************************************************************************** @@ -184,18 +175,16 @@ struct response_record *make_response_record( struct subnet_record *subrec, static struct response_record *find_response_record_on_subnet( struct subnet_record *subrec, uint16 id) { - struct response_record *rrec = NULL; - - for (rrec = subrec->responselist; rrec; rrec = rrec->next) - { - if (rrec->response_id == id) - { - DEBUG(4, ("find_response_record: found response record id = %hu on subnet %s\n", - id, subrec->subnet_name)); - break; - } - } - return rrec; + struct response_record *rrec = NULL; + + for (rrec = subrec->responselist; rrec; rrec = rrec->next) { + if (rrec->response_id == id) { + DEBUG(4, ("find_response_record: found response record id = %hu on subnet %s\n", + id, subrec->subnet_name)); + break; + } + } + return rrec; } /**************************************************************************** @@ -205,37 +194,34 @@ static struct response_record *find_response_record_on_subnet( struct response_record *find_response_record(struct subnet_record **ppsubrec, uint16 id) { - struct response_record *rrec = NULL; - - for ((*ppsubrec) = FIRST_SUBNET; (*ppsubrec); - (*ppsubrec) = NEXT_SUBNET_INCLUDING_UNICAST(*ppsubrec)) - { - if((rrec = find_response_record_on_subnet(*ppsubrec, id)) != NULL) - return rrec; - } - - /* There should never be response records on the remote_broadcast subnet. - Sanity check to ensure this is so. */ - if(remote_broadcast_subnet->responselist != NULL) - { - DEBUG(0,("find_response_record: response record found on subnet %s. This should \ + struct response_record *rrec = NULL; + + for ((*ppsubrec) = FIRST_SUBNET; (*ppsubrec); + (*ppsubrec) = NEXT_SUBNET_INCLUDING_UNICAST(*ppsubrec)) { + if((rrec = find_response_record_on_subnet(*ppsubrec, id)) != NULL) + return rrec; + } + + /* There should never be response records on the remote_broadcast subnet. + Sanity check to ensure this is so. */ + if(remote_broadcast_subnet->responselist != NULL) { + DEBUG(0,("find_response_record: response record found on subnet %s. This should \ never happen !\n", remote_broadcast_subnet->subnet_name)); - } + } - /* Now check the WINS server subnet if it exists. */ - if(wins_server_subnet != NULL) - { - *ppsubrec = wins_server_subnet; - if((rrec = find_response_record_on_subnet(*ppsubrec, id))!= NULL) - return rrec; - } + /* Now check the WINS server subnet if it exists. */ + if(wins_server_subnet != NULL) { + *ppsubrec = wins_server_subnet; + if((rrec = find_response_record_on_subnet(*ppsubrec, id))!= NULL) + return rrec; + } - DEBUG(0,("find_response_record: response packet id %hu received with no \ + DEBUG(0,("find_response_record: response packet id %hu received with no \ matching record.\n", id)); - *ppsubrec = NULL; + *ppsubrec = NULL; - return NULL; + return NULL; } /**************************************************************************** @@ -244,21 +230,19 @@ matching record.\n", id)); BOOL is_refresh_already_queued(struct subnet_record *subrec, struct name_record *namerec) { - struct response_record *rrec = NULL; + struct response_record *rrec = NULL; - for (rrec = subrec->responselist; rrec; rrec = rrec->next) - { - struct packet_struct *p = rrec->packet; - struct nmb_packet *nmb = &p->packet.nmb; - - if((nmb->header.opcode == NMB_NAME_REFRESH_OPCODE_8) || - (nmb->header.opcode == NMB_NAME_REFRESH_OPCODE_9)) - { - /* Yes it's a queued refresh - check if the name is correct. */ - if(nmb_name_equal(&nmb->question.question_name, &namerec->name)) - return True; - } - } - - return False; -} + for (rrec = subrec->responselist; rrec; rrec = rrec->next) { + struct packet_struct *p = rrec->packet; + struct nmb_packet *nmb = &p->packet.nmb; + + if((nmb->header.opcode == NMB_NAME_REFRESH_OPCODE_8) || + (nmb->header.opcode == NMB_NAME_REFRESH_OPCODE_9)) { + /* Yes it's a queued refresh - check if the name is correct. */ + if(nmb_name_equal(&nmb->question.question_name, &namerec->name)) + return True; + } + } + + return False; +} diff --git a/source3/nmbd/nmbd_sendannounce.c b/source3/nmbd/nmbd_sendannounce.c index 353717ee62..87908e352c 100644 --- a/source3/nmbd/nmbd_sendannounce.c +++ b/source3/nmbd/nmbd_sendannounce.c @@ -35,21 +35,21 @@ extern BOOL found_lm_clients; void send_browser_reset(int reset_type, const char *to_name, int to_type, struct in_addr to_ip) { - pstring outbuf; - char *p; + pstring outbuf; + char *p; - DEBUG(3,("send_browser_reset: sending reset request type %d to %s<%02x> IP %s.\n", - reset_type, to_name, to_type, inet_ntoa(to_ip) )); + DEBUG(3,("send_browser_reset: sending reset request type %d to %s<%02x> IP %s.\n", + reset_type, to_name, to_type, inet_ntoa(to_ip) )); - memset(outbuf,'\0',sizeof(outbuf)); - p = outbuf; - SCVAL(p,0,ANN_ResetBrowserState); - p++; - SCVAL(p,0,reset_type); - p++; + memset(outbuf,'\0',sizeof(outbuf)); + p = outbuf; + SCVAL(p,0,ANN_ResetBrowserState); + p++; + SCVAL(p,0,reset_type); + p++; - send_mailslot(True, BROWSE_MAILSLOT, outbuf,PTR_DIFF(p,outbuf), - global_myname(), 0x0, to_name, to_type, to_ip, + send_mailslot(True, BROWSE_MAILSLOT, outbuf,PTR_DIFF(p,outbuf), + global_myname(), 0x0, to_name, to_type, to_ip, FIRST_SUBNET->myip, DGRAM_PORT); } @@ -60,25 +60,25 @@ void send_browser_reset(int reset_type, const char *to_name, int to_type, struct void broadcast_announce_request(struct subnet_record *subrec, struct work_record *work) { - pstring outbuf; - char *p; + pstring outbuf; + char *p; - work->needannounce = True; + work->needannounce = True; - DEBUG(3,("broadcast_announce_request: sending announce request for workgroup %s \ + DEBUG(3,("broadcast_announce_request: sending announce request for workgroup %s \ to subnet %s\n", work->work_group, subrec->subnet_name)); - memset(outbuf,'\0',sizeof(outbuf)); - p = outbuf; - SCVAL(p,0,ANN_AnnouncementRequest); - p++; + memset(outbuf,'\0',sizeof(outbuf)); + p = outbuf; + SCVAL(p,0,ANN_AnnouncementRequest); + p++; - SCVAL(p,0,work->token); /* (local) Unique workgroup token id. */ - p++; - p += push_string(NULL, p+1, global_myname(), 15, STR_ASCII|STR_UPPER|STR_TERMINATE); + SCVAL(p,0,work->token); /* (local) Unique workgroup token id. */ + p++; + p += push_string(NULL, p+1, global_myname(), 15, STR_ASCII|STR_UPPER|STR_TERMINATE); - send_mailslot(False, BROWSE_MAILSLOT, outbuf,PTR_DIFF(p,outbuf), - global_myname(), 0x0, work->work_group,0x1e, subrec->bcast_ip, + send_mailslot(False, BROWSE_MAILSLOT, outbuf,PTR_DIFF(p,outbuf), + global_myname(), 0x0, work->work_group,0x1e, subrec->bcast_ip, subrec->myip, DGRAM_PORT); } @@ -91,33 +91,33 @@ static void send_announcement(struct subnet_record *subrec, int announce_type, time_t announce_interval, const char *server_name, int server_type, const char *server_comment) { - pstring outbuf; - char *p; + pstring outbuf; + char *p; - memset(outbuf,'\0',sizeof(outbuf)); - p = outbuf+1; + memset(outbuf,'\0',sizeof(outbuf)); + p = outbuf+1; - SCVAL(outbuf,0,announce_type); + SCVAL(outbuf,0,announce_type); - /* Announcement parameters. */ - SCVAL(p,0,updatecount); - SIVAL(p,1,announce_interval*1000); /* Milliseconds - despite the spec. */ + /* Announcement parameters. */ + SCVAL(p,0,updatecount); + SIVAL(p,1,announce_interval*1000); /* Milliseconds - despite the spec. */ - push_string(NULL, p+5, server_name, 15, STR_ASCII|STR_UPPER|STR_TERMINATE); + push_string(NULL, p+5, server_name, 15, STR_ASCII|STR_UPPER|STR_TERMINATE); - SCVAL(p,21,lp_major_announce_version()); /* Major version. */ - SCVAL(p,22,lp_minor_announce_version()); /* Minor version. */ + SCVAL(p,21,lp_major_announce_version()); /* Major version. */ + SCVAL(p,22,lp_minor_announce_version()); /* Minor version. */ - SIVAL(p,23,server_type & ~SV_TYPE_LOCAL_LIST_ONLY); - /* Browse version: got from NT/AS 4.00 - Value defined in smb.h (JHT). */ - SSVAL(p,27,BROWSER_ELECTION_VERSION); - SSVAL(p,29,BROWSER_CONSTANT); /* Browse signature. */ + SIVAL(p,23,server_type & ~SV_TYPE_LOCAL_LIST_ONLY); + /* Browse version: got from NT/AS 4.00 - Value defined in smb.h (JHT). */ + SSVAL(p,27,BROWSER_ELECTION_VERSION); + SSVAL(p,29,BROWSER_CONSTANT); /* Browse signature. */ - p += 31 + push_string(NULL, p+31, server_comment, -1, STR_ASCII|STR_TERMINATE); + p += 31 + push_string(NULL, p+31, server_comment, -1, STR_ASCII|STR_TERMINATE); - send_mailslot(False,BROWSE_MAILSLOT, outbuf, PTR_DIFF(p,outbuf), - from_name, 0x0, to_name, to_type, to_ip, subrec->myip, - DGRAM_PORT); + send_mailslot(False,BROWSE_MAILSLOT, outbuf, PTR_DIFF(p,outbuf), + from_name, 0x0, to_name, to_type, to_ip, subrec->myip, + DGRAM_PORT); } /**************************************************************************** @@ -129,28 +129,23 @@ static void send_lm_announcement(struct subnet_record *subrec, int announce_type time_t announce_interval, char *server_name, int server_type, char *server_comment) { - pstring outbuf; - char *p=outbuf; - - memset(outbuf,'\0',sizeof(outbuf)); - - SSVAL(p,0,announce_type); - SIVAL(p,2,server_type & ~SV_TYPE_LOCAL_LIST_ONLY); - SCVAL(p,6,lp_major_announce_version()); /* Major version. */ - SCVAL(p,7,lp_minor_announce_version()); /* Minor version. */ - SSVAL(p,8,announce_interval); /* In seconds - according to spec. */ - - p += 10; - /*StrnCpy(p,server_name,15); - strupper_m(p); - p = skip_string(p,1); - pstrcpy(p,server_comment); - p = skip_string(p,1);*/ - p += push_string(NULL, p, server_name, 15, STR_ASCII|STR_UPPER|STR_TERMINATE); - p += push_string(NULL, p, server_comment, sizeof(pstring)-15, STR_ASCII|STR_UPPER|STR_TERMINATE); - - send_mailslot(False,LANMAN_MAILSLOT, outbuf, PTR_DIFF(p,outbuf), - from_name, 0x0, to_name, to_type, to_ip, subrec->myip, + pstring outbuf; + char *p=outbuf; + + memset(outbuf,'\0',sizeof(outbuf)); + + SSVAL(p,0,announce_type); + SIVAL(p,2,server_type & ~SV_TYPE_LOCAL_LIST_ONLY); + SCVAL(p,6,lp_major_announce_version()); /* Major version. */ + SCVAL(p,7,lp_minor_announce_version()); /* Minor version. */ + SSVAL(p,8,announce_interval); /* In seconds - according to spec. */ + + p += 10; + p += push_string(NULL, p, server_name, 15, STR_ASCII|STR_UPPER|STR_TERMINATE); + p += push_string(NULL, p, server_comment, sizeof(pstring)-15, STR_ASCII|STR_UPPER|STR_TERMINATE); + + send_mailslot(False,LANMAN_MAILSLOT, outbuf, PTR_DIFF(p,outbuf), + from_name, 0x0, to_name, to_type, to_ip, subrec->myip, DGRAM_PORT); } @@ -161,20 +156,20 @@ static void send_lm_announcement(struct subnet_record *subrec, int announce_type static void send_local_master_announcement(struct subnet_record *subrec, struct work_record *work, struct server_record *servrec) { - /* Ensure we don't have the prohibited bit set. */ - uint32 type = servrec->serv.type & ~SV_TYPE_LOCAL_LIST_ONLY; - - DEBUG(3,("send_local_master_announcement: type %x for name %s on subnet %s for workgroup %s\n", - type, global_myname(), subrec->subnet_name, work->work_group)); - - send_announcement(subrec, ANN_LocalMasterAnnouncement, - global_myname(), /* From nbt name. */ - work->work_group, 0x1e, /* To nbt name. */ - subrec->bcast_ip, /* To ip. */ - work->announce_interval, /* Time until next announce. */ - global_myname(), /* Name to announce. */ - type, /* Type field. */ - servrec->serv.comment); + /* Ensure we don't have the prohibited bit set. */ + uint32 type = servrec->serv.type & ~SV_TYPE_LOCAL_LIST_ONLY; + + DEBUG(3,("send_local_master_announcement: type %x for name %s on subnet %s for workgroup %s\n", + type, global_myname(), subrec->subnet_name, work->work_group)); + + send_announcement(subrec, ANN_LocalMasterAnnouncement, + global_myname(), /* From nbt name. */ + work->work_group, 0x1e, /* To nbt name. */ + subrec->bcast_ip, /* To ip. */ + work->announce_interval, /* Time until next announce. */ + global_myname(), /* Name to announce. */ + type, /* Type field. */ + servrec->serv.comment); } /**************************************************************************** @@ -183,17 +178,17 @@ static void send_local_master_announcement(struct subnet_record *subrec, struct static void send_workgroup_announcement(struct subnet_record *subrec, struct work_record *work) { - DEBUG(3,("send_workgroup_announcement: on subnet %s for workgroup %s\n", - subrec->subnet_name, work->work_group)); - - send_announcement(subrec, ANN_DomainAnnouncement, - global_myname(), /* From nbt name. */ - MSBROWSE, 0x1, /* To nbt name. */ - subrec->bcast_ip, /* To ip. */ - work->announce_interval, /* Time until next announce. */ - work->work_group, /* Name to announce. */ - SV_TYPE_DOMAIN_ENUM|SV_TYPE_NT, /* workgroup announce flags. */ - global_myname()); /* From name as comment. */ + DEBUG(3,("send_workgroup_announcement: on subnet %s for workgroup %s\n", + subrec->subnet_name, work->work_group)); + + send_announcement(subrec, ANN_DomainAnnouncement, + global_myname(), /* From nbt name. */ + MSBROWSE, 0x1, /* To nbt name. */ + subrec->bcast_ip, /* To ip. */ + work->announce_interval, /* Time until next announce. */ + work->work_group, /* Name to announce. */ + SV_TYPE_DOMAIN_ENUM|SV_TYPE_NT, /* workgroup announce flags. */ + global_myname()); /* From name as comment. */ } /**************************************************************************** @@ -203,20 +198,20 @@ static void send_workgroup_announcement(struct subnet_record *subrec, struct wor static void send_host_announcement(struct subnet_record *subrec, struct work_record *work, struct server_record *servrec) { - /* Ensure we don't have the prohibited bits set. */ - uint32 type = servrec->serv.type & ~SV_TYPE_LOCAL_LIST_ONLY; - - DEBUG(3,("send_host_announcement: type %x for host %s on subnet %s for workgroup %s\n", - type, servrec->serv.name, subrec->subnet_name, work->work_group)); - - send_announcement(subrec, ANN_HostAnnouncement, - servrec->serv.name, /* From nbt name. */ - work->work_group, 0x1d, /* To nbt name. */ - subrec->bcast_ip, /* To ip. */ - work->announce_interval, /* Time until next announce. */ - servrec->serv.name, /* Name to announce. */ - type, /* Type field. */ - servrec->serv.comment); + /* Ensure we don't have the prohibited bits set. */ + uint32 type = servrec->serv.type & ~SV_TYPE_LOCAL_LIST_ONLY; + + DEBUG(3,("send_host_announcement: type %x for host %s on subnet %s for workgroup %s\n", + type, servrec->serv.name, subrec->subnet_name, work->work_group)); + + send_announcement(subrec, ANN_HostAnnouncement, + servrec->serv.name, /* From nbt name. */ + work->work_group, 0x1d, /* To nbt name. */ + subrec->bcast_ip, /* To ip. */ + work->announce_interval, /* Time until next announce. */ + servrec->serv.name, /* Name to announce. */ + type, /* Type field. */ + servrec->serv.comment); } /**************************************************************************** @@ -226,20 +221,20 @@ static void send_host_announcement(struct subnet_record *subrec, struct work_rec static void send_lm_host_announcement(struct subnet_record *subrec, struct work_record *work, struct server_record *servrec, int lm_interval) { - /* Ensure we don't have the prohibited bits set. */ - uint32 type = servrec->serv.type & ~SV_TYPE_LOCAL_LIST_ONLY; - - DEBUG(3,("send_lm_host_announcement: type %x for host %s on subnet %s for workgroup %s, ttl: %d\n", - type, servrec->serv.name, subrec->subnet_name, work->work_group, lm_interval)); - - send_lm_announcement(subrec, ANN_HostAnnouncement, - servrec->serv.name, /* From nbt name. */ - work->work_group, 0x00, /* To nbt name. */ - subrec->bcast_ip, /* To ip. */ - lm_interval, /* Time until next announce. */ - servrec->serv.name, /* Name to announce. */ - type, /* Type field. */ - servrec->serv.comment); + /* Ensure we don't have the prohibited bits set. */ + uint32 type = servrec->serv.type & ~SV_TYPE_LOCAL_LIST_ONLY; + + DEBUG(3,("send_lm_host_announcement: type %x for host %s on subnet %s for workgroup %s, ttl: %d\n", + type, servrec->serv.name, subrec->subnet_name, work->work_group, lm_interval)); + + send_lm_announcement(subrec, ANN_HostAnnouncement, + servrec->serv.name, /* From nbt name. */ + work->work_group, 0x00, /* To nbt name. */ + subrec->bcast_ip, /* To ip. */ + lm_interval, /* Time until next announce. */ + servrec->serv.name, /* Name to announce (fstring not netbios name struct). */ + type, /* Type field. */ + servrec->serv.comment); } /**************************************************************************** @@ -249,18 +244,15 @@ static void send_lm_host_announcement(struct subnet_record *subrec, struct work_ static void announce_server(struct subnet_record *subrec, struct work_record *work, struct server_record *servrec) { - /* Only do domain announcements if we are a master and it's - our primary name we're being asked to announce. */ - - if (AM_LOCAL_MASTER_BROWSER(work) && strequal(global_myname(),servrec->serv.name)) - { - send_local_master_announcement(subrec, work, servrec); - send_workgroup_announcement(subrec, work); - } - else - { - send_host_announcement(subrec, work, servrec); - } + /* Only do domain announcements if we are a master and it's + our primary name we're being asked to announce. */ + + if (AM_LOCAL_MASTER_BROWSER(work) && strequal(global_myname(),servrec->serv.name)) { + send_local_master_announcement(subrec, work, servrec); + send_workgroup_announcement(subrec, work); + } else { + send_host_announcement(subrec, work, servrec); + } } /**************************************************************************** @@ -270,43 +262,39 @@ static void announce_server(struct subnet_record *subrec, struct work_record *wo void announce_my_server_names(time_t t) { - struct subnet_record *subrec; - - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - struct work_record *work = find_workgroup_on_subnet(subrec, lp_workgroup()); - - if(work) - { - struct server_record *servrec; - - if (work->needannounce) - { - /* Drop back to a max 3 minute announce. This is to prevent a - single lost packet from breaking things for too long. */ - - work->announce_interval = MIN(work->announce_interval, - CHECK_TIME_MIN_HOST_ANNCE*60); - work->lastannounce_time = t - (work->announce_interval+1); - work->needannounce = False; - } - - /* Announce every minute at first then progress to every 12 mins */ - if ((t - work->lastannounce_time) < work->announce_interval) - continue; - - if (work->announce_interval < (CHECK_TIME_MAX_HOST_ANNCE * 60)) - work->announce_interval += 60; - - work->lastannounce_time = t; - - for (servrec = work->serverlist; servrec; servrec = servrec->next) - { - if (is_myname(servrec->serv.name)) - announce_server(subrec, work, servrec); - } - } /* if work */ - } /* for subrec */ + struct subnet_record *subrec; + + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + struct work_record *work = find_workgroup_on_subnet(subrec, lp_workgroup()); + + if(work) { + struct server_record *servrec; + + if (work->needannounce) { + /* Drop back to a max 3 minute announce. This is to prevent a + single lost packet from breaking things for too long. */ + + work->announce_interval = MIN(work->announce_interval, + CHECK_TIME_MIN_HOST_ANNCE*60); + work->lastannounce_time = t - (work->announce_interval+1); + work->needannounce = False; + } + + /* Announce every minute at first then progress to every 12 mins */ + if ((t - work->lastannounce_time) < work->announce_interval) + continue; + + if (work->announce_interval < (CHECK_TIME_MAX_HOST_ANNCE * 60)) + work->announce_interval += 60; + + work->lastannounce_time = t; + + for (servrec = work->serverlist; servrec; servrec = servrec->next) { + if (is_myname(servrec->serv.name)) + announce_server(subrec, work, servrec); + } + } /* if work */ + } /* for subrec */ } /**************************************************************************** @@ -316,47 +304,42 @@ void announce_my_server_names(time_t t) void announce_my_lm_server_names(time_t t) { - struct subnet_record *subrec; - static time_t last_lm_announce_time=0; - int announce_interval = lp_lm_interval(); - int lm_announce = lp_lm_announce(); - - if ((announce_interval <= 0) || (lm_announce <= 0)) - { - /* user absolutely does not want LM announcements to be sent. */ - return; - } - - if ((lm_announce >= 2) && (!found_lm_clients)) - { - /* has been set to 2 (Auto) but no LM clients detected (yet). */ - return; - } - - /* Otherwise: must have been set to 1 (Yes), or LM clients *have* - been detected. */ - - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - struct work_record *work = find_workgroup_on_subnet(subrec, lp_workgroup()); - - if(work) - { - struct server_record *servrec; - - if (last_lm_announce_time && ((t - last_lm_announce_time) < announce_interval )) - continue; - - last_lm_announce_time = t; - - for (servrec = work->serverlist; servrec; servrec = servrec->next) - { - if (is_myname(servrec->serv.name)) - /* skipping equivalent of announce_server() */ - send_lm_host_announcement(subrec, work, servrec, announce_interval); - } - } /* if work */ - } /* for subrec */ + struct subnet_record *subrec; + static time_t last_lm_announce_time=0; + int announce_interval = lp_lm_interval(); + int lm_announce = lp_lm_announce(); + + if ((announce_interval <= 0) || (lm_announce <= 0)) { + /* user absolutely does not want LM announcements to be sent. */ + return; + } + + if ((lm_announce >= 2) && (!found_lm_clients)) { + /* has been set to 2 (Auto) but no LM clients detected (yet). */ + return; + } + + /* Otherwise: must have been set to 1 (Yes), or LM clients *have* + been detected. */ + + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + struct work_record *work = find_workgroup_on_subnet(subrec, lp_workgroup()); + + if(work) { + struct server_record *servrec; + + if (last_lm_announce_time && ((t - last_lm_announce_time) < announce_interval )) + continue; + + last_lm_announce_time = t; + + for (servrec = work->serverlist; servrec; servrec = servrec->next) { + if (is_myname(servrec->serv.name)) + /* skipping equivalent of announce_server() */ + send_lm_host_announcement(subrec, work, servrec, announce_interval); + } + } /* if work */ + } /* for subrec */ } /* Announce timer. Moved into global static so it can be reset @@ -370,7 +353,7 @@ static time_t announce_timer_last=0; void reset_announce_timer(void) { - announce_timer_last = time(NULL) - (CHECK_TIME_MST_ANNOUNCE * 60); + announce_timer_last = time(NULL) - (CHECK_TIME_MST_ANNOUNCE * 60); } /**************************************************************************** @@ -379,45 +362,40 @@ void reset_announce_timer(void) void announce_myself_to_domain_master_browser(time_t t) { - struct subnet_record *subrec; - struct work_record *work; - - if(!we_are_a_wins_client()) - { - DEBUG(10,("announce_myself_to_domain_master_browser: no unicast subnet, ignoring.\n")); - return; - } - - if (!announce_timer_last) - announce_timer_last = t; - - if ((t-announce_timer_last) < (CHECK_TIME_MST_ANNOUNCE * 60)) - { - DEBUG(10,("announce_myself_to_domain_master_browser: t (%d) - last(%d) < %d\n", - (int)t, (int)announce_timer_last, - CHECK_TIME_MST_ANNOUNCE * 60 )); - return; - } - - announce_timer_last = t; - - /* Look over all our broadcast subnets to see if any of them - has the state set as local master browser. */ - - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - for (work = subrec->workgrouplist; work; work = work->next) - { - if (AM_LOCAL_MASTER_BROWSER(work)) - { - DEBUG(4,( "announce_myself_to_domain_master_browser: I am a local master browser for \ + struct subnet_record *subrec; + struct work_record *work; + + if(!we_are_a_wins_client()) { + DEBUG(10,("announce_myself_to_domain_master_browser: no unicast subnet, ignoring.\n")); + return; + } + + if (!announce_timer_last) + announce_timer_last = t; + + if ((t-announce_timer_last) < (CHECK_TIME_MST_ANNOUNCE * 60)) { + DEBUG(10,("announce_myself_to_domain_master_browser: t (%d) - last(%d) < %d\n", + (int)t, (int)announce_timer_last, + CHECK_TIME_MST_ANNOUNCE * 60 )); + return; + } + + announce_timer_last = t; + + /* Look over all our broadcast subnets to see if any of them + has the state set as local master browser. */ + + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + for (work = subrec->workgrouplist; work; work = work->next) { + if (AM_LOCAL_MASTER_BROWSER(work)) { + DEBUG(4,( "announce_myself_to_domain_master_browser: I am a local master browser for \ workgroup %s on subnet %s\n", work->work_group, subrec->subnet_name)); - /* Look in nmbd_browsersync.c for the rest of this code. */ - announce_and_sync_with_domain_master_browser(subrec, work); - } - } - } + /* Look in nmbd_browsersync.c for the rest of this code. */ + announce_and_sync_with_domain_master_browser(subrec, work); + } + } + } } /**************************************************************************** @@ -427,49 +405,43 @@ This must *only* be called on shutdown. void announce_my_servers_removed(void) { - int announce_interval = lp_lm_interval(); - int lm_announce = lp_lm_announce(); - struct subnet_record *subrec; - - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) - { - struct work_record *work; - for (work = subrec->workgrouplist; work; work = work->next) - { - struct server_record *servrec; - - work->announce_interval = 0; - for (servrec = work->serverlist; servrec; servrec = servrec->next) - { - if (!is_myname(servrec->serv.name)) - continue; - servrec->serv.type = 0; - if(AM_LOCAL_MASTER_BROWSER(work)) - send_local_master_announcement(subrec, work, servrec); - send_host_announcement(subrec, work, servrec); - - - if ((announce_interval <= 0) || (lm_announce <= 0)) - { - /* user absolutely does not want LM announcements to be sent. */ - continue; - } - - if ((lm_announce >= 2) && (!found_lm_clients)) - { - /* has been set to 2 (Auto) but no LM clients detected (yet). */ - continue; - } - - /* - * lm announce was set or we have seen lm announcements, so do - * a lm announcement of host removed. - */ - - send_lm_host_announcement(subrec, work, servrec, 0); - } - } - } + int announce_interval = lp_lm_interval(); + int lm_announce = lp_lm_announce(); + struct subnet_record *subrec; + + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) { + struct work_record *work; + for (work = subrec->workgrouplist; work; work = work->next) { + struct server_record *servrec; + + work->announce_interval = 0; + for (servrec = work->serverlist; servrec; servrec = servrec->next) { + if (!is_myname(servrec->serv.name)) + continue; + servrec->serv.type = 0; + if(AM_LOCAL_MASTER_BROWSER(work)) + send_local_master_announcement(subrec, work, servrec); + send_host_announcement(subrec, work, servrec); + + if ((announce_interval <= 0) || (lm_announce <= 0)) { + /* user absolutely does not want LM announcements to be sent. */ + continue; + } + + if ((lm_announce >= 2) && (!found_lm_clients)) { + /* has been set to 2 (Auto) but no LM clients detected (yet). */ + continue; + } + + /* + * lm announce was set or we have seen lm announcements, so do + * a lm announcement of host removed. + */ + + send_lm_host_announcement(subrec, work, servrec, 0); + } + } + } } /**************************************************************************** @@ -480,132 +452,127 @@ void announce_my_servers_removed(void) void announce_remote(time_t t) { - char *s; - const char *ptr; - static time_t last_time = 0; - pstring s2; - struct in_addr addr; - char *comment; - int stype = lp_default_server_announce(); - - if (last_time && (t < (last_time + REMOTE_ANNOUNCE_INTERVAL))) - return; - - last_time = t; - - s = lp_remote_announce(); - if (!*s) - return; - - comment = string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH); - - for (ptr=s; next_token(&ptr,s2,NULL,sizeof(s2)); ) - { - /* The entries are of the form a.b.c.d/WORKGROUP with - WORKGROUP being optional */ - const char *wgroup; - char *pwgroup; - int i; - - pwgroup = strchr_m(s2,'/'); - if (pwgroup) - *pwgroup++ = 0; - if (!pwgroup || !*pwgroup) - wgroup = lp_workgroup(); - else - wgroup = pwgroup; - - addr = *interpret_addr2(s2); + char *s; + const char *ptr; + static time_t last_time = 0; + pstring s2; + struct in_addr addr; + char *comment; + int stype = lp_default_server_announce(); + + if (last_time && (t < (last_time + REMOTE_ANNOUNCE_INTERVAL))) + return; + + last_time = t; + + s = lp_remote_announce(); + if (!*s) + return; + + comment = string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH); + + for (ptr=s; next_token(&ptr,s2,NULL,sizeof(s2)); ) { + /* The entries are of the form a.b.c.d/WORKGROUP with + WORKGROUP being optional */ + const char *wgroup; + char *pwgroup; + int i; + + pwgroup = strchr_m(s2,'/'); + if (pwgroup) + *pwgroup++ = 0; + if (!pwgroup || !*pwgroup) + wgroup = lp_workgroup(); + else + wgroup = pwgroup; + + addr = *interpret_addr2(s2); - /* Announce all our names including aliases */ - /* Give the ip address as the address of our first - broadcast subnet. */ - - for(i=0; my_netbios_names(i); i++) - { - const char *name = my_netbios_names(i); - - DEBUG(5,("announce_remote: Doing remote announce for server %s to IP %s.\n", - name, inet_ntoa(addr) )); - - send_announcement(FIRST_SUBNET, ANN_HostAnnouncement, - name, /* From nbt name. */ - wgroup, 0x1d, /* To nbt name. */ - addr, /* To ip. */ - REMOTE_ANNOUNCE_INTERVAL, /* Time until next announce. */ - name, /* Name to announce. */ - stype, /* Type field. */ - comment); - } - } + /* Announce all our names including aliases */ + /* Give the ip address as the address of our first + broadcast subnet. */ + + for(i=0; my_netbios_names(i); i++) { + const char *name = my_netbios_names(i); + + DEBUG(5,("announce_remote: Doing remote announce for server %s to IP %s.\n", + name, inet_ntoa(addr) )); + + send_announcement(FIRST_SUBNET, ANN_HostAnnouncement, + name, /* From nbt name. */ + wgroup, 0x1d, /* To nbt name. */ + addr, /* To ip. */ + REMOTE_ANNOUNCE_INTERVAL, /* Time until next announce. */ + name, /* Name to announce. */ + stype, /* Type field. */ + comment); + } + } } /**************************************************************************** Implement the 'remote browse sync' feature Andrew added. These are used to put our browse lists into remote browse lists. - **************************************************************************/ +**************************************************************************/ void browse_sync_remote(time_t t) { - char *s; - const char *ptr; - static time_t last_time = 0; - pstring s2; - struct in_addr addr; - struct work_record *work; - pstring outbuf; - char *p; - fstring myname; + char *s; + const char *ptr; + static time_t last_time = 0; + pstring s2; + struct in_addr addr; + struct work_record *work; + pstring outbuf; + char *p; + fstring myname; - if (last_time && (t < (last_time + REMOTE_ANNOUNCE_INTERVAL))) - return; + if (last_time && (t < (last_time + REMOTE_ANNOUNCE_INTERVAL))) + return; - last_time = t; - - s = lp_remote_browse_sync(); - if (!*s) - return; - - /* - * We only do this if we are the local master browser - * for our workgroup on the firsst subnet. - */ - - if((work = find_workgroup_on_subnet(FIRST_SUBNET, lp_workgroup())) == NULL) - { - DEBUG(0,("browse_sync_remote: Cannot find workgroup %s on subnet %s\n", - lp_workgroup(), FIRST_SUBNET->subnet_name )); - return; - } + last_time = t; + + s = lp_remote_browse_sync(); + if (!*s) + return; + + /* + * We only do this if we are the local master browser + * for our workgroup on the firsst subnet. + */ + + if((work = find_workgroup_on_subnet(FIRST_SUBNET, lp_workgroup())) == NULL) { + DEBUG(0,("browse_sync_remote: Cannot find workgroup %s on subnet %s\n", + lp_workgroup(), FIRST_SUBNET->subnet_name )); + return; + } - if(!AM_LOCAL_MASTER_BROWSER(work)) - { - DEBUG(5,("browse_sync_remote: We can only do this if we are a local master browser \ + if(!AM_LOCAL_MASTER_BROWSER(work)) { + DEBUG(5,("browse_sync_remote: We can only do this if we are a local master browser \ for workgroup %s on subnet %s.\n", lp_workgroup(), FIRST_SUBNET->subnet_name )); - return; - } + return; + } - memset(outbuf,'\0',sizeof(outbuf)); - p = outbuf; - SCVAL(p,0,ANN_MasterAnnouncement); - p++; + memset(outbuf,'\0',sizeof(outbuf)); + p = outbuf; + SCVAL(p,0,ANN_MasterAnnouncement); + p++; - fstrcpy(myname, global_myname()); - strupper_m(myname); - myname[15]='\0'; - push_pstring_base(p, myname, outbuf); + fstrcpy(myname, global_myname()); + strupper_m(myname); + myname[15]='\0'; + push_pstring_base(p, myname, outbuf); - p = skip_string(p,1); + p = skip_string(p,1); - for (ptr=s; next_token(&ptr,s2,NULL,sizeof(s2)); ) - { - /* The entries are of the form a.b.c.d */ - addr = *interpret_addr2(s2); + for (ptr=s; next_token(&ptr,s2,NULL,sizeof(s2)); ) { + /* The entries are of the form a.b.c.d */ + addr = *interpret_addr2(s2); - DEBUG(5,("announce_remote: Doing remote browse sync announce for server %s to IP %s.\n", - global_myname(), inet_ntoa(addr) )); + DEBUG(5,("announce_remote: Doing remote browse sync announce for server %s to IP %s.\n", + global_myname(), inet_ntoa(addr) )); - send_mailslot(True, BROWSE_MAILSLOT, outbuf,PTR_DIFF(p,outbuf), - global_myname(), 0x0, "*", 0x0, addr, FIRST_SUBNET->myip, DGRAM_PORT); - } + send_mailslot(True, BROWSE_MAILSLOT, outbuf,PTR_DIFF(p,outbuf), + global_myname(), 0x0, "*", 0x0, addr, FIRST_SUBNET->myip, DGRAM_PORT); + } } diff --git a/source3/nmbd/nmbd_serverlistdb.c b/source3/nmbd/nmbd_serverlistdb.c index 2484a7f830..cdb1089a54 100644 --- a/source3/nmbd/nmbd_serverlistdb.c +++ b/source3/nmbd/nmbd_serverlistdb.c @@ -33,28 +33,26 @@ int updatecount = 0; void remove_all_servers(struct work_record *work) { - struct server_record *servrec; - struct server_record *nexts; + struct server_record *servrec; + struct server_record *nexts; - for (servrec = work->serverlist; servrec; servrec = nexts) - { - DEBUG(7,("remove_all_servers: Removing server %s\n",servrec->serv.name)); - nexts = servrec->next; + for (servrec = work->serverlist; servrec; servrec = nexts) { + DEBUG(7,("remove_all_servers: Removing server %s\n",servrec->serv.name)); + nexts = servrec->next; - if (servrec->prev) - servrec->prev->next = servrec->next; - if (servrec->next) - servrec->next->prev = servrec->prev; + if (servrec->prev) + servrec->prev->next = servrec->next; + if (servrec->next) + servrec->next->prev = servrec->prev; - if (work->serverlist == servrec) - work->serverlist = servrec->next; + if (work->serverlist == servrec) + work->serverlist = servrec->next; - ZERO_STRUCTP(servrec); - SAFE_FREE(servrec); + ZERO_STRUCTP(servrec); + SAFE_FREE(servrec); + } - } - - work->subnet->work_changed = True; + work->subnet->work_changed = True; } /*************************************************************************** @@ -64,23 +62,22 @@ void remove_all_servers(struct work_record *work) static void add_server_to_workgroup(struct work_record *work, struct server_record *servrec) { - struct server_record *servrec2; - - if (!work->serverlist) - { - work->serverlist = servrec; - servrec->prev = NULL; - servrec->next = NULL; - return; - } - - for (servrec2 = work->serverlist; servrec2->next; servrec2 = servrec2->next) - ; - - servrec2->next = servrec; - servrec->next = NULL; - servrec->prev = servrec2; - work->subnet->work_changed = True; + struct server_record *servrec2; + + if (!work->serverlist) { + work->serverlist = servrec; + servrec->prev = NULL; + servrec->next = NULL; + return; + } + + for (servrec2 = work->serverlist; servrec2->next; servrec2 = servrec2->next) + ; + + servrec2->next = servrec; + servrec->next = NULL; + servrec->prev = servrec2; + work->subnet->work_changed = True; } /**************************************************************************** @@ -89,14 +86,13 @@ static void add_server_to_workgroup(struct work_record *work, struct server_record *find_server_in_workgroup(struct work_record *work, const char *name) { - struct server_record *ret; + struct server_record *ret; - for (ret = work->serverlist; ret; ret = ret->next) - { - if (strequal(ret->serv.name,name)) - return ret; - } - return NULL; + for (ret = work->serverlist; ret; ret = ret->next) { + if (strequal(ret->serv.name,name)) + return ret; + } + return NULL; } @@ -106,17 +102,17 @@ struct server_record *find_server_in_workgroup(struct work_record *work, const c void remove_server_from_workgroup(struct work_record *work, struct server_record *servrec) { - if (servrec->prev) - servrec->prev->next = servrec->next; - if (servrec->next) - servrec->next->prev = servrec->prev; + if (servrec->prev) + servrec->prev->next = servrec->next; + if (servrec->next) + servrec->next->prev = servrec->prev; - if (work->serverlist == servrec) - work->serverlist = servrec->next; + if (work->serverlist == servrec) + work->serverlist = servrec->next; - ZERO_STRUCTP(servrec); - SAFE_FREE(servrec); - work->subnet->work_changed = True; + ZERO_STRUCTP(servrec); + SAFE_FREE(servrec); + work->subnet->work_changed = True; } /**************************************************************************** @@ -127,47 +123,44 @@ struct server_record *create_server_on_workgroup(struct work_record *work, const char *name,int servertype, int ttl, const char *comment) { - struct server_record *servrec; + struct server_record *servrec; - if (name[0] == '*') - { - DEBUG(7,("create_server_on_workgroup: not adding name starting with '*' (%s)\n", - name)); - return (NULL); - } + if (name[0] == '*') { + DEBUG(7,("create_server_on_workgroup: not adding name starting with '*' (%s)\n", + name)); + return (NULL); + } - if((servrec = find_server_in_workgroup(work, name)) != NULL) - { - DEBUG(0,("create_server_on_workgroup: Server %s already exists on \ + if((servrec = find_server_in_workgroup(work, name)) != NULL) { + DEBUG(0,("create_server_on_workgroup: Server %s already exists on \ workgroup %s. This is a bug.\n", name, work->work_group)); - return NULL; - } + return NULL; + } - if((servrec = (struct server_record *)malloc(sizeof(*servrec))) == NULL) - { - DEBUG(0,("create_server_entry_on_workgroup: malloc fail !\n")); - return NULL; - } + if((servrec = (struct server_record *)malloc(sizeof(*servrec))) == NULL) { + DEBUG(0,("create_server_entry_on_workgroup: malloc fail !\n")); + return NULL; + } - memset((char *)servrec,'\0',sizeof(*servrec)); + memset((char *)servrec,'\0',sizeof(*servrec)); - servrec->subnet = work->subnet; + servrec->subnet = work->subnet; - fstrcpy(servrec->serv.name,name); - fstrcpy(servrec->serv.comment,comment); - strupper_m(servrec->serv.name); - servrec->serv.type = servertype; + fstrcpy(servrec->serv.name,name); + fstrcpy(servrec->serv.comment,comment); + strupper_m(servrec->serv.name); + servrec->serv.type = servertype; - update_server_ttl(servrec, ttl); + update_server_ttl(servrec, ttl); - add_server_to_workgroup(work, servrec); + add_server_to_workgroup(work, servrec); - DEBUG(3,("create_server_on_workgroup: Created server entry %s of type %x (%s) on \ + DEBUG(3,("create_server_on_workgroup: Created server entry %s of type %x (%s) on \ workgroup %s.\n", name,servertype,comment, work->work_group)); - work->subnet->work_changed = True; + work->subnet->work_changed = True; - return(servrec); + return(servrec); } /******************************************************************* @@ -176,15 +169,15 @@ workgroup %s.\n", name,servertype,comment, work->work_group)); void update_server_ttl(struct server_record *servrec, int ttl) { - if(ttl > lp_max_ttl()) - ttl = lp_max_ttl(); + if(ttl > lp_max_ttl()) + ttl = lp_max_ttl(); - if(is_myname(servrec->serv.name)) - servrec->death_time = PERMANENT_TTL; - else - servrec->death_time = (ttl != PERMANENT_TTL) ? time(NULL)+(ttl*3) : PERMANENT_TTL; + if(is_myname(servrec->serv.name)) + servrec->death_time = PERMANENT_TTL; + else + servrec->death_time = (ttl != PERMANENT_TTL) ? time(NULL)+(ttl*3) : PERMANENT_TTL; - servrec->subnet->work_changed = True; + servrec->subnet->work_changed = True; } /******************************************************************* @@ -195,20 +188,18 @@ void update_server_ttl(struct server_record *servrec, int ttl) void expire_servers(struct work_record *work, time_t t) { - struct server_record *servrec; - struct server_record *nexts; + struct server_record *servrec; + struct server_record *nexts; - for (servrec = work->serverlist; servrec; servrec = nexts) - { - nexts = servrec->next; - - if ((servrec->death_time != PERMANENT_TTL) && ((t == -1) || (servrec->death_time < t))) - { - DEBUG(3,("expire_old_servers: Removing timed out server %s\n",servrec->serv.name)); - remove_server_from_workgroup(work, servrec); - work->subnet->work_changed = True; - } - } + for (servrec = work->serverlist; servrec; servrec = nexts) { + nexts = servrec->next; + + if ((servrec->death_time != PERMANENT_TTL) && ((t == -1) || (servrec->death_time < t))) { + DEBUG(3,("expire_old_servers: Removing timed out server %s\n",servrec->serv.name)); + remove_server_from_workgroup(work, servrec); + work->subnet->work_changed = True; + } + } } /******************************************************************* @@ -221,33 +212,30 @@ static uint32 write_this_server_name( struct subnet_record *subrec, struct work_record *work, struct server_record *servrec) { - struct subnet_record *ssub; - struct work_record *iwork; - - /* Go through all the subnets we have already seen. */ - for (ssub = FIRST_SUBNET; ssub != subrec; ssub = NEXT_SUBNET_INCLUDING_UNICAST(ssub)) - { - for(iwork = ssub->workgrouplist; iwork; iwork = iwork->next) - { - if(find_server_in_workgroup( iwork, servrec->serv.name) != NULL) - { - /* - * We have already written out this server record, don't - * do it again. This gives precedence to servers we have seen - * on the broadcast subnets over servers that may have been - * added via a sync on the unicast_subet. - * - * The correct way to do this is to have a serverlist file - * per subnet - this means changes to smbd as well. I may - * add this at a later date (JRA). - */ - - return 0; - } - } - } - - return servrec->serv.type; + struct subnet_record *ssub; + struct work_record *iwork; + + /* Go through all the subnets we have already seen. */ + for (ssub = FIRST_SUBNET; ssub != subrec; ssub = NEXT_SUBNET_INCLUDING_UNICAST(ssub)) { + for(iwork = ssub->workgrouplist; iwork; iwork = iwork->next) { + if(find_server_in_workgroup( iwork, servrec->serv.name) != NULL) { + /* + * We have already written out this server record, don't + * do it again. This gives precedence to servers we have seen + * on the broadcast subnets over servers that may have been + * added via a sync on the unicast_subet. + * + * The correct way to do this is to have a serverlist file + * per subnet - this means changes to smbd as well. I may + * add this at a later date (JRA). + */ + + return 0; + } + } + } + + return servrec->serv.type; } /******************************************************************* @@ -261,30 +249,29 @@ static uint32 write_this_server_name( struct subnet_record *subrec, static uint32 write_this_workgroup_name( struct subnet_record *subrec, struct work_record *work) { - struct subnet_record *ssub; + struct subnet_record *ssub; - if(strequal(lp_workgroup(), work->work_group)) - return 0; + if(strnequal(lp_workgroup(), work->work_group, sizeof(nstring)-1)) + return 0; - /* This is a workgroup we have seen on a broadcast subnet. All - these have the same type. */ + /* This is a workgroup we have seen on a broadcast subnet. All + these have the same type. */ - if(subrec != unicast_subnet) - return (SV_TYPE_DOMAIN_ENUM|SV_TYPE_NT|SV_TYPE_LOCAL_LIST_ONLY); + if(subrec != unicast_subnet) + return (SV_TYPE_DOMAIN_ENUM|SV_TYPE_NT|SV_TYPE_LOCAL_LIST_ONLY); - for(ssub = FIRST_SUBNET; ssub; ssub = NEXT_SUBNET_EXCLUDING_UNICAST(ssub)) - { - /* This is the unicast subnet so check if we've already written out - this subnet when we passed over the broadcast subnets. */ + for(ssub = FIRST_SUBNET; ssub; ssub = NEXT_SUBNET_EXCLUDING_UNICAST(ssub)) { + /* This is the unicast subnet so check if we've already written out + this subnet when we passed over the broadcast subnets. */ - if(find_workgroup_on_subnet( ssub, work->work_group) != NULL) - return 0; - } + if(find_workgroup_on_subnet( ssub, work->work_group) != NULL) + return 0; + } - /* All workgroups on the unicast subnet (except our own, which we - have already written out) cannot be local. */ + /* All workgroups on the unicast subnet (except our own, which we + have already written out) cannot be local. */ - return (SV_TYPE_DOMAIN_ENUM|SV_TYPE_NT); + return (SV_TYPE_DOMAIN_ENUM|SV_TYPE_NT); } /******************************************************************* @@ -306,143 +293,130 @@ void write_browse_list_entry(XFILE *fp, const char *name, uint32 rec_type, void write_browse_list(time_t t, BOOL force_write) { - struct subnet_record *subrec; - struct work_record *work; - struct server_record *servrec; - pstring fname,fnamenew; - uint32 stype; - int i; - XFILE *fp; - BOOL list_changed = force_write; - static time_t lasttime = 0; + struct subnet_record *subrec; + struct work_record *work; + struct server_record *servrec; + pstring fname,fnamenew; + uint32 stype; + int i; + XFILE *fp; + BOOL list_changed = force_write; + static time_t lasttime = 0; - /* Always dump if we're being told to by a signal. */ - if(force_write == False) - { - if (!lasttime) - lasttime = t; - if (t - lasttime < 5) - return; - } - - lasttime = t; - - dump_workgroups(force_write); + /* Always dump if we're being told to by a signal. */ + if(force_write == False) { + if (!lasttime) + lasttime = t; + if (t - lasttime < 5) + return; + } + + lasttime = t; + + dump_workgroups(force_write); - for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) - { - if(subrec->work_changed) - { - list_changed = True; - break; - } - } - - if(!list_changed) - return; - - updatecount++; + for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) { + if(subrec->work_changed) { + list_changed = True; + break; + } + } + + if(!list_changed) + return; + + updatecount++; - pstrcpy(fname,lp_lockdir()); - trim_string(fname,NULL,"/"); - pstrcat(fname,"/"); - pstrcat(fname,SERVER_LIST); - pstrcpy(fnamenew,fname); - pstrcat(fnamenew,"."); + pstrcpy(fname,lp_lockdir()); + trim_char(fname,'\0' ,'/'); + pstrcat(fname,"/"); + pstrcat(fname,SERVER_LIST); + pstrcpy(fnamenew,fname); + pstrcat(fnamenew,"."); - fp = x_fopen(fnamenew,O_WRONLY|O_CREAT|O_TRUNC, 0644); + fp = x_fopen(fnamenew,O_WRONLY|O_CREAT|O_TRUNC, 0644); - if (!fp) - { - DEBUG(0,("write_browse_list: Can't open file %s. Error was %s\n", - fnamenew,strerror(errno))); - return; - } + if (!fp) { + DEBUG(0,("write_browse_list: Can't open file %s. Error was %s\n", + fnamenew,strerror(errno))); + return; + } - /* - * Write out a record for our workgroup. Use the record from the first - * subnet. - */ - - if((work = find_workgroup_on_subnet(FIRST_SUBNET, lp_workgroup())) == NULL) - { - DEBUG(0,("write_browse_list: Fatal error - cannot find my workgroup %s\n", - lp_workgroup())); - x_fclose(fp); - return; - } - - write_browse_list_entry(fp, work->work_group, - SV_TYPE_DOMAIN_ENUM|SV_TYPE_NT|SV_TYPE_LOCAL_LIST_ONLY, - work->local_master_browser_name, work->work_group); - - /* - * We need to do something special for our own names. - * This is due to the fact that we may be a local master browser on - * one of our broadcast subnets, and a domain master on the unicast - * subnet. We iterate over the subnets and only write out the name - * once. - */ - - for (i=0; my_netbios_names(i); i++) - { - stype = 0; - for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) - { - if((work = find_workgroup_on_subnet( subrec, lp_workgroup() )) == NULL) - continue; - if((servrec = find_server_in_workgroup( work, my_netbios_names(i))) == NULL) - continue; - - stype |= servrec->serv.type; - } - - /* Output server details, plus what workgroup they're in. */ - write_browse_list_entry(fp, my_netbios_names(i), stype, - string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH), lp_workgroup()); - } + /* + * Write out a record for our workgroup. Use the record from the first + * subnet. + */ + + if((work = find_workgroup_on_subnet(FIRST_SUBNET, lp_workgroup())) == NULL) { + DEBUG(0,("write_browse_list: Fatal error - cannot find my workgroup %s\n", + lp_workgroup())); + x_fclose(fp); + return; + } + + write_browse_list_entry(fp, work->work_group, + SV_TYPE_DOMAIN_ENUM|SV_TYPE_NT|SV_TYPE_LOCAL_LIST_ONLY, + work->local_master_browser_name, work->work_group); + + /* + * We need to do something special for our own names. + * This is due to the fact that we may be a local master browser on + * one of our broadcast subnets, and a domain master on the unicast + * subnet. We iterate over the subnets and only write out the name + * once. + */ + + for (i=0; my_netbios_names(i); i++) { + stype = 0; + for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) { + if((work = find_workgroup_on_subnet( subrec, lp_workgroup() )) == NULL) + continue; + if((servrec = find_server_in_workgroup( work, my_netbios_names(i))) == NULL) + continue; + + stype |= servrec->serv.type; + } + + /* Output server details, plus what workgroup they're in. */ + write_browse_list_entry(fp, my_netbios_names(i), stype, + string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH), lp_workgroup()); + } - for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) - { - subrec->work_changed = False; - - for (work = subrec->workgrouplist; work ; work = work->next) - { - /* Write out a workgroup record for a workgroup. */ - uint32 wg_type = write_this_workgroup_name( subrec, work); - - if(wg_type) - { - write_browse_list_entry(fp, work->work_group, wg_type, - work->local_master_browser_name, - work->work_group); - } - - /* Now write out any server records a workgroup may have. */ - - for (servrec = work->serverlist; servrec ; servrec = servrec->next) - { - uint32 serv_type; - - /* We have already written our names here. */ - if(is_myname(servrec->serv.name)) - continue; - - serv_type = write_this_server_name(subrec, work, servrec); - - if(serv_type) - { - /* Output server details, plus what workgroup they're in. */ - write_browse_list_entry(fp, servrec->serv.name, serv_type, - servrec->serv.comment, work->work_group); - } - } - } - } + for (subrec = FIRST_SUBNET; subrec ; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) { + subrec->work_changed = False; + + for (work = subrec->workgrouplist; work ; work = work->next) { + /* Write out a workgroup record for a workgroup. */ + uint32 wg_type = write_this_workgroup_name( subrec, work); + + if(wg_type) { + write_browse_list_entry(fp, work->work_group, wg_type, + work->local_master_browser_name, + work->work_group); + } + + /* Now write out any server records a workgroup may have. */ + + for (servrec = work->serverlist; servrec ; servrec = servrec->next) { + uint32 serv_type; + + /* We have already written our names here. */ + if(is_myname(servrec->serv.name)) + continue; + + serv_type = write_this_server_name(subrec, work, servrec); + if(serv_type) { + /* Output server details, plus what workgroup they're in. */ + write_browse_list_entry(fp, servrec->serv.name, serv_type, + servrec->serv.comment, work->work_group); + } + } + } + } - x_fclose(fp); - unlink(fname); - chmod(fnamenew,0644); - rename(fnamenew,fname); - DEBUG(3,("write_browse_list: Wrote browse list into file %s\n",fname)); + x_fclose(fp); + unlink(fname); + chmod(fnamenew,0644); + rename(fnamenew,fname); + DEBUG(3,("write_browse_list: Wrote browse list into file %s\n",fname)); } diff --git a/source3/nmbd/nmbd_subnetdb.c b/source3/nmbd/nmbd_subnetdb.c index 6296826425..02a91f2760 100644 --- a/source3/nmbd/nmbd_subnetdb.c +++ b/source3/nmbd/nmbd_subnetdb.c @@ -63,28 +63,27 @@ static void add_subnet(struct subnet_record *subrec) * ************************************************************************** ** */ static int namelist_entry_compare( ubi_trItemPtr Item, ubi_trNodePtr Node ) - { - struct name_record *NR = (struct name_record *)Node; - - if( DEBUGLVL( 10 ) ) - { - struct nmb_name *Iname = (struct nmb_name *)Item; +{ + struct name_record *NR = (struct name_record *)Node; - Debug1( "nmbd_subnetdb:namelist_entry_compare()\n" ); - Debug1( "%d == memcmp( \"%s\", \"%s\", %d )\n", - memcmp( Item, &(NR->name), sizeof(struct nmb_name) ), - nmb_namestr(Iname), nmb_namestr(&NR->name), (int)sizeof(struct nmb_name) ); - } + if( DEBUGLVL( 10 ) ) { + struct nmb_name *Iname = (struct nmb_name *)Item; - return( memcmp( Item, &(NR->name), sizeof(struct nmb_name) ) ); - } /* namelist_entry_compare */ + Debug1( "nmbd_subnetdb:namelist_entry_compare()\n" ); + Debug1( "%d == memcmp( \"%s\", \"%s\", %d )\n", + memcmp( Item, &(NR->name), sizeof(struct nmb_name) ), + nmb_namestr(Iname), nmb_namestr(&NR->name), (int)sizeof(struct nmb_name) ); + } + return( memcmp( Item, &(NR->name), sizeof(struct nmb_name) ) ); +} /**************************************************************************** stop listening on a subnet we don't free the record as we don't have proper reference counting for it yet and it may be in use by a response record ****************************************************************************/ + void close_subnet(struct subnet_record *subrec) { DLIST_REMOVE(subnetlist, subrec); @@ -99,8 +98,6 @@ void close_subnet(struct subnet_record *subrec) } } - - /**************************************************************************** Create a subnet entry. ****************************************************************************/ @@ -109,102 +106,90 @@ static struct subnet_record *make_subnet(const char *name, enum subnet_type type struct in_addr myip, struct in_addr bcast_ip, struct in_addr mask_ip) { - struct subnet_record *subrec = NULL; - int nmb_sock, dgram_sock; - - /* Check if we are creating a non broadcast subnet - if so don't create - sockets. - */ - - if(type != NORMAL_SUBNET) - { - nmb_sock = -1; - dgram_sock = -1; - } - else - { - /* - * Attempt to open the sockets on port 137/138 for this interface - * and bind them. - * Fail the subnet creation if this fails. - */ - - if((nmb_sock = open_socket_in(SOCK_DGRAM, global_nmb_port,0, myip.s_addr,True)) == -1) - { - if( DEBUGLVL( 0 ) ) - { - Debug1( "nmbd_subnetdb:make_subnet()\n" ); - Debug1( " Failed to open nmb socket on interface %s ", inet_ntoa(myip) ); - Debug1( "for port %d. ", global_nmb_port ); - Debug1( "Error was %s\n", strerror(errno) ); - } - return NULL; - } - - if((dgram_sock = open_socket_in(SOCK_DGRAM,DGRAM_PORT,3, myip.s_addr,True)) == -1) - { - if( DEBUGLVL( 0 ) ) - { - Debug1( "nmbd_subnetdb:make_subnet()\n" ); - Debug1( " Failed to open dgram socket on interface %s ", inet_ntoa(myip) ); - Debug1( "for port %d. ", DGRAM_PORT ); - Debug1( "Error was %s\n", strerror(errno) ); - } - return NULL; - } - - /* Make sure we can broadcast from these sockets. */ - set_socket_options(nmb_sock,"SO_BROADCAST"); - set_socket_options(dgram_sock,"SO_BROADCAST"); - - } - - subrec = (struct subnet_record *)malloc(sizeof(*subrec)); - - if (!subrec) - { - DEBUG(0,("make_subnet: malloc fail !\n")); - close(nmb_sock); - close(dgram_sock); - return(NULL); - } + struct subnet_record *subrec = NULL; + int nmb_sock, dgram_sock; + + /* Check if we are creating a non broadcast subnet - if so don't create + sockets. */ + + if(type != NORMAL_SUBNET) { + nmb_sock = -1; + dgram_sock = -1; + } else { + /* + * Attempt to open the sockets on port 137/138 for this interface + * and bind them. + * Fail the subnet creation if this fails. + */ + + if((nmb_sock = open_socket_in(SOCK_DGRAM, global_nmb_port,0, myip.s_addr,True)) == -1) { + if( DEBUGLVL( 0 ) ) { + Debug1( "nmbd_subnetdb:make_subnet()\n" ); + Debug1( " Failed to open nmb socket on interface %s ", inet_ntoa(myip) ); + Debug1( "for port %d. ", global_nmb_port ); + Debug1( "Error was %s\n", strerror(errno) ); + } + return NULL; + } + + if((dgram_sock = open_socket_in(SOCK_DGRAM,DGRAM_PORT,3, myip.s_addr,True)) == -1) { + if( DEBUGLVL( 0 ) ) { + Debug1( "nmbd_subnetdb:make_subnet()\n" ); + Debug1( " Failed to open dgram socket on interface %s ", inet_ntoa(myip) ); + Debug1( "for port %d. ", DGRAM_PORT ); + Debug1( "Error was %s\n", strerror(errno) ); + } + return NULL; + } + + /* Make sure we can broadcast from these sockets. */ + set_socket_options(nmb_sock,"SO_BROADCAST"); + set_socket_options(dgram_sock,"SO_BROADCAST"); + } + + subrec = (struct subnet_record *)malloc(sizeof(*subrec)); + if (!subrec) { + DEBUG(0,("make_subnet: malloc fail !\n")); + close(nmb_sock); + close(dgram_sock); + return(NULL); + } - memset( (char *)subrec, '\0', sizeof(*subrec) ); - (void)ubi_trInitTree( subrec->namelist, - namelist_entry_compare, - ubi_trOVERWRITE ); - - if((subrec->subnet_name = strdup(name)) == NULL) - { - DEBUG(0,("make_subnet: malloc fail for subnet name !\n")); - close(nmb_sock); - close(dgram_sock); - ZERO_STRUCTP(subrec); - SAFE_FREE(subrec); - return(NULL); - } - - DEBUG(2, ("making subnet name:%s ", name )); - DEBUG(2, ("Broadcast address:%s ", inet_ntoa(bcast_ip))); - DEBUG(2, ("Subnet mask:%s\n", inet_ntoa(mask_ip))); + memset( (char *)subrec, '\0', sizeof(*subrec) ); + (void)ubi_trInitTree( subrec->namelist, + namelist_entry_compare, + ubi_trOVERWRITE ); + + if((subrec->subnet_name = strdup(name)) == NULL) { + DEBUG(0,("make_subnet: malloc fail for subnet name !\n")); + close(nmb_sock); + close(dgram_sock); + ZERO_STRUCTP(subrec); + SAFE_FREE(subrec); + return(NULL); + } + + DEBUG(2, ("making subnet name:%s ", name )); + DEBUG(2, ("Broadcast address:%s ", inet_ntoa(bcast_ip))); + DEBUG(2, ("Subnet mask:%s\n", inet_ntoa(mask_ip))); - subrec->namelist_changed = False; - subrec->work_changed = False; + subrec->namelist_changed = False; + subrec->work_changed = False; - subrec->bcast_ip = bcast_ip; - subrec->mask_ip = mask_ip; - subrec->myip = myip; - subrec->type = type; - subrec->nmb_sock = nmb_sock; - subrec->dgram_sock = dgram_sock; + subrec->bcast_ip = bcast_ip; + subrec->mask_ip = mask_ip; + subrec->myip = myip; + subrec->type = type; + subrec->nmb_sock = nmb_sock; + subrec->dgram_sock = dgram_sock; - return subrec; + return subrec; } - /**************************************************************************** Create a normal subnet **************************************************************************/ + struct subnet_record *make_normal_subnet(struct interface *iface) { struct subnet_record *subrec; @@ -217,100 +202,99 @@ struct subnet_record *make_normal_subnet(struct interface *iface) return subrec; } - /**************************************************************************** Create subnet entries. **************************************************************************/ BOOL create_subnets(void) { - int num_interfaces = iface_count(); - int i; - struct in_addr unicast_ip, ipzero; - extern struct in_addr loopback_ip; - - if(num_interfaces == 0) { - DEBUG(0,("create_subnets: No local interfaces !\n")); - DEBUG(0,("create_subnets: Waiting for an interface to appear ...\n")); - while (iface_count() == 0) { - sleep(5); - load_interfaces(); - } - } - - num_interfaces = iface_count(); - - /* - * Create subnets from all the local interfaces and thread them onto - * the linked list. - */ - - for (i = 0 ; i < num_interfaces; i++) - { - struct interface *iface = get_interface(i); - - /* - * We don't want to add a loopback interface, in case - * someone has added 127.0.0.1 for smbd, nmbd needs to - * ignore it here. JRA. - */ - - if (ip_equal(iface->ip, loopback_ip)) { - DEBUG(2,("create_subnets: Ignoring loopback interface.\n" )); - continue; - } - - if (!make_normal_subnet(iface)) return False; - } - - if (lp_we_are_a_wins_server()) { - /* Pick the first interface ip address as the WINS server ip. */ - unicast_ip = *iface_n_ip(0); - } else { - /* note that we do not set the wins server IP here. We just - set it at zero and let the wins registration code cope - with getting the IPs right for each packet */ - zero_ip(&unicast_ip); - } - - /* - * Create the unicast and remote broadcast subnets. - * Don't put these onto the linked list. - * The ip address of the unicast subnet is set to be - * the WINS server address, if it exists, or ipzero if not. - */ - - unicast_subnet = make_subnet( "UNICAST_SUBNET", UNICAST_SUBNET, - unicast_ip, unicast_ip, unicast_ip); - - zero_ip(&ipzero); - - remote_broadcast_subnet = make_subnet( "REMOTE_BROADCAST_SUBNET", - REMOTE_BROADCAST_SUBNET, - ipzero, ipzero, ipzero); - - if((unicast_subnet == NULL) || (remote_broadcast_subnet == NULL)) - return False; - - /* - * If we are WINS server, create the WINS_SERVER_SUBNET - don't put on - * the linked list. - */ - - if (lp_we_are_a_wins_server()) - { - if( (wins_server_subnet = make_subnet( "WINS_SERVER_SUBNET", - WINS_SERVER_SUBNET, - ipzero, ipzero, ipzero )) == NULL ) - return False; - } - - return True; + int num_interfaces = iface_count(); + int i; + struct in_addr unicast_ip, ipzero; + extern struct in_addr loopback_ip; + + if(num_interfaces == 0) { + DEBUG(0,("create_subnets: No local interfaces !\n")); + DEBUG(0,("create_subnets: Waiting for an interface to appear ...\n")); + while (iface_count() == 0) { + sleep(5); + load_interfaces(); + } + } + + num_interfaces = iface_count(); + + /* + * Create subnets from all the local interfaces and thread them onto + * the linked list. + */ + + for (i = 0 ; i < num_interfaces; i++) { + struct interface *iface = get_interface(i); + + /* + * We don't want to add a loopback interface, in case + * someone has added 127.0.0.1 for smbd, nmbd needs to + * ignore it here. JRA. + */ + + if (ip_equal(iface->ip, loopback_ip)) { + DEBUG(2,("create_subnets: Ignoring loopback interface.\n" )); + continue; + } + + if (!make_normal_subnet(iface)) + return False; + } + + if (lp_we_are_a_wins_server()) { + /* Pick the first interface ip address as the WINS server ip. */ + unicast_ip = *iface_n_ip(0); + } else { + /* note that we do not set the wins server IP here. We just + set it at zero and let the wins registration code cope + with getting the IPs right for each packet */ + zero_ip(&unicast_ip); + } + + /* + * Create the unicast and remote broadcast subnets. + * Don't put these onto the linked list. + * The ip address of the unicast subnet is set to be + * the WINS server address, if it exists, or ipzero if not. + */ + + unicast_subnet = make_subnet( "UNICAST_SUBNET", UNICAST_SUBNET, + unicast_ip, unicast_ip, unicast_ip); + + zero_ip(&ipzero); + + remote_broadcast_subnet = make_subnet( "REMOTE_BROADCAST_SUBNET", + REMOTE_BROADCAST_SUBNET, + ipzero, ipzero, ipzero); + + if((unicast_subnet == NULL) || (remote_broadcast_subnet == NULL)) + return False; + + /* + * If we are WINS server, create the WINS_SERVER_SUBNET - don't put on + * the linked list. + */ + + if (lp_we_are_a_wins_server()) { + if( (wins_server_subnet = make_subnet( "WINS_SERVER_SUBNET", + WINS_SERVER_SUBNET, + ipzero, ipzero, ipzero )) == NULL ) + return False; + } + + return True; } /******************************************************************* Function to tell us if we can use the unicast subnet. ******************************************************************/ + BOOL we_are_a_wins_client(void) { if (wins_srv_count() > 0) { @@ -326,12 +310,12 @@ Access function used by NEXT_SUBNET_INCLUDING_UNICAST struct subnet_record *get_next_subnet_maybe_unicast(struct subnet_record *subrec) { - if(subrec == unicast_subnet) - return NULL; - else if((subrec->next == NULL) && we_are_a_wins_client()) - return unicast_subnet; - else - return subrec->next; + if(subrec == unicast_subnet) + return NULL; + else if((subrec->next == NULL) && we_are_a_wins_client()) + return unicast_subnet; + else + return subrec->next; } /******************************************************************* @@ -343,19 +327,18 @@ struct subnet_record *get_next_subnet_maybe_unicast(struct subnet_record *subrec struct subnet_record *get_next_subnet_maybe_unicast_or_wins_server(struct subnet_record *subrec) { - if(subrec == unicast_subnet) - { - if(wins_server_subnet) - return wins_server_subnet; - else - return NULL; - } - - if(wins_server_subnet && subrec == wins_server_subnet) - return NULL; - - if((subrec->next == NULL) && we_are_a_wins_client()) - return unicast_subnet; - else - return subrec->next; + if(subrec == unicast_subnet) { + if(wins_server_subnet) + return wins_server_subnet; + else + return NULL; + } + + if(wins_server_subnet && subrec == wins_server_subnet) + return NULL; + + if((subrec->next == NULL) && we_are_a_wins_client()) + return unicast_subnet; + else + return subrec->next; } diff --git a/source3/nmbd/nmbd_synclists.c b/source3/nmbd/nmbd_synclists.c index b9952fb446..6a0576a5a4 100644 --- a/source3/nmbd/nmbd_synclists.c +++ b/source3/nmbd/nmbd_synclists.c @@ -31,8 +31,8 @@ struct sync_record { struct sync_record *next, *prev; - fstring workgroup; - fstring server; + nstring workgroup; + nstring server; pstring fname; struct in_addr ip; pid_t pid; @@ -47,6 +47,7 @@ static XFILE *fp; This is the NetServerEnum callback. Note sname and comment are in UNIX codepage format. ******************************************************************/ + static void callback(const char *sname, uint32 stype, const char *comment, void *state) { @@ -58,6 +59,7 @@ static void callback(const char *sname, uint32 stype, Log in on the remote server's SMB port to their IPC$ service, do a NetServerEnum and record the results in fname ******************************************************************/ + static void sync_child(char *name, int nm_type, char *workgroup, struct in_addr ip, BOOL local, BOOL servers, @@ -78,10 +80,9 @@ static void sync_child(char *name, int nm_type, } make_nmb_name(&calling, local_machine, 0x0); - make_nmb_name(&called , name , nm_type); + make_nmb_name(&called , name, nm_type); - if (!cli_session_request(&cli, &calling, &called)) - { + if (!cli_session_request(&cli, &calling, &called)) { cli_shutdown(&cli); return; } @@ -120,12 +121,12 @@ static void sync_child(char *name, int nm_type, cli_shutdown(&cli); } - /******************************************************************* initialise a browse sync with another browse server. Log in on the remote server's SMB port to their IPC$ service, do a NetServerEnum and record the results ******************************************************************/ + void sync_browse_lists(struct work_record *work, char *name, int nm_type, struct in_addr ip, BOOL local, BOOL servers) @@ -147,8 +148,8 @@ done: ZERO_STRUCTP(s); - fstrcpy(s->workgroup, work->work_group); - fstrcpy(s->server, name); + nstrcpy(s->workgroup, work->work_group); + nstrcpy(s->server, name); s->ip = ip; slprintf(s->fname, sizeof(pstring)-1, @@ -182,8 +183,9 @@ done: } /********************************************************************** -handle one line from a completed sync file + Handle one line from a completed sync file. **********************************************************************/ + static void complete_one(struct sync_record *s, char *sname, uint32 stype, char *comment) { @@ -204,8 +206,7 @@ static void complete_one(struct sync_record *s, sname, lp_max_ttl()); if (work) { /* remember who the master is */ - fstrcpy(work->local_master_browser_name, - comment); + nstrcpy(work->local_master_browser_name, comment); } } return; @@ -235,10 +236,10 @@ static void complete_one(struct sync_record *s, create_server_on_workgroup(work, sname,stype, lp_max_ttl(), comment); } - /********************************************************************** -read the completed sync info - **********************************************************************/ + Read the completed sync info. +**********************************************************************/ + static void complete_sync(struct sync_record *s) { XFILE *f; @@ -251,11 +252,13 @@ static void complete_sync(struct sync_record *s) f = x_fopen(s->fname,O_RDONLY, 0); - if (!f) return; + if (!f) + return; while (!x_feof(f)) { - if (!fgets_slash(line,sizeof(pstring),f)) continue; + if (!fgets_slash(line,sizeof(pstring),f)) + continue; ptr = line; @@ -281,8 +284,9 @@ static void complete_sync(struct sync_record *s) } /********************************************************************** -check for completion of any of the child processes - **********************************************************************/ + Check for completion of any of the child processes. +**********************************************************************/ + void sync_check_completion(void) { struct sync_record *s, *next; diff --git a/source3/nmbd/nmbd_winsproxy.c b/source3/nmbd/nmbd_winsproxy.c index 2e65ebb612..bace112752 100644 --- a/source3/nmbd/nmbd_winsproxy.c +++ b/source3/nmbd/nmbd_winsproxy.c @@ -30,92 +30,85 @@ static void wins_proxy_name_query_request_success( struct subnet_record *subrec, struct userdata_struct *userdata, struct nmb_name *nmbname, struct in_addr ip, struct res_rec *rrec) { - struct packet_struct *original_packet; - struct subnet_record *orig_broadcast_subnet; - struct name_record *namerec; - uint16 nb_flags; - int num_ips; - int i; - int ttl = 3600; /* By default one hour in the cache. */ - struct in_addr *iplist; - - /* Extract the original packet and the original broadcast subnet from - the userdata. */ - - memcpy( (char *)&orig_broadcast_subnet, userdata->data, sizeof(struct subnet_record *) ); - memcpy( (char *)&original_packet, &userdata->data[sizeof(struct subnet_record *)], - sizeof(struct packet_struct *) ); - - nb_flags = get_nb_flags( rrec->rdata ); - - num_ips = rrec->rdlength / 6; - if(num_ips == 0) - { - DEBUG(0,("wins_proxy_name_query_request_success: Invalid number of IP records (0) \ + nstring name; + struct packet_struct *original_packet; + struct subnet_record *orig_broadcast_subnet; + struct name_record *namerec; + uint16 nb_flags; + int num_ips; + int i; + int ttl = 3600; /* By default one hour in the cache. */ + struct in_addr *iplist; + + /* Extract the original packet and the original broadcast subnet from + the userdata. */ + + memcpy( (char *)&orig_broadcast_subnet, userdata->data, sizeof(struct subnet_record *) ); + memcpy( (char *)&original_packet, &userdata->data[sizeof(struct subnet_record *)], + sizeof(struct packet_struct *) ); + + nb_flags = get_nb_flags( rrec->rdata ); + + num_ips = rrec->rdlength / 6; + if(num_ips == 0) { + DEBUG(0,("wins_proxy_name_query_request_success: Invalid number of IP records (0) \ returned for name %s.\n", nmb_namestr(nmbname) )); - return; - } - - if(num_ips == 1) - iplist = &ip; - else - { - if((iplist = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr) )) == NULL) - { - DEBUG(0,("wins_proxy_name_query_request_success: malloc fail !\n")); - return; - } - - for(i = 0; i < num_ips; i++) - putip( (char *)&iplist[i], (char *)&rrec->rdata[ (i*6) + 2]); - } - - /* Add the queried name to the original subnet as a WINS_PROXY_NAME. */ - - if(rrec == PERMANENT_TTL) - ttl = lp_max_ttl(); - - namerec = add_name_to_subnet( orig_broadcast_subnet, nmbname->name, - nmbname->name_type, nb_flags, ttl, - WINS_PROXY_NAME, num_ips, iplist ); - - if(iplist != &ip) - SAFE_FREE(iplist); - - /* - * Check that none of the IP addresses we are returning is on the - * same broadcast subnet as the original requesting packet. If it - * is then don't reply (although we still need to add the name - * to the cache) as the actual machine will be replying also - * and we don't want two replies to a broadcast query. - */ - - if(namerec && original_packet->packet.nmb.header.nm_flags.bcast) - { - for( i = 0; i < namerec->data.num_ips; i++) - { - if( same_net( namerec->data.ip[i], - orig_broadcast_subnet->myip, - orig_broadcast_subnet->mask_ip ) ) - { - DEBUG( 5, ( "wins_proxy_name_query_request_success: name %s is a WINS \ + return; + } + + if(num_ips == 1) { + iplist = &ip; + } else { + if((iplist = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr) )) == NULL) { + DEBUG(0,("wins_proxy_name_query_request_success: malloc fail !\n")); + return; + } + + for(i = 0; i < num_ips; i++) + putip( (char *)&iplist[i], (char *)&rrec->rdata[ (i*6) + 2]); + } + + /* Add the queried name to the original subnet as a WINS_PROXY_NAME. */ + + if(rrec == PERMANENT_TTL) + ttl = lp_max_ttl(); + + pull_ascii_nstring(name, nmbname->name); + namerec = add_name_to_subnet( orig_broadcast_subnet, name, + nmbname->name_type, nb_flags, ttl, + WINS_PROXY_NAME, num_ips, iplist ); + + if(iplist != &ip) + SAFE_FREE(iplist); + + /* + * Check that none of the IP addresses we are returning is on the + * same broadcast subnet as the original requesting packet. If it + * is then don't reply (although we still need to add the name + * to the cache) as the actual machine will be replying also + * and we don't want two replies to a broadcast query. + */ + + if(namerec && original_packet->packet.nmb.header.nm_flags.bcast) { + for( i = 0; i < namerec->data.num_ips; i++) { + if( same_net( namerec->data.ip[i], orig_broadcast_subnet->myip, + orig_broadcast_subnet->mask_ip ) ) { + DEBUG( 5, ( "wins_proxy_name_query_request_success: name %s is a WINS \ proxy name and is also on the same subnet (%s) as the requestor. \ -Not replying.\n", - nmb_namestr(&namerec->name), - orig_broadcast_subnet->subnet_name ) ); - return; - } - } - } - - /* Finally reply to the original name query. */ - reply_netbios_packet(original_packet, /* Packet to reply to. */ - 0, /* Result code. */ - NMB_QUERY, /* nmbd type code. */ - NMB_NAME_QUERY_OPCODE, /* opcode. */ - ttl, /* ttl. */ - rrec->rdata, /* data to send. */ - rrec->rdlength); /* data length. */ +Not replying.\n", nmb_namestr(&namerec->name), orig_broadcast_subnet->subnet_name ) ); + return; + } + } + } + + /* Finally reply to the original name query. */ + reply_netbios_packet(original_packet, /* Packet to reply to. */ + 0, /* Result code. */ + NMB_QUERY, /* nmbd type code. */ + NMB_NAME_QUERY_OPCODE, /* opcode. */ + ttl, /* ttl. */ + rrec->rdata, /* data to send. */ + rrec->rdlength); /* data length. */ } /**************************************************************************** @@ -126,7 +119,7 @@ static void wins_proxy_name_query_request_fail(struct subnet_record *subrec, struct response_record *rrec, struct nmb_name *question_name, int fail_code) { - DEBUG(4,("wins_proxy_name_query_request_fail: WINS server returned error code %d for lookup \ + DEBUG(4,("wins_proxy_name_query_request_fail: WINS server returned error code %d for lookup \ of name %s.\n", fail_code, nmb_namestr(question_name) )); } @@ -137,38 +130,35 @@ proxy query returns. static struct userdata_struct *wins_proxy_userdata_copy_fn(struct userdata_struct *userdata) { - struct packet_struct *p, *copy_of_p; - struct userdata_struct *new_userdata = - (struct userdata_struct *)malloc( userdata->userdata_len ); + struct packet_struct *p, *copy_of_p; + struct userdata_struct *new_userdata = (struct userdata_struct *)malloc( userdata->userdata_len ); - if(new_userdata == NULL) - return NULL; + if(new_userdata == NULL) + return NULL; - new_userdata->copy_fn = userdata->copy_fn; - new_userdata->free_fn = userdata->free_fn; - new_userdata->userdata_len = userdata->userdata_len; + new_userdata->copy_fn = userdata->copy_fn; + new_userdata->free_fn = userdata->free_fn; + new_userdata->userdata_len = userdata->userdata_len; - /* Copy the subnet_record pointer. */ - memcpy( new_userdata->data, userdata->data, sizeof(struct subnet_record *) ); + /* Copy the subnet_record pointer. */ + memcpy( new_userdata->data, userdata->data, sizeof(struct subnet_record *) ); - /* Extract the pointer to the packet struct */ - memcpy((char *)&p, &userdata->data[sizeof(struct subnet_record *)], - sizeof(struct packet_struct *) ); + /* Extract the pointer to the packet struct */ + memcpy((char *)&p, &userdata->data[sizeof(struct subnet_record *)], sizeof(struct packet_struct *) ); - /* Do a deep copy of the packet. */ - if((copy_of_p = copy_packet(p)) == NULL) - { - SAFE_FREE(new_userdata); - return NULL; - } + /* Do a deep copy of the packet. */ + if((copy_of_p = copy_packet(p)) == NULL) { + SAFE_FREE(new_userdata); + return NULL; + } - /* Lock the copy. */ - copy_of_p->locked = True; + /* Lock the copy. */ + copy_of_p->locked = True; - memcpy( &new_userdata->data[sizeof(struct subnet_record *)], (char *)©_of_p, - sizeof(struct packet_struct *) ); + memcpy( &new_userdata->data[sizeof(struct subnet_record *)], (char *)©_of_p, + sizeof(struct packet_struct *) ); - return new_userdata; + return new_userdata; } /**************************************************************************** @@ -178,18 +168,18 @@ proxy query returned. static void wins_proxy_userdata_free_fn(struct userdata_struct *userdata) { - struct packet_struct *p; + struct packet_struct *p; - /* Extract the pointer to the packet struct */ - memcpy((char *)&p, &userdata->data[sizeof(struct subnet_record *)], - sizeof(struct packet_struct *)); + /* Extract the pointer to the packet struct */ + memcpy((char *)&p, &userdata->data[sizeof(struct subnet_record *)], + sizeof(struct packet_struct *)); - /* Unlock the packet. */ - p->locked = False; + /* Unlock the packet. */ + p->locked = False; - free_packet(p); - ZERO_STRUCTP(userdata); - SAFE_FREE(userdata); + free_packet(p); + ZERO_STRUCTP(userdata); + SAFE_FREE(userdata); } /**************************************************************************** @@ -200,22 +190,24 @@ void make_wins_proxy_name_query_request( struct subnet_record *subrec, struct packet_struct *incoming_packet, struct nmb_name *question_name) { - long *ud[(sizeof(struct userdata_struct) + sizeof(struct subrec *) + - sizeof(struct packet_struct *))/sizeof(long *) + 1]; - struct userdata_struct *userdata = (struct userdata_struct *)ud; + long *ud[(sizeof(struct userdata_struct) + sizeof(struct subrec *) + + sizeof(struct packet_struct *))/sizeof(long *) + 1]; + struct userdata_struct *userdata = (struct userdata_struct *)ud; + nstring qname; - memset(ud, '\0', sizeof(ud)); + memset(ud, '\0', sizeof(ud)); - userdata->copy_fn = wins_proxy_userdata_copy_fn; - userdata->free_fn = wins_proxy_userdata_free_fn; - userdata->userdata_len = sizeof(ud); - memcpy( userdata->data, (char *)&subrec, sizeof(struct subnet_record *)); - memcpy( &userdata->data[sizeof(struct subnet_record *)], (char *)&incoming_packet, - sizeof(struct packet_struct *)); - - /* Now use the unicast subnet to query the name with the WINS server. */ - query_name( unicast_subnet, question_name->name, question_name->name_type, - wins_proxy_name_query_request_success, - wins_proxy_name_query_request_fail, - userdata); + userdata->copy_fn = wins_proxy_userdata_copy_fn; + userdata->free_fn = wins_proxy_userdata_free_fn; + userdata->userdata_len = sizeof(ud); + memcpy( userdata->data, (char *)&subrec, sizeof(struct subnet_record *)); + memcpy( &userdata->data[sizeof(struct subnet_record *)], (char *)&incoming_packet, + sizeof(struct packet_struct *)); + + /* Now use the unicast subnet to query the name with the WINS server. */ + pull_ascii_nstring(qname, question_name->name); + query_name( unicast_subnet, qname, question_name->name_type, + wins_proxy_name_query_request_success, + wins_proxy_name_query_request_fail, + userdata); } diff --git a/source3/nmbd/nmbd_winsserver.c b/source3/nmbd/nmbd_winsserver.c index eafff03b76..484588c662 100644 --- a/source3/nmbd/nmbd_winsserver.c +++ b/source3/nmbd/nmbd_winsserver.c @@ -2,7 +2,7 @@ Unix SMB/CIFS implementation. NBT netbios routines and daemon - version 2 - Copyright (C) Jeremy Allison 1994-1998 + Copyright (C) Jeremy Allison 1994-2003 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -26,8 +26,9 @@ #define WINS_VERSION 1 /**************************************************************************** -change the wins owner address in the record. + Change the wins owner address in the record. *****************************************************************************/ + static void update_wins_owner(struct name_record *namerec, struct in_addr wins_ip) { if (namerec==NULL) @@ -36,8 +37,9 @@ static void update_wins_owner(struct name_record *namerec, struct in_addr wins_i } /**************************************************************************** -create the wins flags based on the nb flags and the input value. + Create the wins flags based on the nb flags and the input value. *****************************************************************************/ + static void update_wins_flag(struct name_record *namerec, int flags) { if (namerec==NULL) @@ -74,12 +76,12 @@ static void update_wins_flag(struct name_record *namerec, int flags) DEBUG(8,("update_wins_flag: nbflags: 0x%x, ttl: 0x%d, flags: 0x%x, winsflags: 0x%x\n", namerec->data.nb_flags, (int)namerec->data.death_time, flags, namerec->data.wins_flags)); - } /**************************************************************************** -return the general ID value and increase it if requested + Return the general ID value and increase it if requested. *****************************************************************************/ + static void get_global_id_and_update(SMB_BIG_UINT *current_id, BOOL update) { /* @@ -98,8 +100,9 @@ static void get_global_id_and_update(SMB_BIG_UINT *current_id, BOOL update) } /**************************************************************************** -possibly call the WINS hook external program when a WINS change is made + Possibly call the WINS hook external program when a WINS change is made. *****************************************************************************/ + static void wins_hook(const char *operation, struct name_record *namerec, int ttl) { pstring command; @@ -120,7 +123,7 @@ static void wins_hook(const char *operation, struct name_record *namerec, int tt p += slprintf(p, sizeof(command)-1, "%s %s %s %02x %d", cmd, operation, - namerec->name.name, + nmb_namestr(&namerec->name), namerec->name.name_type, ttl); @@ -139,63 +142,58 @@ Determine if this packet should be allocated to the WINS server. BOOL packet_is_for_wins_server(struct packet_struct *packet) { - struct nmb_packet *nmb = &packet->packet.nmb; - - /* Only unicast packets go to a WINS server. */ - if((wins_server_subnet == NULL) || (nmb->header.nm_flags.bcast == True)) - { - DEBUG(10, ("packet_is_for_wins_server: failing WINS test #1.\n")); - return False; - } - - /* Check for node status requests. */ - if (nmb->question.question_type != QUESTION_TYPE_NB_QUERY) - return False; - - switch(nmb->header.opcode) - { - /* - * A WINS server issues WACKS, not receives them. - */ - case NMB_WACK_OPCODE: - DEBUG(10, ("packet_is_for_wins_server: failing WINS test #2 (WACK).\n")); - return False; - /* - * A WINS server only processes registration and - * release requests, not responses. - */ - case NMB_NAME_REG_OPCODE: - case NMB_NAME_MULTIHOMED_REG_OPCODE: - case NMB_NAME_REFRESH_OPCODE_8: /* ambiguity in rfc1002 about which is correct. */ - case NMB_NAME_REFRESH_OPCODE_9: /* WinNT uses 8 by default. */ - if(nmb->header.response) - { - DEBUG(10, ("packet_is_for_wins_server: failing WINS test #3 (response = 1).\n")); - return False; - } - break; - - case NMB_NAME_RELEASE_OPCODE: - if(nmb->header.response) - { - DEBUG(10, ("packet_is_for_wins_server: failing WINS test #4 (response = 1).\n")); - return False; - } - break; - - /* - * Only process unicast name queries with rd = 1. - */ - case NMB_NAME_QUERY_OPCODE: - if(!nmb->header.response && !nmb->header.nm_flags.recursion_desired) - { - DEBUG(10, ("packet_is_for_wins_server: failing WINS test #5 (response = 1).\n")); - return False; - } - break; - } - - return True; + struct nmb_packet *nmb = &packet->packet.nmb; + + /* Only unicast packets go to a WINS server. */ + if((wins_server_subnet == NULL) || (nmb->header.nm_flags.bcast == True)) { + DEBUG(10, ("packet_is_for_wins_server: failing WINS test #1.\n")); + return False; + } + + /* Check for node status requests. */ + if (nmb->question.question_type != QUESTION_TYPE_NB_QUERY) + return False; + + switch(nmb->header.opcode) { + /* + * A WINS server issues WACKS, not receives them. + */ + case NMB_WACK_OPCODE: + DEBUG(10, ("packet_is_for_wins_server: failing WINS test #2 (WACK).\n")); + return False; + /* + * A WINS server only processes registration and + * release requests, not responses. + */ + case NMB_NAME_REG_OPCODE: + case NMB_NAME_MULTIHOMED_REG_OPCODE: + case NMB_NAME_REFRESH_OPCODE_8: /* ambiguity in rfc1002 about which is correct. */ + case NMB_NAME_REFRESH_OPCODE_9: /* WinNT uses 8 by default. */ + if(nmb->header.response) { + DEBUG(10, ("packet_is_for_wins_server: failing WINS test #3 (response = 1).\n")); + return False; + } + break; + + case NMB_NAME_RELEASE_OPCODE: + if(nmb->header.response) { + DEBUG(10, ("packet_is_for_wins_server: failing WINS test #4 (response = 1).\n")); + return False; + } + break; + + /* + * Only process unicast name queries with rd = 1. + */ + case NMB_NAME_QUERY_OPCODE: + if(!nmb->header.response && !nmb->header.nm_flags.recursion_desired) { + DEBUG(10, ("packet_is_for_wins_server: failing WINS test #5 (response = 1).\n")); + return False; + } + break; + } + + return True; } /**************************************************************************** @@ -204,15 +202,15 @@ Utility function to decide what ttl to give a register/refresh request. static int get_ttl_from_packet(struct nmb_packet *nmb) { - int ttl = nmb->additional->ttl; + int ttl = nmb->additional->ttl; - if(ttl < lp_min_wins_ttl() ) - ttl = lp_min_wins_ttl(); + if(ttl < lp_min_wins_ttl() ) + ttl = lp_min_wins_ttl(); - if(ttl > lp_max_wins_ttl() ) - ttl = lp_max_wins_ttl(); + if(ttl > lp_max_wins_ttl() ) + ttl = lp_max_wins_ttl(); - return ttl; + return ttl; } /**************************************************************************** @@ -221,177 +219,160 @@ Load or create the WINS database. BOOL initialise_wins(void) { - time_t time_now = time(NULL); - XFILE *fp; - pstring line; - - if(!lp_we_are_a_wins_server()) - return True; - - add_samba_names_to_subnet(wins_server_subnet); - - if((fp = x_fopen(lock_path(WINS_LIST),O_RDONLY,0)) == NULL) - { - DEBUG(2,("initialise_wins: Can't open wins database file %s. Error was %s\n", - WINS_LIST, strerror(errno) )); - return True; - } - - while (!x_feof(fp)) - { - pstring name_str, ip_str, ttl_str, nb_flags_str; - unsigned int num_ips; - pstring name; - struct in_addr *ip_list; - int type = 0; - int nb_flags; - int ttl; - const char *ptr; - char *p; - BOOL got_token; - BOOL was_ip; - int i; - unsigned hash; - int version; - - /* Read a line from the wins.dat file. Strips whitespace - from the beginning and end of the line. - */ - if (!fgets_slash(line,sizeof(pstring),fp)) - continue; + time_t time_now = time(NULL); + XFILE *fp; + pstring line; + + if(!lp_we_are_a_wins_server()) + return True; + + add_samba_names_to_subnet(wins_server_subnet); + + if((fp = x_fopen(lock_path(WINS_LIST),O_RDONLY,0)) == NULL) { + DEBUG(2,("initialise_wins: Can't open wins database file %s. Error was %s\n", + WINS_LIST, strerror(errno) )); + return True; + } + + while (!x_feof(fp)) { + pstring name_str, ip_str, ttl_str, nb_flags_str; + unsigned int num_ips; + pstring name; + struct in_addr *ip_list; + int type = 0; + int nb_flags; + int ttl; + const char *ptr; + char *p; + BOOL got_token; + BOOL was_ip; + int i; + unsigned int hash; + int version; + + /* Read a line from the wins.dat file. Strips whitespace + from the beginning and end of the line. */ + if (!fgets_slash(line,sizeof(pstring),fp)) + continue; - if (*line == '#') - continue; - - if (strncmp(line,"VERSION ", 8) == 0) { - if (sscanf(line,"VERSION %d %u", &version, &hash) != 2 || - version != WINS_VERSION) { - DEBUG(0,("Discarding invalid wins.dat file [%s]\n",line)); - x_fclose(fp); - return True; - } - continue; - } - - ptr = line; - - /* - * Now we handle multiple IP addresses per name we need - * to iterate over the line twice. The first time to - * determine how many IP addresses there are, the second - * time to actually parse them into the ip_list array. - */ - - if (!next_token(&ptr,name_str,NULL,sizeof(name_str))) - { - DEBUG(0,("initialise_wins: Failed to parse name when parsing line %s\n", line )); - continue; - } - - if (!next_token(&ptr,ttl_str,NULL,sizeof(ttl_str))) - { - DEBUG(0,("initialise_wins: Failed to parse time to live when parsing line %s\n", line )); - continue; - } - - /* - * Determine the number of IP addresses per line. - */ - num_ips = 0; - do - { - got_token = next_token(&ptr,ip_str,NULL,sizeof(ip_str)); - was_ip = False; - - if(got_token && strchr(ip_str, '.')) - { - num_ips++; - was_ip = True; - } - } while( got_token && was_ip); - - if(num_ips == 0) - { - DEBUG(0,("initialise_wins: Missing IP address when parsing line %s\n", line )); - continue; - } - - if(!got_token) - { - DEBUG(0,("initialise_wins: Missing nb_flags when parsing line %s\n", line )); - continue; - } - - /* Allocate the space for the ip_list. */ - if((ip_list = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr))) == NULL) - { - DEBUG(0,("initialise_wins: Malloc fail !\n")); - return False; - } + if (*line == '#') + continue; + + if (strncmp(line,"VERSION ", 8) == 0) { + if (sscanf(line,"VERSION %d %u", &version, &hash) != 2 || + version != WINS_VERSION) { + DEBUG(0,("Discarding invalid wins.dat file [%s]\n",line)); + x_fclose(fp); + return True; + } + continue; + } + + ptr = line; + + /* + * Now we handle multiple IP addresses per name we need + * to iterate over the line twice. The first time to + * determine how many IP addresses there are, the second + * time to actually parse them into the ip_list array. + */ + + if (!next_token(&ptr,name_str,NULL,sizeof(name_str))) { + DEBUG(0,("initialise_wins: Failed to parse name when parsing line %s\n", line )); + continue; + } + + if (!next_token(&ptr,ttl_str,NULL,sizeof(ttl_str))) { + DEBUG(0,("initialise_wins: Failed to parse time to live when parsing line %s\n", line )); + continue; + } + + /* + * Determine the number of IP addresses per line. + */ + num_ips = 0; + do { + got_token = next_token(&ptr,ip_str,NULL,sizeof(ip_str)); + was_ip = False; + + if(got_token && strchr(ip_str, '.')) { + num_ips++; + was_ip = True; + } + } while( got_token && was_ip); + + if(num_ips == 0) { + DEBUG(0,("initialise_wins: Missing IP address when parsing line %s\n", line )); + continue; + } + + if(!got_token) { + DEBUG(0,("initialise_wins: Missing nb_flags when parsing line %s\n", line )); + continue; + } + + /* Allocate the space for the ip_list. */ + if((ip_list = (struct in_addr *)malloc( num_ips * sizeof(struct in_addr))) == NULL) { + DEBUG(0,("initialise_wins: Malloc fail !\n")); + return False; + } - /* Reset and re-parse the line. */ - ptr = line; - next_token(&ptr,name_str,NULL,sizeof(name_str)); - next_token(&ptr,ttl_str,NULL,sizeof(ttl_str)); - for(i = 0; i < num_ips; i++) - { - next_token(&ptr, ip_str, NULL, sizeof(ip_str)); - ip_list[i] = *interpret_addr2(ip_str); - } - next_token(&ptr,nb_flags_str,NULL, sizeof(nb_flags_str)); - - /* - * Deal with SELF or REGISTER name encoding. Default is REGISTER - * for compatibility with old nmbds. - */ - - if(nb_flags_str[strlen(nb_flags_str)-1] == 'S') - { - DEBUG(5,("initialise_wins: Ignoring SELF name %s\n", line)); - SAFE_FREE(ip_list); - continue; - } + /* Reset and re-parse the line. */ + ptr = line; + next_token(&ptr,name_str,NULL,sizeof(name_str)); + next_token(&ptr,ttl_str,NULL,sizeof(ttl_str)); + for(i = 0; i < num_ips; i++) { + next_token(&ptr, ip_str, NULL, sizeof(ip_str)); + ip_list[i] = *interpret_addr2(ip_str); + } + next_token(&ptr,nb_flags_str,NULL, sizeof(nb_flags_str)); + + /* + * Deal with SELF or REGISTER name encoding. Default is REGISTER + * for compatibility with old nmbds. + */ + + if(nb_flags_str[strlen(nb_flags_str)-1] == 'S') { + DEBUG(5,("initialise_wins: Ignoring SELF name %s\n", line)); + SAFE_FREE(ip_list); + continue; + } - if(nb_flags_str[strlen(nb_flags_str)-1] == 'R') - nb_flags_str[strlen(nb_flags_str)-1] = '\0'; + if(nb_flags_str[strlen(nb_flags_str)-1] == 'R') + nb_flags_str[strlen(nb_flags_str)-1] = '\0'; - /* Netbios name. # divides the name from the type (hex): netbios#xx */ - pstrcpy(name,name_str); + /* Netbios name. # divides the name from the type (hex): netbios#xx */ + pstrcpy(name,name_str); - if((p = strchr(name,'#')) != NULL) - { - *p = 0; - sscanf(p+1,"%x",&type); - } + if((p = strchr(name,'#')) != NULL) { + *p = 0; + sscanf(p+1,"%x",&type); + } - /* Decode the netbios flags (hex) and the time-to-live (in seconds). */ - sscanf(nb_flags_str,"%x",&nb_flags); - sscanf(ttl_str,"%d",&ttl); - - /* add all entries that have 60 seconds or more to live */ - if ((ttl - 60) > time_now || ttl == PERMANENT_TTL) - { - if(ttl != PERMANENT_TTL) - ttl -= time_now; + /* Decode the netbios flags (hex) and the time-to-live (in seconds). */ + sscanf(nb_flags_str,"%x",&nb_flags); + sscanf(ttl_str,"%d",&ttl); + + /* add all entries that have 60 seconds or more to live */ + if ((ttl - 60) > time_now || ttl == PERMANENT_TTL) { + if(ttl != PERMANENT_TTL) + ttl -= time_now; - DEBUG( 4, ("initialise_wins: add name: %s#%02x ttl = %d first IP %s flags = %2x\n", - name, type, ttl, inet_ntoa(ip_list[0]), nb_flags)); - - (void)add_name_to_subnet( wins_server_subnet, name, type, nb_flags, - ttl, REGISTER_NAME, num_ips, ip_list ); - - } - else - { - DEBUG(4, ("initialise_wins: not adding name (ttl problem) %s#%02x ttl = %d first IP %s flags = %2x\n", - name, type, ttl, inet_ntoa(ip_list[0]), nb_flags)); - } + DEBUG( 4, ("initialise_wins: add name: %s#%02x ttl = %d first IP %s flags = %2x\n", + name, type, ttl, inet_ntoa(ip_list[0]), nb_flags)); + + (void)add_name_to_subnet( wins_server_subnet, name, type, nb_flags, + ttl, REGISTER_NAME, num_ips, ip_list ); + } else { + DEBUG(4, ("initialise_wins: not adding name (ttl problem) %s#%02x ttl = %d first IP %s flags = %2x\n", + name, type, ttl, inet_ntoa(ip_list[0]), nb_flags)); + } - SAFE_FREE(ip_list); - } + SAFE_FREE(ip_list); + } - x_fclose(fp); - return True; + x_fclose(fp); + return True; } /**************************************************************************** @@ -400,30 +381,33 @@ Send a WINS WACK (Wait ACKnowledgement) response. static void send_wins_wack_response(int ttl, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - unsigned char rdata[2]; - - rdata[0] = rdata[1] = 0; - - /* Taken from nmblib.c - we need to send back almost - identical bytes from the requesting packet header. */ - - rdata[0] = (nmb->header.opcode & 0xF) << 3; - if (nmb->header.nm_flags.authoritative && - nmb->header.response) rdata[0] |= 0x4; - if (nmb->header.nm_flags.trunc) rdata[0] |= 0x2; - if (nmb->header.nm_flags.recursion_desired) rdata[0] |= 0x1; - if (nmb->header.nm_flags.recursion_available && - nmb->header.response) rdata[1] |= 0x80; - if (nmb->header.nm_flags.bcast) rdata[1] |= 0x10; - - reply_netbios_packet(p, /* Packet to reply to. */ - 0, /* Result code. */ - NMB_WAIT_ACK, /* nmbd type code. */ - NMB_WACK_OPCODE, /* opcode. */ - ttl, /* ttl. */ - (char *)rdata, /* data to send. */ - 2); /* data length. */ + struct nmb_packet *nmb = &p->packet.nmb; + unsigned char rdata[2]; + + rdata[0] = rdata[1] = 0; + + /* Taken from nmblib.c - we need to send back almost + identical bytes from the requesting packet header. */ + + rdata[0] = (nmb->header.opcode & 0xF) << 3; + if (nmb->header.nm_flags.authoritative && nmb->header.response) + rdata[0] |= 0x4; + if (nmb->header.nm_flags.trunc) + rdata[0] |= 0x2; + if (nmb->header.nm_flags.recursion_desired) + rdata[0] |= 0x1; + if (nmb->header.nm_flags.recursion_available && nmb->header.response) + rdata[1] |= 0x80; + if (nmb->header.nm_flags.bcast) + rdata[1] |= 0x10; + + reply_netbios_packet(p, /* Packet to reply to. */ + 0, /* Result code. */ + NMB_WAIT_ACK, /* nmbd type code. */ + NMB_WACK_OPCODE, /* opcode. */ + ttl, /* ttl. */ + (char *)rdata, /* data to send. */ + 2); /* data length. */ } /**************************************************************************** @@ -432,18 +416,18 @@ Send a WINS name registration response. static void send_wins_name_registration_response(int rcode, int ttl, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - char rdata[6]; - - memcpy(&rdata[0], &nmb->additional->rdata[0], 6); - - reply_netbios_packet(p, /* Packet to reply to. */ - rcode, /* Result code. */ - WINS_REG, /* nmbd type code. */ - NMB_NAME_REG_OPCODE, /* opcode. */ - ttl, /* ttl. */ - rdata, /* data to send. */ - 6); /* data length. */ + struct nmb_packet *nmb = &p->packet.nmb; + char rdata[6]; + + memcpy(&rdata[0], &nmb->additional->rdata[0], 6); + + reply_netbios_packet(p, /* Packet to reply to. */ + rcode, /* Result code. */ + WINS_REG, /* nmbd type code. */ + NMB_NAME_REG_OPCODE, /* opcode. */ + ttl, /* ttl. */ + rdata, /* data to send. */ + 6); /* data length. */ } /*********************************************************************** @@ -453,139 +437,128 @@ static void send_wins_name_registration_response(int rcode, int ttl, struct pack void wins_process_name_refresh_request(struct subnet_record *subrec, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - struct nmb_name *question = &nmb->question.question_name; - BOOL bcast = nmb->header.nm_flags.bcast; - uint16 nb_flags = get_nb_flags(nmb->additional->rdata); - BOOL group = (nb_flags & NB_GROUP) ? True : False; - struct name_record *namerec = NULL; - int ttl = get_ttl_from_packet(nmb); - struct in_addr from_ip; - struct in_addr our_fake_ip = *interpret_addr2("0.0.0.0"); - - putip((char *)&from_ip,&nmb->additional->rdata[2]); - - if(bcast) - { - /* - * We should only get unicast name refresh packets here. - * Anyone trying to refresh broadcast should not be going to a WINS - * server. Log an error here. - */ - - DEBUG(0,("wins_process_name_refresh_request: broadcast name refresh request \ + struct nmb_packet *nmb = &p->packet.nmb; + struct nmb_name *question = &nmb->question.question_name; + BOOL bcast = nmb->header.nm_flags.bcast; + uint16 nb_flags = get_nb_flags(nmb->additional->rdata); + BOOL group = (nb_flags & NB_GROUP) ? True : False; + struct name_record *namerec = NULL; + int ttl = get_ttl_from_packet(nmb); + struct in_addr from_ip; + struct in_addr our_fake_ip = *interpret_addr2("0.0.0.0"); + + putip((char *)&from_ip,&nmb->additional->rdata[2]); + + if(bcast) { + /* + * We should only get unicast name refresh packets here. + * Anyone trying to refresh broadcast should not be going to a WINS + * server. Log an error here. + */ + + DEBUG(0,("wins_process_name_refresh_request: broadcast name refresh request \ received for name %s from IP %s on subnet %s. Error - should not be sent to WINS server\n", - nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); - return; - } + nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); + return; + } - DEBUG(3,("wins_process_name_refresh_request: Name refresh for name %s \ + DEBUG(3,("wins_process_name_refresh_request: Name refresh for name %s \ IP %s\n", nmb_namestr(question), inet_ntoa(from_ip) )); - /* - * See if the name already exists. - */ + /* + * See if the name already exists. + */ - namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); + namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); - /* - * If this is a refresh request and the name doesn't exist then - * treat it like a registration request. This allows us to recover - * from errors (tridge) - */ + /* + * If this is a refresh request and the name doesn't exist then + * treat it like a registration request. This allows us to recover + * from errors (tridge) + */ - if(namerec == NULL) - { - DEBUG(3,("wins_process_name_refresh_request: Name refresh for name %s and \ + if(namerec == NULL) { + DEBUG(3,("wins_process_name_refresh_request: Name refresh for name %s and \ the name does not exist. Treating as registration.\n", nmb_namestr(question) )); - wins_process_name_registration_request(subrec,p); - return; - } - - /* - * if the name is present but not active, - * simply remove it and treat the request - * as a registration - */ - if (namerec != NULL && !WINS_STATE_ACTIVE(namerec)) - { - DEBUG(5,("wins_process_name_refresh_request: Name (%s) in WINS was \ + wins_process_name_registration_request(subrec,p); + return; + } + + /* + * if the name is present but not active, + * simply remove it and treat the request + * as a registration + */ + if (namerec != NULL && !WINS_STATE_ACTIVE(namerec)) { + DEBUG(5,("wins_process_name_refresh_request: Name (%s) in WINS was \ not active - removing it.\n", nmb_namestr(question) )); - remove_name_from_namelist( subrec, namerec ); - namerec = NULL; - wins_process_name_registration_request(subrec,p); - return; - } - - /* - * Check that the group bits for the refreshing name and the - * name in our database match. - */ - - if((namerec != NULL) && ((group && !NAME_GROUP(namerec)) || (!group && NAME_GROUP(namerec))) ) - { - DEBUG(3,("wins_process_name_refresh_request: Name %s group bit = %s \ + remove_name_from_namelist( subrec, namerec ); + namerec = NULL; + wins_process_name_registration_request(subrec,p); + return; + } + + /* + * Check that the group bits for the refreshing name and the + * name in our database match. + */ + + if((namerec != NULL) && ((group && !NAME_GROUP(namerec)) || (!group && NAME_GROUP(namerec))) ) { + DEBUG(3,("wins_process_name_refresh_request: Name %s group bit = %s \ does not match group bit in WINS for this name.\n", nmb_namestr(question), group ? "True" : "False" )); - send_wins_name_registration_response(RFS_ERR, 0, p); - return; - } - - /* - * For a unique name check that the person refreshing the name is one of the registered IP - * addresses. If not - fail the refresh. Do the same for group names with a type of 0x1c. - * Just return success for unique 0x1d refreshes. For normal group names update the ttl - * and return success. - */ - - if((!group || (group && (question->name_type == 0x1c))) && find_ip_in_name_record(namerec, from_ip )) - { - /* - * Update the ttl. - */ - update_name_ttl(namerec, ttl); - - /* - * if the record is a replica: - * we take ownership and update the version ID. - */ - if (!ip_equal(namerec->data.wins_ip, our_fake_ip)) { - update_wins_owner(namerec, our_fake_ip); - get_global_id_and_update(&namerec->data.id, True); - } - - send_wins_name_registration_response(0, ttl, p); - wins_hook("refresh", namerec, ttl); - return; - } - else if(group) - { - /* - * Normal groups are all registered with an IP address of 255.255.255.255 - * so we can't search for the IP address. - */ - update_name_ttl(namerec, ttl); - send_wins_name_registration_response(0, ttl, p); - return; - } - else if(!group && (question->name_type == 0x1d)) - { - /* - * Special name type - just pretend the refresh succeeded. - */ - send_wins_name_registration_response(0, ttl, p); - return; - } - else - { - /* - * Fail the refresh. - */ - - DEBUG(3,("wins_process_name_refresh_request: Name refresh for name %s with IP %s and \ + send_wins_name_registration_response(RFS_ERR, 0, p); + return; + } + + /* + * For a unique name check that the person refreshing the name is one of the registered IP + * addresses. If not - fail the refresh. Do the same for group names with a type of 0x1c. + * Just return success for unique 0x1d refreshes. For normal group names update the ttl + * and return success. + */ + + if((!group || (group && (question->name_type == 0x1c))) && find_ip_in_name_record(namerec, from_ip )) { + /* + * Update the ttl. + */ + update_name_ttl(namerec, ttl); + + /* + * if the record is a replica: + * we take ownership and update the version ID. + */ + if (!ip_equal(namerec->data.wins_ip, our_fake_ip)) { + update_wins_owner(namerec, our_fake_ip); + get_global_id_and_update(&namerec->data.id, True); + } + + send_wins_name_registration_response(0, ttl, p); + wins_hook("refresh", namerec, ttl); + return; + } else if(group) { + /* + * Normal groups are all registered with an IP address of 255.255.255.255 + * so we can't search for the IP address. + */ + update_name_ttl(namerec, ttl); + send_wins_name_registration_response(0, ttl, p); + return; + } else if(!group && (question->name_type == 0x1d)) { + /* + * Special name type - just pretend the refresh succeeded. + */ + send_wins_name_registration_response(0, ttl, p); + return; + } else { + /* + * Fail the refresh. + */ + + DEBUG(3,("wins_process_name_refresh_request: Name refresh for name %s with IP %s and \ is IP is not known to the name.\n", nmb_namestr(question), inet_ntoa(from_ip) )); - send_wins_name_registration_response(RFS_ERR, 0, p); - return; - } + send_wins_name_registration_response(RFS_ERR, 0, p); + return; + } } /*********************************************************************** @@ -604,17 +577,17 @@ static void wins_register_query_success(struct subnet_record *subrec, struct in_addr ip, struct res_rec *answers) { - struct packet_struct *orig_reg_packet; + struct packet_struct *orig_reg_packet; - memcpy((char *)&orig_reg_packet, userdata->data, sizeof(struct packet_struct *)); + memcpy((char *)&orig_reg_packet, userdata->data, sizeof(struct packet_struct *)); - DEBUG(3,("wins_register_query_success: Original client at IP %s still wants the \ + DEBUG(3,("wins_register_query_success: Original client at IP %s still wants the \ name %s. Rejecting registration request.\n", inet_ntoa(ip), nmb_namestr(question_name) )); - send_wins_name_registration_response(RFS_ERR, 0, orig_reg_packet); + send_wins_name_registration_response(RFS_ERR, 0, orig_reg_packet); - orig_reg_packet->locked = False; - free_packet(orig_reg_packet); + orig_reg_packet->locked = False; + free_packet(orig_reg_packet); } /*********************************************************************** @@ -632,40 +605,37 @@ static void wins_register_query_fail(struct subnet_record *subrec, struct nmb_name *question_name, int rcode) { - struct userdata_struct *userdata = rrec->userdata; - struct packet_struct *orig_reg_packet; - struct name_record *namerec = NULL; - - memcpy((char *)&orig_reg_packet, userdata->data, sizeof(struct packet_struct *)); - - /* - * We want to just add the name, as we now know the original owner - * didn't want it. But we can't just do that as an arbitary - * amount of time may have taken place between the name query - * request and this timeout/error response. So we check that - * the name still exists and is in the same state - if so - * we remove it and call wins_process_name_registration_request() - * as we know it will do the right thing now. - */ - - namerec = find_name_on_subnet(subrec, question_name, FIND_ANY_NAME); - - if( (namerec != NULL) - && (namerec->data.source == REGISTER_NAME) - && ip_equal(rrec->packet->ip, *namerec->data.ip) ) - { - remove_name_from_namelist( subrec, namerec); - namerec = NULL; - } - - if(namerec == NULL) - wins_process_name_registration_request(subrec, orig_reg_packet); - else - DEBUG(2,("wins_register_query_fail: The state of the WINS database changed between \ + struct userdata_struct *userdata = rrec->userdata; + struct packet_struct *orig_reg_packet; + struct name_record *namerec = NULL; + + memcpy((char *)&orig_reg_packet, userdata->data, sizeof(struct packet_struct *)); + + /* + * We want to just add the name, as we now know the original owner + * didn't want it. But we can't just do that as an arbitary + * amount of time may have taken place between the name query + * request and this timeout/error response. So we check that + * the name still exists and is in the same state - if so + * we remove it and call wins_process_name_registration_request() + * as we know it will do the right thing now. + */ + + namerec = find_name_on_subnet(subrec, question_name, FIND_ANY_NAME); + + if( (namerec != NULL) && (namerec->data.source == REGISTER_NAME) && ip_equal(rrec->packet->ip, *namerec->data.ip) ) { + remove_name_from_namelist( subrec, namerec); + namerec = NULL; + } + + if(namerec == NULL) + wins_process_name_registration_request(subrec, orig_reg_packet); + else + DEBUG(2,("wins_register_query_fail: The state of the WINS database changed between \ querying for name %s in order to replace it and this reply.\n", nmb_namestr(question_name) )); - orig_reg_packet->locked = False; - free_packet(orig_reg_packet); + orig_reg_packet->locked = False; + free_packet(orig_reg_packet); } /*********************************************************************** @@ -728,279 +698,271 @@ querying for name %s in order to replace it and this reply.\n", nmb_namestr(ques void wins_process_name_registration_request(struct subnet_record *subrec, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - struct nmb_name *question = &nmb->question.question_name; - BOOL bcast = nmb->header.nm_flags.bcast; - uint16 nb_flags = get_nb_flags(nmb->additional->rdata); - int ttl = get_ttl_from_packet(nmb); - struct name_record *namerec = NULL; - struct in_addr from_ip; - BOOL registering_group_name = (nb_flags & NB_GROUP) ? True : False; - struct in_addr our_fake_ip = *interpret_addr2("0.0.0.0"); - - putip((char *)&from_ip,&nmb->additional->rdata[2]); - - if(bcast) - { - /* - * We should only get unicast name registration packets here. - * Anyone trying to register broadcast should not be going to a WINS - * server. Log an error here. - */ - - DEBUG(0,("wins_process_name_registration_request: broadcast name registration request \ + nstring name; + struct nmb_packet *nmb = &p->packet.nmb; + struct nmb_name *question = &nmb->question.question_name; + BOOL bcast = nmb->header.nm_flags.bcast; + uint16 nb_flags = get_nb_flags(nmb->additional->rdata); + int ttl = get_ttl_from_packet(nmb); + struct name_record *namerec = NULL; + struct in_addr from_ip; + BOOL registering_group_name = (nb_flags & NB_GROUP) ? True : False; + struct in_addr our_fake_ip = *interpret_addr2("0.0.0.0"); + + putip((char *)&from_ip,&nmb->additional->rdata[2]); + + if(bcast) { + /* + * We should only get unicast name registration packets here. + * Anyone trying to register broadcast should not be going to a WINS + * server. Log an error here. + */ + + DEBUG(0,("wins_process_name_registration_request: broadcast name registration request \ received for name %s from IP %s on subnet %s. Error - should not be sent to WINS server\n", - nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); - return; - } + nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); + return; + } - DEBUG(3,("wins_process_name_registration_request: %s name registration for name %s \ + DEBUG(3,("wins_process_name_registration_request: %s name registration for name %s \ IP %s\n", registering_group_name ? "Group" : "Unique", nmb_namestr(question), inet_ntoa(from_ip) )); - /* - * See if the name already exists. - */ + /* + * See if the name already exists. + */ - namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); + namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); - /* - * if the record exists but NOT in active state, - * consider it dead. - */ - if ( (namerec != NULL) && !WINS_STATE_ACTIVE(namerec)) - { - DEBUG(5,("wins_process_name_registration_request: Name (%s) in WINS was \ + /* + * if the record exists but NOT in active state, + * consider it dead. + */ + if ( (namerec != NULL) && !WINS_STATE_ACTIVE(namerec)) { + DEBUG(5,("wins_process_name_registration_request: Name (%s) in WINS was \ not active - removing it.\n", nmb_namestr(question) )); - remove_name_from_namelist( subrec, namerec ); - namerec = NULL; - } - - /* - * Deal with the case where the name found was a dns entry. - * Remove it as we now have a NetBIOS client registering the - * name. - */ - - if( (namerec != NULL) - && ( (namerec->data.source == DNS_NAME) - || (namerec->data.source == DNSFAIL_NAME) ) ) - { - DEBUG(5,("wins_process_name_registration_request: Name (%s) in WINS was \ + remove_name_from_namelist( subrec, namerec ); + namerec = NULL; + } + + /* + * Deal with the case where the name found was a dns entry. + * Remove it as we now have a NetBIOS client registering the + * name. + */ + + if( (namerec != NULL) && ( (namerec->data.source == DNS_NAME) || (namerec->data.source == DNSFAIL_NAME) ) ) { + DEBUG(5,("wins_process_name_registration_request: Name (%s) in WINS was \ a dns lookup - removing it.\n", nmb_namestr(question) )); - remove_name_from_namelist( subrec, namerec ); - namerec = NULL; - } - - /* - * Reject if the name exists and is not a REGISTER_NAME. - * (ie. Don't allow any static names to be overwritten. - */ - - if((namerec != NULL) && (namerec->data.source != REGISTER_NAME)) - { - DEBUG( 3, ( "wins_process_name_registration_request: Attempt \ + remove_name_from_namelist( subrec, namerec ); + namerec = NULL; + } + + /* + * Reject if the name exists and is not a REGISTER_NAME. + * (ie. Don't allow any static names to be overwritten. + */ + + if((namerec != NULL) && (namerec->data.source != REGISTER_NAME)) { + DEBUG( 3, ( "wins_process_name_registration_request: Attempt \ to register name %s. Name already exists in WINS with source type %d.\n", - nmb_namestr(question), namerec->data.source )); - send_wins_name_registration_response(RFS_ERR, 0, p); - return; - } - - /* - * Special policy decisions based on MS documentation. - * 1). All group names (except names ending in 0x1c) are added as 255.255.255.255. - * 2). All unique names ending in 0x1d are ignored, although a positive response is sent. - */ - - /* - * A group name is always added as the local broadcast address, except - * for group names ending in 0x1c. - * Group names with type 0x1c are registered with individual IP addresses. - */ - - if(registering_group_name && (question->name_type != 0x1c)) - from_ip = *interpret_addr2("255.255.255.255"); - - /* - * Ignore all attempts to register a unique 0x1d name, although return success. - */ - - if(!registering_group_name && (question->name_type == 0x1d)) - { - DEBUG(3,("wins_process_name_registration_request: Ignoring request \ + nmb_namestr(question), namerec->data.source )); + send_wins_name_registration_response(RFS_ERR, 0, p); + return; + } + + /* + * Special policy decisions based on MS documentation. + * 1). All group names (except names ending in 0x1c) are added as 255.255.255.255. + * 2). All unique names ending in 0x1d are ignored, although a positive response is sent. + */ + + /* + * A group name is always added as the local broadcast address, except + * for group names ending in 0x1c. + * Group names with type 0x1c are registered with individual IP addresses. + */ + + if(registering_group_name && (question->name_type != 0x1c)) + from_ip = *interpret_addr2("255.255.255.255"); + + /* + * Ignore all attempts to register a unique 0x1d name, although return success. + */ + + if(!registering_group_name && (question->name_type == 0x1d)) { + DEBUG(3,("wins_process_name_registration_request: Ignoring request \ to register name %s from IP %s.\n", nmb_namestr(question), inet_ntoa(p->ip) )); - send_wins_name_registration_response(0, ttl, p); - return; - } - - /* - * Next two cases are the 'if statement' mentioned above. - */ - - if((namerec != NULL) && NAME_GROUP(namerec)) - { - if(registering_group_name) - { - /* - * If we are adding a group name, the name exists and is also a group entry just add this - * IP address to it and update the ttl. - */ - - DEBUG(3,("wins_process_name_registration_request: Adding IP %s to group name %s.\n", - inet_ntoa(from_ip), nmb_namestr(question) )); - /* - * Check the ip address is not already in the group. - */ - if(!find_ip_in_name_record(namerec, from_ip)) { - add_ip_to_name_record(namerec, from_ip); - /* we need to update the record for replication */ - get_global_id_and_update(&namerec->data.id, True); + send_wins_name_registration_response(0, ttl, p); + return; + } /* - * if the record is a replica, we must change - * the wins owner to us to make the replication updates - * it on the other wins servers. - * And when the partner will receive this record, - * it will update its own record. + * Next two cases are the 'if statement' mentioned above. */ - update_wins_owner(namerec, our_fake_ip); + if((namerec != NULL) && NAME_GROUP(namerec)) { + if(registering_group_name) { + /* + * If we are adding a group name, the name exists and is also a group entry just add this + * IP address to it and update the ttl. + */ + + DEBUG(3,("wins_process_name_registration_request: Adding IP %s to group name %s.\n", + inet_ntoa(from_ip), nmb_namestr(question) )); + + /* + * Check the ip address is not already in the group. + */ + + if(!find_ip_in_name_record(namerec, from_ip)) { + add_ip_to_name_record(namerec, from_ip); + /* we need to update the record for replication */ + get_global_id_and_update(&namerec->data.id, True); + + /* + * if the record is a replica, we must change + * the wins owner to us to make the replication updates + * it on the other wins servers. + * And when the partner will receive this record, + * it will update its own record. + */ + + update_wins_owner(namerec, our_fake_ip); + } + update_name_ttl(namerec, ttl); + send_wins_name_registration_response(0, ttl, p); + return; + } else { - } - update_name_ttl(namerec, ttl); - send_wins_name_registration_response(0, ttl, p); - return; - } - else - { - /* - * If we are adding a unique name, the name exists in the WINS db - * and is a group name then reject the registration. - * - * explanation: groups have a higher priority than unique names. - */ - - DEBUG(3,("wins_process_name_registration_request: Attempt to register name %s. Name \ + /* + * If we are adding a unique name, the name exists in the WINS db + * and is a group name then reject the registration. + * + * explanation: groups have a higher priority than unique names. + */ + + DEBUG(3,("wins_process_name_registration_request: Attempt to register name %s. Name \ already exists in WINS as a GROUP name.\n", nmb_namestr(question) )); - send_wins_name_registration_response(RFS_ERR, 0, p); - return; - } - } - - /* - * From here on down we know that if the name exists in the WINS db it is - * a unique name, not a group name. - */ - - /* - * If the name exists and is one of our names then check the - * registering IP address. If it's not one of ours then automatically - * reject without doing the query - we know we will reject it. - */ - - if((namerec != NULL) && (is_myname(namerec->name.name)) ) - { - if(!ismyip(from_ip)) - { - DEBUG(3,("wins_process_name_registration_request: Attempt to register name %s. Name \ + send_wins_name_registration_response(RFS_ERR, 0, p); + return; + } + } + + /* + * From here on down we know that if the name exists in the WINS db it is + * a unique name, not a group name. + */ + + /* + * If the name exists and is one of our names then check the + * registering IP address. If it's not one of ours then automatically + * reject without doing the query - we know we will reject it. + */ + + if ( namerec != NULL ) + pull_ascii_nstring(name, namerec->name.name); + + if( is_myname(name) ) { + if(!ismyip(from_ip)) { + DEBUG(3,("wins_process_name_registration_request: Attempt to register name %s. Name \ is one of our (WINS server) names. Denying registration.\n", nmb_namestr(question) )); - send_wins_name_registration_response(RFS_ERR, 0, p); - return; - } - else - { - /* - * It's one of our names and one of our IP's - update the ttl. - */ - update_name_ttl(namerec, ttl); - send_wins_name_registration_response(0, ttl, p); - wins_hook("refresh", namerec, ttl); - return; - } - } - - /* - * If the name exists and it is a unique registration and the registering IP - * is the same as the (single) already registered IP then just update the ttl. - * - * But not if the record is an active replica. IF it's a replica, it means it can be - * the same client which has moved and not yet expired. So we don't update - * the ttl in this case and go beyond to do a WACK and query the old client - */ - - if( !registering_group_name - && (namerec != NULL) - && (namerec->data.num_ips == 1) - && ip_equal( namerec->data.ip[0], from_ip ) - && ip_equal(namerec->data.wins_ip, our_fake_ip) ) - { - update_name_ttl( namerec, ttl ); - send_wins_name_registration_response( 0, ttl, p ); - wins_hook("refresh", namerec, ttl); - return; - } - - /* - * Finally if the name exists do a query to the registering machine - * to see if they still claim to have the name. - */ - - if( namerec != NULL ) - { - long *ud[(sizeof(struct userdata_struct) + sizeof(struct packet_struct *))/sizeof(long *) + 1]; - struct userdata_struct *userdata = (struct userdata_struct *)ud; - - /* - * First send a WACK to the registering machine. - */ - - send_wins_wack_response(60, p); - - /* - * When the reply comes back we need the original packet. - * Lock this so it won't be freed and then put it into - * the userdata structure. - */ - - p->locked = True; - - userdata = (struct userdata_struct *)ud; - - userdata->copy_fn = NULL; - userdata->free_fn = NULL; - userdata->userdata_len = sizeof(struct packet_struct *); - memcpy(userdata->data, (char *)&p, sizeof(struct packet_struct *) ); - - /* - * Use the new call to send a query directly to an IP address. - * This sends the query directly to the IP address, and ensures - * the recursion desired flag is not set (you were right Luke :-). - * This function should *only* be called from the WINS server - * code. JRA. - */ - - query_name_from_wins_server( *namerec->data.ip, - question->name, - question->name_type, - wins_register_query_success, - wins_register_query_fail, - userdata ); - return; - } - - /* - * Name did not exist - add it. - */ - - (void)add_name_to_subnet( subrec, question->name, question->name_type, - nb_flags, ttl, REGISTER_NAME, 1, &from_ip); - if ((namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME))) { - get_global_id_and_update(&namerec->data.id, True); - update_wins_owner(namerec, our_fake_ip); - update_wins_flag(namerec, WINS_ACTIVE); - wins_hook("add", namerec, ttl); - } + send_wins_name_registration_response(RFS_ERR, 0, p); + return; + } else { + /* + * It's one of our names and one of our IP's - update the ttl. + */ + update_name_ttl(namerec, ttl); + send_wins_name_registration_response(0, ttl, p); + wins_hook("refresh", namerec, ttl); + return; + } + } + + /* + * If the name exists and it is a unique registration and the registering IP + * is the same as the (single) already registered IP then just update the ttl. + * + * But not if the record is an active replica. IF it's a replica, it means it can be + * the same client which has moved and not yet expired. So we don't update + * the ttl in this case and go beyond to do a WACK and query the old client + */ - send_wins_name_registration_response(0, ttl, p); + if( !registering_group_name + && (namerec != NULL) + && (namerec->data.num_ips == 1) + && ip_equal( namerec->data.ip[0], from_ip ) + && ip_equal(namerec->data.wins_ip, our_fake_ip) ) { + update_name_ttl( namerec, ttl ); + send_wins_name_registration_response( 0, ttl, p ); + wins_hook("refresh", namerec, ttl); + return; + } + + /* + * Finally if the name exists do a query to the registering machine + * to see if they still claim to have the name. + */ + + if( namerec != NULL ) { + long *ud[(sizeof(struct userdata_struct) + sizeof(struct packet_struct *))/sizeof(long *) + 1]; + struct userdata_struct *userdata = (struct userdata_struct *)ud; + + /* + * First send a WACK to the registering machine. + */ + + send_wins_wack_response(60, p); + + /* + * When the reply comes back we need the original packet. + * Lock this so it won't be freed and then put it into + * the userdata structure. + */ + + p->locked = True; + + userdata = (struct userdata_struct *)ud; + + userdata->copy_fn = NULL; + userdata->free_fn = NULL; + userdata->userdata_len = sizeof(struct packet_struct *); + memcpy(userdata->data, (char *)&p, sizeof(struct packet_struct *) ); + + /* + * Use the new call to send a query directly to an IP address. + * This sends the query directly to the IP address, and ensures + * the recursion desired flag is not set (you were right Luke :-). + * This function should *only* be called from the WINS server + * code. JRA. + */ + + pull_ascii_nstring(name, question->name); + query_name_from_wins_server( *namerec->data.ip, + name, + question->name_type, + wins_register_query_success, + wins_register_query_fail, + userdata ); + return; + } + + /* + * Name did not exist - add it. + */ + + pull_ascii_nstring(name, question->name); + add_name_to_subnet( subrec, name, question->name_type, + nb_flags, ttl, REGISTER_NAME, 1, &from_ip); + + if ((namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME))) { + get_global_id_and_update(&namerec->data.id, True); + update_wins_owner(namerec, our_fake_ip); + update_wins_flag(namerec, WINS_ACTIVE); + wins_hook("add", namerec, ttl); + } + + send_wins_name_registration_response(0, ttl, p); } /*********************************************************************** @@ -1017,55 +979,54 @@ static void wins_multihomed_register_query_success(struct subnet_record *subrec, struct in_addr ip, struct res_rec *answers) { - struct packet_struct *orig_reg_packet; - struct nmb_packet *nmb; - struct name_record *namerec = NULL; - struct in_addr from_ip; - int ttl; - struct in_addr our_fake_ip = *interpret_addr2("0.0.0.0"); - - memcpy((char *)&orig_reg_packet, userdata->data, sizeof(struct packet_struct *)); - - nmb = &orig_reg_packet->packet.nmb; - - putip((char *)&from_ip,&nmb->additional->rdata[2]); - ttl = get_ttl_from_packet(nmb); - - /* - * We want to just add the new IP, as we now know the requesting - * machine claims to own it. But we can't just do that as an arbitary - * amount of time may have taken place between the name query - * request and this response. So we check that - * the name still exists and is in the same state - if so - * we just add the extra IP and update the ttl. - */ - - namerec = find_name_on_subnet(subrec, question_name, FIND_ANY_NAME); - - if( (namerec == NULL) || (namerec->data.source != REGISTER_NAME) || !WINS_STATE_ACTIVE(namerec) ) - { - DEBUG(3,("wins_multihomed_register_query_success: name %s is not in the correct state to add \ + struct packet_struct *orig_reg_packet; + struct nmb_packet *nmb; + struct name_record *namerec = NULL; + struct in_addr from_ip; + int ttl; + struct in_addr our_fake_ip = *interpret_addr2("0.0.0.0"); + + memcpy((char *)&orig_reg_packet, userdata->data, sizeof(struct packet_struct *)); + + nmb = &orig_reg_packet->packet.nmb; + + putip((char *)&from_ip,&nmb->additional->rdata[2]); + ttl = get_ttl_from_packet(nmb); + + /* + * We want to just add the new IP, as we now know the requesting + * machine claims to own it. But we can't just do that as an arbitary + * amount of time may have taken place between the name query + * request and this response. So we check that + * the name still exists and is in the same state - if so + * we just add the extra IP and update the ttl. + */ + + namerec = find_name_on_subnet(subrec, question_name, FIND_ANY_NAME); + + if( (namerec == NULL) || (namerec->data.source != REGISTER_NAME) || !WINS_STATE_ACTIVE(namerec) ) { + DEBUG(3,("wins_multihomed_register_query_success: name %s is not in the correct state to add \ a subsequent IP address.\n", nmb_namestr(question_name) )); - send_wins_name_registration_response(RFS_ERR, 0, orig_reg_packet); + send_wins_name_registration_response(RFS_ERR, 0, orig_reg_packet); - orig_reg_packet->locked = False; - free_packet(orig_reg_packet); + orig_reg_packet->locked = False; + free_packet(orig_reg_packet); - return; - } + return; + } - if(!find_ip_in_name_record(namerec, from_ip)) - add_ip_to_name_record(namerec, from_ip); + if(!find_ip_in_name_record(namerec, from_ip)) + add_ip_to_name_record(namerec, from_ip); - get_global_id_and_update(&namerec->data.id, True); - update_wins_owner(namerec, our_fake_ip); - update_wins_flag(namerec, WINS_ACTIVE); - update_name_ttl(namerec, ttl); - send_wins_name_registration_response(0, ttl, orig_reg_packet); - wins_hook("add", namerec, ttl); + get_global_id_and_update(&namerec->data.id, True); + update_wins_owner(namerec, our_fake_ip); + update_wins_flag(namerec, WINS_ACTIVE); + update_name_ttl(namerec, ttl); + send_wins_name_registration_response(0, ttl, orig_reg_packet); + wins_hook("add", namerec, ttl); - orig_reg_packet->locked = False; - free_packet(orig_reg_packet); + orig_reg_packet->locked = False; + free_packet(orig_reg_packet); } /*********************************************************************** @@ -1081,18 +1042,18 @@ static void wins_multihomed_register_query_fail(struct subnet_record *subrec, struct nmb_name *question_name, int rcode) { - struct userdata_struct *userdata = rrec->userdata; - struct packet_struct *orig_reg_packet; + struct userdata_struct *userdata = rrec->userdata; + struct packet_struct *orig_reg_packet; - memcpy((char *)&orig_reg_packet, userdata->data, sizeof(struct packet_struct *)); + memcpy((char *)&orig_reg_packet, userdata->data, sizeof(struct packet_struct *)); - DEBUG(3,("wins_multihomed_register_query_fail: Registering machine at IP %s failed to answer \ + DEBUG(3,("wins_multihomed_register_query_fail: Registering machine at IP %s failed to answer \ query successfully for name %s.\n", inet_ntoa(orig_reg_packet->ip), nmb_namestr(question_name) )); - send_wins_name_registration_response(RFS_ERR, 0, orig_reg_packet); + send_wins_name_registration_response(RFS_ERR, 0, orig_reg_packet); - orig_reg_packet->locked = False; - free_packet(orig_reg_packet); - return; + orig_reg_packet->locked = False; + free_packet(orig_reg_packet); + return; } /*********************************************************************** @@ -1103,250 +1064,241 @@ query successfully for name %s.\n", inet_ntoa(orig_reg_packet->ip), nmb_namestr( void wins_process_multihomed_name_registration_request( struct subnet_record *subrec, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - struct nmb_name *question = &nmb->question.question_name; - BOOL bcast = nmb->header.nm_flags.bcast; - uint16 nb_flags = get_nb_flags(nmb->additional->rdata); - int ttl = get_ttl_from_packet(nmb); - struct name_record *namerec = NULL; - struct in_addr from_ip; - BOOL group = (nb_flags & NB_GROUP) ? True : False; - struct in_addr our_fake_ip = *interpret_addr2("0.0.0.0"); - - putip((char *)&from_ip,&nmb->additional->rdata[2]); - - if(bcast) - { - /* - * We should only get unicast name registration packets here. - * Anyone trying to register broadcast should not be going to a WINS - * server. Log an error here. - */ - - DEBUG(0,("wins_process_multihomed_name_registration_request: broadcast name registration request \ + struct nmb_packet *nmb = &p->packet.nmb; + struct nmb_name *question = &nmb->question.question_name; + BOOL bcast = nmb->header.nm_flags.bcast; + uint16 nb_flags = get_nb_flags(nmb->additional->rdata); + int ttl = get_ttl_from_packet(nmb); + struct name_record *namerec = NULL; + struct in_addr from_ip; + BOOL group = (nb_flags & NB_GROUP) ? True : False; + struct in_addr our_fake_ip = *interpret_addr2("0.0.0.0"); + nstring qname; + + putip((char *)&from_ip,&nmb->additional->rdata[2]); + + if(bcast) { + /* + * We should only get unicast name registration packets here. + * Anyone trying to register broadcast should not be going to a WINS + * server. Log an error here. + */ + + DEBUG(0,("wins_process_multihomed_name_registration_request: broadcast name registration request \ received for name %s from IP %s on subnet %s. Error - should not be sent to WINS server\n", - nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); - return; - } + nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); + return; + } - /* - * Only unique names should be registered multihomed. - */ + /* + * Only unique names should be registered multihomed. + */ - if(group) - { - DEBUG(0,("wins_process_multihomed_name_registration_request: group name registration request \ + if(group) { + DEBUG(0,("wins_process_multihomed_name_registration_request: group name registration request \ received for name %s from IP %s on subnet %s. Errror - group names should not be multihomed.\n", - nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); - return; - } + nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); + return; + } - DEBUG(3,("wins_process_multihomed_name_registration_request: name registration for name %s \ + DEBUG(3,("wins_process_multihomed_name_registration_request: name registration for name %s \ IP %s\n", nmb_namestr(question), inet_ntoa(from_ip) )); - /* - * Deal with policy regarding 0x1d names. - */ + /* + * Deal with policy regarding 0x1d names. + */ - if(question->name_type == 0x1d) - { - DEBUG(3,("wins_process_multihomed_name_registration_request: Ignoring request \ + if(question->name_type == 0x1d) { + DEBUG(3,("wins_process_multihomed_name_registration_request: Ignoring request \ to register name %s from IP %s.", nmb_namestr(question), inet_ntoa(p->ip) )); - send_wins_name_registration_response(0, ttl, p); - return; - } - - /* - * See if the name already exists. - */ - - namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); - - /* - * if the record exists but NOT in active state, - * consider it dead. - */ - if ((namerec != NULL) && !WINS_STATE_ACTIVE(namerec)) { - DEBUG(5,("wins_process_multihomed_name_registration_request: Name (%s) in WINS was not active - removing it.\n", nmb_namestr(question))); - remove_name_from_namelist(subrec, namerec); - namerec = NULL; - } + send_wins_name_registration_response(0, ttl, p); + return; + } + + /* + * See if the name already exists. + */ + + namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); + + /* + * if the record exists but NOT in active state, + * consider it dead. + */ + + if ((namerec != NULL) && !WINS_STATE_ACTIVE(namerec)) { + DEBUG(5,("wins_process_multihomed_name_registration_request: Name (%s) in WINS was not active - removing it.\n", nmb_namestr(question))); + remove_name_from_namelist(subrec, namerec); + namerec = NULL; + } - /* - * Deal with the case where the name found was a dns entry. - * Remove it as we now have a NetBIOS client registering the - * name. - */ - - if( (namerec != NULL) - && ( (namerec->data.source == DNS_NAME) - || (namerec->data.source == DNSFAIL_NAME) ) ) - { - DEBUG(5,("wins_process_multihomed_name_registration_request: Name (%s) in WINS was a dns lookup \ + /* + * Deal with the case where the name found was a dns entry. + * Remove it as we now have a NetBIOS client registering the + * name. + */ + + if( (namerec != NULL) && ( (namerec->data.source == DNS_NAME) || (namerec->data.source == DNSFAIL_NAME) ) ) { + DEBUG(5,("wins_process_multihomed_name_registration_request: Name (%s) in WINS was a dns lookup \ - removing it.\n", nmb_namestr(question) )); - remove_name_from_namelist( subrec, namerec); - namerec = NULL; - } - - /* - * Reject if the name exists and is not a REGISTER_NAME. - * (ie. Don't allow any static names to be overwritten. - */ - - if( (namerec != NULL) && (namerec->data.source != REGISTER_NAME) ) - { - DEBUG( 3, ( "wins_process_multihomed_name_registration_request: Attempt \ + remove_name_from_namelist( subrec, namerec); + namerec = NULL; + } + + /* + * Reject if the name exists and is not a REGISTER_NAME. + * (ie. Don't allow any static names to be overwritten. + */ + + if( (namerec != NULL) && (namerec->data.source != REGISTER_NAME) ) { + DEBUG( 3, ( "wins_process_multihomed_name_registration_request: Attempt \ to register name %s. Name already exists in WINS with source type %d.\n", - nmb_namestr(question), namerec->data.source )); - send_wins_name_registration_response(RFS_ERR, 0, p); - return; - } - - /* - * Reject if the name exists and is a GROUP name and is active. - */ - - if((namerec != NULL) && NAME_GROUP(namerec) && WINS_STATE_ACTIVE(namerec)) - { - DEBUG(3,("wins_process_multihomed_name_registration_request: Attempt to register name %s. Name \ + nmb_namestr(question), namerec->data.source )); + send_wins_name_registration_response(RFS_ERR, 0, p); + return; + } + + /* + * Reject if the name exists and is a GROUP name and is active. + */ + + if((namerec != NULL) && NAME_GROUP(namerec) && WINS_STATE_ACTIVE(namerec)) { + DEBUG(3,("wins_process_multihomed_name_registration_request: Attempt to register name %s. Name \ already exists in WINS as a GROUP name.\n", nmb_namestr(question) )); - send_wins_name_registration_response(RFS_ERR, 0, p); - return; - } - - /* - * From here on down we know that if the name exists in the WINS db it is - * a unique name, not a group name. - */ - - /* - * If the name exists and is one of our names then check the - * registering IP address. If it's not one of ours then automatically - * reject without doing the query - we know we will reject it. - */ - - if((namerec != NULL) && (is_myname(namerec->name.name)) ) - { - if(!ismyip(from_ip)) - { - DEBUG(3,("wins_process_multihomed_name_registration_request: Attempt to register name %s. Name \ + send_wins_name_registration_response(RFS_ERR, 0, p); + return; + } + + /* + * From here on down we know that if the name exists in the WINS db it is + * a unique name, not a group name. + */ + + /* + * If the name exists and is one of our names then check the + * registering IP address. If it's not one of ours then automatically + * reject without doing the query - we know we will reject it. + */ + + if((namerec != NULL) && (is_myname(namerec->name.name)) ) { + if(!ismyip(from_ip)) { + DEBUG(3,("wins_process_multihomed_name_registration_request: Attempt to register name %s. Name \ is one of our (WINS server) names. Denying registration.\n", nmb_namestr(question) )); - send_wins_name_registration_response(RFS_ERR, 0, p); - return; - } - else - { - /* - * It's one of our names and one of our IP's. Ensure the IP is in the record and - * update the ttl. Update the version ID to force replication. - */ - if(!find_ip_in_name_record(namerec, from_ip)) { - get_global_id_and_update(&namerec->data.id, True); - update_wins_owner(namerec, our_fake_ip); - update_wins_flag(namerec, WINS_ACTIVE); - - add_ip_to_name_record(namerec, from_ip); - wins_hook("add", namerec, ttl); - } else { - wins_hook("refresh", namerec, ttl); - } - - update_name_ttl(namerec, ttl); - send_wins_name_registration_response(0, ttl, p); - return; - } - } - - /* - * If the name exists and is active, check if the IP address is already registered - * to that name. If so then update the ttl and reply success. - */ - - if((namerec != NULL) && find_ip_in_name_record(namerec, from_ip) && WINS_STATE_ACTIVE(namerec)) - { - update_name_ttl(namerec, ttl); - /* - * If it's a replica, we need to become the wins owner - * to force the replication - */ - if (!ip_equal(namerec->data.wins_ip, our_fake_ip)) { - get_global_id_and_update(&namerec->data.id, True); - update_wins_owner(namerec, our_fake_ip); - update_wins_flag(namerec, WINS_ACTIVE); - } + send_wins_name_registration_response(RFS_ERR, 0, p); + return; + } else { + /* + * It's one of our names and one of our IP's. Ensure the IP is in the record and + * update the ttl. Update the version ID to force replication. + */ + if(!find_ip_in_name_record(namerec, from_ip)) { + get_global_id_and_update(&namerec->data.id, True); + update_wins_owner(namerec, our_fake_ip); + update_wins_flag(namerec, WINS_ACTIVE); + + add_ip_to_name_record(namerec, from_ip); + wins_hook("add", namerec, ttl); + } else { + wins_hook("refresh", namerec, ttl); + } + + update_name_ttl(namerec, ttl); + send_wins_name_registration_response(0, ttl, p); + return; + } + } + + /* + * If the name exists and is active, check if the IP address is already registered + * to that name. If so then update the ttl and reply success. + */ + + if((namerec != NULL) && find_ip_in_name_record(namerec, from_ip) && WINS_STATE_ACTIVE(namerec)) { + update_name_ttl(namerec, ttl); + + /* + * If it's a replica, we need to become the wins owner + * to force the replication + */ + if (!ip_equal(namerec->data.wins_ip, our_fake_ip)) { + get_global_id_and_update(&namerec->data.id, True); + update_wins_owner(namerec, our_fake_ip); + update_wins_flag(namerec, WINS_ACTIVE); + } - send_wins_name_registration_response(0, ttl, p); - wins_hook("refresh", namerec, ttl); - return; - } - - /* - * If the name exists do a query to the owner - * to see if they still want the name. - */ - - if(namerec != NULL) - { - long *ud[(sizeof(struct userdata_struct) + sizeof(struct packet_struct *))/sizeof(long *) + 1]; - struct userdata_struct *userdata = (struct userdata_struct *)ud; - - /* - * First send a WACK to the registering machine. - */ - - send_wins_wack_response(60, p); - - /* - * When the reply comes back we need the original packet. - * Lock this so it won't be freed and then put it into - * the userdata structure. - */ - - p->locked = True; - - userdata = (struct userdata_struct *)ud; - - userdata->copy_fn = NULL; - userdata->free_fn = NULL; - userdata->userdata_len = sizeof(struct packet_struct *); - memcpy(userdata->data, (char *)&p, sizeof(struct packet_struct *) ); - - /* - * Use the new call to send a query directly to an IP address. - * This sends the query directly to the IP address, and ensures - * the recursion desired flag is not set (you were right Luke :-). - * This function should *only* be called from the WINS server - * code. JRA. - * - * Note that this packet is sent to the current owner of the name, - * not the person who sent the packet - */ - - query_name_from_wins_server( namerec->data.ip[0], - question->name, - question->name_type, - wins_multihomed_register_query_success, - wins_multihomed_register_query_fail, - userdata ); - - return; - } - - /* - * Name did not exist - add it. - */ - - (void)add_name_to_subnet( subrec, question->name, question->name_type, - nb_flags, ttl, REGISTER_NAME, 1, &from_ip); - - if ((namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME))) { - get_global_id_and_update(&namerec->data.id, True); - update_wins_owner(namerec, our_fake_ip); - update_wins_flag(namerec, WINS_ACTIVE); - wins_hook("add", namerec, ttl); - } - - send_wins_name_registration_response(0, ttl, p); + send_wins_name_registration_response(0, ttl, p); + wins_hook("refresh", namerec, ttl); + return; + } + + /* + * If the name exists do a query to the owner + * to see if they still want the name. + */ + + if(namerec != NULL) { + long *ud[(sizeof(struct userdata_struct) + sizeof(struct packet_struct *))/sizeof(long *) + 1]; + struct userdata_struct *userdata = (struct userdata_struct *)ud; + + /* + * First send a WACK to the registering machine. + */ + + send_wins_wack_response(60, p); + + /* + * When the reply comes back we need the original packet. + * Lock this so it won't be freed and then put it into + * the userdata structure. + */ + + p->locked = True; + + userdata = (struct userdata_struct *)ud; + + userdata->copy_fn = NULL; + userdata->free_fn = NULL; + userdata->userdata_len = sizeof(struct packet_struct *); + memcpy(userdata->data, (char *)&p, sizeof(struct packet_struct *) ); + + /* + * Use the new call to send a query directly to an IP address. + * This sends the query directly to the IP address, and ensures + * the recursion desired flag is not set (you were right Luke :-). + * This function should *only* be called from the WINS server + * code. JRA. + * + * Note that this packet is sent to the current owner of the name, + * not the person who sent the packet + */ + + pull_ascii_nstring( qname, question->name); + query_name_from_wins_server( namerec->data.ip[0], + qname, + question->name_type, + wins_multihomed_register_query_success, + wins_multihomed_register_query_fail, + userdata ); + + return; + } + + /* + * Name did not exist - add it. + */ + + pull_ascii_nstring( qname, question->name); + add_name_to_subnet( subrec, qname, question->name_type, + nb_flags, ttl, REGISTER_NAME, 1, &from_ip); + + if ((namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME))) { + get_global_id_and_update(&namerec->data.id, True); + update_wins_owner(namerec, our_fake_ip); + update_wins_flag(namerec, WINS_ACTIVE); + wins_hook("add", namerec, ttl); + } + + send_wins_name_registration_response(0, ttl, p); } /*********************************************************************** @@ -1356,76 +1308,68 @@ is one of our (WINS server) names. Denying registration.\n", nmb_namestr(questio static void process_wins_dmb_query_request(struct subnet_record *subrec, struct packet_struct *p) { - struct name_record *namerec = NULL; - char *prdata; - int num_ips; - - /* - * Go through all the ACTIVE names in the WINS db looking for those - * ending in <1b>. Use this to calculate the number of IP - * addresses we need to return. - */ - - num_ips = 0; - for( namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); - namerec; - namerec = (struct name_record *)ubi_trNext( namerec ) ) - { - if(WINS_STATE_ACTIVE(namerec) && namerec->name.name_type == 0x1b ) - num_ips += namerec->data.num_ips; - } - - if(num_ips == 0) - { - /* - * There are no 0x1b names registered. Return name query fail. - */ - send_wins_name_query_response(NAM_ERR, p, NULL); - return; - } - - if((prdata = (char *)malloc( num_ips * 6 )) == NULL) - { - DEBUG(0,("process_wins_dmb_query_request: Malloc fail !.\n")); - return; - } - - /* - * Go through all the names again in the WINS db looking for those - * ending in <1b>. Add their IP addresses into the list we will - * return. - */ - - num_ips = 0; - for( namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); - namerec; - namerec = (struct name_record *)ubi_trNext( namerec ) ) - { - if(WINS_STATE_ACTIVE(namerec) && namerec->name.name_type == 0x1b) - { - int i; - for(i = 0; i < namerec->data.num_ips; i++) - { - set_nb_flags(&prdata[num_ips * 6],namerec->data.nb_flags); - putip((char *)&prdata[(num_ips * 6) + 2], &namerec->data.ip[i]); - num_ips++; - } - } - } - - /* - * Send back the reply containing the IP list. - */ - - reply_netbios_packet(p, /* Packet to reply to. */ - 0, /* Result code. */ - WINS_QUERY, /* nmbd type code. */ - NMB_NAME_QUERY_OPCODE, /* opcode. */ - lp_min_wins_ttl(), /* ttl. */ - prdata, /* data to send. */ - num_ips*6); /* data length. */ - - SAFE_FREE(prdata); + struct name_record *namerec = NULL; + char *prdata; + int num_ips; + + /* + * Go through all the ACTIVE names in the WINS db looking for those + * ending in <1b>. Use this to calculate the number of IP + * addresses we need to return. + */ + + num_ips = 0; + for( namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); + namerec; namerec = (struct name_record *)ubi_trNext( namerec ) ) { + if(WINS_STATE_ACTIVE(namerec) && namerec->name.name_type == 0x1b ) + num_ips += namerec->data.num_ips; + } + + if(num_ips == 0) { + /* + * There are no 0x1b names registered. Return name query fail. + */ + send_wins_name_query_response(NAM_ERR, p, NULL); + return; + } + + if((prdata = (char *)malloc( num_ips * 6 )) == NULL) { + DEBUG(0,("process_wins_dmb_query_request: Malloc fail !.\n")); + return; + } + + /* + * Go through all the names again in the WINS db looking for those + * ending in <1b>. Add their IP addresses into the list we will + * return. + */ + + num_ips = 0; + for( namerec = (struct name_record *)ubi_trFirst( subrec->namelist ); + namerec; namerec = (struct name_record *)ubi_trNext( namerec ) ) { + if(WINS_STATE_ACTIVE(namerec) && namerec->name.name_type == 0x1b) { + int i; + for(i = 0; i < namerec->data.num_ips; i++) { + set_nb_flags(&prdata[num_ips * 6],namerec->data.nb_flags); + putip((char *)&prdata[(num_ips * 6) + 2], &namerec->data.ip[i]); + num_ips++; + } + } + } + + /* + * Send back the reply containing the IP list. + */ + + reply_netbios_packet(p, /* Packet to reply to. */ + 0, /* Result code. */ + WINS_QUERY, /* nmbd type code. */ + NMB_NAME_QUERY_OPCODE, /* opcode. */ + lp_min_wins_ttl(), /* ttl. */ + prdata, /* data to send. */ + num_ips*6); /* data length. */ + + SAFE_FREE(prdata); } /**************************************************************************** @@ -1435,55 +1379,48 @@ Send a WINS name query response. void send_wins_name_query_response(int rcode, struct packet_struct *p, struct name_record *namerec) { - char rdata[6]; - char *prdata = rdata; - int reply_data_len = 0; - int ttl = 0; - int i; - - memset(rdata,'\0',6); - - if(rcode == 0) - { - ttl = (namerec->data.death_time != PERMANENT_TTL) ? - namerec->data.death_time - p->timestamp : lp_max_wins_ttl(); - - /* Copy all known ip addresses into the return data. */ - /* Optimise for the common case of one IP address so - we don't need a malloc. */ - - if( namerec->data.num_ips == 1 ) - prdata = rdata; - else - { - if((prdata = (char *)malloc( namerec->data.num_ips * 6 )) == NULL) - { - DEBUG(0,("send_wins_name_query_response: malloc fail !\n")); - return; - } - } - - for(i = 0; i < namerec->data.num_ips; i++) - { - set_nb_flags(&prdata[i*6],namerec->data.nb_flags); - putip((char *)&prdata[2+(i*6)], &namerec->data.ip[i]); - } - - sort_query_replies(prdata, i, p->ip); - - reply_data_len = namerec->data.num_ips * 6; - } - - reply_netbios_packet(p, /* Packet to reply to. */ - rcode, /* Result code. */ - WINS_QUERY, /* nmbd type code. */ - NMB_NAME_QUERY_OPCODE, /* opcode. */ - ttl, /* ttl. */ - prdata, /* data to send. */ - reply_data_len); /* data length. */ - - if(prdata != rdata) - SAFE_FREE(prdata); + char rdata[6]; + char *prdata = rdata; + int reply_data_len = 0; + int ttl = 0; + int i; + + memset(rdata,'\0',6); + + if(rcode == 0) { + ttl = (namerec->data.death_time != PERMANENT_TTL) ? namerec->data.death_time - p->timestamp : lp_max_wins_ttl(); + + /* Copy all known ip addresses into the return data. */ + /* Optimise for the common case of one IP address so we don't need a malloc. */ + + if( namerec->data.num_ips == 1 ) { + prdata = rdata; + } else { + if((prdata = (char *)malloc( namerec->data.num_ips * 6 )) == NULL) { + DEBUG(0,("send_wins_name_query_response: malloc fail !\n")); + return; + } + } + + for(i = 0; i < namerec->data.num_ips; i++) { + set_nb_flags(&prdata[i*6],namerec->data.nb_flags); + putip((char *)&prdata[2+(i*6)], &namerec->data.ip[i]); + } + + sort_query_replies(prdata, i, p->ip); + reply_data_len = namerec->data.num_ips * 6; + } + + reply_netbios_packet(p, /* Packet to reply to. */ + rcode, /* Result code. */ + WINS_QUERY, /* nmbd type code. */ + NMB_NAME_QUERY_OPCODE, /* opcode. */ + ttl, /* ttl. */ + prdata, /* data to send. */ + reply_data_len); /* data length. */ + + if(prdata != rdata) + SAFE_FREE(prdata); } /*********************************************************************** @@ -1493,93 +1430,87 @@ void send_wins_name_query_response(int rcode, struct packet_struct *p, void wins_process_name_query_request(struct subnet_record *subrec, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - struct nmb_name *question = &nmb->question.question_name; - struct name_record *namerec = NULL; - - DEBUG(3,("wins_process_name_query: name query for name %s from IP %s\n", - nmb_namestr(question), inet_ntoa(p->ip) )); - - /* - * Special name code. If the queried name is *<1b> then search - * the entire WINS database and return a list of all the IP addresses - * registered to any <1b> name. This is to allow domain master browsers - * to discover other domains that may not have a presence on their subnet. - */ - - if(strequal( question->name, "*") && (question->name_type == 0x1b)) - { - process_wins_dmb_query_request( subrec, p); - return; - } - - namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); - - if(namerec != NULL) - { - /* - * If the name is not anymore in active state then reply not found. - * it's fair even if we keep it in the cache for days. - */ - if (!WINS_STATE_ACTIVE(namerec)) - { - DEBUG(3,("wins_process_name_query: name query for name %s - name expired. Returning fail.\n", - nmb_namestr(question) )); - send_wins_name_query_response(NAM_ERR, p, namerec); - return; - } - /* - * If it's a DNSFAIL_NAME then reply name not found. - */ - - if( namerec->data.source == DNSFAIL_NAME ) - { - DEBUG(3,("wins_process_name_query: name query for name %s returning DNS fail.\n", - nmb_namestr(question) )); - send_wins_name_query_response(NAM_ERR, p, namerec); - return; - } - - /* - * If the name has expired then reply name not found. - */ - - if( (namerec->data.death_time != PERMANENT_TTL) - && (namerec->data.death_time < p->timestamp) ) - { - DEBUG(3,("wins_process_name_query: name query for name %s - name expired. Returning fail.\n", - nmb_namestr(question) )); - send_wins_name_query_response(NAM_ERR, p, namerec); - return; - } - - DEBUG(3,("wins_process_name_query: name query for name %s returning first IP %s.\n", - nmb_namestr(question), inet_ntoa(namerec->data.ip[0]) )); - - send_wins_name_query_response(0, p, namerec); - return; - } - - /* - * Name not found in WINS - try a dns query if it's a 0x20 name. - */ - - if(lp_dns_proxy() && - ((question->name_type == 0x20) || question->name_type == 0)) - { - - DEBUG(3,("wins_process_name_query: name query for name %s not found - doing dns lookup.\n", - nmb_namestr(question) )); - - queue_dns_query(p, question, &namerec); - return; - } - - /* - * Name not found - return error. - */ - - send_wins_name_query_response(NAM_ERR, p, NULL); + struct nmb_packet *nmb = &p->packet.nmb; + struct nmb_name *question = &nmb->question.question_name; + struct name_record *namerec = NULL; + nstring qname; + + DEBUG(3,("wins_process_name_query: name query for name %s from IP %s\n", + nmb_namestr(question), inet_ntoa(p->ip) )); + + /* + * Special name code. If the queried name is *<1b> then search + * the entire WINS database and return a list of all the IP addresses + * registered to any <1b> name. This is to allow domain master browsers + * to discover other domains that may not have a presence on their subnet. + */ + + pull_ascii_nstring(qname, question->name); + if(strequal( qname, "*") && (question->name_type == 0x1b)) { + process_wins_dmb_query_request( subrec, p); + return; + } + + namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); + + if(namerec != NULL) { + /* + * If the name is not anymore in active state then reply not found. + * it's fair even if we keep it in the cache for days. + */ + if (!WINS_STATE_ACTIVE(namerec)) { + DEBUG(3,("wins_process_name_query: name query for name %s - name expired. Returning fail.\n", + nmb_namestr(question) )); + send_wins_name_query_response(NAM_ERR, p, namerec); + return; + } + + /* + * If it's a DNSFAIL_NAME then reply name not found. + */ + + if( namerec->data.source == DNSFAIL_NAME ) { + DEBUG(3,("wins_process_name_query: name query for name %s returning DNS fail.\n", + nmb_namestr(question) )); + send_wins_name_query_response(NAM_ERR, p, namerec); + return; + } + + /* + * If the name has expired then reply name not found. + */ + + if( (namerec->data.death_time != PERMANENT_TTL) && (namerec->data.death_time < p->timestamp) ) { + DEBUG(3,("wins_process_name_query: name query for name %s - name expired. Returning fail.\n", + nmb_namestr(question) )); + send_wins_name_query_response(NAM_ERR, p, namerec); + return; + } + + DEBUG(3,("wins_process_name_query: name query for name %s returning first IP %s.\n", + nmb_namestr(question), inet_ntoa(namerec->data.ip[0]) )); + + send_wins_name_query_response(0, p, namerec); + return; + } + + /* + * Name not found in WINS - try a dns query if it's a 0x20 name. + */ + + if(lp_dns_proxy() && ((question->name_type == 0x20) || question->name_type == 0)) { + DEBUG(3,("wins_process_name_query: name query for name %s not found - doing dns lookup.\n", + nmb_namestr(question) )); + + queue_dns_query(p, question, &namerec); + return; + } + + /* + * Name not found - return error. + */ + + send_wins_name_query_response(NAM_ERR, p, NULL); } /**************************************************************************** @@ -1588,18 +1519,18 @@ Send a WINS name release response. static void send_wins_name_release_response(int rcode, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - char rdata[6]; - - memcpy(&rdata[0], &nmb->additional->rdata[0], 6); - - reply_netbios_packet(p, /* Packet to reply to. */ - rcode, /* Result code. */ - NMB_REL, /* nmbd type code. */ - NMB_NAME_RELEASE_OPCODE, /* opcode. */ - 0, /* ttl. */ - rdata, /* data to send. */ - 6); /* data length. */ + struct nmb_packet *nmb = &p->packet.nmb; + char rdata[6]; + + memcpy(&rdata[0], &nmb->additional->rdata[0], 6); + + reply_netbios_packet(p, /* Packet to reply to. */ + rcode, /* Result code. */ + NMB_REL, /* nmbd type code. */ + NMB_NAME_RELEASE_OPCODE, /* opcode. */ + 0, /* ttl. */ + rdata, /* data to send. */ + 6); /* data length. */ } /*********************************************************************** @@ -1609,123 +1540,115 @@ static void send_wins_name_release_response(int rcode, struct packet_struct *p) void wins_process_name_release_request(struct subnet_record *subrec, struct packet_struct *p) { - struct nmb_packet *nmb = &p->packet.nmb; - struct nmb_name *question = &nmb->question.question_name; - BOOL bcast = nmb->header.nm_flags.bcast; - uint16 nb_flags = get_nb_flags(nmb->additional->rdata); - struct name_record *namerec = NULL; - struct in_addr from_ip; - BOOL releasing_group_name = (nb_flags & NB_GROUP) ? True : False;; - - putip((char *)&from_ip,&nmb->additional->rdata[2]); - - if(bcast) - { - /* - * We should only get unicast name registration packets here. - * Anyone trying to register broadcast should not be going to a WINS - * server. Log an error here. - */ - - DEBUG(0,("wins_process_name_release_request: broadcast name registration request \ + struct nmb_packet *nmb = &p->packet.nmb; + struct nmb_name *question = &nmb->question.question_name; + BOOL bcast = nmb->header.nm_flags.bcast; + uint16 nb_flags = get_nb_flags(nmb->additional->rdata); + struct name_record *namerec = NULL; + struct in_addr from_ip; + BOOL releasing_group_name = (nb_flags & NB_GROUP) ? True : False;; + + putip((char *)&from_ip,&nmb->additional->rdata[2]); + + if(bcast) { + /* + * We should only get unicast name registration packets here. + * Anyone trying to register broadcast should not be going to a WINS + * server. Log an error here. + */ + + DEBUG(0,("wins_process_name_release_request: broadcast name registration request \ received for name %s from IP %s on subnet %s. Error - should not be sent to WINS server\n", - nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); - return; - } + nmb_namestr(question), inet_ntoa(from_ip), subrec->subnet_name)); + return; + } - DEBUG(3,("wins_process_name_release_request: %s name release for name %s \ + DEBUG(3,("wins_process_name_release_request: %s name release for name %s \ IP %s\n", releasing_group_name ? "Group" : "Unique", nmb_namestr(question), inet_ntoa(from_ip) )); - /* - * Deal with policy regarding 0x1d names. - */ + /* + * Deal with policy regarding 0x1d names. + */ - if(!releasing_group_name && (question->name_type == 0x1d)) - { - DEBUG(3,("wins_process_name_release_request: Ignoring request \ + if(!releasing_group_name && (question->name_type == 0x1d)) { + DEBUG(3,("wins_process_name_release_request: Ignoring request \ to release name %s from IP %s.", nmb_namestr(question), inet_ntoa(p->ip) )); - send_wins_name_release_response(0, p); - return; - } + send_wins_name_release_response(0, p); + return; + } - /* - * See if the name already exists. - */ + /* + * See if the name already exists. + */ - namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); - - if( (namerec == NULL) - || ((namerec != NULL) && (namerec->data.source != REGISTER_NAME)) ) - { - send_wins_name_release_response(NAM_ERR, p); - return; - } - - /* - * Check that the sending machine has permission to release this name. - * If it's a group name not ending in 0x1c then just say yes and let - * the group time out. - */ - - if(releasing_group_name && (question->name_type != 0x1c)) - { - send_wins_name_release_response(0, p); - return; - } - - /* - * Check that the releasing node is on the list of IP addresses - * for this name. Disallow the release if not. - */ - - if(!find_ip_in_name_record(namerec, from_ip)) - { - DEBUG(3,("wins_process_name_release_request: Refusing request to \ + namerec = find_name_on_subnet(subrec, question, FIND_ANY_NAME); + + if( (namerec == NULL) || ((namerec != NULL) && (namerec->data.source != REGISTER_NAME)) ) { + send_wins_name_release_response(NAM_ERR, p); + return; + } + + /* + * Check that the sending machine has permission to release this name. + * If it's a group name not ending in 0x1c then just say yes and let + * the group time out. + */ + + if(releasing_group_name && (question->name_type != 0x1c)) { + send_wins_name_release_response(0, p); + return; + } + + /* + * Check that the releasing node is on the list of IP addresses + * for this name. Disallow the release if not. + */ + + if(!find_ip_in_name_record(namerec, from_ip)) { + DEBUG(3,("wins_process_name_release_request: Refusing request to \ release name %s as IP %s is not one of the known IP's for this name.\n", - nmb_namestr(question), inet_ntoa(from_ip) )); - send_wins_name_release_response(NAM_ERR, p); - return; - } - - /* - * Check if the record is active. IF it's already released - * or tombstoned, refuse the release. - */ - if (!WINS_STATE_ACTIVE(namerec)) { - DEBUG(3,("wins_process_name_release_request: Refusing request to \ -release name %s as this record is not anymore active.\n", - nmb_namestr(question) )); - send_wins_name_release_response(NAM_ERR, p); - return; - } - - /* - * Check if the record is a 0x1c group - * and has more then one ip - * remove only this address. - */ - - if(releasing_group_name && - (question->name_type == 0x1c) && - (namerec->data.num_ips > 1)) { - remove_ip_from_name_record(namerec, from_ip); - DEBUG(3,("wins_process_name_release_request: Remove IP %s from NAME: %s\n", - inet_ntoa(from_ip),nmb_namestr(question))); - send_wins_name_release_response(0, p); - return; - } + nmb_namestr(question), inet_ntoa(from_ip) )); + send_wins_name_release_response(NAM_ERR, p); + return; + } + + /* + * Check if the record is active. IF it's already released + * or tombstoned, refuse the release. + */ - /* - * Send a release response. - * Flag the name as released and update the ttl - */ + if (!WINS_STATE_ACTIVE(namerec)) { + DEBUG(3,("wins_process_name_release_request: Refusing request to \ +release name %s as this record is not active anymore.\n", nmb_namestr(question) )); + send_wins_name_release_response(NAM_ERR, p); + return; + } + + /* + * Check if the record is a 0x1c group + * and has more then one ip + * remove only this address. + */ + + if(releasing_group_name && (question->name_type == 0x1c) && (namerec->data.num_ips > 1)) { + remove_ip_from_name_record(namerec, from_ip); + DEBUG(3,("wins_process_name_release_request: Remove IP %s from NAME: %s\n", + inet_ntoa(from_ip),nmb_namestr(question))); + send_wins_name_release_response(0, p); + return; + } + + /* + * Send a release response. + * Flag the name as released and update the ttl + */ - send_wins_name_release_response(0, p); + send_wins_name_release_response(0, p); - namerec->data.wins_flags |= WINS_RELEASED; - update_name_ttl(namerec, EXTINCTION_INTERVAL); + namerec->data.wins_flags |= WINS_RELEASED; + update_name_ttl(namerec, EXTINCTION_INTERVAL); - wins_hook("delete", namerec, 0); + wins_hook("delete", namerec, 0); } /******************************************************************* @@ -1817,94 +1740,89 @@ we are not the wins owner !\n", nmb_namestr(&namerec->name))); /******************************************************************* Write out the current WINS database. ******************************************************************/ + void wins_write_database(BOOL background) { - struct name_record *namerec; - pstring fname, fnamenew; + struct name_record *namerec; + pstring fname, fnamenew; - XFILE *fp; + XFILE *fp; - if(!lp_we_are_a_wins_server()) - return; - - /* we will do the writing in a child process to ensure that the parent - doesn't block while this is done */ - if (background) { - CatchChild(); - if (sys_fork()) { - return; - } - } - - slprintf(fname,sizeof(fname)-1,"%s/%s", lp_lockdir(), WINS_LIST); - all_string_sub(fname,"//", "/", 0); - slprintf(fnamenew,sizeof(fnamenew)-1,"%s.%u", fname, (unsigned int)sys_getpid()); - - if((fp = x_fopen(fnamenew,O_WRONLY|O_CREAT,0644)) == NULL) - { - DEBUG(0,("wins_write_database: Can't open %s. Error was %s\n", fnamenew, strerror(errno))); - if (background) { - _exit(0); - } - return; - } - - DEBUG(4,("wins_write_database: Dump of WINS name list.\n")); - - x_fprintf(fp,"VERSION %d %u\n", WINS_VERSION, 0); + if(!lp_we_are_a_wins_server()) + return; + + /* We will do the writing in a child process to ensure that the parent doesn't block while this is done */ + if (background) { + CatchChild(); + if (sys_fork()) { + return; + } + } + + slprintf(fname,sizeof(fname)-1,"%s/%s", lp_lockdir(), WINS_LIST); + all_string_sub(fname,"//", "/", 0); + slprintf(fnamenew,sizeof(fnamenew)-1,"%s.%u", fname, (unsigned int)sys_getpid()); + + if((fp = x_fopen(fnamenew,O_WRONLY|O_CREAT,0644)) == NULL) { + DEBUG(0,("wins_write_database: Can't open %s. Error was %s\n", fnamenew, strerror(errno))); + if (background) { + _exit(0); + } + return; + } + + DEBUG(4,("wins_write_database: Dump of WINS name list.\n")); + + x_fprintf(fp,"VERSION %d %u\n", WINS_VERSION, 0); - for( namerec - = (struct name_record *)ubi_trFirst( wins_server_subnet->namelist ); - namerec; - namerec = (struct name_record *)ubi_trNext( namerec ) ) - { - int i; - struct tm *tm; - - DEBUGADD(4,("%-19s ", nmb_namestr(&namerec->name) )); - - if( namerec->data.death_time != PERMANENT_TTL ) - { - char *ts, *nl; - - tm = LocalTime(&namerec->data.death_time); - ts = asctime(tm); - nl = strrchr( ts, '\n' ); - if( NULL != nl ) - *nl = '\0'; - DEBUGADD(4,("TTL = %s ", ts )); - } - else - DEBUGADD(4,("TTL = PERMANENT ")); - - for (i = 0; i < namerec->data.num_ips; i++) - DEBUGADD(4,("%15s ", inet_ntoa(namerec->data.ip[i]) )); - DEBUGADD(4,("%2x\n", namerec->data.nb_flags )); - - if( namerec->data.source == REGISTER_NAME ) - { - x_fprintf(fp, "\"%s#%02x\" %d ", - namerec->name.name,namerec->name.name_type, /* Ignore scope. */ - (int)namerec->data.death_time); - - for (i = 0; i < namerec->data.num_ips; i++) - x_fprintf( fp, "%s ", inet_ntoa( namerec->data.ip[i] ) ); - x_fprintf( fp, "%2xR\n", namerec->data.nb_flags ); - } - } + for( namerec = (struct name_record *)ubi_trFirst( wins_server_subnet->namelist ); namerec; namerec = (struct name_record *)ubi_trNext( namerec ) ) { + int i; + struct tm *tm; + + DEBUGADD(4,("%-19s ", nmb_namestr(&namerec->name) )); + + if( namerec->data.death_time != PERMANENT_TTL ) { + char *ts, *nl; + + tm = LocalTime(&namerec->data.death_time); + ts = asctime(tm); + nl = strrchr( ts, '\n' ); + if( NULL != nl ) + *nl = '\0'; + DEBUGADD(4,("TTL = %s ", ts )); + } else { + DEBUGADD(4,("TTL = PERMANENT ")); + } + + for (i = 0; i < namerec->data.num_ips; i++) + DEBUGADD(4,("%15s ", inet_ntoa(namerec->data.ip[i]) )); + DEBUGADD(4,("%2x\n", namerec->data.nb_flags )); + + if( namerec->data.source == REGISTER_NAME ) { + nstring name; + pull_ascii_nstring(name, namerec->name.name); + x_fprintf(fp, "\"%s#%02x\" %d ", name,namerec->name.name_type, /* Ignore scope. */ + (int)namerec->data.death_time); + + for (i = 0; i < namerec->data.num_ips; i++) + x_fprintf( fp, "%s ", inet_ntoa( namerec->data.ip[i] ) ); + x_fprintf( fp, "%2xR\n", namerec->data.nb_flags ); + } + } - x_fclose(fp); - chmod(fnamenew,0644); - unlink(fname); - rename(fnamenew,fname); - if (background) { - _exit(0); - } + x_fclose(fp); + chmod(fnamenew,0644); + unlink(fname); + rename(fnamenew,fname); + if (background) { + _exit(0); + } } /**************************************************************************** -process a internal Samba message receiving a wins record + Process a internal Samba message receiving a wins record. ***************************************************************************/ + void nmbd_wins_new_entry(int msg_type, pid_t src, void *buf, size_t len) { WINS_RECORD *record; @@ -1918,11 +1836,10 @@ void nmbd_wins_new_entry(int msg_type, pid_t src, void *buf, size_t len) if (buf==NULL) return; + /* Record should use UNIX codepage. Ensure this is so in the wrepld code. JRA. */ record=(WINS_RECORD *)buf; - ZERO_STRUCT(question); - memcpy(question.name, record->name, 16); - question.name_type=record->type; + make_nmb_name(&question, record->name, record->type); namerec = find_name_on_subnet(wins_server_subnet, &question, FIND_ANY_NAME); @@ -1994,9 +1911,9 @@ void nmbd_wins_new_entry(int msg_type, pid_t src, void *buf, size_t len) for (i=0; inum_ips; i++) if(!find_ip_in_name_record(namerec, record->ip[i])) add_ip_to_name_record(namerec, record->ip[i]); - } - else + } else { overwrite=True; + } } /* the replica is a multihomed host */ @@ -2050,11 +1967,3 @@ void nmbd_wins_new_entry(int msg_type, pid_t src, void *buf, size_t len) } } - - - - - - - - diff --git a/source3/nmbd/nmbd_workgroupdb.c b/source3/nmbd/nmbd_workgroupdb.c index 2357fd637b..b9fab4b278 100644 --- a/source3/nmbd/nmbd_workgroupdb.c +++ b/source3/nmbd/nmbd_workgroupdb.c @@ -31,7 +31,7 @@ int workgroup_count = 0; /* unique index key: one for each workgroup */ /**************************************************************************** Add a workgroup into the list. - **************************************************************************/ +**************************************************************************/ static void add_workgroup(struct subnet_record *subrec, struct work_record *work) { @@ -42,164 +42,160 @@ static void add_workgroup(struct subnet_record *subrec, struct work_record *work /**************************************************************************** Create an empty workgroup. - **************************************************************************/ +**************************************************************************/ static struct work_record *create_workgroup(const char *name, int ttl) { - struct work_record *work; - struct subnet_record *subrec; - int t = -1; + struct work_record *work; + struct subnet_record *subrec; + int t = -1; - if((work = (struct work_record *)malloc(sizeof(*work))) == NULL) - { - DEBUG(0,("create_workgroup: malloc fail !\n")); - return NULL; - } - memset((char *)work, '\0', sizeof(*work)); + if((work = (struct work_record *)malloc(sizeof(*work))) == NULL) { + DEBUG(0,("create_workgroup: malloc fail !\n")); + return NULL; + } + memset((char *)work, '\0', sizeof(*work)); - fstrcpy(work->work_group,name); - work->serverlist = NULL; + if (strlen(name)+1 > sizeof(nstring)) { + memcpy(work->work_group,name,sizeof(nstring)-1); + work->work_group[sizeof(nstring)-1] = '\0'; + DEBUG(0,("create_workgroup: workgroup name %s is too long. Truncating to %s\n", + name, work->work_group )); + } else { + nstrcpy(work->work_group,name); + } + work->serverlist = NULL; - work->RunningElection = False; - work->ElectionCount = 0; - work->announce_interval = 0; - work->needelection = False; - work->needannounce = True; - work->lastannounce_time = time(NULL); - work->mst_state = lp_local_master() ? MST_POTENTIAL : MST_NONE; - work->dom_state = DOMAIN_NONE; - work->log_state = LOGON_NONE; + work->RunningElection = False; + work->ElectionCount = 0; + work->announce_interval = 0; + work->needelection = False; + work->needannounce = True; + work->lastannounce_time = time(NULL); + work->mst_state = lp_local_master() ? MST_POTENTIAL : MST_NONE; + work->dom_state = DOMAIN_NONE; + work->log_state = LOGON_NONE; - work->death_time = (ttl != PERMANENT_TTL) ? time(NULL)+(ttl*3) : PERMANENT_TTL; + work->death_time = (ttl != PERMANENT_TTL) ? time(NULL)+(ttl*3) : PERMANENT_TTL; - /* Make sure all token representations of workgroups are unique. */ + /* Make sure all token representations of workgroups are unique. */ - for (subrec = FIRST_SUBNET; subrec && (t == -1); - subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) - { - struct work_record *w; - for (w = subrec->workgrouplist; w && t == -1; w = w->next) - { - if (strequal(w->work_group, work->work_group)) - t = w->token; - } - } + for (subrec = FIRST_SUBNET; subrec && (t == -1); subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) { + struct work_record *w; + for (w = subrec->workgrouplist; w && t == -1; w = w->next) { + if (strnequal(w->work_group, work->work_group, sizeof(nstring)-1)) + t = w->token; + } + } - if (t == -1) - work->token = ++workgroup_count; - else - work->token = t; + if (t == -1) + work->token = ++workgroup_count; + else + work->token = t; - /* No known local master browser as yet. */ - *work->local_master_browser_name = '\0'; - - /* No known domain master browser as yet. */ - *work->dmb_name.name = '\0'; - zero_ip(&work->dmb_addr); - - /* WfWg uses 01040b01 */ - /* Win95 uses 01041501 */ - /* NTAS uses ???????? */ - work->ElectionCriterion = (MAINTAIN_LIST)|(BROWSER_ELECTION_VERSION<<8); - work->ElectionCriterion |= (lp_os_level() << 24); - if (lp_domain_master()) - work->ElectionCriterion |= 0x80; + /* No known local master browser as yet. */ + *work->local_master_browser_name = '\0'; + + /* No known domain master browser as yet. */ + *work->dmb_name.name = '\0'; + zero_ip(&work->dmb_addr); + + /* WfWg uses 01040b01 */ + /* Win95 uses 01041501 */ + /* NTAS uses ???????? */ + work->ElectionCriterion = (MAINTAIN_LIST)|(BROWSER_ELECTION_VERSION<<8); + work->ElectionCriterion |= (lp_os_level() << 24); + if (lp_domain_master()) + work->ElectionCriterion |= 0x80; - return work; + return work; } /******************************************************************* Remove a workgroup. - ******************************************************************/ +******************************************************************/ static struct work_record *remove_workgroup_from_subnet(struct subnet_record *subrec, struct work_record *work) { - struct work_record *ret_work = NULL; + struct work_record *ret_work = NULL; - DEBUG(3,("remove_workgroup: Removing workgroup %s\n", work->work_group)); + DEBUG(3,("remove_workgroup: Removing workgroup %s\n", work->work_group)); - ret_work = work->next; + ret_work = work->next; - remove_all_servers(work); + remove_all_servers(work); - if (!work->serverlist) - { - if (work->prev) - work->prev->next = work->next; - if (work->next) - work->next->prev = work->prev; + if (!work->serverlist) { + if (work->prev) + work->prev->next = work->next; + if (work->next) + work->next->prev = work->prev; - if (subrec->workgrouplist == work) - subrec->workgrouplist = work->next; + if (subrec->workgrouplist == work) + subrec->workgrouplist = work->next; - ZERO_STRUCTP(work); - SAFE_FREE(work); - } + ZERO_STRUCTP(work); + SAFE_FREE(work); + } - subrec->work_changed = True; + subrec->work_changed = True; - return ret_work; + return ret_work; } - /**************************************************************************** Find a workgroup in the workgroup list of a subnet. - **************************************************************************/ +**************************************************************************/ struct work_record *find_workgroup_on_subnet(struct subnet_record *subrec, const char *name) { - struct work_record *ret; + struct work_record *ret; - DEBUG(4, ("find_workgroup_on_subnet: workgroup search for %s on subnet %s: ", - name, subrec->subnet_name)); + DEBUG(4, ("find_workgroup_on_subnet: workgroup search for %s on subnet %s: ", + name, subrec->subnet_name)); - for (ret = subrec->workgrouplist; ret; ret = ret->next) - { - if (!strcmp(ret->work_group,name)) - { - DEBUGADD(4, ("found.\n")); - return(ret); - } - } - DEBUGADD(4, ("not found.\n")); - return NULL; + for (ret = subrec->workgrouplist; ret; ret = ret->next) { + if (strnequal(ret->work_group,name,sizeof(nstring)-1)) { + DEBUGADD(4, ("found.\n")); + return(ret); + } + } + DEBUGADD(4, ("not found.\n")); + return NULL; } /**************************************************************************** Create a workgroup in the workgroup list of the subnet. - **************************************************************************/ +**************************************************************************/ struct work_record *create_workgroup_on_subnet(struct subnet_record *subrec, const char *name, int ttl) { - struct work_record *work = NULL; + struct work_record *work = NULL; - DEBUG(4,("create_workgroup_on_subnet: creating group %s on subnet %s\n", - name, subrec->subnet_name)); + DEBUG(4,("create_workgroup_on_subnet: creating group %s on subnet %s\n", + name, subrec->subnet_name)); - if ((work = create_workgroup(name, ttl))) - { - add_workgroup(subrec, work); - - subrec->work_changed = True; + if ((work = create_workgroup(name, ttl))) { + add_workgroup(subrec, work); + subrec->work_changed = True; + return(work); + } - return(work); - } - - return NULL; + return NULL; } /**************************************************************************** Update a workgroup ttl. - **************************************************************************/ +**************************************************************************/ void update_workgroup_ttl(struct work_record *work, int ttl) { - if(work->death_time != PERMANENT_TTL) - work->death_time = time(NULL)+(ttl*3); - work->subnet->work_changed = True; + if(work->death_time != PERMANENT_TTL) + work->death_time = time(NULL)+(ttl*3); + work->subnet->work_changed = True; } /**************************************************************************** @@ -210,8 +206,8 @@ void update_workgroup_ttl(struct work_record *work, int ttl) static void fail_register(struct subnet_record *subrec, struct response_record *rrec, struct nmb_name *nmbname) { - DEBUG(0,("fail_register: Failed to register name %s on subnet %s.\n", - nmb_namestr(nmbname), subrec->subnet_name)); + DEBUG(0,("fail_register: Failed to register name %s on subnet %s.\n", + nmb_namestr(nmbname), subrec->subnet_name)); } /**************************************************************************** @@ -220,50 +216,38 @@ static void fail_register(struct subnet_record *subrec, struct response_record * void initiate_myworkgroup_startup(struct subnet_record *subrec, struct work_record *work) { - int i; + int i; - if(!strequal(lp_workgroup(), work->work_group)) - return; + if(!strnequal(lp_workgroup(), work->work_group,sizeof(nstring)-1)) + return; - /* If this is a broadcast subnet then start elections on it - if we are so configured. */ + /* If this is a broadcast subnet then start elections on it if we are so configured. */ - if ((subrec != unicast_subnet) && (subrec != remote_broadcast_subnet) && - (subrec != wins_server_subnet) && lp_preferred_master() && - lp_local_master()) - { - DEBUG(3, ("initiate_myworkgroup_startup: preferred master startup for \ + if ((subrec != unicast_subnet) && (subrec != remote_broadcast_subnet) && + (subrec != wins_server_subnet) && lp_preferred_master() && lp_local_master()) { + DEBUG(3, ("initiate_myworkgroup_startup: preferred master startup for \ workgroup %s on subnet %s\n", work->work_group, subrec->subnet_name)); - work->needelection = True; - work->ElectionCriterion |= (1<<3); - } + work->needelection = True; + work->ElectionCriterion |= (1<<3); + } - /* Register the WORKGROUP<0> and WORKGROUP<1e> names on the network. */ + /* Register the WORKGROUP<0> and WORKGROUP<1e> names on the network. */ - register_name(subrec,lp_workgroup(),0x0,samba_nb_type|NB_GROUP, - NULL, - fail_register,NULL); - - register_name(subrec,lp_workgroup(),0x1e,samba_nb_type|NB_GROUP, - NULL, - fail_register,NULL); - - for( i = 0; my_netbios_names(i); i++) - { - const char *name = my_netbios_names(i); - int stype = lp_default_server_announce() | (lp_local_master() ? - SV_TYPE_POTENTIAL_BROWSER : 0 ); + register_name(subrec,lp_workgroup(),0x0,samba_nb_type|NB_GROUP, NULL, fail_register,NULL); + register_name(subrec,lp_workgroup(),0x1e,samba_nb_type|NB_GROUP, NULL, fail_register,NULL); + + for( i = 0; my_netbios_names(i); i++) { + const char *name = my_netbios_names(i); + int stype = lp_default_server_announce() | (lp_local_master() ? SV_TYPE_POTENTIAL_BROWSER : 0 ); - if(!strequal(global_myname(), name)) - stype &= ~(SV_TYPE_MASTER_BROWSER|SV_TYPE_POTENTIAL_BROWSER| - SV_TYPE_DOMAIN_MASTER|SV_TYPE_DOMAIN_MEMBER); + if(!strequal(global_myname(), name)) + stype &= ~(SV_TYPE_MASTER_BROWSER|SV_TYPE_POTENTIAL_BROWSER|SV_TYPE_DOMAIN_MASTER|SV_TYPE_DOMAIN_MEMBER); - create_server_on_workgroup(work,name,stype|SV_TYPE_LOCAL_LIST_ONLY, - PERMANENT_TTL, - string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH)); - DEBUG(3,("initiate_myworkgroup_startup: Added server name entry %s \ + create_server_on_workgroup(work,name,stype|SV_TYPE_LOCAL_LIST_ONLY, PERMANENT_TTL, + string_truncate(lp_serverstring(), MAX_SERVER_STRING_LENGTH)); + DEBUG(3,("initiate_myworkgroup_startup: Added server name entry %s \ on subnet %s\n", name, subrec->subnet_name)); - } + } } /**************************************************************************** @@ -272,43 +256,34 @@ on subnet %s\n", name, subrec->subnet_name)); void dump_workgroups(BOOL force_write) { - struct subnet_record *subrec; - int debuglevel = force_write ? 0 : 4; + struct subnet_record *subrec; + int debuglevel = force_write ? 0 : 4; - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) - { - if (subrec->workgrouplist) - { - struct work_record *work; - - if( DEBUGLVL( debuglevel ) ) - { - dbgtext( "dump_workgroups()\n " ); - dbgtext( "dump workgroup on subnet %15s: ", subrec->subnet_name ); - dbgtext( "netmask=%15s:\n", inet_ntoa(subrec->mask_ip) ); - } - - for (work = subrec->workgrouplist; work; work = work->next) - { - DEBUGADD( debuglevel, ( "\t%s(%d) current master browser = %s\n", - work->work_group, - work->token, - *work->local_master_browser_name - ? work->local_master_browser_name : "UNKNOWN" ) ); - if (work->serverlist) - { - struct server_record *servrec; - for (servrec = work->serverlist; servrec; servrec = servrec->next) - { - DEBUGADD( debuglevel, ( "\t\t%s %8x (%s)\n", - servrec->serv.name, - servrec->serv.type, - servrec->serv.comment ) ); - } - } - } - } - } + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) { + if (subrec->workgrouplist) { + struct work_record *work; + + if( DEBUGLVL( debuglevel ) ) { + dbgtext( "dump_workgroups()\n " ); + dbgtext( "dump workgroup on subnet %15s: ", subrec->subnet_name ); + dbgtext( "netmask=%15s:\n", inet_ntoa(subrec->mask_ip) ); + } + + for (work = subrec->workgrouplist; work; work = work->next) { + DEBUGADD( debuglevel, ( "\t%s(%d) current master browser = %s\n", work->work_group, + work->token, *work->local_master_browser_name ? work->local_master_browser_name : "UNKNOWN" ) ); + if (work->serverlist) { + struct server_record *servrec; + for (servrec = work->serverlist; servrec; servrec = servrec->next) { + DEBUGADD( debuglevel, ( "\t\t%s %8x (%s)\n", + servrec->serv.name, + servrec->serv.type, + servrec->serv.comment ) ); + } + } + } + } + } } /**************************************************************************** @@ -318,25 +293,22 @@ void dump_workgroups(BOOL force_write) void expire_workgroups_and_servers(time_t t) { - struct subnet_record *subrec; + struct subnet_record *subrec; - for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) - { - struct work_record *work; - struct work_record *nextwork; - - for (work = subrec->workgrouplist; work; work = nextwork) - { - nextwork = work->next; - expire_servers(work, t); - - if ((work->serverlist == NULL) && (work->death_time != PERMANENT_TTL) && - ((t == -1) || (work->death_time < t))) - { - DEBUG(3,("expire_workgroups_and_servers: Removing timed out workgroup %s\n", - work->work_group)); - remove_workgroup_from_subnet(subrec, work); - } - } - } + for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_INCLUDING_UNICAST(subrec)) { + struct work_record *work; + struct work_record *nextwork; + + for (work = subrec->workgrouplist; work; work = nextwork) { + nextwork = work->next; + expire_servers(work, t); + + if ((work->serverlist == NULL) && (work->death_time != PERMANENT_TTL) && + ((t == -1) || (work->death_time < t))) { + DEBUG(3,("expire_workgroups_and_servers: Removing timed out workgroup %s\n", + work->work_group)); + remove_workgroup_from_subnet(subrec, work); + } + } + } } diff --git a/source3/nsswitch/pam_winbind.h b/source3/nsswitch/pam_winbind.h index fae635d806..0afcceb6aa 100644 --- a/source3/nsswitch/pam_winbind.h +++ b/source3/nsswitch/pam_winbind.h @@ -25,15 +25,18 @@ #define PAM_SM_ACCOUNT #define PAM_SM_PASSWORD -#if defined(SUNOS5) || defined(SUNOS4) || defined(HPUX) +#if defined(SUNOS5) || defined(SUNOS4) || defined(HPUX) || defined(FREEBSD) /* Solaris always uses dynamic pam modules */ #define PAM_EXTERN extern #include +#ifndef PAM_AUTHTOK_RECOVER_ERR #define PAM_AUTHTOK_RECOVER_ERR PAM_AUTHTOK_RECOVERY_ERR #endif +#endif + #ifdef HAVE_SECURITY_PAM_MODULES_H #include #endif diff --git a/source3/nsswitch/wb_client.c b/source3/nsswitch/wb_client.c index 7c5a8dd054..0c6644e9d0 100644 --- a/source3/nsswitch/wb_client.c +++ b/source3/nsswitch/wb_client.c @@ -264,6 +264,80 @@ static int wb_getgroups(const char *user, gid_t **groups) return -1; } +/* Call winbindd to initialise group membership. This is necessary for + some systems (i.e RH5.2) that do not have an initgroups function as part + of the nss extension. In RH5.2 this is implemented using getgrent() + which can be amazingly inefficient as well as having problems with + username case. */ + +int winbind_initgroups(char *user, gid_t gid) +{ + gid_t *tgr, *groups = NULL; + int result; + + /* Call normal initgroups if we are a local user */ + + if (!strchr(user, *lp_winbind_separator())) { + return initgroups(user, gid); + } + + result = wb_getgroups(user, &groups); + + DEBUG(10,("winbind_getgroups: %s: result = %s\n", user, + result == -1 ? "FAIL" : "SUCCESS")); + + if (result != -1) { + int ngroups = result, i; + BOOL is_member = False; + + /* Check to see if the passed gid is already in the list */ + + for (i = 0; i < ngroups; i++) { + if (groups[i] == gid) { + is_member = True; + } + } + + /* Add group to list if necessary */ + + if (!is_member) { + tgr = (gid_t *)Realloc(groups, sizeof(gid_t) * ngroups + 1); + + if (!tgr) { + errno = ENOMEM; + result = -1; + goto done; + } + else groups = tgr; + + groups[ngroups] = gid; + ngroups++; + } + + /* Set the groups */ + + if (sys_setgroups(ngroups, groups) == -1) { + errno = EPERM; + result = -1; + goto done; + } + + } else { + + /* The call failed. Set errno to something so we don't get + a bogus value from the last failed system call. */ + + errno = EIO; + } + + /* Free response data if necessary */ + + done: + SAFE_FREE(groups); + + return result; +} + /* Return a list of groups the user is a member of. This function is useful for large systems where inverting the group database would be too time consuming. If size is zero, list is not modified and the total diff --git a/source3/nsswitch/wbinfo.c b/source3/nsswitch/wbinfo.c index fcd7d2d508..0018e99f60 100644 --- a/source3/nsswitch/wbinfo.c +++ b/source3/nsswitch/wbinfo.c @@ -3,7 +3,7 @@ Winbind status program. - Copyright (C) Tim Potter 2000-2002 + Copyright (C) Tim Potter 2000-2003 Copyright (C) Andrew Bartlett 2002 This program is free software; you can redistribute it and/or modify @@ -219,15 +219,20 @@ static BOOL wbinfo_list_domains(void) /* show sequence numbers */ -static BOOL wbinfo_show_sequence(void) +static BOOL wbinfo_show_sequence(const char *domain) { + struct winbindd_request request; struct winbindd_response response; ZERO_STRUCT(response); + ZERO_STRUCT(request); + + if ( domain ) + fstrcpy( request.domain_name, domain ); /* Send request */ - if (winbindd_request(WINBINDD_SHOW_SEQUENCE, NULL, &response) != + if (winbindd_request(WINBINDD_SHOW_SEQUENCE, &request, &response) != NSS_STATUS_SUCCESS) return False; @@ -481,9 +486,18 @@ static BOOL wbinfo_auth_crap(char *username) parse_wbinfo_domain_user(username, name_domain, name_user); - fstrcpy(request.data.auth_crap.user, name_user); + if (push_utf8_fstring(request.data.auth_crap.user, name_user) == -1) { + d_printf("unable to create utf8 string for '%s'\n", + name_user); + return False; + } - fstrcpy(request.data.auth_crap.domain, name_domain); + if (push_utf8_fstring(request.data.auth_crap.domain, + name_domain) == -1) { + d_printf("unable to create utf8 string for '%s'\n", + name_domain); + return False; + } generate_random_buffer(request.data.auth_crap.chal, 8, False); @@ -682,17 +696,27 @@ static BOOL wbinfo_remove_user_from_group(char *string) /* Print domain users */ -static BOOL print_domain_users(void) +static BOOL print_domain_users(const char *domain) { + struct winbindd_request request; struct winbindd_response response; const char *extra_data; fstring name; /* Send request to winbind daemon */ + ZERO_STRUCT(request); ZERO_STRUCT(response); + + if (domain) { + /* '.' is the special sign for our own domwin */ + if ( strequal(domain, ".") ) + fstrcpy( request.domain_name, lp_workgroup() ); + else + fstrcpy( request.domain_name, domain ); + } - if (winbindd_request(WINBINDD_LIST_USERS, NULL, &response) != + if (winbindd_request(WINBINDD_LIST_USERS, &request, &response) != NSS_STATUS_SUCCESS) return False; @@ -713,15 +737,24 @@ static BOOL print_domain_users(void) /* Print domain groups */ -static BOOL print_domain_groups(void) +static BOOL print_domain_groups(const char *domain) { + struct winbindd_request request; struct winbindd_response response; const char *extra_data; fstring name; + ZERO_STRUCT(request); ZERO_STRUCT(response); - if (winbindd_request(WINBINDD_LIST_GROUPS, NULL, &response) != + if (domain) { + if ( strequal(domain, ".") ) + fstrcpy( request.domain_name, lp_workgroup() ); + else + fstrcpy( request.domain_name, domain ); + } + + if (winbindd_request(WINBINDD_LIST_GROUPS, &request, &response) != NSS_STATUS_SUCCESS) return False; @@ -845,6 +878,7 @@ static BOOL wbinfo_ping(void) enum { OPT_SET_AUTH_USER = 1000, OPT_GET_AUTH_USER, + OPT_DOMAIN_NAME, OPT_SEQUENCE }; @@ -854,8 +888,8 @@ int main(int argc, char **argv) poptContext pc; static char *string_arg; + static char *opt_domain_name; static int int_arg; - BOOL got_command = False; int result = 1; struct poptOption long_options[] = { @@ -864,8 +898,8 @@ int main(int argc, char **argv) /* longName, shortName, argInfo, argPtr, value, descrip, argDesc */ - { "domain-users", 'u', POPT_ARG_NONE, 0, 'u', "Lists all domain users"}, - { "domain-groups", 'g', POPT_ARG_NONE, 0, 'g', "Lists all domain groups" }, + { "domain-users", 'u', POPT_ARG_NONE, 0, 'u', "Lists all domain users", "domain"}, + { "domain-groups", 'g', POPT_ARG_NONE, 0, 'g', "Lists all domain groups", "domain" }, { "WINS-by-name", 'N', POPT_ARG_STRING, &string_arg, 'N', "Converts NetBIOS name to IP", "NETBIOS-NAME" }, { "WINS-by-ip", 'I', POPT_ARG_STRING, &string_arg, 'I', "Converts IP address to NetBIOS name", "IP" }, { "name-to-sid", 'n', POPT_ARG_STRING, &string_arg, 'n', "Converts name to sid", "NAME" }, @@ -888,6 +922,7 @@ int main(int argc, char **argv) { "set-auth-user", 0, POPT_ARG_STRING, &string_arg, OPT_SET_AUTH_USER, "Store user and password used by winbindd (root only)", "user%password" }, { "get-auth-user", 0, POPT_ARG_NONE, NULL, OPT_GET_AUTH_USER, "Retrieve user and password used by winbindd (root only)", NULL }, { "ping", 'p', POPT_ARG_NONE, 0, 'p', "Ping winbindd to see if it is alive" }, + { "domain", 0, POPT_ARG_STRING, &opt_domain_name, OPT_DOMAIN_NAME, "Define to the domain to restrict operatio", "domain" }, POPT_COMMON_VERSION POPT_TABLEEND }; @@ -917,11 +952,7 @@ int main(int argc, char **argv) } while((opt = poptGetNextOpt(pc)) != -1) { - if (got_command) { - d_fprintf(stderr, "No more than one command may be specified at once.\n"); - exit(1); - } - got_command = True; + /* get the generic configuration parameters like --domain */ } poptFreeContext(pc); @@ -932,13 +963,13 @@ int main(int argc, char **argv) while((opt = poptGetNextOpt(pc)) != -1) { switch (opt) { case 'u': - if (!print_domain_users()) { + if (!print_domain_users(opt_domain_name)) { d_printf("Error looking up domain users\n"); goto done; } break; case 'g': - if (!print_domain_groups()) { + if (!print_domain_groups(opt_domain_name)) { d_printf("Error looking up domain groups\n"); goto done; } @@ -1007,7 +1038,7 @@ int main(int argc, char **argv) } break; case OPT_SEQUENCE: - if (!wbinfo_show_sequence()) { + if (!wbinfo_show_sequence(opt_domain_name)) { d_printf("Could not show sequence numbers\n"); goto done; } @@ -1086,6 +1117,9 @@ int main(int argc, char **argv) case OPT_GET_AUTH_USER: wbinfo_get_auth_user(); break; + /* generic configuration options */ + case OPT_DOMAIN_NAME: + break; default: d_fprintf(stderr, "Invalid option\n"); poptPrintHelp(pc, stderr, 0); diff --git a/source3/nsswitch/winbindd.c b/source3/nsswitch/winbindd.c index 8345fa11d0..6a0056f917 100644 --- a/source3/nsswitch/winbindd.c +++ b/source3/nsswitch/winbindd.c @@ -570,9 +570,9 @@ static void process_loop(void) message_dispatch(); - /* rescan the trusted domains list. This must be done - regularly to cope with transitive trusts */ - rescan_trusted_domains(False); + /* refresh the trusted domain cache */ + + rescan_trusted_domains(); /* Free up temporary memory */ @@ -829,7 +829,7 @@ int main(int argc, char **argv) setup_logging("winbindd", log_stdout); reopen_logs(); - DEBUG(1, ("winbindd version %s started.\n", VERSION ) ); + DEBUG(1, ("winbindd version %s started.\n", SAMBA_VERSION_STRING) ); DEBUGADD( 1, ( "Copyright The Samba Team 2000-2003\n" ) ); if (!reload_services_file(False)) { diff --git a/source3/nsswitch/winbindd_acct.c b/source3/nsswitch/winbindd_acct.c index 8abfd17110..0c06df7fdd 100644 --- a/source3/nsswitch/winbindd_acct.c +++ b/source3/nsswitch/winbindd_acct.c @@ -70,18 +70,13 @@ static BOOL winbindd_accountdb_init(void) if ( account_tdb ) return True; - - /* Nope. Try to open it */ - if (!(account_tdb = tdb_open_log(lock_path("winbindd_idmap.tdb"), 0, - TDB_DEFAULT, O_RDWR | O_CREAT, 0600))) - { - /* last chance -- maybe idmap has already opened it */ - if ( !(account_tdb = idmap_tdb_handle()) ) { + /* winbindd_idmap.tdb should always be opened by the idmap_init() + code first */ - DEBUG(0, ("winbindd_idmap_init: Unable to open idmap database\n")); - return False; - } + if ( !(account_tdb = idmap_tdb_handle()) ) { + DEBUG(0, ("winbindd_accountdb_init: Unable to retreive handle for database\n")); + return False; } /* yeah! */ diff --git a/source3/nsswitch/winbindd_ads.c b/source3/nsswitch/winbindd_ads.c index 7140dc35a0..c64359a224 100644 --- a/source3/nsswitch/winbindd_ads.c +++ b/source3/nsswitch/winbindd_ads.c @@ -28,10 +28,6 @@ #undef DBGC_CLASS #define DBGC_CLASS DBGC_WINBIND -/* the realm of our primary LDAP server */ -static char *primary_realm; - - /* return our ads connections structure for a domain. We keep the connection open to make things faster @@ -58,10 +54,8 @@ static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain) SAFE_FREE(ads->auth.password); ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); - if (primary_realm) { - SAFE_FREE(ads->auth.realm); - ads->auth.realm = strdup(primary_realm); - } + SAFE_FREE(ads->auth.realm); + ads->auth.realm = strdup(lp_realm()); status = ads_connect(ads); if (!ADS_ERR_OK(status) || !ads->config.realm) { @@ -84,11 +78,6 @@ static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain) return NULL; } - /* remember our primary realm for trusted domain support */ - if (!primary_realm) { - primary_realm = strdup(ads->config.realm); - } - domain->private = (void *)ads; return ads; } @@ -123,7 +112,7 @@ static NTSTATUS query_user_list(struct winbindd_domain *domain, } rc = ads_search_retry(ads, &res, "(objectCategory=user)", attrs); - if (!ADS_ERR_OK(rc)) { + if (!ADS_ERR_OK(rc) || !res) { DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc))); goto done; } @@ -190,7 +179,8 @@ static NTSTATUS query_user_list(struct winbindd_domain *domain, DEBUG(3,("ads query_user_list gave %d entries\n", (*num_entries))); done: - if (res) ads_msgfree(ads, res); + if (res) + ads_msgfree(ads, res); return status; } @@ -224,7 +214,7 @@ static NTSTATUS enum_dom_groups(struct winbindd_domain *domain, } rc = ads_search_retry(ads, &res, "(objectCategory=group)", attrs); - if (!ADS_ERR_OK(rc)) { + if (!ADS_ERR_OK(rc) || !res) { DEBUG(1,("enum_dom_groups ads_search: %s\n", ads_errstr(rc))); goto done; } @@ -283,7 +273,8 @@ static NTSTATUS enum_dom_groups(struct winbindd_domain *domain, DEBUG(3,("ads enum_dom_groups gave %d entries\n", (*num_entries))); done: - if (res) ads_msgfree(ads, res); + if (res) + ads_msgfree(ads, res); return status; } @@ -378,7 +369,7 @@ static BOOL dn_lookup(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, SAFE_FREE(ldap_exp); SAFE_FREE(escaped_dn); - if (!ADS_ERR_OK(rc)) { + if (!ADS_ERR_OK(rc) || !res) { goto failed; } @@ -393,11 +384,15 @@ static BOOL dn_lookup(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx, goto failed; } - if (res) ads_msgfree(ads, res); + if (res) + ads_msgfree(ads, res); + return True; failed: - if (res) ads_msgfree(ads, res); + if (res) + ads_msgfree(ads, res); + return False; } @@ -436,7 +431,7 @@ static NTSTATUS query_user(struct winbindd_domain *domain, rc = ads_search_retry(ads, &msg, ldap_exp, attrs); free(ldap_exp); free(sidstr); - if (!ADS_ERR_OK(rc)) { + if (!ADS_ERR_OK(rc) || !msg) { DEBUG(1,("query_user(sid=%s) ads_search: %s\n", sid_to_string(sid_string, sid), ads_errstr(rc))); goto done; } @@ -470,7 +465,8 @@ static NTSTATUS query_user(struct winbindd_domain *domain, DEBUG(3,("ads query_user gave %s\n", info->acct_name)); done: - if (msg) ads_msgfree(ads, msg); + if (msg) + ads_msgfree(ads, msg); return status; } @@ -511,7 +507,7 @@ static NTSTATUS lookup_usergroups_alt(struct winbindd_domain *domain, rc = ads_search_retry(ads, &res, ldap_exp, group_attrs); free(ldap_exp); - if (!ADS_ERR_OK(rc)) { + if (!ADS_ERR_OK(rc) || !res) { DEBUG(1,("lookup_usergroups ads_search member=%s: %s\n", user_dn, ads_errstr(rc))); return ads_ntstatus(rc); } @@ -555,8 +551,10 @@ static NTSTATUS lookup_usergroups_alt(struct winbindd_domain *domain, DEBUG(3,("ads lookup_usergroups (alt) for dn=%s\n", user_dn)); done: - if (res) ads_msgfree(ads, res); - if (msg) ads_msgfree(ads, msg); + if (res) + ads_msgfree(ads, res); + if (msg) + ads_msgfree(ads, msg); return status; } @@ -609,7 +607,7 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain, free(ldap_exp); free(sidstr); - if (!ADS_ERR_OK(rc)) { + if (!ADS_ERR_OK(rc) || !msg) { DEBUG(1,("lookup_usergroups(sid=%s) ads_search: %s\n", sid_to_string(sid_string, sid), ads_errstr(rc))); goto done; } @@ -617,14 +615,16 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain, user_dn = ads_pull_string(ads, mem_ctx, msg, "distinguishedName"); if (!user_dn) { DEBUG(1,("lookup_usergroups(sid=%s) ads_search did not return a a distinguishedName!\n", sid_to_string(sid_string, sid))); - if (msg) ads_msgfree(ads, msg); + if (msg) + ads_msgfree(ads, msg); goto done; } - if (msg) ads_msgfree(ads, msg); + if (msg) + ads_msgfree(ads, msg); rc = ads_search_retry_dn(ads, &msg, user_dn, attrs2); - if (!ADS_ERR_OK(rc)) { + if (!ADS_ERR_OK(rc) || !msg) { DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: %s\n", sid_to_string(sid_string, sid), ads_errstr(rc))); goto done; } @@ -638,7 +638,8 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain, count = ads_pull_sids(ads, mem_ctx, msg, "tokenGroups", &sids); - if (msg) ads_msgfree(ads, msg); + if (msg) + ads_msgfree(ads, msg); /* there must always be at least one group in the token, unless we are talking to a buggy Win2k server */ @@ -712,7 +713,7 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain, free(ldap_exp); free(sidstr); - if (!ADS_ERR_OK(rc)) { + if (!ADS_ERR_OK(rc) || !res) { DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc))); goto done; } @@ -761,7 +762,8 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain, status = NT_STATUS_OK; DEBUG(3,("ads lookup_groupmem for sid=%s\n", sid_to_string(sid_string, group_sid))); done: - if (res) ads_msgfree(ads, res); + if (res) + ads_msgfree(ads, res); return status; } @@ -808,6 +810,7 @@ static NTSTATUS trusted_domains(struct winbindd_domain *domain, struct cli_state *cli = NULL; /* i think we only need our forest and downlevel trusted domains */ uint32 flags = DS_DOMAIN_IN_FOREST | DS_DOMAIN_DIRECT_OUTBOUND; + char *contact_domain_name; DEBUG(3,("ads: trusted_domains\n")); @@ -816,14 +819,15 @@ static NTSTATUS trusted_domains(struct winbindd_domain *domain, *names = NULL; *dom_sids = NULL; - if ( !NT_STATUS_IS_OK(result = cm_fresh_connection(domain->name, PI_NETLOGON, &cli)) ) { + contact_domain_name = *domain->alt_name ? domain->alt_name : domain->name; + if ( !NT_STATUS_IS_OK(result = cm_fresh_connection(contact_domain_name, PI_NETLOGON, &cli)) ) { DEBUG(5, ("trusted_domains: Could not open a connection to %s for PIPE_NETLOGON (%s)\n", - domain->name, nt_errstr(result))); + contact_domain_name, nt_errstr(result))); return NT_STATUS_UNSUCCESSFUL; } if ( NT_STATUS_IS_OK(result) ) - result = cli_ds_enum_domain_trusts( cli, mem_ctx, cli->desthost, flags, &domains, &count ); + result = cli_ds_enum_domain_trusts( cli, mem_ctx, cli->desthost, flags, &domains, (unsigned int *)&count ); if ( NT_STATUS_IS_OK(result) && count) { diff --git a/source3/nsswitch/winbindd_cache.c b/source3/nsswitch/winbindd_cache.c index 2891a4fa68..bc6967dee1 100644 --- a/source3/nsswitch/winbindd_cache.c +++ b/source3/nsswitch/winbindd_cache.c @@ -432,7 +432,7 @@ static struct cache_entry *wcache_fetch(struct winbind_cache *cache, } centry = smb_xmalloc(sizeof(*centry)); - centry->data = data.dptr; + centry->data = (unsigned char *)data.dptr; centry->len = data.dsize; centry->ofs = 0; @@ -576,7 +576,7 @@ static void centry_end(struct cache_entry *centry, const char *format, ...) key.dptr = kstr; key.dsize = strlen(kstr); - data.dptr = centry->data; + data.dptr = (char *)centry->data; data.dsize = centry->ofs; tdb_store(wcache->tdb, key, data, TDB_REPLACE); @@ -924,7 +924,7 @@ static NTSTATUS name_to_sid(struct winbindd_domain *domain, centry = wcache_fetch(cache, domain, "NS/%s/%s", domain->name, uname); if (!centry) goto do_query; - *type = centry_uint32(centry); + *type = (enum SID_NAME_USE)centry_uint32(centry); sid2 = centry_sid(centry, mem_ctx); if (!sid2) { ZERO_STRUCTP(sid); @@ -988,7 +988,7 @@ static NTSTATUS sid_to_name(struct winbindd_domain *domain, if (!centry) goto do_query; if (NT_STATUS_IS_OK(centry->status)) { - *type = centry_uint32(centry); + *type = (enum SID_NAME_USE)centry_uint32(centry); *name = centry_string(centry, mem_ctx); } status = centry->status; diff --git a/source3/nsswitch/winbindd_cm.c b/source3/nsswitch/winbindd_cm.c index f07117b5ab..8513a46f8f 100644 --- a/source3/nsswitch/winbindd_cm.c +++ b/source3/nsswitch/winbindd_cm.c @@ -116,7 +116,8 @@ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index, struct winbindd_cm_conn *new_conn) { NTSTATUS result; - char *ipc_username, *ipc_domain, *ipc_password; + char *machine_password; + char *machine_krb5_principal, *ipc_username, *ipc_domain, *ipc_password; struct in_addr dc_ip; int i; BOOL retry = True; @@ -137,10 +138,15 @@ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index, /* Initialise SMB connection */ - cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password); + /* grab stored passwords */ + machine_password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); + + if (asprintf(&machine_krb5_principal, "%s$@%s", global_myname(), lp_realm()) == -1) { + SAFE_FREE(machine_password); + return NT_STATUS_NO_MEMORY; + } - DEBUG(5, ("connecting to %s from %s with username [%s]\\[%s]\n", - new_conn->controller, global_myname(), ipc_domain, ipc_username)); + cm_get_ipc_userpass(&ipc_username, &ipc_domain, &ipc_password); for (i = 0; retry && (i < 3); i++) { BOOL got_mutex; @@ -150,12 +156,99 @@ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index, continue; } - result = cli_full_connection(&new_conn->cli, global_myname(), new_conn->controller, - &dc_ip, 0, "IPC$", "IPC", ipc_username, ipc_domain, - ipc_password, CLI_FULL_CONNECTION_ANNONYMOUS_FALLBACK, - Undefined, &retry); - - secrets_named_mutex_release(new_conn->controller); + new_conn->cli = NULL; + result = cli_start_connection(&new_conn->cli, global_myname(), + new_conn->controller, + &dc_ip, 0, Undefined, + CLI_FULL_CONNECTION_USE_KERBEROS, + &retry); + + if (NT_STATUS_IS_OK(result)) { + + /* reset the error code */ + result = NT_STATUS_UNSUCCESSFUL; + + /* Krb5 session */ + + if ((lp_security() == SEC_ADS) + && (new_conn->cli->protocol >= PROTOCOL_NT1 && new_conn->cli->capabilities & CAP_EXTENDED_SECURITY)) { + new_conn->cli->use_kerberos = True; + DEBUG(5, ("connecting to %s from %s with kerberos principal [%s]\n", + new_conn->controller, global_myname(), machine_krb5_principal)); + + result = NT_STATUS_OK; + + if (!cli_session_setup_spnego(new_conn->cli, machine_krb5_principal, + machine_password, + domain)) { + result = cli_nt_error(new_conn->cli); + DEBUG(4,("failed kerberos session setup with %s\n", nt_errstr(result))); + if (NT_STATUS_IS_OK(result)) + result = NT_STATUS_UNSUCCESSFUL; + } + } + new_conn->cli->use_kerberos = False; + + /* only do this is we have a username/password for thr IPC$ connection */ + + if ( !NT_STATUS_IS_OK(result) + && new_conn->cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE + && strlen(ipc_username) ) + { + DEBUG(5, ("connecting to %s from %s with username [%s]\\[%s]\n", + new_conn->controller, global_myname(), ipc_domain, ipc_username)); + + result = NT_STATUS_OK; + + if (!cli_session_setup(new_conn->cli, ipc_username, + ipc_password, strlen(ipc_password)+1, + ipc_password, strlen(ipc_password)+1, + domain)) { + result = cli_nt_error(new_conn->cli); + DEBUG(4,("failed authenticated session setup with %s\n", nt_errstr(result))); + if (NT_STATUS_IS_OK(result)) + result = NT_STATUS_UNSUCCESSFUL; + } + } + + /* anonymous is all that is left if we get to here */ + + if (!NT_STATUS_IS_OK(result)) { + + DEBUG(5, ("anonymous connection attempt to %s from %s\n", + new_conn->controller, global_myname())); + + result = NT_STATUS_OK; + + if (!cli_session_setup(new_conn->cli, "", NULL, 0, NULL, 0, "")) + { + result = cli_nt_error(new_conn->cli); + DEBUG(4,("failed anonymous session setup with %s\n", nt_errstr(result))); + if (NT_STATUS_IS_OK(result)) + result = NT_STATUS_UNSUCCESSFUL; + } + + } + + if (NT_STATUS_IS_OK(result) && !cli_send_tconX(new_conn->cli, "IPC$", "IPC", + "", 0)) { + result = cli_nt_error(new_conn->cli); + DEBUG(1,("failed tcon_X with %s\n", nt_errstr(result))); + cli_shutdown(new_conn->cli); + if (NT_STATUS_IS_OK(result)) { + result = NT_STATUS_UNSUCCESSFUL; + } + } + } + + if (NT_STATUS_IS_OK(result)) { + struct ntuser_creds creds; + init_creds(&creds, ipc_username, ipc_domain, ipc_password); + cli_init_creds(new_conn->cli, &creds); + } + + if (got_mutex) + secrets_named_mutex_release(new_conn->controller); if (NT_STATUS_IS_OK(result)) break; @@ -164,6 +257,7 @@ static NTSTATUS cm_open_connection(const char *domain, const int pipe_index, SAFE_FREE(ipc_username); SAFE_FREE(ipc_domain); SAFE_FREE(ipc_password); + SAFE_FREE(machine_password); if (!NT_STATUS_IS_OK(result)) { add_failed_connection_entry(domain, new_conn->controller, result); @@ -479,6 +573,7 @@ NTSTATUS cm_get_netlogon_cli(const char *domain, struct winbindd_cm_conn *conn; fstring lock_name; BOOL got_mutex; + struct winbindd_domain *wb_domain = NULL; if (!cli) return NT_STATUS_INVALID_PARAMETER; @@ -520,6 +615,17 @@ NTSTATUS cm_get_netlogon_cli(const char *domain, if ( sec_channel_type == SEC_CHAN_DOMAIN ) fstr_sprintf(conn->cli->mach_acct, "%s$", lp_workgroup()); + /* we need the short form of the domain name for the schanel + rpc bind. What if we fail? I don't think we should ever get + a request for a domain name not in our list but I'm not bailing + out if we do since I'm not 10% certain about this --jerry */ + + if ( (wb_domain = find_domain_from_name( domain )) != NULL ) { + DEBUG(5,("cm_get_netlogon_cli: Using short for of domain name [%s] for netlogon rpc bind\n", + wb_domain->name)); + fstrcpy( conn->cli->domain, wb_domain->name); + } + result = cli_nt_establish_netlogon(conn->cli, sec_channel_type, trust_passwd); if (got_mutex) diff --git a/source3/nsswitch/winbindd_group.c b/source3/nsswitch/winbindd_group.c index 96c121685a..fba427536c 100644 --- a/source3/nsswitch/winbindd_group.c +++ b/source3/nsswitch/winbindd_group.c @@ -821,17 +821,29 @@ enum winbindd_result winbindd_list_groups(struct winbindd_cli_state *state) { uint32 total_entries = 0; struct winbindd_domain *domain; + const char *which_domain; char *extra_data = NULL; char *ted = NULL; unsigned int extra_data_len = 0, i; DEBUG(3, ("[%5lu]: list groups\n", (unsigned long)state->pid)); + /* Ensure null termination */ + state->request.domain_name[sizeof(state->request.domain_name)-1]='\0'; + which_domain = state->request.domain_name; + /* Enumerate over trusted domains */ for (domain = domain_list(); domain; domain = domain->next) { struct getent_state groups; + /* if we have a domain name restricting the request and this + one in the list doesn't match, then just bypass the remainder + of the loop */ + + if ( *which_domain && !strequal(which_domain, domain->name) ) + continue; + ZERO_STRUCT(groups); /* Get list of sam groups */ diff --git a/source3/nsswitch/winbindd_misc.c b/source3/nsswitch/winbindd_misc.c index 740b760b93..88fbb5ee00 100644 --- a/source3/nsswitch/winbindd_misc.c +++ b/source3/nsswitch/winbindd_misc.c @@ -35,6 +35,8 @@ enum winbindd_result winbindd_check_machine_acct(struct winbindd_cli_state *stat int num_retries = 0; struct cli_state *cli; uint32 sec_channel_type; + const char *contact_domain_name = NULL; + DEBUG(3, ("[%5lu]: check machine account\n", (unsigned long)state->pid)); /* Get trust account password */ @@ -46,11 +48,21 @@ enum winbindd_result winbindd_check_machine_acct(struct winbindd_cli_state *stat goto done; } + + /* use the realm name if appropriate and possible */ + + if ( lp_security() == SEC_ADS ) + contact_domain_name = lp_realm(); + + if ( !contact_domain_name || !*contact_domain_name ) + contact_domain_name = lp_workgroup(); + /* This call does a cli_nt_setup_creds() which implicitly checks the trust account password. */ - /* Don't shut this down - it belongs to the connection cache code */ - result = cm_get_netlogon_cli(lp_workgroup(), trust_passwd, sec_channel_type, True, &cli); + + result = cm_get_netlogon_cli(contact_domain_name, + trust_passwd, sec_channel_type, True, &cli); if (!NT_STATUS_IS_OK(result)) { DEBUG(3, ("could not open handle to NETLOGON pipe\n")); @@ -148,9 +160,14 @@ enum winbindd_result winbindd_show_sequence(struct winbindd_cli_state *state) { struct winbindd_domain *domain; char *extra_data = NULL; + const char *which_domain; DEBUG(3, ("[%5lu]: show sequence\n", (unsigned long)state->pid)); + /* Ensure null termination */ + state->request.domain_name[sizeof(state->request.domain_name)-1]='\0'; + which_domain = state->request.domain_name; + extra_data = strdup(""); /* this makes for a very simple data format, and is easily parsable as well @@ -158,6 +175,13 @@ enum winbindd_result winbindd_show_sequence(struct winbindd_cli_state *state) for (domain = domain_list(); domain; domain = domain->next) { char *s; + /* if we have a domain name restricting the request and this + one in the list doesn't match, then just bypass the remainder + of the loop */ + + if ( *which_domain && !strequal(which_domain, domain->name) ) + continue; + domain->methods->sequence_number(domain, &domain->sequence_number); if (DOM_SEQUENCE_NONE == (unsigned)domain->sequence_number) { @@ -194,7 +218,7 @@ enum winbindd_result winbindd_info(struct winbindd_cli_state *state) DEBUG(3, ("[%5lu]: request misc info\n", (unsigned long)state->pid)); state->response.data.info.winbind_separator = *lp_winbind_separator(); - fstrcpy(state->response.data.info.samba_version, VERSION); + fstrcpy(state->response.data.info.samba_version, SAMBA_VERSION_STRING); return WINBINDD_OK; } diff --git a/source3/nsswitch/winbindd_nss.h b/source3/nsswitch/winbindd_nss.h index c4407bbe31..41fecd2816 100644 --- a/source3/nsswitch/winbindd_nss.h +++ b/source3/nsswitch/winbindd_nss.h @@ -157,6 +157,7 @@ struct winbindd_request { enum winbindd_cmd cmd; /* Winbindd command to execute */ pid_t pid; /* pid of calling process */ uint32 flags; /* flags relavant to a given request */ + fstring domain_name; /* name of domain for which the request applies */ union { fstring winsreq; /* WINS request */ diff --git a/source3/nsswitch/winbindd_pam.c b/source3/nsswitch/winbindd_pam.c index a8908487c1..21ae6478de 100644 --- a/source3/nsswitch/winbindd_pam.c +++ b/source3/nsswitch/winbindd_pam.c @@ -65,7 +65,7 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) time_t last_change_time; uint32 sec_channel_type; NET_USER_INFO_3 info3; - struct cli_state *cli = NULL; + struct cli_state *cli; uchar chal[8]; TALLOC_CTX *mem_ctx = NULL; DATA_BLOB lm_resp; @@ -75,6 +75,7 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) unsigned char local_lm_response[24]; unsigned char local_nt_response[24]; const char *contact_domain; + BOOL retry; /* Ensure null termination */ state->request.data.auth.user[sizeof(state->request.data.auth.user)-1]='\0'; @@ -127,6 +128,8 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) do { ZERO_STRUCT(info3); ZERO_STRUCT(ret_creds); + cli = NULL; + retry = False; /* Don't shut this down - it belongs to the connection cache code */ result = cm_get_netlogon_cli(contact_domain, trust_passwd, @@ -154,15 +157,14 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) "password was changed and we didn't know it. Killing connections to domain %s\n", name_domain)); winbindd_cm_flush(); - cli->fd = -1; + retry = True; } /* We have to try a second time as cm_get_netlogon_cli might not yet have noticed that the DC has killed our connection. */ - } while ( (attempts < 2) && (cli->fd == -1) ); - + } while ( (attempts < 2) && retry ); clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds); @@ -170,10 +172,8 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) netsamlogon_cache_store( cli->mem_ctx, &info3 ); wcache_invalidate_samlogon(find_domain_from_name(name_domain), &info3); } - - + done: - /* give us a more useful (more correct?) error code */ if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) || (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) { result = NT_STATUS_NO_LOGON_SERVERS; @@ -206,7 +206,7 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) time_t last_change_time; uint32 sec_channel_type; NET_USER_INFO_3 info3; - struct cli_state *cli = NULL; + struct cli_state *cli; TALLOC_CTX *mem_ctx = NULL; char *user = NULL; const char *domain = NULL; @@ -214,6 +214,7 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) const char *contact_domain; DOM_CRED ret_creds; int attempts = 0; + BOOL retry; DATA_BLOB lm_resp, nt_resp; @@ -226,10 +227,8 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) } /* Ensure null termination */ - state->request.data.auth_crap.user[sizeof(state->request.data.auth_crap.user)-1]='\0'; - - /* Ensure null termination */ - state->request.data.auth_crap.domain[sizeof(state->request.data.auth_crap.domain)-1]='\0'; + state->request.data.auth_crap.user[sizeof(state->request.data.auth_crap.user)-1]=0; + state->request.data.auth_crap.domain[sizeof(state->request.data.auth_crap.domain)-1]=0; if (!(mem_ctx = talloc_init("winbind pam auth crap for (utf8) %s", state->request.data.auth_crap.user))) { DEBUG(0, ("winbindd_pam_auth_crap: could not talloc_init()!\n")); @@ -239,12 +238,16 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) if (pull_utf8_talloc(mem_ctx, &user, state->request.data.auth_crap.user) == (size_t)-1) { DEBUG(0, ("winbindd_pam_auth_crap: pull_utf8_talloc failed!\n")); + result = NT_STATUS_UNSUCCESSFUL; + goto done; } if (*state->request.data.auth_crap.domain) { char *dom = NULL; if (pull_utf8_talloc(mem_ctx, &dom, state->request.data.auth_crap.domain) == (size_t)-1) { DEBUG(0, ("winbindd_pam_auth_crap: pull_utf8_talloc failed!\n")); + result = NT_STATUS_UNSUCCESSFUL; + goto done; } domain = dom; } else if (lp_winbind_use_default_domain()) { @@ -268,6 +271,8 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) char *wrk = NULL; if (pull_utf8_talloc(mem_ctx, &wrk, state->request.data.auth_crap.workstation) == (size_t)-1) { DEBUG(0, ("winbindd_pam_auth_crap: pull_utf8_talloc failed!\n")); + result = NT_STATUS_UNSUCCESSFUL; + goto done; } workstation = wrk; } else { @@ -296,6 +301,8 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) do { ZERO_STRUCT(info3); ZERO_STRUCT(ret_creds); + cli = NULL; + retry = False; /* Don't shut this down - it belongs to the connection cache code */ result = cm_get_netlogon_cli(contact_domain, trust_passwd, sec_channel_type, False, &cli); @@ -325,14 +332,14 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) "password was changed and we didn't know it. Killing connections to domain %s\n", domain)); winbindd_cm_flush(); - cli->fd = -1; + retry = True; } /* We have to try a second time as cm_get_netlogon_cli might not yet have noticed that the DC has killed our connection. */ - } while ( (attempts < 2) && (cli->fd == -1) ); + } while ( (attempts < 2) && retry ); clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds); @@ -353,7 +360,6 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) } done: - /* give us a more useful (more correct?) error code */ if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) || (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) { result = NT_STATUS_NO_LOGON_SERVERS; diff --git a/source3/nsswitch/winbindd_rpc.c b/source3/nsswitch/winbindd_rpc.c index 33339d7ca0..8bd2c66511 100644 --- a/source3/nsswitch/winbindd_rpc.c +++ b/source3/nsswitch/winbindd_rpc.c @@ -295,7 +295,7 @@ static NTSTATUS name_to_sid(struct winbindd_domain *domain, if (NT_STATUS_IS_OK(result)) { sid_copy(sid, &sids[0]); - *type = types[0]; + *type = (enum SID_NAME_USE)types[0]; } return result; @@ -331,7 +331,7 @@ static NTSTATUS sid_to_name(struct winbindd_domain *domain, hnd && hnd->cli && hnd->cli->fd == -1); if (NT_STATUS_IS_OK(result)) { - *type = types[0]; + *type = (enum SID_NAME_USE)types[0]; *name = names[0]; DEBUG(5,("Mapped sid to [%s]\\[%s]\n", domains[0], *name)); diff --git a/source3/nsswitch/winbindd_sid.c b/source3/nsswitch/winbindd_sid.c index 98a6fce24b..ac1ee11555 100644 --- a/source3/nsswitch/winbindd_sid.c +++ b/source3/nsswitch/winbindd_sid.c @@ -185,12 +185,17 @@ enum winbindd_result winbindd_uid_to_sid(struct winbindd_cli_state *state) { DOM_SID sid; - /* Bug out if the uid isn't in the winbind range */ - +#if 0 /* JERRY */ + /* we cannot do this check this anymore since a domain member of + a Samba domain may share unix accounts via NIS or LDAP. In this + case the uid/gid will be out of winbindd's range but still might + be resolved to a SID via an ldap idmap backend */ + if ((state->request.data.uid < server_state.uid_low ) || (state->request.data.uid > server_state.uid_high)) { return WINBINDD_ERROR; } +#endif DEBUG(3, ("[%5lu]: uid to sid %lu\n", (unsigned long)state->pid, (unsigned long)state->request.data.uid)); @@ -214,12 +219,17 @@ enum winbindd_result winbindd_gid_to_sid(struct winbindd_cli_state *state) { DOM_SID sid; - /* Bug out if the gid isn't in the winbind range */ - +#if 0 /* JERRY */ + /* we cannot do this check this anymore since a domain member of + a Samba domain may share unix accounts via NIS or LDAP. In this + case the uid/gid will be out of winbindd's range but still might + be resolved to a SID via an ldap idmap backend */ + if ((state->request.data.gid < server_state.gid_low) || (state->request.data.gid > server_state.gid_high)) { return WINBINDD_ERROR; } +#endif DEBUG(3, ("[%5lu]: gid to sid %lu\n", (unsigned long)state->pid, (unsigned long)state->request.data.gid)); diff --git a/source3/nsswitch/winbindd_user.c b/source3/nsswitch/winbindd_user.c index c0b0d94167..eab88c842e 100644 --- a/source3/nsswitch/winbindd_user.c +++ b/source3/nsswitch/winbindd_user.c @@ -575,6 +575,7 @@ enum winbindd_result winbindd_list_users(struct winbindd_cli_state *state) { struct winbindd_domain *domain; WINBIND_USERINFO *info; + const char *which_domain; uint32 num_entries = 0, total_entries = 0; char *ted, *extra_data = NULL; int extra_data_len = 0; @@ -586,13 +587,24 @@ enum winbindd_result winbindd_list_users(struct winbindd_cli_state *state) if (!(mem_ctx = talloc_init("winbindd_list_users"))) return WINBINDD_ERROR; + /* Ensure null termination */ + state->request.domain_name[sizeof(state->request.domain_name)-1]='\0'; + which_domain = state->request.domain_name; + /* Enumerate over trusted domains */ for (domain = domain_list(); domain; domain = domain->next) { NTSTATUS status; struct winbindd_methods *methods; unsigned int i; - + + /* if we have a domain name restricting the request and this + one in the list doesn't match, then just bypass the remainder + of the loop */ + + if ( *which_domain && !strequal(which_domain, domain->name) ) + continue; + methods = domain->methods; /* Query display info */ diff --git a/source3/nsswitch/winbindd_util.c b/source3/nsswitch/winbindd_util.c index a810e503a0..25de4eff71 100644 --- a/source3/nsswitch/winbindd_util.c +++ b/source3/nsswitch/winbindd_util.c @@ -80,6 +80,14 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const DOM_SID *sid) { struct winbindd_domain *domain; + char *contact_name; + const char *alternative_name = NULL; + + /* ignore alt_name if we are not in an AD domain */ + + if ( (lp_security() == SEC_ADS) && alt_name && *alt_name) { + alternative_name = alt_name; + } /* We can't call domain_list() as this function is called from init_domain_list() and we'll get stuck in a loop. */ @@ -88,9 +96,9 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const strcasecmp(domain_name, domain->alt_name) == 0) { return domain; } - if (alt_name && *alt_name) { - if (strcasecmp(alt_name, domain->name) == 0 || - strcasecmp(alt_name, domain->alt_name) == 0) { + if (alternative_name && *alternative_name) { + if (strcasecmp(alternative_name, domain->name) == 0 || + strcasecmp(alternative_name, domain->alt_name) == 0) { return domain; } } @@ -107,13 +115,13 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const ZERO_STRUCTP(domain); /* prioritise the short name */ - if (strchr_m(domain_name, '.') && alt_name && *alt_name) { - fstrcpy(domain->name, alt_name); + if (strchr_m(domain_name, '.') && alternative_name && *alternative_name) { + fstrcpy(domain->name, alternative_name); fstrcpy(domain->alt_name, domain_name); } else { fstrcpy(domain->name, domain_name); - if (alt_name) { - fstrcpy(domain->alt_name, alt_name); + if (alternative_name) { + fstrcpy(domain->alt_name, alternative_name); } } @@ -125,10 +133,12 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const sid_copy(&domain->sid, sid); } - /* see if this is a native mode win2k domain */ + /* see if this is a native mode win2k domain (use realm name if possible) */ - domain->native_mode = cm_check_for_native_mode_win2k( domain_name ); - DEBUG(3,("add_trusted_domain: %s is a %s mode domain\n", domain_name, + contact_name = *domain->alt_name ? domain->alt_name : domain->name; + domain->native_mode = cm_check_for_native_mode_win2k( contact_name ); + + DEBUG(3,("add_trusted_domain: %s is a %s mode domain\n", contact_name, domain->native_mode ? "native" : "mixed (or NT4)" )); /* Link to domain list */ @@ -141,57 +151,80 @@ static struct winbindd_domain *add_trusted_domain(const char *domain_name, const return domain; } +/******************************************************************** + Periodically we need to refresh the trusted domain cache for smbd +********************************************************************/ -/* +void rescan_trusted_domains( void ) +{ + static time_t last_scan; + time_t now = time(NULL); + struct winbindd_domain *mydomain = NULL; + + /* see if the time has come... */ + + if ( (now > last_scan) && ((now-last_scan) < WINBINDD_RESCAN_FREQ) ) + return; + + /* get the handle for our domain */ + + if ( (mydomain = find_domain_from_name(lp_workgroup())) == NULL ) { + DEBUG(0,("rescan_trusted_domains: Can't find my own domain!\n")); + return; + } + + /* this will only add new domains we didn't already know about */ + + add_trusted_domains( mydomain ); + + last_scan = now; + + return; +} + +/******************************************************************** rescan our domains looking for new trusted domains - */ -void rescan_trusted_domains(BOOL force) +********************************************************************/ + +void add_trusted_domains( struct winbindd_domain *domain ) { - struct winbindd_domain *domain; TALLOC_CTX *mem_ctx; - static time_t last_scan; - time_t t = time(NULL); + NTSTATUS result; + time_t t; + char **names; + char **alt_names; + int num_domains = 0; + DOM_SID *dom_sids, null_sid; + int i; + struct winbindd_domain *new_domain; /* trusted domains might be disabled */ if (!lp_allow_trusted_domains()) { return; } - /* Only rescan every few minutes but force if necessary */ - - if (((unsigned)(t - last_scan) < WINBINDD_RESCAN_FREQ) && !force) - return; - - last_scan = t; - DEBUG(1, ("scanning trusted domain list\n")); if (!(mem_ctx = talloc_init("init_domain_list"))) return; + + ZERO_STRUCTP(&null_sid); - for (domain = _domain_list; domain; domain = domain->next) { - NTSTATUS result; - char **names; - char **alt_names; - int num_domains = 0; - DOM_SID *dom_sids, null_sid; - int i; - struct winbindd_domain *new_domain; + t = time(NULL); + + /* ask the DC what domains it trusts */ + + result = domain->methods->trusted_domains(domain, mem_ctx, (unsigned int *)&num_domains, + &names, &alt_names, &dom_sids); - ZERO_STRUCTP(&null_sid); - - result = domain->methods->trusted_domains(domain, mem_ctx, &num_domains, - &names, &alt_names, &dom_sids); - if (!NT_STATUS_IS_OK(result)) { - continue; - } + if ( NT_STATUS_IS_OK(result) ) { /* Add each domain to the trusted domain list */ for(i = 0; i < num_domains; i++) { DEBUG(10,("Found domain %s\n", names[i])); add_trusted_domain(names[i], alt_names?alt_names[i]:NULL, - domain->methods, &dom_sids[i]); + domain->methods, &dom_sids[i]); /* if the SID was empty, we better set it now */ @@ -212,7 +245,7 @@ void rescan_trusted_domains(BOOL force) result = domain->methods->domain_sid( new_domain, &new_domain->sid ); if ( NT_STATUS_IS_OK(result) ) - sid_copy( &dom_sids[i], &domain->sid ); + sid_copy( &dom_sids[i], &new_domain->sid ); } /* store trusted domain in the cache */ @@ -234,18 +267,26 @@ BOOL init_domain_list(void) free_domain_list(); /* Add ourselves as the first entry */ - domain = add_trusted_domain( lp_workgroup(), NULL, &cache_methods, NULL); + + domain = add_trusted_domain( lp_workgroup(), lp_realm(), &cache_methods, NULL); + + /* get any alternate name for the primary domain */ + + cache_methods.alternate_name(domain); + + /* now we have the correct netbios (short) domain name */ + + if ( *domain->name ) + set_global_myworkgroup( domain->name ); + if (!secrets_fetch_domain_sid(domain->name, &domain->sid)) { DEBUG(1, ("Could not fetch sid for our domain %s\n", domain->name)); return False; } - /* get any alternate name for the primary domain */ - cache_methods.alternate_name(domain); - /* do an initial scan for trusted domains */ - rescan_trusted_domains(True); + add_trusted_domains(domain); return True; } diff --git a/source3/nsswitch/wins.c b/source3/nsswitch/wins.c index 87dac60192..0fc4e46cdb 100644 --- a/source3/nsswitch/wins.c +++ b/source3/nsswitch/wins.c @@ -260,54 +260,105 @@ int lookup(nsd_file_t *rq) } #else + +/* Allocate some space from the nss static buffer. The buffer and buflen + are the pointers passed in by the C library to the _nss_*_* + functions. */ + +static char *get_static(char **buffer, int *buflen, int len) +{ + char *result; + + /* Error check. We return false if things aren't set up right, or + there isn't enough buffer space left. */ + + if ((buffer == NULL) || (buflen == NULL) || (*buflen < len)) { + return NULL; + } + + /* Return an index into the static buffer */ + + result = *buffer; + *buffer += len; + *buflen -= len; + + return result; +} + /**************************************************************************** gethostbyname() - we ignore any domain portion of the name and only handle names that are at most 15 characters long **************************************************************************/ NSS_STATUS -_nss_wins_gethostbyname_r(const char *name, struct hostent *he, - char *buffer, size_t buflen, int *errnop, - int *h_errnop) +_nss_wins_gethostbyname_r(const char *hostname, struct hostent *he, + char *buffer, size_t buflen, int *h_errnop) { - char **host_addresses; struct in_addr *ip_list; int i, count; - size_t namelen = strlen(name) + 1; + fstring name; + size_t namelen; memset(he, '\0', sizeof(*he)); + fstrcpy(name, hostname); + + /* Do lookup */ ip_list = lookup_byname_backend(name, &count); - if (!ip_list) { - return NSS_STATUS_NOTFOUND; - } - if (buflen < namelen + (2*count+1)*INADDRSZ) { - /* no ENOMEM error type?! */ + if (!ip_list) return NSS_STATUS_NOTFOUND; - } + /* Copy h_name */ - host_addresses = (char **)buffer; - he->h_addr_list = host_addresses; - host_addresses[count] = NULL; - buffer += (count + 1) * INADDRSZ; - buflen += (count + 1) * INADDRSZ; - he->h_addrtype = AF_INET; - he->h_length = INADDRSZ; + namelen = strlen(name) + 1; + + if ((he->h_name = get_static(&buffer, &buflen, namelen)) == NULL) + return NSS_STATUS_TRYAGAIN; + + memcpy(he->h_name, name, namelen); + + /* Copy h_addr_list, align to pointer boundary first */ - for (i=0;ih_addr_list = (char **)get_static( + &buffer, &buflen, (count + 1) * sizeof(char *))) == NULL) + return NSS_STATUS_TRYAGAIN; + + for (i = 0; i < count; i++) { + if ((he->h_addr_list[i] = get_static(&buffer, &buflen, + INADDRSZ)) == NULL) + return NSS_STATUS_TRYAGAIN; + memcpy(he->h_addr_list[i], &ip_list[i], INADDRSZ); } + he->h_addr_list[count] = NULL; + if (ip_list) free(ip_list); - memcpy(buffer, name, namelen); - he->h_name = buffer; + /* Set h_addr_type and h_length */ + + he->h_addrtype = AF_INET; + he->h_length = INADDRSZ; + + /* Set h_aliases */ + + if ((i = (unsigned long)(buffer) % sizeof(char*)) != 0) + i = sizeof(char*) - i; + + if (get_static(&buffer, &buflen, i) == NULL) + return NSS_STATUS_TRYAGAIN; + + if ((he->h_aliases = (char **)get_static( + &buffer, &buflen, sizeof(char *))) == NULL) + return NSS_STATUS_TRYAGAIN; + + he->h_aliases[0] = NULL; return NSS_STATUS_SUCCESS; } @@ -315,15 +366,14 @@ _nss_wins_gethostbyname_r(const char *name, struct hostent *he, NSS_STATUS _nss_wins_gethostbyname2_r(const char *name, int af, struct hostent *he, - char *buffer, size_t buflen, int *errnop, - int *h_errnop) + char *buffer, size_t buflen, int *h_errnop) { if(af!=AF_INET) { *h_errnop = NO_DATA; - *errnop = EAFNOSUPPORT; return NSS_STATUS_UNAVAIL; } - return _nss_wins_gethostbyname_r(name,he,buffer,buflen,errnop,h_errnop); + return _nss_wins_gethostbyname_r( + name, he, buffer, buflen, h_errnop); } #endif diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index 8bd50f35de..41b32cef10 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -231,7 +231,6 @@ typedef struct char *szLdapSuffix; char *szLdapFilter; char *szLdapAdminDn; - BOOL ldap_trust_ids; char *szAclCompat; int ldap_passwd_sync; BOOL ldap_delete_dn; @@ -563,6 +562,7 @@ static BOOL handle_debug_list( const char *pszParmValue, char **ptr ); static BOOL handle_workgroup( const char *pszParmValue, char **ptr ); static BOOL handle_netbios_aliases( const char *pszParmValue, char **ptr ); static BOOL handle_netbios_scope( const char *pszParmValue, char **ptr ); +static BOOL handle_charset( const char *pszParmValue, char **ptr ); static BOOL handle_ldap_suffix ( const char *pszParmValue, char **ptr ); static BOOL handle_ldap_sub_suffix ( const char *pszParmValue, char **ptr ); @@ -700,6 +700,7 @@ static const struct enum_list enum_smb_signing_vals[] = { {True, "1"}, {True, "On"}, {True, "enabled"}, + {Auto, "auto"}, {Required, "required"}, {Required, "mandatory"}, {Required, "force"}, @@ -752,9 +753,9 @@ static const struct enum_list enum_map_to_guest[] = { static struct parm_struct parm_table[] = { {"Base Options", P_SEP, P_SEPARATOR}, - {"dos charset", P_STRING, P_GLOBAL, &Globals.dos_charset, NULL, NULL, FLAG_ADVANCED}, - {"unix charset", P_STRING, P_GLOBAL, &Globals.unix_charset, NULL, NULL, FLAG_ADVANCED}, - {"display charset", P_STRING, P_GLOBAL, &Globals.display_charset, NULL, NULL, FLAG_ADVANCED}, + {"dos charset", P_STRING, P_GLOBAL, &Globals.dos_charset, handle_charset, NULL, FLAG_ADVANCED}, + {"unix charset", P_STRING, P_GLOBAL, &Globals.unix_charset, handle_charset, NULL, FLAG_ADVANCED}, + {"display charset", P_STRING, P_GLOBAL, &Globals.display_charset, handle_charset, NULL, FLAG_ADVANCED}, {"comment", P_STRING, P_LOCAL, &sDefault.comment, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, {"path", P_STRING, P_LOCAL, &sDefault.szPath, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_SHARE | FLAG_PRINT}, {"directory", P_STRING, P_LOCAL, &sDefault.szPath, NULL, NULL, FLAG_HIDE}, @@ -1071,7 +1072,6 @@ static struct parm_struct parm_table[] = { {"ldap admin dn", P_STRING, P_GLOBAL, &Globals.szLdapAdminDn, NULL, NULL, FLAG_ADVANCED}, {"ldap ssl", P_ENUM, P_GLOBAL, &Globals.ldap_ssl, NULL, enum_ldap_ssl, FLAG_ADVANCED}, {"ldap passwd sync", P_ENUM, P_GLOBAL, &Globals.ldap_passwd_sync, NULL, enum_ldap_passwd_sync, FLAG_ADVANCED}, - {"ldap trust ids", P_BOOL, P_GLOBAL, &Globals.ldap_trust_ids, NULL, NULL, FLAG_ADVANCED}, {"ldap delete dn", P_BOOL, P_GLOBAL, &Globals.ldap_delete_dn, NULL, NULL, FLAG_ADVANCED}, {"Miscellaneous Options", P_SEP, P_SEPARATOR}, @@ -1309,18 +1309,18 @@ static void init_globals(void) string_set(&Globals.szGuestaccount, GUEST_ACCOUNT); /* using UTF8 by default allows us to support all chars */ - string_set(&Globals.unix_charset, "UTF8"); + string_set(&Globals.unix_charset, DEFAULT_UNIX_CHARSET); #if defined(HAVE_NL_LANGINFO) && defined(CODESET) /* If the system supports nl_langinfo(), try to grab the value from the user's locale */ string_set(&Globals.display_charset, "LOCALE"); #else - string_set(&Globals.display_charset, "ASCII"); + string_set(&Globals.display_charset, DEFAULT_DISPLAY_CHARSET); #endif /* Use codepage 850 as a default for the dos character set */ - string_set(&Globals.dos_charset, "CP850"); + string_set(&Globals.dos_charset, DEFAULT_DOS_CHARSET); /* * Allow the default PASSWD_CHAT to be overridden in local.h. @@ -1339,7 +1339,7 @@ static void init_globals(void) string_set(&Globals.szLockDir, dyn_LOCKDIR); string_set(&Globals.szSocketAddress, "0.0.0.0"); pstrcpy(s, "Samba "); - pstrcat(s, VERSION); + pstrcat(s, SAMBA_VERSION_STRING); string_set(&Globals.szServerString, s); slprintf(s, sizeof(s) - 1, "%d.%d", DEFAULT_MAJOR_VERSION, DEFAULT_MINOR_VERSION); @@ -1427,19 +1427,21 @@ static void init_globals(void) Globals.bClientPlaintextAuth = True; /* Do use a plaintext password if is requested by the server */ Globals.bLanmanAuth = True; /* Do use the LanMan hash if it is available */ Globals.bNTLMAuth = True; /* Do use NTLMv1 if it is available (otherwise NTLMv2) */ - + Globals.bClientNTLMv2Auth = False; /* Client should not use NTLMv2, as we can't tell that the server supports it. */ + /* Note, that we will use NTLM2 session security (which is different), if it is available */ + Globals.map_to_guest = 0; /* By Default, "Never" */ Globals.min_passwd_length = MINPASSWDLENGTH; /* By Default, 5. */ Globals.oplock_break_wait_time = 0; /* By Default, 0 msecs. */ Globals.enhanced_browsing = True; - Globals.iLockSpinCount = 3; /* Try 2 times. */ + Globals.iLockSpinCount = 3; /* Try 3 times. */ Globals.iLockSpinTime = 10; /* usec. */ #ifdef MMAP_BLACKLIST Globals.bUseMmap = False; #else Globals.bUseMmap = True; #endif - Globals.bUnixExtensions = False; + Globals.bUnixExtensions = True; /* hostname lookups can be very expensive and are broken on a large number of sites (tridge) */ @@ -1514,6 +1516,9 @@ static void init_globals(void) Globals.bUseSpnego = True; Globals.bClientUseSpnego = True; + Globals.client_signing = Auto; + Globals.server_signing = False; + string_set(&Globals.smb_ports, SMB_PORTS); } @@ -1554,8 +1559,8 @@ static char *lp_string(const char *s) lp_talloc = talloc_init("lp_talloc"); tmpstr = alloc_sub_basic(current_user_info.smb_name, s); - if (trim_string(tmpstr, "\"", "\"")) { - if (strchr(tmpstr,'"') != NULL) { + if (trim_char(tmpstr, '\"', '\"')) { + if (strchr(tmpstr,'\"') != NULL) { SAFE_FREE(tmpstr); tmpstr = alloc_sub_basic(current_user_info.smb_name,s); } @@ -1692,7 +1697,6 @@ FN_GLOBAL_STRING(lp_ldap_filter, &Globals.szLdapFilter) FN_GLOBAL_STRING(lp_ldap_admin_dn, &Globals.szLdapAdminDn) FN_GLOBAL_INTEGER(lp_ldap_ssl, &Globals.ldap_ssl) FN_GLOBAL_INTEGER(lp_ldap_passwd_sync, &Globals.ldap_passwd_sync) -FN_GLOBAL_BOOL(lp_ldap_trust_ids, &Globals.ldap_trust_ids) FN_GLOBAL_BOOL(lp_ldap_delete_dn, &Globals.ldap_delete_dn) FN_GLOBAL_STRING(lp_add_share_cmd, &Globals.szAddShareCommand) FN_GLOBAL_STRING(lp_change_share_cmd, &Globals.szChangeShareCommand) @@ -2293,13 +2297,8 @@ BOOL lp_add_home(const char *pszHomename, int iDefaultService, if (!(*(ServicePtrs[iDefaultService]->szPath)) || strequal(ServicePtrs[iDefaultService]->szPath, lp_pathname(GLOBAL_SECTION_SNUM))) { pstrcpy(newHomedir, pszHomedir); - } else { - pstrcpy(newHomedir, lp_pathname(iDefaultService)); - string_sub(newHomedir,"%H", pszHomedir, sizeof(newHomedir)); - string_sub(newHomedir,"%S", pszHomename, sizeof(newHomedir)); - } - - string_set(&ServicePtrs[i]->szPath, newHomedir); + string_set(&ServicePtrs[i]->szPath, newHomedir); + } if (!(*(ServicePtrs[i]->comment))) { pstring comment; @@ -2307,7 +2306,9 @@ BOOL lp_add_home(const char *pszHomename, int iDefaultService, "Home directory of %s", user); string_set(&ServicePtrs[i]->comment, comment); } - ServicePtrs[i]->bAvailable = sDefault.bAvailable; + + /* set the browseable flag from the gloabl default */ + ServicePtrs[i]->bBrowseable = sDefault.bBrowseable; DEBUG(3, ("adding home's share [%s] for user '%s' at '%s'\n", pszHomename, @@ -2377,7 +2378,10 @@ BOOL lp_add_printer(const char *pszPrintername, int iDefaultService) /* the printer name is set to the service name. */ string_set(&ServicePtrs[i]->szPrintername, pszPrintername); string_set(&ServicePtrs[i]->comment, comment); + + /* set the browseable flag from the gloabl default */ ServicePtrs[i]->bBrowseable = sDefault.bBrowseable; + /* Printers cannot be read_only. */ ServicePtrs[i]->bRead_only = False; /* No share modes on printer services. */ @@ -2698,7 +2702,6 @@ static BOOL handle_netbios_name(const char *pszParmValue, char **ptr) standard_sub_basic(current_user_info.smb_name, netbios_name,sizeof(netbios_name)); - ret = set_global_myname(netbios_name); string_set(&Globals.szNetbiosName,global_myname()); @@ -2708,6 +2711,15 @@ static BOOL handle_netbios_name(const char *pszParmValue, char **ptr) return ret; } +static BOOL handle_charset(const char *pszParmValue, char **ptr) +{ + if (strcmp(*ptr, pszParmValue) != 0) { + string_set(ptr, pszParmValue); + init_iconv(); + } + return True; +} + static BOOL handle_workgroup(const char *pszParmValue, char **ptr) { BOOL ret; @@ -3101,7 +3113,7 @@ BOOL lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue pstr_sprintf(param_key, "%s:", pszParmName); slen = strlen(param_key); pstrcat(param_key, sep+1); - trim_string(param_key+slen, " ", " "); + trim_char(param_key+slen, ' ', ' '); not_added = True; data = (snum < 0) ? Globals.param_opt : ServicePtrs[snum]->param_opt; @@ -4158,12 +4170,11 @@ void lp_remove_service(int snum) void lp_copy_service(int snum, const char *new_name) { - char *oldname = lp_servicename(snum); do_section(new_name); if (snum >= 0) { snum = lp_servicenumber(new_name); if (snum >= 0) - lp_do_parameter(snum, "copy", oldname); + lp_do_parameter(snum, "copy", lp_servicename(snum)); } } diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c new file mode 100644 index 0000000000..f84ff28db9 --- /dev/null +++ b/source3/passdb/lookup_sid.c @@ -0,0 +1,488 @@ +/* + Unix SMB/CIFS implementation. + uid/user handling + Copyright (C) Andrew Tridgell 1992-1998 + Copyright (C) Gerald (Jerry) Carter 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" + +/***************************************************************** + *THE CANONICAL* convert name to SID function. + Tries local lookup first - for local domains - then uses winbind. +*****************************************************************/ + +BOOL lookup_name(const char *domain, const char *name, DOM_SID *psid, enum SID_NAME_USE *name_type) +{ + fstring sid; + BOOL local_lookup = False; + + *name_type = SID_NAME_UNKNOWN; + + /* If we are looking up a domain user, make sure it is + for the local machine only */ + + if (strequal(global_myname(), domain)) { + local_lookup = True; + } else if (lp_server_role() == ROLE_DOMAIN_PDC || + lp_server_role() == ROLE_DOMAIN_BDC) { + if (strequal(domain, lp_workgroup())) { + local_lookup = True; + } + } + + if (local_lookup) { + if (local_lookup_name(name, psid, name_type)) { + DEBUG(10, + ("lookup_name: (local) [%s]\\[%s] -> SID %s (type %s: %u)\n", + domain, name, sid_to_string(sid,psid), + sid_type_lookup(*name_type), (unsigned int)*name_type)); + return True; + } + } else { + /* Remote */ + if (winbind_lookup_name(domain, name, psid, name_type)) { + + DEBUG(10,("lookup_name (winbindd): [%s]\\[%s] -> SID %s (type %u)\n", + domain, name, sid_to_string(sid, psid), + (unsigned int)*name_type)); + return True; + } + } + + DEBUG(10, ("lookup_name: %s lookup for [%s]\\[%s] failed\n", + local_lookup ? "local" : "winbind", domain, name)); + + return False; +} + +/***************************************************************** + *THE CANONICAL* convert SID to name function. + Tries local lookup first - for local sids, then tries winbind. +*****************************************************************/ + +BOOL lookup_sid(DOM_SID *sid, fstring dom_name, fstring name, enum SID_NAME_USE *name_type) +{ + if (!name_type) + return False; + + *name_type = SID_NAME_UNKNOWN; + + /* Check if this is our own sid. This should perhaps be done by + winbind? For the moment handle it here. */ + + if (sid->num_auths == 5) { + DOM_SID tmp_sid; + uint32 rid; + + sid_copy(&tmp_sid, sid); + sid_split_rid(&tmp_sid, &rid); + + if (sid_equal(get_global_sam_sid(), &tmp_sid)) { + + return map_domain_sid_to_name(&tmp_sid, dom_name) && + local_lookup_sid(sid, name, name_type); + } + } + + if (!winbind_lookup_sid(sid, dom_name, name, name_type)) { + fstring sid_str; + DOM_SID tmp_sid; + uint32 rid; + + DEBUG(10,("lookup_sid: winbind lookup for SID %s failed - trying local.\n", sid_to_string(sid_str, sid) )); + + sid_copy(&tmp_sid, sid); + sid_split_rid(&tmp_sid, &rid); + return map_domain_sid_to_name(&tmp_sid, dom_name) && + lookup_known_rid(&tmp_sid, rid, name, name_type); + } + return True; +} + + +/***************************************************************** + Id mapping cache. This is to avoid Winbind mappings already + seen by smbd to be queried too frequently, keeping winbindd + busy, and blocking smbd while winbindd is busy with other + stuff. Written by Michael Steffens , + modified to use linked lists by jra. +*****************************************************************/ + +#define MAX_UID_SID_CACHE_SIZE 100 +#define TURNOVER_UID_SID_CACHE_SIZE 10 +#define MAX_GID_SID_CACHE_SIZE 100 +#define TURNOVER_GID_SID_CACHE_SIZE 10 + +static size_t n_uid_sid_cache = 0; +static size_t n_gid_sid_cache = 0; + +static struct uid_sid_cache { + struct uid_sid_cache *next, *prev; + uid_t uid; + DOM_SID sid; + enum SID_NAME_USE sidtype; +} *uid_sid_cache_head; + +static struct gid_sid_cache { + struct gid_sid_cache *next, *prev; + gid_t gid; + DOM_SID sid; + enum SID_NAME_USE sidtype; +} *gid_sid_cache_head; + +/***************************************************************** + Find a SID given a uid. +*****************************************************************/ + +static BOOL fetch_sid_from_uid_cache(DOM_SID *psid, uid_t uid) +{ + struct uid_sid_cache *pc; + + for (pc = uid_sid_cache_head; pc; pc = pc->next) { + if (pc->uid == uid) { + fstring sid; + *psid = pc->sid; + DEBUG(3,("fetch sid from uid cache %u -> %s\n", + (unsigned int)uid, sid_to_string(sid, psid))); + DLIST_PROMOTE(uid_sid_cache_head, pc); + return True; + } + } + return False; +} + +/***************************************************************** + Find a uid given a SID. +*****************************************************************/ + +static BOOL fetch_uid_from_cache( uid_t *puid, const DOM_SID *psid ) +{ + struct uid_sid_cache *pc; + + for (pc = uid_sid_cache_head; pc; pc = pc->next) { + if (sid_compare(&pc->sid, psid) == 0) { + fstring sid; + *puid = pc->uid; + DEBUG(3,("fetch uid from cache %u -> %s\n", + (unsigned int)*puid, sid_to_string(sid, psid))); + DLIST_PROMOTE(uid_sid_cache_head, pc); + return True; + } + } + return False; +} + +/***************************************************************** + Store uid to SID mapping in cache. +*****************************************************************/ + +static void store_uid_sid_cache(const DOM_SID *psid, uid_t uid) +{ + struct uid_sid_cache *pc; + + if (n_uid_sid_cache >= MAX_UID_SID_CACHE_SIZE && n_uid_sid_cache > TURNOVER_UID_SID_CACHE_SIZE) { + /* Delete the last TURNOVER_UID_SID_CACHE_SIZE entries. */ + struct uid_sid_cache *pc_next; + size_t i; + + for (i = 0, pc = uid_sid_cache_head; i < (n_uid_sid_cache - TURNOVER_UID_SID_CACHE_SIZE); i++, pc = pc->next) + ; + for(; pc; pc = pc_next) { + pc_next = pc->next; + DLIST_REMOVE(uid_sid_cache_head,pc); + SAFE_FREE(pc); + n_uid_sid_cache--; + } + } + + pc = (struct uid_sid_cache *)malloc(sizeof(struct uid_sid_cache)); + if (!pc) + return; + pc->uid = uid; + sid_copy(&pc->sid, psid); + DLIST_ADD(uid_sid_cache_head, pc); + n_uid_sid_cache++; +} + +/***************************************************************** + Find a SID given a gid. +*****************************************************************/ + +static BOOL fetch_sid_from_gid_cache(DOM_SID *psid, gid_t gid) +{ + struct gid_sid_cache *pc; + + for (pc = gid_sid_cache_head; pc; pc = pc->next) { + if (pc->gid == gid) { + fstring sid; + *psid = pc->sid; + DEBUG(3,("fetch sid from gid cache %u -> %s\n", + (unsigned int)gid, sid_to_string(sid, psid))); + DLIST_PROMOTE(gid_sid_cache_head, pc); + return True; + } + } + return False; +} + +/***************************************************************** + Find a gid given a SID. +*****************************************************************/ + +static BOOL fetch_gid_from_cache(gid_t *pgid, const DOM_SID *psid) +{ + struct gid_sid_cache *pc; + + for (pc = gid_sid_cache_head; pc; pc = pc->next) { + if (sid_compare(&pc->sid, psid) == 0) { + fstring sid; + *pgid = pc->gid; + DEBUG(3,("fetch uid from cache %u -> %s\n", + (unsigned int)*pgid, sid_to_string(sid, psid))); + DLIST_PROMOTE(gid_sid_cache_head, pc); + return True; + } + } + return False; +} + +/***************************************************************** + Store gid to SID mapping in cache. +*****************************************************************/ + +static void store_gid_sid_cache(const DOM_SID *psid, gid_t gid) +{ + struct gid_sid_cache *pc; + + if (n_gid_sid_cache >= MAX_GID_SID_CACHE_SIZE && n_gid_sid_cache > TURNOVER_GID_SID_CACHE_SIZE) { + /* Delete the last TURNOVER_GID_SID_CACHE_SIZE entries. */ + struct gid_sid_cache *pc_next; + size_t i; + + for (i = 0, pc = gid_sid_cache_head; i < (n_gid_sid_cache - TURNOVER_GID_SID_CACHE_SIZE); i++, pc = pc->next) + ; + for(; pc; pc = pc_next) { + pc_next = pc->next; + DLIST_REMOVE(gid_sid_cache_head,pc); + SAFE_FREE(pc); + n_gid_sid_cache--; + } + } + + pc = (struct gid_sid_cache *)malloc(sizeof(struct gid_sid_cache)); + if (!pc) + return; + pc->gid = gid; + sid_copy(&pc->sid, psid); + DLIST_ADD(gid_sid_cache_head, pc); + n_gid_sid_cache++; +} + +/***************************************************************** + *THE CANONICAL* convert uid_t to SID function. +*****************************************************************/ + +NTSTATUS uid_to_sid(DOM_SID *psid, uid_t uid) +{ + uid_t low, high; + fstring sid; + + ZERO_STRUCTP(psid); + + if (fetch_sid_from_uid_cache(psid, uid)) + return ( psid ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ); + + if (lp_idmap_uid(&low, &high) && uid >= low && uid <= high) { + if (winbind_uid_to_sid(psid, uid)) { + + DEBUG(10,("uid_to_sid: winbindd %u -> %s\n", + (unsigned int)uid, sid_to_string(sid, psid))); + + if (psid) + store_uid_sid_cache(psid, uid); + return ( psid ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ); + } + } + + if (!local_uid_to_sid(psid, uid)) { + DEBUG(10,("uid_to_sid: local %u failed to map to sid\n", (unsigned int)uid )); + return NT_STATUS_UNSUCCESSFUL; + } + + DEBUG(10,("uid_to_sid: local %u -> %s\n", (unsigned int)uid, sid_to_string(sid, psid))); + + store_uid_sid_cache(psid, uid); + return NT_STATUS_OK; +} + +/***************************************************************** + *THE CANONICAL* convert gid_t to SID function. +*****************************************************************/ + +NTSTATUS gid_to_sid(DOM_SID *psid, gid_t gid) +{ + gid_t low, high; + fstring sid; + + ZERO_STRUCTP(psid); + + if (fetch_sid_from_gid_cache(psid, gid)) + return ( psid ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ); + + if (lp_idmap_gid(&low, &high) && gid >= low && gid <= high) { + if (winbind_gid_to_sid(psid, gid)) { + + DEBUG(10,("gid_to_sid: winbindd %u -> %s\n", + (unsigned int)gid, sid_to_string(sid, psid))); + + if (psid) + store_gid_sid_cache(psid, gid); + return ( psid ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ); + } + } + + if (!local_gid_to_sid(psid, gid)) { + DEBUG(10,("gid_to_sid: local %u failed to map to sid\n", (unsigned int)gid )); + return NT_STATUS_UNSUCCESSFUL; + } + + DEBUG(10,("gid_to_sid: local %u -> %s\n", (unsigned int)gid, sid_to_string(sid, psid))); + + store_gid_sid_cache(psid, gid); + return NT_STATUS_OK; +} + +/***************************************************************** + *THE CANONICAL* convert SID to uid function. +*****************************************************************/ + +NTSTATUS sid_to_uid(const DOM_SID *psid, uid_t *puid) +{ + fstring dom_name, name, sid_str; + enum SID_NAME_USE name_type; + + if (fetch_uid_from_cache(puid, psid)) + return NT_STATUS_OK; + + /* if this is our SID then go straight to a local lookup */ + + if ( sid_compare_domain(get_global_sam_sid(), psid) == 0 ) { + DEBUG(10,("sid_to_uid: my domain (%s) - trying local.\n", + sid_string_static(psid) )); + + if ( local_sid_to_uid(puid, psid, &name_type) ) + goto success; + + DEBUG(10,("sid_to_uid: local lookup failed\n")); + + return NT_STATUS_UNSUCCESSFUL; + } + + /* If it is not our local domain, only hope is winbindd */ + + if ( !winbind_lookup_sid(psid, dom_name, name, &name_type) ) { + DEBUG(10,("sid_to_uid: winbind lookup for non-local sid %s failed\n", + sid_string_static(psid) )); + + return NT_STATUS_UNSUCCESSFUL; + } + + /* If winbindd does know the SID, ensure this is a user */ + + if (name_type != SID_NAME_USER) { + DEBUG(10,("sid_to_uid: winbind lookup succeeded but SID is not a user (%u)\n", + (unsigned int)name_type )); + return NT_STATUS_INVALID_PARAMETER; + } + + /* get the uid. Has to work or else we are dead in the water */ + + if ( !winbind_sid_to_uid(puid, psid) ) { + DEBUG(10,("sid_to_uid: winbind failed to allocate a new uid for sid %s\n", + sid_to_string(sid_str, psid) )); + return NT_STATUS_UNSUCCESSFUL; + } + +success: + DEBUG(10,("sid_to_uid: %s -> %u\n", sid_to_string(sid_str, psid), + (unsigned int)*puid )); + + store_uid_sid_cache(psid, *puid); + + return NT_STATUS_OK; +} +/***************************************************************** + *THE CANONICAL* convert SID to gid function. + Group mapping is used for gids that maps to Wellknown SIDs +*****************************************************************/ + +NTSTATUS sid_to_gid(const DOM_SID *psid, gid_t *pgid) +{ + fstring dom_name, name, sid_str; + enum SID_NAME_USE name_type; + + if (fetch_gid_from_cache(pgid, psid)) + return NT_STATUS_OK; + + /* + * First we must look up the name and decide if this is a group sid. + * Group mapping can deal with foreign SIDs + */ + + if (!winbind_lookup_sid(psid, dom_name, name, &name_type)) { + DEBUG(10,("sid_to_gid: winbind lookup for sid %s failed - trying local.\n", + sid_to_string(sid_str, psid) )); + + if ( local_sid_to_gid(pgid, psid, &name_type) ) + goto success; + + DEBUG(10,("sid_to_gid: no one knows this SID\n")); + + return NT_STATUS_UNSUCCESSFUL; + } + + /* winbindd knows it; Ensure this is a group sid */ + + if ((name_type != SID_NAME_DOM_GRP) && (name_type != SID_NAME_ALIAS) && (name_type != SID_NAME_WKN_GRP)) { + DEBUG(10,("sid_to_gid: winbind lookup succeeded but SID is not a known group (%u)\n", + (unsigned int)name_type )); + + /* winbindd is running and knows about this SID. Just the wrong type. + Don't fallback to a local lookup here */ + + return NT_STATUS_INVALID_PARAMETER; + } + + /* winbindd knows it and it is a type of group; sid_to_gid must succeed + or we are dead in the water */ + + if ( !winbind_sid_to_gid(pgid, psid) ) { + DEBUG(10,("sid_to_uid: winbind failed to allocate a new gid for sid %s\n", + sid_to_string(sid_str, psid) )); + return NT_STATUS_UNSUCCESSFUL; + } + +success: + DEBUG(10,("sid_to_gid: %s -> %u\n", sid_to_string(sid_str, psid), + (unsigned int)*pgid )); + + store_gid_sid_cache(psid, *pgid); + + return NT_STATUS_OK; +} + diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c index e440e064ef..76745be3f0 100644 --- a/source3/passdb/passdb.c +++ b/source3/passdb/passdb.c @@ -758,13 +758,27 @@ BOOL local_lookup_sid(DOM_SID *sid, char *name, enum SID_NAME_USE *psid_name_use if (fallback_pdb_rid_is_user(rid)) { uid_t uid; + struct passwd *pw = NULL; DEBUG(5, ("assuming RID %u is a user\n", (unsigned)rid)); uid = fallback_pdb_user_rid_to_uid(rid); - slprintf(name, sizeof(fstring)-1, "unix_user.%u", (unsigned int)uid); - - return False; /* Indicates that this user was 'not mapped' */ + pw = sys_getpwuid( uid ); + + DEBUG(5,("local_lookup_sid: looking up uid %u %s\n", (unsigned int)uid, + pw ? "succeeded" : "failed" )); + + if ( !pw ) + fstr_sprintf(name, "unix_user.%u", (unsigned int)uid); + else + fstrcpy( name, pw->pw_name ); + + DEBUG(5,("local_lookup_sid: found user %s for rid %u\n", name, + (unsigned int)rid )); + + *psid_name_use = SID_NAME_USER; + + return ( pw != NULL ); } else { gid_t gid; struct group *gr; @@ -779,16 +793,19 @@ BOOL local_lookup_sid(DOM_SID *sid, char *name, enum SID_NAME_USE *psid_name_use DEBUG(5,("local_lookup_sid: looking up gid %u %s\n", (unsigned int)gid, gr ? "succeeded" : "failed" )); - if(!gr) { - slprintf(name, sizeof(fstring)-1, "unix_group.%u", (unsigned int)gid); - return False; /* Indicates that this group was 'not mapped' */ - } - - fstrcpy( name, gr->gr_name); + if( !gr ) + fstr_sprintf(name, "unix_group.%u", (unsigned int)gid); + else + fstrcpy( name, gr->gr_name); DEBUG(5,("local_lookup_sid: found group %s for rid %u\n", name, (unsigned int)rid )); - return True; + + /* assume fallback groups aer domain global groups */ + + *psid_name_use = SID_NAME_DOM_GRP; + + return ( gr != NULL ); } } @@ -1156,11 +1173,18 @@ BOOL local_sid_to_uid(uid_t *puid, const DOM_SID *psid, enum SID_NAME_USE *name_ DOM_SID *local_gid_to_sid(DOM_SID *psid, gid_t gid) { GROUP_MAP group; + BOOL ret; /* we don't need to disable winbindd since the gid is stored in the GROUP_MAP object */ + + /* done as root since ldap backend requires root to open a connection */ - if ( !pdb_getgrgid( &group, gid ) ) { + become_root(); + ret = pdb_getgrgid( &group, gid ); + unbecome_root(); + + if ( !ret ) { /* fallback to rid mapping if enabled */ @@ -1289,6 +1313,7 @@ BOOL init_sam_from_buffer(SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen) BOOL ret = True; uid_t uid = -1; gid_t gid = -1; + struct passwd *pw = NULL; if(sampass == NULL || buf == NULL) { DEBUG(0, ("init_sam_from_buffer: NULL parameters found!\n")); @@ -1296,7 +1321,7 @@ BOOL init_sam_from_buffer(SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen) } /* unpack the buffer into variables */ - len = tdb_unpack (buf, buflen, TDB_FORMAT_STRING, + len = tdb_unpack ((char *)buf, buflen, TDB_FORMAT_STRING, &logon_time, &logoff_time, &kickoff_time, @@ -1344,6 +1369,12 @@ BOOL init_sam_from_buffer(SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen) pdb_set_nt_username(sampass, nt_username, PDB_SET); pdb_set_fullname(sampass, fullname, PDB_SET); + + if ( (pw=Get_Pwnam(username)) != NULL ) { + uid = pw->pw_uid; + gid = pw->pw_gid; + } + if (homedir) { pdb_set_homedir(sampass, homedir, PDB_SET); } @@ -1633,7 +1664,7 @@ uint32 init_buffer_from_sam (uint8 **buf, const SAM_ACCOUNT *sampass, BOOL size_ } /* now for the real call to tdb_pack() */ - buflen = tdb_pack(*buf, len, TDB_FORMAT_STRING, + buflen = tdb_pack((char *)*buf, len, TDB_FORMAT_STRING, logon_time, logoff_time, kickoff_time, @@ -1676,3 +1707,51 @@ uint32 init_buffer_from_sam (uint8 **buf, const SAM_ACCOUNT *sampass, BOOL size_ return (buflen); } + + +/********************************************************************** +**********************************************************************/ + +static BOOL get_free_ugid_range(uint32 *low, uint32 *high) +{ + uid_t u_low, u_high; + gid_t g_low, g_high; + + if (!lp_idmap_uid(&u_low, &u_high) || !lp_idmap_gid(&g_low, &g_high)) { + return False; + } + + *low = (u_low < g_low) ? u_low : g_low; + *high = (u_high < g_high) ? u_high : g_high; + + return True; +} + +/****************************************************************** + Get the the non-algorithmic RID range if idmap range are defined +******************************************************************/ + +BOOL get_free_rid_range(uint32 *low, uint32 *high) +{ + uint32 id_low, id_high; + + if (!lp_enable_rid_algorithm()) { + *low = BASE_RID; + *high = (uint32)-1; + } + + if (!get_free_ugid_range(&id_low, &id_high)) { + return False; + } + + *low = fallback_pdb_uid_to_user_rid(id_low); + if (fallback_pdb_user_rid_to_uid((uint32)-1) < id_high) { + *high = (uint32)-1; + } else { + *high = fallback_pdb_uid_to_user_rid(id_high); + } + + return True; +} + + diff --git a/source3/passdb/pdb_interface.c b/source3/passdb/pdb_interface.c index 5ebc14030f..d548081e78 100644 --- a/source3/passdb/pdb_interface.c +++ b/source3/passdb/pdb_interface.c @@ -422,10 +422,10 @@ static NTSTATUS make_pdb_methods_name(struct pdb_methods **methods, struct pdb_c if (p) { *p = 0; module_location = p+1; - trim_string(module_location, " ", " "); + trim_char(module_location, ' ', ' '); } - trim_string(module_name, " ", " "); + trim_char(module_name, ' ', ' '); DEBUG(5,("Attempting to find an passdb backend to match %s (%s)\n", selected, module_name)); diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c index aee6495759..009425c5f6 100644 --- a/source3/passdb/pdb_ldap.c +++ b/source3/passdb/pdb_ldap.c @@ -333,6 +333,8 @@ static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state, /* New Interface is being implemented here */ +#if 0 /* JERRY - not uesed anymore */ + /********************************************************************** Initialize SAM_ACCOUNT from an LDAP query (unix attributes only) *********************************************************************/ @@ -385,6 +387,7 @@ static BOOL get_unix_attributes (struct ldapsam_privates *ldap_state, return True; } +#endif /********************************************************************** Initialize SAM_ACCOUNT from an LDAP query @@ -419,8 +422,9 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, uint32 hours_len; uint8 hours[MAX_HOURS_LEN]; pstring temp; + struct passwd *pw = NULL; uid_t uid = -1; - gid_t gid = getegid(); + gid_t gid = -1; /* * do a little initialization @@ -455,6 +459,14 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, DEBUG(2, ("Entry found for user: %s\n", username)); + /* I'm not going to fail here, since there are checks + higher up the cal stack to do this --jerry */ + + if ( (pw=Get_Pwnam(username)) != NULL ) { + uid = pw->pw_uid; + gid = pw->pw_gid; + } + pstrcpy(nt_username, username); pstrcpy(domain, ldap_state->domain_name); @@ -523,6 +535,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } +#if 0 /* JERRY -- not used anymore */ /* * If so configured, try and get the values from LDAP */ @@ -541,6 +554,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } } } +#endif if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), temp)) @@ -1685,7 +1699,7 @@ static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE))); return False; } - map->sid_name_use = (uint32)atol(temp); + map->sid_name_use = (enum SID_NAME_USE)atol(temp); if ((map->sid_name_use < SID_NAME_USER) || (map->sid_name_use > SID_NAME_UNKNOWN)) { @@ -2128,7 +2142,6 @@ static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods, GROUP_MAP map; GROUP_MAP *mapt; int entries = 0; - NTSTATUS nt_status; *num_entries = 0; *rmap = NULL; @@ -2138,7 +2151,7 @@ static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods, return NT_STATUS_ACCESS_DENIED; } - while (NT_STATUS_IS_OK(nt_status = ldapsam_getsamgrent(methods, &map))) { + while (NT_STATUS_IS_OK(ldapsam_getsamgrent(methods, &map))) { if (sid_name_use != SID_NAME_UNKNOWN && sid_name_use != map.sid_name_use) { DEBUG(11,("enum_group_mapping: group %s is not of the requested type\n", map.nt_name)); diff --git a/source3/passdb/pdb_mysql.c b/source3/passdb/pdb_mysql.c index d3eb7cb975..6c200be504 100644 --- a/source3/passdb/pdb_mysql.c +++ b/source3/passdb/pdb_mysql.c @@ -240,9 +240,9 @@ static NTSTATUS row_to_sam_account(MYSQL_RES * r, SAM_ACCOUNT * u) pdb_set_unknown_str(u, row[16], PDB_SET); pdb_set_munged_dial(u, row[17], PDB_SET); - string_to_sid(&sid, row[18]); + if(row[18])string_to_sid(&sid, row[18]); pdb_set_user_sid(u, &sid, PDB_SET); - string_to_sid(&sid, row[19]); + if(row[19])string_to_sid(&sid, row[19]); pdb_set_group_sid(u, &sid, PDB_SET); if (pdb_gethexpwd(row[20], temp), PDB_SET) diff --git a/source3/passdb/pdb_plugin.c b/source3/passdb/pdb_plugin.c index ea67da23a5..027cd0b5d3 100644 --- a/source3/passdb/pdb_plugin.c +++ b/source3/passdb/pdb_plugin.c @@ -41,9 +41,11 @@ NTSTATUS pdb_init_plugin(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, con if (p) { *p = 0; plugin_location = p+1; - trim_string(plugin_location, " ", " "); - } else plugin_location = NULL; - trim_string(plugin_name, " ", " "); + trim_char(plugin_location, ' ', ' '); + } else { + plugin_location = NULL; + } + trim_char(plugin_name, ' ', ' '); DEBUG(5, ("Trying to load sam plugin %s\n", plugin_name)); dl_handle = sys_dlopen(plugin_name, RTLD_NOW ); diff --git a/source3/passdb/pdb_tdb.c b/source3/passdb/pdb_tdb.c index 7c2156455a..c9a84f3242 100644 --- a/source3/passdb/pdb_tdb.c +++ b/source3/passdb/pdb_tdb.c @@ -133,7 +133,7 @@ static NTSTATUS tdbsam_getsampwent(struct pdb_methods *my_methods, SAM_ACCOUNT * } /* unpack the buffer */ - if (!init_sam_from_buffer(user, data.dptr, data.dsize)) { + if (!init_sam_from_buffer(user, (unsigned char *)data.dptr, data.dsize)) { DEBUG(0,("pdb_getsampwent: Bad SAM_ACCOUNT entry returned from TDB!\n")); SAFE_FREE(data.dptr); return nt_status; @@ -213,7 +213,7 @@ static NTSTATUS tdbsam_getsampwnam (struct pdb_methods *my_methods, SAM_ACCOUNT } /* unpack the buffer */ - if (!init_sam_from_buffer(user, data.dptr, data.dsize)) { + if (!init_sam_from_buffer(user, (unsigned char *)data.dptr, data.dsize)) { DEBUG(0,("pdb_getsampwent: Bad SAM_ACCOUNT entry returned from TDB!\n")); SAFE_FREE(data.dptr); tdb_close(pwd_tdb); @@ -390,7 +390,7 @@ static BOOL tdb_update_sam(struct pdb_methods *my_methods, SAM_ACCOUNT* newpwd, ret = False; goto done; } - data.dptr = buf; + data.dptr = (char *)buf; fstrcpy(name, pdb_get_username(newpwd)); strlower_m(name); diff --git a/source3/passdb/secrets.c b/source3/passdb/secrets.c index 23413e4026..8a146f0d68 100644 --- a/source3/passdb/secrets.c +++ b/source3/passdb/secrets.c @@ -58,7 +58,7 @@ void *secrets_fetch(const char *key, size_t *size) secrets_init(); if (!tdb) return NULL; - kbuf.dptr = key; + kbuf.dptr = (char *)key; kbuf.dsize = strlen(key); dbuf = tdb_fetch(tdb, kbuf); if (size) @@ -74,9 +74,9 @@ BOOL secrets_store(const char *key, const void *data, size_t size) secrets_init(); if (!tdb) return False; - kbuf.dptr = key; + kbuf.dptr = (char *)key; kbuf.dsize = strlen(key); - dbuf.dptr = data; + dbuf.dptr = (char *)data; dbuf.dsize = size; return tdb_store(tdb, kbuf, dbuf, TDB_REPLACE) == 0; } @@ -90,7 +90,7 @@ BOOL secrets_delete(const char *key) secrets_init(); if (!tdb) return False; - kbuf.dptr = key; + kbuf.dptr = (char *)key; kbuf.dsize = strlen(key); return tdb_delete(tdb, kbuf) == 0; } @@ -738,3 +738,56 @@ BOOL must_use_pdc( const char *domain ) } +/******************************************************************************* + Store a complete AFS keyfile into secrets.tdb. +*******************************************************************************/ + +BOOL secrets_store_afs_keyfile(const char *cell, const struct afs_keyfile *keyfile) +{ + fstring key; + + if ((cell == NULL) || (keyfile == NULL)) + return False; + + if (ntohl(keyfile->nkeys) > SECRETS_AFS_MAXKEYS) + return False; + + slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_AFS_KEYFILE, cell); + return secrets_store(key, keyfile, sizeof(struct afs_keyfile)); +} + +/******************************************************************************* + Fetch the current (highest) AFS key from secrets.tdb +*******************************************************************************/ +BOOL secrets_fetch_afs_key(const char *cell, struct afs_key *result) +{ + fstring key; + struct afs_keyfile *keyfile; + size_t size; + uint32 i; + + slprintf(key, sizeof(key)-1, "%s/%s", SECRETS_AFS_KEYFILE, cell); + + keyfile = (struct afs_keyfile *)secrets_fetch(key, &size); + + if (keyfile == NULL) + return False; + + if (size != sizeof(struct afs_keyfile)) { + SAFE_FREE(keyfile); + return False; + } + + i = ntohl(keyfile->nkeys); + + if (i > SECRETS_AFS_MAXKEYS) { + SAFE_FREE(keyfile); + return False; + } + + *result = keyfile->entry[i-1]; + + result->kvno = ntohl(result->kvno); + + return True; +} diff --git a/source3/printing/lpq_parse.c b/source3/printing/lpq_parse.c index 0acca67b70..111617e3ae 100644 --- a/source3/printing/lpq_parse.c +++ b/source3/printing/lpq_parse.c @@ -766,14 +766,14 @@ static BOOL parse_lpq_nt(char *line,print_queue_struct *buf,BOOL first) /* Make sure the status is valid */ parse_line.space2 = '\0'; - trim_string(parse_line.status, NULL, " "); + trim_char(parse_line.status, '\0', ' '); if (!strequal(parse_line.status, LPRNT_PRINTING) && !strequal(parse_line.status, LPRNT_PAUSED) && !strequal(parse_line.status, LPRNT_WAITING)) return(False); parse_line.space3 = '\0'; - trim_string(parse_line.jobname, NULL, " "); + trim_char(parse_line.jobname, '\0', ' '); buf->job = atoi(parse_line.jobid); buf->priority = 0; @@ -837,7 +837,7 @@ static BOOL parse_lpq_os2(char *line,print_queue_struct *buf,BOOL first) /* Get the job name */ parse_line.space2[0] = '\0'; - trim_string(parse_line.jobname, NULL, " "); + trim_char(parse_line.jobname, '\0', ' '); fstrcpy(buf->fs_file, parse_line.jobname); buf->priority = 0; @@ -850,7 +850,7 @@ static BOOL parse_lpq_os2(char *line,print_queue_struct *buf,BOOL first) /* Make sure we have a valid status */ parse_line.space4[0] = '\0'; - trim_string(parse_line.status, NULL, " "); + trim_char(parse_line.status, '\0', ' '); if (!strequal(parse_line.status, LPROS2_PRINTING) && !strequal(parse_line.status, LPROS2_PAUSED) && !strequal(parse_line.status, LPROS2_WAITING)) diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c index 5e6e95ff7e..4859d785be 100644 --- a/source3/printing/nt_printing.c +++ b/source3/printing/nt_printing.c @@ -204,13 +204,19 @@ struct table_node { int version; }; +#define SPL_ARCH_WIN40 "WIN40" +#define SPL_ARCH_W32X86 "W32X86" +#define SPL_ARCH_W32MIPS "W32MIPS" +#define SPL_ARCH_W32ALPHA "W32ALPHA" +#define SPL_ARCH_W32PPC "W32PPC" + static const struct table_node archi_table[]= { - {"Windows 4.0", "WIN40", 0 }, - {"Windows NT x86", "W32X86", 2 }, - {"Windows NT R4000", "W32MIPS", 2 }, - {"Windows NT Alpha_AXP", "W32ALPHA", 2 }, - {"Windows NT PowerPC", "W32PPC", 2 }, + {"Windows 4.0", SPL_ARCH_WIN40, 0 }, + {"Windows NT x86", SPL_ARCH_W32X86, 2 }, + {"Windows NT R4000", SPL_ARCH_W32MIPS, 2 }, + {"Windows NT Alpha_AXP", SPL_ARCH_W32ALPHA, 2 }, + {"Windows NT PowerPC", SPL_ARCH_W32PPC, 2 }, {NULL, "", -1 } }; @@ -1755,6 +1761,11 @@ static WERROR get_a_printer_driver_3(NT_PRINTER_DRIVER_INFO_LEVEL_3 **info_ptr, ZERO_STRUCT(driver); architecture = get_short_archi(arch); + + /* Windows 4.0 (i.e. win9x) should always use a version of 0 */ + + if ( strcmp( architecture, SPL_ARCH_WIN40 ) == 0 ) + version = 0; DEBUG(8,("get_a_printer_driver_3: [%s%s/%d/%s]\n", DRIVERS_PREFIX, architecture, version, drivername)); @@ -2015,7 +2026,7 @@ static WERROR update_a_printer_2(NT_PRINTER_INFO_LEVEL_2 *info) if (info->servername[0]!='\0') { trim_string(info->printername, info->servername, NULL); - trim_string(info->printername, "\\", NULL); + trim_char(info->printername, '\\', '\0'); info->servername[0]='\0'; } @@ -2245,7 +2256,7 @@ int unpack_devicemode(NT_DEVICEMODE **nt_devmode, char *buf, int buflen) int len = 0; int extra_len = 0; NT_DEVICEMODE devmode; - + ZERO_STRUCT(devmode); len += tdb_unpack(buf+len, buflen-len, "p", nt_devmode); @@ -2886,6 +2897,11 @@ WERROR delete_printer_data( NT_PRINTER_INFO_LEVEL_2 *p2, const char *key, const key_index = lookup_printerkey( &p2->data, key ); if ( key_index == -1 ) return WERR_OK; + + /* make sure the value exists so we can return the correct error code */ + + if ( !regval_ctr_getvalue( &p2->data.keys[key_index].values, value ) ) + return WERR_BADFILE; regval_ctr_delvalue( &p2->data.keys[key_index].values, value ); @@ -2919,7 +2935,7 @@ WERROR add_printer_data( NT_PRINTER_INFO_LEVEL_2 *p2, const char *key, const cha return WERR_NOMEM; regval_ctr_addvalue( &p2->data.keys[key_index].values, value, - type, data, real_len ); + type, (const char *)data, real_len ); DEBUG(8,("add_printer_data: Added key => [%s], value => [%s], type=> [%d], size => [%d]\n", key, value, type, real_len )); @@ -3012,7 +3028,7 @@ static int unpack_values(NT_PRINTER_DATA *printer_data, char *buf, int buflen) /* add the new value */ - regval_ctr_addvalue( &printer_data->keys[key_index].values, valuename, type, data_p, size ); + regval_ctr_addvalue( &printer_data->keys[key_index].values, valuename, type, (const char *)data_p, size ); SAFE_FREE(data_p); /* 'B' option to tdbpack does a malloc() */ @@ -3195,6 +3211,7 @@ static WERROR get_a_printer_2(NT_PRINTER_INFO_LEVEL_2 **info_ptr, const char *sh int len = 0; TDB_DATA kbuf, dbuf; fstring printername; + char adevice[MAXDEVICENAME]; ZERO_STRUCT(info); @@ -3255,6 +3272,10 @@ static WERROR get_a_printer_2(NT_PRINTER_INFO_LEVEL_2 **info_ptr, const char *sh printername)); info.devmode = construct_nt_devicemode(printername); } + + safe_strcpy(adevice, info.printername, sizeof(adevice)-1); + fstrcpy(info.devmode->devicename, adevice); + len += unpack_values( &info.data, dbuf.dptr+len, dbuf.dsize-len ); diff --git a/source3/python/py_lsa.c b/source3/python/py_lsa.c index 4204f43f7b..07191be868 100644 --- a/source3/python/py_lsa.c +++ b/source3/python/py_lsa.c @@ -104,8 +104,7 @@ done: if (cli) cli_shutdown(cli); - if (mem_ctx) - talloc_destroy(mem_ctx); + talloc_destroy(mem_ctx); } return result; @@ -141,12 +140,13 @@ static PyObject *lsa_close(PyObject *self, PyObject *args, PyObject *kw) static PyObject *lsa_lookup_names(PyObject *self, PyObject *args) { - PyObject *py_names, *result; + PyObject *py_names, *result = NULL; NTSTATUS ntstatus; lsa_policy_hnd_object *hnd = (lsa_policy_hnd_object *)self; int num_names, i; const char **names; DOM_SID *sids; + TALLOC_CTX *mem_ctx = NULL; uint32 *name_types; if (!PyArg_ParseTuple(args, "O", &py_names)) @@ -157,18 +157,22 @@ static PyObject *lsa_lookup_names(PyObject *self, PyObject *args) return NULL; } + if (!(mem_ctx = talloc_init("lsa_lookup_names"))) { + PyErr_SetString(lsa_error, "unable to init talloc context\n"); + goto done; + } + if (PyList_Check(py_names)) { /* Convert list to char ** array */ num_names = PyList_Size(py_names); - names = (const char **)talloc( - hnd->mem_ctx, num_names * sizeof(char *)); + names = (const char **)talloc(mem_ctx, num_names * sizeof(char *)); for (i = 0; i < num_names; i++) { PyObject *obj = PyList_GetItem(py_names, i); - names[i] = talloc_strdup(hnd->mem_ctx, PyString_AsString(obj)); + names[i] = talloc_strdup(mem_ctx, PyString_AsString(obj)); } } else { @@ -176,17 +180,17 @@ static PyObject *lsa_lookup_names(PyObject *self, PyObject *args) /* Just a single element */ num_names = 1; - names = (const char **)talloc(hnd->mem_ctx, sizeof(char *)); + names = (const char **)talloc(mem_ctx, sizeof(char *)); names[0] = PyString_AsString(py_names); } - ntstatus = cli_lsa_lookup_names(hnd->cli, hnd->mem_ctx, &hnd->pol, + ntstatus = cli_lsa_lookup_names(hnd->cli, mem_ctx, &hnd->pol, num_names, names, &sids, &name_types); if (!NT_STATUS_IS_OK(ntstatus) && NT_STATUS_V(ntstatus) != 0x107) { PyErr_SetObject(lsa_ntstatus, py_ntstatus_tuple(ntstatus)); - return NULL; + goto done; } result = PyList_New(num_names); @@ -196,10 +200,13 @@ static PyObject *lsa_lookup_names(PyObject *self, PyObject *args) py_from_SID(&sid_obj, &sids[i]); - obj = Py_BuildValue("(Oi)", sid_obj, name_types[i]); + obj = Py_BuildValue("(Ni)", sid_obj, name_types[i]); PyList_SetItem(result, i, obj); } + + done: + talloc_destroy(mem_ctx); return result; } @@ -207,7 +214,7 @@ static PyObject *lsa_lookup_names(PyObject *self, PyObject *args) static PyObject *lsa_lookup_sids(PyObject *self, PyObject *args, PyObject *kw) { - PyObject *py_sids, *result; + PyObject *py_sids, *result = NULL; NTSTATUS ntstatus; int num_sids, i; char **domains, **names; @@ -224,7 +231,7 @@ static PyObject *lsa_lookup_sids(PyObject *self, PyObject *args, return NULL; } - if (!(mem_ctx = talloc_init("lsa_open_policy"))) { + if (!(mem_ctx = talloc_init("lsa_lookup_sids"))) { PyErr_SetString(lsa_error, "unable to init talloc context\n"); goto done; } @@ -243,7 +250,6 @@ static PyObject *lsa_lookup_sids(PyObject *self, PyObject *args, if (!string_to_sid(&sids[i], PyString_AsString(obj))) { PyErr_SetString(PyExc_ValueError, "string_to_sid failed"); - result = NULL; goto done; } } @@ -257,7 +263,6 @@ static PyObject *lsa_lookup_sids(PyObject *self, PyObject *args, if (!string_to_sid(&sids[0], PyString_AsString(py_sids))) { PyErr_SetString(PyExc_ValueError, "string_to_sid failed"); - result = NULL; goto done; } } @@ -268,7 +273,6 @@ static PyObject *lsa_lookup_sids(PyObject *self, PyObject *args, if (!NT_STATUS_IS_OK(ntstatus)) { PyErr_SetObject(lsa_ntstatus, py_ntstatus_tuple(ntstatus)); - result = NULL; goto done; } @@ -285,8 +289,7 @@ static PyObject *lsa_lookup_sids(PyObject *self, PyObject *args, } done: - if (mem_ctx) - talloc_destroy(mem_ctx); + talloc_destroy(mem_ctx); return result; } @@ -404,7 +407,7 @@ static PyMethodDef lsa_methods[] = { "\n" "Example:\n" "\n" -">>> spoolss.setup_logging(interactive = 1)" }, +">>> lsa.setup_logging(interactive = 1)" }, { "get_debuglevel", (PyCFunction)get_debuglevel, METH_VARARGS, @@ -412,7 +415,7 @@ static PyMethodDef lsa_methods[] = { "\n" "Example:\n" "\n" -">>> spoolss.get_debuglevel()\n" +">>> lsa.get_debuglevel()\n" "0" }, { "set_debuglevel", (PyCFunction)set_debuglevel, @@ -421,7 +424,7 @@ static PyMethodDef lsa_methods[] = { "\n" "Example:\n" "\n" -">>> spoolss.set_debuglevel(10)" }, +">>> lsa.set_debuglevel(10)" }, { NULL } }; diff --git a/source3/python/py_smb.c b/source3/python/py_smb.c index bb84a337c9..e5e6506196 100644 --- a/source3/python/py_smb.c +++ b/source3/python/py_smb.c @@ -221,10 +221,10 @@ static PyObject *py_smb_query_secdesc(PyObject *self, PyObject *args, { cli_state_object *cli = (cli_state_object *)self; static char *kwlist[] = { "fnum", NULL }; - PyObject *result; + PyObject *result = NULL; SEC_DESC *secdesc = NULL; int fnum; - TALLOC_CTX *mem_ctx; + TALLOC_CTX *mem_ctx = NULL; /* Parse parameters */ @@ -238,7 +238,6 @@ static PyObject *py_smb_query_secdesc(PyObject *self, PyObject *args, if (cli_is_error(cli->cli)) { PyErr_SetString(PyExc_RuntimeError, "query_secdesc failed"); - result = NULL; goto done; } @@ -252,7 +251,6 @@ static PyObject *py_smb_query_secdesc(PyObject *self, PyObject *args, PyErr_SetString( PyExc_TypeError, "Invalid security descriptor returned"); - result = NULL; goto done; } @@ -268,11 +266,12 @@ static PyObject *py_smb_set_secdesc(PyObject *self, PyObject *args, { cli_state_object *cli = (cli_state_object *)self; static char *kwlist[] = { "fnum", "security_descriptor", NULL }; + PyObject *result = NULL; PyObject *py_secdesc; SEC_DESC *secdesc; - TALLOC_CTX *mem_ctx = talloc_init("py_smb_set_secdesc"); + TALLOC_CTX *mem_ctx = NULL; int fnum; - BOOL result; + BOOL err; /* Parse parameters */ @@ -280,20 +279,26 @@ static PyObject *py_smb_set_secdesc(PyObject *self, PyObject *args, args, kw, "iO", kwlist, &fnum, &py_secdesc)) return NULL; + mem_ctx = talloc_init("py_smb_set_secdesc"); + if (!py_to_SECDESC(&secdesc, py_secdesc, mem_ctx)) { PyErr_SetString(PyExc_TypeError, "Invalid security descriptor"); - return NULL; + goto done; } - result = cli_set_secdesc(cli->cli, fnum, secdesc); + err = cli_set_secdesc(cli->cli, fnum, secdesc); if (cli_is_error(cli->cli)) { PyErr_SetString(PyExc_RuntimeError, "set_secdesc failed"); - return NULL; + goto done; } - return PyInt_FromLong(result); + result = PyInt_FromLong(err); + done: + talloc_destroy(mem_ctx); + + return result; } static PyMethodDef smb_hnd_methods[] = { diff --git a/source3/python/py_spoolss_drivers.c b/source3/python/py_spoolss_drivers.c index a072ac0d5c..12190519ec 100644 --- a/source3/python/py_spoolss_drivers.c +++ b/source3/python/py_spoolss_drivers.c @@ -177,6 +177,7 @@ PyObject *spoolss_hnd_getprinterdriver(PyObject *self, PyObject *args, int level = 1; uint32 needed; char *arch = "Windows NT x86"; + int version = 2; static char *kwlist[] = {"level", "arch", NULL}; /* Parse parameters */ @@ -189,12 +190,12 @@ PyObject *spoolss_hnd_getprinterdriver(PyObject *self, PyObject *args, werror = cli_spoolss_getprinterdriver( hnd->cli, hnd->mem_ctx, 0, &needed, &hnd->pol, level, - arch, &ctr); + version, arch, &ctr); if (W_ERROR_V(werror) == ERRinsufficientbuffer) werror = cli_spoolss_getprinterdriver( hnd->cli, hnd->mem_ctx, needed, NULL, &hnd->pol, - level, arch, &ctr); + level, version, arch, &ctr); if (!W_ERROR_IS_OK(werror)) { PyErr_SetObject(spoolss_werror, py_werror_tuple(werror)); diff --git a/source3/python/py_winbind.c b/source3/python/py_winbind.c index ebceb95d71..130f78d7e1 100644 --- a/source3/python/py_winbind.c +++ b/source3/python/py_winbind.c @@ -427,7 +427,10 @@ static PyObject *py_auth_crap(PyObject *self, PyObject *args, PyObject *kw) ZERO_STRUCT(request); ZERO_STRUCT(response); - fstrcpy(request.data.auth_crap.user, username); + if (push_utf8_fstring(request.data.auth_crap.user, username) == -1) { + PyErr_SetString(winbind_error, "unable to create utf8 string"); + return NULL; + } generate_random_buffer(request.data.auth_crap.chal, 8, False); @@ -473,7 +476,10 @@ static PyObject *py_auth_smbd(PyObject *self, PyObject *args, PyObject *kw) ZERO_STRUCT(request); ZERO_STRUCT(response); - fstrcpy(request.data.smbd_auth_crap.user, username); + if (push_utf8_fstring(request.data.auth_crap.user, username) == -1) { + PyErr_SetString("unable to create utf8 string"); + return NULL; + } generate_random_buffer(request.data.smbd_auth_crap.chal, 8, False); diff --git a/source3/rpc_client/cli_netlogon.c b/source3/rpc_client/cli_netlogon.c index 7b8cd19174..97bc4c65b7 100644 --- a/source3/rpc_client/cli_netlogon.c +++ b/source3/rpc_client/cli_netlogon.c @@ -514,7 +514,7 @@ NTSTATUS cli_netlogon_sam_logon(struct cli_state *cli, TALLOC_CTX *mem_ctx, 0, /* param_ctrl */ 0xdead, 0xbeef, /* LUID? */ username, cli->clnt_name_slash, - cli->sess_key, lm_owf_user_pwd, + (const char *)cli->sess_key, lm_owf_user_pwd, nt_owf_user_pwd); break; @@ -685,31 +685,20 @@ NTSTATUS cli_net_srv_pwset(struct cli_state *cli, TALLOC_CTX *mem_ctx, NET_Q_SRV_PWSET q_s; uint16 sec_chan_type = 2; NTSTATUS nt_status; - char *mach_acct; gen_next_creds( cli, &new_clnt_cred); prs_init(&qbuf , 1024, mem_ctx, MARSHALL); prs_init(&rbuf, 0, mem_ctx, UNMARSHALL); - /* create and send a MSRPC command with api NET_SRV_PWSET */ - - mach_acct = talloc_asprintf(mem_ctx, "%s$", machine_name); - - if (!mach_acct) { - DEBUG(0,("talloc_asprintf failed!\n")); - nt_status = NT_STATUS_NO_MEMORY; - goto done; - } - DEBUG(4,("cli_net_srv_pwset: srv:%s acct:%s sc: %d mc: %s clnt %s %x\n", - cli->srv_name_slash, mach_acct, sec_chan_type, machine_name, + cli->srv_name_slash, cli->mach_acct, sec_chan_type, machine_name, credstr(new_clnt_cred.challenge.data), new_clnt_cred.timestamp.time)); /* store the parameters */ - init_q_srv_pwset(&q_s, cli->srv_name_slash, cli->sess_key, - mach_acct, sec_chan_type, machine_name, - &new_clnt_cred, (char *)hashed_mach_pwd); + init_q_srv_pwset(&q_s, cli->srv_name_slash, (const char *)cli->sess_key, + cli->mach_acct, sec_chan_type, machine_name, + &new_clnt_cred, hashed_mach_pwd); /* turn parameters into data stream */ if(!net_io_q_srv_pwset("", &q_s, &qbuf, 0)) { diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c index ebe54c2c06..dedbf017a9 100644 --- a/source3/rpc_client/cli_pipe.c +++ b/source3/rpc_client/cli_pipe.c @@ -264,7 +264,7 @@ static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, DATA_BLOB ntlmssp_verf = data_blob(NULL, auth_len); /* save the reply away, for use a little later */ - prs_copy_data_out(ntlmssp_verf.data, &auth_verf, auth_len); + prs_copy_data_out((char *)ntlmssp_verf.data, &auth_verf, auth_len); return (NT_STATUS_IS_OK(ntlmssp_client_store_response(cli->ntlmssp_pipe_state, @@ -287,7 +287,7 @@ static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, return False; } sig = data_blob(NULL, auth_len); - prs_copy_data_out(sig.data, &auth_verf, auth_len); + prs_copy_data_out((char *)sig.data, &auth_verf, auth_len); } /* @@ -306,12 +306,12 @@ static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, return False; } nt_status = ntlmssp_client_unseal_packet(cli->ntlmssp_pipe_state, - reply_data, data_len, + (unsigned char *)reply_data, data_len, &sig); } else if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) { nt_status = ntlmssp_client_check_packet(cli->ntlmssp_pipe_state, - reply_data, data_len, + (const unsigned char *)reply_data, data_len, &sig); } @@ -684,10 +684,10 @@ static NTSTATUS create_rpc_bind_req(struct cli_state *cli, prs_struct *rpc_out, /* Auth len in the rpc header doesn't include auth_header. */ auth_len = request.length; - prs_copy_data_in(&auth_info, request.data, request.length); + prs_copy_data_in(&auth_info, (char *)request.data, request.length); DEBUG(5, ("NTLMSSP Negotiate:\n")); - dump_data(5, request.data, request.length); + dump_data(5, (const char *)request.data, request.length); data_blob_free(&request); @@ -751,6 +751,7 @@ static NTSTATUS create_rpc_bind_req(struct cli_state *cli, prs_struct *rpc_out, return NT_STATUS_NO_MEMORY; } } + prs_mem_free(&auth_info); return NT_STATUS_OK; } @@ -810,7 +811,7 @@ static NTSTATUS create_rpc_bind_resp(struct cli_state *cli, * Append the auth data to the outgoing buffer. */ - if(!prs_copy_data_in(rpc_out, ntlmssp_reply.data, ntlmssp_reply.length)) { + if(!prs_copy_data_in(rpc_out, (char *)ntlmssp_reply.data, ntlmssp_reply.length)) { DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n")); data_blob_free(&ntlmssp_reply); return NT_STATUS_NO_MEMORY; @@ -1016,7 +1017,7 @@ BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num, /* write auth footer onto the packet */ real_auth_len = sign_blob.length; - prs_copy_data_in(&sec_blob, sign_blob.data, sign_blob.length); + prs_copy_data_in(&sec_blob, (char *)sign_blob.data, sign_blob.length); data_blob_free(&sign_blob); } @@ -1492,7 +1493,9 @@ NTSTATUS cli_nt_establish_netlogon(struct cli_state *cli, int sec_chan, const uchar trust_password[16]) { NTSTATUS result; - uint32 neg_flags = 0x000001ff; + /* The 7 here seems to be required to get Win2k not to downgrade us + to NT4. Actually, anything other than 1ff would seem to do... */ + uint32 neg_flags = 0x000701ff; int fnum; cli_nt_netlogon_netsec_session_close(cli); @@ -1585,7 +1588,9 @@ NTSTATUS cli_nt_setup_netsec(struct cli_state *cli, int sec_chan, const uchar trust_password[16]) { NTSTATUS result; - uint32 neg_flags = 0x000001ff; + /* The 7 here seems to be required to get Win2k not to downgrade us + to NT4. Actually, anything other than 1ff would seem to do... */ + uint32 neg_flags = 0x000701ff; cli->pipe_auth_flags = 0; if (lp_client_schannel() == False) { diff --git a/source3/rpc_client/cli_spoolss.c b/source3/rpc_client/cli_spoolss.c index 6392620497..8f5f2413de 100644 --- a/source3/rpc_client/cli_spoolss.c +++ b/source3/rpc_client/cli_spoolss.c @@ -720,7 +720,7 @@ WERROR cli_spoolss_getprinterdriver(struct cli_state *cli, TALLOC_CTX *mem_ctx, uint32 offered, uint32 *needed, POLICY_HND *pol, uint32 level, - const char *env, PRINTER_DRIVER_CTR *ctr) + const char *env, int version, PRINTER_DRIVER_CTR *ctr) { prs_struct qbuf, rbuf; SPOOL_Q_GETPRINTERDRIVER2 q; @@ -742,7 +742,7 @@ WERROR cli_spoolss_getprinterdriver(struct cli_state *cli, prs_init(&qbuf, MAX_PDU_FRAG_LEN, mem_ctx, MARSHALL); prs_init(&rbuf, 0, mem_ctx, UNMARSHALL); - make_spoolss_q_getprinterdriver2(&q, pol, env, level, 2, 2, + make_spoolss_q_getprinterdriver2(&q, pol, env, level, version, 2, &buffer, offered); /* Marshall data and send request */ @@ -2027,7 +2027,7 @@ WERROR cli_spoolss_setprinterdata(struct cli_state *cli, TALLOC_CTX *mem_ctx, /* Initialise input parameters */ make_spoolss_q_setprinterdata( - &q, hnd, value->valuename, value->type, value->data_p, value->size); + &q, hnd, value->valuename, value->type, (char *)value->data_p, value->size); /* Marshall data and send request */ @@ -2072,7 +2072,7 @@ WERROR cli_spoolss_setprinterdataex(struct cli_state *cli, TALLOC_CTX *mem_ctx, /* Initialise input parameters */ make_spoolss_q_setprinterdataex( - &q, hnd, keyname, value->valuename, value->type, value->data_p, + &q, hnd, keyname, value->valuename, value->type, (char *)value->data_p, value->size); /* Marshall data and send request */ @@ -2215,7 +2215,7 @@ WERROR cli_spoolss_enumprinterdataex(struct cli_state *cli, TALLOC_CTX *mem_ctx, rpcstr_pull(name, v->valuename.buffer, sizeof(name), -1, STR_TERMINATE); - regval_ctr_addvalue(ctr, name, v->type, v->data, v->data_len); + regval_ctr_addvalue(ctr, name, v->type, (const char *)v->data, v->data_len); } done: diff --git a/source3/rpc_parse/parse_echo.c b/source3/rpc_parse/parse_echo.c index 67f9ad772e..4b1ff1f4d5 100644 --- a/source3/rpc_parse/parse_echo.c +++ b/source3/rpc_parse/parse_echo.c @@ -73,7 +73,7 @@ BOOL echo_io_q_echo_data(const char *desc, ECHO_Q_ECHO_DATA *q_d, return False; } - if (!prs_uint8s(False, "data", ps, depth, q_d->data, q_d->size)) + if (!prs_uint8s(False, "data", ps, depth, (unsigned char *)q_d->data, q_d->size)) return False; return True; @@ -92,7 +92,7 @@ BOOL echo_io_r_echo_data(const char *desc, ECHO_R_ECHO_DATA *q_d, return False; } - if (!prs_uint8s(False, "data", ps, depth, q_d->data, q_d->size)) + if (!prs_uint8s(False, "data", ps, depth, (unsigned char *)q_d->data, q_d->size)) return False; return True; @@ -120,7 +120,7 @@ BOOL echo_io_q_sink_data(const char *desc, ECHO_Q_SINK_DATA *q_d, return False; } - if (!prs_uint8s(False, "data", ps, depth, q_d->data, q_d->size)) + if (!prs_uint8s(False, "data", ps, depth, (unsigned char *)q_d->data, q_d->size)) return False; return True; @@ -159,7 +159,7 @@ BOOL echo_io_r_source_data(const char *desc, ECHO_R_SOURCE_DATA *q_d, return False; } - if (!prs_uint8s(False, "data", ps, depth, q_d->data, q_d->size)) + if (!prs_uint8s(False, "data", ps, depth, (unsigned char *)q_d->data, q_d->size)) return False; return True; diff --git a/source3/rpc_parse/parse_net.c b/source3/rpc_parse/parse_net.c index 804da707de..dd319df5a0 100644 --- a/source3/rpc_parse/parse_net.c +++ b/source3/rpc_parse/parse_net.c @@ -801,7 +801,7 @@ void init_q_srv_pwset(NET_Q_SRV_PWSET *q_s, DEBUG(5,("init_q_srv_pwset\n")); /* Process the new password. */ - cred_hash3( nt_cypher, hashed_mach_pwd, sess_key, 1); + cred_hash3( nt_cypher, hashed_mach_pwd, (const unsigned char *)sess_key, 1); init_clnt_info(&q_s->clnt_id, logon_srv, acct_name, sec_chan, comp_name, cred); @@ -2447,6 +2447,10 @@ static BOOL net_io_sam_policy_info(const char *desc, SAM_DELTA_POLICY *info, return True; } +#if 0 + +/* This function is pretty broken - see bug #334 */ + /******************************************************************* reads or writes a structure. ********************************************************************/ @@ -2495,6 +2499,12 @@ static BOOL net_io_sam_trustdoms_info(const char *desc, SAM_DELTA_TRUSTDOMS *inf return True; } +#endif + +#if 0 + +/* This function doesn't work - see bug #334 */ + /******************************************************************* reads or writes a structure. ********************************************************************/ @@ -2582,6 +2592,8 @@ static BOOL net_io_sam_secret_info(const char *desc, SAM_DELTA_SECRET *info, return True; } +#endif + /******************************************************************* reads or writes a structure. ********************************************************************/ @@ -2726,14 +2738,10 @@ static BOOL net_io_sam_delta_ctr(const char *desc, uint8 sess_key[16], return False; break; - case SAM_DELTA_TRUST_DOMS: - if (!net_io_sam_trustdoms_info("", &delta->trustdoms_info, ps, depth)) - return False; - break; + /* These guys are implemented but broken */ + case SAM_DELTA_TRUST_DOMS: case SAM_DELTA_SECRET_INFO: - if (!net_io_sam_secret_info("", &delta->secret_info, ps, depth)) - return False; break; /* These guys are not implemented yet */ diff --git a/source3/rpc_parse/parse_prs.c b/source3/rpc_parse/parse_prs.c index 11d8658b15..81a9573077 100644 --- a/source3/rpc_parse/parse_prs.c +++ b/source3/rpc_parse/parse_prs.c @@ -1402,7 +1402,7 @@ static void netsec_digest(struct netsec_auth_struct *a, if (auth_flags & AUTH_PIPE_SEAL) { MD5Update(&ctx3, verf->data8, sizeof(verf->data8)); } - MD5Update(&ctx3, data, data_len); + MD5Update(&ctx3, (const unsigned char *)data, data_len); MD5Final(whole_packet_digest, &ctx3); dump_data_pw("whole_packet_digest:\n", whole_packet_digest, sizeof(whole_packet_digest)); @@ -1429,7 +1429,7 @@ static void netsec_get_sealing_key(struct netsec_auth_struct *a, dump_data_pw("sess_kf0:\n", sess_kf0, sizeof(sess_kf0)); - /* MD5 of sess_kf0 and the high bytes of the sequence number */ + /* MD5 of sess_kf0 and 4 zero bytes */ hmac_md5(sess_kf0, zeros, 0x4, digest2); dump_data_pw("digest2:\n", digest2, sizeof(digest2)); @@ -1506,9 +1506,9 @@ void netsec_encode(struct netsec_auth_struct *a, int auth_flags, dump_data_pw("verf->data8_enc:\n", verf->data8, sizeof(verf->data8)); /* encode the packet payload */ - dump_data_pw("data:\n", data, data_len); - netsechash(sealing_key, data, data_len); - dump_data_pw("data_enc:\n", data, data_len); + dump_data_pw("data:\n", (const unsigned char *)data, data_len); + netsechash(sealing_key, (unsigned char *)data, data_len); + dump_data_pw("data_enc:\n", (const unsigned char *)data, data_len); } /* encode the sequence number (key based on packet digest) */ @@ -1578,9 +1578,9 @@ BOOL netsec_decode(struct netsec_auth_struct *a, int auth_flags, sizeof(verf->data8)); /* extract the packet payload */ - dump_data_pw("data :\n", data, data_len); - netsechash(sealing_key, data, data_len); - dump_data_pw("datadec:\n", data, data_len); + dump_data_pw("data :\n", (const unsigned char *)data, data_len); + netsechash(sealing_key, (unsigned char *)data, data_len); + dump_data_pw("datadec:\n", (const unsigned char *)data, data_len); } /* digest includes 'data' after unsealing */ diff --git a/source3/rpc_parse/parse_reg.c b/source3/rpc_parse/parse_reg.c index b4d20bf2ba..bbf6e6a8e3 100644 --- a/source3/rpc_parse/parse_reg.c +++ b/source3/rpc_parse/parse_reg.c @@ -40,7 +40,7 @@ static uint32 reg_init_buffer2( BUFFER2 *buf2, REGISTRY_VALUE *val ) return 0; real_size = regval_size(val); - init_buffer2( buf2, (char*)regval_data_p(val), real_size ); + init_buffer2( buf2, (unsigned char*)regval_data_p(val), real_size ); return real_size; } diff --git a/source3/rpc_parse/parse_samr.c b/source3/rpc_parse/parse_samr.c index fce3195225..1fe9b3231f 100644 --- a/source3/rpc_parse/parse_samr.c +++ b/source3/rpc_parse/parse_samr.c @@ -183,9 +183,9 @@ BOOL samr_io_r_lookup_domain(const char *desc, SAMR_R_LOOKUP_DOMAIN * r_u, reads or writes a structure. ********************************************************************/ -void init_samr_q_unknown_2d(SAMR_Q_UNKNOWN_2D * q_u, POLICY_HND *dom_pol, DOM_SID *sid) +void init_samr_q_remove_user_foreign_domain(SAMR_Q_REMOVE_USER_FOREIGN_DOMAIN * q_u, POLICY_HND *dom_pol, DOM_SID *sid) { - DEBUG(5, ("samr_init_samr_q_unknown_2d\n")); + DEBUG(5, ("samr_init_samr_q_remove_user_foreign_domain\n")); q_u->dom_pol = *dom_pol; init_dom_sid2(&q_u->sid, sid); @@ -195,13 +195,13 @@ void init_samr_q_unknown_2d(SAMR_Q_UNKNOWN_2D * q_u, POLICY_HND *dom_pol, DOM_SI reads or writes a structure. ********************************************************************/ -BOOL samr_io_q_unknown_2d(const char *desc, SAMR_Q_UNKNOWN_2D * q_u, +BOOL samr_io_q_remove_user_foreign_domain(const char *desc, SAMR_Q_REMOVE_USER_FOREIGN_DOMAIN * q_u, prs_struct *ps, int depth) { if (q_u == NULL) return False; - prs_debug(ps, depth, desc, "samr_io_q_unknown_2d"); + prs_debug(ps, depth, desc, "samr_io_q_remove_user_foreign_domain"); depth++; if(!prs_align(ps)) @@ -223,13 +223,13 @@ BOOL samr_io_q_unknown_2d(const char *desc, SAMR_Q_UNKNOWN_2D * q_u, reads or writes a structure. ********************************************************************/ -BOOL samr_io_r_unknown_2d(const char *desc, SAMR_R_UNKNOWN_2D * r_u, +BOOL samr_io_r_remove_user_foreign_domain(const char *desc, SAMR_R_REMOVE_USER_FOREIGN_DOMAIN * r_u, prs_struct *ps, int depth) { if (r_u == NULL) return False; - prs_debug(ps, depth, desc, "samr_io_r_unknown_2d"); + prs_debug(ps, depth, desc, "samr_io_r_remove_user_foreign_domain"); depth++; if(!prs_align(ps)) diff --git a/source3/rpc_parse/parse_spoolss.c b/source3/rpc_parse/parse_spoolss.c index 1a380c64d5..7ca9bccab4 100644 --- a/source3/rpc_parse/parse_spoolss.c +++ b/source3/rpc_parse/parse_spoolss.c @@ -1368,7 +1368,7 @@ BOOL spoolss_io_r_getprinterdata(const char *desc, SPOOL_R_GETPRINTERDATA *r_u, return False; if (UNMARSHALLING(ps) && r_u->size) { - r_u->data = prs_alloc_mem(ps, r_u->size); + r_u->data = (unsigned char *)prs_alloc_mem(ps, r_u->size); if(!r_u->data) return False; } @@ -6178,7 +6178,7 @@ BOOL make_spoolss_q_setprinterdata(SPOOL_Q_SETPRINTERDATA *q_u, const POLICY_HND init_unistr2(&q_u->value, value, strlen(value)+1); q_u->max_len = q_u->real_len = data_size; - q_u->data = data; + q_u->data = (unsigned char *)data; return True; } @@ -6195,7 +6195,7 @@ BOOL make_spoolss_q_setprinterdataex(SPOOL_Q_SETPRINTERDATAEX *q_u, const POLICY init_unistr2(&q_u->key, key, strlen(key)+1); q_u->max_len = q_u->real_len = data_size; - q_u->data = data; + q_u->data = (unsigned char *)data; return True; } @@ -6990,7 +6990,7 @@ BOOL spoolss_io_r_getprinterdataex(const char *desc, SPOOL_R_GETPRINTERDATAEX *r return False; if (UNMARSHALLING(ps) && r_u->size) { - r_u->data = prs_alloc_mem(ps, r_u->size); + r_u->data = (unsigned char *)prs_alloc_mem(ps, r_u->size); if(!r_u->data) return False; } @@ -7689,7 +7689,7 @@ BOOL make_spoolss_q_writeprinter(SPOOL_Q_WRITEPRINTER *q_u, { memcpy(&q_u->handle, handle, sizeof(POLICY_HND)); q_u->buffer_size = q_u->buffer_size2 = data_size; - q_u->buffer = data; + q_u->buffer = (unsigned char *)data; return True; } diff --git a/source3/rpc_server/srv_dfs.c b/source3/rpc_server/srv_dfs.c index 27bb0732b4..6c35917e61 100644 --- a/source3/rpc_server/srv_dfs.c +++ b/source3/rpc_server/srv_dfs.c @@ -157,17 +157,23 @@ static BOOL api_dfs_enum(pipes_struct *p) /******************************************************************* \pipe\netdfs commands ********************************************************************/ - -NTSTATUS rpc_dfs_init(void) +static struct api_struct api_netdfs_cmds[] = { - struct api_struct api_netdfs_cmds[] = - { {"DFS_EXIST", DFS_EXIST, api_dfs_exist }, {"DFS_ADD", DFS_ADD, api_dfs_add }, {"DFS_REMOVE", DFS_REMOVE, api_dfs_remove }, {"DFS_GET_INFO", DFS_GET_INFO, api_dfs_get_info }, {"DFS_ENUM", DFS_ENUM, api_dfs_enum } - }; +}; + +void netdfs_get_pipe_fns( struct api_struct **fns, int *n_fns ) +{ + *fns = api_netdfs_cmds; + *n_fns = sizeof(api_netdfs_cmds) / sizeof(struct api_struct); +} + +NTSTATUS rpc_dfs_init(void) +{ return rpc_pipe_register_commands(SMB_RPC_INTERFACE_VERSION, "netdfs", "netdfs", api_netdfs_cmds, sizeof(api_netdfs_cmds) / sizeof(struct api_struct)); } diff --git a/source3/rpc_server/srv_dfs_nt.c b/source3/rpc_server/srv_dfs_nt.c index eba4eaec75..3470ad99b4 100644 --- a/source3/rpc_server/srv_dfs_nt.c +++ b/source3/rpc_server/srv_dfs_nt.c @@ -159,7 +159,7 @@ WERROR _dfs_remove(pipes_struct *p, DFS_Q_DFS_REMOVE *q_u, { pstring refpath; pstrcpy(refpath,jn.referral_list[i].alternate_path); - trim_string(refpath, "\\", "\\"); + trim_char(refpath, '\\', '\\'); DEBUG(10,("_dfs_remove: refpath: .%s.\n", refpath)); if(strequal(refpath, altpath)) { @@ -257,7 +257,7 @@ static BOOL init_reply_dfs_info_3(TALLOC_CTX *ctx, struct junction_map* j, DFS_I struct referral* ref = &(j[i].referral_list[ii]); pstrcpy(path, ref->alternate_path); - trim_string(path,"\\",""); + trim_char(path,'\\','\0'); p = strrchr_m(path,'\\'); if(p==NULL) { diff --git a/source3/rpc_server/srv_echo.c b/source3/rpc_server/srv_echo.c index 166b6e939d..c6cfde07c1 100644 --- a/source3/rpc_server/srv_echo.c +++ b/source3/rpc_server/srv_echo.c @@ -120,18 +120,31 @@ static BOOL api_sink_data(pipes_struct *p) \pipe\rpcecho commands ********************************************************************/ -NTSTATUS rpc_echo_init(void) +struct api_struct api_echo_cmds[] = { + {"ADD_ONE", ECHO_ADD_ONE, api_add_one }, + {"ECHO_DATA", ECHO_DATA, api_echo_data }, + {"SOURCE_DATA", ECHO_SOURCE_DATA, api_source_data }, + {"SINK_DATA", ECHO_SINK_DATA, api_sink_data }, +}; + + +void echo_get_pipe_fns( struct api_struct **fns, int *n_fns ) { - struct api_struct api_echo_cmds[] = { - {"ADD_ONE", ECHO_ADD_ONE, api_add_one }, - {"ECHO_DATA", ECHO_DATA, api_echo_data }, - {"SOURCE_DATA", ECHO_SOURCE_DATA, api_source_data }, - {"SINK_DATA", ECHO_SINK_DATA, api_sink_data }, - }; + *fns = api_echo_cmds; + *n_fns = sizeof(api_echo_cmds) / sizeof(struct api_struct); +} +NTSTATUS rpc_echo_init(void) +{ return rpc_pipe_register_commands(SMB_RPC_INTERFACE_VERSION, "rpcecho", "rpcecho", api_echo_cmds, sizeof(api_echo_cmds) / sizeof(struct api_struct)); } +#else /* DEVELOPER */ + +NTSTATUS rpc_echo_init(void) +{ + return NT_STATUS_OK; +} #endif /* DEVELOPER */ diff --git a/source3/rpc_server/srv_lsa.c b/source3/rpc_server/srv_lsa.c index 34812b15d9..138fb1d7ef 100644 --- a/source3/rpc_server/srv_lsa.c +++ b/source3/rpc_server/srv_lsa.c @@ -644,9 +644,8 @@ static BOOL api_lsa_query_info2(pipes_struct *p) /*************************************************************************** \PIPE\ntlsa commands ***************************************************************************/ -NTSTATUS rpc_lsa_init(void) -{ -static const struct api_struct api_lsa_cmds[] = + +static struct api_struct api_lsa_cmds[] = { { "LSA_OPENPOLICY2" , LSA_OPENPOLICY2 , api_lsa_open_policy2 }, { "LSA_OPENPOLICY" , LSA_OPENPOLICY , api_lsa_open_policy }, @@ -671,17 +670,33 @@ static const struct api_struct api_lsa_cmds[] = ADS DC capabilities */ { "LSA_QUERYINFO2" , LSA_QUERYINFO2 , api_lsa_query_info2 } }; -/* - * NOTE: Certain calls can not be enabled if we aren't an ADS DC. Make sure - * these calls are always last and that you decrement by the amount of calls - * to disable. - */ - int funcs = sizeof(api_lsa_cmds) / sizeof(struct api_struct); - if (!(SEC_ADS == lp_security() && ROLE_DOMAIN_PDC == lp_server_role())) { - funcs -= 1; - } +static int count_fns(void) +{ + int funcs = sizeof(api_lsa_cmds) / sizeof(struct api_struct); + + /* + * NOTE: Certain calls can not be enabled if we aren't an ADS DC. Make sure + * these calls are always last and that you decrement by the amount of calls + * to disable. + */ + if (!(SEC_ADS == lp_security() && ROLE_DOMAIN_PDC == lp_server_role())) { + funcs -= 1; + } + + return funcs; +} +void lsa_get_pipe_fns( struct api_struct **fns, int *n_fns ) +{ + *fns = api_lsa_cmds; + *n_fns = count_fns(); +} + + +NTSTATUS rpc_lsa_init(void) +{ + int funcs = count_fns(); - return rpc_pipe_register_commands(SMB_RPC_INTERFACE_VERSION, "lsarpc", "lsass", api_lsa_cmds, - funcs); + return rpc_pipe_register_commands(SMB_RPC_INTERFACE_VERSION, "lsarpc", "lsass", api_lsa_cmds, + funcs); } diff --git a/source3/rpc_server/srv_lsa_ds.c b/source3/rpc_server/srv_lsa_ds.c new file mode 100644 index 0000000000..1e75175c2c --- /dev/null +++ b/source3/rpc_server/srv_lsa_ds.c @@ -0,0 +1,93 @@ +/* + * Unix SMB/CIFS implementation. + * RPC Pipe client / server routines + * Copyright (C) Gerald Carter 2003 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +/* This is the interface for the registry functions. */ + +#include "includes.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_RPC_SRV + +#if 0 /* disabled */ +/******************************************************************* + api_reg_open_entry + ********************************************************************/ + +static BOOL api_dsrole_get_primary_dominfo(pipes_struct *p) +{ + DS_Q_GETPRIMDOMINFO q_u; + DS_R_GETPRIMDOMINFO r_u; + prs_struct *data = &p->in_data.data; + prs_struct *rdata = &p->out_data.rdata; + + ZERO_STRUCT(q_u); + ZERO_STRUCT(r_u); + + /* grab the request */ + if ( !ds_io_q_getprimdominfo("", data, 0, &q_u) ) + return False; + + /* construct reply. */ + r_u.status = _dsrole_get_primary_dominfo( p, &q_u, &r_u ); + + if ( !ds_io_r_getprimdominfo("", rdata, 0, &r_u) ) + return False; + + return True; +} +#endif + +/******************************************************************* + stub functions for unimplemented RPC +*******************************************************************/ + +static BOOL api_dsrole_stub( pipes_struct *p ) +{ + DEBUG(0,("api_dsrole_stub: Hmmm....didn't know this RPC existed...\n")); + + return False; +} + + +/******************************************************************* + array of \PIPE\lsass (new windows 2000 UUID) operations +********************************************************************/ +static struct api_struct api_lsa_ds_cmds[] = { + { "DS_NOP", DS_NOP, api_dsrole_stub } + +#if 0 /* disabled due to breakage with viewing domain users and groups + on a Samba PDC from win2k clients --jerry CIFS 2003 */ + { "DS_GETPRIMDOMINFO", DS_GETPRIMDOMINFO, api_dsrole_get_primary_dominfo } +#endif + +}; + +void lsa_ds_get_pipe_fns( struct api_struct **fns, int *n_fns ) +{ + *fns = api_lsa_ds_cmds; + *n_fns = sizeof(api_lsa_ds_cmds) / sizeof(struct api_struct); +} + + +NTSTATUS rpc_lsa_ds_init(void) +{ + return rpc_pipe_register_commands(SMB_RPC_INTERFACE_VERSION, "lsa_ds", "lsa_ds", api_lsa_ds_cmds, + sizeof(api_lsa_ds_cmds) / sizeof(struct api_struct)); +} diff --git a/source3/rpc_server/srv_lsa_ds_nt.c b/source3/rpc_server/srv_lsa_ds_nt.c new file mode 100644 index 0000000000..37540a9668 --- /dev/null +++ b/source3/rpc_server/srv_lsa_ds_nt.c @@ -0,0 +1,127 @@ +/* + * Unix SMB/CIFS implementation. + * RPC Pipe client / server routines + * Copyright (C) Andrew Tridgell 1992-1997. + * Copyright (C) Luke Kenneth Casson Leighton 1996-1997. + * Copyright (C) Paul Ashton 1997. + * Copyright (C) Jeremy Allison 2001. + * Copyright (C) Gerald Carter 2002. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +/* Implementation of registry functions. */ + +#include "includes.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_RPC_SRV + +/******************************************************************** + Fill in a DS_DOMINFO_CTR structure + ********************************************************************/ + +static NTSTATUS fill_dsrole_dominfo_basic(TALLOC_CTX *ctx, DSROLE_PRIMARY_DOMAIN_INFO_BASIC **info) +{ + DSROLE_PRIMARY_DOMAIN_INFO_BASIC *basic; + const char *netbios_domain; + fstring dnsdomain; + + DEBUG(10,("fill_dsrole_dominfo_basic: enter\n")); + + if ( !(basic = talloc_zero(ctx, sizeof(DSROLE_PRIMARY_DOMAIN_INFO_BASIC))) ) { + DEBUG(0,("fill_dsrole_dominfo_basic: FATAL error! talloc_xero() failed\n")); + return NT_STATUS_NO_MEMORY; + } + + switch ( lp_server_role() ) { + case ROLE_STANDALONE: + basic->machine_role = DSROLE_STANDALONE_SRV; + break; + case ROLE_DOMAIN_MEMBER: + basic->machine_role = DSROLE_DOMAIN_MEMBER_SRV; + break; + case ROLE_DOMAIN_BDC: + basic->machine_role = DSROLE_BDC; + basic->flags = DSROLE_PRIMARY_DS_RUNNING|DSROLE_PRIMARY_DS_MIXED_MODE; + if ( secrets_fetch_domain_guid( lp_workgroup(), &basic->domain_guid ) ) + basic->flags |= DSROLE_PRIMARY_DOMAIN_GUID_PRESENT; + get_mydomname(dnsdomain); + strlower_m(dnsdomain); + break; + case ROLE_DOMAIN_PDC: + basic->machine_role = DSROLE_PDC; + basic->flags = DSROLE_PRIMARY_DS_RUNNING|DSROLE_PRIMARY_DS_MIXED_MODE; + if ( secrets_fetch_domain_guid( lp_workgroup(), &basic->domain_guid ) ) + basic->flags |= DSROLE_PRIMARY_DOMAIN_GUID_PRESENT; + get_mydomname(dnsdomain); + strlower_m(dnsdomain); + break; + } + + basic->unknown = 0x6173; /* seen on the wire; maybe padding */ + + /* always set netbios name */ + + basic->netbios_ptr = 1; + netbios_domain = get_global_sam_name(); + init_unistr2( &basic->netbios_domain, netbios_domain, strlen(netbios_domain) ); + + basic->dnsname_ptr = 1; + init_unistr2( &basic->dns_domain, dnsdomain, strlen(dnsdomain) ); + basic->forestname_ptr = 1; + init_unistr2( &basic->forest_domain, dnsdomain, strlen(dnsdomain) ); + + + /* fill in some additional fields if we are a member of an AD domain */ + + if ( lp_security() == SEC_ADS ) { + /* TODO */ + ;; + } + + *info = basic; + + return NT_STATUS_OK; +} + +/******************************************************************** + Implement the DsroleGetPrimaryDomainInfo() call + ********************************************************************/ + +NTSTATUS _dsrole_get_primary_dominfo(pipes_struct *p, DS_Q_GETPRIMDOMINFO *q_u, DS_R_GETPRIMDOMINFO *r_u) +{ + NTSTATUS result = NT_STATUS_OK; + uint32 level = q_u->level; + + switch ( level ) { + + case DsRolePrimaryDomainInfoBasic: + r_u->level = DsRolePrimaryDomainInfoBasic; + r_u->ptr = 1; + result = fill_dsrole_dominfo_basic( p->mem_ctx, &r_u->info.basic ); + break; + + default: + DEBUG(0,("_dsrole_get_primary_dominfo: Unsupported info level [%d]!\n", + level)); + result = NT_STATUS_INVALID_LEVEL; + } + + return result; +} + + + diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c index 9eafcb8dc3..330dd727ef 100644 --- a/source3/rpc_server/srv_lsa_nt.c +++ b/source3/rpc_server/srv_lsa_nt.c @@ -502,7 +502,7 @@ NTSTATUS _lsa_enum_trust_dom(pipes_struct *p, LSA_Q_ENUM_TRUST_DOM *q_u, LSA_R_E if (!(info->access & POLICY_VIEW_LOCAL_INFORMATION)) return NT_STATUS_ACCESS_DENIED; - nt_status = secrets_get_trusted_domains(p->mem_ctx, &enum_context, max_num_domains, &num_domains, &trust_doms); + nt_status = secrets_get_trusted_domains(p->mem_ctx, (int *)&enum_context, max_num_domains, (int *)&num_domains, &trust_doms); if (!NT_STATUS_IS_OK(nt_status) && !NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES) && diff --git a/source3/rpc_server/srv_netlog.c b/source3/rpc_server/srv_netlog.c index d1be2f3723..9c10d86379 100644 --- a/source3/rpc_server/srv_netlog.c +++ b/source3/rpc_server/srv_netlog.c @@ -320,10 +320,7 @@ static BOOL api_net_logon_ctrl(pipes_struct *p) /******************************************************************* array of \PIPE\NETLOGON operations ********************************************************************/ - -NTSTATUS rpc_net_init(void) -{ - static struct api_struct api_net_cmds [] = +static struct api_struct api_net_cmds [] = { { "NET_REQCHAL" , NET_REQCHAL , api_net_req_chal }, { "NET_AUTH" , NET_AUTH , api_net_auth }, @@ -336,6 +333,14 @@ NTSTATUS rpc_net_init(void) { "NET_LOGON_CTRL" , NET_LOGON_CTRL , api_net_logon_ctrl } }; +void netlog_get_pipe_fns( struct api_struct **fns, int *n_fns ) +{ + *fns = api_net_cmds; + *n_fns = sizeof(api_net_cmds) / sizeof(struct api_struct); +} + +NTSTATUS rpc_net_init(void) +{ return rpc_pipe_register_commands(SMB_RPC_INTERFACE_VERSION, "NETLOGON", "lsass", api_net_cmds, sizeof(api_net_cmds) / sizeof(struct api_struct)); } diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c index 594cb3a9ae..d1fb587d74 100644 --- a/source3/rpc_server/srv_pipe.c +++ b/source3/rpc_server/srv_pipe.c @@ -713,26 +713,19 @@ BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status) Used to reject unknown binds from Win2k. *******************************************************************/ -BOOL check_bind_req(char* pipe_name, RPC_IFACE* abstract, - RPC_IFACE* transfer) +BOOL check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract, + RPC_IFACE* transfer, uint32 context_id) { extern struct pipe_id_info pipe_names[]; + char *pipe_name = p->name; int i=0; fstring pname; + fstrcpy(pname,"\\PIPE\\"); fstrcat(pname,pipe_name); DEBUG(3,("check_bind_req for %s\n", pname)); -#ifndef SUPPORT_NEW_LSARPC_UUID - - /* check for the first pipe matching the name */ - - for ( i=0; pipe_names[i].client_pipe; i++ ) { - if ( strequal(pipe_names[i].client_pipe, pname) ) - break; - } -#else /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */ for ( i=0; pipe_names[i].client_pipe; i++ ) @@ -743,29 +736,34 @@ BOOL check_bind_req(char* pipe_name, RPC_IFACE* abstract, && (transfer->version == pipe_names[i].trans_syntax.version) && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(RPC_UUID)) == 0) ) { + struct api_struct *fns = NULL; + int n_fns = 0; + PIPE_RPC_FNS *context_fns; + + if ( !(context_fns = malloc(sizeof(PIPE_RPC_FNS))) ) { + DEBUG(0,("check_bind_req: malloc() failed!\n")); + return False; + } + + /* save the RPC function table associated with this bind */ + + get_pipe_fns(i, &fns, &n_fns); + + context_fns->cmds = fns; + context_fns->n_cmds = n_fns; + context_fns->context_id = context_id; + + /* add to the list of open contexts */ + + DLIST_ADD( p->contexts, context_fns ); + break; } } -#endif if(pipe_names[i].client_pipe == NULL) return False; -#ifndef SUPPORT_NEW_LSARPC_UUID - /* check the abstract interface */ - if ( (abstract->version != pipe_names[i].abstr_syntax.version) - || (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(RPC_UUID)) != 0) ) - { - return False; - } - - /* check the transfer interface */ - if ( (transfer->version != pipe_names[i].trans_syntax.version) - || (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(RPC_UUID)) != 0) ) - { - return False; - } -#endif return True; } @@ -861,7 +859,7 @@ BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p) } if (i == rpc_lookup_size) { - if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) { + if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) { DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n", p->name )); if(!setup_bind_nak(p)) @@ -878,10 +876,10 @@ BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p) } } - if (i == rpc_lookup_size) { - DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name)); - return False; - } + if (i == rpc_lookup_size) { + DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name)); + return False; + } } /* decode the bind request */ @@ -1028,7 +1026,8 @@ BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p) unknown to NT4) Needed when adding entries to a DACL from NT5 - SK */ - if(check_bind_req(p->name, &hdr_rb.abstract, &hdr_rb.transfer)) { + if(check_bind_req(p, &hdr_rb.abstract, &hdr_rb.transfer, hdr_rb.context_id )) + { init_rpc_hdr_ba(&hdr_ba, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN, @@ -1227,10 +1226,10 @@ BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in) sizeof(p->ntlmssp_hash)); dump_data_pw("Incoming RPC PDU (NTLMSSP sealed)\n", - data, data_len); + (const unsigned char *)data, data_len); NTLMSSPcalc_p(p, (uchar*)data, data_len); dump_data_pw("Incoming RPC PDU (NTLMSSP unsealed)\n", - data, data_len); + (const unsigned char *)data, data_len); crc32 = crc32_calc_buffer(data, data_len); } @@ -1391,6 +1390,48 @@ struct current_user *get_current_user(struct current_user *user, pipes_struct *p return user; } +/**************************************************************************** + Find the set of RPC functions associated with this context_id +****************************************************************************/ + +static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id ) +{ + PIPE_RPC_FNS *fns = NULL; + PIPE_RPC_FNS *tmp = NULL; + + if ( !list ) { + DEBUG(0,("find_pipe_fns_by_context: ERROR! No context list for pipe!\n")); + return NULL; + } + + for (tmp=list; tmp; tmp=tmp->next ) { + if ( tmp->context_id == context_id ) + break; + } + + fns = tmp; + + return fns; +} + +/**************************************************************************** + memory cleanup +****************************************************************************/ + +void free_pipe_rpc_context( PIPE_RPC_FNS *list ) +{ + PIPE_RPC_FNS *tmp = list; + PIPE_RPC_FNS *tmp2; + + while (tmp) { + tmp2 = tmp->next; + SAFE_FREE(tmp); + tmp = tmp2; + } + + return; +} + /**************************************************************************** Find the correct RPC function to call for this request. If the pipe is authenticated then become the correct UNIX user @@ -1399,9 +1440,9 @@ struct current_user *get_current_user(struct current_user *user, pipes_struct *p BOOL api_pipe_request(pipes_struct *p) { - int i = 0; BOOL ret = False; - + PIPE_RPC_FNS *pipe_fns; + if (p->ntlmssp_auth_validated) { if(!become_authenticated_pipe_user(p)) { @@ -1411,36 +1452,19 @@ BOOL api_pipe_request(pipes_struct *p) } DEBUG(5, ("Requested \\PIPE\\%s\n", p->name)); - - for (i = 0; i < rpc_lookup_size; i++) { - if (strequal(rpc_lookup[i].pipe.clnt, p->name)) { - DEBUG(3,("Doing \\PIPE\\%s\n", - rpc_lookup[i].pipe.clnt)); - set_current_rpc_talloc(p->mem_ctx); - ret = api_rpcTNP(p, rpc_lookup[i].pipe.clnt, - rpc_lookup[i].cmds, - rpc_lookup[i].n_cmds); - set_current_rpc_talloc(NULL); - break; - } + + /* get the set of RPC functions for this context */ + + pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id); + + if ( pipe_fns ) { + set_current_rpc_talloc(p->mem_ctx); + ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds); + set_current_rpc_talloc(NULL); } - - - if (i == rpc_lookup_size) { - smb_probe_module("rpc", p->name); - - for (i = 0; i < rpc_lookup_size; i++) { - if (strequal(rpc_lookup[i].pipe.clnt, p->name)) { - DEBUG(3,("Doing \\PIPE\\%s\n", - rpc_lookup[i].pipe.clnt)); - set_current_rpc_talloc(p->mem_ctx); - ret = api_rpcTNP(p, rpc_lookup[i].pipe.clnt, - rpc_lookup[i].cmds, - rpc_lookup[i].n_cmds); - set_current_rpc_talloc(NULL); - break; - } - } + else { + DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n", + p->hdr_req.context_id, p->name)); } if(p->ntlmssp_auth_validated) @@ -1529,3 +1553,56 @@ BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name, return True; } + +/******************************************************************* +*******************************************************************/ + +void get_pipe_fns( int idx, struct api_struct **fns, int *n_fns ) +{ + struct api_struct *cmds = NULL; + int n_cmds = 0; + + switch ( idx ) { + case PI_LSARPC: + lsa_get_pipe_fns( &cmds, &n_cmds ); + break; + case PI_LSARPC_DS: + lsa_ds_get_pipe_fns( &cmds, &n_cmds ); + break; + case PI_SAMR: + samr_get_pipe_fns( &cmds, &n_cmds ); + break; + case PI_NETLOGON: + netlog_get_pipe_fns( &cmds, &n_cmds ); + break; + case PI_SRVSVC: + srvsvc_get_pipe_fns( &cmds, &n_cmds ); + break; + case PI_WKSSVC: + wkssvc_get_pipe_fns( &cmds, &n_cmds ); + break; + case PI_WINREG: + reg_get_pipe_fns( &cmds, &n_cmds ); + break; + case PI_SPOOLSS: + spoolss_get_pipe_fns( &cmds, &n_cmds ); + break; + case PI_NETDFS: + netdfs_get_pipe_fns( &cmds, &n_cmds ); + break; +#ifdef DEVELOPER + case PI_ECHO: + echo_get_pipe_fns( &cmds, &n_cmds ); + break; +#endif + default: + DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx)); + } + + *fns = cmds; + *n_fns = n_cmds; + + return; +} + + diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c index 125f603771..55def97673 100644 --- a/source3/rpc_server/srv_pipe_hnd.c +++ b/source3/rpc_server/srv_pipe_hnd.c @@ -1106,6 +1106,8 @@ static BOOL close_internal_rpc_pipe_hnd(void *np_conn) if (p->mem_ctx) talloc_destroy(p->mem_ctx); + + free_pipe_rpc_context( p->contexts ); /* Free the handles database. */ close_policy_by_pipe(p); diff --git a/source3/rpc_server/srv_reg.c b/source3/rpc_server/srv_reg.c index e1a02103f7..b780be0aff 100644 --- a/source3/rpc_server/srv_reg.c +++ b/source3/rpc_server/srv_reg.c @@ -367,16 +367,12 @@ static BOOL api_reg_save_key(pipes_struct *p) return True; } - - /******************************************************************* array of \PIPE\reg operations ********************************************************************/ -NTSTATUS rpc_reg_init(void) +static struct api_struct api_reg_cmds[] = { - static struct api_struct api_reg_cmds[] = - { { "REG_CLOSE" , REG_CLOSE , api_reg_close }, { "REG_OPEN_ENTRY" , REG_OPEN_ENTRY , api_reg_open_entry }, { "REG_OPEN_HKCR" , REG_OPEN_HKCR , api_reg_open_hkcr }, @@ -390,7 +386,17 @@ NTSTATUS rpc_reg_init(void) { "REG_ABORT_SHUTDOWN" , REG_ABORT_SHUTDOWN , api_reg_abort_shutdown }, { "REG_UNKNOWN_1A" , REG_UNKNOWN_1A , api_reg_unknown_1a }, { "REG_SAVE_KEY" , REG_SAVE_KEY , api_reg_save_key } - }; +}; + +void reg_get_pipe_fns( struct api_struct **fns, int *n_fns ) +{ + *fns = api_reg_cmds; + *n_fns = sizeof(api_reg_cmds) / sizeof(struct api_struct); +} + +NTSTATUS rpc_reg_init(void) +{ + return rpc_pipe_register_commands(SMB_RPC_INTERFACE_VERSION, "winreg", "winreg", api_reg_cmds, sizeof(api_reg_cmds) / sizeof(struct api_struct)); } diff --git a/source3/rpc_server/srv_samr.c b/source3/rpc_server/srv_samr.c index 86ff039683..a0f62c20fc 100644 --- a/source3/rpc_server/srv_samr.c +++ b/source3/rpc_server/srv_samr.c @@ -386,7 +386,7 @@ static BOOL api_samr_chgpasswd_user(pipes_struct *p) ZERO_STRUCT(q_u); ZERO_STRUCT(r_u); - /* unknown 38 command */ + /* change password request */ if (!samr_io_q_chgpasswd_user("", &q_u, data, 0)) { DEBUG(0,("api_samr_chgpasswd_user: Failed to unmarshall SAMR_Q_CHGPASSWD_USER.\n")); return False; @@ -448,13 +448,12 @@ static BOOL api_samr_open_user(pipes_struct *p) ZERO_STRUCT(q_u); ZERO_STRUCT(r_u); - /* grab the samr unknown 22 */ if(!samr_io_q_open_user("", &q_u, data, 0)) { DEBUG(0,("api_samr_open_user: unable to unmarshall SAMR_Q_OPEN_USER.\n")); return False; } - r_u.status = _api_samr_open_user(p, &q_u, &r_u); + r_u.status = _samr_open_user(p, &q_u, &r_u); /* store the response in the SMB stream */ if(!samr_io_r_open_user("", &r_u, rdata, 0)) { @@ -479,7 +478,6 @@ static BOOL api_samr_query_userinfo(pipes_struct *p) ZERO_STRUCT(q_u); ZERO_STRUCT(r_u); - /* grab the samr unknown 24 */ if(!samr_io_q_query_userinfo("", &q_u, data, 0)){ DEBUG(0,("api_samr_query_userinfo: unable to unmarshall SAMR_Q_QUERY_USERINFO.\n")); return False; @@ -510,7 +508,6 @@ static BOOL api_samr_query_usergroups(pipes_struct *p) ZERO_STRUCT(q_u); ZERO_STRUCT(r_u); - /* grab the samr unknown 32 */ if(!samr_io_q_query_usergroups("", &q_u, data, 0)) { DEBUG(0,("api_samr_query_usergroups: unable to unmarshall SAMR_Q_QUERY_USERGROUPS.\n")); return False; @@ -541,7 +538,6 @@ static BOOL api_samr_query_dom_info(pipes_struct *p) ZERO_STRUCT(q_u); ZERO_STRUCT(r_u); - /* grab the samr unknown 8 command */ if(!samr_io_q_query_dom_info("", &q_u, data, 0)) { DEBUG(0,("api_samr_query_dom_info: unable to unmarshall SAMR_Q_QUERY_DOMAIN_INFO.\n")); return False; @@ -579,7 +575,7 @@ static BOOL api_samr_create_user(pipes_struct *p) return False; } - r_u.status=_api_samr_create_user(p, &q_u, &r_u); + r_u.status=_samr_create_user(p, &q_u, &r_u); /* store the response in the SMB stream */ if(!samr_io_r_create_user("", &r_u, rdata, 0)) { @@ -761,7 +757,7 @@ static BOOL api_samr_open_alias(pipes_struct *p) return False; } - r_u.status=_api_samr_open_alias(p, &q_u, &r_u); + r_u.status=_samr_open_alias(p, &q_u, &r_u); /* store the response in the SMB stream */ if(!samr_io_r_open_alias("", &r_u, rdata, 0)) { @@ -1347,13 +1343,13 @@ static BOOL api_samr_open_group(pipes_struct *p) } /******************************************************************* - api_samr_unknown_2d + api_samr_remove_user_foreign_domain ********************************************************************/ -static BOOL api_samr_unknown_2d(pipes_struct *p) +static BOOL api_samr_remove_user_foreign_domain(pipes_struct *p) { - SAMR_Q_UNKNOWN_2D q_u; - SAMR_R_UNKNOWN_2D r_u; + SAMR_Q_REMOVE_USER_FOREIGN_DOMAIN q_u; + SAMR_R_REMOVE_USER_FOREIGN_DOMAIN r_u; prs_struct *data = &p->in_data.data; prs_struct *rdata = &p->out_data.rdata; @@ -1361,15 +1357,15 @@ static BOOL api_samr_unknown_2d(pipes_struct *p) ZERO_STRUCT(q_u); ZERO_STRUCT(r_u); - if (!samr_io_q_unknown_2d("", &q_u, data, 0)) { - DEBUG(0,("api_samr_unknown_2d: unable to unmarshall SAMR_Q_UNKNOWN_2D.\n")); + if (!samr_io_q_remove_user_foreign_domain("", &q_u, data, 0)) { + DEBUG(0,("api_samr_remove_user_foreign_domain: unable to unmarshall SAMR_Q_REMOVE_USER_FOREIGN_DOMAIN.\n")); return False; } - r_u.status = _samr_unknown_2d(p, &q_u, &r_u); + r_u.status = _samr_remove_user_foreign_domain(p, &q_u, &r_u); - if (!samr_io_r_unknown_2d("", &r_u, rdata, 0)) { - DEBUG(0,("api_samr_unknown_2d: unable to marshall SAMR_R_UNKNOWN_2D.\n")); + if (!samr_io_r_remove_user_foreign_domain("", &r_u, rdata, 0)) { + DEBUG(0,("api_samr_remove_user_foreign_domain: unable to marshall SAMR_R_REMOVE_USER_FOREIGN_DOMAIN.\n")); return False; } @@ -1421,7 +1417,6 @@ static BOOL api_samr_set_dom_info(pipes_struct *p) ZERO_STRUCT(q_u); ZERO_STRUCT(r_u); - /* grab the samr unknown 8 command */ if(!samr_io_q_set_domain_info("", &q_u, data, 0)) { DEBUG(0,("api_samr_set_dom_info: unable to unmarshall SAMR_Q_SET_DOMAIN_INFO.\n")); return False; @@ -1442,10 +1437,8 @@ static BOOL api_samr_set_dom_info(pipes_struct *p) array of \PIPE\samr operations ********************************************************************/ -NTSTATUS rpc_samr_init(void) +static struct api_struct api_samr_cmds [] = { - static struct api_struct api_samr_cmds [] = - { {"SAMR_CLOSE_HND" , SAMR_CLOSE_HND , api_samr_close_hnd }, {"SAMR_CONNECT" , SAMR_CONNECT , api_samr_connect }, {"SAMR_CONNECT_ANON" , SAMR_CONNECT_ANON , api_samr_connect_anon }, @@ -1490,7 +1483,7 @@ NTSTATUS rpc_samr_init(void) {"SAMR_OPEN_ALIAS" , SAMR_OPEN_ALIAS , api_samr_open_alias }, {"SAMR_OPEN_GROUP" , SAMR_OPEN_GROUP , api_samr_open_group }, {"SAMR_OPEN_DOMAIN" , SAMR_OPEN_DOMAIN , api_samr_open_domain }, - {"SAMR_UNKNOWN_2D" , SAMR_UNKNOWN_2D , api_samr_unknown_2d }, + {"SAMR_REMOVE_USER_FOREIGN_DOMAIN" , SAMR_REMOVE_USER_FOREIGN_DOMAIN , api_samr_remove_user_foreign_domain }, {"SAMR_LOOKUP_DOMAIN" , SAMR_LOOKUP_DOMAIN , api_samr_lookup_domain }, {"SAMR_QUERY_SEC_OBJECT" , SAMR_QUERY_SEC_OBJECT , api_samr_query_sec_obj }, @@ -1499,7 +1492,17 @@ NTSTATUS rpc_samr_init(void) {"SAMR_UNKNOWN_2E" , SAMR_UNKNOWN_2E , api_samr_unknown_2e }, {"SAMR_SET_DOMAIN_INFO" , SAMR_SET_DOMAIN_INFO , api_samr_set_dom_info }, {"SAMR_CONNECT4" , SAMR_CONNECT4 , api_samr_connect4 } - }; +}; + +void samr_get_pipe_fns( struct api_struct **fns, int *n_fns ) +{ + *fns = api_samr_cmds; + *n_fns = sizeof(api_samr_cmds) / sizeof(struct api_struct); +} + + +NTSTATUS rpc_samr_init(void) +{ return rpc_pipe_register_commands(SMB_RPC_INTERFACE_VERSION, "samr", "lsass", api_samr_cmds, sizeof(api_samr_cmds) / sizeof(struct api_struct)); } diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c index 14aad5d6f8..7f7b5e8d5e 100644 --- a/source3/rpc_server/srv_samr_nt.c +++ b/source3/rpc_server/srv_samr_nt.c @@ -8,6 +8,7 @@ * Copyright (C) Jeremy Allison 2001-2002, * Copyright (C) Jean François Micouleau 1998-2001, * Copyright (C) Jim McDonough 2002. + * Copyright (C) Gerald (Jerry) Carter 2003. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -913,7 +914,6 @@ static NTSTATUS get_group_alias_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM } else if (sid_equal(sid, get_global_sam_sid()) && !lp_hide_local_users()) { struct sys_grent *glist; struct sys_grent *grp; - struct passwd *pw; gid_t winbind_gid_low, winbind_gid_high; BOOL winbind_groups_exist = lp_idmap_gid(&winbind_gid_low, &winbind_gid_high); @@ -952,7 +952,7 @@ static NTSTATUS get_group_alias_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DOM /* Don't return user private groups... */ - if ((pw = Get_Pwnam(smap.nt_name)) != 0) { + if (Get_Pwnam(smap.nt_name) != 0) { DEBUG(10,("get_group_alias_entries: not returing %s, clashes with user.\n", smap.nt_name )); continue; } @@ -1013,8 +1013,13 @@ static NTSTATUS get_group_domain_entries(TALLOC_CTX *ctx, DOMAIN_GRP **d_grp, DO *p_num_entries = 0; + /* access checks for the users were performed higher up. become/unbecome_root() + needed for some passdb backends to enumerate groups */ + + become_root(); pdb_enum_group_mapping(SID_NAME_DOM_GRP, &map, (int *)&group_entries, ENUM_ONLY_MAPPED); - + unbecome_root(); + num_entries=group_entries-start_idx; /* limit the number of entries */ @@ -1659,10 +1664,10 @@ NTSTATUS _samr_lookup_rids(pipes_struct *p, SAMR_Q_LOOKUP_RIDS *q_u, SAMR_R_LOOK } /******************************************************************* - _api_samr_open_user. Safe - gives out no passwd info. + _samr_open_user. Safe - gives out no passwd info. ********************************************************************/ -NTSTATUS _api_samr_open_user(pipes_struct *p, SAMR_Q_OPEN_USER *q_u, SAMR_R_OPEN_USER *r_u) +NTSTATUS _samr_open_user(pipes_struct *p, SAMR_Q_OPEN_USER *q_u, SAMR_R_OPEN_USER *r_u) { SAM_ACCOUNT *sampass=NULL; DOM_SID sid; @@ -2140,7 +2145,7 @@ NTSTATUS _samr_query_dom_info(pipes_struct *p, SAMR_Q_QUERY_DOMAIN_INFO *q_u, SA num_users, num_groups, num_aliases); break; case 0x03: - account_policy_get(AP_TIME_TO_LOGOUT, (int *)&u_logout); + account_policy_get(AP_TIME_TO_LOGOUT, (unsigned int *)&u_logout); unix_to_nt_time_abs(&nt_logout, u_logout); init_unk_info3(&ctr->info.inf3, nt_logout); @@ -2181,12 +2186,12 @@ NTSTATUS _samr_query_dom_info(pipes_struct *p, SAMR_Q_QUERY_DOMAIN_INFO *q_u, SA } /******************************************************************* - _api_samr_create_user + _samr_create_user Create an account, can be either a normal user or a machine. This funcion will need to be updated for bdc/domain trusts. ********************************************************************/ -NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_CREATE_USER *r_u) +NTSTATUS _samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_CREATE_USER *r_u) { SAM_ACCOUNT *sam_pass=NULL; fstring account; @@ -2300,12 +2305,12 @@ NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_ int add_ret; all_string_sub(add_script, "%u", account, sizeof(account)); add_ret = smbrun(add_script,NULL); - DEBUG(3,("_api_samr_create_user: Running the command `%s' gave %d\n", add_script, add_ret)); + DEBUG(3,("_samr_create_user: Running the command `%s' gave %d\n", add_script, add_ret)); } else /* no add user script -- ask winbindd to do it */ { if ( !winbind_create_user( account, &new_rid ) ) { - DEBUG(3,("_api_samr_create_user: winbind_create_user(%s) failed\n", + DEBUG(3,("_samr_create_user: winbind_create_user(%s) failed\n", account)); } } @@ -2369,6 +2374,7 @@ NTSTATUS _api_samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_ NTSTATUS _samr_connect_anon(pipes_struct *p, SAMR_Q_CONNECT_ANON *q_u, SAMR_R_CONNECT_ANON *r_u) { struct samr_info *info = NULL; + uint32 des_access = q_u->access_mask; /* Access check */ @@ -2386,6 +2392,13 @@ NTSTATUS _samr_connect_anon(pipes_struct *p, SAMR_Q_CONNECT_ANON *q_u, SAMR_R_CO if ((info = get_samr_info_by_sid(NULL)) == NULL) return NT_STATUS_NO_MEMORY; + /* don't give away the farm but this is probably ok. The SA_RIGHT_SAM_ENUM_DOMAINS + was observed from a win98 client trying to enumerate users (when configured + user level access control on shares) --jerry */ + + se_map_generic( &des_access, &sam_generic_mapping ); + info->acc_granted = des_access & (SA_RIGHT_SAM_ENUM_DOMAINS|SA_RIGHT_SAM_OPEN_DOMAIN); + info->status = q_u->unknown_0; /* get a (unique) handle. open a policy on it. */ @@ -2510,7 +2523,9 @@ NTSTATUS _samr_lookup_domain(pipes_struct *p, SAMR_Q_LOOKUP_DOMAIN *q_u, SAMR_R_ if (!find_policy_by_hnd(p, &q_u->connect_pol, (void**)&info)) return NT_STATUS_INVALID_HANDLE; - if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, SA_RIGHT_SAM_OPEN_DOMAIN, "_samr_lookup_domain"))) { + if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, + SA_RIGHT_SAM_ENUM_DOMAINS, "_samr_lookup_domain"))) + { return r_u->status; } @@ -2605,7 +2620,7 @@ NTSTATUS _samr_enum_domains(pipes_struct *p, SAMR_Q_ENUM_DOMAINS *q_u, SAMR_R_EN api_samr_open_alias ********************************************************************/ -NTSTATUS _api_samr_open_alias(pipes_struct *p, SAMR_Q_OPEN_ALIAS *q_u, SAMR_R_OPEN_ALIAS *r_u) +NTSTATUS _samr_open_alias(pipes_struct *p, SAMR_Q_OPEN_ALIAS *q_u, SAMR_R_OPEN_ALIAS *r_u) { DOM_SID sid; POLICY_HND domain_pol = q_u->dom_pol; @@ -3773,7 +3788,8 @@ NTSTATUS _samr_delete_dom_user(pipes_struct *p, SAMR_Q_DELETE_DOM_USER *q_u, SAM /* check if the user exists before trying to delete */ pdb_init_sam(&sam_pass); if(!pdb_getsampwsid(sam_pass, &user_sid)) { - DEBUG(5,("_samr_delete_dom_user:User %s doesn't exist.\n", pdb_get_username(sam_pass))); + DEBUG(5,("_samr_delete_dom_user:User %s doesn't exist.\n", + sid_string_static(&user_sid))); pdb_free_sam(&sam_pass); return NT_STATUS_NO_SUCH_USER; } @@ -4269,13 +4285,75 @@ NTSTATUS _samr_open_group(pipes_struct *p, SAMR_Q_OPEN_GROUP *q_u, SAMR_R_OPEN_G } /********************************************************************* - _samr_unknown_2d + _samr_remove_user_foreign_domain *********************************************************************/ -NTSTATUS _samr_unknown_2d(pipes_struct *p, SAMR_Q_UNKNOWN_2D *q_u, SAMR_R_UNKNOWN_2D *r_u) +NTSTATUS _samr_remove_user_foreign_domain(pipes_struct *p, + SAMR_Q_REMOVE_USER_FOREIGN_DOMAIN *q_u, + SAMR_R_REMOVE_USER_FOREIGN_DOMAIN *r_u) { - DEBUG(0,("_samr_unknown_2d: Not yet implemented.\n")); - return NT_STATUS_NOT_IMPLEMENTED; + DOM_SID user_sid, dom_sid; + SAM_ACCOUNT *sam_pass=NULL; + uint32 acc_granted; + + sid_copy( &user_sid, &q_u->sid.sid ); + + DEBUG(5,("_samr_remove_user_foreign_domain: removing user [%s]\n", + sid_string_static(&user_sid))); + + /* Find the policy handle. Open a policy on it. */ + + if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &dom_sid, &acc_granted)) + return NT_STATUS_INVALID_HANDLE; + + if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, + STD_RIGHT_DELETE_ACCESS, "_samr_remove_user_foreign_domain"))) + { + return r_u->status; + } + + if ( !sid_check_is_in_our_domain(&user_sid) ) { + DEBUG(5,("_samr_remove_user_foreign_domain: user not is our domain!\n")); + return NT_STATUS_NO_SUCH_USER; + } + + /* check if the user exists before trying to delete */ + + pdb_init_sam(&sam_pass); + + if ( !pdb_getsampwsid(sam_pass, &user_sid) ) { + + DEBUG(5,("_samr_remove_user_foreign_domain:User %s doesn't exist.\n", + sid_string_static(&user_sid))); + + pdb_free_sam(&sam_pass); + + return NT_STATUS_NO_SUCH_USER; + } + + /* + * delete the unix side + * + * note: we don't check if the delete really happened + * as the script is not necessary present + * and maybe the sysadmin doesn't want to delete the unix side + */ + + smb_delete_user(pdb_get_username(sam_pass)); + + /* and delete the samba side */ + + if ( !pdb_delete_sam_account(sam_pass) ) { + + DEBUG(5,("_samr_delete_dom_user:Failed to delete entry for user %s.\n", pdb_get_username(sam_pass))); + pdb_free_sam(&sam_pass); + + return NT_STATUS_CANNOT_DELETE; + } + + pdb_free_sam(&sam_pass); + + return NT_STATUS_OK; } /******************************************************************* diff --git a/source3/rpc_server/srv_spoolss.c b/source3/rpc_server/srv_spoolss.c index fa0ca8478c..f846813a40 100755 --- a/source3/rpc_server/srv_spoolss.c +++ b/source3/rpc_server/srv_spoolss.c @@ -141,7 +141,7 @@ static BOOL api_spoolss_deleteprinterdata(pipes_struct *p) return False; } - r_u.status = _spoolss_deleteprinterdata( p, &q_u, &r_u); + r_u.status = _spoolss_deleteprinterdata( p, &q_u, &r_u ); if (!spoolss_io_r_deleteprinterdata("", &r_u, rdata, 0)) { DEBUG(0,("spoolss_io_r_deleteprinterdata: unable to marshall SPOOL_R_DELETEPRINTERDATA.\n")); @@ -1580,8 +1580,6 @@ static BOOL api_spoolss_replycloseprinter(pipes_struct *p) \pipe\spoolss commands ********************************************************************/ -NTSTATUS rpc_spoolss_init(void) -{ struct api_struct api_spoolss_cmds[] = { {"SPOOLSS_OPENPRINTER", SPOOLSS_OPENPRINTER, api_spoolss_open_printer }, @@ -1640,6 +1638,15 @@ NTSTATUS rpc_spoolss_init(void) {"SPOOLSS_REPLYCLOSEPRINTER", SPOOLSS_REPLYCLOSEPRINTER, api_spoolss_replycloseprinter } #endif }; + +void spoolss_get_pipe_fns( struct api_struct **fns, int *n_fns ) +{ + *fns = api_spoolss_cmds; + *n_fns = sizeof(api_spoolss_cmds) / sizeof(struct api_struct); +} + +NTSTATUS rpc_spoolss_init(void) +{ return rpc_pipe_register_commands(SMB_RPC_INTERFACE_VERSION, "spoolss", "spoolss", api_spoolss_cmds, sizeof(api_spoolss_cmds) / sizeof(struct api_struct)); } diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c index 8237298ebb..7159527a7d 100644 --- a/source3/rpc_server/srv_spoolss_nt.c +++ b/source3/rpc_server/srv_spoolss_nt.c @@ -387,7 +387,6 @@ static WERROR delete_printer_handle(pipes_struct *p, POLICY_HND *hnd) char *cmd = lp_deleteprinter_cmd(); pstring command; int ret; - int i; /* Printer->dev.handlename equals portname equals sharename */ slprintf(command, sizeof(command)-1, "%s \"%s\"", cmd, @@ -406,7 +405,7 @@ static WERROR delete_printer_handle(pipes_struct *p, POLICY_HND *hnd) /* go ahead and re-read the services immediately */ reload_services( False ); - if ( ( i = lp_servicenumber( Printer->dev.handlename ) ) < 0 ) + if ( lp_servicenumber( Printer->dev.handlename ) < 0 ) return WERR_ACCESS_DENIED; } @@ -957,7 +956,7 @@ static void send_notify2_changes( SPOOLSS_NOTIFY_MSG_CTR *ctr, uint32 idx ) SPOOL_NOTIFY_INFO_DATA *data; uint32 data_len = 0; uint32 id; - int i, event_index; + int i; /* Is there notification on this handle? */ @@ -980,8 +979,6 @@ static void send_notify2_changes( SPOOLSS_NOTIFY_MSG_CTR *ctr, uint32 idx ) data = talloc( mem_ctx, msg_group->num_msgs*sizeof(SPOOL_NOTIFY_INFO_DATA) ); ZERO_STRUCTP(data); - event_index = 0; - /* build the array of change notifications */ sending_msg_count = 0; @@ -2671,6 +2668,8 @@ static BOOL srv_spoolss_replyopenprinter(int snum, const char *printer, fstrcpy(unix_printer, printer+2); /* the +2 is to strip the leading 2 backslashs */ + ZERO_STRUCT(notify_cli); + if(!spoolss_connect_to_client(¬ify_cli, client_ip, unix_printer)) return False; @@ -3753,7 +3752,6 @@ static WERROR printserver_notify_info(pipes_struct *p, POLICY_HND *hnd, Printer_entry *Printer=find_printer_index_by_hnd(p, hnd); int n_services=lp_numservices(); int i; - uint32 id; SPOOL_NOTIFY_OPTION *option; SPOOL_NOTIFY_OPTION_TYPE *option_type; @@ -3763,7 +3761,6 @@ static WERROR printserver_notify_info(pipes_struct *p, POLICY_HND *hnd, return WERR_BADFID; option=Printer->notify.option; - id=1; info->version=2; info->data=NULL; info->count=0; @@ -6192,12 +6189,9 @@ static WERROR publish_or_unpublish_printer(pipes_struct *p, POLICY_HND *handle, SPOOL_PRINTER_INFO_LEVEL_7 *info7 = info->info_7; int snum; Printer_entry *Printer = find_printer_index_by_hnd(p, handle); - WERROR result; DEBUG(5,("publish_or_unpublish_printer, action = %d\n",info7->action)); - result = WERR_OK; - if (!Printer) return WERR_BADFID; @@ -7100,7 +7094,6 @@ static void fill_port_2(PORT_INFO_2 *port, const char *name) init_unistr(&port->port_name, name); init_unistr(&port->monitor_name, "Local Monitor"); init_unistr(&port->description, "Local Port"); -#define PORT_TYPE_WRITE 1 port->port_type=PORT_TYPE_WRITE; port->reserved=0x0; } @@ -7723,7 +7716,6 @@ WERROR _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, S NT_PRINTER_INFO_LEVEL *printer = NULL; - uint32 param_index; uint32 biggest_valuesize; uint32 biggest_datasize; uint32 data_len; @@ -7772,7 +7764,6 @@ WERROR _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, S { DEBUGADD(6,("Activating NT mega-hack to find sizes\n")); - param_index = 0; biggest_valuesize = 0; biggest_datasize = 0; @@ -8032,6 +8023,9 @@ WERROR _spoolss_deleteprinterdata(pipes_struct *p, SPOOL_Q_DELETEPRINTERDATA *q_ unistr2_to_ascii( valuename, value, sizeof(valuename)-1 ); status = delete_printer_dataex( printer, SPOOL_PRINTERDATA_KEY, valuename ); + + if ( W_ERROR_IS_OK(status) ) + mod_a_printer( *printer, 2 ); free_a_printer(&printer, 2); @@ -8895,6 +8889,9 @@ WERROR _spoolss_deleteprinterdataex(pipes_struct *p, SPOOL_Q_DELETEPRINTERDATAEX status = delete_printer_dataex( printer, keyname, valuename ); + if ( W_ERROR_IS_OK(status) ) + mod_a_printer( *printer, 2 ); + free_a_printer(&printer, 2); return status; @@ -9186,12 +9183,11 @@ static WERROR getprintprocessordirectory_level_1(UNISTR2 *name, { pstring path; pstring long_archi; - const char *short_archi; PRINTPROCESSOR_DIRECTORY_1 *info=NULL; unistr2_to_ascii(long_archi, environment, sizeof(long_archi)-1); - if (!(short_archi = get_short_archi(long_archi))) + if (!get_short_archi(long_archi)) return WERR_INVALID_ENVIRONMENT; if((info=(PRINTPROCESSOR_DIRECTORY_1 *)malloc(sizeof(PRINTPROCESSOR_DIRECTORY_1))) == NULL) diff --git a/source3/rpc_server/srv_srvsvc.c b/source3/rpc_server/srv_srvsvc.c index 0da3cf70dd..9d85088e56 100644 --- a/source3/rpc_server/srv_srvsvc.c +++ b/source3/rpc_server/srv_srvsvc.c @@ -526,10 +526,8 @@ static BOOL api_srv_net_file_set_secdesc(pipes_struct *p) \PIPE\srvsvc commands ********************************************************************/ -NTSTATUS rpc_srv_init(void) +static struct api_struct api_srv_cmds[] = { - static const struct api_struct api_srv_cmds[] = - { { "SRV_NET_CONN_ENUM" , SRV_NET_CONN_ENUM , api_srv_net_conn_enum }, { "SRV_NET_SESS_ENUM" , SRV_NET_SESS_ENUM , api_srv_net_sess_enum }, { "SRV_NET_SHARE_ENUM_ALL" , SRV_NET_SHARE_ENUM_ALL , api_srv_net_share_enum_all }, @@ -547,7 +545,17 @@ NTSTATUS rpc_srv_init(void) { "SRV_NET_NAME_VALIDATE" , SRV_NET_NAME_VALIDATE , api_srv_net_name_validate }, { "SRV_NET_FILE_QUERY_SECDESC", SRV_NET_FILE_QUERY_SECDESC, api_srv_net_file_query_secdesc }, { "SRV_NET_FILE_SET_SECDESC" , SRV_NET_FILE_SET_SECDESC , api_srv_net_file_set_secdesc } - }; +}; + +void srvsvc_get_pipe_fns( struct api_struct **fns, int *n_fns ) +{ + *fns = api_srv_cmds; + *n_fns = sizeof(api_srv_cmds) / sizeof(struct api_struct); +} + + +NTSTATUS rpc_srv_init(void) +{ return rpc_pipe_register_commands(SMB_RPC_INTERFACE_VERSION, "srvsvc", "ntsvcs", api_srv_cmds, sizeof(api_srv_cmds) / sizeof(struct api_struct)); } diff --git a/source3/rpc_server/srv_util.c b/source3/rpc_server/srv_util.c index 03e53118a8..632d381503 100644 --- a/source3/rpc_server/srv_util.c +++ b/source3/rpc_server/srv_util.c @@ -307,8 +307,17 @@ BOOL get_domain_user_groups(TALLOC_CTX *ctx, int *numgroups, DOM_GID **pgids, SA */ gids = (DOM_GID *)talloc(ctx, sizeof(DOM_GID) * num_entries); - /* for each group, check if the user is a member of*/ + /* for each group, check if the user is a member of. Only include groups + from this domain */ + for(i=0; idesthost, flags, &trusts, &num_domains ); diff --git a/source3/rpcclient/cmd_netlogon.c b/source3/rpcclient/cmd_netlogon.c index 0ec78a0673..a48b59bf6a 100644 --- a/source3/rpcclient/cmd_netlogon.c +++ b/source3/rpcclient/cmd_netlogon.c @@ -146,13 +146,10 @@ static NTSTATUS cmd_netlogon_sam_sync(struct cli_state *cli, const char **argv) { NTSTATUS result = NT_STATUS_UNSUCCESSFUL; - unsigned char trust_passwd[16]; uint32 database_id = 0, num_deltas; SAM_DELTA_HDR *hdr_deltas; SAM_DELTA_CTR *deltas; DOM_CRED ret_creds; - uint32 neg_flags = 0x000001ff; - uint32 sec_channel_type = 0; if (argc > 2) { fprintf(stderr, "Usage: %s [database_id]\n", argv[0]); @@ -162,26 +159,6 @@ static NTSTATUS cmd_netlogon_sam_sync(struct cli_state *cli, if (argc == 2) database_id = atoi(argv[1]); - if (!secrets_init()) { - fprintf(stderr, "Unable to initialise secrets database\n"); - return result; - } - - /* Initialise session credentials */ - - if (!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd, - NULL, &sec_channel_type)) { - fprintf(stderr, "could not fetch trust account password\n"); - goto done; - } - - result = cli_nt_setup_creds(cli, sec_channel_type, trust_passwd, &neg_flags, 2); - - if (!NT_STATUS_IS_OK(result)) { - fprintf(stderr, "Error initialising session creds\n"); - goto done; - } - /* on first call the returnAuthenticator is empty */ memset(&ret_creds, 0, sizeof(ret_creds)); @@ -208,13 +185,10 @@ static NTSTATUS cmd_netlogon_sam_deltas(struct cli_state *cli, const char **argv) { NTSTATUS result = NT_STATUS_UNSUCCESSFUL; - unsigned char trust_passwd[16]; uint32 database_id, num_deltas, tmp; SAM_DELTA_HDR *hdr_deltas; SAM_DELTA_CTR *deltas; UINT64_S seqnum; - uint32 neg_flags = 0x000001ff; - uint32 sec_channel_type = 0; if (argc != 3) { fprintf(stderr, "Usage: %s database_id seqnum\n", argv[0]); @@ -227,28 +201,6 @@ static NTSTATUS cmd_netlogon_sam_deltas(struct cli_state *cli, seqnum.low = tmp & 0xffff; seqnum.high = 0; - if (!secrets_init()) { - fprintf(stderr, "Unable to initialise secrets database\n"); - goto done; - } - - /* Initialise session credentials */ - - if (!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd, - NULL, &sec_channel_type)) { - fprintf(stderr, "could not fetch trust account password\n"); - goto done; - } - - result = cli_nt_setup_creds(cli, sec_channel_type, trust_passwd, &neg_flags, 2); - - if (!NT_STATUS_IS_OK(result)) { - fprintf(stderr, "Error initialising session creds\n"); - goto done; - } - - /* Synchronise sam database */ - result = cli_netlogon_sam_deltas(cli, mem_ctx, database_id, seqnum, &num_deltas, &hdr_deltas, &deltas); @@ -308,6 +260,8 @@ static NTSTATUS cmd_netlogon_sam_logon(struct cli_state *cli, result = cli_netlogon_sam_logon(cli, mem_ctx, &ret_creds, username, password, logon_type); + clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds); + if (!NT_STATUS_IS_OK(result)) goto done; @@ -315,6 +269,39 @@ static NTSTATUS cmd_netlogon_sam_logon(struct cli_state *cli, return result; } +/* Change the trust account password */ + +static NTSTATUS cmd_netlogon_change_trust_pw(struct cli_state *cli, + TALLOC_CTX *mem_ctx, int argc, + const char **argv) +{ + NTSTATUS result = NT_STATUS_UNSUCCESSFUL; + DOM_CRED ret_creds; + + /* Check arguments */ + + if (argc > 1) { + fprintf(stderr, "Usage: change_trust_pw"); + return NT_STATUS_OK; + } + + /* Perform the sam logon */ + + ZERO_STRUCT(ret_creds); + + result = trust_pw_find_change_and_store_it(cli, mem_ctx, + lp_workgroup()); + + clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds); + + if (!NT_STATUS_IS_OK(result)) + goto done; + + done: + return result; +} + + /* List of commands exported by this module */ struct cmd_set netlogon_commands[] = { @@ -325,7 +312,8 @@ struct cmd_set netlogon_commands[] = { { "logonctrl", RPC_RTYPE_NTSTATUS, cmd_netlogon_logon_ctrl, NULL, PI_NETLOGON, "Logon Control", "" }, { "samsync", RPC_RTYPE_NTSTATUS, cmd_netlogon_sam_sync, NULL, PI_NETLOGON, "Sam Synchronisation", "" }, { "samdeltas", RPC_RTYPE_NTSTATUS, cmd_netlogon_sam_deltas, NULL, PI_NETLOGON, "Query Sam Deltas", "" }, - { "samlogon", RPC_RTYPE_NTSTATUS, cmd_netlogon_sam_logon, NULL, PI_NETLOGON, "Sam Logon", "" }, + { "samlogon", RPC_RTYPE_NTSTATUS, cmd_netlogon_sam_logon, NULL, PI_NETLOGON, "Sam Logon", "" }, + { "samlogon", RPC_RTYPE_NTSTATUS, cmd_netlogon_change_trust_pw, NULL, PI_NETLOGON, "Change Trust Account Password", "" }, { NULL } }; diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c index b2fa802e9a..61e100c03b 100644 --- a/source3/rpcclient/cmd_spoolss.c +++ b/source3/rpcclient/cmd_spoolss.c @@ -35,6 +35,7 @@ static const struct table_node archi_table[]= { {"Windows 4.0", "WIN40", 0 }, {"Windows NT x86", "W32X86", 2 }, + {"Windows NT x86", "W32X86", 3 }, {"Windows NT R4000", "W32MIPS", 2 }, {"Windows NT Alpha_AXP", "W32ALPHA", 2 }, {"Windows NT PowerPC", "W32PPC", 2 }, @@ -395,7 +396,31 @@ static void display_port_info_2(PORT_INFO_2 *i2) rpcstr_pull(buffer, i2->description.buffer, sizeof(buffer), -1, STR_TERMINATE); printf("\tDescription:\t[%s]\n", buffer); - printf("\tPort Type:\t[%d]\n", i2->port_type); + printf("\tPort Type:\t" ); + if ( i2->port_type ) { + int comma = 0; /* hack */ + printf( "[" ); + if ( i2->port_type & PORT_TYPE_READ ) { + printf( "Read" ); + comma = 1; + } + if ( i2->port_type & PORT_TYPE_WRITE ) { + printf( "%sWrite", comma ? ", " : "" ); + comma = 1; + } + /* These two have slightly different interpretations + on 95/98/ME but I'm disregarding that for now */ + if ( i2->port_type & PORT_TYPE_REDIRECTED ) { + printf( "%sRedirected", comma ? ", " : "" ); + comma = 1; + } + if ( i2->port_type & PORT_TYPE_NET_ATTACHED ) { + printf( "%sNet-Attached", comma ? ", " : "" ); + } + printf( "]\n" ); + } else { + printf( "[Unset]\n" ); + } printf("\tReserved:\t[%d]\n", i2->reserved); printf("\n"); } @@ -912,6 +937,7 @@ static WERROR cmd_spoolss_getdriver(struct cli_state *cli, servername, user; uint32 i; + BOOL success = False; if ((argc == 1) || (argc > 3)) { @@ -947,15 +973,22 @@ static WERROR cmd_spoolss_getdriver(struct cli_state *cli, werror = cli_spoolss_getprinterdriver( cli, mem_ctx, 0, &needed, &pol, info_level, - archi_table[i].long_archi, &ctr); + archi_table[i].long_archi, archi_table[i].version, + &ctr); - if (W_ERROR_V(werror) == ERRinsufficientbuffer) + if (W_ERROR_V(werror) == ERRinsufficientbuffer) { werror = cli_spoolss_getprinterdriver( cli, mem_ctx, needed, NULL, &pol, info_level, - archi_table[i].long_archi, &ctr); + archi_table[i].long_archi, archi_table[i].version, + &ctr); + } if (!W_ERROR_IS_OK(werror)) continue; + + /* need at least one success */ + + success = True; printf ("\n[%s]\n", archi_table[i].long_archi); @@ -980,6 +1013,9 @@ static WERROR cmd_spoolss_getdriver(struct cli_state *cli, if (opened_hnd) cli_spoolss_close_printer (cli, mem_ctx, &pol); + if ( success ) + werror = WERR_OK; + return werror; } diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c index 831d2beaa4..515489292b 100644 --- a/source3/rpcclient/rpcclient.c +++ b/source3/rpcclient/rpcclient.c @@ -40,7 +40,7 @@ static struct cmd_list { /**************************************************************************** handle completion of commands for readline ****************************************************************************/ -static char **completion_fn(char *text, int start, int end) +static char **completion_fn(const char *text, int start, int end) { #define MAX_COMPLETIONS 100 char **matches; @@ -361,7 +361,7 @@ static NTSTATUS cmd_schannel(struct cli_state *cli, TALLOC_CTX *mem_ctx, static uchar zeros[16]; if (argc == 2) { - strhex_to_str(cli->auth_info.sess_key, + strhex_to_str((char *)cli->auth_info.sess_key, strlen(argv[1]), argv[1]); memcpy(cli->sess_key, cli->auth_info.sess_key, sizeof(cli->sess_key)); @@ -522,6 +522,8 @@ static NTSTATUS do_cmd(struct cli_state *cli, /* some of the DsXXX commands use the netlogon pipe */ if (lp_client_schannel() && (cmd_entry->pipe_idx == PI_NETLOGON) && !(cli->pipe_auth_flags & AUTH_PIPE_NETSEC)) { + /* The 7 here seems to be required to get Win2k not to downgrade us + to NT4. Actually, anything other than 1ff would seem to do... */ uint32 neg_flags = 0x000001ff; uint32 sec_channel_type; @@ -725,8 +727,10 @@ out_free: nt_status = cli_full_connection(&cli, global_myname(), server, opt_ipaddr ? &server_ip : NULL, 0, "IPC$", "IPC", - cmdline_auth_info.username, lp_workgroup(), - cmdline_auth_info.password, 0, + cmdline_auth_info.username, + lp_workgroup(), + cmdline_auth_info.password, + cmdline_auth_info.use_kerberos ? CLI_FULL_CONNECTION_USE_KERBEROS : 0, cmdline_auth_info.signing_state,NULL); if (!NT_STATUS_IS_OK(nt_status)) { diff --git a/source3/sam/idmap_ldap.c b/source3/sam/idmap_ldap.c index 9a1ee039d0..6122641718 100644 --- a/source3/sam/idmap_ldap.c +++ b/source3/sam/idmap_ldap.c @@ -4,7 +4,7 @@ idmap LDAP backend Copyright (C) Tim Potter 2000 - Copyright (C) Anthony Liguori 2003 + Copyright (C) Jim McDonough 2003 Copyright (C) Simo Sorce 2003 Copyright (C) Gerald Carter 2003 @@ -41,12 +41,6 @@ struct ldap_idmap_state { struct smbldap_state *smbldap_state; TALLOC_CTX *mem_ctx; - - uint32 low_allocated_user_rid; - uint32 high_allocated_user_rid; - uint32 low_allocated_group_rid; - uint32 high_allocated_group_rid; - }; #define LDAP_MAX_ALLOC_ID 128 /* number tries while allocating @@ -203,11 +197,7 @@ static NTSTATUS ldap_next_rid(struct ldap_idmap_state *state, uint32 *rid, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_USERRID), old_rid_string)) { - - *rid = (uint32)atol(old_rid_string); - - } else { - *rid = state->low_allocated_user_rid; + *rid = (uint32)atol(old_rid_string); } break; case GROUP_RID_TYPE: @@ -216,8 +206,6 @@ static NTSTATUS ldap_next_rid(struct ldap_idmap_state *state, uint32 *rid, old_rid_string)) { *rid = (uint32)atol(old_rid_string); - } else { - *rid = state->low_allocated_group_rid; } break; } @@ -231,10 +219,6 @@ static NTSTATUS ldap_next_rid(struct ldap_idmap_state *state, uint32 *rid, switch (rid_type) { case USER_RID_TYPE: - if (next_rid > state->high_allocated_user_rid) { - return NT_STATUS_UNSUCCESSFUL; - } - /* Try to make the modification atomically by enforcing the old value in the delete mod. */ smbldap_make_mod(state->smbldap_state->ldap_struct, entry, &mods, @@ -243,10 +227,6 @@ static NTSTATUS ldap_next_rid(struct ldap_idmap_state *state, uint32 *rid, break; case GROUP_RID_TYPE: - if (next_rid > state->high_allocated_group_rid) { - return NT_STATUS_UNSUCCESSFUL; - } - /* Try to make the modification atomically by enforcing the old value in the delete mod. */ smbldap_make_mod(state->smbldap_state->ldap_struct, entry, &mods, @@ -361,7 +341,7 @@ static NTSTATUS ldap_allocate_id(unid_t *id, int id_type) get_attr_key2string( idpool_attr_list, LDAP_ATTR_UIDNUMBER ) : get_attr_key2string( idpool_attr_list, LDAP_ATTR_GIDNUMBER ); - snprintf(filter, sizeof(filter)-1, "(objectClass=%s)", LDAP_OBJ_IDPOOL); + pstr_sprintf(filter, "(objectClass=%s)", LDAP_OBJ_IDPOOL); attr_list = get_attr_list( idpool_attr_list ); @@ -400,20 +380,23 @@ static NTSTATUS ldap_allocate_id(unid_t *id, int id_type) if (id_type & ID_USERID) { id->uid = strtoul(id_str, NULL, 10); if (id->uid > huid ) { - DEBUG(0,("ldap_allocate_id: Cannot allocate uid above %d!\n", huid)); + DEBUG(0,("ldap_allocate_id: Cannot allocate uid above %lu!\n", + (unsigned long)huid)); goto out; } } else { id->gid = strtoul(id_str, NULL, 10); if (id->gid > hgid ) { - DEBUG(0,("ldap_allocate_id: Cannot allocate gid above %d!\n", hgid)); + DEBUG(0,("ldap_allocate_id: Cannot allocate gid above %lu!\n", + (unsigned long)hgid)); goto out; } } - snprintf(new_id_str, sizeof(new_id_str), "%u", - ((id_type & ID_USERID) ? id->uid : id->gid) + 1); + pstr_sprintf(new_id_str, "%lu", + ((id_type & ID_USERID) ? (unsigned long)id->uid : + (unsigned long)id->gid) + 1); smbldap_set_mod( &mods, LDAP_MOD_DELETE, type, id_str ); smbldap_set_mod( &mods, LDAP_MOD_ADD, type, new_id_str ); @@ -458,27 +441,38 @@ static NTSTATUS ldap_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) if ( id_type & ID_USERID ) { type = get_attr_key2string( idpool_attr_list, LDAP_ATTR_UIDNUMBER ); obj_class = LDAP_OBJ_SAMBASAMACCOUNT; - snprintf(id_str, sizeof(id_str), "%u", id.uid ); + fstr_sprintf(id_str, "%lu", (unsigned long)id.uid ); pstrcpy( suffix, lp_ldap_suffix()); } else { type = get_attr_key2string( idpool_attr_list, LDAP_ATTR_GIDNUMBER ); obj_class = LDAP_OBJ_GROUPMAP; - snprintf(id_str, sizeof(id_str), "%u", id.gid ); + fstr_sprintf(id_str, "%lu", (unsigned long)id.gid ); pstrcpy( suffix, lp_ldap_group_suffix() ); } + + DEBUG(5,("ldap_get_sid_from_id: Searching \"%s\"\n", filter )); attr_list = get_attr_list( sidmap_attr_list ); - snprintf(filter, sizeof(filter), "(&(|(objectClass=%s)(objectClass=%s))(%s=%s))", + pstr_sprintf(filter, "(&(|(objectClass=%s)(objectClass=%s))(%s=%s))", LDAP_OBJ_IDMAP_ENTRY, obj_class, type, id_str); rc = smbldap_search(ldap_state.smbldap_state, suffix, LDAP_SCOPE_SUBTREE, filter, attr_list, 0, &result); - if (rc != LDAP_SUCCESS) + if (rc != LDAP_SUCCESS) { + DEBUG(3,("ldap_get_isd_from_id: Failure looking up entry (%s)\n", + ldap_err2string(rc) )); goto out; - + } + count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result); + + if (count > 1) { + DEBUG(0,("ldap_get_sid_from_id: mapping returned [%d] entries!\n", + count)); + goto out; + } /* fall back to looking up an idmap entry if we didn't find and actual user or group */ @@ -487,24 +481,30 @@ static NTSTATUS ldap_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) ldap_msgfree(result); result = NULL; - snprintf(filter, sizeof(filter), "(&(objectClass=%s)(%s=%u))", - LDAP_OBJ_IDMAP_ENTRY, type, ((id_type & ID_USERID) ? id.uid : id.gid)); + pstr_sprintf(filter, "(&(objectClass=%s)(%s=%lu))", + LDAP_OBJ_IDMAP_ENTRY, type, + ((id_type & ID_USERID) ? (unsigned long)id.uid : + (unsigned long)id.gid)); pstrcpy( suffix, lp_ldap_idmap_suffix() ); rc = smbldap_search(ldap_state.smbldap_state, suffix, LDAP_SCOPE_SUBTREE, filter, attr_list, 0, &result); - if (rc != LDAP_SUCCESS) - goto out; + if (rc != LDAP_SUCCESS) { + DEBUG(3,("ldap_get_isd_from_id: Failure looking up entry (%s)\n", + ldap_err2string(rc) )); + goto out; + } count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result); - } - - if (count != 1) { - DEBUG(0,("ldap_get_sid_from_id: mapping not found for %s: %u\n", - type, ((id_type & ID_USERID) ? id.uid : id.gid))); - goto out; + + if (count != 1) { + DEBUG(0,("ldap_get_sid_from_id: mapping not found for %s: %lu\n", + type, ((id_type & ID_USERID) ? (unsigned long)id.uid : + (unsigned long)id.gid))); + goto out; + } } entry = ldap_first_entry(ldap_state.smbldap_state->ldap_struct, result); @@ -538,117 +538,146 @@ static NTSTATUS ldap_get_id_from_sid(unid_t *id, int *id_type, const DOM_SID *si pstring id_str; const char *suffix; const char *type; - const char *obj_class; - const char *posix_obj_class; int rc; int count; char **attr_list; char *dn = NULL; NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - /* first try getting the mapping from a samba user or group */ - sid_to_string(sid_str, sid); - if ( *id_type & ID_USERID ) { - type = get_attr_key2string( sidmap_attr_list, LDAP_ATTR_UIDNUMBER ); - obj_class = LDAP_OBJ_SAMBASAMACCOUNT; - posix_obj_class = LDAP_OBJ_POSIXACCOUNT; - suffix = lp_ldap_suffix(); - snprintf(filter, sizeof(filter), - "(&(|(&(objectClass=%s)(objectClass=%s))(objectClass=%s))(%s=%s))", - obj_class, posix_obj_class, LDAP_OBJ_IDMAP_ENTRY, - get_attr_key2string( sidmap_attr_list, LDAP_ATTR_SID ), - sid_str); - } - else { + + DEBUG(8,("ldap_get_id_from_sid: %s (%s)\n", sid_str, + (*id_type & ID_GROUPID ? "group" : "user") )); + + /* ahhh.... ok. We have to check users and groups in places other + than idmap (hint: we're a domain member of a Samba domain) */ + + if ( *id_type & ID_GROUPID ) { + type = get_attr_key2string( sidmap_attr_list, LDAP_ATTR_GIDNUMBER ); - obj_class = LDAP_OBJ_GROUPMAP; - posix_obj_class = LDAP_OBJ_POSIXGROUP; suffix = lp_ldap_group_suffix(); - snprintf(filter, sizeof(filter), - "(&(|(objectClass=%s)(objectClass=%s))(%s=%s))", - obj_class, LDAP_OBJ_IDMAP_ENTRY, + pstr_sprintf(filter, "(&(|(objectClass=%s)(objectClass=%s))(%s=%s))", + LDAP_OBJ_GROUPMAP, LDAP_OBJ_IDMAP_ENTRY, + get_attr_key2string( sidmap_attr_list, LDAP_ATTR_SID ), + sid_str); + + } + else { + + type = get_attr_key2string( sidmap_attr_list, LDAP_ATTR_UIDNUMBER ); + suffix = lp_ldap_suffix(); + pstr_sprintf(filter, "(&(|(&(objectClass=%s)(objectClass=%s))(objectClass=%s))(%s=%s))", + LDAP_OBJ_SAMBASAMACCOUNT, LDAP_OBJ_POSIXACCOUNT, LDAP_OBJ_IDMAP_ENTRY, get_attr_key2string( sidmap_attr_list, LDAP_ATTR_SID ), sid_str); + } - + + DEBUG(10,("ldap_get_id_from_sid: Searching for \"%s\"\n", filter)); + + /* do the search and check for errors */ + attr_list = get_attr_list( sidmap_attr_list ); rc = smbldap_search(ldap_state.smbldap_state, suffix, LDAP_SCOPE_SUBTREE, - filter, attr_list, 0, &result); - - if (rc != LDAP_SUCCESS) + filter, attr_list, 0, &result); + + if ( rc != LDAP_SUCCESS ) { + DEBUG(3,("ldap_get_id_from_sid: Failure looking up group mapping (%s)\n", + ldap_err2string(rc) )); goto out; + } count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result); - - /* fall back to looking up an idmap entry if we didn't find anything under the idmap - user or group suffix */ - if (count == 0) { - ldap_msgfree(result); - - snprintf(filter, sizeof(filter), "(&(objectClass=%s)(%s=%s))", - LDAP_OBJ_IDMAP_ENTRY, LDAP_ATTRIBUTE_SID, sid_str); + if ( count > 1 ) { + DEBUG(3,("ldap_get_id_from_sid: search \"%s\" returned [%d] entries. Bailing...\n", + filter, count)); + goto out; + } + + /* see if we need to do a search here */ + + if ( count == 0 ) { + + if ( result ) { + ldap_msgfree(result); + result = NULL; + } + + /* look in idmap suffix */ suffix = lp_ldap_idmap_suffix(); + pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))", + LDAP_OBJ_IDMAP_ENTRY, LDAP_ATTRIBUTE_SID, sid_str); rc = smbldap_search(ldap_state.smbldap_state, suffix, LDAP_SCOPE_SUBTREE, filter, attr_list, 0, &result); - if (rc != LDAP_SUCCESS) + if (rc != LDAP_SUCCESS) { + DEBUG(3,("ldap_get_id_from_sid: Failure looking up idmap entry (%s)\n", + ldap_err2string(rc) )); goto out; + } + /* check for the number of entries returned */ + count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result); - } - if ( count > 1 ) { - DEBUG(0, ("ldap_get_id_from_sid: search %s returned more than on entry!\n", - filter)); - goto out; - } - - /* we might have an existing entry to work with so pull out the requested information */ - - if ( count ) { - entry = ldap_first_entry(ldap_state.smbldap_state->ldap_struct, result); - - dn = ldap_get_dn(ldap_state.smbldap_state->ldap_struct, result); - DEBUG(10, ("Found mapping entry at dn=%s, looking for %s\n", dn, type)); - - if ( smbldap_get_single_attribute(ldap_state.smbldap_state->ldap_struct, entry, type, id_str) ) - { - if ( (*id_type & ID_USERID) ) - id->uid = strtoul(id_str, NULL, 10); - else - id->gid = strtoul(id_str, NULL, 10); - - ret = NT_STATUS_OK; + if ( count > 1 ) { + DEBUG(0, ("ldap_get_id_from_sid: (2nd) search %s returned [%d] entries!\n", + filter, count)); goto out; } - } - if (!(*id_type & ID_QUERY_ONLY)) { - /* if entry == NULL, and we are asked to - allocate a new id */ - int i; + + /* try to allocate a new id if we still haven't found one */ + + if ( (count==0) && !(*id_type & ID_QUERY_ONLY) ) { + int i; + + DEBUG(8,("ldap_get_id_from_sid: Allocating new id\n")); - for (i = 0; i < LDAP_MAX_ALLOC_ID; i++) - { - ret = ldap_allocate_id(id, *id_type); - if ( NT_STATUS_IS_OK(ret) ) - break; - } + for (i = 0; i < LDAP_MAX_ALLOC_ID; i++) { + ret = ldap_allocate_id(id, *id_type); + if ( NT_STATUS_IS_OK(ret) ) + break; + } - if ( !NT_STATUS_IS_OK(ret) ) { - DEBUG(0,("ldap_allocate_id: cannot acquire id lock!\n")); + if ( !NT_STATUS_IS_OK(ret) ) { + DEBUG(0,("ldap_allocate_id: cannot acquire id lock!\n")); + goto out; + } + + DEBUG(10,("ldap_get_id_from_sid: Allocated new %cid [%ul]\n", + (*id_type & ID_GROUPID ? 'g' : 'u'), (uint32)id->uid )); + + ret = ldap_set_mapping(sid, *id, *id_type); + + /* all done */ + goto out; } - - ret = ldap_set_mapping(sid, *id, *id_type); - } else { - /* no match, and not adding one */ - ret = NT_STATUS_UNSUCCESSFUL; } + DEBUG(10,("ldap_get_id_from_sid: success\n")); + + entry = ldap_first_entry(ldap_state.smbldap_state->ldap_struct, result); + + dn = ldap_get_dn(ldap_state.smbldap_state->ldap_struct, result); + + DEBUG(10, ("Found mapping entry at dn=%s, looking for %s\n", dn, type)); + + if ( smbldap_get_single_attribute(ldap_state.smbldap_state->ldap_struct, entry, type, id_str) ) + { + if ( (*id_type & ID_USERID) ) + id->uid = strtoul(id_str, NULL, 10); + else + id->gid = strtoul(id_str, NULL, 10); + + ret = NT_STATUS_OK; + goto out; + } + out: free_attr_list( attr_list ); if (result) @@ -670,7 +699,7 @@ static NTSTATUS ldap_set_mapping_internals(const DOM_SID *sid, unid_t id, int id_type, const char *ldap_dn, LDAPMessage *entry) { - char *dn = NULL; + pstring dn; pstring id_str; fstring type; LDAPMod **mods = NULL; @@ -685,24 +714,20 @@ static NTSTATUS ldap_set_mapping_internals(const DOM_SID *sid, unid_t id, if (ldap_dn) { DEBUG(10, ("Adding new IDMAP mapping on DN: %s", ldap_dn)); ldap_op = LDAP_MOD_REPLACE; - dn = strdup(ldap_dn); + pstrcpy( dn, ldap_dn ); } else { ldap_op = LDAP_MOD_ADD; - asprintf(&dn, "%s=%s,%s", get_attr_key2string( sidmap_attr_list, LDAP_ATTR_SID), + pstr_sprintf(dn, "%s=%s,%s", get_attr_key2string( sidmap_attr_list, LDAP_ATTR_SID), sid_string, lp_ldap_idmap_suffix()); } - if (!dn) { - DEBUG(0, ("ldap_set_mapping_internals: out of memory allocating DN!\n")); - return NT_STATUS_NO_MEMORY; - } - if ( id_type & ID_USERID ) fstrcpy( type, get_attr_key2string( sidmap_attr_list, LDAP_ATTR_UIDNUMBER ) ); else fstrcpy( type, get_attr_key2string( sidmap_attr_list, LDAP_ATTR_GIDNUMBER ) ); - snprintf(id_str, sizeof(id_str), "%u", ((id_type & ID_USERID) ? id.uid : id.gid)); + pstr_sprintf(id_str, "%lu", ((id_type & ID_USERID) ? (unsigned long)id.uid : + (unsigned long)id.gid)); if (entry) values = ldap_get_values(ldap_state.smbldap_state->ldap_struct, entry, "objectClass"); @@ -754,15 +779,16 @@ static NTSTATUS ldap_set_mapping_internals(const DOM_SID *sid, unid_t id, char *ld_error = NULL; ldap_get_option(ldap_state.smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); - DEBUG(0,("ldap_set_mapping_internals: Failed to %s mapping from %s to %u [%s]\n", + DEBUG(0,("ldap_set_mapping_internals: Failed to %s mapping from %s to %lu [%s]\n", (ldap_op == LDAP_MOD_ADD) ? "add" : "replace", - sid_string, (unsigned int)((id_type & ID_USERID) ? id.uid : id.gid), type)); + sid_string, (unsigned long)((id_type & ID_USERID) ? id.uid : id.gid), type)); DEBUG(0, ("ldap_set_mapping_internals: Error was: %s (%s)\n", ld_error ? ld_error : "(NULL)", ldap_err2string (rc))); return NT_STATUS_UNSUCCESSFUL; } - DEBUG(10,("ldap_set_mapping: Successfully created mapping from %s to %d [%s]\n", - sid_string, ((id_type & ID_USERID) ? id.uid : id.gid), type)); + DEBUG(10,("ldap_set_mapping: Successfully created mapping from %s to %lu [%s]\n", + sid_string, ((id_type & ID_USERID) ? (unsigned long)id.uid : + (unsigned long)id.gid), type)); return NT_STATUS_OK; } @@ -794,18 +820,18 @@ static NTSTATUS ldap_set_mapping(const DOM_SID *sid, unid_t id, int id_type) suffix = lp_ldap_suffix(); type = get_attr_key2string( idpool_attr_list, LDAP_ATTR_UIDNUMBER ); posix_obj_class = LDAP_OBJ_POSIXACCOUNT; - snprintf(id_str, sizeof(id_str), "%u", id.uid ); + fstr_sprintf(id_str, "%lu", (unsigned long)id.uid ); } else { obj_class = LDAP_OBJ_GROUPMAP; suffix = lp_ldap_group_suffix(); type = get_attr_key2string( idpool_attr_list, LDAP_ATTR_GIDNUMBER ); posix_obj_class = LDAP_OBJ_POSIXGROUP; - snprintf(id_str, sizeof(id_str), "%u", id.gid ); + fstr_sprintf(id_str, "%lu", (unsigned long)id.gid ); } sid_to_string(sid_str, sid); - snprintf(filter, sizeof(filter), + pstr_sprintf(filter, "(|" "(&(|(objectClass=%s)(|(objectClass=%s)(objectClass=%s)))(%s=%s))" "(&(objectClass=%s)(%s=%s))" @@ -859,10 +885,13 @@ out: return ret; } -/***************************************************************************** - Initialise idmap database. -*****************************************************************************/ -static NTSTATUS ldap_idmap_init( char *params ) + + +/********************************************************************** + Verify the sambaUnixIdPool entry in the directiry. +**********************************************************************/ + +static NTSTATUS verify_idpool( void ) { fstring filter; int rc; @@ -870,24 +899,8 @@ static NTSTATUS ldap_idmap_init( char *params ) LDAPMessage *result = NULL; LDAPMod **mods = NULL; int count; - NTSTATUS nt_status; - - ldap_state.mem_ctx = talloc_init("idmap_ldap"); - if (!ldap_state.mem_ctx) { - return NT_STATUS_NO_MEMORY; - } - - /* assume location is the only parameter */ - if (!NT_STATUS_IS_OK(nt_status = - smbldap_init(ldap_state.mem_ctx, params, - &ldap_state.smbldap_state))) { - talloc_destroy(ldap_state.mem_ctx); - return nt_status; - } - - /* see if the idmap suffix and sub entries exists */ - snprintf( filter, sizeof(filter), "(objectclass=%s)", LDAP_OBJ_IDPOOL ); + fstr_sprintf( filter, "(objectclass=%s)", LDAP_OBJ_IDPOOL ); attr_list = get_attr_list( idpool_attr_list ); rc = smbldap_search(ldap_state.smbldap_state, lp_ldap_idmap_suffix(), @@ -914,8 +927,8 @@ static NTSTATUS ldap_idmap_init( char *params ) return NT_STATUS_UNSUCCESSFUL; } - snprintf( uid_str, sizeof(uid_str), "%d", luid ); - snprintf( gid_str, sizeof(gid_str), "%d", lgid ); + fstr_sprintf( uid_str, "%lu", (unsigned long)luid ); + fstr_sprintf( gid_str, "%lu", (unsigned long)lgid ); smbldap_set_mod( &mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_IDPOOL ); smbldap_set_mod( &mods, LDAP_MOD_ADD, @@ -925,7 +938,36 @@ static NTSTATUS ldap_idmap_init( char *params ) rc = smbldap_modify(ldap_state.smbldap_state, lp_ldap_idmap_suffix(), mods); } + + return ( rc==LDAP_SUCCESS ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ); +} + +/***************************************************************************** + Initialise idmap database. +*****************************************************************************/ +static NTSTATUS ldap_idmap_init( char *params ) +{ + NTSTATUS nt_status; + + ldap_state.mem_ctx = talloc_init("idmap_ldap"); + if (!ldap_state.mem_ctx) { + return NT_STATUS_NO_MEMORY; + } + + /* assume location is the only parameter */ + if (!NT_STATUS_IS_OK(nt_status = + smbldap_init(ldap_state.mem_ctx, params, + &ldap_state.smbldap_state))) { + talloc_destroy(ldap_state.mem_ctx); + return nt_status; + } + + /* see if the idmap suffix and sub entries exists */ + nt_status = verify_idpool(); + if ( !NT_STATUS_IS_OK(nt_status) ) + return nt_status; + return NT_STATUS_OK; } diff --git a/source3/sam/idmap_tdb.c b/source3/sam/idmap_tdb.c index 2055103898..8ab8ec8477 100644 --- a/source3/sam/idmap_tdb.c +++ b/source3/sam/idmap_tdb.c @@ -45,20 +45,6 @@ static struct idmap_state { gid_t gid_low, gid_high; /* Range of gids to allocate */ } idmap_state; -/********************************************************************** - Return the TDB_CONTEXT* for winbindd_idmap. I **really** feel - dirty doing this, but not so dirty that I want to create another - tdb -***********************************************************************/ - -TDB_CONTEXT *idmap_tdb_handle( void ) -{ - if ( idmap_tdb ) - return idmap_tdb; - - return NULL; -} - /********************************************************************** allocate a new RID; We don't care if is a user or group **********************************************************************/ @@ -75,7 +61,7 @@ static NTSTATUS db_allocate_rid(uint32 *rid, int rid_type) /* cannot fail since idmap is only called winbindd */ - idmap_get_free_rid_range( &lowrid, &highrid ); + get_free_rid_range( &lowrid, &highrid ); tmp_rid = lowrid; @@ -122,7 +108,7 @@ static NTSTATUS db_allocate_id(unid_t *id, int id_type) } /* fetch a new id and increment it */ - ret = tdb_change_uint32_atomic(idmap_tdb, HWM_USER, &hwm, 1); + ret = tdb_change_uint32_atomic(idmap_tdb, HWM_USER, (unsigned int *)&hwm, 1); if (!ret) { DEBUG(0, ("idmap_tdb: Fatal error while fetching a new id\n!")); return NT_STATUS_UNSUCCESSFUL; @@ -152,7 +138,7 @@ static NTSTATUS db_allocate_id(unid_t *id, int id_type) } /* fetch a new id and increment it */ - ret = tdb_change_uint32_atomic(idmap_tdb, HWM_GROUP, &hwm, 1); + ret = tdb_change_uint32_atomic(idmap_tdb, HWM_GROUP, (unsigned int *)&hwm, 1); if (!ret) { DEBUG(0, ("idmap_tdb: Fatal error while fetching a new id\n!")); @@ -650,6 +636,27 @@ static void db_idmap_status(void) /* Display complete mapping of users and groups to rids */ } +/********************************************************************** + Return the TDB_CONTEXT* for winbindd_idmap. I **really** feel + dirty doing this, but not so dirty that I want to create another + tdb +***********************************************************************/ + +TDB_CONTEXT *idmap_tdb_handle( void ) +{ + if ( idmap_tdb ) + return idmap_tdb; + + /* go ahead an open it; db_idmap_init() doesn't use any params + right now */ + + db_idmap_init( NULL ); + if ( idmap_tdb ) + return idmap_tdb; + + return NULL; +} + static struct idmap_methods db_methods = { db_idmap_init, diff --git a/source3/sam/idmap_util.c b/source3/sam/idmap_util.c index f794ea5173..f28e11cde7 100644 --- a/source3/sam/idmap_util.c +++ b/source3/sam/idmap_util.c @@ -22,50 +22,7 @@ #undef DBGC_CLASS #define DBGC_CLASS DBGC_IDMAP -/********************************************************************** -**********************************************************************/ - -BOOL idmap_get_free_ugid_range(uint32 *low, uint32 *high) -{ - uid_t u_low, u_high; - gid_t g_low, g_high; - - if (!lp_idmap_uid(&u_low, &u_high) || !lp_idmap_gid(&g_low, &g_high)) { - return False; - } - - *low = (u_low < g_low) ? u_low : g_low; - *high = (u_high < g_high) ? u_high : g_high; - - return True; -} - -/****************************************************************** - Get the the non-algorithmic RID range if idmap range are defined -******************************************************************/ - -BOOL idmap_get_free_rid_range(uint32 *low, uint32 *high) -{ - uint32 id_low, id_high; - - if (!lp_enable_rid_algorithm()) { - *low = BASE_RID; - *high = (uint32)-1; - } - - if (!idmap_get_free_ugid_range(&id_low, &id_high)) { - return False; - } - - *low = fallback_pdb_uid_to_user_rid(id_low); - if (fallback_pdb_user_rid_to_uid((uint32)-1) < id_high) { - *high = (uint32)-1; - } else { - *high = fallback_pdb_uid_to_user_rid(id_high); - } - - return True; -} +#if 0 /* NOT USED */ /********************************************************************** Get the free RID base if idmap is configured, otherwise return 0 @@ -137,6 +94,8 @@ BOOL idmap_check_sid_is_in_free_range(const DOM_SID *sid) return True; } +#endif /* NOT USED */ + /***************************************************************** Returns SID pointer. *****************************************************************/ @@ -192,7 +151,7 @@ NTSTATUS idmap_sid_to_uid(const DOM_SID *sid, uid_t *uid, uint32 flags) flags |= ID_USERID; - ret = idmap_get_id_from_sid(&id, &flags, sid); + ret = idmap_get_id_from_sid(&id, (int *)&flags, sid); if ( NT_STATUS_IS_OK(ret) ) { DEBUG(10,("idmap_sid_to_uid: uid = [%lu]\n", (unsigned long)id.uid)); @@ -221,7 +180,7 @@ NTSTATUS idmap_sid_to_gid(const DOM_SID *sid, gid_t *gid, uint32 flags) flags |= ID_GROUPID; - ret = idmap_get_id_from_sid(&id, &flags, sid); + ret = idmap_get_id_from_sid(&id, (int *)&flags, sid); if ( NT_STATUS_IS_OK(ret) ) { diff --git a/source3/script/.cvsignore b/source3/script/.cvsignore index 7a8114ecd7..0464ca2335 100644 --- a/source3/script/.cvsignore +++ b/source3/script/.cvsignore @@ -1 +1,2 @@ findsmb +gen-8bit-gap.sh diff --git a/source3/script/find_missing_doc.pl b/source3/script/find_missing_doc.pl deleted file mode 100755 index b27a405e4d..0000000000 --- a/source3/script/find_missing_doc.pl +++ /dev/null @@ -1,90 +0,0 @@ -#!/usr/bin/perl - -my $doc_file = "/docs/docbook/manpages/smb.conf.5.sgml"; -my $source_file = "/source/param/loadparm.c"; - -my %link,%doc,%param; - -# This one shouldn't be documented at all -$doc{-valid} = "FOUND"; - -$topdir = (shift @ARGV) or $topdir = "."; - -################################################## -# Reading links from manpage - -open(IN,$topdir.$doc_file); - -while() { - if( /([^<]*)<\/parameter><\/link><\/para><\/listitem>/g ){ - $link{$2} = $1; - $ref{$1} = $2; - } -} - -close(IN); - -################################################## -# Reading documentation from manpage - -open(IN,$topdir.$doc_file) || die("Can't open $topdir$doc_file"); - -while() { - if( /([^<]*?)([ ]*)\(.\)([ ]*)<\/term>/g ) { - $key = $1; - $value = $2; - $doc{$value} = $key; - - # There is a reference to this entry - if($ref{$key} eq $value){ - $ref{$key} = "FOUND"; - } else { - if($ref{$key}) { - print "$key should refer to $value, but refers to " . $ref{$key} . "\n"; - } else { - print "$key should refer to $value, but has no reference!\n"; - } - $ref{$key} = $value; - } - } -} - -close(IN); - -################################################# -# Reading entries from source code - -open(SOURCE,$topdir.$source_file) || die("Can't open $topdir$source_file"); - -while ($ln = ) { - last if $ln =~ m/^static\ struct\ parm_struct\ parm_table.*/; -} #burn through the preceding lines - -while ($ln = ) { - last if $ln =~ m/^\s*\}\;\s*$/; - #pull in the param names only - next if $ln =~ m/.*P_SEPARATOR.*/; - next unless $ln =~ /.*\"(.*)\".*/; - - if($doc{lc($1)}) { - $doc{lc($1)} = "FOUND"; - } else { - print "$1 is not documented!\n"; - } -} -close SOURCE; - -################################################## -# Trying to find missing references - -foreach (keys %ref) { - if($ref{$_} cmp "FOUND") { - print "$_ references to " . $ref{$_} . ", but " . $ref{$_} . " isn't an anchor!\n"; - } -} - -foreach (keys %doc) { - if($doc{$_} cmp "FOUND") { - print "$_ is documented but is not a configuration option!\n"; - } -} diff --git a/source3/script/findsmb.in b/source3/script/findsmb.in index 6276bd3f39..fb06018fe5 100755 --- a/source3/script/findsmb.in +++ b/source3/script/findsmb.in @@ -23,29 +23,33 @@ $SAMBABIN = "@prefix@/bin"; for ($i = 0; $i < 2; $i++) { # test for -d and -r options - $_ = shift; - if (m/-d|-D/) { - $DEBUG = 1; - } elsif (m/-r/) { - $R_OPTION = "-r"; - } + $_ = shift; + if (m/-d|-D/) { + $DEBUG = 1; + } elsif (m/-r/) { + $R_OPTION = "-r"; + } } if ($_) { # set broadcast address if it was specified - $BCAST = "-B $_"; + $BCAST = "-B $_"; } -sub ipsort # do numeric sort on last field of IP address + +###################################################################### +# do numeric sort on last field of IP address +sub ipsort { - @t1 = split(/\./,$a); - @t2 = split(/\./,$b); - @t1[3] <=> @t2[3]; + @t1 = split(/\./,$a); + @t2 = split(/\./,$b); + @t1[3] <=> @t2[3]; } +###################################################################### # look for all machines that respond to a name lookup -open(NMBLOOKUP,"$SAMBABIN/nmblookup $BCAST '*'|") || - die("Can't run nmblookup '*'.\n"); +open(NMBLOOKUP,"$SAMBABIN/nmblookup $BCAST '*' --debuglevel=0|") || + die("Can't run nmblookup '*'.\n"); # get rid of all lines that are not a response IP address, # strip everything but IP address and sort by last field in address @@ -59,94 +63,98 @@ print "---------------------------------------------------------------------\n"; foreach $ip (@ipaddrs) # loop through each IP address found { - $ip =~ s/\n//; # strip newline from IP address - -# find the netbios names registered by each machine - - open(NMBLOOKUP,"$SAMBABIN/nmblookup $R_OPTION -A $ip|") || - die("Can't get nmb name list.\n"); - @nmblookup = ; - close NMBLOOKUP; - -# get the first <00> name - - @name = grep(/<00>/,@nmblookup); - $_ = @name[0]; - if ($_) { # we have a netbios name - if (/GROUP/) { # is it a group name - ($name, $aliases, $type, $length, @addresses) = - gethostbyaddr(pack('C4',split('\.',$ip)),2); - if (! $name) { # could not get name - $name = "unknown nis name"; + $ip =~ s/\n//; # strip newline from IP address + + # find the netbios names registered by each machine + + open(NMBLOOKUP,"$SAMBABIN/nmblookup $R_OPTION -A $ip --debuglevel=0|") || + die("Can't get nmb name list.\n"); + @nmblookup = ; + close NMBLOOKUP; + + # get the first <00> name + + @name = grep(/<00>/,@nmblookup); + $_ = @name[0]; + + if ($_) { # we have a netbios name + if (/GROUP/) { # is it a group name + ($name, $aliases, $type, $length, @addresses) = + gethostbyaddr(pack('C4',split('\.',$ip)),2); + if (! $name) { # could not get name + $name = "unknown nis name"; + } + } else { + # The Netbios name can contain lot of characters also '<' '>' + # and spaces. The follwing cure inside name space but not + # names starting or ending with spaces + /(.{1,15})\s+<00>\s+/; + $name = $1; + $name =~ s/^\s+//g; + } + + # do an smbclient command on the netbios name. + + if ( "$name" ) { + open(SMB,"$SAMBABIN/smbclient -L $name -I $ip -N --debuglevel=1 2>&1 |") || + die("Can't do smbclient command.\n"); + @smb = ; + close SMB; + + if ($DEBUG) { # if -d flag print results of nmblookup and smbclient + print "===============================================================\n"; + print @nmblookup; + print @smb; + } + + # look for the OS= string + + @info = grep(/OS=/,@smb); + $_ = @info[0]; + if ($_) { # we found response + s/Domain=|OS=|Server=|\n//g; # strip out descriptions to make line shorter + + } else { # no OS= string in response (WIN95 client) + + # for WIN95 clients get workgroup name from nmblookup response + @name = grep(/<00> - /,@nmblookup); + $_ = @name[0]; + if ($_) { + # Same as before for space and characters + /(.{1,15})\s+<00>\s+/; + $_ = "[$1]"; + } else { + $_ = "Unknown Workgroup"; + } + } + } + + # see if machine registered a local master browser name + if (grep(/<1d>/,@nmblookup)) { + $master = '+'; # indicate local master browser + if (grep(/<1b>/,@nmblookup)) { # how about domain master browser? + $master = '*'; # indicate domain master browser + } + } else { + $master = ' '; # not a browse master + } + + # line up info in 3 columns + + print "$ip".' 'x(16-length($ip))."$name".' 'x(14-length($name))."$master"."$_\n"; + + } else { # no netbios name found + # try getting the host name + ($name, $aliases, $type, $length, @addresses) = + gethostbyaddr(pack('C4',split('\.',$ip)),2); + if (! $name) { # could not get name + $name = "unknown nis name"; + } + if ($DEBUG) { # if -d flag print results of nmblookup + print "===============================================================\n"; + print @nmblookup; + } + print "$ip".' 'x(16-length($ip))."$name\n"; } - } else { -# The Netbios name can contain lot of characters also '<' '>' -# and spaces. The follwing cure inside name space but not -# names starting or ending with spaces - /(.{1,15})\s+<00>\s+/; - $name = $1; - } - -# do an smbclient command on the netbios name. - - open(SMB,"$SAMBABIN/smbclient -N -L $name -I $ip -U% |") || - die("Can't do smbclient command.\n"); - @smb = ; - close SMB; - - if ($DEBUG) { # if -d flag print results of nmblookup and smbclient - print "===============================================================\n"; - print @nmblookup; - print @smb; - } - -# look for the OS= string - - @info = grep(/OS=/,@smb); - $_ = @info[0]; - if ($_) { # we found response - s/Domain=|OS=|Server=|\n//g; # strip out descriptions to make line shorter - - } else { # no OS= string in response (WIN95 client) - -# for WIN95 clients get workgroup name from nmblookup response - @name = grep(/<00> - /,@nmblookup); - $_ = @name[0]; - if ($_) { -# Same as before for space and characters - /(.{1,15})\s+<00>\s+/; - $_ = "[$1]"; - } else { - $_ = "Unknown Workgroup"; - } - } - -# see if machine registered a local master browser name - if (grep(/<1d>/,@nmblookup)) { - $master = '+'; # indicate local master browser - if (grep(/<1b>/,@nmblookup)) { # how about domain master browser? - $master = '*'; # indicate domain master browser - } - } else { - $master = ' '; # not a browse master - } - -# line up info in 3 columns - - print "$ip".' 'x(16-length($ip))."$name".' 'x(14-length($name))."$master"."$_\n"; - - } else { # no netbios name found -# try getting the host name - ($name, $aliases, $type, $length, @addresses) = - gethostbyaddr(pack('C4',split('\.',$ip)),2); - if (! $name) { # could not get name - $name = "unknown nis name"; - } - if ($DEBUG) { # if -d flag print results of nmblookup - print "===============================================================\n"; - print @nmblookup; - } - print "$ip".' 'x(16-length($ip))."$name\n"; - } } diff --git a/source3/script/gap.awk b/source3/script/gap.awk new file mode 100644 index 0000000000..11680d10f9 --- /dev/null +++ b/source3/script/gap.awk @@ -0,0 +1,39 @@ +BEGIN { hv["0"] = 0; hv["1"] = 1; hv["2"] = 2; hv["3"] = 3; + hv["4"] = 4; hv["5"] = 5; hv["6"] = 6; hv["7"] = 7; + hv["8"] = 8; hv["9"] = 9; hv["A"] = 10; hv["B"] = 11; + hv["C"] = 12; hv["D"] = 13; hv["E"] = 14; hv["F"] = 15; + hv["a"] = 10; hv["b"] = 11; hv["c"] = 12; hv["d"] = 13; + hv["e"] = 14; hv["f"] = 15; + + first = 0; last = 0; idx = 0; +} + +function tonum(str) +{ + num=0; + cnt=1; + while (cnt <= length(str)) { + num *= 16; + num += hv[substr(str,cnt,1)]; + ++cnt; + } + return num; +} + +{ + u = tonum($1); + if (u - last > 6) + { + if (last) + { + printf (" { 0x%04x, 0x%04x, %5d },\n", + first, last, idx); + idx -= u - last - 1; + } + first = u; + } + last = u; +} + +END { printf (" { 0x%04x, 0x%04x, %5d },\n", + first, last, idx); } diff --git a/source3/script/gaptab.awk b/source3/script/gaptab.awk new file mode 100644 index 0000000000..f9d1526361 --- /dev/null +++ b/source3/script/gaptab.awk @@ -0,0 +1,48 @@ +BEGIN { hv["0"] = 0; hv["1"] = 1; hv["2"] = 2; hv["3"] = 3; + hv["4"] = 4; hv["5"] = 5; hv["6"] = 6; hv["7"] = 7; + hv["8"] = 8; hv["9"] = 9; hv["A"] = 10; hv["B"] = 11; + hv["C"] = 12; hv["D"] = 13; hv["E"] = 14; hv["F"] = 15; + hv["a"] = 10; hv["b"] = 11; hv["c"] = 12; hv["d"] = 13; + hv["e"] = 14; hv["f"] = 15; + + first = 0; last = 0; idx = 0; f = 0; +} + +function tonum(str) +{ + num=0; + cnt=1; + while (cnt <= length(str)) { + num *= 16; + num += hv[substr(str,cnt,1)]; + ++cnt; + } + return num; +} + +function fmt(val) +{ + if (f++ % 8 == 0) + { printf ("\n '\\x%02x',", val); } + else + { printf (" '\\x%02x',", val); } +} + +{ + u = tonum($1); c = tonum($2); + + if (u - last > 6) + { + if (last) { idx += last - first + 1; } + first = u; + } + else + { + for (m = last+1; m < u; m++) { fmt(0); } + } + + fmt(c); + last = u; +} + +END { print "" } diff --git a/source3/script/gen-8bit-gap.awk b/source3/script/gen-8bit-gap.awk new file mode 100644 index 0000000000..59a1a23be0 --- /dev/null +++ b/source3/script/gen-8bit-gap.awk @@ -0,0 +1,18 @@ +BEGIN { + for (i=0; i<256; i++) { + tbl[sprintf("%02x",i)] = "0x0000"; + } +} + +/^[[:space:]]*.x([[:xdigit:]][[:xdigit:]])[:space:]*.*$/ { + tbl[substr($2,3,2)]=sprintf("0x%s",substr($1,3,4)); +} + +END { + for(i=0; i<32; i++) { + for(j=0; j<8; j++) { + printf(" %s,", tbl[sprintf("%02x",i*8+j)]); + } + printf "\n" + } +} \ No newline at end of file diff --git a/source3/script/gen-8bit-gap.sh.in b/source3/script/gen-8bit-gap.sh.in new file mode 100755 index 0000000000..bcf64a4464 --- /dev/null +++ b/source3/script/gen-8bit-gap.sh.in @@ -0,0 +1,49 @@ +#!/bin/sh +if test $# -ne 2 ; then + echo "Usage: $0 " + exit 1 +fi + +CHARMAP=$1 +CHARSETNAME=$2 + +echo "/* " +echo " * Conversion table for $CHARSETNAME charset " +echo " * " +echo " * Conversion tables are generated using $CHARMAP table " +echo " * and source/script/gen-8bit-gap.sh script " +echo " * " +echo " * This program is free software; you can redistribute it and/or modify " +echo " * it under the terms of the GNU General Public License as published by " +echo " * the Free Software Foundation; either version 2 of the License, or " +echo " * (at your option) any later version. " +echo " * " +echo " * This program is distributed in the hope that it will be useful," +echo " * but WITHOUT ANY WARRANTY; without even the implied warranty of " +echo " * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the " +echo " * GNU General Public License for more details. " +echo " * " +echo " * You should have received a copy of the GNU General Public License " +echo " * along with this program; if not, write to the Free Software " +echo " * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. " +echo " */" + +echo '#include "includes.h"' +echo +echo "static const uint16 to_ucs2[256] = {" +cat "$CHARMAP" | @AWK@ -f @srcdir@/script/gen-8bit-gap.awk +echo "};" +echo +echo "static const struct charset_gap_table from_idx[] = {" +sed -ne 's/^[[:space:]]*.x\(..\).*/\1 \2/p' \ + "$CHARMAP" | sort -u | @AWK@ -f @srcdir@/script/gaptab.awk +echo "};" +echo +echo "SMB_GENERATE_CHARSET_MODULE_8_BIT_GAP($CHARSETNAME)" +echo diff --git a/source3/script/installmodules.sh b/source3/script/installmodules.sh index ec5691992d..c80da76368 100755 --- a/source3/script/installmodules.sh +++ b/source3/script/installmodules.sh @@ -24,13 +24,4 @@ for p in $*; do chmod $INSTALLPERMS $LIBDIR/$p2 done - -cat << EOF -====================================================================== -The modules are installed. You may uninstall the modules using the -command "make uninstallmodules" or "make uninstall" to uninstall -binaries, man pages, shell scripts and modules. -====================================================================== -EOF - exit 0 diff --git a/source3/script/installswat.sh b/source3/script/installswat.sh index d1f8ea191d..bd2f8da234 100755 --- a/source3/script/installswat.sh +++ b/source3/script/installswat.sh @@ -71,13 +71,13 @@ done done -# Install Using Samba book +# Install Using Samba book (but only if it is there) -if [ "x$BOOKDIR" != "x" ]; then +if [ "x$BOOKDIR" != "x" -a -f $SRCDIR../docs/htmldocs/using_samba/toc.html ]; then # Create directories - for d in $BOOKDIR $BOOKDIR/figs $BOOKDIR/gifs; do + for d in $BOOKDIR $BOOKDIR/figs ; do if [ ! -d $d ]; then mkdir $d if [ ! -d $d ]; then @@ -96,19 +96,17 @@ if [ "x$BOOKDIR" != "x" ]; then chmod 0644 $FNAME done - # Figures - - for f in $SRCDIR../docs/htmldocs/using_samba/figs/*.gif; do - FNAME=$BOOKDIR/figs/`basename $f` + for f in $SRCDIR../docs/htmldocs/using_samba/*.gif; do + FNAME=$BOOKDIR/`basename $f` echo $FNAME cp $f $FNAME || echo Cannot install $FNAME. Does $USER have privileges? chmod 0644 $FNAME done - # Gifs + # Figures - for f in $SRCDIR../docs/htmldocs/using_samba/gifs/*.gif; do - FNAME=$BOOKDIR/gifs/`basename $f` + for f in $SRCDIR../docs/htmldocs/using_samba/figs/*.gif; do + FNAME=$BOOKDIR/figs/`basename $f` echo $FNAME cp $f $FNAME || echo Cannot install $FNAME. Does $USER have privileges? chmod 0644 $FNAME diff --git a/source3/script/linkmodules.sh b/source3/script/linkmodules.sh new file mode 100755 index 0000000000..16a04cc064 --- /dev/null +++ b/source3/script/linkmodules.sh @@ -0,0 +1,12 @@ +#!/bin/sh + +cd "$1" +test -f "$2" || exit 0 + +for I in $3 $4 $5 $6 $7 $8 +do + echo "Linking $I to $2" + ln -s $2 $I +done + +exit 0 diff --git a/source3/script/mkproto.awk b/source3/script/mkproto.awk index 6a45a70cc3..b6e911699e 100644 --- a/source3/script/mkproto.awk +++ b/source3/script/mkproto.awk @@ -41,20 +41,6 @@ END { } } -# special handling for code merge of TNG to head -/^#define OLD_NTDOMAIN 1/ { - printf "#if OLD_NTDOMAIN\n" -} -/^#undef OLD_NTDOMAIN/ { - printf "#endif\n" -} -/^#define NEW_NTDOMAIN 1/ { - printf "#if NEW_NTDOMAIN\n" -} -/^#undef NEW_NTDOMAIN/ { - printf "#endif\n" -} - # we handle the loadparm.c fns separately /^FN_LOCAL_BOOL/ { diff --git a/source3/script/mkproto.sh b/source3/script/mkproto.sh index 2bf96c9b41..62041c7e33 100755 --- a/source3/script/mkproto.sh +++ b/source3/script/mkproto.sh @@ -25,7 +25,7 @@ header="$1" shift headertmp="$header.$$.tmp~" -proto_src="`echo $@ | tr ' ' '\n' | sed -e 's/\.o/\.c/g' | sort | uniq | egrep -v 'ubiqx/|wrapped'`" +proto_src="`echo $@ | tr ' ' '\n' | sed -e 's/\.o/\.c/g' | sort | uniq | egrep -v 'ubiqx/|wrapped|modules/getdate'`" echo creating $header diff --git a/source3/script/mkversion.sh b/source3/script/mkversion.sh new file mode 100755 index 0000000000..ca39297940 --- /dev/null +++ b/source3/script/mkversion.sh @@ -0,0 +1,87 @@ +#!/bin/sh +# + +VERSION_FILE=$1 +OUTPUT_FILE=$2 + +if test -z "$VERSION_FILE";then + VERSION_FILE="VERSION" +fi + +if test -z "$OUTPUT_FILE";then + OUTPUT_FILE="include/version.h" +fi + +SOURCE_DIR=$3 + +SAMBA_VERSION_MAJOR=`sed -n 's/^SAMBA_VERSION_MAJOR=//p' $SOURCE_DIR$VERSION_FILE` +SAMBA_VERSION_MINOR=`sed -n 's/^SAMBA_VERSION_MINOR=//p' $SOURCE_DIR$VERSION_FILE` +SAMBA_VERSION_RELEASE=`sed -n 's/^SAMBA_VERSION_RELEASE=//p' $SOURCE_DIR$VERSION_FILE` + +SAMBA_VERSION_REVISION=`sed -n 's/^SAMBA_VERSION_REVISION=//p' $SOURCE_DIR$VERSION_FILE` + +SAMBA_VERSION_PRE_RELEASE=`sed -n 's/^SAMBA_VERSION_PRE_RELEASE=//p' $SOURCE_DIR$VERSION_FILE` + +SAMBA_VERSION_RC_RELEASE=`sed -n 's/^SAMBA_VERSION_RC_RELEASE=//p' $SOURCE_DIR$VERSION_FILE` + +SAMBA_VERSION_BETA_RELEASE=`sed -n 's/^SAMBA_VERSION_BETA_RELEASE=//p' $SOURCE_DIR$VERSION_FILE` + +SAMBA_VERSION_ALPHA_RELEASE=`sed -n 's/^SAMBA_VERSION_ALPHA_RELEASE=//p' $SOURCE_DIR$VERSION_FILE` + +SAMBA_VERSION_TEST_RELEASE=`sed -n 's/^SAMBA_VERSION_TEST_RELEASE=//p' $SOURCE_DIR$VERSION_FILE` + +SAMBA_VERSION_IS_CVS_SNAPSHOT=`sed -n 's/^SAMBA_VERSION_IS_CVS_SNAPSHOT=//p' $SOURCE_DIR$VERSION_FILE` + +SAMBA_VERSION_VENDOR_SUFFIX=`sed -n 's/^SAMBA_VERSION_VENDOR_SUFFIX=//p' $SOURCE_DIR$VERSION_FILE` + +echo "/* Autogenerated by script/mkversion.sh */" > $OUTPUT_FILE + +echo "#define SAMBA_VERSION_MAJOR ${SAMBA_VERSION_MAJOR}" >> $OUTPUT_FILE +echo "#define SAMBA_VERSION_MINOR ${SAMBA_VERSION_MINOR}" >> $OUTPUT_FILE +echo "#define SAMBA_VERSION_RELEASE ${SAMBA_VERSION_RELEASE}" >> $OUTPUT_FILE + + +SAMBA_VERSION_STRING="${SAMBA_VERSION_MAJOR}.${SAMBA_VERSION_MINOR}.${SAMBA_VERSION_RELEASE}" + + +if test -n "${SAMBA_VERSION_REVISION}";then + SAMBA_VERSION_STRING="${SAMBA_VERSION_STRING}${SAMBA_VERSION_REVISION}" + echo "#define SAMBA_VERSION_REVISION \"${SAMBA_VERSION_REVISION}\"" >> $OUTPUT_FILE +elif test -n "${SAMBA_VERSION_PRE_RELEASE}";then + SAMBA_VERSION_STRING="${SAMBA_VERSION_STRING}pre${SAMBA_VERSION_PRE_RELEASE}" + echo "#define SAMBA_VERSION_PRE_RELEASE ${SAMBA_VERSION_PRE_RELEASE}" >> $OUTPUT_FILE +elif test -n "${SAMBA_VERSION_RC_RELEASE}";then + SAMBA_VERSION_STRING="${SAMBA_VERSION_STRING}rc${SAMBA_VERSION_RC_RELEASE}" + echo "#define SAMBA_VERSION_RC_RELEASE ${SAMBA_VERSION_RC_RELEASE}" >> $OUTPUT_FILE +elif test -n "${SAMBA_VERSION_BETA_RELEASE}";then + SAMBA_VERSION_STRING="${SAMBA_VERSION_STRING}beta${SAMBA_VERSION_BETA_RELEASE}" + echo "#define SAMBA_VERSION_BETA_RELEASE ${SAMBA_VERSION_BETA_RELEASE}" >> $OUTPUT_FILE +elif test -n "${SAMBA_VERSION_ALPHA_RELEASE}";then + SAMBA_VERSION_STRING="${SAMBA_VERSION_STRING}alpha${SAMBA_VERSION_ALPHA_RELEASE}" + echo "#define SAMBA_VERSION_ALPHA_RELEASE ${SAMBA_VERSION_ALPHA_RELEASE}" >> $OUTPUT_FILE +elif test -n "${SAMBA_VERSION_TEST_RELEASE}";then + SAMBA_VERSION_STRING="${SAMBA_VERSION_STRING}test${SAMBA_VERSION_TEST_RELEASE}" + echo "#define SAMBA_VERSION_TEST_RELEASE ${SAMBA_VERSION_TEST_RELEASE}" >> $OUTPUT_FILE +fi + + +if test x"${SAMBA_VERSION_IS_CVS_SNAPSHOT}" = x"yes";then + SAMBA_VERSION_STRING="CVS ${SAMBA_VERSION_STRING}" + echo "#define SAMBA_VERSION_IS_CVS_SNAPSHOT 1" >> $OUTPUT_FILE +fi + +if test -n "${SAMBA_VERSION_VENDOR_SUFFIX}";then + echo "#define SAMBA_VERSION_VENDOR_SUFFIX ${SAMBA_VERSION_VENDOR_SUFFIX}" >> $OUTPUT_FILE +fi + +echo "#define SAMBA_VERSION_OFFICIAL_STRING \"${SAMBA_VERSION_STRING}\"" >> $OUTPUT_FILE + +echo "#define SAMBA_VERSION_STRING samba_version_string()" >> $OUTPUT_FILE + +echo "$0: 'include/version.h' created for Samba(\"${SAMBA_VERSION_STRING}\")" + +if test -n "${SAMBA_VERSION_VENDOR_SUFFIX}";then + echo "$0: with VENDOR_SUFFIX = ${SAMBA_VERSION_VENDOR_SUFFIX}" +fi + +exit 0 diff --git a/source3/smbadduser b/source3/smbadduser index 9837413aeb..35f6dbab14 100755 --- a/source3/smbadduser +++ b/source3/smbadduser @@ -2,13 +2,19 @@ # # smbadduser - Written by Mike Zakharoff # + +prefix=/usr/local/samba +exec_prefix=${prefix} +LIBDIR=${exec_prefix}/lib +PRIVATEDIR=${prefix}/private +CONFIGDIR=${LIBDIR} + unalias * set path = ($path /usr/local/samba/bin) -set smbpasswd = /usr/local/samba/private/smbpasswd -#set smbpasswd = /etc/samba/smbpasswd -set user_map = /usr/local/samba/lib/users.map -#set user_map = /etc/samba/smbusers +set smbpasswd = $PRIVATEDIR/smbpasswd +set user_map = $CONFIGDIR/users.map + # # Set to site specific passwd command # diff --git a/source3/smbadduser.in b/source3/smbadduser.in new file mode 100644 index 0000000000..05da7de08e --- /dev/null +++ b/source3/smbadduser.in @@ -0,0 +1,79 @@ +#!/bin/csh +# +# smbadduser - Written by Mike Zakharoff +# + +prefix=@prefix@ +exec_prefix=@exec_prefix@ +LIBDIR=@libdir@ +PRIVATEDIR=@privatedir@ +CONFIGDIR=@configdir@ + +unalias * +set path = ($path /usr/local/samba/bin) + +set smbpasswd = $PRIVATEDIR/smbpasswd +set user_map = $CONFIGDIR/users.map + +# +# Set to site specific passwd command +# +set passwd = "cat /etc/passwd" +#set passwd = "niscat passwd.org_dir" +#set passwd = "ypcat passwd" + +set line = "----------------------------------------------------------" +if ($#argv == 0) then + echo $line + echo "Written: Mike Zakharoff email: michael.j.zakharoff@boeing.com" + echo "" + echo " 1) Updates $smbpasswd" + echo " 2) Updates $user_map" + echo " 3) Executes smbpasswd for each new user" + echo "" + echo "smbadduser unixid:ntid unixid:ntid ..." + echo "" + echo "Example: smbadduser zak:zakharoffm johns:smithj" + echo $line + exit 1 +endif + +touch $smbpasswd $user_map +set new = () +foreach one ($argv) + echo $one | grep ':' >& /dev/null + if ($status != 0) then + echo "ERROR: Must use unixid:ntid like -> zak:zakharoffm" + continue + endif + set unix = `echo $one | awk -F: '{print $1}'` + set ntid = `echo $one | awk -F: '{print $2}'` + + set usr = `eval $passwd | awk -F: '$1==USR {print $1}' USR=$unix` + if ($#usr != 1) then + echo "ERROR: $unix Not in passwd database SKIPPING..." + continue + endif + set tmp = `cat $smbpasswd | awk -F: '$1==USR {print $1}' USR=$unix` + if ($#tmp != 0) then + echo "ERROR: $unix is already in $smbpasswd SKIPPING..." + continue + endif + + echo "Adding: $unix to $smbpasswd" + /usr/bin/smbpasswd -a -n $unix + if ($unix != $ntid) then + echo "Adding: {$unix = $ntid} to $user_map" + echo "$unix = $ntid" >> $user_map + endif + set new = ($new $unix) +end + +# +# Enter password for new users +# +foreach one ($new) + echo $line + echo "ENTER password for $one" + smbpasswd $one +end diff --git a/source3/smbd/blocking.c b/source3/smbd/blocking.c index fed3a51b88..8fa2a6494e 100644 --- a/source3/smbd/blocking.c +++ b/source3/smbd/blocking.c @@ -148,7 +148,7 @@ for fnum = %d, name = %s\n", length, (int)blr->expire_time, lock_timeout, blr->fsp->fnum, blr->fsp->fsp_name )); /* Push the MID of this packet on the signing queue. */ - srv_defer_sign_response(SVAL(inbuf,smb_mid)); + srv_defer_sign_response(SVAL(inbuf,smb_mid), True); return True; } diff --git a/source3/smbd/change_trust_pw.c b/source3/smbd/change_trust_pw.c index 2eff77b1f7..80c9fcb258 100644 --- a/source3/smbd/change_trust_pw.c +++ b/source3/smbd/change_trust_pw.c @@ -35,6 +35,9 @@ NTSTATUS change_trust_account_password( const char *domain, const char *remote_m fstring dc_name; struct cli_state *cli; + DEBUG(5,("change_trust_account_password: Attempting to change trust account password in domain %s....\n", + domain)); + if (remote_machine == NULL || !strcmp(remote_machine, "*")) { /* Use the PDC *only* for this */ @@ -92,6 +95,8 @@ failed: DEBUG(0,("%s : change_trust_account_password: Failed to change password for domain %s.\n", timestring(False), domain)); } + else + DEBUG(5,("change_trust_account_password: sucess!\n")); return nt_status; } diff --git a/source3/smbd/chgpasswd.c b/source3/smbd/chgpasswd.c index 6bc8626d81..d99570ff7c 100644 --- a/source3/smbd/chgpasswd.c +++ b/source3/smbd/chgpasswd.c @@ -259,7 +259,7 @@ static int expect(int master, char *issue, char *expected) /* Eat leading/trailing whitespace before match. */ pstring str; pstrcpy( str, buffer); - trim_string( str, " ", " "); + trim_char( str, ' ', ' '); if ((match = (unix_wild_match(expected, str) == 0))) timeout = 200; @@ -333,19 +333,14 @@ static BOOL chat_with_program(char *passwordprogram, struct passwd *pass, int wstat; BOOL chstat = False; - if (pass == NULL) - { - DEBUG(0, - ("chat_with_program: user doesn't exist in the UNIX password database.\n")); + if (pass == NULL) { + DEBUG(0, ("chat_with_program: user doesn't exist in the UNIX password database.\n")); return False; } /* allocate a pseudo-terminal device */ - if ((master = findpty(&slavedev)) < 0) - { - DEBUG(3, - ("Cannot Allocate pty for password change: %s\n", - pass->pw_name)); + if ((master = findpty(&slavedev)) < 0) { + DEBUG(3, ("Cannot Allocate pty for password change: %s\n", pass->pw_name)); return (False); } @@ -356,39 +351,29 @@ static BOOL chat_with_program(char *passwordprogram, struct passwd *pass, CatchChildLeaveStatus(); - if ((pid = sys_fork()) < 0) - { - DEBUG(3, - ("Cannot fork() child for password change: %s\n", - pass->pw_name)); + if ((pid = sys_fork()) < 0) { + DEBUG(3, ("Cannot fork() child for password change: %s\n", pass->pw_name)); close(master); CatchChild(); return (False); } /* we now have a pty */ - if (pid > 0) - { /* This is the parent process */ - if ((chstat = talktochild(master, chatsequence)) == False) - { - DEBUG(3, - ("Child failed to change password: %s\n", - pass->pw_name)); + if (pid > 0) { /* This is the parent process */ + if ((chstat = talktochild(master, chatsequence)) == False) { + DEBUG(3, ("Child failed to change password: %s\n", pass->pw_name)); kill(pid, SIGKILL); /* be sure to end this process */ } - while ((wpid = sys_waitpid(pid, &wstat, 0)) < 0) - { - if (errno == EINTR) - { + while ((wpid = sys_waitpid(pid, &wstat, 0)) < 0) { + if (errno == EINTR) { errno = 0; continue; } break; } - if (wpid < 0) - { + if (wpid < 0) { DEBUG(3, ("The process is no longer waiting!\n\n")); close(master); CatchChild(); @@ -402,29 +387,21 @@ static BOOL chat_with_program(char *passwordprogram, struct passwd *pass, close(master); - if (pid != wpid) - { - DEBUG(3, - ("We were waiting for the wrong process ID\n")); + if (pid != wpid) { + DEBUG(3, ("We were waiting for the wrong process ID\n")); return (False); } - if (WIFEXITED(wstat) == 0) - { - DEBUG(3, - ("The process exited while we were waiting\n")); + if (WIFEXITED(wstat) == 0) { + DEBUG(3, ("The process exited while we were waiting\n")); return (False); } - if (WEXITSTATUS(wstat) != 0) - { - DEBUG(3, - ("The status of the process exiting was %d\n", + if (WEXITSTATUS(wstat) != 0) { + DEBUG(3, ("The status of the process exiting was %d\n", wstat)); return (False); } - } - else - { + } else { /* CHILD */ /* @@ -438,12 +415,9 @@ static BOOL chat_with_program(char *passwordprogram, struct passwd *pass, if (as_root) become_root(); - DEBUG(3, - ("Dochild for user %s (uid=%d,gid=%d)\n", pass->pw_name, - (int)getuid(), (int)getgid())); - chstat = - dochild(master, slavedev, pass, passwordprogram, - as_root); + DEBUG(3, ("Dochild for user %s (uid=%d,gid=%d) (as_root = %s)\n", pass->pw_name, + (int)getuid(), (int)getgid(), BOOLSTR(as_root) )); + chstat = dochild(master, slavedev, pass, passwordprogram, as_root); if (as_root) unbecome_root(); @@ -452,20 +426,16 @@ static BOOL chat_with_program(char *passwordprogram, struct passwd *pass, * The child should never return from dochild() .... */ - DEBUG(0, - ("chat_with_program: Error: dochild() returned %d\n", - chstat)); + DEBUG(0, ("chat_with_program: Error: dochild() returned %d\n", chstat)); exit(1); } if (chstat) - DEBUG(3, - ("Password change %ssuccessful for user %s\n", + DEBUG(3, ("Password change %ssuccessful for user %s\n", (chstat ? "" : "un"), pass->pw_name)); return (chstat); } - BOOL chgpasswd(const char *name, const char *oldpass, const char *newpass, BOOL as_root) { pstring passwordprogram; @@ -489,7 +459,7 @@ BOOL chgpasswd(const char *name, const char *oldpass, const char *newpass, BOOL oldpass = ""; } - DEBUG(3, ("Password change for user: %s\n", name)); + DEBUG(3, ("Password change (as_root=%s) for user: %s\n", BOOLSTR(as_root), name)); #if DEBUG_PASSWORD DEBUG(100, ("Passwords: old=%s new=%s\n", oldpass, newpass)); @@ -519,8 +489,7 @@ BOOL chgpasswd(const char *name, const char *oldpass, const char *newpass, BOOL len = strlen(oldpass); for (i = 0; i < len; i++) { if (iscntrl((int)oldpass[i])) { - DEBUG(0, - ("chat_with_program: oldpass contains control characters (disallowed).\n")); + DEBUG(0, ("chat_with_program: oldpass contains control characters (disallowed).\n")); return False; } } @@ -528,8 +497,7 @@ BOOL chgpasswd(const char *name, const char *oldpass, const char *newpass, BOOL len = strlen(newpass); for (i = 0; i < len; i++) { if (iscntrl((int)newpass[i])) { - DEBUG(0, - ("chat_with_program: newpass contains control characters (disallowed).\n")); + DEBUG(0, ("chat_with_program: newpass contains control characters (disallowed).\n")); return False; } } @@ -556,11 +524,8 @@ BOOL chgpasswd(const char *name, const char *oldpass, const char *newpass, BOOL /* A non-PAM password change just doen't make sense without a valid local user */ - if (pass == NULL) - { - DEBUG(0, - ("chgpasswd: user %s doesn't exist in the UNIX password database.\n", - name)); + if (pass == NULL) { + DEBUG(0, ("chgpasswd: user %s doesn't exist in the UNIX password database.\n", name)); return False; } @@ -746,7 +711,6 @@ NTSTATUS pass_oem_change(char *user, uchar * ntdata, uchar * nthash) { fstring new_passwd; - const char *unix_user; SAM_ACCOUNT *sampass = NULL; NTSTATUS nt_status = check_oem_password(user, lmdata, lmhash, ntdata, nthash, &sampass, new_passwd, sizeof(new_passwd)); @@ -754,20 +718,9 @@ NTSTATUS pass_oem_change(char *user, if (!NT_STATUS_IS_OK(nt_status)) return nt_status; - /* - * At this point we have the new case-sensitive plaintext - * password in the fstring new_passwd. If we wanted to synchronise - * with UNIX passwords we would call a UNIX password changing - * function here. However it would have to be done as root - * as the plaintext of the old users password is not - * available. JRA. - */ - - unix_user = pdb_get_username(sampass); - /* We've already checked the old password here.... */ become_root(); - nt_status = change_oem_password(sampass, NULL, new_passwd); + nt_status = change_oem_password(sampass, NULL, new_passwd, True); unbecome_root(); memset(new_passwd, 0, sizeof(new_passwd)); @@ -949,7 +902,7 @@ static NTSTATUS check_oem_password(const char *user, is correct before calling. JRA. ************************************************************/ -NTSTATUS change_oem_password(SAM_ACCOUNT *hnd, char *old_passwd, char *new_passwd) +NTSTATUS change_oem_password(SAM_ACCOUNT *hnd, char *old_passwd, char *new_passwd, BOOL as_root) { BOOL ret; uint32 min_len; @@ -993,7 +946,7 @@ NTSTATUS change_oem_password(SAM_ACCOUNT *hnd, char *old_passwd, char *new_passw */ if(lp_unix_password_sync() && - !chgpasswd(pdb_get_username(hnd), old_passwd, new_passwd, False)) { + !chgpasswd(pdb_get_username(hnd), old_passwd, new_passwd, as_root)) { return NT_STATUS_ACCESS_DENIED; } diff --git a/source3/smbd/fileio.c b/source3/smbd/fileio.c index 6be5f6af7d..6cf7014846 100644 --- a/source3/smbd/fileio.c +++ b/source3/smbd/fileio.c @@ -87,8 +87,11 @@ ssize_t read_file(files_struct *fsp,char *data,SMB_OFF_T pos,size_t n) * Serve from write cache if we can. */ - if(read_from_write_cache(fsp, data, pos, n)) + if(read_from_write_cache(fsp, data, pos, n)) { + fsp->pos = pos + n; + fsp->position_information = fsp->pos; return n; + } flush_write_cache(fsp, READ_FLUSH); @@ -123,6 +126,9 @@ tryagain: DEBUG(10,("read_file (%s): pos = %.0f, size = %lu, returned %lu\n", fsp->fsp_name, (double)pos, (unsigned long)n, (long)ret )); + fsp->pos += ret; + fsp->position_information = fsp->pos; + return(ret); } @@ -145,6 +151,16 @@ static ssize_t real_write_file(files_struct *fsp,char *data,SMB_OFF_T pos, size_ DEBUG(10,("real_write_file (%s): pos = %.0f, size = %lu, returned %ld\n", fsp->fsp_name, (double)pos, (unsigned long)n, (long)ret )); + if (ret != -1) { + fsp->pos += ret; + +/* Yes - this is correct - writes don't update this. JRA. */ +/* Found by Samba4 tests. */ +#if 0 + fsp->position_information = fsp->pos; +#endif + } + return ret; } @@ -244,7 +260,7 @@ nonop=%u allocated=%u active=%u direct=%u perfect=%u readhits=%u\n", if(!wcp) { DO_PROFILE_INC(writecache_direct_writes); total_written = real_write_file(fsp, data, pos, n); - if ((total_written != -1) && (pos + total_written > (SMB_OFF_T)fsp->size)) + if ((total_written != -1) && (pos + total_written > (SMB_OFF_T)fsp->size)) fsp->size = (SMB_BIG_UINT)(pos + total_written); return total_written; } @@ -252,6 +268,8 @@ nonop=%u allocated=%u active=%u direct=%u perfect=%u readhits=%u\n", DEBUG(9,("write_file (%s)(fd=%d pos=%.0f size=%u) wcp->offset=%.0f wcp->data_size=%u\n", fsp->fsp_name, fsp->fd, (double)pos, (unsigned int)n, (double)wcp->offset, (unsigned int)wcp->data_size)); + fsp->pos = pos + n; + /* * If we have active cache and it isn't contiguous then we flush. * NOTE: There is a small problem with running out of disk .... diff --git a/source3/smbd/filename.c b/source3/smbd/filename.c index ad107f9c3e..643e315c06 100644 --- a/source3/smbd/filename.c +++ b/source3/smbd/filename.c @@ -125,7 +125,7 @@ BOOL unix_convert(pstring name,connection_struct *conn,char *saved_last_componen * also trim trailing /'s. */ - trim_string(name,"/","/"); + trim_char(name,'/','/'); /* * If we trimmed down to a single '\0' character @@ -164,7 +164,7 @@ BOOL unix_convert(pstring name,connection_struct *conn,char *saved_last_componen return(True); start = name; - while (strncmp(start,"./",2) == 0) + while (start[0] == '.' && start[1] == '/') start += 2; pstrcpy(orig_path, name); diff --git a/source3/smbd/files.c b/source3/smbd/files.c index f0fd6b7a73..1fe6f250e5 100644 --- a/source3/smbd/files.c +++ b/source3/smbd/files.c @@ -142,6 +142,22 @@ void file_close_conn(connection_struct *conn) } } +/**************************************************************************** + Close all open files for a pid. +****************************************************************************/ + +void file_close_pid(uint16 smbpid) +{ + files_struct *fsp, *next; + + for (fsp=Files;fsp;fsp=next) { + next = fsp->next; + if (fsp->file_pid == smbpid) { + close_file(fsp,False); + } + } +} + /**************************************************************************** Initialise file structures. ****************************************************************************/ @@ -200,6 +216,18 @@ void file_close_user(int vuid) } } +void file_dump_open_table(void) +{ + int count=0; + files_struct *fsp; + + for (fsp=Files;fsp;fsp=fsp->next,count++) { + DEBUG(10,("Files[%d], fnum = %d, name %s, fd = %d, fileid = %lu, dev = %x, inode = %.0f\n", + count, fsp->fnum, fsp->fsp_name, fsp->fd, (unsigned long)fsp->file_id, + (unsigned int)fsp->dev, (double)fsp->inode )); + } +} + /**************************************************************************** Find a fsp given a file descriptor. ****************************************************************************/ diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c index a5f7a7b2ea..b27ccc23ef 100644 --- a/source3/smbd/lanman.c +++ b/source3/smbd/lanman.c @@ -1706,13 +1706,24 @@ static BOOL api_NetUserGetGroups(connection_struct *conn,uint16 vuid, char *para int uLevel = SVAL(p,0); const char *level_string; int count=0; + SAM_ACCOUNT *sampw = NULL; + BOOL ret = False; + DOM_GID *gids = NULL; + int num_groups = 0; + int i; + fstring grp_domain; + fstring grp_name; + enum SID_NAME_USE grp_type; + DOM_SID sid, dom_sid; *rparam_len = 8; *rparam = REALLOC(*rparam,*rparam_len); /* check it's a supported varient */ - if (!strcmp(str1,"zWrLeh")) + + if ( strcmp(str1,"zWrLeh") != 0 ) return False; + switch( uLevel ) { case 0: level_string = "B21"; @@ -1732,18 +1743,59 @@ static BOOL api_NetUserGetGroups(connection_struct *conn,uint16 vuid, char *para p = *rdata; - /* XXXX we need a real SAM database some day */ - pstrcpy(p,"Users"); p += 21; count++; - pstrcpy(p,"Domain Users"); p += 21; count++; - pstrcpy(p,"Guests"); p += 21; count++; - pstrcpy(p,"Domain Guests"); p += 21; count++; + /* Lookup the user information; This should only be one of + our accounts (not remote domains) */ + + pdb_init_sam( &sampw ); + + become_root(); /* ROOT BLOCK */ + + if ( !pdb_getsampwnam(sampw, UserName) ) + goto out; + + /* this next set of code is horribly inefficient, but since + it is rarely called, I'm going to leave it like this since + it easier to follow --jerry */ + + /* get the list of group SIDs */ + + if ( !get_domain_user_groups(conn->mem_ctx, &num_groups, &gids, sampw) ) { + DEBUG(1,("api_NetUserGetGroups: get_domain_user_groups() failed!\n")); + goto out; + } + /* convert to names (we don't support universal groups so the domain + can only be ours) */ + + sid_copy( &dom_sid, get_global_sam_sid() ); + for (i=0; isam_account, pass1, pass2))) { + if (NT_STATUS_IS_OK(change_oem_password(server_info->sam_account, pass1, pass2, False))) { SSVAL(*rparam,0,NERR_Success); } unbecome_root(); @@ -1957,7 +2009,7 @@ static BOOL api_SetUserPassword(connection_struct *conn,uint16 vuid, char *param if (check_lanman_password(user,(unsigned char *)pass1,(unsigned char *)pass2, &hnd)) { become_root(); - if (change_lanman_password(hnd,pass2)) { + if (change_lanman_password(hnd,(uchar *)pass2)) { SSVAL(*rparam,0,NERR_Success); } unbecome_root(); @@ -1980,47 +2032,46 @@ static BOOL api_SamOEMChangePassword(connection_struct *conn,uint16 vuid, char * char **rdata,char **rparam, int *rdata_len,int *rparam_len) { - fstring user; - char *p = param + 2; - *rparam_len = 2; - *rparam = REALLOC(*rparam,*rparam_len); + fstring user; + char *p = param + 2; + *rparam_len = 2; + *rparam = REALLOC(*rparam,*rparam_len); - *rdata_len = 0; + *rdata_len = 0; - SSVAL(*rparam,0,NERR_badpass); + SSVAL(*rparam,0,NERR_badpass); - /* - * Check the parameter definition is correct. - */ - if(!strequal(param + 2, "zsT")) { - DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", param + 2)); - return False; - } - p = skip_string(p, 1); + /* + * Check the parameter definition is correct. + */ - if(!strequal(p, "B516B16")) { - DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p)); - return False; - } - p = skip_string(p,1); + if(!strequal(param + 2, "zsT")) { + DEBUG(0,("api_SamOEMChangePassword: Invalid parameter string %s\n", param + 2)); + return False; + } + p = skip_string(p, 1); - p += pull_ascii_fstring(user,p); + if(!strequal(p, "B516B16")) { + DEBUG(0,("api_SamOEMChangePassword: Invalid data parameter string %s\n", p)); + return False; + } + p = skip_string(p,1); + p += pull_ascii_fstring(user,p); - DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user)); + DEBUG(3,("api_SamOEMChangePassword: Change password for <%s>\n",user)); - /* - * Pass the user through the NT -> unix user mapping - * function. - */ + /* + * Pass the user through the NT -> unix user mapping + * function. + */ - (void)map_username(user); + (void)map_username(user); - if (NT_STATUS_IS_OK(pass_oem_change(user, (uchar*) data, (uchar *)&data[516], NULL, NULL))) - { - SSVAL(*rparam,0,NERR_Success); - } + if (NT_STATUS_IS_OK(pass_oem_change(user, (uchar*) data, (uchar *)&data[516], NULL, NULL))) { + SSVAL(*rparam,0,NERR_Success); + } - return(True); + return(True); } /**************************************************************************** diff --git a/source3/smbd/mangle_hash2.c b/source3/smbd/mangle_hash2.c index cdce28e1bd..9cd0438d51 100644 --- a/source3/smbd/mangle_hash2.c +++ b/source3/smbd/mangle_hash2.c @@ -201,22 +201,24 @@ static const char *cache_lookup(u32 hash) In this algorithm, mangled names use only pure ascii characters (no multi-byte) so we can avoid doing a UCS2 conversion */ -static BOOL is_mangled_component(const char *name) +static BOOL is_mangled_component(const char *name, size_t len) { - unsigned int len, i; + unsigned int i; - M_DEBUG(10,("is_mangled_component %s ?\n", name)); + M_DEBUG(10,("is_mangled_component %s (len %u) ?\n", name, (unsigned int)len)); /* check the length */ - len = strlen(name); - if (len > 12 || len < 8) return False; + if (len > 12 || len < 8) + return False; /* the best distinguishing characteristic is the ~ */ - if (name[6] != '~') return False; + if (name[6] != '~') + return False; /* check extension */ if (len > 8) { - if (name[8] != '.') return False; + if (name[8] != '.') + return False; for (i=9; name[i]; i++) { if (! FLAG_CHECK(name[i], FLAG_ASCII)) { return False; @@ -241,7 +243,7 @@ static BOOL is_mangled_component(const char *name) } } - M_DEBUG(10,("is_mangled %s -> yes\n", name)); + M_DEBUG(10,("is_mangled_component %s (len %u) -> yes\n", name, (unsigned int)len)); return True; } @@ -267,16 +269,13 @@ static BOOL is_mangled(const char *name) M_DEBUG(10,("is_mangled %s ?\n", name)); for (s=name; (p=strchr(s, '/')); s=p+1) { - char *component = strndup(s, PTR_DIFF(p, s)); - if (is_mangled_component(component)) { - free(component); + if (is_mangled_component(s, PTR_DIFF(p, s))) { return True; } - free(component); } /* and the last part ... */ - return is_mangled_component(s); + return is_mangled_component(s,strlen(s)); } @@ -305,7 +304,8 @@ static BOOL is_8_3(const char *name, BOOL check_case, BOOL allow_wildcards) the result we need in this case. Using strlen_m would not only be slower, it would be incorrect */ len = strlen(name); - if (len > 12) return False; + if (len > 12) + return False; /* find the '.'. Note that once again we use the non-multibyte function */ @@ -449,6 +449,27 @@ static BOOL is_legal_name(const char *name) size_t numdots = 0; while (*name) { + if (((unsigned int)name[0]) > 128 && (name[1] != 0)) { + /* Possible start of mb character. */ + char mbc[2]; + /* + * We know the following will return 2 bytes. What + * we need to know was if errno was set. + * Note that if CH_UNIX is utf8 a string may be 3 + * bytes, but this is ok as mb utf8 characters don't + * contain embedded ascii bytes. We are really checking + * for mb UNIX asian characters like Japanese (SJIS) here. + * JRA. + */ + errno = 0; + convert_string(CH_UNIX, CH_UCS2, name, 2, mbc, 2); + if (!errno) { + /* Was a good mb string. */ + name += 2; + continue; + } + } + if (FLAG_CHECK(name[0], FLAG_ILLEGAL)) { return False; } diff --git a/source3/smbd/message.c b/source3/smbd/message.c index 233848d2d6..88f833e468 100644 --- a/source3/smbd/message.c +++ b/source3/smbd/message.c @@ -64,7 +64,7 @@ static void msg_deliver(void) * Incoming message is in DOS codepage format. Convert to UNIX. */ - if ((len = convert_string_allocate(CH_DOS, CH_UNIX, msgbuf, msgpos, (void **) &msg)) < 0 || !msg) { + if ((len = convert_string_allocate(NULL,CH_DOS, CH_UNIX, msgbuf, msgpos, (void **) &msg)) < 0 || !msg) { DEBUG(3,("Conversion failed, delivering message in DOS codepage format\n")); for (i = 0; i < msgpos;) { if (msgbuf[i] == '\r' && i < (msgpos-1) && msgbuf[i+1] == '\n') { diff --git a/source3/smbd/notify.c b/source3/smbd/notify.c index 9adf827c79..ca6f2b783f 100644 --- a/source3/smbd/notify.c +++ b/source3/smbd/notify.c @@ -199,7 +199,7 @@ BOOL change_notify_set(char *inbuf, files_struct *fsp, connection_struct *conn, DLIST_ADD(change_notify_list, cnbp); /* Push the MID of this packet on the signing queue. */ - srv_defer_sign_response(SVAL(inbuf,smb_mid)); + srv_defer_sign_response(SVAL(inbuf,smb_mid), True); return True; } diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c index 3ffa6efa77..f8bd3ae15f 100644 --- a/source3/smbd/nttrans.c +++ b/source3/smbd/nttrans.c @@ -762,9 +762,8 @@ create_options = 0x%x root_dir_fid = 0x%x\n", flags, desired_access, file_attrib restore_case_semantics(file_attributes); if(!fsp) { - set_bad_path_error(errno, bad_path); END_PROFILE(SMBntcreateX); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess); } } else { /* @@ -838,16 +837,14 @@ create_options = 0x%x root_dir_fid = 0x%x\n", flags, desired_access, file_attrib if(!fsp) { restore_case_semantics(file_attributes); - set_bad_path_error(errno, bad_path); END_PROFILE(SMBntcreateX); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess); } } else { restore_case_semantics(file_attributes); - set_bad_path_error(errno, bad_path); END_PROFILE(SMBntcreateX); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess); } } } @@ -1279,8 +1276,7 @@ static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *o if(!fsp) { restore_case_semantics(file_attributes); - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess); } } else { @@ -1312,13 +1308,11 @@ static int call_nt_transact_create(connection_struct *conn, char *inbuf, char *o if(!fsp) { restore_case_semantics(file_attributes); - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess); } } else { restore_case_semantics(file_attributes); - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess); } } @@ -1724,7 +1718,11 @@ static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *ou char **ppparams, uint32 parameter_count, char **ppdata, uint32 data_count) { - unsigned fnum, control; + uint32 function; + uint16 fidnum; + files_struct *fsp; + uint8 isFSctl; + uint8 compfilter; static BOOL logged_message; char *pdata = *ppdata; @@ -1733,19 +1731,26 @@ static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *ou return ERROR_NT(NT_STATUS_NOT_SUPPORTED); } - fnum = SVAL(*ppsetup, 4); - control = IVAL(*ppsetup, 0); + function = IVAL(*ppsetup, 0); + fidnum = SVAL(*ppsetup, 4); + isFSctl = CVAL(*ppsetup, 6); + compfilter = CVAL(*ppsetup, 7); + + DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n", + function, fidnum, isFSctl, compfilter)); - DEBUG(10,("call_nt_transact_ioctl: fnum=%d control=0x%08x\n", - fnum, control)); + fsp=file_fsp(*ppsetup, 4); + /* this check is done in each implemented function case for now + because I don't want to break anything... --metze + FSP_BELONGS_CONN(fsp,conn);*/ - switch (control) { + switch (function) { case FSCTL_SET_SPARSE: /* pretend this succeeded - tho strictly we should mark the file sparse (if the local fs supports it) so we can know if we need to pre-allocate or not */ - DEBUG(10,("FSCTL_SET_SPARSE: fnum=%d control=0x%08x\n",fnum,control)); + DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X](but not implemented)\n", fidnum)); send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0); return -1; @@ -1754,7 +1759,7 @@ static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *ou but works ok like this --metze */ - DEBUG(10,("FSCTL_GET_REPARSE_POINT: fnum=%d control=0x%08x\n",fnum,control)); + DEBUG(10,("FSCTL_0x000900C0: called on FID[0x%04X](but not implemented)\n",fidnum)); send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0); return -1; @@ -1763,7 +1768,7 @@ static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *ou * --metze */ - DEBUG(10,("FSCTL_GET_REPARSE_POINT: fnum=%d control=0x%08x\n",fnum,control)); + DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum)); send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0); return -1; @@ -1772,10 +1777,125 @@ static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *ou * --metze */ - DEBUG(10,("FSCTL_SET_REPARSE_POINT: fnum=%d control=0x%08x\n",fnum,control)); + DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum)); send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0); return -1; + case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/ + { + /* + * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots) + * and return their volume names. If max_data_count is 16, then it is just + * asking for the number of volumes and length of the combined names. + * + * pdata is the data allocated by our caller, but that uses + * total_data_count (which is 0 in our case) rather than max_data_count. + * Allocate the correct amount and return the pointer to let + * it be deallocated when we return. + */ + uint32 max_data_count = IVAL(inbuf,smb_nt_MaxDataCount); + SHADOW_COPY_DATA *shadow_data = NULL; + TALLOC_CTX *shadow_mem_ctx = NULL; + BOOL labels = False; + uint32 labels_data_count = 0; + uint32 i; + char *cur_pdata; + + FSP_BELONGS_CONN(fsp,conn); + + if (max_data_count < 16) { + DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n", + max_data_count)); + return ERROR_NT(NT_STATUS_INVALID_PARAMETER); + } + + if (max_data_count > 16) { + labels = True; + } + + shadow_mem_ctx = talloc_init("SHADOW_COPY_DATA"); + if (shadow_mem_ctx == NULL) { + DEBUG(0,("talloc_init(SHADOW_COPY_DATA) failed!\n")); + return ERROR_NT(NT_STATUS_NO_MEMORY); + } + + shadow_data = (SHADOW_COPY_DATA *)talloc_zero(shadow_mem_ctx,sizeof(SHADOW_COPY_DATA)); + if (shadow_data == NULL) { + DEBUG(0,("talloc_zero() failed!\n")); + return ERROR_NT(NT_STATUS_NO_MEMORY); + } + + shadow_data->mem_ctx = shadow_mem_ctx; + + /* + * Call the VFS routine to actually do the work. + */ + if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)!=0) { + talloc_destroy(shadow_data->mem_ctx); + if (errno == ENOSYS) { + DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n", + conn->connectpath)); + return ERROR_NT(NT_STATUS_NOT_SUPPORTED); + } else { + DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n", + conn->connectpath)); + return ERROR_NT(NT_STATUS_UNSUCCESSFUL); + } + } + + labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2; + + if (!labels) { + data_count = 16; + } else { + data_count = 12+labels_data_count+4; + } + + if (max_data_countmem_ctx); + return ERROR_NT(NT_STATUS_BUFFER_TOO_SMALL); + } + + pdata = nttrans_realloc(ppdata, data_count); + if (pdata == NULL) { + talloc_destroy(shadow_data->mem_ctx); + return ERROR_NT(NT_STATUS_NO_MEMORY); + } + + cur_pdata = pdata; + + /* num_volumes 4 bytes */ + SIVAL(pdata,0,shadow_data->num_volumes); + + if (labels) { + /* num_labels 4 bytes */ + SIVAL(pdata,4,shadow_data->num_volumes); + } + + /* needed_data_count 4 bytes */ + SIVAL(pdata,8,labels_data_count); + + cur_pdata+=12; + + DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n", + shadow_data->num_volumes,fsp->fsp_name)); + if (labels && shadow_data->labels) { + for (i=0;inum_volumes;i++) { + srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE|STR_TERMINATE); + cur_pdata+=2*sizeof(SHADOW_COPY_LABEL); + DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i])); + } + } + + talloc_destroy(shadow_data->mem_ctx); + + send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, pdata, data_count); + + return -1; + } + case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */ { /* pretend this succeeded - @@ -1783,24 +1903,24 @@ static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *ou * we have to send back a list with all files owned by this SID * * but I have to check that --metze - */ - + */ DOM_SID sid; uid_t uid; - size_t sid_len=SID_MAX_SIZE; - - DEBUG(10,("FSCTL_FIND_FILES_BY_SID: fnum=%d control=0x%08x\n",fnum,control)); + size_t sid_len = MIN(data_count-4,SID_MAX_SIZE); - /* this is not the length of the sid :-( so unknown 4 bytes */ - /*sid_len = IVAL(pdata,0); - DEBUGADD(0,("sid_len: (%u)\n",sid_len));*/ + DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum)); + + FSP_BELONGS_CONN(fsp,conn); + + /* unknown 4 bytes: this is not the length of the sid :-( */ + /*unknown = IVAL(pdata,0);*/ sid_parse(pdata+4,sid_len,&sid); - DEBUGADD(10,("SID: %s\n",sid_string_static(&sid))); + DEBUGADD(10,("for SID: %s\n",sid_string_static(&sid))); if (!NT_STATUS_IS_OK(sid_to_uid(&sid, &uid))) { - DEBUG(0,("sid_to_uid: failed, sid[%s]\n", - sid_string_static(&sid))); + DEBUG(0,("sid_to_uid: failed, sid[%s] sid_len[%u]\n", + sid_string_static(&sid),sid_len)); uid = (-1); } @@ -1813,6 +1933,7 @@ static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *ou * for each file * * but I don't know how to deal with the paged results + * (maybe we can hang the result anywhere in the fsp struct) * * we don't send all files at once * and at the next we should *not* start from the beginning, @@ -1829,7 +1950,7 @@ static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *ou if (!logged_message) { logged_message = True; /* Only print this once... */ DEBUG(0,("call_nt_transact_ioctl(0x%x): Currently not implemented.\n", - control)); + function)); } } diff --git a/source3/smbd/open.c b/source3/smbd/open.c index 5f49640aa4..71af23aaf9 100644 --- a/source3/smbd/open.c +++ b/source3/smbd/open.c @@ -23,6 +23,7 @@ extern userdom_struct current_user_info; extern uint16 global_oplock_port; +extern uint16 global_smbpid; extern BOOL global_client_failed_oplock_break; /**************************************************************************** @@ -226,8 +227,8 @@ static BOOL open_file(files_struct *fsp,connection_struct *conn, fsp->inode = psbuf->st_ino; fsp->dev = psbuf->st_dev; fsp->vuid = current_user.vuid; + fsp->file_pid = global_smbpid; fsp->size = psbuf->st_size; - fsp->pos = -1; fsp->can_lock = True; fsp->can_read = ((flags & O_WRONLY)==0); fsp->can_write = ((flags & (O_WRONLY|O_RDWR))!=0); @@ -626,6 +627,12 @@ static int open_mode_check(connection_struct *conn, const char *fname, SMB_DEV_T DEBUG(5,("open_mode_check: oplock_request = %d, breaking oplock (%x) on file %s, \ dev = %x, inode = %.0f\n", *p_oplock_request, share_entry->op_type, fname, (unsigned int)dev, (double)inode)); + /* Ensure the reply for the open uses the correct sequence number. */ + /* This isn't a real deferred packet as it's response will also increment + * the sequence. + */ + srv_defer_sign_response(get_current_mid(), False); + /* Oplock break - unlock to request it. */ unlock_share_entry(conn, dev, inode); @@ -1356,7 +1363,7 @@ files_struct *open_directory(connection_struct *conn, char *fname, SMB_STRUCT_ST fsp->dev = psbuf->st_dev; fsp->size = psbuf->st_size; fsp->vuid = current_user.vuid; - fsp->pos = -1; + fsp->file_pid = global_smbpid; fsp->can_lock = True; fsp->can_read = False; fsp->can_write = False; @@ -1419,7 +1426,7 @@ files_struct *open_file_stat(connection_struct *conn, char *fname, SMB_STRUCT_ST fsp->dev = (SMB_DEV_T)0; fsp->size = psbuf->st_size; fsp->vuid = current_user.vuid; - fsp->pos = -1; + fsp->file_pid = global_smbpid; fsp->can_lock = False; fsp->can_read = False; fsp->can_write = False; diff --git a/source3/smbd/password.c b/source3/smbd/password.c index b988f2ec74..32c24b3d67 100644 --- a/source3/smbd/password.c +++ b/source3/smbd/password.c @@ -28,6 +28,9 @@ static user_struct *validated_users; static int next_vuid = VUID_OFFSET; static int num_validated_vuids; +extern userdom_struct current_user_info; + + /**************************************************************************** Check if a uid has been validated, and return an pointer to the user_struct if it has. NULL if not. vuid is biased by an offset. This allows us to @@ -296,7 +299,7 @@ BOOL user_ok(const char *user,int snum, gid_t *groups, size_t n_groups) if (ret && lp_valid_users(snum)) { str_list_copy(&valid, lp_valid_users(snum)); - if (valid && str_list_substitute(valid, "%S", lp_servicename(snum))) { + if ( valid && str_list_sub_basic(valid, current_user_info.smb_name) ) { ret = user_in_list(user, (const char **)valid, groups, n_groups); } } diff --git a/source3/smbd/process.c b/source3/smbd/process.c index dce1c4bc03..3c15cd1833 100644 --- a/source3/smbd/process.c +++ b/source3/smbd/process.c @@ -47,6 +47,15 @@ SIG_ATOMIC_T got_sig_term = 0; BOOL global_machine_password_needs_changing = False; extern int max_send; +/**************************************************************************** + Function to return the current request mid from Inbuffer. +****************************************************************************/ + +uint16 get_current_mid(void) +{ + return SVAL(InBuffer,smb_mid); +} + /**************************************************************************** structure to hold a linked list of queued messages. for processing. @@ -88,7 +97,7 @@ static BOOL push_message(ubi_slList *list_head, char *buf, int msg_len) ubi_slAddTail( list_head, msg); /* Push the MID of this packet on the signing queue. */ - srv_defer_sign_response(SVAL(buf,smb_mid)); + srv_defer_sign_response(SVAL(buf,smb_mid), True); return True; } @@ -710,7 +719,7 @@ static int switch_message(int type,char *inbuf,char *outbuf,int size,int bufsize if(session_tag != UID_FIELD_INVALID) vuser = get_valid_user_struct(session_tag); if(vuser != NULL) - current_user_info = vuser->user; + set_current_user_info(&vuser->user); } /* does this protocol need to be run as root? */ @@ -1256,8 +1265,10 @@ void smbd_process(void) if ((InBuffer == NULL) || (OutBuffer == NULL)) return; +#if defined(DEVELOPER) clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size); clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, OutBuffer, total_buffer_size); +#endif max_recv = MIN(lp_maxxmit(),BUFFER_SIZE); @@ -1286,7 +1297,9 @@ void smbd_process(void) num_smbs = 0; /* Reset smb counter. */ } +#if defined(DEVELOPER) clobber_region(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, InBuffer, total_buffer_size); +#endif while (!receive_message_or_smb(InBuffer,BUFFER_SIZE+LARGE_WRITEX_HDR_SIZE,select_timeout)) { if(!timeout_processing( deadtime, &select_timeout, &last_timeout_processing_time)) diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c index 71312295f4..6ac4cffddb 100644 --- a/source3/smbd/reply.c +++ b/source3/smbd/reply.c @@ -38,6 +38,21 @@ unsigned int smb_echo_count = 0; extern BOOL global_encrypted_passwords_negotiated; +/**************************************************************************** + Ensure we check the path in the same way as W2K. +****************************************************************************/ + +static NTSTATUS check_path_syntax(const char *name) +{ + while (*name == '\\') + name++; + if (strequal(name, ".")) + return NT_STATUS_OBJECT_NAME_INVALID; + else if (strequal(name, "..")) + return NT_STATUS_OBJECT_PATH_SYNTAX_BAD; + return NT_STATUS_OK; +} + /**************************************************************************** Reply to a special message. ****************************************************************************/ @@ -333,7 +348,6 @@ int reply_ioctl(connection_struct *conn, uint32 ioctl_code = (device << 16) + function; int replysize, outsize; char *p; - files_struct *fsp = file_fsp(inbuf,smb_vwv0); START_PROFILE(SMBioctl); DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code)); @@ -356,6 +370,11 @@ int reply_ioctl(connection_struct *conn, switch (ioctl_code) { case IOCTL_QUERY_JOB_INFO: { + files_struct *fsp = file_fsp(inbuf,smb_vwv0); + if (!fsp) { + END_PROFILE(SMBioctl); + return(UNIXERROR(ERRDOS,ERRbadfid)); + } SSVAL(p,0,fsp->rap_print_jobid); /* Job number */ srvstr_push(outbuf, p+2, global_myname(), 15, STR_TERMINATE|STR_ASCII); srvstr_push(outbuf, p+18, lp_servicename(SNUM(conn)), 13, STR_TERMINATE|STR_ASCII); @@ -379,10 +398,16 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size BOOL ok = False; BOOL bad_path = False; SMB_STRUCT_STAT sbuf; + NTSTATUS status; + START_PROFILE(SMBchkpth); srvstr_pull_buf(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), STR_TERMINATE); + status = check_path_syntax(name); + if (!NT_STATUS_IS_OK(status)) + return ERROR_NT(status); + RESOLVE_DFSPATH(name, conn, inbuf, outbuf); unix_convert(name,conn,0,&bad_path,&sbuf); @@ -401,8 +426,21 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size one at a time - if a component fails it expects ERRbadpath, not ERRbadfile. */ - if(errno == ENOENT) - return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND); + if(errno == ENOENT) { + /* + * Windows returns different error codes if + * the parent directory is valid but not the + * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND + * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND + * if the path is invalid. + */ + if (bad_path) { + return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND); + } else { + return ERROR_NT(NT_STATUS_OBJECT_NAME_NOT_FOUND); + } + } else if (errno == ENOTDIR) + return ERROR_NT(NT_STATUS_NOT_A_DIRECTORY); return(UNIXERROR(ERRDOS,ERRbadpath)); } @@ -463,9 +501,8 @@ int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size } if (!ok) { - set_bad_path_error(errno, bad_path); END_PROFILE(SMBgetatr); - return(UNIXERROR(ERRDOS,ERRbadfile)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadfile); } outsize = set_message(outbuf,10,0,True); @@ -510,20 +547,24 @@ int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size mode = SVAL(inbuf,smb_vwv0); mtime = make_unix_date3(inbuf+smb_vwv1); - if (VALID_STAT_OF_DIR(sbuf)) - mode |= aDIR; - else - mode &= ~aDIR; + if (mode != FILE_ATTRIBUTE_NORMAL) { + if (VALID_STAT_OF_DIR(sbuf)) + mode |= aDIR; + else + mode &= ~aDIR; + + if (check_name(fname,conn)) + ok = (file_chmod(conn,fname,mode,NULL) == 0); + } else { + ok = True; + } - if (check_name(fname,conn)) - ok = (file_chmod(conn,fname,mode,NULL) == 0); if (ok) ok = set_filetime(conn,fname,mtime); if (!ok) { - set_bad_path_error(errno, bad_path); END_PROFILE(SMBsetatr); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess); } outsize = set_message(outbuf,0,0,True); @@ -684,9 +725,8 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size dptr_num = dptr_create(conn,directory,True,expect_close,SVAL(inbuf,smb_pid)); if (dptr_num < 0) { if(dptr_num == -2) { - set_bad_path_error(errno, bad_path); END_PROFILE(SMBsearch); - return (UNIXERROR(ERRDOS,ERRnofids)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnofids); } END_PROFILE(SMBsearch); return ERROR_DOS(ERRDOS,ERRnofids); @@ -732,21 +772,23 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size SearchEmpty: - if (numentries == 0 || !ok) { - SCVAL(outbuf,smb_rcls,ERRDOS); - SSVAL(outbuf,smb_err,ERRnofiles); - dptr_close(&dptr_num); - } - /* If we were called as SMBffirst with smb_search_id == NULL and no entries were found then return error and close dirptr (X/Open spec) */ if(ok && expect_close && numentries == 0 && status_len == 0) { - SCVAL(outbuf,smb_rcls,ERRDOS); - SSVAL(outbuf,smb_err,ERRnofiles); + if (Protocol < PROTOCOL_NT1) { + SCVAL(outbuf,smb_rcls,ERRDOS); + SSVAL(outbuf,smb_err,ERRnofiles); + } /* Also close the dptr - we know it's gone */ dptr_close(&dptr_num); + } else if (numentries == 0 || !ok) { + if (Protocol < PROTOCOL_NT1) { + SCVAL(outbuf,smb_rcls,ERRDOS); + SSVAL(outbuf,smb_err,ERRnofiles); + } + dptr_close(&dptr_num); } /* If we were called as SMBfunique, then we can close the dirptr now ! */ @@ -851,9 +893,8 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, unixmode, oplock_request,&rmode,NULL); if (!fsp) { - set_bad_path_error(errno, bad_path); END_PROFILE(SMBopen); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess); } size = sbuf.st_size; @@ -939,9 +980,8 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt oplock_request, &rmode,&smb_action); if (!fsp) { - set_bad_path_error(errno, bad_path); END_PROFILE(SMBopenX); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess); } size = sbuf.st_size; @@ -1063,9 +1103,8 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, ofun, unixmode, oplock_request, NULL, NULL); if (!fsp) { - set_bad_path_error(errno, bad_path); END_PROFILE(SMBcreate); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess); } outsize = set_message(outbuf,1,0,True); @@ -1132,9 +1171,8 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, close(tmpfd); if (!fsp) { - set_bad_path_error(errno, bad_path); END_PROFILE(SMBctemp); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess); } outsize = set_message(outbuf,1,0,True); @@ -1215,6 +1253,9 @@ static NTSTATUS can_delete(char *fname,connection_struct *conn, int dirtype) int access_mode; files_struct *fsp; + DEBUG(10,("can_delete: %s, dirtype = %d\n", + fname, dirtype )); + if (!CAN_WRITE(conn)) return NT_STATUS_MEDIA_WRITE_PROTECTED; @@ -1222,14 +1263,21 @@ static NTSTATUS can_delete(char *fname,connection_struct *conn, int dirtype) return NT_STATUS_OBJECT_NAME_NOT_FOUND; fmode = dos_mode(conn,fname,&sbuf); + + /* Can't delete a directory. */ if (fmode & aDIR) return NT_STATUS_FILE_IS_A_DIRECTORY; +#if 0 /* JRATEST */ + else if (dirtype & aDIR) /* Asked for a directory and it isn't. */ + return NT_STATUS_OBJECT_NAME_INVALID; +#endif /* JRATEST */ + if (!lp_delete_readonly(SNUM(conn))) { if (fmode & aRONLY) return NT_STATUS_CANNOT_DELETE; } if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) - return NT_STATUS_CANNOT_DELETE; + return NT_STATUS_NO_SUCH_FILE; /* We need a better way to return NT status codes from open... */ unix_ERR_class = 0; @@ -1329,7 +1377,7 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name) */ if (dirptr) { - error = NT_STATUS_OBJECT_NAME_NOT_FOUND; + error = NT_STATUS_NO_SUCH_FILE; if (strequal(mask,"????????.???")) pstrcpy(mask,"*"); @@ -1377,6 +1425,10 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size srvstr_pull_buf(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), STR_TERMINATE); + status = check_path_syntax(name); + if (!NT_STATUS_IS_OK(status)) + return ERROR_NT(status); + RESOLVE_DFSPATH(name, conn, inbuf, outbuf); DEBUG(3,("reply_unlink : %s\n",name)); @@ -2262,39 +2314,25 @@ int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int switch (mode) { case 0: umode = SEEK_SET; + res = startpos; break; case 1: umode = SEEK_CUR; + res = fsp->pos + startpos; break; case 2: umode = SEEK_END; break; default: umode = SEEK_SET; + res = startpos; break; } - if((res = SMB_VFS_LSEEK(fsp,fsp->fd,startpos,umode)) == -1) { - /* - * Check for the special case where a seek before the start - * of the file sets the offset to zero. Added in the CIFS spec, - * section 4.2.7. - */ - - if(errno == EINVAL) { - SMB_OFF_T current_pos = startpos; - - if(umode == SEEK_CUR) { - - if((current_pos = SMB_VFS_LSEEK(fsp,fsp->fd,0,SEEK_CUR)) == -1) { - END_PROFILE(SMBlseek); - return(UNIXERROR(ERRDOS,ERRnoaccess)); - } - - current_pos += startpos; - - } else if (umode == SEEK_END) { - + if (umode == SEEK_END) { + if((res = SMB_VFS_LSEEK(fsp,fsp->fd,startpos,umode)) == -1) { + if(errno == EINVAL) { + SMB_OFF_T current_pos = startpos; SMB_STRUCT_STAT sbuf; if(SMB_VFS_FSTAT(fsp,fsp->fd, &sbuf) == -1) { @@ -2303,10 +2341,9 @@ int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int } current_pos += sbuf.st_size; + if(current_pos < 0) + res = SMB_VFS_LSEEK(fsp,fsp->fd,0,SEEK_SET); } - - if(current_pos < 0) - res = SMB_VFS_LSEEK(fsp,fsp->fd,0,SEEK_SET); } if(res == -1) { @@ -2334,10 +2371,12 @@ int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int size, int int reply_flush(connection_struct *conn, char *inbuf,char *outbuf, int size, int dum_buffsize) { int outsize = set_message(outbuf,0,0,True); + uint16 fnum = SVAL(inbuf,smb_vwv0); files_struct *fsp = file_fsp(inbuf,smb_vwv0); START_PROFILE(SMBflush); - CHECK_FSP(fsp,conn); + if (fnum != 0xFFFF) + CHECK_FSP(fsp,conn); if (!fsp) { file_sync_all(conn); @@ -2359,6 +2398,9 @@ int reply_exit(connection_struct *conn, { int outsize; START_PROFILE(SMBexit); + + file_close_pid(SVAL(inbuf,smb_pid)); + outsize = set_message(outbuf,0,0,True); DEBUG(3,("exit\n")); @@ -2704,7 +2746,7 @@ int reply_printclose(connection_struct *conn, if (!CAN_PRINT(conn)) { END_PROFILE(SMBsplclose); - return ERROR_DOS(ERRDOS,ERRnoaccess); + return ERROR_NT(NT_STATUS_UNSUCCESSFUL); } DEBUG(3,("printclose fd=%d fnum=%d\n", @@ -2849,7 +2891,17 @@ NTSTATUS mkdir_internal(connection_struct *conn, pstring directory) ret = vfs_MkDir(conn,directory,unix_mode(conn,aDIR,directory)); if (ret == -1) { - NTSTATUS nterr = set_bad_path_error(errno, bad_path); + NTSTATUS nterr = NT_STATUS_OK; + if(errno == ENOENT) { + unix_ERR_class = ERRDOS; + if (bad_path) { + unix_ERR_code = ERRbadpath; + nterr = NT_STATUS_OBJECT_PATH_NOT_FOUND; + } else { + unix_ERR_code = ERRbadfile; + nterr = NT_STATUS_OBJECT_NAME_NOT_FOUND; + } + } if (!NT_STATUS_IS_OK(nterr)) return nterr; return map_nt_error_from_unix(errno); @@ -3044,9 +3096,8 @@ int reply_rmdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, } if (!ok) { - set_bad_path_error(errno, bad_path); END_PROFILE(SMBrmdir); - return(UNIXERROR(ERRDOS,ERRbadpath)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRbadpath); } outsize = set_message(outbuf,0,0,True); @@ -3129,6 +3180,130 @@ static BOOL resolve_wildcards(const char *name1, char *name2) return(True); } +/**************************************************************************** + Ensure open files have their names updates. +****************************************************************************/ + +static void rename_open_files(connection_struct *conn, SMB_DEV_T dev, SMB_INO_T inode, char *newname) +{ + files_struct *fsp; + BOOL did_rename = False; + + for(fsp = file_find_di_first(dev, inode); fsp; fsp = file_find_di_next(fsp)) { + DEBUG(10,("rename_open_files: renaming file fnum %d (dev = %x, inode = %.0f) from %s -> %s\n", + fsp->fnum, (unsigned int)fsp->dev, (double)fsp->inode, + fsp->fsp_name, newname )); + string_set(&fsp->fsp_name, newname); + did_rename = True; + } + + if (!did_rename) + DEBUG(10,("rename_open_files: no open files on dev %x, inode %.0f for %s\n", + (unsigned int)dev, (double)inode, newname )); +} + +/**************************************************************************** + Rename an open file - given an fsp. +****************************************************************************/ + +NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *newname, BOOL replace_if_exists) +{ + SMB_STRUCT_STAT sbuf; + BOOL bad_path = False; + pstring newname_last_component; + NTSTATUS error = NT_STATUS_OK; + BOOL dest_exists; + + ZERO_STRUCT(sbuf); + unix_convert(newname,conn,newname_last_component,&bad_path,&sbuf); + + /* Ensure newname contains a '/' */ + if(strrchr_m(newname,'/') == 0) { + pstring tmpstr; + + pstrcpy(tmpstr, "./"); + pstrcat(tmpstr, newname); + pstrcpy(newname, tmpstr); + } + + /* + * Check for special case with case preserving and not + * case sensitive. If the old last component differs from the original + * last component only by case, then we should allow + * the rename (user is trying to change the case of the + * filename). + */ + + if((case_sensitive == False) && (case_preserve == True) && + strequal(newname, fsp->fsp_name)) { + char *p; + pstring newname_modified_last_component; + + /* + * Get the last component of the modified name. + * Note that we guarantee that newname contains a '/' + * character above. + */ + p = strrchr_m(newname,'/'); + pstrcpy(newname_modified_last_component,p+1); + + if(strcsequal(newname_modified_last_component, + newname_last_component) == False) { + /* + * Replace the modified last component with + * the original. + */ + pstrcpy(p+1, newname_last_component); + } + } + + /* + * If the src and dest names are identical - including case, + * don't do the rename, just return success. + */ + + if (strcsequal(fsp->fsp_name, newname)) { + DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n", + newname)); + return NT_STATUS_OK; + } + + dest_exists = vfs_object_exist(conn,newname,NULL); + + if(!replace_if_exists && dest_exists) { + DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n", + fsp->fsp_name,newname)); + return NT_STATUS_OBJECT_NAME_COLLISION; + } + + error = can_rename(newname,conn,&sbuf); + + if (dest_exists && !NT_STATUS_IS_OK(error)) { + DEBUG(3,("rename_internals: Error %s rename %s -> %s\n", + nt_errstr(error), fsp->fsp_name,newname)); + if (NT_STATUS_EQUAL(error,NT_STATUS_SHARING_VIOLATION)) + error = NT_STATUS_ACCESS_DENIED; + return error; + } + + if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) { + DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n", + fsp->fsp_name,newname)); + rename_open_files(conn, fsp->dev, fsp->inode, newname); + return NT_STATUS_OK; + } + + if (errno == ENOTDIR || errno == EISDIR) + error = NT_STATUS_OBJECT_NAME_COLLISION; + else + error = map_nt_error_from_unix(errno); + + DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n", + nt_errstr(error), fsp->fsp_name,newname)); + + return error; +} + /**************************************************************************** The guts of the rename command, split out so it may be called by the NT SMB code. @@ -3150,6 +3325,8 @@ NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, BO *directory = *mask = 0; + ZERO_STRUCT(sbuf1); + ZERO_STRUCT(sbuf2); rc = unix_convert(name,conn,0,&bad_path1,&sbuf1); unix_convert(newname,conn,newname_last_component,&bad_path2,&sbuf2); @@ -3290,6 +3467,7 @@ directory = %s, newname = %s, newname_last_component = %s, is_8_3 = %d\n", */ if (strcsequal(directory, newname)) { + rename_open_files(conn, sbuf1.st_dev, sbuf1.st_ino, newname); DEBUG(3,("rename_internals: identical names in rename %s - returning success\n", directory)); return NT_STATUS_OK; } @@ -3303,6 +3481,7 @@ directory = %s, newname = %s, newname_last_component = %s, is_8_3 = %d\n", if(SMB_VFS_RENAME(conn,directory, newname) == 0) { DEBUG(3,("rename_internals: succeeded doing rename on %s -> %s\n", directory,newname)); + rename_open_files(conn, sbuf1.st_dev, sbuf1.st_ino, newname); return NT_STATUS_OK; } @@ -3367,8 +3546,10 @@ directory = %s, newname = %s, newname_last_component = %s, is_8_3 = %d\n", continue; } - if (!SMB_VFS_RENAME(conn,fname,destname)) + if (!SMB_VFS_RENAME(conn,fname,destname)) { + rename_open_files(conn, sbuf1.st_dev, sbuf1.st_ino, newname); count++; + } DEBUG(3,("rename_internals: doing rename on %s -> %s\n",fname,destname)); } CloseDir(dirptr); diff --git a/source3/smbd/sec_ctx.c b/source3/smbd/sec_ctx.c index 411ece5249..8a85792ead 100644 --- a/source3/smbd/sec_ctx.c +++ b/source3/smbd/sec_ctx.c @@ -199,7 +199,7 @@ BOOL initialise_groups(char *user, uid_t uid, gid_t gid) /* Call initgroups() to get user groups */ - if (initgroups(user,gid) == -1) { + if (winbind_initgroups(user,gid) == -1) { DEBUG(0,("Unable to initgroups. Error was %s\n", strerror(errno) )); if (getuid() == 0) { if (gid < 0 || gid > 32767 || uid < 0 || uid > 32767) { diff --git a/source3/smbd/server.c b/source3/smbd/server.c index 453ff54e4b..8b890549ea 100644 --- a/source3/smbd/server.c +++ b/source3/smbd/server.c @@ -744,7 +744,7 @@ void build_options(BOOL screen); reopen_logs(); - DEBUG(0,( "smbd version %s started.\n", VERSION)); + DEBUG(0,( "smbd version %s started.\n", SAMBA_VERSION_STRING)); DEBUGADD(0,( "Copyright Andrew Tridgell and the Samba Team 1992-2003\n")); DEBUG(2,("uid=%d gid=%d euid=%d egid=%d\n", diff --git a/source3/smbd/service.c b/source3/smbd/service.c index c2855487a5..70126b9e7f 100644 --- a/source3/smbd/service.c +++ b/source3/smbd/service.c @@ -273,7 +273,7 @@ static void set_read_only(connection_struct *conn, gid_t *groups, size_t n_group str_list_copy(&list, lp_readlist(conn->service)); if (list) { - if (!str_list_substitute(list, "%S", service)) { + if ( !str_list_sub_basic(list, current_user_info.smb_name) ) { DEBUG(0, ("ERROR: read list substitution failed\n")); } if (user_in_list(conn->user, (const char **)list, groups, n_groups)) @@ -283,7 +283,7 @@ static void set_read_only(connection_struct *conn, gid_t *groups, size_t n_group str_list_copy(&list, lp_writelist(conn->service)); if (list) { - if (!str_list_substitute(list, "%S", service)) { + if ( !str_list_sub_basic(list, current_user_info.smb_name) ) { DEBUG(0, ("ERROR: write list substitution failed\n")); } if (user_in_list(conn->user, (const char **)list, groups, n_groups)) @@ -642,6 +642,10 @@ static connection_struct *make_connection_snum(int snum, user_struct *vuser, return NULL; } } + +#ifdef WITH_FAKE_KASERVER + afs_login(user); +#endif #if CHECK_PATH_ON_TCONX /* win2000 does not check the permissions on the directory @@ -691,6 +695,7 @@ static connection_struct *make_connection_snum(int snum, user_struct *vuser, if( DEBUGLVL( IS_IPC(conn) ? 3 : 1 ) ) { dbgtext( "%s (%s) ", get_remote_machine_name(), conn->client_address ); + dbgtext( "%s", srv_is_signing_active() ? "signed " : ""); dbgtext( "connect to service %s ", lp_servicename(SNUM(conn)) ); dbgtext( "initially as user %s ", user ); dbgtext( "(uid=%d, gid=%d) ", (int)geteuid(), (int)getegid() ); diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c index 88b442215d..427caa3ba1 100644 --- a/source3/smbd/sesssetup.c +++ b/source3/smbd/sesssetup.c @@ -62,7 +62,7 @@ static int add_signature(char *outbuf, char *p) char *start = p; fstring lanman; - fstr_sprintf( lanman, "Samba %s", VERSION ); + fstr_sprintf( lanman, "Samba %s", SAMBA_VERSION_STRING); p += srvstr_push(outbuf, p, "Unix", -1, STR_TERMINATE); p += srvstr_push(outbuf, p, lanman, -1, STR_TERMINATE); @@ -149,7 +149,6 @@ static int reply_spnego_kerberos(connection_struct *conn, DATA_BLOB auth_data; DATA_BLOB ap_rep, ap_rep_wrapped, response; auth_serversupplied_info *server_info = NULL; - ADS_STRUCT *ads; uint8 session_key[16]; uint8 tok_id[2]; BOOL foreign = False; @@ -165,18 +164,12 @@ static int reply_spnego_kerberos(connection_struct *conn, return ERROR_NT(NT_STATUS_LOGON_FAILURE); } - ads = ads_init_simple(); + ret = ads_verify_ticket(lp_realm(), &ticket, &client, &auth_data, &ap_rep, session_key); - if (!ads) { - return ERROR_NT(NT_STATUS_LOGON_FAILURE); - } + data_blob_free(&ticket); - ads->auth.realm = strdup(lp_realm()); - - ret = ads_verify_ticket(ads, &ticket, &client, &auth_data, &ap_rep, session_key); if (!NT_STATUS_IS_OK(ret)) { DEBUG(1,("Failed to verify incoming ticket!\n")); - ads_destroy(&ads); return ERROR_NT(NT_STATUS_LOGON_FAILURE); } @@ -187,16 +180,17 @@ static int reply_spnego_kerberos(connection_struct *conn, p = strchr_m(client, '@'); if (!p) { DEBUG(3,("Doesn't look like a valid principal\n")); - ads_destroy(&ads); data_blob_free(&ap_rep); + SAFE_FREE(client); return ERROR_NT(NT_STATUS_LOGON_FAILURE); } *p = 0; - if (strcasecmp(p+1, ads->auth.realm) != 0) { + if (strcasecmp(p+1, lp_realm()) != 0) { DEBUG(3,("Ticket for foreign realm %s@%s\n", client, p+1)); if (!lp_allow_trusted_domains()) { data_blob_free(&ap_rep); + SAFE_FREE(client); return ERROR_NT(NT_STATUS_LOGON_FAILURE); } foreign = True; @@ -213,7 +207,7 @@ static int reply_spnego_kerberos(connection_struct *conn, user = smb_xstrdup(client); } - ads_destroy(&ads); + SAFE_FREE(client); /* setup the string used by %U */ sub_set_smb_name(user); @@ -223,7 +217,7 @@ static int reply_spnego_kerberos(connection_struct *conn, if (!pw) { DEBUG(1,("Username %s is invalid on this system\n",user)); data_blob_free(&ap_rep); - return ERROR_NT(NT_STATUS_NO_SUCH_USER); + return ERROR_NT(NT_STATUS_LOGON_FAILURE); } if (!NT_STATUS_IS_OK(ret = make_server_info_pw(&server_info,pw))) { diff --git a/source3/smbd/statcache.c b/source3/smbd/statcache.c index fbebdb240f..948173687d 100644 --- a/source3/smbd/statcache.c +++ b/source3/smbd/statcache.c @@ -66,11 +66,12 @@ void stat_cache_add( const char *full_orig_name, const char *orig_translated_pat return; /* - * Don't cache trivial valid directory entries. + * Don't cache trivial valid directory entries such as . and .. */ - if((*full_orig_name == '\0') || (strcmp(full_orig_name, ".") == 0) || - (strcmp(full_orig_name, "..") == 0)) + if((*full_orig_name == '\0') || (full_orig_name[0] == '.' && + ((full_orig_name[1] == '\0') || + (full_orig_name[1] == '.' && full_orig_name[1] == '\0')))) return; /* @@ -216,10 +217,10 @@ BOOL stat_cache_lookup(connection_struct *conn, pstring name, pstring dirpath, /* * Don't lookup trivial valid directory entries. */ - if((*name == '\0') || (strcmp(name, ".") == 0) || (strcmp(name, "..") == 0)) { - DO_PROFILE_INC(statcache_misses); + if((*name == '\0') || (name[0] == '.' && + ((name[1] == '\0') || + (name[1] == '.' && name[1] == '\0')))) return False; - } if (case_sensitive) { chk_name = strdup(name); @@ -247,6 +248,7 @@ BOOL stat_cache_lookup(connection_struct *conn, pstring name, pstring dirpath, while (1) { hash_elem = hash_lookup(&stat_cache, chk_name); if(hash_elem == NULL) { + DEBUG(10,("stat_cache_lookup: lookup failed for name [%s]\n", chk_name )); /* * Didn't find it - remove last component for next try. */ @@ -276,6 +278,7 @@ BOOL stat_cache_lookup(connection_struct *conn, pstring name, pstring dirpath, } } else { scp = (stat_cache_entry *)(hash_elem->value); + DEBUG(10,("stat_cache_lookup: lookup succeeded for name [%s] -> [%s]\n", chk_name, scp->translated_path )); DO_PROFILE_INC(statcache_hits); if(SMB_VFS_STAT(conn,scp->translated_path, pst) != 0) { /* Discard this entry - it doesn't exist in the filesystem. */ diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c index 86906fa5be..033e76a33e 100644 --- a/source3/smbd/trans2.c +++ b/source3/smbd/trans2.c @@ -1,7 +1,7 @@ /* Unix SMB/CIFS implementation. SMB transaction2 handling - Copyright (C) Jeremy Allison 1994-2001 + Copyright (C) Jeremy Allison 1994-2003 Copyright (C) Stefan (metze) Metzmacher 2003 Extensively modified by Andrew Tridgell, 1995 @@ -261,8 +261,7 @@ static int call_trans2open(connection_struct *conn, char *inbuf, char *outbuf, i unix_convert(fname,conn,0,&bad_path,&sbuf); if (!check_name(fname,conn)) { - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess); } unixmode = unix_mode(conn,open_attr | aARCH, fname); @@ -271,8 +270,7 @@ static int call_trans2open(connection_struct *conn, char *inbuf, char *outbuf, i oplock_request, &rmode,&smb_action); if (!fsp) { - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess); } size = get_file_size(sbuf); @@ -441,9 +439,9 @@ static mode_t unix_perms_from_wire( connection_struct *conn, SMB_STRUCT_STAT *ps } /**************************************************************************** -checks for SMB_TIME_NO_CHANGE and if not found -calls interpret_long_date + Checks for SMB_TIME_NO_CHANGE and if not found calls interpret_long_date. ****************************************************************************/ + time_t interpret_long_unix_date(char *p) { DEBUG(1,("interpret_long_unix_date\n")); @@ -763,6 +761,70 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn, p = pdata + len; break; + case SMB_FIND_FILE_LEVEL_261: + p += 4; + SIVAL(p,0,reskey); p += 4; + put_long_date(p,cdate); p += 8; + put_long_date(p,adate); p += 8; + put_long_date(p,mdate); p += 8; + put_long_date(p,mdate); p += 8; + SOFF_T(p,0,file_size); + SOFF_T(p,8,allocation_size); + p += 16; + SIVAL(p,0,nt_extmode); + p += 4; + len = srvstr_push(outbuf, p + 20, fname, -1, STR_TERMINATE_ASCII); + SIVAL(p, 0, len); + memset(p+4,'\0',16); /* EA size. Unknown 0 1 2 */ + p += 20 + len; /* Strlen, EA size. Unknown 0 1 2, string itself */ + len = PTR_DIFF(p, pdata); + len = (len + 3) & ~3; + SIVAL(pdata,0,len); + p = pdata + len; + break; + + case SMB_FIND_FILE_LEVEL_262: + was_8_3 = mangle_is_8_3(fname, True); + p += 4; + SIVAL(p,0,reskey); p += 4; + put_long_date(p,cdate); p += 8; + put_long_date(p,adate); p += 8; + put_long_date(p,mdate); p += 8; + put_long_date(p,mdate); p += 8; + SOFF_T(p,0,file_size); + SOFF_T(p,8,allocation_size); + p += 16; + SIVAL(p,0,nt_extmode); p += 4; + q = p; p += 4; + SIVAL(p,0,0); p += 4; + /* Clear the short name buffer. This is + * IMPORTANT as not doing so will trigger + * a Win2k client bug. JRA. + */ + memset(p,'\0',26); + if (!was_8_3) { + pstring mangled_name; + pstrcpy(mangled_name, fname); + mangle_map(mangled_name,True,True,SNUM(conn)); + mangled_name[12] = 0; + len = srvstr_push(outbuf, p+2, mangled_name, 24, STR_UPPER|STR_UNICODE); + SSVAL(p, 0, len); + } else { + SSVAL(p,0,0); + *(p+2) = 0; + } + p += 2 + 24; + memset(p, '\0', 10); /* 2 4 byte unknowns plus a zero reserved. */ + p += 10; + len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII); + SIVAL(q,0,len); + p += len; + len = PTR_DIFF(p, pdata); + len = (len + 3) & ~3; + SIVAL(pdata,0,len); + p = pdata + len; + break; + /* CIFS UNIX Extension. */ case SMB_FIND_FILE_UNIX: @@ -895,6 +957,8 @@ close_if_end = %d requires_resume_key = %d level = %d, max_data_bytes = %d\n", case SMB_FIND_FILE_FULL_DIRECTORY_INFO: case SMB_FIND_FILE_NAMES_INFO: case SMB_FIND_FILE_BOTH_DIRECTORY_INFO: + case SMB_FIND_FILE_LEVEL_261: + case SMB_FIND_FILE_LEVEL_262: break; case SMB_FIND_FILE_UNIX: if (!lp_unix_extensions()) @@ -910,8 +974,7 @@ close_if_end = %d requires_resume_key = %d level = %d, max_data_bytes = %d\n", unix_convert(directory,conn,0,&bad_path,&sbuf); if(!check_name(directory,conn)) { - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRbadpath)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath); } p = strrchr_m(directory,'/'); @@ -1365,7 +1428,7 @@ static int call_trans2qfsinfo(connection_struct *conn, char *inbuf, char *outbuf * the called hostname and the service name. */ SIVAL(pdata,0,str_checksum(lp_servicename(snum)) ^ (str_checksum(local_machine)<<16) ); - len = srvstr_push(outbuf, pdata+l2_vol_szVolLabel, vname, -1, 0); + len = srvstr_push(outbuf, pdata+l2_vol_szVolLabel, vname, -1, STR_NOALIGN); SCVAL(pdata,l2_vol_cch,len); data_len = l2_vol_szVolLabel + len; DEBUG(5,("call_trans2qfsinfo : time = %x, namelen = %d, name = %s\n", @@ -1716,14 +1779,22 @@ static int call_trans2setfsinfo(connection_struct *conn, * Utility function to set bad path error. ****************************************************************************/ -NTSTATUS set_bad_path_error(int err, BOOL bad_path) +int set_bad_path_error(int err, BOOL bad_path, char *outbuf, int def_class, uint32 def_code) { - if((err == ENOENT) && bad_path) { + DEBUG(10,("set_bad_path_error: err = %d bad_path = %d\n", + err, (int)bad_path )); + + if(err == ENOENT) { unix_ERR_class = ERRDOS; - unix_ERR_code = ERRbadpath; - return NT_STATUS_OBJECT_PATH_NOT_FOUND; + if (bad_path) { + unix_ERR_code = ERRbadpath; + return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND); + } else { + unix_ERR_code = ERRbadfile; + return ERROR_NT(NT_STATUS_OBJECT_NAME_NOT_FOUND); + } } - return NT_STATUS_OK; + return UNIXERROR(def_class,def_code); } /**************************************************************************** @@ -1778,8 +1849,7 @@ static int call_trans2qfilepathinfo(connection_struct *conn, unix_convert(fname,conn,0,&bad_path,&sbuf); if (!check_name(fname,conn)) { DEBUG(3,("call_trans2qfilepathinfo: fileinfo of %s failed for fake_file(%s)\n",fname,strerror(errno))); - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRbadpath)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath); } } else if(fsp && (fsp->is_directory || fsp->fd == -1)) { @@ -1792,21 +1862,18 @@ static int call_trans2qfilepathinfo(connection_struct *conn, unix_convert(fname,conn,0,&bad_path,&sbuf); if (!check_name(fname,conn)) { DEBUG(3,("call_trans2qfilepathinfo: fileinfo of %s failed (%s)\n",fname,strerror(errno))); - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRbadpath)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath); } if (INFO_LEVEL_IS_UNIX(info_level)) { /* Always do lstat for UNIX calls. */ if (SMB_VFS_LSTAT(conn,fname,&sbuf)) { DEBUG(3,("call_trans2qfilepathinfo: SMB_VFS_LSTAT of %s failed (%s)\n",fname,strerror(errno))); - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRbadpath)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath); } } else if (!VALID_STAT(sbuf) && SMB_VFS_STAT(conn,fname,&sbuf)) { DEBUG(3,("call_trans2qfilepathinfo: SMB_VFS_STAT of %s failed (%s)\n",fname,strerror(errno))); - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRbadpath)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath); } delete_pending = fsp->directory_delete_on_close; @@ -1821,9 +1888,7 @@ static int call_trans2qfilepathinfo(connection_struct *conn, DEBUG(3,("fstat of fnum %d failed (%s)\n", fsp->fnum, strerror(errno))); return(UNIXERROR(ERRDOS,ERRbadfid)); } - if((pos = SMB_VFS_LSEEK(fsp,fsp->fd,0,SEEK_CUR)) == -1) - return(UNIXERROR(ERRDOS,ERRnoaccess)); - + pos = fsp->position_information; delete_pending = fsp->delete_on_close; } } else { @@ -1842,29 +1907,26 @@ static int call_trans2qfilepathinfo(connection_struct *conn, unix_convert(fname,conn,0,&bad_path,&sbuf); if (!check_name(fname,conn)) { DEBUG(3,("call_trans2qfilepathinfo: fileinfo of %s failed (%s)\n",fname,strerror(errno))); - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRbadpath)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath); } if (INFO_LEVEL_IS_UNIX(info_level)) { /* Always do lstat for UNIX calls. */ if (SMB_VFS_LSTAT(conn,fname,&sbuf)) { DEBUG(3,("call_trans2qfilepathinfo: SMB_VFS_LSTAT of %s failed (%s)\n",fname,strerror(errno))); - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRbadpath)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath); } } else if (!VALID_STAT(sbuf) && SMB_VFS_STAT(conn,fname,&sbuf)) { DEBUG(3,("call_trans2qfilepathinfo: SMB_VFS_STAT of %s failed (%s)\n",fname,strerror(errno))); - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRbadpath)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath); } } if (INFO_LEVEL_IS_UNIX(info_level) && !lp_unix_extensions()) return ERROR_DOS(ERRDOS,ERRunknownlevel); - DEBUG(3,("call_trans2qfilepathinfo %s level=%d call=%d total_data=%d\n", - fname,info_level,tran_call,total_data)); + DEBUG(3,("call_trans2qfilepathinfo %s (fnum = %d) level=%d call=%d total_data=%d\n", + fname,fsp ? fsp->fnum : -1, info_level,tran_call,total_data)); p = strrchr_m(fname,'/'); if (!p) @@ -1873,6 +1935,9 @@ static int call_trans2qfilepathinfo(connection_struct *conn, base_name = p+1; mode = dos_mode(conn,fname,&sbuf); + if (!mode) + mode = FILE_ATTRIBUTE_NORMAL; + fullpathname = fname; file_size = get_file_size(sbuf); allocation_size = get_allocation_size(fsp,&sbuf); @@ -1985,7 +2050,10 @@ static int call_trans2qfilepathinfo(connection_struct *conn, data_size = 24; SOFF_T(pdata,0,allocation_size); SOFF_T(pdata,8,file_size); - SIVAL(pdata,16,sbuf.st_nlink); + if (delete_pending & sbuf.st_nlink) + SIVAL(pdata,16,sbuf.st_nlink - 1); + else + SIVAL(pdata,16,sbuf.st_nlink); SCVAL(pdata,20,0); SCVAL(pdata,21,(mode&aDIR)?1:0); break; @@ -2043,7 +2111,10 @@ static int call_trans2qfilepathinfo(connection_struct *conn, pdata += 40; SOFF_T(pdata,0,allocation_size); SOFF_T(pdata,8,file_size); - SIVAL(pdata,16,sbuf.st_nlink); + if (delete_pending && sbuf.st_nlink) + SIVAL(pdata,16,sbuf.st_nlink - 1); + else + SIVAL(pdata,16,sbuf.st_nlink); SCVAL(pdata,20,delete_pending); SCVAL(pdata,21,(mode&aDIR)?1:0); pdata += 24; @@ -2415,8 +2486,7 @@ static int call_trans2setfilepathinfo(connection_struct *conn, unix_convert(fname,conn,0,&bad_path,&sbuf); if (!check_name(fname,conn) || (!VALID_STAT(sbuf))) { DEBUG(3,("call_trans2setfilepathinfo: fileinfo of %s failed (%s)\n",fname,strerror(errno))); - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRbadpath)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath); } } else if (fsp && fsp->print_file) { /* @@ -2455,8 +2525,7 @@ static int call_trans2setfilepathinfo(connection_struct *conn, srvstr_pull(inbuf, fname, ¶ms[6], sizeof(fname), -1, STR_TERMINATE); unix_convert(fname,conn,0,&bad_path,&sbuf); if(!check_name(fname, conn)) { - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRbadpath)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRbadpath); } /* @@ -2465,8 +2534,7 @@ static int call_trans2setfilepathinfo(connection_struct *conn, if(!VALID_STAT(sbuf) && !INFO_LEVEL_IS_UNIX(info_level)) { DEBUG(3,("call_trans2setfilepathinfo: stat of %s failed (%s)\n", fname, strerror(errno))); - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRbadpath)); + return ERROR_NT(NT_STATUS_OBJECT_NAME_NOT_FOUND); } } @@ -2479,8 +2547,8 @@ static int call_trans2setfilepathinfo(connection_struct *conn, if (VALID_STAT(sbuf)) unixmode = sbuf.st_mode; - DEBUG(3,("call_trans2setfilepathinfo(%d) %s info_level=%d totdata=%d\n", - tran_call,fname,info_level,total_data)); + DEBUG(3,("call_trans2setfilepathinfo(%d) %s (fnum %d) info_level=%d totdata=%d\n", + tran_call,fname, fsp ? fsp->fnum : -1, info_level,total_data)); /* Realloc the parameter and data sizes */ params = Realloc(*pparams,2); @@ -2507,18 +2575,13 @@ static int call_trans2setfilepathinfo(connection_struct *conn, switch (info_level) { case SMB_INFO_STANDARD: { - if (total_data < l1_cbFile+4) + if (total_data < 12) return(ERROR_DOS(ERRDOS,ERRinvalidparam)); /* access time */ tvs.actime = make_unix_date2(pdata+l1_fdateLastAccess); - /* write time */ tvs.modtime = make_unix_date2(pdata+l1_fdateLastWrite); - - dosmode = SVAL(pdata,l1_attrFile); - size = IVAL(pdata,l1_cbFile); - break; } @@ -2677,14 +2740,17 @@ static int call_trans2setfilepathinfo(connection_struct *conn, case SMB_FILE_DISPOSITION_INFORMATION: case SMB_SET_FILE_DISPOSITION_INFO: /* Set delete on close for open file. */ { - BOOL delete_on_close = (CVAL(pdata,0) ? True : False); + BOOL delete_on_close; NTSTATUS status; if (total_data < 1) return(ERROR_DOS(ERRDOS,ERRinvalidparam)); + delete_on_close = (CVAL(pdata,0) ? True : False); + + /* Just ignore this set on a path. */ if (tran_call != TRANSACT2_SETFILEINFO) - return ERROR_DOS(ERRDOS,ERRunknownlevel); + break; if (fsp == NULL) return(UNIXERROR(ERRDOS,ERRbadfid)); @@ -2702,6 +2768,27 @@ static int call_trans2setfilepathinfo(connection_struct *conn, break; } + case SMB_FILE_POSITION_INFORMATION: + { + SMB_BIG_UINT position_information; + + if (total_data < 8) + return(ERROR_DOS(ERRDOS,ERRinvalidparam)); + + position_information = (SMB_BIG_UINT)IVAL(pdata,0); +#ifdef LARGE_SMB_OFF_T + position_information |= (((SMB_BIG_UINT)IVAL(pdata,4)) << 32); +#else /* LARGE_SMB_OFF_T */ + if (IVAL(pdata,4) != 0) /* more than 32 bits? */ + return ERROR_DOS(ERRDOS,ERRunknownlevel); +#endif /* LARGE_SMB_OFF_T */ + DEBUG(10,("call_trans2setfilepathinfo: Set file position information for file %s to %.0f\n", + fname, (double)position_information )); + if (fsp) + fsp->position_information = position_information; + break; + } + /* * CIFS UNIX extensions. */ @@ -2881,6 +2968,55 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n", return(-1); } + case SMB_FILE_RENAME_INFORMATION: + { + BOOL overwrite; + uint32 root_fid; + uint32 len; + pstring newname; + pstring base_name; + char *p; + NTSTATUS status; + + if (total_data < 12) + return(ERROR_DOS(ERRDOS,ERRinvalidparam)); + + overwrite = (CVAL(pdata,0) ? True : False); + root_fid = IVAL(pdata,4); + len = IVAL(pdata,8); + srvstr_pull(inbuf, newname, &pdata[12], sizeof(newname), len, 0); + + /* Check the new name has no '\' characters. */ + if (strchr_m(newname, '\\') || strchr_m(newname, '/')) + return ERROR_NT(NT_STATUS_NOT_SUPPORTED); + + RESOLVE_DFSPATH(newname, conn, inbuf, outbuf); + + /* Create the base directory. */ + pstrcpy(base_name, fname); + p = strrchr_m(base_name, '/'); + if (p) + *p = '\0'; + /* Append the new name. */ + pstrcat(base_name, "/"); + pstrcat(base_name, newname); + + if (fsp) { + DEBUG(10,("call_trans2setfilepathinfo: SMB_FILE_RENAME_INFORMATION (fnum %d) %s -> %s\n", + fsp->fnum, fsp->fsp_name, base_name )); + status = rename_internals_fsp(conn, fsp, base_name, overwrite); + } else { + DEBUG(10,("call_trans2setfilepathinfo: SMB_FILE_RENAME_INFORMATION %s -> %s\n", + fname, newname )); + status = rename_internals(conn, fname, base_name, overwrite); + } + if (!NT_STATUS_IS_OK(status)) + return ERROR_NT(status); + process_pending_change_notify_queue((time_t)0); + SSVAL(params,0,0); + send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0); + return(-1); + } default: return ERROR_DOS(ERRDOS,ERRunknownlevel); } @@ -2896,10 +3032,12 @@ size = %.0f, uid = %u, gid = %u, raw perms = 0%o\n", DEBUG(6,("modtime: %s ", ctime(&tvs.modtime))); DEBUG(6,("size: %.0f ", (double)size)); - if (S_ISDIR(sbuf.st_mode)) - dosmode |= aDIR; - else - dosmode &= ~aDIR; + if (dosmode) { + if (S_ISDIR(sbuf.st_mode)) + dosmode |= aDIR; + else + dosmode &= ~aDIR; + } DEBUG(6,("dosmode: %x\n" , dosmode)); @@ -3030,8 +3168,7 @@ static int call_trans2mkdir(connection_struct *conn, if(ret < 0) { DEBUG(5,("call_trans2mkdir error (%s)\n", strerror(errno))); - set_bad_path_error(errno, bad_path); - return(UNIXERROR(ERRDOS,ERRnoaccess)); + return set_bad_path_error(errno, bad_path, outbuf, ERRDOS,ERRnoaccess); } /* Realloc the parameter and data sizes */ diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c index 8d3e7cd9be..7979ffe854 100644 --- a/source3/smbd/uid.c +++ b/source3/smbd/uid.c @@ -370,7 +370,7 @@ BOOL unbecome_user(void) } /***************************************************************** - Convert the suplimentary SIDs returned in a netlogon into UNIX + Convert the supplementary SIDs returned in a netlogon into UNIX group gid_t's. Add to the total group array. *****************************************************************/ @@ -437,467 +437,4 @@ void add_supplementary_nt_login_groups(int *n_groups, gid_t **pp_groups, NT_USER *pptok = new_tok; } -/***************************************************************** - *THE CANONICAL* convert name to SID function. - Tries local lookup first - for local domains - then uses winbind. -*****************************************************************/ - -BOOL lookup_name(const char *domain, const char *name, DOM_SID *psid, enum SID_NAME_USE *name_type) -{ - fstring sid; - BOOL local_lookup = False; - - *name_type = SID_NAME_UNKNOWN; - - /* If we are looking up a domain user, make sure it is - for the local machine only */ - - if (strequal(global_myname(), domain)) { - local_lookup = True; - } else if (lp_server_role() == ROLE_DOMAIN_PDC || - lp_server_role() == ROLE_DOMAIN_BDC) { - if (strequal(domain, lp_workgroup())) { - local_lookup = True; - } - } - - if (local_lookup) { - if (local_lookup_name(name, psid, name_type)) { - DEBUG(10, - ("lookup_name: (local) [%s]\\[%s] -> SID %s (type %s: %u)\n", - domain, name, sid_to_string(sid,psid), - sid_type_lookup(*name_type), (unsigned int)*name_type)); - return True; - } - } else { - /* Remote */ - if (winbind_lookup_name(domain, name, psid, name_type)) { - - DEBUG(10,("lookup_name (winbindd): [%s]\\[%s] -> SID %s (type %u)\n", - domain, name, sid_to_string(sid, psid), - (unsigned int)*name_type)); - return True; - } - } - - DEBUG(10, ("lookup_name: %s lookup for [%s]\\[%s] failed\n", - local_lookup ? "local" : "winbind", domain, name)); - - return False; -} - -/***************************************************************** - *THE CANONICAL* convert SID to name function. - Tries local lookup first - for local sids, then tries winbind. -*****************************************************************/ - -BOOL lookup_sid(DOM_SID *sid, fstring dom_name, fstring name, enum SID_NAME_USE *name_type) -{ - if (!name_type) - return False; - - *name_type = SID_NAME_UNKNOWN; - - /* Check if this is our own sid. This should perhaps be done by - winbind? For the moment handle it here. */ - - if (sid->num_auths == 5) { - DOM_SID tmp_sid; - uint32 rid; - - sid_copy(&tmp_sid, sid); - sid_split_rid(&tmp_sid, &rid); - - if (sid_equal(get_global_sam_sid(), &tmp_sid)) { - - return map_domain_sid_to_name(&tmp_sid, dom_name) && - local_lookup_sid(sid, name, name_type); - } - } - - if (!winbind_lookup_sid(sid, dom_name, name, name_type)) { - fstring sid_str; - DOM_SID tmp_sid; - uint32 rid; - - DEBUG(10,("lookup_sid: winbind lookup for SID %s failed - trying local.\n", sid_to_string(sid_str, sid) )); - - sid_copy(&tmp_sid, sid); - sid_split_rid(&tmp_sid, &rid); - return map_domain_sid_to_name(&tmp_sid, dom_name) && - lookup_known_rid(&tmp_sid, rid, name, name_type); - } - return True; -} - - -/***************************************************************** - Id mapping cache. This is to avoid Winbind mappings already - seen by smbd to be queried too frequently, keeping winbindd - busy, and blocking smbd while winbindd is busy with other - stuff. Written by Michael Steffens , - modified to use linked lists by jra. -*****************************************************************/ - -#define MAX_UID_SID_CACHE_SIZE 100 -#define TURNOVER_UID_SID_CACHE_SIZE 10 -#define MAX_GID_SID_CACHE_SIZE 100 -#define TURNOVER_GID_SID_CACHE_SIZE 10 - -static size_t n_uid_sid_cache = 0; -static size_t n_gid_sid_cache = 0; - -static struct uid_sid_cache { - struct uid_sid_cache *next, *prev; - uid_t uid; - DOM_SID sid; - enum SID_NAME_USE sidtype; -} *uid_sid_cache_head; - -static struct gid_sid_cache { - struct gid_sid_cache *next, *prev; - gid_t gid; - DOM_SID sid; - enum SID_NAME_USE sidtype; -} *gid_sid_cache_head; - -/***************************************************************** - Find a SID given a uid. -*****************************************************************/ - -static BOOL fetch_sid_from_uid_cache(DOM_SID *psid, uid_t uid) -{ - struct uid_sid_cache *pc; - - for (pc = uid_sid_cache_head; pc; pc = pc->next) { - if (pc->uid == uid) { - fstring sid; - *psid = pc->sid; - DEBUG(3,("fetch sid from uid cache %u -> %s\n", - (unsigned int)uid, sid_to_string(sid, psid))); - DLIST_PROMOTE(uid_sid_cache_head, pc); - return True; - } - } - return False; -} - -/***************************************************************** - Find a uid given a SID. -*****************************************************************/ - -static BOOL fetch_uid_from_cache( uid_t *puid, const DOM_SID *psid ) -{ - struct uid_sid_cache *pc; - - for (pc = uid_sid_cache_head; pc; pc = pc->next) { - if (sid_compare(&pc->sid, psid) == 0) { - fstring sid; - *puid = pc->uid; - DEBUG(3,("fetch uid from cache %u -> %s\n", - (unsigned int)*puid, sid_to_string(sid, psid))); - DLIST_PROMOTE(uid_sid_cache_head, pc); - return True; - } - } - return False; -} - -/***************************************************************** - Store uid to SID mapping in cache. -*****************************************************************/ - -static void store_uid_sid_cache(const DOM_SID *psid, uid_t uid) -{ - struct uid_sid_cache *pc; - - if (n_uid_sid_cache >= MAX_UID_SID_CACHE_SIZE && n_uid_sid_cache > TURNOVER_UID_SID_CACHE_SIZE) { - /* Delete the last TURNOVER_UID_SID_CACHE_SIZE entries. */ - struct uid_sid_cache *pc_next; - size_t i; - - for (i = 0, pc = uid_sid_cache_head; i < (n_uid_sid_cache - TURNOVER_UID_SID_CACHE_SIZE); i++, pc = pc->next) - ; - for(; pc; pc = pc_next) { - pc_next = pc->next; - DLIST_REMOVE(uid_sid_cache_head,pc); - SAFE_FREE(pc); - n_uid_sid_cache--; - } - } - - pc = (struct uid_sid_cache *)malloc(sizeof(struct uid_sid_cache)); - if (!pc) - return; - pc->uid = uid; - sid_copy(&pc->sid, psid); - DLIST_ADD(uid_sid_cache_head, pc); - n_uid_sid_cache++; -} - -/***************************************************************** - Find a SID given a gid. -*****************************************************************/ - -static BOOL fetch_sid_from_gid_cache(DOM_SID *psid, gid_t gid) -{ - struct gid_sid_cache *pc; - - for (pc = gid_sid_cache_head; pc; pc = pc->next) { - if (pc->gid == gid) { - fstring sid; - *psid = pc->sid; - DEBUG(3,("fetch sid from gid cache %u -> %s\n", - (unsigned int)gid, sid_to_string(sid, psid))); - DLIST_PROMOTE(gid_sid_cache_head, pc); - return True; - } - } - return False; -} - -/***************************************************************** - Find a gid given a SID. -*****************************************************************/ - -static BOOL fetch_gid_from_cache(gid_t *pgid, const DOM_SID *psid) -{ - struct gid_sid_cache *pc; - - for (pc = gid_sid_cache_head; pc; pc = pc->next) { - if (sid_compare(&pc->sid, psid) == 0) { - fstring sid; - *pgid = pc->gid; - DEBUG(3,("fetch uid from cache %u -> %s\n", - (unsigned int)*pgid, sid_to_string(sid, psid))); - DLIST_PROMOTE(gid_sid_cache_head, pc); - return True; - } - } - return False; -} - -/***************************************************************** - Store gid to SID mapping in cache. -*****************************************************************/ -static void store_gid_sid_cache(const DOM_SID *psid, gid_t gid) -{ - struct gid_sid_cache *pc; - - if (n_gid_sid_cache >= MAX_GID_SID_CACHE_SIZE && n_gid_sid_cache > TURNOVER_GID_SID_CACHE_SIZE) { - /* Delete the last TURNOVER_GID_SID_CACHE_SIZE entries. */ - struct gid_sid_cache *pc_next; - size_t i; - - for (i = 0, pc = gid_sid_cache_head; i < (n_gid_sid_cache - TURNOVER_GID_SID_CACHE_SIZE); i++, pc = pc->next) - ; - for(; pc; pc = pc_next) { - pc_next = pc->next; - DLIST_REMOVE(gid_sid_cache_head,pc); - SAFE_FREE(pc); - n_gid_sid_cache--; - } - } - - pc = (struct gid_sid_cache *)malloc(sizeof(struct gid_sid_cache)); - if (!pc) - return; - pc->gid = gid; - sid_copy(&pc->sid, psid); - DLIST_ADD(gid_sid_cache_head, pc); - n_gid_sid_cache++; -} - -/***************************************************************** - *THE CANONICAL* convert uid_t to SID function. -*****************************************************************/ - -NTSTATUS uid_to_sid(DOM_SID *psid, uid_t uid) -{ - uid_t low, high; - fstring sid; - - ZERO_STRUCTP(psid); - - if (fetch_sid_from_uid_cache(psid, uid)) - return ( psid ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ); - - if (lp_idmap_uid(&low, &high) && uid >= low && uid <= high) { - if (winbind_uid_to_sid(psid, uid)) { - - DEBUG(10,("uid_to_sid: winbindd %u -> %s\n", - (unsigned int)uid, sid_to_string(sid, psid))); - - if (psid) - store_uid_sid_cache(psid, uid); - return ( psid ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ); - } - } - - if (!local_uid_to_sid(psid, uid)) { - DEBUG(10,("uid_to_sid: local %u failed to map to sid\n", (unsigned int)uid )); - return NT_STATUS_UNSUCCESSFUL; - } - - DEBUG(10,("uid_to_sid: local %u -> %s\n", (unsigned int)uid, sid_to_string(sid, psid))); - - store_uid_sid_cache(psid, uid); - return NT_STATUS_OK; -} - -/***************************************************************** - *THE CANONICAL* convert gid_t to SID function. -*****************************************************************/ - -NTSTATUS gid_to_sid(DOM_SID *psid, gid_t gid) -{ - gid_t low, high; - fstring sid; - - ZERO_STRUCTP(psid); - - if (fetch_sid_from_gid_cache(psid, gid)) - return ( psid ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ); - - if (lp_idmap_gid(&low, &high) && gid >= low && gid <= high) { - if (winbind_gid_to_sid(psid, gid)) { - - DEBUG(10,("gid_to_sid: winbindd %u -> %s\n", - (unsigned int)gid, sid_to_string(sid, psid))); - - if (psid) - store_gid_sid_cache(psid, gid); - return ( psid ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL ); - } - } - - if (!local_gid_to_sid(psid, gid)) { - DEBUG(10,("gid_to_sid: local %u failed to map to sid\n", (unsigned int)gid )); - return NT_STATUS_UNSUCCESSFUL; - } - - DEBUG(10,("gid_to_sid: local %u -> %s\n", (unsigned int)gid, sid_to_string(sid, psid))); - - store_gid_sid_cache(psid, gid); - return NT_STATUS_OK; -} - -/***************************************************************** - *THE CANONICAL* convert SID to uid function. -*****************************************************************/ - -NTSTATUS sid_to_uid(const DOM_SID *psid, uid_t *puid) -{ - fstring dom_name, name, sid_str; - enum SID_NAME_USE name_type; - - if (fetch_uid_from_cache(puid, psid)) - return NT_STATUS_OK; - - /* if this is our SID then go straight to a local lookup */ - - if ( sid_compare_domain(get_global_sam_sid(), psid) == 0 ) { - DEBUG(10,("sid_to_uid: my domain (%s) - trying local.\n", - sid_string_static(psid) )); - - if ( local_sid_to_uid(puid, psid, &name_type) ) - goto success; - - DEBUG(10,("sid_to_uid: local lookup failed\n")); - - return NT_STATUS_UNSUCCESSFUL; - } - - /* If it is not our local domain, only hope is winbindd */ - - if ( !winbind_lookup_sid(psid, dom_name, name, &name_type) ) { - DEBUG(10,("sid_to_uid: winbind lookup for non-local sid %s failed\n", - sid_string_static(psid) )); - - return NT_STATUS_UNSUCCESSFUL; - } - - /* If winbindd does know the SID, ensure this is a user */ - - if (name_type != SID_NAME_USER) { - DEBUG(10,("sid_to_uid: winbind lookup succeeded but SID is not a user (%u)\n", - (unsigned int)name_type )); - return NT_STATUS_INVALID_PARAMETER; - } - - /* get the uid. Has to work or else we are dead in the water */ - - if ( !winbind_sid_to_uid(puid, psid) ) { - DEBUG(10,("sid_to_uid: winbind failed to allocate a new uid for sid %s\n", - sid_to_string(sid_str, psid) )); - return NT_STATUS_UNSUCCESSFUL; - } - -success: - DEBUG(10,("sid_to_uid: %s -> %u\n", sid_to_string(sid_str, psid), - (unsigned int)*puid )); - - store_uid_sid_cache(psid, *puid); - - return NT_STATUS_OK; -} -/***************************************************************** - *THE CANONICAL* convert SID to gid function. - Group mapping is used for gids that maps to Wellknown SIDs -*****************************************************************/ - -NTSTATUS sid_to_gid(const DOM_SID *psid, gid_t *pgid) -{ - fstring dom_name, name, sid_str; - enum SID_NAME_USE name_type; - - if (fetch_gid_from_cache(pgid, psid)) - return NT_STATUS_OK; - - /* - * First we must look up the name and decide if this is a group sid. - * Group mapping can deal with foreign SIDs - */ - - if (!winbind_lookup_sid(psid, dom_name, name, &name_type)) { - DEBUG(10,("sid_to_gid: winbind lookup for sid %s failed - trying local.\n", - sid_to_string(sid_str, psid) )); - - if ( local_sid_to_gid(pgid, psid, &name_type) ) - goto success; - - DEBUG(10,("sid_to_gid: no one knows this SID\n")); - - return NT_STATUS_UNSUCCESSFUL; - } - - /* winbindd knows it; Ensure this is a group sid */ - - if ((name_type != SID_NAME_DOM_GRP) && (name_type != SID_NAME_ALIAS) && (name_type != SID_NAME_WKN_GRP)) { - DEBUG(10,("sid_to_gid: winbind lookup succeeded but SID is not a known group (%u)\n", - (unsigned int)name_type )); - - /* winbindd is running and knows about this SID. Just the wrong type. - Don't fallback to a local lookup here */ - - return NT_STATUS_INVALID_PARAMETER; - } - - /* winbindd knows it and it is a type of group; sid_to_gid must succeed - or we are dead in the water */ - - if ( !winbind_sid_to_gid(pgid, psid) ) { - DEBUG(10,("sid_to_uid: winbind failed to allocate a new gid for sid %s\n", - sid_to_string(sid_str, psid) )); - return NT_STATUS_UNSUCCESSFUL; - } - -success: - DEBUG(10,("sid_to_gid: %s -> %u\n", sid_to_string(sid_str, psid), - (unsigned int)*pgid )); - - store_gid_sid_cache(psid, *pgid); - - return NT_STATUS_OK; -} diff --git a/source3/smbd/utmp.c b/source3/smbd/utmp.c index 6ff2f586ba..a521d0113d 100644 --- a/source3/smbd/utmp.c +++ b/source3/smbd/utmp.c @@ -217,13 +217,13 @@ static void uw_pathname(pstring fname, const char *uw_name, const char *uw_defau /* For w-files, first look for explicit "wtmp dir" */ if (uw_name[0] == 'w') { pstrcpy(dirname,lp_wtmpdir()); - trim_string(dirname,"","/"); + trim_char(dirname,'\0','/'); } /* For u-files and non-explicit w-dir, look for "utmp dir" */ if (dirname == 0 || strlen(dirname) == 0) { pstrcpy(dirname,lp_utmpdir()); - trim_string(dirname,"","/"); + trim_char(dirname,'\0','/'); } /* If explicit directory above, use it */ @@ -283,8 +283,12 @@ static void updwtmp_my(pstring wname, struct utmp *u, BOOL claim) * man page appears not to specify (hints non-NULL) * A correspondent suggest at least ut_name should be NULL */ +#if defined(HAVE_UT_UT_NAME) memset((char *)&u->ut_name, '\0', sizeof(u->ut_name)); +#endif +#if defined(HAVE_UT_UT_HOST) memset((char *)&u->ut_host, '\0', sizeof(u->ut_host)); +#endif } /* Stolen from logwtmp function in libutil. * May be more locking/blocking is needed? @@ -406,7 +410,9 @@ static void sys_utmp_update(struct utmp *u, const char *hostname, BOOL claim) else ux.ut_syslen = 0; #endif +#if defined(HAVE_UT_UT_HOST) utmp_strcpy(ux.ut_host, hostname, sizeof(ux.ut_host)); +#endif uw_pathname(uname, "utmpx", ux_pathname); uw_pathname(wname, "wtmpx", wx_pathname); diff --git a/source3/smbd/vfs-wrap.c b/source3/smbd/vfs-wrap.c index 8d44a1a0fa..a76a7a6abd 100644 --- a/source3/smbd/vfs-wrap.c +++ b/source3/smbd/vfs-wrap.c @@ -49,6 +49,42 @@ SMB_BIG_UINT vfswrap_disk_free(vfs_handle_struct *handle, connection_struct *con result = sys_disk_free(path, small_query, bsize, dfree, dsize); return result; } + +int vfswrap_get_quota(struct vfs_handle_struct *handle, struct connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *qt) +{ +#ifdef HAVE_SYS_QUOTAS + int result; + + START_PROFILE(syscall_get_quota); + result = sys_get_quota(conn->connectpath, qtype, id, qt); + END_PROFILE(syscall_get_quota); + return result; +#else + errno = ENOSYS; + return -1; +#endif +} + +int vfswrap_set_quota(struct vfs_handle_struct *handle, struct connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *qt) +{ +#ifdef HAVE_SYS_QUOTAS + int result; + + START_PROFILE(syscall_set_quota); + result = sys_set_quota(conn->connectpath, qtype, id, qt); + END_PROFILE(syscall_set_quota); + return result; +#else + errno = ENOSYS; + return -1; +#endif +} + +int vfswrap_get_shadow_copy_data(struct vfs_handle_struct *handle, struct files_struct *fsp, SHADOW_COPY_DATA *shadow_copy_data, BOOL labels) +{ + errno = ENOSYS; + return -1; /* Not implemented. */ +} /* Directory operations */ @@ -756,36 +792,6 @@ int vfswrap_sys_acl_free_qualifier(vfs_handle_struct *handle, connection_struct return sys_acl_free_qualifier(qualifier, tagtype); } -int vfswrap_get_quota(struct vfs_handle_struct *handle, struct connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *qt) -{ -#ifdef HAVE_SYS_QUOTAS - int result; - - START_PROFILE(syscall_get_quota); - result = sys_get_quota(conn->connectpath, qtype, id, qt); - END_PROFILE(syscall_get_quota); - return result; -#else - errno = ENOSYS; - return -1; -#endif -} - -int vfswrap_set_quota(struct vfs_handle_struct *handle, struct connection_struct *conn, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *qt) -{ -#ifdef HAVE_SYS_QUOTAS - int result; - - START_PROFILE(syscall_set_quota); - result = sys_set_quota(conn->connectpath, qtype, id, qt); - END_PROFILE(syscall_set_quota); - return result; -#else - errno = ENOSYS; - return -1; -#endif -} - /**************************************************************** Extended attribute operations. *****************************************************************/ diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c index 5f3abe7efe..753db4cece 100644 --- a/source3/smbd/vfs.c +++ b/source3/smbd/vfs.c @@ -56,6 +56,7 @@ static struct vfs_ops default_vfs = { vfswrap_disk_free, vfswrap_get_quota, vfswrap_set_quota, + vfswrap_get_shadow_copy_data, /* Directory operations */ @@ -140,7 +141,6 @@ static struct vfs_ops default_vfs = { vfswrap_setxattr, vfswrap_lsetxattr, vfswrap_fsetxattr - } }; @@ -233,10 +233,10 @@ BOOL vfs_init_custom(connection_struct *conn, const char *vfs_object) if (p) { *p = 0; module_param = p+1; - trim_string(module_param, " ", " "); + trim_char(module_param, ' ', ' '); } - trim_string(module_name, " ", " "); + trim_char(module_name, ' ', ' '); /* First, try to load the module with the new module system */ if((entry = vfs_find_backend_entry(module_name)) || diff --git a/source3/tdb/tdb.c b/source3/tdb/tdb.c index 34681ea78f..f5809ef63a 100644 --- a/source3/tdb/tdb.c +++ b/source3/tdb/tdb.c @@ -1015,12 +1015,11 @@ static int tdb_keylocked(TDB_CONTEXT *tdb, u32 hash) } /* As tdb_find, but if you succeed, keep the lock */ -static tdb_off tdb_find_lock(TDB_CONTEXT *tdb, TDB_DATA key, int locktype, +static tdb_off tdb_find_lock_hash(TDB_CONTEXT *tdb, TDB_DATA key, u32 hash, int locktype, struct list_struct *rec) { - u32 hash, rec_ptr; + u32 rec_ptr; - hash = tdb_hash(&key); if (!tdb_keylocked(tdb, hash)) return 0; if (tdb_lock(tdb, BUCKET(hash), locktype) == -1) @@ -1061,13 +1060,13 @@ const char *tdb_errorstr(TDB_CONTEXT *tdb) on failure return -1. */ -static int tdb_update(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA dbuf) +static int tdb_update_hash(TDB_CONTEXT *tdb, TDB_DATA key, u32 hash, TDB_DATA dbuf) { struct list_struct rec; tdb_off rec_ptr; /* find entry */ - if (!(rec_ptr = tdb_find(tdb, key, tdb_hash(&key), &rec))) + if (!(rec_ptr = tdb_find(tdb, key, hash, &rec))) return -1; /* must be long enough key, data and tailer */ @@ -1101,9 +1100,11 @@ TDB_DATA tdb_fetch(TDB_CONTEXT *tdb, TDB_DATA key) tdb_off rec_ptr; struct list_struct rec; TDB_DATA ret; + u32 hash; /* find which hash bucket it is in */ - if (!(rec_ptr = tdb_find_lock(tdb,key,F_RDLCK,&rec))) + hash = tdb_hash(&key); + if (!(rec_ptr = tdb_find_lock_hash(tdb,key,hash,F_RDLCK,&rec))) return tdb_null; if (rec.data_len) @@ -1122,16 +1123,22 @@ TDB_DATA tdb_fetch(TDB_CONTEXT *tdb, TDB_DATA key) this doesn't match the conventions in the rest of this module, but is compatible with gdbm */ -int tdb_exists(TDB_CONTEXT *tdb, TDB_DATA key) +static int tdb_exists_hash(TDB_CONTEXT *tdb, TDB_DATA key, u32 hash) { struct list_struct rec; - if (tdb_find_lock(tdb, key, F_RDLCK, &rec) == 0) + if (tdb_find_lock_hash(tdb, key, hash, F_RDLCK, &rec) == 0) return 0; tdb_unlock(tdb, BUCKET(rec.full_hash), F_RDLCK); return 1; } +int tdb_exists(TDB_CONTEXT *tdb, TDB_DATA key) +{ + u32 hash = tdb_hash(&key); + return tdb_exists_hash(tdb, key, hash); +} + /* record lock stops delete underneath */ static int lock_record(TDB_CONTEXT *tdb, tdb_off off) { @@ -1388,7 +1395,7 @@ TDB_DATA tdb_nextkey(TDB_CONTEXT *tdb, TDB_DATA oldkey) if (!tdb->travlocks.off) { /* No previous element: do normal find, and lock record */ - tdb->travlocks.off = tdb_find_lock(tdb, oldkey, F_WRLCK, &rec); + tdb->travlocks.off = tdb_find_lock_hash(tdb, oldkey, tdb_hash(&oldkey), F_WRLCK, &rec); if (!tdb->travlocks.off) return tdb_null; tdb->travlocks.hash = BUCKET(rec.full_hash); @@ -1416,13 +1423,13 @@ TDB_DATA tdb_nextkey(TDB_CONTEXT *tdb, TDB_DATA oldkey) } /* delete an entry in the database given a key */ -int tdb_delete(TDB_CONTEXT *tdb, TDB_DATA key) +static int tdb_delete_hash(TDB_CONTEXT *tdb, TDB_DATA key, u32 hash) { tdb_off rec_ptr; struct list_struct rec; int ret; - if (!(rec_ptr = tdb_find_lock(tdb, key, F_WRLCK, &rec))) + if (!(rec_ptr = tdb_find_lock_hash(tdb, key, hash, F_WRLCK, &rec))) return -1; ret = do_delete(tdb, rec_ptr, &rec); if (tdb_unlock(tdb, BUCKET(rec.full_hash), F_WRLCK) != 0) @@ -1430,6 +1437,12 @@ int tdb_delete(TDB_CONTEXT *tdb, TDB_DATA key) return ret; } +int tdb_delete(TDB_CONTEXT *tdb, TDB_DATA key) +{ + u32 hash = tdb_hash(&key); + return tdb_delete_hash(tdb, key, hash); +} + /* store an element in the database, replacing any existing element with the same key @@ -1452,13 +1465,13 @@ int tdb_store(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA dbuf, int flag) /* check for it existing, on insert. */ if (flag == TDB_INSERT) { - if (tdb_exists(tdb, key)) { + if (tdb_exists_hash(tdb, key, hash)) { tdb->ecode = TDB_ERR_EXISTS; goto fail; } } else { /* first try in-place update, on modify or replace. */ - if (tdb_update(tdb, key, dbuf) == 0) + if (tdb_update_hash(tdb, key, hash, dbuf) == 0) goto out; if (flag == TDB_MODIFY && tdb->ecode == TDB_ERR_NOEXIST) goto fail; @@ -1470,7 +1483,7 @@ int tdb_store(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA dbuf, int flag) care. Doing this first reduces fragmentation, and avoids coalescing with `allocated' block before it's updated. */ if (flag != TDB_INSERT) - tdb_delete(tdb, key); + tdb_delete_hash(tdb, key, hash); /* Copy key+value *before* allocating free space in case malloc fails and we are left with a dead spot in the tdb. */ @@ -1519,13 +1532,13 @@ fail: is <= the old data size and the key exists. on failure return -1. Record must be locked before calling. */ -static int tdb_append_inplace(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA new_dbuf) +static int tdb_append_inplace(TDB_CONTEXT *tdb, TDB_DATA key, u32 hash, TDB_DATA new_dbuf) { struct list_struct rec; tdb_off rec_ptr; /* find entry */ - if (!(rec_ptr = tdb_find(tdb, key, tdb_hash(&key), &rec))) + if (!(rec_ptr = tdb_find(tdb, key, hash, &rec))) return -1; /* Append of 0 is always ok. */ @@ -1567,7 +1580,7 @@ int tdb_append(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA new_dbuf) return -1; /* first try in-place. */ - if (tdb_append_inplace(tdb, key, new_dbuf) == 0) + if (tdb_append_inplace(tdb, key, hash, new_dbuf) == 0) goto out; /* reset the error code potentially set by the tdb_append_inplace() */ @@ -1610,7 +1623,7 @@ int tdb_append(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA new_dbuf) care. Doing this first reduces fragmentation, and avoids coalescing with `allocated' block before it's updated. */ - tdb_delete(tdb, key); + tdb_delete_hash(tdb, key, hash); if (!(rec_ptr = tdb_allocate(tdb, key.dsize + new_data_size, &rec))) goto fail; diff --git a/source3/torture/cmd_vfs.c b/source3/torture/cmd_vfs.c index d91dbf50e0..8317a57a20 100644 --- a/source3/torture/cmd_vfs.c +++ b/source3/torture/cmd_vfs.c @@ -490,8 +490,8 @@ static NTSTATUS cmd_stat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, c int ret; const char *user; const char *group; - struct passwd *pwd; - struct group *grp; + struct passwd *pwd = NULL; + struct group *grp = NULL; SMB_STRUCT_STAT st; if (argc != 2) { @@ -533,6 +533,7 @@ static NTSTATUS cmd_stat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, c printf(" Access: %s", ctime(&(st.st_atime))); printf(" Modify: %s", ctime(&(st.st_mtime))); printf(" Change: %s", ctime(&(st.st_ctime))); + SAFE_FREE(pwd); SAFE_FREE(grp); return NT_STATUS_OK; @@ -544,8 +545,8 @@ static NTSTATUS cmd_fstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, int fd; const char *user; const char *group; - struct passwd *pwd; - struct group *grp; + struct passwd *pwd = NULL; + struct group *grp = NULL; SMB_STRUCT_STAT st; if (argc != 2) { @@ -596,6 +597,7 @@ static NTSTATUS cmd_fstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, printf(" Access: %s", ctime(&(st.st_atime))); printf(" Modify: %s", ctime(&(st.st_mtime))); printf(" Change: %s", ctime(&(st.st_ctime))); + SAFE_FREE(pwd); SAFE_FREE(grp); return NT_STATUS_OK; @@ -606,8 +608,8 @@ static NTSTATUS cmd_lstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, { const char *user; const char *group; - struct passwd *pwd; - struct group *grp; + struct passwd *pwd = NULL; + struct group *grp = NULL; SMB_STRUCT_STAT st; if (argc != 2) { @@ -647,6 +649,7 @@ static NTSTATUS cmd_lstat(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int argc, printf(" Access: %s", ctime(&(st.st_atime))); printf(" Modify: %s", ctime(&(st.st_mtime))); printf(" Change: %s", ctime(&(st.st_ctime))); + SAFE_FREE(pwd); SAFE_FREE(grp); return NT_STATUS_OK; diff --git a/source3/torture/masktest.c b/source3/torture/masktest.c index fa901e3d63..8c44f35f95 100644 --- a/source3/torture/masktest.c +++ b/source3/torture/masktest.c @@ -140,7 +140,7 @@ static BOOL reg_match_one(struct cli_state *cli, const char *pattern, const char if (strcmp(file,"..") == 0) file = "."; - return ms_fnmatch(pattern, file, cli->protocol)==0; + return ms_fnmatch(pattern, file, cli->protocol, False /* not case sensitive */)==0; } static char *reg_test(struct cli_state *cli, char *pattern, char *long_name, char *short_name) diff --git a/source3/torture/rpctorture.c b/source3/torture/rpctorture.c index 8dfaebd64f..d95c0cee0f 100644 --- a/source3/torture/rpctorture.c +++ b/source3/torture/rpctorture.c @@ -193,7 +193,7 @@ static void usage(char *pname) fprintf(out_hnd, "Usage: %s service [-d debuglevel] [-l log] ", pname); - fprintf(out_hnd, "\nVersion %s\n",VERSION); + fprintf(out_hnd, "\nVersion %s\n",SAMBA_VERSION_STRING); fprintf(out_hnd, "\t-d debuglevel set the debuglevel\n"); fprintf(out_hnd, "\t-l log basename. Basename for log/debug files\n"); fprintf(out_hnd, "\t-n netbios name. Use this name as my netbios name\n"); @@ -489,7 +489,7 @@ enum client_action strupper_m(global_myname); fstrcpy(cli_info.myhostname, global_myname); - DEBUG(3,("%s client started (version %s)\n",timestring(False),VERSION)); + DEBUG(3,("%s client started (version %s)\n",timestring(False),SAMBA_VERSION_STRING)); if (*smb_cli->domain == 0) { diff --git a/source3/torture/smbiconv.c b/source3/torture/smbiconv.c index 3524136fb1..1dd168b0bb 100644 --- a/source3/torture/smbiconv.c +++ b/source3/torture/smbiconv.c @@ -24,7 +24,7 @@ #include "includes.h" static int -process_block (smb_iconv_t cd, char *addr, size_t len, FILE *output) +process_block (smb_iconv_t cd, const char *addr, size_t len, FILE *output) { #define OUTBUF_SIZE 32768 const char *start = addr; @@ -37,7 +37,7 @@ process_block (smb_iconv_t cd, char *addr, size_t len, FILE *output) { outptr = outbuf; outlen = OUTBUF_SIZE; - n = smb_iconv (cd, &addr, &len, &outptr, &outlen); + n = smb_iconv (cd, &addr, &len, &outptr, &outlen); if (outptr != outbuf) { @@ -171,7 +171,7 @@ int main(int argc, char *argv[]) char *from = ""; char *to = ""; char *output = NULL; - char *preload = NULL; + const char *preload_modules[] = {NULL, NULL}; FILE *out = stdout; int fd; smb_iconv_t cd; @@ -184,7 +184,7 @@ int main(int argc, char *argv[]) { "from-code", 'f', POPT_ARG_STRING, &from, 0, "Encoding of original text" }, { "to-code", 't', POPT_ARG_STRING, &to, 0, "Encoding for output" }, { "output", 'o', POPT_ARG_STRING, &output, 0, "Write output to this file" }, - { "preload-modules", 'p', POPT_ARG_STRING, &preload, 0, "Modules to load" }, + { "preload-modules", 'p', POPT_ARG_STRING, &preload_modules[0], 0, "Modules to load" }, POPT_COMMON_SAMBA POPT_TABLEEND }; @@ -202,12 +202,12 @@ int main(int argc, char *argv[]) facilities. See lib/debug.c */ setup_logging("smbiconv", True); - if(preload)smb_load_modules(str_list_make(preload, NULL)); + if (preload_modules[0]) smb_load_modules(preload_modules); if(output) { - output = fopen(output, "w"); + out = fopen(output, "w"); - if(!output) { + if(!out) { DEBUG(0, ("Can't open output file '%s': %s, exiting...\n", output, strerror(errno))); return 1; } @@ -231,7 +231,7 @@ int main(int argc, char *argv[]) } /* Loop thru all arguments */ - process_fd(cd, fd, stdout); + process_fd(cd, fd, out); close(fd); } diff --git a/source3/utils/log2pcaphex.c b/source3/utils/log2pcaphex.c new file mode 100644 index 0000000000..4804b99338 --- /dev/null +++ b/source3/utils/log2pcaphex.c @@ -0,0 +1,294 @@ +/* + Unix SMB/CIFS implementation. + Utility to extract pcap files from samba (log level 10) log files + + Copyright (C) Jelmer Vernooij 2003 + Thanks to Tim Potter for the genial idea + + Portions (from capconvert.c) (C) Andrew Tridgell 1997 + Portions (from text2pcap.c) (C) Ashok Narayanan 2001 + + Example use with -h parameter: + log2pcaphex < samba-log-file | text2pcap -T 139,139 - foo.pcap + + TODO: Have correct IP and TCP checksums. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" +#include + +int quiet = 0; +int hexformat = 0; + +#define itoa(a) ((a) < 0xa?'0'+(a):'A' + (a-0xa)) + +#include +#include +#include +#include +#include + +#define TCPDUMP_MAGIC 0xa1b2c3d4 + +/* tcpdump file format */ +struct tcpdump_file_header { + uint32 magic; + uint16 major; + uint16 minor; + int32 zone; + uint32 sigfigs; + uint32 snaplen; + uint32 linktype; +}; + +struct tcpdump_packet { + struct timeval ts; + uint32 caplen; + uint32 len; +}; + +typedef struct { + uint8 ver_hdrlen; + uint8 dscp; + uint16 packet_length; + uint16 identification; + uint8 flags; + uint8 fragment; + uint8 ttl; + uint8 protocol; + uint16 hdr_checksum; + uint32 src_addr; + uint32 dest_addr; +} hdr_ip_t; + +static hdr_ip_t HDR_IP = {0x45, 0, 0, 0x3412, 0, 0, 0xff, 6, 0, 0x01010101, 0x02020202}; + +typedef struct { + uint16 source_port; + uint16 dest_port; + uint32 seq_num; + uint32 ack_num; + uint8 hdr_length; + uint8 flags; + uint16 window; + uint16 checksum; + uint16 urg; +} hdr_tcp_t; + +static hdr_tcp_t HDR_TCP = {139, 139, 0, 0, 0x50, 0, 0, 0, 0}; + +void print_pcap_header(FILE *out) +{ + struct tcpdump_file_header h; + h.magic = TCPDUMP_MAGIC; + h.major = 2; + h.minor = 4; + h.zone = 0; + h.sigfigs = 0; + h.snaplen = 102400; /* As long packets as possible */ + h.linktype = 101; /* Raw IP */ + fwrite(&h, sizeof(struct tcpdump_file_header), 1, out); +} + +void print_pcap_packet(FILE *out, unsigned char *data, long length, long caplen) +{ + static int i = 0; + struct tcpdump_packet p; + i++; + p.ts.tv_usec = 0; + p.ts.tv_sec = 0; + p.caplen = caplen; + p.len = length; + fwrite(&p, sizeof(struct tcpdump_packet), 1, out); + fwrite(data, sizeof(unsigned char), caplen, out); +} + +void print_hex_packet(FILE *out, unsigned char *data, long length) +{ + long i,cur = 0; + while(cur < length) { + fprintf(out, "%06lX ", cur); + for(i = cur; i < length && i < cur + 16; i++) { + fprintf(out, "%02x ", data[i]); + } + + cur = i; + fprintf(out, "\n"); + } +} + +void print_netbios_packet(FILE *out, unsigned char *data, long length, long actual_length) +{ + unsigned char *newdata; long offset = 0; + long newlen; + + newlen = length+sizeof(HDR_IP)+sizeof(HDR_TCP); + newdata = malloc(newlen); + + HDR_IP.packet_length = htons(newlen); + HDR_TCP.window = htons(0x2000); + HDR_TCP.source_port = HDR_TCP.dest_port = htons(139); + + memcpy(newdata+offset, &HDR_IP, sizeof(HDR_IP));offset+=sizeof(HDR_IP); + memcpy(newdata+offset, &HDR_TCP, sizeof(HDR_TCP));offset+=sizeof(HDR_TCP); + memcpy(newdata+offset,data,length); + + print_pcap_packet(out, newdata, newlen, actual_length+offset); + free(newdata); +} + +unsigned char *curpacket = NULL; +long curpacket_len = 0; + +void read_log_msg(FILE *in, unsigned char **_buffer, long *buffersize, long *data_offset, long *data_length) +{ + unsigned char *buffer; + int tmp; long i; + assert(fscanf(in, " size=%ld\n", buffersize)); + *buffersize+=4; /* for netbios */ + buffer = malloc(*buffersize); + memset(buffer, 0, *buffersize); + /* NetBIOS */ + buffer[0] = 0x00; + buffer[1] = 0x00; + memcpy(buffer+2, &buffersize, 2); + buffer[4] = 0xFF; + buffer[5] = 'S'; + buffer[6] = 'M'; + buffer[7] = 'B'; + assert(fscanf(in, " smb_com=0x%x\n", &tmp)); buffer[smb_com] = tmp; + assert(fscanf(in, " smb_rcls=%d\n", &tmp)); buffer[smb_rcls] = tmp; + assert(fscanf(in, " smb_reh=%d\n", &tmp)); buffer[smb_reh] = tmp; + assert(fscanf(in, " smb_err=%d\n", &tmp)); memcpy(buffer+smb_err, &tmp, 2); + assert(fscanf(in, " smb_flg=%d\n", &tmp)); buffer[smb_flg] = tmp; + assert(fscanf(in, " smb_flg2=%d\n", &tmp)); memcpy(buffer+smb_flg2, &tmp, 2); + assert(fscanf(in, " smb_tid=%d\n", &tmp)); memcpy(buffer+smb_tid, &tmp, 2); + assert(fscanf(in, " smb_pid=%d\n", &tmp)); memcpy(buffer+smb_pid, &tmp, 2); + assert(fscanf(in, " smb_uid=%d\n", &tmp)); memcpy(buffer+smb_uid, &tmp, 2); + assert(fscanf(in, " smb_mid=%d\n", &tmp)); memcpy(buffer+smb_mid, &tmp, 2); + assert(fscanf(in, " smt_wct=%d\n", &tmp)); buffer[smb_wct] = tmp; + for(i = 0; i < buffer[smb_wct]; i++) { + assert(fscanf(in, " smb_vwv[%*2d]=%*5d (0x%X)\n", &tmp)); + memcpy(buffer+smb_vwv+i*2, &tmp, 2); + } + + *data_offset = smb_vwv+buffer[smb_wct]*2; + assert(fscanf(in, " smb_bcc=%ld\n", data_length)); buffer[(*data_offset)] = *data_length; + (*data_offset)+=2; + *_buffer = buffer; +} + +long read_log_data(FILE *in, unsigned char *buffer, long data_length) +{ + long i, addr; char real[2][16]; int ret; + unsigned char tmp; + for(i = 0; i < data_length; i++) { + if(i % 16 == 0){ + if(i != 0) { /* Read data after each line */ + assert(fscanf(in, "%8s %8s", real[0], real[1]) == 2); + } + ret = fscanf(in, " [%03lX]", &addr); + if(!ret) { + if(!quiet)fprintf(stderr, "Only first %ld bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i); + return i-1; + } + assert(addr == i); + } + if(!fscanf(in, "%02lX", &tmp)) { + if(!quiet)fprintf(stderr, "Only first %ld bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i-1); + return i-1; + } + buffer[i] = tmp; + } + return data_length; +} + +int main (int argc, char **argv) +{ + const char *infile, *outfile; + FILE *out, *in; + int opt; + poptContext pc; + char buffer[4096]; + long data_offset, data_length; + long data_bytes_read; + int in_packet = 0; + struct poptOption long_options[] = { + POPT_AUTOHELP + { "quiet", 'q', POPT_ARG_NONE, &quiet, 0, "Be quiet, don't output warnings" }, + { "hex", 'h', POPT_ARG_NONE, &hexformat, 0, "Output format readable by text2pcap" }, + POPT_TABLEEND + }; + + pc = poptGetContext(NULL, argc, (const char **) argv, long_options, + POPT_CONTEXT_KEEP_FIRST); + poptSetOtherOptionHelp(pc, "[ []]"); + + + while((opt = poptGetNextOpt(pc)) != -1) { + switch (opt) { + } + } + + poptGetArg(pc); /* Drop argv[0], the program name */ + + infile = poptGetArg(pc); + + if(infile) { + in = fopen(infile, "r"); + if(!in) { + perror("fopen"); + return 1; + } + } else in = stdin; + + outfile = poptGetArg(pc); + + if(outfile) { + out = fopen(outfile, "w+"); + if(!out) { + perror("fopen"); + fprintf(stderr, "Can't find %s, using stdout...\n", outfile); + } + } + + if(!outfile) out = stdout; + + if(!hexformat)print_pcap_header(out); + + while(!feof(in)) { + fgets(buffer, sizeof(buffer), in); + if(buffer[0] == '[') { /* Header */ + if(strstr(buffer, "show_msg")) { + in_packet++; + if(in_packet == 1)continue; + read_log_msg(in, &curpacket, &curpacket_len, &data_offset, &data_length); + } else if(in_packet && strstr(buffer, "dump_data")) { + data_bytes_read = read_log_data(in, curpacket+data_offset, data_length); + } else { + if(in_packet){ + if(hexformat) print_hex_packet(out, curpacket, curpacket_len); + else print_netbios_packet(out, curpacket, curpacket_len, data_bytes_read+data_offset); + free(curpacket); + } + in_packet = 0; + } + } + } + + return 0; +} diff --git a/source3/utils/net.c b/source3/utils/net.c index 8f6b09a3fa..e5c078da29 100644 --- a/source3/utils/net.c +++ b/source3/utils/net.c @@ -181,6 +181,27 @@ NTSTATUS connect_to_ipc_anonymous(struct cli_state **c, } } +/**************************************************************************** + Use the local machine's password for this session +****************************************************************************/ +int net_use_machine_password(void) +{ + char *user_name = NULL; + + if (!secrets_init()) { + d_printf("ERROR: Unable to open secrets database\n"); + exit(1); + } + + user_name = NULL; + opt_password = secrets_fetch_machine_password(opt_target_workgroup, NULL, NULL); + if (asprintf(&user_name, "%s$@%s", global_myname(), lp_realm()) == -1) { + return -1; + } + opt_user_name = user_name; + return 0; +} + BOOL net_find_server(unsigned flags, struct in_addr *server_ip, char **server_name) { @@ -321,7 +342,7 @@ static int net_join(int argc, const char **argv) if (net_ads_join(argc, argv) == 0) return 0; else - d_printf("ADS join did not work, trying RPC...\n"); + d_printf("ADS join did not work, falling back to RPC...\n"); } return net_rpc_join(argc, argv); } @@ -334,6 +355,31 @@ static int net_changetrustpw(int argc, const char **argv) return net_rpc_changetrustpw(argc, argv); } +static int net_changesecretpw(int argc, const char **argv) +{ + char *trust_pw; + uint32 sec_channel_type = SEC_CHAN_WKSTA; + + if(opt_force) { + trust_pw = getpass("Enter machine password: "); + + if (!secrets_store_machine_password(trust_pw, lp_workgroup(), sec_channel_type)) { + d_printf("Unable to write the machine account password in the secrets database"); + return 1; + } + else { + d_printf("Modified trust account password in secrets database\n"); + } + } + else { + d_printf("Machine account password change requires the -f flag.\n"); + d_printf("Do NOT use this function unless you know what it does!\n"); + d_printf("This function will change the ADS Domain member machine account password in the secrets.tdb file!\n"); + } + + return 0; +} + static int net_share(int argc, const char **argv) { if (net_rpc_check(0)) @@ -416,6 +462,50 @@ static int net_getdomainsid(int argc, const char **argv) return 0; } +#ifdef WITH_FAKE_KASERVER + +int net_afskey_usage(int argc, const char **argv) +{ + d_printf(" net afskey filename\n" + "\tImports a OpenAFS KeyFile into our secrets.tdb\n\n"); + return -1; +} + +static int net_afskey(int argc, const char **argv) +{ + int fd; + struct afs_keyfile keyfile; + + if (argc != 1) { + d_printf("usage: 'net afskey '\n"); + return -1; + } + + if (!secrets_init()) { + d_printf("Could not open secrets.tdb\n"); + return -1; + } + + if ((fd = open(argv[0], O_RDONLY, 0)) < 0) { + d_printf("Could not open %s\n", argv[0]); + return -1; + } + + if (read(fd, &keyfile, sizeof(keyfile)) != sizeof(keyfile)) { + d_printf("Could not read keyfile\n"); + return -1; + } + + if (!secrets_store_afs_keyfile(afs_cell(), &keyfile)) { + d_printf("Could not write keyfile to secrets.tdb\n"); + return -1; + } + + return 0; +} + +#endif /* WITH_FAKE_KASERVER */ + static uint32 get_maxrid(void) { SAM_ACCOUNT *pwd = NULL; @@ -516,6 +606,7 @@ static struct functable net_func[] = { {"SERVICE", net_rap_service}, {"PASSWORD", net_rap_password}, {"CHANGETRUSTPW", net_changetrustpw}, + {"CHANGESECRETPW", net_changesecretpw}, {"TIME", net_time}, {"LOOKUP", net_lookup}, {"JOIN", net_join}, @@ -525,6 +616,9 @@ static struct functable net_func[] = { {"GETDOMAINSID", net_getdomainsid}, {"MAXRID", net_maxrid}, {"IDMAP", net_idmap}, +#ifdef WITH_FAKE_KASERVER + {"AFSKEY", net_afskey}, +#endif {"HELP", net_help}, {NULL, NULL} @@ -649,23 +743,10 @@ static struct functable net_func[] = { sec_init(); if (opt_machine_pass) { - char *user = NULL; /* it is very useful to be able to make ads queries as the machine account for testing purposes and for domain leave */ - if (!secrets_init()) { - d_printf("ERROR: Unable to open secrets database\n"); - exit(1); - } - - opt_password = secrets_fetch_machine_password(opt_workgroup, NULL, NULL); - - asprintf(&user,"%s$", global_myname()); - opt_user_name = user; - if (!opt_password) { - d_printf("ERROR: Unable to fetch machine password\n"); - exit(1); - } + net_use_machine_password(); } if (!opt_password) { diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c index 631e235127..3b955742d8 100644 --- a/source3/utils/net_ads.c +++ b/source3/utils/net_ads.c @@ -127,9 +127,14 @@ static ADS_STRUCT *ads_startup(void) ADS_STATUS status; BOOL need_password = False; BOOL second_time = False; - char *cp; + char *cp; - ads = ads_init(NULL, opt_target_workgroup, opt_host); + /* lp_realm() should be handled by a command line param, + However, the join requires that realm be set in smb.conf + and compares our realm with the remote server's so this is + ok until someone needs more flexibility */ + + ads = ads_init(lp_realm(), opt_target_workgroup, opt_host); if (!opt_user_name) { opt_user_name = "administrator"; @@ -579,10 +584,7 @@ static int net_ads_leave(int argc, const char **argv) } if (!opt_password) { - char *user_name; - asprintf(&user_name, "%s$", global_myname()); - opt_password = secrets_fetch_machine_password(opt_target_workgroup, NULL, NULL); - opt_user_name = user_name; + net_use_machine_password(); } if (!(ads = ads_startup())) { @@ -603,7 +605,6 @@ static int net_ads_leave(int argc, const char **argv) static int net_ads_join_ok(void) { - char *user_name; ADS_STRUCT *ads = NULL; if (!secrets_init()) { @@ -611,9 +612,7 @@ static int net_ads_join_ok(void) return -1; } - asprintf(&user_name, "%s$", global_myname()); - opt_user_name = user_name; - opt_password = secrets_fetch_machine_password(opt_target_workgroup, NULL, NULL); + net_use_machine_password(); if (!(ads = ads_startup())) { return -1; @@ -648,6 +647,7 @@ int net_ads_join(int argc, const char **argv) ADS_STRUCT *ads; ADS_STATUS rc; char *password; + char *machine_account = NULL; char *tmp_password; const char *org_unit = "Computers"; char *dn; @@ -656,6 +656,8 @@ int net_ads_join(int argc, const char **argv) char *ou_str; uint32 sec_channel_type = SEC_CHAN_WKSTA; uint32 account_type = UF_WORKSTATION_TRUST_ACCOUNT; + char *short_domain_name = NULL; + TALLOC_CTX *ctx = NULL; if (argc > 0) org_unit = argv[0]; @@ -669,6 +671,16 @@ int net_ads_join(int argc, const char **argv) if (!(ads = ads_startup())) return -1; + if (!*lp_realm()) { + d_printf("realm must be set in in smb.conf for ADS join to succeed.\n"); + return -1; + } + + if (strcmp(ads->config.realm, lp_realm()) != 0) { + d_printf("realm of remote server (%s) and realm in smb.conf (%s) DO NOT match. Aborting join\n", ads->config.realm, lp_realm()); + return -1; + } + ou_str = ads_ou_string(org_unit); asprintf(&dn, "%s,%s", ou_str, ads->config.bind_path); free(ou_str); @@ -696,16 +708,47 @@ int net_ads_join(int argc, const char **argv) rc = ads_domain_sid(ads, &dom_sid); if (!ADS_ERR_OK(rc)) { - d_printf("ads_domain_sid: %s\n", ads_errstr(rc)); + d_printf("ads_domain_sid: %s\n", ads_errstr(rc)); + return -1; + } + + if (asprintf(&machine_account, "%s$", global_myname()) == -1) { + d_printf("asprintf failed\n"); return -1; } - rc = ads_set_machine_password(ads, global_myname(), password); + rc = ads_set_machine_password(ads, machine_account, password); if (!ADS_ERR_OK(rc)) { d_printf("ads_set_machine_password: %s\n", ads_errstr(rc)); return -1; } - + + /* make sure we get the right workgroup */ + + if ( !(ctx = talloc_init("net ads join")) ) { + d_printf("talloc_init() failed!\n"); + return -1; + } + + rc = ads_workgroup_name(ads, ctx, &short_domain_name); + if ( ADS_ERR_OK(rc) ) { + if ( !strequal(lp_workgroup(), short_domain_name) ) { + d_printf("The workgroup in smb.conf does not match the short\n"); + d_printf("domain name obtained from the server.\n"); + d_printf("Using the name [%s] from the server.\n", short_domain_name); + d_printf("You should set \"workgroup = %s\" in smb.conf.\n", short_domain_name); + } + } + else + short_domain_name = lp_workgroup(); + + d_printf("Using short domain name -- %s\n", short_domain_name); + + /* HACK ALRET! Store the sid and password under bother the lp_workgroup() + value from smb.conf and the string returned from the server. The former is + neede to bootstrap winbindd's first connection to the DC to get the real + short domain name --jerry */ + if (!secrets_store_domain_sid(lp_workgroup(), &dom_sid)) { DEBUG(1,("Failed to save domain sid\n")); return -1; @@ -716,10 +759,22 @@ int net_ads_join(int argc, const char **argv) return -1; } - d_printf("Joined '%s' to realm '%s'\n", global_myname(), ads->config.realm); + if (!secrets_store_domain_sid(short_domain_name, &dom_sid)) { + DEBUG(1,("Failed to save domain sid\n")); + return -1; + } - free(password); + if (!secrets_store_machine_password(password, short_domain_name, sec_channel_type)) { + DEBUG(1,("Failed to save machine password\n")); + return -1; + } + + d_printf("Joined '%s' to realm '%s'\n", global_myname(), ads->config.realm); + SAFE_FREE(password); + SAFE_FREE(machine_account); + if ( ctx ) + talloc_destroy(ctx); return 0; } @@ -1020,17 +1075,13 @@ int net_ads_changetrustpw(int argc, const char **argv) char *host_principal; char *hostname; ADS_STATUS ret; - char *user_name; if (!secrets_init()) { DEBUG(1,("Failed to initialise secrets database\n")); return -1; } - asprintf(&user_name, "%s$", global_myname()); - opt_user_name = user_name; - - opt_password = secrets_fetch_machine_password(opt_target_workgroup, NULL, NULL); + net_use_machine_password(); use_in_memory_ccache(); diff --git a/source3/utils/net_ads_cldap.c b/source3/utils/net_ads_cldap.c index e74e4b5a4c..595e6e9434 100644 --- a/source3/utils/net_ads_cldap.c +++ b/source3/utils/net_ads_cldap.c @@ -240,7 +240,7 @@ static int recv_cldap_netlogon(int sock, struct cldap_netlogon_reply *reply) return -1; } - p = os3.data; + p = (char *)os3.data; reply->type = IVAL(p, 0); p += 4; reply->flags = IVAL(p, 0); p += 4; @@ -248,25 +248,25 @@ static int recv_cldap_netlogon(int sock, struct cldap_netlogon_reply *reply) memcpy(&reply->guid.info, p, GUID_SIZE); p += GUID_SIZE; - p += pull_netlogon_string(reply->forest, p, os3.data); - p += pull_netlogon_string(reply->unk0, p, os3.data); - p += pull_netlogon_string(reply->domain, p, os3.data); - p += pull_netlogon_string(reply->hostname, p, os3.data); - p += pull_netlogon_string(reply->netbios_domain, p, os3.data); - p += pull_netlogon_string(reply->unk1, p, os3.data); - p += pull_netlogon_string(reply->netbios_hostname, p, os3.data); - p += pull_netlogon_string(reply->unk2, p, os3.data); + p += pull_netlogon_string(reply->forest, p, (const char *)os3.data); + p += pull_netlogon_string(reply->unk0, p, (const char *)os3.data); + p += pull_netlogon_string(reply->domain, p, (const char *)os3.data); + p += pull_netlogon_string(reply->hostname, p, (const char *)os3.data); + p += pull_netlogon_string(reply->netbios_domain, p, (const char *)os3.data); + p += pull_netlogon_string(reply->unk1, p, (const char *)os3.data); + p += pull_netlogon_string(reply->netbios_hostname, p, (const char *)os3.data); + p += pull_netlogon_string(reply->unk2, p, (const char *)os3.data); if (reply->type == SAMLOGON_AD_R) { - p += pull_netlogon_string(reply->user_name, p, os3.data); + p += pull_netlogon_string(reply->user_name, p, (const char *)os3.data); } else { *reply->user_name = 0; } - p += pull_netlogon_string(reply->unk3, p, os3.data); - p += pull_netlogon_string(reply->site_name, p, os3.data); - p += pull_netlogon_string(reply->unk4, p, os3.data); - p += pull_netlogon_string(reply->site_name_2, p, os3.data); + p += pull_netlogon_string(reply->unk3, p, (const char *)os3.data); + p += pull_netlogon_string(reply->site_name, p, (const char *)os3.data); + p += pull_netlogon_string(reply->unk4, p, (const char *)os3.data); + p += pull_netlogon_string(reply->site_name_2, p, (const char *)os3.data); reply->version = IVAL(p, 0); reply->lmnt_token = SVAL(p, 4); diff --git a/source3/utils/net_groupmap.c b/source3/utils/net_groupmap.c index 8831839e4e..9937145230 100644 --- a/source3/utils/net_groupmap.c +++ b/source3/utils/net_groupmap.c @@ -252,11 +252,21 @@ static int net_groupmap_add(int argc, const char **argv) } } - if ( !unixgrp[0] || (!rid && !string_sid[0]) ) { + if ( !unixgrp[0] ) { d_printf("Usage: net groupmap add {rid=|sid=} unixgroup= [type=] [ntgroup=] [comment=]\n"); return -1; } + if ( (gid = nametogid(unixgrp)) == (gid_t)-1 ) { + d_printf("Can't lookup UNIX group %s\n", ntgroup); + return -1; + } + + if ( (rid == 0) && (string_sid[0] == '\0') ) { + d_printf("No rid or sid specified, choosing algorithmic mapping\n"); + rid = pdb_gid_to_group_rid(gid); + } + /* append the rid to our own domain/machine SID if we don't have a full SID */ if ( !string_sid[0] ) { sid_copy(&sid, get_global_sam_sid()); @@ -267,11 +277,6 @@ static int net_groupmap_add(int argc, const char **argv) if (ntcomment[0]) fstrcpy(ntcomment, "Local Unix group"); - if ( (gid = nametogid(unixgrp)) == (gid_t)-1 ) { - d_printf("Can't lookup UNIX group %s\n", ntgroup); - return -1; - } - if ( !ntgroup[0] ) fstrcpy( ntgroup, unixgrp ); diff --git a/source3/utils/net_help.c b/source3/utils/net_help.c index 1f3afb1690..95116a4d2a 100644 --- a/source3/utils/net_help.c +++ b/source3/utils/net_help.c @@ -47,7 +47,7 @@ int net_common_flags_usage(int argc, const char **argv) d_printf("\t-U or --user=\t\tuser name\n"); d_printf("\t-s or --configfile=\t\tpathname of smb.conf file\n"); d_printf("\t-l or --long\t\t\tDisplay full information\n"); - d_printf("\t-V or --version\t\tPrint samba version information\n"); + d_printf("\t-V or --version\t\t\tPrint samba version information\n"); d_printf("\t-P or --machine-pass\t\tAuthenticate as machine account\n"); return -1; } @@ -60,7 +60,8 @@ static int help_usage(int argc, const char **argv) "\n"\ "Valid functions are:\n"\ " RPC RAP ADS FILE SHARE SESSION SERVER DOMAIN PRINTQ USER GROUP VALIDATE\n"\ -" GROUPMEMBER ADMIN SERVICE PASSWORD TIME LOOKUP GETLOCALSID SETLOCALSID\n"); +" GROUPMEMBER ADMIN SERVICE PASSWORD TIME LOOKUP GETLOCALSID SETLOCALSID\n"\ +" CHANGESCRETPW\n"); return -1; } @@ -156,6 +157,8 @@ static int net_usage(int argc, const char **argv) " net cache\t\tto operate on cache tdb file\n"\ " net getlocalsid [NAME]\tto get the SID for local name\n"\ " net setlocalsid SID\tto set the local domain SID\n"\ + " net changesecretpw\tto change the machine password in the local secrets database only\n"\ + " \tthis requires the -f flag as a safety barrier\n"\ "\n"\ " net ads \tto run ADS commands\n"\ " net rap \tto run RAP (pre-RPC) commands\n"\ @@ -193,6 +196,9 @@ int net_help(int argc, const char **argv) {"PASSWORD", net_rap_password_usage}, {"TIME", net_time_usage}, {"LOOKUP", net_lookup_usage}, +#ifdef WITH_FAKE_KASERVER + {"AFSKEY", net_afskey_usage}, +#endif {"HELP", help_usage}, {NULL, NULL}}; diff --git a/source3/utils/net_lookup.c b/source3/utils/net_lookup.c index 8456da4e0c..cef0ea5fbe 100644 --- a/source3/utils/net_lookup.c +++ b/source3/utils/net_lookup.c @@ -23,7 +23,7 @@ int net_lookup_usage(int argc, const char **argv) { d_printf( -" net lookup host HOSTNAME \n\tgives IP for a hostname\n\n" +" net lookup [host] HOSTNAME[#]\n\tgives IP for a hostname\n\n" " net lookup ldap [domain]\n\tgives IP of domain's ldap server\n\n" " net lookup kdc [realm]\n\tgives IP of realm's kerberos KDC\n\n" " net lookup dc [domain]\n\tgives IP of domains Domain Controllers\n\n" @@ -37,14 +37,22 @@ static int net_lookup_host(int argc, const char **argv) { struct in_addr ip; int name_type = 0x20; + const char *name = argv[0]; + char *p; - if (argc == 0) return net_lookup_usage(argc, argv); - if (argc > 1) name_type = strtol(argv[1], NULL, 0); + if (argc == 0) + return net_lookup_usage(argc, argv); - if (!resolve_name(argv[0], &ip, name_type)) { + p = strchr_m(name,'#'); + if (p) { + *p = '\0'; + sscanf(++p,"%x",&name_type); + } + + if (!resolve_name(name, &ip, name_type)) { /* we deliberately use DEBUG() here to send it to stderr so scripts aren't mucked up */ - DEBUG(0,("Didn't find %s#%02x\n", argv[0], name_type)); + DEBUG(0,("Didn't find %s#%02x\n", name, name_type)); return -1; } @@ -221,7 +229,9 @@ static int net_lookup_kdc(int argc, const char **argv) /* lookup hosts or IP addresses using internal samba lookup fns */ int net_lookup(int argc, const char **argv) { - struct functable func[] = { + int i; + + struct functable table[] = { {"HOST", net_lookup_host}, {"LDAP", net_lookup_ldap}, {"DC", net_lookup_dc}, @@ -230,5 +240,19 @@ int net_lookup(int argc, const char **argv) {NULL, NULL} }; - return net_run_function(argc, argv, func, net_lookup_usage); + if (argc < 1) { + d_printf("\nUsage: \n"); + return net_lookup_usage(argc, argv); + } + for (i=0; table[i].funcname; i++) { + if (StrCaseCmp(argv[0], table[i].funcname) == 0) + return table[i].fn(argc-1, argv+1); + } + + /* Default to lookup a hostname so 'net lookup foo#1b' can be + used instead of 'net lookup host foo#1b'. The host syntax + is a bit confusing as non #00 names can't really be + considered hosts as such. */ + + return net_lookup_host(argc, argv); } diff --git a/source3/utils/net_rpc.c b/source3/utils/net_rpc.c index 890d4a012b..fefc5af365 100644 --- a/source3/utils/net_rpc.c +++ b/source3/utils/net_rpc.c @@ -84,7 +84,14 @@ static DOM_SID *net_get_remote_domain_sid(struct cli_state *cli) result = cli_lsa_query_info_policy(cli, mem_ctx, &pol, info_class, domain_name, domain_sid); if (!NT_STATUS_IS_OK(result)) { - goto error; + error: + fprintf(stderr, "could not obtain sid for domain %s\n", cli->domain); + + if (!NT_STATUS_IS_OK(result)) { + fprintf(stderr, "error: %s\n", nt_errstr(result)); + } + + exit(1); } cli_lsa_close(cli, mem_ctx, &pol); @@ -92,15 +99,6 @@ static DOM_SID *net_get_remote_domain_sid(struct cli_state *cli) talloc_destroy(mem_ctx); return domain_sid; - - error: - fprintf(stderr, "could not obtain sid for domain %s\n", cli->domain); - - if (!NT_STATUS_IS_OK(result)) { - fprintf(stderr, "error: %s\n", nt_errstr(result)); - } - - exit(1); } /** @@ -1709,8 +1707,13 @@ static NTSTATUS rpc_trustdom_add_internals(const DOM_SID *domain_sid, struct cli static int rpc_trustdom_add(int argc, const char **argv) { - return run_rpc_command(NULL, PI_SAMR, 0, rpc_trustdom_add_internals, - argc, argv); + if (argc > 0) { + return run_rpc_command(NULL, PI_SAMR, 0, rpc_trustdom_add_internals, + argc, argv); + } else { + d_printf("Usage: net rpc trustdom add \n"); + return -1; + } } @@ -1726,6 +1729,7 @@ static int rpc_trustdom_add(int argc, const char **argv) static int rpc_trustdom_del(int argc, const char **argv) { d_printf("Sorry, not yet implemented.\n"); + d_printf("Use 'smbpasswd -x -i' instead.\n"); return -1; } @@ -1782,7 +1786,7 @@ static int rpc_trustdom_establish(int argc, const char **argv) /* find the domain controller */ if (!net_find_pdc(&server_ip, pdc_name, domain_name)) { - DEBUG(0, ("Coulnd find domain controller for domain %s\n", domain_name)); + DEBUG(0, ("Couldn't find domain controller for domain %s\n", domain_name)); return -1; } @@ -1988,8 +1992,8 @@ static int rpc_trustdom_list(int argc, const char **argv) POLICY_HND connect_hnd; /* trusted domains listing variables */ - int enum_ctx = 0; - int num_domains, i, pad_len, col_len = 20; + unsigned int num_domains, enum_ctx = 0; + int i, pad_len, col_len = 20; DOM_SID *domain_sids; char **trusted_dom_names; fstring pdc_name, dummy; diff --git a/source3/utils/net_rpc_samsync.c b/source3/utils/net_rpc_samsync.c index 9eadbbbade..ed69f8a326 100644 --- a/source3/utils/net_rpc_samsync.c +++ b/source3/utils/net_rpc_samsync.c @@ -550,7 +550,11 @@ fetch_group_info(uint32 rid, SAM_GROUP_INFO *delta) map.sid = group_sid; map.sid_name_use = SID_NAME_DOM_GRP; fstrcpy(map.nt_name, name); - fstrcpy(map.comment, comment); + if (delta->hdr_grp_desc.buffer) { + fstrcpy(map.comment, comment); + } else { + fstrcpy(map.comment, ""); + } if (insert) pdb_add_group_mapping_entry(&map); @@ -911,9 +915,40 @@ fetch_sam_entry(SAM_DELTA_HDR *hdr_delta, SAM_DELTA_CTR *delta, fetch_alias_mem(hdr_delta->target_rid, &delta->als_mem_info, dom_sid); break; + /* The following types are recognised but not handled */ case SAM_DELTA_DOMAIN_INFO: d_printf("SAM_DELTA_DOMAIN_INFO not handled\n"); break; + case SAM_DELTA_RENAME_GROUP: + d_printf("SAM_DELTA_RENAME_GROUP not handled\n"); + break; + case SAM_DELTA_RENAME_USER: + d_printf("SAM_DELTA_RENAME_USER not handled\n"); + break; + case SAM_DELTA_RENAME_ALIAS: + d_printf("SAM_DELTA_RENAME_ALIAS not handled\n"); + break; + case SAM_DELTA_POLICY_INFO: + d_printf("SAM_DELTA_POLICY_INFO not handled\n"); + break; + case SAM_DELTA_TRUST_DOMS: + d_printf("SAM_DELTA_TRUST_DOMS not handled\n"); + break; + case SAM_DELTA_PRIVS_INFO: + d_printf("SAM_DELTA_PRIVS_INFO not handled\n"); + break; + case SAM_DELTA_SECRET_INFO: + d_printf("SAM_DELTA_SECRET_INFO not handled\n"); + break; + case SAM_DELTA_DELETE_GROUP: + d_printf("SAM_DELTA_DELETE_GROUP not handled\n"); + break; + case SAM_DELTA_DELETE_USER: + d_printf("SAM_DELTA_DELETE_USER not handled\n"); + break; + case SAM_DELTA_MODIFIED_COUNT: + d_printf("SAM_DELTA_MODIFIED_COUNT not handled\n"); + break; default: d_printf("Unknown delta record type %d\n", hdr_delta->type); break; diff --git a/source3/utils/nmblookup.c b/source3/utils/nmblookup.c index d2c5cbc00e..3c5a22841e 100644 --- a/source3/utils/nmblookup.c +++ b/source3/utils/nmblookup.c @@ -109,7 +109,7 @@ static void do_node_status(int fd, const char *name, int type, struct in_addr ip status = node_status_query(fd,&nname,ip, &count); if (status) { for (i=0;idata, MIN(challenge->length, 8)); @@ -296,7 +310,7 @@ static void manage_squid_ntlmssp_request(enum squid_mode squid_mode, } DEBUG(10, ("got NTLMSSP packet:\n")); - dump_data(10, request.data, request.length); + dump_data(10, (const char *)request.data, request.length); nt_status = ntlmssp_server_update(ntlmssp_state, request, &reply); @@ -347,27 +361,35 @@ static void manage_squid_basic_request(enum squid_mode squid_mode, static void offer_gss_spnego_mechs(void) { DATA_BLOB token; - ASN1_DATA asn1; SPNEGO_DATA spnego; ssize_t len; char *reply_base64; + pstring principal; + pstring myname_lower; + ZERO_STRUCT(spnego); + pstrcpy(myname_lower, global_myname()); + strlower_m(myname_lower); + + pstr_sprintf(principal, "%s$@%s", myname_lower, lp_realm()); + /* Server negTokenInit (mech offerings) */ spnego.type = SPNEGO_NEG_TOKEN_INIT; - spnego.negTokenInit.mechTypes = smb_xmalloc(sizeof(char *) * 2); + spnego.negTokenInit.mechTypes = smb_xmalloc(sizeof(char *) * 3); +#ifdef HAVE_KRB5 + spnego.negTokenInit.mechTypes[0] = smb_xstrdup(OID_KERBEROS5_OLD); + spnego.negTokenInit.mechTypes[1] = smb_xstrdup(OID_NTLMSSP); + spnego.negTokenInit.mechTypes[2] = NULL; +#else spnego.negTokenInit.mechTypes[0] = smb_xstrdup(OID_NTLMSSP); spnego.negTokenInit.mechTypes[1] = NULL; +#endif + - ZERO_STRUCT(asn1); - asn1_push_tag(&asn1, ASN1_SEQUENCE(0)); - asn1_push_tag(&asn1, ASN1_CONTEXT(0)); - asn1_write_GeneralString(&asn1, "NONE"); - asn1_pop_tag(&asn1); - asn1_pop_tag(&asn1); - spnego.negTokenInit.mechListMIC = data_blob(asn1.data, asn1.length); - asn1_free(&asn1); + spnego.negTokenInit.mechListMIC = data_blob(principal, + strlen(principal)); len = write_spnego_data(&token, &spnego); free_spnego_data(&spnego); @@ -391,11 +413,14 @@ static void manage_gss_spnego_request(enum squid_mode squid_mode, char *buf, int length) { static NTLMSSP_STATE *ntlmssp_state = NULL; - SPNEGO_DATA spnego; - DATA_BLOB request, token; + SPNEGO_DATA request, response; + DATA_BLOB token; NTSTATUS status; ssize_t len; + char *user = NULL; + char *domain = NULL; + const char *reply_code; char *reply_base64; pstring reply_argument; @@ -432,9 +457,9 @@ static void manage_gss_spnego_request(enum squid_mode squid_mode, return; } - request = base64_decode_data_blob(buf + 3); - len = read_spnego_data(request, &spnego); - data_blob_free(&request); + token = base64_decode_data_blob(buf + 3); + len = read_spnego_data(token, &request); + data_blob_free(&token); if (len == -1) { DEBUG(1, ("GSS-SPNEGO query [%s] invalid", buf)); @@ -442,100 +467,159 @@ static void manage_gss_spnego_request(enum squid_mode squid_mode, return; } - if (spnego.type == SPNEGO_NEG_TOKEN_INIT) { + if (request.type == SPNEGO_NEG_TOKEN_INIT) { /* Second request from Client. This is where the client offers its mechanism to use. We currently only support NTLMSSP, the decision for Kerberos would be taken here. */ - if ( (spnego.negTokenInit.mechTypes == NULL) || - (spnego.negTokenInit.mechTypes[0] == NULL) ) { + if ( (request.negTokenInit.mechTypes == NULL) || + (request.negTokenInit.mechTypes[0] == NULL) ) { DEBUG(1, ("Client did not offer any mechanism")); x_fprintf(x_stdout, "BH\n"); return; } - if ( strcmp(spnego.negTokenInit.mechTypes[0], OID_NTLMSSP) != 0 ) { - DEBUG(1, ("Client did not choose NTLMSSP but %s\n", - spnego.negTokenInit.mechTypes[0])); - x_fprintf(x_stdout, "BH\n"); - return; - } + if (strcmp(request.negTokenInit.mechTypes[0], OID_NTLMSSP) == 0) { - if ( spnego.negTokenInit.mechToken.data == NULL ) { - DEBUG(1, ("Client did not provide NTLMSSP data\n")); - x_fprintf(x_stdout, "BH\n"); - return; - } + if ( request.negTokenInit.mechToken.data == NULL ) { + DEBUG(1, ("Client did not provide NTLMSSP data\n")); + x_fprintf(x_stdout, "BH\n"); + return; + } - if ( ntlmssp_state != NULL ) { - DEBUG(1, ("Client wants a new NTLMSSP challenge, but " - "already got one\n")); - x_fprintf(x_stdout, "BH\n"); - ntlmssp_server_end(&ntlmssp_state); - return; + if ( ntlmssp_state != NULL ) { + DEBUG(1, ("Client wants a new NTLMSSP challenge, but " + "already got one\n")); + x_fprintf(x_stdout, "BH\n"); + ntlmssp_server_end(&ntlmssp_state); + return; + } + + ntlmssp_server_start(&ntlmssp_state); + ntlmssp_state->check_password = winbind_pw_check; + ntlmssp_state->get_domain = get_winbind_domain; + ntlmssp_state->get_global_myname = get_winbind_netbios_name; + + DEBUG(10, ("got NTLMSSP packet:\n")); + dump_data(10, (const char *)request.negTokenInit.mechToken.data, + request.negTokenInit.mechToken.length); + + response.type = SPNEGO_NEG_TOKEN_TARG; + response.negTokenTarg.supportedMech = strdup(OID_NTLMSSP); + response.negTokenTarg.mechListMIC = data_blob(NULL, 0); + + status = ntlmssp_server_update(ntlmssp_state, + request.negTokenInit.mechToken, + &response.negTokenTarg.responseToken); } - ntlmssp_server_start(&ntlmssp_state); - ntlmssp_state->check_password = winbind_pw_check; - ntlmssp_state->get_domain = get_winbind_domain; - ntlmssp_state->get_global_myname = get_winbind_netbios_name; +#ifdef HAVE_KRB5 + if (strcmp(request.negTokenInit.mechTypes[0], OID_KERBEROS5_OLD) == 0) { - DEBUG(10, ("got NTLMSSP packet:\n")); - dump_data(10, spnego.negTokenInit.mechToken.data, - spnego.negTokenInit.mechToken.length); + char *principal; + DATA_BLOB auth_data; + DATA_BLOB ap_rep; + uint8 session_key[16]; - free_spnego_data(&spnego); + if ( request.negTokenInit.mechToken.data == NULL ) { + DEBUG(1, ("Client did not provide Kerberos data\n")); + x_fprintf(x_stdout, "BH\n"); + return; + } - spnego.type = SPNEGO_NEG_TOKEN_TARG; - spnego.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE; - spnego.negTokenTarg.supportedMech = strdup(OID_NTLMSSP); + response.type = SPNEGO_NEG_TOKEN_TARG; + response.negTokenTarg.supportedMech = strdup(OID_KERBEROS5_OLD); + response.negTokenTarg.mechListMIC = data_blob(NULL, 0); + response.negTokenTarg.responseToken = data_blob(NULL, 0); - status = ntlmssp_server_update(ntlmssp_state, - spnego.negTokenInit.mechToken, - &spnego.negTokenTarg.responseToken); + status = ads_verify_ticket(lp_realm(), + &request.negTokenInit.mechToken, + &principal, &auth_data, &ap_rep, + session_key); - } else { + /* Now in "principal" we have the name we are + authenticated as. */ + + if (NT_STATUS_IS_OK(status)) { + + domain = strchr(principal, '@'); - /* spnego.type == SPNEGO_NEG_TOKEN_TARG */ + if (domain == NULL) { + DEBUG(1, ("Did not get a valid principal " + "from ads_verify_ticket\n")); + x_fprintf(x_stdout, "BH\n"); + return; + } - DATA_BLOB response; + *domain++ = '\0'; + domain = strdup(domain); + user = strdup(principal); - if (spnego.negTokenTarg.responseToken.data == NULL) { - DEBUG(1, ("Got a negTokenArg without a responseToken!\n")); + data_blob_free(&ap_rep); + data_blob_free(&auth_data); + + SAFE_FREE(principal); + } + } +#endif + + } else { + + if ( (request.negTokenTarg.supportedMech == NULL) || + ( strcmp(request.negTokenTarg.supportedMech, OID_NTLMSSP) != 0 ) ) { + /* Kerberos should never send a negTokenTarg, OID_NTLMSSP + is the only one we support that sends this stuff */ + DEBUG(1, ("Got a negTokenTarg for something non-NTLMSSP: %s\n", + request.negTokenTarg.supportedMech)); x_fprintf(x_stdout, "BH\n"); return; } - status = ntlmssp_server_update(ntlmssp_state, - spnego.negTokenTarg.responseToken, - &response); + if (request.negTokenTarg.responseToken.data == NULL) { + DEBUG(1, ("Got a negTokenTarg without a responseToken!\n")); + x_fprintf(x_stdout, "BH\n"); + return; + } - data_blob_free(&spnego.negTokenTarg.responseToken); + status = ntlmssp_server_update(ntlmssp_state, + request.negTokenTarg.responseToken, + &response.negTokenTarg.responseToken); - spnego.negTokenTarg.responseToken = response; + response.type = SPNEGO_NEG_TOKEN_TARG; + response.negTokenTarg.supportedMech = strdup(OID_NTLMSSP); + response.negTokenTarg.mechListMIC = data_blob(NULL, 0); + if (NT_STATUS_IS_OK(status)) { + user = strdup(ntlmssp_state->user); + domain = strdup(ntlmssp_state->domain); + ntlmssp_server_end(&ntlmssp_state); + } } + free_spnego_data(&request); + if (NT_STATUS_IS_OK(status)) { - spnego.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED; + response.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED; reply_code = "AF"; - pstr_sprintf(reply_argument, "%s\\%s", - ntlmssp_state->domain, ntlmssp_state->user); + pstr_sprintf(reply_argument, "%s\\%s", domain, user); } else if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { - spnego.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE; + response.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE; reply_code = "TT"; pstr_sprintf(reply_argument, "*"); } else { - spnego.negTokenTarg.negResult = SPNEGO_REJECT; + response.negTokenTarg.negResult = SPNEGO_REJECT; reply_code = "NA"; pstrcpy(reply_argument, nt_errstr(status)); } - len = write_spnego_data(&token, &spnego); - free_spnego_data(&spnego); + SAFE_FREE(user); + SAFE_FREE(domain); + + len = write_spnego_data(&token, &response); + free_spnego_data(&response); if (len == -1) { DEBUG(1, ("Could not write SPNEGO data blob\n")); @@ -551,16 +635,12 @@ static void manage_gss_spnego_request(enum squid_mode squid_mode, SAFE_FREE(reply_base64); data_blob_free(&token); - if (NT_STATUS_IS_OK(status)) { - ntlmssp_server_end(&ntlmssp_state); - } - return; } static NTLMSSP_CLIENT_STATE *client_ntlmssp_state = NULL; -static void manage_client_ntlmssp_init(SPNEGO_DATA spnego) +static BOOL manage_client_ntlmssp_init(SPNEGO_DATA spnego) { NTSTATUS status; DATA_BLOB null_blob = data_blob(NULL, 0); @@ -573,14 +653,12 @@ static void manage_client_ntlmssp_init(SPNEGO_DATA spnego) if (client_ntlmssp_state != NULL) { DEBUG(1, ("Request for initial SPNEGO request where " "we already have a state\n")); - x_fprintf(x_stdout, "BH\n"); - return; + return False; } if ( (opt_username == NULL) || (opt_domain == NULL) ) { DEBUG(1, ("Need username and domain for NTLMSSP\n")); - x_fprintf(x_stdout, "BH\n"); - return; + return False; } if (opt_password == NULL) { @@ -591,7 +669,7 @@ static void manage_client_ntlmssp_init(SPNEGO_DATA spnego) DEBUG(10, ("Requesting password\n")); x_fprintf(x_stdout, "PW\n"); - return; + return True; } status = ntlmssp_client_start(&client_ntlmssp_state); @@ -599,9 +677,8 @@ static void manage_client_ntlmssp_init(SPNEGO_DATA spnego) if (!NT_STATUS_IS_OK(status)) { DEBUG(1, ("Could not start NTLMSSP client: %s\n", nt_errstr(status))); - x_fprintf(x_stdout, "BH\n"); ntlmssp_client_end(&client_ntlmssp_state); - return; + return False; } status = ntlmssp_set_username(client_ntlmssp_state, opt_username); @@ -609,9 +686,8 @@ static void manage_client_ntlmssp_init(SPNEGO_DATA spnego) if (!NT_STATUS_IS_OK(status)) { DEBUG(1, ("Could not set username: %s\n", nt_errstr(status))); - x_fprintf(x_stdout, "BH\n"); ntlmssp_client_end(&client_ntlmssp_state); - return; + return False; } status = ntlmssp_set_domain(client_ntlmssp_state, opt_domain); @@ -619,9 +695,8 @@ static void manage_client_ntlmssp_init(SPNEGO_DATA spnego) if (!NT_STATUS_IS_OK(status)) { DEBUG(1, ("Could not set domain: %s\n", nt_errstr(status))); - x_fprintf(x_stdout, "BH\n"); ntlmssp_client_end(&client_ntlmssp_state); - return; + return False; } status = ntlmssp_set_password(client_ntlmssp_state, opt_password); @@ -629,9 +704,8 @@ static void manage_client_ntlmssp_init(SPNEGO_DATA spnego) if (!NT_STATUS_IS_OK(status)) { DEBUG(1, ("Could not set password: %s\n", nt_errstr(status))); - x_fprintf(x_stdout, "BH\n"); ntlmssp_client_end(&client_ntlmssp_state); - return; + return False; } spnego.type = SPNEGO_NEG_TOKEN_INIT; @@ -645,9 +719,8 @@ static void manage_client_ntlmssp_init(SPNEGO_DATA spnego) if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) { DEBUG(1, ("Expected MORE_PROCESSING_REQUIRED, got: %s\n", nt_errstr(status))); - x_fprintf(x_stdout, "BH\n"); ntlmssp_client_end(&client_ntlmssp_state); - return; + return False; } write_spnego_data(&to_server, &spnego); @@ -657,7 +730,7 @@ static void manage_client_ntlmssp_init(SPNEGO_DATA spnego) data_blob_free(&to_server); x_fprintf(x_stdout, "KK %s\n", to_server_base64); SAFE_FREE(to_server_base64); - return; + return True; } static void manage_client_ntlmssp_targ(SPNEGO_DATA spnego) @@ -719,21 +792,110 @@ static void manage_client_ntlmssp_targ(SPNEGO_DATA spnego) return; } -static void manage_client_krb5_init(SPNEGO_DATA spnego) +#ifdef HAVE_KRB5 + +static BOOL manage_client_krb5_init(SPNEGO_DATA spnego) { - DEBUG(1, ("to be done ... \n")); - x_fprintf(x_stdout, "BH\n"); - return; + char *principal; + DATA_BLOB tkt, to_server; + unsigned char session_key_krb5[16]; + SPNEGO_DATA reply; + char *reply_base64; + + const char *my_mechs[] = {OID_KERBEROS5_OLD, NULL}; + ssize_t len; + + if ( (spnego.negTokenInit.mechListMIC.data == NULL) || + (spnego.negTokenInit.mechListMIC.length == 0) ) { + DEBUG(1, ("Did not get a principal for krb5\n")); + return False; + } + + principal = malloc(spnego.negTokenInit.mechListMIC.length+1); + + if (principal == NULL) { + DEBUG(1, ("Could not malloc principal\n")); + return False; + } + + memcpy(principal, spnego.negTokenInit.mechListMIC.data, + spnego.negTokenInit.mechListMIC.length); + principal[spnego.negTokenInit.mechListMIC.length] = '\0'; + + tkt = cli_krb5_get_ticket(principal, 0, session_key_krb5); + + if (tkt.data == NULL) { + + pstring user; + + /* Let's try to first get the TGT, for that we need a + password. */ + + if (opt_password == NULL) { + DEBUG(10, ("Requesting password\n")); + x_fprintf(x_stdout, "PW\n"); + return True; + } + + pstr_sprintf(user, "%s@%s", opt_username, opt_domain); + + if (kerberos_kinit_password(user, opt_password, 0) != 0) { + DEBUG(10, ("Requesting TGT failed\n")); + x_fprintf(x_stdout, "NA\n"); + return True; + } + + tkt = cli_krb5_get_ticket(principal, 0, session_key_krb5); + } + + ZERO_STRUCT(reply); + + reply.type = SPNEGO_NEG_TOKEN_INIT; + reply.negTokenInit.mechTypes = my_mechs; + reply.negTokenInit.reqFlags = 0; + reply.negTokenInit.mechToken = tkt; + reply.negTokenInit.mechListMIC = data_blob(NULL, 0); + + len = write_spnego_data(&to_server, &reply); + data_blob_free(&tkt); + + if (len == -1) { + DEBUG(1, ("Could not write SPNEGO data blob\n")); + return False; + } + + reply_base64 = base64_encode_data_blob(to_server); + x_fprintf(x_stdout, "KK %s *\n", reply_base64); + + SAFE_FREE(reply_base64); + data_blob_free(&to_server); + DEBUG(10, ("sent GSS-SPNEGO KERBEROS5 negTokenInit\n")); + return True; } static void manage_client_krb5_targ(SPNEGO_DATA spnego) { - DEBUG(1, ("Got a negTokenTarg with a Kerberos token. This should not " - "happen!\n")); - x_fprintf(x_stdout, "BH\n"); - return; + switch (spnego.negTokenTarg.negResult) { + case SPNEGO_ACCEPT_INCOMPLETE: + DEBUG(1, ("Got a Kerberos negTokenTarg with ACCEPT_INCOMPLETE\n")); + x_fprintf(x_stdout, "BH\n"); + break; + case SPNEGO_ACCEPT_COMPLETED: + DEBUG(10, ("Accept completed\n")); + x_fprintf(x_stdout, "AF\n"); + break; + case SPNEGO_REJECT: + DEBUG(10, ("Rejected\n")); + x_fprintf(x_stdout, "NA\n"); + break; + default: + DEBUG(1, ("Got an invalid negTokenTarg\n")); + x_fprintf(x_stdout, "AF\n"); + } } +#endif + static void manage_gss_spnego_client_request(enum squid_mode squid_mode, char *buf, int length) { @@ -753,7 +915,7 @@ static void manage_gss_spnego_client_request(enum squid_mode squid_mode, /* We asked for a password and obviously got it :-) */ - opt_password = strndup(request.data, request.length); + opt_password = strndup((const char *)request.data, request.length); if (opt_password == NULL) { DEBUG(1, ("Out of memory\n")); @@ -796,14 +958,17 @@ static void manage_gss_spnego_client_request(enum squid_mode squid_mode, while (*mechType != NULL) { - if (strcmp(*mechType, OID_NTLMSSP) == 0) { - manage_client_ntlmssp_init(spnego); - goto out; +#ifdef HAVE_KRB5 + if ( (strcmp(*mechType, OID_KERBEROS5_OLD) == 0) || + (strcmp(*mechType, OID_KERBEROS5) == 0) ) { + if (manage_client_krb5_init(spnego)) + goto out; } +#endif - if (strcmp(*mechType, OID_KERBEROS5_OLD) == 0) { - manage_client_krb5_init(spnego); - goto out; + if (strcmp(*mechType, OID_NTLMSSP) == 0) { + if (manage_client_ntlmssp_init(spnego)) + goto out; } mechType++; @@ -816,17 +981,42 @@ static void manage_gss_spnego_client_request(enum squid_mode squid_mode, if (spnego.type == SPNEGO_NEG_TOKEN_TARG) { + if (spnego.negTokenTarg.supportedMech == NULL) { + /* On accept/reject Windows does not send the + mechanism anymore. Handle that here and + shut down the mechanisms. */ + + switch (spnego.negTokenTarg.negResult) { + case SPNEGO_ACCEPT_COMPLETED: + x_fprintf(x_stdout, "AF\n"); + break; + case SPNEGO_REJECT: + x_fprintf(x_stdout, "NA\n"); + break; + default: + DEBUG(1, ("Got a negTokenTarg with no mech and an " + "unknown negResult: %d\n", + spnego.negTokenTarg.negResult)); + x_fprintf(x_stdout, "BH\n"); + } + + ntlmssp_client_end(&client_ntlmssp_state); + goto out; + } + if (strcmp(spnego.negTokenTarg.supportedMech, OID_NTLMSSP) == 0) { manage_client_ntlmssp_targ(spnego); goto out; } +#if HAVE_KRB5 if (strcmp(spnego.negTokenTarg.supportedMech, OID_KERBEROS5_OLD) == 0) { manage_client_krb5_targ(spnego); goto out; } +#endif } @@ -925,8 +1115,8 @@ static BOOL check_auth_crap(void) &opt_lm_response, &opt_nt_response, flags, - lm_key, - nt_key, + (unsigned char *)lm_key, + (unsigned char *)nt_key, &error_string); if (!NT_STATUS_IS_OK(nt_status)) { @@ -940,7 +1130,7 @@ static BOOL check_auth_crap(void) if (request_lm_key && (memcmp(zeros, lm_key, sizeof(lm_key)) != 0)) { - hex_encode(lm_key, + hex_encode((const unsigned char *)lm_key, sizeof(lm_key), &hex_lm_key); x_fprintf(x_stdout, "LM_KEY: %s\n", hex_lm_key); @@ -949,7 +1139,7 @@ static BOOL check_auth_crap(void) if (request_nt_key && (memcmp(zeros, nt_key, sizeof(nt_key)) != 0)) { - hex_encode(nt_key, + hex_encode((const unsigned char *)nt_key, sizeof(nt_key), &hex_nt_key); x_fprintf(x_stdout, "NT_KEY: %s\n", hex_nt_key); @@ -1023,16 +1213,16 @@ static BOOL test_lm(void) sizeof(lm_key)) != 0) { DEBUG(1, ("LM Key does not match expectations!\n")); DEBUG(1, ("lm_key:\n")); - dump_data(1, lm_key, 8); + dump_data(1, (const char *)lm_key, 8); DEBUG(1, ("expected:\n")); - dump_data(1, lm_hash, 8); + dump_data(1, (const char *)lm_hash, 8); } if (memcmp(lm_hash, nt_key, 8) != 0) { DEBUG(1, ("Session Key (first 8, lm hash) does not match expectations!\n")); DEBUG(1, ("nt_key:\n")); - dump_data(1, nt_key, 8); + dump_data(1, (const char *)nt_key, 8); DEBUG(1, ("expected:\n")); - dump_data(1, lm_hash, 8); + dump_data(1, (const char *)lm_hash, 8); } return True; } @@ -1095,18 +1285,18 @@ static BOOL test_lm_ntlm(void) sizeof(lm_key)) != 0) { DEBUG(1, ("LM Key does not match expectations!\n")); DEBUG(1, ("lm_key:\n")); - dump_data(1, lm_key, 8); + dump_data(1, (const char *)lm_key, 8); DEBUG(1, ("expected:\n")); - dump_data(1, lm_hash, 8); + dump_data(1, (const char *)lm_hash, 8); pass = False; } if (memcmp(session_key.data, nt_key, sizeof(nt_key)) != 0) { DEBUG(1, ("NT Session Key does not match expectations!\n")); DEBUG(1, ("nt_key:\n")); - dump_data(1, nt_key, 16); + dump_data(1, (const char *)nt_key, 16); DEBUG(1, ("expected:\n")); - dump_data(1, session_key.data, session_key.length); + dump_data(1, (const char *)session_key.data, session_key.length); pass = False; } return pass; @@ -1138,10 +1328,10 @@ static BOOL test_ntlm(void) flags |= WBFLAG_PAM_NTKEY; SMBNTencrypt(opt_password,chall.data,nt_response.data); - E_md4hash(opt_password, nt_hash); - SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data); + E_md4hash(opt_password, (unsigned char *)nt_hash); + SMBsesskeygen_ntv1((const unsigned char *)nt_hash, NULL, session_key.data); - E_deshash(opt_password, lm_hash); + E_deshash(opt_password, (unsigned char *)lm_hash); nt_status = contact_winbind_auth_crap(opt_username, opt_domain, opt_workstation, @@ -1149,8 +1339,8 @@ static BOOL test_ntlm(void) NULL, &nt_response, flags, - lm_key, - nt_key, + (unsigned char *)lm_key, + (unsigned char *)nt_key, &error_string); data_blob_free(&nt_response); @@ -1178,7 +1368,7 @@ static BOOL test_ntlm(void) DEBUG(1, ("nt_key:\n")); dump_data(1, nt_key, 16); DEBUG(1, ("expected:\n")); - dump_data(1, session_key.data, session_key.length); + dump_data(1, (const char *)session_key.data, session_key.length); pass = False; } return pass; @@ -1234,17 +1424,17 @@ static BOOL test_ntlm_in_lm(void) sizeof(lm_key)) != 0) { DEBUG(1, ("LM Key does not match expectations!\n")); DEBUG(1, ("lm_key:\n")); - dump_data(1, lm_key, 8); + dump_data(1, (const char *)lm_key, 8); DEBUG(1, ("expected:\n")); - dump_data(1, lm_hash, 8); + dump_data(1, (const char *)lm_hash, 8); pass = False; } if (memcmp(lm_hash, nt_key, 8) != 0) { DEBUG(1, ("Session Key (first 8 lm hash) does not match expectations!\n")); DEBUG(1, ("nt_key:\n")); - dump_data(1, nt_key, 16); + dump_data(1, (const char *)nt_key, 16); DEBUG(1, ("expected:\n")); - dump_data(1, lm_hash, 8); + dump_data(1, (const char *)lm_hash, 8); pass = False; } return pass; @@ -1276,10 +1466,10 @@ static BOOL test_ntlm_in_both(void) flags |= WBFLAG_PAM_NTKEY; SMBNTencrypt(opt_password,chall.data,nt_response.data); - E_md4hash(opt_password, nt_hash); - SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data); + E_md4hash(opt_password, (unsigned char *)nt_hash); + SMBsesskeygen_ntv1((const unsigned char *)nt_hash, NULL, session_key.data); - E_deshash(opt_password, lm_hash); + E_deshash(opt_password, (unsigned char *)lm_hash); nt_status = contact_winbind_auth_crap(opt_username, opt_domain, opt_workstation, @@ -1287,8 +1477,8 @@ static BOOL test_ntlm_in_both(void) &nt_response, &nt_response, flags, - lm_key, - nt_key, + (unsigned char *)lm_key, + (unsigned char *)nt_key, &error_string); data_blob_free(&nt_response); @@ -1316,7 +1506,7 @@ static BOOL test_ntlm_in_both(void) DEBUG(1, ("nt_key:\n")); dump_data(1, nt_key, 16); DEBUG(1, ("expected:\n")); - dump_data(1, session_key.data, session_key.length); + dump_data(1, (const char *)session_key.data, session_key.length); pass = False; } @@ -1378,9 +1568,9 @@ static BOOL test_ntlmv2(void) sizeof(nt_key)) != 0) { DEBUG(1, ("NT Session Key does not match expectations!\n")); DEBUG(1, ("nt_key:\n")); - dump_data(1, nt_key, 16); + dump_data(1, (const char *)nt_key, 16); DEBUG(1, ("expected:\n")); - dump_data(1, nt_session_key.data, nt_session_key.length); + dump_data(1, (const char *)nt_session_key.data, nt_session_key.length); pass = False; } return pass; @@ -1442,9 +1632,9 @@ static BOOL test_lmv2_ntlmv2(void) sizeof(nt_key)) != 0) { DEBUG(1, ("NT Session Key does not match expectations!\n")); DEBUG(1, ("nt_key:\n")); - dump_data(1, nt_key, 16); + dump_data(1, (const char *)nt_key, 16); DEBUG(1, ("expected:\n")); - dump_data(1, nt_session_key.data, nt_session_key.length); + dump_data(1, (const char *)nt_session_key.data, nt_session_key.length); pass = False; } return pass; @@ -1557,18 +1747,18 @@ static BOOL test_ntlm_broken(BOOL break_lm) sizeof(lm_key)) != 0) { DEBUG(1, ("LM Key does not match expectations!\n")); DEBUG(1, ("lm_key:\n")); - dump_data(1, lm_key, 8); + dump_data(1, (const char *)lm_key, 8); DEBUG(1, ("expected:\n")); - dump_data(1, lm_hash, 8); + dump_data(1, (const char *)lm_hash, 8); pass = False; } if (memcmp(session_key.data, nt_key, sizeof(nt_key)) != 0) { DEBUG(1, ("NT Session Key does not match expectations!\n")); DEBUG(1, ("nt_key:\n")); - dump_data(1, nt_key, 16); + dump_data(1, (const char *)nt_key, 16); DEBUG(1, ("expected:\n")); - dump_data(1, session_key.data, session_key.length); + dump_data(1, (const char *)session_key.data, session_key.length); pass = False; } return pass; diff --git a/source3/utils/profiles.c b/source3/utils/profiles.c index 23df26d150..3230eb21fc 100644 --- a/source3/utils/profiles.c +++ b/source3/utils/profiles.c @@ -448,7 +448,7 @@ static int get_sid(DOM_SID *sid, const unsigned char *sid_str) SIVAL(&sid->sub_auths[i], 0, auth); i++; - lstr = strchr(lstr + 1, '-'); + lstr = (const unsigned char *)strchr(lstr + 1, '-'); } return 1; diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c index c90c042106..58ee57b5dd 100644 --- a/source3/utils/smbcacls.c +++ b/source3/utils/smbcacls.c @@ -751,7 +751,7 @@ static struct cli_state *connect_one(const char *share) POPT_AUTOHELP { "delete", 'D', POPT_ARG_STRING, NULL, 'D', "Delete an acl", "ACL" }, { "modify", 'M', POPT_ARG_STRING, NULL, 'M', "Modify an acl", "ACL" }, - { "add", 'A', POPT_ARG_STRING, NULL, 'A', "Add an acl", "ACL" }, + { "add", 'a', POPT_ARG_STRING, NULL, 'a', "Add an acl", "ACL" }, { "set", 'S', POPT_ARG_STRING, NULL, 'S', "Set acls", "ACLS" }, { "chown", 'C', POPT_ARG_STRING, NULL, 'C', "Change ownership of a file", "USERNAME" }, { "chgrp", 'G', POPT_ARG_STRING, NULL, 'G', "Change group ownership of a file", "GROUPNAME" }, @@ -796,7 +796,7 @@ static struct cli_state *connect_one(const char *share) mode = SMB_ACL_MODIFY; break; - case 'A': + case 'a': the_acl = smb_xstrdup(poptGetOptArg(pc)); mode = SMB_ACL_ADD; break; diff --git a/source3/utils/smbgroupedit.c b/source3/utils/smbgroupedit.c deleted file mode 100644 index 0faa0513ed..0000000000 --- a/source3/utils/smbgroupedit.c +++ /dev/null @@ -1,405 +0,0 @@ -/* - * Unix SMB/CIFS implementation. - * RPC Pipe client / server routines - * Copyright (C) Andrew Tridgell 1992-2000, - * Copyright (C) Jean François Micouleau 1998-2001. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - */ - -#include "includes.h" - -/* - * Next two lines needed for SunOS and don't - * hurt anything else... - */ -extern char *optarg; -extern int optind; - -/********************************************************* - Print command usage on stderr and die. -**********************************************************/ -static void usage(void) -{ - if (getuid() == 0) { - printf("smbgroupedit options\n"); - } else { - printf("You need to be root to use this tool!\n"); - } - printf("options:\n"); - printf(" -a group create new group\n"); - printf(" -n group NT group name\n"); - printf(" -p privilege only local\n"); - printf(" -d description group description\n"); - printf(" -v list groups\n"); - printf(" -l long list (include details)\n"); - printf(" -s short list (default)\n"); - printf(" -c SID change group\n"); - printf(" -u unix group\n"); - printf(" -d description group description\n"); - printf(" -r rid RID of new group\n"); - printf(" -x group delete this group\n"); - printf("\n"); - printf(" -t[b|d|l] type: builtin, domain, local \n"); - exit(1); -} - -/********************************************************* - Figure out if the input was an NT group or a SID string. - Return the SID. -**********************************************************/ -static BOOL get_sid_from_input(DOM_SID *sid, char *input) -{ - GROUP_MAP map; - - if (StrnCaseCmp( input, "S-", 2)) { - /* Perhaps its the NT group name? */ - if (!pdb_getgrnam(&map, input, MAPPING_WITHOUT_PRIV)) { - printf("NT Group %s doesn't exist in mapping DB\n", input); - return False; - } else { - *sid = map.sid; - } - } else { - if (!string_to_sid(sid, input)) { - printf("converting sid %s from a string failed!\n", input); - return False; - } - } - return True; -} - -/********************************************************* - add a group. -**********************************************************/ -static int addgroup(gid_t gid, enum SID_NAME_USE sid_type, char *ntgroup, char *ntcomment, char *privilege, uint32 rid) -{ - PRIVILEGE_SET se_priv; - DOM_SID sid; - fstring string_sid; - fstring comment; - - sid_copy(&sid, get_global_sam_sid()); - sid_append_rid(&sid, rid); - - sid_to_string(string_sid, &sid); - - if (ntcomment==NULL) - fstrcpy(comment, "Local Unix group"); - else - fstrcpy(comment, ntcomment); - - init_privilege(&se_priv); - if (privilege!=NULL) - convert_priv_from_text(&se_priv, privilege); - - if(!add_initial_entry(gid, string_sid, sid_type, ntgroup, - comment, se_priv, PR_ACCESS_FROM_NETWORK)) { - printf("adding entry for group %s failed!\n", ntgroup); - free_privilege(&se_priv); - return -1; - } - - free_privilege(&se_priv); - return 0; -} - -/********************************************************* - Change a group. -**********************************************************/ -static int changegroup(char *sid_string, char *group, enum SID_NAME_USE sid_type, char *ntgroup, char *groupdesc, char *privilege) -{ - DOM_SID sid; - GROUP_MAP map; - gid_t gid; - - if (!get_sid_from_input(&sid, sid_string)) { - return -1; - } - - /* Get the current mapping from the database */ - if(!pdb_getgrsid(&map, sid, MAPPING_WITH_PRIV)) { - printf("This SID does not exist in the database\n"); - return -1; - } - - /* If a new Unix group is specified, check and change */ - if (group!=NULL) { - gid=nametogid(group); - if (gid==-1) { - printf("The UNIX group does not exist\n"); - return -1; - } else - map.gid=gid; - } - - /* - * Allow changing of group type only between domain and local - * We disallow changing Builtin groups !!! (SID problem) - */ - if (sid_type==SID_NAME_ALIAS - || sid_type==SID_NAME_DOM_GRP - || sid_type==SID_NAME_UNKNOWN) { - if (map.sid_name_use==SID_NAME_ALIAS - || map.sid_name_use==SID_NAME_DOM_GRP - || map.sid_name_use==SID_NAME_UNKNOWN) { - map.sid_name_use=sid_type; - } else { - printf("cannot change group type to builtin\n"); - }; - } else { - printf("cannot change group type from builtin\n"); - } - - if (ntgroup!=NULL) - fstrcpy(map.nt_name, ntgroup); - - /* Change comment if new one */ - if (groupdesc!=NULL) - fstrcpy(map.comment, groupdesc); - - /* Change the privilege if new one */ - if (privilege!=NULL) - convert_priv_from_text(&map.priv_set, privilege); - - if (!pdb_update_group_mapping_entry(&map)) { - printf("Could not update group database\n"); - free_privilege(&map.priv_set); - return -1; - } - - free_privilege(&map.priv_set); - return 0; -} - -/********************************************************* - Delete the group. -**********************************************************/ -static int deletegroup(char *group) -{ - DOM_SID sid; - - if (!get_sid_from_input(&sid, group)) { - return -1; - } - - if(!pdb_delete_group_mapping_entry(sid)) { - printf("removing group %s from the mapping db failed!\n", group); - return -1; - } - - return 0; -} - -/********************************************************* - List the groups. -**********************************************************/ -static int listgroup(enum SID_NAME_USE sid_type, BOOL long_list) -{ - int entries,i; - GROUP_MAP *map=NULL; - fstring string_sid; - fstring group_type; - fstring priv_text; - - if (!long_list) - printf("NT group (SID) -> Unix group\n"); - - if (!pdb_enum_group_mapping(sid_type, &map, &entries, ENUM_ALL_MAPPED, MAPPING_WITH_PRIV)) - return -1; - - for (i=0; i %s\n", map[i].nt_name, string_sid, gidtoname(map[i].gid)); - else { - printf("%s\n", map[i].nt_name); - printf("\tSID : %s\n", string_sid); - printf("\tUnix group: %s\n", gidtoname(map[i].gid)); - printf("\tGroup type: %s\n", group_type); - printf("\tComment : %s\n", map[i].comment); - printf("\tPrivilege : %s\n\n", priv_text); - } - } - - return 0; -} - -/********************************************************* - Start here. -**********************************************************/ -int main (int argc, char **argv) -{ - int ch; - BOOL add_group = False; - BOOL view_group = False; - BOOL change_group = False; - BOOL delete_group = False; - BOOL nt_group = False; - BOOL priv = False; - BOOL group_type = False; - BOOL long_list = False; - - char *group = NULL; - char *sid = NULL; - char *ntgroup = NULL; - char *privilege = NULL; - char *groupt = NULL; - char *group_desc = NULL; - - enum SID_NAME_USE sid_type; - uint32 rid = -1; - - setup_logging("groupedit", True); - - if (argc < 2) { - usage(); - return 0; - } - - if (!lp_load(dyn_CONFIGFILE,True,False,False)) { - fprintf(stderr, "Can't load %s - run testparm to debug it\n", - dyn_CONFIGFILE); - exit(1); - } - - if (!init_names()) - exit(1); - - if(!initialize_password_db(True)) { - fprintf(stderr, "Can't setup password database vectors.\n"); - exit(1); - } - - if(get_global_sam_sid()==False) { - fprintf(stderr, "Can not read machine SID\n"); - return 0; - } - - while ((ch = getopt(argc, argv, "a:c:d:ln:p:r:st:u:vx:")) != EOF) { - switch(ch) { - case 'a': - add_group = True; - group=optarg; - break; - case 'c': - change_group = True; - sid=optarg; - break; - case 'd': - group_desc=optarg; - break; - case 'l': - long_list = True; - break; - case 'n': - nt_group = True; - ntgroup=optarg; - break; - case 'p': - priv = True; - privilege=optarg; - break; - case 'r': - rid = atoi(optarg); - break; - case 's': - long_list = False; - break; - case 't': - group_type = True; - groupt=optarg; - break; - case 'u': - group=optarg; - break; - case 'v': - view_group = True; - break; - case 'x': - delete_group = True; - group=optarg; - break; - /*default: - usage();*/ - } - } - - - if (((add_group?1:0) + (view_group?1:0) + (change_group?1:0) + (delete_group?1:0)) > 1) { - fprintf (stderr, "Incompatible options on command line!\n"); - usage(); - exit(1); - } - - /* no option on command line -> list groups */ - if (((add_group?1:0) + (view_group?1:0) + (change_group?1:0) + (delete_group?1:0)) == 0) - view_group = True; - - - if (group_type==False) - sid_type=SID_NAME_UNKNOWN; - else { - switch (groupt[0]) { - case 'l': - case 'L': - sid_type=SID_NAME_ALIAS; - break; - case 'd': - case 'D': - sid_type=SID_NAME_DOM_GRP; - break; - case 'b': - case 'B': - sid_type=SID_NAME_WKN_GRP; - break; - default: - sid_type=SID_NAME_UNKNOWN; - break; - } - } - - if (add_group) { - gid_t gid=nametogid(group); - if (gid==-1) { - printf("unix group %s doesn't exist!\n", group); - return -1; - } - - if (rid == -1) { - rid = pdb_gid_to_group_rid(gid); - } - return addgroup(gid, sid_type, ntgroup?ntgroup:group, - group_desc, privilege, rid); - } - - if (view_group) - return listgroup(sid_type, long_list); - - if (delete_group) - return deletegroup(group); - - if (change_group) { - return changegroup(sid, group, sid_type, ntgroup, group_desc, privilege); - } - - usage(); - - return 0; -} diff --git a/source3/utils/status.c b/source3/utils/status.c index 8bf67fc4d6..c17e080b6b 100644 --- a/source3/utils/status.c +++ b/source3/utils/status.c @@ -597,7 +597,7 @@ static int traverse_sessionid(TDB_CONTEXT *tdb, TDB_DATA kbuf, TDB_DATA dbuf, vo } else { if (locks_only) goto locks; - d_printf("\nSamba version %s\n",VERSION); + d_printf("\nSamba version %s\n",SAMBA_VERSION_STRING); d_printf("PID Username Group Machine \n"); d_printf("-------------------------------------------------------------------\n"); diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c index 16918ecd4a..0a87b4bc1e 100644 --- a/source3/utils/testparm.c +++ b/source3/utils/testparm.c @@ -287,6 +287,27 @@ via the %%o substitution. With encrypted passwords this is not possible.\n", lp_ Level II oplocks can only be set if oplocks are also set.\n", lp_servicename(s) ); } + + if (lp_map_hidden(s) && !(lp_create_mask(s) & S_IXOTH)) { + printf("Invalid combination of parameters for service %s. \ + Map hidden can only work if create mask includes octal 01 (S_IXOTH).\n", + lp_servicename(s) ); + } + if (lp_map_hidden(s) && (lp_force_create_mode(s) & S_IXOTH)) { + printf("Invalid combination of parameters for service %s. \ + Map hidden can only work if force create mode excludes octal 01 (S_IXOTH).\n", + lp_servicename(s) ); + } + if (lp_map_system(s) && !(lp_create_mask(s) & S_IXGRP)) { + printf("Invalid combination of parameters for service %s. \ + Map system can only work if create mask includes octal 010 (S_IXGRP).\n", + lp_servicename(s) ); + } + if (lp_map_system(s) && (lp_force_create_mode(s) & S_IXGRP)) { + printf("Invalid combination of parameters for service %s. \ + Map system can only work if force create mode excludes octal 010 (S_IXGRP).\n", + lp_servicename(s) ); + } } } diff --git a/source3/web/statuspage.c b/source3/web/statuspage.c index c579e8f112..21d7e45738 100644 --- a/source3/web/statuspage.c +++ b/source3/web/statuspage.c @@ -327,7 +327,7 @@ void status_page(void) d_printf("\n"); - d_printf("", _("version:"), VERSION); + d_printf("", _("version:"), SAMBA_VERSION_STRING); fflush(stdout); d_printf("\n", _("smbd:"), smbd_running()?_("running"):_("not running")); diff --git a/source3/web/swat.c b/source3/web/swat.c index a1c132a088..1c892559dd 100644 --- a/source3/web/swat.c +++ b/source3/web/swat.c @@ -737,7 +737,16 @@ static void wizard_page(void) d_printf("", (winstype == 0) ? "checked" : ""); d_printf("", (winstype == 1) ? "checked" : ""); d_printf("", (winstype == 2) ? "checked" : ""); - d_printf("",lp_wins_server_list()); + d_printf(""); if (winstype == 3) { d_printf(""); d_printf(""); diff --git a/source3/wrepld/server.c b/source3/wrepld/server.c index 504818b8d5..25de680982 100644 --- a/source3/wrepld/server.c +++ b/source3/wrepld/server.c @@ -586,7 +586,7 @@ static void process(void) reopen_logs(); - DEBUG(1,( "wrepld version %s started.\n", VERSION)); + DEBUG(1,( "wrepld version %s started.\n", SAMBA_VERSION_STRING)); DEBUGADD(1,( "Copyright Andrew Tridgell and the Samba Team 1992-2002\n")); DEBUG(2,("uid=%d gid=%d euid=%d egid=%d\n", -- cgit From 7f438c3b9e8913a7836b4851ef7c40a7b97a986d Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 04:14:19 +0000 Subject: removing unused files (This used to be commit 1a9145015d4b2ee7e7399099760cda13d619e740) --- source3/include/smb_ldap.h | 59 -- source3/libsmb/netlogon_unigrp.c | 172 ----- source3/passdb/pdb_nisplus.c | 1519 -------------------------------------- source3/passdb/pdb_unix.c | 131 ---- source3/script/cvslog.pl | 102 --- 5 files changed, 1983 deletions(-) delete mode 100644 source3/include/smb_ldap.h delete mode 100644 source3/libsmb/netlogon_unigrp.c delete mode 100644 source3/passdb/pdb_nisplus.c delete mode 100644 source3/passdb/pdb_unix.c delete mode 100755 source3/script/cvslog.pl diff --git a/source3/include/smb_ldap.h b/source3/include/smb_ldap.h deleted file mode 100644 index 1a30b853e7..0000000000 --- a/source3/include/smb_ldap.h +++ /dev/null @@ -1,59 +0,0 @@ -/* - Unix SMB/CIFS implementation. - LDAP protocol helper functions for SAMBA - Copyright (C) Jean François Micouleau 1998 - Copyright (C) Gerald Carter 2001 - Copyright (C) Shahms King 2001 - Copyright (C) Andrew Bartlett 2002 - Copyright (C) Stefan (metze) Metzmacher 2002 - Copyright (C) Jim McDonough 2003 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - -*/ - -#ifndef SMB_LDAP_H -#define SMB_LDAP_H - -#ifdef HAVE_LDAP - -#include -#include - -struct smb_ldap_privates { - - /* Former statics */ - LDAP *ldap_struct; - LDAPMessage *result; - LDAPMessage *entry; - int index; - - time_t last_ping; - /* retrive-once info */ - const char *uri; - - BOOL permit_non_unix_accounts; - - uint32 low_nua_rid; - uint32 high_nua_rid; - - char *bind_dn; - char *bind_secret; - - struct smb_ldap_privates *next; -}; - -#endif -#endif diff --git a/source3/libsmb/netlogon_unigrp.c b/source3/libsmb/netlogon_unigrp.c deleted file mode 100644 index 466410d800..0000000000 --- a/source3/libsmb/netlogon_unigrp.c +++ /dev/null @@ -1,172 +0,0 @@ -/* - Unix SMB/CIFS implementation. - Universal groups helpers - Copyright (C) Alexander Bokovoy 2002. - Copyright (C) Andrew Bartlett 2002. - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - - This work was sponsored by Optifacio Software Services, Inc. -*/ - -#include "includes.h" -#define UNIGROUP_PREFIX "UNIGROUP" - -/* - Handle for netlogon_unigrp.tdb database. It is used internally - in cli_store_uni_groups_*() and cli_fetch_uni_groups() - and is initialized on first call to cli_store_uni_groups_*() -*/ -static TDB_CONTEXT *netlogon_unigrp_tdb = NULL; - -/* - Store universal groups info into netlogon_unigrp.tdb for - later usage. We use 'domain_SID/user_rid' as key and - array of uint32 where array[0] is number of elements - and elements are array[1] ... array[array[0]] -*/ - -BOOL uni_group_cache_init(void) -{ - if (!netlogon_unigrp_tdb) { - netlogon_unigrp_tdb = tdb_open_log(lock_path("netlogon_unigrp.tdb"), 0, - TDB_DEFAULT, O_RDWR | O_CREAT, 0644); - } - - return (netlogon_unigrp_tdb != NULL); -} - -BOOL uni_group_cache_store_netlogon(TALLOC_CTX *mem_ctx, NET_USER_INFO_3 *user) -{ - TDB_DATA key,data; - fstring keystr, sid_string; - DOM_SID user_sid; - unsigned int i; - - if (!uni_group_cache_init()) { - DEBUG(0,("uni_group_cache_store_netlogon: cannot open netlogon_unigrp.tdb for write!\n")); - return False; - } - - sid_copy(&user_sid, &user->dom_sid.sid); - sid_append_rid(&user_sid, user->user_rid); - - /* Prepare key as USER-SID string */ - slprintf(keystr, sizeof(keystr), "%s/%s", - UNIGROUP_PREFIX, - sid_to_string(sid_string, &user_sid)); - key.dptr = keystr; - key.dsize = strlen(keystr) + 1; - - /* Prepare data */ - data.dsize = (user->num_groups2+1)*sizeof(uint32); - data.dptr = talloc(mem_ctx, data.dsize); - if(!data.dptr) { - DEBUG(0,("uni_group_cache_store_netlogon: cannot allocate memory!\n")); - talloc_destroy(mem_ctx); - return False; - } - - /* Store data in byteorder-independent format */ - SIVAL(&((uint32*)data.dptr)[0],0,user->num_groups2); - for(i=1; i<=user->num_groups2; i++) { - SIVAL(&((uint32*)data.dptr)[i],0,user->gids[i-1].g_rid); - } - if (tdb_store(netlogon_unigrp_tdb, key, data, TDB_REPLACE) == -1) - return False; - return True; -} - -/* - Fetch universal groups info from netlogon_unigrp.tdb for given - domain sid and user rid and allocate it using given mem_ctx. - Universal groups are returned as array of uint32 elements - and elements are array[0] ... array[num_elements-1] - -*/ -DOM_SID **uni_group_cache_fetch(DOM_SID *domain, DOM_SID *user_sid, - TALLOC_CTX *mem_ctx, uint32 *num_groups) -{ - TDB_DATA key,data; - fstring keystr; - DOM_SID **groups; - uint32 i; - uint32 group_count; - fstring sid_string; - - if (!domain) { - DEBUG(1,("uni_group_cache_fetch: expected non-null domain sid\n")); - return NULL; - } - if (!mem_ctx) { - DEBUG(1,("uni_group_cache_fetch: expected non-null memory context\n")); - return NULL; - } - if (!num_groups) { - DEBUG(1,("uni_group_cache_fetch: expected non-null num_groups\n")); - return NULL; - } - if (!netlogon_unigrp_tdb) { - netlogon_unigrp_tdb = tdb_open_log(lock_path("netlogon_unigrp.tdb"), 0, - TDB_DEFAULT, O_RDWR, 0644); - } - if (!netlogon_unigrp_tdb) { - DEBUG(5,("uni_group_cache_fetch: cannot open netlogon_unigrp.tdb for read - normal if not created yet\n")); - return NULL; - } - - *num_groups = 0; - - /* Fetch universal groups */ - slprintf(keystr, sizeof(keystr), "%s/%s", - UNIGROUP_PREFIX, - sid_to_string(sid_string, user_sid)); - key.dptr = keystr; - key.dsize = strlen(keystr) + 1; - data = tdb_fetch(netlogon_unigrp_tdb, key); - - /* There is no cached universal groups in netlogon_unigrp.tdb */ - /* for this user. */ - if (!data.dptr) - return NULL; - - /* Transfer data to receiver's memory context */ - group_count = IVAL(&((uint32*)data.dptr)[0],0); - groups = talloc(mem_ctx, (group_count)*sizeof(*groups)); - if (groups) { - for(i=0; i - * Copyright (C) Luke Kenneth Casson Leighton 1996-1998. - * Copyright (C) Toomas Soome 2001 - * Copyright (C) Jelmer Vernooij 2002 - * - * This program is free software; you can redistribute it and/or modify it under - * the terms of the GNU General Public License as published by the Free - * Software Foundation; either version 2 of the License, or (at your option) - * any later version. - * - * This program is distributed in the hope that it will be useful, but WITHOUT - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for - * more details. - * - * You should have received a copy of the GNU General Public License along with - * this program; if not, write to the Free Software Foundation, Inc., 675 - * Mass Ave, Cambridge, MA 02139, USA. - */ - -#include "includes.h" - -#ifdef BROKEN_NISPLUS_INCLUDE_FILES - -/* - * The following lines are needed due to buggy include files - * in Solaris 2.6 which define GROUP in both /usr/include/sys/acl.h and - * also in /usr/include/rpcsvc/nis.h. The definitions conflict. JRA. - * Also GROUP_OBJ is defined as 0x4 in /usr/include/sys/acl.h and as - * an enum in /usr/include/rpcsvc/nis.h. - */ - - -#if defined(GROUP) -#undef GROUP -#endif - -#if defined(GROUP_OBJ) -#undef GROUP_OBJ -#endif - -#endif - -#include - -/*************************************************************** - - the fields for the NIS+ table, generated from mknissmbpwtbl.sh, are: - - name=S,nogw=r - uid=S,nogw=r - user_rid=S,nogw=r - smb_grpid=,nw+r - group_rid=,nw+r - acb=,nw+r - - lmpwd=C,nw=,g=r,o=rm - ntpwd=C,nw=,g=r,o=rm - - logon_t=,nw+r - logoff_t=,nw+r - kick_t=,nw+r - pwdlset_t=,nw+r - pwdlchg_t=,nw+r - pwdmchg_t=,nw+r - - full_name=,nw+r - home_dir=,nw+r - dir_drive=,nw+r - logon_script=,nw+r - profile_path=,nw+r - acct_desc=,nw+r - workstations=,nw+r - - hours=,nw+r - -****************************************************************/ - -#define NPF_NAME 0 -#define NPF_UID 1 -#define NPF_USER_RID 2 -#define NPF_SMB_GRPID 3 -#define NPF_GROUP_RID 4 -#define NPF_ACB 5 -#define NPF_LMPWD 6 -#define NPF_NTPWD 7 -#define NPF_LOGON_T 8 -#define NPF_LOGOFF_T 9 -#define NPF_KICK_T 10 -#define NPF_PWDLSET_T 11 -#define NPF_PWDCCHG_T 12 -#define NPF_PWDMCHG_T 13 -#define NPF_FULL_NAME 14 -#define NPF_HOME_DIR 15 -#define NPF_DIR_DRIVE 16 -#define NPF_LOGON_SCRIPT 17 -#define NPF_PROFILE_PATH 18 -#define NPF_ACCT_DESC 19 -#define NPF_WORKSTATIONS 20 -#define NPF_HOURS 21 - -struct nisplus_private_info { - nis_result *result; - int enum_entry; - char *location; -}; - -static char *make_nisname_from_user_rid (uint32 rid, char *pfile); -static char *make_nisname_from_name (const char *user_name, char *pfile); -static void get_single_attribute (const nis_object * new_obj, int col, - char *val, int len);; -static BOOL make_sam_from_nisp_object (SAM_ACCOUNT * pw_buf, - const nis_object * obj); -static BOOL make_sam_from_nisresult (SAM_ACCOUNT * pw_buf, - const nis_result * result);; -static void set_single_attribute (nis_object * new_obj, int col, - const char *val, int len, int flags); -static BOOL init_nisp_from_sam (nis_object * obj, const SAM_ACCOUNT * sampass, - nis_object * old); -static nis_result *nisp_get_nis_list (const char *nisname, - unsigned int flags); - -/*************************************************************** - Start enumeration of the passwd list. -****************************************************************/ - -static NTSTATUS nisplussam_setsampwent (struct pdb_methods *methods, BOOL update) -{ - struct nisplus_private_info *private = - (struct nisplus_private_info *) methods->private_data; - - char *sp; - pstring pfiletmp; - - if ((sp = strrchr (private->location, '/'))) - safe_strcpy (pfiletmp, sp + 1, sizeof (pfiletmp) - 1); - else - safe_strcpy (pfiletmp, p, sizeof (pfiletmp) - 1); - safe_strcat (pfiletmp, ".org_dir", - sizeof (pfiletmp) - strlen (pfiletmp) - 1); - - pdb_endsampwent (); /* just in case */ - global_nisp_ent->result = nisp_get_nis_list (pfiletmp, 0); - global_nisp_ent->enum_entry = 0; - if (global_nisp_ent->result != NULL) - return NT_STATUS_UNSUCCESSFUL; - else - return NT_STATUS_OK; -} - -/*************************************************************** - End enumeration of the passwd list. -****************************************************************/ - -static void nisplussam_endsampwent (struct pdb_methods *methods) -{ - struct nisplus_private_info *global_nisp_ent = - (struct nisplus_private_info *) methods->private_data; - if (global_nisp_ent->result) - nis_freeresult (global_nisp_ent->result); - global_nisp_ent->result = NULL; - global_nisp_ent->enum_entry = 0; -} - -/***************************************************************** - Get one SAM_ACCOUNT from the list (next in line) -*****************************************************************/ - -static NTSTATUS nisplussam_getsampwent (struct pdb_methods *methods, - SAM_ACCOUNT * user) -{ - NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL; - struct nisplus_private_info *global_nisp_ent = - (struct nisplus_private_info *) methods->private_data; - int enum_entry = (int) (global_nisp_ent->enum_entry); - nis_result *result = global_nisp_ent->result; - - if (user == NULL) { - DEBUG (0, ("SAM_ACCOUNT is NULL.\n")); - return nt_status; - } - - if (result == NULL || enum_entry < 0 || enum_entry >= (NIS_RES_NUMOBJ (result) - 1)) { - return nt_status; - } - - if (!make_sam_from_nisp_object(user, &NIS_RES_OBJECT (result)[enum_entry])) { - DEBUG (0, ("Bad SAM_ACCOUNT entry returned from NIS+!\n")); - return nt_status; - } - (int) (global_nisp_ent->enum_entry)++; - - return nt_status; -} - -/****************************************************************** - Lookup a name in the SAM database -******************************************************************/ - -static NTSTATUS nisplussam_getsampwnam (struct pdb_methods *methods, - SAM_ACCOUNT * user, const char *sname) -{ - /* Static buffers we will return. */ - NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL; - nis_result *result = NULL; - pstring nisname; - BOOL ret; - struct nisplus_private_info *private = - (struct nisplus_private_info *) methods->private_data; - - if (!private->location || !(*private->location)) { - DEBUG (0, ("No SMB password file set\n")); - return nt_status; - } - if (strrchr (private->location, '/')) - private->location = strrchr (private->location, '/') + 1; - - slprintf (nisname, sizeof (nisname) - 1, "[name=%s],%s.org_dir", - sname, private->location); - DEBUG (10, ("search by nisname: %s\n", nisname)); - - /* Search the table. */ - - if (!(result = nisp_get_nis_list (nisname, 0))) { - return nt_status; - } - - ret = make_sam_from_nisresult (user, result); - nis_freeresult (result); - - if (ret) nt_status = NT_STATUS_OK; - - return nt_status; -} - -/*************************************************************************** - Search by sid - **************************************************************************/ - -static NTSTATUS nisplussam_getsampwrid (struct pdb_methods *methods, - SAM_ACCOUNT * user, uint32 rid) -{ - NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL; - nis_result *result; - char *nisname; - BOOL ret; - char *sp; - pstring pfiletmp; - struct nisplus_private_info *private = - (struct nisplus_private_info *) methods->private_data; - - if (!private->location || !(*private->location)) { - DEBUG (0, ("no SMB password file set\n")); - return nt_status; - } - - if ((sp = strrchr (private->location, '/'))) - safe_strcpy (pfiletmp, sp + 1, sizeof (pfiletmp) - 1); - else - safe_strcpy (pfiletmp, private->location, sizeof (pfiletmp) - 1); - safe_strcat (pfiletmp, ".org_dir", - sizeof (pfiletmp) - strlen (pfiletmp) - 1); - - nisname = make_nisname_from_user_rid (rid, pfiletmp); - - DEBUG (10, ("search by rid: %s\n", nisname)); - - /* Search the table. */ - - if (!(result = nisp_get_nis_list (nisname, 0))) { - return nt_status; - } - - ret = make_sam_from_nisresult (user, result); - nis_freeresult (result); - - if (ret) nt_status = NT_STATUS_OK; - - return nt_status; -} - -static NTSTATUS nisplussam_getsampwsid (struct pdb_methods *methods, - SAM_ACCOUNT * user, const DOM_SID * sid) -{ - uint32 rid; - - if (!sid_peek_check_rid (get_global_sam_sid (), sid, &rid)) - return NT_STATUS_UNSUCCESSFUL; - return nisplussam_getsampwrid (methods, user, rid); -} - - - -/*************************************************************************** - Delete a SAM_ACCOUNT -****************************************************************************/ - -static NTSTATUS nisplussam_delete_sam_account (struct pdb_methods *methods, - SAM_ACCOUNT * user) -{ - NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL; - const char *sname; - pstring nisname; - nis_result *result, *delresult; - nis_object *obj; - struct nisplus_private_info *private = - (struct nisplus_private_info *) methods->private_data; - - if (!user) { - DEBUG (0, ("no SAM_ACCOUNT specified!\n")); - return nt_status; - } - - sname = pdb_get_username (user); - - if (!private->location || !(*private->location)) { - DEBUG (0, ("no SMB password file set\n")); - return nt_status; - } - - if (strrchr (private->location, '/')) - private->location = strrchr (private->location, '/') + 1; - - slprintf (nisname, sizeof (nisname) - 1, "[name=%s],%s.org_dir", - sname, private->location); - - /* Search the table. */ - - if (!(result = nisp_get_nis_list (nisname, - MASTER_ONLY | FOLLOW_LINKS | - FOLLOW_PATH | EXPAND_NAME | - HARD_LOOKUP))) { - return nt_status; - } - - if (result->status != NIS_SUCCESS || NIS_RES_NUMOBJ (result) <= 0) { - /* User not found. */ - DEBUG (0, ("user not found in NIS+\n")); - nis_freeresult (result); - return nt_status; - } - - obj = NIS_RES_OBJECT (result); - slprintf (nisname, sizeof (nisname) - 1, "[name=%s],%s.%s", sname, - obj->zo_name, obj->zo_domain); - - DEBUG (10, ("removing name: %s\n", nisname)); - delresult = nis_remove_entry (nisname, obj, - MASTER_ONLY | REM_MULTIPLE | ALL_RESULTS - | FOLLOW_PATH | EXPAND_NAME | - HARD_LOOKUP); - - nis_freeresult (result); - - if (delresult->status != NIS_SUCCESS) { - DEBUG (0, ("NIS+ table update failed: %s %s\n", - nisname, nis_sperrno (delresult->status))); - nis_freeresult (delresult); - return nt_status; - } - nis_freeresult (delresult); - - return NT_STATUS_OK; -} - -/*************************************************************************** - Modifies an existing SAM_ACCOUNT -****************************************************************************/ - -static NTSTATUS nisplussam_update_sam_account (struct pdb_methods *methods, - SAM_ACCOUNT * newpwd) -{ - NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL; - nis_result *result, *addresult; - nis_object *obj; - nis_object new_obj; - entry_col *ecol; - int ta_maxcol; - struct nisplus_private_info *private = - (struct nisplus_private_info *) methods->private_data; - pstring nisname; - - if (!private->location || !(*private->location)) { - DEBUG (0, ("no SMB password file set\n")); - return nt_status; - } - if (strrchr (private->location, '/')) - private->location = strrchr (private->location, '/') + 1; - - slprintf (nisname, sizeof (nisname) - 1, "[name=%s],%s.org_dir", - pdb_get_username (newpwd), private->location); - - DEBUG (10, ("search by name: %s\n", nisname)); - - /* Search the table. */ - - if (! - (result = - nisp_get_nis_list (nisname, - MASTER_ONLY | FOLLOW_LINKS | FOLLOW_PATH | - EXPAND_NAME | HARD_LOOKUP))) { - return ne_status; - } - - if (result->status != NIS_SUCCESS || NIS_RES_NUMOBJ (result) <= 0) { - /* User not found. */ - DEBUG (0, ("user not found in NIS+\n")); - nis_freeresult (result); - return nt_status; - } - - obj = NIS_RES_OBJECT (result); - DEBUG (6, ("entry found in %s\n", obj->zo_domain)); - - /* we must create new stub object with EN_MODIFIED flag. - this is because obj from result is going to be freed and - we do not want to break it or cause memory leaks or corruption. - */ - - memmove ((char *) &new_obj, obj, sizeof (new_obj)); - ta_maxcol = obj->TA_data.ta_maxcol; - - if (!(ecol = (entry_col *) malloc (ta_maxcol * sizeof (entry_col)))) { - DEBUG (0, ("memory allocation failure\n")); - nis_freeresult (result); - return nt_status; - } - - memmove ((char *) ecol, obj->EN_data.en_cols.en_cols_val, - ta_maxcol * sizeof (entry_col)); - new_obj.EN_data.en_cols.en_cols_val = ecol; - new_obj.EN_data.en_cols.en_cols_len = ta_maxcol; - - if (init_nisp_from_sam (&new_obj, newpwd, obj) == True) { - slprintf (nisname, sizeof (nisname) - 1, "[name=%s],%s.%s", - pdb_get_username (newpwd), private->location, obj->zo_domain); - - DEBUG (10, ("NIS+ table update: %s\n", nisname)); - addresult = - nis_modify_entry (nisname, &new_obj, - MOD_SAMEOBJ | FOLLOW_PATH | - EXPAND_NAME | HARD_LOOKUP); - - if (addresult->status != NIS_SUCCESS) { - DEBUG (0, ("NIS+ table update failed: %s %s\n", - nisname, nis_sperrno (addresult->status))); - nis_freeresult (addresult); - nis_freeresult (result); - free (ecol); - return nt_status; - } - - DEBUG (6, ("password changed\n")); - nis_freeresult (addresult); - } else { - DEBUG (6, ("nothing to change!\n")); - } - - free (ecol); - nis_freeresult (result); - - return NT_STATUS_OK; -} - -/*************************************************************************** - Adds an existing SAM_ACCOUNT -****************************************************************************/ - -static NTSTATUS nisplussam_add_sam_account (struct pdb_methods *methods, - SAM_ACCOUNT * newpwd) -{ - NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL; - int local_user = 0; - char *pfile; - pstring pfiletmp; - char *nisname; - nis_result *result = NULL, *tblresult = NULL; - nis_object new_obj; - entry_col *ecol; - int ta_maxcol; - - /* - * 1. find user domain. - * a. try nis search in passwd.org_dir - if found use domain from result. - * b. try getpwnam. this may be needed if user is defined - * in /etc/passwd file (or elsewere) and not in passwd.org_dir. - * if found, use host default domain. - * c. exit with False - no such user. - * - * 2. add user - * a. find smbpasswd table - * search pfile in user domain if not found, try host default - * domain. - * b. smbpasswd domain is found, fill data and add entry. - * - * pfile should contain ONLY table name, org_dir will be concated. - * so, at first we will clear path prefix from pfile, and - * then we will use pfiletmp as playground to put together full - * nisname string. - * such approach will make it possible to specify samba private dir - * AND still use NIS+ table. as all domain related data is normally - * stored in org_dir.DOMAIN, this should be ok do do. - */ - - pfile = private->location; - if (strrchr (pfile, '/')) - pfile = strrchr (pfile, '/') + 1; - - /* - * Check if user is already there. - */ - safe_strcpy (pfiletmp, pfile, sizeof (pfiletmp) - 1); - safe_strcat (pfiletmp, ".org_dir", - sizeof (pfiletmp) - strlen (pfiletmp) - 1); - - if (pdb_get_username (newpwd) != NULL) { - nisname = make_nisname_from_name (pdb_get_username (newpwd), - pfiletmp); - } else { - return nt_status; - } - - if (! - (result = - nisp_get_nis_list (nisname, - MASTER_ONLY | FOLLOW_LINKS | FOLLOW_PATH | - EXPAND_NAME | HARD_LOOKUP))) { - return nt_status; - } - if (result->status != NIS_SUCCESS && result->status != NIS_NOTFOUND) { - DEBUG (3, ("nis_list failure: %s: %s\n", - nisname, nis_sperrno (result->status))); - nis_freeresult (result); - return nt_status; - } - - if (result->status == NIS_SUCCESS && NIS_RES_NUMOBJ (result) > 0) { - DEBUG (3, ("User already exists in NIS+ password db: %s\n", - pfile)); - nis_freeresult (result); - return nt_status; - } - - nis_freeresult (result); /* no such user, free results */ - - /* - * check for user in unix password database. we need this to get - * domain, where smbpasswd entry should be stored. - */ - - nisname = make_nisname_from_name (pdb_get_username (newpwd), - "passwd.org_dir"); - - result = nisp_get_nis_list (nisname, - MASTER_ONLY | FOLLOW_LINKS | FOLLOW_PATH | - EXPAND_NAME | HARD_LOOKUP); - - if (result->status != NIS_SUCCESS || NIS_RES_NUMOBJ (result) <= 0) { - struct passwd *passwd; - - DEBUG (3, ("nis_list failure: %s: %s\n", - nisname, nis_sperrno (result->status))); - nis_freeresult (result); - - if (!(passwd = getpwnam_alloc (pdb_get_username (newpwd)))) { - /* no such user in system! */ - return nt_status; - } - passwd_free (&passwd); - - /* - * user is defined, but not in passwd.org_dir. - */ - local_user = 1; - } else { - safe_strcpy (pfiletmp, pfile, sizeof (pfiletmp) - 1); - safe_strcat (pfiletmp, ".", - sizeof (pfiletmp) - strlen (pfiletmp) - 1); - safe_strcat (pfiletmp, NIS_RES_OBJECT (result)->zo_domain, - sizeof (pfiletmp) - strlen (pfiletmp) - 1); - nis_freeresult (result); /* not needed any more */ - - tblresult = nisp_get_nis_list (pfiletmp, - MASTER_ONLY | FOLLOW_LINKS | - FOLLOW_PATH | EXPAND_NAME | - HARD_LOOKUP); - } - - if (local_user || tblresult->status != NIS_SUCCESS) { - /* - * no user domain or - * smbpasswd table not found in user domain, fallback to - * default domain. - */ - if (!local_user) /* free previous failed search result */ - nis_freeresult (tblresult); - - safe_strcpy (pfiletmp, pfile, sizeof (pfiletmp) - 1); - safe_strcat (pfiletmp, ".org_dir", - sizeof (pfiletmp) - strlen (pfiletmp) - 1); - tblresult = nis_lookup (pfiletmp, MASTER_ONLY | FOLLOW_LINKS | - FOLLOW_PATH | EXPAND_NAME | - HARD_LOOKUP); - if (tblresult->status != NIS_SUCCESS) { - /* still nothing. bail out */ - nis_freeresult (tblresult); - DEBUG (3, ("nis_lookup failure: %s\n", - nis_sperrno (tblresult->status))); - return nt_status; - } - /* we need full name for nis_add_entry() */ - safe_strcpy (pfiletmp, pfile, sizeof (pfiletmp) - 1); - safe_strcat (pfiletmp, ".", - sizeof (pfiletmp) - strlen (pfiletmp) - 1); - safe_strcat (pfiletmp, NIS_RES_OBJECT (tblresult)->zo_domain, - sizeof (pfiletmp) - strlen (pfiletmp) - 1); - } - - memset ((char *) &new_obj, 0, sizeof (new_obj)); - /* fill entry headers */ - /* we do not free these. */ - new_obj.zo_name = NIS_RES_OBJECT (tblresult)->zo_name; - new_obj.zo_owner = NIS_RES_OBJECT (tblresult)->zo_owner; - new_obj.zo_group = NIS_RES_OBJECT (tblresult)->zo_group; - new_obj.zo_domain = NIS_RES_OBJECT (tblresult)->zo_domain; - /* uints */ - new_obj.zo_access = NIS_RES_OBJECT (tblresult)->zo_access; - new_obj.zo_ttl = NIS_RES_OBJECT (tblresult)->zo_ttl; - - new_obj.zo_data.zo_type = ENTRY_OBJ; - new_obj.EN_data.en_type = NIS_RES_OBJECT (tblresult)->TA_data.ta_type; - - ta_maxcol = NIS_RES_OBJECT (tblresult)->TA_data.ta_maxcol; - - if (!(ecol = (entry_col *) malloc (ta_maxcol * sizeof (entry_col)))) { - DEBUG (0, ("memory allocation failure\n")); - nis_freeresult (tblresult); - return nt_status; - } - - memset ((char *) ecol, 0, ta_maxcol * sizeof (entry_col)); - new_obj.EN_data.en_cols.en_cols_val = ecol; - new_obj.EN_data.en_cols.en_cols_len = ta_maxcol; - - init_nisp_from_sam (&new_obj, newpwd, NULL); - - DEBUG (10, ("add NIS+ entry: %s\n", nisname)); - result = nis_add_entry (pfiletmp, &new_obj, 0); - - free (ecol); /* free allocated entry space */ - - if (result->status != NIS_SUCCESS) { - DEBUG (3, ("NIS+ table update failed: %s,%s\n", - nisname, nis_sperrno (result->status))); - nis_freeresult (tblresult); - nis_freeresult (result); - return nt_status; - } - - nis_freeresult (tblresult); - nis_freeresult (result); - - return NT_STATUS_OK; -} - -/*************************************************************** - make_nisname_from_user_rid - ****************************************************************/ -static char *make_nisname_from_user_rid (uint32 rid, char *pfile) -{ - static pstring nisname; - - safe_strcpy (nisname, "[user_rid=", sizeof (nisname) - 1); - slprintf (nisname, sizeof (nisname) - 1, "%s%d", nisname, rid); - safe_strcat (nisname, "],", sizeof (nisname) - strlen (nisname) - 1); - safe_strcat (nisname, pfile, sizeof (nisname) - strlen (nisname) - 1); - - return nisname; -} - -/*************************************************************** - make_nisname_from_name - ****************************************************************/ -static char *make_nisname_from_name (const char *user_name, char *pfile) -{ - static pstring nisname; - - safe_strcpy (nisname, "[name=", sizeof (nisname) - 1); - safe_strcat (nisname, user_name, - sizeof (nisname) - strlen (nisname) - 1); - safe_strcat (nisname, "],", sizeof (nisname) - strlen (nisname) - 1); - safe_strcat (nisname, pfile, sizeof (nisname) - strlen (nisname) - 1); - - return nisname; -} - -/************************************************************************* - gets a NIS+ attribute - *************************************************************************/ -static void get_single_attribute (const nis_object * new_obj, int col, - char *val, int len) -{ - int entry_len; - - if (new_obj == NULL || val == NULL) - return; - - entry_len = ENTRY_LEN (new_obj, col); - if (len > entry_len) { - len = entry_len; - } - - safe_strcpy (val, ENTRY_VAL (new_obj, col), len - 1); -} - -/************************************************************************ - makes a struct sam_passwd from a NIS+ object. - ************************************************************************/ -static BOOL make_sam_from_nisp_object (SAM_ACCOUNT * pw_buf, - const nis_object * obj) -{ - char *ptr; - pstring full_name; /* this must be translated to dos code page */ - pstring acct_desc; /* this must be translated to dos code page */ - pstring home_dir; /* set default value from smb.conf for user */ - pstring home_drive; /* set default value from smb.conf for user */ - pstring logon_script; /* set default value from smb.conf for user */ - pstring profile_path; /* set default value from smb.conf for user */ - pstring hours; - int hours_len; - unsigned char smbpwd[16]; - unsigned char smbntpwd[16]; - - - /* - * time values. note: this code assumes 32bit time_t! - */ - - /* Don't change these timestamp settings without a good reason. They are - important for NT member server compatibility. */ - - pdb_set_logon_time (pw_buf, (time_t) 0, PDB_DEFAULT); - ptr = (uchar *) ENTRY_VAL (obj, NPF_LOGON_T); - if (ptr && *ptr && (StrnCaseCmp (ptr, "LNT-", 4) == 0)) { - int i; - - ptr += 4; - for (i = 0; i < 8; i++) { - if (ptr[i] == '\0' || !isxdigit (ptr[i])) - break; - } - if (i == 8) { - pdb_set_logon_time (pw_buf, - (time_t) strtol (ptr, NULL, 16), - PDB_SET); - } - } - - pdb_set_logoff_time (pw_buf, get_time_t_max (), PDB_DEFAULT); - ptr = (uchar *) ENTRY_VAL (obj, NPF_LOGOFF_T); - if (ptr && *ptr && (StrnCaseCmp (ptr, "LOT-", 4) == 0)) { - int i; - - ptr += 4; - for (i = 0; i < 8; i++) { - if (ptr[i] == '\0' || !isxdigit (ptr[i])) - break; - } - if (i == 8) { - pdb_set_logoff_time (pw_buf, - (time_t) strtol (ptr, NULL, 16), - PDB_SET); - } - } - - pdb_set_kickoff_time (pw_buf, get_time_t_max (), PDB_DEFAULT); - ptr = (uchar *) ENTRY_VAL (obj, NPF_KICK_T); - if (ptr && *ptr && (StrnCaseCmp (ptr, "KOT-", 4) == 0)) { - int i; - - ptr += 4; - for (i = 0; i < 8; i++) { - if (ptr[i] == '\0' || !isxdigit (ptr[i])) - break; - } - if (i == 8) { - pdb_set_kickoff_time (pw_buf, - (time_t) strtol (ptr, NULL, 16), - PDB_SET); - } - } - - pdb_set_pass_last_set_time (pw_buf, (time_t) 0, PDB_DEFAULT); - ptr = (uchar *) ENTRY_VAL (obj, NPF_PWDLSET_T); - if (ptr && *ptr && (StrnCaseCmp (ptr, "LCT-", 4) == 0)) { - int i; - - ptr += 4; - for (i = 0; i < 8; i++) { - if (ptr[i] == '\0' || !isxdigit (ptr[i])) - break; - } - if (i == 8) { - pdb_set_pass_last_set_time (pw_buf, - (time_t) strtol (ptr, - NULL, - 16), - PDB_SET); - } - } - - pdb_set_pass_can_change_time (pw_buf, (time_t) 0, PDB_DEFAULT); - ptr = (uchar *) ENTRY_VAL (obj, NPF_PWDCCHG_T); - if (ptr && *ptr && (StrnCaseCmp (ptr, "CCT-", 4) == 0)) { - int i; - - ptr += 4; - for (i = 0; i < 8; i++) { - if (ptr[i] == '\0' || !isxdigit (ptr[i])) - break; - } - if (i == 8) { - pdb_set_pass_can_change_time (pw_buf, - (time_t) strtol (ptr, - NULL, - 16), - PDB_SET); - } - } - - pdb_set_pass_must_change_time (pw_buf, get_time_t_max (), PDB_DEFAULT); /* Password never expires. */ - ptr = (uchar *) ENTRY_VAL (obj, NPF_PWDMCHG_T); - if (ptr && *ptr && (StrnCaseCmp (ptr, "MCT-", 4) == 0)) { - int i; - - ptr += 4; - for (i = 0; i < 8; i++) { - if (ptr[i] == '\0' || !isxdigit (ptr[i])) - break; - } - if (i == 8) { - pdb_set_pass_must_change_time (pw_buf, - (time_t) strtol (ptr, - NULL, - 16), - PDB_SET); - } - } - - /* string values */ - pdb_set_username (pw_buf, ENTRY_VAL (obj, NPF_NAME), PDB_SET); - pdb_set_domain (pw_buf, lp_workgroup (), PDB_DEFAULT); - /* pdb_set_nt_username() -- cant set it here... */ - - get_single_attribute (obj, NPF_FULL_NAME, full_name, - sizeof (pstring)); -#if 0 - unix_to_dos (full_name, True); -#endif - pdb_set_fullname (pw_buf, full_name, PDB_SET); - - pdb_set_acct_ctrl (pw_buf, pdb_decode_acct_ctrl (ENTRY_VAL (obj, - NPF_ACB), PDB_SET)); - - get_single_attribute (obj, NPF_ACCT_DESC, acct_desc, - sizeof (pstring)); -#if 0 - unix_to_dos (acct_desc, True); -#endif - pdb_set_acct_desc (pw_buf, acct_desc, PDB_SET); - - pdb_set_workstations (pw_buf, ENTRY_VAL (obj, NPF_WORKSTATIONS), PDB_SET); - pdb_set_munged_dial (pw_buf, NULL, PDB_DEFAULT); - - pdb_set_user_sid_from_rid (pw_buf, - atoi (ENTRY_VAL (obj, NPF_USER_RID)), PDB_SET); - pdb_set_group_sid_from_rid (pw_buf, - atoi (ENTRY_VAL (obj, NPF_GROUP_RID)), PDB_SET); - - /* values, must exist for user */ - if (!(pdb_get_acct_ctrl (pw_buf) & ACB_WSTRUST)) { - - get_single_attribute (obj, NPF_HOME_DIR, home_dir, - sizeof (pstring)); - if (!(home_dir && *home_dir)) { - pstrcpy (home_dir, lp_logon_home ()); - pdb_set_homedir (pw_buf, home_dir, PDB_DEFAULT); - } else - pdb_set_homedir (pw_buf, home_dir, PDB_SET); - - get_single_attribute (obj, NPF_DIR_DRIVE, home_drive, - sizeof (pstring)); - if (!(home_drive && *home_drive)) { - pstrcpy (home_drive, lp_logon_drive ()); - pdb_set_dir_drive (pw_buf, home_drive, PDB_DEFAULT); - } else - pdb_set_dir_drive (pw_buf, home_drive, PDB_SET); - - get_single_attribute (obj, NPF_LOGON_SCRIPT, logon_script, - sizeof (pstring)); - if (!(logon_script && *logon_script)) { - pstrcpy (logon_script, lp_logon_script ()); - pdb_set_logon_script (pw_buf, logon_script, PDB_DEFAULT); - } else - pdb_set_logon_script (pw_buf, logon_script, PDB_SET); - - get_single_attribute (obj, NPF_PROFILE_PATH, profile_path, - sizeof (pstring)); - if (!(profile_path && *profile_path)) { - pstrcpy (profile_path, lp_logon_path ()); - pdb_set_profile_path (pw_buf, profile_path, PDB_DEFAULT); - } else - pdb_set_profile_path (pw_buf, profile_path, PDB_SET); - - } else { - /* lkclXXXX this is OBSERVED behaviour by NT PDCs, enforced here. */ - pdb_set_group_sid_from_rid (pw_buf, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT); - } - - /* Check the lanman password column. */ - ptr = (char *) ENTRY_VAL (obj, NPF_LMPWD); - if (!pdb_set_lanman_passwd (pw_buf, NULL, PDB_DEFAULT)) - return False; - - if (!strncasecmp (ptr, "NO PASSWORD", 11)) { - pdb_set_acct_ctrl (pw_buf, - pdb_get_acct_ctrl (pw_buf) | ACB_PWNOTREQ, PDB_SET); - } else { - if (strlen (ptr) != 32 || !pdb_gethexpwd (ptr, smbpwd)) { - DEBUG (0, ("malformed LM pwd entry: %s.\n", - pdb_get_username (pw_buf))); - return False; - } - if (!pdb_set_lanman_passwd (pw_buf, smbpwd, PDB_SET)) - return False; - } - - /* Check the NT password column. */ - ptr = ENTRY_VAL (obj, NPF_NTPWD); - if (!pdb_set_nt_passwd (pw_buf, NULL, PDB_DEFAULT)) - return False; - - if (!(pdb_get_acct_ctrl (pw_buf) & ACB_PWNOTREQ) && - strncasecmp (ptr, "NO PASSWORD", 11)) { - if (strlen (ptr) != 32 || !pdb_gethexpwd (ptr, smbntpwd)) { - DEBUG (0, ("malformed NT pwd entry:\ %s.\n", - pdb_get_username (pw_buf))); - return False; - } - if (!pdb_set_nt_passwd (pw_buf, smbntpwd, PDB_SET)) - return False; - } - - pdb_set_unknown_3 (pw_buf, 0xffffff, PDB_DEFAULT); /* don't know */ - pdb_set_logon_divs (pw_buf, 168, PDB_DEFAULT); /* hours per week */ - - if ((hours_len = ENTRY_LEN (obj, NPF_HOURS)) == 21) { - memcpy (hours, ENTRY_VAL (obj, NPF_HOURS), hours_len); - } else { - hours_len = 21; /* 21 times 8 bits = 168 */ - /* available at all hours */ - memset (hours, 0xff, hours_len); - } - pdb_set_hours_len (pw_buf, hours_len, PDB_SET); - pdb_set_hours (pw_buf, hours, PDB_SET); - - pdb_set_unknown_5 (pw_buf, 0x00020000, PDB_DEFAULT); /* don't know */ - pdb_set_unknown_6 (pw_buf, 0x000004ec, PDB_DEFAULT); /* don't know */ - - return True; -} - -/************************************************************************ - makes a struct sam_passwd from a NIS+ result. - ************************************************************************/ -static BOOL make_sam_from_nisresult (SAM_ACCOUNT * pw_buf, - const nis_result * result) -{ - if (pw_buf == NULL || result == NULL) - return False; - - if (result->status != NIS_SUCCESS && result->status != NIS_NOTFOUND) { - DEBUG (0, ("NIS+ lookup failure: %s\n", - nis_sperrno (result->status))); - return False; - } - - /* User not found. */ - if (NIS_RES_NUMOBJ (result) <= 0) { - DEBUG (10, ("user not found in NIS+\n")); - return False; - } - - if (NIS_RES_NUMOBJ (result) > 1) { - DEBUG (10, - ("WARNING: Multiple entries for user in NIS+ table!\n")); - } - - /* Grab the first hit. */ - return make_sam_from_nisp_object (pw_buf, - &NIS_RES_OBJECT (result)[0]); -} - -/************************************************************************* - sets a NIS+ attribute - *************************************************************************/ -static void set_single_attribute (nis_object * new_obj, int col, - const char *val, int len, int flags) -{ - if (new_obj == NULL) - return; - - ENTRY_VAL (new_obj, col) = val; - ENTRY_LEN (new_obj, col) = len + 1; - - if (flags != 0) { - new_obj->EN_data.en_cols.en_cols_val[col].ec_flags = flags; - } -} - -/*************************************************************** - copy or modify nis object. this object is used to add or update - nisplus table entry. - ****************************************************************/ -static BOOL init_nisp_from_sam (nis_object * obj, const SAM_ACCOUNT * sampass, - nis_object * old) -{ - /* - * Fill nis_object for entry add or update. - * if we are updateing, we have to find out differences and set - * EN_MODIFIED flag. also set need_to_modify to trigger - * nis_modify_entry() call in pdb_update_sam_account(). - * - * TODO: - * get data from SAM - * if (modify) get data from nis_object, compare and store if - * different + set EN_MODIFIED and need_to_modify - * else - * store - */ - BOOL need_to_modify = False; - const char *name = pdb_get_username (sampass); /* from SAM */ - - uint32 u_rid; - uint32 g_rid; - /* these must be static or allocate and free entry columns! */ - static fstring uid; /* from SAM */ - static fstring user_rid; /* from SAM */ - static fstring gid; /* from SAM */ - static fstring group_rid; /* from SAM */ - char *acb; /* from SAM */ - static fstring smb_passwd; /* from SAM */ - static fstring smb_nt_passwd; /* from SAM */ - static fstring logon_t; /* from SAM */ - static fstring logoff_t; /* from SAM */ - static fstring kickoff_t; /* from SAM */ - static fstring pwdlset_t; /* from SAM */ - static fstring pwdlchg_t; /* from SAM */ - static fstring pwdmchg_t; /* from SAM */ - static fstring full_name; /* from SAM */ - static fstring acct_desc; /* from SAM */ - static char empty[1]; /* just an empty string */ - - if (!(u_rid = pdb_get_user_rid (sampass))) - return False; - if (!(g_rid = pdb_get_group_rid (sampass))) - return False; - - slprintf (uid, sizeof (uid) - 1, "%u", fallback_pdb_user_rid_to_uid (u_rid)); - slprintf (user_rid, sizeof (user_rid) - 1, "%u", u_rid); - slprintf (gid, sizeof (gid) - 1, "%u", fallback_pdb_group_rid_to_uid (g_rid)); - slprintf (group_rid, sizeof (group_rid) - 1, "%u", g_rid); - - acb = pdb_encode_acct_ctrl (pdb_get_acct_ctrl (sampass), - NEW_PW_FORMAT_SPACE_PADDED_LEN); - pdb_sethexpwd (smb_passwd, pdb_get_lanman_passwd (sampass), - pdb_get_acct_ctrl (sampass)); - pdb_sethexpwd (smb_nt_passwd, pdb_get_nt_passwd (sampass), - pdb_get_acct_ctrl (sampass)); - slprintf (logon_t, 13, "LNT-%08X", - (uint32) pdb_get_logon_time (sampass)); - slprintf (logoff_t, 13, "LOT-%08X", - (uint32) pdb_get_logoff_time (sampass)); - slprintf (kickoff_t, 13, "KOT-%08X", - (uint32) pdb_get_kickoff_time (sampass)); - slprintf (pwdlset_t, 13, "LCT-%08X", - (uint32) pdb_get_pass_last_set_time (sampass)); - slprintf (pwdlchg_t, 13, "CCT-%08X", - (uint32) pdb_get_pass_can_change_time (sampass)); - slprintf (pwdmchg_t, 13, "MCT-%08X", - (uint32) pdb_get_pass_must_change_time (sampass)); - safe_strcpy (full_name, pdb_get_fullname (sampass), - sizeof (full_name) - 1); - safe_strcpy (acct_desc, pdb_get_acct_desc (sampass), - sizeof (acct_desc) - 1); - -#if 0 - - /* Not sure what to do with these guys. -tpot */ - - dos_to_unix (full_name, True); - dos_to_unix (acct_desc, True); - -#endif - - if (old) { - /* name */ - if (strcmp (ENTRY_VAL (old, NPF_NAME), name)) { - need_to_modify = True; - set_single_attribute (obj, NPF_NAME, name, - strlen (name), EN_MODIFIED); - } - - - /* uid */ - if (!ENTRY_VAL (old, NPF_UID) || strcmp (ENTRY_VAL (old, NPF_UID), uid)) { - need_to_modify = True; - set_single_attribute (obj, NPF_UID, uid, strlen (uid), EN_MODIFIED); - } - - /* user_rid */ - if (!ENTRY_VAL (old, NPF_USER_RID) || strcmp (ENTRY_VAL (old, NPF_USER_RID), user_rid)) { - need_to_modify = True; - set_single_attribute (obj, NPF_USER_RID, user_rid, strlen (user_rid), EN_MODIFIED); - } - - /* smb_grpid */ - if (!ENTRY_VAL (old, NPF_SMB_GRPID) || strcmp (ENTRY_VAL (old, NPF_SMB_GRPID), gid)) { - need_to_modify = True; - set_single_attribute (obj, NPF_SMB_GRPID, gid, strlen (gid), EN_MODIFIED); - } - - /* group_rid */ - if (!ENTRY_VAL (old, NPF_GROUP_RID) || strcmp (ENTRY_VAL (old, NPF_GROUP_RID), group_rid)) { - need_to_modify = True; - set_single_attribute (obj, NPF_GROUP_RID, group_rid, strlen (group_rid), EN_MODIFIED); - } - - /* acb */ - if (!ENTRY_VAL (old, NPF_ACB) || - strcmp (ENTRY_VAL (old, NPF_ACB), acb)) { - need_to_modify = True; - set_single_attribute (obj, NPF_ACB, acb, strlen (acb), - EN_MODIFIED); - } - - /* lmpwd */ - if (!ENTRY_VAL (old, NPF_LMPWD) || - strcmp (ENTRY_VAL (old, NPF_LMPWD), smb_passwd)) { - need_to_modify = True; - set_single_attribute (obj, NPF_LMPWD, smb_passwd, - strlen (smb_passwd), - EN_CRYPT | EN_MODIFIED); - } - - /* ntpwd */ - if (!ENTRY_VAL (old, NPF_NTPWD) || - strcmp (ENTRY_VAL (old, NPF_NTPWD), smb_nt_passwd)) { - need_to_modify = True; - set_single_attribute (obj, NPF_NTPWD, smb_nt_passwd, - strlen (smb_nt_passwd), - EN_CRYPT | EN_MODIFIED); - } - - /* logon_t */ - if (pdb_get_logon_time (sampass) && - (!ENTRY_VAL (old, NPF_LOGON_T) || - strcmp (ENTRY_VAL (old, NPF_LOGON_T), logon_t))) { - need_to_modify = True; - set_single_attribute (obj, NPF_LOGON_T, logon_t, - strlen (logon_t), EN_MODIFIED); - } - - /* logoff_t */ - if (pdb_get_logoff_time (sampass) && - (!ENTRY_VAL (old, NPF_LOGOFF_T) || - strcmp (ENTRY_VAL (old, NPF_LOGOFF_T), logoff_t))) { - need_to_modify = True; - set_single_attribute (obj, NPF_LOGOFF_T, logoff_t, - strlen (logoff_t), EN_MODIFIED); - } - - /* kick_t */ - if (pdb_get_kickoff_time (sampass) && - (!ENTRY_VAL (old, NPF_KICK_T) || - strcmp (ENTRY_VAL (old, NPF_KICK_T), kickoff_t))) { - need_to_modify = True; - set_single_attribute (obj, NPF_KICK_T, kickoff_t, - strlen (kickoff_t), - EN_MODIFIED); - } - - /* pwdlset_t */ - if (pdb_get_pass_last_set_time (sampass) && - (!ENTRY_VAL (old, NPF_PWDLSET_T) || - strcmp (ENTRY_VAL (old, NPF_PWDLSET_T), pwdlset_t))) { - need_to_modify = True; - set_single_attribute (obj, NPF_PWDLSET_T, pwdlset_t, - strlen (pwdlset_t), - EN_MODIFIED); - } - - /* pwdlchg_t */ - if (pdb_get_pass_can_change_time (sampass) && - (!ENTRY_VAL (old, NPF_PWDCCHG_T) || - strcmp (ENTRY_VAL (old, NPF_PWDCCHG_T), pwdlchg_t))) { - need_to_modify = True; - set_single_attribute (obj, NPF_PWDCCHG_T, pwdlchg_t, - strlen (pwdlchg_t), - EN_MODIFIED); - } - - /* pwdmchg_t */ - if (pdb_get_pass_must_change_time (sampass) && - (!ENTRY_VAL (old, NPF_PWDMCHG_T) || - strcmp (ENTRY_VAL (old, NPF_PWDMCHG_T), pwdmchg_t))) { - need_to_modify = True; - set_single_attribute (obj, NPF_PWDMCHG_T, pwdmchg_t, - strlen (pwdmchg_t), - EN_MODIFIED); - } - - /* full_name */ - /* must support set, unset and change */ - if ((pdb_get_fullname (sampass) && - !ENTRY_VAL (old, NPF_FULL_NAME)) || - (ENTRY_VAL (old, NPF_FULL_NAME) && - !pdb_get_fullname (sampass)) || - (ENTRY_VAL (old, NPF_FULL_NAME) && - pdb_get_fullname (sampass) && - strcmp (ENTRY_VAL (old, NPF_FULL_NAME), full_name))) { - need_to_modify = True; - set_single_attribute (obj, NPF_FULL_NAME, full_name, - strlen (full_name), - EN_MODIFIED); - } - - /* home_dir */ - /* must support set, unset and change */ - if ((pdb_get_homedir (sampass) && - !ENTRY_VAL (old, NPF_HOME_DIR)) || - (ENTRY_VAL (old, NPF_HOME_DIR) && - !pdb_get_homedir (sampass)) || - (ENTRY_VAL (old, NPF_HOME_DIR) && - pdb_get_homedir (sampass) && - strcmp (ENTRY_VAL (old, NPF_HOME_DIR), - pdb_get_homedir (sampass)))) { - need_to_modify = True; - set_single_attribute (obj, NPF_HOME_DIR, - pdb_get_homedir (sampass), - strlen (pdb_get_homedir - (sampass)), - EN_MODIFIED); - } - - /* dir_drive */ - /* must support set, unset and change */ - if ((pdb_get_dir_drive (sampass) && - !ENTRY_VAL (old, NPF_DIR_DRIVE)) || - (ENTRY_VAL (old, NPF_DIR_DRIVE) && - !pdb_get_dir_drive (sampass)) || - (ENTRY_VAL (old, NPF_DIR_DRIVE) && - pdb_get_dir_drive (sampass) && - strcmp (ENTRY_VAL (old, NPF_DIR_DRIVE), - pdb_get_dir_drive (sampass)))) { - need_to_modify = True; - set_single_attribute (obj, NPF_DIR_DRIVE, - pdb_get_dir_drive (sampass), - strlen (pdb_get_dir_drive - (sampass)), - EN_MODIFIED); - } - - /* logon_script */ - /* must support set, unset and change */ - if (((pdb_get_logon_script (sampass) && - !ENTRY_VAL (old, NPF_LOGON_SCRIPT)) || - ((ENTRY_VAL (old, NPF_LOGON_SCRIPT) && - (!pdb_get_logon_script (sampass)))) || - ((ENTRY_VAL (old, NPF_LOGON_SCRIPT) && - pdb_get_logon_script (sampass) && - strcmp (ENTRY_VAL (old, NPF_LOGON_SCRIPT), - pdb_get_logon_script (sampass)))))) { - need_to_modify = True; - set_single_attribute (obj, NPF_LOGON_SCRIPT, - pdb_get_logon_script (sampass), - strlen (pdb_get_logon_script - (sampass)), - EN_MODIFIED); - } - - /* profile_path */ - /* must support set, unset and change */ - if ((pdb_get_profile_path (sampass) && - !ENTRY_VAL (old, NPF_PROFILE_PATH)) || - (ENTRY_VAL (old, NPF_PROFILE_PATH) && - !pdb_get_profile_path (sampass)) || - (ENTRY_VAL (old, NPF_PROFILE_PATH) && - pdb_get_profile_path (sampass) && - strcmp (ENTRY_VAL (old, NPF_PROFILE_PATH), - pdb_get_profile_path (sampass)))) { - need_to_modify = True; - set_single_attribute (obj, NPF_PROFILE_PATH, - pdb_get_profile_path (sampass), - strlen (pdb_get_profile_path - (sampass)), - EN_MODIFIED); - } - - /* acct_desc */ - /* must support set, unset and change */ - if ((pdb_get_acct_desc (sampass) && - !ENTRY_VAL (old, NPF_ACCT_DESC)) || - (ENTRY_VAL (old, NPF_ACCT_DESC) && - !pdb_get_acct_desc (sampass)) || - (ENTRY_VAL (old, NPF_ACCT_DESC) && - pdb_get_acct_desc (sampass) && - strcmp (ENTRY_VAL (old, NPF_ACCT_DESC), acct_desc))) { - need_to_modify = True; - set_single_attribute (obj, NPF_ACCT_DESC, acct_desc, - strlen (acct_desc), - EN_MODIFIED); - } - - /* workstations */ - /* must support set, unset and change */ - if ((pdb_get_workstations (sampass) && - !ENTRY_VAL (old, NPF_WORKSTATIONS)) || - (ENTRY_VAL (old, NPF_WORKSTATIONS) && - !pdb_get_workstations (sampass)) || - (ENTRY_VAL (old, NPF_WORKSTATIONS) && - (pdb_get_workstations (sampass)) && - strcmp (ENTRY_VAL (old, NPF_WORKSTATIONS), - pdb_get_workstations (sampass)))) { - need_to_modify = True; - set_single_attribute (obj, NPF_WORKSTATIONS, - pdb_get_workstations (sampass), - strlen (pdb_get_workstations - (sampass)), - EN_MODIFIED); - } - - /* hours */ - if ((pdb_get_hours_len (sampass) != - ENTRY_LEN (old, NPF_HOURS)) - || memcmp (pdb_get_hours (sampass), - ENTRY_VAL (old, NPF_HOURS), ENTRY_LEN (old, - NPF_HOURS))) - { - need_to_modify = True; - /* set_single_attribute will add 1 for len ... */ - set_single_attribute (obj, NPF_HOURS, - pdb_get_hours (sampass), - pdb_get_hours_len (sampass) - 1, - EN_MODIFIED); - } - } else { - const char *homedir, *dirdrive, *logon_script, *profile_path, - *workstations; - - *empty = '\0'; /* empty string */ - - set_single_attribute (obj, NPF_NAME, name, strlen (name), 0); - set_single_attribute (obj, NPF_UID, uid, strlen (uid), 0); - set_single_attribute (obj, NPF_USER_RID, user_rid, - strlen (user_rid), 0); - set_single_attribute (obj, NPF_SMB_GRPID, gid, strlen (gid), - 0); - set_single_attribute (obj, NPF_GROUP_RID, group_rid, - strlen (group_rid), 0); - set_single_attribute (obj, NPF_ACB, acb, strlen (acb), 0); - set_single_attribute (obj, NPF_LMPWD, smb_passwd, - strlen (smb_passwd), EN_CRYPT); - set_single_attribute (obj, NPF_NTPWD, smb_nt_passwd, - strlen (smb_nt_passwd), EN_CRYPT); - set_single_attribute (obj, NPF_LOGON_T, logon_t, - strlen (logon_t), 0); - set_single_attribute (obj, NPF_LOGOFF_T, logoff_t, - strlen (logoff_t), 0); - set_single_attribute (obj, NPF_KICK_T, kickoff_t, - strlen (kickoff_t), 0); - set_single_attribute (obj, NPF_PWDLSET_T, pwdlset_t, - strlen (pwdlset_t), 0); - set_single_attribute (obj, NPF_PWDCCHG_T, pwdlchg_t, - strlen (pwdlchg_t), 0); - set_single_attribute (obj, NPF_PWDMCHG_T, pwdmchg_t, - strlen (pwdmchg_t), 0); - set_single_attribute (obj, NPF_FULL_NAME, - full_name, strlen (full_name), 0); - - if (!(homedir = pdb_get_homedir (sampass))) - homedir = empty; - - set_single_attribute (obj, NPF_HOME_DIR, - homedir, strlen (homedir), 0); - - if (!(dirdrive = pdb_get_dir_drive (sampass))) - dirdrive = empty; - - set_single_attribute (obj, NPF_DIR_DRIVE, - dirdrive, strlen (dirdrive), 0); - - if (!(logon_script = pdb_get_logon_script (sampass))) - logon_script = empty; - - set_single_attribute (obj, NPF_LOGON_SCRIPT, - logon_script, strlen (logon_script), 0); - - if (!(profile_path = pdb_get_profile_path (sampass))) - profile_path = empty; - - set_single_attribute (obj, NPF_PROFILE_PATH, - profile_path, strlen (profile_path), 0); - - set_single_attribute (obj, NPF_ACCT_DESC, - acct_desc, strlen (acct_desc), 0); - - if (!(workstations = pdb_get_workstations (sampass))) - workstations = empty; - - set_single_attribute (obj, NPF_WORKSTATIONS, - workstations, strlen (workstations), 0); - - /* set_single_attribute will add 1 for len ... */ - set_single_attribute (obj, NPF_HOURS, - pdb_get_hours (sampass), - pdb_get_hours_len (sampass) - 1, 0); - } - - return need_to_modify; -} - -/*************************************************************** - calls nis_list, returns results. - ****************************************************************/ -static nis_result *nisp_get_nis_list (const char *nisname, unsigned int flags) -{ - nis_result *result; - int i; - - if (!flags) - flags = FOLLOW_LINKS | FOLLOW_PATH | EXPAND_NAME | - HARD_LOOKUP; - - for (i = 0; i < 2; i++) { - alarm (60); /* hopefully ok for long searches */ - result = nis_list (nisname, flags, NULL, NULL); - - alarm (0); - CatchSignal (SIGALRM, SIGNAL_CAST SIG_DFL); - - if (!(flags & MASTER_ONLY) && NIS_RES_NUMOBJ (result) <= 0) { - /* nis replicas are not in sync perhaps? - * this can happen, if account was just added. - */ - DEBUG (10, ("will try master only\n")); - nis_freeresult (result); - flags |= MASTER_ONLY; - } else - break; - } - return result; -} - -static void free_private_data(void **vp) -{ - struct nisplus_private_info **private = (struct nisplus_private_info **)vp; - - if ((*private)->result) { - nis_freeresult ((*private)->result); - } - - free(*private); - - /* No need to free any further, as it is talloc()ed */ -} - -NTSTATUS pdb_init_nisplussam (PDB_CONTEXT * pdb_context, - PDB_METHODS ** pdb_method, const char *location) -{ - NTSTATUS nt_status; - struct nisplus_private_info *private = malloc (sizeof (struct nisplus_private_info)); - - ZERO_STRUCT(private); - p->location = talloc_strdup(pdb_context->mem_ctx, location); - - if (!NT_STATUS_IS_OK - (nt_status = - make_pdb_methods (pdb_context->mem_ctx, pdb_method))) { - return nt_status; - } - - (*pdb_method)->name = "nisplussam"; - - /* Functions your pdb module doesn't provide should be set - * to NULL */ - - (*pdb_method)->setsampwent = nisplussam_setsampwent; - (*pdb_method)->endsampwent = nisplussam_endsampwent; - (*pdb_method)->getsampwent = nisplussam_getsampwent; - (*pdb_method)->getsampwnam = nisplussam_getsampwnam; - (*pdb_method)->getsampwsid = nisplussam_getsampwsid; - (*pdb_method)->add_sam_account = nisplussam_add_sam_account; - (*pdb_method)->update_sam_account = nisplussam_update_sam_account; - (*pdb_method)->delete_sam_account = nisplussam_delete_sam_account; - (*pdb_method)->free_private_data = free_private_data; - (*pdb_method)->private_data = private; - - return NT_STATUS_OK; -} - -NTSTATUS pdb_nisplus_init(void) -{ - return smb_register_passdb(PASSDB_INTERFACE_VERSION, "nisplussam", pdb_init_nisplussam); -} diff --git a/source3/passdb/pdb_unix.c b/source3/passdb/pdb_unix.c deleted file mode 100644 index 395795758f..0000000000 --- a/source3/passdb/pdb_unix.c +++ /dev/null @@ -1,131 +0,0 @@ -/* - * Unix password backend for samba - * Copyright (C) Jelmer Vernooij 2002 - * - * This program is free software; you can redistribute it and/or modify it under - * the terms of the GNU General Public License as published by the Free - * Software Foundation; either version 2 of the License, or (at your option) - * any later version. - * - * This program is distributed in the hope that it will be useful, but WITHOUT - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for - * more details. - * - * You should have received a copy of the GNU General Public License along with - * this program; if not, write to the Free Software Foundation, Inc., 675 - * Mass Ave, Cambridge, MA 02139, USA. - */ - -#include "includes.h" - -/****************************************************************** - Lookup a name in the SAM database - ******************************************************************/ - -static NTSTATUS unixsam_getsampwnam (struct pdb_methods *methods, SAM_ACCOUNT *user, const char *sname) -{ - struct passwd *pass; - if (!methods) { - DEBUG(0,("invalid methods\n")); - return NT_STATUS_UNSUCCESSFUL; - } - if (!sname) { - DEBUG(0,("invalid name specified")); - return NT_STATUS_UNSUCCESSFUL; - } - pass = Get_Pwnam(sname); - - return pdb_fill_sam_pw(user, pass); -} - - -/*************************************************************************** - Search by rid - **************************************************************************/ - -static NTSTATUS unixsam_getsampwrid (struct pdb_methods *methods, - SAM_ACCOUNT *user, uint32 rid) -{ - NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL; - struct passwd *pass = NULL; - const char *guest_account = lp_guestaccount(); - if (!(guest_account && *guest_account)) { - DEBUG(1, ("NULL guest account!?!?\n")); - return nt_status; - } - - if (!methods) { - DEBUG(0,("invalid methods\n")); - return nt_status; - } - - if (rid == DOMAIN_USER_RID_GUEST) { - pass = getpwnam_alloc(guest_account); - if (!pass) { - DEBUG(1, ("guest account %s does not seem to exist...\n", guest_account)); - return nt_status; - } - } else if (fallback_pdb_rid_is_user(rid)) { - pass = getpwuid_alloc(fallback_pdb_user_rid_to_uid (rid)); - } - - if (pass == NULL) { - return nt_status; - } - - nt_status = pdb_fill_sam_pw(user, pass); - passwd_free(&pass); - - return nt_status; -} - -static NTSTATUS unixsam_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUNT * user, const DOM_SID *sid) -{ - uint32 rid; - if (!sid_peek_check_rid(get_global_sam_sid(), sid, &rid)) - return NT_STATUS_UNSUCCESSFUL; - return unixsam_getsampwrid(my_methods, user, rid); -} - -/*************************************************************************** - Updates a SAM_ACCOUNT - - This isn't a particulary practical option for pdb_unix. We certainly don't - want to twidde the filesystem, so what should we do? - - Current plan is to transparently add the account. It should appear - as if the pdb_unix version was modified, but its actually stored somehwere. - ****************************************************************************/ - -static NTSTATUS unixsam_update_sam_account (struct pdb_methods *methods, SAM_ACCOUNT *newpwd) -{ - return methods->parent->pdb_add_sam_account(methods->parent, newpwd); -} - -NTSTATUS pdb_init_unixsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location) -{ - NTSTATUS nt_status; - - if (!pdb_context) { - DEBUG(0, ("invalid pdb_context specified\n")); - return NT_STATUS_UNSUCCESSFUL; - } - - if (!NT_STATUS_IS_OK(nt_status = make_pdb_methods(pdb_context->mem_ctx, pdb_method))) { - return nt_status; - } - - (*pdb_method)->name = "unixsam"; - (*pdb_method)->update_sam_account = unixsam_update_sam_account; - (*pdb_method)->getsampwnam = unixsam_getsampwnam; - (*pdb_method)->getsampwsid = unixsam_getsampwsid; - - /* There's not very much to initialise here */ - return NT_STATUS_OK; -} - -NTSTATUS pdb_unix_init(void) -{ - return smb_register_passdb(PASSDB_INTERFACE_VERSION, "unixsam", pdb_init_unixsam); -} diff --git a/source3/script/cvslog.pl b/source3/script/cvslog.pl deleted file mode 100755 index f3d020aa72..0000000000 --- a/source3/script/cvslog.pl +++ /dev/null @@ -1,102 +0,0 @@ -#!/usr/bin/perl -w - -my ( $tag, $filename, $date ); -my ( $tmp, $change_flag ); - -if ( $#ARGV != 2 ) { - - print "Usage: ", $0, " cvstag date file\n"; - exit 1; -} - -$tag = $ARGV[0]; -$date = $ARGV[1]; -$filename = $ARGV[2]; - -print STDERR "$filename\n"; - -open ( CVSLOG, "cvs log -d\"$date\" $filename |" ) || die $!; - -## -## First get the branch revision number -## -undef $revision; -while ( !defined($revision) ) { - if ( eof( \*CVSLOG ) ) { - print STDERR "Premature end of cvs log output!\n"; - exit (1); - } - - $string = ; - chomp( $string ); - - if ( $string =~ /$tag:/ ) { - ( $tmp, $revision ) = split( /:/, $string ); - $revision =~ s/\s+//g; - $revision =~ s/\.0\./\./g; - } -} - -## -## Setup the beginning of the first record -## -$string = ""; -while ( $string !~ /^-+/ ) { - $string = ; - exit(0) if ( eof(\*CVSLOG) ); -} - -## -## Loop starting at the revision number for the entry -## - -while ( $string = ) { - - ($tmp, $entry_rev) = split( /\s+/, $string ); - if ( equal_revision( $revision, $entry_rev ) ) { - if ( ! defined($change_flag) ) { - print "++++++++++++++++++++++++++++++++++++++++++++++++++\n"; - print "## $filename\n"; - print "++\n"; - $change_flag = 1; - } - - while ( $string !~ /^-+/ && !eof(CVSLOG) ) { - print "$string"; - $string = ; - } - } - else { - while ( ($string !~ /^-+/) && !eof(CVSLOG) ) { - $string = ; - } - } -} - -close( CVSLOG ); -exit 0; - -############################################################## -## -sub equal_revision { - my ( $branch, $newfile ) = @_; - my ( $indx ); - my ( @branch_rev, @file_rev ); - - @branch_rev = split( /\./, $branch ); - @file_rev = split( /\./, $newfile ); - - return 0 if ( $#branch_rev != ($#file_rev - 1) ); - - $indx = 0; - while( $indx <= $#branch_rev ) { - if ( $branch_rev[$indx] != $file_rev[$indx] ) { - return 0; - } - $indx++; - } - - return 1; -} - - -- cgit From f83a6ce2adbdd471809ccbcfd69dc3fcf6d89129 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 11:12:43 +0000 Subject: another round of syncs for HEAD that I forget (This used to be commit 3aaf65d297d20320dc1f2c0ac0487feb47873609) --- README | 89 +-- WHATSNEW.txt | 346 +++++++++-- packaging/Debian/debian/libsmbclient.postinst | 12 - packaging/Debian/debian/patches/configure.patch | 32 - packaging/Debian/debian/patches/krb5-vars.patch | 688 --------------------- .../debian/patches/pam_smbpass_linkage.patch | 24 - packaging/Debian/debian/patches/smbadduser.patch | 23 - .../Debian/debian/patches/smbclient-tar.patch | 43 -- packaging/Debian/debian/python2.2-samba.files | 1 - packaging/Debian/debian/samba-common.conffiles | 3 - packaging/Debian/debian/samba.conffiles | 3 - packaging/Debian/debian/swat.docs | 1 - packaging/Debian/debian/winbind.conffiles | 2 - packaging/Mandrake/samba-2.2.0-gawk.patch | 11 - packaging/Mandrake/samba-2.2.5-gp-reloc-fix.patch | 12 - packaging/Mandrake/smbmount-sbin.patch | 15 - packaging/Mandrake/swat_16.xpm.bz2 | Bin 1003 -> 0 bytes packaging/Mandrake/swat_32.xpm.bz2 | Bin 2727 -> 0 bytes packaging/Mandrake/swat_48.xpm.bz2 | Bin 3051 -> 0 bytes packaging/README.UnixWare | 6 - packaging/RedHat/samba2.spec.tmpl | 429 ------------- packaging/SGI/relnotes.html | 21 +- packaging/Solaris/makepkg.sh | 154 ----- swat/README | 77 --- swat/help/welcome.html | 20 +- swat/images/globals.gif | Bin 628 -> 2004 bytes swat/images/home.gif | Bin 580 -> 2044 bytes swat/images/passwd.gif | Bin 613 -> 1993 bytes swat/images/printers.gif | Bin 705 -> 2077 bytes swat/images/shares.gif | Bin 569 -> 2006 bytes swat/images/status.gif | Bin 578 -> 2080 bytes swat/images/viewconfig.gif | Bin 820 -> 1939 bytes swat/images/wizard.gif | Bin 853 -> 2554 bytes 33 files changed, 390 insertions(+), 1622 deletions(-) delete mode 100644 packaging/Debian/debian/libsmbclient.postinst delete mode 100644 packaging/Debian/debian/patches/configure.patch delete mode 100644 packaging/Debian/debian/patches/krb5-vars.patch delete mode 100644 packaging/Debian/debian/patches/pam_smbpass_linkage.patch delete mode 100644 packaging/Debian/debian/patches/smbadduser.patch delete mode 100644 packaging/Debian/debian/patches/smbclient-tar.patch delete mode 100644 packaging/Debian/debian/python2.2-samba.files delete mode 100644 packaging/Debian/debian/samba-common.conffiles delete mode 100644 packaging/Debian/debian/samba.conffiles delete mode 100644 packaging/Debian/debian/swat.docs delete mode 100644 packaging/Debian/debian/winbind.conffiles delete mode 100644 packaging/Mandrake/samba-2.2.0-gawk.patch delete mode 100644 packaging/Mandrake/samba-2.2.5-gp-reloc-fix.patch delete mode 100644 packaging/Mandrake/smbmount-sbin.patch delete mode 100644 packaging/Mandrake/swat_16.xpm.bz2 delete mode 100644 packaging/Mandrake/swat_32.xpm.bz2 delete mode 100644 packaging/Mandrake/swat_48.xpm.bz2 delete mode 100644 packaging/README.UnixWare delete mode 100644 packaging/RedHat/samba2.spec.tmpl delete mode 100755 packaging/Solaris/makepkg.sh delete mode 100644 swat/README diff --git a/README b/README index 725a26523a..f529610ef4 100644 --- a/README +++ b/README @@ -1,5 +1,5 @@ This is a development version of Samba, the free SMB and CIFS client and -server for unix and other operating systems. Samba is maintained by +server for UNIX and other operating systems. Samba is maintained by the Samba Team, who support the original author, Andrew Tridgell. >>>> Please read THE WHOLE of this file as it gives important information @@ -13,35 +13,36 @@ copy of which you should have received with this software (in a file called COPYING). -WHAT IS SMB? -============ +WHAT IS SMB/CIFS? +================= This is a big question. The very short answer is that it is the protocol by which a lot of PC-related machines share files and printers and other information such as lists of available files and printers. Operating systems that -support this natively include Windows NT, OS/2, and Linux and add on -packages that achieve the same thing are available for DOS, Windows, -VMS, Unix of all kinds, MVS, and more. Apple Macs and some Web Browsers -can speak this protocol as well. Alternatives to SMB include -Netware, NFS, Appletalk, Banyan Vines, Decnet etc; many of these have -advantages but none are both public specifications and widely -implemented in desktop machines by default. - -The Common Internet Filesystem (CIFS) is what the new SMB initiative +support this natively include Windows 9x, Windows NT (and derivatives), +OS/2, Mac OS X and Linux. Add on packages that achieve the same +thing are available for DOS, Windows 3.1, VMS, Unix of all kinds, +MVS, and more. Some Web Browsers can speak this protocol as well +(smb://). Alternatives to SMB include Netware, NFS, Appletalk, +Banyan Vines, Decnet etc; many of these have advantages but none are +both public specifications and widely implemented in desktop machines +by default. + +The Common Internet File system (CIFS) is what the new SMB initiative is called. For details watch http://samba.org/cifs. WHY DO PEOPLE WANT TO USE SMB? ============================== -1. Many people want to integrate their Microsoft or IBM style desktop - machines with their Unix or VMS (etc) servers. +1. Many people want to integrate their Microsoft desktop clients + with their Unix servers. 2. Others want to integrate their Microsoft (etc) servers with Unix - or VMS (etc) servers. This is a different problem to integrating - desktop clients. + servers. This is a different problem to integrating desktop + clients. 3. Others want to replace protocols like NFS, DecNet and Novell NCP, especially when used with PCs. @@ -50,18 +51,26 @@ WHY DO PEOPLE WANT TO USE SMB? WHAT CAN SAMBA DO? ================== -Here is a very short list of what samba includes, and what it does. For -many networks this can be simply summarised by "Samba provides a complete -replacement for Windows NT, Warp, NFS or Netware servers." +Please refer to the WHATSNEW.txt included with this README for +a list of features in the latest Samba release. + +Here is a very short list of what samba includes, and what it does. +For many networks this can be simply summarized by "Samba provides +a complete replacement for Windows NT, Warp, NFS or Netware servers." - a SMB server, to provide Windows NT and LAN Manager-style file and print services to SMB clients such as Windows 95, Warp Server, smbfs and others. +- a Windows NT 4.0 Domain Controller replacement. + +- a file/print server that can act as a member of a Windows NT 4.0 + or Active Directory domain. + - a NetBIOS (rfc1001/1002) nameserver, which amongst other things gives browsing support. Samba can be the master browser on your LAN if you wish. - a ftp-like SMB client so you can access PC resources (disks and -printers) from unix, Netware and other operating systems + printers) from UNIX, Netware, and other operating systems - a tar extension to the client for backing up PCs @@ -73,16 +82,14 @@ http://samba.org/samba, and browse the user survey. Related packages include: -- smbfs, a linux-only filesystem allowing you to mount remote SMB -filesystems from PCs on your linux box. This is included as standard with +- smbfs, a Linux-only filesystem allowing you to mount remote SMB +filesystems from PCs on your Linux box. This is included as standard with Linux 2.0 and later. -- tcpdump-smb, a extension to tcpdump to allow you to investigate SMB -networking problems over netbeui and tcp/ip. +- cifsvfs, a more advanced Linux-only filesystem allowing you to mount +remote SMB filesystems from PCs on your Linux box. This is included +as standard with Linux 2.5 and later. -- smblib, a library of smb functions which are designed to make it -easy to smb-ise any particular application. See -ftp://samba.org/pub/samba/smblib. CONTRIBUTIONS @@ -90,9 +97,10 @@ CONTRIBUTIONS If you want to contribute to the development of the software then please join the mailing list. The Samba team accepts patches -(preferably in "diff -u" format, see docs/BUGS.txt for more details) -and are always glad to receive feedback or suggestions to the address -samba@lists.samba.org. +(preferably in "diff -u" format, see http://samba.org/samba/devel/ +for more details) and are always glad to receive feedback or +suggestions to the address samba@lists.samba.org. More information +on the various Samba mailing lists can be found at http://lists.samba.org/. You can also get the Samba sourcecode straight from the CVS tree - see http://samba.org/cvs.html. @@ -107,7 +115,7 @@ If you like a particular feature then look through the CVS change-log who added it, then send them an email. Remember that free software of this kind lives or dies by the response -we get. If noone tells us they like it then we'll probably move onto +we get. If no one tells us they like it then we'll probably move onto something else. However, as you can see from the user survey quite a lot of people do seem to like it at the moment :-) @@ -119,17 +127,16 @@ DOCUMENTATION ------------- There is quite a bit of documentation included with the package, -including man pages, and lots of .txt files with hints and useful +including man pages, and lots of .html files with hints and useful info. This is also available from the web page. There is a growing -collection of information under docs/faq; by the next release expect -this to be the default starting point. +collection of information under docs/. A list of Samba documentation in languages other than English is available on the web page. If you would like to help with the documentation (and we _need_ help!) then have a look at the mailing list samba-docs, archived at -http://lists.samba.org/ +http://lists.samba.org/listinfo/samba-docs/ MAILING LIST @@ -197,12 +204,12 @@ A few tips when submitting to this or any mailing list. NEWS GROUP ---------- -You might also like to look at the usenet news group -comp.protocols.smb as it often contains lots of useful info and is -frequented by lots of Samba users. The newsgroup was initially setup -by people on the Samba mailing list. It is not, however, exclusive to -Samba, it is a forum for discussing the SMB protocol (which Samba -implements). The samba list is gatewayed to this newsgroup. +You might also like to look at the usenet news group comp.protocols.smb +as it often contains lots of useful info and is frequented by lots of +Samba users. The newsgroup was initially setup by people on the Samba +mailing list. It is not, however, exclusive to Samba, it is a forum for +discussing the SMB protocol (which Samba implements). The samba list +is gatewayed to this newsgroup. WEB SITE diff --git a/WHATSNEW.txt b/WHATSNEW.txt index c264e6a3c7..4a3c3e1d0a 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -1,29 +1,22 @@ - WHATS NEW IN Samba 3.0.0 beta4 - July 16 2003 + WHATS NEW IN Samba 3.0.0 RC3 + September 8, 2003 ============================== -This is the third beta release of Samba 3.0.0. This is a -non-production release intended for testing purposes. Use -at your own risk. +This is the third release candidate snapshot of Samba 3.0.0. A release +candidate implies that the code is very close to a final release, remember +that this is still a non-production release intended for testing purposes. +Use at your own risk. -The purpose of this beta release is to get wider testing of the major -new pieces of code in the current Samba 3.0 development tree. We have -officially ceased development on the 2.2.x release of Samba and are -concentrating on Samba 3.0. To reduce the time before the final -Samba 3.0 release we need as many people as possible to start testing -these beta releases, and to provide high quality feedback on what -needs fixing. - -Samba 3.0 is feature complete. However there is still some final -work to be done on certain pieces of functionality. Please refer to -the section on "Known Issues" for more details. +The purpose of this release candidate is to get wider testing of the major +new pieces of code in the current Samba 3.0 development tree. +Please refer to the section on "Known Issues" for more details. Major new features: ------------------- 1) Active Directory support. Samba 3.0 is now able to - to join a ADS realm as a member server and authenticate + join a ADS realm as a member server and authenticate users using LDAP/Kerberos. 2) Unicode support. Samba will now negotiate UNICODE on the wire and @@ -34,9 +27,7 @@ Major new features: been almost completely rewritten. Most of the changes are internal, but the new auth system is also very configurable. -4) New filename mangling system. The filename mangling system has been - completely rewritten. An internal database now stores mangling maps - persistently. This needs lots of testing. +4) New default filename mangling system. 5) A new "net" command has been added. It is somewhat similar to the "net" command in windows. Eventually we plan to replace @@ -49,9 +40,10 @@ Major new features: 7) Better Windows 2000/XP/2003 printing support including publishing printer attributes in active directory. -8) New loadable RPC modules. +8) New loadable module support for passdb backends and + character sets. -9) New dual-daemon winbindd support for better performance. +9) New default dual-daemon winbindd support for better performance. 10) Support for migrating from a Windows NT 4.0 domain to a Samba domain and maintaining user, group and domain SIDs. @@ -64,25 +56,257 @@ Major new features: 13) Major updates to the Samba documentation tree. +14) Full support for client and server SMB signing to ensure + compatibility with default Windows 2003 security settings. + Plus lots of other improvements! Additional Documentation ------------------------ -Please refer to Samba documentation tree (including in the docs/ +Please refer to Samba documentation tree (included in the docs/ subdirectory) for extensive explanations of installing, configuring and maintaining Samba 3.0 servers and clients. It is advised to begin with the Samba-HOWTO-Collection for overviews and specific tasks (the current book is up to approximately 400 pages) and to refer to the various man pages for information on individual options. +We are very glad to be able to include the second edition of +"Using Samba" by Jay Ts, Robert Eckstein, and David Collier-Brown +(O'Reilly & Associates) in this release. The book is available +on-line at http://samba.org/samba/docs/ and is included with +the Samba Web Administration Tool (SWAT). Thanks to the authors and +publisher for making "Using Samba" under the GNU Free Documentation +License. + + ###################################################################### -Changes since 3.0beta2 -###################### +Changes since 3.0rc2 +#################### Please refer to the CVS log for the SAMBA_3_0 branch for complete -details +details: + +1) Remove Perl module dependencies in generated RedHat 8/9 RPMS. +2) Update mount helper to take synonyms for file_mode and + dir_mode (fmask and dmask). +3) Fix portability bug with log2pcaphex. +4) Use different algorithm to generate codepages source code which + allows to take gaps into account thus making unnecessary + extended [index] = value, syntax in to_ucs2 array (bug 380). +5) Fix comment strings to 43 bytes as per spec. +6) Fix pam_winbind compile bug on FreeBSD (bug 261). +7) Support for in-memory keytabs, which are needed to make heimdal + work properly. MIT does not support them, so this check will be + used to decide whether to use them. (partial fix for bug 372). +8) Disable RC4-HMAC on broken heimdal setups. (remainder of bug + 372). +9) Correct bug in smbclient that resulted in errors when untarring + long filenames (bug 308). +10) Improve autoconf checks for PAM header files and libs. +11) Added fast path to convert_string() when dealing with + ASCII->ASCII, UCS2-LE->ASCII, and ASCII->UCS2-LE with + values <= 0x7F. +12) Quiet debug messages when we don't find a module and it is not + a critical error (bug 375). +13) Fix UNIX passwd sync properly. +14) Fix more transitive trust issues in winbindd (bug 305). +15) Ensure that winbindd functions with 'disable netbios = yes' +16) Store the real short domain name in secrets.tdb as soon as we + know it. Also display an error message when joining an AD + domain and the 'workgroup' parameter has not been specified. +17) Return 0 DFS links instead of -1 when dfs support is not enabled. +18) Update LDAP schema for Netscape DS 4.x and Novell eDirectory 8.7 +19) Ensure that name types can be specified using name#type notation + in the 'net' command (bug 73). +20) Add retry looks to ADS sequence number and domain SID lookups + (bug 364). +21) use a variant of alloc_sub_basic() for string lists such as + 'valid users', 'write list', and 'read list' (bug 397). +22) Fix seg fault when winbindd receives an error from the AD server + in response to an LDAP search (bug 282). +23) Update findsmb to use the new syntax for smbclient and nmblookup. +24) Fix bug that prevented variables from being used in explicitly + defined path in [homes]. +25) Only set SIDs when they're returned by the MySQL query + (pdb_mysql.so). +26) Include support for NTLMv2 key exchange. +27) Revert default for 'client ntlmv2 auth' to off (bug 359). +28) Fix crash in winbindd when the trust account password gets + changed underneath us via 'net rpc changetrustpw' (bug 382). +29) Use djb-algorithm string hash - faster than the tdb one we + used to use. Does not change on disk format or hashing location. +30) Implements some kind of improved AFS support for Samba on + Linux with OpenAFS 1.2.10. './configure --with-fake-kaserver' + assumes that you have OpenAFS on your machine. +31) When enumerating dfs shares loop from 0 to lp_numservices() instead + of relying on lp_servicename(n) to return an empty string for + invalid service numbers (bug 403). +32) Fix crash bug in 'net rpc samdump' (bug 334). +33) Fix crash bug in WINS NSS module (bug 299). +34) Fix a few minor compile errors on HP-UX. + + + +Changes since 3.0rc1 +#################### + +1) Add levels 261 and 262 to search. Found using Samba4 tester. +2) Correct bad error return code in session setup reply +3) Fix bug where smbd returned DOS error codes from SMBsearch + even when NT1 protocol was negotiated. +4) Implement SMBexit properly. +5) Return group lists from a Samba PDC to a Windows 9x/ME box + in implementing user level access control (bug 314). +6) Prevent SWAT from crashing when adding shares (bug 254) +7) Fix various documentation issues (bugs 304 & 214) +8) Fix wins server listing in SWAT (bug 197) +9) Fix problem in rpcclient that caused enumerating printer + drivers to report failure (bug 294). +10) Use kerberos 5 authentication in our client code whenever possible +11) Fix schannel bug that caused Active Directory DC's to downgrade our + machine account to an NT member. +12) Implement missing SAMR_REMOVE_USER_FOREIGN_DOMAIN call (bug 252). +13) Implement automatic generation of include/version.h +14) Include initial version of smbldap-tool scripts for the Samba + 3.0 schema. +15) Implement numerous fixes for multi-byte character strings. +16) Enable 'unix extensions' parameter by default. +17) Make sure we set the SID type when falling back to the rid + algorithm (bug 245). +18) Correct linking problems with pam_smbpass (bug 327). +19) Add SYSV defines for Irix and Solaris to ensure the 'printing' + parameter default to the correct value (bug 230) +20) Fix recursion bug in alloc_string_sub() (bug 289, et. al.) +21) Ensure that 'make install' includes the static and shared + versions of the libsmbclient libraries. +22) Add CP850 and CP437 internal character set support (bug 150). +23) Add support to examples/LDAP/convertSambaAccount for generating + LDIF modify files instead of just add (303). +24) Fix support for -W option in smbclient (bug 39) +25) Remove 'ldap trust ids' parameter since it could not be supported + by the current architecture. +26) Don't crash when no argument is given to -T in smbclient (bug 345). +27) Ensure smbadduser contains the same paths for the smbpasswd file + as the other Samba tools (bug 290). +28) Port of 'available = no' fix for [homes] from SAMBA_2_2 cvs tree. +29) Add sanity checks to DeletePrinterData[Ex]() and ensure that the + modified printer is written to disk. +30) Force winbindd to periodically update the trusted domain cache. +31) Remove outdated import/export script to convert an smbpasswd file + to and from and LDAP directory. Use the pdbedit tool instead. +32) Ensure that %U substitution is restored on next valid packet + if a logon fails. + + +Changes since 3.0beta3 +###################### + +1) Various memory leak fixes. +2) Provide full support for SMB signing (server and client) +3) Check for broken getgrouplist() in glibc. +4) Don't get stuck in an infinite loop listing directories + recursively if the server returns an empty directory name + (bug 222). +5) Idle LDAP connections after 150 seconds. +6) Patched make uninstallmodules (bug 236). +7) Fix bug that caused smbd to return incomplete directory listings + when UNIX files contained MS wildcard characters. +8) Quiet default debug messages in command line tools. +9) Fixes to avoid panics on invalid multi-byte strings. +10) Fix error messages when creating a new smbpasswd file (bug 198). +11) Implemented better detection routines in autoconf scripts for + locating ads support on the host OS. +12) Fix bug that caused libraries in /usr/local/lib to be ignored + (bug 174). +13) Ensure winbindd_ads uses the correct realm or domain name when + connecting to trusted DC. +14) Ensure a correct prototype is created for snprintf() (bug 187) +15) Stop files being created on read-only shares in some circumstances. +16) Fix wbinfo -p (bug 251) +17) Support schannel on any tcp/ip connection if necessary +18) Correct bug in user_in_list() so that it works with winbind groups + again. +19) Ensure the schannel bind credentials default to the domain + of the destination host. +20) Default password expiration time in account_pol.tdb to never + expire. Remove any existing account_pol.tdb file to reset + the new default policy (bug 184). +21) Add buttons to SWAT to change the view of smb.conf (bug 212) +22) Fix incorrect checks that determine whether or not the 'add user + script' has been set. +23) More cleanup for internal character set conversions. +24) Fixes for multi-byte strings in stat cache code. +25) Ensure that the net command honors the 'workgroup' parameter + in smb.conf when not overridden from the command line. +26) Add gss-spnego support to the ntlm_auth tool. +27) Add vfs_default_quota VFS module. +28) Added server support for NT quota interfaces. +29) Prevent Krb5 replay attacks by adding a replay_cache. +30) Fix problems with winbindd and transitive trusts in AD domains. +31) Added -S to client tools for setting SMB signing options on the + command line. +32) Fix bug causing the 'passwd change program' to be called as the + connected user and not root. +33) Fixed data corruption bug in byte-range locking (e.g. affected MS Excel). +34) Support winbindd on FreeBSD is possible. +35) Look at only the first OID in the security blob sent in the session + setup request to determine the token type. +36) Only push locks onto a blocking lock queue if the posix lock failed with + EACCES or EAGAIN (this means another lock conflicts). Else return an + error and don't queue the request. +37) Fix command line argument processing for smbtar. +38) Correct issue that caused smbd to return generic unix_user. + for lookupsid(). +39) Default to algorithmic mapping when generating a rid for a group + mapping. +40) Expand %g and %G in logon script, profile path, etc... during + a domain logon (bug 208). +41) Make sure smbclient obeys '-s ' +42) Added win2k3 shadow copy operations to VFS interface. +43) Allow connections to samba domain member as SERVER\user (don't + always default to DOMAIN\user). +44) Remove checks in winbindd that caused it to attempt to use + non-transitive trust relationships. +45) Remove delays in winbindd caused by invalid DNS lookups. +46) Fix supplementary group memberships on systems with slightly + broken NSS implementations (bug 267). +47) Correct issue that prevented smbclient from viewing shares on + a win2k server when using a non-anonymous connection (bug 284). +48) Add --domain=DOMAIN_NAME to wbinfo for limiting operations like + 'wbinfo -u' to a single domain. The '.' character represents + our domain. +49) Fix group enumeration bug when using an LDAP directory for + storing group mappings. +50) Default to use NTLMv2 if available. Fallback to not use LM/NTLM + when the extended security capability bit is not set. +51) Fix crash in 'wbinfo -a' when using extended characters in the + username (bug 269). +52) Fix multi-byte strupper() panics (bug 205). +53) Add vfs_readonly VFS module. +54) Make sure to initialize the sambaNextUserRid and sambaNextGroupRid + attributes when using 'idmap backend = ldap' (bug 280). +55) Make sure that users shared between a Samba PDC and member + samba server are seen as domain users and not local users on the + domain member. +56) Fix Query FS Info level 2. +57) Allow enumeration of users and groups by win9x "file server" (bug + 286). +58) Create symlinks during install for modules that support mutliple + functions (bug 91). +59) More iconv detection fixes. +60) Fix path length error in vfs_recycle module (bug 291). +61) Added server support for the LSA_DS UUID on the \lsarpc pipe. + (server DsRoleGetPrimaryDomainInfo() is currently disabled). +62) Fix SMBseek and get/set position calls. +62) Fix SetFileInfo level 1. +63) Added tool to convert smbd log file to a pcap file (log2pcaphex). + + + +Changes since 3.0beta2 +###################### 1) Added fix for Japanese case names in statcache code; these can change size on upper casing. @@ -113,8 +337,8 @@ details groups (bug #109). 13) Remove idmap_XX_to_XX calls from smbd. Move back to the the winbind_XXX and local_XXX calls used in 2.2. -14) All uid/gid allocation must involve winbindd now - (we no attempt to map unknown SIDs to a UNIX identify). +14) All uid/gid allocation must involve winbindd now (we do not + attempt to map unknown SIDs to a UNIX identify). 15) Add 'winbind trusted domains only' parameter to force a domain member. The server to use matching users names from /etc/passwd for its domain (needed for domain member of a Samba domain). @@ -241,6 +465,49 @@ Changes since 3.0beta1 ###################################################################### +Upgrading from a previous Samba 3.0 beta +######################################## + +Beginning with Samba 3.0.0beta3, the RID allocation functions +have been moved into winbindd. Previously these were handled +by each passdb backend. This means that winbindd must be running +to automatically allocate RIDs for users and/or groups. Otherwise, +smbd will use the 2.2 algorithm for generating new RIDs. + +If you are using 'passdb backend = tdbsam' with a previous Samba +3.0 beta release (or possibly alpha), it may be necessary to +move the RID_COUNTER entry from /usr/local/samba/private/passdb.tdb +to winbindd_idmap.tdb. To do this: + +1) Ensure that winbindd_idmap.tdb exists (launch winbindd at least + once) +2) build tdbtool by executing 'make tdbtool' in the source/tdb/ + directory +3) run: (note that 'tdb>' is the tool's prompt for input) + + root# ./tdbtool /usr/local/samba/private/passdb.tdb + tdb> show RID_COUNTER + key 12 bytes + RID_COUNTER + data 4 bytes + [000] 0A 52 00 00 .R. + + tdb> move RID_COUNTER /usr/local/samba/var/locks/winbindd_idmap.tdb + .... + record moved + +If you are using 'passdb backend = ldapsam', it will be necessary to +store idmap entries in the LDAP directory as well (i.e. idmap backend += ldap). Refer to the 'net idmap' command for more information on +migrating SID<->UNIX id mappings from one backend to another. + +If the RID_COUNTER record does not exist, then these instructions are +unneccessary and the new RID_COUNTER record will be correctly generated +if needed. + + + +######################## Upgrading from Samba 2.2 ######################## @@ -337,6 +604,7 @@ New Parameters (new parameters have been grouped by function): * ntlm auth * paranoid server security * server schannel + * server signing * smb ports * use spnego @@ -382,7 +650,6 @@ New Parameters (new parameters have been grouped by function): * ldap idmap suffix * ldap machine suffix * ldap passwd sync - * ldap trust ids * ldap user suffix General Configuration @@ -399,6 +666,7 @@ Modified Parameters (changes in behavior): * restrict anonymous (integer value) * security (new 'ads' value) * strict locking (enabled by default) + * unix extensions (enabled by default) * winbind cache time (increased to 5 minutes) * winbind uid (deprecated in favor of 'idmap uid') * winbind gid (deprecated in favor of 'idmap gid') @@ -470,6 +738,14 @@ aware of when moving to Samba 3.0. with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols. + MIT kerberos 1.3.1 supports the ARCFOUR-HMAC-MD5 encryption + type which is neccessary for servers on which the + administrator password has not been changed, or kerberos-enabled + SMB connections to servers that require Kerberos SMB signing. + Besides this one difference, either MIT or Heimdal Kerberos + distributions are usable by Samba 3.0. + + Samba 3.0 also includes the possibility of setting up chains of authentication methods (auth methods) and account storage backends (passdb backend). Please refer to the smb.conf(5) @@ -716,10 +992,10 @@ Examples Known Issues ############ -* The smbldap perl scripts for managing user entries in an LDAP - directory have not be updated to function with the Samba 3.0 - schema changes. This (or an equivalent solution) work is planned - to be completed prior to the stable 3.0.0 release. +* There are several bugs currently logged against the 3.0 codebase + that affect the use of NT 4.0 GUI domain management tools when run + against a Samba 3.0 PDC. This bugs should be released in an early + 3.0.x release. Please refer to https://bugzilla.samba.org/ for a current list of bugs filed against the Samba 3.0 codebase. @@ -738,6 +1014,6 @@ the problem then you will probably be ignored. A new bugzilla installation has been established to help support the Samba 3.0 community of users. This server, located at -https://bugzilla.samba.org/, will replace the existing jitterbug server -and the old http://bugs.samba.org now points to the new bugzilla server. +https://bugzilla.samba.org/, has replaced the older jitterbug server +previously located at http://bugs.samba.org/. diff --git a/packaging/Debian/debian/libsmbclient.postinst b/packaging/Debian/debian/libsmbclient.postinst deleted file mode 100644 index 3223fa64d6..0000000000 --- a/packaging/Debian/debian/libsmbclient.postinst +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -# -# postinst script for libsmbclient -# -# $Id: libsmbclient.postinst,v 1.3 2003/06/01 07:12:51 peloy Exp $ -# - -if [ "$1" = "configure" ]; then - ldconfig -fi - -#DEBHELPER# diff --git a/packaging/Debian/debian/patches/configure.patch b/packaging/Debian/debian/patches/configure.patch deleted file mode 100644 index 0cf1434b29..0000000000 --- a/packaging/Debian/debian/patches/configure.patch +++ /dev/null @@ -1,32 +0,0 @@ -diff -uNr samba-3.0alpha21.orig/source/configure.in samba-3.0alpha21/source/configure.in ---- samba-3.0alpha21.orig/source/configure.in 2003-02-16 13:01:45.000000000 -0600 -+++ samba-3.0alpha21/source/configure.in 2003-02-16 13:04:03.000000000 -0600 -@@ -481,6 +481,28 @@ - #endif - } - ], [LINUX_LFS_SUPPORT=yes], [LINUX_LFS_SUPPORT=no], [LINUX_LFS_SUPPORT=cross]) -+ if test x$LINUX_LFS_SUPPORT = xyes ; then -+ AC_TRY_RUN([ -+#include -+#include -+#include -+main() { -+ unsigned int *padding; -+ struct flock foo_lock = {F_WRLCK, SEEK_SET, 0, 1, 0}; -+ int fd = open("/dev/null", O_RDWR); -+ -+ /* Yes, we're depending on the internals of the Linux flock structure -+ here -- but this test is explicitly Linux-specific to begin with. */ -+ padding = (unsigned int *)&foo_lock; -+ padding[1] = 0xffffffff; -+ foo_lock.l_start = 0; -+ if (fcntl(fd, F_SETLK, &foo_lock) < 0) -+ exit(1); -+ -+ exit(0); -+} -+], [LINUX_LFS_SUPPORT=yes], [LINUX_LFS_SUPPORT=no], [LINUX_LFS_SUPPORT=cross]) -+ fi - CPPFLAGS="$old_CPPFLAGS" - if test x$LINUX_LFS_SUPPORT = xyes ; then - CPPFLAGS="-D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE $CPPFLAGS" diff --git a/packaging/Debian/debian/patches/krb5-vars.patch b/packaging/Debian/debian/patches/krb5-vars.patch deleted file mode 100644 index d6eadfd91b..0000000000 --- a/packaging/Debian/debian/patches/krb5-vars.patch +++ /dev/null @@ -1,688 +0,0 @@ ---- samba_3_0/source/Makefile.in.orig 2003-07-15 12:26:55.000000000 -0400 -+++ samba_3_0/source/Makefile.in 2003-07-15 12:26:57.000000000 -0400 -@@ -32,7 +32,6 @@ - ACLLIBS=@ACLLIBS@ - PASSDBLIBS=@PASSDBLIBS@ - IDMAP_LIBS=@IDMAP_LIBS@ --ADSLIBS=@ADSLIBS@ - KRB5LIBS=@KRB5_LIBS@ - LDAPLIBS=@LDAP_LIBS@ - -@@ -735,12 +734,12 @@ - - bin/smbd@EXEEXT@: $(SMBD_OBJ) @BUILD_POPT@ bin/.dummy - @echo Linking $@ -- @$(CC) $(FLAGS) -o $@ $(SMBD_OBJ) $(ADSLIBS) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ -+ @$(CC) $(FLAGS) -o $@ $(SMBD_OBJ) $(KRB5LIBS) $(LDAPLIBS) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ - $(AUTHLIBS) $(ACLLIBS) $(PASSDBLIBS) $(LIBS) @POPTLIBS@ - - bin/nmbd@EXEEXT@: $(NMBD_OBJ) @BUILD_POPT@ bin/.dummy - @echo Linking $@ -- @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(ADSLIBS) -+ @$(CC) $(FLAGS) -o $@ $(NMBD_OBJ) $(LDFLAGS) $(DYNEXP) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) - - bin/wrepld@EXEEXT@: $(WREPL_OBJ) @BUILD_POPT@ bin/.dummy - @echo Linking $@ -@@ -749,19 +748,19 @@ - bin/swat@EXEEXT@: $(SWAT_OBJ) @BUILD_POPT@ bin/.dummy - @echo Linking $@ - @$(CC) $(FLAGS) -o $@ $(SWAT_OBJ) $(LDFLAGS) $(DYNEXP) $(PRINTLIBS) \ -- $(AUTHLIBS) $(LIBS) $(PASSDBLIBS) @POPTLIBS@ $(KRB5LIBS) -+ $(AUTHLIBS) $(LIBS) $(PASSDBLIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) - - bin/rpcclient@EXEEXT@: $(RPCCLIENT_OBJ) @BUILD_POPT@ bin/.dummy - @echo Linking $@ -- @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(RPCCLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(ADSLIBS) -+ @$(CC) $(FLAGS) -o $@ $(PASSDBLIBS) $(RPCCLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) - - bin/smbclient@EXEEXT@: $(CLIENT_OBJ) @BUILD_POPT@ bin/.dummy - @echo Linking $@ -- @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(ADSLIBS) -+ @$(CC) $(FLAGS) -o $@ $(CLIENT_OBJ) $(LDFLAGS) $(DYNEXP) $(TERMLDFLAGS) $(TERMLIBS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) - - bin/net@EXEEXT@: $(NET_OBJ) @BUILD_POPT@ bin/.dummy - @echo Linking $@ -- @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(ADSLIBS) $(PASSDBLIBS) -+ @$(CC) $(FLAGS) -o $@ $(NET_OBJ) $(DYNEXP) $(LDFLAGS) $(LIBS) @POPTLIBS@ $(KRB5LIBS) $(LDAPLIBS) $(PASSDBLIBS) - - bin/profiles@EXEEXT@: $(PROFILES_OBJ) @BUILD_POPT@ bin/.dummy - @echo Linking $@ -@@ -809,7 +808,7 @@ - - bin/smbpasswd@EXEEXT@: $(SMBPASSWD_OBJ) bin/.dummy - @echo Linking $@ -- @$(CC) $(FLAGS) -o $@ $(SMBPASSWD_OBJ) $(PASSDBLIBS) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) -+ @$(CC) $(FLAGS) -o $@ $(SMBPASSWD_OBJ) $(PASSDBLIBS) $(LDFLAGS) $(DYNEXP) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) - - bin/pdbedit@EXEEXT@: $(PDBEDIT_OBJ) @BUILD_POPT@ bin/.dummy - @echo Linking $@ -@@ -881,7 +880,7 @@ - - bin/smbw_sample@EXEEXT@: $(SMBW_OBJ) utils/smbw_sample.o bin/.dummy - @echo Linking $@ -- @$(CC) $(FLAGS) -o $@ $(SMBW_OBJ) utils/smbw_sample.o $(LDFLAGS) $(LIBS) $(KRB5LIBS) -+ @$(CC) $(FLAGS) -o $@ $(SMBW_OBJ) utils/smbw_sample.o $(LDFLAGS) $(LIBS) $(KRB5LIBS) $(LDAPLIBS) - - bin/smbsh@EXEEXT@: $(SMBSH_OBJ) bin/.dummy - @echo Linking $@ -@@ -890,12 +889,14 @@ - bin/smbwrapper.@SHLIBEXT@: $(PICOBJS) bin/.dummy - @echo Linking shared library $@ - @$(SHLD) $(LDSHFLAGS) -o $@ $(PICOBJS) $(LIBS) \ -- @SONAMEFLAG@`basename $@` $(KRB5LIBS) -+ $(KRB5LIBS) $(LDAPLIBS) \ -+ @SONAMEFLAG@`basename $@` - - bin/libsmbclient.@SHLIBEXT@: $(LIBSMBCLIENT_PICOBJS) - @echo Linking libsmbclient shared library $@ - @$(SHLD) $(LDSHFLAGS) -o $@ $(LIBSMBCLIENT_PICOBJS) $(LDFLAGS) $(LIBS) \ -- $(KRB5LIBS) @SONAMEFLAG@`basename $@`.$(LIBSMBCLIENT_MAJOR) -+ $(KRB5LIBS) $(LDAPLIBS) \ -+ @SONAMEFLAG@`basename $@`.$(LIBSMBCLIENT_MAJOR) - - bin/libsmbclient.a: $(LIBSMBCLIENT_PICOBJS) - @echo Linking libsmbclient non-shared library $@ -@@ -905,7 +906,8 @@ - bin/libbigballofmud.@SHLIBEXT@: $(LIBBIGBALLOFMUD_PICOBJS) - @echo Linking bigballofmud shared library $@ - @$(SHLD) $(LDSHFLAGS) -o $@ $(LIBBIGBALLOFMUD_PICOBJS) $(LIBS) \ -- @SONAMEFLAG@`basename $@`.$(LIBBIGBALLOFMUD_MAJOR) $(PASSDBLIBS) $(IDMAP_LIBS) $(ADSLIBS) -+ $(PASSDBLIBS) $(IDMAP_LIBS) $(KRB5LIBS) $(LDAPLIBS) \ -+ @SONAMEFLAG@`basename $@`.$(LIBBIGBALLOFMUD_MAJOR) - ln -snf libbigballofmud.so bin/libbigballofmud.so.0 - - # It would be nice to build a static bigballofmud too, but when I try -diff -uNr samba-3.0.0beta2.orig/source/aclocal.m4 samba-3.0.0beta2/source/aclocal.m4 ---- samba-3.0.0beta2.orig/source/aclocal.m4 2003-07-01 15:44:25.000000000 -0500 -+++ samba-3.0.0beta2/source/aclocal.m4 2003-07-05 16:22:30.000000000 -0500 -@@ -111,6 +111,113 @@ - esac - ]) - -+# AC_CHECK_LIB_EXT(LIBRARY, [EXT_LIBS], [FUNCTION], -+# [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND], -+# [ADD-ACTION-IF-FOUND],[OTHER-LIBRARIES]) -+# ------------------------------------------------------ -+# -+# Use a cache variable name containing both the library and function name, -+# because the test really is for library $1 defining function $3, not -+# just for library $1. Separate tests with the same $1 and different $3s -+# may have different results. -+# -+# Note that using directly AS_VAR_PUSHDEF([ac_Lib], [ac_cv_lib_$1_$3]) -+# is asking for troubles, since AC_CHECK_LIB($lib, fun) would give -+# ac_cv_lib_$lib_fun, which is definitely not what was meant. Hence -+# the AS_LITERAL_IF indirection. -+# -+# FIXME: This macro is extremely suspicious. It DEFINEs unconditionnally, -+# whatever the FUNCTION, in addition to not being a *S macro. Note -+# that the cache does depend upon the function we are looking for. -+# -+# It is on purpose we used `ac_check_lib_ext_save_LIBS' and not just -+# `ac_save_LIBS': there are many macros which don't want to see `LIBS' -+# changed but still want to use AC_CHECK_LIB_EXT, so they save `LIBS'. -+# And ``ac_save_LIBS' is too tempting a name, so let's leave them some -+# freedom. -+AC_DEFUN([AC_CHECK_LIB_EXT], -+[ -+AH_CHECK_LIB_EXT([$1]) -+ac_check_lib_ext_save_LIBS=$LIBS -+LIBS="-l$1 $$2 $7 $LIBS" -+AS_LITERAL_IF([$1], -+ [AS_VAR_PUSHDEF([ac_Lib_ext], [ac_cv_lib_ext_$1])], -+ [AS_VAR_PUSHDEF([ac_Lib_ext], [ac_cv_lib_ext_$1''])])dnl -+ -+m4_ifval([$3], -+ [ -+ AH_CHECK_FUNC_EXT([$3]) -+ AS_LITERAL_IF([$1], -+ [AS_VAR_PUSHDEF([ac_Lib_func], [ac_cv_lib_ext_$1_$3])], -+ [AS_VAR_PUSHDEF([ac_Lib_func], [ac_cv_lib_ext_$1''_$3])])dnl -+ AC_CACHE_CHECK([for $3 in -l$1], ac_Lib_func, -+ [AC_TRY_LINK_FUNC($3, -+ [AS_VAR_SET(ac_Lib_func, yes); -+ AS_VAR_SET(ac_Lib_ext, yes)], -+ [AS_VAR_SET(ac_Lib_func, no); -+ AS_VAR_SET(ac_Lib_ext, no)]) -+ ]) -+ AS_IF([test AS_VAR_GET(ac_Lib_func) = yes], -+ [AC_DEFINE_UNQUOTED(AS_TR_CPP(HAVE_$3))])dnl -+ AS_VAR_POPDEF([ac_Lib_func])dnl -+ ],[ -+ AC_CACHE_CHECK([for -l$1], ac_Lib_ext, -+ [AC_TRY_LINK_FUNC([main], -+ [AS_VAR_SET(ac_Lib_ext, yes)], -+ [AS_VAR_SET(ac_Lib_ext, no)]) -+ ]) -+ ]) -+LIBS=$ac_check_lib_ext_save_LIBS -+ -+AS_IF([test AS_VAR_GET(ac_Lib_ext) = yes], -+ [m4_default([$4], -+ [AC_DEFINE_UNQUOTED(AS_TR_CPP(HAVE_LIB$1)) -+ case "$$2" in -+ *-l$1*) -+ ;; -+ *) -+ $2="$$2 -l$1" -+ ;; -+ esac]) -+ [$6] -+ ], -+ [$5])dnl -+AS_VAR_POPDEF([ac_Lib_ext])dnl -+])# AC_CHECK_LIB_EXT -+ -+# AH_CHECK_LIB_EXT(LIBNAME) -+# --------------------- -+m4_define([AH_CHECK_LIB_EXT], -+[AH_TEMPLATE(AS_TR_CPP(HAVE_LIB$1), -+ [Define to 1 if you have the `]$1[' library (-l]$1[).])]) -+ -+# AC_CHECK_FUNCS_EXT(FUNCTION, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND]) -+# ----------------------------------------------------------------- -+dnl check for a function in a $LIBS and $OTHER_LIBS libraries variable. -+dnl AC_CHECK_FUNC_EXT(func,OTHER_LIBS,IF-TRUE,IF-FALSE) -+AC_DEFUN([AC_CHECK_FUNC_EXT], -+[ -+ AH_CHECK_FUNC_EXT($1) -+ ac_check_func_ext_save_LIBS=$LIBS -+ LIBS="$2 $LIBS" -+ AS_VAR_PUSHDEF([ac_var], [ac_cv_func_ext_$1])dnl -+ AC_CACHE_CHECK([for $1], ac_var, -+ [AC_LINK_IFELSE([AC_LANG_FUNC_LINK_TRY([$1])], -+ [AS_VAR_SET(ac_var, yes)], -+ [AS_VAR_SET(ac_var, no)])]) -+ LIBS=$ac_check_func_ext_save_LIBS -+ AS_IF([test AS_VAR_GET(ac_var) = yes], -+ [AC_DEFINE_UNQUOTED(AS_TR_CPP([HAVE_$1])) $3], -+ [$4])dnl -+AS_VAR_POPDEF([ac_var])dnl -+])# AC_CHECK_FUNC -+ -+# AH_CHECK_FUNC_EXT(FUNCNAME) -+# --------------------- -+m4_define([AH_CHECK_FUNC_EXT], -+[AH_TEMPLATE(AS_TR_CPP(HAVE_$1), -+ [Define to 1 if you have the `]$1[' function.])]) -+ - dnl Define an AC_DEFINE with ifndef guard. - dnl AC_N_DEFINE(VARIABLE [, VALUE]) - define(AC_N_DEFINE, -diff -uNr samba-3.0.0beta2.orig/source/configure.in samba-3.0.0beta2/source/configure.in ---- samba-3.0.0beta2.orig/source/configure.in 2003-07-05 16:22:00.000000000 -0500 -+++ samba-3.0.0beta2/source/configure.in 2003-07-05 16:23:53.000000000 -0500 -@@ -162,12 +162,10 @@ - AC_SUBST(PRINTLIBS) - AC_SUBST(AUTHLIBS) - AC_SUBST(ACLLIBS) --AC_SUBST(ADSLIBS) - AC_SUBST(PASSDBLIBS) - AC_SUBST(IDMAP_LIBS) - AC_SUBST(KRB5_LIBS) - AC_SUBST(LDAP_LIBS) --AC_SUBST(LDAP_OBJ) - AC_SUBST(SHLIB_PROGS) - AC_SUBST(SMBWRAPPER) - AC_SUBST(EXTRA_BIN_PROGS) -@@ -2105,14 +2103,107 @@ - AC_MSG_RESULT(no) - ) - -+######################################################## -+# Compile with LDAP support? -+ -+with_ldap_support=auto -+AC_MSG_CHECKING([for LDAP support]) -+ -+AC_ARG_WITH(ldap, -+[ --with-ldap LDAP support (default yes)], -+[ case "$withval" in -+ yes|no) -+ with_ldap_support=$withval -+ ;; -+ esac ]) -+ -+AC_MSG_RESULT($with_ldap_support) -+ -+SMBLDAP="" -+SMBLDAP_PROTO="" -+AC_SUBST(SMBLDAP) -+AC_SUBST(SMBLDAP_PROTO) -+if test x"$with_ldap_support" != x"no"; then -+ -+ ################################################################## -+ # first test for ldap.h and lber.h -+ # (ldap.h is required for this test) -+ AC_CHECK_HEADERS(ldap.h lber.h) -+ -+ if test x"$ac_cv_header_ldap_h" != x"yes"; then -+ if test x"$with_ldap_support" = x"yes"; then -+ AC_MSG_ERROR(ldap.h is needed for LDAP support) -+ else -+ AC_MSG_WARN(ldap.h is needed for LDAP support) -+ fi -+ -+ with_ldap_support=no -+ fi -+fi -+ -+if test x"$with_ldap_support" != x"no"; then -+ ac_save_LIBS=$LIBS -+ -+ ################################################################## -+ # we might need the lber lib on some systems. To avoid link errors -+ # this test must be before the libldap test -+ AC_CHECK_LIB_EXT(lber, LDAP_LIBS, ber_scanf) -+ -+ ######################################################## -+ # now see if we can find the ldap libs in standard paths -+ AC_CHECK_LIB_EXT(ldap, LDAP_LIBS, ldap_init) -+ -+ AC_CHECK_FUNC_EXT(ldap_domain2hostlist,$LDAP_LIBS) -+ -+ ######################################################## -+ # If we have LDAP, does it's rebind procedure take 2 or 3 arguments? -+ # Check found in pam_ldap 145. -+ AC_CHECK_FUNC_EXT(ldap_set_rebind_proc,$LDAP_LIBS) -+ -+ LIBS="$LIBS $LDAP_LIBS" -+ AC_CACHE_CHECK(whether ldap_set_rebind_proc takes 3 arguments, smb_ldap_cv_ldap_set_rebind_proc, [ -+ AC_TRY_COMPILE([ -+ #include -+ #include ], -+ [ldap_set_rebind_proc(0, 0, 0);], -+ [smb_ldap_cv_ldap_set_rebind_proc=3], -+ [smb_ldap_cv_ldap_set_rebind_proc=2] -+ ) -+ ]) -+ -+ AC_DEFINE_UNQUOTED(LDAP_SET_REBIND_PROC_ARGS, $smb_ldap_cv_ldap_set_rebind_proc, [Number of arguments to ldap_set_rebind_proc]) -+ -+ AC_CHECK_FUNC_EXT(ldap_initialize,$LDAP_LIBS) -+ -+ if test x"$ac_cv_lib_ext_ldap_ldap_init" = x"yes" -a x"$ac_cv_func_ext_ldap_domain2hostlist" = x"yes"; then -+ AC_DEFINE(HAVE_LDAP,1,[Whether ldap is available]) -+ default_static_modules="$default_static_modules pdb_ldap idmap_ldap"; -+ SMBLDAP="lib/smbldap.o" -+ with_ldap_support=yes -+ AC_MSG_CHECKING(whether LDAP support is used) -+ AC_MSG_RESULT(yes) -+ else -+ if test x"$with_ldap_support" = x"yes"; then -+ AC_MSG_ERROR(libldap is needed for LDAP support) -+ else -+ AC_MSG_WARN(libldap is needed for LDAP support) -+ fi -+ -+ LDAP_LIBS="" -+ with_ldap_support=no -+ fi -+ LIBS=$ac_save_LIBS -+fi -+ -+ - ################################################# - # active directory support - - with_ads_support=auto --AC_MSG_CHECKING([whether to use Active Directory]) -+AC_MSG_CHECKING([for Active Directory and krb5 support]) - - AC_ARG_WITH(ads, --[ --with-ads Active Directory support (default yes)], -+[ --with-ads Active Directory support (default auto)], - [ case "$withval" in - yes|no) - with_ads_support="$withval" -@@ -2124,22 +2215,28 @@ - FOUND_KRB5=no - KRB5_LIBS="" - -+if test x"$with_ldap_support" != x"yes"; then -+ if test x"$with_ads_support" = x"yes"; then -+ AC_MSG_ERROR(Active Directory Support requires LDAP support) -+ elif test x"$with_ads_support" != x"no"; then -+ AC_MSG_WARN(Active Directory Support requires LDAP support) -+ fi -+ with_ads_support=no -+fi -+ - if test x"$with_ads_support" != x"no"; then - - # Do no harm to the values of CFLAGS and LIBS while testing for - # Kerberos support. - -- ac_save_CFLAGS="$CFLAGS" -- ac_save_LIBS="$LIBS" -- - ################################################# - # check for krb5-config from recent MIT and Heimdal kerberos 5 - AC_PATH_PROG(KRB5_CONFIG, krb5-config) - AC_MSG_CHECKING(for working krb5-config) - if test -x "$KRB5_CONFIG"; then -- LIBS="$LIBS `$KRB5_CONFIG --libs`" -- CFLAGS="$CFLAGS `$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" -- CPPFLAGS="$CPPFLAGS `$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" -+ KRB5_LIBS="`CFLAGS='' $KRB5_CONFIG --libs gssapi`" -+ KRB5_CFLAGS="`$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" -+ KRB5_CPPFLAGS="`$KRB5_CONFIG --cflags | sed s/@INCLUDE_des@//`" - FOUND_KRB5=yes - AC_MSG_RESULT(yes) - else -@@ -2154,18 +2251,23 @@ - [ --with-krb5=base-dir Locate Kerberos 5 support (default=/usr)], - [ case "$withval" in - no) -- AC_MSG_RESULT(no) -+ AC_MSG_RESULT(no krb5-path given) -+ ;; -+ yes) -+ AC_MSG_RESULT(/usr) -+ KRB5_LIBS="-lkrb5" -+ FOUND_KRB5=yes - ;; - *) -- AC_MSG_RESULT(yes) -- LIBS="$LIBS -lkrb5" -- CFLAGS="$CFLAGS -I$withval/include" -- CPPFLAGS="$CPPFLAGS -I$withval/include" -- LDFLAGS="$LDFLAGS -L$withval/lib" -+ AC_MSG_RESULT($withval) -+ KRB5_LIBS="-lkrb5" -+ KRB5_CFLAGS="-I$withval/include" -+ KRB5_CPPFLAGS="-I$withval/include" -+ KRB5_LDFLAGS="-L$withval/lib" - FOUND_KRB5=yes - ;; - esac ], -- AC_MSG_RESULT(no) -+ AC_MSG_RESULT(no krb5-path given) - ) - fi - -@@ -2175,15 +2277,15 @@ - AC_MSG_CHECKING(for /usr/include/heimdal) - if test -d /usr/include/heimdal; then - if test -f /usr/lib/heimdal/lib/libkrb5.a; then -- LIBS="$LIBS -lkrb5" -- CFLAGS="$CFLAGS -I/usr/include/heimdal" -- CPPFLAGS="$CPPFLAGS -I/usr/include/heimdal" -- LDFLAGS="$LDFLAGS -L/usr/lib/heimdal/lib" -+ KRB5_LIBS="-lkrb5" -+ KRB5_CFLAGS="-I/usr/include/heimdal" -+ KRB5_CPPFLAGS="-I/usr/include/heimdal" -+ KRB5_LDFLAGS="-L/usr/lib/heimdal/lib" - AC_MSG_RESULT(yes) - else -- LIBS="$LIBS -lkrb5" -- CFLAGS="$CFLAGS -I/usr/include/heimdal" -- CPPFLAGS="$CPPFLAGS -I/usr/include/heimdal" -+ KRB5_LIBS="-lkrb5" -+ KRB5_CFLAGS="-I/usr/include/heimdal" -+ KRB5_CPPFLAGS="-I/usr/include/heimdal" - AC_MSG_RESULT(yes) - fi - else -@@ -2196,16 +2298,26 @@ - # see if this box has the RedHat location for kerberos - AC_MSG_CHECKING(for /usr/kerberos) - if test -d /usr/kerberos -a -f /usr/kerberos/lib/libkrb5.a; then -- LIBS="$LIBS -lkrb5" -- LDFLAGS="$LDFLAGS -L/usr/kerberos/lib" -- CFLAGS="$CFLAGS -I/usr/kerberos/include" -- CPPFLAGS="$CPPFLAGS -I/usr/kerberos/include" -+ KRB5_LIBS="-lkrb5" -+ KRB5_LDFLAGS="-L/usr/kerberos/lib" -+ KRB5_CFLAGS="-I/usr/kerberos/include" -+ KRB5_CPPFLAGS="-I/usr/kerberos/include" - AC_MSG_RESULT(yes) - else - AC_MSG_RESULT(no) - fi - fi - -+ ac_save_CFLAGS=$CFLAGS -+ ac_save_CPPFLAGS=$CPPFLAGS -+ ac_save_LDFLAGS=$LDFLAGS -+ -+ CFLAGS="$CFLAGS $KRB5_CFLAGS" -+ CPPFLAGS="$CPPFLAGS $KRB5_CPPFLAGS" -+ LDFLAGS="$LDFLAGS $KRB5_LDFLAGS" -+ -+ KRB5_LIBS="$KRB5_LDFLAGS $KRB5_LIBS" -+ - # now check for krb5.h. Some systems have the libraries without the headers! - # note that this check is done here to allow for different kerberos - # include paths -@@ -2225,24 +2337,17 @@ - # Turn off AD support and restore CFLAGS and LIBS variables - - with_ads_support="no" -- -- CFLAGS="$ac_save_CFLAGS" -- LIBS="$ac_save_LIBS" -- -- else -- -- # Get rid of case where $with_ads_support=auto -- -- with_ads_support="yes" -- -+ -+ CFLAGS=$ac_save_CFLAGS -+ CPPFLAGS=$ac_save_CPPFLAGS -+ LDFLAGS=$ac_save_LDFLAGS - fi - fi - - # Now we have determined whether we really want ADS support - --if test x"$with_ads_support" = x"yes"; then -- -- AC_DEFINE(WITH_ADS,1,[Whether to include Active Directory support]) -+if test x"$with_ads_support" != x"no"; then -+ ac_save_LIBS=$LIBS - - # now check for gssapi headers. This is also done here to allow for - # different kerberos include paths -@@ -2250,64 +2365,46 @@ - - ################################################################## - # we might need the k5crypto and com_err libraries on some systems -- AC_CHECK_LIB(com_err, _et_list) -- AC_CHECK_LIB(k5crypto, krb5_encrypt_data) -+ AC_CHECK_LIB_EXT(com_err, KRB5_LIBS, _et_list) -+ AC_CHECK_LIB_EXT(k5crypto, KRB5_LIBS, krb5_encrypt_data) - - # Heimdal checks. -- AC_CHECK_LIB(crypto, des_set_key) -- AC_CHECK_LIB(asn1, copy_Authenticator) -- AC_CHECK_LIB(roken, roken_getaddrinfo_hostspec) -+ AC_CHECK_LIB_EXT(crypto, KRB5_LIBS, des_set_key) -+ AC_CHECK_LIB_EXT(asn1, KRB5_LIBS, copy_Authenticator) -+ AC_CHECK_LIB_EXT(roken, KRB5_LIBS, roken_getaddrinfo_hostspec) - - # Heimdal checks. On static Heimdal gssapi must be linked before krb5. -- AC_CHECK_LIB(gssapi, gss_display_status, [LIBS="$LIBS -lgssapi -lkrb5"; -+ AC_CHECK_LIB_EXT(gssapi, KRB5_LIBS, gss_display_status, [KRB5_LIBS="$KRB5_LIBS -lgssapi -lkrb5"; - AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) - -- AC_CHECK_LIB(krb5, krb5_set_real_time, -- [AC_DEFINE(HAVE_KRB5_SET_REAL_TIME,1, -- [Whether krb5_set_real_time is available])]) -- AC_CHECK_LIB(krb5, krb5_set_default_in_tkt_etypes, -- [AC_DEFINE(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES,1, -- [Whether krb5_set_default_in_tkt_etypes, is available])]) -- AC_CHECK_LIB(krb5, krb5_set_default_tgs_ktypes, -- [AC_DEFINE(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES,1, -- [Whether krb5_set_default_tgs_ktypes is available])]) -- -- AC_CHECK_LIB(krb5, krb5_principal2salt, -- [AC_DEFINE(HAVE_KRB5_PRINCIPAL2SALT,1, -- [Whether krb5_principal2salt is available])]) -- AC_CHECK_LIB(krb5, krb5_use_enctype, -- [AC_DEFINE(HAVE_KRB5_USE_ENCTYPE,1, -- [Whether krb5_use_enctype is available])]) -- AC_CHECK_LIB(krb5, krb5_string_to_key, -- [AC_DEFINE(HAVE_KRB5_STRING_TO_KEY,1, -- [Whether krb5_string_to_key is available])]) -- AC_CHECK_LIB(krb5, krb5_get_pw_salt, -- [AC_DEFINE(HAVE_KRB5_GET_PW_SALT,1, -- [Whether krb5_get_pw_salt is available])]) -- AC_CHECK_LIB(krb5, krb5_string_to_key_salt, -- [AC_DEFINE(HAVE_KRB5_STRING_TO_KEY_SALT,1, -- [Whether krb5_string_to_key_salt is available])]) -- AC_CHECK_LIB(krb5, krb5_auth_con_setkey, -- [AC_DEFINE(HAVE_KRB5_AUTH_CON_SETKEY,1, -- [Whether krb5_auth_con_setkey is available])]) -- AC_CHECK_LIB(krb5, krb5_auth_con_setuseruserkey, -- [AC_DEFINE(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY,1, -- [Whether krb5_auth_con_setuseruserkey is available])]) -- AC_CHECK_LIB(krb5, krb5_locate_kdc, -- [AC_DEFINE(HAVE_KRB5_LOCATE_KDC,1, -- [Whether krb5_locate_kdc is available])]) -- AC_CHECK_LIB(krb5, krb5_get_permitted_enctypes, -- [AC_DEFINE(HAVE_KRB5_GET_PERMITTED_ENCTYPES,1, -- [Whether krb5_get_permitted_enctypes is available])]) -- AC_CHECK_LIB(krb5, krb5_get_default_in_tkt_etypes, -- [AC_DEFINE(HAVE_KRB5_GET_DEFAULT_IN_TKT_ETYPES,1, -- [Whether krb5_get_default_in_tkt_etypes is available])]) -- AC_CHECK_LIB(krb5, krb5_free_ktypes, -- [AC_DEFINE(HAVE_KRB5_FREE_KTYPES,1, -- [Whether krb5_free_ktypes is available])]) -- AC_CHECK_LIB(krb5, krb5_principal_get_comp_string, -- [AC_DEFINE(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING,1, -- [Whether krb5_principal_get_comp_string is available])]) -+ ######################################################## -+ # now see if we can find the krb5 libs in standard paths -+ # or as specified above -+ AC_CHECK_LIB_EXT(krb5, KRB5_LIBS, krb5_mk_req_extended) -+ -+ ######################################################## -+ # now see if we can find the gssapi libs in standard paths -+ AC_CHECK_LIB_EXT(gssapi_krb5, KRB5_LIBS,gss_display_status,[],[], -+ AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])) -+ -+ AC_CHECK_FUNC_EXT(krb5_set_real_time, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_set_default_in_tkt_etypes, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_set_default_tgs_ktypes, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_principal2salt, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_use_enctype, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_string_to_key, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_get_pw_salt, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_string_to_key_salt, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_auth_con_setkey, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_auth_con_setuseruserkey, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_locate_kdc, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_get_permitted_enctypes, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_get_default_in_tkt_etypes, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_free_ktypes, $KRB5_LIBS) -+ AC_CHECK_FUNC_EXT(krb5_principal_get_comp_string, $KRB5_LIBS) -+ -+ LIBS="$LIBS $KRB5_LIBS" -+ - AC_CACHE_CHECK([for the krb5_princ_component macro], - samba_cv_HAVE_KRB5_PRINC_COMPONENT,[ - AC_TRY_LINK([#include ], -@@ -2380,87 +2468,21 @@ - [Whether the ENCTYPE_ARCFOUR_HMAC_MD5 key type is available]) - fi - -- ######################################################## -- # now see if we can find the krb5 libs in standard paths -- # or as specified above -- AC_CHECK_LIB(krb5, krb5_mk_req_extended, [KRB5_LIBS="$LIBS -lkrb5"; -- KRB5_CFLAGS="$CFLAGS"; -- AC_DEFINE(HAVE_KRB5,1,[Whether KRB5 is available])]) -- -- ######################################################## -- # now see if we can find the gssapi libs in standard paths -- AC_CHECK_LIB(gssapi_krb5, gss_display_status, -- [KRB5_LIBS="$KRB5_LIBS -lgssapi_krb5"; -- AC_DEFINE(HAVE_GSSAPI,1,[Whether GSSAPI is available])]) -- -- CFLAGS="$ac_save_CFLAGS" -- LIBS="$ac_save_LIBS" --fi -- --######################################################## --# Compile with LDAP support? -- --LDAP_OBJ="" --with_ldap_support=yes --AC_MSG_CHECKING([whether to use LDAP]) -- --AC_ARG_WITH(ldap, --[ --with-ldap LDAP support (default yes)], --[ case "$withval" in -- no) -- with_ldap_support=no -- ;; -- esac ]) -- --AC_MSG_RESULT($with_ldap_support) -- --SMBLDAP="" --if test x"$with_ldap_support" = x"yes"; then -- ac_save_LIBS="$LIBS" -- LIBS="" -- -- ################################################################## -- # we might need the lber lib on some systems. To avoid link errors -- # this test must be before the libldap test -- AC_CHECK_LIB(lber, ber_scanf) -- -- ######################################################## -- # now see if we can find the ldap libs in standard paths -- if test x$have_ldap != xyes; then -- AC_CHECK_LIB(ldap, ldap_init, [ -- LIBS="$LIBS -lldap"; -- AC_CHECK_LIB(ldap, ldap_domain2hostlist, [ -- AC_DEFINE(HAVE_LDAP,1,[Whether ldap is available]) -- AC_CHECK_HEADERS([ldap.h lber.h], -- [default_static_modules="$default_static_modules pdb_ldap idmap_ldap"; -- SMBLDAP="lib/smbldap.o"]) -- ]) -- ]) -- -- ######################################################## -- # If we have LDAP, does it's rebind procedure take 2 or 3 arguments? -- # Check found in pam_ldap 145. -- AC_CHECK_FUNCS(ldap_set_rebind_proc) -- AC_CACHE_CHECK(whether ldap_set_rebind_proc takes 3 arguments, pam_ldap_cv_ldap_set_rebind_proc, [ -- AC_TRY_COMPILE([ -- #include -- #include ], [ldap_set_rebind_proc(0, 0, 0);], [pam_ldap_cv_ldap_set_rebind_proc=3], [pam_ldap_cv_ldap_set_rebind_proc=2]) ]) -- AC_DEFINE_UNQUOTED(LDAP_SET_REBIND_PROC_ARGS, $pam_ldap_cv_ldap_set_rebind_proc, [Number of arguments to ldap_set_rebind_proc]) -- AC_CHECK_FUNCS(ldap_initialize) -- fi -- -- AC_SUBST(SMBLDAP) -- LDAP_LIBS="$LIBS"; -- LIBS="$ac_save_LIBS"; --else -- # Can't have ADS support without LDAP -+ if test x"$ac_cv_lib_ext_krb5_krb5_mk_req_extended" = x"yes"; then -+ AC_DEFINE(HAVE_KRB5,1,[Whether to have KRB5 support]) -+ AC_DEFINE(WITH_ADS,1,[Whether to include Active Directory support]) -+ AC_MSG_CHECKING(whether Active Directory and krb5 support is used) -+ AC_MSG_RESULT(yes) -+ else - if test x"$with_ads_support" = x"yes"; then -- AC_MSG_ERROR(Active directory support requires LDAP) -+ AC_MSG_ERROR(libkrb5 is needed for Active Directory support) -+ else -+ AC_MSG_WARN(libkrb5 is needed for Active Directory support) - fi --fi -- --if test x"$with_ads_support" = x"yes"; then -- ADSLIBS="$LDAP_LIBS $KRB5_LIBS" -+ KRB5_LIBS="" -+ with_ads_support=no -+ fi -+ LIBS="$ac_save_LIBS" - fi - - ######################################################## diff --git a/packaging/Debian/debian/patches/pam_smbpass_linkage.patch b/packaging/Debian/debian/patches/pam_smbpass_linkage.patch deleted file mode 100644 index 022a3a0a28..0000000000 --- a/packaging/Debian/debian/patches/pam_smbpass_linkage.patch +++ /dev/null @@ -1,24 +0,0 @@ -diff -uNr samba-3.0.0beta2.orig/source/Makefile.in samba-3.0.0beta2/source/Makefile.in ---- samba-3.0.0beta2.orig/source/Makefile.in 2003-07-05 16:24:34.000000000 -0500 -+++ samba-3.0.0beta2/source/Makefile.in 2003-07-05 16:24:54.000000000 -0500 -@@ -579,8 +579,8 @@ - PAM_SMBPASS_OBJ_0 = pam_smbpass/pam_smb_auth.o pam_smbpass/pam_smb_passwd.o \ - pam_smbpass/pam_smb_acct.o pam_smbpass/support.o \ - libsmb/smbencrypt.o libsmb/smbdes.o libsmb/nterr.o \ -- $(PARAM_OBJ) $(LIB_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ) \ -- $(SECRETS_OBJ) $(UBIQX_OBJ) -+ $(LIBSAMBA_OBJ) $(PARAM_OBJ) $(LIB_OBJ) $(PASSDB_OBJ) \ -+ $(GROUPDB_OBJ) $(SECRETS_OBJ) $(UBIQX_OBJ) $(SMBLDAP_OBJ) - - PAM_SMBPASS_PICOOBJ = $(PAM_SMBPASS_OBJ_0:.o=.po) - -@@ -1076,7 +1076,8 @@ - - bin/pam_smbpass.@SHLIBEXT@: $(PAM_SMBPASS_PICOOBJ) - @echo "Linking shared library $@" -- @$(SHLD) $(LDSHFLAGS) -o $@ $(PAM_SMBPASS_PICOOBJ) -lpam $(DYNEXP) $(LIBS) -lc -+ @$(SHLD) $(LDSHFLAGS) -o $@ $(PAM_SMBPASS_PICOOBJ) -lpam $(DYNEXP) \ -+ $(PASSDBLIBS) $(LIBS) -lc - - bin/libmsrpc.a: $(LIBMSRPC_PICOBJ) - @-$(AR) -rc $@ $(LIBMSRPC_PICOBJ) diff --git a/packaging/Debian/debian/patches/smbadduser.patch b/packaging/Debian/debian/patches/smbadduser.patch deleted file mode 100644 index 36b74b3175..0000000000 --- a/packaging/Debian/debian/patches/smbadduser.patch +++ /dev/null @@ -1,23 +0,0 @@ -diff -uNr samba-3.0alpha21.orig/source/smbadduser samba-3.0alpha21/source/smbadduser ---- samba-3.0alpha21.orig/source/smbadduser 2003-02-16 13:01:45.000000000 -0600 -+++ samba-3.0alpha21/source/smbadduser 2003-02-16 16:25:16.000000000 -0600 -@@ -2,13 +2,14 @@ - # - # smbadduser - Written by Mike Zakharoff - # -+# Customized for Debian by Eloy A. Paris -+# - unalias * --set path = ($path /usr/local/samba/bin) -+# No need to set a path in Debian -+#set path = ($path /usr/local/samba/bin) - --set smbpasswd = /usr/local/samba/private/smbpasswd --#set smbpasswd = /etc/samba/smbpasswd --set user_map = /usr/local/samba/lib/users.map --#set user_map = /etc/samba/smbusers -+set smbpasswd = /etc/samba/smbpasswd -+set user_map = /etc/samba/users.map - # - # Set to site specific passwd command - # diff --git a/packaging/Debian/debian/patches/smbclient-tar.patch b/packaging/Debian/debian/patches/smbclient-tar.patch deleted file mode 100644 index e6cdcafbf8..0000000000 --- a/packaging/Debian/debian/patches/smbclient-tar.patch +++ /dev/null @@ -1,43 +0,0 @@ -diff -uNr samba-3.0.0beta2.orig/source/client/client.c samba-3.0.0beta2/source/client/client.c ---- samba-3.0.0beta2.orig/source/client/client.c 2003-07-01 22:36:24.000000000 -0500 -+++ samba-3.0.0beta2/source/client/client.c 2003-07-06 15:17:36.000000000 -0500 -@@ -2731,6 +2731,7 @@ - int opt; - pstring query_host; - BOOL message = False; -+ char* tar_args = NULL; - extern char tar_type; - pstring term_code; - static const char *new_name_resolve_order = NULL; -@@ -2816,7 +2817,7 @@ - max_protocol = interpret_protocol(poptGetOptArg(pc), max_protocol); - break; - case 'T': -- if (!tar_parseargs(argc, argv, poptGetOptArg(pc), optind)) { -+ if (!(tar_args = poptGetOptArg(pc))) { - poptPrintUsage(pc, stderr, 0); - exit(1); - } -@@ -2848,6 +2849,22 @@ - pstrcpy(cmdline_auth_info.password,poptGetArg(pc)); - } - -+ /* The tar command may take a number of string options; pass -+ everything we have left to tar_parseargs(). */ -+ if (tar_args) { -+ const char **argv2 = poptGetArgs(pc); -+ int argc2 = 0; -+ -+ if (argv2) { -+ while (argv2[argc2]) argc2++; -+ } -+ -+ if (!tar_parseargs(argc2, argv2, tar_args, 0)) { -+ poptPrintUsage(pc, stderr, 0); -+ exit(1); -+ } -+ } -+ - init_names(); - - if(new_name_resolve_order) diff --git a/packaging/Debian/debian/python2.2-samba.files b/packaging/Debian/debian/python2.2-samba.files deleted file mode 100644 index a24e2b98c8..0000000000 --- a/packaging/Debian/debian/python2.2-samba.files +++ /dev/null @@ -1 +0,0 @@ -usr/lib/python2.2/site-packages/ diff --git a/packaging/Debian/debian/samba-common.conffiles b/packaging/Debian/debian/samba-common.conffiles deleted file mode 100644 index 4684ede3d1..0000000000 --- a/packaging/Debian/debian/samba-common.conffiles +++ /dev/null @@ -1,3 +0,0 @@ -/etc/pam.d/samba -/etc/samba/gdbcommands -/etc/dhcp3/dhclient-enter-hooks.d/samba diff --git a/packaging/Debian/debian/samba.conffiles b/packaging/Debian/debian/samba.conffiles deleted file mode 100644 index 908a791a62..0000000000 --- a/packaging/Debian/debian/samba.conffiles +++ /dev/null @@ -1,3 +0,0 @@ -/etc/cron.daily/samba -/etc/init.d/samba -/etc/logrotate.d/samba diff --git a/packaging/Debian/debian/swat.docs b/packaging/Debian/debian/swat.docs deleted file mode 100644 index afbfcf0c61..0000000000 --- a/packaging/Debian/debian/swat.docs +++ /dev/null @@ -1 +0,0 @@ -swat/README diff --git a/packaging/Debian/debian/winbind.conffiles b/packaging/Debian/debian/winbind.conffiles deleted file mode 100644 index c9adbfff17..0000000000 --- a/packaging/Debian/debian/winbind.conffiles +++ /dev/null @@ -1,2 +0,0 @@ -/etc/init.d/winbind -/etc/logrotate.d/winbind diff --git a/packaging/Mandrake/samba-2.2.0-gawk.patch b/packaging/Mandrake/samba-2.2.0-gawk.patch deleted file mode 100644 index b77bc3a93c..0000000000 --- a/packaging/Mandrake/samba-2.2.0-gawk.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- samba-2.2.0/source/script/convert_smbpasswd.gawk Thu Nov 5 04:50:17 1998 -+++ samba-2.2.0/source/script/convert_smbpasswd Thu Apr 19 08:43:44 2001 -@@ -7,7 +7,7 @@ - # with trying to work out how to get the seconds since 1970 - # in awk or the shell. JRA. - # --nawk 'BEGIN {FS=":"} -+gawk 'BEGIN {FS=":"} - { - if( $0 ~ "^#" ) { - print $0 diff --git a/packaging/Mandrake/samba-2.2.5-gp-reloc-fix.patch b/packaging/Mandrake/samba-2.2.5-gp-reloc-fix.patch deleted file mode 100644 index 8888d6622e..0000000000 --- a/packaging/Mandrake/samba-2.2.5-gp-reloc-fix.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -ur samba-2.2.5.orig/examples/VFS/Makefile.in samba-2.2.5/examples/VFS/Makefile.in ---- samba-2.2.5.orig/examples/VFS/Makefile.in 2002-06-17 20:35:09.000000000 +0200 -+++ samba-2.2.5/examples/VFS/Makefile.in 2002-06-30 16:43:15.000000000 +0200 -@@ -4,7 +4,7 @@ - - CC=@CC@ - LIBTOOL=@LIBTOOL@ --CFLAGS=@CFLAGS@ -+CFLAGS=@CFLAGS@ -DPIC -fPIC - LDFLAGS=@LDFLAGS@ - - VFS_OBJS=audit.so skel.so block/block.so recycle/recycle.so diff --git a/packaging/Mandrake/smbmount-sbin.patch b/packaging/Mandrake/smbmount-sbin.patch deleted file mode 100644 index b638720813..0000000000 --- a/packaging/Mandrake/smbmount-sbin.patch +++ /dev/null @@ -1,15 +0,0 @@ -+++ samba-2.2.1/source/client/smbmount.c Sun Apr 15 01:03:46 2001 ---- samba-2.2.1/source/client/smbmount.c.seb Mon Jun 11 14:26:23 2001 -@@ -484,9 +484,9 @@ - } - - if (sys_fork() == 0) { -- if (file_exist(BINDIR "/smbmnt", NULL)) { -- execv(BINDIR "/smbmnt", args); -- fprintf(stderr,"execv of %s failed. Error was %s.", BINDIR "/smbmnt", strerror(errno)); -+ if (file_exist(SBINDIR "/smbmnt", NULL)) { -+ execv(SBINDIR "/smbmnt", args); -+ fprintf(stderr,"execv of %s failed. Error was %s.", SBINDIR "/smbmnt", strerror(errno)); - } else { - execvp("smbmnt", args); - fprintf(stderr,"execvp of smbmnt failed. Error was %s.", strerror(errno) ); diff --git a/packaging/Mandrake/swat_16.xpm.bz2 b/packaging/Mandrake/swat_16.xpm.bz2 deleted file mode 100644 index c17430c589..0000000000 Binary files a/packaging/Mandrake/swat_16.xpm.bz2 and /dev/null differ diff --git a/packaging/Mandrake/swat_32.xpm.bz2 b/packaging/Mandrake/swat_32.xpm.bz2 deleted file mode 100644 index c8e4df6bff..0000000000 Binary files a/packaging/Mandrake/swat_32.xpm.bz2 and /dev/null differ diff --git a/packaging/Mandrake/swat_48.xpm.bz2 b/packaging/Mandrake/swat_48.xpm.bz2 deleted file mode 100644 index 812b737b4f..0000000000 Binary files a/packaging/Mandrake/swat_48.xpm.bz2 and /dev/null differ diff --git a/packaging/README.UnixWare b/packaging/README.UnixWare deleted file mode 100644 index a4b08954ec..0000000000 --- a/packaging/README.UnixWare +++ /dev/null @@ -1,6 +0,0 @@ -Date: January 9, 2001 -Maintainer: John H Terpstra -Subject: UnixWare Packaging Files -Modifications: Initial release 20010109 - -Note: The packaging build files for UnixWare are located under ~samba/packaging/Caldera/UnixWare. diff --git a/packaging/RedHat/samba2.spec.tmpl b/packaging/RedHat/samba2.spec.tmpl deleted file mode 100644 index 638df4f2cc..0000000000 --- a/packaging/RedHat/samba2.spec.tmpl +++ /dev/null @@ -1,429 +0,0 @@ -Summary: Samba SMB client and server -Name: samba -Version: PVERSION -Release: PRELEASE -Copyright: GNU GPL version 2 -Group: Networking -Source: http://download.samba.org/samba/ftp/samba-%{version}.tar.bz2 -Packager: Gerald Carter [Samba-Team] -Requires: pam >= 0.72 kernel >= 2.2.1 glibc >= 2.1.2 -Prereq: chkconfig fileutils -Provides: samba = %{version} -Obsoletes: samba-common, samba-client, samba-swat -BuildRoot: /var/tmp/samba -Prefix: /usr - -%description -Samba provides an SMB/CIFS server which can be used to provide -network file and print services to SMB/CIFS clients, including -various versions of MS Windows, OS/2, and other Linux machines. -Samba also provides some SMB clients, which complement the -built-in SMB filesystem in Linux. Samba uses NetBIOS over TCP/IP -(NetBT) protocols and does NOT need NetBEUI (Microsoft Raw NetBIOS -frame) protocol. - -Samba 3.0 also introduces UNICODE support and kerberos/ldap -integration as a member server in a Windows 2000 domain. - -Please refer to the WHATSNEW.txt document for fixup information. - -%changelog -* Mon Nov 18 2002 Gerald Carter - - removed change log entries since history - is being maintained in CVS - -%prep -%setup - -%build -## Build main Samba source -cd source - -%ifarch ia64 -libtoolize --copy --force # get it to recognize IA-64 -autoheader -autoconf -EXTRA="-D_LARGEFILE64_SOURCE" -%endif -NUMCPU=`grep processor /proc/cpuinfo | wc -l` -CFLAGS="$RPM_OPT_FLAGS $EXTRA" ./configure \ - --prefix=%{prefix} \ - --localstatedir=/var \ - --with-configdir=/etc/samba \ - --with-privatedir=/etc/samba \ - --with-fhs \ - --with-quotas \ - --with-smbmount \ - --with-pam \ - --with-pam_smbpass \ - --with-syslog \ - --with-utmp \ - --with-sambabook=%{prefix}/share/swat/using_samba \ - --with-swatdir=%{prefix}/share/swat \ - --with-libsmbclient -make -j${NUMCPU} proto -make -j${NUMCPU} all nsswitch/libnss_wins.so modules -make -j${NUMCPU} debug2html -make -j${NUMCPU} bin/smbspool - -# Remove some permission bits to avoid to many dependencies -find examples docs -type f | xargs -r chmod -x - -%install -rm -rf $RPM_BUILD_ROOT -mkdir -p $RPM_BUILD_ROOT -mkdir -p $RPM_BUILD_ROOT/sbin -mkdir -p $RPM_BUILD_ROOT/etc/samba -mkdir -p $RPM_BUILD_ROOT/etc/{logrotate.d,pam.d,samba} -mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d -mkdir -p $RPM_BUILD_ROOT%{prefix}/{bin,sbin} -mkdir -p $RPM_BUILD_ROOT%{prefix}/share/swat/{images,help,include,using_samba} -mkdir -p $RPM_BUILD_ROOT%{prefix}/share/swat/using_samba/{figs,gifs} -mkdir -p $RPM_BUILD_ROOTMANDIR_MACRO -mkdir -p $RPM_BUILD_ROOT/var/cache/samba -mkdir -p $RPM_BUILD_ROOT/var/{log,run}/samba -mkdir -p $RPM_BUILD_ROOT/var/spool/samba -mkdir -p $RPM_BUILD_ROOT/lib/security -mkdir -p $RPM_BUILD_ROOT%{prefix}/lib/samba/vfs -mkdir -p $RPM_BUILD_ROOT%{prefix}/{lib,include} - -# Install standard binary files -for i in nmblookup smbclient smbpasswd smbstatus testparm testprns \ - rpcclient smbspool smbcacls smbcontrol wbinfo smbmnt net smbgroupedit \ - smbcacls pdbedit tdbbackup smbtree -do - install -m755 source/bin/$i $RPM_BUILD_ROOT%{prefix}/bin -done - -for i in mksmbpasswd.sh smbtar findsmb -do - install -m755 source/script/$i $RPM_BUILD_ROOT%{prefix}/bin -done - -# Install secure binary files -for i in smbd nmbd swat smbmount smbumount debug2html winbindd wrepld -do - install -m755 source/bin/$i $RPM_BUILD_ROOT%{prefix}/sbin -done - -# we need a symlink for mount to recognise the smb and smbfs filesystem types -ln -sf %{prefix}/sbin/smbmount $RPM_BUILD_ROOT/sbin/mount.smbfs -ln -sf %{prefix}/sbin/smbmount $RPM_BUILD_ROOT/sbin/mount.smb - -# This allows us to get away without duplicating code that -# sombody else can maintain for us. -cd source -make BASEDIR=$RPM_BUILD_ROOT/usr \ - CONFIGDIR=$RPM_BUILD_ROOT/etc/samba \ - LIBDIR=$RPM_BUILD_ROOT%{prefix}/lib/samba \ - VARDIR=$RPM_BUILD_ROOT/var \ - SBINDIR=$RPM_BUILD_ROOT%{prefix}/sbin \ - BINDIR=$RPM_BUILD_ROOT%{prefix}/bin \ - MANDIR=$RPM_BUILD_ROOTMANDIR_MACRO \ - SWATDIR=$RPM_BUILD_ROOT%{prefix}/share/swat \ - SAMBABOOK=$RPM_BUILD_ROOT%{prefix}/share/swat/using_samba \ - installman installswat installdat installmodules -cd .. - -# Install the nsswitch wins library -install -m755 source/nsswitch/libnss_wins.so $RPM_BUILD_ROOT/lib -( cd $RPM_BUILD_ROOT/lib; ln -sf libnss_wins.so libnss_wins.so.2; ) - -# Install winbind shared libraries -install -m755 source/nsswitch/libnss_winbind.so $RPM_BUILD_ROOT/lib -( cd $RPM_BUILD_ROOT/lib; ln -sf libnss_winbind.so libnss_winbind.so.2; ) -install -m755 source/nsswitch/pam_winbind.so $RPM_BUILD_ROOT/lib/security - -# Install pam_smbpass.so -install -m755 source/bin/pam_smbpass.so $RPM_BUILD_ROOT/lib/security - -# libsmbclient -install -m 755 source/bin/libsmbclient.so $RPM_BUILD_ROOT%{prefix}/lib/ -install -m 755 source/bin/libsmbclient.a $RPM_BUILD_ROOT%{prefix}/lib/ -install -m 644 source/include/libsmbclient.h $RPM_BUILD_ROOT%{prefix}/include/ - -# Install SWAT helper files -#for i in swat/help/*.html docs/htmldocs/*.html -#do -# install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/help -#done -#for i in swat/images/*.gif -#do -# install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/images -#done -#for i in swat/include/*.html -#do -# install -m644 $i $RPM_BUILD_ROOT%{prefix}/share/swat/include -#done - -# Install the miscellany -install -m755 packaging/RedHat/smbprint $RPM_BUILD_ROOT%{prefix}/bin -install -m755 packaging/RedHat/smb.init $RPM_BUILD_ROOT/etc/rc.d/init.d/smb -install -m755 packaging/RedHat/winbind.init $RPM_BUILD_ROOT/etc/rc.d/init.d/winbind -install -m755 packaging/RedHat/smb.init $RPM_BUILD_ROOT%{prefix}/sbin/samba -install -m644 packaging/RedHat/samba.log $RPM_BUILD_ROOT/etc/logrotate.d/samba -install -m644 packaging/RedHat/smb.conf $RPM_BUILD_ROOT/etc/samba/smb.conf -install -m644 packaging/RedHat/smbusers $RPM_BUILD_ROOT/etc/samba/smbusers -install -m644 packaging/RedHat/samba.pamd $RPM_BUILD_ROOT/etc/pam.d/samba -install -m644 packaging/RedHat/samba.pamd.stack $RPM_BUILD_ROOT/etc/samba/samba.stack -install -m644 packaging/RedHat/samba.xinetd $RPM_BUILD_ROOT/etc/samba/samba.xinetd -echo 127.0.0.1 localhost > $RPM_BUILD_ROOT/etc/samba/lmhosts - -%clean -rm -rf $RPM_BUILD_ROOT - -%post -/sbin/chkconfig --add smb -/sbin/chkconfig --add winbind -/sbin/chkconfig smb off -/sbin/chkconfig winbind off - -echo "Looking for old /etc/smb.conf..." -if [ -f /etc/smb.conf -a ! -f /etc/samba/smb.conf ]; then - echo "Moving old /etc/smb.conf to /etc/samba/smb.conf" - mv /etc/smb.conf /etc/samba/smb.conf -fi - -echo "Looking for old /etc/smbusers..." -if [ -f /etc/smbusers -a ! -f /etc/samba/smbusers ]; then - echo "Moving old /etc/smbusers to /etc/samba/smbusers" - mv /etc/smbusers /etc/samba/smbusers -fi - -echo "Looking for old /etc/lmhosts..." -if [ -f /etc/lmhosts -a ! -f /etc/samba/lmhosts ]; then - echo "Moving old /etc/lmhosts to /etc/samba/lmhosts" - mv /etc/lmhosts /etc/samba/lmhosts -fi - -echo "Looking for old /etc/MACHINE.SID..." -if [ -f /etc/MACHINE.SID -a ! -f /etc/samba/MACHINE.SID ]; then - echo "Moving old /etc/MACHINE.SID to /etc/samba/MACHINE.SID" - mv /etc/MACHINE.SID /etc/samba/MACHINE.SID -fi - -echo "Looking for old /etc/smbpasswd..." -if [ -f /etc/smbpasswd -a ! -f /etc/samba/smbpasswd ]; then - echo "Moving old /etc/smbpasswd to /etc/samba/smbpasswd" - mv /etc/smbpasswd /etc/samba/smbpasswd -fi - -# -# For 2.2.1 we move the tdb files from /var/lock/samba to /var/cache/samba -# to preserve across reboots. -# -echo "Moving tdb files in /var/lock/samba/*.tdb to /var/cache/samba/*.tdb" -for i in /var/lock/samba/*.tdb -do -if [ -f $i ]; then - newname=`echo $i | sed -e's|var\/lock\/samba|var\/cache\/samba|'` - echo "Moving $i to $newname" - mv $i $newname -fi -done - -# Remove the transient tdb files. -if [ -e /var/cache/samba/brlock.tdb ]; then - rm -f /var/cache/samba/brlock.tdb -fi - -if [ -e /var/cache/samba/unexpected.tdb ]; then - rm -f /var/cache/samba/unexpected.tdb -fi - -if [ -e /var/cache/samba/connections.tdb ]; then - rm -f /var/cache/samba/connections.tdb -fi - -if [ -e /var/cache/samba/locking.tdb ]; then - rm -f /var/cache/samba/locking.tdb -fi - -if [ -e /var/cache/samba/messages.tdb ]; then - rm -f /var/cache/samba/messages.tdb -fi - -if [ -d /var/lock/samba ]; then - rm -rf /var/lock/samba -fi - -# Add swat entry to /etc/services if not already there. -if !( grep ^[:space:]*swat /etc/services > /dev/null ) then - echo 'swat 901/tcp # Add swat service used via inetd' >> /etc/services -fi - -# Add swat entry to /etc/inetd.conf if needed. -if [ -f /etc/inetd.conf ]; then - if !( grep ^[:space:]*swat /etc/inetd.conf > /dev/null ) then - echo 'swat stream tcp nowait.400 root %{prefix}/sbin/swat swat' >> /etc/inetd.conf - killall -1 inetd || : - fi -fi - -# Add swat entry to xinetd.d if needed. -if [ -d $RPM_BUILD_ROOT/etc/xinetd.d -a ! -f /etc/xinetd.d/swat ]; then - mv /etc/samba/samba.xinetd /etc/xinetd.d/swat -else - rm -f /etc/samba/samba.xinetd -fi - -# Install the correct version of the samba pam file, depending on pam version. -if [ -f /lib/security/pam_stack.so ]; then - echo "Installing stack version of /etc/pam.d/samba..." - mv /etc/samba/samba.stack /etc/pam.d/samba -else - echo "Installing non-stack version of /etc/pam.d/samba..." - rm -f /etc/samba/samba.stack -fi - -# Create winbind nss client symlink - -if [ -e /lib/libnss_winbind.so ]; then - ln -sf /lib/libnss_winbind.so /lib/libnss_winbind.so.2 -fi - -%preun -if [ $1 = 0 ] ; then - /sbin/chkconfig --del smb - - # We want to remove the browse.dat and wins.dat files so they can not interfer with a new version of samba! - if [ -e /var/cache/samba/browse.dat ]; then - rm -f /var/cache/samba/browse.dat - fi - if [ -e /var/cache/samba/wins.dat ]; then - rm -f /var/cache/samba/wins.dat - fi - - # Remove the transient tdb files. - if [ -e /var/cache/samba/brlock.tdb ]; then - rm -f /var/cache/samba/brlock.tdb - fi - - if [ -e /var/cache/samba/unexpected.tdb ]; then - rm -f /var/cache/samba/unexpected.tdb - fi - - if [ -e /var/cache/samba/connections.tdb ]; then - rm -f /var/cache/samba/connections.tdb - fi - - if [ -e /var/cache/samba/locking.tdb ]; then - rm -f /var/cache/samba/locking.tdb - fi - - if [ -e /var/cache/samba/messages.tdb ]; then - rm -f /var/cache/samba/messages.tdb - fi - - # Remove winbind nss client symlink - - if [ -L /lib/libnss_winbind.so.2 ]; then - rm -f /lib/libnss_winbind.so.2 - fi -fi - -%postun -# Only delete remnants of samba if this is the final deletion. -if [ $1 = 0 ] ; then - if [ -x /etc/pam.d/samba ]; then - rm -f /etc/pam.d/samba - fi - if [ -e /var/log/samba ]; then - rm -rf /var/log/samba - fi - if [ -e /var/cache/samba ]; then - rm -rf /var/cache/samba - fi - - # Remove swat entries from /etc/inetd.conf and /etc/services - cd /etc - tmpfile=/etc/tmp.$$ - if [ -f /etc/inetd.conf ]; then - # preserve inetd.conf permissions. - cp -p /etc/inetd.conf $tmpfile - sed -e '/^[:space:]*swat.*$/d' /etc/inetd.conf > $tmpfile - mv $tmpfile inetd.conf - fi - # preserve services permissions. - cp -p /etc/services $tmpfile - sed -e '/^[:space:]*swat.*$/d' /etc/services > $tmpfile - mv $tmpfile /etc/services - - # Remove swat entry from /etc/xinetd.d - if [ -f /etc/xinetd.d/swat ]; then - rm -r /etc/xinetd.d/swat - fi -fi - -%files -%defattr(-,root,root) -%doc README COPYING Manifest Read-Manifest-Now -%doc WHATSNEW.txt Roadmap -%doc docs -%doc swat/README -%doc examples -%{prefix}/sbin/smbd -%{prefix}/sbin/nmbd -%{prefix}/sbin/swat -%{prefix}/bin/smbmnt -%{prefix}/sbin/smbmount -%{prefix}/sbin/smbumount -%{prefix}/sbin/winbindd -%{prefix}/sbin/wrepld -%{prefix}/sbin/samba -%{prefix}/sbin/debug2html -/sbin/mount.smbfs -/sbin/mount.smb -%{prefix}/bin/mksmbpasswd.sh -%{prefix}/bin/smbclient -%{prefix}/bin/smbspool -%{prefix}/bin/rpcclient -%{prefix}/bin/testparm -%{prefix}/bin/testprns -%{prefix}/bin/findsmb -%{prefix}/bin/smbstatus -%{prefix}/bin/nmblookup -%{prefix}/bin/smbpasswd -%{prefix}/bin/smbtar -%{prefix}/bin/smbprint -%{prefix}/bin/smbcontrol -%{prefix}/bin/wbinfo -%{prefix}/bin/net -%{prefix}/bin/smbgroupedit -%{prefix}/bin/smbcacls -%{prefix}/bin/pdbedit -%{prefix}/bin/tdbbackup -%{prefix}/bin/smbtree -%attr(755,root,root) /lib/libnss_wins.s* -%attr(755,root,root) %{prefix}/lib/samba/vfs/*.so -%attr(755,root,root) %{prefix}/lib/samba/*.dat -%{prefix}/include/libsmbclient.h -%{prefix}/lib/libsmbclient.a -%{prefix}/lib/libsmbclient.so -%{prefix}/share/swat/help/* -%{prefix}/share/swat/images/* -%{prefix}/share/swat/include/*.html -%{prefix}/share/swat/lang/*/help/* -%{prefix}/share/swat/lang/*/images/* -%{prefix}/share/swat/lang/*/include/*.html -%{prefix}/share/swat/using_samba/* -%config(noreplace) /etc/samba/lmhosts -%config(noreplace) /etc/samba/smb.conf -%config(noreplace) /etc/samba/smbusers -/etc/samba/samba.stack -/etc/samba/samba.xinetd -/etc/rc.d/init.d/smb -/etc/rc.d/init.d/winbind -/etc/logrotate.d/samba -%config(noreplace) /etc/pam.d/samba -MANDIR_MACRO/man1/* -MANDIR_MACRO/man5/* -MANDIR_MACRO/man7/* -MANDIR_MACRO/man8/* -%attr(755,root,root) %dir /var/cache/samba -%dir /var/log/samba -%dir /var/run/samba -%attr(1777,root,root) %dir /var/spool/samba -%attr(-,root,root) /lib/libnss_winbind.so -%attr(-,root,root) /lib/security/pam_winbind.so -%attr(-,root,root) /lib/security/pam_smbpass.so diff --git a/packaging/SGI/relnotes.html b/packaging/SGI/relnotes.html index d055be6c1a..afcf579677 100644 --- a/packaging/SGI/relnotes.html +++ b/packaging/SGI/relnotes.html @@ -205,8 +205,17 @@ printer name to describe its location. of the docs directory from the Samba distribution; consult samba(7) for an introduction.

    -

    There is a mailing list for discussion of Samba. To subscribe and - for more information go to lists.samba.org. +

    There is a mailing list for discussion of Samba. To subscribe send mail +to listproc@samba.org +with a body of "subscribe samba Your Name"

    + +

    To send mail to everyone on the list mail to samba@samba.org. +

    + +

    There is also an announcement mailing list where new versions are announced. +To subscribe send mail to listproc@samba.org +with a body of "subscribe samba-announce Your Name". All announcements +also go to the samba list.

    You might also like to look at the Usenet news group comp.protocols.smb as it often contains lots of useful info and is frequented by lots of Samba @@ -214,10 +223,10 @@ users. The newsgroup was initially setup by people on the Samba mailing list. It is not, however, exclusive to Samba, it is a forum for discussing the SMB protocol (which Samba implements).

    -

    - A Samba WWW site has been setup with lots of useful info. Connect to: - http://samba.org/. You can - contact the webmaster at "webmaster at samba dot org". +

    A Samba WWW site has been setup with lots of useful info. Connect to: +http://samba.org/pub/samba/. +It is maintained by Paul Blackman (thanks Paul!). You can contact him at +ictinus@lake.canberra.edu.au.

    diff --git a/packaging/Solaris/makepkg.sh b/packaging/Solaris/makepkg.sh deleted file mode 100755 index bd370e9a62..0000000000 --- a/packaging/Solaris/makepkg.sh +++ /dev/null @@ -1,154 +0,0 @@ -#!/bin/sh -# -# Copyright (C) Shirish A Kalele 2000 -# -# Builds a Samba package from the samba distribution. -# By default, the package will be built to install samba in /usr/local -# Change the INSTALL_BASE variable to change this: will modify the pkginfo -# and samba.server files to point to the new INSTALL_BASE -# -INSTALL_BASE=/usr/local - -add_dynamic_entries() -{ - # Add the binaries, docs and SWAT files - - echo "#\n# Binaries \n#" - cd $DISTR_BASE/source/bin - for binfile in * - do - if [ -f $binfile ]; then - echo f none samba/bin/$binfile=source/bin/$binfile 0755 root other - fi - done - - # Add the scripts to bin/ - echo "#\n# Scripts \n#" - cd $DISTR_BASE/source/script - for shfile in * - do - if [ -f $shfile ]; then - echo f none samba/bin/$shfile=source/script/$shfile 0755 root other - fi - done - - # Add the manpages - echo "#\n# man pages \n#" - echo d none /usr ? ? ? - echo d none /usr/share ? ? ? - echo d none /usr/share/man ? ? ? - - # Create directories for man page sections if nonexistent - cd $DISTR_BASE/docs/manpages - for i in 1 2 3 4 5 6 7 8 9 - do - manpages=`ls *.$i 2>/dev/null` - if [ $? -eq 0 ] - then - echo d none /usr/share/man/man$i ? ? ? - for manpage in $manpages - do - echo f none /usr/share/man/man${i}/${manpage}=docs/manpages/$manpage 0644 root other - done - fi - done - - echo "#\n# HTML documentation \n#" - cd $DISTR_BASE - list=`find docs/htmldocs -type d | grep -v "/CVS$"` - for docdir in $list - do - if [ -d $docdir ]; then - echo d none samba/$docdir 0755 root other - fi - done - - list=`find docs/htmldocs -type f | grep -v /CVS/` - for htmldoc in $list - do - if [ -f $htmldoc ]; then - echo f none samba/$htmldoc=$htmldoc 0644 root other - fi - done - - # Create a symbolic link to the Samba book in docs/ for beginners - echo 's none samba/docs/samba_book=htmldocs/using_samba' - - echo "#\n# Text Docs \n#" - echo d none samba/docs/textdocs 0755 root other - cd $DISTR_BASE/docs/textdocs - for textdoc in * - do - if [ -f $textdoc ]; then - echo f none samba/docs/textdocs/$textdoc=docs/textdocs/$textdoc 0644 root other - fi - done - echo "#\n# SWAT \n#" - cd $DISTR_BASE - list=`find swat -type d | grep -v "/CVS$"` - for i in $list - do - echo "d none samba/$i 0755 root other" - done - list=`find swat -type f | grep -v /CVS/` - for i in $list - do - echo "f none samba/$i=$i 0644 root other" - done - echo "#\n# HTML documentation for SWAT\n#" - cd $DISTR_BASE/docs/htmldocs - for htmldoc in * - do - if [ -f $htmldoc ]; then - echo f none samba/swat/help/$htmldoc=docs/htmldocs/$htmldoc 0644 root other - fi - done - - echo "#\n# Using Samba Book files for SWAT\n#" - cd $DISTR_BASE/docs/htmldocs - -# set up a symbolic link instead of duplicating the book tree - echo 's none samba/swat/using_samba=../docs/htmldocs/using_samba' - -} - -if [ $# = 0 ] -then - # Try to guess the distribution base.. - CURR_DIR=`pwd` - DISTR_BASE=`echo $CURR_DIR | sed 's|\(.*\)/packaging.*|\1|'` - echo "Assuming Samba distribution is rooted at $DISTR_BASE.." -else - DISTR_BASE=$1 -fi - -# -if [ ! -d $DISTR_BASE ]; then - echo "Source build directory $DISTR_BASE does not exist." - exit 1 -fi - -# Set up the prototype file from prototype.master -if [ -f prototype ]; then - rm prototype -fi - -# Setup version from version.h -VERSION=`sed 's/#define VERSION \"\(.*\)\"$/\1/' ../../source/include/version.h` -sed -e "s|__VERSION__|$VERSION|" -e "s|__ARCH__|`uname -p`|" -e "s|__BASEDIR__|$INSTALL_BASE|g" pkginfo.master >pkginfo - -sed -e "s|__BASEDIR__|$INSTALL_BASE|g" inetd.conf.master >inetd.conf -sed -e "s|__BASEDIR__|$INSTALL_BASE|g" samba.server.master >samba.server - -cp prototype.master prototype - -# Add the dynamic part to the prototype file -(add_dynamic_entries >> prototype) - -# Create the package -pkgmk -o -d /tmp -b $DISTR_BASE -f prototype -if [ $? = 0 ] -then - pkgtrans /tmp samba.pkg samba -fi -echo The samba package is in /tmp diff --git a/swat/README b/swat/README deleted file mode 100644 index 588ecef769..0000000000 --- a/swat/README +++ /dev/null @@ -1,77 +0,0 @@ -This is a brief description of how to install and use the Samba Web -Administration Tool on your machine. - -Installation ------------- - -After you compile SWAT you need to run "make install" to install the -swat binary and the various help files and images. A default install -would put these in: - -/usr/local/samba/bin/swat -/usr/local/samba/swat/images/* -/usr/local/samba/swat/help/* - -Running via inetd ------------------ - -You then need to edit your /etc/inetd.conf and /etc/services to enable -SWAT to be launched via inetd. - -In /etc/services you need to add a line like this: - -swat 901/tcp - -the choice of port number isn't really important except that it should -be less than 1024 and not currently used (using a number above 1024 -presents an obscure security hole depending on the implementation -details of your inetd daemon). - -In /etc/inetd.conf you should add a line like this: - -swat stream tcp nowait.400 root /usr/local/samba/bin/swat swat - -One you have edited /etc/services and /etc/inetd.conf you need to send -a HUP signal to inetd. On many systems "killall -1 inetd" will do this -on others you will need to use "kill -1 PID" where PID is the process -ID of the inetd daemon. - - - -Launching ---------- - -To launch SWAT just run your favourite web browser and point it at -http://localhost:901/ - -Note that you can attach to SWAT from any IP connected machine but -connecting from a remote machine leaves your connection open to -password sniffing as passwords will be sent in the clear over the -wire. - -You should be prompted for a username/password when you connect. You -will need to provide the username "root" and the correct root -password. - -Running -------- - -Just follow your nose! If you can't work out how to use it then maybe -you should use "vi smb.conf" instead. - - -WARNINGS --------- - -SWAT will rewrite your smb.conf file. It will rearrange the entries -and delete all comments, include= and copy= options. If you have a -carefully crafted smb.conf then back it up or don't use SWAT! - - -Development ------------ - -Please join the samba-technical mailing list if you want to discuss -the development of SWAT. Note that this list is for technical developer -discussions and is not a general help list. - diff --git a/swat/help/welcome.html b/swat/help/welcome.html index b3e9a81766..8fc54ad5f2 100644 --- a/swat/help/welcome.html +++ b/swat/help/welcome.html @@ -22,9 +22,9 @@ Please choose a configuration action using one of the above buttons
  • smbcontrol - send control messages to Samba daemons
  • smbpasswd - managing SMB passwords
  • SWAT - web configuration tool -
  • make_smbcodepage - codepage creation -
  • make_unicodemap - unicode map file creation -
  • smbrun - internal smbd utility +
  • net - tool for administration of Samba and remote CIFS servers +
  • pdbedit - Samba user account management tool +
  • tdbbackup - Tool for backing up TDB databases
  • Client Tools
      @@ -35,6 +35,11 @@ Please choose a configuration action using one of the above buttons
    • smbmount - user space tool for mounting SMB filesystems under Linux
    • smbspool - command line SMB print client
    • smbumount - user space tool for umounting SMB filesystems under Linux +
    • ntlm_auth - allow external programs to use NTLM authentication +
    • smbcquotas - get or set quotas on NTFS 5 shares +
    • smbsh - Allow access to remote SMB shares using a UNIX shell +
    • smbtree - Text-based SMB network browsing +
    • smbspool - Send a print job to an SMB printer
  • Diagnostic Utilities
      @@ -42,10 +47,17 @@ Please choose a configuration action using one of the above buttons
    • testparm - validating your config file
    • testprns - testing printer configuration
    • nmblookup - NetBIOS name query tool +
    • wbinfo - Tool for getting winbind information +
    +
  • Misc. Utilities +
      +
    • profiles - migrating profiles from one domain to another +
    • editreg - editing windows registry files +
    • log2pcap - generate pcap files from samba log files
  • Books diff --git a/swat/images/globals.gif b/swat/images/globals.gif index 75e874f380..7a9a8510d7 100644 Binary files a/swat/images/globals.gif and b/swat/images/globals.gif differ diff --git a/swat/images/home.gif b/swat/images/home.gif index 364a2955c8..84b1dd032f 100644 Binary files a/swat/images/home.gif and b/swat/images/home.gif differ diff --git a/swat/images/passwd.gif b/swat/images/passwd.gif index 2fc88fb182..17393a1402 100644 Binary files a/swat/images/passwd.gif and b/swat/images/passwd.gif differ diff --git a/swat/images/printers.gif b/swat/images/printers.gif index 212a70c664..db9ec3f0e0 100644 Binary files a/swat/images/printers.gif and b/swat/images/printers.gif differ diff --git a/swat/images/shares.gif b/swat/images/shares.gif index 2c04ca8b9c..b3af15e35d 100644 Binary files a/swat/images/shares.gif and b/swat/images/shares.gif differ diff --git a/swat/images/status.gif b/swat/images/status.gif index 48e2f07fcd..81ef0bcf16 100644 Binary files a/swat/images/status.gif and b/swat/images/status.gif differ diff --git a/swat/images/viewconfig.gif b/swat/images/viewconfig.gif index 5dee515669..bdeac1cf96 100644 Binary files a/swat/images/viewconfig.gif and b/swat/images/viewconfig.gif differ diff --git a/swat/images/wizard.gif b/swat/images/wizard.gif index a2474e0f00..a4614e936b 100644 Binary files a/swat/images/wizard.gif and b/swat/images/wizard.gif differ -- cgit From b7aaa707fec8b7a2231e82322eb025566a456796 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 18:28:41 +0000 Subject: add missing file from 3.0 (This used to be commit 8c27bfaa3fbea96d947814071b323c31e7c77701) --- make-tarball.sh | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 make-tarball.sh diff --git a/make-tarball.sh b/make-tarball.sh new file mode 100644 index 0000000000..1eb05db70d --- /dev/null +++ b/make-tarball.sh @@ -0,0 +1,43 @@ +#!/bin/sh + +## A simple script to build a tarball of the current CVS tree. +## You either need to include the using_samba cvs module in the +## parent directory or tell the script where to find it +## +## Usgae: ./make-tarball.sh + +USING_SAMBA=../using_samba/ +SRCDIR=`pwd` + +if [ ! -d $USING_SAMBA ]; then + + echo Cannot find "Using Samba" directory \(assuming $USING_SAMBA\). + echo Please set the USING_SAMBA variable in this script to the correct + echo location. The html files are available in the using_samba CVS + echo module on cvs.samba.org. See http://cvs/samba.org/ for details + echo about anonymous CVS access. Exiting now.... + + exit 1 + +fi + +VERSION=`grep SAMBA_VERSION_OFFICIAL_STRING source/include/version.h | cut -d\" -f2 | sed 's/ /_/g'` +TARBALLDIR=/tmp/samba-$VERSION + +echo Creating the tarball source directory in $TARBALLDIR + +/bin/rm -rf $TARBALLDIR +/bin/rm -f samba-$VERSION.tar + +mkdir $TARBALLDIR +rsync -aC ./ $TARBALLDIR +rsync -aC $USING_SAMBA $TARBALLDIR/docs/htmldocs/ + +echo Creating packaging scripts... +( cd $TARBALLDIR/packaging; sh bin/update-pkginfo $VERSION 1 ) + +echo Creating source/configure... +( cd $TARBALLDIR/source; ./autogen.sh ) + +echo Making tarball samba-$VERSION.tar in current directory... +( cd `dirname $TARBALLDIR`; tar cf $SRCDIR/samba-$VERSION.tar samba-$VERSION ) -- cgit From fd5b572f556bcd56ffa04013b8ce731dcf79dcf0 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 18:29:33 +0000 Subject: version.h is autogenerated now (This used to be commit 04f8cbbca66024ffdcd2ebc0f4db7849d02ca99b) --- source3/include/version.h | 8 -------- 1 file changed, 8 deletions(-) delete mode 100644 source3/include/version.h diff --git a/source3/include/version.h b/source3/include/version.h deleted file mode 100644 index 51e8c408e6..0000000000 --- a/source3/include/version.h +++ /dev/null @@ -1,8 +0,0 @@ -/* Autogenerated by script/mkversion.sh */ -#define SAMBA_VERSION_MAJOR 3 -#define SAMBA_VERSION_MINOR 0 -#define SAMBA_VERSION_RELEASE 1 -#define SAMBA_VERSION_PRE_RELEASE 1 -#define SAMBA_VERSION_IS_CVS_SNAPSHOT 1 -#define SAMBA_VERSION_OFFICIAL_STRING "CVS 3.0.1pre1" -#define SAMBA_VERSION_STRING samba_version_string() -- cgit From 9a9031ec729f1ce6bd18e95bd726d4200dfd9500 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 10 Sep 2003 00:43:00 +0000 Subject: remove references to 'strip dot' (This used to be commit b5c5a9dc76c7584047e6ad8e7063b2da348e67d7) --- docs/docbook/smbdotconf/filename/stripdot.xml | 12 ------------ source3/param/loadparm.c | 4 ---- 2 files changed, 16 deletions(-) delete mode 100644 docs/docbook/smbdotconf/filename/stripdot.xml diff --git a/docs/docbook/smbdotconf/filename/stripdot.xml b/docs/docbook/smbdotconf/filename/stripdot.xml deleted file mode 100644 index afed63a12b..0000000000 --- a/docs/docbook/smbdotconf/filename/stripdot.xml +++ /dev/null @@ -1,12 +0,0 @@ - - - This is a boolean that controls whether to - strip trailing dots off UNIX filenames. This helps with some - CDROMs that have filenames ending in a single dot. - - Default: strip dot = no - - diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index 41b32cef10..b370b6b049 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -246,7 +246,6 @@ typedef struct BOOL bUpdateEncrypt; int clientSchannel; int serverSchannel; - BOOL bStripDot; BOOL bNullPasswords; BOOL bObeyPamRestrictions; BOOL bLoadPrinters; @@ -965,7 +964,6 @@ static struct parm_struct parm_table[] = { {"default devmode", P_BOOL, P_LOCAL, &sDefault.bDefaultDevmode, NULL, NULL, FLAG_ADVANCED | FLAG_PRINT}, {"Filename Handling", P_SEP, P_SEPARATOR}, - {"strip dot", P_BOOL, P_GLOBAL, &Globals.bStripDot, NULL, NULL, FLAG_ADVANCED}, {"mangling method", P_STRING, P_GLOBAL, &Globals.szManglingMethod, NULL, NULL, FLAG_ADVANCED}, {"mangle prefix", P_INTEGER, P_GLOBAL, &Globals.mangle_prefix, NULL, NULL, FLAG_ADVANCED}, @@ -1387,7 +1385,6 @@ static void init_globals(void) Globals.bReadbmpx = False; Globals.bNullPasswords = False; Globals.bObeyPamRestrictions = False; - Globals.bStripDot = False; Globals.syslog = 1; Globals.bSyslogOnly = False; Globals.bTimestampLogs = True; @@ -1718,7 +1715,6 @@ FN_GLOBAL_BOOL(lp_large_readwrite, &Globals.bLargeReadwrite) FN_GLOBAL_BOOL(lp_writeraw, &Globals.bWriteRaw) FN_GLOBAL_BOOL(lp_null_passwords, &Globals.bNullPasswords) FN_GLOBAL_BOOL(lp_obey_pam_restrictions, &Globals.bObeyPamRestrictions) -FN_GLOBAL_BOOL(lp_strip_dot, &Globals.bStripDot) FN_GLOBAL_BOOL(lp_encrypted_passwords, &Globals.bEncryptPasswords) FN_GLOBAL_BOOL(lp_update_encrypted, &Globals.bUpdateEncrypt) FN_GLOBAL_INTEGER(lp_client_schannel, &Globals.clientSchannel) -- cgit From 6f5133aa825572d5b4e12d9c23f8040259798660 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 10 Sep 2003 01:14:37 +0000 Subject: merge from 3.0 (This used to be commit fa0d4ea150e0243958273168eaf9bf195e2c12e0) --- docs/docbook/smbdotconf/locking/strictlocking.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/docbook/smbdotconf/locking/strictlocking.xml b/docs/docbook/smbdotconf/locking/strictlocking.xml index 34c1c7fe5e..a13b4d52a1 100644 --- a/docs/docbook/smbdotconf/locking/strictlocking.xml +++ b/docs/docbook/smbdotconf/locking/strictlocking.xml @@ -3,15 +3,15 @@ xmlns:samba="http://samba.org/common"> This is a boolean that controls the handling of - file locking in the server. When this is set to yes + file locking in the server. When this is set to yes, the server will check every read and write access for file locks, and deny access if locks exist. This can be slow on some systems. - When strict locking is no the server does file + When strict locking is disabled, the server performs file lock checks only when the client explicitly asks for them. Well-behaved clients always ask for lock checks when it - is important, so in the vast majority of cases strict + is important. So in the vast majority of cases, strict locking = no is preferable. Default: strict locking = no -- cgit From ca4dabf12c8f23977c4ed190a5e32e16e7d56d6b Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Wed, 10 Sep 2003 03:34:21 +0000 Subject: Removed accidentally re-added file. (This used to be commit a7bffe2095e4bb591dfa97ea4d786483fd44053b) --- source3/intl/libgettext.h | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 source3/intl/libgettext.h diff --git a/source3/intl/libgettext.h b/source3/intl/libgettext.h deleted file mode 100644 index e69de29bb2..0000000000 -- cgit From f59a010674418f3e82774a8680fa108d02eb8460 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Wed, 10 Sep 2003 03:47:10 +0000 Subject: Remove autogenerated file. (This used to be commit 275bdc3ff550fd14a11c9f3919a82d4af35dc6fa) --- source3/smbadduser | 79 ------------------------------------------------------ 1 file changed, 79 deletions(-) delete mode 100755 source3/smbadduser diff --git a/source3/smbadduser b/source3/smbadduser deleted file mode 100755 index 35f6dbab14..0000000000 --- a/source3/smbadduser +++ /dev/null @@ -1,79 +0,0 @@ -#!/bin/csh -# -# smbadduser - Written by Mike Zakharoff -# - -prefix=/usr/local/samba -exec_prefix=${prefix} -LIBDIR=${exec_prefix}/lib -PRIVATEDIR=${prefix}/private -CONFIGDIR=${LIBDIR} - -unalias * -set path = ($path /usr/local/samba/bin) - -set smbpasswd = $PRIVATEDIR/smbpasswd -set user_map = $CONFIGDIR/users.map - -# -# Set to site specific passwd command -# -set passwd = "cat /etc/passwd" -#set passwd = "niscat passwd.org_dir" -#set passwd = "ypcat passwd" - -set line = "----------------------------------------------------------" -if ($#argv == 0) then - echo $line - echo "Written: Mike Zakharoff email: michael.j.zakharoff@boeing.com" - echo "" - echo " 1) Updates $smbpasswd" - echo " 2) Updates $user_map" - echo " 3) Executes smbpasswd for each new user" - echo "" - echo "smbadduser unixid:ntid unixid:ntid ..." - echo "" - echo "Example: smbadduser zak:zakharoffm johns:smithj" - echo $line - exit 1 -endif - -touch $smbpasswd $user_map -set new = () -foreach one ($argv) - echo $one | grep ':' >& /dev/null - if ($status != 0) then - echo "ERROR: Must use unixid:ntid like -> zak:zakharoffm" - continue - endif - set unix = `echo $one | awk -F: '{print $1}'` - set ntid = `echo $one | awk -F: '{print $2}'` - - set usr = `eval $passwd | awk -F: '$1==USR {print $1}' USR=$unix` - if ($#usr != 1) then - echo "ERROR: $unix Not in passwd database SKIPPING..." - continue - endif - set tmp = `cat $smbpasswd | awk -F: '$1==USR {print $1}' USR=$unix` - if ($#tmp != 0) then - echo "ERROR: $unix is already in $smbpasswd SKIPPING..." - continue - endif - - echo "Adding: $unix to $smbpasswd" - /usr/bin/smbpasswd -a -n $unix - if ($unix != $ntid) then - echo "Adding: {$unix = $ntid} to $user_map" - echo "$unix = $ntid" >> $user_map - endif - set new = ($new $unix) -end - -# -# Enter password for new users -# -foreach one ($new) - echo $line - echo "ENTER password for $one" - smbpasswd $one -end -- cgit From 80a11b868d402174ad3afab37c8f461c3c6eeb1c Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Wed, 10 Sep 2003 03:49:43 +0000 Subject: Remove another dead file. (This used to be commit a5656a5756b3c1061d683d664a7f087182b39b47) --- source3/lib/ldap.c | 719 ------------------------------------------------- source3/python/mkpatch | 6 - 2 files changed, 725 deletions(-) delete mode 100644 source3/lib/ldap.c delete mode 100755 source3/python/mkpatch diff --git a/source3/lib/ldap.c b/source3/lib/ldap.c deleted file mode 100644 index 917e03a871..0000000000 --- a/source3/lib/ldap.c +++ /dev/null @@ -1,719 +0,0 @@ -/* - Unix SMB/CIFS implementation. - LDAP protocol helper functions for SAMBA - Copyright (C) Jean François Micouleau 1998 - Copyright (C) Gerald Carter 2001 - Copyright (C) Shahms King 2001 - Copyright (C) Andrew Bartlett 2002 - Copyright (C) Stefan (metze) Metzmacher 2002 - Copyright (C) Jim McDonough 2003 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - -*/ - -#include "includes.h" - -#ifdef HAVE_LDAP -/* TODO: -* persistent connections: if using NSS LDAP, many connections are made -* however, using only one within Samba would be nice -* -* Clean up SSL stuff, compile on OpenLDAP 1.x, 2.x, and Netscape SDK -* -* Other LDAP based login attributes: accountExpires, etc. -* (should be the domain of Samba proper, but the sam_password/SAM_ACCOUNT -* structures don't have fields for some of these attributes) -* -* SSL is done, but can't get the certificate based authentication to work -* against on my test platform (Linux 2.4, OpenLDAP 2.x) -*/ - -/* NOTE: this will NOT work against an Active Directory server -* due to the fact that the two password fields cannot be retrieved -* from a server; recommend using security = domain in this situation -* and/or winbind -*/ - -#include "smb_ldap.h" - -/* We need an internal mapping of LDAP * -> smb_ldap_privates so we implement - it in terms of a VK list. It's a little backwards but its quite efficent */ -static struct smb_ldap_privates *head; - -static struct smb_ldap_privates *get_internal(LDAP *ldap_struct) -{ - struct smb_ldap_privates *ret = head; - - while (NULL != ret && ret->ldap_struct != ldap_struct) { - ret = ret->next; - } - - return ret; -} - -#define SMB_LDAP_DONT_PING_TIME 10 /* ping only all 10 seconds */ - -/******************************************************************* - find the ldap password -******************************************************************/ -static BOOL smb_ldap_fetch_pw(char **dn, char** pw) -{ - char *key = NULL; - size_t size; - - *dn = smb_xstrdup(lp_ldap_admin_dn()); - - if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, *dn) < 0) { - SAFE_FREE(*dn); - DEBUG(0, ("smb_ldap_fetch_pw: asprintf failed!\n")); - } - - *pw=secrets_fetch(key, &size); - SAFE_FREE(key); - if (!size) { - /* Upgrade 2.2 style entry */ - char *p; - char* old_style_key = strdup(*dn); - char *data; - fstring old_style_pw; - - if (!old_style_key) { - DEBUG(0, ("smb_ldap_fetch_pw: strdup failed!\n")); - return False; - } - - for (p=old_style_key; *p; p++) - if (*p == ',') *p = '/'; - - data=secrets_fetch(old_style_key, &size); - if (!size && size < sizeof(old_style_pw)) { - DEBUG(0,("fetch_ldap_pw: neither ldap secret retrieved!\n")); - SAFE_FREE(old_style_key); - SAFE_FREE(*dn); - return False; - } - - strncpy(old_style_pw, data, size); - old_style_pw[size] = 0; - - SAFE_FREE(data); - - if (!secrets_store_ldap_pw(*dn, old_style_pw)) { - DEBUG(0,("fetch_ldap_pw: ldap secret could not be upgraded!\n")); - SAFE_FREE(old_style_key); - SAFE_FREE(*dn); - return False; - } - if (!secrets_delete(old_style_key)) { - DEBUG(0,("fetch_ldap_pw: old ldap secret could not be deleted!\n")); - } - - SAFE_FREE(old_style_key); - - *pw = smb_xstrdup(old_style_pw); - } - - return True; -} - -/******************************************************************* - open a connection to the ldap server. -******************************************************************/ -int smb_ldap_open_connection (struct smb_ldap_privates *ldap_state, - LDAP ** ldap_struct) -{ - int rc = LDAP_SUCCESS; - int version; - BOOL ldap_v3 = False; - -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) - DEBUG(10, ("smb_ldap_open_connection: %s\n", ldap_state->uri)); - - if ((rc = ldap_initialize(ldap_struct, ldap_state->uri)) != LDAP_SUCCESS) { - DEBUG(0, ("ldap_initialize: %s\n", ldap_err2string(rc))); - return rc; - } - -#else - - /* Parse the string manually */ - - { - int port = 0; - fstring protocol; - fstring host; - const char *p = ldap_state->uri; - SMB_ASSERT(sizeof(protocol)>10 && sizeof(host)>254); - - /* skip leading "URL:" (if any) */ - if ( strncasecmp( p, "URL:", 4 ) == 0 ) { - p += 4; - } - - sscanf(p, "%10[^:]://%254s[^:]:%d", protocol, host, &port); - - if (port == 0) { - if (strequal(protocol, "ldap")) { - port = LDAP_PORT; - } else if (strequal(protocol, "ldaps")) { - port = LDAPS_PORT; - } else { - DEBUG(0, ("unrecognised protocol (%s)!\n", protocol)); - } - } - - if ((*ldap_struct = ldap_init(host, port)) == NULL) { - DEBUG(0, ("ldap_init failed !\n")); - return LDAP_OPERATIONS_ERROR; - } - - if (strequal(protocol, "ldaps")) { -#ifdef LDAP_OPT_X_TLS - int tls = LDAP_OPT_X_TLS_HARD; - if (ldap_set_option (*ldap_struct, LDAP_OPT_X_TLS, &tls) != LDAP_SUCCESS) - { - DEBUG(0, ("Failed to setup a TLS session\n")); - } - - DEBUG(3,("LDAPS option set...!\n")); -#else - DEBUG(0,("smb_ldap_open_connection: Secure connection not supported by LDAP client libraries!\n")); - return LDAP_OPERATIONS_ERROR; -#endif - } - } -#endif - - if (ldap_get_option(*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS) - { - if (version != LDAP_VERSION3) - { - version = LDAP_VERSION3; - if (ldap_set_option (*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS) { - ldap_v3 = True; - } - } else { - ldap_v3 = True; - } - } - - if (lp_ldap_ssl() == LDAP_SSL_START_TLS) { -#ifdef LDAP_OPT_X_TLS - if (ldap_v3) { - if ((rc = ldap_start_tls_s (*ldap_struct, NULL, NULL)) != LDAP_SUCCESS) - { - DEBUG(0,("Failed to issue the StartTLS instruction: %s\n", - ldap_err2string(rc))); - return rc; - } - DEBUG (3, ("StartTLS issued: using a TLS connection\n")); - } else { - - DEBUG(0, ("Need LDAPv3 for Start TLS\n")); - return LDAP_OPERATIONS_ERROR; - } -#else - DEBUG(0,("smb_ldap_open_connection: StartTLS not supported by LDAP client libraries!\n")); - return LDAP_OPERATIONS_ERROR; -#endif - } - - DEBUG(2, ("smb_ldap_open_connection: connection opened\n")); - return rc; -} - - -/******************************************************************* - a rebind function for authenticated referrals - This version takes a void* that we can shove useful stuff in :-) -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -#else -static int rebindproc_with_state (LDAP * ld, char **whop, char **credp, - int *methodp, int freeit, void *arg) -{ - struct smb_ldap_privates *ldap_state = arg; - - /** @TODO Should we be doing something to check what servers we rebind to? - Could we get a referral to a machine that we don't want to give our - username and password to? */ - - if (freeit) { - SAFE_FREE(*whop); - memset(*credp, '\0', strlen(*credp)); - SAFE_FREE(*credp); - } else { - DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n", - ldap_state->bind_dn)); - - *whop = strdup(ldap_state->bind_dn); - if (!*whop) { - return LDAP_NO_MEMORY; - } - *credp = strdup(ldap_state->bind_secret); - if (!*credp) { - SAFE_FREE(*whop); - return LDAP_NO_MEMORY; - } - *methodp = LDAP_AUTH_SIMPLE; - } - return 0; -} -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - -/******************************************************************* - a rebind function for authenticated referrals - This version takes a void* that we can shove useful stuff in :-) - and actually does the connection. -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -static int rebindproc_connect_with_state (LDAP *ldap_struct, - LDAP_CONST char *url, - ber_tag_t request, - ber_int_t msgid, void *arg) -{ - struct smb_ldap_privates *ldap_state = arg; - int rc; - DEBUG(5,("rebindproc_connect_with_state: Rebinding as \"%s\"\n", - ldap_state->bind_dn)); - - /** @TODO Should we be doing something to check what servers we rebind to? - Could we get a referral to a machine that we don't want to give our - username and password to? */ - - rc = ldap_simple_bind_s(ldap_struct, ldap_state->bind_dn, ldap_state->bind_secret); - - return rc; -} -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - -/******************************************************************* - Add a rebind function for authenticated referrals -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -#else -# if LDAP_SET_REBIND_PROC_ARGS == 2 -static int rebindproc (LDAP *ldap_struct, char **whop, char **credp, - int *method, int freeit ) -{ - return rebindproc_with_state(ldap_struct, whop, credp, - method, freeit, get_internal(ldap_struct)); - -} -# endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/ -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - -/******************************************************************* - a rebind function for authenticated referrals - this also does the connection, but no void*. -******************************************************************/ -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -# if LDAP_SET_REBIND_PROC_ARGS == 2 -static int rebindproc_connect (LDAP * ld, LDAP_CONST char *url, int request, - ber_int_t msgid) -{ - return rebindproc_connect_with_state(ld, url, (ber_tag_t)request, msgid, - get_internal(ld)); -} -# endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/ -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - -/******************************************************************* - connect to the ldap server under system privilege. -******************************************************************/ -int smb_ldap_connect_system(struct smb_ldap_privates *ldap_state, - LDAP * ldap_struct) -{ - int rc; - char *ldap_dn; - char *ldap_secret; - - if (NULL == get_internal(ldap_struct)) { - ldap_state->next = head; - } - - /* get the password */ - if (!smb_ldap_fetch_pw(&ldap_dn, &ldap_secret)) - { - DEBUG(0, ("ldap_connect_system: Failed to retrieve password from secrets.tdb\n")); - return LDAP_INVALID_CREDENTIALS; - } - - ldap_state->bind_dn = ldap_dn; - ldap_state->bind_secret = ldap_secret; - - /* removed the sasl_bind_s "EXTERNAL" stuff, as my testsuite - (OpenLDAP) doesnt' seem to support it */ - - DEBUG(10,("ldap_connect_system: Binding to ldap server %s as \"%s\"\n", - ldap_state->uri, ldap_dn)); - -#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000) -# if LDAP_SET_REBIND_PROC_ARGS == 2 - ldap_set_rebind_proc(ldap_struct, &rebindproc_connect); -# endif -# if LDAP_SET_REBIND_PROC_ARGS == 3 - ldap_set_rebind_proc(ldap_struct, &rebindproc_connect_with_state, (void *)ldap_state); -# endif -#else /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ -# if LDAP_SET_REBIND_PROC_ARGS == 2 - ldap_set_rebind_proc(ldap_struct, &rebindproc); -# endif -# if LDAP_SET_REBIND_PROC_ARGS == 3 - ldap_set_rebind_proc(ldap_struct, &rebindproc_with_state, (void *)ldap_state); -# endif -#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/ - - rc = ldap_simple_bind_s(ldap_struct, ldap_dn, ldap_secret); - - if (rc != LDAP_SUCCESS) { - char *ld_error; - ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, - &ld_error); - DEBUG(0, - ("failed to bind to server with dn= %s Error: %s\n\t%s\n", - ldap_dn, ldap_err2string(rc), - ld_error)); - free(ld_error); - return rc; - } - - DEBUG(2, ("ldap_connect_system: succesful connection to the LDAP server\n")); - return rc; -} - -/********************************************************************** -Connect to LDAP server -*********************************************************************/ -int smb_ldap_open(struct smb_ldap_privates *ldap_state) -{ - int rc; - SMB_ASSERT(ldap_state); - -#ifndef NO_LDAP_SECURITY - if (geteuid() != 0) { - DEBUG(0, ("smb_ldap_open: cannot access LDAP when not root..\n")); - return LDAP_INSUFFICIENT_ACCESS; - } -#endif - - if ((ldap_state->ldap_struct != NULL) && ((ldap_state->last_ping + SMB_LDAP_DONT_PING_TIME) < time(NULL))) { - struct sockaddr_un addr; - socklen_t len; - int sd; - if (ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_DESC, &sd) == 0 && - getpeername(sd, (struct sockaddr *) &addr, &len) < 0) { - /* the other end has died. reopen. */ - ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); - ldap_state->ldap_struct = NULL; - ldap_state->last_ping = (time_t)0; - } else { - ldap_state->last_ping = time(NULL); - } - } - - if (ldap_state->ldap_struct != NULL) { - DEBUG(5,("smb_ldap_open: allready connected to the LDAP server\n")); - return LDAP_SUCCESS; - } - - if ((rc = smb_ldap_open_connection(ldap_state, &ldap_state->ldap_struct))) { - return rc; - } - - if ((rc = smb_ldap_connect_system(ldap_state, ldap_state->ldap_struct))) { - ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); - ldap_state->ldap_struct = NULL; - return rc; - } - - - ldap_state->last_ping = time(NULL); - DEBUG(4,("The LDAP server is succesful connected\n")); - - return LDAP_SUCCESS; -} - -/********************************************************************** -Disconnect from LDAP server -*********************************************************************/ -NTSTATUS smb_ldap_close(struct smb_ldap_privates *ldap_state) -{ - if (!ldap_state) - return NT_STATUS_INVALID_PARAMETER; - - if (ldap_state->ldap_struct != NULL) { - ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL); - ldap_state->ldap_struct = NULL; - } - - DEBUG(5,("The connection to the LDAP server was closed\n")); - /* maybe free the results here --metze */ - - return NT_STATUS_OK; -} - -static int smb_ldap_retry_open(struct smb_ldap_privates *ldap_state, int *attempts) -{ - int rc; - - SMB_ASSERT(ldap_state && attempts); - - if (*attempts != 0) { - /* we retry after 0.5, 2, 4.5, 8, 12.5, 18, 24.5 seconds */ - msleep((((*attempts)*(*attempts))/2)*1000); - } - (*attempts)++; - - if ((rc = smb_ldap_open(ldap_state))) { - DEBUG(0,("Connection to LDAP Server failed for the %d try!\n",*attempts)); - return rc; - } - - return LDAP_SUCCESS; -} - - -int smb_ldap_search(struct smb_ldap_privates *ldap_state, - const char *base, int scope, const char *filter, - const char *attrs[], int attrsonly, - LDAPMessage **res) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - - SMB_ASSERT(ldap_state); - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = smb_ldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_search_s(ldap_state->ldap_struct, base, scope, - filter, (char **)attrs, attrsonly, res); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - smb_ldap_close(ldap_state); - } - - return rc; -} - -int smb_ldap_modify(struct smb_ldap_privates *ldap_state, char *dn, - LDAPMod *attrs[]) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - - if (!ldap_state) - return (-1); - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = smb_ldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_modify_s(ldap_state->ldap_struct, dn, attrs); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - smb_ldap_close(ldap_state); - } - - return rc; -} - -int smb_ldap_add(struct smb_ldap_privates *ldap_state, const char *dn, - LDAPMod *attrs[]) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - - if (!ldap_state) - return (-1); - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = smb_ldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_add_s(ldap_state->ldap_struct, dn, attrs); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - smb_ldap_close(ldap_state); - } - - return rc; -} - -int smb_ldap_delete(struct smb_ldap_privates *ldap_state, char *dn) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - - if (!ldap_state) - return (-1); - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = smb_ldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_delete_s(ldap_state->ldap_struct, dn); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - smb_ldap_close(ldap_state); - } - - return rc; -} - -int smb_ldap_extended_operation(struct smb_ldap_privates *ldap_state, - LDAP_CONST char *reqoid, - struct berval *reqdata, - LDAPControl **serverctrls, - LDAPControl **clientctrls, char **retoidp, - struct berval **retdatap) -{ - int rc = LDAP_SERVER_DOWN; - int attempts = 0; - - if (!ldap_state) - return (-1); - - while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) { - - if ((rc = smb_ldap_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS) - continue; - - rc = ldap_extended_operation_s(ldap_state->ldap_struct, reqoid, reqdata, serverctrls, clientctrls, retoidp, retdatap); - } - - if (rc == LDAP_SERVER_DOWN) { - DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO)); - smb_ldap_close(ldap_state); - } - - return rc; -} - -/******************************************************************* -search an attribute and return the first value found. -******************************************************************/ -BOOL smb_ldap_get_single_attribute (LDAP * ldap_struct, LDAPMessage * entry, - const char *attribute, pstring value) -{ - char **values; - - if ((values = ldap_get_values (ldap_struct, entry, attribute)) == NULL) { - value = NULL; - DEBUG (10, ("smb_ldap_get_single_attribute: [%s] = []\n", attribute)); - - return False; - } - - pstrcpy(value, values[0]); - ldap_value_free(values); -#ifdef DEBUG_PASSWORDS - DEBUG (100, ("smb_ldap_get_single_attribute: [%s] = [%s]\n", attribute, value)); -#endif - return True; -} - - -/************************************************************************ -Routine to manage the LDAPMod structure array -manage memory used by the array, by each struct, and values - -************************************************************************/ -void smb_ldap_make_a_mod (LDAPMod *** modlist, int modop, - const char *attribute, const char *value) -{ - LDAPMod **mods; - int i; - int j; - - mods = *modlist; - - if (attribute == NULL || *attribute == '\0') - return; - - if (value == NULL || *value == '\0') - return; - - if (mods == NULL) - { - mods = (LDAPMod **) malloc(sizeof(LDAPMod *)); - if (mods == NULL) - { - DEBUG(0, ("smb_ldap_make_a_mod: out of memory!\n")); - return; - } - mods[0] = NULL; - } - - for (i = 0; mods[i] != NULL; ++i) { - if (mods[i]->mod_op == modop && !strcasecmp(mods[i]->mod_type, attribute)) - break; - } - - if (mods[i] == NULL) - { - mods = (LDAPMod **) Realloc (mods, (i + 2) * sizeof (LDAPMod *)); - if (mods == NULL) - { - DEBUG(0, ("smb_ldap_make_a_mod: out of memory!\n")); - return; - } - mods[i] = (LDAPMod *) malloc(sizeof(LDAPMod)); - if (mods[i] == NULL) - { - DEBUG(0, ("smb_ldap_make_a_mod: out of memory!\n")); - return; - } - mods[i]->mod_op = modop; - mods[i]->mod_values = NULL; - mods[i]->mod_type = strdup(attribute); - mods[i + 1] = NULL; - } - - if (value != NULL) - { - j = 0; - if (mods[i]->mod_values != NULL) { - for (; mods[i]->mod_values[j] != NULL; j++); - } - mods[i]->mod_values = (char **)Realloc(mods[i]->mod_values, - (j + 2) * sizeof (char *)); - - if (mods[i]->mod_values == NULL) { - DEBUG (0, ("smb_ldap_make_a_mod: Memory allocation failure!\n")); - return; - } - mods[i]->mod_values[j] = strdup(value); - mods[i]->mod_values[j + 1] = NULL; - } - *modlist = mods; -} - -#endif diff --git a/source3/python/mkpatch b/source3/python/mkpatch deleted file mode 100755 index ab5be1b6a2..0000000000 --- a/source3/python/mkpatch +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/sh -# -# Make samba-head.patch. Must be run from samba source directory. -# - -cvs -z3 diff -u Makefile.in configure.in > python/samba-head.patch -- cgit From 623a46b7e4a56f0f9552a6b394409136d0c050cd Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Wed, 10 Sep 2003 03:59:35 +0000 Subject: Remove tags file for distclean. (This used to be commit 2ac5ac495025f6c673216c1922ff51b913a0aeac) --- source3/Makefile.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/Makefile.in b/source3/Makefile.in index f7ec500d06..a2c4a360d4 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -1377,7 +1377,7 @@ distclean: realclean -rm -f include/stamp-h -rm -f include/config.h Makefile -rm -f config.status config.cache so_locations - -rm -rf .deps + -rm -rf .deps TAGS realdistclean: distclean -rm -f include/config.h.in -- cgit From 37737023a8dccbaa546d1b88999c4d4f8257e436 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 10 Sep 2003 14:03:08 +0000 Subject: Support for CAN-2003-0689 port from SAMBA_3_0 (This used to be commit 69b30ec0776b06c62810a3eb1d7be1df3db9e169) --- source3/configure.in | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/source3/configure.in b/source3/configure.in index a2e04b5d48..151411feb8 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -883,8 +883,23 @@ AC_CHECK_FUNCS(open64 _open64 __open64 creat64) # case "$host_os" in *linux*) - # glibc <= 2.3.2 has a broken getgrouplist - AC_TRY_RUN([ + # test if user trusts its own glibc version w.r.t. CAN-2003-0689 + # Some vendors already provided glibc builds with this fix so getgrouplist() is usable + # on those platforms. Unfortunately, we can't get this information from compiling yet. + AC_MSG_CHECKING([whether GNU libc has good getgrouplist w.r.t. CAN-2003-0689]) + AC_ARG_WITH(good-getgrouplist, + [ --with-good-getgrouplist[=no] whether GNU libc has good getgrouplist w.r.t. CAN-2003-0689 ], + [ case "$with_good_getgrouplist" in + yes) + AC_MSG_RESULT(yes) + AC_DEFINE(HAVE_GETGROUPLIST, 1, [Have good getgrouplist]) + ;; + *) + AC_MSG_RESULT(no) + ;; + esac], +# glibc <= 2.3.2 has a broken getgrouplist +AC_TRY_RUN([ #include #include main() { @@ -902,8 +917,12 @@ main() { } ], [linux_getgrouplist_ok=yes], [linux_getgrouplist_ok=no]) if test x"$linux_getgrouplist_ok" = x"yes"; then + AC_MSG_RESULT(yes) AC_DEFINE(HAVE_GETGROUPLIST, 1, [Have good getgrouplist]) + else + AC_MSG_RESULT(no) fi +) ;; *) AC_CHECK_FUNCS(getgrouplist) -- cgit From 1c138c61818c5641ce5bd556d44245db5d4b45ca Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 10 Sep 2003 15:41:07 +0000 Subject: Back out --with-good-getgrouplist patch (This used to be commit d2fdc3955fb6859e865e805d32ca405ab44d0505) --- source3/configure.in | 23 ++--------------------- 1 file changed, 2 insertions(+), 21 deletions(-) diff --git a/source3/configure.in b/source3/configure.in index 151411feb8..a2e04b5d48 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -883,23 +883,8 @@ AC_CHECK_FUNCS(open64 _open64 __open64 creat64) # case "$host_os" in *linux*) - # test if user trusts its own glibc version w.r.t. CAN-2003-0689 - # Some vendors already provided glibc builds with this fix so getgrouplist() is usable - # on those platforms. Unfortunately, we can't get this information from compiling yet. - AC_MSG_CHECKING([whether GNU libc has good getgrouplist w.r.t. CAN-2003-0689]) - AC_ARG_WITH(good-getgrouplist, - [ --with-good-getgrouplist[=no] whether GNU libc has good getgrouplist w.r.t. CAN-2003-0689 ], - [ case "$with_good_getgrouplist" in - yes) - AC_MSG_RESULT(yes) - AC_DEFINE(HAVE_GETGROUPLIST, 1, [Have good getgrouplist]) - ;; - *) - AC_MSG_RESULT(no) - ;; - esac], -# glibc <= 2.3.2 has a broken getgrouplist -AC_TRY_RUN([ + # glibc <= 2.3.2 has a broken getgrouplist + AC_TRY_RUN([ #include #include main() { @@ -917,12 +902,8 @@ main() { } ], [linux_getgrouplist_ok=yes], [linux_getgrouplist_ok=no]) if test x"$linux_getgrouplist_ok" = x"yes"; then - AC_MSG_RESULT(yes) AC_DEFINE(HAVE_GETGROUPLIST, 1, [Have good getgrouplist]) - else - AC_MSG_RESULT(no) fi -) ;; *) AC_CHECK_FUNCS(getgrouplist) -- cgit From ff166384c84acb24fad4abe54e2ec43a7f4fdfc3 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Wed, 10 Sep 2003 19:47:13 +0000 Subject: Remove obsolete files. (This used to be commit 3d71340e5c1bf3397e69897bbc8434bbaa503a75) --- source3/include/sam.h | 238 ------ source3/sam/SAM-interface_handles.txt | 123 --- source3/sam/get_set_account.c | 845 -------------------- source3/sam/get_set_domain.c | 263 ------- source3/sam/get_set_group.c | 106 --- source3/sam/sam_ads.c | 1378 --------------------------------- source3/sam/sam_plugin.c | 79 -- source3/sam/sam_skel.c | 251 ------ source3/torture/cmd_sam.c | 514 ------------ source3/torture/samtest.c | 445 ----------- 10 files changed, 4242 deletions(-) delete mode 100644 source3/include/sam.h delete mode 100644 source3/sam/SAM-interface_handles.txt delete mode 100644 source3/sam/get_set_account.c delete mode 100644 source3/sam/get_set_domain.c delete mode 100644 source3/sam/get_set_group.c delete mode 100755 source3/sam/sam_ads.c delete mode 100644 source3/sam/sam_plugin.c delete mode 100644 source3/sam/sam_skel.c delete mode 100644 source3/torture/cmd_sam.c delete mode 100644 source3/torture/samtest.c diff --git a/source3/include/sam.h b/source3/include/sam.h deleted file mode 100644 index f46a6e7bcb..0000000000 --- a/source3/include/sam.h +++ /dev/null @@ -1,238 +0,0 @@ -/* - Unix SMB/CIFS implementation. - SAM structures - Copyright (C) Kai Krueger 2002 - Copyright (C) Stefan (metze) Metzmacher 2002 - Copyright (C) Simo Sorce 2002 - Copyright (C) Andrew Bartlett 2002 - Copyright (C) Jelmer Vernooij 2002 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#ifndef _SAM_H -#define _SAM_H - -/* We want to track down bugs early */ -#if 1 -#define SAM_ASSERT(x) SMB_ASSERT(x) -#else -#define SAM_ASSERT(x) while (0) { \ - if (!(x)) { - DEBUG(0, ("SAM_ASSERT failed!\n")) - return NT_STATUS_FAIL_CHECK;\ - } \ - } -#endif - - -/* let it be 0 until we have a stable interface --metze */ -#define SAM_INTERFACE_VERSION 0 - -/* use this inside a passdb module */ -#define SAM_MODULE_VERSIONING_MAGIC \ -int sam_version(void)\ -{\ - return SAM_INTERFACE_VERSION;\ -} - -/* Backend to use by default when no backend was specified */ -#define SAM_DEFAULT_BACKEND "plugin" - -typedef struct sam_domain_handle { - TALLOC_CTX *mem_ctx; - uint32 access_granted; - const struct sam_methods *current_sam_methods; /* sam_methods creating this handle */ - void (*free_fn)(struct sam_domain_handle **); - struct domain_data { - DOM_SID sid; /*SID of the domain. Should not be changed */ - char *name; /* Name of the domain */ - char *servername; /* */ - NTTIME max_passwordage; /* time till next password expiration */ - NTTIME min_passwordage; /* time till password can be changed again */ - NTTIME lockout_duration; /* time till login is allowed again after lockout*/ - NTTIME reset_count; /* time till bad login counter is reset */ - uint16 min_passwordlength; /* minimum number of characters for a password */ - uint16 password_history; /* number of passwords stored in history */ - uint16 lockout_count; /* number of bad login attempts before lockout */ - BOOL force_logoff; /* force logoff after logon hours have expired */ - BOOL login_pwdchange; /* Users need to logon to change their password */ - uint32 num_accounts; /* number of accounts in the domain */ - uint32 num_groups; /* number of global groups */ - uint32 num_aliases; /* number of local groups */ - uint32 sam_sequence_number; /* global sequence number */ - } private; -} SAM_DOMAIN_HANDLE; - -typedef struct sam_account_handle { - TALLOC_CTX *mem_ctx; - uint32 access_granted; - const struct sam_methods *current_sam_methods; /* sam_methods creating this handle */ - void (*free_fn)(struct sam_account_handle **); - struct sam_account_data { - uint32 init_flag; - NTTIME logon_time; /* logon time */ - NTTIME logoff_time; /* logoff time */ - NTTIME kickoff_time; /* kickoff time */ - NTTIME pass_last_set_time; /* password last set time */ - NTTIME pass_can_change_time; /* password can change time */ - NTTIME pass_must_change_time; /* password must change time */ - char * account_name; /* account_name string */ - SAM_DOMAIN_HANDLE * domain; /* domain of account */ - char *full_name; /* account's full name string */ - char *unix_home_dir; /* UNIX home directory string */ - char *home_dir; /* home directory string */ - char *dir_drive; /* home directory drive string */ - char *logon_script; /* logon script string */ - char *profile_path; /* profile path string */ - char *acct_desc; /* account description string */ - char *workstations; /* login from workstations string */ - char *unknown_str; /* don't know what this is, yet. */ - char *munged_dial; /* munged path name and dial-back tel number */ - DOM_SID account_sid; /* Primary Account SID */ - DOM_SID group_sid; /* Primary Group SID */ - DATA_BLOB lm_pw; /* .data is Null if no password */ - DATA_BLOB nt_pw; /* .data is Null if no password */ - char *plaintext_pw; /* if Null not available */ - uint16 acct_ctrl; /* account info (ACB_xxxx bit-mask) */ - uint32 unknown_1; /* 0x00ff ffff */ - uint16 logon_divs; /* 168 - number of hours in a week */ - uint32 hours_len; /* normally 21 bytes */ - uint8 hours[MAX_HOURS_LEN]; - uint32 unknown_2; /* 0x0002 0000 */ - uint32 unknown_3; /* 0x0000 04ec */ - } private; -} SAM_ACCOUNT_HANDLE; - -typedef struct sam_group_handle { - TALLOC_CTX *mem_ctx; - uint32 access_granted; - const struct sam_methods *current_sam_methods; /* sam_methods creating this handle */ - void (*free_fn)(struct sam_group_handle **); - struct sam_group_data { - char *group_name; - char *group_desc; - DOM_SID sid; - uint16 group_ctrl; /* specifies if the group is a local group or a global group */ - uint32 num_members; - } private; -} SAM_GROUP_HANDLE; - - -typedef struct sam_group_member { - DOM_SID sid; - BOOL group; /* specifies if it is a group or a account */ -} SAM_GROUP_MEMBER; - -typedef struct sam_account_enum { - DOM_SID sid; - char *account_name; - char *full_name; - char *account_desc; - uint16 acct_ctrl; -} SAM_ACCOUNT_ENUM; - -typedef struct sam_group_enum { - DOM_SID sid; - char *group_name; - char *group_desc; - uint16 group_ctrl; -} SAM_GROUP_ENUM; - - -/* bits for group_ctrl: to spezify if the group is global group or alias */ -#define GCB_LOCAL_GROUP 0x0001 -#define GCB_ALIAS_GROUP (GCB_LOCAL_GROUP |GCB_BUILTIN) -#define GCB_GLOBAL_GROUP 0x0002 -#define GCB_BUILTIN 0x1000 - -typedef struct sam_context -{ - struct sam_methods *methods; - TALLOC_CTX *mem_ctx; - - void (*free_fn)(struct sam_context **); -} SAM_CONTEXT; - -typedef struct sam_methods -{ - struct sam_context *parent; - struct sam_methods *next; - struct sam_methods *prev; - const char *backendname; - const char *domain_name; - DOM_SID domain_sid; - void *private_data; - - /* General API */ - - NTSTATUS (*sam_get_sec_desc) (const struct sam_methods *, const NT_USER_TOKEN *access_token, const DOM_SID *sid, SEC_DESC **sd); - NTSTATUS (*sam_set_sec_desc) (const struct sam_methods *, const NT_USER_TOKEN *access_token, const DOM_SID *sid, const SEC_DESC *sd); - - NTSTATUS (*sam_lookup_sid) (const struct sam_methods *, const NT_USER_TOKEN *access_token, TALLOC_CTX *mem_ctx, const DOM_SID *sid, char **name, uint32 *type); - NTSTATUS (*sam_lookup_name) (const struct sam_methods *, const NT_USER_TOKEN *access_token, const char *name, DOM_SID *sid, uint32 *type); - - /* Domain API */ - - NTSTATUS (*sam_update_domain) (const struct sam_methods *, const SAM_DOMAIN_HANDLE *domain); - NTSTATUS (*sam_get_domain_handle) (const struct sam_methods *, const NT_USER_TOKEN *access_token, uint32 access_desired, SAM_DOMAIN_HANDLE **domain); - - /* Account API */ - - NTSTATUS (*sam_create_account) (const struct sam_methods *, const NT_USER_TOKEN *access_token, uint32 access_desired, const char *account_name, uint16 acct_ctrl, SAM_ACCOUNT_HANDLE **account); - NTSTATUS (*sam_add_account) (const struct sam_methods *, const SAM_ACCOUNT_HANDLE *account); - NTSTATUS (*sam_update_account) (const struct sam_methods *, const SAM_ACCOUNT_HANDLE *account); - NTSTATUS (*sam_delete_account) (const struct sam_methods *, const SAM_ACCOUNT_HANDLE *account); - NTSTATUS (*sam_enum_accounts) (const struct sam_methods *, const NT_USER_TOKEN *access_token, uint16 acct_ctrl, uint32 *account_count, SAM_ACCOUNT_ENUM **accounts); - - NTSTATUS (*sam_get_account_by_sid) (const struct sam_methods *, const NT_USER_TOKEN *access_token, uint32 access_desired, const DOM_SID *accountsid, SAM_ACCOUNT_HANDLE **account); - NTSTATUS (*sam_get_account_by_name) (const struct sam_methods *, const NT_USER_TOKEN *access_token, uint32 access_desired, const char *name, SAM_ACCOUNT_HANDLE **account); - - /* Group API */ - - NTSTATUS (*sam_create_group) (const struct sam_methods *, const NT_USER_TOKEN *access_token, uint32 access_desired, const char *group_name, uint16 group_ctrl, SAM_GROUP_HANDLE **group); - NTSTATUS (*sam_add_group) (const struct sam_methods *, const SAM_GROUP_HANDLE *group); - NTSTATUS (*sam_update_group) (const struct sam_methods *, const SAM_GROUP_HANDLE *group); - NTSTATUS (*sam_delete_group) (const struct sam_methods *, const SAM_GROUP_HANDLE *group); - NTSTATUS (*sam_enum_groups) (const struct sam_methods *, const NT_USER_TOKEN *access_token, uint16 group_ctrl, uint32 *groups_count, SAM_GROUP_ENUM **groups); - NTSTATUS (*sam_get_group_by_sid) (const struct sam_methods *, const NT_USER_TOKEN *access_token, uint32 access_desired, const DOM_SID *groupsid, SAM_GROUP_HANDLE **group); - NTSTATUS (*sam_get_group_by_name) (const struct sam_methods *, const NT_USER_TOKEN *access_token, uint32 access_desired, const char *name, SAM_GROUP_HANDLE **group); - - NTSTATUS (*sam_add_member_to_group) (const struct sam_methods *, const SAM_GROUP_HANDLE *group, const SAM_GROUP_MEMBER *member); - NTSTATUS (*sam_delete_member_from_group) (const struct sam_methods *, const SAM_GROUP_HANDLE *group, const SAM_GROUP_MEMBER *member); - NTSTATUS (*sam_enum_groupmembers) (const struct sam_methods *, const SAM_GROUP_HANDLE *group, uint32 *members_count, SAM_GROUP_MEMBER **members); - - NTSTATUS (*sam_get_groups_of_sid) (const struct sam_methods *, const NT_USER_TOKEN *access_token, const DOM_SID **sids, uint16 group_ctrl, uint32 *group_count, SAM_GROUP_ENUM **groups); - - void (*free_private_data)(void **); -} SAM_METHODS; - -typedef NTSTATUS (*sam_init_function)(SAM_METHODS *, const char *); - -struct sam_init_function_entry { - char *module_name; - /* Function to create a member of the sam_methods list */ - sam_init_function init; -}; - -typedef struct sam_backend_entry { - char *module_name; - char *module_params; - char *domain_name; - DOM_SID *domain_sid; -} SAM_BACKEND_ENTRY; - - -#endif /* _SAM_H */ diff --git a/source3/sam/SAM-interface_handles.txt b/source3/sam/SAM-interface_handles.txt deleted file mode 100644 index 1c164bd198..0000000000 --- a/source3/sam/SAM-interface_handles.txt +++ /dev/null @@ -1,123 +0,0 @@ -SAM API - -NTSTATUS sam_get_sec_obj(NT_USER_TOKEN *access, DOM_SID *sid, SEC_DESC **sd) -NTSTATUS sam_set_sec_obj(NT_USER_TOKEN *access, DOM_SID *sid, SEC_DESC *sd) - -NTSTATUS sam_lookup_name(NT_USER_TOKEN *access, DOM_SID *domain, char *name, DOM_SID **sid, uint32 *type) -NTSTATUS sam_lookup_sid(NT_USER_TOKEN *access, DOM_SID *sid, char **name, uint32 *type) - - -Domain API - -NTSTATUS sam_update_domain(SAM_DOMAIN_HANDLE *domain) - -NTSTATUS sam_enum_domains(NT_USER_TOKEN *access, int32 *domain_count, DOM_SID **domains, char **domain_names) -NTSTATUS sam_lookup_domain(NT_USER_TOKEN *access, char *domain, DOM_SID **domainsid) - -NTSTATUS sam_get_domain_by_sid(NT_USER_TOKEN *access, uint32 access_desired, DOM_SID *domainsid, SAM_DOMAIN_HANDLE **domain) - - -User API - -NTSTATUS sam_create_user(NT_USER_TOKEN *access, uint32 access_desired, SAM_USER_HANDLE **user) -NTSTATUS sam_add_user(SAM_USER_HANDLE *user) -NTSTATUS sam_update_user(SAM_USER_HANDLE *user) -NTSTATUS sam_delete_user(SAM_USER_HANDLE * user) - -NTSTATUS sam_enum_users(NT_USER_TOKEN *access, DOM_SID *domain, int32 *user_count, SAM_USER_ENUM **users) - -NTSTATUS sam_get_user_by_sid(NT_USER_TOKEN *access, uint32 access_desired, DOM_SID *usersid, SAM_USER_HANDLE **user) -NTSTATUS sam_get_user_by_name(NT_USER_TOKEN *access, uint32 access_desired, char *domain, char *name, SAM_USER_HANDLE **user) - - -Group API - -NTSTATUS sam_create_group(NT_USER_TOKEN *access, uint32 access_desired, uint32 typ, SAM_GROUP_HANDLE **group) -NTSTATUS sam_add_group(SAM_GROUP_HANDLE *samgroup) -NTSTATUS sam_update_group(SAM_GROUP_HANDLE *samgroup) -NTSTATUS sam_delete_group(SAM_GROUP_HANDLE *groupsid) - -NTSTATUS sam_enum_groups(NT_USER_TOKEN *access, DOM_SID *domainsid, uint32 typ, uint32 *groups_count, SAM_GROUP_ENUM **groups) - -NTSTATUS sam_get_group_by_sid(NT_USER_TOKEN *access, uint32 access_desired, DOM_SID *groupsid, SAM_GROUP_HANDLE **group) -NTSTATUS sam_get_group_by_name(NT_USER_TOKEN *access, uint32 access_desired, char *domain, char *name, SAM_GROUP_HANDLE **group) - -NTSTATUS sam_add_member_to_group(SAM_GROUP_HANDLE *group, SAM_GROUP_MEMBER *member) -NTSTATUS sam_delete_member_from_group(SAM_GROUP_HANDLE *group, SAM_GROUP_MEMBER *member) -NTSTATUS sam_enum_groupmembers(SAM_GROUP_HANLDE *group, uint32 *members_count, SAM_GROUP_MEMBER **members) - -NTSTATUS sam_get_groups_of_user(SAM_USER_HANDLE *user, uint32 typ, uint32 *group_count, SAM_GROUP_ENUM **groups) - - - -structures - -typedef _SAM_GROUP_MEMBER { - DOM_SID sid; - BOOL group; /* specifies if it is a group or a user */ - -} SAM_GROUP_MEMBER - -typedef struct sam_user_enum { - DOM_SID sid; - char *username; - char *full_name; - char *user_desc; - uint16 acc_ctrl; -} SAM_USER_ENUM; - -typedef struct sam_group_enum { - DOM_SID sid; - char *groupname; - char *comment; -} SAM_GROUP_ENUM - -NTSTATUS sam_get_domain_sid(SAM_DOMAIN_HANDLE *domain, DOM_SID **sid) -NTSTATUS sam_get_domain_num_users(SAM_DOMAIN_HANDLE *domain, uint32 *num_users) -NTSTATUS sam_get_domain_num_groups(SAM_DOMAIN_HANDLE *domain, uint32 *num_groups) -NTSTATUS sam_get_domain_num_aliases(SAM_DOMAIN_HANDLE *domain, uint32 *num_aliases) -NTSTATUS sam_{get,set}_domain_name(SAM_DOMAIN_HANDLE *domain, char **domain_name) -NTSTATUS sam_{get,set}_domain_server(SAM_DOMAIN_HANDLE *domain, char **server_name) -NTSTATUS sam_{get,set}_domain_max_pwdage(SAM_DOMAIN_HANDLE *domain, NTTIME *max_passwordage) -NTSTATUS sam_{get,set}_domain_min_pwdage(SAM_DOMAIN_HANDLE *domain, NTTIME *min_passwordage) -NTSTATUS sam_{get,set}_domain_lockout_duration(SAM_DOMAIN_HANDLE *domain, NTTIME *lockout_duration) -NTSTATUS sam_{get,set}_domain_reset_count(SAM_DOMAIN_HANDLE *domain, NTTIME *reset_lockout_count) -NTSTATUS sam_{get,set}_domain_min_pwdlength(SAM_DOMAIN_HANDLE *domain, uint16 *min_passwordlength) -NTSTATUS sam_{get,set}_domain_pwd_history(SAM_DOMAIN_HANDLE *domain, uin16 *password_history) -NTSTATUS sam_{get,set}_domain_lockout_count(SAM_DOMAIN_HANDLE *domain, uint16 *lockout_count) -NTSTATUS sam_{get,set}_domain_force_logoff(SAM_DOMAIN_HANDLE *domain, BOOL *force_logoff) -NTSTATUS sam_{get,set}_domain_login_pwdchange(SAM_DOMAIN_HANDLE *domain, BOOL *login_pwdchange) - -NTSTATUS sam_get_user_sid(SAM_USER_HANDLE *user, DOM_SID **sid) -NTSTATUS sam_{get,set}_user_pgroup(SAM_USER_HANDLE *user, DOM_SID **pgroup) -NTSTATUS sam_{get,set}_user_name(SAM_USER_HANDLE *user, char **username) -NTSTATUS sam_{get,set}_user_fullname(SAM_USER_HANDLE *user, char** fullname) -NTSTATUS sam_{get,set}_user_description(SAM_USER_HANDLE *user, char **description) -NTSTATUS sam_{get,set}_user_home_dir(SAM_USER_HANDLE *user, char **home_dir) -NTSTATUS sam_{get,set}_user_dir_drive(SAM_USER_HANDLE *user, char **dir_drive) -NTSTATUS sam_{get,set}_user_logon_script(SAM_USER_HANDLE *user, char **logon_script) -NTSTATUS sam_{get,set}_user_profile_path(SAM_USER_HANDLE *user, char **profile_path) -NTSTATUS sam_{get,set}_user_workstations(SAM_USER_HANDLE *user, char **workstations) -NTSTATUS sam_{get,set}_user_munged_dial(SAM_USER_HANDLE *user, char **munged_dial) -NTSTATUS sam_{get,set}_user_lm_pwd(SAM_USER_HANDLE *user, DATA_BLOB *lm_pwd) -NTSTATUS sam_{get,set}_user_nt_pwd(SAM_USER_HANDLE *user, DATA_BLOB *nt_pwd) -NTSTATUS sam_{get,set}_user_plain_pwd(SAM_USER_HANDLE *user, DATA_BLOB *plaintext_pwd) -NTSTATUS sam_{get,set}_user_acct_ctrl(SAM_USER_HANDLE *user, uint16 *acct_ctrl) -NTSTATUS sam_{get,set}_user_logon_divs(SAM_USER_HANDLE *user, uint16 *logon_divs) -NTSTATUS sam_{get,set}_user_hours(SAM_USER_HANDLE *user, uint32 *hours_len, uint8 **hours) -NTSTATUS sam_{get,set}_user_logon_time(SAM_USER_HANDLE *user, NTTIME *logon_time) -NTSTATUS sam_{get,set}_user_logoff_time(SAM_USER_HANDLE *user, NTTIME *logoff_time) -NTSTATUS sam_{get,set}_user_kickoff_time(SAM_USER_HANDLE *user, NTTIME kickoff_time) -NTSTATUS sam_{get,set}_user_pwd_last_set(SAM_USER_HANDLE *user, NTTIME pwd_last_set) -NTSTATUS sam_{get,set}_user_pwd_can_change(SAM_USER_HANDLE *user, NTTIME pwd_can_change) -NTSTATUS sam_{get,set}_user_pwd_must_change(SAM_USER_HANDLE *user, NTTIME pwd_must_change) -NTSTATUS sam_{get,set}_user_unknown_1(SAM_USER_HANDLE *user, char **unknown_1) -NTSTATUS sam_{get,set}_user_unknown_2(SAM_USER_HANDLE *user, uint32 *unknown_2) -NTSTATUS sam_{get,set}_user_unknown_3(SAM_USER_HANDLE *user, uint32 *unknown_3) -NTSTATUS sam_{get,set}_user_unknown_4(SAM_USER_HANDLE *user, uint32 *unknown_4) - -NTSTATUS sam_get_group_sid(SAM_GROUP_HANDLE *group, DOM_SID **sid) -NTSTATUS sam_get_group_typ(SAM_GROUP_HANDLE *group, uint32 *typ) -NTSTATUS sam_{get,set}_group_name(SAM_GROUP_HANDLE *group, char **group_name) -NTSTATUS sam_{get,set}_group_comment(SAM_GROUP_HANDLE *group, char **comment) -NTSTATUS sam_{get,set}_group_priv_set(SAM_GROUP_HANDLE *group, PRIVILEGE_SET *priv_set) \ No newline at end of file diff --git a/source3/sam/get_set_account.c b/source3/sam/get_set_account.c deleted file mode 100644 index acac281d21..0000000000 --- a/source3/sam/get_set_account.c +++ /dev/null @@ -1,845 +0,0 @@ -/* - Unix SMB/CIFS implementation. - SAM_ACCOUNT_HANDLE access routines - Copyright (C) Andrew Bartlett 2002 - Copyright (C) Stefan (metze) Metzmacher 2002 - Copyright (C) Jelmer Vernooij 2002 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" - -#undef DBGC_CLASS -#define DBGC_CLASS DBGC_SAM - -NTSTATUS sam_get_account_domain_sid(const SAM_ACCOUNT_HANDLE *sampass, const DOM_SID **sid) -{ - NTSTATUS status; - SAM_DOMAIN_HANDLE *domain; - SAM_ASSERT(!sampass || !sid); - - if (!NT_STATUS_IS_OK(status = sam_get_account_domain(sampass, &domain))){ - DEBUG(0, ("sam_get_account_domain_sid: Can't get domain for account\n")); - return status; - } - - return sam_get_domain_sid(domain, sid); -} - -NTSTATUS sam_get_account_domain_name(const SAM_ACCOUNT_HANDLE *sampass, const char **domain_name) -{ - NTSTATUS status; - SAM_DOMAIN_HANDLE *domain; - SAM_ASSERT(sampass && domain_name); - - if (!NT_STATUS_IS_OK(status = sam_get_account_domain(sampass, &domain))){ - DEBUG(0, ("sam_get_account_domain_name: Can't get domain for account\n")); - return status; - } - - return sam_get_domain_name(domain, domain_name); -} - -NTSTATUS sam_get_account_acct_ctrl(const SAM_ACCOUNT_HANDLE *sampass, uint16 *acct_ctrl) -{ - SAM_ASSERT(sampass && acct_ctrl); - - *acct_ctrl = sampass->private.acct_ctrl; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_logon_time(const SAM_ACCOUNT_HANDLE *sampass, NTTIME *logon_time) -{ - SAM_ASSERT(sampass && logon_time) ; - - *logon_time = sampass->private.logon_time; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_logoff_time(const SAM_ACCOUNT_HANDLE *sampass, NTTIME *logoff_time) -{ - SAM_ASSERT(sampass && logoff_time) ; - - *logoff_time = sampass->private.logoff_time; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_kickoff_time(const SAM_ACCOUNT_HANDLE *sampass, NTTIME *kickoff_time) -{ - SAM_ASSERT(sampass && kickoff_time); - - *kickoff_time = sampass->private.kickoff_time; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_pass_last_set_time(const SAM_ACCOUNT_HANDLE *sampass, NTTIME *pass_last_set_time) -{ - SAM_ASSERT(sampass && pass_last_set_time); - - *pass_last_set_time = sampass->private.pass_last_set_time; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_pass_can_change_time(const SAM_ACCOUNT_HANDLE *sampass, NTTIME *pass_can_change_time) -{ - SAM_ASSERT(sampass && pass_can_change_time); - - *pass_can_change_time = sampass->private.pass_can_change_time; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_pass_must_change_time(const SAM_ACCOUNT_HANDLE *sampass, NTTIME *pass_must_change_time) -{ - SAM_ASSERT(sampass && pass_must_change_time); - - *pass_must_change_time = sampass->private.pass_must_change_time; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_logon_divs(const SAM_ACCOUNT_HANDLE *sampass, uint16 *logon_divs) -{ - SAM_ASSERT(sampass && logon_divs); - - *logon_divs = sampass->private.logon_divs; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_hours_len(const SAM_ACCOUNT_HANDLE *sampass, uint32 *hours_len) -{ - SAM_ASSERT(sampass && hours_len); - - *hours_len = sampass->private.hours_len; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_hours(const SAM_ACCOUNT_HANDLE *sampass, const uint8 **hours) -{ - SAM_ASSERT(sampass && hours); - - *hours = sampass->private.hours; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_nt_pwd(const SAM_ACCOUNT_HANDLE *sampass, DATA_BLOB *nt_pwd) -{ - SAM_ASSERT(sampass); - - SMB_ASSERT((!sampass->private.nt_pw.data) - || sampass->private.nt_pw.length == NT_HASH_LEN); - - *nt_pwd = sampass->private.nt_pw; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_lm_pwd(const SAM_ACCOUNT_HANDLE *sampass, DATA_BLOB *lm_pwd) -{ - SAM_ASSERT(sampass); - - SMB_ASSERT((!sampass->private.lm_pw.data) - || sampass->private.lm_pw.length == LM_HASH_LEN); - - *lm_pwd = sampass->private.lm_pw; - - return NT_STATUS_OK; -} - -/* Return the plaintext password if known. Most of the time - it isn't, so don't assume anything magic about this function. - - Used to pass the plaintext to sam backends that might - want to store more than just the NTLM hashes. -*/ - -NTSTATUS sam_get_account_plaintext_pwd(const SAM_ACCOUNT_HANDLE *sampass, char **plain_pwd) -{ - SAM_ASSERT(sampass && plain_pwd); - - *plain_pwd = sampass->private.plaintext_pw; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_sid(const SAM_ACCOUNT_HANDLE *sampass, const DOM_SID **sid) -{ - SAM_ASSERT(sampass); - - *sid = &(sampass->private.account_sid); - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_pgroup(const SAM_ACCOUNT_HANDLE *sampass, const DOM_SID **sid) -{ - SAM_ASSERT(sampass); - - *sid = &(sampass->private.group_sid); - - return NT_STATUS_OK; -} - -/** - * Get flags showing what is initalised in the SAM_ACCOUNT_HANDLE - * @param sampass the SAM_ACCOUNT_HANDLE in question - * @return the flags indicating the members initialised in the struct. - **/ - -NTSTATUS sam_get_account_init_flag(const SAM_ACCOUNT_HANDLE *sampass, uint32 *initflag) -{ - SAM_ASSERT(sampass); - - *initflag = sampass->private.init_flag; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_name(const SAM_ACCOUNT_HANDLE *sampass, char **account_name) -{ - SAM_ASSERT(sampass); - - *account_name = sampass->private.account_name; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_domain(const SAM_ACCOUNT_HANDLE *sampass, SAM_DOMAIN_HANDLE **domain) -{ - SAM_ASSERT(sampass); - - *domain = sampass->private.domain; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_fullname(const SAM_ACCOUNT_HANDLE *sampass, char **fullname) -{ - SAM_ASSERT(sampass); - - *fullname = sampass->private.full_name; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_homedir(const SAM_ACCOUNT_HANDLE *sampass, char **homedir) -{ - SAM_ASSERT(sampass); - - *homedir = sampass->private.home_dir; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_unix_home_dir(const SAM_ACCOUNT_HANDLE *sampass, char **uhomedir) -{ - SAM_ASSERT(sampass); - - *uhomedir = sampass->private.unix_home_dir; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_dir_drive(const SAM_ACCOUNT_HANDLE *sampass, char **dirdrive) -{ - SAM_ASSERT(sampass); - - *dirdrive = sampass->private.dir_drive; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_logon_script(const SAM_ACCOUNT_HANDLE *sampass, char **logon_script) -{ - SAM_ASSERT(sampass); - - *logon_script = sampass->private.logon_script; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_profile_path(const SAM_ACCOUNT_HANDLE *sampass, char **profile_path) -{ - SAM_ASSERT(sampass); - - *profile_path = sampass->private.profile_path; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_description(const SAM_ACCOUNT_HANDLE *sampass, char **description) -{ - SAM_ASSERT(sampass); - - *description = sampass->private.acct_desc; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_workstations(const SAM_ACCOUNT_HANDLE *sampass, char **workstations) -{ - SAM_ASSERT(sampass); - - *workstations = sampass->private.workstations; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_unknown_str(const SAM_ACCOUNT_HANDLE *sampass, char **unknown_str) -{ - SAM_ASSERT(sampass); - - *unknown_str = sampass->private.unknown_str; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_munged_dial(const SAM_ACCOUNT_HANDLE *sampass, char **munged_dial) -{ - SAM_ASSERT(sampass); - - *munged_dial = sampass->private.munged_dial; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_unknown_1(const SAM_ACCOUNT_HANDLE *sampass, uint32 *unknown1) -{ - SAM_ASSERT(sampass && unknown1); - - *unknown1 = sampass->private.unknown_1; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_unknown_2(const SAM_ACCOUNT_HANDLE *sampass, uint32 *unknown2) -{ - SAM_ASSERT(sampass && unknown2); - - *unknown2 = sampass->private.unknown_2; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_account_unknown_3(const SAM_ACCOUNT_HANDLE *sampass, uint32 *unknown3) -{ - SAM_ASSERT(sampass && unknown3); - - *unknown3 = sampass->private.unknown_3; - - return NT_STATUS_OK; -} - -/********************************************************************* - Collection of set...() functions for SAM_ACCOUNT_HANDLE_INFO. - ********************************************************************/ - -NTSTATUS sam_set_account_acct_ctrl(SAM_ACCOUNT_HANDLE *sampass, uint16 acct_ctrl) -{ - SAM_ASSERT(sampass); - - sampass->private.acct_ctrl = acct_ctrl; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_logon_time(SAM_ACCOUNT_HANDLE *sampass, NTTIME mytime, BOOL store) -{ - SAM_ASSERT(sampass); - - sampass->private.logon_time = mytime; - - - return NT_STATUS_UNSUCCESSFUL; -} - -NTSTATUS sam_set_account_logoff_time(SAM_ACCOUNT_HANDLE *sampass, NTTIME mytime, BOOL store) -{ - SAM_ASSERT(sampass); - - sampass->private.logoff_time = mytime; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_kickoff_time(SAM_ACCOUNT_HANDLE *sampass, NTTIME mytime, BOOL store) -{ - SAM_ASSERT(sampass); - - sampass->private.kickoff_time = mytime; - - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_pass_can_change_time(SAM_ACCOUNT_HANDLE *sampass, NTTIME mytime, BOOL store) -{ - SAM_ASSERT(sampass); - - sampass->private.pass_can_change_time = mytime; - - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_pass_must_change_time(SAM_ACCOUNT_HANDLE *sampass, NTTIME mytime, BOOL store) -{ - SAM_ASSERT(sampass); - - sampass->private.pass_must_change_time = mytime; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_pass_last_set_time(SAM_ACCOUNT_HANDLE *sampass, NTTIME mytime) -{ - SAM_ASSERT(sampass); - - sampass->private.pass_last_set_time = mytime; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_hours_len(SAM_ACCOUNT_HANDLE *sampass, uint32 len) -{ - SAM_ASSERT(sampass); - - sampass->private.hours_len = len; - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_logon_divs(SAM_ACCOUNT_HANDLE *sampass, uint16 hours) -{ - SAM_ASSERT(sampass); - - sampass->private.logon_divs = hours; - return NT_STATUS_OK; -} - -/** - * Set flags showing what is initalised in the SAM_ACCOUNT_HANDLE - * @param sampass the SAM_ACCOUNT_HANDLE in question - * @param flag The *new* flag to be set. Old flags preserved - * this flag is only added. - **/ - -NTSTATUS sam_set_account_init_flag(SAM_ACCOUNT_HANDLE *sampass, uint32 flag) -{ - SAM_ASSERT(sampass); - - sampass->private.init_flag |= flag; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_sid(SAM_ACCOUNT_HANDLE *sampass, const DOM_SID *u_sid) -{ - SAM_ASSERT(sampass && u_sid); - - sid_copy(&sampass->private.account_sid, u_sid); - - DEBUG(10, ("sam_set_account_sid: setting account sid %s\n", - sid_string_static(&sampass->private.account_sid))); - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_sid_from_string(SAM_ACCOUNT_HANDLE *sampass, const char *u_sid) -{ - DOM_SID new_sid; - SAM_ASSERT(sampass && u_sid); - - DEBUG(10, ("sam_set_account_sid_from_string: setting account sid %s\n", - u_sid)); - - if (!string_to_sid(&new_sid, u_sid)) { - DEBUG(1, ("sam_set_account_sid_from_string: %s isn't a valid SID!\n", u_sid)); - return NT_STATUS_UNSUCCESSFUL; - } - - if (!NT_STATUS_IS_OK(sam_set_account_sid(sampass, &new_sid))) { - DEBUG(1, ("sam_set_account_sid_from_string: could not set sid %s on SAM_ACCOUNT_HANDLE!\n", u_sid)); - return NT_STATUS_UNSUCCESSFUL; - } - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_pgroup_sid(SAM_ACCOUNT_HANDLE *sampass, const DOM_SID *g_sid) -{ - SAM_ASSERT(sampass && g_sid); - - sid_copy(&sampass->private.group_sid, g_sid); - - DEBUG(10, ("sam_set_group_sid: setting group sid %s\n", - sid_string_static(&sampass->private.group_sid))); - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_pgroup_string(SAM_ACCOUNT_HANDLE *sampass, const char *g_sid) -{ - DOM_SID new_sid; - SAM_ASSERT(sampass && g_sid); - - DEBUG(10, ("sam_set_group_sid_from_string: setting group sid %s\n", - g_sid)); - - if (!string_to_sid(&new_sid, g_sid)) { - DEBUG(1, ("sam_set_group_sid_from_string: %s isn't a valid SID!\n", g_sid)); - return NT_STATUS_UNSUCCESSFUL; - } - - if (!NT_STATUS_IS_OK(sam_set_account_pgroup_sid(sampass, &new_sid))) { - DEBUG(1, ("sam_set_group_sid_from_string: could not set sid %s on SAM_ACCOUNT_HANDLE!\n", g_sid)); - return NT_STATUS_UNSUCCESSFUL; - } - return NT_STATUS_OK; -} - -/********************************************************************* - Set the domain name. - ********************************************************************/ - -NTSTATUS sam_set_account_domain(SAM_ACCOUNT_HANDLE *sampass, SAM_DOMAIN_HANDLE *domain) -{ - SAM_ASSERT(sampass); - - sampass->private.domain = domain; - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's NT name. - ********************************************************************/ - -NTSTATUS sam_set_account_name(SAM_ACCOUNT_HANDLE *sampass, const char *account_name) -{ - SAM_ASSERT(sampass); - - DEBUG(10, ("sam_set_account_name: setting nt account_name %s, was %s\n", account_name, sampass->private.account_name)); - - sampass->private.account_name = talloc_strdup(sampass->mem_ctx, account_name); - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's full name. - ********************************************************************/ - -NTSTATUS sam_set_account_fullname(SAM_ACCOUNT_HANDLE *sampass, const char *full_name) -{ - SAM_ASSERT(sampass); - - DEBUG(10, ("sam_set_account_fullname: setting full name %s, was %s\n", full_name, sampass->private.full_name)); - - sampass->private.full_name = talloc_strdup(sampass->mem_ctx, full_name); - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's logon script. - ********************************************************************/ - -NTSTATUS sam_set_account_logon_script(SAM_ACCOUNT_HANDLE *sampass, const char *logon_script, BOOL store) -{ - SAM_ASSERT(sampass); - - DEBUG(10, ("sam_set_logon_script: from %s to %s\n", logon_script, sampass->private.logon_script)); - - sampass->private.logon_script = talloc_strdup(sampass->mem_ctx, logon_script); - - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's profile path. - ********************************************************************/ - -NTSTATUS sam_set_account_profile_path(SAM_ACCOUNT_HANDLE *sampass, const char *profile_path, BOOL store) -{ - SAM_ASSERT(sampass); - - DEBUG(10, ("sam_set_profile_path: setting profile path %s, was %s\n", profile_path, sampass->private.profile_path)); - - sampass->private.profile_path = talloc_strdup(sampass->mem_ctx, profile_path); - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's directory drive. - ********************************************************************/ - -NTSTATUS sam_set_account_dir_drive(SAM_ACCOUNT_HANDLE *sampass, const char *dir_drive, BOOL store) -{ - SAM_ASSERT(sampass); - - DEBUG(10, ("sam_set_dir_drive: setting dir drive %s, was %s\n", dir_drive, - sampass->private.dir_drive)); - - sampass->private.dir_drive = talloc_strdup(sampass->mem_ctx, dir_drive); - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's home directory. - ********************************************************************/ - -NTSTATUS sam_set_account_homedir(SAM_ACCOUNT_HANDLE *sampass, const char *home_dir, BOOL store) -{ - SAM_ASSERT(sampass); - - DEBUG(10, ("sam_set_homedir: setting home dir %s, was %s\n", home_dir, - sampass->private.home_dir)); - - sampass->private.home_dir = talloc_strdup(sampass->mem_ctx, home_dir); - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's unix home directory. - ********************************************************************/ - -NTSTATUS sam_set_account_unix_homedir(SAM_ACCOUNT_HANDLE *sampass, const char *unix_home_dir) -{ - SAM_ASSERT(sampass); - - DEBUG(10, ("sam_set_unix_homedir: setting home dir %s, was %s\n", unix_home_dir, - sampass->private.unix_home_dir)); - - sampass->private.unix_home_dir = talloc_strdup(sampass->mem_ctx, unix_home_dir); - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's account description. - ********************************************************************/ - -NTSTATUS sam_set_account_acct_desc(SAM_ACCOUNT_HANDLE *sampass, const char *acct_desc) -{ - SAM_ASSERT(sampass); - - sampass->private.acct_desc = talloc_strdup(sampass->mem_ctx, acct_desc); - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's workstation allowed list. - ********************************************************************/ - -NTSTATUS sam_set_account_workstations(SAM_ACCOUNT_HANDLE *sampass, const char *workstations) -{ - SAM_ASSERT(sampass); - - DEBUG(10, ("sam_set_workstations: setting workstations %s, was %s\n", workstations, - sampass->private.workstations)); - - sampass->private.workstations = talloc_strdup(sampass->mem_ctx, workstations); - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's 'unknown_str', whatever the heck this actually is... - ********************************************************************/ - -NTSTATUS sam_set_account_unknown_str(SAM_ACCOUNT_HANDLE *sampass, const char *unknown_str) -{ - SAM_ASSERT(sampass); - - sampass->private.unknown_str = talloc_strdup(sampass->mem_ctx, unknown_str); - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's dial string. - ********************************************************************/ - -NTSTATUS sam_set_account_munged_dial(SAM_ACCOUNT_HANDLE *sampass, const char *munged_dial) -{ - SAM_ASSERT(sampass); - - sampass->private.munged_dial = talloc_strdup(sampass->mem_ctx, munged_dial); - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's NT hash. - ********************************************************************/ - -NTSTATUS sam_set_account_nt_pwd(SAM_ACCOUNT_HANDLE *sampass, const DATA_BLOB data) -{ - SAM_ASSERT(sampass); - - sampass->private.nt_pw = data; - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's LM hash. - ********************************************************************/ - -NTSTATUS sam_set_account_lm_pwd(SAM_ACCOUNT_HANDLE *sampass, const DATA_BLOB data) -{ - SAM_ASSERT(sampass); - - sampass->private.lm_pw = data; - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's plaintext password only (base procedure, see helper - below) - ********************************************************************/ - -NTSTATUS sam_set_account_plaintext_pwd(SAM_ACCOUNT_HANDLE *sampass, const char *plain_pwd) -{ - SAM_ASSERT(sampass); - - sampass->private.plaintext_pw = talloc_strdup(sampass->mem_ctx, plain_pwd); - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_unknown_1(SAM_ACCOUNT_HANDLE *sampass, uint32 unkn) -{ - SAM_ASSERT(sampass); - - sampass->private.unknown_1 = unkn; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_unknown_2(SAM_ACCOUNT_HANDLE *sampass, uint32 unkn) -{ - SAM_ASSERT(sampass); - - sampass->private.unknown_2 = unkn; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_unknown_3(SAM_ACCOUNT_HANDLE *sampass, uint32 unkn) -{ - SAM_ASSERT(sampass); - - sampass->private.unknown_3 = unkn; - return NT_STATUS_OK; -} - -NTSTATUS sam_set_account_hours(SAM_ACCOUNT_HANDLE *sampass, const uint8 *hours) -{ - SAM_ASSERT(sampass); - - if (!hours) { - memset ((char *)sampass->private.hours, 0, MAX_HOURS_LEN); - return NT_STATUS_OK; - } - - memcpy(sampass->private.hours, hours, MAX_HOURS_LEN); - - return NT_STATUS_OK; -} - -/* Helpful interfaces to the above */ - -/********************************************************************* - Sets the last changed times and must change times for a normal - password change. - ********************************************************************/ - -NTSTATUS sam_set_account_pass_changed_now(SAM_ACCOUNT_HANDLE *sampass) -{ - uint32 expire; - NTTIME temptime; - - SAM_ASSERT(sampass); - - unix_to_nt_time(&temptime, time(NULL)); - if (!NT_STATUS_IS_OK(sam_set_account_pass_last_set_time(sampass, temptime))) - return NT_STATUS_UNSUCCESSFUL; - - if (!account_policy_get(AP_MAX_PASSWORD_AGE, &expire) - || (expire==(uint32)-1)) { - - get_nttime_max(&temptime); - if (!NT_STATUS_IS_OK(sam_set_account_pass_must_change_time(sampass, temptime, False))) - return NT_STATUS_UNSUCCESSFUL; - - } else { - /* FIXME: Add expire to temptime */ - - if (!NT_STATUS_IS_OK(sam_get_account_pass_last_set_time(sampass,&temptime)) || !NT_STATUS_IS_OK(sam_set_account_pass_must_change_time(sampass, temptime,True))) - return NT_STATUS_UNSUCCESSFUL; - } - - return NT_STATUS_OK; -} - -/********************************************************************* - Set the account's PLAINTEXT password. Used as an interface to the above. - Also sets the last change time to NOW. - ********************************************************************/ - -NTSTATUS sam_set_account_passwd(SAM_ACCOUNT_HANDLE *sampass, const char *plaintext) -{ - DATA_BLOB data; - uchar new_lanman_p16[16]; - uchar new_nt_p16[16]; - - SAM_ASSERT(sampass && plaintext); - - nt_lm_owf_gen(plaintext, new_nt_p16, new_lanman_p16); - - data = data_blob(new_nt_p16, 16); - if (!NT_STATUS_IS_OK(sam_set_account_nt_pwd(sampass, data))) - return NT_STATUS_UNSUCCESSFUL; - - data = data_blob(new_lanman_p16, 16); - - if (!NT_STATUS_IS_OK(sam_set_account_lm_pwd(sampass, data))) - return NT_STATUS_UNSUCCESSFUL; - - if (!NT_STATUS_IS_OK(sam_set_account_plaintext_pwd(sampass, plaintext))) - return NT_STATUS_UNSUCCESSFUL; - - if (!NT_STATUS_IS_OK(sam_set_account_pass_changed_now(sampass))) - return NT_STATUS_UNSUCCESSFUL; - - return NT_STATUS_OK; -} - diff --git a/source3/sam/get_set_domain.c b/source3/sam/get_set_domain.c deleted file mode 100644 index c70a4a3f09..0000000000 --- a/source3/sam/get_set_domain.c +++ /dev/null @@ -1,263 +0,0 @@ -/* - Unix SMB/CIFS implementation. - SAM_DOMAIN access routines - Copyright (C) Andrew Bartlett 2002 - Copyright (C) Stefan (metze) Metzmacher 2002 - Copyright (C) Jelmer Vernooij 2002 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" - -#undef DBGC_CLASS -#define DBGC_CLASS DBGC_SAM - -NTSTATUS sam_get_domain_sid(SAM_DOMAIN_HANDLE *domain, const DOM_SID **sid) -{ - SAM_ASSERT(domain &&sid); - - *sid = &(domain->private.sid); - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_domain_num_accounts(SAM_DOMAIN_HANDLE *domain, uint32 *num_accounts) -{ - SAM_ASSERT(domain &&num_accounts); - - *num_accounts = domain->private.num_accounts; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_domain_num_groups(SAM_DOMAIN_HANDLE *domain, uint32 *num_groups) -{ - SAM_ASSERT(domain &&num_groups); - - *num_groups = domain->private.num_groups; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_domain_num_aliases(SAM_DOMAIN_HANDLE *domain, uint32 *num_aliases) -{ - SAM_ASSERT(domain &&num_aliases); - - *num_aliases = domain->private.num_aliases; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_domain_name(SAM_DOMAIN_HANDLE *domain, const char **domain_name) -{ - SAM_ASSERT(domain &&domain_name); - - *domain_name = domain->private.name; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_domain_server(SAM_DOMAIN_HANDLE *domain, const char **server_name) -{ - SAM_ASSERT(domain &&server_name); - - *server_name = domain->private.servername; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_domain_max_pwdage(SAM_DOMAIN_HANDLE *domain, NTTIME *max_passwordage) -{ - SAM_ASSERT(domain &&max_passwordage); - - *max_passwordage = domain->private.max_passwordage; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_domain_min_pwdage(SAM_DOMAIN_HANDLE *domain, NTTIME *min_passwordage) -{ - SAM_ASSERT(domain &&min_passwordage); - - *min_passwordage = domain->private.min_passwordage; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_domain_lockout_duration(SAM_DOMAIN_HANDLE *domain, NTTIME *lockout_duration) -{ - SAM_ASSERT(domain &&lockout_duration); - - *lockout_duration = domain->private.lockout_duration; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_domain_reset_count(SAM_DOMAIN_HANDLE *domain, NTTIME *reset_lockout_count) -{ - SAM_ASSERT(domain &&reset_lockout_count); - - *reset_lockout_count = domain->private.reset_count; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_domain_min_pwdlength(SAM_DOMAIN_HANDLE *domain, uint16 *min_passwordlength) -{ - SAM_ASSERT(domain &&min_passwordlength); - - *min_passwordlength = domain->private.min_passwordlength; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_domain_pwd_history(SAM_DOMAIN_HANDLE *domain, uint16 *password_history) -{ - SAM_ASSERT(domain &&password_history); - - *password_history = domain->private.password_history; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_domain_lockout_count(SAM_DOMAIN_HANDLE *domain, uint16 *lockout_count) -{ - SAM_ASSERT(domain &&lockout_count); - - *lockout_count = domain->private.lockout_count; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_domain_force_logoff(SAM_DOMAIN_HANDLE *domain, BOOL *force_logoff) -{ - SAM_ASSERT(domain &&force_logoff); - - *force_logoff = domain->private.force_logoff; - - return NT_STATUS_OK; -} - - -NTSTATUS sam_get_domain_login_pwdchange(SAM_DOMAIN_HANDLE *domain, BOOL *login_pwdchange) -{ - SAM_ASSERT(domain && login_pwdchange); - - *login_pwdchange = domain->private.login_pwdchange; - - return NT_STATUS_OK; -} - -/* Set */ - -NTSTATUS sam_set_domain_name(SAM_DOMAIN_HANDLE *domain, const char *domain_name) -{ - SAM_ASSERT(domain); - - domain->private.name = talloc_strdup(domain->mem_ctx, domain_name); - - return NT_STATUS_OK; -} - - -NTSTATUS sam_set_domain_max_pwdage(SAM_DOMAIN_HANDLE *domain, NTTIME max_passwordage) -{ - SAM_ASSERT(domain); - - domain->private.max_passwordage = max_passwordage; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_domain_min_pwdage(SAM_DOMAIN_HANDLE *domain, NTTIME min_passwordage) -{ - SAM_ASSERT(domain); - - domain->private.min_passwordage = min_passwordage; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_domain_lockout_duration(SAM_DOMAIN_HANDLE *domain, NTTIME lockout_duration) -{ - SAM_ASSERT(domain); - - domain->private.lockout_duration = lockout_duration; - - return NT_STATUS_OK; -} -NTSTATUS sam_set_domain_reset_count(SAM_DOMAIN_HANDLE *domain, NTTIME reset_lockout_count) -{ - SAM_ASSERT(domain); - - domain->private.reset_count = reset_lockout_count; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_domain_min_pwdlength(SAM_DOMAIN_HANDLE *domain, uint16 min_passwordlength) -{ - SAM_ASSERT(domain); - - domain->private.min_passwordlength = min_passwordlength; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_domain_pwd_history(SAM_DOMAIN_HANDLE *domain, uint16 password_history) -{ - SAM_ASSERT(domain); - - domain->private.password_history = password_history; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_domain_lockout_count(SAM_DOMAIN_HANDLE *domain, uint16 lockout_count) -{ - SAM_ASSERT(domain); - - domain->private.lockout_count = lockout_count; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_domain_force_logoff(SAM_DOMAIN_HANDLE *domain, BOOL force_logoff) -{ - SAM_ASSERT(domain); - - domain->private.force_logoff = force_logoff; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_domain_login_pwdchange(SAM_DOMAIN_HANDLE *domain, BOOL login_pwdchange) -{ - SAM_ASSERT(domain); - - domain->private.login_pwdchange = login_pwdchange; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_domain_server(SAM_DOMAIN_HANDLE *domain, const char *server_name) -{ - SAM_ASSERT(domain); - - domain->private.servername = talloc_strdup(domain->mem_ctx, server_name); - - return NT_STATUS_OK; -} diff --git a/source3/sam/get_set_group.c b/source3/sam/get_set_group.c deleted file mode 100644 index 11ea9258a7..0000000000 --- a/source3/sam/get_set_group.c +++ /dev/null @@ -1,106 +0,0 @@ -/* - Unix SMB/CIFS implementation. - SAM_USER_HANDLE access routines - Copyright (C) Andrew Bartlett 2002 - Copyright (C) Stefan (metze) Metzmacher 2002 - Copyright (C) Jelmer Vernooij 2002 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" - -#undef DBGC_CLASS -#define DBGC_CLASS DBGC_SAM - -/* sam group get functions */ - -NTSTATUS sam_get_group_sid(const SAM_GROUP_HANDLE *group, const DOM_SID **sid) -{ - SAM_ASSERT(group && sid); - - *sid = &(group->private.sid); - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_group_ctrl(const SAM_GROUP_HANDLE *group, uint32 *group_ctrl) -{ - SAM_ASSERT(group && group_ctrl); - - *group_ctrl = group->private.group_ctrl; - - return NT_STATUS_OK; -} - -NTSTATUS sam_get_group_name(const SAM_GROUP_HANDLE *group, const char **group_name) -{ - SAM_ASSERT(group); - - *group_name = group->private.group_name; - - return NT_STATUS_OK; - -} -NTSTATUS sam_get_group_comment(const SAM_GROUP_HANDLE *group, const char **group_desc) -{ - SAM_ASSERT(group); - - *group_desc = group->private.group_desc; - - return NT_STATUS_OK; -} - -/* sam group set functions */ - -NTSTATUS sam_set_group_sid(SAM_GROUP_HANDLE *group, const DOM_SID *sid) -{ - SAM_ASSERT(group); - - if (!sid) - ZERO_STRUCT(group->private.sid); - else - sid_copy(&(group->private.sid), sid); - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_group_group_ctrl(SAM_GROUP_HANDLE *group, uint32 group_ctrl) -{ - SAM_ASSERT(group); - - group->private.group_ctrl = group_ctrl; - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_group_name(SAM_GROUP_HANDLE *group, const char *group_name) -{ - SAM_ASSERT(group); - - group->private.group_name = talloc_strdup(group->mem_ctx, group_name); - - return NT_STATUS_OK; -} - -NTSTATUS sam_set_group_description(SAM_GROUP_HANDLE *group, const char *group_desc) -{ - SAM_ASSERT(group); - - group->private.group_desc = talloc_strdup(group->mem_ctx, group_desc); - - return NT_STATUS_OK; - -} diff --git a/source3/sam/sam_ads.c b/source3/sam/sam_ads.c deleted file mode 100755 index 79b107e417..0000000000 --- a/source3/sam/sam_ads.c +++ /dev/null @@ -1,1378 +0,0 @@ -/* - Unix SMB/CIFS implementation. - Active Directory SAM backend, for simulate a W2K DC in mixed mode. - - Copyright (C) Stefan (metze) Metzmacher 2002 - Copyright (C) Andrew Bartlett 2002 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" - - -#ifdef HAVE_LDAP - -static int sam_ads_debug_level = DBGC_SAM; - -#undef DBGC_CLASS -#define DBGC_CLASS sam_ads_debug_level - -#ifndef FIXME -#define FIXME( body ) { DEBUG(0,("FIXME: "));\ - DEBUGADD(0,(body));} -#endif - -#define ADS_STATUS_OK ADS_ERROR(0) -#define ADS_STATUS_UNSUCCESSFUL ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL) -#define ADS_STATUS_NOT_IMPLEMENTED ADS_ERROR_NT(NT_STATUS_NOT_IMPLEMENTED) - - -#define ADS_SUBTREE_BUILTIN "CN=Builtin," -#define ADS_SUBTREE_COMPUTERS "CN=Computers," -#define ADS_SUBTREE_DC "CN=Domain Controllers," -#define ADS_SUBTREE_USERS "CN=Users," -#define ADS_ROOT_TREE "" -/* Here are private module structs and functions */ - -typedef struct sam_ads_privates { - ADS_STRUCT *ads_struct; - TALLOC_CTX *mem_ctx; - BOOL bind_plaintext; - char *ads_bind_dn; - char *ads_bind_pw; - char *ldap_uri; - /* did we need something more? */ -}SAM_ADS_PRIVATES; - - -/* get only these LDAP attributes, witch we really need for an account */ -const char *account_attrs[] = { "objectSid", - "objectGUID", - "sAMAccountType", - "sAMAcountName", - "userPrincipalName", - "accountExpires", - "badPasswordTime", - "badPwdCount", - "lastLogoff", - "lastLogon", - "userWorkstations", - "dBCSPwd", - "unicodePwd", - "pwdLastSet", - "userAccountControl", - "profilePath", - "homeDrive", - "scriptPath", - "homeDirectory", - "cn", - "primaryGroupID",/* 513 */ - "nsNPAllowDialIn",/* TRUE */ - "userParameters",/* Dial Back number ...*/ - "codePage",/* 0 */ - "countryCode",/* 0 */ - "adminCount",/* 1 or 0 */ - "logonCount",/* 0 */ - "managedObjects", - "memberOf",/* dn */ - "instanceType",/* 4 */ - "name", /* sync with cn */ - "description", - /* "nTSecurityDescriptor", */ - NULL}; - -/* get only these LDAP attributes, witch we really need for a group */ -const char *group_attrs[] = {"objectSid", - /* "objectGUID", */ - "sAMAccountType", - "sAMAcountName", - "groupType", - /* "member", */ - "description", - "name", /* sync with cn */ - /* "nTSecurityDescriptor", */ - NULL}; - - -/*************************************************** - return our ads connection. We keep the connection - open to make things faster -****************************************************/ -static ADS_STATUS sam_ads_cached_connection(SAM_ADS_PRIVATES *privates) -{ - ADS_STRUCT *ads_struct; - ADS_STATUS ads_status; - - if (!privates->ads_struct) { - privates->ads_struct = ads_init_simple(); - ads_struct = privates->ads_struct; - ads_struct->server.ldap_uri = smb_xstrdup(privates->ldap_uri); - if ((!privates->ads_bind_dn) || (!*privates->ads_bind_dn)) { - ads_struct->auth.flags |= ADS_AUTH_ANON_BIND; - } else { - ads_struct->auth.user_name - = smb_xstrdup(privates->ads_bind_dn); - if (privates->ads_bind_pw) { - ads_struct->auth.password - = smb_xstrdup(privates->ads_bind_pw); - } - } - if (privates->bind_plaintext) { - ads_struct->auth.flags |= ADS_AUTH_SIMPLE_BIND; - } - } else { - ads_struct = privates->ads_struct; - } - - if (ads_struct->ld != NULL) { - /* connection has been opened. ping server. */ - struct sockaddr_un addr; - socklen_t len; - int sd; - if (ldap_get_option(ads_struct->ld, LDAP_OPT_DESC, &sd) == 0 && - getpeername(sd, (struct sockaddr *) &addr, &len) < 0) { - /* the other end has died. reopen. */ - ldap_unbind_ext(ads_struct->ld, NULL, NULL); - ads_struct->ld = NULL; - } - } - - if (ads_struct->ld != NULL) { - DEBUG(5,("sam_ads_cached_connection: allready connected to the LDAP server\n")); - return ADS_SUCCESS; - } - - ads_status = ads_connect(ads_struct); - - ads_status = ads_server_info(ads_struct); - if (!ADS_ERR_OK(ads_status)) { - DEBUG(0,("Can't set server info: %s\n",ads_errstr(ads_status))); - /* return ads_status; */ FIXME("for now we only warn!\n"); - } - - DEBUG(2, ("sam_ads_cached_connection: succesful connection to the LDAP server\n")); - return ADS_SUCCESS; -} - -static ADS_STATUS sam_ads_do_search(SAM_ADS_PRIVATES *privates, const char *bind_path, int scope, const char *exp, const char **attrs, void **res) -{ - ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL); - - ads_status = sam_ads_cached_connection(privates); - if (!ADS_ERR_OK(ads_status)) - return ads_status; - - return ads_do_search_retry(privates->ads_struct, bind_path, scope, exp, attrs, res); -} - - -/********************************************* -here we have to check the update serial number - - this is the core of the ldap cache -*********************************************/ -static ADS_STATUS sam_ads_usn_is_valid(SAM_ADS_PRIVATES *privates, uint32 usn_in, uint32 *usn_out) -{ - ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL); - - SAM_ASSERT(privates && privates->ads_struct && usn_out); - - ads_status = ads_USN(privates->ads_struct, usn_out); - if (!ADS_ERR_OK(ads_status)) - return ads_status; - - if (*usn_out == usn_in) - return ADS_SUCCESS; - - return ads_status; -} - -/*********************************************** -Initialize SAM_ACCOUNT_HANDLE from an ADS query -************************************************/ -/* not ready :-( */ -static ADS_STATUS ads_entry2sam_account_handle(SAM_ADS_PRIVATES *privates, SAM_ACCOUNT_HANDLE *account ,void *msg) -{ - ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_NO_SUCH_USER); - NTSTATUS nt_status = NT_STATUS_NO_SUCH_USER; - ADS_STRUCT *ads_struct = privates->ads_struct; - TALLOC_CTX *mem_ctx = account->mem_ctx; - char *tmp_str = NULL; - - SAM_ASSERT(privates && ads_struct && account && mem_ctx && msg); - - FIXME("should we really use ads_pull_username()(or ads_pull_string())?\n"); - if ((account->private.account_name = ads_pull_username(ads_struct, mem_ctx, msg))==NULL) { - DEBUG(0,("ads_pull_username failed\n")); - return ADS_ERROR_NT(NT_STATUS_NO_SUCH_USER); - } - - if ((account->private.full_name = ads_pull_string(ads_struct, mem_ctx, msg,"name"))==NULL) { - DEBUG(3,("ads_pull_string for 'name' failed - skip\n")); - } - - if ((account->private.acct_desc = ads_pull_string(ads_struct, mem_ctx, msg,"description"))!=NULL) { - DEBUG(3,("ads_pull_string for 'acct_desc' failed - skip\n")); - } - - if ((account->private.home_dir = ads_pull_string(ads_struct, mem_ctx, msg,"homeDirectory"))!=NULL) { - DEBUG(3,("ads_pull_string for 'homeDirectory' failed - skip\n")); - } - - if ((account->private.dir_drive = ads_pull_string(ads_struct, mem_ctx, msg,"homeDrive"))!=NULL) { - DEBUG(3,("ads_pull_string for 'homeDrive' failed - skip\n")); - } - - if ((account->private.profile_path = ads_pull_string(ads_struct, mem_ctx, msg,"profilePath"))!=NULL) { - DEBUG(3,("ads_pull_string for 'profilePath' failed - skip\n")); - } - - if ((account->private.logon_script = ads_pull_string(ads_struct, mem_ctx, msg,"scriptPath"))!=NULL) { - DEBUG(3,("ads_pull_string for 'scriptPath' failed - skip\n")); - } - - FIXME("check 'nsNPAllowDialIn' for munged_dial!\n"); - if ((account->private.munged_dial = ads_pull_string(ads_struct, mem_ctx, msg,"userParameters"))!=NULL) { - DEBUG(3,("ads_pull_string for 'userParameters' failed - skip\n")); - } - - if ((account->private.unix_home_dir = ads_pull_string(ads_struct, mem_ctx, msg,"msSFUHomeDrirectory"))!=NULL) { - DEBUG(3,("ads_pull_string for 'msSFUHomeDrirectory' failed - skip\n")); - } - -#if 0 - FIXME("use function intern mem_ctx for pwdLastSet\n"); - if ((tmp_str = ads_pull_string(ads_struct, mem_ctx, msg,"pwdLastSet"))!=NULL) { - DEBUG(3,("ads_pull_string for 'pwdLastSet' failed - skip\n")); - } else { - account->private.pass_last_set_time = ads_parse_nttime(tmp_str); - tmp_str = NULL; - - } -#endif - -#if 0 -typedef struct sam_account_handle { - TALLOC_CTX *mem_ctx; - uint32 access_granted; - const struct sam_methods *current_sam_methods; /* sam_methods creating this handle */ - void (*free_fn)(struct sam_account_handle **); - struct sam_account_data { - uint32 init_flag; - NTTIME logon_time; /* logon time */ - NTTIME logoff_time; /* logoff time */ - NTTIME kickoff_time; /* kickoff time */ - NTTIME pass_last_set_time; /* password last set time */ - NTTIME pass_can_change_time; /* password can change time */ - NTTIME pass_must_change_time; /* password must change time */ - char * account_name; /* account_name string */ - SAM_DOMAIN_HANDLE * domain; /* domain of account */ - char *full_name; /* account's full name string */ - char *unix_home_dir; /* UNIX home directory string */ - char *home_dir; /* home directory string */ - char *dir_drive; /* home directory drive string */ - char *logon_script; /* logon script string */ - char *profile_path; /* profile path string */ - char *acct_desc; /* account description string */ - char *workstations; /* login from workstations string */ - char *unknown_str; /* don't know what this is, yet. */ - char *munged_dial; /* munged path name and dial-back tel number */ - DOM_SID account_sid; /* Primary Account SID */ - DOM_SID group_sid; /* Primary Group SID */ - DATA_BLOB lm_pw; /* .data is Null if no password */ - DATA_BLOB nt_pw; /* .data is Null if no password */ - char *plaintext_pw; /* if Null not available */ - uint16 acct_ctrl; /* account info (ACB_xxxx bit-mask) */ - uint32 unknown_1; /* 0x00ff ffff */ - uint16 logon_divs; /* 168 - number of hours in a week */ - uint32 hours_len; /* normally 21 bytes */ - uint8 hours[MAX_HOURS_LEN]; - uint32 unknown_2; /* 0x0002 0000 */ - uint32 unknown_3; /* 0x0000 04ec */ - } private; -} SAM_ACCOUNT_HANDLE; -#endif - - return ads_status; -} - - -/*********************************************** -Initialize SAM_GROUP_ENUM from an ads entry -************************************************/ -/* not ready :-( */ -static ADS_STATUS ads_entry2sam_group_enum(SAM_ADS_PRIVATES *privates, TALLOC_CTX *mem_ctx, SAM_GROUP_ENUM **group_enum,const void *entry) -{ - ADS_STATUS ads_status = ADS_STATUS_UNSUCCESSFUL; - ADS_STRUCT *ads_struct = privates->ads_struct; - SAM_GROUP_ENUM __group_enum; - SAM_GROUP_ENUM *_group_enum = &__group_enum; - - SAM_ASSERT(privates && ads_struct && mem_ctx && group_enum && entry); - - *group_enum = _group_enum; - - DEBUG(3,("sam_ads: ads_entry2sam_account_handle\n")); - - if (!ads_pull_sid(ads_struct, &entry, "objectSid", &(_group_enum->sid))) { - DEBUG(0,("No sid for!?\n")); - return ADS_STATUS_UNSUCCESSFUL; - } - - if (!(_group_enum->group_name = ads_pull_string(ads_struct, mem_ctx, &entry, "sAMAccountName"))) { - DEBUG(0,("No groupname found")); - return ADS_STATUS_UNSUCCESSFUL; - } - - if (!(_group_enum->group_desc = ads_pull_string(ads_struct, mem_ctx, &entry, "desciption"))) { - DEBUG(0,("No description found")); - return ADS_STATUS_UNSUCCESSFUL; - } - - DEBUG(0,("sAMAccountName: %s\ndescription: %s\nobjectSid: %s\n", - _group_enum->group_name, - _group_enum->group_desc, - sid_string_static(&(_group_enum->sid)) - )); - - return ads_status; -} - -static ADS_STATUS sam_ads_access_check(SAM_ADS_PRIVATES *privates, const SEC_DESC *sd, const NT_USER_TOKEN *access_token, uint32 access_desired, uint32 *acc_granted) -{ - ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_ACCESS_DENIED); - NTSTATUS nt_status; - uint32 my_acc_granted; - - SAM_ASSERT(privates && sd && access_token); - /* acc_granted can be set to NULL */ - - /* the steps you need are: - 1. get_sec_desc for sid - 2. se_map_generic(accessdesired, generic_mapping) - 3. se_access_check() */ - - if (!se_access_check(sd, access_token, access_desired, (acc_granted)?acc_granted:&my_acc_granted, &nt_status)) { - DEBUG(3,("sam_ads_access_check: ACCESS DENIED\n")); - ads_status = ADS_ERROR_NT(nt_status); - return ads_status; - } - ads_status = ADS_ERROR_NT(nt_status); - return ads_status; -} - -static ADS_STATUS sam_ads_get_tree_sec_desc(SAM_ADS_PRIVATES *privates, const char *subtree, SEC_DESC **sd) -{ - ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER); - ADS_STRUCT *ads_struct = privates->ads_struct; - TALLOC_CTX *mem_ctx = privates->mem_ctx; - char *search_path; - void *sec_desc_res; - void *sec_desc_msg; - const char *sec_desc_attrs[] = {"nTSecurityDescriptor",NULL}; - - SAM_ASSERT(privates && ads_struct && mem_ctx && sd); - *sd = NULL; - - if (subtree) { - asprintf(&search_path, "%s%s",subtree,ads_struct->config.bind_path); - } else { - asprintf(&search_path, "%s",""); - } - ads_status = sam_ads_do_search(privates, search_path, LDAP_SCOPE_BASE, "(objectClass=*)", sec_desc_attrs, &sec_desc_res); - SAFE_FREE(search_path); - if (!ADS_ERR_OK(ads_status)) - return ads_status; - - if ((sec_desc_msg = ads_first_entry(ads_struct, sec_desc_res))==NULL) { - ads_status = ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER); - return ads_status; - } - - if (!ads_pull_sd(ads_struct, mem_ctx, sec_desc_msg, sec_desc_attrs[0], sd)) { - *sd = NULL; - ads_status = ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER); - return ads_status; - } - - return ads_status; -} - -static ADS_STATUS sam_ads_account_policy_get(SAM_ADS_PRIVATES *privates, int field, uint32 *value) -{ - ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER); - ADS_STRUCT *ads_struct = privates->ads_struct; - void *ap_res; - void *ap_msg; - const char *ap_attrs[] = {"minPwdLength",/* AP_MIN_PASSWORD_LEN */ - "pwdHistoryLength",/* AP_PASSWORD_HISTORY */ - "AP_USER_MUST_LOGON_TO_CHG_PASS",/* AP_USER_MUST_LOGON_TO_CHG_PASS */ - "maxPwdAge",/* AP_MAX_PASSWORD_AGE */ - "minPwdAge",/* AP_MIN_PASSWORD_AGE */ - "lockoutDuration",/* AP_LOCK_ACCOUNT_DURATION */ - "AP_RESET_COUNT_TIME",/* AP_RESET_COUNT_TIME */ - "AP_BAD_ATTEMPT_LOCKOUT",/* AP_BAD_ATTEMPT_LOCKOUT */ - "AP_TIME_TO_LOGOUT",/* AP_TIME_TO_LOGOUT */ - NULL}; - /*lockOutObservationWindow - lockoutThreshold $ pwdProperties*/ - static uint32 ap[9]; - static uint32 ap_usn = 0; - uint32 tmp_usn = 0; - - SAM_ASSERT(privates && ads_struct && value); - - FIXME("We need to decode all account_policy attributes!\n"); - - ads_status = sam_ads_usn_is_valid(privates,ap_usn,&tmp_usn); - if (!ADS_ERR_OK(ads_status)) { - ads_status = sam_ads_do_search(privates, ads_struct->config.bind_path, LDAP_SCOPE_BASE, "(objectClass=*)", ap_attrs, &ap_res); - if (!ADS_ERR_OK(ads_status)) - return ads_status; - - if (ads_count_replies(ads_struct, ap_res) != 1) { - ads_msgfree(ads_struct, ap_res); - return ADS_ERROR(LDAP_NO_RESULTS_RETURNED); - } - - if (!(ap_msg = ads_first_entry(ads_struct, ap_res))) { - ads_msgfree(ads_struct, ap_res); - return ADS_ERROR(LDAP_NO_RESULTS_RETURNED); - } - - if (!ads_pull_uint32(ads_struct, ap_msg, ap_attrs[0], &ap[0])) { - /* AP_MIN_PASSWORD_LEN */ - ap[0] = MINPASSWDLENGTH;/* 5 chars minimum */ - } - if (!ads_pull_uint32(ads_struct, ap_msg, ap_attrs[1], &ap[1])) { - /* AP_PASSWORD_HISTORY */ - ap[1] = 0;/* don't keep any old password */ - } - if (!ads_pull_uint32(ads_struct, ap_msg, ap_attrs[2], &ap[2])) { - /* AP_USER_MUST_LOGON_TO_CHG_PASS */ - ap[2] = 0;/* don't force user to logon */ - } - if (!ads_pull_uint32(ads_struct, ap_msg, ap_attrs[3], &ap[3])) { - /* AP_MAX_PASSWORD_AGE */ - ap[3] = MAX_PASSWORD_AGE;/* 21 days */ - } - if (!ads_pull_uint32(ads_struct, ap_msg, ap_attrs[4], &ap[4])) { - /* AP_MIN_PASSWORD_AGE */ - ap[4] = 0;/* 0 days */ - } - if (!ads_pull_uint32(ads_struct, ap_msg, ap_attrs[5], &ap[5])) { - /* AP_LOCK_ACCOUNT_DURATION */ - ap[5] = 0;/* lockout for 0 minutes */ - } - if (!ads_pull_uint32(ads_struct, ap_msg, ap_attrs[6], &ap[6])) { - /* AP_RESET_COUNT_TIME */ - ap[6] = 0;/* reset immediatly */ - } - if (!ads_pull_uint32(ads_struct, ap_msg, ap_attrs[7], &ap[7])) { - /* AP_BAD_ATTEMPT_LOCKOUT */ - ap[7] = 0;/* don't lockout */ - } - if (!ads_pull_uint32(ads_struct, ap_msg, ap_attrs[8], &ap[8])) { - /* AP_TIME_TO_LOGOUT */ - ap[8] = -1;/* don't force logout */ - } - - ads_msgfree(ads_struct, ap_res); - ap_usn = tmp_usn; - } - - switch(field) { - case AP_MIN_PASSWORD_LEN: - *value = ap[0]; - ads_status = ADS_ERROR_NT(NT_STATUS_OK); - break; - case AP_PASSWORD_HISTORY: - *value = ap[1]; - ads_status = ADS_ERROR_NT(NT_STATUS_OK); - break; - case AP_USER_MUST_LOGON_TO_CHG_PASS: - *value = ap[2]; - ads_status = ADS_ERROR_NT(NT_STATUS_OK); - break; - case AP_MAX_PASSWORD_AGE: - *value = ap[3]; - ads_status = ADS_ERROR_NT(NT_STATUS_OK); - break; - case AP_MIN_PASSWORD_AGE: - *value = ap[4]; - ads_status = ADS_ERROR_NT(NT_STATUS_OK); - break; - case AP_LOCK_ACCOUNT_DURATION: - *value = ap[5]; - ads_status = ADS_ERROR_NT(NT_STATUS_OK); - break; - case AP_RESET_COUNT_TIME: - *value = ap[6]; - ads_status = ADS_ERROR_NT(NT_STATUS_OK); - break; - case AP_BAD_ATTEMPT_LOCKOUT: - *value = ap[7]; - ads_status = ADS_ERROR_NT(NT_STATUS_OK); - break; - case AP_TIME_TO_LOGOUT: - *value = ap[8]; - ads_status = ADS_ERROR_NT(NT_STATUS_OK); - break; - default: *value = 0; break; - } - - return ads_status; -} - - -/********************************** -Now the functions off the SAM API -***********************************/ - -/* General API */ -static NTSTATUS sam_ads_get_sec_desc(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, - const DOM_SID *sid, SEC_DESC **sd) -{ - ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL); - SAM_ADS_PRIVATES *privates = (struct sam_ads_privates *)sam_method->private_data; - ADS_STRUCT *ads_struct = privates->ads_struct; - TALLOC_CTX *mem_ctx; - char *sidstr,*filter; - void *sec_desc_res; - void *sec_desc_msg; - const char *sec_desc_attrs[] = {"nTSecurityDescriptor",NULL}; - fstring sid_str; - SEC_DESC *my_sd; - - SAM_ASSERT(sam_method && access_token && sid && sd); - - ads_status = sam_ads_get_tree_sec_desc(privates, ADS_ROOT_TREE, &my_sd); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - ads_status = sam_ads_access_check(privates, my_sd, access_token, GENERIC_RIGHTS_DOMAIN_READ, NULL); - - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - sidstr = sid_binstring(sid); - if (asprintf(&filter, "(objectSid=%s)", sidstr) == -1) { - SAFE_FREE(sidstr); - return NT_STATUS_NO_MEMORY; - } - - SAFE_FREE(sidstr); - - ads_status = sam_ads_do_search(privates,ads_struct->config.bind_path, - LDAP_SCOPE_SUBTREE, filter, sec_desc_attrs, - &sec_desc_res); - SAFE_FREE(filter); - - if (!ADS_ERR_OK(ads_status)) { - return ads_ntstatus(ads_status); - } - - if (!(mem_ctx = talloc_init("sec_desc parse in sam_ads"))) { - DEBUG(1, ("talloc_init() failed for sec_desc parse context in sam_ads")); - ads_msgfree(ads_struct, sec_desc_res); - return NT_STATUS_NO_MEMORY; - } - - if (ads_count_replies(ads_struct, sec_desc_res) != 1) { - DEBUG(1,("sam_ads_get_sec_desc: duplicate or 0 results for sid %s\n", - sid_to_string(sid_str, sid))); - talloc_destroy(mem_ctx); - ads_msgfree(ads_struct, sec_desc_res); - return NT_STATUS_UNSUCCESSFUL; - } - - if (!(sec_desc_msg = ads_first_entry(ads_struct, sec_desc_res))) { - talloc_destroy(mem_ctx); - ads_msgfree(ads_struct, sec_desc_res); - return NT_STATUS_INVALID_PARAMETER; - } - - if (!ads_pull_sd(ads_struct, mem_ctx, sec_desc_msg, sec_desc_attrs[0], sd)) { - ads_status = ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER); - talloc_destroy(mem_ctx); - ads_msgfree(ads_struct, sec_desc_res); - return ads_ntstatus(ads_status); - } - - /* now, were we allowed to see the SD we just got? */ - - ads_msgfree(ads_struct, sec_desc_res); - talloc_destroy(mem_ctx); - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_set_sec_desc(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, - const DOM_SID *sid, const SEC_DESC *sd) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - - -static NTSTATUS sam_ads_lookup_sid(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, - TALLOC_CTX *mem_ctx, const DOM_SID *sid, char **name, - enum SID_NAME_USE *type) -{ - ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL); - SAM_ADS_PRIVATES *privates = (struct sam_ads_privates *)sam_method->private_data; - ADS_STRUCT *ads_struct = privates->ads_struct; - SEC_DESC *my_sd; - - SAM_ASSERT(sam_method && access_token && mem_ctx && sid && name && type); - - ads_status = sam_ads_get_tree_sec_desc(privates, ADS_ROOT_TREE, &my_sd); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - ads_status = sam_ads_access_check(privates, my_sd, access_token, GENERIC_RIGHTS_DOMAIN_READ, NULL); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - return ads_sid_to_name(ads_struct, mem_ctx, sid, name, type); -} - -static NTSTATUS sam_ads_lookup_name(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, - const char *name, DOM_SID *sid, enum SID_NAME_USE *type) -{ - ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL); - SAM_ADS_PRIVATES *privates = (struct sam_ads_privates *)sam_method->private_data; - ADS_STRUCT *ads_struct = privates->ads_struct; - SEC_DESC *my_sd; - - SAM_ASSERT(sam_method && access_token && name && sid && type); - - ads_status = sam_ads_get_tree_sec_desc(privates, ADS_ROOT_TREE, &my_sd); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - ads_status = sam_ads_access_check(privates, my_sd, access_token, GENERIC_RIGHTS_DOMAIN_READ, NULL); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - return ads_name_to_sid(ads_struct, name, sid, type); -} - - -/* Domain API */ - -static NTSTATUS sam_ads_update_domain(const SAM_METHODS *sam_method, const SAM_DOMAIN_HANDLE *domain) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_get_domain_handle(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, - const uint32 access_desired, SAM_DOMAIN_HANDLE **domain) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - SAM_ADS_PRIVATES *privates = (struct sam_ads_privates *)sam_method->private_data; - TALLOC_CTX *mem_ctx = privates->mem_ctx; /*Fix me is this right??? */ - SAM_DOMAIN_HANDLE *dom_handle = NULL; - SEC_DESC *sd; - uint32 acc_granted; - uint32 tmp_value; - - DEBUG(5,("sam_ads_get_domain_handle: %d\n",__LINE__)); - - SAM_ASSERT(sam_method && access_token && domain); - - (*domain) = NULL; - - if ((dom_handle = talloc(mem_ctx, sizeof(SAM_DOMAIN_HANDLE))) == NULL) { - DEBUG(0,("failed to talloc dom_handle\n")); - ads_status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - return ads_ntstatus(ads_status); - } - - ZERO_STRUCTP(dom_handle); - - dom_handle->mem_ctx = mem_ctx; /*Fix me is this right??? */ - dom_handle->free_fn = NULL; - dom_handle->current_sam_methods = sam_method; - - /* check if access can be granted as requested */ - - ads_status = sam_ads_get_tree_sec_desc(privates, ADS_ROOT_TREE, &sd); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - ads_status = sam_ads_access_check(privates, sd, access_token, access_desired, &acc_granted); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - dom_handle->access_granted = acc_granted; - - /* fill all the values of dom_handle */ - sid_copy(&dom_handle->private.sid, &sam_method->domain_sid); - dom_handle->private.name = smb_xstrdup(sam_method->domain_name); - dom_handle->private.servername = "WHOKNOWS"; /* what is the servername */ - - /*Fix me: sam_ads_account_policy_get() return ADS_STATUS! */ - ads_status = sam_ads_account_policy_get(privates, AP_MAX_PASSWORD_AGE, &tmp_value); - if (!ADS_ERR_OK(ads_status)) { - DEBUG(4,("sam_ads_account_policy_get failed for max password age. Useing default\n")); - tmp_value = MAX_PASSWORD_AGE; - } - unix_to_nt_time_abs(&dom_handle->private.max_passwordage,tmp_value); - - ads_status = sam_ads_account_policy_get(privates, AP_MIN_PASSWORD_AGE, &tmp_value); - if (!ADS_ERR_OK(ads_status)) { - DEBUG(4,("sam_ads_account_policy_get failed for min password age. Useing default\n")); - tmp_value = 0; - } - unix_to_nt_time_abs(&dom_handle->private.min_passwordage, tmp_value); - - ads_status = sam_ads_account_policy_get(privates, AP_LOCK_ACCOUNT_DURATION, &tmp_value); - if (!ADS_ERR_OK(ads_status)) { - DEBUG(4,("sam_ads_account_policy_get failed for lockout duration. Useing default\n")); - tmp_value = 0; - } - unix_to_nt_time_abs(&dom_handle->private.lockout_duration, tmp_value); - - ads_status = sam_ads_account_policy_get(privates, AP_RESET_COUNT_TIME, &tmp_value); - if (!ADS_ERR_OK(ads_status)) { - DEBUG(4,("sam_ads_account_policy_get failed for time till locout count is reset. Useing default\n")); - tmp_value = 0; - } - unix_to_nt_time_abs(&dom_handle->private.reset_count, tmp_value); - - ads_status = sam_ads_account_policy_get(privates, AP_MIN_PASSWORD_LEN, &tmp_value); - if (!ADS_ERR_OK(ads_status)) { - DEBUG(4,("sam_ads_account_policy_get failed for min password length. Useing default\n")); - tmp_value = 0; - } - dom_handle->private.min_passwordlength = (uint16)tmp_value; - - ads_status = sam_ads_account_policy_get(privates, AP_PASSWORD_HISTORY, &tmp_value); - if (!ADS_ERR_OK(ads_status)) { - DEBUG(4,("sam_ads_account_policy_get failed password history. Useing default\n")); - tmp_value = 0; - } - dom_handle->private.password_history = (uint16)tmp_value; - - ads_status = sam_ads_account_policy_get(privates, AP_BAD_ATTEMPT_LOCKOUT, &tmp_value); - if (!ADS_ERR_OK(ads_status)) { - DEBUG(4,("sam_ads_account_policy_get failed for bad attempts till lockout. Useing default\n")); - tmp_value = 0; - } - dom_handle->private.lockout_count = (uint16)tmp_value; - - ads_status = sam_ads_account_policy_get(privates, AP_TIME_TO_LOGOUT, &tmp_value); - if (!ADS_ERR_OK(ads_status)) { - DEBUG(4,("sam_ads_account_policy_get failed for force logout. Useing default\n")); - tmp_value = -1; - } - - ads_status = sam_ads_account_policy_get(privates, AP_USER_MUST_LOGON_TO_CHG_PASS, &tmp_value); - if (!ADS_ERR_OK(ads_status)) { - DEBUG(4,("sam_ads_account_policy_get failed for user must login to change password. Useing default\n")); - tmp_value = 0; - } - - /* should the real values of num_accounts, num_groups and num_aliases be retreved? - * I think it is to expensive to bother - */ - dom_handle->private.num_accounts = 3; - dom_handle->private.num_groups = 4; - dom_handle->private.num_aliases = 5; - - *domain = dom_handle; - - ads_status = ADS_ERROR_NT(NT_STATUS_OK); - return ads_ntstatus(ads_status); -} - -/* Account API */ -static NTSTATUS sam_ads_create_account(const SAM_METHODS *sam_method, - const NT_USER_TOKEN *access_token, uint32 access_desired, - const char *account_name, uint16 acct_ctrl, SAM_ACCOUNT_HANDLE **account) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - SAM_ADS_PRIVATES *privates = (struct sam_ads_privates *)sam_method->private_data; - SEC_DESC *sd = NULL; - uint32 acc_granted; - - SAM_ASSERT(sam_method && privates && access_token && account_name && account); - - ads_status = sam_ads_get_tree_sec_desc(privates, ADS_SUBTREE_USERS, &sd); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - ads_status = sam_ads_access_check(privates, sd, access_token, access_desired, &acc_granted); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - ads_status = ADS_ERROR_NT(sam_init_account(account)); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - (*account)->access_granted = acc_granted; - - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_add_account(const SAM_METHODS *sam_method, const SAM_ACCOUNT_HANDLE *account) -{ - ADS_STATUS ads_status = ADS_ERROR(LDAP_NO_MEMORY); - SAM_ADS_PRIVATES *privates = (struct sam_ads_privates *)sam_method->private_data; - ADS_STRUCT *ads_struct = privates->ads_struct; - TALLOC_CTX *mem_ctx = privates->mem_ctx; - ADS_MODLIST mods; - uint16 acct_ctrl; - char *new_dn; - SEC_DESC *sd; - uint32 acc_granted; - - SAM_ASSERT(sam_method && account); - - ads_status = ADS_ERROR_NT(sam_get_account_acct_ctrl(account,&acct_ctrl)); - if (!ADS_ERR_OK(ads_status)) - goto done; - - if ((acct_ctrl & ACB_WSTRUST)||(acct_ctrl & ACB_SVRTRUST)) { - /* Computer account */ - char *name,*controlstr; - char *hostname,*host_upn,*host_spn; - const char *objectClass[] = {"top", "person", "organizationalPerson", - "user", "computer", NULL}; - - ads_status = ADS_ERROR_NT(sam_get_account_name(account,&name)); - if (!ADS_ERR_OK(ads_status)) - goto done; - - if (!(host_upn = talloc_asprintf(mem_ctx, "%s@%s", name, ads_struct->config.realm))) { - ads_status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - goto done; - } - - if (!(new_dn = talloc_asprintf(mem_ctx, "CN=%s,CN=Computers,%s", hostname, - ads_struct->config.bind_path))) { - ads_status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - goto done; - } - - if (!(controlstr = talloc_asprintf(mem_ctx, "%u", ads_acb2uf(acct_ctrl)))) { - ads_status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - goto done; - } - - if (!(mods = ads_init_mods(mem_ctx))) { - ads_status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - goto done; - } - - ads_status = ads_mod_str(mem_ctx, &mods, "cn", hostname); - if (!ADS_ERR_OK(ads_status)) - goto done; - ads_status = ads_mod_strlist(mem_ctx, &mods, "objectClass", objectClass); - if (!ADS_ERR_OK(ads_status)) - goto done; - ads_status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", host_upn); - if (!ADS_ERR_OK(ads_status)) - goto done; - ads_status = ads_mod_str(mem_ctx, &mods, "displayName", hostname); - if (!ADS_ERR_OK(ads_status)) - goto done; - ads_status = ads_mod_str(mem_ctx, &mods, "sAMAccountName", name); - if (!ADS_ERR_OK(ads_status)) - goto done; - ads_status = ads_mod_str(mem_ctx, &mods, "userAccountControl", controlstr); - if (!ADS_ERR_OK(ads_status)) - goto done; - - ads_status = ads_mod_str(mem_ctx, &mods, "servicePrincipalName", host_spn); - if (!ADS_ERR_OK(ads_status)) - goto done; - ads_status = ads_mod_str(mem_ctx, &mods, "dNSHostName", hostname); - if (!ADS_ERR_OK(ads_status)) - goto done; - ads_status = ads_mod_str(mem_ctx, &mods, "userAccountControl", controlstr); - if (!ADS_ERR_OK(ads_status)) - goto done; - /* ads_status = ads_mod_str(mem_ctx, &mods, "operatingSystem", "Samba"); - if (!ADS_ERR_OK(ads_status)) - goto done; - *//* ads_status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion", VERSION); - if (!ADS_ERR_OK(ads_status)) - goto done; - */ - /* End Computer account */ - } else { - /* User account*/ - char *upn, *controlstr; - char *name, *fullname; - const char *objectClass[] = {"top", "person", "organizationalPerson", - "user", NULL}; - - ads_status = ADS_ERROR_NT(sam_get_account_name(account,&name)); - if (!ADS_ERR_OK(ads_status)) - goto done; - - ads_status = ADS_ERROR_NT(sam_get_account_fullname(account,&fullname)); - if (!ADS_ERR_OK(ads_status)) - goto done; - - if (!(upn = talloc_asprintf(mem_ctx, "%s@%s", name, ads_struct->config.realm))) { - ads_status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - goto done; - } - - if (!(new_dn = talloc_asprintf(mem_ctx, "CN=%s,CN=Users,%s", fullname, - ads_struct->config.bind_path))) { - ads_status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - goto done; - } - - if (!(controlstr = talloc_asprintf(mem_ctx, "%u", ads_acb2uf(acct_ctrl)))) { - ads_status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - goto done; - } - - if (!(mods = ads_init_mods(mem_ctx))) { - ads_status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - goto done; - } - - ads_status = ads_mod_str(mem_ctx, &mods, "cn", fullname); - if (!ADS_ERR_OK(ads_status)) - goto done; - ads_status = ads_mod_strlist(mem_ctx, &mods, "objectClass", objectClass); - if (!ADS_ERR_OK(ads_status)) - goto done; - ads_status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", upn); - if (!ADS_ERR_OK(ads_status)) - goto done; - ads_status = ads_mod_str(mem_ctx, &mods, "displayName", fullname); - if (!ADS_ERR_OK(ads_status)) - goto done; - ads_status = ads_mod_str(mem_ctx, &mods, "sAMAccountName", name); - if (!ADS_ERR_OK(ads_status)) - goto done; - ads_status = ads_mod_str(mem_ctx, &mods, "userAccountControl", controlstr); - if (!ADS_ERR_OK(ads_status)) - goto done; - }/* End User account */ - - /* Finally at the account */ - ads_status = ads_gen_add(ads_struct, new_dn, mods); - -done: - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_update_account(const SAM_METHODS *sam_method, const SAM_ACCOUNT_HANDLE *account) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_delete_account(const SAM_METHODS *sam_method, const SAM_ACCOUNT_HANDLE *account) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - - - - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_enum_accounts(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, uint16 acct_ctrl, uint32 *account_count, SAM_ACCOUNT_ENUM **accounts) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - -#if 0 -static NTSTATUS sam_ads_get_account_by_sid(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, const uint32 access_desired, const DOM_SID *account_sid, SAM_ACCOUNT_HANDLE **account) -{ - ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL); - SAM_ADS_PRIVATES *privates = (struct sam_ads_privates *)sam_method->private_data; - ADS_STRUCT *ads_struct = privates->ads_struct; - TALLOC_CTX *mem_ctx = privates->mem_ctx; - SEC_DESC *sd = NULL; - uint32 acc_granted; - - SAM_ASSERT(sam_method && privates && ads_struct && access_token && account_sid && account); - - ads_status = ADS_ERROR_NT(sam_ads_get_sec_desc(sam_method, access_token, account_sid, &my_sd)); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - ads_status = sam_ads_access_check(privates, sd, access_token, access_desired, &acc_granted); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - ads_status = ADS_ERROR_NT(sam_init_account(account)); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - (*account)->access_granted = acc_granted; - - return ads_ntstatus(ads_status); -} -#else -static NTSTATUS sam_ads_get_account_by_sid(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, const uint32 access_desired, const DOM_SID *account_sid, SAM_ACCOUNT_HANDLE **account) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} -#endif - -#if 0 -static NTSTATUS sam_ads_get_account_by_name(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, const uint32 access_desired, const char *account_name, SAM_ACCOUNT_HANDLE **account) -{ - ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL); - SAM_ADS_PRIVATES *privates = (struct sam_ads_privates *)sam_method->private_data; - ADS_STRUCT *ads_struct = privates->ads_struct; - TALLOC_CTX *mem_ctx = privates->mem_ctx; - SEC_DESC *sd = NULL; - uint32 acc_granted; - - SAM_ASSERT(sam_method && privates && ads_struct && access_token && account_name && account); - - ads_status = sam_ads_get_tree_sec_desc(privates, ADS_ROOT_TREE, &sd); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - ads_status = sam_ads_access_check(privates, sd, access_token, access_desired, &acc_granted); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - ads_status = ADS_ERROR_NT(sam_init_account(account)); - if (!ADS_ERR_OK(ads_status)) - return ads_ntstatus(ads_status); - - (*account)->access_granted = acc_granted; - - return ads_ntstatus(ads_status); -} -#else -static NTSTATUS sam_ads_get_account_by_name(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, const uint32 access_desired, const char *account_name, SAM_ACCOUNT_HANDLE **account) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} -#endif - -/* Group API */ -static NTSTATUS sam_ads_create_group(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, uint32 access_desired, const char *group_name, uint16 group_ctrl, SAM_GROUP_HANDLE **group) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_add_group(const SAM_METHODS *sam_method, const SAM_GROUP_HANDLE *group) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_update_group(const SAM_METHODS *sam_method, const SAM_GROUP_HANDLE *group) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_delete_group(const SAM_METHODS *sam_method, const SAM_GROUP_HANDLE *group) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_enum_groups(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, const uint16 group_ctrl, uint32 *groups_count, SAM_GROUP_ENUM **groups) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - SAM_ADS_PRIVATES *privates = (struct sam_ads_privates *)sam_method->private_data; - ADS_STRUCT *ads_struct = privates->ads_struct; - TALLOC_CTX *mem_ctx = privates->mem_ctx; - void *res = NULL; - void *msg = NULL; - char *filter = NULL; - int i = 0; - - /* get only these LDAP attributes, witch we really need for a group */ - const char *group_enum_attrs[] = {"objectSid", - "description", - "sAMAcountName", - NULL}; - - SAM_ASSERT(sam_method && access_token && groups_count && groups); - - *groups_count = 0; - - DEBUG(3,("ads: enum_dom_groups\n")); - - FIXME("get only group from the wanted Type!\n"); - asprintf(&filter, "(&(objectClass=group)(groupType=%s))", "*"); - ads_status = sam_ads_do_search(privates, ads_struct->config.bind_path, LDAP_SCOPE_SUBTREE, filter, group_enum_attrs, &res); - if (!ADS_ERR_OK(ads_status)) { - DEBUG(1,("enum_groups ads_search: %s\n", ads_errstr(ads_status))); - } - - *groups_count = ads_count_replies(ads_struct, res); - if (*groups_count == 0) { - DEBUG(1,("enum_groups: No groups found\n")); - } - - (*groups) = talloc_zero(mem_ctx, (*groups_count) * sizeof(**groups)); - if (!*groups) { - ads_status = ADS_ERROR_NT(NT_STATUS_NO_MEMORY); - } - - for (msg = ads_first_entry(ads_struct, res); msg; msg = ads_next_entry(ads_struct, msg)) { - uint32 grouptype; - - if (!ads_pull_uint32(ads_struct, msg, "groupType", &grouptype)) { - ; - } else { - (*groups)->group_ctrl = ads_gtype2gcb(grouptype); - } - - if (!((*groups)->group_name = ads_pull_string(ads_struct, mem_ctx, msg, "sAMAccountName"))) { - ; - } - - if (!((*groups)->group_desc = ads_pull_string(ads_struct, mem_ctx, msg, "description"))) { - ; - } - - if (!ads_pull_sid(ads_struct, msg, "objectSid", &((*groups)->sid))) { - DEBUG(1,("No sid for group %s !?\n", (*groups)->group_name)); - continue; - } - - i++; - } - - (*groups_count) = i; - - ads_status = ADS_ERROR_NT(NT_STATUS_OK); - - DEBUG(3,("ads enum_dom_groups gave %d entries\n", (*groups_count))); - - if (res) ads_msgfree(ads_struct, res); - - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_get_group_by_sid(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, const uint32 access_desired, const DOM_SID *groupsid, SAM_GROUP_HANDLE **group) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_get_group_by_name(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, const uint32 access_desired, const char *name, SAM_GROUP_HANDLE **group) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_add_member_to_group(const SAM_METHODS *sam_method, const SAM_GROUP_HANDLE *group, const SAM_GROUP_MEMBER *member) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_delete_member_from_group(const SAM_METHODS *sam_method, const SAM_GROUP_HANDLE *group, const SAM_GROUP_MEMBER *member) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_enum_groupmembers(const SAM_METHODS *sam_method, const SAM_GROUP_HANDLE *group, uint32 *members_count, SAM_GROUP_MEMBER **members) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - -static NTSTATUS sam_ads_get_groups_of_sid(const SAM_METHODS *sam_method, const NT_USER_TOKEN *access_token, const DOM_SID **sids, const uint16 group_ctrl, uint32 *group_count, SAM_GROUP_ENUM **groups) -{ - ADS_STATUS ads_status = ADS_STATUS_NOT_IMPLEMENTED; - DEBUG(0,("sam_ads: %s was called!\n",FUNCTION_MACRO)); - SAM_ASSERT(sam_method); - return ads_ntstatus(ads_status); -} - -/********************************** -Free our private data -***********************************/ -static void sam_ads_free_private_data(void **vp) -{ - SAM_ADS_PRIVATES **sam_ads_state = (SAM_ADS_PRIVATES **)vp; - - if ((*sam_ads_state)->ads_struct->ld) { - ldap_unbind((*sam_ads_state)->ads_struct->ld); - } - - ads_destroy(&((*sam_ads_state)->ads_struct)); - - talloc_destroy((*sam_ads_state)->mem_ctx); - FIXME("maybe we must free some other stuff here\n"); - - *sam_ads_state = NULL; -} - - - -/***************************************************** -Init the ADS SAM backend -******************************************************/ -NTSTATUS sam_init_ads(SAM_METHODS *sam_method, const char *module_params) -{ - ADS_STATUS ads_status; - SAM_ADS_PRIVATES *sam_ads_state; - TALLOC_CTX *mem_ctx; - - SAM_ASSERT(sam_method && sam_method->parent); - - mem_ctx = sam_method->parent->mem_ctx; - - /* Here the SAM API functions of the sam_ads module */ - - /* General API */ - - sam_method->sam_get_sec_desc = sam_ads_get_sec_desc; - sam_method->sam_set_sec_desc = sam_ads_set_sec_desc; - - sam_method->sam_lookup_sid = sam_ads_lookup_sid; - sam_method->sam_lookup_name = sam_ads_lookup_name; - - /* Domain API */ - - sam_method->sam_update_domain = sam_ads_update_domain; - sam_method->sam_get_domain_handle = sam_ads_get_domain_handle; - - /* Account API */ - - sam_method->sam_create_account = sam_ads_create_account; - sam_method->sam_add_account = sam_ads_add_account; - sam_method->sam_update_account = sam_ads_update_account; - sam_method->sam_delete_account = sam_ads_delete_account; - sam_method->sam_enum_accounts = sam_ads_enum_accounts; - - sam_method->sam_get_account_by_sid = sam_ads_get_account_by_sid; - sam_method->sam_get_account_by_name = sam_ads_get_account_by_name; - - /* Group API */ - - sam_method->sam_create_group = sam_ads_create_group; - sam_method->sam_add_group = sam_ads_add_group; - sam_method->sam_update_group = sam_ads_update_group; - sam_method->sam_delete_group = sam_ads_delete_group; - sam_method->sam_enum_groups = sam_ads_enum_groups; - sam_method->sam_get_group_by_sid = sam_ads_get_group_by_sid; - sam_method->sam_get_group_by_name = sam_ads_get_group_by_name; - - sam_method->sam_add_member_to_group = sam_ads_add_member_to_group; - sam_method->sam_delete_member_from_group = sam_ads_delete_member_from_group; - sam_method->sam_enum_groupmembers = sam_ads_enum_groupmembers; - - sam_method->sam_get_groups_of_sid = sam_ads_get_groups_of_sid; - - sam_ads_state = talloc_zero(mem_ctx, sizeof(SAM_ADS_PRIVATES)); - if (!sam_ads_state) { - DEBUG(0, ("talloc() failed for sam_ads private_data!\n")); - return NT_STATUS_NO_MEMORY; - } - - if (!(sam_ads_state->mem_ctx = talloc_init("sam_ads_method"))) { - DEBUG(0, ("talloc_init() failed for sam_ads_state->mem_ctx\n")); - return NT_STATUS_NO_MEMORY; - } - - sam_ads_state->ads_bind_dn = talloc_strdup(sam_ads_state->mem_ctx, lp_parm_const_string(GLOBAL_SECTION_SNUM,"sam_ads","bind as", "")); - sam_ads_state->ads_bind_pw = talloc_strdup(sam_ads_state->mem_ctx, lp_parm_const_string(GLOBAL_SECTION_SNUM,"sam_ads","bind pw", "")); - - sam_ads_state->bind_plaintext = lp_parm_bool(GLOBAL_SECTION_SNUM, "sam_ads", "plaintext bind" , True); - - if (!sam_ads_state->ads_bind_dn || !sam_ads_state->ads_bind_pw) { - DEBUG(0, ("talloc_strdup() failed for bind dn or password\n")); - return NT_STATUS_NO_MEMORY; - } - - /* Maybe we should not check the result here? Server down on startup? */ - - if (module_params && *module_params) { - sam_ads_state->ldap_uri = talloc_strdup(sam_ads_state->mem_ctx, module_params); - if (!sam_ads_state->ldap_uri) { - DEBUG(0, ("talloc_strdup() failed for bind dn or password\n")); - return NT_STATUS_NO_MEMORY; - } - } else { - sam_ads_state->ldap_uri = "ldapi://"; - } - - ads_status = sam_ads_cached_connection(sam_ads_state); - if (!ADS_ERR_OK(ads_status)) { - return ads_ntstatus(ads_status); - } - - sam_method->private_data = sam_ads_state; - sam_method->free_private_data = sam_ads_free_private_data; - - sam_ads_debug_level = debug_add_class("sam_ads"); - if (sam_ads_debug_level == -1) { - sam_ads_debug_level = DBGC_ALL; - DEBUG(0, ("sam_ads: Couldn't register custom debugging class!\n")); - } else DEBUG(2, ("sam_ads: Debug class number of 'sam_ads': %d\n", sam_ads_debug_level)); - - DEBUG(5, ("Initializing sam_ads\n")); - if (module_params) - DEBUG(10, ("Module Parameters for Domain %s[%s]: %s\n", sam_method->domain_name, sam_method->domain_name, module_params)); - return NT_STATUS_OK; -} - -#else /* HAVE_LDAP */ -void sam_ads_dummy(void) -{ - DEBUG(0,("sam_ads: not supported!\n")); -} -#endif /* HAVE_LDAP */ diff --git a/source3/sam/sam_plugin.c b/source3/sam/sam_plugin.c deleted file mode 100644 index fd26c4b8d3..0000000000 --- a/source3/sam/sam_plugin.c +++ /dev/null @@ -1,79 +0,0 @@ -/* - Unix SMB/CIFS implementation. - Loadable san module interface. - Copyright (C) Jelmer Vernooij 2002 - Copyright (C) Andrew Bartlett 2002 - Copyright (C) Stefan (metze) Metzmacher 2002 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" - -#undef DBGC_CLASS -#define DBGC_CLASS DBGC_SAM - -NTSTATUS sam_init_plugin(SAM_METHODS *sam_methods, const char *module_params) -{ - void *dl_handle; - char *plugin_params, *plugin_name, *p; - sam_init_function plugin_init; - int (*plugin_version)(void); - - if (module_params == NULL) { - DEBUG(0, ("The plugin module needs an argument!\n")); - return NT_STATUS_UNSUCCESSFUL; - } - - plugin_name = smb_xstrdup(module_params); - p = strchr(plugin_name, ':'); - if (p) { - *p = 0; - plugin_params = p+1; - trim_string(plugin_params, " ", " "); - } else plugin_params = NULL; - trim_string(plugin_name, " ", " "); - - DEBUG(5, ("Trying to load sam plugin %s\n", plugin_name)); - dl_handle = sys_dlopen(plugin_name, RTLD_NOW); - if (!dl_handle) { - DEBUG(0, ("Failed to load sam plugin %s using sys_dlopen (%s)\n", plugin_name, sys_dlerror())); - return NT_STATUS_UNSUCCESSFUL; - } - - plugin_version = sys_dlsym(dl_handle, "sam_version"); - if (!plugin_version) { - sys_dlclose(dl_handle); - DEBUG(0, ("Failed to find function 'sam_version' using sys_dlsym in sam plugin %s (%s)\n", plugin_name, sys_dlerror())); - return NT_STATUS_UNSUCCESSFUL; - } - - if (plugin_version()!=SAM_INTERFACE_VERSION) { - sys_dlclose(dl_handle); - DEBUG(0, ("Wrong SAM_INTERFACE_VERSION! sam plugin has version %d and version %d is needed! Please update!\n", - plugin_version(),SAM_INTERFACE_VERSION)); - return NT_STATUS_UNSUCCESSFUL; - } - - plugin_init = sys_dlsym(dl_handle, "sam_init"); - if (!plugin_init) { - sys_dlclose(dl_handle); - DEBUG(0, ("Failed to find function 'sam_init' using sys_dlsym in sam plugin %s (%s)\n", plugin_name, sys_dlerror())); - return NT_STATUS_UNSUCCESSFUL; - } - - DEBUG(5, ("Starting sam plugin %s with parameters %s for domain %s\n", plugin_name, plugin_params, sam_methods->domain_name)); - return plugin_init(sam_methods, plugin_params); -} diff --git a/source3/sam/sam_skel.c b/source3/sam/sam_skel.c deleted file mode 100644 index b4d64bb6da..0000000000 --- a/source3/sam/sam_skel.c +++ /dev/null @@ -1,251 +0,0 @@ -/* - Unix SMB/CIFS implementation. - this is a skeleton for SAM backend modules. - - Copyright (C) Stefan (metze) Metzmacher 2002 - Copyright (C) Jelmer Vernooij 2002 - Copyright (C) Andrew Bartlett 2002 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" - -static int sam_skel_debug_level = DBGC_SAM; - -#undef DBGC_CLASS -#define DBGC_CLASS sam_skel_debug_level - -/* define the version of the SAM interface */ -SAM_MODULE_VERSIONING_MAGIC - -/* General API */ - -static NTSTATUS sam_skel_get_sec_desc(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, const DOM_SID *sid, SEC_DESC **sd) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_set_sec_desc(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, const DOM_SID *sid, const SEC_DESC *sd) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -static NTSTATUS sam_skel_lookup_sid(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, TALLOC_CTX *mem_ctx, const DOM_SID *sid, char **name, uint32 *type) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_lookup_name(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, const char *name, DOM_SID *sid, uint32 *type) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -/* Domain API */ - -static NTSTATUS sam_skel_update_domain(const SAM_METHODS *sam_methods, const SAM_DOMAIN_HANDLE *domain) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_get_domain_handle(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, SAM_DOMAIN_HANDLE **domain) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -/* Account API */ - -static NTSTATUS sam_skel_create_account(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, const char *account_name, uint16 acct_ctrl, SAM_ACCOUNT_HANDLE **account) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_add_account(const SAM_METHODS *sam_methods, const SAM_ACCOUNT_HANDLE *account) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_update_account(const SAM_METHODS *sam_methods, const SAM_ACCOUNT_HANDLE *account) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_delete_account(const SAM_METHODS *sam_methods, const SAM_ACCOUNT_HANDLE *account) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_enum_accounts(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint16 acct_ctrl, uint32 *account_count, SAM_ACCOUNT_ENUM **accounts) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -static NTSTATUS sam_skel_get_account_by_sid(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, const DOM_SID *accountsid, SAM_ACCOUNT_HANDLE **account) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_get_account_by_name(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, const char *name, SAM_ACCOUNT_HANDLE **account) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -/* Group API */ - -static NTSTATUS sam_skel_create_group(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, const char *account_name, uint16 group_ctrl, SAM_GROUP_HANDLE **group) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_add_group(const SAM_METHODS *sam_methods, const SAM_GROUP_HANDLE *group) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_update_group(const SAM_METHODS *sam_methods, const SAM_GROUP_HANDLE *group) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_delete_group(const SAM_METHODS *sam_methods, const SAM_GROUP_HANDLE *group) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_enum_groups(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint16 group_ctrl, uint32 *groups_count, SAM_GROUP_ENUM **groups) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_get_group_by_sid(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, const DOM_SID *groupsid, SAM_GROUP_HANDLE **group) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_get_group_by_name(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, uint32 access_desired, const char *name, SAM_GROUP_HANDLE **group) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -static NTSTATUS sam_skel_add_member_to_group(const SAM_METHODS *sam_methods, const SAM_GROUP_HANDLE *group, const SAM_GROUP_MEMBER *member) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_delete_member_from_group(const SAM_METHODS *sam_methods, const SAM_GROUP_HANDLE *group, const SAM_GROUP_MEMBER *member) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS sam_skel_enum_groupmembers(const SAM_METHODS *sam_methods, const SAM_GROUP_HANDLE *group, uint32 *members_count, SAM_GROUP_MEMBER **members) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - - -static NTSTATUS sam_skel_get_groups_of_sid(const SAM_METHODS *sam_methods, const NT_USER_TOKEN *access_token, const DOM_SID **sids, uint16 group_ctrl, uint32 *group_count, SAM_GROUP_ENUM **groups) -{ - DEBUG(0,("sam_skel: %s was called!\n",FUNCTION_MACRO)); - return NT_STATUS_NOT_IMPLEMENTED; -} - -NTSTATUS sam_init_skel(SAM_METHODS *sam_methods, const char *module_params) -{ - /* Functions your SAM module doesn't provide should be set - * to NULL */ - - sam_methods->sam_get_sec_desc = sam_skel_get_sec_desc; - sam_methods->sam_set_sec_desc = sam_skel_set_sec_desc; - - sam_methods->sam_lookup_sid = sam_skel_lookup_sid; - sam_methods->sam_lookup_name = sam_skel_lookup_name; - - /* Domain API */ - - sam_methods->sam_update_domain = sam_skel_update_domain; - sam_methods->sam_get_domain_handle = sam_skel_get_domain_handle; - - /* Account API */ - - sam_methods->sam_create_account = sam_skel_create_account; - sam_methods->sam_add_account = sam_skel_add_account; - sam_methods->sam_update_account = sam_skel_update_account; - sam_methods->sam_delete_account = sam_skel_delete_account; - sam_methods->sam_enum_accounts = sam_skel_enum_accounts; - - sam_methods->sam_get_account_by_sid = sam_skel_get_account_by_sid; - sam_methods->sam_get_account_by_name = sam_skel_get_account_by_name; - - /* Group API */ - - sam_methods->sam_create_group = sam_skel_create_group; - sam_methods->sam_add_group = sam_skel_add_group; - sam_methods->sam_update_group = sam_skel_update_group; - sam_methods->sam_delete_group = sam_skel_delete_group; - sam_methods->sam_enum_groups = sam_skel_enum_groups; - sam_methods->sam_get_group_by_sid = sam_skel_get_group_by_sid; - sam_methods->sam_get_group_by_name = sam_skel_get_group_by_name; - - sam_methods->sam_add_member_to_group = sam_skel_add_member_to_group; - sam_methods->sam_delete_member_from_group = sam_skel_delete_member_from_group; - sam_methods->sam_enum_groupmembers = sam_skel_enum_groupmembers; - - sam_methods->sam_get_groups_of_sid = sam_skel_get_groups_of_sid; - - sam_methods->free_private_data = NULL; - - - sam_skel_debug_level = debug_add_class("sam_skel"); - if (sam_skel_debug_level == -1) { - sam_skel_debug_level = DBGC_SAM; - DEBUG(0, ("sam_skel: Couldn't register custom debugging class!\n")); - } else DEBUG(2, ("sam_skel: Debug class number of 'sam_skel': %d\n", sam_skel_debug_level)); - - if(module_params) - DEBUG(0, ("Starting 'sam_skel' with parameters '%s' for domain %s\n", module_params, sam_methods->domain_name)); - else - DEBUG(0, ("Starting 'sam_skel' for domain %s without paramters\n", sam_methods->domain_name)); - - return NT_STATUS_OK; -} diff --git a/source3/torture/cmd_sam.c b/source3/torture/cmd_sam.c deleted file mode 100644 index 3f7f7dfe27..0000000000 --- a/source3/torture/cmd_sam.c +++ /dev/null @@ -1,514 +0,0 @@ -/* - Unix SMB/CIFS implementation. - SAM module functions - - Copyright (C) Jelmer Vernooij 2002 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" -#include "samtest.h" - -static void print_account(SAM_ACCOUNT_HANDLE *a) -{ - /* FIXME */ -} - -static NTSTATUS cmd_context(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - NTSTATUS status; - char **plugins; - int i; - - plugins = malloc(argc * sizeof(char *)); - - for(i = 1; i < argc; i++) - plugins[i-1] = argv[i]; - - plugins[argc-1] = NULL; - - if(!NT_STATUS_IS_OK(status = make_sam_context_list(&st->context, plugins))) { - printf("make_sam_context_list failed: %s\n", nt_errstr(status)); - SAFE_FREE(plugins); - return status; - } - - SAFE_FREE(plugins); - - return NT_STATUS_OK; -} - -static NTSTATUS cmd_load_module(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - char *plugin_arg[2]; - NTSTATUS status; - if (argc != 2 && argc != 3) { - printf("Usage: load [domain-name]\n"); - return NT_STATUS_OK; - } - - if (argc == 3) - asprintf(&plugin_arg[0], "plugin:%s|%s", argv[1], argv[2]); - else - asprintf(&plugin_arg[0], "plugin:%s", argv[1]); - - plugin_arg[1] = NULL; - - if(!NT_STATUS_IS_OK(status = make_sam_context_list(&st->context, plugin_arg))) { - free(plugin_arg[0]); - return status; - } - - free(plugin_arg[0]); - - printf("load: ok\n"); - return NT_STATUS_OK; -} - -static NTSTATUS cmd_get_sec_desc(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_set_sec_desc(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_lookup_sid(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - char *name; - uint32 type; - NTSTATUS status; - DOM_SID sid; - if (argc != 2) { - printf("Usage: lookup_sid \n"); - return NT_STATUS_INVALID_PARAMETER; - } - - if (!string_to_sid(&sid, argv[1])){ - printf("Unparseable SID specified!\n"); - return NT_STATUS_INVALID_PARAMETER; - } - - if (!NT_STATUS_IS_OK(status = sam_lookup_sid(st->context, st->token, mem_ctx, &sid, &name, &type))) { - printf("sam_lookup_sid failed!\n"); - return status; - } - - printf("Name: %s\n", name); - printf("Type: %d\n", type); /* FIXME: What kind of an integer is type ? */ - - return NT_STATUS_OK; -} - -static NTSTATUS cmd_lookup_name(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - DOM_SID sid; - uint32 type; - NTSTATUS status; - if (argc != 3) { - printf("Usage: lookup_name \n"); - return NT_STATUS_INVALID_PARAMETER; - } - - if (!NT_STATUS_IS_OK(status = sam_lookup_name(st->context, st->token, argv[1], argv[2], &sid, &type))) { - printf("sam_lookup_name failed!\n"); - return status; - } - - printf("SID: %s\n", sid_string_static(&sid)); - printf("Type: %d\n", type); - - return NT_STATUS_OK; -} - -static NTSTATUS cmd_lookup_account(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_lookup_group(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_lookup_domain(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - DOM_SID *sid; - NTSTATUS status; - if (argc != 2) { - printf("Usage: lookup_domain \n"); - return NT_STATUS_INVALID_PARAMETER; - } - - if (!NT_STATUS_IS_OK(status = sam_lookup_domain(st->context, st->token, argv[1], &sid))) { - printf("sam_lookup_name failed!\n"); - return status; - } - - printf("SID: %s\n", sid_string_static(sid)); - - return NT_STATUS_OK; -} - -static NTSTATUS cmd_enum_domains(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - int32 domain_count, i; - DOM_SID *domain_sids; - char **domain_names; - NTSTATUS status; - - if (!NT_STATUS_IS_OK(status = sam_enum_domains(st->context, st->token, &domain_count, &domain_sids, &domain_names))) { - printf("sam_enum_domains failed!\n"); - return status; - } - - if (domain_count == 0) { - printf("No domains found!\n"); - return NT_STATUS_OK; - } - - for (i = 0; i < domain_count; i++) { - printf("%s %s\n", domain_names[i], sid_string_static(&domain_sids[i])); - } - - SAFE_FREE(domain_sids); - SAFE_FREE(domain_names); - - return NT_STATUS_OK; -} - -static NTSTATUS cmd_update_domain(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_show_domain(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - NTSTATUS status; - DOM_SID sid; - SAM_DOMAIN_HANDLE *domain; - uint32 tmp_uint32; - uint16 tmp_uint16; - NTTIME tmp_nttime; - BOOL tmp_bool; - const char *tmp_string; - - if (argc != 2) { - printf("Usage: show_domain \n"); - return status; - } - - if (!string_to_sid(&sid, argv[1])){ - printf("Unparseable SID specified!\n"); - return NT_STATUS_INVALID_PARAMETER; - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_by_sid(st->context, st->token, GENERIC_RIGHTS_DOMAIN_ALL_ACCESS, &sid, &domain))) { - printf("sam_get_domain_by_sid failed\n"); - return status; - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_num_accounts(domain, &tmp_uint32))) { - printf("sam_get_domain_num_accounts failed: %s\n", nt_errstr(status)); - } else { - printf("Number of accounts: %d\n", tmp_uint32); - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_num_groups(domain, &tmp_uint32))) { - printf("sam_get_domain_num_groups failed: %s\n", nt_errstr(status)); - } else { - printf("Number of groups: %u\n", tmp_uint32); - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_num_aliases(domain, &tmp_uint32))) { - printf("sam_get_domain_num_aliases failed: %s\n", nt_errstr(status)); - } else { - printf("Number of aliases: %u\n", tmp_uint32); - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_name(domain, &tmp_string))) { - printf("sam_get_domain_name failed: %s\n", nt_errstr(status)); - } else { - printf("Domain Name: %s\n", tmp_string); - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_lockout_count(domain, &tmp_uint16))) { - printf("sam_get_domain_lockout_count failed: %s\n", nt_errstr(status)); - } else { - printf("Lockout Count: %u\n", tmp_uint16); - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_force_logoff(domain, &tmp_bool))) { - printf("sam_get_domain_force_logoff failed: %s\n", nt_errstr(status)); - } else { - printf("Force Logoff: %s\n", (tmp_bool?"Yes":"No")); - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_lockout_duration(domain, &tmp_nttime))) { - printf("sam_get_domain_lockout_duration failed: %s\n", nt_errstr(status)); - } else { - printf("Lockout duration: %u\n", tmp_nttime.low); - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_login_pwdchange(domain, &tmp_bool))) { - printf("sam_get_domain_login_pwdchange failed: %s\n", nt_errstr(status)); - } else { - printf("Password changing allowed: %s\n", (tmp_bool?"Yes":"No")); - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_max_pwdage(domain, &tmp_nttime))) { - printf("sam_get_domain_max_pwdage failed: %s\n", nt_errstr(status)); - } else { - printf("Maximum password age: %u\n", tmp_nttime.low); - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_min_pwdage(domain, &tmp_nttime))) { - printf("sam_get_domain_min_pwdage failed: %s\n", nt_errstr(status)); - } else { - printf("Minimal password age: %u\n", tmp_nttime.low); - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_min_pwdlength(domain, &tmp_uint16))) { - printf("sam_get_domain_min_pwdlength: %s\n", nt_errstr(status)); - } else { - printf("Minimal Password Length: %u\n", tmp_uint16); - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_pwd_history(domain, &tmp_uint16))) { - printf("sam_get_domain_pwd_history failed: %s\n", nt_errstr(status)); - } else { - printf("Password history: %u\n", tmp_uint16); - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_reset_count(domain, &tmp_nttime))) { - printf("sam_get_domain_reset_count failed: %s\n", nt_errstr(status)); - } else { - printf("Reset count: %u\n", tmp_nttime.low); - } - - if (!NT_STATUS_IS_OK(status = sam_get_domain_server(domain, &tmp_string))) { - printf("sam_get_domain_server failed: %s\n", nt_errstr(status)); - } else { - printf("Server: %s\n", tmp_string); - } - - return NT_STATUS_OK; -} - -static NTSTATUS cmd_create_account(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_update_account(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_delete_account(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_enum_accounts(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - NTSTATUS status; - DOM_SID sid; - int32 account_count, i; - SAM_ACCOUNT_ENUM *accounts; - - if (argc != 2) { - printf("Usage: enum_accounts \n"); - return NT_STATUS_INVALID_PARAMETER; - } - - if (!string_to_sid(&sid, argv[1])){ - printf("Unparseable SID specified!\n"); - return NT_STATUS_INVALID_PARAMETER; - } - - if (!NT_STATUS_IS_OK(status = sam_enum_accounts(st->context, st->token, &sid, 0, &account_count, &accounts))) { - printf("sam_enum_accounts failed: %s\n", nt_errstr(status)); - return status; - } - - if (account_count == 0) { - printf("No accounts found!\n"); - return NT_STATUS_OK; - } - - for (i = 0; i < account_count; i++) - printf("SID: %s\nName: %s\nFullname: %s\nDescription: %s\nACB_BITS: %08X\n\n", - sid_string_static(&accounts[i].sid), accounts[i].account_name, - accounts[i].full_name, accounts[i].account_desc, - accounts[i].acct_ctrl); - - SAFE_FREE(accounts); - - return NT_STATUS_OK; -} - -static NTSTATUS cmd_lookup_account_sid(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - NTSTATUS status; - DOM_SID sid; - SAM_ACCOUNT_HANDLE *account; - - if (argc != 2) { - printf("Usage: lookup_account_sid \n"); - return NT_STATUS_INVALID_PARAMETER; - } - - if (!string_to_sid(&sid, argv[1])){ - printf("Unparseable SID specified!\n"); - return NT_STATUS_INVALID_PARAMETER; - } - - if (!NT_STATUS_IS_OK(status = sam_get_account_by_sid(st->context, st->token, GENERIC_RIGHTS_USER_ALL_ACCESS, &sid, &account))) { - printf("context_sam_get_account_by_sid failed: %s\n", nt_errstr(status)); - return status; - } - - print_account(account); - - return NT_STATUS_OK; -} - -static NTSTATUS cmd_lookup_account_name(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - NTSTATUS status; - SAM_ACCOUNT_HANDLE *account; - - if (argc != 3) { - printf("Usage: lookup_account_name \n"); - return NT_STATUS_INVALID_PARAMETER; - } - - - if (!NT_STATUS_IS_OK(status = sam_get_account_by_name(st->context, st->token, GENERIC_RIGHTS_USER_ALL_ACCESS, argv[1], argv[2], &account))) { - printf("context_sam_get_account_by_sid failed: %s\n", nt_errstr(status)); - return status; - } - - print_account(account); - - return NT_STATUS_OK; -} - -static NTSTATUS cmd_create_group(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_update_group(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_delete_group(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_enum_groups(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_lookup_group_sid(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_lookup_group_name(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_group_add_member(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS cmd_group_del_member(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - - -static NTSTATUS cmd_group_enum(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - - -static NTSTATUS cmd_get_sid_groups(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - return NT_STATUS_NOT_IMPLEMENTED; -} - -struct cmd_set sam_general_commands[] = { - - { "General SAM Commands" }, - - { "load", cmd_load_module, "Load a module", "load [domain-sid]" }, - { "context", cmd_context, "Load specified context", "context [DOMAIN|]backend1[:options] [DOMAIN|]backend2[:options]" }, - { "get_sec_desc", cmd_get_sec_desc, "Get security descriptor info", "get_sec_desc " }, - { "set_sec_desc", cmd_set_sec_desc, "Set security descriptor info", "set_sec_desc " }, - { "lookup_sid", cmd_lookup_sid, "Lookup type of specified SID", "lookup_sid " }, - { "lookup_name", cmd_lookup_name, "Lookup type of specified name", "lookup_name " }, - { NULL } -}; - -struct cmd_set sam_domain_commands[] = { - { "Domain Commands" }, - { "update_domain", cmd_update_domain, "Update domain information", "update_domain [domain-options] domain-name | domain-sid" }, - { "show_domain", cmd_show_domain, "Show domain information", "show_domain domain-sid | domain-name" }, - { "enum_domains", cmd_enum_domains, "Enumerate all domains", "enum_domains " }, - { "lookup_domain", cmd_lookup_domain, "Lookup a domain by name", "lookup_domain domain-name" }, - { NULL } -}; - -struct cmd_set sam_account_commands[] = { - { "Account Commands" }, - { "create_account", cmd_create_account, "Create a new account with specified properties", "create_account [account-options]" }, - { "update_account", cmd_update_account, "Update an existing account", "update_account [account-options] account-sid | account-name" }, - { "delete_account", cmd_delete_account, "Delete an account", "delete_account account-sid | account-name" }, - { "enum_accounts", cmd_enum_accounts, "Enumerate all accounts", "enum_accounts " }, - { "lookup_account", cmd_lookup_account, "Lookup an account by either sid or name", "lookup_account account-sid | account-name" }, - { "lookup_account_sid", cmd_lookup_account_sid, "Lookup an account by sid", "lookup_account_sid account-sid" }, - { "lookup_account_name", cmd_lookup_account_name, "Lookup an account by name", "lookup_account_name account-name" }, - { NULL } -}; - -struct cmd_set sam_group_commands[] = { - { "Group Commands" }, - { "create_group", cmd_create_group, "Create a new group", "create_group [group-opts]" }, - { "update_group", cmd_update_group, "Update an existing group", "update_group [group-opts] group-name | group-sid" }, - { "delete_group", cmd_delete_group, "Delete an existing group", "delete_group group-name | group-sid" }, - { "enum_groups", cmd_enum_groups, "Enumerate all groups", "enum_groups " }, - { "lookup_group", cmd_lookup_group, "Lookup a group by SID or name", "lookup_group group-sid | group-name" }, - { "lookup_group_sid", cmd_lookup_group_sid, "Lookup a group by SID", "lookup_group_sid " }, - { "lookup_group_name", cmd_lookup_group_name, "Lookup a group by name", "lookup_group_name " }, - { "group_add_member", cmd_group_add_member, "Add group member to group", "group_add_member " }, - { "group_del_member", cmd_group_del_member, "Delete group member from group", "group_del_member " }, - { "group_enum", cmd_group_enum, "Enumerate all members of specified group", "group_enum group-sid | group-name" }, - - { "get_sid_groups", cmd_get_sid_groups, "Get a list of groups specified sid is a member of", "group_enum " }, - { NULL } -}; diff --git a/source3/torture/samtest.c b/source3/torture/samtest.c deleted file mode 100644 index fd5f75a664..0000000000 --- a/source3/torture/samtest.c +++ /dev/null @@ -1,445 +0,0 @@ -/* - Unix SMB/CIFS implementation. - SAM module tester - - Copyright (C) 2002 Jelmer Vernooij - - Parts of the code stolen from vfstest by Simo Sorce and Eric Lorimer - Parts of the code stolen from rpcclient by Tim Potter - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" -#include "samtest.h" - -struct func_entry { - char *name; - int (*fn)(struct connection_struct *conn, const char *path); -}; - -/* List to hold groups of commands */ -static struct cmd_list { - struct cmd_list *prev, *next; - struct cmd_set *cmd_set; -} *cmd_list; - -static char* next_command (char** cmdstr) -{ - static pstring command; - char *p; - - if (!cmdstr || !(*cmdstr)) - return NULL; - - p = strchr_m(*cmdstr, ';'); - if (p) - *p = '\0'; - pstrcpy(command, *cmdstr); - *cmdstr = p; - - return command; -} - -/* Load specified configuration file */ -static NTSTATUS cmd_conf(struct samtest_state *sam, TALLOC_CTX *mem_ctx, - int argc, char **argv) -{ - if (argc != 2) { - printf("Usage: %s \n", argv[0]); - return NT_STATUS_OK; - } - - if (!lp_load(argv[1], False, True, False)) { - printf("Error loading \"%s\"\n", argv[1]); - return NT_STATUS_OK; - } - - printf("\"%s\" successfully loaded\n", argv[1]); - return NT_STATUS_OK; -} - -/* Display help on commands */ -static NTSTATUS cmd_help(struct samtest_state *st, TALLOC_CTX *mem_ctx, - int argc, const char **argv) -{ - struct cmd_list *tmp; - struct cmd_set *tmp_set; - - /* Usage */ - if (argc > 2) { - printf("Usage: %s [command]\n", argv[0]); - return NT_STATUS_OK; - } - - /* Help on one command */ - - if (argc == 2) { - for (tmp = cmd_list; tmp; tmp = tmp->next) { - - tmp_set = tmp->cmd_set; - - while(tmp_set->name) { - if (strequal(argv[1], tmp_set->name)) { - if (tmp_set->usage && - tmp_set->usage[0]) - printf("%s\n", tmp_set->usage); - else - printf("No help for %s\n", tmp_set->name); - - return NT_STATUS_OK; - } - - tmp_set++; - } - } - - printf("No such command: %s\n", argv[1]); - return NT_STATUS_OK; - } - - /* List all commands */ - - for (tmp = cmd_list; tmp; tmp = tmp->next) { - - tmp_set = tmp->cmd_set; - - while(tmp_set->name) { - - printf("%20s\t%s\n", tmp_set->name, - tmp_set->description ? tmp_set->description: - ""); - - tmp_set++; - } - } - - return NT_STATUS_OK; -} - -/* Change the debug level */ -static NTSTATUS cmd_debuglevel(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - if (argc > 2) { - printf("Usage: %s [debuglevel]\n", argv[0]); - return NT_STATUS_OK; - } - - if (argc == 2) { - DEBUGLEVEL = atoi(argv[1]); - } - - printf("debuglevel is %d\n", DEBUGLEVEL); - - return NT_STATUS_OK; -} - -static NTSTATUS cmd_quit(struct samtest_state *st, TALLOC_CTX *mem_ctx, int argc, char **argv) -{ - /* Cleanup */ - talloc_destroy(mem_ctx); - - exit(0); - return NT_STATUS_OK; /* NOTREACHED */ -} - -static struct cmd_set samtest_commands[] = { - - { "GENERAL OPTIONS" }, - - { "help", cmd_help, "Get help on commands", "" }, - { "?", cmd_help, "Get help on commands", "" }, - { "conf", cmd_conf, "Load smb configuration file", "conf " }, - { "debuglevel", cmd_debuglevel, "Set debug level", "" }, - { "exit", cmd_quit, "Exit program", "" }, - { "quit", cmd_quit, "Exit program", "" }, - - { NULL } -}; - -static struct cmd_set separator_command[] = { - { "---------------", NULL, "----------------------" }, - { NULL } -}; - - -/*extern struct cmd_set sam_commands[];*/ -extern struct cmd_set sam_general_commands[]; -extern struct cmd_set sam_domain_commands[]; -extern struct cmd_set sam_account_commands[]; -extern struct cmd_set sam_group_commands[]; -static struct cmd_set *samtest_command_list[] = { - samtest_commands, - sam_general_commands, - sam_domain_commands, - sam_account_commands, - sam_group_commands, - NULL -}; - -static void add_command_set(struct cmd_set *cmd_set) -{ - struct cmd_list *entry; - - if (!(entry = (struct cmd_list *)malloc(sizeof(struct cmd_list)))) { - DEBUG(0, ("out of memory\n")); - return; - } - - ZERO_STRUCTP(entry); - - entry->cmd_set = cmd_set; - DLIST_ADD(cmd_list, entry); -} - -static NTSTATUS do_cmd(struct samtest_state *st, struct cmd_set *cmd_entry, char *cmd) -{ - char *p = cmd, **argv = NULL; - NTSTATUS result = NT_STATUS_UNSUCCESSFUL; - TALLOC_CTX *mem_ctx = NULL; - pstring buf; - int argc = 0, i; - - /* Count number of arguments first time through the loop then - allocate memory and strdup them. */ - - again: - while(next_token(&p, buf, " ", sizeof(buf))) { - if (argv) { - argv[argc] = strdup(buf); - } - - argc++; - } - - if (!argv) { - - /* Create argument list */ - - argv = (char **)malloc(sizeof(char *) * argc); - memset(argv, 0, sizeof(char *) * argc); - - if (!argv) { - fprintf(stderr, "out of memory\n"); - result = NT_STATUS_NO_MEMORY; - goto done; - } - - p = cmd; - argc = 0; - - goto again; - } - - /* Call the function */ - - if (cmd_entry->fn) { - - if (mem_ctx == NULL) { - /* Create mem_ctx */ - if (!(mem_ctx = talloc_init("do_cmd"))) { - DEBUG(0, ("talloc_init() failed\n")); - goto done; - } - } - - /* Run command */ - result = cmd_entry->fn(st, mem_ctx, argc, argv); - - } else { - fprintf (stderr, "Invalid command\n"); - goto done; - } - - done: - - /* Cleanup */ - - if (argv) { - for (i = 0; i < argc; i++) - SAFE_FREE(argv[i]); - - SAFE_FREE(argv); - } - - return result; -} - -/* Process a command entered at the prompt or as part of -c */ -static NTSTATUS process_cmd(struct samtest_state *st, char *cmd) -{ - struct cmd_list *temp_list; - BOOL found = False; - pstring buf; - char *p = cmd; - NTSTATUS result = NT_STATUS_OK; - int len = 0; - - if (cmd[strlen(cmd) - 1] == '\n') - cmd[strlen(cmd) - 1] = '\0'; - - if (!next_token(&p, buf, " ", sizeof(buf))) { - return NT_STATUS_OK; - } - - /* strip the trainly \n if it exsists */ - len = strlen(buf); - if (buf[len-1] == '\n') - buf[len-1] = '\0'; - - /* Search for matching commands */ - - for (temp_list = cmd_list; temp_list; temp_list = temp_list->next) { - struct cmd_set *temp_set = temp_list->cmd_set; - - while(temp_set->name) { - if (strequal(buf, temp_set->name)) { - found = True; - result = do_cmd(st, temp_set, cmd); - - goto done; - } - temp_set++; - } - } - - done: - if (!found && buf[0]) { - printf("command not found: %s\n", buf); - return NT_STATUS_OK; - } - - if (!NT_STATUS_IS_OK(result)) { - printf("result was %s\n", nt_errstr(result)); - } - - return result; -} - -void exit_server(char *reason) -{ - DEBUG(3,("Server exit (%s)\n", (reason ? reason : ""))); - exit(0); -} - -static int server_fd = -1; -int last_message = -1; - -int smbd_server_fd(void) -{ - return server_fd; -} - -BOOL reload_services(BOOL test) -{ - return True; -} - -/* Main function */ - -int main(int argc, char *argv[]) -{ - BOOL interactive = True; - int opt; - static char *cmdstr = NULL; - struct cmd_set **cmd_set; - struct samtest_state st; - - /* make sure the vars that get altered (4th field) are in - a fixed location or certain compilers complain */ - poptContext pc; - struct poptOption long_options[] = { - POPT_AUTOHELP - {"command", 'e', POPT_ARG_STRING, &cmdstr, 'e', "Execute semicolon seperated cmds"}, - POPT_COMMON_SAMBA - POPT_TABLEEND - }; - - ZERO_STRUCT(st); - - st.token = get_system_token(); - - setlinebuf(stdout); - - DEBUGLEVEL = 1; - - pc = poptGetContext("samtest", argc, (const char **) argv, - long_options, 0); - - while((opt = poptGetNextOpt(pc)) != -1) { - switch (opt) { - case 'l': - slprintf(logfile, sizeof(logfile) - 1, "%s.client", - opt_logfile); - lp_set_logfile(logfile); - interactive = False; - break; - } - } - - if (!lp_load(config_file,True,False,False)) { - fprintf(stderr, "Can't load %s - run testparm to debug it\n", config_file); - exit(1); - } - - poptFreeContext(pc); - - /* the following functions are part of the Samba debugging - facilities. See lib/debug.c */ - setup_logging("samtest", interactive); - if (!interactive) - reopen_logs(); - - /* Load command lists */ - - cmd_set = samtest_command_list; - - while(*cmd_set) { - add_command_set(*cmd_set); - add_command_set(separator_command); - cmd_set++; - } - - /* Do anything specified with -c */ - if (cmdstr && cmdstr[0]) { - char *cmd; - char *p = cmdstr; - - while((cmd=next_command(&p)) != NULL) { - process_cmd(&st, cmd); - } - - return 0; - } - - /* Loop around accepting commands */ - - while(1) { - pstring prompt; - char *line; - - slprintf(prompt, sizeof(prompt) - 1, "samtest $> "); - - line = smb_readline(prompt, NULL, NULL); - - if (line == NULL) - break; - - if (line[0] != '\n') - process_cmd(&st, line); - } - - return 0; -} -- cgit From 7c6b4a1d18cf3b72569fe491b33be190f65c49a7 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Thu, 11 Sep 2003 07:31:39 +0000 Subject: Merge from samba-3.0: >Fix error message when calling namedtogid() fails adding a group map >entry. Bug #431. (This used to be commit 1befe1758351f43558808a3c91543752e7ff7823) --- source3/utils/net_groupmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/utils/net_groupmap.c b/source3/utils/net_groupmap.c index 9937145230..f99876bbd8 100644 --- a/source3/utils/net_groupmap.c +++ b/source3/utils/net_groupmap.c @@ -258,7 +258,7 @@ static int net_groupmap_add(int argc, const char **argv) } if ( (gid = nametogid(unixgrp)) == (gid_t)-1 ) { - d_printf("Can't lookup UNIX group %s\n", ntgroup); + d_printf("Can't lookup UNIX group %s\n", unixgrp); return -1; } -- cgit From 0788e30fe18901df92a497a9ceddb898cd3d07b9 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Thu, 11 Sep 2003 07:32:04 +0000 Subject: Merge from samba-3.0: >Formatting fixups for help output. (This used to be commit fe7c8e39688f0966563c67dd61a9ad8ae2b98f99) --- source3/utils/net_help.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source3/utils/net_help.c b/source3/utils/net_help.c index 95116a4d2a..c688beef72 100644 --- a/source3/utils/net_help.c +++ b/source3/utils/net_help.c @@ -42,10 +42,10 @@ int net_common_flags_usage(int argc, const char **argv) d_printf("Valid miscellaneous options are:\n"); /* misc options */ d_printf("\t-p or --port=\t\tconnection port on target\n"); d_printf("\t-W or --myworkgroup=\tclient workgroup\n"); - d_printf("\t-d or --debuglevel=\t\tdebug level (0-10)\n"); + d_printf("\t-d or --debuglevel=\tdebug level (0-10)\n"); d_printf("\t-n or --myname=\t\tclient name\n"); d_printf("\t-U or --user=\t\tuser name\n"); - d_printf("\t-s or --configfile=\t\tpathname of smb.conf file\n"); + d_printf("\t-s or --configfile=\tpathname of smb.conf file\n"); d_printf("\t-l or --long\t\t\tDisplay full information\n"); d_printf("\t-V or --version\t\t\tPrint samba version information\n"); d_printf("\t-P or --machine-pass\t\tAuthenticate as machine account\n"); -- cgit From 5cb04291390ccc369855449806778508d0c62ed9 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Thu, 11 Sep 2003 07:33:05 +0000 Subject: Merge from samba-3.0: >Revision 1.8.2.33 >Fix error return path memory leaks in vampire code for creating users. > >Display an error if we can't create a posix account for the user >(e.g no add user/machine script was specified; bug #323). >Revision 1.8.2.32: >Use opt_target_workgroup instead of lp_workgroup() in vampire code so >we can override the value in smb.conf with the -w option. > >Migrating accounts from another domain can now be done like: > ># bin/net join bdc -w nt4dom -Uadministrator%password ># bin/net rpc vampire -w nt4dom -U administrator%password (This used to be commit 36f7d88edd15bff1b7dfa78f3908dae272b96215) --- source3/utils/net_rpc_samsync.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/source3/utils/net_rpc_samsync.c b/source3/utils/net_rpc_samsync.c index ed69f8a326..64f2d3f68f 100644 --- a/source3/utils/net_rpc_samsync.c +++ b/source3/utils/net_rpc_samsync.c @@ -428,9 +428,10 @@ static NTSTATUS fetch_account_info(uint32 rid, SAM_ACCOUNT_INFO *delta) (delta->acb_info & ACB_DOMTRUST) ) { pstrcpy(add_script, lp_addmachine_script()); } else { - *add_script = '\0'; DEBUG(1, ("Unknown user type: %s\n", smbpasswd_encode_acb_info(delta->acb_info))); + nt_ret = NT_STATUS_UNSUCCESSFUL; + goto done; } if (*add_script) { int add_ret; @@ -448,8 +449,11 @@ static NTSTATUS fetch_account_info(uint32 rid, SAM_ACCOUNT_INFO *delta) } /* try and find the possible unix account again */ - if ( !(passwd = Get_Pwnam(account)) ) - return NT_STATUS_NO_SUCH_USER; + if ( !(passwd = Get_Pwnam(account)) ) { + d_printf("Could not create posix account info for '%s'\n", account); + nt_ret = NT_STATUS_NO_SUCH_USER; + goto done; + } } @@ -499,6 +503,7 @@ static NTSTATUS fetch_account_info(uint32 rid, SAM_ACCOUNT_INFO *delta) pdb_get_username(sam_account))); } + done: pdb_free_sam(&sam_account); return nt_ret; } @@ -1034,7 +1039,7 @@ int rpc_vampire(int argc, const char **argv) goto fail; } - if (!secrets_fetch_trust_account_password(lp_workgroup(), + if (!secrets_fetch_trust_account_password(opt_target_workgroup, trust_password, NULL, &sec_channel)) { d_printf("Could not retrieve domain trust secret\n"); @@ -1056,7 +1061,7 @@ int rpc_vampire(int argc, const char **argv) nt_errstr(result)); if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) d_printf("Perhaps %s is a Windows 2000 native mode " - "domain?\n", lp_workgroup()); + "domain?\n", opt_target_workgroup); goto fail; } -- cgit From 95bfe31c1f4fda39195fcc2fea0648c277a0e49d Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Thu, 11 Sep 2003 07:34:44 +0000 Subject: Merge from samba-3.0: >Fix for bug #273 - smbd crash on machine account change. >Someone only half changed the code to use dc_name >instead of remote machine... Found via back trace from Dariush Forouher >. >Jeremy. (This used to be commit 1956478ddece5899ebdf627969136603e1c21637) --- source3/smbd/change_trust_pw.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/source3/smbd/change_trust_pw.c b/source3/smbd/change_trust_pw.c index 80c9fcb258..1178400e4d 100644 --- a/source3/smbd/change_trust_pw.c +++ b/source3/smbd/change_trust_pw.c @@ -48,22 +48,20 @@ NTSTATUS change_trust_account_password( const char *domain, const char *remote_m if ( !name_status_find( domain, 0x1b, 0x20, pdc_ip, dc_name) ) goto failed; - } - /* supoport old deprecated "smbpasswd -j DOMAIN -r MACHINE" behavior */ - else { + } else { + /* supoport old deprecated "smbpasswd -j DOMAIN -r MACHINE" behavior */ fstrcpy( dc_name, remote_machine ); } /* if this next call fails, then give up. We can't do password changes on BDC's --jerry */ - if (!NT_STATUS_IS_OK(cli_full_connection(&cli, global_myname(), remote_machine, + if (!NT_STATUS_IS_OK(cli_full_connection(&cli, global_myname(), dc_name, NULL, 0, "IPC$", "IPC", "", "", - "", 0, Undefined, NULL))) - { - DEBUG(0,("modify_trust_password: Connection to %s failed!\n", remote_machine)); + "", 0, Undefined, NULL))) { + DEBUG(0,("modify_trust_password: Connection to %s failed!\n", dc_name)); nt_status = NT_STATUS_UNSUCCESSFUL; goto failed; } @@ -75,7 +73,7 @@ NTSTATUS change_trust_account_password( const char *domain, const char *remote_m if(cli_nt_session_open(cli, PI_NETLOGON) == False) { DEBUG(0,("modify_trust_password: unable to open the domain client session to machine %s. Error was : %s.\n", - remote_machine, cli_errstr(cli))); + dc_name, cli_errstr(cli))); cli_nt_session_close(cli); cli_ulogoff(cli); cli_shutdown(cli); @@ -83,8 +81,7 @@ NTSTATUS change_trust_account_password( const char *domain, const char *remote_m goto failed; } - nt_status = trust_pw_find_change_and_store_it(cli, cli->mem_ctx, - domain); + nt_status = trust_pw_find_change_and_store_it(cli, cli->mem_ctx, domain); cli_nt_session_close(cli); cli_ulogoff(cli); -- cgit From d80e9b7e42c3b474dc04a635e6494dc6bfd11fe1 Mon Sep 17 00:00:00 2001 From: Jim McDonough Date: Thu, 11 Sep 2003 18:37:17 +0000 Subject: Updated 3.0 schema files for IBM Directory Server 5.1 keeps with IBM convention of separate attributetype and objectclass definitions (This used to be commit 861f3b0d5fc11645f05494a6a5fe716031cfc79f) --- examples/LDAP/samba.schema.at.IBM-DS | 46 ++++++++++++++++++++++++++++++++++++ examples/LDAP/samba.schema.oc.IBM-DS | 15 ++++++++++++ 2 files changed, 61 insertions(+) create mode 100644 examples/LDAP/samba.schema.at.IBM-DS create mode 100644 examples/LDAP/samba.schema.oc.IBM-DS diff --git a/examples/LDAP/samba.schema.at.IBM-DS b/examples/LDAP/samba.schema.at.IBM-DS new file mode 100644 index 0000000000..5aa70b5101 --- /dev/null +++ b/examples/LDAP/samba.schema.at.IBM-DS @@ -0,0 +1,46 @@ +## Samba 3.0 schema for IBM Directory Server 5.1 - object classes only + +attributetypes=( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 hash of the unicode password'EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Account Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{16} SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.27 NAME 'sambaPwdLastSet' DESC 'Timestamp of the last password update' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.28 NAME 'sambaPwdCanChange' DESC 'Timestamp of when the user is allowed to update the password' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.29 NAME 'sambaPwdMustChange' DESC 'Timestamp of when the password will expire' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.30 NAME 'sambaLogonTime' DESC 'Timestamp of last logon' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.31 NAME 'sambaLogoffTime' DESC 'Timestamp of last logoff' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.32 NAME 'sambaKickoffTime' DESC 'Timestamp of when the user will be logged off automatically' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' DESC 'Driver letter of home directory mapping' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' DESC 'Logon script path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' DESC 'Roaming profile path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations' DESC 'List of user workstations the user is allowed to logon to' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' DESC 'Home directory UNC path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' DESC 'Windows NT domain to which the user belongs' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' DESC 'Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' DESC 'Primary Group Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.19 NAME 'sambaGroupType' DESC 'NT Group Type' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.21 NAME 'sambaNextUserRid' DESC 'Next NT rid to give our for users' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.22 NAME 'sambaNextGroupRid' DESC 'Next NT rid to give out for groups' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.39 NAME 'sambaNextRid' DESC 'Next NT rid to give out for anything' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + +attributetypes=( 1.3.6.1.4.1.7165.2.1.40 NAME 'sambaAlgorithmicRidBase' DESC 'Base at which the samba RID generation algorithm should operate' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + diff --git a/examples/LDAP/samba.schema.oc.IBM-DS b/examples/LDAP/samba.schema.oc.IBM-DS new file mode 100644 index 0000000000..202c332407 --- /dev/null +++ b/examples/LDAP/samba.schema.oc.IBM-DS @@ -0,0 +1,15 @@ +## Samba 3.0 schema for IBM Directory Server 5.1 - object classes only + +objectclasses=( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY DESC 'Samba 3.0 Auxilary SAM Account' MUST ( uid $ sambaSID ) MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $ sambaProfilePath $ description $ sambaUserWorkstations $ sambaPrimaryGroupSID $ sambaDomainName )) + +objectclasses=( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' SUP top AUXILIARY DESC 'Samba Group Mapping' MUST ( gidNumber $ sambaSID $ sambaGroupType ) MAY ( displayName $ description )) + +objectclasses=( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' SUP top STRUCTURAL DESC 'Samba Domain Information' MUST ( sambaDomainName $ sambaSID ) MAY ( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ sambaAlgorithmicRidBase ) ) + +objectclasses=( 1.3.6.1.4.1.7165.1.2.2.7 NAME 'sambaUnixIdPool' SUP top AUXILIARY DESC 'Pool for allocating UNIX uids/gids' MUST ( uidNumber $ gidNumber ) ) + +objectclasses=( 1.3.6.1.4.1.7165.1.2.2.8 NAME 'sambaIdmapEntry' SUP top AUXILIARY DESC 'Mapping from a SID to an ID' MUST ( sambaSID ) MAY ( uidNumber $ gidNumber ) ) + +objectclasses=( 1.3.6.1.4.1.7165.1.2.2.9 NAME 'sambaSidEntry' SUP top STRUCTURAL DESC 'Structural Class for a SID' MUST ( sambaSID ) ) + + -- cgit From a0fb605c2519bd3a9e3730fcb372977a52c7d25b Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Fri, 12 Sep 2003 02:03:28 +0000 Subject: Fix another crash bug in samsync. (This used to be commit 675707c33e8447b9cb9fc2ae451663a56a14d792) --- source3/utils/net_rpc_samsync.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/source3/utils/net_rpc_samsync.c b/source3/utils/net_rpc_samsync.c index 64f2d3f68f..d1c8300a49 100644 --- a/source3/utils/net_rpc_samsync.c +++ b/source3/utils/net_rpc_samsync.c @@ -182,6 +182,9 @@ static void dump_database(struct cli_state *cli, unsigned db_type, DOM_CRED *ret result = cli_netlogon_sam_sync(cli, mem_ctx, ret_creds, db_type, sync_context, &num_deltas, &hdr_deltas, &deltas); + if (NT_STATUS_IS_ERR(result)) + break; + clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), ret_creds); for (i = 0; i < num_deltas; i++) { display_sam_entry(&hdr_deltas[i], &deltas[i]); -- cgit From eae6e9f155c78a4f448c1a798f9d7d61f53a2795 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 15 Sep 2003 04:59:45 +0000 Subject: Merge from Samba 3.0: >Fix from Craig Barratt to fix restore >with filenames > 100 chars. >Jeremy. (This used to be commit a7bbfd636798232416c044df8a77dbbd8c77f9ed) --- source3/client/clitar.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/source3/client/clitar.c b/source3/client/clitar.c index b01de5b8e7..f38d6fe91a 100644 --- a/source3/client/clitar.c +++ b/source3/client/clitar.c @@ -1054,9 +1054,11 @@ static int get_dir(file_info2 finfo) has the data. We only want the long file name, as the loop in do_tarput will deal with the rest. */ -static char * get_longfilename(file_info2 finfo) +static char *get_longfilename(file_info2 finfo) { - int namesize = strlen(finfo.name) + strlen(cur_dir) + 2; + /* finfo.size here is the length of the filename as written by the "/./@LongLink" name + * header call. */ + int namesize = finfo.size + strlen(cur_dir) + 2; char *longname = malloc(namesize); int offset = 0, left = finfo.size; BOOL first = True; -- cgit From a9cd4a6ae1709381f896605beb0c3e82c16b330e Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 15 Sep 2003 05:01:27 +0000 Subject: Merge from Samba 3.0: >For some reason testparm runs at debug level 2 which causes the module probe functions to >display verbose debugs. Increase the probe debugs to level 3. (This used to be commit be91bbd570bd94f67001aab9cfb2baf44b390097) --- source3/lib/module.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/lib/module.c b/source3/lib/module.c index e2c6f6dcf5..941a6cfbe3 100644 --- a/source3/lib/module.c +++ b/source3/lib/module.c @@ -41,7 +41,7 @@ static NTSTATUS do_smb_load_module(const char *module_name, BOOL is_probe) handle = sys_dlopen(module_name, RTLD_LAZY); if(!handle) { - int level = is_probe ? 2 : 0; + int level = is_probe ? 3 : 0; DEBUG(level, ("Error loading module '%s': %s\n", module_name, sys_dlerror())); -- cgit From d8231592bc4497fbec0a9ced20cd8cc84782bb9d Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 15 Sep 2003 05:02:12 +0000 Subject: Merge from Samba 3.0: >Fix for MacOS/X which uses STUPID BROKEN UNICODE COMPOSE CHARACTERS ! >(rant off :-). Inspired by work from Benjamin Riefenstahl . >Also add MacOSX/Darwin configure fixes. >Jerry - can we put this in 3.0 release ? :-). >Jeremy. (This used to be commit 67acde75d3569b612f87646ff0740f8020e8fdcf) --- source3/lib/charcnv.c | 79 +++++++++++++++++++++++++++++++++----------------- source3/lib/util_str.c | 14 +++++++-- 2 files changed, 65 insertions(+), 28 deletions(-) diff --git a/source3/lib/charcnv.c b/source3/lib/charcnv.c index 5f3cf64a68..dafc88fb77 100644 --- a/source3/lib/charcnv.c +++ b/source3/lib/charcnv.c @@ -176,6 +176,14 @@ static size_t convert_string_internal(charset_t from, charset_t to, descriptor = conv_handles[from][to]; + if (srclen == (size_t)-1) { + if (from == CH_UCS2) { + srclen = (strlen_w((const smb_ucs2_t *)src)+1) * 2; + } else { + srclen = strlen((const char *)src)+1; + } + } + if (descriptor == (smb_iconv_t)-1 || descriptor == (smb_iconv_t)0) { if (!conv_silent) DEBUG(0,("convert_string_internal: Conversion not supported.\n")); @@ -248,31 +256,40 @@ size_t convert_string(charset_t from, charset_t to, void const *src, size_t srclen, void *dest, size_t destlen) { + /* + * NB. We deliberately don't do a strlen here is srclen == -1. + * This is very expensive over millions of calls and is taken + * care of in the slow path in convert_string_internal. JRA. + */ + if (srclen == 0) return 0; if (from != CH_UCS2 && to != CH_UCS2) { const unsigned char *p = (const unsigned char *)src; unsigned char *q = (unsigned char *)dest; + size_t slen = srclen; + size_t dlen = destlen; unsigned char lastp; size_t retval = 0; /* If all characters are ascii, fast path here. */ - while (srclen && destlen) { + while (slen && dlen) { if ((lastp = *p) <= 0x7f) { *q++ = *p++; - if (srclen != (size_t)-1) { - srclen--; + if (slen != (size_t)-1) { + slen--; } - destlen--; + dlen--; retval++; if (!lastp) break; } else { - if (srclen == (size_t)-1) { - srclen = strlen(p)+1; - } - return retval + convert_string_internal(from, to, p, srclen, q, destlen); +#ifdef BROKEN_UNICODE_COMPOSE_CHARACTERS + goto general_case; +#else + return retval + convert_string_internal(from, to, p, slen, q, dlen); +#endif } } return retval; @@ -280,25 +297,28 @@ size_t convert_string(charset_t from, charset_t to, const unsigned char *p = (const unsigned char *)src; unsigned char *q = (unsigned char *)dest; size_t retval = 0; + size_t slen = srclen; + size_t dlen = destlen; unsigned char lastp; /* If all characters are ascii, fast path here. */ - while ((srclen >= 2) && destlen) { - if ((lastp = *p) <= 0x7f && p[1] == 0) { + while ((slen >= 2) && dlen) { + if (((lastp = *p) <= 0x7f) && (p[1] == 0)) { *q++ = *p; - if (srclen != (size_t)-1) { - srclen -= 2; + if (slen != (size_t)-1) { + slen -= 2; } p += 2; - destlen--; + dlen--; retval++; if (!lastp) break; } else { - if (srclen == (size_t)-1) { - srclen = strlen_w((const void *)p)+2; - } - return retval + convert_string_internal(from, to, p, srclen, q, destlen); +#ifdef BROKEN_UNICODE_COMPOSE_CHARACTERS + goto general_case; +#else + return retval + convert_string_internal(from, to, p, slen, q, dlen); +#endif } } return retval; @@ -306,29 +326,36 @@ size_t convert_string(charset_t from, charset_t to, const unsigned char *p = (const unsigned char *)src; unsigned char *q = (unsigned char *)dest; size_t retval = 0; + size_t slen = srclen; + size_t dlen = destlen; unsigned char lastp; /* If all characters are ascii, fast path here. */ - while (srclen && (destlen >= 2)) { + while (slen && (dlen >= 2)) { if ((lastp = *p) <= 0x7F) { *q++ = *p++; *q++ = '\0'; - if (srclen != (size_t)-1) { - srclen--; + if (slen != (size_t)-1) { + slen--; } - destlen -= 2; + dlen -= 2; retval += 2; if (!lastp) break; } else { - if (srclen == (size_t)-1) { - srclen = strlen(p)+1; - } - return retval + convert_string_internal(from, to, p, srclen, q, destlen); +#ifdef BROKEN_UNICODE_COMPOSE_CHARACTERS + goto general_case; +#else + return retval + convert_string_internal(from, to, p, slen, q, dlen); +#endif } } return retval; } + +#ifdef BROKEN_UNICODE_COMPOSE_CHARACTERS + general_case: +#endif return convert_string_internal(from, to, src, srclen, dest, destlen); } @@ -542,7 +569,7 @@ char *strdup_upper(const char *s) strupper_w(buffer); - size = convert_string(CH_UCS2, CH_UNIX, buffer, sizeof(buffer), out_buffer, sizeof(out_buffer)); + size = convert_string(CH_UCS2, CH_UNIX, buffer, -1, out_buffer, sizeof(out_buffer)); if (size == -1) { return NULL; } diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c index 82b312e241..15ac1639a9 100644 --- a/source3/lib/util_str.c +++ b/source3/lib/util_str.c @@ -382,6 +382,10 @@ void string_replace(pstring s,char oldc,char newc) return; /* Slow (mb) path. */ +#ifdef BROKEN_UNICODE_COMPOSE_CHARACTERS + /* With compose characters we must restart from the beginning. JRA. */ + p = s; +#endif push_ucs2(NULL, tmpbuf, p, sizeof(tmpbuf), STR_TERMINATE); string_replace_w(tmpbuf, UCS2_CHAR(oldc), UCS2_CHAR(newc)); pull_ucs2(NULL, p, tmpbuf, -1, sizeof(tmpbuf), STR_TERMINATE); @@ -1175,18 +1179,19 @@ char *string_truncate(char *s, unsigned int length) We convert via ucs2 for now. **/ -char *strchr_m(const char *s, char c) +char *strchr_m(const char *src, char c) { wpstring ws; pstring s2; smb_ucs2_t *p; + const char *s; /* this is quite a common operation, so we want it to be fast. We optimise for the ascii case, knowing that all our supported multi-byte character sets are ascii-compatible (ie. they match for the first 128 chars) */ - while (*s && (((unsigned char)s[0]) & 0x80)) { + for (s = src; *s && !(((unsigned char)s[0]) & 0x80); s++) { if (*s == c) return s; } @@ -1194,6 +1199,11 @@ char *strchr_m(const char *s, char c) if (!*s) return NULL; +#ifdef BROKEN_UNICODE_COMPOSE_CHARACTERS + /* With compose characters we must restart from the beginning. JRA. */ + s = src; +#endif + push_ucs2(NULL, ws, s, sizeof(ws), STR_TERMINATE); p = strchr_w(ws, UCS2_CHAR(c)); if (!p) -- cgit From b584f74bd7fdc6a353b38d9e2e6e69fee1096fb4 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 15 Sep 2003 05:03:11 +0000 Subject: Merge from Samba 3.0: >Fix a nasty mess, and also bug #296. passdb/pdb_ldap.c was not converting >to/from utf8 for some calls. The libads code gets this right. Wonder why >the passdb code doesn't use it ? >Jeremy. (This used to be commit 258c106e2243f19c77fe35edd6dcba816a8fc8ee) --- source3/libads/ldap.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c index e925750e0a..48401cc3d8 100644 --- a/source3/libads/ldap.c +++ b/source3/libads/ldap.c @@ -709,7 +709,16 @@ char *ads_get_dn(ADS_STRUCT *ads, void *msg) utf8_dn = ldap_get_dn(ads->ld, msg); - pull_utf8_allocate((void **) &unix_dn, utf8_dn); + if (!utf8_dn) { + DEBUG (5, ("ads_get_dn: ldap_get_dn failed\n")); + return NULL; + } + + if (pull_utf8_allocate((void **) &unix_dn, utf8_dn) == (size_t)-1) { + DEBUG(0,("ads_get_dn: string conversion failure utf8 [%s]\n", + utf8_dn )); + return NULL; + } ldap_memfree(utf8_dn); return unix_dn; } -- cgit From aafb99dc8f14e061ca538c6f9822ba5b8253d40b Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 15 Sep 2003 05:19:07 +0000 Subject: Merge from Samba 3.0: >Still on my mb rampage. Ensure smbldap_make_mod() correctly detects old >values. >Jeremy. (This used to be commit 9df18a6c4ea30545297f9e5a0b10b440e6a0687e) --- source3/lib/smbldap.c | 48 +++++++++++++++++++++++++++++++++--------------- 1 file changed, 33 insertions(+), 15 deletions(-) diff --git a/source3/lib/smbldap.c b/source3/lib/smbldap.c index 1ce03491da..781e6b976c 100644 --- a/source3/lib/smbldap.c +++ b/source3/lib/smbldap.c @@ -282,8 +282,9 @@ BOOL fetch_ldap_pw(char **dn, char** pw) } /******************************************************************* -search an attribute and return the first value found. + Search an attribute and return the first value found. ******************************************************************/ + BOOL smbldap_get_single_attribute (LDAP * ldap_struct, LDAPMessage * entry, const char *attribute, pstring value) { @@ -300,8 +301,7 @@ search an attribute and return the first value found. return False; } - if (convert_string(CH_UTF8, CH_UNIX,values[0], -1, value, sizeof(pstring)) == (size_t)-1) - { + if (convert_string(CH_UTF8, CH_UNIX,values[0], -1, value, sizeof(pstring)) == (size_t)-1) { DEBUG(1, ("smbldap_get_single_attribute: string conversion of [%s] = [%s] failed!\n", attribute, values[0])); ldap_value_free(values); @@ -402,32 +402,32 @@ search an attribute and return the first value found. *modlist = mods; } - /********************************************************************** Set attribute to newval in LDAP, regardless of what value the attribute had in LDAP before. *********************************************************************/ + void smbldap_make_mod(LDAP *ldap_struct, LDAPMessage *existing, LDAPMod ***mods, const char *attribute, const char *newval) { - char **values = NULL; + pstring oldval; + BOOL existed; if (existing != NULL) { - values = ldap_get_values(ldap_struct, existing, attribute); + existed = smbldap_get_single_attribute(ldap_struct, existing, attribute, oldval); + } else { + existed = False; + *oldval = '\0'; } /* all of our string attributes are case insensitive */ - if ((values != NULL) && (values[0] != NULL) && - StrCaseCmp(values[0], newval) == 0) - { + if (existed && (StrCaseCmp(oldval, newval) == 0)) { /* Believe it or not, but LDAP will deny a delete and an add at the same time if the values are the same... */ - - ldap_value_free(values); return; } @@ -439,7 +439,7 @@ search an attribute and return the first value found. smbldap_set_mod(mods, LDAP_MOD_ADD, attribute, newval); } - if (values == NULL) { + if (!existed) { /* There has been no value before, so don't delete it. Here's a possible race: We might end up with duplicate attributes */ @@ -451,11 +451,9 @@ search an attribute and return the first value found. deny the complete operation if somebody changed the attribute behind our back. */ - smbldap_set_mod(mods, LDAP_MOD_DELETE, attribute, values[0]); - ldap_value_free(values); + smbldap_set_mod(mods, LDAP_MOD_DELETE, attribute, oldval); } - /********************************************************************** Some varients of the LDAP rebind code do not pass in the third 'arg' pointer to a void*, so we try and work around it by assuming that the @@ -1329,3 +1327,23 @@ NTSTATUS smbldap_search_domain_info(struct smbldap_state *ldap_state, return ret; } +/******************************************************************* + Return a copy of the DN for a LDAPMessage. Convert from utf8 to CH_UNIX. +********************************************************************/ + +char *smbldap_get_dn(LDAP *ld, LDAPMessage *entry) +{ + char *utf8_dn, *unix_dn; + + utf8_dn = ldap_get_dn(ld, entry); + if (!utf8_dn) { + DEBUG (5, ("smbldap_get_dn: ldap_get_dn failed\n")); + return NULL; + } + if (pull_utf8_allocate((void **) &unix_dn, utf8_dn) == (size_t)-1) { + DEBUG (0, ("smbldap_get_dn: String conversion failure utf8 [%s]\n", utf8_dn)); + return NULL; + } + ldap_memfree(utf8_dn); + return unix_dn; +} -- cgit From ac4ae84d0848fde76887239b47a5deb5bbf76b21 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 15 Sep 2003 05:25:49 +0000 Subject: Merge from Samba 3.0: >Patch from Gregory Hinton Nietsky , >ensure the desired access is read from the incoming RPC request. >Jeremy. (This used to be commit a556637d0bc56aeb980c422c4d1da44311956c3b) --- source3/rpc_server/srv_samr_nt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c index 7f7b5e8d5e..261d641ab1 100644 --- a/source3/rpc_server/srv_samr_nt.c +++ b/source3/rpc_server/srv_samr_nt.c @@ -4236,7 +4236,7 @@ NTSTATUS _samr_open_group(pipes_struct *p, SAMR_Q_OPEN_GROUP *q_u, SAMR_R_OPEN_G struct samr_info *info; SEC_DESC *psd = NULL; uint32 acc_granted; - uint32 des_access; + uint32 des_access = q_u->access_mask; size_t sd_size; NTSTATUS status; fstring sid_string; -- cgit From 4d0d68191173aae351f12dc5805856980dcbfeb7 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 15 Sep 2003 05:26:44 +0000 Subject: Merge from Samba 3.0: >Fix for typo in darwin detection. >Jeremy. >Fix for MacOS/X which uses STUPID BROKEN UNICODE COMPOSE CHARACTERS ! >(rant off :-). Inspired by work from Benjamin Riefenstahl . >Also add MacOSX/Darwin configure fixes. >Jerry - can we put this in 3.0 release ? :-). >Jeremy. (This used to be commit 7951dee600146623ce473659c3f41963ea873e3e) --- source3/configure.in | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/source3/configure.in b/source3/configure.in index a2e04b5d48..0cf34bc9a7 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -402,7 +402,6 @@ case "$host_os" in *freebsd*) AC_DEFINE(FREEBSD, 1, [Whether the host os is FreeBSD]) ;; - # # VOS may need to have POSIX support and System V compatibility enabled. # @@ -503,6 +502,26 @@ main() { AC_MSG_RESULT([$LINUX_LFS_SUPPORT]) ;; +# +# MacOS X is the *only* system that uses compose character in utf8. This +# is so horribly broken.... +# + *darwin*) + AC_DEFINE(BROKEN_UNICODE_COMPOSE_CHARACTERS, 1, [Does this system use unicode compose characters]) +# Add Fink directories for various packages, like dlcompat. +# Note: iconv does that explicitly below, but other packages +# don't. + CPPFLAGS="$CPPFLAGS -I/sw/include" + LDFLAGS="$LDFLAGS -L/sw/lib" + +# If we have dlsym_prepend_underscore (from Fink's dlcompat), +# use that instead of plain dlsym. + + AC_CHECK_LIB(dl,dlopen) + AC_CHECK_FUNCS(dlsym_prepend_underscore, + [CPPFLAGS="$CPPFLAGS -Ddlsym=dlsym_prepend_underscore"]) + + ;; *hurd*) AC_MSG_CHECKING([for LFS support]) old_CPPFLAGS="$CPPFLAGS" @@ -1162,6 +1181,14 @@ if test "$enable_shared" = "yes"; then BLDSHARED="false" LDSHFLAGS="" ;; + + *darwin*) AC_DEFINE(DARWINOS,1,[Whether the host os is Darwin/MacOSX]) + BLDSHARED="true" + LDSHFLAGS="-bundle -flat_namespace -undefined suppress" + SHLIBEXT="dylib" + AC_DEFINE(STAT_ST_BLOCKSIZE,512) + ;; + *) AC_DEFINE(STAT_ST_BLOCKSIZE,512) ;; -- cgit From d26084868ac3088b7709889db9bd988c2e8a95ff Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 15 Sep 2003 05:27:55 +0000 Subject: Merge from Samba 3.0: >fix unitiailized timestamp where merging print_jobs and lpq listing (This used to be commit 1603d0e6848a8ec3f7d8a8f735c9d1a6d92aac0b) --- source3/printing/printing.c | 1 + 1 file changed, 1 insertion(+) diff --git a/source3/printing/printing.c b/source3/printing/printing.c index 1a7066f906..1a878afb92 100644 --- a/source3/printing/printing.c +++ b/source3/printing/printing.c @@ -2184,6 +2184,7 @@ static BOOL get_stored_queue_info(struct tdb_print_db *pdb, int snum, int *pcoun queue[total_count].page_count = pjob->page_count; queue[total_count].status = pjob->status; queue[total_count].priority = 1; + queue[total_count].time = pjob->starttime; fstrcpy(queue[total_count].fs_user, pjob->user); fstrcpy(queue[total_count].fs_file, pjob->jobname); total_count++; -- cgit From 1d38ffec7a64d84bbfadd17d93a75cf2cd6451b5 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 15 Sep 2003 05:28:51 +0000 Subject: Merge from Samba 3.0: >Ensure we consistantly translate to/from utf8 for talking to LDAP. >Jeremy. (This used to be commit 5b0753bd98ffef5133da31f1c47a45e794d0bb72) --- source3/sam/idmap_ldap.c | 64 +++++++++++++++++++++++------------------------- 1 file changed, 31 insertions(+), 33 deletions(-) diff --git a/source3/sam/idmap_ldap.c b/source3/sam/idmap_ldap.c index 6122641718..72fcb47b03 100644 --- a/source3/sam/idmap_ldap.c +++ b/source3/sam/idmap_ldap.c @@ -104,6 +104,7 @@ static BOOL sid_in_use(struct ldap_idmap_state *state, This also checks that this RID is actually free - in case the admin manually stole it :-). *********************************************************************/ + static NTSTATUS ldap_next_rid(struct ldap_idmap_state *state, uint32 *rid, int rid_type) { @@ -121,11 +122,9 @@ static NTSTATUS ldap_next_rid(struct ldap_idmap_state *state, uint32 *rid, int attempts = 0; char *ld_error = NULL; - while (attempts < 10) - { + while (attempts < 10) { if (!NT_STATUS_IS_OK(ret = smbldap_search_domain_info(state->smbldap_state, - &domain_result, get_global_sam_name(), True))) - { + &domain_result, get_global_sam_name(), True))) { return ret; } @@ -136,7 +135,7 @@ static NTSTATUS ldap_next_rid(struct ldap_idmap_state *state, uint32 *rid, return ret; } - if ((dn = ldap_get_dn(state->smbldap_state->ldap_struct, entry)) == NULL) { + if ((dn = smbldap_get_dn(state->smbldap_state->ldap_struct, entry)) == NULL) { DEBUG(0, ("Could not get domain info DN\n")); ldap_msgfree(domain_result); return ret; @@ -148,8 +147,7 @@ static NTSTATUS ldap_next_rid(struct ldap_idmap_state *state, uint32 *rid, if (smbldap_get_single_attribute(state->smbldap_state->ldap_struct, entry, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_ALGORITHMIC_RID_BASE), - algorithmic_rid_base_string)) - { + algorithmic_rid_base_string)) { alg_rid_base = (uint32)atol(algorithmic_rid_base_string); } else { @@ -169,8 +167,7 @@ static NTSTATUS ldap_next_rid(struct ldap_idmap_state *state, uint32 *rid, can allocate to new users */ if (smbldap_get_single_attribute(state->smbldap_state->ldap_struct, entry, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_RID), - old_rid_string)) - { + old_rid_string)) { *rid = (uint32)atol(old_rid_string); } else { *rid = BASE_RID; @@ -195,16 +192,14 @@ static NTSTATUS ldap_next_rid(struct ldap_idmap_state *state, uint32 *rid, case USER_RID_TYPE: if (smbldap_get_single_attribute(state->smbldap_state->ldap_struct, entry, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_USERRID), - old_rid_string)) - { + old_rid_string)) { *rid = (uint32)atol(old_rid_string); } break; case GROUP_RID_TYPE: if (smbldap_get_single_attribute(state->smbldap_state->ldap_struct, entry, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_GROUPRID), - old_rid_string)) - { + old_rid_string)) { *rid = (uint32)atol(old_rid_string); } break; @@ -236,32 +231,31 @@ static NTSTATUS ldap_next_rid(struct ldap_idmap_state *state, uint32 *rid, } } - if ((rc = ldap_modify_s(state->smbldap_state->ldap_struct, dn, mods)) == LDAP_SUCCESS) { + if ((rc = smbldap_modify(state->smbldap_state, dn, mods)) == LDAP_SUCCESS) { DOM_SID dom_sid; DOM_SID sid; pstring domain_sid_string; int error = 0; if (!smbldap_get_single_attribute(state->smbldap_state->ldap_struct, domain_result, - get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOM_SID), - domain_sid_string)) - { + get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOM_SID), + domain_sid_string)) { ldap_mods_free(mods, True); - ldap_memfree(dn); + SAFE_FREE(dn); ldap_msgfree(domain_result); return ret; } if (!string_to_sid(&dom_sid, domain_sid_string)) { ldap_mods_free(mods, True); - ldap_memfree(dn); + SAFE_FREE(dn); ldap_msgfree(domain_result); return ret; } ldap_mods_free(mods, True); mods = NULL; - ldap_memfree(dn); + SAFE_FREE(dn); ldap_msgfree(domain_result); sid_copy(&sid, &dom_sid); @@ -286,8 +280,7 @@ static NTSTATUS ldap_next_rid(struct ldap_idmap_state *state, uint32 *rid, ldap_mods_free(mods, True); mods = NULL; - ldap_memfree(dn); - dn = NULL; + SAFE_FREE(dn); ldap_msgfree(domain_result); domain_result = NULL; @@ -361,7 +354,10 @@ static NTSTATUS ldap_allocate_id(unid_t *id, int id_type) goto out; } - dn = ldap_get_dn(ldap_state.smbldap_state->ldap_struct, result); + dn = smbldap_get_dn(ldap_state.smbldap_state->ldap_struct, result); + if (!dn) { + goto out; + } entry = ldap_first_entry(ldap_state.smbldap_state->ldap_struct, result); if (!smbldap_get_single_attribute(ldap_state.smbldap_state->ldap_struct, entry, type, id_str)) { @@ -401,9 +397,9 @@ static NTSTATUS ldap_allocate_id(unid_t *id, int id_type) smbldap_set_mod( &mods, LDAP_MOD_DELETE, type, id_str ); smbldap_set_mod( &mods, LDAP_MOD_ADD, type, new_id_str ); - rc = ldap_modify_s(ldap_state.smbldap_state->ldap_struct, dn, mods); + rc = smbldap_modify(ldap_state.smbldap_state, dn, mods); - ldap_memfree(dn); + SAFE_FREE(dn); ldap_mods_free( mods, True ); if (rc != LDAP_SUCCESS) { @@ -663,12 +659,13 @@ static NTSTATUS ldap_get_id_from_sid(unid_t *id, int *id_type, const DOM_SID *si entry = ldap_first_entry(ldap_state.smbldap_state->ldap_struct, result); - dn = ldap_get_dn(ldap_state.smbldap_state->ldap_struct, result); + dn = smbldap_get_dn(ldap_state.smbldap_state->ldap_struct, result); + if (!dn) + goto out; DEBUG(10, ("Found mapping entry at dn=%s, looking for %s\n", dn, type)); - if ( smbldap_get_single_attribute(ldap_state.smbldap_state->ldap_struct, entry, type, id_str) ) - { + if ( smbldap_get_single_attribute(ldap_state.smbldap_state->ldap_struct, entry, type, id_str) ) { if ( (*id_type & ID_USERID) ) id->uid = strtoul(id_str, NULL, 10); else @@ -682,8 +679,7 @@ out: free_attr_list( attr_list ); if (result) ldap_msgfree(result); - if (dn) - ldap_memfree(dn); + SAFE_FREE(dn); return ret; } @@ -864,7 +860,9 @@ static NTSTATUS ldap_set_mapping(const DOM_SID *sid, unid_t id, int id_type) if (count == 1) { entry = ldap_first_entry(ldap_state.smbldap_state->ldap_struct, result); - dn = ldap_get_dn(ldap_state.smbldap_state->ldap_struct, result); + dn = smbldap_get_dn(ldap_state.smbldap_state->ldap_struct, result); + if (!dn) + goto out; DEBUG(10, ("Found partial mapping entry at dn=%s, looking for %s\n", dn, type)); ret = ldap_set_mapping_internals(sid, id, id_type, dn, entry); @@ -880,8 +878,7 @@ static NTSTATUS ldap_set_mapping(const DOM_SID *sid, unid_t id, int id_type) out: if (result) ldap_msgfree(result); - if (dn) - ldap_memfree(dn); + SAFE_FREE(dn); return ret; } @@ -945,6 +942,7 @@ static NTSTATUS verify_idpool( void ) /***************************************************************************** Initialise idmap database. *****************************************************************************/ + static NTSTATUS ldap_idmap_init( char *params ) { NTSTATUS nt_status; -- cgit From 5b5ed5a6dcc07b979f4386636a5430bfac39ad2a Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 15 Sep 2003 05:30:52 +0000 Subject: Merge from Samba 3.0: >remove getpwnam() calls from init_sam_from_xxx(). >This means that %u & %g will no longer expand, but %U >and %G still do. The payback is that winbindd local >accounts for users work with 'wbinfo -u' when winbind >is running on a PDC. (This used to be commit f047e24561688c697179b14549b1800e00b2a435) --- source3/passdb/passdb.c | 37 ++++++++----------------------------- 1 file changed, 8 insertions(+), 29 deletions(-) diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c index 76745be3f0..1dadee8a49 100644 --- a/source3/passdb/passdb.c +++ b/source3/passdb/passdb.c @@ -1311,9 +1311,6 @@ BOOL init_sam_from_buffer(SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen) uint32 len = 0; uint32 lm_pw_len, nt_pw_len, hourslen; BOOL ret = True; - uid_t uid = -1; - gid_t gid = -1; - struct passwd *pw = NULL; if(sampass == NULL || buf == NULL) { DEBUG(0, ("init_sam_from_buffer: NULL parameters found!\n")); @@ -1369,55 +1366,37 @@ BOOL init_sam_from_buffer(SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen) pdb_set_nt_username(sampass, nt_username, PDB_SET); pdb_set_fullname(sampass, fullname, PDB_SET); - - if ( (pw=Get_Pwnam(username)) != NULL ) { - uid = pw->pw_uid; - gid = pw->pw_gid; - } - if (homedir) { pdb_set_homedir(sampass, homedir, PDB_SET); } else { pdb_set_homedir(sampass, - talloc_sub_specified(sampass->mem_ctx, - lp_logon_home(), - username, domain, - uid, gid), - PDB_DEFAULT); + talloc_sub_basic(sampass->mem_ctx, username, lp_logon_home()), + PDB_DEFAULT); } if (dir_drive) pdb_set_dir_drive(sampass, dir_drive, PDB_SET); else { pdb_set_dir_drive(sampass, - talloc_sub_specified(sampass->mem_ctx, - lp_logon_drive(), - username, domain, - uid, gid), - PDB_DEFAULT); + talloc_sub_basic(sampass->mem_ctx, username, lp_logon_drive()), + PDB_DEFAULT); } if (logon_script) pdb_set_logon_script(sampass, logon_script, PDB_SET); else { pdb_set_logon_script(sampass, - talloc_sub_specified(sampass->mem_ctx, - lp_logon_script(), - username, domain, - uid, gid), - PDB_DEFAULT); + talloc_sub_basic(sampass->mem_ctx, username, lp_logon_script()), + PDB_DEFAULT); } if (profile_path) { pdb_set_profile_path(sampass, profile_path, PDB_SET); } else { pdb_set_profile_path(sampass, - talloc_sub_specified(sampass->mem_ctx, - lp_logon_path(), - username, domain, - uid, gid), - PDB_DEFAULT); + talloc_sub_basic(sampass->mem_ctx, username, lp_logon_path()), + PDB_DEFAULT); } pdb_set_acct_desc(sampass, acct_desc, PDB_SET); -- cgit From ca3d5310ce1ae62a8d169b68416096fca67a5f62 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 15 Sep 2003 05:33:34 +0000 Subject: Merge from Samba 3.0: >remove getpwnam() calls from init_sam_from_xxx(). >This means that %u & %g will no longer expand, but %U >and %G still do. The payback is that winbindd local >accounts for users work with 'wbinfo -u' when winbind >is running on a PDC. >Fix a nasty mess, and also bug #296. passdb/pdb_ldap.c was not converting >to/from utf8 for some calls. The libads code gets this right. Wonder why >the passdb code doesn't use it ? >Jeremy. (This used to be commit 1e60bbff70efe3b5c306bc1ef560ee8032b1a852) --- source3/passdb/pdb_ldap.c | 493 +++++++++++++++++++++------------------------- 1 file changed, 226 insertions(+), 267 deletions(-) diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c index 009425c5f6..e00631fb7d 100644 --- a/source3/passdb/pdb_ldap.c +++ b/source3/passdb/pdb_ldap.c @@ -99,7 +99,7 @@ struct ldapsam_privates { }; /********************************************************************** - Free a LDAPMessage (one is stored on the SAM_ACCOUNT) + Free a LDAPMessage (one is stored on the SAM_ACCOUNT). **********************************************************************/ static void private_data_free_fn(void **result) @@ -109,13 +109,12 @@ static void private_data_free_fn(void **result) } /********************************************************************** - get the attribute name given a user schame version + Get the attribute name given a user schame version. **********************************************************************/ static const char* get_userattr_key2string( int schema_ver, int key ) { - switch ( schema_ver ) - { + switch ( schema_ver ) { case SCHEMAVER_SAMBAACCOUNT: return get_attr_key2string( attrib_map_v22, key ); @@ -130,13 +129,12 @@ static const char* get_userattr_key2string( int schema_ver, int key ) } /********************************************************************** - return the list of attribute names given a user schema version - **********************************************************************/ + Return the list of attribute names given a user schema version. +**********************************************************************/ static char** get_userattr_list( int schema_ver ) { - switch ( schema_ver ) - { + switch ( schema_ver ) { case SCHEMAVER_SAMBAACCOUNT: return get_attr_list( attrib_map_v22 ); @@ -149,17 +147,17 @@ static char** get_userattr_list( int schema_ver ) return NULL; } + /******************************************************************* - generate the LDAP search filter for the objectclass based on the - version of the schema we are using - ******************************************************************/ + Generate the LDAP search filter for the objectclass based on the + version of the schema we are using. +******************************************************************/ static const char* get_objclass_filter( int schema_ver ) { static fstring objclass_filter; - switch( schema_ver ) - { + switch( schema_ver ) { case SCHEMAVER_SAMBAACCOUNT: fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT ); break; @@ -167,7 +165,7 @@ static const char* get_objclass_filter( int schema_ver ) fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT ); break; default: - DEBUG(0,("pdb_ldapsam: get_objclass_filter(): Invalid schema version specified!\n")); + DEBUG(0,("get_objclass_filter: Invalid schema version specified!\n")); break; } @@ -175,8 +173,9 @@ static const char* get_objclass_filter( int schema_ver ) } /******************************************************************* - run the search by name. + Run the search by name. ******************************************************************/ + static int ldapsam_search_suffix_by_name (struct ldapsam_privates *ldap_state, const char *user, LDAPMessage ** result, char **attr) @@ -208,8 +207,9 @@ static int ldapsam_search_suffix_by_name (struct ldapsam_privates *ldap_state, } /******************************************************************* - run the search by rid. + Run the search by rid. ******************************************************************/ + static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state, uint32 rid, LDAPMessage ** result, char **attr) @@ -226,8 +226,9 @@ static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state, } /******************************************************************* - run the search by SID. + Run the search by SID. ******************************************************************/ + static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state, const DOM_SID *sid, LDAPMessage ** result, char **attr) @@ -250,6 +251,7 @@ static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state, Delete complete object or objectclass and attrs from object found in search_result depending on lp_ldap_delete_dn ******************************************************************/ + static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state, LDAPMessage *result, const char *objectclass, @@ -264,22 +266,25 @@ static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state, rc = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); if (rc != 1) { - DEBUG(0, ("Entry must exist exactly once!\n")); + DEBUG(0, ("ldapsam_delete_entry: Entry must exist exactly once!\n")); return NT_STATUS_UNSUCCESSFUL; } entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); - dn = ldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry); + dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry); + if (!dn) { + return NT_STATUS_UNSUCCESSFUL; + } if (lp_ldap_delete_dn()) { NTSTATUS ret = NT_STATUS_OK; rc = smbldap_delete(ldap_state->smbldap_state, dn); if (rc != LDAP_SUCCESS) { - DEBUG(0, ("Could not delete object %s\n", dn)); + DEBUG(0, ("ldapsam_delete_entry: Could not delete object %s\n", dn)); ret = NT_STATUS_UNSUCCESSFUL; } - ldap_memfree(dn); + SAFE_FREE(dn); return ret; } @@ -287,17 +292,15 @@ static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state, for (name = ldap_first_attribute(ldap_state->smbldap_state->ldap_struct, entry, &ptr); name != NULL; - name = ldap_next_attribute(ldap_state->smbldap_state->ldap_struct, entry, ptr)) - { + name = ldap_next_attribute(ldap_state->smbldap_state->ldap_struct, entry, ptr)) { char **attrib; /* We are only allowed to delete the attributes that really exist. */ - for (attrib = attrs; *attrib != NULL; attrib++) - { + for (attrib = attrs; *attrib != NULL; attrib++) { if (StrCaseCmp(*attrib, name) == 0) { - DEBUG(10, ("deleting attribute %s\n", name)); + DEBUG(10, ("ldapsam_delete_entry: deleting attribute %s\n", name)); smbldap_set_mod(&mods, LDAP_MOD_DELETE, name, NULL); } } @@ -319,18 +322,17 @@ static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state, ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); - DEBUG(0, ("could not delete attributes for %s, error: %s (%s)\n", + DEBUG(0, ("ldapsam_delete_entry: Could not delete attributes for %s, error: %s (%s)\n", dn, ldap_err2string(rc), ld_error?ld_error:"unknown")); SAFE_FREE(ld_error); - ldap_memfree(dn); + SAFE_FREE(dn); return NT_STATUS_UNSUCCESSFUL; } - ldap_memfree(dn); + SAFE_FREE(dn); return NT_STATUS_OK; } - /* New Interface is being implemented here */ #if 0 /* JERRY - not uesed anymore */ @@ -390,9 +392,10 @@ static BOOL get_unix_attributes (struct ldapsam_privates *ldap_state, #endif /********************************************************************** -Initialize SAM_ACCOUNT from an LDAP query -(Based on init_sam_from_buffer in pdb_tdb.c) + Initialize SAM_ACCOUNT from an LDAP query. + (Based on init_sam_from_buffer in pdb_tdb.c) *********************************************************************/ + static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, SAM_ACCOUNT * sampass, LDAPMessage * entry) @@ -422,9 +425,6 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, uint32 hours_len; uint8 hours[MAX_HOURS_LEN]; pstring temp; - struct passwd *pw = NULL; - uid_t uid = -1; - gid_t gid = -1; /* * do a little initialization @@ -453,19 +453,11 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, "uid", username)) { - DEBUG(1, ("No uid attribute found for this user!\n")); + DEBUG(1, ("init_sam_from_ldap: No uid attribute found for this user!\n")); return False; } - DEBUG(2, ("Entry found for user: %s\n", username)); - - /* I'm not going to fail here, since there are checks - higher up the cal stack to do this --jerry */ - - if ( (pw=Get_Pwnam(username)) != NULL ) { - uid = pw->pw_uid; - gid = pw->pw_gid; - } + DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username)); pstrcpy(nt_username, username); @@ -478,38 +470,27 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, /* deal with different attributes between the schema first */ - if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) - { + if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) { if (smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), temp)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), temp)) { pdb_set_user_sid_from_string(sampass, temp, PDB_SET); } if (smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_SID), temp)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_SID), temp)) { pdb_set_group_sid_from_string(sampass, temp, PDB_SET); - } - else - { + } else { pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT); } - - - } - else - { + } else { if (smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), temp)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), temp)) { user_rid = (uint32)atol(temp); pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET); } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_RID), temp)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_RID), temp)) { pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT); } else { uint32 group_rid; @@ -527,7 +508,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } if (pdb_get_init_flags(sampass,PDB_USERSID) == PDB_DEFAULT) { - DEBUG(1, ("no %s or %s attribute found for this user %s\n", + DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n", get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), username)); @@ -557,8 +538,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, #endif if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), temp)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), temp)) { /* leave as default */ } else { pass_last_set_time = (time_t) atol(temp); @@ -566,8 +546,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp)) { /* leave as default */ } else { logon_time = (time_t) atol(temp); @@ -575,8 +554,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp)) { /* leave as default */ } else { logoff_time = (time_t) atol(temp); @@ -584,8 +562,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp)) { /* leave as default */ } else { kickoff_time = (time_t) atol(temp); @@ -593,8 +570,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp)) { /* leave as default */ } else { pass_can_change_time = (time_t) atol(temp); @@ -602,8 +578,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp)) { /* leave as default */ } else { pass_must_change_time = (time_t) atol(temp); @@ -617,11 +592,9 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, */ if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME), fullname)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME), fullname)) { if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_CN), fullname)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_CN), fullname)) { /* leave as default */ } else { pdb_set_fullname(sampass, fullname, PDB_SET); @@ -631,49 +604,41 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE), dir_drive)) + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE), dir_drive)) { - pdb_set_dir_drive(sampass, talloc_sub_specified(sampass->mem_ctx, - lp_logon_drive(), - username, domain, - uid, gid), - PDB_DEFAULT); + pdb_set_dir_drive( sampass, + talloc_sub_basic(sampass->mem_ctx, username, lp_logon_drive()), + PDB_DEFAULT ); } else { pdb_set_dir_drive(sampass, dir_drive, PDB_SET); } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH), homedir)) + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH), homedir)) { - pdb_set_homedir(sampass, talloc_sub_specified(sampass->mem_ctx, - lp_logon_home(), - username, domain, - uid, gid), - PDB_DEFAULT); + pdb_set_homedir( sampass, + talloc_sub_basic(sampass->mem_ctx, username, lp_logon_home()), + PDB_DEFAULT ); } else { pdb_set_homedir(sampass, homedir, PDB_SET); } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT), logon_script)) + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT), logon_script)) { - pdb_set_logon_script(sampass, talloc_sub_specified(sampass->mem_ctx, - lp_logon_script(), - username, domain, - uid, gid), - PDB_DEFAULT); + pdb_set_logon_script( sampass, + talloc_sub_basic(sampass->mem_ctx, username, lp_logon_script()), + PDB_DEFAULT ); } else { pdb_set_logon_script(sampass, logon_script, PDB_SET); } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH), profile_path)) + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH), profile_path)) { - pdb_set_profile_path(sampass, talloc_sub_specified(sampass->mem_ctx, - lp_logon_path(), - username, domain, - uid, gid), - PDB_DEFAULT); + pdb_set_profile_path( sampass, + talloc_sub_basic( sampass->mem_ctx, username, lp_logon_path()), + PDB_DEFAULT ); } else { pdb_set_profile_path(sampass, profile_path, PDB_SET); } @@ -687,8 +652,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS), workstations)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS), workstations)) { /* leave as default */; } else { pdb_set_workstations(sampass, workstations, PDB_SET); @@ -701,8 +665,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, memset(hours, 0xff, hours_len); if (!smbldap_get_single_attribute (ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), temp)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), temp)) { /* leave as default */ } else { pdb_gethexpwd(temp, smblmpwd); @@ -713,8 +676,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } if (!smbldap_get_single_attribute (ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), temp)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), temp)) { /* leave as default */ } else { pdb_gethexpwd(temp, smbntpwd); @@ -725,8 +687,7 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } if (!smbldap_get_single_attribute (ldap_state->smbldap_state->ldap_struct, entry, - get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO), temp)) - { + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO), temp)) { acct_ctrl |= ACB_NORMAL; } else { acct_ctrl = pdb_decode_acct_ctrl(temp); @@ -752,9 +713,10 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, } /********************************************************************** -Initialize SAM_ACCOUNT from an LDAP query -(Based on init_buffer_from_sam in pdb_tdb.c) + Initialize SAM_ACCOUNT from an LDAP query. + (Based on init_buffer_from_sam in pdb_tdb.c) *********************************************************************/ + static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, LDAPMessage *existing, LDAPMod *** mods, SAM_ACCOUNT * sampass, @@ -779,20 +741,18 @@ static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods, "uid", pdb_get_username(sampass)); - DEBUG(2, ("Setting entry for user: %s\n", pdb_get_username(sampass))); + DEBUG(2, ("init_ldap_from_sam: Setting entry for user: %s\n", pdb_get_username(sampass))); /* only update the RID if we actually need to */ - if (need_update(sampass, PDB_USERSID)) - { + if (need_update(sampass, PDB_USERSID)) { fstring sid_string; fstring dom_sid_string; const DOM_SID *user_sid = pdb_get_user_sid(sampass); - switch ( ldap_state->schema_ver ) - { + switch ( ldap_state->schema_ver ) { case SCHEMAVER_SAMBAACCOUNT: if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) { - DEBUG(1, ("User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n", + DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n", sid_to_string(sid_string, user_sid), sid_to_string(dom_sid_string, &ldap_state->domain_sid))); return False; @@ -818,17 +778,15 @@ static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, /* we don't need to store the primary group RID - so leaving it 'free' to hang off the unix primary group makes life easier */ - if (need_update(sampass, PDB_GROUPSID)) - { + if (need_update(sampass, PDB_GROUPSID)) { fstring sid_string; fstring dom_sid_string; const DOM_SID *group_sid = pdb_get_group_sid(sampass); - switch ( ldap_state->schema_ver ) - { + switch ( ldap_state->schema_ver ) { case SCHEMAVER_SAMBAACCOUNT: if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) { - DEBUG(1, ("User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n", + DEBUG(1, ("init_ldap_from_sam: User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n", sid_to_string(sid_string, group_sid), sid_to_string(dom_sid_string, &ldap_state->domain_sid))); return False; @@ -922,8 +880,7 @@ static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp); if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) - || (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY)) - { + || (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY)) { pdb_sethexpwd(temp, pdb_get_lanman_passwd(sampass), pdb_get_acct_ctrl(sampass)); @@ -958,11 +915,10 @@ static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state, return True; } - - /********************************************************************** -Connect to LDAP server for password enumeration + Connect to LDAP server for password enumeration. *********************************************************************/ + static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, BOOL update) { struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; @@ -980,8 +936,8 @@ static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, BOOL update) free_attr_list( attr_list ); if (rc != LDAP_SUCCESS) { - DEBUG(0, ("LDAP search failed: %s\n", ldap_err2string(rc))); - DEBUG(3, ("Query was: %s, %s\n", lp_ldap_suffix(), filter)); + DEBUG(0, ("ldapsam_setsampwent: LDAP search failed: %s\n", ldap_err2string(rc))); + DEBUG(3, ("ldapsam_setsampwent: Query was: %s, %s\n", lp_ldap_suffix(), filter)); ldap_msgfree(ldap_state->result); ldap_state->result = NULL; return NT_STATUS_UNSUCCESSFUL; @@ -999,8 +955,9 @@ static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, BOOL update) } /********************************************************************** -End enumeration of the LDAP password list + End enumeration of the LDAP password list. *********************************************************************/ + static void ldapsam_endsampwent(struct pdb_methods *my_methods) { struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; @@ -1011,8 +968,9 @@ static void ldapsam_endsampwent(struct pdb_methods *my_methods) } /********************************************************************** -Get the next entry in the LDAP password database +Get the next entry in the LDAP password database. *********************************************************************/ + static NTSTATUS ldapsam_getsampwent(struct pdb_methods *my_methods, SAM_ACCOUNT *user) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; @@ -1034,8 +992,9 @@ static NTSTATUS ldapsam_getsampwent(struct pdb_methods *my_methods, SAM_ACCOUNT } /********************************************************************** -Get SAM_ACCOUNT entry from LDAP by username +Get SAM_ACCOUNT entry from LDAP by username. *********************************************************************/ + static NTSTATUS ldapsam_getsampwnam(struct pdb_methods *my_methods, SAM_ACCOUNT *user, const char *sname) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; @@ -1056,15 +1015,11 @@ static NTSTATUS ldapsam_getsampwnam(struct pdb_methods *my_methods, SAM_ACCOUNT count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); if (count < 1) { - DEBUG(4, - ("Unable to locate user [%s] count=%d\n", sname, - count)); + DEBUG(4, ("ldapsam_getsampwnam: Unable to locate user [%s] count=%d\n", sname, count)); ldap_msgfree(result); return NT_STATUS_NO_SUCH_USER; } else if (count > 1) { - DEBUG(1, - ("Duplicate entries for this user [%s] Failing. count=%d\n", sname, - count)); + DEBUG(1, ("ldapsam_getsampwnam: Duplicate entries for this user [%s] Failing. count=%d\n", sname, count)); ldap_msgfree(result); return NT_STATUS_NO_SUCH_USER; } @@ -1093,8 +1048,7 @@ static int ldapsam_get_ldap_user_by_sid(struct ldapsam_privates *ldap_state, char ** attr_list; uint32 rid; - switch ( ldap_state->schema_ver ) - { + switch ( ldap_state->schema_ver ) { case SCHEMAVER_SAMBASAMACCOUNT: attr_list = get_userattr_list(ldap_state->schema_ver); rc = ldapsam_search_suffix_by_sid(ldap_state, sid, result, attr_list); @@ -1121,8 +1075,9 @@ static int ldapsam_get_ldap_user_by_sid(struct ldapsam_privates *ldap_state, } /********************************************************************** -Get SAM_ACCOUNT entry from LDAP by SID + Get SAM_ACCOUNT entry from LDAP by SID. *********************************************************************/ + static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUNT * user, const DOM_SID *sid) { struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; @@ -1139,26 +1094,20 @@ static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUNT count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); - if (count < 1) - { - DEBUG(4, - ("Unable to locate SID [%s] count=%d\n", sid_to_string(sid_string, sid), + if (count < 1) { + DEBUG(4, ("ldapsam_getsampwsid: Unable to locate SID [%s] count=%d\n", sid_to_string(sid_string, sid), count)); ldap_msgfree(result); return NT_STATUS_NO_SUCH_USER; - } - else if (count > 1) - { - DEBUG(1, - ("More than one user with SID [%s]. Failing. count=%d\n", sid_to_string(sid_string, sid), + } else if (count > 1) { + DEBUG(1, ("ldapsam_getsampwsid: More than one user with SID [%s]. Failing. count=%d\n", sid_to_string(sid_string, sid), count)); ldap_msgfree(result); return NT_STATUS_NO_SUCH_USER; } entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); - if (!entry) - { + if (!entry) { ldap_msgfree(result); return NT_STATUS_NO_SUCH_USER; } @@ -1176,15 +1125,14 @@ static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUNT } /******************************************************************** -Do the actual modification - also change a plaintext passord if -it it set. + Do the actual modification - also change a plaintext passord if + it it set. **********************************************************************/ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, SAM_ACCOUNT *newpwd, char *dn, LDAPMod **mods, int ldap_op, - BOOL (*need_update)(const SAM_ACCOUNT *, - enum pdb_elements)) + BOOL (*need_update)(const SAM_ACCOUNT *, enum pdb_elements)) { struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; int rc; @@ -1194,11 +1142,10 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, } if (!mods) { - DEBUG(5,("mods is empty: nothing to modify\n")); + DEBUG(5,("ldapsam_modify_entry: mods is empty: nothing to modify\n")); /* may be password change below however */ } else { - switch(ldap_op) - { + switch(ldap_op) { case LDAP_MOD_ADD: smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", @@ -1211,7 +1158,7 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, dn ,mods); break; default: - DEBUG(0,("Wrong LDAP operation type: %d!\n", + DEBUG(0,("ldapsam_modify_entry: Wrong LDAP operation type: %d!\n", ldap_op)); return NT_STATUS_INVALID_PARAMETER; } @@ -1220,8 +1167,7 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, char *ld_error = NULL; ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); - DEBUG(1, - ("failed to %s user dn= %s with: %s\n\t%s\n", + DEBUG(1, ("ldapsam_modify_entry: Failed to %s user dn= %s with: %s\n\t%s\n", ldap_op == LDAP_MOD_ADD ? "add" : "modify", dn, ldap_err2string(rc), ld_error?ld_error:"unknown")); @@ -1231,9 +1177,9 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, } if (!(pdb_get_acct_ctrl(newpwd)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) && - (lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_OFF) && - need_update(newpwd, PDB_PLAINTEXT_PW) && - (pdb_get_plaintext_passwd(newpwd)!=NULL)) { + (lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_OFF) && + need_update(newpwd, PDB_PLAINTEXT_PW) && + (pdb_get_plaintext_passwd(newpwd)!=NULL)) { BerElement *ber; struct berval *bv; char *retoid; @@ -1261,7 +1207,7 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, ber_printf (ber, "N}"); if ((rc = ber_flatten (ber, &bv))<0) { - DEBUG(0,("ber_flatten returns a value <0\n")); + DEBUG(0,("ldapsam_modify_entry: ber_flatten returns a value <0\n")); ber_free(ber,1); SAFE_FREE(utf8_dn); SAFE_FREE(utf8_password); @@ -1276,12 +1222,12 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, LDAP_EXOP_MODIFY_PASSWD, bv, NULL, NULL, &retoid, &retdata)) != LDAP_SUCCESS) { - DEBUG(0,("LDAP Password could not be changed for user %s: %s\n", + DEBUG(0,("ldapsam_modify_entry: LDAP Password could not be changed for user %s: %s\n", pdb_get_username(newpwd),ldap_err2string(rc))); } else { - DEBUG(3,("LDAP Password changed for user %s\n",pdb_get_username(newpwd))); + DEBUG(3,("ldapsam_modify_entry: LDAP Password changed for user %s\n",pdb_get_username(newpwd))); #ifdef DEBUG_PASSWORD - DEBUG(100,("LDAP Password changed to %s\n",pdb_get_plaintext_passwd(newpwd))); + DEBUG(100,("ldapsam_modify_entry: LDAP Password changed to %s\n",pdb_get_plaintext_passwd(newpwd))); #endif ber_bvfree(retdata); ber_memfree(retoid); @@ -1292,8 +1238,9 @@ static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods, } /********************************************************************** -Delete entry from LDAP for username + Delete entry from LDAP for username. *********************************************************************/ + static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * sam_acct) { struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; @@ -1305,13 +1252,13 @@ static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods, SAM_A fstring objclass; if (!sam_acct) { - DEBUG(0, ("sam_acct was NULL!\n")); + DEBUG(0, ("ldapsam_delete_sam_account: sam_acct was NULL!\n")); return NT_STATUS_INVALID_PARAMETER; } sname = pdb_get_username(sam_acct); - DEBUG (3, ("Deleting user %s from LDAP.\n", sname)); + DEBUG (3, ("ldapsam_delete_sam_account: Deleting user %s from LDAP.\n", sname)); attr_list= get_userattr_list( ldap_state->schema_ver ); rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result, attr_list); @@ -1321,8 +1268,7 @@ static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods, SAM_A return NT_STATUS_NO_SUCH_USER; } - switch ( ldap_state->schema_ver ) - { + switch ( ldap_state->schema_ver ) { case SCHEMAVER_SAMBASAMACCOUNT: fstrcpy( objclass, LDAP_OBJ_SAMBASAMACCOUNT ); break; @@ -1344,9 +1290,10 @@ static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods, SAM_A } /********************************************************************** - Helper function to determine for update_sam_account whether - we need LDAP modification. + Helper function to determine for update_sam_account whether + we need LDAP modification. *********************************************************************/ + static BOOL element_is_changed(const SAM_ACCOUNT *sampass, enum pdb_elements element) { @@ -1354,13 +1301,14 @@ static BOOL element_is_changed(const SAM_ACCOUNT *sampass, } /********************************************************************** -Update SAM_ACCOUNT + Update SAM_ACCOUNT. *********************************************************************/ + static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * newpwd) { NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data; - int rc; + int rc = 0; char *dn; LDAPMessage *result; LDAPMessage *entry; @@ -1379,53 +1327,57 @@ static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, SAM_A } if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) { - DEBUG(0, ("No user to modify!\n")); + DEBUG(0, ("ldapsam_update_sam_account: No user to modify!\n")); return NT_STATUS_UNSUCCESSFUL; } entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); - dn = ldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry); + dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry); + if (!dn) { + return NT_STATUS_UNSUCCESSFUL; + } - DEBUG(4, ("user %s to be modified has dn: %s\n", pdb_get_username(newpwd), dn)); + DEBUG(4, ("ldapsam_update_sam_account: user %s to be modified has dn: %s\n", pdb_get_username(newpwd), dn)); if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd, element_is_changed)) { DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n")); - ldap_memfree(dn); + SAFE_FREE(dn); return NT_STATUS_UNSUCCESSFUL; } if (mods == NULL) { - DEBUG(4,("mods is empty: nothing to update for user: %s\n", + DEBUG(4,("ldapsam_update_sam_account: mods is empty: nothing to update for user: %s\n", pdb_get_username(newpwd))); ldap_mods_free(mods, True); - ldap_memfree(dn); + SAFE_FREE(dn); return NT_STATUS_OK; } ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, element_is_changed); ldap_mods_free(mods,True); - ldap_memfree(dn); + SAFE_FREE(dn); if (!NT_STATUS_IS_OK(ret)) { char *ld_error = NULL; ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); - DEBUG(0,("failed to modify user with uid = %s, error: %s (%s)\n", + DEBUG(0,("ldapsam_update_sam_account: failed to modify user with uid = %s, error: %s (%s)\n", pdb_get_username(newpwd), ld_error?ld_error:"(unknwon)", ldap_err2string(rc))); SAFE_FREE(ld_error); return ret; } - DEBUG(2, ("successfully modified uid = %s in the LDAP database\n", + DEBUG(2, ("ldapsam_update_sam_account: successfully modified uid = %s in the LDAP database\n", pdb_get_username(newpwd))); return NT_STATUS_OK; } /********************************************************************** - Helper function to determine for update_sam_account whether - we need LDAP modification. + Helper function to determine for update_sam_account whether + we need LDAP modification. *********************************************************************/ + static BOOL element_is_set_or_changed(const SAM_ACCOUNT *sampass, enum pdb_elements element) { @@ -1434,7 +1386,7 @@ static BOOL element_is_set_or_changed(const SAM_ACCOUNT *sampass, } /********************************************************************** -Add SAM_ACCOUNT to LDAP + Add SAM_ACCOUNT to LDAP. *********************************************************************/ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * newpwd) @@ -1446,7 +1398,7 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO LDAPMessage *entry = NULL; pstring dn; LDAPMod **mods = NULL; - int ldap_op; + int ldap_op = LDAP_MOD_REPLACE; uint32 num_result; char **attr_list; char *escape_user; @@ -1456,7 +1408,7 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO fstring sid_string; if (!username || !*username) { - DEBUG(0, ("Cannot add user without a username!\n")); + DEBUG(0, ("ldapsam_add_sam_account: Cannot add user without a username!\n")); return NT_STATUS_INVALID_PARAMETER; } @@ -1471,7 +1423,7 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO } if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) { - DEBUG(0,("User '%s' already in the base, with samba attributes\n", + DEBUG(0,("ldapsam_add_sam_account: User '%s' already in the base, with samba attributes\n", username)); ldap_msgfree(result); free_attr_list( attr_list ); @@ -1485,7 +1437,7 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO sid, &result); if (rc == LDAP_SUCCESS) { if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) { - DEBUG(0,("SID '%s' already in the base, with samba attributes\n", + DEBUG(0,("ldapsam_add_sam_account: SID '%s' already in the base, with samba attributes\n", sid_to_string(sid_string, sid))); free_attr_list( attr_list ); return NT_STATUS_UNSUCCESSFUL; @@ -1512,7 +1464,7 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); if (num_result > 1) { - DEBUG (0, ("More than one user with that uid exists: bailing out!\n")); + DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n")); free_attr_list( attr_list ); ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; @@ -1522,12 +1474,17 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO if (num_result == 1) { char *tmp; - DEBUG(3,("User exists without samba attributes: adding them\n")); + DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n")); ldap_op = LDAP_MOD_REPLACE; entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result); - tmp = ldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry); + tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry); + if (!tmp) { + free_attr_list( attr_list ); + ldap_msgfree(result); + return NT_STATUS_UNSUCCESSFUL; + } slprintf (dn, sizeof (dn) - 1, "%s", tmp); - ldap_memfree (tmp); + SAFE_FREE(tmp); } else if (ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT) { @@ -1550,7 +1507,7 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); if (num_result > 1) { - DEBUG (0, ("More than one user with that uid exists: bailing out!\n")); + DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n")); free_attr_list( attr_list ); ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; @@ -1560,12 +1517,17 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO if (num_result == 1) { char *tmp; - DEBUG(3,("User exists without samba attributes: adding them\n")); + DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n")); ldap_op = LDAP_MOD_REPLACE; entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result); - tmp = ldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry); + tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry); + if (!tmp) { + free_attr_list( attr_list ); + ldap_msgfree(result); + return NT_STATUS_UNSUCCESSFUL; + } slprintf (dn, sizeof (dn) - 1, "%s", tmp); - ldap_memfree (tmp); + SAFE_FREE(tmp); } } @@ -1573,7 +1535,7 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO if (num_result == 0) { /* Check if we need to add an entry */ - DEBUG(3,("Adding new user\n")); + DEBUG(3,("ldapsam_add_sam_account: Adding new user\n")); ldap_op = LDAP_MOD_ADD; if (username[strlen(username)-1] == '$') { slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_machine_suffix ()); @@ -1592,11 +1554,10 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO ldap_msgfree(result); if (mods == NULL) { - DEBUG(0,("mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd))); + DEBUG(0,("ldapsam_add_sam_account: mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd))); return NT_STATUS_UNSUCCESSFUL; } - switch ( ldap_state->schema_ver ) - { + switch ( ldap_state->schema_ver ) { case SCHEMAVER_SAMBAACCOUNT: smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBAACCOUNT); break; @@ -1610,13 +1571,13 @@ static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCO ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, element_is_set_or_changed); if (!NT_STATUS_IS_OK(ret)) { - DEBUG(0,("failed to modify/add user with uid = %s (dn = %s)\n", + DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n", pdb_get_username(newpwd),dn)); ldap_mods_free(mods, True); return ret; } - DEBUG(2,("added: uid == %s in the LDAP database\n", pdb_get_username(newpwd))); + DEBUG(2,("ldapsam_add_sam_account: added: uid == %s in the LDAP database\n", pdb_get_username(newpwd))); ldap_mods_free(mods, True); return NT_STATUS_OK; @@ -1666,64 +1627,58 @@ static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, pstring temp; if (ldap_state == NULL || map == NULL || entry == NULL || - ldap_state->smbldap_state->ldap_struct == NULL) - { + ldap_state->smbldap_state->ldap_struct == NULL) { DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n")); return False; } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER), temp)) - { - DEBUG(0, ("Mandatory attribute %s not found\n", + get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER), temp)) { + DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n", get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GIDNUMBER))); return False; } - DEBUG(2, ("Entry found for group: %s\n", temp)); + DEBUG(2, ("init_group_from_ldap: Entry found for group: %s\n", temp)); map->gid = (gid_t)atol(temp); if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID), temp)) - { - DEBUG(0, ("Mandatory attribute %s not found\n", + get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID), temp)) { + DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n", get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID))); return False; } string_to_sid(&map->sid, temp); if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), temp)) - { - DEBUG(0, ("Mandatory attribute %s not found\n", + get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), temp)) { + DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n", get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE))); return False; } map->sid_name_use = (enum SID_NAME_USE)atol(temp); if ((map->sid_name_use < SID_NAME_USER) || - (map->sid_name_use > SID_NAME_UNKNOWN)) { - DEBUG(0, ("Unknown Group type: %d\n", map->sid_name_use)); + (map->sid_name_use > SID_NAME_UNKNOWN)) { + DEBUG(0, ("init_group_from_ldap: Unknown Group type: %d\n", map->sid_name_use)); return False; } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), temp)) - { + get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), temp)) { temp[0] = '\0'; if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_attr_key2string( groupmap_attr_list, LDAP_ATTR_CN), temp)) { - DEBUG(0, ("Attributes cn not found either " - "for gidNumber(%lu)\n",(unsigned long)map->gid)); + DEBUG(0, ("init_group_from_ldap: Attributes cn not found either \ +for gidNumber(%lu)\n",(unsigned long)map->gid)); return False; } } fstrcpy(map->nt_name, temp); if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, - get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), temp)) - { + get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), temp)) { temp[0] = '\0'; } fstrcpy(map->comment, temp); @@ -1784,13 +1739,13 @@ static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods, count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result); if (count < 1) { - DEBUG(4, ("Did not find group\n")); + DEBUG(4, ("ldapsam_getgroup: Did not find group\n")); ldap_msgfree(result); return NT_STATUS_NO_SUCH_GROUP; } if (count > 1) { - DEBUG(1, ("Duplicate entries for filter %s: count=%d\n", + DEBUG(1, ("ldapsam_getgroup: Duplicate entries for filter %s: count=%d\n", filter, count)); ldap_msgfree(result); return NT_STATUS_NO_SUCH_GROUP; @@ -1804,7 +1759,7 @@ static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods, } if (!init_group_from_ldap(ldap_state, map, entry)) { - DEBUG(1, ("init_group_from_ldap failed for group filter %s\n", + DEBUG(1, ("ldapsam_getgroup: init_group_from_ldap failed for group filter %s\n", filter)); ldap_msgfree(result); return NT_STATUS_NO_SUCH_GROUP; @@ -1908,7 +1863,7 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, if (NT_STATUS_IS_OK(ldapsam_getgrgid(methods, &dummy, map->gid))) { - DEBUG(0, ("Group %ld already exists in LDAP\n", (unsigned long)map->gid)); + DEBUG(0, ("ldapsam_add_group_mapping_entry: Group %ld already exists in LDAP\n", (unsigned long)map->gid)); return NT_STATUS_UNSUCCESSFUL; } @@ -1926,20 +1881,24 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, } if (count > 1) { - DEBUG(2, ("Group %lu must exist exactly once in LDAP\n", + DEBUG(2, ("ldapsam_add_group_mapping_entry: Group %lu must exist exactly once in LDAP\n", (unsigned long)map->gid)); ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; } entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); - tmp = ldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry); + tmp = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry); + if (!tmp) { + ldap_msgfree(result); + return NT_STATUS_UNSUCCESSFUL; + } pstrcpy(dn, tmp); - ldap_memfree(tmp); + SAFE_FREE(tmp); if (!init_ldap_from_group(ldap_state->smbldap_state->ldap_struct, result, &mods, map)) { - DEBUG(0, ("init_ldap_from_group failed!\n")); + DEBUG(0, ("ldapsam_add_group_mapping_entry: init_ldap_from_group failed!\n")); ldap_mods_free(mods, True); ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; @@ -1948,7 +1907,7 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, ldap_msgfree(result); if (mods == NULL) { - DEBUG(0, ("mods is empty\n")); + DEBUG(0, ("ldapsam_add_group_mapping_entry: mods is empty\n")); return NT_STATUS_UNSUCCESSFUL; } @@ -1961,13 +1920,13 @@ static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods, char *ld_error = NULL; ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); - DEBUG(0, ("failed to add group %lu error: %s (%s)\n", (unsigned long)map->gid, + DEBUG(0, ("ldapsam_add_group_mapping_entry: failed to add group %lu error: %s (%s)\n", (unsigned long)map->gid, ld_error ? ld_error : "(unknown)", ldap_err2string(rc))); SAFE_FREE(ld_error); return NT_STATUS_UNSUCCESSFUL; } - DEBUG(2, ("successfully modified group %lu in LDAP\n", (unsigned long)map->gid)); + DEBUG(2, ("ldapsam_add_group_mapping_entry: successfully modified group %lu in LDAP\n", (unsigned long)map->gid)); return NT_STATUS_OK; } @@ -1992,17 +1951,16 @@ static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods, } if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) { - DEBUG(0, ("No group to modify!\n")); + DEBUG(0, ("ldapsam_update_group_mapping_entry: No group to modify!\n")); ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; } entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); - dn = ldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry); if (!init_ldap_from_group(ldap_state->smbldap_state->ldap_struct, result, &mods, map)) { - DEBUG(0, ("init_ldap_from_group failed\n")); + DEBUG(0, ("ldapsam_update_group_mapping_entry: init_ldap_from_group failed\n")); ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; } @@ -2010,11 +1968,16 @@ static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods, ldap_msgfree(result); if (mods == NULL) { - DEBUG(4, ("mods is empty: nothing to do\n")); + DEBUG(4, ("ldapsam_update_group_mapping_entry: mods is empty: nothing to do\n")); return NT_STATUS_UNSUCCESSFUL; } + dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry); + if (!dn) { + return NT_STATUS_UNSUCCESSFUL; + } rc = smbldap_modify(ldap_state->smbldap_state, dn, mods); + SAFE_FREE(dn); ldap_mods_free(mods, True); @@ -2022,12 +1985,12 @@ static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods, char *ld_error = NULL; ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error); - DEBUG(0, ("failed to modify group %lu error: %s (%s)\n", (unsigned long)map->gid, + DEBUG(0, ("ldapsam_update_group_mapping_entry: failed to modify group %lu error: %s (%s)\n", (unsigned long)map->gid, ld_error ? ld_error : "(unknown)", ldap_err2string(rc))); SAFE_FREE(ld_error); } - DEBUG(2, ("successfully modified group %lu in LDAP\n", (unsigned long)map->gid)); + DEBUG(2, ("ldapsam_update_group_mapping_entry: successfully modified group %lu in LDAP\n", (unsigned long)map->gid)); return NT_STATUS_OK; } @@ -2082,8 +2045,8 @@ static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods, BOOL update) free_attr_list( attr_list ); if (rc != LDAP_SUCCESS) { - DEBUG(0, ("LDAP search failed: %s\n", ldap_err2string(rc))); - DEBUG(3, ("Query was: %s, %s\n", lp_ldap_group_suffix(), filter)); + DEBUG(0, ("ldapsam_setsamgrent: LDAP search failed: %s\n", ldap_err2string(rc))); + DEBUG(3, ("ldapsam_setsamgrent: Query was: %s, %s\n", lp_ldap_group_suffix(), filter)); ldap_msgfree(ldap_state->result); ldap_state->result = NULL; return NT_STATUS_UNSUCCESSFUL; @@ -2147,24 +2110,24 @@ static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods, *rmap = NULL; if (!NT_STATUS_IS_OK(ldapsam_setsamgrent(methods, False))) { - DEBUG(0, ("Unable to open passdb\n")); + DEBUG(0, ("ldapsam_enum_group_mapping: Unable to open passdb\n")); return NT_STATUS_ACCESS_DENIED; } while (NT_STATUS_IS_OK(ldapsam_getsamgrent(methods, &map))) { if (sid_name_use != SID_NAME_UNKNOWN && sid_name_use != map.sid_name_use) { - DEBUG(11,("enum_group_mapping: group %s is not of the requested type\n", map.nt_name)); + DEBUG(11,("ldapsam_enum_group_mapping: group %s is not of the requested type\n", map.nt_name)); continue; } if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) { - DEBUG(11,("enum_group_mapping: group %s is non mapped\n", map.nt_name)); + DEBUG(11,("ldapsam_enum_group_mapping: group %s is non mapped\n", map.nt_name)); continue; } mapt=(GROUP_MAP *)Realloc((*rmap), (entries+1)*sizeof(GROUP_MAP)); if (!mapt) { - DEBUG(0,("enum_group_mapping: Unable to enlarge group map!\n")); + DEBUG(0,("ldapsam_enum_group_mapping: Unable to enlarge group map!\n")); SAFE_FREE(*rmap); return NT_STATUS_UNSUCCESSFUL; } @@ -2235,7 +2198,7 @@ static NTSTATUS pdb_init_ldapsam_common(PDB_CONTEXT *pdb_context, PDB_METHODS ** ldap_state = talloc_zero(pdb_context->mem_ctx, sizeof(*ldap_state)); if (!ldap_state) { - DEBUG(0, ("talloc() failed for ldapsam private_data!\n")); + DEBUG(0, ("pdb_init_ldapsam_common: talloc() failed for ldapsam private_data!\n")); return NT_STATUS_NO_MEMORY; } @@ -2325,9 +2288,9 @@ static NTSTATUS pdb_init_ldapsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_met ldap_state->domain_name, True); if ( !NT_STATUS_IS_OK(nt_status) ) { - DEBUG(2, ("WARNING: Could not get domain info, nor add one to the domain\n")); - DEBUGADD(2, ("Continuing on regardless, will be unable to allocate new users/groups, " - "and will risk BDCs having inconsistant SIDs\n")); + DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain info, nor add one to the domain\n")); + DEBUGADD(2, ("pdb_init_ldapsam: Continuing on regardless, will be unable to allocate new users/groups, \ +and will risk BDCs having inconsistant SIDs\n")); sid_copy(&ldap_state->domain_sid, get_global_sam_sid()); return NT_STATUS_OK; } @@ -2336,15 +2299,14 @@ static NTSTATUS pdb_init_ldapsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_met entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result); if (!entry) { - DEBUG(0, ("Could not get domain info entry\n")); + DEBUG(0, ("pdb_init_ldapsam: Could not get domain info entry\n")); ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; } if (smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), - domain_sid_string)) - { + domain_sid_string)) { BOOL found_sid; string_to_sid(&ldap_domain_sid, domain_sid_string); found_sid = secrets_fetch_domain_sid(ldap_state->domain_name, &secrets_domain_sid); @@ -2357,12 +2319,11 @@ static NTSTATUS pdb_init_ldapsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_met if (smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ALGORITHMIC_RID_BASE), - alg_rid_base_string)) - { + alg_rid_base_string)) { alg_rid_base = (uint32)atol(alg_rid_base_string); if (alg_rid_base != algorithmic_rid_base()) { - DEBUG(0, ("The value of 'algorithmic RID base' has changed since the LDAP\n" - "database was initialised. Aborting. \n")); + DEBUG(0, ("pdb_init_ldapsam: The value of 'algorithmic RID base' has changed since the LDAP\n\ +database was initialised. Aborting. \n")); ldap_msgfree(result); return NT_STATUS_UNSUCCESSFUL; } @@ -2383,5 +2344,3 @@ NTSTATUS pdb_ldap_init(void) return NT_STATUS_OK; } - - -- cgit From 240d5944e3b8e5b748465f9e974b2fab309703be Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 15 Sep 2003 05:35:02 +0000 Subject: Merge from Samba 3.0: >Fix a nasty mess, and also bug #296. passdb/pdb_ldap.c was not converting >to/from utf8 for some calls. The libads code gets this right. Wonder why >the passdb code doesn't use it ? >Jeremy. (This used to be commit 9b6328bcfd5b53a05926eb5a97c74275842d086b) --- source3/printing/nt_printing.c | 44 +++++++++++++++++++++++++++++++++++++----- 1 file changed, 39 insertions(+), 5 deletions(-) diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c index 4859d785be..868f68c079 100644 --- a/source3/printing/nt_printing.c +++ b/source3/printing/nt_printing.c @@ -2587,7 +2587,8 @@ static WERROR publish_it(NT_PRINTER_INFO_LEVEL *printer) ADS_STATUS ads_rc; TALLOC_CTX *ctx = talloc_init("publish_it"); ADS_MODLIST mods = ads_init_mods(ctx); - char *prt_dn = NULL, *srv_dn, **srv_cn; + char *prt_dn = NULL, *srv_dn, *srv_cn_0; + char *srv_dn_utf8, **srv_cn_utf8; void *res = NULL; ADS_STRUCT *ads; const char *attrs[] = {"objectGUID", NULL}; @@ -2634,12 +2635,45 @@ static WERROR publish_it(NT_PRINTER_INFO_LEVEL *printer) /* figure out where to publish */ ads_find_machine_acct(ads, &res, global_myname()); - srv_dn = ldap_get_dn(ads->ld, res); + + /* We use ldap_get_dn here as we need the answer + * in utf8 to call ldap_explode_dn(). JRA. */ + + srv_dn_utf8 = ldap_get_dn(ads->ld, res); + if (!srv_dn_utf8) { + ads_destroy(&ads); + return WERR_SERVER_UNAVAILABLE; + } ads_msgfree(ads, res); - srv_cn = ldap_explode_dn(srv_dn, 1); - asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn[0], + srv_cn_utf8 = ldap_explode_dn(srv_dn_utf8, 1); + if (!srv_cn_utf8) { + ldap_memfree(srv_dn_utf8); + ads_destroy(&ads); + return WERR_SERVER_UNAVAILABLE; + } + /* Now convert to CH_UNIX. */ + if (pull_utf8_allocate((void **) &srv_dn, srv_dn_utf8) == (size_t)-1) { + ldap_memfree(srv_dn_utf8); + ldap_memfree(srv_cn_utf8); + ads_destroy(&ads); + return WERR_SERVER_UNAVAILABLE; + } + if (pull_utf8_allocate((void **) &srv_cn_0, srv_cn_utf8[0]) == (size_t)-1) { + ldap_memfree(srv_dn_utf8); + ldap_memfree(srv_cn_utf8); + ads_destroy(&ads); + SAFE_FREE(srv_dn); + return WERR_SERVER_UNAVAILABLE; + } + + ldap_memfree(srv_dn_utf8); + ldap_memfree(srv_cn_utf8); + + asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn_0, printer->info_2->sharename, srv_dn); - ads_memfree(ads, srv_dn); + + SAFE_FREE(srv_dn); + SAFE_FREE(srv_cn_0); /* publish it */ ads_rc = ads_add_printer_entry(ads, prt_dn, ctx, &mods); -- cgit From bbc4f18f22b1ce5a247121a65e1bc1d00e585847 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Mon, 15 Sep 2003 12:59:09 +0000 Subject: Alias charset 646 internally (This used to be commit f4eb7acc7dfc400cc6524dccdd8081acd707f937) --- source3/lib/iconv.c | 1 + 1 file changed, 1 insertion(+) diff --git a/source3/lib/iconv.c b/source3/lib/iconv.c index c09bff5fd7..3d26d7e17c 100644 --- a/source3/lib/iconv.c +++ b/source3/lib/iconv.c @@ -57,6 +57,7 @@ static struct charset_functions builtin_functions[] = { {"UCS-2LE", iconv_copy, iconv_copy}, {"UTF8", utf8_pull, utf8_push}, {"ASCII", ascii_pull, ascii_push}, + {"646", ascii_pull, ascii_push}, {"UCS2-HEX", ucs2hex_pull, ucs2hex_push}, {NULL, NULL, NULL} }; -- cgit From 5f91a15a66f8c530087ec438696cf42587d3cfdb Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 15 Sep 2003 14:21:32 +0000 Subject: fix online help -w option need the password on the command line (This used to be commit 0b8f32b7f53b145fb51f5537a7f42d11d69ed4c3) --- source3/utils/smbpasswd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/utils/smbpasswd.c b/source3/utils/smbpasswd.c index 6ab6d35e73..6854842b20 100644 --- a/source3/utils/smbpasswd.c +++ b/source3/utils/smbpasswd.c @@ -63,7 +63,7 @@ static void usage(void) printf(" -i interdomain trust account\n"); printf(" -m machine trust account\n"); printf(" -n set no password\n"); - printf(" -w ldap admin password\n"); + printf(" -w PASSWORD ldap admin password\n"); printf(" -x delete user\n"); printf(" -R ORDER name resolve order\n"); -- cgit From 4fd86794ecf4249ce04a3fbb57d3524fdfaa058d Mon Sep 17 00:00:00 2001 From: "Christopher R. Hertel" Date: Mon, 15 Sep 2003 17:01:45 +0000 Subject: Fixed test and wording for long share names. The RAP NetShareEnum() call has a length limit of 12 characters (not 8, as previously tested). Took DaveCB's suggested and added a note listing some of the client systems that might be affected. (This used to be commit cdfc0fc383ab63f47ddd547fddc4c28bbfddf5e5) --- source3/utils/testparm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c index 0a87b4bc1e..34c25480d9 100644 --- a/source3/utils/testparm.c +++ b/source3/utils/testparm.c @@ -248,9 +248,10 @@ via the %%o substitution. With encrypted passwords this is not possible.\n", lp_ for (s=0;s<1000;s++) { if (VALID_SNUM(s)) - if (strlen(lp_servicename(s)) > 8) { - printf("WARNING: You have some share names that are longer than 8 chars\n"); - printf("These may give errors while browsing or may not be accessible\nto some older clients\n"); + if (strlen(lp_servicename(s)) > 12) { + printf( "WARNING: You have some share names that are longer than 12 characters.\n" ); + printf( "These may not be accessible to some older clients.\n" ); + printf( "(Eg. Windows9x, WindowsMe, and smbclient prior to Samba 3.0.)\n" ); break; } } -- cgit From f208ab8ac24efd1cf34d01d6718cf2d9aa065b13 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Mon, 15 Sep 2003 21:22:15 +0000 Subject: Ensure HEAD is also up to date. Fix OOPS when dealing with mangled names reported by several users. This was my bug when removing a redundant strlen. Jeremy. (This used to be commit 3b3e19f66f783016ca3bc2d9e76328732ed4a84b) --- source3/smbd/mangle_hash2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source3/smbd/mangle_hash2.c b/source3/smbd/mangle_hash2.c index 9cd0438d51..e0efb3e41b 100644 --- a/source3/smbd/mangle_hash2.c +++ b/source3/smbd/mangle_hash2.c @@ -53,7 +53,7 @@ #include "includes.h" -#if 0 +#if 1 #define M_DEBUG(level, x) DEBUG(level, x) #else #define M_DEBUG(level, x) @@ -219,7 +219,7 @@ static BOOL is_mangled_component(const char *name, size_t len) if (len > 8) { if (name[8] != '.') return False; - for (i=9; name[i]; i++) { + for (i=9; name[i] && i < len; i++) { if (! FLAG_CHECK(name[i], FLAG_ASCII)) { return False; } -- cgit From 77adfbf4605bddeb1211586bb4ea4b1042ddbcd5 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Mon, 15 Sep 2003 21:27:33 +0000 Subject: Fix from gregory@networksentry.co.za, don't clobber the comment if it exists. Jeremy. (This used to be commit a7ef2ce34931d9fcdeb8ecbcad981d96db4c409a) --- source3/utils/net_groupmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source3/utils/net_groupmap.c b/source3/utils/net_groupmap.c index f99876bbd8..323f4afbc3 100644 --- a/source3/utils/net_groupmap.c +++ b/source3/utils/net_groupmap.c @@ -274,10 +274,10 @@ static int net_groupmap_add(int argc, const char **argv) sid_to_string(string_sid, &sid); } - if (ntcomment[0]) + if (!ntcomment[0]) fstrcpy(ntcomment, "Local Unix group"); - if ( !ntgroup[0] ) + if (!ntgroup[0] ) fstrcpy( ntgroup, unixgrp ); -- cgit From 6df89dbe1020736f25a01b1e319e849f8db89851 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Tue, 16 Sep 2003 01:28:09 +0000 Subject: Fix #442 which Alexander considered a showstopper. Allow us to join mixed mode domains. Jeremy. (This used to be commit 07cfce283004d29d1f60e5d8c97e3e3d7c293805) --- source3/libsmb/cliconnect.c | 8 -------- source3/libsmb/ntlmssp.c | 6 ++++++ 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c index 48bcb61f92..b5f7b97ae8 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c @@ -547,14 +547,6 @@ static BOOL cli_session_setup_ntlmssp(struct cli_state *cli, const char *user, return False; } - ntlmssp_state->use_ntlmv2 = lp_client_ntlmv2_auth(); - - if (cli->sign_info.negotiated_smb_signing - || cli->sign_info.mandatory_signing) { - ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN; - ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN; - } - do { nt_status = ntlmssp_client_update(ntlmssp_state, blob_in, &blob_out); diff --git a/source3/libsmb/ntlmssp.c b/source3/libsmb/ntlmssp.c index 42bf18d1d2..c51b599b04 100644 --- a/source3/libsmb/ntlmssp.c +++ b/source3/libsmb/ntlmssp.c @@ -692,6 +692,12 @@ NTSTATUS ntlmssp_client_start(NTLMSSP_CLIENT_STATE **ntlmssp_state) NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_NTLM2 | NTLMSSP_NEGOTIATE_KEY_EXCH | + /* + * We need to set this to allow a later SetPassword + * via the SAMR pipe to succeed. Strange.... We could + * also add NTLMSSP_NEGOTIATE_SEAL here. JRA. + * */ + NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_REQUEST_TARGET; (*ntlmssp_state)->ref_count = 1; -- cgit From 582ec27a8e18d8b9bf891c0b3203afd1e1af6eac Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Tue, 16 Sep 2003 02:48:16 +0000 Subject: Merge from 3.0: >Remove quotes in smb.conf ldap example - the quotes actually turn >up in the ldap filter string. (This used to be commit 7bca3b6cc2e02569eec015ce75b0ccefefb654d6) --- docs/docbook/projdoc/passdb.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/docbook/projdoc/passdb.xml b/docs/docbook/projdoc/passdb.xml index 0ee3fa709e..75d46af33b 100644 --- a/docs/docbook/projdoc/passdb.xml +++ b/docs/docbook/projdoc/passdb.xml @@ -1031,10 +1031,10 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz ldap trust idsYes specify the base DN to use when searching the directory -ldap suffix"ou=people,dc=samba,dc=org" +ldap suffixou=people,dc=samba,dc=org generally the default ldap search filter is ok -ldap filter"(&(uid=%u)(objectclass=sambaSamAccount))" +ldap filter(&(uid=%u)(objectclass=sambaSamAccount)) -- cgit From 3050c0602a67017cd76202c36541cf22ec73486d Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Tue, 16 Sep 2003 02:48:56 +0000 Subject: Merge from 3.0: >Fix typo. (This used to be commit 914e4be8f716ec909d399f69436092adfbe4f535) --- docs/docbook/smbdotconf/ldap/ldapidmapsuffix.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/docbook/smbdotconf/ldap/ldapidmapsuffix.xml b/docs/docbook/smbdotconf/ldap/ldapidmapsuffix.xml index f826183c33..7dd86cc41b 100644 --- a/docs/docbook/smbdotconf/ldap/ldapidmapsuffix.xml +++ b/docs/docbook/smbdotconf/ldap/ldapidmapsuffix.xml @@ -10,6 +10,6 @@ Default: none - Example: dc=samba,ou=Idmap + Example: ou=Idmap,dc=samba,dc=org -- cgit From c2505ca394942a5717cb434f3a025de72ee0df81 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Tue, 16 Sep 2003 02:50:21 +0000 Subject: Merge from 3.0: >Fix OOPS when dealing with mangled names reported by several users. >This was my bug when removing a redundant strlen. >Jerry - last showstopper I knew about. >Jeremy. (This used to be commit 3266777acb911f84e70f42f17cd9f6bbd3ba35d0) --- source3/smbd/statcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/smbd/statcache.c b/source3/smbd/statcache.c index 948173687d..76406f208e 100644 --- a/source3/smbd/statcache.c +++ b/source3/smbd/statcache.c @@ -119,7 +119,7 @@ void stat_cache_add( const char *full_orig_name, const char *orig_translated_pat if (original_path_length != translated_path_length) { if (original_path_length < translated_path_length) { - DEBUG(0, ("OOPS - tried to store stat cache entry for werid length paths [%s] %u and [%s] %u)!\n", + DEBUG(0, ("OOPS - tried to store stat cache entry for weird length paths [%s] %u and [%s] %u)!\n", original_path, original_path_length, translated_path, translated_path_length)); SAFE_FREE(original_path); SAFE_FREE(translated_path); -- cgit From 9903a9d88ad70151b2f45552ece31c0ebd0fba81 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Tue, 16 Sep 2003 13:31:17 +0000 Subject: Fix typo. Found by Aurelien Degremont (This used to be commit 271111d6a7f5011c8300e060a9da3a972a28a704) --- source3/passdb/pdb_xml.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/passdb/pdb_xml.c b/source3/passdb/pdb_xml.c index 154d8c927f..7af2fdd940 100644 --- a/source3/passdb/pdb_xml.c +++ b/source3/passdb/pdb_xml.c @@ -410,7 +410,7 @@ static NTSTATUS xmlsam_add_sam_account(struct pdb_methods *methods, SAM_ACCOUNT sid_to_string(sid_str, pdb_get_group_sid(u))); if (pdb_get_init_flags(u, PDB_LOGONTIME) != PDB_DEFAULT) - xmlNewChild(user, data->ns, "login_time", + xmlNewChild(user, data->ns, "logon_time", iota(pdb_get_logon_time(u))); if (pdb_get_init_flags(u, PDB_LOGOFFTIME) != PDB_DEFAULT) -- cgit From 338889379d1b493059f4ff9dc1c0938c7d4e3639 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 16 Sep 2003 21:12:44 +0000 Subject: packaging updates from Buchan (This used to be commit 8079494aef23105ce4d1ab8d7f943a838baaca01) --- packaging/Mandrake/samba2.spec.tmpl | 422 ++++++++++++++++++++++-------------- packaging/Mandrake/smb.conf | 33 ++- packaging/Mandrake/winbind.init | 4 +- 3 files changed, 291 insertions(+), 168 deletions(-) diff --git a/packaging/Mandrake/samba2.spec.tmpl b/packaging/Mandrake/samba2.spec.tmpl index c55da187de..787ea1e5db 100644 --- a/packaging/Mandrake/samba2.spec.tmpl +++ b/packaging/Mandrake/samba2.spec.tmpl @@ -13,11 +13,15 @@ # cvs should be submitted for inclusion in samba cvs. %define pkg_name samba -%define ver 3.0.0beta3 -%define rel 3mdk +%define ver 3.0.0rc4 +%define rel 2mdk %define vscanver 0.3.3beta1 %define libsmbmajor 0 +%{!?mklibname: %define mklibname %lib%{1}%{?2:%{2}}%{?3:_%{3}}%{-s:-static}%{-d:-devel}} + +%define libname %mklibname smbclient %libsmbmajor + # Version and release replaced by samba-team at release from samba cvs %define pversion PVERSION %define prelease PRELEASE @@ -28,6 +32,7 @@ %if %have_pversion %define source_ver %{pversion} +# Don't abort for stupid reasons on builds from tarballs: %global _unpackaged_files_terminate_build 0 %global _missing_doc_files_terminate_build 0 %else @@ -63,6 +68,7 @@ %define build_non_default 0 # Default options +%define build_alternatives 0 %define build_system 0 %define build_acl 1 %define build_winbind 1 @@ -72,30 +78,30 @@ %define build_scanners 0 # CUPS supports functionality for 'printcap name = cups' (9.0 and later): %define build_cupspc 0 -# releases that have chrpath available in main -%define build_chrpath 0 +# %_{pre,postun}_service are provided by rpm-helper in 9.0 and later +%define have_rpmhelper 1 # Set defaults for each version %if %build_mdk92 +%define build_alternatives 1 %define build_cupspc 1 -%define build_chrpath 1 %endif %if %build_mdk91 %define build_cupspc 1 -%define build_chrpath 1 %endif %if %build_mdk90 -%define build_chrpath 1 %endif %if %build_mdk82 +%define have_rpmhelper 0 %endif %if %build_mdk81 %define build_winbind 0 %define build_wins 0 +%define have_rpmhelper 0 %endif %if %build_mdk80 @@ -103,6 +109,7 @@ %define build_winbind 0 %define build_wins 0 %define build_ads 0 +%define have_rpmhelper 1 %endif %if %build_mdk72 @@ -110,6 +117,7 @@ %define build_winbind 0 %define build_wins 0 %define build_ads 0 +%define have_rpmhelper 1 %endif @@ -117,30 +125,30 @@ # To use it, do rpm [-ba|--rebuild] --with 'xxx' # Check if the rpm was built with the defaults, otherwise we inform the user %define build_non_default 0 -%{?_with_system: %{expand: %%global build_system 1}} -%{?_without_system: %{expand: %%global build_system 0}} -%{?_with_acl: %{expand: %%global build_acl 1}} -%{?_with_acl: %{expand: %%global build_non_default 1}} -%{?_without_acl: %{expand: %%global build_acl 0}} -%{?_without_acl: %{expand: %%global build_non_default 1}} -%{?_with_winbind: %{expand: %%global build_winbind 1}} -%{?_with_winbind: %{expand: %%global build_non_default 1}} -%{?_without_winbind: %{expand: %%global build_winbind 0}} -%{?_without_winbind: %{expand: %%global build_non_default 1}} -%{?_with_wins: %{expand: %%global build_wins 1}} -%{?_with_wins: %{expand: %%global build_non_default 1}} -%{?_without_wins: %{expand: %%global build_wins 0}} -%{?_without_wins: %{expand: %%global build_non_default 1}} -%{?_with_ldap: %{expand: %%global build_ldap 1}} -%{?_with_ldap: %{expand: %%global build_non_default 1}} -%{?_without_ldap: %{expand: %%global build_ldap 0}} -%{?_without_ldap: %{expand: %%global build_non_default 1}} -%{?_with_ads: %{expand: %%global build_ads 1}} -%{?_with_ads: %{expand: %%global build_non_default 1}} -%{?_without_ads: %{expand: %%global build_ads 0}} -%{?_without_ads: %{expand: %%global build_non_default 1}} -%{?_with_scanners: %{expand: %%global build_scanners 1}} -%{?_with_scanners: %{expand: %%global build_non_default 1}} +%{?_with_system: %global build_system 1} +%{?_without_system: %global build_system 0} +%{?_with_acl: %global build_acl 1} +%{?_with_acl: %global build_non_default 1} +%{?_without_acl: %global build_acl 0} +%{?_without_acl: %global build_non_default 1} +%{?_with_winbind: %global build_winbind 1} +%{?_with_winbind: %global build_non_default 1} +%{?_without_winbind: %global build_winbind 0} +%{?_without_winbind: %global build_non_default 1} +%{?_with_wins: %global build_wins 1} +%{?_with_wins: %global build_non_default 1} +%{?_without_wins: %global build_wins 0} +%{?_without_wins: %global build_non_default 1} +%{?_with_ldap: %global build_ldap 1} +%{?_with_ldap: %global build_non_default 1} +%{?_without_ldap: %global build_ldap 0} +%{?_without_ldap: %global build_non_default 1} +%{?_with_ads: %global build_ads 1} +%{?_with_ads: %global build_non_default 1} +%{?_without_ads: %global build_ads 0} +%{?_without_ads: %global build_non_default 1} +%{?_with_scanners: %global build_scanners 1} +%{?_with_scanners: %global build_non_default 1} # As if that weren't enough, we're going to try building with antivirus # support as an option also @@ -179,6 +187,18 @@ #check gcc version to disable some optimisations on gcc-3.3.1 %define gcc331 %(gcc -dumpversion|awk '{if ($1>3.3) print 1; else print 0}') +#Define sets of binaries that we can use in globs and loops: +%global commonbin net,ntlm_auth,rpcclient,smbcacls,smbcquotas,smbpasswd,smbtree,testparm,testprns + +%global serverbin editreg,pdbedit,profiles,smbcontrol,smbstatus,tdbbackup +%global serversbin nmbd,samba,smbd + +%global clientbin findsmb,nmblookup,smbclient,smbmnt,smbmount,smbprint,smbspool,smbtar,smbumount +%global client_bin mount.cifs +%global client_sbin mount.smb,mount.smbfs + +%global testbin debug2html,smbtorture,msgtest,masktest,locktest,locktest2,nsstest,vfstest + %ifarch alpha %define build_expsam xml %else @@ -194,6 +214,12 @@ %else %define samba_major 3 %endif +# alternatives_major is %{nil} if we aren't system and not using alternatives +%if !%build_system || %build_alternatives +%define alternative_major 3 +%else +%define alternative_major %{nil} +%endif Summary: Samba SMB server. Name: %{pkg_name}%{samba_major} @@ -237,6 +263,7 @@ Patch3: samba-2.2.0-buildroot.patch.bz2 Patch4: samba-3.0-smbmount-sbin.patch.bz2 %if !%have_pversion # Version specific patches: current version +Patch100: samba-3.0.0rc4-mandrake-packaging.patch.bz2 %else # Version specific patches: upcoming version %endif @@ -262,10 +289,7 @@ BuildRequires: libldap-devel %if %build_ads BuildRequires: libldap-devel krb5-devel %endif -%if %build_chrpath -BuildRequires: chrpath -%endif -BuildRoot: %{_tmppath}/%{name}-root +BuildRoot: %{_tmppath}/%{name}-%{version}-root Prefix: /usr Prereq: /sbin/chkconfig /bin/mktemp /usr/bin/killall Prereq: fileutils sed /bin/grep @@ -308,7 +332,9 @@ more information. URL: http://www.samba.org Summary: Samba (SMB) server programs. Requires: %{name}-common = %{version} +%if %have_rpmhelper PreReq: rpm-helper +%endif Group: Networking/Other %if %build_system Provides: samba @@ -352,6 +378,9 @@ URL: http://www.samba.org Summary: Samba (SMB) client programs. Group: Networking/Other Requires: %{name}-common = %{version} +%if %build_alternatives +#Conflicts: samba-client < 2.2.8a-9mdk +%endif %if %build_system Provides: samba3-client Obsoletes: samba3-client @@ -359,6 +388,9 @@ Obsoletes: smbfs %else #Provides: samba-client %endif +%if !%build_system && %build_alternatives +Provides: samba-client +%endif %description client Samba-client provides some SMB clients, which complement the built-in @@ -482,21 +514,21 @@ IP addresses. %message_system %endif -%if %{?_without_test:0}%{!?_without_test:1} +%if %{?_with_test:1}%{!?_with_test:0} %package test URL: http://www.samba.org Summary: Debugging and benchmarking tools for samba Group: System/Servers Requires: %{name}-common = %{version} %endif -%if %build_system && %{?_without_test:0}%{!?_without_test:1} +%if %build_system && %{?_with_test:1}%{!?_with_test:0} Provides: samba3-test samba3-debug Obsoletes: samba3-test samba3-debug %else Provides: samba-test samba3-debug Obsoletes: samba3-debug %endif -%if %{?_without_test:0}%{!?_without_test:1} +%if %{?_with_test:1}%{!?_with_test:0} %description test This package provides tools for benchmarking samba, and debugging @@ -504,52 +536,53 @@ the correct operation of tools against smb servers. %endif %if %build_system -%package -n libsmbclient%{libsmbmajor} +%package -n %{libname} URL: http://www.samba.org Summary: SMB Client Library Group: System/Libraries Provides: libsmbclient -%description -n libsmbclient%{libsmbmajor} +%description -n %{libname} This package contains the SMB client library, part of the samba suite of networking software, allowing other software to access SMB shares. %endif %if %have_pversion && %build_system -%message_bugzilla libsmbclient%{libsmbmajor} +%message_bugzilla %{libname} %endif %if %build_system -%package -n libsmbclient%{libsmbmajor}-devel +%package -n %{libname}-devel URL: http://www.samba.org Summary: SMB Client Library Development files Group: System/Libraries Provides: libsmbclient-devel +Requires: %{libname} = %{version}-%{release} -%description -n libsmbclient%{libsmbmajor}-devel +%description -n %{libname}-devel This package contains the development files for the SMB client library, part of the samba suite of networking software, allowing the development of other software to access SMB shares. %endif %if %have_pversion && %build_system -%message_bugzilla libsmbclient%{libsmbmajor}-devel +%message_bugzilla %{libname}-devel %endif %if %build_system -%package -n libsmbclient%{libsmbmajor}-static-devel +%package -n %{libname}-static-devel URL: http://www.samba.org Summary: SMB Client Static Library Development files Group: System/Libraries Provides: libsmbclient-static-devel = %{version}-%{release} -Requires: libsmbclient%{libsmbmajor}-devel = %{version}-%{release} +Requires: %{libname}-devel = %{version}-%{release} -%description -n libsmbclient%{libsmbmajor}-static-devel +%description -n %{libname}-static-devel This package contains the static development files for the SMB client library, part of the samba suite of networking software, allowing the development of other software to access SMB shares. %endif %if %have_pversion && %build_system -%message_bugzilla libsmbclient%{libsmbmajor}-devel +%message_bugzilla %{libname}-devel %endif #%package passdb-ldap @@ -763,6 +796,7 @@ echo -e "\n%{name}-%{version}-%{release}\n">>%{SOURCE7} # Version specific patches: current version %if !%have_pversion echo "Applying patches for current version: %{ver}" +%patch100 -p1 -b .mdk %else # Version specific patches: upcoming version echo "Applying patches for new versions: %{pversion}" @@ -806,6 +840,14 @@ perl -pi -e 's/%{pkg_name}/%{name}/g' source/auth/pampass.c #remove cvs internal files from docs: find docs examples -name '.cvsignore' -exec rm -f {} \; +#make better doc trees: +mkdir -p clean-docs/samba-doc +cp -a examples docs clean-docs/samba-doc +mv -f clean-docs/samba-doc/examples/libsmbclient clean-docs/ +rm -Rf clean-docs/samba-doc/docs/{docbook,manpages,htmldocs,using_samba} +ln -s %{_datadir}/swat%{samba_major}/using_samba/ clean-docs/samba-doc/docs/using_samba +ln -sf %{_datadir}/swat%{samba_major}/help/ clean-docs/samba-doc/docs/htmldocs + %build #%serverbuild (cd source @@ -859,8 +901,10 @@ CFLAGS=`echo "$RPM_OPT_FLAGS"|sed -e 's/-g//g'` perl -pi -e 's/-g //g' Makefile %endif +perl -pi -e 's|-Wl,-rpath,%{_libdir}||g;s|-Wl,-rpath -Wl,%{_libdir}||g' Makefile + make proto_exists -%make all libsmbclient smbfilter wins modules %{!?_without_test: torture debug2html} bin/editreg client/mount.cifs +%make all libsmbclient smbfilter wins modules %{?_with_test: torture debug2html bin/log2pcap} bin/editreg client/mount.cifs # Build VFS modules (experimental) @@ -873,10 +917,7 @@ make proto_exists ) # Build mkntpasswd in examples/LDAP/ for smbldaptools -#( -#cd examples.bin/LDAP/smbldap-tools/mkntpwd -#make -#) +make -C examples.bin/LDAP/smbldap-tools/mkntpwd # Build antivirus vfs objects: %if %build_fprot @@ -930,7 +971,7 @@ make DESTDIR=$RPM_BUILD_ROOT LIBDIR=%{_libdir}/%{name} install installclientlib install -m755 source/bin/editreg %{buildroot}/%{_bindir} #need to stay -mkdir -p $RPM_BUILD_ROOT/sbin +mkdir -p $RPM_BUILD_ROOT/{sbin,bin} mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/{logrotate.d,pam.d,xinetd.d} mkdir -p $RPM_BUILD_ROOT/%{_initrddir} mkdir -p $RPM_BUILD_ROOT/var/cache/%{name} @@ -951,6 +992,10 @@ install -m 755 source/bin/pam_smbpass.so $RPM_BUILD_ROOT/%{_lib}/security/pam_sm install -m 755 source/nsswitch/pam_winbind.so $RPM_BUILD_ROOT/%{_lib}/security/pam_winbind%{samba_major}.so install -m755 source/bin/libsmbclient.a $RPM_BUILD_ROOT%{_libdir}/libsmbclient.a +pushd $RPM_BUILD_ROOT/%{_libdir} +[ -f libsmbclient.so ] && mv -f libsmbclient.so libsmbclient.so.%{libsmbmajor} +ln -sf libsmbclient.so.%{libsmbmajor} libsmbclient.so +popd # smbsh forgotten #install -m 755 source/bin/smbsh $RPM_BUILD_ROOT%{_bindir}/ @@ -981,9 +1026,9 @@ done # Make link for wins and winbind resolvers ( cd $RPM_BUILD_ROOT/%{_lib}; ln -s libnss_wins%{samba_major}.so libnss_wins%{samba_major}.so.2; ln -s libnss_winbind%{samba_major}.so libnss_winbind%{samba_major}.so.2) -%if %{?_without_test:0}%{!?_without_test:1} -for i in smbtorture msgtest masktest locktest locktest2 nsstest vfstest debug2html;do - install -m755 source/bin/$i $RPM_BUILD_ROOT/%{_bindir} +%if %{?_with_test:1}%{!?_with_test:0} +for i in {%{testbin}};do + install -m755 source/bin/${i} $RPM_BUILD_ROOT/%{_bindir}/${i}%{samba_major} done %endif @@ -1006,30 +1051,35 @@ done # install -m644 packaging/Mandrake/samba-slapd-include.conf $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/samba-slapd.include # Install smbldap-tools scripts: -#for i in examples/LDAP/smbldap-tools/*.pl; do -# install -m 750 $i $RPM_BUILD_ROOT/%{_datadir}/%{name}/scripts/ -#done +for i in examples/LDAP/smbldap-tools/*.pl; do + install -m 750 $i $RPM_BUILD_ROOT/%{_datadir}/%{name}/scripts/ + ln -s %{_datadir}/%{name}/scripts/`basename $i` $RPM_BUILD_ROOT/%{_bindir}/`basename $i|sed -e 's/\.pl//g'`%{samba_major} +done -#install -m 750 examples/LDAP/smbldap-tools/smbldap_tools.pm $RPM_BUILD_ROOT/%{_datadir}/%{name}/scripts/ +install -m 750 examples/LDAP/smbldap-tools/smbldap_tools.pm $RPM_BUILD_ROOT/%{_datadir}/%{name}/scripts/ # The conf file -#install -m 640 examples/LDAP/smbldap-tools/smbldap_conf.pm $RPM_BUILD_ROOT/%{_sysconfdir}/%{name} +install -m 640 examples/LDAP/smbldap-tools/smbldap_conf.pm $RPM_BUILD_ROOT/%{_sysconfdir}/%{name} -# Link both smbldap*.pm into vendor-perl (any better ideas?) -#mkdir -p %{buildroot}/%{perl_vendorlib} -#ln -s %{_sysconfdir}/%{name}/smbldap_conf.pm $RPM_BUILD_ROOT/%{perl_vendorlib} -#ln -s %{_datadir}/%{name}/scripts/smbldap_tools.pm $RPM_BUILD_ROOT/%{perl_vendorlib} +#Fix the smbldap-tools when not system samba: +%if !%build_system +perl -pi -e 's/^(use|package)(\s+)smbldap_(\w+);$/${1}${2}smbldap_${3}%{samba_major};/g' \ +%{buildroot}/%{_sysconfdir}/%{name}/smbldap_conf.pm \ +%{buildroot}/%{_datadir}/%{name}/scripts/smbldap*.p? +perl -pi -e 's,/usr/local/sbin/mkntpwd,/usr/sbin/mkntpwd%{samba_major},g;s,553,421,g' %{buildroot}/%{_sysconfdir}/%{name}/smbldap_conf.pm +perl -pi -e 's,\$smbldap_conf::SID,\$smbldap_conf3::SID,g' %{buildroot}/%{_datadir}/%{name}/scripts/smbldap*.p? +%endif +# Link both smbldap*.pm into vendor-perl (any better ideas?) +mkdir -p %{buildroot}/%{perl_vendorlib} +ln -s %{_sysconfdir}/%{name}/smbldap_conf.pm $RPM_BUILD_ROOT/%{perl_vendorlib}/smbldap_conf%{samba_major}.pm +ln -s %{_datadir}/%{name}/scripts/smbldap_tools.pm $RPM_BUILD_ROOT/%{perl_vendorlib}/smbldap_tools%{samba_major}.pm #mkntpwd -#install -m750 examples.bin/LDAP/smbldap-tools/mkntpwd/mkntpwd %{buildroot}/%{_sbindir} +install -m750 examples.bin/LDAP/smbldap-tools/mkntpwd/mkntpwd %{buildroot}/%{_sbindir}/mkntpwd%{samba_major} # Samba smbpasswd migration script: -install -m700 examples/LDAP/export_smbpasswd.pl $RPM_BUILD_ROOT/%{_datadir}/%{name}/scripts/ -install -m700 examples/LDAP/import_smbpasswd.pl $RPM_BUILD_ROOT/%{_datadir}/%{name}/scripts/ install -m755 examples/LDAP/convertSambaAccount $RPM_BUILD_ROOT/%{_datadir}/%{name}/scripts/ - - # make a conf file for winbind from the default one: cat packaging/Mandrake/smb.conf|sed -e 's/^; winbind/ winbind/g;s/^; obey pam/ obey pam/g; s/^; printer admin = @"D/ printer admin = @"D/g;s/^; password server = \*/ password server = \*/g;s/^; template/ template/g; s/^ security = user/ security = domain/g' > packaging/Mandrake/smb-winbind.conf install -m644 packaging/Mandrake/smb-winbind.conf $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/smb-winbind.conf @@ -1043,23 +1093,22 @@ perl -pi -e 's/printcap name = lpstat/printcap name = cups/g' $RPM_BUILD_ROOT/%{ perl -pi -e 's/printcap name = lpstat/printcap name = cups/g' $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/smb-winbind.conf %endif -# Link smbmount to /sbin/mount.smb and /sbin/mount.smbfs -#I don't think it's possible for make to do this ... -(cd $RPM_BUILD_ROOT/sbin - ln -s ..%{_bindir}/smbmount%{samba_major} mount.smb%{samba_major} - ln -s ..%{_bindir}/smbmount%{samba_major} mount.smbfs%{samba_major} -) +#%if !%build_system +# Fix script paths in smb.conf +#perl -pi -e 's,%{_datadir}/samba,%{_datadir}/%{name},g' %{buildroot}/%{_sysconfdir}/%{name}/smb*.conf +#%endif + #install mount.cifs -install -m755 source/client/mount.cifs %{buildroot}/sbin -bzcat %{SOURCE11} > %{buildroot}/%{_mandir}/man8/mount.cifs.8 +install -m755 source/client/mount.cifs %{buildroot}/bin/mount.cifs%{samba_major} +#bzcat %{SOURCE11} > %{buildroot}/%{_mandir}/man8/mount.cifs%{samba_major}.8 echo 127.0.0.1 localhost > $RPM_BUILD_ROOT/%{_sysconfdir}/%{name}/lmhosts # Link smbspool to CUPS (does not require installed CUPS) mkdir -p $RPM_BUILD_ROOT/%{_libdir}/cups/backend - ln -s %{_bindir}/smbspool $RPM_BUILD_ROOT/%{_libdir}/cups/backend/smb%{samba_major} + ln -s %{_bindir}/smbspool%{alternative_major} $RPM_BUILD_ROOT/%{_libdir}/cups/backend/smb%{alternative_major} # xinetd support @@ -1094,27 +1143,51 @@ bzcat %{SOURCE6} > $RPM_BUILD_ROOT%{_miconsdir}/swat%{samba_major}.png bzcat %{SOURCE10}> $RPM_BUILD_ROOT%{_datadir}/%{name}/scripts/print-pdf -%if %build_chrpath -find %{buildroot}/%{_lib} %{buildroot}/%{_bindir} %{buildroot}/%{_sbindir} %{buildroot}/%{_libdir} -type f -exec chrpath -d {} \; -%endif - # Fix configs when not building system samba: -%if !%build_system -# Work around non-existent but claimed --program-suffix support :-( -for dir in %{_sbindir} %{_bindir};do - FILES=`find %{buildroot}$dir -type f |grep -v "\."|grep -v %{samba_major}$` - for OLD in $FILES; do - NEW=`echo ${OLD}%{samba_major}` + +#Client binaries will have suffixes while we use alternatives, even +# if we are system samba +%if !%build_system || %build_alternatives +for OLD in %{buildroot}/%{_bindir}/{%{clientbin}} %{buildroot}/bin/%{client_bin} %{buildroot}/%{_libdir}/cups/backend/smb +do + NEW=`echo ${OLD}%{alternative_major}` + [ -e $OLD ] && mv -f $OLD $NEW +done +for OLD in %{buildroot}/%{_mandir}/man?/{%{clientbin}}* %{buildroot}/%{_mandir}/man?/%{client_bin}* +do + if [ -e $OLD ] + then + BASE=`perl -e '$_="'${OLD}'"; m,(%buildroot)(.*?)(\.[0-9]),;print "$1$2\n";'` + EXT=`echo $OLD|sed -e 's,'${BASE}',,g'` + NEW=`echo ${BASE}%{alternative_major}${EXT}` mv $OLD $NEW - done + fi +done +%endif +# Link smbmount to /sbin/mount.smb and /sbin/mount.smbfs +#I don't think it's possible for make to do this ... +(cd $RPM_BUILD_ROOT/sbin + ln -s ..%{_bindir}/smbmount%{alternative_major} mount.smb%{alternative_major} + ln -s ..%{_bindir}/smbmount%{alternative_major} mount.smbfs%{alternative_major} +) +# Server/common binaries are versioned only if not system samba: +%if !%build_system +for OLD in %{buildroot}/%{_bindir}/{%{commonbin}} %{buildroot}/%{_bindir}/{%{serverbin},wbinfo} %{buildroot}/%{_sbindir}/{%{serversbin},winbindd,swat} +do + NEW=`echo ${OLD}%{alternative_major}` + mv $OLD $NEW -f ||: done # And the man pages too: -FILES=`find %{buildroot}%{_mandir} -type f ` -for OLD in $FILES; do - BASE=`perl -e '$name="'${OLD}'"; print "",($name =~ /(.*?)\.[0-9]/), "\n";'` - EXT=`echo $OLD|sed -e 's,'${BASE}',,g'` - NEW=`echo ${BASE}%{samba_major}${EXT}` - mv $OLD $NEW +for OLD in %{buildroot}/%{_mandir}/man?/{%{commonbin},%{serverbin},wbinfo,%{serversbin},winbindd,swat,{%testbin},smb.conf,lmhosts}* +do + if [ -e $OLD ] + then + BASE=`perl -e '$_="'${OLD}'"; m,(%buildroot)(.*?)(\.[0-9]),;print "$1$2\n";'` +# BASE=`perl -e '$name="'${OLD}'"; print "",($name =~ /(.*?)\.[0-9]/), "\n";'` + EXT=`echo $OLD|sed -e 's,'${BASE}',,g'` + NEW=`echo ${BASE}%{samba_major}${EXT}` + mv $OLD $NEW + fi done # Replace paths in config files and init scripts: for i in smb winbind;do @@ -1292,6 +1365,27 @@ if [ "$1" = "0" -a -x /usr/bin/update-menus ]; then /usr/bin/update-menus || tru %clean_menus +%if %build_system +%post -n %{libname} -p /sbin/ldconfig +%postun -n %{libname} -p /sbin/ldconfig +%endif + +%if %build_alternatives +%post client + +update-alternatives --install %{_bindir}/smbclient smbclient \ +%{_bindir}/smbclient%{alternative_major} 10 \ +$(for i in {/bin/mount.cifs,/sbin/{%{client_sbin}},%{_bindir}/{%{clientbin}}};do +j=`basename $i` +[ "$j" = "smbclient" ] || \ +echo -n " --slave ${i} ${j} ${i}%{alternative_major}";done) \ +--slave %{_libdir}/cups/backend/smb cups_smb %{_libdir}/cups/backend/smb%{alternative_major} || \ +update-alternatives --auto smbclient + +%preun client +[ $1 = 0 ] && update-alternatives --remove smbclient %{_bindir}/smbclient%{alternative_major} +%endif + %triggerpostun -- samba < 1.9.18p7 if [ $1 != 0 ]; then @@ -1314,7 +1408,7 @@ fi %{_sbindir}/nmbd%{samba_major} #%{_sbindir}/wrepld%{samba_major} %{_bindir}/smbcontrol%{samba_major} -#%{_sbindir}/mkntpwd +%{_sbindir}/mkntpwd%{samba_major} %{_bindir}/smbstatus%{samba_major} %{_bindir}/pdbedit%{samba_major} %{_bindir}/tdbbackup%{samba_major} @@ -1349,11 +1443,12 @@ fi %dir %{_datadir}/%{name} %dir %{_datadir}/%{name}/scripts %attr(0755,root,root) %{_datadir}/%{name}/scripts/print-pdf -#%attr(0750,root,root) %{_datadir}/%{name}/scripts/smbldap*.pl -#%attr(0640,root,root) %config(noreplace) %{_sysconfdir}/%{name}/smbldap_conf.pm -#%attr(0644,root,root) %{_datadir}/%{name}/scripts/smbldap_tools.pm -#%{perl_vendorlib}/*.pm -%attr(0700,root,root) %{_datadir}/%{name}/scripts/*port_smbpasswd.pl +%attr(0750,root,adm) %{_datadir}/%{name}/scripts/smbldap*.pl +%attr(0750,root,adm) %{_bindir}/smbldap* +%attr(0640,root,adm) %config(noreplace) %{_sysconfdir}/%{name}/smbldap_conf.pm +%attr(0644,root,root) %{_datadir}/%{name}/scripts/smbldap_tools.pm +%{perl_vendorlib}/*.pm +#%attr(0700,root,root) %{_datadir}/%{name}/scripts/*port_smbpasswd.pl %attr(0755,root,root) %{_datadir}/%{name}/scripts/convertSambaAccount @@ -1362,8 +1457,8 @@ fi %doc README COPYING Manifest Read-Manifest-Now %doc WHATSNEW.txt Roadmap %doc README.%{name}-mandrake-rpm -%doc docs -%doc examples +%doc clean-docs/samba-doc/docs +%doc clean-docs/samba-doc/examples %attr(-,root,root) %{_datadir}/swat%{samba_major}/using_samba/ %files swat @@ -1381,17 +1476,18 @@ fi %lang(ja) %{_datadir}/swat%{samba_major}/lang/ja %lang(tr) %{_datadir}/swat%{samba_major}/lang/tr %{_mandir}/man8/swat*.8* -%doc swat/README +#%doc swat/README %files client %defattr(-,root,root) +%(for i in %{_bindir}/{%{clientbin}}%{alternative_major};do echo $i;done) +%(for i in %{_mandir}/man?/{%{clientbin}}%{alternative_major}.?.*;do echo $i|grep -v smbprint;done) %ifnarch alpha -/sbin/mount.smb%{samba_major} -/sbin/mount.smbfs%{samba_major} -/sbin/mount.cifs -%attr(755,root,root) %{_bindir}/smbmount%{samba_major} -%attr(4755,root,root) %{_bindir}/smbumount%{samba_major} -%attr(4755,root,root) %{_bindir}/smbmnt%{samba_major} +%(for i in /sbin/{%{client_sbin}}%{alternative_major};do echo $i;done) +%attr(4755,root,root) /bin/mount.cifs%{alternative_major} +%attr(755,root,root) %{_bindir}/smbmount%{alternative_major} +%attr(4755,root,root) %{_bindir}/smbumount%{alternative_major} +%attr(4755,root,root) %{_bindir}/smbmnt%{alternative_major} %{_mandir}/man8/smbmnt*.8* %{_mandir}/man8/smbmount*.8* %{_mandir}/man8/smbumount*.8* @@ -1400,41 +1496,20 @@ fi %exclude %{_bindir}/smb*m*nt%{samba_major} %exclude %{_mandir}/man8/smb*m*nt*.8* %endif -%{_bindir}/nmblookup%{samba_major} -%{_bindir}/findsmb%{samba_major} -%{_bindir}/smbclient%{samba_major} -%{_bindir}/smbprint%{samba_major} -%{_bindir}/smbtar%{samba_major} -%{_bindir}/smbspool%{samba_major} # Link of smbspool to CUPS -/%{_libdir}/cups/backend/smb%{samba_major} -/%{_mandir}/man1/nmblookup*.1* -/%{_mandir}/man1/findsmb*.1* -/%{_mandir}/man1/smbclient*.1* -/%{_mandir}/man1/smbtar*.1* -/%{_mandir}/man8/smbspool*.8* +/%{_libdir}/cups/backend/smb%{alternative_major} %files common %defattr(-,root,root) %dir /var/cache/%{name} %dir /var/log/%{name} %dir /var/run/%{name} -#%{_bindir}/make_smbcodepage -#%{_bindir}/make_unicodemap -%{_bindir}/testparm%{samba_major} -%{_bindir}/testprns%{samba_major} -#%{_bindir}/make_printerdef -%{_bindir}/rpcclient%{samba_major} -#%{_bindir}/smbsh%{samba_major} -%{_bindir}/smbpasswd%{samba_major} -%{_bindir}/smbcacls%{samba_major} -%{_bindir}/smbcquotas%{samba_major} -%{_bindir}/net%{samba_major} -%{_bindir}/smbtree%{samba_major} -%{_bindir}/ntlm_auth%{samba_major} +%(for i in %{_bindir}/{%{commonbin}}%{samba_major};do echo $i;done) +%(for i in %{_mandir}/man?/{%{commonbin}}%{samba_major}\.[0-9]*;do echo $i;done) #%{_libdir}/smbwrapper%{samba_major}.so %dir %{_libdir}/%{name} %{_libdir}/%{name}/*.dat +%{_libdir}/%{name}/charset #%{_libdir}/%{name}/lowcase.dat #%{_libdir}/%{name}/valid.dat %dir %{_sysconfdir}/%{name} @@ -1443,19 +1518,8 @@ fi %attr(-,root,root) %config(noreplace) %{_sysconfdir}/%{name}/lmhosts %dir %{_localstatedir}/%{name} %attr(-,root,root) %{_localstatedir}/%{name}/codepages -#%{_mandir}/man1/make_smbcodepage*.1* -#%{_mandir}/man1/make_unicodemap*.1* -%{_mandir}/man1/testparm*.1* -%{_mandir}/man1/rpcclient*.1* -%{_mandir}/man1/testprns*.1* %{_mandir}/man5/smb.conf*.5* %{_mandir}/man5/lmhosts*.5* -%{_mandir}/man8/smbpasswd*.8* -%{_mandir}/man1/smbcacls*.1* -%{_mandir}/man1/smbcquotas*.1* -%{_mandir}/man8/net*.8* -%{_mandir}/man1/smbtree*.1* -%{_mandir}/man1/ntlm_auth*.1* %{_mandir}/man7/Samba*.7* %dir %{_datadir}/swat%{samba_major} @@ -1479,40 +1543,38 @@ fi %attr(755,root,root) /%{_lib}/libnss_wins%{samba_major}.so* %endif -%if %{?_without_test:0}%{!?_without_test:1} +%if %{?_with_test:1}%{!?_with_test:0} %files test %defattr(-,root,root) -%{_bindir}/debug2html%{samba_major} -%{_bindir}/smbtorture%{samba_major} -%{_bindir}/msgtest%{samba_major} -%{_bindir}/masktest%{samba_major} -%{_bindir}/locktest%{samba_major} -%{_bindir}/locktest2%{samba_major} -%{_bindir}/nsstest%{samba_major} -%{_bindir}/vfstest%{samba_major} +%(for i in %{_bindir}/{%{testbin}}%{samba_major};do echo $i;done) %{_mandir}/man1/vfstest%{samba_major}*.1* +%exclude %{_mandir}/man1/log2pcap*.1* %else %exclude %{_mandir}/man1/vfstest%{samba_major}*.1* +%exclude %{_mandir}/man1/log2pcap*.1* %endif %if %build_system -%files -n libsmbclient%{libsmbmajor} +%files -n %{libname} %defattr(-,root,root) -%{_libdir}/libsmbclient.so* +%{_libdir}/libsmbclient.so.* %else -%exclude %{_libdir}/libsmbclient.so* +%exclude %{_libdir}/libsmbclient.so.* %endif %if %build_system -%files -n libsmbclient%{libsmbmajor}-devel +%files -n %{libname}-devel %defattr(-,root,root) %{_includedir}/* +%{_libdir}/libsmbclient.so +%doc clean-docs/libsmbclient/* %else %exclude %{_includedir}/* +%exclude %{_libdir}/libsmbclient.so %endif %if %build_system -%files -n libsmbclient%{libsmbmajor}-static-devel +%files -n %{libname}-static-devel %defattr(-,root,root) %{_libdir}/libsmbclient.a %else @@ -1593,6 +1655,42 @@ fi %exclude %{_mandir}/man1/smbsh*.1* %changelog +* Sat Sep 13 2003 Buchan Milne 3.0.0-0.rc4.2mdk +- rc4 +- Don't update alternatives in pre/post scripts when not using alternatives +- Fix case of --with-system without alternatives +- Final fixes to smbldap-tools for non-system case +- Remove duplicate docs (really - 1 character typo ...) +- Update configs (fix winbind init script, add example scripts in smb.conf) + +* Tue Sep 09 2003 Buchan Milne 3.0.0-0.rc3.2mdk +- rc3 +- Fix mount.smb{,fs} alternatives (spotted by Laurent Culioli) + +* Thu Sep 04 2003 Buchan Milne 3.0.0-0.rc2.3mdk +- Fix alternatives +- Fix libname (can I blame guillomovitch's evil line-wrapping spec mode?) +- Fix smbldap-tools package/use names when not system samba +- Don't conflict samba3-client with samba-client for now so we can install it + +* Fri Aug 29 2003 Buchan Milne 3.0.0-0.rc2.2mdk +- rc2 +- Remove patches 100-102 (upstream) +- Fix libname +- Alternatavise client +- Better solution to avoid rpath + +* Fri Aug 22 2003 Buchan Milne 3.0.0-0.rc1.3mdk +- Fix build with test package (p100), but not by default (too big) +- Fix (p101) for SID resolution when member of samba-2.2.x domain +- Fix libsmbclient packages (thanks Gotz) +- version mount.cifs, patch from CVS (p102), and setuid it +- Clean up docs (guillomovitch spam ;-) + +* Sat Aug 16 2003 Buchan Milne 3.0.0-0.rc1.2mdk +- rc1 +- disable test subpackage since it's broken again + * Mon Jul 28 2003 Buchan Milne 3.0.0-0.beta3.3mdk - Rebuild for kerberos-1.3 on cooker - Put printer directories back diff --git a/packaging/Mandrake/smb.conf b/packaging/Mandrake/smb.conf index 6024442ecd..6ea6635191 100644 --- a/packaging/Mandrake/smb.conf +++ b/packaging/Mandrake/smb.conf @@ -212,10 +212,30 @@ # impacts where Win2k finds it's /HOME share ; logon home = \\%L\%U\.profile + # The add user script is used by a domain member to add local user accounts -# that have been authenticated by the domain controller. -# Script for domain member for adding local accounts for authenticated users: -; add user script = /usr/sbin/useradd -s /bin/false %u +# that have been authenticated by the domain controller, or when adding +# users via the Windows NT Tools (ie User Manager for Domains). + +# Scripts for file (passwd, smbpasswd) backend: +; add user script = /usr/sbin/useradd -s /bin/false '%u' +; delete user script = /usr/sbin/userdel '%s' +; add user to group script = /usr/bin/gpasswd -a '%u' '%g' +; delete user from group script = /usr/bin/gpasswd -d '%u' '%g' +; set primary group script = /usr/sbin/usermod -g '%g' '%u' +; add group script = /usr/sbin/groupadd %g && getent group '%g'|awk -F: '{print $3}' +; delete group script = /usr/sbin/groupdel '%g' + +# Scripts for LDAP backend (assumes nss_ldap is in use on the domain controller, +# and needs configuration in smbldap_conf.pm +; add user script = /usr/share/samba/scripts/smbldap-useradd.pl '%u' +; delete user script = /usr/share/samba/scripts/smbldap-userdel.pl '%u' +; add user to group script = /usr/share/samba/scripts/smbldap-groupmod.pl -m '%u' '%g' +; delete user from group script = /usr/share/samba/scripts/smbldap-groupmod.pl -x '%u' '%g' +; set primary group script = /usr/share/samba/scripts/smbldap-usermod.pl -g '%g' '%u' +; add group script = /usr/share/samba/scripts/smbldap-groupadd.pl '%g' && /usr/share/samba3/scripts/smbldap-groupshow.pl %g|awk '/^gidNumber:/ {print $2}' +; delete group script = /usr/share/samba/scripts/smbldap-userdel.pl '%g' + # The add machine script is use by a samba server configured as a domain # controller to add local machine accounts when adding machines to the domain. @@ -360,7 +380,11 @@ ; path = /var/lib/samba/profiles ; browseable = no ; guest ok = yes - +# This script can be enabled to create profile directories on the fly +# You may want to turn off guest acces if you enable this, as it +# hasn't been thoroughly tested. +;root preexec = PROFILE=/var/lib/samba/profiles/%u; if [ ! -e $PROFILE ]; \ +; then mkdir -pm700 $PROFILE; chown %u.%g $PROFILE;fi # NOTE: If you have a CUPS print system there is no need to # specifically define each individual printer. @@ -404,6 +428,7 @@ # A useful application of samba is to make a PDF-generation service # To streamline this, install windows postscript drivers (preferably colour) # on the samba server, so that clients can automatically install them. +# Note that this only works if 'printcap name' is *not* set to 'cups' [pdf-generator] path = /var/tmp diff --git a/packaging/Mandrake/winbind.init b/packaging/Mandrake/winbind.init index b7b452eb0b..e5bc9adcbf 100644 --- a/packaging/Mandrake/winbind.init +++ b/packaging/Mandrake/winbind.init @@ -28,7 +28,7 @@ RETVAL=0 start() { echo -n "Starting Winbind services: " RETVAL=1 - if [ "`grep -i 'winbind uid' /etc/samba/smb.conf | egrep -v [\#\;]`" ]; then + if [ "`grep -i 'idmap uid' /etc/samba/smb.conf | egrep -v [\#\;]`" -a "`grep -i 'idmap gid' /etc/samba/smb.conf | egrep -v [\#\;]`" ]; then daemon winbindd RETVAL=$? else @@ -42,7 +42,7 @@ start() { stop() { echo -n "Shutting down Winbind services: " RETVAL=1 - if [ "`grep -i 'winbind uid' /etc/samba/smb.conf | egrep -v [\#\;]`" ]; then + if [ "`grep -i 'winbind uid' /etc/samba/smb.conf | egrep -v [\#\;]`" -a "`grep -i 'idmap gid' /etc/samba/smb.conf | egrep -v [\#\;]`" ]; then killproc winbindd RETVAL=$? fi -- cgit From 9dab796ed56ffea2e373df5be1ec17a77f600285 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Wed, 17 Sep 2003 17:57:18 +0000 Subject: Obviously correct typo bugfix from Lin Li . Jeremy. (This used to be commit f91da7d99bc2d9e57c411ceb0c2eb812654f3701) --- source3/nsswitch/winbindd_pam.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/nsswitch/winbindd_pam.c b/source3/nsswitch/winbindd_pam.c index 21ae6478de..ea2868b2cf 100644 --- a/source3/nsswitch/winbindd_pam.c +++ b/source3/nsswitch/winbindd_pam.c @@ -95,7 +95,7 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) /* Parse domain and username */ parse_domain_user(state->request.data.auth.user, name_domain, name_user); - if ( !name_domain ) { + if ( !*name_domain ) { DEBUG(5,("no domain separator (%s) in username (%s) - failing auth\n", lp_winbind_separator(), state->request.data.auth.user)); result = NT_STATUS_INVALID_PARAMETER; goto done; -- cgit From 53185ba285991b24d88f5b3c6c4e9e0eed1c1431 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Wed, 17 Sep 2003 19:36:53 +0000 Subject: Fix coredump from Samba4 torture suite. Jeremy. (This used to be commit 640bc276ba3d1ab83cd8994bddd64fd745f75101) --- source3/smbd/files.c | 2 ++ source3/smbd/nttrans.c | 3 +++ 2 files changed, 5 insertions(+) diff --git a/source3/smbd/files.c b/source3/smbd/files.c index 1fe6f250e5..80544c9a30 100644 --- a/source3/smbd/files.c +++ b/source3/smbd/files.c @@ -405,6 +405,8 @@ files_struct *file_fsp(char *buf, int where) if (chain_fsp) return chain_fsp; + if (!buf) + return NULL; fnum = SVAL(buf, where); for (fsp=Files;fsp;fsp=fsp->next, count++) { diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c index f8bd3ae15f..1c50744947 100644 --- a/source3/smbd/nttrans.c +++ b/source3/smbd/nttrans.c @@ -1472,6 +1472,9 @@ static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf, files_struct *fsp; uint32 flags; + if(setup_count < 6) + return ERROR_DOS(ERRDOS,ERRbadfunc); + fsp = file_fsp(setup,4); flags = IVAL(setup, 0); -- cgit From 92347f2d0f3972db9e4e686db989d292689175be Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Wed, 17 Sep 2003 23:36:58 +0000 Subject: Unregister event fix from metze. Jeremy. (This used to be commit b3b2b3d5e7c9d4995890bf7b156fc1176b042cfc) --- source3/lib/module.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/source3/lib/module.c b/source3/lib/module.c index 941a6cfbe3..38fcf0f329 100644 --- a/source3/lib/module.c +++ b/source3/lib/module.c @@ -210,18 +210,21 @@ void smb_run_idle_events(time_t now) struct smb_idle_list_ent *event = smb_idle_event_list; while (event) { + struct smb_idle_list_ent *next = event->next; time_t interval; - if (event->interval >= SMB_IDLE_EVENT_MIN_INTERVAL) { + if (event->interval <= 0) { + interval = SMB_IDLE_EVENT_DEFAULT_INTERVAL; + } else if (event->interval >= SMB_IDLE_EVENT_MIN_INTERVAL) { interval = event->interval; } else { interval = SMB_IDLE_EVENT_MIN_INTERVAL; } if (now >(event->lastrun+interval)) { - event->fn(&event->data,&event->interval,now); event->lastrun = now; + event->fn(&event->data,&event->interval,now); } - event = event->next; + event = next; } return; -- cgit From f4525f46ce0e807f11ad3eaeee10fb57bdd175bf Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 18 Sep 2003 01:17:20 +0000 Subject: Fix for #470 - unable to display SIDs in ACLs. Jeremy. (This used to be commit 1b343f710550a39815001c668c48d9b194f19243) --- source3/passdb/passdb.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c index 1dadee8a49..743ea823bf 100644 --- a/source3/passdb/passdb.c +++ b/source3/passdb/passdb.c @@ -1073,8 +1073,16 @@ DOM_SID *local_uid_to_sid(DOM_SID *psid, uid_t uid) unix_pw = sys_getpwuid( uid ); if ( !unix_pw ) { - DEBUG(4,("local_uid_to_sid: host has know idea of uid %lu\n", (unsigned long)uid)); - return NULL; + DEBUG(4,("local_uid_to_sid: host has no idea of uid %lu\n", (unsigned long)uid)); + + if ( !lp_enable_rid_algorithm() ) + return NULL; + + DEBUG(8,("local_uid_to_sid: falling back to RID algorithm\n")); + + sid_copy( psid, get_global_sam_sid() ); + sid_append_rid( psid, fallback_pdb_uid_to_user_rid(uid) ); + goto out; } if ( !NT_STATUS_IS_OK(pdb_init_sam(&sampw)) ) { @@ -1101,6 +1109,7 @@ DOM_SID *local_uid_to_sid(DOM_SID *psid, uid_t uid) sid_append_rid( psid, fallback_pdb_uid_to_user_rid(uid) ); } +out: DEBUG(10,("local_uid_to_sid: uid (%d) -> SID %s (%s).\n", (unsigned int)uid, sid_string_static(psid), unix_pw->pw_name)); -- cgit From 8e0a88b7e2f84175860225363ff17584e6e1ddd4 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 18 Sep 2003 21:19:43 +0000 Subject: Oops. Proper fix for #470. Jeremy. (This used to be commit e121a2ec0c243477ea318d573166f342abbd1cce) --- source3/passdb/passdb.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c index 743ea823bf..78f36eb9b6 100644 --- a/source3/passdb/passdb.c +++ b/source3/passdb/passdb.c @@ -1060,6 +1060,24 @@ BOOL local_password_change(const char *user_name, int local_flags, return True; } +/**************************************************************************** + Convert a uid to SID - algorithmic. +****************************************************************************/ + +static DOM_SID *algorithmic_uid_to_sid(DOM_SID *psid, uid_t uid) +{ + if ( !lp_enable_rid_algorithm() ) + return NULL; + + DEBUG(8,("algorithmic_uid_to_sid: falling back to RID algorithm\n")); + sid_copy( psid, get_global_sam_sid() ); + sid_append_rid( psid, fallback_pdb_uid_to_user_rid(uid) ); + DEBUG(10,("algorithmic_uid_to_sid: uid (%d) -> SID %s.\n", + (unsigned int)uid, sid_string_static(psid) )); + + return psid; +} + /**************************************************************************** Convert a uid to SID - locally. ****************************************************************************/ @@ -1074,15 +1092,7 @@ DOM_SID *local_uid_to_sid(DOM_SID *psid, uid_t uid) if ( !unix_pw ) { DEBUG(4,("local_uid_to_sid: host has no idea of uid %lu\n", (unsigned long)uid)); - - if ( !lp_enable_rid_algorithm() ) - return NULL; - - DEBUG(8,("local_uid_to_sid: falling back to RID algorithm\n")); - - sid_copy( psid, get_global_sam_sid() ); - sid_append_rid( psid, fallback_pdb_uid_to_user_rid(uid) ); - goto out; + return algorithmic_uid_to_sid( psid, uid); } if ( !NT_STATUS_IS_OK(pdb_init_sam(&sampw)) ) { @@ -1099,18 +1109,10 @@ DOM_SID *local_uid_to_sid(DOM_SID *psid, uid_t uid) else { DEBUG(4,("local_uid_to_sid: User %s [uid == %lu] has no samba account\n", unix_pw->pw_name, (unsigned long)uid)); - - if ( !lp_enable_rid_algorithm() ) - return NULL; - DEBUG(8,("local_uid_to_sid: falling back to RID algorithm\n")); - - sid_copy( psid, get_global_sam_sid() ); - sid_append_rid( psid, fallback_pdb_uid_to_user_rid(uid) ); + return algorithmic_uid_to_sid( psid, uid); } -out: - DEBUG(10,("local_uid_to_sid: uid (%d) -> SID %s (%s).\n", (unsigned int)uid, sid_string_static(psid), unix_pw->pw_name)); -- cgit From 30fd3599143260ee6893a5125e7ec7cec8bb2289 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 18 Sep 2003 23:54:12 +0000 Subject: The "unknown_5" 32 bit field in the user structs is actually 2 16-bit fields, bad_password_count and logon_count. Ensure this is stored/fetched in the various SAMs. As it replaces the unknown_5 field this fits exactly into the tdb SAM without any binary problems. It also is added to the LDAP SAM as two extra attributes. It breaks compatibility with the experimental SAMs xml and mysql. The maintainers of these SAMs must fix them so upgrades like this can be done transparently. I will insist on the "experimental" status until this is solved. Jeremy. (This used to be commit 71ecd10181cd35313b79f618c2928c2f45424812) --- source3/include/passdb.h | 8 ++++++-- source3/include/rpc_samr.h | 8 ++++++-- source3/include/smbldap.h | 2 ++ source3/passdb/passdb.c | 20 +++++++++++++------- source3/passdb/pdb_get_set.c | 30 ++++++++++++++++++++++++------ source3/passdb/pdb_ldap.c | 20 +++++++++++++++++++- source3/passdb/pdb_mysql.c | 16 ++++++++++------ source3/passdb/pdb_xml.c | 12 +++++++++--- source3/rpc_parse/parse_samr.c | 36 ++++++++++++++++++++---------------- source3/rpc_server/srv_samr_util.c | 26 ++++++++++++++++++-------- source3/rpcclient/cmd_samr.c | 3 ++- 11 files changed, 129 insertions(+), 52 deletions(-) diff --git a/source3/include/passdb.h b/source3/include/passdb.h index e3077eee70..a4b2bcff3f 100644 --- a/source3/include/passdb.h +++ b/source3/include/passdb.h @@ -57,7 +57,8 @@ enum pdb_elements { PDB_MUNGEDDIAL, PDB_HOURS, PDB_UNKNOWN3, - PDB_UNKNOWN5, + PDB_BAD_PASSWORD_COUNT, + PDB_LOGON_COUNT, PDB_UNKNOWN6, PDB_LMPASSWD, PDB_NTPASSWD, @@ -136,7 +137,10 @@ typedef struct sam_passwd uint32 hours_len; /* normally 21 bytes */ uint8 hours[MAX_HOURS_LEN]; - uint32 unknown_5; /* 0x0002 0000 */ + /* Was unknown_5. */ + uint16 bad_password_count; + uint16 logon_count; + uint32 unknown_6; /* 0x0000 04ec */ /* a tag for who added the private methods */ const struct pdb_methods *backend_private_methods; diff --git a/source3/include/rpc_samr.h b/source3/include/rpc_samr.h index 4d9ad0b2e1..3b81042df3 100644 --- a/source3/include/rpc_samr.h +++ b/source3/include/rpc_samr.h @@ -189,7 +189,9 @@ typedef struct sam_user_info_23 /* uint8 pad[2] */ uint32 ptr_logon_hrs; /* pointer to logon hours */ - uint32 unknown_5; /* 0x0001 0000 */ + /* Was unknown_5. */ + uint16 bad_password_count; + uint16 logon_count; uint8 padding1[6]; @@ -312,7 +314,9 @@ typedef struct sam_user_info_21 /* uint8 pad[2] */ uint32 ptr_logon_hrs; /* unknown pointer */ - uint32 unknown_5; /* 0x0002 0000 */ + /* Was unknown_5. */ + uint16 bad_password_count; + uint16 logon_count; uint8 padding1[6]; diff --git a/source3/include/smbldap.h b/source3/include/smbldap.h index 826fc3c55a..9765b9fbd6 100644 --- a/source3/include/smbldap.h +++ b/source3/include/smbldap.h @@ -88,6 +88,8 @@ #define LDAP_ATTR_SID 32 #define LDAP_ATTR_ALGORITHMIC_RID_BASE 33 #define LDAP_ATTR_NEXT_RID 34 +#define LDAP_ATTR_BAD_PASSWORD_COUNT 35 +#define LDAP_ATTR_LOGON_COUNT 36 typedef struct _attrib_map_entry { int attrib; diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c index 78f36eb9b6..cdbda38983 100644 --- a/source3/passdb/passdb.c +++ b/source3/passdb/passdb.c @@ -83,7 +83,8 @@ void pdb_fill_default_sam(SAM_ACCOUNT *user) user->private.logon_divs = 168; /* hours per week */ user->private.hours_len = 21; /* 21 times 8 bits = 168 */ memset(user->private.hours, 0xff, user->private.hours_len); /* available at all hours */ - user->private.unknown_5 = 0x00000000; /* don't know */ + user->private.bad_password_count = 0; + user->private.logon_count = 0; user->private.unknown_6 = 0x000004ec; /* don't know */ /* Some parts of samba strlen their pdb_get...() returns, @@ -1280,7 +1281,7 @@ BOOL local_sid_to_gid(gid_t *pgid, const DOM_SID *psid, enum SID_NAME_USE *name_ Marshall/unmarshall SAM_ACCOUNT structs. *********************************************************************/ -#define TDB_FORMAT_STRING "ddddddBBBBBBBBBBBBddBBwdwdBdd" +#define TDB_FORMAT_STRING "ddddddBBBBBBBBBBBBddBBwdwdBwwd" /********************************************************************** Intialize a SAM_ACCOUNT struct from a BYTE buffer of size len @@ -1315,8 +1316,9 @@ BOOL init_sam_from_buffer(SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen) fullname_len, homedir_len, logon_script_len, profile_path_len, acct_desc_len, workstations_len; - uint32 user_rid, group_rid, unknown_3, hours_len, unknown_5, unknown_6; + uint32 user_rid, group_rid, unknown_3, hours_len, unknown_6; uint16 acct_ctrl, logon_divs; + uint16 bad_password_count, logon_count; uint8 *hours; static uint8 *lm_pw_ptr, *nt_pw_ptr; uint32 len = 0; @@ -1357,7 +1359,8 @@ BOOL init_sam_from_buffer(SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen) &logon_divs, &hours_len, &hourslen, &hours, - &unknown_5, + &bad_password_count, + &logon_count, &unknown_6); if (len == -1) { @@ -1432,7 +1435,8 @@ BOOL init_sam_from_buffer(SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen) pdb_set_group_sid_from_rid(sampass, group_rid, PDB_SET); pdb_set_unknown_3(sampass, unknown_3, PDB_SET); pdb_set_hours_len(sampass, hours_len, PDB_SET); - pdb_set_unknown_5(sampass, unknown_5, PDB_SET); + pdb_set_bad_password_count(sampass, bad_password_count, PDB_SET); + pdb_set_logon_count(sampass, logon_count, PDB_SET); pdb_set_unknown_6(sampass, unknown_6, PDB_SET); pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET); pdb_set_logon_divs(sampass, logon_divs, PDB_SET); @@ -1640,7 +1644,8 @@ uint32 init_buffer_from_sam (uint8 **buf, const SAM_ACCOUNT *sampass, BOOL size_ pdb_get_logon_divs(sampass), pdb_get_hours_len(sampass), MAX_HOURS_LEN, pdb_get_hours(sampass), - pdb_get_unknown_5(sampass), + pdb_get_bad_password_count(sampass), + pdb_get_logon_count(sampass), pdb_get_unknown_6(sampass)); @@ -1682,7 +1687,8 @@ uint32 init_buffer_from_sam (uint8 **buf, const SAM_ACCOUNT *sampass, BOOL size_ pdb_get_logon_divs(sampass), pdb_get_hours_len(sampass), MAX_HOURS_LEN, pdb_get_hours(sampass), - pdb_get_unknown_5(sampass), + pdb_get_bad_password_count(sampass), + pdb_get_logon_count(sampass), pdb_get_unknown_6(sampass)); diff --git a/source3/passdb/pdb_get_set.c b/source3/passdb/pdb_get_set.c index 1505458551..9c2b7e4c70 100644 --- a/source3/passdb/pdb_get_set.c +++ b/source3/passdb/pdb_get_set.c @@ -314,12 +314,20 @@ uint32 pdb_get_unknown_3 (const SAM_ACCOUNT *sampass) return (-1); } -uint32 pdb_get_unknown_5 (const SAM_ACCOUNT *sampass) +uint16 pdb_get_bad_password_count(const SAM_ACCOUNT *sampass) { if (sampass) - return (sampass->private.unknown_5); + return (sampass->private.bad_password_count); else - return (-1); + return 0; +} + +uint16 pdb_get_logon_count(const SAM_ACCOUNT *sampass) +{ + if (sampass) + return (sampass->private.logon_count); + else + return 0; } uint32 pdb_get_unknown_6 (const SAM_ACCOUNT *sampass) @@ -984,14 +992,24 @@ BOOL pdb_set_unknown_3 (SAM_ACCOUNT *sampass, uint32 unkn, enum pdb_value_state return pdb_set_init_flags(sampass, PDB_UNKNOWN3, flag); } -BOOL pdb_set_unknown_5 (SAM_ACCOUNT *sampass, uint32 unkn, enum pdb_value_state flag) +BOOL pdb_set_bad_password_count(SAM_ACCOUNT *sampass, uint16 bad_password_count, enum pdb_value_state flag) +{ + if (!sampass) + return False; + + sampass->private.bad_password_count = bad_password_count; + + return pdb_set_init_flags(sampass, PDB_BAD_PASSWORD_COUNT, flag); +} + +BOOL pdb_set_logon_count(SAM_ACCOUNT *sampass, uint16 logon_count, enum pdb_value_state flag) { if (!sampass) return False; - sampass->private.unknown_5 = unkn; + sampass->private.logon_count = logon_count; - return pdb_set_init_flags(sampass, PDB_UNKNOWN5, flag); + return pdb_set_init_flags(sampass, PDB_LOGON_COUNT, flag); } BOOL pdb_set_unknown_6 (SAM_ACCOUNT *sampass, uint32 unkn, enum pdb_value_state flag) diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c index e00631fb7d..d4de6b2e96 100644 --- a/source3/passdb/pdb_ldap.c +++ b/source3/passdb/pdb_ldap.c @@ -422,6 +422,8 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, smbntpwd[NT_HASH_LEN]; uint16 acct_ctrl = 0, logon_divs; + uint16 bad_password_count = 0, + logon_count = 0; uint32 hours_len; uint8 hours[MAX_HOURS_LEN]; pstring temp; @@ -704,7 +706,23 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state, pdb_set_munged_dial(sampass, munged_dial, PDB_SET); /* pdb_set_unknown_3(sampass, unknown3, PDB_SET); */ - /* pdb_set_unknown_5(sampass, unknown5, PDB_SET); */ + + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_COUNT), temp)) { + /* leave as default */ + } else { + bad_password_count = (uint32) atol(temp); + pdb_set_bad_password_count(sampass, bad_password_count, PDB_SET); + } + + if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, + get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_COUNT), temp)) { + /* leave as default */ + } else { + logon_count = (uint32) atol(temp); + pdb_set_logon_count(sampass, logon_count, PDB_SET); + } + /* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */ pdb_set_hours(sampass, hours, PDB_SET); diff --git a/source3/passdb/pdb_mysql.c b/source3/passdb/pdb_mysql.c index 6c200be504..460e260ddc 100644 --- a/source3/passdb/pdb_mysql.c +++ b/source3/passdb/pdb_mysql.c @@ -49,7 +49,8 @@ #define CONFIG_UNKNOWN_3_DEFAULT "unknown_3" #define CONFIG_LOGON_DIVS_DEFAULT "logon_divs" #define CONFIG_HOURS_LEN_DEFAULT "hours_len" -#define CONFIG_UNKNOWN_5_DEFAULT "unknown_5" +#define CONFIG_BAD_PASSWORD_COUNT_DEFAULT "bad_password_count" +#define CONFIG_LOGON_COUNT_DEFAULT "logon_count" #define CONFIG_UNKNOWN_6_DEFAULT "unknown_6" #define CONFIG_HOST_DEFAULT "localhost" #define CONFIG_USER_DEFAULT "samba" @@ -259,8 +260,9 @@ static NTSTATUS row_to_sam_account(MYSQL_RES * r, SAM_ACCOUNT * u) pdb_set_unknown_3(u, xatol(row[24]), PDB_SET); pdb_set_logon_divs(u, xatol(row[25]), PDB_SET); pdb_set_hours_len(u, xatol(row[26]), PDB_SET); - pdb_set_unknown_5(u, xatol(row[27]), PDB_SET); - pdb_set_unknown_6(u, xatol(row[28]), PDB_SET); + pdb_set_bad_password_count(u, xatol(row[27]), PDB_SET); + pdb_set_logon_count(u, xatol(row[28]), PDB_SET); + pdb_set_unknown_6(u, xatol(row[29]), PDB_SET); return NT_STATUS_OK; } @@ -278,7 +280,7 @@ static NTSTATUS mysqlsam_setsampwent(struct pdb_methods *methods, BOOL update) } asprintf(&query, - "SELECT %s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s FROM %s", + "SELECT %s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s FROM %s", config_value_read(data, "logon time column", CONFIG_LOGON_TIME_DEFAULT), config_value_read(data, "logoff time column", @@ -333,8 +335,10 @@ static NTSTATUS mysqlsam_setsampwent(struct pdb_methods *methods, BOOL update) CONFIG_LOGON_DIVS_DEFAULT), config_value_read(data, "hours len column", CONFIG_HOURS_LEN_DEFAULT), - config_value_read(data, "unknown 5 column", - CONFIG_UNKNOWN_5_DEFAULT), + config_value_read(data, "bad_password_count column", + CONFIG_BAD_PASSWORD_COUNT_DEFAULT), + config_value_read(data, "logon_count column", + CONFIG_LOGON_COUNT_DEFAULT), config_value_read(data, "unknown 6 column", CONFIG_UNKNOWN_6_DEFAULT), config_value(data, "table", CONFIG_TABLE_DEFAULT) diff --git a/source3/passdb/pdb_xml.c b/source3/passdb/pdb_xml.c index 7af2fdd940..29922bca4f 100644 --- a/source3/passdb/pdb_xml.c +++ b/source3/passdb/pdb_xml.c @@ -159,8 +159,13 @@ static BOOL parseUser(xmlDocPtr doc, xmlNsPtr ns, xmlNodePtr cur, SAM_ACCOUNT * atol(xmlNodeListGetString (doc, cur->xmlChildrenNode, 1)), PDB_SET); - else if (!strcmp(cur->name, "unknown_5") && cur->ns == ns) - pdb_set_unknown_5(u, + else if (!strcmp(cur->name, "bad_password_count") && cur->ns == ns) + pdb_set_bad_password_count(u, + atol(xmlNodeListGetString + (doc, cur->xmlChildrenNode, 1)), PDB_SET); + + else if (!strcmp(cur->name, "logon_count") && cur->ns == ns) + pdb_set_logon_count(u, atol(xmlNodeListGetString (doc, cur->xmlChildrenNode, 1)), PDB_SET); @@ -495,7 +500,8 @@ static NTSTATUS xmlsam_add_sam_account(struct pdb_methods *methods, SAM_ACCOUNT xmlNewChild(user, data->ns, "hours_len", iota(pdb_get_hours_len(u))); - xmlNewChild(user, data->ns, "unknown_5", iota(pdb_get_unknown_5(u))); + xmlNewChild(user, data->ns, "bad_password_count", iota(pdb_get_bad_password_count(u))); + xmlNewChild(user, data->ns, "logon_count", iota(pdb_get_logon_count(u))); xmlNewChild(user, data->ns, "unknown_6", iota(pdb_get_unknown_6(u))); xmlSaveFile(data->location, data->doc); diff --git a/source3/rpc_parse/parse_samr.c b/source3/rpc_parse/parse_samr.c index 1fe9b3231f..420a727765 100644 --- a/source3/rpc_parse/parse_samr.c +++ b/source3/rpc_parse/parse_samr.c @@ -5411,7 +5411,6 @@ static BOOL sam_io_user_info24(const char *desc, SAM_USER_INFO_24 * usr, init_sam_user_info23 unknown_3 = 0x09f8 27fa - unknown_5 = 0x0001 0000 unknown_6 = 0x0000 04ec *************************************************************************/ @@ -5438,7 +5437,8 @@ void init_sam_user_info23W(SAM_USER_INFO_23 * usr, NTTIME * logon_time, /* all z uint32 unknown_3, uint16 logon_divs, LOGON_HRS * hrs, - uint32 unknown_5, + uint16 bad_password_count, + uint16 logon_count, char newpass[516], uint32 unknown_6) { int len_user_name = user_name != NULL ? user_name->uni_str_len : 0; @@ -5487,11 +5487,11 @@ void init_sam_user_info23W(SAM_USER_INFO_23 * usr, NTTIME * logon_time, /* all z usr->passmustchange=0; } - ZERO_STRUCT(usr->padding1); ZERO_STRUCT(usr->padding2); - usr->unknown_5 = unknown_5; /* 0x0001 0000 */ + usr->bad_password_count = bad_password_count; + usr->logon_count = logon_count; memcpy(usr->pass, newpass, sizeof(usr->pass)); @@ -5516,7 +5516,6 @@ void init_sam_user_info23W(SAM_USER_INFO_23 * usr, NTTIME * logon_time, /* all z init_sam_user_info23 unknown_3 = 0x09f8 27fa - unknown_5 = 0x0001 0000 unknown_6 = 0x0000 04ec *************************************************************************/ @@ -5534,7 +5533,7 @@ void init_sam_user_info23A(SAM_USER_INFO_23 * usr, NTTIME * logon_time, /* all z char *unk_str, char *mung_dial, uint32 user_rid, /* 0x0000 0000 */ uint32 group_rid, uint32 acb_info, uint32 unknown_3, uint16 logon_divs, - LOGON_HRS * hrs, uint32 unknown_5, + LOGON_HRS * hrs, uint16 bad_password_count, uint16 logon_count, char newpass[516], uint32 unknown_6) { int len_user_name = user_name != NULL ? strlen(user_name) : 0; @@ -5586,7 +5585,8 @@ void init_sam_user_info23A(SAM_USER_INFO_23 * usr, NTTIME * logon_time, /* all z ZERO_STRUCT(usr->padding1); ZERO_STRUCT(usr->padding2); - usr->unknown_5 = unknown_5; /* 0x0001 0000 */ + usr->bad_password_count = bad_password_count; + usr->logon_count = logon_count; memcpy(usr->pass, newpass, sizeof(usr->pass)); @@ -5678,7 +5678,9 @@ static BOOL sam_io_user_info23(const char *desc, SAM_USER_INFO_23 * usr, if(!prs_uint32("ptr_logon_hrs ", ps, depth, &usr->ptr_logon_hrs)) return False; - if(!prs_uint32("unknown_5 ", ps, depth, &usr->unknown_5)) + if(!prs_uint16("bad_password_count ", ps, depth, &usr->bad_password_count)) + return False; + if(!prs_uint16("logon_count ", ps, depth, &usr->logon_count)) return False; if(!prs_uint8s(False, "padding1 ", ps, depth, usr->padding1, sizeof(usr->padding1))) @@ -5865,7 +5867,6 @@ static BOOL sam_io_user_info25(const char *desc, SAM_USER_INFO_25 * usr, prs_str init_sam_user_info21W unknown_3 = 0x00ff ffff - unknown_5 = 0x0002 0000 unknown_6 = 0x0000 04ec *************************************************************************/ @@ -5895,7 +5896,9 @@ void init_sam_user_info21W(SAM_USER_INFO_21 * usr, uint32 unknown_3, uint16 logon_divs, LOGON_HRS * hrs, - uint32 unknown_5, uint32 unknown_6) + uint16 bad_password_count, + uint16 logon_count, + uint32 unknown_6) { int len_user_name = user_name != NULL ? user_name->uni_str_len : 0; int len_full_name = full_name != NULL ? full_name->uni_str_len : 0; @@ -5936,7 +5939,8 @@ void init_sam_user_info21W(SAM_USER_INFO_21 * usr, usr->logon_divs = logon_divs; /* should be 168 (hours/week) */ usr->ptr_logon_hrs = hrs ? 1 : 0; - usr->unknown_5 = unknown_5; /* 0x0002 0000 */ + usr->bad_password_count = bad_password_count; + usr->logon_count = logon_count; if (nt_time_is_zero(pass_must_change_time)) { usr->passmustchange=PASS_MUST_CHANGE_AT_NEXT_LOGON; @@ -5944,7 +5948,6 @@ void init_sam_user_info21W(SAM_USER_INFO_21 * usr, usr->passmustchange=0; } - ZERO_STRUCT(usr->padding1); ZERO_STRUCT(usr->padding2); @@ -5969,7 +5972,6 @@ void init_sam_user_info21W(SAM_USER_INFO_21 * usr, init_sam_user_info21 unknown_3 = 0x00ff ffff - unknown_5 = 0x0002 0000 unknown_6 = 0x0000 04ec *************************************************************************/ @@ -6086,7 +6088,8 @@ NTSTATUS init_sam_user_info21A(SAM_USER_INFO_21 *usr, SAM_ACCOUNT *pw, DOM_SID * usr->logon_divs = pdb_get_logon_divs(pw); usr->ptr_logon_hrs = pdb_get_hours(pw) ? 1 : 0; - usr->unknown_5 = pdb_get_unknown_5(pw); /* 0x0002 0000 */ + usr->bad_password_count = pdb_get_bad_password_count(pw); + usr->logon_count = pdb_get_logon_count(pw); if (pdb_get_pass_must_change_time(pw) == 0) { usr->passmustchange=PASS_MUST_CHANGE_AT_NEXT_LOGON; @@ -6094,7 +6097,6 @@ NTSTATUS init_sam_user_info21A(SAM_USER_INFO_21 *usr, SAM_ACCOUNT *pw, DOM_SID * usr->passmustchange=0; } - ZERO_STRUCT(usr->padding1); ZERO_STRUCT(usr->padding2); @@ -6192,7 +6194,9 @@ static BOOL sam_io_user_info21(const char *desc, SAM_USER_INFO_21 * usr, if(!prs_uint32("ptr_logon_hrs ", ps, depth, &usr->ptr_logon_hrs)) return False; - if(!prs_uint32("unknown_5 ", ps, depth, &usr->unknown_5)) + if(!prs_uint16("bad_password_count ", ps, depth, &usr->bad_password_count)) + return False; + if(!prs_uint16("logon_count ", ps, depth, &usr->logon_count)) return False; if(!prs_uint8s(False, "padding1 ", ps, depth, usr->padding1, sizeof(usr->padding1))) diff --git a/source3/rpc_server/srv_samr_util.c b/source3/rpc_server/srv_samr_util.c index b81c441811..db6649073e 100644 --- a/source3/rpc_server/srv_samr_util.c +++ b/source3/rpc_server/srv_samr_util.c @@ -189,7 +189,7 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from) pdb_set_acct_ctrl(to, from->acb_info, PDB_CHANGED); } - DEBUG(10,("INFO_21 UNKOWN_3: %08X -> %08X\n",pdb_get_unknown_3(to),from->unknown_3)); + DEBUG(10,("INFO_21 UNKNOWN_3: %08X -> %08X\n",pdb_get_unknown_3(to),from->unknown_3)); if (from->unknown_3 != pdb_get_unknown_3(to)) { pdb_set_unknown_3(to, from->unknown_3, PDB_CHANGED); } @@ -208,12 +208,17 @@ void copy_id21_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_21 *from) /* Fix me: only update if it changes --metze */ pdb_set_hours(to, from->logon_hrs.hours, PDB_CHANGED); - DEBUG(10,("INFO_21 UNKOWN_5: %08X -> %08X\n",pdb_get_unknown_5(to),from->unknown_5)); - if (from->unknown_5 != pdb_get_unknown_5(to)) { - pdb_set_unknown_5(to, from->unknown_5, PDB_CHANGED); + DEBUG(10,("INFO_21 BAD_PASSWORD_COUNT: %08X -> %08X\n",pdb_get_bad_password_count(to),from->bad_password_count)); + if (from->bad_password_count != pdb_get_bad_password_count(to)) { + pdb_set_bad_password_count(to, from->bad_password_count, PDB_CHANGED); } - DEBUG(10,("INFO_21 UNKOWN_6: %08X -> %08X\n",pdb_get_unknown_6(to),from->unknown_6)); + DEBUG(10,("INFO_21 LOGON_COUNT: %08X -> %08X\n",pdb_get_logon_count(to),from->logon_count)); + if (from->logon_count != pdb_get_logon_count(to)) { + pdb_set_logon_count(to, from->logon_count, PDB_CHANGED); + } + + DEBUG(10,("INFO_21 UNKNOWN_6: %08X -> %08X\n",pdb_get_unknown_6(to),from->unknown_6)); if (from->unknown_6 != pdb_get_unknown_6(to)) { pdb_set_unknown_6(to, from->unknown_6, PDB_CHANGED); } @@ -413,9 +418,14 @@ void copy_id23_to_sam_passwd(SAM_ACCOUNT *to, SAM_USER_INFO_23 *from) /* Fix me: only update if it changes --metze */ pdb_set_hours(to, from->logon_hrs.hours, PDB_CHANGED); - DEBUG(10,("INFO_23 UNKOWN_5: %08X -> %08X\n",pdb_get_unknown_5(to),from->unknown_5)); - if (from->unknown_5 != pdb_get_unknown_5(to)) { - pdb_set_unknown_5(to, from->unknown_5, PDB_CHANGED); + DEBUG(10,("INFO_23 BAD_PASSWORD_COUNT: %08X -> %08X\n",pdb_get_bad_password_count(to),from->bad_password_count)); + if (from->bad_password_count != pdb_get_bad_password_count(to)) { + pdb_set_bad_password_count(to, from->bad_password_count, PDB_CHANGED); + } + + DEBUG(10,("INFO_23 LOGON_COUNT: %08X -> %08X\n",pdb_get_logon_count(to),from->logon_count)); + if (from->logon_count != pdb_get_logon_count(to)) { + pdb_set_logon_count(to, from->logon_count, PDB_CHANGED); } DEBUG(10,("INFO_23 UNKOWN_6: %08X -> %08X\n",pdb_get_unknown_6(to),from->unknown_6)); diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c index 722d66621a..34c6fc35ab 100644 --- a/source3/rpcclient/cmd_samr.c +++ b/source3/rpcclient/cmd_samr.c @@ -85,7 +85,8 @@ static void display_sam_user_info_21(SAM_USER_INFO_21 *usr) printf("\tunknown_3:\t0x%08x\n", usr->unknown_3); /* 0x00ff ffff */ printf("\tlogon_divs:\t%d\n", usr->logon_divs); /* 0x0000 00a8 which is 168 which is num hrs in a week */ - printf("\tunknown_5:\t0x%08x\n", usr->unknown_5); /* 0x0002 0000 */ + printf("\tbad_password_count:\t0x%08x\n", usr->bad_password_count); + printf("\tlogon_count:\t0x%08x\n", usr->logon_count); printf("\tpadding1[0..7]...\n"); -- cgit From dfc79d317e74c8a0fd38982e9a8491d8effd9ad4 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Fri, 19 Sep 2003 06:20:53 +0000 Subject: Merge from 3.0: >Fix typo. (This used to be commit 028179b18b3037f24e7a49fe9e7bf64c4cacdd94) --- docs/docbook/smbdotconf/printing/os2drivermap.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/docbook/smbdotconf/printing/os2drivermap.xml b/docs/docbook/smbdotconf/printing/os2drivermap.xml index ffaa58fe2a..0dc827b882 100644 --- a/docs/docbook/smbdotconf/printing/os2drivermap.xml +++ b/docs/docbook/smbdotconf/printing/os2drivermap.xml @@ -14,7 +14,7 @@ LaserJet 5L. The need for the file is due to the printer driver namespace - problem described in . For more details on OS/2 clients, please + problem described in . For more details on OS/2 clients, please refer to . Default: os2 driver map = <empty string> -- cgit From 48a5e3fa09f1f5fc2ca7c7b5a17b58999092861a Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Fri, 19 Sep 2003 06:21:46 +0000 Subject: Merge from 3.0: >The -P option to smbclient no longer works - update all smbprint scripts to >remove it. Closes bug #473. (This used to be commit 87e8d584e992df9170b3a36ef60bcdea8ddc9887) --- examples/printing/smbprint | 1 - examples/printing/smbprint-new.sh | 1 - examples/printing/smbprint.sysv | 2 +- packaging/Mandrake/smbprint | 2 +- packaging/RedHat/smbprint | 2 +- 5 files changed, 3 insertions(+), 5 deletions(-) diff --git a/examples/printing/smbprint b/examples/printing/smbprint index 68bd66a13f..61ee41f444 100755 --- a/examples/printing/smbprint +++ b/examples/printing/smbprint @@ -140,6 +140,5 @@ $smbclient \ $IP \ $debugargs \ -U $username \ - -P \ -c "$command" # diff --git a/examples/printing/smbprint-new.sh b/examples/printing/smbprint-new.sh index 68bd66a13f..61ee41f444 100644 --- a/examples/printing/smbprint-new.sh +++ b/examples/printing/smbprint-new.sh @@ -140,6 +140,5 @@ $smbclient \ $IP \ $debugargs \ -U $username \ - -P \ -c "$command" # diff --git a/examples/printing/smbprint.sysv b/examples/printing/smbprint.sysv index 3e1cec47f5..11fea21441 100644 --- a/examples/printing/smbprint.sysv +++ b/examples/printing/smbprint.sysv @@ -47,6 +47,6 @@ password="" echo translate echo "print -" cat $* -) | /opt/samba/smbclient "\\\\$server\\$service" $password -N -P > /dev/null +) | /opt/samba/smbclient "\\\\$server\\$service" $password -N > /dev/null exit $? diff --git a/packaging/Mandrake/smbprint b/packaging/Mandrake/smbprint index 0d07c9c783..b5f689f291 100755 --- a/packaging/Mandrake/smbprint +++ b/packaging/Mandrake/smbprint @@ -74,4 +74,4 @@ echo "server $server, service $service" >> $logfile # echo translate echo "print -" cat -) | /usr/bin/smbclient "//$server/$service" $password -U $server -N -P >> $logfile +) | /usr/bin/smbclient "//$server/$service" $password -U $server -N >> $logfile diff --git a/packaging/RedHat/smbprint b/packaging/RedHat/smbprint index ec083eede6..a0fd2e481b 100755 --- a/packaging/RedHat/smbprint +++ b/packaging/RedHat/smbprint @@ -74,4 +74,4 @@ echo "server $server, service $service" >> $logfile # echo translate echo "print -" cat -) | /usr/bin/smbclient "\\\\$server\\$service" $password -U $server -N -P >> $logfile +) | /usr/bin/smbclient "\\\\$server\\$service" $password -U $server -N >> $logfile -- cgit From 7bb5182cf8ce3aa2b41a55083fedb8ae6d61d92a Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Fri, 19 Sep 2003 06:22:54 +0000 Subject: Merge from 3.0: >Applied Steve Langasek's patch for bug #450. (This used to be commit 50ae61b674550082e30f7156f2a9129b7abebb14) --- source3/libsmb/trusts_util.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/source3/libsmb/trusts_util.c b/source3/libsmb/trusts_util.c index 4e02b29f92..c18641bc84 100644 --- a/source3/libsmb/trusts_util.c +++ b/source3/libsmb/trusts_util.c @@ -180,9 +180,10 @@ BOOL enumerate_domain_trusts( TALLOC_CTX *mem_ctx, const char *domain, done: /* cleanup */ - - cli_nt_session_close( cli ); - cli_shutdown( cli ); + if (cli) { + cli_nt_session_close( cli ); + cli_shutdown( cli ); + } return NT_STATUS_IS_OK(result); } -- cgit From 54b5bbb57aac951b5ee06833be6d69c66431d9bb Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Fri, 19 Sep 2003 06:23:51 +0000 Subject: Merge from 3.0: >Fix warnings on Sun cc Workshop Compilers 5.0. Reported by "Richard >Bollinger" . Also fixed script/gaptab.awk to >produce compatible tables. >Fix CP437 and CP850 syntax for old compilers removing ANSI C99-specifics (This used to be commit a9f34d9fde4ea5e043444803aeda70d5e64c3870) --- source3/modules/CP437.c | 84 ++++++++++++++++++++++++------------------------- source3/modules/CP850.c | 74 +++++++++++++++++++++---------------------- 2 files changed, 79 insertions(+), 79 deletions(-) diff --git a/source3/modules/CP437.c b/source3/modules/CP437.c index b7e7409746..620f6cd9b6 100644 --- a/source3/modules/CP437.c +++ b/source3/modules/CP437.c @@ -89,48 +89,48 @@ static const struct charset_gap_table from_idx[] = { static const unsigned char from_ucs2[] = { - '\x00', '\x01', '\x02', '\x03', '\x04', '\x05', '\x06', '\x07', - '\x08', '\x09', '\x0a', '\x0b', '\x0c', '\x0d', '\x0e', '\x0f', - '\x10', '\x11', '\x12', '\x13', '\x14', '\x15', '\x16', '\x17', - '\x18', '\x19', '\x1a', '\x1b', '\x1c', '\x1d', '\x1e', '\x1f', - '\x20', '\x21', '\x22', '\x23', '\x24', '\x25', '\x26', '\x27', - '\x28', '\x29', '\x2a', '\x2b', '\x2c', '\x2d', '\x2e', '\x2f', - '\x30', '\x31', '\x32', '\x33', '\x34', '\x35', '\x36', '\x37', - '\x38', '\x39', '\x3a', '\x3b', '\x3c', '\x3d', '\x3e', '\x3f', - '\x40', '\x41', '\x42', '\x43', '\x44', '\x45', '\x46', '\x47', - '\x48', '\x49', '\x4a', '\x4b', '\x4c', '\x4d', '\x4e', '\x4f', - '\x50', '\x51', '\x52', '\x53', '\x54', '\x55', '\x56', '\x57', - '\x58', '\x59', '\x5a', '\x5b', '\x5c', '\x5d', '\x5e', '\x5f', - '\x60', '\x61', '\x62', '\x63', '\x64', '\x65', '\x66', '\x67', - '\x68', '\x69', '\x6a', '\x6b', '\x6c', '\x6d', '\x6e', '\x6f', - '\x70', '\x71', '\x72', '\x73', '\x74', '\x75', '\x76', '\x77', - '\x78', '\x79', '\x7a', '\x7b', '\x7c', '\x7d', '\x7e', '\x7f', - '\xff', '\xad', '\x9b', '\x9c', '\x00', '\x9d', '\x00', '\x00', - '\x00', '\x00', '\xa6', '\xae', '\xaa', '\x00', '\x00', '\x00', - '\xf8', '\xf1', '\xfd', '\x00', '\x00', '\xe6', '\x00', '\xfa', - '\x00', '\x00', '\xa7', '\xaf', '\xac', '\xab', '\x00', '\xa8', - '\x00', '\x00', '\x00', '\x00', '\x8e', '\x8f', '\x92', '\x80', - '\x00', '\x90', '\xa5', '\x00', '\x00', '\x00', '\x00', '\x99', - '\x00', '\x00', '\x00', '\x00', '\x00', '\x9a', '\x00', '\x00', - '\xe1', '\x85', '\xa0', '\x83', '\x00', '\x84', '\x86', '\x91', - '\x87', '\x8a', '\x82', '\x88', '\x89', '\x8d', '\xa1', '\x8c', - '\x8b', '\x00', '\xa4', '\x95', '\xa2', '\x93', '\x00', '\x94', - '\xf6', '\x00', '\x97', '\xa3', '\x96', '\x81', '\x00', '\x00', - '\x98', '\x9f', '\xe2', '\x00', '\x00', '\x00', '\x00', '\xe9', - '\xe4', '\x00', '\x00', '\xe8', '\x00', '\x00', '\xea', '\xe0', - '\x00', '\x00', '\xeb', '\xee', '\xe3', '\x00', '\x00', '\xe5', - '\xe7', '\x00', '\xed', '\xfc', '\x9e', '\xf9', '\xfb', '\x00', - '\x00', '\x00', '\xec', '\xef', '\xf7', '\xf0', '\x00', '\x00', - '\xf3', '\xf2', '\xa9', '\xf4', '\xf5', '\xc4', '\x00', '\xb3', - '\xda', '\x00', '\x00', '\x00', '\xbf', '\x00', '\x00', '\x00', - '\xc0', '\x00', '\x00', '\x00', '\xd9', '\x00', '\x00', '\x00', - '\xc3', '\xb4', '\xc2', '\xc1', '\xc5', '\xcd', '\xba', '\xd5', - '\xd6', '\xc9', '\xb8', '\xb7', '\xbb', '\xd4', '\xd3', '\xc8', - '\xbe', '\xbd', '\xbc', '\xc6', '\xc7', '\xcc', '\xb5', '\xb6', - '\xb9', '\xd1', '\xd2', '\xcb', '\xcf', '\xd0', '\xca', '\xd8', - '\xd7', '\xce', '\xdf', '\x00', '\x00', '\x00', '\xdc', '\x00', - '\x00', '\x00', '\xdb', '\x00', '\x00', '\x00', '\xdd', '\x00', - '\x00', '\x00', '\xde', '\xb0', '\xb1', '\xb2', '\xfe', + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, + 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, + 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, + 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, + 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, + 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, + 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, + 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, + 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, + 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, + 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, + 0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f, + 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, + 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, + 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, + 0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, + 0xff, 0xad, 0x9b, 0x9c, 0x00, 0x9d, 0x00, 0x00, + 0x00, 0x00, 0xa6, 0xae, 0xaa, 0x00, 0x00, 0x00, + 0xf8, 0xf1, 0xfd, 0x00, 0x00, 0xe6, 0x00, 0xfa, + 0x00, 0x00, 0xa7, 0xaf, 0xac, 0xab, 0x00, 0xa8, + 0x00, 0x00, 0x00, 0x00, 0x8e, 0x8f, 0x92, 0x80, + 0x00, 0x90, 0xa5, 0x00, 0x00, 0x00, 0x00, 0x99, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x9a, 0x00, 0x00, + 0xe1, 0x85, 0xa0, 0x83, 0x00, 0x84, 0x86, 0x91, + 0x87, 0x8a, 0x82, 0x88, 0x89, 0x8d, 0xa1, 0x8c, + 0x8b, 0x00, 0xa4, 0x95, 0xa2, 0x93, 0x00, 0x94, + 0xf6, 0x00, 0x97, 0xa3, 0x96, 0x81, 0x00, 0x00, + 0x98, 0x9f, 0xe2, 0x00, 0x00, 0x00, 0x00, 0xe9, + 0xe4, 0x00, 0x00, 0xe8, 0x00, 0x00, 0xea, 0xe0, + 0x00, 0x00, 0xeb, 0xee, 0xe3, 0x00, 0x00, 0xe5, + 0xe7, 0x00, 0xed, 0xfc, 0x9e, 0xf9, 0xfb, 0x00, + 0x00, 0x00, 0xec, 0xef, 0xf7, 0xf0, 0x00, 0x00, + 0xf3, 0xf2, 0xa9, 0xf4, 0xf5, 0xc4, 0x00, 0xb3, + 0xda, 0x00, 0x00, 0x00, 0xbf, 0x00, 0x00, 0x00, + 0xc0, 0x00, 0x00, 0x00, 0xd9, 0x00, 0x00, 0x00, + 0xc3, 0xb4, 0xc2, 0xc1, 0xc5, 0xcd, 0xba, 0xd5, + 0xd6, 0xc9, 0xb8, 0xb7, 0xbb, 0xd4, 0xd3, 0xc8, + 0xbe, 0xbd, 0xbc, 0xc6, 0xc7, 0xcc, 0xb5, 0xb6, + 0xb9, 0xd1, 0xd2, 0xcb, 0xcf, 0xd0, 0xca, 0xd8, + 0xd7, 0xce, 0xdf, 0x00, 0x00, 0x00, 0xdc, 0x00, + 0x00, 0x00, 0xdb, 0x00, 0x00, 0x00, 0xdd, 0x00, + 0x00, 0x00, 0xde, 0xb0, 0xb1, 0xb2, 0xfe, }; SMB_GENERATE_CHARSET_MODULE_8_BIT_GAP(CP437) diff --git a/source3/modules/CP850.c b/source3/modules/CP850.c index 311d651068..e6f70aa17a 100644 --- a/source3/modules/CP850.c +++ b/source3/modules/CP850.c @@ -79,43 +79,43 @@ static const struct charset_gap_table from_idx[] = { }; static const unsigned char from_ucs2[] = { - '\x00', '\x01', '\x02', '\x03', '\x04', '\x05', '\x06', '\x07', - '\x08', '\x09', '\x0a', '\x0b', '\x0c', '\x0d', '\x0e', '\x0f', - '\x10', '\x11', '\x12', '\x13', '\x14', '\x15', '\x16', '\x17', - '\x18', '\x19', '\x1a', '\x1b', '\x1c', '\x1d', '\x1e', '\x1f', - '\x20', '\x21', '\x22', '\x23', '\x24', '\x25', '\x26', '\x27', - '\x28', '\x29', '\x2a', '\x2b', '\x2c', '\x2d', '\x2e', '\x2f', - '\x30', '\x31', '\x32', '\x33', '\x34', '\x35', '\x36', '\x37', - '\x38', '\x39', '\x3a', '\x3b', '\x3c', '\x3d', '\x3e', '\x3f', - '\x40', '\x41', '\x42', '\x43', '\x44', '\x45', '\x46', '\x47', - '\x48', '\x49', '\x4a', '\x4b', '\x4c', '\x4d', '\x4e', '\x4f', - '\x50', '\x51', '\x52', '\x53', '\x54', '\x55', '\x56', '\x57', - '\x58', '\x59', '\x5a', '\x5b', '\x5c', '\x5d', '\x5e', '\x5f', - '\x60', '\x61', '\x62', '\x63', '\x64', '\x65', '\x66', '\x67', - '\x68', '\x69', '\x6a', '\x6b', '\x6c', '\x6d', '\x6e', '\x6f', - '\x70', '\x71', '\x72', '\x73', '\x74', '\x75', '\x76', '\x77', - '\x78', '\x79', '\x7a', '\x7b', '\x7c', '\x7d', '\x7e', '\x7f', - '\xff', '\xad', '\xbd', '\x9c', '\xcf', '\xbe', '\xdd', '\xf5', - '\xf9', '\xb8', '\xa6', '\xae', '\xaa', '\xf0', '\xa9', '\xee', - '\xf8', '\xf1', '\xfd', '\xfc', '\xef', '\xe6', '\xf4', '\xfa', - '\xf7', '\xfb', '\xa7', '\xaf', '\xac', '\xab', '\xf3', '\xa8', - '\xb7', '\xb5', '\xb6', '\xc7', '\x8e', '\x8f', '\x92', '\x80', - '\xd4', '\x90', '\xd2', '\xd3', '\xde', '\xd6', '\xd7', '\xd8', - '\xd1', '\xa5', '\xe3', '\xe0', '\xe2', '\xe5', '\x99', '\x9e', - '\x9d', '\xeb', '\xe9', '\xea', '\x9a', '\xed', '\xe8', '\xe1', - '\x85', '\xa0', '\x83', '\xc6', '\x84', '\x86', '\x91', '\x87', - '\x8a', '\x82', '\x88', '\x89', '\x8d', '\xa1', '\x8c', '\x8b', - '\xd0', '\xa4', '\x95', '\xa2', '\x93', '\xe4', '\x94', '\xf6', - '\x9b', '\x97', '\xa3', '\x96', '\x81', '\xec', '\xe7', '\x98', - '\xd5', '\x9f', '\xf2', '\xc4', '\x00', '\xb3', '\xda', '\x00', - '\x00', '\x00', '\xbf', '\x00', '\x00', '\x00', '\xc0', '\x00', - '\x00', '\x00', '\xd9', '\x00', '\x00', '\x00', '\xc3', '\xb4', - '\xc2', '\xc1', '\xc5', '\xcd', '\xba', '\x00', '\x00', '\xc9', - '\x00', '\x00', '\xbb', '\x00', '\x00', '\xc8', '\x00', '\x00', - '\xbc', '\x00', '\x00', '\xcc', '\x00', '\x00', '\xb9', '\x00', - '\x00', '\xcb', '\x00', '\x00', '\xca', '\x00', '\x00', '\xce', - '\xdf', '\x00', '\x00', '\x00', '\xdc', '\x00', '\x00', '\x00', - '\xdb', '\xb0', '\xb1', '\xb2', '\xfe', + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, + 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, + 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, + 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, + 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, + 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, + 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, + 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, + 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, + 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, + 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, + 0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f, + 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, + 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, + 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, + 0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, + 0xff, 0xad, 0xbd, 0x9c, 0xcf, 0xbe, 0xdd, 0xf5, + 0xf9, 0xb8, 0xa6, 0xae, 0xaa, 0xf0, 0xa9, 0xee, + 0xf8, 0xf1, 0xfd, 0xfc, 0xef, 0xe6, 0xf4, 0xfa, + 0xf7, 0xfb, 0xa7, 0xaf, 0xac, 0xab, 0xf3, 0xa8, + 0xb7, 0xb5, 0xb6, 0xc7, 0x8e, 0x8f, 0x92, 0x80, + 0xd4, 0x90, 0xd2, 0xd3, 0xde, 0xd6, 0xd7, 0xd8, + 0xd1, 0xa5, 0xe3, 0xe0, 0xe2, 0xe5, 0x99, 0x9e, + 0x9d, 0xeb, 0xe9, 0xea, 0x9a, 0xed, 0xe8, 0xe1, + 0x85, 0xa0, 0x83, 0xc6, 0x84, 0x86, 0x91, 0x87, + 0x8a, 0x82, 0x88, 0x89, 0x8d, 0xa1, 0x8c, 0x8b, + 0xd0, 0xa4, 0x95, 0xa2, 0x93, 0xe4, 0x94, 0xf6, + 0x9b, 0x97, 0xa3, 0x96, 0x81, 0xec, 0xe7, 0x98, + 0xd5, 0x9f, 0xf2, 0xc4, 0x00, 0xb3, 0xda, 0x00, + 0x00, 0x00, 0xbf, 0x00, 0x00, 0x00, 0xc0, 0x00, + 0x00, 0x00, 0xd9, 0x00, 0x00, 0x00, 0xc3, 0xb4, + 0xc2, 0xc1, 0xc5, 0xcd, 0xba, 0x00, 0x00, 0xc9, + 0x00, 0x00, 0xbb, 0x00, 0x00, 0xc8, 0x00, 0x00, + 0xbc, 0x00, 0x00, 0xcc, 0x00, 0x00, 0xb9, 0x00, + 0x00, 0xcb, 0x00, 0x00, 0xca, 0x00, 0x00, 0xce, + 0xdf, 0x00, 0x00, 0x00, 0xdc, 0x00, 0x00, 0x00, + 0xdb, 0xb0, 0xb1, 0xb2, 0xfe, }; SMB_GENERATE_CHARSET_MODULE_8_BIT_GAP(CP850) -- cgit From 389bf06cde17871fe4d8ef4cecc1cf92ef91e6be Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Fri, 19 Sep 2003 18:54:40 +0000 Subject: insert missing sh-bang (This used to be commit fe2b6317cbda34c2d00194884847642789f40e75) --- examples/LDAP/smbldap-tools/smbldap-groupmod.pl | 1 + 1 file changed, 1 insertion(+) diff --git a/examples/LDAP/smbldap-tools/smbldap-groupmod.pl b/examples/LDAP/smbldap-tools/smbldap-groupmod.pl index 7b5a46b06e..4a891a2772 100755 --- a/examples/LDAP/smbldap-tools/smbldap-groupmod.pl +++ b/examples/LDAP/smbldap-tools/smbldap-groupmod.pl @@ -1,3 +1,4 @@ +#!/usr/bin/perl # This code was developped by IDEALX (http://IDEALX.org/) and # contributors (their names can be found in the CONTRIBUTORS file). # -- cgit From 8139c5fcfa6bd26ce03af41c374f84be48343666 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Fri, 19 Sep 2003 21:57:46 +0000 Subject: Ensure that dup_sec_desc copies the 'type' field correctly. This caused me to expose a type arguement to make_sec_desc(). We weren't copying the SE_DESC_DACL_AUTO_INHERITED flag which could cause errors on auto inherited checks. Jeremy. (This used to be commit 546b2271c08735ac1049a453abac996d794aa364) --- source3/lib/util_seaccess.c | 4 ++-- source3/printing/nt_printing.c | 6 +++--- source3/python/py_ntsec.c | 2 +- source3/rpc_parse/parse_sec.c | 20 +++++++++++--------- source3/rpc_server/srv_lsa_nt.c | 2 +- source3/rpc_server/srv_samr_nt.c | 8 ++++---- source3/rpc_server/srv_srvsvc_nt.c | 2 +- source3/utils/smbcacls.c | 6 +++--- 8 files changed, 26 insertions(+), 24 deletions(-) diff --git a/source3/lib/util_seaccess.c b/source3/lib/util_seaccess.c index eba8cab7fb..2482d582d2 100644 --- a/source3/lib/util_seaccess.c +++ b/source3/lib/util_seaccess.c @@ -435,7 +435,7 @@ SEC_DESC_BUF *se_create_child_secdesc(TALLOC_CTX *ctx, SEC_DESC *parent_ctr, correct. Perhaps the user and group should be passed in as parameters by the caller? */ - sd = make_sec_desc(ctx, SEC_DESC_REVISION, + sd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, parent_ctr->owner_sid, parent_ctr->grp_sid, parent_ctr->sacl, @@ -479,7 +479,7 @@ NTSTATUS samr_make_sam_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size) if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL) return NT_STATUS_NO_MEMORY; - if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, NULL, NULL, NULL, psa, sd_size)) == NULL) + if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL) return NT_STATUS_NO_MEMORY; return NT_STATUS_OK; diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c index 868f68c079..9c95cf9085 100644 --- a/source3/printing/nt_printing.c +++ b/source3/printing/nt_printing.c @@ -4572,7 +4572,7 @@ WERROR nt_printing_setsec(const char *printername, SEC_DESC_BUF *secdesc_ctr) /* Make a deep copy of the security descriptor */ - psd = make_sec_desc(mem_ctx, secdesc_ctr->sec->revision, + psd = make_sec_desc(mem_ctx, secdesc_ctr->sec->revision, secdesc_ctr->sec->type, owner_sid, group_sid, sacl, dacl, @@ -4665,7 +4665,7 @@ static SEC_DESC_BUF *construct_default_printer_sdb(TALLOC_CTX *ctx) NT5 machine. */ if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) != NULL) { - psd = make_sec_desc(ctx, SEC_DESC_REVISION, + psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, &owner_sid, NULL, NULL, psa, &sd_size); } @@ -4741,7 +4741,7 @@ BOOL nt_printing_getsec(TALLOC_CTX *ctx, const char *printername, SEC_DESC_BUF * sid_append_rid(&owner_sid, DOMAIN_USER_RID_ADMIN); - psd = make_sec_desc(ctx, (*secdesc_ctr)->sec->revision, + psd = make_sec_desc(ctx, (*secdesc_ctr)->sec->revision, (*secdesc_ctr)->sec->type, &owner_sid, (*secdesc_ctr)->sec->grp_sid, (*secdesc_ctr)->sec->sacl, diff --git a/source3/python/py_ntsec.c b/source3/python/py_ntsec.c index 3d408e0bda..5ce5e8fc1b 100644 --- a/source3/python/py_ntsec.c +++ b/source3/python/py_ntsec.c @@ -276,7 +276,7 @@ BOOL py_to_SECDESC(SEC_DESC **sd, PyObject *dict, TALLOC_CTX *mem_ctx) { size_t sd_size; - *sd = make_sec_desc(mem_ctx, revision, + *sd = make_sec_desc(mem_ctx, revision, SEC_DESC_SELF_RELATIVE, got_owner_sid ? &owner_sid : NULL, got_group_sid ? &group_sid : NULL, got_sacl ? &sacl : NULL, diff --git a/source3/rpc_parse/parse_sec.c b/source3/rpc_parse/parse_sec.c index 3848bd7051..0ed930c08d 100644 --- a/source3/rpc_parse/parse_sec.c +++ b/source3/rpc_parse/parse_sec.c @@ -561,7 +561,7 @@ SEC_DESC_BUF *sec_desc_merge(TALLOC_CTX *ctx, SEC_DESC_BUF *new_sdb, SEC_DESC_BU /* Create new security descriptor from bits */ - psd = make_sec_desc(ctx, new_sdb->sec->revision, + psd = make_sec_desc(ctx, new_sdb->sec->revision, secdesc_type, owner_sid, group_sid, sacl, dacl, &secdesc_size); return_sdb = make_sec_desc_buf(ctx, secdesc_size, psd); @@ -573,7 +573,7 @@ SEC_DESC_BUF *sec_desc_merge(TALLOC_CTX *ctx, SEC_DESC_BUF *new_sdb, SEC_DESC_BU Creates a SEC_DESC structure ********************************************************************/ -SEC_DESC *make_sec_desc(TALLOC_CTX *ctx, uint16 revision, +SEC_DESC *make_sec_desc(TALLOC_CTX *ctx, uint16 revision, uint16 type, DOM_SID *owner_sid, DOM_SID *grp_sid, SEC_ACL *sacl, SEC_ACL *dacl, size_t *sd_size) { @@ -586,10 +586,12 @@ SEC_DESC *make_sec_desc(TALLOC_CTX *ctx, uint16 revision, return NULL; dst->revision = revision; - dst->type = SEC_DESC_SELF_RELATIVE; + dst->type = type; - if (sacl) dst->type |= SEC_DESC_SACL_PRESENT; - if (dacl) dst->type |= SEC_DESC_DACL_PRESENT; + if (sacl) + dst->type |= SEC_DESC_SACL_PRESENT; + if (dacl) + dst->type |= SEC_DESC_DACL_PRESENT; dst->off_owner_sid = 0; dst->off_grp_sid = 0; @@ -654,7 +656,7 @@ SEC_DESC *dup_sec_desc( TALLOC_CTX *ctx, SEC_DESC *src) if(src == NULL) return NULL; - return make_sec_desc( ctx, src->revision, + return make_sec_desc( ctx, src->revision, src->type, src->owner_sid, src->grp_sid, src->sacl, src->dacl, &dummy); } @@ -666,7 +668,7 @@ SEC_DESC *dup_sec_desc( TALLOC_CTX *ctx, SEC_DESC *src) SEC_DESC *make_standard_sec_desc(TALLOC_CTX *ctx, DOM_SID *owner_sid, DOM_SID *grp_sid, SEC_ACL *dacl, size_t *sd_size) { - return make_sec_desc(ctx, SEC_DESC_REVISION, + return make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, owner_sid, grp_sid, NULL, dacl, sd_size); } @@ -924,7 +926,7 @@ NTSTATUS sec_desc_add_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, uint32 if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace))) return NT_STATUS_UNSUCCESSFUL; - if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->owner_sid, + if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid, psd[0]->grp_sid, psd[0]->sacl, dacl, sd_size))) return NT_STATUS_UNSUCCESSFUL; @@ -976,7 +978,7 @@ NTSTATUS sec_desc_del_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, size_t if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace))) return NT_STATUS_UNSUCCESSFUL; - if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->owner_sid, + if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid, psd[0]->grp_sid, psd[0]->sacl, dacl, sd_size))) return NT_STATUS_UNSUCCESSFUL; diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c index 330dd727ef..686a3069bb 100644 --- a/source3/rpc_server/srv_lsa_nt.c +++ b/source3/rpc_server/srv_lsa_nt.c @@ -334,7 +334,7 @@ static NTSTATUS lsa_get_generic_sd(TALLOC_CTX *mem_ctx, SEC_DESC **sd, size_t *s if((psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, 3, ace)) == NULL) return NT_STATUS_NO_MEMORY; - if((*sd = make_sec_desc(mem_ctx, SEC_DESC_REVISION, &adm_sid, NULL, NULL, psa, sd_size)) == NULL) + if((*sd = make_sec_desc(mem_ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, &adm_sid, NULL, NULL, psa, sd_size)) == NULL) return NT_STATUS_NO_MEMORY; return NT_STATUS_OK; diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c index 261d641ab1..828e07c1ad 100644 --- a/source3/rpc_server/srv_samr_nt.c +++ b/source3/rpc_server/srv_samr_nt.c @@ -467,7 +467,7 @@ static NTSTATUS samr_make_dom_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL) return NT_STATUS_NO_MEMORY; - if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, NULL, NULL, NULL, psa, sd_size)) == NULL) + if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL) return NT_STATUS_NO_MEMORY; return NT_STATUS_OK; @@ -510,7 +510,7 @@ static NTSTATUS samr_make_usr_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 4, ace)) == NULL) return NT_STATUS_NO_MEMORY; - if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, NULL, NULL, NULL, psa, sd_size)) == NULL) + if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL) return NT_STATUS_NO_MEMORY; return NT_STATUS_OK; @@ -549,7 +549,7 @@ static NTSTATUS samr_make_grp_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL) return NT_STATUS_NO_MEMORY; - if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, NULL, NULL, NULL, psa, sd_size)) == NULL) + if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL) return NT_STATUS_NO_MEMORY; return NT_STATUS_OK; @@ -588,7 +588,7 @@ static NTSTATUS samr_make_ali_obj_sd(TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) == NULL) return NT_STATUS_NO_MEMORY; - if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, NULL, NULL, NULL, psa, sd_size)) == NULL) + if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL) return NT_STATUS_NO_MEMORY; return NT_STATUS_OK; diff --git a/source3/rpc_server/srv_srvsvc_nt.c b/source3/rpc_server/srv_srvsvc_nt.c index ea66a7d38b..4d1cf9bddc 100644 --- a/source3/rpc_server/srv_srvsvc_nt.c +++ b/source3/rpc_server/srv_srvsvc_nt.c @@ -184,7 +184,7 @@ static SEC_DESC *get_share_security_default( TALLOC_CTX *ctx, int snum, size_t * init_sec_ace(&ace, &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, sa, 0); if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 1, &ace)) != NULL) { - psd = make_sec_desc(ctx, SEC_DESC_REVISION, NULL, NULL, NULL, psa, psize); + psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, psize); } if (!psd) { diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c index 58ee57b5dd..5a70d16884 100644 --- a/source3/utils/smbcacls.c +++ b/source3/utils/smbcacls.c @@ -389,7 +389,7 @@ static SEC_DESC *sec_desc_parse(char *str) return NULL; } - ret = make_sec_desc(ctx,revision, owner_sid, grp_sid, + ret = make_sec_desc(ctx,revision, SEC_DESC_SELF_RELATIVE, owner_sid, grp_sid, NULL, dacl, &sd_size); SAFE_FREE(grp_sid); @@ -504,7 +504,7 @@ static int owner_set(struct cli_state *cli, enum chown_mode change_mode, return EXIT_FAILED; } - sd = make_sec_desc(ctx,old->revision, + sd = make_sec_desc(ctx,old->revision, old->type, (change_mode == REQUEST_CHOWN) ? &sid : NULL, (change_mode == REQUEST_CHGRP) ? &sid : NULL, NULL, NULL, &sd_size); @@ -679,7 +679,7 @@ static int cacl_set(struct cli_state *cli, char *filename, sort_acl(old->dacl); /* Create new security descriptor and set it */ - sd = make_sec_desc(ctx,old->revision, NULL, NULL, + sd = make_sec_desc(ctx,old->revision, old->type, NULL, NULL, NULL, old->dacl, &sd_size); fnum = cli_nt_create(cli, filename, WRITE_DAC_ACCESS); -- cgit From da3345757545bdc3b3ec965db15a34008e383099 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Sat, 20 Sep 2003 15:21:46 +0000 Subject: updates to SunOne DS schema from André Fiebach (This used to be commit ec65dabe9ddd116da41beae0b1a573724c991df6) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- examples/LDAP/samba-schema-netscapeds5.x | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/examples/LDAP/samba-schema-netscapeds5.x b/examples/LDAP/samba-schema-netscapeds5.x index 37c3347465..e750039acb 100644 --- a/examples/LDAP/samba-schema-netscapeds5.x +++ b/examples/LDAP/samba-schema-netscapeds5.x @@ -1,10 +1,30 @@ ## -## Garren Chew +## Darren Chew +## Andre Fiebach ## ## Samba 3.0 schema file for Netscape DS 5.x ## ## INSTALL-DIRECTORY/slapd-your_name/config/schema/samba-schema-netscapeds5.ldif - +#################################################################### +# Sun One DS do not load the schema without this lines +# André Fiebach +dn: cn=schema +objectClass: top +objectClass: ldapSubentry +objectClass: subschema +cn: schema +aci: (target="ldap:///cn=schema")(targetattr !="aci")(version 3.0;acl "anonymo + us, no acis"; allow (read, search, compare) userdn = "ldap:///anyone";) +aci: (targetattr = "*")(version 3.0; acl "Configuration Administrator"; allow + (all) userdn = "ldap:///uid=admin,ou=Administrators, ou=TopologyManagement, + o=NetscapeRoot";) +aci: (targetattr = "*")(version 3.0; acl "Local Directory Administrators Group + "; allow (all) groupdn = "ldap:///cn=Directory Administrators, dc=samba,dc=org";) +aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow (all)groupdn = "ld + ap:///cn=slapd-sambaldap, cn=iPlanet Directory Server, cn=Server Group, cn=iPlanetDirectory.samba.org, ou=samba.org, o=NetscapeRoot";) +modifiersName: cn=directory manager +modifyTimestamp: 20020322124844Z +#################################################################### objectClasses: ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY DESC 'Samba 3.0 Auxilary SAM Account' MUST ( uid $ sambaSID ) MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $ sambaProfilePath $ description $ sambaUserWorkstations $ sambaPrimaryGroupSID $ sambaDomainName ) X-ORIGIN 'user defined' ) objectClasses: ( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' SUP top AUXILIARY DESC 'Samba Group Mapping' MUST ( gidNumber $ sambaSID $ sambaGroupType ) MAY ( displayName $ description ) X-ORIGIN 'user defined' ) objectClasses: ( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' SUP top STRUCTURAL DESC 'Samba Domain Information' MUST ( sambaDomainName $ sambaSID ) MAY ( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ sambaAlgorithmicRidBase ) X-ORIGIN 'user defined' ) -- cgit From ccb7f73f2370eaa4b9ba3d23e928a39cd4aa011e Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Sat, 20 Sep 2003 15:29:27 +0000 Subject: fix from Brad Langhorst to correctly check if the primaryGroupID has been set (This used to be commit db0d8f76ba9fbd090b62cb1233b566040e36f552) --- examples/LDAP/convertSambaAccount | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/LDAP/convertSambaAccount b/examples/LDAP/convertSambaAccount index d2770c75a6..e00d0a2326 100755 --- a/examples/LDAP/convertSambaAccount +++ b/examples/LDAP/convertSambaAccount @@ -170,7 +170,7 @@ while ( !$ldif->eof ) { $entry->add( 'sambaSID' => $domsid."-".$entry->get_value( "rid" ) ); $entry->delete( 'rid' ); - if ( $entry->get_value( "primaryGroupID" ) ) { + if ( defined($entry->get_value( "primaryGroupID" )) ) { push @adds, "sambaPrimaryGroupSID: " . $domsid."-".$entry->get_value( "primaryGroupID" ); push @dels, "primaryGroupID"; $entry->add( 'sambaPrimaryGroupSID' => $domsid."-".$entry->get_value( "primaryGroupID" ) ); -- cgit From 9ad22b358d5941ba361e6ed21c03ccf0e63d9b6d Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Sat, 20 Sep 2003 16:45:53 +0000 Subject: removing obselete parameter from smb.conf (This used to be commit acf2564e0cc298cd7e0a395fee48efdfcb7c6d0d) --- packaging/RedHat/smb.conf | 4 ---- 1 file changed, 4 deletions(-) diff --git a/packaging/RedHat/smb.conf b/packaging/RedHat/smb.conf index 5786ec5d04..74806da16b 100644 --- a/packaging/RedHat/smb.conf +++ b/packaging/RedHat/smb.conf @@ -117,10 +117,6 @@ # and gives it a slightly higher chance of winning the election ; preferred master = yes -# Use only if you have an NT server on your network that has been -# configured at install time to be a primary domain controller. -; domain controller = - # Enable this if you want Samba to be a domain logon server for # Windows95 workstations. ; domain logons = yes -- cgit From 2862f64374143e43ffe271ea22cfc73e43bc891b Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Sun, 21 Sep 2003 03:14:05 +0000 Subject: Fix typo (This used to be commit 68e044f60ddb6dc7d894f95eff8a866e713df253) --- source3/utils/pdbedit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/utils/pdbedit.c b/source3/utils/pdbedit.c index 0f1f6edf08..c69b149469 100644 --- a/source3/utils/pdbedit.c +++ b/source3/utils/pdbedit.c @@ -409,7 +409,7 @@ static int new_user (struct pdb_context *in, const char *username, if (NT_STATUS_IS_OK(in->pdb_add_sam_account (in, sam_pwent))) { print_user_info (in, username, True, False); } else { - fprintf (stderr, "Unable to add user! (does it alredy exist?)\n"); + fprintf (stderr, "Unable to add user! (does it already exist?)\n"); pdb_free_sam (&sam_pwent); return -1; } -- cgit From 8031b1655c41a9feecd064f7a125c1dcacb4a292 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Sun, 21 Sep 2003 03:16:05 +0000 Subject: Fix bug and do more error checking. Noticed by Wilco Baan Hofman (This used to be commit ec32501cefe1ea27bcf08b5be9d53cdce8cbbbdc) --- source3/passdb/pdb_mysql.c | 46 +++++++++++++++++++++++++++++++++------------- 1 file changed, 33 insertions(+), 13 deletions(-) diff --git a/source3/passdb/pdb_mysql.c b/source3/passdb/pdb_mysql.c index 460e260ddc..7c2c56e359 100644 --- a/source3/passdb/pdb_mysql.c +++ b/source3/passdb/pdb_mysql.c @@ -156,7 +156,7 @@ static const char * config_value_write(pdb_mysql_data * data, const char *name, if (!v) return NULL; - swrite = strchr(v, ':'); + swrite = strrchr(v, ':'); /* Default to the same field as read field */ if (!swrite) @@ -182,7 +182,7 @@ static const char * config_value_read(pdb_mysql_data * data, const char *name, c if (!v) return "NULL"; - swrite = strchr(v, ':'); + swrite = strrchr(v, ':'); /* If no write is specified, there are no problems */ if (!swrite) { @@ -241,14 +241,20 @@ static NTSTATUS row_to_sam_account(MYSQL_RES * r, SAM_ACCOUNT * u) pdb_set_unknown_str(u, row[16], PDB_SET); pdb_set_munged_dial(u, row[17], PDB_SET); - if(row[18])string_to_sid(&sid, row[18]); - pdb_set_user_sid(u, &sid, PDB_SET); - if(row[19])string_to_sid(&sid, row[19]); - pdb_set_group_sid(u, &sid, PDB_SET); + if(!row[18] || !string_to_sid(&sid, row[18])) { + DEBUG(0,("No user SID retrieved from database!\n")); + } else { + pdb_set_user_sid(u, &sid, PDB_SET); + } + + if(row[19]) { + string_to_sid(&sid, row[19]); + pdb_set_group_sid(u, &sid, PDB_SET); + } - if (pdb_gethexpwd(row[20], temp), PDB_SET) + if (pdb_gethexpwd(row[20], temp)) pdb_set_lanman_passwd(u, temp, PDB_SET); - if (pdb_gethexpwd(row[21], temp), PDB_SET) + if (pdb_gethexpwd(row[21], temp)) pdb_set_nt_passwd(u, temp, PDB_SET); /* Only use plaintext password storage when lanman and nt are @@ -335,9 +341,9 @@ static NTSTATUS mysqlsam_setsampwent(struct pdb_methods *methods, BOOL update) CONFIG_LOGON_DIVS_DEFAULT), config_value_read(data, "hours len column", CONFIG_HOURS_LEN_DEFAULT), - config_value_read(data, "bad_password_count column", + config_value_read(data, "bad password count column", CONFIG_BAD_PASSWORD_COUNT_DEFAULT), - config_value_read(data, "logon_count column", + config_value_read(data, "logon count column", CONFIG_LOGON_COUNT_DEFAULT), config_value_read(data, "unknown 6 column", CONFIG_UNKNOWN_6_DEFAULT), @@ -446,7 +452,7 @@ static NTSTATUS mysqlsam_select_by_field(struct pdb_methods * methods, SAM_ACCOU } asprintf(&query, - "SELECT %s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s FROM %s WHERE %s = '%s'", + "SELECT %s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s FROM %s WHERE %s = '%s'", config_value_read(data, "logon time column", CONFIG_LOGON_TIME_DEFAULT), config_value_read(data, "logoff time column", @@ -501,8 +507,10 @@ static NTSTATUS mysqlsam_select_by_field(struct pdb_methods * methods, SAM_ACCOU CONFIG_LOGON_DIVS_DEFAULT), config_value_read(data, "hours len column", CONFIG_HOURS_LEN_DEFAULT), - config_value_read(data, "unknown 5 column", - CONFIG_UNKNOWN_5_DEFAULT), + config_value_read(data, "bad password count column", + CONFIG_BAD_PASSWORD_COUNT_DEFAULT), + config_value_read(data, "logon count column", + CONFIG_LOGON_COUNT_DEFAULT), config_value_read(data, "unknown 6 column", CONFIG_UNKNOWN_6_DEFAULT), config_value(data, "table", CONFIG_TABLE_DEFAULT), field, @@ -649,6 +657,7 @@ static NTSTATUS mysqlsam_replace_sam_account(struct pdb_methods *methods, const SAM_ACCOUNT * newpwd, char isupdate) { pstring temp; + char *field; struct pdb_mysql_data *data; pdb_mysql_query query; fstring sid_str; @@ -659,6 +668,7 @@ static NTSTATUS mysqlsam_replace_sam_account(struct pdb_methods *methods, } data = (struct pdb_mysql_data *) methods->private_data; + if (data == NULL || data->handle == NULL) { DEBUG(0, ("invalid handle!\n")); return NT_STATUS_INVALID_HANDLE; @@ -876,6 +886,7 @@ static NTSTATUS mysqlsam_init(struct pdb_context * pdb_context, struct pdb_metho { NTSTATUS nt_status; struct pdb_mysql_data *data; + const char *sid_column, *username_column; mysqlsam_debug_level = debug_add_class("mysqlsam"); if (mysqlsam_debug_level == -1) { @@ -884,6 +895,7 @@ static NTSTATUS mysqlsam_init(struct pdb_context * pdb_context, struct pdb_metho ("mysqlsam: Couldn't register custom debugging class!\n")); } + if (!pdb_context) { DEBUG(0, ("invalid pdb_methods specified\n")); return NT_STATUS_UNSUCCESSFUL; @@ -931,6 +943,14 @@ static NTSTATUS mysqlsam_init(struct pdb_context * pdb_context, struct pdb_metho DEBUG(0, ("Failed to connect to server\n")); return NT_STATUS_UNSUCCESSFUL; } + + sid_column = config_value_read(data, "user sid column", CONFIG_USER_SID_DEFAULT); + username_column = config_value_read(data, "username column", CONFIG_USERNAME_DEFAULT); + if(!strcmp(sid_column,"NULL") || !strcmp(username_column, "NULL")) { + DEBUG(0,("Please specify both a valid 'user sid column' and a valid 'username column' in smb.conf\n")); + return NT_STATUS_UNSUCCESSFUL; + } + /* Process correct entry in $HOME/.my.conf */ if (!mysql_real_connect(data->handle, config_value(data, "mysql host", CONFIG_HOST_DEFAULT), -- cgit From 5b17f2a9e47fd57bd11db28abb48a71f8321c035 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Mon, 22 Sep 2003 16:12:34 +0000 Subject: solaris packagaing fixes from Brian King (This used to be commit e8d7e9cc9bb26e6b124d036a3702f242fae3bd85) --- packaging/Solaris/makepkg.sh.tmpl | 16 +++++++++++++++- packaging/Solaris/prototype.master | 1 + 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/packaging/Solaris/makepkg.sh.tmpl b/packaging/Solaris/makepkg.sh.tmpl index 55a2da2c6a..d1da9d5f12 100755 --- a/packaging/Solaris/makepkg.sh.tmpl +++ b/packaging/Solaris/makepkg.sh.tmpl @@ -18,7 +18,14 @@ add_dynamic_entries() for binfile in * do if [ -f $binfile ]; then - echo f none samba/bin/$binfile=source/bin/$binfile 0755 root other + case $file in + CP*.so) + echo echo f none samba/lib/charset/$binfile=source/bin/$binfile 0755 root other + ;; + *) + echo f none samba/bin/$binfile=source/bin/$binfile 0755 root other + ;; + esac fi done @@ -42,6 +49,13 @@ add_dynamic_entries() echo s none /usr/lib/nss_winbind.so.2=/usr/lib/libnss_winbind.so 0755 root other fi + # add the .dat codepages + echo "#\n# Codepages \n#" + for file in $DISTR_BASE/source/codepages/*.dat ; do + bfile=`basename $file` + echo f none /usr/local/samba/lib/$bfile=source/codepages/$bfile + done + # Add the manpages echo "#\n# man pages \n#" echo d none /usr ? ? ? diff --git a/packaging/Solaris/prototype.master b/packaging/Solaris/prototype.master index ff5ba895b3..6c5aa3e28a 100644 --- a/packaging/Solaris/prototype.master +++ b/packaging/Solaris/prototype.master @@ -37,6 +37,7 @@ d none samba/docs 0755 root other # # Stuff that goes into lib # +d none samba/lib/charset 0755 root other f none samba/lib/smb.conf.example=examples/smb.conf.default 0644 root other d none samba/lib/regeditscripts 0755 root other f none samba/lib/regeditscripts/NT4_PlainPassword.reg=docs/Registry/NT4_PlainPassword.reg 0444 root other -- cgit From 492072314b12f09b85353be971a0ab7d1329b179 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Mon, 22 Sep 2003 17:54:34 +0000 Subject: fix some warnings found by the Sun C compiler (This used to be commit 585764305aa84a7732f71f2e01227e1a6a08664f) --- source3/lib/util_unistr.c | 2 +- source3/msdfs/msdfs.c | 2 +- source3/nsswitch/winbindd_util.c | 1 - source3/rpc_client/cli_samr.c | 2 +- source3/tdb/tdbutil.c | 4 ++-- source3/utils/net_groupmap.c | 5 ++--- source3/utils/net_rpc.c | 2 +- 7 files changed, 8 insertions(+), 10 deletions(-) diff --git a/source3/lib/util_unistr.c b/source3/lib/util_unistr.c index fd51f3c57d..e7c200218e 100644 --- a/source3/lib/util_unistr.c +++ b/source3/lib/util_unistr.c @@ -841,5 +841,5 @@ UNISTR2* ucs2_to_unistr2(TALLOC_CTX *ctx, UNISTR2* dst, smb_ucs2_t* src) strncpy_w(dst->buffer, src, dst->uni_max_len); return dst; -}; +} diff --git a/source3/msdfs/msdfs.c b/source3/msdfs/msdfs.c index 4c86cd0f94..f8a97effee 100644 --- a/source3/msdfs/msdfs.c +++ b/source3/msdfs/msdfs.c @@ -330,8 +330,8 @@ BOOL dfs_redirect(char* pathname, connection_struct* conn, pathname)); return False; } + /* never reached */ - return False; } /********************************************************************** diff --git a/source3/nsswitch/winbindd_util.c b/source3/nsswitch/winbindd_util.c index 25de4eff71..850a0b1a2d 100644 --- a/source3/nsswitch/winbindd_util.c +++ b/source3/nsswitch/winbindd_util.c @@ -895,6 +895,5 @@ BOOL get_trust_pw(const char *domain, uint8 ret_pwd[16], } /* Failure */ - return False; } diff --git a/source3/rpc_client/cli_samr.c b/source3/rpc_client/cli_samr.c index 635b7e7135..f985ee9979 100644 --- a/source3/rpc_client/cli_samr.c +++ b/source3/rpc_client/cli_samr.c @@ -655,7 +655,7 @@ done: prs_mem_free(&rbuf); return result; -}; +} /* Enumerate domain groups */ diff --git a/source3/tdb/tdbutil.c b/source3/tdb/tdbutil.c index b01dacd0f5..bae9a8b9d4 100644 --- a/source3/tdb/tdbutil.c +++ b/source3/tdb/tdbutil.c @@ -807,7 +807,7 @@ TDB_LIST_NODE *tdb_search_keys(TDB_CONTEXT *tdb, const char* pattern) return list; -}; +} /** @@ -825,6 +825,6 @@ void tdb_search_list_free(TDB_LIST_NODE* node) SAFE_FREE(node); node = next_node; }; -}; +} diff --git a/source3/utils/net_groupmap.c b/source3/utils/net_groupmap.c index 323f4afbc3..06a8daa775 100644 --- a/source3/utils/net_groupmap.c +++ b/source3/utils/net_groupmap.c @@ -508,9 +508,8 @@ int net_groupmap(int argc, const char **argv) return -1; } - return net_run_function(argc, argv, func, net_help_groupmap); - if ( 0 == argc ) - return net_help_groupmap( argc, argv ); + if ( argc ) + return net_run_function(argc, argv, func, net_help_groupmap); return net_help_groupmap( argc, argv ); } diff --git a/source3/utils/net_rpc.c b/source3/utils/net_rpc.c index fefc5af365..85818152d1 100644 --- a/source3/utils/net_rpc.c +++ b/source3/utils/net_rpc.c @@ -1976,7 +1976,7 @@ static NTSTATUS rpc_query_domain_sid(const DOM_SID *domain_sid, struct cli_state sid_to_string(str_sid, domain_sid); d_printf("%s\n", str_sid); return NT_STATUS_OK; -}; +} static int rpc_trustdom_list(int argc, const char **argv) -- cgit From f6e0a1097460c1eaac8842f941dbb0a42713dfd1 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 24 Sep 2003 01:24:13 +0000 Subject: fixing a bug in the retry loop for winbindd_pam_auth[_crap]() (This used to be commit a1b6e28e9c1742dd5debe46b18fa474f11b31dd1) --- source3/nsswitch/winbindd_pam.c | 40 +++++++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/source3/nsswitch/winbindd_pam.c b/source3/nsswitch/winbindd_pam.c index ea2868b2cf..d696428de4 100644 --- a/source3/nsswitch/winbindd_pam.c +++ b/source3/nsswitch/winbindd_pam.c @@ -65,7 +65,7 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) time_t last_change_time; uint32 sec_channel_type; NET_USER_INFO_3 info3; - struct cli_state *cli; + struct cli_state *cli = NULL; uchar chal[8]; TALLOC_CTX *mem_ctx = NULL; DATA_BLOB lm_resp; @@ -128,7 +128,6 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) do { ZERO_STRUCT(info3); ZERO_STRUCT(ret_creds); - cli = NULL; retry = False; /* Don't shut this down - it belongs to the connection cache code */ @@ -148,8 +147,17 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) &info3); attempts += 1; + /* We have to try a second time as cm_get_netlogon_cli + might not yet have noticed that the DC has killed + our connection. */ + + if ( cli->fd == -1 ) { + retry = True; + continue; + } + /* if we get access denied, a possible cuase was that we had and open - connection to the DC, but someone changed our machine accoutn password + connection to the DC, but someone changed our machine account password out from underneath us using 'net rpc changetrustpw' */ if ( NT_STATUS_V(result) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) ) { @@ -158,12 +166,9 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) name_domain)); winbindd_cm_flush(); retry = True; + cli = NULL; } - /* We have to try a second time as cm_get_netlogon_cli - might not yet have noticed that the DC has killed - our connection. */ - } while ( (attempts < 2) && retry ); clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds); @@ -206,7 +211,7 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) time_t last_change_time; uint32 sec_channel_type; NET_USER_INFO_3 info3; - struct cli_state *cli; + struct cli_state *cli = NULL; TALLOC_CTX *mem_ctx = NULL; char *user = NULL; const char *domain = NULL; @@ -301,7 +306,6 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) do { ZERO_STRUCT(info3); ZERO_STRUCT(ret_creds); - cli = NULL; retry = False; /* Don't shut this down - it belongs to the connection cache code */ @@ -323,8 +327,17 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) attempts += 1; - /* if we get access denied, a possible cuase was that we had and open - connection to the DC, but someone changed our machine accoutn password + /* We have to try a second time as cm_get_netlogon_cli + might not yet have noticed that the DC has killed + our connection. */ + + if ( cli->fd == -1 ) { + retry = True; + continue; + } + + /* if we get access denied, a possible cause was that we had and open + connection to the DC, but someone changed our machine account password out from underneath us using 'net rpc changetrustpw' */ if ( NT_STATUS_V(result) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) ) { @@ -333,12 +346,9 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) domain)); winbindd_cm_flush(); retry = True; + cli = NULL; } - /* We have to try a second time as cm_get_netlogon_cli - might not yet have noticed that the DC has killed - our connection. */ - } while ( (attempts < 2) && retry ); clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds); -- cgit From a899daa93acbe398761d905426a9b2302e8497f1 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Wed, 24 Sep 2003 02:45:00 +0000 Subject: Another round of merges from 3.0: >Change error message displayed when --without-libiconv is used as >an argument to configure. Closes bug 468. (This used to be commit 4b73ba7df1764b47aae8b22980efdb05d1639e57) --- source3/configure.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/configure.in b/source3/configure.in index 0cf34bc9a7..b981313c9a 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -1573,7 +1573,7 @@ AC_ARG_WITH(libiconv, [ --with-libiconv=BASEDIR Use libiconv in BASEDIR/lib and BASEDIR/include (default=auto) ], [ if test "$withval" = "no" ; then - AC_MSG_ERROR(I won't take no for an answer) + AC_MSG_ERROR([argument to --with-libiconv must be a directory]) else if test "$withval" != "yes" ; then ICONV_PATH_SPEC=yes -- cgit From 238cac9581bb24555bfe8e4d5724c03e9594447b Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Wed, 24 Sep 2003 02:45:43 +0000 Subject: Another round of merges from 3.0: >Reformat - preparing to fix bug #480 (which will be ugly). >Jeremy. (This used to be commit cd91dd9cd8392d1b9cfcbd8ef42237b813dc89b5) --- source3/include/rpc_misc.h | 140 +++++++++++++++++++-------------------------- 1 file changed, 59 insertions(+), 81 deletions(-) diff --git a/source3/include/rpc_misc.h b/source3/include/rpc_misc.h index a0572a0bfd..f9dd15c36b 100644 --- a/source3/include/rpc_misc.h +++ b/source3/include/rpc_misc.h @@ -85,49 +85,42 @@ typedef struct enum_hnd_info { uint32 ptr_hnd; /* pointer to enumeration handle */ uint32 handle; /* enumeration handle */ - } ENUM_HND; /* LOOKUP_LEVEL - switch value */ typedef struct lookup_level_info { - uint16 value; - + uint16 value; } LOOKUP_LEVEL; /* DOM_SID2 - security id */ typedef struct sid_info_2 { uint32 num_auths; /* length, bytes, including length of len :-) */ - DOM_SID sid; - } DOM_SID2; /* STRHDR - string header */ typedef struct header_info { - uint16 str_str_len; - uint16 str_max_len; - uint32 buffer; /* non-zero */ - + uint16 str_str_len; + uint16 str_max_len; + uint32 buffer; /* non-zero */ } STRHDR; /* UNIHDR - unicode string header */ typedef struct unihdr_info { - uint16 uni_str_len; - uint16 uni_max_len; - uint32 buffer; /* usually has a value of 4 */ - + uint16 uni_str_len; + uint16 uni_max_len; + uint32 buffer; /* usually has a value of 4 */ } UNIHDR; /* UNIHDR2 - unicode string header and undocumented buffer */ typedef struct unihdr2_info { - UNIHDR unihdr; - uint32 buffer; /* 32 bit buffer pointer */ - + UNIHDR unihdr; + uint32 buffer; /* 32 bit buffer pointer */ } UNIHDR2; /* clueless as to what maximum length should be */ @@ -138,16 +131,15 @@ typedef struct unihdr2_info /* UNISTR - unicode string size and buffer */ typedef struct unistr_info { - /* unicode characters. ***MUST*** be little-endian. ***MUST*** be null-terminated */ - uint16 *buffer; + /* unicode characters. ***MUST*** be little-endian. ***MUST*** be null-terminated */ + uint16 *buffer; } UNISTR; /* BUFHDR - buffer header */ typedef struct bufhdr_info { - uint32 buf_max_len; - uint32 buf_len; - + uint32 buf_max_len; + uint32 buf_len; } BUFHDR; /* BUFFER2 - unicode string, size (in uint8 ascii chars) and buffer */ @@ -155,51 +147,47 @@ typedef struct bufhdr_info /* of a unicode string different from the other \PIPE\ writers */ typedef struct buffer2_info { - uint32 buf_max_len; - uint32 undoc; - uint32 buf_len; - /* unicode characters. ***MUST*** be little-endian. **NOT** necessarily null-terminated */ - uint16 *buffer; - + uint32 buf_max_len; + uint32 undoc; + uint32 buf_len; + /* unicode characters. ***MUST*** be little-endian. **NOT** necessarily null-terminated */ + uint16 *buffer; } BUFFER2; /* BUFFER3 */ typedef struct buffer3_info { - uint32 buf_max_len; - uint8 *buffer; /* Data */ - uint32 buf_len; - + uint32 buf_max_len; + uint8 *buffer; /* Data */ + uint32 buf_len; } BUFFER3; /* BUFFER5 */ typedef struct buffer5_info { - uint32 buf_len; - uint16 *buffer; /* data */ + uint32 buf_len; + uint16 *buffer; /* data */ } BUFFER5; /* UNISTR2 - unicode string size (in uint16 unicode chars) and buffer */ typedef struct unistr2_info { - uint32 uni_max_len; - uint32 undoc; - uint32 uni_str_len; - /* unicode characters. ***MUST*** be little-endian. - **must** be null-terminated and the uni_str_len should include - the NULL character */ - uint16 *buffer; - + uint32 uni_max_len; + uint32 undoc; + uint32 uni_str_len; + /* unicode characters. ***MUST*** be little-endian. + **must** be null-terminated and the uni_str_len should include + the NULL character */ + uint16 *buffer; } UNISTR2; /* STRING2 - string size (in uint8 chars) and buffer */ typedef struct string2_info { - uint32 str_max_len; - uint32 undoc; - uint32 str_str_len; - uint8 *buffer; /* uint8 characters. **NOT** necessarily null-terminated */ - + uint32 str_max_len; + uint32 undoc; + uint32 str_str_len; + uint8 *buffer; /* uint8 characters. **NOT** necessarily null-terminated */ } STRING2; /* UNISTR3 - XXXX not sure about this structure */ @@ -266,85 +254,77 @@ typedef struct domrid3_info /* DOM_RID4 - rid + user attributes */ typedef struct domrid4_info { - uint32 unknown; - uint16 attr; - uint32 rid; /* user RID */ - + uint32 unknown; + uint16 attr; + uint32 rid; /* user RID */ } DOM_RID4; /* DOM_CLNT_SRV - client / server names */ typedef struct clnt_srv_info { - uint32 undoc_buffer; /* undocumented 32 bit buffer pointer */ - UNISTR2 uni_logon_srv; /* logon server name */ - uint32 undoc_buffer2; /* undocumented 32 bit buffer pointer */ - UNISTR2 uni_comp_name; /* client machine name */ - + uint32 undoc_buffer; /* undocumented 32 bit buffer pointer */ + UNISTR2 uni_logon_srv; /* logon server name */ + uint32 undoc_buffer2; /* undocumented 32 bit buffer pointer */ + UNISTR2 uni_comp_name; /* client machine name */ } DOM_CLNT_SRV; /* DOM_LOG_INFO - login info */ typedef struct log_info { - uint32 undoc_buffer; /* undocumented 32 bit buffer pointer */ - UNISTR2 uni_logon_srv; /* logon server name */ - UNISTR2 uni_acct_name; /* account name */ - uint16 sec_chan; /* secure channel type */ - UNISTR2 uni_comp_name; /* client machine name */ - + uint32 undoc_buffer; /* undocumented 32 bit buffer pointer */ + UNISTR2 uni_logon_srv; /* logon server name */ + UNISTR2 uni_acct_name; /* account name */ + uint16 sec_chan; /* secure channel type */ + UNISTR2 uni_comp_name; /* client machine name */ } DOM_LOG_INFO; /* DOM_CHAL - challenge info */ typedef struct chal_info { - uchar data[8]; /* credentials */ + uchar data[8]; /* credentials */ } DOM_CHAL; /* DOM_CREDs - timestamped client or server credentials */ typedef struct cred_info { - DOM_CHAL challenge; /* credentials */ - UTIME timestamp; /* credential time-stamp */ + DOM_CHAL challenge; /* credentials */ + UTIME timestamp; /* credential time-stamp */ } DOM_CRED; /* DOM_CLNT_INFO - client info */ typedef struct clnt_info { - DOM_LOG_INFO login; - DOM_CRED cred; - + DOM_LOG_INFO login; + DOM_CRED cred; } DOM_CLNT_INFO; /* DOM_CLNT_INFO2 - client info */ typedef struct clnt_info2 { - DOM_CLNT_SRV login; - uint32 ptr_cred; - DOM_CRED cred; - + DOM_CLNT_SRV login; + uint32 ptr_cred; + DOM_CRED cred; } DOM_CLNT_INFO2; /* DOM_LOGON_ID - logon id */ typedef struct logon_info { - uint32 low; - uint32 high; - + uint32 low; + uint32 high; } DOM_LOGON_ID; /* OWF INFO */ typedef struct owf_info { - uint8 data[16]; - + uint8 data[16]; } OWF_INFO; /* DOM_GID - group id + user attributes */ typedef struct gid_info { - uint32 g_rid; /* a group RID */ - uint32 attr; - + uint32 g_rid; /* a group RID */ + uint32 attr; } DOM_GID; /* POLICY_HND */ @@ -355,7 +335,6 @@ typedef struct lsa_policy_info uint16 data3; uint16 data4; uint8 data5[8]; - #ifdef __INSURE__ /* To prevent the leakage of policy handles mallocate a bit of @@ -366,7 +345,6 @@ typedef struct lsa_policy_info char *marker; #endif - } POLICY_HND; /* -- cgit From 43004ba8830874a8ab02bc755b1e99160af982b5 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Wed, 24 Sep 2003 02:46:59 +0000 Subject: Another round of merges from 3.0: >Fix return of result. Patch from Yasuma Takeda >Jeremy. >Applied Monyo's patch for bug #412 which allows \n characters to >appear in msg strings. >Put in some DEBUGs for swat language selection. Part of bug 456. (This used to be commit 0105b72db85141da30746c06ad7f5cec15bf9640) --- source3/intl/lang_tdb.c | 38 +++++++++++++++++++++++++------------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/source3/intl/lang_tdb.c b/source3/intl/lang_tdb.c index f12b9b6f15..5409ce6619 100644 --- a/source3/intl/lang_tdb.c +++ b/source3/intl/lang_tdb.c @@ -58,6 +58,8 @@ static BOOL load_msg(const char *msg_file) if (*msgstr == 0) { msgstr = msgid; } + all_string_sub(msgid, "\\n", "\n", 0); + all_string_sub(msgstr, "\\n", "\n", 0); key.dptr = msgid; key.dsize = strlen(msgid)+1; data.dptr = msgstr; @@ -99,10 +101,12 @@ BOOL lang_tdb_init(const char *lang) struct stat st; static int initialised; time_t loadtime; + BOOL result = False; /* we only want to init once per process, unless given an override */ - if (initialised && !lang) return True; + if (initialised && !lang) + return True; if (initialised) { /* we are re-initialising, free up any old init */ @@ -121,41 +125,49 @@ BOOL lang_tdb_init(const char *lang) } /* if no lang then we don't translate */ - if (!lang) return True; + if (!lang) + return True; asprintf(&msg_path, "%s.msg", lib_path((const char *)lang)); if (stat(msg_path, &st) != 0) { /* the msg file isn't available */ - free(msg_path); - return False; + DEBUG(10, ("lang_tdb_init: %s: %s", msg_path, + strerror(errno))); + goto done; } - asprintf(&path, "%s%s.tdb", lock_path("lang_"), lang); + DEBUG(10, ("lang_tdb_init: loading %s\n", path)); + tdb = tdb_open_log(path, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0644); if (!tdb) { tdb = tdb_open_log(path, 0, TDB_DEFAULT, O_RDONLY, 0); - free(path); - free(msg_path); - if (!tdb) return False; + if (!tdb) { + DEBUG(10, ("lang_tdb_init: %s: %s\n", path, + strerror(errno))); + goto done; + } current_lang = strdup(lang); - return True; + result = True; + goto done; } - free(path); - loadtime = tdb_fetch_int32(tdb, "/LOADTIME/"); if (loadtime == -1 || loadtime < st.st_mtime) { load_msg(msg_path); tdb_store_int32(tdb, "/LOADTIME/", (int)time(NULL)); } - free(msg_path); current_lang = strdup(lang); + result = True; - return True; + done: + SAFE_FREE(msg_path); + SAFE_FREE(path); + + return result; } /* translate a msgid to a message string in the current language -- cgit From 293421f3c64a2adff7dc15f7ad3adb6120c9fd16 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 24 Sep 2003 15:05:22 +0000 Subject: syncing up docs, examples, & packaging from 3.0 (This used to be commit dd1348c566b4700ea01bd89639e2d3330c878167) --- docs/Samba-Developers-Guide.pdf | 3824 +- docs/Samba-HOWTO-Collection.pdf | 59965 ++++++++++--------- docs/docbook/configure | 2618 +- docs/docbook/global.ent | 46 +- docs/docbook/projdoc/AccessControls.xml | 594 +- docs/docbook/projdoc/AdvancedNetworkAdmin.xml | 215 +- docs/docbook/projdoc/Bugs.xml | 112 +- docs/docbook/projdoc/CUPS-printing.xml | 4795 +- docs/docbook/projdoc/Compiling.xml | 263 +- docs/docbook/projdoc/DOMAIN_MEMBER.xml | 681 +- docs/docbook/projdoc/Diagnosis.xml | 352 +- docs/docbook/projdoc/Further-Resources.xml | 13 +- docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml | 465 +- docs/docbook/projdoc/Integrating-with-Windows.xml | 279 +- docs/docbook/projdoc/InterdomainTrusts.xml | 193 +- docs/docbook/projdoc/NT4Migration.xml | 341 +- docs/docbook/projdoc/NetworkBrowsing.xml | 1176 +- docs/docbook/projdoc/Other-Clients.xml | 234 +- .../projdoc/PAM-Authentication-And-Samba.xml | 494 +- docs/docbook/projdoc/PolicyMgmt.xml | 349 +- docs/docbook/projdoc/Portability.xml | 84 +- docs/docbook/projdoc/Problems.xml | 271 +- docs/docbook/projdoc/ProfileMgmt.xml | 1472 +- docs/docbook/projdoc/SWAT.xml | 441 +- docs/docbook/projdoc/Samba-BDC-HOWTO.xml | 551 +- docs/docbook/projdoc/Samba-PDC-HOWTO.xml | 667 +- docs/docbook/projdoc/ServerType.xml | 308 +- docs/docbook/projdoc/Speed.xml | 135 +- docs/docbook/projdoc/StandAloneServer.xml | 117 +- docs/docbook/projdoc/UNIX_INSTALL.xml | 250 +- docs/docbook/projdoc/VFS.xml | 157 +- docs/docbook/projdoc/locking.xml | 452 +- docs/docbook/projdoc/msdfs_setup.xml | 113 +- docs/docbook/projdoc/printer_driver2.xml | 3811 +- docs/docbook/projdoc/securing-samba.xml | 186 +- docs/docbook/projdoc/unicode.xml | 97 +- docs/docbook/projdoc/upgrading-to-3.0.xml | 300 +- docs/docbook/projdoc/winbind.xml | 701 +- docs/faq/FAQ-ClientApp.html | 6 +- docs/faq/FAQ-Install.html | 4 +- docs/faq/FAQ-errors.html | 8 +- docs/faq/FAQ-features.html | 18 +- docs/faq/FAQ-general.html | 6 +- docs/faq/samba-faq.html | 4 +- docs/htmldocs/AccessControls.html | 641 +- docs/htmldocs/AdvancedNetworkManagement.html | 205 +- docs/htmldocs/Appendixes.html | 4 +- docs/htmldocs/Backup.html | 6 +- docs/htmldocs/CUPS-printing.html | 4106 +- docs/htmldocs/ClientConfig.html | 4 +- docs/htmldocs/DNSDHCP.html | 4 +- docs/htmldocs/FastStart.html | 4 +- docs/htmldocs/Further-Resources.html | 166 +- docs/htmldocs/InterdomainTrusts.html | 217 +- docs/htmldocs/IntroSMB.html | 58 +- docs/htmldocs/NT4Migration.html | 235 +- docs/htmldocs/NetworkBrowsing.html | 1167 +- docs/htmldocs/Other-Clients.html | 212 +- docs/htmldocs/PolicyMgmt.html | 333 +- docs/htmldocs/Portability.html | 88 +- docs/htmldocs/ProfileMgmt.html | 1005 +- docs/htmldocs/SWAT.html | 384 +- docs/htmldocs/Samba-Developers-Guide.html | 252 +- docs/htmldocs/Samba-HOWTO-Collection.html | 19052 +++--- docs/htmldocs/SambaHA.html | 4 +- docs/htmldocs/ServerType.html | 336 +- docs/htmldocs/StandAloneServer.html | 121 +- docs/htmldocs/VFS.html | 148 +- docs/htmldocs/bugreport.html | 118 +- docs/htmldocs/compiling.html | 234 +- docs/htmldocs/diagnosis.html | 354 +- docs/htmldocs/domain-member.html | 635 +- docs/htmldocs/findsmb.1.html | 2 +- docs/htmldocs/groupmapping.html | 278 +- docs/htmldocs/install.html | 189 +- docs/htmldocs/integrate-ms-networks.html | 310 +- docs/htmldocs/introduction.html | 5 +- docs/htmldocs/ix01.html | 41 +- docs/htmldocs/lmhosts.5.html | 4 +- docs/htmldocs/locking.html | 506 +- docs/htmldocs/migration.html | 2 +- docs/htmldocs/msdfs.html | 83 +- docs/htmldocs/net.8.html | 6 +- docs/htmldocs/nmbd.8.html | 22 +- docs/htmldocs/nmblookup.1.html | 18 +- docs/htmldocs/ntlm_auth.1.html | 8 +- docs/htmldocs/optional.html | 39 +- docs/htmldocs/pam.html | 481 +- docs/htmldocs/passdb.html | 732 +- docs/htmldocs/pdbedit.8.html | 8 +- docs/htmldocs/pr01.html | 6 +- docs/htmldocs/pr02.html | 2 +- docs/htmldocs/printing.html | 3040 +- docs/htmldocs/problems.html | 227 +- docs/htmldocs/rpcclient.1.html | 12 +- docs/htmldocs/samba-bdc.html | 428 +- docs/htmldocs/samba-pdc.html | 596 +- docs/htmldocs/samba.7.html | 26 +- docs/htmldocs/securing-samba.html | 210 +- docs/htmldocs/smb.conf.5.html | 819 +- docs/htmldocs/smbcacls.1.html | 12 +- docs/htmldocs/smbclient.1.html | 62 +- docs/htmldocs/smbcontrol.1.html | 20 +- docs/htmldocs/smbcquotas.1.html | 12 +- docs/htmldocs/smbd.8.html | 26 +- docs/htmldocs/smbmnt.8.html | 4 +- docs/htmldocs/smbmount.8.html | 6 +- docs/htmldocs/smbpasswd.5.html | 4 +- docs/htmldocs/smbpasswd.8.html | 6 +- docs/htmldocs/smbsh.1.html | 12 +- docs/htmldocs/smbspool.8.html | 4 +- docs/htmldocs/smbstatus.1.html | 14 +- docs/htmldocs/smbtar.1.html | 8 +- docs/htmldocs/smbtree.1.html | 8 +- docs/htmldocs/smbumount.8.html | 4 +- docs/htmldocs/speed.html | 153 +- docs/htmldocs/swat.8.html | 12 +- docs/htmldocs/testparm.1.html | 8 +- docs/htmldocs/testprns.1.html | 4 +- docs/htmldocs/troubleshooting.html | 2 +- docs/htmldocs/type.html | 4 +- docs/htmldocs/unicode.html | 78 +- docs/htmldocs/upgrading-to-3.0.html | 240 +- docs/htmldocs/vfstest.1.html | 8 +- docs/htmldocs/wbinfo.1.html | 4 +- docs/htmldocs/winbind.html | 714 +- docs/htmldocs/winbindd.8.html | 26 +- docs/manpages/net.8 | 2 +- docs/manpages/nmbd.8 | 4 +- docs/manpages/nmblookup.1 | 4 +- docs/manpages/ntlm_auth.1 | 4 +- docs/manpages/pdbedit.8 | 4 +- docs/manpages/rpcclient.1 | 4 +- docs/manpages/smb.conf.5 | 60 +- docs/manpages/smbcacls.1 | 8 +- docs/manpages/smbclient.1 | 4 +- docs/manpages/smbcquotas.1 | 6 +- docs/manpages/smbd.8 | 4 +- docs/manpages/smbsh.1 | 2 +- docs/manpages/smbstatus.1 | 4 +- docs/manpages/smbtree.1 | 4 +- docs/manpages/swat.8 | 4 +- docs/manpages/testparm.1 | 2 +- docs/manpages/vfstest.1 | 4 +- docs/manpages/wbinfo.1 | 2 +- docs/manpages/winbindd.8 | 4 +- examples/LDAP/smbldap-tools/smbldap-groupadd.pl | 5 +- examples/LDAP/smbldap-tools/smbldap-groupdel.pl | 9 +- examples/LDAP/smbldap-tools/smbldap-groupshow.pl | 6 +- .../LDAP/smbldap-tools/smbldap-migrate-accounts.pl | 60 +- .../LDAP/smbldap-tools/smbldap-migrate-groups.pl | 6 +- examples/LDAP/smbldap-tools/smbldap-passwd.pl | 58 +- examples/LDAP/smbldap-tools/smbldap-populate.pl | 45 +- examples/LDAP/smbldap-tools/smbldap-useradd.pl | 176 +- examples/LDAP/smbldap-tools/smbldap-userdel.pl | 3 + examples/LDAP/smbldap-tools/smbldap-usermod.pl | 203 +- examples/LDAP/smbldap-tools/smbldap-usershow.pl | 5 +- examples/LDAP/smbldap-tools/smbldap_conf.pm | 118 +- examples/LDAP/smbldap-tools/smbldap_tools.pm | 551 +- packaging/Debian/README | 10 +- packaging/Debian/debian/README.build-upstream | 10 +- packaging/Debian/debian/changelog | 21 +- packaging/Debian/debian/patches/fhs.patch | 2 +- packaging/Debian/debian/patches/samba.patch | 4 +- packaging/Debian/debian/rules | 3 +- packaging/RedHat/samba.spec.tmpl | 1 + 166 files changed, 66435 insertions(+), 61807 deletions(-) diff --git a/docs/Samba-Developers-Guide.pdf b/docs/Samba-Developers-Guide.pdf index fd5ddf3fcf..6e3a6112e5 100644 --- a/docs/Samba-Developers-Guide.pdf +++ b/docs/Samba-Developers-Guide.pdf @@ -1389,12 +1389,14 @@ endobj << /S /GoTo /D [930 0 R /Fit ] >> endobj 932 0 obj << -/Length 230 +/Length 240 /Filter /FlateDecode >> stream -xÚ‘ÁNÃ0 †ï} -ÓCLÇNrìLBâDoˆ+‰iˆ­> stream @@ -8244,29 +8246,22 @@ x G!¬00$.Êb퀂¸¸(DH"$ `Ê£œ=Ñp;{ CžóW’(PÖ ††C­@ +Œ=Ì Wj…ê¡ pÆ“(‹@upêÂ\ah7˜ ÚÀ¡ 5ÌŽðÿr¤Š´EEÿ’m°Îÿ¹ÁЮ8S@œIN ΢ ‰ðÚÀlüš(\/ÎÉÿ†©WÂ"šVN¿ÊÿžÒÄ­œàÏe œœ±¨²¡‘ÿL5‚ýeNfÇ:ý3ªŠ±BÀ¡²H; (ð—wU‚{Àl´á¨=ÐÖ á -û­Ã6ÿ4Üo üòÊ -ÆÜÿºÑßAm+8£ïéüwÙ_Ù¿tÁ¸ù á@3>.÷û÷›Å?š)"¡(8·"` må ÀíŽD€^ ióÂ(m¸Ä¦Œ/»Y.§=ªe0ÞMÓð\r¾}´~µ¾jtÖðto~‚É‹öŒíŽõlmý¢Ï,x-fn-Ï‚Á¢ÆJiƒÐÇeìB,º”).ùa¡_Ü)â ¿ ù:„×pOí °TǹÄÏŸž›ÒÄ\ƒ6ö¯…EUˆO®Vt¥¼ÃT.ìÅaùÜmËN—§õ’Kå)Wã8ŒÇÓç‘yˆÐN苲s°à-ýRÁ¨8ƒš ¨ÕcSZV¡¢ÜA¹š‰ô(Š4¡¥ %”WMk׋ õÉŸ§NÒË€Ýþæ–BÒ6þ¨>àˆ7¤nUûÆ[ëÓ};b>Ó…!ùtn“ƒØ%ïçÓ*ô„WRA¥:’ê4VÎ÷ÒÔj”F©†&"Fˆnïð6d÷uT4´F_)ŽSýòM—,¦ŽÚ1p~Îó*^Ù þÛ[äÊÕNoB‘ Ö¨ëûN9ò×üšÅc’×M܉6 ž¾u Jkt¥“Ù.å7>h_µ°é=YüÑÛ¶ì ,ç#©A&—’ãiÀæO Z{· áé5~ÐåÖ›¡>2G7QËc°Þ•ŒE½†n™ƒCÝJŸ_å¼rÞ$Ÿ(_鳞عÿŠæ}4úyèw’Ø®6uößÇZh©„í¦d³xQöÆ}Î- ºïÝ]’ÔµFÛ?,\–}˜ú­ûdcyÖ0¼æÞM‡xþ¬V“âØV½í!‡ì@DØÝC⨉Ԉ‡÷N¤Î!Ï;áN‹sCÑïÆWÕ@ØS±Ÿï¹ÒÉê©ó‰“£Rš—.i…©\¬.;»sÐK^¢X@@@¸°ïâÔqÏ -ô8ËÄ{Þý¬EpOüví|d5½@a( TѪŒ—úýñ9€ê½"ü¶ãm<±·Ñ“©Mž·zSkU)á‘J¬šk±T¡+ŒTIïAbš‡7ÃøaMàxÄÕñãÉÏ^jàÚká¬!ËoóÑ-ÂñÇS„&Šø=dãL—Rfàúnü!ó¦Ý:qCëZÖ\’ô®=öã“¥˜³¾ÝäC6œ‡!ÉëÐÿ¾ð‰8awFu q\©ÚHÌaÅ1?ä -MœsÒ-¼f9ÅÔLUÿÄæÝصpÍHù}äǹ0˜tsíFRGbÛK´ò’—j›Jh¨VÖ¾Gl‡¯2}Í“`Ò·þÒ»Qš}ùk¼iNùVnG?Ø(ãÒn!ÊÿܾóHùÅnpO/IF[™±ªä -žçfKÛÙç9p<ôÀ¡î¡K©ðW¦‹{'”P/Y.~MÇž{Ó·êý£»ö«|»ä˜M&m’ÛQê²j²µ Íàt‘oê,ôÎëâz݉qòB²«!JæZ=žgã\·™…œleÜ{T"cɹW1æ­óS2–ÅÅ:E…“4’žBÎ!0§­ -©èe¦Ú<ñ:ÑÝ/f˾S1ñKsª’¢x?Ì4ÇT]\®Z§ä~Xk¾ä ~5m¦èíÞµ%OáÞÍ(ÝîBÛ/Ç]Úéòú»áM‡˜Ü5u$EPð'Ê»šÚWúæŠRgMß8J½÷›õ{6õ=ªæÚ)îžnÙšÈÁœû:ùP$3eàù«ýå­ÍòŸ?ØÆàs¤Pã„<òF•å”d§À½Ø]5/þ¨óÔ—ÙeI0íwAÙBjš¯ÅAvÜb%+êe}ùžMÝÕñôçec5ÛôCOc-ž š¥ÖSîˆþ[µŠqÒAâ÷SŽxZ*u̹D<ÙŸ> -Ÿ&·• ¤@Þ]&·‘Ï -üÔõÏ·å«°Lúþéd}Žå@‰€Rgtì(Ú¦Ä%ÎtÖ!xò¨™ƒ§Ô;$”1‚Ë›—¿^ÂÛYV2Ì·³,Ýà,¢=,'MdÒ’Çô@jh$Ó ë‘¨eá`•¼ •ÌívnáCÄÎ鯢K©i†0{̃‹”W…<îš9WÕÒÕ\Mß°Õ4Yþ¤H¾î4Û5á7_ÕEšÀùìNÅð¾Îؘ%Fo’&í—MøˆñÄNøl‚*m6ikòVëÌ¢äĸ1Që¤:N˜b«ç0a^7 â.9­‰„ò7éìI‰Ôt†â_‘ÂPkÞ=¯ïËrÉ|ßuÎM¸Ÿ§w -O•íxËÙ^ÀÑÏ^I/Å5òâ°ß3OÔ¹…ýöJhXè -°çÙÔ#,Â’…~Ió‘Å|ô‡’&Y‰üÅ)1¼ ½ÛÓ†R¼Q¶ÌŒ¨1I¤Ñ\­Ã«D­sùÚã(‚ µF»ËiñocõÜX¼£"\öõ¾Û^؉ê!ï]»V„‰7¢Z.ã³VÆå£Ä˜ZBPN"ÅôÀ÷"m»ä”xvxWvyOî›pn.é2Ëî?L-Òϳ›©Êm2º&¯bÛðÅUºÏ⺰Åï!äëúY뀤ƒ3ÒB#¢Þ+g=Å£²êÝÐ¥˜æ…+r' koøë‹×ò` itü3`/YP nt˜öþŽ²Æp2ÏÚfË·{Mäã(’}æ|Ä“ïWåÕÿH@ßœi”WWý–WÞºD´á ¥ò¶iÕ9²º¼Ø÷uáz¾ˆÿf›;õBÙ©œ#E_L%ŠNr˜ä¸çTŽújèìÁE_@4)\cb¼ f¨*ðý™K© -"y@ãŦV8¢-Ð+èƒÝ -Ó”êWM£oi{7HÍ­íªû>,äƦÌÀSš¾$ -I÷Tm?¡rÚ{“×:~ÒzbôA¯”¦ý*Ÿïº6»7L OKÉÍ3+’¢ËZe¡–“¼Ó}Í„—h>[ Ð6SuqßbÚ:¦‹‘®ë^— µXm*ÑÔ°=Zõ°‰ñ%d¨¶ðO¢p"¥Z;Æ$…K¼Uœ*1ø&_·ü¼;î€<îˆa»ëy`”G_òØhaa‡Š—{®¨ñ0úÉz²Íwk‡}{A¢¦¢Ú…×buOÔNÖ8ny¬m…’e¤­µµM‰HÆ$¾d ã Œ5täm(‡[Ó¦~UÿFƒWPð °)®½`ôíÊuÏôÔ6úÈXx—¤§C–š‹ê£òÄ…´úþì/_åîÔuß„æÈ£»£Döå’Þ³“Ø;?çôõ}Ê/ -÷ëR4¬ýdù@†?øª_OÈÏ Ü©4e¶uÍ#ÁG{GA“ßì¹{ÙMÍnßò÷^ö[f³Õ V¶þyŠq¡¸ÿ24ñòq,Bˆzïn‘·ÉªŸOÿMöÄ–Ña½îWê[ÊÞ-^èY\WD9ø…@8fht)N k¸¹ ´ÞúÐÝ­áÔ¨q”ï¸Ëp·<+2²Ì½õ!ÝK¢ÛÖÁ+_—‘³qã“SöÀ|„Ú­‡ñÇxe‡_ù‹Ê°2,QB‡»á];ÍÃÏ-¦b|“¥!…ÍW–?Æ­Óˆ&î/ oQ86›žK¸Ž£9á[Wúü÷›¢ož Úxµ™¥™jÑy<\Ó&—ôAÖċÓEéÍ^šß])|I3#Jç•š Ý¼¨{¾É«û32²^ [͇”C<•øœ³È›°ž<A7ÛÀ¾ ÍÀÛ4Sшú„ß÷rÛ5íÐ RJȶ.è -R-a¿ÏHü1ôóUtj“g{!¼tS#Þ_YùŠÏÖÄÛ5x}çL&Ò|N­È -¨L)n“ÊU¾¯ü¿þ®ñùÛžÀ@—VÈ‹,9¹Ñ5­^õȳZ.¡×A:xpYÝ õ+\‡e”ÙøsµÒ$x%M§<É¢ñ{ú1Ï.ï?¢á+x9dFáQãÞ˜û¹íP_^àh£ç>âúb¤£Ü”þ®UëØNŠØ~‚Á·r® Ùª·ô•š·Æö‘T§´”ø „U¾§Ó•t·«|?>veÏVhÈÝ{¥+HFõ™Z‰nÙØo«–‰ü:—Ä3¼¬©z Õý0Of:ËVëQý)ï•‚l¯”Ìv—.¿m:aâ$ö®lJç2•ó² ))Ô\B¢îõ¯'ü'Ì¥Ï8e=IVÈž^¬ã»;„z&H™ÎL¤îæw(MI.óÖu@as›e:MÔcæ4gŒƒÏ -ÆyÇŒZ°E¢¶±óõÂÖë`„TN~úkVa|$^hªL,âææªÚtŒ„ÈÉ\uõµ­»…ŸQ'&]"ŠëzøÁsñkìN"%Œ‹-/™ÿxFøZ©é«·ÏX£’ÎåA>‰fÎÙžœé\©ÀÁ0Ñ·»…‰ûØMòKݼ©Ío‡¸˜âèR°šôr^‡÷¬5fvÅW -“ÿ4§¸8sÛºÄ8Ù ÎÜq×aesž‘Eí2ž§äÂû7uݨÔVéZÐ7ŸzVGÌk)|ö¤?`Smçk¨¿ÙlGæ_ѳb®“~¨`­xØäÑ*ÏvZºìê0æÔ"Æ)¹u:§Búm3Ǩx„Œndá=—3] Î]H+i& Žó×~0x•,Ž¥ZgN¹êz' –]Lâçë<=Ìâ8GM›%ûöIV¸nšÌ„»’=ÊÛ„ïâ°g)/jœxe®°ú|Ñ !82ù0@¦|°ð“ý°C ›çÈgÛœ{ì‰Ôþ5ãJ5ÞÚÒ„ÊÔ•nC® áEÌÓõ½^½ËšôÈiõ@Øãi.?ík‚ÖO6XҚ׬–«>-”=Ð;ýOç÷ÀÃj‰šýw4Yµý +De€dtãÍÎÓÎ*G Ï–RÍ8‰ÍwÙô6Ïs‰4ßU~òß‘½ c¸¿Àìû£fY~ñ@·¡iÁÒQÆÁúš’Jµ¿Ö)‘w~*ãÃ৊E“3m}¶¹Ù-.‹\{6wm€ÿ/ð¢³BcPNVhGÀ¬d \endstream +û­Ã6ÿ4Üo ü÷55 ¹ÿu£¿ƒÚVp$FßÓùﲿ²3è‚qóAÃ=€f| \"î÷ï7‹4SDBQ6p$n%DÀ@+4ÚÊ€Û ‰½@@8Òæ„yàóó!QÜ n(>@[ðëBA‚@~[ø/í7 + ù­Ð0$f‹¹PAÿRÿºÏ¿e0NÆÝ(Êæo Œ“ä.H ȯpAâ@~Å¿ITȯzA¸sê$ŠÝáÎiýMb8‡Ú„³¯{A¸šz$ ä׿  ¿ÁáúþM¸Õä·º œkë Âu‡þM \{›?7Øøkš Î݈3dÿâÁÿ@œ Ç?çñâl8] n›ø‘ ÎêÄÙpþq}Ñ ®¯ëˆæÄÙÀþ¸¾î(ˆkäùÿsååäP^¼`WPD77q ¨ˆ¸ÏÏ3@Â]°0U ˆ€€€n>¿T(Û-Ìï?Ü×ôo¶…ã¾=Ì|GA%‚’«Bò}sß\æ—³«ŽÕ,7ÒH4‡xÕ£æÂ5]f|\FM±|y™Ùý”Á5¢Á[çƒÒV€KlÊØù²›årÚ£ZãÝ4 Ï%çÛ‡AëWë«F÷¾‰àk O÷æ'˜¼hÏØîXÏÖæPÐ_!úÌ‚×bæVÑò,,j¬”†0}\Æ.Ä¢K™â’&úÅ2!žðË@¯C(q ÷ÔªKuœKüüé¹ù!MÌ5hcÿZX4Q…øÔèjE÷PÊ;1LåòÑÉ^<–ÏݶìtyZ/™±TN‘r5^Ãx<}î©‘‡턾(; ÞÒ/ŒŠ3¨Ù€Z=6¥¡e +)Ê”«™H¢HZš‘PByÕ´v½ØPŸüipê$½ Øíon)„ mãêŽxCêVµo¼µ>-Ñ·#æá3QQ’Oç690ˆ]ò~>­BÿHx%Tª#©.@cå|/M­Fi”jhò(b„èöoCv_GECkô•’á8Õ/ßtÉbê¨çç<¯â•Ýààß¹½E®\ `àÔјñ&Ù`ºÞ¸ï”#ͯéP<&y=ÑÄhÚáé[Ç ´FWP:Ù˜íR~ãƒöU ›Þ“ŽmËÂr>’dòw)9žühþÄ µw Ž^ã]n½êƒ stµ<kà]yÀX”Ñkè¶Áá98Ô­ôùUÎ+çMð‰ò•>ëyáÍ‘û¯hÞGs Ÿ‡~'‰íz`Sgÿ}¬…–JØnJ–1‹eoÜçܲ ûÞÝE YA]k´ýÃÂeÙ‡©OЊ±O6–g óÀkîQÐtˆçÏÁj5)ŽmÕû×rÈD„Ý-0$þšHxxïDêò¼î´87ýn|U-„=ûùž+¬ž:Ÿ89*¥yé’V˜ÊUÁÚé²³Û1½¤á%Šd û.N÷¬@³L¼ç­ÑÏÚY÷Äo×ÎGVÓ †’@­Êx©ßŸ¨Þ+ÒÁo;ÞÆ{=™ +Ðäy«7µV•Ù( ÄªY±KºÂXA•ô$©yx3ŒÖŽ—A\?žü쥮½Î²ü†1Ý"Yúù7ëÛM>dÃy’¼ýï ŸˆvgT·Ç•ªÈVüóƒA®PÑÄ9'ÝÂk–SLÍTõOlÞ] gÐŒ”ßG~œ ÃÃ6oØkëÒRÖ1À{{9ØD\µGØ›Î@v=Tˆ£ÐxG²‹.¹ÝžìŠ”4ÏØÍ\L†Õ)i¿è¤êÇßåøùˆvPAœŸªw10Ø!8¦‡º¨†fšÇÌy˜[Ì©‘¸ËCyëOI9S+ª¬šµH…fúi؉zGÌÁ}DÍn©fÞ› #Ýí=ʶ¿ÑÅw…²+ŸjQÚ•K•ÓêƒI7×n$u$¶½D+/yÉ©¶Ù©„&Œjeí{Ävø*Ó×< &}ë/}±¥Ù—¿Æ ‘æ”oåvôÓ‰í2.톢üÏí 1”_ì÷ô’d$±•«J®àyn¶´}žÇC\êÚ±” +eº¸wB õ’åâ×tì¹7}«Þ?ºk¿Ê·KŽÙdÒ&¹ ¥Þ) ¡&[ Ò Nù¦ÎBÐHï¼.®×è'/$»¢d®Õãy6Îu›¹QÈÉVƽG%2–œ{õcÞ:?Õ)cY\¬ST8I#©á)ä"sÚªŠ^fªÍ¯Ýýb¶,AàË1¿4§*)Š÷ÃLsLUÑÅåªuJñà‡µæHêWsÑfŠÞî][òîÝŒÒí.´ýñrÜ¥.¯¿ÞtˆÉ]ãPGR¢¼«©}¥oÞ¨X!µqÖô£Ô{¿Y¿gXߣj®âîé–ý¡‰üÁ¹¯“/E2ÓQ>Ü‘»Ú_ÞÚ,ßñ9ñƒm >çAj5NÈ#oTYNIv +Ü‹ÝUóâ:O}™ Q–Ó~”-¤¦ùjQldÇ-V2±¢^Ö—ïÙDÑ}PO^6V³M?1ô4Öâ¹ Yj=åŽè±U«'$þw°1èx€§¥RÇœKÄ“ýé£ðirëP¹@ +äÝeòpù¬ÐÁ@]ñ|[¾ +ˤïŸNÖ‡áøX”(uFÇŽ¢mJ\âLg‚×)š9xJ½CB#¸¼yùë%¼e%Ã|;ËÒmÎ"ÚÃrÒD&} yL¤†ÖA2°YZV‰ÁÛPÉÜnç~1Dìœþ*º”šf³Ç<¸HyUÈã®™sU-]ÍÕô [M“åOŠäëN³]~óU]¤ œÏîT ïëŒYbô÷&i2ÜzÙ„Oì„Ï&¨Òf“¶&oµÎ,JNìµNªã„)¶zæu*î’ÓšH(“În”HýAg(þ) µæÝóúN±3ÍEù<ÑæúÙ—“%pÜ^ îï²·/ v½fîÝjà`Ì™iŸÒ0ælN4R'þÊLñ3GÁЖÄ‚÷¢à‹¾¯÷%bŸR›É.~'’I^_ R¼Ó +&m‰]ƒß/ik¿UìkÌì» Þ¤`Ëjm2‘O9òhïÒ©Þ `ar€«êP0üdA3æ [Ú®¯mdiÄÑël¡)óù`X‚¦N?dØÅ<ûd¶à®ïõZø~®Qm8Ͷ;Ù$ÿÄÕs@¦ì]sû?wÿ¾°Åv· >ƒñSÕÈ/£JåW:ïqÊŸ¾Ö‹óÇê“[Øo¯„†…®{žM=Â",Yè—4ùXÌG(i’•È_œrÛл=m(5ÁeË̈“DÍÕ: ¹J”‘Ñ:—¯=Ž"ÈPk´»\ÿ6V?À%À;*Â`_ï»í…¨~òÞµk`E˜x#ªå2>ke`\>JŒ©%å$RLÏ|/Ò¶KN‰g‡we—÷ä¾ çæ’.³ìþÃÔ"ý<»™ªÜ&£kò*¶ _\¥û,® [|ñr@¾®ŸµH:8#-4Ò ê½rØSü0*«Þ ]Ši^¸Â“%Øùé »½ùw70ÓŠRéX£%“)+±&xä)o,˱»slNÚZI›‚0­×)F&åí¾‘ó«\MÞã1ÁÛ9*gµ~rÕQŠû(ÝH¸r)q9FLEåäl`%¯(:3“[ÃVÄõ†i’Ë^óßñM ²¥»^›ôk½¿êv¯…8Ú.b`QOà²6&‘h¶rݸ&^úEg7ÿHY*øAe:ÍOÒSòÎ?‡oÓÛrâ‰L„­¢þ#꙳â7L#_Ö†‹0¢~¨Y>÷Ÿ–Vb=Ü^8ì=«d,ù–õæÎ¥óžÙlj´R¼¹eRì÷žæ#w’°ö†/°¾x-Æð—FÇ?ö’êF‡iïï(k 'ó¬m¶|»×D>Ž"ÙwaÎG<9ð~qU^ýôÍ™FYpuÕo q%á­KDR*o›V#«Ë‹}_®ç‹øo¶¹S/”Ê9RôÅT¢è$‡IŽ{Nuਯ†Î\ôDA“Â5&Æ»±`†ªß¹”ª ‚‘G4^lj…#Ú‚½‚>Ø­0MY¡~Õ4êñ–¶WqƒÔÜJЮºïÃBnlÊ <©éK¢ÄqOÕö*§½7y­ã'­'FôJiÚ¯òùÞ¨k³{ÃÄð´”LÑ<³")º¬Uj9À;Ý×Lx‰æ³µmC1U÷-¦­cºéºîÅq¹P‹Õ¦M Û£U›_Bæj ÿ$jñ‡!RªµcLR¸Ä[Å©CoòÕqËÏ»ãÈ㎶»žFyô%v¨x¹çŠ£Ÿ¬'KÑ|·vØ·$j*ª]x-V÷Dídƒàf‘ÇÚV(9QFÚšQ‹QÛ”ˆdLâKÖ0¾ÀˆQCGŽÐ†‚q¸5mêàWõo4x ›âÚ ¶Aß®\÷LOm£Œ…qIz:d©±¨>*O\H«ïÏþbñUîN]7ü IhŽ8º;Jd_.é=;ùa½cðsN_ߧü¢p¿.EÃÚO–„`øƒ¯úõ„ü¼ÀJóWv`[Ñ<|´wÔ4ùÍž»—ÝÔìö-ïe¿e6[ be럧Šû_!C? Ç"„¨÷Þè6y›¬úùôßÙdOŒ`Öë~¥¾¥ éÝâ…žÅuE”s€_„c†FW ‘â´°†› Bë­ÝÝNšGù~» w˳"s ËÜ[Ò½$Z°m<±òu97î19eÌG¨ÝzŒWFpø•¿¨ +Ã%t¸NÑõ¸Ó<ülÑòh*Æ7YrPØ|eùcÜ:hâþZðÖ…c³é¹„ë8š¾u¥Ï¿)úVìË W›‘Yš©ÇÃ5mrI4lI¼8]”Þì¥ùݵ‘—43¢t^y  ÚÍ‹ºç›¼:±_1“!#ëÕ°õ8Ð|H9$àáÀS‰Ï1‹¼ ëÉst³ <áÛÐ L°M3¨Oø}/·]Ó ò ¥„ i뢮 ÕâöûŒÄC?_ÕI§6y¶ÀK75â=𕕯ølM ù±]ƒ×wÎd"ÍçÑúˆüØ €Ê”â6©\åûÊoñëí ti…¼È’“ÝyQÓêU<«åz”¡Ó—ÕÝP¿ÂÕxXF™?gPû(M‚WÒtÊ“,¿§óìòþ#¾‚—Cf1ÛõåŽ6zî)®/F:Ê=A@éïZµŽí¤ˆí'|+çÊ­zK_©yklIuJK‰Ï@Xå{:]Iwû°Ê÷ãcWöl…†Ü½Wº‚d´QŸ©•è–ý¶j™È¯sI<ÃËšªZÝód¦³l`µÕŸò^)ÉöJÉL`wéòÛ¦)N2‘aïʦtÞ!S9ï r’BÍ%$ê^/üz ~ªX49ÓÖg›ë‘MÑâ²Èµ`s×ÆãFVærךLóHsm/ydyñ0dÖY2Z5ÌK$¤W›{»Ÿ »s¨Ï3?'{µy‹4`Ò;Ë©„ «¿õ²€ws£TÝèÁrúƒ°ÈŒNÿáøÿÿ' +@0+4åd…vü– jendstream endobj 1963 0 obj << /Type /Font @@ -8275,14 +8270,14 @@ endobj /FirstChar 12 /LastChar 121 /Widths 2069 0 R -/BaseFont /CGUDUX+CMSS10 +/BaseFont /MJNMVV+CMSS10 /FontDescriptor 1961 0 R >> endobj 1961 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 -/FontName /CGUDUX+CMSS10 +/FontName /MJNMVV+CMSS10 /ItalicAngle 0 /StemV 78 /XHeight 444 @@ -8306,16 +8301,14 @@ endobj /Filter /FlateDecode >> stream -xÚíR}‰B(dRìó¶ñá1´Ù “H(cÝb•% -!¾hqÉÐ0?ã‚$ Û݉°¨ñaYe‰÷:Ÿm½¤di}!¾éNBI6•0ÜCÕjÞlñŒÆ54Ã`©Fæˆë";„üL¯Œ¶§.†ALèÒ¬S_iyæ3ÊZVŸW+ÿŠ—›<ÐmÜ'¸¹fôÑ7S½Qw”®º ”½‘ÊvÎMì ß×ü¬[õ$û›W™ØÀ¼ -·ï`oZãÌ›MÈY¤»°^'àÔÔ×óÝzò§máOÔ³íRòÜ:²¿U!YJBž7cIÃQË2(i+Z®Û©VÕä;ã·š‡Ÿ‰éKªËùûLmçw.ñ÷~zTÙ´«ûó*o… /—D˜ÓŽ¶ç„º¤Øžñ8ÔØ<æ$1È‚ ¯VâƒüW½œ—ŽrUnï®1ÄYh‘us×v|“Ÿ™’o›)ìãJ/¹JÎìxm-ðK–Ú¼u‚êo}àÕš¶7+׉M‹4³<=7è9®Ð\f‘I¤wœ—Üu¤7I·k¥Îs*W,ܯ&§çùm¸ß$wí­MI×ÔØ&-çYÕî¤!ò»–vîp9¯Frèo4“ík¾¢˜Td[°ôû>}i›®Þþ zc˜_ë<µ»VºG}[Wv£¨zK×xifÛV1ÑN5fÉt‰VCíˆeæû¼ûÁwç^`>®³8PCïuzpïãò–0T¤¯nà)Þ@/Çp:õ jmÕSnÜ}²pîð…œ¡ “ÄÄñÜ Ý8_^GÒ-ÿ‘¾AMåk76HCûŸÇw'ë—w‡ý:ȉôÔÑ«’ÁОÐ]Õ7Ú̾¢H€G~“²€y¶—ÊÄØ-õÒ™–‡­;^¤m9qåʼnõeUâSNõÒ›6_Ÿdérõ6‚ÊA{òºŽNW¼y™Av¬g¨,]+©˜?å¿“W]0ÕºÜã'¹Ý Œ²o*ußJÔ NO¹užTö~ç]w ՞ъ¥ã1³ÌéÄ|¼`^8ĺû£îI•‚âækÆ®^:OÅ«%ì\–žF[ý¼hE±Kª3Ãد/U' -þyÊ:EËw´P'&E*ßM>8¹jíñ±Ž¡È+aÕâúë“ ³_ÎòŽ3H£z¥YÙŽ^÷TìJ´úåù]¹5ÃŽàž0?Ó¦7g§³úíË·R‹nZî†VÌm£e)šöB³ÛK•Œt˜ÎÏÃã&E±kKz_úž{Ql¸ÉÁø­Êòܪgé»’?ú7&tb(·{/Ã5;;ßm~èF­#9©Oô–áÃ1íºTss¹õ˜›ƒôzbïÚçº+‹|Öc[‚-ùîÌÙ¦‹]m}Æ·‡\•Êb½}8¸·8>ŸùºSF+)• Ç ÷5—% j™“ñ¬-ï«œFB¯Kc*uv++áY}¼ã—MÆ„ÄKÁº‡>Ì^S YñÖË+d(|S³x=Ôñ}"ÜŽpžj§z¶½š<‡5Ü·ûâ(Ó«>¾ôuîŒgEÒ¦P|‘ö¼ä˜‚’lüÕF\ÓÓÇ&Yþ?”ÆÆ9Q‡Îi -Xjo3ƒr1ƒ8ãÔQÓËËÞpÝT6£±"ÎÐsv*`"çþŒ)ù;y–Râš¼¼1»*oý‰ ¿<ú¾½•Zä§ÙQ™pxtúf‹ße|geOyuÎ@YõLUqt’1˜®,-/Æ`Rü'•‹Ñ"œ¾íØVY'#µÆ+_*>Â\Ù¯¼U!?BÍ:ÛóØ£ ® &·Mû|£’ÙµÔToµÞÓ3\Yra¿öåªå]F=Ûö©ŠxaÓ]ðê<õGÞüãÚ‡òé& ×U(ǪjMTÜê;߉“‹iåË]àFÅÉ€[K|ô¤¦9åóÑE[Òç­ÒŽ%ðöË4\̵Òs}¤«´Ê,V»Le“þÇû—ÀŸB€Å…˜BÂc -ñ¿ÖýŸD¡2)ö¿yÛyH„ÞêI$9cÃR•)`žpiÉäa~Æ!ˆ÷o³u]ß¹$ÜûéurUóîìÏk¼‚N¼\aN;Ú‘ê’j{ÆãÐÀaó˜“Ô )ºZ…ò_sôr~jÈQ=f¸£§ÖWl¡EÖÍ[ßCðMyfBJ¹m~¤¨_„k:*¹ä*>³óµ5ß/EbÿñÖ ª¿õWëfU˜Ø¾4¬L'6=ÒÌòôpÜç„BK¹E‘Þy^|בÞ2,fÜ®“8Ϩ\±p¿š’‘ï·é~³Ìµ¯.5CSc»¤h‚kU·—ŸŽFÈNì^ÞµsÐå¼Éa ÉLº¿åŠbr±máòïúõ%íºzñôÆ1¿64z6iwó­tú¶­î!F=Põ–<>®ñÒ̶½rràœj̲4*éb­ÆºQˬ÷»¸÷ƒïοÀ|Ü`q –ÞçôàÞÇ•EL5`¸X_ÝÀ7R´‰^awê;ÔÙª§Þ¸û$~hþð…ÜáL“¤¤‰¼M=8_ngò4­à‘¾AmÕk'6HCûÇ÷$ëWô„ý:ÄŽôÔѽåÚƒŽø´ùÓÀZºÚ›àŽúŸ5)àxoèîšíf +_QÄÀ#¿)iÀËKerü–zÙlëö/ÒOµž¸ò÷’¤†òjQ£)»fùM›¯O2u9z›Aå ½ùÝGg*ß¼Ì$;60T–oÄ•V.œòßÅŽkðÃÞ.œn[éñ“ÌÎîFÙ7ºÿ%ê$»·Â:_"}¿ë®»†jïXåò‰˜9h&©ÀÏ_ 3ïþ¨{R¥°¤åš±«—ΓC ªF‰»Vd¤ÓÖG?/^Uâ’æÌ°âõe¯ê…á#?ÂÙ§hŽêÄä¨1ò»©²'׬?>Þ99x%¬²FÔp}ŠaöËYîqiL¯,;ÇÑ랊]©Ö€¬ ;¯vÄÜægÚ¼ùæÜL`ö€}Å6jñmCË=ðª£í´lEÓ>xnG™’‘äü<Ó¡K57—Y»9H®'õ­®»ºØg#¶5Ø’çÍ5_ìnï×0Èô0¾=ìªT{ìíá}% Ðë2L9u¾´L:ƒÞ×\–6ªeM%0¿o\í4z]3X¥³GY Ïìç¿l2.h"^ +Ö8ôaîšZȪ·^^!Ãá[ZD!˜_Ïó‰p;Â~ªæÙþvzêÖpÿž‹cWCBÙ êüÏÊä-¡øbíñ1%éī͸æ§M²ý<(‰;Œs¢ŸÓ +ä3ÕÞ(fåa†pÆic¦—ÿ’³éº©tVcUœ¡çÜtÀdîýYSòw²l¥¤uùùãvÕ6Þú“~yô׎6j±ŸfgUâá±™›­~—ñÉìÕ½5¹m¤5³Õ%ÑÉÆ`†²´¼ƒIõŸR.9D‹pú¶swXU½”Ô– |©0øt*´z@y›B(~”š}¶÷±Ga\am^»öù&%³ki¨Þj}§g9Ò”¢í;ÊÕ+»zw$ìWrÃfº‘µùêŽÜ…IƵ3Í@Ÿ«€?'Ô!Ô™¨:¸5t½†§”Ð*V*º MŠS·–ù6êILs+¢=2‹¿ÏX°J?–È—j¸˜k=¤çùHÖh•[¬u™Î!ýöÿ +&†B” ±ÿ1¨> endobj 1958 0 obj << /Ascent 514 /CapHeight 683 /Descent 0 -/FontName /DJSYEA+CMCSC10 +/FontName /MNVKIE+CMCSC10 /ItalicAngle 0 /StemV 72 /XHeight 431 @@ -8351,16 +8344,13 @@ endobj /Length1 777 /Length2 1024 /Length3 532 -/Length 1588 +/Length 1587 /Filter /FlateDecode >> stream -xÚíRiTWEŽ¢†rµôQÄa ÅÊ^6¡@Ý1d^ÈÀd&N&EŠ¶XÄ¥A)x@±ˆÁ½ (Ki…VAl±DŠ”£b‘ºuÀzzª?Û_=ù3÷ûî»ßû>KóÐp[„ˆ…¾NÙrÙ\>ð -ö÷är 8†¥¥ JàÞ -ò×ÕÕ È1`ï8Î|ž#Š¼i2‰Æ‰)`åÅš"9 $Q¡ÁJ %´†P€pBˆB*™ <0 „M0(ƒd"DØ . ¨±0ÅvS¦üqœ_•¹ôu+’2Ú°š¶É´I„À±d€@ÃnAOƒ´—ÃÖ›â¾r [%LÉ¿Šê-‚@‚bÉR‰TNA$ñ7©kà+wžöÖJ€¡B<ƒÀ–ëÈæ8¾ª£2_T‘P”ŠH€ÉàtâÈ›>èø¦]Ø­÷_ççdóúj§»¡§"’¥pþ¢Ocî_˜‰D ’Ãæp¸4‘~_E¿1ÍŠÇ{ž¤ ™A/x`3 8*hËvlœ è#€f $cê^ì]ÜÔªÑYÑ ÆÛ¿âéI(6ÛryÀÖžG+Ûs€3³åïÄOpt“ú{ÇÅÙÁÕ~º*”“$Ä©é¢czE(,„ -(dôÜ „nÛã‹O}Z™æSv­jK¶¤äÈvu}–ªÄ=ò“ÛüïÉÓÐì¡A–A¨®êËÿî÷û~DÑSÞjµï±á‹ÓÆ;n땸æ*ƒµ3%ŽCy–¿]•íðmíØgÓБqX¢Èfx•†o¾üM’Ñ#ëöÂ]ëwÆŸYÌžŸÛ( ƨ:^»Ô7!)¿¨[ó’1¿úã5¿mt]´íÑdžë8˜äg4éSº+—¼SÄœwýèŠï:Æ¢>ò=w¼pÛ®5ù_,[9¶óìÍ«õ‰è‹Rò‰˜ìê–,<{`å‘‹ï t›bý¶%_Æ5á¼®~ÿrv¥ÏLo-QÞgR°vdÂ*h_&ãÖiÃZê 'd21Å‚”_ÕÄ{‰1C%•:ªf±´w(=2ÀÕõKGÍu_ØÞ¿8æÂ’ø'>›5Z?yýҥܤsÖâ¬äï'æL–w„¬nÒ|É\¦º$m؈ íq«¢£†+Š*Öê´wê¨Ìû}dkn©ÝYé¶xK’º6rnazèü¼:‹òõmñ)Ö3 -ÊòYf=?$Õ1Û®9³g5´-d½¸.²ÕYó{lÞÚ”ÒHå¢47 U|~1‚¹H¯á€j<齌ëU=Ú‰/ëUGMXõZoê–„× R%xÞŒ‰±âZËÃ;È'Õ~a_‰î(kÀH¦EêÙ:¡Ymçh¯–ô  ÒÆÇV<ÈÈúå— 3Ì”¼oë£u7f -±êÁÇ>YS¡=¬iœ™p{ïÞÏuî^•Ý.ŽÚRµAW9#qaÈ3×:i¶[ƒc¼Þ»š=¶¥Ž{öÁ«H÷¹šÒÝW楧„4¥ª<µÍ[NŽäæè{×=Õfj)çm´êz˜å3øAqŒA‚úTêÚrïãÒ„rŽR“Åså3°>ãECWB4Ä33³bŠ¿Jmy™­Ú3èßÜ*5mt<©:ß—ï8N´5„™hìÍùC/Õ)rÔëÕ²[úØ=ÃÊò0›fNšy·×èГ¬eù†•ëÔ-6¡ÖêJ~‰ó˜¸iù¯Ì¥òô'~ƒÆÝž/·©3¾‹KšFgo=v¯´³&å²1«tÿû·OÖÅlxšQõ£gߨÌÜ™BüîU‰w½8;'ÂûÌðŽ3'íù]µ~súê­×Ü·v»4yH—Èæ>ÿ²f›$t/æucRÅÔ}jZé0¾ÉÃ÷»?%tºgŸàüÇñ¿ÀB@ˆAI™ÀønZÀendstream +xÚíRm8Ti–«Tc]‘"mk_+!cãc¬6ßKM,*…4æ¼cgΙΜaH(Y)µZ!mí¨–.J+¾—R>ÖŽ»-©Õšˆd]•’>÷ÐvumýÜýµ×žóçÜÏs¿÷sŸû}¬,‚Cí<"ú8eÇesùÀ[ ðâr 8†••7 …Jà>B +ò×ÍÍ*0àà8.|žœ¼ Y‰ÆJ(`íÍ'¹O)$Q‘!%RZC$Ä@(!B!•ÄžBÆOÈA”C2"l— TD‹â ûqS¸˜.¯ËˆBö¦•I9m +XOØdÚ$BàX@ ˜a¿Œ §AÚË¿aë]q?†-JÇå_GõA(E±¤¿(„T¦  Iü]êJøÚ½7'€b¨ÈÅ °ã:±9N¯ë¨ÜUB$¥D br8Q‡8ò®:¾ öá¾?ÀöÍÕNtƒ…(N…%É à¼¥O`î[L‡D¢JÁas8\šH¿o¾¢Þ™æ‹‹ÅcÏIR˜Ä —ˆF<°ž PJ•´e{6NPô@³ˆ ’1~¯ÎÀ>v|Õè¬èãý_ñò"”ëí¸<`çÀ£•¸ÎÀ…ÇÙðwâr]§€>€Çquqts˜¨Š$ qjb‡è˜Þ`1J' ¡Š×‘ûæ¸Â_–¥ú¼R>…%ŸWth³¦&S]äÎüÍ}æÏäÉÖ0hþÀ(Ó(=lX0´¤Âón™ðLi\jŸÙaÔh0‹µOèÔaÑ`äÝ&UCÝ é¾ì;ß–´¾nù¨;¡fÊ÷K¸.̆¶N.ûõÚ‹‡©ñi-·:õw#–½Œ(ÕÙ¥ùpEwîOOïù‰Î’&ÓÈ=Œ_všÕÝl‹¿aPä¶M%ÐY’!uêϱz|Y¾Å¯©§wmk`kú©2‹ç]ºþ≳ڴäo_}´ÖþÎbfóôøÜ:‘ glj*£ühÕ|¿øÄÜ‚í+ÆÌŠ/V>^ë14wÓÃ/ŒWÍr42ÍM¯7¤ôÏËû €9ãêáE?µGõ~Öïwæhþ¦í+s¿^°xxëé_/×$ /‹mÉ'²½C8gÌÞŇÎOÌÒopŒñß”t׆ŠrÚ{²É©e¾“}tÄ9;d |pÔzé7ÝŒÏ÷¦èh–:#c É–¤â²6ÖÄçP´9*-ÓS7Hd]ýi¦(8¯¬¨™ÿ(rºÇœ–ž£ÏÍ‹ÛzlÇ”¡š±«.l[$JdU+G–¯,ÕÐÖMÎÝ·¹k÷Wú‡w.Ëj‘Dn(‰\£¯š”0'è¹[µ,˽Ö)Îà#í.»â0§]{àe¤ãLeñÎK3ÒF’ƒêSÔ^ºÇ·eúT?Óeê¨f¬µnéÛ÷ia´Q¼æDJx‰ÏQY| G¥Íä»ñX·ÉÜþKAZâ¹¹ù/Ñ…&ߥ4¾ÊRïê hh’™Õ9‰PŸíÎu]2B4׆˜j,øý¥¯4É÷³5y«œ4–òë†çؼBæ`¶ œv<8ãv×ìýO2ä—­Ò4ÚÛhî«øE³™G$õ ÿ`ÎW¤=éõì39ïþ\°Ð¶Úä6.­šºñÈâ¶Êä‹&¬âo>é½q¼:zͳmaå7½òø³Z¸PH@àrÉö—§§…ùœØr긿´½ÊšÐP³ñŠÇÆ×zOÙ<ùôßVn’ïƼ¯©™úÏÌÊGÖypøþ÷F°ø6¬cœø0þøOˆ0($)B*$ã»GZ¶endstream endobj 1551 0 obj << /Type /Font @@ -8369,14 +8359,14 @@ endobj /FirstChar 62 /LastChar 62 /Widths 2073 0 R -/BaseFont /ZIYGEL+CMMIB10 +/BaseFont /XEMFMM+CMMIB10 /FontDescriptor 1549 0 R >> endobj 1549 0 obj << /Ascent 694 /CapHeight 686 /Descent -194 -/FontName /ZIYGEL+CMMIB10 +/FontName /XEMFMM+CMMIB10 /ItalicAngle -14 /StemV 113 /XHeight 444 @@ -8396,43 +8386,34 @@ endobj /Filter /FlateDecode >> stream -xÚí”U\\Ûòç!8ÁƒmÜwB‚îNC7[€à,¸»Üà®Á‚wÁ 0sÿ÷œÌ½3Oó™Þý°¿µjUýªV­MG¥¬Æ&†š@¤¡vÎlœ@N!€„‚¸6'€ÈÁ!ŽNG'á9[Bí$AÎ!§  @b{ý…xy„8øÐéP{GKs g£Óo'~€˜-ÄÑÒdP9[@la1LA65¨©%ÄÙ³±¨þÞáP…8A]!` :''liê 0˜[Ú¡³ÿÖ$kgðÿË v±ÿ÷’+ÄÑ & -Àø—L&L$jgãCÌÐÙ¡°l˜–ÿ²þ3¸´‹"Èöwø¿:õ_ë [Kÿñ€ÚÚ»8C -P0ÄÑî?]µ ÿ'µù¯4²Î KS1;s€ã_&K'iKwXÙÒÙÔ`²q‚üe‡ØÿS¬q `×WPQfùŸ3ýkQdiç¬îaÿwØßÞ1ç? 뎣¥;@Ö^N˜#ìù÷›Á$“²3…‚-íÌ\¼|£#È6=0â¼çXÚ!îˆ;L1;Ðê Û€µÄ`uDÿ} Üv­=ìV!¨M,ËgÐ6¼»<ÔìOFp·¦ÈN$¡óÎÏ1—ŽI_û{7¯Õñ³ òöofî–g5”Ô+°&íÚÖ]gù%-áîÖ|¥O³ÙRGq·)¹2TF*2ÒòYx5 y;×ñ8BÌVµ™’tžEmGB -°|â‡?¦Öì&òËÇbŸTå*MªTú°Z&£ëÆ4¦7-¯öøYu‘¿o¼^}7<íØïeÓ)ÑÝj2÷®<ɉ ÿˆòX}GZjáYa»¼Åå è‘~'»“ÃøÁˆDÛæ+v¶£8þF­7 ýÈ2Õ¥‰˜•ào[{%Áä‹ ÅH¤r0+ -"ÚÆF†¬V‰ìŒ®)5¨¤`cO9£Q¹½²p[ƒ Z«±Ìëò,4C|ÙŽõ³ïU.gDN0z­"cKÿÛ2™Ä6@hh-Î -(ÞuݎпøÜ$c߃V/** ¡™Z9%]#ÏGQç3s&_OVnWZõå…„¨âé€áëdŽCTCh½Y¹®`$Û9#2óDÖ°¦¦ :A€—\Êÿ›§‰S m„äð éOEþ: -“–, -”„½cG…q½X’׈8¸ÄmjZzç œ»×<º_„ ø<‡ÞH /`M]iÒW+rO,ÙÕøôJÞ™ ôºüœžˆ‘Ú Ëã^bZÏ< ÞîMÒêI¿‚dŸ±ÒŸ0Ḹ&~9ã”\8Дõ³ª•È~)¢)«JAútŽÎ;fíƒ]¤2¾E ŠSøb%-‡“SýŽûî1ÈÑoCÚ§ ±EYŽÄÔ±ÃÉܨ.­ó¸¾ËSõ¨¨³(¤í Ÿcè¼<^7׉"p§¨O°ÜœœSˆº[ÿy¼aâáfÕBÀC!¾Ãg÷ÌÏÞ¿º^%.›ˆ{k¾úäH$šjÄ\sÅ*î£÷ ‹LQceø㶠-™Š§è M“*][¦k+ØoÑto s!%–¢o ê[—ž'ùîŒI©³Lk­|h’LúBEáKe1vI£ÝÇø¥¡ÝXBp“Í ±B8\w5”ù¼_*ÙZ˜wþéì£@(A©8©WÕ“^Ñ×çf5ô1Ït'!Yù¹ü¥á2wÕÔ±be+ø&^bûãm•ëN–=‘NwGÞªD}ßw—*8½óX - £sÎ1÷¾£‡ÍÏ31?¯º^äÚ¶dñÚ[}Vñ$·Ö}Šâ~Ÿ1z©öBmJ‚Â4×°‚sâ».nbÕPV³=]ÙÕðK”×3›d[ïQ”O'1d”QV.‡z…5g'3I ½ÂÄ1’¾‰ø×à+}(0­;dN­ Ÿãfó±Ÿ> ÖÅ®,ö‹Ç}6$­èL¬`->„_Ýy9 [¬y÷šÅ®1½ä릘> gØdïê^¿ß"¼£ ŸHHóÃÕ:Uì§|—˜Î|ÒÿL!Fâð`p×qγ·ð'Ç`éŘ„t†çj†ñÚ–èÔ©BÏvŒC6;òå³Î(ù¶ƒ,áÎÎr%K­çÉrÒ&o˱Ñ}`üë.ùOã;'ŠÃ[¦··®ÒØ;WËEÒúoïÌ,ͬ€/•ƒõâ¹?–¾ﱞmw.¦d h¿S5!ÏN—D²DÚå YÚñP¼—wl4<“kÙ½•ùÄÙ k\™Â#êS3Þw‘¬_^&ù‹]Ç7røÛ:£ÜáOI{¹a%VßÿâHЫ"ÝZçV5µÞç!ïIŽZâ¸T‘r3q†H~%™+1JÜÛg¢nHþNæ2¸‹©‘¶±on+Ùýcé×E+àñ }Ìgu¨²™¶G-N>UQQ¨ŽXõ'IÒ•!4x+9½¦Ýw±ás«,‰Ø´buñ5ʲZí#ϱהŠÏ D8æÕo꬟f´93!-Ž¦²©”1ùÜsi²}Nµã"Ì©ÆΌהó íO¥Ô?X¦(W±ôrPú#dožwQp¡¾¼ÅT¹l$^ÄéWvEŠ+[¼©œK´7 -ž¹µjÀFL6½à-¯ÙPvt¾XN]ìi¹¾CwY+÷Æo`ô~é€ìjÆw)þ.²†=²$Ý^ÈÕ¥?í9+qëüUÛìRƒCßW­&Žôd›nËÐei¦3øÓs¬I±±/þ–YÛ”¸¤ŒËL n³žÙx7”ÌŸ‚r· -{,&L}TîÕì »äͪšÙÔ›SnÝ—/Ô1ˆ -˜Ë‰–‚¾;| ,o+T$*žõc¹t¾gW@D–ß»ðö“ŸŸ—‰h×ã¾Úpd]îý’G!ï¥^ß]ÙÝ­M3(Ä=‚eC‰ö‹ä›í‹­Üû3=0ÎåȬ©„]¹±¡]éL¶bb‚¾Y …9<–§å¼nO…*ïö5Š.­ó”oM$Ÿê¿ŽQgjù |Í•ÌöK+†«mkÿ’½öd2t­¥Ò–ꀓèF !µ£¬lå$š§|õ¾¿±ç mKÖìšµ¥U»"ÂIíݺD¬‘GËó W™u‡ÏKÃO¥ÏÏÒ´ulñ-ò%‹ ºDÜ·þWÝ<”v³ô5·Â(yJœ!›>Zo^… ôŠìWù~­ó¯ê£TÛDÜKRò¹Lˆ/Õ¨ï¢"Øʯ¼»Ñ’:¿Ü|Ù¨îÃ`Gt_ôaÉÎï;âÙ˜RWîÖñ2 š.o§òþâûƒïu_ÌϦGáµßzOK¤\4v(PúxÜ„Pî2ª)"r t“O¢Upvˆ²@*N%yÇ[ãêœ]¨\ïÂçøá_£ÞÍÇUOõ-˜ÏG·þ\´ ªñ“¯í)êzFP\µ«ùŒcfŠ!Ì×~=ž¡ÿu¯[d…‚—ï¶}¦d-SÒ(¦õ»³†½|]7¤¬àÏt¥ëˆ½ѧѸ’æÜrb$x~·g¸Jjw;ªC¯ÖyªøƒLü¨ïŽãÂh0̸ǸZ¯j´Iq¦CI+.ú÷Ù¦zÅnNŒ[š{,lPß ÝF¢kéûúÄHyô÷Dß1Êy˜K•B#RÐûÔ?¾¿™Oôìœ1AK2Ç—ÜnÍ)qóP²·G†b|îR@V+ùY€î.U45Þ(rˆù͉¼ð]¼©…’UX\’ÀÐnw¤žÖ+´Lkteö’Ù%2íòÑ\Úðm4axBÊ}wÁÞ©Üãê˜ýöU_ÊÅIbGvC˜ƒ}Æ&Ɉwî)\ñp£×¯|~‹êXÃkN'Íž’КvÅBÇs>¨]Œ‰×š û¶Y„ºû€@›\ 1tù¢ˆ€#íÐal Ýýúž ½c)äIR†™>4K¸Ñ°=ù +Á]eÐ_àugõõˆóµÄõSb~œ3"hÂBÁÔFÐN=ù ›˜úãd‘•Ž|óƒ,•Ý„.£M—ä»ù¥øç\Ã3ÊÈOÓ!9Ò> ‰¯ô¿ -PtbU(G‡¤ó‡bM•Ä¡™FpI.PR*ãöu Öš¹ªuI±+Ï‘qw>T2E®o‡¶’è‹U zÇŽ«ƒI{Ãd7¬líŠ1B åøi¢dÀÛ¨‘jS ¦}KNÛÐP]‡úyXž§\³Œ4ïB\Œ™¼ÄÄ Èž¬‘÷c|ˆÂ¢Šè;±“S„±@Â׊t“æ§à;f¹öÄOWíúÅÑÜìö“<9¹cÄ -{ »YË:‘p±>±ú®Ò}kHG ¦)MErmÓM6þ¾ýALcPéÎ'‘F’›JVä6¤d‰I‚Þ’ÜðåÚ¨çã(K“›Ã¤rÎ_í ™¸/еÅ{Üu””ß-âͺO Î9 R‘}­¹58ø#¡Weüe^ëê'[ù_Px€y6/·íši^%5y?E…óÖ‡Wèó˜ÂÔëÂiK¦œ‘%9«uãD äUB=æ–U©ñÝÆpž£É±)©gÏrƒI™ªøŸþZbuC7㮳¦«Í“¶h -I6Ì4s¯«Ìóg¢ CZ3æl) ¼¬ÞWš‹+Ùã:£ÊÉìà8²Ú0øù¶¦Ÿ4š•*2?eçW¾ržVÉ=tJŃ›(F(ué Ë›ºþÐõFós]dOMî¦3`!“´™šãEµ™Îªvœ;®/HƲ¾«A)òFÅYñ]¢ÚºW'žÞ <ƒ³½Þ>Œ)Ô _¢'T&Ëæ©T2GÆ)ýxyž(µu—Ñ4‚`Ýy™à¼ÁÁˆ+˜ä#Ef®¢Wü}h£á¿y5´O6ç{È'¾˜V"Z¨ÖÃαá%S˜CŽ·rp=˜€$>‚EÔ\dTt-ø…·›“¤ëQܽqìÜ‹­pðm˜ùœÒæaÔ@‰½hÙˆ,ÕäÓiÞùZDƒ¹â¦8¿KÄXëRo¢bôõ» àÀZžØþ78ż+\\ãzº>R£CJÐF©ú'eÊ…Åí ©B^ƒщZh‚Þ”4߈ú™°.¾­É­fÊú[‚Ç¢Isú¦¾f·°ØÄ+>Ü´øùí1Crˆ"Ãfùï[ÖœÂGݹ߼xŸM}.ê -Ü£“_ëA_Þw—ÀÁèÝÓá”{Ùà+F”wº¨¸KæJÈ»Ÿ|*h9{/ð‘з3(/ -‡àyÚ§©¤$¦WåÜmUò \d‹Ç¥à\÷Ö$¥«/.þ‘ÔF]8Ϥ¿Ó±M^<Ë.¬åŸÜœ±eŠ¶˜&2ÎÓJ„ðv8Éœ$úbU Šÿ´MÄíÛÔÔ=§%¥òÛu@4R».Û ¿ŽCpkIˆîbQh ù*™tŠl{ÜÐiÉ3ÎSP8hêªJ“õn÷® #å@©ÎSlÜ “E\êàµ>Qeóê5aæ…4îóîWÇû72V_kSÞëE‹±p9¾ÌrJi WËÆÚ\4~ü%(Q éØþX°µkÌÉ~ Žç^Ó'Ù½1»¼Ujγfú„ïGó›Ññš -ïŠå÷*;È¿ò²êé–ô(=I™ÝåËÇçoH“'Òñ÷Æ0/@ÞYÄNBLŽ˜£˜dzjãôq©EÁÈ-¥Ôx€Ä–®Ñ(Í©ÿhÀ”Vo¾7¦Œ°¼ZÅ ¿‡‰âü…ïI ‡DL7ë°`‰À6k$%6á­:kmqœµÌeHÆ°Ùœ—žÖæÕ6ÇP:['lHÎv£=v‹ÞßÕDœNô|É ù¶/Y¤xÀP~Ï];+Ç\§²°Wðº- &O*égÌ»r]|SD+<waŸ‰‚È?ËÈ4{{= -¶ÚfYUÖØcÔ©ƒñ}ŸÀÂ\¢Ù>“s,+­›Ùgá´’Uj½—&á/@Ë¥(ÇÍö'¨?ùe¬nOñšB–«m4E—Kû Ý1|ïK¨­ë¿ú kÊò[± -E*]pèêõdzóH %ºÝ8—•”&â¬=³Q -7M7Ý0Fl–µ䯥ÎI£¿Çí"NÚ0(Uc3ûj¯Gðç[ßL:)ÓÀÝàßમõ` ®c:l™Œ‹Ðˆ‰nÞDö^ÍšdRJ˜ã÷ ¯Ö‹¨¤+#þdý1~bï bµøyË÷øk€Š-âü-©à%ß2-üª|¯¶jgM1Ð+ªs1—§yËðó&. -ÅÕ™•gÛš.^úYÐ'W4‡0·÷KšMÇv|˜ðH‡æ˜Ývf•‡ö;žÿÖˆ“ÚH¶ýÚ ›ég”ŠT èèh†áúzׯkwænSàH0tˆµ¿_(t䣃±ÉÇ}䧅 à÷dŒß²h„(ü>¢(#-"oú±q)Yìà.Ø ¤¤¼ïçŒ3 XbßÕÆž£ê-ö=d«Ü줺¾._®H.ÿÑÌý¬|ßAê"LÊL“6Öó©ãF]Í«7× ¤‚2ç™ö<)V<ý"x2“~æ-º/¡Mb¼¼eÆL,ùd72&èUȨѪjG*=îñºNÜ°g6ò¦eµïå/õÞÐFèÔ±Ú&ïò -ØñÞ;´ -Íut*ëæÓ’|»9ú@ÃñøCÿÿþŸ`j9:CmAŽÖèÿ 07?endstream +xÚí”U\\Ûòç!8ÁƒmÜwB‚îN‡n·Á=¸»;ÁÝÝ‚ n@pLçÜÿ='sïãÌÓ|¦w?ìo­ZU¿ªUkÓQ)«±‰¡ï!ÒP['6N §@BA\›“À äàG§£“p€€œ, ¶’ 'ˆ€SP y{ý…xy„8øÐéP;w 3s'£Óo'~€˜ ÄÁÂd P9™Cl`1L@Ö5¨‰Äɳ¶¨þÞáP…8B\ ` :''laâx1³°Egÿ­IÖÖ +àÿ—ìl÷ï%ˆƒ#L€ñ/™L˜H0ÔÖÚ†˜¢³+BaÙ 0-ÿ7dýgpigkkEÍïðuê¿ÖA6Öîÿãµ±sv‚8 `ˆƒíºjAþ%Njý_id@Ö&b¶fÖÇ¿LŽÒn°²…“‰9Àdíù˱ÿ§XãþÀ®¥®¦,/Ïò?gú×¢2ÈÂÖIÝÝîï°¿½ÿbÎÖ 7€¬½œ0GØóï7ƒÿH&ek[Øš¸xù ;:lz`Ä øÀ °°CÜ7˜bv -Ô ¶k‰Àê€þû@¹ì ;Øy‚`uÀ–þ²òðØÍÝíÌ!¶ÿ˜øì07 è^üvGk£ù?X4ˆôƒ €j ù›y9ìN®ÿ¬órÂØÜò‡7€ÝÔÂå, ¬3L›#Äåi°ÂÙÿu”[ûØX˜@­¡ÿøñÁ’Aìa÷·¦Wòo⇥–ý›`R•ÿ&Ø첃þ!ؾ÷ÿ,›ÉßÄÉÛþgý¹`õý°êÌÿ@Xq ¬2Ë?&Âê„©°þa2lþAØÀ±Ûþ0Ð?&Ãî„Épø÷ø„Épúa2œÿ@˜ —?&Ãõä‚åuÿ ÿû’ˆ‹CÝ>°qÃ:ÄÆ› X€ Ÿ×ÿî©akaï ‘•„ ?ìÈ~[Mœ ¶N}˜`7ðßlj»¯ˆÄ}é ÔD8À2©!¨Ä[*oª‰^ܬ1Z±¶k¶ý¹ÿb ¼uሼ=óZö]Yê ¬]¤]J×_¤Žamž*ãÒ§¾öÑÉó».Æ»©ͤÚç© +î;vÔ×þGØ­ sǼðJ3k£%ñ:ùý?Žr”%Õ÷P¾RÁuë¹Ôu§ðñkK§ZkÖÐsS©â$Û—„ð¯ºâÄÇ"®Nú{[£6±¬œAÛœñîòP³ãànMÃÃIBœžc.'}íçÕ¼^ÇÏ&ÈÛ´•¹WžÕPR?¡Àþ™´kGwƒå—´„›kó•>ÍVKÅÝ–äêp©ÈhÈ/zñÕ æí|Çã(1[ÕVJÒ9xµ +)ÀòŽúZs@šÌ#,yR•«px_ ÒÕ2U7®1³eqµÏ7ĪCˆümgðõÚ뼑‡OëN‰èv“™WåINlˆø'”Çê 8ÒRs +›•m.{E÷ô;ÙŜƟÀpF$Ú6±³]ʼn7j}YèÇ©ÎM pÀ¬?›Ú+ î¨@\¸Hî°Ðh@"•Ë¤i!PèÑ&f("x­Jdwl]©A%+hÚ íŒÊõ•¹ë:\àzE^—G¡)âËvl¬Ÿý¯r9Ãs‚Ðk[öÙVÈ$vBÃë±®hQ@ñ®ëv„¥çï3\9hõ"#Cš©•“QÒ5ò¼u>3gò5ðdåv¥U_^Hˆ*ž¾Næ8B5ô†vЛ–ë +F°3"3Ofhj +¢ø{Ê¥ó¿Ytœ<Ò†KŽ¼Ž+òÓQ˜²`Qè¤$ì?.ŒíÃ’|è¸FÄÁ%nSÓÒ;gàÜ»¶wç©°×í6àso ~#½;.‚¾ˆ5}¥I_­È=¹l[ãgÐ'y÷ ¤×åëøDŒÔþkD÷ÓjÎÿ!HðvŠVOú$ûŒ•~¨ø„ ÇÙ%±÷ŒSrñPSÖײT"Û[DSV˜‚wŽÎ;nå]¨2±M ŠUèµ”–ÃÉ©~Ç}wä°&íׄؠ, G`êØâdnV—Ö¹_ß婺WÔ™ÒvÐÏ3t^~ß0Ó‰$ w£¨O°ØššWˆ¼Ûøù}󽻫e …ø.Ÿí3_;¿èF•¸l~î­QØÚ“‘hªsÍ«¸·ÞWx,b0Ey´¥áÛ6*Td*ž¢34Mªtm™®Ev¬ ¼%“ ¼uÌÅ”ŠþE4¨O]zžä»3&¥Î2­õòá)2é …ÞÊbì’FÛuŽñËÃ{1„à&ë;b…0¸îj(óù€T²•0ïÂÓÙ'‚ SqR)®ª½¢÷ÍZÈcŸÉnB²òsùKÃîªé­à›x‰O·U.»YvD:Ýykuôýßœ«tàôÎc(ÌÎ9ÇÝú¶>ÏFÿ¼êz‘kÓ’ÅkgùYŃÜJ÷)’ûCÆØ¥Ú µi +“\à +ÎÉor¸¸‰UÃYÍvteW#/íQ^ÏJl‘mg|@Q>ÂQFY½îÖ`œ›Ê$5ô ÇHú*>è{^ƒ¯ô±À¤ît’:µ4|@Œ›ÍÇ~ð€Z{´º4 ûÙ´¢3±‚ ´ôv=|oäé(l¾î.ÜgJ³Îô’_¬›bæ,Œa‹½«{ã~›ðŽ‚|2!ÍWëTAp€ò]b:óÉÀk0…ˆÃÁMÇ)ÏÎ\Âüƒ…'cÒž‹)Æk¢SÇ +=›A0ÙÜhï/f%œ1ò{YÂÝÝ•J<–Z“•p¤-Þ–ïFDôñÃ.{ä?ï)Žn™ÞÞºHcï^­5v Jw꿽?4µ0µb¼TÒGˆçþTvô¼Ïz¶Ó¹Hš’p¨ýNõ=yvºÔ%Â6É–‡â턼C£á™\ËÞ­Lgƒ®qe +¨KtÍDÿE²~yQ¨ä/v¿½ˆ‘¯èŒrG?%íä6[d„•X}ürˆ#@¯ŠtkZÕÔúž 9n‰åREÊÍlÄ&ù•d¦Ä(qo—‰ºé/ ûø;šÉà.¥šGøÛļ¹­d÷‹ £Þ­H€Ç3ô6›ÓQ ÊfòXsÒL'/œ£=ªªN7¿¯o¥x%buÏLIZPµŠ!ˆ !(ôukBpŒ ÓŸuÑù!¨1ÕíÍÔA0”®'3;¤ˆùÓ,DoÞ‹`èÄ™ÔdŸ©ÛªïQÂ(¥–Ç9A­½_†ÖGØÒÖ§ÙÜ,ã·ò:ŒÑ@ì/%­¥ê™;ÙÛN #ÃáOö†)j ~^¬Ài¶±¯ÅúØîµ8ø4–EE!:bÔq’¤«Ãhð–ÖrzM{ïbÂæ×X±iÅêâk”eµÛGŸc¯+Ÿˆp,¨ßÔY9<ÍjsfBZLdS)/¢íó¹çÓdûk'D˜S¯)@;q¥Ô?X¦)×°ôrPÂeožwQp¡¾¼ÃT¹l$^ÄêWvEˆ+›¿©œO´3 +š½µlÀFL6¹à-¯ÙTvt¾XI]êi¹¾Cw^/÷Âo`ôziìbÊw)þ. +²Ž=º,Õ^ÈÕ¥?å1'qëôEÛôRƒCßG­&–ôd‡nÛÐyy¶3(î9Ö$*)Ô¯eÆtJ¡pN!JÄO¶¨ÇÞ¿ôÇ?¨æ€’Kä~%MÑõ,:,QVRà‰SûÔ˜¹{,p®˜¬£¦{ýØø‰&èÆ›½‚÷œu#äñ$kJ}TqÃÇLý×?PÑ»f%­YSäs/Rð&o³Ab ñAœ]¼«à(rU!r’,yo‰gm§˜F¿õí‡{©ð÷ëÙÕ³Ðô’wÈ-ƒ^ü5x™fë·ÒB{]ãeb ­#N/÷¹ƒ5?.êòwâ<ÓjœÄ“Olì¿eÖ6!.)ã2Õ‚Ûªg6Þ !ó£ Ü«ÂU“{5wÅ.y³ªf:ýæ”[÷å u ¢ær¢åÀoö½båm…ŠDÅs>“¡,—N÷ì +ˆÈòû÷OÞòóó2ízÜW›¬+}½yòžêõÍQ•ÝÝÚ4Cò@ÜP!ØA6„(ñø H¾Ù®ÑÒm Óã\ŽÌŠJxÉ…û;6´+€ÉVLLÐ?g®<Çíx¨œ×í¡PåÕ>¸NÑ¥užòµé£äSý—qêL-o”/¹’Ù¾iÅpµ ãí½ÙëOµTÚRíq]©!¤¶”’­œD ”¯> 4ö¦³mËš^³¶´ªbW„;ª½±Ýˆ1royø*³îèyiØI£ôùYš¶Ž Þ’P¾diQ—ˆûÖo󪛇ÒvN‚¾æV%O‰3xKÃÛ@ëÍ«0>‘ƒJ£3Ÿ/u~Uý”j[ˆ›£péJ~Ñ— ñ%âÕà=TùÕw7ZRç—[/Õý¢££l‰î‹>.Ûú~C<WêÊÝþ¾Â‚¦ËÛ©|°ôáð[]¯ÙÙ̼ö[ )c‰Tƒ‹ÆJo÷›` +Ã=F5ED®Án’ )´ê‰ÏÎQHÅ©$ïDkù«^Ž‹×š}$ûºU„º÷€@›\í¯1|ù¢ˆ€#íÈa|0Ýíúž ½c9øIR†™>$K¸Ñ°=ù +ÁMeÈOàugõõ¨ÓµÄõSb~¬"hÒ\ÁÄZÐN=ù0›˜úãT‘¥Ž;|ó1ƒ,•;ݤ.£u—ä»…åøç\#³ÊÈO3Á9ÒÞ ‰¯ô¿PtbU(G§ó‡`M—Ä¢™„sI.RR*ãöw ÖšºªuI±+Ï‘qw?V2Elì„´’è‹U zÅL¨ƒIûBe6­ml‹ÑB åø¢dÀÛÈÑj µ¦]K%NÛðp]‡=úyhž‡\³Œ4ïB\Œ™¼ä½A Y#ï§ø`…%Ñwb'§ƒb„¯/è§ÌNÁïm™åFÙã®Úõ‹£¸Ùí¦xrrljö÷²Vt"à0b¼cô]¤ûבŽLRšŠäÚ&‹šlüýC,˜Æ ¡Ò;œ8‘F’›JVä6¤d‰)‚¾’ÜðåÚ¨ç(ËS[#¤rN_ì¡›™¸/еÅ{Üt”•ß-áϹMŽ|É9 T•}­¹=4ô#¡Weâe^ëZœˆ|‡(Ìß,›—ÛfÝ$¯’š|€¢Â”yûã+ôLaê á´eΈ’œµº ¢Žò*¡3‹ªÔønc8±ä˜”Ôγg¹A¤LUüÏ -³º"Š›r׌[QŠÕæI›7'æ ™ºÕUæù±GRЃ!­Nó6”ž–*ÍÄ•ŽÏìpPådvqX­|}ZÓOMËÆ”™Ÿ²ó+_9ÍE©ä9¦âÁM#”:wÐåM_Çt½‚Ð|]–ØS“»éÅ G Æ%­§çyQ­g²ê£\ç‹’1¬ïjPŠ¼Pqýe|–©¶ïÀÕ‰çŸ÷ÎàlE¯wŽ†¢Ë†tÃ–é •É2Gx*•Ìq +E?]ž'JFnße4"Xu^&8mr0â +&dzK‘™©èAßZkøm]Í$Íû±ÆŠ/¥•ˆªõ°slzÊæã­^% ‰b5] ö’àvs’t=Š»5ŽŸ{²½ 5›WÚ:ŠÜ¨3¡­‘¥¾;Í땯EÔ8\”+n:шõ½DŒ±*õ"*F߸Û®‡ã‰|…SÜÌû¸ÊÅõ0¡§ë-56¬m”ªÿqR¦\Pܾ˜*ä9´•¨…&èEIó•¨_!€ ëâÛøº Ðr¶l %h<Š4§úKv ‹u¼âÃM‹ï™ï>3$‡("tŽÿ±eÝ1lÌ‘ûÍ‹ÙÔç¢.ðß{´¢ókÝéËûïr8}û:œrO k|ÅðòNg7É\ y·“¸²‰Á–³ñŸ}:ðð"qž§ÅM'%1½*/àn«’á"›?.庵&)]õ:ûEPuá<“þFÇ6uñ,»°–jkÖbŒ)Ê|†È8O+ÂÛá(;x’èƒU5T(ôÓ&·KSsìLœ–”Ê÷@ÔÑ Píºl“þ:aе%!ª‹E¡ä‹ dÊ1¢íqS§ý%ÏOAIÀ‰‹*MÖ»½»‚Œ”C9¤:± ƒLq©Ã×úD”Ík׆™Ò¸ÏG¹o\îßÈX~© Hù %ÆÂåð2Ë1¥%L-kWpÉøYPo`¢Òw»ï‚­ÛãfHvÛ(n=÷â˜ÞÉnÙå­Ró53'|?šßŒMÔTxP¬|PÙE~ø•oOUO·" GéAÂÈì&_>±pCš<™Ž¿?ŽyòÊ"vbrÀÃ$ÓS› M- +Bn)íäib`ã=6"púI©O(ûÄq¹†Pìþ%Áhö¡Ÿ^„âi'÷ì±!u5õÇÉqTꘗ½Ö=Ø~òcÁûËx…B.EdÏ¯Ü Ç·mÙNXfmÀËÄÈÝ}³>…j“)úýÄYÏØ­XÙ@þGjK¼0@[0÷¡:õtPk!åÏúïWUçL𺊩R ì7ªÕèšxŒiμ‹y?tðèÐŠÖ ”)×±!qo«÷w)Ýk!Ë{ ÐußUÇBЕ­M²Þ ºØJ4±p;*êi÷uÆ“šÕr‹± G\Qçº`àx0}ÍÕº~[a¸.Jä|a 5Æ€ü‚sÑRµP%úêzA–/h(7Äv]HKöc„༅%±|«;³xŠIŸÈ4<„¬âà†RNu;ŽNâ«ô$ÜüEJgÊüP6³Ôð¹*ß ýuK”Ý™`º a»8Žôœ´û+Ö·6Ùâoæ`q!»,©ÛNσ¤\+:ÑBÅâpKnïÔÉ£ Þš\'3U²49Šk²¡RyókRËêɦ®RÓØÐãAuÏpôŸct-32å/¯h{4F€_–·²¼šŒ“|ªB®/~Ä_ßg˜¶ÇFkÍwŠ%8höp±Ý¡Yà§5*íÇGu.ª°VFʼnúY¤¥Î*ØíÏ&L¨Û¶)¼¹¥¼æ¿dÀ`ÙEäé~x뮊•ŽÕZ’GAÃ…Ä Ê(»V¥¥,[Õˆ)HT”Ì!÷VDñäî *Þ)^–³Èª£]¥£mûÜd¤.Ÿò¯‰;~KPÚ$Œ‘¥¬”Ù¸è ¹Ê2ÑS—¼Ér(ë¥>K¢}„¦q,\å·‰óû,Üäœs¿ª¼¾Y*J¥+—YÀl¤½¬ÖÇé‘z*HV#)z„F|¯R¾çÑÜボËûVôŠúMõÛmFkÔVòÕûÉƈàbxÊ»W8ði w+ ádn€IU*T³ž{å³×˜£È?÷Ì^lwŸ1p™óõFµR¦¯’¹Vï3ÀS¥èL­íÔÞªA+î$6* +yÉéB v®£y€(M ÛÛεË&Íw¬ÆÎÓÑk;÷О9•3Mb¿Žëã_ÐG» ›$+†§hxåJ˜åG»ß•j Ѥ‡ÙËåh²:WI#àË|õ|az½÷æÉÿ¹•«CÄ jì÷ s½Ã.ä>ŽúžÍ%š€ò{a1ï«õSá×ZSì~]HjÚä\ú¹ê:’&ÆQË°²À›!íëFÔ䕨aüëˆPã !‰ž8^´Â¹ÁĶE«kºIT[‘P_a/ +#׊_’ ]TcU“õ]{c@£û±,ò¾^=÷(~ “bÔ1¡)ƒ ;i}üµ/^!×B 9<­`Ë4K4IåãèˆÏ¼ÌQ¡È+ïœæ²Ç•øÞ{™]3¡‚Rm +¼¼ë5YG—}ÝdzÎÒ•Vwu˜§»„zùŒ™Eðôæ‚«íØöÍ{˜YØü$Ÿâ9 +–´QÁ¦¾WAè‡ ŸÑÛ>OUø¬(줋üz¬÷Ÿ-`Aí¢’I&¦;¥_Y°* °¨ÁÅ-×àpÖ &„Cã"#×1œÙžë†ÿÚò¹Ç•Xà)÷¤z¤¬b¦«Ž®0ÿ®:ó¬côámÀÊé’{É—QI±ÙÏk¥]×9Fä["ojŽý…ýZq1•’Ôë¼í1ÂÎrëçm$²z_ÛŸä—ëw*’–u+^»ópçù:±½ad‘UPeøA3‡©Ø—Ó™³c94Sé²GzxeëÂt©ÔCÄèòS‡n‘Çøeû3«¤JðØ]ãhÐèŠ8cb7”tãz™<‡+Óü4R:Ú ™2%zTñ—wk“P…Ë(‰ÂÊ(0ÿÕbç²~®—eXÜ~"†h–éMEÕùt UE)FáiÓ`ˆ?úq­80ñ–Y²µÁss°ë†ùêån+£”Õ\AsÙ+T¥/¼8 #]Õ}QmØT!$¡ŽúÝŽ„ÍLNoqe]Xgâ§*Šß¶„i NÜ=v…GÎÎ7ai\¾¯¢DŒ Á#Z>>°Ó +¸^ûfXÖ MË->ë‰ÁÞJž>äÁÐÀ¶‚w=ñË{xÖ~åË°™Œÿ+¿0òIŠ‡@z”[÷gúõDæƒÞµpaº¬ÝÕŽî¯÷¹LìÇIlù@áÒœúLiõfûãÊ+kU òû˜(N½|ObÈ8$bºYGmË6Y£(1 q´ê¬u6űV2—ý ÃfpAzF›WÛ Célƒ°!9kÄUŒö»kÔÁž&âL¢ÇënÈ×É"ÅC†ò{îÚ99æ:ÝàÅØ‚wÐa0yRÉcÞ•ËÒ›¢@ZḠ»4H$äPøYF¦qÄËóQ°Õ&˪¨B°Æ£NŒ×èóæÍöžšgYm5¯ØÊ>ƒŒ¤•¬Që½|öt±òPŠò½Ùîdõ'¿ŒÕñ­ñ)^SðJµµ¦HâJ顆Ï}I(µUý_aMù~KV¡ðç­ïŠ7ÞÊ¢J§*?[uðö²êFùœÖúˆ4QÅ@·æIu»¿Þ°¨\Y/Á¿Ý,¡‰Lªç„G;(¢;jߊӾ :ª:„£ºt†N€¡†ºg“^Ï5‘-Ÿ¶¦Ú#’c~MÓt¼6by…ö™R5íãi‡~ˆ>«F̘^¸O„\´í䧿ðÅò÷–ýDØi¦ü^¯/õ36¸ZyÔ$·?å² FÉëÉ#$KOÂÆEÎÐÝ<ÊÒJu†œøÃjš:Gšér+™TÛR}žuû×z—Å﵌0È &ð ͈˜s‘ +Þ£“‹4¬‹ˆB?#µY#Ò¯SnÜ4µ¸àšv¹¥lFm6`¥vˆ­ÐÑOz"iÂãIæEU¯ÏàÏWEÌ”ÿ<6eKacíbð˜MèËpzpÖïìl}\%1cñ¢b§E»Ûý,È OÕ1èìY8ÎÏ>#Þàâ&8 ýAØÊ2"Ø«èïQºâî2¶êµ@幟àÁxZI’8ȤÃ,Ê‚`<Ý +¤ðèbtÜ’¿pûø]]úqŠ80€!ä¥X÷lªoŽ!ªÀì‘«Vq>mèü—aN¦ Ç*öA#%Ì ¢Ø熋”®ë*Ta熭Ɨ„™ê¡/0Þ,€Ê"Œ3k,ó>edÖ[pæ­ê\kØJŒôÑdFvÇìí·9€¿XØÄ¥ª8ë; X5d‡xăúÀø›gËË]‹™Ä~¿D4®èu;ƒ ™ÉÉ=•÷‰+ìÇÆ +˜ /Æ‚õí‹–á"ên—L3m±¥F®bû¨â‹|07Ë8íT¯"g”eZ3?Ë·£ªØÀ«Eú8˜aàuóõ0˜°Äe–…= XÍ„Ôy¹PçGFl.dekyUÈnN³‘©sTz8òL ò¢I*37$Š¼´¶Ê!Äœ ”Ê<<©=C)ô§¦®¥,Ð5ôVé‚ûHW¯'Ó—GZ(éØ¥èʹ¢¤4kå‘ý‹R¸i†¸é†1|«¬Ý =u^ýn× pÊšA©r›ÙG{#œ?ßêfÊQ™Îî†ÿû ®êz¸à:¡Ã†É¸˜èæMDßÕÜûLJ 3üä5Ãz•´se䟬?&NììU,W>oû|?Ƥb ?K*x‰Ç·B ?L *ߧ­ÚYSÌôŒì\Êåé@Þ6ü¼…‹BquféѶ®‹—~AÖôÎÍ!ÌíëM³§é؉íзÝɬr×vÃóÛuTͶ[a=óŒR‘ŠÍ0L_ãúuíîüm + †±Vã· …Ž|t06ù¸ƒ·üŒpü¾Œñ[Mÿ`åOßFe¤€ÃäM?6/%‹íÝ;””÷œ±Ëì{ÚØó4P½¥þçClUC[T××å+éQå?Ú€¹Ÿ•ï;H%€I™iÒÆzÞãܨkyõf„TPæ¼÷†=OŠO¿ž À¤Ÿy‹î AhS//B˜1Kz­áFÇ= µ1ZUm A¥ß{<¯7혼hYÍÁûùË}7´á:u¬6 Àû†¼Ã6¼Aö­Bó„ʺù´$_oŽ?ÒpüþÐÿ€ÿ'˜XC@NPƒúÿŒÙ7Wendstream endobj 1548 0 obj << /Type /Font @@ -8441,14 +8422,14 @@ endobj /FirstChar 38 /LastChar 121 /Widths 2074 0 R -/BaseFont /BZBMQP+CMBX10 +/BaseFont /WTSPKK+CMBX10 /FontDescriptor 1546 0 R >> endobj 1546 0 obj << /Ascent 694 /CapHeight 686 /Descent -194 -/FontName /BZBMQP+CMBX10 +/FontName /WTSPKK+CMBX10 /ItalicAngle 0 /StemV 114 /XHeight 444 @@ -8468,36 +8449,36 @@ endobj /Filter /FlateDecode >> stream -xÚí”e\[ݶîq V¬@’(Z§¸Š»[€`ÜÝ¡XK(.Å¥×âîîÐ/ÅÝNÞwŸ½ÙgŸ÷~º¿›õ%ÿ1ƜϳÆs1>SV{-f5KCíá¯9Ø8€ïÕ8@@6€‘Q6C ö’&p°ƒŸŸ(æl äDæy¸@œÈ" ÔÁ±´‚_J0ÿUÄ ³à f&öÀ÷&p+°r3[ Ô †»³Ålmª­pª‚À0°9€ƒh1ƒMÁ–{û_Žäì- @Þ„Íþ™rÃœ¦€/‘&™H‹æP{[w 9ØÀ®Ej‘Nþo˜úÏÍ¥mmMìþÚþï.ý¯¼‰ÄÖý¿+ vÎp0 øj†Ùÿg©øæÞƒÍ!Îvÿ™•ƒ›ØBÌÄì-mÁÀ×ül\<ÿCœ¤!n`seÜÌ -habëþ;¶7ÿO#Èæýmƒ]QBRV^–õ¿Oõ爐 Ä®îÿfŽFöqêØ@ d!òùç?ƒÿ“²7ƒšCì‘cÁÍ4ÁLÜÈù@7Г±7»ÁnHÇìlöP8r Ùo øëPßðÙÍ¡¶¶&°¿âÿñÙ¡Èîýݤ†‘m`w@Æ æ!> »} —BíÁÿbnîúçæ@² üoœ@v ¨óƒ:÷dâòo\@v'd3þÅÜH»€í"Hgàÿá•Y#ö@ȼøñÙ%ù -’„ô/õ/âEº—~ ¤w™Bú–} ¤i¹Bê)<Rïý!õ©§ô/âCê)?RAõ -j„ì‰ú!ßVãêš„T×z ¤ºö!ÕuþEÈùbh;r`Ùíÿ ‘Yè¿á_§ðoˆýGûÿ÷U‡ºy¾æá¾æDÎç /7ÈûjØCÁr’È‘xùùþŽš9Ã``{øß_ ä5û'[@ v›榡f‚AÖŸjB -}¤rF‹0™hùAƒ-ÁUA¶ÝeA’IXíˆ:øéq0±5¤øÑÇ=ùRvs îUª1¯O5öàYâ2æ¬5ì}³]}C´ÞŒîv"»´ðÍ9º_µ¬ûóô§+.-˜å -Û¼ÙT{…3Ó·Ç>6¾C«sxÉæôë -I`Í­•W¿e 9й¼^ -ý”SÒ»9ªö¥q›EdÆ{ô)„Ð .ˆÙÍbmÀñÙ†nN;‘¹~—a3qnr]òøòSaºíwKKîÝ!+Ý’8qœù»žÈª'7ì4ÏšOhMÝ_*ž¡Ô|ré'oŠàâò¹½U-ÿBÔ"Ì-ÌòS}$´ZÛÕúyKOfu±þÚ¥Ø~û\,±UÔÃ’îÑ/¸à…8™ˆ’÷݆Dƒ`sdýÏ£wM#¾€•È<S|tá²(Å£¶åC.çÃo5P\!A7u’:VËûÌÐr-JÖç Ë#RG¿~íü¹ÊÞç÷-¶£´•ýÚ=õjgsÕÓÛOŠô—‰u*ÖSJ?N÷ö6|åUí'Ÿ»›ºýáÔ.—æaLgÚù8*>À:`êµk. çëGLd=ŸÌDSiUR ¬ò9Ú%³}Xçþy“Äé¯;P¼Ü¾|–$èçvNã"æÍ¢1%¿óÚÌ(ç)ÅÇsnQÿßÂ<º5Ò‘º7ö4< ³ª¹,¡8¤ ÏÚ@1Á=þŲ€«•üÒ—­øç«Š›]Ý3;ÛÒ]þi˜d¢+ÅÀW,ÄAÏ ­uK¥ƒu:?0ºU×Óž”îUK”Bì„(ƒ­c-QåØÕ£’l­òPå>ô¤„:ûe‘Û9Ùd}¾²êïáð¶Þt42$#¢BœrGí^úÈQ9ÓÃI -cO$ùÞ.Ò:éåÇb³)³g.‡eÛê37P´_Úç»NKxK”܇]| Ž;Ðåòê÷dŒ¡‘Å#­v&¡¹ûd=ï¼*½²p/™¿¢óK#c®“½7¿)ÎÇKÔЊ]¨ðƒ{¬fU5ÍhÎ ¨Ô娋 Úv”áíàwÛ˜+tìTÖ¬u)êŸT›Ns¤Ò2¨±Ç,šwöç¿Nîwό蒔gh¸ïÐtte\tÁ¾ø\ºå¡¡;`ô9ú‹˜T©È‡•[®—ìwJáqûLVñùÀ‚ðW=Êømxé¸ó*g›wÞij ¢…’E}U$òñ³×75QC^2GŸµv^s“+9+ó,~}EpNpj{BkƒºïNæˆûS½ó°¶¡Û& ¿ý×Ì_¹7ãŽ>JpUb­¦ËùÆÓߤSÑO”¤ÀnÎÖyÈyõï¯+”qb"f¾‚0'žZ [uß7E£C'+“ΖPW0EMœw:ñøë¾:gs¾¬áþ¾Î¡ï¾åŠ ô4¢Z£ÎšŽá1íûú^øIëÏ)¬Š^´áj´•‘û¾úÉü-ÓUżÉñ€6!% îæÂG噜ŷnÁ„!ºÎ盧³ÂpžMê4¶·¿}ýÔ6LT}7ŒŠšN74‘ ô@3\czÒ_x ¸­5¯òäqÉßèýt+öùD§þXRêÒûDá8*%­rN½‡Ëðx~NÇ`<ç³ 8“9VåË“½üT&K«›W»ÁÀ¨ÞjÙûµ¤ÁZ;ºR=ò†óºa0å•ræikDEâH÷Y<›½-^Ϊ³¢ñ_¢Ç¤a¢‘žÚì”×7¤IˆŠø!™åGÈÍc&º? -ãQ×ÅȾJ¼GñVõ¹¶È9ÝçlÒ+IJk\ªË±àïWîÈÍZúk±ccU¹Ì\ÊЦuLbw¦:Ïr3éà›áÒ'FÝœSvKçöGy;ÅÒνsèF€2ëè jYSlÊþñ("I!€=Õz‹~à±Êyöu³ó«*ñ)ùzð~$k žÝyz„í¢œ×åkô“u•áA ¼Zm~áðP*955*í:]}½ŽõØÑG ê\U¬XŽ~Ÿ„Ö5›,@”ú¡eñ¿v¢wA ¥ÈËT!â/CRСӧõ‹`¾BH{o\¯Š@ÍmÇ›Ÿt…5e1Ö¥<94¶)’€“o{IzŽ)¥û’Cî&Vôë^I,= ¢$Dùsóß_=‰kJT°â(ÔfÏQ¡"ЫaQãÅõ/[#'Ãw1ÙÃaº!pCweqÜ©'‚f1p,VN¸—ØwFÞè4ˆe¢lçß–âÜ*v=m®´Ã)1Ôë#X«µ8›aµØõ•AàXš½4¸1Ù9¡PÒƒ±QG(:Á¶_øŽW6ˆo«}ê|-|Òné»Hƒöc*ó„Òí©r^²¾A§]Û+ɳ‹Is’"—Òå¸8­( -v^ÖªÂ^Å‘ËÎPÿ¨kû=Ï ¹ÿìÔ²¯£\¾;u¸>i«¿¸-ù“uð93!£·:j²ÒSÙ­è¢7¯gÛdìIÝÊ@ñŸ†bÁm”; ½Tí4ewN@g÷Ö׈ÓVé$³”¦àM–u©˜&[Šº˜¯z¹Œ«?ÌÏ´÷ŸéÇcgô­™(Œ¥Uú¬æKð”)Y|s'¹~o‡T´’-eƒÒu)áV¤~Ö>›Y—¢o†Ñt¢sÿ@z¬š~~œ&‰'HÓ?[í¡ œ®x<ÉSüò3}§Š<ÕÊŒ±ú‹7Ð(Öœ×ww’Ó³oóˆáã…Sc`F0³‰2Í©vUp;ÏÞÙBG!3ÚKYzúN-ye»ØAÊ¢?°~2)U˱ax;}æ×ýì£ìÇk´Ý˜Þ…ÒóFÑfã¢_ÚÞÝñ\èóùL5`²ýÝΧÓC7Æ¿ŠWü«AOñ^ÓÅ=z.¾¶‹Þ×êRãe+r |ì]öêmêûVO)„|_¼Q”¶£w'ó&¸jÀEßp…Ž„¶@©ÓþstJ¤-“-Z)ºãîÑ¢ÂB9ËŸfnk« ‰§>ŠFé(¦˜"Ž Ã=^:l -½ô~5á5dSß.'ˬ¤Èv·©¾â2Ó¤?Òc~AÊ¿¾vQk˜ᑺ§cm'RwÍæ2ÙßFø#ÝÀp©§~…bRÖ?“*é ™~Ð(«ÞãÛ•é÷• »ÉIø§96§f‚O/‹ªúR–ô‰Ëž¯ÒíȆ€e}u…o:„,Ûk`[¿2¸³œ¹E¿dð›Ïº@> -ºJÓÅÚÆÚlÿ¹ÍjÃÁyk–I¢…s&&É%ª•«†D‰‰ùÅ}Ìfÿ&Õ«áñ&|ÃYàó]ÌötF—á…jáj`Œ9;IÊ+öm:Mx8M˜ý4%Fj37öeÎïŽqp6«R2Ðá4«µNR1²ÌµÔ"`1|¼½ÐJôÊ’ó²ÃŒÝqüf¾:Ô>À•q,yüäL¯ûâóû&ýJ4á¶öˆ -R™7öwƒ§#/¼±Ö™R—Ïë…d­2Rw ‰GÑ4Á¡:Uš¸ê“9 ´š|DTeû©É³\Úì;$\Ë›¬¯P'Úž·f˜¿üR6Ñò!’kЃ€è~Uý¾ÖVCÿÜ1)‰+@Þ:uÿ­r°DmÄðÄÂÔÅÅCŽÉS; ¯°ö}'‘÷/Ê!Ì°OZŸk‰vÍ’ó9LwœyßN·7ðý¿h¹3ÜnmAnD±!q§ÝZîͺš¡€nï±@v|gžç Ä÷?LZ7kïð­6;¨*Ýïèµ8¾W=™WßÏé±°÷•¼ZYÆH»ïâôÁ΀c“ãðÁw†tbµó“5+™¬ó)òR,^"?%‰"•ºjè_ä‰òy„´î›œ=Ys§Se·D?¼2ޤחTÑó"dUZÑ­ÿ~ÛÉIhÕyÈb¦ö¡Ø´Áùö¼=~dŸc“˪Bq^(½Xo€ÌþÙœ ÍN(ó –Ýø` :‚K9k^;8(ËíF|„4Qi´ãJŒ4# -LT,bÜø•ÿdöxr|ÒÏë¢ ±Ýþ¸ z‹\ƒªFë½VH|š•€ {Á]½þ䧂+i‹ØÅyƒ€› ² ‘˜‡_Œâ&pÎ /º©kß¾§…Ï yNþþ©ëýˆD  -šæ}¶Qh±¨”&T@.<û9èPäGQ;ŸêùÿC,ïF´—Ì’ûÇéáJÉÌâZOlvzøK5ß ¹¶bÃÜ÷Œ'›ÌæJÂÉ¿6{4¼j‹–Ô•‰È¿\6PkzæïñƆòd®%ÄhV}$ßRä1®ÞÝfë!x­ÄÅ‘µH™tm8ý‹êO¶Ä%ôo?-o„{.JVhîvÆ–Ì»•i¤jO¯ujWŸ8ô^ëÜ^ïÌ“ÀÍÙD=4¶(Fs‰*š´õ/Lô¾¥­d=«Y%ïJâýÍ$ü9ÄŽM_—ÑÅý$cEç$RÛÛG§©Ë骅CÊdÛ´ú,˜'Gc¼‚šñË`1»)þT‚ïX.M6¸˜Ûx6÷ú³\…/€ž¤jHéãÜTt»Àr[~Q”ƒ ¬¯´È…9[üÑŸ-_OA«+ ï§Ç“ET}[½žRñþ:¢˜´3®q!Ùlƒs}ÍÌIÄ@{/3j’ÄnF •\ôË{é-oýÃå¶=éŸÂ}fê—÷}áº_íe ñOðxu;ú2p±ÁÓ‹Z¤#ÑFSý½óC?Åçíy—ä*o‹mÊÔVh¨UK5q7ÕÌÓ+8ÈöŒsvgî-7•ûœß|ü*8ÍGò#ôWÛçÕ1n_!¬ -âY›L¹ZÿU߃‘}Âřꞈ¨¥Ë¦`Ü -û‹X)5 ê{ÓÛa<›À*¨…´/Ï>gÁBξÖK¿/¶“\¤iT^©„ØúÔçÓí -+~û.ÓP':§†§àn­•b²d¥ªK§uuÑäÇÃɇ¡éƒÆ&P#$éy+f_iνBd ÓªRˆHaã~>2etndûàŒ´Â\ÕQ™düVºØ =ãx&«Ê•,bB³9¥½G§_C≹&@RUÜ@ï7Åd'ar÷õÖÒ-\”c†ÛŽØyžRl¥],_zÍXÏì²=½šïPΰè|ÑèìÉ2Ü:-|øoÏ÷ùU ‘Œ“v(”Nus±e‰ý1.¸Î¿æúî¥éÈÔ[\ÜÏ7ü¹7 bï:»8¥uW¯à¯G*‡*q»}龘Òßò'¡uÚÊg·x‡»>ßÐæ“ùßNh¶–ö×7,ÙÚ¡’‹u«6íéµFŒ®†PA3èj–¬a>bì0¦’E*·am=Wõ*IêPStƒHG\¦”œÏÏX<zõ/¸eÎQiW•y_×ê¡M5Ü,ÑD…b?ñ1´ÁPöà$|ÔöÍjü™È–À9.öÅC¦uÚœ S-VfšUÞsê’m~ì~5A§´éBô>‹g”Ú¶oW쬩¾˜½Èâê]Ú¢7MZ•M%ôå>„'âþ‰'–‰MPœ—ÑL$ [ÒâúÔãÍHÉÊeHftfÊz•-ÔÛW©c•Š,ýk{¹,Kl2|%‚.ØŸÑA_lðgÿð™Îq)MD¿î?{³§Äæ/zý3$ƒ›·£¥÷ÍÐéz†©.k”^ÍWê¾A“ùºvŒï÷J'Ÿ~fÐq£çïÛ›&ùön8Òj`Æó}Lt¢¿$ìZÿ%CEŒšÅ Z¢ù‰¬Ø„yíÝ{Ù2ºTðõs -YO./›‡NHéå_øÙ«€×Zô3gÃBU˜1(.ƒ/Ë×*\Ú…x­ÃwZ9³}󰔢ãåÛû1=ÚUnå×&ÆÜn¾¤x«³¿Â?dªð{šä —ÛáöH"‰}M©ÓM¬sÙeæ¨F仟8ìÀ:“/*w¯‚}:¥˜åóôÆ1¾ïÑbËÕpÀù ÚsMq­Œú7djðߟ0÷Ï&GLºTÎäœTm¦æ‡ßã),ôíÌr;žAuˆ ´0_„ã‚?ƒW i8© -ë]¼HUÜ>ÑlÂki¡åà÷`ßÀ"‹[«¥G/ÑË”Í".-P©3BÚªoI?÷N?7P2d Â: ¥þØëòÜt«“ùçùƒMòZ lßFã‹`íá`³ÈÜrvuR†*–ÎH>ïf¡ÞæJñ:coph[÷èi+1¥ úÊd L³sM±|ùèÎÕHÄíh§|ƒAÌÁyÂÉ:‰€Õª4É­ïŠ42÷çSëK¨(±‡3‘ò‚¼Åšœ«I8sþ'ÖÞÔF1Ûªa„‰Pn=óç‚1,r•ßz:‰·Ù:>/,è= bžõaûYŽáP\âK4s]u*5 Ê_SAÉž-½äRî§9” úaT{«x³ŸL”k|§?¶4ëôÂSfi°1…]RfKÆã £ÎY”¢:ÅøÞýæû^MŒԌNc"šÀ“=¥?³’ú±/—LìàË2^ú¼}/ëK²Ï±’m´øײ òr¯e’r¼Ë¸ð“ümŒyRRÍ”·FÂÞîª9Ž‡¦¯ÝˆPƒÐŒò_¤*‚ñ¨AEÕÃaJOrCù¦ó*&†Ú{»ºxìó=RÐSàeëbÔGÏH¤ñ»£›“½Ê‹|çì"ؘI9–¿ou(`TnÛDT”Úþ¼ôbe`FÝÛ/ziZNÔ ´.*Ãb™IJeð¬Ú -ß¡ý5 ¤@nè㫯 ®^à­qˆEw«”0LÀ¢ò9‹D‰9™Ó¦ÙÑÿµ}®Òq,û4[×o©oÌ·;÷Óu%Cšxèó,ɯ4Ý?&i“p™Ä¶ë´ÞžÆ“ô±hç·SH¿¦É–µËí '— -€bD‰ ‡¤© ¾½—¯0+͊ד1Óld°el r’Dí¤ÿþX‘fñ´à%Ñ2‘2Ñ^μ -[ªÍœBbeÌw*ûm/>?'µ$ýqpúm>þ½- +‹þ.«&ªááíàðFÍd“ ñ>ÃØäÆ’i¦(›µÌ§~• ruLÈ…DCÒuª?Y!¸SDíÍ—g§&¶ˆ.î›ÅŠ²W[·¡t%•¶á†³™3t’®4,LváðsìQâ^ *Ì6Â!ªŸ$š>ª;MAÀµ:;ÅÖ±Û%‘[‰#%T¬ß‰¤¾ÇöIîâZôº*jU…RÓåäcß|ê¢9JE¿àD³È¼ `ãÊúxâÇ5e§Å•çi\÷¾_’«’1RÍcƒqZW·¨ç¿ ÏìËaNç0gUb.º"9…BD´0{wÉt?FžMèæJã^­“7× 6ï6±Mê$ä¶çpL ¿uÕe'ÄM½Ç(FWM‹‚j  IKÑ9¤RJ‹­ ìU>Y9@˜£ i4öùõ¥ ¸™­ŠÿIÔl)Mhœ­Tw·ohîÇ$‡¬Yˆ}þ±e²u¥¼Ð´=Ϧ)üôÖSƒ2^~„Myúì~!â\—×]ªÑÚf1À1<œkº!äw¡öŽ6°×f#VìûóÂ^Ç-±i—£@“Kø%q™Òu§©±.ɉÈÑ¢¼wÔËõ½ˆ÷‰¤â¸„0”jÖªƒztW±\åÖSê–X”„;­·¸– •˜_.œ`U ¡Ã§¦ïíì$1$¤öˆ½­…ÉÇ‚?ŸöHUÑVé“^óTâ¡w¿'Yjü2Á%2å™Ã™·¥Êw1ÜÃXÑ“N~^_ø8AƒCEfø(ÖÑÅê²jºƒŒðh„»÷zèî¼ÁIVè~¸ˆzüGrl}ú?Õ%Íïú¯I„ŠÃŒ§kë¢`Å ­§± Ô%ÒIìèDÿE ]F{3¦Ñ«†Ÿ;B>EyȾJø`ûüãH”]Ž€rò máòÊýèéÊgó6‰QKÊ ]~-¶B¡ ÛÜ+ßßî]=-$<þæj¦E™Æ@…WÚ—¼=äVQw…‡%ÝCØß™«Øq»Ž¯ƒ(¼?%Œ¼k p¢ËÚãçÒƆh’`öæMŠv•¿ –ÜÄYj¶ 1¥ìÔOä~1rÉ¢=Š]síØ·„Ða‡G‹ž¡ÍH=bЕQ~ÇH-ÈXMj…˜Åˆÿ:k~¼R=*gT¯eú?üþÿÿOl`f 6Á¡v&0ÀZLÕÛendstream +xÚí”e\[ݶîq V¬@ +”-ŠSÜJ¡¸»ÁÝŠµ„âR\Jq-îîmñRÜíä}÷Ù›}öùxï§û»Y_òcÌù ¸13±¾7[í{˜™ØÕ f0Ü(nk Týk…P솹€ÍÙœœ@sˆh +¶„Ø8þr$goòý#lîìðÏ” æ„4|4ÉDZ4‡ÚÛºÍÁE(R ŒtòÃÔn.ãlk«hb÷×öwéåMì ¶îÿ]µsp†ƒaÀ÷Ps0Ìþ?KµÀÿ0÷lq¶ûϬÜÄb&noi ¾`çæýGâ$q›+CàfV@ ['ðßq°½ùA6ïo +ïd%äÙþûTÿN*›@ìáêî` è¡úoæ|`d`7 ˆâD"Ÿþ3ø1i{3¨9Ä9<¼@ÌÄ€œ$ñ=9{s°ì†tÌÁn…#—‘ñZ@a€¿õ5/Ãjkkû+þÃÑŠìÞßMúgÙd jþârx€aЇr)Ôü/æ9à®yN$[ÁÀÿVÁä°€:?¨ó¼F .ÿVÁ äpB6ã_̃d° Øþ!‚tþ^y‘5â„ÌK<Cò¯ õ@HÿÒÿ">¤{™Bz—} ¤ï·„4-÷@H=…Bê½ ¤žâ!õ”þEüH=åB*¨>RAí=Q äÛj<R]óêZ„T×~ ¤ºÎ¿ˆ9_mçD,‡ý¿!2 ý7üëþ ‘¢ÿhÿÿ¾ +P7ÏW¼\ÀW\Èyàääz äãyÿÏB {ˆ£3XN +92 ŸÿßQ3g lÿû „¼fÿd òb‚Án`3ÀÜ4ÔL(ÈúSMH¡tÎh&‹ "?h°%¸ +!ľ»,D2 «Q?="&¶†?ú¸'_ÊanÁ³JU#îÕã©Æ…¾Á±¸Y¬ 8?ÛÐÍi'²ÔOâ2.b&0ÍM¢K_~*L·ýniɳ;d¥['3×Yõ䆃†ñ¨ù„ÖÔý…âJÍ'—~ò¦nn/ÛÕò/D-"<"¬?ÕGB«µ]­Ÿõ¸ôdVë¯]Šï·ÏõwÀ[Å<,éý‚ ]H‰*yßmH65GÖÿìr>üÖXÅrS'©c³¼Ï -×¢d{º<"uôë×Ο«ì}vÑb;J+YÙï ÝS¯v6W=½ýt H™X§b=5p¡ôãtooÃW>Å3Õ1|"‘ÍGR°¾è -ÖòWÒùxçXd²?žþìheXhû¦'1¤ú©¥Å¦OÉ+­{ãi·’%LónK~âWõǯã^¹ëEé´~~óÕœØÄ.¼Ä‚3 +y¾&1–š}5» +üÔ|/ÅÅ|·â]éÝa~Mc(ii’¢VÞ#ž½bè⥧fÓóØ#€ÏÕ¬•õ~#Å›À?¥zÌñ!BÙá˜%°Î÷S±b˜p(  àFëmg°×·µwJÝ&©Ž.f&Ê ºœ¯ ×î_íyÉV—ŽDË¢œzU%ü|Ú©Ä'LJe–)ër.·4SŸãR—°•ßÿaÞ²éOØÇTûý‰/Ëþ“ìšàK7•ìMÜë©:7åwR±šy «°ñë®èts«µâàèU±Ÿœ=%¤Ó]Þl5Ü-ÛÐÌ5¢ 6âüðsÖ×ÂÓKÔí\Ì»Xëxb rü·<)VÉCåÄ”¿lî#QNKšXÛM‹Ã£$êÙqð-Ç¿¡,eeÛ,¾³FQÆ¢¼êoœ•Ê#_»ª´[Üÿñˆ©±Õú2!jpåê±­9}ÕÛ§ýïäsw³S·Ÿ œšÂåÒ<ŒéL;g@åÏجS½vÍEàüýˆ‰¬g“™h*­Jjõ@~G»dö«ñËqUa@û¥}¾ë´¤·dÉ}ØÅ—±ðg¸ýQ./OÆY<Òjgš»OÖóÍ«2(‹ô’ù+:¿02æ>Ù{ý›â|<°D ­Ø… +?¸ÇjVUӌ漀J PŽº¸ mGÞ~·¹BÇAeÍV—¢þIµé4G:-ƒúGÌ¢éq×hþ«ä~÷<¡ˆ.)yƆûMGW¦Eì‹Ï¥[ºFŸ£¿ˆ B•Š|ØxäzÉÞñ¤·Ïd5Ÿ !Õ£Œß†—Ž;¯rµyç¦"Z(YÕWõÑI"_±èqS3ä#s4ðYkç37é°’³2ÈÐWQ$ç§Ö¸'´V1ªËñídŽ¸?Õ;kºm²ð‹ÐÅbññ¥Ûq3î¸á£Wa¶j¸œoLð1ÃM:ÃDI +ìæl—i Wž¶FT$~€Lß™ýìmAðrVݘÿ& 3íŒÌÔf§¾Ô¸!MBœpÄ©,?B^3±øQ¯º.Fè„`öíPâ=Š—ˆªÏµEÎé>§T“^IRZãR]ˆ¿rGnÖÒ_‹«Êeæ’P€6­c»Ë8Õy&˜›I(ß —91êæ꘲[Ú8'°?ÊÛ)–q–ìCw0â=ºŠÔ÷Þ± šŒœ’œ`ZÁ•z L@¡Ø^7vj¸Úi†H¶ã)ØJ¿Îˆ„ã<±°v9â‚îd )©WÜéB•~Ö©yç(³Ž¢–5ŧì"’¢ØS­·è«\g_7‹1¿ªŸ’¯ïG²ÅPáÙ§GØ.ÊÙyýP¾B?YW”Ä«Õ ¥’SS£Ò>¡ÓÕ×ëXO€}”¤ÎUÅŠUÜë÷Ih]³ÉD©ŠS h'zÄPŠ¾H&þ2$ ý:}Z¿æ/„´÷ÆõªVÑüÑv¼ùIAWXSc]Ê›Cc›"8ù¶—¤ç˜’Qºï!5DànbÅ°î•ÄÚ³ FB”?7ÿÝñå3Ѹ¦D+ÎBmŽ*½V5>\ÿ²5r2|“=l‘æ7tWVÇz"h#WÁbå„+p‰cgäMNƒx&Êvþý°a)έb×ÓæJÛ9œC½>‚µZ‹³6‹]_ÙŽ¥Ù ƒ“Q +%={u„¢l{ð¹ïxeƒÄ¶Ú§Î'ÉÐÂ'í–°‹4Xa?¦2o(Ýž*×%ÛktÚµ½"Ñ<»˜4'iri]^€‹ÓŠ¢àa÷èe­*ìeùÛêum¿ç¹ ÷ŸZöu”Ëw§×'mõ÷·¥~² >£±s&dòV§SMVzúv+ºèµÈ«Ù6Y{R·òPü§¡XpåÎÂE/U@;MÙÐÙ½õâ4‡M&É,¥)x“u]:¦É–¢.æ«^.Ó곃À3í}zýx쌾5…±t êAŸÕ| ž2%«oî$÷ïñíŠV²¥lPº.%ÜŠÔÏÚg3ëRìõ0šNtîHUÓÏÁÓ$ñiúg«=„sÀ'yêƒ_~¦ïT‘g Z™1UñåšóúNâNrzöMcÞ1|¼pj Ìf6Q†‚¢¹Ô® +nç9š#[è(dG{)KOß©%²n;0J[ôÖO&¥j96Ìo'¢Ïüºéß9¾½Âà|…¶Ó»PzÞ(Öl\ôKÛ»;ž}>Ÿ¹L¶¿ÛùñtzèÆøWñŠ5è)^Ã+º¸GÏ$ÖÁvÑûZ]j|ìE„σ½Ë^ž M}ßê)…ïK4ŠÑöbôîdÞ7P ¸è®Ð‘0Ò(uÚŽN‰´¥c¶E‹ ¥ÂBwÜ=ZTX('`ýÓÌcmõ +¹ÊÐÅÚÆÚlÿ¹ÍjÃÁyk–Mbƒs%&É%ª•«†D‰’‰ûÅ}Ì”áø&Õ«áñ:|ÃYàó]ÌötF—á…jáj`Œ9IÊKŽmF:Mx8M„ý4%Fz37öeÎïŽqp6¯«R2Ðá4«µNJ1²ÌµÔ"`1|¼½ÐJìÊ’ ó²ÃŒÃiüf¾:Ô>À•u,yüäL¯ûâóû&ýJ4‘¶Žˆ +RÙ×öwƒ§#Ͻ±Ö™S—Ïë…ßZe¤î¢i‚/Cuª4qÕ'sh5ù‰ ¨8ËöS“g¹µ9vH¸—7Ù^¢N´=%nÍ0ñ¥l¢;åC$÷  Ðý$¦ú}­­0†á™cRw€"¼uêþ[å`‰Úˆñ‰…©‹‹‡³§.v(^aíûN"ï_”C˜ `Ÿ´>×íš×$çs˜ï¸ò¾noàûÑrg¼Ýڂ܈aCâN»µÜ›u5C5<ÞcøμÏ@ˆï˜µnÖÞá[;lvPUºß1h-p2~ ®z2¯¾ŸÓca78î)&uµ ºŒ‘v9ÞÅåƒÇ&Çá‡ï éÄjæ'kV2ÙæSä¥Y½DJE*uÕ0<Ïã÷iÝ78{²åN1¥¾ÝûðFØx“A_JEÏ‹#T˜7Gc¼‚šñË`1»)þT’ÿX.M6¸˜Çx6÷ê³\…/€¤jHéãÜTt»àr[~Q”ƒ¬¯´È…%[âÑŸ-_O!«+ ï§Ç“ET}[½‚žÒñþ:b˜´3®q!Ùìƒs}Í,IÄ@{/3j’Än& •\ôË{™-o^QýÃå¶=™Ÿ"}fê—÷}áº_íßâ;žàñévôeàbƒ§µHG¢¦úzç‡~ ŠÏÛó(.ÉUÞÛ”© ®ÐP«–jânª™§Wp’í3åìÏÜ[n*÷9;¾&øøUhšŸäG诶ϫc<¾ÂXij6™rµþ«¾#ú„‹3Õ=QK—ÌÁ¸ö±Òj4@Ô÷¦·Ãx6UxƼôÀþˆÝGôküDM`üÃðI1TYhKˆLk¿NTŠBÚ—úÏÙA°³¯õ2ï‹í¤i•W*!¶¾õùtg»"Šß¾Ë6ԉͩá)¸[k¥˜,ÙDéƒêÒi]]4ðpòahú ± Ô)†@¾ŠYç—šs/è´ª¢ÒXŸߣ‡L™œ™Á>8#mGÀŸ0WuTfY§•.CÏ8Þɪr%‹X‡Ðl.™CïÑià×xbî І‡tÐûu1ÙIØŸÀ}½µL@ 7å˜á¶#vž§4»diëW‡^3¶3»lO¯æ;„3,:_El':{² w‡N‹þÛó}~U†C$Ó¤ +¥SÝ\lYbŒ ®ó¯9‚¾{:25Å÷óÄ ž (¤Ø;†În N©EÝÕ+øë‘Êã¡JÜn_ /æ€Ì·üIh¶òÙ-Þá®Ï7´ùd¡7š­¥ýõ ‹E¶v¨äâ`ݪM{­£«¡TÐ ºš%[X 8Œ¹$F‘ÊmX[ÏE½JŠ:ÔTÝ Ò—9%ç3=«§B¯þϯÌ9*íª2ïëZ=´©†›%š¨Pì'>†6Ê\„Ú¾YÓ‹n žãb_|0d^§Í :Õbc¡Yõç;§.Ù%ÀîWrŠL›.Dï³ §Ô¶}³bgµøKõùìEwïÒ„iÒêÛTB_žCq"îï‘xb™øÅyÍD"œ°%-®O=ÞŒ”¬\–dFg¦¬WÙB °}•:V©ÈÚï±V°—˺Ä.Ë_"ä‚ýdðÅö¿é·Ò„Aôûàþ³×»qJìþÒ¡×?C2xøv;Zz_Þ¡g˜ê²E‰ãÕ|¥î4™¯kÇø~?ñ§tòégF7¾½i’oá¶#­Ö öa¼ßwÀD'úK"®õ_2TÄ©Y ª%›Ÿ¼Ÿ0¯½ûaÿ¶Œ.|}Ä’BÖ“ËÇî¡Rzùã~c¶ à*à•ÃÌÙ°pfÌŠËàËòµŠ—va>ëðVN¡lß<,¥è8‚Dùö~Lv•[ùÀµ‰1·›/)Þê/ñ™+üž&9ävx<’Hb_QêÁtFë\v9è}Õˆ|÷‡ØfòÅäîU°O§³|ž>Ç8Æ÷=Zl¹8?A{¦)¡µ‘Qÿ:ƒL þûæþÙäˆI—Ê™œ“ªÍÔüðc<……¾YÇ3¨`æã‹p\ðgôª 1! '•¥e;°‹­Š[Â'šMx%#¼üìXd‘ckµôè…#z¹‘“YÄ¥*uFH[â éçÞéâgJæB¬AX¤Ô{]ž™.pw²¼ö<¿s°I^‹„íÛh|ª=l[ήNÊPÅÒÉçÛÌ"ÔÛ\)^gê më# `#¦BB™¬iv®)ž/ݹ‰¸픯`4ˆ98O8ùQ'°Z•&5¢õ]P‘Fö>â|j} %¶óp&R^ˆ¯X“+`5 '`Î?âÄÚ›Ú(f[5Œ!Ê£g¾à\°QB#®ƒeC®ò[O'ñ6[Ç繃‡A }¶ŸåHÅ%±d3çÑUç RZ ü5”Œ~é·r?Íy¤ôHУÚÃXÅ›ýd¢\ã;½ø±¥Y× çž²Kè€i,|è’2{2'u΢4Õ)Æ÷î×ß÷jf¤gtÑŸ|è)ý™•Ô}1¸db_–õjÔçë{Q_’}Ž•l£%°–‘—ëx-“”ã]Æ…ŸäocÌ“’j¦¼1ñFðTÍq.84}íF„„f”ÿ"UŠGÍ*ª³Pz’Êß0W11ÔÞÛÕÅkŸï‘‚ž/[§>¢'‘ÁïŽn:Lö*/ò³‹`g!å\þ¾Õ¡X€Q¹mQQnhûóÒ‹‘uo¿è…h9Q3к¨ ‹u^4M8•Ñ³j+|‡ö×€~¹¡Œ¿N¢6¸z¯Æ!Ý­RÒ0‹ÊçX<%ædN›fGÿ×ô™JÇñÛ¤Ùº~K}cv¸Ý±ø»˜¯+ƒÐ$BŸeI}¥éþ1I›„Ë,¾ý[§õö4ž4 ãC»€Bú5Mö[ñÜrré(F‘(z(@æºàÛ{ù +I³Ò¬x=Y3ÍFF[¦¶ ')ÔN†ïÏ€™áaO ^-)íålÁ«°¥ÛÌ)$WÆ|ש°ßôâ pñZK1‰¤ÿÑæØÛ’´²(è2°j¢ÞîoÔL6™ï3ŽMn,™fŠ±[Ë~êW¹ WPÇ„\H6$]§ú“‚;EÕ^¡?5±EtñÜ,V´½<غ ¥+©´ 7œÍœ¡“r¥ae¶ƒ ‡Ÿc÷jPa¶Qý$ÑôQÝi +®Õiܱ*¶ŽÝ.‰ÞJ)¡býN$õ=¶Or—ÐâýA÷–¾sµ9 ï˜<÷H4p +Á¹íÍ3ø(å›Òp¾+yKžãè'-žÆôœ¶Iÿ»ìc@qÒñ³PFòõBá]©ý”™Gž!~ºùÚö¥ÁQaDwÚ íS^ù6nQÑRÉ+‹Ú1ÅÌ#ÃÕKºNYò‡ˆ‚0áX)Eâ`¡iTŒZB?äÃý¶s7Ǫ͛‘ØÒæ¬ÒêÇÛè îk¸÷l(‘žIã¹C9¥|ËäŸé”¶†­Iz» I»‹s|4„5ï;¿²å„C.quê·ÔTŽö6Y›±;q4µÚ,€wÞý_ì5$“»?Êïë®ô4vúa‰â&sÙqöteÿžë¥›ŸÒ+â¼t¤Ð-§Ø WÑ€PUó—Vì0p¯ÌzQ*}ÍÛTð¥r9… ‰= ®¢úšsó\¶ÐÇ`³=QX¸[Ž™ßö…£€Pg%„n®’"* ±2ÆäÀšB:›áÂö=ŽkîµTN9Ás5·¨>â0¶k­ñb÷ Ú KÃ_Ž§¯#!GV«5±ËÚäÒ·!ûØøuVµ4wš,ó›Ý€G—ò;—ùØS¥1ÑUÀVÿNûi%‡røR­™LÚËÈŠ{Š +‹-M:imªs;( -a¸}-b<æMŠ +ÿY+šAÉlÁz`Íš|Ñpý»áË4sô:|è×r);ú. +C•ÇÚøþŽ¹Ÿ½*8—⪲²8±‹p\zM,]p ²!ÁOj"dµòd>܇͒Ê´M¹Ì/û© Aú†1(Ì=ÇF2_2Ši_z‹Üúç Ã_Åuáßr»M}²Éëä¢Dü|iÒßRzÞ´7¤[»UÔ'Þ|©Á*\t诳i—¸E~‚Ÿí}C™°ïŽˆéòRÀK“lêOªMð~ ý$~™ÈeAG·¸˜_kü¾™´_tµ;¦d ¦íwýÂ@ÛcXRF•î¸—N€ó;ôZ![aÈJØ+·:¼sïDŒ¼*O ±ÞٽȻ¸äí öÎt ã1iÐ ïFÜ]¤>koIÜ0Ë:Æ+Ôϸßjž2bt×Ö>ïî +µ6i•*0œ_ÖsïyB„*(#FåY ×z¬ùüC÷å…Ê+ +rfPž“L_Ê"^éÚݧãæ7zr +”MEï;2çZ<ËR7ú+ôUM'ådÐ¥ì1š2%l † +w”ròu²ÕW,¥NHiżÐHþ“•~s:…Cå´½HïÙñ:аòn5mhœÙì¬C’w] %»#ªúÄÿvï,– +@Öî÷Ké²ñ°Ê7JχÓèxo#jåt÷W¾vQb¥¤Q~;7¤C?ÙsCWª]Á±ç!ãtVkgÆŠ¼Ð“‘ÂÜŸ™¼¦±™²äŽdt8£tAåÇìÈ/ù‹/¶é2.\E7…ä˜}j­Û¢•ÔWq »6[bý|/˜ƼʨS­ƒ®&â©2„ “ä^º·…Tù*¦‘KùÛÈ ùû©3&9šµw0½D}ºwìϬŸì/²IôÃC4~Ÿ­tiߣòaÐU)P«*”ž.('3øæSÍYò(ú¹@ šEîäÛwÖÇ?î);-ît8oãº÷ý’\•¬‘j;ŒËººµ @¤@=þMdæ`_s:‡ù8«stÑÉ%"ª …Ù»K¦û1rðl”hB7P÷j¼¹Nd´y×°°‰}R'!·=‡sZä«.!æhêå8F1ºjZTMFšÎ!í”RF|e`¯òÉÊÂMX£±Ï¯/ÕHÐÍlUâO¢fƒhiBã4h¥º»}Cs?&9dÍBüƒHô-³­+å…¦íy|6Má§7ž”ñò#ìÊÓg÷ çº ¸îÒÖî0‹Îáá\ËÐ}¡€ µw´½Fø0;±b߇œçö:n‰M»äšÜ"/ˆË”®;MuIžHFŽå½£^®ïE¼O$•À%„¡$P³UÔ£»ŠçÂ(ç°žR·Ä¢$Üi½Áµ©4xÄürá«j85}oç ‰!!µGìm-L>úù´GºŠ¶Joœô2˜˜·½û=ÉRã— nÑ)Ï®¼-Uþ‹á¦ú‹ž |tòóúÂÇ œú(²ÃG ´Ž.V—UÓdŒ„G#<½¿ÐC@ßpç N²B÷ÃEÕã?ªcë3ü©.i~ïÔM"\f<][+m= Œ¥.‘NbG'ú/í2Ú›X0^6üÜ~ô,ÊãíË„¶ÏÞ9ŽDÙ…á*'ÏÐ.¯Üž®|6ßa—µ¤ âÔÐb/ž°Í½¢ñýíÞÕÓBÂë?a®fZ”i|±Tx©}É×CnuWxXÒ=„ý¥Š'±ëø:ˆÂûSÂøÁ»¶'º¬=ný`lˆ& foÞ¤XWùë`©Mœ¥f SÊNýäAžç#—¬Ú£Ø5×î}Kx´ØÚ\`€tÐ#F]YåwLÔBLÕ„¡VˆYŒØñ¯³æÇ+Õ£rFõZ& ÿÃàÿoðÿÄf¶`jg³ü²Õãendstream endobj 1075 0 obj << /Type /Font @@ -8506,14 +8487,14 @@ endobj /FirstChar 36 /LastChar 116 /Widths 2075 0 R -/BaseFont /NCDHKH+CMSL10 +/BaseFont /LJGBKN+CMSL10 /FontDescriptor 1073 0 R >> endobj 1073 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /NCDHKH+CMSL10 +/FontName /LJGBKN+CMSL10 /ItalicAngle -9 /StemV 79 /XHeight 431 @@ -8529,19 +8510,16 @@ endobj /Length1 793 /Length2 1151 /Length3 532 -/Length 1727 +/Length 1728 /Filter /FlateDecode >> stream -xÚíRkPSבª¡Ly©¤jÝ F‰4O !¡€DŒEÃSsNÈ)É9x8¤D|PIUÆ"6:ò¥ÂT¨”ZbZÀi¡ÀX‹T­Š€¯°N§ô罿îܽÿìõ­o¯õío/š[„Œ!‚°õp† “#AR©„Ãä™Í¦ÐhA8,' –°po°B«\/Àæ y^BŸBAXšGRTð¢Oø@¤qD!GTN¨` YC!W¦@`BÏ"µ¬™¸‘ÖÀé0žCL -‡ DA€õp -‚RXš$¨ü70¤M{›Ê€ñtRð˜”I¤HCÕzÁJ -kFvƒI-ÿ YS‹‡hÕêUrÍDùI§þ•—kµþ/¦IÓ0¤ãèTj üFœ†­fjVBÈÕˆB„¦¨aÀà,c²—½Á‘ôDC¡P¥\Oâ0 -MUBú7©ƒ( Šñüëk'“r%"õi0`ÿÍžŒ9ǤI8¢ñl&›Í!‰ä~{JœÒLŒ*0AS—ç ä8.×SÈ!"#0p‚B°À:R1‹‰byÎd%†S&þÕ› Xj8=}}p+eböH÷&°?-0Ó^\ÀàòÈVìe>€Ïcgÿ“…"´°$ðØ>|/Þ$ªÐâ8Œ“CEÚö6V"¤Ó0¬ƒË Lá»å“½§¶Uçˆ+;ŽÚÒÓç›oi;·õ¤É—9Ôãët oø1þàÇ­ŽŸ ÇŠ‡Ã¿bAJ^/õ”(Ël±¶v;ší]èåûd3(†’¦]*mmyOs`û]Ë´Ï?¹?½“qζvå=¿‚:\0½úæ—sR7¶÷Z쾄Ü‹)‰¥§WSxeü~(V‰Yª.ÍMØ÷Ôù•…Úr»+õ–½I`,•Ú\7ù½˜Å¦ë”}íÎþÔ…–ØÁ -™pæ|ïkÑe&`õ¾Ÿ›)Ö¿©1\úûÌþNº ßÍôn—$/»8,F52ïh¹“¢zžÚ/´Šj ×µ¬mÖø£òêVç9¥ÖupýŠ8i {hk’Ç^ÒþX´cú“ÄçÏ{ž½6R›( nV®Ç§ÅxúìÈð𢷱©¶W?3»ÅÉU_Ü%Da=vË­šú²šF¥ Vp=×åÆ‘ÏÜ-\Ê=á˜foÙ‡Òµž_7šw'ˆuV‚¸‹èG}»ØlÜÏM - ŠïI>yÓóRMýùÊ`çšüé‰æÆÊE3±îþÀ¹nþÎó}g;ˆ"j§åB—®ð¾êl–o|lÁ1¡÷®¾ƒ?G™†{/ȱÜ5'ÌßÏY²ŠÌb¬Þ›z¬:¼z›FÿH0kÏQAÝCŽMYÖÙ'¢Æx!¨õßøt)½•¶îrÍ#¡0âyE2 8ÓÜ‚âèÀñ1C÷ÌÇëx¾ )¯ºü¯9XeصñÁ£›Ël_GÚõu÷ ¨iâO‹s^oéÕÚ9ŠÛâ-èÝ£¦Ûß÷"‚þÍg:jÝýb¿ZìßL­=ÿËèòÕ ®£2ÒÀVÇyX÷Ó ¦ -M r¸(Oñ°¸š¥ÎßJž¸¢æ¦4㶂vèå‰ÊâhVÎ@÷ò“ÞnÄÊÑ -!*[,9¥^j5íöôÑÇÅ®OñM®†ñëËvB·Ê#ÖŽ”ûÝé×æ:_.hÿù´—T)}/Û“Åœ´¦½ŒˆäñWŒ_—ìœù4ñÅ‹¾ço +é­z'3Ç3bܼøe¸¸ »v°é–×>38ÅÉU_Ü#E~!}V+ ÛÕÿöÈj“‚XÁ\‡›G?s6ri÷…ãê}ÿ’®sûºÙ°'A¬5Ä]Â>¨zôó¥ÖÂܤ €ø¾ä³‘·Ü.×5^¨´¯ËŸ™hh +ª^Ò<ïôŸïäk¿Ð{®(Á T»Œ{´ETç²ìxã‹Ž =ö¼ôú¡$ÊÐ4rÄsQŽåЖ©»˜"—ë½~±8Z—¬ëòª;iø~Þ²}Pd–{ø¾Ô㵡µÛպǂ9{ q,*²Î=5§,'Š@½Kè¦gË]Ûë¯Ô=&mŠÂ^T%3‰8¿³­m™NŒë3¸g×®çy'¤¼îñ=q¨F¿{ÓÃÇ·V,Ú±ž&´èÐÓÄŸ–ä¼Ù:Ú¬±²7wı{ÇJï|ß·œ;d«qö‰ýj©o+½þÂÆV†»sm•‘z6çV`>0Á€ZªÔu ÈÁtÙ_žâbt4Hí¿•Ñ^½'*—åÛ>‹X,°˜uÿ£«qŸ~“\û nM¼ÖûùhøNþKc"Ë5±È]N®ìáÍ3nxšv8¯š^7Àþ›‹öÿÿ(,'H\-'Ri¿Ç¡’Îendstream endobj 974 0 obj << /Type /Font @@ -8550,14 +8528,14 @@ endobj /FirstChar 60 /LastChar 62 /Widths 2076 0 R -/BaseFont /BMYDCW+CMMI10 +/BaseFont /OWQBSR+CMMI10 /FontDescriptor 972 0 R >> endobj 972 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /BMYDCW+CMMI10 +/FontName /OWQBSR+CMMI10 /ItalicAngle -14 /StemV 72 /XHeight 431 @@ -8577,13 +8555,16 @@ endobj /Length1 842 /Length2 1048 /Length3 532 -/Length 1656 +/Length 1655 /Filter /FlateDecode >> stream -xÚíRkXgµ¶Šºf5BeŠY$™‰†•* #1²–’IHfp2¤–O *+Ð Ô šDxDÄ¥rYŠÆ»\¤e»²‚(¶ŠÅÊ Û-ýÙýµÏÎü™÷¼ç;ß™ó¾Lg‰ÔÓOÇ"B#=!äB¤Q@,Æd -&Qó‡IÄ€¼½!ÀO§ .ò|8 —Gc<Ñ@ ª8X'p›%ñ? B rB`2ÑPrX Hq9Šà§Vá³'´@8¢Eˆ$DÁ¢A @å$‹¨PŒÆžu$”8À›‡ºÄW­$„ÐR¦€u”I7€²¨À1µP J[ŒSw!”“ÿ†©…âBZ-†5³òs)ý¢kPµá%×$êH„BpB` ©ȼ¹Dê4 »"V£r?L¥FOh# ÜÀo Z!ªG””ÇJX­EæpS,´BÅ7g„Íß"æ{¼œë\S£¹ÃˆàOì¹ú©¦R"P= ²@¢ˆÔûêk÷‚Ë09®@1Àáz0AÀµATÅöBŠ)=€è)Çl†“Ô€Š&Pâmv¬Ô:±c©hrŸ‡@…°Q#Êÿ„7¼„çgûoœú3v,,OЪamÜüË8ø|\¿×“ã xz{Qö È àñ¸)?'Ê0tù\7qæó‘ëÁȹ=¤¢~U+Qj<¢Gä´žn\þNF|A]æ)cÀÉÛåKØÖS–ʇ=VÍ‘õÆ"T‘"å sV‘æáâþÚœVFBûªíòwщsÙâƒïŸ WÔf/‰ü(ÛÄúJÊ0|˜•ÿ›®Ã¢Ö=; ?3õ¿åÓDÜ?|Àe}ϸKªÅö¨bˆ¿ëdã³Þn›åî៸¿íÈë)³ºûÚJ†áîƒÎ5ëS .ûÊÇnü=X$ah…Y®íÊwmbÇá‰oh»•Iííaƒ~-]CýÉ«Ïß =Ø­uÚÿö>æ÷_HKôO³Œoíýòj¢£cÿHvñÓB­iMNü¶»·[3.÷³sÓ‚W[îoˆ›v´xˆó§{7,®¬w¸ÿììhßÌ•ã_Œ“%pÂgçóœüGßßSÚàûLÆÈNaÕF=27´Út7¬€è[ºz¹SǬÅ×—fqBtµùõq9#lÆÀ·¯wß4ßOÓ,²u8òAØîó´ìPXøbivË@ïŸÛÁŠ÷iЕ¢o«ÃŽVê™>5΋}W̤ÊNÞL þ½1i­íšu×¾¯“V·2ŸÞÙŸhã¶MÔýÑ÷Yü µUSÆ0OÙöEäè…éQvzé_¯K:Ê}:PÐUü[ۜӃÏo¾»æЭNóZác©l“S`{{ØY2Ó6jü7«Fᶘ+® ïe-™âXXÀ)î¼Ò{·[䜞wxýÆÂ+£îé-ã3…‡…;îëžZw„ätœÊ³?#h¨Î¼gŠjžìQÑÜ‚¼:Kžõ~e±srY¶|¢~Ó^F^nDZï$ýåm#=ñ?.3HÅì ú•ôâ†dê…ñOÓ}Ó£w¯6ô9Ú_«s½1€N$WßY›œÜ°$çjsQüõ®¢rÓãªj‹KFèC5Û¦«+¦FVÙc®wRM¯ï±½Ç;¹}òl°2ÂÂì7Ÿ+E"ÏŸÚßüž`·œ\ŠËþ¸ãÌÙN¶¦o1·¼Ù÷¤ö¦ymÒðåòio;NxõÊ#7Æ0ŽÉê¢ÝZívSù ù½Ž‰ ¾?‘²ÏM¦Ï]'kì2ιœÞœî¦ãFñÊ$Ž“»6Ûy}ì8aö¯ŒOyÃÙ®é7}ùiÕrçgtÿ‹‘ßJZ¤³ÝÖºo£ÇeÌ< 6VlÑUõ“®6e¹—¶:4 -|×{œ°MÓ Uô‚¤ðäÊ®i—uŽ^/lÊ+Û¸³Nrü“kÑ·—ýz¤Öç@iie¡¢þ¨‘93(*dÇò^—N‰ì¹ß??”æërÈîR£ØôñáÒ'êÌZNÀ¥-¿­¡ç~¤Ï|¹9Æ=Óõ¡ú¤Ù¶<üVû’b³SªCÌ£¶ÿ¨Þ ëª'~}ª†×Á]«wÅLìµ”­³¿à|ü•íÿÿr5$®‰Ú¿istendstream +xÚíRkXguí*²Ð5«*ëPÌ" ÉL4D¨T!Œ@Ä”ÛZvH&a ™ÁÉ’Z<%¨T ©4 ˆðˆ ˆKå²w¹HËve "PlŠ•@·»ôçî¯}:ógÞóžï|gÎû²œ$R_‡qŒô€Ø7 ‘FA ±A‹% ˜DqÌ&oòò‚_ +€xÈ÷æ‚Þ<>ð$ªâI`ƒÀuŽÄ|5Êa ÉxDCiÈa5 Åå(BØ€¯Z „ÏÐáˆ!’›A€•“@¢B1gΑSâVè’^µ’BK™6P&]Ê¢ÇÔ@(i1NÝ…PNþ¦‹ ujµÖÌÉϧô³>¬AÕ†— \“¤#Á-¦F æBªÓ,îŠHXÊ}1•< Ílpo¡j…¨QHPR(aµ™ÇL±Ø +ß¼Ž @- p9×ù¦F1r—! ÀŸØó5ôSM¥D z dƒ D©÷Õ×îE—`r\b*€Ëó`‚€ 4jƒ¨Šì…S zÑSŽ9l '©#M* Ä ÚÜX©uâÄQÑ"ä¾\ +#`9¢F”ÿoz /Ìö_8õgœ8Xž¨UÃÚøyøçqøùáú½\/ÀÃË“²AžŸÏKýO¢ C÷è‘?ÀAp w!¹Ž ŒœßC*êWµ¥Æƒ zDNëíÁåoe&Ög2œ¼]±Œc=m©zØkÕÙ`,F©RÞÑ0'i)¨Ëmc&v¬Ù)ëƒ8gŸ#>øîÄ Fe]öñÒÈÒyÍ쯤LÃÙ¿yáî2"jÛóNÑg¦7¼›‰û‡8oìpN³Ð*†ý¢O6=ëë±Yéþ‰Û›üÞr«»¿ZÍ4Ü}еîqCZáeùø¿‹$L­0Û¥Cù¶MÜ<ù m·2¹£Ã=lÈ·µ{x eâùë¡›côcŽûßÜÇúþ i©þi¶ñ½_^M²bvîÍ)yú~¨5­Ùѯýîí¶ÌËœ¼ôÀ&Çൖû›âg,îâ‚ß©À¾MKk†ì¯%|#;{Ú7;låðgãT)œøÙù|Gÿ±÷ö”5ú<“1sRÙAõEQÌm6=« ƶî^AÞô1kñõåÙÜ]ÝdAC|î(‡9øíæë=·Í÷Ó5KèöGÞÛ}ž– + _,Ïiìû°= ¬|])þ¶&ìøX•žå]ë´ÔgÕlšìäÍŒ°àß“×Ó×Õª»÷…|¼¶õôÎþ$×¢ž¦yx$Èö»PW-1eŽð•]±19a_DŽ]˜éôE`§—ÿåš±´kI‘lɱ¡ƒ…Ý%¿¥çžz~óíu‡nu™× Ke[93ØãÀæÈÒÙö1Ûà¿Z5 wÄæZñlø/oÍÇÁnIו¾»="§ŒüÃ7]sËh˜-:,Üu_÷Ôº3¤ ¸°óT¾ÝAcMÖ=STËT¯*ˆæäÙu\ò¬ï+‹­£óŠ•“ [ö2óó:}'¨hìMøq…A*æ5¬f”D0%Ó·üVÙû4Ã'#f÷ZC¿ƒÝµz—ƒèÔArí¥q))Ër¯¶'\ÿá*z!/#¾º®¤t”1œY»c¦¦rztær'ÍôÚú=þÉSg#€ÕÖ€ù\šyþÔþ–wC¸Ýã”24XöÇ]gÎvq4ýK¸åõþ'u7Íë“G.WÌxÙrÃkV¹1ŽqMVm×kwš*NÈïuNõÿ‰”}nŠ0}î2Uk÷yÎùôÖ W/Êï¡Lâ0½•>ìù±Ã¤aÄ¿*!õ×nˆˆ¸nÀôuÖ§Õ+ž1ü/F~7&i• +̶Ûëk½ŒîÖqó Ø2T¹MS\iÔO¹Ø”ç]Únß$ðÙè~‚ž®5ª…Éá)UÝ3Î<_<Ø’_¾ùzÉñO®ÅÜ^ñCè‘:ïeeUEŠ†£FÖxì@¨ËM:3.²ã}ÿüPºó!ÛKMbÓLJ˞¨ÿa0k¹—¶i|·‡žû‘1ûåÖX·,—‡ê’zEÁÄ­Že%fÇ4ûØGíþQ}™ÖÕO*}ûU®ƒÑk¢ãŽN%õYÊ7Ø]p:þ—íÿ ¹ ×ÀD"íŸpíuendstream endobj 967 0 obj << /Type /Font @@ -8592,14 +8573,14 @@ endobj /FirstChar 15 /LastChar 110 /Widths 2078 0 R -/BaseFont /BVEMNB+CMSY10 +/BaseFont /CENZFE+CMSY10 /FontDescriptor 965 0 R >> endobj 965 0 obj << /Ascent 750 /CapHeight 683 /Descent -194 -/FontName /BVEMNB+CMSY10 +/FontName /CENZFE+CMSY10 /ItalicAngle -14 /StemV 85 /XHeight 431 @@ -8619,64 +8600,89 @@ endobj /Length1 2224 /Length2 14366 /Length3 532 -/Length 15584 +/Length 15583 /Filter /FlateDecode >> stream -xÚí·UXÌ–h‹Kp×…»»K‚»»³pw A'¸»KàîîîîîÎYÿîîì>÷>ÝïŒYµjŽªYäÄ -ÊôÂ&vF@1;[gzffÀgYf&3“<9ùgG ¡³…íCg €™›› lï`á03ñ°±€~àÉŸíì=-ÌÌTŸ©ÿéÄ ¶:ZÚd Í6 1Œ ­ÊvÆ@g€°µ5@éŸO8”€N@GW  <33ÀÄÂØ`4³°…güÇIÒÖÔÀù_aûÿir::¤TÿÒ¤€$Mìl­=&@SxF9;P6 Èåÿ ­ÿ=¸˜‹µµœ¡Í?Ãÿk¥þ¯vC kÿîagcïâ tÈÚ™mÿwWuàÉÉM,\lþw«¤³¡µ…±°­™5Àô_! '1 w ‰‚…³±9ÀÙÑø¯0ÐÖä;€Vî_ŒârŸe¤•hÿ»¨ÿjT0´°uVñ°ÿ÷¨ÿôþ3ÿaÐò8Z¸´™@ëË êúþŸßtÿW2Q[c; [3 ;ÀÐÑÑд}@ÄðbXØšÝ@w0#ƒ­3è#К|˜Ú9ÂÿSQVV#¨ÙÚÐæŸø…ØŒ.vÎ@#ë?Av£­‹Ñ?•7³ýæ0Ú¶Îb\FCPÔÉ´4ÿŽrÿ÷¨ÿµ%þ'ÌÆÀÐhk 4ý+ÊüßÑÿÕ™4²Ó?C8Yý ‚f`oíâô'ò7¶³±1üÉ›{Ø›ÿˆ³qüKÜÂî!h.NÖ†Næ" ™xíþ@“°³þ›ÙAöÎnÚÙAÞÎæŽÀ¿z€”Mí\ÿ@º¦®õé:ŠýoÉ:]ÿr–ø ÁRµµø[„ëŸ9[Ûýõ!±øÏ(HØèôg±8@Æ@Ã?•æ›ýsíÿHs°þS< Ó?WÑŸ HTø$EþHðóÙ}ùC 3Ñ'ÈHìtÄÿHEâ$$ÿ(»ôe—ùC ì²”]î²Ëÿ›¸@Ùþ(»âeWúC ìÊT4•?rQýC µ?rQÿC ?rÑü7qƒ²9[ÿã0€î|F#Pø?÷&7ë¿{ÿç!áɸ€Ž½£“±ãŸº}ÿœn‡Ñyÿ›˜™@‹bòþ³EþÂvô_ò0û A cþ‚d,þBÐÒXþ… '«¿$eý‚¬þÜJÌ  ”Ñö/YÙý… +û¿ðŸ û‚¬ÿÂŽØ_²rþ AV.!ÈÊõ/Y¹ýA•û_²òø AVžá× øõefaû§Àù±°ÿw¿ÿ¬,3èÙÝÆÎÖ&ÿU’ÿûå±s÷¢gг€îlNVfÐgúúŸÝTm-@§Yò èþbbâbeùWÔØÅtá:ÿë­½iÿæ tÃ/ÎÙóZ&Ö}/öÍ(¦1«–«é˜nEXˆ·.’v Y«Öx*MAC܃Þ#r{ÁsúÑâ­8*vîç4û¶çj°—âÙˆ§q•"ë±kOrpŒÔ\7ssÂ.?µ6\§™×›~Ñwœ­@õEef…¬SÛµ¶35ƒSC,ÅZ58¨š‚•X 9É¡8„-xÕ 9.ju<ÀÇ2¶vùÒ®Åõ)6ëç›>Ø£ñ‡0‘Œ…úqKþàz®U/f«áº¸°š‚vFr£ÔŠÎ䊰™&ÛÅæû¥ö‰M妪N°™—-8#šQœý~*˜ n'õS˜R±OJPÇ<¢õe²ÈVNåAL,…¢7Xq‚©ò§@Ú­¼DÊ¢ZÏwé±ÂßÈuAX mþõ¦€a¾.º²UÑŸW_:åNµ¼¥zHcðÁ[DÔßP+YoÚb`ßQÆÑeçNìsz:w®©²ÉwØÉŸ 1;|¨FØÓïˆD¬¾ -Y~ \5¦TŽÏ‡,9„Ý çÊœ¤!>°HöÈøFV'ÎXág×ö ¥dJŠiÑ#ŸÀþ™yj£,¢3 }à¨6¿]l—ìÞ‚Ãi϶ÈûñsÌ®G·üã ©Ç0J&¡v[1îŸ  vÂØ -êeáìS׬é…M5—(ÉðÑ…ÀáQw¥mÇ"Í·F÷NwèeF©¯Ïùvs•ßí9äÁ×¢†ž+_Í»³˜QcÔ9ÆJKÂò;ÊÈ©,t%[C‰JÏ,Rà·Oƒj “d`±&òï/²;I--y¢u¢ÌHÍ -äj«ïNü~AÀì°,G¾ÌN#b<61Éyp3l´tl:×d¿ððcA`Ï“‰úö—|êÓÅq&ʳ o7 ‡¡•n‡M’ŽN È7uŒV:•ÖóØünà*¡÷ý"ã)Ó5èêÂg@ËM)¸`±&'«Žº?Á*«œcO[¨BçðØ 2šiœj¡±W5¡¸––u‘$NŠË5`Úä‡Ô¥Aî¯kÎÔ~bJTßÒF•¿_†RÇMrxW„•w(šöžk埱I:25d¿À©õ; üÂ~±ë¯È£n§&IPˆB+oO9\ðGtMÒÄæMØ^1—Ð\ÂÃáœÅæwð³‹3SaNX9÷?6o纑jCõ§6/›Žáã -‡.ÕÅ\½|¬´YšHŽµs¤Ž6Ç¡@>ãß]ö¾ã°’™—þ¸2Úô%õ©<7‰R]Î@ŽyX‘{Û—ÆP±«¥îP½ßþ$/\óY/Ü•lÖŠå¡åuÀ¹dîHgð—ù÷‹ðþ5°[Z Á™¦+k µ!ÊjÍwþu4¢õÝ0ô®(€SÁop<×y¬Cœ]¤s5^ÝãÞ1 ÒòzÒØÁÈÑÄÁ.˜|Ú˜-³ýÓ°Ze°¦N´%sW½-Á|ˆ‡ñFBù•ÜÔ¥ãogÝa(°cR˜Jõöœêd -®F˜TÑ?%tV›÷BÕˆìÞ¹•'ç¬r pÆ®òØsy]ÄÐ)v£2߆êXû> |ï&f2UB¾‘G¾Î¹9bVù„Й·D¿&^Ѧ”{ð‹Ó˜–TWnŒ¯>1¿˜µG‡Š2àÎå˜Ðû–™¥Ï"¤Gävƒé—s¦éZÙžì©Cˆw æEfß;K´óÁÍw,’·»žk¨XÙlxËÃÏ^xˆ!m…(F»d¾†?f«Ÿ¢Dhú¥Ÿ Ús›zÊxX`ƒgàrÏí¦6Wuí—“²ðl˜•&‘hùcÕíÞ"²nÜñœ%?›'’a -ýúû¼?’J4QD<6Ž”,3èYˆr,z[P©þ‘dŸï}X´¾.¨Ä ž×a•Ð«Àü…aó–Õ©è3 X<™Â¦˜WÖ=š¶3_Ï@ ÂÖ[!x½ Abì³á‡çÐN¶zÁæò -|À£Å³"}zß'4»th +†Ò:ÚpÔ)½ ¾¡ž;7Ró™A‡ÿmY2öu%Ò°V­Û†Ó{^ºiÖEj]—‰ôøv[ã;LX¼²m¹P6Kä#V–:S¥›xmÅ Û—WÁ ¹·A»âÒááDÍŸ{ÔÙNô‘jÊ=¬Šðø <ñ†åt‚©‰œ}IÏ03t°™ŽˆÕÉ^Ø[M3I"¢ÜÌ&®Ê ¼NpFw|a-}ú¹Ãa<ñ° Â/¥|#D{9íE–‘¾¦ÁÍ£Á¯Âbü$fÝj‚ðÉ1•_ÅI3x>¥ryd ³¢>HžµS?Cßô&àä§|¦Œ BOÞsö:73.Þ©ÿkVjà€ÜóÝÁ>Ÿeu`“7ßr ,‰¹/¼M Ü—-j¼^št@ì?Æ@Û8E¡¨ôü´j4÷—˜§HOB*»AØU©ú0‚•þÇ> è-öªZê#ƒFLU*£ÏÁ%cLb¢M¤Kǹé2´9à÷!$ ²ú)SÎå“N`ˆÆïî!3p­¾ ˜PîÕ¨9Ö¦1ÿ8AÞö´@ ?ûú í3O‚ž(–}‡|ˆ«wu×[d¤ûsÔ(ÚO?~­M=}f…VúŽ}ìÇÔ߯u1Þn6ˆxbÁ¤Òl¿œªæŠõ£˜ÒÏ”ñünò-›JÒÛYù|—ŒkO]”?òúI©#Ÿ.E]2|úîØ3áö~³‹A7,aâá)AÜOn.îwæÞ}ÀgƒR`SDfÈ‹›dتM/Ëo¢•ÑÈÜt¦0ÙX((•…Ñ ~‚ò®\EY¸hõö0âùo—ì\OëÖ!ÈS©)å¥2"ÔX‰»­÷¥åBÍ&n]p°k麚y]ì:ËkÜe%"]ó7»0 gY §i‰7àú +²ÅcvŸ -mýZWª*UñV&Y³÷n/¦çné¡Cãå¢w‰#R¶!Ó±Æã.¯Et‘Á}åD1Ùüýù`@vÌPÿ×½ðÃ×Ð¥+Îæi<¥#Ä“”s餥ž ÀêCƒä±Ÿ%RŒÍžV–ÀŠËU°2Ú­°„zÁý¦<çk‰‰y7~7B[סÏÈMîÒÑ2¬çþ²z)`×ëêÄËæw7\%PàŠªë*Éa®á‘fÐálžëÛ7°dñMÿ[×..ä2¥ß-Ž17á‰Æ‚mæ3AG?ƒxBj4N:s¥²Ýšâ›K²!¢s<ÔX´^`d’âÞNY÷ÜLB>hFò@CÌ#rÉòTlÎ[HÉDpv{³­Þ×Q…‡©˜ÜX -üò¬ÈC4Í “ï8b·o)y¥hj†Ãä~}î圧šKës¸T[Øï¬Ò{­òä–`‹ø*ý•ÉÒSb ‡ôÎ{Aàö¥¦"âduÙòwmvõ\2’ÖòÄÒJ˜ÍÍjLu¦Îå:N*øn$çŒj…á~SMtƶʆa(‚„tfÙ}‹è¼¨åPw“…ÀŠÈ•}B’áM¥æF!HdË '{9°=Ôciø꯰õípR#>C)Щ8Ð\ŽÄEÀf~£XpKJ+Æ|w‡ò‚qâíßÖ±ºB;!©9Ò3™@ ²ÃÈüi ç*—¹X}ÄFg-1¡_o±Ïˆ8”aÜƱŠp0û.Q½VFëµsÒÇØ.ƒ-(ð X2ã¯fOo%ýyà÷4A¢?QËÂzSR+úË$·ç -­) ±8`¹Ý ("Ðúë²±â$J´C‡ 1ö»×ÝSR…Ÿ.ÜC‰1$RéÜþ¤1’ûeùع9H¨¥_œ M„ùàýšM<ñÍ¿úºÎ¯B˜e(j^•|F\£º¿ò@}·Ã™Åê•×ÆðΞ½ÑßÖXN-ACê,zs~FY‹ªk{h!Û½O-ò‡Sñc¬|O#vRRÙµ¡×Ý Âe¿äól~ɤ¯ŸòЖL³¡‡Mâšé‘‘>-òd„¿×&©«ï›pAèf/*Ë=n(¿=ŒJð|™Å”¯´®´6“Ú aDw’M]NJL¦óÂý²L^FB—%ÿm•ä©V¹“s™¼à ãKÅ#>pEð8ª 4©Ý¦+Ó…xG!Ž`¨rêe†‹—xB+ÁÕYæDlšÄkûÑFšw˜5ÐEƒQËרÔh­oÂ~šû\ƒ1ë*9? Vx8UÜ{õéŸòVÔ/,Éb‘ŒÄEzÌ=+À£`ªêÔIÈú<ˆÎͪ¿mñÔ·V^v4Q/kçw 1æÉÐ÷!-ü]f”ø…Þvaö˜;´ñÛw¢ÐËŽÍ6ßÝdBª—™1Pí§XXØÉñ¸xM?QèÐK&Uäû¨kìX£K(Æ$‰¯p ¶~‚Gr×аn²² -Þœc’ ȈŒæ[Kô¿ÉæÔ µ<‹ÝàOeDÈ*$Q‡§i¼sÌüBEÓQ <>ãJÁù>Ó€ ;O˜f®Xýaó"¤qüè1Ìüƒ÷ѳz‰ÍÓÄ×-Êþ#™+»b6Á'øÕ²wŸN6%3鵇À- ÈÉ~»",½päÜïêñP,—´fDYiçêÇÒU·‹}»þ›Œï'ï×üßã~¢ÔýÊIãÎnyÏâÞãiô yü„À¼w-<Ç&âЯ=Xc´šýä¬bÔz/ŸSf3H­{óÿµVÚò¦TÉ~IwÞe‡U7ÄŽÞS8ôÚJŽ&†C—•iKubÌ'®®~~%«ÄÄìãËqëÐ,!äªOïׂ ú»‹‘éS?Ççû8ì$wl½Î D7”P,;ñ›Ý!“\uŸ³rý«if­ËÉÑ©Aë‚ ¯ á¢>‚â/«×»úxå*ú‘ä;ð[éÉÔYƒš”þ”¹óøâW‰ÞÒÝ©W€„[ÃØõ*Óý&sõ‹’›Q/­Âk‰§,æ@ë\g2h²ä½Õå©ð¹Îµæ1D9`ŸÄöìsé‡j.±ŽF H=.GqÙXƒñxÅìºçD«ÍC|‚Ò¾hMË{C©_6šonï¯Är^o•ûæï˜I>VÒÖý¢éפuöt­ij)å««/‰tÝæƒ)³~·î©P5OÐP5Ò÷Vo¦TÔ†àå*ÏJŽv‘R·°!kÖ]c+ -l­)]TÎxÓÑ@qÌ,±ÇÁë‡[¡‰µßûïNãÒ£å¸nõ캴ZúÉÃþM΋ñ‚t=Soapb#†½EÁ$ÔzØ3¦­”)_×NsL-Ë+¨ókwÕ÷ç76µ4üfȨؕ3Sü0çÓ mòݱix(*§Ô2¤„¿™£—–§%!刕¿éSk§Ú!;tÚNµà•Æ?Ï*rFÂÔ+·A4?öl{r±H•gÆLJ-EÜ cpB~x0ΖdÑÇøÞPqöãõI)N­q ºãÑ•Mا|§™àÓ0]pgH÷ÊaÃ%ùq¼Œ—û†@ÅÖrNY&kû¹_¶y‰îËÊrGÿ¡r·ô[ä38'æX[1,®²Ç9L5j1«Cð-*ÇR3ºb"+¿Ù¢h58Åyg}ÒÁgc¦„hÙ²n—œ<Ì3ž‚™2ðä J×$2X:ÞQŠè ôÎ{_*¾¾ùGÕ¦'BF„ÞŠ£ËHÎßH“³ò.Ám@µ™rLç­’+½‚‘å(µºñTËØp¯ñç‰"jÛìÃÐ,*߶› -ÀE†º;J/w‰JÜUÚ‚šÝ5uÇSY]É.—_Ž-uÅiÅ ,ŠÛ#Ò-%k*@GÝÃÜg/„„6Ùš¾Z*,¢eì{Ón·@‘†öpX+ÙÙ_±(ýN†ð³qÑanb¡àCý0‹.F÷í—7伧þ—Ö3#öCÎØWûå´¡¶\.[äÕuzlDj¯zBŒ y¶ÅxqRˆ .¨£6žH¶n7:}72oÏ•ñ2r|cu£ø²¼‡4ÉÉ8ÑÊ íòêTp¡þIIôˆ”=ì‘ ~ê¹:ÙH†S±<-þ§Ñ}À˲cí4ÑÁX¼éŽZŠohP¬­]c7pÒÊ¿¼ŒõlGc~¯íöaúÓ4nCV;ŠâU ¾=štÓI¯Eáe˜tšÝ¤G ®ûjNèÁtÙçô’lMÖF+ƒ„!Â>QFm“ªUbÿ†­ÅËŠá' - oÆI†ü *Aþ]e‡ûW1ŒyíÐŽ£y¶Góa¥¹2þ5[xÞÂ`]š9SÝ­5^Mú]=Þð³sƒ/ 8ë¡ûEž“r÷¿ŸŒ¢3|‘ø2©¥è(¨îKÃÔCáÆxš4)ÂàqÛ(-ìáx -{`JnrÁ룛IÔ9&ÿ(¤KŽ“~¯>ªxßQÆèu•†Õ4¯ {(,æe‚9§ ¤MIä¶0Ϩw¨9®ë¢ õÖg¦¤ÐúÚf¬ª’±§^}“iÜ™›§_ n6P`Ã-4pv¸‰—-àéƒišTRNŽ`&;žË˲ÆšðÙÓ®Hj´£VŠ›ô…¦­QŒqb÷߬¢ Çν؛—ŒlU&ø. Ø­V⬋¦ÅëÊðC§$3ÙŸ+ 0ãeð³ÆYÉÇç*™Æê¬ë[^Œ^4ú3Ãè|†…S,ðÿ®¹²ú•â`–™%nh8& ×Á…ˆÅ„ž#É©ÿ@¹¨u·º(ý§^¢2ž“–íKMç!¥8„áoX:&zDJåI«Ë\>©Pª|”E×=¨SKfD+÷3va/‰ª_l ™ÏVu~ƒ¬óxFn"]¤¡éª–‚•ÔJ üeD{ˆ ˆâß ú"·Cæ8awœÈûanÑ0ÔU§{êͨšº•—Ô.]ô™ìËAäodwdï$dH×<2çáp.×yÎé\8´©^é'¹Òe:.„,š/ħ¬+¹$Ž1ÝŠÎÕ5‰i÷¥´§¬¨Ž,ø™>ä8Ž“ž@õÝøÖj@|¢HâÎ'¥‘ÈÈ‹kjÚÈ*ÂÃY;[â<˜\Êà JÈÅV³»ÊbÍ|‡>Þg3äÎhÔƒÐá»Ðƒ½ÓTþ´gÎß:ýÊ…þæ.HTMzIóÁ3—1Ú}Z«% ¾ ›ìez‚ýËJoÌk—¹²iÒ¹¡qÉ—ôoµ´`èâ|uÇPÏBv‡~󞬳0¬Ú1":¬ãÏW†5»²’…ýÓ»(Ó yÛ'‰­<ŸÉ8V`æ|ô“‰Ô¾}E¯ùégÝ4”­å?År'_QÞ“³˜¨@õ>ËßnÍQ~0W÷DÓÛ -5ÀDªý`Å:ÉÔ‚'…ó°í{Q`õyœcýÍõE^Á /ê–3]ëÉá–H›eñ8³u!}¬i/åÔ¾!—ψ4~ÝAqéĬü©†-ƒ¼ Œ÷í->°Ìý8pÈ|]ô»KõúôMqEØÙŠHD'ð½É‡½Š!A4)"‹‡K•4³ÏGj¸&T¿ÿAªr^¹Ú³XŸgæ7Ífýã´¥ú!l`)§œ*¬ ]¾w#±G~¹sÏ4Ã&Âúe'(YG‚3Û±¨‹×í;.¦Ñ[ïÝî]Üœëêlª{é—ÖMÎ^B9Ãî©)?{¬ov¯ÇépZ3çLrª`ÏmÉä–P>“_ù9_™è7^ý0´]ž”ØÖ òÏqûshµíšYö—ïÕ&8Ôò×TÓ¶ ÚQŒVeÑóýôI¼µ„Ü?¢P¿>m&>7ANvUŸ¬Î Öº¾²SË—*,/W›š°´‚ œ9k‡<û´êlLCƒ³íàפßhÄSëžB•f›Úö%Œ?õ#Ê0yc´d` ''DÝ=4ûø¨ÿä¥vT6t¿.¯b¾o‘ãÀ0sžÑ2Õ7«¦Zµ:rüÏ'ó©y‡˜~MÈ3 )Xܘ+»å4ŠöSÅ©Úo®4ZF‡wðÍÚdzJ›Û^O/­\fZ†ùÄbtÄ×[yEô¿ß&ÇUÑ ê¾Mç«ÆEç¡„8ÄÄ%Þ -…µh}¿/l–˜²˜wÎ7ùœá§„6µsv"ŸbÍ £ àôlF…÷>7‹9âxÏç 4*ç¤XªfØǪ~ŠÝÍg©“®`TÈKeiŒ¯'tr1ctýF ’=?£×™çÒä5ÆÚ5,¶ú¦R-ŽLPåÀEjÛD¡'*(°±&DÌφÍEåãü96ÖܨÔkKiˆÛrF¦2¿n_H§Ì[›ï x~dZÇ»í—>Cô²q -ƒÅâsÝ’1fSƒbæ -'ÏgYftf< VØiÙ¯ÇF6¯¹N§Î1…¾7ÔÎí~E‡pÂÆ1¼!]rÝòÕJUCõؘÍ^¦*¬‡ó[=‰â|¥¦Â¢“á·äd¼QÖC¥Ñ_]à}vªéD¿Lh)ŸÜP( ® £& -Ý¿DcHÑC‘tCÿÀ·Gwü.ruÒ:yü4J¶G¹ˆb tòìÒ.WKm„üL¼½‘=;øíZ%ª,Z"Rn2ýrÙÿ­­ý‚¡þúé~Ñ6ãË`iôMÐþ!{ ÚĈÈ8t_Oñw%†[þye][Ñôb™êáÍ<— ¸Ä‘£Ó5§å®ØÛ`|q!‚Ù¨"ͱFÊí,)Íp0Fÿݵ .!õVi4´ó„ßþìÐÙŽ–í“‚WN õ¢ù‚HNxz$÷çûå¶NÄ48×ë{ˆ9;ë•É7Ie:ÔÏž(ŠY%0 L+Gü$|ip¹@k¯ÇxHg/ÊÔh>¾Ðç/'2ÍuŸaŸú£òÃ5"¹ÆyË¿ ýÌò‹À¬¼hWÉÉ¥&ì_þŒDÇ£(.ѧ´<)JE~]dhRoŽJŽ#HÄx†™½Î_Á-æPÎ…7Îùî{MøÍõš„I^Ñl¤H®ä ?ÔàPëGYåR÷üŒz„ÍÎz¿–@æZÍ<.CrZ}ËsfêCiý‘Ç_ëÒGÿA´d]g <Ä#Äm'¿h&äVby}•g¥™öÁ„Lœß4¦©YÆr¹‡—@úVÑ‹ÞRJ†ÚøŽ€â¬™žmþ.—ˆO£Yô¬ž!Ó~T‹V¦†h YºôиƒZø8óÛª€€$¡öC½ -ÌO™ûÆC$[šïþývÍO2…„“þ~“V `9»?ü ÚŽSɬF•=õái†0ØWâ ºM¡¢ªJå&kÛ‡ö¨²Vq™ª~è·ð«|ÁÌ™xÇ¯í²­,WÜY׆šƒ,øcæ k¨6ÑØ:`,cH£ ðÖŽm0Ë8ên*vQ¹Ù,‡¤—k¿Ó/M,¨(†×ß9LF³å¬ÙÞ$ä’%ü;•¾ ÷À\ÃÍü"z쬖Äf3e#¾î·Gï¢Ä¯QÙptB¬¤KF°]_ùZGq20J—_Õžn•€JØpºâ¯ï«ôH¦ A‹»x·ÎDµT ˧8Âüˆ~}þ*^ñÔêhÙÛŠ,úÒƒïÎ9! Í™o4ý×}ºþ$¼ˆuú“¸D@x÷9Dá·çYÁ‡½Ô—CoJªáþüýÅp¿*£ÆÚ-ÝC–RçÃrž"‰Õñ)4¿êò¾×… ÔGÒ i£¸b)òøÕ ŠË+þ‘ø³'iŽMïÈ3IJËÆó|tÑkÖ6¿Û÷ @ZAD"¶tžÅk«ðéuNÎæþŠJ‡_Ú%E±Î*D8™e]ý÷{U¶Ö¼1Ê—oçõ;Q -îáH)7Z:íÌ®²Ï+,¸5oÐPœ0ØKBŸíÐl1/£Q­^æ(nÉ>ºÚÆ.yýȦÐz°Ë¿•ÿs/RJ?Î/;ÌŒÒ{ŽŠÏ}z‚Ÿƒ+>1³ß‚)E¡ýPl®·Ÿƒl­znVꢺƒ¼wÇ€XÏ’å¹î`–ÒwŠ.†h Ð&)(hù²?µÑÍoŠ"†ƒ½Êš¦¤¡¤aëäÄOQ*úbTÖHƒAâ¤Ü·YY¿õPõBäµg¨´-ܨùlÖ!_ÝU¶îÓ»ÜIXÎÈòü³ w=ÝÔŠø‚-ÛèÓª¿˜Œè`ÿu†Î`÷@Ãko© -º\²úsÅöJÒ§…¾7ô(¹|Öa[NðÇ`V°6ËÇ$v-M<¡öd!ÂÞ…v±™±)È´ `±Oöyõ=K$+‡×‹¼[ K'£²ºoO¥qxÄ:/õ“»–ï7Ë®`j1µÞsUëÚc -­ü*¦@×*'³h/zUŠÖh„Sù3\461˜/Ù”[¾¿å„ÑH¹§C4(í ´ÌžV@ɯ}U\VØþæ_ -7)–b󰃞 í>W*c0Cn$ ŽÉâ¤ÊMœ€m‚ç¯VÒ¸'•L¤ #ºÛcN’ñè>ìCª¤sÞà5P䶦–ö©Kì‡Ù3yfŸLù¯ÉÕ韙dÙº*¡u$xèæ?aô?g\¡vØT±QÖ’É!€!^¹hĦ˜§ïùÙw2±®œJªz߉lm'Ûhß“Ìp [f¥Š×ÖÊ^«H¶˜—纠q‡¨ -*oÍ]íYLQÚ‘}_Ð5°¿PØyG…ñøu9R,~—;Ggïš{Çõ³ª-¸ë̲;[çŽ( ìûB¥8 ‹ç¢x„äa€Í0KíÃÞìî¡L¸R» fv/ÅjÜhJfY|¨ÂšUÆ š¶.ß »¶ÌÓˆƒ8}èÙ dÄtöBúËvù—cºRMVÇS¹}R¾‡Ñà $RÉ⻤Œeª­o7fCûi‹ -Ó®ƒ}Z)doǯs+O#mÈÔ2°C.”µÚ½_…r0r‡ø.à£è}Y SJ È´Âw\Î_çíD†vLtÐFÏ~ÈÜ F'0hÐZµK©ÖŠ¨²I~¢wüýFGevø섹ܿ·¼i^Ò¤E«ð‚~*ÖñBæË]Ó7©Ã‘´Îèà†J,<(/ñO\¨$åIý÷ˆª•†Âמ‚MóŸÁv_”ýaß®M¼› >ç®-%^Ji"8Q±ÿŽ"6"_+*+ã‘£öZܦüÖ®]r¼æÊ„•B_KzçËø†qfÞÇ‚fž{ÍLJ8Íåëëvµ×ß_U]È_ÕÔxÖÐCÔ—Þ`OÖj ×—ýs»Š¹ï;‰ÇõdÙ8-ÿáëÍLz5©з¡Â8Q„¤Lø½…¨Üå³#++-¯QÀñ@mc1yŽ‰Ô.P–%ù ½³ø!Gé<ÕdØõM2<û‘ø6]–+8Ý6¢†¯†èì|bY;µbÔûµúqç{ñ–¿§ž¸Ky¹;Åñ˜Œ<4¾aðýHSWxåˆgËïØ‹¸œÈ¸uÖ̵DîKåuBñ -Ø¡Jjåõb=O®Â}"O Ô§§›AóLÔ±ùˆ{^y*õmÞQjÔHê⢦«Ýøæ›sí±ˆ¾GÔn§†‘GÎ G7‰ç€±LW™1«J‚&Û\-žÆVÅÔ;B3ÙfÈ­B„ßÒ…‘mX¸dgŽd£Ü ÚÖÚZ«jê¬nËðâ¸\5þµ'/}‰p–(+ ÇOñeú†õq2…o¶Âü\Äf)'ñSêoù…FLMÙÔItæÜØ–î,së_föX™üÂÀ1MÌ×dÁß9™gÅñŸÝ˯zñG­¼‡¨$ˆmÂ*± rëkÅ•)ݦ:eÜšåéZ¹ŒŠ8j¡!–à^-(;—‰^µe¾3Aü`‹[+/ØÕ±µ£AÌh^¼¿þ8£a¦~UŠd1˜´y§l0NŒØr渳›¾Ðí€lwÊüÛ–AA¬‚~<}VN¨æ-¦«=!&…‚Ò‡±ÀfÔMjèsË4¹!ó´*œÖ·ñ¸ÒþÉói+o\ü—6¿žuŒ3e Í<µzÒ™þÀ-þÝТ-eD†þEÕLhZžQ¦èqžimdâÔQWí)7õ%Âg¨:V¥„Sˆ,V+!Ó:~ãàuÛŽG ý—ׄYPºT4íÊbj:KB“”â%´úŠx<,1íÄI¡ç<4¦6àŽ{/Ö±¢±¡. â1§•È~%1ãÑ´)kØç¼Ïa‹‚´‡:f¯¸¨´vã#ê)ðgQy^aÍŸßv²”ÉöÔ6tÜfT±¦Åw.†šÓ‘µŠG -‡ÀgGh£)Ìj'ELdØ2ý¦!ëäæÒÈ~ãÉÝÓ†½£=ºÚÊAÁüMJ¶tX–†_ÃÏÕep$4jŸ&`µ7z˾ÎMm‰yúJps½e)ß#ì›@aNÊ)Ìð$vpê4ÈJû,ez[_šl1hNdºlÛÐ*Ä{È$KSžÆé”?4†}I³E¦âg¿¦Nr Lä¼ÝžøÏ;ÆM I^„ÀÌýslÏaå@¿ü}ÀT’X.qYC¢í!1GÐmò~O®™{c¨zb›¼2K>&¦âƒn•öÃd¾žø^À6éOl†Ç¬Ù ÷™õå¼f!Õb¬aémè$!)Ì#•2ømu®t¼ãzJÂ{G.çˆ"ÿR˜V’™ß¢^çü‡!4ôr_9~0ŽJu}˜òÝ Óå|¨ÎÍÒ|TqÿÜ™^<à'q<ÚÀöÙ7i° ô6Êt‚#6ó¿"Ó„ 8›E^Wïdê†L›}ƒeÍå› -ñ¾ó¶NNá_4žØì.¯lݲ -WÕ¦:¹†à`û±€÷-=ãÈË3øÆ„/:‚¡3|Âs«®QùE‘P‰KÇ}{:B1}ÎÏ@´è˜´T–¹Î;‹µï,x·¼×Ø™Ú{;pEÖøŽï‰—ÃÂpŒ‘ɺtqƒ&šCyá§KÚ…s|õ•²â¬§B /ÈTK¡»v9Õ­ ¹Ñyë­ö-;ÄP¼®fò=­O„›RQ1sù\wõj" -5ýÍ’¸™IB±T†Ÿº÷kînmŠóNïí I”–—+?DÁx‹ÔMÜXgÉÜ­X$t¬0l+‚“=vJlè~A/5œƒÂeßôhµ‘n8%ß”ÂÜù,*ÓE­ &œs“é>©òÕ¯Š/“¥g#«±'ãT#ñù0•Uýœá~+†Ú:Ù jXÉCð³’"Y;aȼÕ¶+»Õow¸æÛ -Ëšx“ÂÙÂïAZý’a-P#8Y—˜$0’º™Hàt†ýÄ™ÂÆc}¯.½T“1‰.ðüÖ®bZ"²â‘oNR§Ò&Óa¬µÄwçPkÑqÁ&ImĶ0DáI‡ô¢ýýË«Ýàžö°–›ñ°Ž<àa¤if–´ÜŸ´pÖ·²\!<Ùwî‰]ø”UPýüND–À/wë}Žœœø¦o+òcl~›ÄÐØ”\?Kǯoz²®ÉÓ¸4ùÏ…joÛT™­ÁWPý¸ (1­)ÞÍ8š«ÙÏU9k°ìøŠ9ŠÔ·Àø©©¾ï/츢ҭã6@s#צs$'Þ8rf]pâ÷¼?&æÑÛt‘LªMÑ> ½.sTIÀ”Yžs5Ö¼¢?^£V”8ÍHêSY¡àˆ—c)Í!šgRÜÑ/‰(È -pÚŒÁ¯þ6” #úîidÛ´z·ÆC šíù¤ÉŽ¦ƒÎfý˜Ýˆ¤®¼n÷.,ØSŒâ³ú4¶æO¾kÈz‚í]â™´j™ß¦}‘èÉdOŠú„PñËxZÅrÎbo̪eʯLO¾&@>ìI·ã9*û»j`™íê ®ùEE·s—V¼ìÛÞBA‹q¸|7³¿8åÓXwNg—n÷Ô q)˜;‹óêcŽê´hƒg\ÊWÍ.¡[ÙLi+«w!,óI3~fÿÄftÁ[ëlváôH‡ÆÇ0Ž¹t?lN•¦Õ¢"ÑJA”±ÏØYãq[Ž\­bs5$×NÎþ,A§Ð]d=©ø¦ò£ #y²TÀ -Ì×åúQ¡p&Æ]å£òÔ$Y"óK4©—ßMßÖˆ`Èõ -ï‹¿~·¡—*zˆÿôÚº¢¦ÐIWcâ“-Ö«a$T\‰ØBœÐàâ¸è«ÕŒ«¨ò!Æá¥a4ÝUÂs[Ù -Åx¯z~溙_Ua€Þí#ú6³f´â˜ À ø‚51P©^©<´òN½‹ö o™_^‹®ϽÕ)àN%¤O¯±pÒs&ÑígU§tó©—;ãÏ—n -ÒgÇõ}ÙJÆf…Ö>œåF3-»£‹€¿–o½lÇȇœC>®FBURò™\ª‡¸Õ6¼ùÅhe•/¹ qKÏãƒ}¯ƒ Ú˜^òøèœL¶Ÿö?_Aã(~†¬7ÃK¸ø(Ðó -¡óŠ^ûØB笒ô|‰¶š»Ç,¹gÃrø1¯¨o¤Ää^«-]ä.RSN`2}¢ žÂĬ_?:¥)yð#±/šÙ¯k­ôÈâ3g¤=U"Q¿Ãì•^Róƒ&Öê$¢`¬×Œüè¢G“aÚõÔ6\[ -Ú¹jpv‡¢78TòKOÆ=Ë7…5Χó’ù(b‘Ú¢Y;ªÕŒÂ†™"·)è¿ðÒq—ÇGÑVrdŸÔíGÆjªB´UˆÓ‰‘µ¹ë»úê¥ÕŒËhÏT·p&!¯4ß3Ø SÄK®6û*žÂ7ÍЈRJÒ[¢ -ûö¦ÙÊuŽ41ÛehE>ý§’@çâ7‡‚8®IW´èvÈwŽ=ó1MSŠ N§xèIf˜‰tõtÊ À6CKžØŽ©OPÔ^%g'ŽŸ<³âDk:šã•‚ÖWÂ`\µ ô‡š$Ààž›ÂOÑYµD|/$ù(•ç×<%]ÂzÃœ†ü0L&KÕïùwAÞ˜¯3­Ð‚“À÷ìçåš´¶4Ìè”…YhaAÄGäobÖ mLuüñ&,OwôzIwHÉájÕþú¿2$5£çâç¬MÚÙ+ÃGõ4~+¡±wDG=¯ä»ÓFI6sfºÆÔè¥gÛédp-¡ë¿ Kcó¡!=]=¶r¨¡¹ˆNQAß]#X›Ë± É.ó•)›MÞVàoZçë×-ÒæÅ ÷`žü×áG;%1¾^ 3¬cmùP–ië5nEèÅYR!}®ßRª—lšÐ³#‹ÝÞ­{L9'WYCÉÇëB-ÙAõ—! !bß´3x^ÛÄŒ°Ï}6iö[dóë1DVèÂûùÙ|¸¸ú«XðÜU'Q¤¯<Ò›æÙöÛ9ø…mL¥™^™£ÌǽV ã0¡4å‡è~ZæÆoÀpdÑí^ÚÑ/½¦½òYå‡Xûý¿ì6&ËUöhW›áÞEø˜sŒ•Â WJ·uÉWˆ ‰,ÂvTz~ð ç|Æ­Œ˜UúÊÄë“ݬ’ýlÙ6Q–J¼:ϾÝÜlRr+)Vj¾Ÿ6Eð:“}gù¢Ðû²CƒP¨nLjHHX½ AÜWð±SZ|IÏMÚE)¦þéŠ"*¿ËYù®u^“‹VZ -ÍûwÚšÔä ‰ñgŸßŒý2B7rH§õJŸejèeæÏÓ›/ÓOZA³ðr'XYçLaf®¾²Ð¶úæZ¼SND³ÁgWFÄ{ÞjåfÒf’5”›$’6^Aͽ1øúõ@ñ—„Ë >óOÆAt9ðª÷i<—çê¦` ÚÏ«×HÓtõaásZz_ b¥c+×6(%›¾6$ÂŽåªV‰©sš ìÈÖ;ŠÇû²Ínß„…kI°MµÛ6¡=‘Íõ³ñ¹!¢òÇzwÉÖõ_!:bÆä[}åÿ±+öõÁ4Tâ|jXž8æR{ê ¾MÑùI5’é‹åQf‚ƒB +Ëñ§HŒÓ&V4ãðÑPS‡ë¤O6–€JcßžáìóÉ%ÝéRW9ÕCS½übJÄN®AîÁcþs:^ïÀO6©œÖæb•Kc`5ržXŸë¹[zÛlÑÙ@%”5znT:±`¸s‡åcMqQÀ÷iyK¿ -Bðm‹_`ÜDl/ŒœÁW‰Ñþ]pÌ9Ž‘ eûÍÇ¥²R]¥KÁcÔ´%ö.…+j6u¾_ƒqkú\åëÒ¨€Œe4Ô, "¤ù)‰MŽ´tSá®ÌNOÝVuôhc4Ì¥'–ö|Ö8Â(’@udKÎü:}¡Ù½ä_›WÖ¦g0“ÛѶD¨S^‚.uše4”fx«@ XÏOäJE(SÄ®ø˜‰Ì²ŽD{¹?NM¡C\tÇé£8çÁj}‹7÷öb×KáùXV= §h³³¹T/ó–nt BûÿDÖÖÙë þf GÅ‹‘­.ˆý¹g¡7?VÍ3æÇpîÏbeü5ã)©'eª‹ùb\ò^ÿüü‘{Ô(@ýˆc¯(¹72m.5×n$¾RÇãÛÁQÂ<× ¨Ä’´ú¤f&_Äæ&xî@IH²¤Æ¸ÃÉüݯ#ƒ›êìµ´£ -òwdšäe -„˜~"Áe®ûW=uŒŽˆ*mÖCsxÍç-úºQÇf³—âü ö%Ú¤‡¯»ly.vGW;h€rq^2¨é"ª]>Ö]ëÝM¬È^Öl9‰å$¯5¹K1Ÿœ*$õËn|³N?”ºjØNí Åã -ìºåÉü®¸!­)|W‚9ñààڇݨ#]sÞ»(_ç«Fv<­=¬ÿ6NÙPˆÙM÷¨Ùó` M~x>I@UÙ`‹MÒçÕ°k.‰*‚ólo4‡¼Û”X.}ÍæjŠ§§À[†å/ý Bîs³hèÒÀæâú}±£ ™xÞdñ`ý#4á—®¶‘§©=!­-kÔ™ŒÍ@—Uf-Iø!ã[(ölW3ý,ð÷#¬öò½Ú¦RŸ–8{¯×ûø‡Àã -¶'ºB×þ¯&¼j’KÕ«þ:mŸ$©Åfï>c¯'ÌÍÒÍÑ$9õ”Ãw9—,må7CÝ Ó«ãÝdªÀÍú›Ac"ù*} ý}FËã -Û<âåÏ.÷ oEôt¾›tj&EUõuò¹ìö ÀsÜ2Ãœ|W­TRÎyÏfbúøÿÿðÿ‰Œ­†ŽÎv6†ŽVðÿMÂ$¤endstream +xÚí·UXÌ–h‹Kp×…»»K‚»»³pw A'ÁÝÝ îîîîîîœõïîÞÉîóxïÓý.ðÀ˜U«æ¨š%@N¬ L/lbg³³u¦gf`æ|–UQaf0301‰À““v:[ØÙ~1tò˜¹¹YÂöŽ3 èžðÙÎÞÃÑÂÌÜ@õ™úŸNœa £…±¡-@ÖÐÙhÃØРlgltö`[[”þù„@ èttš0À33L,ŒF@3 [xÆœ$mMíœÿ6q±ÿŸ&W £H +@õ/MjHÒÄÎÖÚ`4…g”³e‚\þßÐú߃‹¹X[ËÚü3ü¿Vêÿj7´±°öøïv6ö.Î@G€¬ ÐÑöwUþ—œ,ÐÄÂÅæ·J:Z[ ÛšYLÿ²p³pš(X8›œ]€ÿ +mMþ·håþeÀ(.!&§&IûßEýW£‚¡…­³Š‡ý¿Gý§÷¿˜ùƒ–ÇÑ ÍZ_fPGÐ÷ÿü¦û¿’‰ÚÛ™XØšXØ9†ŽŽ†ð í"v€3ÀÂÖ躃„líœA€Öä+ÀÔÎþŸŠ²²AÍÖ†6ÿÄÿ+Ä`tp±sšYÿ ²m]lŒþ©¼™íŸ0'€Ñèh ´uþã0Ú€¢N† ¥ùw”û¿Gý¯-ñ?a6&ІŽ@[k é_QæÿŽþ¯Î, ‘þÂÉêO4{k§?¿±áŸHÞÜÃÞøGœã_âv Ù@sq²6t2ÿÍÄèh÷'š„-ðß̲wvûÓÎòv6wþÕ¤ljçâø'Ò5µpý«H× Tì3HÖ èú—+¨°ŒÀÿXvª­Åß"\ÿÌÙÚî¯qÿ3ŒÅF9@ÂÖ@§?‹Å2:¸þ©4ÈØìŸkøGšƒõŸâþ¹ŠþA¢Â$)ò‡@‚ŸÿÈîË™‰þ›8AFb¤#þ‡@*$!ù‡@Ù¥ÿ(»Ìe—ýC ìr”]þßÄÊ®ð‡@Ùÿ(»ÒeWþC ¢©ü!‹ê¹¨ý!‹ú¹hü!‹æ¿‰”ÝÈÑÐØ +èü‡tç3Âÿ¹7¹YÿÝû? 7HÆtìŒíÿìÐíËøçDpƒ<ŒþÈÃøßÄÌZ“¿ðŸ-òþ³£ÿB‡Ù_Zó¿$cñ‚–Æò/9Yý… )ë¿dõçVb] Œ¶!ÈÊî/YÙÿ…ÿlØ¿dåøþsÄþB•ó_²rù AV®!ÈÊí²€¬ÜÿB•Ç_²òü ÿ»fÀÿ¨/3 Û?þË…ý¿ûýge™AÏ>èþ3¶°p¶°6ù¯’üß/ˆˆ»=€žtgs²2ƒö8Ó×ÿì¦jk:Í’_@÷+Ë¿¢Æ.Ž  ×ù_o=èMû6µ=€@ ;Ð~qÎΘ7Ð2¡î{‘hÎD14 ¸ˆY}´\MÇt+BÀB ¸uþ´ÍZµÆSI2âô‘Û žÓoÅQ±s?‡èÄÙ·=Wƒ½dÏF<«dY]{’û€c¤æº™›vpù©µá¢_š¹½i}ÇY +T_TöaVˆÁ:µ]k;S985Ä’­Uƒƒª)X‰•ŠBØ‚WÝÅB­ŽøXÃ6Ð._Úµ¸ >åÀfþ|Ó{4þæÏ"’¾P?nÉœLõªóÅìq5\V“ßÎHn”RÞ™T6Ód»Ø|¿Ô>±©ÜTÕé6ó²gD3Š³ß/C3Áí¤~ +S"öI ê˜G´¾TÙÊ ²,@"ˆ‰¥@ôë—`Šü)6@+7²°Åó@z,€ð7r]VüD›…½)`˜o£‹®tUôçÕ—N¹D-o©ÒØ|ðõ7Ô +Ö›ö£Øw”ñtÙ¹ûìžÎkª¬còvògB̪ö´;"«¯ÂG–W)•ãò ‹a7è¹2&iˆ,’<Ò¿‘ýgÈB,wƒ3ƒkû„R<%Å´h‹‘GàÿÌ‹<µQÑ™>pÔ›ß.²KroÁá´g[ä‡ýø9f×£[þñ…Ôc%ƒP»­w ‰ÏÐFH;alõ2‚pö©kÖÆô¦šŒK”ŠdøèBàð¨;ŠÒ¶c‘æ[£{§;ô2£Ô×ç<»¹ŠïöÇòàkQCÏÀ¯æݙ̨1êc%Åay¥äTº’­¡D%çÉðÛ§Aµ?†IHÒ1ŒX“ù÷Ù¤––<Ñ:Qf¤fr´Õw'~¿ H`vXH–#_f§1›˜ä =¸6Z:6ó k²^xø± °çÉD}û‹?õéâ8å½Ù…·ÃPŠJ·Ã& IG§ä™:Æ+Jëyl~7p•ÇÐû~‘þ”átu á3 å¦\ƒ°X““UGÝŸ`•ÀUζ§-P¡sø@ìÍ4NµÐØÇ«_TK˺¿HòKŠË5`Úä‡Ô¥ANåÀ5gJ.'íÖþ‘dq“KùYïêæB»¹?1%ªoI#ʈ_¼/ C‰ã&9¼+ÂÀÊ»GM{ϵòÏØD™²J0GjýN¿°JvýyÔí”D +Qhåí)‡ þˆ®IšØÜiÛ+æZƒëBx8œS ØÂü~VaBF +Ì +çþÇæí7Rm¨þ”æeÓ1|\áÐ¥ú±˜«—6KI±³vŽÔÑæ8Ègü»ËÞwV2óòÂ_WF›¾¤<•å¤!QªËÈ1+òboûã²Â*vµÔª÷{Ÿä†kx6ë…»’ÍZ±< ´¼8Ï)â Vš¿ï_SÛ¸¥…‘œiº²ÆP¢¬Ö|ç_w@#ZïÐ CïŠ8õüÇs]÷À:ÄÙE:WãÕ=î³ -«'Œ€Mˆì‚É£Ù2Û? «U& kêD[2wÕÛ̃hqo$”_ÉIY:þvÖ­†;&…©ToÏ©N–¯àªa„IýSBgµy/TÁî[y"aÎ*‡gì*—=‡çÐE¼b7*ãm¨Žµï³À÷nb&S%äyäëì›#f•O‘¹KôkáåmJ9•œÆ´¤ºrc|õ yEܨ=:T”w.À„Þ·Ì,}!="·L¿œ3M×ÎœðdMê@¼c0/2ûÞY¢˜n¾c‘¼Ýõ\CÅâÎdÁ[~ÆðÂC qh+@1Ú%3ð5ü?[-ø%‚DÓ/ýlОÓÔSÊÃ<‡”snï0µ¹ªk¿œ˜‰gìä0‰DË«¶h÷–yãŽç,ùÑØÜ8 S¨òìóþH +ÑD!ñØ8R’Ì gU ÊI°èm~…øG’}¾÷aÑúºH ƒzn‡U|¯ó†Í[V§^Dt Ï4`ñd +w˜b^Y÷hÚÎ|A< +[o…àõ‚‰±Ï†žMCN8Ù6ê›ÃoX ðÏŠôé}ŸüÑìÒA 1P¬JëhKÀQ§ä^€6ú†zîÜHÍgþ·IdñØוHÃZµnNgìyé¦Y©u]&ÒãÛmï0aqÊB¶eBY,‘X™êL^nàµå/l_^/äÞíŠJ†„4îPg9ÑGª +ö°*Â?à/XðÄ–Ñ ¦$pö%>ÃÌÐÁf8"rT'yao5Í$Šˆr3›¸*3ð:ÁÝñ…µ4öaè—çx ‡ñÄÁÆ ¿”ðíe·ZFúšc4¿ +‹ñ“8t˜!t« Â'ÅTp|'Mçù”ÂåiŽÎŠú yÖNý }Ó?<—ü™òWzÒv˜³×¹™qÑðNýX³Rüàžïöù,«ƒ˜¼¹ø–aqÌ}Á½hJà¾txhaãõÒ¤bÿ1ÚÆ) +E…ç U£¹¸ÄäÁ1ÍÇûÞÝ +_M]žÌÅC¹D8-~‰bê*{3¶:ol©À—j¥?ãÂÔ>¡’ +®Be×*/[h þ6G zŽÝ[h½»Âa°Ás‡ƒ­ã‡›ü^[v²ñ³ñ +6Bõ]½™Ý¡ã8D5Rå÷ëY-)£Áð¢„àµ`Dcz ·£SÚ'½:â´grö‘Ö¶5$ü·}Žü†£ürÊÉ­ ôÚÒEú‡ZEyö(Ù¦ÓõÌ¿»[ëì÷ +?6Xú¥ãU⇎ôgÃlF²W`îq.¾; “¤i§±ËðB-GºbBñu¶Ëˆ+]Ô¶O KÞÌr—ÚÀ²\}ýõm¨–÷>úEJ*Rmìs²ôä ¤²K”]•ú¡ß#XÉqìÓ€ÞBa¯ª¥>2hÄ¥‚1úl\Q06ÁD&ÊѺ4œ›.C›~B"«Ÿ2e\>ñà†hüî®á2׊à°€ å^šcm +óämOë$œð³¯ßÐ>óÄ;á‰"œaÙwȇ¸z—Sw½EFº?G¢ýôãá·ÑÚÔÓgVhÕ©ïØÇ~L ñýZãífƒˆ'L*ÍfPéT5W„¨Å”v. Ž…äw“gÙTœÞÌÊç»d\#xê¢ü©€?ÐOJùt)ê’áÓwÇž ·÷›m\ Ò_Ãr&žÄýäæâ~gÎáíÑw|6(ùV0…d†¼¸‰†­*Ñô²ü&ZéÌMg +“‚R™Ýà'(ïÊU”‹VPo#žßùöpÉÎõÔ¸n‚<•š’_Z!#BÕ˜¸Ûz_jP P^!Ôl~­ v-]W3¯‹]gz» ¡D¤iþf&á, c!¡ó4í#1àA?aE¶xÌîS¡­_ëJUÅ¡*ÁÊ$iöÞíãÅôÜ-="bh¼\ô.qDÊ6d8ÖxÜ嶈.2X¢¯œ(&#›¿! ÈŽêWÞ ?| ]ºâlžÆS:B4HûY"EÁØ\àie +\ ¸\+!£Ð +K¨çßoúÇq¾›˜wpãw#´u-úŒÜä,-Ãzî/«—v½®N¼l~wÃU®¨º®æimÎæ¹¾}K_Ðô¿uíâòxA.UúÝRîsž`,øÐf>tôã1ˆ'¤Fã¤3ÛQÚ!Ë­ù(®¹8 "Ú8ÛCEëFÖ!ñ×Û)ëž›IˆÃÍHhˆyDn#YžòÍy )™èÎnov£ÕÛá:ªð0“KJÏò\ô@Ól‘0ùŽ#vû–âWŠ¦f8Lî×ç^Ωqª¹Ô>‡Kµ…ýÎ*½×*On ¶ˆ¯Ò_™,=%ÖpHï¼n_jÊ#NV—Ý)×fUÏ%!i-O,­¤‚ÙܬÆT—bê\®ã¤@€ïFrΨ–î7ÕD§ÿ`«h†"ˆOc–Ý·ˆÎZu79Q,\Ù'$ÞTjn‚D¶¼p²—ÛC=–†¯þ +[Ñ'5â3” ‚ÍåH\læ7Š·ô ´bÌsw0!Ï'Þþm«+´’’-=“ô— ;ŒÌ›Æp®r™‹ÕGltÖ3ªì|‹}FÄ¡ ã6ŽUÔ€ƒÙw ˆzìµ2Z¯“>Æv¤hAoÀ’5{z+îϵ¿§ +ý‰ZÖ›œÌXÞ_*¹=W`M‰ÅËíAÖ_G5ˆÍðK2 X{0tØpc°ûwÝ=%UøÙéàÂ=”CåÎíO#¹JË÷ÀÎÈq@|-ýâd¸hÌï×,⩈ˆoþÕ‡Ðu~åÂ,CQóª„à3âÕýê»Î,V¨ ¸6†wöìþ¶ÆrjiRgÑ›ó3ÊZT]ÛC Yî}j‘?œŠ†cå{±K¯ ½î.û%ŸgóŠ'}ý”‡¶dš =Áר–.¸ût²)™I¯=n‘HèFLöÛbé…#ç|Wƒb¹< 5#ÊL=W<–®Ò¸]ìÛõßüxd|?y¿æÿþë'J]ev*wVË{&÷O£gÈã'æ½káq86‡~íÁ£Õ¬'g£¶Ð{ùìR³˜AjÝ›ø¯µ"€”ž7¥ +öKºó(;¬ºù vìðž‚¡×Vr41ºÌ [ªc>quõó+Y%&f_Ž[‡f !W}"x¿lÐß]Œ”HŸú9>ßÿÂNtÇÖëœðGtC Å¢±op°Ù2ÉQ÷9+Ó¿šfÖºœ—´ÎòÚþ(ê#(þ²z½«W¦¢I¾¿•–´A¹1¨IéO™3/~¥‘à-ÝrˆÏ·5Œ]¯2Ýo2'Q¿(n°õÒ*¸–xÊd´.Æu&ƒ&KÚ[]ž +Ÿë\`C”öAlÏ>—|¨æëh´€Ôãrt—5o€W̪{N±Ú<Ä'(é‹ÖÑ´¼7”ª´Ñ|s{%–óz«ð °Ø7ÇLô±’¶î…H»&…¬³§3hMUK.[]}I ë6Lžõ»uOªy‚† +¨‘†ظ·z3¥ 6/WyVp´‹”¸… Yk´î[éP`kMéš rƙ`fŠ=^?Ü +Mô¨ýÞw—-õp«g×¥ÕÒO"öor^Œ¤#è™zƒ ƒ1ì- &¡ÖÞ1íh¥LþºvšmjYVN½˜W»«¾?¿±©¥á7CFÅ®œ‘ì‡9Ÿ +½h“çŽMÃCQ1¥þ %üͽ¤,5)[¬ìMŸZ;ÅÙ¡Óvª¯$îyV‘3î¤^¹  ù±gÛ“ƒˆEª,#..l)BàƒòÃq–$‹>Æ÷†ò³¯OJ9èô˜pj[ЮlÂ>e;ÍŸ†é‚;Cº/P.Éãd¼Ü74 +(¶ü“sÊ2™Û•Hð´ÛsÞ—i|›M±phC}åÖ+ÑCeSê4ŸMÓ»c4Í)â3…u·UjÉ}u~çã·u`-luÁ|LçnöO_cp¦ñSÉÏlÁ›Ÿg‡öç¹Þ[;í +¤ö°¢Ï?Ü'àI¢/J.NæJŽþ½Q·)ˆ>¼ ƒè y¹;«¯ÁÛ }ÞÞ>6ü³z)íÕîÃ@19m]R^w\Ž°ý„8~StÜ^§ÂT6F©¦î3¤BöEÕ¬{fóÈCœçèåÄ +^Ÿ²í/ßlåyª£—gQ.Û_âCÇ>máÑöz‰ÃÕ7)د+ŽÕw#©I’¨ÉÎÐ:{ÒëΘù&Âëâ?*ò´;û.a¸Fõêbªá”Êgâ© t´óž «•¸“¯^}¯ªçv«ODËc«ï0a÷Œ_ª4ä=èæ— +ÁSb„.ÜÉŠ<5Ix}¿‹[‰Þ>q7k»ñÉ=ø²ÍKt_VÄ“;úý»¥ß"ŸÁù81/ÀÚŠaq•5ÎaªQ‹Y‚oP1Î’ÞYñÍE«Á)ÖÈ;ó“>Û0%DË–íp»ääÁ`®ñÌ”'oPš&‘ÁÒñŽRœ@_H wpîûRÑõM%U›žz+Ž.#9G|#MöÊ»·Õfò0·J®ä +ZD–£Äò‰ÅÌçb< •R¥6Á"Ûµßj\,–·˜9ëQ7O½ü˜0Æwø—d#:¶†•=‡ÖöÇ´”§ƒÒ(n`H[´äÌ©EusŸ½Ú$hz@øj‰°ˆ– ³îM»ÝE*ÚOÀa­dgù ä;ÂÏÆE‡¹‰…üõÃ,ºhÝ·_ÞsŸú_ZÏŒØ9c_í—S‡Úr¸tl‘gT×鱩½ê]1z8$äÙ[àÅMH!Ò¹ ŽÚD{"EغÝèDôÝȼ=Wj<Ä;ÈÈñÕâJsR%'‰Vm—U§€ õOJ¢G$ïa¤óS'ËÕÉF2œŠåjñ8î^–k§‰&îÄâüKvÔjT|Cƒbmí»Ñ ¨€“Vþe¥¬g;*ó{m·ÓŸ¦q2ÛQ¯bðíѤ›Nz- +.äS•è =ZpÝW³C¦K?§gyh²6Z‰„Äö‰2j›Te«û7l-^–?Q xÓ·HÒåÑP ò†è*:|Ü¿jŒaÌk‡vͳ=š+­È•ò¯ÙÂóëÊÐÌ1hœ +ˆèn­ÙðjÒïêñ~€Ÿ|aÀYÝ/ôœl”»ÿÝødÑðˆà‹Ä—A-EGAíüp_¯ +7ÆÓ¤IÛFiaÇSÐûSr“ ^ÝL¢Î4éG]R¤˜ô{ÍðQùûŽ2Î@¯Ó¨ì0¬¦9xíXØCA/Ì9e mr·… xz½CÍq]­·>3%…Ô×0}U•Œ=åê›|LCàÎÜ<ýb€p³n³ÃMœl>OLÓ¤’r +pÃ0Éñ\^–µ քϾˆvER£%µBܤ/4ubŒ»ÿfµð\È8vîÅÞ¼xd«"ÞwaÀnµg]4¹0NW†:9‰¹Ðþ\a(€™/Ÿ˜õ—•|\Ž‚i¬Îº¾åÅèE£?3ŒÎgX8Å|ÿïš+«_)f™Y~ GÃdâ:¸±˜Ðsä"9õ(¶îV¦ýÔKPfÂsbÒ2£}©iã<¤‡0ü KçÂ$BH©xæ"F»Okõ`¢¤¢Ãwa“½LO°xbQéyí² W6M<74.þ’ö­–V ]œ¯îêYÈîðÁoÞ“uæ‚U;?FD‡uüùÊ°fWV’  zez!wû$¡•gã3Ç +Ìœ~‘Ú·¯è5?ý¬›†²´|ã¦XîäËËz²¨Þ‡`ùûí9Êæêžhz[¡˜HU ¬X#™Zð¤p¶}/ò­ž"sa¬¿¹¾£(Ð+”ãEÝr¦i=9Üi³,g´.¤5í%ŸÚ7ä0ð‘Æ-¢;(.˜•=Õ°¥³‚·ñ¾½ÅÅ–ù£ù⯋‚‚~w©^Ÿ¾)®;[‰èñ¾7ù°A1Ä‹&ÆBdòp©’fôùH ׄê÷?HUÌ+W{éóÌü¦Ù¬œ¶T?„ ,á”S…´+Ç÷n$öÈ+sî™f¸ÂÃD˜@¿ì¤%눢cfû1uñº}§ÑÅ4zë½Û½‹Ûs]Eu/ýÒºÉyÃK(gØ}À#Õ"ågõÍîõ8 NkæœI@ì¹-ÜÊgR™wý•‰~ãÕCÛõèI‰mÍ ï·?›VÛ®™eqù^m‚C-oM5u[¢ÅhUí1ÏOŸÄ[KÈý# +õëÓfBÁsädWõÉêÜ`­ë+;µ|‰ÂòÒxµ©iK+˜À™³vȳO«ÎÆ448Û~MÚFµîù'Ti¶©-a_¸S?¢t“7FKÖprBÔÝÓH³úO^jG¥C÷ëò*æûÙ 3çé-S}³êaªU«#Çð|2‘šwˆéׄ<ñ—‚ÕqÁ¹²ZN£Øa?•ŸªýáJå etXpß  }<«°¹íõôrÑúèÀe¦e˜G,FG|½•Ÿ‹QHÿûmr\ ªîÛtžê¯è\”‡˜_ ·Ba-Zßï š%f§¬æóL~gø)¡MíœÈ§XÓÉè‚Ç0(½G›Qá½ÏÍbŽ8Þó8ÈÊ8)–ªY#vÀ±ªŸbwóXÊä+åòR™ãëI\̘]¿¨dÏÏèuæ¹4y±v ‹¬¾©T‹£T9p‘ÚÀ6Qè‰ + +l¬ ó³asQù8Ž57*ñÚR⶜‘©È«ÛÒ)õÖæûž™Úñnû¥Ï½tœÂ`±è\c·xÌ£ÙTÁ ˆ¹ÜɳÆÙ#Y–ˆ$vZZùØÈæ5×éÔ9¦Ð÷†Ú¹Ý¯èNØ8†·#¤K£[¶Z¡j¨³ÙËT…uãp~«'1Cœ§ÔTP¸s2ü–”„7Êz¨4ZÙÞg§šFTiB Lþä†Bip]5Qàþ%ƒ@ŠŠ¤ú¾í<º›àw‘«“ÖÉã§Q²=ÊE“h “g—øs)¸rXJ#üãgâí¬ÙÁo¯Ðê,Q¥Ñ‘r“yë—Ëþomí õ×OGð‹¶é_K¢o‚öÙcȸ Ð&FDÆ¡ûzŠ¾+1ìÜòÏ+ëÚŠ¦ÉTÇkæº\À%Œ®9-wÅÞã‹ë ÌFjŽ5RÎhgJi†3€1úï®m¤s ©·J£¡Çÿög‡Îr´|hŸ¼rb¨íÌDrÂÓ# ¼?ß/³u"¦Á¹^ïÜCÌÞ@Xw¨HºI,Õ¡~FðDQÌ,†i`Zqà8â'ÉçËO¥€Ëù¼Z{=ÆA:k|Q.÷ Fóñ…>9‘iŒh®Ûxü ûÔí®É5Î[ö]èg¦_Æ`ÅE»Jv5á`ÿòg$:¥@qáy\“ïX7¬ò“ÙwA ú|ŽÂ]‚¿Î¼P¥3SŸ>ù¢7>Ë! ü ‘4Ø”íÝxJÍ•‚¡Tä×E†f!õæ¨à8‚D,†g˜Ùë¬ n1'Ø€‚p.¸Apþ0ÈtßkÏoæ¨×$LòŠf#Er%_ð¡‡Z?šÈ*çºçgÔ#ìhVæûµÌ2×jÆq)’Óê[®3SJëä_üµ.}ôD‹×u¶ÀC,ã)”XŸBó«.ë{]B} š6Š«!– _ ¢¸¼â‰?{‘fâØôŽá/¯p¨Ô..ŒÕpV ÂÉ,ëê¿ß«²µæŽQ¾|;—¨ßŒRpGJ†¸ÑÒigv•}^aÁݨyƒ†â„Á^ +ú”`‡f‹y•€‚hõ2GqKöÑÕ6vÉÛèG…Öƒ]Þ­üG˜{‘úq~Ùé`f”ÞsüS|îÓül\ñ‰ œ•ð¸L) +í·€"Óp½ýlô`kÕs³Õä½;Äz–LÏu³ä¾St1Dk€6I~Y@Ë—ý©n~S1ìUÖT% % sX''~x¢ˆÑ£ÒF 'å¾Í’È|ø­‡ª"¯=C¥máFÍgƒ°Öùê¬ÒuŸÞå–HÂ2F–çŸù½ëi¦æPćláØFŸVýÅdDû¯Óu»^{KUÐùà’ÕŸË·W?-¼ð½¡GÉå±Ûr‚?³‚³‰X>&²kiâ µ'qö.´‹ÍŒM@¦‹|²Î«ïY"Y9¼^äÝêhXú;•Õ}{*ŒÃ#Öyé¨w˜Üµ|¿YvS‹©õž«Z×ShåU1ºV9™u@{Ñ«R´F#œÊŸAèä )°‰Á|ÉÏ¢Üòý]™F#åž\•ß t¶ƒÒ2GxþyX%¯öUqMDXaû› ܤX²]ÌÃz&´û\‰lŒÁ ¹‘D4.8&‹“*7q<¶už¿ZqãžT‘‚ŽX\èn9IrÄ£û\°5ª’Î x€×@¡ÛšZVا.±fÏt`\T䙘}2e•“«Ó?3ȲtUBëHð†QÍÂèN¿Bí°©b£¬%“CC¼rшM6OÛó³ïdb]#8•Tõ2¾;ÙÚN²Ñ¿'™á¶ÌL¯%6¬•½V‘l1#.ÏuAãQåWÜš»Ú³ ˜¢´#û¾ k`¡°óŽ +ãñër ¤$Xü.wŽÎÞ5÷Ž/êgU[p×™eu¶ÎQØ÷„JpÏEñÉÛa–Ú‡½ØÝC™p¤vÌì^ŠÔ¸Ñ”Ì3ùP…4«Œ4m]¾t;l™§qúгçˈé,ì„ô—îò/Ç u¥˜¬Ž§pû$£‡H ’ÅwIËP[ßnÌ‚öÓ¦]û´RÀÞŽ_1æV–JÚ*þ¡e`‡\ kµ{¿ +å`äñ]ÀGÑû²¦„a…ï¸6œ·ÎÿÚ‰ í˜à + žý.¸ŒŽgРµj—R­?Qe“2*øDïøûŽÊìðÙ s¹oyÓ¼¸I‹VáýT¬ã…Ì—»¦o>R‡7"qÑÁ •XxP^âž0¸Pqò“úïU+ …¯=ù›æ?ƒí¾(ûþ\šx7|ÎY[J¸”ÒDp4¢bÿ-ElD¾VXZÊ#Gí;´¸Mù­\ºøxÍ• +™¾–ôÎ)–ñ ã̼Í<çš™”pšË××íj¯¿¿ªº€¿ª©ñ¬¡‡¨/­Áž¬Õ®/!úçvsßw ŽëÉD>²qZþÃ×›™´jR5 o; B…q"?I™ð{ Q™ËgGVVZ^¢€1âÚÆ"òl©]& ,KÒzgÑC¶ÒyŠÉ°ë›dxÖ#ñmš,WpšmD _ ÑÙùÄ.²þvJù¨÷kõãÎ-öâ-O=q—òrw²ã1yh\Ãàû‘¦®ðÊÏ–<Þ±q‘q묙k±Ü—Šë|„Dâ°C•ÔŠëÅzž…ûž¨%N:O7ƒæ™¨có÷ܲêÚÜ£”¨‘”ÅEMW»ñÍ7çÚc}Ž¨ÝN #ìAŽnÏc™®RcV•xM¶¹Z<­ò©v„lf²Í[…¿¥ #Û°pÉÎlÉF-¸´¬µµVÕ.ÔYÝ–áÅq¹*jükO^úbáLQþVŽŸâËô ëãd +ßl…ù¹ˆÍ’Oâ¦Ôßò +Œ˜š²¨é̹±-ÝYæÖ¿Ìì5°2ù…cš*˜¯É‚¿s2ÏŠ+â?»!—]õâZyQIÛ„U`5 +äÔ׊+SºMuʸ5ËÓµr rþÔBC,3À½ZPv:/½jËxg‚øÁök­¬@`WÇÖŽ1½yñþú㌆™úU ’Å`âæ²Á81bË™ãjÌnÚB·²Ý)óo[±rúñ´Y9¡š·˜®öP„˜, +^­ó!à7.Q·€àxÚyM8%Á¥KEÓ®4¦¦³84Q)NB;¾¯ÇÃÓNAœzÎCã`jî¸÷b+ êÒÈ sZ‰¬2‘¦ÕHYÃ>û}[  õ8Ô1{ÀE¥µQO?ÓˆÊó +kþü¶“ L¶§.°¡ã6£Š5(¾s1Ôœ†¬U4i9Ö8;BMaV;)b"Öá7 Y'7 4—FöMêž6ìíÑÕV +æoR²¥Ã²4ü‚~¾¨.ƒ#¡Qûôø0«¸Ñ[úunjKÌÓW‚›ë-Sùaß +sRNa†'¡ƒS§AVÚg)ÃÛúÒd‹é@s"ÃeÛ†Vy$ÎC&Išòô—NÙCcØ—T[d*~vñðkêDÂdHÎÛí‰ð¼ÃaÜ”ä…ÌÜ?ÇöVôËÞL%‰å–5$ÚѲ݆!ï7ñäš¹7†ª'¶É+2åSib +(>èVi?Lfâë‰ïœa“þôÈbxÌœ zŸY_ÎmR-–ÞцN’òÇ<"Q)…ßVG‘áZ@Ç;Φ§$¼wärN†(ô/i%™ùÝ!êuÎÁ/qBC/÷•ãã¨Tׇ€)?ÑÝ0]Î÷€êáœLÍG÷ÏiE>pÇ£ lŸ}Û@o£Lç 8b~A3ÿ+2MŠ³YäuõN†nÈ´Ù7XÖ¾I¡ï;oë¤dþEã‰ÍÖ-«pUm +¡“kþ¶ xßÒÒ¼<ƒoLø¢#1cÀ'<·êê•?Q +»tÜ·§¡!ôÓgÿ D‹ŽIMa™ë¼³Xû΂wË{¡½·Whïøžpi1,Ü Ç™¬K7h¢9”~º”¡]8Q1ÇW_)-Ê|*Ðð‚L±º `—SÝ +’û»Þjߢ±C<Åëàj&ßÓúD¸Iñ!3‡ÏuW¯&¢@Óß,‘›™$K%~ø©{¿æîÖ¦(÷ôÞš„Ai©q¹â³QPÁ1AŒ·H ùÑÄýu¦ÌýØŠE|Ç +ö"8Ùc§„Á†îôÃ9(\öMæPé†Sòý·A)ÌI¢2]ÔÊ`ÂÙ7î“*_ýªø2Xz62K{B0N50žSXÕÏî·’`¨­“ ¢†•<?+)’µ3†Ì«Qm»²[ýv‡k¾-·¬‰3™!œ-ø¤Õ/ùöÐ5‚“uI€I#± ‘‰NgØOœ)Œ`<Ö÷êÒKµ1 Shà?~ÑÉoí*¦%"óWX²âÍIÊ´³Sê$cŒµ–øîj-:.Ø$©Ø†(<é^´¿YµÒsÀÖr3Ö‘<Œ4ÍÌ’–›ã“ÎúV¦+„'ûÎ=± Ÿ²*ªÉÈÒøånÝ Ï‘“ßômE~L€ÍoÓ€›’ëgÉøõMoCæ5y*&¿ó¹Pím›*³5øꪗ%¦5Å»G3b5û¹*gí–_G¡ú_#5•g TÌÍòLˆp §[·72óÊe !Š=~—Ë.°ˆ¨¥ œ(c"JŒ3Õò)’XöCYJŠ…„ÂÆ*'ãKPÙ• +Žxp–¢Ñ¢yÅý’ˆ‚¬§ÁüêoCÙ0¢ïžF¶ A«w¿öÀx(!cC³<Ÿ4ÙÑtÐÙ¬³‘Õ×½ ö¡ø¬>M£­ù“€ï²ž`;@{&®Zæµi_$xòÙ…¢>!”W/C«XÎYìYµLù•êÉ÷Âȇ=éñviÆÏÌÁãŸÐŒ.xkÅ.ÜéÐøÆ1—槀ͩr´ZX(Za"ˆ2ö;sü×–#W+¤€Ø\Í#ɵ“³?KÐ)tY`O +>€…©ì(ÈHž,°óuù€~T(€‰qWù¨,%QÖ†ÈüMêåwÓ·5"r½‚û¢¯ßmèå‡ +bÀ„Æ?½¶®¨)tÒÕ˜ød‰õj Uà¶Ç7ø†¸€.új5ã*ª|ˆqxi˜ÚÍšé­ÿ2¹!ió!*NçP>A¸g'¢o”/ƒè‚ø²yqlòCS›/¼ÆÜCuìä}ˆ‚€iö‰²%5B{MÊcÚës:t–Ì/ë‹[h¹õèQQÑ„Ýî³-Ü{8n©³•Çû_væ}"?DýNªÉ‹¢âÁ +³y‘áCÆäŠ>ØgªB˜Ãöüè€ ïËÌG:Ézä Qª‰€¼sÚÓXq›<ës¸ºq(ýÕÿÒs¬)³Nn™·þwQìÊ_ ‹ó»¾îCß B£jèغ ŒióÂåRÞÝM;…PXa–¼É¡§²õ²›Ye\zÀüÉ],%3d>M­ÉÕ("#‘" ;FÞYo—ÈzR}Q;OñÄÇ‘nÇcˆ£{B‡Ú²ØBX 2|DoyÍÔÏÎ:ÂòÔ¶”‚ØGV×õ±ˆ®¼¸áý·jæùm(.jŠI  ;L[ÙÑßÃPçšR9x!ÿ£ÆDÜû'ý‹Ðîódc+yÌʧb‘#zMxËš“p•¶@~2ÿçX”Ñ20OÞ;©¨ÐºŒ‘øìŠàºzÓé¥õ«Ð!'÷ËÅVÞà;§ú^Ç'ÕLx}"Ëáy)-ˆ¯¸$F_ujJƒØVH"䨂ÎÌw·(H!û¹r\‘¤+,!$ S‹hÛ^‘sáM«ÃнôäÙ¹†±Ê„}Šøˆß²Mw•ðÜV6CK0Þ«žŸ¹næWEU wûˆ¾Í¬­8fp¾`M T¨Wh§­¼Sï¢Uâ-óËkÑ5๷:åÜ©„ôé5LzÎ$¸ý¬ê”r>õ’cgüùÒMâQNú츾O#[ÁجÀÚ‡³Üh¦ewt‘ ð×ò­—íù}ÈÇÕHè£JJ>“Cõð·Ú†·ó1¯­´â%§á×Òóø`_þë ƒ6¦—<>:'S£í§ýÏWÐ8ŠŸ°!kãÌðâ/> +ô|B‹ï¼¢×>¶Ð9« =_¢­æî1KêÙ°~Ì-ì)6¹×jKy…‹Ô”Ó˜LŸ(¨'31ë×NiÊAüHè‹föëZ+9²øÌY')AO•@Ôï0{¥—Ø|à ‰µ:‰¨Øë5#?ºèѤGc˜v=µ ×–‚v®œÝ¡è •üÒ“~ÏrÆMa3Âé¼d>Š†X¨¶hÖŽj5£°a¦Èm +ú/¼dœÆåñQ´•Ùguû‘±š†ªm•âtbdgmîú®¾z)_5ý2Ú3Å-œIÈ+Õ÷ vÂñ’«Í¾Š§àM34¢„’ô–è†Â>€½i¶âF#MÌvZ‘Oÿ©8йèÍ!ÿפ+Z<ô;ä;Çžù˜¦)ÅȧS<ôD3Ì ºz:åx`›¡%ÏlÇÔ'(j¯â³ÇOž™¿Dk:šã”‚ÖWÂ`\µ ô‡š$Ààž›ÂOÑYµD|/$ù(•ç×<Å]ÂzÃœ†ü0L&KÕïywAÞ阯3­Ð‚“À÷¬çåšÔ¶4Ìè”™haAÄGäobÖ mLuüq&,Owôz‰wHIájÕþú•é’ŒÑsqsÖƒ&íìá£z?È•ÐXŒ;¢£žWòÜi£$›93\cjôÒ²ìtÒ¹–Ðõ_Ð¥±ùО®[9ÔÐ\D§¨ ï®¬ˆÀÍåˆXÐä—yÊ”ÍÎ&o+ðÎ7­óuÈë©óâPÈ{0OþÇë𣈕‰Œ/†è ëX[>”¥Úz[z±D–THßÇ_§ë·”ê%[…&ôìÆb7‚wë“ÏÉUÖPGòðºP‹wPýehÈ£Ø7í ž×61cìsžMšýÙüz ‘ºð~~6.ªþ*<$wÕIék 4ƦùA¶ýv~aSi¦Wæès#Åq¯Uü8L(MÙ!ºŸ–¹ñ[0Yt»—vôK¯i~¯|&GÙ!Ö~¥ÝÆä`™ªÃíj3Ü»s¶±RôÊ@ɶ³.ùÊq‘EØŽ +Ã@ÏäìϸUƒ³J_™x}’¢›U²ž-Û&JSˆWçÙ·››MŠo%ÅJÌÃÀ÷S§^g²î,_z_vh +ÔI «—!ˆûò!vJŠ.c#é¹I»(ÅÔ?ÝAQDåu9+ßÕ!¢ÎkrÑJK¡yÿN]“Zƒ§¥÷• V:¶bM`ƒR²ékCâ!ìXŽj•˜:§ ÊŽlA½ƒ xœ/ÛìöMX¸æ$ÛT»móÚÙ\?Ÿ"*ßx¬w—lmaÿ¢#fLžÕWþ»b_LC5à!Χ†å‰c.µ§ÞàÛ`‘T#™¾XÞQeÄ;(°²ŠÄ8mbEó8 5uø°NAúdc ¨0¶ñíÎ:Ÿ\Ò.ñq•S=4ÕË+2¡Dìää<æ?§óçõüd“Ênm^ V±4V#çŠõ¹ž»¥µÍž T@Y£çD¥ †;wX>Ö|Ÿ–·ô+'߶¨ã&b{aä ¾Jè ˆöï‚cÎvŒd(Ýo>.‘•ê*Yº£¦-¶w)XQ³©óýŒ[Óç*_—JÍd,¥¡6`i!ÍKHhr¤¥› +wevzêî´ª£G£a.9±ì´ç³ÆF‘ª#[ræÕé ½Èî%Un^Y›žAÀLnGÛ¡Ny ºÔi–ÐPšá­%`=?‘?l(9¢L»âc&0Ë:íåü855†qѧ +àœ«õ-ÚÜØ‹]/©Ä%ò±¬z6NÖfgs©^æ-Ùè„öÿ‰¬­³×üÍŽŠ#K]– ûsÏBo^¬šgÌᜟÅJùkÆ“SNJ>TÿóŸä=¼þùù#÷¨Q€úÇ^aRodê\J®ÝH\…Ž Æ·ƒ£øy®AQ‰%iõIÍ6L¾ˆÍMðœâ$Iq‡“ù»Ê#ƒ›ê¬µ´|£ròwdš¤e +„˜~"Á¥®ûW=uŒŽˆ*mÖCsxÍç-úºQÇf³–~ùAíJ´I_wÙò\쎮vÐå~yÉ ¦‰¨v øXw­w7±"{Y?°e'”‘¼¦×ä,Å|r*—Ô/½ñÍ<ýPâªa;}´ƒ‡+°ë–+ó»ün„´¦à] æăƒkv£ŽtÍyï¢lqœ¯Ùñ´ö°þÛ8eCf7Ý£fσ6ùáù$UYdƒ ,6IŸWî¹$ª4B2Îs°¼ÑònSB™ô5›«)ž>œ#l)–¿t%…ÜçfÑÐ¥ÍÅõû"G2ñ_x“EƒõЄ_ºÚFž¦òõ„d´¶¬}PgÒ7]V™µ$ᇌo¡Ø[°]Íô3Áß°ÚÈ÷j›J|Z~Ù{½6ØÇ=—³u8Ѹö5‰àU ”\ª^õ×iû$I-¶Ø0£x÷{=~n–nŽ&Ñ©§ ¾Ë¹xi+¯êN˜^ï&C†hÖß„ÉWékéï3ZW؆@à/V™_èxs(¢§óݤS3)ªª¯“Ïe·ožã–æä»j…’rºÈ{z0ÃÓÿÃ/øÿ€ÿO `l 4tt¶³1t´‚ÿ?Ž½$¥endstream endobj 955 0 obj << /Type /Font @@ -8685,14 +8691,14 @@ endobj /FirstChar 33 /LastChar 126 /Widths 2080 0 R -/BaseFont /GNCLKR+CMTT10 +/BaseFont /GHFNVI+CMTT10 /FontDescriptor 953 0 R >> endobj 953 0 obj << /Ascent 611 /CapHeight 611 /Descent -222 -/FontName /GNCLKR+CMTT10 +/FontName /GHFNVI+CMTT10 /ItalicAngle 0 /StemV 69 /XHeight 431 @@ -8713,7 +8719,7 @@ endobj >> stream xÚ¬·stݺ¸Û¶mÛ¶msÅvÒ°±m£±ÝØN46›“~ëÝûœÝîóû÷+cuÝs>s^÷ÄýŒP’ª¨3ŠZ8™YJ99º3²2±ò‘ˆ+ª±²°2±°ˆÁQRŠ»ZšºÛ:9J˜º[ò‘°òò²‘HYšÿø89ø8Ùà(IÄœ}\m­mÜIhÄiÿéÄM"ê`éjknêH¢hêncéÃÜ@¢îdnkéîÃD" -¨ý󄉚¥›¥«§¥++‰…­¹;‰™¥µ­#ó?J²ŽVN$Üÿ[x8ÿo“§¥«PŠ„æ_š´$@I 'G€‰…¥³’p6K ËÿZÿwp)@ÉÔáŸáÿY¨ÿ§ÙÔÁàó?œœ=Ü-]I,,]ÿoWmË»)ZZØz8üßVYwS€­¹¨£5À’„åß![7)[oK [ws+S€›å¿â–ŽÿW¸rÿR`VÓÓ“¤ÿ÷žþ«MÅÔÖÑ]ÃÇù?£þÓù_Ìú‡«ãjëM¢Ï\^V`GàçþŸ¹$Í,l­IØ8¹HL]]M}à€§Hœ$~¬$¶Ž–Þ$–Þ@af&G'wà#$À5 ±rr…ûgC{Îlõ¯Ø¿‘ ˆ¶ˆ€?ÈñOç?ÍìÀfàØS‡?!`'wK 3À¿÷þ?-œ$ÌŽfÿkÇ?a.f 'ÀÔõOˆ›„ÙÙÒÕÜÒñ¯§yH˜M€Q7Sàrÿ'Êû?³ý÷T,ÀL]-–VEYÿ'ú:S6uûg7û?A`fη?`^æN¦"À|l|œm,ÿäÂÁõ/q[§?†À\ܦn6"ÀL|-]þ€I89Zþ‡9öî^Ú9Þî6®–õøg—œ<þ¬ç?ûdëùW ®ðý‡²n–ž¹O ³å-'PÕÑöožr8ýõï?Ã8Øþw” (héâaúç p±ÿ³/–nÿT®?A “éŸé¸€J¢¨#ö‡€*âè!ñ‡€’ÿ!nàbIý! ‰ô.“Ì:Éþ! ŒÜºÈÿ! ‹Âº(þ! ‹Òº(ÿ‡x€.*è¢ú‡€.jè¢þ‡€.è¢ù‡€.Zè¢ý‡€.:è¢ûâºèý! ‹™«©¹½¥û] ^öÿÄÿûRK5óŸ£Î œÈì'2ÿSX€3Yü…ÿ†¿ðŸ£ú'´þ ™Ûü…ÀÔÿ*>,ÀÜíþB “ý_”ú«4±­þ”!V`¹evü VN!ÐÊù/üç¸þ…@+׿ðŸ»ó­ÜÿB •Ç_´òü V^UW •÷_´òù V¾á?ÕÕÑâïÚÁÊT³tøOìÿ}툉9yû1²kð‹åŸÝá%áåâ øïžšŽ¶Àë)+¬5,,ÜÀSðOÔÜÃXÝÿõ®Îû¿le |ZZz[šÃ­s2ç³Ëh‹¨ +¨ý󄉚¥›¥«§¥++‰…­¹;‰™¥µ­#ó?J²ŽVN$Üÿ[x8ÿo“§¥«PŠ„æ_š´$@I 'G€‰…¥³’p6K ËÿZÿwp)@ÉÔáŸáÿY¨ÿ§ÙÔÁàó?œœ=Ü-]I,,]ÿoWmË»)ZZØz8üßVYwS€­¹¨£5À’„åß![7)[oK [ws+S€›å¿â–ŽÿW¸rÿR`V‘PTW£ÿ÷žþ«MÅÔÖÑ]ÃÇù?£þÓù_Ìú‡«ãjëM¢Ï\^V`GàçþŸ¹$Í,l­IØ8¹HL]]M}à€§Hœ$~¬$¶Ž–Þ$–Þ@af&G'wà#$À5 ±rr…ûgC{Îlõ¯Ø¿‘ ˆ¶ˆ€?ÈñOç?ÍìÀfàØS‡?!`'wK 3À¿÷þ?-œ$ÌŽfÿkÇ?a.f 'ÀÔõOˆ›„ÙÙÒÕÜÒñ¯§yH˜M€Q7Sàrÿ'Êû?³ý÷T,ÀL]-–VEYÿ'ú:S6uûg7û?A`fη?`^æN¦"À|l|œm,ÿäÂÁõ/q[§?†À\ܦn6"ÀL|-]þ€I89Zþ‡9öî^Ú9Þî6®–õøg—œ<þ¬ç?ûdëùW ®ðý‡²n–ž¹O ³å-'PÕÑöožr8ýõï?Ã8Øþw” (héâaúç p±ÿ³/–nÿT®?A “éŸé¸€J¢¨#ö‡€*âè!ñ‡€’ÿ!nàbIý! ‰ô.“Ì:Éþ! ŒÜºÈÿ! ‹Âº(þ! ‹Òº(ÿ‡x€.*è¢ú‡€.jè¢þ‡€.è¢ù‡€.Zè¢ý‡€.:è¢ûâºèý! ‹™«©¹½¥û] ^öÿÄÿûRK5óŸ£Î œÈì'2ÿSX€3Yü…ÿ†¿ðŸ£ú'´þ ™Ûü…ÀÔÿ*>,ÀÜíþB “ý_”ú«4±­þ”!V`¹evü VN!ÐÊù/üç¸þ…@+׿ðŸ»ó­ÜÿB •Ç_´òü V^UW •÷_´òù V¾á?ÕÕÑâïÚÁÊT³tøOìÿ}툉9yû1²kð‹åŸÝá%áåâ øïžšŽ¶Àë)+¬5,,ÜÀSðOÔÜÃXÝÿõ®Îû¿le |ZZz[šÃ­s2ç³Ëh‹¨ ”,™¯†¤³nOTjþºÔ º– (Ÿ”w¡ÛnÒy©ÉFG:†<&özÃw‹îñW‘ºqIÌ\ù8ö49ÎöíÄ×¹ÍVô9r&{ ½@în[¾¿äU^ÜžªJÕ-Éû9zQ¤B#¡q½I 2 ïÙ2ÆÅ­#• ÐŒ o¢b'UCÉt©ŠâˆÜòBIM†Øš ´‹„é ÿ~ãÔãöRS˜òaðˆ™€jÞCÌ®¶O‡¡v"|YY‰‚Üø{x¼^$‡ÄZÝ•ärFmR64=¢>ÏOÒxá'ö¬d”¢ç5Cgé;%—ávù¡1;½±M©ÜZËÏä§/qÔÏ0¾ç$éO¼Å=ò)A»Á×þÈ)îEqZ´z¤ˆväØz#Ù9ó¾¬H÷¹šx¢pdΩ¿ý5ïSLjEt$TËgí:¸Ïì±P‚É4ed /–³¿¤‘^ÆÓP­?DkÝH‘-{æÑ&8|çôZx¨ÚÂSrH¿–} ²næ]éIamZºsò÷™ò«2æ1’žxå|Dæ¥]%l0ÊCò®é,Üî¿X*¾Zè¹^<{ŒËîZh: n9 :íý&€9Á7oÔj„ë:‚seï|‘Å©XVD·N âñø&ˆhTUÒ̺{EW—~:2¿GÃñ…¡ïe7ïD„n÷`q´]\Ää5<¿ºãtE@/| º1þbÅE—H"Ø…?¦jOBxF‰k^&®s¸ÜÌ\së‡;Ê„ òõ­åÞo¾g:ɳAj% —Ä¿¾íÝxÇûmƒèNsäñNZ‹F•c:YèiU uw«EvY7WÞÜÔ¸¥½[ˆ<‡¡Òüć,óýOéÏ+iÛÐéŠ^ Ѧ|ã;ÒÞógË “ ³EãÏmÙ=»nC‡gœ±®«@÷:U ®Óu¸ܼ—!6_ª#Œ;Gøë–=ʘ(W[P³"ídCÝøv:ö˜²ÙŒËTê1¤ ¯˜ô -nij­«ÿ1rýºEˆ!kÈFú/üü'€à\ !>:2€ü ó¡îendstream +nij­«ÿ1rýºEˆ!kÈFú/üü'€à\ !>:2€ü M§¡ïendstream endobj 951 0 obj << /Type /Font @@ -8795,14 +8801,14 @@ endobj /FirstChar 11 /LastChar 124 /Widths 2081 0 R -/BaseFont /LBYBZE+CMR10 +/BaseFont /PDMSCR+CMR10 /FontDescriptor 949 0 R >> endobj 949 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /LBYBZE+CMR10 +/FontName /PDMSCR+CMR10 /ItalicAngle 0 /StemV 69 /XHeight 431 @@ -8826,7 +8832,7 @@ endobj /Filter /FlateDecode >> stream -xÚí·S|ä߶öÛIǨضmÛéض;VGÛ¶mÛFÇV'éXoþkｺ÷z/Ϲ:ŸSUõsÌù7Ñ'±¼¶Æ&î÷OÇôt¶vΟ]Ÿ•ñ˜Ú9Âü³®ŸKOoú¯Ø!Ó'ZüAæO´þ72³è\ìœMŒ ­ÿk}ÿÝ +xÚí·S|ä߶öÛIǨضmÛéض;VGÛ¶mÛFÇV'éXoþkｺ÷z/Ϲ:ŸSUõsÌù7Ñ'±¼¶Æ&î÷OÇôt¶vΟ]Ÿ•ñ˜Ú9Âü³®ŸKOoú¯Ø!Ó'ZüAæO´þ72³è\ìœMŒ ­ÿk}ÿÝ  ·u±1üg{˜Ùþ sþw‡ÿÍ ·7p4±µ61ý+ÊøßÑÿHþô`oíâô'ðéÂÈÎÆÆàOäSÝÜÃÞÜä2 Ûg¯OY;ã?!v½“µ“ùŸ€ÞÓÄÑîOàÓ¯­É¿™õÓ¨³ÛŸvÖÊcçâø'ðO,\ÿêñiÎéséþÍÿ˜µ¶ûãŒõSÃÉÄÆâGÙ˜ÿ©”‰Ó?GþOðs^‚èsJBès6ÂèSFä}Jˆþ›Ø?'!ö‡>«,þ‡>e%ÿЧ‚ÌúTýCŸ rèSAþßÄñ© ð‡>ÿÐgÉ”þЧžòú,–Êúœ­êúô¢ö‡>Õ5þЧºæ¿éóv¡ÿ³8?3 ÿÐg¦ÑŸíÌðiÔø/ütjòþ³ºá§W³¿ðÓ¬ù_øéö¯ƒÂðiÂê/ütaý~Ú°ùƒŸw½í_øiÃî/ü´aÿþ³3þÂOŽ᧠§¿ð³jÎá§+—¿ðÓ•ë_øéÊí¯£ÿéÊý/ütåñ~ºòüþß—»-ãç¦eú<2ŸÙœlœ>ÿ;SÕÖâs‡KŠ|ž*&ŽE\?O¼ó¿~g>oÒÿaS‹ÏË×ÄÄÝÄfuÉΈ;È2¹)¤ÔW4¦ œÒ 7µ8h¢+¸!•›îì'7Ê‚có´Š þ r0²¥E9RÒ…t%½±)ë6V“ ÷°—2}ð ò0<enš2ä•Ñ™ŽÈHöP¢MføÑ*Á¾}3õÕñÝ–kxµÌ #{ÖEXéòÒÛ­¯Õ·ÉíUØcâƒ$Ýìv™Dµã­Øñçsq»|»Õ ´;Ô÷U¬¾Í9« øTÎïÙ² ‹©¼¯Ð ”î¦;“0ŒéV«Yœ5 Gˆ„t£®K @@ -8885,7 +8891,7 @@ v\ 0 h Ah¶ŸÕ‡ EÕ|Âöµ|ç?g­)Î.U‡ëQŽa—ÕG}åÕK=¾°ifïìî>z¯&éãD¶ssÊö9 XÁ§YßàUC§S¯A¬ Ã^ vý/C7b<.´z~Uœ´<˜‰…¤¤€“îÇ»!›ö“R& Nº^‘×Ôö‡2]°»ü°]òa1Ë3Þˆ™Eq$œÎZŽî®[%)ˆ Ý ® ·ŒvºË»¶üä ÛYêŽ![DEâS‘qê´ŠÒ†o¿]×r{Þ’œ{/¹»c®•ÒË­ÏX†ÿ‡/˜ÿ€ÿO `dmbàèlgcàhó `uendstream +¥‰L‹MÎ`ñj=FS$‘•‘k…ͦè“f¦‡@˽ßßRªw¯ ¤îxqÝO[MJ;o@@ƒ,¥I;5l-y$hˆ É…k=žö”DJ(ÐïñÖüdØðbšW@i}Ù†QT³‚œ†Ý<1È`wÍM" úe¬8nùêän™ð.^¬çQª /@YäèsOéêC‚Hè†vÄÙ(UFÆ}ô#X0‚¯’ÓéaäLöéʉ†¸«)XØÃ颞Ý»%Ø—¹|'›kø[¸€Ä.¡z¤RmYúÚ5áãäÓxÊ•wXÝ?…“Rº—=ýR¿(lt~€ùš©ä&"TYÿ¶‹û„Q²ª-§ŸöÌârÇÙ½(,z z‚ß½Ÿ=âå…ÍmnéB³¯bªš¹ævŽãTß½¾>“R& Nº^‘×Ôö‡2]°»ü°]òa1Ë3Þˆ™Eq$œÎZŽî®[%)ˆ Ý ® ·ŒvºË»¶üä ÛYêŽ![DEâS‘qê´ŠÒ†o¿]×r{Þ’œ{/¹»c®•ÒË­ÏX†ÿ‡/˜ÿ€ÿO `dmbàèlgcàhó·ou­endstream endobj 948 0 obj << /Type /Font @@ -8894,14 +8900,14 @@ endobj /FirstChar 11 /LastChar 122 /Widths 2083 0 R -/BaseFont /QRFOKQ+CMTI10 +/BaseFont /KSNXNR+CMTI10 /FontDescriptor 946 0 R >> endobj 946 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /QRFOKQ+CMTI10 +/FontName /KSNXNR+CMTI10 /ItalicAngle -14 /StemV 68 /XHeight 431 @@ -8914,51 +8920,48 @@ endobj [613 562 588 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 514 818 0 0 0 307 409 409 0 767 307 358 307 511 511 511 511 0 511 511 511 0 0 0 307 307 0 0 0 511 0 743 704 716 755 678 653 774 0 386 0 0 627 897 743 767 678 767 729 562 716 743 743 0 743 743 0 0 0 0 0 0 0 511 460 460 511 460 307 460 511 307 0 460 256 818 562 511 511 460 422 409 332 537 460 664 464 486 409 ] endobj 939 0 obj << -/Length1 916 -/Length2 2862 +/Length1 912 +/Length2 2778 /Length3 532 -/Length 3503 +/Length 3416 /Filter /FlateDecode >> stream -xÚíRg\û¶¥JDQéƒÒKŠtTB/GzGŠ2‘IRDéR%€HSŠb@é .`DzAQ‘#E¥"âzO¹žï}z¿7óeÖÚë¿þköÞÒ’ÖvÊzX’'hL"R”Qp”6``a‹: àHnii2ˆ¡@$¢!†j(-- GõŽ ”º¶Š¦6R[0 ù‘!3ÿ.Òô ò X^<`Gò‚@JÐÃãÛï'[0$Ó@,œ…°ð} "7â{ 3¢7 ÐøIc©~”h 9€ -c…”X±$">À‚ÞÜKë.•ä#Ô¯æÆT<ÞCønÿ½Iÿ(c>è?ÁJÉ€ ’‰¿JÀŸÙ,@,D%üZ5£`ð—ÑÈŸ` ÑA¬5DñÂÞ|øƒ‰Ø_C°úö#⤹©©âÏyþ¨Yc "Å>ÈïO×ïâõfu‡ ÑW$‰D±„¬÷/÷_î2"z‘°‘µjê†LÆq³6ƒ…Ô€`± é¬À8‘DaX= ¼IdîïãTÕgA2é;û“Ð$"ø'VCJà_u5 ãÈàß*¢ýE¨«½? -ɪûü ªÜ_Åü ª³ìÿ5õüg‡õõIô`eU@ù+”–¦& ¡† ýoò§‚f†¬ß@"5´T°^T2$R~¬4kx`oˆ5j¤ƒ^ÜcÃ$¯£‘g.×E3ÃŒ -{K8Øõ}î¤XV· Ü㉽Ď¿ÑyÂ_a²Êy£4kïÀM‘€‹M!6OŒßŸ÷OÉÚš¡žÉ:[/â¼”eôÆïÐZÄcÝàʼ»Uÿd3Í¥¨#÷ù|k9Cû·»&$ÙZ]i5­Ù‘êÎÆYx‡˜¨*I[X¦?3V5æy ,-uÇó§agb8ï*>ûHj¢ -lr^cl¹­üÞ¯ëº?gHÝØ34‚&àq˜øSEU‰„¤ìú†ÍÛ9t¯JLJ&qðx£nt÷pêPçKášÜ0ø…‰Á¨®kæGàU3ŹB–.­@Áxcö\iÉñ9±Ör¾Áù<{é˜JmÈláµ>_9›3«.ÂêÑ ïÆõŒÚ˜© Tè) ïgr¦™éðóȵªÀçW8Üâ÷ä”å\¼ØþÒúɦ’÷Bê\M7—BÉ®„—ž&ù*'ŽŒ3­û·§kš«|#¿+v£½Nµ·àn‡Íúh%o?_Ro!ÿ+ÔåÛL_:ÓôÕhê‚xjúu‚dŒ«^fòÙýùÎ~ÖmE, 5–†«4z2–ì}Öøóóø£è§VRpi9ÝAKëeNCkÙõO=Ü3ê3B³3ž< >µvr£Ñ;@÷`Ã4Ö… <ºÚ$Cû±­—^3·[þ@BLò0l×bÁóJ¡²ØŽ°§ïOø¿ÞÇ­š.6¡†»iþø°qÜ6a˜¶°ªŸõ×ók)hŸþ½b¼!&¿¥ØEsbg< # 1ÅêÑï*Øqë‚™\í™âg‘ iðª=|Í«M•iZ›J6ªî]cÝ`÷®FP$¦€G¼>&ãîé°ù&(ÍèÝMﶤmS.« t¤ö.•úÝtµ–’eÅkV‚Þ£ûÅoæ öYÆŸ\Š÷ßëœÈüð½0°îuEàŠ-ZXd:õ ßMÂÐeK¾4™Ç4[²¡óC{æË æ -EÁ(—Ãlß9GW›%O‰ÔT“.¿–MÜ¡M%Úé,òj­Õõ¬œqYS­£þ8YÅÝlaòŽqÞ5Ƀy _Ks<>µç·Š5WÄñ–õ‰Jå>Zv ÿø _³¥]¾~-€éV‹ikëk4E wˆ÷†Ç è)Ô‡?zwepzâä*oB!…œ¬P¾Kl»·¾ùƒåêùÍû¶·AÝ™™­p5;Xܳg¿üŽv FÎH Cnß½YƒðJŸÅþÍÄÔ·ázË!iæûÜ/nö6½Y÷Ög¿¨ê™´0ÔŽ÷»¾aª’á5IaóWIžö-÷Äö»ëf¯ž»˜Õ hÙěėªÑÎmÌñ?‚iKE·ŽœŒV8 Cˆ1¢ úlÑ‚zZdeŒÞZä¿öµÓ2#ÉܸË/Ó¡ÝÊy:7{hæ¿Û Oœè Õd3Ö8wûd§bkºùØü·ûVQç‚'»ò¸KÇy‹ãdbh/Ô<«KwûO%*Fw×UÞwˆ<±ô³]WŒ;þ8…wª5`±4‰Ïqà’ϯTc“çd¡íîø;ıwY›iVvå¾ È0-êÎ[òh ós_©íŸ•ˆ¥»e4”o|Y&ÂáüN‘„£á×í?Þú’ܼɼTËÀí8Á÷¹ÅŸð1ñ(oIU¯U’eE/¶\KT}Ó‘ö1IJý‘ÓÃüs/©u”@»²sI3Mò+»çÊóL4?ÏÈoMÂÆÖQs -LÒýx²(Z°Bª>|ç}1­CCk¼!ÓøǾ­]%²«V؆$Ø}›|¦'wkóði;q¬Ì¿àø àКX>bÈ4Bs9(5‘.Ö—¥úú/ä‘À=bùFôè@à!fÓû½;•\ݶ-ÚgëG„wÃJNÝì_ ¨{#P‚ÛçLÊ}Ѳo̵[z?< -Â<Ëg–WÍÄq”qÝ|\zÅ!Ñ™úÊôÑøDxŸ¬8áÜôœ¬ªº0S²àíNdL¬kø°ÇåÖ»¼6jÅtj®óâ%ŽÑyè¡E³Õ•GywVPMj¬‹Ì²KŽ Ý­¥/É”œ#ö6KÕÙ(óF,Ö›¾³Vó@(·‘ÔwR÷ÁŽž¸pú5`Ý *OY -ãMvù27üÌd Y±–5a‹ãþºˆ ©v—øJq¾ÛÎ~/jògÎ|ô¾¦3Åu¹Ð‚;*’e.HÛœnÊfˆEs&>+KSƹ¦CÏ‹w”ID‹o͎ѪìÜ·ÛE'EI™»xŠì>öD#¼ͱvôq}Q6ñéwZ³žíZêF¾çÑc|Â<§>Ҁ܇\ïæƒq¤KBŒÛËZM¶3ùeû×Tb»«5`!ÓJ‹øëb,q½ šd—Êõ´èòr¶n·<éElŸ­|ìrݤ‘dMÑ-QA}k‡ z¤[ðÔf&¡ÖoÕ¸™šYzô7;©&lï-ð½æ+aÖiñg…wŠê‘¸^ÏñÞp³\‘–îöq»cô›‰ßˆŠp-#u˜÷u•3.œ»íŽá¿Lí±êYacîÙêžÙ¹OÊ⹤,ö.÷,ºðÚ_zõâÌïW_‹,Rîv^îËè¬Ó† Ž´ƒÎæ1²áÔ#œ_u{­ä„£¾ÜˆÈhÖ‘ÍÏØ3rYçÎŒžàÀƒ½ËI­DÛX7Úã—‘œ€Ú¶î‹cJp¨×ŽÝ_€ƒÕë¸XÄ#ÈxyÀþ¦øÛöÇú£Ÿ‘« -d 9õ2sv©r£®“ö -w%m-l5Ð’­Z7lC‘é½`"J÷Û¸ Œ˜NlGx2D´@(cã>ñD„ì(ø¤CëL0W<ó%êÙÔ‹/V}£3¹ÝNе"…&ƒm >˜;Œû‚ÂË3+©œXŽÓ¢‹pãN;­­”¢à|]¼hWááwm¹*GKâD¥ä^d›Ý|÷5lÍξ*ä{ÿ4p±Ì˜« CXjëöu„+æ?-w(QwU -×c3þvèÊ®dÅc*´$Û­†éìjÉýû 0%Éü¯Nôv G2&ª˜Í“r¸qþX]¿ûR1Æ|ók½oL”oJ·|ÈxÑœó\N#½ H7HÑMJt‹H<C ŠCÑ O? ¤;ùß0õ³øEo Æ ý&ÿmHÿ‘F`Ñò? ðXOoHLñH€û¹ô:ø§7S‰öÆþœ5&!0h]œ+ †ÐÄ‹h? G“\ÜC¿ÇAògô¹}· hn~ù’…ìŸûüžƒ#Ð8Ò5²çߪߊ¿3ô_LŸíØC (½þüõïÆOgâ\ðH4Ž~!`ª‚@@9è7ƒN0à@ã úÑ +*àð$z @ŸI €Â8¾­SEPô øoÑïP$ùþÀP:»@ð2 hù7iÐœÿ&(„ÞŽüéÝà¨(bÿ…ô™(zþ€*€"áT¥Ÿüÿsºzzx¿[òÊ*€¼Ý †º: ƒþ{íå Ð_ QÓPùuñ&@éûu¦/î/F¡ékA?Ð…ƒÖw9wÇýWJXaa^g‹ ƒžëïqfåu=¯Ž„>`ÀŽƒl•ù?dqˆâI/IÈÙøÞ¾'‡ZŒŸÑÆ.SÄýÑÙ(GÙ®Gé}!¼›)©@ÝDù€0—'`ÏçâhØXçö,hÆU#–)øy@•©ô{ íÁCDWRá¥OƒÐ‘ø¤GX±p{Ý”Xÿ“96žð†·‚fúV5jkVýejÉk×\·¸r2¹îú9®Ç¹%¦·‘׶K®÷m¥U½¡Þ\¼‘r½*90-¹JìëwۭܲAuNW#m @sV‘,és9±ÓïÅ<§ô©èðØ~nÖ¥ÜáRþ’ˆ7AÔå+^'8T’„‡`nOLÞ‰{ÜcàÖPñ„ï?^ØŠÓvíæ>`t9Î2 —1u­T^ 6÷œ!áÞ¶)_ +{cŠˆ?d1Q¡Œçù±×/ßëã> ÊiPÊ\Ís?}Nwöµ@"÷ˆHUxr¥SÐÂKt¢áÜTC ã¨íÆbD“U¹ŠÓVWôY6û*jð¤È“ôÞ.ÓIÚQŽìEÞf‚7·÷$už=˱ޤÆ*P\A3á—%[§Ûù ÐUë‹>ÚòÁHEåÝÛ­ü(ï%ÅrRiZ›ž@ò¾¯, E;Kíëe^pî<€[Ý’§·Ëc)éÕQ“d¼æ5¶šr—ã „ø‹.¦MÅv !oVì„aß<ð²Ú*¾Q}q¤?Ó%Ýã¶éÝ8Ë'/Ç>+꧅?{Z¥1”bn#rü%­ã<òð¶á`…qïÊßc]§*ä|!hÙ1DRsÂBÔ¹,œÛ‡Ef§²žr#µÂ,Gbëiìþ¹ZõÞ.xùÞ}騭X“–óÎÑi_kkwÊ>¥Þ™Í"u¼4(‚õX®†6Fìä£=r˜M1}Ò‡L‘¸|t°EŽë¼ÙÊ3ý|]Q\ì:RÓàjé@ËÉ<õ`ƒu¾¥[z”Ätdðd][Cähgó mÖ[n!ZŸlÓÀ=N&þ™°ç_뛫:òîü¢on­aiiÇ{¹¬^¨”Ò»m¸Y'»=§ué5Â,dØùPâÌxœóÑǶإŽo{nRÜÛ }\÷ÍÛ&Lãy¦qî%}êâÇï•Ö/g7¸N[iÎÀb#Bìåd]ùOy–ßùzE£ŒQ» º±ÊJA‘Z*|Eê\d—™ƒYóTJo³ÌûãM, ևIQ2BцÅ9Ô9kAľÍDîe–-C"0;ò¼3£r9|w!]dåê\U,¶e£± *SpÌÿ­Q¼QeÜRÎdÿ@«wžwö¬>W˜…aYТŸ +–ËßÈÌaãfBœ e¾>jaê§>Ò»=Ù-Ãàž6}Öelö%Êù9yûã…h­òôí† ¢G»JîŠ^–§‘:|–o9Hd¾¨øÍN0éL}ÍÑO 3N&¾‡\ÂlÞa0¥×ß\óÏKñgµV2hžþ+rÁoc—/¹’rTò¸1&õ#n<° YÉá™VÊÇÍ7†Ã=®éä꧑¼Ì̳ｼA-æä¼Wk:¸-ÙSÁ«2^ ƒC‰‹rJ4¤h㡶á럟KŒÝy7ûJšGšvgvÄ-Ϭz§àmOë)«R§²HOÒ‰OEuÎL­ö 2ìÎí_úøiÈIqB3e2ʦUKxtHÉ7Í;uÒVÔÿ#}»Ï<¶›ø‡9MF3;±T$ÃJ ËóÙLËN·vA$ļøiÀµ‹ ÑL’”O¬JTyöþ¹k‹Otæåê¥Ý—ðNJ"GاO>3ÐÌ«fò:¶4¸u8”'8Ewß½hÍ2=5¢^" ½zì«Ä–ÑBãôÂõ6Þ:R¦ºøÌ'GJÜûŽÉÇëùt­a¾ß Úï¯Ä,ÞJ¿¼›"QŒ›+OPžf^¬•Œé mð¨õÜBÇÛ© 7Þá¸Ý.÷µ½ñ…•DÁºÄD &þÉ*Ϧ]fÑ3ÓϲYóÍmÌ¢›ÊÃ*ÜnŽsÓ»´é§°kCi ÓÃÙFµª­·i§_“`çQ÷rD[ID!Œruº_ÃyŽ6çz2Ö]ÍðRŽ/ó««Ò²4ü—gë بÔ"Ì–¿X$þÓÕâ …OUE4°éU:’òâ,g&Æ%©ZžÜuCè\~kgÁ™EÚDkû0„ü8Ò»—?c2ìf¯bùñMùMÎ[-‹; 8êú˜˜ÔäЮ¨d6d$lQµY¼ä\«ïqì +f§ÓA¡*äÔl¶ätQÌ%r¦PA j@Ïédö§ë•Qu³#+ ™QÁ~õ¡T¥ÛöòçqÊæ#UÛø­'ÿêëƒz¶'×-6½÷ ø+Åõ/Ü£}é^ùE‘§4 g;Kn=1–^–lc\t½ê"WI¼¡P*+J.sËßPäñêxâ ëZ–jŸC¤Y>B÷ö§è˜L·‹â:ª-ÿZˆäˆ/šTÉÙ?Èšä«?õPmÕ¤—õþâüé°r‰+Í&ç ÷„à÷%!"œ9]Nê_L.Â^è-TóÙn>|Áyª õ‰¡:½Uê¸dëž o|x+[øÑLÄI6nÚÝ÷•ß?ÀtÑ¿0†8í)ÜkaÄÚaÐ|mïp´6×B¬wýÂ¥e•1нr5Åk…V¹ÎúŽ•)àvÅþ™&µµ’®4šA°/B-ÀNúRv_|}Ö?ëpGv¤ÝÉæØd«Ù©2ñwé2M»¯,Ô[ïÂ;kzHo¦øN>,›IåÁ¶)!?Ò9x:¬gmÆ|6®¾¦ªEˆ­¤ L{øóà8jãEþÇ&YÂ*î£*co‹«¤’V9ªÄ?Š$7à cUöÜÏVRcfl·}†Ä,RðsM¦…³bnÖùÃw”Ï>¯¾Päu$IBÔÊJêú5EtØÎë)Á «ÍMT¦D–Œ¦Ø<-­ßLÎwüÁ4ñ Ug1ýÖa&FšøMHœ¡ÀuN>/ÞQTÆ×”M«u*níØï}ûÅÉ{•õkÏ@W”Œ?¢X>?|d@jÿè.•·VŠ"„¡ù–ä_K +a%(¡ˆ$¾ ¥@.Q}ÜçéœhÌò•à°É6=áù›ïñG2•e¡k)üÔÊ_gì×}v`uûm †°ˆeœ¬Žsá*4“·Ýä.”dóÂÃûÔдU±%wåëvwúoò°Ko&‡?@‡uﾇåe9ŒÁeq‚ÏÕß3Ä0—CÖþè hÈ$ƒªFë¡ãd=G2/LåôÆÃ¥àJÈùãøÿ.A ᱂Ç?ýRfendstream endobj 940 0 obj << /Type /Font /Subtype /Type1 /Encoding 2068 0 R /FirstChar 48 -/LastChar 117 +/LastChar 116 /Widths 2084 0 R -/BaseFont /ZLSHQH+CMR12 +/BaseFont /QQJHXR+CMR12 /FontDescriptor 938 0 R >> endobj 938 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /ZLSHQH+CMR12 +/FontName /QQJHXR+CMR12 /ItalicAngle 0 /StemV 65 /XHeight 431 /FontBBox [-34 -251 988 750] /Flags 4 -/CharSet (/zero/one/two/three/five/A/g/h/s/t/u) +/CharSet (/zero/two/three/S/b/d/e/m/p/r/t) /FontFile 939 0 R >> endobj 2084 0 obj -[490 490 490 490 0 490 0 0 0 0 0 0 0 0 0 0 0 734 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 490 544 0 0 0 0 0 0 0 0 0 0 386 381 544 ] +[490 0 490 490 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 544 0 0 0 0 0 0 0 0 0 0 0 0 0 0 544 0 544 435 0 0 0 0 0 0 0 816 0 0 544 0 381 0 381 ] endobj 936 0 obj << /Length1 1972 @@ -8971,63 +8974,56 @@ stream xÚíµUX\]—h»;Á \‚w—`Á ‡ÂÝÝ݃»Hp <¸;ww‡Sï×ÝéîËÿ¿:Ï¡ns­=÷˜sɦ&WRe6%@¶NL¬Xy¢òªª"š¬,Ö,HÔÔ¢@C' ­˜¡Àúñ#+@ØÙ Àçâå`çeáB¢ˆ‚ìÜ,ÌÌ´¢tÿLâÛ,Œ mò†Næ@pcCk€*ÈØèäþ lm Pùç G€ Ðèà4ù€ÄÊ -0±0vÍ,l‘˜ÿq’¶5¸ÿ#lâl÷_C.@G°€,I+š€l­Ý&@S$fø]@°ÉÿRÿ3¹„³µµ‚¡Í?éÿ³Oÿk†¡…µûÎÙØ9;ò  ƒíÿœúøz" ëÿõ"i'Ck ca[3k €å?BŽn@% 'cs€©¡µ#ð_q ­ÉÿT7î_Ì"r¢ŸÅ¥þ½¦ÿV2´°uRs·ûwâæÿ‹YßÜ! 7€ËVðDðï¿þûò?^'nk 2±°o -N.€¡ƒƒ¡;xw€‰àÉ -°°5º€n`gæ¶ 'ð#pS¼¦ ¤–¼ê̦ÿŠý²Ñâ ÙÁhýodç0Û;ƒœ€&FÖÿ±¸ÿùøŸ#ÿ=ÌÁ`¶3tÚZMÿŠ²þgôL¿ÛÐñŸŽVoA°µ³ã[ì` ²±1|‹p˜ÍÝí̶o!.ðSàD “·7€ÙÑÚÐÑü-Â`ö:€Þà"@¶À3'ØÞÉõmœìídîükÆ?í9;¼þi˜…Ë_3ÀºŽà¥ü7ƒe.¹‚—øßÁ Vµµø[„矚­Aoq±ÿÓo ã?—Ã[œ[øÀyEÞœSôÀ ÅÞ\·ø¿‰\µÄk–|#p½Ro–~#p¥2ov‘}#°‹Ü]äßì¢ðF`ÅØEéÀ.ÊovQy#°‹ê]ÔÞì¢þF`7»|~#°‹æ]´þMà»—ÙÈÁÐØ -èôßv3øfc~ÛŒÁŒÞœÁøí4±€Ë1ù Áá?›é/Wdö‚K2ÿ Á5ýuNYÀEYþ…`'«¿,eý‚­lÞ|31Ûþ…`+Ð_¶²û ÿÙx!ØÊá/ügwÿ…`+§¿låü‚­\þB°•ë_ØÊí/[¹ÿ…`+áÿ¾|ED@nžLàËÄ>Áàj?‚÷‹÷Ÿ¨nk>?ÒbàCÎÂÂnß?Qcgð­äô¯ïøbÿ/6µ€@7 1ÒÂ,Ș/È2µ!¤ÌG¼`¼–Α8½$h¸=¸.ïÃá>¬i‡Æ15 éf0¦¥EFʱl%³‰)çaƒ°W¿§*sðM‡l˜S+UcþòuÉvÓùpåâUˆKkl[œíW›7ÅbÐ|FrJÅz¥ -O3Ô:dü¥O"ÕLkûÃ÷l`#&JIžmƒzVÛ{h¦¶¸ây«È.h8Äf‡E\MÀÀƒY^¾Õ×{ú í;JÑ «a5æp´É(äÒØPÝ}dBŒ‰Ò‡ Ü]â ób™-½}Åï²|Äݪï[ÄÚ¼>Cãà@R6ª$ˆxÒ2e’ÏKû0zë -¤ L¢­$0¿PkÐ=²\Zª§š6N ã–Ñuê±¹x~ÇÒß@˜|ÌÖñè §¬ &ûá²ÿFt²õ©&É·,4‡ ¢öûת͇+EžýûwŸÔ¤È*ù" xÞõ2ï8RvmÜ„u‰š”9º¥¢y4<‡j·äe=`L½ÖOVí -ç»ÖãxùCýp_pzZèºìmlÅ•ÙåW}Ïsºy‹ÏBà–¬§{è„Ü)UR*Æo¥Žì‡ËOBU[yº8h­¶:Æó?ß’Rï8þcøŽ 3ˆ¥u†¢óÃ`E9ÍTÛ>zèsò¯ÜºëGœ¥r·)o³µãS_ËøÞ_†Ý›È@Ýtr£¨Áˆ ]T=Hœü§mŸ('2Š%a4Ä«&¢–Q\×Ù®¡Ijß>¡mäËšKm/”ªÉS¸²=4~œ¼šS£YlF+rï]f3ôDfàImøTxß–ÞÞb§DM, =Ù¼8¬?Þ úØ÷äÀÙf¢ß—4ÚyuAê5øš²ŸË™×L€üÂÆ–®â¿íŒ¯Î#÷+ZhülMÓ«0矟ñQÝDÇjhJ(ð߉¡ÔåîŠ e§¤úé`Ðs~”=ïŠ:T°A¹É.xX[/$]4Ò,°Ðš|BßÓÉ€@‹çFNôäá,C‘Ÿ:•~¼çåùži¨8¯Ï¹ÃœV‹øÛÁ—Pd19Ò9 ð–Öó‰!øxÁna?ÚV’Ø£Z‚-Ïa²—W>§ƒô>"çÉšÑÛ¤æÚ7WË\o%¦Æœ5dh…ädÖµXÚˆ•¤ýdösíôÔѮ՞ÖAPÌ–NÀÏ7‰9Ôç~8×ßÊH ÷G3W¶rïDäbyé%ÙŒ åG¶•ÒqÛ7»=5öÐœ„">ÍÏoêÉB—&2û z6È‚¸)Qþ$ËÆèÙ&q`÷J.OÈõ¿:gÔ‘ r„Á£Û~8ŸlÙÛñ&FAQHïQeÀ›7/ú@²à™UÆþ^K™)I0MÇÜñ'±²¾¢]yHT-+; -9¯9¸IÆFßb /ìIö}¡Q%ý%Þ´åäXÑD—e^¨e˘´¾±ÜÖˆùI…ŽŠ&jÞ¹“‰mB¬ ø©eDH®[J.ìú 9Ì“ÄÛá^ž,FÔb£¢|Âu~Ìù–6hùùöDÆR¹ùÐf–®ŒåÂf<÷¯ ʃn?ð€/q˜:5‰V[Ä1ù˜aÆ‹H»®ÔÚm…Pq†:WŒúä¬,8¼àÂ:C~èQ­þ¦†,CŽäËb’¾b†õ¦‘ótÒQ~W"ù½€˜þæ®w­gZǃeýb±._¼"%Œ82p·ÙÉ£|ÕGÇ2{SY1'S%”pZ¬q¥˜ÇKóx­SÖ(ÂÀœ—œÒÀÀë¢BFBuBÈõÈ1Ojs±Ñåñ¼‡K%¤%>;e÷óTBveÛ\0ÿï„™1}k²kYÕx›/1À“]~R#ah Ÿ›$#‚æðôþ\¡¥Çv8Æ-ÉWó[ZGÔFÁ ¨°°û·véVÓÜ —¡øó§-r›@µž†j«G˜½safÕËd “_ñ‚¬/Öû¡Ã`ߣMÚ¨æi8é}®§6j+?g·£Xl$Ï n÷]Ø€]ºAZA nÚ°‡Ç8Gü²öx°ôÐÞPÔ`¢‡3Çúä*á6k¹±A»i¢+þp3ðG "›¬ªÙI‰Ý©£ÚÜnƒ†¦U¨´Òþ åá¦èkžÒ3‚b®ë­ÕrwDå]õ»¢¢_ÎŒïoH’€&?¨ñ§MU}#9A,¤°¾²4›dÆ| Ö¥üÐvìC-ÆxÅŠBÄñsTŠüé†óËÆK®i-jÂ6¬ÊÕU”Èj¢ -A u¾vdÐâul Ú¹ÔÁ  °2„a{ù3ˆ•°:é8¬ü·’ñÌ2‹USºæØ -5\"/²¼ÒPÊ\pb`˜¬’bK‹Õ·5`ÜuΕ)Éj°ÿý Æ -#^Ziÿe—¬ykíœÓˆÇ~~?šÛë¡û2ùÕB'ˆÛò¾¦Maðº?êg»$*/KõfmëÃéqjÑ Êèùź¸ÏÁ®’Rýö3æÔvºÔY6‹äãIñ‘ ·`§w!ÆQJ‰–äσ*©…Œ÷•ý­)çãVwš^“ÝŽÂ:¬ðâ¦z¿%·7ê‰+c‚mø„áIG:Hf¤!&Ù5—3ü@?ýÞíÅ19sfЊmvoKÓ§z‹Ä÷üó¹2²ë´i¥€@ê㢌Š0G!šP캙gBn]éÂÆrß9“¤vj4× Ãxã‚Äà–lßìLÆ]®tàmªqD¼÷T‹¨EžÖÒ¡àlÓtt×Y1óm¤øvEÐøâ|qLItYÿÝkÌ*îÍÎi…½g:…#¿¿‡3·|È»¸èÍ”Éj?S ÜÙûª=!¼Á‡ù('mMqC¾FH6÷ÌôV¬%Åß©ŸÑGóÞ*ØE®:Ì.êR¶sßÔ ý–¬á"@»@ðÉ-¿¨¡ Þ[—é“Å;»z¿B·3#Wm}3„ݾ©ÖÏ÷|-xoä2ë6äZ;¯yX ‚'¹Wrq\¹ÐËCâu­I¸»áÀ‹Ç¦}*kü$”QTŽyyÄŒéÒ…½C’RV–ùtxì“oXïPGsP†«Òí +º”eP(f-RWÔ‹\^·y4&ˆƒS®Þ@Ý­ÀNkSÝ(rÁR8$Ò³Ý:àkï`êÓ²@ÎíâÝ%ÚÈGzƒ -û•3ðûLä7ŠÖxdËd&Qæ -ooFhª>.‰#x¬Tê ®¸áœ‘^Ýœ7t¸[,3äYyŒùïÝ'i–¢Uz‡›B=5ê2¼fjÕ¿Æ”O\6,¨ *·‹Î\•E¯Ä{8KPÈ‹&¿ÚÓùœY±£!Ô Š´‘yÿ¦ÿÜÌ“XjJ¤F­ ñýcÞ~Ç[bk°‚b­y#5WÇK¾;i@wQ*Qô\ñ}M‡ŠåðÃRÏæSÔz”RÕŽ»Ù­–oJ6Ž^×ÂÙ·e q—¶‹L.eªåĚɮ` ƒX‹žÝÿÑ\HÞZ˜ýV¡(…äªþ‡Dî& -Á „™½ù< -Rÿ…»ºXί[è!ù~v'/Ñ8R²“ šÝ©¶Ö={¸ž]y2|‰¨ ¿BÕ*)Ñ(«™JéŠí•-Ò"P¶£—°Õ³ÁæU†Éß©œvðÙfÂÓßîúD]2ž­eSRlø)nã-ÊŽ˜4fZã¨,ü7g,9ÙnbwL†râërîec.6…£[±€:!}’Û•ï{•ýKYéïÔ\ÙµDM~‹š¼3 -É&ÍùqZ’J’’]y°o¢‡kž>†S1ƒn>fòÎúLr§™Å.;9ˆ|t¢û-½U>³Ê¾ÌÊEîT àšÅ·Q=·,~;pš¨ÆäE–/z§Ùö+ù"qVUJ­Y*{GÝábM§Y©Ð+ÕdââÙÆß>:Û£Dê=$)“øž¿&z{ˆ?y}dW÷gxhðÌ]nH>ÖÅfùFé Â(S\¡(è„eI/O<õ(›øö w# -ÅQ°ÃâJ/‘l1þv·%ƒâ›nøŒ®ÓB¢…»‘Æñlò!LÆÄ0Îìj@–¦s€îl2Õ¨íÑœßäJ×NÒ£ÝÛ Ê³)Î x.ÈGhhP*rLIq„–ÛàÐS±ªnJ2._ùÎ{(€ôÑðO"™Ê1”X¥¯™lïâøWlÿµî€'©ïÑÉð1Z/šóª€rŒØ‰½ÖwÄÏr±Zôx}mgHºá_>—ÉÇ„ˆòmí@“Eä®Àßÿ,Ó}úè;s¦M—­®¹UdÕq×fF^ñÕö鉀õ´; -‘b5ï†ôUZ‹Ê{éXç•_ªP:°ÌÄ äÇ™16*°$>|»ÀÈ–Ù²¦³bxüÓ« Ç›ù0å)TåðÆŽ±?¾ ]“s}z,˜;YÀK˜.ªhÊz¶ Uß壼?ÃÚ2ØÈDŒw ›œQ_é”}\U¶'’{×'äkW´ë9eÈtÈà8ww|ѨÙ\vé·léã–m£Î{ªŒâ "ÆèëViŠP¹ÂÒ"…y´ ëJ%¦¢åA¯kHï>‰Z5n€ÜMóþè©L^üú¤™3+õ“=ÞcÄù¨ÓÛ,æÉøQN*ùðrþìt*Ò©˜ÑuþÓòõåM¶êr)ÁŸ"þ£›IÉËf G#£©n,7­ ËjToN™Ú„™–Œ†™ú# BÉñÙdßni€q[Z?”âQÒ>BBˆÏ¼Î꒤儼’T»,~¯àñœtcZ™Üçèç?Œ½zÆ°îfõ.øb„»³èDŒÕ¢øš™gbÈH4¤¿ë;úãî‘é¸ äd R^ìB| CQ"–\JQ#Sr›ü“<T)îuŠÝwu9s›èÑ£&ûú†%ñ¦ýÓø±µ\({ Öï9G‡Ð©Î.»p±Üeç›| ýwf7Xj aÝF)s¾Yþ0¨ÜTÄ«¦-4êQ°‡«UÇ“¢µ††b£.&‰?öh»Ú縯o÷Ç -5ÕØá4Xãíþ±‰;<^µ˜'yµîêN]œ„-mÛ—|Rg©ÄÑnÄ]D!ûz4?ÝùiÜÊéÀ%»Ý–²ý ž]VÌ»xcÝ#§&þ$r^³¦ÔÍzåVX=S"ãs{Š9^f^I½n…4èýœ ÷2-úŽ«·Nð'æ¥]ž -‰—Û|ÚÓ[L^59¨ªZ Ü= M|ZãD«]á«$™9uLX½vÓJEj¬§Œ§ÊmyPÊ÷ÊFÓÞlƒ•wxhU;l›?ù(gö]H ªrÏÊcIñù¶—س?1ñ2ê÷}„ûè(œ¬õõ—q©t–¥oäi’¬ŒpP.wjÓœ±{_›Ó#$_ÛúY³Â„ø@¶ëÛ®ÆäÌõÀe¬_h g&çŒ_\´¡Ç¯ù€qßOfý¢bÿ"=ŽÞËÆfÓ¼{5JY+óÖFAÏ“÷ Nw\ š%&¸Ã -sB„$p·—SÔ¯„\øvÑüxÎhÔÜÔB§+â¿#º(ÉNÂ挌Iõ“ òF*>´Þ°'úõ|s²¤„Àú)õÚiGJë`"Tix€¸:÷$?²x} cn®¦ï¯A™úÑ N¿Øŵøå'^·Zq\I_«JPuˆî=tÚLa˜£)PÄ+;‘ö3C‹*å FñÏ)Wkâh7ú¼Ù!ó  ÔðɕׇNu¼O©<‡â+ƒc ÷$?Nä'zk…®‘J ×›ÛëàÈFj“õ­fÆ{Ý>œ,'œ%•¶C§rð%¥䪬_‰Y-Hð½õŠk»©†áíÖ€µ -J¾»ŒÄ°AýPZnAýýƒyÈdë«“Ÿ©ñ`›Šù¾hA×ÉàËàkíÍ™„nKôEžh G<+»¶Ìñóæ2™q?J˜~)Ú¢@¤¤ %7¢¨Uïò6‡ßXÙðYUr®¬KCÛðñ¤Vc‹i|0r -ëFÎ$£[KäŸû~G ãOz^’‚¼#ÉI´—þm)Dë<ýïiø´rƒ|³uz\¨Ì3¶‚¢íŠ!Ž_§Mèºï®Ùü½Ö—c—ÞÜå?²†/›åÐæE_¼Í¯ÃðÆiÊOœ†²¢ #éÙ} ûl¶‹"²£V‹I©¹b»oGN/.ÔåöÝ~ö@H…¨ÕqQ§žû0óvÌËÞqÈb>nà9NR1«`¨Å€¿‚©'«}•ì‚õX¿ÎË¡xá Àõ¯›4µ}K䎪nê1c,oB›\A4jºx‹)Ù™×d hñ¤¸«™)ü"zDIñÇ#ö½A÷Ø;ÉéŸe/¼M,#Rí‚i÷5..Õ‹PXq監.èR³Ü4º¸f?WGhó’iHÆ?ÃFÔkÿÏEoÃM§‹ª~OêéÎì óì·œE7ÞOLVDÝ?ä_ sÎÇv³4¯¶§öÉ7"hµ ,Ïq_g;µ|4ˆ˜üÀ~Ã$° Ÿ;ûHÔáeÜa°¹½Z¬jí¤ï_àP…ŠÀáî/Á¨ù´> <A2¿ þBº9ðéGãX€8 -yüÞñ<é‘wÞí1éß–!,Ÿ™MB¼ð³K«]…¼¶ï¦¡•\†UoÝ_gq„¿ËŠ´¾¼èÖ­²~äv¬Qòÿ!˜ï7Í–,`EÌý n´iÁá9«½4txSšgâ¨ÅòÃûº¨ST) –w¦gÁ~´HŠvZ½úÐC‰w­ü‚A6WþºµxúË©ðê42v–ÀÁxÓ,«.)ö±Š•V1ño[϶q†&wWÔzÉ]w™‡Ÿ?ŸŽŸ>â-‰6‹5‹Øõêçý³Ç¨”ª/wtŒÌfö׃ĥI“ƒÑQ+#+7A -Kã{{%<°¦ŠxQ¨eϬLÕ%æ*.=&Rê‰qMû“Òm®¤Ĥ%G"/L Íï½¾§;&%¦:Fn¡ÇHfé´$¨¯Aá༞`|­×n·|?w'MÛ Y_CI1ÒÑ;Ms ÷Õl˜™Må£è“¤x=$éÚŽ -=vS]9sÎ1£Øa pÓÑ–'y‚ŸC½ñ’>t;ÜÜï‹«v’ô[ä|²òÚC€åïÞåùøðµ0r™²£DÝV~#_’½™µ\&NQòOš1À‰ìòò*I[%‚5vÿ\¸ï^CÇ5}KŽßÈõWÞ!ÜÐ9+>9ß,™ã»Suæÿ®÷›˜˜ÕRJ|µ' زFdzl´'n¢+Ü<_[ì~ÒsEÓ„oŸas+ëžÂ<\¹<}ñ›M¨î%ñ px©3Û·ÓÌ’¡/>¹™¢ -2ý˜Ÿœ,hqvcJ¨M5’ç·–5iÔBtšÕ „öãð€î -òÃÚ+×øúÉ€BŸŠ8üòúTr—6Ü!¨E©0O%v?€®ëÂP% -ÓÝǶÄ1„…¢ƒGnCe™éUÁTŸÏlÚ3ça19ÉðJ·aˆŠ…É"´}AáÙí­DCÓ¡˜Äµ“Ì•¤–pB³¤]r@'þ€/ÇDàáæñ%öªÁ½$)ÓÚaª:*T;ÊjùB÷ d”]©S¢‡òØw(£¯òCªögÆ%6r¢Üyð.DÄ­ŸŒÏ6ãÙ¾ŠOw¡ÕÇ-‰Ô×2«¯¦KÅØ\1ðröèL{Ry0´w‚1ú©cÌÞÌ7¦¬\ǾNz<œ-Höø5—˜/ _çÝ?}-û@&ºuG‘KÏñ,1ÍWÜt"òºGEV E§òPãÂq›iêù†ßùõU–Ak—XU€†ÜÌGÿ i9b®‹ÅBãÄ…Ýa„9oßT7— ¯^Ú·•Æ²«VCØ:mܾqÀá›O£‡ï‘Ù;Øw“<¶úÛ ‡&ʨÊô³—™ô÷_ `;¤è>±6)ú«Æ8ÛÙ}ú¦®;Þj[ðèö£!±Ð|–fà°VàÈf'¿[•¤Æ•Ü&¸N¡#·Íº©óÕÖ[Nôû®±—Ì¢¡í÷¥%Q6Öy„÷ˆßá°"ÏB˜ÜP|û[ŽGÿÈíÚ\4ˆ˜—èáxòHJ¸vŒ”¶n¶(·r/³1‰[ÐâEõ;_xŸ–ÚÃHC?ãÓ3¯–) 0Ï*ó“hTIf‘b'† -ßh`´7Âѹäe:Ó^~ÌÇŸÛ-GÅãÞ%÷2nx~-4 y¢‹[¾{ƒ²½³ír‰Ëudß(“!©Yà^;¹n„ h€†sežY'"T Ɇjµ“¢ôz˼»ëȨ*왹3ÄwÎwïÎ[®*ÙQûJã=!ò2¿¹î÷(e÷5iji-mÄc¢w9SW­ûÆ!(º«ÝºÇm¿›ÓUÏÈâáeJ/Vͼ¥êK-Ôd3Š0&:U­0QI½R©‰¼ÂCsl(Fm’Æ oúçé7š§Ø. 9™ f[,8´äuÒ†oÙ9+¨·Ù(‚Iì9P«¡V·„ŒÓ¦lÌ;¯w!Ã1¡ -ç]¸Û¬Å%Ã}ÑÝãb"@ƒÇSŽìžá²øÊ%xvPhQÈ·ë"P#qû®_\íöI:¸bæ‘:ÕXÌå'tóJHy¯ vAaɬ֬T Q 2ïæOÃV{‰MWü#4NH‚· oÓÇz·Ÿ¡„•®YqÜœüçð{¯÷ðíbÛ}Ía!= Qc¬Á6æE4„ãë£Y;A°¤»Ï·Qýnz##_.ûmà -#1¾ñ4–Z²¬«3zãRu$Š$<ýÏò—}÷öQü^! -·n#B|fJ”§¬u—ì®-¬)„ëÍ?m¯L[äíŠb+ºW”öª P†ˆ›Of>/À,Q'+ÔÆ#ŒpV2á`¨²¢³_Èou¥Ü2× O‘büzC\›˜îõÕ]’izÜÏ ~2ÿá4¶tÿâCW€Ø„CGHrSC£i÷ƒ‡ÿ»ƒÄççšc‡ƒÑ¯W!Ã-£ÅCÆZ?·ë…ú}Ü¥*Û°—IQ‘¶Øw3º°ÆVrpì‡ê½¢¥ìJï!÷—òm¢;'ÁNä÷Õ±¡±¯ƒNüÈ6r}%?«¹²ò¿ÇRbÆkâA]o}¢ b|fYÛ%¢r%òû¼æåÀ¬:ùZ3hìÈFQ/J»¤€9uuú£Ëðçƒ÷•½:ž’_@á´*Ly¥€N§§ÖÔþÁ<.èúáU-E¨ûÝF–“L E“½ytDs’—Öý¸bLŒV4>nü§ˆ¨bíC)·ÂÊôö‹Å’•‡WÀæŠSuJ}K5éw>äÜGLEÿö#šêd&Y!ñyÜUÉzjÜx< ô_ª5‚ͽ Q¬±ÐÖë-e>á˜Ox(¹«2±fFdI=z€è±Ÿ…¹ñ#m» Ý×£ŸYC-›N*¢·2\»MˆÕ9ýõßXÐ ô^Xâ+Éàó3¯sãúºƒ'–ŽiF‘ÿš!¸\tTÞ—QM 3ûVÞíƆ_Ë{ã]^U¥Ý‰_ü¨@áïÙÙ=§=…7±t_YeÐœžÒËÕ†žì¯q©úž naxNMx‹=ëÒJ²,ütxGÝøÂLvû)BôëÆ2½ºäŸËPÒB¤¦ïR8¡9gØë¥EðÙFûìRÕMª@gI=üFy_ô…z»\ XšÄu-!Ôíö"J³ÛدTáž+^’²pͺ«[”& |Mb(_äÑ#"›ËÚ¶¢m®|¢Óõ¦˜†+õ›WúØ(sÃÒô BóàëK©B7BÕ…¤©x» *ªBèèýb/sŽÁC±Â¬?Ø„­a?*ª%ÚÔ#±Yf:VÙÇ&óؼkP£·<è†*%2YéÑÔëÊbKÀß6¼“\*]ð -–V*ä£ÁˆÎi •¤iÅUêY­j¬ZIÁÌÿz¤ÀTòá‡Ør Êß*¿h¤óµqŽ“\a]7èðW¿þ¬`œi 'À¢•ŽH›­Rßü´%>¢\k”_TwM¾¯öh2n4Ï‘ÿG£ýdjš[™çzߢ@ÚäL™kcàe~\ë -£æE½¼€Y9Åh¥tÈüuma'ýzºyí|™Úê¦R„´5÷g¥< ¾óRf͇×Vª5jøð¹‰ô¤ÄPeFñ@›v––^¾ŠSR‹ó:—T‘‡‘UYzÒ'–3×÷ÈšI}èš=ÔËkß;,i-+ÖÐN`n5Ò|=0¼3äœj¼ŸK±=§S`TÙ½–ù@ŒPÔu~ ¹ð -ð:$¹ºR2÷€š!‹³šÔ,iõ¨ðÎ\{ åAbŸ¡o=RMcÛ,»1ï݇<| ³¹Ñ_äSôüe7üÔ¾üf&ß²ËÆ8 -ªNÉìVÇKÐêh«Îà©U9 |詸ÆÏä -ôR*“º¾ -K—6i~@£cªÀ¡¬m‰fJ8*øÙÃÁõ³3Mà·¹wwϱÅ8H¸m‡l“®rc2˜d¿S²MÒbïa&¥™WÚÒõ†l?~vC>¸ãF|XDÇì¤g¢Ú­ž_CmRê´ìÈ0µßÇfþ ã@W(“É -yµõu§ñí»³„TÇ–!jìøl5ûØA/¾Õ”j‚ýN•ýq5lV£4ZÍB`4NŠ6¸á'NV’ëŽÕ1ð½ÿ×EðÁûþéé™>é:á@ûš¾ Ï€e=óÐÙo‰ë—×é£PÇÞw™ÞÊÊGF¡ÅèxLB~i.#¹{2'bÒz¾kt¦¥·¤2åY9Š£±Ú’Ò»m_:ƒ›'ðÛuãuñÄÊIÃ"Æ‹¡€düÄ@BÕ&©«ú™¯ö)'ê,‘°¤?ƒâF,²e!,Д¼½Jï¾Ñ”_y^'—ÝPGËÁc&ä2²y= ™CÝ”dí°É‘ u¦bº)PZ–>Fí¤§Œ)èPÍx3èÃ[Búf »yÚõwÄ~FózúSP¿C"$:7Ô.¦‚Äz1rK¯â|ÙÙ@èƒDÌc/‘}ʈÖÄ·^/²ïé ä‰+¾ˆl>£à˜¾Huáf7:„F~Ü–€B™J>¹+ø@:Üþ¹*ýi®Ï„„£›3;{ÜfOôëX :˜ó5­ÝÔ«˜±S\Z‡V0¸c@„‹Š& q›Ë6pzŸ:Mò &ç’"¹Þ„á;ÿ¼h¯¥ÜfÊ„Ë{«q|~tÒj&œñѳ›ÇÇþXÃN´ÞÞ¯£ªV—#—ÓDÜåH¥ÀУäŸ÷`N¥ñ“5§€Ü¨ŸNU -²Ã¡ Æ´1qÔ)¢ŸQ~¨ºV3f|oýP?ïJØÎ(܆ íÌ|õÝ×7à/—o•`ì#g\ãµ]Po^¤ò S'ih'HEìEE›ÂÚFÇO„øþE Ç.ÔÊI@ây4—ÿÁÛn 7çB%3hÙKØyS®°eôÛ‘v׳¿/ù*½ÇÄUi|“ϼÂRF1^¨FÍÝ5Þ‚*É¡†‚¯FçÌ·»b?$2m½N¨ûíQ›Eû{¤¶89²…7Ç™]Zæa>–~‚Y ]þÅ]­1oàþŠŒ¿‡òûÕßV¡{l$PÆ5äÜ#þ1î}Xª–姀âÏÒQ´‰ìËœÚÜ8ÝËØä¼×­LK}R|Ê8`mÂv]^ðwÝʇ3¢ÇprÚ>R“­+¢ß9^á»pbN£&¸0e©ýìa¨e↼LÊÜ^û´\ŒÒ[/]´/«4P–IΊúa_X­0‹ý -;ívà¯gÉ+ä·q¾Ðü:oJ'ÊZ‚ÌäÝÇ€™[º’bÕcCõðíÁ:F,N{Z$Ò@Ͷ«GÓ†Ês|†Z{?JÆ*¸/_Ñ¿<‰?ˆ>{†XhAù‹í¤íœR~EÒ']¡3ðâV|}BD¨Ò,KÐÌlèá'JU°ÃáiËÍ+F3ÕvâùƱ‹Š1jßìwi ÉWÅ”àÚ_n1r€¡ ¯émàÇ?ʉØx¬ô™•dšJ\0r¯ªUXHÒU -{{Sò:ØGSÚ ’m(Åä=³ŒÔͶ'¡Þ'+‘ãXc äÀxí/œ‘`Gó•£ÙÓŲhÕÚ’I4¹Ù—Ù.ó÷z©ð²° ŽED/ˆdÜ{9Àq1²@'> ![©-²)á¦c•± -Q¬\…Ø&ä3`ü ÞÂø¿ØEóÀ.Zÿ&ðÝËlä`hltúo»|³1¿mÆà FoÎ`üvšXÀå˜ü…àŒÀ¿ðŸÍô‚+2û Á%™ÿ…àšþ:§,à¢,ÿB°“Õ_–²þ ÁV6o¾™˜mÿB°è/[Ùý…ÿl¼¿låðþ³»ÿB°•Ó_¶rþ ÁV.!ØÊõ¯‹låö‚­ÜÿB°•Ç¿ð_¾"" 7O&ðÆebŸ`pµÁ{ŒÅû¿OT·µŸi1ð!gaá·ïŸ¨±³øVrú×÷|±ÿ›Z€?@ ÐiadÌd™ÚRæ#^0^KçHœ^4Ü\—Î÷áðÖ´Cã˜ô3ÓÒ¢#åX¶’ÙÄ”s°AØ«ßS•9x³‡./CþÔøPWêwN_ºMVøîÙ–]#Ãé"åõªK;lµÜ>+w>áqLÙÜìó¥•ïÈÚrš åv +Ò—œV¹d ÆÞjÜÐÑ$¨´Pô_7ãûe°keÒj5ýcdŽ<ôLºÀ"ë²y–çd´_Tž›ûâuÙ +Õ¶e98€OÊIWó³b±ëgq{È×ý3ÉÁUãÔÅ^3EÙCè«Co©Ë‚8ÃÙcƒûðm}m*lN-ºËéL©¦èK¦C6Ì©•ª1ÿ ùºäG»Æé|¸rñ*Ä¥5¶-Îö«Í›b1h>£FH9¥b½R…§j2þ‚Ò'‘j¦µýá{6°¥$϶A=«í=4S[\qŠ2!ÆDéÃî.qP‚y±Ì–Þ¾âwY>ânÕ÷-bmÞ?Ÿ¡qð )UDºÕY†Š=¥ÌœÃ%bšØZËÙª •—Ùg™Ç±õ +òóœ°ì§ë€o¹B½áUÒ&ÑV’F˜_¨5èY.-ÕSM'†qËè:õØ\<¿céo L>fëxô…SV“ýpÙŽ#:ÙúT“ä[ŽÃÑÀ +ûýkUÈæÕ"Ïþý»OjRd•|‘<ïz™wœF)»6nºÄMÊÝRѼžCµ[ò²0¦^ë'«v…ó]ëq¼ü¡‰~¸/8½?-t]ö6¶âÊìò«¾ç9݃¼Åg!pKÖSƒ=tB*)㎷RGöÃeŽ'¡ª­<]´V[ãùŸoI©÷ +ÿ1|Ç…ÄÒ:CÑùa°Œ"ƒœfªm‹=ôÀ9ùWnÝõÎ#ÎR¹Û”·ÙÚñ©¯e|ï/ÃîMäG nH:¹QÔ`Dˆ.ª$NþÓ¶Oˆ“G Å’0âUQË(®ël×Ð$µoŸÐ6ò‰eÍ¥¶JÕä)\Ù?N^Í©Ñ,6£¹÷.³z"3ð¤6|*¼oKoo±S¢&–‚žì ^ÖoP}ì{ràl3ÑïKí¼º õ|MÙÏåÌk&@~acËWñßvÆWç‘û-4~¶¦éU˜óÏÏø¨n¢c54%øïÄP êrwŇ²SRýt0hˆ¹?ÊžwE*Ø Üä —ƒ<¬­’.é?Xè@M>¡ïéd@ Ås#'zrˆp–¡ÈOJ?ÞóòÀ|Ï4Tœ×çÜáN«ÅüíàK¨²˜éPøKëùÄ|¼`7ž¨`Ï™¶RK(ÖÇ͸6Ó·SÊeÛÀêêNQP›¨çÈ5­…øâðò¯˜ã.krŒI*Á„÷¼~/*(^åÌþ¡ÒÞ&^f6ÿªÂ÷&rf1èy±2 ü¾SãÀ£_†pS‚Cç#• O°ÒåRQ¸…Ù¢}•‰¡b=d÷r°¼õÚJ:ÜfyòUº ”_,búÑ]I;-gªHQJŽpðn6ÿ‰2 +»SàèHáçOß©&ü¼‰ª}ã|ô5ž&Y“âG)#CÐE`eY)›RëÕïCâéTøÏdåpû©Ëÿœ†Q–õKî/–˜ò´¥%ˆ_EQàÃvSçTìJb¬­µgb„.¡CN¨\èê£v17Ü>‰…þ +ß kÿƒ¥…ðõBßÁÆö}ä°&ÕqbÊó |TÈ·-+ˆ Ñ²ã”!2Ã'­£(\áwŒƒHxV?¥iÉÝj³Wd¤ƒ>ûÂg/£mJÆ3gÔ ]Ë"àf7@Ȳ$ÌŸ(üÞÿñ¬_|¬œ{å,ÒC¡°þë'ŠÆÁÄât +¶hú­&nf€+Îm¯ÑÇ„vò3Úª¡¥R©Œ?h7V0û‹;t–´µÓª$Àç'J@äôªÌ%§b¦ÇûÚq$)©Â°ÖÑõë6MÆ"§9=LCä¯ò5œt £]Ô›ì¿u9P¶$Ó©}¡Ð6Š¢0d!"›Gn,,¢Ã:XzC¨²¹Ó4”†L ²¦Dš³­AÃÛ‰xzŸ°‹í¿+IìÑ-Á–ç0aÙË+ŸÓAz‘ódÍèmRs훫e®·ScÎ2´Br2ëZ,mÄJÒ~2û¹vzêh×jOë (fK'àÎç›Äêó?ëoe¤Œ…û£™‰Œ+[¹áW"r±¼ô’lƆò#[ŽJé¸í›Ýžš@{hNBŸf€g‹7õd¡K™} =dAÜ”(’ecôl“8°{%—'äú_ƒ3jHP9ÂàÑm?œO¶ìmŠx£ (¤÷¨2àÍ›} Ù ðÌ*c¯%„ŒÌ”$˜¦cîø“XY_Ñ®<$ª–•…œ×Ü$c£ï ±„ö$û¾Ð¨’þoÚrr¬h¢Ë2/Ô2eLZßXnkD‹ü¤BGE5ïÜÉÄ6!ÖüÔ2"$×-%vý…æI +âíp/ O#j±QQ>á:?æ|K4ü|{"c©Ü|h3KWÆra3û×åA·ˆxÀ—8Ì +šŠD«-b‰˜|Ì0ãE¤]Wjí¶B¨8C+F}rVÞpa!¿ô¨V SC–!Gòe1Ia_1ÃzÓÈy:é(¿+‘ü^@Ls×»Ö3-‚ãÁ²~±X—/^‘F¸Ûìd‹Q¾ê£c™½©,Ž€“©J8-Ö¸ŽRÌ㊥y¼Ö)ka`ÎKNi`àuQ!#¡:!äÇzä˜'µ¹ØèòxÞÃ¥Ò2„ûy*!»²m.˜ÿwB‹ÌŒ>‰5Ùµ¬j¼Í—àÉ.¿ )‚‘0´†ÏÍG’Asxz .ˆÐÒc;ã–ä«ù-­#j£`†TXØý[»t«in†ËPü‚ùÓ9ˆM ÀZOCµÕ£ÌÞ9HÈ0³êe2†É¯xAVëýÐa°‡ïQ„&mTó4œô>×Sµ•Ÿ³ÛQ,6’gP·û.l À.Ý ­ P7í@ØÃcœ#~Y{2…°òpt´¯›ØÓ ‚×(\Èt-[ʽñR3X,Hù¤` ™¯¨H*Œ×ÁFŽ“pêË‘‚ +™4ܨVœóò…%šéºJfõwSuCŒ[r¹}ӵΠ‹¿ÐÇ÷k1×õ‚Öj¹;¢rÈ®ú]QÑ/gÆ÷7$I@“ÔøÓ¦ª¾‘œ R X_YšM2c>ëR~h;ö¡–c¼ƒbE¡ âø9*EþtÃùÇeã%×´5aVåêªJd5Q… ‚…:_;2hñ:¶í\ê`PX°½|‰ÄJXtVþ[Éxf™Åª©]sl…ž¤¬¼!iµKÅ +˜AÏý² sjûý·†+geUgãöêO²ä3—Uyuß…Vr$‰ÊßO¸g“di…y¿DÞ+|†Ÿò:ˆú„½²Y“YïIæcZ<>Ü©à˜›J»‹s—;üY¼æÄ#B¹?9–-T·Ì/Ê<­È èq™<ÙÉ—bbc¾ÒØ\Ö]­~L­\Ãu +£ „æ¸Ä-/ÄSïˆû-"'¯ L ;^ðŽ›ó§ûÞosb<êòŠÞ"ñ|0Oh"jênA €rõþ–‚ÌPþ`ª_ôt…EÛÒÞ‰â[A6ų»c1.‘Y^i(e.810LVI±¥Å‚êÛ0î:çÊ”d5ؽ%¤8®òcÊE×]™}wè\M¡XRF?\ +aŸþc…/­Œ´ÿ²ÀKÖ¼µv΀iÄc?¿ÍíõÐ}™üj¡“DŽmy_Ó¦0xŽFÝõ³]•—¥z ³¶õáô8µè†eôüb]ÜgÈ`WI©~ûsj;Ý ê,Eòñ¤øÈá[°Ó»ã(¥DKòçA•ÔBÆ{‚ÊþÖ”óñ +;M +¯ÉnGaVxqS½_ƒ’Û›õÄ•±GA6|Âpƒ¤#$3Ò“ìšË~ Ÿ~ïö☜93hÅ6»7€¥ŠéS½Eâ{þùÜÙuÚ´R@ õqQF E˜£M(vÝÌ3¡·‚®t +ac¹ïœIR;5šë†a¼qAâpK¶ov&cHÈ.W:ð¶Õ8¢GÞ{*„EÔ"OkéPð6‡i:ºkŠ¬ƒŽ¿ù6 +R|»"h|q¾8¦$º¬ÿî5fƒ÷fç´ÂÞ3‘ßßÙ[>ä]\ôfÊdµŸ)n‚ì}ÕžÞàÃü”“¶¦¸!_#$›{fú+Ö’âïÔÏ¿è£yol‰"Wfu)Û¹oêƆ~KÖp ] øä„_ ÔPï­ËôIˆâ]½_¡Û™‘«¶¾ˆn_Tëç{¾¼‡ƒ¿7r™Îur­‡×Œ<,PÁ“Ü+¹8®\èe‰!ñºÖ$ÜÝpàÎÅcÓ>•5~Ê(*ǼÉíÊ÷½Êþ¥¬ôwj®ìZ¢¦N¿EÍ Þ™ …䓉æü8-I%IÉ®<ØŒ7QŒC„5OŸGé˜A73yçN}&¹ÓÌâN—D>:Ñý–^Œ*ŸYe_få‹"w*‹pÍ‹âÛ¨ž[¿8MTcò"˽Ólû•|‘8«*¥Ö‰,•½£îp±Î&‡Sž·Ž3Õl]÷Ü<£–¶‘ŸPè»Å_„t3Ê*¸µÄ›!¢’géœ5Ì% ¦y,zå׋-9SLˆX9Äî»K±Å¯ô¼<áÏöúªú|í—«iôòÉ|äC-Æi0L«úbZ›×Åüúó”ûäYbým­ÝM&·c´ë/Œ[ܼÌÎo͉œyb¨¾5 ’e¨'|÷>¹k$ü¨Äåp ÞÁ‚¡ò[/ÙäÙ!ó#ŠÌ‡ð_dš–U&´©°ûÎŽ` ;B5u!õŠ8ï©!ýdÉîD‰_­WÞ:jÓh`"¤Puņ“%¹ WôT°Fðz¢íįuŽNäcÔøbÜÆVäð+B-ÞjÉf¦Î ÜðL_îtÐðKÊ 94L“T7PY4 |é´`¯…Êæµð&ºÓ<§l‰ØŒu©%e;ØbgÊàK)©E;á,5×gþ]áÜ [·+¡ÿ¤èÒp®iÏéËc„ÑåKÄC†y…Àsž.P[œµˆ* +{Ä<®Œ‘ˆTm*áå2mO:!žŒ¤ ÿ!U¨™Ù/°>Û†³.Ï;ùå’·Õ«]Jžœ;Z색$Ÿ¬Tè•j2qñlãom‹Q"õž’”IüaAÏ_½=ÄŸ¼>²«áÛ3<4xæ.7$ëb³|£tPa”)®Pô‹NBƒ²$ÈÈ'žú”M|{ +»…â‚(Øaq¥—H6‹˜ »Û’AñM7|F×i!ÑÂÝHãx¶ù&cbgv5 KÓ9Àw6™jTŠ€öhÎor¥k'éÑî¿måÙç<—ä#´ 4(¹¦¤Ž8BËmpè©XU·% —¯|g‹=@zˆhx'‘LåJ¬ÒŽ×L¶÷ qü«6ÿZwÀ“Ô÷èÇdø­ÍyU@9FìÄÞNë;âg¹X-z¼¾¶³ $Ýð/ŸËäcBDù¶v É"rWàï–é>}ô9Ó&ËV×Ü*²ê¸k3#¯øjûôDÀzÚ…H±šwCú‹*­Eå½t¬óÊ/U(XfâòãÌX>‡]`dKlYÓˆÎY1<þéU†ãÍ|˜òªrxcÇØ߆®É¹¾ =Ì,à%LU 4e=[ЪïòQÞŸamld"Æ;†ÍΨ¯tʾ?®ª@ÛɽŒë“òµ+ÚõœŽ2d:dpœ»;¾hÔl®»ô[¶ôq˶Qç=UFñcô‰u«4E¨Ü +ai‘‡Â¡(K.¥¨‘)¹MþIžª” ÷:Åœ9„̓ôèQ“}}C‚’xÓþi üØZ.”=ë÷œ£ÃNèTg —]¸Xî²óM¾„þ»F³,5аn£”9ß,Tn*âUÓõ(ØÃÕªã¿IÑZCC±Q “Ä{´]ísÜ×·¿Ž{„c…Žšjìp¬ñvÿØįZ̉¼Zwu§.N–6‰íK>©³Tâh7⮢}=šŸîü4neŠtà’ÝnKÙþÏ‹.+æ]¼±¿î‰‘S9¯€Y Sêf=r+¬ž)‘ñ¹= Å/3¯¤^·Bô~NÐ{™ }ÇÕ['øóÒ.O…ÄËm>íi‹-&¯šTU­îž„&¾ ­q¢Õ®€ÇðU’Ìœ:&¬^?»i¥"5Ö +€SÆSå¶<(å{e£éï¶ÁÊ;<´ª¶ÍŸ|”3û.¤ÆU¹g層ø|ÛKlŽÙŸ˜xõû>ˆ} tNÖúú˸T:ËÒ7ò4IÖF8(—;µiÎؽ¯ƒÍé’¯mý¬YaB| ÛõmWcræzà2Ö/´ †3“sÆ/.ÚÐcÈ×Î|À¸ï'³~Q±‘ÆGïec³iÞ=‹¥¬•yk£ çÉû§;®ÍÜa…9!B¸ÛË)êWB.|»h~¹…u#g’Ñ­%raÏ}¿#‡…ñ'=/IAÞ‘ä$ÚˆKÿ¶¢užþŠ÷4|Z¹A¾Ù:=.Tæ[AÑvÅǯÓ&ôÝw×lþ^ë˱KoîòY×Írhó ¢/ˆ Þæ×axã4åŒ'NCYQ‘¿ôì¾…}6Û‡EÙQ«Å¤Ô\±Ý·#§êrûÀn?ûN ¤BÔ긨SÏ}˜ù ;æeï8d17ð'©˜U0ÔbÀ‰_ÁÔ“Õ¾JvÁ€z¬_çåP¼p?àú×MšÚ¾%rGU·@õ˜1–·G¡ÇNŒM® 5]¼Å”ìÌk² ´xRÜÕÌ~=¢¤øãûÞ {ìäôÀϲÞ&–Ç +H©vÁ´û—êE¨ ¬¸óÍQt©Yn]\³Ÿ«‡#´yÉ´$ãŸa#êµN‰ž±Þ+]”«¨Nܵ­‰fÜ›û 6}þÍ=/í o´µ?øå„f ;¬5gj*ô°»ù¾²eÍÄÛCÔÕYð©ø‹tPŠÿ~x9ð¯btäa:ö,ò¥m~QSŠ‹iÖù\ÛV¹=»gBЦš[µY-VCÙ~›ÐJQ|—£%q¡ú|Žœ¦ÀçKrà ˆxú÷CHßO ¥9¶÷\Ÿç¢·á¦ÓEU¿'õtgv†yö[΢ï'&+¢îŸ ò¯…9çc»YšWÛSûä´Ú‡ç¸¯³‹Z>š DL~`?ÈaXÏ}$êð2î0ØÜ^-VµöNÒ÷/p(ŽBEàp÷—`TŽ|Z žŽ ™_!Ýøô£q,@…‹Ÿ»Æ“¦í…¬¯¡¤éè¦Æ9ûj6Ì̦òQôIR¼’tmG…»©®œ9ç˜Qì0¸éhË“< A€Ï¡ÞxI:nî÷EˆU;Iú-r>Yyí!Àòwï¿ò||øZ¹LÙQ¢n+¿‘/ÉÞÌZ.§¨Fù'ÍàDvyy•¤­Á».Ü÷@¯¡ãš¾%Çoäú+ï n蜊œo–ÌñÝ©ŒÎ:óƒ×ûMLÌj)%¾Ú“ìGY£ãÙ 6Ú7Ñnž¯-v?é¹¢i·ϊ°¹•‰uÏa.Š\ž¾øÍ&Ô ÷’x‚8¼Ô™íÛéfÉПÜÌGQ™~ÌON´8»1%Ô¦Éó[Ëš4jH!:ÍêBûqx@wùaí•k|ýd@¡OE~ù }*¹KîÔ"ˆˆÔ˜§»Ç@×õ‹‡aA¨…éîc[âÂBÑÁ#·¡²Ìôª`ªÏg6mŒŠ™ó°˜œdx¥Û0ÄÅÀÂdÚ¾ ðìöV¢¡éPLâÚIæJRË8¡YÒ.9 ÀŒ—c"ðpóx„{ÕàÞ’”iíƒ0Uªe µ|¡û2ʮԌ)щC yì;”ÑWù!Uû3c‡9Qî}S×oHµ-xtûÑXh> K3pX+Hpd³‚ß­Ê@RãJn\§Ð‘Ûf$˜dú}W4”"1¿ªÏ*|Oÿ$I/™Álê¿ÑÙö•d³à¹GØï\ld1zxÒ¶âò}ÝTùjë‡-'úŽ}×ØKfÑÐöûÒ’(ë<Â{ÄïpX‘g!Ln(¾ý-Ç£ävm®š +ÄGÌKôp3%ʉSV€ºKv×ÖÂõ柶W ¦-òvE±Ý+J{Õ?(CÄÍ'3Ÿ`–¨“jã‘ F8+™p0TYÑY€/ä·ºRn„ë…ΧH1~½!®MLw ‹zÈê.ÉÎ4=îg?™ÿp [ºñ¡+@l¡‡#$¹‰©¡Ñ´ûÁÃÿÝAâósͱÃÁè׫á–Ñâ! c­ŸÛõBý> +îR +•mØˤ¨H[ì»]Xc+98öÃŒaaÕ^ÑRv%‹÷{Kù6Ñ“à'òûj„ØÐØ×A'~d¹¾’ŸÕ\Yùßc)1ã5ñ ‹®·>Q1>³¬íQ¹ù}^ór`Ö|­4vd£¨¥]R@œº:}ŒÑeøóÁûÊÎ^Ï É/ pZ&‰¼R@'ŠÓS kjÿ`týðªÀ–"Týn#ËI&†¢ÉÞ<:¢9I‰Kë~\1¦F+7þS‰DT±Šv¡[aezûÅbÉÊÃ+`sÅ©:¥¾¥ˆô;rî#¦¢ûMu2“ Ȭø‡À¼?îªd=5n<ú/ÕÁæ^†(ÖŒXhëõ–2ŸpÌ‚' +¼ áÜU™X3 #²¤=@ôØÏÂÜø‘6 ŽÝ„îëÑϬ¡–M'Ñ[®Ý&ÄêþáÚï,hz/,ñ•dpˆù™×N‡¹q}ÝÁË?Ç´ #wYÜÈÍÎ\.º*ï˨¦…™}+ïvcïå½ñ.¯ªÒîÄ/~T ð÷ìlŠžSƒžÂ›Xº¯¬2hNOé‹eÈjCOöWˆ¸€T}O·0<§&¼Åžui%Y~:¼£n|a&»ý‚ˆ!úõNc™^]òÏe(i!RÓw)œƒÐœ3ìõÒ"øl£ýNv©ê&U ³¤~£¼/úB½] ®,Mâκ–êv{¥Ù ˆmìWªpÏ•ˆF/IY¸fÝÕ-J“¾&1”/òè‘Íem[Ñ6W>ÑéÇzSLC‚ΕúÍ+}l”¹aéú ¡yðõ¥T¡¡êB ÒT¼]PU!tô~±Œ9Çà!ŒXaVŽŸlÂÖ°Õmê‘Ø,3«ìc“ylÞ5¨Ñ[tC•™¬ôhêue±%àoÞI.•.xK+òÑ`Dç4†JÒ´â*õ¬V5V­¤`æ=„ Ò`*ùðCì¹åo•Œ_4ÒùÚ8ÇI®°®tø«_V0δ…`ÑJG$ˆÍV©o~ÚQ®5Ê/ª‹»Œ&ßWû@47šçÈÿƒ£Ñ~25Í­Ìs½oQ mr¦Ìµ±ð2?®u…Qó¢‰^^À¬œb´R:d~Šº¶°“~=ݼv¾LmuS)BÚš{€³Rßy)³æÃk+Õ5|øÜÄ?zRb¨2£x M;KK/_Å)©ÅyKª‚ÈÃÈ*‚,½éË™ƒë{dͤ>tÍêåµï–´–kh' 07i¾ÞrN5Þϥ؞Ó)0ªl^Ë| F(ê:¿„\x…Fx’\])™{@ÍÅYMj–´zTxg®½†ò ±Ïз ©¦±m–ݘ÷îC¾…ÙŠÜè/ò)zþ²~j_~H3“oÙåcU'ˆdv+ÈãŒ%hu´UgðÔª >ôT\ãgrz)•IH]_…‹¥K›4? Ñ1UàPÖ¶D3%üìá‹àúÙˆ&ðÛÜ»»çØb$ܶC¶ÉŽW¹1L²ß)Ù&i±ˆ÷0“ÒÌ+íéúC¶Ÿ?»!Üq#¾,¢cvÒ³QíVϯơ6)uZvd˜Úïc3 +‰q +”Éd–¼ÚúºÓÎøöÝÙFBªcË5v|¶ƒš}l‡ ßjJ5Á~§J‚þ¸6«Q­f!0'EÜð'+IÈuÇ ƒêøÇÞÈë"øà}ÿôôLŸŒtp + }Mß„gÀ²žyèì·ÄõËëôQ¨cï»Loe壣Ðbt<&!¿4—‘ܽ ™ƒŒ1i=ß5:ÓÒ[R™ò¬ÅÑXmIéݶ/ÁÍøíºñºxâå¤a ‘GãÅP@² ~b ¡j“ÔUýÌWû”u–HØ ÒŸAñ#Y‹²– hÊÞ^¥wßhʯ<¯“Ëî ¨£åà1“ +rÙ¼ž† ŒÌ¡nJ²ƒvØäȆ:S1Ý(-KŸˆ#‹vÒSÆt¨‹f¼ôá-¡ +}3ÐÝ<íú;b?£ùŽ=ý)¨ß!›aJSA +b½ˆ ¹%ÈÀWq¾ìl ôA"æ±—È>åDkâ[¯HÙ÷ôòÄ_D6ŸQpL_¤ºp³B#?nKÀ¡L%ŸÜ| nÿ\•þ4×gBÂQŽMŠ™=n³'úu,̈ùšÖnêÕNLŠØ).­C+Ü1 BŠÅ E‡†¸Íe8½O&ù“sI‘ÜoÂð^´×Rn3eÂeŒ½ŽÕ8¾??:i5ÎøèÙÍãc¬a'Zoï×QU«Ë‘ËŠi"îŠr¤RàGèQòÏ{0§ÒøÉšS@î ÔO§*ÙáPPcÚ˜8êÑÏ(?Ô]«3 ¾·~¨Ÿw%lgHn +Cvf¾úîë› ðáË·J0ö‘3®ñÚ.(‚7/Rù…©“44Š¤"öˆ¢¢Mam£ã'B|ÿ¢‡cjå$ ñ<šËÿàˆm·†›s¡’´ì%ì¼Æ)WØ2úíH»ëÙß—|•ÞãGâª4¾Ég^a)£/T£æîoA•‰äPCÁˆW£sæÛ]±’™¶^'Ôýö¨Í¢ý‡=R[œÙ›ãÌ.-ó‹0K?Á¬„.ÿ‰â®ŒÖ˜7pEÆ¿ßCùýêo«ÐÎ=6’(cŽrîÿ÷>,UËòÓ@ñçNé(ÚDöeNmnœîelrÞëV& ‰¥>)>e°6a»./ø»n åCŒÑc89m©ÉÖÑï¯ð]81§Q\˜²Ô~ö0Ô2qC^&en¯}Z®Fé­—.Ú—U(KŽ$gEý0/¬V˜Å~„v;ð׳äòÛ8_h~7¥e-AfrŠî‰cÀÌ-ÝI±ê±¡zøö`#§=-i fÛÕ£iCå¹ >C­½%FcÜ—¯è_žÄDŸ=C¬´ üÅvÒvN)¿"é“®Pxq+¾>!¢ T i–%hf6ô‰ð¥*Øáð´å棙j;q„|ãØEž9å(ŵoö»´…äÀ«ÀbJpí/·9@ŒÐ„×ô¶ðãåDlßVaB=Ýy” +…Ìé~·Xù/»ufÙ}ð#ÀkÉ*â‡?¦Aà­ÍÏùƒDÙ¯¢Ç‰Í€róÍ";2“j2±d @Ñü÷nS‰–ff/§béŒ +Yr%9Åy[sÊCb¾p“”¦zµ5+ãmdª”T”¢£ÝIèï7Úc…ß…3zídt‡¯€a…TÒE„*/f®1î{¢p8âú‘â&E™\¦X=yñ¥Ô¦_!R«– Êf•ñ/”£F(°ÛæÐýR‰”Ó‰'V™u#OóèwL®M «ÖNºñ°h5º9_Ö^%¢Ç"kYK ²´gs~é7^%ŠãØl‘›s.#Í # ×j-¤.¹§)àì`ëÛ!nйÐе4‰Òi;@±qäc\`º?M€œY§¶o’µ_·@[øü‚Áð–sBbÖãÙž±Ve,ÿÿþ_‚ÿ+[ œ@6†VHÿ´0¾Œendstream endobj 937 0 obj << /Type /Font @@ -9036,14 +9032,14 @@ endobj /FirstChar 11 /LastChar 122 /Widths 2085 0 R -/BaseFont /BLCWEH+CMSSBX10 +/BaseFont /UJXDLX+CMSSBX10 /FontDescriptor 935 0 R >> endobj 935 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 -/FontName /BLCWEH+CMSSBX10 +/FontName /UJXDLX+CMSSBX10 /ItalicAngle 0 /StemV 136 /XHeight 458 @@ -10878,7 +10874,7 @@ endobj /Count -3 >> endobj 2092 0 obj << -/Names [(CodingSuggestions) 983 0 R (Doc-Start) 934 0 R (Item.1) 1297 0 R (Item.10) 1324 0 R (Item.100) 1583 0 R (Item.101) 1584 0 R (Item.102) 1585 0 R (Item.103) 1586 0 R (Item.104) 1587 0 R (Item.105) 1592 0 R (Item.106) 1593 0 R (Item.107) 1598 0 R (Item.108) 1599 0 R (Item.109) 1600 0 R (Item.11) 1325 0 R (Item.110) 1853 0 R (Item.111) 1854 0 R (Item.112) 1855 0 R (Item.113) 1856 0 R (Item.114) 1861 0 R (Item.115) 1862 0 R (Item.116) 1863 0 R (Item.117) 1864 0 R (Item.118) 2014 0 R (Item.119) 2015 0 R (Item.12) 1326 0 R (Item.120) 2016 0 R (Item.121) 2017 0 R (Item.122) 2018 0 R (Item.123) 2027 0 R (Item.124) 2028 0 R (Item.125) 2029 0 R (Item.126) 2030 0 R (Item.127) 2032 0 R (Item.128) 2042 0 R (Item.129) 2047 0 R (Item.13) 1331 0 R (Item.14) 1343 0 R (Item.15) 1344 0 R (Item.16) 1345 0 R (Item.17) 1361 0 R (Item.18) 1362 0 R (Item.19) 1363 0 R (Item.2) 1298 0 R (Item.20) 1368 0 R (Item.21) 1369 0 R (Item.22) 1370 0 R (Item.23) 1371 0 R (Item.24) 1372 0 R (Item.25) 1373 0 R (Item.26) 1374 0 R (Item.27) 1375 0 R (Item.28) 1376 0 R (Item.29) 1377 0 R (Item.3) 1299 0 R (Item.30) 1378 0 R (Item.31) 1379 0 R (Item.32) 1380 0 R (Item.33) 1381 0 R (Item.34) 1382 0 R (Item.35) 1383 0 R (Item.36) 1384 0 R (Item.37) 1385 0 R (Item.38) 1386 0 R (Item.39) 1391 0 R (Item.4) 1302 0 R (Item.40) 1392 0 R (Item.41) 1393 0 R (Item.42) 1400 0 R (Item.43) 1401 0 R (Item.44) 1402 0 R (Item.45) 1403 0 R (Item.46) 1404 0 R (Item.47) 1405 0 R (Item.48) 1406 0 R (Item.49) 1411 0 R (Item.5) 1307 0 R (Item.50) 1412 0 R (Item.51) 1413 0 R (Item.52) 1414 0 R (Item.53) 1442 0 R (Item.54) 1443 0 R (Item.55) 1444 0 R (Item.56) 1445 0 R (Item.57) 1446 0 R (Item.58) 1447 0 R (Item.59) 1452 0 R (Item.6) 1308 0 R (Item.60) 1453 0 R (Item.61) 1454 0 R (Item.62) 1455 0 R (Item.63) 1456 0 R (Item.64) 1457 0 R (Item.65) 1458 0 R (Item.66) 1459 0 R (Item.67) 1461 0 R (Item.68) 1462 0 R (Item.69) 1463 0 R (Item.7) 1309 0 R (Item.70) 1469 0 R (Item.71) 1470 0 R (Item.72) 1471 0 R (Item.73) 1472 0 R (Item.74) 1473 0 R (Item.75) 1474 0 R (Item.76) 1475 0 R (Item.77) 1476 0 R (Item.78) 1477 0 R (Item.79) 1478 0 R (Item.8) 1310 0 R (Item.80) 1484 0 R (Item.81) 1485 0 R (Item.82) 1486 0 R (Item.83) 1487 0 R (Item.84) 1488 0 R (Item.85) 1489 0 R (Item.86) 1490 0 R (Item.87) 1492 0 R (Item.88) 1493 0 R (Item.89) 1494 0 R (Item.9) 1311 0 R (Item.90) 1495 0 R (Item.91) 1507 0 R (Item.92) 1508 0 R (Item.93) 1509 0 R (Item.94) 1510 0 R (Item.95) 1562 0 R (Item.96) 1563 0 R (Item.97) 1564 0 R (Item.98) 1565 0 R (Item.99) 1566 0 R (Packaging) 1023 0 R (SMBPASSWDFILEFORMAT) 1933 0 R (architecture) 981 0 R (chapter*.1) 963 0 R (chapter*.2) 1029 0 R (chapter.1) 6 0 R (chapter.10) 258 0 R (chapter.11) 726 0 R (chapter.12) 750 0 R (chapter.13) 758 0 R (chapter.14) 810 0 R (chapter.15) 826 0 R (chapter.16) 854 0 R (chapter.17) 866 0 R (chapter.18) 914 0 R (chapter.19) 926 0 R (chapter.2) 22 0 R (chapter.3) 46 0 R (chapter.4) 82 0 R (chapter.5) 86 0 R (chapter.6) 178 0 R (chapter.7) 206 0 R (chapter.8) 246 0 R (chapter.9) 250 0 R (contributing) 1024 0 R (debug) 982 0 R (id2722648) 1285 0 R (id2722732) 1290 0 R (id2722763) 1291 0 R (id2722878) 1296 0 R (id2722932) 1300 0 R (id2722970) 1301 0 R (id2723044) 1312 0 R (id2723106) 1313 0 R (id2723191) 1323 0 R (id2725185) 1332 0 R (id2725315) 1337 0 R (id2725362) 1342 0 R (id2725474) 1350 0 R (id2725480) 1351 0 R (id2725500) 1352 0 R (id2725523) 1353 0 R (id2725986) 1398 0 R (id2726011) 1399 0 R (id2726171) 1415 0 R (id2726185) 1416 0 R (id2726199) 1417 0 R (id2726212) 1418 0 R (id2726225) 1423 0 R (id2726244) 1424 0 R (id2726258) 1425 0 R (id2726273) 1426 0 R (id2726287) 1427 0 R (id2726302) 1428 0 R (id2726316) 1429 0 R (id2726330) 1430 0 R (id2791658) 1431 0 R (id2791671) 1437 0 R (id2791685) 1438 0 R (id2791702) 1439 0 R (id2791718) 1440 0 R (id2791755) 1441 0 R (id2791906) 1460 0 R (id2792005) 1468 0 R (id2792126) 1483 0 R (id2792216) 1491 0 R (id2792273) 1500 0 R (id2792338) 1501 0 R (id2792434) 1506 0 R (id2792506) 1516 0 R (id2792555) 1521 0 R (id2792580) 1522 0 R (id2792665) 1527 0 R (id2792716) 1528 0 R (id2792777) 1529 0 R (id2792846) 1534 0 R (id2792888) 1535 0 R (id2792916) 1536 0 R (id2792961) 1541 0 R (id2793387) 1561 0 R (id2793528) 1571 0 R (id2793730) 1588 0 R (id2793766) 1589 0 R (id2793803) 1590 0 R (id2793811) 1591 0 R (id2793894) 1601 0 R (id2793901) 1602 0 R (id2793976) 1603 0 R (id2794107) 1608 0 R (id2794114) 1609 0 R (id2794126) 1610 0 R (id2794137) 1611 0 R (id2794150) 1612 0 R (id2794162) 1613 0 R (id2794256) 1614 0 R (id2794269) 1620 0 R (id2794326) 1621 0 R (id2794368) 1622 0 R (id2794395) 1623 0 R (id2794438) 1624 0 R (id2794523) 1625 0 R (id2794617) 1630 0 R (id2794644) 1631 0 R (id2794730) 1632 0 R (id2794800) 1633 0 R (id2794900) 1638 0 R (id2794977) 1639 0 R (id2795018) 1640 0 R (id2795100) 1641 0 R (id2795153) 1646 0 R (id2795323) 1647 0 R (id2795428) 1652 0 R (id2795465) 1653 0 R (id2795609) 1654 0 R (id2795721) 1659 0 R (id2796285) 1665 0 R (id2796380) 1666 0 R (id2796422) 1671 0 R (id2796591) 1672 0 R (id2797058) 1677 0 R (id2797071) 1682 0 R (id2797176) 1683 0 R (id2797365) 1688 0 R (id2797500) 1689 0 R (id2797527) 1694 0 R (id2797565) 1695 0 R (id2797708) 1696 0 R (id2797748) 1697 0 R (id2797898) 1703 0 R (id2797970) 1704 0 R (id2798050) 1705 0 R (id2798096) 1710 0 R (id2798284) 1711 0 R (id2798451) 1716 0 R (id2798465) 1717 0 R (id2798535) 1718 0 R (id2798577) 1723 0 R (id2798591) 1724 0 R (id2798630) 1725 0 R (id2798685) 1726 0 R (id2798693) 1727 0 R (id2798705) 1728 0 R (id2798776) 1733 0 R (id2798783) 1734 0 R (id2798796) 1735 0 R (id2798888) 1736 0 R (id2798895) 1737 0 R (id2798921) 1738 0 R (id2798953) 1739 0 R (id2798966) 1740 0 R (id2799065) 1745 0 R (id2799163) 1746 0 R (id2799177) 1747 0 R (id2799290) 1753 0 R (id2799388) 1754 0 R (id2799551) 1755 0 R (id2799583) 1760 0 R (id2799653) 1761 0 R (id2799686) 1762 0 R (id2799716) 1763 0 R (id2799785) 1768 0 R (id2799833) 1769 0 R (id2799872) 1770 0 R (id2799914) 1771 0 R (id2799948) 1772 0 R (id2799962) 1773 0 R (id2799990) 1778 0 R (id2800051) 1779 0 R (id2800066) 1780 0 R (id2800094) 1781 0 R (id2800144) 1786 0 R (id2800156) 1787 0 R (id2800176) 1788 0 R (id2800302) 1789 0 R (id2800423) 1794 0 R (id2800451) 1795 0 R (id2800634) 1796 0 R (id2800748) 1802 0 R (id2800794) 1803 0 R (id2800814) 1804 0 R (id2800940) 1805 0 R (id2801013) 1810 0 R (id2801026) 1811 0 R (id2801068) 1812 0 R (id2801129) 1813 0 R (id2801137) 1814 0 R (id2801299) 1819 0 R (id2801398) 1824 0 R (id2801445) 1825 0 R (id2801485) 1826 0 R (id2801492) 1827 0 R (id2801619) 1832 0 R (id2801800) 1833 0 R (id2801815) 1834 0 R (id2801863) 1839 0 R (id2801922) 1840 0 R (id2802085) 1846 0 R (id2802101) 1847 0 R (id2802197) 1848 0 R (id2802419) 1865 0 R (id2802432) 1866 0 R (id2802814) 1884 0 R (id2802970) 1893 0 R (id2803100) 1898 0 R (id2803127) 1899 0 R (id2803196) 1904 0 R (id2803203) 1905 0 R (id2803219) 1906 0 R (id2803247) 1907 0 R (id2803269) 1908 0 R (id2803276) 1909 0 R (id2803294) 1914 0 R (id2803323) 1915 0 R (id2803423) 1921 0 R (id2803560) 1926 0 R (id2803580) 1927 0 R (id2803709) 1932 0 R (id2804076) 1942 0 R (id2804124) 1943 0 R (id2804158) 1944 0 R (id2804199) 1949 0 R (id2804227) 1950 0 R (id2804291) 1951 0 R (id2804486) 1971 0 R (id2804504) 1972 0 R (id2804713) 1977 0 R (id2804721) 1978 0 R (id2804836) 1987 0 R (id2804907) 1992 0 R (id2804915) 1993 0 R (id2805108) 1999 0 R (id2805352) 2012 0 R (id2805360) 2013 0 R (id2805888) 2048 0 R (id2805896) 2049 0 R (id2805919) 2050 0 R (id2805989) 2059 0 R (id2806022) 2060 0 R (internals) 984 0 R (modules) 1020 0 R (netbios) 980 0 R (ntdomain) 1015 0 R (page.1) 933 0 R (page.10) 1284 0 R (page.100) 2007 0 R (page.101) 2011 0 R (page.102) 2022 0 R (page.103) 2026 0 R (page.104) 2037 0 R (page.105) 2041 0 R (page.106) 2046 0 R (page.107) 2054 0 R (page.108) 2058 0 R (page.109) 2064 0 R (page.11) 1289 0 R (page.12) 1295 0 R (page.13) 1306 0 R (page.14) 1318 0 R (page.15) 1322 0 R (page.16) 1330 0 R (page.17) 1336 0 R (page.18) 1341 0 R (page.19) 1349 0 R (page.2) 945 0 R (page.20) 1358 0 R (page.21) 1367 0 R (page.22) 1390 0 R (page.23) 1397 0 R (page.24) 1410 0 R (page.25) 1422 0 R (page.26) 1436 0 R (page.27) 1451 0 R (page.28) 1467 0 R (page.29) 1482 0 R (page.3) 962 0 R (page.30) 1499 0 R (page.31) 1505 0 R (page.32) 1515 0 R (page.33) 1520 0 R (page.34) 1526 0 R (page.35) 1533 0 R (page.36) 1540 0 R (page.37) 1545 0 R (page.38) 1556 0 R (page.39) 1560 0 R (page.4) 992 0 R (page.40) 1570 0 R (page.41) 1582 0 R (page.42) 1597 0 R (page.43) 1607 0 R (page.44) 1619 0 R (page.45) 1629 0 R (page.46) 1637 0 R (page.47) 1645 0 R (page.48) 1651 0 R (page.49) 1658 0 R (page.5) 1028 0 R (page.50) 1664 0 R (page.51) 1670 0 R (page.52) 1676 0 R (page.53) 1681 0 R (page.54) 1687 0 R (page.55) 1693 0 R (page.56) 1702 0 R (page.57) 1709 0 R (page.58) 1715 0 R (page.59) 1722 0 R (page.6) 1072 0 R (page.60) 1732 0 R (page.61) 1744 0 R (page.62) 1752 0 R (page.63) 1759 0 R (page.64) 1767 0 R (page.65) 1777 0 R (page.66) 1785 0 R (page.67) 1793 0 R (page.68) 1801 0 R (page.69) 1809 0 R (page.7) 1127 0 R (page.70) 1818 0 R (page.71) 1823 0 R (page.72) 1831 0 R (page.73) 1838 0 R (page.74) 1845 0 R (page.75) 1852 0 R (page.76) 1860 0 R (page.77) 1870 0 R (page.78) 1874 0 R (page.79) 1878 0 R (page.8) 1184 0 R (page.80) 1883 0 R (page.81) 1888 0 R (page.82) 1892 0 R (page.83) 1897 0 R (page.84) 1903 0 R (page.85) 1913 0 R (page.86) 1920 0 R (page.87) 1925 0 R (page.88) 1931 0 R (page.89) 1937 0 R (page.9) 1237 0 R (page.90) 1941 0 R (page.91) 1948 0 R (page.92) 1957 0 R (page.93) 1970 0 R (page.94) 1976 0 R (page.95) 1982 0 R (page.96) 1986 0 R (page.97) 1991 0 R (page.98) 1998 0 R (page.99) 2003 0 R (parsing) 985 0 R (printing) 1016 0 R (pwencrypt) 1019 0 R (rpc-plugin) 1021 0 R (sam) 1018 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.10.1) 262 0 R (section.10.2) 274 0 R (section.10.3) 418 0 R (section.10.4) 558 0 R (section.10.5) 622 0 R (section.10.6) 650 0 R (section.10.7) 678 0 R (section.10.8) 694 0 R (section.11.1) 730 0 R (section.11.2) 734 0 R (section.11.3) 738 0 R (section.11.4) 742 0 R (section.11.5) 746 0 R (section.12.1) 754 0 R (section.13.1) 762 0 R (section.13.2) 766 0 R (section.13.3) 770 0 R (section.13.4) 774 0 R (section.13.5) 790 0 R (section.13.6) 802 0 R (section.13.7) 806 0 R (section.14.1) 814 0 R (section.14.2) 818 0 R (section.14.3) 822 0 R (section.15.1) 830 0 R (section.15.2) 834 0 R (section.15.3) 846 0 R (section.16.1) 858 0 R (section.16.2) 862 0 R (section.17.1) 870 0 R (section.17.2) 882 0 R (section.17.3) 894 0 R (section.17.4) 902 0 R (section.18.1) 918 0 R (section.18.2) 922 0 R (section.2.1) 26 0 R (section.2.2) 30 0 R (section.2.3) 34 0 R (section.2.4) 38 0 R (section.2.5) 42 0 R (section.3.1) 50 0 R (section.3.2) 54 0 R (section.3.3) 58 0 R (section.3.4) 62 0 R (section.3.5) 66 0 R (section.5.1) 90 0 R (section.5.2) 94 0 R (section.5.3) 98 0 R (section.5.4) 162 0 R (section.5.5) 174 0 R (section.6.1) 182 0 R (section.6.2) 198 0 R (section.7.1) 210 0 R (section.7.2) 214 0 R (section.7.3) 218 0 R (section.7.4) 222 0 R (section.7.5) 226 0 R (section.7.6) 230 0 R (section.7.7) 234 0 R (section.7.8) 238 0 R (section.7.9) 242 0 R (section.9.1) 254 0 R (subsection.10.1.1) 266 0 R (subsection.10.1.2) 270 0 R (subsection.10.2.1) 278 0 R (subsection.10.2.2) 282 0 R (subsection.10.2.3) 294 0 R (subsection.10.3.1) 422 0 R (subsection.10.3.10) 522 0 R (subsection.10.3.11) 534 0 R (subsection.10.3.12) 546 0 R (subsection.10.3.2) 426 0 R (subsection.10.3.3) 462 0 R (subsection.10.3.4) 466 0 R (subsection.10.3.5) 470 0 R (subsection.10.3.6) 474 0 R (subsection.10.3.7) 486 0 R (subsection.10.3.8) 498 0 R (subsection.10.3.9) 510 0 R (subsection.10.4.1) 562 0 R (subsection.10.4.2) 574 0 R (subsection.10.4.3) 586 0 R (subsection.10.4.4) 598 0 R (subsection.10.4.5) 610 0 R (subsection.10.5.1) 626 0 R (subsection.10.5.2) 638 0 R (subsection.10.6.1) 654 0 R (subsection.10.6.2) 666 0 R (subsection.10.7.1) 682 0 R (subsection.10.7.2) 686 0 R (subsection.10.7.3) 690 0 R (subsection.10.8.1) 698 0 R (subsection.10.8.2) 710 0 R (subsection.13.4.1) 778 0 R (subsection.13.4.2) 782 0 R (subsection.13.4.3) 786 0 R (subsection.13.5.1) 794 0 R (subsection.13.5.2) 798 0 R (subsection.15.2.1) 838 0 R (subsection.15.2.2) 842 0 R (subsection.15.3.1) 850 0 R (subsection.17.1.1) 874 0 R (subsection.17.1.2) 878 0 R (subsection.17.2.1) 886 0 R (subsection.17.2.2) 890 0 R (subsection.17.3.1) 898 0 R (subsection.17.4.1) 906 0 R (subsection.17.4.2) 910 0 R (subsection.3.5.1) 70 0 R (subsection.3.5.2) 74 0 R (subsection.3.5.3) 78 0 R (subsection.5.3.1) 102 0 R (subsection.5.3.10) 138 0 R (subsection.5.3.11) 142 0 R (subsection.5.3.12) 146 0 R (subsection.5.3.13) 150 0 R (subsection.5.3.14) 154 0 R (subsection.5.3.15) 158 0 R (subsection.5.3.2) 106 0 R (subsection.5.3.3) 110 0 R (subsection.5.3.4) 114 0 R (subsection.5.3.5) 118 0 R (subsection.5.3.6) 122 0 R (subsection.5.3.7) 126 0 R (subsection.5.3.8) 130 0 R (subsection.5.3.9) 134 0 R (subsection.5.4.1) 166 0 R (subsection.5.4.2) 170 0 R (subsection.6.1.1) 186 0 R (subsection.6.1.2) 190 0 R (subsection.6.1.3) 194 0 R (subsection.6.2.1) 202 0 R (subsubsection.10.2.2.1) 286 0 R (subsubsection.10.2.2.2) 290 0 R (subsubsection.10.2.3.1) 298 0 R (subsubsection.10.2.3.10) 334 0 R (subsubsection.10.2.3.11) 338 0 R (subsubsection.10.2.3.12) 342 0 R (subsubsection.10.2.3.13) 346 0 R (subsubsection.10.2.3.14) 350 0 R (subsubsection.10.2.3.15) 354 0 R (subsubsection.10.2.3.16) 358 0 R (subsubsection.10.2.3.17) 362 0 R (subsubsection.10.2.3.18) 366 0 R (subsubsection.10.2.3.19) 370 0 R (subsubsection.10.2.3.2) 302 0 R (subsubsection.10.2.3.20) 374 0 R (subsubsection.10.2.3.21) 378 0 R (subsubsection.10.2.3.22) 382 0 R (subsubsection.10.2.3.23) 386 0 R (subsubsection.10.2.3.24) 390 0 R (subsubsection.10.2.3.25) 394 0 R (subsubsection.10.2.3.26) 398 0 R (subsubsection.10.2.3.27) 402 0 R (subsubsection.10.2.3.28) 406 0 R (subsubsection.10.2.3.29) 410 0 R (subsubsection.10.2.3.3) 306 0 R (subsubsection.10.2.3.30) 414 0 R (subsubsection.10.2.3.4) 310 0 R (subsubsection.10.2.3.5) 314 0 R (subsubsection.10.2.3.6) 318 0 R (subsubsection.10.2.3.7) 322 0 R (subsubsection.10.2.3.8) 326 0 R (subsubsection.10.2.3.9) 330 0 R (subsubsection.10.3.10.1) 526 0 R (subsubsection.10.3.10.2) 530 0 R (subsubsection.10.3.11.1) 538 0 R (subsubsection.10.3.11.2) 542 0 R (subsubsection.10.3.12.1) 550 0 R (subsubsection.10.3.12.2) 554 0 R (subsubsection.10.3.2.1) 430 0 R (subsubsection.10.3.2.2) 434 0 R (subsubsection.10.3.2.3) 438 0 R (subsubsection.10.3.2.4) 442 0 R (subsubsection.10.3.2.5) 446 0 R (subsubsection.10.3.2.6) 450 0 R (subsubsection.10.3.2.7) 454 0 R (subsubsection.10.3.2.8) 458 0 R (subsubsection.10.3.6.1) 478 0 R (subsubsection.10.3.6.2) 482 0 R (subsubsection.10.3.7.1) 490 0 R (subsubsection.10.3.7.2) 494 0 R (subsubsection.10.3.8.1) 502 0 R (subsubsection.10.3.8.2) 506 0 R (subsubsection.10.3.9.1) 514 0 R (subsubsection.10.3.9.2) 518 0 R (subsubsection.10.4.1.1) 566 0 R (subsubsection.10.4.1.2) 570 0 R (subsubsection.10.4.2.1) 578 0 R (subsubsection.10.4.2.2) 582 0 R (subsubsection.10.4.3.1) 590 0 R (subsubsection.10.4.3.2) 594 0 R (subsubsection.10.4.4.1) 602 0 R (subsubsection.10.4.4.2) 606 0 R (subsubsection.10.4.5.1) 614 0 R (subsubsection.10.4.5.2) 618 0 R (subsubsection.10.5.1.1) 630 0 R (subsubsection.10.5.1.2) 634 0 R (subsubsection.10.5.2.1) 642 0 R (subsubsection.10.5.2.2) 646 0 R (subsubsection.10.6.1.1) 658 0 R (subsubsection.10.6.1.2) 662 0 R (subsubsection.10.6.2.1) 670 0 R (subsubsection.10.6.2.2) 674 0 R (subsubsection.10.8.1.1) 702 0 R (subsubsection.10.8.1.2) 706 0 R (subsubsection.10.8.2.1) 714 0 R (subsubsection.10.8.2.2) 718 0 R (subsubsection.10.8.2.3) 722 0 R (tracing) 987 0 R (unix-smb) 986 0 R (vfs) 1022 0 R (windows-debug) 988 0 R (wins) 1017 0 R] +/Names [(CodingSuggestions) 983 0 R (Doc-Start) 934 0 R (Item.1) 1297 0 R (Item.10) 1324 0 R (Item.100) 1583 0 R (Item.101) 1584 0 R (Item.102) 1585 0 R (Item.103) 1586 0 R (Item.104) 1587 0 R (Item.105) 1592 0 R (Item.106) 1593 0 R (Item.107) 1598 0 R (Item.108) 1599 0 R (Item.109) 1600 0 R (Item.11) 1325 0 R (Item.110) 1853 0 R (Item.111) 1854 0 R (Item.112) 1855 0 R (Item.113) 1856 0 R (Item.114) 1861 0 R (Item.115) 1862 0 R (Item.116) 1863 0 R (Item.117) 1864 0 R (Item.118) 2014 0 R (Item.119) 2015 0 R (Item.12) 1326 0 R (Item.120) 2016 0 R (Item.121) 2017 0 R (Item.122) 2018 0 R (Item.123) 2027 0 R (Item.124) 2028 0 R (Item.125) 2029 0 R (Item.126) 2030 0 R (Item.127) 2032 0 R (Item.128) 2042 0 R (Item.129) 2047 0 R (Item.13) 1331 0 R (Item.14) 1343 0 R (Item.15) 1344 0 R (Item.16) 1345 0 R (Item.17) 1361 0 R (Item.18) 1362 0 R (Item.19) 1363 0 R (Item.2) 1298 0 R (Item.20) 1368 0 R (Item.21) 1369 0 R (Item.22) 1370 0 R (Item.23) 1371 0 R (Item.24) 1372 0 R (Item.25) 1373 0 R (Item.26) 1374 0 R (Item.27) 1375 0 R (Item.28) 1376 0 R (Item.29) 1377 0 R (Item.3) 1299 0 R (Item.30) 1378 0 R (Item.31) 1379 0 R (Item.32) 1380 0 R (Item.33) 1381 0 R (Item.34) 1382 0 R (Item.35) 1383 0 R (Item.36) 1384 0 R (Item.37) 1385 0 R (Item.38) 1386 0 R (Item.39) 1391 0 R (Item.4) 1302 0 R (Item.40) 1392 0 R (Item.41) 1393 0 R (Item.42) 1400 0 R (Item.43) 1401 0 R (Item.44) 1402 0 R (Item.45) 1403 0 R (Item.46) 1404 0 R (Item.47) 1405 0 R (Item.48) 1406 0 R (Item.49) 1411 0 R (Item.5) 1307 0 R (Item.50) 1412 0 R (Item.51) 1413 0 R (Item.52) 1414 0 R (Item.53) 1442 0 R (Item.54) 1443 0 R (Item.55) 1444 0 R (Item.56) 1445 0 R (Item.57) 1446 0 R (Item.58) 1447 0 R (Item.59) 1452 0 R (Item.6) 1308 0 R (Item.60) 1453 0 R (Item.61) 1454 0 R (Item.62) 1455 0 R (Item.63) 1456 0 R (Item.64) 1457 0 R (Item.65) 1458 0 R (Item.66) 1459 0 R (Item.67) 1461 0 R (Item.68) 1462 0 R (Item.69) 1463 0 R (Item.7) 1309 0 R (Item.70) 1469 0 R (Item.71) 1470 0 R (Item.72) 1471 0 R (Item.73) 1472 0 R (Item.74) 1473 0 R (Item.75) 1474 0 R (Item.76) 1475 0 R (Item.77) 1476 0 R (Item.78) 1477 0 R (Item.79) 1478 0 R (Item.8) 1310 0 R (Item.80) 1484 0 R (Item.81) 1485 0 R (Item.82) 1486 0 R (Item.83) 1487 0 R (Item.84) 1488 0 R (Item.85) 1489 0 R (Item.86) 1490 0 R (Item.87) 1492 0 R (Item.88) 1493 0 R (Item.89) 1494 0 R (Item.9) 1311 0 R (Item.90) 1495 0 R (Item.91) 1507 0 R (Item.92) 1508 0 R (Item.93) 1509 0 R (Item.94) 1510 0 R (Item.95) 1562 0 R (Item.96) 1563 0 R (Item.97) 1564 0 R (Item.98) 1565 0 R (Item.99) 1566 0 R (Packaging) 1023 0 R (SMBPASSWDFILEFORMAT) 1933 0 R (architecture) 981 0 R (chapter*.1) 963 0 R (chapter*.2) 1029 0 R (chapter.1) 6 0 R (chapter.10) 258 0 R (chapter.11) 726 0 R (chapter.12) 750 0 R (chapter.13) 758 0 R (chapter.14) 810 0 R (chapter.15) 826 0 R (chapter.16) 854 0 R (chapter.17) 866 0 R (chapter.18) 914 0 R (chapter.19) 926 0 R (chapter.2) 22 0 R (chapter.3) 46 0 R (chapter.4) 82 0 R (chapter.5) 86 0 R (chapter.6) 178 0 R (chapter.7) 206 0 R (chapter.8) 246 0 R (chapter.9) 250 0 R (contributing) 1024 0 R (debug) 982 0 R (id2719795) 1290 0 R (id2719826) 1291 0 R (id2719940) 1296 0 R (id2722095) 1323 0 R (id2722239) 1332 0 R (id2722369) 1337 0 R (id2722414) 1342 0 R (id2722525) 1350 0 R (id2722532) 1351 0 R (id2722552) 1352 0 R (id2722575) 1353 0 R (id2724304) 1398 0 R (id2724329) 1399 0 R (id2724483) 1300 0 R (id2724521) 1301 0 R (id2724596) 1312 0 R (id2724662) 1313 0 R (id2727692) 1285 0 R (id2777725) 1415 0 R (id2777739) 1416 0 R (id2777752) 1417 0 R (id2777766) 1418 0 R (id2777780) 1423 0 R (id2777795) 1424 0 R (id2777810) 1425 0 R (id2777824) 1426 0 R (id2777838) 1427 0 R (id2777853) 1428 0 R (id2777867) 1429 0 R (id2777882) 1430 0 R (id2777896) 1431 0 R (id2777910) 1437 0 R (id2777925) 1438 0 R (id2777937) 1439 0 R (id2777952) 1440 0 R (id2777989) 1441 0 R (id2783322) 1516 0 R (id2783369) 1521 0 R (id2783394) 1522 0 R (id2783464) 1527 0 R (id2783501) 1528 0 R (id2783546) 1529 0 R (id2783608) 1534 0 R (id2783638) 1535 0 R (id2783663) 1536 0 R (id2783718) 1541 0 R (id2783967) 1460 0 R (id2784052) 1468 0 R (id2784171) 1483 0 R (id2784262) 1491 0 R (id2784318) 1500 0 R (id2784383) 1501 0 R (id2784479) 1506 0 R (id2792804) 1753 0 R (id2792901) 1754 0 R (id2793063) 1755 0 R (id2793096) 1760 0 R (id2793165) 1761 0 R (id2793198) 1762 0 R (id2793228) 1763 0 R (id2793297) 1768 0 R (id2793344) 1769 0 R (id2793384) 1770 0 R (id2793425) 1771 0 R (id2793459) 1772 0 R (id2793473) 1773 0 R (id2793501) 1778 0 R (id2793563) 1779 0 R (id2793578) 1780 0 R (id2793604) 1781 0 R (id2793654) 1786 0 R (id2793666) 1787 0 R (id2793686) 1788 0 R (id2793813) 1789 0 R (id2793934) 1794 0 R (id2793962) 1795 0 R (id2794156) 1561 0 R (id2794297) 1571 0 R (id2794498) 1588 0 R (id2794533) 1589 0 R (id2794572) 1590 0 R (id2794578) 1591 0 R (id2794654) 1601 0 R (id2794661) 1602 0 R (id2794736) 1603 0 R (id2794867) 1608 0 R (id2794874) 1609 0 R (id2794886) 1610 0 R (id2794897) 1611 0 R (id2794910) 1612 0 R (id2794922) 1613 0 R (id2795016) 1614 0 R (id2795029) 1620 0 R (id2795086) 1621 0 R (id2795128) 1622 0 R (id2795155) 1623 0 R (id2795198) 1624 0 R (id2795283) 1625 0 R (id2795376) 1630 0 R (id2795404) 1631 0 R (id2795490) 1632 0 R (id2795560) 1633 0 R (id2795659) 1638 0 R (id2795737) 1639 0 R (id2795778) 1640 0 R (id2795860) 1641 0 R (id2795912) 1646 0 R (id2796083) 1647 0 R (id2796187) 1652 0 R (id2796226) 1653 0 R (id2796368) 1654 0 R (id2796481) 1659 0 R (id2797044) 1665 0 R (id2797139) 1666 0 R (id2797181) 1671 0 R (id2797350) 1672 0 R (id2797816) 1677 0 R (id2797829) 1682 0 R (id2797932) 1683 0 R (id2798120) 1688 0 R (id2798254) 1689 0 R (id2798281) 1694 0 R (id2798320) 1695 0 R (id2798460) 1696 0 R (id2798500) 1697 0 R (id2798650) 1703 0 R (id2798722) 1704 0 R (id2798802) 1705 0 R (id2798848) 1710 0 R (id2799028) 1711 0 R (id2799192) 1716 0 R (id2799206) 1717 0 R (id2799276) 1718 0 R (id2799318) 1723 0 R (id2799332) 1724 0 R (id2799371) 1725 0 R (id2799426) 1726 0 R (id2799433) 1727 0 R (id2799445) 1728 0 R (id2799517) 1733 0 R (id2799524) 1734 0 R (id2799536) 1735 0 R (id2799626) 1736 0 R (id2799633) 1737 0 R (id2799660) 1738 0 R (id2799691) 1739 0 R (id2799705) 1740 0 R (id2799804) 1745 0 R (id2799901) 1746 0 R (id2799914) 1747 0 R (id2802600) 1796 0 R (id2802714) 1802 0 R (id2802760) 1803 0 R (id2802780) 1804 0 R (id2802906) 1805 0 R (id2802979) 1810 0 R (id2802992) 1811 0 R (id2803034) 1812 0 R (id2803095) 1813 0 R (id2803103) 1814 0 R (id2803265) 1819 0 R (id2803364) 1824 0 R (id2803413) 1825 0 R (id2803452) 1826 0 R (id2803458) 1827 0 R (id2803585) 1832 0 R (id2803766) 1833 0 R (id2803780) 1834 0 R (id2803828) 1839 0 R (id2803888) 1840 0 R (id2804051) 1846 0 R (id2804067) 1847 0 R (id2804163) 1848 0 R (id2804378) 1865 0 R (id2804392) 1866 0 R (id2804752) 1884 0 R (id2804881) 1893 0 R (id2805011) 1898 0 R (id2805038) 1899 0 R (id2805107) 1904 0 R (id2805115) 1905 0 R (id2805130) 1906 0 R (id2805158) 1907 0 R (id2805180) 1908 0 R (id2805187) 1909 0 R (id2805205) 1914 0 R (id2805234) 1915 0 R (id2805326) 1921 0 R (id2805464) 1926 0 R (id2805488) 1927 0 R (id2805596) 1932 0 R (id2805964) 1942 0 R (id2806010) 1943 0 R (id2806044) 1944 0 R (id2806084) 1949 0 R (id2806112) 1950 0 R (id2806174) 1951 0 R (id2806369) 1971 0 R (id2806388) 1972 0 R (id2806596) 1977 0 R (id2806604) 1978 0 R (id2806719) 1987 0 R (id2806791) 1992 0 R (id2806798) 1993 0 R (id2806981) 1999 0 R (id2807226) 2012 0 R (id2807234) 2013 0 R (id2807724) 2048 0 R (id2807731) 2049 0 R (id2807756) 2050 0 R (id2807824) 2059 0 R (id2807857) 2060 0 R (internals) 984 0 R (modules) 1020 0 R (netbios) 980 0 R (ntdomain) 1015 0 R (page.1) 933 0 R (page.10) 1284 0 R (page.100) 2007 0 R (page.101) 2011 0 R (page.102) 2022 0 R (page.103) 2026 0 R (page.104) 2037 0 R (page.105) 2041 0 R (page.106) 2046 0 R (page.107) 2054 0 R (page.108) 2058 0 R (page.109) 2064 0 R (page.11) 1289 0 R (page.12) 1295 0 R (page.13) 1306 0 R (page.14) 1318 0 R (page.15) 1322 0 R (page.16) 1330 0 R (page.17) 1336 0 R (page.18) 1341 0 R (page.19) 1349 0 R (page.2) 945 0 R (page.20) 1358 0 R (page.21) 1367 0 R (page.22) 1390 0 R (page.23) 1397 0 R (page.24) 1410 0 R (page.25) 1422 0 R (page.26) 1436 0 R (page.27) 1451 0 R (page.28) 1467 0 R (page.29) 1482 0 R (page.3) 962 0 R (page.30) 1499 0 R (page.31) 1505 0 R (page.32) 1515 0 R (page.33) 1520 0 R (page.34) 1526 0 R (page.35) 1533 0 R (page.36) 1540 0 R (page.37) 1545 0 R (page.38) 1556 0 R (page.39) 1560 0 R (page.4) 992 0 R (page.40) 1570 0 R (page.41) 1582 0 R (page.42) 1597 0 R (page.43) 1607 0 R (page.44) 1619 0 R (page.45) 1629 0 R (page.46) 1637 0 R (page.47) 1645 0 R (page.48) 1651 0 R (page.49) 1658 0 R (page.5) 1028 0 R (page.50) 1664 0 R (page.51) 1670 0 R (page.52) 1676 0 R (page.53) 1681 0 R (page.54) 1687 0 R (page.55) 1693 0 R (page.56) 1702 0 R (page.57) 1709 0 R (page.58) 1715 0 R (page.59) 1722 0 R (page.6) 1072 0 R (page.60) 1732 0 R (page.61) 1744 0 R (page.62) 1752 0 R (page.63) 1759 0 R (page.64) 1767 0 R (page.65) 1777 0 R (page.66) 1785 0 R (page.67) 1793 0 R (page.68) 1801 0 R (page.69) 1809 0 R (page.7) 1127 0 R (page.70) 1818 0 R (page.71) 1823 0 R (page.72) 1831 0 R (page.73) 1838 0 R (page.74) 1845 0 R (page.75) 1852 0 R (page.76) 1860 0 R (page.77) 1870 0 R (page.78) 1874 0 R (page.79) 1878 0 R (page.8) 1184 0 R (page.80) 1883 0 R (page.81) 1888 0 R (page.82) 1892 0 R (page.83) 1897 0 R (page.84) 1903 0 R (page.85) 1913 0 R (page.86) 1920 0 R (page.87) 1925 0 R (page.88) 1931 0 R (page.89) 1937 0 R (page.9) 1237 0 R (page.90) 1941 0 R (page.91) 1948 0 R (page.92) 1957 0 R (page.93) 1970 0 R (page.94) 1976 0 R (page.95) 1982 0 R (page.96) 1986 0 R (page.97) 1991 0 R (page.98) 1998 0 R (page.99) 2003 0 R (parsing) 985 0 R (printing) 1016 0 R (pwencrypt) 1019 0 R (rpc-plugin) 1021 0 R (sam) 1018 0 R (section.1.1) 10 0 R (section.1.2) 14 0 R (section.1.3) 18 0 R (section.10.1) 262 0 R (section.10.2) 274 0 R (section.10.3) 418 0 R (section.10.4) 558 0 R (section.10.5) 622 0 R (section.10.6) 650 0 R (section.10.7) 678 0 R (section.10.8) 694 0 R (section.11.1) 730 0 R (section.11.2) 734 0 R (section.11.3) 738 0 R (section.11.4) 742 0 R (section.11.5) 746 0 R (section.12.1) 754 0 R (section.13.1) 762 0 R (section.13.2) 766 0 R (section.13.3) 770 0 R (section.13.4) 774 0 R (section.13.5) 790 0 R (section.13.6) 802 0 R (section.13.7) 806 0 R (section.14.1) 814 0 R (section.14.2) 818 0 R (section.14.3) 822 0 R (section.15.1) 830 0 R (section.15.2) 834 0 R (section.15.3) 846 0 R (section.16.1) 858 0 R (section.16.2) 862 0 R (section.17.1) 870 0 R (section.17.2) 882 0 R (section.17.3) 894 0 R (section.17.4) 902 0 R (section.18.1) 918 0 R (section.18.2) 922 0 R (section.2.1) 26 0 R (section.2.2) 30 0 R (section.2.3) 34 0 R (section.2.4) 38 0 R (section.2.5) 42 0 R (section.3.1) 50 0 R (section.3.2) 54 0 R (section.3.3) 58 0 R (section.3.4) 62 0 R (section.3.5) 66 0 R (section.5.1) 90 0 R (section.5.2) 94 0 R (section.5.3) 98 0 R (section.5.4) 162 0 R (section.5.5) 174 0 R (section.6.1) 182 0 R (section.6.2) 198 0 R (section.7.1) 210 0 R (section.7.2) 214 0 R (section.7.3) 218 0 R (section.7.4) 222 0 R (section.7.5) 226 0 R (section.7.6) 230 0 R (section.7.7) 234 0 R (section.7.8) 238 0 R (section.7.9) 242 0 R (section.9.1) 254 0 R (subsection.10.1.1) 266 0 R (subsection.10.1.2) 270 0 R (subsection.10.2.1) 278 0 R (subsection.10.2.2) 282 0 R (subsection.10.2.3) 294 0 R (subsection.10.3.1) 422 0 R (subsection.10.3.10) 522 0 R (subsection.10.3.11) 534 0 R (subsection.10.3.12) 546 0 R (subsection.10.3.2) 426 0 R (subsection.10.3.3) 462 0 R (subsection.10.3.4) 466 0 R (subsection.10.3.5) 470 0 R (subsection.10.3.6) 474 0 R (subsection.10.3.7) 486 0 R (subsection.10.3.8) 498 0 R (subsection.10.3.9) 510 0 R (subsection.10.4.1) 562 0 R (subsection.10.4.2) 574 0 R (subsection.10.4.3) 586 0 R (subsection.10.4.4) 598 0 R (subsection.10.4.5) 610 0 R (subsection.10.5.1) 626 0 R (subsection.10.5.2) 638 0 R (subsection.10.6.1) 654 0 R (subsection.10.6.2) 666 0 R (subsection.10.7.1) 682 0 R (subsection.10.7.2) 686 0 R (subsection.10.7.3) 690 0 R (subsection.10.8.1) 698 0 R (subsection.10.8.2) 710 0 R (subsection.13.4.1) 778 0 R (subsection.13.4.2) 782 0 R (subsection.13.4.3) 786 0 R (subsection.13.5.1) 794 0 R (subsection.13.5.2) 798 0 R (subsection.15.2.1) 838 0 R (subsection.15.2.2) 842 0 R (subsection.15.3.1) 850 0 R (subsection.17.1.1) 874 0 R (subsection.17.1.2) 878 0 R (subsection.17.2.1) 886 0 R (subsection.17.2.2) 890 0 R (subsection.17.3.1) 898 0 R (subsection.17.4.1) 906 0 R (subsection.17.4.2) 910 0 R (subsection.3.5.1) 70 0 R (subsection.3.5.2) 74 0 R (subsection.3.5.3) 78 0 R (subsection.5.3.1) 102 0 R (subsection.5.3.10) 138 0 R (subsection.5.3.11) 142 0 R (subsection.5.3.12) 146 0 R (subsection.5.3.13) 150 0 R (subsection.5.3.14) 154 0 R (subsection.5.3.15) 158 0 R (subsection.5.3.2) 106 0 R (subsection.5.3.3) 110 0 R (subsection.5.3.4) 114 0 R (subsection.5.3.5) 118 0 R (subsection.5.3.6) 122 0 R (subsection.5.3.7) 126 0 R (subsection.5.3.8) 130 0 R (subsection.5.3.9) 134 0 R (subsection.5.4.1) 166 0 R (subsection.5.4.2) 170 0 R (subsection.6.1.1) 186 0 R (subsection.6.1.2) 190 0 R (subsection.6.1.3) 194 0 R (subsection.6.2.1) 202 0 R (subsubsection.10.2.2.1) 286 0 R (subsubsection.10.2.2.2) 290 0 R (subsubsection.10.2.3.1) 298 0 R (subsubsection.10.2.3.10) 334 0 R (subsubsection.10.2.3.11) 338 0 R (subsubsection.10.2.3.12) 342 0 R (subsubsection.10.2.3.13) 346 0 R (subsubsection.10.2.3.14) 350 0 R (subsubsection.10.2.3.15) 354 0 R (subsubsection.10.2.3.16) 358 0 R (subsubsection.10.2.3.17) 362 0 R (subsubsection.10.2.3.18) 366 0 R (subsubsection.10.2.3.19) 370 0 R (subsubsection.10.2.3.2) 302 0 R (subsubsection.10.2.3.20) 374 0 R (subsubsection.10.2.3.21) 378 0 R (subsubsection.10.2.3.22) 382 0 R (subsubsection.10.2.3.23) 386 0 R (subsubsection.10.2.3.24) 390 0 R (subsubsection.10.2.3.25) 394 0 R (subsubsection.10.2.3.26) 398 0 R (subsubsection.10.2.3.27) 402 0 R (subsubsection.10.2.3.28) 406 0 R (subsubsection.10.2.3.29) 410 0 R (subsubsection.10.2.3.3) 306 0 R (subsubsection.10.2.3.30) 414 0 R (subsubsection.10.2.3.4) 310 0 R (subsubsection.10.2.3.5) 314 0 R (subsubsection.10.2.3.6) 318 0 R (subsubsection.10.2.3.7) 322 0 R (subsubsection.10.2.3.8) 326 0 R (subsubsection.10.2.3.9) 330 0 R (subsubsection.10.3.10.1) 526 0 R (subsubsection.10.3.10.2) 530 0 R (subsubsection.10.3.11.1) 538 0 R (subsubsection.10.3.11.2) 542 0 R (subsubsection.10.3.12.1) 550 0 R (subsubsection.10.3.12.2) 554 0 R (subsubsection.10.3.2.1) 430 0 R (subsubsection.10.3.2.2) 434 0 R (subsubsection.10.3.2.3) 438 0 R (subsubsection.10.3.2.4) 442 0 R (subsubsection.10.3.2.5) 446 0 R (subsubsection.10.3.2.6) 450 0 R (subsubsection.10.3.2.7) 454 0 R (subsubsection.10.3.2.8) 458 0 R (subsubsection.10.3.6.1) 478 0 R (subsubsection.10.3.6.2) 482 0 R (subsubsection.10.3.7.1) 490 0 R (subsubsection.10.3.7.2) 494 0 R (subsubsection.10.3.8.1) 502 0 R (subsubsection.10.3.8.2) 506 0 R (subsubsection.10.3.9.1) 514 0 R (subsubsection.10.3.9.2) 518 0 R (subsubsection.10.4.1.1) 566 0 R (subsubsection.10.4.1.2) 570 0 R (subsubsection.10.4.2.1) 578 0 R (subsubsection.10.4.2.2) 582 0 R (subsubsection.10.4.3.1) 590 0 R (subsubsection.10.4.3.2) 594 0 R (subsubsection.10.4.4.1) 602 0 R (subsubsection.10.4.4.2) 606 0 R (subsubsection.10.4.5.1) 614 0 R (subsubsection.10.4.5.2) 618 0 R (subsubsection.10.5.1.1) 630 0 R (subsubsection.10.5.1.2) 634 0 R (subsubsection.10.5.2.1) 642 0 R (subsubsection.10.5.2.2) 646 0 R (subsubsection.10.6.1.1) 658 0 R (subsubsection.10.6.1.2) 662 0 R (subsubsection.10.6.2.1) 670 0 R (subsubsection.10.6.2.2) 674 0 R (subsubsection.10.8.1.1) 702 0 R (subsubsection.10.8.1.2) 706 0 R (subsubsection.10.8.2.1) 714 0 R (subsubsection.10.8.2.2) 718 0 R (subsubsection.10.8.2.3) 722 0 R (tracing) 987 0 R (unix-smb) 986 0 R (vfs) 1022 0 R (windows-debug) 988 0 R (wins) 1017 0 R] /Limits [(CodingSuggestions) (wins)] >> endobj 2093 0 obj << @@ -10898,7 +10894,7 @@ endobj >> endobj 2096 0 obj << /Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfTeX-1.10b)/Keywords() -/CreationDate (D:20030815195700) +/CreationDate (D:20030923232900) >> endobj xref 0 2097 @@ -10908,2097 +10904,2097 @@ xref 0000000004 00000 f 0000000000 00000 f 0000000009 00000 n -0000093786 00000 n -0000506737 00000 n +0000093796 00000 n +0000506650 00000 n 0000000054 00000 n 0000000130 00000 n -0000093908 00000 n -0000506665 00000 n +0000093918 00000 n +0000506578 00000 n 0000000177 00000 n 0000000207 00000 n -0000097771 00000 n -0000506579 00000 n +0000097781 00000 n +0000506492 00000 n 0000000255 00000 n 0000000295 00000 n -0000097895 00000 n -0000506506 00000 n +0000097905 00000 n +0000506419 00000 n 0000000343 00000 n 0000000378 00000 n -0000100636 00000 n -0000506381 00000 n +0000100646 00000 n +0000506294 00000 n 0000000424 00000 n 0000000463 00000 n -0000100759 00000 n -0000506307 00000 n +0000100769 00000 n +0000506220 00000 n 0000000511 00000 n 0000000546 00000 n -0000101070 00000 n -0000506220 00000 n +0000101080 00000 n +0000506133 00000 n 0000000594 00000 n 0000000641 00000 n -0000101193 00000 n -0000506133 00000 n +0000101203 00000 n +0000506046 00000 n 0000000689 00000 n 0000000726 00000 n -0000105359 00000 n -0000506046 00000 n +0000105369 00000 n +0000505959 00000 n 0000000774 00000 n 0000000811 00000 n -0000105483 00000 n -0000505972 00000 n +0000105493 00000 n +0000505885 00000 n 0000000859 00000 n 0000000893 00000 n -0000109099 00000 n -0000505846 00000 n +0000109109 00000 n +0000505759 00000 n 0000000939 00000 n 0000000982 00000 n -0000109222 00000 n -0000505772 00000 n +0000109232 00000 n +0000505685 00000 n 0000001030 00000 n 0000001070 00000 n -0000111680 00000 n -0000505685 00000 n +0000111690 00000 n +0000505598 00000 n 0000001118 00000 n 0000001160 00000 n -0000113885 00000 n -0000505598 00000 n +0000113895 00000 n +0000505511 00000 n 0000001208 00000 n 0000001253 00000 n -0000115960 00000 n -0000505511 00000 n +0000115970 00000 n +0000505424 00000 n 0000001301 00000 n 0000001346 00000 n -0000118405 00000 n -0000505400 00000 n +0000118415 00000 n +0000505313 00000 n 0000001394 00000 n 0000001430 00000 n -0000118529 00000 n -0000505326 00000 n +0000118539 00000 n +0000505239 00000 n 0000001483 00000 n 0000001519 00000 n -0000118652 00000 n -0000505239 00000 n +0000118662 00000 n +0000505152 00000 n 0000001572 00000 n 0000001607 00000 n -0000118776 00000 n -0000505165 00000 n +0000118786 00000 n +0000505078 00000 n 0000001660 00000 n 0000001712 00000 n -0000122364 00000 n -0000505076 00000 n +0000122374 00000 n +0000504989 00000 n 0000001758 00000 n 0000001797 00000 n -0000132483 00000 n -0000504948 00000 n +0000132493 00000 n +0000504861 00000 n 0000001843 00000 n 0000001879 00000 n -0000132606 00000 n -0000504874 00000 n +0000132616 00000 n +0000504787 00000 n 0000001927 00000 n 0000001968 00000 n -0000132730 00000 n -0000504787 00000 n +0000132740 00000 n +0000504700 00000 n 0000002016 00000 n 0000002056 00000 n -0000136814 00000 n -0000504658 00000 n +0000136824 00000 n +0000504571 00000 n 0000002104 00000 n 0000002149 00000 n -0000136938 00000 n -0000504580 00000 n +0000136948 00000 n +0000504493 00000 n 0000002203 00000 n 0000002244 00000 n -0000137063 00000 n -0000504488 00000 n +0000137073 00000 n +0000504401 00000 n 0000002298 00000 n 0000002339 00000 n -0000137188 00000 n -0000504396 00000 n +0000137198 00000 n +0000504309 00000 n 0000002393 00000 n 0000002439 00000 n -0000139086 00000 n -0000504304 00000 n +0000139096 00000 n +0000504217 00000 n 0000002493 00000 n 0000002534 00000 n -0000139210 00000 n -0000504212 00000 n +0000139220 00000 n +0000504125 00000 n 0000002588 00000 n 0000002629 00000 n -0000139335 00000 n -0000504120 00000 n +0000139345 00000 n +0000504033 00000 n 0000002683 00000 n 0000002725 00000 n -0000139460 00000 n -0000504028 00000 n +0000139470 00000 n +0000503941 00000 n 0000002779 00000 n 0000002821 00000 n -0000139585 00000 n -0000503936 00000 n +0000139595 00000 n +0000503849 00000 n 0000002875 00000 n 0000002921 00000 n -0000139710 00000 n -0000503844 00000 n +0000139720 00000 n +0000503757 00000 n 0000002975 00000 n 0000003021 00000 n -0000139835 00000 n -0000503752 00000 n +0000139845 00000 n +0000503665 00000 n 0000003076 00000 n 0000003124 00000 n -0000139958 00000 n -0000503660 00000 n +0000139968 00000 n +0000503573 00000 n 0000003179 00000 n 0000003227 00000 n -0000140083 00000 n -0000503568 00000 n +0000140093 00000 n +0000503481 00000 n 0000003282 00000 n 0000003325 00000 n -0000142279 00000 n -0000503476 00000 n +0000142289 00000 n +0000503389 00000 n 0000003380 00000 n 0000003423 00000 n -0000142403 00000 n -0000503384 00000 n +0000142413 00000 n +0000503297 00000 n 0000003478 00000 n 0000003526 00000 n -0000142528 00000 n -0000503306 00000 n +0000142538 00000 n +0000503219 00000 n 0000003581 00000 n 0000003629 00000 n -0000142652 00000 n -0000503176 00000 n +0000142662 00000 n +0000503089 00000 n 0000003678 00000 n 0000003723 00000 n -0000142777 00000 n -0000503097 00000 n +0000142787 00000 n +0000503010 00000 n 0000003777 00000 n 0000003813 00000 n -0000147171 00000 n -0000503018 00000 n +0000147181 00000 n +0000502931 00000 n 0000003867 00000 n 0000003905 00000 n -0000149758 00000 n -0000502940 00000 n +0000149768 00000 n +0000502853 00000 n 0000003954 00000 n 0000003998 00000 n -0000152896 00000 n -0000502808 00000 n +0000152906 00000 n +0000502721 00000 n 0000004045 00000 n 0000004084 00000 n -0000153020 00000 n -0000502690 00000 n +0000153030 00000 n +0000502603 00000 n 0000004133 00000 n 0000004173 00000 n -0000153584 00000 n -0000502611 00000 n +0000153594 00000 n +0000502524 00000 n 0000004227 00000 n 0000004275 00000 n -0000155862 00000 n -0000502518 00000 n +0000155872 00000 n +0000502431 00000 n 0000004329 00000 n 0000004384 00000 n -0000155987 00000 n -0000502439 00000 n +0000155997 00000 n +0000502352 00000 n 0000004438 00000 n 0000004488 00000 n -0000157934 00000 n -0000502321 00000 n +0000157944 00000 n +0000502234 00000 n 0000004537 00000 n 0000004567 00000 n -0000159263 00000 n -0000502256 00000 n +0000159273 00000 n +0000502169 00000 n 0000004621 00000 n 0000004661 00000 n -0000162250 00000 n -0000502123 00000 n +0000162260 00000 n +0000502036 00000 n 0000004708 00000 n 0000004753 00000 n -0000162374 00000 n -0000502044 00000 n +0000162384 00000 n +0000501957 00000 n 0000004802 00000 n 0000004838 00000 n -0000162499 00000 n -0000501951 00000 n +0000162509 00000 n +0000501864 00000 n 0000004887 00000 n 0000004920 00000 n -0000165910 00000 n -0000501858 00000 n +0000165920 00000 n +0000501771 00000 n 0000004969 00000 n 0000005007 00000 n -0000166035 00000 n -0000501765 00000 n +0000166045 00000 n +0000501678 00000 n 0000005056 00000 n 0000005089 00000 n -0000166160 00000 n -0000501672 00000 n +0000166170 00000 n +0000501585 00000 n 0000005138 00000 n 0000005169 00000 n -0000169734 00000 n -0000501579 00000 n +0000169744 00000 n +0000501492 00000 n 0000005218 00000 n 0000005252 00000 n -0000169859 00000 n -0000501486 00000 n +0000169869 00000 n +0000501399 00000 n 0000005301 00000 n 0000005338 00000 n -0000169983 00000 n -0000501393 00000 n +0000169993 00000 n +0000501306 00000 n 0000005387 00000 n 0000005423 00000 n -0000173847 00000 n -0000501314 00000 n +0000173857 00000 n +0000501227 00000 n 0000005472 00000 n 0000005515 00000 n -0000176927 00000 n -0000501220 00000 n +0000176937 00000 n +0000501133 00000 n 0000005562 00000 n 0000005610 00000 n -0000180351 00000 n -0000501087 00000 n +0000180361 00000 n +0000501000 00000 n 0000005657 00000 n 0000005716 00000 n -0000180475 00000 n -0000501022 00000 n +0000180485 00000 n +0000500935 00000 n 0000005765 00000 n 0000005814 00000 n -0000185389 00000 n -0000500889 00000 n +0000185399 00000 n +0000500802 00000 n 0000005862 00000 n 0000005900 00000 n -0000185514 00000 n -0000500771 00000 n +0000185524 00000 n +0000500684 00000 n 0000005950 00000 n 0000005987 00000 n -0000188777 00000 n -0000500692 00000 n +0000188787 00000 n +0000500605 00000 n 0000006042 00000 n 0000006076 00000 n -0000188902 00000 n -0000500613 00000 n +0000188912 00000 n +0000500526 00000 n 0000006131 00000 n 0000006165 00000 n -0000189027 00000 n -0000500481 00000 n +0000189037 00000 n +0000500394 00000 n 0000006215 00000 n 0000006260 00000 n -0000189151 00000 n -0000500402 00000 n +0000189161 00000 n +0000500315 00000 n 0000006315 00000 n 0000006347 00000 n -0000192362 00000 n -0000500270 00000 n +0000192372 00000 n +0000500183 00000 n 0000006402 00000 n 0000006441 00000 n -0000192486 00000 n -0000500191 00000 n +0000192496 00000 n +0000500104 00000 n 0000006501 00000 n 0000006547 00000 n -0000192610 00000 n -0000500112 00000 n +0000192620 00000 n +0000500025 00000 n 0000006607 00000 n 0000006653 00000 n -0000194584 00000 n -0000499993 00000 n +0000194594 00000 n +0000499906 00000 n 0000006708 00000 n 0000006745 00000 n -0000194709 00000 n -0000499914 00000 n +0000194719 00000 n +0000499827 00000 n 0000006805 00000 n 0000006840 00000 n -0000194834 00000 n -0000499821 00000 n +0000194844 00000 n +0000499734 00000 n 0000006900 00000 n 0000006933 00000 n -0000194959 00000 n -0000499728 00000 n +0000194969 00000 n +0000499641 00000 n 0000006993 00000 n 0000007027 00000 n -0000195083 00000 n -0000499635 00000 n +0000195093 00000 n +0000499548 00000 n 0000007087 00000 n 0000007122 00000 n -0000195206 00000 n -0000499542 00000 n +0000195216 00000 n +0000499455 00000 n 0000007182 00000 n 0000007246 00000 n -0000195331 00000 n -0000499449 00000 n +0000195341 00000 n +0000499362 00000 n 0000007306 00000 n 0000007349 00000 n -0000197289 00000 n -0000499356 00000 n +0000197299 00000 n +0000499269 00000 n 0000007409 00000 n 0000007470 00000 n -0000197414 00000 n -0000499263 00000 n +0000197424 00000 n +0000499176 00000 n 0000007530 00000 n 0000007612 00000 n -0000197539 00000 n -0000499170 00000 n +0000197549 00000 n +0000499083 00000 n 0000007672 00000 n 0000007726 00000 n -0000197664 00000 n -0000499077 00000 n +0000197674 00000 n +0000498990 00000 n 0000007787 00000 n 0000007857 00000 n -0000197789 00000 n -0000498984 00000 n +0000197799 00000 n +0000498897 00000 n 0000007918 00000 n 0000007982 00000 n -0000197914 00000 n -0000498891 00000 n +0000197924 00000 n +0000498804 00000 n 0000008043 00000 n 0000008106 00000 n -0000200428 00000 n -0000498798 00000 n +0000200438 00000 n +0000498711 00000 n 0000008167 00000 n 0000008229 00000 n -0000200553 00000 n -0000498705 00000 n +0000200563 00000 n +0000498618 00000 n 0000008290 00000 n 0000008380 00000 n -0000200677 00000 n -0000498612 00000 n +0000200687 00000 n +0000498525 00000 n 0000008441 00000 n 0000008506 00000 n -0000200802 00000 n -0000498519 00000 n +0000200812 00000 n +0000498432 00000 n 0000008567 00000 n 0000008646 00000 n -0000203276 00000 n -0000498426 00000 n +0000203286 00000 n +0000498339 00000 n 0000008707 00000 n 0000008783 00000 n -0000203401 00000 n -0000498333 00000 n +0000203411 00000 n +0000498246 00000 n 0000008844 00000 n 0000008908 00000 n -0000203526 00000 n -0000498240 00000 n +0000203536 00000 n +0000498153 00000 n 0000008969 00000 n 0000009061 00000 n -0000203649 00000 n -0000498147 00000 n +0000203659 00000 n +0000498060 00000 n 0000009122 00000 n 0000009222 00000 n -0000206167 00000 n -0000498054 00000 n +0000206177 00000 n +0000497967 00000 n 0000009283 00000 n 0000009364 00000 n -0000206292 00000 n -0000497961 00000 n +0000206302 00000 n +0000497874 00000 n 0000009425 00000 n 0000009505 00000 n -0000208518 00000 n -0000497868 00000 n +0000208528 00000 n +0000497781 00000 n 0000009566 00000 n 0000009617 00000 n -0000208643 00000 n -0000497775 00000 n +0000208653 00000 n +0000497688 00000 n 0000009678 00000 n 0000009744 00000 n -0000208767 00000 n -0000497682 00000 n +0000208777 00000 n +0000497595 00000 n 0000009805 00000 n 0000009893 00000 n -0000210913 00000 n -0000497589 00000 n +0000210923 00000 n +0000497502 00000 n 0000009954 00000 n 0000010016 00000 n -0000213547 00000 n -0000497496 00000 n +0000213557 00000 n +0000497409 00000 n 0000010077 00000 n 0000010172 00000 n -0000213672 00000 n -0000497403 00000 n +0000213682 00000 n +0000497316 00000 n 0000010233 00000 n 0000010316 00000 n -0000216538 00000 n -0000497310 00000 n +0000216548 00000 n +0000497223 00000 n 0000010377 00000 n 0000010432 00000 n -0000216663 00000 n -0000497231 00000 n +0000216673 00000 n +0000497144 00000 n 0000010493 00000 n 0000010544 00000 n -0000219698 00000 n -0000497098 00000 n +0000219708 00000 n +0000497011 00000 n 0000010594 00000 n 0000010649 00000 n -0000222969 00000 n -0000497019 00000 n +0000222979 00000 n +0000496932 00000 n 0000010704 00000 n 0000010742 00000 n -0000223094 00000 n -0000496887 00000 n +0000223104 00000 n +0000496800 00000 n 0000010797 00000 n 0000010830 00000 n -0000225901 00000 n -0000496808 00000 n +0000225911 00000 n +0000496721 00000 n 0000010890 00000 n 0000010985 00000 n -0000226026 00000 n -0000496715 00000 n +0000226036 00000 n +0000496628 00000 n 0000011045 00000 n 0000011098 00000 n -0000228559 00000 n -0000496622 00000 n +0000228569 00000 n +0000496535 00000 n 0000011158 00000 n 0000011202 00000 n -0000228684 00000 n -0000496529 00000 n +0000228694 00000 n +0000496442 00000 n 0000011262 00000 n 0000011308 00000 n -0000228809 00000 n -0000496436 00000 n +0000228819 00000 n +0000496349 00000 n 0000011368 00000 n 0000011414 00000 n -0000228934 00000 n -0000496343 00000 n +0000228944 00000 n +0000496256 00000 n 0000011474 00000 n 0000011520 00000 n -0000231298 00000 n -0000496250 00000 n +0000231308 00000 n +0000496163 00000 n 0000011580 00000 n 0000011626 00000 n -0000231423 00000 n -0000496171 00000 n +0000231433 00000 n +0000496084 00000 n 0000011686 00000 n 0000011732 00000 n -0000231548 00000 n -0000496078 00000 n +0000231558 00000 n +0000495991 00000 n 0000011787 00000 n 0000011818 00000 n -0000234311 00000 n -0000495985 00000 n +0000234321 00000 n +0000495898 00000 n 0000011873 00000 n 0000011919 00000 n -0000234435 00000 n -0000495892 00000 n +0000234445 00000 n +0000495805 00000 n 0000011974 00000 n 0000012026 00000 n -0000236765 00000 n -0000495760 00000 n +0000236775 00000 n +0000495673 00000 n 0000012081 00000 n 0000012123 00000 n -0000236890 00000 n -0000495681 00000 n +0000236900 00000 n +0000495594 00000 n 0000012183 00000 n 0000012219 00000 n -0000237015 00000 n -0000495602 00000 n +0000237025 00000 n +0000495515 00000 n 0000012279 00000 n 0000012316 00000 n -0000238873 00000 n -0000495470 00000 n +0000238883 00000 n +0000495383 00000 n 0000012371 00000 n 0000012419 00000 n -0000238998 00000 n -0000495391 00000 n +0000239008 00000 n +0000495304 00000 n 0000012479 00000 n 0000012515 00000 n -0000239122 00000 n -0000495312 00000 n +0000239132 00000 n +0000495225 00000 n 0000012575 00000 n 0000012612 00000 n -0000239247 00000 n -0000495180 00000 n +0000239257 00000 n +0000495093 00000 n 0000012667 00000 n 0000012723 00000 n -0000239372 00000 n -0000495101 00000 n +0000239382 00000 n +0000495014 00000 n 0000012783 00000 n 0000012819 00000 n -0000239497 00000 n -0000495022 00000 n +0000239507 00000 n +0000494935 00000 n 0000012879 00000 n 0000012916 00000 n -0000241322 00000 n -0000494890 00000 n +0000241332 00000 n +0000494803 00000 n 0000012971 00000 n 0000013013 00000 n -0000241447 00000 n -0000494811 00000 n +0000241457 00000 n +0000494724 00000 n 0000013073 00000 n 0000013109 00000 n -0000241572 00000 n -0000494732 00000 n +0000241582 00000 n +0000494645 00000 n 0000013169 00000 n 0000013206 00000 n -0000241697 00000 n -0000494600 00000 n +0000241707 00000 n +0000494513 00000 n 0000013262 00000 n 0000013299 00000 n -0000241822 00000 n -0000494521 00000 n +0000241832 00000 n +0000494434 00000 n 0000013360 00000 n 0000013397 00000 n -0000241947 00000 n -0000494442 00000 n +0000241957 00000 n +0000494355 00000 n 0000013458 00000 n 0000013496 00000 n -0000242072 00000 n -0000494310 00000 n +0000242082 00000 n +0000494223 00000 n 0000013552 00000 n 0000013595 00000 n -0000242197 00000 n -0000494231 00000 n +0000242207 00000 n +0000494144 00000 n 0000013656 00000 n 0000013693 00000 n -0000244572 00000 n -0000494152 00000 n +0000244582 00000 n +0000494065 00000 n 0000013754 00000 n 0000013792 00000 n -0000244697 00000 n -0000494034 00000 n +0000244707 00000 n +0000493947 00000 n 0000013848 00000 n 0000013892 00000 n -0000244822 00000 n -0000493955 00000 n +0000244832 00000 n +0000493868 00000 n 0000013953 00000 n 0000013990 00000 n -0000247352 00000 n -0000493876 00000 n +0000247362 00000 n +0000493789 00000 n 0000014051 00000 n 0000014089 00000 n -0000247477 00000 n -0000493744 00000 n +0000247487 00000 n +0000493657 00000 n 0000014139 00000 n 0000014196 00000 n -0000247602 00000 n -0000493626 00000 n +0000247612 00000 n +0000493539 00000 n 0000014251 00000 n 0000014299 00000 n -0000250141 00000 n -0000493547 00000 n +0000250151 00000 n +0000493460 00000 n 0000014359 00000 n 0000014395 00000 n -0000250266 00000 n -0000493468 00000 n +0000250276 00000 n +0000493381 00000 n 0000014455 00000 n 0000014492 00000 n -0000250391 00000 n -0000493336 00000 n +0000250401 00000 n +0000493249 00000 n 0000014547 00000 n 0000014592 00000 n -0000250516 00000 n -0000493257 00000 n +0000250526 00000 n +0000493170 00000 n 0000014652 00000 n 0000014688 00000 n -0000252921 00000 n -0000493178 00000 n +0000252931 00000 n +0000493091 00000 n 0000014748 00000 n 0000014785 00000 n -0000253046 00000 n -0000493046 00000 n +0000253056 00000 n +0000492959 00000 n 0000014840 00000 n 0000014890 00000 n -0000253171 00000 n -0000492967 00000 n +0000253181 00000 n +0000492880 00000 n 0000014950 00000 n 0000014986 00000 n -0000253296 00000 n -0000492888 00000 n +0000253306 00000 n +0000492801 00000 n 0000015046 00000 n 0000015083 00000 n -0000253421 00000 n -0000492756 00000 n +0000253431 00000 n +0000492669 00000 n 0000015138 00000 n 0000015178 00000 n -0000253546 00000 n -0000492677 00000 n +0000253556 00000 n +0000492590 00000 n 0000015238 00000 n 0000015274 00000 n -0000255473 00000 n -0000492598 00000 n +0000255483 00000 n +0000492511 00000 n 0000015334 00000 n 0000015371 00000 n -0000255598 00000 n -0000492480 00000 n +0000255608 00000 n +0000492393 00000 n 0000015426 00000 n 0000015467 00000 n -0000255722 00000 n -0000492401 00000 n +0000255732 00000 n +0000492314 00000 n 0000015527 00000 n 0000015563 00000 n -0000255847 00000 n -0000492322 00000 n +0000255857 00000 n +0000492235 00000 n 0000015623 00000 n 0000015660 00000 n -0000258091 00000 n -0000492190 00000 n +0000258101 00000 n +0000492103 00000 n 0000015710 00000 n 0000015801 00000 n -0000258216 00000 n -0000492072 00000 n +0000258226 00000 n +0000491985 00000 n 0000015856 00000 n 0000015896 00000 n -0000258341 00000 n -0000491993 00000 n +0000258351 00000 n +0000491906 00000 n 0000015956 00000 n 0000015992 00000 n -0000258466 00000 n -0000491914 00000 n +0000258476 00000 n +0000491827 00000 n 0000016052 00000 n 0000016089 00000 n -0000260608 00000 n -0000491796 00000 n +0000260618 00000 n +0000491709 00000 n 0000016144 00000 n 0000016180 00000 n -0000260733 00000 n -0000491717 00000 n +0000260743 00000 n +0000491630 00000 n 0000016240 00000 n 0000016276 00000 n -0000260858 00000 n -0000491638 00000 n +0000260868 00000 n +0000491551 00000 n 0000016336 00000 n 0000016373 00000 n -0000263217 00000 n -0000491506 00000 n +0000263227 00000 n +0000491419 00000 n 0000016423 00000 n 0000016474 00000 n -0000263341 00000 n -0000491388 00000 n +0000263351 00000 n +0000491301 00000 n 0000016529 00000 n 0000016570 00000 n -0000263466 00000 n -0000491309 00000 n +0000263476 00000 n +0000491222 00000 n 0000016630 00000 n 0000016666 00000 n -0000263590 00000 n -0000491230 00000 n +0000263600 00000 n +0000491143 00000 n 0000016726 00000 n 0000016763 00000 n -0000266073 00000 n -0000491112 00000 n +0000266083 00000 n +0000491025 00000 n 0000016818 00000 n 0000016864 00000 n -0000266198 00000 n -0000491033 00000 n +0000266208 00000 n +0000490946 00000 n 0000016924 00000 n 0000016960 00000 n -0000266323 00000 n -0000490954 00000 n +0000266333 00000 n +0000490867 00000 n 0000017020 00000 n 0000017057 00000 n -0000266448 00000 n -0000490822 00000 n +0000266458 00000 n +0000490735 00000 n 0000017107 00000 n 0000017178 00000 n -0000266573 00000 n -0000490743 00000 n +0000266583 00000 n +0000490656 00000 n 0000017233 00000 n 0000017271 00000 n -0000268322 00000 n -0000490650 00000 n +0000268332 00000 n +0000490563 00000 n 0000017326 00000 n 0000017361 00000 n -0000270897 00000 n -0000490571 00000 n +0000270907 00000 n +0000490484 00000 n 0000017416 00000 n 0000017451 00000 n -0000271021 00000 n -0000490453 00000 n +0000271031 00000 n +0000490366 00000 n 0000017501 00000 n 0000017539 00000 n -0000271146 00000 n -0000490335 00000 n +0000271156 00000 n +0000490248 00000 n 0000017594 00000 n 0000017636 00000 n -0000271271 00000 n -0000490256 00000 n +0000271281 00000 n +0000490169 00000 n 0000017696 00000 n 0000017750 00000 n -0000273600 00000 n -0000490177 00000 n +0000273610 00000 n +0000490090 00000 n 0000017810 00000 n 0000017857 00000 n -0000273723 00000 n -0000490059 00000 n +0000273733 00000 n +0000489972 00000 n 0000017912 00000 n 0000017954 00000 n -0000273848 00000 n -0000489980 00000 n +0000273858 00000 n +0000489893 00000 n 0000018014 00000 n 0000018063 00000 n -0000275666 00000 n -0000489887 00000 n +0000275676 00000 n +0000489800 00000 n 0000018123 00000 n 0000018173 00000 n -0000275791 00000 n -0000489808 00000 n +0000275801 00000 n +0000489721 00000 n 0000018233 00000 n 0000018284 00000 n -0000278088 00000 n -0000489675 00000 n +0000278098 00000 n +0000489588 00000 n 0000018332 00000 n 0000018379 00000 n -0000278213 00000 n -0000489596 00000 n +0000278223 00000 n +0000489509 00000 n 0000018429 00000 n 0000018462 00000 n -0000278338 00000 n -0000489503 00000 n +0000278348 00000 n +0000489416 00000 n 0000018512 00000 n 0000018576 00000 n -0000278463 00000 n -0000489410 00000 n +0000278473 00000 n +0000489323 00000 n 0000018626 00000 n 0000018668 00000 n -0000285574 00000 n -0000489317 00000 n +0000285584 00000 n +0000489230 00000 n 0000018718 00000 n 0000018793 00000 n -0000285699 00000 n -0000489238 00000 n +0000285709 00000 n +0000489151 00000 n 0000018843 00000 n 0000018903 00000 n -0000295084 00000 n -0000489105 00000 n +0000295094 00000 n +0000489018 00000 n 0000018951 00000 n 0000018994 00000 n -0000295209 00000 n -0000489040 00000 n +0000295219 00000 n +0000488953 00000 n 0000019044 00000 n 0000019082 00000 n -0000299282 00000 n -0000488907 00000 n +0000299292 00000 n +0000488820 00000 n 0000019130 00000 n 0000019176 00000 n -0000299407 00000 n -0000488828 00000 n +0000299417 00000 n +0000488741 00000 n 0000019226 00000 n 0000019276 00000 n -0000303214 00000 n -0000488735 00000 n +0000303224 00000 n +0000488648 00000 n 0000019326 00000 n 0000019371 00000 n -0000303339 00000 n -0000488642 00000 n +0000303349 00000 n +0000488555 00000 n 0000019421 00000 n 0000019478 00000 n -0000306416 00000 n -0000488510 00000 n +0000306426 00000 n +0000488423 00000 n 0000019528 00000 n 0000019559 00000 n -0000306541 00000 n -0000488431 00000 n +0000306551 00000 n +0000488344 00000 n 0000019614 00000 n 0000019652 00000 n -0000306666 00000 n -0000488338 00000 n +0000306676 00000 n +0000488251 00000 n 0000019707 00000 n 0000019747 00000 n -0000306791 00000 n -0000488259 00000 n +0000306801 00000 n +0000488172 00000 n 0000019802 00000 n 0000019840 00000 n -0000306916 00000 n -0000488127 00000 n +0000306926 00000 n +0000488040 00000 n 0000019890 00000 n 0000019926 00000 n -0000307041 00000 n -0000488048 00000 n +0000307051 00000 n +0000487961 00000 n 0000019981 00000 n 0000020037 00000 n -0000309994 00000 n -0000487969 00000 n +0000310004 00000 n +0000487882 00000 n 0000020092 00000 n 0000020129 00000 n -0000310119 00000 n -0000487876 00000 n +0000310129 00000 n +0000487789 00000 n 0000020179 00000 n 0000020221 00000 n -0000312178 00000 n -0000487797 00000 n +0000312188 00000 n +0000487710 00000 n 0000020271 00000 n 0000020303 00000 n -0000315311 00000 n -0000487664 00000 n +0000315321 00000 n +0000487577 00000 n 0000020351 00000 n 0000020407 00000 n -0000315436 00000 n -0000487585 00000 n +0000315446 00000 n +0000487498 00000 n 0000020457 00000 n 0000020494 00000 n -0000315561 00000 n -0000487492 00000 n +0000315571 00000 n +0000487405 00000 n 0000020544 00000 n 0000020586 00000 n -0000318635 00000 n -0000487413 00000 n +0000318645 00000 n +0000487326 00000 n 0000020636 00000 n 0000020679 00000 n -0000323620 00000 n -0000487280 00000 n +0000323630 00000 n +0000487193 00000 n 0000020727 00000 n 0000020757 00000 n -0000323745 00000 n -0000487201 00000 n +0000323755 00000 n +0000487114 00000 n 0000020807 00000 n 0000020842 00000 n -0000323870 00000 n -0000487069 00000 n +0000323880 00000 n +0000486982 00000 n 0000020892 00000 n 0000020932 00000 n -0000323995 00000 n -0000486990 00000 n +0000324005 00000 n +0000486903 00000 n 0000020987 00000 n 0000021028 00000 n -0000327290 00000 n -0000486911 00000 n +0000327300 00000 n +0000486824 00000 n 0000021083 00000 n 0000021124 00000 n -0000327415 00000 n -0000486793 00000 n +0000327425 00000 n +0000486706 00000 n 0000021174 00000 n 0000021214 00000 n -0000327540 00000 n -0000486728 00000 n +0000327550 00000 n +0000486641 00000 n 0000021269 00000 n 0000021335 00000 n -0000333951 00000 n -0000486595 00000 n +0000333961 00000 n +0000486508 00000 n 0000021383 00000 n 0000021427 00000 n -0000334076 00000 n -0000486516 00000 n +0000334086 00000 n +0000486429 00000 n 0000021477 00000 n 0000021507 00000 n -0000334201 00000 n -0000486437 00000 n +0000334211 00000 n +0000486350 00000 n 0000021557 00000 n 0000021598 00000 n -0000335823 00000 n -0000486304 00000 n +0000335833 00000 n +0000486217 00000 n 0000021646 00000 n 0000021680 00000 n -0000335948 00000 n -0000486186 00000 n +0000335958 00000 n +0000486099 00000 n 0000021730 00000 n 0000021784 00000 n -0000336073 00000 n -0000486107 00000 n +0000336083 00000 n +0000486020 00000 n 0000021839 00000 n 0000021887 00000 n -0000339881 00000 n -0000486028 00000 n +0000339891 00000 n +0000485941 00000 n 0000021942 00000 n 0000021998 00000 n -0000342351 00000 n -0000485896 00000 n +0000342361 00000 n +0000485809 00000 n 0000022048 00000 n 0000022136 00000 n -0000342476 00000 n -0000485817 00000 n +0000342486 00000 n +0000485730 00000 n 0000022191 00000 n 0000022249 00000 n -0000345327 00000 n -0000485738 00000 n +0000345337 00000 n +0000485651 00000 n 0000022304 00000 n 0000022373 00000 n -0000351475 00000 n -0000485606 00000 n +0000351485 00000 n +0000485519 00000 n 0000022423 00000 n 0000022482 00000 n -0000351600 00000 n -0000485541 00000 n +0000351610 00000 n +0000485454 00000 n 0000022537 00000 n 0000022605 00000 n -0000361676 00000 n -0000485423 00000 n +0000361686 00000 n +0000485336 00000 n 0000022655 00000 n 0000022690 00000 n -0000361801 00000 n -0000485344 00000 n +0000361811 00000 n +0000485257 00000 n 0000022745 00000 n 0000022803 00000 n -0000361925 00000 n -0000485265 00000 n +0000361935 00000 n +0000485178 00000 n 0000022858 00000 n 0000022911 00000 n -0000364135 00000 n -0000485132 00000 n +0000364145 00000 n +0000485045 00000 n 0000022959 00000 n 0000023000 00000 n -0000364260 00000 n -0000485053 00000 n +0000364270 00000 n +0000484966 00000 n 0000023050 00000 n 0000023085 00000 n -0000364385 00000 n -0000484974 00000 n +0000364395 00000 n +0000484887 00000 n 0000023135 00000 n 0000023167 00000 n -0000368236 00000 n -0000484894 00000 n +0000368246 00000 n +0000484807 00000 n 0000023215 00000 n 0000023255 00000 n -0000023617 00000 n -0000023858 00000 n +0000023627 00000 n +0000023868 00000 n 0000023307 00000 n -0000023736 00000 n -0000023797 00000 n -0000481070 00000 n -0000467831 00000 n -0000480904 00000 n -0000467418 00000 n -0000463632 00000 n -0000467255 00000 n -0000481943 00000 n -0000025991 00000 n -0000025073 00000 n -0000023943 00000 n -0000025930 00000 n -0000462811 00000 n -0000446607 00000 n -0000462647 00000 n -0000444662 00000 n -0000426259 00000 n -0000444499 00000 n -0000025236 00000 n -0000425287 00000 n -0000409417 00000 n -0000425123 00000 n -0000025407 00000 n -0000025577 00000 n -0000025748 00000 n -0000029365 00000 n -0000027488 00000 n -0000026089 00000 n -0000029243 00000 n -0000029304 00000 n -0000027699 00000 n -0000407941 00000 n -0000406001 00000 n -0000407777 00000 n -0000027847 00000 n -0000028001 00000 n -0000028148 00000 n -0000028307 00000 n -0000404101 00000 n -0000402091 00000 n -0000403938 00000 n -0000028458 00000 n -0000028645 00000 n -0000028793 00000 n -0000028943 00000 n -0000029092 00000 n -0000093846 00000 n -0000100697 00000 n -0000109160 00000 n -0000122425 00000 n -0000132544 00000 n -0000152958 00000 n -0000162312 00000 n -0000176989 00000 n -0000180413 00000 n -0000035480 00000 n -0000031541 00000 n -0000029476 00000 n -0000035419 00000 n -0000031863 00000 n -0000032033 00000 n -0000032204 00000 n -0000032353 00000 n -0000032528 00000 n -0000032703 00000 n -0000032873 00000 n -0000033023 00000 n -0000033169 00000 n -0000033315 00000 n -0000033467 00000 n -0000033637 00000 n -0000033787 00000 n -0000033959 00000 n -0000034112 00000 n -0000034286 00000 n -0000034458 00000 n -0000034603 00000 n -0000034770 00000 n -0000034943 00000 n -0000035095 00000 n -0000035250 00000 n -0000185451 00000 n -0000278150 00000 n -0000295146 00000 n -0000299344 00000 n -0000315373 00000 n -0000323682 00000 n -0000334013 00000 n -0000335885 00000 n -0000364197 00000 n -0000368298 00000 n -0000044740 00000 n -0000038014 00000 n -0000035578 00000 n -0000044614 00000 n -0000044677 00000 n -0000038499 00000 n -0000038651 00000 n -0000038805 00000 n -0000038960 00000 n -0000039115 00000 n -0000039268 00000 n -0000039423 00000 n -0000039578 00000 n -0000039733 00000 n -0000039887 00000 n -0000040042 00000 n -0000040195 00000 n -0000040349 00000 n -0000040504 00000 n -0000040659 00000 n -0000040814 00000 n -0000040969 00000 n -0000041129 00000 n -0000041289 00000 n -0000041449 00000 n -0000041602 00000 n -0000041755 00000 n -0000041909 00000 n -0000042064 00000 n -0000042219 00000 n -0000042379 00000 n -0000042539 00000 n -0000042699 00000 n -0000042859 00000 n -0000043019 00000 n -0000043179 00000 n -0000043338 00000 n -0000043498 00000 n -0000043658 00000 n -0000043818 00000 n -0000043977 00000 n -0000044137 00000 n -0000044296 00000 n -0000044455 00000 n -0000056333 00000 n -0000048049 00000 n -0000044826 00000 n -0000056270 00000 n -0000401506 00000 n -0000392316 00000 n -0000401340 00000 n -0000048615 00000 n -0000048770 00000 n -0000048930 00000 n -0000049090 00000 n -0000049245 00000 n -0000049398 00000 n -0000049553 00000 n -0000049713 00000 n -0000049872 00000 n -0000050032 00000 n -0000050187 00000 n -0000050346 00000 n -0000050498 00000 n -0000050653 00000 n -0000050808 00000 n -0000050963 00000 n -0000051118 00000 n -0000051273 00000 n -0000051428 00000 n -0000051582 00000 n -0000051737 00000 n -0000051892 00000 n -0000052044 00000 n -0000052195 00000 n -0000052350 00000 n -0000052504 00000 n -0000052660 00000 n -0000052821 00000 n -0000052980 00000 n -0000053136 00000 n -0000053297 00000 n -0000053458 00000 n -0000053623 00000 n -0000053789 00000 n -0000053950 00000 n -0000054116 00000 n -0000054282 00000 n -0000054448 00000 n -0000054614 00000 n -0000054780 00000 n -0000054945 00000 n -0000055110 00000 n -0000055276 00000 n -0000055442 00000 n -0000055608 00000 n -0000055775 00000 n -0000055940 00000 n -0000056105 00000 n -0000069221 00000 n -0000059993 00000 n -0000056433 00000 n -0000069158 00000 n -0000060596 00000 n -0000060763 00000 n -0000060930 00000 n -0000061097 00000 n -0000061264 00000 n -0000061431 00000 n -0000061598 00000 n -0000061765 00000 n -0000061932 00000 n -0000062098 00000 n -0000062265 00000 n -0000062432 00000 n -0000062598 00000 n -0000062765 00000 n -0000062932 00000 n -0000063099 00000 n -0000063266 00000 n -0000063422 00000 n -0000063583 00000 n -0000063744 00000 n -0000063910 00000 n -0000064075 00000 n -0000064241 00000 n -0000064407 00000 n -0000064573 00000 n -0000064738 00000 n -0000064904 00000 n -0000065070 00000 n -0000065231 00000 n -0000065392 00000 n -0000065553 00000 n -0000065714 00000 n -0000065880 00000 n -0000066046 00000 n -0000066206 00000 n -0000066372 00000 n -0000066538 00000 n -0000066698 00000 n -0000066864 00000 n -0000067030 00000 n -0000067191 00000 n -0000067357 00000 n -0000067523 00000 n -0000067685 00000 n -0000067852 00000 n -0000068019 00000 n -0000068180 00000 n -0000068347 00000 n -0000068514 00000 n -0000068675 00000 n -0000068839 00000 n -0000069004 00000 n -0000482063 00000 n -0000080701 00000 n -0000072134 00000 n -0000069308 00000 n -0000080638 00000 n -0000072710 00000 n -0000072871 00000 n -0000073037 00000 n -0000073203 00000 n -0000073364 00000 n -0000073530 00000 n -0000073696 00000 n -0000073857 00000 n -0000074023 00000 n -0000074188 00000 n -0000074349 00000 n -0000074515 00000 n -0000074680 00000 n -0000074841 00000 n -0000075007 00000 n -0000075173 00000 n -0000075329 00000 n -0000075490 00000 n -0000075656 00000 n -0000075822 00000 n -0000075983 00000 n -0000076148 00000 n -0000076314 00000 n -0000076470 00000 n -0000076631 00000 n -0000076796 00000 n -0000076962 00000 n -0000077123 00000 n -0000077289 00000 n -0000077455 00000 n -0000077611 00000 n -0000077772 00000 n -0000077933 00000 n -0000078094 00000 n -0000078249 00000 n -0000078410 00000 n -0000078576 00000 n -0000078741 00000 n -0000078902 00000 n -0000079068 00000 n -0000079234 00000 n -0000079400 00000 n -0000079554 00000 n -0000079710 00000 n -0000079866 00000 n -0000080020 00000 n -0000080176 00000 n -0000080332 00000 n -0000080484 00000 n -0000091184 00000 n -0000083840 00000 n -0000080814 00000 n -0000091121 00000 n -0000084362 00000 n -0000084516 00000 n -0000084672 00000 n -0000084828 00000 n -0000084984 00000 n -0000085140 00000 n -0000085301 00000 n -0000085462 00000 n -0000085623 00000 n -0000085778 00000 n -0000085939 00000 n -0000086100 00000 n -0000086255 00000 n -0000086411 00000 n -0000086565 00000 n -0000086721 00000 n -0000086877 00000 n -0000087033 00000 n -0000087187 00000 n -0000087342 00000 n -0000087498 00000 n -0000087659 00000 n -0000087818 00000 n -0000087973 00000 n -0000088134 00000 n -0000088288 00000 n -0000088444 00000 n -0000088600 00000 n -0000088754 00000 n -0000088909 00000 n -0000089070 00000 n -0000089231 00000 n -0000089387 00000 n -0000089547 00000 n -0000089708 00000 n -0000089864 00000 n -0000090025 00000 n -0000090181 00000 n -0000090342 00000 n -0000090503 00000 n -0000090657 00000 n -0000090812 00000 n -0000090968 00000 n -0000094032 00000 n -0000093600 00000 n -0000091284 00000 n -0000093723 00000 n -0000093969 00000 n -0000098019 00000 n -0000097585 00000 n -0000094118 00000 n -0000097708 00000 n -0000097832 00000 n -0000097956 00000 n -0000101379 00000 n -0000100450 00000 n -0000098132 00000 n -0000100573 00000 n -0000100820 00000 n -0000100883 00000 n -0000100944 00000 n -0000101007 00000 n -0000101130 00000 n -0000101254 00000 n -0000101317 00000 n -0000105606 00000 n -0000104858 00000 n -0000101465 00000 n -0000104981 00000 n -0000105044 00000 n -0000105107 00000 n -0000105170 00000 n -0000105233 00000 n -0000105296 00000 n -0000105420 00000 n -0000105543 00000 n -0000482188 00000 n -0000107114 00000 n -0000106928 00000 n -0000105706 00000 n -0000107051 00000 n -0000109535 00000 n -0000108913 00000 n -0000107201 00000 n -0000109036 00000 n -0000109283 00000 n -0000109346 00000 n -0000109409 00000 n -0000109472 00000 n -0000111804 00000 n -0000111431 00000 n -0000109634 00000 n -0000111554 00000 n -0000111617 00000 n -0000111741 00000 n -0000114008 00000 n -0000113699 00000 n -0000111917 00000 n -0000113822 00000 n -0000113946 00000 n -0000116273 00000 n -0000115774 00000 n -0000114134 00000 n -0000115897 00000 n -0000116021 00000 n -0000116084 00000 n -0000116147 00000 n -0000116210 00000 n -0000118900 00000 n -0000118219 00000 n -0000116386 00000 n -0000118342 00000 n -0000118466 00000 n -0000118590 00000 n -0000118713 00000 n -0000118837 00000 n -0000482313 00000 n -0000122676 00000 n -0000121758 00000 n -0000119000 00000 n -0000122301 00000 n -0000121911 00000 n -0000122111 00000 n -0000122487 00000 n -0000122550 00000 n -0000122613 00000 n -0000127623 00000 n -0000126243 00000 n -0000122775 00000 n -0000126366 00000 n -0000126429 00000 n -0000126492 00000 n -0000126555 00000 n -0000126618 00000 n -0000126681 00000 n -0000126744 00000 n -0000126807 00000 n -0000126870 00000 n -0000126933 00000 n -0000126995 00000 n -0000127058 00000 n -0000127121 00000 n -0000127183 00000 n -0000127246 00000 n -0000127309 00000 n -0000127372 00000 n -0000127435 00000 n -0000127498 00000 n -0000127561 00000 n -0000129802 00000 n -0000129427 00000 n -0000127710 00000 n -0000129550 00000 n -0000129613 00000 n -0000129676 00000 n -0000129739 00000 n -0000133294 00000 n -0000132297 00000 n -0000129889 00000 n -0000132420 00000 n -0000132667 00000 n -0000132791 00000 n -0000132854 00000 n -0000132917 00000 n -0000132980 00000 n -0000133043 00000 n -0000133106 00000 n -0000133169 00000 n -0000133232 00000 n -0000137313 00000 n -0000136377 00000 n -0000133380 00000 n -0000136500 00000 n -0000136563 00000 n -0000136626 00000 n -0000136689 00000 n -0000136752 00000 n -0000136875 00000 n -0000137000 00000 n -0000137125 00000 n -0000137250 00000 n -0000140207 00000 n -0000138900 00000 n -0000137413 00000 n -0000139023 00000 n -0000139148 00000 n -0000139272 00000 n -0000139397 00000 n -0000139522 00000 n -0000139647 00000 n -0000139772 00000 n -0000139896 00000 n -0000140020 00000 n -0000140145 00000 n -0000482438 00000 n -0000143277 00000 n -0000142093 00000 n -0000140307 00000 n -0000142216 00000 n -0000142341 00000 n -0000142465 00000 n -0000142589 00000 n -0000142714 00000 n -0000142839 00000 n -0000142900 00000 n -0000142962 00000 n -0000143025 00000 n -0000143088 00000 n -0000143151 00000 n -0000143214 00000 n -0000147484 00000 n -0000146483 00000 n -0000143390 00000 n -0000146606 00000 n -0000146669 00000 n -0000146732 00000 n -0000146795 00000 n -0000146857 00000 n -0000146920 00000 n -0000146983 00000 n -0000147046 00000 n -0000147108 00000 n -0000147233 00000 n -0000147296 00000 n -0000147359 00000 n -0000147421 00000 n -0000150512 00000 n -0000149572 00000 n -0000147584 00000 n -0000149695 00000 n -0000149820 00000 n -0000149883 00000 n -0000149946 00000 n -0000150009 00000 n -0000150072 00000 n -0000150135 00000 n -0000150198 00000 n -0000150261 00000 n -0000150323 00000 n -0000150386 00000 n -0000150449 00000 n -0000153960 00000 n -0000152710 00000 n -0000150612 00000 n -0000152833 00000 n -0000153082 00000 n -0000153145 00000 n -0000153208 00000 n -0000153271 00000 n -0000153333 00000 n -0000153396 00000 n -0000153459 00000 n -0000153521 00000 n -0000153646 00000 n -0000153709 00000 n -0000153772 00000 n -0000153835 00000 n -0000153898 00000 n -0000156112 00000 n -0000155676 00000 n -0000154059 00000 n -0000155799 00000 n -0000155924 00000 n -0000156049 00000 n -0000158309 00000 n -0000157748 00000 n -0000156238 00000 n -0000157871 00000 n -0000157994 00000 n -0000158057 00000 n -0000158120 00000 n -0000158183 00000 n -0000158246 00000 n -0000482563 00000 n -0000159388 00000 n -0000159077 00000 n -0000158435 00000 n -0000159200 00000 n -0000159325 00000 n -0000162624 00000 n -0000162064 00000 n -0000159488 00000 n -0000162187 00000 n -0000162436 00000 n -0000162561 00000 n -0000166285 00000 n -0000165724 00000 n -0000162723 00000 n -0000165847 00000 n -0000165972 00000 n -0000166097 00000 n -0000166222 00000 n -0000170108 00000 n -0000169548 00000 n -0000166385 00000 n -0000169671 00000 n -0000169796 00000 n -0000169920 00000 n -0000170045 00000 n -0000173970 00000 n -0000173661 00000 n -0000170221 00000 n -0000173784 00000 n -0000173909 00000 n -0000177051 00000 n -0000176741 00000 n -0000174070 00000 n -0000176864 00000 n -0000391713 00000 n -0000382815 00000 n -0000391547 00000 n -0000382580 00000 n -0000380705 00000 n -0000382414 00000 n -0000482688 00000 n -0000179121 00000 n -0000178935 00000 n -0000177178 00000 n -0000179058 00000 n -0000180914 00000 n -0000180165 00000 n -0000179249 00000 n -0000180288 00000 n -0000180537 00000 n -0000180600 00000 n -0000180663 00000 n -0000180726 00000 n -0000180788 00000 n -0000180851 00000 n -0000185639 00000 n -0000183763 00000 n -0000181013 00000 n -0000185326 00000 n -0000185576 00000 n -0000183961 00000 n -0000184154 00000 n -0000184348 00000 n -0000184570 00000 n -0000184757 00000 n -0000184933 00000 n -0000185139 00000 n -0000189400 00000 n -0000188280 00000 n -0000185764 00000 n -0000188403 00000 n -0000188466 00000 n -0000188529 00000 n -0000188592 00000 n -0000188651 00000 n -0000188714 00000 n -0000188839 00000 n -0000188964 00000 n -0000189089 00000 n -0000189212 00000 n -0000189275 00000 n -0000189338 00000 n -0000192735 00000 n -0000191987 00000 n -0000189500 00000 n -0000192110 00000 n -0000192173 00000 n -0000192236 00000 n -0000192299 00000 n -0000192424 00000 n -0000192547 00000 n -0000192672 00000 n -0000195455 00000 n -0000194398 00000 n -0000192835 00000 n -0000194521 00000 n -0000194646 00000 n -0000194771 00000 n -0000194896 00000 n -0000195021 00000 n -0000195143 00000 n -0000195268 00000 n -0000195393 00000 n -0000482813 00000 n -0000198039 00000 n -0000197103 00000 n -0000195568 00000 n -0000197226 00000 n -0000197351 00000 n -0000197476 00000 n -0000197601 00000 n -0000197726 00000 n -0000197851 00000 n -0000197976 00000 n -0000200926 00000 n -0000200242 00000 n -0000198139 00000 n -0000200365 00000 n -0000200490 00000 n -0000200614 00000 n -0000200739 00000 n -0000200864 00000 n -0000203773 00000 n -0000203090 00000 n -0000201052 00000 n -0000203213 00000 n -0000203338 00000 n -0000203463 00000 n -0000203587 00000 n -0000203711 00000 n -0000206417 00000 n -0000205981 00000 n -0000203899 00000 n -0000206104 00000 n -0000206229 00000 n -0000206354 00000 n -0000208892 00000 n -0000208332 00000 n -0000206543 00000 n -0000208455 00000 n -0000208580 00000 n -0000208704 00000 n -0000208829 00000 n -0000211038 00000 n -0000210727 00000 n -0000209005 00000 n -0000210850 00000 n -0000210975 00000 n -0000482938 00000 n -0000213797 00000 n -0000213361 00000 n -0000211151 00000 n -0000213484 00000 n -0000213609 00000 n -0000213734 00000 n -0000216788 00000 n -0000216352 00000 n -0000213910 00000 n -0000216475 00000 n -0000216600 00000 n -0000216725 00000 n -0000219823 00000 n -0000219512 00000 n -0000216914 00000 n -0000219635 00000 n -0000219760 00000 n -0000223219 00000 n -0000222783 00000 n -0000219923 00000 n -0000222906 00000 n -0000223031 00000 n -0000223156 00000 n -0000226151 00000 n -0000225715 00000 n -0000223358 00000 n -0000225838 00000 n -0000225963 00000 n -0000226088 00000 n -0000229059 00000 n -0000228373 00000 n -0000226277 00000 n -0000228496 00000 n -0000228621 00000 n -0000228746 00000 n -0000228871 00000 n -0000228996 00000 n -0000483063 00000 n -0000231673 00000 n -0000231112 00000 n -0000229159 00000 n -0000231235 00000 n -0000231360 00000 n -0000231485 00000 n -0000231610 00000 n -0000234559 00000 n -0000234125 00000 n -0000231773 00000 n -0000234248 00000 n -0000234373 00000 n -0000234496 00000 n -0000237140 00000 n -0000236579 00000 n -0000234685 00000 n -0000236702 00000 n -0000236827 00000 n -0000236952 00000 n -0000237077 00000 n -0000239622 00000 n -0000238687 00000 n -0000237266 00000 n -0000238810 00000 n -0000238935 00000 n -0000239060 00000 n -0000239184 00000 n -0000239309 00000 n -0000239434 00000 n -0000239559 00000 n -0000242322 00000 n -0000241136 00000 n -0000239748 00000 n -0000241259 00000 n -0000241384 00000 n -0000241509 00000 n -0000241634 00000 n -0000241759 00000 n -0000241884 00000 n -0000242009 00000 n -0000242134 00000 n -0000242259 00000 n -0000244947 00000 n -0000244386 00000 n -0000242435 00000 n -0000244509 00000 n -0000244634 00000 n -0000244759 00000 n -0000244884 00000 n -0000483188 00000 n -0000247726 00000 n -0000247166 00000 n -0000245060 00000 n -0000247289 00000 n -0000247414 00000 n -0000247539 00000 n -0000247664 00000 n -0000250641 00000 n -0000249955 00000 n -0000247852 00000 n -0000250078 00000 n -0000250203 00000 n -0000250328 00000 n -0000250453 00000 n -0000250578 00000 n -0000253669 00000 n -0000252735 00000 n -0000250754 00000 n -0000252858 00000 n -0000252983 00000 n -0000253108 00000 n -0000253233 00000 n -0000253358 00000 n -0000253483 00000 n -0000253607 00000 n -0000255972 00000 n -0000255287 00000 n -0000253782 00000 n -0000255410 00000 n -0000255535 00000 n -0000255660 00000 n -0000255784 00000 n -0000255909 00000 n -0000258591 00000 n -0000257905 00000 n -0000256098 00000 n -0000258028 00000 n -0000258153 00000 n -0000258278 00000 n -0000258403 00000 n -0000258528 00000 n -0000260983 00000 n -0000260422 00000 n -0000258730 00000 n -0000260545 00000 n -0000260670 00000 n -0000260795 00000 n -0000260920 00000 n -0000483313 00000 n -0000263715 00000 n -0000263031 00000 n -0000261109 00000 n -0000263154 00000 n -0000263279 00000 n -0000263403 00000 n -0000263527 00000 n -0000263652 00000 n -0000266698 00000 n -0000265887 00000 n -0000263828 00000 n -0000266010 00000 n -0000266135 00000 n -0000266260 00000 n -0000266385 00000 n -0000266510 00000 n -0000266635 00000 n -0000268447 00000 n -0000268136 00000 n -0000266811 00000 n -0000268259 00000 n -0000268384 00000 n -0000271396 00000 n -0000270711 00000 n -0000268560 00000 n -0000270834 00000 n -0000270958 00000 n -0000271083 00000 n -0000271208 00000 n -0000271333 00000 n -0000273973 00000 n -0000273414 00000 n -0000271509 00000 n -0000273537 00000 n -0000273662 00000 n -0000273785 00000 n -0000273910 00000 n -0000275916 00000 n -0000275480 00000 n -0000274086 00000 n -0000275603 00000 n -0000275728 00000 n -0000275853 00000 n -0000483438 00000 n -0000278587 00000 n -0000277902 00000 n -0000276029 00000 n -0000278025 00000 n -0000278275 00000 n -0000278400 00000 n -0000278525 00000 n -0000282586 00000 n -0000282149 00000 n -0000278686 00000 n -0000282272 00000 n -0000282335 00000 n -0000282398 00000 n -0000282461 00000 n -0000282524 00000 n -0000285824 00000 n -0000285136 00000 n -0000282699 00000 n -0000285259 00000 n -0000285322 00000 n -0000285385 00000 n -0000285448 00000 n -0000285511 00000 n -0000285636 00000 n -0000285761 00000 n -0000288175 00000 n -0000287989 00000 n -0000285937 00000 n -0000288112 00000 n -0000291727 00000 n -0000291541 00000 n -0000288288 00000 n -0000291664 00000 n -0000293047 00000 n -0000292861 00000 n -0000291840 00000 n -0000292984 00000 n -0000483563 00000 n -0000295334 00000 n -0000294898 00000 n -0000293147 00000 n -0000295021 00000 n -0000295271 00000 n -0000296479 00000 n -0000296293 00000 n -0000295433 00000 n -0000296416 00000 n -0000299532 00000 n -0000299096 00000 n -0000296566 00000 n -0000299219 00000 n -0000299469 00000 n -0000303463 00000 n -0000303028 00000 n -0000299631 00000 n -0000303151 00000 n -0000303276 00000 n -0000303400 00000 n -0000307166 00000 n -0000306230 00000 n -0000303576 00000 n -0000306353 00000 n -0000306478 00000 n -0000306603 00000 n -0000306728 00000 n -0000306853 00000 n -0000306978 00000 n -0000307103 00000 n -0000310244 00000 n -0000309808 00000 n -0000307279 00000 n -0000309931 00000 n -0000310056 00000 n -0000310181 00000 n -0000483688 00000 n -0000312303 00000 n -0000311992 00000 n -0000310357 00000 n -0000312115 00000 n -0000312240 00000 n -0000315685 00000 n -0000315125 00000 n -0000312430 00000 n -0000315248 00000 n -0000315498 00000 n -0000315623 00000 n -0000318823 00000 n -0000318449 00000 n -0000315771 00000 n -0000318572 00000 n -0000318697 00000 n -0000318760 00000 n -0000321610 00000 n -0000321424 00000 n -0000318963 00000 n -0000321547 00000 n -0000324119 00000 n -0000323434 00000 n -0000321737 00000 n -0000323557 00000 n -0000323807 00000 n -0000323932 00000 n -0000324056 00000 n -0000327664 00000 n -0000327104 00000 n -0000324218 00000 n -0000327227 00000 n -0000327352 00000 n -0000327477 00000 n -0000327601 00000 n -0000483813 00000 n -0000329435 00000 n -0000331028 00000 n -0000329312 00000 n -0000327777 00000 n -0000330965 00000 n -0000379399 00000 n -0000377064 00000 n -0000379232 00000 n -0000375441 00000 n -0000369394 00000 n -0000375275 00000 n -0000330794 00000 n -0000330852 00000 n -0000330942 00000 n -0000334326 00000 n -0000333765 00000 n -0000331199 00000 n -0000333888 00000 n -0000334138 00000 n -0000334263 00000 n -0000336198 00000 n -0000335637 00000 n -0000334451 00000 n -0000335760 00000 n -0000336010 00000 n -0000336135 00000 n -0000337535 00000 n -0000337349 00000 n -0000336297 00000 n -0000337472 00000 n -0000340006 00000 n -0000339695 00000 n -0000337648 00000 n -0000339818 00000 n -0000339943 00000 n -0000342601 00000 n -0000342165 00000 n -0000340132 00000 n -0000342288 00000 n -0000342413 00000 n -0000342538 00000 n -0000483938 00000 n -0000345452 00000 n -0000345141 00000 n -0000342728 00000 n -0000345264 00000 n -0000345389 00000 n -0000347142 00000 n -0000346956 00000 n -0000345592 00000 n -0000347079 00000 n -0000348603 00000 n -0000348417 00000 n -0000347242 00000 n -0000348540 00000 n -0000352039 00000 n -0000351289 00000 n -0000348703 00000 n -0000351412 00000 n -0000351537 00000 n -0000351662 00000 n -0000351725 00000 n -0000351788 00000 n -0000351851 00000 n -0000351914 00000 n -0000351976 00000 n -0000353151 00000 n -0000352965 00000 n -0000352165 00000 n -0000353088 00000 n -0000356577 00000 n -0000355903 00000 n -0000353264 00000 n -0000356199 00000 n -0000356262 00000 n -0000356325 00000 n -0000356388 00000 n -0000356451 00000 n -0000356047 00000 n -0000356514 00000 n -0000484063 00000 n -0000357939 00000 n -0000357753 00000 n -0000356690 00000 n -0000357876 00000 n -0000359416 00000 n -0000359168 00000 n -0000358039 00000 n -0000359291 00000 n -0000359354 00000 n -0000362046 00000 n -0000361427 00000 n -0000359516 00000 n -0000361550 00000 n -0000361613 00000 n -0000361738 00000 n -0000361863 00000 n -0000361983 00000 n -0000362713 00000 n -0000362527 00000 n -0000362159 00000 n -0000362650 00000 n -0000364510 00000 n -0000363949 00000 n -0000362813 00000 n -0000364072 00000 n -0000364322 00000 n -0000364447 00000 n -0000368361 00000 n -0000367664 00000 n -0000364609 00000 n -0000368173 00000 n -0000367817 00000 n -0000367993 00000 n -0000484188 00000 n -0000368447 00000 n -0000375737 00000 n -0000376054 00000 n -0000379602 00000 n -0000379709 00000 n -0000382790 00000 n -0000392049 00000 n -0000401829 00000 n -0000404312 00000 n -0000404343 00000 n -0000408177 00000 n -0000408398 00000 n -0000425874 00000 n -0000445227 00000 n -0000445658 00000 n -0000463251 00000 n -0000467648 00000 n -0000481543 00000 n -0000484268 00000 n -0000484393 00000 n -0000484519 00000 n -0000484645 00000 n -0000484725 00000 n -0000484817 00000 n -0000506847 00000 n -0000522723 00000 n -0000522764 00000 n -0000522804 00000 n -0000523035 00000 n +0000023746 00000 n +0000023807 00000 n +0000480983 00000 n +0000467744 00000 n +0000480817 00000 n +0000467338 00000 n +0000463639 00000 n +0000467175 00000 n +0000481856 00000 n +0000026001 00000 n +0000025083 00000 n +0000023953 00000 n +0000025940 00000 n +0000462818 00000 n +0000446614 00000 n +0000462654 00000 n +0000444669 00000 n +0000426266 00000 n +0000444506 00000 n +0000025246 00000 n +0000425294 00000 n +0000409425 00000 n +0000425130 00000 n +0000025417 00000 n +0000025587 00000 n +0000025758 00000 n +0000029375 00000 n +0000027498 00000 n +0000026099 00000 n +0000029253 00000 n +0000029314 00000 n +0000027709 00000 n +0000407949 00000 n +0000406010 00000 n +0000407785 00000 n +0000027857 00000 n +0000028011 00000 n +0000028158 00000 n +0000028317 00000 n +0000404110 00000 n +0000402099 00000 n +0000403947 00000 n +0000028468 00000 n +0000028655 00000 n +0000028803 00000 n +0000028953 00000 n +0000029102 00000 n +0000093856 00000 n +0000100707 00000 n +0000109170 00000 n +0000122435 00000 n +0000132554 00000 n +0000152968 00000 n +0000162322 00000 n +0000176999 00000 n +0000180423 00000 n +0000035490 00000 n +0000031551 00000 n +0000029486 00000 n +0000035429 00000 n +0000031873 00000 n +0000032043 00000 n +0000032214 00000 n +0000032363 00000 n +0000032538 00000 n +0000032713 00000 n +0000032883 00000 n +0000033033 00000 n +0000033179 00000 n +0000033325 00000 n +0000033477 00000 n +0000033647 00000 n +0000033797 00000 n +0000033969 00000 n +0000034122 00000 n +0000034296 00000 n +0000034468 00000 n +0000034613 00000 n +0000034780 00000 n +0000034953 00000 n +0000035105 00000 n +0000035260 00000 n +0000185461 00000 n +0000278160 00000 n +0000295156 00000 n +0000299354 00000 n +0000315383 00000 n +0000323692 00000 n +0000334023 00000 n +0000335895 00000 n +0000364207 00000 n +0000368308 00000 n +0000044750 00000 n +0000038024 00000 n +0000035588 00000 n +0000044624 00000 n +0000044687 00000 n +0000038509 00000 n +0000038661 00000 n +0000038815 00000 n +0000038970 00000 n +0000039125 00000 n +0000039278 00000 n +0000039433 00000 n +0000039588 00000 n +0000039743 00000 n +0000039897 00000 n +0000040052 00000 n +0000040205 00000 n +0000040359 00000 n +0000040514 00000 n +0000040669 00000 n +0000040824 00000 n +0000040979 00000 n +0000041139 00000 n +0000041299 00000 n +0000041459 00000 n +0000041612 00000 n +0000041765 00000 n +0000041919 00000 n +0000042074 00000 n +0000042229 00000 n +0000042389 00000 n +0000042549 00000 n +0000042709 00000 n +0000042869 00000 n +0000043029 00000 n +0000043189 00000 n +0000043348 00000 n +0000043508 00000 n +0000043668 00000 n +0000043828 00000 n +0000043987 00000 n +0000044147 00000 n +0000044306 00000 n +0000044465 00000 n +0000056343 00000 n +0000048059 00000 n +0000044836 00000 n +0000056280 00000 n +0000401514 00000 n +0000392324 00000 n +0000401348 00000 n +0000048625 00000 n +0000048780 00000 n +0000048940 00000 n +0000049100 00000 n +0000049255 00000 n +0000049408 00000 n +0000049563 00000 n +0000049723 00000 n +0000049882 00000 n +0000050042 00000 n +0000050197 00000 n +0000050356 00000 n +0000050508 00000 n +0000050663 00000 n +0000050818 00000 n +0000050973 00000 n +0000051128 00000 n +0000051283 00000 n +0000051438 00000 n +0000051592 00000 n +0000051747 00000 n +0000051902 00000 n +0000052054 00000 n +0000052205 00000 n +0000052360 00000 n +0000052514 00000 n +0000052670 00000 n +0000052831 00000 n +0000052990 00000 n +0000053146 00000 n +0000053307 00000 n +0000053468 00000 n +0000053633 00000 n +0000053799 00000 n +0000053960 00000 n +0000054126 00000 n +0000054292 00000 n +0000054458 00000 n +0000054624 00000 n +0000054790 00000 n +0000054955 00000 n +0000055120 00000 n +0000055286 00000 n +0000055452 00000 n +0000055618 00000 n +0000055785 00000 n +0000055950 00000 n +0000056115 00000 n +0000069231 00000 n +0000060003 00000 n +0000056443 00000 n +0000069168 00000 n +0000060606 00000 n +0000060773 00000 n +0000060940 00000 n +0000061107 00000 n +0000061274 00000 n +0000061441 00000 n +0000061608 00000 n +0000061775 00000 n +0000061942 00000 n +0000062108 00000 n +0000062275 00000 n +0000062442 00000 n +0000062608 00000 n +0000062775 00000 n +0000062942 00000 n +0000063109 00000 n +0000063276 00000 n +0000063432 00000 n +0000063593 00000 n +0000063754 00000 n +0000063920 00000 n +0000064085 00000 n +0000064251 00000 n +0000064417 00000 n +0000064583 00000 n +0000064748 00000 n +0000064914 00000 n +0000065080 00000 n +0000065241 00000 n +0000065402 00000 n +0000065563 00000 n +0000065724 00000 n +0000065890 00000 n +0000066056 00000 n +0000066216 00000 n +0000066382 00000 n +0000066548 00000 n +0000066708 00000 n +0000066874 00000 n +0000067040 00000 n +0000067201 00000 n +0000067367 00000 n +0000067533 00000 n +0000067695 00000 n +0000067862 00000 n +0000068029 00000 n +0000068190 00000 n +0000068357 00000 n +0000068524 00000 n +0000068685 00000 n +0000068849 00000 n +0000069014 00000 n +0000481976 00000 n +0000080711 00000 n +0000072144 00000 n +0000069318 00000 n +0000080648 00000 n +0000072720 00000 n +0000072881 00000 n +0000073047 00000 n +0000073213 00000 n +0000073374 00000 n +0000073540 00000 n +0000073706 00000 n +0000073867 00000 n +0000074033 00000 n +0000074198 00000 n +0000074359 00000 n +0000074525 00000 n +0000074690 00000 n +0000074851 00000 n +0000075017 00000 n +0000075183 00000 n +0000075339 00000 n +0000075500 00000 n +0000075666 00000 n +0000075832 00000 n +0000075993 00000 n +0000076158 00000 n +0000076324 00000 n +0000076480 00000 n +0000076641 00000 n +0000076806 00000 n +0000076972 00000 n +0000077133 00000 n +0000077299 00000 n +0000077465 00000 n +0000077621 00000 n +0000077782 00000 n +0000077943 00000 n +0000078104 00000 n +0000078259 00000 n +0000078420 00000 n +0000078586 00000 n +0000078751 00000 n +0000078912 00000 n +0000079078 00000 n +0000079244 00000 n +0000079410 00000 n +0000079564 00000 n +0000079720 00000 n +0000079876 00000 n +0000080030 00000 n +0000080186 00000 n +0000080342 00000 n +0000080494 00000 n +0000091194 00000 n +0000083850 00000 n +0000080824 00000 n +0000091131 00000 n +0000084372 00000 n +0000084526 00000 n +0000084682 00000 n +0000084838 00000 n +0000084994 00000 n +0000085150 00000 n +0000085311 00000 n +0000085472 00000 n +0000085633 00000 n +0000085788 00000 n +0000085949 00000 n +0000086110 00000 n +0000086265 00000 n +0000086421 00000 n +0000086575 00000 n +0000086731 00000 n +0000086887 00000 n +0000087043 00000 n +0000087197 00000 n +0000087352 00000 n +0000087508 00000 n +0000087669 00000 n +0000087828 00000 n +0000087983 00000 n +0000088144 00000 n +0000088298 00000 n +0000088454 00000 n +0000088610 00000 n +0000088764 00000 n +0000088919 00000 n +0000089080 00000 n +0000089241 00000 n +0000089397 00000 n +0000089557 00000 n +0000089718 00000 n +0000089874 00000 n +0000090035 00000 n +0000090191 00000 n +0000090352 00000 n +0000090513 00000 n +0000090667 00000 n +0000090822 00000 n +0000090978 00000 n +0000094042 00000 n +0000093610 00000 n +0000091294 00000 n +0000093733 00000 n +0000093979 00000 n +0000098029 00000 n +0000097595 00000 n +0000094128 00000 n +0000097718 00000 n +0000097842 00000 n +0000097966 00000 n +0000101389 00000 n +0000100460 00000 n +0000098142 00000 n +0000100583 00000 n +0000100830 00000 n +0000100893 00000 n +0000100954 00000 n +0000101017 00000 n +0000101140 00000 n +0000101264 00000 n +0000101327 00000 n +0000105616 00000 n +0000104868 00000 n +0000101475 00000 n +0000104991 00000 n +0000105054 00000 n +0000105117 00000 n +0000105180 00000 n +0000105243 00000 n +0000105306 00000 n +0000105430 00000 n +0000105553 00000 n +0000482101 00000 n +0000107124 00000 n +0000106938 00000 n +0000105716 00000 n +0000107061 00000 n +0000109545 00000 n +0000108923 00000 n +0000107211 00000 n +0000109046 00000 n +0000109293 00000 n +0000109356 00000 n +0000109419 00000 n +0000109482 00000 n +0000111814 00000 n +0000111441 00000 n +0000109644 00000 n +0000111564 00000 n +0000111627 00000 n +0000111751 00000 n +0000114018 00000 n +0000113709 00000 n +0000111927 00000 n +0000113832 00000 n +0000113956 00000 n +0000116283 00000 n +0000115784 00000 n +0000114144 00000 n +0000115907 00000 n +0000116031 00000 n +0000116094 00000 n +0000116157 00000 n +0000116220 00000 n +0000118910 00000 n +0000118229 00000 n +0000116396 00000 n +0000118352 00000 n +0000118476 00000 n +0000118600 00000 n +0000118723 00000 n +0000118847 00000 n +0000482226 00000 n +0000122686 00000 n +0000121768 00000 n +0000119010 00000 n +0000122311 00000 n +0000121921 00000 n +0000122121 00000 n +0000122497 00000 n +0000122560 00000 n +0000122623 00000 n +0000127633 00000 n +0000126253 00000 n +0000122785 00000 n +0000126376 00000 n +0000126439 00000 n +0000126502 00000 n +0000126565 00000 n +0000126628 00000 n +0000126691 00000 n +0000126754 00000 n +0000126817 00000 n +0000126880 00000 n +0000126943 00000 n +0000127005 00000 n +0000127068 00000 n +0000127131 00000 n +0000127193 00000 n +0000127256 00000 n +0000127319 00000 n +0000127382 00000 n +0000127445 00000 n +0000127508 00000 n +0000127571 00000 n +0000129812 00000 n +0000129437 00000 n +0000127720 00000 n +0000129560 00000 n +0000129623 00000 n +0000129686 00000 n +0000129749 00000 n +0000133304 00000 n +0000132307 00000 n +0000129899 00000 n +0000132430 00000 n +0000132677 00000 n +0000132801 00000 n +0000132864 00000 n +0000132927 00000 n +0000132990 00000 n +0000133053 00000 n +0000133116 00000 n +0000133179 00000 n +0000133242 00000 n +0000137323 00000 n +0000136387 00000 n +0000133390 00000 n +0000136510 00000 n +0000136573 00000 n +0000136636 00000 n +0000136699 00000 n +0000136762 00000 n +0000136885 00000 n +0000137010 00000 n +0000137135 00000 n +0000137260 00000 n +0000140217 00000 n +0000138910 00000 n +0000137423 00000 n +0000139033 00000 n +0000139158 00000 n +0000139282 00000 n +0000139407 00000 n +0000139532 00000 n +0000139657 00000 n +0000139782 00000 n +0000139906 00000 n +0000140030 00000 n +0000140155 00000 n +0000482351 00000 n +0000143287 00000 n +0000142103 00000 n +0000140317 00000 n +0000142226 00000 n +0000142351 00000 n +0000142475 00000 n +0000142599 00000 n +0000142724 00000 n +0000142849 00000 n +0000142910 00000 n +0000142972 00000 n +0000143035 00000 n +0000143098 00000 n +0000143161 00000 n +0000143224 00000 n +0000147494 00000 n +0000146493 00000 n +0000143400 00000 n +0000146616 00000 n +0000146679 00000 n +0000146742 00000 n +0000146805 00000 n +0000146867 00000 n +0000146930 00000 n +0000146993 00000 n +0000147056 00000 n +0000147118 00000 n +0000147243 00000 n +0000147306 00000 n +0000147369 00000 n +0000147431 00000 n +0000150522 00000 n +0000149582 00000 n +0000147594 00000 n +0000149705 00000 n +0000149830 00000 n +0000149893 00000 n +0000149956 00000 n +0000150019 00000 n +0000150082 00000 n +0000150145 00000 n +0000150208 00000 n +0000150271 00000 n +0000150333 00000 n +0000150396 00000 n +0000150459 00000 n +0000153970 00000 n +0000152720 00000 n +0000150622 00000 n +0000152843 00000 n +0000153092 00000 n +0000153155 00000 n +0000153218 00000 n +0000153281 00000 n +0000153343 00000 n +0000153406 00000 n +0000153469 00000 n +0000153531 00000 n +0000153656 00000 n +0000153719 00000 n +0000153782 00000 n +0000153845 00000 n +0000153908 00000 n +0000156122 00000 n +0000155686 00000 n +0000154069 00000 n +0000155809 00000 n +0000155934 00000 n +0000156059 00000 n +0000158319 00000 n +0000157758 00000 n +0000156248 00000 n +0000157881 00000 n +0000158004 00000 n +0000158067 00000 n +0000158130 00000 n +0000158193 00000 n +0000158256 00000 n +0000482476 00000 n +0000159398 00000 n +0000159087 00000 n +0000158445 00000 n +0000159210 00000 n +0000159335 00000 n +0000162634 00000 n +0000162074 00000 n +0000159498 00000 n +0000162197 00000 n +0000162446 00000 n +0000162571 00000 n +0000166295 00000 n +0000165734 00000 n +0000162733 00000 n +0000165857 00000 n +0000165982 00000 n +0000166107 00000 n +0000166232 00000 n +0000170118 00000 n +0000169558 00000 n +0000166395 00000 n +0000169681 00000 n +0000169806 00000 n +0000169930 00000 n +0000170055 00000 n +0000173980 00000 n +0000173671 00000 n +0000170231 00000 n +0000173794 00000 n +0000173919 00000 n +0000177061 00000 n +0000176751 00000 n +0000174080 00000 n +0000176874 00000 n +0000391721 00000 n +0000382823 00000 n +0000391555 00000 n +0000382588 00000 n +0000380714 00000 n +0000382422 00000 n +0000482601 00000 n +0000179131 00000 n +0000178945 00000 n +0000177188 00000 n +0000179068 00000 n +0000180924 00000 n +0000180175 00000 n +0000179259 00000 n +0000180298 00000 n +0000180547 00000 n +0000180610 00000 n +0000180673 00000 n +0000180736 00000 n +0000180798 00000 n +0000180861 00000 n +0000185649 00000 n +0000183773 00000 n +0000181023 00000 n +0000185336 00000 n +0000185586 00000 n +0000183971 00000 n +0000184164 00000 n +0000184358 00000 n +0000184580 00000 n +0000184767 00000 n +0000184943 00000 n +0000185149 00000 n +0000189410 00000 n +0000188290 00000 n +0000185774 00000 n +0000188413 00000 n +0000188476 00000 n +0000188539 00000 n +0000188602 00000 n +0000188661 00000 n +0000188724 00000 n +0000188849 00000 n +0000188974 00000 n +0000189099 00000 n +0000189222 00000 n +0000189285 00000 n +0000189348 00000 n +0000192745 00000 n +0000191997 00000 n +0000189510 00000 n +0000192120 00000 n +0000192183 00000 n +0000192246 00000 n +0000192309 00000 n +0000192434 00000 n +0000192557 00000 n +0000192682 00000 n +0000195465 00000 n +0000194408 00000 n +0000192845 00000 n +0000194531 00000 n +0000194656 00000 n +0000194781 00000 n +0000194906 00000 n +0000195031 00000 n +0000195153 00000 n +0000195278 00000 n +0000195403 00000 n +0000482726 00000 n +0000198049 00000 n +0000197113 00000 n +0000195578 00000 n +0000197236 00000 n +0000197361 00000 n +0000197486 00000 n +0000197611 00000 n +0000197736 00000 n +0000197861 00000 n +0000197986 00000 n +0000200936 00000 n +0000200252 00000 n +0000198149 00000 n +0000200375 00000 n +0000200500 00000 n +0000200624 00000 n +0000200749 00000 n +0000200874 00000 n +0000203783 00000 n +0000203100 00000 n +0000201062 00000 n +0000203223 00000 n +0000203348 00000 n +0000203473 00000 n +0000203597 00000 n +0000203721 00000 n +0000206427 00000 n +0000205991 00000 n +0000203909 00000 n +0000206114 00000 n +0000206239 00000 n +0000206364 00000 n +0000208902 00000 n +0000208342 00000 n +0000206553 00000 n +0000208465 00000 n +0000208590 00000 n +0000208714 00000 n +0000208839 00000 n +0000211048 00000 n +0000210737 00000 n +0000209015 00000 n +0000210860 00000 n +0000210985 00000 n +0000482851 00000 n +0000213807 00000 n +0000213371 00000 n +0000211161 00000 n +0000213494 00000 n +0000213619 00000 n +0000213744 00000 n +0000216798 00000 n +0000216362 00000 n +0000213920 00000 n +0000216485 00000 n +0000216610 00000 n +0000216735 00000 n +0000219833 00000 n +0000219522 00000 n +0000216924 00000 n +0000219645 00000 n +0000219770 00000 n +0000223229 00000 n +0000222793 00000 n +0000219933 00000 n +0000222916 00000 n +0000223041 00000 n +0000223166 00000 n +0000226161 00000 n +0000225725 00000 n +0000223368 00000 n +0000225848 00000 n +0000225973 00000 n +0000226098 00000 n +0000229069 00000 n +0000228383 00000 n +0000226287 00000 n +0000228506 00000 n +0000228631 00000 n +0000228756 00000 n +0000228881 00000 n +0000229006 00000 n +0000482976 00000 n +0000231683 00000 n +0000231122 00000 n +0000229169 00000 n +0000231245 00000 n +0000231370 00000 n +0000231495 00000 n +0000231620 00000 n +0000234569 00000 n +0000234135 00000 n +0000231783 00000 n +0000234258 00000 n +0000234383 00000 n +0000234506 00000 n +0000237150 00000 n +0000236589 00000 n +0000234695 00000 n +0000236712 00000 n +0000236837 00000 n +0000236962 00000 n +0000237087 00000 n +0000239632 00000 n +0000238697 00000 n +0000237276 00000 n +0000238820 00000 n +0000238945 00000 n +0000239070 00000 n +0000239194 00000 n +0000239319 00000 n +0000239444 00000 n +0000239569 00000 n +0000242332 00000 n +0000241146 00000 n +0000239758 00000 n +0000241269 00000 n +0000241394 00000 n +0000241519 00000 n +0000241644 00000 n +0000241769 00000 n +0000241894 00000 n +0000242019 00000 n +0000242144 00000 n +0000242269 00000 n +0000244957 00000 n +0000244396 00000 n +0000242445 00000 n +0000244519 00000 n +0000244644 00000 n +0000244769 00000 n +0000244894 00000 n +0000483101 00000 n +0000247736 00000 n +0000247176 00000 n +0000245070 00000 n +0000247299 00000 n +0000247424 00000 n +0000247549 00000 n +0000247674 00000 n +0000250651 00000 n +0000249965 00000 n +0000247862 00000 n +0000250088 00000 n +0000250213 00000 n +0000250338 00000 n +0000250463 00000 n +0000250588 00000 n +0000253679 00000 n +0000252745 00000 n +0000250764 00000 n +0000252868 00000 n +0000252993 00000 n +0000253118 00000 n +0000253243 00000 n +0000253368 00000 n +0000253493 00000 n +0000253617 00000 n +0000255982 00000 n +0000255297 00000 n +0000253792 00000 n +0000255420 00000 n +0000255545 00000 n +0000255670 00000 n +0000255794 00000 n +0000255919 00000 n +0000258601 00000 n +0000257915 00000 n +0000256108 00000 n +0000258038 00000 n +0000258163 00000 n +0000258288 00000 n +0000258413 00000 n +0000258538 00000 n +0000260993 00000 n +0000260432 00000 n +0000258740 00000 n +0000260555 00000 n +0000260680 00000 n +0000260805 00000 n +0000260930 00000 n +0000483226 00000 n +0000263725 00000 n +0000263041 00000 n +0000261119 00000 n +0000263164 00000 n +0000263289 00000 n +0000263413 00000 n +0000263537 00000 n +0000263662 00000 n +0000266708 00000 n +0000265897 00000 n +0000263838 00000 n +0000266020 00000 n +0000266145 00000 n +0000266270 00000 n +0000266395 00000 n +0000266520 00000 n +0000266645 00000 n +0000268457 00000 n +0000268146 00000 n +0000266821 00000 n +0000268269 00000 n +0000268394 00000 n +0000271406 00000 n +0000270721 00000 n +0000268570 00000 n +0000270844 00000 n +0000270968 00000 n +0000271093 00000 n +0000271218 00000 n +0000271343 00000 n +0000273983 00000 n +0000273424 00000 n +0000271519 00000 n +0000273547 00000 n +0000273672 00000 n +0000273795 00000 n +0000273920 00000 n +0000275926 00000 n +0000275490 00000 n +0000274096 00000 n +0000275613 00000 n +0000275738 00000 n +0000275863 00000 n +0000483351 00000 n +0000278597 00000 n +0000277912 00000 n +0000276039 00000 n +0000278035 00000 n +0000278285 00000 n +0000278410 00000 n +0000278535 00000 n +0000282596 00000 n +0000282159 00000 n +0000278696 00000 n +0000282282 00000 n +0000282345 00000 n +0000282408 00000 n +0000282471 00000 n +0000282534 00000 n +0000285834 00000 n +0000285146 00000 n +0000282709 00000 n +0000285269 00000 n +0000285332 00000 n +0000285395 00000 n +0000285458 00000 n +0000285521 00000 n +0000285646 00000 n +0000285771 00000 n +0000288185 00000 n +0000287999 00000 n +0000285947 00000 n +0000288122 00000 n +0000291737 00000 n +0000291551 00000 n +0000288298 00000 n +0000291674 00000 n +0000293057 00000 n +0000292871 00000 n +0000291850 00000 n +0000292994 00000 n +0000483476 00000 n +0000295344 00000 n +0000294908 00000 n +0000293157 00000 n +0000295031 00000 n +0000295281 00000 n +0000296489 00000 n +0000296303 00000 n +0000295443 00000 n +0000296426 00000 n +0000299542 00000 n +0000299106 00000 n +0000296576 00000 n +0000299229 00000 n +0000299479 00000 n +0000303473 00000 n +0000303038 00000 n +0000299641 00000 n +0000303161 00000 n +0000303286 00000 n +0000303410 00000 n +0000307176 00000 n +0000306240 00000 n +0000303586 00000 n +0000306363 00000 n +0000306488 00000 n +0000306613 00000 n +0000306738 00000 n +0000306863 00000 n +0000306988 00000 n +0000307113 00000 n +0000310254 00000 n +0000309818 00000 n +0000307289 00000 n +0000309941 00000 n +0000310066 00000 n +0000310191 00000 n +0000483601 00000 n +0000312313 00000 n +0000312002 00000 n +0000310367 00000 n +0000312125 00000 n +0000312250 00000 n +0000315695 00000 n +0000315135 00000 n +0000312440 00000 n +0000315258 00000 n +0000315508 00000 n +0000315633 00000 n +0000318833 00000 n +0000318459 00000 n +0000315781 00000 n +0000318582 00000 n +0000318707 00000 n +0000318770 00000 n +0000321620 00000 n +0000321434 00000 n +0000318973 00000 n +0000321557 00000 n +0000324129 00000 n +0000323444 00000 n +0000321747 00000 n +0000323567 00000 n +0000323817 00000 n +0000323942 00000 n +0000324066 00000 n +0000327674 00000 n +0000327114 00000 n +0000324228 00000 n +0000327237 00000 n +0000327362 00000 n +0000327487 00000 n +0000327611 00000 n +0000483726 00000 n +0000329445 00000 n +0000331038 00000 n +0000329322 00000 n +0000327787 00000 n +0000330975 00000 n +0000379408 00000 n +0000377073 00000 n +0000379241 00000 n +0000375450 00000 n +0000369404 00000 n +0000375284 00000 n +0000330804 00000 n +0000330862 00000 n +0000330952 00000 n +0000334336 00000 n +0000333775 00000 n +0000331209 00000 n +0000333898 00000 n +0000334148 00000 n +0000334273 00000 n +0000336208 00000 n +0000335647 00000 n +0000334461 00000 n +0000335770 00000 n +0000336020 00000 n +0000336145 00000 n +0000337545 00000 n +0000337359 00000 n +0000336307 00000 n +0000337482 00000 n +0000340016 00000 n +0000339705 00000 n +0000337658 00000 n +0000339828 00000 n +0000339953 00000 n +0000342611 00000 n +0000342175 00000 n +0000340142 00000 n +0000342298 00000 n +0000342423 00000 n +0000342548 00000 n +0000483851 00000 n +0000345462 00000 n +0000345151 00000 n +0000342738 00000 n +0000345274 00000 n +0000345399 00000 n +0000347152 00000 n +0000346966 00000 n +0000345602 00000 n +0000347089 00000 n +0000348613 00000 n +0000348427 00000 n +0000347252 00000 n +0000348550 00000 n +0000352049 00000 n +0000351299 00000 n +0000348713 00000 n +0000351422 00000 n +0000351547 00000 n +0000351672 00000 n +0000351735 00000 n +0000351798 00000 n +0000351861 00000 n +0000351924 00000 n +0000351986 00000 n +0000353161 00000 n +0000352975 00000 n +0000352175 00000 n +0000353098 00000 n +0000356587 00000 n +0000355913 00000 n +0000353274 00000 n +0000356209 00000 n +0000356272 00000 n +0000356335 00000 n +0000356398 00000 n +0000356461 00000 n +0000356057 00000 n +0000356524 00000 n +0000483976 00000 n +0000357949 00000 n +0000357763 00000 n +0000356700 00000 n +0000357886 00000 n +0000359426 00000 n +0000359178 00000 n +0000358049 00000 n +0000359301 00000 n +0000359364 00000 n +0000362056 00000 n +0000361437 00000 n +0000359526 00000 n +0000361560 00000 n +0000361623 00000 n +0000361748 00000 n +0000361873 00000 n +0000361993 00000 n +0000362723 00000 n +0000362537 00000 n +0000362169 00000 n +0000362660 00000 n +0000364520 00000 n +0000363959 00000 n +0000362823 00000 n +0000364082 00000 n +0000364332 00000 n +0000364457 00000 n +0000368371 00000 n +0000367674 00000 n +0000364619 00000 n +0000368183 00000 n +0000367827 00000 n +0000368003 00000 n +0000484101 00000 n +0000368457 00000 n +0000375746 00000 n +0000376063 00000 n +0000379611 00000 n +0000379718 00000 n +0000382798 00000 n +0000392057 00000 n +0000401837 00000 n +0000404321 00000 n +0000404352 00000 n +0000408185 00000 n +0000408406 00000 n +0000425881 00000 n +0000445234 00000 n +0000445665 00000 n +0000463258 00000 n +0000467563 00000 n +0000481456 00000 n +0000484181 00000 n +0000484306 00000 n +0000484432 00000 n +0000484558 00000 n +0000484638 00000 n +0000484730 00000 n +0000506760 00000 n +0000522636 00000 n +0000522677 00000 n +0000522717 00000 n +0000522948 00000 n trailer << /Size 2097 @@ -13006,5 +13002,5 @@ trailer /Info 2096 0 R >> startxref -523191 +523104 %%EOF diff --git a/docs/Samba-HOWTO-Collection.pdf b/docs/Samba-HOWTO-Collection.pdf index a33f75fa06..4a42345aad 100644 --- a/docs/Samba-HOWTO-Collection.pdf +++ b/docs/Samba-HOWTO-Collection.pdf @@ -57,11916 +57,12250 @@ endobj << /S /GoTo /D (section.2.1) >> endobj 44 0 obj -(2.1 Obtaining and installing samba) +(2.1 Obtaining and Installing Samba) endobj 45 0 obj << /S /GoTo /D (section.2.2) >> endobj 48 0 obj -(2.2 Configuring samba \(smb.conf\)) +(2.2 Configuring Samba \(smb.conf\)) endobj 49 0 obj << /S /GoTo /D (subsection.2.2.1) >> endobj 52 0 obj -(2.2.1 Example Configuration) +(2.2.1 Configuration file syntax) endobj 53 0 obj -<< /S /GoTo /D (subsubsection.2.2.1.1) >> +<< /S /GoTo /D (subsection.2.2.2) >> endobj 56 0 obj -(2.2.1.1 Test your config file with testparm) +(2.2.2 Example Configuration) endobj 57 0 obj -<< /S /GoTo /D (subsection.2.2.2) >> +<< /S /GoTo /D (subsubsection.2.2.2.1) >> endobj 60 0 obj -(2.2.2 SWAT) +(2.2.2.1 Test Your Config File with testparm) endobj 61 0 obj -<< /S /GoTo /D (section.2.3) >> +<< /S /GoTo /D (subsection.2.2.3) >> endobj 64 0 obj -(2.3 Try listing the shares available on your server) +(2.2.3 SWAT) endobj 65 0 obj -<< /S /GoTo /D (section.2.4) >> +<< /S /GoTo /D (section.2.3) >> endobj 68 0 obj -(2.4 Try connecting with the unix client) +(2.3 List Shares Available on the Server) endobj 69 0 obj -<< /S /GoTo /D (section.2.5) >> +<< /S /GoTo /D (section.2.4) >> endobj 72 0 obj -(2.5 Try connecting from another SMB client) +(2.4 Connect with a UNIX Client) endobj 73 0 obj -<< /S /GoTo /D (section.2.6) >> +<< /S /GoTo /D (section.2.5) >> endobj 76 0 obj -(2.6 What If Things Don't Work?) +(2.5 Connect from a Remote SMB Client) endobj 77 0 obj -<< /S /GoTo /D (section.2.7) >> +<< /S /GoTo /D (section.2.6) >> endobj 80 0 obj -(2.7 Common Errors) +(2.6 What If Things Don't Work?) endobj 81 0 obj -<< /S /GoTo /D (subsection.2.7.1) >> +<< /S /GoTo /D (section.2.7) >> endobj 84 0 obj -(2.7.1 Large number of smbd processes) +(2.7 Common Errors) endobj 85 0 obj -<< /S /GoTo /D (subsection.2.7.2) >> +<< /S /GoTo /D (subsection.2.7.1) >> endobj 88 0 obj -(2.7.2 "open\137oplock\137ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested") +(2.7.1 Large Number of smbd Processes) endobj 89 0 obj -<< /S /GoTo /D (subsection.2.7.3) >> +<< /S /GoTo /D (subsection.2.7.2) >> endobj 92 0 obj -(2.7.3 "The network name cannot be found") +(2.7.2 Error Message: open\137oplock\137ipc) endobj 93 0 obj -<< /S /GoTo /D (chapter.3) >> +<< /S /GoTo /D (subsection.2.7.3) >> endobj 96 0 obj -(3 Fast Start for the Impatient) +(2.7.3 ``The network name cannot be found'') endobj 97 0 obj -<< /S /GoTo /D (section.3.1) >> +<< /S /GoTo /D (chapter.3) >> endobj 100 0 obj -(3.1 Note) +(3 Fast Start for the Impatient) endobj 101 0 obj -<< /S /GoTo /D (part.2) >> +<< /S /GoTo /D (section.3.1) >> endobj 104 0 obj -(II Server Configuration Basics) +(3.1 Note) endobj 105 0 obj -<< /S /GoTo /D (chapter.4) >> +<< /S /GoTo /D (part.2) >> endobj 108 0 obj -(4 Server Types and Security Modes) +(II Server Configuration Basics) endobj 109 0 obj -<< /S /GoTo /D (section.4.1) >> +<< /S /GoTo /D (chapter.4) >> endobj 112 0 obj -(4.1 Features and Benefits) +(4 Server Types and Security Modes) endobj 113 0 obj -<< /S /GoTo /D (section.4.2) >> +<< /S /GoTo /D (section.4.1) >> endobj 116 0 obj -(4.2 Server Types) +(4.1 Features and Benefits) endobj 117 0 obj -<< /S /GoTo /D (section.4.3) >> +<< /S /GoTo /D (section.4.2) >> endobj 120 0 obj -(4.3 Samba Security Modes) +(4.2 Server Types) endobj 121 0 obj -<< /S /GoTo /D (subsection.4.3.1) >> +<< /S /GoTo /D (section.4.3) >> endobj 124 0 obj -(4.3.1 User Level Security) +(4.3 Samba Security Modes) endobj 125 0 obj -<< /S /GoTo /D (subsubsection.4.3.1.1) >> +<< /S /GoTo /D (subsection.4.3.1) >> endobj 128 0 obj -(4.3.1.1 Example Configuration) +(4.3.1 User Level Security) endobj 129 0 obj -<< /S /GoTo /D (subsection.4.3.2) >> +<< /S /GoTo /D (subsubsection.4.3.1.1) >> endobj 132 0 obj -(4.3.2 Share Level Security) +(4.3.1.1 Example Configuration) endobj 133 0 obj -<< /S /GoTo /D (subsubsection.4.3.2.1) >> +<< /S /GoTo /D (subsection.4.3.2) >> endobj 136 0 obj -(4.3.2.1 Example Configuration) +(4.3.2 Share Level Security) endobj 137 0 obj -<< /S /GoTo /D (subsection.4.3.3) >> +<< /S /GoTo /D (subsubsection.4.3.2.1) >> endobj 140 0 obj -(4.3.3 Domain Security Mode \(User Level Security\)) +(4.3.2.1 Example Configuration) endobj 141 0 obj -<< /S /GoTo /D (subsubsection.4.3.3.1) >> +<< /S /GoTo /D (subsection.4.3.3) >> endobj 144 0 obj -(4.3.3.1 Example Configuration) +(4.3.3 Domain Security Mode \(User Level Security\)) endobj 145 0 obj -<< /S /GoTo /D (subsection.4.3.4) >> +<< /S /GoTo /D (subsubsection.4.3.3.1) >> endobj 148 0 obj -(4.3.4 ADS Security Mode \(User Level Security\)) +(4.3.3.1 Example Configuration) endobj 149 0 obj -<< /S /GoTo /D (subsubsection.4.3.4.1) >> +<< /S /GoTo /D (subsection.4.3.4) >> endobj 152 0 obj -(4.3.4.1 Example Configuration) +(4.3.4 ADS Security Mode \(User Level Security\)) endobj 153 0 obj -<< /S /GoTo /D (subsection.4.3.5) >> +<< /S /GoTo /D (subsubsection.4.3.4.1) >> endobj 156 0 obj -(4.3.5 Server Security \(User Level Security\)) +(4.3.4.1 Example Configuration) endobj 157 0 obj -<< /S /GoTo /D (subsubsection.4.3.5.1) >> +<< /S /GoTo /D (subsection.4.3.5) >> endobj 160 0 obj -(4.3.5.1 Example Configuration) +(4.3.5 Server Security \(User Level Security\)) endobj 161 0 obj -<< /S /GoTo /D (section.4.4) >> +<< /S /GoTo /D (subsubsection.4.3.5.1) >> endobj 164 0 obj -(4.4 Password checking) +(4.3.5.1 Example Configuration) endobj 165 0 obj -<< /S /GoTo /D (section.4.5) >> +<< /S /GoTo /D (section.4.4) >> endobj 168 0 obj -(4.5 Common Errors) +(4.4 Password Checking) endobj 169 0 obj -<< /S /GoTo /D (subsection.4.5.1) >> +<< /S /GoTo /D (section.4.5) >> endobj 172 0 obj -(4.5.1 What makes Samba a SERVER?) +(4.5 Common Errors) endobj 173 0 obj -<< /S /GoTo /D (subsection.4.5.2) >> +<< /S /GoTo /D (subsection.4.5.1) >> endobj 176 0 obj -(4.5.2 What makes Samba a Domain Controller?) +(4.5.1 What Makes Samba a Server?) endobj 177 0 obj -<< /S /GoTo /D (subsection.4.5.3) >> +<< /S /GoTo /D (subsection.4.5.2) >> endobj 180 0 obj -(4.5.3 What makes Samba a Domain Member?) +(4.5.2 What Makes Samba a Domain Controller?) endobj 181 0 obj -<< /S /GoTo /D (subsection.4.5.4) >> +<< /S /GoTo /D (subsection.4.5.3) >> endobj 184 0 obj -(4.5.4 Constantly Losing Connections to Password Server) +(4.5.3 What Makes Samba a Domain Member?) endobj 185 0 obj -<< /S /GoTo /D (chapter.5) >> +<< /S /GoTo /D (subsection.4.5.4) >> endobj 188 0 obj -(5 Domain Control) +(4.5.4 Constantly Losing Connections to Password Server) endobj 189 0 obj -<< /S /GoTo /D (section.5.1) >> +<< /S /GoTo /D (chapter.5) >> endobj 192 0 obj -(5.1 Features and Benefits) +(5 Domain Control) endobj 193 0 obj -<< /S /GoTo /D (section.5.2) >> +<< /S /GoTo /D (section.5.1) >> endobj 196 0 obj -(5.2 Basics of Domain Control) +(5.1 Features and Benefits) endobj 197 0 obj -<< /S /GoTo /D (subsection.5.2.1) >> +<< /S /GoTo /D (section.5.2) >> endobj 200 0 obj -(5.2.1 Domain Controller Types) +(5.2 Basics of Domain Control) endobj 201 0 obj -<< /S /GoTo /D (subsection.5.2.2) >> +<< /S /GoTo /D (subsection.5.2.1) >> endobj 204 0 obj -(5.2.2 Preparing for Domain Control) +(5.2.1 Domain Controller Types) endobj 205 0 obj -<< /S /GoTo /D (section.5.3) >> +<< /S /GoTo /D (subsection.5.2.2) >> endobj 208 0 obj -(5.3 Domain Control - Example Configuration) +(5.2.2 Preparing for Domain Control) endobj 209 0 obj -<< /S /GoTo /D (section.5.4) >> +<< /S /GoTo /D (section.5.3) >> endobj 212 0 obj -(5.4 Samba ADS Domain Control) +(5.3 Domain Control --- Example Configuration) endobj 213 0 obj -<< /S /GoTo /D (section.5.5) >> +<< /S /GoTo /D (section.5.4) >> endobj 216 0 obj -(5.5 Domain and Network Logon Configuration) +(5.4 Samba ADS Domain Control) endobj 217 0 obj -<< /S /GoTo /D (subsection.5.5.1) >> +<< /S /GoTo /D (section.5.5) >> endobj 220 0 obj -(5.5.1 Domain Network Logon Service) +(5.5 Domain and Network Logon Configuration) endobj 221 0 obj -<< /S /GoTo /D (subsubsection.5.5.1.1) >> +<< /S /GoTo /D (subsection.5.5.1) >> endobj 224 0 obj -(5.5.1.1 Example Configuration) +(5.5.1 Domain Network Logon Service) endobj 225 0 obj -<< /S /GoTo /D (subsubsection.5.5.1.2) >> +<< /S /GoTo /D (subsubsection.5.5.1.1) >> endobj 228 0 obj -(5.5.1.2 The Special Case of MS Windows XP Home Edition) +(5.5.1.1 Example Configuration) endobj 229 0 obj -<< /S /GoTo /D (subsubsection.5.5.1.3) >> +<< /S /GoTo /D (subsubsection.5.5.1.2) >> endobj 232 0 obj -(5.5.1.3 The Special Case of Windows 9x / Me) +(5.5.1.2 The Special Case of MS Windows XP Home Edition) endobj 233 0 obj -<< /S /GoTo /D (subsection.5.5.2) >> +<< /S /GoTo /D (subsubsection.5.5.1.3) >> endobj 236 0 obj -(5.5.2 Security Mode and Master Browsers) +(5.5.1.3 The Special Case of Windows 9x/Me) endobj 237 0 obj -<< /S /GoTo /D (section.5.6) >> +<< /S /GoTo /D (subsection.5.5.2) >> endobj 240 0 obj -(5.6 Common Errors) +(5.5.2 Security Mode and Master Browsers) endobj 241 0 obj -<< /S /GoTo /D (subsection.5.6.1) >> +<< /S /GoTo /D (section.5.6) >> endobj 244 0 obj -(5.6.1 '\044' cannot be included in machine name) +(5.6 Common Errors) endobj 245 0 obj -<< /S /GoTo /D (subsection.5.6.2) >> +<< /S /GoTo /D (subsection.5.6.1) >> endobj 248 0 obj -(5.6.2 Joining domain fails because of existing machine account) +(5.6.1 ``\044'' Cannot Be Included in Machine Name) endobj 249 0 obj -<< /S /GoTo /D (subsection.5.6.3) >> +<< /S /GoTo /D (subsection.5.6.2) >> endobj 252 0 obj -(5.6.3 The system can not log you on \(C000019B\)....) +(5.6.2 Joining Domain Fails Because of Existing Machine Account) endobj 253 0 obj -<< /S /GoTo /D (subsection.5.6.4) >> +<< /S /GoTo /D (subsection.5.6.3) >> endobj 256 0 obj -(5.6.4 The machine trust account not accessible) +(5.6.3 The System Cannot Log You On \(C000019B\)) endobj 257 0 obj -<< /S /GoTo /D (subsection.5.6.5) >> +<< /S /GoTo /D (subsection.5.6.4) >> endobj 260 0 obj -(5.6.5 Account disabled) +(5.6.4 The Machine Trust Account Is Not Accessible) endobj 261 0 obj -<< /S /GoTo /D (subsection.5.6.6) >> +<< /S /GoTo /D (subsection.5.6.5) >> endobj 264 0 obj -(5.6.6 Domain Controller Unavailable) +(5.6.5 Account Disabled) endobj 265 0 obj -<< /S /GoTo /D (subsection.5.6.7) >> +<< /S /GoTo /D (subsection.5.6.6) >> endobj 268 0 obj -(5.6.7 Can not log onto domain member workstation after joining domain) +(5.6.6 Domain Controller Unavailable) endobj 269 0 obj -<< /S /GoTo /D (chapter.6) >> +<< /S /GoTo /D (subsection.5.6.7) >> endobj 272 0 obj -(6 Backup Domain Control) +(5.6.7 Cannot Log onto Domain Member Workstation After Joining Domain) endobj 273 0 obj -<< /S /GoTo /D (section.6.1) >> +<< /S /GoTo /D (chapter.6) >> endobj 276 0 obj -(6.1 Features And Benefits) +(6 Backup Domain Control) endobj 277 0 obj -<< /S /GoTo /D (section.6.2) >> +<< /S /GoTo /D (section.6.1) >> endobj 280 0 obj -(6.2 Essential Background Information) +(6.1 Features and Benefits) endobj 281 0 obj -<< /S /GoTo /D (subsection.6.2.1) >> +<< /S /GoTo /D (section.6.2) >> endobj 284 0 obj -(6.2.1 MS Windows NT4 Style Domain Control) +(6.2 Essential Background Information) endobj 285 0 obj -<< /S /GoTo /D (subsubsection.6.2.1.1) >> +<< /S /GoTo /D (subsection.6.2.1) >> endobj 288 0 obj -(6.2.1.1 Example PDC Configuration) +(6.2.1 MS Windows NT4-style Domain Control) endobj 289 0 obj -<< /S /GoTo /D (subsection.6.2.2) >> +<< /S /GoTo /D (subsubsection.6.2.1.1) >> endobj 292 0 obj -(6.2.2 Active Directory Domain Control) +(6.2.1.1 Example PDC Configuration) endobj 293 0 obj -<< /S /GoTo /D (subsection.6.2.3) >> +<< /S /GoTo /D (subsection.6.2.2) >> endobj 296 0 obj -(6.2.3 What qualifies a Domain Controller on the network?) +(6.2.2 LDAP Configuration Notes) endobj 297 0 obj -<< /S /GoTo /D (subsection.6.2.4) >> +<< /S /GoTo /D (subsection.6.2.3) >> endobj 300 0 obj -(6.2.4 How does a Workstation find its domain controller?) +(6.2.3 Active Directory Domain Control) endobj 301 0 obj -<< /S /GoTo /D (section.6.3) >> +<< /S /GoTo /D (subsection.6.2.4) >> endobj 304 0 obj -(6.3 Backup Domain Controller Configuration) +(6.2.4 What Qualifies a Domain Controller on the Network?) endobj 305 0 obj -<< /S /GoTo /D (subsection.6.3.1) >> +<< /S /GoTo /D (subsection.6.2.5) >> endobj 308 0 obj -(6.3.1 Example Configuration) +(6.2.5 How does a Workstation find its Domain Controller?) endobj 309 0 obj -<< /S /GoTo /D (section.6.4) >> +<< /S /GoTo /D (subsubsection.6.2.5.1) >> endobj 312 0 obj -(6.4 Common Errors) +(6.2.5.1 NetBIOS Over TCP/IP Enabled) endobj 313 0 obj -<< /S /GoTo /D (subsection.6.4.1) >> +<< /S /GoTo /D (subsubsection.6.2.5.2) >> endobj 316 0 obj -(6.4.1 Machine Accounts keep expiring, what can I do?) +(6.2.5.2 NetBIOS Over TCP/IP Disabled) endobj 317 0 obj -<< /S /GoTo /D (subsection.6.4.2) >> +<< /S /GoTo /D (section.6.3) >> endobj 320 0 obj -(6.4.2 Can Samba be a Backup Domain Controller to an NT4 PDC?) +(6.3 Backup Domain Controller Configuration) endobj 321 0 obj -<< /S /GoTo /D (subsection.6.4.3) >> +<< /S /GoTo /D (subsection.6.3.1) >> endobj 324 0 obj -(6.4.3 How do I replicate the smbpasswd file?) +(6.3.1 Example Configuration) endobj 325 0 obj -<< /S /GoTo /D (subsection.6.4.4) >> +<< /S /GoTo /D (section.6.4) >> endobj 328 0 obj -(6.4.4 Can I do this all with LDAP?) +(6.4 Common Errors) endobj 329 0 obj -<< /S /GoTo /D (chapter.7) >> +<< /S /GoTo /D (subsection.6.4.1) >> endobj 332 0 obj -(7 Domain Membership) +(6.4.1 Machine Accounts Keep Expiring) endobj 333 0 obj -<< /S /GoTo /D (section.7.1) >> +<< /S /GoTo /D (subsection.6.4.2) >> endobj 336 0 obj -(7.1 Features and Benefits) +(6.4.2 Can Samba Be a Backup Domain Controller to an NT4 PDC?) endobj 337 0 obj -<< /S /GoTo /D (section.7.2) >> +<< /S /GoTo /D (subsection.6.4.3) >> endobj 340 0 obj -(7.2 MS Windows Workstation/Server Machine Trust Accounts) +(6.4.3 How Do I Replicate the smbpasswd File?) endobj 341 0 obj -<< /S /GoTo /D (subsection.7.2.1) >> +<< /S /GoTo /D (subsection.6.4.4) >> endobj 344 0 obj -(7.2.1 Manual Creation of Machine Trust Accounts) +(6.4.4 Can I Do This All with LDAP?) endobj 345 0 obj -<< /S /GoTo /D (subsection.7.2.2) >> +<< /S /GoTo /D (chapter.7) >> endobj 348 0 obj -(7.2.2 Using NT4 Server Manager to Add Machine Accounts to the Domain) +(7 Domain Membership) endobj 349 0 obj -<< /S /GoTo /D (subsection.7.2.3) >> +<< /S /GoTo /D (section.7.1) >> endobj 352 0 obj -(7.2.3 "On-the-Fly" Creation of Machine Trust Accounts) +(7.1 Features and Benefits) endobj 353 0 obj -<< /S /GoTo /D (subsection.7.2.4) >> +<< /S /GoTo /D (section.7.2) >> endobj 356 0 obj -(7.2.4 Making an MS Windows Workstation or Server a Domain Member) +(7.2 MS Windows Workstation/Server Machine Trust Accounts) endobj 357 0 obj -<< /S /GoTo /D (subsubsection.7.2.4.1) >> +<< /S /GoTo /D (subsection.7.2.1) >> endobj 360 0 obj -(7.2.4.1 Windows 200x XP Professional) +(7.2.1 Manual Creation of Machine Trust Accounts) endobj 361 0 obj -<< /S /GoTo /D (subsubsection.7.2.4.2) >> +<< /S /GoTo /D (subsection.7.2.2) >> endobj 364 0 obj -(7.2.4.2 Windows NT4) +(7.2.2 Managing Domain Machine Accounts using NT4 Server Manager) endobj 365 0 obj -<< /S /GoTo /D (subsubsection.7.2.4.3) >> +<< /S /GoTo /D (subsection.7.2.3) >> endobj 368 0 obj -(7.2.4.3 Samba) +(7.2.3 On-the-Fly Creation of Machine Trust Accounts) endobj 369 0 obj -<< /S /GoTo /D (section.7.3) >> +<< /S /GoTo /D (subsection.7.2.4) >> endobj 372 0 obj -(7.3 Domain Member Server) +(7.2.4 Making an MS Windows Workstation or Server a Domain Member) endobj 373 0 obj -<< /S /GoTo /D (subsection.7.3.1) >> +<< /S /GoTo /D (subsubsection.7.2.4.1) >> endobj 376 0 obj -(7.3.1 Joining an NT4 type Domain with Samba-3) +(7.2.4.1 Windows 200x/XP Professional Client) endobj 377 0 obj -<< /S /GoTo /D (subsection.7.3.2) >> +<< /S /GoTo /D (subsubsection.7.2.4.2) >> endobj 380 0 obj -(7.3.2 Why is this better than security = server?) +(7.2.4.2 Windows NT4 Client) endobj 381 0 obj -<< /S /GoTo /D (section.7.4) >> +<< /S /GoTo /D (subsubsection.7.2.4.3) >> endobj 384 0 obj -(7.4 Samba ADS Domain Membership) +(7.2.4.3 Samba Client) endobj 385 0 obj -<< /S /GoTo /D (subsection.7.4.1) >> +<< /S /GoTo /D (section.7.3) >> endobj 388 0 obj -(7.4.1 Setup your smb.conf) +(7.3 Domain Member Server) endobj 389 0 obj -<< /S /GoTo /D (subsection.7.4.2) >> +<< /S /GoTo /D (subsection.7.3.1) >> endobj 392 0 obj -(7.4.2 Setup your /etc/krb5.conf) +(7.3.1 Joining an NT4-type Domain with Samba-3) endobj 393 0 obj -<< /S /GoTo /D (subsection.7.4.3) >> +<< /S /GoTo /D (subsection.7.3.2) >> endobj 396 0 obj -(7.4.3 Create the computer account) +(7.3.2 Why Is This Better Than =`security = server=`?) endobj 397 0 obj -<< /S /GoTo /D (subsubsection.7.4.3.1) >> +<< /S /GoTo /D (section.7.4) >> endobj 400 0 obj -(7.4.3.1 Possible errors) +(7.4 Samba ADS Domain Membership) endobj 401 0 obj -<< /S /GoTo /D (subsection.7.4.4) >> +<< /S /GoTo /D (subsection.7.4.1) >> endobj 404 0 obj -(7.4.4 Test your server setup) +(7.4.1 Configure smb.conf) endobj 405 0 obj -<< /S /GoTo /D (subsection.7.4.5) >> +<< /S /GoTo /D (subsection.7.4.2) >> endobj 408 0 obj -(7.4.5 Testing with smbclient) +(7.4.2 Configure /etc/krb5.conf) endobj 409 0 obj -<< /S /GoTo /D (subsection.7.4.6) >> +<< /S /GoTo /D (subsection.7.4.3) >> endobj 412 0 obj -(7.4.6 Notes) +(7.4.3 Create the Computer Account) endobj 413 0 obj -<< /S /GoTo /D (section.7.5) >> +<< /S /GoTo /D (subsubsection.7.4.3.1) >> endobj 416 0 obj -(7.5 Common Errors) +(7.4.3.1 Possible Errors) endobj 417 0 obj -<< /S /GoTo /D (subsection.7.5.1) >> +<< /S /GoTo /D (subsection.7.4.4) >> endobj 420 0 obj -(7.5.1 Can Not Add Machine Back to Domain) +(7.4.4 Testing Server Setup) endobj 421 0 obj -<< /S /GoTo /D (subsection.7.5.2) >> +<< /S /GoTo /D (subsection.7.4.5) >> endobj 424 0 obj -(7.5.2 Adding Machine to Domain Fails) +(7.4.5 Testing with smbclient) endobj 425 0 obj -<< /S /GoTo /D (chapter.8) >> +<< /S /GoTo /D (subsection.7.4.6) >> endobj 428 0 obj -(8 Stand-Alone Servers) +(7.4.6 Notes) endobj 429 0 obj -<< /S /GoTo /D (section.8.1) >> +<< /S /GoTo /D (section.7.5) >> endobj 432 0 obj -(8.1 Features and Benefits) +(7.5 Sharing User ID Mappings between Samba Domain Members) endobj 433 0 obj -<< /S /GoTo /D (section.8.2) >> +<< /S /GoTo /D (section.7.6) >> endobj 436 0 obj -(8.2 Background) +(7.6 Common Errors) endobj 437 0 obj -<< /S /GoTo /D (section.8.3) >> +<< /S /GoTo /D (subsection.7.6.1) >> endobj 440 0 obj -(8.3 Example Configuration) +(7.6.1 Cannot Add Machine Back to Domain) endobj 441 0 obj -<< /S /GoTo /D (subsection.8.3.1) >> +<< /S /GoTo /D (subsection.7.6.2) >> endobj 444 0 obj -(8.3.1 Reference Documentation Server) +(7.6.2 Adding Machine to Domain Fails) endobj 445 0 obj -<< /S /GoTo /D (subsection.8.3.2) >> +<< /S /GoTo /D (subsection.7.6.3) >> endobj 448 0 obj -(8.3.2 Central Print Serving) +(7.6.3 I Can't Join a Windows 2003 PDC) endobj 449 0 obj -<< /S /GoTo /D (section.8.4) >> +<< /S /GoTo /D (chapter.8) >> endobj 452 0 obj -(8.4 Common Errors) +(8 Stand-alone Servers) endobj 453 0 obj -<< /S /GoTo /D (chapter.9) >> +<< /S /GoTo /D (section.8.1) >> endobj 456 0 obj -(9 MS Windows Network Configuration Guide) +(8.1 Features and Benefits) endobj 457 0 obj -<< /S /GoTo /D (section.9.1) >> +<< /S /GoTo /D (section.8.2) >> endobj 460 0 obj -(9.1 Note) +(8.2 Background) endobj 461 0 obj -<< /S /GoTo /D (part.3) >> +<< /S /GoTo /D (section.8.3) >> endobj 464 0 obj -(III Advanced Configuration) +(8.3 Example Configuration) endobj 465 0 obj -<< /S /GoTo /D (chapter.10) >> +<< /S /GoTo /D (subsection.8.3.1) >> endobj 468 0 obj -(10 Samba / MS Windows Network Browsing Guide) +(8.3.1 Reference Documentation Server) endobj 469 0 obj -<< /S /GoTo /D (section.10.1) >> +<< /S /GoTo /D (subsection.8.3.2) >> endobj 472 0 obj -(10.1 Features and Benefits) +(8.3.2 Central Print Serving) endobj 473 0 obj -<< /S /GoTo /D (section.10.2) >> +<< /S /GoTo /D (section.8.4) >> endobj 476 0 obj -(10.2 What is Browsing?) +(8.4 Common Errors) endobj 477 0 obj -<< /S /GoTo /D (section.10.3) >> +<< /S /GoTo /D (chapter.9) >> endobj 480 0 obj -(10.3 Discussion) +(9 MS Windows Network Configuration Guide) endobj 481 0 obj -<< /S /GoTo /D (subsection.10.3.1) >> +<< /S /GoTo /D (section.9.1) >> endobj 484 0 obj -(10.3.1 NetBIOS over TCP/IP) +(9.1 Note) endobj 485 0 obj -<< /S /GoTo /D (subsection.10.3.2) >> +<< /S /GoTo /D (part.3) >> endobj 488 0 obj -(10.3.2 TCP/IP - without NetBIOS) +(III Advanced Configuration) endobj 489 0 obj -<< /S /GoTo /D (subsection.10.3.3) >> +<< /S /GoTo /D (chapter.10) >> endobj 492 0 obj -(10.3.3 DNS and Active Directory) +(10 Network Browsing) endobj 493 0 obj -<< /S /GoTo /D (section.10.4) >> +<< /S /GoTo /D (section.10.1) >> endobj 496 0 obj -(10.4 How Browsing Functions) +(10.1 Features and Benefits) endobj 497 0 obj -<< /S /GoTo /D (subsection.10.4.1) >> +<< /S /GoTo /D (section.10.2) >> endobj 500 0 obj -(10.4.1 Setting up WORKGROUP Browsing) +(10.2 What Is Browsing?) endobj 501 0 obj -<< /S /GoTo /D (subsection.10.4.2) >> +<< /S /GoTo /D (section.10.3) >> endobj 504 0 obj -(10.4.2 Setting up DOMAIN Browsing) +(10.3 Discussion) endobj 505 0 obj -<< /S /GoTo /D (subsection.10.4.3) >> +<< /S /GoTo /D (subsection.10.3.1) >> endobj 508 0 obj -(10.4.3 Forcing Samba to be the master) +(10.3.1 NetBIOS over TCP/IP) endobj 509 0 obj -<< /S /GoTo /D (subsection.10.4.4) >> +<< /S /GoTo /D (subsection.10.3.2) >> endobj 512 0 obj -(10.4.4 Making Samba the domain master) +(10.3.2 TCP/IP without NetBIOS) endobj 513 0 obj -<< /S /GoTo /D (subsection.10.4.5) >> +<< /S /GoTo /D (subsection.10.3.3) >> endobj 516 0 obj -(10.4.5 Note about broadcast addresses) +(10.3.3 DNS and Active Directory) endobj 517 0 obj -<< /S /GoTo /D (subsection.10.4.6) >> +<< /S /GoTo /D (section.10.4) >> endobj 520 0 obj -(10.4.6 Multiple interfaces) +(10.4 How Browsing Functions) endobj 521 0 obj -<< /S /GoTo /D (subsection.10.4.7) >> +<< /S /GoTo /D (subsection.10.4.1) >> endobj 524 0 obj -(10.4.7 Use of the Remote Announce parameter) +(10.4.1 Configuring WORKGROUP Browsing) endobj 525 0 obj -<< /S /GoTo /D (subsection.10.4.8) >> +<< /S /GoTo /D (subsection.10.4.2) >> endobj 528 0 obj -(10.4.8 Use of the Remote Browse Sync parameter) +(10.4.2 DOMAIN Browsing Configuration) endobj 529 0 obj -<< /S /GoTo /D (section.10.5) >> +<< /S /GoTo /D (subsection.10.4.3) >> endobj 532 0 obj -(10.5 WINS - The Windows Internetworking Name Server) +(10.4.3 Forcing Samba to Be the Master) endobj 533 0 obj -<< /S /GoTo /D (subsection.10.5.1) >> +<< /S /GoTo /D (subsection.10.4.4) >> endobj 536 0 obj -(10.5.1 Setting up a WINS server) +(10.4.4 Making Samba the Domain Master) endobj 537 0 obj -<< /S /GoTo /D (subsection.10.5.2) >> +<< /S /GoTo /D (subsection.10.4.5) >> endobj 540 0 obj -(10.5.2 WINS Replication) +(10.4.5 Note about Broadcast Addresses) endobj 541 0 obj -<< /S /GoTo /D (subsection.10.5.3) >> +<< /S /GoTo /D (subsection.10.4.6) >> endobj 544 0 obj -(10.5.3 Static WINS Entries) +(10.4.6 Multiple Interfaces) endobj 545 0 obj -<< /S /GoTo /D (section.10.6) >> +<< /S /GoTo /D (subsection.10.4.7) >> endobj 548 0 obj -(10.6 Helpful Hints) +(10.4.7 Use of the Remote Announce Parameter) endobj 549 0 obj -<< /S /GoTo /D (subsection.10.6.1) >> +<< /S /GoTo /D (subsection.10.4.8) >> endobj 552 0 obj -(10.6.1 Windows Networking Protocols) +(10.4.8 Use of the Remote Browse Sync Parameter) endobj 553 0 obj -<< /S /GoTo /D (subsection.10.6.2) >> +<< /S /GoTo /D (section.10.5) >> endobj 556 0 obj -(10.6.2 Name Resolution Order) +(10.5 WINS --- The Windows Internetworking Name Server) endobj 557 0 obj -<< /S /GoTo /D (section.10.7) >> +<< /S /GoTo /D (subsection.10.5.1) >> endobj 560 0 obj -(10.7 Technical Overview of browsing) +(10.5.1 WINS Server Configuration) endobj 561 0 obj -<< /S /GoTo /D (subsection.10.7.1) >> +<< /S /GoTo /D (subsection.10.5.2) >> endobj 564 0 obj -(10.7.1 Browsing support in Samba) +(10.5.2 WINS Replication) endobj 565 0 obj -<< /S /GoTo /D (subsection.10.7.2) >> +<< /S /GoTo /D (subsection.10.5.3) >> endobj 568 0 obj -(10.7.2 Problem resolution) +(10.5.3 Static WINS Entries) endobj 569 0 obj -<< /S /GoTo /D (subsection.10.7.3) >> +<< /S /GoTo /D (section.10.6) >> endobj 572 0 obj -(10.7.3 Browsing across subnets) +(10.6 Helpful Hints) endobj 573 0 obj -<< /S /GoTo /D (subsubsection.10.7.3.1) >> +<< /S /GoTo /D (subsection.10.6.1) >> endobj 576 0 obj -(10.7.3.1 How does cross subnet browsing work ?) +(10.6.1 Windows Networking Protocols) endobj 577 0 obj -<< /S /GoTo /D (section.10.8) >> +<< /S /GoTo /D (subsection.10.6.2) >> endobj 580 0 obj -(10.8 Common Errors) +(10.6.2 Name Resolution Order) endobj 581 0 obj -<< /S /GoTo /D (subsection.10.8.1) >> +<< /S /GoTo /D (section.10.7) >> endobj 584 0 obj -(10.8.1 How can one flush the Samba NetBIOS name cache without restarting Samba?) +(10.7 Technical Overview of Browsing) endobj 585 0 obj -<< /S /GoTo /D (subsection.10.8.2) >> +<< /S /GoTo /D (subsection.10.7.1) >> endobj 588 0 obj -(10.8.2 My client reports "This server is not configured to list shared resources") +(10.7.1 Browsing Support in Samba) endobj 589 0 obj -<< /S /GoTo /D (subsection.10.8.3) >> +<< /S /GoTo /D (subsection.10.7.2) >> endobj 592 0 obj -(10.8.3 I get an Unable to browse the network error) +(10.7.2 Problem Resolution) endobj 593 0 obj -<< /S /GoTo /D (chapter.11) >> +<< /S /GoTo /D (subsection.10.7.3) >> endobj 596 0 obj -(11 Account Information Databases) +(10.7.3 Cross-Subnet Browsing) endobj 597 0 obj -<< /S /GoTo /D (section.11.1) >> +<< /S /GoTo /D (subsubsection.10.7.3.1) >> endobj 600 0 obj -(11.1 Features and Benefits) +(10.7.3.1 Behavior of Cross-Subnet Browsing) endobj 601 0 obj -<< /S /GoTo /D (subsection.11.1.1) >> +<< /S /GoTo /D (section.10.8) >> endobj 604 0 obj -(11.1.1 Backwards Compatibility Backends) +(10.8 Common Errors) endobj 605 0 obj -<< /S /GoTo /D (subsection.11.1.2) >> +<< /S /GoTo /D (subsection.10.8.1) >> endobj 608 0 obj -(11.1.2 New Backends) +(10.8.1 How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?) endobj 609 0 obj -<< /S /GoTo /D (section.11.2) >> +<< /S /GoTo /D (subsection.10.8.2) >> endobj 612 0 obj -(11.2 Technical Information) +(10.8.2 Server Resources Can Not Be Listed) endobj 613 0 obj -<< /S /GoTo /D (subsection.11.2.1) >> +<< /S /GoTo /D (subsection.10.8.3) >> endobj 616 0 obj -(11.2.1 Important Notes About Security) +(10.8.3 I get an `Unable to browse the network' error) endobj 617 0 obj -<< /S /GoTo /D (subsubsection.11.2.1.1) >> +<< /S /GoTo /D (subsection.10.8.4) >> endobj 620 0 obj -(11.2.1.1 Advantages of Encrypted Passwords) +(10.8.4 Browsing of Shares and Directories is Very Slow) endobj 621 0 obj -<< /S /GoTo /D (subsubsection.11.2.1.2) >> +<< /S /GoTo /D (chapter.11) >> endobj 624 0 obj -(11.2.1.2 Advantages of non-encrypted passwords) +(11 Account Information Databases) endobj 625 0 obj -<< /S /GoTo /D (subsection.11.2.2) >> +<< /S /GoTo /D (section.11.1) >> endobj 628 0 obj -(11.2.2 Mapping User Identifiers between MS Windows and UNIX) +(11.1 Features and Benefits) endobj 629 0 obj -<< /S /GoTo /D (subsection.11.2.3) >> +<< /S /GoTo /D (subsection.11.1.1) >> endobj 632 0 obj -(11.2.3 Mapping Common UIDs/GIDs on Distributed Machines) +(11.1.1 Backward Compatibility Backends) endobj 633 0 obj -<< /S /GoTo /D (section.11.3) >> +<< /S /GoTo /D (subsection.11.1.2) >> endobj 636 0 obj -(11.3 Account Management Tools) +(11.1.2 New Backends) endobj 637 0 obj -<< /S /GoTo /D (subsection.11.3.1) >> +<< /S /GoTo /D (section.11.2) >> endobj 640 0 obj -(11.3.1 The smbpasswd Command) +(11.2 Technical Information) endobj 641 0 obj -<< /S /GoTo /D (subsection.11.3.2) >> +<< /S /GoTo /D (subsection.11.2.1) >> endobj 644 0 obj -(11.3.2 The pdbedit Command) +(11.2.1 Important Notes About Security) endobj 645 0 obj -<< /S /GoTo /D (section.11.4) >> +<< /S /GoTo /D (subsubsection.11.2.1.1) >> endobj 648 0 obj -(11.4 Password Backends) +(11.2.1.1 Advantages of Encrypted Passwords) endobj 649 0 obj -<< /S /GoTo /D (subsection.11.4.1) >> +<< /S /GoTo /D (subsubsection.11.2.1.2) >> endobj 652 0 obj -(11.4.1 Plain Text) +(11.2.1.2 Advantages of Non-Encrypted Passwords) endobj 653 0 obj -<< /S /GoTo /D (subsection.11.4.2) >> +<< /S /GoTo /D (subsection.11.2.2) >> endobj 656 0 obj -(11.4.2 smbpasswd - Encrypted Password Database) +(11.2.2 Mapping User Identifiers between MS Windows and UNIX) endobj 657 0 obj -<< /S /GoTo /D (subsection.11.4.3) >> +<< /S /GoTo /D (subsection.11.2.3) >> endobj 660 0 obj -(11.4.3 tdbsam) +(11.2.3 Mapping Common UIDs/GIDs on Distributed Machines) endobj 661 0 obj -<< /S /GoTo /D (subsection.11.4.4) >> +<< /S /GoTo /D (section.11.3) >> endobj 664 0 obj -(11.4.4 ldapsam) +(11.3 Account Management Tools) endobj 665 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.1) >> +<< /S /GoTo /D (subsection.11.3.1) >> endobj 668 0 obj -(11.4.4.1 Supported LDAP Servers) +(11.3.1 The smbpasswd Command) endobj 669 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.2) >> +<< /S /GoTo /D (subsection.11.3.2) >> endobj 672 0 obj -(11.4.4.2 Schema and Relationship to the RFC 2307 posixAccount) +(11.3.2 The pdbedit Command) endobj 673 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.3) >> +<< /S /GoTo /D (section.11.4) >> endobj 676 0 obj -(11.4.4.3 OpenLDAP configuration) +(11.4 Password Backends) endobj 677 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.4) >> +<< /S /GoTo /D (subsection.11.4.1) >> endobj 680 0 obj -(11.4.4.4 Initialise the LDAP database) +(11.4.1 Plaintext) endobj 681 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.5) >> +<< /S /GoTo /D (subsection.11.4.2) >> endobj 684 0 obj -(11.4.4.5 Configuring Samba) +(11.4.2 smbpasswd --- Encrypted Password Database) endobj 685 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.6) >> +<< /S /GoTo /D (subsection.11.4.3) >> endobj 688 0 obj -(11.4.4.6 Accounts and Groups management) +(11.4.3 tdbsam) endobj 689 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.7) >> +<< /S /GoTo /D (subsection.11.4.4) >> endobj 692 0 obj -(11.4.4.7 Security and sambaSamAccount) +(11.4.4 ldapsam) endobj 693 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.8) >> +<< /S /GoTo /D (subsubsection.11.4.4.1) >> endobj 696 0 obj -(11.4.4.8 LDAP special attributes for sambaSamAccounts) +(11.4.4.1 Supported LDAP Servers) endobj 697 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.9) >> +<< /S /GoTo /D (subsubsection.11.4.4.2) >> endobj 700 0 obj -(11.4.4.9 Example LDIF Entries for a sambaSamAccount) +(11.4.4.2 Schema and Relationship to the RFC 2307 posixAccount) endobj 701 0 obj -<< /S /GoTo /D (subsubsection.11.4.4.10) >> +<< /S /GoTo /D (subsubsection.11.4.4.3) >> endobj 704 0 obj -(11.4.4.10 Password synchronisation) +(11.4.4.3 OpenLDAP Configuration) endobj 705 0 obj -<< /S /GoTo /D (subsection.11.4.5) >> +<< /S /GoTo /D (subsubsection.11.4.4.4) >> endobj 708 0 obj -(11.4.5 MySQL) +(11.4.4.4 Initialize the LDAP Database) endobj 709 0 obj -<< /S /GoTo /D (subsubsection.11.4.5.1) >> +<< /S /GoTo /D (subsubsection.11.4.4.5) >> endobj 712 0 obj -(11.4.5.1 Creating the database) +(11.4.4.5 Configuring Samba) endobj 713 0 obj -<< /S /GoTo /D (subsubsection.11.4.5.2) >> +<< /S /GoTo /D (subsubsection.11.4.4.6) >> endobj 716 0 obj -(11.4.5.2 Configuring) +(11.4.4.6 Accounts and Groups Management) endobj 717 0 obj -<< /S /GoTo /D (subsubsection.11.4.5.3) >> +<< /S /GoTo /D (subsubsection.11.4.4.7) >> endobj 720 0 obj -(11.4.5.3 Using plaintext passwords or encrypted password) +(11.4.4.7 Security and sambaSamAccount) endobj 721 0 obj -<< /S /GoTo /D (subsubsection.11.4.5.4) >> +<< /S /GoTo /D (subsubsection.11.4.4.8) >> endobj 724 0 obj -(11.4.5.4 Getting non-column data from the table) +(11.4.4.8 LDAP Special Attributes for sambaSamAccounts) endobj 725 0 obj -<< /S /GoTo /D (subsection.11.4.6) >> +<< /S /GoTo /D (subsubsection.11.4.4.9) >> endobj 728 0 obj -(11.4.6 XML) +(11.4.4.9 Example LDIF Entries for a sambaSamAccount) endobj 729 0 obj -<< /S /GoTo /D (section.11.5) >> +<< /S /GoTo /D (subsubsection.11.4.4.10) >> endobj 732 0 obj -(11.5 Common Errors) +(11.4.4.10 Password Synchronization) endobj 733 0 obj -<< /S /GoTo /D (subsection.11.5.1) >> +<< /S /GoTo /D (subsection.11.4.5) >> endobj 736 0 obj -(11.5.1 Users can not logon) +(11.4.5 MySQL) endobj 737 0 obj -<< /S /GoTo /D (subsection.11.5.2) >> +<< /S /GoTo /D (subsubsection.11.4.5.1) >> endobj 740 0 obj -(11.5.2 Users being added to wrong backend database) +(11.4.5.1 Creating the Database) endobj 741 0 obj -<< /S /GoTo /D (subsection.11.5.3) >> +<< /S /GoTo /D (subsubsection.11.4.5.2) >> endobj 744 0 obj -(11.5.3 auth methods does not work) +(11.4.5.2 Configuring) endobj 745 0 obj -<< /S /GoTo /D (chapter.12) >> +<< /S /GoTo /D (subsubsection.11.4.5.3) >> endobj 748 0 obj -(12 Mapping MS Windows and UNIX Groups) +(11.4.5.3 Using Plaintext Passwords or Encrypted Password) endobj 749 0 obj -<< /S /GoTo /D (section.12.1) >> +<< /S /GoTo /D (subsubsection.11.4.5.4) >> endobj 752 0 obj -(12.1 Features and Benefits) +(11.4.5.4 Getting Non-Column Data from the Table) endobj 753 0 obj -<< /S /GoTo /D (section.12.2) >> +<< /S /GoTo /D (subsection.11.4.6) >> endobj 756 0 obj -(12.2 Discussion) +(11.4.6 XML) endobj 757 0 obj -<< /S /GoTo /D (subsection.12.2.1) >> +<< /S /GoTo /D (section.11.5) >> endobj 760 0 obj -(12.2.1 Example Configuration) +(11.5 Common Errors) endobj 761 0 obj -<< /S /GoTo /D (section.12.3) >> +<< /S /GoTo /D (subsection.11.5.1) >> endobj 764 0 obj -(12.3 Configuration Scripts) +(11.5.1 Users Cannot Logon) endobj 765 0 obj -<< /S /GoTo /D (subsection.12.3.1) >> +<< /S /GoTo /D (subsection.11.5.2) >> endobj 768 0 obj -(12.3.1 Sample smb.conf add group script) +(11.5.2 Users Being Added to the Wrong Backend Database) endobj 769 0 obj -<< /S /GoTo /D (subsection.12.3.2) >> +<< /S /GoTo /D (subsection.11.5.3) >> endobj 772 0 obj -(12.3.2 Script to configure Group Mapping) +(11.5.3 Configuration of =`auth methods=`) endobj 773 0 obj -<< /S /GoTo /D (section.12.4) >> +<< /S /GoTo /D (chapter.12) >> endobj 776 0 obj -(12.4 Common Errors) +(12 Group Mapping --- MS Windows and UNIX) endobj 777 0 obj -<< /S /GoTo /D (subsection.12.4.1) >> +<< /S /GoTo /D (section.12.1) >> endobj 780 0 obj -(12.4.1 Adding Groups Fails) +(12.1 Features and Benefits) endobj 781 0 obj -<< /S /GoTo /D (subsection.12.4.2) >> +<< /S /GoTo /D (section.12.2) >> endobj 784 0 obj -(12.4.2 Adding MS Windows Groups to MS Windows Groups Fails) +(12.2 Discussion) endobj 785 0 obj -<< /S /GoTo /D (subsection.12.4.3) >> +<< /S /GoTo /D (subsection.12.2.1) >> endobj 788 0 obj -(12.4.3 Adding Domain Users to the Power Users group) +(12.2.1 Default Users, Groups and Relative Identifiers) endobj 789 0 obj -<< /S /GoTo /D (chapter.13) >> +<< /S /GoTo /D (subsection.12.2.2) >> endobj 792 0 obj -(13 File, Directory and Share Access Controls) +(12.2.2 Example Configuration) endobj 793 0 obj -<< /S /GoTo /D (section.13.1) >> +<< /S /GoTo /D (section.12.3) >> endobj 796 0 obj -(13.1 Features and Benefits) +(12.3 Configuration Scripts) endobj 797 0 obj -<< /S /GoTo /D (section.13.2) >> +<< /S /GoTo /D (subsection.12.3.1) >> endobj 800 0 obj -(13.2 File System Access Controls) +(12.3.1 Sample smb.conf Add Group Script) endobj 801 0 obj -<< /S /GoTo /D (subsection.13.2.1) >> +<< /S /GoTo /D (subsection.12.3.2) >> endobj 804 0 obj -(13.2.1 MS Windows NTFS Comparison with UNIX File Systems) +(12.3.2 Script to Configure Group Mapping) endobj 805 0 obj -<< /S /GoTo /D (subsection.13.2.2) >> +<< /S /GoTo /D (section.12.4) >> endobj 808 0 obj -(13.2.2 Managing Directories) +(12.4 Common Errors) endobj 809 0 obj -<< /S /GoTo /D (subsection.13.2.3) >> +<< /S /GoTo /D (subsection.12.4.1) >> endobj 812 0 obj -(13.2.3 File and Directory Access Control) +(12.4.1 Adding Groups Fails) endobj 813 0 obj -<< /S /GoTo /D (section.13.3) >> +<< /S /GoTo /D (subsection.12.4.2) >> endobj 816 0 obj -(13.3 Share Definition Access Controls) +(12.4.2 Adding MS Windows Groups to MS Windows Groups Fails) endobj 817 0 obj -<< /S /GoTo /D (subsection.13.3.1) >> +<< /S /GoTo /D (subsection.12.4.3) >> endobj 820 0 obj -(13.3.1 User and Group Based Controls) +(12.4.3 Adding Domain Users to the Power Users Group) endobj 821 0 obj -<< /S /GoTo /D (subsection.13.3.2) >> +<< /S /GoTo /D (chapter.13) >> endobj 824 0 obj -(13.3.2 File and Directory Permissions Based Controls) +(13 File, Directory and Share Access Controls) endobj 825 0 obj -<< /S /GoTo /D (subsection.13.3.3) >> +<< /S /GoTo /D (section.13.1) >> endobj 828 0 obj -(13.3.3 Miscellaneous Controls) +(13.1 Features and Benefits) endobj 829 0 obj -<< /S /GoTo /D (section.13.4) >> +<< /S /GoTo /D (section.13.2) >> endobj 832 0 obj -(13.4 Access Controls on Shares) +(13.2 File System Access Controls) endobj 833 0 obj -<< /S /GoTo /D (subsection.13.4.1) >> +<< /S /GoTo /D (subsection.13.2.1) >> endobj 836 0 obj -(13.4.1 Share Permissions Management) +(13.2.1 MS Windows NTFS Comparison with UNIX File Systems) endobj 837 0 obj -<< /S /GoTo /D (subsubsection.13.4.1.1) >> +<< /S /GoTo /D (subsection.13.2.2) >> endobj 840 0 obj -(13.4.1.1 Windows NT4 Workstation/Server) +(13.2.2 Managing Directories) endobj 841 0 obj -<< /S /GoTo /D (subsubsection.13.4.1.2) >> +<< /S /GoTo /D (subsection.13.2.3) >> endobj 844 0 obj -(13.4.1.2 Windows 200x/XP) +(13.2.3 File and Directory Access Control) endobj 845 0 obj -<< /S /GoTo /D (section.13.5) >> +<< /S /GoTo /D (section.13.3) >> endobj 848 0 obj -(13.5 MS Windows Access Control Lists and UNIX Interoperability) +(13.3 Share Definition Access Controls) endobj 849 0 obj -<< /S /GoTo /D (subsection.13.5.1) >> +<< /S /GoTo /D (subsection.13.3.1) >> endobj 852 0 obj -(13.5.1 Managing UNIX permissions Using NT Security Dialogs) +(13.3.1 User and Group-Based Controls) endobj 853 0 obj -<< /S /GoTo /D (subsection.13.5.2) >> +<< /S /GoTo /D (subsection.13.3.2) >> endobj 856 0 obj -(13.5.2 Viewing File Security on a Samba Share) +(13.3.2 File and Directory Permissions-Based Controls) endobj 857 0 obj -<< /S /GoTo /D (subsection.13.5.3) >> +<< /S /GoTo /D (subsection.13.3.3) >> endobj 860 0 obj -(13.5.3 Viewing file ownership) +(13.3.3 Miscellaneous Controls) endobj 861 0 obj -<< /S /GoTo /D (subsection.13.5.4) >> +<< /S /GoTo /D (section.13.4) >> endobj 864 0 obj -(13.5.4 Viewing File or Directory Permissions) +(13.4 Access Controls on Shares) endobj 865 0 obj -<< /S /GoTo /D (subsubsection.13.5.4.1) >> +<< /S /GoTo /D (subsection.13.4.1) >> endobj 868 0 obj -(13.5.4.1 File Permissions) +(13.4.1 Share Permissions Management) endobj 869 0 obj -<< /S /GoTo /D (subsubsection.13.5.4.2) >> +<< /S /GoTo /D (subsubsection.13.4.1.1) >> endobj 872 0 obj -(13.5.4.2 Directory Permissions) +(13.4.1.1 Windows NT4 Workstation/Server) endobj 873 0 obj -<< /S /GoTo /D (subsection.13.5.5) >> +<< /S /GoTo /D (subsubsection.13.4.1.2) >> endobj 876 0 obj -(13.5.5 Modifying file or directory permissions) +(13.4.1.2 Windows 200x/XP) endobj 877 0 obj -<< /S /GoTo /D (subsection.13.5.6) >> +<< /S /GoTo /D (section.13.5) >> endobj 880 0 obj -(13.5.6 Interaction with the standard Samba create mask parameters) +(13.5 MS Windows Access Control Lists and UNIX Interoperability) endobj 881 0 obj -<< /S /GoTo /D (subsection.13.5.7) >> +<< /S /GoTo /D (subsection.13.5.1) >> endobj 884 0 obj -(13.5.7 Interaction with the standard Samba file attribute mapping) +(13.5.1 Managing UNIX Permissions Using NT Security Dialogs) endobj 885 0 obj -<< /S /GoTo /D (section.13.6) >> +<< /S /GoTo /D (subsection.13.5.2) >> endobj 888 0 obj -(13.6 Common Errors) +(13.5.2 Viewing File Security on a Samba Share) endobj 889 0 obj -<< /S /GoTo /D (subsection.13.6.1) >> +<< /S /GoTo /D (subsection.13.5.3) >> endobj 892 0 obj -(13.6.1 Users can not write to a public share) +(13.5.3 Viewing File Ownership) endobj 893 0 obj -<< /S /GoTo /D (subsection.13.6.2) >> +<< /S /GoTo /D (subsection.13.5.4) >> endobj 896 0 obj -(13.6.2 I have set force user but Samba still makes root the owner of all the files I touch!) +(13.5.4 Viewing File or Directory Permissions) endobj 897 0 obj -<< /S /GoTo /D (subsection.13.6.3) >> +<< /S /GoTo /D (subsubsection.13.5.4.1) >> endobj 900 0 obj -(13.6.3 MS Word with Samba changes owner of file) +(13.5.4.1 File Permissions) endobj 901 0 obj -<< /S /GoTo /D (chapter.14) >> +<< /S /GoTo /D (subsubsection.13.5.4.2) >> endobj 904 0 obj -(14 File and Record Locking) +(13.5.4.2 Directory Permissions) endobj 905 0 obj -<< /S /GoTo /D (section.14.1) >> +<< /S /GoTo /D (subsection.13.5.5) >> endobj 908 0 obj -(14.1 Features and Benefits) +(13.5.5 Modifying File or Directory Permissions) endobj 909 0 obj -<< /S /GoTo /D (section.14.2) >> +<< /S /GoTo /D (subsection.13.5.6) >> endobj 912 0 obj -(14.2 Discussion) +(13.5.6 Interaction with the Standard Samba ``create mask'' Parameters) endobj 913 0 obj -<< /S /GoTo /D (subsection.14.2.1) >> +<< /S /GoTo /D (subsection.13.5.7) >> endobj 916 0 obj -(14.2.1 Opportunistic Locking Overview) +(13.5.7 Interaction with the Standard Samba File Attribute Mapping) endobj 917 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.1) >> +<< /S /GoTo /D (section.13.6) >> endobj 920 0 obj -(14.2.1.1 Exclusively Accessed Shares) +(13.6 Common Errors) endobj 921 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.2) >> +<< /S /GoTo /D (subsection.13.6.1) >> endobj 924 0 obj -(14.2.1.2 Multiple-Accessed Shares or Files) +(13.6.1 Users Cannot Write to a Public Share) endobj 925 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.3) >> +<< /S /GoTo /D (subsection.13.6.2) >> endobj 928 0 obj -(14.2.1.3 UNIX or NFS Client Accessed Files) +(13.6.2 File Operations Done as root with force user Set) endobj 929 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.4) >> +<< /S /GoTo /D (subsection.13.6.3) >> endobj 932 0 obj -(14.2.1.4 Slow and/or Unreliable Networks) +(13.6.3 MS Word with Samba Changes Owner of File) endobj 933 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.5) >> +<< /S /GoTo /D (chapter.14) >> endobj 936 0 obj -(14.2.1.5 Multi-User Databases) +(14 File and Record Locking) endobj 937 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.6) >> +<< /S /GoTo /D (section.14.1) >> endobj 940 0 obj -(14.2.1.6 PDM Data Shares) +(14.1 Features and Benefits) endobj 941 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.7) >> +<< /S /GoTo /D (section.14.2) >> endobj 944 0 obj -(14.2.1.7 Beware of Force User) +(14.2 Discussion) endobj 945 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.8) >> +<< /S /GoTo /D (subsection.14.2.1) >> endobj 948 0 obj -(14.2.1.8 Advanced Samba Opportunistic Locking Parameters) +(14.2.1 Opportunistic Locking Overview) endobj 949 0 obj -<< /S /GoTo /D (subsubsection.14.2.1.9) >> +<< /S /GoTo /D (subsubsection.14.2.1.1) >> endobj 952 0 obj -(14.2.1.9 Mission Critical High Availability) +(14.2.1.1 Exclusively Accessed Shares) endobj 953 0 obj -<< /S /GoTo /D (section.14.3) >> +<< /S /GoTo /D (subsubsection.14.2.1.2) >> endobj 956 0 obj -(14.3 Samba Opportunistic Locking Control) +(14.2.1.2 Multiple-Accessed Shares or Files) endobj 957 0 obj -<< /S /GoTo /D (subsection.14.3.1) >> +<< /S /GoTo /D (subsubsection.14.2.1.3) >> endobj 960 0 obj -(14.3.1 Example Configuration) +(14.2.1.3 UNIX or NFS Client-Accessed Files) endobj 961 0 obj -<< /S /GoTo /D (subsubsection.14.3.1.1) >> +<< /S /GoTo /D (subsubsection.14.2.1.4) >> endobj 964 0 obj -(14.3.1.1 Disabling Oplocks) +(14.2.1.4 Slow and/or Unreliable Networks) endobj 965 0 obj -<< /S /GoTo /D (subsubsection.14.3.1.2) >> +<< /S /GoTo /D (subsubsection.14.2.1.5) >> endobj 968 0 obj -(14.3.1.2 Disabling Kernel OpLocks) +(14.2.1.5 Multi-User Databases) endobj 969 0 obj -<< /S /GoTo /D (section.14.4) >> +<< /S /GoTo /D (subsubsection.14.2.1.6) >> endobj 972 0 obj -(14.4 MS Windows Opportunistic Locking and Caching Controls) +(14.2.1.6 PDM Data Shares) endobj 973 0 obj -<< /S /GoTo /D (subsection.14.4.1) >> +<< /S /GoTo /D (subsubsection.14.2.1.7) >> endobj 976 0 obj -(14.4.1 Workstation Service Entries) +(14.2.1.7 Beware of Force User) endobj 977 0 obj -<< /S /GoTo /D (subsection.14.4.2) >> +<< /S /GoTo /D (subsubsection.14.2.1.8) >> endobj 980 0 obj -(14.4.2 Server Service Entries) +(14.2.1.8 Advanced Samba Opportunistic Locking Parameters) endobj 981 0 obj -<< /S /GoTo /D (section.14.5) >> +<< /S /GoTo /D (subsubsection.14.2.1.9) >> endobj 984 0 obj -(14.5 Persistent Data Corruption) +(14.2.1.9 Mission-Critical High-Availability) endobj 985 0 obj -<< /S /GoTo /D (section.14.6) >> +<< /S /GoTo /D (section.14.3) >> endobj 988 0 obj -(14.6 Common Errors) +(14.3 Samba Opportunistic Locking Control) endobj 989 0 obj -<< /S /GoTo /D (subsection.14.6.1) >> +<< /S /GoTo /D (subsection.14.3.1) >> endobj 992 0 obj -(14.6.1 locking.tdb error messages) +(14.3.1 Example Configuration) endobj 993 0 obj -<< /S /GoTo /D (subsection.14.6.2) >> +<< /S /GoTo /D (subsubsection.14.3.1.1) >> endobj 996 0 obj -(14.6.2 Problems saving files in MS Office on Windows XP) +(14.3.1.1 Disabling Oplocks) endobj 997 0 obj -<< /S /GoTo /D (subsection.14.6.3) >> +<< /S /GoTo /D (subsubsection.14.3.1.2) >> endobj 1000 0 obj -(14.6.3 Long delays deleting files over network with XP SP1) +(14.3.1.2 Disabling Kernel Oplocks) endobj 1001 0 obj -<< /S /GoTo /D (section.14.7) >> +<< /S /GoTo /D (section.14.4) >> endobj 1004 0 obj -(14.7 Additional Reading) +(14.4 MS Windows Opportunistic Locking and Caching Controls) endobj 1005 0 obj -<< /S /GoTo /D (chapter.15) >> +<< /S /GoTo /D (subsection.14.4.1) >> endobj 1008 0 obj -(15 Securing Samba) +(14.4.1 Workstation Service Entries) endobj 1009 0 obj -<< /S /GoTo /D (section.15.1) >> +<< /S /GoTo /D (subsection.14.4.2) >> endobj 1012 0 obj -(15.1 Introduction) +(14.4.2 Server Service Entries) endobj 1013 0 obj -<< /S /GoTo /D (section.15.2) >> +<< /S /GoTo /D (section.14.5) >> endobj 1016 0 obj -(15.2 Features and Benefits) +(14.5 Persistent Data Corruption) endobj 1017 0 obj -<< /S /GoTo /D (section.15.3) >> +<< /S /GoTo /D (section.14.6) >> endobj 1020 0 obj -(15.3 Technical Discussion of Protective Measures and Issues) +(14.6 Common Errors) endobj 1021 0 obj -<< /S /GoTo /D (subsection.15.3.1) >> +<< /S /GoTo /D (subsection.14.6.1) >> endobj 1024 0 obj -(15.3.1 Using host based protection) +(14.6.1 locking.tdb Error Messages) endobj 1025 0 obj -<< /S /GoTo /D (subsection.15.3.2) >> +<< /S /GoTo /D (subsection.14.6.2) >> endobj 1028 0 obj -(15.3.2 User based protection) +(14.6.2 Problems Saving Files in MS Office on Windows XP) endobj 1029 0 obj -<< /S /GoTo /D (subsection.15.3.3) >> +<< /S /GoTo /D (subsection.14.6.3) >> endobj 1032 0 obj -(15.3.3 Using interface protection) +(14.6.3 Long Delays Deleting Files Over Network with XP SP1) endobj 1033 0 obj -<< /S /GoTo /D (subsection.15.3.4) >> +<< /S /GoTo /D (section.14.7) >> endobj 1036 0 obj -(15.3.4 Using a firewall) +(14.7 Additional Reading) endobj 1037 0 obj -<< /S /GoTo /D (subsection.15.3.5) >> +<< /S /GoTo /D (chapter.15) >> endobj 1040 0 obj -(15.3.5 Using a IPC\044 share deny) +(15 Securing Samba) endobj 1041 0 obj -<< /S /GoTo /D (subsection.15.3.6) >> +<< /S /GoTo /D (section.15.1) >> endobj 1044 0 obj -(15.3.6 NTLMv2 Security) +(15.1 Introduction) endobj 1045 0 obj -<< /S /GoTo /D (section.15.4) >> +<< /S /GoTo /D (section.15.2) >> endobj 1048 0 obj -(15.4 Upgrading Samba) +(15.2 Features and Benefits) endobj 1049 0 obj -<< /S /GoTo /D (section.15.5) >> +<< /S /GoTo /D (section.15.3) >> endobj 1052 0 obj -(15.5 Common Errors) +(15.3 Technical Discussion of Protective Measures and Issues) endobj 1053 0 obj -<< /S /GoTo /D (subsection.15.5.1) >> +<< /S /GoTo /D (subsection.15.3.1) >> endobj 1056 0 obj -(15.5.1 Smbclient works on localhost, but the network is dead) +(15.3.1 Using Host-Based Protection) endobj 1057 0 obj -<< /S /GoTo /D (subsection.15.5.2) >> +<< /S /GoTo /D (subsection.15.3.2) >> endobj 1060 0 obj -(15.5.2 Why can users access home directories of other users?) +(15.3.2 User-Based Protection) endobj 1061 0 obj -<< /S /GoTo /D (chapter.16) >> +<< /S /GoTo /D (subsection.15.3.3) >> endobj 1064 0 obj -(16 Interdomain Trust Relationships) +(15.3.3 Using Interface Protection) endobj 1065 0 obj -<< /S /GoTo /D (section.16.1) >> +<< /S /GoTo /D (subsection.15.3.4) >> endobj 1068 0 obj -(16.1 Features and Benefits) +(15.3.4 Using a Firewall) endobj 1069 0 obj -<< /S /GoTo /D (section.16.2) >> +<< /S /GoTo /D (subsection.15.3.5) >> endobj 1072 0 obj -(16.2 Trust Relationship Background) +(15.3.5 Using IPC\044 Share-Based Denials) endobj 1073 0 obj -<< /S /GoTo /D (section.16.3) >> +<< /S /GoTo /D (subsection.15.3.6) >> endobj 1076 0 obj -(16.3 Native MS Windows NT4 Trusts Configuration) +(15.3.6 NTLMv2 Security) endobj 1077 0 obj -<< /S /GoTo /D (subsection.16.3.1) >> +<< /S /GoTo /D (section.15.4) >> endobj 1080 0 obj -(16.3.1 Creating an NT4 Domain Trust) +(15.4 Upgrading Samba) endobj 1081 0 obj -<< /S /GoTo /D (subsection.16.3.2) >> +<< /S /GoTo /D (section.15.5) >> endobj 1084 0 obj -(16.3.2 Completing an NT4 Domain Trust) +(15.5 Common Errors) endobj 1085 0 obj -<< /S /GoTo /D (subsection.16.3.3) >> +<< /S /GoTo /D (subsection.15.5.1) >> endobj 1088 0 obj -(16.3.3 Inter-Domain Trust Facilities) +(15.5.1 Smbclient Works on Localhost, but the Network Is Dead) endobj 1089 0 obj -<< /S /GoTo /D (section.16.4) >> +<< /S /GoTo /D (subsection.15.5.2) >> endobj 1092 0 obj -(16.4 Configuring Samba NT-style Domain Trusts) +(15.5.2 Why Can Users Access Home Directories of Other Users?) endobj 1093 0 obj -<< /S /GoTo /D (subsection.16.4.1) >> +<< /S /GoTo /D (chapter.16) >> endobj 1096 0 obj -(16.4.1 Samba as the Trusted Domain) +(16 Interdomain Trust Relationships) endobj 1097 0 obj -<< /S /GoTo /D (subsection.16.4.2) >> +<< /S /GoTo /D (section.16.1) >> endobj 1100 0 obj -(16.4.2 Samba as the Trusting Domain) +(16.1 Features and Benefits) endobj 1101 0 obj -<< /S /GoTo /D (section.16.5) >> +<< /S /GoTo /D (section.16.2) >> endobj 1104 0 obj -(16.5 NT4-style Domain Trusts with Windows 2000) +(16.2 Trust Relationship Background) endobj 1105 0 obj -<< /S /GoTo /D (section.16.6) >> +<< /S /GoTo /D (section.16.3) >> endobj 1108 0 obj -(16.6 Common Errors) +(16.3 Native MS Windows NT4 Trusts Configuration) endobj 1109 0 obj -<< /S /GoTo /D (chapter.17) >> +<< /S /GoTo /D (subsection.16.3.1) >> endobj 1112 0 obj -(17 Hosting a Microsoft Distributed File System tree on Samba) +(16.3.1 Creating an NT4 Domain Trust) endobj 1113 0 obj -<< /S /GoTo /D (section.17.1) >> +<< /S /GoTo /D (subsection.16.3.2) >> endobj 1116 0 obj -(17.1 Features and Benefits) +(16.3.2 Completing an NT4 Domain Trust) endobj 1117 0 obj -<< /S /GoTo /D (section.17.2) >> +<< /S /GoTo /D (subsection.16.3.3) >> endobj 1120 0 obj -(17.2 Common Errors) +(16.3.3 Inter-Domain Trust Facilities) endobj 1121 0 obj -<< /S /GoTo /D (chapter.18) >> +<< /S /GoTo /D (section.16.4) >> endobj 1124 0 obj -(18 Classical Printing Support) +(16.4 Configuring Samba NT-Style Domain Trusts) endobj 1125 0 obj -<< /S /GoTo /D (section.18.1) >> +<< /S /GoTo /D (subsection.16.4.1) >> endobj 1128 0 obj -(18.1 Features and Benefits) +(16.4.1 Samba as the Trusted Domain) endobj 1129 0 obj -<< /S /GoTo /D (section.18.2) >> +<< /S /GoTo /D (subsection.16.4.2) >> endobj 1132 0 obj -(18.2 Technical Introduction) +(16.4.2 Samba as the Trusting Domain) endobj 1133 0 obj -<< /S /GoTo /D (subsection.18.2.1) >> +<< /S /GoTo /D (section.16.5) >> endobj 1136 0 obj -(18.2.1 What happens if you send a Job from a Client) +(16.5 NT4-Style Domain Trusts with Windows 2000) endobj 1137 0 obj -<< /S /GoTo /D (subsection.18.2.2) >> +<< /S /GoTo /D (section.16.6) >> endobj 1140 0 obj -(18.2.2 Printing Related Configuration Parameters) +(16.6 Common Errors) endobj 1141 0 obj -<< /S /GoTo /D (subsection.18.2.3) >> +<< /S /GoTo /D (chapter.17) >> endobj 1144 0 obj -(18.2.3 Parameters Recommended for Use) +(17 Hosting a Microsoft Distributed File System tree on Samba) endobj 1145 0 obj -<< /S /GoTo /D (section.18.3) >> +<< /S /GoTo /D (section.17.1) >> endobj 1148 0 obj -(18.3 A simple Configuration to Print) +(17.1 Features and Benefits) endobj 1149 0 obj -<< /S /GoTo /D (subsection.18.3.1) >> +<< /S /GoTo /D (section.17.2) >> endobj 1152 0 obj -(18.3.1 Verification of "Settings in Use" with testparm) +(17.2 Common Errors) endobj 1153 0 obj -<< /S /GoTo /D (subsection.18.3.2) >> +<< /S /GoTo /D (subsection.17.2.1) >> endobj 1156 0 obj -(18.3.2 A little Experiment to warn you) +(17.2.1 MSDFS UNIX Path Is Case-Critical) endobj 1157 0 obj -<< /S /GoTo /D (section.18.4) >> +<< /S /GoTo /D (chapter.18) >> endobj 1160 0 obj -(18.4 Extended Sample Configuration to Print) +(18 Classical Printing Support) endobj 1161 0 obj -<< /S /GoTo /D (section.18.5) >> +<< /S /GoTo /D (section.18.1) >> endobj 1164 0 obj -(18.5 Detailed Explanation of the Example's Settings) +(18.1 Features and Benefits) endobj 1165 0 obj -<< /S /GoTo /D (subsection.18.5.1) >> +<< /S /GoTo /D (section.18.2) >> endobj 1168 0 obj -(18.5.1 The [global] Section) +(18.2 Technical Introduction) endobj 1169 0 obj -<< /S /GoTo /D (subsection.18.5.2) >> +<< /S /GoTo /D (subsection.18.2.1) >> endobj 1172 0 obj -(18.5.2 The [printers] Section) +(18.2.1 Client to Samba Print Job Processing) endobj 1173 0 obj -<< /S /GoTo /D (subsection.18.5.3) >> +<< /S /GoTo /D (subsection.18.2.2) >> endobj 1176 0 obj -(18.5.3 Any [my\137printer\137name] Section) +(18.2.2 Printing Related Configuration Parameters) endobj 1177 0 obj -<< /S /GoTo /D (subsection.18.5.4) >> +<< /S /GoTo /D (section.18.3) >> endobj 1180 0 obj -(18.5.4 Print Commands) +(18.3 Simple Print Configuration) endobj 1181 0 obj -<< /S /GoTo /D (subsection.18.5.5) >> +<< /S /GoTo /D (subsection.18.3.1) >> endobj 1184 0 obj -(18.5.5 Default Print Commands for various UNIX Print Subsystems) +(18.3.1 Verifing Configuration with testparm) endobj 1185 0 obj -<< /S /GoTo /D (subsection.18.5.6) >> +<< /S /GoTo /D (subsection.18.3.2) >> endobj 1188 0 obj -(18.5.6 Setting up your own Print Commands) +(18.3.2 Rapid Configuration Validation) endobj 1189 0 obj -<< /S /GoTo /D (section.18.6) >> +<< /S /GoTo /D (section.18.4) >> endobj 1192 0 obj -(18.6 Innovations in Samba Printing since 2.2) +(18.4 Extended Printing Configuration) endobj 1193 0 obj -<< /S /GoTo /D (subsection.18.6.1) >> +<< /S /GoTo /D (subsection.18.4.1) >> endobj 1196 0 obj -(18.6.1 Client Drivers on Samba Server for Point'n'Print) +(18.4.1 Detailed Explanation Settings) endobj 1197 0 obj -<< /S /GoTo /D (subsection.18.6.2) >> +<< /S /GoTo /D (subsubsection.18.4.1.1) >> endobj 1200 0 obj -(18.6.2 The [printer\044] Section is removed from Samba 3) +(18.4.1.1 The [global] Section) endobj 1201 0 obj -<< /S /GoTo /D (subsection.18.6.3) >> +<< /S /GoTo /D (subsubsection.18.4.1.2) >> endobj 1204 0 obj -(18.6.3 Creating the [print\044] Share) +(18.4.1.2 The [printers] Section) endobj 1205 0 obj -<< /S /GoTo /D (subsection.18.6.4) >> +<< /S /GoTo /D (subsubsection.18.4.1.3) >> endobj 1208 0 obj -(18.6.4 Parameters in the [print\044] Section) +(18.4.1.3 Any [my\137printer\137name] Section) endobj 1209 0 obj -<< /S /GoTo /D (subsection.18.6.5) >> +<< /S /GoTo /D (subsubsection.18.4.1.4) >> endobj 1212 0 obj -(18.6.5 Subdirectory Structure in [print\044]) +(18.4.1.4 Print Commands) endobj 1213 0 obj -<< /S /GoTo /D (section.18.7) >> +<< /S /GoTo /D (subsubsection.18.4.1.5) >> endobj 1216 0 obj -(18.7 Installing Drivers into [print\044]) +(18.4.1.5 Default UNIX System Printing Commands) endobj 1217 0 obj -<< /S /GoTo /D (subsection.18.7.1) >> +<< /S /GoTo /D (subsubsection.18.4.1.6) >> endobj 1220 0 obj -(18.7.1 Setting Drivers for existing Printers with a Client GUI) +(18.4.1.6 Custom Print Commands) endobj 1221 0 obj -<< /S /GoTo /D (subsection.18.7.2) >> +<< /S /GoTo /D (section.18.5) >> endobj 1224 0 obj -(18.7.2 Setting Drivers for existing Printers with rpcclient) +(18.5 Printing Developments Since Samba-2.2) endobj 1225 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.1) >> +<< /S /GoTo /D (subsection.18.5.1) >> endobj 1228 0 obj -(18.7.2.1 Identifying the Driver Files) +(18.5.1 Point'n'Print Client Drivers on Samba Servers) endobj 1229 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.2) >> +<< /S /GoTo /D (subsection.18.5.2) >> endobj 1232 0 obj -(18.7.2.2 Collecting the Driver Files from a Windows Host's [print\044] Share) +(18.5.2 The Obsoleted [printer\044] Section) endobj 1233 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.3) >> +<< /S /GoTo /D (subsection.18.5.3) >> endobj 1236 0 obj -(18.7.2.3 Depositing the Driver Files into [print\044]) +(18.5.3 Creating the [print\044] Share) endobj 1237 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.4) >> +<< /S /GoTo /D (subsection.18.5.4) >> endobj 1240 0 obj -(18.7.2.4 Check if the Driver Files are there \(with smbclient\)) +(18.5.4 [print\044] Section Parameters) endobj 1241 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.5) >> +<< /S /GoTo /D (subsection.18.5.5) >> endobj 1244 0 obj -(18.7.2.5 Running rpcclient with adddriver) +(18.5.5 The [print\044] Share Directory) endobj 1245 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.6) >> +<< /S /GoTo /D (section.18.6) >> endobj 1248 0 obj -(18.7.2.6 Check how Driver Files have been moved after adddriver finished) +(18.6 Installing Drivers into [print\044]) endobj 1249 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.7) >> +<< /S /GoTo /D (subsection.18.6.1) >> endobj 1252 0 obj -(18.7.2.7 Check if the Driver is recognized by Samba) +(18.6.1 Add Printer Wizard Driver Installation) endobj 1253 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.8) >> +<< /S /GoTo /D (subsection.18.6.2) >> endobj 1256 0 obj -(18.7.2.8 A side note: you are not bound to specific driver names) +(18.6.2 Installing Print Drivers Using rpcclient) endobj 1257 0 obj -<< /S /GoTo /D (subsubsection.18.7.2.9) >> +<< /S /GoTo /D (subsubsection.18.6.2.1) >> endobj 1260 0 obj -(18.7.2.9 Running rpcclient with setdriver) +(18.6.2.1 Identifying Driver Files) endobj 1261 0 obj -<< /S /GoTo /D (section.18.8) >> +<< /S /GoTo /D (subsubsection.18.6.2.2) >> endobj 1264 0 obj -(18.8 Client Driver Install Procedure) +(18.6.2.2 Obtaining Driver Files from Windows Client [print\044] Shares) endobj 1265 0 obj -<< /S /GoTo /D (subsection.18.8.1) >> +<< /S /GoTo /D (subsubsection.18.6.2.3) >> endobj 1268 0 obj -(18.8.1 The first Client Driver Installation) +(18.6.2.3 Installing Driver Files into [print\044]) endobj 1269 0 obj -<< /S /GoTo /D (subsection.18.8.2) >> +<< /S /GoTo /D (subsubsection.18.6.2.4) >> endobj 1272 0 obj -(18.8.2 IMPORTANT! Setting Device Modes on new Printers) +(18.6.2.4 smbclient to Confirm Driver Installation) endobj 1273 0 obj -<< /S /GoTo /D (subsection.18.8.3) >> +<< /S /GoTo /D (subsubsection.18.6.2.5) >> endobj 1276 0 obj -(18.8.3 Further Client Driver Install Procedures) +(18.6.2.5 Running rpcclient with adddriver) endobj 1277 0 obj -<< /S /GoTo /D (subsection.18.8.4) >> +<< /S /GoTo /D (subsubsection.18.6.2.6) >> endobj 1280 0 obj -(18.8.4 Always make first Client Connection as root or "printer admin") +(18.6.2.6 Checking adddriver Completion) endobj 1281 0 obj -<< /S /GoTo /D (section.18.9) >> +<< /S /GoTo /D (subsubsection.18.6.2.7) >> endobj 1284 0 obj -(18.9 Other Gotchas) +(18.6.2.7 Check Samba for Driver Recognition) endobj 1285 0 obj -<< /S /GoTo /D (subsection.18.9.1) >> +<< /S /GoTo /D (subsubsection.18.6.2.8) >> endobj 1288 0 obj -(18.9.1 Setting Default Print Options for the Client Drivers) +(18.6.2.8 Specific Driver Name Flexibility) endobj 1289 0 obj -<< /S /GoTo /D (subsection.18.9.2) >> +<< /S /GoTo /D (subsubsection.18.6.2.9) >> endobj 1292 0 obj -(18.9.2 Supporting large Numbers of Printers) +(18.6.2.9 Running rpcclient with the setdriver) endobj 1293 0 obj -<< /S /GoTo /D (subsection.18.9.3) >> +<< /S /GoTo /D (section.18.7) >> endobj 1296 0 obj -(18.9.3 Adding new Printers with the Windows NT APW) +(18.7 Client Driver Installation Procedure) endobj 1297 0 obj -<< /S /GoTo /D (subsection.18.9.4) >> +<< /S /GoTo /D (subsection.18.7.1) >> endobj 1300 0 obj -(18.9.4 Weird Error Message Cannot connect under a different Name) +(18.7.1 First Client Driver Installation) endobj 1301 0 obj -<< /S /GoTo /D (subsection.18.9.5) >> +<< /S /GoTo /D (subsection.18.7.2) >> endobj 1304 0 obj -(18.9.5 Be careful when assembling Driver Files) +(18.7.2 Setting Device Modes on New Printers) endobj 1305 0 obj -<< /S /GoTo /D (subsection.18.9.6) >> +<< /S /GoTo /D (subsection.18.7.3) >> endobj 1308 0 obj -(18.9.6 Samba and Printer Ports) +(18.7.3 Additional Client Driver Installation) endobj 1309 0 obj -<< /S /GoTo /D (subsection.18.9.7) >> +<< /S /GoTo /D (subsection.18.7.4) >> endobj 1312 0 obj -(18.9.7 Avoiding the most common Misconfigurations of the Client Driver) +(18.7.4 Always Make First Client Connection as root or ``printer admin'') endobj 1313 0 obj -<< /S /GoTo /D (section.18.10) >> +<< /S /GoTo /D (section.18.8) >> endobj 1316 0 obj -(18.10 The Imprints Toolset) +(18.8 Other Gotchas) endobj 1317 0 obj -<< /S /GoTo /D (subsection.18.10.1) >> +<< /S /GoTo /D (subsection.18.8.1) >> endobj 1320 0 obj -(18.10.1 What is Imprints?) +(18.8.1 Setting Default Print Options for Client Drivers) endobj 1321 0 obj -<< /S /GoTo /D (subsection.18.10.2) >> +<< /S /GoTo /D (subsection.18.8.2) >> endobj 1324 0 obj -(18.10.2 Creating Printer Driver Packages) +(18.8.2 Supporting Large Numbers of Printers) endobj 1325 0 obj -<< /S /GoTo /D (subsection.18.10.3) >> +<< /S /GoTo /D (subsection.18.8.3) >> endobj 1328 0 obj -(18.10.3 The Imprints Server) +(18.8.3 Adding New Printers with the Windows NT APW) endobj 1329 0 obj -<< /S /GoTo /D (subsection.18.10.4) >> +<< /S /GoTo /D (subsection.18.8.4) >> endobj 1332 0 obj -(18.10.4 The Installation Client) +(18.8.4 Error Message: ``Cannot connect under a different Name'') endobj 1333 0 obj -<< /S /GoTo /D (section.18.11) >> +<< /S /GoTo /D (subsection.18.8.5) >> endobj 1336 0 obj -(18.11 Add Network Printers at Logon without User Interaction) +(18.8.5 Take Care When Assembling Driver Files) endobj 1337 0 obj -<< /S /GoTo /D (section.18.12) >> +<< /S /GoTo /D (subsection.18.8.6) >> endobj 1340 0 obj -(18.12 The addprinter command) +(18.8.6 Samba and Printer Ports) endobj 1341 0 obj -<< /S /GoTo /D (section.18.13) >> +<< /S /GoTo /D (subsection.18.8.7) >> endobj 1344 0 obj -(18.13 Migration of "Classical" printing to Samba) +(18.8.7 Avoiding Common Client Driver Misconfiguration) endobj 1345 0 obj -<< /S /GoTo /D (section.18.14) >> +<< /S /GoTo /D (section.18.9) >> endobj 1348 0 obj -(18.14 Publishing Printer Information in Active Directory or LDAP) +(18.9 The Imprints Toolset) endobj 1349 0 obj -<< /S /GoTo /D (section.18.15) >> +<< /S /GoTo /D (subsection.18.9.1) >> endobj 1352 0 obj -(18.15 Common Errors) +(18.9.1 What is Imprints?) endobj 1353 0 obj -<< /S /GoTo /D (subsection.18.15.1) >> +<< /S /GoTo /D (subsection.18.9.2) >> endobj 1356 0 obj -(18.15.1 I give my root password but I don't get access) +(18.9.2 Creating Printer Driver Packages) endobj 1357 0 obj -<< /S /GoTo /D (subsection.18.15.2) >> +<< /S /GoTo /D (subsection.18.9.3) >> endobj 1360 0 obj -(18.15.2 My printjobs get spooled into the spooling directory, but then get lost) +(18.9.3 The Imprints Server) endobj 1361 0 obj -<< /S /GoTo /D (chapter.19) >> +<< /S /GoTo /D (subsection.18.9.4) >> endobj 1364 0 obj -(19 CUPS Printing Support in Samba 3.0) +(18.9.4 The Installation Client) endobj 1365 0 obj -<< /S /GoTo /D (section.19.1) >> +<< /S /GoTo /D (section.18.10) >> endobj 1368 0 obj -(19.1 Introduction) +(18.10 Adding Network Printers without User Interaction) endobj 1369 0 obj -<< /S /GoTo /D (subsection.19.1.1) >> +<< /S /GoTo /D (section.18.11) >> endobj 1372 0 obj -(19.1.1 Features and Benefits) +(18.11 The addprinter Command) endobj 1373 0 obj -<< /S /GoTo /D (subsection.19.1.2) >> +<< /S /GoTo /D (section.18.12) >> endobj 1376 0 obj -(19.1.2 Overview) +(18.12 Migration of Classical Printing to Samba) endobj 1377 0 obj -<< /S /GoTo /D (section.19.2) >> +<< /S /GoTo /D (section.18.13) >> endobj 1380 0 obj -(19.2 Basic Configuration of CUPS support) +(18.13 Publishing Printer Information in Active Directory or LDAP) endobj 1381 0 obj -<< /S /GoTo /D (subsection.19.2.1) >> +<< /S /GoTo /D (section.18.14) >> endobj 1384 0 obj -(19.2.1 Linking of smbd with libcups.so) +(18.14 Common Errors) endobj 1385 0 obj -<< /S /GoTo /D (subsection.19.2.2) >> +<< /S /GoTo /D (subsection.18.14.1) >> endobj 1388 0 obj -(19.2.2 Simple smb.conf Settings for CUPS) +(18.14.1 I Give My Root Password but I Do Not Get Access) endobj 1389 0 obj -<< /S /GoTo /D (subsection.19.2.3) >> +<< /S /GoTo /D (subsection.18.14.2) >> endobj 1392 0 obj -(19.2.3 More complex smb.conf Settings for CUPS) +(18.14.2 My Print Jobs Get Spooled into the Spooling Directory, but Then Get Lost) endobj 1393 0 obj -<< /S /GoTo /D (section.19.3) >> +<< /S /GoTo /D (chapter.19) >> endobj 1396 0 obj -(19.3 Advanced Configuration) +(19 CUPS Printing Support) endobj 1397 0 obj -<< /S /GoTo /D (subsection.19.3.1) >> +<< /S /GoTo /D (section.19.1) >> endobj 1400 0 obj -(19.3.1 Central spooling vs. "Peer-to-Peer" printing) +(19.1 Introduction) endobj 1401 0 obj -<< /S /GoTo /D (subsection.19.3.2) >> +<< /S /GoTo /D (subsection.19.1.1) >> endobj 1404 0 obj -(19.3.2 CUPS/Samba as a "spooling-only" Print Server; "raw" printing with Vendor Drivers on Windows Clients) +(19.1.1 Features and Benefits) endobj 1405 0 obj -<< /S /GoTo /D (subsection.19.3.3) >> +<< /S /GoTo /D (subsection.19.1.2) >> endobj 1408 0 obj -(19.3.3 Driver Installation Methods on Windows Clients) +(19.1.2 Overview) endobj 1409 0 obj -<< /S /GoTo /D (subsection.19.3.4) >> +<< /S /GoTo /D (section.19.2) >> endobj 1412 0 obj -(19.3.4 Explicitly enable "raw" printing for application/octet-stream!) +(19.2 Basic CUPS Support Configuration) endobj 1413 0 obj -<< /S /GoTo /D (subsection.19.3.5) >> +<< /S /GoTo /D (subsection.19.2.1) >> endobj 1416 0 obj -(19.3.5 Three familiar Methods for driver upload plus a new one) +(19.2.1 Linking smbd with libcups.so) endobj 1417 0 obj -<< /S /GoTo /D (section.19.4) >> +<< /S /GoTo /D (subsection.19.2.2) >> endobj 1420 0 obj -(19.4 Using CUPS/Samba in an advanced Way -- intelligent printing with PostScript Driver Download) +(19.2.2 Simple smb.conf Settings for CUPS) endobj 1421 0 obj -<< /S /GoTo /D (subsection.19.4.1) >> +<< /S /GoTo /D (subsection.19.2.3) >> endobj 1424 0 obj -(19.4.1 GDI on Windows -- PostScript on UNIX) +(19.2.3 More Complex CUPS smb.conf Settings) endobj 1425 0 obj -<< /S /GoTo /D (subsection.19.4.2) >> +<< /S /GoTo /D (section.19.3) >> endobj 1428 0 obj -(19.4.2 Windows Drivers, GDI and EMF) +(19.3 Advanced Configuration) endobj 1429 0 obj -<< /S /GoTo /D (subsection.19.4.3) >> +<< /S /GoTo /D (subsection.19.3.1) >> endobj 1432 0 obj -(19.4.3 UNIX Printfile Conversion and GUI Basics) +(19.3.1 Central Spooling vs. ``Peer-to-Peer'' Printing) endobj 1433 0 obj -<< /S /GoTo /D (subsection.19.4.4) >> +<< /S /GoTo /D (subsection.19.3.2) >> endobj 1436 0 obj -(19.4.4 PostScript and Ghostscript) +(19.3.2 Raw Print Serving --- Vendor Drivers on Windows Clients) endobj 1437 0 obj -<< /S /GoTo /D (subsection.19.4.5) >> +<< /S /GoTo /D (subsection.19.3.3) >> endobj 1440 0 obj -(19.4.5 Ghostscript -- the Software RIP for non-PostScript Printers) +(19.3.3 Installation of Windows Client Drivers) endobj 1441 0 obj -<< /S /GoTo /D (subsection.19.4.6) >> +<< /S /GoTo /D (subsection.19.3.4) >> endobj 1444 0 obj -(19.4.6 PostScript Printer Description \(PPD\) Specification) +(19.3.4 Explicitly Enable ``raw'' Printing for application/octet-stream) endobj 1445 0 obj -<< /S /GoTo /D (subsection.19.4.7) >> +<< /S /GoTo /D (subsection.19.3.5) >> endobj 1448 0 obj -(19.4.7 CUPS can use all Windows-formatted Vendor PPDs) +(19.3.5 Driver Upload Methods) endobj 1449 0 obj -<< /S /GoTo /D (subsection.19.4.8) >> +<< /S /GoTo /D (section.19.4) >> endobj 1452 0 obj -(19.4.8 CUPS also uses PPDs for non-PostScript Printers) +(19.4 Advanced Intelligent Printing with PostScript Driver Download) endobj 1453 0 obj -<< /S /GoTo /D (section.19.5) >> +<< /S /GoTo /D (subsection.19.4.1) >> endobj 1456 0 obj -(19.5 The CUPS Filtering Architecture) +(19.4.1 GDI on Windows -- PostScript on UNIX) endobj 1457 0 obj -<< /S /GoTo /D (subsection.19.5.1) >> +<< /S /GoTo /D (subsection.19.4.2) >> endobj 1460 0 obj -(19.5.1 MIME types and CUPS Filters) +(19.4.2 Windows Drivers, GDI and EMF) endobj 1461 0 obj -<< /S /GoTo /D (subsection.19.5.2) >> +<< /S /GoTo /D (subsection.19.4.3) >> endobj 1464 0 obj -(19.5.2 MIME type Conversion Rules) +(19.4.3 UNIX Printfile Conversion and GUI Basics) endobj 1465 0 obj -<< /S /GoTo /D (subsection.19.5.3) >> +<< /S /GoTo /D (subsection.19.4.4) >> endobj 1468 0 obj -(19.5.3 Filter Requirements) +(19.4.4 PostScript and Ghostscript) endobj 1469 0 obj -<< /S /GoTo /D (subsection.19.5.4) >> +<< /S /GoTo /D (subsection.19.4.5) >> endobj 1472 0 obj -(19.5.4 Prefilters) +(19.4.5 Ghostscript --- the Software RIP for Non-PostScript Printers) endobj 1473 0 obj -<< /S /GoTo /D (subsection.19.5.5) >> +<< /S /GoTo /D (subsection.19.4.6) >> endobj 1476 0 obj -(19.5.5 pstops) +(19.4.6 PostScript Printer Description \(PPD\) Specification) endobj 1477 0 obj -<< /S /GoTo /D (subsection.19.5.6) >> +<< /S /GoTo /D (subsection.19.4.7) >> endobj 1480 0 obj -(19.5.6 pstoraster) +(19.4.7 Using Windows-Formatted Vendor PPDs) endobj 1481 0 obj -<< /S /GoTo /D (subsection.19.5.7) >> +<< /S /GoTo /D (subsection.19.4.8) >> endobj 1484 0 obj -(19.5.7 imagetops and imagetoraster) +(19.4.8 CUPS Also Uses PPDs for Non-PostScript Printers) endobj 1485 0 obj -<< /S /GoTo /D (subsection.19.5.8) >> +<< /S /GoTo /D (section.19.5) >> endobj 1488 0 obj -(19.5.8 rasterto [printers specific]) +(19.5 The CUPS Filtering Architecture) endobj 1489 0 obj -<< /S /GoTo /D (subsection.19.5.9) >> +<< /S /GoTo /D (subsection.19.5.1) >> endobj 1492 0 obj -(19.5.9 CUPS Backends) +(19.5.1 MIME Types and CUPS Filters) endobj 1493 0 obj -<< /S /GoTo /D (subsection.19.5.10) >> +<< /S /GoTo /D (subsection.19.5.2) >> endobj 1496 0 obj -(19.5.10 cupsomatic/Foomatic -- how do they fit into the Picture?) +(19.5.2 MIME Type Conversion Rules) endobj 1497 0 obj -<< /S /GoTo /D (subsection.19.5.11) >> +<< /S /GoTo /D (subsection.19.5.3) >> endobj 1500 0 obj -(19.5.11 The Complete Picture) +(19.5.3 Filtering Overview) endobj 1501 0 obj -<< /S /GoTo /D (subsection.19.5.12) >> +<< /S /GoTo /D (subsubsection.19.5.3.1) >> endobj 1504 0 obj -(19.5.12 mime.convs) +(19.5.3.1 Filter requirements) endobj 1505 0 obj -<< /S /GoTo /D (subsection.19.5.13) >> +<< /S /GoTo /D (subsection.19.5.4) >> endobj 1508 0 obj -(19.5.13 "Raw" printing) +(19.5.4 Prefilters) endobj 1509 0 obj -<< /S /GoTo /D (subsection.19.5.14) >> +<< /S /GoTo /D (subsection.19.5.5) >> endobj 1512 0 obj -(19.5.14 "application/octet-stream" printing) +(19.5.5 pstops) endobj 1513 0 obj -<< /S /GoTo /D (subsection.19.5.15) >> +<< /S /GoTo /D (subsection.19.5.6) >> endobj 1516 0 obj -(19.5.15 PostScript Printer Descriptions \(PPDs\) for non-PS Printers) +(19.5.6 pstoraster) endobj 1517 0 obj -<< /S /GoTo /D (subsection.19.5.16) >> +<< /S /GoTo /D (subsection.19.5.7) >> endobj 1520 0 obj -(19.5.16 Difference between cupsomatic/foomatic-rip and native CUPS printing) +(19.5.7 imagetops and imagetoraster) endobj 1521 0 obj -<< /S /GoTo /D (subsection.19.5.17) >> +<< /S /GoTo /D (subsection.19.5.8) >> endobj 1524 0 obj -(19.5.17 Examples for filtering Chains) +(19.5.8 rasterto [printers specific]) endobj 1525 0 obj -<< /S /GoTo /D (subsection.19.5.18) >> +<< /S /GoTo /D (subsection.19.5.9) >> endobj 1528 0 obj -(19.5.18 Sources of CUPS drivers / PPDs) +(19.5.9 CUPS Backends) endobj 1529 0 obj -<< /S /GoTo /D (subsection.19.5.19) >> +<< /S /GoTo /D (subsection.19.5.10) >> endobj 1532 0 obj -(19.5.19 Printing with Interface Scripts) +(19.5.10 The Role of =`cupsomatic/foomatic=`) endobj 1533 0 obj -<< /S /GoTo /D (section.19.6) >> +<< /S /GoTo /D (subsection.19.5.11) >> endobj 1536 0 obj -(19.6 Network printing \(purely Windows\)) +(19.5.11 The Complete Picture) endobj 1537 0 obj -<< /S /GoTo /D (subsection.19.6.1) >> +<< /S /GoTo /D (subsection.19.5.12) >> endobj 1540 0 obj -(19.6.1 From Windows Clients to an NT Print Server) +(19.5.12 mime.convs) endobj 1541 0 obj -<< /S /GoTo /D (subsection.19.6.2) >> +<< /S /GoTo /D (subsection.19.5.13) >> endobj 1544 0 obj -(19.6.2 Driver Execution on the Client) +(19.5.13 ``Raw'' Printing) endobj 1545 0 obj -<< /S /GoTo /D (subsection.19.6.3) >> +<< /S /GoTo /D (subsection.19.5.14) >> endobj 1548 0 obj -(19.6.3 Driver Execution on the Server) +(19.5.14 application/octet-stream Printing) endobj 1549 0 obj -<< /S /GoTo /D (section.19.7) >> +<< /S /GoTo /D (subsection.19.5.15) >> endobj 1552 0 obj -(19.7 Network Printing \(Windows clients -- UNIX/Samba Print Servers\)) +(19.5.15 PostScript Printer Descriptions \(PPDs\) for Non-PS Printers) endobj 1553 0 obj -<< /S /GoTo /D (subsection.19.7.1) >> +<< /S /GoTo /D (subsection.19.5.16) >> endobj 1556 0 obj -(19.7.1 From Windows Clients to a CUPS/Samba Print Server) +(19.5.16 cupsomatic/foomatic-rip Versus native CUPS Printing) endobj 1557 0 obj -<< /S /GoTo /D (subsection.19.7.2) >> +<< /S /GoTo /D (subsection.19.5.17) >> endobj 1560 0 obj -(19.7.2 Samba receiving Jobfiles and passing them to CUPS) +(19.5.17 Examples for Filtering Chains) endobj 1561 0 obj -<< /S /GoTo /D (section.19.8) >> +<< /S /GoTo /D (subsection.19.5.18) >> endobj 1564 0 obj -(19.8 Network PostScript RIP: CUPS Filters on Server -- clients use PostScript Driver with CUPS-PPDs) +(19.5.18 Sources of CUPS Drivers/PPDs) endobj 1565 0 obj -<< /S /GoTo /D (subsection.19.8.1) >> +<< /S /GoTo /D (subsection.19.5.19) >> endobj 1568 0 obj -(19.8.1 PPDs for non-PS Printers on UNIX) +(19.5.19 Printing with Interface Scripts) endobj 1569 0 obj -<< /S /GoTo /D (subsection.19.8.2) >> +<< /S /GoTo /D (section.19.6) >> endobj 1572 0 obj -(19.8.2 PPDs for non-PS Printers on Windows) +(19.6 Network Printing \(Purely Windows\)) endobj 1573 0 obj -<< /S /GoTo /D (section.19.9) >> +<< /S /GoTo /D (subsection.19.6.1) >> endobj 1576 0 obj -(19.9 Windows Terminal Servers \(WTS\) as CUPS Clients) +(19.6.1 From Windows Clients to an NT Print Server) endobj 1577 0 obj -<< /S /GoTo /D (subsection.19.9.1) >> +<< /S /GoTo /D (subsection.19.6.2) >> endobj 1580 0 obj -(19.9.1 Printer Drivers running in "Kernel Mode" cause many Problems) +(19.6.2 Driver Execution on the Client) endobj 1581 0 obj -<< /S /GoTo /D (subsection.19.9.2) >> +<< /S /GoTo /D (subsection.19.6.3) >> endobj 1584 0 obj -(19.9.2 Workarounds impose Heavy Limitations) +(19.6.3 Driver Execution on the Server) endobj 1585 0 obj -<< /S /GoTo /D (subsection.19.9.3) >> +<< /S /GoTo /D (section.19.7) >> endobj 1588 0 obj -(19.9.3 CUPS: a "Magical Stone"?) +(19.7 Network Printing \(Windows Clients --- UNIX/Samba Print Servers\)) endobj 1589 0 obj -<< /S /GoTo /D (subsection.19.9.4) >> +<< /S /GoTo /D (subsection.19.7.1) >> endobj 1592 0 obj -(19.9.4 PostScript Drivers with no major problems -- even in Kernel Mode) +(19.7.1 From Windows Clients to a CUPS/Samba Print Server) endobj 1593 0 obj -<< /S /GoTo /D (section.19.10) >> +<< /S /GoTo /D (subsection.19.7.2) >> endobj 1596 0 obj -(19.10 Setting up CUPS for driver Download) +(19.7.2 Samba Receiving Jobfiles and Passing Them to CUPS) endobj 1597 0 obj -<< /S /GoTo /D (subsection.19.10.1) >> +<< /S /GoTo /D (section.19.8) >> endobj 1600 0 obj -(19.10.1 cupsaddsmb: the unknown Utility) +(19.8 Network PostScript RIP) endobj 1601 0 obj -<< /S /GoTo /D (subsection.19.10.2) >> +<< /S /GoTo /D (subsection.19.8.1) >> endobj 1604 0 obj -(19.10.2 Prepare your smb.conf for cupsaddsmb) +(19.8.1 PPDs for Non-PS Printers on UNIX) endobj 1605 0 obj -<< /S /GoTo /D (subsection.19.10.3) >> +<< /S /GoTo /D (subsection.19.8.2) >> endobj 1608 0 obj -(19.10.3 CUPS Package of "PostScript Driver for WinNT/2k/XP") +(19.8.2 PPDs for Non-PS Printers on Windows) endobj 1609 0 obj -<< /S /GoTo /D (subsection.19.10.4) >> +<< /S /GoTo /D (section.19.9) >> endobj 1612 0 obj -(19.10.4 Recognize the different Driver Files) +(19.9 Windows Terminal Servers \(WTS\) as CUPS Clients) endobj 1613 0 obj -<< /S /GoTo /D (subsection.19.10.5) >> +<< /S /GoTo /D (subsection.19.9.1) >> endobj 1616 0 obj -(19.10.5 Acquiring the Adobe Driver Files) +(19.9.1 Printer Drivers Running in ``Kernel Mode'' Cause Many Problems) endobj 1617 0 obj -<< /S /GoTo /D (subsection.19.10.6) >> +<< /S /GoTo /D (subsection.19.9.2) >> endobj 1620 0 obj -(19.10.6 ESP Print Pro Package of "PostScript Driver for WinNT/2k/XP") +(19.9.2 Workarounds Impose Heavy Limitations) endobj 1621 0 obj -<< /S /GoTo /D (subsection.19.10.7) >> +<< /S /GoTo /D (subsection.19.9.3) >> endobj 1624 0 obj -(19.10.7 Caveats to be considered) +(19.9.3 CUPS: A ``Magical Stone''?) endobj 1625 0 obj -<< /S /GoTo /D (subsection.19.10.8) >> +<< /S /GoTo /D (subsection.19.9.4) >> endobj 1628 0 obj -(19.10.8 Benefits of using "CUPS PostScript Driver for Windows NT/2k/XP" instead of Adobe Driver) +(19.9.4 PostScript Drivers with No Major Problems --- Even in Kernel Mode) endobj 1629 0 obj -<< /S /GoTo /D (subsection.19.10.9) >> +<< /S /GoTo /D (section.19.10) >> endobj 1632 0 obj -(19.10.9 Run "cupsaddsmb" \(quiet Mode\)) +(19.10 Configuring CUPS for Driver Download) endobj 1633 0 obj -<< /S /GoTo /D (subsection.19.10.10) >> +<< /S /GoTo /D (subsection.19.10.1) >> endobj 1636 0 obj -(19.10.10 Run "cupsaddsmb" with verbose Output) +(19.10.1 cupsaddsmb: The Unknown Utility) endobj 1637 0 obj -<< /S /GoTo /D (subsection.19.10.11) >> +<< /S /GoTo /D (subsection.19.10.2) >> endobj 1640 0 obj -(19.10.11 Understanding cupsaddsmb) +(19.10.2 Prepare Your smb.conf for cupsaddsmb) endobj 1641 0 obj -<< /S /GoTo /D (subsection.19.10.12) >> +<< /S /GoTo /D (subsection.19.10.3) >> endobj 1644 0 obj -(19.10.12 How to recognize if cupsaddsmb completed successfully) +(19.10.3 CUPS ``PostScript Driver for Windows NT/200x/XP'') endobj 1645 0 obj -<< /S /GoTo /D (subsection.19.10.13) >> +<< /S /GoTo /D (subsection.19.10.4) >> endobj 1648 0 obj -(19.10.13 cupsaddsmb with a Samba PDC) +(19.10.4 Recognizing Different Driver Files) endobj 1649 0 obj -<< /S /GoTo /D (subsection.19.10.14) >> +<< /S /GoTo /D (subsection.19.10.5) >> endobj 1652 0 obj -(19.10.14 cupsaddsmb Flowchart) +(19.10.5 Acquiring the Adobe Driver Files) endobj 1653 0 obj -<< /S /GoTo /D (subsection.19.10.15) >> +<< /S /GoTo /D (subsection.19.10.6) >> endobj 1656 0 obj -(19.10.15 Installing the PostScript Driver on a Client) +(19.10.6 ESP Print Pro PostScript Driver for Windows NT/200x/XP) endobj 1657 0 obj -<< /S /GoTo /D (subsection.19.10.16) >> +<< /S /GoTo /D (subsection.19.10.7) >> endobj 1660 0 obj -(19.10.16 Avoiding critical PostScript Driver Settings on the Client) +(19.10.7 Caveats to be Considered) endobj 1661 0 obj -<< /S /GoTo /D (section.19.11) >> +<< /S /GoTo /D (subsection.19.10.8) >> endobj 1664 0 obj -(19.11 Installing PostScript Driver Files manually \(using rpcclient\)) +(19.10.8 Windows CUPS PostScript Driver Versus Adobe Driver) endobj 1665 0 obj -<< /S /GoTo /D (subsection.19.11.1) >> +<< /S /GoTo /D (subsection.19.10.9) >> endobj 1668 0 obj -(19.11.1 A Check of the rpcclient man Page) +(19.10.9 Run cupsaddsmb \(Quiet Mode\)) endobj 1669 0 obj -<< /S /GoTo /D (subsection.19.11.2) >> +<< /S /GoTo /D (subsection.19.10.10) >> endobj 1672 0 obj -(19.11.2 Understanding the rpcclient man page) +(19.10.10 Run cupsaddsmb with Verbose Output) endobj 1673 0 obj -<< /S /GoTo /D (subsection.19.11.3) >> +<< /S /GoTo /D (subsection.19.10.11) >> endobj 1676 0 obj -(19.11.3 Producing an Example by querying a Windows Box) +(19.10.11 Understanding cupsaddsmb) endobj 1677 0 obj -<< /S /GoTo /D (subsection.19.11.4) >> +<< /S /GoTo /D (subsection.19.10.12) >> endobj 1680 0 obj -(19.11.4 What is required for adddriver and setdriver to succeed) +(19.10.12 How to Recognize If cupsaddsmb Completed Successfully) endobj 1681 0 obj -<< /S /GoTo /D (subsection.19.11.5) >> +<< /S /GoTo /D (subsection.19.10.13) >> endobj 1684 0 obj -(19.11.5 Manual Driver Installation in 15 Steps) +(19.10.13 cupsaddsmb with a Samba PDC) endobj 1685 0 obj -<< /S /GoTo /D (subsection.19.11.6) >> +<< /S /GoTo /D (subsection.19.10.14) >> endobj 1688 0 obj -(19.11.6 Troubleshooting revisited) +(19.10.14 cupsaddsmb Flowchart) endobj 1689 0 obj -<< /S /GoTo /D (section.19.12) >> +<< /S /GoTo /D (subsection.19.10.15) >> endobj 1692 0 obj -(19.12 The printing *.tdb Files) +(19.10.15 Installing the PostScript Driver on a Client) endobj 1693 0 obj -<< /S /GoTo /D (subsection.19.12.1) >> +<< /S /GoTo /D (subsection.19.10.16) >> endobj 1696 0 obj -(19.12.1 Trivial DataBase Files) +(19.10.16 Avoiding Critical PostScript Driver Settings on the Client) endobj 1697 0 obj -<< /S /GoTo /D (subsection.19.12.2) >> +<< /S /GoTo /D (section.19.11) >> endobj 1700 0 obj -(19.12.2 Binary Format) +(19.11 Installing PostScript Driver Files Manually Using rpcclient) endobj 1701 0 obj -<< /S /GoTo /D (subsection.19.12.3) >> +<< /S /GoTo /D (subsection.19.11.1) >> endobj 1704 0 obj -(19.12.3 Losing *.tdb Files) +(19.11.1 A Check of the rpcclient man Page) endobj 1705 0 obj -<< /S /GoTo /D (subsection.19.12.4) >> +<< /S /GoTo /D (subsection.19.11.2) >> endobj 1708 0 obj -(19.12.4 Using tdbbackup) +(19.11.2 Understanding the rpcclient man Page) endobj 1709 0 obj -<< /S /GoTo /D (section.19.13) >> +<< /S /GoTo /D (subsection.19.11.3) >> endobj 1712 0 obj -(19.13 CUPS Print Drivers from Linuxprinting.org) +(19.11.3 Producing an Example by Querying a Windows Box) endobj 1713 0 obj -<< /S /GoTo /D (subsection.19.13.1) >> +<< /S /GoTo /D (subsection.19.11.4) >> endobj 1716 0 obj -(19.13.1 foomatic-rip and Foomatic explained) +(19.11.4 Requirements for adddriver and setdriver to Succeed) endobj 1717 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.1) >> +<< /S /GoTo /D (subsection.19.11.5) >> endobj 1720 0 obj -(19.13.1.1 690 "perfect" Printers) +(19.11.5 Manual Driver Installation in 15 Steps) endobj 1721 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.2) >> +<< /S /GoTo /D (subsection.19.11.6) >> endobj 1724 0 obj -(19.13.1.2 How the "Printing HOWTO" started it all) +(19.11.6 Troubleshooting Revisited) endobj 1725 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.3) >> +<< /S /GoTo /D (section.19.12) >> endobj 1728 0 obj -(19.13.1.3 Foomatic's strange Name) +(19.12 The Printing *.tdb Files) endobj 1729 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.4) >> +<< /S /GoTo /D (subsection.19.12.1) >> endobj 1732 0 obj -(19.13.1.4 cupsomatic, pdqomatic, lpdomatic, directomatic) +(19.12.1 Trivial Database Files) endobj 1733 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.5) >> +<< /S /GoTo /D (subsection.19.12.2) >> endobj 1736 0 obj -(19.13.1.5 The Grand Unification achieved...) +(19.12.2 Binary Format) endobj 1737 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.6) >> +<< /S /GoTo /D (subsection.19.12.3) >> endobj 1740 0 obj -(19.13.1.6 Driver Development outside) +(19.12.3 Losing *.tdb Files) endobj 1741 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.7) >> +<< /S /GoTo /D (subsection.19.12.4) >> endobj 1744 0 obj -(19.13.1.7 Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and commercial UNIX) +(19.12.4 Using tdbbackup) endobj 1745 0 obj -<< /S /GoTo /D (subsubsection.19.13.1.8) >> +<< /S /GoTo /D (section.19.13) >> endobj 1748 0 obj -(19.13.1.8 Foomatic Database generated PPDs) +(19.13 CUPS Print Drivers from Linuxprinting.org) endobj 1749 0 obj -<< /S /GoTo /D (subsection.19.13.2) >> +<< /S /GoTo /D (subsection.19.13.1) >> endobj 1752 0 obj -(19.13.2 foomatic-rip and Foomatic-PPD Download and Installation) +(19.13.1 foomatic-rip and Foomatic Explained) endobj 1753 0 obj -<< /S /GoTo /D (section.19.14) >> +<< /S /GoTo /D (subsubsection.19.13.1.1) >> endobj 1756 0 obj -(19.14 Page Accounting with CUPS) +(19.13.1.1 690 ``Perfect'' Printers) endobj 1757 0 obj -<< /S /GoTo /D (subsection.19.14.1) >> +<< /S /GoTo /D (subsubsection.19.13.1.2) >> endobj 1760 0 obj -(19.14.1 Setting up Quotas) +(19.13.1.2 How the Printing HOWTO Started It All) endobj 1761 0 obj -<< /S /GoTo /D (subsection.19.14.2) >> +<< /S /GoTo /D (subsubsection.19.13.1.3) >> endobj 1764 0 obj -(19.14.2 Correct and incorrect Accounting) +(19.13.1.3 Foomatic's Strange Name) endobj 1765 0 obj -<< /S /GoTo /D (subsection.19.14.3) >> +<< /S /GoTo /D (subsubsection.19.13.1.4) >> endobj 1768 0 obj -(19.14.3 Adobe and CUPS PostScript Drivers for Windows Clients) +(19.13.1.4 cupsomatic, pdqomatic, lpdomatic, directomatic) endobj 1769 0 obj -<< /S /GoTo /D (subsection.19.14.4) >> +<< /S /GoTo /D (subsubsection.19.13.1.5) >> endobj 1772 0 obj -(19.14.4 The page\137log File Syntax) +(19.13.1.5 The Grand Unification Achieved) endobj 1773 0 obj -<< /S /GoTo /D (subsection.19.14.5) >> +<< /S /GoTo /D (subsubsection.19.13.1.6) >> endobj 1776 0 obj -(19.14.5 Possible Shortcomings) +(19.13.1.6 Driver Development Outside) endobj 1777 0 obj -<< /S /GoTo /D (subsection.19.14.6) >> +<< /S /GoTo /D (subsubsection.19.13.1.7) >> endobj 1780 0 obj -(19.14.6 Future Developments) +(19.13.1.7 Forums, Downloads, Tutorials, Howtos --- also for Mac OS X and Commercial UNIX) endobj 1781 0 obj -<< /S /GoTo /D (subsection.19.14.7) >> +<< /S /GoTo /D (subsubsection.19.13.1.8) >> endobj 1784 0 obj -(19.14.7 Other Accounting Tools) +(19.13.1.8 Foomatic Database-Generated PPDs) endobj 1785 0 obj -<< /S /GoTo /D (section.19.15) >> +<< /S /GoTo /D (subsection.19.13.2) >> endobj 1788 0 obj -(19.15 Additional Material) +(19.13.2 foomatic-rip and Foomatic-PPD Download and Installation) endobj 1789 0 obj -<< /S /GoTo /D (section.19.16) >> +<< /S /GoTo /D (section.19.14) >> endobj 1792 0 obj -(19.16 Auto-Deletion or Preservation of CUPS Spool Files) +(19.14 Page Accounting with CUPS) endobj 1793 0 obj -<< /S /GoTo /D (subsection.19.16.1) >> +<< /S /GoTo /D (subsection.19.14.1) >> endobj 1796 0 obj -(19.16.1 CUPS Configuration Settings explained) +(19.14.1 Setting Up Quotas) endobj 1797 0 obj -<< /S /GoTo /D (subsection.19.16.2) >> +<< /S /GoTo /D (subsection.19.14.2) >> endobj 1800 0 obj -(19.16.2 Pre-conditions) +(19.14.2 Correct and Incorrect Accounting) endobj 1801 0 obj -<< /S /GoTo /D (subsection.19.16.3) >> +<< /S /GoTo /D (subsection.19.14.3) >> endobj 1804 0 obj -(19.16.3 Manual Configuration) +(19.14.3 Adobe and CUPS PostScript Drivers for Windows Clients) endobj 1805 0 obj -<< /S /GoTo /D (section.19.17) >> +<< /S /GoTo /D (subsection.19.14.4) >> endobj 1808 0 obj -(19.17 In Case of Trouble.....) +(19.14.4 The page\137log File Syntax) endobj 1809 0 obj -<< /S /GoTo /D (section.19.18) >> +<< /S /GoTo /D (subsection.19.14.5) >> endobj 1812 0 obj -(19.18 Printing from CUPS to Windows attached Printers) +(19.14.5 Possible Shortcomings) endobj 1813 0 obj -<< /S /GoTo /D (section.19.19) >> +<< /S /GoTo /D (subsection.19.14.6) >> endobj 1816 0 obj -(19.19 More CUPS filtering Chains) +(19.14.6 Future Developments) endobj 1817 0 obj -<< /S /GoTo /D (section.19.20) >> +<< /S /GoTo /D (section.19.15) >> endobj 1820 0 obj -(19.20 Common Errors) +(19.15 Additional Material) endobj 1821 0 obj -<< /S /GoTo /D (subsection.19.20.1) >> +<< /S /GoTo /D (section.19.16) >> endobj 1824 0 obj -(19.20.1 Win9x client can't install driver) +(19.16 Auto-Deletion or Preservation of CUPS Spool Files) endobj 1825 0 obj -<< /S /GoTo /D (subsection.19.20.2) >> +<< /S /GoTo /D (subsection.19.16.1) >> endobj 1828 0 obj -(19.20.2 "cupsaddsmb" keeps asking for root password in neverending loop) +(19.16.1 CUPS Configuration Settings Explained) endobj 1829 0 obj -<< /S /GoTo /D (subsection.19.20.3) >> +<< /S /GoTo /D (subsection.19.16.2) >> endobj 1832 0 obj -(19.20.3 "cupsaddsmb" gives "No PPD file for printer..." message while PPD file is present) +(19.16.2 Pre-Conditions) endobj 1833 0 obj -<< /S /GoTo /D (subsection.19.20.4) >> +<< /S /GoTo /D (subsection.19.16.3) >> endobj 1836 0 obj -(19.20.4 Client can't connect to Samba printer) +(19.16.3 Manual Configuration) endobj 1837 0 obj -<< /S /GoTo /D (subsection.19.20.5) >> +<< /S /GoTo /D (section.19.17) >> endobj 1840 0 obj -(19.20.5 Can't reconnect to Samba under new account from Win2K/XP) +(19.17 Printing from CUPS to Windows Attached Printers) endobj 1841 0 obj -<< /S /GoTo /D (subsection.19.20.6) >> +<< /S /GoTo /D (section.19.18) >> endobj 1844 0 obj -(19.20.6 Avoid being connected to the Samba server as the "wrong" user) +(19.18 More CUPS-Filtering Chains) endobj 1845 0 obj -<< /S /GoTo /D (subsection.19.20.7) >> +<< /S /GoTo /D (section.19.19) >> endobj 1848 0 obj -(19.20.7 Upgrading to CUPS drivers from Adobe drivers on NT/2K/XP clients gives problems) +(19.19 Common Errors) endobj 1849 0 obj -<< /S /GoTo /D (subsection.19.20.8) >> +<< /S /GoTo /D (subsection.19.19.1) >> endobj 1852 0 obj -(19.20.8 Can't use "cupsaddsmb" on Samba server which is a PDC) +(19.19.1 Windows 9x/ME Client Can't Install Driver) endobj 1853 0 obj -<< /S /GoTo /D (subsection.19.20.9) >> +<< /S /GoTo /D (subsection.19.19.2) >> endobj 1856 0 obj -(19.20.9 Deleted Win2K printer driver is still shown) +(19.19.2 ``cupsaddsmb'' Keeps Asking for Root Password in Never-ending Loop) endobj 1857 0 obj -<< /S /GoTo /D (subsection.19.20.10) >> +<< /S /GoTo /D (subsection.19.19.3) >> endobj 1860 0 obj -(19.20.10 Win2K/XP "Local Security Policies") +(19.19.3 ``cupsaddsmb'' Errors) endobj 1861 0 obj -<< /S /GoTo /D (subsection.19.20.11) >> +<< /S /GoTo /D (subsection.19.19.4) >> endobj 1864 0 obj -(19.20.11 WinXP clients: "Administrator can not install printers for all local users") +(19.19.4 Client Can't Connect to Samba Printer) endobj 1865 0 obj -<< /S /GoTo /D (subsection.19.20.12) >> +<< /S /GoTo /D (subsection.19.19.5) >> endobj 1868 0 obj -(19.20.12 "Print Change Notify" functions on NT-clients) +(19.19.5 New Account Reconnection from Windows 200x/XP Troubles) endobj 1869 0 obj -<< /S /GoTo /D (subsection.19.20.13) >> +<< /S /GoTo /D (subsection.19.19.6) >> endobj 1872 0 obj -(19.20.13 WinXP-SP1) +(19.19.6 Avoid Being Connected to the Samba Server as the Wrong User) endobj 1873 0 obj -<< /S /GoTo /D (subsection.19.20.14) >> +<< /S /GoTo /D (subsection.19.19.7) >> endobj 1876 0 obj -(19.20.14 Print options for all users can't be set on Win2K/XP) +(19.19.7 Upgrading to CUPS Drivers from Adobe Drivers) endobj 1877 0 obj -<< /S /GoTo /D (subsection.19.20.15) >> +<< /S /GoTo /D (subsection.19.19.8) >> endobj 1880 0 obj -(19.20.15 Most common blunders in driver settings on Windows clients) +(19.19.8 Can't Use ``cupsaddsmb'' on Samba Server Which Is a PDC) endobj 1881 0 obj -<< /S /GoTo /D (subsection.19.20.16) >> +<< /S /GoTo /D (subsection.19.19.9) >> endobj 1884 0 obj -(19.20.16 cupsaddsmb does not work with newly installed printer) +(19.19.9 Deleted Windows 200x Printer Driver Is Still Shown) endobj 1885 0 obj -<< /S /GoTo /D (subsection.19.20.17) >> +<< /S /GoTo /D (subsection.19.19.10) >> endobj 1888 0 obj -(19.20.17 Permissions on /var/spool/samba/ get reset after each reboot) +(19.19.10 Windows 200x/XP "Local Security Policies") endobj 1889 0 obj -<< /S /GoTo /D (subsection.19.20.18) >> +<< /S /GoTo /D (subsection.19.19.11) >> endobj 1892 0 obj -(19.20.18 Printer named "lp" intermittently swallows jobs and spits out completely different ones) +(19.19.11 Administrator Cannot Install Printers for All Local Users) endobj 1893 0 obj -<< /S /GoTo /D (subsection.19.20.19) >> +<< /S /GoTo /D (subsection.19.19.12) >> endobj 1896 0 obj -(19.20.19 Location of Adobe PostScript driver files necessary for "cupsaddsmb") +(19.19.12 Print Change Notify Functions on NT-clients) endobj 1897 0 obj -<< /S /GoTo /D (section.19.21) >> +<< /S /GoTo /D (subsection.19.19.13) >> endobj 1900 0 obj -(19.21 An Overview of the CUPS Printing Processes) +(19.19.13 WinXP-SP1) endobj 1901 0 obj -<< /S /GoTo /D (chapter.20) >> +<< /S /GoTo /D (subsection.19.19.14) >> endobj 1904 0 obj -(20 Stackable VFS modules) +(19.19.14 Print Options for All Users Can't Be Set on Windows 200x/XP) endobj 1905 0 obj -<< /S /GoTo /D (section.20.1) >> +<< /S /GoTo /D (subsection.19.19.15) >> endobj 1908 0 obj -(20.1 Features and Benefits) +(19.19.15 Most Common Blunders in Driver Settings on Windows Clients) endobj 1909 0 obj -<< /S /GoTo /D (section.20.2) >> +<< /S /GoTo /D (subsection.19.19.16) >> endobj 1912 0 obj -(20.2 Discussion) +(19.19.16 cupsaddsmb Does Not Work with Newly Installed Printer) endobj 1913 0 obj -<< /S /GoTo /D (section.20.3) >> +<< /S /GoTo /D (subsection.19.19.17) >> endobj 1916 0 obj -(20.3 Included modules) +(19.19.17 Permissions on /var/spool/samba/ Get Reset After Each Reboot) endobj 1917 0 obj -<< /S /GoTo /D (subsection.20.3.1) >> +<< /S /GoTo /D (subsection.19.19.18) >> endobj 1920 0 obj -(20.3.1 audit) +(19.19.18 Print Queue Called ``lp'' Mis-handles Print Jobs) endobj 1921 0 obj -<< /S /GoTo /D (subsection.20.3.2) >> +<< /S /GoTo /D (subsection.19.19.19) >> endobj 1924 0 obj -(20.3.2 extd\137audit) +(19.19.19 Location of Adobe PostScript Driver Files for ``cupsaddsmb'') endobj 1925 0 obj -<< /S /GoTo /D (subsection.20.3.3) >> +<< /S /GoTo /D (section.19.20) >> endobj 1928 0 obj -(20.3.3 fake\137perms) +(19.20 Overview of the CUPS Printing Processes) endobj 1929 0 obj -<< /S /GoTo /D (subsection.20.3.4) >> +<< /S /GoTo /D (chapter.20) >> endobj 1932 0 obj -(20.3.4 recycle) +(20 Stackable VFS modules) endobj 1933 0 obj -<< /S /GoTo /D (subsection.20.3.5) >> +<< /S /GoTo /D (section.20.1) >> endobj 1936 0 obj -(20.3.5 netatalk) +(20.1 Features and Benefits) endobj 1937 0 obj -<< /S /GoTo /D (section.20.4) >> +<< /S /GoTo /D (section.20.2) >> endobj 1940 0 obj -(20.4 VFS modules available elsewhere) +(20.2 Discussion) endobj 1941 0 obj -<< /S /GoTo /D (subsection.20.4.1) >> +<< /S /GoTo /D (section.20.3) >> endobj 1944 0 obj -(20.4.1 DatabaseFS) +(20.3 Included Modules) endobj 1945 0 obj -<< /S /GoTo /D (subsection.20.4.2) >> +<< /S /GoTo /D (subsection.20.3.1) >> endobj 1948 0 obj -(20.4.2 vscan) +(20.3.1 audit) endobj 1949 0 obj -<< /S /GoTo /D (chapter.21) >> +<< /S /GoTo /D (subsection.20.3.2) >> endobj 1952 0 obj -(21 Winbind: Use of Domain Accounts) +(20.3.2 extd\137audit) endobj 1953 0 obj -<< /S /GoTo /D (section.21.1) >> +<< /S /GoTo /D (subsection.20.3.3) >> endobj 1956 0 obj -(21.1 Features and Benefits) +(20.3.3 fake\137perms) endobj 1957 0 obj -<< /S /GoTo /D (section.21.2) >> +<< /S /GoTo /D (subsection.20.3.4) >> endobj 1960 0 obj -(21.2 Introduction) +(20.3.4 recycle) endobj 1961 0 obj -<< /S /GoTo /D (section.21.3) >> +<< /S /GoTo /D (subsection.20.3.5) >> endobj 1964 0 obj -(21.3 What Winbind Provides) +(20.3.5 netatalk) endobj 1965 0 obj -<< /S /GoTo /D (subsection.21.3.1) >> +<< /S /GoTo /D (section.20.4) >> endobj 1968 0 obj -(21.3.1 Target Uses) +(20.4 VFS Modules Available Elsewhere) endobj 1969 0 obj -<< /S /GoTo /D (section.21.4) >> +<< /S /GoTo /D (subsection.20.4.1) >> endobj 1972 0 obj -(21.4 How Winbind Works) +(20.4.1 DatabaseFS) endobj 1973 0 obj -<< /S /GoTo /D (subsection.21.4.1) >> +<< /S /GoTo /D (subsection.20.4.2) >> endobj 1976 0 obj -(21.4.1 Microsoft Remote Procedure Calls) +(20.4.2 vscan) endobj 1977 0 obj -<< /S /GoTo /D (subsection.21.4.2) >> +<< /S /GoTo /D (chapter.21) >> endobj 1980 0 obj -(21.4.2 Microsoft Active Directory Services) +(21 Winbind: Use of Domain Accounts) endobj 1981 0 obj -<< /S /GoTo /D (subsection.21.4.3) >> +<< /S /GoTo /D (section.21.1) >> endobj 1984 0 obj -(21.4.3 Name Service Switch) +(21.1 Features and Benefits) endobj 1985 0 obj -<< /S /GoTo /D (subsection.21.4.4) >> +<< /S /GoTo /D (section.21.2) >> endobj 1988 0 obj -(21.4.4 Pluggable Authentication Modules) +(21.2 Introduction) endobj 1989 0 obj -<< /S /GoTo /D (subsection.21.4.5) >> +<< /S /GoTo /D (section.21.3) >> endobj 1992 0 obj -(21.4.5 User and Group ID Allocation) +(21.3 What Winbind Provides) endobj 1993 0 obj -<< /S /GoTo /D (subsection.21.4.6) >> +<< /S /GoTo /D (subsection.21.3.1) >> endobj 1996 0 obj -(21.4.6 Result Caching) +(21.3.1 Target Uses) endobj 1997 0 obj -<< /S /GoTo /D (section.21.5) >> +<< /S /GoTo /D (section.21.4) >> endobj 2000 0 obj -(21.5 Installation and Configuration) +(21.4 How Winbind Works) endobj 2001 0 obj -<< /S /GoTo /D (subsection.21.5.1) >> +<< /S /GoTo /D (subsection.21.4.1) >> endobj 2004 0 obj -(21.5.1 Introduction) +(21.4.1 Microsoft Remote Procedure Calls) endobj 2005 0 obj -<< /S /GoTo /D (subsection.21.5.2) >> +<< /S /GoTo /D (subsection.21.4.2) >> endobj 2008 0 obj -(21.5.2 Requirements) +(21.4.2 Microsoft Active Directory Services) endobj 2009 0 obj -<< /S /GoTo /D (subsection.21.5.3) >> +<< /S /GoTo /D (subsection.21.4.3) >> endobj 2012 0 obj -(21.5.3 Testing Things Out) +(21.4.3 Name Service Switch) endobj 2013 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.1) >> +<< /S /GoTo /D (subsection.21.4.4) >> endobj 2016 0 obj -(21.5.3.1 Configure nsswitch.conf and the winbind libraries on Linux and Solaris) +(21.4.4 Pluggable Authentication Modules) endobj 2017 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.2) >> +<< /S /GoTo /D (subsection.21.4.5) >> endobj 2020 0 obj -(21.5.3.2 NSS Winbind on AIX) +(21.4.5 User and Group ID Allocation) endobj 2021 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.3) >> +<< /S /GoTo /D (subsection.21.4.6) >> endobj 2024 0 obj -(21.5.3.3 Configure smb.conf) +(21.4.6 Result Caching) endobj 2025 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.4) >> +<< /S /GoTo /D (section.21.5) >> endobj 2028 0 obj -(21.5.3.4 Join the SAMBA server to the PDC domain) +(21.5 Installation and Configuration) endobj 2029 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.5) >> +<< /S /GoTo /D (subsection.21.5.1) >> endobj 2032 0 obj -(21.5.3.5 Start up the winbindd daemon and test it!) +(21.5.1 Introduction) endobj 2033 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.6) >> +<< /S /GoTo /D (subsection.21.5.2) >> endobj 2036 0 obj -(21.5.3.6 Fix the init.d startup scripts) +(21.5.2 Requirements) endobj 2037 0 obj -<< /S /GoTo /D (subsubsection.21.5.3.7) >> +<< /S /GoTo /D (subsection.21.5.3) >> endobj 2040 0 obj -(21.5.3.7 Configure Winbind and PAM) +(21.5.3 Testing Things Out) endobj 2041 0 obj -<< /S /GoTo /D (section.21.6) >> +<< /S /GoTo /D (subsubsection.21.5.3.1) >> endobj 2044 0 obj -(21.6 Conclusion) +(21.5.3.1 Configure nsswitch.conf and the Winbind Libraries on Linux and Solaris) endobj 2045 0 obj -<< /S /GoTo /D (section.21.7) >> +<< /S /GoTo /D (subsubsection.21.5.3.2) >> endobj 2048 0 obj -(21.7 Common Errors) +(21.5.3.2 NSS Winbind on AIX) endobj 2049 0 obj -<< /S /GoTo /D (subsection.21.7.1) >> +<< /S /GoTo /D (subsubsection.21.5.3.3) >> endobj 2052 0 obj -(21.7.1 NSCD Problem Warning) +(21.5.3.3 Configure smb.conf) endobj 2053 0 obj -<< /S /GoTo /D (chapter.22) >> +<< /S /GoTo /D (subsubsection.21.5.3.4) >> endobj 2056 0 obj -(22 Advanced Network Management) +(21.5.3.4 Join the Samba Server to the PDC Domain) endobj 2057 0 obj -<< /S /GoTo /D (section.22.1) >> +<< /S /GoTo /D (subsubsection.21.5.3.5) >> endobj 2060 0 obj -(22.1 Features and Benefits) +(21.5.3.5 Starting and Testing the winbindd Daemon) endobj 2061 0 obj -<< /S /GoTo /D (section.22.2) >> +<< /S /GoTo /D (subsubsection.21.5.3.6) >> endobj 2064 0 obj -(22.2 Remote Server Administration) +(21.5.3.6 Fix the init.d Startup Scripts) endobj 2065 0 obj -<< /S /GoTo /D (section.22.3) >> +<< /S /GoTo /D (subsubsection.21.5.3.7) >> endobj 2068 0 obj -(22.3 Remote Desktop Management) +(21.5.3.7 Configure Winbind and PAM) endobj 2069 0 obj -<< /S /GoTo /D (subsection.22.3.1) >> +<< /S /GoTo /D (section.21.6) >> endobj 2072 0 obj -(22.3.1 Remote Management from NoMachines.Com) +(21.6 Conclusion) endobj 2073 0 obj -<< /S /GoTo /D (section.22.4) >> +<< /S /GoTo /D (section.21.7) >> endobj 2076 0 obj -(22.4 Network Logon Script Magic) +(21.7 Common Errors) endobj 2077 0 obj -<< /S /GoTo /D (subsection.22.4.1) >> +<< /S /GoTo /D (subsection.21.7.1) >> endobj 2080 0 obj -(22.4.1 Adding printers without user intervention) +(21.7.1 NSCD Problem Warning) endobj 2081 0 obj -<< /S /GoTo /D (section.22.5) >> +<< /S /GoTo /D (subsection.21.7.2) >> endobj 2084 0 obj -(22.5 Common Errors) +(21.7.2 Winbind Is Not Resolving Users and Groups) endobj 2085 0 obj -<< /S /GoTo /D (chapter.23) >> +<< /S /GoTo /D (chapter.22) >> endobj 2088 0 obj -(23 System and Account Policies) +(22 Advanced Network Management) endobj 2089 0 obj -<< /S /GoTo /D (section.23.1) >> +<< /S /GoTo /D (section.22.1) >> endobj 2092 0 obj -(23.1 Features and Benefits) +(22.1 Features and Benefits) endobj 2093 0 obj -<< /S /GoTo /D (section.23.2) >> +<< /S /GoTo /D (section.22.2) >> endobj 2096 0 obj -(23.2 Creating and Managing System Policies) +(22.2 Remote Server Administration) endobj 2097 0 obj -<< /S /GoTo /D (subsection.23.2.1) >> +<< /S /GoTo /D (section.22.3) >> endobj 2100 0 obj -(23.2.1 Windows 9x/Me Policies) +(22.3 Remote Desktop Management) endobj 2101 0 obj -<< /S /GoTo /D (subsection.23.2.2) >> +<< /S /GoTo /D (subsection.22.3.1) >> endobj 2104 0 obj -(23.2.2 Windows NT4 Style Policy Files) +(22.3.1 Remote Management from NoMachine.Com) endobj 2105 0 obj -<< /S /GoTo /D (subsubsection.23.2.2.1) >> +<< /S /GoTo /D (section.22.4) >> endobj 2108 0 obj -(23.2.2.1 Registry Spoiling) +(22.4 Network Logon Script Magic) endobj 2109 0 obj -<< /S /GoTo /D (subsection.23.2.3) >> +<< /S /GoTo /D (subsection.22.4.1) >> endobj 2112 0 obj -(23.2.3 MS Windows 200x / XP Professional Policies) +(22.4.1 Adding Printers without User Intervention) endobj 2113 0 obj -<< /S /GoTo /D (subsubsection.23.2.3.1) >> +<< /S /GoTo /D (chapter.23) >> endobj 2116 0 obj -(23.2.3.1 Administration of Win2K / XP Policies) +(23 System and Account Policies) endobj 2117 0 obj -<< /S /GoTo /D (section.23.3) >> +<< /S /GoTo /D (section.23.1) >> endobj 2120 0 obj -(23.3 Managing Account/User Policies) +(23.1 Features and Benefits) endobj 2121 0 obj -<< /S /GoTo /D (subsection.23.3.1) >> +<< /S /GoTo /D (section.23.2) >> endobj 2124 0 obj -(23.3.1 Samba Editreg Toolset) +(23.2 Creating and Managing System Policies) endobj 2125 0 obj -<< /S /GoTo /D (subsection.23.3.2) >> +<< /S /GoTo /D (subsection.23.2.1) >> endobj 2128 0 obj -(23.3.2 Windows NT4/200x) +(23.2.1 Windows 9x/ME Policies) endobj 2129 0 obj -<< /S /GoTo /D (subsection.23.3.3) >> +<< /S /GoTo /D (subsection.23.2.2) >> endobj 2132 0 obj -(23.3.3 Samba PDC) +(23.2.2 Windows NT4-Style Policy Files) endobj 2133 0 obj -<< /S /GoTo /D (section.23.4) >> +<< /S /GoTo /D (subsubsection.23.2.2.1) >> endobj 2136 0 obj -(23.4 System Startup and Logon Processing Overview) +(23.2.2.1 Registry Spoiling) endobj 2137 0 obj -<< /S /GoTo /D (section.23.5) >> +<< /S /GoTo /D (subsection.23.2.3) >> endobj 2140 0 obj -(23.5 Common Errors) +(23.2.3 MS Windows 200x/XP Professional Policies) endobj 2141 0 obj -<< /S /GoTo /D (subsection.23.5.1) >> +<< /S /GoTo /D (subsubsection.23.2.3.1) >> endobj 2144 0 obj -(23.5.1 Policy Does Not Work) +(23.2.3.1 Administration of Windows 200x/XP Policies) endobj 2145 0 obj -<< /S /GoTo /D (chapter.24) >> +<< /S /GoTo /D (section.23.3) >> endobj 2148 0 obj -(24 Desktop Profile Management) +(23.3 Managing Account/User Policies) endobj 2149 0 obj -<< /S /GoTo /D (section.24.1) >> +<< /S /GoTo /D (section.23.4) >> endobj 2152 0 obj -(24.1 Features and Benefits) +(23.4 Management Tools) endobj 2153 0 obj -<< /S /GoTo /D (section.24.2) >> +<< /S /GoTo /D (subsection.23.4.1) >> endobj 2156 0 obj -(24.2 Roaming Profiles) +(23.4.1 Samba Editreg Toolset) endobj 2157 0 obj -<< /S /GoTo /D (subsection.24.2.1) >> +<< /S /GoTo /D (subsection.23.4.2) >> endobj 2160 0 obj -(24.2.1 Samba Configuration for Profile Handling) +(23.4.2 Windows NT4/200x) endobj 2161 0 obj -<< /S /GoTo /D (subsubsection.24.2.1.1) >> +<< /S /GoTo /D (subsection.23.4.3) >> endobj 2164 0 obj -(24.2.1.1 NT4/200x User Profiles) +(23.4.3 Samba PDC) endobj 2165 0 obj -<< /S /GoTo /D (subsubsection.24.2.1.2) >> +<< /S /GoTo /D (section.23.5) >> endobj 2168 0 obj -(24.2.1.2 Windows 9x / Me User Profiles) +(23.5 System Startup and Logon Processing Overview) endobj 2169 0 obj -<< /S /GoTo /D (subsubsection.24.2.1.3) >> +<< /S /GoTo /D (section.23.6) >> endobj 2172 0 obj -(24.2.1.3 Mixed Windows 9x / Me and Windows NT4/200x User Profiles) +(23.6 Common Errors) endobj 2173 0 obj -<< /S /GoTo /D (subsubsection.24.2.1.4) >> +<< /S /GoTo /D (subsection.23.6.1) >> endobj 2176 0 obj -(24.2.1.4 Disabling Roaming Profile Support) +(23.6.1 Policy Does Not Work) endobj 2177 0 obj -<< /S /GoTo /D (subsection.24.2.2) >> +<< /S /GoTo /D (chapter.24) >> endobj 2180 0 obj -(24.2.2 Windows Client Profile Configuration Information) +(24 Desktop Profile Management) endobj 2181 0 obj -<< /S /GoTo /D (subsubsection.24.2.2.1) >> +<< /S /GoTo /D (section.24.1) >> endobj 2184 0 obj -(24.2.2.1 Windows 9x / Me Profile Setup) +(24.1 Features and Benefits) endobj 2185 0 obj -<< /S /GoTo /D (subsubsection.24.2.2.2) >> +<< /S /GoTo /D (section.24.2) >> endobj 2188 0 obj -(24.2.2.2 Windows NT4 Workstation) +(24.2 Roaming Profiles) endobj 2189 0 obj -<< /S /GoTo /D (subsubsection.24.2.2.3) >> +<< /S /GoTo /D (subsection.24.2.1) >> endobj 2192 0 obj -(24.2.2.3 Windows 2000/XP Professional) +(24.2.1 Samba Configuration for Profile Handling) endobj 2193 0 obj -<< /S /GoTo /D (subsection.24.2.3) >> +<< /S /GoTo /D (subsubsection.24.2.1.1) >> endobj 2196 0 obj -(24.2.3 Sharing Profiles between W9x/Me and NT4/200x/XP workstations) +(24.2.1.1 NT4/200x User Profiles) endobj 2197 0 obj -<< /S /GoTo /D (subsection.24.2.4) >> +<< /S /GoTo /D (subsubsection.24.2.1.2) >> endobj 2200 0 obj -(24.2.4 Profile Migration from Windows NT4/200x Server to Samba) +(24.2.1.2 Windows 9x/Me User Profiles) endobj 2201 0 obj -<< /S /GoTo /D (subsubsection.24.2.4.1) >> +<< /S /GoTo /D (subsubsection.24.2.1.3) >> endobj 2204 0 obj -(24.2.4.1 Windows NT4 Profile Management Tools) +(24.2.1.3 Mixed Windows 9x/Me and Windows NT4/200x User Profiles) endobj 2205 0 obj -<< /S /GoTo /D (subsubsection.24.2.4.2) >> +<< /S /GoTo /D (subsubsection.24.2.1.4) >> endobj 2208 0 obj -(24.2.4.2 Side bar Notes) +(24.2.1.4 Disabling Roaming Profile Support) endobj 2209 0 obj -<< /S /GoTo /D (subsubsection.24.2.4.3) >> +<< /S /GoTo /D (subsection.24.2.2) >> endobj 2212 0 obj -(24.2.4.3 moveuser.exe) +(24.2.2 Windows Client Profile Configuration Information) endobj 2213 0 obj -<< /S /GoTo /D (subsubsection.24.2.4.4) >> +<< /S /GoTo /D (subsubsection.24.2.2.1) >> endobj 2216 0 obj -(24.2.4.4 Get SID) +(24.2.2.1 Windows 9x/Me Profile Setup) endobj 2217 0 obj -<< /S /GoTo /D (section.24.3) >> +<< /S /GoTo /D (subsubsection.24.2.2.2) >> endobj 2220 0 obj -(24.3 Mandatory profiles) +(24.2.2.2 Windows NT4 Workstation) endobj 2221 0 obj -<< /S /GoTo /D (section.24.4) >> +<< /S /GoTo /D (subsubsection.24.2.2.3) >> endobj 2224 0 obj -(24.4 Creating/Managing Group Profiles) +(24.2.2.3 Windows 2000/XP Professional) endobj 2225 0 obj -<< /S /GoTo /D (section.24.5) >> +<< /S /GoTo /D (subsection.24.2.3) >> endobj 2228 0 obj -(24.5 Default Profile for Windows Users) +(24.2.3 Sharing Profiles between W9x/Me and NT4/200x/XP Workstations) endobj 2229 0 obj -<< /S /GoTo /D (subsection.24.5.1) >> +<< /S /GoTo /D (subsection.24.2.4) >> endobj 2232 0 obj -(24.5.1 MS Windows 9x/Me) +(24.2.4 Profile Migration from Windows NT4/200x Server to Samba) endobj 2233 0 obj -<< /S /GoTo /D (subsubsection.24.5.1.1) >> +<< /S /GoTo /D (subsubsection.24.2.4.1) >> endobj 2236 0 obj -(24.5.1.1 How User Profiles Are Handled in Windows 9x / Me?) +(24.2.4.1 Windows NT4 Profile Management Tools) endobj 2237 0 obj -<< /S /GoTo /D (subsection.24.5.2) >> +<< /S /GoTo /D (subsubsection.24.2.4.2) >> endobj 2240 0 obj -(24.5.2 MS Windows NT4 Workstation) +(24.2.4.2 Side Bar Notes) endobj 2241 0 obj -<< /S /GoTo /D (subsection.24.5.3) >> +<< /S /GoTo /D (subsubsection.24.2.4.3) >> endobj 2244 0 obj -(24.5.3 MS Windows 200x/XP) +(24.2.4.3 moveuser.exe) endobj 2245 0 obj -<< /S /GoTo /D (section.24.6) >> +<< /S /GoTo /D (subsubsection.24.2.4.4) >> endobj 2248 0 obj -(24.6 Common Errors) +(24.2.4.4 Get SID) endobj 2249 0 obj -<< /S /GoTo /D (subsection.24.6.1) >> +<< /S /GoTo /D (section.24.3) >> endobj 2252 0 obj -(24.6.1 Setting up roaming profiles for just a few user's or group's?) +(24.3 Mandatory Profiles) endobj 2253 0 obj -<< /S /GoTo /D (subsection.24.6.2) >> +<< /S /GoTo /D (section.24.4) >> endobj 2256 0 obj -(24.6.2 Can NOT use Roaming Profiles) +(24.4 Creating and Managing Group Profiles) endobj 2257 0 obj -<< /S /GoTo /D (subsection.24.6.3) >> +<< /S /GoTo /D (section.24.5) >> endobj 2260 0 obj -(24.6.3 Changing the default profile) +(24.5 Default Profile for Windows Users) endobj 2261 0 obj -<< /S /GoTo /D (chapter.25) >> +<< /S /GoTo /D (subsection.24.5.1) >> endobj 2264 0 obj -(25 PAM based Distributed Authentication) +(24.5.1 MS Windows 9x/Me) endobj 2265 0 obj -<< /S /GoTo /D (section.25.1) >> +<< /S /GoTo /D (subsubsection.24.5.1.1) >> endobj 2268 0 obj -(25.1 Features and Benefits) +(24.5.1.1 User Profile Handling with Windows 9x/Me) endobj 2269 0 obj -<< /S /GoTo /D (section.25.2) >> +<< /S /GoTo /D (subsection.24.5.2) >> endobj 2272 0 obj -(25.2 Technical Discussion) +(24.5.2 MS Windows NT4 Workstation) endobj 2273 0 obj -<< /S /GoTo /D (subsection.25.2.1) >> +<< /S /GoTo /D (subsection.24.5.3) >> endobj 2276 0 obj -(25.2.1 PAM Configuration Syntax) +(24.5.3 MS Windows 200x/XP) endobj 2277 0 obj -<< /S /GoTo /D (subsubsection.25.2.1.1) >> +<< /S /GoTo /D (section.24.6) >> endobj 2280 0 obj -(25.2.1.1 Anatomy of /etc/pam.d Entries) +(24.6 Common Errors) endobj 2281 0 obj -<< /S /GoTo /D (subsection.25.2.2) >> +<< /S /GoTo /D (subsection.24.6.1) >> endobj 2284 0 obj -(25.2.2 Example System Configurations) +(24.6.1 Configuring Roaming Profiles for a Few Users or Groups) endobj 2285 0 obj -<< /S /GoTo /D (subsubsection.25.2.2.1) >> +<< /S /GoTo /D (subsection.24.6.2) >> endobj 2288 0 obj -(25.2.2.1 PAM: original login config) +(24.6.2 Cannot Use Roaming Profiles) endobj 2289 0 obj -<< /S /GoTo /D (subsubsection.25.2.2.2) >> +<< /S /GoTo /D (subsection.24.6.3) >> endobj 2292 0 obj -(25.2.2.2 PAM: login using pam\137smbpass) +(24.6.3 Changing the Default Profile) endobj 2293 0 obj -<< /S /GoTo /D (subsection.25.2.3) >> +<< /S /GoTo /D (chapter.25) >> endobj 2296 0 obj -(25.2.3 smb.conf PAM Configuration) +(25 PAM-Based Distributed Authentication) endobj 2297 0 obj -<< /S /GoTo /D (subsection.25.2.4) >> +<< /S /GoTo /D (section.25.1) >> endobj 2300 0 obj -(25.2.4 Remote CIFS Authentication using winbindd.so) +(25.1 Features and Benefits) endobj 2301 0 obj -<< /S /GoTo /D (subsection.25.2.5) >> +<< /S /GoTo /D (section.25.2) >> endobj 2304 0 obj -(25.2.5 Password Synchronization using pam\137smbpass.so) +(25.2 Technical Discussion) endobj 2305 0 obj -<< /S /GoTo /D (subsubsection.25.2.5.1) >> +<< /S /GoTo /D (subsection.25.2.1) >> endobj 2308 0 obj -(25.2.5.1 Password Synchronisation Configuration) +(25.2.1 PAM Configuration Syntax) endobj 2309 0 obj -<< /S /GoTo /D (subsubsection.25.2.5.2) >> +<< /S /GoTo /D (subsubsection.25.2.1.1) >> endobj 2312 0 obj -(25.2.5.2 Password Migration Configuration) +(25.2.1.1 Anatomy of /etc/pam.d Entries) endobj 2313 0 obj -<< /S /GoTo /D (subsubsection.25.2.5.3) >> +<< /S /GoTo /D (subsection.25.2.2) >> endobj 2316 0 obj -(25.2.5.3 Mature Password Configuration) +(25.2.2 Example System Configurations) endobj 2317 0 obj -<< /S /GoTo /D (subsubsection.25.2.5.4) >> +<< /S /GoTo /D (subsubsection.25.2.2.1) >> endobj 2320 0 obj -(25.2.5.4 Kerberos Password Integration Configuration) +(25.2.2.1 PAM: Original Login Config) endobj 2321 0 obj -<< /S /GoTo /D (section.25.3) >> +<< /S /GoTo /D (subsubsection.25.2.2.2) >> endobj 2324 0 obj -(25.3 Common Errors) +(25.2.2.2 PAM: Login Using pam\137smbpass) endobj 2325 0 obj -<< /S /GoTo /D (subsection.25.3.1) >> +<< /S /GoTo /D (subsection.25.2.3) >> endobj 2328 0 obj -(25.3.1 pam\137winbind problem) +(25.2.3 smb.conf PAM Configuration) endobj 2329 0 obj -<< /S /GoTo /D (subsection.25.3.2) >> +<< /S /GoTo /D (subsection.25.2.4) >> endobj 2332 0 obj -(25.3.2 Winbind is not resolving users and groups) +(25.2.4 Remote CIFS Authentication Using winbindd.so) endobj 2333 0 obj -<< /S /GoTo /D (chapter.26) >> +<< /S /GoTo /D (subsection.25.2.5) >> endobj 2336 0 obj -(26 Integrating MS Windows networks with Samba) +(25.2.5 Password Synchronization Using pam\137smbpass.so) endobj 2337 0 obj -<< /S /GoTo /D (section.26.1) >> +<< /S /GoTo /D (subsubsection.25.2.5.1) >> endobj 2340 0 obj -(26.1 Features and Benefits) +(25.2.5.1 Password Synchronization Configuration) endobj 2341 0 obj -<< /S /GoTo /D (section.26.2) >> +<< /S /GoTo /D (subsubsection.25.2.5.2) >> endobj 2344 0 obj -(26.2 Background Information) +(25.2.5.2 Password Migration Configuration) endobj 2345 0 obj -<< /S /GoTo /D (section.26.3) >> +<< /S /GoTo /D (subsubsection.25.2.5.3) >> endobj 2348 0 obj -(26.3 Name Resolution in a pure UNIX/Linux world) +(25.2.5.3 Mature Password Configuration) endobj 2349 0 obj -<< /S /GoTo /D (subsection.26.3.1) >> +<< /S /GoTo /D (subsubsection.25.2.5.4) >> endobj 2352 0 obj -(26.3.1 /etc/hosts) +(25.2.5.4 Kerberos Password Integration Configuration) endobj 2353 0 obj -<< /S /GoTo /D (subsection.26.3.2) >> +<< /S /GoTo /D (section.25.3) >> endobj 2356 0 obj -(26.3.2 /etc/resolv.conf) +(25.3 Common Errors) endobj 2357 0 obj -<< /S /GoTo /D (subsection.26.3.3) >> +<< /S /GoTo /D (subsection.25.3.1) >> endobj 2360 0 obj -(26.3.3 /etc/host.conf) +(25.3.1 pam\137winbind Problem) endobj 2361 0 obj -<< /S /GoTo /D (subsection.26.3.4) >> +<< /S /GoTo /D (subsection.25.3.2) >> endobj 2364 0 obj -(26.3.4 /etc/nsswitch.conf) +(25.3.2 Winbind Is Not Resolving Users and Groups) endobj 2365 0 obj -<< /S /GoTo /D (section.26.4) >> +<< /S /GoTo /D (chapter.26) >> endobj 2368 0 obj -(26.4 Name resolution as used within MS Windows networking) +(26 Integrating MS Windows Networks with Samba) endobj 2369 0 obj -<< /S /GoTo /D (subsection.26.4.1) >> +<< /S /GoTo /D (section.26.1) >> endobj 2372 0 obj -(26.4.1 The NetBIOS Name Cache) +(26.1 Features and Benefits) endobj 2373 0 obj -<< /S /GoTo /D (subsection.26.4.2) >> +<< /S /GoTo /D (section.26.2) >> endobj 2376 0 obj -(26.4.2 The LMHOSTS file) +(26.2 Background Information) endobj 2377 0 obj -<< /S /GoTo /D (subsection.26.4.3) >> +<< /S /GoTo /D (section.26.3) >> endobj 2380 0 obj -(26.4.3 HOSTS file) +(26.3 Name Resolution in a Pure UNIX/Linux World) endobj 2381 0 obj -<< /S /GoTo /D (subsection.26.4.4) >> +<< /S /GoTo /D (subsection.26.3.1) >> endobj 2384 0 obj -(26.4.4 DNS Lookup) +(26.3.1 /etc/hosts) endobj 2385 0 obj -<< /S /GoTo /D (subsection.26.4.5) >> +<< /S /GoTo /D (subsection.26.3.2) >> endobj 2388 0 obj -(26.4.5 WINS Lookup) +(26.3.2 /etc/resolv.conf) endobj 2389 0 obj -<< /S /GoTo /D (section.26.5) >> +<< /S /GoTo /D (subsection.26.3.3) >> endobj 2392 0 obj -(26.5 Common Errors) +(26.3.3 /etc/host.conf) endobj 2393 0 obj -<< /S /GoTo /D (subsection.26.5.1) >> +<< /S /GoTo /D (subsection.26.3.4) >> endobj 2396 0 obj -(26.5.1 Pinging works only in one way) +(26.3.4 /etc/nsswitch.conf) endobj 2397 0 obj -<< /S /GoTo /D (subsection.26.5.2) >> +<< /S /GoTo /D (section.26.4) >> endobj 2400 0 obj -(26.5.2 Very Slow Network Connections) +(26.4 Name Resolution as Used within MS Windows Networking) endobj 2401 0 obj -<< /S /GoTo /D (subsection.26.5.3) >> +<< /S /GoTo /D (subsection.26.4.1) >> endobj 2404 0 obj -(26.5.3 Samba server name change problem) +(26.4.1 The NetBIOS Name Cache) endobj 2405 0 obj -<< /S /GoTo /D (chapter.27) >> +<< /S /GoTo /D (subsection.26.4.2) >> endobj 2408 0 obj -(27 Unicode/Charsets) +(26.4.2 The LMHOSTS File) endobj 2409 0 obj -<< /S /GoTo /D (section.27.1) >> +<< /S /GoTo /D (subsection.26.4.3) >> endobj 2412 0 obj -(27.1 Features and Benefits) +(26.4.3 HOSTS File) endobj 2413 0 obj -<< /S /GoTo /D (section.27.2) >> +<< /S /GoTo /D (subsection.26.4.4) >> endobj 2416 0 obj -(27.2 What are charsets and unicode?) +(26.4.4 DNS Lookup) endobj 2417 0 obj -<< /S /GoTo /D (section.27.3) >> +<< /S /GoTo /D (subsection.26.4.5) >> endobj 2420 0 obj -(27.3 Samba and charsets) +(26.4.5 WINS Lookup) endobj 2421 0 obj -<< /S /GoTo /D (section.27.4) >> +<< /S /GoTo /D (section.26.5) >> endobj 2424 0 obj -(27.4 Conversion from old names) +(26.5 Common Errors) endobj 2425 0 obj -<< /S /GoTo /D (section.27.5) >> +<< /S /GoTo /D (subsection.26.5.1) >> endobj 2428 0 obj -(27.5 Japanese charsets) +(26.5.1 Pinging Works Only in One Way) endobj 2429 0 obj -<< /S /GoTo /D (section.27.6) >> +<< /S /GoTo /D (subsection.26.5.2) >> endobj 2432 0 obj -(27.6 Common errors) +(26.5.2 Very Slow Network Connections) endobj 2433 0 obj -<< /S /GoTo /D (subsection.27.6.1) >> +<< /S /GoTo /D (subsection.26.5.3) >> endobj 2436 0 obj -(27.6.1 CP850.so can't be found) +(26.5.3 Samba Server Name Change Problem) endobj 2437 0 obj -<< /S /GoTo /D (chapter.28) >> +<< /S /GoTo /D (chapter.27) >> endobj 2440 0 obj -(28 Samba Backup Techniques) +(27 Unicode/Charsets) endobj 2441 0 obj -<< /S /GoTo /D (section.28.1) >> +<< /S /GoTo /D (section.27.1) >> endobj 2444 0 obj -(28.1 Note) +(27.1 Features and Benefits) endobj 2445 0 obj -<< /S /GoTo /D (section.28.2) >> +<< /S /GoTo /D (section.27.2) >> endobj 2448 0 obj -(28.2 Features and Benefits) +(27.2 What Are Charsets and Unicode?) endobj 2449 0 obj -<< /S /GoTo /D (chapter.29) >> +<< /S /GoTo /D (section.27.3) >> endobj 2452 0 obj -(29 High Availability Options) +(27.3 Samba and Charsets) endobj 2453 0 obj -<< /S /GoTo /D (section.29.1) >> +<< /S /GoTo /D (section.27.4) >> endobj 2456 0 obj -(29.1 Note) +(27.4 Conversion from Old Names) endobj 2457 0 obj -<< /S /GoTo /D (part.4) >> +<< /S /GoTo /D (section.27.5) >> endobj 2460 0 obj -(IV Migration and Updating) +(27.5 Japanese Charsets) endobj 2461 0 obj -<< /S /GoTo /D (chapter.30) >> +<< /S /GoTo /D (section.27.6) >> endobj 2464 0 obj -(30 Upgrading from Samba-2.x to Samba-3.0.0) +(27.6 Common Errors) endobj 2465 0 obj -<< /S /GoTo /D (section.30.1) >> +<< /S /GoTo /D (subsection.27.6.1) >> endobj 2468 0 obj -(30.1 New Features in Samba-3) +(27.6.1 CP850.so Can't Be Found) endobj 2469 0 obj -<< /S /GoTo /D (section.30.2) >> +<< /S /GoTo /D (chapter.28) >> endobj 2472 0 obj -(30.2 Configuration Parameter Changes) +(28 Samba Backup Techniques) endobj 2473 0 obj -<< /S /GoTo /D (subsection.30.2.1) >> +<< /S /GoTo /D (section.28.1) >> endobj 2476 0 obj -(30.2.1 Removed Parameters) +(28.1 Note) endobj 2477 0 obj -<< /S /GoTo /D (subsection.30.2.2) >> +<< /S /GoTo /D (section.28.2) >> endobj 2480 0 obj -(30.2.2 New Parameters) +(28.2 Features and Benefits) endobj 2481 0 obj -<< /S /GoTo /D (subsection.30.2.3) >> +<< /S /GoTo /D (chapter.29) >> endobj 2484 0 obj -(30.2.3 Modified Parameters \(changes in behavior\):) +(29 High Availability Options) endobj 2485 0 obj -<< /S /GoTo /D (section.30.3) >> +<< /S /GoTo /D (section.29.1) >> endobj 2488 0 obj -(30.3 New Functionality) +(29.1 Note) endobj 2489 0 obj -<< /S /GoTo /D (subsection.30.3.1) >> +<< /S /GoTo /D (part.4) >> endobj 2492 0 obj -(30.3.1 Databases) +(IV Migration and Updating) endobj 2493 0 obj -<< /S /GoTo /D (subsection.30.3.2) >> +<< /S /GoTo /D (chapter.30) >> endobj 2496 0 obj -(30.3.2 Changes in Behavior) +(30 Upgrading from Samba-2.x to Samba-3.0.0) endobj 2497 0 obj -<< /S /GoTo /D (subsection.30.3.3) >> +<< /S /GoTo /D (section.30.1) >> endobj 2500 0 obj -(30.3.3 Charsets) +(30.1 Quick Migration Guide) endobj 2501 0 obj -<< /S /GoTo /D (subsection.30.3.4) >> +<< /S /GoTo /D (section.30.2) >> endobj 2504 0 obj -(30.3.4 Passdb Backends and Authentication) +(30.2 New Features in Samba-3) endobj 2505 0 obj -<< /S /GoTo /D (subsection.30.3.5) >> +<< /S /GoTo /D (section.30.3) >> endobj 2508 0 obj -(30.3.5 Charsets) +(30.3 Configuration Parameter Changes) endobj 2509 0 obj -<< /S /GoTo /D (subsection.30.3.6) >> +<< /S /GoTo /D (subsection.30.3.1) >> endobj 2512 0 obj -(30.3.6 LDAP) +(30.3.1 Removed Parameters) endobj 2513 0 obj -<< /S /GoTo /D (subsubsection.30.3.6.1) >> +<< /S /GoTo /D (subsection.30.3.2) >> endobj 2516 0 obj -(30.3.6.1 New Schema) +(30.3.2 New Parameters) endobj 2517 0 obj -<< /S /GoTo /D (subsubsection.30.3.6.2) >> +<< /S /GoTo /D (subsection.30.3.3) >> endobj 2520 0 obj -(30.3.6.2 New Suffix for Searching) +(30.3.3 Modified Parameters \(Changes in Behavior\):) endobj 2521 0 obj -<< /S /GoTo /D (subsubsection.30.3.6.3) >> +<< /S /GoTo /D (section.30.4) >> endobj 2524 0 obj -(30.3.6.3 IdMap LDAP support) +(30.4 New Functionality) endobj 2525 0 obj -<< /S /GoTo /D (chapter.31) >> +<< /S /GoTo /D (subsection.30.4.1) >> endobj 2528 0 obj -(31 Migration from NT4 PDC to Samba-3 PDC) +(30.4.1 Databases) endobj 2529 0 obj -<< /S /GoTo /D (section.31.1) >> +<< /S /GoTo /D (subsection.30.4.2) >> endobj 2532 0 obj -(31.1 Planning and Getting Started) +(30.4.2 Changes in Behavior) endobj 2533 0 obj -<< /S /GoTo /D (subsection.31.1.1) >> +<< /S /GoTo /D (subsection.30.4.3) >> endobj 2536 0 obj -(31.1.1 Objectives) +(30.4.3 Charsets) endobj 2537 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.1) >> +<< /S /GoTo /D (subsection.30.4.4) >> endobj 2540 0 obj -(31.1.1.1 Domain Layout) +(30.4.4 Passdb Backends and Authentication) endobj 2541 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.2) >> +<< /S /GoTo /D (subsection.30.4.5) >> endobj 2544 0 obj -(31.1.1.2 Server Share and Directory Layout) +(30.4.5 LDAP) endobj 2545 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.3) >> +<< /S /GoTo /D (subsubsection.30.4.5.1) >> endobj 2548 0 obj -(31.1.1.3 Logon Scripts) +(30.4.5.1 New Schema) endobj 2549 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.4) >> +<< /S /GoTo /D (subsubsection.30.4.5.2) >> endobj 2552 0 obj -(31.1.1.4 Profile Migration/Creation) +(30.4.5.2 New Suffix for Searching) endobj 2553 0 obj -<< /S /GoTo /D (subsubsection.31.1.1.5) >> +<< /S /GoTo /D (subsubsection.30.4.5.3) >> endobj 2556 0 obj -(31.1.1.5 User and Group Accounts) +(30.4.5.3 IdMap LDAP Support) endobj 2557 0 obj -<< /S /GoTo /D (subsection.31.1.2) >> +<< /S /GoTo /D (chapter.31) >> endobj 2560 0 obj -(31.1.2 Steps In Migration Process) +(31 Migration from NT4 PDC to Samba-3 PDC) endobj 2561 0 obj -<< /S /GoTo /D (section.31.2) >> +<< /S /GoTo /D (section.31.1) >> endobj 2564 0 obj -(31.2 Migration Options) +(31.1 Planning and Getting Started) endobj 2565 0 obj -<< /S /GoTo /D (subsection.31.2.1) >> +<< /S /GoTo /D (subsection.31.1.1) >> endobj 2568 0 obj -(31.2.1 Planning for Success) +(31.1.1 Objectives) endobj 2569 0 obj -<< /S /GoTo /D (subsection.31.2.2) >> +<< /S /GoTo /D (subsubsection.31.1.1.1) >> endobj 2572 0 obj -(31.2.2 Samba-3 Implementation Choices) +(31.1.1.1 Domain Layout) endobj 2573 0 obj -<< /S /GoTo /D (chapter.32) >> +<< /S /GoTo /D (subsubsection.31.1.1.2) >> endobj 2576 0 obj -(32 SWAT - The Samba Web Administration Tool) +(31.1.1.2 Server Share and Directory Layout) endobj 2577 0 obj -<< /S /GoTo /D (section.32.1) >> +<< /S /GoTo /D (subsubsection.31.1.1.3) >> endobj 2580 0 obj -(32.1 Features and Benefits) +(31.1.1.3 Logon Scripts) endobj 2581 0 obj -<< /S /GoTo /D (subsection.32.1.1) >> +<< /S /GoTo /D (subsubsection.31.1.1.4) >> endobj 2584 0 obj -(32.1.1 Enabling SWAT for use) +(31.1.1.4 Profile Migration/Creation) endobj 2585 0 obj -<< /S /GoTo /D (subsection.32.1.2) >> +<< /S /GoTo /D (subsubsection.31.1.1.5) >> endobj 2588 0 obj -(32.1.2 Securing SWAT through SSL) +(31.1.1.5 User and Group Accounts) endobj 2589 0 obj -<< /S /GoTo /D (subsection.32.1.3) >> +<< /S /GoTo /D (subsection.31.1.2) >> endobj 2592 0 obj -(32.1.3 The SWAT Home Page) +(31.1.2 Steps in Migration Process) endobj 2593 0 obj -<< /S /GoTo /D (subsection.32.1.4) >> +<< /S /GoTo /D (section.31.2) >> endobj 2596 0 obj -(32.1.4 Global Settings) +(31.2 Migration Options) endobj 2597 0 obj -<< /S /GoTo /D (subsection.32.1.5) >> +<< /S /GoTo /D (subsection.31.2.1) >> endobj 2600 0 obj -(32.1.5 Share Settings) +(31.2.1 Planning for Success) endobj 2601 0 obj -<< /S /GoTo /D (subsection.32.1.6) >> +<< /S /GoTo /D (subsection.31.2.2) >> endobj 2604 0 obj -(32.1.6 Printers Settings) +(31.2.2 Samba-3 Implementation Choices) endobj 2605 0 obj -<< /S /GoTo /D (subsection.32.1.7) >> +<< /S /GoTo /D (chapter.32) >> endobj 2608 0 obj -(32.1.7 The SWAT Wizard) +(32 SWAT --- The Samba Web Administration Tool) endobj 2609 0 obj -<< /S /GoTo /D (subsection.32.1.8) >> +<< /S /GoTo /D (section.32.1) >> endobj 2612 0 obj -(32.1.8 The Status Page) +(32.1 Features and Benefits) endobj 2613 0 obj -<< /S /GoTo /D (subsection.32.1.9) >> +<< /S /GoTo /D (section.32.2) >> endobj 2616 0 obj -(32.1.9 The View Page) +(32.2 Guidelines and Technical Tips) endobj 2617 0 obj -<< /S /GoTo /D (subsection.32.1.10) >> +<< /S /GoTo /D (subsection.32.2.1) >> endobj 2620 0 obj -(32.1.10 The Password Change Page) +(32.2.1 Validate SWAT Installation) endobj 2621 0 obj -<< /S /GoTo /D (part.5) >> +<< /S /GoTo /D (subsubsection.32.2.1.1) >> endobj 2624 0 obj -(V Troubleshooting) +(32.2.1.1 Locating the swat File) endobj 2625 0 obj -<< /S /GoTo /D (chapter.33) >> +<< /S /GoTo /D (subsubsection.32.2.1.2) >> endobj 2628 0 obj -(33 The Samba checklist) +(32.2.1.2 Locating the SWAT Support Files) endobj 2629 0 obj -<< /S /GoTo /D (section.33.1) >> +<< /S /GoTo /D (subsection.32.2.2) >> endobj 2632 0 obj -(33.1 Introduction) +(32.2.2 Enabling SWAT for Use) endobj 2633 0 obj -<< /S /GoTo /D (section.33.2) >> +<< /S /GoTo /D (subsection.32.2.3) >> endobj 2636 0 obj -(33.2 Assumptions) +(32.2.3 Securing SWAT through SSL) endobj 2637 0 obj -<< /S /GoTo /D (section.33.3) >> +<< /S /GoTo /D (subsection.32.2.4) >> endobj 2640 0 obj -(33.3 The tests) +(32.2.4 Enabling SWAT Internationalization Support) endobj 2641 0 obj -<< /S /GoTo /D (chapter.34) >> +<< /S /GoTo /D (section.32.3) >> endobj 2644 0 obj -(34 Analysing and solving samba problems) +(32.3 Overview and Quick Tour) endobj 2645 0 obj -<< /S /GoTo /D (section.34.1) >> +<< /S /GoTo /D (subsection.32.3.1) >> endobj 2648 0 obj -(34.1 Diagnostics tools) +(32.3.1 The SWAT Home Page) endobj 2649 0 obj -<< /S /GoTo /D (subsection.34.1.1) >> +<< /S /GoTo /D (subsection.32.3.2) >> endobj 2652 0 obj -(34.1.1 Debugging with Samba itself) +(32.3.2 Global Settings) endobj 2653 0 obj -<< /S /GoTo /D (subsection.34.1.2) >> +<< /S /GoTo /D (subsection.32.3.3) >> endobj 2656 0 obj -(34.1.2 Tcpdump) +(32.3.3 Share Settings) endobj 2657 0 obj -<< /S /GoTo /D (subsection.34.1.3) >> +<< /S /GoTo /D (subsection.32.3.4) >> endobj 2660 0 obj -(34.1.3 Ethereal) +(32.3.4 Printers Settings) endobj 2661 0 obj -<< /S /GoTo /D (subsection.34.1.4) >> +<< /S /GoTo /D (subsection.32.3.5) >> endobj 2664 0 obj -(34.1.4 The Windows Network Monitor) +(32.3.5 The SWAT Wizard) endobj 2665 0 obj -<< /S /GoTo /D (subsubsection.34.1.4.1) >> +<< /S /GoTo /D (subsection.32.3.6) >> endobj 2668 0 obj -(34.1.4.1 Installing 'Network Monitor' on an NT Workstation) +(32.3.6 The Status Page) endobj 2669 0 obj -<< /S /GoTo /D (subsubsection.34.1.4.2) >> +<< /S /GoTo /D (subsection.32.3.7) >> endobj 2672 0 obj -(34.1.4.2 Installing 'Network Monitor' on an 9x Workstation) +(32.3.7 The View Page) endobj 2673 0 obj -<< /S /GoTo /D (section.34.2) >> +<< /S /GoTo /D (subsection.32.3.8) >> endobj 2676 0 obj -(34.2 Useful URLs) +(32.3.8 The Password Change Page) endobj 2677 0 obj -<< /S /GoTo /D (section.34.3) >> +<< /S /GoTo /D (part.5) >> endobj 2680 0 obj -(34.3 Getting help from the mailing lists) +(V Troubleshooting) endobj 2681 0 obj -<< /S /GoTo /D (section.34.4) >> +<< /S /GoTo /D (chapter.33) >> endobj 2684 0 obj -(34.4 How to get off the mailing lists) +(33 The Samba Checklist) endobj 2685 0 obj -<< /S /GoTo /D (chapter.35) >> +<< /S /GoTo /D (section.33.1) >> endobj 2688 0 obj -(35 Reporting Bugs) +(33.1 Introduction) endobj 2689 0 obj -<< /S /GoTo /D (section.35.1) >> +<< /S /GoTo /D (section.33.2) >> endobj 2692 0 obj -(35.1 Introduction) +(33.2 Assumptions) endobj 2693 0 obj -<< /S /GoTo /D (section.35.2) >> +<< /S /GoTo /D (section.33.3) >> endobj 2696 0 obj -(35.2 General info) +(33.3 The Tests) endobj 2697 0 obj -<< /S /GoTo /D (section.35.3) >> +<< /S /GoTo /D (chapter.34) >> endobj 2700 0 obj -(35.3 Debug levels) +(34 Analyzing and Solving Samba Problems) endobj 2701 0 obj -<< /S /GoTo /D (section.35.4) >> +<< /S /GoTo /D (section.34.1) >> endobj 2704 0 obj -(35.4 Internal errors) +(34.1 Diagnostics Tools) endobj 2705 0 obj -<< /S /GoTo /D (section.35.5) >> +<< /S /GoTo /D (subsection.34.1.1) >> endobj 2708 0 obj -(35.5 Attaching to a running process) +(34.1.1 Debugging with Samba Itself) endobj 2709 0 obj -<< /S /GoTo /D (section.35.6) >> +<< /S /GoTo /D (subsection.34.1.2) >> endobj 2712 0 obj -(35.6 Patches) +(34.1.2 Tcpdump) endobj 2713 0 obj -<< /S /GoTo /D (part.6) >> +<< /S /GoTo /D (subsection.34.1.3) >> endobj 2716 0 obj -(VI Appendixes) +(34.1.3 Ethereal) endobj 2717 0 obj -<< /S /GoTo /D (chapter.36) >> +<< /S /GoTo /D (subsection.34.1.4) >> endobj 2720 0 obj -(36 How to compile Samba) +(34.1.4 The Windows Network Monitor) endobj 2721 0 obj -<< /S /GoTo /D (section.36.1) >> +<< /S /GoTo /D (subsubsection.34.1.4.1) >> endobj 2724 0 obj -(36.1 Access Samba source code via CVS) +(34.1.4.1 Installing Network Monitor on an NT Workstation) endobj 2725 0 obj -<< /S /GoTo /D (subsection.36.1.1) >> +<< /S /GoTo /D (subsubsection.34.1.4.2) >> endobj 2728 0 obj -(36.1.1 Introduction) +(34.1.4.2 Installing Network Monitor on Windows 9x/Me) endobj 2729 0 obj -<< /S /GoTo /D (subsection.36.1.2) >> +<< /S /GoTo /D (section.34.2) >> endobj 2732 0 obj -(36.1.2 CVS Access to samba.org) +(34.2 Useful URLs) endobj 2733 0 obj -<< /S /GoTo /D (subsubsection.36.1.2.1) >> +<< /S /GoTo /D (section.34.3) >> endobj 2736 0 obj -(36.1.2.1 Access via CVSweb) +(34.3 Getting Mailing List Help) endobj 2737 0 obj -<< /S /GoTo /D (subsubsection.36.1.2.2) >> +<< /S /GoTo /D (section.34.4) >> endobj 2740 0 obj -(36.1.2.2 Access via cvs) +(34.4 How to Get Off the Mailing Lists) endobj 2741 0 obj -<< /S /GoTo /D (section.36.2) >> +<< /S /GoTo /D (chapter.35) >> endobj 2744 0 obj -(36.2 Accessing the samba sources via rsync and ftp) +(35 Reporting Bugs) endobj 2745 0 obj -<< /S /GoTo /D (section.36.3) >> +<< /S /GoTo /D (section.35.1) >> endobj 2748 0 obj -(36.3 Verifying Samba's PGP signature) +(35.1 Introduction) endobj 2749 0 obj -<< /S /GoTo /D (section.36.4) >> +<< /S /GoTo /D (section.35.2) >> endobj 2752 0 obj -(36.4 Building the Binaries) +(35.2 General Information) endobj 2753 0 obj -<< /S /GoTo /D (subsection.36.4.1) >> +<< /S /GoTo /D (section.35.3) >> endobj 2756 0 obj -(36.4.1 Compiling samba with Active Directory support) +(35.3 Debug Levels) endobj 2757 0 obj -<< /S /GoTo /D (subsubsection.36.4.1.1) >> +<< /S /GoTo /D (section.35.4) >> endobj 2760 0 obj -(36.4.1.1 Installing the required packages for Debian) +(35.4 Internal Errors) endobj 2761 0 obj -<< /S /GoTo /D (subsubsection.36.4.1.2) >> +<< /S /GoTo /D (section.35.5) >> endobj 2764 0 obj -(36.4.1.2 Installing the required packages for RedHat) +(35.5 Attaching to a Running Process) endobj 2765 0 obj -<< /S /GoTo /D (section.36.5) >> +<< /S /GoTo /D (section.35.6) >> endobj 2768 0 obj -(36.5 Starting the smbd and nmbd) +(35.6 Patches) endobj 2769 0 obj -<< /S /GoTo /D (subsection.36.5.1) >> +<< /S /GoTo /D (part.6) >> endobj 2772 0 obj -(36.5.1 Starting from inetd.conf) +(VI Appendixes) endobj 2773 0 obj -<< /S /GoTo /D (subsection.36.5.2) >> +<< /S /GoTo /D (chapter.36) >> endobj 2776 0 obj -(36.5.2 Alternative: starting it as a daemon) +(36 How to Compile Samba) endobj 2777 0 obj -<< /S /GoTo /D (chapter.37) >> +<< /S /GoTo /D (section.36.1) >> endobj 2780 0 obj -(37 Portability) +(36.1 Access Samba Source Code via CVS) endobj 2781 0 obj -<< /S /GoTo /D (section.37.1) >> +<< /S /GoTo /D (subsection.36.1.1) >> endobj 2784 0 obj -(37.1 HPUX) +(36.1.1 Introduction) endobj 2785 0 obj -<< /S /GoTo /D (section.37.2) >> +<< /S /GoTo /D (subsection.36.1.2) >> endobj 2788 0 obj -(37.2 SCO UNIX) +(36.1.2 CVS Access to samba.org) endobj 2789 0 obj -<< /S /GoTo /D (section.37.3) >> +<< /S /GoTo /D (subsubsection.36.1.2.1) >> endobj 2792 0 obj -(37.3 DNIX) +(36.1.2.1 Access via CVSweb) endobj 2793 0 obj -<< /S /GoTo /D (section.37.4) >> +<< /S /GoTo /D (subsubsection.36.1.2.2) >> endobj 2796 0 obj -(37.4 RedHat Linux Rembrandt-II) +(36.1.2.2 Access via CVS) endobj 2797 0 obj -<< /S /GoTo /D (section.37.5) >> +<< /S /GoTo /D (section.36.2) >> endobj 2800 0 obj -(37.5 AIX) +(36.2 Accessing the Samba Sources via rsync and ftp) endobj 2801 0 obj -<< /S /GoTo /D (subsection.37.5.1) >> +<< /S /GoTo /D (section.36.3) >> endobj 2804 0 obj -(37.5.1 Sequential Read Ahead) +(36.3 Verifying Samba's PGP Signature) endobj 2805 0 obj -<< /S /GoTo /D (section.37.6) >> +<< /S /GoTo /D (section.36.4) >> endobj 2808 0 obj -(37.6 Solaris) +(36.4 Building the Binaries) endobj 2809 0 obj -<< /S /GoTo /D (subsection.37.6.1) >> +<< /S /GoTo /D (subsection.36.4.1) >> endobj 2812 0 obj -(37.6.1 Locking improvements) +(36.4.1 Compiling Samba with Active Directory Support) endobj 2813 0 obj -<< /S /GoTo /D (subsection.37.6.2) >> +<< /S /GoTo /D (subsubsection.36.4.1.1) >> endobj 2816 0 obj -(37.6.2 Winbind on Solaris 9) +(36.4.1.1 Installing the Required Packages for Debian) endobj 2817 0 obj -<< /S /GoTo /D (chapter.38) >> +<< /S /GoTo /D (subsubsection.36.4.1.2) >> endobj 2820 0 obj -(38 Samba and other CIFS clients) +(36.4.1.2 Installing the Required Packages for Red Hat Linux) endobj 2821 0 obj -<< /S /GoTo /D (section.38.1) >> +<< /S /GoTo /D (subsubsection.36.4.1.3) >> endobj 2824 0 obj -(38.1 Macintosh clients?) +(36.4.1.3 SuSE Linux Package Requirements) endobj 2825 0 obj -<< /S /GoTo /D (section.38.2) >> +<< /S /GoTo /D (section.36.5) >> endobj 2828 0 obj -(38.2 OS2 Client) +(36.5 Starting the smbd and nmbd) endobj 2829 0 obj -<< /S /GoTo /D (subsection.38.2.1) >> +<< /S /GoTo /D (subsection.36.5.1) >> endobj 2832 0 obj -(38.2.1 Configuring OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba) +(36.5.1 Starting from inetd.conf) endobj 2833 0 obj -<< /S /GoTo /D (subsection.38.2.2) >> +<< /S /GoTo /D (subsection.36.5.2) >> endobj 2836 0 obj -(38.2.2 Configuring OS/2 Warp 3 \(not Connect\), OS/2 1.2, 1.3 or 2.x for Samba) +(36.5.2 Alternative: Starting smbd as a Daemon) endobj 2837 0 obj -<< /S /GoTo /D (subsection.38.2.3) >> +<< /S /GoTo /D (chapter.37) >> endobj 2840 0 obj -(38.2.3 Printer driver download for for OS/2 clients?) +(37 Portability) endobj 2841 0 obj -<< /S /GoTo /D (section.38.3) >> +<< /S /GoTo /D (section.37.1) >> endobj 2844 0 obj -(38.3 Windows for Workgroups) +(37.1 HPUX) endobj 2845 0 obj -<< /S /GoTo /D (subsection.38.3.1) >> +<< /S /GoTo /D (section.37.2) >> endobj 2848 0 obj -(38.3.1 Latest TCP/IP stack from Microsoft) +(37.2 SCO UNIX) endobj 2849 0 obj -<< /S /GoTo /D (subsection.38.3.2) >> +<< /S /GoTo /D (section.37.3) >> endobj 2852 0 obj -(38.3.2 Delete .pwl files after password change) +(37.3 DNIX) endobj 2853 0 obj -<< /S /GoTo /D (subsection.38.3.3) >> +<< /S /GoTo /D (section.37.4) >> endobj 2856 0 obj -(38.3.3 Configuring WfW password handling) +(37.4 Red Hat Linux) endobj 2857 0 obj -<< /S /GoTo /D (subsection.38.3.4) >> +<< /S /GoTo /D (section.37.5) >> endobj 2860 0 obj -(38.3.4 Case handling of passwords) +(37.5 AIX) endobj 2861 0 obj -<< /S /GoTo /D (subsection.38.3.5) >> +<< /S /GoTo /D (subsection.37.5.1) >> endobj 2864 0 obj -(38.3.5 Use TCP/IP as default protocol) +(37.5.1 Sequential Read Ahead) endobj 2865 0 obj -<< /S /GoTo /D (subsection.38.3.6) >> +<< /S /GoTo /D (section.37.6) >> endobj 2868 0 obj -(38.3.6 Speed improvement) +(37.6 Solaris) endobj 2869 0 obj -<< /S /GoTo /D (section.38.4) >> +<< /S /GoTo /D (subsection.37.6.1) >> endobj 2872 0 obj -(38.4 Windows '95/'98) +(37.6.1 Locking Improvements) endobj 2873 0 obj -<< /S /GoTo /D (subsection.38.4.1) >> +<< /S /GoTo /D (subsection.37.6.2) >> endobj 2876 0 obj -(38.4.1 Speed improvement) +(37.6.2 Winbind on Solaris 9) endobj 2877 0 obj -<< /S /GoTo /D (section.38.5) >> +<< /S /GoTo /D (chapter.38) >> endobj 2880 0 obj -(38.5 Windows 2000 Service Pack 2) +(38 Samba and Other CIFS Clients) endobj 2881 0 obj -<< /S /GoTo /D (section.38.6) >> +<< /S /GoTo /D (section.38.1) >> endobj 2884 0 obj -(38.6 Windows NT 3.1) +(38.1 Macintosh Clients) endobj 2885 0 obj -<< /S /GoTo /D (chapter.39) >> +<< /S /GoTo /D (section.38.2) >> endobj 2888 0 obj -(39 Samba Performance Tuning) +(38.2 OS2 Client) endobj 2889 0 obj -<< /S /GoTo /D (section.39.1) >> +<< /S /GoTo /D (subsection.38.2.1) >> endobj 2892 0 obj -(39.1 Comparisons) +(38.2.1 Configuring OS/2 Warp Connect or OS/2 Warp 4) endobj 2893 0 obj -<< /S /GoTo /D (section.39.2) >> +<< /S /GoTo /D (subsection.38.2.2) >> endobj 2896 0 obj -(39.2 Socket options) +(38.2.2 Configuring Other Versions of OS/2) endobj 2897 0 obj -<< /S /GoTo /D (section.39.3) >> +<< /S /GoTo /D (subsection.38.2.3) >> endobj 2900 0 obj -(39.3 Read size) +(38.2.3 Printer Driver Download for OS/2 Clients) endobj 2901 0 obj -<< /S /GoTo /D (section.39.4) >> +<< /S /GoTo /D (section.38.3) >> endobj 2904 0 obj -(39.4 Max xmit) +(38.3 Windows for Workgroups) endobj 2905 0 obj -<< /S /GoTo /D (section.39.5) >> +<< /S /GoTo /D (subsection.38.3.1) >> endobj 2908 0 obj -(39.5 Log level) +(38.3.1 Latest TCP/IP Stack from Microsoft) endobj 2909 0 obj -<< /S /GoTo /D (section.39.6) >> +<< /S /GoTo /D (subsection.38.3.2) >> endobj 2912 0 obj -(39.6 Read raw) +(38.3.2 Delete .pwl Files After Password Change) endobj 2913 0 obj -<< /S /GoTo /D (section.39.7) >> +<< /S /GoTo /D (subsection.38.3.3) >> endobj 2916 0 obj -(39.7 Write raw) +(38.3.3 Configuring Windows for Workgroups Password Handling) endobj 2917 0 obj -<< /S /GoTo /D (section.39.8) >> +<< /S /GoTo /D (subsection.38.3.4) >> endobj 2920 0 obj -(39.8 Slow Logins) +(38.3.4 Password Case Sensitivity) endobj 2921 0 obj -<< /S /GoTo /D (section.39.9) >> +<< /S /GoTo /D (subsection.38.3.5) >> endobj 2924 0 obj -(39.9 Client tuning) +(38.3.5 Use TCP/IP as Default Protocol) endobj 2925 0 obj -<< /S /GoTo /D (section.39.10) >> +<< /S /GoTo /D (subsection.38.3.6) >> endobj 2928 0 obj -(39.10 Samba performance problem due changing kernel) +(38.3.6 Speed Improvement) endobj 2929 0 obj -<< /S /GoTo /D (section.39.11) >> +<< /S /GoTo /D (section.38.4) >> endobj 2932 0 obj -(39.11 Corrupt tdb Files) +(38.4 Windows 95/98) endobj 2933 0 obj -<< /S /GoTo /D (chapter.40) >> +<< /S /GoTo /D (subsection.38.4.1) >> endobj 2936 0 obj -(40 DNS and DHCP Configuration Guide) +(38.4.1 Speed Improvement) endobj 2937 0 obj -<< /S /GoTo /D (section.40.1) >> +<< /S /GoTo /D (section.38.5) >> endobj 2940 0 obj -(40.1 Note) +(38.5 Windows 2000 Service Pack 2) endobj 2941 0 obj -<< /S /GoTo /D (chapter.41) >> +<< /S /GoTo /D (section.38.6) >> endobj 2944 0 obj -(41 Further Resources) +(38.6 Windows NT 3.1) endobj 2945 0 obj -<< /S /GoTo /D (section.41.1) >> +<< /S /GoTo /D (chapter.39) >> endobj 2948 0 obj -(41.1 Websites) +(39 Samba Performance Tuning) endobj 2949 0 obj -<< /S /GoTo /D (section.41.2) >> +<< /S /GoTo /D (section.39.1) >> endobj 2952 0 obj -(41.2 Related updates from Microsoft) +(39.1 Comparisons) endobj 2953 0 obj -<< /S /GoTo /D [2954 0 R /Fit ] >> +<< /S /GoTo /D (section.39.2) >> +endobj +2956 0 obj +(39.2 Socket Options) +endobj +2957 0 obj +<< /S /GoTo /D (section.39.3) >> +endobj +2960 0 obj +(39.3 Read Size) +endobj +2961 0 obj +<< /S /GoTo /D (section.39.4) >> +endobj +2964 0 obj +(39.4 Max Xmit) endobj -2956 0 obj << -/Length 236 +2965 0 obj +<< /S /GoTo /D (section.39.5) >> +endobj +2968 0 obj +(39.5 Log Level) +endobj +2969 0 obj +<< /S /GoTo /D (section.39.6) >> +endobj +2972 0 obj +(39.6 Read Raw) +endobj +2973 0 obj +<< /S /GoTo /D (section.39.7) >> +endobj +2976 0 obj +(39.7 Write Raw) +endobj +2977 0 obj +<< /S /GoTo /D (section.39.8) >> +endobj +2980 0 obj +(39.8 Slow Logins) +endobj +2981 0 obj +<< /S /GoTo /D (section.39.9) >> +endobj +2984 0 obj +(39.9 Client Tuning) +endobj +2985 0 obj +<< /S /GoTo /D (section.39.10) >> +endobj +2988 0 obj +(39.10 Samba Performance Problem Due to Changing Linux Kernel) +endobj +2989 0 obj +<< /S /GoTo /D (section.39.11) >> +endobj +2992 0 obj +(39.11 Corrupt tdb Files) +endobj +2993 0 obj +<< /S /GoTo /D (chapter.40) >> +endobj +2996 0 obj +(40 DNS and DHCP Configuration Guide) +endobj +2997 0 obj +<< /S /GoTo /D (section.40.1) >> +endobj +3000 0 obj +(40.1 Note) +endobj +3001 0 obj +<< /S /GoTo /D (chapter.41) >> +endobj +3004 0 obj +(41 Further Resources) +endobj +3005 0 obj +<< /S /GoTo /D (section.41.1) >> +endobj +3008 0 obj +(41.1 Websites) +endobj +3009 0 obj +<< /S /GoTo /D (section.41.2) >> +endobj +3012 0 obj +(41.2 Related updates from Microsoft) +endobj +3013 0 obj +<< /S /GoTo /D [3014 0 R /Fit ] >> +endobj +3016 0 obj << +/Length 234 /Filter /FlateDecode >> stream -xÚ‘ÁJÄ0†ï}Š9¦‡Œ3™dÒ»¬ -‚ ˜›xº®.ì´}Ú]+H.3ù?2_Ê‹¡ HÒBlƒ0ôÇŠ`Ÿ“ÛŠÂÁà}®WB{N-Kƒ1Ä5H#ŠF°™ðA¿ŽãàГ‚UjQ¸)ð&UW7ŽÀª -¤7à±Q83éõÉ> endobj -2957 0 obj << -/D [2954 0 R /XYZ 85.039 786.531 null] +3017 0 obj << +/D [3014 0 R /XYZ 85.039 786.531 null] >> endobj -2958 0 obj << -/D [2954 0 R /XYZ 85.039 766.606 null] +3018 0 obj << +/D [3014 0 R /XYZ 85.039 766.606 null] >> endobj -2955 0 obj << -/Font << /F20 2961 0 R /F21 2964 0 R >> +3015 0 obj << +/Font << /F20 3021 0 R /F21 3024 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2968 0 obj << -/Length 1451 +3028 0 obj << +/Length 1373 /Filter /FlateDecode >> stream -xÚWKÛ6¾ï¯0öRˆµ¢H½zë3A.)§=4=Ð×VV IŽ³ýõ)Ërâ Xäp83ü8/ŠE?±È“0’Å"ËÓ0‘bQîï¢ÅV^ß Ç¡&JÁø+‹«Dæa’ËÅj"áçõÝÃï"Yˆ(,¢b±~ôZ’4óL,ÖÕ?ÁzW÷Ë•Ì’`³\ÅY`á?ìÒTà×4OËåJ¶YŠ 18,‡Ú¶¼dùûæÝöÿ½~×ó\W•©x8Xþ¾×û%hÚ€Íâ+²âò¸'Éí2.‚AOä£ØÏøG빃†…<‹ºj£p¹JÒìRã¿ë·€ÙJ œa@§6';!§FYÏŽ|j[±"Öœ¦Á8g›{ ¦EÊðÊ¿­xCoùë•ÕCÿƒe y÷8“ÂðA”ô·Û;¯¿ñÝ^¢«¹#8@{YÇ5,9ŒZz+ÀÏàªBâõ©"öa>Ùç‘FÐa᯷e^扃†!Æ?‹ LÖN2Ý‚iš)5vþ7Z1±©€ŠX@LG{KÚäΔÓ3ï®ëëѺG>Á€8_#r Et_ÉKºå G”Á‰ -„#ÞeÅ«z@ w¿­Ç(Ž…U$I‡q¬8Ðq¡Û:Ž?'!ï¹Wv -y9 ù¹L<Æn?><œN§°×ûm·}˜#¥ÓL]3Ë:žçÊ„‹¬#¥ -³4¹0Á:ˆ¼"B÷¿~;ˆàž™0ÌôÖ¸àV€ïÑtцEòÂïo«"Ì┯1!ÝÇÝ F°Ø»!H$%¨B¡Tñ"‰r:èíñÜ« û5s™hÒ[Ó°/av‘2øk 1];æE[ºö€5J/m›]ç¹mÑ\ZôêJ],B™Éï„Âs¿ x&“ °è-ãð&äïšðàô+‚C?túÊ_#ªTÝ„ÃóܶJFY(.l‚¤5×G×Ú¾‰†ç~AïL&j~m:ÝT ÂÇ(‰àôoGºg ^üEwƒ¹2SÅ*Ùmñ<·›KBãB1 -d—ž…Q‘»¶“pTï1ÊÎÕw…¶óm•8N\ð”*ʃ«Å“«å¸Žm~Í—I9ê™6–—¶QñÛvÃç©¿”‚uÃÛ¶×-!R| @3öÐœ…œP莣ç;ê à0ŸGsfB# ™ÝeV;N5å:{ÄJ‘$c惭RTðÔR“sjL… ™¦ÏVo¨VbGE2ìDÖÚÊ0rðY\†Ã<)Š±4"O_ÿç3&l§- 8K{ë°bIÄ5*‰ÄN×`¹ä›Ò‡ -6UòÆGÉkø -;=íåd&¨PÂÄe} Eî¶oxÓ8æ ܾs@23nQký1 -¾¾syF¦ÒRšÝ#‰jq=8 U6¸IW£¿î]°ýJòà'æs'£qÝö¥å…6sŸ@þïPuÝ«@h'èpqª«s?Tκˆ‚¦±-›£on©kA*&´ó‘§-Ú†ƒéy&•ÅÖƒ—cؘ‘ÁkäæNýÄlãôÙÍ ëÖÛY1Íì^œhÞ{ ä,þ@ˆ€)9` 8Ñ'‰k7‚T"Uį -ø]¢’¦CH ÇéL)ìm禼cƒ˜my|¿vé‚Ô¹-½çeêºá«›Þ©Ck¥éÜŒ¤ò¢A6NdÄu`å‡#9óØSè¶[^tŠZ¤ô°\Ã0}pÅ8p€8Åôgžy¤ÑH0Cò³&Ñ=¤9:ó¡î(k°sá.ß²âø€íWS—“õ'̾œ¸.ž#ÊÖɧü¤žÔìw8ƒ%ïë¶Ææb°“'䬦ºG´LB%åw¿Ôÿ…à¿Îendstream +xÚ•WKsÛ6¾ûWh|)5Ñ$Á‡Ø[ŸÎä’N£´‡¦ˆ„%Æ¡!©¨î¯ï~» EIvâŽgL`w±û€ÂY@ál™øÊgÙ2õΊÝM0Ûçþ&tq¢ü$Žiý s1pQ¤ü4…Ì«›»_Ãd~ä³Õˮʿ¼Õ¶êæ •%Þz¾ˆ2ÏÒÿ¥gA‹½§e[Ì¡gëyèÕË¢¯l#,û ß·ïçtþÏÕûNöº,M)ËÞÊ÷ƒÞÍÉÒšÔhQ_ÒR ‡knæQîõz¢j¿àó[§rK'(y™º%j‡•?_$ivnñïÕ;Š}¤œ1à(IL#²#$5t=9ò¨M)†Äršzã^|ªíž;LJÿÆÅß”r ³òŒU}÷Sey÷p¡E@b5Üoûõ°Ð_éÁ!Ú·m\ÃÒšýh¥n…äÜ8W¸¾8¼ÌÞgÛbO9`B–þãz‘™È«bü³p¨²všùL]O©‘Ë¿Ñ‹‰O”G!$tèØY¶î4·¦˜ÆÀ4¹»¶«Fï$‚8_#ò5‘¾JXº‘T”Á&öÂwY +W÷°póËj¬Ü0J}•RáÆŸÆK)n0Ú“øý^JY=WÊÛ¾ßww<ýNïÖÚ·íæîÚFàGYø|ëP~;ÖËúè†ôBp·?¿\¾¡w+B¨½1®.c‚æ·Úh¾##*eMèQœûY”žÝÀaϘ¢út/™I ®¸¹\DºóÄ#5žÎgã|gj¹_T¼RÞsòдÍØ«lõùÒf–ðžû²…7—ÇSj×Ùpúxjq¸ùÖ—ïŠÝ•Žzû®oõ¥¹etºïëTHUúÍTh¯ÒKMx}÷¦Õu)ž +’€\~7:ß>)æOºí͵Ù@ùY½x_L©ÜUF™–K7Ñ=‚Üû€;œL‰ÊGi^p;–^6÷è†ø˜wøš&}´ÚØ›b s8¶ÕȱÇî\ ÞàÛN7Ò=Ùðž³ÑØ}}Rr„Ò­¤*ö[}Ì—ÑÁ¥Á *e&È}^4½cÅ•nhqI2Ö=mA‰½Ç†§ó±6%ÊBÓNت57y<X‡èˆh~@Bbqå.æcO‡LWý;ô :ÎÃ0œ…Ý —DÑËÁã^Îâ| Vf•)\8 ¯2· ¢Òáçƒlø†Å4žÉ<µU?è15ÌXM(> endobj -2973 0 obj << +3033 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [210.406 518.803 332.67 530.796] /Subtype/Link/A<> >> endobj -2977 0 obj << +3037 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [138.346 504.951 215.702 517.852] /Subtype/Link/A<> >> endobj -2978 0 obj << +3038 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [220.377 504.951 304.46 517.852] /Subtype/Link/A<> >> endobj -2979 0 obj << +3039 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [319.468 504.951 425.172 517.852] /Subtype/Link/A<> >> endobj -2969 0 obj << -/D [2967 0 R /XYZ 85.039 786.531 null] +3029 0 obj << +/D [3027 0 R /XYZ 85.039 786.531 null] >> endobj -2966 0 obj << -/Font << /F15 2972 0 R /F35 2976 0 R >> +3026 0 obj << +/Font << /F15 3032 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2982 0 obj << -/Length 523 +3042 0 obj << +/Length 490 /Filter /FlateDecode >> stream -xÚ}SM›0½çWøh8þÆôÖJm¤*Z­ZzÚöIˆÀiÚß²4ÍVH¶™yž÷f<#‡OgW9ÉœeF RžœìÁ³Zˆ¡bFk8?p¦“7µ’q=ÄŒi&5ÓN#æC±X~’œHάU¤ØMB,áÒ‘¢z¡ëz¿9&©²–>u¾)ëäGñyñ±¸Ežî¨¸í¹g˜À- œå<Ÿs Ãrkwqh Ö­º$•Ž–—SÝ&pðßtmô5‰ æhÕ ¾Çÿí_'© UD¡¡­` Æ>ý!ðîêé[4®ê¶îCÎðóŒ÷¶GXš2âÖXÑFÚñ~F¿sÃWÏkØD4üD¡u?Ü„J–¤ÚYúK•I>[R-»3ÂR(Úíp— ¯Ž†ã#R°‡úàŽŽ(õRÕU pE2 À[ÆBÓ¯pÜœ™Ñ-ž" Dï0ë¾IbUsñ«k1•A"ÁxQ>é–M5lá鲉s‡÷/¨¶SÅs:)oÚz^j³ñ÷=—;¦2EŒsÌÙ±ßÑÞïGÀ—Y÷àt†ݧæÝwiÞŸß-—×ë•í†ëúýŸ¡êa¹?™ÿõ. aœ4 » ‰Á¤ƒ˜Z­ôôæä(Põxp‡©‚‰1(]Ý 3Ê1ãysOùò endstream +xÚuSË®›0Ýç+¼4 Œ_¼ºk¥©Š®®Zºj» `R˜¦ýûÎØ$Šî%BòãÌñÌ™aFŸ Y̸ÊIš%,V‚Ôç'XŠX:V,ÖÎÆðf ɸN·8œ„*c:NÐø©ÜE_$'’³$Q¤l©l~Ò½éªSª$¡/£íkü.¿î>—~tÂòL> "ãÙ=†ˆ‰à,çùcŒòØÏB§´ƒPf´^Îfà`+Ûƒ·õ Ž–ѦŸí„÷Ë5A(hãY ,œDÑõzeíܲqê"¬ï0›9ê.'fÿ¾ (9‡‘O¦J‚IÆ0^„=Þ’¥Ô0y±÷ô¼õÕ;2grå[Îÿéðó2endstream endobj -2981 0 obj << +3041 0 obj << /Type /Page -/Contents 2982 0 R -/Resources 2980 0 R +/Contents 3042 0 R +/Resources 3040 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2965 0 R -/Annots [ 2985 0 R ] +/Parent 3025 0 R +/Annots [ 3045 0 R ] >> endobj -2985 0 obj << +3045 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [97.376 585.447 299.821 597.439] /Subtype/Link/A<> >> endobj -2983 0 obj << -/D [2981 0 R /XYZ 85.039 786.531 null] +3043 0 obj << +/D [3041 0 R /XYZ 85.039 786.531 null] >> endobj -2984 0 obj << -/D [2981 0 R /XYZ 85.039 639.047 null] +3044 0 obj << +/D [3041 0 R /XYZ 85.039 639.047 null] >> endobj -2980 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +3040 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2988 0 obj << -/Length 1726 +3048 0 obj << +/Length 1111 /Filter /FlateDecode >> stream -xÚ½ZËnÜ6Ýû+´Ô,†åK|Ea»yÕMºˆnš.&Å™d<Èr -ÿ}IŠ’(Š¼ˆa žXÇ÷^žû eR`óE -U!Ìt!•@#ŧ»3\Üš'¯ÏˆGðŠ¡Šsó9ñpÝ?] Š0—IŒ÷±–”#®¸Å\ÞœýòŠâ‚b$+n>÷D„!‚©*n¶ÿ”+†Ë¶mvÚÝñp¿ú÷æêìåÍ`¸ÿÎ<åk*ÖÊ>ì~ØÜ݇÷ †‚TH 10$UA0ÒX‡ =Æ2üã°¢ªl›)«µù¸}0?­Ö¤´ŒWkÆhÙíw^^›G›»•åGû)^ Ñ&’UUf‘$X¡Š¿* F»R -)!‡µp¬…`‚8fE²‹ù€‰œ‘©J±©3ó8‰!1B'_llø~ì¶6@¬|[²Ñùb¢ãâúØX:¿¼b*°#™QŒ4ž­_çA43Z˜ðµš[·½G/0lZÇ[ÏÜPÝžïÍ¿µÝó}R"'†ã]L”šm’X€í13z“€Ä–,½ß2©R ‚¤Ð'fC€ÎfC±^ßí²ÿëÔÞ©ž™¹o7û}÷ŸÍaÛåÄÍJ±.f÷m÷èúâÝåÅ,Jœ"ªhÈ{.¿J"ÊY˜éùœ` Irƒsb4äDä1Ç "R6µ£ ”Òn{[›0ÎBD%Ë%Ŧ.Ë)×l>x0L:²h½šmá¶>¿·[j‹œ*?n-‹Íí\úI&Áøõ˜•HúSK ô±D•¤°Ú­sGÏú¾K‹aƾ®ÝÙÃfq³k݉¤ûÅwþ¬Ú§÷ý|ì®ÜQtä7×¢ÀÁIt!A8GZ-ŒU=h1AFc@‚DÓ xü9S÷„ëâÔ ’Ž,>}ê†â7LÝ1•äÔrɦ‘H)ËcÄòð EyGyDÓò<þü©{Â{yêWÛ|úÔ Es˜ºc.É©;ä’ ÕIQ&/–´$Èá –ØcR,¡Ççj¶öËÍ\Gló©ÍŠèÐlc&Éf2É -F˜ÜR§ÎŸ:Ûn{Œ»<Þmv~?ú›Þã~&&A1£b`~¶t)©èI׶”™PjAà´(ðÑ ðÈcZàÇgxÈþCëˆm>Yà@DGGLÒ˜dŽµ©ä°^ —³¨–¼·Q,Swi­Œî^×Ífï¯÷?à -›à^ "i͈O°MÓÖ©û~‚%bÆZN+T!ÂÅ„{^* ®"²Ø5ÏÆò}ú¦=^¢dß4dÉsˆºæÄ$¢LÐ5|¯`ò"éAK*2‰=&uzŒ^]n¶Ä˜ª›xD§<ÿˆ!JÉ”&ð¨C/Žlº7@NKóxXÕÄ5 (x=fÆeZ>"K 6ª -QÍNì:Û{Œõz¹q﻾=tGP»m¦eºZºûÐ9©Uc!͹¢ˆ0Ëä'3‰Í\½0ö E™Æ™GÓ2<>W뜰_nà:b›OmPD‡Ö3I¶ÎIVûf¿±°`F Z àpLä1-˜À£;aíæoîî'8„¾­Ûî¹”¼¥ÀšäÅBÌ™,bˆ¥CÃkˆmf×`ÅòÖ}´%t²óëºù«nÑ‹—³þÊ”{źÇÌxN;ld ’’dHŸü'$#8[D=$>c¼«}±w uãRËV‹Ý÷™äw‡êÑ×, -Z#ánrªÄ$çò÷0•«ÆIæÌ "XñÂc,u³ª¬/sÄíÄ.ÿ¡À®endstream +xÚíYKoÛF¾ûWðH´Ù'w( +ÉUíÔM€"ziz ÍÌD" ŠJáŸ}Q’ù+ºº X´†äÌÎ÷Íì7k@ýƒÁ$2à"Œ à~}ƒ¥¶\_ e0Jõu‡qR['1ò®{`0!Pãåââ݆† ŽI°øboZ¤…³ˆÀ°ªÊìn[eE¾‰þ^Ü\üº8| Å@Æ´ÇæJaŒîËr¸‹O×Î+b‚@Byèõ·<Â"¬Ê…E4Ñ—éV_ÞGš(¢ !8¬ +óIÃ[mJÖæá¹jFˆ  Å=™ª­.PÙuŠ‰}¦mÈu„ü"ÞtÍt~Y·cc:|ggæ‰IÃ÷,5 %áuoVù WióóT‡ï®ˆ8x– !÷/ø©‘À1\‡d¾)—ÞtÔG¢]§Ó•þ­ ­pP,HźéX"€)~ž ëîY𵻟›O0„v] õ¾0þããˆC4Ë6U²Z¹?’> endobj -2991 0 obj << +3051 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [84.043 614.97 194.551 624.538] /Subtype /Link /A << /S /GoTo /D (IntroSMB) >> >> endobj -2998 0 obj << +3058 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [193.467 585.75 286.703 597.439] /Subtype/Link/A<> >> endobj -2999 0 obj << +3059 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [84.043 560.773 243.278 570.341] /Subtype /Link /A << /S /GoTo /D (install) >> >> endobj -3000 0 obj << +3060 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [201.074 531.553 287.733 543.243] /Subtype/Link/A<> >> endobj -3001 0 obj << +3061 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [213.498 504.455 301.672 516.144] /Subtype/Link/A<> >> endobj -3002 0 obj << +3062 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [205.528 477.356 277.612 489.046] /Subtype/Link/A<> >> endobj -3003 0 obj << +3063 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [171.68 450.258 279.46 461.947] +/Subtype/Link/A<> +>> endobj +3064 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [182.74 423.16 259.066 434.849] +/Subtype/Link/A<> +>> endobj +3065 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 423.16 219.945 434.849] +/Rect [84.043 396.061 219.945 407.751] /Subtype /Link /A << /S /GoTo /D (FastStart) >> >> endobj -3004 0 obj << +3066 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 396.061 277.612 407.751] +/Rect [205.528 368.963 277.612 380.652] /Subtype/Link/A<> >> endobj -3005 0 obj << +3067 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 368.963 246.551 380.652] +/Rect [84.043 341.864 246.551 353.554] /Subtype /Link /A << /S /GoTo /D (ServerType) >> >> endobj -3006 0 obj << +3068 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [201.074 341.864 287.733 353.554] +/Rect [201.074 314.766 287.733 326.456] /Subtype/Link/A<> >> endobj -3007 0 obj << +3069 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 314.766 301.672 326.456] +/Rect [213.498 287.668 301.672 299.357] /Subtype/Link/A<> >> endobj -3008 0 obj << +3070 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 287.668 277.612 299.357] +/Rect [205.528 260.569 277.612 272.259] /Subtype/Link/A<> >> endobj -3009 0 obj << +3071 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 262.69 163.187 272.259] +/Rect [84.043 235.592 163.187 245.16] /Subtype /Link /A << /S /GoTo /D (samba-pdc) >> >> endobj -3010 0 obj << +3072 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 233.471 277.612 245.16] +/Rect [205.528 206.372 277.612 218.062] /Subtype/Link/A<> >> endobj -3011 0 obj << +3073 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.149 205.766 308.384 218.668] +/Rect [227.149 178.668 308.384 191.57] /Subtype/Link/A<> >> endobj -3012 0 obj << +3074 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [192.225 179.274 292.187 190.964] +/Rect [192.225 152.176 292.187 163.865] /Subtype/Link/A<> >> endobj -3013 0 obj << +3075 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [214.998 124.471 270.445 137.373] +/Subtype/Link/A<> +>> endobj +3076 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 152.176 202.43 163.865] +/Rect [84.043 97.979 202.43 109.668] /Subtype /Link /A << /S /GoTo /D (samba-bdc) >> >> endobj -3014 0 obj << +3077 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 125.077 277.612 136.767] +/Rect [205.528 70.88 277.612 82.57] /Subtype/Link/A<> >> endobj -3015 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [200.892 99.674 339.46 109.668] -/Subtype/Link/A<> ->> endobj -3016 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 70.88 185.672 82.57] -/Subtype /Link -/A << /S /GoTo /D (domain-member) >> ->> endobj -2989 0 obj << -/D [2987 0 R /XYZ 85.039 786.531 null] +3049 0 obj << +/D [3047 0 R /XYZ 85.039 786.531 null] >> endobj -2990 0 obj << -/D [2987 0 R /XYZ 85.039 643.064 null] +3050 0 obj << +/D [3047 0 R /XYZ 85.039 643.064 null] >> endobj -2986 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F38 2997 0 R >> +3046 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R /F38 3057 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3026 0 obj << -/Length 2055 +3086 0 obj << +/Length 1196 /Filter /FlateDecode >> stream -xÚ½[Ñn9}ÏWä1‘¶f<öŒ=Ò - e©€ÕÒî.ð04CÉnÚ°ÓÄ߯íñŒ=wìëU#ÍÑ=Ç7çØ·ž@ç™úCç² «æB–¤`t~y=ËæWêç3jÙü$#¬’ú½gï>dó•ÂœÍº~S¯3B«j~=ã#göß›Ùùì÷¡J÷Ÿ¥ ÍI8a‘’1Ví‰( -Rr¡1O.fN9ÓŒTY5¿ø¤^QÂ36ïA«w‹÷Ëg³gC5š•Drî›ö˜ #-|FšFóãÙöó’.n–'Œ±Å¯¤ûûb)Ù¢YžÐE«Þür«_íÔ«¶Öâœ2éUU‹¹P:t¹Ÿ¡ú\)+r>V¯ßh¯,â·Ž¯ÖÔÄ^æÕb÷Èh­¯—¹\|¬‰Ò¼m¯&šDIJUëh™(­VÒJBºÞ»¹TÆ©pÃ8 b J!t†ŒaÃxŒgMÛ¨öŠÅ÷Î+7›µj³éûö&àÁ —EÌ´*H.ó±Ø¨?ztB6¨iü¡\?º­ö¸5Ê‚P´sb"`l‹QÔú3-pO Ä&éˆ8›3Ę.ìG÷¼iëͪ³Âû¬ÈT[φ£ý®~D»7©Û]ÓüA3A˜jSlQ]¤¼iT4îhZ­÷ûàmðÓb%ÚÉ5Œ ê`)U€X‘£ñ0q“ô ”K0ÂÁ&1èŸññÍJ;¢ù¦íÀ»#F÷|½ºj6›Ð¹BI.Xü\ÉI&ÆZ‘cÅ€qÑ ¢fݵzkS÷;VÔp"˜@û×c&RÆû¨„Úƒ ’øâa{XPÒ¡³` ÛÃc÷ŠÅ}ƒ>÷5oÔ§çmt°æ¡ó6ÖÑaÞ†J‚ó¶¯$æõB aU!÷ôº‡Žz½ÇhÖWçÝG÷—>ÂÌѶÕyÿvÛyþu³Ó-ù¦¶Õê?v -²c2ÕÖãWwæCÞ­·ÖÏÕ¿ïÖ+“ØDµdN¥¿¬i3I˜¨öË -“D–‰¨t˜dR†RHPÆtáœ8º£ÅÄ“¾GJE€Šg$ÞK‘±ŒpBœŒh@(%¢Ì÷ ˆCÇb1æ0èÜ}vº¿†Ø¬uV[’`fl`ž´FM{âÊFåÎÌf“œ0Zª™Iú«›v’Qe¸>'ø¯ä\rR– JJ%Å+ -d fÅgG×k:Ÿcæs¨$8ŸûJb†É+N*Ïç&n˜”2 F82 ã3þf6¯ë¦uGÎÆxåÚ5/»Ô붿. -9T=zäEz†œ9_ ¬©‰·›Æ ¢”ÌOŸ=~ù–˜étzêÐj*;3‘1>w@%Ô2¥ R”{Né::¥÷sMXÑé6·WÝ€þJ½DnAê3gä‹?^¿Ðm{k¯;t˶w_–¡¹]K• O\àj0#’ñ½®sž!s{J&ÄCà ñÏšÚýƒÄúæ}Ʋ%ç|q¹]Ûn¾ÒAr¿(u!ªïb^ j¤ø/5iŽ%›ƒºæÆps<Æ£M«#ùéq]¬yÐÀŠõs˜X¡ŒàÈêˈmTMâ3«‡‰Û¥¥ì‚vŒA»øŒÇOFêÓã ºXóÐñëè0ž@%ÁñÄW5LQ©iŸíyÖxèèYÓc4ëézÓ=t¥‹Ÿìm ÔO.wÛÖþNR›C§{}®?úºµOjíRsÛ]žX™&õùo7Áó‡qæ//xþ°ŒïuoD™2©L|]¡%3ãŠ!™ŒáÌxŒGËŒ¯~Ì`ë€5Î ÒQ— $œOI43™þuµÄ ã0ˆa,(i„Ð0† ã1ÞÓÅÀHlúb— jþðÅÖ9{1.|úè×&Õ¬ ñ EA¾6Ùa’_›Œ³¹¯MŽéÂ_›tt÷ïì‹N_;còAÅÃ/‘>wÎ@HðÊÙò°ëϸÝ9¡9µýÑóïªÛƒÍ³åá)²™‚#×Nጅÿ“eý×~ÿOÞ³eRÉÈ#õ‚1µ Ù‹Ñk) ^ý¿PîTðåãe(endstream +xÚíZßSã6~Ï_‘Çø!:Ë’,i¦Ók€ÂÀ]{¤íÍÜ݃À¾`êØÔ$ÇðßwW’CHlŽ„kë›fxÀÑÚÚÕ~ßþlÚáö• !Ó}©b"í_N{a’£õw„ýaH˜V(û«÷áSØOàž“ž¼ƒëP­ûÓŒÎüï¼wÞûu1‹“ñþbªU5ÃúŽ! ‰R¼éÃ({=î½:ä0êþø³½gœ|| © >OzãÅ“‚p!܃«“¢hyN*æü=PlPæüDjC:¨‚!clpšIzD²êW‡L-Í¢( 5õSý°j›ÒDȸ6Gª‰½;ÚÔ&?OíeW Û;O«7錌V- ,^6ÁùÇ*~´ŒZñ«Ï#ÀŽG.$¬Tu »£9x»ü0ƒ_W©odÇo­—®@P€`?-€Ñ² ?2«hs'ɨ¼E æõEJ’tÍlÝ_AgE#èÂÇ"<¡+öq^@í7ÁF¸23縮!M'œz 5ZäD°bwñäŠGåÔd…Sz–NÑë WÒÊ®!ÈnV•jMb&›0ôÂN2老œrëý™¸ÿc [Ÿ@ÀívÝÈÉÊ4eAdÔÊ<ÍID· ÞõUéÁlÏê6S¤Â…ÁÌQV“U2ô¹kËÔ@5µ¹¥›¥•cá½Ãf?ϳ:Ë¢ ìW¢5“GDË-à@"˜½[㢠‰XEÕ Peü(v;”¤ÓÊä‰C¸àd$Õ½ÍEVø“©fIš†’0®[³4D1¾:i…6Ü/ðA°HS¤hñèE4Šì:)û–†*½C¸Kbè–,™¤yÞÜóD’=ÑóH¡6cVa|‚Îgå.¨Uq,_€HHI Ht2bNÒ|ºÜ‡¾óõŶ…iU”¶°–ÙuSCËS ´ Û44×&ÑÁWól9–´lDtgKÿ®éü§šNµiÓyŽÎ7E24yY8T0…Ánè‹ÝAë¹ÞWa¡li8yw«hçNƒÊÿõ†s¶œ;¯ýÅͽãôîÖ±6ÐhýŽ••Ý{»¶Ä·Œq哹õï,+-¤ƒ,±Ô[±6 +aR·P­–~¿››ÙB²§ëη%ØÆ{`Ë ‰ R`§Ï몴´²Á™!ÖË¥$‚Ç-LñÂQ:N”o‹ +oGEìÚÇÍÛÇMÂxÿòÒ¦üy°hñ¬ÿŽë³×϶-&~¨>é°ûÍd±Åcc‡œü·7ÇïקÝ÷"-mª—î^Ê~gd+¶Æ£sX¿e2ÅÇ…ç|pYfž£gHæ‡MXná3óõ0’öMÔGD +Þü‰Åoô ?q⊄ +:˜‡ÉÚ)žáµ¿î‘†endstream endobj -3025 0 obj << +3085 0 obj << /Type /Page -/Contents 3026 0 R -/Resources 3024 0 R +/Contents 3086 0 R +/Resources 3084 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2965 0 R -/Annots [ 3028 0 R 3029 0 R 3030 0 R 3031 0 R 3032 0 R 3033 0 R 3034 0 R 3035 0 R 3036 0 R 3037 0 R 3038 0 R 3039 0 R 3040 0 R 3041 0 R 3042 0 R 3043 0 R 3044 0 R 3045 0 R 3046 0 R 3047 0 R 3048 0 R 3049 0 R 3050 0 R 3051 0 R 3052 0 R ] +/Parent 3025 0 R +/Annots [ 3088 0 R 3089 0 R 3090 0 R 3091 0 R 3092 0 R 3093 0 R 3094 0 R 3095 0 R 3096 0 R 3097 0 R 3098 0 R 3099 0 R 3100 0 R 3101 0 R 3102 0 R 3103 0 R 3104 0 R 3105 0 R 3106 0 R 3107 0 R 3108 0 R 3109 0 R 3110 0 R 3111 0 R 3112 0 R ] >> endobj -3028 0 obj << +3088 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [200.892 754.224 339.46 764.219] +/Subtype/Link/A<> +>> endobj +3089 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [214.998 724.825 270.445 737.727] +/Subtype/Link/A<> +>> endobj +3090 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 698.333 185.672 710.022] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> +>> endobj +3091 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 752.53 277.612 764.219] +/Rect [205.528 671.235 277.612 682.924] /Subtype/Link/A<> >> endobj -3029 0 obj << +3092 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [194.286 725.431 266.096 737.121] +/Rect [194.286 644.136 266.096 655.826] /Subtype/Link/A<> >> endobj -3030 0 obj << +3093 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.149 697.727 308.384 710.629] +/Rect [227.149 616.432 308.384 629.333] /Subtype/Link/A<> >> endobj -3031 0 obj << +3094 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [201.074 671.235 287.733 682.924] +/Rect [201.074 589.939 287.733 601.629] /Subtype/Link/A<> >> endobj -3032 0 obj << +3095 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 644.136 301.672 655.826] +/Rect [213.498 562.841 301.672 574.53] /Subtype/Link/A<> >> endobj -3033 0 obj << +3096 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [214.998 535.137 270.445 548.038] +/Subtype/Link/A<> +>> endobj +3097 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 619.159 182.824 628.727] +/Rect [84.043 510.765 180.096 520.334] /Subtype /Link /A << /S /GoTo /D (StandAloneServer) >> >> endobj -3034 0 obj << +3098 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 589.939 277.612 601.629] +/Rect [205.528 481.546 277.612 493.235] /Subtype/Link/A<> >> endobj -3035 0 obj << +3099 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 562.841 294.415 574.53] +/Rect [84.043 454.447 294.415 466.137] /Subtype /Link /A << /S /GoTo /D (ClientConfig) >> >> endobj -3036 0 obj << +3100 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 535.743 277.612 547.432] +/Rect [205.528 427.349 277.612 439.039] /Subtype/Link/A<> >> endobj -3037 0 obj << +3101 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 508.038 317.354 520.94] +/Rect [84.043 400.251 173.581 411.94] /Subtype /Link /A << /S /GoTo /D (NetworkBrowsing) >> >> endobj -3038 0 obj << +3102 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 481.546 277.612 493.235] +/Rect [205.528 373.152 277.612 384.842] /Subtype/Link/A<> >> endobj -3039 0 obj << +3103 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 454.447 301.672 466.137] +/Rect [213.498 346.054 301.672 357.743] /Subtype/Link/A<> >> endobj -3040 0 obj << +3104 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 429.47 237.551 439.039] +/Rect [84.043 321.077 237.551 330.645] /Subtype /Link /A << /S /GoTo /D (passdb) >> >> endobj -3041 0 obj << +3105 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 400.251 301.672 411.94] +/Rect [213.498 291.857 301.672 303.547] /Subtype/Link/A<> >> endobj -3042 0 obj << +3106 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [205.528 264.759 277.612 276.448] +/Subtype/Link/A<> +>> endobj +3107 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.149 372.546 308.384 385.448] +/Rect [227.149 237.054 308.384 249.956] /Subtype/Link/A<> >> endobj -3043 0 obj << +3108 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [194.286 346.054 266.096 357.743] +/Rect [194.286 210.562 266.096 222.251] /Subtype/Link/A<> >> endobj -3044 0 obj << +3109 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 318.955 277.612 330.645] -/Subtype/Link/A<> +/Rect [214.998 182.857 270.445 195.759] +/Subtype/Link/A<> >> endobj -3045 0 obj << +3110 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [226.983 291.251 320.975 304.153] +/Rect [226.983 155.759 320.975 168.661] /Subtype/Link/A<> >> endobj -3046 0 obj << +3111 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 264.759 286.869 276.448] +/Rect [84.043 129.267 282.566 140.956] /Subtype /Link /A << /S /GoTo /D (groupmapping) >> >> endobj -3047 0 obj << +3112 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.149 209.956 308.384 222.857] -/Subtype/Link/A<> +/Rect [205.528 102.168 277.612 113.858] +/Subtype/Link/A<> >> endobj -3048 0 obj << +3087 0 obj << +/D [3085 0 R /XYZ 85.039 786.531 null] +>> endobj +3084 0 obj << +/Font << /F41 3054 0 R /F15 3032 0 R /F38 3057 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3121 0 obj << +/Length 1328 +/Filter /FlateDecode +>> +stream +xÚíZQsâ6~çWðhÏ%K¶4Ó馗»æ®3i }¹ÞƒðÅØT8—æ~}µ’lØ$@Úãf˜Ì°Œ´ÚïÛoWkp7Ð¸Ë +BÑy„Xˆ»£Y'èNôÈ›vwÝ^€BÁaìï·Aw¬ï¹ìØ‹÷ú}€°ÝY‡²1ºÏYgÐù½žÅŽÑn=Õú2½êŽ^ ÎiÓ=8Ba¤ç€±Ÿ‡WT_ DwxcîŽ?x8ö?/;¯‡õ7¢ŒÙ/®O +C«sbÖ0ç©’lì÷Â0Ôó³ÀÇÞ¥ô{ØSúzЗ°K6<ôÉÌ'±÷IHP¡&ë+ÄJûÀLûÈÌjÚŸÖ¿Þ#„˜ ôHŒ‹¡ÓvÚ7[í¼H3m™ñÙÖU¿¤ªº2* õ`¯&¹¾è<=˜Âf”„OÔ;à^¹€×…s7¼/rŸp¯$Šl±n8 4çÚ ~¯µ»ÇźËÛ­¾EöÿÐç¡Wson¼aöž4°N‡wLâ6Ò Š&{pnêá•šr°ø ¼ÿ)AÚ†&ÚÚ¯xÚa‹£UÚ@RIuŽ¼gY–ú†œ†•›xÄQÎÚðà‰x8€I-mHDqÌ@‚k(#|¬Hd3‰k-šhQyák³½"ýÜŠQ$Zƒa¾O”,MÂÞ“è輲ʳÐY[k; ®}Ì‚±U÷`03Ÿ˜Tµ¡í:ûDa¼ª‚{i;Èt’;õ¾–F¯ µô÷÷Fà‰[}9Í'›‰0n§B¯=©Áq©8©Á·Vƒ-ÍOeÍ©¬Ù ×A:²z~], ,š½›@D!¢„¶csßÎ@H•ŽZ®«_ûÚ¢é\¿ ›Tf ëóS,„­ëÙ.)p GwÊfXwvY9Žmø%Ú$OmˆIl-ÚlEA{°ñU…z>¦_À›…ÊLÊéç•a¥üg^wÍFæ\–›lbHÐâ0Äëñ]òëÛbQ¦U-œØ¿¥#]Ô7eÕÿ×9%!¹+¥k=ê$ ¥œÙ÷¥’îj‘/5qKMtÙÒÞÒöw£ÇÉCÈÆ©ª{GS»áw°ÍÌ#ÆI Ç1]PsÞzã«Òü|.ÖŠÒ¯,ª+nÓÜk’˜ÃzK‚ßeZ>Kû=<Ï+Xé¨*k®ì‰ÙTâin˜d44xn“)øtSàˆ¦€h{®We€¿»ƒ„édðê¦ÒóT¯ÅZ"› ×Þh¤NÄ—[Ù…:·àäi–}HãI~ë³H—vcÙpŽf”Ö1†Êã(£úzÀ¾ÀþÖø›çÏðŸT÷{ïsœÿq5p:DÖ* Vוٔh>·CÔ¦ÆbêŠÛæ‡qv´G Šmþñ†_õˆ> endobj +3123 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 183.464 277.612 195.153] -/Subtype/Link/A<> +/Rect [227.149 751.924 308.384 764.825] +/Subtype/Link/A<> >> endobj -3049 0 obj << +3124 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 156.365 286.339 168.055] +/Rect [84.043 725.431 286.339 737.121] /Subtype /Link /A << /S /GoTo /D (AccessControls) >> >> endobj -3050 0 obj << +3125 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 129.267 277.612 140.956] +/Rect [205.528 698.333 277.612 710.022] /Subtype/Link/A<> >> endobj -3051 0 obj << +3126 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [194.286 102.168 266.096 113.858] +/Rect [194.286 671.235 266.096 682.924] /Subtype/Link/A<> >> endobj -3052 0 obj << +3127 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 74.464 301.672 87.365] +/Rect [213.498 643.53 301.672 656.432] /Subtype/Link/A<> >> endobj -3027 0 obj << -/D [3025 0 R /XYZ 85.039 786.531 null] ->> endobj -3024 0 obj << -/Font << /F41 2994 0 R /F15 2972 0 R /F38 2997 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3061 0 obj << -/Length 2240 -/Filter /FlateDecode ->> -stream -xÚ½ZÛrÛ6}×WèQz0JAÎt2NÓ¦­›Î¤±›—6ŒLËltq)ºiòõÅ•@`¡q'™Ìزx²{°<»X\ð2ãÿð²¢(#õ’U%¢/7ûE¶Üò'?.°FdË‹ ‘ºÏþ^üñ.[ÞrÌÕB}ù‘ήëå~QP‚hAôß»Åõâ·ÑŠzV,GS¾› ƒ¸ ªªB`Ô³~»TÞXhÍû‚QŠÊ‚ ôw7‹o^bºÄª³zys7NcnnÿX½ìvk¼jׄ«æp+>Õ›v³¾À«cÏŸé¯^×yµÚ¬s¶úÀ¿îÛõ»›«Å7#‰<ËQQK‹ÃlT3TPº¼ÈÊ"#Ç’W<õ8–[cÁFEF–$óg†™O -g%ªhµ´ŒÍIiÌÌ£=ŒsDpîx¼jûv/BòIEéùn×ñàœdô‚Ë7/Iea**ÊÝŠÿýíŒlMQ^å.Yñ ßj„ýÎ :AÛ³)ÿ%^lsyj$÷÷ Z‹—=¡%EŒœBÌ8Cv­÷Ï|GF˜âRX#„Â$÷6 ÂuÖÃäîªÝí[ñî{GHý~»®Èªí"‡ØêØýPFMPY³˜2r\¨Ü²HG…aÀ }Ï¢”ÅD¯’ê Y†JVBq4Ÿˆ3pÏ$’§¡9¨ —ˆ¥49Eâ{ ªÄöxu¼ç!=(mü¤5r#5b¢ÿ KÈÀ?õM@,|°,‹…3£yᲫE£áqø6¥^î×y½.%W¡– -¨%¬D%·EÔ`fLÜzâYS0”ÓÌ„£AIÁ'Áx±<þ $ÑmÔ,ýæx’2á©:FIPÁßRl~© -”çØeŸ_4:Á׳)·}·AýÄ“ÿ¼ä#¸à?j-ö3T¼Oã§36®8+ 4rŽ¤ô̾ÊBGû*ƒ^¯ÛÍcßøx·*½¯u5ïìµ”ab3šk>«ñYmå3IF¬gJéÙ2׳ï1¨gÛãsÞhòÊÖ~TŠ–¥OJüvÛîv¡z‡QÎH¼Þå(c.W ÜI0LÚ³(¼½èì8ÁóÊ_@0ÂÀøÌŒŠ§hפiÊ[­š&ä1ayhPR€ÃIžÇ°<,_k~tاçGp¾Í§ÎPDÇùÑgœm&QÁ -Uå™5pGK †—?Äx‡¶¿=î›î0¾ÄbÕ?ž³Î‘Ù5ƒH­ãátß=ÈÕ“›"“K˜‰À\l|Í™óµöYcÄÊD‡h@É ˜Œày g€åñ«e€ÍþŒ €ÆáÛ|r2Àc΋I, -Þ¾”%caâ‚1 ”` ‡£`|AÁØß4wÍNw<¼ŸE¼7òg+c/:‘®ùJŽJ…7”„¸¬¡(4Ìß·)﻽ )ê@?®…Ï%¸Qasy¦¢äF=G8Ç:Jf4»UEš¿Fä‡-€cJ#*J+mÂJÓ ¤Ò‡“Ò¬iÉ{ÚÛ6tÔ&vQ¡ÌŒÊì¸Í¶‰?¯ T3¸¥µ0q‰PJ"ÃQ"¾Ç Dl?¶}³Ó“è·x¨¯Æ±ÿ$;-ùðEÓmP Οc£’Éó -á¢téÇ»†âÛTm/(J®€ˆà[Áñ4˜ ¯©u-r)O¬s·‹,t´VŒ¬•¿¿¾ÖY.^[§J¤¾j ºQ -ÔÅ”„.Ò:È¢JPÊ4)Ù‰Þ\Š8ßæÓ÷™ hŽûL>—à>“Íå I—ù¢"gNè::¡̸ÿÓ胢h¿ßéåþÛ—ü‰žì徯íHçÚ[™¦‚2‘\.T{ÙjÚ†k2&\²UâÖ‡%3h2dç1œA–ǯA6ï32oódÍ)ƒ<.á ²¸Ä&pœ‰û‘%,– ˆEƒ’bNbñ<†ÅbyüZ'†ûô‰!8ßæSO ¡ˆŽ'†>“à‰¡Í$zK•¯Û*xs~‚·T&yK5îmº¥êº ßRÜÝtzÿõµõq´B"dTî8oÂcb®ý>ý&¼uÊŠê*r¶L ás]eȈQ”>_q;€ò™aNø?Ø»&endstream -endobj -3060 0 obj << -/Type /Page -/Contents 3061 0 R -/Resources 3059 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2965 0 R -/Annots [ 3063 0 R 3064 0 R 3065 0 R 3066 0 R 3067 0 R 3068 0 R 3069 0 R 3070 0 R 3071 0 R 3072 0 R 3073 0 R 3074 0 R 3075 0 R 3076 0 R 3077 0 R 3078 0 R 3079 0 R 3080 0 R 3081 0 R 3082 0 R 3083 0 R 3084 0 R 3085 0 R 3086 0 R 3087 0 R ] ->> endobj -3063 0 obj << +3128 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 752.53 203.49 764.219] +/Rect [84.043 617.038 203.49 628.727] /Subtype /Link /A << /S /GoTo /D (locking) >> >> endobj -3064 0 obj << +3129 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [194.286 725.431 266.096 737.121] +/Rect [194.286 589.939 266.096 601.629] /Subtype/Link/A<> >> endobj -3065 0 obj << +3130 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 698.333 301.672 710.022] +/Rect [213.498 562.841 301.672 574.53] /Subtype/Link/A<> >> endobj -3066 0 obj << +3131 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 671.235 277.612 682.924] +/Rect [205.528 535.743 277.612 547.432] /Subtype/Link/A<> >> endobj -3067 0 obj << +3132 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [183.225 644.136 281.096 655.826] +/Rect [183.225 508.644 281.096 520.334] /Subtype/Link/A<> >> endobj -3068 0 obj << +3133 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 617.038 162.127 628.727] +/Rect [84.043 481.546 162.127 493.235] /Subtype /Link /A << /S /GoTo /D (securing-samba) >> >> endobj -3069 0 obj << +3134 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [201.074 589.939 287.733 601.629] +/Rect [201.074 454.447 287.733 466.137] /Subtype/Link/A<> >> endobj -3070 0 obj << +3135 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 562.841 277.612 574.53] +/Rect [205.528 427.349 277.612 439.039] /Subtype/Link/A<> >> endobj -3071 0 obj << +3136 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 535.743 241.278 547.432] +/Rect [84.043 400.251 241.278 411.94] /Subtype /Link /A << /S /GoTo /D (InterdomainTrusts) >> >> endobj -3072 0 obj << +3137 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 508.644 277.612 520.334] +/Rect [205.528 373.152 277.612 384.842] /Subtype/Link/A<> >> endobj -3073 0 obj << +3138 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [202.437 481.546 289.703 493.235] +/Rect [202.437 346.054 289.703 357.743] /Subtype/Link/A<> >> endobj -3074 0 obj << +3139 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 453.841 301.672 466.743] +/Rect [213.498 318.349 301.672 331.251] /Subtype/Link/A<> >> endobj -3075 0 obj << +3140 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [209.407 427.349 317.339 439.039] +/Rect [209.407 291.857 317.339 303.547] /Subtype/Link/A<> >> endobj -3076 0 obj << +3141 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 400.251 370.612 411.94] +/Rect [84.043 264.759 370.612 276.448] /Subtype /Link /A << /S /GoTo /D (msdfs) >> >> endobj -3077 0 obj << +3142 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [189.589 373.152 278.4 384.842] +/Rect [189.589 237.66 278.4 249.35] /Subtype/Link/A<> >> endobj -3078 0 obj << +3143 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [205.528 210.562 277.612 222.251] +/Subtype/Link/A<> +>> endobj +3144 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 346.054 212.43 357.743] +/Rect [84.043 183.464 212.43 195.153] /Subtype /Link /A << /S /GoTo /D (printing) >> >> endobj -3079 0 obj << +3145 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [179.68 318.955 266.218 330.645] +/Rect [179.68 156.365 266.218 168.055] /Subtype/Link/A<> >> endobj -3080 0 obj << +3146 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.149 291.251 308.384 304.153] +/Rect [227.149 128.661 308.384 141.562] /Subtype/Link/A<> >> endobj -3081 0 obj << +3147 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [205.528 102.168 277.612 113.858] +/Subtype/Link/A<> +>> endobj +3148 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 264.759 266.399 276.448] +/Rect [84.043 75.07 200.642 86.638] /Subtype /Link /A << /S /GoTo /D (CUPS-printing) >> >> endobj -3082 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [179.68 237.66 266.218 249.35] -/Subtype/Link/A<> +3122 0 obj << +/D [3120 0 R /XYZ 85.039 786.531 null] >> endobj -3083 0 obj << -/Type /Annot +3119 0 obj << +/Font << /F41 3054 0 R /F15 3032 0 R /F38 3057 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3158 0 obj << +/Length 1443 +/Filter /FlateDecode +>> +stream +xÚíZÛrâF}ç+xÌj4ºŒR©xmoj³v9†Ý§{N·¡]~h—;Äd~×ã.qíN²ŽÙÁò®CÕf·oæs´ýÕùüÅì†ðÌûŽ¼yŸMB}¿›ul‡Çfê:íŒ:¿¯F‘6»»jsš~ýDŸ™„s[÷ u sa ´Œ;oÎm¸gßô»ã©xf~6þ4©×û2~ß9¯Þtˆí8òÅÍAÑ´>&u4cþ¶ìQ£¬z}Ƙq5…‹¨×§Fs9âæ{sÎøÚ«ŽO¸ç«÷Þ\Ë·"ï”±2]¿Û²Ù¦›FbâhÂEÏzŽk$Œ6'á6xtcÛbè,´ú—Í×û””Üêö-˜zØ^’·É¼„í'A.Qù”|Oªd©Aƒñ¸Ó†gÄ÷vâm=5ñM‚” Ek ,x:R‹P‹®é˜zô,nÜ Âe/ÀB›ú.¼\è€ï£4QTJ¯‰²Ç™•yуeEòU©Ïˆ+PÓBJMKðvgP¿>. `]YVp¸Òaë®ÏòockQ‡¸Ì[Niƒ­Ê[·:ª0wLpƒ2ܤúß6>ƒe$±Èpˆ©ž +ï,‡àZ´dè×ÖƒL#ÿGnáÑ¡åˆâC@Bò«‚f, ©4_à§JN#8žÕŠ‘o‹îÑmÏò +ÀÁÉ3 ØV€<üJŸq +û”8ž{˜á3N2™5®Ð!EU)\4zÈSSéõCü=äP5—áY­Â³šî öÀyî3@-f”Œðœ¨S5FȨÀȘàHÞÁÃ¥(“8ÉÑA©¼y7Õdr›PS –írŸ ‡èľ²l_ôb†Q#袖s}6<½€å鵌mÜta0L£‡ ëº@%'…Øc¿îVŸ¾É€ADDÂx(P¹õú~((yTUÎäRp?xþqc"’¬¸–I¡r$SQ*É}]DÕw‘·¥þ¹Ý€ ‘ù(KT*€¦EYK"ðÇ2­0ææµfʤ›ÐaË4jwøh#‹ì¢Ùþ¢@–½| êõmÛ6>.Ö¼˜Ê¿§E$j·C‘&ÅR¼\5Ùå¢lÖ&Þ”õxúl;}R¡Ô3&A‘I!ò1J‚`ÙT†œpÊŸ¡Ù@Zšì@cn(ò`ÝKh„Z•zGiª“hT¥&}}îÏá{€S"&0ç@H°]¤As]ï9ˆP¨øaêƒË ˆUæ[fYGy¢«f@fR§½š1wÇ Žª<ˆe`‘غb2û&)vMDz‚piLèwGɦ+¯­µòú²¨09#-Wù|„„HÁ–-‰›ÉFÎaÖ°ëU’Œ·bQ)iÕÚe¢žhÚƒÔâÒ=J"Q‚«jLN?¨½*$Î|!´CQ)²¤F€Jî]Ï2ÂmÿØózÝ~ì6¼‚nÃ.uÞ‰nb¾ª?CéÆËH:N´6±*U‘q!ž baÏ"!¢ªfä4y÷¸fe}½-¬êEØ´=Ô_˜I£oõÑQEJå ¦„ͪ #ÿ3'˜…ª"™Ôýó–Ž5óÄ)ÑB(e=ê?D¨SY—Ï0ysE˜²ˆlõŸ äØ…è@:õ[[:b\I(={ømØÚíìqŽìy{vî½\õ¸m /ú'¢˜\ÔÇÚiò(l>/«Ú4\V«Î’l½È¤àÃI‘7Hå›m„Ë‘LN¦ÃAå±é‰_¹>‚<d6Óâ«r[_wØÓ‘mïä"äõªèa¾ê +,u«,š©Ö\ïÍíQp0J˜iwû¶E<ÇÖÉâWüg~ÃÉqÓ=X»[ž" +þˆ$}endstream +endobj +3157 0 obj << +/Type /Page +/Contents 3158 0 R +/Resources 3156 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3183 0 R +/Annots [ 3160 0 R 3161 0 R 3162 0 R 3163 0 R 3164 0 R 3165 0 R 3166 0 R 3167 0 R 3168 0 R 3169 0 R 3170 0 R 3171 0 R 3172 0 R 3173 0 R 3174 0 R 3175 0 R 3176 0 R 3177 0 R 3178 0 R 3179 0 R 3180 0 R 3181 0 R 3182 0 R ] +>> endobj +3160 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [179.68 752.53 266.218 764.219] +/Subtype/Link/A<> +>> endobj +3161 0 obj << +/Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [195.286 209.956 282.157 222.857] +/Rect [195.286 724.825 282.157 737.727] /Subtype/Link/A<> >> endobj -3084 0 obj << +3162 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 182.857 301.672 195.759] +/Rect [213.498 697.727 301.672 710.629] /Subtype/Link/A<> >> endobj -3085 0 obj << +3163 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 158.486 198.672 168.055] +/Rect [84.043 673.356 198.672 682.924] /Subtype /Link /A << /S /GoTo /D (VFS) >> >> endobj -3086 0 obj << +3164 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 129.267 301.672 140.956] +/Rect [213.498 644.136 301.672 655.826] /Subtype/Link/A<> >> endobj -3087 0 obj << +3165 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 102.168 277.612 113.858] +/Rect [205.528 617.038 277.612 628.727] /Subtype/Link/A<> >> endobj -3062 0 obj << -/D [3060 0 R /XYZ 85.039 786.531 null] +3166 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [177.255 589.939 256.309 601.629] +/Subtype/Link/A<> >> endobj -3059 0 obj << -/Font << /F15 2972 0 R /F41 2994 0 R /F38 2997 0 R >> -/ProcSet [ /PDF /Text ] +3167 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 483.667 253.278 493.235] +/Subtype /Link +/A << /S /GoTo /D (winbind) >> >> endobj -3097 0 obj << -/Length 2128 -/Filter /FlateDecode ->> -stream -xÚ½ZËrÛ6Ýë+´”Bˆ r¦Ó±š¤MܺMc·]´]Ð#+–D—¦ã¸_ß‹I@ŽfêÉ4UÈ3÷yÎÏ#øƒçiŒ"šÍyš ˜âùÍaÍ·pç‡Öˆh¾ŠÍRqïŸÙŸGó `ÎgêâüŽβùaÆbŠbFõ¿÷³ËÙ¯­uÍ[S¶›UƒXÑ¥)sbt´+Ç(a\`¾»š½úžá9ŽPeó«Oð #ÑyºÚü¹ø+Â|ù÷ÕùìíUk G Jãtn8l086=b‚(&=—»%^–+¼(—+JéⲬàʸR¨+EqTV»íî7ò½ºøåÓƒ(! b›†Aáî6¬[á„ÉP’±^BwK’ŠÐñB‡úñíúÍ„þÁvÐ ±H -]ÍÂÝì0njÐh7»nZÝÝ4<®÷Å×ü¸YbU€Jà»RÖ¤}i=‹›Lvð“œÄ(K¸ûé Ö¶Â9’$C„õR<u^çû;¥Hˆ éÜ<ˆŒC-ŠÃn!+ÌhýÞºööݹ»Û¹»¬›¾~}:ª -\õ¿âÚ!¿Y¾¸µz/ÚûÛ=Tˆ/6y­ý©Ôw‚ûZ û}¡qP¥}ÜceM8C4&" u§ÚÎÕŽ -èaΖEIèÍ—eœˆd›™´Q‘ÿ,“¬EüO’Ò•fÄ…Äæ[yÿPÅÍzÀd!ãÅgØ&*8%@UŽ"ÏbЦÅ8"1 3§QÇ0æçŽíÑIÓãy)¨¡Ió©ÿ_-SÚÐð j -ÿÊEp¯¾§i¿=œpˆC˜ûfPRˆ,­ö¢7ª­F˜|hÐáÓk·‡ZHâYÝÿE´TD¸N«#Hºi¸w(€ ž¦Ó€aEå#oxШ:cXÝ -0<¾˜Ìè'( ”‡mód*Ú)ÀŠÄ­#Ÿ°øÖ$Å` ½ -h0r‹|¿½Ê7æó¤x¯[•ýhh<®úª®Ö¥‚ZŽ+QF*ê¡hP¿4‹Ÿâ°|CQ„'hã8C,Ù(5 1•Æü*±=:UbzüÿwÕ½¸ÇwÕÁ l›§ïªCÕlwÕv,Î]µ‹W!*?ò ” EƒFÉpØ‘Åòè&‹áñ¥Fj/úñ‘ÌöyêH U´©v$ΑjFâ%L#âyéҦãA£„ 8ìcytÆðøCQåûM÷} ”ø¼¥Jõ,?–‘7_çU]T®'2ظÀs«—1$E˜%ýðýŒÑèp"¶M5d*òs;_ÄR‚œóâMÃõl0ƒ0¬ùÒ·¢ ‡ˆÓ©'TØ»þjˆpy!ö™ò8·ÔÂ7Ö^¶øùŠé/'Þ¼6×]kU–‹nó‰^Önd«ÆÚà†*ƒ0i"ŽaŸêþFþ£Ó>¸ }Új¼rCYêy¿SŠ0Içâ¦júÄ%ÞxÆ°4hŒð1*= -endstream -endobj -3096 0 obj << -/Type /Page -/Contents 3097 0 R -/Resources 3095 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3122 0 R -/Annots [ 3099 0 R 3100 0 R 3101 0 R 3102 0 R 3103 0 R 3104 0 R 3105 0 R 3106 0 R 3107 0 R 3108 0 R 3109 0 R 3110 0 R 3111 0 R 3112 0 R 3113 0 R 3114 0 R 3115 0 R 3116 0 R 3117 0 R 3118 0 R 3119 0 R 3120 0 R 3121 0 R ] +3168 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [177.255 454.447 288.066 466.137] +/Subtype/Link/A<> >> endobj -3099 0 obj << +3169 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [201.074 427.349 287.733 439.039] +/Subtype/Link/A<> +>> endobj +3170 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [211.316 399.645 320.915 412.546] +/Subtype/Link/A<> +>> endobj +3171 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [183.377 373.152 299.884 384.842] +/Subtype/Link/A<> +>> endobj +3172 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [213.498 346.054 301.672 357.743] +/Subtype/Link/A<> +>> endobj +3173 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [205.528 318.955 277.612 330.645] +/Subtype/Link/A<> +>> endobj +3174 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 671.235 241.218 682.924] +/Rect [84.043 291.857 241.218 303.547] /Subtype /Link /A << /S /GoTo /D (AdvancedNetworkManagement) >> >> endobj -3100 0 obj << +3175 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 644.136 277.612 655.826] +/Rect [205.528 264.759 277.612 276.448] /Subtype/Link/A<> >> endobj -3101 0 obj << +3176 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 617.038 223.884 628.727] +/Rect [84.043 237.66 223.884 249.35] /Subtype /Link /A << /S /GoTo /D (PolicyMgmt) >> >> endobj -3102 0 obj << +3177 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 589.939 277.612 601.629] +/Rect [205.528 210.562 277.612 222.251] /Subtype/Link/A<> >> endobj -3103 0 obj << +3178 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 562.841 224.612 574.53] +/Rect [84.043 183.464 224.612 195.153] /Subtype /Link /A << /S /GoTo /D (ProfileMgmt) >> >> endobj -3104 0 obj << +3179 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 535.743 277.612 547.432] +/Rect [205.528 156.365 277.612 168.055] /Subtype/Link/A<> >> endobj -3105 0 obj << +3180 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 510.765 274.369 520.334] +/Rect [84.043 131.388 276.036 140.956] /Subtype /Link /A << /S /GoTo /D (pam) >> >> endobj -3106 0 obj << +3181 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 481.546 277.612 493.235] +/Rect [205.528 102.168 277.612 113.858] /Subtype/Link/A<> >> endobj -3107 0 obj << +3182 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [209.407 454.447 317.339 466.137] +/Rect [209.407 75.07 317.339 86.759] /Subtype/Link/A<> >> endobj -3108 0 obj << +3159 0 obj << +/D [3157 0 R /XYZ 85.039 786.531 null] +>> endobj +3156 0 obj << +/Font << /F41 3054 0 R /F15 3032 0 R /F38 3057 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3192 0 obj << +/Length 1197 +/Filter /FlateDecode +>> +stream +xÚíZKsÛ6¾ëWðHãE˜Ét¬8w’:±Z’h“‘˜PdBÓvÝ_ß]€zX$Kv&l«ñÁ v `w¿}b…?æ(ŸP¡PÄ̹˜ ¨3Êá€ÕÔR"´BÚ·ÁûÔ‰çx`'o`L ÓÚ™ ¤/ˆ/Eýœ No«XštK­o3œs %JIä±´râØÁ»ÃÁóñ`ï%óF‰¦Ú2„qüÞ}•{\¹U2)£*Í=æN¼¡Ò} ÃS +÷ÌÌÇ2Þ\Zò›¤òxèÞà\Q~zM¸I«©}í4š!õ<ò>Ž¿ŽGæ\àS›"¨†‚P±õ-á(2¬^ÿ69óÒÄj,Êã¥êŠìzµ›o À'¦šÄ‰Ì oÖ¼ ‚øÏüÎkÄšún?Ä´@ÃöC> endobj +3194 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 427.349 311.975 439.039] +/Rect [84.043 752.53 314.096 764.219] /Subtype /Link /A << /S /GoTo /D (integrate-ms-networks) >> >> endobj -3109 0 obj << +3195 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 400.251 277.612 411.94] +/Rect [205.528 725.431 277.612 737.121] /Subtype/Link/A<> >> endobj -3110 0 obj << +3196 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 372.546 171.642 385.448] +/Rect [84.043 697.727 171.642 710.629] /Subtype /Link /A << /S /GoTo /D (unicode) >> >> endobj -3111 0 obj << +3197 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 346.054 301.672 357.743] +/Rect [213.498 671.235 301.672 682.924] /Subtype/Link/A<> >> endobj -3112 0 obj << +3198 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [205.528 644.136 277.612 655.826] +/Subtype/Link/A<> +>> endobj +3199 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [242.225 318.955 366.036 330.645] +/Rect [242.225 617.038 366.036 628.727] /Subtype/Link/A<> >> endobj -3113 0 obj << +3200 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 291.857 213.218 303.547] +/Rect [84.043 589.939 213.218 601.629] /Subtype /Link /A << /S /GoTo /D (Backup) >> >> endobj -3114 0 obj << +3201 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 264.759 277.612 276.448] +/Rect [205.528 562.841 277.612 574.53] /Subtype/Link/A<> >> endobj -3115 0 obj << +3202 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 237.66 208.824 249.35] +/Rect [84.043 535.743 208.824 547.432] /Subtype /Link /A << /S /GoTo /D (SambaHA) >> >> endobj -3116 0 obj << +3203 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 210.562 277.612 222.251] +/Rect [205.528 508.644 277.612 520.334] /Subtype/Link/A<> >> endobj -3117 0 obj << +3204 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 183.464 290.036 195.153] +/Rect [84.043 481.546 290.036 493.235] /Subtype /Link /A << /S /GoTo /D (upgrading-to-3.0) >> >> endobj -3118 0 obj << +3205 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 156.365 301.672 168.055] +/Rect [213.498 454.447 301.672 466.137] /Subtype/Link/A<> >> endobj -3119 0 obj << +3206 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 129.267 277.612 140.956] +/Rect [205.528 427.349 277.612 439.039] /Subtype/Link/A<> >> endobj -3120 0 obj << +3207 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.149 101.562 308.384 114.464] +/Rect [227.149 399.645 308.384 412.546] /Subtype/Link/A<> >> endobj -3121 0 obj << +3208 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 75.07 296.399 86.759] +/Rect [84.043 373.152 296.399 384.842] /Subtype /Link /A << /S /GoTo /D (NT4Migration) >> >> endobj -3098 0 obj << -/D [3096 0 R /XYZ 85.039 786.531 null] ->> endobj -3095 0 obj << -/Font << /F41 2994 0 R /F15 2972 0 R /F38 2997 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3135 0 obj << -/Length 2036 -/Filter /FlateDecode ->> -stream -xÚ½ZMoÛ8½ûWøhÌŠ¤$RÀb‘´Ý¶`w»‰±=´=8¶k»µ­¬ì´È¿_õEQäPð"EQD_f‡o†"GêË„D< ™’„Óñò0ŠÆÕòvD+D4žE„gÚþ}üW -s3*_þPÏ¡Y6>Œâ„“$æÕïûÑÝèïÆJÙS¶›Y˜ñˆH;1Û™H’Æ0/ç£ob:¦É¢l<ÿ¢ž(‰#>®AóÕÇɧˆŠéçùÍè·ycF)‘‰ÆzkLÏ#ML”NYÇãM¾ÒÉq:ãœOÞ‘òç|*ùd=ÑI¡NðtVOÅȽxÃ¥aUuV0¡x€¹_löL1KXÜe ŦBÜý¨Ñx?l›àøëvʲÉùJs]¦LNîDq΋M“HIª,b­1=&¾Û–€É¯¶»Z»L*ád`¨lQ(n]ÒiÑýXÁë݇©ÞÉ5ŒÜ¼Åüˆ'óíº|¸›–‘“{x*_~˜Ê¸êûò¯®Wªñ°;îNçbƒ¾Ë†*òéL…6ßÛä‘ ,af/û1eŒ0Ê!¸$Ê2½«¡‚â -i1ˆD*PP#ˆÃV$–G·J ÏS;\ƒå%mY¼¼bñkÊ¡MÅYM.^y0 =tah ½å°Æ€×÷ÐãÆ鼸ßéç3¼zꉇ§$æܤÓë|B ¸d™Z7ŠÀb°…mó Úöè´éñùë^‡w¸ð¡=°m^^ú°h6µÏæâ,~&Ÿ¼Y*ˆé@yh¯¼kŒþ8Ù=lÎsø<¶]W#û -bôû›;ø•‹ :vG0p>¹Î¼2*Mþ}íÅ\µeÃ"ŽˆsÄLˆÖ’–GwBBB˜¼$ÖÛæÿH$šmBX\Ü apñ&U¡ø¡³AÄR‚bA¶b±<ºÅbx¼ÙJuü±|óÇÍÖµ`úœÝ»àúËq‡ ²(Ñ8UÛ¦VÅa¹ºz¬?µÈüûYæ‡þ #<æhÄjL†µèZjaG–Êh 8»ÿ ¶%/˜>³wë‡ÂM%ITí-¨5ÆQPõòa]|Ñ+ýÁEêº6.'<ÂÛݱ¿¤¢‚pµš0hô5È•ºø°eœXÅ’ã‰QƒB‰aó'†íÑ™¦G²ÈmoÌ>eíÔŸý·…>­\»ŽSÕ|B¥ÿ85ÖW:¼‘ãÔèe?”ì—W«3\F!§rû|&0ÈÛÖoýbJ ECZ"zt¬BjZÁʨVMà–œAÔR‚jA¶j±<ºÕbx|þ9·Ã;<ç¢=°m^>çbÑlæ\›‹sÎ5¹xÅ%„>ÝD,((Äa+Ë£[,†ÇŸu9¬Ã>|; í‡móÒûaXD› b6ç 1“‰÷J¥$T½Ñ‚ý*Kˆþºöç]½Y³‰òùõ»WïÍÙš”¾âÍ£ÉsuU’MÞ>îVzçb‡)MHjÐvÜyˆH’Â5cµ&s_>Rÿy}Åòò‹ÎÆ7,’IÏW¼„sµð‘cžèCˆ‹´»\5 Tƒð™#§endstream -endobj -3134 0 obj << -/Type /Page -/Contents 3135 0 R -/Resources 3133 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3122 0 R -/Annots [ 3137 0 R 3138 0 R 3139 0 R 3140 0 R 3141 0 R 3142 0 R 3143 0 R 3144 0 R 3145 0 R 3146 0 R 3147 0 R 3148 0 R 3149 0 R 3150 0 R 3151 0 R 3152 0 R 3153 0 R 3154 0 R 3155 0 R 3156 0 R 3157 0 R 3158 0 R 3159 0 R 3160 0 R 3161 0 R 3162 0 R ] ->> endobj -3137 0 obj << +3209 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 752.53 277.612 764.219] +/Rect [205.528 346.054 277.612 357.743] /Subtype/Link/A<> >> endobj -3138 0 obj << +3210 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 727.553 308.248 737.121] +/Rect [84.043 321.077 300.975 330.645] /Subtype /Link /A << /S /GoTo /D (SWAT) >> >> endobj -3139 0 obj << +3211 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 698.333 277.612 710.022] +/Rect [205.528 291.857 277.612 303.547] /Subtype/Link/A<> >> endobj -3140 0 obj << +3212 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 673.356 184.278 682.924] +/Rect [84.043 266.88 187.611 276.448] /Subtype /Link /A << /S /GoTo /D (diagnosis) >> >> endobj -3141 0 obj << +3213 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [201.074 644.136 287.733 655.826] +/Rect [201.074 237.66 287.733 249.35] /Subtype/Link/A<> >> endobj -3142 0 obj << +3214 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 617.038 301.672 628.727] +/Rect [213.498 210.562 301.672 222.251] /Subtype/Link/A<> >> endobj -3143 0 obj << +3215 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [182.74 183.464 259.066 195.153] +/Subtype/Link/A<> +>> endobj +3216 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 589.939 271.763 601.629] +/Rect [84.043 156.365 277.187 168.055] /Subtype /Link /A << /S /GoTo /D (problems) >> >> endobj -3144 0 obj << +3217 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [227.149 562.235 308.384 575.137] +/Rect [227.149 128.661 308.384 141.562] /Subtype/Link/A<> >> endobj -3145 0 obj << +3218 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 535.743 301.672 547.432] +/Rect [213.498 102.168 301.672 113.858] /Subtype/Link/A<> >> endobj -3146 0 obj << +3219 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [192.225 508.644 292.187 520.334] +/Rect [192.225 75.07 292.187 86.759] /Subtype/Link/A<> >> endobj -3147 0 obj << +3193 0 obj << +/D [3191 0 R /XYZ 85.039 786.531 null] +>> endobj +3190 0 obj << +/Font << /F15 3032 0 R /F41 3054 0 R /F38 3057 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3231 0 obj << +/Length 990 +/Filter /FlateDecode +>> +stream +xÚíZßoÛ6~×_¡GéÁR¤$†¬É’,ÀÖ.6öÒõA±U[mu²ŒbÿýîH:ulÉ‹ênÓ0!¡yüq¼û¾»#!î3ü㾊 í§*Xpºò˜?GÉ­ÇÝæ­Hö»÷öóg8æÞ³Ÿ°Í€kí¯< ˆ¥p¿—ÞØûùi+“þÓR‡ÛŒv#F‚R²i O@$¸É^M¼‹‰} 4Óþä½3™½ ~e< ßMî½ï'O3cql'.J¢ý5yÜ°æu¶GBˆ`ò`‘gUŽxPÑ67BíÍH"ÐÒÍúæP”ƒŒäNê©æNôp{bûnσËM¶ +£4xÌ•Õühy BÈçÇ4‹>Óp·è·‡ÓG<ˆlD)0ë&+C-m㤖Æ(CœŽÚÕ*¹ž[³½"É;曥µlvÍÈʬ:º_ˆ¸/t>{¼;°ÿ'¡ƒZbC­[UÖ€¤^¥mPÑ"u‡Ê‡Eé F¬Ðæˆu/ íÊÏÀ‹æ§É>^zä |¹r®0¾yp>úÅø¨Z—§Å‡×h‰nu gpõ%¾ù¬Ò ØŒ!yo—îÞ‰x ‰HûéïÖ3âEþ‰œ"-qÈ*Ålž/—MlᥢÍ%JC«î©+ŠR¸ç¥ájvš/JB’¤gx„qÄ•Úh]âë]IÚ9‹Õ¥…óU¹²Qm·Ì­Œ’”µŽðËm˜oŽ¹;é@êþ“zȉCN¢n§¨Û¹ª}CÊ•d¥:{,–¤yM]9‡ãݦ­’uÂ~Òvª=®”† ÚT»Px¼‹0ÖxFAÓxM\^äöW?ÐAn°oì:–E¾¦‰õÑ¥•KÝ~kuÂë×®ŸÉuÝ÷wÀÿÁ`øQ¬¬ùœ^—ër;_4Q :Iþ…XMg—ô‚iøT>®`Š·ïÃ⺓¶äH#þdƘ½&´]DØä Õ-:œÉ¯”M±›WïM½k ê¦ÔÊ÷ÂÑ–z‹õú¸ˆŽá÷[NÚKj›£gäá¥Kÿth›§D¹Ù$[ç CÎ(®Z¯Ixj&ºCî£Õfz9«)-ÀƸ¡¬Œ¿ØI;Nà HŸ“ `Éðþ3¼ÿ åË?U¹þi¼»¤Ð‰m_ß]½ÙI$BÿÉùÖر.Jcó(¸ÝôÀ“[1ˆ“Ö_'ýï–Äõ¿¦¿(ľ~ÜH7¡’Á¶2™ãYÄÌ K©‘l‚íÜŒ'üÛÀ"ÛÁéá¥é!Ñ bÑü=§-ô™ßsHLiªév‹µÛ@¿ (ü £ªj endstream +endobj +3230 0 obj << +/Type /Page +/Contents 3231 0 R +/Resources 3229 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3183 0 R +/Annots [ 3233 0 R 3234 0 R 3235 0 R 3236 0 R 3237 0 R 3238 0 R 3239 0 R 3240 0 R 3241 0 R 3242 0 R 3243 0 R 3244 0 R 3245 0 R 3246 0 R 3247 0 R 3248 0 R 3249 0 R 3250 0 R 3251 0 R 3252 0 R 3253 0 R 3254 0 R 3255 0 R 3256 0 R 3257 0 R ] +>> endobj +3233 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [182.74 752.53 259.066 764.219] +/Subtype/Link/A<> +>> endobj +3234 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 481.546 160.975 493.114] +/Rect [84.043 725.431 160.975 737] /Subtype /Link /A << /S /GoTo /D (bugreport) >> >> endobj -3148 0 obj << +3235 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 454.447 301.672 466.137] +/Rect [205.528 698.333 277.612 710.022] +/Subtype/Link/A<> +>> endobj +3236 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [213.498 671.235 301.672 682.924] /Subtype/Link/A<> >> endobj -3149 0 obj << +3237 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [201.074 427.349 287.733 439.039] +/Rect [201.074 644.136 287.733 655.826] /Subtype/Link/A<> >> endobj -3150 0 obj << +3238 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 400.251 196.036 411.94] +/Rect [84.043 617.038 199.066 628.727] /Subtype /Link /A << /S /GoTo /D (compiling) >> >> endobj -3151 0 obj << +3239 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 373.152 301.672 384.842] +/Rect [213.498 589.939 301.672 601.629] /Subtype/Link/A<> >> endobj -3152 0 obj << +3240 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [205.528 562.841 277.612 574.53] +/Subtype/Link/A<> +>> endobj +3241 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [201.074 346.054 287.733 357.743] +/Rect [201.074 535.743 287.733 547.432] /Subtype/Link/A<> >> endobj -3153 0 obj << +3242 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 318.955 137.43 330.645] +/Rect [84.043 508.644 137.43 520.334] /Subtype /Link /A << /S /GoTo /D (Portability) >> >> endobj -3154 0 obj << +3243 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 291.857 301.672 303.547] +/Rect [213.498 481.546 301.672 493.235] /Subtype/Link/A<> >> endobj -3155 0 obj << +3244 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [205.528 454.447 277.612 466.137] +/Subtype/Link/A<> +>> endobj +3245 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 266.88 229.915 276.448] +/Rect [84.043 429.47 235.975 439.039] /Subtype /Link /A << /S /GoTo /D (Other-Clients) >> >> endobj -3156 0 obj << +3246 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 237.66 301.672 249.35] +/Rect [213.498 400.251 301.672 411.94] /Subtype/Link/A<> >> endobj -3157 0 obj << +3247 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [205.528 373.152 277.612 384.842] +/Subtype/Link/A<> +>> endobj +3248 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [202.528 209.956 290.339 222.857] +/Rect [182.74 346.054 259.066 357.743] +/Subtype/Link/A<> +>> endobj +3249 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [202.528 318.349 290.339 331.251] /Subtype/Link/A<> >> endobj -3158 0 obj << +3250 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 183.464 218.369 195.153] +/Rect [84.043 291.857 218.369 303.547] /Subtype /Link /A << /S /GoTo /D (speed) >> >> endobj -3159 0 obj << +3251 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [193.619 156.365 302.097 168.055] +/Rect [193.619 264.759 302.097 276.448] /Subtype/Link/A<> >> endobj -3160 0 obj << +3252 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 129.267 301.672 140.956] +/Rect [213.498 237.66 301.672 249.35] /Subtype/Link/A<> >> endobj -3161 0 obj << +3253 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 102.168 277.612 113.858] +/Rect [205.528 210.562 277.612 222.251] /Subtype/Link/A<> >> endobj -3162 0 obj << +3254 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 75.07 266.596 86.759] +/Rect [84.043 183.464 266.596 195.153] /Subtype /Link /A << /S /GoTo /D (DNSDHCP) >> >> endobj -3136 0 obj << -/D [3134 0 R /XYZ 85.039 786.531 null] ->> endobj -3133 0 obj << -/Font << /F41 2994 0 R /F15 2972 0 R /F38 2997 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3174 0 obj << -/Length 502 -/Filter /FlateDecode ->> -stream -xÚ”ÍnÛ0„ïz -©ƒ6\.)’@Qâ¾ÅzIsp×IG©ì ¯R¶(Y -D{³³ËB&üƒÌj䘱9hBv¿KÛúÊ·[…`™r6Ôþ&·w‚=xÍ2iþüçÏÐ9¶K”&ЊÚß/Éä¦wijŠõVq›¬Sd$ÀZ5©iÓfFkÈ• š«"¹X(d(À ÇŠ?þ„ ±NT<Üò_MzW,“ë¢wC‘ƒÕ–˜všQGÔ§Q¡t\–)ò×4#"þšw‘Zâ›4C^ùâÛ>œþT­C¸‹ÙW?¬‘Æçv_âôÒ'ÓR Ó‡Bµm«“9:õü±ghüü˜JÇ—uÖõ.•–ÿ^ƒÏ\VÛQ&“Cîç6ÚiFI³ÇN!É׸]Ç®´ŒšŠß@sXM¡sT9†®‹Ô*þ^Âm¶7W_åjSo¤|×w_Wö# 6S{Ž‘ö+7yØ çæ©`ëO o4Ÿ2ß[Í ?l7Mü±Ýró²,¨eþgÍ|õZ¦~F^>=O îrwuT œ„>Oz+ž9Öœã#¿ÜÒÍyÒIÈýµÍ챓ÄAƒG>s˜“E4ý…Fêøúÿ/t™²à¬œ^œ&”¶ òº8¯&O»¥‰À&VÍendstream -endobj -3173 0 obj << -/Type /Page -/Contents 3174 0 R -/Resources 3172 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3122 0 R -/Annots [ 3176 0 R 3177 0 R 3178 0 R ] ->> endobj -3176 0 obj << +3255 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.528 752.53 277.612 764.219] +/Rect [205.528 156.365 277.612 168.055] /Subtype/Link/A<> >> endobj -3177 0 obj << +3256 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 727.553 172.611 737.121] +/Rect [84.043 131.388 172.611 140.956] /Subtype /Link /A << /S /GoTo /D (Further-Resources) >> >> endobj -3178 0 obj << +3257 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [213.498 698.333 301.672 710.022] +/Rect [213.498 102.168 301.672 113.858] /Subtype/Link/A<> >> endobj -3175 0 obj << -/D [3173 0 R /XYZ 85.039 786.531 null] +3232 0 obj << +/D [3230 0 R /XYZ 85.039 786.531 null] >> endobj -3172 0 obj << -/Font << /F41 2994 0 R /F15 2972 0 R /F38 2997 0 R >> +3229 0 obj << +/Font << /F41 3054 0 R /F15 3032 0 R /F38 3057 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3182 0 obj << -/Length 2685 +3267 0 obj << +/Length 1729 /Filter /FlateDecode >> stream -xÚí[KsÛF¾ëW°rYðÀỸÁ^¶,ÇÎ:e³]>$9À%qC - ÙÑ¿ßîyC‚hʦ"[Š€y4ûûº§{z†ORøÇ'&c©,&¹Ñ,“|r±>I'×ðå›î[¨L²L)x>ðq¾Î´`©Ê¶ñsÌr¡˜2 -ÛœÎOþþZ¤‘2­åd~Ñ H*Ìd~ùSò²®šEÕl§¿Ì¿=y5o M•d©V‡¦œ3JÃT! -ÅSÍLf@ðT±,ç±Tœ³"Ëb©|”ê ›Î87&ùfIµØ”«éLj¼©¶ <ódU6˺Ú;SRL¢ ݧÍõÄ=üÉZÓòí‰ -Ý›ôÏ<äA˜¹f4=CAg‡õÉ™J%nRƹܑ7eEZDú mP\úÔJöšM ŠäÉåÝ…ÕŸUjƒïtžœ—ë÷e_¥Úþ°hNR¥®5-âþ˜V¥ùJ£¡Æ©´µŠ}ax ´šiJ…¡ÊrPÙiy1yòëõHW#ïࡺœÎåeiÚÿŸ*Š}ûk»ÿ±¡{¼É™ÎU«Ö>üq½fQ·>dûc‚?} zL méy[ªëR®eüW=•iòÑ%ˆ!Q|ƒ)’j ûä¼Ä´¿Ï§¸¨mã^ŸcËg§/†RËH¶cRKò§ìiµÌµÜ õÀÔr_˜ÃªSÓë5d–ÿ~o•·¬ÐP«k :Âò -æÛ Ý®Vöŵ‹¶å“R Ü7æ/Ê ÞÆZaÛ‹0‚½é‡=55iK•3¡BÚø²®~†|ѽÛÄ\°è#Ò&y_ºW?§Yj_»· ZÛt¡Fr\Áx›plü¥{h¯Ë±Üèºäˆp"ØÑ—€ 5/Ÿ¥ -˜WJ–sÑò=…úê÷©%1àjá¼ÀqlNiwô -#ÿrÐþ$̽~ÆbÞu#0tO`Þ—€Àœš—kïDʸÞÁœÛýÚÂ~GɯÖÜ£Ý×·ýë¢c€£„ÿ+0äã²¹Á'‘¸í†ms["SÖ˜=<&cöJ l×6R°ƒÀö% €¥æm9ÕL‡½mæÜ=óù»)ç"yÐο¤PúO¢†WãXjtÝjDÔèK@Pƒš7IJpU5G ooîec²¶t†‡Í·ìí5dgÕ>tÄðÃ4ƒ8|is½÷Á Ø:8ç²B óYÀ+k,ºn" ô% @ÍÛ öÛ ½w76Æwè½¹rˆÎñ岺޺×_#ÞÕß|°ønjÀùo~ý'  ù—åA×àA„Áƒ¾¨y[@kã7”ËÛý› ®Ýª.“Whñ›zãö‹$Ä–Ï[º‡â•9– ]7‚ PAú¡æ 9†“~+ 6 ¾+7×> -°îýÎmMg>ÆCÚÔWQü×~ÏCIúvãJŽv{É¥ Ûmæ¦øS‰ ­± èº ˆj} Pó¶ àœåºh²Ì¯ê[ Ÿ_â÷äáEÊD×føíä§_ÒÉ%ˆóíIÊda&áÒÜ¢˜¬O$¹ô­NÎOþÜP³h¬ÒBœq±#m}»r'ª€yîˆÕ¾”B(–üÿ1ÃX´œB–*½#çò¶³ƒ÷¥N^c(æ’¬pŠCå…­Ž(Èž®{ˆ nå®\»·_ÿà¬U3³@ûô¯À£ÛVå% s¹ñ6è>òþË1Ö³lŸÌ4¤ -~Çš…üÕƆ‚ÞÜ?âØ¥^–UUû ¡ÜÚ1˼ö+ÊfñÛßuZ\~„âòó°pQ&Fo#u½†íÛ·¡Í»?ý°uS“ãF±hù—Á¶ç7­s÷ l] 1„{Ī\ûVeåò÷Á/]ºPßág:çÅcGØ©d,Âm/áNÙ½éé¢ì'Îñ - Î3Ú!>T” m¬`¾(ûk²¥-¾ú“»M‰¯6þÏ«z*Ým‘ –1x~z}[6ËEÕ Õb#‘Ž©Å’¿`Lû²AÝvC Œ NdE>¼øD%N(íÅ[¥†Šì÷5n“g¦øœ‚åÇkõŽ5Ó®a§1tÃdêKpÀRa•ÙqWDjÏÉ ¾‰½ÀÖ–Úk ÖõsŒ¹yòaá-ò¥ÍÒm­ff‹we8‹Ÿ'§å—â‹íÐÕ†Ncn6Pbïh:x¯¡ˆ2NˆYÉ» `¾RÑ>‘¬šqÒ'†6(²ò>q_Éói!’û[{Ûƒ™*ç‹‹»M{t÷îÙ Ùð†Äb;ä##ñ‘ä/ÚÓ¢0x”=êøHn8ûÔ™žwu3ÕºÈ׸¥dCŽ²±E„ -D8¼rêÓøª$ži. -ñtÝbPéH·uv‹1\òeNrÞ–&YWCSí™–ó¨ d·)1½¹Ÿâù|âéöL?¯¡Y²>£nY"Ðäà­ˆdÉŽ(|rÕU×T[ø<ß=ãtîn@Xï²´‰/zœµé4úfÈŸ2;Ôƒj Q7‚J;Ôˆ(9oHw¹èêmÈŽ°›ùÖm¢ÒHMŒUw1î3VÝÖ Ç੉jãÞÈ4žýé‰ Í¤¤=uØ ’¸8µÉÆÉôÄ·±× ÓáÓ/a ý9ÿ4477endstream +xÚíš[sÚF€ßùL_*=°ÕÞ$m_:ƱSgLÚ2i'Ƀ 2V’#ä8þ÷=gw%l `ÌÅ—j2ãˆÝEHçÛsöÜhÓƒ´JâqÕ BŸHN›ýqÃkaæuƒÚBr"…€ë“­r¶å3â‰`ѯÙâ!ÒÇÉv¯ñË1óšÌ#¾Ï›½s½¨7øèfi§ÅÄýÜ{Ó8êÝþº`Dùbѽ%!Uæ_ø„v‰wû×)%JÊÛ¿~BÜ¥a輎áÂIã<¹-îûÎI:)àš:£¨H²töñ„ð‡ŸÖ÷7ƒù°i.Þ½^ò‹”ÎÞŠrB%]!è…³Ô'Ôbä.ü¾]rW QžºóP _xé"Ïàý©3¸êë×Ö²(pÌœn4>‹æ%A§O¸Dó?Êæ$Á6‘ÈD]¾'• ßß4€7mG}—Ηaˆ3déÀmÉ€:°HzÞüB©Í=î×7»õ,næ,Ü®sØ3˜ÇnÖܹãüà¡¡¡,Ô*ÌÌbî¹!wâ|œ¤Ù(ÞÀ6沦»Kº|t¹¥ûNm4ÒQ¡/˜;ÂÚ1)ã>NÀùÒ +9­)o‰²Øea)w;€³d…Ó‰‹ –{`Úeó9à”çÑ%àL¸ µp—§Íêe¡–{@í[ÔOÐþö¥Ö¦:³« úYaø "ÖÁ„Ú ˜`6˜ø=s¹ç\›Ð¡ !NÐËƽ0 °l´¡çó=WU˜f¸‹+:íƒíþöƒŽU +Áª¨ã3ýÖIŠŠ‘·bÞ.NÒR]´`ÀJ–K ðrYè@ð¥?Ö~ÓmÛ4VE‡YúɃ“:ëü6ÆFŸ<éi–f”ô³ôîàu[J5Æí`¤Œx¡º?GTƌ˒Q,uÂCãb›k ñ&u™µücL>ºè·LΣ¨ +N®æÆ,·£ïèEŒ º’†ÓŒbêPç¯TÈk\ÛÀŃõÌ%à¢:±¨Beó0æl3jõŽdäfà'3<£5ªÇÉÈD Hø:).Ìpao…ü£¶WÁ#WeCÓìÇôq«BÝ.¥Ì9@½—äK?1M ÷à˜”É°ÓdbU«{åFk´;‰ªsðÍ•àekmŠÎÊ£­<îŠ «aÝòkøýoè¸ØO-ñÀ¬øËòPöÁSLÍ´ÄÑ/* CÖFfìýÛ“¿­%qŠÐ`µb¬wq¥³"—0<×Ééñ†ïbíÎd…UÌn§=Ô_÷Œ{YØÔt¯L\}¸Ð¤srnXô.LHnMê+/ülmî7N–ù nàÓZõaPéžÖ©qyÈ¡ÞåYnr,œ²:íø$à®çÃUø~åCk.ß–õû1ÖôÏt}(¶aEv~+Œ7¹˜gK…0Ò7AŤô›„`ÿ'g•yûáW…ñ¹½ÅԱ†ñ¯(zéd—†c:ß/#H·×Ïõµññ³×Às½i`GNؼ†kP¥šã‡-Íí§Q£Ûøk²™™å›]ŽLwîÝ.2ùQÂ|ºù£°U’iôQZÏ¢B6#(ÆBâKõô·g"‚mÖ+ã¢Ê‰+Ѐ\ã8ëÍÎM£±]Õ´·—Y—ÀØ™xêõeW8=ø Î'ªj+²“â·Å§c¬=EºÈd{׊‡rûñ`?m<Ùž=ádODeOŽ1ÜÕ'bTèþ4Ùx« Ý6MÕåáiË3Ø‹§«mÈú6d÷Í•¢*tƒ˜ °õÐ{è߸XtÓ~ vTJ¿>,vZìtY8˜i\蚎Y­Õ‰öwolˆVÅBhÌZ"¨Éîì:a ¢-³$ï'ežÆӢΨÂmúX +£ßà$umï åÆUty/ŒÓ"úzAð¬ÒW×ÐdmÍ*óW]]#È-„EšUU~4–Ê–úTÕšµ[ͺ'ÇZµîIÄßj•¹·WÙ8JÒO3®È´Ýò½N!ÇÕY§8­•£º6¦3ðùsV/ +Ãk…ÙµÂTÑ:åÜ_¶–1J8 V• è\:–qF ?ÉlUb=endstream endobj -3181 0 obj << +3266 0 obj << /Type /Page -/Contents 3182 0 R -/Resources 3180 0 R +/Contents 3267 0 R +/Resources 3265 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3122 0 R -/Annots [ 3185 0 R 3186 0 R 3187 0 R 3188 0 R 3189 0 R 3190 0 R 3191 0 R 3192 0 R 3193 0 R 3194 0 R 3195 0 R 3196 0 R 3197 0 R 3198 0 R 3199 0 R 3200 0 R 3201 0 R 3202 0 R 3203 0 R 3204 0 R 3205 0 R 3206 0 R 3207 0 R 3208 0 R 3209 0 R 3210 0 R 3211 0 R 3212 0 R 3213 0 R 3214 0 R 3215 0 R 3216 0 R 3217 0 R 3218 0 R 3219 0 R ] +/Parent 3183 0 R +/Annots [ 3270 0 R 3271 0 R 3272 0 R 3273 0 R 3274 0 R 3275 0 R 3276 0 R 3277 0 R 3278 0 R 3279 0 R 3280 0 R 3281 0 R 3282 0 R 3283 0 R 3284 0 R 3285 0 R 3286 0 R 3287 0 R 3288 0 R 3289 0 R 3290 0 R 3291 0 R 3292 0 R 3293 0 R 3294 0 R 3295 0 R 3296 0 R 3297 0 R 3298 0 R 3299 0 R 3300 0 R 3301 0 R 3302 0 R 3303 0 R 3304 0 R 3305 0 R ] >> endobj -3185 0 obj << +3270 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [524.436 603.575 539.579 613.869] /Subtype /Link /A << /S /GoTo /D (part.1) >> >> endobj -3186 0 obj << +3271 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [525.586 579.116 539.579 588.685] /Subtype /Link /A << /S /GoTo /D (chapter.1) >> >> endobj -3187 0 obj << +3272 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 565.567 539.579 574.59] /Subtype /Link /A << /S /GoTo /D (section.1.1) >> >> endobj -3188 0 obj << +3273 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 552.018 539.579 561.041] /Subtype /Link /A << /S /GoTo /D (section.1.2) >> >> endobj -3189 0 obj << +3274 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 538.469 539.579 547.492] /Subtype /Link /A << /S /GoTo /D (section.1.3) >> >> endobj -3190 0 obj << +3275 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 524.92 539.579 533.942] /Subtype /Link /A << /S /GoTo /D (section.1.4) >> >> endobj -3191 0 obj << +3276 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 511.37 539.579 520.393] /Subtype /Link /A << /S /GoTo /D (section.1.5) >> >> endobj -3192 0 obj << +3277 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 497.821 539.579 506.844] /Subtype /Link /A << /S /GoTo /D (section.1.6) >> >> endobj -3193 0 obj << +3278 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [525.586 473.363 539.579 482.931] /Subtype /Link /A << /S /GoTo /D (chapter.2) >> >> endobj -3194 0 obj << +3279 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 459.814 539.579 468.837] /Subtype /Link /A << /S /GoTo /D (section.2.1) >> >> endobj -3195 0 obj << +3280 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 446.265 539.579 455.287] /Subtype /Link /A << /S /GoTo /D (section.2.2) >> >> endobj -3196 0 obj << +3281 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 432.715 539.579 441.738] /Subtype /Link /A << /S /GoTo /D (subsection.2.2.1) >> >> endobj -3197 0 obj << +3282 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 419.166 539.579 428.189] /Subtype /Link -/A << /S /GoTo /D (subsubsection.2.2.1.1) >> +/A << /S /GoTo /D (subsection.2.2.2) >> >> endobj -3198 0 obj << +3283 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 405.617 539.579 414.64] /Subtype /Link -/A << /S /GoTo /D (subsection.2.2.2) >> +/A << /S /GoTo /D (subsubsection.2.2.2.1) >> >> endobj -3199 0 obj << +3284 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 392.068 539.579 401.091] /Subtype /Link -/A << /S /GoTo /D (section.2.3) >> +/A << /S /GoTo /D (subsection.2.2.3) >> >> endobj -3200 0 obj << +3285 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 378.519 539.579 387.541] /Subtype /Link -/A << /S /GoTo /D (section.2.4) >> +/A << /S /GoTo /D (section.2.3) >> >> endobj -3201 0 obj << +3286 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 364.969 539.579 373.992] /Subtype /Link -/A << /S /GoTo /D (section.2.5) >> +/A << /S /GoTo /D (section.2.4) >> >> endobj -3202 0 obj << +3287 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 351.42 539.579 360.443] /Subtype /Link -/A << /S /GoTo /D (section.2.6) >> +/A << /S /GoTo /D (section.2.5) >> >> endobj -3203 0 obj << +3288 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 337.871 539.579 346.894] /Subtype /Link -/A << /S /GoTo /D (section.2.7) >> +/A << /S /GoTo /D (section.2.6) >> >> endobj -3204 0 obj << +3289 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 324.322 539.579 333.345] /Subtype /Link +/A << /S /GoTo /D (section.2.7) >> +>> endobj +3290 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [526.677 310.773 539.579 319.795] +/Subtype /Link /A << /S /GoTo /D (subsection.2.7.1) >> >> endobj -3205 0 obj << +3291 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 297.223 539.579 306.246] /Subtype /Link /A << /S /GoTo /D (subsection.2.7.2) >> >> endobj -3206 0 obj << +3292 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 283.674 539.579 292.697] /Subtype /Link /A << /S /GoTo /D (subsection.2.7.3) >> >> endobj -3207 0 obj << +3293 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [525.586 259.216 539.579 268.784] /Subtype /Link /A << /S /GoTo /D (chapter.3) >> >> endobj -3208 0 obj << +3294 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 245.667 539.579 254.689] /Subtype /Link /A << /S /GoTo /D (section.3.1) >> >> endobj -3209 0 obj << +3295 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [524.436 207.173 539.579 217.468] /Subtype /Link /A << /S /GoTo /D (part.2) >> >> endobj -3210 0 obj << +3296 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [525.586 182.715 539.579 192.283] /Subtype /Link /A << /S /GoTo /D (chapter.4) >> >> endobj -3211 0 obj << +3297 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 169.166 539.579 178.189] /Subtype /Link /A << /S /GoTo /D (section.4.1) >> >> endobj -3212 0 obj << +3298 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 155.617 539.579 164.64] /Subtype /Link /A << /S /GoTo /D (section.4.2) >> >> endobj -3213 0 obj << +3299 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 142.068 539.579 151.09] /Subtype /Link /A << /S /GoTo /D (section.4.3) >> >> endobj -3214 0 obj << +3300 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 128.518 539.579 137.541] /Subtype /Link /A << /S /GoTo /D (subsection.4.3.1) >> >> endobj -3215 0 obj << +3301 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 114.969 539.579 123.992] /Subtype /Link /A << /S /GoTo /D (subsubsection.4.3.1.1) >> >> endobj -3216 0 obj << +3302 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 101.42 539.579 110.443] /Subtype /Link /A << /S /GoTo /D (subsection.4.3.2) >> >> endobj -3217 0 obj << +3303 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 87.871 539.579 96.894] /Subtype /Link /A << /S /GoTo /D (subsubsection.4.3.2.1) >> >> endobj -3218 0 obj << +3304 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 74.322 539.579 83.344] /Subtype /Link /A << /S /GoTo /D (subsection.4.3.3) >> >> endobj -3219 0 obj << +3305 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 60.772 539.579 69.795] /Subtype /Link /A << /S /GoTo /D (subsubsection.4.3.3.1) >> >> endobj -3183 0 obj << -/D [3181 0 R /XYZ 85.039 786.531 null] +3268 0 obj << +/D [3266 0 R /XYZ 85.039 786.531 null] >> endobj -3184 0 obj << -/D [3181 0 R /XYZ 85.039 643.064 null] +3269 0 obj << +/D [3266 0 R /XYZ 85.039 643.064 null] >> endobj -3180 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +3265 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3222 0 obj << -/Length 3145 +3308 0 obj << +/Length 2104 /Filter /FlateDecode >> stream -xÚíœYs7€ßõ+ø°U!«–È`pÌÌ“Ë:²±+vi-%NU’‡1E[\óPHÊÇ¿_ƒœA+°bK²S[Yó˜fcúënÑA¡þGµ kU-‰`t0Yƒ7ê›ÿP¸b —Œ£kϾÿAÈ-HS4ƒó×þwš‚ˆFÎ/~­–£²n§öŸÍèó§'çþ‡#Õ”1ý³üöG1¸PCxzPÖÔƒ÷êuAhÓ \0"8ƒ÷󃳃ÿúß²ßñ•ê» Áj"jÖ½ *¢Û ¥$¼áƒJ"yeîƒF8k)‡ÏFcÆØðlD‡Óј'×ë™z½Õ÷øQLJÏÔûÕh¬>¸˜Ú«/DñóF_>]ÛO~2Âï´Ôt?9èÏ®•ôzfOÉÑÑXÈz¨ô‹¢HþÛ擾»ù’=h¢¬ˆ¬‚:¦^¿Ø/bãƒÔ8ëÿ·ñig²gtL/•”ðBý"/I¡Ü'‚N‡TY¢©›áÉõ¦]hBWêÕ|jY+'ÿ½ \}òæz­¯ØΔ۫ªü¼X>U°@.Õ †P­›¦ÚBÓëC¹TWóÆSÊgÓµ ¿u2üâà5ñêƒ×JêæÝ| ^îÄ/âàSåâbþC™Äß‚ÓëƒZ}¡ÿÖZÝ}.M+‚teIŠ»Z‚)]´zú_POÂçÃS[íÆ̧ïõëÕúÂFáD¿»T\V÷³¥†¨Djv?™Ý;Xsæz„—Bœ"•ö‹ŽzÄ5¥Î;d]©(¸‡÷8Z™ ^è°ÕNq¢3úz¥ƒY¹ £åÝý¾áŒ™é‘XÚ;v@ñ”{ôŒ í¨^7÷+Ý„‰Ò;…¹ÿå¥Éì6ã/Ú·f6ßØ·gjNPo_µÖ{ZøT œ¼QJ‡¿h‡zñh4–êó8'8£ä‚bèØà" º;4¦×ƒ–©UFp ËO}¬7o&´3“@Êá‘~§7³Íp»^ÍçÓµ‚Ï$»dÁ -¹dƒB6¶pšlwYL¯'Ë+R -îɲ¿“ì3³d·› »AËËòÞÆ.X#—pCÇ–NîŽ!Œéõ„#U»Z‹Z‰o¶­-Ía/öÓj3[¾±¯Õ÷K¿ë2«t;Á+ÔÛ•½VŠúŠÍ{½(4«€ ·á @.Ù 7 2ˆ! cƒ¦AvGÐÉYEh=—jñ-úëjn-6–ECJ.ýÐÊ¢[t×è‘éåšT˵ã•A–²R WçÛ­Ùq¯æ]J{A!j: ¾ˆoÿ7édÒt᧺&s•H´–º?˜Þå­h‘MÖ¢°¼ýaTsëôíÖ+Ìë ¤º%8÷¡ùÔÇli·ê²¦)¿ÝE®3ifØEbé°‹qñ*å;=#HçOT¯w“º$”×à&%¸É¡M{³ ¤ÄÕkëÇ«LÌWèuRTq¦äè7å `¸\gbˆ3DPxt†îgÀôºÉTHuuÓxgp;ž^승-|ùÊæ¹)[^©µP5ty¥ìîÐ}&ò`¥\òA !@ÈwG€ÇôzòBÍ-uÓ*ÎÏÎd¹.Ĉq¤ ;Ä 0½Þ TF­ip™wÐü³èVûn$„šµõÊIì,+yýqƒirq1wlö4îîܘ^[]]ÊÒã®\“žŸœ÷ff6ø«î:m1]èyàUh3¯p¥îÍJž&ÝëeÝ6¾ìz2H,iK î,—VChEV“ÉóážܪQFê¨I°¯Ï]cFx‡íäíõ•mÁ3al2¹íÈ[-·k“Þ“íx‘Ö¿ÒŽ‡rÿ7Í(“G°ÑO%ÛñÆ%¡%þ|3£”ÈšáÕ V¤ìö—zòßÜ“Wño¸'Ï™47ƒ€1®´uG€¤KL¯s“²V)²à&®'ïd³ЉQ‡—­5›Ð3ϬéÍçZ¯|}ÁòÉÒ6é, #6²øjÈ;+e’ÄÒäw$ŸHëAš<ª×M”eż«N=;CÏžŸs8Ôµµì¨I'ÙØS7÷ïwû¹Hƒ‚46miwRL¯;C*EC$:éG¸§êõñzœ+ qϲîÆsa1flÔäARϘ˜^Ÿ\’BÔfé·¯Û™{ªßDÝl.Y­?ÞÜqÅn×'{gÁ ¹ƒ96vrwdL¯‡ÌJ"ŠÆCî}hìO}ÐÎg›;Q¤3ïÈ<“2wgˆn“²½„zÖrêz²*Ó´C‡¾(M¸ó\šA ¡[5M³;„&¦×Ó¤5iÂŒêÊŠ?Ú‰Pe²§¾=_êåùþ¶°»Åù –âæÇ"î“(·Ï~6¼úR8í­çÒôRÌȨi–õJD©_‚p -$™RÅ®}¯m¤Yûœ&ì@wW>óÐ÷Öms ók]‹‡µ¶ÆÉeí¥Ö‘Ù“µuÕ#¬¥.jiCI-l·ÎëykvþxÇ×TvöÉ䉥ïØ>I¼giä¨^ß´ª £Pïòíëÿôn|šƒ€1s$ˆ!ƒJ6÷ôŒqL¯O -’“J2ï ~wÜsÌþx÷æfû ?<Ïdð?\ÍÌí2G÷ÿv•duA¼Ú›¸BõW0VyEùÝ 3ä¢ bÚØÄi´Ý h1½­ ¤¤Ü£-÷OöžbyåVkÑB-*ƒ]_Ý´ãòkp{ÄÀ}Ÿ€¯¥œ=2}˜åíhÁåÒ -b­ØjiZÝ ´0½žSúe ÅEµ~ Q³ž^Íg®‰ªÝB¤êM‘ïà€£žîOt]ì,¸í1 âRŠú¾OÑ`¤\ðA HöhôŒéõàK•u©ðàù~˜>é°7xg[s”%Y³qº„‡SŽµ÷<>Õ§©¾‚5+ׂâ1ˆ´tG>ãªk"ë²ïKýÇÜßJüô¿²ëʸÚêÕ7}ª-³Ó¥éƒjsQ4âÿòQýõendstream +xÚí\]sšX¾÷W8;{Rç¸ÊDMÛt›Ô6v²;m/ˆ’ÈD%‹Ø43ûã÷¼ç h4‰ÄÛ‹ @Îsž÷óATuøTõ©íà êù̦U»ÃŠS½âGÞUáT‰í0 +‡Ê›·”U‘cNPí\Š!Þ7«™Œj®oe‘ü3®ýè|¨u¦.R'6a®òoåÛ§Úã7úPqløÕ[¾íØ(ªÃ +¡Ø¦«ÏƒÊYå³¹Š1_Ñ‚/Mll»V÷³[gµ:ÆØ:«!+ªÕ‘Õ¤1ßÎàîà±Nøç¤Vç;z‘ýÝ¡Î×1 R¹ç£8ù'œ Ô%£.ì›ð³ÓX^Ÿ‡juÊ|‹ßŸ:ÎÂ?$uìá!÷"²‘Ï7ç¦5½ªÊ/ï–L¦ëÝ¿¢3sÅ9À°çÁmë V Yˆ?DàÖÑ/þ!ÂäÞð­A$aâ‹ñ»ƒßs5IaDóåY÷ç”ëY×ÀˆÑŸÏÛÎù/‘kîËCû0٨¶™† C€èXÇ4fq¼1r_;e8Aj#åÏûÂFæñbxm<ÛXî=“v–Óø¶äÎðž×Ó®ô€‡›ÙpK÷„•ƒŸû<øµ’a+j뜸 KßÙC³&4øù¡9Ñ4Â.DJ'ðÁ8Ø3h&ú0J:‘æ«~œ…råTÀÿ1‹hE±bdB{Kô²DQñÀõÀ³Š<Ë ï6*ÄpylH‹ ˆÙ˜yq×)¸?DŒG­D.zÎ AæYM°N£Løœd0÷àÉŠ \ÁÞ»sOìÍ<¥®êUÏ·’±^¢¬·5ŸÈ%f"ÿ̶‘ZJ ±×¬F•æd|X¸ûXkýUŽ7HKG 7¤ˆ»Êx$—y`8í\HºyÏHê ¹3˜¬B˜*QG”€n¸·öŒ×÷(~¹yß2'C7îè4)·Sm8¡\¦1Ò+IÆK \º„ÀFä öaòJ°’XYÉ…“;þS%ˆµ +¾ïïºõ JH×úÎB™‚¨$Å´¡–¹1³½ã*NDP ÐÑn©˜ÒµN…EÍ +Uº½Ö9ÐU’ã™3‹ÓJDààÕ¼=JÏ^ÐÂðâ4Ê £\ˆM^€ã?ã.CŸ¼B7õH¦[Pt%ˆö¨ÒY‘4Èr"~”Önd™¬‡*~hŠ{Í&`P[SNì\Ä„½DXC•§ýÝ–ÇÞ'CuâQOôw¨˜½ð$»åM2~Â$Ÿ‹`OèQÀœ©É €AoNøày¿ç*wËñ ®-ä:O îë|÷ïyò$gZãÐЮBÁ`\„ùhÇ])!ÚbûÆéËi¤„j31Úw„ÉŸL›<`Ü(ÉòR-ððxÔLz:FS1·éê„]ð4ýX•tá„SOðOî’fÁkaÞzV’+ù!sjš8Óµ¨µ‡ñ@¹ †T}…IL„ö\ÀÛ_ñ8›.‰fž¶ôÁÔ)‡]q©.%3`>Ô݆ù§åÌ¿n}΄wÜýÈ6Î"¶ð|FnüSó1ÌŸøði”ËïøhqžÃÿ¡ !eu¤\¡ÁoŠ ¹É‚ÕÛ¹÷4+XÅrî&½˜aç±âÍibF‰a‘ìÆiÌÜu£‰í‡•ŽÖ¢™˜åX11³á…H1Á… ²Õž}÷\!.`뵆¾Ž„ÞƒýY£”»#jî0âï‘Úç<­ü…²#QT3NH¡–Èp"¥Õ½T§¶à³Òk?dy…T˜ÇK“|-ŠJØtŒðܓ꽬’ƒ)%G#ì^On¤„C<·0tRÑ‘Œ²TX¿ç“sm9Gݵ‘‹–j:M\ùc{MÇ˦þÆs|f4G㱂 ,iYË]ëÞ¯R L5æx$›ÍCU˜³GwÒlJ¿qr¶´*yÚ!õ±i‹ÝM•ö¶§U/l§Üq°ñÒ²ÂäÁŽJ›o·šK»+Ì¡»ÚH¡%´Ù”Pæc Öõa{ióWô&“,—5ÑWŸi”…69cë×…qŠÓ\¨œ¤w 3ðÓÄh¿@n9‘¢>Ce%ÄŠL3ÁàbçR*çÎ 4ó²~¤åsòÜà]Æ`O¯ë*ïe/WNpÏ´É +fÿÂu>}ãLyYz`é`=V¡ù²P Oô‘u’´í¬À¥øù™wwõ²E²!yüIdŸjú§¦e´Íö›ãv^™:‰ª‰·K¾¾D0ܧ‚ÑŠuÍcwÈš %6/ È´q"•Ê‹Ö“Ys3Èå_óÑÚ´–¾ŽDò±h­çâ±É$ד€>ÞWçgñ"›þ™f¤Ë{EFÉ\¤ep‘äU9Åt 30±Û_‘z$ïð{ãüæ½*–„”›w^”zyöm‚†Ñ_˜°|ª:¹Yáu•%F'Ó¤Q¯ê¶šÞNÏ3.Ê~Zª¡u,?~‰n xˆ¥ú%‹fKbÍ[é7ú—]zZ?ÃÏ’9ÎÁF#‹òáaåÀCîÓàx¡N?Î_2?(aímœõ•\Fèàýÿg‰(^ PºÓG|ÛÁ´øÇsŸð»ĵ¿ÁJ+­T6ü˜Ct endstream endobj -3221 0 obj << +3307 0 obj << /Type /Page -/Contents 3222 0 R -/Resources 3220 0 R +/Contents 3308 0 R +/Resources 3306 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3122 0 R -/Annots [ 3227 0 R 3228 0 R 3229 0 R 3230 0 R 3231 0 R 3232 0 R 3233 0 R 3234 0 R 3235 0 R 3236 0 R 3237 0 R 3238 0 R 3239 0 R 3240 0 R 3241 0 R 3242 0 R 3243 0 R 3244 0 R 3245 0 R 3246 0 R 3247 0 R 3248 0 R 3249 0 R 3250 0 R 3251 0 R 3252 0 R 3253 0 R 3254 0 R 3255 0 R 3256 0 R 3257 0 R 3258 0 R 3259 0 R 3260 0 R 3261 0 R 3262 0 R 3263 0 R 3264 0 R 3265 0 R 3266 0 R 3267 0 R 3268 0 R 3269 0 R 3270 0 R 3271 0 R 3272 0 R ] +/Parent 3183 0 R +/Annots [ 3313 0 R 3314 0 R 3315 0 R 3316 0 R 3317 0 R 3318 0 R 3319 0 R 3320 0 R 3321 0 R 3322 0 R 3323 0 R 3324 0 R 3325 0 R 3326 0 R 3327 0 R 3328 0 R 3329 0 R 3330 0 R 3331 0 R 3332 0 R 3333 0 R 3334 0 R 3335 0 R 3336 0 R 3337 0 R 3338 0 R 3339 0 R 3340 0 R 3341 0 R 3342 0 R 3343 0 R 3344 0 R 3345 0 R 3346 0 R 3347 0 R 3348 0 R 3349 0 R 3350 0 R 3351 0 R 3352 0 R 3353 0 R 3354 0 R 3355 0 R 3356 0 R 3357 0 R 3358 0 R 3359 0 R 3360 0 R 3361 0 R ] >> endobj -3227 0 obj << +3313 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 754.651 539.579 763.674] /Subtype /Link /A << /S /GoTo /D (subsection.4.3.4) >> >> endobj -3228 0 obj << +3314 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 741.102 539.579 750.125] /Subtype /Link /A << /S /GoTo /D (subsubsection.4.3.4.1) >> >> endobj -3229 0 obj << +3315 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 727.553 539.579 736.575] /Subtype /Link /A << /S /GoTo /D (subsection.4.3.5) >> >> endobj -3230 0 obj << +3316 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 714.003 539.579 723.026] /Subtype /Link /A << /S /GoTo /D (subsubsection.4.3.5.1) >> >> endobj -3231 0 obj << +3317 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 700.454 539.579 709.477] /Subtype /Link /A << /S /GoTo /D (section.4.4) >> >> endobj -3232 0 obj << +3318 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 686.905 539.579 695.928] /Subtype /Link /A << /S /GoTo /D (section.4.5) >> >> endobj -3233 0 obj << +3319 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 673.356 539.579 682.379] /Subtype /Link /A << /S /GoTo /D (subsection.4.5.1) >> >> endobj -3234 0 obj << +3320 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 659.807 539.579 668.829] /Subtype /Link /A << /S /GoTo /D (subsection.4.5.2) >> >> endobj -3235 0 obj << +3321 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 646.257 539.579 655.28] /Subtype /Link /A << /S /GoTo /D (subsection.4.5.3) >> >> endobj -3236 0 obj << +3322 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 632.708 539.579 641.731] /Subtype /Link /A << /S /GoTo /D (subsection.4.5.4) >> >> endobj -3237 0 obj << +3323 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [525.586 608.25 539.579 617.818] /Subtype /Link /A << /S /GoTo /D (chapter.5) >> >> endobj -3238 0 obj << +3324 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 594.701 539.579 603.724] /Subtype /Link /A << /S /GoTo /D (section.5.1) >> >> endobj -3239 0 obj << +3325 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 581.151 539.579 590.174] /Subtype /Link /A << /S /GoTo /D (section.5.2) >> >> endobj -3240 0 obj << +3326 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 567.602 539.579 576.625] /Subtype /Link /A << /S /GoTo /D (subsection.5.2.1) >> >> endobj -3241 0 obj << +3327 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 554.053 539.579 563.076] /Subtype /Link /A << /S /GoTo /D (subsection.5.2.2) >> >> endobj -3242 0 obj << +3328 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 540.504 539.579 549.527] /Subtype /Link /A << /S /GoTo /D (section.5.3) >> >> endobj -3243 0 obj << +3329 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 526.955 539.579 535.978] /Subtype /Link /A << /S /GoTo /D (section.5.4) >> >> endobj -3244 0 obj << +3330 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 513.406 539.579 522.428] /Subtype /Link /A << /S /GoTo /D (section.5.5) >> >> endobj -3245 0 obj << +3331 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 499.856 539.579 508.879] /Subtype /Link /A << /S /GoTo /D (subsection.5.5.1) >> >> endobj -3246 0 obj << +3332 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 486.307 539.579 495.33] /Subtype /Link /A << /S /GoTo /D (subsubsection.5.5.1.1) >> >> endobj -3247 0 obj << +3333 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 472.758 539.579 481.781] /Subtype /Link /A << /S /GoTo /D (subsubsection.5.5.1.2) >> >> endobj -3248 0 obj << +3334 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 459.209 539.579 468.232] /Subtype /Link /A << /S /GoTo /D (subsubsection.5.5.1.3) >> >> endobj -3249 0 obj << +3335 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 445.66 539.579 454.682] /Subtype /Link /A << /S /GoTo /D (subsection.5.5.2) >> >> endobj -3250 0 obj << +3336 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 432.11 539.579 441.133] /Subtype /Link /A << /S /GoTo /D (section.5.6) >> >> endobj -3251 0 obj << +3337 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 418.561 539.579 427.584] /Subtype /Link /A << /S /GoTo /D (subsection.5.6.1) >> >> endobj -3252 0 obj << +3338 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 405.012 539.579 414.035] /Subtype /Link /A << /S /GoTo /D (subsection.5.6.2) >> >> endobj -3253 0 obj << +3339 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 391.463 539.579 400.486] /Subtype /Link /A << /S /GoTo /D (subsection.5.6.3) >> >> endobj -3254 0 obj << +3340 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 377.914 539.579 386.936] /Subtype /Link /A << /S /GoTo /D (subsection.5.6.4) >> >> endobj -3255 0 obj << +3341 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 364.364 539.579 373.387] /Subtype /Link /A << /S /GoTo /D (subsection.5.6.5) >> >> endobj -3256 0 obj << +3342 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 350.815 539.579 359.838] /Subtype /Link /A << /S /GoTo /D (subsection.5.6.6) >> >> endobj -3257 0 obj << +3343 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 337.266 539.579 346.289] /Subtype /Link /A << /S /GoTo /D (subsection.5.6.7) >> >> endobj -3258 0 obj << +3344 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [525.586 312.808 539.579 322.376] /Subtype /Link /A << /S /GoTo /D (chapter.6) >> >> endobj -3259 0 obj << +3345 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 299.258 539.579 308.281] /Subtype /Link /A << /S /GoTo /D (section.6.1) >> >> endobj -3260 0 obj << +3346 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 285.709 539.579 294.732] /Subtype /Link /A << /S /GoTo /D (section.6.2) >> >> endobj -3261 0 obj << +3347 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 272.16 539.579 281.183] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.1) >> >> endobj -3262 0 obj << +3348 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 258.611 539.579 267.634] /Subtype /Link /A << /S /GoTo /D (subsubsection.6.2.1.1) >> >> endobj -3263 0 obj << +3349 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 245.062 539.579 254.084] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.2) >> >> endobj -3264 0 obj << +3350 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 231.512 539.579 240.535] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.3) >> >> endobj -3265 0 obj << +3351 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 217.963 539.579 226.986] /Subtype /Link /A << /S /GoTo /D (subsection.6.2.4) >> >> endobj -3266 0 obj << +3352 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 204.414 539.579 213.437] /Subtype /Link -/A << /S /GoTo /D (section.6.3) >> +/A << /S /GoTo /D (subsection.6.2.5) >> >> endobj -3267 0 obj << +3353 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 190.865 539.579 199.888] /Subtype /Link -/A << /S /GoTo /D (subsection.6.3.1) >> +/A << /S /GoTo /D (subsubsection.6.2.5.1) >> >> endobj -3268 0 obj << +3354 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 177.316 539.579 186.338] /Subtype /Link -/A << /S /GoTo /D (section.6.4) >> +/A << /S /GoTo /D (subsubsection.6.2.5.2) >> >> endobj -3269 0 obj << +3355 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 163.766 539.579 172.789] /Subtype /Link -/A << /S /GoTo /D (subsection.6.4.1) >> +/A << /S /GoTo /D (section.6.3) >> >> endobj -3270 0 obj << +3356 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 150.217 539.579 159.24] /Subtype /Link -/A << /S /GoTo /D (subsection.6.4.2) >> +/A << /S /GoTo /D (subsection.6.3.1) >> >> endobj -3271 0 obj << +3357 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 136.668 539.579 145.691] /Subtype /Link -/A << /S /GoTo /D (subsection.6.4.3) >> +/A << /S /GoTo /D (section.6.4) >> >> endobj -3272 0 obj << +3358 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 123.119 539.579 132.142] /Subtype /Link -/A << /S /GoTo /D (subsection.6.4.4) >> ->> endobj -3223 0 obj << -/D [3221 0 R /XYZ 85.039 786.531 null] +/A << /S /GoTo /D (subsection.6.4.1) >> >> endobj -3220 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +3359 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [526.677 109.57 539.579 118.593] +/Subtype /Link +/A << /S /GoTo /D (subsection.6.4.2) >> +>> endobj +3360 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [526.677 96.02 539.579 105.043] +/Subtype /Link +/A << /S /GoTo /D (subsection.6.4.3) >> +>> endobj +3361 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [526.677 82.471 539.579 91.494] +/Subtype /Link +/A << /S /GoTo /D (subsection.6.4.4) >> +>> endobj +3309 0 obj << +/D [3307 0 R /XYZ 85.039 786.531 null] +>> endobj +3306 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3275 0 obj << -/Length 3278 +3364 0 obj << +/Length 2134 /Filter /FlateDecode >> stream -xÚí\YsÛ8~÷¯PÍ“ô ˜8I>lM%v’M¶âxcOy«fçA‘e[åƒ^IžLþýàj‰¶él©”£ƒlv«¿  ÑúT’¼”•"’ÓÁôr«œê+o¶¨¿cìo'÷¼<ÜÚ~-Õ€¤.êÁáIxN]Y«ÁáñïÃæjĪájæ^–£?ßm½: NTSÎÍcÿ·õûÅàX›ðn« ¼®Ÿõû‚к\n ɉܾØ:Øúwx–»&NªëW^Z Ƽ U%:o¡%¢àú—JI”(Ã/eEÇ/õ÷˜_Z’ÑX 1ÜmFc:¼Ñád~5sUßë³ËOúƒ~],Ïæúóõ¦'$Óž­ø Ñë.-NîÍÇÄL¸7só™ÆNU·4ójSsÛsÞ·cF(»…"æV¦‚ET&{KÁH¡Qrž£Úw¥öÝëQ%†3ã¿ÉêF;iaß/µã8N®ŽÝ›—öÛ+ãTóæ¿ú½æÖ¸®ÙP?J…yu|ê|Ánù†â_÷èqJ¢J\ÚÂ&C '5NÄÚpm>ûµ-h±îÅõš0}·¨=M˜§ÉûG„# û\³‚›+‡Ÿ-Q„þZ³¨Yœ,u43&+Óâš«íƒÙâO‡f ÷€÷“©<³Ïq|28U|¸¸ òîæÓ©ùÔ˜ï!šépñýðõ¾è‹oCðMý\dñm[€à‹é¥:0‰ZëÕ߶&TJiP´wëáÍäÂù}gá#‚A©¹r_6' ‚ÕðìžðÕ£åj/ôEÕ‰ ˆ‚giÍu­’9]EÓZ#ÌùÛr~uꜿw(6µúk‹î“GÓÀ89M¿[Ùæm…_˜¦~ÜÑtg±‘›67ß‘ï:ÄpÕøgyŠì6—¶w®éÐq¿®/@A -Á(ñËÂÔR …(°TUê¯h@‹{´~ù`|?¶-æ P¿¾ø¢ßÿ⼦[¢¥ëMu a› ÐMp¹B€QJ|ßf¿¼'’‰XÊ5¯ò–äÁDõ4KA¸dM‚è¹ÅãÆN¾Õôï9ÜLíDCš´Ñ‰{Ve5….ÍÍzìë»]QU}aó?±/lQ -u_¶¶l˜^ªÜ¸F)=ѯ lth:Àºª‡G¶3;nŒãV9Çþgß½î›ÚœÌ,PK “í/%ûá#ߌþ'÷…1Š!0¦îÌÃضÓ`<)ÖadŒ¶Ô#£>‡øF{ôÅ8Š!§¾ÎcܶÁÓ0朔ÅÆÜc|0qámbf”>èiã7‚Ü»§/äQ ié³ÃÜ7óËkC…ÕZžks˜ãÒ ï9ÔÎ-}‘RЉë,Î-ṏR˜¬K& §4…9æÕöms^Ú‘×ü“¾páŸ-l.ma’Òµ|ªaÜ»¦/ÔQ Á:u{ì¶Ú˜ÞШ)%¥bnÈ~ÛÀYºú·Ñ¥ç— Ü%³Dqsm -:èïܽû²"Š!¬HÑÉ tX€°Ó ¬uE¬¬°SïÓÌÜ{¹1ÈŸ^ÌgõE!Ÿ6#À{=‘ˆå±†L–äê Œ¨QŠF(ψ½feøPUâ‰ää¾%¼ûúR"Š!”H¡ÉS¢mB L/¤DI ¥Ö—> °ã2s—°ÆýÊ¡-š…/% ì1 øâÙ— Q !H -Tž m ‚`zCÌšJ‚@ª`'$y¨n8>Î#½tÕç>?ØÄ´ô:WfEðÁ.Û‚úBÅhSç¡m[€@‹é Ð -A -ª´0û7@&Ùü.8S!/h«V'ó‹¥ñ¯|”Þ;¤/ÈQ 9qv•--ì° [½Íô@_Öxõ¶ 5‘¯Þ†{¬e¾zû`eËŒM!¾0o.léèÌUr˜D¿ž5ÌË\ýv¢ù.õÛ¨¡›Ï´–f ú’Geë· ´t{ӘP¤ð¹Ûêgéöÿ¥ýy—ömQ i)\yî´-@‚,¦hÂkf›©£ ”nCwxºpezšmº@MYÒÇ7`þþT·ö¤J"–§ÊdYªtX§ -ª7P¥¬HM=S ÜâÕ_¦Øǯ“\ÝNså£Æ©][õŠ¬ϘÎ})¤F$Èd+”Ûê> JaxÆ•$\E>ÀÈû£í3NÒ -òÐØ”=w»Ðb7`,|vƒlí,LF_<ÆÑø«/þQ !@ŠEžm  -`z$%€!úŽGœÕÃÕvˆØRØ9dèUHñÕŒ=íô øª/þQ Á?Å!ÛLoèôÝÌ玫P¥ñ3=s?‚xgö%HC’•-Ëí°ŸÞUøôŽSNª¤Œ³kz÷Ëj?½³ûô<îȇãfÄ W›­¿Û›­ìG󟾠™uî.ìØîÂŽ:ÆvØ»"tÓº^f]õ5»z9¥DU·$UyQæë3ë054YvÍЪ~L ñA¶cïÞ¾í8Š!í8!SÛ‚ŽvLIɤ֫wÍ3 Y‘JšÆ®Öô Ñ)©!¡!Ã=Æ´·ºÙð?qÕ7/lÓûsr5»V¹ÓÑ\[>•Dp6H @}éîÆíÝ|¦õe¶´1yÖ09“]·P¥QæÝtù-G0Yy²—¥+ZÂ=Æf}Q›lQ¤-ˆÔ1pÛ9v#~Ú:*ó1ÔÜrî„_.|¼uÖõ虜‰ñw‰œèoÝ|¦([„”< -¨d%9D–·œ‡À'¥ßÝ¢¯šÐÉ~fÕ¾.\‚O{†ËD,.S¼µ-È‹Q½'ú+VHà ó<9:³©7ÿÇÏ/a¢ìv¡¹­‚†(§¿fzägJïÖ¾T‰bUȪlqT‡U0½@Z+¢¤ªpO•Ýù2¤EÂÞQ³ÅDý‰Ý™/àÛž|IÄò|Iq«²«¢äù‚ê…” ­8¡EÂÓ ™^Zwê6Ž¼ýà7EØ`²vÊᎹa_Sjûí~Ü ù“-ॾÈG1ùù¶ò˜Þ€¼ŠË‹yæ‘?ÜÙ·xˆÇ®Gù<·§C47>Ó¶NZ= Uf5õ ²„ºùl;Oή‰wX€é @˸hæèݽƒ°ƒ1±âNí°Ùr(“µéõùb6]5 ³Ÿí ¶oy¯¥ØD =q?»ì±‹ê #×õôUáGÿ„A¡).ÂAþ0¬ÓPÝÂÝ"íÔÌ£ÍÀRòçØå‹{-¼&b1€êìÂk‡10½!°°¼gy=þÁlµŠÃdOÔ‘aɇÿ2/o>Ú¿ùbBP`]òGÒðÙ}Q£‚nôr]Bi«G°e·/¢RjVÙ"´ìvhw?˜®/ÞîuE§ªÔcîÎ)}1RÆÑÝuv¤­ÁQ0.â✺ó×î§éZCLH«Qc»àbµãåÄí–0ÃüZ”òâ^‹£‰zâÿ:{ZA‡ì˜^À½ŠKnváaß8ôkmØÞxœÔ®¦—”?*h«{­jVwXÔL\g×BªÛ—4¬˜ÒpŠ¢ ˆª„éwT'®¡†¹—Ùøh&ÇÓIºÕmbOI\ÌÜFÇ™Ï>Þ íýÒûX[ÂNµ ÏÃÜVi›WÎ’¡„*aVÐxMO|±š§ÅnsWèÊN&SXP²zVÇL9¯õ=s&H!GÎD<êìZ][=²"$IÙ}Šºþãp&îý9ÕÚzXÝVžaV$}PAÊwìM‰Å¡JÚ\endstream +xÚíœIsâ8€ïü +ncv¬Í¶S] tzÒSIgº2U=}  TÎÒË¿Ÿ÷ž$³9+Ádq¥*xC }z«ž`õþX=QA(t=N¢@ VïŽja½w>Ô˜}"¬Ë ŒÞÚk×vöUTga C]oÿK´Ï¿xÍtÜà‰7í™—Iãkûcí}{®_2Øʵ/_Ãú9|ÐÇZÔÀq0­ë£šT"PRØóËÚií¯¼sOÖÍ» +¾«/E°¤î‹0HYø‹Ay‡xXС8hø‘”^+møÌ5˜×Ž¾ˆbïNz£op¯Ùd0„ó«åKÉÌWÅ1³~Ýœ|¸åƒU¼Ü㦕ÕÎÚáðyÀx!;ÛWŸ±@ò$ï1S…=fÐçú¼ßH¤×Ã~w¦×йŒŽ'Ða!¼ÎøÜìÑÕ1ü2 Ç€Þך{Д +C|‘ZϾÜöÈß¾^ÓËÀyð˜¡Z_8þàÍ3 -Þ8ãÎ}bnžˆg€lD™—6xìý È.à H³‹aª)Îòt¼sÚ˾£ˆ÷2ÓÀa§‹oP;f.`íF"¼ì:¿yx·Ûų¯;Eá³ð°Idžñ Lôýá &Q£ +ã½ëÎ¥¸ffŇ9›‹é¿soðÈñ×Û›áô}<½>u7>8ô‡ã¾ÒV:2†á…CŽ7r6ôtß\Ì!yxò1%e¸â€>ô§H÷¥D|CÔšq +`† kü…÷ƒÌTƒ<3 œûFOÊgf]w¡$..:9àZùÀ©6ùÃöÄ$m¦S'xí°ƒï¸³¯’¹ÆY‡±ý„I¯{ §Ð¬áwó2‰…Fè­ ßKʸ}ë;˜:.Eúž,A?J«—,Ønëô¾Îïd0¼Âû•.ÌÁ©2W…Ítl3ŸýëÌ*»É SÐMÇÊ0~ž£ÿÌô¥*C_Ê\_ÁÛ1²»s‘}ƒÊd!ç&‹)*“ËQ¶ÇæÓ¦ƒÞ\H›Ž®€ÑunΖÓ;¾~‘QØÚ€ââcâ3KS㈧6ù€’si‰½ÇôD–f&$•®B±%Zºqré˜ ±©ðä7[>A‰ÿùåù§…]™n51b+Fw›0šJÖ¨XMlÅêé”J4±z Rª„‰b +ïÐÿ@#÷TŪ1p±jxkê=tIRÕ©nךo~å8ÉëTmîg®tˆ +é­ŠÙË hÞfueWðþ§‰h|\5žeÒóø„)ùãZV<ÎSlÞÍKæjNHÛæUiÙ¬>Šy”¥·[F°1#åÄ›&‚MN¹ÂóղؘÉ7å–Ä/_›«Ì\áqf\w[]e‰¸¼£æ¼J<=%»™LYe7¶£XÕvý~mý~*Ç?ÿŒÄB2š ®õ¦tŠÿàLˆ s£IÊ•¬¬OfÖ•Õƒø@úxh’'¨¯Ÿ,jˆ·Å¯»ÅMç¡fÚaB$ú%Íû×%6,",ˆ¹ªû4ž…“†³ azInX Á!û˜äÝì;å¦p¦½s#ÍéX‘Ü*•o¯.Óƒÿ¤Øݲ ¸¼M8H‹Xg÷+\sbb×~Ac8ÝZÝy{”LHÍM +¼MIè“©‰dK;aá +ê ^¥¶¥’MÇžp…[Äg´Pg× +\Ñì^fSš0¡ßa7U¥ð×…ºùÕW¸",ÕÖp’Ç“Tú0!¿Fʨ2î›g”°¦D°QO£-w)|²¥Ó$¾ [hÛ´œ›åvŽ± “±*LÝ5n©µ›ÇÄ‚ +–†Óí’¶‰ëzìQ¨ŠNYt„¥Ó::Í·÷ä è¦Â–’r®X²xìצî=©*GÆÊ0yÒš¼?ŒË²äÀ,þÄ-¢ ³ˆÒÅ`ý%*Ûö¨|ãkñÕ™¶…UùÏ3üéäO|ùpB'Ÿ­2-¤¯´x­r&JQ27\­OXe·Ke|G· ùl£^@Œ}Š"m–-^ òŠõ ,‰3]ûæ·'º®:/q_ÜhgŠŒÌ®H³¹dV€tؙж’Xè7e²TI¨¤Eµôã"Ë„7o &Bî÷p8{x™5Íóc*ˆoú™¿º5~¡Oò êžóà^–ôw¬3@endstream endobj -3274 0 obj << +3363 0 obj << /Type /Page -/Contents 3275 0 R -/Resources 3273 0 R +/Contents 3364 0 R +/Resources 3362 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3122 0 R -/Annots [ 3277 0 R 3278 0 R 3279 0 R 3280 0 R 3281 0 R 3282 0 R 3283 0 R 3284 0 R 3285 0 R 3286 0 R 3287 0 R 3288 0 R 3289 0 R 3290 0 R 3291 0 R 3292 0 R 3293 0 R 3294 0 R 3295 0 R 3296 0 R 3297 0 R 3298 0 R 3299 0 R 3300 0 R 3301 0 R 3302 0 R 3303 0 R 3304 0 R 3305 0 R 3306 0 R 3307 0 R 3308 0 R 3309 0 R 3310 0 R 3311 0 R 3312 0 R 3313 0 R 3314 0 R 3315 0 R 3316 0 R 3317 0 R 3318 0 R 3319 0 R 3320 0 R 3321 0 R 3322 0 R 3323 0 R 3324 0 R ] +/Parent 3183 0 R +/Annots [ 3366 0 R 3367 0 R 3368 0 R 3369 0 R 3370 0 R 3371 0 R 3372 0 R 3373 0 R 3374 0 R 3375 0 R 3376 0 R 3377 0 R 3381 0 R 3382 0 R 3383 0 R 3384 0 R 3385 0 R 3386 0 R 3387 0 R 3388 0 R 3389 0 R 3390 0 R 3391 0 R 3392 0 R 3393 0 R 3394 0 R 3395 0 R 3396 0 R 3397 0 R 3398 0 R 3399 0 R 3400 0 R 3401 0 R 3402 0 R 3403 0 R 3404 0 R 3405 0 R 3406 0 R 3407 0 R 3408 0 R 3409 0 R 3410 0 R 3411 0 R 3412 0 R 3413 0 R 3414 0 R 3415 0 R 3416 0 R ] >> endobj -3277 0 obj << +3366 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [525.586 754.651 539.579 764.219] /Subtype /Link /A << /S /GoTo /D (chapter.7) >> >> endobj -3278 0 obj << +3367 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 741.102 539.579 750.125] /Subtype /Link /A << /S /GoTo /D (section.7.1) >> >> endobj -3279 0 obj << +3368 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 727.553 539.579 736.575] /Subtype /Link /A << /S /GoTo /D (section.7.2) >> >> endobj -3280 0 obj << +3369 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 714.003 539.579 723.026] /Subtype /Link /A << /S /GoTo /D (subsection.7.2.1) >> >> endobj -3281 0 obj << +3370 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 700.454 539.579 709.477] /Subtype /Link /A << /S /GoTo /D (subsection.7.2.2) >> >> endobj -3282 0 obj << +3371 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 686.905 539.579 695.928] /Subtype /Link /A << /S /GoTo /D (subsection.7.2.3) >> >> endobj -3283 0 obj << +3372 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 673.356 539.579 682.379] /Subtype /Link /A << /S /GoTo /D (subsection.7.2.4) >> >> endobj -3284 0 obj << +3373 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 659.807 539.579 668.829] /Subtype /Link /A << /S /GoTo /D (subsubsection.7.2.4.1) >> >> endobj -3285 0 obj << +3374 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 646.257 539.579 655.28] /Subtype /Link /A << /S /GoTo /D (subsubsection.7.2.4.2) >> >> endobj -3286 0 obj << +3375 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 632.708 539.579 641.731] /Subtype /Link /A << /S /GoTo /D (subsubsection.7.2.4.3) >> >> endobj -3287 0 obj << +3376 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 619.159 539.579 628.182] /Subtype /Link /A << /S /GoTo /D (section.7.3) >> >> endobj -3288 0 obj << +3377 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 605.61 539.579 614.633] /Subtype /Link /A << /S /GoTo /D (subsection.7.3.1) >> >> endobj -3289 0 obj << +3381 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 592.061 539.579 601.083] /Subtype /Link /A << /S /GoTo /D (subsection.7.3.2) >> >> endobj -3290 0 obj << +3382 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 578.511 539.579 587.534] /Subtype /Link /A << /S /GoTo /D (section.7.4) >> >> endobj -3291 0 obj << +3383 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 564.962 539.579 573.985] /Subtype /Link /A << /S /GoTo /D (subsection.7.4.1) >> >> endobj -3292 0 obj << +3384 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 551.413 539.579 560.436] /Subtype /Link /A << /S /GoTo /D (subsection.7.4.2) >> >> endobj -3293 0 obj << +3385 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 537.864 539.579 546.887] /Subtype /Link /A << /S /GoTo /D (subsection.7.4.3) >> >> endobj -3294 0 obj << +3386 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 524.315 539.579 533.337] /Subtype /Link /A << /S /GoTo /D (subsubsection.7.4.3.1) >> >> endobj -3295 0 obj << +3387 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 510.765 539.579 519.788] /Subtype /Link /A << /S /GoTo /D (subsection.7.4.4) >> >> endobj -3296 0 obj << +3388 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 497.216 539.579 506.239] /Subtype /Link /A << /S /GoTo /D (subsection.7.4.5) >> >> endobj -3297 0 obj << +3389 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 483.667 539.579 492.69] /Subtype /Link /A << /S /GoTo /D (subsection.7.4.6) >> >> endobj -3298 0 obj << +3390 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 470.118 539.579 479.141] /Subtype /Link /A << /S /GoTo /D (section.7.5) >> >> endobj -3299 0 obj << +3391 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 456.569 539.579 465.591] /Subtype /Link -/A << /S /GoTo /D (subsection.7.5.1) >> +/A << /S /GoTo /D (section.7.6) >> >> endobj -3300 0 obj << +3392 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 443.019 539.579 452.042] /Subtype /Link -/A << /S /GoTo /D (subsection.7.5.2) >> +/A << /S /GoTo /D (subsection.7.6.1) >> >> endobj -3301 0 obj << +3393 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 418.561 539.579 428.129] +/Rect [526.677 429.47 539.579 438.493] /Subtype /Link -/A << /S /GoTo /D (chapter.8) >> +/A << /S /GoTo /D (subsection.7.6.2) >> >> endobj -3302 0 obj << +3394 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 405.012 539.579 414.035] +/Rect [526.677 415.921 539.579 424.944] /Subtype /Link -/A << /S /GoTo /D (section.8.1) >> +/A << /S /GoTo /D (subsection.7.6.3) >> >> endobj -3303 0 obj << +3395 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 391.463 539.579 400.486] +/Rect [525.586 391.463 539.579 401.031] /Subtype /Link -/A << /S /GoTo /D (section.8.2) >> +/A << /S /GoTo /D (chapter.8) >> >> endobj -3304 0 obj << +3396 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 377.914 539.579 386.936] /Subtype /Link -/A << /S /GoTo /D (section.8.3) >> +/A << /S /GoTo /D (section.8.1) >> >> endobj -3305 0 obj << +3397 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 364.364 539.579 373.387] /Subtype /Link -/A << /S /GoTo /D (subsection.8.3.1) >> +/A << /S /GoTo /D (section.8.2) >> >> endobj -3306 0 obj << +3398 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 350.815 539.579 359.838] /Subtype /Link -/A << /S /GoTo /D (subsection.8.3.2) >> +/A << /S /GoTo /D (section.8.3) >> >> endobj -3307 0 obj << +3399 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 337.266 539.579 346.289] /Subtype /Link -/A << /S /GoTo /D (section.8.4) >> +/A << /S /GoTo /D (subsection.8.3.1) >> >> endobj -3308 0 obj << +3400 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 312.808 539.579 322.376] +/Rect [526.677 323.717 539.579 332.74] /Subtype /Link -/A << /S /GoTo /D (chapter.9) >> +/A << /S /GoTo /D (subsection.8.3.2) >> >> endobj -3309 0 obj << +3401 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 299.258 539.579 308.281] +/Rect [526.677 310.168 539.579 319.19] /Subtype /Link -/A << /S /GoTo /D (section.9.1) >> +/A << /S /GoTo /D (section.8.4) >> >> endobj -3310 0 obj << +3402 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [524.436 260.765 539.579 271.06] +/Rect [525.586 285.709 539.579 295.278] /Subtype /Link -/A << /S /GoTo /D (part.3) >> +/A << /S /GoTo /D (chapter.9) >> >> endobj -3311 0 obj << +3403 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [525.586 236.307 539.579 245.875] +/Rect [526.677 272.16 539.579 281.183] /Subtype /Link -/A << /S /GoTo /D (chapter.10) >> +/A << /S /GoTo /D (section.9.1) >> >> endobj -3312 0 obj << +3404 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 222.758 539.579 231.781] +/Rect [524.436 233.667 539.579 243.962] /Subtype /Link -/A << /S /GoTo /D (section.10.1) >> +/A << /S /GoTo /D (part.3) >> >> endobj -3313 0 obj << +3405 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [526.677 209.209 539.579 218.231] +/Rect [525.586 209.209 539.579 218.777] /Subtype /Link -/A << /S /GoTo /D (section.10.2) >> +/A << /S /GoTo /D (chapter.10) >> >> endobj -3314 0 obj << +3406 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 195.659 539.579 204.682] /Subtype /Link -/A << /S /GoTo /D (section.10.3) >> +/A << /S /GoTo /D (section.10.1) >> >> endobj -3315 0 obj << +3407 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 182.11 539.579 191.133] /Subtype /Link -/A << /S /GoTo /D (subsection.10.3.1) >> +/A << /S /GoTo /D (section.10.2) >> >> endobj -3316 0 obj << +3408 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 168.561 539.579 177.584] /Subtype /Link -/A << /S /GoTo /D (subsection.10.3.2) >> +/A << /S /GoTo /D (section.10.3) >> >> endobj -3317 0 obj << +3409 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 155.012 539.579 164.035] /Subtype /Link -/A << /S /GoTo /D (subsection.10.3.3) >> +/A << /S /GoTo /D (subsection.10.3.1) >> >> endobj -3318 0 obj << +3410 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 141.463 539.579 150.485] /Subtype /Link -/A << /S /GoTo /D (section.10.4) >> +/A << /S /GoTo /D (subsection.10.3.2) >> >> endobj -3319 0 obj << +3411 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 127.913 539.579 136.936] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.1) >> +/A << /S /GoTo /D (subsection.10.3.3) >> >> endobj -3320 0 obj << +3412 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 114.364 539.579 123.387] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.2) >> +/A << /S /GoTo /D (section.10.4) >> >> endobj -3321 0 obj << +3413 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 100.815 539.579 109.838] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.3) >> +/A << /S /GoTo /D (subsection.10.4.1) >> >> endobj -3322 0 obj << +3414 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 87.266 539.579 96.289] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.4) >> +/A << /S /GoTo /D (subsection.10.4.2) >> >> endobj -3323 0 obj << +3415 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 73.717 539.579 82.739] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.5) >> +/A << /S /GoTo /D (subsection.10.4.3) >> >> endobj -3324 0 obj << +3416 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 60.167 539.579 69.19] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.6) >> +/A << /S /GoTo /D (subsection.10.4.4) >> >> endobj -3276 0 obj << -/D [3274 0 R /XYZ 85.039 786.531 null] +3365 0 obj << +/D [3363 0 R /XYZ 85.039 786.531 null] >> endobj -3273 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +3362 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3327 0 obj << -/Length 3552 +3419 0 obj << +/Length 2374 /Filter /FlateDecode >> stream -xÚí[sÛ6Çßý)4}’Œwâ©“8IëN›¦±3Ý™nhY±5Õm)¹i¾ýâP$NÊÍfbÇ™N¬x~²xRéÿð¤æ¨¢j"k8Å“ùú¤šÜè_¾?ÁþˆSÈivÌÓË“o_p1ÁR•š\¾çQâJL.¯Ÿžm73RO ÷²ŸýqùãÉóËxâÌ5¦Ôœö?'¿ÿQM®u~<©Uõä~_!¬Ôd}Â8EœQÿyurqòk<—ûMœÕÐUpZ#^Óþe`ž]&1Å&’s$˜´×¡eH¢Ù)búf¿Ðo(›nßšW:=Ü.ܛ׳S<]¬·À“Íf†§Û;ównsÇ횶Y/ÌQxÚÎt¹ª©>7Sʼðª*¾@‡|œùN$2¡ÎöfâÞ¼Îì­N3³~€Ïm¬D¯Ö@ °ß–Ti‰D°õh°OÛ­ô»}„ʦòûÍ|p­Ä=bê¯,Ód0Íb 0í—` -ùÅF¬Òg$úh¦S®c@›þvþòÂ9u.ogØoKS/¯#Ióݹo¯Ú;OögógÛþi-nÜ¡/5àDÞ“ÆÓ¿Ì¡»¤õ}îƒ3x2€gW²¼_8ä7Vbým„}¾X9¢;ývçø7î% ÂUÝÖáÒ¨ÄÇÁ¹—·ŽÑXæÎàíã®ê"ë®W€sÉWdl*w†™xÌ âëÅnµœ7‡¥Î3Nk\*÷’®‹ÎXÀÑ -`œâ®TsÏ=@p`‹Zê¯p¢MC¥>èZ¬Ï}«á?×ß»æº]†X×j.ð£à6R™YY9Œ²JPÖè7tãÚ7¢œßÿ°XíÞjÄw+Gþ‡eOè΂< ”ŸA%>¢cU’Ì•d´•ôK¨ò› -Q¡Z«%ª$ôÿCÝË…ÎàdÌàôïËÍ“Ñ+“¯m[-²z:ß®´“³I ˆ`óOa;«ÓÌlv÷Ü.èU‘v¿mÈq¤Í$"œ%Ú! H øk×öoWw¦¯°É€áûK{2s=6$_\OàÑøÅžÌìè—±÷‹`‡Ç®€R$«ˆ]ú®àrVÓébnªô­©ì:û[9ür4øÒŸ–‹wÝý•þÖÝ­bÂ` ùŵÿžŸãXm$3@D¸¨~m@Žc“@*„9OÚ@g^& îïvn,h{™Ö[A,}SqѬá•&rN¾œ–Áj,ýdÐï@(Óï 9Žô+ô¿D?t®?¿Z-ÖzG¦g0cÓ3ðŠ<Ža¢Çä£5VÉ @‡)J _@ã ®(ª¸L jšy»ÝïCcp•Mï¹A#•_(ÿª‘ü3³2ÿ.Zâ?P„2Ð1.9àR!^ÕþxjzV«é¡‡7°M -è2ü0A`Ú{»ÓQ„™LXÜÇ,MpB2?úAÃ;“z˜„ýôŽ~->Xƒ±`“¶ß2Ø~°ãõqÁ‘âlí³¾³íÚpX‡ÌÞLý´­íÈ AL¾þ%â£9V"É H‡Tq©g €D DZíçDKE%‰„ä/V{ÆÈtÞlÌÛåÛ¦Þ|ùï -s3´¿u¿nÓoYh~z¹8<5’;7Ê ÷ÝÆ8Í;Û|4n’NñniO¸Õ£P{TÊ?M{ðˆŽÓ„2{Q§˜Æµ“èþ;3R}ð‚üDzÖB©G§2É -P³;æCbîù´ xR&QŒ“”C&ûó{ßM­–~ë„ûÜ.ò!Œï¼¾¹¼]ìǶÙú“Ì·]˜ÉîÚŵ_êÞº×ÕrÈÎeôÜ´VÄö@2m}F}×ÆM öÈo4ЊìüµŽ…—Ìz8–ñõ‹ðƒG€#)HòÐsßcº%Hßy½Ù4&ÁXùÉ«ù+;zIsáçlÅÚ$(n5Z: üé¾_´ÖÖgøUW±È“€¼ù2ò~zÈ•×h ÆÕàΡžèôRçšÙŒ%©ú Â1¶h¦sRlúd>ßÞmŒ„œžoÞngÔNJêœÆ®n…,Ó&8úgî«æªÙÏl ë…¸²×—• ­;.þñ9]h‹ë¼Ù¹ú! {±ÀÝdǥ̙¤H† Hl;{“¾˜ÕÌu®ÍÁ,ó·yvßl|«öÔ~{¾Ù3 §Räñæ…!¦#+ffV®˜^€zúE(·Å ãÐ3Q!Rñ$”8)èµ?íPÓ^{‘œEl×;·º|ejßjiÛWßù> I^­ÛÙ0~´ LvÌñ°R§±È“€<<€¼_9ä8"g .ò¸4&þû?EøãÍ£CÜÆŠ!™bÈ™TÅUá"b€ÇŽ‚R„+Ä@>¸`tn>¾µyÔÚu$¡®©xăãXq$3@FÅÕÄ"â€Ç–+Äy&ŽÐ9œ¯ÃˆÊn3Ê[/·‡”TèîJ¨óî»°z”müœÛÑPì=$U²YðAK>™ä;ÊäûEÈCŽÃT1«ªÂT¦'Ÿ¦ŠŸ\ÿ5ã"ponûÝc6oß›,á†ÁtújFÔ´±#ß}™žE9îKÙcY&3€e'¤ÅeŸ",!Ç%UÄѺ,É?diïÅØœÆ4`ö ¼ßÂ4ˆÍ‡¨2þyfùÃ%䘙•9vÃYä8P„2GÐqh©¬‘ cœöjì*}¾n÷fæ±Î]íÃ!Óõï°4#ºE»»;ì2Oš#YøCí¯?»‰\» |`ŸX3¾yyþ/3fWÿOŠî‚ÇBŒVÃ<”e„=ÿAÀk(8¢"#HË϶ë¸nóæü™­\ß~oߘ¯ÂOÏ–ûC»4cw±6þìF_·ËM¶¿—ÕäÓÕ6]cA%3€T'fÅ5µ"¬ Ç!1¦£GXÔ'ÆO涴ùLJ{˜­'ÍF7Ÿ6)îL?Û\Ú-¦nW~ᜋG‘‡ ŽUF2”ÑTVF¿€2 DZë£I˜D5ÊYñåí”âÛ¼ÎË+‘VvdŽß¯¯v3nzËý»kwp÷â¢RøƒÃúmcÛ]íCŠ;¤* ÄÇr¬@’ §²@úE9Ž! IL“@È?ˆUÇõ•ù»°oõð¨/Ê‘P² ®Ûœ´†RïXÑ$3@4v¬(š~Ñ@Žcc¦âDœ±g¾¿ye§_÷¶ÿ÷»ñÃ,}>I·¹v‹>Ó×mž¤èX•$3@%XÅu´"*‡¦…(‰æI%¡ïye2‹&lÌuÓwë„(òu;DG!„#u‘™•uÑÅSÔÅ@ʺG]Ô U"ÓEèrökÓH\å#ôëνÝcçjü¸£9˜UV³…Gò{ÄÖ‡a,Ûd°í„¸Ì¶_€-ä8²•âX$¶aØx0þÕ¾q ⧪3…öµÆ'r>€cU‘ÌUtàoå(  -ÈqTH ™TÁ¼*VFÍnßhIpB¿JbP>zc%‘ÌItÈ”%Ñ/ Èq˜è%Œ"†ëŽ$Ò¤ý…}®ÃÎ-Ç´q¶è§g&|òÊßÑ·Á™Y -ÅTýc¡&3j'¶ÅÕú"P!Ç*Q¨êj˜½¿pS}nÖ©éìã!þù;«°B»¿]îºÛó]r¯_˜3¹„V2LíÛy«ýòo·ËÏkIÊÇÂñ×1N2àtbT†Ó/rá`(>†C=œ_\e‹K'ݪææÍ÷f:þÆnÇòÏä`Š>¬ŠçÃ0–m2ØvB\Ü1P€-ä8²­’ò-óhÏ7K{Ót³Zm9í’¾6ÉrLÀMÎ\‹ûNÔ]üX Ñ -à™…•W´ûþš€×× -‚hrOó,ßÛ߶”ÝÞ€«ª~øyOˆÃH°™Y™l'Ƥxkë@ÊlAÇ®äHHrW„nÛк¾KÅíÿ±“ü¾µk9;ÿýÚ-â„ÕRÛÙ‘Î} ¿Ø±“@0$@°_€ ä8aBÊä,,BÛCvöšÆ…‘pãE¨®f‹Qcs¢¡õ:IØý«˜>c±&3k]R\î(€r±2}´<ÆZ{¬ÝNÒòó “E¶lüs‹šÃÁ’÷«Ü¾¢¾Ýúf k¦¸ rÝ^÷«» âðò—6–W2xåa#Å…«"¼ Ç‘å¨"숗ò¼žÿkÕ.»ç§gç/ü¶/òv…ûk£DËÖÍZÔŸ–¿®±°’+). €9Ž°ˆ~•üx´_é¿X6Ú›§­š1£½ùi³ÜÇ1‡xX™Œ¿ü±L“À4-áE¦ý"L!ÇaRW)’Mõòtk#ž^üú“y‹¯Szƒ‚ð±+ˆd"ç¢_@ãPÉ•Ù";zH3zgíBWÞ0VÉÇŸý§ä­ÂH²Éª 6/)®éôý—±B^ÕºB59¦JÀÁ¨P¢ûÈŒ$¬Ê¤ó˜—I÷ý—IC^i!‘õé0?ø¦÷˜”ݪYÆŠ]¿wEïväa¨Ï¬Ž¶f›ž"ÛšÝKÔÿ6¹XzP’»À±ÏIŠVÀc’²ÐY~Næ±ÿâmµ§£zèٿ毨ÄGý¿²[t‘ª?ðPâ1ês|`ó¢=(+ñäHßðendstream +xÚí\[sÚÈ~çWðvÄŠæ¦ËÓ–cÇ [‰5öÙSµ»U+@¶U ˆ#‰8ÙÚ¿Ó=„1G1¶ÊU Ëhdú›îþú"‘¶'ÿH;®Ç¢vú®`¤=œ´¼ö•<ó¾Eô¯Í]ÏpêíyëͱðÛÄs#/jŸ_âóÑoÎa6íÐÐ)õUtþ8ÿ¹õî¼2I—»Üg0Ëÿ[¿ýáµGòF?·<—EaûFn{.‰¢ö¤ÅsgzÜê·~±³¨s¼­®Zñ¿v9¡®Fí.óÜ0äöŸ&bÅ?-pW¸.ó}ç$+¹Å¸:]8Ù¼„}æ¼Í³xÔ!ΰÓ%N\”jÔåò#ãEŸ‰ü ¼È‘sò¿„çÝýZwnƒ!»]~ î—„róŽ8ó«¶Ú8{¿Fˆ¡{F=fiÆû"i´P¾êÓ\Ê|\¦3øÒõôêË/åÁxh ø^r~Q5Ah/ +[v©T¬¼NÔÆB7±ºx0JD³ùÔèŸ÷ðŽóx‚Ê'—ò’‡`L¸50Ò(7……;} Ò·éð^„‚¢kÏÀmñ "à”(çί½“¾ç?êëüZËú×T +{ +>Hâ Ch¼R>5[%¢Yþ^{¥f<‰'½ê'ù¤®îtCý¨ïÒ€ì€RX‹æ—hÍY Õ·ÂW’ÌÕaÉ~÷—'¯æy ¥’3u}6þ'ª ,z¬³d6N‡q‰X„$lèÂÃpE^Mp1 W´Eb4ԦϢ÷ì¼<µD\þjŸ4~+.lü|íÃ>$ãÐòùXö!51b7 tPØ#÷÷**6@Øz¿ˆÆÈRBPÓ“¤Df¢98<Ã9>CØœ•™\ ¡3ÌÆò +¼JM$µ˜Rßz¾äãÏ™²–Ùxn¹@sš,‘ +*hc;Ÿ±ílg mçy'dN2=º “Te¬à;•{U¦.÷Òäf9x[ŠÑPCAÿo¬å-Li-ZXs¹AÏ!±5CÓ˜®:߈1›Ž0dÈ&Ïb¹‘F%ë‚ÏQå¾ãdbL))M)À…¦4b¢¡ ë0cu”À†‡y¦2ôÝ>€4¨äE–L%úD£‘QÔx¿[°ñGÁÆ‚-½Ÿ„8`-y9o¨kˆÁ~Aº¢³*ÆÕ=ˆ¯ñ’+`WU jƒD®Î½¯ƒ‘„š‘f˜.œ¾!xž££ÞOhÉ=-7©§ZnòÁhõç0žÂ†ïœj…‚ƒÇèç +¥”x¶¼^œ­8%£@Ô½ÞiˆJ¾YÝ@‘ÛÅõ7)ΆÕW˜@Ç)eœ—:m-åÑf„ùyð+삸eïÒw1ü•åð¬£aZ¶‘›t­ +Zç¹­êl®T¬gdU“¯ƒÝ©Y±e2êt}¹ä^¶Ÿê W¡¥W=%ò«ªË5€üy¶#˜Z}‰^7à<îÖ9íÕ¬ÿ¨©mì ¨+|öÊ!ÛH·øCA¨áTŒ^Çy%±ŽÝ1˜éS#ŽR{vXfyj”1-Ôùÿbú€ôMO;6&òù~AîÄ´(w¹XݶD|—ù\̓÷§Þ*øÀGGÜ9³ùÔLúËÞô2ë0ÌÖIZ†…´lª†©Cñ .:h1oË…ÕV·¿G +ÿ¡ènᎮ/Á´n­:«þfk˜ U.zÜ ¹Z^q ”$_¬S0?z‘ªðÁÚ]„…òÃæñ]ÃHׂþä¾0¶É2EÿºQ %#SNŸÌâ2’ŽStÚ¾˜ñÈ°C*MKYÏçëøY$Ü€ŠÇ£C¼»¥ŸŠqy"?èØ’‚I;/ ÞèÜôŒŠ×Ǹ’Ûö +Æõ¥†ì^bˆ?QÆÖ8—ù¯Ñ€JEü]€%µ¨(µ&´7©ÖbÝ#fÂ¥*»;0½Ï‹ÂƒígbÔemmÀ¢W¦ôQ°m•üÔ¨-’Ÿ£/á;³øÊPlCÒ±f˜ƒ¢‘B$Õý—Hî‹Ðj̱ ä‡æ;wV¾3bSè†0œd`$» íG xâ… {Ûeèŧë¡Õõ¢0ù ž/1|ƒFN™ÃOr Ðð%&{8‰Šg?ÉKu/ÙªC\œôþ¡Wô< Q]°û1üÛÖ.zG¸ªß¼Ç ¬ËLM† (sdés̼¡Ð'†Îu:­¤xHŸ£ÉuP0¦)˜Œë±Ž<·mJÖ°Jã©4:*s^ußÈÚTU6V¡Ž~ÿ¾ ª[ê³ü ºöåß‹¨2T®„P/&ƒYGÀóeÅÍH ^šWp—¾}ÚNál..ð÷–y?Ý]º9ºíhŸ nJ}c&\? +îÁX0¶OUÔ5Cžñ`g+ý0!äÚHk‡O—#FkOÜcM |gƒÖ¢ÒÜìÏàKcݨž|•Î6òXSJ~*}­ Nc¡‹ (æH¬‰¿F•Çêø­˜mT}‚ÑÆkM?ŠËx`'“V„~ƒÈ&ˆ˜ˆ¢ó8( $z=C/LÁ¢šà4µä1ÀÏOAYƒç³Às»Œ¢¹H÷U9ý€òFI¨!¹ECµGQ§±~ÑÀŠ»Ä¦…ÁÜVcu…êÒ> endobj -3329 0 obj << +3421 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.7) >> +/A << /S /GoTo /D (subsection.10.4.5) >> >> endobj -3330 0 obj << +3422 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (subsection.10.4.8) >> +/A << /S /GoTo /D (subsection.10.4.6) >> >> endobj -3331 0 obj << +3423 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (section.10.5) >> +/A << /S /GoTo /D (subsection.10.4.7) >> >> endobj -3332 0 obj << +3424 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (subsection.10.5.1) >> +/A << /S /GoTo /D (subsection.10.4.8) >> >> endobj -3333 0 obj << +3425 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsection.10.5.2) >> +/A << /S /GoTo /D (section.10.5) >> >> endobj -3334 0 obj << +3426 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (subsection.10.5.3) >> +/A << /S /GoTo /D (subsection.10.5.1) >> >> endobj -3335 0 obj << +3427 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [526.677 673.356 539.579 682.379] /Subtype /Link +/A << /S /GoTo /D (subsection.10.5.2) >> +>> endobj +3428 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [526.677 659.807 539.579 668.829] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.5.3) >> +>> endobj +3429 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [526.677 646.257 539.579 655.28] +/Subtype /Link /A << /S /GoTo /D (section.10.6) >> >> endobj -3336 0 obj << +3430 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 659.807 539.579 668.829] +/Rect [526.677 632.708 539.579 641.731] /Subtype /Link /A << /S /GoTo /D (subsection.10.6.1) >> >> endobj -3337 0 obj << +3431 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 646.257 539.579 655.28] +/Rect [526.677 619.159 539.579 628.182] /Subtype /Link /A << /S /GoTo /D (subsection.10.6.2) >> >> endobj -3338 0 obj << +3432 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 632.708 539.579 641.731] +/Rect [526.677 605.61 539.579 614.633] /Subtype /Link /A << /S /GoTo /D (section.10.7) >> >> endobj -3339 0 obj << +3433 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 619.159 539.579 628.182] +/Rect [526.677 592.061 539.579 601.083] /Subtype /Link /A << /S /GoTo /D (subsection.10.7.1) >> >> endobj -3340 0 obj << +3434 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 605.61 539.579 614.633] +/Rect [526.677 578.511 539.579 587.534] /Subtype /Link /A << /S /GoTo /D (subsection.10.7.2) >> >> endobj -3341 0 obj << +3435 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 592.061 539.579 601.083] +/Rect [526.677 564.962 539.579 573.985] /Subtype /Link /A << /S /GoTo /D (subsection.10.7.3) >> >> endobj -3342 0 obj << +3436 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 578.511 539.579 587.534] +/Rect [526.677 551.413 539.579 560.436] /Subtype /Link /A << /S /GoTo /D (subsubsection.10.7.3.1) >> >> endobj -3343 0 obj << +3437 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 564.962 539.579 573.985] +/Rect [526.677 537.864 539.579 546.887] /Subtype /Link /A << /S /GoTo /D (section.10.8) >> >> endobj -3344 0 obj << +3438 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 537.864 539.579 546.887] +/Rect [526.677 510.765 539.579 519.788] /Subtype /Link /A << /S /GoTo /D (subsection.10.8.1) >> >> endobj -3345 0 obj << +3439 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 524.315 539.579 533.337] +/Rect [526.677 497.216 539.579 506.239] /Subtype /Link /A << /S /GoTo /D (subsection.10.8.2) >> >> endobj -3346 0 obj << +3440 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 510.765 539.579 519.788] +/Rect [526.677 483.667 539.579 492.69] /Subtype /Link /A << /S /GoTo /D (subsection.10.8.3) >> >> endobj -3347 0 obj << +3441 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [526.677 470.118 539.579 479.141] +/Subtype /Link +/A << /S /GoTo /D (subsection.10.8.4) >> +>> endobj +3442 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 486.307 539.579 495.875] +/Rect [525.586 445.66 539.579 455.228] /Subtype /Link /A << /S /GoTo /D (chapter.11) >> >> endobj -3348 0 obj << +3443 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 472.758 539.579 481.781] +/Rect [526.677 432.11 539.579 441.133] /Subtype /Link /A << /S /GoTo /D (section.11.1) >> >> endobj -3349 0 obj << +3444 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 459.209 539.579 468.232] +/Rect [521.223 418.561 539.579 427.584] /Subtype /Link /A << /S /GoTo /D (subsection.11.1.1) >> >> endobj -3350 0 obj << +3445 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 445.66 539.579 454.682] +/Rect [521.223 405.012 539.579 414.035] /Subtype /Link /A << /S /GoTo /D (subsection.11.1.2) >> >> endobj -3351 0 obj << +3446 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 432.11 539.579 441.133] +/Rect [521.223 391.463 539.579 400.486] /Subtype /Link /A << /S /GoTo /D (section.11.2) >> >> endobj -3352 0 obj << +3447 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 418.561 539.579 427.584] +/Rect [521.223 377.914 539.579 386.936] /Subtype /Link /A << /S /GoTo /D (subsection.11.2.1) >> >> endobj -3353 0 obj << +3448 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 405.012 539.579 414.035] +/Rect [521.223 364.364 539.579 373.387] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.2.1.1) >> >> endobj -3354 0 obj << +3449 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 391.463 539.579 400.486] +/Rect [521.223 350.815 539.579 359.838] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.2.1.2) >> >> endobj -3355 0 obj << +3450 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 377.914 539.579 386.936] +/Rect [521.223 337.266 539.579 346.289] /Subtype /Link /A << /S /GoTo /D (subsection.11.2.2) >> >> endobj -3356 0 obj << +3451 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 364.364 539.579 373.387] +/Rect [521.223 323.717 539.579 332.74] /Subtype /Link /A << /S /GoTo /D (subsection.11.2.3) >> >> endobj -3357 0 obj << +3452 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 350.815 539.579 359.838] +/Rect [521.223 310.168 539.579 319.19] /Subtype /Link /A << /S /GoTo /D (section.11.3) >> >> endobj -3361 0 obj << +3456 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 337.266 539.579 346.289] +/Rect [521.223 296.618 539.579 305.641] /Subtype /Link /A << /S /GoTo /D (subsection.11.3.1) >> >> endobj -3362 0 obj << +3457 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 323.717 539.579 332.74] +/Rect [521.223 283.069 539.579 292.092] /Subtype /Link /A << /S /GoTo /D (subsection.11.3.2) >> >> endobj -3363 0 obj << +3458 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 310.168 539.579 319.19] +/Rect [521.223 269.52 539.579 278.543] /Subtype /Link /A << /S /GoTo /D (section.11.4) >> >> endobj -3364 0 obj << +3459 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 296.618 539.579 305.641] +/Rect [521.223 255.971 539.579 264.994] /Subtype /Link /A << /S /GoTo /D (subsection.11.4.1) >> >> endobj -3365 0 obj << +3460 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 283.069 539.579 292.092] +/Rect [521.223 242.422 539.579 251.444] /Subtype /Link /A << /S /GoTo /D (subsection.11.4.2) >> >> endobj -3366 0 obj << +3461 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 269.52 539.579 278.543] +/Rect [521.223 228.872 539.579 237.895] /Subtype /Link /A << /S /GoTo /D (subsection.11.4.3) >> >> endobj -3367 0 obj << +3462 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 255.971 539.579 264.994] +/Rect [521.223 215.323 539.579 224.346] /Subtype /Link /A << /S /GoTo /D (subsection.11.4.4) >> >> endobj -3368 0 obj << +3463 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 242.422 539.579 251.444] +/Rect [521.223 201.774 539.579 210.797] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.4.1) >> >> endobj -3369 0 obj << +3464 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 228.872 539.579 237.895] +/Rect [521.223 188.225 539.579 197.248] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.4.2) >> >> endobj -3370 0 obj << +3465 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 215.323 539.579 224.346] +/Rect [521.223 174.676 539.579 183.698] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.4.3) >> >> endobj -3371 0 obj << +3466 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 201.774 539.579 210.797] +/Rect [521.223 161.126 539.579 170.149] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.4.4) >> >> endobj -3372 0 obj << +3467 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 188.225 539.579 197.248] +/Rect [521.223 147.577 539.579 156.6] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.4.5) >> >> endobj -3373 0 obj << +3468 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 174.676 539.579 183.698] +/Rect [521.223 134.028 539.579 143.051] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.4.6) >> >> endobj -3374 0 obj << +3469 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 161.126 539.579 170.149] +/Rect [521.223 120.479 539.579 129.502] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.4.7) >> >> endobj -3375 0 obj << +3470 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 147.577 539.579 156.6] +/Rect [521.223 106.93 539.579 115.952] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.4.8) >> >> endobj -3376 0 obj << +3471 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 134.028 539.579 143.051] +/Rect [521.223 93.38 539.579 102.403] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.4.9) >> >> endobj -3377 0 obj << +3472 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 120.479 539.579 129.502] +/Rect [521.223 79.831 539.579 88.854] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.4.10) >> >> endobj -3378 0 obj << +3473 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 106.93 539.579 115.952] +/Rect [521.223 66.282 539.579 75.305] /Subtype /Link /A << /S /GoTo /D (subsection.11.4.5) >> >> endobj -3379 0 obj << +3420 0 obj << +/D [3418 0 R /XYZ 85.039 786.531 null] +>> endobj +3417 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F59 3455 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3477 0 obj << +/Length 2336 +/Filter /FlateDecode +>> +stream +xÚí\ÛnÛF}×W}¢€ŠáÞÈåclÇFŠ:I+§ Ðö–h™ˆ$ª$UÅ@?¾;³»e]";-;„‹—%EÍÙ™9sv—¤í©?Ò–ÂõXؤï +FÚýqËkÕ™‹1-¼6w=_À©“«Ö«sá·‰ç†^ؾºÁ&Wƒ?ÓtÒ¡Ò)bý‘wþ¾ú¥õæªr“.w¹Ïà.ÿ´þüÛkÔýÒò\Êö\m{. Ãö¸ÅsgfÔêµ~+ï¢Ïñ¶¾jͳvY¸DªOÏ•’—ÏLÄšg&Äå®p;Ä!n§ËeèœfqT$“a§ËsŠ[u*†mîœEEtåjú£š 󆕽åmç~ù=û3_„øj{ÅjÙ°­7~¿Øj,yÿžÄw™Ï—o¹È…»B- éä/pud8ËõØøáÞ Ú`õh¬˜ÁêcÞé§I9ЇQ„»:2|-ÌQØ°q>ïÐÀI3ÕhkGS;Øê \ØÏî¦ê³ˆ¡ñNÐM—«g`ò8ŒÖh|nŒ*pŸh3¾Ka§ V:MG3µ=†í‰¶!D3ÝîFÉÒ± x&Ú]u$s¢kun¤Ž„?þÿ8£sB]O†Úêb£û.Äßù|ù«J!9¶`sTq,n@Å ÊäJÊ‘º”så(è#ãt²AY†á‚¡Ïƒúàåô{–zßï´;áKŒ×~Ì1“d¹øv"”“Ô$§_Ó!Àï?.—ü@®Yvt=v'°—\ýõH@<0‰,Õy¬PmNûÔ‘\¥ºJŽ<‰úÀ¾¡ˆ'æR$úªf1t…Œ fÀXâåªdR6j¦7ð,ªL”•›¸ÌcæVÑL•V]A…3Ž‹Ûtë+–¾6`®'sÁ3ð³£ÁÔä>ªÊm®­‘«÷Á ÞÚP¿-äÎEŽÎ¦€|à\‚oL§KT_þoq¶§7?%“AÚaÄ™#U×ý&B7Sg?¾{ûy%¡0¡«{x° ¶Úð¨|ÅVréÁ>FBèR—еz‡1Oø•ßp +Š¹ØÃ9Ä QQ|;‹íïVNÙðrkNtSãD…j†´áp~xŠH1 ÈgIÞÜfšª Ä=Îý#Eë…-jÈs€¶%ŒgñMX +M É÷Ÿµ;_`ù<›šAµ0žNß‘?Œtrü9†nñv`DÒÄx¿æ5úáRIùœø`P4–¾ù +™+¶©*ÀºKÌZè¡¡d …ßd•Ð)¾ +‹ëŒ±×Ï’©É‚ŒÊ&>>QY‹²2>ö¢qÕù04Ž!¸]ƒ8‰©+®[¥t®©9%tÛŽ&ÓÜ•¼xï« +0ÁÍ”}§År|Šo-m…ÃËÖo¿ XÏ>x%o¤Ç'Š”a-ÞÇËH ¡O·ŠüTzXÉÏqØœl”ƒ>B òà Š0¤1¼ìi²b  ©o^©û/Tq1׬c.{èe(-D t +ßGazæÕä?líµÀ.Ë…,äæ³t%I…4Û}‘¸a Ì]½7©ˆš¦R*†aj8µXêÕoñ¹ëÑÐ\ZI©‡v¼£Á»ªFÊïQ#™V#Ï“TÌ?kñ,Éâ~*#ª”wVe´ó€öÜ¢&‡mb}Ùë~?ÎóRÉ.´Â9²îG“dô©4IÖh’OK.Ö@¿wîÈJMÒ¸„N½;«LñXR½#V^bÏËéz(_A^á„4 n•žl°Šô¨9s>aÚ34!pæÁwWç†Dà(v:žFX=綄˜Û!kƒ8äbø„:ckv(¾ït±` ‚ÇDõöaý|Êr½Kœ Ëf•k¬}TÊÉô'Ïc 9ß`LQb–!.ÅÁ2¹%˜÷0XPß•aQgÃ{!QÅÃNW†~Ós•U{0¥:²ÓY \ü,Ñ*=„³×Õfl0‡ßd¦Ò¼A-žÆV¦Q-ñHZV­]œ›åÕY»§F +¦!¢ˆ±“üh1¨ƒA,ßÄN9‰zd’ÃøvŽÓˆOª€²…K1<ƒšÖE%,;¹MT—‰åè:ʦh§³ûáÎÚ–qÚÐŒ †•uä/«Óo«¥hÁ2†Ébhë6*™#ȺŒ5Uô!‘} _.$úerR ‡ã$/׶¨ph¤_tÚhc¤4S:”…<ùcúa «^ X‹õzŸPhý¼,ŒyeÂoš});ëàU/Îô„qéKXñµó‹]­O·XŸzÞ×WŸ?ÀÚ¿YˆG¸WGv² X¾!m­xqñC’å4¶NIõÂÑÛR5Ô1ª/”E×8j™p^ñI.Äñ&NjI,‹e'+Z’µ¨Y ytWç–­Þ¬­¬.ð»2#.'¤f¥ù5Ï€W¦C¸…äG˜2jÃÁD$ñ¼ÄàÜ( [LhI\dÚEzj“Ý-é׳•^VBç´&tØvtÞÏ'q–ß&*ÔøÄoêŸÀ$v@‰oGÉ.ÛÆY;˜fwÕ(<ºׂ™ò3D…ÕÁ†•^Ò{VMn”S"š÷$< L–6ßHZqê-^"h 9hú–¤¥Èe ¼á®â*ó›+Qîá¾°ÇkÂǾqÁÔªÖèÛÁ"æÌ;º]}YO¯@mfe‹"æyû‹0^N973dL*ëÑ‹/?U_W’EãxiŒ–Iñ,;Kºbõ_x …)\Pd ,·žqEV›N±‚U.ȃà‰û¹_Gï7óÀŸH ðk cþ^A¡_TX‡@"mD‘ R½%zÕ º^YŠú2|¹¤º.¬Ö ¾7Z—M¸°Ð x–Nì0k¾f10ýÕN6Î:…Åš)Ô¸2´/>ÀH»zCÊ]É¥is£Âƒ ª+ý¬B:3˜‘¼zkº!±Ñ‹U“ôÀμÿN kêle' –S Õ).pð!ŸFœ c£§¢ŠQ¾ Ã&CÓ»Bú¼ýò‘ØYÏ\ºë_=¹€ë;ÞÉ©ë«/Ø ûU‚¥Û,ý˜ÿ8ö:endstream +endobj +3476 0 obj << +/Type /Page +/Contents 3477 0 R +/Resources 3475 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3474 0 R +/Annots [ 3479 0 R 3480 0 R 3481 0 R 3482 0 R 3483 0 R 3484 0 R 3485 0 R 3486 0 R 3487 0 R 3488 0 R 3489 0 R 3490 0 R 3491 0 R 3492 0 R 3493 0 R 3494 0 R 3495 0 R 3496 0 R 3497 0 R 3498 0 R 3499 0 R 3500 0 R 3501 0 R 3502 0 R 3503 0 R 3504 0 R 3505 0 R 3506 0 R 3507 0 R 3508 0 R 3509 0 R 3510 0 R 3511 0 R 3512 0 R 3513 0 R 3514 0 R 3515 0 R 3516 0 R 3517 0 R 3518 0 R 3519 0 R 3520 0 R 3521 0 R 3522 0 R 3523 0 R 3524 0 R 3525 0 R 3526 0 R 3527 0 R ] +>> endobj +3479 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 93.38 539.579 102.403] +/Rect [521.223 754.651 539.579 763.674] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.5.1) >> >> endobj -3380 0 obj << +3480 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 79.831 539.579 88.854] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.5.2) >> >> endobj -3381 0 obj << +3481 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 66.282 539.579 75.305] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.5.3) >> >> endobj -3328 0 obj << -/D [3326 0 R /XYZ 85.039 786.531 null] ->> endobj -3325 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3385 0 obj << -/Length 3279 -/Filter /FlateDecode ->> -stream -xÚíœYsÛ8€ßý+´oRÕ -!.¹œÊÔ8•];›TÍÎmÑ2+–ä¥èñäß/n€Ñ3ÌQ±ÔTÆ:ØB³¿F£Ñˆg™øÏJŽ2ZÍŠ2GœâÙÅæ(›­Å7¯Ž°¹bi.Y×<;;zrÌóÎP•U³³K÷;U†x•ÏÎV¿ÍŸï¶ RÎûFÿÙ/~?ûåèå™ûá iL©üÙÿýö{6[ ~9Ê­ÊÙx!\U³ÍãqFÍûë£Ó£¹ßÒß±™–» NKÄKßæÁmà#–ÑYÁ9ÊY¡î‹G uîMàx·o¤ƒt{í*Ú×ÆYÔÐë€.£ùn-ݨ¢?H˜æšÊ_‹ì-€û°Y€yª1Ç[††9G~.ÇèyÓn×ú}½¨WÍJ¿ëwšÿéí5çõÅ‚ó2j¶æR)'2ƒóZþ~U”ßž¾÷©üœ€0°*@1j ´jYæe!>Â&50ëÛ^˜ýJP±¾é¯3Agµ×è$—†,¿7Ø·ºgÓù$©F„/~ϵƚH?K〠UŠÿˆ -‘0Z \ÎÄ8-ðç÷vt_æ9EŒQ§ÉâiŠ½F«&ŒT±ùI}s£{¶ð•“Sù·˜¿oì­ô…ÕnA±ðãÒŸTo½{óúƒ~õªÛÝÞèK"ƒgún½v ¡õÕðÍþ¦ºš% í+6°™?- žæbŠD s¬œU¨Ñ›ëxQ2ݵêþVæWa7«mt|¦>ÝêIžÿ7ÃL¼ÈeU‘7Ó²6ÚW½ÐWC^€ Å*¤ƒ5Ø°sš#ê 5ðJGyÑîU~u«³oñ¿V&TŒå÷”ø½tcÛ©ãŇ ¹Qœt˜XÀa †Ýð.(ªÀalzþòO™T©qýF¼º6å•ç»­ ëÛN¥]Ê“ª’>ÒdÜh*u/POI’z¬@jØ…‰¬B„å–:usö® «o=ˆœ^tí6()cÁ©náÅ·éPšt‹XÀ- †m0àGyUx·°Áà´Þ„A@ !9;—u\]¨• ƥșÔc­æn2‡“ïô$?joÄ |`‘ÀZg"ò@,|`ù4òÒÈÁ†òR„|Vzäv®.;¼ uÓgãñßx„ÌÔåÕúb‘ûË7®¦_ЇÚØd*h/€í €ŽU@C ÛÏsque‹ˆý,Ó~‘‹kNu/¸HHŠ²¤‹Ä*.5ìbsR¸ˆ ÿOW²’ãêt¯lT7sM5Q_Æ‹kñ 'ø‡¨ÓZ{Mu/8AÈp‚XÀ  †0Œ¸w2CÉü}»ÕE>‘ ÜÅ;ÿУÇd1Uߨ[éSyÆ¿&9u“S¹Y!€š7Àì°q€XºIÇ‹¨âØ£1¡Ç“c^ÂETÈfJêÅnS·2üóRV軽´V`TÜXšýU3òÛTÖ¼ˆ¹ôíNám:ùóÅübÝèÑ%n%gHŒTZrí2 -^òoÛÙSNb,;ÕM¼à(!5ÀUb¾¨˜Ë3*œ.æÚk´jº˜{ܪ=ÿÔeÙm×\ôª€ÛI ŸlWvMúx¥Ê’êšF‹=½¸hö¦Ø+fš}çöw$Ë»¾§¼ ÞÞáoêûË“¦÷¿—w XÞåÂô´ÀpnÆÊ -U®âü³¼û5B¼µéÄÞˆ¥{ïWÒ…FTH‡z°aç(E®·q[Þ5ÝSš§Ÿö}c6F‰.§ÂïÞ9sûȤCíäÐÊ0þ1<ÂoªGx1À#`Š¤GÄ*5l‡–TºÂqP¿Õ©¿WI€É¶Šùñ‚7gÇ&{®Âðæ¦V…™½ªq[fô½Yâ5Ër*-ßØZЩxóIùWoCÐF:+¾As³S z1€àÀi‚± -A¨aGUˆT¹'hSî“Zõzí’n1îZ‹á·kU·Î2ú¸gYÖ>S¡{1úÀöÉ5õèPÃ:娰û8%t›µB¹ã_´jøWÁ¼WÅ™O.Àë¤à ¸‹È. ¬ùÃ"mŒ2•´H ž&«†vC¶P»Ê®[j9•[–ë΀~ÑÈ´Mv÷V¯§ÉÀüTáNóU#zQänœ6›ê^ pƒK®³Ž¨¸Ô°ëðY‰rW÷ –V잸AVO -êÏÔ$@_¹ -‡má •ò5à‡ài¦òöbïÐìïX€7Ô°åM+1tEÜ`]eb€+7vÝLÕê۽ܽa³Ð+¨2ß“NQäÅ÷dkÍ0‘m –f;0qšíˆ -i¶`ÃŽm‰ç­»OZ»½FíkIºÞ6»ÛÃèméPFwòfL5¿“èøQû{ U;šÓ¼D™Ý„IÝ*4Ïö°Å‡n;…Ü:[»t^.šPú#•g¬!§z†\#„Ä’ÛjFTœjØ.k°w¸ýƒl/ˆé›v¿·mÓOTب×ÞUmÊ5rÜyÈ‘ÀØf*p/íÎ’‹ê#*À¡†í¹FÊäGdϱ9×ø^m€XéU.WwaúÅ{YÜÝuíÑÛýVON›îu¼A-š{„ÐÜíT„^ @Z@« „vI(§ €dÙŸO>¼•§óÇ3P3LeëŶ¡‰¶± -[¨a7Z  eæÊåöhâ_”FÁšŠ”ûµÝ÷{›À/\îí ¤¯]…]GùÝ:Ótõ¹Ú#Ñöò{‘á3ο9Xcƒ©`½6´/K®bŽ¨€…vm–!âSp¨0ª™Z(TN¥UPuC®Ú±h8¾Û;‰7g¾°­k­j£›c¦§kõõn-ËÜœ~;ræ&§’ób¹Ð€¹X€Ô°%GÊYîÉÙyñÚæÎ186Ë "QnÜÁ…n€ÀfÒæy§µÞjߺ„‹•ø¾Æ\k‹‰€±4àÓ€GTHv€ Š0Ó1À²Üiëàë°;›]©Â†¸zÜ“dk²©~àÅ?q0žôƒXÀ †ð -åYáý€Á}×¹E.S“ãrgzûÛ…Ýöô’¬mýí Ñw#kŒ0•¬ȆÈÆ*d¡†mÆLXŽ2^ÈúIÏ ¾c3«˜?ºNl¬2µP‡gÉý&#*¨¡†jJϪÔvrt°uÕašÅ‹×Xb*^/à ­ àUðB »KTC5·Y´9Æß^Ê…ˆÁ œ²{•Z»°³ž¨û3Æï;nm™©´;°9À:j@ ´êHg¢ïbOÚ>½ÉÌTÅÌôÂ.<Óù]k÷ü„ÖÚ÷µš+×Ýj4åv‡»ÌŽÅ&x2D½ÿh&aªæ]›ÇE„ùçô«€Ó7:œ“À&dÉýAqû8 U W•y@®øúäT2,Jö½:úu~Ûû5F}¬K>ÃA„ÎðWìqöF'’ ÄÒèFdÉG§Œ¨†6l P¸(Å®>œÿ> endobj -3387 0 obj << +3482 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 754.651 539.579 763.674] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link /A << /S /GoTo /D (subsubsection.11.4.5.4) >> >> endobj -3388 0 obj << +3483 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 741.102 539.579 750.125] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link /A << /S /GoTo /D (subsection.11.4.6) >> >> endobj -3389 0 obj << +3484 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 727.553 539.579 736.575] +/Rect [521.223 686.905 539.579 695.928] /Subtype /Link /A << /S /GoTo /D (section.11.5) >> >> endobj -3390 0 obj << +3485 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 714.003 539.579 723.026] +/Rect [521.223 673.356 539.579 682.379] /Subtype /Link /A << /S /GoTo /D (subsection.11.5.1) >> >> endobj -3391 0 obj << +3486 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 700.454 539.579 709.477] +/Rect [521.223 659.807 539.579 668.829] /Subtype /Link /A << /S /GoTo /D (subsection.11.5.2) >> >> endobj -3392 0 obj << +3487 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 686.905 539.579 695.928] +/Rect [521.223 646.257 539.579 655.28] /Subtype /Link /A << /S /GoTo /D (subsection.11.5.3) >> >> endobj -3393 0 obj << +3488 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 662.447 539.579 672.015] +/Rect [519.586 621.799 539.579 631.367] /Subtype /Link /A << /S /GoTo /D (chapter.12) >> >> endobj -3394 0 obj << +3489 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 648.897 539.579 657.92] +/Rect [521.223 608.25 539.579 617.273] /Subtype /Link /A << /S /GoTo /D (section.12.1) >> >> endobj -3395 0 obj << +3490 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 635.348 539.579 644.371] +/Rect [521.223 594.701 539.579 603.724] /Subtype /Link /A << /S /GoTo /D (section.12.2) >> >> endobj -3396 0 obj << +3491 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 621.799 539.579 630.822] +/Rect [521.223 581.151 539.579 590.174] /Subtype /Link /A << /S /GoTo /D (subsection.12.2.1) >> >> endobj -3397 0 obj << +3492 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 608.25 539.579 617.273] +/Rect [521.223 567.602 539.579 576.625] +/Subtype /Link +/A << /S /GoTo /D (subsection.12.2.2) >> +>> endobj +3493 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 554.053 539.579 563.076] /Subtype /Link /A << /S /GoTo /D (section.12.3) >> >> endobj -3398 0 obj << +3494 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 594.701 539.579 603.724] +/Rect [521.223 540.504 539.579 549.527] /Subtype /Link /A << /S /GoTo /D (subsection.12.3.1) >> >> endobj -3399 0 obj << +3495 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 581.151 539.579 590.174] +/Rect [521.223 526.955 539.579 535.978] /Subtype /Link /A << /S /GoTo /D (subsection.12.3.2) >> >> endobj -3400 0 obj << +3496 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 567.602 539.579 576.625] +/Rect [521.223 513.406 539.579 522.428] /Subtype /Link /A << /S /GoTo /D (section.12.4) >> >> endobj -3401 0 obj << +3497 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 554.053 539.579 563.076] +/Rect [521.223 499.856 539.579 508.879] /Subtype /Link /A << /S /GoTo /D (subsection.12.4.1) >> >> endobj -3402 0 obj << +3498 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 540.504 539.579 549.527] +/Rect [521.223 486.307 539.579 495.33] /Subtype /Link /A << /S /GoTo /D (subsection.12.4.2) >> >> endobj -3403 0 obj << +3499 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 526.955 539.579 535.978] +/Rect [521.223 472.758 539.579 481.781] /Subtype /Link /A << /S /GoTo /D (subsection.12.4.3) >> >> endobj -3404 0 obj << +3500 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 502.496 539.579 512.065] +/Rect [519.586 448.3 539.579 457.868] /Subtype /Link /A << /S /GoTo /D (chapter.13) >> >> endobj -3405 0 obj << +3501 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 488.947 539.579 497.97] +/Rect [521.223 434.75 539.579 443.773] /Subtype /Link /A << /S /GoTo /D (section.13.1) >> >> endobj -3406 0 obj << +3502 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 475.398 539.579 484.421] +/Rect [521.223 421.201 539.579 430.224] /Subtype /Link /A << /S /GoTo /D (section.13.2) >> >> endobj -3407 0 obj << +3503 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 461.849 539.579 470.872] +/Rect [521.223 407.652 539.579 416.675] /Subtype /Link /A << /S /GoTo /D (subsection.13.2.1) >> >> endobj -3408 0 obj << +3504 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 448.3 539.579 457.322] +/Rect [521.223 394.103 539.579 403.126] /Subtype /Link /A << /S /GoTo /D (subsection.13.2.2) >> >> endobj -3409 0 obj << +3505 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 434.75 539.579 443.773] +/Rect [521.223 380.554 539.579 389.576] /Subtype /Link /A << /S /GoTo /D (subsection.13.2.3) >> >> endobj -3410 0 obj << +3506 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 421.201 539.579 430.224] +/Rect [521.223 367.004 539.579 376.027] /Subtype /Link /A << /S /GoTo /D (section.13.3) >> >> endobj -3411 0 obj << +3507 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 407.652 539.579 416.675] +/Rect [521.223 353.455 539.579 362.478] /Subtype /Link /A << /S /GoTo /D (subsection.13.3.1) >> >> endobj -3412 0 obj << +3508 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 394.103 539.579 403.126] +/Rect [521.223 339.906 539.579 348.929] /Subtype /Link /A << /S /GoTo /D (subsection.13.3.2) >> >> endobj -3413 0 obj << +3509 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 380.554 539.579 389.576] +/Rect [521.223 326.357 539.579 335.38] /Subtype /Link /A << /S /GoTo /D (subsection.13.3.3) >> >> endobj -3414 0 obj << +3510 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 367.004 539.579 376.027] +/Rect [521.223 312.808 539.579 321.83] /Subtype /Link /A << /S /GoTo /D (section.13.4) >> >> endobj -3415 0 obj << +3511 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 353.455 539.579 362.478] +/Rect [521.223 299.258 539.579 308.281] /Subtype /Link /A << /S /GoTo /D (subsection.13.4.1) >> >> endobj -3416 0 obj << +3512 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 339.906 539.579 348.929] +/Rect [521.223 285.709 539.579 294.732] /Subtype /Link /A << /S /GoTo /D (subsubsection.13.4.1.1) >> >> endobj -3417 0 obj << +3513 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 326.357 539.579 335.38] +/Rect [521.223 272.16 539.579 281.183] /Subtype /Link /A << /S /GoTo /D (subsubsection.13.4.1.2) >> >> endobj -3418 0 obj << +3514 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 312.808 539.579 321.83] +/Rect [521.223 258.611 539.579 267.634] /Subtype /Link /A << /S /GoTo /D (section.13.5) >> >> endobj -3419 0 obj << +3515 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 299.258 539.579 308.281] +/Rect [521.223 245.062 539.579 254.084] /Subtype /Link /A << /S /GoTo /D (subsection.13.5.1) >> >> endobj -3420 0 obj << +3516 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 285.709 539.579 294.732] +/Rect [521.223 231.512 539.579 240.535] /Subtype /Link /A << /S /GoTo /D (subsection.13.5.2) >> >> endobj -3421 0 obj << +3517 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 272.16 539.579 281.183] +/Rect [521.223 217.963 539.579 226.986] /Subtype /Link /A << /S /GoTo /D (subsection.13.5.3) >> >> endobj -3422 0 obj << +3518 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 258.611 539.579 267.634] +/Rect [521.223 204.414 539.579 213.437] /Subtype /Link /A << /S /GoTo /D (subsection.13.5.4) >> >> endobj -3423 0 obj << +3519 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 245.062 539.579 254.084] +/Rect [521.223 190.865 539.579 199.888] /Subtype /Link /A << /S /GoTo /D (subsubsection.13.5.4.1) >> >> endobj -3424 0 obj << +3520 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 231.512 539.579 240.535] +/Rect [521.223 177.316 539.579 186.338] /Subtype /Link /A << /S /GoTo /D (subsubsection.13.5.4.2) >> >> endobj -3425 0 obj << +3521 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 217.963 539.579 226.986] +/Rect [521.223 163.766 539.579 172.789] /Subtype /Link /A << /S /GoTo /D (subsection.13.5.5) >> >> endobj -3426 0 obj << +3522 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 204.414 539.579 213.437] +/Rect [521.223 150.217 539.579 159.24] /Subtype /Link /A << /S /GoTo /D (subsection.13.5.6) >> >> endobj -3427 0 obj << +3523 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 190.865 539.579 199.888] +/Rect [521.223 136.668 539.579 145.691] /Subtype /Link /A << /S /GoTo /D (subsection.13.5.7) >> >> endobj -3428 0 obj << +3524 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 177.316 539.579 186.338] +/Rect [521.223 123.119 539.579 132.142] /Subtype /Link /A << /S /GoTo /D (section.13.6) >> >> endobj -3429 0 obj << +3525 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 163.766 539.579 172.789] +/Rect [521.223 109.57 539.579 118.593] /Subtype /Link /A << /S /GoTo /D (subsection.13.6.1) >> >> endobj -3430 0 obj << +3526 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 136.668 539.579 145.691] +/Rect [521.223 96.02 539.579 105.043] /Subtype /Link /A << /S /GoTo /D (subsection.13.6.2) >> >> endobj -3431 0 obj << +3527 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 123.119 539.579 132.142] +/Rect [521.223 82.471 539.579 91.494] /Subtype /Link /A << /S /GoTo /D (subsection.13.6.3) >> >> endobj -3386 0 obj << -/D [3384 0 R /XYZ 85.039 786.531 null] +3478 0 obj << +/D [3476 0 R /XYZ 85.039 786.531 null] >> endobj -3383 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +3475 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F20 3021 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3434 0 obj << -/Length 3495 -/Filter /FlateDecode ->> -stream -xÚíYSI€ßùzØ)bUÓÕut÷Ó† ö®g f „'bvI†b[ÿýÖ‘uH­J»±!&f$¤ÊÎT~YWÖ1t©è $cÕ (%Œ&—;ÙàL}óÏ -%ÆPd•yy¼óËk!4#UV Ž?úçT•Oî.®Fy9\ÍìËrôÇñ¯;¯Žýƒ#Õ”1ýØÿíüþG6˜*~ÝÉ«ÊÁ'õ>#´ª—;\0"8ƒ¿ç;G;ÿñϲßñ•Úö+8+-c–‘²ä[‹ÐŒž1õK… ’þ—æÙ–_ -eô/¥œŒÆ¾næ#:œÆLÃújjß¼ŸM#F‡-üýv¡^³áä¢Q…¯Î6Ý"råÂ’ "#ìWíÙÀ¾yÙìJã6o>Ó-òŽjVnªîú<=Î Í¿0ºh.½ITD&9g<'™b~¤Ê“9W®•\{’ëÕòSkÞ/•çת7/ͧWÖétøߌrõ^…Ú¸ªò¡z”È2ý«*úkë VäÅïöèNèä$§•÷iN"„¬Ô8ëòÚ|ö—B¨kB'N\Y\±”\•æ• ”e¯YN4{$K#jwÆœËJüA ø¶oÀ1$`bnHÀtM@SLsIxÅ…úÔ‹nW˜”Ãw×*N®Uè”ÃE«ÛŠÝz4&rVºAžè–…›FZ•™Œòbx¡K¨†Ú49ïnuo6ko×ê|é–îAGT -»òP_äVÁí¼.XõºZsJ•Ð&è¶a2jÔ¼¬†¯þ´8épî Í4Ÿ¶L_LL±™m?fй«Âµïxª"è8­7úõRÔÈÏB$¹vô#h­Ž®, õÝÀ›Þ} u¾jt…žHã Žú¿†e®XÖ­«¯0ˆPÕßÔô׺vϵLEùÃé~|Oš‘XçšcÓ<·˜Š*öD N˜È7ˆ2 zrðæ7ËIJaà çȾß70“p•VÃœX¤†¸«¸~nXËR>œðËûâ bÎØ«ή NL±Ç)ÕdJ½®ãä€óHSXèôS¶Óá/îÉU;›7õ)Ô_Íý`¶Ò„?i!Ó=_h°Y.P½„ßÜdC@Æþ2 ²kSìAò‚ä‚o€-íøÄV3à·W¯ ¼zé]ÉÅc_§È‚ú’ bÙØÁÙ® YL±'Ë)²M²ÈîíKÍqUÛZx¤þXï/ÅÚØç‘L£R˜Á#}11sìms×3¦ØcÎ3¢šþ Ì`~ óÕ´šñ¬éb?Bg©-‹vŸØa“ªâ%{Ô”Á!})1„rìl„rׄ2¦ØSÎ$QÿnP.ò‹éíHHÕ˺iŸÈÔ—ýi 3Øk=ÿÕìJ•¼¹jÜähÕLl‰µÉ/d)͇6„êËÙ -ÂħKú]˜ÁÏëË,ˆ!Ìb׉"ɬk S옉Š‘LÌ*×µ6K›¯2#ܶq)ÕÏí‡ÿjÎÎaÀkñ6sÓë6s]t¥©Yl)Š‡S÷ÜOîÉ1Ks\sgšãÒQÅ.ý(ŠŠˆÌ穤;uëŽé%·hÒ.ÿ"ËqRÑy¬o1$ b¢L†A×$ 0Å.©(¤ •ˆÂÀ%M¶IÃXó3ÅV%ÎnZ3È2Õ½*ÙOÇvOÔÁA}©1„zì|Q%©wM@¨cŠ}#.rõZ­Q‰Æ½fYŸÎã~òݵû†:nÙÓ¡ éK9ˆ!”cg#”»& ”1Åž²*]Ê Èyò¿gíÕl½´«ªx$(í¯îKÒK! #";úŒˆVßQç‚0ê³Æ:ê}H#~0½íÔ§¦–¶~§ûm?.Ö «f bè®ÜFwégö 3؆aönm¾?Ouçvç?Š+ø¡/Ø †},³$Ú® [L±ï~)%…Ì\×ý~°ÓØ‹å -zX3ñq)ŒöVC±“"ûÕ+à¢?ש+.‹§Ó8ƒ“ú’bù€L®æn1!)väyU*"ò9?šµ°$ Ðam6ÐæÃWº>[àM”Ö* -ñPÆÐ÷ Îi=#!KG™\ìÝbB:PÅ®ç%'RúU ü¡ ‚%L¶ÖÖŠö ·©ä¶Õ­ûµ™é†¢¤Õ_b‡s[ßXbH,ÄHX蚀ĦØÇBA ¥>½-!vf"vé:]ÿÛváÒU4Þ´5DÀ›}C$ˆ!!“’<"]ÁûŽCDMòBˆ¸!ÃÜÏÏJ7¨#«é©˜Y«ƒÅ-U^FÛ -ê3ý†Iñä: pT_úA ¡C@èwM@ècŠ=}ÎIFe ï† ‡†ïé|v 3C·ÖÁpÏòtöÆìÑehOöö„wª€ŒG–®ÍùàgzA;ì;ùíPÀ~0[pC_¶A a»X&·l1a‹)ölYFÔ¸=°eÀöíÂÑ›Îæég8u£?¿Cd•„mÈ…ÍbÐøÍÆn§‚Îô^Øï>5«ó2Ì@éHç~ipJ_ÒA !;!Ý5!)öÝ<•¤¢žtÝü‹©æÙ˜ _X1yo·Oý<\äÏ<?ö Ž †GÌ Ž® ɳ¹šç‰?«Áª\ªÐ³®ŒÍDÙ³G³ÉM분š0‘…^Í9­S2"M_s 5ló™ÖiÉ¥äèYw9ÁªŒ0ö…}ö¬( ç+wãMÈ—ØaÓôÆͱ!ß’Ï;í¿\Á»=+`J׿˜Iýé¦Óê£E -¤—üùøÎwˆðiß bH”ļ0éš€Ä ¦ØŠ ¤¤>PÜúùñ¨T“-›87KåÛs³%Íær&7K¿yß®Ýö%;Œ·»Q&«Æ ×ôö]\ÕË›õÍßëyû7v^wcÆ}´ø©äÁI}É1„| !ß5!)vÃtÕãÜ¥ŒE´d~²ôë$ç‹%¤êNëhã>3ké­â;ñcusºë -¥:÷ôeÄæ±ëer·Ìæ˜bÏ\ Ý -ÊóÜ3'S¶­(»J:±CŠ’ʧžw^ê‹>ˆ!ècú® zL±GO)¡’ô¬[Ý8Þ~Ôó¶x¥f½¾ë.@G‚|‚ìÁM}Ù1„}Œaß5a)vìóª ÒTäy—=l2‡Á^;3‡=j™ëeXþn÷Î{=C"K‡Ä™Ü0·Å„tH Š}H”œd2 - ‘ ‰7‡*vÿéXÁäíìrÞg}è ‚õÄð±ÿð]ð˜b¾Èˆpia ^øƒã·û·¹[¬÷‡÷ÛfˆË‚þ¥ª=8ª/ý †Ð!Èä¬-& ô1Ånº— I*—*~ÖÉõ™Ù;7QÙ³ª0ÇÉtz‰>§ÖcÜÙ7F‚#1*$Fº& 1‚)ö1ÂÕºí¼~#Çóâý·…x³oˆ1$DbRHˆtM@BSì;‘¼"¥¬Bˆ¸ÜÁ‘=vÛ2õ‚Þúép·0çÖò –âmÙö 5¹‡¿Ã|ôÆœ©1"«ó0ü¸êœK†yÌæ²b­f³¢,ï5¸¥/ë †°Ž]Ž°îš€°Æ{ÖTF#Ö.gðáÚå“PÞ,׎ é¤ÞÚõö3 qqéF‘MR ‹¶ñ+½L\8æ>Aá/™µËŒÆE.î-x¡/Ú † =\$·ín1áNKt´¢Š>E—è\uv‰îÍÕjÖN—µÙv¡áxT)27&Uh.V››5!7¼Ûy¨Á+}Q1uìqu×5¦Ø£V )j·æöÆ-´¿®» aìšœ¹G­Y™yR‘ÉÇŸju~ê ?ˆ!ðcEò Ìø˜b×{WÉü¾KŸi]ëtã=Î7V›«—6ùî®-Øs³.&úªÓ£ó{¸%ñ^`ƒ_z²RiԱNjäa†®þ4hL««ä%#\–³O…­­—ÝüÕfMw›.æjm§Åc«Õà˜ž ƒTtìò4è®þ4hL«-+RÑtþí ãŠï`‹ïr÷ÈO»ØË:§ïQ^ -¹"*r{‘¾E³£¹ -Ñê¯+Pݵ϶ú55›ÍF³l²™¶¿²7Ûq?ÙrgPòä¤<Ë2åyV=ôûƒ¬gz_$㤰{d‚ÏÓ¤»ú‘ÜÒÁä¶äú—¹»Ê¿ýÿoáS€¼$U™L)©YAÁLÎÜÞ»ô>OS(²øÿ1&&endstream +3530 0 obj << +/Length 2222 +/Filter /FlateDecode +>> +stream +xÚíœ[sÚFÇßù<ôAÌTŠV{Ñê©ã˜¤q_ð¤3mdP°Æ\IØÍ·ïž½I`ì˜àÈØh2„$d´?=ÿsYP×ÿP—SÏÇQ7äÌ£uGӎ߈#¿v>ÃïÏg½vÞ¼§¬‹|/ò£îð‹ÉoRcò·=7¤x§‰•1Æõ€nà }7VFJG 9€ŽðÈy÷ŸÂƒœÌZ+@P@äþ¯ŠÑÁHž–(ƒNôL=¸'ÇvÂ`Wñ°­Í +oç±V…œ@ó9*Y™‚…er”Ýð¿„qn H»TaÒôÞƒ¹e𙑖Ɔ4°¦q~rô§O5®Ø9¨íÃ,Õ’U0#EB‚2c5 DÄ8{ÙHƒˆ¦0€œƒ¹­t#rÞ&ç³<ÉÒøB› à:IJs ’.ê + ø}¦Ð$º21¹çêñÖcßK9ðqaæ(FèKx»HåÑÞœi(gýc”±zøâͲg Knú…Hð—m7¡FôVË[1IÙ$Éí 8žç#½û\9waYï)!Ú !® Œoz” §b”±Õºñ°]Ä:h¹†üI)Î\ÌR£ŸËt¤ÎXŠwt6G8SøãiRjÄJ°q´GãO’póÔ‹bòÊÔH}H'a¸°ï@qI3éaÒ N.alE„Âi¸Çü†y¬ó4wè-Ãx“¸Íç‚^èû™}aÛg_è#šä‹ŒàHØUŠW°ÐiÓÉ"—j@æà"ŽŸ}Èw.ï61ëáåÄK?-⋬îN¯U\SÙ– ýV©5K(¸—ÐïI>K²hQÆZ"O計vTÇ:ÃòYz›± ÿ 5ׂ߲b ÓYZh¦ÝUhT¸´‰: žÖv‡±<~yŸ;SÙMì¾ûá$ÿ‰õ?ŸUÐrU”ÚÅH©l‚ÍüFTÉhuèTØùÂÂÖ!†Âhlƒ$×EMLW_*TÄy–¤h¥µìAÒ]Qo¯#Þ$éCõ¬x¦øZ¡BŠX•Ž3“YžÃÌx-•<Ø)GQ[H}˜fЄ“cçá\Šø©™CÁúò|nr(hëä»wÃ9—YW™Y¹ÈñÊñE7ئž‘uõ(ž˜‰—A;Ç"†Âf\噤r‘%S­71¼©´¤,ë%úhªí÷¸ª žŠPœÕ=«±ñ%A õ©ªrû癈þ|Úâ08°Æñqnz?É$‰¯zäÅû¤´ò}¹ÒjK±ÁTp—JƒWjçmZ^ªš:`úè ‚wðšá+‚°‘îµ£:ÛJµ_ej?©®¾± hк¨­]Ôv\¡ø)ߦs•ªÎÕA2Zä¦7HÒQÛ ž^ÄOמÊèsµ§RÛžzT§ÊW&&ÒÁ­¶Í‹?ô‰o Bm§jÛŽüR!Óo26U®ac'Qé=YÐ)—Ed—„ +žG‹Â¶>mfªòJþ©Bí¨L€€ ›G".ùŠØ¨gT¯ÞBJDî´„­U¶Î «å>ÌUŽÃ}/uÓ­°t!§{±†(–’RÓ@C1o‡ÏŒ ß5.-z’üKlZ Øɼºò‰P‹«q\ä.®¸ÖÑ'2n!ÒN³p§…ÄÎa ÂH×XÝÙáOf EÕœ¹:‹ö“Yg² jÙ&Âû|©= j”ÒÃoW'ØŒÇê¢7Ø÷a>ÕcÞO­È•ó<5å2“fâLyiÚQ̪¢â>x§Æ?Ú>'m““g*'4!Ûx>eÁQpöDˆ–/ŠÒü®D&û~«¼Vq™^O—°Ÿí÷$Xû{Ïë#Â~O‚Ù,½Ìàæv}zi +ŽY¬kr·ìݼÖÀU;çÕ$ŸËvPñ° l1> F“ˆ?‰ëÙs\uõJå>VÚ+œ ‰Ú‚äV<¸®FäâA?>fµ„ûažÄUÿ„qôvúJ‰Ç²¬v­±LŸïeÐ6ÑÀËjyw©5?ÛR£œ·œž–“I´Ûìºû8û1ë€c©¦eSZJµúlŸÓJ!jÂY›v¨ù™ú" •E“'C™¶TkQ«5x}#Î-iˆG¥+ (~õâ7biÕJ”2±V õÀÕÞlš]“ŠÛOÛjŠUðý¬êFhxÑ'YÎúy‘Þ@ÃlVH ¹þ^ÏqÜùzÏ·$ÔM í½«öß÷!ƒ¾Þð;)Ùd‰¸$fëGµ²¸-~•Ãô±)Á;7£ÎYº™ÿúÔa€endstream endobj -3433 0 obj << +3529 0 obj << /Type /Page -/Contents 3434 0 R -/Resources 3432 0 R +/Contents 3530 0 R +/Resources 3528 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3382 0 R -/Annots [ 3436 0 R 3437 0 R 3438 0 R 3439 0 R 3440 0 R 3441 0 R 3442 0 R 3443 0 R 3444 0 R 3445 0 R 3446 0 R 3447 0 R 3448 0 R 3449 0 R 3450 0 R 3451 0 R 3452 0 R 3453 0 R 3454 0 R 3455 0 R 3456 0 R 3457 0 R 3458 0 R 3459 0 R 3460 0 R 3461 0 R 3462 0 R 3463 0 R 3464 0 R 3465 0 R 3466 0 R 3467 0 R 3468 0 R 3469 0 R 3470 0 R 3471 0 R 3472 0 R 3473 0 R 3474 0 R 3475 0 R 3476 0 R 3477 0 R 3478 0 R 3479 0 R 3480 0 R 3481 0 R 3482 0 R 3483 0 R 3484 0 R 3485 0 R 3486 0 R ] +/Parent 3474 0 R +/Annots [ 3532 0 R 3533 0 R 3534 0 R 3535 0 R 3536 0 R 3537 0 R 3538 0 R 3539 0 R 3540 0 R 3541 0 R 3542 0 R 3543 0 R 3544 0 R 3545 0 R 3546 0 R 3547 0 R 3548 0 R 3549 0 R 3550 0 R 3551 0 R 3552 0 R 3553 0 R 3554 0 R 3555 0 R 3556 0 R 3557 0 R 3558 0 R 3559 0 R 3560 0 R 3561 0 R 3562 0 R 3563 0 R 3564 0 R 3565 0 R 3566 0 R 3567 0 R 3568 0 R 3569 0 R 3570 0 R 3571 0 R 3572 0 R 3573 0 R 3574 0 R 3575 0 R 3576 0 R 3577 0 R 3578 0 R 3579 0 R 3580 0 R 3581 0 R 3582 0 R ] >> endobj -3436 0 obj << +3532 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [519.586 754.651 539.579 764.219] /Subtype /Link /A << /S /GoTo /D (chapter.14) >> >> endobj -3437 0 obj << +3533 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 741.102 539.579 750.125] /Subtype /Link /A << /S /GoTo /D (section.14.1) >> >> endobj -3438 0 obj << +3534 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 727.553 539.579 736.575] /Subtype /Link /A << /S /GoTo /D (section.14.2) >> >> endobj -3439 0 obj << +3535 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 714.003 539.579 723.026] /Subtype /Link /A << /S /GoTo /D (subsection.14.2.1) >> >> endobj -3440 0 obj << +3536 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 700.454 539.579 709.477] /Subtype /Link /A << /S /GoTo /D (subsubsection.14.2.1.1) >> >> endobj -3441 0 obj << +3537 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 686.905 539.579 695.928] /Subtype /Link /A << /S /GoTo /D (subsubsection.14.2.1.2) >> >> endobj -3442 0 obj << +3538 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 673.356 539.579 682.379] /Subtype /Link /A << /S /GoTo /D (subsubsection.14.2.1.3) >> >> endobj -3443 0 obj << +3539 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 659.807 539.579 668.829] /Subtype /Link /A << /S /GoTo /D (subsubsection.14.2.1.4) >> >> endobj -3444 0 obj << +3540 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 646.257 539.579 655.28] /Subtype /Link /A << /S /GoTo /D (subsubsection.14.2.1.5) >> >> endobj -3445 0 obj << +3541 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 632.708 539.579 641.731] /Subtype /Link /A << /S /GoTo /D (subsubsection.14.2.1.6) >> >> endobj -3446 0 obj << +3542 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 619.159 539.579 628.182] /Subtype /Link /A << /S /GoTo /D (subsubsection.14.2.1.7) >> >> endobj -3447 0 obj << +3543 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 605.61 539.579 614.633] /Subtype /Link /A << /S /GoTo /D (subsubsection.14.2.1.8) >> >> endobj -3448 0 obj << +3544 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 592.061 539.579 601.083] /Subtype /Link /A << /S /GoTo /D (subsubsection.14.2.1.9) >> >> endobj -3449 0 obj << +3545 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 578.511 539.579 587.534] /Subtype /Link /A << /S /GoTo /D (section.14.3) >> >> endobj -3450 0 obj << +3546 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 564.962 539.579 573.985] /Subtype /Link /A << /S /GoTo /D (subsection.14.3.1) >> >> endobj -3451 0 obj << +3547 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 551.413 539.579 560.436] /Subtype /Link /A << /S /GoTo /D (subsubsection.14.3.1.1) >> >> endobj -3452 0 obj << +3548 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 537.864 539.579 546.887] /Subtype /Link /A << /S /GoTo /D (subsubsection.14.3.1.2) >> >> endobj -3453 0 obj << +3549 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 524.315 539.579 533.337] /Subtype /Link /A << /S /GoTo /D (section.14.4) >> >> endobj -3454 0 obj << +3550 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 510.765 539.579 519.788] /Subtype /Link /A << /S /GoTo /D (subsection.14.4.1) >> >> endobj -3455 0 obj << +3551 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 497.216 539.579 506.239] /Subtype /Link /A << /S /GoTo /D (subsection.14.4.2) >> >> endobj -3456 0 obj << +3552 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 483.667 539.579 492.69] /Subtype /Link /A << /S /GoTo /D (section.14.5) >> >> endobj -3457 0 obj << +3553 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 470.118 539.579 479.141] /Subtype /Link /A << /S /GoTo /D (section.14.6) >> >> endobj -3458 0 obj << +3554 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 456.569 539.579 465.591] /Subtype /Link /A << /S /GoTo /D (subsection.14.6.1) >> >> endobj -3459 0 obj << +3555 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 443.019 539.579 452.042] /Subtype /Link /A << /S /GoTo /D (subsection.14.6.2) >> >> endobj -3460 0 obj << +3556 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 429.47 539.579 438.493] /Subtype /Link /A << /S /GoTo /D (subsection.14.6.3) >> >> endobj -3461 0 obj << +3557 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 415.921 539.579 424.944] /Subtype /Link /A << /S /GoTo /D (section.14.7) >> >> endobj -3462 0 obj << +3558 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [519.586 391.463 539.579 401.031] /Subtype /Link /A << /S /GoTo /D (chapter.15) >> >> endobj -3463 0 obj << +3559 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 377.914 539.579 386.936] /Subtype /Link /A << /S /GoTo /D (section.15.1) >> >> endobj -3464 0 obj << +3560 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 364.364 539.579 373.387] /Subtype /Link /A << /S /GoTo /D (section.15.2) >> >> endobj -3465 0 obj << +3561 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 350.815 539.579 359.838] /Subtype /Link /A << /S /GoTo /D (section.15.3) >> >> endobj -3466 0 obj << +3562 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 337.266 539.579 346.289] /Subtype /Link /A << /S /GoTo /D (subsection.15.3.1) >> >> endobj -3467 0 obj << +3563 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 323.717 539.579 332.74] /Subtype /Link /A << /S /GoTo /D (subsection.15.3.2) >> >> endobj -3468 0 obj << +3564 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 310.168 539.579 319.19] /Subtype /Link /A << /S /GoTo /D (subsection.15.3.3) >> >> endobj -3469 0 obj << +3565 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 296.618 539.579 305.641] /Subtype /Link /A << /S /GoTo /D (subsection.15.3.4) >> >> endobj -3470 0 obj << +3566 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 283.069 539.579 292.092] /Subtype /Link /A << /S /GoTo /D (subsection.15.3.5) >> >> endobj -3471 0 obj << +3567 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 269.52 539.579 278.543] /Subtype /Link /A << /S /GoTo /D (subsection.15.3.6) >> >> endobj -3472 0 obj << +3568 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 255.971 539.579 264.994] /Subtype /Link /A << /S /GoTo /D (section.15.4) >> >> endobj -3473 0 obj << +3569 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 242.422 539.579 251.444] /Subtype /Link /A << /S /GoTo /D (section.15.5) >> >> endobj -3474 0 obj << +3570 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 228.872 539.579 237.895] /Subtype /Link /A << /S /GoTo /D (subsection.15.5.1) >> >> endobj -3475 0 obj << +3571 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 215.323 539.579 224.346] /Subtype /Link /A << /S /GoTo /D (subsection.15.5.2) >> >> endobj -3476 0 obj << +3572 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [519.586 190.865 539.579 200.433] /Subtype /Link /A << /S /GoTo /D (chapter.16) >> >> endobj -3477 0 obj << +3573 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 177.316 539.579 186.338] /Subtype /Link /A << /S /GoTo /D (section.16.1) >> >> endobj -3478 0 obj << +3574 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 163.766 539.579 172.789] /Subtype /Link /A << /S /GoTo /D (section.16.2) >> >> endobj -3479 0 obj << +3575 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 150.217 539.579 159.24] /Subtype /Link /A << /S /GoTo /D (section.16.3) >> >> endobj -3480 0 obj << +3576 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 136.668 539.579 145.691] /Subtype /Link /A << /S /GoTo /D (subsection.16.3.1) >> >> endobj -3481 0 obj << +3577 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 123.119 539.579 132.142] /Subtype /Link /A << /S /GoTo /D (subsection.16.3.2) >> >> endobj -3482 0 obj << +3578 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 109.57 539.579 118.593] /Subtype /Link /A << /S /GoTo /D (subsection.16.3.3) >> >> endobj -3483 0 obj << +3579 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 96.02 539.579 105.043] /Subtype /Link /A << /S /GoTo /D (section.16.4) >> >> endobj -3484 0 obj << +3580 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 82.471 539.579 91.494] /Subtype /Link /A << /S /GoTo /D (subsection.16.4.1) >> >> endobj -3485 0 obj << +3581 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 68.922 539.579 77.945] /Subtype /Link /A << /S /GoTo /D (subsection.16.4.2) >> >> endobj -3486 0 obj << +3582 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 55.373 539.579 64.396] /Subtype /Link /A << /S /GoTo /D (section.16.5) >> >> endobj -3435 0 obj << -/D [3433 0 R /XYZ 85.039 786.531 null] +3531 0 obj << +/D [3529 0 R /XYZ 85.039 786.531 null] >> endobj -3432 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +3528 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3489 0 obj << -/Length 3853 -/Filter /FlateDecode ->> -stream -xÚíYsÜ6€ßõ+f]©Ễâ Hì›#Ù‰]eÇk)ë­rò@k(‰•9´Nï¯_܇DÛŒÉN*•h†C°›ýuÈàY&ÿÁ³2G³¢ä(§xv±>ÊfWò—Ž°=ãØžróýùÑws>Ù˜_úëˆ å‚ÏΗ¯ç'ÛÍ‚”ó®6v‹_ÏŸ=:÷ŽDcJÕeÿ{ôú×l¶”*<=ÊåìV~Îb¶>b9E9£öûêèìè_þZæ763­Æî"§%ÊK:¼ œG·3ŒXFgEž#Î -}˜#ŽÇ„1yKëÅ1ž¯åSJçxÞ¶ÛVþÙÉ#˜Ìå‰y–©?Lˆè[ÿôÛÝ6ÿ°KÎ A oÍ—öjf>¼ŒIÙVÇQ³!©ÃkkR¨`±¨0pF „Ë™$X>îEÎ?Ž Šå¹ÂëF²‘`°çÕ¤‘›ÿ¸U´“Ó5›+é3¼˜WêŸ?k.Úín{Ù™¯§êÄFyV׺oöúX/Í)ÝñUmœ©oõÕkí¨æp×Öµ¥Wþ=«Öoª!®ÌØ*܈)³™âðšÆES¸Öñc‚0yGWEÊxùŽ—L8st° ñÇ‹’͵ñªn¯Â»6Àt¼W›¥ùð½>º‘¿ë¿d˜)£ËÓ„ á@7&ç¾æ1¬´û äã Õ»HÆP&°óò÷0ðAÞa­9Õ=B3À?z¤Ê¤ƒ U€‡¼ˆSî­Zi†“•ô•j·S÷Eµ2Ýô‹¶Ù„Qáls£œi¾]Èÿ´]ª·ŽTxŸÞÔøðšÆš"eÍèZÒ[ó¢@9~GFÆ9G™”i­øwwýÒÙtb@FÍÒÙã¸ÐP…t— -öŽ’™ß3ç(®Ï>_”t^_,H1¿VŽÐ˜°£lþDÎO„Ì‘df&ç)KùÛþ¢kTßžÓ¿poíì8Õ9B3À9bF€s UœŒ GL°—g‹2ΡúÕ÷¾ºVrg¤Œ¨vP°wƒ‚Ë®!J†së§õeµW3žnl:cæ@kåvÑóÒU1_ä\Î}›í>¤À??òŸÑ -˜ê(öo܈ûÖ}èêµv3üQ¸Ù[œÊ-4¸ÅæÉ’ôˆ -7H°çÆ *Y¸qË-Ì6Œé…›^ÂrÚªo·~iÁÒƒ^G½ž)Èü½«•w Ö&SA‡fèØÞ"YuQ v“UÆ"¯=¸-¡O6Š‹f(.÷õÆ^Y‘¨²…ZzVV 0ö“]³¹°i±¼ãÅqQÒ/±`áÌ5ÕB3Àb"YŸQðH°vš£‚ÁÜL6^ÎUpOÛæwõµn­l“~pV·æT3牣ä}}÷8/ÒQ\©»RáŶÙt®È!](#óoõ&"Ó²w \ ŒpÛð“ºGÊ!¬í¦:Dh8DÌpˆ¡ -€C@‚½CH°ˆâý§¶ßæçQé²±^ÓÖë­rã Ë‘íg¦ä¥\Êú]¨íiøn‚Þšc*ãÐ `›Z$ Ô#*Œ!Ážq&Á²20v3Ö“¶®ì~½ƒJäëxŽøMT¿¸®Ôµ²Ì¾ždÜZg*òÐ @[^°$ò¡ -rH°CNEŽ2!röÞû Ü:bßâ¬Î…>T´ä$á‹bïÌ4‘}Ô,;‡ Í~D…4{P°g_b”ç½›‡©þ^r\6m}Ñm[[¬:ëZ³ipßæÎ{aºÂÙ—çÖ,SQûVéÈà"Y–Ê8R]:Oy‰²Ì/J>ßuÕj¥Çë«D.ó­c|ÐÝ3Ì¿îÍ¡ÎzSÝ!4ü!&#’Ot¨x$ØG~®vüG.SùSÒ}§ˆ÷é>ýÆQboz‘XæP×»MFv‰ªï?üüD~(Ä'Çk-1ohà­,’òŒ¨à…{¼L"/¹3¼­©É“.tò¯Ê{MoKÁØgŽhk©ÈC3ylyùP9$sÛÉ“Ñœöã¹ -kVŠù“¥ ®FÑ}»@œ½êÎ}0G¬Ž®Üã&yž!ã¸5ÉTΡÀ96·H.*Ž¨p†{Θ¢2cœ‰å|²]­¢Iv˜°Õ#ñnáJ².òþƒÝû¯´¯,MåÖž÷ãÖoüv7’÷Lµ¥ÙÛ™Ê(4ŦÉŽF`Ï(Ë ‰µeD-£ÓÚô‡Û]Óë‹•9¯ß+Ãü«—™ g^¬(ï&ò¬¦R ͪ‘qI–\þQ  - vTIÉQ‘ñªÌEÞµyâê7[ÖÙ´uªÌ!ÔÆïàróµu¿o6c«=øK–ga|ÝÙ"«š¬°òt¼8. ù` &‚š¥ÁÆö%Yr¹cD…4XP°[P„óC°¹ûr¯btGjœÓ¤­·î=>½]ªìå½à÷h¨t&˜Ê54¸Fæ%Y²b=¢Àì¹æñ¬8àÊÇöÚŒp‡óàÁ©˜ …jóûí µ:}hm×Éñ¥Y©.;wѤg¨ÕN_ýìæîº^&©ÙœJ-4¨EÆ#Y²=¢@ ì©1Ž²¼< V|p7ÛØε5ùÑöj£NûŸɈƶeéÕ«R/5Hý?WÚ{Ÿ -44€Fv%Y²Ê8¢ìR‚òL--ÐÞ³MË@q³íÜØ÷Oy¦œ#F¡ú!’êó¢Ô;@ÜÓ©.5Ú™ÎÚ€WÔUt]9ËaF¬v”í”vÅŸ¤hox*ÅÐ  “dÉ∠-EH°§(щÃ1R|œ1Ò<ƒØ-‡IoÎó{7­´–˜J×·àClò´€TW–¢ó¥ÀÒ½ø%¹Ìo¾Ûê±+é!š¶íð|ßêÇJÅWZ¶f›ê¾àÉ’Eá¡|À ©®fˆF%ü`ðè‚}ְݹÍxzíÀM5"O»>Ùø*bµÒϹØ}º”|Q«CÎNÁGÍÒäcúÒìAÁ~Q"ŠI€ï -ÆOž©mz?½T›ê÷Š<|~þ·›ã –\ÿÞ¸í\Ï|°¬{Û‚äèZßwwÆõc9_ûä ííNeš #S’,YQ` ö 9C§¡Û¼¡_´oãb‚[rùø(»~waU/ÆìÞƲ5ÙT?Í?ˆp,Y}QðH°÷ƒKXð·£ãáÊ<#¬g96*×Õo~kzxÿ,R7¾0w¢gO:ß³•æø}!•ÛεÕ©­*ÜzÒƒ›aÐÛÉðB¿ÃÑ$†›jgÉÿ$Uk€©TC3€jd\ˆêP€*$Øei˜ˆsOUØ4í§ATÿ ºÞμýIÑYñ÷;úFÝÄZtª›„f€›D´N©GTÜ샟0„qÜZØ×n£«ýª‹2ùÞ¦üŸn摪Ç.âš ¸)¸ÅçBjï~*ÒÐ @YB:T@ - öHå¡œó€”ÄÛ´ì»»¶moÁoUµWÍó½îYý"Aا}9|CÿØ_+¸—ã¶5ÉTΡÀ927ÁÉrõˆ -gH°ã, -”á"`öO‹ê:±ß|ë_íx;eF¬cKºÏÏÍ߇Ê^©G1ÊÏ‹ÔÞýD¢¡UhdW‚“…ì¡ü4NHª£YRÄxhº$ì•‹g£@¹W?´m´ëæ™yÏ®r1|R™Gol6u±ÝlÂ~ZÓfo^ÒF›ªLqS½"ˆÇèuÑÏ+õ.™œ}”uA{·é…Viz‘eŽ”¢7”Ÿ¦Iõo_HàˆžÛû½bÞ·ÔÆcèÞÖÂn¯ë(–kÓù®â ~¯¥`~ß¾fì3õåk¾ðîµ`y‚“5С|àÍk€Tÿ¨>G”‹ÀÛ?ÙVzoÙ}‘˜Æ¼PGäX¬òî\|uoi0VšúLºo<’ìOpú ùÀ»˜¥ ÊÇ^Æ,ÿUçˆûßpøW:3õŠÎdMH¦ì…Ún‹µ•™ô._sR¤ñÿe¨endstream +3585 0 obj << +/Length 2401 +/Filter /FlateDecode +>> +stream +xÚí\Ys£Æ~ׯP¥Rô ½7ÇË\Oe<¾#'s«œyÀ–© PŠÇùõ·Oo „¼ÉƒFKMÕ€šÅp¾>ç|giÜ®Ãÿ¹Ý€Úf]?ðlŠÝîpÒqºc~ä]ÇUg8]b;…C¿^u~>£^×ulæ°îÕ­8åjtmgiVÉͬ÷åê}çôªr“>±‰‡á.w®¿8ÝÿCï;ŽYнçûŽí2ÖtÅ6%XýN:ƒÎÍ]ä1Ò•W5½{Lô>­ß“£=²xË•ð">™hó ¨ÞG<r€¿#Ö2À}Æq.âtÌ¡ö|+„g}ˆ‡y6Ën ùóNŒaB¹Þ½™°ä)gz<‰äÀÄÝ#1¿äp‘G‘üSb¾ñí œÜ„KRÆTÎvx•Ò]ñrÞ’tƒ&°@¢J¥úÈvQ£þ+ö]×&(xB¥8žÏŠl²:“2‚R¡q|ËGª8,ÄX¹³8‰íÀ{–Ñ Z„FWe>Bg[Æi³ç2ˆh®¨” pÌujJØB‘ÌË ¾×MÙBCµNÅ\åJ.#̨þ®ãßRÒ¬EIë¢Ê£ a•œk”¡™ ïÀüGŽÓ"*ºì0“Ë£¸(oʾÍ扫Y[Ù•O–X…#œ§&'&¢c@ZHöÝl4n !…Œ®5|šƒøÒUN»Ö²{¯—Àé´pi$Teæ9;¡-¨Em1‰;ÙÿWµã–Kz$Lú‚-SUÙ ªz<‘»;î9¸Eü:Êm†Òt©ôm–kDzĪd_ôP,;‹õ *ëãøÛ i†@Á0˜ +g!ûtƒìP;ƒ%“ò¿958áÌ8ù¯1°¯X¸›`}à´—’]RÚ":ìmýŒX!—cƒüØBsøæÇÐ ·5½¡+]¤›ÃyR,/’#§=©O³Z ¼š®ˆî,²e¶¯5D ©æ=•Ñn–/t?þæceÿ.æbí¯X'/ââÊŠÁ.n—Ÿî¬ŸrQKXÕØDEÙœ*ˆ®|±õÙTsy–ºââJÞîèò3Ã[n +MNsQSFèƒúD8Ž~á/N¨ðèÇ¢o;ÕÎ~h–ïjz ÇAµÒ‘qùr3‚œ6j¶Ä3 Ù¬€ï +Ò ¦… +V°/0µcÕ/Åçø]¤ØבD'’L·J®)—w¦¿µ'4çh—Ìm£™C6N ³˜Â6_Kº\nø-;¹+ÿMÙάZ·×u”ßÄâ·Ä^ówXKÅ[ãªÙ¦ÏÔâåä‰> endobj -3491 0 obj << +3587 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 754.651 539.579 763.674] /Subtype /Link /A << /S /GoTo /D (section.16.6) >> >> endobj -3492 0 obj << +3588 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [519.586 730.193 539.579 739.761] /Subtype /Link /A << /S /GoTo /D (chapter.17) >> >> endobj -3493 0 obj << +3589 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 716.643 539.579 725.666] /Subtype /Link /A << /S /GoTo /D (section.17.1) >> >> endobj -3494 0 obj << +3590 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 703.094 539.579 712.117] /Subtype /Link /A << /S /GoTo /D (section.17.2) >> >> endobj -3495 0 obj << +3591 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 678.636 539.579 688.204] +/Rect [521.223 689.545 539.579 698.568] /Subtype /Link -/A << /S /GoTo /D (chapter.18) >> +/A << /S /GoTo /D (subsection.17.2.1) >> >> endobj -3496 0 obj << +3592 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 665.087 539.579 674.11] +/Rect [519.586 665.087 539.579 674.655] /Subtype /Link -/A << /S /GoTo /D (section.18.1) >> +/A << /S /GoTo /D (chapter.18) >> >> endobj -3497 0 obj << +3593 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 651.538 539.579 660.56] /Subtype /Link -/A << /S /GoTo /D (section.18.2) >> +/A << /S /GoTo /D (section.18.1) >> >> endobj -3498 0 obj << +3594 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 637.988 539.579 647.011] /Subtype /Link -/A << /S /GoTo /D (subsection.18.2.1) >> +/A << /S /GoTo /D (section.18.2) >> >> endobj -3499 0 obj << +3595 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 624.439 539.579 633.462] /Subtype /Link -/A << /S /GoTo /D (subsection.18.2.2) >> +/A << /S /GoTo /D (subsection.18.2.1) >> >> endobj -3500 0 obj << +3596 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 610.89 539.579 619.913] /Subtype /Link -/A << /S /GoTo /D (subsection.18.2.3) >> +/A << /S /GoTo /D (subsection.18.2.2) >> >> endobj -3501 0 obj << +3597 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 597.341 539.579 606.364] /Subtype /Link /A << /S /GoTo /D (section.18.3) >> >> endobj -3502 0 obj << +3598 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 583.792 539.579 592.814] /Subtype /Link /A << /S /GoTo /D (subsection.18.3.1) >> >> endobj -3503 0 obj << +3599 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 570.242 539.579 579.265] /Subtype /Link /A << /S /GoTo /D (subsection.18.3.2) >> >> endobj -3504 0 obj << +3600 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 556.693 539.579 565.716] /Subtype /Link /A << /S /GoTo /D (section.18.4) >> >> endobj -3505 0 obj << +3601 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 543.144 539.579 552.167] /Subtype /Link -/A << /S /GoTo /D (section.18.5) >> +/A << /S /GoTo /D (subsection.18.4.1) >> >> endobj -3506 0 obj << +3602 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 529.595 539.579 538.618] /Subtype /Link -/A << /S /GoTo /D (subsection.18.5.1) >> +/A << /S /GoTo /D (subsubsection.18.4.1.1) >> >> endobj -3507 0 obj << +3603 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 516.046 539.579 525.068] /Subtype /Link -/A << /S /GoTo /D (subsection.18.5.2) >> +/A << /S /GoTo /D (subsubsection.18.4.1.2) >> >> endobj -3508 0 obj << +3604 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 502.496 539.579 511.519] /Subtype /Link -/A << /S /GoTo /D (subsection.18.5.3) >> +/A << /S /GoTo /D (subsubsection.18.4.1.3) >> >> endobj -3509 0 obj << +3605 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 488.947 539.579 497.97] /Subtype /Link -/A << /S /GoTo /D (subsection.18.5.4) >> +/A << /S /GoTo /D (subsubsection.18.4.1.4) >> >> endobj -3510 0 obj << +3606 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 475.398 539.579 484.421] /Subtype /Link -/A << /S /GoTo /D (subsection.18.5.5) >> +/A << /S /GoTo /D (subsubsection.18.4.1.5) >> >> endobj -3511 0 obj << +3607 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 461.849 539.579 470.872] /Subtype /Link -/A << /S /GoTo /D (subsection.18.5.6) >> +/A << /S /GoTo /D (subsubsection.18.4.1.6) >> >> endobj -3512 0 obj << +3608 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 448.3 539.579 457.322] /Subtype /Link -/A << /S /GoTo /D (section.18.6) >> +/A << /S /GoTo /D (section.18.5) >> >> endobj -3513 0 obj << +3609 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 434.75 539.579 443.773] /Subtype /Link -/A << /S /GoTo /D (subsection.18.6.1) >> +/A << /S /GoTo /D (subsection.18.5.1) >> >> endobj -3514 0 obj << +3610 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 421.201 539.579 430.224] /Subtype /Link -/A << /S /GoTo /D (subsection.18.6.2) >> +/A << /S /GoTo /D (subsection.18.5.2) >> >> endobj -3515 0 obj << +3611 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 407.652 539.579 416.675] /Subtype /Link -/A << /S /GoTo /D (subsection.18.6.3) >> +/A << /S /GoTo /D (subsection.18.5.3) >> >> endobj -3516 0 obj << +3612 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 394.103 539.579 403.126] /Subtype /Link -/A << /S /GoTo /D (subsection.18.6.4) >> +/A << /S /GoTo /D (subsection.18.5.4) >> >> endobj -3517 0 obj << +3613 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 380.554 539.579 389.576] /Subtype /Link -/A << /S /GoTo /D (subsection.18.6.5) >> +/A << /S /GoTo /D (subsection.18.5.5) >> >> endobj -3518 0 obj << +3614 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 367.004 539.579 376.027] /Subtype /Link -/A << /S /GoTo /D (section.18.7) >> +/A << /S /GoTo /D (section.18.6) >> >> endobj -3519 0 obj << +3615 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 353.455 539.579 362.478] /Subtype /Link -/A << /S /GoTo /D (subsection.18.7.1) >> +/A << /S /GoTo /D (subsection.18.6.1) >> >> endobj -3520 0 obj << +3616 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 339.906 539.579 348.929] /Subtype /Link -/A << /S /GoTo /D (subsection.18.7.2) >> +/A << /S /GoTo /D (subsection.18.6.2) >> >> endobj -3521 0 obj << +3617 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 326.357 539.579 335.38] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.1) >> +/A << /S /GoTo /D (subsubsection.18.6.2.1) >> >> endobj -3522 0 obj << +3618 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 312.808 539.579 321.83] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.2) >> +/A << /S /GoTo /D (subsubsection.18.6.2.2) >> >> endobj -3523 0 obj << +3619 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 299.258 539.579 308.281] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.3) >> +/A << /S /GoTo /D (subsubsection.18.6.2.3) >> >> endobj -3524 0 obj << +3620 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 285.709 539.579 294.732] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.4) >> +/A << /S /GoTo /D (subsubsection.18.6.2.4) >> >> endobj -3525 0 obj << +3621 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 272.16 539.579 281.183] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.5) >> +/A << /S /GoTo /D (subsubsection.18.6.2.5) >> >> endobj -3526 0 obj << +3622 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 258.611 539.579 267.634] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.6) >> +/A << /S /GoTo /D (subsubsection.18.6.2.6) >> >> endobj -3527 0 obj << +3623 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 245.062 539.579 254.084] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.7) >> +/A << /S /GoTo /D (subsubsection.18.6.2.7) >> >> endobj -3528 0 obj << +3624 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 231.512 539.579 240.535] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.8) >> +/A << /S /GoTo /D (subsubsection.18.6.2.8) >> >> endobj -3529 0 obj << +3625 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 217.963 539.579 226.986] /Subtype /Link -/A << /S /GoTo /D (subsubsection.18.7.2.9) >> +/A << /S /GoTo /D (subsubsection.18.6.2.9) >> >> endobj -3530 0 obj << +3626 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 204.414 539.579 213.437] /Subtype /Link -/A << /S /GoTo /D (section.18.8) >> +/A << /S /GoTo /D (section.18.7) >> >> endobj -3531 0 obj << +3627 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 190.865 539.579 199.888] /Subtype /Link -/A << /S /GoTo /D (subsection.18.8.1) >> +/A << /S /GoTo /D (subsection.18.7.1) >> >> endobj -3532 0 obj << +3628 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 177.316 539.579 186.338] /Subtype /Link -/A << /S /GoTo /D (subsection.18.8.2) >> +/A << /S /GoTo /D (subsection.18.7.2) >> >> endobj -3533 0 obj << +3629 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 163.766 539.579 172.789] /Subtype /Link -/A << /S /GoTo /D (subsection.18.8.3) >> +/A << /S /GoTo /D (subsection.18.7.3) >> >> endobj -3534 0 obj << +3630 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 150.217 539.579 159.24] /Subtype /Link -/A << /S /GoTo /D (subsection.18.8.4) >> +/A << /S /GoTo /D (subsection.18.7.4) >> >> endobj -3535 0 obj << +3631 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 136.668 539.579 145.691] /Subtype /Link -/A << /S /GoTo /D (section.18.9) >> +/A << /S /GoTo /D (section.18.8) >> >> endobj -3536 0 obj << +3632 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 123.119 539.579 132.142] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.1) >> +/A << /S /GoTo /D (subsection.18.8.1) >> >> endobj -3537 0 obj << +3633 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 109.57 539.579 118.593] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.2) >> +/A << /S /GoTo /D (subsection.18.8.2) >> >> endobj -3538 0 obj << +3634 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 96.02 539.579 105.043] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.3) >> +/A << /S /GoTo /D (subsection.18.8.3) >> >> endobj -3539 0 obj << +3635 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 82.471 539.579 91.494] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.4) >> +/A << /S /GoTo /D (subsection.18.8.4) >> >> endobj -3540 0 obj << +3636 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 68.922 539.579 77.945] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.5) >> +/A << /S /GoTo /D (subsection.18.8.5) >> >> endobj -3541 0 obj << +3637 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 55.373 539.579 64.396] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.6) >> +/A << /S /GoTo /D (subsection.18.8.6) >> >> endobj -3490 0 obj << -/D [3488 0 R /XYZ 85.039 786.531 null] +3586 0 obj << +/D [3584 0 R /XYZ 85.039 786.531 null] >> endobj -3487 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +3583 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3544 0 obj << -/Length 3834 +3640 0 obj << +/Length 2469 /Filter /FlateDecode >> stream -xÚí[sÛ6Çßý)´~Yif…7^fv;ɸSw½µ³Ý™¶Œ¤ØÚÈ’*Êq3ýò‹\$Š§e·Ic'Ó©-Sx~ ÙùJÍ2Y Š2gZòÁäö(\›o^qÜŽÆ|¸j¶î¯‰ýëöÖøÁþ}>oÜ¡¥)üCÆÕõù°©·s{¤³ÔpõÆ_Ô›¹c'‹9zÑ}wº™ÛzÌ6£q!Ë¡©œÎ²Ö¯=‡k!˜àU¸¹–›6×÷áÛÔqXjœk;nÿÚà8ÁËVÂ*Ä(Ã<ãLeæŠJ°Ì°Gbæ„‘Ðùðê]xv»ÞXf(F{ðjT‡Æ€tÑÌx¸l»r¬ªªËÍ¿å”Xüÿ»t—FÐ}5‹IPQiWÐe8´jaÎVU¢ÎFÜèà;hkõÖ‰bÛâ™mÐkh¥ œÊ -‡ÿaZ]Å?MžHè¹¾rˆÅ9$T(9´«@È2ä`ŽF)'…“ÍÌtȾg¿Hú èl±ó5]ÿ jÀÃp žÀÏ·#­‡õõ¬WëÉÛ¸¦/kW„àŒî6Ÿ;ïš%øv laXHñJ‡—.Ý L÷R Ýù­/ûPŠÀ‰P -hÙ'D@Xõ:ÈËÂâ‰Ô¾0ö2C½0.³mz'îÒúq£÷®êÉ>)Ö ?Å@Ð?P…nü¤aæ…bR‹ÀŸ»°ðét -„Åð ú ãû‘(†+hùo}ç½ïü±‹¨1ÿzuíUr?·±ú -®=žñÊŠÊgþ:õÄY4}\ ê#cFôÅ‹˜o ‘ubnWÀL˜óŒ•æ·Ç,ö¢ÿækÓÈ•Öÿéè=YÙPï¶^a”™úœb}ï¼¾ŠˆÅE$`„ŠhWPe8(BLh!"ΡI_o’>ÞÏ·Ouc›,œbi½8vߥ±}‚Ÿø¯bÜPßBÿñ>™Vm¾|ìÑM}ÙÇbûž]‚=e8°—’Yd¯û èœ_Ã?·œoÒΡHÿlùúõÍm"—9þ~:ÙÎ}„8…â›™ëÜí(òõ…ûúôñôÂt/ÿàXÑ}±ÆbÖÄ»BÈN¬í*X)ë0vƒzí°ž`×í =‡Æº±`Ìæâ!ÄdBËGoö•H,FH$!EI¤]B"”áîg93ÿ'Á Ï™ÓÆõN›µ=66Ó‹à ˆñÛ‡ƒ{›ñÝLÝQèàïðŒ3wˆ-VË¿âÁëæ‘êÉÄFp•Jé?•5º¥/ëXŒ`¸œbÝ®Áš2ìYëJ²L kL᜿oÚÿF¯ÈgzÍKñ!øÇL° §¡Ë‡ÔŽõ9ú°²Y»®ô" &ÓƒA)‡kKh{3[¨ÔÂ."èò×Ñz/ôD›ëF›z˜@{  --´JŒ—ƒ±PfÊ~x…Æwóc›ëV1y'²öB“?ǯ´°áÉ«‹K·JcfnKLâåÅðòn½†Àp2?6[wÔäæÜKéÝBhP»oÌÝ´½¹[U#½ìΦïdÿšÎ˪ÓËñZmïâò×X˜© WñtnZOñ+‹)Z›³Uð®éC 8åç°±«œÞùP¤¬xxéß{÷öm³±Ñft”šÚUèîŽIá;Vœé¨Ž ¦/`‰ÍvmõÖ.wº1Ñusv¶ žÙ£KßñÂâ($R`äÌäãN»9¿õ•‚/D!ð d°oœA·É Q°Jó("ø'®V¿›ÏîÍüGòÛ¢?Ðq}U‹:H PJhWÐe8 "fÞ­2áÕ pyV»$ËSì;"’ìŒp§½º0ß^&aœ½ÆØ Æõ*ÓyX@‡õUA,F¨ A© ]B”áÐ'd+µŒ*ðÃ×s€þ6ÄÌ>×`  N“»‹‹!ûöÚÆ“»µ_¸aþ¤à3ñ W\½ŸúÂÅø !t'üvø”a_•“Yß—À1l®XøéTH¡²¸Q -eq9Ûn­b®q!æO¬ønAŃBî½ÓyR¬yêy!ò.äªÐœ4’>ïÈ%"?·ó`$[ãÖaªýónãÿ -¨ÿ„ð¢'ú⿉—)¼í*x)Ã~PWyÆDâ|‰ƒúÓ黑ÎM<ïçƒ3ìºOVËqݦÊF㜫ÏpÞç×W±¡ˆŒE§"ÚU A ^å,×yT„àOpN¹³M½è̶¥ jïp¬ÒÃã (7s+èãíj ŸÒc~e.Y£w\U~BÌÑ=}™ÇbóÄõóvæ”áÀ\ÌY™ûqݦàøðÉåÎj¨0ß@Ô/òÂÿyÜì‰À²‡>ñþØx‘l¾tG.Í<2ٚ҇k”ÃãMí¶q˜ÃX8ݹiM8h¢IHáº?þ yÙÙr ¾HeotÌ%ÃÅ‹©bNí•pëwjãå;+A» -7}ß„MÛ~t ›Ìª²zˆÁ©2uÿ$sRŒ1žäDܹýó@S†ƒˆ³œeYEì#•Ž žgËf[/v§p˜ŸžÏ¶7.ý?ÝW…]OþuU¸¹K!‹?‡,:¡/ÙXŒ ›8˜"Û®A–2ìÉÊJ0¥«HV!Ùç?CÂ`1ŸÌ· ¿B¯Ló¯_'³ãíµ€YdâÞ?ÈÀq@ÍM=y¡Ë¤"+YQ–¦â`¿^ƒ½‘Ðóq·}Äî[>Y´‰–¶³í¸Ùnàó ~˜žÓ^s÷Î`ª­^ó/F/y¿mcø½§zâOŠuãO)øT¡?i8à/JVñH_#ý«›ozˆúÛ·ƒ{~ózÓÕªÝF\ݳrhõ6µXÕÓ¸ú¸¸‹ÏÔîWÈqßcÚc e™øãÛ6ú¡/ÛPŠ@=,Dçnζ},aÕÏ=d®™ÌX…sWË!U¹Ÿºð£t zæ° íÇÚþÖÃúà„Åœð¬WØ@â½;ð ^ÃEÝ&<¿Ž[ƒ«üð±*÷¹+cÒ> °j¶—“Í|m·‰BÌ!4Ë*žÆÃÏéÊF7Ë…ï@@h¹‘õ—TúŽè5g%ï¯úXŒ=ždu/;··¨!|ÊpèÑÌÙ"Qù~ŽõòôÌw#>EOV°çù%y@eÕøÝÇQ†;aË«oÎþcü®ù' }Ñp,FNüLnWL€…b—°ŸPâÙî 0ýûK‚(Âò*l‰;a¼]ä²M£wú"Åä‰ç…äÈÛU S†rÎÏUDânÔÚb¶»`fŽ@˜˜Ø‘ ñ¿|…‚xfÇf>i`V|B„Ñ} ÇbáÄÑáv”aOXT˹Ž„ý4¤ ì6×—öq×S7ñœ¢ÊÍ0í}ÓxR¬xêw!;÷¨B7pÒp^*–å p?óØêì|àÙ{Àåê"©Öœ¬|{vÓÎd.²´Ù²˜E#—>¬Ý±³»ÇÝœ™»ñàbŠ·ß—i,F0M\+dçVÄU ˜R†Ó"cšç‘iN7â‡ÆÒðÝÏûvøûõ8ã‡Lg095Ÿx|°Ä%JmÙÉF‚‰Ï?Uò#7ZôE_À±8ñ³TL€uΪ¼ˆ€‹4—í«Ñ]ãŸ'[,:r¿¶)†ÇF¶q±À\³ßèRË€üâZ£R $Þs_±2ñ§› TI •dŠ—dÙY/šUB2äfŸÕs}«mœãCó¦mD×z Òü¢øÈ-ï½/ÐXŒšø•Ú®”2ìó=BT¬ÌCWc¾'<Ôy’î{1_˜1-]K|º™@“´Oymq/¾ßªŠG·¸ì½ÕW±!„„Û Te8´iž3É øÄÇùÙ¹Aù'÷*ÍŒÈg\“)Pkÿ Ñ ÚéìI—ê!GÔ誾üc1‚‚âß®ÁŸ2øg‚EÄ/~ ~jžÜ„ ò·w¸æcÙ+]>‚I•óV_„R„"!;7´íø «ž>/+&ø}Šd·ñ:œ³Ÿîæáù‚ÛðÒ¹q©?Ä·wVOúI±nü)!;—òT¡[¤á €B³¼Q!…²Ù{Vdáf´•*¿,ˆìê]ØW±¡‹ ª@è‚2t‘Ón2êÂgZÖÍvµ†±¼d/áR:°¯*b1B Jí*ª  U(sv‘¨"OT±©ûb_´°«t[_-Äb„$Bu®¨¨¡ÊpЂÔ,*jÁ§uæ·5>j½Z'»3’¹Br†Ý -ä¦þ ²o†æ“Äžé‹;#p'^ªs­å@Ü”á€[p¦ -qûäkö[Lû|¿ÞO'ñÏ0½úãh\å£kå衾Øc1{â} -{» -vÊpÀž¬yÄ^µr~Ïj›zkç€6S a¢{+ÌçÖÑ£·úJ #$ $Ю!Ê°—@¥˜LSðægx ÈänݬàÍM6ó÷äEòªg<šì¹ |Üâ· -Krïýê WÛø>—ðõ¯I^Õ}Þ†ÉÆÀc©åï»'ËXªeâQ¡:WbÚö»ARV=Ç2c¥H9ò½užÀób³í,¦ìç“íÌ÷s!wÃEßôdKu³N¼N°nÛïfMY ¯i*˜(Ê„5¾¹çv~k/6qÿvÀ;X“òK î_¯iÝÖû;õâÎD(ÝýÞÎ}ûÝo¢‘œ•‡^$ ?a¯«{Èïÿ mÌd *;óË 50¤’8/,º·mÚ“’ÿØ*qendstream +xÚí\ÙnÛJ}×W÷‰®öF6Ÿ^bÃAœÑXöd€$´DËD$Q—¤ìÌ|ütuWSÔâX^ÂX6aÀâ.²«êÔ©j‘¶§þH[ +×ca;¾+i&-¯=R{Ž[ðÚÜõ|»öÏ[ß&žzaûüJr>üâ¤Ó•N›¼óíüCëýyå"]îrŸÁUþj}ù浇ê‹>´<—…²}«–=—„a{Ò₹‚3\·ú­•W1ûxÛœµá^»œPדa»Ë›Áó«qUÿ²µàL¾æŽ'ßøÅ”òµ'—›ž¥ö.Ul‰n:¶«Ø1§òž7ÔȠ𞘠+ÞóÞ ç–baLö‚ÝKIw*bð\nß#0~m×Q`g1:ppêÑthöÑ  À² hS¡Çåâ7cißš¨ŸÝ$ñ­"¾Œì¬]½(ÂÓrnxßP²d€ù.¬\gèc † +qH3¶ÂÊKÕLˆ÷ÚcÓ q«u™"-ÝêG-!~/Þ…€ }*è„fi ZÅ¥¸ƒùÌ*Æn®b°ïÉ7mwâ××`6ëAû€DYëc•—ª‘«¹P +Ø¢Õ‹ÂÈÅ(ÿ^Y âÀš, ‚·—_“™ÙšÙiŠ™ Œ<Ê9âü½„6D­€@œ¼téÔ¢¸Hn€êNLŸ… B d ÙÞð¦#|£´kˉ‡KÁj¤ç¢õÆ'¼É‚fP‹½±2¬Ä‹òUfU÷>2TªÂû‰djTÔÛð•0®{ â8ëivi*6²?¬6¬¯`D|,ÄØm³« (ÈÎ"S´D™¯R è•ÝTõøÿ™w$sÊTo˜–}"p,&欆üYƒ5Lõ×á¾EeúFžT^{~$dŒ‚•êdšÑx¼ðqÕJÖçÄŒóæÁ+›t#Ï™ÿzɃ¬ÉFl—Æû¿!—UĤ/”r¨L£Ë + ÷¥«õ@oÿX/dU»L) èÝ‘+wBÕíTâýD3õýƒŽ P´-ÚþÞ¥òl\tó"ƒåþEsÍ¥§#”¸2`xÍ·¢@ïèa»Ð,0oœÆŵQЇʊI…c¸°bÈï#†¨@Çãq2ZrƒwšÊ¢;P\^t.¦¦ßªo/­Oœ롬òºj»»ž–ï gìR>æÕb`¼¤|LJX\Düõ õßõñ‡”k%3Ûµ  ŸNþ£M×gEÏŽØKó6a±îQPú‹ÃÐR݇Xwz¤F*ðߖӫ͘,4¯>f9&‚<ØP TzS½}~eWŒí\Óh^ šûº†“'ƒ¤ú*à!5Ác!ú¯bÉqU åŠâèßòÅ1Aè5 ‚2ZZ–ú-£±ê1§-®Ñ¸úé•íä•N”!«?;é™ÝÈرËeÚÝø.ð;;ÿw?«iøýŸKU¾Y¥X¦¶\…ªšõ„׃ñ=TKd1íÁÈK¦]%w9°‚!Ûãàõ;cò"/µUŽ@œîèi:Ƕðq‚8 ¶Ÿsƒð¼"WÁ~C^Ùðý×ÜL™ØJ®©Ò…’í0Jþ“—¬ÉÌJ¥![é¥Å€rÙ4mþ^Ó{8¨V˜åEŠí{"`¯¤iåÅ¡Ö„ª_A5‹r=OQøAä®i5‘dL“ŸµR“!,ÄôʺÒo´E^rþ–±â¤ùJ”‰±7;mûËliº0—› n1j‚ß KL6æõœme^ᚨµi½ä»N¦Cck¡™^ܸǗ†üô LN-Õ°³ÔÖ#Ó+ì`’•“Õ“ùžWÌgy +3öï®R³°©A‰5ü Jµ½/Ï« ?²‚ßA:™ã"^¨ÂÉ ˜ƒXéSÚ˜Ûpñºà¹à“Ĥà0 A `zÊkxåK@r®?tB°/´l·&ΦÆP[K~è#}dUÁÎ’gÄ•\lþùÜ…Ù>á—o9u}&¶ôë‚®9féaþ=¤ÛZendstream endobj -3543 0 obj << +3639 0 obj << /Type /Page -/Contents 3544 0 R -/Resources 3542 0 R +/Contents 3640 0 R +/Resources 3638 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3382 0 R -/Annots [ 3546 0 R 3547 0 R 3548 0 R 3549 0 R 3550 0 R 3551 0 R 3552 0 R 3553 0 R 3554 0 R 3555 0 R 3556 0 R 3557 0 R 3558 0 R 3559 0 R 3560 0 R 3561 0 R 3562 0 R 3563 0 R 3564 0 R 3565 0 R 3566 0 R 3567 0 R 3568 0 R 3569 0 R 3570 0 R 3571 0 R 3572 0 R 3573 0 R 3574 0 R 3575 0 R 3576 0 R 3577 0 R 3578 0 R 3579 0 R 3580 0 R 3581 0 R 3582 0 R 3583 0 R 3584 0 R 3585 0 R 3586 0 R 3587 0 R 3588 0 R 3589 0 R 3590 0 R 3591 0 R 3592 0 R 3593 0 R 3594 0 R ] +/Parent 3474 0 R +/Annots [ 3642 0 R 3643 0 R 3644 0 R 3645 0 R 3646 0 R 3647 0 R 3648 0 R 3649 0 R 3650 0 R 3651 0 R 3652 0 R 3653 0 R 3654 0 R 3655 0 R 3656 0 R 3657 0 R 3658 0 R 3659 0 R 3660 0 R 3661 0 R 3662 0 R 3663 0 R 3664 0 R 3665 0 R 3666 0 R 3667 0 R 3668 0 R 3669 0 R 3670 0 R 3671 0 R 3672 0 R 3673 0 R 3674 0 R 3675 0 R 3676 0 R 3677 0 R 3678 0 R 3679 0 R 3680 0 R 3681 0 R 3682 0 R 3683 0 R 3684 0 R 3685 0 R 3686 0 R 3687 0 R 3688 0 R 3689 0 R 3690 0 R 3691 0 R 3692 0 R ] >> endobj -3546 0 obj << +3642 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsection.18.9.7) >> +/A << /S /GoTo /D (subsection.18.8.7) >> >> endobj -3547 0 obj << +3643 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (section.18.10) >> +/A << /S /GoTo /D (section.18.9) >> >> endobj -3548 0 obj << +3644 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (subsection.18.10.1) >> +/A << /S /GoTo /D (subsection.18.9.1) >> >> endobj -3549 0 obj << +3645 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (subsection.18.10.2) >> +/A << /S /GoTo /D (subsection.18.9.2) >> >> endobj -3550 0 obj << +3646 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsection.18.10.3) >> +/A << /S /GoTo /D (subsection.18.9.3) >> >> endobj -3551 0 obj << +3647 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (subsection.18.10.4) >> +/A << /S /GoTo /D (subsection.18.9.4) >> >> endobj -3552 0 obj << +3648 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 673.356 539.579 682.379] /Subtype /Link -/A << /S /GoTo /D (section.18.11) >> +/A << /S /GoTo /D (section.18.10) >> >> endobj -3553 0 obj << +3649 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 659.807 539.579 668.829] /Subtype /Link -/A << /S /GoTo /D (section.18.12) >> +/A << /S /GoTo /D (section.18.11) >> >> endobj -3554 0 obj << +3650 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 646.257 539.579 655.28] /Subtype /Link -/A << /S /GoTo /D (section.18.13) >> +/A << /S /GoTo /D (section.18.12) >> >> endobj -3555 0 obj << +3651 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 632.708 539.579 641.731] /Subtype /Link -/A << /S /GoTo /D (section.18.14) >> +/A << /S /GoTo /D (section.18.13) >> >> endobj -3556 0 obj << +3652 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 619.159 539.579 628.182] /Subtype /Link -/A << /S /GoTo /D (section.18.15) >> +/A << /S /GoTo /D (section.18.14) >> >> endobj -3557 0 obj << +3653 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 605.61 539.579 614.633] /Subtype /Link -/A << /S /GoTo /D (subsection.18.15.1) >> +/A << /S /GoTo /D (subsection.18.14.1) >> >> endobj -3558 0 obj << +3654 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 592.061 539.579 601.083] /Subtype /Link -/A << /S /GoTo /D (subsection.18.15.2) >> +/A << /S /GoTo /D (subsection.18.14.2) >> >> endobj -3559 0 obj << +3655 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [519.586 567.602 539.579 577.171] /Subtype /Link /A << /S /GoTo /D (chapter.19) >> >> endobj -3560 0 obj << +3656 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 554.053 539.579 563.076] /Subtype /Link /A << /S /GoTo /D (section.19.1) >> >> endobj -3561 0 obj << +3657 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 540.504 539.579 549.527] /Subtype /Link /A << /S /GoTo /D (subsection.19.1.1) >> >> endobj -3562 0 obj << +3658 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 526.955 539.579 535.978] /Subtype /Link /A << /S /GoTo /D (subsection.19.1.2) >> >> endobj -3563 0 obj << +3659 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 513.406 539.579 522.428] /Subtype /Link /A << /S /GoTo /D (section.19.2) >> >> endobj -3564 0 obj << +3660 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 499.856 539.579 508.879] /Subtype /Link /A << /S /GoTo /D (subsection.19.2.1) >> >> endobj -3565 0 obj << +3661 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 486.307 539.579 495.33] /Subtype /Link /A << /S /GoTo /D (subsection.19.2.2) >> >> endobj -3566 0 obj << +3662 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 472.758 539.579 481.781] /Subtype /Link /A << /S /GoTo /D (subsection.19.2.3) >> >> endobj -3567 0 obj << +3663 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 459.209 539.579 468.232] /Subtype /Link /A << /S /GoTo /D (section.19.3) >> >> endobj -3568 0 obj << +3664 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 445.66 539.579 454.682] /Subtype /Link /A << /S /GoTo /D (subsection.19.3.1) >> >> endobj -3569 0 obj << +3665 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 418.561 539.579 427.584] +/Rect [521.223 432.11 539.579 441.133] /Subtype /Link /A << /S /GoTo /D (subsection.19.3.2) >> >> endobj -3570 0 obj << +3666 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 405.012 539.579 414.035] +/Rect [521.223 418.561 539.579 427.584] /Subtype /Link /A << /S /GoTo /D (subsection.19.3.3) >> >> endobj -3571 0 obj << +3667 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 391.463 539.579 400.486] +/Rect [521.223 405.012 539.579 414.035] /Subtype /Link /A << /S /GoTo /D (subsection.19.3.4) >> >> endobj -3572 0 obj << +3668 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 377.914 539.579 386.936] +/Rect [521.223 391.463 539.579 400.486] /Subtype /Link /A << /S /GoTo /D (subsection.19.3.5) >> >> endobj -3573 0 obj << +3669 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 350.815 539.579 359.838] +/Rect [521.223 377.914 539.579 386.936] /Subtype /Link /A << /S /GoTo /D (section.19.4) >> >> endobj -3574 0 obj << +3670 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 337.266 539.579 346.289] +/Rect [521.223 364.364 539.579 373.387] /Subtype /Link /A << /S /GoTo /D (subsection.19.4.1) >> >> endobj -3575 0 obj << +3671 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 323.717 539.579 332.74] +/Rect [521.223 350.815 539.579 359.838] /Subtype /Link /A << /S /GoTo /D (subsection.19.4.2) >> >> endobj -3576 0 obj << +3672 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 310.168 539.579 319.19] +/Rect [521.223 337.266 539.579 346.289] /Subtype /Link /A << /S /GoTo /D (subsection.19.4.3) >> >> endobj -3577 0 obj << +3673 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 296.618 539.579 305.641] +/Rect [521.223 323.717 539.579 332.74] /Subtype /Link /A << /S /GoTo /D (subsection.19.4.4) >> >> endobj -3578 0 obj << +3674 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 283.069 539.579 292.092] +/Rect [521.223 310.168 539.579 319.19] /Subtype /Link /A << /S /GoTo /D (subsection.19.4.5) >> >> endobj -3579 0 obj << +3675 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 269.52 539.579 278.543] +/Rect [521.223 296.618 539.579 305.641] /Subtype /Link /A << /S /GoTo /D (subsection.19.4.6) >> >> endobj -3580 0 obj << +3676 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 255.971 539.579 264.994] +/Rect [521.223 283.069 539.579 292.092] /Subtype /Link /A << /S /GoTo /D (subsection.19.4.7) >> >> endobj -3581 0 obj << +3677 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 242.422 539.579 251.444] +/Rect [521.223 269.52 539.579 278.543] /Subtype /Link /A << /S /GoTo /D (subsection.19.4.8) >> >> endobj -3582 0 obj << +3678 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 228.872 539.579 237.895] +/Rect [521.223 255.971 539.579 264.994] /Subtype /Link /A << /S /GoTo /D (section.19.5) >> >> endobj -3583 0 obj << +3679 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 215.323 539.579 224.346] +/Rect [521.223 242.422 539.579 251.444] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.1) >> >> endobj -3584 0 obj << +3680 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 201.774 539.579 210.797] +/Rect [521.223 228.872 539.579 237.895] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.2) >> >> endobj -3585 0 obj << +3681 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 188.225 539.579 197.248] +/Rect [521.223 215.323 539.579 224.346] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.3) >> >> endobj -3586 0 obj << +3682 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 174.676 539.579 183.698] +/Rect [521.223 201.774 539.579 210.797] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.19.5.3.1) >> +>> endobj +3683 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 188.225 539.579 197.248] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.4) >> >> endobj -3587 0 obj << +3684 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 161.126 539.579 170.149] +/Rect [521.223 174.676 539.579 183.698] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.5) >> >> endobj -3588 0 obj << +3685 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 147.577 539.579 156.6] +/Rect [521.223 161.126 539.579 170.149] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.6) >> >> endobj -3589 0 obj << +3686 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 134.028 539.579 143.051] +/Rect [521.223 147.577 539.579 156.6] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.7) >> >> endobj -3590 0 obj << +3687 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 120.479 539.579 129.502] +/Rect [521.223 134.028 539.579 143.051] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.8) >> >> endobj -3591 0 obj << +3688 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 106.93 539.579 115.952] +/Rect [521.223 120.479 539.579 129.502] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.9) >> >> endobj -3592 0 obj << +3689 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 93.38 539.579 102.403] +/Rect [521.223 106.93 539.579 115.952] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.10) >> >> endobj -3593 0 obj << +3690 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 79.831 539.579 88.854] +/Rect [521.223 93.38 539.579 102.403] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.11) >> >> endobj -3594 0 obj << +3691 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 66.282 539.579 75.305] +/Rect [521.223 79.831 539.579 88.854] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.12) >> >> endobj -3545 0 obj << -/D [3543 0 R /XYZ 85.039 786.531 null] +3692 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 66.282 539.579 75.305] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.5.13) >> >> endobj -3542 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +3641 0 obj << +/D [3639 0 R /XYZ 85.039 786.531 null] +>> endobj +3638 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F59 3455 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3597 0 obj << -/Length 3906 +3695 0 obj << +/Length 2582 /Filter /FlateDecode >> stream -xÚåÝsÛ6ÀßýWhü$ÝŒ`²/7‰“\Óks¾Ø™t¦í-)¯¶äè#½þð±V"¹9fâž›N#‰"¸Ðþ‹ÅbIóQfþã£R±,¯Fº,˜Êùhvs”®Ì7;âpÆN™¢s_@j&”L†Àò¢?›”r¼^ÝøQýÚO`í±Óë&æ,ýíÊQ/ýç!üOîÄ9_¬ýla#ˆJÞ¸ ‡¡pS3.Ò1·Ý.%8ÂÍsÜ"¸à>qÎOØËSsð£;0ÛÁ2Ì^·oa àB€k‹bQY¶ÅÃöô ®¡6š6€P%zm ÝÂ(ÁÑÌʉ+•l ÿZ6€qñ £ú £¡àS3<Ò?¾Ý<%8NñYÁÌÿ¼¦¦ø3bŠ?œÓ­‡Ÿí»~9þ·?ÿÕ‹ç?Ÿœ›õ¢‘piWŽíüÏí åBÊ\}M¶ †¡lS3‚-R±Py/Ûv¶”à0¨U•³LéÄökÌÚàÙmš„¿„â´*ò;£á'䈚õsÄê$8vt¡Ÿ#)8rÔfÙ••‰c˜ öËñ%¨~½ð ¸æ=?¬.Cêçelz,îµX›˜1+7ȹ‚l]&Λ†E?-xù'¹Ýðë‡"MͤH³&NêEÚî”Ü®*«TDZö»]ÒånßÃfSö³æ/ŸŸ}ÇdJ¶<³Q×µÏoãyù<€]·§uô¬+nÏ° nx&Hæ¬è!wr>k«Þ‘P,«Œ¾x3Ùš)·2=;³Y ¡ËÿaœpC¥„1ŸÁ{ ¨1à¤Ï…vˆ±@ ŽîÍœ]i(„Y*f­Ù¹­€´Ÿ3E¦¾·o´YÈeŠ5L° Ôìu1”olEàMZªw°-Ÿ€KHlÍpÏ9OpÅׄ ‘‹››¬Û´~)ãúÞÂe ¥›šx‘¢)¾í.€)Áq&ãœé"¦‡+˜ÉºÖ“27ÓÀM³¬¯éÙhƒçiK·ÞàÄÍ×M¸Äœnzª²â>Ý žšÀ‘Þ…*z·»@§‡!-«Òm¡FàÑ_£Þ"ìݯÃäH×;kK¼_ÐÀh>þûb½\€eüäË>æ.TyÌêݶÜvcíb“OÁW¬.]˜{q®å— ¿q 8Ô¬Ö®£ ýàHÁ\)YQä \ðůírІ›ª×ë•#4‡‘fGlìšxÌz ýï}õeûÔÿcsÓlëT˜Qdù}õÄACù¦f_¤fŠo» _Jpä«9ã\&¾!‡Qõw{+øãŸê«&ÄìØoWËÅñ_M̤Õ77Õ åš¼‘Ú)Þí.¼)Á‘·Ò̬#oqw}Õ/–qÝ%LÐåOñ>Õ(Sÿ2·±·º¼Žýdž;毻Ü÷çÖ‡FØ«ëñ|a½ƒ -~ïPˆ©é’‚Øî‘Â')%Ëx\ý˜&Fþø|±E{ê~Õ}‹ÖȾ´…Ííâ -ÏÜ`KKoUÏÍ”(õÞ\ Új©aˆ„P½ÕT] L€Çqž1YhdœuT®åÒ½KErõ|¾¹¹ì(VSËòÎ4^ßô"íÇì–¿Û ìÉÛæºq•zv*Ïô}ñæßõ™hq¨i¤f„i B”i´»@˜%8š/XűiT{³wõ¢²OÎó»j Ovãs¸6IÌf«å›¶ãpó¿s/Ö BrÏ71gðê¾Oí ¢¡ÜS3‚;R?ŽÝ‚;%8rÏr–%âwL$çï&ùzfÿõûÕ×ß™ï³aÀA¦Ï¦¼¸8¿Ÿü|vl§h}¼à§ å•š¼Ú„*{yµ»@ð¢^yY±’WˆÜÏðÒ®–V¹ļ¹Œ[,ö½v®–Ú}¿^àݳž øgÍÞ†N¦T<ô5ÐP³~#À,„ê­‘íèB¿‚£è‚ ì«áv‡G³w»f¯Þ³4_]º >?éäü~βÖÅC\‚v†­àIï¢è-ŒmË'pR#íB0-8 wE<µ‹è³¾š6wvRÏlîʺp}7.|âÒfºÌ‡¢‚Ÿ6”UjFÀBjEo•[G\”àÈKHó‚›N}+¸:ìtnWéN–8È;p‚Ž†‚OÍðHÿ¢è­ÿêèžÀ‹Ê |­p‚(c“b ù”íEÁååþ®Î?vvÿôÖü;­ªüÞÑ ŠH5맋•LÐíèB?]Rp¤[r&Å]îé¾ZÎñþ¸¯«ÝîÞ?ÝÏàîÝzÔŸ Ÿšà‘þEÑ[9ÑÑ<%8‚/4+5NýsáÁ¿‚Çbà0ª;WW}óŒØfüÞñï¿]Üœ» †Ãf7óµ£¾ô5§k{¿V%ùÝQ ¥ššT‘rEÑ»¡ÓÑ‚*%8RU’å{iû´Krö­«½e2V@ÂîìAeïÙ“S[Äö0Ç.(d(åÔŒ Œ”MQnw L Ž”¥Y?jœ µO0ù åg×0®ÝóLÌè|[¯a0ôA%Î@_C 5#Œ± Œ ÝÂ(ÁÑ„fBଯ}‰5‚çËͶ¾¾Æeø°Y(çNEÓþ¡&í¢i” Uu¬|‹‰b‰{ÄÔ2”ujF°F*7u» kJpdm¼x¡÷Xžõ#jÕÌq†7AÝ6³P]ә͓îù6 =¿ýµv_¥VêhÂJ35#h"¥Š¢w¿¦£ MJp¨º™–#Lî‹.:F-uï…<¸»öe|’Þ(ÖnxîÌ%ÍiŸRIë.Ýh³öeu>ø:,e…•x©þ¬ëµ2”tlE€NúEï–L[>™Æ,·§+9ÂÌaG £x§l¥îåÑ¢Ó^ûú;qÏßM5SËh/•ÏãKQ>¨:(k }Ô¬?AðïèB¿‚£èœe¹@õÿåÒº“·ó #>ÝSg­@Iuß¹ƒŠ†rOÍîHýB÷nÍutàN ŽÜUÅd‰|Žêf á¹ ÁvøàÓõMX.[´—¡:Ê|÷n‡mç®Ó«»Ÿpb¿zì²ü{î\¾¶ †¡lS3‚-R1ŶÝ‚-%8²•ŠU9f µ¯­+¯·©n¿^¼Û5î41á!Ò–©_«õ”Oz€J©Ûy;Z ÷FÛ$Škm7u¥ïŽ+¨`(×ÔŒàŠÔ+tï&]G®”àÈ5,/%â -õ?ù›Üý†°­¶Z³:(Bæ -"êíâÖ>ê±Ò÷݃†²MͶHÅB÷n]ut`K ŽlyÉŒÛCl¡XÂݶv‹—&p~ë]ójïñëÅûfÓlÃè-yñ­eG‚z†2OÍæHõB÷fG:º@0§‡5Ïé¾^›Û¶‹¬‹RņUöñqÀú/Ì9Ø˸˜ŠÏ~µIŽâ~V$ß­m€‡ÚFjFØB$to6¥£ „mP‚ƒ?¨8Ó¹F¦Á±;pMt÷õ¶~\ãGÀ[©âÛNš‚–’O­úÁ#ý Ý›wiËïÇNI-/1uXŒ=n–.þÉ;†gþvD÷È_­Åÿñ£ß½¾†>F6¶"#›HüÛò©?Ð/5=Ey‰øâìÇÕ¦°#½ó9îß.wÐÓà‡ †VÔ3#‚{[~‹{øSQ1‘©®?aþÏÃſüoQÄ?˜!KV•½ùÍ --G¹b2¬ {œ„zü-*endstream +xÚí\ßs›H~÷_¡Ú'tUÂ Ì p/[‰íì:—ä”HÞìÖf°„mn%P%öÕýñ7=݃„Ùqˆl©Ráa¡þèî¯ ¬ã¨¬ÛñÂŽH[x¬3š8Kuæ—F3œ·)àÔóáÁá !;̱C'ì /ô”áøOë(K»n`•1~Ý¿†/N†µEzÜæÒƒU>üù—Ó«/zyàØ^t>«cÇfaØ™páÙ‚{ô÷ä`pð¶ZÏñ^Õp¯=Î\Û ÂNÏsì àÕM3ÑpÓ,´…͸Ýe·¢Ù¬Ë¬I2ŠÊDýffÝžú-£n©ßUö +}«31EÓnÏó<«Ÿ'jv×]Âe̲»=†ð!gýãKç6˜òm—¯€ã…Âö]¡Ž×Dš_vðàÝ/_¤ËÅêšLÚžäËKÞŽ\ÃMЈVäå`”'€[¹†F)ÇñcƒZ1ÂQf%³æfiS¸õÁN_ ô uÈ𺋌x“¥=8;høž¼Äåv!ÛBê»Wæ ¬Mñ¸>Ây£ù¬È¦JF‡ é®Pÿ©¿ߨ§¥8Ãu–¾Š¹Ž2K´ÎoÝÀ³””çEó7ÊЧ™ébñO +nOÖÑYÐðR Úqé²¾~H…W¥ÂBˆPE<÷ð(ûm¡ì£º\wÑâ\ÊJ¢.­èÈ ÝÄèHôO]EZ¬ZOÂ6 ÝÖÙÉàÛ›à nƒl®Ÿxq+»€O×:‚±³šQ;Öêø Ô1,ûpúp“þn¶¥i!9¶º-":à|6†­¼ÂSã}."€€QÕÈi»ªXX/XÒ·ÝÁM8÷ÃÍó•îl ›ò=—sëM\v]_a¤$ÿ›8hÞŠWqM4´ZÆ“z¯‘g0÷³æ™HA|ÎZêAAäʇLþï¨|Òfê7xRZ/º·òlŠêô^£¶@ÆŽ&IâhèÊ OD)Å¡aˆ =Æ‘Aœ£mwòÇ­^¬%d\BfÍ7¡LOÔàµ͉Îã óY^ÅÄA`Ò0ÑÓ0!#wÕ>²6ˆˆZò¡ð«kÜQöx_ÐîæÔüû:µU/Ö`/¹õ?œöæô÷Ê(Ô©óèë&“bòÀ“?Ø%¹­>ÿA\Y>ˆ€™…Òö­sˆäÖ³+' ¥·zÐÆû¬<¨ïÐbÅU®aAÔ¹õ2 pŸÄEÅ ”^R E…&yõˆW&EEP—:e‚‚=é²-6M^¦)ø²iZ¤uøC`öÕ¯–ü‡»ƒGż½6èAPY¹*Ï»NÖó®ƒußc”%/–ùø¥*’=y.À[±Ae ¢Uš¸ÞžûÙÃìaóbÖ|š¤Ñ„œ{…ÈJš¯FᆃEñ#*êîGS‰IbÖ¨0V“BG>nk׎.… sWcºq^e_ ×%Çb†2.¤-»Àù‚¶TˆZ/Ÿ>Γ¥þ®’rך³…ƒà‰þ>Ö3×Ñ‚QLûrÇHzØ`’š÷À¼õo«±aÈ`õ¡*ŽQoÍ&b³ìÃÛÄ[´ôibA”G˜D¨ä™º(íˆ–lúü +B/&¤Ez¨Òƒ«(§Ç]»KvÀö²é—(¥µˆ«¯L11òjP Á®`ÞÖ£ã;m¡C5@íþCkn(Û*7#¶°“l¥g‹ ’vÏ +ÔÓµg>k ªõé®ï\¿õá|R½ôæ +-\¶´e5ìSbœU¢s;ó§ûpVÃ'[¡è.Rôá"n¥]!¼‚àú‡]Ž1ùMT¼B<Ûooº ®~+ÜÐ5̵· +V&3*#½³Þd¾h‹ðpŸdú~èm¦–DíŸ'©ÎýÝôÖý&+¿­rÓÂûAH<ÿUVÜnIAߦ¤îº肶 £H –U*Ç`1Ï#LŠÌgð*±W¼л#£ñh£ÂYãÆÐ[RïÕÊ.tPNûà_!š_ÏÖ^=ag9FÚÒuŸ> endobj -3599 0 obj << +3697 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsection.19.5.13) >> ->> endobj -3600 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 741.102 539.579 750.125] -/Subtype /Link /A << /S /GoTo /D (subsection.19.5.14) >> >> endobj -3601 0 obj << +3698 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 727.553 539.579 736.575] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.15) >> >> endobj -3602 0 obj << +3699 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 714.003 539.579 723.026] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.16) >> >> endobj -3603 0 obj << +3700 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 700.454 539.579 709.477] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.17) >> >> endobj -3604 0 obj << +3701 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 686.905 539.579 695.928] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.18) >> >> endobj -3605 0 obj << +3702 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 673.356 539.579 682.379] +/Rect [521.223 686.905 539.579 695.928] /Subtype /Link /A << /S /GoTo /D (subsection.19.5.19) >> >> endobj -3606 0 obj << +3703 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 659.807 539.579 668.829] +/Rect [521.223 673.356 539.579 682.379] /Subtype /Link /A << /S /GoTo /D (section.19.6) >> >> endobj -3607 0 obj << +3704 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 646.257 539.579 655.28] +/Rect [521.223 659.807 539.579 668.829] /Subtype /Link /A << /S /GoTo /D (subsection.19.6.1) >> >> endobj -3608 0 obj << +3705 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 632.708 539.579 641.731] +/Rect [521.223 646.257 539.579 655.28] /Subtype /Link /A << /S /GoTo /D (subsection.19.6.2) >> >> endobj -3609 0 obj << +3706 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 619.159 539.579 628.182] +/Rect [521.223 632.708 539.579 641.731] /Subtype /Link /A << /S /GoTo /D (subsection.19.6.3) >> >> endobj -3610 0 obj << +3707 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 605.61 539.579 614.633] +/Rect [521.223 619.159 539.579 628.182] /Subtype /Link /A << /S /GoTo /D (section.19.7) >> >> endobj -3611 0 obj << +3708 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 592.061 539.579 601.083] +/Rect [521.223 605.61 539.579 614.633] /Subtype /Link /A << /S /GoTo /D (subsection.19.7.1) >> >> endobj -3612 0 obj << +3709 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 578.511 539.579 587.534] +/Rect [521.223 592.061 539.579 601.083] /Subtype /Link /A << /S /GoTo /D (subsection.19.7.2) >> >> endobj -3613 0 obj << +3710 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 551.413 539.579 560.436] +/Rect [521.223 578.511 539.579 587.534] /Subtype /Link /A << /S /GoTo /D (section.19.8) >> >> endobj -3614 0 obj << +3711 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 537.864 539.579 546.887] +/Rect [521.223 564.962 539.579 573.985] /Subtype /Link /A << /S /GoTo /D (subsection.19.8.1) >> >> endobj -3615 0 obj << +3712 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 524.315 539.579 533.337] +/Rect [521.223 551.413 539.579 560.436] /Subtype /Link /A << /S /GoTo /D (subsection.19.8.2) >> >> endobj -3616 0 obj << +3713 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 510.765 539.579 519.788] +/Rect [521.223 537.864 539.579 546.887] /Subtype /Link /A << /S /GoTo /D (section.19.9) >> >> endobj -3617 0 obj << +3714 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 497.216 539.579 506.239] +/Rect [521.223 524.315 539.579 533.337] /Subtype /Link /A << /S /GoTo /D (subsection.19.9.1) >> >> endobj -3618 0 obj << +3715 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 483.667 539.579 492.69] +/Rect [521.223 510.765 539.579 519.788] /Subtype /Link /A << /S /GoTo /D (subsection.19.9.2) >> >> endobj -3619 0 obj << +3716 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 470.118 539.579 479.141] +/Rect [521.223 497.216 539.579 506.239] /Subtype /Link /A << /S /GoTo /D (subsection.19.9.3) >> >> endobj -3620 0 obj << +3717 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 456.569 539.579 465.591] +/Rect [521.223 483.667 539.579 492.69] /Subtype /Link /A << /S /GoTo /D (subsection.19.9.4) >> >> endobj -3621 0 obj << +3718 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 443.019 539.579 452.042] +/Rect [521.223 470.118 539.579 479.141] /Subtype /Link /A << /S /GoTo /D (section.19.10) >> >> endobj -3622 0 obj << +3719 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 429.47 539.579 438.493] +/Rect [521.223 456.569 539.579 465.591] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.1) >> >> endobj -3623 0 obj << +3720 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 415.921 539.579 424.944] +/Rect [521.223 443.019 539.579 452.042] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.2) >> >> endobj -3624 0 obj << +3721 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 402.372 539.579 411.395] +/Rect [521.223 429.47 539.579 438.493] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.3) >> >> endobj -3625 0 obj << +3722 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 388.823 539.579 397.845] +/Rect [521.223 415.921 539.579 424.944] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.4) >> >> endobj -3626 0 obj << +3723 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 375.273 539.579 384.296] +/Rect [521.223 402.372 539.579 411.395] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.5) >> >> endobj -3627 0 obj << +3724 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 361.724 539.579 370.747] +/Rect [521.223 388.823 539.579 397.845] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.6) >> >> endobj -3628 0 obj << +3725 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 348.175 539.579 357.198] +/Rect [521.223 375.273 539.579 384.296] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.7) >> >> endobj -3629 0 obj << +3726 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 321.077 539.579 330.099] +/Rect [521.223 361.724 539.579 370.747] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.8) >> >> endobj -3630 0 obj << +3727 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 307.527 539.579 316.55] +/Rect [521.223 348.175 539.579 357.198] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.9) >> >> endobj -3631 0 obj << +3728 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 293.978 539.579 303.001] +/Rect [521.223 334.626 539.579 343.649] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.10) >> >> endobj -3632 0 obj << +3729 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 280.429 539.579 289.452] +/Rect [521.223 321.077 539.579 330.099] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.11) >> >> endobj -3633 0 obj << +3730 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 266.88 539.579 275.903] +/Rect [521.223 307.527 539.579 316.55] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.12) >> >> endobj -3634 0 obj << +3731 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 253.331 539.579 262.354] +/Rect [521.223 293.978 539.579 303.001] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.13) >> >> endobj -3635 0 obj << +3732 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 239.781 539.579 248.804] +/Rect [521.223 280.429 539.579 289.452] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.14) >> >> endobj -3636 0 obj << +3733 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 226.232 539.579 235.255] +/Rect [521.223 266.88 539.579 275.903] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.15) >> >> endobj -3637 0 obj << +3734 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 212.683 539.579 221.706] +/Rect [521.223 253.331 539.579 262.354] /Subtype /Link /A << /S /GoTo /D (subsection.19.10.16) >> >> endobj -3638 0 obj << +3735 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 199.134 539.579 208.157] +/Rect [521.223 239.781 539.579 248.804] /Subtype /Link /A << /S /GoTo /D (section.19.11) >> >> endobj -3639 0 obj << +3736 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 185.585 539.579 194.608] +/Rect [521.223 226.232 539.579 235.255] /Subtype /Link /A << /S /GoTo /D (subsection.19.11.1) >> >> endobj -3640 0 obj << +3737 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 172.036 539.579 181.058] +/Rect [521.223 212.683 539.579 221.706] /Subtype /Link /A << /S /GoTo /D (subsection.19.11.2) >> >> endobj -3641 0 obj << +3738 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 158.486 539.579 167.509] +/Rect [521.223 199.134 539.579 208.157] /Subtype /Link /A << /S /GoTo /D (subsection.19.11.3) >> >> endobj -3642 0 obj << +3739 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 144.937 539.579 153.96] +/Rect [521.223 185.585 539.579 194.608] /Subtype /Link /A << /S /GoTo /D (subsection.19.11.4) >> >> endobj -3643 0 obj << +3740 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 131.388 539.579 140.411] +/Rect [521.223 172.036 539.579 181.058] /Subtype /Link /A << /S /GoTo /D (subsection.19.11.5) >> >> endobj -3644 0 obj << +3741 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 117.839 539.579 126.862] +/Rect [521.223 158.486 539.579 167.509] /Subtype /Link /A << /S /GoTo /D (subsection.19.11.6) >> >> endobj -3645 0 obj << +3742 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 104.29 539.579 113.312] +/Rect [521.223 144.937 539.579 153.96] /Subtype /Link /A << /S /GoTo /D (section.19.12) >> >> endobj -3646 0 obj << +3743 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 90.74 539.579 99.763] +/Rect [521.223 131.388 539.579 140.411] /Subtype /Link /A << /S /GoTo /D (subsection.19.12.1) >> >> endobj -3647 0 obj << +3744 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 77.191 539.579 86.214] +/Rect [521.223 117.839 539.579 126.862] /Subtype /Link /A << /S /GoTo /D (subsection.19.12.2) >> >> endobj -3648 0 obj << +3745 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 63.642 539.579 72.665] +/Rect [521.223 104.29 539.579 113.312] /Subtype /Link /A << /S /GoTo /D (subsection.19.12.3) >> >> endobj -3598 0 obj << -/D [3596 0 R /XYZ 85.039 786.531 null] +3746 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 90.74 539.579 99.763] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.12.4) >> >> endobj -3595 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R >> +3747 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 77.191 539.579 86.214] +/Subtype /Link +/A << /S /GoTo /D (section.19.13) >> +>> endobj +3748 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 63.642 539.579 72.665] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.13.1) >> +>> endobj +3696 0 obj << +/D [3694 0 R /XYZ 85.039 786.531 null] +>> endobj +3693 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3651 0 obj << -/Length 4038 -/Filter /FlateDecode ->> -stream -xÚí[sÛ6Çßý)4~©4³BHàeß²NïÍ¥kgÚ™¶´DÛÜR¢JÒu2ûåÀÁåHO†IÜØÍÎN×…C€ç÷Çí`ÂY ÿÎ2Á‚(Ÿ¥YÂDÎV›“`v-ùú$4)–&É¥ù×ÅÉ“¯D2 –ùìâÊÝ'˜È“ÙÅú—ùY³]ðlÞ—ð§[üvñÝÉ—îÆ(ë0ŠÔmÿ8ùå·`¶–Eøî$`QžÍîä瀅y>ÛœÄ"b"ŽÌ÷úäüäGw/ø-žÕ±§QÆD #è1Bž°8g©,‰SýaÎBÎb¶£xþº«¶×êIäógÈ0L¤‰ÌJYôëËË…çÅê÷Û$ÞËE$òSj³ÅRúçùðâþöiÌ€ ÎsçܦözþÁ«%2‚;¼·ò,O³AŒ -ŽP •q„,äcΩ=«˜ˆ-¸Hæg¯_/–QÍ_-Ây[A]€+ÏZy©úS])Kù«üÚ©Ÿâù•úÜlàËÊ*Ÿß¾Ù¡[Tòóöš5*áõb™pþÑ©˜"Æà?M…ïÍøˆOóQøÃ"ð©Œ]sÁeê8GðCh.®šÅ’§š¤l4´•ú¸l«ˆ ØÊkkøüÕ"‹çÊ"sJ!+AùfW{)ÓÇB<°&` ¸ñÍTàÞŒŽüγ`ø°p*ã01µ]^݇=WÿΓ<–§;ͱl¯äoºz¯úSéZ‚\vŽ¨âÇ’þ#hêÇ8K—Le &_ãfŠí~¶×±ÌSÕ’°rõ›F5ºwÀ¯¿¤êóé+݈›6y ±âÿÍKu駋—z×m_šŠ^™ ¨ëÅ2Ä_…žp*%gE€ò¾£X ò'p¹ZbI–ÊKá!²H#“i4i~¿èÀÿúÒ+‚ÅöÚ}QlÊ÷ïO?Uí³®˜È™ÃÅnæY8F÷HÆñ’;¾iÌ"ÁùÆš¯y+¿îºf#Ùêïÿ®;}ý‡Dí±7Ij“lÍÅuÕúÖÚÞ5Iy´©¼¼Á ¹â5,Á‹ÊØñJ–É¿¼„æuqS›7¥,”·…©Ð×íBpYU+)²ùkÅa[ý„ñJO§úJN)‡Ó©,gr”fîQ¬«j¡«Ò­×ò;cJº×ÇþUãä1M7#D€XðŒŠ`XBTÆNqʸˆEh(2ŠýJ=R„q dÆ6*Òœ‰ÀÇBcˆ…¾Rn/ì<ëéJ“ÑÝúpú|g›c9ÙÖ š%Ƀik壟[×MÕƒ7#ô€°ð,Õð„¨Œ]OËÖƒ ž—=¢Ãtxÿ¨>7½j›3ÂÃyÍdLÆ[S%àÍ ”†E $@eì$ ¸lr$ÓÆŸ5m[® ™4éÕv%öSr¸úT'_5·x%DM'n㙩¸½yÂ=,›ÊØá–©³ÑŽ€öÓus©ûtÓ `Øx©Lõá]¾ÒÓÅ[/3‹e­]%SM„™Bþ¤Û‘5tíæ÷³ºr‹ÏË8 î<çTvΊ@ç=ȳt”Ü ‘«ãÆ‹Â3ëÞ*z£}ªÖ U~P .z‘3çZ¾â¥ÇWò—p§%ºÕ°¸<½Ní·nÌÐ᫪öñùó·°ÎR¼‘ýHš<èåò÷XJG^š$@ʹ‡÷~—‡E 4HeìD†,M8¡švÁÅ€.kKY~¹Ñ!„•UÈ”Iÿ͇ Æ[S%àÍ <ÝMq¤„¨Œ­â<“ÀH@z’wÛ«ÁakàïÕ>áà¡”OòÏbàh6Q Èl\ ¡„#EW™±SB&Ù'RB -Jxi—a]™šQÆ*Ðèµn¿«ŒË¦êÀ›:@8x6ºÅæHPÛ˜Bœ†, }ÌY@LáéZ-íT:4cc·ÑüyÑ—m¥¾…Á±îãêû?\ÆwSáÍA .” †E Aeì!R&§žN‰Ä­ -×5KÕ<+ë‚vzÉ4¯Ü„²sÑÿ?Ò´@i¯ç$çšP­%k7Ú,Õt#ˆ·qÍTÞÞŒàÜÎóÑ­GŠ@ð¦2vA³ LoDòŒÎš­Z,Vmþ­ÞÔáž[潉t~SJYéMui=ØFÝ<þT¦ÞŒ`Š\K1`Jeì˜F‹“15Q!_G—«f»Ö`ÉRBËÅ£h‰ïIÆ_SEàÍ <Ý5r¤„¨Œ$ö<Ä"0Á¢çì{¶½º©Þ×zðËAªz§qú7§n4•º7#¨#çSÔ‡E ¨S»î;ˆX”ø5ºïoM{}†eõn8¿‚µ9½a mnÕÊm]2µ«Gäó0þŒGxÆ›S%â͉ R”D†E $Bel%e9ËB¿f™eD¼ãbÿGö•ef?Ø•ÞSÖlŽìã‚ št~Ñ7ãå¢ïÕ³l~ã6 ÒèÀteŸ@y#º°.œ¨ d6® Œ‡ç£ÛŽa\dÆN©'øþ"YƒhîÞÓóf2¥§®ƒmnÒöî¦rwR™è`XRëUt)tý|xwrÕyé´%Ì„l‹”&ñ£íw -¤xøäð62#4nÆŨƇE 4Nel5.+ËS4nvbøM-¨ãÒûh¾ÀWôzÈvog•ØœP/ -sXjo#–òÜúf"pd6û~¤ãÀÉŒðLi9nv=œùáG[®š­„jzTõ0uîÉ2ÕK ëÒôIÛÒœ\-+¤¦÷¯€qÿþÉϯ$œ4ý0T橦¢òf*ä1 -Õ°**c‡*IY–&•ÙðTw/Me:x·Õ ¶«Ø}X?m0ÁíoÊ£Uz‚ÖŒü`N%›Ó;;Óm¶×fsk—º–y˜¼'IóÐSIz3‚$r(ErX‚$•±#)bùX‚$iv¼Þ]뤵ÝB À£þž½Vc…sø²Ö¿1Q]sõI}Á{c5PÕXðù‹‹'¶âÉoGç$ÝØ áÚÜÓŽt.ëRÂÊâìóðXbM'G‘¡\“è]ÊP.•±S.Oç9Rn6è.ní8ؾ¬@í¥BÉpÝA¯!?š×àõÒÂýX˜w õòƒœw7pÖFŸ½…Ù,ù—^<;S»´Å=6ΘJØ›„‘£y>º‡úHÂTÆŽ°¬ÛIŠ ç@Xmk°!sºÙ¬U—¿?>¬ƒ8ÅᇕñÄ6ô”¥F}ΞÕJ¸wjÁ-HPå6^šŠÞ›è -ý°z*c‡>Xˆç·2É"9›éÎþˆ¬ì"éyé^ŒÐV½"ýoª¯Ý‘¸ªìTÃGÒˆƒK¦bvVeïl -ò ‚1‘«Eª×Ðe{aÉ3¶€WöL|eǹ9ÿÏ…Úd1?}ªZrïÖ†U×·EoÃQ«Â™ša³P÷­Q¨áÈK‰ô9 {7lP»@Ì@ëÃ>§•úi~"Md6Ž;–ày¤ã@ÉŒÑ4bA„Ë!¢{/ rkOz`i_:Óô•Š2½=õ'[n·ö¼«ÙêÐíwÑ/.–câHrñ)ëªõÄT¼ÞŒÀ‹¼LáÀKeìðŠœÅÙ^£íWØå¹ä„@çÿ±9Àe¼6U -ÞŒ"BIaXB -TÆN -±`y´'…¤0¬èÍn¿öâ3knýè¶;lrÑšÓÞ9hZí½·x§‚äqxïPÍóO…êͨȷ<=ut¤T*c5â,Êb UÔçM·YÝlLGïGº¬!Øæ#tû«;xÌÝâ0Ž:ú|Ý#¹¿çd´‘ÑGiž{*LoFÀD>åùè©‘#E `R;˜aƲSÕþpóè -‘!ÕøxñýVB·¯$PÛ¾ÛßÍ· -ÞLÀ!º* ½õ“©m'ÇVµêÎIJ,¹¿ªi|*MoFÐDN¥h‹@Ф2v4Áx†ã­j»`bO–í¦‚õU8r0Nz›ûÛ'Ýþþý'1Ö'øºD &mÙá¯Å•›H—u´%´ÑhÝ7û8uÓ<øTšÞŒ ‰œJÑ Ieliæ!K#rUû;Oíè0›o‹®Fòãi½3qª0‡Z)mϹq¯ éQC©«¥´îtõU=®dtp§ÿè0i©à 0*ù®2¯SiàÝcðyÕlvuÙ—òƇX¨z·ú¯AÁ,ho±®Ù–ƒ£gŸçÀ0Í$÷éïwVÄ»H!Í;t=ÌŸzeüx®VÕIÌ’(êÎAÕ.@3<]¤gîzq ³;ÍgÝêœÛùŸ®ö-{Ë~c]¢. ^—a¶"èVNÝâíÁV•ÑÝBŽ¾ØN?ïä÷ÚY+êµvΓ¿aþ~öXrDûgä‘}ÛóûÿëîŸHˆ3–g£Ø”%i<‹‹ÝÜat?$B%þîËGendstream +3751 0 obj << +/Length 2695 +/Filter /FlateDecode +>> +stream +xÚí\]S£H¾÷W¤öfIÕ‚@7 }éø1ë쪙‰¾3U»{ jjHȪýñoŸsº ‰Ä‰£F£)«ú 8OŸïC¼–«þ¼V8.“­0NÀ¼Vo¸å¶.UÏû-Op[ÜqE]ïN·¶Ñò\Gº²uzCNûY»Ù¨íGV™Ð¡hÿsúakÿ´¶ˆÍ.¬òïÖ_ÿ¸­¾ºÑ‡-×a2j]«s×ñ¤l ·xÀœ€3}nu·>V«PoѬ†gµY:^¤Ž®E¼zf/hxfO:s<§íYðϳ„tÛ6cÌúÛc¼/’´mÏÊÕ€‹¤§å/4 mýÊyѶ¹Ç-§m® .eíjöpWß“OŸC… E&O¨ó[´Ì/[tòéý$ô#w~MO8LðÙ%Âäžri˜|„é÷ è~ Hp«¼Rí ×QQϺ$´~?¦Ï§'4¬«zÊ8/“>u–tÜISE<Á6´o¢=CÚ´#femÛ­l—Õ‰ÌñkAtì–€C<ºÔ°ÇÃëmxâ pሠ0Q—ã"*Lðú7ÂcŒpõÿU½·0ÓCR=†æêÆþ 'ÞRcK³ª/‹ÖÞƒi,MêI}z•À=•"”µáB-øzÎû¼øŠ@À‘u$ þv=ÞkH¥.q™[FÒ ¹Yc§×Vˆ€t$ß*]¤V ¢'c–3ÒKðÌ"Á½öÿ·š‚Çý¾W£s +Ì2â9)s<¦ÌÕ kôÕ€0xÅ¢Ì_%:aMÅ€è™ -£x(­=Rû#„&îºù†OJœ0ˆSlŽ\c$”gŠçþƒƒkÅ0WͨáBM´9—ÖQÜ£‘'jD—:¿ÀÛ·8wBú6ðÐÄÚÌ·vq©á°2Qªªç írv|ø¥mGd>W> S×à[ƒÍýÀ>Kd/.ãs°Mp$6üotÜÈœäqiNµ…ØQ×=5Éøzó3û)H¸ç;n$ï¡/ÁRW¿X`*Úù`L¤ìšÌ +<ŽàEÕ `jšÑö´¤6¡–*q`VÓ|yhúiX&NSÒ»¶àì1À Á3€ÁîÇÊ@ôa¡?›|§‡TÍ@Ýv˜®~SÞ6ìžu”HŒ„x1’ëQ‹ûf¬àጵ˜qV7)kqëlLÿã$+A¼ 7x™¤d‘øp.«BNËÄÝ,Ï“^I°ÕÅßᨇ]$±($±M}npzœá´ÓÏÎQ{%·¡"yH¦h«¢ìöЩkà”‹AÎD^Ðì °Zµ£ñAì“Óý»é Š¢ûÊH,CyN”‰2½}™Ìß=”Näji}w0Y"as(Y÷ÜýTi¦âÁ †»ßPÒ*ã¥CñR8îÞ}óûDÁ%øƒ”`¸* h£hæ«Üñó4™†x¯Ð%,I€In‚bd|£ +Ÿ?Aø¡Á?)A»å¹™ L „LÈEs7ŒÑJüŠ€üŠ~œ4t­ÀË"y—IŽaÏuýFñµr,V¦Ð`NÀUÎ00²—¤ 9̨±]:UN ¨b^ßÚjj\{1o%<“cO´Ò« @að*°’«‘ŸÂ8Sïf#H/€Ž›`ömŠF×Vbüet©-Î}uq3Ncl„\hÀÃW( åJlWa¼»)Ø +“ºhÛ#dë Ä^†Ò]_i×ï(F b´™æ®K4T(Œ ÜÃl {<ÈBÛ¬~ Œ#Ü.rˆ##‚À‘gJí@C™-öÅwp¡2®2°ó¹€\߫ʨ‰²É.]#å%½• bGY>u¨AÙ\ZVFÅÀ€¸{E*JÑ8RDß؉Íðù+O|»”Ÿl‰Õ4 ª +×<.S§$ôeÚt:œVÂb|jryƒª®¬Š»c–Ú©&p« ê³¢>UîkCeI~ñ –z(ºŠ_¢†7_Ãeåøwº¤ˆ‘)ŒÖ­´‹oCשÝk +¹LUü›æ%Qbu©ö¥cwA‰xÔÚEß0Ž|·ŒQÅkbu9Ö(°Ø¬ý÷Îx3I9kàÝ­=ñúIɲ¢JɆUàO(Îú•»b‡{h¯ÍØÅTÅ~Yü˜Ö3õ±,`ÏEo±*5/ˆÜ!Çê+túŠJ±Ô©"\1Åÿ•[³¹èÈøŽŸ‹s·‡õKúrÕÄWFüh‘Àÿ81›sRË(«íl~Þ<ùt¬ýõ£á$›Ì²~jøçöÒ²s-Y¸nªxuÈHBFg~z u€ !*]¹&o׿Àô +¸ºåÉ@k…Y¥ÝuvÆ€ÃûE¶WèGë +Éý2ô¾Kú­g¿ LPÐðM#ŒÓz˜º/XH¢ÐÐ’³N2 ++éÙ[ɾ? :Ÿ;<¿WT_Àw›@jKe•–qïk›©ýM_:ˆÐúßA—N†7v­þ˜cž, ßM‚Û,xóÆ3÷vWÔDHx[óãLM½ú=—ÚÅêm=õ¾>×ÞqBŸ›¯´²­>ö59‹*‰§ aÁP”ÒßT›Ü{¿7¡þØ¢J=£¯AÞU¤}jSÙœ‹ŠÖìûƒÍ4؇£^:A÷P3ï)PØÒëÂß`ûXØzOo"¸ °™P.Ï„JÞA¯ œfâ? +¶ÁÐúÚä¦ìÏß17ŸÑ>é—¸µ}%ÞlqéüRV å3l!méÙÌs"4ÿhèTt<à÷>¹ï,ëüÜz3ó2ÿRnnendstream endobj -3650 0 obj << +3750 0 obj << /Type /Page -/Contents 3651 0 R -/Resources 3649 0 R +/Contents 3751 0 R +/Resources 3749 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3701 0 R -/Annots [ 3653 0 R 3654 0 R 3655 0 R 3656 0 R 3657 0 R 3658 0 R 3659 0 R 3660 0 R 3661 0 R 3662 0 R 3663 0 R 3664 0 R 3665 0 R 3666 0 R 3667 0 R 3668 0 R 3669 0 R 3670 0 R 3671 0 R 3672 0 R 3673 0 R 3674 0 R 3675 0 R 3676 0 R 3677 0 R 3678 0 R 3679 0 R 3680 0 R 3681 0 R 3682 0 R 3683 0 R 3684 0 R 3685 0 R 3686 0 R 3687 0 R 3688 0 R 3689 0 R 3690 0 R 3691 0 R 3692 0 R 3693 0 R 3694 0 R 3695 0 R 3696 0 R 3697 0 R 3698 0 R 3699 0 R 3700 0 R ] +/Parent 3803 0 R +/Annots [ 3753 0 R 3754 0 R 3755 0 R 3756 0 R 3757 0 R 3758 0 R 3759 0 R 3760 0 R 3761 0 R 3762 0 R 3763 0 R 3764 0 R 3765 0 R 3766 0 R 3767 0 R 3768 0 R 3769 0 R 3770 0 R 3771 0 R 3772 0 R 3773 0 R 3774 0 R 3775 0 R 3776 0 R 3777 0 R 3778 0 R 3779 0 R 3780 0 R 3781 0 R 3782 0 R 3783 0 R 3784 0 R 3785 0 R 3786 0 R 3787 0 R 3788 0 R 3789 0 R 3790 0 R 3791 0 R 3792 0 R 3793 0 R 3794 0 R 3795 0 R 3796 0 R 3797 0 R 3798 0 R 3799 0 R 3800 0 R 3801 0 R 3802 0 R ] >> endobj -3653 0 obj << +3753 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsection.19.12.4) >> +/A << /S /GoTo /D (subsubsection.19.13.1.1) >> >> endobj -3654 0 obj << +3754 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (section.19.13) >> +/A << /S /GoTo /D (subsubsection.19.13.1.2) >> >> endobj -3655 0 obj << +3755 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (subsection.19.13.1) >> +/A << /S /GoTo /D (subsubsection.19.13.1.3) >> >> endobj -3656 0 obj << +3756 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.1) >> +/A << /S /GoTo /D (subsubsection.19.13.1.4) >> >> endobj -3657 0 obj << +3757 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.2) >> +/A << /S /GoTo /D (subsubsection.19.13.1.5) >> >> endobj -3658 0 obj << +3758 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.3) >> +/A << /S /GoTo /D (subsubsection.19.13.1.6) >> >> endobj -3659 0 obj << +3759 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 673.356 539.579 682.379] +/Rect [521.223 659.807 539.579 668.829] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.4) >> +/A << /S /GoTo /D (subsubsection.19.13.1.7) >> >> endobj -3660 0 obj << +3760 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 659.807 539.579 668.829] +/Rect [521.223 646.257 539.579 655.28] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.5) >> +/A << /S /GoTo /D (subsubsection.19.13.1.8) >> >> endobj -3661 0 obj << +3761 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 646.257 539.579 655.28] +/Rect [521.223 632.708 539.579 641.731] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.6) >> +/A << /S /GoTo /D (subsection.19.13.2) >> >> endobj -3662 0 obj << +3762 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 619.159 539.579 628.182] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.7) >> +/A << /S /GoTo /D (section.19.14) >> >> endobj -3663 0 obj << +3763 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 605.61 539.579 614.633] /Subtype /Link -/A << /S /GoTo /D (subsubsection.19.13.1.8) >> +/A << /S /GoTo /D (subsection.19.14.1) >> >> endobj -3664 0 obj << +3764 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 592.061 539.579 601.083] /Subtype /Link -/A << /S /GoTo /D (subsection.19.13.2) >> +/A << /S /GoTo /D (subsection.19.14.2) >> >> endobj -3665 0 obj << +3765 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 578.511 539.579 587.534] /Subtype /Link -/A << /S /GoTo /D (section.19.14) >> +/A << /S /GoTo /D (subsection.19.14.3) >> >> endobj -3666 0 obj << +3766 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 564.962 539.579 573.985] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.1) >> +/A << /S /GoTo /D (subsection.19.14.4) >> >> endobj -3667 0 obj << +3767 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 551.413 539.579 560.436] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.2) >> +/A << /S /GoTo /D (subsection.19.14.5) >> >> endobj -3668 0 obj << +3768 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 537.864 539.579 546.887] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.3) >> +/A << /S /GoTo /D (subsection.19.14.6) >> >> endobj -3669 0 obj << +3769 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 524.315 539.579 533.337] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.4) >> +/A << /S /GoTo /D (section.19.15) >> >> endobj -3670 0 obj << +3770 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 510.765 539.579 519.788] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.5) >> +/A << /S /GoTo /D (section.19.16) >> >> endobj -3671 0 obj << +3771 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 497.216 539.579 506.239] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.6) >> +/A << /S /GoTo /D (subsection.19.16.1) >> >> endobj -3672 0 obj << +3772 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 483.667 539.579 492.69] /Subtype /Link -/A << /S /GoTo /D (subsection.19.14.7) >> +/A << /S /GoTo /D (subsection.19.16.2) >> >> endobj -3673 0 obj << +3773 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 470.118 539.579 479.141] /Subtype /Link -/A << /S /GoTo /D (section.19.15) >> +/A << /S /GoTo /D (subsection.19.16.3) >> >> endobj -3674 0 obj << +3774 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 456.569 539.579 465.591] /Subtype /Link -/A << /S /GoTo /D (section.19.16) >> +/A << /S /GoTo /D (section.19.17) >> >> endobj -3675 0 obj << +3775 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 443.019 539.579 452.042] /Subtype /Link -/A << /S /GoTo /D (subsection.19.16.1) >> +/A << /S /GoTo /D (section.19.18) >> >> endobj -3676 0 obj << +3776 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 429.47 539.579 438.493] /Subtype /Link -/A << /S /GoTo /D (subsection.19.16.2) >> +/A << /S /GoTo /D (section.19.19) >> >> endobj -3677 0 obj << +3777 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 415.921 539.579 424.944] /Subtype /Link -/A << /S /GoTo /D (subsection.19.16.3) >> +/A << /S /GoTo /D (subsection.19.19.1) >> >> endobj -3678 0 obj << +3778 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 402.372 539.579 411.395] /Subtype /Link -/A << /S /GoTo /D (section.19.17) >> +/A << /S /GoTo /D (subsection.19.19.2) >> >> endobj -3679 0 obj << +3779 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 388.823 539.579 397.845] /Subtype /Link -/A << /S /GoTo /D (section.19.18) >> +/A << /S /GoTo /D (subsection.19.19.3) >> >> endobj -3680 0 obj << +3780 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 375.273 539.579 384.296] /Subtype /Link -/A << /S /GoTo /D (section.19.19) >> +/A << /S /GoTo /D (subsection.19.19.4) >> >> endobj -3681 0 obj << +3781 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 361.724 539.579 370.747] /Subtype /Link -/A << /S /GoTo /D (section.19.20) >> +/A << /S /GoTo /D (subsection.19.19.5) >> >> endobj -3682 0 obj << +3782 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 348.175 539.579 357.198] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.1) >> +/A << /S /GoTo /D (subsection.19.19.6) >> >> endobj -3683 0 obj << +3783 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 334.626 539.579 343.649] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.2) >> +/A << /S /GoTo /D (subsection.19.19.7) >> >> endobj -3684 0 obj << +3784 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 321.077 539.579 330.099] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.19.8) >> +>> endobj +3785 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 307.527 539.579 316.55] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.3) >> +/A << /S /GoTo /D (subsection.19.19.9) >> >> endobj -3685 0 obj << +3786 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 293.978 539.579 303.001] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.4) >> +/A << /S /GoTo /D (subsection.19.19.10) >> >> endobj -3686 0 obj << +3787 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 280.429 539.579 289.452] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.5) >> +/A << /S /GoTo /D (subsection.19.19.11) >> >> endobj -3687 0 obj << +3788 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 266.88 539.579 275.903] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.6) >> +/A << /S /GoTo /D (subsection.19.19.12) >> >> endobj -3688 0 obj << +3789 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 253.331 539.579 262.354] +/Subtype /Link +/A << /S /GoTo /D (subsection.19.19.13) >> +>> endobj +3790 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 239.781 539.579 248.804] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.7) >> +/A << /S /GoTo /D (subsection.19.19.14) >> >> endobj -3689 0 obj << +3791 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 226.232 539.579 235.255] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.8) >> +/A << /S /GoTo /D (subsection.19.19.15) >> >> endobj -3690 0 obj << +3792 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 212.683 539.579 221.706] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.9) >> +/A << /S /GoTo /D (subsection.19.19.16) >> >> endobj -3691 0 obj << +3793 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 199.134 539.579 208.157] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.10) >> +/A << /S /GoTo /D (subsection.19.19.17) >> >> endobj -3692 0 obj << +3794 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 185.585 539.579 194.608] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.11) >> +/A << /S /GoTo /D (subsection.19.19.18) >> >> endobj -3693 0 obj << +3795 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 172.036 539.579 181.058] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.12) >> +/A << /S /GoTo /D (subsection.19.19.19) >> >> endobj -3694 0 obj << +3796 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 158.486 539.579 167.509] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.13) >> +/A << /S /GoTo /D (section.19.20) >> >> endobj -3695 0 obj << +3797 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 144.937 539.579 153.96] +/Rect [519.586 134.028 539.579 143.596] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.14) >> +/A << /S /GoTo /D (chapter.20) >> >> endobj -3696 0 obj << +3798 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 131.388 539.579 140.411] +/Rect [521.223 120.479 539.579 129.502] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.15) >> +/A << /S /GoTo /D (section.20.1) >> >> endobj -3697 0 obj << +3799 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 117.839 539.579 126.862] +/Rect [521.223 106.93 539.579 115.952] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.16) >> +/A << /S /GoTo /D (section.20.2) >> >> endobj -3698 0 obj << +3800 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 104.29 539.579 113.312] +/Rect [521.223 93.38 539.579 102.403] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.17) >> +/A << /S /GoTo /D (section.20.3) >> >> endobj -3699 0 obj << +3801 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 77.191 539.579 86.214] +/Rect [521.223 79.831 539.579 88.854] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.18) >> +/A << /S /GoTo /D (subsection.20.3.1) >> >> endobj -3700 0 obj << +3802 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 63.642 539.579 72.665] +/Rect [521.223 66.282 539.579 75.305] /Subtype /Link -/A << /S /GoTo /D (subsection.19.20.19) >> +/A << /S /GoTo /D (subsection.20.3.2) >> >> endobj -3652 0 obj << -/D [3650 0 R /XYZ 85.039 786.531 null] +3752 0 obj << +/D [3750 0 R /XYZ 85.039 786.531 null] >> endobj -3649 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R >> +3749 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F59 3455 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3704 0 obj << -/Length 3215 +3806 0 obj << +/Length 2207 /Filter /FlateDecode >> stream -xÚíœ[sÛ6Çßý)´oÔƒ°¸’ľ9qÓM¦N³‘³Ù™nI–5ÖÅ•(;ýö‹;`‘<7IDZ5T²DGçÿpp’ °ú J0“ƒ¢Ì‘`d0YàÁ\}óó qWŒÜ%£äš'%òÁHb9¸¸ õHŒ„ÌÓß²—›õ–Y=³/»áïoN~º'MÆtµœüö;L• oN0b²Ü©÷)«.œ¹¿—'ã“…ºìw|`Kµý -ÁJ$JÖüD$?ƒ`‚8fƒB”óÂü"%hHEž®‡#ÆXöë­þI³ííbH²ÙpD²;ûÅæÒ¾ÖW3ý†g/?¼S—Œí§ï¶êýºC½ln/Ò—l7Ñú|bjÛíìËp$ÎzÁé —²ùáW~÷ð%ò J•_dpUÃéÛùÀ¾yŸÊàJ’bMëÖ2P)&8M[LhèÏYH9QŽ¸hGÄ‹?*Q×Ê`Å-¤»kŒiX9Iòl\W“ë!#Yõi©õÏ‹ì߯ÆöÍJéËp6Ý/g»¦+±ý±]Ð…Ø‘ ™yX§¶“aÚéÂXWÓu¾sÁÃÃ5íýŠJ)ï4Õ«”<{5,¹íFU½×}ÁÓ¯;MµžÚ7/̧kßãþ‹ WïÕ¸2’’~3Ê¿gñïÓÿ¬Kûv¿P -è}Q,ˆœFûÀØ ´ÁaI<#Ô1r¶ØM´ìšÁc¡æ—çù#ûQ²â|Û–X  %Ñ Â¥iÀ Ô°&×1À0Ìëõd©a™šÑÂŒ!4[é÷v¦ªïöK?šì4JâˆË=\¼g{â’ëÆ%UaÖ…K‹ ݸ€ š#.ù /r¤&Œˆ‹ž…XžgÕ^#±¨õ<-ž–¾ß çɾxÄb‰JM< †9C\­2Ôá1û\OÍ %E2/B¡×0ªº¢}3òu’ÊZÌT«zßÊ„Ûœ>×y¯ ÑèË^ˆBÖý¢MDAí=¢\¢Ròˆ(sˆ^V×f]ÚÄT…æ\†‚_‡©­k”TÖ†©ZfQrÏÔ5ív¶Õëà•›v%+Žª#*º´­‡u?DkÓ€VO+Ëã"ÒÊ­Û™ èÿT,˜7fÉ\æÇ)"Ä9³/!±@H"ü“¦ !PÃe@!B„#d=««ºZ^ë4˜8®èZp¾ë D,‘èÑ4j8¬è°TANîànEgsiŒ™\ZXÁÍv6‰Zé©ïv(T ¿XVŸÜÊNc¦œ¥ÏÌî®f:Á”ìÉÁàüÖ†X €!ÑD­:ahšÀ5ìG!Êeaðëµ356|RªVVV gåq¦°zy·õd!)ÖÍB* ÀB‹ Ý,€ Ô‰ð2²àg·69X­uMàý ï×Q üýA‡Øýš‹õ'½ƒ§wHöåͲÌ>ìf–)³——ٙɮôH³XÛN'“Í~]wnä$}ÉFhÿaÖ·y§oc]ÿçFΡ5­S´ªFIè½yÜÈùÓº´o¿ ¥€nÅ‚Èi´ŒÖ@«¦ÏÏ yy³ÿ­S.ŒÛû`m¶t.Ž{9_€‹so_^b1˜D:%G'1Md †3¤@˜SÏŒßËùx¥GßÚ†óÃ!Š0x›Ãö…^,¦É¶ŽÈ‹çH‡sd_:b1€ŽD$ˆŽ¦ PÃ!üÃL½²H‡_ -\ K5¿lç³Ú²ðÁ. ´ú„?'›ó^_$b1‰D†ËN$š&H@ ûƒ—Ið©‚šàÎ f˜°†Ž:Ü€ñQ+›íµ¦„Šg?ŸxOöÄ#)ÖGª€G‹ Ýx€ ûƒ9b’G<üˆq¾ðAÇv³Û\ºqãý̨gþÀÞÆlZ˜ gSÒšƒ}Õr©È)þ¡ï¾*Çb€Ê‰³!•›&*C •sŠJ¿Å@’´@»Ê§“zapZ)Ïa©2©7Û?íUcCèHõv1ññͬaß;§¯â± xâxHñ¦ €âPÃAq.uçŒâ~ ômµrªŽÝñ\ÛwÝgêï»E=ª>}¥w›Ä³˜ù½·ú"‹$J0ÜyD·Å¨á€¨ðgƒ5~_ñNõïçó{{§ûúÊwh -HµÖœTn½©:û¹ç§÷„åä“Ùy¤¯Ì± sâmHæ¦ €ÌPÃAfe‘‰Ì~sðÃÎÎir‰f?o7zš¾±¿>sòk]—Ó]ú#÷iç—¾bÇb€Ø‰ÏÁb7MĆbãå>¿¯ÅÎØïmŸ4ݳö˜ÆM6ÀÜK!þªôá£Âù®/±D¢ DÓ¨a¿¼cR ,CÖ^„â®Vñ·êÈ:‹¸>È/ëlZy¾ßšÄ‘Ë+Ò§½‚óÎêI@R¬›€T€€º öC+•ì"àp¦‘¥ÌŸ}ÊÇ9¯/¡ÀC”¡Ñ>@Ðj€!/Æ$Ò@ïÍèÀo±õ!Ü*‰öt’ðìKD, ‘ˆÃéd¢iÔp Bè=â„ -–¦…g;;&èàÜNú8ÌÝæä¯{VȲ|8‡õ¥ (HÄ€(hšP5Lr*pý½GÉôtÁK©c·Ï¬b½&ä,[ï 6!PfWh²Y_Ú¯*Ÿ'æþ^^uÜ-ÌX“ÈêËåBAÚVÛE²pÔ›ˆC]ðKH>ï?ß«[9F­ŠQAËÁˆè}y;¹Ž7:ÆUõéT“`Ïà K¤´@LôÎG'ÅHÝEÒÎ{ÕZL …*¥KÌ ¥Ò·ã±ßš[œæ l}¤{úú?z±Ãä!È9¢¯º± nâdHݦ €ºPÃA]ŒMƒU£.ë‚”’fZ¡Ýè# þ&爾êÆb€º‰“•*ê6MÔ…öêÒ2GÎÔåNÝ7›ÅÚ?ûax/á|zþâÔþµ‹û nû!ä¯êͽG°ìÝÙKûfºY™sgEQ|oÙü/ì)[R¬[¶Ô{€l-&tË6d+"âP6ád×ÕÖç”X¶¿iJxw ÛÇÓÊm†ôCü®vA§ýkQÿm8*™ø‹:ŸÿÁ}UŒÅg2ÒyK@‹ €ŠPÃAE!QŽ‹s§â«Åç¦p&L[ÔÈi²SJ×IjØž6qÛ^T<òQÕû ¯°± lâ_F:O 5„å9¢<¶æÌ-‘QÚùÞés§çz{=vEÝï«h,(š8–‘νÙE¡†}Ζ2Š9ÛÜål•”“å~çrsòxÄó ðpžì‹G,à‘¨Ähç:½Å¨á€)Qܹ/f2]ùÙô'½ªÞn¶ö®-Fè‘VB¬3ûJ|D™ <ít­úTÅqáðÙþ·ã—gÉ3Ô6Ÿ–:ø²§Õh_m×6›§wñéÍÚ9ßôÕ:”´Ž^g´s½Ülÿ«²FJe‡ àM;þõ7휚›un«õd6up˜>õáìNÿo£Á¶½vGÀªu5Ÿ­fëºëfÄ/¹Y´û°NëÒÎÕNRWçÍ:#Š…ŸÌHŠ•=Òä…yu¾<Þ²ó º¤÷iÏ>™ë^BMº‡`°áŠ¯܃âïÛ±[l+w6–œ<ÌgœNý#>Lþ{±«·q·^Š' „ó]_ b1ˆDˆ¦ PÃŽÃÖÄÙlw]oÜêúܬÈÔÈk7bíf½‘Éœ¯ú‹$:0Ú™|i1jØGeúµðymšÜwsˆÀ¹ÖÜÌ·fJª+ .MÜ悶·›óÊî¹-Âœ²Cf P2ùdt¿¸¯Œ± câMHƦ €ŒPᆨO`Óp¯Ì[:ÑB…NJ ›”\¿læ~)6gèuŒ}Sû>w§«¥O¼O;¿õ…!`H4a´3ïÖbÔ°ïÓR¢\‘ߥO§S¿”Ò2ßèÐ=²z¶uaáŸ×ë+sØÖÈ f¹ ”³á{ðµæ*'âÑ­¯œGzªKu‹œøšÑÎû%›íwK µê»»~®:.½Ââ˜hù8œ3{ÂKuÑÈÄhgš¶Ù~÷‚Q`”¢mŨþÙ“&_õ°ý°îä%’eçÍÂ…²BÎBœùÇivŸ2%ÿ ÿ3¾endstream +xÚí\[WâH~çWðȤoIzßÑY献;8ëœ3;"戛Կ]} AE4ˆæxŽÄ\ÚÐ_WÕWU_‚šŽøAMŸÙáMÏwmFP³?j8Í¡8ò¥ôN“ÚŽËàÐçÓƧæ6‘cs‡7O/ä)§ƒ_Ö^2naßÊCõ‘µ~Ÿ~m쟖iS›ºFù¯ñë·ÓˆôµáØ„ûͱí؈óæ¨A±%úï¸Ñkü]Œ¢ŽÑ¦ºjɽ¶)¶ãóf›8¶ïÓâ¦[rÓXŒ#~ZmâºÖEp·.Þ9£¶Ë˜Ø|ôΉ½å÷ G°bõÝ\·ÚØÿ¿¬´…¬ld­6'ž%n‘9ÎýÊùÊcO8å¹Ç^ýòñlOL¶sòtØTß¿<0µÄA‹c"×&.rõjB°îøVÕ«) û€ßRnÄWâ»oƒ7/g¶‡Ù&ðâŠàeÞq˜y_‰oÄXæ £Iž‡¦ðÈ2˜`©˜R럃žÀ”ëHØj"öùÖ`ÒR+0ëL[ç ‚ýÁy,>Àž µöã,¼/Õ>å»Å†ÏÈî­„…i§bš|änʲa²'@‰´]v…Už ‚  ZJüÚ$·e’k:Xjc ä4“a3òë°ù-Œž-§áåqä `gâ`¶œZgÑø\ëx˜ÿ!&Á÷­Y¨–BrŸžÕ…ƒÉ¬;«]~?™Œïg”0•'Àÿ_1%Kïˆ8ôÞ”,å0 &YvTOÀÓ>’þ ‚ÑA˧*Œ9¡´„˜Øø,÷ŽMÄù×ATlç,püVVëN…)úúŒIß ª9çÒßåQKÛñvÏ;íÞlc¼Ù£p ÷Pà W|ñLlGÿÂãEŸ€­'°{ Œ] {f®W[°kñ€ÖÎÓ–/s: säE<:Dk†²1Cq«pÌ&üSZà¶TiŸÊR!ÔjK=ƒ¤W€0fµ®Ú5Mu–E&ʦI–\hƒýÊBk’‡Ú§‰¬ÃÊÃ!a°"ö‚8°{Ä©­ïe!ÂBÔéçÑTÕæ%ݨ`ÆýCÀ….]ùš‘–ÂÑE•`Z„ÎÀ<¤,ë÷Q–§³†)g5˜Û“¬³fWy¢3Ù#5„§R4Õ.†jK\^Àá’°|?x:U +Èš©.¼)æpªߺŒ +GlKîO{<¼ú³¸P„‹@=èÅ„&2È‹ùþ– MÕ+ôª@­¯sc^C­†äŒ×µGZ‰EÍôßÁ $Ä2Åë4Ò/.I5›™5-/%›Î Ê] +~‡JwPŽŽž1Ê"rô.ìÍÝòC¢D1ñÞ]–Ë|V@ «¬p•Bpù ¨z*ô¹lìFýh&S}9Bîm‹“šoÙiy¯ÏáHAÈ÷ÒPPj#)Ä¿2É,‹f +Ó> BU\¨ñ#Ùx>­qziÅ!à„JµáÔócº2Ão?iÛ7Í +…K_â3TWÞ +°ªjZø´ŽOiìEöýàÀ]\´¸E¨äôƒFQ,!ÄäƒÁTÀL£4˜©4Hz;%¶u7«O¨—¦%QlxæìÝXÖÆÍCÌ+²,#ë<šSd ¤ò'mdØqnžO?OÊ}Š ¥…®cÏyKIá 7 ‡R›ÓZÐÌÌ©3)ƒ2&)¦œ=Ü%ß´²ˆž¯2¢UÎ…5äà·hÄyõ’) +o¦¶Vð¶N_i^'æyòü“~K@:?‡ëR¶CçÈ3_ßXd_âÓs—¿ÜtfH¼—”bÛ%ì©ï¹º÷eÔ9s_æ*e Âendstream endobj -3703 0 obj << +3805 0 obj << /Type /Page -/Contents 3704 0 R -/Resources 3702 0 R +/Contents 3806 0 R +/Resources 3804 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3701 0 R -/Annots [ 3706 0 R 3707 0 R 3708 0 R 3709 0 R 3710 0 R 3711 0 R 3712 0 R 3713 0 R 3714 0 R 3715 0 R 3716 0 R 3717 0 R 3718 0 R 3719 0 R 3720 0 R 3721 0 R 3722 0 R 3723 0 R 3724 0 R 3725 0 R 3726 0 R 3727 0 R 3728 0 R 3729 0 R 3730 0 R 3731 0 R 3732 0 R 3733 0 R 3734 0 R 3735 0 R 3736 0 R 3737 0 R 3738 0 R 3739 0 R 3740 0 R 3741 0 R 3742 0 R 3743 0 R 3744 0 R 3745 0 R 3746 0 R 3747 0 R 3748 0 R 3749 0 R 3750 0 R 3751 0 R 3752 0 R ] +/Parent 3803 0 R +/Annots [ 3808 0 R 3809 0 R 3810 0 R 3811 0 R 3812 0 R 3813 0 R 3814 0 R 3815 0 R 3816 0 R 3817 0 R 3818 0 R 3819 0 R 3820 0 R 3821 0 R 3822 0 R 3823 0 R 3824 0 R 3825 0 R 3826 0 R 3827 0 R 3828 0 R 3829 0 R 3830 0 R 3831 0 R 3832 0 R 3833 0 R 3834 0 R 3835 0 R 3836 0 R 3837 0 R 3838 0 R 3839 0 R 3840 0 R 3841 0 R 3842 0 R 3843 0 R 3844 0 R 3845 0 R 3846 0 R 3847 0 R 3848 0 R 3849 0 R 3850 0 R 3851 0 R 3852 0 R 3853 0 R 3854 0 R 3855 0 R 3856 0 R ] >> endobj -3706 0 obj << +3808 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (section.19.21) >> +/A << /S /GoTo /D (subsection.20.3.3) >> >> endobj -3707 0 obj << +3809 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 730.193 539.579 739.761] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (chapter.20) >> +/A << /S /GoTo /D (subsection.20.3.4) >> >> endobj -3708 0 obj << +3810 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 716.643 539.579 725.666] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (section.20.1) >> +/A << /S /GoTo /D (subsection.20.3.5) >> >> endobj -3709 0 obj << +3811 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 703.094 539.579 712.117] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (section.20.2) >> +/A << /S /GoTo /D (section.20.4) >> >> endobj -3710 0 obj << +3812 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 689.545 539.579 698.568] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (section.20.3) >> +/A << /S /GoTo /D (subsection.20.4.1) >> >> endobj -3711 0 obj << +3813 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 675.996 539.579 685.019] +/Rect [521.223 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (subsection.20.3.1) >> +/A << /S /GoTo /D (subsection.20.4.2) >> >> endobj -3712 0 obj << +3814 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 662.447 539.579 671.469] +/Rect [519.586 662.447 539.579 672.015] /Subtype /Link -/A << /S /GoTo /D (subsection.20.3.2) >> +/A << /S /GoTo /D (chapter.21) >> >> endobj -3713 0 obj << +3815 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 648.897 539.579 657.92] /Subtype /Link -/A << /S /GoTo /D (subsection.20.3.3) >> +/A << /S /GoTo /D (section.21.1) >> >> endobj -3714 0 obj << +3816 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 635.348 539.579 644.371] /Subtype /Link -/A << /S /GoTo /D (subsection.20.3.4) >> +/A << /S /GoTo /D (section.21.2) >> >> endobj -3715 0 obj << +3817 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 621.799 539.579 630.822] /Subtype /Link -/A << /S /GoTo /D (subsection.20.3.5) >> +/A << /S /GoTo /D (section.21.3) >> >> endobj -3716 0 obj << +3818 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 608.25 539.579 617.273] /Subtype /Link -/A << /S /GoTo /D (section.20.4) >> +/A << /S /GoTo /D (subsection.21.3.1) >> >> endobj -3717 0 obj << +3819 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 594.701 539.579 603.724] /Subtype /Link -/A << /S /GoTo /D (subsection.20.4.1) >> +/A << /S /GoTo /D (section.21.4) >> >> endobj -3718 0 obj << +3820 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 581.151 539.579 590.174] /Subtype /Link -/A << /S /GoTo /D (subsection.20.4.2) >> +/A << /S /GoTo /D (subsection.21.4.1) >> >> endobj -3719 0 obj << +3821 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 556.693 539.579 566.261] +/Rect [521.223 567.602 539.579 576.625] /Subtype /Link -/A << /S /GoTo /D (chapter.21) >> +/A << /S /GoTo /D (subsection.21.4.2) >> >> endobj -3720 0 obj << +3822 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 543.144 539.579 552.167] +/Rect [521.223 554.053 539.579 563.076] /Subtype /Link -/A << /S /GoTo /D (section.21.1) >> +/A << /S /GoTo /D (subsection.21.4.3) >> >> endobj -3721 0 obj << +3823 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 529.595 539.579 538.618] +/Rect [521.223 540.504 539.579 549.527] /Subtype /Link -/A << /S /GoTo /D (section.21.2) >> +/A << /S /GoTo /D (subsection.21.4.4) >> >> endobj -3722 0 obj << +3824 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 516.046 539.579 525.068] +/Rect [521.223 526.955 539.579 535.978] /Subtype /Link -/A << /S /GoTo /D (section.21.3) >> +/A << /S /GoTo /D (subsection.21.4.5) >> >> endobj -3723 0 obj << +3825 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 502.496 539.579 511.519] +/Rect [521.223 513.406 539.579 522.428] /Subtype /Link -/A << /S /GoTo /D (subsection.21.3.1) >> +/A << /S /GoTo /D (subsection.21.4.6) >> >> endobj -3724 0 obj << +3826 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 488.947 539.579 497.97] +/Rect [521.223 499.856 539.579 508.879] /Subtype /Link -/A << /S /GoTo /D (section.21.4) >> +/A << /S /GoTo /D (section.21.5) >> >> endobj -3725 0 obj << +3827 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 475.398 539.579 484.421] +/Rect [521.223 486.307 539.579 495.33] /Subtype /Link -/A << /S /GoTo /D (subsection.21.4.1) >> +/A << /S /GoTo /D (subsection.21.5.1) >> >> endobj -3726 0 obj << +3828 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 461.849 539.579 470.872] +/Rect [521.223 472.758 539.579 481.781] /Subtype /Link -/A << /S /GoTo /D (subsection.21.4.2) >> +/A << /S /GoTo /D (subsection.21.5.2) >> >> endobj -3727 0 obj << +3829 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 448.3 539.579 457.322] +/Rect [521.223 459.209 539.579 468.232] /Subtype /Link -/A << /S /GoTo /D (subsection.21.4.3) >> +/A << /S /GoTo /D (subsection.21.5.3) >> >> endobj -3728 0 obj << +3830 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 434.75 539.579 443.773] +/Rect [521.223 432.11 539.579 441.133] /Subtype /Link -/A << /S /GoTo /D (subsection.21.4.4) >> +/A << /S /GoTo /D (subsubsection.21.5.3.1) >> >> endobj -3729 0 obj << +3831 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 421.201 539.579 430.224] +/Rect [521.223 418.561 539.579 427.584] /Subtype /Link -/A << /S /GoTo /D (subsection.21.4.5) >> +/A << /S /GoTo /D (subsubsection.21.5.3.2) >> >> endobj -3730 0 obj << +3832 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 407.652 539.579 416.675] +/Rect [521.223 405.012 539.579 414.035] /Subtype /Link -/A << /S /GoTo /D (subsection.21.4.6) >> +/A << /S /GoTo /D (subsubsection.21.5.3.3) >> >> endobj -3731 0 obj << +3833 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 394.103 539.579 403.126] +/Rect [521.223 391.463 539.579 400.486] /Subtype /Link -/A << /S /GoTo /D (section.21.5) >> +/A << /S /GoTo /D (subsubsection.21.5.3.4) >> >> endobj -3732 0 obj << +3834 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 380.554 539.579 389.576] +/Rect [521.223 377.914 539.579 386.936] /Subtype /Link -/A << /S /GoTo /D (subsection.21.5.1) >> +/A << /S /GoTo /D (subsubsection.21.5.3.5) >> >> endobj -3733 0 obj << +3835 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 367.004 539.579 376.027] +/Rect [521.223 364.364 539.579 373.387] /Subtype /Link -/A << /S /GoTo /D (subsection.21.5.2) >> +/A << /S /GoTo /D (subsubsection.21.5.3.6) >> >> endobj -3734 0 obj << +3836 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 353.455 539.579 362.478] +/Rect [521.223 350.815 539.579 359.838] /Subtype /Link -/A << /S /GoTo /D (subsection.21.5.3) >> +/A << /S /GoTo /D (subsubsection.21.5.3.7) >> >> endobj -3735 0 obj << +3837 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 326.357 539.579 335.38] +/Rect [521.223 337.266 539.579 346.289] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.1) >> +/A << /S /GoTo /D (section.21.6) >> >> endobj -3736 0 obj << +3838 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 312.808 539.579 321.83] +/Rect [521.223 323.717 539.579 332.74] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.2) >> +/A << /S /GoTo /D (section.21.7) >> >> endobj -3737 0 obj << +3839 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 299.258 539.579 308.281] +/Rect [521.223 310.168 539.579 319.19] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.3) >> +/A << /S /GoTo /D (subsection.21.7.1) >> >> endobj -3738 0 obj << +3840 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 285.709 539.579 294.732] +/Rect [521.223 296.618 539.579 305.641] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.4) >> +/A << /S /GoTo /D (subsection.21.7.2) >> >> endobj -3739 0 obj << +3841 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 272.16 539.579 281.183] +/Rect [519.586 272.16 539.579 281.728] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.5) >> +/A << /S /GoTo /D (chapter.22) >> >> endobj -3740 0 obj << +3842 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 258.611 539.579 267.634] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.6) >> +/A << /S /GoTo /D (section.22.1) >> >> endobj -3741 0 obj << +3843 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 245.062 539.579 254.084] /Subtype /Link -/A << /S /GoTo /D (subsubsection.21.5.3.7) >> +/A << /S /GoTo /D (section.22.2) >> >> endobj -3742 0 obj << +3844 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 231.512 539.579 240.535] /Subtype /Link -/A << /S /GoTo /D (section.21.6) >> +/A << /S /GoTo /D (section.22.3) >> >> endobj -3743 0 obj << +3845 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 217.963 539.579 226.986] /Subtype /Link -/A << /S /GoTo /D (section.21.7) >> +/A << /S /GoTo /D (subsection.22.3.1) >> >> endobj -3744 0 obj << +3846 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 204.414 539.579 213.437] /Subtype /Link -/A << /S /GoTo /D (subsection.21.7.1) >> +/A << /S /GoTo /D (section.22.4) >> >> endobj -3745 0 obj << +3847 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 179.956 539.579 189.524] +/Rect [521.223 190.865 539.579 199.888] /Subtype /Link -/A << /S /GoTo /D (chapter.22) >> +/A << /S /GoTo /D (subsection.22.4.1) >> >> endobj -3746 0 obj << +3848 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 166.407 539.579 175.429] +/Rect [519.586 166.407 539.579 175.975] /Subtype /Link -/A << /S /GoTo /D (section.22.1) >> +/A << /S /GoTo /D (chapter.23) >> >> endobj -3747 0 obj << +3849 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 152.857 539.579 161.88] /Subtype /Link -/A << /S /GoTo /D (section.22.2) >> +/A << /S /GoTo /D (section.23.1) >> >> endobj -3748 0 obj << +3850 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 139.308 539.579 148.331] /Subtype /Link -/A << /S /GoTo /D (section.22.3) >> +/A << /S /GoTo /D (section.23.2) >> >> endobj -3749 0 obj << +3851 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 125.759 539.579 134.782] /Subtype /Link -/A << /S /GoTo /D (subsection.22.3.1) >> +/A << /S /GoTo /D (subsection.23.2.1) >> >> endobj -3750 0 obj << +3852 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 112.21 539.579 121.233] /Subtype /Link -/A << /S /GoTo /D (section.22.4) >> +/A << /S /GoTo /D (subsection.23.2.2) >> >> endobj -3751 0 obj << +3853 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 98.661 539.579 107.683] /Subtype /Link -/A << /S /GoTo /D (subsection.22.4.1) >> +/A << /S /GoTo /D (subsubsection.23.2.2.1) >> >> endobj -3752 0 obj << +3854 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 85.111 539.579 94.134] /Subtype /Link -/A << /S /GoTo /D (section.22.5) >> +/A << /S /GoTo /D (subsection.23.2.3) >> >> endobj -3705 0 obj << -/D [3703 0 R /XYZ 85.039 786.531 null] +3855 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 71.562 539.579 80.585] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.23.2.3.1) >> >> endobj -3702 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +3856 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 58.013 539.579 67.036] +/Subtype /Link +/A << /S /GoTo /D (section.23.3) >> +>> endobj +3807 0 obj << +/D [3805 0 R /XYZ 85.039 786.531 null] +>> endobj +3804 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3755 0 obj << -/Length 3333 -/Filter /FlateDecode ->> -stream -xÚí[wÛ6€ßý+ôVéA0@\HìË×NÒvëÔ»'{N·ŠL;ÚX¦W’kûß/@\Ecc“Ô—æô´’%Žf8ß .%#¬þ!£Š#L娬┌æË<:Wß¼Ù!öŠ©½d]óýÉÎîk.F#‰åèäÌÿŽÄˆK1:9ým¼ß\NŠj¼©ÍËzòûÉO;¯NüGª ¥úgÿ»óÛïxtªLøi#*«Ñz‘r´Üaœ"ΨýûbçxçŸþ·Ìwld¤†î‚Ñ‘j4¥U¼„`‚¦êN9G‚•þN šP2n.&d¼˜/Ôk}AÏC¼PÞ¬è(²Ç|µ:™7ï"óÝÕ°ùÝßÔöÓBöTÓª«ºïRëôiHqOìèK áM"<2Éù½d -Ÿu)QN-¿žTÌ8h¶¹V¾ZYgM)¥ÊͧæÍ÷í§—Î—ÿÆ„©÷*ê¦RcõScý¤Œþ|.ùŠâŸ÷Ó½Ð)PA¤÷iN"„ŒÔ4ëóêþö}!Ô7¡'îZX±”B]ͤ ”ÂÊþªžm—ç[‘QŒg—³sÝÈÜ7¾™R¦¢ê›š Õ -k*¥Š´çÙú#r G¾† ÷M CŠI!“lTªO=`ÝèŽôýB·ðÓFS»Y„òv÷Ð4û>PŠå£CûJÌ•{ry€µu9¥8Éy[-À8¥ÌóÕ9B\ˆßž0óæX÷éú›»‹À[¶¼ïLã~½¸Ðà«‚>KªÆ)¹`½À6¸ÂÛÓ´azjQ•ê#²E™Œukf•¿kÕmß¼Öï6+õî.¾Rýz9nmH¨Þ»ü¥µcç¡Lä‘Xšyì}JI -ú€ iê b׶EÉåEÀNmã><6­ô½Î|ÕZ%Á…صóã[sÁ®yùבy=Òy_sV·a²^4:f`áC•”>²Ö ¹dƒ@6r0D¶o@Rì´Pã'õ“ zïtÙ6Õ…iΚÊÈ­bsÃ/þ‘ mžßêš¹þ‘ö1ÎÊGBhï6aFžTijaß!¤ØeÏj8‡ -ÎBj³g•&ëFuîè½y  Ñc.3„ßýµåZ¯TH¡Ÿ[zí–A ˆ‚†òi2 -ú&Q)ö]4¥¨ÄQ¸ûx¶Ô\?Ì äWº“^lVµŠ“I¥Z² -~]›vÞ ->ˆ_)¬»rc ˆ1¡€b obF„ó÷äà»æù\=^_"sëž\æA `¹^y7ɼoÀRì™cÔ¿9n÷Gû:û.Ÿ_/þ•‚Áú-7‚ (ú&Á)v©—aî‹Ø̦Çw~DæêdíÀ{¶j °WÒëÏ͹KñLžÞ>æ&_û|â—?t|Õ«?õÍd*+òäôΙŒ#±4ãØÕãÒŒAÅžq)ǾªÎ]±´Yj>KGî•&·jV†<%Åsh«"Ö›¹!Ä€‰HQÊ“!Ò7H±{&pÁ‘äQˆ¸\°›áÛÛiáµË šØéÜP‡Ð'=/_öÁy-7‚ -(ú&$'> †¯à‰OÎâà´§¹¢ f&=lÕEAß4WvzsÕè ¸¶F««>z¦^Ö—›Ô §WüùMÀÊíß3ÞIï¹ßùœ™MN%¢¥¼§.Jʼn8¿}›ÙüÍÏú4·ù1 ùE¼ ê›ôÄb(DµR\¸@q3›ïšÙÒçQGºƒµíK å·gôvdX'æFF"#EFß 2 Åþ1ª8 ‘‘¨×ì7—¶‡8¿ÖÅW+6Å;kVq–ÞFP˜8ýaÖÖãý\‹FùFÖ:!—lÈF†ÈöMÈBŠ]IU%¢x›l(©‡²‹&×)Àˆššî øï PÝýgBÄÒPcßRZ¦ ˜† -*öPKŠJWd÷P uxÃÖ|È¡m–¿škªå¶éBÁé“…ký 7ˆp#Cpû&p!Å®À¨À¼—Z¸‡‹[Çæœí$%~pv¨;ˆƒk{. ‰üBi•Ò7)ö@˜@‚‹f,Ö³ñ -0Oµ3VÑgqgj^×WvBe¶]¹O¡aÙ[ÎåÄŽ‘;!Ž}Žb—ä0JÁeàMHì_,ìÒâ~øÛ+Úuú“óëÎ\ôú•-ígf2?{«¹ü‚À/r#¥É5{&ü ž‰8ßæR™Œ§Þ`†z\oTsœJüôSwã¹4ƒ@3r*D³o@Rìib°«{šPã×é½×•fõÉÏ#„‘ò™ä¥öös™1€iäZÊ’ëwL˜BŠS* ĸì0¥S•màÝûÖaIIž?w«™ü"±4¿Ø¿Òü@Åî IË -IðùÙÛšÄÊ Þ·ûP›ÓøÒâS¾oÒÞ茴¶%Æv½ü{½ º›‹º¼ÓGÂM;5°ú´Þ˜'¨ièÓã1w’KÇKp‚(K.§èëÐZ=Áæ&Q:y‰zÊ-ÎU.¢¾4Ó^cçZïÏûë•L5oš±êrP©«wª]òEš’½·\XA  ù ÂÕ7à)ö]!'¨"ÛÀàdÅ?ÞzMKèеmi¹•šn/šRΖr¶éî5`F~¤,9³=`R쪫 QtºüäX'§–MÛlcyÛl\g({¡““Î7¹Àƒ<ò;¼oRì+Ê%¡à.yY¶ÅÓ/^»ª™êþêÛZ×FÉËžv¾ÉÄà‘ß!à}àbœDëwu7µí^<Ð{CÄ_pYšóP.ö `¼OYr€ vH±›-d‰ñõÕí꧳MíºÌræßfC EçÌ̉ÄÒƒ"dÀ„t„€Š}„T aá#„uv·BÛm¿ÑxèM)×Wf”Ó™;¿âÖ9¹Äƒ@™½½\fA `¹bÖ7`)öM¶¨20+ÖdmÉekm±+9N}ÖmÓº$—s8Gî¦,¹4bÀ€3¤Øs&QqÎÙù­:g]^.xõÂ{eë¤\òA  ,9w?`@Rì4\ Ò?“Å·m&Ÿ!Æ™¹⥀ø˜(ON\õõÑhuÝ©$* -¢Ã¯^­7›xí/[µ‹žÃWWÉù,¿°õ?×~ÂÙÎ_Ù ê›ðó6ÑÿÎ -;ÙóvlHÆß­Õ3\ð/IÓÝ}&ÎH,Í3ö,tÀ„4QP±GZr$Ê" uOôý™mëo9éz½³üÊÓí­eU]×3îàor1xäwxß8¤Øz7 ÀÝ£}ÿc[˜ 'Gl>ZЧ[£s:¾Úš-¤{®Ä­sr‰1€xäxÊ“'… ˜o“ðf0¢®Q©vh;˜»¦ n6„MdaN¼<4ñña¶nÇR¢ÔK1Í"JÕ•ëù¹×f—±ýzïZ…N{pf»\hnòüÄž±È¾‡ìo§û›ÆÕÉ™Žè·’{Ç0¸m¬kÍ`JEô^1Wç߶}‘†j}šÛPƒÐP#^PôôMºfH±õŠÛ6Ö.;¨çzœõ±=–iîÎÌ:ð‡4ͯ×k·Z'éâÉ-Ï{„±îÌ‘ ÄH„Šòd}À F Åîñ-K„IB$ìñV½ÉÞ¡Ý=Öžø”X5]ŒïìªÕõèƒ`(}1pëžLäA*MRÃIA'jx×RÓjtõgC(T eùê_ê¸þÿÿŸ~¬À*$«dU@#J6¢1jÇæéåèæ¢Èâÿ©»¸Þendstream +3859 0 obj << +/Length 2157 +/Filter /FlateDecode +>> +stream +xÚí\]SâX}çWä1<s¿’Ü}SP×ÙuÖÜš­š‡S#ÄM¨ûë÷öý¢H¤¦j!ĤÏíîÓÝ' Ëÿ0Ç%ÜòÏaY½aõâ“ÓÒG¸u\ÁGG—ƒæYÈu¸Ë­ËkyÈeÿ›ÝNFMØy¤^²æ÷ËOãËÒIZÔ¡³üÛøöݵúâ}j¸áu/¶]qn ”‡Q¢ßß6º?‹³¨Ï¨¥¾Uq­-J|V‹¸NÐâš«¸fLê4[˜Rû<5‘¢f ÙCù¿¸nçÍ!Ô¾lÔNÄ¡ÜfÍ–‡-¾É\wþ…r¾ð³Ùà××;õ   #OlÏÁ,µñåt‰õ Á³çDžC<:}Êy„vÜ€[-k¯1÷@<Ïî†CXœW!€Jìã¾€<ÎÓh Þ Éd¹rõÅw‚ÀëH8s|̶@¬üƒ—ö@ñ>S®ùù’`×}h¶|áÇïËe>,`¤Úã.:má^¾¿}ÁoWÔÙ€dOâÈtrì> +¯Ëd<Œ†ÊëºbO¦ùX¼Þ)pÃQ_müž P€‹SR{2 fY<ÒáöŸ°4¢ôgÝ7[<@ûÔV†g?ó4>íd(i‹±ú1X=MR…Ax\d«à%µÄQ¯`.MIJbh ~T@w”kE&&¹ÚÿU2Àÿ‡°õ÷QôuqÔnŠEEêËòyä`· +c(?8µ;*6^yáÔóí‹4ùÇEô6R+@(¢:F£|n9¦j"ø[ n¿ò¯Âæn?¨²&ܲ.¼ZØA¸²JÔwÜBÈ¡8xbm+N±ë*+yû¡L&©6ÅtJ9ÒR‡‚a ‰Ã8Çûö‚•Ï6ÎmŒ¿$á°Hû–ôÒ†Jšøû´ôÆ >+-¬ +êv2Òž9§aÙÊP’k‘JŒP¯¼ׯàèȾ•åX'Þ’Jn ³ÌË`!þ3È FÙ x©,«ÿ%Ù{d0P€ÅÁÙ;wÁY@¼µýÄ«¬©ê]ð‡ƒó‰Ì‚4'9Þ±Dq?Ñ7tÙ±Œ@¿„ŽØsp®Ñ‘ bó…¥}(…e•³ijãKFþúÖô׶&[Õ˜T³gᕬKL~‡d÷YÞ7mÓ?ß©æ”6°ØsèxÛ½ ýš2ð²Žhû6ÖS˜ùH¢Hà[°g 9·ÈÕ&QŸÁ'"[õ¾À¥[“gƒz¢ .çÙ§Ãú¼ù»&þäÊ Z>§;Üë„cY–‘Ym|•S¼ôGÑÍœpTêñ]g=Ô­²‘%݃¿/ÊõÀu$Éb˜Â[¨ëÑÞö”bÇ#l¥ÜL(–6„€~¥¦—½\ÙÓ‘¸È^—E\£WÀY FM§q&ZÁ—"AE*Š9yŒž<Å…ˆÝRÝêWïód¡€ôí+ؘWMÕŸS@{öQy©¾ ,\£Ð§òH¸&Es‰BÍHÊz’-ÌÅéÖx +©Ñø&kt! ôµ]B½N?'9„%êá]kœoJ&— eu¦BÉXE8DNôAíè”ã=€ÅVÅÊÔ…§‘EݳŽˆCÜûHÓýõ£›+‘ÆDûÖsY…?.H9’3ÓÀÝ·é·]£ll§‘(sL'FOÔ°š'–{4§iRsÌtIì¡ÚTFgÓ‰®CÀà6_Bû®˜´èCꮥ ¥¹©é$‹—€û{—#´žÉ+&cçÝ[ËŒí¥nÁîyô…MOÏbÔžÉÀRGÏû8¿1> Au ✑wÌ<êr¼š£èxJÒ”åº7MÉõ¯&Èj ÉVXÝÐÓÃ,ز°u‰½(ô8skñʉ(tJnS9‚Õrš +͇d’†FjùÎ „XÐbë¶i°èÃÍѧ2Žï`7æïÐÏjÂä°v8K'yÉt°±L÷Æýȱ¡õ1b+@d2XûF69ù¦rJ{ UU8¾ÍˆÔ‚×ì.n!ZøuÒLé¤/šÛ‡€Ì×[Gaõ•Zºgy_s³ãp „\€7Ê〛QŠHˆ¯¦ fäÙ +jw©xz•ÐÃöâé7ÎôdóDŽêi9Ì‹z@¸oĸóqÈ/x'+ÕÞ8ËJë»å½;9ÃVáK7ŸœXIF}n|xnDÔÆ[+ôYØî>êA¯ðyxæ•}eEX +k6«°>…y"õïúi¬äZ½Ú.ù¬ÖÁÒ9ˆMG7߆Àc²ƒ%Ånß‹ÕÑGb%!äñCaå»éãô£«eñc*™RÉÀQ®‹>˜çðz> endobj -3757 0 obj << +3861 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 754.651 539.579 764.219] +/Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (chapter.23) >> +/A << /S /GoTo /D (section.23.4) >> >> endobj -3758 0 obj << +3862 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (section.23.1) >> +/A << /S /GoTo /D (subsection.23.4.1) >> >> endobj -3759 0 obj << +3863 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (section.23.2) >> +/A << /S /GoTo /D (subsection.23.4.2) >> >> endobj -3760 0 obj << +3864 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (subsection.23.2.1) >> +/A << /S /GoTo /D (subsection.23.4.3) >> >> endobj -3761 0 obj << +3865 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsection.23.2.2) >> +/A << /S /GoTo /D (section.23.5) >> >> endobj -3762 0 obj << +3866 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 686.905 539.579 695.928] /Subtype /Link -/A << /S /GoTo /D (subsubsection.23.2.2.1) >> +/A << /S /GoTo /D (section.23.6) >> >> endobj -3763 0 obj << +3867 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 673.356 539.579 682.379] /Subtype /Link -/A << /S /GoTo /D (subsection.23.2.3) >> +/A << /S /GoTo /D (subsection.23.6.1) >> >> endobj -3764 0 obj << +3868 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 659.807 539.579 668.829] +/Rect [519.586 648.897 539.579 658.466] /Subtype /Link -/A << /S /GoTo /D (subsubsection.23.2.3.1) >> +/A << /S /GoTo /D (chapter.24) >> >> endobj -3765 0 obj << +3869 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 646.257 539.579 655.28] +/Rect [521.223 635.348 539.579 644.371] /Subtype /Link -/A << /S /GoTo /D (section.23.3) >> +/A << /S /GoTo /D (section.24.1) >> >> endobj -3766 0 obj << +3870 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 632.708 539.579 641.731] +/Rect [521.223 621.799 539.579 630.822] /Subtype /Link -/A << /S /GoTo /D (subsection.23.3.1) >> +/A << /S /GoTo /D (section.24.2) >> >> endobj -3767 0 obj << +3871 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 619.159 539.579 628.182] +/Rect [521.223 608.25 539.579 617.273] /Subtype /Link -/A << /S /GoTo /D (subsection.23.3.2) >> +/A << /S /GoTo /D (subsection.24.2.1) >> >> endobj -3768 0 obj << +3872 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 605.61 539.579 614.633] +/Rect [521.223 594.701 539.579 603.724] /Subtype /Link -/A << /S /GoTo /D (subsection.23.3.3) >> +/A << /S /GoTo /D (subsubsection.24.2.1.1) >> >> endobj -3769 0 obj << +3873 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 592.061 539.579 601.083] +/Rect [521.223 581.151 539.579 590.174] /Subtype /Link -/A << /S /GoTo /D (section.23.4) >> +/A << /S /GoTo /D (subsubsection.24.2.1.2) >> >> endobj -3770 0 obj << +3874 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 578.511 539.579 587.534] +/Rect [521.223 567.602 539.579 576.625] /Subtype /Link -/A << /S /GoTo /D (section.23.5) >> +/A << /S /GoTo /D (subsubsection.24.2.1.3) >> >> endobj -3771 0 obj << +3875 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 564.962 539.579 573.985] +/Rect [521.223 554.053 539.579 563.076] /Subtype /Link -/A << /S /GoTo /D (subsection.23.5.1) >> +/A << /S /GoTo /D (subsubsection.24.2.1.4) >> >> endobj -3772 0 obj << +3876 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 540.504 539.579 550.072] +/Rect [521.223 540.504 539.579 549.527] /Subtype /Link -/A << /S /GoTo /D (chapter.24) >> +/A << /S /GoTo /D (subsection.24.2.2) >> >> endobj -3773 0 obj << +3877 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 526.955 539.579 535.978] /Subtype /Link -/A << /S /GoTo /D (section.24.1) >> +/A << /S /GoTo /D (subsubsection.24.2.2.1) >> >> endobj -3774 0 obj << +3878 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 513.406 539.579 522.428] /Subtype /Link -/A << /S /GoTo /D (section.24.2) >> +/A << /S /GoTo /D (subsubsection.24.2.2.2) >> >> endobj -3775 0 obj << +3879 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 499.856 539.579 508.879] /Subtype /Link -/A << /S /GoTo /D (subsection.24.2.1) >> ->> endobj -3776 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 486.307 539.579 495.33] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.1.1) >> +/A << /S /GoTo /D (subsubsection.24.2.2.3) >> >> endobj -3777 0 obj << +3880 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 472.758 539.579 481.781] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.1.2) >> +/A << /S /GoTo /D (subsection.24.2.4) >> >> endobj -3778 0 obj << +3881 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 459.209 539.579 468.232] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.1.3) >> +/A << /S /GoTo /D (subsubsection.24.2.4.1) >> >> endobj -3779 0 obj << +3882 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 445.66 539.579 454.682] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.1.4) >> +/A << /S /GoTo /D (subsubsection.24.2.4.2) >> >> endobj -3780 0 obj << +3883 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 432.11 539.579 441.133] /Subtype /Link -/A << /S /GoTo /D (subsection.24.2.2) >> +/A << /S /GoTo /D (subsubsection.24.2.4.3) >> >> endobj -3781 0 obj << +3884 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 418.561 539.579 427.584] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.2.1) >> +/A << /S /GoTo /D (subsubsection.24.2.4.4) >> >> endobj -3782 0 obj << +3885 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 405.012 539.579 414.035] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.2.2) >> +/A << /S /GoTo /D (section.24.3) >> >> endobj -3783 0 obj << +3886 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 391.463 539.579 400.486] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.2.3) >> +/A << /S /GoTo /D (section.24.4) >> >> endobj -3784 0 obj << +3887 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 377.914 539.579 386.936] /Subtype /Link -/A << /S /GoTo /D (subsection.24.2.3) >> +/A << /S /GoTo /D (section.24.5) >> >> endobj -3785 0 obj << +3888 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 364.364 539.579 373.387] /Subtype /Link -/A << /S /GoTo /D (subsection.24.2.4) >> +/A << /S /GoTo /D (subsection.24.5.1) >> >> endobj -3786 0 obj << +3889 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 350.815 539.579 359.838] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.4.1) >> +/A << /S /GoTo /D (subsubsection.24.5.1.1) >> >> endobj -3787 0 obj << +3890 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 337.266 539.579 346.289] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.4.2) >> +/A << /S /GoTo /D (subsection.24.5.2) >> >> endobj -3788 0 obj << +3891 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 323.717 539.579 332.74] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.4.3) >> +/A << /S /GoTo /D (subsection.24.5.3) >> >> endobj -3789 0 obj << +3892 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 310.168 539.579 319.19] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.2.4.4) >> +/A << /S /GoTo /D (section.24.6) >> >> endobj -3790 0 obj << +3893 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 296.618 539.579 305.641] /Subtype /Link -/A << /S /GoTo /D (section.24.3) >> +/A << /S /GoTo /D (subsection.24.6.1) >> >> endobj -3791 0 obj << +3894 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 283.069 539.579 292.092] /Subtype /Link -/A << /S /GoTo /D (section.24.4) >> +/A << /S /GoTo /D (subsection.24.6.2) >> >> endobj -3792 0 obj << +3895 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 269.52 539.579 278.543] /Subtype /Link -/A << /S /GoTo /D (section.24.5) >> +/A << /S /GoTo /D (subsection.24.6.3) >> >> endobj -3793 0 obj << +3896 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 255.971 539.579 264.994] +/Rect [519.586 245.062 539.579 254.63] /Subtype /Link -/A << /S /GoTo /D (subsection.24.5.1) >> +/A << /S /GoTo /D (chapter.25) >> >> endobj -3794 0 obj << +3897 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 242.422 539.579 251.444] +/Rect [521.223 231.512 539.579 240.535] /Subtype /Link -/A << /S /GoTo /D (subsubsection.24.5.1.1) >> +/A << /S /GoTo /D (section.25.1) >> >> endobj -3795 0 obj << +3898 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 228.872 539.579 237.895] +/Rect [521.223 217.963 539.579 226.986] /Subtype /Link -/A << /S /GoTo /D (subsection.24.5.2) >> +/A << /S /GoTo /D (section.25.2) >> >> endobj -3796 0 obj << +3899 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 215.323 539.579 224.346] +/Rect [521.223 204.414 539.579 213.437] /Subtype /Link -/A << /S /GoTo /D (subsection.24.5.3) >> +/A << /S /GoTo /D (subsection.25.2.1) >> >> endobj -3797 0 obj << +3900 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 201.774 539.579 210.797] +/Rect [521.223 190.865 539.579 199.888] /Subtype /Link -/A << /S /GoTo /D (section.24.6) >> +/A << /S /GoTo /D (subsubsection.25.2.1.1) >> >> endobj -3798 0 obj << +3901 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 188.225 539.579 197.248] +/Rect [521.223 177.316 539.579 186.338] /Subtype /Link -/A << /S /GoTo /D (subsection.24.6.1) >> +/A << /S /GoTo /D (subsection.25.2.2) >> >> endobj -3799 0 obj << +3902 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 174.676 539.579 183.698] +/Rect [521.223 163.766 539.579 172.789] /Subtype /Link -/A << /S /GoTo /D (subsection.24.6.2) >> +/A << /S /GoTo /D (subsubsection.25.2.2.1) >> >> endobj -3800 0 obj << +3903 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 161.126 539.579 170.149] +/Rect [521.223 150.217 539.579 159.24] /Subtype /Link -/A << /S /GoTo /D (subsection.24.6.3) >> +/A << /S /GoTo /D (subsubsection.25.2.2.2) >> >> endobj -3801 0 obj << +3904 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 136.668 539.579 146.236] +/Rect [521.223 136.668 539.579 145.691] /Subtype /Link -/A << /S /GoTo /D (chapter.25) >> +/A << /S /GoTo /D (subsection.25.2.3) >> >> endobj -3802 0 obj << +3905 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 123.119 539.579 132.142] /Subtype /Link -/A << /S /GoTo /D (section.25.1) >> +/A << /S /GoTo /D (subsection.25.2.4) >> >> endobj -3803 0 obj << +3906 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 109.57 539.579 118.593] /Subtype /Link -/A << /S /GoTo /D (section.25.2) >> +/A << /S /GoTo /D (subsection.25.2.5) >> >> endobj -3804 0 obj << +3907 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 96.02 539.579 105.043] /Subtype /Link -/A << /S /GoTo /D (subsection.25.2.1) >> +/A << /S /GoTo /D (subsubsection.25.2.5.1) >> >> endobj -3805 0 obj << +3908 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 82.471 539.579 91.494] /Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.1.1) >> +/A << /S /GoTo /D (subsubsection.25.2.5.2) >> >> endobj -3806 0 obj << +3909 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 68.922 539.579 77.945] /Subtype /Link -/A << /S /GoTo /D (subsection.25.2.2) >> +/A << /S /GoTo /D (subsubsection.25.2.5.3) >> >> endobj -3807 0 obj << +3910 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 55.373 539.579 64.396] /Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.2.1) >> +/A << /S /GoTo /D (subsubsection.25.2.5.4) >> >> endobj -3756 0 obj << -/D [3754 0 R /XYZ 85.039 786.531 null] +3860 0 obj << +/D [3858 0 R /XYZ 85.039 786.531 null] >> endobj -3753 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +3857 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3810 0 obj << -/Length 2978 -/Filter /FlateDecode ->> -stream -xÚí\[w9~ϯðÛ:º«µ/{ ;ì„%%a˜sfæÁqŒãCb3¶C–ýõ«»dw« É0CHN±éVIÕõ}*U•Ô!l~È 3=PD‚‘ÁäjfæοöHh1 -MFE›'§{ž -9 i¬§oS?#¡åàôü—áÁr±O›áfê?Öû¿>Ûûá4u\ M³Ýþ¾÷ËoxpnTx¶‡ÓÍàÆ|Ljh=¸Úã‚!ÁYøÿåÞÉÞR_þx©®§¬A¢aíÇ ¢x " ☠”Hr垃 -DÍÏ>š_#ÞèáËý†ý}Ä^.gó…ÿzm­÷Gd87_3ñýøj÷ÑaHK•†ùä³3DU÷“b_£¢³öƒ1¢å[ϵ¾Ú§jxöÞ¨:vJ›_Tð¡}H­í‡À¸ýñ¥÷>[|ÇV‚ë]ÚjÜÕl࿼*áR°Uvû¶fa·TÜéPà40¡qmðàaƒuâ3f`RFp,ë&3—Èð­'”¡3ôóÿ9pw~Å„Ï,ûVãÍÜ\É.3uè¾T¼y°N_ȳyay&iò¶ -äÐÀ rjZs!çòWS ôÕr3µÈòáÁáÓñc‹ìæ"8Òù$`\õ87é‚8sßÎÏÍo´^š[˜¨¿Îðä}áÌbœ…U!8Û*pB'8ÍÕ¥P¾´v¯07öûruî¡91(|\L쵋•›ºóÿuÂioÍ<œ‡n¯!L#N‰SàVëGèg:êX; ­eñ¨í…ÃñJ2õuÝJV^ï^”ª=jÙ§§«Ri{X€FµÁR°Íç6‹È¤X£•Ö•ÌÂ`WK£k³*ØÛö–þÓg½º¾%)¤l7&y§ÖøTÀ¨-Ù(s‰ìÀE? בE`¶JÑáAZØ[Ë·0·¿™e8>qO ±:†¥5;T¨£œ`T1Aw`dÆ£ñÆÁ–bƒªŽ¾îÆ:¿åÊÜ À06R|sAU|ð¾hf1ͨLŠ*šm4¡š£Æ|n£Éšÿž®ÎLn£†.²Ð-× ØÊt= ÉëçÎXN¾>rá!û"—Åä -BȵUƒ&8 ÇMb*xDÎN@ÊMð»¼òÑpXÍ~°¦^¹ig¡#ô.¤5ÁäÖìK‘,P¤@ -¢H[€"ÐÀ1Ä–Œ!… ŠfwTVHcbU™enǾFEgZ6i¦¶´¼™ûÌË.ù‹àPl¸¼ZÚK—>ÑÛ7ùbóÓ1®!{ïöý):¶UèéH [„Èt¤Žo,êÚäÛ‹ÌÃBc/-7þ»ubŽëåå‡2o¿^§*ˆ#{fnÕº~o®sɾ½ "ؤ/ÐY º°·1sè¶ -- 9Sˆ4³Â˜0¿»N×¥‘ÐÂd½¹~Gq»ÜÛ8*Hc$ÍMà‚‡ªTã“Dóå>#¾<³öñ¿ÌðÐ5XÙkï L7óÍ…ÿvb<žÛ8`g„BiÐþ¾5üŒ»}zû75û}µíÊó#Š…w„6M•„ƒa<3áM´; AÃS[—wÍá{˜J,O¥'îê"NÂ$oÖ67¦÷7tˆ6í9… ±ú.ñ‚(ÔV¡î«ÁQ¤i­u$ - Dy2žØ,î÷ª–×®FšB2|ëbÍ+O&ë¤]ZNø}dF0b_fd1€@3Ú*Ì€NÌÆáðÄŒ˜w¯BÎÿ*.Ñשvæôð9Q]Y&x}|øó£ç> -¸þo¬ÅÇrÁ¥¡W#Ä7‹r0H_”³€ral&uå¶ -ÊÐÀ1Vœ ‘1Ž‰Ã£éÆíª=ºµïÿ9–wvî~%R8ûõ¥D‘pè°;8@†ú‰ -T!-H&Ý%Ãjjr4Y.ìF« ÷ö`«¾Àg1ú¦ª{í*ðC'õcš ÀoX@yðÁn}ÉÅ2˜@dh«8‘cÔ–ÉÀwÉ°ˆ[±ë´¾qQ£e Ú:”¡Xs¯l×—Y D S¤Jˆ¶ -! c<È…N„à­xЬóKw#ŃãõVí&¤.c')X< -9Þ„‚ M:h“ æÖbº±ä -›ï\Ù-(üÉàF;ô·«ƒ[Ú˜©ê!êà‚ÇÙÎC*n2Xpc xzÐ=žnž¾0eÐ|¢h[5äû™ÁÑ}AÎbÈ…­™ªŸèP8,1¢Xdé.ÈÏíü/NNΡôãêñاöß½óŽVê } /€ o«@ œ çI!3ô1´3`€O­Ÿmc®(}ÈórÁ€}Y‘ÅVà0UݨéP`4pb3?V™1Æûçq Ãó¥YåÍzk—Ûë÷†J=P!X­/²@…ˆ -m*@'*„(¨Oj¾9¬qA³ûL‚`¯¾$Èb -, ´UH œB|,Æi×H<5¹E‚5ûR$‹)bªºåÛ¡@hàè'˜¦ˆ )…—~Ÿ¾<–SµÀ-—Ë-j®L‹–cûË´h˜¾ÃŽ!¨'ê…XõÒøê*ÔQN¨«i’A‰ÃOöE›é*Àzréóv›¤û41ìÝ»L>¤íñèuÚ^ž¸Rs%ZÒ; ¹·N_Ä“x¶;„wk|n`Ô„¶ˆÉî˜,ØÃöÔVØÚsåžéꃽ6]…*Mª øs÷ãÅl6ãÙ.³˜hÌî´Á}±Íb¸…™!tÛ*ÀÇv4|l‡q« íÄ6ŽÊÛy½˜OLh‚¾ó飃‹±=Œ³ZOÛ¯­Æc1Å@ŸsÔÔk·Oo³ênxÑtÔFQµa¦;¢41c  åêá¨Í2í‚MûN»,L»/ˆBm¯ - œˆBjâ)]•ŽÚ¼±uðq8ù8Gƒõ{)ã•/oÒ™Ç||òÚ½Ö4ñ©ÙùôæSªï•Á€}Y‘ÅVà@¬h«°8±cDãaY•ŽÙì,µÉa„Uu÷Þ¦m_qO]F°c_rd1€FLUct¨8’ƒ6),#9xJÈÝéùx¥·›c~þvev—r]Ú,ü²–0¦y£š{Á‰h¾žœ(Äêœ(¡8Ñ¡BàÀ‰Š!"'b‘æÙؽnìK¯·cð¸~„‚~¨Ôìð$˜´/O²À“.ˆ'mž@'žd,î+$+żi®ä‰­·mø‘1 ¦ìË,𣀉5Õ>*ü€ŽY>åaÑd~ÄJÞÁËF`÷ |ÀaS»~üm㯜¹X3x˜·î­›jõ–û£±ú2 ‹ (€€ÐVáV¯ïPJ«¾…ãGãk&*u©I1žŒ'n#ÈÒã}8F°¯M|1¹XÌ¿žVËiÜÏ) -Jn÷çW=•úß¼¡`9À€…¸úÄ 7(ž±hR5àØýÑÑè»äK¿IWìÍÛw&)`fà "µÆÜ00j¤ щøÇ2šTx¨Ý‚#Ѧ=IRˆÕYRâФC…[9k¢0Âœî:¶qTÒÞaÿ8Ÿ…#ÏíþÌøl~éŽêÚúíGï¸_8'n÷aª^»Pàsü6¨ïnŸÞ–ÕÓŽE_·yo’H…4¥Ÿ˜ŽÂGÁ†îûžšÁ¾}§f¦fD§¶ -S“ EÅ`dd¸f•¹)Qcæíˆãæ ¿a¹N¶õ¢<7C«ÛáOÖtB ì<œ­¶ß ´sÕ;xó嵬Lhí_–Þ} Óg#Ô ²eh «»Û§·eõ bÑ45]M°™œÑî©mþ±øÇå¾üÏž¦ÙϤ›ê»&ýQ|Àâ,øÏ*}B£Bãÿ#X:žendstream +3913 0 obj << +/Length 1934 +/Filter /FlateDecode +>> +stream +xÚí\ÝSÚJç¯àí†â~&»÷åNµÕÚ©h+Ö;Óö!BÄŒ@lÚþ÷wÏ~D +6¨7㌠»KXöwÎÙßùXp©?\ÜGTÖCøœâzgPCõžê9¨a;Õ™]»íÚÎ>êùÉzûRiw¿z{é°A„—Çæ2j|o¨½kO=¤É|PxÊÚ×ï¨ÞUô¡†|*EýNÝ#KYÔ§>gÔ¾î×NkŸŠ§˜>V7ïZ0×&£¡E½I‘/+æŒù‚9îS¿Ñ$Œ©éMì Ô·hRJ½w ìeYš©ËHµ`â©!¸0)§^Ý¿,ëÛîÛ7{ô šŒ¨åźŸÃ ëÕÍÍçƒ%KO6ûLøªõþ#çáÅÄGBÖ›A®€/Vßw f?‘>Í.Iê“p±@Úžåó¸K´R\(aJ†]#`' `)4õc-yf@èë”JŸò¤…Xi9Ȥw¡.س‚% Ìk¥¹iø¬‘¥ý[=¬gºÏFqfGFSï>ÈÒ±zu£º$ÛDCr?$|4øzhXÓLÔFÀ[ïéçè ´©@}7ɼÃa÷²(O†°ôAèèuÓÅÞÈ4¶à>ÎM3E^ +ÿ²kÛ{—äWæ!§Ñà"š3x”›föÀb-œ«zâÜb‰Ek dw·&ñ1!‹†Øõibì3"‘ç@Û>ØÝö‚yZX£„0‹Ýº(ÁŒœIÚÕ­ ²úæÂLÝç °’T{Üzn¤'+­@›,y7ê4Hè]÷€´¤€ @íÀ=\/5¡AH`˜¢;³ +Õg‡ª#¦­h›Í¤ØmÆ9 ÇT{,¯pú­·¢Öá¿;ÍV6þiœ7õ´ô•h0ñ%°…`Š[îÄyÀÙ¹Á-˜M†‚«6ÏŽs”…)™Å4s"=¿“/ÕN*×Qn"_CºD/-‚$Ä•6nÈ•´‘Í"94õOs{ 1¹æ=±¯Ç¤šê4š!š« ¢2 [•ÑD£Â‘†~K`µƒ† ºs¤îO-£  +P^"&Ÿjoé·ç¦YýK³kç§KÉž=‹ q):Æ +Ó¾²¸´â|÷ðØ®î®=ã`À(+½Q‘’"³}ñ|Ú¶ í'6PY»?_3ÇAJ +›6˜"˜1‹²°r 6Æ“•¤„ŽŠ¼mY?¦jCSÛʵÂs|£øFV8>¹ ñ>¤¤‚%"ø{4’WÛ-ñQ^Š‚ò‚ž©ö¦skçÈHMÒFa~<쫾_¦OvíñT°3ò¯ñÿÏ’—AuxAO¿ÀjÇÙ/³ö@{ú)x wúc¦c/Y§Nž¤ÖÇ—©ðú#æ¸éi4Ð… 6wpg·ð:Î +×OçL-Jp.x4ìÙ¦WÁ Æ É_/0Á–Þ¡IxŸ “Žâ*Šžt㽫Hg°Gñ|µÕúéêp­tuHÂ¥éjµ÷˜„öÁ «tõ–7ø›a‘®>צ$7{÷›dÑa¦«ÈÈ´-¡±pŸÒZü•…êÆÿ¨«±8xO;—”žÙ7 +Œö4¦™‰Û‚*ƽ>¦¢ …d…C¥«-¹ìŠó¯.3p¸4»îw'¡áIš»rË@:ÏøCt£YZ<*Ø›±ª.u¦«på¿ `ƒ*ä±%xËHs¾.ä±w"8òGé”Ç¥kˆÿ²Ç»Sþؾ.är5~‰*¹)nÓþšÜÄ_Æ_3¥Äºªx7êèð2xc³y ©Àì\ “ãø ]8Ö«8ÆW‹Â…k¥¹S.äK²>¯Ëx‰ª:DáÎU>ûKyóÈ”4–î}Ò³Ç'ÞÜF D壋¤¯«³ HõËX¼cmý Âû”æo뀅¬ÌÝ3Ò„5Ë¥(Öd£I…Ï$](6«¹ÉUÀ¾ä|z‡_àsîØ÷²û§,@5ŒT7gÀ°×5G—æ4ªjÂܨ˜/m‘êËk%l™6¥/”m`&(²ì›^u‹óZ6¦™½ZµX‘šÏOÓš§SG²šÔWÝÈGOh:è–˜’Zg:>u\Sݱ¥F~¢¼¨ˆ<æ˜tmŒU;å:öþé©Õ±¡V|gÂ.Ki‘«e-©M +¥•AhI€>Æo¢“Z¶ÚgSf]åVàEY4ˆsnæ‚áÚuï9Ä1B¼‚Šê¼4n.¦bªÌé$¸=UU~Gã4v:eaNnRUz= ]eIaOçuMë– aUª÷;ò’t•&G· ½nb茦 Muz¢ø…oˆ£=WsbÛÜ®ib ºÈÓ­>B’©wà¿×$ìe$J`+l![] VÔOr[;'8©\Ô·>QŠÖMNô¼ò +´"“öƒ\mXIÞ¶Žþ6œnœe”3U¯&9t¥Ë]o5AUL”SZÁ¸FYŒtãýT> endobj -3812 0 obj << +3915 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.2.2) >> +/A << /S /GoTo /D (section.25.3) >> >> endobj -3813 0 obj << +3916 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (subsection.25.2.3) >> +/A << /S /GoTo /D (subsection.25.3.1) >> >> endobj -3814 0 obj << +3917 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] /Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (subsection.25.2.4) >> +/A << /S /GoTo /D (subsection.25.3.2) >> >> endobj -3815 0 obj << +3918 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 714.003 539.579 723.026] +/Rect [519.586 703.094 539.579 712.663] /Subtype /Link -/A << /S /GoTo /D (subsection.25.2.5) >> +/A << /S /GoTo /D (chapter.26) >> >> endobj -3816 0 obj << +3919 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 700.454 539.579 709.477] +/Rect [521.223 689.545 539.579 698.568] /Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.5.1) >> +/A << /S /GoTo /D (section.26.1) >> >> endobj -3817 0 obj << +3920 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 686.905 539.579 695.928] +/Rect [521.223 675.996 539.579 685.019] /Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.5.2) >> +/A << /S /GoTo /D (section.26.2) >> >> endobj -3818 0 obj << +3921 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 673.356 539.579 682.379] +/Rect [521.223 662.447 539.579 671.469] /Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.5.3) >> +/A << /S /GoTo /D (section.26.3) >> >> endobj -3819 0 obj << +3922 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 659.807 539.579 668.829] -/Subtype /Link -/A << /S /GoTo /D (subsubsection.25.2.5.4) >> ->> endobj -3820 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 646.257 539.579 655.28] -/Subtype /Link -/A << /S /GoTo /D (section.25.3) >> ->> endobj -3821 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 632.708 539.579 641.731] -/Subtype /Link -/A << /S /GoTo /D (subsection.25.3.1) >> ->> endobj -3822 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 619.159 539.579 628.182] -/Subtype /Link -/A << /S /GoTo /D (subsection.25.3.2) >> ->> endobj -3823 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 594.701 539.579 604.269] -/Subtype /Link -/A << /S /GoTo /D (chapter.26) >> ->> endobj -3824 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 581.151 539.579 590.174] -/Subtype /Link -/A << /S /GoTo /D (section.26.1) >> ->> endobj -3825 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 567.602 539.579 576.625] -/Subtype /Link -/A << /S /GoTo /D (section.26.2) >> ->> endobj -3826 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 554.053 539.579 563.076] -/Subtype /Link -/A << /S /GoTo /D (section.26.3) >> ->> endobj -3827 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 540.504 539.579 549.527] +/Rect [521.223 648.897 539.579 657.92] /Subtype /Link /A << /S /GoTo /D (subsection.26.3.1) >> >> endobj -3828 0 obj << +3923 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 526.955 539.579 535.978] +/Rect [521.223 635.348 539.579 644.371] /Subtype /Link /A << /S /GoTo /D (subsection.26.3.2) >> >> endobj -3829 0 obj << +3924 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 513.406 539.579 522.428] +/Rect [521.223 621.799 539.579 630.822] /Subtype /Link /A << /S /GoTo /D (subsection.26.3.3) >> >> endobj -3830 0 obj << +3925 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 499.856 539.579 508.879] +/Rect [521.223 608.25 539.579 617.273] /Subtype /Link /A << /S /GoTo /D (subsection.26.3.4) >> >> endobj -3831 0 obj << +3926 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 486.307 539.579 495.33] +/Rect [521.223 594.701 539.579 603.724] /Subtype /Link /A << /S /GoTo /D (section.26.4) >> >> endobj -3832 0 obj << +3927 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 472.758 539.579 481.781] +/Rect [521.223 581.151 539.579 590.174] /Subtype /Link /A << /S /GoTo /D (subsection.26.4.1) >> >> endobj -3833 0 obj << +3928 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 459.209 539.579 468.232] +/Rect [521.223 567.602 539.579 576.625] /Subtype /Link /A << /S /GoTo /D (subsection.26.4.2) >> >> endobj -3834 0 obj << +3929 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 445.66 539.579 454.682] +/Rect [521.223 554.053 539.579 563.076] /Subtype /Link /A << /S /GoTo /D (subsection.26.4.3) >> >> endobj -3835 0 obj << +3930 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 432.11 539.579 441.133] +/Rect [521.223 540.504 539.579 549.527] /Subtype /Link /A << /S /GoTo /D (subsection.26.4.4) >> >> endobj -3836 0 obj << +3931 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 418.561 539.579 427.584] +/Rect [521.223 526.955 539.579 535.978] /Subtype /Link /A << /S /GoTo /D (subsection.26.4.5) >> >> endobj -3837 0 obj << +3932 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 405.012 539.579 414.035] +/Rect [521.223 513.406 539.579 522.428] /Subtype /Link /A << /S /GoTo /D (section.26.5) >> >> endobj -3838 0 obj << +3933 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 391.463 539.579 400.486] +/Rect [521.223 499.856 539.579 508.879] /Subtype /Link /A << /S /GoTo /D (subsection.26.5.1) >> >> endobj -3839 0 obj << +3934 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 377.914 539.579 386.936] +/Rect [521.223 486.307 539.579 495.33] /Subtype /Link /A << /S /GoTo /D (subsection.26.5.2) >> >> endobj -3840 0 obj << +3935 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 364.364 539.579 373.387] +/Rect [521.223 472.758 539.579 481.781] /Subtype /Link /A << /S /GoTo /D (subsection.26.5.3) >> >> endobj -3841 0 obj << +3936 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 339.906 539.579 349.474] +/Rect [519.586 448.3 539.579 457.868] /Subtype /Link /A << /S /GoTo /D (chapter.27) >> >> endobj -3842 0 obj << +3937 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 326.357 539.579 335.38] +/Rect [521.223 434.75 539.579 443.773] /Subtype /Link /A << /S /GoTo /D (section.27.1) >> >> endobj -3843 0 obj << +3938 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 312.808 539.579 321.83] +/Rect [521.223 421.201 539.579 430.224] /Subtype /Link /A << /S /GoTo /D (section.27.2) >> >> endobj -3844 0 obj << +3939 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 299.258 539.579 308.281] +/Rect [521.223 407.652 539.579 416.675] /Subtype /Link /A << /S /GoTo /D (section.27.3) >> >> endobj -3845 0 obj << +3940 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 285.709 539.579 294.732] +/Rect [521.223 394.103 539.579 403.126] /Subtype /Link /A << /S /GoTo /D (section.27.4) >> >> endobj -3846 0 obj << +3941 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 272.16 539.579 281.183] +/Rect [521.223 380.554 539.579 389.576] /Subtype /Link /A << /S /GoTo /D (section.27.5) >> >> endobj -3847 0 obj << +3942 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 258.611 539.579 267.634] +/Rect [521.223 367.004 539.579 376.027] /Subtype /Link /A << /S /GoTo /D (section.27.6) >> >> endobj -3848 0 obj << +3943 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 245.062 539.579 254.084] +/Rect [521.223 353.455 539.579 362.478] /Subtype /Link /A << /S /GoTo /D (subsection.27.6.1) >> >> endobj -3849 0 obj << +3944 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 220.603 539.579 230.172] +/Rect [519.586 328.997 539.579 338.565] /Subtype /Link /A << /S /GoTo /D (chapter.28) >> >> endobj -3850 0 obj << +3945 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 207.054 539.579 216.077] +/Rect [521.223 315.448 539.579 324.471] /Subtype /Link /A << /S /GoTo /D (section.28.1) >> >> endobj -3851 0 obj << +3946 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 193.505 539.579 202.528] +/Rect [521.223 301.899 539.579 310.921] /Subtype /Link /A << /S /GoTo /D (section.28.2) >> >> endobj -3852 0 obj << +3947 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 169.047 539.579 178.615] +/Rect [519.586 277.44 539.579 287.008] /Subtype /Link /A << /S /GoTo /D (chapter.29) >> >> endobj -3853 0 obj << +3948 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 155.497 539.579 164.52] +/Rect [521.223 263.891 539.579 272.914] /Subtype /Link /A << /S /GoTo /D (section.29.1) >> >> endobj -3854 0 obj << +3949 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [517.86 117.004 539.579 127.299] +/Rect [517.86 225.398 539.579 235.693] /Subtype /Link /A << /S /GoTo /D (part.4) >> >> endobj -3811 0 obj << -/D [3809 0 R /XYZ 85.039 786.531 null] ->> endobj -3808 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3857 0 obj << -/Length 2989 -/Filter /FlateDecode ->> -stream -xÚí\ËvÛFÝë+¸ìô@ÏΖsìÄ*ñ"É¢hŠQÔ€`œÌ×O¿»I Ë†}<‘¨‹$ÐÕU¨{ûUU$™`õLj0““ª.‘`d²ØœáÉJÝyqF\‹™k2KÚ<¿<ûêQNFËÉå»ÐÄHÈrryýsq¾½›Òºè–öe7ýõòÛ³¯/Cljj˜îö?g?ÿŠ'×Ê„oÏ0b²ž¼Wï1"RN6g\0$8sŸoÏægÿ -}Ù{|b¥†ž‚³ -‘z2cÕ5lB0A3õ¤B ’WáI)xR×F?©ês:“¼øñ~Õ6×ë»ÕtÆʪx×n7ú]Y̧3R4›))®šEØ«ÝÖ¶›7u™!u#|ì&A•Kk6IŒ²·ÚÕľù!yß~†ã>ÍCÔ¼§šÕǪû~užWE褛Ò2˜DDb’w~Å) -CçW¢E Yèû&ÐCŠ -—|R©«v=è©óƒßf«Aþ]ÿ1Ÿ¯ôÒB¯/vËVÏ”>0 ¿”·ÆÂoEè=ì‡jÈsÊÜzÄ'ˆS‡xXúÛ äšUzÈ~!¸­·Æ"¤Ðê2‹{O?= Õ£_Ö•ºD"üÌÁÿZí•hU\¯Ý|4Þ5#¦f‹¥./ÝWdù ¼Ð·¦}}O¯n±¸R«9ä¦1óÉz«ûR¢äÊýUõpàöî‰w"–üÀõuC|À„<ä b¿¶—GLP9ÜñíïÝz«1ln׆éO5æ}˜£õ/`†sâXfD1€)@µÌ2£oÀ Hq˜ JuXS ÌðËÿEÓ5Wš ;3ÞÕ_^•Ò/Äç¼±Œˆb#R`FôM)Œà¢‚GFøíÁ9<Á?7<ñó»>&¨ó€P7žœÓÆ2!ŠLH˜Ð7`¤801Tá„ ,2Ám õN@S×}ÒÿB¼p.Ë‹(ð"…àE߀âÀ Š"ò‚;^Ø]âng7ŽDïùÂÌИ=âoá ©§’k7‹˜yÅí4Ÿí;õáÆE4׋ÆìIÔÞ±~$ˆ;çŒE<Šˆ§Ž—8‹xßqHq@—Hýˆ‹¿g‚±¼p.Ë‹(ð"…àE߀bÏ !¢Š¼(/^]èáûìrJ)OäXðexá]8’‰Xžðäy1`Bž bRÚó¦¨$¸>à)ôÑ‚×R;õtñÞålì`i -ÍtV ‹O -pç›±€G1ðÔïà}À!ÅðR )Ž§ƒ€ïM䇔úÚöÚ;w\0÷—M«8Q7êâÚœ8¦3IéãÙùc,ÈQ 9õµ$Yû& CŠÈ‚ªWy2s ¿¼~­Ã÷ŸèOf q¿¿71ÆmÛ)¡ƒ³á£ÆÎcŽb©£%Í"Ü7!›“§qQÃ9yA+Eæä}c±9ù×ú´¿jmÂ8$“ì|U|w©ïrwL¸Ð·2ôšOöó›‹ó\š>±ócÒôàc÷i]β.}}Nš^PjÇlQaê=í³ôonõ(»»3“ãʯæΞ^ø°}gpð÷çÙ¥w>¢ÏkrÚ¡Zï»±ƒ3Šƒ3Å`Jß`ú…‡Í6ƨ,‡j¿Wçl!Š{ðÝ:&lMb¶~Ð3ì_Àçʱüˆb?R˜~ôMø)öË3¯+Äð!?â¦ûb»i|íΫÆfwÔŸí¾Ó„œÚ6Û{c$ĉXâOËlÆ~À„<Ä âqÅPåCÁb¿Íž/[;îýNZï ]½ud»X·ËE·mÿæÃôéžy,Q 2õ'dßHHq²Äˆbq¤ßJ¿Ú®|Õ|Ñê•ü¾3…T¤:ÑC±÷ÇX£rêk™­³0R@æ%*Ey2w ¿Ñ[²­®µ¸]Z¬_¯Wm££ßëíÝWçíÒ…¾+òX@tÏ;Ä(€˜ú±o"¤8€È"¸:Q8´‘ïö`N‹íÖœv]JcaveÛ½ÍiLݦŒ<®êü0Ü(€›ú·o.¤Øo©9‘Hˆ\Ÿëžw~3}? Éî—wqœNÍY7Tš±l*œv×­Ëå;ùÙ9j,úQ @?@¿o€>¤ØŸ°9.öÑR*ž]8#÷{MW¥ÅìÃιp,/¢À‹YeyÑ7à¤ØÏ -LRÄ…Œ¼ðm{Ic+ïBÜZ]Ü/¾ZÊ0Eé|I,ﱑ4HÄò48@#Oƒò4T5’$² ¬ é7_4ò/M¡¼ž#nmͼ+^Hfs}Û®;XÍ%ÎÖ%caRʉ³e¶2¶¯ÿ³ÞLèF xû6Æ2jÞó·SI‹gSIŠK­žYj˜(÷Í2D´m ŒÉkêÛo§ Ë+{ûÙõÆÌ#ë]ÖÓ…4[ ¦þÞæ"à‰áŸó¸Oý gs‡I_Ù8ƒßÇÖ ®ÍŒëKÁí>ú ~5-„ÁŸ‡ -#óÆÕ³ë#´”ôé.ÖÞ§c‡oÆo‚Äž¾ À, )³4­óáVšDÅ¿6•ìW·‰·SBôÈUëò¥ÝÔ§©çýNñ¥²Só)®ÒÎUcñbþ þ}ü!ÅÂPí« iz„[.ö­¯à >÷àwzYVgõÕ=·Ïç¯t -=¬[ÆbŬ—sœ-@0ÀR°ÆQ_ÿ¨±öÉ—7.È­7áf7ÆYñÏíf™~³M—°KFNu˜;/…>ŠÐ'pœ­L0€R졧u‰*_⨡÷5Ç/n·æk*·¾z¨ëì ×ǯƒ¯¥?±ÂBﱑ4HÄò4HÑh0`Bž â@ƒŠ!"øBäÃ\×<ÖAØ: ½õ+ù&ƒóÛX2D1€ &jëž%C߀ â@!QéÃÆš ¾úØ„c×î§Qü÷T‡8QÚãÀ;x¿%CÈ`‘¡o@Hq /öU‘š ÕÇí Þ®ÿÛ´úÜ(ª'5!8wå@8@q oÀHqà€^øºIÍzˆ]Óíwé×Úõv°ò). ÎacYÅ$`pœý!›@Š Hd²EÇ$øií—‚÷Ç4Õþ*ŠsÜX2)€ ˆ -=ý­X N’ÈFS¢ðD°¿bc“5罹.=ÖH›X®Iø¬–=ž~:°[7…=H°G Ø{ú‚új=§Bk…,ËDõKT«bFÊIrø³ljЧÖÕ÷m´i?!ôs‘÷v»¿º]întÛN×XÛ­¨W‹j’èæZÃf÷i]–-HKú‚ÊÐCMH‰X©Pÿ«€ù ᇙ²¡‰oc³)’Ë“ê -³«Æf=7ËÅo:S¶Þé¥8—àHÔ~L‚´ò¸OëÛlAÒ×'&8Ž­Lp^,ä7^ÚCK,'¹ÖY“6t)"\=¾‰çÿ?§9ӢT~NKpƒHD?˜¨ K¤5°…5f=[|¥Ê³]øbÕÆ×*iš˜hù› A¬CÇ$H‰PAééh Q¯5 ó‰ÿ…§°Õ õl;“eìÉçÛ±d‰b[Ü8ÎV· ˜_øÕæ€Uƒ¥ê?ó?ùé¿:®&®:›®PYñ S›;fó‚”å‹ -L£ÄâÿÞ ªlendstream -endobj -3856 0 obj << -/Type /Page -/Contents 3857 0 R -/Resources 3855 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3701 0 R -/Annots [ 3859 0 R 3860 0 R 3861 0 R 3862 0 R 3863 0 R 3864 0 R 3865 0 R 3866 0 R 3867 0 R 3868 0 R 3869 0 R 3870 0 R 3871 0 R 3872 0 R 3873 0 R 3874 0 R 3875 0 R 3876 0 R 3877 0 R 3878 0 R 3879 0 R 3880 0 R 3881 0 R 3882 0 R 3883 0 R 3884 0 R 3885 0 R 3886 0 R 3887 0 R 3888 0 R 3889 0 R 3890 0 R 3891 0 R 3892 0 R 3893 0 R 3894 0 R 3895 0 R 3896 0 R 3897 0 R 3898 0 R 3899 0 R 3900 0 R 3901 0 R 3902 0 R 3903 0 R ] ->> endobj -3859 0 obj << +3950 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 754.651 539.579 764.219] +/Rect [519.586 200.939 539.579 210.508] /Subtype /Link /A << /S /GoTo /D (chapter.30) >> >> endobj -3860 0 obj << +3951 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 741.102 539.579 750.125] +/Rect [521.223 187.39 539.579 196.413] /Subtype /Link /A << /S /GoTo /D (section.30.1) >> >> endobj -3861 0 obj << +3952 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 727.553 539.579 736.575] +/Rect [521.223 173.841 539.579 182.864] /Subtype /Link /A << /S /GoTo /D (section.30.2) >> >> endobj -3862 0 obj << +3953 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 714.003 539.579 723.026] +/Rect [521.223 160.292 539.579 169.315] /Subtype /Link -/A << /S /GoTo /D (subsection.30.2.1) >> +/A << /S /GoTo /D (section.30.3) >> >> endobj -3863 0 obj << +3954 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 700.454 539.579 709.477] +/Rect [521.223 146.743 539.579 155.766] /Subtype /Link -/A << /S /GoTo /D (subsection.30.2.2) >> +/A << /S /GoTo /D (subsection.30.3.1) >> >> endobj -3864 0 obj << +3955 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 686.905 539.579 695.928] +/Rect [521.223 133.194 539.579 142.216] /Subtype /Link -/A << /S /GoTo /D (subsection.30.2.3) >> +/A << /S /GoTo /D (subsection.30.3.2) >> >> endobj -3865 0 obj << +3956 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 673.356 539.579 682.379] +/Rect [521.223 119.644 539.579 128.667] /Subtype /Link -/A << /S /GoTo /D (section.30.3) >> +/A << /S /GoTo /D (subsection.30.3.3) >> >> endobj -3866 0 obj << +3957 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 659.807 539.579 668.829] +/Rect [521.223 106.095 539.579 115.118] /Subtype /Link -/A << /S /GoTo /D (subsection.30.3.1) >> +/A << /S /GoTo /D (section.30.4) >> >> endobj -3867 0 obj << +3958 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 646.257 539.579 655.28] +/Rect [521.223 92.546 539.579 101.569] /Subtype /Link -/A << /S /GoTo /D (subsection.30.3.2) >> +/A << /S /GoTo /D (subsection.30.4.1) >> >> endobj -3868 0 obj << +3959 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 632.708 539.579 641.731] +/Rect [521.223 78.997 539.579 88.02] /Subtype /Link -/A << /S /GoTo /D (subsection.30.3.3) >> +/A << /S /GoTo /D (subsection.30.4.2) >> >> endobj -3869 0 obj << +3960 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 619.159 539.579 628.182] +/Rect [521.223 65.448 539.579 74.47] /Subtype /Link -/A << /S /GoTo /D (subsection.30.3.4) >> +/A << /S /GoTo /D (subsection.30.4.3) >> >> endobj -3870 0 obj << +3914 0 obj << +/D [3912 0 R /XYZ 85.039 786.531 null] +>> endobj +3911 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +3963 0 obj << +/Length 2035 +/Filter /FlateDecode +>> +stream +xÚíœKWâHÇ÷| +–É‚Lê•ÇÒÖÖ±ÚöÀ´‹ž^ˆ1'‰ÍtŸùðS·^D@Åà#Çs„¤BõãÖýßG@m—ÿ¡vÀ—„m?ðFP{0i¹í9j!u„Û¦Žë1úÐkývȼ6rÐ Û½KqHoøÍÚϦ6¬2–…ý½÷©õ±W9I‡:Ô#p–Zß¾»í!£O-×!aОñ箃°=iQFF‰ÚN[ÝÖs9FÛòU+®µCvÜ lwˆë5ØŠ‹æÇð‹rìñ<ë.<* +»ƒ¬¡¬>ßMˆõ¶£ ^Á¿¶§||XÀԊĆ/溕†Ë;×?äi/_ CBæø˜ñçKsšÚòÉG÷Íd.žyñèíSÞ Øp \Lá:9€9Þ;çŸÈ 뜺]zPC÷QP‰ï;(ØŒ)²|¸ ´Î„…ͤAu…á㉰B»ã»ìÂòøz…¼× ¯„uÃGþr‘ûþ•û.ù®,Wãq”sž¾5æ;X6Gv'Äø½BOÄÖåCŸãá)ߊ®%€ùšip]ó!N$ËKxÄïÓr† s ÁV«‘êyÄ`wÕÀÒRë4“ÈÅRWÂsÐÄó­Ë<›Ègg=¥J±ÀƾÜ(3yD7šô£|äöùÁþ⧣„I—uÇL­¾Ð,ÍT°jâav”Të`ᕺRMN!‡âào6r`’0¥Öy +ßèéT¬!#ùUŽ¦J€ñ½bI*Åêñnå|³Œ¥¸ã¦ÞˆdXD‹Ÿl ¤!4‘rŸ¹ÐfÌú[“”É#´Acã tÛtäù5‚b;tÙ$J¦ÊE€ö'üËx¬ÔA.B„3xس+CG+¸nœKsÓ" ÄY”ÇËÁíA’ǃ2Ë®FI\Ü0ØÐD´L;ÉFÙTG<9x®ë²Öá7qÎ" ¯F@T:ùñ؆¦±ätšŒò²=I6ým?UªÇG €m` +ÀŸ"/§)¥÷°u”g"ŠQé·ÙÌ¿ÙJ? Æ2¶+Ý°’nÝR‹¶k5×ÜehW¯¢e°çœïÈ3H‡Z©îøKBâ5ÂìÑèÈ&ž«j™Ìgà'6ÆÀ%/sÞ_U å×bØR«ãK“{ã{ob}Œ Y±€4ñÒý ƒšš5š€ëêG"¹« ˜g*–̉ª-UŒw{–¶$  ¥ZówXæïºvˆ­=;DVO&ßþ“½q\IÎɧ6á¸úrco8I¦°*¥Y–áup>Èëq¾éÖ²xÔEgñÜ{xkxlòw‡6ÿ~Æ2É Ú-7‰žj"³Š' ¼ÁE`qãŽ66’UÐ7U®dØHŒ# › ã41 ÷lî~bSš&ƒ(Õ#üpß%ߤ)®Á;áŠÂø +È¢T J•"eqa#„øÊÇ-»'÷O‹2JS!ó9ðýFP<ÙF±³"6OÀž¨˜‹{­ ˱4K@UÈ.t¿”rô0Y„Þc‚©^Fx=F]°0ÐÑ&ýµL~@V¸äÐ!] +ZÐCôM !5­tZ‡·õÓj,µ‚Aµ»Ae¨ ¬ +›@j }:@¶?¢ã¨xp“ߪ/»(a_yv3Ë\b·{ Fø]sb5ÝÌÐŽMFWhÉ\¼J%¬¢4ùU ‡—ÚZ˜G^7¯åN”rÿ¬ª?’x¶\ü"t½íW/’ð|ô<¯‰ÆÖbê×bgÄHw™‚X”ëʾˆõ{6Qã² zCf5~lWÜ´9J³¾Xãt eYÊÎIÈß"¯i‚Ù C¶B£EnuTtçjÒçAJË£ ÈG€ j2Fs‹H.—Å.yq7POæ(’/$[Ï^pE™ƒäa~ðEôV,£ò¦Ð=Z¾ø,llp„aMýE„_½„Î!2¿éóÝËu$N°ˆ’“ ­H6ÌlσÇ}Ø-ÄÐt/‘ÞI¦ò­€#H¼q‡ ÉÊR.F> endobj +3965 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 605.61 539.579 614.633] +/Rect [521.223 754.651 539.579 763.674] /Subtype /Link -/A << /S /GoTo /D (subsection.30.3.5) >> +/A << /S /GoTo /D (subsection.30.4.4) >> >> endobj -3871 0 obj << +3966 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 592.061 539.579 601.083] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link -/A << /S /GoTo /D (subsection.30.3.6) >> +/A << /S /GoTo /D (subsection.30.4.5) >> >> endobj -3872 0 obj << +3967 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 578.511 539.579 587.534] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link -/A << /S /GoTo /D (subsubsection.30.3.6.1) >> +/A << /S /GoTo /D (subsubsection.30.4.5.1) >> >> endobj -3873 0 obj << +3968 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 564.962 539.579 573.985] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link -/A << /S /GoTo /D (subsubsection.30.3.6.2) >> +/A << /S /GoTo /D (subsubsection.30.4.5.2) >> >> endobj -3874 0 obj << +3969 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 551.413 539.579 560.436] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link -/A << /S /GoTo /D (subsubsection.30.3.6.3) >> +/A << /S /GoTo /D (subsubsection.30.4.5.3) >> >> endobj -3875 0 obj << +3970 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 526.955 539.579 536.523] +/Rect [519.586 675.996 539.579 685.564] /Subtype /Link /A << /S /GoTo /D (chapter.31) >> >> endobj -3876 0 obj << +3971 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 513.406 539.579 522.428] +/Rect [521.223 662.447 539.579 671.469] /Subtype /Link /A << /S /GoTo /D (section.31.1) >> >> endobj -3877 0 obj << +3972 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 499.856 539.579 508.879] +/Rect [521.223 648.897 539.579 657.92] /Subtype /Link /A << /S /GoTo /D (subsection.31.1.1) >> >> endobj -3878 0 obj << +3973 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 486.307 539.579 495.33] +/Rect [521.223 635.348 539.579 644.371] /Subtype /Link /A << /S /GoTo /D (subsubsection.31.1.1.1) >> >> endobj -3879 0 obj << +3974 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 472.758 539.579 481.781] +/Rect [521.223 621.799 539.579 630.822] /Subtype /Link /A << /S /GoTo /D (subsubsection.31.1.1.2) >> >> endobj -3880 0 obj << +3975 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 459.209 539.579 468.232] +/Rect [521.223 608.25 539.579 617.273] /Subtype /Link /A << /S /GoTo /D (subsubsection.31.1.1.3) >> >> endobj -3881 0 obj << +3976 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 445.66 539.579 454.682] +/Rect [521.223 594.701 539.579 603.724] /Subtype /Link /A << /S /GoTo /D (subsubsection.31.1.1.4) >> >> endobj -3882 0 obj << +3977 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 432.11 539.579 441.133] +/Rect [521.223 581.151 539.579 590.174] /Subtype /Link /A << /S /GoTo /D (subsubsection.31.1.1.5) >> >> endobj -3883 0 obj << +3978 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 418.561 539.579 427.584] +/Rect [521.223 567.602 539.579 576.625] /Subtype /Link /A << /S /GoTo /D (subsection.31.1.2) >> >> endobj -3884 0 obj << +3979 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 405.012 539.579 414.035] +/Rect [521.223 554.053 539.579 563.076] /Subtype /Link /A << /S /GoTo /D (section.31.2) >> >> endobj -3885 0 obj << +3980 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 391.463 539.579 400.486] +/Rect [521.223 540.504 539.579 549.527] /Subtype /Link /A << /S /GoTo /D (subsection.31.2.1) >> >> endobj -3886 0 obj << +3981 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 377.914 539.579 386.936] +/Rect [521.223 526.955 539.579 535.978] /Subtype /Link /A << /S /GoTo /D (subsection.31.2.2) >> >> endobj -3887 0 obj << +3982 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 353.455 539.579 363.024] +/Rect [519.586 502.496 539.579 512.065] /Subtype /Link /A << /S /GoTo /D (chapter.32) >> >> endobj -3888 0 obj << +3983 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 339.906 539.579 348.929] +/Rect [521.223 488.947 539.579 497.97] /Subtype /Link /A << /S /GoTo /D (section.32.1) >> >> endobj -3889 0 obj << +3984 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 326.357 539.579 335.38] +/Rect [521.223 475.398 539.579 484.421] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.1) >> +/A << /S /GoTo /D (section.32.2) >> >> endobj -3890 0 obj << +3985 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 312.808 539.579 321.83] +/Rect [521.223 461.849 539.579 470.872] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.2) >> +/A << /S /GoTo /D (subsection.32.2.1) >> >> endobj -3891 0 obj << +3986 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 299.258 539.579 308.281] +/Rect [521.223 448.3 539.579 457.322] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.3) >> +/A << /S /GoTo /D (subsubsection.32.2.1.1) >> >> endobj -3892 0 obj << +3987 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 285.709 539.579 294.732] +/Rect [521.223 434.75 539.579 443.773] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.4) >> +/A << /S /GoTo /D (subsubsection.32.2.1.2) >> >> endobj -3893 0 obj << +3988 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 272.16 539.579 281.183] +/Rect [521.223 421.201 539.579 430.224] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.5) >> +/A << /S /GoTo /D (subsection.32.2.2) >> >> endobj -3894 0 obj << +3989 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 258.611 539.579 267.634] +/Rect [521.223 407.652 539.579 416.675] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.6) >> +/A << /S /GoTo /D (subsection.32.2.3) >> >> endobj -3895 0 obj << +3990 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 245.062 539.579 254.084] +/Rect [521.223 394.103 539.579 403.126] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.7) >> +/A << /S /GoTo /D (subsection.32.2.4) >> >> endobj -3896 0 obj << +3991 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 231.512 539.579 240.535] +/Rect [521.223 380.554 539.579 389.576] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.8) >> +/A << /S /GoTo /D (section.32.3) >> >> endobj -3897 0 obj << +3992 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 217.963 539.579 226.986] +/Rect [521.223 367.004 539.579 376.027] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.9) >> +/A << /S /GoTo /D (subsection.32.3.1) >> >> endobj -3898 0 obj << +3993 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 204.414 539.579 213.437] +/Rect [521.223 353.455 539.579 362.478] /Subtype /Link -/A << /S /GoTo /D (subsection.32.1.10) >> +/A << /S /GoTo /D (subsection.32.3.2) >> >> endobj -3899 0 obj << +3994 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 339.906 539.579 348.929] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.3.3) >> +>> endobj +3995 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 326.357 539.579 335.38] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.3.4) >> +>> endobj +3996 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 312.808 539.579 321.83] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.3.5) >> +>> endobj +3997 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 299.258 539.579 308.281] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.3.6) >> +>> endobj +3998 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 285.709 539.579 294.732] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.3.7) >> +>> endobj +3999 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 272.16 539.579 281.183] +/Subtype /Link +/A << /S /GoTo /D (subsection.32.3.8) >> +>> endobj +4000 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [517.86 165.921 539.579 176.216] +/Rect [517.86 233.667 539.579 243.962] /Subtype /Link /A << /S /GoTo /D (part.5) >> >> endobj -3900 0 obj << +4001 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 141.463 539.579 151.031] +/Rect [519.586 209.209 539.579 218.777] /Subtype /Link /A << /S /GoTo /D (chapter.33) >> >> endobj -3901 0 obj << +4002 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 127.913 539.579 136.936] +/Rect [521.223 195.659 539.579 204.682] /Subtype /Link /A << /S /GoTo /D (section.33.1) >> >> endobj -3902 0 obj << +4003 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 114.364 539.579 123.387] +/Rect [521.223 182.11 539.579 191.133] /Subtype /Link /A << /S /GoTo /D (section.33.2) >> >> endobj -3903 0 obj << +4004 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 100.815 539.579 109.838] +/Rect [521.223 168.561 539.579 177.584] /Subtype /Link /A << /S /GoTo /D (section.33.3) >> >> endobj -3858 0 obj << -/D [3856 0 R /XYZ 85.039 786.531 null] ->> endobj -3855 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3906 0 obj << -/Length 2999 -/Filter /FlateDecode ->> -stream -xÚíœKsÛ8ÇïþºE:ˆKBy&r1:½ð×yÆžÿ9~²ZNp9îjó±žüuúÛѯ§þÂQÓˆuÙGþ•Îe~;Ê3"ÊÑ'ù=Ï£Åe$c”ØãùÑÉÑüµÌotdjíº JŠ •£)ɳ²¤;‹ e4'òNË8-üâ|ÇÚ2êN Í&SAÇÇËÉ«ù¿¬ùïòr2%¼WËsóe½R?~lÜkyT-Î*st=!hܪk¬ÎT¹zÑ3ÃÒÀ%E]4?µ—#óåMtG®4|GÛ×T·Dî5MÊí¦ûV¶:Lq†ð-8©¢˜û.!uÉIQPœåRQke$íŒ)?mªË¥4Ðj­ŒÕ)SÏÔ7yHw+Y¬¯æò˜‹r,kQ!ÔËóþôÛE¾aõ¯»tœa$¼M{â djM£j}½¶¯}Bý.ô8qeá†ætT`YšŠŠB…p>~ZŸÝH<.—þ™$dü©é®Ì·“j¡<”~ -åaÓ­kUZ=“iÉÅÃÃÝ5·æIÕ;¿0úøærpí3jkŸµO°kÛ×4fãCf‹®õ5kŸLÈ¢Å-kŸ¬”¢¥3—[û|a–Ó[ÁLåW½Ê13 ¡zJ”÷/>ýþ¡3oâCU~cé šú]öË`Þ.K á˜Á~t^Öme'oz˜¾ìP„@ÙkÓTPB5”H/”~P †=(Lº"êAqÓ¸°Z®æyýQù?“ƒ2ÌìÃŒ5o*3¡ÀL$ÄL¿ 3PÞŠ2戡›ÃQÝ*¯RR´›©[=Dµ -^<ÐÑ¢ ›ÊŠ«â£¨äd»q€’á&=#¸ÈCŽf)9ÖtÕL­¯^ÅŸ‹*ãr37 -¥eM^˯­™íÌêµÝé-6¨:(¬S‰Õ&"(*©èwàjØ“d‘cG·d¼VdTÝL}\)mË‚ÿØ.à‡$Æ7•˜P &"¦ß…%Ê -ÌFSY‡ -2Rò¬”áæ”Lw%ŽÛäŒE!¥+£úöîEfvúŽ¯í–/Éǵʼ‘îF:Ïu?¢D¥l«EMAf³¥ážm_Ó˜M ™-ºQÌvA<#\±¹%«‰²ý³]º-¢Qnôç22Ïõ’Žt·ÚYËÏÙja–õŒeçµ9­)Ê£ÜCö‰Û¡þn]QÛçƒ6f»w9Ó‚vJ…”á–9’Z3ñÜíÇ3 û±K j':÷K ˆgfê¤N®W7­ çíòØ̆ùæccSUž¼;‘Èçø`ü˜3_¢‹ª û±X’°I 6ì6¥)Ž6)y”›tëRŽü§OQpÖKEï±-+!¶EÁ†=(ÚåQú’~¢Õ£}¬1˜éØ{½Þ\Q_[·Qe:Â’“ä"'§;ºÓkT Ð=2?¤;JØbvÛáD¨-¶MÝC¾‚Ó<%>ª`É -drTê39SÎÙý—ÙY$Qæ¨Ú°Ì±µ™wtaXf°a/sm’z™ñž2Ï>ª0—êÐqR/÷Ø )^&lˆ‚ »y)¢ QîÞ7ç}aÑã*LæôO›ÈúÔJÍZ;˜ó~Þ×®¿,g¦z¥–IÎí{§ó^Ñ>És¶J Øcû3Öb4@qûögjØÀxÆsîp êï&¥Z -mTöÌ—xIkköÿÈú×òàÙë_].«NÓ a ¸8´Å gºTB5€‡HŠs’wtàjØó@I–³Âñà–Ëßè„—ó…Ø®.ëhy¡ãASði}Ö¨ÌXž:¸»öžS… Õ!#{BBö» 5ì…̱ü[Bâï(ä[ ŸW*‹NÐ不½õT=C5@ÏȬf.îè 'Ô°—qYf¥Ÿ¦¹ýÉå1«¶–×v¦¦ß*sYçöËR¿dÿ\’­Áµ†¹ˆä°è·?LÔª‹qÁ2‚P ÂÅ»¸¸Ð›Ñ s Ÿüº;Ïf«å…z¤8Шݙ(UóP =2?¤z¿ €ìPÃ^wéä éî–aç.£¥kBÔ/ÒpÒYH—ßv±Ëolrse½·œWµžÉ©•ü‚ß­IRuÕ#sS<˜¹´£ _•›ŒeY­ÌîÚùte4 …Ùú|=1‰Éù¸íª3ó¢B§¿ mpF-í³Ã vlûšÆhƒi<ѵ¾f“«Lãß2†b’îE¡Âor>ýöI×ÆViIŸ5lêê_$ÄQ¿ €“…ö´ÈS8gŽ·4zòäßöe²W/$6EIÙƒkÌTBB5€H(ˆ~B †!HðŒ3îñÉÈŒ³rGZœai‰ª Ó‹в£ ô€ {ZJ’¡ÜÓâVV·ÃdéY^6:Áâæ³ ¤ýz{[é?ÐM_è¼ ù¯(ų`Í–ÊB¨°IBñ`®ÛŽ.,@ {¸È˜[e/Bº±vÝ'ðC2cÍ›ÊL¨0I1ÓïÀ Ô° úãYž—ì×nÜ"ÉÌRAž{mêÞÈ­ì¢Ï±ÁYäP³¯œ±R Õ"! ú]€ö^ƒb5 -G€KE?Ñœ¯jÆ3F¼Æ]™±æMe&T˜‰¤ƒ˜éw`jØ{ \fdœÓxi_KQþâ½Oðh×­ûCfýh¹ó*#ô°37­ÉR1ðµ -‚½ö€V=ˆe„Übáïjš)ÆgM”Šãþ6MìSÔÒ P;úø§HܵæJ•ß×äBP2˜äÕoxa¬™À;_ë—ÿ÷§ïþ÷iÃK³r0+YRUБz»’˜?`gÌŠzü?%©vŸendstream -endobj -3905 0 obj << -/Type /Page -/Contents 3906 0 R -/Resources 3904 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3701 0 R -/Annots [ 3908 0 R 3909 0 R 3910 0 R 3911 0 R 3912 0 R 3913 0 R 3914 0 R 3915 0 R 3916 0 R 3917 0 R 3918 0 R 3919 0 R 3920 0 R 3921 0 R 3922 0 R 3923 0 R 3924 0 R 3925 0 R 3926 0 R 3927 0 R 3928 0 R 3929 0 R 3930 0 R 3931 0 R 3932 0 R 3933 0 R 3934 0 R 3935 0 R 3936 0 R 3937 0 R 3938 0 R 3939 0 R 3940 0 R 3941 0 R 3942 0 R 3943 0 R 3944 0 R 3945 0 R 3946 0 R 3947 0 R 3948 0 R 3949 0 R 3950 0 R 3951 0 R ] ->> endobj -3908 0 obj << +4005 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 754.651 539.579 764.219] +/Rect [519.586 144.103 539.579 153.671] /Subtype /Link /A << /S /GoTo /D (chapter.34) >> >> endobj -3909 0 obj << +4006 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 741.102 539.579 750.125] +/Rect [521.223 130.553 539.579 139.576] /Subtype /Link /A << /S /GoTo /D (section.34.1) >> >> endobj -3910 0 obj << +4007 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 727.553 539.579 736.575] +/Rect [521.223 117.004 539.579 126.027] /Subtype /Link /A << /S /GoTo /D (subsection.34.1.1) >> >> endobj -3911 0 obj << +4008 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 714.003 539.579 723.026] +/Rect [521.223 103.455 539.579 112.478] /Subtype /Link /A << /S /GoTo /D (subsection.34.1.2) >> >> endobj -3912 0 obj << +4009 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 700.454 539.579 709.477] +/Rect [521.223 89.906 539.579 98.929] /Subtype /Link /A << /S /GoTo /D (subsection.34.1.3) >> >> endobj -3913 0 obj << +4010 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 686.905 539.579 695.928] +/Rect [521.223 76.357 539.579 85.379] /Subtype /Link /A << /S /GoTo /D (subsection.34.1.4) >> >> endobj -3914 0 obj << +4011 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 673.356 539.579 682.379] +/Rect [521.223 62.807 539.579 71.83] /Subtype /Link /A << /S /GoTo /D (subsubsection.34.1.4.1) >> >> endobj -3915 0 obj << +3964 0 obj << +/D [3962 0 R /XYZ 85.039 786.531 null] +>> endobj +3961 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4014 0 obj << +/Length 2087 +/Filter /FlateDecode +>> +stream +xÚí\YSÛH~÷¯ðÛÊšSš}ãHÀ),&ÉV%yF€*Æ"²œ„¿ÝsÈ2˜ÃØìUQ…¿éãëéiðGš‘ð¦ša$}ÁH³wÕšpe·AìA“ûxi뤱ñ^È& |¨æɹ¾åäì«· Z4òŠÄl†­ï'ïN*´¹Ï%ÃV~6¾~šgðCÏTÔü ûO”j^5¸`¾àÌ÷ÝÆ?e+æoš§¦¼k›…¡O"Ø~ñò‰˜òÎŒûÄç~‹xÔoµy¤¼Î`XÄý~ +§­6cÌû˜´ÚÄ+°W¿ñ_–ÿ0 ÇÄK‹,7Çp¨·_R<–é'†xŽ{êÏÆœ„¦!ü˜‚{7\©û®Ý*“ÐK"aÿŽ(ò‹¦Ù9Þ}@œ¨Ûmé3É'›¼#eÎŒ” ¡•2Š—rî}jažƒ(F}#­OÇû #¥ÄLrxðÚë>>_Ó·Ààt5fàݤ(ôð¿0ã}œö«§öQ¹†F§ôØÓc¢g¯[mÉEëÛÁ•[\÷Œ53™À6;‡ßÂìµKcæ4ø€Tï8ûížÖý! ª¢ÑÛˆ²eh­´!¤qÑÃÍe‚:Ê·­€5Úmâ‡T4Û,ò¹bSqJàÝÔ-A| +_yƒÏì±Þæ5j%’‰ÀKgx€„ÿO2…F0h9z”FÜù-NùÞ*è‡|œJ0*¢ÈcóÐ)ièðeèÿoá´Uƒívve’F$}¤ÉRz]<ã¥ÓxTK":D(ðµÑ¤×‚i +*ˤàdd2柕ً.¾c2}©›¡³Ë­‘¼ hîfµn³öÌÉXÏ›΋kÌR…kˆÈ—§š²L~nEÌKò¹7Õ‰Å[‘å_¤#8Ø=² bÜ}1ˆ %@I¥¬Iärqt‰¾­‘ž<«BXÕ¿­t£R¥¥Æ‰¨Î<Üp)Ñ%/Ù²] +ÌÖ +ýcÈ“ %ü+i§\–‡ÄNš›ñžµÈòÛ*ó5Wh4Ë œ`f«EFËQ46ã(rJ­Sqi%}œüD©¦yb½—IðéŒí–^|‘XûzîêŸv’Sl |^›Aô†#ù¥-ž*lúBÂ>v÷îÅ…«®Ðô|ô§Õ–òµ%¬–8ž™±¶ÝwN(i' ¡F(TBu¢Dƒâ ÐF«,blÓh=‚kµ ×î&xºÚ¼¸Ïµ­@‹m‡q<°;øÈäåˆÕN}Á°ÎèÔEéÔ§!‹xŽÎ´Ú%Å™ßËçÐï0¬ó|·@cÁ’@sy¾Í¾›N/ÒqÑÄßÐknXS1(3<Ö°_›7::œ˜Ý‰±ÄÌ/ ùE^¹6/4“IG-S˜xyŸššÊo7]ÄèkUæ…åtÑÞѧL¢V‚ß­—'aôå„°L¿u·mõÿÇ@F¬FwõÑ- õ4¨µ/i¶ ¤]ÏP'PÇD¹a¢J¯IÍ®^ÂüÅçIÂq©žÖdBV ¯î™ÙBX¥x&¥5Û¤AÒ²—yÇ:=[F°yéîÄ3ŠÕE/ ­O@Ï•av³¾æç).³¬V×å««XŠºÊR]÷m1´Îk–Ù«ë\/Ù3|ÿVR“‹ºëµñsÉ™/&X:M+¥n%yUõ*rœ¥uÝ‹ ¸°¬Md²6ÝøJ׎ÈÐ&·aç°¸Lr[ Üyßµ{X œ–.·XàzK&gÎê&tž2º£2¡s÷̤T‘ íÌîv?Û!PZ»œ¹]ÎÊ6¢2usˆ cj‹ØJ0aćõªÙ7 óLž qp ¾„ã´À(¯N\v7¨ýÔI+âàŸ®­ngz­–­Ï°®,Ÿò óte}ŒÃà Äʸ—eÁ@…Á:ص5qÃ4Ø9šì¼*÷ˆ°µwû ¨oO€…YXôBÄÔ-Vµ0¹_sÇ櫃~æ³Y}î ƒ;¦ãs)kdfôO.ù<íëKeÕŒ¶Wø'P¦<]ÛõÄaýÍ™§!-Åö±1¹‹¤ú© “m<ÀŠÞŽ+é-\MQ0[‰À¼ƒ´—gÃì èÚ›¿eAãÜÒNÒ·F+Ëzük­t6Sø>í»ªµM4{…¾=/‹±”®'ÔëTôÚ~k$5È—º”k´”"5PãIw!¼ç3}cçø§¾dâi#bÊB\sÏDgþ¼´ºendstream +endobj +4013 0 obj << +/Type /Page +/Contents 4014 0 R +/Resources 4012 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 3803 0 R +/Annots [ 4016 0 R 4017 0 R 4018 0 R 4019 0 R 4020 0 R 4021 0 R 4022 0 R 4023 0 R 4024 0 R 4025 0 R 4026 0 R 4027 0 R 4028 0 R 4029 0 R 4030 0 R 4031 0 R 4032 0 R 4033 0 R 4034 0 R 4035 0 R 4036 0 R 4037 0 R 4038 0 R 4039 0 R 4040 0 R 4041 0 R 4042 0 R 4043 0 R 4044 0 R 4045 0 R 4046 0 R 4047 0 R 4048 0 R 4049 0 R 4050 0 R 4051 0 R 4052 0 R 4053 0 R 4054 0 R 4055 0 R 4056 0 R 4057 0 R 4058 0 R 4059 0 R 4060 0 R 4061 0 R 4062 0 R ] +>> endobj +4016 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 659.807 539.579 668.829] +/Rect [521.223 754.651 539.579 763.674] /Subtype /Link /A << /S /GoTo /D (subsubsection.34.1.4.2) >> >> endobj -3916 0 obj << +4017 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 646.257 539.579 655.28] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link /A << /S /GoTo /D (section.34.2) >> >> endobj -3917 0 obj << +4018 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 632.708 539.579 641.731] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link /A << /S /GoTo /D (section.34.3) >> >> endobj -3918 0 obj << +4019 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 619.159 539.579 628.182] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link /A << /S /GoTo /D (section.34.4) >> >> endobj -3919 0 obj << +4020 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 594.701 539.579 604.269] +/Rect [519.586 689.545 539.579 699.113] /Subtype /Link /A << /S /GoTo /D (chapter.35) >> >> endobj -3920 0 obj << +4021 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 581.151 539.579 590.174] +/Rect [521.223 675.996 539.579 685.019] /Subtype /Link /A << /S /GoTo /D (section.35.1) >> >> endobj -3921 0 obj << +4022 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 567.602 539.579 576.625] +/Rect [521.223 662.447 539.579 671.469] /Subtype /Link /A << /S /GoTo /D (section.35.2) >> >> endobj -3922 0 obj << +4023 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 554.053 539.579 563.076] +/Rect [521.223 648.897 539.579 657.92] /Subtype /Link /A << /S /GoTo /D (section.35.3) >> >> endobj -3923 0 obj << +4024 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 540.504 539.579 549.527] +/Rect [521.223 635.348 539.579 644.371] /Subtype /Link /A << /S /GoTo /D (section.35.4) >> >> endobj -3924 0 obj << +4025 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 526.955 539.579 535.978] +/Rect [521.223 621.799 539.579 630.822] /Subtype /Link /A << /S /GoTo /D (section.35.5) >> >> endobj -3925 0 obj << +4026 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 513.406 539.579 522.428] +/Rect [521.223 608.25 539.579 617.273] /Subtype /Link /A << /S /GoTo /D (section.35.6) >> >> endobj -3926 0 obj << +4027 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [517.86 474.912 539.579 485.207] +/Rect [517.86 569.757 539.579 580.051] /Subtype /Link /A << /S /GoTo /D (part.6) >> >> endobj -3927 0 obj << +4028 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 450.454 539.579 460.022] +/Rect [519.586 545.298 539.579 554.867] /Subtype /Link /A << /S /GoTo /D (chapter.36) >> >> endobj -3928 0 obj << +4029 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 436.905 539.579 445.928] +/Rect [521.223 531.749 539.579 540.772] /Subtype /Link /A << /S /GoTo /D (section.36.1) >> >> endobj -3929 0 obj << +4030 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 423.356 539.579 432.378] +/Rect [521.223 518.2 539.579 527.223] /Subtype /Link /A << /S /GoTo /D (subsection.36.1.1) >> >> endobj -3930 0 obj << +4031 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 409.806 539.579 418.829] +/Rect [521.223 504.651 539.579 513.674] /Subtype /Link /A << /S /GoTo /D (subsection.36.1.2) >> >> endobj -3931 0 obj << +4032 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 396.257 539.579 405.28] +/Rect [521.223 491.102 539.579 500.124] /Subtype /Link /A << /S /GoTo /D (subsubsection.36.1.2.1) >> >> endobj -3932 0 obj << +4033 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 382.708 539.579 391.731] +/Rect [521.223 477.552 539.579 486.575] /Subtype /Link /A << /S /GoTo /D (subsubsection.36.1.2.2) >> >> endobj -3933 0 obj << +4034 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 369.159 539.579 378.182] +/Rect [521.223 464.003 539.579 473.026] /Subtype /Link /A << /S /GoTo /D (section.36.2) >> >> endobj -3934 0 obj << +4035 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 355.61 539.579 364.632] +/Rect [521.223 450.454 539.579 459.477] /Subtype /Link /A << /S /GoTo /D (section.36.3) >> >> endobj -3935 0 obj << +4036 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 342.06 539.579 351.083] +/Rect [521.223 436.905 539.579 445.928] /Subtype /Link /A << /S /GoTo /D (section.36.4) >> >> endobj -3936 0 obj << +4037 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 328.511 539.579 337.534] +/Rect [521.223 423.356 539.579 432.378] /Subtype /Link /A << /S /GoTo /D (subsection.36.4.1) >> >> endobj -3937 0 obj << +4038 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 314.962 539.579 323.985] +/Rect [521.223 409.806 539.579 418.829] /Subtype /Link /A << /S /GoTo /D (subsubsection.36.4.1.1) >> >> endobj -3938 0 obj << +4039 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 301.413 539.579 310.436] +/Rect [521.223 396.257 539.579 405.28] /Subtype /Link /A << /S /GoTo /D (subsubsection.36.4.1.2) >> >> endobj -3939 0 obj << +4040 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [521.223 382.708 539.579 391.731] +/Subtype /Link +/A << /S /GoTo /D (subsubsection.36.4.1.3) >> +>> endobj +4041 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 287.864 539.579 296.886] +/Rect [521.223 369.159 539.579 378.182] /Subtype /Link /A << /S /GoTo /D (section.36.5) >> >> endobj -3940 0 obj << +4042 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 274.314 539.579 283.337] +/Rect [521.223 355.61 539.579 364.632] /Subtype /Link /A << /S /GoTo /D (subsection.36.5.1) >> >> endobj -3941 0 obj << +4043 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 260.765 539.579 269.788] +/Rect [521.223 342.06 539.579 351.083] /Subtype /Link /A << /S /GoTo /D (subsection.36.5.2) >> >> endobj -3942 0 obj << +4044 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 236.307 539.579 245.875] +/Rect [519.586 317.602 539.579 327.17] /Subtype /Link /A << /S /GoTo /D (chapter.37) >> >> endobj -3943 0 obj << +4045 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 222.758 539.579 231.781] +/Rect [521.223 304.053 539.579 313.076] /Subtype /Link /A << /S /GoTo /D (section.37.1) >> >> endobj -3944 0 obj << +4046 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 209.209 539.579 218.231] +/Rect [521.223 290.504 539.579 299.527] /Subtype /Link /A << /S /GoTo /D (section.37.2) >> >> endobj -3945 0 obj << +4047 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 195.659 539.579 204.682] +/Rect [521.223 276.955 539.579 285.977] /Subtype /Link /A << /S /GoTo /D (section.37.3) >> >> endobj -3946 0 obj << +4048 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 182.11 539.579 191.133] +/Rect [521.223 263.405 539.579 272.428] /Subtype /Link /A << /S /GoTo /D (section.37.4) >> >> endobj -3947 0 obj << +4049 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 168.561 539.579 177.584] +/Rect [521.223 249.856 539.579 258.879] /Subtype /Link /A << /S /GoTo /D (section.37.5) >> >> endobj -3948 0 obj << +4050 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 155.012 539.579 164.035] +/Rect [521.223 236.307 539.579 245.33] /Subtype /Link /A << /S /GoTo /D (subsection.37.5.1) >> >> endobj -3949 0 obj << +4051 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 141.463 539.579 150.485] +/Rect [521.223 222.758 539.579 231.781] /Subtype /Link /A << /S /GoTo /D (section.37.6) >> >> endobj -3950 0 obj << +4052 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 127.913 539.579 136.936] +/Rect [521.223 209.209 539.579 218.231] /Subtype /Link /A << /S /GoTo /D (subsection.37.6.1) >> >> endobj -3951 0 obj << +4053 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 114.364 539.579 123.387] +/Rect [521.223 195.659 539.579 204.682] /Subtype /Link /A << /S /GoTo /D (subsection.37.6.2) >> >> endobj -3907 0 obj << -/D [3905 0 R /XYZ 85.039 786.531 null] ->> endobj -3904 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -3954 0 obj << -/Length 2359 -/Filter /FlateDecode ->> -stream -xÚíœ[oÛ6Çßý)ô6˜Y^%òiÀÒulmÖdèC»ÅV\£¶•Éö:ìÓ/b,ó$j1ÌéŒ"°,óGçÿã*É°þG2)f*+dŽ#Ùl=ÂÙBÿòýˆ¸S—d¥ùözôì…È3‚‘Â*»¾ ù(Œ„ʳëùÛñE½™P9ÞUöc;ùýú§Ñw×!ã¨h˜ÉöÑÛßq6×.ü4ˆ)™}Ô×¥²õˆ †gîûjt5ú5äe㙵:öœˆÈlÊ0’’MB0A3ý¤B œáI)>ò¤.yR&Ñdªøøª\ß”“)Ë‹q¹™Û‹z÷¾jìåÅ2~qe¿ÌVKý­Úì&S2îÅFPGɲÈûS³ÈìÅëÈqŸvü0Oã9g¤W´~šƒ¢ûÁôá†9ð†ˆÈì‚S„µf.ŽDG’r>þ¥œ--7õö½Žc&b%³o&SI‹±N/0îp¥’¿="É¿hþyY÷@¡ˆÂØÓ#ŒµšFf}‰ó~˜¾ =4|Z¸àÀÕ©¹òlPÇÆ«+]s¨‚/ºÅ©i}’¨¸¨E¥3P‰ƒPé» LhŽ¸âY¡ïLL#ÂòÜô@ï0ᚖž1Íífa›’WWϨ½z3‘|\6wö›6ؘVÙ´/³½W7–´Wú‡ØŒi3}ËYr›¨ÜÚ¯¥ý:‹è4·omfll.×Ý~ݘ«É´À PL?ÜPµ¬  ” ¤Òýb…R…uL…Ž¢Ÿ*³ï°À›zwL4ýùú0‚è×þŠÅ²²1E9mtAžX›”(ö™†ê¬iºhqF“êôÊJõå²Ð·H's"]Ì]g\¹ÍÛ{š{mÜýmCsó£¹iTYÕå¼ßPÚ¦ü=¬-[ݹ„Ÿ@cé£2PæÈ,­sq@è#.¤• öýj^pÄõR3ׯ¾YÅæVÀ­Õ$(ÕÖúù`êjSïï&fÔ:•…ø?u>pCièÌ"Q8cIú.4@‡ŠŸë)‘¦"Ðà»ÏŸË]Õµ]C{}a¾\šû㥽å~ÖÍäÌ4˜\õ6­C½¶ý²œ5õ¶¾Õ™ðœØè+¥³ ÉP;3@ç(ÜÎ}¡‚ƒÎ¼@TðNgß ?¯V•×±²¢¡»¶Xùî–ðUåZ„Ò4仸Õ7mAÙ’°ýh(¨ü®Õo±xol•!€Ÿºô.JC¥ïÌé# éû.ÒCéCŽ¤g ÀÞܾyXÜ÷eÛa¬‚!çO¤~»x ¹3DŽb ‰Üw*8ˆL1"Bt"s/²Õ¯ -¢™aÚªíì¶N×·ÇÄ–Zì¹þ–çêéÍ«SÊ» U¾3”€”ï»(”Ç9ÒòÂ)ÿÛÖµçGºîÒµçóê¶Ü \/×vÞ»Z ¥n¾µY­»Åž¦Ü.2Cåî̹£¨Cr÷]ä† -ör ÅE'wîä¾Ò³dÝDWmçìÚèåÚTê¦Ôwóµue'hTµ gª8±ñ÷¿CƒÜ@"³4 ±(œñ G\HÓì's¢PHà°€ÎÉÜWJ<ûJI=·¦ô¼(z Å¡htf‘B}4 ‚CC‘ ¤D„97£Án( @C$ -DC߀¨àÐPª?ÃnŠ -Š1v+¡UóçræF—&™éK?Ó§:L}áMƒ‹ÛP:3†H†¾ PÁZ†c°ðòÚ~ê)#=PâÜwÜÄÆr(Á -À£S‰3‘¤£W~òôåˆ Ÿ~D'Â<ýàÓ´ü¨Þé‡Ë ÓóÍ涞èiC³.7m ¢;žë‰"ãýf¹Y¤N£rÕ¨DfiTbÅTŽ¸F,8 R0Tøu}vó^·#w»ûJíFÍòïê”·ìN’Ü¡Ätf1‘pºƒNÓw *8“cD±ðÄðpæÎ…øk½Ü™ž:ƒòxP\L‡‚Ò™ DzA ô]@ - ðå"÷ ø)ãϵÛ%²û†vµÀìRqÚÊŸ$8.ÆCÁéÌp"ý pú.à@pCœühŸÔ”î¨ø Ìãq± -LgéÓw*8Ctó"0…_0§ŽšåÎ-@5í<=öÕÐäLž¡y<4.¾C¡éÌh"í8“Ihú.Ð@hpŽ°ßúPHúIÒÊCl11ݔfb$žâFöÀŠ ëPV:3€•H2ˆ•¾ +PÁž¦(âByV”_p98¡½ÛoÚÓ®z€SqÆÀÄGt &‘Y“X-“#.¤1 ˜)–å0šP‘ÛóàrÜ.o¶ÇdÚݳöœ=Öì—8uewÑnVþHº;iÎÜì«øP\{xj±ô'®ìrN³1i!NPn™¡j+@ì.æÖ½ò©RƒÒ¹@,ï¤&VꋺiÌq˜;ß ánìõ‹¥=©ä¹)¸Ï†‹åP8:3€ŽH'¾ ð.ˆ‚wA7žÀ» >M붻 Ï_šJuðèóÌÝ‹‰9ƒeßµ/û¦4«¶öæ÷ûå¼JmŒD=fcôÿ0Ïö8NƶËës6F˜Î®xhc„Ñ1¿âŽÃÆÈËÚÌ„TO©®dUuñZU;3 ªÆÚ8õ]ø¬ K†)’JÀUÕ¥i]#¶ª¾0»“û¦{Aûuµ­÷ͬJ¾Ž•ô¨:9v˜§ Zòe¼(¯O|ûЛ£ÕJ…Ï}œH<o‡37öÅ=Fn_a’ŸëàÐ:èƒ<°Ffé:xOÀ4NG\H§À‚9…@… -äÐ{K~f4\îâãf{ûî¬óÎíoþ…³Ô»CD}©4¸À ¥¡3hˆEáÉW ¸tôº[f9;ÖÖè?æßÕþôÿÌ#´X\âeòµ¹åϘ@œÙ.‡&OȸD‘Çÿ™³ßendstream -endobj -3953 0 obj << -/Type /Page -/Contents 3954 0 R -/Resources 3952 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3990 0 R -/Annots [ 3956 0 R 3957 0 R 3958 0 R 3959 0 R 3960 0 R 3961 0 R 3962 0 R 3963 0 R 3964 0 R 3965 0 R 3966 0 R 3967 0 R 3968 0 R 3969 0 R 3970 0 R 3971 0 R 3972 0 R 3973 0 R 3974 0 R 3975 0 R 3976 0 R 3977 0 R 3978 0 R 3979 0 R 3980 0 R 3981 0 R 3982 0 R 3983 0 R 3984 0 R 3985 0 R 3986 0 R 3987 0 R 3988 0 R 3989 0 R ] ->> endobj -3956 0 obj << +4054 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 754.651 539.579 764.219] +/Rect [519.586 171.201 539.579 180.769] /Subtype /Link /A << /S /GoTo /D (chapter.38) >> >> endobj -3957 0 obj << +4055 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 741.102 539.579 750.125] +/Rect [521.223 157.652 539.579 166.675] /Subtype /Link /A << /S /GoTo /D (section.38.1) >> >> endobj -3958 0 obj << +4056 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 727.553 539.579 736.575] +/Rect [521.223 144.103 539.579 153.125] /Subtype /Link /A << /S /GoTo /D (section.38.2) >> >> endobj -3959 0 obj << +4057 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 714.003 539.579 723.026] +/Rect [521.223 130.553 539.579 139.576] /Subtype /Link /A << /S /GoTo /D (subsection.38.2.1) >> >> endobj -3960 0 obj << +4058 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 700.454 539.579 709.477] +/Rect [521.223 117.004 539.579 126.027] /Subtype /Link /A << /S /GoTo /D (subsection.38.2.2) >> >> endobj -3961 0 obj << +4059 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 686.905 539.579 695.928] +/Rect [521.223 103.455 539.579 112.478] /Subtype /Link /A << /S /GoTo /D (subsection.38.2.3) >> >> endobj -3962 0 obj << +4060 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 673.356 539.579 682.379] +/Rect [521.223 89.906 539.579 98.929] /Subtype /Link /A << /S /GoTo /D (section.38.3) >> >> endobj -3963 0 obj << +4061 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 659.807 539.579 668.829] +/Rect [521.223 76.357 539.579 85.379] /Subtype /Link /A << /S /GoTo /D (subsection.38.3.1) >> >> endobj -3964 0 obj << +4062 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 646.257 539.579 655.28] +/Rect [521.223 62.807 539.579 71.83] /Subtype /Link /A << /S /GoTo /D (subsection.38.3.2) >> >> endobj -3965 0 obj << +4015 0 obj << +/D [4013 0 R /XYZ 85.039 786.531 null] +>> endobj +4012 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4065 0 obj << +/Length 1192 +/Filter /FlateDecode +>> +stream +xÚíšKsÛ6€ïú<’1x¸V®¤ŽëZê´3i´D+K‚K‰vÚ_ß]Lý -Çoi8š ‚Ä~ØvøÑHË”peZ¥’Óh<ï‘h +’½ %H$R¢$Š~õÞíJQ’b¢Ñ‰+2š|Žv‘0¯ +X&_F{?.UÒ©Pkù»÷ù ‰&ð¢=’r££ 8')5&š÷„ä©<\ÏzÃÞoßkñ2ù§Z¾µ/(K‰6QŸ“Tkñý£©lùh®S¿¤Ï•ÂüE¨Hh<­«‹)8ÿ(p5±Ø°‹%Þñ‰­‚0Ñ"¶Õé´‚2¶>[úÛ‡X8‡ //ðÜV/yŸ/&Ptæ*…7(ªbøIÈ­aÌm²kZæF¦“p~C7Õ4ò'G{whDp}½NªR®ÄÕ*oW;E@æjAíASNUW55È—…×ö°X,ËUy+WXæh?ÍÖèæÁ²g|s©É@í÷Íh€àÌ»‡ž[ld§8ÉëHVþ Uve“>Ëâ1>fg “u¬ž…• +¬†gNãE*¶õa~æV‚s´¨bîÄÞ{'}Cù“ëzË0š‡aäYJµ§(×BD'É„h‚Œ|gôÆèÿåÐ +#?U¯€ö-T¤´³Ð·m¡÷ (ï0QFñ4‡Eu^Ž‹f Ä)ÏÿO½˜¸éìñ5Aª;@ŒübS˜´ÙyÛ'¢+È£è2+e{,x¹÷Œ´¡7Ð6AF>?ÎÑg` œÆEubNâjž/œå‚£%†Æõ¢„Ððº¸ô‘)¾ì–ö·¾^z£ýºMØæþöYJk+šÜ§4L¯éóÆ @ØçvŽcËôî¼*—výÞpµA£ÇFõxúüþ̤,°6üº‰DˆÇ~EÜ«Ò¢»ÞãèMÍè#7?ÌÝü‘ÅÃò_¸Î¨x£¨¶Œ4{ ÒM8ø)ÿæçÎK0f‘eä­Üû6äŸ÷]ûp&-eG{3h˵°U«ï>r.Áæu¼·Çº³&ÊÄu£ª\…”ÀQC›™nÀ~Úü%hëf>kRyÁ§Ûi‰A–T¦ã¼ùœMGÏÊ¢IÐ"æQ¢y\c€…)ƒvWÞaÞÌp3aRaª!»tQ³Øé"LØ»DJŽÈÝgŠTöWý‹yX­“ 1®ˆºõn,ÿS0‹i³;åûn3¾£Óþ_Šjះ*1S£·šÌúi¥ÌÀVjö,Øß +·ZûóÝrV`:×èÎêÞÛG§nñ©Û´„¡OÞâþw²óïÜžàn„>ÓºÊ]ÚËÝÜ«ËIñ„Ù\ù°l.}l6tÑds,N+¥6›Ôµ·Ì2ä+[õ–±‹+uµúZT¾»K[Wãbù„]^ýp—'wööõ.šG/Rn$<öylÜ#æ½]Á¯ž}ÔÙ•| FUùêò® 7øCO¼¬Ù¯éöR„Éקr\Ù¥=ÁÔ)5Éë$³‡‘l†3®XʉjßJü?çGì,U\Þ¯Ó°›žØ—¹Òšÿ†Åã=endstream +endobj +4064 0 obj << +/Type /Page +/Contents 4065 0 R +/Resources 4063 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4092 0 R +/Annots [ 4067 0 R 4068 0 R 4069 0 R 4070 0 R 4071 0 R 4072 0 R 4073 0 R 4074 0 R 4075 0 R 4076 0 R 4077 0 R 4078 0 R 4079 0 R 4080 0 R 4081 0 R 4082 0 R 4083 0 R 4084 0 R 4085 0 R 4086 0 R 4087 0 R 4088 0 R 4089 0 R 4090 0 R 4091 0 R ] +>> endobj +4067 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 632.708 539.579 641.731] +/Rect [521.223 754.651 539.579 763.674] /Subtype /Link /A << /S /GoTo /D (subsection.38.3.3) >> >> endobj -3966 0 obj << +4068 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 619.159 539.579 628.182] +/Rect [521.223 741.102 539.579 750.125] /Subtype /Link /A << /S /GoTo /D (subsection.38.3.4) >> >> endobj -3967 0 obj << +4069 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 605.61 539.579 614.633] +/Rect [521.223 727.553 539.579 736.575] /Subtype /Link /A << /S /GoTo /D (subsection.38.3.5) >> >> endobj -3968 0 obj << +4070 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 592.061 539.579 601.083] +/Rect [521.223 714.003 539.579 723.026] /Subtype /Link /A << /S /GoTo /D (subsection.38.3.6) >> >> endobj -3969 0 obj << +4071 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 578.511 539.579 587.534] +/Rect [521.223 700.454 539.579 709.477] /Subtype /Link /A << /S /GoTo /D (section.38.4) >> >> endobj -3970 0 obj << +4072 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 564.962 539.579 573.985] +/Rect [521.223 686.905 539.579 695.928] /Subtype /Link /A << /S /GoTo /D (subsection.38.4.1) >> >> endobj -3971 0 obj << +4073 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 551.413 539.579 560.436] +/Rect [521.223 673.356 539.579 682.379] /Subtype /Link /A << /S /GoTo /D (section.38.5) >> >> endobj -3972 0 obj << +4074 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 537.864 539.579 546.887] +/Rect [521.223 659.807 539.579 668.829] /Subtype /Link /A << /S /GoTo /D (section.38.6) >> >> endobj -3973 0 obj << +4075 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 513.406 539.579 522.974] +/Rect [519.586 635.348 539.579 644.917] /Subtype /Link /A << /S /GoTo /D (chapter.39) >> >> endobj -3974 0 obj << +4076 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 499.856 539.579 508.879] +/Rect [521.223 621.799 539.579 630.822] /Subtype /Link /A << /S /GoTo /D (section.39.1) >> >> endobj -3975 0 obj << +4077 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 486.307 539.579 495.33] +/Rect [521.223 608.25 539.579 617.273] /Subtype /Link /A << /S /GoTo /D (section.39.2) >> >> endobj -3976 0 obj << +4078 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 472.758 539.579 481.781] +/Rect [521.223 594.701 539.579 603.724] /Subtype /Link /A << /S /GoTo /D (section.39.3) >> >> endobj -3977 0 obj << +4079 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 459.209 539.579 468.232] +/Rect [521.223 581.151 539.579 590.174] /Subtype /Link /A << /S /GoTo /D (section.39.4) >> >> endobj -3978 0 obj << +4080 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 445.66 539.579 454.682] +/Rect [521.223 567.602 539.579 576.625] /Subtype /Link /A << /S /GoTo /D (section.39.5) >> >> endobj -3979 0 obj << +4081 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 432.11 539.579 441.133] +/Rect [521.223 554.053 539.579 563.076] /Subtype /Link /A << /S /GoTo /D (section.39.6) >> >> endobj -3980 0 obj << +4082 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 418.561 539.579 427.584] +/Rect [521.223 540.504 539.579 549.527] /Subtype /Link /A << /S /GoTo /D (section.39.7) >> >> endobj -3981 0 obj << +4083 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 405.012 539.579 414.035] +/Rect [521.223 526.955 539.579 535.978] /Subtype /Link /A << /S /GoTo /D (section.39.8) >> >> endobj -3982 0 obj << +4084 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 391.463 539.579 400.486] +/Rect [521.223 513.406 539.579 522.428] /Subtype /Link /A << /S /GoTo /D (section.39.9) >> >> endobj -3983 0 obj << +4085 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 377.914 539.579 386.936] +/Rect [521.223 499.856 539.579 508.879] /Subtype /Link /A << /S /GoTo /D (section.39.10) >> >> endobj -3984 0 obj << +4086 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 364.364 539.579 373.387] +/Rect [521.223 486.307 539.579 495.33] /Subtype /Link /A << /S /GoTo /D (section.39.11) >> >> endobj -3985 0 obj << +4087 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 339.906 539.579 349.474] +/Rect [519.586 461.849 539.579 471.417] /Subtype /Link /A << /S /GoTo /D (chapter.40) >> >> endobj -3986 0 obj << +4088 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 326.357 539.579 335.38] +/Rect [521.223 448.3 539.579 457.322] /Subtype /Link /A << /S /GoTo /D (section.40.1) >> >> endobj -3987 0 obj << +4089 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [519.586 301.899 539.579 311.467] +/Rect [519.586 423.841 539.579 433.41] /Subtype /Link /A << /S /GoTo /D (chapter.41) >> >> endobj -3988 0 obj << +4090 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 288.349 539.579 297.372] +/Rect [521.223 410.292 539.579 419.315] /Subtype /Link /A << /S /GoTo /D (section.41.1) >> >> endobj -3989 0 obj << +4091 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [521.223 274.8 539.579 283.823] +/Rect [521.223 396.743 539.579 405.766] /Subtype /Link /A << /S /GoTo /D (section.41.2) >> >> endobj -3955 0 obj << -/D [3953 0 R /XYZ 85.039 786.531 null] +4066 0 obj << +/D [4064 0 R /XYZ 85.039 786.531 null] >> endobj -3952 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +4063 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3993 0 obj << -/Length 241 +4095 0 obj << +/Length 226 /Filter /FlateDecode >> stream -xÚuP±N1 Ýï+<&CLÇN²"•ªL Ùà Z„T®R¹ÿ U‡28ò{ÏïÙ¾=‚,è¹@ÊŠÂÏ׆lZQ%Æö_Ýêg,1¯’'1¡dîœÛ:ÜÜÁ£*C=@È„œHPL‘ ¾<šËdFËÞœgëX“ÙY2hŸêý·:bÊ©«]*¨Í"ÌÄ_âí~²ŽÌþ<»VÍnúhê¹7[‹ÌqœßZ9õÆÔg›úzÉ5aÑ°¶–onPBù‹þ»< F¾ìNä±øÒÓ³WdQX8=}ÐëDÒ.ܯwtíù 8Â` endstream +xÚmP;O1 ÞïWdL†?ò\‘ *C6Äp‚!•C*÷ÿ…s¥@«SGßÃög2¨L‰€RM. ¢yùм)³èG¢@ Aÿ+¤?³ž¥@ eMD5HQ B Ü%·m¸¹g4Š¤$¦íi{}²NÈŽNÐgç%e»udÁ=·‡“#@.¹;|®ª®P¡,æÍnržìî8º7Ùíô¥î¹ƒ +‘=Œó»–ÏL½çp×þÂü. ä\ײ Î†È쵊™@(Ÿn¶d¥h¡býŸ•Óõ +¬½™óå±ÏõN%Yâendstream endobj -3992 0 obj << +4094 0 obj << /Type /Page -/Contents 3993 0 R -/Resources 3991 0 R +/Contents 4095 0 R +/Resources 4093 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3990 0 R +/Parent 4092 0 R >> endobj -3994 0 obj << -/D [3992 0 R /XYZ 85.039 786.531 null] +4096 0 obj << +/D [4094 0 R /XYZ 85.039 786.531 null] >> endobj 6 0 obj << -/D [3992 0 R /XYZ 85.039 547.583 null] +/D [4094 0 R /XYZ 85.039 547.583 null] >> endobj -3991 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +4093 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3997 0 obj << -/Length 2820 +4099 0 obj << +/Length 2789 /Filter /FlateDecode >> stream -xÚkoÛ8ò{EP,PyQ+’(ùq÷áиÍnm4>t·-Ó².’è•èf½÷çw^”•Ø),r8œΛL|Á_|1ËÂHÍ/¦³I˜©ø"¯_E¬üô*Œ4Sa–¦0>³8ö«ãIFéô,ŽðO“4Lg)â\-_]^'ÑE…“‰ºXn¼ $JfËõ¿‚8³, -nFqиv4Ž;«(XïsWÚÆ“ià6™÷¸®kÀ]éÑ¿—õaÙ‹ðŒø÷„àqvGá<š…TY˜eSò?À]©àõ͆‡Q2 ìž'ûÄY›¶sºY3èq íp’öÈqð¦5¼¾¶%n*Þ¾ˆÑXǃÊè¶)Q9tƒØ‡,ʦáóšÉüÞ5 µdjR&’íá ª 41N¦a4gý߃6¨sœ¦³ ìø+Ó_£8­€€ÁéyÃQyiö$aC:ƒ [€C¨Ì`illË8_Iêõ­ 8ˆÓWºÃÒyU&,Òì;ÖÏ–ˆ»¸À%ŽnîXH [#‰U/Wu:¢‡ýzNzp-ŽäØ@CmÑ™ -v­u$ðDÊI©¨tÜhÜ4ŒµÑ¹C{fó ”„«e(£1vÏÈ‹Aq’‚ƒÇÁ§«Ëìgc’eÓ« -5„hG ‘Yð¹1¼b7Lµ·ë›ŽV¨ùs'ï\kšÂmQ}Ñœ= ŽXèÃì'9 {´8⢺ã6ËCäXŒ‰! ö {âÎßyŽ’ã÷+ÙhÍþ!ÂôŽëÙéöÇDIçÝÒfR™œÇÙ‚¦ìíPÿ±¤X²{8A2I‚Öü¶/[Ž.†hþ°îtKÁm¨N¤EØíò2‰¢Cî‡^8Œr£4‰‡qˆ¼J!NU2~uà•ym÷Aˆ½Ÿ ¶ÝñÖg¬¾§K!»b°OfAQÙ•®äŒdZZ!Ó âŠb€¬èxIEü= -ÊóžÍ­®É:üh=Ž‰YdТ#e£+ -S†~ÿLDåxŒ$>´Dë7=ž9õr4SñZ¦ªÂjH–$aœ%ß­!_èâ4TédPCÒyNç‰:*u ®Ä]ãà¡h-¦¨óR¤ó(Œ¢ïK1Ày±’¥YÎøüŸQE”–ÈLP^,:9Žta!}¥ó, pèý“S4×LÌ¥ØaT°Úÿñ™Ñ¶dŒi[Êã°îsîè˜ÌûÅÌÛ_:fðEÈëËm)´;¬œoùWÈs¤÷¥ÏÕŽ"uEù¢³/lÍy2°óÅ4çÁJ%ßÔÚ¦–œzù…(Õ)¦ID’¶’ÿ… PòÚ„…®ªŽ‡}ªò\,Ž:ß9”p¼~ŒÜÈ°âù¹Fk4èj©àÆ=Ý}zÞA8a–Ö¼ÖÇŒßIª*{ùóÃXHHmT™Þñ$#üeÑ­q\ÑÉйy6ØZtïË8²isÄ¥>†M—“zZÉXX{…ÂØ6|žÓ#·TgUÂ}´eÈ?Þßf)&Zœ}ÝÁtP {CP‡Å°¾PÑE|Ëßv/¤ì ×éS®Ëû8LÄU­g«eSézî˜T«5#s’•F0ÕiWr-•î Ö©Þcd-|³ 5´–*ŒÞJ{GÉ šañj:_Œ‹Æ¬¹ïXVué{JFZÀ]Kê±`ðyĈÜ0ÊO-UˆÐá”p íä$÷œ$ .Îuí3}hž4‰Íiá&{Mæ˜S.¿Üù㙡|B·Ê}³l€l‚MŒg†Øšó òJ «O^®I'j: ¸öoÉÈ€¶lx´Ó¾‹ƒÉIÄ\$È›-ðfTeÞ·xÝ@&‡)ñL£j8lH=•-èÛoQƒ)‘L¦‘„*¹Ï{•áóú†=™ÆO‡s8!q#_=iU:FÑôMH½÷O”Ž|¯©¼b²erh:ɧúÊ‚rÛä5·,×±µ{1—— GÛ¾Õ@Q¨yD½¯òM415Ý›všið‰Ý½Ó…¸â”HÆ"í>ÈÍÌʧP* ^Ëíî5§(\ÆûIqŠ )ñêæóýQs9’øóýüõô¼7 §ÎËÏTãvÒ{%jÜ:ÇCýfD“z=«yðzËA$ââr.)YòJYq"¡Œ€¦×<'µa‘Ž“àŸh^¼ô|P:LÔ4¸G#Z†&©Î^­ŽÒÓ­!³Ëû²÷ºÜæ¢E…—}CÁï=é„Þ{ÒK}*spA»q¼Tëöé8?!¶¡l ¸X É>å„ß rÝwkˆ}´¾G§G&W¶t3E¨nÎåë–”Ôøû´Š¦Çü/p*‚ðrRy6<×x)>ˆ îŃá -à¥iÆphÒê¥ɱ"¾¾";…d³õmoÁ1üÅqíL¶â~HLˆ0Cªáð͵“föŒy›ðÉ»Cï8^‰òŽ^9âãËU{oî|GA·¯Á žÐ•ß[Äú¸‡<¸,Jɶ4¯rzLiåÙ†â×r—Dí<å4ž´àÅóùÔoue^ Ø•®âfaÁ¯UyùöÅ‘•û¦éLî³a[ºÒÈûä5ÚNS(Ú}N®#=Á(_^g³Á÷ÙS¦ù 0ÃÎßD"ˆXœzup†ÞSX¸t‹ü—ø¼ÖRN·¹ÒMhQ¶å7ÓQï=B49þš:@{ÜÂÍeG,é×´ûËõ2ÀÂOI•¸cïÜ )št¼‰ø?G¼×õŠŸÎí±LÑc#]¾°šG@ã{Ï߇Ædæ÷ÛŒž<ÆL“Švæ-7ñ`X”W¥s|„h혴ùݱZsÇtxó†4bkž­à²I·Îž†èŠ—YIùÌ×hÚz×ñl«¿™³oT^=x³H&oëÞì+|ý øi,å‹‚^{!D¸[–t_l=•Áó^æužyß%5Ö”éÇõû=vç m옺edæ´-º#mÙÿ²aô¾TT…]Ë#lÍõ<§‚;*-·ã?â%DQß2¦k½‚Fº.»®Ï®°ºóêaþĪ Ãã‹õ×m)oúˆÅ‚.ÄÓ4ó–ü?¹ñÐueŠÿˆ`ב)·ß°éQ²¥ 9UÏ̆Â4|f»ïäA‚HRÈ9~d dç›~ºòR¹·r¨C–7‘2d¤]ðv¡:_éÝŽ•+[VÝZºË_¬ý(î–Ï(«ÜÏšp'N€Korò sx+Wx¾Ôã+‚œ„û™ƒ44ë½ì¡{á PeaªÔððÅ—À#êéC Ô°ºPO5šLŸ³ÌÔ,Ìfê;<ÿÚßö endstream +xÚ]oã¸ñ}EXù+’(YvûPlœÍ]ŠÝ$X»Ø+º} eÙR#‰®D'çëŸï|Q¶cçPˆÈáp†œï¡Ã‹þ‹qâjr‘ŽG~¢Â‹¬þ\¬aåç¡`ĉò“8†ñ™Å¡[Ž"?ˆÓs8ÁÅPý8áâÍüÃõ]\D?©‹ùŠæËz¡?&IàÝB¯±í`zf0T·Üf¶4 ŒG©g6y3\×5à.ôà_ó¿}øHOÜŽ—60lKâoÒå(a<÷ BeK©·2-ã|§ƒ.¨)ÀyEœn¸Ðr!Ue΄å4ÛŽEij9âNŸp£û'æ¡;>¤……"—Ī?Wµ:"‡-qBr°-]ŽÎ±€„<Ó¢ÔåmZcéÀC8RFV†2Aã FÞ}ÃX+YTa2ñJÙH¸ZÖ‰2*~ó†¼è'1iè}½¹žÒÅîp6¤ÓãÙô¢B !Ú^BtŠÄ{lr^1+¦ÚëõcÇ ”ü¹›w¶Í›µ-P|Á„- XŒh¶ìm'^ [Ô8â–€k÷Û ‘c•£’`›@÷¿ñOŽß藍%Û‡¦7½ï ƒ ·|>߇’Þ9–¼Ö;Œ?IÆ©*sýËÃø«(Õ|âIè<ø$ÁCn9E“= óm0µÈÞåedÓfˆKµ«.#ñ´4’¡°v…±iø>§Wn)qªˆ ¾hË¿ß> Æ1FNœ}/rÁ´ßsöŠ *‰a}f ,Šø†¿íVH®é1×ù”m&bªÆ±Õ²©´=wŒ’Õ’‘9jJ¹—è´-99J…ˆèT·èYS—ý%‰ÔOùÁ•Ôkx3LÀ_óÎe×u“/¹/Aui-[JBRÀ]s*š`ð8àŽÜ0ÊÏ-…üÐápõá(sœÄ .Îtí"}nŽª¾æ4“¾FŒ)×ßžÜåQÍÝ¿¢Ye.ˆVÀJ6ªÄ1ClÍqP¹Œ£ÓIV.I&*M=Næ)p@— 6Ú•e0ùS0q2ÁæŠ@Ë ¸Ñ{U™õ5[wp&‹!ñL噳Ûx*³Þ¡m_¡c"¥¸ +¹{UÎ÷ux”†G‚Ã9Ü‹¸2¯ŽjŽQ4}#ïìHèÈ÷Žò%[&‡: +ÑùTŸYBfš "£f†Ïµ¯ÕÞåeÃ^` iw )Ô<¢bV¹ª˜Çšfy{àš±÷•Í½Ók!qÃ!‘”EÒ}¾Š²Ã5 J%Þ¥th—¢pŽõ)&„Ä›ûÇÙþ çb$ñç†ìõô¾÷ ‡ÎëGÊq)¦"5öf»Î²ÆP¾ Ѥ…^Îjâ]ìDr\\Î$$K\)+dp¨# ê5ÏIl˜¤ÃÈûªËz"‚– +‡‘J½Ê!xÕÒÏ}9ÕÙ^iš£€}¦ß8(éZ¬7Dß,!š¨Ã2]ˆ[%#©(íÛ6ŒNñö°ú —ú¿h–õæØ4U¦é˜„nM—Ë@ÔãÎ6ï£iE}íMVm‰«dEÜ÷psïj£_OCžÙ+[Vp’{°BxúõŠG¯_šçÔ2&lÑAì=`ký@„¾PEô,æ( ¸ûfÎØŽ¯ðT‡J“¾¡óéÓõý“$BsÜ`ïøg4ü EßY-ŽÙðt+Kèì#]_!‹(•3ÎA§Á=?¥IŠ3ê’Ž8AMï>0_‘CÖŒJ‘€e½‘Ä K{»=¨N \Cùé%EÐ$áFÊî3Õ2‹!°Ü–½Õevø '-J¼¸ì + +~³‰Gôf°Ð×24+ËKµnŸI–ãbç-“!é ðû„A¡ûj ±÷ÚwèôPdË–ZM„êæ\¼nIHûg¨ ÝÇç`ß‘©ÜËJæYñ\ãe$ù .˜ŸD/Ž†Cy¸“R/†øK†p?ŠxlTä~Í–GÒ.À0\§ˆ¸ûò &…˜"Ìr8|3m¥˜=£ÞÆ?zHcèû+QÞгE¸Š +CgÍ+ãÂÀë¶5(tÇê±ñE´{È‚Ëu)Ñ–@‚æDN¯#­¼Ãÿ®’¨¼“·™Æ‘¼p2IÝV[f•€mi+.Á¦üüôç÷»/ö4ÈÜ÷M—g.¶¥-óŽÓàêN“+Ú,#Ó‘š`G”¯ï’ÉQ[{ô6™¿@L°²ÄGŽ<gk½ØÙœHX¸ô€üçø^ÖRFÝ\iwŒ¦”(Eù’wT»@M…M†¿¤ +Ð^ è\6Ä’þç­Ãþv7€0uS%î˜âã3HŠ&o"þogº^áÓ$ÐÙ-¦)z=¤¶Qá“iþŠ(|gü}n @àÌü ›ÐÆiR’Âʼåb‚=‹çUñùÀ[;&ÿfY¬™e:¼yE15ÏÐlR×ÙÓYñ2 ){&ÇùU[o:žú%?ûèäăE4Jx[àÕ¶ÂçLߺbnôÒA„[ðI·ëÂQ9x¯KœÌgû¡„Æš"ýpMõ~ÝY(;¦n™9¥@7$-óoV¬•Ú—’ª°kùb„­9ÂωৎRKÂåøOØ„(ª[†ÔÖ+(¤ë²ëúè +«'æO¬:ßß?A/Jy¤GtHÔ§±'ê-©{ë¤ã¡v%ÅØtdÊå7lzÕ;†!SõFmYç ßÙl;y ’är–üXÉù¢ŸZ^ª§L)vYe#ל×RY¥7–K‚FFÆ#ŠÚðÅ”Û +¾š¬öhuol4{ ÃÂÇŒ¦Ïùáq[ŸŒ%xä« ëI FÒ<¿žyڋÉ'G?p½}å‹¢ÐWaÊ¿”½ÿÊ¥oÉG*ò£(=þ‰Í}ÿÔ”Õ¶endstream endobj -3996 0 obj << +4098 0 obj << /Type /Page -/Contents 3997 0 R -/Resources 3995 0 R +/Contents 4099 0 R +/Resources 4097 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3990 0 R +/Parent 4092 0 R >> endobj -3998 0 obj << -/D [3996 0 R /XYZ 85.039 786.531 null] +4100 0 obj << +/D [4098 0 R /XYZ 85.039 786.531 null] >> endobj -3999 0 obj << -/D [3996 0 R /XYZ 85.039 766.606 null] +4101 0 obj << +/D [4098 0 R /XYZ 85.039 766.606 null] >> endobj 10 0 obj << -/D [3996 0 R /XYZ 85.039 766.606 null] +/D [4098 0 R /XYZ 85.039 766.606 null] >> endobj -3017 0 obj << -/D [3996 0 R /XYZ 85.039 662.656 null] +3078 0 obj << +/D [4098 0 R /XYZ 85.039 662.656 null] >> endobj 14 0 obj << -/D [3996 0 R /XYZ 85.039 522.152 null] +/D [4098 0 R /XYZ 85.039 522.152 null] >> endobj -4000 0 obj << -/D [3996 0 R /XYZ 85.039 479.199 null] +4102 0 obj << +/D [4098 0 R /XYZ 85.039 479.199 null] >> endobj -3995 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +4097 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4003 0 obj << -/Length 3410 +4105 0 obj << +/Length 3168 /Filter /FlateDecode >> stream -xÚ¥ZKsÛ8¾ûW¨|YºjD“Ÿ™“í$;ž­8Ù±R9ÌÌ–h‰‰ÔTïüùí@H¢äÃTªh A‡“þ…“<ñUL²<õN曋`²„™_„B1’©Cs;»¸~Ÿ¤“0ð‹ ˜Ìží>Eà'E:™-~÷î~¹ù4{÷ÛÕT)å…þÕ4ËrïþaöÛU”{ß~¾›Ý_MCïãUè= QìÍ>2ñãͼÅÙ›«?g¿^¼›YqC¥P˜¿.~ÿ3˜,@ð_/_ùä;ô?,ŠÉæ"N”ŸÄJ~¯//þk÷â¹x«ÆÎn(¦aáQr^?iê§AjõÁlì«8uõ“$~g¤ŸÐ@)I\x³«"ôÊvSÁ©kÍ2?8a¬ævšÓ·kˆ^»Ýs íír½]—ãÝýûG¼WÁ½¶Î…*s¡Ð¹¼k6¨º ÌÓÀ½è¶E-’†{žx_­y„Ðã¥ëKZˆWDZwCÊÝáª/,Hbr´³j°-º¬æùJöVžÞB«[Ã’e@~/#÷¸(çÕ¢\ðÒ~¥e“G ÿpË(g…/B‘ý;šdÓA•wy¿gOÀ¾ì/yA ¤ªz9L×ð\¿2L^xbŽ»¬t½4,+‘¬o¸½#0~ËOÚžJý89$š3¶'D¯ÚÞ†ƒíp·=‡ãÛÊÞ弟þÂ7Þ— °ÇTwúcoÃöµ²hz šÍ£U´ jõ[µ@ª—L€è°.¯É¡+c°¼¦[éÖ%%ÎZÕ¼Dh 7´ F|¦d=/‰ãäº'kÝŠ<õ‘)&tÌ]'`CñöáqÏ»”WëMÉsV]³Þõ#,I ®¤ÅbèäÐ~¹8i"I‘øy ÎšˆCsÚD Ñk&rŽ¡5‘CŽ£&âr¼ÿt‡Ö©Ñ¨G±‡šDšË{Á…ÂñÓ)v>±‘¦³†;^ȶAW'Lªæº¯šÑ* É‘dSö+kyÈ=[’ˆÖç°¯‹F4òÆ…› x…æ8*20† ñæ›}â…=îLHT -âÑ,[ü²Õ›îäõCz&çÓ$‡æÌõ ѫ׆ápýǯßáøÜtÛë5»ÚD’àÕ*UP@C‘¦< -gwɽΚD¥×ÕÿØùaü *¿ô¹ã@ÈþÚ9aÌ –ÈnÊvðiæÑF!oùí*I1ÉÐO&=ª…î5÷ºK¯Ÿ`êØ žÙœi«ksüMÅ)™N~«4w°Q†#k-Mû•çØBkŠVÔ· ‚K ÆÝÆ""ÎILî0p’­ÐCK´©Z¼BÜÚµÆ J^Ƨ¶Âhÿ‰nhìøm9eW/Á‘ñB—’H|%el(ÝФ[òðLØEÇÀ:˱{¡:6ºÝ³*<íò¤3`¤IqÞ™š3Î$D¯:Ó†ƒ3pw&‡ãCÙSÞ}ÿ“ Lú¢Ã¤ žbÿòAr;6¬œ KERèÓ5$Ü…XˆnÓ_¤f»ë™ú0 ¼ÙŠ’úH’{hë¦çŽæ†AnÈÃÆá³¥£K[$9­L2“0Àú¶qœpÚ¹|¼t|žÑX_˜Íd¬üQu=[ü:” -ëÆ05Ç‚Y:# -Ô&Úd“0þ}Uq"(?QÝxCC¥Ì²ªÁJ)½˜Fiä- 8q†²nœH³@’ÐÞ#’ßß~àÁ'ºiî?¾ôåWî–Q¹Â ‚+›]åŠ`4N?ðË¥ÅPŠr¸9¥ÌØ!°Òk¬–i™æá'ºŸPÀ”’]œ³X€?lŠ¼ÞŽh€òâ$â °ªÑ“P.ÓŒ’Ò•MÄa|ÎË–‹½®‘á²b¼ùöˆné!U–0|k_Dyàon(YOB ¬˜TRN²îŒ<%wl–gc:!°ø™,oŽv7zåp´8÷eÅÊñ°f׳Ì<ÅEí‚œT·%þÍÍw¤Ã!ÇÔO‹ß",À€?[œ'ìR%÷Ëã£áfhu°n´‘åp®ãÃÊ![®éù\×`€n³4€3¥ŒŠ—pŒcÖÇUÂÿ˜[Á 0ȧ Ð?¶Ð3ÜçšÑ«'G¤Y¿\qÉ&ðÕ¼M_Ò ÒJ}½~áq̾ZJÖ•fK¾\6[“¢¥X5€Ìã'…ç¼*µ–#–ò<ý`£@ˆß+P0õ`ݦcâuõ•Ž0ºôt>ßó­ÆW“žkÞŠÝoHðÂ-l¹"1!h&»\vÀ~¤‘cÎõ®“J´–LjÒvIž0Wæg6Y¢±|êMþ;T¨ó¦&°ãlÀàT’Àèáù÷4‡æt’eˆ^K²Î1´IÖ!ÇÑ$Ëåh¼‡oð [¬$Y'Y0Àµ?ÄC©8x9xžÄ x÷ƒl2´±?w¥¬+xŸ5—¸˜k%™o¢üÖ˜²±TñÑÔÌM½ýöÙ$lcpG `¸1bl")#ÃmLˆ!ÉZáÝ÷Û®;A,»EËáK&ÙIŠ‘¨€¥6­ ]W‰ñáú!¢™òƒ™gãX%è1ÞTjêrþAqŽj8úI ­dò*`ß4ùUæ `_ŽX0Ô@¯å®•“k,8ççš N¨R¢¥dj|#ð£Ë$$§NM1ä<›r̳”aÁ¹,çyµÝË8ýÊá[ÀÏ<ÀÅv”qyà sË󕀑®c.=×çØ•QYhÊf'y³u6©d‡š¬MvA±ßéžêT:½Ü°g0ƒŠ„”n(µïŠÆsâð ÄçRXÓ–²¼–í(o§äÒQ åÐÞWœb®&ÃE"…)èdÿËŠÓjŠi0dó·g÷†Z‡é3ä2&õW§Ø)<ÅÜ [óô|I!9W‚853zŽSï ÅÁ…½zYþ0“VJ9RBðnù•–ÖPL´ X-ÆCebÆÀ€“ûÖ8ÆÍÁÆ8¬˜šÓɽ˜Î1´éãh`r9>ÜÎÌ7¼(ÿ†íPýçn]hS2¤_k"þ^[g$"Ús6¼DÞÍzÍ”ïÈY†ÔÔì†xl㜶„R⇠,5ü8 -8¸e×þQѳ >ø§ü¸u‡/Ç×÷Ÿ°öyü¦ãV3ÏáÑ~·î%ŒFÁÒ„‰<óó“®nEæ^”"hÃí=¿XŸS/ÈK\4ÇÝ‚œko  Dk:%vÈA¡]HàÞmJç‹øBuÍD¿½Ç©;þAÈ=Ôøݾ°öUœgNì·~Ð_tb°…³ˆŽqÙ½-{]ÙÇ祂kçJàDrtöUbw*ƒÚóÖãМΠÑkùÀ9†68ä8š¸¿DÿyÃ:>pê‹I‘ý8ý…@u?׃ù(&à/«Ï“Øsø[Yì™Mö‘ÉV -í ç ¸:Ÿp $§õ+4¯©÷ 7«Ýv£ÊuØ}QÿP·êPoÆ%O½ø±Rã…&Þþþ<Ϫ=Îý"?adI”ùiaPQ~(p¢r?ÉÕˆÄÿAz½¸endstream +xÚÕZKsÛF¾ëW¨tY¨Ê„ð&áœ$ÙÞ0[’½&]>$9ŒHˆD´­ÍŸßîþC„œC.J¹Ê3œéyõãëäŸ{ôÏ?ŸÄ®¦çãIâÆ¡¾Øœyç+šù÷™¯ÞyäzIÌS7ó³«wqrî{nê¥çóG!™/un¾þ0ûñr†¡ã»—£ñxâLïç/ƒ‰óþͧÛùôrä;ï/}瞉"gþijë;¼áÙëËßç¿œ½÷ŽEn”„|ög¿þî/éz¿œyn˜NοQßsý4=ßœEqèÆQ¨¿‹³ÙÙí.˜‹Î±jà…£Žbä§nÄÃ\ñ«ãÔò! áÈ £¤Ïß èñq”:óËÔw²z“ÓëJ~]UP¯Z= <2pÇ“ô™SÃØõý`hÒOÜ0¡gÙEþ€d~óüññ‘±Å1oÊSý=ýx`Ï™Ùk"½ózÁ?j~`ÉÚðxàå‰fÅòÌ]£P ò}s?;0–Ð)Í&ÃœeGS»6þAæ%Y†Q—Sûyz?ûgÇôÃ- 7!> +"‡Í—Ã4'4âÎÈ[ÀÌj°”0gÃF(h‘/L›W%ãÈØ]b’MÖ®­ñlCÜÊmdý„Ö3çeÄðÙ¼°ô¡«9kÖbBDÎ$ל !=`aË; FdŠE2 å]ÕfÓü³$y'´wwE%gñÆ1K* S1ajÒ³#¦q(òÄi¬„sSäÿƒYÒøo^ìånæ2DFž’ý±ëáyê´´DwðÍ꽵ᄱläc˯—qÂÎÙ²F^%Ä»®*Å$N×â6† 1‘xKàÖ¢œçΡc£%_¤R3v®W&/I£1î¬4rfƒÝu¨+†DQDs§†`˜'p±¼—=(Þ®Ô¬åQ…Dycâ%)¼Lˆ¥Bjh–ùjÓ-Ë%}ägÐÏÏkPlØ7ò•U50Bt÷ +-9H +c²ý]~pzßKôaD°Í^ÀÑODºtËU ÑJúŸC%’@>ë»ÆBú¢Ú–h)G>´]8»OU)`‡àKÀàù˜ÉR׋‚—4A"¯¡4¥šhI3ù·"yðboJêGˆàíwÑ1ßújüÔdº~ºO ,Z?$”;Åã¬CÂÏN}ø¨ÍS›Kº¹Ñ€ÀoÞŠ’Ñ>’… #»dÐŒ5F˜dgn¢RgÚm[4ŠAv‹øÎ)î’tæÙE”]«øÕäÊEþ!@ý FéA]94 +c6öWaÒ¥Áø!ŽKr,ù)VO­†š„Ûâ’pšWó¦}á‚h¨¢^®½'r zç§ a‡šB%¢kýȇB ’“.Y9É7\;¤GÙcùöÀû#˜%Ê}û' Æö{8[c>×ÓÙq58¥EòÌ]u¹Z¢¬vÚÑÊeo“\w(EÕö»‰ùP¿1Í +Ãç‚ã_Åy2 ‰ò aBäõ=£-ÇuvùGá çò°ªÎty©ÛI.¡ÿ”§P OÝæˆõ8rNâ½™¢ ìåÅò«A²x(²ÑØc_Bµ‚Ã3Á0E&] RÔa¿` +§Å?7]öB*äu<5W…£Äù,^miE¯ËïçÚjx¨OŠiCrÅ5Šƒ´ü8#ÑR<¯*$}c OªvÜÓl¸ŽÎZµe•×ôÊØ‚P›®8uŽki„3?([ùÞÄ Óð…¹™›y÷¡)h¢vŸ›O¼ «òay˜Úùí‡ ±na‰pÆ—Rˆ¿•Ö¾„H¶ïSõÀ¹. +P6ØŽ[ƒiv{Ÿvª¶ˆ+|ÍÁ}@¬–~œ>na­ßs)ÃÐÀqé;A1é– ¯WÓœ¯º¿nÐœ¹/_ïŠVýbà‡kÁ% ^]ë7f™éE+´S|Oßi–¢ø}tæݼ ’c~‰7≯x@KíÞ¥–§^xÚ-×Gpó¡nµ•0Y1ÅÓup•£¬Xd’åè€'ÊÁœ“U[1`É—ÚF½û4-mx“A³]C5Dý¯’ôSÁX«ÉýOQ8ðEkênñBkßÛBü^«ûCB0aî^Ki}_¥“«;Û\ŒÌ×™f«ù•æn]ee¨²(<õ#|ð VTeЛò4¯Á¬žZSb ©ݬîü5ÃL W$ÍöiMë¿JáýOo> |î‰?³:ûÈÛŠ4ûÆ´f(îãÂ> +O3|]BÍJïÓÕZ%{k ë¥h| up£x|p#ú釾Qªüãq+|¢µÆ}y:$-º 8ƒLgO®<:}–Ü-H}ÖktzwãŸ~˜º(2_sÈC`{Ï|åbÖ>¦Yf´‡ñç®WèÚ‡òÁo³\„É ³Åó,0 ucý«Ð&Šáœ÷ðGžW^É1Pj—ê„w›¬÷…j©N·ÑÇwªcàSät›¢Œàëg9F­—¾°xŸÃ¿É°ð˜Í<û3vc Sƒü{˜nÆÖºøü`r|O¥9àèÿÖ MBendstream endobj -4002 0 obj << +4104 0 obj << /Type /Page -/Contents 4003 0 R -/Resources 4001 0 R +/Contents 4105 0 R +/Resources 4103 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3990 0 R +/Parent 4092 0 R >> endobj -4004 0 obj << -/D [4002 0 R /XYZ 85.039 786.531 null] +4106 0 obj << +/D [4104 0 R /XYZ 85.039 786.531 null] >> endobj 18 0 obj << -/D [4002 0 R /XYZ 85.039 766.606 null] +/D [4104 0 R /XYZ 85.039 766.606 null] >> endobj -4005 0 obj << -/D [4002 0 R /XYZ 85.039 742.055 null] +4107 0 obj << +/D [4104 0 R /XYZ 85.039 742.055 null] >> endobj -4001 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F41 2994 0 R /F15 2972 0 R >> +4103 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F41 3054 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4008 0 obj << -/Length 3177 +4110 0 obj << +/Length 2998 /Filter /FlateDecode >> stream -xÚ¥ZIsÛƾëW°t XeBX›s’”ø=¹´ø‰trHr€H„ -ZV~}z›ÀM‡W.fé™éîéåë¡Ü‘ÿÜQØŽŸŒ¢8´ßÍ7gÎh3ÿ9s…b"$“ÍÕììâSŽ\ÇNœd4[š}Ç’p4[üa]ÿ÷òËì×ÇñÄ÷}˵Ǔ(Š­›ûÙãØ‹­‡_¾^ÏnÆ×z»Ö=)köÀÄÓË;¼ÂÙËñ_³Ïg¿Î ;=†]ßGfþ>ûã/g´Æ?Ÿ9¶ŸÄ£Wh;¶›$£Í™ -|;P¾ô‹³éÙÿÌ^<§F¼êìÛAìï ï„;T ³O”Zo(lµåÎ HU¤%w*ù®²¶ÍK˜Yq/ zÖ&}ÆåNDV³­J:mÅÔ *i ãOÍ›H’?'^´KÙ®3nLÓ îú”r÷.Í \TÊù·yÓrëO'pR$ý>+͉û§B¶IÛcW£<ÛÑúÄñz%‡¬ª£>®X¡AÅ®‘¡¶EU~¼¸x}}E©mè‘&´hvU“Fw8te{ž;dqçÊ5ÍiÎvwBÖ@_`æG”âyvòžƒu4t ³ÊöUØSEçºÛ˜kûàUJ¬Ç¬HÛlÞFÖ—ºú–ÍÛæ'aëâè$'=š£—¡íEq2[g5˜…ïùVªs2Wì¹V9ö«-ÞpƳZ¼£×1˜hŤ%ÛµkfÀeêg&þÓqU‘5ot½m¶‘Í‹<+ɸæPÃn`§ ;‘6<³„0jߢ Ó²íae¶Ü2|/ÐjÙ=ãÇk£c\W¡vAiCHBZ0Žõp_[›j«-¸•MEœmÖÚZÌF( ~ì¼àlÕ -UqÀ„ÉbÈ%|—ÄÌçuEBVèH4áX¿S¾Z0Û §4Äó¨¾ 'n1áùàÿwi šª™dkŒŒûÈRw2`¤EBJv Øï¥6îÜš»n*öÞ½á -}=é!Ñˬ—p«ç†ïÉO’Nº$¶Ò9ÅvÓ†Ç@Ǧü„[Ì 8\ä:Ë&ÀÄO“. ùµÌÅ+¡³ÈÍÎÛª~Ç -ÒÛ,BC.Çñ7éiq‰ÍBf—ü5V„ÍWOpŽÝnSL1lT ÀÚ8ps·ÙΑH¢Ïn\n˜è5o×d¤²×i<#tÁA‹^çx=£æ;«Å@kvœø'ãNæxÜÑDïÅSš¸³{âÁ¸Ó?‘c¿xû¥žz]m(> 4ı1 iB‚JŠÄÕ°ýoxè7´¦ºÝ‚•kb^Nô»AКpN§ l\I¶>ïE;L¦¸Šâ|§wWŸ‹|Š}Ul°‚ 2EÀɘ‡Óy›óÍF€°¹È¤_½°-x|ÉÁ]ú1¾á.Èî‹· [Pô£€x *uŒÓÕR6һ쀘ÚK”à*¦TÍKzqHüh_t8)™ÔáàaÄ.BŽm!‰ZÏi/ä¨Qé;®\h`°€Ô(¼ä»PAA,êC( íEQܸéÙ NSè(᪒ÒQNqðM¸)çÎ/ÌuáÛ£j -•ÂÊ’@W’pˆÛhäë<«)ÆS–\çÚÆÒ‚iðœt£SCuÏK:ÏÐZ±*ru¤x™ñ1z²mL°‡áFl6§›†Ømú„ºÈ›õFCÓ˜¬¨¿{º›ã¹6›–‹+Šn¢ôý{ž§\h‚^ä“ØÕ gzÁ±õ,"yq`Ñ$^À˜õ€‹p($òµ<Üä«’÷¦µÊúÊR`ªkʘRç,/òt¶Ááž±ÖeÚ²/¤~ÿ!Ù‰Z•oW’éä€Ô;º$u}ؼ»BâØïŒJŸ¨]èÌ8È#‡H(œv$3¼%öWu*ÛQºÏP‘@±î;¶st¹JÉrñv1! ?ÁÆÊcM¡½0°®[“c|ú–„š2^cQtX]é‚6&½1jÙHHЬÊÙäÊÛ'í÷UHû ÑñÚFdÑ÷‹¤ÄǺ¦ð¦¢PÙ¹±’ã#£/æn¹³yÛ'L›^òÞ‰'J_°7d¼`˜ÔyŒÃ\tµPWØ5¶–®ÕI’~¡©•¤º!¶Í¾É¬äî”H=§ G²®"¤zŒ®Wžò¸»"ë›sŠzƒ»#µcfܲƒóNiÃË0}ì@å'vŒ ,ï<‡ñ¤G½%vvD…|ë„’D1¬ð­ƒ»\°Ø÷â![»¯^Bsš›Àumljì¼®s‰äÊ ì$Œ†¨ó„Hf¶!± ˜»»â±A/°NñÌIŠmÖ »Dyò.£ä]fJ²„P1f‹¡‰USQ­ÞŽq£<Û Þᦣ9ú6ã;à2Š=f H¥NéUÃß‚Ê - ÐåÎCeI -m¸÷õ—/Ü0’»®qCõ}Ö^ÝgØ4`&è=DQF¶8ÍC$ì0³¬ê,®œ]÷TÕç8ŽnHb»ç:¥5½r’ÑÊ;Š;X¼ -Ç”¡y¯RØŧw8þ²d\‡ì•Ç@q«gó­Îp0¯KÆÌ5OîWÊLüJOGkÙÇV›Žà\š"dCщp-O7eÆÏä´W}zQð@÷º­´±¥ÿd Ãø‘W 4H€Z¼`ðŽâƒ/<‡o[§px8gâU¦Á•±œ´5x;Æ'9ÊÐî*Ft¦Ò!p¦Ó)Ìz¦)(U(—ÆJªjŒP²ß”<¸ÊÊîøâÃR=qæWž”AÂÖ‡ À.ÎÇŸ —UQèúãµÃ€æêEV<Ç<ϳ£ <Çz4ÇËtMô^™~ê@S¦ïžx°LïŸxÎ^ Ðæº*Ë.§²ŽÏyj¾Pj!õË/%®åOÈSRSU \+)S×¼ux.`BòÍ'k(ì „óŽ„sÑÎÚÒ{XÍ_ÀfB`óës“pF|òúz4ǯO½w}§4×·{âÁëëŸx>̱§Yç$4ðH×ö7z®xÞj¤èVácØŒéGªó(à÷ˆB^pùͶ=¿–ŠLÞKb¤ýÎ?‚{¼!À¦Ê®†±Ô’:~³?5\zGÒ`'ÃÀK!²ø‘~쀆ä‡y†mi П:L:?`…ãüÌG8 † ^Ç¥Ÿdç#ŒÈq'˜8PIkÙ™)]Úƒ{8?<ç˜é*°¼ðôïl=š¦+Dïšî‰;ÓÝ9ñ°éöN<7á=AÀ°ªÚœv¿PMÞöì¥*Ðj‡¬>‹¬{ßë•åÆz¡½÷‹/ÏÓ"›·BΛÝk3–BŽâÔ¼f„Â%‘'ÄûÉ0wzànqgj/¡Ô3üq„Ÿ=ðÇ5OY_®‘ÊGƒ¾xá «ˆö¡Pῲ֙<~ÂÈ„ë~wÀ^‘uÖ]0]Ø -JóB†›Þ« t«Àµk¡Ó8‘ü„¢ïbðKÊA'ˆ"¿â(dßÇVÇ?£˜…¹ý«ˤ2©}™”yI; —Ê¥úrá#ÒmZnÒ’Õ*lÝ^ÞsçŽpqºê~1óPbo_h2Y¯g[ \¯9|Åû]áò ‘Õìk˜%¶âÙ ªdãÍ›8%œÎ¼èpf»Í¸1Ow¸ëcÊÝÛ4/pQ)çßäMË­?œÀIqê—iXiNÜ?²MÚŽ\„‹*JX}8To„öðó7”µÅCÚÕóþüüåå%±¡GÒivíª&-œê:‰íÆ´{—vú, +,ï`™ÞdæÂ7ŒÆ-|æÅvtïÁ°²}ö÷wm ”`=dEÚf+0à0²>ÕÕçlÙ6#:óì(9q Ø®ë}ÛÒÛ¬†+ñ=ßJucI¦‚=×*§^bµÅ+R<«E]¾LÁ<*žZ²M¹†æZ?ñä?WYóJ×Ðf;ټȳ’nŒûxm5ì6"ÒÔ†)k À¥Qû͇–í¿ ++Û´å–á{…†XË&h•¯<^U⺠+•Ø³6Ô‚1ê÷`JYsƒ 1gIË7®®?ÈЯD¶¹ª$Q3ŸTü ÛìRU»•FÝ)àÊô…™fñM΂ÃÈWa¿®ò YÜj£ÏŠµ=t¾úᘵ¸¡í‡Š½€ŒE¹£ÖïF‡Û¶ +‚¡ûôIý=G ðHÕžŠ;æZ:ÔãA2ìÑŒ[MmØË7_`K0w‰Fú„c¡õ!/„:mÈ]rdKÑR`ÙÃz±ƒŠÅ}Ulíª½6ÅV6 Úlõµ›PBOì<#µj…Ǫ±Eºz²mß%1óe]‘zë7ý³Ýð䔆˜~ê;÷˜pƒQÃG¾MKÐTÍSöÆZ¸\áìNì¡£‚´H8“=ö{®_¶æ®„›Š¼wo¸B_O:&z™õ·zjøžü$é¤Kb+]’“³¿5<:ÞñÌÏ0qa‡‹\GAÙ˜xeø#éš¿”¹¸tV¹¹Ãe[Õ¯ÓXA<™…~>žËqüMzZ\c³êš¿ÆŠ°£ùê Ü„›©AEôÿŠ=¬˜»Í~‰“F¶áI/y»%#•½Iã…hFNŠ:Ç#4óDŒšï¬>s^d{‘?™…‘©ï F“½ÀL–:ÞUµ#wÇt Ç®ÅVë^à"‚`DzÁÀÑ°9ïxèW4ŽºÝƒÑêɼœæb +L@ã@š†ql›\‹LwÙ/ r¸Š`¾óÛËÈÅ»a×SÛ ŠÉÖ0 ã<‡Óe›óERì\eÒ¯žÙ V<¾flc…>bÂî‚ì> VíØ€`Fß©ÅøQA¨c$WkÙHïr¼tÀÀ½TL!”—ô`EÜâXtØ;)™Ôáà0Ä.¦ûB¨¦i§bFù‚+W:`¯ $CfZòÝH°'LŠú© Lí"nÜôìÉ„%Ü@URtÉ Ö^…›rY }e® wØ?Uò Äš’¡$$áÖ ·ÑÈ·yVdSÐÛæÚÆÒ‚çà9éN#}µÀsºÌÐZ±RpµãCÚ—ñ1z¶o vÃp#6›ÓMÃão›>¢.òf»Ó)cLVÔß=]OÍñ«\›MË•(ýøž—i'š `‰]=sà–p[O"’ñ¦¬\„C©$(_ËÃM¾)yoZ«0,ÅŒ2ž¢cy:jàpÏJë2mÙ Ò¿“ÐÄ­Êw’è‚âlDÜ%’žÞ 2Pýõ@Bœð§ŠT‘­t”䓱‚‡ ¬œs’›:•íú;¼‡ŠÕ‰#bîb“’ÙâÕ"! oacå±6vÌe»ukBšâÄ›¾%e@¯1ÉÍèh¥ózÚ˜tÇÈNð@³*g“o(O Ÿn ¯FÚo˜É—mD}Ç8•¸b€ «IU*ÂÉ·•À‹I}1˽-ÛþÄ´éâ0QÝ%÷“+^0 Ð<ƨ0ˆçç]ÒU[­¥€ku’¤_ý)È0RÝûÆæ=ßdVrwNYE½¤Þ‘«Èû¨£ëÕŒ¼î®Èú&¢ÞàîHíMJC\4üÅØq!øÀ·ïGx ±­b÷¿}&øÜñ+`hÿ¹Ëô C;„Úz4'Qéô‰/Û\d#wR^`'a<0#Š 5ÚäFv{Écƒ²YDŒÅǶ8ó†ÓbÜT”uÑ î8µ3¼ùžíº§0›«Ço½_(y¿˜ç!Tj¤£ÐÄj¥¨6¯ÿ‡7Œ)¤uJå¿Ä‚ÒvN@_£ÉPYÓîýòã'nÐâ®ëGÜ@ø¼ËÚËëû9 £) ¯ÄRÚr*yfH)Äc^5³²‘…D9Ø}9;AÍž`˜Y|¦Ý˜z„Õt%sÎyÌ€™ ÷bCQØ⸠èÔ%±²ª |¸rqÕSUŸã8N¸!ÁæŽOè”ÖôÊ5NþAq£Å¡pL‘“÷*…]| †ã/JN´½aJ1.‰³<™—RåpÔºÎÑ9‰­™x\‰òäzcÙÊ<¶©Øt$ñ$Òaª!•’š2Ä÷39éEŸ\<Ð=¿*mhéßÙÊ0}âÅò^0x£ðÁ(W†o[§px¸äÉÁåÞCKÚšä7Æw+É[¡ÝUÕœ^™²£œöJ IÑ@ÜðÒJ +o±’¢A*âë’7YÙqP¼ã4Q4ܨé•K&ðÓ õXt>LL³ÕéçµuUºxé´÷¾Êê÷#p+Ûãüï§þ}ÃÞ iÃUU–]Pce½aÒŒ?¬KÐN!…“Ë/ +®åÏÈâSS®H*T®t&J]ó¢Ò¥—K©²Áä–OÖi¦'é‘7Z8 ã¼]JÚHïF5!'3IIG_#(‰¿³Û5é<댗èþB§kÅKŠ]|Ì»’1ÉHuv\·òpɵ9lûæJ*?4|=x'ñŠö{ó|Ï ¤Ö†M Ư®d„±Ô\Úµ‰Ù·Íˆ«HÄGx.D?ÒÐpCÊŽÎ9RZC–LI-¯°Âq~` Nƒaþ«ñâ­ì|‚9îLŒTœZvfJ—À`íÎWÏ9i‰²Ý$úÎ,Ñ h‚aySµ9A«¬{ÖÝc”åÆ¡}ô®ÍËó´È–­Lç8ŒÍîÍ‹GqÜr@ªlO†¡÷“—LîP€ÇÝ ¶Ž‰^B?|âçjëñ”õé +gùh?Çdqz…}×v¸Á‹u&o~02ãú×sìYg¬Ïk©”2CHØõÞ [•Âºú€Éú.¿Œúä@ù-B!û>¶:þyÅ,Ì­èßFX&%ug'—:–K™G¤ÙÔP6Õ— ŸQnÒr—–¬ZaíæâŽ;·”¦›î·¥ '³õzöÕðÀÕ–Ñä+¼ßùC¢„¤²ÿƒ¬º w©­Ô]ùR¿9ü€†ãÛP/±¶±sÈ6Žyø›´«Ðp ³MŸËÙñ»_‘•›ìœãE#¹wŸUåºÀj—Æ +»æ°ÇuàXw ~•»¹å•ŽízÜ¢cÁí>•9ÆÞŒ—v^™´ øNï ئ×框Oá«ë„¶ãÅã•b÷¿ÿÃq(Ïý ÿ§‘ÕKŽÿ—€æ Àú?T.[hendstream endobj -4007 0 obj << +4109 0 obj << /Type /Page -/Contents 4008 0 R -/Resources 4006 0 R +/Contents 4110 0 R +/Resources 4108 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3990 0 R -/Annots [ 4010 0 R 4012 0 R ] +/Parent 4092 0 R +/Annots [ 4112 0 R 4114 0 R ] >> endobj -4010 0 obj << +4112 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [84.043 738.375 195.218 751.276] /Subtype/Link/A<> >> endobj -4012 0 obj << +4114 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [438.653 403.295 507.324 414.984] /Subtype/Link/A<> >> endobj -4009 0 obj << -/D [4007 0 R /XYZ 85.039 786.531 null] +4111 0 obj << +/D [4109 0 R /XYZ 85.039 786.531 null] >> endobj 22 0 obj << -/D [4007 0 R /XYZ 85.039 722.931 null] +/D [4109 0 R /XYZ 85.039 722.931 null] >> endobj -4011 0 obj << -/D [4007 0 R /XYZ 85.039 680.584 null] +4113 0 obj << +/D [4109 0 R /XYZ 85.039 680.584 null] >> endobj 26 0 obj << -/D [4007 0 R /XYZ 85.039 374.302 null] +/D [4109 0 R /XYZ 85.039 374.302 null] >> endobj -4013 0 obj << -/D [4007 0 R /XYZ 85.039 331.349 null] +4115 0 obj << +/D [4109 0 R /XYZ 85.039 331.349 null] >> endobj -4006 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> +4108 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4016 0 obj << -/Length 3166 +4118 0 obj << +/Length 3046 /Filter /FlateDecode >> stream -xÚ¥ZYoÜF~ׯ ˆ<É&9dü°°e;Q É^k²Æ" °ÔšaÄ!gIŽŽÍŸßººÙœCyXä˜>ª«««ëøº(âÁ?þ$‰\O¥“Y»‘ò'‹õ‰7YÂÌ'¾PL…djÑ|˜ŸœŽâ‰ï¹©—Næ÷†Oê¹QOæù¯ÎÅOï¿Î?};›*¥ß=›Îf‰sy3ÿv$Η¿\Ì/Ϧ¾óåÌwn(tæ_˜øöý5 ~ÀÙ÷g¿Ï>ù47âXûJ¡0ÿ9ùõwo’ƒà?Ÿx®J“É´=×OÓÉú$Œ”…JúÕÉíÉ? /ž '¼êÐÙ5ÅTyn’„¯ë'ŠÜ8œý„¾¥ßóÝÐSM„ -úÍóg»Çó½ØM¢db1ÛÛPÓìíèGöŽ~à*?íx+zU©çÜB³@wþ¿„nSÃT’ÒTŸµý~7pq±ï;_ñÖ2"ížÎ‚™Ó´0›w¼"k æZÔ‹ö—õEÎS¿y‘´Ô®q“F|Y¶X æÍa¢¬—<Ú#³kj–’Ú÷88ýª`ºû¦ªˆ¤yš¢&A?So,¥ã–¸™¦‘³¦³ö+æ gÉ»ΦQ¾Û`ÀãíÛï°1ß pæg‰"E’jÑ"Ÿï„.ª.HÓ=Üq¨碩kM»è™¸oø7c†Ý*vØCêlm±ÆÛ¤åîÒ…¹·xìaâF3<% -[ß/á_&Lî,˜ UG<ÛGô®¢µwÝç±(Œ¢ýÞ~ìªXiÞp¢BìJ¡ÅŽ•€Ö3U‘ïú~<2"R „ጣrW´å¢àN‚‚GLÁçdˆ4ZyË«.¿^ü[uÆN‡V¬gSšelî,A0sƒ™¢ë%¦ÞÂxnCôâ®8æ9z2‚HX .ž³u©£Å =½ì¸…îÛ2“… x8QÖÌ"×J!G_ñ ^­ù£{·²g³íw­HÜ(ˆ&q4s_N´K¡øf9€¦žZäû°Ë“\ Xl[ =*#ígíeÎz9É1Šÿ`ë`Ù‚qí¾«¼ÁwüUÓ¼.î.'’GÅÎ¥X[¨b7ˆÇÖ–UUƒr?ulN/Øi¶lBÚŸ(ûT2ºÂó6ÛåJ÷åÞ•DÚ®Ïî04—”¯pv-Øô¼ˆÒ‰¶reb‹ïœ_\~¾åÁîP‚ÄqŠ-ņ{wÚq¦7–ä Ãq¿Gð†ŽÃ ):€ÙÐUala-ÀY0ÂzCAU‡©óiSRR\n‹#ûG)(?zËX4û­ùD‰†íÿo4³Àù;¯²ž-0pî1³ÖùÔXÿ¥í¦yj¥¡WÊʸp‹’ñy/‡ƒ\39Ÿ’‘¯²œYmD@Ž›É…É–«¢ÖÛh×á•y),Êõ{šEi²vCŒÀtÐ÷Óï -7RšE:1: - ñ/Ü[£ûn8¶â‘’•Óèyyà`ŽZ%9Šv´´hï³…ÐTðš¦X6Fƒ Å; Ö^ -rúζßáBY¨ªDÒ’¯xþÄ]ÏŒg¿­7õŽ¬-?½†€âÞã.¨ì0±¯•Îœ Z4›ª`’§Uà +’Qÿž°%,¹.mÓ5÷=gY<ƒûÁôn -Ü 2Šð]«(¢ûI¾Ð¶Xk?‚øÆêÅàI‹8l‘X lug§Q¼ÕH9yf°SÇ.Ð"Iõ²Ð²ßȹ±<íç…)È·ÛB$$ãæ Ãg& [v¶RËÝ :]dÛ®`Œ ƦÄÀ·¤c’‹3¦Z\‰S¸P>owD^£0d k–„É»JH¨PžŒ[hÛ"{íºÂ1­¥÷ ÌnÐMˆé%~A+/Ä–aÕ¾e`B àa΀;Üd‰~»j?Á Ëı[võ)"îi÷-$Øåf~CñQ'½v,m [w؉?-Ù8HžÒÁy––ñ–Ú"%÷Žw†§Wö /±‘dц¡3_’IÁiät˜ÖI?#çUæH#ûÛ$Ì ¹¿è -÷‰kgP )ó9”’Ü¿—úŽùe)ôi$x¡3›3Ž°£Ý¢yv"x~D°–žj%îÅ /Ù¯ú+š#7(†>.ëN‹Â~¯$$"àç+G”Ðø¶2þ¹“˜‡m-};ˆÃ 6ÑZVÖDï3f¨ý´'ÌQ1í¢a³àxµ•S4„’ËÆd/^{A>£EÈ2M­sÿJð -dC:4yRR£FúpNÒë²èGIpFñÜuWê]Idkg˜Õ!ËS;âÕ]÷)•耮ˆX‡@‹¾rµÇ1!Hw=SùC®6Í®hûŒó±X”íb»Æ‹”Á¡Z¢¤Ù?ÌmÊ@Çï=ºPyߘ*‹ì^˜º-ì»ozIµbr_eUÏC”s \$¼¦ÌWÒEë'™~oõ+;¹³ ™)5n+dPŸjè¡src9Z„î¡rcÓ®å:õM(©Ñ ÐUPY-·b€¹±¡Z#5ƒ¨y ”ëɸ‹i«Úê(Pt(Tü€†><¯Zp*§býúDÁ=uÆ„\_#íL)QìÒèl_d9:½'K½#ÏV˜¥gVPŠŽÊàŒP쇠ڞ§®KS6fìGá~µ&1<õ嵂±õÀKE„i¹Å1±Ý©«ëf“Cáq¤^Î 4`Ym‹Ê õÔ:z¸"‰ Ñ€wwÙÈ€4¦øÒ „Â^5Ù·UÐæŽ Áøév\ã9o¾k =úê3õ%ÿä%¥·zù÷7PŠ˜­Òpkɾ4 Ö|@Ÿ¡¡—Á# ¢¶nfR–wz)"Ñ\Yl˜«‡Âý¨N„eË…Ã1@ÕÀc±û†{‡öþs·ž”†®¯&A»‰ïÿEÅ“i§ñ~]iÌ·¼âGÍVG’ËþMûxÅpº\”ÔžïÉ~Ö6@·ê¥FQT`’*~_ð䜧®³eößÒDpa|;*3¥Ÿ¦É®JB?q“$+e§ÆüÜÜg -´Qüú7× HÜ zµ 觸e*eÀXÊ€×oÁë 2€¬–lÔ) j¯‰bÑ- ú1Œ$l.s*À1U‚e›ÞJÅA¬=!Oôvx•ãTàyŠ[3ƒCr¹*LÉ‚ßÂqQ.Ô9QÞƒ_Q,ÏhM.ŽÅ¥’B—QÒW«ëR*Áôj·Àïë1|詯?$,ð¤ë–æ¦TMÙ¶¤W¸®VrV9§ìÈ•ÂíFËû3S¼äØ"ÔœÓÎB—Qì,“ïãÙð¾Ó•Sž[ ÎÖèÚ¦úñæüŒ®-døãáý}¦ÅˆDYTzU.LÎêLu ¸ÿõe^e t?ÃÜ&åà=›Â/ V™mp8mWŒ…½ÙxƒBî|40_¯b«È+y4Ârd 7`&iÊïølRÅx âxdôUñß8ŒÓ‹1’ѧ -ÞBOejEÝéòE§¿g€Ú9>Ò«<»£ªI1XKAë7?œŸ?==¹Kcݦ]žWo0oPÔù=Š\¹ýs죆ŠÜÿc7€À|Õÿןj˜0&a‚c_ fn< µ0¨Håí}ðRvu@âÿƪh…endstream +xÚÍZYoÛH~÷¯‚BÍû˜<,'™ÍÀv²±fƒÅdZ"%qL‘Z’Š¬?¿uu“’ic}Y°ú¨®®®ã«êf܉ÿÜIÚŽŸNâ$²Cß,·Îd 3?_¸BáLÛ‰Bœz7¿¸üF×±S'ÌWD2Ï~³®ÿvõeþáëtæû¾åÚÓY'Ö§»ùש—XŸßÿz=ÿ4¹Öç©kÝ!Q`Í?3ñýÕ- ¾ÃÙ«éïó_.>Ì[Ï;ˆ|Üû_¿ýîL2ï— ÇöÓdr€¶c»i:Ù^¡o‡/ýòâþâï† Ï^5r™¦˜ùŽ$ÁÙ~<ŒwD ß7>?DhaÈ Ï™âÔ§Žð¼ýø©cÝC3GUµ-þ- [W0•¤4Õ©¦ÛÃï ¹®õµ¯ˆ´=L½Øª˜ÍZ^¡šœ¹æÕ²9â².Ïxê»:@Kí +7é`Ä•eË%2¬› &ŠjÍ£R1»ºb)©½ÂéÄê69Ó­ê²$Ræ0C]¡•]ÔJÇ-p52MCkKgí6ÌÎ’µ?Mga[wxLàDd(m¥÷ù8;TGA¢ èo§³À ­käWj%‚¶tó±Ãµ³ª¹MȀ΋š;÷á‰ç›[^¤ªŒwó›Û·º‰ nÐŽoGNŒ”?¼s·™y±íÅþdàÓñÿ«O†Ö|šø¤ÒWÎG¾®«*_vd­H÷xª3)î¶Õh I«j;`„!ÆöÚ†¹7x’³ƒza ˆhUÅ$'rK‹)Zâ×üÀàÈ›áŽOy0°¦ˆõçp0GÉOìmä‚pzòdÑ@ï«Šüaæ{‘í%þ‰[1!Ê–Z#˜Ê þñ CO”D£„¸_ ý†ÜÁQ3&Á()„E8I£=ÐÐIbæ +ècˆK ÃX#Ž9‹"¡x€ Äù£Ú bŒã¢ånÛ0“¥3œ(*f‘iw¢0Þð ^­ù£Ù³Þwç>î…©í¹ »oG~ľŽÍZ(¾þü’‹³Égš‚uÍäìùµ…ðûíÝðxët}&“¤vœ¸§‘÷¼ ãaYŸ:¶Kàƒ—Dщ—¨²¬QCË6>b§Þ‹«Ôü{ 

    Èè®Þ¯7º/6òóÚN-$ Ê8»,6/"`‡_%YÜ$ñËëOïy°KU8N±ï¸·Ð®ƒ3±ºýÍñ}ÏŽÝh¼VŸ²ã00ðåÁp`ûA4Ô«k‡¨Ú µ>ì +JGë}>R|À>é3Ûø¡í‚s½ˆ’ß]?ø†êS¹IâY+èí+rŸºhHTBâZ‡¦æ¬ÊÀßn£:nQž[Pèp,f²Š¸ ¦ñíœq[UZËÈM‘žQžÃ&¯ô:æ„ŠÒ»,/:Ôäñ[ƒFäCdÉÕ$¶ –¾ƒ&FIs90 yZÒ#÷¶ˆ!û%Žmx¤`ÅÔzÓõƒ)8`ˆ+ +`ŽJrйû¥y³RK¡)lê¦X×F ÓIAN°NwÆ¥êƒÃlJàù·wÏre´Ý™£ËGô²Äè5½^‘O“´ÂºÑÊ +bKºÞ•9“657PCýUm°ä¶X6u[¯:Wþ²8ûàFz7ÂÁ¸L0’äªi¹KÒ=îØšä…>¨©“rÔeèõ<=~F)ñ5JµbãÍ°S!XÝ<°­ý0$û¤ãúb¥¨°<"@£³:‘õmš°ˆaˆÄJ`«Å0…¡UC¢Ñ0-o¸D$uTë\ËB|Cën€ì?G¦À&”"!9oˆÙÙ ™€lÝ•’N½N—jßgóÅÁ÷¤c’‹SmóV =ÄF ßå­ÑF5>B°°fIx¢«€t€ +åéÞ¹…¶ÉÕÃÉ®´JTe4ñì½ÑÔ"}gÊrñeXõÔ30AxPu šÜYà&kŒØUÇ N \»E[½& âžß\²MfÆá70€ˆfDxth«ßºÅNdý9qò5œgio©=RrééÎp©QrÇAE{pÀ%y“Kf„ ‘Óaš&ýœ¯oŽtâßâ›TH.¯™º{âZ©HŠ¬¯ +IÖß +mc¾³ }JþoÍæ\ Ѭh.t@Õ%ÃoíWúøPm:p/× “î¬uà -7%D&£Ûc÷DhE¶ÿ,Ù°=&ã§bÞ…Üb?5¸‰ËN2¤!Æx+ð&Š$Ëš}€Ái/ÂÖTâü(j“ª©ž €F9£2H)u¥ÿ +RÖª>÷™¤(yŠK>S±áœäÒuÞdPn'ÝIVn ½+‰<Øf5>9þYÍðâ®O=³&Ýàˆ¼5W°³˜¨ò;ÏÊÜÛ鑣Ѯ««\æ@,¡·­ñäe½+4­.[‡5/8%CÄóN9çç á =©Dÿ Z­àÛIjJ4¹§Ào?R÷od®Øš¬”º}pš¬ûRˆþâ^´ƒÞ‹]&“íVü«0¨wT¨)β?RÄ©1é¹3X¡Á•Às¤šŸé€kËcE÷=ß}–?Q=MÅ8úõ]ÝÜ +þ“‡8öùǘFe6têÞåRq‡«\3|ŠÞ7€k]D< MÃtsjñ®üFræ[ò$§¯„P½ K¼/5r‹sÀ/äS®)lX±f!ôÇãƒÈ€ˆuh*'`Ñ5}’v¼ô¸•ŽÝ¹õkúO*Øû†ëÇ̼Sö+è:L/‡±'(IÙ&vø ¡/‹•$~÷_‡e§ó¶Î9ÊÜâ±r%î_'‘Eo¯­<¾SÁ{Fõóݯ<ø+ª&—á÷ãû}‰D¨ ¬ +*½)–&‡´æ™ ¸ÿõenL t¿ÀxÜ&å Íë+ –jèp8=ns×ÕïPȳ×x±%Í›×óÈ— l!GÖéF0Ê1iR¾Å;ZÓ“ú\Ÿ‘ÎéÈ~ÈŸãOáÞ8ÉÉ7Þp£ì¿UU­~Ghõ‡º¼„‘¥èÉ]-Ê|ùø¨Öí~º¼<öÚÀ¤]7ëËÒäæ Šº\¡È¥Ý=vöÈë½ë… w8ŽEbçÿí?$€Ð8Í‹¸ã;O>é’ÿ “¡endstream endobj -4015 0 obj << +4117 0 obj << /Type /Page -/Contents 4016 0 R -/Resources 4014 0 R +/Contents 4118 0 R +/Resources 4116 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3990 0 R -/Annots [ 4018 0 R 4020 0 R ] +/Parent 4092 0 R +/Annots [ 4120 0 R 4122 0 R ] >> endobj -4018 0 obj << +4120 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [370.528 654.697 522.302 666.386] /Subtype/Link/A<> >> endobj -4020 0 obj << +4122 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [93.134 243.693 419.884 255.383] /Subtype/Link/A<> >> endobj -4017 0 obj << -/D [4015 0 R /XYZ 85.039 786.531 null] +4119 0 obj << +/D [4117 0 R /XYZ 85.039 786.531 null] >> endobj 30 0 obj << -/D [4015 0 R /XYZ 85.039 625.098 null] +/D [4117 0 R /XYZ 85.039 625.098 null] >> endobj -4019 0 obj << -/D [4015 0 R /XYZ 85.039 582.751 null] +4121 0 obj << +/D [4117 0 R /XYZ 85.039 582.751 null] >> endobj 34 0 obj << -/D [4015 0 R /XYZ 85.039 228.25 null] +/D [4117 0 R /XYZ 85.039 228.25 null] >> endobj -4021 0 obj << -/D [4015 0 R /XYZ 85.039 188.086 null] +4123 0 obj << +/D [4117 0 R /XYZ 85.039 188.086 null] >> endobj -4014 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R >> +4116 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4024 0 obj << -/Length 2134 +4126 0 obj << +/Length 2366 /Filter /FlateDecode >> stream -xÚ…XYÛ6~÷¯0úRˆ¹â¡«@’4m6h4ë-6ym­-D–\I®wÿ}ç dZ²],°&9ÃápŽ3’Sþä4„¯“i‡"ÐrºÚMüé(¿M¤å010¾@œwÔy¨„o¢‹<öŒy¤Œ0±Až7‹Éݯʟ*_„¡ž.ž:EBPÄWñt±~ô”˜ÍƒÀ÷ÞW3-½ãl®ÃØk+ü ½û²iÓb&½ç‘—–k&,f‰ô²¦åå‡×ß¼ž}[|˜¼[ô κ ³?+-¤ n^(„KDZv/$Ð&t/¤¥0¾´’x%“xŸgsé-Û4‡ ”8¦Áæì*‘×SÀm —«Iw0[¦×.§bJy[ÿé/ƒ©ôEâ'ŽþA¢…IÒÿM^¦5ú$¾·‡aºš©Èû> B/Ýd ª'øPt5UŒzÒRZgÌ“—°{… èÄÃþe8[3™©;$TäRØ™–3•@ÿAüᙧUÍ¿~ºÿ‹Gë¼ik´ÛòÐâOU‚ B©¼Å–Ϋù` º1Ñù£š/ †œ6^Sí2íñÚ1^;è® «)®ýK¦È‹t‰±iùÓvè%¥#= ¢D$6Êp½ÞX†/Ž¿:æù‰{ì¯DT½ÝÚË¡ò_hímá>{P¨›IòL³Aü0ÃMmÎd .‚L;WàDˆwŠ„ŸpžßC¸˜XƒKA¹ê€å•Y¶æeÌxü]U»}^ðF( öÐÎ)s<¡3«%W‡º ±ì¤ò= -ÖmjÖ‡£Û" Ð4^Ià|93sÏöKÖ8—é:u%M¶é¾íT«ÙDs¶ 俵åÂs//(‰6L8˜ìÔìa-ï‹H)ŽmöICÂê´%;‘iÆ2Å£i ¡}u1:ž¹Ã46ÁP’Zƒbñ($t`N!“­M0ø‡A¹‡áP“ÅÒµ&`Ìém(0€pêÊ+OŸq9çåq¡Ú“å30NºÍ¢—¦Ív¬À§ ÷u6}ÌÁÍ”ÃLÛ‡%"ŸŽ«ëÄÛ¥¸ù…)eÕòjÙm¡ã`Gà°as’Yóú±{jH+Ü€yÃC«í±ÐÒ„Òû\Ú °´Íx ò³š‡(ž-´®ñ]ÕcoòÜ óqœl·çj÷ž¼bžÜmŸÆ1¬¶_pµBò‘—Ÿ*K'/âÌ>'ôyUÚÝ牆KŒ€È[; Y&®¼½& E¨nCÏÕÚÁˆª0´µƒ²µÃÛªüêK³x}I@³¯~à7´ VU …¸&¯) iÆ·uîY®– :ô^:;ýØ )-Wµ|9AE>¹WEÊkڪƈÆ-¹¥µtDìÓÈÞ -¹P=·¯Ð†£Aíµl2ÖMÖ[OL`u!Â)eh˜søãÃv²o .VqhüÔ|©jÚÙ|DðK¼MMÉJ*Z‹ «yT¯àÓ·Ý¢ãȵ",u…>jµyâÌküvZÆNF‡RAÂ-çdú¦GK py0”ÕOéÊò cTkééÛeÉËUáV®Ž8,ü#n8þ¿P½Afn¦ ÃÓÆ„+psPB_££lHOÚVꌟÓÝž -SÀˆ·T£öR8¯è‹¤¾­ß‰ç*F¨XŠ8ѤTáäeXwÃmíû:€Ú¯<ƒ «6’úÜoxNƒ6Œ¸=»ò,y¥1ð£ó:£Øl«®ÇAi3û ÎÓ@WÑ¥G‹Ìù’Žœš cbïÞ)º‘´Ù0Ò´RåôZrÕ]4¥Ôi¼Ö1Ø ô„Š⅙©1‰Í¹‚ ¢riÀ“m…La ¸`-e|m{&û¥Ñø†›Î¢ÃS\È)³¢Ià Kû…ŠØíç*t[™ñ×(Áš~WŒP‡¾&áõÊÒ UqkÓwf]#Ì3(U â Ø%HÂ-X."„Ûí¹Õ&/Ç¥J™îl…Mu!ü#å^Nm•ÞµŠ´«T¾²ke øRe¨!ùTµ™³Ÿktu*ïÇá=â}`ÁXM¥\±ÓäÐX:°ÃQÛ'ñ7º èrn&v_êô¬>øø¡ÐA؉CëÑ‘ŽEëgþRGŽ]endstream +xÚ­YÝ㶿¿bÑ—RÀ™+Šú,Ї»Ã%¹"mÜ×"—Ù–mõdÉ•äìº}æ‹úXË› R,°"9äÌp8ó›!mî|ø3wi¤}›Ý%i¬#kî6ÇWþÝ(ß¾22#Œ¬ŽÂÚ Ä•£®â@ûa²4Ç¿[ÙT‡QŒÄ·¯î¿ ü»À×qlïv4éaû“ +´·Š"_}×xÖ¨GoeãTõ ~cõ¡îú¼òŒª°Ÿ¨¼Þ2áÁËŒ*ºž‡?¾ùûÛ7ÞÏ{õþaIÀj›·”4:Lƒ©’&Ô6ŒçJT3ÌÔ?½•Që>/A©ÛÔØÏÔKÔGí ;¨¦³>æÇuî´j©“ì–Ž‘6fÔÑDwÆ×™ŸMu|[Öy b. %õÕ šùÆ õÅ‹b•ï‹Ž ;I†jxAª@êæmÁtRuS·ð-p[ž ;¦¹Õ±éÔK¿FNî|_Rï ÓŸx¤iùûã?>ü‹e ï²ëÛr s_65|ÑÂiG ŒNxË \„‚Õн/£mçU‡Î’ùªkŽ·NׇÑÕúÅ‹"E§WåëJ˜#±~"&Š´Í ŒN í^füðí ÇÑFæSS§™:¢†h_\ öÁ 8g‘w[˜-6ú9»¢eAø=ˆÇ|8–¼â!ò„ÍYV6'oÆcëƒYà¤ÀsÑð« Jµ™Y¿»°GXlCµƒétÜÖªmaRuLhÐul¼ºY<À¼…ÓBNŽhç¡/Ð@Ƕ#%7‚Ÿ}}#¢¦Àíö¥EK/žQNkí<*H´Ÿ¥´§»¹`êÔE±åYÄlšã©týé!ôŠnÄ,$Ž÷°!½^ó$Úøàë\ÿå¹;¬3?Ììd¨eø!7^ôÃw‡ý¬sX¿F)÷ßDÙdEìCN0²ì»¡8GŠRõŽ¶;ÆíF€bȶ hèEкòâÄè(þ^ü|Û¡Ÿê rÅʤÀÈÜ@Æ £ ý ô½ß55úÊ}}Ý ÊÔüìG>ºÈq­Ñ©šü!¡a³€Ú i| ¶AØí‹°=¸ÍŸÑñý Š?£šä¾<~ +ÉS{1Ô„F² ´Ÿ9ô¡C¶S±& Àš¡Ç=ÒiâL¿0Ó&uóP¡Ê¹)ú®±êñP’ÃXâÙE#LuaÚ¢s¦Þ¢>$ˆŠǥi*ï‹~sßá™ÜÓ9üÀáèØÆ3º¡}ëb†™’,ÉÓaàöwîÚûªÙä•­Êõý Æ1q¬ý48Œú·—ZÁ‹T0å5wŠ`˜b/SÅmÑs§?”l6úJN h•;2:ZÇÆTmî—=÷ÏÝÔ~ C6³TS#cß2ìûÁ˜¡`ì8¦pèíÉïNH/y#•,‘¨U%ZÃÜþ÷Lä +†\¢8/Ç,ËŽ.1x‰ /ØJ}BƒëÕ:ïF7ÇâÙh`–|# >~òŒ1ê—†êáõ„!gwW9DdRÍb½ ù‡Æ9‹B4QX«äz PÈŒ½P‰³dPFg¨Ã3€2ÊH)<¢”‹}B¥!±Û]ê>Z¬"-¸õÍR75ÙËxôpX‚ €–ù*ÔÈì5hØ$‚`†£†6Dk]ÈqsÐOØ1à;;ՖðÄ1òÉ-ÏÕt¦%w&a%“t!øÆêSYã±7(ñqB·ÚüÎ.$ïóÁKaþ¸% +³$Щ5S§³t%Ã39t(Ñ^ëìGŠÝz#õo7ÄHÆÊHü¹ ±.Â`aŸ·=$Ày=‰ÜÓÓ‚<@Ãi.ˆ(”íÔõX4õløGÝB¦¯ÛÉ•‰½læO@ûÙ¥Èg%:ÉÃ?†ÄãG®Êº Ú?Vï ¦ú4ð9ÔŽÌáCì7<@Ó ßbŒhx¹çzÏì\¬†¢»l…SWLŠI7²)0lš +ŠÃXñ_Nme?}>´r/SÐ…Ih½`‰‡ƒ‹3¬‹¬úÏ$=H1yª`ó@Z1ê= uæÚRRÒmh¨^j Å&ÉÎjd©Ìùò +4ÈPÂß}.ã;{nË~,‡JÁ8=©¾çáž’ÈRñMñÆEE?sYp%4ûE ÊB„éW•M¢¤«´Å©u>Ú‰‰Ð;&碛 QŽJi&šQcz%vÓ’±Š«†ÐÌ®»ÈýjËŸ ÷¨]³Î«?1ð˜0Ô&°×é,]¸‘÷¿æZa(Æê”C5’.2dLè¹Z–AÉú¬qˆ¢rÏÊà ~aŒ}=±¬©ddvUrÐä¿  Ó +wvÊDÕÈs¸œÁÕ‡å‡R\¾íË͹¢ÖR7ääÐþÞ»Õû'BP+.š}uQˆ2„vù1ÍRQë¿œ–7¤ÅRR +Êù#uáýËê(uÛBå ª ±_#P‘›ôæ-†ì—`™h{ó +DgñW•?î%“ÀS~> endobj -4027 0 obj << +4129 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [236.346 576.833 338.096 588.522] +/Rect [239.404 576.606 344.135 588.295] /Subtype/Link/A<> >> endobj -4028 0 obj << +4130 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [334.765 549.734 539.579 561.424] +/Rect [321.437 535.958 494.999 547.648] /Subtype /Link /A << /S /GoTo /D (compiling) >> >> endobj -4029 0 obj << +4133 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 538.306 119.763 547.875] +/Rect [84.043 210.639 145.278 222.329] /Subtype /Link -/A << /S /GoTo /D (compiling) >> +/A << /S /GoTo /D (smbconfminimal) >> >> endobj -4025 0 obj << -/D [4023 0 R /XYZ 85.039 786.531 null] +4135 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [452.256 65.988 513.491 77.677] +/Subtype /Link +/A << /S /GoTo /D (simple-example) >> +>> endobj +4127 0 obj << +/D [4125 0 R /XYZ 85.039 786.531 null] >> endobj 38 0 obj << -/D [4023 0 R /XYZ 85.039 766.606 null] +/D [4125 0 R /XYZ 85.039 766.606 null] >> endobj -3018 0 obj << -/D [4023 0 R /XYZ 85.039 662.883 null] +3079 0 obj << +/D [4125 0 R /XYZ 85.039 662.656 null] >> endobj 42 0 obj << -/D [4023 0 R /XYZ 85.039 662.883 null] +/D [4125 0 R /XYZ 85.039 662.656 null] >> endobj -4026 0 obj << -/D [4023 0 R /XYZ 85.039 617.808 null] +4128 0 obj << +/D [4125 0 R /XYZ 85.039 617.581 null] >> endobj 46 0 obj << -/D [4023 0 R /XYZ 85.039 466.627 null] +/D [4125 0 R /XYZ 85.039 520.515 null] >> endobj -4030 0 obj << -/D [4023 0 R /XYZ 85.039 422.877 null] +4131 0 obj << +/D [4125 0 R /XYZ 85.039 476.765 null] >> endobj 50 0 obj << -/D [4023 0 R /XYZ 85.039 343.534 null] +/D [4125 0 R /XYZ 85.039 397.34 null] >> endobj -4031 0 obj << -/D [4023 0 R /XYZ 85.039 306.667 null] +4132 0 obj << +/D [4125 0 R /XYZ 85.039 360.473 null] >> endobj -4032 0 obj << -/D [4023 0 R /XYZ 276.614 216.978 null] +54 0 obj << +/D [4125 0 R /XYZ 85.039 196.37 null] >> endobj -4033 0 obj << -/D [4023 0 R /XYZ 85.039 94.508 null] +4134 0 obj << +/D [4125 0 R /XYZ 85.039 161.625 null] >> endobj -4022 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +4124 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4037 0 obj << -/Length 2445 +4141 0 obj << +/Length 1824 /Filter /FlateDecode >> stream -xÚYëã¶ÿ¾…´ˆ ÄZIÔ3ß6í¥¹ä^½u±(.÷¶e[==IÞÅþ÷%ÊZo€"¸˜ŽÈ™áÌof¸þƒÿüE¹žÊI»‘òÛêÆ[`åŸ7¾p¬„eeñü´¾¹ý9Š¾çf^¶Xï‡}2ϲx±Þ}qþþËݧõ›ÏË•RÊ Üå*IRç—Ë u˜¸þÈ¿o?ܯ—©rîÞ½cÂ݇Çrå;o–¾ D¸¿{³Ÿ|·üºþõæÍzÔÒÅW -åüãæËWo±~½ñ\•¥‹'{®Ÿe‹ê&Œ”…JæåÍýÍ¿†½x-\ðW/™%R©¥jn?zÁ.QäÆaBvy¯¿¡ rV¨CUÎ-(E„ÐyÆÅæÌ«' Ÿ{÷Gû“ -Ù6÷LýÝóCà.e›¢–¯€vÚ¶iÛ|Ûó·.õV–~÷"ïÜu‰ÔgþÔlq›ã¸Ñ·†Ãg ßù.^e$®ÖB%^¦¡Ó´ËU‚¬M›ãȃ-÷ðUÓVº/ššiz³„/Aåžç¤^¾=·ÅO…¥gYäè‹úÐñÞ¼3…pðåØTÄÜ}µö<¢À,‰Ïêçšc’\ïI³oséja¸ðo‘àa†wÏKíaÁƒÏ–«î•Å>w•Ë=ÑŒßÝCÔ²ò*ôœs±òÕÀu¯Ùôw—rúAà*ö„“^rb³¾†¹Töx–{%êâ,s½Š xóH‰“À#HàløŽï‚‹­@Y€ƒ n¦CŽÑ-Ü=ÄÍ 0<Ã!…B;Ox•ìLäDìÙ?z‘ÆÍÚêšv àšÿ'Ú¡†š|OÎfuDrjzïú 9߯GƒÁòÑ$-nqrÔ(õÁhm9±ÉT¤Öþ/Wb:‚@óZH,^ùnEVDG x–†6^a­Ežsÿ°Ì(S³Ö×d¯_b乊+a¦Ü4ô9<,}ÏM©~ -’È‘ø@ü·Æ¼šoVÝa|¦ Øçíž -¤2þà'ǼA†B\;@1ùÌœý[÷ù¸ÏåÁX{|²jܨ¥E½ãÙDº: -|X!¥@8á†sm$~¶Med*Ê‚"çSæu½.K)2¦ 3¹[›ƒdå0ÀÚ·Me­±·Wa -~@¦`]B² ¦ç0¹tbäúï™?Œ0 Ó‹ëžp‡pºá ÅÓÀ®ž…glÕ€ôd“>'[îx,¹à¨`šÔÄÚÏÊB?rƒ~U径5.´ᘔ…½²Ø)ÂÕ¤,¼ØwìûÓ··e³Õå±éú3Ï¿½&RÄC0fÖÄ0ÏL„ È\î4Ôð]„EÏ´ý8¤öiâ“%DTã¶íKÁõ¡ÁýÂ(«œ º…är<ºï5'TžC·CÜsÀÆÕ=šïYt-õ%®¼ý$©·Î·¦c“š*-‘Ž—#rn¤Ñ¥ šÚú’îo~ò P×æé­Rv†J=l÷8‹ tL³¬ 3<Ù»åU%P9ŸÈy©®žë(žt7"aÓ㺎†[ÍäÀŸèŽ%¤tÀÕ¢ùZd’ÂFC -Ä ß÷à@©w‘úLU}‹I2bi4ÒâCÍ3§ËMÑÛæ×=ú„ ¯•,ÏP8…® -c«dQ€/aHá¤ì¯}æ&%/º~È;@b,€AwäŽ yîéô£] Ýà¬UìòöàãŠ~Ð`C›öº~#Ï°…)ˆR7KX¿¿‚r¬»j³-‹¼îyºzÇ¿Ï ¢"!u¾¢3Ç[ý‡ò&Æ°µÀ‘2_¹ãé!ïy°1uÍ4ÿLº$$ ¾ò.›øœâ%Ž$O®³ôF”p…žk¼xšpésÆ!v¨¾XQKesÓ{†¦þ^ŽïíŸ6’G›þ8„=P‹î''f ATh%béå*-óþŒ1†Ž{‰* ¬ÆÉLŠŽ'väfgÇDÂIÜT—\ØðlÃÀê[áús¸1<Ž9sá`z½*¡œòB}7šQù®ßSþ€‚°µ2 E“Ø+în|ùëÎCí…9«ã߇ýÃß÷–/WpÔ5Cƒ3fÌ ï÷a6CA \ç±ÊÊØ©|Á ’x}K½ðøn‘S?™Xiy!Ä ÖªTºf¾y8ѽՌðmþÇÙ< p{œ)³6Åå„lÇk›wGQ®èç xà_‡&¬-(úÏx#À¼5±‰¶ƒ>?n c™n0‰±ÇQï°ù+?…ØK'nOµ£ÏƘrµäãk—,›á-ÌÃÆ -èCbI2–š=0›Ü¿ú÷ß$ë7cö7¼RVÜ/wÉõb–LG¹yÊêæ’ÜxëFd%ýf -Pnê5U« w¦ŸÖNçr?ºWr\ä†ü’Ëÿ”y¢þÿÿz2$Êr`\é*Kâ$4 †*˜71üW–¹Äÿübaendstream +xÚµXYsÛ6~ׯP§¥f"˜xf¦jê$NꤵÕÉtÜ<À%qÌC%©¸þ÷ݤ.ÚMÇÍøAàb±»ØãÛ…åØ…?9Ž|áêxFðµ'Åȯ`çÍHZwì 7ðqë§ùè쵌¥+b7Ï—Ä2_Ü8¯ÞÎ~Ÿ_M¦ZkG‰É4 #çíljŠœOLœäß‹×óI¤Ù/¿0aöágË1™Jç|"` Âõì¾~Bòlòyþnt>ß³jê /ÐhÖ_£›Ïîx–¿¹BÇÑøÖ®q<.Fž¯…ïiû®G¿õRxÏó©ËO;Ž©rE¨Ô©º0­:}¤NŸ¨£¥ˆc5¤Iz¾ýp< …ûÇ¿éDáüoð—)ÐaXå)úуxÈ—Çþ |:ìî+z\ðŒB’3\f…É™Ö ­À@ߊ¤*—ÇŠâ@H%xY»RD rª[z»\‹Œ¹YåÕ­É?£&r):<¦­ûª¾[ÕÕv3™úÊw~äŸOïß ð–i{›U ³”¦HÎ\þñavyÞS¡pc>vÓ¬MÊ!íÓ®„œµÅæ@D´'B}ˆâáØ£~(b|%Ýrì+*@ Oƒù;!Çæq“µ‹c+4‡ÏG¿©öe•/Òš\5cEúÀaIUiÙøìºê‚Y›rQ¼^fyÚßœè‹(ÀE(μSœ*¸•|Ô`œTøÿ!zB”A|QÏ…²jAàb¹Ã¬Øä@´JN ¨Êy q;V-=ð«ÿ UÀ¦èÿŽ)þryñóùìjþv¨º×~ÍPq¯¶ic3µº;WVìuj–»Ìø‚FzR)¿ikªp‡ÑƒÑž¯3ˆ¦çjçžâŒQΑà9†Ö†ùž)ë2MÚ¬*&ÜNTìà»NÓ÷ø@½2¾Þ– $ò¸AZ¬g0h¼iqÁ§Úµi»UÊ‹þâIj¥Á8Dà{g5¥†x*”cnskˆíKÆq lè’t4I­k \°£BAžÛÔ­wœ .IEÞ)à¥g_5µPȠ̃׼äh4­ªöû >ž\[ǵ}e¥mrÖª™³'~: “þ+t’Š:êâ­C‡Éì>¦Øþ\óWÒ;àS¸¶-·‘hß4(oLô¾ƒô8ÁtF‹þ àß•<·Zpíþµ”‚›\Ys² §ž´§Îo8Bæo10›Ìrà Yag®K;!—>2˜•á Bñè½îô—Ý‚k¦~rŽ—và†Ïd¬É ê[SM¬ú$ýnò•žzä nkõyÿîƒ1<ØMŸl Z¼:ÝÓï?ÿÑÿkendstream endobj -4036 0 obj << +4140 0 obj << /Type /Page -/Contents 4037 0 R -/Resources 4035 0 R +/Contents 4141 0 R +/Resources 4139 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4034 0 R -/Annots [ 4039 0 R 4040 0 R 4043 0 R ] +/Parent 4136 0 R +/Annots [ 4145 0 R 4146 0 R ] >> endobj -4039 0 obj << +4145 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [491.495 724.825 539.579 737.727] +/Rect [481.285 343.796 539.579 355.485] /Subtype /Link /A << /S /GoTo /D (securing-samba) >> >> endobj -4040 0 obj << +4146 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 714.003 123.308 723.572] +/Rect [84.043 330.247 161.168 341.936] /Subtype /Link /A << /S /GoTo /D (securing-samba) >> >> endobj -4043 0 obj << +4142 0 obj << +/D [4140 0 R /XYZ 85.039 786.531 null] +>> endobj +4137 0 obj << +/D [4140 0 R /XYZ 85.039 763.817 null] +>> endobj +4143 0 obj << +/D [4140 0 R /XYZ 296.705 769.79 null] +>> endobj +4138 0 obj << +/D [4140 0 R /XYZ 85.039 576.984 null] +>> endobj +4144 0 obj << +/D [4140 0 R /XYZ 274.614 582.957 null] +>> endobj +58 0 obj << +/D [4140 0 R /XYZ 85.039 315.978 null] +>> endobj +4147 0 obj << +/D [4140 0 R /XYZ 85.039 281.834 null] +>> endobj +4139 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F59 3455 0 R /F20 3021 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4150 0 obj << +/Length 2396 +/Filter /FlateDecode +>> +stream +xÚ¥YÝ“Û¸ ß¿Â}gb®(R•·½4½ËM.—f·“vÒ<ж¼ÖU¶|’|Ûýï‹/}ÙÚäf:™Y‘ ‚øàèEÿôÂÅ*4Ù"u‰Š^l7áâV~¼ÑÂ.¬ +“—~x¸¹ý[œ,t¨²0[<ìˆåaû%xóÓÝLJ·Ÿ–+cL©å*M]ðÓ¯ËÈŸ™øð+ß}¸X:ܽÏ„»ŽåJo—:"Üßý³|·üúðóÍÛ‡‘V+«lbP­ßo¾| [Ðüç›P™Ì-ž`*e‹ÃŠ­‘yysó÷^ +¯Ùïš¹üªãXéLeQ¼‚ø5y‰ì*Šì”ïk4ôµ=¦z"wŽ–LÃàc™{Òduî·<ênn¬¹Œ+\>à&–=ÑÍ‘†žÃï¦:tey ŽC˜°“Br]´bÂÐu¹Öu…Oì9Ùê[œ(D«â(!Œ´B¾ðÂ.ðϘPE6Z¬’T¥6a\Â…úQ8>ýÈaæ c߶§×··eµñå¾jÚ×Y¨o/ÏÐœ‘âl„z/ÃÛ3T±6§|êcµD˜>È#n$Ã\fVõZ1ãä°Ø)£µ0òS²6éÃÖZGïÞh’œàw`H%Þ't Ÿ0YÒÓ¾R\°öÌˆË k + c«ÝêøHD„‹]ží¤CÈ:a<±Ó¶àG`èmÖy §Zw n{„iœLC}бÈé£psùã–`=pâd€} +úö€“ AéůD–§ë<3ñÝÇÕðî9åáô'0ÚˆíÉÈ´ˆïÔ]“!®´ÌÞŸð¯Eñvïå%]Ÿ)Þ!ILV®çbº O*´=’^‚Q-çu€U¤ä óM=âl0{mʸZº»àÇù—N¾!/>1Îl™Ú%hÞ° ^ÀmO¨n¡(Dêåè’Yל¡æàTâ°ê¡n„]Þ0D“Ý çÓËUºrÙ9ÓÏFä/UÝ¥¡$ aZ”*ÁXð{¼êbŸ) ûD! +æÓ(˜ípMZÙUç>ÅxÈú­"*—!…:•š¼˃OßÂÃ7{š¼U8ÆD¯ý²ÑŽ ²C5—¦p‡4¡;$.xØ£ÊI†H´^ÆT‡àô3%`¸[BA¹=PP4+ƨ)TF•ëàͶ¦íbÇDãY«òÊ:M”IøóY`"&NH)(í…Úhe]4) ­¯N hªm¼'4E¿'³÷~iBxšØIÆsÿá J6k 4d¤;'ˆËB¸Gì^ø|£Oá†úÛx_U8¨* +R̹ Ùûº ó†I}JÀI·Jc† .I‘g]ÊJWé ûea®jÊ·¬Ä(e‘&y=}°À’ÿ—Á§K',~thU–Œå\³Á)ðVs¥7–1:xÍÁ}Qr¬¬Q‰I‰ñ/àÁ(šÃzSù±åéê=Ÿ¡xÃÄÄü}ü;Q ‰úYý Iଯ¸«sɯںDÐ+ç‰çO)©˜€ T"ŒExŠ%ëÒ:Útäï݇#ѵc“c5ºÊÂ(x·›î£“·¹cy…¶z&J½~Õ!o÷}Á{ Ó»vGÁ…-ò×8Ü´åó|Á]y—µ©tã”Ü.¹É÷pxEÈ»e"× 0ðeSñhÈÅ€¸çÎÖ¹lh…«÷ Nž8=#ùâÍ äZ¸:gÄÓ7+•(QQ)ÄÏùÂ"÷òSf qû§n^qŽjº×Ð7@¤ +[>S–Góð›èôÃ_;B(äfZ ô4”ªèiJT4éK†ŠRQ…ªmFvªWe>DNÉÛx©¯ØbH%Å894߯Dä]Ì [f”*FÓžYëü÷soø¶a¢¬ÍÔZwÉtקjà¤~¾P\ˆæ‡×îè,ºzw”Ì…A˜ ’h„™Qi 7‡¥‰P+ø ØB;"i¶ˆU&²ó@AÙ®§…# k¦nó®­zÔÁ¥M·¬°‘­d|¿%!Ћîn|åQÌ­ ¢W+ÝÍ”MõÄhžnÆXçw~ǨÅ@Ýö-4Ä/? WT•` p Ö:ΔƒãØ0«3¦Ó1„x×Ñ%©ÀË']Êð;¨Wõ»šù-‘JR÷BueÊ$ß+¬oª#ÔÕRÐCEÀÇF ž?ÿøðîŸ> endobj +4153 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [414.285 436.223 536.549 448.216] +/Rect [414.285 650.337 536.549 662.329] /Subtype/Link/A<> >> endobj -4038 0 obj << -/D [4036 0 R /XYZ 85.039 786.531 null] +4154 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [316.663 542.246 539.579 553.936] +/Subtype /Link +/A << /S /GoTo /D (SWAT) >> >> endobj -54 0 obj << -/D [4036 0 R /XYZ 85.039 699.735 null] +4155 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 530.818 142.211 540.387] +/Subtype /Link +/A << /S /GoTo /D (SWAT) >> >> endobj -4041 0 obj << -/D [4036 0 R /XYZ 85.039 663.47 null] +4151 0 obj << +/D [4149 0 R /XYZ 85.039 786.531 null] >> endobj -58 0 obj << -/D [4036 0 R /XYZ 85.039 553.36 null] +62 0 obj << +/D [4149 0 R /XYZ 85.039 766.606 null] >> endobj -4042 0 obj << -/D [4036 0 R /XYZ 85.039 520.939 null] +4152 0 obj << +/D [4149 0 R /XYZ 85.039 748.602 null] >> endobj -62 0 obj << -/D [4036 0 R /XYZ 85.039 341.909 null] +66 0 obj << +/D [4149 0 R /XYZ 85.039 515.375 null] >> endobj -4044 0 obj << -/D [4036 0 R /XYZ 85.039 296.835 null] +4156 0 obj << +/D [4149 0 R /XYZ 85.039 473.09 null] >> endobj -4035 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R /F62 4047 0 R >> +70 0 obj << +/D [4149 0 R /XYZ 85.039 245.314 null] +>> endobj +4160 0 obj << +/D [4149 0 R /XYZ 85.039 205.151 null] +>> endobj +4148 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F59 3455 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4050 0 obj << -/Length 1571 +4163 0 obj << +/Length 1720 /Filter /FlateDecode >> stream -xÚ­XßoÛ6~÷_! &3-Š¤~ôaCÚ&k‹¶Yyhû Û²¥U–\INšÿ~wô¶hM:´ë,VcÊ–ê<#ÁÞ¢“a®ÃZ{ nü³o»Ó¾ŸŒHâS^ou$íÐyP9uE‚ÂüÅÃ¬Í b~B6¯¼XºuCúÚê÷t»+ ,!¤ö×EŠ‚CñÁóÑè8\¤”é¤ÕjÄTYo¬ËxM1mËZ£ª½s!ÿ û¯2“{¤¬žÑ/*áR{Ö`‘ÛÙÏýfwAŽ"»UƒÈÿàn¹ë8xÌU4êò®®ËßçìïÀMsº(3Mm§S*P1‹ƒó×@g´* *!S¡©ŠÛ<í(µ_¯)ùu'•ëÁѦ%ñ˺úÍhÞzÒËo¾‚ÚŸcŽ’©óíÎAe´xœ0)bºëÙ—jL:²ÕåußœNæ\ì…õaEGhœr|Íd@=j÷:‹š[[ú:YÙŒ0/L[›OŸ¢Û>,|²ÚZ¯du• Z®²5˺4¯[^t#íÒðõci«ávýRÚ6˜kbÑ Ö}sÕ±±ìþ¢ó-Í@g”¼9H$ yG†¼_ÔÛ-¾ôñòeÓ+·cÞ+g½9èŒVPß÷<²”|h,벤®¢oN¾íí­¶º§îÚè¾{i÷™YÛdæã ×í´ ¾Ül±½yOè˜ :KÕ€‰“¥Nå ©èÚv`úɽšÞÚþ¸Æ&ÕL1véB¹ŠS(Ã}ƒü§ÿr8t’1KâàôU)xîÃHZgð®„8vX‰˜©Xœðø_Œ–+ßendstream +xÚ¥XmoÛ6þî_á*#ŠÔ[?lHÓ¬KÑ&]í!º~m9"‰®$'Ë~ýî…²åØiA"òx<žž;>wŠûð#ÇI(|•Žã$¡’ãy5òÇ·°òn$­†?ÖÂB\z3þFcé‹ÔOÇÓ%©L_œóßÎ>M/>»žRÊ „ëÅqâüví‰sÃÂé5?/¯&S7QÎÙ‡,8»zk5\O:®t@“³0{ƒâ3÷ëôýèb:ðÊÓBG +Ýú6úòÕ/Àó÷#_¨4?ÀØ2MÇÕH‡J„ZÙy9šŒ~ßZá5=æ]G^Þë5<å‹$Ñ[dx…‹À߬B‡×0*s½v=­µs¹ä—êV°’ãX;\]þÉÒ•i;–°ÜòpŽÛ³rki @’ÁÑ2ŽDªíù³¬š¬´çŸÒBF‘UÊêšœŒO¹wÃN)ì gn‹šguVåC¿Ž8(¯÷`Ùä‹#Z$¾²:'lú“ÃlxòÀ“Ò:ÑáôqízAìä¯Ù ôT˜ +&=­D¤"2ü“ë…Aè´Õl^yÝñôô”`9í]{’E1ìÂã‰ï))tlƒ€X ¥£aÐB¾‡:uÎM]çsŒc¦ââEÎç¼2]΢ÉÇ7<8G¸ÉWëÙ1'bxkùýÌ»2ˆØõ%¤XÖñhÂù(ÎpÄ¢åçÊM wnéܲ˜²ŽÄMNã®|Äß) $qæY ’DS ýxHÜÕÖ 4ðhdž ddoNÉÜ’å•õv‰‡j01Ý*o¬MŒ&Òµ€´†d¼¡]+p`CŒ$ÞÒ”ó‘õ%_3I À¼*ÈÄ7²'8‡5Á¡½˜0jW7SŠ†)è vkY´]¾à1ºVóp{×a|E‡v&¬¹ëŠÛJf”î¦ÁMŒ4ÿµššŸ€>o¼ÁÔËŒÚ|{CŸ2€¯²±TT°@!ßHBfV÷¨u‚i‹¸šâzˆKÇіmÚ¯Y¢hi?†òÞe„pF:KÚ_±^†›û(Ã"å_Ç©c9ÑX•W°JìJ‘àwb^õo$z‚Xø)ðñ@´eè tE{×òl—}0ÁèKí¼½žœðˆ2®^l_•È-X»ÆÌ9 X¸C›™ÄkžpˆóÝñ¦¶“1k¡#›ºvï\âëYULã h7sÌÙÕ±«ÐãN4Ï_ÿ-•þ™¹²Î-in0Š8X¼æ'*áo›7÷yƒe¡ŸpŸ¿?$¦Cö²KcSXŒðomEÈÅ­x©¿åº“ಠãg}^Sâêžý5øiOXeNÕð°„q ‚äE%$²%䆩*õ @OÔ­,©@2´,~kêWVóÆUHÊw€R¤óË1Eœ>ç_(¤üAuù Ç D )ÓUÇS"³¬HíñÙÐ=Ί®D"ìàP6·c|~÷7ÎWÙzKß ¢Ô‰mJÒÁŽ0qÚmSd¦ Mœ ônHÔŽÓs°K ˜ß•ÔÞt®†‘Ð2eW{ðžw93P:ôm[ìŽ Já”ÚŽï.†í¹^ZжÅ˾eG$ÿÔ9ÈÚT/Æ!(1ôAD!©)} Z ÉΖÎ\¼„´Òù.²m,ûsbÊ{Ê\»0N?5813$ý¼jŸ¾ŸH)à"÷>ýï¨ðXã:«¬å­ÝyÍS`PbÕœŠZ»¤2ÏMOÈå¼í êR 7W!z‚6£Ì•× |ð5Jöhëm m™-v Juß ”hä¡Xäø@÷—o*¬•°²¸£šŠÎá"wz8²¹Öð Û5]1ß”Ù@ÔX¬ñôŠÍî™Gß¾mrLÅ(pZcU¸CÃáðîkµ+g¸¶n M›yWØÒX’˜€Y9 fºi*b™Äç%Óɶ‘ šÇB0Ï[ñ@¦­ÅÈö9+K»ÁP¿SE)•mÎ{°Õ¤Àq^ÏÍÆŒŸ +¤>€•œ& ·d[·­öнئ^<Ó¡ò7~غ-”á§ÁF°™ÛØëoöoIŸqðEøÏ•¡>—"ù£2o¿dªŠº®0MÃõ¥}ágÊ´o ²ävʇ‚Üë³HÒÔ»/aË(ªÿ:†?›¼_k¬MÌ”¬hí§2©7½½uŸ© :Þ º©Ÿô¯‡ÔÂ*+Ê“)jøÅ‘B›†" ÔñØ xÙ?,4ô +*ܦÓwÑVú d°Î^9û‡>I¡endstream endobj -4049 0 obj << +4162 0 obj << /Type /Page -/Contents 4050 0 R -/Resources 4048 0 R +/Contents 4163 0 R +/Resources 4161 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4034 0 R -/Annots [ 4055 0 R 4056 0 R ] +/Parent 4136 0 R +/Annots [ 4167 0 R 4168 0 R 4169 0 R ] >> endobj -4055 0 obj << +4167 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [263.502 186.32 308.646 198.01] +/Rect [198.407 267.858 356.818 279.548] /Subtype /Link /A << /S /GoTo /D (diagnosis) >> >> endobj -4056 0 obj << +4168 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 172.771 249.377 184.461] +/Rect [498.768 267.858 539.579 279.548] /Subtype /Link /A << /S /GoTo /D (problems) >> >> endobj -4051 0 obj << -/D [4049 0 R /XYZ 85.039 786.531 null] ->> endobj -66 0 obj << -/D [4049 0 R /XYZ 85.039 766.606 null] ->> endobj -4052 0 obj << -/D [4049 0 R /XYZ 85.039 742.055 null] ->> endobj -70 0 obj << -/D [4049 0 R /XYZ 85.039 532.739 null] +4169 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 254.309 289.603 265.998] +/Subtype /Link +/A << /S /GoTo /D (problems) >> >> endobj -4053 0 obj << -/D [4049 0 R /XYZ 85.039 487.664 null] +4164 0 obj << +/D [4162 0 R /XYZ 85.039 786.531 null] >> endobj 74 0 obj << -/D [4049 0 R /XYZ 85.039 258.821 null] +/D [4162 0 R /XYZ 85.039 682.022 null] >> endobj -4054 0 obj << -/D [4049 0 R /XYZ 85.039 213.747 null] +4165 0 obj << +/D [4162 0 R /XYZ 85.039 639.737 null] >> endobj 78 0 obj << -/D [4049 0 R /XYZ 85.039 143.779 null] +/D [4162 0 R /XYZ 85.039 340.359 null] >> endobj -4057 0 obj << -/D [4049 0 R /XYZ 85.039 103.615 null] +4166 0 obj << +/D [4162 0 R /XYZ 85.039 295.284 null] >> endobj -4048 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F35 2976 0 R /F15 2972 0 R >> +82 0 obj << +/D [4162 0 R /XYZ 85.039 198.218 null] +>> endobj +4170 0 obj << +/D [4162 0 R /XYZ 85.039 158.054 null] +>> endobj +4161 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F20 3021 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4060 0 obj << -/Length 2124 +4173 0 obj << +/Length 2214 /Filter /FlateDecode >> stream -xÚ­XK“ã4¾çW¤ö‚Sµ1–eùÁmØ]`©}j‹šØ“¸&±³¶³aþ=ýd'±³`‹±Ôjµº?õKóþ‰yªü@fó$}%Å|½Ÿó ¬ü8†ciX–žïW³oPñ\~dóÕ£““¾Êâù*ÿÓ{õÓÝ/«7¿-–RJ/ôË$I½Ÿ>.ÂÔûÄÄÕGþ¾ýp¿Z¤Ò»{÷Ž w^ŽÅRxoÂ"Üß½‡Ù÷H¾[ü½úyöfå4Ø"¤D=?Ïþü;˜ç`ÓϳÀ—Y:?Á8ðE–Í÷³HI_EÒÌw³ûÙ¯N¯EsÞ5‹åXŠÌÏBuº8öã vÐ…°*üL©!tJùq”t¡Ÿø`¦Ð” -¼w0Ö xͦâÄ«Žû^H4HŒ½ú‘[³–óô@;k"­‹¶-Ú)àÀ"ÊÛ–ô#Rº£‘ 6Ì [óåã‡."ˆV{Ð*f<)ÀÚ©DÜèp£-¸ÿ„\ó*â~מ8ŽÞ°Œ¼%(R -w5ûß–¸ó]ÁSŠ\ÿÔ·(ƒœ¡!å?#ŸÓŽ¹g{žqB¸¼­¢ç1W@@¢¬,*ë®Ä«Bþ¦ø Gt†7ù A$´Í‰¬§ üq’OÌ}ÀêJ9`܆GŒÕ†Ç…^£þ[Þ³Þ•‡§™ã.B±*hLJdHàUQ¤¼•M)ªq)ž¶(÷™Q·ÎIݘ+àœXX—#’¹5Ê:ºˆ ºHhíÞ¿4+•¹ÛaøÁôÀ¾ÖðŒÌÁh, Äl5-]]Óefb«mò¥01ÉW†â";¡9V<  †½câ¸áµ3ïGB®‹½ÃŸî ¥—ºÙÂ:Bî c٬ŶÀã‰=¤ª;”ök4zè%…q"0¬æû¢=nݘ#Ô\øŠ|x ³+ö\£™ÛÁèÖFhŸfû°åTÌNCâ= V˪½ÈþD[¤"hpÂÛ½ñ€g²ÁSúR%† ^h¼5\Ù¢ºÔA¨Ø¡é¶›¿ÚÔJ?‹ÔhK»´²–a×ÚŠ6'É™ºõagúǧ+³Ø Ûþ_4²n+ 4IÏ,¬´ˆQšy?,L]R5]0%uønŠŽÖ"½ãîù÷×è¿ð¤uæâ­˜5uÒ<ÑyÞØy!»à¿ä±ïKà±ä #:|qúÓ4½èÇpLQÒ^éŠã-¦Ú A\n*ækÈK)íù‹ …ØO“ì¦x&[÷(½ùùö¾ÈlW È2 Çl}ÀDÆåàÉ&š/åšÒ”²©œÎ7ï>Qož\—4èô›>{îžiäQmÞ{ýdš]d$i¤Š!”Ý7­•QýˆóÐÑ ËY)~?Ød~&µ5’vÖ$`}Дrž®*k½ÌëEÓë…Íåšà2R…N…k˜Ô¾ CÓ5È5†^VY› Þ6<îTboŒT›õH‰ÓÀ [´qM„”\‚ŒÞ;Âû­Ð9oè{cœ}¼ÉÌù 8ÒCiI© MÔÜ‹`×óX›ú˜ÇZëz)îŸjÓƒPñ­yñì¾.;«i£b}֘ǽêDl„`Zrû>à™ÌßÈ(i ò·´ùZÓ‘ãÍšk•‚ƒœ£þÉ,Òcã|=ˆy÷˜ç¶.â$öƒ¶«2L®ÿ2ojáÙ:¾/Û¾oD·ØPkÓI™WÿRkœÞ¡ç!"1AÂé! - CrUá‚ØOUzó@ËsuâìB„¾áÙ‰6Ͳ3ºµu‰€PùÂÎ× _Ñã¹ø§l;zÇQ·ª Yž¸¨´Ù‚zcHݶm 9iñ¡ýO>DçãÞhbrnÇrmæù*ØÓ§õXŸ7u§|(ÇÖýj–Út¹ŽŒðuͳ«V©yÂW¯ÏßI´fe_ F?qÁ¤×b°ó h'æ<ûS“yä‰éìþé…ë§ilºv5¸…Pj×ÉþÊj™9Pq| 7ÚMçÚ‚­TV#þa¶fvû.ÖyÿÆÂèîŸYô~¥Á•ÌþOÏ뀭;—lì/)Ò‚Póoaå=ª§*BC#†7}yÀ3íÌ–ékÞ|ë@çΗ'ŽúóðÄÕvpý}Œ½˜%9³{-÷åØ!o®>çòk¡tc^è”t¦ •Š:÷áö¶ÿô{|_©S?K'@RÐøÄId•AŒdt©°’©¯R9¢ñ¿ï­×^endstream +xÚÍÙnãFòÝ_!äe) êìæ•7gf’L0×ÆZ ™<´)Ú",’’ÅÀ~üÖÕ$%Ñ΂؀Ù]U캦ƒ…¿Á"”¯³E’Æ*ÒÁ"¯®üÅ=`~º +„Â_åÇ¢~X_}÷c/_e~¶XßÉzó›÷âçëëW¿.WZk/TËU’¤ÞÏï—aê}dàú=?_¿»Y/Sí]¿yÀëw/…b¹ +¼WËÀÜ\¿…ݾ^þ¾þåêÕz"ÕÊ(këóÕo¿û‹ HþË•¯t–.Ž°öUe‹êÊDZEFË~wusõïáÆ™¿5£üÊQ¬‚Lea4o $Ê…MMªD:'Š|ï ¬íRû^{_€ºqâ½;T·° +¼¢e@sÇÏHµAHì}hÚæE‡È¢›1O¨thžW* qƒhÆ£7¶BïÝZäœÐ M Ì:\•nÑwˆEVØbÛCó¦•Õ¾DsßÚŠ^ûŒàû^Í<–+ø»‚o‘8å“çQ¶Þ0£cY3S#Á Ó3‰¶ìD¸­Hƒz€~À¥` q,Ú/ø*˜¬InEßgdŽª@ŠŽè,z,Láx[TM ’…x ø&Ä7A¾aš_¤#¾¸èè4sâѲ4t~wÂ`0¼ð±¸Þ0þÄ~Š1Kꀨ}ÏZ“ýv¬áŒîyS 9ÔèzŠÛãOÅd=º°€ã ð²©l)È ÉÙ·ÍnàÔºRŽe˜(ÒY¾†p +£x…¸-I<¨AÙ$b#£Ò@¢¶nz¦8‰é UA˜ I{ÆuM&»çc-š+Óòö#Ô(\E§aá„F?$!›‘€5ƒ±1Úñ cIzòqŠošZH:rØýN¶åZ=98—à¤wÄg‘<Û“O@´ã* U‘Æä"ðõ#¾ÞZÞ³ÇkQAþÄA@¦G|ÙË“'ÍÎí†(+(˶›ãÜ¥ÁÀ<õ°¢²¯€¡v ¬„à_<’¸ ˜˜‡6—`%äÿøAIâhfâxË©³2m¤ Àâ#ÀXzˆÖ¶ø|(¤ºÍçY¦kH£ ‰ŽÁ–´ƒEÞÔµÃå}Iñ“)§1VFÇÞëž_ìö–lQ»ù1vä=—W2a>T*ígÞÂ[&*lŽ‚o™7EØ®ƒt‚"sÖ­G‰+»)ÔŒm×[¬(h=Š0éq‹'>2PB7•`8ÅÄ ]ÃÏÊÖê-ð3®úV0µ¼¸'gP¨ø)ÕuîˆS³2—½^Ž&5ŽÜ +L?ZP&DfŒA\·ü< fà‰–õhêU‰ ¡‹=g1ä‹4ç®c=èO]¶h§|4ÅDÓ3Œ’7gÀžƒµpòóé†Ê™St¾¬­Fk•DR9»=Ù´ç:#¨“&Ù,#0V1S‚C(Á‰œóÉ|׎¨S9Ä%zÈv®1“ϹV`@q­à  åð‰y@ +výP$€] f¤ õUÄcÐ̈•$_5Ñ…2ÑáèÚRÝk–š–8¼½… ú9 <ª\³ç ¯>—'ˆBeÈÒ:Ðj•™hvœÌóR7ûÊ÷ò‡s!t¬ Ïü 2”{–à\˜²c‡O¯Ñ3Ók=?¾^c|…Ùص[J€\ Z$á¢å{Íí܈¶á7K9Sº†ïíš{†|ò³+äŒ#7:X7 +Ú4RÑ.EC0'þW:)LôN"Ìó&„@› +*r/ +ÿIJ6F.7cBïÇej<[îŠ ÛS>6áIYº/z® S}p€•ròŸ—¤(‹Þ—®q×Hg±Ô Ú¢“&øð“ÜaÓ6Æ{5MÄ¡ŒH@øÂÖu#§Ùn¸CÝ×nä@Èg,Ç2¬-ßÌŒÿÅëssXÊÕÔb±!d˜”sdûÀ˜Mñ¥Ìé +W6ìÿê™àˆª6(öÏ£ æ mÇN¹{Dƒ£žpú[û ¹Ät(‰#€Rç[ˆ™Œ˜'÷ŽTn1Úq#0è¨GTS®·Å3ªN¦xÚ˜L(>a¢à=´öLrYÖ”uЕ0ë˶G íû£ê±ï½¦}`ÜÆá¾p#ãÖ…˜c‰W! V*zýv³ŒÐÍÝi4ôËÄÄÿz~ƒ™Æj´2™»þЇíýZ@œC7wQ¬ àýä \BœäɦÓ _áJÉÓ“•P‡c2lŠÞÒEGbÜ]· ›‰¸te¼Ðûc‡vlîç‰Ùìqê²’‚2ä̼{ì؉ÕEo‹@©@?Ùá#¥“ø«Z¼–•y½¾À•LÂBã$Žýƒ¾è<ÒVòi'wÙS;AÜ5ü !‰ŽJÌõ;£cž/‘ë-w-¯us¿‡m=3;åöÐ \{;ºÝl=Œß4tRÈ +¦*»¹ÜæX‘jóýÌä¥!˜ÓdÎ-A¬tl&ýÀ3Ê«äüØH™HæŽóCeþ¬Ç¸ªÊÁµçå¼D͸ÏèÁŒ4l×Åe×ó¬°½%µ wk¡û›â­jiXå´Ö'ó²6¥nò®n$ÐÝ\þG0 ¥CþŸ§Tl°®ü£LNU]CU?¸¡ v.Ϲ€t}û8Ü^pÛðÓæùd¦œ;ûÌäÔó¦_ª°K6£·åuÎVXЛXŒÜ4¨§¬ï².™épu-¦:ùbÚArtƒ—7é mèŽÃ©ÇW]üôöl”mAWIèëyÃä¡t+ÙŽ¯å.Ç¡íbüB´ƒU›Ãn¨îÎpodй¥~O§ñUlþ‘Á)Öm{ò!à SƧiÏ )nÜp+d;\ØaM•ä™ôõ ”Ìl¾“Iðüµÿ„˜PÅz¼Î?k]\_™æÄÜÿÃâ-¬endstream endobj -4059 0 obj << +4172 0 obj << /Type /Page -/Contents 4060 0 R -/Resources 4058 0 R +/Contents 4173 0 R +/Resources 4171 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4034 0 R ->> endobj -4061 0 obj << -/D [4059 0 R /XYZ 85.039 786.531 null] ->> endobj -82 0 obj << -/D [4059 0 R /XYZ 85.039 766.606 null] +/Parent 4136 0 R >> endobj -4062 0 obj << -/D [4059 0 R /XYZ 85.039 746.277 null] +4174 0 obj << +/D [4172 0 R /XYZ 85.039 786.531 null] >> endobj 86 0 obj << -/D [4059 0 R /XYZ 85.039 540.921 null] +/D [4172 0 R /XYZ 85.039 766.606 null] >> endobj -4063 0 obj << -/D [4059 0 R /XYZ 85.039 492.833 null] +4175 0 obj << +/D [4172 0 R /XYZ 85.039 746.277 null] >> endobj 90 0 obj << -/D [4059 0 R /XYZ 85.039 423.575 null] +/D [4172 0 R /XYZ 85.039 540.921 null] >> endobj -4064 0 obj << -/D [4059 0 R /XYZ 85.039 391.154 null] +4176 0 obj << +/D [4172 0 R /XYZ 85.039 506.781 null] >> endobj -4058 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> +94 0 obj << +/D [4172 0 R /XYZ 85.039 396.875 null] +>> endobj +4177 0 obj << +/D [4172 0 R /XYZ 85.039 364.454 null] +>> endobj +4171 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F41 3054 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4067 0 obj << -/Length 396 +4180 0 obj << +/Length 370 /Filter /FlateDecode >> stream -xÚ}R=OÃ0Ýû+<ÚCÛ篬HÁÀB6ÄZ—D´i•˜ÿ' ­*¥w¾w÷ÞóY‚8 Kb‚l+NÞcå~%&„ÒZ©Ÿ)sµ0¸²g1Ga¥åTÂÜV«›µäDr0Iµ›…˜(„KGªí E`…Öœ® -Zh,}uÊû)ÝrÚç$4>LÐé­ï{­WwÕ·žo¦¨XœµÌI!ÐâU;F;0è–v„Tfi«&;"R%}b… Çà/)›š®’ÿ`Fr¡‰àPòrA®KiåH^5íÀ -Å Ý0iiSŸâ ßç³m»ÍAÇ’°’ÊúƒIG}>i§JÛ¥ÃpÌYhÚØ5N·´÷{_©ÓG³q·ô!äÊtÚǸî:?±îk?Oó(~¾ÅϾš¹ŸQÇ]ú×IÄ®3íN¤'YŽ¶·Qc´»IŸéMŒ­Y>\¸~Ô ð×ê/náú È  6ó¸ñè¿”h‡W8¿îÁÍ¿endstream +xÚ}R;oƒ0Þó+<ÚWÛ笕š*º”­ê@ƒSPóÿkc¨HD+$|ïî¾{ÂÃ'H®cAln@£ ûÓ†“¯àyÞˆ ¡4‚V*È+ÎlöfFWv ÃI†9(m¢ó±Ü> endobj -4068 0 obj << -/D [4066 0 R /XYZ 85.039 786.531 null] +4181 0 obj << +/D [4179 0 R /XYZ 85.039 786.531 null] >> endobj -94 0 obj << -/D [4066 0 R /XYZ 85.039 766.606 null] +98 0 obj << +/D [4179 0 R /XYZ 85.039 766.606 null] >> endobj -3019 0 obj << -/D [4066 0 R /XYZ 85.039 658.638 null] +3080 0 obj << +/D [4179 0 R /XYZ 85.039 658.638 null] >> endobj -98 0 obj << -/D [4066 0 R /XYZ 85.039 658.638 null] +102 0 obj << +/D [4179 0 R /XYZ 85.039 658.638 null] >> endobj -4069 0 obj << -/D [4066 0 R /XYZ 85.039 620.371 null] +4182 0 obj << +/D [4179 0 R /XYZ 85.039 620.371 null] >> endobj -4065 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +4178 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4072 0 obj << -/Length 252 +4185 0 obj << +/Length 238 /Filter /FlateDecode >> stream -xÚuP»N1ìï+\úŠ[v½Ûm ¨¸(N!D)H¤Kàû±“ƒ è%ÛÚÍì 9,‡\R@Î.&erËݺ w M Q)ÿ°ûA»À ²¤YÒdÒ©DÐÄ•³è›«Û€. ˜±ëß]ˆLÌi0ˆB®{ö-“ZF?ÚŽ-úûò`¹ÉCûÚ?œ4bŠU££@DË^ñQäi5~­ÚŽüX%Ì_ï¶/H²þ<ΆÃf·=‹:öE{³ÜWõæ¦ÿ 1e‹-ÌÅÄâÊ4ä¿è¿e°‚ð¹ RGsÍÁhÀjnâÔl—ii¼¶yºôüŒdÑendstream +xÚmP»N1ìï+\ÚÅ-ûð³ JTH¸ŠSQ +éø~öîèdÉkíÌŽg– ê!“ “r„ dÖ š­"w ý0|Þë{lÏhË’¡øêͲþ…û52¤T没þ+ /Ðk3Pšv8f§`¡`ùŸ]ÒµVmæt¹üsý¡^endstream endobj -4071 0 obj << +4184 0 obj << /Type /Page -/Contents 4072 0 R -/Resources 4070 0 R +/Contents 4185 0 R +/Resources 4183 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4034 0 R +/Parent 4187 0 R >> endobj -4073 0 obj << -/D [4071 0 R /XYZ 85.039 786.531 null] +4186 0 obj << +/D [4184 0 R /XYZ 85.039 786.531 null] >> endobj -102 0 obj << -/D [4071 0 R /XYZ 85.039 547.583 null] +106 0 obj << +/D [4184 0 R /XYZ 85.039 547.583 null] >> endobj -4070 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +4183 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4076 0 obj << -/Length 2702 +4190 0 obj << +/Length 2604 /Filter /FlateDecode >> stream -xÚ…Y[Û¸~ϯ˜î“ ¬UI¤,©/‹ÍnÒ¦h¶@gŠhûÀ±d›YòJr&ù÷=7Rôu0Àˆ—ÃsÈsýH§ ü¥e'ªz(ÊUœ«ôa½—<ÕÿŽt¼Xæy=6Ã×fX,ÕªˆžU}?@'‰š‘ÇLWsã±Y»H£iÓßyð3ô{h¦Q þûô×wžüÞ¼TØ}šÞÝ}@C»Oó‡4‰«¤ -w¯ò8Ï ÚýÓÎâþÔ*Z/²2Ú™Ã;iË4³¨<: ´µ¬ˆ¾BÃÖÐÛnƒÃÞL¶ï˜vh¶f¨ñlÝ–©Û®qm€Z^$A8õ^=âhÉ‘>íÌÄTÀÉìqÏØâÁ½!žÜyvœù8À ö•FÿIR½=Bc ¡5j”¶LÑ'*Ò„ª×š8€l°¨.Šègül×C?ö›‰»]CçxÅô¨›7õÞvxt:Æ„3fêž|űØØõ=ñΩ¢sRZÏͽÝFLBSÂÀ1výã(¨£2z6"ȶ­ æÃÿÓ è NÓ9s¿òÀ+XàGhjÌ&ܪíxÆð'0ŒŒ¬{Ó|s+§fØ8™E&Çó·ÈÌ ¼Èmàó#~“è‹…€¡­”¬®Q¤¢žqṞqrOj48_9¤x»Î€ÐtÒ¤3‘—A‡ã’›4ï,ÃÎÉ粦å)ÓŽ½0éy¤nÐÝ:g°,Ú¹`gÍqoÉ9“‘@NÀCMΟq=¹c}â¬À#J .r¤øVïqä |D6ÿÇ&_m®ècÛPpi:6Ÿ­ç9nõ¼É ];ò0‡­·f‡Á>³P8ˆR;³VWB^X#í&´bVÄIå¬ó:¥”UxÈZ¸Çè¤ó¯6ÔÎtÜ4gŸb™œèR n^™…ßI¢Û¼M:%o&äF¾ÜSî¡ä¨ÓB˜ä<– Eû¤‘ >‘³•­­ÍÁ`^k·Õšéÿ\‰Ø9mˆZ‡¦5“S±Xà ¿_(p/"êÒb].W*c3¶ÖÉb/Oí•ó%T´ßÍèJB‚šÇ‘¥K•U‘!y/$­f";þˆ4úáËn$ßy˜s,j¼ÂOÁ沊‚Fø¸ äA: w¼®ú>÷£Ð³IÌÁonXˆ>æôe¬Û1DÌæÈgk`É -íì»-~(ßï¬È)x9GM\’dœRVÍ«Ÿç -Ù9r !Ü+ëS¦Á¤¥ÆY\OAxàòÅ\¸rf…âháó’“,(¿‘pÕÀé]Ó„_Ï_Ú)mã5ˆ îIî ‡ùsV3zõÑ -¨ïÅ\:[I…:Üö‰C$UR©\& È¥ ñ‚ž¿^(šêxÆ©Ûƒ7ÅØwæ¹u]5 -³®'î9z˜ÍÊ›ÆÙÐW'0\˳Œyz:¿Eo°.ûH¨:@apSµ„àÄ£i[”e]v–ÃvTx&ž¤”4C#B#ÍÕ‚XÌyt€¤nN³;…ßfô}€à&>MßÅ70«ÎM'÷w@ãwªc¥Wfr_ âNsƒ>"‚F3x¨ÕjFÚïE+´Ó[¨Úq¾»Ã™æ&ªVe§pÇ  -Å™ v‘§lŒ¦ã;0nW噸pûâ3PÔì SrkGönYÊ>DèE5B9NÀPUEŸ®IÊxä4èŒy¹<€í©w) -{.U^Fí v¶óÎJ›øÝ ZÆu£yµiÑ.þ¥ $€î_¤ë|Ü-›únésg—À°ñD¼ôeR^Š•ƒ+ÙȵN¸\*dCÊ@åñ‰b†ì # IË„´=žÜ -ðp¥bă4ý\ô^Þúó†&… B´E%‰Ö’åd®¢ÑØݧJñ¹E~OüÙR^ê-BwÉDŸ¸·FXE’ŽCw«4¹h Ê4œW>‹®mt…X‹#ì™H À•~ï€i˜â¬ä>¹ñ`4/A–•üI²¬‡ÏÍ(²Ná ð€p <ò‡[04+KÀébù¬d܇C¾øQÇ´ÍŸøòóDßË:_âÁYUDîbé).6…ƒ"üHù‰˜ñ6 £4Ö“YÉ®üB6nM:ÙºíËÑF³§VEÞãVþ¨¢¿YÑï¥ÍÉ©âk*|¡ˆ¢›2ï§0AŽ–j€JÞV©\&UgaËÒ¾±@` Si/‘݃_Ôåòêü%uþ”*¿’ýσÏÇÀx;ã!<´3r€Ê#{>ÊÕ7³¹¢“ïdØ£xó 7 M?¬}ØÜ> -VèN½Ú{?i&¼¿ óvX›Þݦ5R‘ç70qÉä°15cºÄ­=Äža9å(aCï"Óµ;BxýQèUf˜ï©Š¡ÆÄmL­ZS®.Up·rÉ×— ªÖÌ Wyÿ®s–†P“¿=ižü•=Øðó ý"¯r˜%‡¾mg8yCß:‰³û÷·™äŽ¶™æMeß–6ëúTÜuUÏâÎ4 n{‚Fþ¡ùÆU¸•78ò[y]Ò—Å -=…ÎÙ‰–î'Æ¡„yf䮃§7æѺËxNÅ4´œ{’“/'‰¶õ£—Ù¥3'¯ |®³mf'¿lÀf~ž”Cpñ«æ’Ûë~ol7'ÃëÞSUñ*ËîzÏLrÛ{„æ-ï¹#Í{Ï™¸«Þˆ»ˆS­÷Ö¥AªX.-ûлfYÕ‚IÔG¤Œd‘Ëxó•¢Èâ<ÓoüpéHn+RhÞRäi^‘gâ®*2âþ<™ël~ë r?€PA¾ü­³¹Òî~ºÁ…”äÜ9U®Ü9ñ7$d´¤æ8_©9äíÚý¢I"’–¡ãŸ Ò“½Ñº—{záÁðºŒÈ7ßáOÓ¶wŽ_ä1rµOMÃ[a§òX+Úï¦×̤—fX«|åØá1Ô…Ï䪌óRÝ‘ù`;¦Ëendstream +xÚÍYK“㶾ï¯P|¢ª,† A‘ÊÅåµãd]Y_F©MUœF¤$d(B!©™ÝŸ~$õð^·¦jˆG£ÑèçH-øS‹2“l³(Êuœgj±;½K˜ùÛ;%:Ïâ\khß™\ùÙÕ:]Ü£I«¬Œu¾ÆÉ÷Ûwþ%Mi¯×Ùb»'¢mõïHÇËUž'ÑSݽÖÝr•­‹h»Ü¨èË:IT÷pò=ä^N¿‚‰Ûç\°DÝr‡=Ž +Y.©È4/ïæ´Ladð`¡7@ŽŠÀ +&ºøè7q­ðï/ÅaÛÈŠKijž-s®GgnYzbÑÈVµPöpGßüöá^é§EŽŒ>“o"¸Ø\ðè… +‘—Q3‚‘Ã(YÉà¾GÁº¸®H«2 š7M¢¿×“@÷/Òõîí— ®GÜe`îìЀ T?Û^ª2)/E„`Ãqa.· +!<Õ¡’ô´afWɨ%h‡Ë á£Ú³‚‘ Ò¹±xwÌ^´èØÀ•°øtí+](5gõŽ¥¸‚nƒþU¸vÐ*^p Lñï+¡\uí£¤n$·XÆø‚û ç‰sȈ;ë.#¶f9 Znfôîä1æ4Qyì-W„¾æe’1 h/ºPa®{ÙkŽñ„'Tú3ÊûåOß=—iYÆ%£9 +•Œ:¦©ÿ‚¹>¥¤QÄu! ƒÒMù+c ¸‘ +Ñjœ+ S¼EbHÚíziÐY‰Ta!Ûµ"¥¼ør´Þœ¨µ¡œàW˜ØDÿ°¢à;wrÇŒ/ ð…ŠHŽVÌn~J®JJî ÆRÓ[•Ê®ÜxŒe‰@–©tØ‘k4º€¤¨ËµÒ;Œò¥²°’ÏÝ´à…cÑÂs3¨4r°ç‹”PfG'_“b°(®Ú(i’FŒ°v!%Á—"È”&Š…Äu­PÍôj‚S­¬¡”s„{²¬±ˆqdrK §L'j°•MåD‰D Gz2yBI¸z!K,û>ªxˆA¢Øa{¾ãŸötÍîݦž =Ît» ³8Ë‚mLÉZS +Å®<=­ <þ×f'¤Œh‰¡BL>2ãüê)˜å1¹ÙÖ›ÿüíÿ¸%×a¹†Q,äX¤iò( Ù‹áŒ$.gþ +ÏÆɪ޶»šù5¶I[6IS3©”¶%‹–S†‡Úd³W¢äáUûN½ÈYâ 740P.òj¸e|é€I*·#û<`Ój.PýÎ4Ò¬j +bÇvñštº–þ™&ÙL´‹î4FXâ“Û.³hyºŸd¹…Có8{†êÁ {|‘)þ¯}•ó¨›cÐÂÝÈrß £« + ˆnêÚg”<\½ÞmºÙC’5  ŽWK‘&D—ñýúèOâoÏáfÌ~¸s#HÕ&.Šõ½ZÃu@žå ›ku›ƒøÅ5ß<ÖqwßószOþï‡ì´Ê&ïFô‚§kLHƒ„\¦,ÙMr@Õü¶Õ<ù3û•!úiò8Ú¹&Ÿîæ2…&‡x0ý·¬?pì†éù%¿þÌu°‘®׈[ÝIÌ–ÏWLž>µ‡ó3Í_=Æ ùÕäÒÕø¨È©l¹“ ¯ÄþÉK¾Ž†4zÇ­™]ÜùTWÒ¥³_@ÈåÅhòà‰ô?Ûn,n®„Z€¶=²ÝuÄk]~ãåQë‰q +š¾Ït,¥1ϲ[ˆ:ˆœñ!2臯h盼v&cíÉý +;ÊţǑì§ßòÄÿ,­«p ?}È4?LûŠÓ‹PîÝí32Rs/¤’öwþ·½\îŸF:á:¯fÏY½õï×ôZ‚p;!féÇ£;/Òó¤Ìþ“¼ÄB¦ )¤ûz€dè³7¨k«¥©ŠçÍnYy½Gš¥qšs_ðßÿæ®g²endstream endobj -4075 0 obj << +4189 0 obj << /Type /Page -/Contents 4076 0 R -/Resources 4074 0 R +/Contents 4190 0 R +/Resources 4188 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4080 0 R +/Parent 4187 0 R >> endobj -4077 0 obj << -/D [4075 0 R /XYZ 85.039 786.531 null] +4191 0 obj << +/D [4189 0 R /XYZ 85.039 786.531 null] >> endobj -4078 0 obj << -/D [4075 0 R /XYZ 85.039 766.606 null] +4192 0 obj << +/D [4189 0 R /XYZ 85.039 766.606 null] >> endobj -106 0 obj << -/D [4075 0 R /XYZ 85.039 766.606 null] +110 0 obj << +/D [4189 0 R /XYZ 85.039 766.606 null] >> endobj -3020 0 obj << -/D [4075 0 R /XYZ 85.039 658.638 null] +3081 0 obj << +/D [4189 0 R /XYZ 85.039 658.638 null] >> endobj -110 0 obj << -/D [4075 0 R /XYZ 85.039 454.407 null] +114 0 obj << +/D [4189 0 R /XYZ 85.039 454.407 null] >> endobj -4079 0 obj << -/D [4075 0 R /XYZ 85.039 414.243 null] +4193 0 obj << +/D [4189 0 R /XYZ 85.039 414.243 null] >> endobj -4074 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> +4188 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4083 0 obj << -/Length 2880 +4196 0 obj << +/Length 2505 /Filter /FlateDecode >> stream -xÚZYÛ8~ï_á·µX]ûÖI';lg²±g‚Áì<¨mu[ˆly%9`ÿüÖAR”-«ƒ 1EYůV•"f!ü³4 -B•Í’4"%f›ýM8{‚7ÿ¸†biH–Í›õÍë÷Q<a…ÙlýèöÉ ÊâÙzûÇüíO·ŸÖï>/–J©¹Ë$Iç«…˜ÃœbþÛ;Ók=_ÿþ ŸVL|ûñŽ+œ|»XŠù¯Ÿ?¬çÉû_î˜öÏõÏ7ïÖNPï(B)ó?7üζp¤ŸoÂ@eéìÆa ²l¶¿Ñ‘ -"­Ìsu³ºù—Û‹ßé¯CÅR,U¤©žF.Š‚X'9-<äD(ª™%BèþŠäüx"Œƒ4JgÞf -ÍGù… ”Ž«|¿éü!_*Fù¸XÂsÑìË®eôuQ0EýÈ¿°0¡—UWñ§`ú|³Aê_póŽé·y—?ä­¡z€·ù·øŠ4ÅaÛ^S¬LñléžfiCô"Ò {¤Ï8Ž#íq\ïðäá|B"Eá1o êgœ¯›-À´à…øÔcCYOø‚äÞ÷4šÌ‹~’Xt PŠ®À‰-“Ã27nŠcUÂ#ï×fúÔ–‡'úF°D@¦¥PîÔÇjÁ†£–Øt;˜©Éʶֲ Hè$ˆP4¥åü©üF‡jy%FœXCE’¦‰~uFÅ÷ª¬Ê×þà7Lí -x¸7±†_ð\‡m¤Ï†ëÇ5 -£ùÁáã’Ö 8-ã*3ØÞ;lDgÝäì&ð¯Ì`þiË'Ü©õ&g…W?ð†/žvx -|¼²Ñ³_~ÕºUÖ~ø‰÷÷+ FiJú™BÕ£¹v-ÑKawŠ¡ »çGîÏñ®Þç¥AýmÍ€5ueî+Äá\»I â_I,ÍÒ#"qbé‹#u¥‘Û Åùï;Ì#ðôSì Í»áéU<Ù}¢ ¿Ï1:  þËÙÕ=цh)v3vãhxìÞ˜ûï«£„cåÂù¦‡KÕ{ç5\Â$J¿€KO4‹!šÆeŠÃåŒÝ8.»Û»Õ„yà QUEs%NèiOÆ æzœ°D/ʼn)†.Nœs>Gÿè÷çKMd†›ÉžWì˃P%Óöà]·K4i“ì¬=œ³µŸŸià=r™iœ˪w”á%s &™Ê^€©'š€ÉMÃ4ÅÎÁtÆn&Ýǵf|ðô|ýÚÈÇæn‘Á”|Á–Œ×@¤zº6÷h®;–%zɱ¦:Ç:ç8êX>Çæ>ùakJüª>˜Š³83p·@&Š~ÃÌ/›D5îò£«WLÃï–&5ÛQòöÄ/.Âì,¨½BÝ_ x'„éÅ€ëˆ%þt_Ò$ ->‡{ë \W›jºÝ•G~ò7õX©ô­ÜòZ-äÜäqMWΓ=-àJGÑ)ÉdY䤷Mñ”SíHeÎxŽxrc…5¦ÐO§†êK· ¦¦ÀÆC´ã'Ì+5 Ûí -ÛÀi;²(uU´ÛÇIJª¼<6”q[cK“0·2i°2±Æ`e>QBþTl‡I³A›iöÆÆJÖ$Al6vËG†dÉ`VendàJ‰sðÞRI øÞ„^|lÌñY3ÅöZÁ¤d„©šöäžæjÉ$³8H¤2%“²%S¾ȹZZ›Så#K?xæ¡ ±Ž¨Ÿd¦ ¨MËçÑ\­ dn/Ùí? I¬_Q©ZJS…lŒIáðÕ’µqr -îP%LÖâ8Fï!;å6UÝ/ƒ¨õ¡à)òc‡Ÿ¿0ÅoLÐ"-qB‰:’²ë¹þö $eÑÎõ:7M'3,»‹ýø-¬&>üS“Øz~L¢8ôl &«í™?YÃÊßÏ”Pøãù¡Å¥·Ë³7ïm8Q¾—øÉdyO$Ëì—é»ïÎ?./ofó ¦Æ›Í£(ž.fj +sJ©éO—0¦e3]þü¿L|þá‚ œ|7›«é§›«åÏ€ñ´iÎÕ=ÿÂƈ˶ØãOÎôéj…Ô.íyËôYÚ¦wi#Tw°š®Åg¤ÉwYã=Wn®#OGýúãÖýó,·Ü &þ úújý}Úéq¾ª3 iÅñ«· LÜ„íŽ t@ºc¾wpCÑ4ïytD[ãð¥hsœÈ˜¶uã:ß—|2¿6—éCSìÖ<^êM†a¢ÐÒz_ÎØ ÐÒ1íf*òšÌy +¯‰|0Š=]¤TÃ;1ªS:JIê$ªù.Ìæ¿è$EY´¸÷‰WZ˜Ú)àãZr oQ¯]V!飜úa‰Âþèìã‚ö+Жíª`?PÖ’®«”Ýþ× 0àŸ¦X#§D4«”/¼|Â5 ÖÔ?mæêäǹ–„ÇÑùª«0ã‹¢fÛÂý´U-ôhÓŠå,vl_$~,ÀîDp½àß[<‰œ†m€[„Xûþo3¼•—âËXO…zJº§fSìy寫1(ýPd¼×(=0P·Åî9b0Ðû’h÷„TXV4oÒj¯Sê-ÆãÌ`ãˆ'W¢ö ʬ5õÄ7ps6ц¿œ°l»É]#ˆÓ<î.”E©Ê¹y½;^å©Úó3—º +A] ™n°”à8™„êÖÔ¯ —X›i¶âbßÔnvÇòžM2gc–E*20’f ×;*]|+ÂhÜ×¢>ßLž½ ¨#ãEúêÀêt{—2–^ä«C Ý@é'ž¹FKøØÖüŸÐõ:‡Æ¶ïÊh-u%~£Ug6£ÙȇîÞZ´4“õýŽ1(Èýøµ¡jrž'G–‹ïþÍK:¢8‹Fh$ÞJó™ aZ ·Œ¯kE;ÄW2|W‚°<áStu К<(ˆcjˆwÙ°q³Á:uÉ( ÇÇÑt3èÃp¾{gáåb»/óíÀ™&ëã©ÄÔd©¾ ²mßo‹„©0 Ž&/Kfàf7CQZî×q¸ªv˜ +PüC=¬×Ô]'®»f¥"n°-äá²È˜¢hÃ@øꮈ©©-.ùã¥~÷ÕyvpÎ${û×(9I¢Ÿ&0+¤éZ~£ðÐ)k({VõiÇ¿ÉÓºM¹òäž[@áÂ!ðÃ>Uø•XÞ¢oÞ]½_0A—Å]Ÿ‰Ï?ŸÉŠk¦è{Ï2£Â„‘”×9¯¦µp§¼HöÀcû¦u0Ñw’ò`²¯ þO9Ôy‘ô’oÞÛdôÕ^’X ýOKÓÿ˜Yàò—¼ç(QØÀÓq$[°Bž²Õ0RŽd±Ä‹ì0.>ªîµã´ñ”v¼ –ãÐLog1U ™ñnÝD\3èwPÃà“½§os:hŠ&G‚´ÑHE¬l,b@˜Z S60î‹Ch Q¼S%Bp¨ðX‡+yq0‘†ä€ü¤:Ì.Ï žô 6ÐÄ 'Ʋƒ.8ß{ds·š¥ 1pK@#`"P‚k‚œzõìÙótá¼—)jÒ–?R¹*ï*š„(ÅSf€rDzW + —i¤¹î^0 Õ‘¤Õ=¢¼%;õ/8ü ½‚¦8yqƒØÅ1º2RZ¼Û–² $xšâ6>5’Û}çU[èÌMcx&OB„)_¾È UÒû!_xÑõ,JŸCÜGÎcJ%)SÆf*êÜZV~CõCT®5Ï’¥\€Å¿Ñ§”ç[;L¦”ƒ¬yÑVOMŸ0¯X¸,zß8ó£ XW\,´@»£çâ,7cÅAù±g’À ün8¿¹‘#ˆ<€XBøÍ«ÐK´ÓüÓ]ÞŒë~‹v$?`>GVW0ø0ÂÍ„^ìÛÿ’>#¤=õŠ±±ÆK^ì¾r¶ºD¹nfÊ×ÓŸF55`±À™vˆgUw›ü‰ïLò&yH)/†r8ô¬"4ÐÕüíQË"}×nÐñ¸&Lxô¾Íë1ôƒ YcâÑ6> endobj -4084 0 obj << -/D [4082 0 R /XYZ 85.039 786.531 null] +4197 0 obj << +/D [4195 0 R /XYZ 85.039 786.531 null] >> endobj -114 0 obj << -/D [4082 0 R /XYZ 85.039 682.89 null] +118 0 obj << +/D [4195 0 R /XYZ 85.039 683.387 null] >> endobj -4085 0 obj << -/D [4082 0 R /XYZ 85.039 639.937 null] +4198 0 obj << +/D [4195 0 R /XYZ 85.039 640.434 null] >> endobj -118 0 obj << -/D [4082 0 R /XYZ 85.039 326.083 null] +122 0 obj << +/D [4195 0 R /XYZ 85.039 312.309 null] >> endobj -4086 0 obj << -/D [4082 0 R /XYZ 85.039 283.13 null] +4199 0 obj << +/D [4195 0 R /XYZ 85.039 269.356 null] >> endobj -4081 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R /F58 3360 0 R >> +4194 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4089 0 obj << -/Length 3077 +4202 0 obj << +/Length 2896 /Filter /FlateDecode >> stream -xÚ¥ksÛ6ò»…¿•š‰âÁWgîCÛäîÒiÒ^­^¦Óö-Ñ6ŠTI*Nþ}÷²(µ77F °Xì.ö «ëþS×E'¦¼Î‹,NºÞì®’ëXùוˆ¹ `¾^_½ügš]«$.“òz}ïñ”Iœ–ÙõzûKôÍ¿¿úaýúÇÕ1&²ñê&Ï‹èv¥"˜SJEÿ} cZ¶Ñúçðë–¿z÷Š·8ùÍêFE?ýøfý3O¾ýþÃþ¶þöêõÚ°¢ŒA2ÿ¸úå·äz ,}{•Ä¦,®Ÿ`œÄª,¯wW65qj|·W·Wÿñ¸xÍ^ó®%©¤¦ˆÓÂœŠE¥ bIÓ8³9‰e ¾F¦F`ÈfÑÔãoUX˜ën¥‹hj6ÕT3@3ßÂú=ÒIôfâµ-ÌÁ~ØQ º®Ÿßê nÚÏrȯ‰22Ç3¿&iâI ³ôa¨+9¥þ4 Y­x(åÁÓJçQlô+·Õ× -¯ Dw£P²%‰‚¹>âÖz€-¹¶ÈL>˦F3É(¡¡™ø¬ÂF Œ4Ë£õc#°;„ò´àæþÐmqhÏ4 1ÝCý&‹”h;L ÛÈ/ˆÈâUÎ4j:Þÿ„ûº#†c>a@´µþ^YRðõ’I?æ°Úï‘‹¾Ú lU¿ ŸÛ·ø5¢>M—Þñ¯[0™œ(|&â€^=ð*É%c²»fÂR+mU…À2&6zOýзm-KwN¤0f¶é¦mD+P˜p32E \ôÊÊ_ó™•ðÕãþÖãu¾] ÜñŽÞcã›Püä,ž+‘$à·B©\¥YT5¸§ºkkY!E¡M5ð8¸YùÝLMß…¸à*‰ºÏ##¨·ñ¯”•eœ›ô¢ƒ `È“hXUq™¦'ÉrkSllb8_¡¤IôÓˆø&¾«?Ö-3tªh>ò;ÓÊ$pgˆÌʸTæ2‘3ÌYw—oLJKD¾G3묜 ¨mq¢ˆ¶5ÈfhîÄê0ˆ,E€3/c[ ˆí0"ƒºÌ£–$ð#lçV 8ëgU) FÔ\]€Œ¼ÐL_ŒLQÖìö­³jT_t¾Ú žªRŒú£Ô\ ´0‘Pç”)\ö5DòSã;ÊZ#ÚÎÑ&6@nhBÕE\êÒÓ4Žxi=xó±žûF²4Ö*“M›ž\ðŽI …àÍ[•QuœzWÞ¤auÒî'Žl›¾åÙÎqýЋ+“Ä;1¥‹€'tc9¾QŽäõƒ¸#ÄVíä@¤—$•ÛXÙ”•KûjɼûaË:é$Z#GqiÎú¸R>®úÇ«‡©hCSûçRÑü;8ðßë,MìÚ`„QQ" óDã—H7Žž¤}&. æî(R8!"Sïú©>çlé4ù߉#¬ÕCíD* ²“ë„läõŽÓœn¶uÅ£''ZwÔè'† Îù~»„ B%áખâD;µädˆ¾w†ÔÍIàžúK MÏq¡‘˜³©º/dx'Lû %R:5ÁÒÆY–‹9Z¤xgðO½Ÿ^4ø½^¥:=X°E[ãlÑ…+—Õ%@Bïb4k!@ÒDÕ}y&@¤—«„ä4<”E y”ª“x©’,.@Žr ÏRJÇFéð°õ£ˆþïÚË!hpÜê/¤0ÃœƒÀ iú¼.œ6 âÒq^Áy^³4”„²­ÐûR5%ÖÎUˆæaÏX\²B’?"¹=c"Òz$xöFÀøc5Ì…ß©ïÀ2Ì3é­T%‹aÚªØd©˜ùÄ^ÿËÉØ_ô]Gsœ·žºŠ\Ám¹tEÊ:8î‰cSOEQR2=û¹(Û4¸?7ݯW¼íÄx8Y29Wª‰°`b鎼w/È.ykl8ŽÅ:Ó<<’HGG+ò;¾4ÖCÔøÌäÇÉÎxävÙÌÊØ‘@Ŷ÷~z â&(üêjæµ,6Ýl9§·¥ÌÌRZ•b®6¹Òv1»Rqá2²Xì,Ëc•2¸¤dþPʺLˆ²‘‡UK|PUÊöÌZs'i-ÂÝc’ ÏeOSV&GI%-Pq@LS#yòó -ˆÌõóª8ŸSBLÛCýÇÁ›Î4JAlu½Çn ùX‡Tž8„ê@™©ÖÜŽ/D¤…Š³B© Fq(=¢‡†1ø©}a‹ãPTºd«*Ñq™9^KÊŸq¬ÁijëLºg|¤¡xP5ÊüžôŠ¨8Å%¤¯zàmhªx»ÖÕ ¾¨úèR‘TtQäaºË6¦«Ò ,”6Næ¼>v \ÙT5nA-eò{r¢96ÁBNÌ­\=yÍqÈ{FÉ®Å9ë<‹Ü„«‘I²ç¹7į÷äj_½’V€2ÑV|VµCÑ0…GÉœze§^œ›;­¿v -νÁÇ6hÖ9wÔÐÑŸk˜ÂÄyQ\Ì9ß>x^™›ªi•·¨`Ëè52*~{ßôú¸‡ÃP‘·韡0…à_^np0g{\Sq”¥Œ¾oúN²R×A”wríšÉ7|XçqÉ$¡dMJ×Tø‰JutÅßQ åÎIšG·?¥(ÿ¼`´eàiÆ/Å™¤ÀCbÙ?Kò¹ØŠ@ÞþÁÔù #Iã2/…’ “ -7è?…Ál[ß“Shû„lšÂ„¤MP…ŒA‡öç5ê„Ž?ÓD ùtéÒ=0gYZC¬l¨‰ZY·ÕÊÓUÌæv^ - -qBˆs}, :Tþ3ÌY]TPŠ)Îc¿ÿð‚S.XAdO˜x¤ÞÃâxNñð« ÊÍVœ ÑÏ]J”,wwŸ¡É"ßú;˜^ •ì?rÊÉÉ+Ãì\É%@önÑÎ×~ßMÕÜ”ý¼àý8“°:ª}s¿ÂòyU–Ók\ËÊÕØ5¯Š—³1Zo{L@qxÔ–§Ã‰!`!!ë,|<>Nž55ó’g‡}9‡6±¶éœC'xw5Ó¾ëر±¼ÚÈCÎ’nM®aW‚áÛ#ñÖŸö­¿°Æ7Óì³Ô '*þ «&.ó¬dø4šÃ#|ô’à.Î"Í™/l“…VKÉoHÉåâÉ*GÎr†!´ôü;WÈK°ñOêqŽyÒ`Eê¡ÃûÀ.jj¹¨ÚÖBb·=i¡J ¬ϪMJ­\º?5gA(4\ãèCï2ã£=~Ür©êßÀhÒõ¿ºçóD„Šwâ)Ä·\_x±êlo•–6ë]u'ï.8ÇÏy«³ƒÔ¾8œ)À–!¤˜o&^‡]}”z#RT]›¯ž&wœØ}@¥òÇg‘öÊ·ýÎ1&½æzðh«öÂ;šö‰®!9ÊäÁëLnøn`öÝš«MÐ(t³Vú£'q ¥°`Ü6¾°™¶cÿ•Ûgš¢.öóUüzd´{æ\~.]êYÞ\·99~¯¥™ª ^wGî Ï×">Üà"êeóIv'ó%U*Î5p~ŒÉOx¬w.èÃüSÐaW®Žg4Bn#ç ­¿¦aø== ûÝÆ:Ŧ÷¾“âÄë4Üþög^âÆ嵑ӬàJŸ÷¬ŒFJøuIH êú5†u´=8í¡=Àê/mCéHž¼œËú}š…ãØ®`â-ÿ©ßSÿŽÃ½b²Îá’l™ä}•ùCˆX2ð¶­[Ù3 ¥T#7P\ßX -¦rðøØS»`B!Â<Ñ,•TÚï¨,K¸ôÊ<&+€¬läéòÓË·¢0°ïéD‹ryl®^ýôK´Øàß]Ea\ä‹GhG¡*ŠÅþ*1qh’XÞë«õÕ?=Kîù92‘ÖÒûΖ²Šý<ˆX@­x$åÆãRgA9™èGÖåÇnAŽOD¡® +Rïªû„SmS²$Øáf²Q?ÐÕc›EF uÕÀkåIÊ0il*¡Ý#•—'·Çf‡Í˜ù  +ÓÜÛЙ’í80m%OPQ‚GAUãIOwohó%ú¦ŒPZ4Þ”{Ët»’< eOƒÈ¯íˆSD&Ø`·Stît3¢'öy¼@V¶â{Jü·4dµÒßÙ_ívàö@hp."*…ü†½FÙè&£\—‡»mÙŸš’"YxööÒ¡ `0ósq_ˆ†å½å]ntê!`úCÙs£iù9*½ä5hõe7r›rF38,œ`Þ…‘‘BÇÄ{°I£bÊš 7‚¼]»ÕHÓŒÑDŒT/¸Ñ·Œ‘|§ËæOãE¼}™ +îV€à±˜àŽ2 +‚O%èNo þÀI_wÔøÕ.†ëÁ³OP+Ã$Ne²ƒoåœ8K¨eŸÕ9qÊæ›Í“PswŽ  `ÍgT]øˆ'*ŒSã“!ºÀü‡”òÕFP¡{N{y«3§¥…‡d$°ÜcE +k)ž +–ç0æÛ +çv˜0^ò´y‡”Ä'Y‘S°pbíö<—$,Æíªbc»ee•„C÷¤ÒÞÉJÄÀü–íP)¦qv¢ÞR¢ÍßwÍs±+„â©] aƾ~-å !e¡«rªa Sö”Õw.á› µ?ïR]ê¼›˜U¤tÄާ㕀¾uüTæ im¦O2ß ¿ï3_Ê}!“{ƒÀô÷UÛ ˜Ý»’`Y´=—ö*­žJ{5˜±~>Ù8xŒO.€íœY¿¿ !¾›¹(I!QÒÈ›J0LÂMQ7›ù ÚžD<\Ÿ¦¯ãŒ³ÄÙ*TðÜð|"Ñ*5ÐäÊDá0ý`®Ñ&ø3?àÖu3;ZÁô,§éJ¥¢"Wc©f<ÖÎÞÔn—¼ýa€÷ô²õ9AB‰ù¤ˆ¸Â!j4ŠÏsµˆ Ì|pŽ6`ÀâÌWÕZ´ÔZÖå2&0“KÇŠK¬YaHñG”Z°Ü—¤)Á‡`IvYÁHó犤™hŒ’‘Á‰€ΠyD/r ûföb¶¾›®(Æ,ź/–Ç(À2‘byK!ªãêQüÉaån’`€µBÈiÄÎNöÆ—…7.=‘‡KÔ9ɉZC¶¾/ÌÀ0‡T³–žÑëÁËô0{.Í iËiÿÆo”: nD¢R:\üÂGlÝ’–GŸJ\aèе·\©þ2Y”«Ã\BF¡¸=^µL§|Õ Ÿ=‰4 ³H*ª5b7+Ѓ…ÎF ÁPè´Ô'«¡êZ1bšÂ7o¿÷FÊw£¬yõÛo™îô‹ÈÚ;Pó8S(¸ªw›¹ˆf;¹ˆ¥)õÉDæ$‡Èã¹ô¯çù€6Ö^‘›Ø0´NÓbêª~®éÜ;Yá ®iîŒÇæj3âû(E¬JŠ9oKÙLíBÂŒ*X"ªØVÿÜ—`üþÝÍ¿¹õD0TÂG=Û½Lz|°4é Y!á)ã¾~}dÎô‡²ê¸5Þ¸)×ÓxºðC!ï‹™MòGOú¼3Fr×'L$$`Õ…ŽÛ$#ÝàY´ DGÆ®¨‚­!༠ÆÞ®ùùJJì`«=w7vðŸ†"螇hñlÔÖ=zŽ¿ˆ+ºH‚‘zǤ”»þæ¡‘l·ïy +¢J6+PÎP4gÅçë·rb="–?M`Ñ ±Å$CÇrñû° ”Ü=U»|dÄnþ^±Ã_9ÔÅÖ¡s"~ªväK°Ý­ÚÆùM\¿ù±n‚/®æÆ6†J4þvÆÊÏÁåËM™<Ìâl>F=ýÿ<`=Çx¥?ï%ѹˆBsR8ý%j)èendstream endobj -4088 0 obj << +4201 0 obj << /Type /Page -/Contents 4089 0 R -/Resources 4087 0 R +/Contents 4202 0 R +/Resources 4200 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4080 0 R +/Parent 4187 0 R >> endobj -4090 0 obj << -/D [4088 0 R /XYZ 85.039 786.531 null] +4203 0 obj << +/D [4201 0 R /XYZ 85.039 786.531 null] >> endobj -122 0 obj << -/D [4088 0 R /XYZ 85.039 699.735 null] +126 0 obj << +/D [4201 0 R /XYZ 85.039 699.735 null] >> endobj -4091 0 obj << -/D [4088 0 R /XYZ 85.039 662.868 null] +4204 0 obj << +/D [4201 0 R /XYZ 85.039 662.868 null] >> endobj -4092 0 obj << -/D [4088 0 R /XYZ 85.039 578.181 null] +4205 0 obj << +/D [4201 0 R /XYZ 85.039 578.181 null] >> endobj -4093 0 obj << -/D [4088 0 R /XYZ 85.039 551.083 null] +4206 0 obj << +/D [4201 0 R /XYZ 85.039 551.083 null] >> endobj -126 0 obj << -/D [4088 0 R /XYZ 85.039 383.788 null] +130 0 obj << +/D [4201 0 R /XYZ 85.039 383.788 null] >> endobj -4094 0 obj << -/D [4088 0 R /XYZ 85.039 350.25 null] +4207 0 obj << +/D [4201 0 R /XYZ 85.039 350.25 null] >> endobj -130 0 obj << -/D [4088 0 R /XYZ 85.039 253.689 null] +134 0 obj << +/D [4201 0 R /XYZ 85.039 253.689 null] >> endobj -4095 0 obj << -/D [4088 0 R /XYZ 85.039 218.944 null] +4208 0 obj << +/D [4201 0 R /XYZ 85.039 218.944 null] >> endobj -4087 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +4200 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F59 3455 0 R /F35 3036 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4099 0 obj << -/Length 2206 +4212 0 obj << +/Length 2124 /Filter /FlateDecode >> stream -xÚ­X[Û6~Ÿ_a`±€ ÔŠ(êZ Ù$ÝN‘I³±ÓnÐöAc˶ZYšRr&óï{nÔe,¹vLL‘çðžëGª…ÿÔ" ]O§‹8‰ÜP«Åötã-°òï%+!Y hþµ¹yñm-”ç¦^ºØì»}RÏ Óh±Ùýì¼úîåû͛˕ÖÚ Üå*Žg½TÌ)¥œßÀ˜–góé=~­™øå»×ñäݯ™ö×Í÷7o6¢ƒ£(­QÍ?n~þÕ[ìàHßßx®N“Å#Œ=W¥éât„Ú -ßåÍúæ?Ý^¼,˜kÊ*¡NÜ0Ñ—fQá„YÂЂ˜Ì²?ƒòeÉgɶx¸mÞàOóO>âGTí‘'j# E{¬‘½n6ÞÌd¼ÃãÒ‘\9;íº®üØõà(û.«–~ê<-W~9$»Ú"Ç-µ ®ÅN#S°g¸8=œ. ]ù ÷nò¦A¥ë -Ò¾[ÜÕ}`Þ‘e¢ÀU*ÞüóÒO âB§Ø³X0ÂÖÉôtFè¦+*þmŽ™é9J*‡ùJ¡¡©íÙqåi™h"4ð}gs´Lb&4BmNYY>±L2u^íÈÀ+¦nG0ÀIé<èÏ©!®,vü‰¦`^Se§'•s“ç– HOÏùt`Zd'Ôú^Ę|[›]Ãí±Ñ¹CQ;qh'\Ö²°:‰ -õ~ÂÏ:R®¯"qÖÃ25ÁÙ÷b^ ú0:T3áê$uý4nËUB¡Pš­ÒÊOá+ïö˜s€O*/MÅ£ýŒÐádÈ*J[{”ÖàYrþo¥ÃDá᪊涭ÍDêËsÅ¡«B{®BÊJkÑZ&P1òª[[µÅð¨çØ ´*†…±¸ÈÀ5c³ ’f&ï¬ñÄöõÁ®q GQÙàÀóI üÝÂA­Íñ¬ýšv~ñBC“ƒhÃ’)öXŽˆ¥cª!ñO`dŸšòŠ>ØE1Wù"Î8ú¤DÃ3eÑ´Ä+ä¸W%ªsᲑM_Í óÈ…íí6È—wEp`† nã'±ó5$û‚ ÂÙˆ+ -¬rdáh‹ëÇ|‹b~ï -%¯ø·=Ö9²CVT§Ò~ð}äBŸO¦hWC?™Ë1RŽ± pùlª©(èR -ZêÜîYÃŒõ8{ˇâ)‰??IÈÑõ¹’õƒ”¤°ÒÚ;Æã°Dëe¦&¶YQY¦uîJë@¾e­ò5ƒLÈdëvw¦óGA8¹ -b4Ô­}ï²[G*q͇ \í‚ -¾«ÀšpbçÍ—ìô`-æU]ýâ©àp69»¯SªÈÕê/4ìifñD˜PR£>œ©<Ï´õC5”Ë-!Ö¦lÒ¶™*•K•Ók_'ßÒø3¶TÆΚë¥m©ÔÞÊGXÂÜä<“Ùɨ§PÿEpD̘ʖºï(Öq,¢BÄÍ ÜóØð4'Jq‘"AšRVµlJÔ¶þB!õëwù8QõÐ`9Ûî$Ý ¸v}êÎZüì’ª†Å%œOˆœ“beèûPÓšº:  žXä®hèÄ„^Mv°y¾Çýês›¢:ôîmË1€£U*¢½ª1¸À™« AŠUQ_ͺMW”›"4é².ˆ¡§&É°.h¬ -¡ç¼®O™t*, -k¶%6M2ë©=2¬ß Ѓ."eÛíǽaxâ­$Ðùݨ½Î:öÜî5WÝÓÌ–(„pu &´–!}¸ÄˆÄœ‰%`2ªïìXñ'pN¹¾aºTh»xÁ\tGRƒ¦£èN™uÅOtTÁqcxî( ™„l'ñÖÈlsU—\¸L©Öœ‡=`ÛG¹­¾f0•1É)#qd|ÂË—lŒ›hÍÞÁ€÷±À{#Ž¸]öèIhí2­€ÁÍŠmÖt-ƒ%“ÿqîàÝö°Ôü{oýæÛÖÁWðhŸ-oêóaTeÂ3¼@T6/{æù˜ŒßM]v5Ú4s¹«ÓØõ¯7Ìžd¶£kt•øãÌý¿tt%®]8ÐðÃI2¡¡Žà—k dÕ=¶ÓŒ[-E,þò”Žre±1ÎÞåÌC¡N Ù|†ñe?lŽ–QäíQòL0åP]r*5Ã[MaÃÏÏ/(&˲FÆGćÁ‹Å•È¦]/9S¨ýƒ¯(ÄÏ(ÂB€îdB\¤þE8ÛÆz05?cŸ°ßÝÒ3ÔËØ7ßh‘0¹¥"æÉžÜ_t‡ÂA ò|\ú)jþµÊ`ôå2„óëqéó'JÌUyNwP_‘Èš‡¿á°¨ªä¼ §À°e‹w‘ô·ê¤ÔrÁ !¿°Ö绺ÊÇØ_cRJôPúz& 4ï@ÅW“p@sÙëÒÄÕ±îöA¥ÕEER^ä&˜»W¤Yšëâ”òâû#y?Tc,Šï®ÃÔ:ຠCŠ£ÖÁ˚˿á,ÌÍWhþÄÂ,&’Ö]%^Z¬eoØg© j³´S*E@3odÛõü|"¦Z$!ÁÚŒ2üÊÕ>ÕsýB…‰G×aÏ€f>„UöçCኴ>®‰ëBa ï]þ¥•§àºzf”ïnÑÿ}ñ¶°<=ÉËɉ¿iü%ßÚWض¯–/¾Õó=ÁÔuûhx÷À7\˜‡-~£r£ÕGþÍv§¢*ñgmmþ‰o*ø–2Ó.C¸YO"qøã ùŸÞí{h›¸)4üI›‡pØ(¬2 -¼ç -Û÷ýKÿŒüEendstream +xÚµX[oÛF~ׯ°(@;ÃRd€>dcïÖE¶‘ÒlÐö–(‰ Eº$Çÿ¾ç6)Ònw·…8—3gÎý|#=UðÓÓ8ô•I¦‹8òC£§ëÃDMw°óï‰ +5µ¾ŠBÜúçjòå¿Âhª•Ÿ¨dºÚÉjó“÷úëW߯®ßÎæÆÏú³ùb{Ë™ö`Mkíýx cÚ¶ÞêÃ÷8[2ñ«7WðâíwWLûËê›Éõª#ÔÜú62(Õo“Ÿ~QÓ þÍDù&‰§0V¾N’éabCã‡Öȼ˜,'?œ¸ðžò©ÝçŽbn”ÇödŽ!e™ïÓ¦A5fAìUõÆGáQâ`á+¸IoÓr$Þ#œXXo]äY‰Ômƒ Æ£óY¹áY*‹®2ï¼*q1ÊöxÏ4Ù'dC„Boy§Ýg]Þ5Ö¼–7,H.‡–û´³g¼úm‡kÑ•e}Dª¼ÅÝÇYl:ch4lBÆhD^íÂ6JPa»PÞ§YÁ±ü¼qdRäY¦‡ŒÉîŽ0m™ ¬ø{é ÙâTK¸v—2a­‘ŽÄÜ4Ì°Ý£V2Aæb2”0%]2>Œærò§ț–U[\‰=ð +Þ/>ƒãwEÖ5@HúƒV5«W˜‘ ¼÷{¶?û1I@Aí¡ ­Rx‘½}&T¨hE—27^MùX[;ž¯³ê¨VÉfhQÆJxåÂ=-šŠ¤g%äÆWÑðd0˜2ÖgéøZܯ)2Ñ0©‰"¯9Ç ÌÚ“=0² ÆÚš¡“‡C}$?«PImaõX0·mUó`_äFÔ5¯ ‘<#µ€…ff©Ä¬Œ%¡a‚mxˆAA×møJ1”O‘õ4î” u&2¡dÃD½z3wT]ÓÝ“µ$<[Ll«$BÕÉÄËtyAÝ×±\×îüuUnG® •ÄÐý¬´-œ;0^¡b¬œ“µ¢äƒÄ[PâÁõ1džV/–¼±F²}FŸTd6]Á!µŒÒ]š—”`¤û"ãé)Ïr—``šDгÑe¢Yk½›-Wí”›Ó!m×(ÇžW©0Â2ÆJu¤‚l—oÆUUcû)Ù9˜RqÚ˦TÚf¹WÉ4iË“NÑñGZŸÇhpÌh·æ6“œZU FZ•õw¾Æ’mïúsz¸/\¾-¼×U‰nÞë´[†²‹à Ü07¯ó|Ó\íÇÂ2|„—6ñmh…n˜ì¢T|ÂiߊÁœKŒÁ6‡ÛÜê +9A¬Ècè’Úµ:qñË‘ žG! 5»!–þ2oáX„ÞWüÁò–%7_Ät\ëÈ™¨FtC'/ŒëLÂ×H+9mUèŠýZN‚¶n{)ë½ÏKn°õàú…’:J}·sTö6ËJ˜ùGAt¿”ZJïýÈdy»çkNCr÷«ÍY±1pñjp8Æ¥ó„!ÕQr‹îq~¤öW•»Bü·95ªuEw¥»S¡†mLùº:\$$¥Ü b¥”­OáÓGI¦ƒ’rB(g”4L#ÀáÚOetè›EØËhí'ˆm0ŸCå]U‡”dåt^²$ØñÈj,QÜ°Þ­¸ ´—€ò]ƒN©yô£´€Öø47êcE"‰Ÿ*WFû: Ÿ/=4D¦‹âlª +Έ¬N[稀{î0Q±A(uª1.GG{_˜h¡ûŠ9RÚ0¬+ãêAB9{_x¹vXri‚>w‡#>p‰ÅqmŸŠ2éð*Ñ^ÊÒ)®’ sϸ$ê‚˶>Å.•AÀsk‰yB,¸h¹;åá!完éQf¼–®[g® +Â=‡‚Œ Êôܾ°hXÄþ3N +$ïwÄ5¸Š§A0þÛ1kZ9äJ œ¹s'÷h?bßœóU N]wû1`‰žYœH°ÐÞÕ¥aìz$U]‘À§ÇF#HÇÆ»Ú +t¨™kç•A”èþaBÎ+xÛš*,`O=m<~H?Î:ˆýRÎaäÁ r`M¶úz mq› 3 öDE)Wõ¹„Õôd¦rýI›ç Gü§ ‡ùk GðôÎZ$#’@¹›…dRÆŒÄð˨ ln)ú¼ +Æ£3TC,¬õ§Q~bÜÂOÐÉžÒõšœÂŽŒ_ì‡éÉ•Ÿf@]m/À'¡Ó¢à>žc:îxƒR¥ÄÛò›–>Âc¿ „K¼HþKüÕ{Œb#°˜o 0AAÑ×O££ ¶¯±à}@±ƒ,¿ï‘ßÞ\]¿z»úú9<…ÆS˜Á&Pòè'OÂŒŸ€?lÙ]0º )*þ:„ó§øÖ—½tÅ•ÁŸ.°VfÙ†n9—:þŠÃ¼ìˆ’ñÆ­ügËïÉö·°x³’›þxûrQ³!?ßܛŅê¦*³þ#eËu±_Ž=OŒçéhf‚À†Ï¶{=(<±oã]² %Ÿåø4>ÿaÅ(ÖÞ“!:Ö„=²f"0JΞšg[V¿ÀǧWeNˆØ ï¥K$îU"»¥–)p)ˆ“Kv¦I™ÑE3üw4lÌ‚^«ºW$zéü´q908¯`a¦ —Ùø÷eð÷ø’4;¿ÝÞ½¹ùÏ—ßrES|î(ùØ´™Àøì³dG›½){ýÿhëªjÿÁõ¥ÌZÔ÷küJ9Š£ù;þ¦›C^æM ͽª¿ ÿ@\(¯uL:Î#¬€½üù¬mè/‚ø ò£ÀŽw:IêÿïpôþOzÖüvð…¦çÑß×áendstream endobj -4098 0 obj << +4211 0 obj << /Type /Page -/Contents 4099 0 R -/Resources 4097 0 R +/Contents 4212 0 R +/Resources 4210 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4080 0 R ->> endobj -4100 0 obj << -/D [4098 0 R /XYZ 85.039 786.531 null] +/Parent 4187 0 R >> endobj -134 0 obj << -/D [4098 0 R /XYZ 85.039 645.538 null] ->> endobj -4101 0 obj << -/D [4098 0 R /XYZ 85.039 609.273 null] +4213 0 obj << +/D [4211 0 R /XYZ 85.039 786.531 null] >> endobj 138 0 obj << -/D [4098 0 R /XYZ 85.039 499.163 null] +/D [4211 0 R /XYZ 85.039 645.538 null] >> endobj -4102 0 obj << -/D [4098 0 R /XYZ 85.039 463.753 null] +4214 0 obj << +/D [4211 0 R /XYZ 85.039 609.273 null] >> endobj 142 0 obj << -/D [4098 0 R /XYZ 85.039 397.28 null] +/D [4211 0 R /XYZ 85.039 499.163 null] >> endobj -4103 0 obj << -/D [4098 0 R /XYZ 85.039 361.015 null] +4215 0 obj << +/D [4211 0 R /XYZ 85.039 463.753 null] >> endobj -4104 0 obj << -/D [4098 0 R /XYZ 85.039 226.515 null] +146 0 obj << +/D [4211 0 R /XYZ 85.039 383.731 null] >> endobj -4105 0 obj << -/D [4098 0 R /XYZ 85.039 185.868 null] +4216 0 obj << +/D [4211 0 R /XYZ 85.039 347.466 null] >> endobj -4097 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F35 2976 0 R >> +4217 0 obj << +/D [4211 0 R /XYZ 85.039 215.955 null] +>> endobj +4218 0 obj << +/D [4211 0 R /XYZ 85.039 175.307 null] +>> endobj +4210 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F20 3021 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4108 0 obj << -/Length 2553 +4221 0 obj << +/Length 2543 /Filter /FlateDecode >> stream -xÚ¥ioÛFö»ÅP23œáU X(‘³ë¶v³±¼Ù )”DKLIQ!©8þ÷}Ç IN60‚@Ã7oÞ¼ûKGÀ?é$¡/TêÄIä‡J:ËêB8kØùç…4žAñF8/ç/^‡‘#…ŸŠÔ™ß÷tRá‡iäÌW¿»¯þ5}3¿|;ñ”R®ö'^'îíDº“Rºÿ¹„5mkwþþ ~Ý2òôfÆ‹[¾šxÒ½{{5ÏÀëßfŒûÇüç‹ËyÏèH©²ùéâ÷?„³‘~¾¾JçÖ—iêT:T~¨•ù./n/þÝÓâ=íð©sZ±^8Áÿs(+áÙëѱ¯ãøI:tJ^YôC:½­B™øñÈV‘v¤ôÓ0D[´E"ŒÉV75h´CEçÇj5ØQùiDü9Ÿé ¦ŠQFkâ~Š/®*éÌj`ÓqjÈz#ºÄ©LF^%ƒÔâЉƒÄ—B«·°Z!« Xd^ྞxZÁÇvÅ‹2ëÅi²Ä„nñ; å¾«=„u]l ÞW-O‚Ø}hv3×¼h»I¸eŽŸÊÕUfÜé©vŒ»˜©ûˆJE+Ktš”äÈ¿Ë}Wl×?"‹×* è*ò“( ô¦®»¿M¼0ݶZ첶}Xñ§÷‘g¿]O¯nþw3½¾4 ÿ¾™½A?H¥‰  ›Æ»F_¿È–‚¡3±@>⟘= A¸È•‚g¬^R€ªð\ú¼jwP¥” -µ‡§…†BºC¹•NÝu¢Ñ}0î”NÜ -âBl•ó§EÈöÆÃ<Ì;€Ð¡18ѲÞòNöH‚p Õ&ÿ´G¬ÆCõËš›ÌWÆ°¶Ë¨zd@ˆ»›«ÿòVFw/ë=sÃÛ÷uà ºP€âæLÉØ·XÎT¾¶å_LQF<³C|ÁoƉ§X¦"Ö ÍÝ]ÍÌÉí2gÕ®³%ûÝ~bõÅØ›¬e„^\8bxÈ4cô»Ì:Ú^ñ½}¬ŸÃ¢!Œªî̵ï€B_p!;² N0{åãáÎmÑ ûr`|‹õ¶cà2Û2úÂZ¡^%Ûz‰·ý9±V_16«P¸»&ÿÜïé–õš"³µ­ˆ‚]«DÆF§ ^îc®ØXÖ®où÷úÙaÏgÈ8M½_Ÿó‡Šýe;ä²ùž\œ|ˆ2Gf7sÌk4e¸ ?OB0>ñ½bx»É˲GáJÍiJ¹/8ý,_쌗=˜CƸÐ%Š“u·±/Rfzº5¡Yvy³å(´jÆâÀŠ‰k ˜4³æøÿmð¼ïÐVß‹åØpÏøŽÛ¬Â3 ·¬O ~nbÓbV>`³ÏŽrDk¢U¯ Æö‰1E‹Ô×¥eÞiÖ¦e~{föa?) *¹5Tƨµ•ÄjGü£p`P¸wŒýÀ± Ò²:f>Á1÷'“‘Åù:ÓÇ”kvO±ñ˜„À¯' f:àOhH”º%¶BuS‘]Fy_¨±ùzïœÆÊÔ^PIaRØ$@^¡¶ÌñæÜIéO&#‚éD%¯"õ SZlo„~ª–cšÆccîØŠâÔŠß#a»)vÇr…ö#ŒGŒžÙâ|]šcJ½‘Ï„Š´Ÿòüäć. Äh¬µtÌŒfVÔ¾òA|||CáN©OÆ„Eî­(š‚Ô¦¥ð(v¯1±n%àóƒÅ];áQ¿æŸóÒÐ0#܈ Ë§$„¹!’Á×%pž t% !5ƒûË • -zYÉŒm)ÖÃ1/h4VIêÂÌÏ.Ž°€Yȸá1Ú” -YWô™öfEc›% IŒ¹¢é4IíÎûf75µÎñøR›|¾(7§4Ì ®,€:öÛ홊‡$u”ºÍÞŒò°¦Ñ;‚Ñ+ë°XŽu,ú®Ð² \&¡áÁ©`Dw¸savx†˜¬I²•í¸Ëhîb¥¡E¥µ<(P¾™kÏ<ô -þ–ŽêÞÙ¢ ÞÌ©#Ö‚µ¯E½¦)Ê™™?q‹'þ2Ë5…}™5 4¹¡,òûžjÎ[õ¶´¨û¢ùƒï!@Öñ®uŸQmGœ3Š’ (Ъx$3O‚ãþ -×®©éþžÀÌïKî ÿD¡vŒoŸhpýªº”º,¹7€cìS[Ë4I`ŸÃ† ÒM¨LN»ô‘Ñ” Q·šÁ“Xh‚çùŽjuK?ðav"gÚ5Àç\Å9½`©3üp|ëÑóqÙš_¾ëȱ‰[$8ãuuP,¸’CW7rÉwÛƒ™˜rÂ-5@Îx;ÆDcj(LÔËÁŽ™ÂÄîô|EÓî{ÔO½o­µ©mÕ.6îL},i×À«b½±Ó ¡aOM©jQØPdÎYãv_þ</ª7¬‹2?£˜6ao< Qc¢“EëÌØQ—ff÷R¹Sl´Éh©á¯Êƒ‰»!w²“)nfØé$9öZÜ{ǽg›–Ñ!¯2n옊é³S±”·NÑ4¤UìþÒ{…ÍD5¦¢Ɖ+zÌŽÈKîéÍÑQóŸ™A2ŸÇ©qbÎ%gzÄ·>·âKÛ® ­ªØíSÎ'L6!¥ç™•1©æd ±ÖᙌYixòœÎ(ZÏEí–+îÝyÀãn}¹Ìûž÷é§ÛÐÕöÙ©8n»ö©ÎKF‘/ƒä«}ɧ．û©¥/ãÎKbïcÝå—¬ÚÙÒ]daóP–õ¥¢~jX’ÐÓ õu{”Ó¾)•¾1bè5¿çYi^ß~bíÚºôYkÍQÞãÆ‹}šþz}ÆSÚÞrx¾þÉ:À-8!´± ÔPjÂo[sûxÏe‰£·¯D;zNʸò÷ó[Õ¿-?2`x‚ֿ^­~|ª%…NRU,üg¹žõw´a€Mü4 žšb?Šµe†Ü礇U⇉:Ãñ_wÐÁªendstream +xÚÅioÛÈõ»…€¢,'äpx( +År¶Þ]{ÓXnl%ѳ”¨Tÿû}×P”D§Ý¦@aÀœãÍ›w#äÁŸ?JBåé(N"þh±¹ðF+ØùþÂod”…¸õjvñâu|O¥^:š=Èlù‹sù·É›ÙÕÛ±cÔØãĹû¬ù¾ïüã +Æ´mœÙû78»càÉí”w¸x9v}çþíõì=/Þü]üò«7Zá?\x*H“Ñ#Œ=å§éhsaÂ@…&yyqwñ÷ àÝ5A¨¢`ôro”oüÁë€hm|>‹…Îx€…Glΰ„*HFZ'*0i§”ÈŒ|_¥aØWÊm¢kQ¢ù€ü|(ß#•>|åÁUo÷ÆDêá-¼¸Þø£i4d©Ò`iìŒÅOŒå.º6H×™«•Vfì“-¬,q¬ÁÚájÞ]À6ƒí-g•û±*`²å3ï¿+¶KX¬Æ:vÞº·Á#íX'ÎS™óò´"Jð®B°Ü7-oÎÇ:užPx$1´–”XÈ¿Xû¶Ø®^"À‹×AxÄ+دJâ€Àëªjÿ4vC:Íf¾ËšæqÉS÷#§?ßL®oÿu;¹¹’š¿o¦—½Õ~`ˆ­á¦äˆ&÷ža&ËM±-š¶ÎÚªþ3]VÕK¦ñH®EÒ£ôT7ûáÂÊhËóeÅ_ÒÁzŒF¾ÝdÍIÊ<οIZû¬À"•DúT`Û¼åA½[ð4¾!ýQ–o¹Ì:Å7üEâ*YÛ2É9™L“!7õnyÎ#.íšg=‰á%†çÛŠ¿t~‡c‡1õ$@뜉 ûDjpåÄ Ä[Ø2NX`#4`Q¢Â(ù÷‘)P&ˆã’ì"üÓ’ ž TÇ*c©HJ–µ±ÄSî PøZN€uŸr•@„óþ_¹F‰š#ßʶ÷¢e‹þàùf…A¨Î^i×…ÀT{BE×^xÿ #Ã÷™Ú¢ <¨Eµ} ̤ʀÆ (­Ó‘aµâ\dpêTªÆ£,è ]ýÈ5 ™±u‰ó¿OŠ®«$AÊR[pæTv¬BÞsªüÆVê&q6èo‰³Ìyj²½ÞE÷€³‡3V[>ÀùQ¬`­óOû‚ÔÌspØnXñwn}éÊx­i3J@!"ãþöúŸ¼•ÑÝ‹jÏÔðöCUó€îÀ¸H;û&G@m(WáÃœ°';D|!RœZd@¤A¨¼¿žÊÉí"ç%+!g ¢¯Ú­¼zMóC(Ë…ÎÆë\ä»È8i/ùÞ. mëœ5AlªV®}GéWrv¶é äXx©Þsf6ïúµ {‹)»åEª|n‹«˜ØJVõ/ûml•¾dh– çìêüs·×Ç[V« +}­±-‡[V‰„õN \…Ö#W¬-i7wü}GUÌQÕ‚gH7uµ_ ™Ã†ÍÅ’‚¡ödádB2»™cŒXÉ¢dò‚Hü<A÷D÷’×›unY);HÎùë¡0¦®ÔF§y»x!e²>h©ˆÂ3URl5[Ãa ê’¢UÁ VÄ„›lÅ¡Ë6¯·ì»V;èyìŽ11 â³'®ØëÀê›c·¶8ÚÚ%mçµ¬Ø ‘ñwÙÏÌÅÛY ¼tðñhAĤÖ|ÀƬM ¾C¾ˆí@ÅžøJ§»y±^IMþöû¯ÄÌËu¶ëÒ¨Bí'™9íëŃ^Ð&"(¡çRXƒc¼„z8L{’J<Œ1ZúΡŠÎÈ>ÂÄ™ŒC´?ûOB f¨æ¬ŠÑ‘J£”3µm¾žgÅš‡œbó`WxæS {TU¨Én1WõŒ¦®mÐ\e@9u²›t¼`ÿiá:í¢›u"ýN<…ôwÖb…ÐéùQGäÿ@kñÒBC®"µbO DúfŽ* ŠÇX†žÐèCìió‡äß?ý1p @˜Åƒ$~?p5ô¬qÔ¥ví 4«F +HÄ·ƒ0ôœÉÇØEδuAm_àQ´bçÙã¤Ó^èÝ7ÈwÍ ?åŸóRpHÃÖÃàþ€›AS”¤Ïpìúaøõ"åU…­1!ljøÐå‚Á˜ØôšÜˆÞHúPHeÀ§ÜiòM¸ /FÎdÑ6â|jK4BO ½d£À¢Ðÿ8wâ1ûå.¥’JiRCÏB¨$ôŸ¤!¹À5‡6¥N-^c»wµ 4O¶j³n$&`°GŒ†iQç–#DxÀ|eÇÀìý}¼¸ºß}°W-ÚRÐQÞ+Ò.ãƒM»ƒsÖ­Ãé.=öR€$`Ë@–Qµªæ@†\·H¤šñ‰ñQ™¤V-;”h™Õ¼Ù»¥,,K¬dÆÝ— " ¯ì–tÐ ÚCÿ@'Ř܋ ÁR„"ɼh›qTÛ’›[['P@=äSžSmhç•-v¡ÛïøP?ø^ö¤R•%gc8ó=*~ÛÛ7‡7Åw´¾dÊ!Ц²÷òÆ5õ H3ÀBª¢I&² +Œ†’»»Ä aR"+•‡ß3Î$ œ§ø¡‰ðHÉ€ôf€£g¼þŒ.`ñIʺ?‘×È—ï:q"Ny¼4K5 ½wk[Èz<è(9TáÊ2ÞŽ1IQì\XÁŽ4R´´&ÒþŠ&iœ÷(Ÿj_3Xcc:^Û»˜µ¢Z”¤-ë›bµ¶ õ‘׺FîÞ72 kóðýÏeWÛì8Í=FØë73T4˜$†~€Þ‡¤u¨JëÚ©¡¸,H¤Tóls0ñ5Ù‘m.q3ÃPmÀý8Xn©YñÞ© #˜övP!Åáýs2%††|‹+Уüƒ‡»lNÍ×b‘ó» =cãþ]/Øêʾ,'mjÛ¨¡÷ü U~®pÑF¥q|T‚.] æc=ÕÕ—l³+…(§ óÃWqä÷“¡ +_´( Š„Ê(/¿þ> endobj -4096 0 obj << +4209 0 obj << /Type /XObject /Subtype /Form /FormType 1 /PTEX.FileName (./xslt/figures/note.pdf) /PTEX.PageNumber 1 -/PTEX.InfoDict 4120 0 R +/PTEX.InfoDict 4233 0 R /Matrix [1 0 0 1 0 0] /BBox [0 0 27 27] /Resources << /ProcSet [ /PDF ] /ExtGState << -/R4 4121 0 R +/R4 4234 0 R >>>> -/Length 4122 0 R +/Length 4235 0 R /Filter /FlateDecode >> stream @@ -11979,12 +12313,12 @@ q n*Œ1½÷¨¾x¥Æˆpîâ‹&XîÃœ§³±è\íD¤ßä0}#XŒûž˜‹¸À>#^V°¡|2Îi‰9ÊÎr)`˜¢Xh¡Ò& „hb—H°Œe"Ãêʱ„£~Ï“a³tŒºìZDß!#Z¶ÚÂk! e'jÝ=§ _tsÙ¬ûÍ&­Nå@‚i¬ˆ3t%kÐE„\H–YZxÿ/U¥Ç™åë—Φ@±¯iW H þrÓGçX5¾ûû8‡´ÕªOª«t–Ô³$Ây°‰—BÒ›ÀÄ5©/¨vp÷o`kA“ôr ±ñœÓ4N.4Žæ&F°ÑTÆG%V½ Î'ÌØR5¬BÔ‹`qUžv-UÍ=ëÆåQv2ë_ ”¿­qq‚~èr¯Ú5ÌJ¼ð˜°h»P¡õ‹kÜàéÚýªå>Ò¸D °o»Îi¸CrT]¿MJ¥ ÆÖ¹’°;¿ö‹ûóZ¼¬ å[Ç-œÁ¤ŸBx¿ýpü|üÈÂendstream endobj -4120 0 obj +4233 0 obj << /Producer (AFPL Ghostscript 6.50) >> endobj -4121 0 obj +4234 0 obj << /Type /ExtGState /Name /R4 @@ -11994,2865 +12328,3229 @@ endobj /SA true >> endobj -4122 0 obj +4235 0 obj 1049 endobj -4116 0 obj << +4229 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 406.344 213.036 418.033] +/Rect [84.043 400.366 313.004 412.056] /Subtype /Link /A << /S /GoTo /D (winbind) >> >> endobj -4117 0 obj << +4230 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [339.379 379.245 525.639 390.935] +/Rect [362.528 373.268 517.544 384.957] /Subtype /Link /A << /S /GoTo /D (domain-member) >> >> endobj -4109 0 obj << -/D [4107 0 R /XYZ 85.039 786.531 null] +4222 0 obj << +/D [4220 0 R /XYZ 85.039 786.531 null] >> endobj -146 0 obj << -/D [4107 0 R /XYZ 85.039 364.977 null] +150 0 obj << +/D [4220 0 R /XYZ 85.039 358.999 null] >> endobj -4118 0 obj << -/D [4107 0 R /XYZ 85.039 329.567 null] +4231 0 obj << +/D [4220 0 R /XYZ 85.039 323.589 null] >> endobj -150 0 obj << -/D [4107 0 R /XYZ 85.039 166.128 null] +154 0 obj << +/D [4220 0 R /XYZ 85.039 160.15 null] >> endobj -4119 0 obj << -/D [4107 0 R /XYZ 85.039 131.984 null] +4232 0 obj << +/D [4220 0 R /XYZ 85.039 126.007 null] >> endobj -4106 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> -/XObject << /Im1 4096 0 R >> +4219 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R /F58 3380 0 R /F15 3032 0 R /F59 3455 0 R /F20 3021 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4126 0 obj << -/Length 2689 +4238 0 obj << +/Length 2694 /Filter /FlateDecode >> stream -xÚÛrÛ¶òÝ_¡Gi&b‚àåÌô¡mÒsÒIÒœXm'Óö–hKŠTHªŽÿ¾{ ^$·MXì{ߥÕ‡µHŒçët'‘g´Zl7þâVþ{£b- kæ»ÍÍËL´P¾—úébsßáI}ϤÑb³ûmùýÿ¾ý°yýqµÖZ/CoµŽãdy»RK˜SJ-y cZ—›Oðí–¿}ÿŠ·8ùýj­–?|³ùÄ“ï~zÅ°l~¼y½éê\EiÇüróÛþbWúñÆ÷tš,aì{*MÇ›ÐhÏ„ZÞ‹›Û›ÿw¸x-\ð®9®x&ÑS¶(ã°%Už¯âElŒE†Ø’í¾Gƒ÷Êë?WAžû†O8Wkï3/Þ­ÖA ÏŠöxpûÑf`ÉKãdžR,‚€æš5ðÐ*YÖôzoç‘®Š—m5æ¦2‘)`g÷ S¼/Õ |t¸a¡×ø”cœxÄvÏGÑ*]nñ6ûì3­{ºªäç®:f‰ÇðE¸Ã„5ˆõp_JÆѺ—šÖÂ\¿Š†Ått•ûJÎ{¬já6œVáü1köuþÕ;<_ù Ü߆ßVåï¾ -añá¼f©¡ö«Ò¡°!m©N„cÞ$¢4¾ë«ÖíÀÐmXU^jŒcÝQxNè ¡§Q ص1þòt‘”8ŠaŒØÂê™d‚gmWÚµ¦õß}ãÃÔÏÝð6ÿ3/pÁÞí¹Æ]ý&W—.¥^pAŽÝÅz˜©-0f? éb·®I&‘XÚÿžWx›WŸxñXî%Ë]ί$Æ$^füZt¶Öò|…[ØïëêÈ£vŸ3É–Õ›'÷ÖZKE'š‰ê+&Pˆ6“”UË Ûì”݉ Üó|F"R¤…8ÕõÎhœµ¼P›‹–G‹C¿„Nßèå›#’iƒÃx¹Çñþxâ•ÚÞp[¹³S;Æüþ§ omQõyxîã¬p°×v &·'fAà:f¥U˜ÞÕ$¥Awù´Ïâ·×a±nŸ[è ]Ðxù™/€¸å¶À“ïòÿ\Г &'Wõß!ý•ë‘}å…¾îáUÁÅ“hàG^b’«-Ì„â0¨ÀÓ*Pü@á®Í‰•í!+$ Ø’’VÈ^âù·, aEJ11t†âßI.ñ+©øŽ,ïQû~¾ |ÿ+Cœ²†ÄCTgæèÜÅV–>º\d Éõª¹"†yV—©õb’›—BOî­Õ?fã=?…7d@Ƙ­uLÀGŠÝ™0žýÌbøÎhW3ËÒAÂshT‚€b™Œ Ï‰Ý ‘>H|×pAAäÅêiô0WÄ!@ÏÊã -Á^ #Šóq(¾bEÏ…GÈòë0Ί´À?GÝqñŽÿ…(9 -¥nÛsA£BB–<)^ÙE;IÜÞÚVòÜ÷è¦Þ ‘\òN/¤ˆT@?wù‰gÀRŒ|æx51Å1Ím±xšœ†é÷A8Ò\ÊFC©3CWõ ‡¹¢ô¬\!ØëÁˆâ¼8)Så,•åê„¢O¨Sv†8¸Å< Œ1ã×± Ĺ;JN2ÌÂÐç”nljQ:ÌýB‡™ 9¶:|Ÿ*ŠCp¤(„©sì»]^¢Wxšn³ÇmçVjV‰£å%Ѫøt=q`®ˆV€ží‚½hGçEëPüõ€9&xÔ0ò¥8ÃQgï1åa¤:KU6ƒÅI†W±ò¾¹“8 ßVgpØ)&0´{Ų&Ò‚íÏfà4ŸµvÔ“ExD]dá›t®I0”®“¿äˆl8®XÞ\ÒRtïc²£ÓÓ°îIÕ{A E´ö=?‰‰ØŒ(q4í{Ä׊¬xXdÅq»G¹€º&·‡&¶ÚŽJž(gÁµ-y—fÚ5ÊnËÁ>ÁA.sæ"fºV S/®_, ¹ZV›½2´¡8ô¶ÏÇâgà ڤͰì¡òíå ø®’coÈ1²é¼ilÿ 4(Àö|â]Óˆb/J”lÊ} -šmçñ5Úñ!sÈ0p¥3 ©½ä‚ñ´„¥Jl$>ºnÖ°Ær@¸tÕ“N‰J´™h áevÌ_ÎdøQâÈ_¬REéP"q”†°ñW³¶Í'R,ÄSñ³¨HE¢¸›âslj§º wÖ -ð"s L]¥‡{οJ]ÏîœÉw7À õ•s]²(p<Ë©Hü ŽÈ éC%L¸…1"Õ3;DPö¾á^ˆ ´…ÃìÅcÛ)@DâqÖ94OLln&€Yçë†jáNì…s®4ÄG„¶!ƒ S(ÏÒ!…ù’‘Üû1!vX¸T:Mðõ¬‘.sQe.}éç­Ã$Œ“p5?°Áà`Þzì¢gZÍÖÅ“¡[ÏÊÊ gÜ€‡÷wßÍ q`²æ߀ÿƒXá§|îO«Dc91J=öÅŽ_³¢Á¶ÒRåü"ÁäÉþ–„Г #β€Ø)µ †µ.@j+º¯æ:š`TÙP¯tOª1†Î‘E#pgpìºëÃùÿ¶þê¹x³d ¡ÔÕ`ud=/XUÒ%å¬h$™Á79(ÂwÆ?ˆ8ï‡4š3Jz]ac^në'2%ÐcTâÌŸ6Ýf'jÝA݉DìaCK§(Í Ÿz߸±å1Œ2~P›®ä¬J¶Èû`#1zm ‹Þ8òŸ'PPÿ:´æ-´-ÌØŸ4¼Îñ"\vû8À>áÝÛ\pyvôþ¦Í£ýœ¸@«ê¶3ÔƒQ|a æÃÆÏèONƒ¯wnß3¿ÏÈTÛ9£æ ûpñº5-EøøRz ßØõ‘iA>rcWjç0V}HÁ-Óì&'‰ m“f2¬sÎÕ)™ÈwžÀ¡åsPª¸Ïä½m;@Ê™Dl(1IM€)®ÁFïLfŒÉÂîl§{ý*pTë‰'­n‘]AQ]ÍCëÞhLxö¶ãjÅl¿RÁdבÿ‚ßqrvž‚”BG m\[Œ®¤ù‘üŸ_u, 8zC<°Xë4òB5ü:–ÁÛjö-1“='¨˜@‰o¢N3¬€bf¬R­1öÏƲ0ºTX#6I—h7YÞaí‰{n>Å!ñýÌþWIJµò¸HO-ç<Á†`ŒEm¢±Ä;ÔÆ\¼ -,mÅÌè¥Kó ~b³Öü>ý&e¢k˜«ç)ðCøƒ¼¦ßo®‘À mR]¹5l‘µ6*CÅ >šaCÚúDŠk­óaªk­v*³Ù]t—ÚbÚx¡žmV¯¶_¢ÿý¿4ô ˜ÄK“`¾bÀmGqhCzƒñí¿>LOü§–.žendstream +xÚÕM³ÓFòþ~…o«W……FšÑGªrHÉ’‚ E%9È–Þ³ +Ù2’œ‡ÿýö׌dK†b÷°lq𨧧§§¿»jÀ?µHDÙ"IcßDj±ÙÝ‹{ØùåF F°Ð~Üúquóøg/TàgA¶XÝʪøÃûéŸ?¼Z=}}»Œ¢ÈÓþí2IRïÍ­ò¦”ò~ +kÚÖÞêý+üzÃÈ?¼|‹7üév©¼·¯Ÿ­Þ3ðÅoO÷¯Õ¯7OW#¦–Ú×q„\}¼ùã¯`Qã¿Þ~”¥‹X¾Ê²ÅîF›È7:’ïúæÍÍ¿ÞÓ >5óö¥Ö‰oâx±Œ?…_'„tF‡¼ëš¶¸]šÐx]Ùþ]¶¼þžNͱõ?”íºl›ÎxÙ㟕Ñ[?KÒÅ2L|¥b"ýª)”(œ¼+Y4­…ÜÙE‹Êë›KiÅ1hP;‚ðÞiï¼xý ?ëŒ §Ûm~€+úñÉ#æÛd£Fƒ49õ¤ÙåÕ°Mì½(wë[\"Ïݶ:\2¨LOÎ`=£„ÈCÞ¹Îc¾/.i† +4óÁ¯yî›rÓW r…^âÇú’4p«óŸs{׈wM[òEÕÕØ´»Ü^²&‰ßç(µd käÑ€U†‹¥Bû͈f¿…ýªcÛ4û?¥ïkóá9ÍÖÊó/Ÿ4ÐKÏ¢x>,CãGÉ B+?3fü:íG(5QÀ˜äÉ~Å ÊöHVT¡AÝFwâ?èmg1Ÿ——5.c:Ôâ©á «™F”fW8ÀŒù¼^ÕÛ0E;]êPóÍ|k˜ «|zº]ZQ2¥®Á½ë±Gö¼×àÉ3¢w¨ÎfÇGHk¥¬ñ¦žº¸ÞZ¢{B˜ÌwHr àÜ¢ÁwÞñǾ‘‹7ù!_×õæŽá9X7›í¹œ,+83)ëÂa–Ñ«‰¾eMïÇá^Ç‘A^ j×`jÏÖ3> -3è9Õý¶>ñŽ b›fÇOGP()¿qû†V˜[>Bïʼ?:rÄDDH–-HøÞЩªÇ]ájçô;Š!™lóŽÃ/q›ïåB +r6<¬ó *僼<²ßæ=£‘ô7xµstÏýnÆ  ìtÖUìGÒ‡@£ÕŒACH&ÁË×æJìÂ-ý¥àõ +_Øô%=½¯òZòø†ÞÔ`Èá-†?gYŠ<ð葽79.Aš—bàZʾhHˆ"¹—+ý8 ‚OŒ9ïy R˜kÚÍ*™„?ë †ID¿Á|âÿ߉÷¹5ÐÿÊ«9ž;*­ma0‘ö[bÎÎéT7+,”È(»)!@‰BÖDçšL¼’®®0¿ žúE)gß–”Ÿ°U–• Æ`HF‰µ¬òUH`ƒmî9ô)váâÀUè=l« nlùI~”¶ûjs¬i…á{+´²( ¹c[îyÕõ å›ý½A}7(j—[„|[R?©þ?3ò‡íX¨„[~bko—KÂE”FìN’ ‚ ¾qrÜHIÓñQÊñ`ɸž $r-h<ÂëRÜLP?8„òÀp³ŸaK9^üS–צ©vDƒ²‘H¤»®Vø±þÆÔ:­—¢”b¼Ž2L¸  +)çÏËp„0t²¶Ì?`q¢.vŠúÄ›g%Üà(sÁ¼kzùžê}táeE€”\-Šr.wšÑU·ÅcÇ^ +ÉVû/¨*ù¶Tõ®¢ê žC!Eîˆ+çŽ W·±rŽ¤l±†@ÆWÞËßøÜl)…ù†«»#ÏŒŠâ˜ ù½½Z(TS½Éð¼·«áZê°Ñ¶X™&c eûT[ëÁ³jŠ÷6Õ5¬?iÆ¢³Ü7²ÑiÊô¹ ³ê…†)HºìÆñ0 Û2ìÂ9øâ,ôE¡’ü*ª]¥ÖÏùâ­„å*^Ž MKf*~^8¨×\uVƒûH™ZyãªêÙíahõ…зÝøMÐ¥¹gÖc&7®Z±Ö`sÔy9½b×M¯±Fî†ZŠ¯Í ÏŽAùÈwK.xªFЙ[¤p<¶œ*uC*‘~¦à­2o늙Ĥ‹gq+hƒXÍ9St6ä‰éÂúhËѲ]Θé>ß•gòTª†òŽ?0§¥¡·­”p£º§Ž1\Kñ8ov4ÉJ•)úÅ=µy©r áœg<ãYT<`õês¯é@+ üÔYÛF ™e_Ì7tùJŸÏ7ÊOJzËà–ÉÈcA @†ÅD÷ä@´~|8¢(Í Û<ïÜQáµ³×åAæØ_í=»1b‰]É/HŸËìÄ£Á|¿‹à¯ç„ʇê™FÒä‹i%°–#¥Å}p=힨„EYPª¢qÐá¯R¶âœYÿý‡„¥g+6ŸŠÁ/¯kš¯Ô*îhf„q¡/c#t‰ð<0€¨žï›q6ã±3|¿øq†ÈÇöüÂÉ…K„ŒŽ¿Î%ÒÄOƒPÎHB‰TêG:un½¿M#l™—‘þðͱfߎ4Š¬kxÅm >VÖ;Ù$âôLMYKC×sÂj55@€a¢У´¥…iŒe®ÙÚ8Ô¢T=L¹áZ‚›Ý¼Ër=WUL-¡>OBa‘?Ó/ ‡47lhìAèöXl¸ =T-ˆ®kÈô0£©,§´€ÞÝù=Ýñàò¯`ÀrÁ(µ'XƦ¯(~ t4A®3–Õpͪ‡ÃÀ—å\Üœ8çø¦&v*¸œ½¥›ï ™J"dcØéÐsB;¡:-mtM¤ ë5K¤Œ‹+fÈNô•[„I“8s„Œ 2O¥ÐÁÒMF¦þ$G»kY`Cy4ÄÙìœíÌ5d4 ‘)L¹ß´'Š€•\­/€nþ›ëÞ<#‡ær"02 ÈyêÙÛ qY’ØWÔPÛAÑ¿?Íü{DhÐ÷L¾»ˆc:€¶º”¡%×N±e6¬&‘m9.+é@ÿƒî%q\ü¨z¾°’ÍöˆwîÝàQö3AZª0õÃìL9Gþ›€ q,k”Le/% `eÃéÚN=)Vwb 5;ÿ€Wã„%âeŽŽUËšèlí¤Ó¡ý{ +]õý+LöÙ^ˆöìËDˆóÖ)yüæ0 ý8°Úûú×N§ï:ä '•,ö¡«K´-?â˪5UŠð‹=vQ‰uãXA4El¥Œš·Re ”wÑW—„:²+*\`F,®rÖ…@ªKµ-à$oͶO emDK¸už§l÷¦¡÷>— 6HmISmX}ÁuµÚ ,ªà¹>”È^"€0]€rá¿’ Rš+Ùœ€x›ñ©»€ÞÑ°’³ +)Ü1ô^®ì=צ`“fmÜ ×ØQ´6ÒÍÖ»q›jï¾’ZVâ#˃,j]—çîÙ\YŸú‘” P“ù‹‚r +'!ø'_'g˜Éú•6~&‹eù:Hçÿˆ(¶òßýŸ îgxŸÒèhò(Æ9üüãÎendstream endobj -4125 0 obj << +4237 0 obj << /Type /Page -/Contents 4126 0 R -/Resources 4124 0 R +/Contents 4238 0 R +/Resources 4236 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4080 0 R -/Annots [ 4128 0 R ] +/Parent 4243 0 R +/Annots [ 4240 0 R 4241 0 R ] >> endobj -4128 0 obj << +4240 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [155.623 725.431 326.449 737.121] +/Rect [156.085 725.431 311.057 737.121] /Subtype /Link /A << /S /GoTo /D (domain-member) >> >> endobj -4127 0 obj << -/D [4125 0 R /XYZ 85.039 786.531 null] +4241 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [333.88 725.431 387.977 737.121] +/Subtype /Link +/A << /S /GoTo /D (ads-member) >> >> endobj -154 0 obj << -/D [4125 0 R /XYZ 85.039 697.613 null] +4239 0 obj << +/D [4237 0 R /XYZ 85.039 786.531 null] >> endobj -4129 0 obj << -/D [4125 0 R /XYZ 85.039 662.203 null] +158 0 obj << +/D [4237 0 R /XYZ 85.039 697.613 null] >> endobj -4124 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R >> +4242 0 obj << +/D [4237 0 R /XYZ 85.039 662.203 null] +>> endobj +4236 0 obj << +/Font << /F56 3312 0 R /F58 3380 0 R /F15 3032 0 R /F59 3455 0 R /F20 3021 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4132 0 obj << -/Length 3000 +4247 0 obj << +/Length 2885 /Filter /FlateDecode >> stream -xÚ­Z[oܶ~÷¯XôI dQu)ЇÄNÏq‘89µsÒ íƒ,É»ªw¥ÄµëóëÏܨË^Ü ‚@äp8‡3ßp­füS³D»^Îâ$ru fùæÌ›-aä_gJ8²ñ¼¾9{ù³ŽfÊsS/ÝÜõrRÏÕi4»)~wÎÿýêÃÍ›_ç‹ œÐ/â8q®çÊšRÊùïhÓpèÜ|þ€½kf~uuÁk$žÏÊùøëåÍg&¾{Á¼Þüröæ¦Wt´¨æ—³ßÿôflé—3Ï ÒdömÏUi:Ûœ…:puH}v}öŸ^…3žuÌ*–cáÿ5˱´§.çÍ*H\­ã“rh–r¸ÅìÑžœþ¬"?v#=œUΔrS­ñ¬àŒB†‚x°"žÕU5hèr߬Â%Ê }²ÅìËL¹^˜¦³ŒÚ¤ý°+"¼¼Ü¨ÙEjÎFšŠØÅH.iª’‘W)?u£XÏb?q•§HÕO«õ¬Á<ü)ÛÜfÜ«:þ¶»èuU/…^ã®À z"ö¯Ð¨(¶#©-L{ 3´<“Éù®­È@~ì<ñÀéÍ|”¢déÕSíF*á•ëÒ;œÝ•µ©²5™UÆG€ã÷ˆÔm6÷Ò*Û,pð7•¸Q¡Ç€¦$¿4¢óá.Á=ÃÐ=¶¸¯ýˆ‚ÜJ/`#‰ÏCeû`%MvpPÖ\¸“a†ÁNà˜†‰¤>6¶¤}™#SÕ•ÌuUš×—ﯙc“å« -KkÔpÃŽH ÍÝD&,&IvIcØ&ià&±š˜$ÛÍÉŽ`bZž¬[5è6 +lÒ8„&„cWŠS§ŸTsÿ -ûïo¸S”¦ŸMÊVuÉ‚Íj®ø˜¡s×6n]±¶¯a¶ŽBêlCŽÃ·¿W|MFtš{ÜÀÍœFÎ-9ZÙ+µ#c›ùª©ri“ÍR= šÞ¬Ùhœm„„ŸîÍ´g1ä¹õ+Ѭ—|[™¶ï<ÙAXŒ7©iy†VUÚ©ôxÕo;½y7`ׂ9Å– -…¡ÙÍÆ*ZÕb¡Áö~Ù6ä´|)•¼°w+7ìÜEév¡Âh6Ê\ß1Ù*/ž-úþMÉ‚hì? Ž"ÁQЧ1ß;Gd çùdˆÐ \0ì£O˜:oþÎ6Û5_à Šó¦þÃSár'ˆ7óOSŸÀ<:ñ]?}¾x¾%G4ÔžëG iø±ãô©çÝ5?ÑE+Tè±cÚ†D;™ôéfãw‡Á·W=Ÿk¸˜kd'ÄÕ“Íø Ñc×KY—›…TœÌJ®Á«Á©(£­éSvŒ+6lg†ŒŠB¹/1T¢ˆ1ã]³Æƒ äøHÉiÉLÛ¬…Ø2„~‘A±gO]© ªrëæMM«øžèºü‘î‡vÓ8]ZÕŒlÊ:oŸ¶‚@6³>[Ã-£L-‹þÄk~žCæâÐv$&í£ -)£ÙãHÄ—{áz›uVƒ‚7b³ÍjYØO,ú›ß÷\Õ襳0JÝÔÿç¸~|›/DÒbÅÈqpƒÐ£À.‡»°ùv¢Tärð¿‹V"êyµ¢¢\8V 2)@µ=µj{½ŽŸ -/¢ˆ³Æ [‚‰œ÷õ1œkRÈL¼T0èÀövw\STTËÚM&¸hRZÊÖUa1_ÁcÁCŒrƒ´ÄGHE„W³½ò‘ð@,ÂdKÜ'Ð.‹©?1½à$ÐÇMØKÛiOoBÌ_=h1z2‰ÀeÛ6ò Ò8È'„k`ëkÍLŤî@@_Y°ãð…g3XÎÕè4®q ›%xLÙò$Ë%1óð˜ÔÇkJT=ã•œlêBe¸^AŸ¾Å+L]kGQúïMuÏ89‘h(ãCöf¹ëX΀$[FáRÅÑ”ºxvîñT·7⎛ìŽ1—ŒŽôÐî²jÝɼæˆcµå_ ½Ñ›"o0N¤&›â› Ĭí"o?7êþbq Cä§0­ÉTÖ¼(xä_ÈF—¾ÃUå[‡Þ×_¾ï8~ððñR%TñûC¨‰ÒÀùÔkÜrÙ2üDÌY™’{òDÒôüÄMªÙ‰÷Ljv†ÙÁ# -¹¦Ã×d­ÉR…Xâ¼ã()hDÈálÑßm#YÓeK½SÆÈŒa"ä5Æ•tàN­9¨´Ö:ÝnmzìIß‘£0aºs´ÉÎtÓ`” -Ц·9ü†ÀSxƒ ˆ­=ÂîÒÂk os. ‰Ú–_PÛª±F’'6þå8è•1­3ì÷9:¨ññêò7Êhí¼ÙÕø6c˜HQ÷s"µ/,p¦ºq¹²Ýjׇ¢˜Û€?è ÔÛu¿Ýo$Y½”v& º-‡˜6Kó—M-Kßö€9 ƒ¦^\¿ƒïkœ÷òüògy®Îו8[çž(ÐüX»ÚŸ-ÐF<} e"ÔÄC懑Ƕ„ ¥vü0ðúÁÕ `‡ŽªÈ|Uæ÷’‰Ohnš<_ÜŽx¡š•ã%ô‡ša½èÍùDDr,f­pb,$à  ¼ªâ ~׶¡¢w‰Ð?] á`&Ò‰©5L¤ôrj„.ùÞ›l½.ëeù²ågØ-ç¢Ú.ýµñCO_40DøXâi/sïÝ Á[èQ}¬œ·è7 -Y‚!}ûÕÍÛw>LRܧ;ƒ<ä‹5½OùZÈ°Žt™tMù·á£! õ²cˆe­¼®^üàXÎ!·Y'ôH˜Ü12›à>ô?/q.mòÔRø¢•›Ýº`ÒpI!5õ!”sÔÿìÓY:ÃÇʬx¾`OíØÛ‡ímÛ~ ÓiÖ/ö’7òîÄUÝtÔ®ÞôGá§ìC¯í&lâïq &Wf”Dó« ¡w®3îÅrxH'ø‡SÑéñ œþî- h·6ŠAÒ…&ÂnÅÕþM£žAl€í¨¦ƒ²3Çpò§ €ñFoĹÅO[º¡8x`nâ^àdrêØ<21á±éòSH&?Š¬¨@ñ|‹Êš»²'Èa…—¸=ü’âïåg TÞGšßç+Þ¿ï ‡-À€ -7[P*çÇ16Ý0Iž ± EX(}G?TAÁzƒ*ú‹÷S”ñ:yn5˲¿Ü$ +å»òÇ˽ ¼»;…¼ùU%m{JˆpŽ?מdØré‚á‘&Ð(–†£g@ Íîk~¨Ãs/ ¤’ lÑ -lôH p¡Õ©ã+Æó?€[ŽÓGÄ,ÿtB§—êhºÖÑóÖ¢rŸöŠ|Ù—(Q‡ðfï®éËßýñ»ÛrB´o92ÿR¯ü¼Ë/Åä-Hö¡Ä´xïj7KhrŸ/¬át,tÖG^4Mk_güD~…J´(ã' ŸUßFª‚Ø° y4$NX;ˆ(.êÁg>¾}Ë”8´P¼_ý$ê³9rv”c+#J5üå<¼â8ˆ AG¢ ¿ÑRûâÍ©¿n´òÏ û¾ÿÙLßô‡½³‡Éiȧñ7š8´Ê öÖøËLÑøÿ^.8àendstream +xÚÍY[oÛF~÷¯úDÃáÌð²À>$qº›"v²•³Ù ÛZ¢,Ö©”]÷×ï¹qHJtlÑÅ€9—3gæœ9—ïŒÔ,€?5K¬èt'‘oµš­öÁìfþv¡„"˜?ˆ,N½¾¹xù½f*ðÓ Ýlˆäfý“÷æï¯>Þ¼ýq¾ÐZ{ÆŸ/â8ñ–såÁ˜RÊûç[hÓ´ñn¾|ÄÞ’‰_]_rc‰ƒoæ å}úñÝͼúpÉ´?ßüpñöfp¨…ñM¤ñT_/~ú9˜­áà?\¾N“Ù#´_¥éla¬ö­ÑÒß],/þá¸ðœ™ñª ÙF[?Š Mø-Û)ã+£&·ƒC+øQœ<ˇVÀ‡[LŸð±¾Nf*Œ}ÆîZ"3SÊO­^ËuÊkQ§ù„ãÐRd0û:S~`ÒTóä Mí×ÐÀËw{5»¬àD³þP:õC0 û±6îT*™0–ÏÛTÂ'©·ÌàŒ{¸…Fƒià ë#Œ•eÿïdªDQ@`;`ÚHƒP6XæõC^39!m·:Öi#Œ½'ž»ªæ‹0ñÖsÑÏÉyU }•aZ´ã£å rmD`\d;ži·(HÛurnPÎnÖ¤AÇIö€˜ÿÚé!o‰i=!'hY91‰#ŸâqrT(Z ckØ1Žäl¤Šsábë0D‘­‘¼=wÚJ¾8¸e5ê8ö¸WíÔZ42~Mýöõ;˜ú°äµ$sÕ1)Êœ§Êl/­j#msV'²ÉH;mF»ÞááLx,(ÛbÕíÑUɳ ëPyk†vFf¢Ô[e%^\%,×9{J½§3âP»EÍ`kƒœª=vH +R~  DNݳì/eJ¼.#+«î¾/¿¥±ÜýØȶh¬¶U±’6k(î'E°ðŽµÎó¬•Á}u¦y¢#¤å»G–E8fŽîX,†BZ¾ŠÚmþÄ.ŒŒK4º$A¥b•Š]‘“éÖÝ¡ZV²,qºe^4¶®öYA"K¡‹Œ‚Ä{W2 5½’Œù ¸¢ ìØ ÷g{¸ðó«jœ<°&8;µÛŒu¨µe¿€ÁɘuñiÈê%_+ÞE Qäbvob0´É`£|é¡C«êÀú«³¶@ïä\sŸ@ñØÝ68²`k§âï-íœóòû²ÂS=–ânqä«‘n²†Óï#F¢­ïïè–À†if/¡3÷O‹Ž0FÅÀ/}«?–ëŽCþ^¸$ýß'`ÔOMÙܪgÐÎ" }*—ÂÂ`"…_û ë+0JК÷ö×lØIŒbïMUþ;Pæî΂7V•I7 Ÿ9‰ý€'y¥'ùÔ”mâ]-ùû™ÂìºÂ»¾ÁoÌ7 ý¬äï«yh½cH-šG˜›f[µ£½Á˜ü ec¹Ùb.’½¶bæ<v †ò@ jGŸ¼é\MôílÁ¡ Í9¡õo˜ÅpSí8¦Â½OhȆ5ĉÖyuïºC$Œ¥TùiçÆÍþÖ_UåfBh“úÆv`ïv×E³¿0µº3DŸÀ7R|Îe­ÊËUýt?µ ôCÖ4U½n¸ûWþ|åLÅ*D/íÓˆ´q×sBÝq‘ W~7H`CsTÖ‚Ç‚ÀÙµùgÓ¾ÑѤ«ÉLo»S@ûÉB#:äù'n^mÎÄ_4áÿ`ëìtçÈ7`kþÆ—o¾›°ìE•ƒ‰ÙT•²Sç5…2ëeuÖ¬GÙLÀ& P›ðÀSÃ#ä´øý:'Ïo‹ "窸ȡ“Öµ0wFàò5¯fŽ}ºàˆ'#Ði²xŠvt²zÍkne…0¦߇¹¼lW¬1pëÈûPæ.ÛQ D‰!½â~!ëü°ÃTn)ª)ˆEõÞÅKMûÕ”- +uÖ<Çq×`”xa%¾Y-°ªeÅ­Ì÷wÈݹ‚Èšn[LÇ«Ñ â.v‚, S?/0Ì_Ž]UÑräÌ$‚æuM·ÍÕ(ûŸåÜ0ØZPF¦À#$p WãˆÃcP” +$‹ÎûÌÓÝê¶Ûj“­Únˆ€P@·Ã FºS˜ è]!“5U)l—Ù)°NÀîc¡~Çf†w®C§ê8²HÖCÌ&½áævu@®»cÃ|ÜeäuIXvP[°ù?¿–ìßÕ‡1ú–Ô†ƒµhI›“Ò£Îi›ª•~W*Й弛¬ØI¹ó\uþ «œü8è•©‘PâÌÊ£ºaÍÄ”ÁøÈä?¨OväÀ9$#`˜"û„‰l׊’Ú¢S/2šq|‚:~Ý—Hèm?ÐØœÓ h» 'äés©RTñ@8 1Qª½Ïƒ G $ÃTIÅ]´9÷$Ê §ñý‰!ÙN¼ïy¨:¶ÜÈ6-^5ùÃuQÝR=y†å=²‰Ky!L6ü…»EƒïâñG¦®Ü:S—ˆYÛ² ¡íîu… øÔŽc‰sÀæ¸kd¤ïÀNx`,8ªäØ6ã”*Α’Cl˜„qÂDÍ»L _@bQç_8^ç óÎxeÓ¢3)^~º~‡KÿŽŒø¬ª£˜­Á”ˆá Ûg ËÄ`<<àÆ<[qT¤'1æun…«.Z÷…7vÎ×׈ZjDÉ_4ÁîÓ˜57Dæ·®ªÅT]ÒËÖBQ¹}õúå›wßËë.£gÑyZJö€Åü r(D¥PÁ%ö¹ê,ñckGÕc´GÕ™‘²ìã\£ÿhðfì08€m›¯î%NUeq’>W•AÕ§úªì¤2â`)å}&œ ‰ïÑ€Nv…¨– fò&‰+(  °øÐâ; ÒMÇsa’ w"ª[$ã6ôªŠÝ®¢·‚Ý./ïò—5?b8q”ÝÖßêìbsΣУM )Û–Ç÷~†V vå§òÞ_aæSLÅÈD0÷þê!„EŠû”¶‘€ê¼2' ¸áÕ.ùò_[î6mÍÐ-Ó$γh®èkr˜šÖßâ6ë^LÎEËŽœnF€ m ß¡ºì¬é^aªãnÍCý‹ äŽePùóƒ L÷zǺ´^@¡õ–¨µ×Ü>ÔUËÕ5Ç‚Ý‹“ìjíô°‚³Ýî•«ÎǸЎ M´Ì;ôª»ÇÁÐË‹„Ç!ŒÞøEuï²Â¾3œ©„rütGŠhí SAn’ÇL¤¤rÖÈŽ·#}aƒ!ò^N 78x Åðã`5cPÏ›v*‡|¬#ùÌqyòLë+Ý×OÁ0£¡”:`ì6µ\prf·™`S‰ëyÉ]±L(ÖÖÝ|‡mUlj:Í/¨çg]À= ŒJ?zy–~ò rGÄtM¾´©È‡zlP±5H‘ŧ|­o¬T˧L­¼Ñünp~%]]‚à†…ÙºØ°åÉ©·'ʼÅj€'G„y÷uv•Z÷q +#¢±×h¨{@ëf¹òšx(£‡¼“OfÓØñ)G úÿê¸BTg8?HY0³ªúgC[‡Z€’P |N_dÚ¸’µBiCI3H¿eŸÁZb=*ÏaˆKE â!Bœm¬•á>ûX› Y1N;‹ŸîÖ 2” å,aWؾ‹-ë\P$d rбü¹ÅÆ÷ØUyן޿gxÛ¬†r8¯e3Ò’5"ß-P.’ ¥Â½ŽžVÅÑióhq[H,†îåÛå³Ö¦5@¸g ›Ä”?ö‹½ ýH[ ~×ÌŒ9{ácš‘åþÁoíCendstream endobj -4131 0 obj << +4246 0 obj << /Type /Page -/Contents 4132 0 R -/Resources 4130 0 R +/Contents 4247 0 R +/Resources 4245 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4139 0 R +/Parent 4243 0 R >> endobj -4133 0 obj << -/D [4131 0 R /XYZ 85.039 786.531 null] +4248 0 obj << +/D [4246 0 R /XYZ 85.039 786.531 null] >> endobj -158 0 obj << -/D [4131 0 R /XYZ 85.039 606.533 null] +162 0 obj << +/D [4246 0 R /XYZ 85.039 604.621 null] >> endobj -4137 0 obj << -/D [4131 0 R /XYZ 85.039 575.245 null] +4252 0 obj << +/D [4246 0 R /XYZ 85.039 573.333 null] >> endobj -162 0 obj << -/D [4131 0 R /XYZ 85.039 275.527 null] +166 0 obj << +/D [4246 0 R /XYZ 85.039 273.823 null] >> endobj -4138 0 obj << -/D [4131 0 R /XYZ 85.039 233.179 null] +4253 0 obj << +/D [4246 0 R /XYZ 85.039 231.476 null] >> endobj -4130 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F20 2961 0 R /F58 3360 0 R /F15 2972 0 R /F41 2994 0 R >> -/XObject << /Im1 4096 0 R >> +4245 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F65 4251 0 R /F20 3021 0 R /F59 3455 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F41 3054 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4142 0 obj << -/Length 3183 +4256 0 obj << +/Length 3205 /Filter /FlateDecode >> stream -xڥ˒ÛÆñ¾_Áò ¬a¼ rÐË‘\YÉñ®£¸lf ,‰hÔîþ}ú9 sH©´ôôôt÷ôô ü yêq±X癟Æáb³¿ [˜ùûM(+AY98oîo¾ÿ!ÍaàA±¸´tŠÀO‹lq_þæ½ýðú§û÷?/Wq{‰¿\­×¹w· =€…aèýë=Œi:ñîý ßîùõ§w<¸CàÛå*ô~ùùãý¯ ¼ýüŽqÿ¸ÿñæý½eÔ%ŒcdóÏ›ßþ%ˆôãMàÇE¾x‚qà‡E±Øß$iì§I,ïÍÍÝÍ?--žK¼jN+iœûi_ª%Lµ„aäÇa´X§©Ÿ%kÒË×e”{ÕËÀ’KU¡”-ȵÁAƒ—ÃÈS†ßíqÆlkEúŽá9zXF…÷2Vüöm™fžiŽ€K”AýIzÞÉ|¯ña\·[¦fü|@.œ°ùØኽð¼ãÕ8þ‡ioM‹ãÈÛ™açã±,VÑÚÖ 8ðƒœå¾ÅÓÍCï mWÂßn­½'Ü!¼"åéƒem5àߪÿf%®õïfƒ‹¿òšð<‹Ä»Â]jTfÙ¡ºÅ§{~~£è‰<ÒîZAˆýg^mh1›Ne¨»–‰\eåvQÁb¢5¤…2ž#ãQ¾öb~<)'MÀãPáö­Ç]Õ3pßáÓ++~íùy0Ãð„Êèú!pîG=!4)X2Z–ÌÈ£=€½¼Ö U%( o®;àÉ!Ýs"ídF~yDÚMÃ3ŸØ¬Zåò¾À¨²€ó-™ ‚o™Œt8¢)`s”^®Ë¡1µäHÈÏ:œÒª/”fp¯Kåå1ÇþŽ¾Š–…µè$‰/ô’$©·iêŠu/ÒTd¾–4÷Pü†jG²eß‘xD}Ësm5²r•ÿ¯ gßà Ë®öxh›³ýQj´¨J,…v­Ë†ÅÇåt =ã†Á̉îký +Õ™´(Nò³Cc?TÞ—]Õ2ÂH Võü+YjƱ"±PªQè’»œ` Þ•ÒÞØ$h×’©á™öµÊŽh›®mõ 7#ßìÄ1hÄÙ‰Éàxª«KU”(_7Ý:ô^±íêxOvÁ}µb½æ¡©UªÓ=«â!…¾Õˆš âJèØ°·ÜU¥¼ƒa¡{ç7´7‡Ç˜< -RzB$ð*s¶ÿÅñ0à{#ï¶vƒWG:´´€=‘Øδ[bØ(“eõhP€F§W5g׆‹¬½&Áš%Æ•× "Ý::$‡ß©¯€Cjd¦0PÙH0R ñ9ëÇñ–°£A£©žÅb.8W”húy!¸ƒÚW¦U³vîi¢Z5I±Ú¾ÚÖDM¢a„ƒé;­ko’{,—9ÝB¹|‘rk-¹ æâ2ΈNþ) -à« ‰¢¹Ãx¦fsÀ¡qNÃô2L!-Yöõ»¤‡ãiÝD9ˆkø1wûhb°¾ç[½©˜™)y¦¶¢±DE^qáKgtpᜢ"$ö#ðn}%éW]Ò±V<þ§ŸjŠº0¢øRËKýÈO=m\ÒWûN—CT'/ÀÞ£Þ¾û¸Ä‘щ§4ÅyÖJ¡CÛNxê\„Tí¦9X^Îæ0NÆ!†Öå±XwÆ`ݤF‰åI˜8±¦k} -zYý„I[ÛѸ^xŽ¸ÅáÇ–êˆñRèØ -HdKaÁÄ=Cl¿TêÆLãÖ:p“ö$øÀ“y³âJBÇs­¹n©xáØ«9Â%¯Gºôäí3ôÀxŸ «³`Ízû†ÇWnâ?qN£ãàʲiÀÁÍ%Õ&¦—ùº¥§| ¤~±ÎÁt úˆ/o"¥¼ Qaæ&ÿ7k©HºÒdì’#°˜¾5{É3šÊ¡’¸T -¹¢[9Εò•wÎÅÿ¼ºqv‘Jã5‹SïNh?~Ô?ЂM†(•T<¢ƒÁk%Ä6N€³W“Ç>ŒöV!¡ÎîFþäë‘cÂæ6á -x‚1“š‘Ñì4’T]¸l´1 à çE7 ˆ‚`CG¿éŽ¶xS›Ä÷†³u¸i0®üåÓÇóHÏ’>f|­›û«K‚bÐã4/Âhë¼Èš‘B¼°:••+|ê^dÍS9áëÍf¬úWg)¦8'¹ÝgÇÎSRщ㓺¯–´¸7¶ún$™µ©qUVg‰kNL~p„˜VŸ’mœg¿âg£È&¬eJ..P°1ù+Í(ÌW-º¢ˆe'z”HœpÔÏÊ9î¸" °úD"’ÉõÜü íúÛjA®aW“J,¯”ß”e‚“¢À•©„'G–KV #îlR™ k'ós c<@,Ž…õYC‚¦ÔÕNKq¿2gÕñ½ê‡s×û"iÄœùÞ™¬n.Å¢JC¼Ög>ïÅ™ÝbBUñ ňõIXŒ0ë23JCê Y‹œ>×ÔpƒuGé¼±g‹mšxИ:©WÜp«j)4œ „ÕȈVty•Ÿvµä30õýiî45ãÐCl„Ò_¦ õHJÆ4@áây!¸¶.§cH"¶Axâ¡&³Uú¼uè}¢,qœJ)¢”ŸÒDˆ<Û‚£nÃ>ßñS\Î0YéB•µZtÍ8ÿNûÑIt­IÅ¡¯ðã‹ê(Æx%YôïAÀjQÆk®È³K'CÐ ˜Yr9?¸vÀQ_ÙÚ—ªfq.š¹G ;Ö6ç©ÚÄ´=6SÝKum»C8óH•ôž§'?ç(>\É+NEBæÝk‹ƒ“ÿ¥Z’ÄX&˜†{übrÖãZÒõ¦k·Cì -n<Ö{=a$j¤ìps›`ZŽÈ\ îÚõšáxr•ôJRGï0\)ã<;ÕíØ¥½–«Þ0öÖeaû¶8™æ‹Ò¢üF]+$mËò„tå”@6BŽìUF[¥ˆÂ(ÒpÔ¯\šöiÒ¶Pˆ£S²K½Ë¶Z‚¶ê°éu`…î¸ ÍÍýu*ŸöyuÙZU)ýÈ/¨vЕöãu=iï[+ÿ«3~Êk²ÌuAí4c³Ãs\ìh0`j¯#F-ä-¶˜KœNºœý¾ðXaù™ÉqïòÓÑP&ËŸt9°Â{ßnÉYC®‹fü}œú ÿøäÜÝÃVÒÿõÃ4’ -«h>f¤p;³u¢ÌPKÎÖ°\rü_©‹ó²endstream +xÚ¥ÙrÛÈñ]_ÁÊXebgp@ªòà+±·"ïf¥³µÞ‡‘ˆp0hIŸ¾f]©”ËÂ`¦§§»§oP¯üÓ«4öU˜­’tëÇ¡^íê+µÚÃÊß®´@¨Uä«mŒKon¯~øk¼]iåg*[ÝÞÈmþ»÷öÃëŸoßÿ²Þ„aèEþz“$©w³ÖÌi­½¾‡1-GÞío?ãÛ ¿þôŽ78ùv½ÑÞ¯¿|¼ý'¯zÇ°ÜþxõþvBÔ&ò£mˆTýçê÷?Ô*¼R~˜¥«G+_gÙª¾ŠâУPÞ««›«8,¼­x×ï›(ØúAƒPùi9!èxAë õŠçžÙZf¡@–`b‡ƒÏÇ— ?¾è0ªqÑìK ÷'^J7ør·2ïy(ñ×u¼õLuP Ҏ"ëAÖ;»ÐŸªÆe³gdzËÏ;¤Ð ¡÷-êïÆñßMsmÞÁôoaµ IH"QiBœ_ãe¦ÚûLÇåð·]‰÷ˆ'¤—ż|t¤mzü[t_ÃáÝìpóïѯà™EÞµ¨ žR¢8óÙ°G|ºåçWºƒŽÐ#Ðâ݆6ó˜¡é^ú²mxÔýEr‘?!ej¨Q…2’ O‘ð M¼–’ªâ‰S_àÎ-‡CÑñdÝâÓË ~mïùy4}ÿˆÂh»gàÞOö†P©`ËàH23ŒúúòÚhE‚ ‚Rðáö¼9Ä{.S„¡“ÌÀ/÷ˆ»ª`ù‘¬Þé©.Ÿ „Zp½!5¡aEó{&%íO¨ +G8¹ƒ9V¦…øÉ. ¥t„•r#±ùð8·T"?æTÁßÁ·ì€f«,sEá…\¢(övUY°ìe‚ä„–eœ4l–´vWü†bG´y×{„}ÏkM1°p-ý<Ï®a.§ºë¡cÎÎG®Q£ +Ñ:µÌ+f·Ó…v «ÕÂÖ%1‰~†…âŒ2ÚFéÙ¥±Ê”÷ùP4 0G‚'{ÿ…l5ÃP[ÈÕ xÉaΠeÞ-¦ÚY%èÔœ±áv¥åÁvmÓØ‹Þ lÙÑD¡æ *ƒã¹¬.E‘#íühí½bݬãõ‚ºbÃrÌ]UZ®F;kÙC t"'«.+ÁcÇÞòPäòŠ…îßPß&4†äQÓ#WYÒýϾ7ð®Ëiøj A‹úƒŒfp&";˜fODÀE`1/î 2P ðÜTSvm¸Éù@k¤æw§^ÉBèê=^~k}\¢`»'5…‹„0Gb!:ý8Z 8šÍP‰ÕѤî„ݲg˜º0 GEƒ—Ç™8Q¡­t`±+ö%áE5èžàh:Sƒs‡0UŠ¦2/f´¼|nnž†R "ºrgÎxÿŒX tN'UcìgI +ZåF(å$û¤•q{Uñµ¨xø~”ÍPìÁÜî£/º†düÝg¥ëÆR±õuº%doÐD¡d§¸]‰ý耪yPY¸;¶4bw‡PO·j›1%›Òr7ð´^l'{ŒK÷à—Áx’86£Åð.1Q­Ï|8ÇúùÁä_`˜×¬¢àYý¢lËÆi+;sgz™ dB±{ã3ØeW¼‘趌 VW íÐnÑÍ÷¶’-zC\î̉O¼_?}ü×÷Œj׺˜1*÷X!¶©¬ÿUtC@ð³ÝÊpfÉï¹ûJÏlݦ¬œûuf‡ŽìÕ,§½TzÄ~¸¤a²¤·—:šÆ~¢µl9wlw¥äÒqñ¡’ ØeE^䶃¡µ¯’xæ²?Lôr^¹¾ââé|Q£ÃXvŽÌÍüÎÆÖ1jÉÊRˆ«ÍSYS©.¾…¼À‰¦ÄKJ”cW¥.8OO,ÞªÂÖ%ä‹C¤“ÔÏ¢pê'¬±€² ·AèGQ*ìîÖŠµWòÉ€A&Ê +ÓU†ë&> ?–sr¢©÷‰rêP'“b QÜósŒ2gŠcÅ¡cï§^£P?Áh±“áå¥ó²¼çmqÃxÚ€£ ¸c¬}ëÅ´û‹Šü§î'\¦YP¼(óà ú_o[Í#eÊR~<–X²àhÞ@¦)2rp£Ð„•NÓ—Ôt˜ {ÁiGòì]‡ +‘ßS5_óËg×J– +Ñj_AÖ’]¤@6†nÁÆomEÉ…YŒìq–BeVÅ= ©Ã +fÇ¥”XUÛìmiUµ{;=”õX^ÅÄBÜ66ïsVArVTm/ ÷º$Æ3SÔâRÛ²]ôÙtyé˜ê‡Ø-^´†ë‡ÎåÌèG™'õ}¶¸(9QÛJ×:'ÁÄ9JÖÇn\iœðEfxJöþÔ”àÖQË©Oƒ8*A¶kg'’_””ÖHšÉR‹?ˆ¨xô¦ØŠã©–sD2H%ßj`Ú¾Ñç˜%ÚUìV±âÄíYݨ"é9),©/Êg˜ýF­cÒgeÉL±Hšˆ8te!ªü¥l®Ûž4:[hmJ3#˹¾9• ¤15t²âZhØä`AÑ帷Ûf’ôÐð¥J‰ëA˜b–»Â!'›¶^²Q\zžöSÛ˜˜p'Ô±Mm-I…%Ud æjC¬‘,ʦà+òÏ¿9º_qUSš,,Ýà–·Ú}) `:òÃh;ýRù1ø)`Ä{ÛÖ5}µb¶‰÷¾ëÚuÒïíé '„ øsýío‘Ÿ×idC[Ä1ßÄéÚæEœyÈÚXˆ¤ÜÑÑbÄ°j'l€Ùþ2F?ù†ƒèæÈÇ®¦›‡“(œ)vþE%j[79vÀže¡“@Íþ%ƒ¯M¦¹C–öÛ‡Ç<¡2»bŒg éA’q†ÚB/eO\Žˆp ¼?Þx®×<³,C‹È¢”RŽuÞ«Ö%{)›J'½o¬MwCùµ¬ÀZ}jsÁŠÜTÍSC[YyuÔ&œ}ŸÈïpVÁ¹q›Å?³»ãD,e.þƒåä;v.Ö[µÇzb”¡•ŽÞ*p³Ú­xšDA(&?M|(HâÀñƒ­½±´§W#¿ÚÖFŒ+V/+<âsM)Ø`gÀ¾mÒ‘Tüe9Ööžc}ùO¢µ˜âIÛ–ûı÷ï±sÍ@ác¾É²ßÙ!tþRö/…¢@Ö¢Ê01 #ðZJ†¸Eï•äIšÚ™›’ÿkòõV ãÀ‘sö%gÓ÷ÈGçå”OÚ´á˜P i±#â™v ‹ODÉaïØíœH”:?ßk廤G§\6¤3a £ï“Úoú9=̼›¶.M'¯¾L˜5ÁwgZ_Ûs“2ÕÁPj+Mª|td©÷¾ÙsXøŒV[?ã_æ\F ‘Èÿ÷û˜(ð·P©nFd/Gœ(>'Q`Ô”Àÿª. zendstream endobj -4141 0 obj << +4255 0 obj << /Type /Page -/Contents 4142 0 R -/Resources 4140 0 R +/Contents 4256 0 R +/Resources 4254 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4139 0 R +/Parent 4243 0 R >> endobj -4143 0 obj << -/D [4141 0 R /XYZ 85.039 786.531 null] +4257 0 obj << +/D [4255 0 R /XYZ 85.039 786.531 null] >> endobj -166 0 obj << -/D [4141 0 R /XYZ 85.039 209.66 null] +170 0 obj << +/D [4255 0 R /XYZ 85.039 209.66 null] >> endobj -4144 0 obj << -/D [4141 0 R /XYZ 85.039 169.496 null] +4258 0 obj << +/D [4255 0 R /XYZ 85.039 169.496 null] >> endobj -4140 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R >> +4254 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F59 3455 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4147 0 obj << -/Length 2267 +4261 0 obj << +/Length 2185 /Filter /FlateDecode >> stream -xÚ­YYã6~ï_áÌáÉŸß3íïóonç U´µ(æ7¿þN– Ò7¡²Y:9Â8T:Ë&Û›ÈYå"+ß››û›t¼x-šð®KVq6U.µçfÑî‚YœSq”Y6ù¤_òU6qaÌ×0Q€rη´¸)›5~GH½:ÀP3Òæ ·h`g²à™ÉÛC d½zäÙ=L­ë¼-ñhù#¯ûÃ÷Ó™I‚ª-/±mË|³Þ_§.9æ»%¶ùÔ¤ ¸L3Óh¹ŒT} ~»x]¢fkâ^\T»Ç‹ª\Ú­x¡­äw]5²õ±ªyW¸cË#sÁwÙðœ®Z·¨}Q -‹]Þâi_QfaßVlcR[] +©D›—3¤§¡P0°ªUæÜ â,SÖr†DÊ)8Wc¸0øךœ' 8èijA¦†gîóíCŽCpÌÜÞý|{÷Ýqý1/‰; ¹¹qì = ‰;Ÿ¦­EYÐT|µk€uÑ’5~‚F€Q”öë T±BÒÁ‰:1ÊÄstøÞé`AÜÊö™éGFZ9— ùäÆK9ã`7×Ï<[=`L-«.ðþ €Jð}h™¨Øា¬}DlžY‰#~àl…¡Š¤^"Æ ˜H€ÔØQ"49[Káqqð?ÐÕ‘DlyØ4‡-·ä…–£!ŠÐ34ž]¶œl´ðf¸^¢¿ˆ ›ï¦ô<-;"!Ås^;–¨ Žò…œË6¡ ‹µØTtùTµƒÕêž½÷Æ+.ÀBθP¡]‚güCÆd³¤¢[Ûvs[¯PÚ)” "‹>V@©óP3a¦bm%vÚúRxéDYí£‘@ ÎëGDÎhÖE-R||ëå®Oœ‘ˆ9Sð¡W®"Ÿ. ²öàÊ1eb•™dlÅ›„ëp­Ú1Æå›j÷žÅ`“¾ŒÉU4s©V TÁš™ÿ ÍÞSôe¹ã©w”jäþº7bì]ƒ;/ÇKê h®Â‹[6ðAËš8hºTQXµpj%NÉë–ü³äPA.Ÿ®°ø†–Õ–uÄ1×3( Ï~ú<ç“ëBÊ/LnÁ„’+†LR8çõ®ØjîFÙeGŸaƒÃÏû)Ù{Æ?OÒw˜³¨ƒLp€«y—¤6:OR;F¬ÜÓ¾8"ãœÙKŸ7HÞA ðà-CAÍ›—¹ñ¸áiâ§Î,ѱJÂW"¦§¹šQ¦•…,d€ýeÀGŸÄ8 zÙ—RÀ ò’Bš«)¹Dé4"…~èÚ¢†"œë(¸Gÿd!„ä·7|URÅð¨h¦Ù_ -÷¹à-ÖX›fŒÎÜ…½”æóŒP¢‰rYa‰Áïræ§Ï°mμ K„º'^”r£Ë5ÞðOäµ×åiÚ§áy>ŒêKW#ݸFJBK~ÃìV܇;9˜¹n&Á]‘/}Q.„¸oçp€ï¤z{FÎÛüK±–p‡¹±s’f5Á”$[ß:ÛÿÀÒ¾otšo†z;V»(NãM‡‘Šà‚ÙP…©Ã`â¥z5áÁÝ ô<õl@~{§<©æúkdý3›fÏX‹€À¥f®‚[QáÜúͺܟ*dàÒ‚ Ï2ÈÓ¼¬†É,Üóâ‘ÝåeË.Â[ -´Þr;^¤#mté/çtOs¤l -ÍŒ•éH@ -p¾ab˜´öÏŒ>?U¸P Êñ®XÔÓEŒPŒ0Ⱦ ÊA3 ëÇ©TÀꥠtEE}EY›F*{EÙÍU³pw× Èÿ†\3€X"?2†€CoæZó|òI¤ ýί¾,X ¾ü®0N³žÕ…dH€3T„ïÞ›rÙcæo¡ á¯f›r»§‹ -ŒWà .ꈲçµ:¢4MŠBðº_œ1$´ùÃF*=#6ÁíŠùâ9­Ø:£®ç\p+JÌ+ùÜ2£\h‡(³‡€¡¡ÂH1p?ß5¾&›Žê°Z3ÁüqÔ€À³^Cpð[¨]Wµø ƒ)¥[0"q@í:öt¯k94¨}£¶j‰ ½‹  @ óóvÄñbsh—ÌÙ5É󯧹Õo®´C׆šyL¿0äü -µ\B¹5oFªâ’˜ë"8PîȃJCè+‹Ñ­öõï™'JaW š.Y%9ÿ±Æ6 GP‡†žšrfLõ‡JGŽ/Dd[&}+P -ÆŸ[…a<—‡-“Æâ@Œ¥1„R1ݬ ÙÐøŽüa[¶m! 8îX.6eá{S\`¾¸w#Û8Öº¥šûÜ‹¦Ä…œúSÙ«à3Ày|!kÐ0ç&8öaâ;~7ó7>öÝó ×î$öt×~#†”&–ãTäÁ¶$’Öv,ú >ÁC `C¹6Yª²Ôþ)Dô¼ffç˜hÁYw'¾ -Š|+ÀN©‘æ`uúîwÀèQßú+vªÒÙ$*ÌØêvËîcI=l”·ßúöÖøð•X˜èOÇ®ñ4Üxê3tÀ¥Òó³ü,›éá-†äªœv]È÷ÜÀøõ$R~Ùy÷N›FïC)Çíq'¥ÜQ¥39 ÆS“@ïÍ(vÎÞ£¨âgº¾³ówÈ|ÓHè=í*ÜvôB0Hõi QS˜¯äõ7?ôÅMž¯ %ùÉ·Ú]k³¬£æóBãYï?õ¿ }¯†Ák.G¸ƒÀ‹“È C­š;Øÿ¯Ã¹ÄÿÏQMendstream +xÚÅXëã¶ÿî¿ÂÍ—È@ÌŠ"©Š È=z½ —\oÝA.d[k «‡#É»Ýÿ¾ó’,ÙÞÍ"W 8Üšâ Éá<~3C=÷៞ÇNù&™Gq¨œÑóM9óç; ¼›iáðçVù¡CÒ«ÕìÏsá\û*ñ“ùê–XVÛ_¼×ÿîãêí§ÅÒãYµXFQìÝ,´sZkïßoaLdë­~þˆ_7ÌüÝoxpƒ“¯KíýëÓûÕÏ<ùáÇ7ÌûëêûÙÛÕH¨¥U64(Õo³_~õç[üû™¯LÏ`ì+$órfQÎù.f7³»0ÍÎyÕ•»/{Ž¥ñUÛA Ú]QB‘V ëî˜î2ЀsÎ[í3¸Gä{o‰Räíž¿G¬ßÀLì{{˜È7‹ ò'L¼}Ú"³öJ`bï‘—€oßÀ$k/¦קó¤MƳ‡Å6¬»Œvèò´(€Mvº_¸ÐKwGá%‘¶L*S>ÔŽºÖ¨…„.¹¦36å>Ç[ì‹G¶Ö¦®n0C‚!©Ú1¡«åw_·²ô¶nxŽ.^㊒'&º‚ï¼å8]w<îP Y.[Ti‡§Ý£Ì²}WW;%ÃÕ÷ƒ&Æ]wøeà”‰ÂÁÚLk•87¶¶UNÁšLí{?íIùaä}@CÜ-ŒŽÒ‡¡w“–ë”R™É¤ßgÍ_{ù®ˆb¬Òöwoµˆ ªÐjãµuInÁ_Ý^ "TG#ŸõmO_¯¥pMKtÀ5ŽP&ˆödtžå`ȧ‚%ö6´mÞ=2ÿD>«•Ca/A@°ÏV$@«’$k´Ú}^ŽaMà­sô¾+âkO\iM>†Ã§‹³kÓ†i™‘€]A¶0r‡~ßMJ[Z„â°&·8Àž``ÖI<ºcbThãA%›ãºp +´¾oEº¬é}îÆÇ”ôA±Ø²]È×S‘òÜH¬…¼(xuºÁÕ]ù½z†Å2Çù¡îx1Ý»þÎàSðA˜Ô²î´u*ƒ‰îZÚ«ëúXÀ!Ê,ÅI¹Îæ`äc H¹ÉfW<ͼ‹²ºæš>u¨Ha©yÃÁ‡2þN3öitþ‡WL8×<S7ïdÐÖÇf#;\!×éˆFÎÀ8B¼tXTW¢²ÜÍMÝ--êê9\rN%Ú<…K‘²ÉËp)øøô†Ü Dî¼bÊëºêššrƒÖ#(ÙÔŒ©\&0},•k… å®Äpéžï6h“Ä»ŒQ§UëÄ($yb4ˆ#o[—¤s¦êý¦åÙ +ãMéõ‘Ç%hšù‚8žø}QÚž’ìýˆ\™ï ŸÍ¾e};ñ%0 9˜ãhØÖbõÁáK ñ—‘Ý‹<ßü/=ÿC†Ÿ 6.þâDýn(I8ÉÖº8!PGuìŽj½X «eʶVÌý +#Rà‚ÙÆpö' ›ÒǶÆò210à rVtûqèŽ7ï«ÇËØ1€6^Úªq­íXYv&:VÅR"ð¡gcJ³›óàÓ»gÜïõ>Åî¡Œñ}s%ý:¥¨/Ü%»˜£¹\cáŽIåÿáBFè™ü=áJ(CµdB&=-çД¬\l*ÖuIéõ>Cå;„ÇH™8üòºÞ +ŠÆ¶ ò?t„®oŸþQ#!'0ʼnòUTúd‚Yjj*AÂK`ûˆ0„5&:‰ñ þ4[&BKpÏì eûÄ¥ žNž×ègmìOûÞ­OxÀqŸ×3Æ“39b§*u·é6*ˆ®·ÜBy^ZnL‹|K DÂ|öÿ5Š Ñ’—‡Bn²Ë‡¾.r$$¦&í#’Ýb𧸓XfÃ]ŠÅ´tœV*@ôP½6ej]1•LjGç†Æ¼]2Ĺ@ãšrkÝÛ\TÏ—€ ³t60€ÂlÀ%5P{HY¬5’x°©»úÀqåõbäR!%»«õŠÜýËîmuäI‘ÏF /â–y&êàÐ÷žendstream endobj -4146 0 obj << +4260 0 obj << /Type /Page -/Contents 4147 0 R -/Resources 4145 0 R +/Contents 4261 0 R +/Resources 4259 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4139 0 R -/Annots [ 4152 0 R ] +/Parent 4243 0 R +/Annots [ 4266 0 R ] >> endobj -4152 0 obj << +4266 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [103.437 426.968 291.006 438.657] +/Rect [103.437 426.968 258.453 438.657] /Subtype /Link /A << /S /GoTo /D (domain-member) >> >> endobj -4148 0 obj << -/D [4146 0 R /XYZ 85.039 786.531 null] ->> endobj -170 0 obj << -/D [4146 0 R /XYZ 85.039 724.712 null] ->> endobj -4149 0 obj << -/D [4146 0 R /XYZ 85.039 692.291 null] +4262 0 obj << +/D [4260 0 R /XYZ 85.039 786.531 null] >> endobj 174 0 obj << -/D [4146 0 R /XYZ 85.039 609.28 null] +/D [4260 0 R /XYZ 85.039 724.712 null] >> endobj -4150 0 obj << -/D [4146 0 R /XYZ 85.039 574.737 null] +4263 0 obj << +/D [4260 0 R /XYZ 85.039 692.291 null] >> endobj 178 0 obj << -/D [4146 0 R /XYZ 85.039 516.703 null] +/D [4260 0 R /XYZ 85.039 609.28 null] >> endobj -4151 0 obj << -/D [4146 0 R /XYZ 85.039 484.282 null] +4264 0 obj << +/D [4260 0 R /XYZ 85.039 574.737 null] >> endobj 182 0 obj << -/D [4146 0 R /XYZ 85.039 412.699 null] +/D [4260 0 R /XYZ 85.039 516.703 null] >> endobj -4153 0 obj << -/D [4146 0 R /XYZ 85.039 377.953 null] +4265 0 obj << +/D [4260 0 R /XYZ 85.039 484.282 null] >> endobj -4145 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +186 0 obj << +/D [4260 0 R /XYZ 85.039 412.699 null] +>> endobj +4267 0 obj << +/D [4260 0 R /XYZ 85.039 377.953 null] +>> endobj +4259 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F59 3455 0 R /F58 3380 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4157 0 obj << -/Length 2546 +4271 0 obj << +/Length 1438 /Filter /FlateDecode >> stream -xÚ…Y[sÛ¶~ϯPŸJÍÄ I$Õ>œ9IšÖ§mœ™(ã3Óö¦(‰5Iè”]ÿû³7ÔÕã—ÅîâÃîb± -gü…³LûZÌÒ,ñµ -gyý&˜m`æç7¡PÄZù:Ž¡}fòÆÍÞ$‘ÄéY‘q“F±g1Ò¼_¾y÷) -fQà'‰š-×N‘ ¢l¶\ýái~£uà}´µ)ç¡×ÌoT’zlÓ·¶šÿµüÏ›Ÿ–ƒ˜#×™Ð"I4 ,¦Š(ík’"Ëm¢3åýÔu GÑäÔ=»æñß -Ó6e³ù•z÷)Ô~Áì&Jý`‘9V-,Ž©g\£6Í<ʼî=oA„’Ý:­5ù¡¾¤CÇCýVhÚ‚V%A _á¤âÔÛ‰¾hÑAÞË”Z{¼!,z\Ø”½ M’ì¦ÌÔÉ1]W²|ƒ03 -¸y8îåÖvBþ¼&í<äm˜ª‚æËhžQ6Ÿu"o[T¨_²C« V„ >(wš6«§ruÅT¸¡ÉRÒÙÖÂbmê²Â%¦ž%YЗÍm®­MGÌc=°ÌvLoª¶0«é BOs @••aËñÝžÉÞ× µ‡k‹–ÛÈ¿¸‡NìbïóÝ’gèhðË–ÿX1º*Dû@Kì¸Óñ&Ym䀛"{f°eEÉU6<ôgÆ­ƒNÈÈ8VîÛŽÌ<þ/Ê™Fä¦ë ç;§GÝÙÚY{šz¦+s‡-ÕÞï é+ÏÝ“®ÈçÉsÅÒcgŠÇa0[:*ÛscGgÛ—ù¾¢V…fž&ÞÚ¶<÷' -8B6+jpp²d‹°l‡–­`PöÛX{ÎÛ‰SSLÂï}逴¨5†%h¯qȺ e†Ý…ÿÁvU>’¹Ó€)Œç *¹½)žt윇Þp¸%œ‘s7§F¹ÙT…¨Å6Ž«kã‚tÆx€Bâ×ÊÑH¶9Ì*a·E¯‚ ã<<÷ÊQÄ@»œCô±Ln𣽠8VÏ#l— _xR@±; -ë0°í 'Æà‹ê¾ÅÐÏg‰ìNîXÙ$q¶ëÁþÌDsà£H£”B¥ñ³Â½á6\1tDx¥»xÞòÞ9|DÐqô×Rxp›27O‘ZÆ ®é˜ªøgbyO‡ˆü-Ow¶rH`×"¡ªºÃ¸Æ÷ø§9 Ô¢*˜’PL*¸ýÕÔÈëÁp6Z¹kX% w×óŒmÆE¹‘ŒW ]Ëä0\ñ‰CW[ËÜáÑG[×bPDñŠ &œwûbV±òn±½f./´nÆà)›ÁœˆãÚ3Ÿ%^7˜#‘"0Ì÷;4Ö–nJƒ"0AÂÑü0ÿóþ–ßab±Áæ„èK ÷Ð’¼&q`eùKg²wiê³9ñ™D<ØÉ ðZ"é­îŽÕ0è2Á~[ž‹“¿Ü¡üûåøq¸à- aÇQà­ÆÌgÙ]â0ƒ4 Î 0Ý*\ú„K\´Ä¶ƒÛµu—ò‘û¿Fä©oö̤cjÔÇå6¦ÄïÁç‘ìªåœøúŽßCUÔ$ë‡ izD~¤¢«iú„†Òô8œ¤Õaúq F(âfz,/ ?ÓÙUŽæDâA"†‘¯Âè@â{ÃMÎÑb‰_wä5_p8:‰ì->ÚÏypTªýPÅWÁ™Ð\ǽÎ58ÇÏ‚3•ø¹èßãÎoï¾2©%ÄJno+JÕ® gðM®#1Ò\ABˆ^EâŠÀ‰#‰ç‘˜Hü÷žˆî\òl¹þ®û9YÊ4๼P×Ùš+hÑ«h\8¢q$ñ<‰ßºé%OÏ+¹n)wß 4¢óðD ågð½Ï„æ2<Žè5x® à9–xž©Ä£˜ò©¬Š!y -½ ZËážÊ{ÛJÎó…2™r{fÆyMJ‡±¨PæUß>ßþ÷Ýo% Ôÿ\B9IüôzlI®`Ì4¯B|YÚˆð¡¸óâ¾MzÃ3­pÈBºÑá»uï2Œ[îáãÇé1N“ÅRº7)KÈ# F+¹(Ør1LÑî^z$ Ô‘ïSÙ’op6,çŠ×1¦©QªÀ1?ÈØå>Rš#ElŒÕèìö2já(Ôøªá| Ç\~ed†-V -L.¹Ž!NH'Y J8zúˆÈÎ>"6LΑ¡¨åL2Eu¶æzWêH&] ¡jF—VŸ&d”BÂCV¬ÞmÃk“÷˜hF©B.€(I„(¹Å Œ§N’H$Ç †éz‘ÓCµaáíwü5"ÓY%`GV…rOðâqyVažØ˜Á¦ÿ·§ì¢ù”k”ÍiºæòvªjÄ1'n…{`›ƒ§gxï]Q%ÖòHë¿ŸE»M!Svß2;ª²t2Ê›*ª¡Äˆk¨´YÅ5„mÇsÈÆñ[3;© -êéOª­FWüÕbP*ŒÄÀP8û/GzXl¨)N¨YázÛøPZ´û•ŠÓ°÷±õåضÎÞ‡qE„û¶9æÉPJp€ûýlMÓ3Ñ[pôu-¨¹ž!E¾æ¼MUµ¥3‹ŽÒAsÝ÷.-?zÕÊöžÇµØ›…ÀÜ¡öp®],­Ô¥TŸ#€—9øÕ;DV(FñǶ#Šp‹ÍÕ2Ÿá¥‚zšx;)pš…À]“Ø™%à·¾ ™.í¿èxh䀢g˜ä,âõKSHãÈ[ˆë4EFÖÃÄ¡qÛóÌZÊÎ[oîÀ$*urG˜ã¿TÏÓªÙ™ÖSj°.‰ÈÛ¸QYþ˜…e7¹‚åoX§–"ÖúÐD¦^ ´_k¬Óz.Ó.xßÐ@p•?ïÅ¥CÊ<ç¹lªÁt|‡Ýûÿ;t xblDRÀ»‡^Lª€7ÿ|úÍ{äcÃ¥í¾—Fâú‰Žò,]~u©H¨œI/b¬/O”œÁšûQ}lü8¥|åš¡«kÏDÏú wx2¾ñó ‹‰a.ødžê¯ï\ñÁÓdâ l$@ù,O·ë> endobj -4158 0 obj << -/D [4156 0 R /XYZ 85.039 786.531 null] ->> endobj -186 0 obj << -/D [4156 0 R /XYZ 85.039 766.606 null] ->> endobj -3021 0 obj << -/D [4156 0 R /XYZ 85.039 662.656 null] ->> endobj -4155 0 obj << -/Font << /F20 2961 0 R /F62 4047 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R >> -/ProcSet [ /PDF /Text ] +/Parent 4243 0 R +/Annots [ 4273 0 R ] >> endobj -4161 0 obj << -/Length 3254 -/Filter /FlateDecode ->> -stream -xÚ­ksÛ6ò»…¾51|€¯~¹q­¦çNœäber3m?Ð%ñB‘ -IÙuýí $QöÍõ¦Ó\,€Å¾waâÁþ$\/Ì&I»QèO–»+o²™Ÿ¯|Á˜ ÊÌÂùqqõö]O|Ïͼl²X›}2ϲx²XýêÜüãúÓâ§ÏÓY†NäNgI’:óSß¹»¾ýÀà›éÌwôa£ÏÓ u>¾Ÿþ¾øå꧅!Á"ÒC$àûÕ¯¿{“ûË•ç†Y:y‚±çúY6Ù]©(t#ÊwuuõO³Ï© ¯»¯Æ˜ù™›ÑË<‰c7öbÓf•ªØæI¹±Jˆ'‘ë#"•9說çyh ¼yüˆc'¯W8Hœ‹ºøÍóÎõÝ%†ÈÎ/R8à°ÔÒ©ù‰›(–Ú×mÞ Qê”HS”8=Ò°-ø­xfèÃ4ò!R4kþ½y–Ëš€¾#ó·Ú /ku¢--®éŸÿŽ7}ûÎ,"½É,H\$‰ôÝâÂ4qrþyš‰ÓàêÕ^{tÁH¹qœÂ¸ô¾¬7ÜCy Œ75>Ö#g&«"_Ö½ADO¡#ï裡³4^k`·mÚà ]Ðg1MC§á©^:¯QµŸ§©ÒÛõ[b0 ðo -Ø à1›ê™6m^V<$Ã/òøž‡_K׫x"UÕŽù>ˆßG]fΡ‰©4BR€[<~˜o)¬mj*§.zÚË°ö[‰K6p·4˼þýGFÍ«JŸKû:Òf\$4aòçbNUñĪèð/±© ¡«fN æ0%@^ûô ãT͆ ñVƒ‘Ópùà1@oÓõy_6¤€(Öw¦€T> åÈ®`}…eÂ(¾-dm÷©ÁºJåMB±0ô)ý¶(eÃ,šÈ—ËæÀ79£§bó"¯‘Õ¥ì.´¾|ô93¶¹q9ø |Ûê%×ìÛ2ïåV€Ñ·‡®g$vVm -,ì¶xÖžçž´áPô[ÙÀ¦­ÖsZÂÏr|+Èè ŒJô`³pk_Ø=Ž,*QŸpd$E—{ƒ?¿<êJè‹ -á !¥Ñ`&ç–ÀpmB4^.‘ÖâŽa-5@k—…5ƒ¤9Œà½Á¹ÔAWZé{uÌŽŽB µ%“jÛ™ï‹9¨DõôÞåYfZ¹UWö=[´LéGÄ2 &m…P½5B,€WÑ£=·]Sç•S§–F~Q©ÈYlEºa¨ä7$ †Ïµ>‚"^´`0Ù`¡Bn6ov¬Ig#Ò„½,MìÛ×4D"ɨ©4¿\}cŠ,)]y»ÊغĶŽHF s4ŽGÆ b5®Êø8@Ë*¼JfP×µß6€@.ZUx}ŽVŞݬޞîsvMòùi~ãòèš÷›™Ý¹°±…%yáP±;Qà›Ð‡ ~? 9¶4„0cfÄ\’Ù XËW»´’’𠊽Æ’Û9jŽËÀA´™í aÆXŒ7DúaÏ_ÝE -VúH6¢´u„l/š²¨•ƒÎ&–Ç‚qp ’·s£ÙVñæGøi5mâN%4âÜá)é¾ÐÎ$ ë>3ß4M`±.Ø‚%øþ=ȦäÞNèÏéºy€Aî¹'øb„p´ !àøg#üâ£îBúŠôiƒÅïKñ|XÈã½æ.ÒtâØ\±–³p`|=¢lyá,™¢·g Òõ‰·ÆùI ZðxoDß© -^îWܼ·oINßC$ã=Wñ]OeYÈ(Ö˜¨nE€··;2o€Ì‰E©l;³ö%J}»t†¸qM”JÄ!òÑî&<(/GÅ"_V5†L…z¹æßœóQÞÝóïײ^éàó$ʉð¹Ä+TYb”†ÒA<õ™'Šú±lIÝ9+©{†ït,` f öçê|rd…ïGÿåýì1¤ÁßÁÿ`…c»…±±÷5æx² å›´:×Gâ×Òx2X¸¦FI ¸'æ7»Wîë ã -š —â|´Ü3%‡&cz4¾· 0-(ñ¤Ì CRçßR-d":L67<Õë“ -F°•È -é0C^l'h=Ÿ9’ÇsBYmSú¨ÎfPò:·=Ï°£¥ÈXÚLÅ9ÙÑç ÁUb(ÅÈ\Ž;a-.lm•CH®Ý8FW­µëly?<î,âZ\Á„‚÷Ì©Bz‚„ãëR“PU¤' '†‰î8èãI²5jX’ž%y— -"çSUä µÅ ÜŠT4z86»RÉÈžKЛúÔ…©\¯ -&aº‰OÝCžj7â¦>õÞ{f¡Ÿ»¦Ó=‘i¶®Q $ DöʈU­ù^ö '× À±'iÂbEŒ¶æ4ÎÌB:¿dÄnˆ—$¤-ZÁñ‡”Dd³2¿#Í=‹š*‹\_Å+@ý…p‡1Õ÷€¿¦“ú¿Çà£Ø©ÒtàHtÞ­;r3?j6]<6ºÅþX„ÐC½4YQI Æ`ï síÅBì{=ñ€ò-,9·Ã¤)¶f!ŽÒw®[Y¸­„(ä+ýd ‡î¯|;"{¾«¼ÐlŨŸœžçCXO£ôÅ5ÎÙ‰G÷ýÀ Õö‰_IÓL»‘xña¡xÀ¶cjsÛ)^jb qðrÛ¹Ìô[^:аåôÄQ¶Ø'^¯Vì-¸­¢"«i©¶Vµç<0Šh_¬"WQ_7¯óM!ßÜ`†à5·›{:mp· î!ÞRšÌ„ûÀ]žY5õpÅ3ê&)ŸyÏ¿_é§yÙYxZbŽ'}Jì6:²7nY<àDñ4¿Îêw@€¨¾•½F–¶(NKÅe÷L"¾l•?ˆ…áäºïŒw¥Žf->4ô6úÌÒ«){Ê|.8Ñš±fšÖIã~Ït¶£¥Ÿí¨;qÔ¡²&ïÊ%ÓÄSwT7ƒX©¡lØgžÀHFÜ3¬¤½Æ’‡¥GV(ÛðRø™…/[˜AyÁÀçUûº|Ú`^ÇÇ[×pÜ­U²’n¯G5²ÂêyO}Rß—l[Æ*pHà‡ŠÒ¨}¥M‚Ä(&vÒ áiiR凡#:”ªlu4lji ýa ¥V|Éð™l¶Šß°”¥0hÀygJÀÓw‹mAýÄÔ3MP?ðuáVØHI2¨€V<ÐÆH6Sôl-©`ÍßïçHìõ'þZQç?`ö ™g› Žf8ò‚eS›Î-::„±€x"«• -@j¥&g«ÙÀ­3OC2–E ®Pq÷¡C§#Ïг¡öÂjH/=n±ÃÔ’r™÷ÅJ¹>¢ò@zÔØluS£“†Ôw—ŒÌ#7 _¶2 ç²™i¤×ì쥡ž8jiö‰·»}UHAMzNŠ9ëÔßìðãKMO¼\–¡VOŒ¸Qª/R U„SÂGý`™@i}VÒAÊ+Ù¼d‚Š¶ÖïOye‹´Ê‡=?LQƒ 5a¬B¾•W­¼êä*øÕì‡ü^Ü2>%ä™Ë¼C ̸fþ¦HëF„ʘéñY£F:œu}‡×LØ›Yaˆ» ð™ž`Ãd´Ï†©NØSë¹%úà,2N[ÔB`éRö¥\%§öã~~ÂǦ~¶15¡ÁæÔr6¢‘C!¤ ýþþ8¿á&AAƒ¼—CMfgzW¹éc ~&‘×û¼ÖÁP’<ëÑ ö]2+Ñ©ˆhùáÿÞDöÈO|²ÒZn:%)=É]*#WûnøŸ¹ó—þÌÉh±JÝ, ÆU+Ã¥‰Aq¨3-ŽÂÔÒp„âÿÒÝÕendstream +4268 0 obj << +/Type /XObject +/Subtype /Image +/Width 599 +/Height 387 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 25699 +/Filter /FlateDecode +>> +stream +xÚì½X×û¿-E@Qz°VĆÝ`#»&V”X1Š‚ÝØPQQDÄŠŠ‚ŠŠ+Š‰Šˆ Œˆˆ½»‰`”Ž÷‰çÿw˲.°Ï}k¯™ÙÙ™Ù3gÎ=Ï”sþý -pæ´´´_ýµyóæ4§¶¶6 Ðè»wï.ÓÖÖ–ozÇŽÙW¥—ƾڿY[ÈÁ÷UíÚµ³³³ù&bÏ]‚||ÿý÷™™™¼s&&&—žÓÔÔôæÍ›¥—©®®ÃM¼uëM)ËP={öd_õêÕ«¼444ܵk$ b¤’’Š§RRR||| hb·nÝh"›„hiiIÛ·oþüùì¯ãœœœhbݺu³²²ø–9tèÐr'Ožüã? +4Ô«W¯TUUMLLH²4ðúõk!ÛYzâÌ™3i3 A– //^¼°°°à½8éççG£-[¶ÌÏÏç3//ÏÁÁ¾Z·nß2cccÉhÏž=£)¤Hmmí¸¸8«[½z5Môôôœ>}: øúú–K‚÷ïߧOÒ7$ ò$öìÙCÓ{öìÉF;uêD£GŽ)=gdd$}Õ¥K—ÒË´µµ3g lÞ¼ÙÞÞ¾¬Õ5iÒ„&Þ¸qãúõë4дiÓrI:wî-YUUõÕ«WlÊóçÏUTT(®,((]‚„‡‡G§N A•—à®]»hú?üÀFÛ·oO£G-=çáÇ˺'HÜ»w—šš*puì~¢@h±å’àíÛ·¹‡d A–à‹/êÔ©Ãk=v•RàÓ¡-Z´ ¯üýý¿)ÖÒ_õëׯ, öïß¿\$Úµkçåå ¨€srr|8eÔêÕ«ÃÂÂh]÷îÝãëì€ü@¡Ššì°oß¾E‹‘ z÷îMõ¹ªªªðj¿Fõë×oÛ¶-yÍÍÍ<²~ýúààà#GŽ\½z•¤óòåKr–¢ç)ìùóçôw.\¸¹sçN__ßY³fÑ_þá‡Ú´iC™ðͼRWW·µµ¥ù){}||È”á/^¼`  + “““>¼qãÆÉ“'÷ìÙÓÑÑ‘ÝVÕíÁuìØÑÕÕ•"ÁÀÀÀß~ûâ©ÇSˆüä%##ãÑ£G¤6Ê"ʨyóæ3¦{÷î”5kÖ,+‡ÕÔÔè|ƒvÉqíÚµ´k¿|ù‚ü€JÆwOž<9qâ„ŸŸß/¿üÒµk×:uê”U›››SD3räÈ P~êÔ) +|^¿~l?~¤,ýý÷ß·mÛF™L~¤S Êö²Î@hgÑ 'N¤ÝñðáCÜv!Ê£ïàÁƒ‹/þ駟lmm^ «^½ºÝ€<==·lÙrúôéÛ·o㊜ ¡ G;"88xæÌ™trr¸ïH—ÖÖÖC‡¥]L3“R0ª,÷îÝ;~ü¸Ï?þجY3EãÆ{÷îM¾£èãܹs¸¥@ÐΊߺuëäÉ“i'ZYY•ÞÅêêê´ë‡ FÑ"†§OŸ"ßJIAAÁÍ›7CBB&MšÔ¥K +èJ‡ ­[·2d… ‘‘‘"LP2rssY°?þ|ÚÑMš4)0êèèPñ˜>}:šWP + +)Œ¬·cÇ///²›šš_ugffÖµk×9sæ>|˜æDuWeOöíÛ7wîÜï¿ÿžŠDéS£6mÚP,IéÊ•+¸gž|8sæ ’qãÆQ¨Èw•N¥¨h‘©˜½yóÙ-ÙÙÙ±±±«V­úá‡ø®pRõE•ØèÑ£7lØpéÒ%:çGvòR\\|ãÆ *BC‡¥âÄwZU«V­~ýú­[·Ž +aaa!² ñEFF.^¼¸M›6|÷tjÔ¨áêêºzõꘘ˜œœä/dº“'OR8p ±±1ßIWÇŽ===©p¾}ûy#¯_¿Þ·oß„ H||5££ãŒ3ÂÃÃ錤ɳgϨàÍž=»ôùX£F¨¸nÛ¶ M"*ñ?ÞÊÊŠ·zÑÔÔtqqY¾|9®Aù¡¸¸øêÕ«+V¬èÒ¥ ŸÛµk7nܸ°°°´´4d@¸øŽ=Jâã»ÿ¢¯¯?`À€õë×'%%á = ÿBLLLôõõ¥B[£F Þ’L{êÔ©80Hj/^\ºtiûöíy_d ˆ¯_¿~>>>7oÞ„ø€âBB¤ó7*Ì:::¼Wò©ÀÏ;÷Ê•+x=€*ÈçÏŸ7oÞ½E‹¼×ˆœ===O:•——‡\U¢¢¢ÈÈÈ3f4mÚ”÷X CcáÂ…gÏžÅI ÊôÑñ>vìXCCCî`×ÐÐ8p`@@@ff&²Te^½zµ}ûv:xûYÖÖÖ¦C†¦ãW”¿ÿþ›á>}úð¾ÆnaaáååõÇà>¥ÃCŠùå—ÚµkóvIùã?Ò¡”‘‘,@þùôéS```ÇŽy›œ¢Q??¿¿þú ù€(WW×èèh<Ñ €”)**"Ò¨®®Î½ƒß½{w²!®Ã FXãù?ýô“––wÍsèС‡Æ›}ÈÃJã„ 8Ò°;wîÄcØT†Û·o{yyq½Æ¨ªªöèÑϺ Ÿäççoܸ‘RîÙìš5kΙ3çï¿ÿFæ :>|ؼysË–-¹ËžÍš5[»v-šu@!ÈÎÎÞ°aƒ¹¹9wÓá¼bÅ +ô³ €pâââFŽÉ=Œmhhèáᑘ˜ˆœŠ•g…^~ňŽŽ¦C˜k‹FMMmܸqçÏŸÇM|xIKK[³fMýúõ¹Ûë}úôK‡/Õ䃟~ú {Yá 1bï???ÞÑáÇÓmcó[YYiiiÑl-Z´ˆ‹‹87³íÙ·o_óæÍi9vvvþù§À¿Ü¾}ûøøøË—/Ó€„rµ¤¤„ör=xêëë“ñ°7¨ +àŽ ¢S\\Ì®y¶jÕŠZŠì¨º¦*ÒEEE4@6áªkš_]]½,IQ¬÷ôéSÞ‰üñG›6mh ööö§Nø×/_N›6ÍÑÑÑÄÄ„b%îÛ²$(úöðýY:#%RtÆF_¼xA£Òl‡ðîÝ»îîî\›ôY& ˆ¤§§/Y²„ëʶnݺk×®•r'¶¥%8lصkWH45kÖTFŽÞ£Gn +I"—Áƒ³Qsss.”#E’8Ê’EŽ7n,}3.;;›¢K###nNޛ㶶¶ÞÞÞ)))t@ðJw6nºèÛ÷QQQ¥ÏåNž<)å /,,ܺu+w´V­ZTo UR X<þœ÷ŒŽÎu:$“3ºÒôóó‘ô}@gç. Ò°oß>ª#""¸)ëׯ733Û¾};={öš5k¨–ÎÉÉá»'P:“'O>~ü8Þ´iÓ³gϨÚ?sæLýúõÙD:]¤Õq‚300ˆ¥Ã'---$$„[ßlÜôòniýÀ¼SöîÝ;dÈYÅà´vkkkîv!U)?FrΣG†Ênü©ªª4èòåË2ÜHTR)÷•ÕÔÔTÚ§t¦ÇF…<)P:ÍõìÙ300†Çoll¬®®ÞªU«øøx."³²²¢ÃÇÐÐ’ ÔÔÔlll|||¸åðÍ&ÊÓ¡B$Ha&Ù–¯E—ÏŸ?ëééÉ6ÿ!A”†ŒŒ OOO®mÎ;Ÿ9sÙd{¥ÂÆƆH==½åË—ó=ì B‚ˆ—OŸ>Íœ9“Sa›6m¢££‘-@ÊP©³µµåô·mÛ6ù|’@)ÉÎÎ^»v­‰‰ ;Æ[µjuúôid ±±±NNN\+¸òü"Oi ΛçuæÌ1‰¦víÚ@‚Hœœö°.;ÒÛ·oƒl">>¾[·n\_™Ë–-+((óm.-ÁQ£~ +X-ÑdkÛ@š*ô÷÷ç¢BîQ[Ä£Gúôéà +XõêÕçΫ(MÝâr(U„ììl___]]]vÔ0àîÝ»ÈPIÞ½{çææÆ^Ò©U«Ö’%K« 0H€*Eaa!E…¬¥UUÕŸþùÕ«WÈP(Ö#å©««³æ¦OŸ®ˆ­»C‚TͨpÁ‚ì½Bâ¼yó¸FÅø&%%%»víbW(9rä³gÏô¿@‚TYÞ¾}ëêêÊ*CCÃM›6¡9nðM¢££7nÌŠM‹-nÞ¼©Ð ŠsûöíÎ;³ª I“&Òo( +÷îÝsqqaEÅÈÈhçÎJð§ A z9•AÎwñ‰'È€lSmmm©ºC±Ÿ?ž8q"{ú¥zõê‹/Vš‹ €!AFaaa`` žžm­ººº§§'n‚’’’õë×kkkS©PSS›:uꇔ¯rã•ààÁý½½H45nÜTÜrBiþ|¯Y³<¦;6Šý¬)9ùréÑ6p3”µ1”BC·Iú¤î›IQ$È(((ðööVUUeýö†„„  û*KJJŠ+À]»v¥Qå®Ü˜IR 1M:µ‡Z‚5jÔ(+Þ2d€Ø%rõêÙÒ+¢mೌ@\]‡C‚àÍ›7Té±-oÛ¶-Þ(¬j|úôÉËË‹½þ`llY*7\"J½e6fÌ°qãFr©sçv• ­”­ˆÖËFù,ãî>Ž7uìجäu°Ô©S‡=?}útEiT’#GŽXXX°7I/^,ÿMŸA‚@&¼|ùTRÒy.y{ÏE‚:µ×ú4ìâÒut´§BÈ6iÒˆW‚zzºlE´^ä[Ñ’%ó ÁÊ“••ÅE†††¤EJÌû÷ï¹ÖÏÚ¶m›ššZ¥*7HHA‚­[;r×*i¸k׎ÜhÓ¦z÷îÉZZš—W‚³fyÐç±cwíÚ Š‘;wî´nÝšý‘þýû¿~ý…’Aÿ¶mÛØ]]Ý­[·‹·!AHðÿ—`ûÿ#ÁöíÿÛ ’`ZóæM§äåå^–=<&Óç‘#aTº AÉU’:::4,ÞJÈ'OžtêÔ‰ÔAƒ½y󦼕ƒŠŠŠ‘‘ÑÏ?ÿ¬pOC‚@ÊlÓ¦%ëÑ°ÐHÐBȃ1B$w:::”?~ìׯûG:t(Wm ä:“ `ç6úúúááá ñèéÕ«W ,>|8$ B‚BÒ¢EsHL,Ñðòå ¹Ñ¹s=}}½¹QOÏ_ØO’’.q¹4~ü˜²$ˆ{‚’æðáìB ÀÀ@¼C¡ Ð9L»víXùœ4iRvvv%¯sRX³fMn:)ÕÚÚºzõê¼³}íµvž¡¡aPP——É—†=Ê-ÇÊÊŠ*úa‹-âââ.°Y³fì•[·nÙÚÚB‚@úÔÕÕÑÓÓåRÍš5$ôt¨ˆ–Y¼x.ÐêëëQ244X°`&“`ãÆ ÙDé'}Ú*å“ ÝÜܸ¾z«ÂJÆ–-[455i÷™››Ÿ9s¦2•7œžžnbbÂM_¸p!÷f=¯W­ZõéÓ§'N¨¨¨°á“'O6lØoÉùùùþþþÜt¾.^¼˜¾¥uëÖ-[¶LŒìÙ³NK45hPTh Jù=A%8k–ï–ÌŸïÅ$H2’aC1ÜV)eÁ8wîÃÓ¿ÓÖÖ¦J!¡¢€½zõúß‹´®t>SÉÊ>‹ŠŠ?~¼qãFÎG|ežW‚œãH‚Ü°ªªjé…óÎ÷@ +]\\h€þKeZùC$* ÁøøsW¯ž˜nܸ([ Ž1TSS£´£¢•µÍJcÆŒPz þûµÛúÉ“'³ÿèììüþý{/r~)ÛÀÀ€=-®ÊA]]ÝÚÚÚ××—{\ê›,køåË—Ó¦Mstt¤ RCCCà­[·Wå %(o‰W‚ãÆÖÒÒ,-A²’”·ÊÝ}\U #**ÊÈȈõ-NÃ8dä¼¼¼‰'²ÒH1Tff¦¸*Q¦‹.A[[[ooï”””ôôô‚‚!\°`Á¼yó*s- $(.þù矾}û²?;~üøÏŸ?ãÀ‘nݺeiiÉÚܺu«/\‹]‚¨ÆÆÆ¥¥¥…„„‘à7´´´*Ùã $ AHPŒ³Ç-5j”œœŒcGæï6nÜÈvŠƒƒƒØ;É»£¢¢¬­­ÕÔÔlll|||„HBÅæÍ›‹±rƒ$ Vž×¯_ÛÛÛ³žw–/_ŽÃG†dffrÍ -[¶ìË—/Êôïüüü*y-”YYYJ$ –‹¼¼<Ö«³³s%Ÿ?#11‘õ©¯¯¯|nÆ +ØB‚‚vòu KûëÀ]’~ƒF”ÄÚ…åœãdzJØÊÊŠ*dXIšìÞ½›=ZéääôìÙ3d$( êèèü¤ „+U¿ 4`mK®X±U®ÈÍÍ;v,+u+wGH’ ^–£+Ó˜|–“;wnܸ(ó””t©¼|xãþýDyH¥%XV‚¼40Ðwt´—h²··ƒ¿ÉáÇY_$ÎÎÎ\ç8 ¼<~ü¸qãÆ”…Éê%¾²½bÅŠÉ“'³á¼¼¼I“&é|ÅÝÝ=??ŸûI…»äöíÛ×¼ysšÎþüóOH”ŽÃÃC¼¼¦Ê<Í™3Cˆÿøãè¡C¡%ˆË¡òÃ7¨nd ¬¥¥¥!CÊ YõÑ´iS_|eûùóçdd69ùré̓Eb„þýû³ ÈÈQ $_P¦M›6MæÍò•í/^p‘ ¹‰{J§¸¸˜“cå»,«un±Hp„±»vm–hrph *¨åüž o*-AnãÙ Ü( T>-½y ˆP=ɺå¥þ­[·"C„畧§'Ë«M›6ÉIåÀ;ºlÙ2ò677çšýðá'ÇÊw)(Q Žù“ƒƒDSÇŽí!A\ûåPî¹P–6´æ•`ûömùftªWÏ… ²ŒZµjr£,ººº²L:$?•Ã¿_Ÿý믿–.]jeeõþý{öÕìٳ׬Y“›››““ÃwOP¸¿Ù¥ D%د_oI?3Сƒ$¨ ”ç÷B40Зa«ã è„……±û\ãÇGëj|äçç<˜2G[[û÷ß—·ÊA]]â¾qãƽ~ýšûJÈÓ¡Â%øÍ.¥ A:ynÜØFì‰þ$ˆHPìIHË-ÑÑ‘{÷n—f[1|éܹ è\¸pAKK‹²«wïÞx…ƒ")gggöQe^ˆ!A¥” œ'H°\ܾ}›ªzʱN:Qå )((èܹ3‹)s!’–àÌ™Ó||I4uéÒ„!A ăfff”i]ºtÉÊʪÊY‘‘‘Ñ®Ý-±×«WïñãÇ(R ŸŸÏo¿…zxLf/ Þºu…Ý…¹yórÅj€ØØ“¼wsnܸˆ÷´œôîÝ© ¬©©©ÆÆÆ”o­[·®²ñ`ff¦£ã/”5hÐàùóç(Ò‘à/¿L‘hjÕª$¨ˆåTÔ6ååï¿ÿfò¶hÑ‚{çºêðñãGkëÿžpnØ°aüû2” Ô€ˆPiPÛT€—/_’èPjÓ¦M•Å€NNN¬M¹W¯^¡$HG‚^^S[¶tN¢`BBH œ7oÞÔ©S‡]ÍËË« +977—¤OÙÊÊŠþ>ÊÀ7-Æ7Pa Ê$A‚á¼}û–]íСÃçÏŸ•ûÏ’è[¶lI¶~ýúŠÒ¿Æýû÷¬§§§¡¡aooZIA‚ €—/^è˜êÞ½»ǃ………¬%UssóÔÔT…ØæÇ›ššîر#+++;;ûüùócÆŒQP Žçjnn&–daQ‡ì B‚ˆ‹§OŸ²÷{÷î]\\¬|°¤¤dРAìø‡*Êf=Úßß¿¬¨¶¬cJ÷XúA2ú ·¶¶¦Ùþ¡ýn€ŠÇâÅ‹IÍZZZ àj¾–– xŒY½Ú„#=244¤#‹b åó ——ýµÚµk+J È033+ëÆ¥þöXº1´… r +²4¾U«VùøødddÐœ3fÌpss¸À²$¸`Á̘˜(–Nœ8Ô©Sûo¦Áƒûq?¡Ä^Œ‚!AÄÎõë×ItpM™2E™þ׺uëèOijjÆÄÄ(Ö–«««—ÕÐë7ûü÷ÿö(¼EÐo.hРAff&&åщ“À–%AîeyJ&Œ%èÓ××ãÞ…¿råÌС AH qñâEªxéø"q(Ç?:zô¨ÊWNž<©pobbÂÛh6/¢ô'ø¯ÈÍbsiÜ+¥ûäý¦9C%$ÄÐZuY bׯ_÷ës¼õy½ B‚H”ß~ûMUU•*·ððpEÿ/—.]¢ª‹€€EÜþaÆùùù üJ”þù,Æ{•›o¶o.  ñíÛ·}W®H˜¿‰µuú¹§ç/ˆ!A¤)ƒ]?LIIQÜ‘ššj``@dÆŒ +úîܹC!(((+++'''66¶W¯^ì+Qúä­[·nDDçA¾Ù¾¹4n`éÒ¥7n$QÞ¸qcàÀŽoݺ2}ºû7“·÷D‚ RÆÍÍŽ2==½¿þúK·ŸâÖNxß¾}¹ }ŠHbbâ÷ß_»vmuuu{{û•+W²é¢ô'øïÿíFÐÊÊŠb|vo6ÑŸýòåKHHHƒ 444hÃ"##Ë%Áž=»U²ÃÓfÍš@‚ ’†êºþ;ånÒ¤ w¡LQ(**¢ˆ‰6ž¬‘½)+„G‚Kˆ!A¤郎2:ÖºvíªX/MxzzÒfS$øòåKìGHTˆrЗ„’žžnjjJyKZQ”mŽŒŒdÏ¢›xH„!API®^½Ê°Ü³güomRRR5hkƒƒƒ±ï AHPáÊ ¥µkW,Y2O`¢¯$ÑÆì… §„¯«¬í¡´ýË+=”½rþ°hNNk ÜÝÝ{ „T‚uëZ”éÐW’0Hpðfáë|uíÚ¬ +VX÷CrÛùBIII¿~ýh#[¶lYXXˆ]&ŸlР^%û +444à“àÍ›—[µjþ•F‚––æ_Ÿëî5|ø .Ñ(M¤¯$'Á:uLËZÛBW×Ἡ{÷®`Õ!??ŸuDÛ½{wù|ã`íÚÿª;CCÃ/^`É­%Ñ€vbâô,¯|<~|_RÒy.Ѩ(Ü¿?˜"8š ®©WÏ’]»v7jiiáéù ¯;vt*k];c¿‚«$—š5kR>“nämÛ’’’ÔÔÔTTTbcc±§ä³r;sæEgâJññçø$¨¥¥²‘R‹Í!Á*+A¾ ›«V-å]²dï(Eså• ->©ø‘^!Á*È©S§H4Õ«WOHHŸ­ÊÌÌd·çÌ™ƒ}$Ï•›„“ ¶¶6«Áºti Vu ZMÿ“ ®nµV­þ» ’ ­mãÍ›})-]:§, zxL¦ÏK—~_¹r $X5!Ñ|½³Ó€kTDæ°[m۶ŭÀª,AMME‹fQjÔÈD$XH!¼víü®]›!ÁªIQQ‘££#åöÈ‘#åa{8Àž\U¬Ž!A±K÷!AJGŽ„‘•¸¼‰w4(hïèòå þŠ¥X–qO°ŠóäÉ“ZµjQ†“€d»%¯^½ÒÓÓ£-ÙµköK••`JÊÕaÆ𥨨C BK°U+‡Ž¸D£’{:TDÅCëׯËYrݺ•L‚S§N,íPi&Ú0HPÊìÞ½›2\GG§¬~Ï¥C=h3 €=R•%ˆ÷•¬œHÿ=A%Èw5•]ke’mC1܆¡Î‘&}ûö¥|ˆ¹¹Yi ’’¤¿a®®Ã!ABúúø±î«W¯¤¼jöDhŸ>}°ä¿r‹ˆØ+«4k–$ B‚@r <˜ržëî\:°~"ôôôd{G”«r›8qlݺ¥“ƒCs\…!Ae’ ¤·D®tÿöí[ö¤(×ø¤ÉÊÊÒ×ק5nß¾–Q Ê­¬fÓtuu AH”­ÃÂÂFŒÁ;ÅÏÏwtøðá4Ø%%✒°Ë1UUÕzõê?~¼2‹"Ñ¢ÌÍÍIOR8^¼¼¼¾>>ÝJ>›0Â%èé9ùر½,íÙ³¥, <¸»wïž,ýüó(Þ¯–-û•ûjÍše¼_ù#÷ÕÑ£û!AH‘ôôtKKKn455ÕÔÔôáÇܪái%“ }~ùòåäÉ“•YTqqq‡¤ÓñîíÛ·UTTÔÕÕoݺÅ(¢}|p¯?ÇÄ)K‚«¹PÑʪ~é®”cÇŽäýÊÄĸJ½,¯d°æÈÂÂvÊCŠˆØ[Õ.‡¶mÛöÉ“'lxÖ¬Y÷-[¶Œ’ [·nMyyy“&MÒùŠ»»;×n­:<<ÜÚÚºzõê|ÎZ¸pahh( $$$899Ñ ÆÆÆ®®®ÿ–êL™Íoee¥¥¥E³µhÑ"..NàlÜÌB¶gß¾}Í›7§åØÙÙ ì`[Haa!­±’‡ä;w(¨$7‘¤$zìwëÖ¶|úôéðK• f™üÚϳ` jB‚ $X~–.]º{÷nÈÍÍmÒ¤IAAÁ”)SÈ2ìr¹ì߯Ífúùùåäädgg¯^½zÞ¼yÜ‘N3po«q[²cÇŽû÷ï³áºuëÆÄÄÐbIµ«V­â‘Îüýý6l(p6nTÈöÇiE´º-[¶888‰ÉÑ£FªüQIb¢eRH(¹ÿðáô +:‹øøñ#üRu"Akë"G‚&U-ÄåP\—)R;v, 3›„}…FŒqéÒ%°°°ÈÈÈ`óS=Ì]A(©¤¤$ò)7ÑÔÔ4((ˆ¯ö²ÍäAáe{H‘jjje•:ÆĉE¿Ø[™™™ìyR•$Ê:uê|m¹(rQ\ Ž5tÆ•,­\¹°, FEš2eqtt¤ýÂúÑ(/ôÛ={ö  "ÄåP$Q.آΑ7öîÝKû¥eË–åýá•+Wè‡&&&_¾|©Ìa%ÏüðÈ B‚ $¨Ääç盚šÒ®¹|ùr¹~8jÔ¨J6; ÊUå¶víŠ fJ9EDì…!AHÈÙ×tÊÑeá»wï455UUU_¿~­”‡ÕΛªšSR®Þ¼yYÊéîÝk •Py`9äÅ‹jjj$µ¬¬,@{³oß¾ÊznY%±'44HÊéüù“ $ ™C:+WÿJööö4ÿÑ£G!A¥‘à±cÃÃC¤œââNC‚™sìØ1:ZíììD™9)é¿‹ÛFFF~$F 'Oþ¹cÇv²M›7¯«²LL¼#å”’rÈœÂÂBccc:`IpßœÙËË‹æœ1c†¸ª_–ÈA2¿R±páì*+Á |½½H9=ºÈžžžtÀÎœ9Sølý™››Óœ×¯_—„gÏžºMúÉÅ¥{— ^‘€¨Ê°¦DÍÌÌJJJ„Ìváš­aÆb¯~™ÉG2©ŠÝÜFUq âeyH€*©ŽYÒœy¦NúU !AD‚ˆ!A” R³¤¹²f  ‘½Y/Ê­CH‘ "AH‚=öinn^\\,p†k×®Ñ õë×—D  "„²ÅÒÒ’[’ÀoYÛ2•.D$ˆH ‡LŸ>]H‹ -[¶¤oÏœ9 "D$  |àÊêTâŸþQQQÑÒÒÊÏχ•O‚ÁÁ›VK9EGGB‚ +WZÚOSbòòò´µµIviii|_………‰×  \IðÂ…SgΓrº~ý$ B‚@® šŸv)oú¸qãhúúõë%*ÁQ£~Z´hŽô““Së*.ÁsçNP\&å” *biaiÓ&¿+ L>>‹%t¾ê￲ôêbcO²o +k“(ÅÅFŸJà›°"~þùg¾é 4 éÉÉÉ•àÖ­ë㤟FŽü±ŠKbpò‘”ÓéÓ‡!AÅ•`Ó¦Ê +sÔÕÕ%dSS“Ò«Û¶-€};}º»à+8x3$¾ iŽv••ïÄW¯^ÑD}}ý²ÞžÀåPå¨Öð` $X^ öèÑuÈ~\<¸¯D%hbò_+Ç}úô`«377+-ÁæÍm‡›êÔ1…ˆ”””èééÑ>zùò%71<<¼òB‚ò\­á H°bòôôä¦tèЦÄÄÄ@‚ˆ B‚b“`õjÕºÿ öîý$Ø» øìÝ»…R«V%øÇG|i +‹ +!AP.Hv´Ú·oÏF‹‹‹kÔ¨¡¢¢’•• "D$ Ê<þ` ¯W®\ ‚ò’‘‘AÊ#ñÑè;wh—ÙØØHô€‚ B‚UG‚))Wììím)ÑÀâÅs]\º³QJ£GswÇÍ@•÷Ã=¾ãfã~N©, âž ¨¤<ÚM·oߦáýû÷ÓðСC!AD‚ˆ!A> ~÷]Çzs©_?‰>*W^R"Î)¡¢~ÿþýÁƒëé鑆ìííCCC¥VÚsssUUUÕÕÕŸ={FÿÎÂÂBÒ$¨ˆDEEQFijj"+ AHP¢LOO·´´äFSSSMMM>|ÈM177§y”I‚?¦ÿ¸cÇŽ¬¬¬ìììóçÏ3FšžÄGÿ+..Ž>;wî H„ex9´mÛ¶Ož¶_{8 H„e(Á¥K—îÞ½›]©kÒ¤IAAÁ”)SتíÛ·“Ëh`Îœ9~~~999:­^½zÞ¼yܾ£>|øÀ¸Qœuÿþ}6\·nݘ˜Z,©vÕªUÂC<ÒªaÆgãF…lyœVD«Û²e‹ƒƒCéU˜™™½yóF†žÄGÛéëëKŸsçÎ…$X Ú)Ü1›’Ÿ#'é΄*"AŠÔÆŽKÁÁÁÌ&a_¡#F\ºt‰]ÁËÈÈ`óüø‘»‚*PRIIIäSn¢©©iPPýJÄëœäAáe{H‘jjj¥—¯®®Îl‘$>Ö‚è×–ú A V@‚Ê ÑÑ‘ÞÞ ä$?²ŠH°¸¸˜]ólÕªUjj* PdçììLM›6e¾ ›”””pó“GÊ’ÅzOŸ>åøÇ´iÓ†–`ooêÔ)?|ùòå´iÓMLL444¸oË’ èÛSúÿÒ*^¿~-ã˜õ®;räHî­yH@‚å•à]%—CeþŠUÈááá=zôà¦=:xð`6jnnÎ…r¤Hî™ÆÒÒ¡ÈqãÆ¥oÆeggStiddÄÍÉÛ¬­­­··wJJJzzzAA¯yg㦋¾=¥ÿì°aÃøž€•2  ëÕ«}Ò‚t$ˆ÷!AÜ”ÿ{‚ÇŽðòš*'é?Ž–K‚ÚÚÚ2ÙN{{ÛÊKpß¾}¤'Þ¦KÖ¯_off¶}ûv6:{öì5kÖäæææääð݃(É“'?~œ oÚ´éÙ³g………gÎœ©_¿>w£VÇ ÎÀÀ 66–¢Î´´´n9|³qÓË»=¼Ü¹s‡V”••E?§õ’¤YàI|´aÓçõë×¥#Á­—/ÿ!唃H„E?f>¼qÿ~¢œ$Ú˜òF‚2ÙÎaÃW^‚¤RyŠ›’ššJK{þü9ò4¦@éP4׳gÏÀÀ@?~¼±±±ººz«V­âãã¹cÜÊÊJUUÕÐÐZ[[«©©ÙØØøøøpËá›M”§CE¹ó˜˜˜øý÷ß×®]›¶ÊÞÞ^¼}Ú~mXãÆ¿ûGÒ‘``àéßãhÖ¬ $ B‚å=fåÿr¨]3¤z¦ÿ>ÒLîîãåªÅ +$>ÚSuêÔ¡OI<§*D‚***úRHìHiÚ´1$ B‚¢³GŽ„É䶅À$ðr¨®®nY h“ÝÝÇIùL»iÓF ÂAâ£=¥§§GŸÜ3®Ò‘ ––ÖŒîRH¬XB‚ $¨d‘à’%ó\]‡ûû¯¤´°@ ~÷]çE‹fK:?TPH|ÌGô)ö†Cåêr($ B‚å:f/\8µcG œ¤øøs¥%Èuª{÷î5®S]D‚ \äææ²~ÁèSo, +”`PPÀ¤InRNtÒ B‚ èÇlBBÌ‘#ar’ã„H†KKfÓ’.ŽŽö ÂñåËv{Ž>¹·%-ÁÐÐm$²† nݺ¾JL¼@£ô)– &))Wy››`‹…!AHP™.‡ +— ºR¢@ⓉIRK—ΧtèP(ûŠ +3nØà+–¢xìض|–×@‚ $X®cVþŒ‰?wüx8M Ù*P‚{ö±Ÿ§¤Ä³6pØ(oû3•¨dòn!‰T\ Jùr(ZŒ!AD‚•ù¦#¾*åc AH” ÞºuåÒ¥ßå$ݾÍ߀víÚµ--ÍyQN‚ªªª|ßJ'Õª¥ *ìÁ)¿" B‚ üKðôéÃ+W.‘“táÂ)> –“ löŠ„”_–wqéN>’~²µm B‚ ¢_½~ýÂÙ³ÇËJ7o^ò­tÒ!AE½,/åfÓd $ B‚ +-A…H ¢ÀšM“ZÚ›7¯#É6;v„!AHÿþ¯m©u¥$W „!Á²ŽÙÞ½{"U&A‚ŠëJIjêB‚ $¨bLjüÃ:Õõôô¤Ï€€IK02r©GBéÏ?c!AH¬$@|à‘H|tûúúÒçܹs%-A‰>³gOP¹$¸~ýjúU§NP AH€ª ‰á}ûöÑç¨Q£¤#A»ï¾ë$Ƥ§§[ NŸ>…~ellŒb B‚TMH|tÇÅÅÑgçÎ¥#ÁÒ/ËOœ8¶o_SxxßÏ;tp‚!AHP^H|t?{öŒ>-,,¤&Áää˼mÏè‹~ÙÓÅ¥;÷í[×C‚ $¨$>:„¿|ù¢¡¡¡¢¢"öæCEŒml¬hú´i“|| IÍi6ÿ•ˆ¥/A555oð™:u*+áûùíÛ·Qº!¹¹¹ªªªêêê4ܤÉMŠ‰ý¨,K‚wï^ ¢töì1N‚"B|øðûyttd%%€¬ÄKIÑ!åÑ‘Hú£áа؟é"ÁððJ±±ÿuìÕ¬Yc5‘ XMd?g…l)o hoo  sHyt$’þhxÁ‚4¼lÙ2™\­d*K‚[¶ø¯^íÍ—Xðˆ÷ =z4$€Ì!åÑ‘Hú£a:ixèСRàÀ?ˆ·×iKK ´¶n€´$);ïܹCÃ666Ê ZYÕ§éݺu0 7%æDH@‚‚”Ç= S\\\£F •¬¬,%“ ]Ó6m)™˜C‚üûµ;]R‰¯¨¨ˆMéС˜111J#AB‚ìè0lß¾=7eÆŒ4eåÊ•J#ÁÈÈ}ûöíàK/þ H€*ΪU«XÿÜ”ððpšÒ·o_¥‘ z‘ @ $;: I|Ü”W¯^Ñ}}ýââbHHe¥¤¤DOO×/_òNoÐà¿ç'“““%*Á!CÌšå!ÆT¯ž%$ A€ˆæè´²²â›>nÜ8š¾~ýz‰JPNú„$@Õ„õ¥ûóÏ?óM ¯ø$èëëíî>NBéܹ €ß„j~:Iy|Óÿùç--­üü|1J0>þœ&ÿU €¨jäååikk“ìÒÒÒJÛ²eK:<Ïœ9#F ._¾PÓèÑÃ!A PÕ ÁÑH²øí¢E‹èÛ3fˆQ‚ÜÈ3gŽ9VVJI‰ïS£¸ + AÓ§O§d'ðÛk׮ѷõë×—„…?sòäo €ÅÒò¿ +Hv¿-))155¥’’’$$Áºu-š6mÈ›444 A $ ©Ž>sss!oÄO:õk› %$ÁmÛü’’Îó&ÖÒuY<}úð˜1#¸täHß K—Îç¾:u"ß·/þÎûó°° €¨šÚèè#Í ™çÂ… 4OÆ åD‚»woá½jêï¿R`‹1 CC¾o;€´$ Hmtô‘æ„ÌóåË +i¶ëׯˑ­ªU³&Á¯¯}”)AãjÕZC‚  +CR£CÏÌ̬¤¤Døœ^^^byFTœT«VM]˜55…IPµZµê €¨ÂxzzÒ¡7sæÌoÎÉnQT(/ír¨±±.‡HÀGaa¡±±±è}ÚÛÛÓÌG»ùe\`à*Þdff"D‚÷îý™˜xKwï^ã›!9ù2÷íù¾½?‘÷çwî$@‚ ªqìØ1:îìììDœŸµ/ZÉîñž òë@Ô&âüïÞ½ÓÔÔTUU}ýúµ¸$8uêDgç.e¥ØØ“ €bçÅ‹jjj$µ¬¬,Ñ5jÔ(!mËT@‚r• A PE`-‚’ÔÊõ«+W®Ð¯LLL*üx $$€lÉÏÏg-¡]¾|¹¼¿uppøÚ_íHHEdïÞ½BºNhh(ýÖÖÖ¶’¼|ùÝ»·ÈOºwïOH@‚Téˆ#U,Š433£ŸŸ;w®2LHˆùí·PùI÷ï_‡AyK²<ƒ’ €@H^t€˜ššTl «W¯¦%ôìÙ³2ÄåP B‚HŸ^½zÑB"«ð222ttth!)))–`TÔ!Éò“RR®B‚§s(7¬±PRXNNNe–3þ|Z΀PuH%E´EGÇ‚ *¹œ´´4mmmZTrrrŪŽ‡oÖ 333Å»ä 6Ð’›4iR\\\ª—C$  Q¾|ùbggW®^“D'??¿N:´ð   rUxO@‚ R€ôDG„M…›ˆÎáÇiùÆÆÆ?~D$ AHù!33S__ŸŽR•äÖÒ­[7ZÅôéÓE¯:RRâ¯\9#? ÷$€òAb¢Ã¡C‡]ËíÛ·UTTÔÕÕoݺ%bÕqöì1ŸEò“nßÆÓ¡@©¸s玪ª*¹‰$%éuyyyÑqתU«’’Ñ«\ $€$(..¦ŽOOO)¬.++‹]wݾ}»(UGttäܹžò“RRâQuH°Â¹¡Ð»åY)!ÑÎ577'=Ig‘‘‘´F==½7oÞ|³ê¸?‘¼#?éáà ¨¤GúiÑ¢9ÒONN­+#Aö_TUUëÕ«wüøqyðÛ¤êÕ«[XXŒ;öÅ‹(r \¼}û¶V­ZTŠHLÒ\o¿~ýh¥}úô^¶]]‡Éarvî ‚ÊHpëÖõ‰‰qÒO#GþXI þûõ]ª“'O’täD‚ôYTTôäÉ“€€€ üý÷ß(u@tL¥¨W¯^R^ïû÷ïYWƒ‡Ru +R ”TÐË¡œÂ + µ´´x¿²²²¢)‘µhÑ"..ŽM,((˜6mšžž^ýúõÙÛǼ\¸pahhhi3r£4°qãFZ²¦¦fß¾}¾ZÅ÷Û+VLž<™ çååMš4Iç+îîîùùùÜOæÍ›g```hhäå奯¯OÃGþwx7lß¾}Í›7§ìììþüóO”s…D{SWW÷Õ«WÒ_ûÎ;Yë4>|(ýíf¹‡N†Q„@” E‚$¯Q£F•žDãïïß°aC6º`Á‚3fddd¼xñ‚ÍÏydÇŽ÷ïß(2^׬\¹’"»œœœùóçO˜0á›|þü9¢Î™3ÇÏÏ~›½zõj÷“U«V}úôéĉ***l˜gn³Ëú;¼6kÖ,Š=Éò[¶lqpp@9WÐ ¡FFF´7IF²Ú†=zT¬Ë] A™HcâĉÛØ'qYØ°¥¥%ß<Ì#III¹¹¹e‰Œ×5ÜÄwïÞ™˜˜|S‚d%uuu6L6$ÿ²aŠ"icø~»©4¬ªª*üïÜ0’¬ššʹ"Ò·o_Ú•...Â_U(êééÑfìÚµ {@‚Šr9”j~Š€:vìÈF_¾|9mÚ4GGGò”††7Ù¯­`…=}úTˆÈº†ÂOÎnB~K!' ÒÚ¹Ê6ƒû9ïO—õwnØ¿xjT1Ù½{7í8!ÏgJ‡ЖPIKMMÅ~ BHÅ\tزa[[[ooï””Šûh:7[:u(‚ã[Â¥K—6nÜÈ{B0Þ¦ºæÇæææß”à²eËÈ_l˜æçn#ÒÏ99~S‚eýHPixòä {"”$ÛÞmÛ¶maa!ö€å\‚^‘SH\¡±±±EEEiii!!!œf̘1sæÌŒŒ :ÙvssãõÅäÉ“¹—,ìíí·mÛF‡? Ï™3‡×57nÜ Åfffúúú<¸¬M¢yþú믥K—ZYY½ÿž}5{öì5kÖäææRÜÊwOP¸Ëú; r@{–Â|Úk#GŽ”“M¢Þ A1öe$(Ñ{‚ÚÚÚtîúòåK6=**ÊÚÚZMMÍÆÆÆÇLJ÷ªéøñãuttêÕ«G>âõEX={ö ¤aŠ +›7o®®®Þ¬Y³½{÷òºÆÙÙYSSÓØؘ—]Ö&Ño)î7nÜëׯ¹¯„<*\‚eýHP9`'Z$®HÈIIITäTTTè û@‚h6 r’àÔ©S$šêÕ«'$$ÈÛ¶­]»–½16$ B‚@ì\jÖ¬IåŠt#‡›WRRÂn¶lÙ7rKpàÀdÒ%t‹öh@TMòó󜜨ÀwïÞ]†ïD'''‡ÝtwwÇ.ˆÑ‹â‚´B¥ÝÊÊJ`ó,òCRRR5hSƒƒƒ±×$ Py"""Ø»x)))ò¿µ¬ 555´È AH€JrõêUMMM*ê{öìQ”möôô¤ 633ãžÁV”êN¡ëj, "–X] „ôôtSSS©u˜+.ŠŠŠzõêE›moo/ðå ÉUVè+ @‚"rÿþýÁƒëééihhСʺ„Ú# îß¿¿S§NZZZô/† ¢XgÝà›>lmm©„tíÚ•¯?ùçãÇ ÒÆ÷íÛW:Oò ¯4 ŠÎãÇé{ÇŽYYYTÕœ?~̘1 +'Aúí’%K(X  +géÒ¥íÛ·G‰U¨20`íâ&Mšì‡KþIMM500 ¿0cÆ i^]A_iè+ ü&£Gö÷÷ø•ÂYºhñuÓɦ„‡‡[[[ÓlÿŠÐð 7@§ú‹/&5Sñ¦Ú{o¼ðÖ-¹¹¹¥gŠ‹››ízª¢ÿúë/Åý—.]b74™e¤ ¢¯4ô•&i *Á{‚fffe5¿/¤p +,Z¥:‡ä&di|TÚ}||è¤9éØd­•–^ /ttpçNjÓ¦ J¬r@Ê ýNúPˆÇA…C!ŒÊW$݉-úJ+½Rô•&! †„l½|ù)§„„1F‚T‹ŠŠ~õÍÂÉW´„7ÅùÍ¥q 4ÈÌÌdäDAU®_¿Nš =>eÊ%ûkt*8hÐ úkúúú*±è+ ”²µ´´fÌp—B>|ˆØ%xçÎ*KAAAYYYT©PõêÕKôÂÉ;Z·n݈ˆ΃|³}siÜ#t +JÇ/ntp 8ð›e˜U:xoݺõôéS:§å=_ +Ç£G iw3Fá^ˆ*Øýû÷§?Hg†’ˆÑW$¨Ü—CÅ+A"11ñû￧o*¢t²·råJÑ '_™¤Kl± P>Þ¾}˺êСÃçÏŸ«Â_ÎÌÌdÝB5jÔèÕ«W(@%H’Zºt>¥C‡BÙW¾4ºaƒ¯X$xìض|–×@‚@ù P¨N:TŒ[·n­ô1 /?~´¶¶¦?Þ°aCî"H‚h@€JòòåKR•á6mÚTAP<èèèHŸáçÏŸ£<HU‡¿ÿþ›]mÑ¢E• …è·k÷_•R¯^½Ç£THUÔÔTcccv4''§*gEAAAçÎÙ{ ·oßV¦š“o(“]\º“¤Ÿlm›@‚@Ñ¡ªžõ1Ô¥K—¬¬,d8;;³÷èÅØåô•ÆNâããuuuQNäJ‚² +m@ö>`§Nªx ÈK~~> ‹Åƒ¿ÿþ{å¨}¥ýËó.0 +‰œHpóæuä Ù¦cÇB‚@¹pá‚––{#¾°°ÂKII‰««+ëþСC•\šrô•VIIHP®$ˆ°°0ªå¨ÄŽ?¾¬LàAOOOÖ.ñ¦M›*³(åè+ „!A P-Ç%ª ‘ ¤`òjÚ´i_¾|©ØB”¬¯4HP~$¹Ô#¡ô矱 P¾èfòäÉ,ºÙºu+2D¢¢¢XÔìââÂ]`,ÊÔW$(W”èƒ1{öA‚@™ÈÎÎfý&hiiEDD CD'11ÑÀÀàkËùMÿþûïòþ\iúJƒåS‚vß}×IŒIOOJUÝ-Z´`Oþ_»v R^?~ܸqcÊ@2 9±\¿UŽ¾Ò A¹•`é—å'NÛ·¯‹ˆ)<<„ïç:8A‚@™ ZŽuݨQ£´´4dHÅxÿþ½ecÍš5ÏŸ?_ÞXRÑûJûWÐã©@N$˜œ|ÙÃc2— ôE¿ìéâÒûáÖ­ë!A d>|¸F¬ÓUEï5Oæ9’ÝD£˜‹»€\E‚66V_Ÿæšäã³HHrphN³ùû¯D$”’âââ… RuM%ÓÍÍ /Š‹M›6±KúöíË=c € %x÷îµÐÐ JgÏã$("$Á‡o°ŸGGGB‚@9ÈÉÉqqqa¯{SÌ‚ /—/_ÖÕýïá› C€Ì%B)6ö$MoÖ¬±šÈ¬& ²Ÿ3‡B‚@Ñ¡j¹^½zT ãââ!’ ==ÝÁÁ2YCCƒ»§€L$(Þ×ÞË’à–-þ«W{ó%{ö "9rssÇŽËê%‚‚ä ¾ü÷©˜Ê'KK ´¶n€´þœ&ÿU ?~tssc…¿}ûö©©©ÈE¤¸¸8 €uk¥¯¯Ž<“àòå å0=bçðáÃfff¬•æÀÀ@€ŠÎ“'O:uêĪ²AƒQ„ˆ<å• wòÌ™cGŽ„••RRâÅûÔ(.‡)€ýúõce¾C‡¨-•:“Ù¶m uuu·nÝJA"²T@‚ÂŒ9yò7H(z%©££Cè$•÷ïßsͬµmÛW¹A…%X·®EÓ¦ ykÑŠÈ;wZ·nÍŠzÿþý_¿~^¼x1:cà¶m~IIçykéº, ž>}x̘\:r$Œo†¥KçsßN:‘ïÛ‹çýyXØNHˆ…¬¬,///uuuÖî'UOŸ>qûÝØØýóIKp÷î-¼WMýýW +l1†ahhÀ÷í±cЀ6/%%%¤¼:uê°Ž¦OŸž——‡l©R¤¤¤ØÙÙ±Z¥k×®4Š<’• Uµj¶Â$øÃÂ$h\­ZkHˆƒ7oÞP¥Çݺ{÷.ò¤Êž ­_¿^[[›µˆ>uêÔ> [€¤$¨V­šº0 ~mà¡L ªV«V•£  ÀÛÛ[U•JS5“¼>þ=-- Ù ÊU‚@²³³,X ¦¦FÅCKKkÞ¼y¸ý*Æ»wïÜÜÜØ33µjÕ"-fee![ AHÈ'………þþþ$>ÖÈÏ?ÿüêÕ+d ¨$=âÚ[«^½úܹsñV)$ y‹þ|}}Ù}bÀ€xûˆ—øøønݺ±V³fÍeË–¡Éµ*%ÁË—ÿؽ{‹ü¤{÷þ„Á¿_;§èÏÄÄ„•Uª¬-@BÄÆÆ:9ý¿Wºtttp¯¹ŠH0!!æ·ßBå'Ý¿„þÖ¯_Ïúþc½ßÆÄÄ [€ˆŽŽ¶µµeOOOoÛ¶mP¡ÒK—Cü½víZ.úkÕªÕéÓ§‘-@Êsæ ²È qqqÆ c…SSSsâĉ>D¶(“>¼ñàA¢ü$H°êðîÝ;///öÞáââréÒ%d C=z4tèPö^¡ªªê Aƒ._¾ŒlQ FEš1cŠü$\­ +}ú´eË®£g:÷4hPtttqq12‘ "A¥ýè`8p ÷ʃ¾¾þòåËÑ,?¨‚\ºtiøðáÜÛ¯õêÕ£c§‚ò)Á””ø+WÎÈOÂ=A…ãåË—t€›ššrO¸¹¹]¸p9ª8d½5kÖÔ¯_Ÿ ûôéQXXˆÌ‘ ž={ÌÇg‘ü¤Û·ñt¨bP\\üÿµwî±TÿOŽN.“RKÖV´Ýä–1'Ó ÉYD”$Š¹•[S1t˜Û䥆Q“º¨„a-Ò²‰2T$«Ð\Ê%¿ýžÛYŸÙéòë××·Nz=vþàøŸóy½_¯÷óóü|>ï÷ålnnÕcæÞ?zô(-NJb”——;88°ÙlQ¥(++{yyÕÖÖRd$Aér(ñÿRRR‚VPPe‘´´´‹‹ËÝ»wé¡‚ø===IIIk×®öMMM>ŸOS’þ^,)úJÎëñãAÉdpp0>>^UU•)a”sXXØÐЇ ~œ††??¿yóæ1w6lØ™™IWQ~‹>yR Ý‘œWss‰ D1<<œ˜˜ˆ"eFBÉÉÉtuuQpâ§-**²µµeFѲÙl' +éq²_&‚NNvø255!”„ +E1ººº²X,Q¶àlzz:=ïM“Hÿùóç9sç™NNN%%%t‹áßAI†Dð·066†³S £}0€fff©©©###‚ø÷xûöm\\œ˜:;;çååÑ4“N’ă®˜šé—CÀQnJJJL@ûh†O‚øÅtwwGFFZXX0ÅÈf³½¼¼„B!‹Ä$244„²Úµk—¢¢"SnÚÚÚ(ÀÖÖVŠAüvoª££Ã”§´´´­­-=ECÿ„ÑÑÑÜÜ\.—Ë \+W®Œˆˆ ið BéïïOHH022bžOø5::šÎW âijjŠ‰‰111a†·ccc¼ÙÑÑAñ!ɧ««+--Í‚™“M4_·ŸŸßÍ›7é¡5‚cll¬´´ÔÃÙß^4.ÉÆÆ¥Ô××G!"ˆ?‘@°gÏfy_Ñ|õ\.7..Žù%þràì q(f^ //’Áûto ¦ pÕÕÕÞÞÞkÖ¬™ø€½©©©¯¯oqq1:$þÓ‡3Cfµk(cÇŽÁÒ˜#‚˜òö0))‰ÇãÉÊÊ2=€ŒŒÌúõëÃÃÃËËË© ¦ÞI`MMMpp0’|â>%%%¹sçhZB‚ø ØUTT„††2«›‰†ZXYYAëëëI‰?—ÚÚÚØØX$óÄ¡ RRRHøÀÀÀªª*º?N„ˆÁÁÁüüü}ûö1«ý2+~Z[[£'yøð! "!ùŽÂ…¤x¡ ±===i‘2‚ ~D322 ˆjjj»8ÄÍ›7Ÿ:uª¬¬ŒzBr„¯ºº:,,LlPX·n‹‹Kvv6­UMÄÏÑÙÙ™••åêꪧ§7±{‘’’ÒÖÖöññÉËË«««£@¿’ööv$ž¿¿?ÒRLø–.]ŠtMII¡™"‚˜t‡(BBB¾ìydeeœœ"##ïܹC릓Žh9$—ËeÖcÎÇŒŒŒ|}}‘œÝÝÝ+‚ ~ –••EDDXZZN’/ê”444ããã+++i°ñŒ×ÕÕ!…x<žØ}j   `eeCWæ ‚ZZZrrr||| 'N´(bÙ²eööö|>¿  `xx˜ÂE|IOOÏ­[·$...P½‰Sÿ‰¦ÃEj¹»»#Í^½zEá"BbùôéS}}ýÙ³gýüütuu'¾¡¢¢Âáp„B!¶¤ÇÔÿBFFFÐôYYY[¶lAJˆ% DPOOª‡Dªªª¢'“ ‚ø£»»ÌÌL777±k§¢îZ¹cÇŽ@ðèÑ#ZqŠñáÃ4knnnpp0FOìž2PTTDzx{{#U°11Uill,((·±±ÑÔÔ»ðÅ\A577÷õõMII¹}ûö‹/È ü) ±jjj’““áãЈjjj_61‹ÅBÓÛÙÙEGG#ÚÚÚ(nAü@ÝD6NÐÖÖVKKëK› šØmÅŠÖÖÖPÆ3gÎ\¿~½¡¡”ñ7ÃÞÜÜŒ†ÈÈÈ8tè—Ë500øjÛAÕÕÕy<š?~ü˜Ì>AÄwd±¥¥¥°°6ÁÃÃÃá,X°`Ú7PUUÕÓÓspp8räHBBBqq1úØÎÎN +ãdÑÛÛ‹Þ¸q®AÞ½{·‘‘ÂþU ÐXØ`ÿþýh¾+W®@(éÚ&AÄ?dtt†Q(&&&º»»oܸQ[[û[ý°h18 ôÆNNN'Ož„>^¾|ùÁƒÏž=£aÔbôõõ=}ú´¢¢!B ‚‚‚ tfff œœÜ·",--½dÉ4„››ŸÏGÓÔÖÖ’Å#‚ø•ž±±±½wVVÖñãÇÑ›››£gþêE9±Ñý‹-Ò××ß¾}»³³³¿¿lllFFÆÕ«W«««a|^¾|9Fs <þ‡sïÞ=@žžuøða²¥¥%4‚ð?cÅb±´´´°=ž€Ó]Z‚ Iv¯¾¾¾´´ôâÅ‹p‚^^^666ȉ+¨~8͹sçÂéè蘚šB18|âĉèèè´´´ .\ºt©¸¸ûª¬¬¬««ƒè455µ··wtttww÷öö¾ÿ~ppª:22266öŸÏˆt|||oâO?~ÄfØøÝ»w¯_¿ÆÇ[[[Ÿ|Ö¬Y³ Gl6{ÆŒ,Kê3"³9}út¼)##ÙÅfØXYYYEEWWW×ÔÔÄ?Ô×ׇa°{öööØ©§§§ÈÆÄĤ§§ã‹Á$Š¬hKK ì'5A|Ÿÿ®*üendstream endobj -4160 0 obj << -/Type /Page -/Contents 4161 0 R -/Resources 4159 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4139 0 R -/Annots [ 4164 0 R 4165 0 R ] ->> endobj -4164 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [449.546 389.988 482.144 402.89] -/Subtype /Link -/A << /S /GoTo /D (domain-member) >> ->> endobj -4165 0 obj << +4273 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [128.678 377.045 273.702 388.734] +/Rect [160.152 483.399 210.009 495.088] /Subtype /Link -/A << /S /GoTo /D (domain-member) >> +/A << /S /GoTo /D (domain-example) >> >> endobj -4162 0 obj << -/D [4160 0 R /XYZ 85.039 786.531 null] +4272 0 obj << +/D [4270 0 R /XYZ 85.039 786.531 null] >> endobj 190 0 obj << -/D [4160 0 R /XYZ 85.039 766.606 null] +/D [4270 0 R /XYZ 85.039 766.606 null] >> endobj -4163 0 obj << -/D [4160 0 R /XYZ 85.039 744.844 null] +3082 0 obj << +/D [4270 0 R /XYZ 85.039 662.656 null] >> endobj -4159 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F58 3360 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R >> -/XObject << /Im1 4096 0 R >> -/ProcSet [ /PDF /Text ] +4274 0 obj << +/D [4270 0 R /XYZ 85.039 456.101 null] >> endobj -4168 0 obj << -/Length 3148 -/Filter /FlateDecode ->> -stream -xÚ¥ÙrÛ8òÝ_¡·¡ªF €×¾ùÈn2'ÞØ[™ª™y $Êæ†=$Ç?}¤DJ©­­T"h4º}#á,€?á,ü@g³$ýH‡³Õö"˜=ÂÊ¿.BXÈbsõpñæŸQ< ? ²ÙÃÆáÉ?ÊâÙÃúwïúÝåÝÃÛÏó…ÖÚ‹üù"IRïæÓ<ôn/ßäéëù"ôpêãŽ>ÏUê}ú0ÿóá—‹·Ž„‘¡ÖHÀ_¿ÿÌÖ@ì/¯³töãÀ³l¶½0‘ö#£å»º¸¿ø·ÃÅkfÆ»¦øtêG©3F†ÃPù:T³$ŠüØ$ÄqÙ"WÆ»†ÊUS·ÈS½¯n±ÌÛ?×ÌxÝðo‹4ÿ ƒª\å]Á8òήêýn®2¯ãÉ5å]Î[»š'¿ài;\ªç*ñ^Ú¹þ©õOIR‹&;Ý= qoÂ!÷Aè›@;DÈýA˜Ÿ±ŸFéÙ-ÌèÄiyN¼\uå•£ìÓÀËùóK¹¬kT¨YRAðêM½Í€Æ¤‚5K¹©«ªhxþ -J¿½ÒÐûÕÞS³œ/@ÊÝ®N2/ß­yRó Ï+xá¦lŠUW7¯€)d¯¼GD;”H`jÇÐ3á®4@wn”Aý¡ßM¾ê~†¡I¼û|‹Ë|¡q-b«z{Ï€O9.ZJp¹­·xbÁë—¤Y=­8G´Òtù*hQ§h+I ¯k¦ ¡êŠçòeY•¨ä¨~¯<×=‘ªyŒzÉ ®Á/hñ“éP-¡8&±wR½ò†â;J (oðL†gšò -Ç”õ&Ѿ -c ‚4æ#Âß0Ü~Z%`Æ f©'2,}+¾d”•'Ä5$à)G{êsÙV -Ñ’r½%\VŒk³Gl¢Ì -,,‹õz´ûgѦ³bY‹vØï¼C4ÍäÍwåVæ×D6òÈ3IJ¬é—![@…ã -\TÃ*MŸå¦ßH̽Â7 *4ž$L¼wì˜DßBÑÍF´y`7c‹Å´œ‘-¨¢„¯~‰¹Z t:ðTìxé¿È!9àŽ'î1ð\1ØBÐt? ¢¼b_Í_nœË»yj¼ŸyêWwùKѾºÅ¥X{7ï®ï ¹ÔVš¸…fP—›Õ$Á:GŽùEI¿”°\<ïzÆcˢˉ}˜&ÄßQ ö$Â)D½#º4;­•œFNP^ž/Z–ø*%Ó¤ÄFž3L½ì;þ&Þþ¼ÃPf~»c€w¤Ù8³ªJ1KÁ‘7ÃìêŽ]³ï±žnQQ¬‡•Ä€çü³¶¾Æ -£0pJ’· هػŠØq¡`ËÝØ+Ñ}‘V¥‘5æg'`ÄŽq K¼¹X„Ü)ð‹ÞPƒÂ0M©æ+AFKÄŒcTÄ’˜7 r+Gµ½V¯î -ú~™Z@ò•çQ{D>¡'a¦«ú‘¥’’7kÝŠÝå ÄqW»M@Ü%Äu]4¢i’‹@,Û4ðƒÓ7Ã[Þ C°úÊ_ÌK¢à)w“°Ç‘ˆ¡œÄÂcrÄ2/–'”жˆ‹IÁKðþ$<% -ž6€:Ñ€1ï|_‰F_I„Y?ÉwxsÝ -С‚Äs8‹U×Õšù@ÌÝæ;þüÈÒ–ËDZ¿ -ʃ‡ø%¾–EkQSp‚E¶*˜ú8&™ƒA˜‹Å…d^à5Úr·²)(alH?¿»`›‹n`j9à>f@ÜòÈ!X©Yx¾¥¾ÿmìLÐ*Sd”œåàÿÿ¼ª8ãÂÕ¿ö¥\ ÍRJ2 •…”y(I‡`™ ‰ðω+æüÓZõ%äfpF½®[:KÖj®K«á«}Ë7»f„Ûº’1Ø G“šwT d‰ŸÄÉ,RÝ+…©?¯43|T -¼@ …#ŒÎ»‹ž®PÈ«/žçdÿ¸È]vù²¼K¶ÐôNèXç{O"ДÂÈû\l€î#1IäÇZÍLúqý@á-ôb>Öžcœ¤ò5S ±P&÷<“bijÕè¡ã"q@’³e>ŸÈ—aKÅÇ’ˆ#ɶ#Ó2ßÄé þú¡Š¦MC`  Ó8ÂĦ¾JrbžŒäE2j€h^dâÏé¹°º´ òHfµ¯H¡Ÿ+™Üû.½å}”58üe+é’u98¦†ÀeÏï -±he|£²»VÒMLm¶˜¯úDÞê3΃þåKÉ’$5+«-Ö’®rÁîøçÔuoS¯TO8k¨vàZ’™‰Œ%ñ”×B/àãû=Æyà¯S믒q‹0p9)ã½GN6” IÚâ4_%©Ÿ¢â ëÌC)Ž:ÔÚ7à‡!êûJ¦Y³M4²Ž09_?ѧƒÛÒôlŸnC‡)X5¾6ñ -«3í‡ 7òæµ&ó®¸`¢f%y㘕 ü´kÁÜu½㧊õ™ý920c™X<"ó“4 З&%Гáø•r.f±‡ ¹¼Þ/9Ob(WipùƉÎ3)§wCyc{/”NãèfØî -ãq»ë Ö´Ζ=ZN_‘ê\B#£t Yù¦ýÜÂh»‰¸·å~šmc”– Ø·Pqæí(òì9à(í]UÝÐy%ë¹àÅÓä;Ž˜ŒA5åü³ävã‚™”ûÊrßÜâ ƒ×þµ*ƒãC±ýŒE‰:öÄx %“–šb@(Û!\æX,G•$·Ñ0‹Š±çáJKY´SWUß•©þã”Jƒr&ê¼F;gwPú`(u -­àWÓÛ]èa¢E‹‹su4¸¡‘aÞðôòkäUO9%wŠöƒp²¹ ™~žoõ+HÿÕùF?ƒü¨Íïnòž5ÙâïϺ#UܺÆ×ÍàZ¯ûkum‹æ”„ÀG†ÁùëÀœƒýPgìEqtâ´0'^IH)Îa‰* -f ïÓ‚ ¡Z -}V0˜Ó‚±@?̹`ŽOœÌðÄË›û3 -BN¨â\|²åùðTL¼`-Û»¦ÜršÏ΃ÑúÀŠ#ã]SS¢c HQȈ؜Ç/¡N€‘H Â ȽTŒ©Œ zÍymy•Ò6ø-·®§˜»¬~˜×‚·“ TÂ5®ÞÞóÄ÷\Ø·;pÊA %P6¼ßÙê3óãTøßãš]6ׄ8:‡OkÖ黼ìäÑÉ>Yp,(©c?ìäS­4€÷•Çë×*<ç¬Û—ˆ ßáß;ù:w*÷Ð`bNH¨ g":½\uÒ iy²C‚áãO~Ð(„EJºŒ±Ï0Ó_#|Ð5baû$¶¨‡¹É›Wg´±7}ID¤[ƒ1F*–áKh;nnµOõ¾²ýÙÈödùƒ)Lbo‹ DM]·ºh¸CÄúNoÔ'BôµrÍ®ÀÄQÅgp94\ãÀØ w|Ù2PÛ5ý“|ç2_ -[¶½ ]àj[’Z×ÃPÒ:m4Ñ¿,Àª^‚Š¼G~6àQJ±˜¾¹‚­áYlÒîižȾ‰+žË{y?«)!ÈÝûakÉ$UUÊz í :þe#s$öM“·üvÃÈ8 Ò® 6J¤]IFkëm˜\æՀȵåûnh‘ÀÒý­l¥ƒ.¢æ•ÒÖ|½ÌZÙ|ð2H°;^¸§÷[²j\Vä³Ê>tx²$°/^!·ì ¿°à:ëC#9òÔ » M6D±¬ap"_$6ÎqÈW#ßh= -ÿ×›éËÍÔÏÒ9K±5NŒ%Ù6é1Áö¿×Œ)þÑ0³endstream +4275 0 obj << +/D [4270 0 R /XYZ 291.201 260.073 null] +>> endobj +4269 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R >> +/XObject << /Im2 4268 0 R >> +/ProcSet [ /PDF /Text /ImageC ] +>> endobj +4278 0 obj << +/Length 2852 +/Filter /FlateDecode +>> +stream +xÚÕÉrÛFö®¯àœVY0¶Æ2sHÉRl+åX“)MU’C‹IŒ@€@k˜¯Ÿ·u$Aç0‡IÊUB÷ëíííO<øçORåza6IÒØU¡?Yl¯¼ÉVÞ]ù²Ã›D®+\z3¿zýVÅßs3/›ÌW´e¾üŹ}óiþÃçéu†Žr§×I’:wSßùéæþ#ƒo§×¾ƒ s}ž©óðaúÛüÇ«æƒç®#7ŠC|ïËÕ/¿y“% ôã•ç†Y:y±çúY6Ù^E*tUʼ¼š]ýÓÞÂkÑ„OPumv\‡ž›¦‘%ÏW#佦‘ÓÔ[ $NœnDä<žé-Òñ¤yºÕE ‹EµÆyì”EÛñJ]õ‡H¿®xKÃp,ñdy`p±4ð +è +˜®dm+çƒÌ9Èõ–€µ\Z™Ã~Á?uó\ xÍ'ð¾w´ûœ¾ 4à¦sãßr s{ÊÅGŽeÄÝ )À”ªîx°(™ˆ§!#àn#Wu‰œ©§Aâ¼XD`ßÃü PοsâN×¾‚å¬g6òö#âòæ ‚qW`Yó—d²_à[Æg +H ý] +n²{(^ã­œVð)H€-ëßÚmŠv„;ïðýÇùÃô:ò3&AÎQà9V¬ºäÕ—Öa”:E‡†ãÎ|Ã"ÉùˆqlØãmݲˆéBÔ9Os½çKZÞ8#ü'¸`ÆÃGä]LC‘mßÔœsRwˆ[ýTæ[zìï#æœxnª1#ôc7ŒÁH­ñEþˆñýêùÉéµÊ”⃧—âÒðÎQƒ~£ ÝbÁ®‰Òí' å5éÿ'ÂR$pˆÖû†äÈšàž¢t$n„ôõÆÎÿÞy÷‰¹˜1i•Þ¢‚‡ ý¬ku‰6ø—$îfÏ+ŽrÁ""Á.êŠEMN´®þ€ºìÏEÝÏ-™cÃiÏ’Çë¦ÞïŽèD#íµô¯%Å“DrÊÜ-/Q€xä =°À×çͶà˜6TÒŠ¦.@.‡?¼ÿ×ëmØÿçÕþϦ•% æ뇯@å†Ý;óIœ?ÂiSïüq™K ŒÉ< zÉó©Ë›Z˜mÖ]nw°¸ø3Ix­¿þkÑË¡ôEL˜äÐ324/Mˆæ; +à §8x¢€žód·h üÿOyœ‰ ÌDÎ M!çiVˆùB¢,Â0>)$^Ï…Uxô”U¸\å†,xÙðLIngƒÍ‰"ÙÝ +Þ¬âÛ]ÙãÒm´`­‰zNºª~ƒÉσ/¥;Ç)qˆÂ̹¯°Ò‹ó§ rhŠQâ;ål˜XðÒYn„Û‘à\ó¾NÞiEœ4!×_-oÕ¢¼âDµðÝ3~1œÓŸÓŸJ[…þ²·Š…ï“šÕÅ,„¼¼kò8@âÊ“aÙ¬àLÉw’ÒpmiÃ\‰âÑ5­,½Í‘™<É]x¥BEµ(v`½7W®„–M¿H6¡‘#‡©äNP_e[Uàfi(wE±ÉÝq¸›*¸Ž´9Çᢣ"‚õYxˆìÉ\6äÜV?“õ¦ºNb0ï9oÿÆØyž$v“Ø"Crz‚üÜA±Þóê³skgYqFÌÈJ3<Š¹ûTd?vĵwú÷`ÒB·5òô ÎhÚ¼Z€˜»­äIGDŸHK.|:æ”JŒRD->dóuÊî†]ßÇåFùâŸ`P?O¡¨ÑlØAc¢CBÎB¤®³vYÐW8a?°7®>ghY·²™XÆ,oŒ1ƒâ/ºâkÑ 0 à[~+—¡-Ów©5Õ¡ü³CÓ@jPz-ñõ‰Lg9,ÚB)9}á9ro­«â÷£|ï—ÜïÜ ÊxIŽL™Ê'J§¢S¥SRê©H*gÃg )úøiµËw¾‡‚ÔKœD¬ +¶×ÆàxÅß i]ô GnN¤¥Ë7ÝËSWÓDh[×6r_Bú\ +Æ0¦Ê€œW(JSËR ]™k«ÔÈ*ï¾s!Ãôm.8rÁ¯sAåúÔ¿Éœ·ÓÐsrÝíãH°“ÃN7Nœ7y•S¥@=ƒÐÈ«a^¿õ(*™W)u U*F™pø`ÃLçüÀÐ' +Rü°`Ûá,«X4¸¡në•1®”¤€FEŸA3Žpû†tõðýH„òlªnCT¬H>ð9,IgÏc­ +Ý4õ…´dsT~@^6+ÖHuFcàzž’£¯rqðjäÌf> endobj -4170 0 obj << +4279 0 obj << +/D [4277 0 R /XYZ 85.039 786.531 null] +>> endobj +194 0 obj << +/D [4277 0 R /XYZ 85.039 378.83 null] +>> endobj +4280 0 obj << +/D [4277 0 R /XYZ 85.039 338.666 null] +>> endobj +4276 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F41 3054 0 R /F59 3455 0 R /F20 3021 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4283 0 obj << +/Length 3115 +/Filter /FlateDecode +>> +stream +xÚÕZYsÛF~ׯàÛ‚U&ŒûÈ›-9‰ËöZÊ:UI ”ƒ€:Rûã·¿î<6ÙÍ>xËUÂ==3=Ý_´;sèŸ;KBÛñÓYœDv軳åæÌ™ÝÑÌ7g®R8³Àv¢S¯oÎ^~F3×±S'ݬ™äfõ“uþí«7o>ξï[¡=_Äqb]¼Ÿ»ÖÕ«Ëw2|>_¸†ÞÝ õqî%Öû·ó_n¾;{s3ÚnØAäc¿ßÎ~úÅ™­èHß9¶Ÿ&³Gj;¶›¦³ÍYúvøÚ/Ï®ÏþÞs‘¹`&«ŽÜjø¡EÔðˆÆû3Û¹íîÑíèЮÛ®—žäëâ#-!Oöø„¶ŸÌ\×·Ó8é4d§a8ø»šÙAŽù F¡ºüd³ßf®íiêËì¨Í'ñÀËË;»¨éH³áT~j{ôê½z˜öÇr“#zð.Ç‘:<íãÜ‹­­æó|x¾µ, ž®pôcU¯e.«ä{u-ßO ,ˆ°Z1G¥¿¨7˜Éh¦¨dèz!Ðàr×`¸ÃÆÏÂæMõP456äeyÕɚͮÕÖí|Aä,D~FèMÊwÙÛÊ‹cë*߀>±ò¦•‘®–¯aC^r[æSŠ»1#´—|f>y»Ç­»×ÅÙŠ²j™¯d`m.›™÷ßQ£É•Á–å]?«|eÿñüÈÜé¾ØbСɇº|WðyÊ\Fº{°P¿R“å‰NËrº3¤rd?ò ‰Ñ‰»¦ÆÑ·B…'Ê6†»ìwx|–K¤j$VÅË] à“:Öe'”Øo8eÁ’ÂxÏŠŸ¡™ˆµ¨+™cí ð ü¹àsm²BîÎl\¢­Zy×zWÍu,µÖrçñÂÑ…bw"™¶Ëô±cýì„Î2+K(ú™|6Ùò¾¨r[òž,Ϫ£. ! Cë#ߩיFÈ»z2¼È±“(™-B¸4†ËTs§Øðñ›cõç¬ Û.× âØ€+‡!ž.˜>¤²ð]¬$™<7©&ÈzÛ’wbaC©HY÷îA`Úžïõ\Ž ¿oG~$hwúFæÁØqmj ŠªˆïtfˆTH6üVöþI|'µ?¤¹¶GÍ-,ºNL®nÑû³ÿÞW-ÜØNâE°®._ä‘Ãͽ^™/\–‚ÅbÛ$Œîª%k+=gYt…ѵVÖe#±Uù£4sXÞC]gð¾Í¾ ô&Yö¶Ùòç«#Ïwl'‰=·Ù>yÐá½I,‡÷üÙqã}¶¡•:ǘbjÌó¨ì>Êà¾p©w74€ë@’J%1‚‘Ö>T똔È篓¦_Ö5_­VbÆ®­B«¿ +{I?¬‡"“FÿâDöCk@ 3WP *»Ëµ¿®¹á÷XÁ K²!„‰I/ eÍȇè´êÈdfÅJ©›Õ• ¥—":à=¯åû‰/°26ý(ú{è~ÀT €¯K¢á¢ýíiP¯Èè'v›Ô@éi×Úù“º{H‡¾rH@®Vð¹èF{dÚ)ä~‚°‚HæaDâ*³[š@¢uà +'«bÙÔm½îþÖÊÀ§yˆÝb ´Ú¢3Î4r\±`Ÿ±Ø'¶ëÃWµ»í–Áºnºy‘A1Dëá^t ?˜v3†•;>ÊFcG?Šºjër P +Ø»A³ß'¹à~§L=aôe™Ú¥œ›Ÿ’µbµ3q$‡jq8 æ/±HžÝ*†‚"#E§Éï eWlªÄóÅ@0 /Œüi¡I†Az?/–™ú!BuK‡ >ƒ g#kU³Â(•˜ª:À2kûÄf.=Þçˆ@)=ì Í[$º…É0/QÈ œÍXfª’o¦ß·`ðêƒôVlbÙ-y4’†ûVÀT"ì·f´;8Ú»TæiH5“Eb|Œ#ˆsêfb5™Â2S72àuVEÛ5‡Û]g¶Æ¥^ìùW– ^N)xq6Ú¨P;æ˜ëËg™áw¢è´W°?´¨/ÌG_n¶e®©!k0çQ°³]”Òù²(ä¥ù9W¹L´&ÿPþÉ‹àŸDѽÄ!0¥] +}ua=ÀnÔ-ŨIžÊ¿3å ,+ƒœ‹ßÙçq¬UWz”ÝV’)ø +™ÓcA˜ÊDŸ¤&$b‰%®&‰«©qa‚j¢=Wlö¦Ó›H8JDp\àcË£=O¼ª×R¡ý@tçÒ×I4:'qã∡ Q?ª2(xRh½#4¨àûP,µÐó0— +L¦Ù{@»H :A¨¬Òîèˆèü³Æ0gµå†á#YkJNã3èî2„„¦èDW&’Ã+/pÅo¤ÈUC±»Å­¦fª¡&;êbXÙ‡ gH‰ÈáNÍušÇ}E·hÿ¿<Í«¥–Ä’”Ÿ„¿ò9¦Ó4ì9Ž#­^©©}^‚@è´ ï©´¸ùÀñ­ïóf¯~‚—óSgpñ´§{Ð ƒw,ú·[vuó¬Z¹Žu)*s¨ +Ÿ… Gü¾Pyôî…VmÇù>HV‚µ\Ÿsbñ ‡9hDç6¹ŒþEÁ¥ÐþвÆm#<öV¥Œe·E©ec†UŒ‰ÏB«8–²Có4Ðc»@§àò%µ¶»þàü,£ùÓÈÍr\6Ž;ȱ•g¼%Ñ›´…s‰Æ;E6O¬ƒ'hí}VÝéΙ.à<‘è4\ªØx6ôò(ÆéÝ -9 Ô¢¯¿Î³Î\1<«• {®ÊãÐh)ÉCñyÎDÆ4{Mœ58´Ë¬ZÉ&xìÖºßëÙ¤@eŽÒo”XßjobfÅV(ÍN´†ÎqŽÈ¨ã›?ÆœEx¾VÂÕ6 ÆÝE’ꯓz°'.úêµ´ÿ)Ÿ‚oþÙ£lkiõÉGâ³é«ï{“5úºÅTZßž)Ù1K-ÁZ#= ´‚ Q™œG‡°Ù±1e^Èå'›.kT“ ›yä©Ë«V¾í‹iJOØÞ×jsAShv_ZK8çx‡E<‚T槗?~@‡žöê\(!Îóz³’­F&úÊÖØÞ5?¦é¡Šáx£j±–0Ðñ†$»!øJf è»ÉŽ†"\øðS ZÒýB+·½š=ô&ÓÌ¥öCý¯Qbžj.ÀˆGgþÍb'l%¥†é)Jný°Ðä÷Ôæ²[zªìÆ$Ï¥Á´ú§Èµè#·Ýô5DJŠ´Ô‘h‰Fxk8xVJÓdÏxän‘ûµ†Ù¤¥ò Ïz]slŠŸýø×1â$Í8ˆå7¤É®ÿñqqˆ07ïß¿TØo~|£Á¿øL® ¢w§ÁS_ÂJù—*“^æÍéeÿÆ^XéÓË+£¬¬Ð^ìz4'Š¬=È®ºœï ">}‰Jv¹LorMLö½Á$¤‚™|VZ^£k‰“GdÖÖÒ캒iå§Q_[… =ê´Y’UlYP‹(tÉÎÊ}´”ðÀ“3 1u J|ãBºzŒyH8×õý/ãÏå°i•~,Ç> 5Ðd%zhŠi ÇÊúŽe€®Æh.E|Ç`ÛgºîÞ#[Ì×õ%´èËÚ˜[7àå±b:xyÂRA0D+Ò»õA†Ž<+-)õh³‰¢Á/ÓÊ2uw¹Ò×tΈ£º"+Íþ“x…Ñ‹4¤åБËEÿcqÖùIQ2r%Êý­ Lª“¢%)t©eÕ·ŒW ‡Ôþœõ³ÒA +Ò\gË‚u¹+òÖ°æ8ÒèæÆ­TG«mQ-MÆ ~Ó§>"ÍDKNÿ@çک톣êIÞ ÕŒÓ~Þ\;ñ‚ãÿÇhø½ö/ü§ŸÀ³#üæ:0;íáƒtÿ J3 þ]ÝUendstream +endobj +4282 0 obj << +/Type /Page +/Contents 4283 0 R +/Resources 4281 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4287 0 R +/Annots [ 4285 0 R 4286 0 R ] +>> endobj +4285 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [407.43 670.181 500.027 683.082] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> +>> endobj +4286 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [146.561 657.238 204.19 668.927] +/Subtype /Link +/A << /S /GoTo /D (domain-member) >> +>> endobj +4284 0 obj << +/D [4282 0 R /XYZ 85.039 786.531 null] +>> endobj +4281 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F65 4251 0 R /F15 3032 0 R /F41 3054 0 R /F35 3036 0 R >> +/XObject << /Im1 4209 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4290 0 obj << +/Length 3166 +/Filter /FlateDecode +>> +stream +xÚÕÛrÛ¸õÝ_¡Gj&B €àåщwÓìl.ÕÉÎlö’h‹Iô’T¼î×÷ÜRmÚ>´ã—ƒƒƒƒs‡õ,†?=ËŠm1ËòT9«gëýU<»‡™×WZ âY¢âÔáÔËåÕ_~téLǪˆ‹ÙòŽ@–›_£W½þ°üáã|a­œš/²,nÞÏuôöúÍ;~5_è‡Þ-±õqnòèýÏóß–?]ý°m·HT’ZÜï÷«_‹g 駫XÙ"Ÿ=B;Vº(fû«ÄYå+ýÝÕíÕßžKf¼jâT ±°±Êó$O»‰ãÝ–{¤vU.ì|‘ÄiTÃ1öxŠhì*lí«ÂôCÜ·ÍqŽóÐs ["ðC}€ß{ZÍ&‹ª~¿¸º"T^ô‰@7 N< +Zäݽ —ÉËþþî "ù…{g€Ÿc÷[¨e¾pÈv )è¼mUîvOpm¹‹~Çåu_a/ÖÍpìz]öDï†!{l¬úãa½N@Sþ[òt·mZ˜î¥÷P®+ LƒÜ¤±Ž–[doÇ“µ|72¦£õ±£o%ÛA„Oh¼CŠý°õ™ˆ%:Q™qáÄpõ<ÕÞϸññõ7„áÕ–.’Þ÷ç(N›8 SŒ°èL¹,T¯Û¹3Qs)±.Þ– ÷Ò=n¹ ‚°iq;d†Ëðº…í0 ÷ýËù&6Jgz|F¯ÏŸLñaŒ6Ê9P “©¸(Î5àl›fpý@àZÐD”Mã@84Ï%ÁÞ-žüpóŠpwô-Ÿ_dâøž½^ãÑQÔꯣÍoj¾iŸæy ¡?Qm›Thv\MhÀ±«* "{@>ÛngzJÊs¨xr9ÏmÔ½hö É4®›#[Evîpçv_öus ËNüéŽu_®Ä®àÀŠ7f^{j6e_ñ 4IRDéˆwþ¬B<ŸôL8LœªM_«4É¿Wþo«5‘/‚Ÿ«Lì˜w™2ò¦HÅ.ÿ^y\¸Å,]%Ia!sÈÛØ»­Z‚"Z³æÞ®r‡–Ñõ5Y%&,#βåÉëxÝËe;Ôr-5û‡]ÕË›º£ bÐñíÂTsÇ(Ê‘Dp+Ä;`E‘œp.‰Z•làØož_?[>.BÀqs~GöžÅÄNX?íR¥só_²~´‰ÖS–.!´U×sÇ?À‡ž×V FNÔkLÝ€„ãø +mdÉÖ˜Ò]Šs¡œæ¿nãNDÓf¨2$³÷L ´0…²iˆ Œ&Ê&éµS†Ä¤ˆ^’»Grë5IS$á¦Ù³W„±WÍ¡oÉ{íVý’?+Ç:;ßÑ©NO!Å©1ÎIÍý@b´/Û'¾ƒ`ð>¼| BÀyê¿Í¬DkùÿÖé^Šï’THx!wÃ9™û¿:çõÍí7®Ô%˜Ãk9$žq–Ñò嶚p ”¼œÔ{Txo¢Ñºa? Ô—´­ç`«!?¡\Cð—ÅZ°c¨ƒžbrr”¾Ljbs6Å0Yï(âà$®ôQ.NÁV$Àooùû‰âæ y{Lw'¤X.p)„¥‰2é‰-»L lH ô…D¥æDs89i‡à½¯8‡8’5}Á!]’NÀÍ +Wq‡2PÀ¹­vF¶"ÓÊ£ƒ?×ö³j)n´qô#æ „ôËn:á ü–邬šlµ|ô¶Ö>Ê[—›ð4™r˜©±è€ æ> øë½ ‚ãMX“_ræù‹Gd]ë—#A8«)&„›†Éá’æHÜ2yˆN'\”Ç ›ÏN=v[M ©jÑ_ñ2M*)4öMH» ·.}i¢\íÎ0—ìÏëÃ0Î'I1à(zV „¡üÊD×Có†-\îeaÙ F!„wôBâUÕžÁ0Ào' #Ƹ/$vÎE˜Þà]¸"ºoXíè—²ÿ„yô5$0xånÇs——Ê㬽ÌSÌFëŠ÷ºB„йZb[ +^>óÆ!âï] ™)%Å!W?RŠF$IÅHjŽ¹3Ï‹ÉŠB?¦’—¢VξA¢²„Y•A½ù*ŒCðt&{d>Ù>aILí)€¨yËö ·\„¶9 ÖÒ‚Jo+ÉNObi,l1|ÆF÷%¤_KAäöÛ)vüy„ 1°ò‹Åcââ7zÃB5§*Ô³¥Â(š +üžm”$Ž# ÷¢ Úò$Ûã̆ *0¬MÒ ÄXËr¯ûØ&¯ÃT•ì@–ºf1D ’'Õ#÷C mÌyâq¡Pgy5ˆOàË-AÁpCª¿§&%š8BV¤í¹C™Ö(©‚ÆEe¶Õ}ÝyyÇh×Cæã+¥‰ —!ãºÕ‘BAa'Á]’pð-)Cy/ñÄ©p L"Æë·RPE¿Dz’ÆàÔÙâHLêmCõãIÀèàت¥¤‡w=\õÃP]Ñþ² ìØ…ª–óŽ|L±kŸÚãðÑoŠÜtK¹gýâ`_Klcù:¾áK°66ÒíPILmÈ®¡TȺG.4ÁÔtÜúï«Ý§šxŒ³)+|?‘¥¤È@”ÄQ ÎÞbIfzÁ’ôàÌõºµOìßÔ­D4D†8ÊLèPýeÓ¬nv(A ÔôIhŠ¨«‰óRçï.5‹Ô%õþº—" +\¦à8M±ÕàŸ|,æ݉†¥C8›¦—ž%) +)'øAùâÜtÝò óUA-¤ú­6ž¤rÜÃ17<¹>a‹š·%é/Du{6*=_r–ªÓ€G×Ó|N áçH>˜Dl—«š +ì=‡àˆ^ çF.¿mëÍhÑÁ³ÔÓA‘v0ÅýPŒÙ_µ_pÚ™8Zù•†O­Âã]¨‰ë‚mÞT§s>î  ‡ê0N¢J¯7Ø9o¼0}FÅj1{-ReAk8.#zÃ0zôÃa)Â<„¨…k_å.dܘíù;ÏG, …cïOu"<˜ cÿ&HKlÌÏ7¸äúÃXûOU­_ 3û‹ +{Rx–§{Qù>l¦lÖ;ô´6Ë%zÊN_AqÂ3/Ë%ˆ ܱÃ1FHX¾$‡§Oí3mâ#Ñ,ç$cGÅzÜb+0]¹÷ÐgÎ*“rü€™Ëî™\¼‚w~#ÜÉ0{Yñ$%¿ØŒêö ¹â.†Â›=ÁMACïk?Ÿc¹é(p¤Äݦ³LÕÒX¥q6³ªpòÌ8‘Ü'*³f¶€üË^ꔵÅÉ5?[{°:ª8_ð2ñnPìšýÞšƒMTQ˜qÍA»è%Õ 1 +O°[òç$=9¼þÿ™“ØàäŸ/ž/«‚=çÃœ°àŸzÜ_endstream +endobj +4289 0 obj << +/Type /Page +/Contents 4290 0 R +/Resources 4288 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4287 0 R +/Annots [ 4292 0 R 4293 0 R 4294 0 R 4295 0 R 4296 0 R 4308 0 R ] +>> endobj +4292 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [96.77 519.205 243.975 530.894] +/Rect [498.768 738.375 539.579 751.276] /Subtype /Link /A << /S /GoTo /D (groupmapping) >> >> endobj -4171 0 obj << +4293 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 725.431 298.589 737.121] +/Subtype /Link +/A << /S /GoTo /D (groupmapping) >> +>> endobj +4294 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [474.635 480.678 539.579 490.247] +/Rect [503.041 686.905 539.579 696.473] /Subtype /Link /A << /S /GoTo /D (machine-trust-accounts) >> >> endobj -4172 0 obj << +4295 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 465.008 210.464 476.697] +/Rect [84.043 671.235 99.975 682.924] /Subtype /Link /A << /S /GoTo /D (machine-trust-accounts) >> >> endobj -4173 0 obj << +4296 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [362.911 451.459 539.579 463.148] +/Rect [254.164 657.685 465.677 669.375] /Subtype /Link /A << /S /GoTo /D (passdb) >> >> endobj -4174 0 obj << +4308 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 440.031 134.49 449.599] +/Rect [128.13 51.074 306.964 64.026] /Subtype /Link /A << /S /GoTo /D (passdb) >> >> endobj -4169 0 obj << -/D [4167 0 R /XYZ 85.039 786.531 null] +4291 0 obj << +/D [4289 0 R /XYZ 85.039 786.531 null] >> endobj -194 0 obj << -/D [4167 0 R /XYZ 85.039 424.588 null] +198 0 obj << +/D [4289 0 R /XYZ 85.039 642.253 null] >> endobj -4175 0 obj << -/D [4167 0 R /XYZ 85.039 382.303 null] +4297 0 obj << +/D [4289 0 R /XYZ 85.039 602.089 null] >> endobj -198 0 obj << -/D [4167 0 R /XYZ 85.039 310.72 null] +202 0 obj << +/D [4289 0 R /XYZ 85.039 530.516 null] >> endobj -4176 0 obj << -/D [4167 0 R /XYZ 85.039 275.974 null] +4298 0 obj << +/D [4289 0 R /XYZ 85.039 495.77 null] >> endobj -4166 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F20 2961 0 R >> +4288 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F59 3455 0 R /F20 3021 0 R /F41 3054 0 R /F36 4301 0 R /F37 4304 0 R /F66 4307 0 R /F77 4311 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4180 0 obj << -/Length 3578 +4315 0 obj << +/Length 2755 /Filter /FlateDecode >> stream -xÚ­Ërã6òî¯Ð-TUÄøÚ=yÆÉfR™o¬ª²9À-±F">Æñßo¿Bå9ì–«, Ñh4Ð~ñ"‚¿xQ¤a¤ÊE^daªâÅæx-v0ò¯›X0V‚²òpÞ­o~ø)Íq–Q¹X?9:e¦e¶XoÿÞÿ|{¿þñ·åJ)¤ár•çEp÷yo?|bðûå*ôi­ß–I|þuùçú—›׎ÉX)d௛?þŒ[`ö—›(Te±xvÆe¹8ÞèT…©VÒ?Ü<ÜüÛÑâ1½àYsûMU¦…ºÜpœÎl8MÃLç´áÍr¥U ûŠÜ“é©—íC?>ðïï°íºÙÂÿv™äÁKÏhŸÖšÇ{œ=à‰¼I¨lÛ£©èÓð÷Ì’ xJ-4ßË„{hß½ø:fàN í¦jUHMf&ÖT/Ü¿C´Xdç´ŠñKtÛ —C×–«¤TÁÖ æÉUˆdâ€$Œ —I©ƒ§¶;JÓðϳ閸gêàyá/1]a;;3Déª]-ÇÝ+7æp¨¶—4 yû‘áÿ‰Òè‡â`3âê59ßnH†íˆgE›œÙÿGƒò0;"‚$€jŒ›`3*‚g Qîbøç Âh&,©t9ŽÂy¯‡æ΀[¤g`’&#êöDJ„8öU'‹á@/yõÆ u+HŽ“vä+niƒ áÉumS[•ã©—§€âÂ+mZ)m••à×X€¡-© y¤«‚ó^j BCï 1ñeäí"èÎ#ê«°“qZ.“<ŒJæò÷šîÜDh>pówº §Šà$Šþæ–Ó$ÿÕ ­ÃÑ4`Öã`ËÝÛUÆÚ¢"»º«x¤E*¯ õ‡LôߣîeAÛˆÎ"Žì‰³FŠ6¢l@Í;F›»Ò—’BÍSiX%Æ©àÄïëª#U-àK#,éÜ“nl¬ p3‡3A|8eP!E³_pÄJI€nÔ¬€´^„41A¿~AGðƒmì`×Û3†H3ð6¦e°£xyG¶S]–¢˜öUœ9L@C{±pª(Ùäcƒì^}pF‡–I³X:²4[; Ö(» D > Ô rè*sd”Í­Go%Áã(IÛ-ñ‰®f¶¨EÑtª¯†¡$ØãfOpHÖS ‡WFówÉcõðkNvœHYÑ9‘Æ{¹çù°KÀx4+ÅÓ‡=¹5h=‘Þ á0ßTã ;Û†‰<Šeôv›Òfë㳓ãÑÓ| Û²]­êÒÙìÄ‚‰Ñùõ§ÜÞsÏ»ú'3I›h–Œ³§uSÉ q½iGá‚)¢b±Ùc@e5a{jÒ -ÚÒ'ôÓ*=KóÓD@Ý ‚5ÍÐ6xþž¢ž%0ö‰ûÈM|YMŒðÀ™£*{3pkOJ´Y½7GñÀöHèŽó -K¾øÈÎœ5óýÍä&áÔz‰d̺}"·Ï¦åÕM§ƒ3>ŸààæÁÇwèÜÅm1o“ÛB²­íäeÔ™1ˆU†îÕrkºht‚8ÀøIe‹<,s 5u”‡™Ê*,SÞsÌ8'éÊ¢­TF)‡¤bð X/<ÔD…*Îà<ì—ñC4q­´mèjˆÎÉÑ mì–xµá²§Èl7³~¬tX–‰PmñîÇiðŽBOhš6„ÈÀ½pù´öK}80žµÎ>¶½¬CaÒr(€ÛÆafAdÖÌö˜ïåN¯H9³RÖpï¹ÍÁ ^Ì®Š´¼ªŠ8 íŸHzÎœñB+¢¾RˉÚtxب àÚÞ±åZr.»=3vhÍv镳#¹•{Rnω²²lÁsçÂÔV‚,%©Xç´K5élþa&'¸·kñEÒÍ\‚@r!ð;é:´ë£mYõ$TÙÓÕŽî3ÇG p·s®ÙO2'yŽT“Tl6ŒÀüZ·âÓU2eÓ8X Œí ˜N°5t~:½2’ R'Fx YÛðKÁ²2E8ŒÎ ½zÎÁE„Š‡è„˜•‰¥OXSY {ÍedÆaÊ:ˆm7­u.˜ .ÎrÉGb/96Œ ¬IÀñ8âVrÑYƒð¢2È#åt<€±¤¸ÀÝØUÛKÊyìM³«z4•;F­ù=“2ÝoEk(dœìËKÍæo.¦ri"®þ@rD`{û´Ö¨3šË)k¤‹ë¦ [ÖèÚE?p²©{ÉÊ!vNSNã#Õ“¾*}/~>aÅylŒId4g!> þJmÆHf°¯%AÀ6zª ÀdÈÝýôäJb_ì†g‚´#eÅ]8Má'ô¿Ö”ž®}I;z™K4hZ¡9MÙ`ž©,ærì 7."$–.n$AþÁ²ü#f=RHÍüÜݦÊcÓ¾#¶¥‘¾¨ -ð 뒛̖”Ãå]k;¢  |·VæÀê•©$ñH;¦ºjÒaƽÎiÌÚÚj®dÈ ôÎv;iÉ™³eE7v@UÝ”K%ùSïWêÁ*WaR¼]´öp¨†«c?dâPGÊÂùùzq”…DÐo-hq.V<‰¼ã8Ð;9Yñ¾s³rKY“ˆÅ-Ô*@ß· Æⱋŗ”iÎ…ãy¨óBÂñŸñÚóÃ’¨ˆ‹5’ä°2ˆœl®Õô$§º"…q¡ÞÏ„ó†xé›âycÁI¾['}HrìfÁR»ª;ÂÝ1“‰sŽJGb=Ú#?h·g^ÊÀUë²4 -~n]‘0DÌhÕâ’ WÎÖÐc˜«5BǸš¡}TDùE”k—†úñÙ=º·œî½ýA…5S8€1VØKM#«y™&Š±ìZÒ¹í¡·š¶ÜΕ2nå #IQ2â|Wö-Dà(×g^¥c÷*õ Ó™Æ˶™š„«Éù³HõÓäÂt Œ>íHcg:ä‘Öí3—*‰B qytð%…º|ª`Õ\ÊÌ?W”I«X(à§a&ÖÜøõ0‹OÜßíÊ5Oƒ#c¥€£r©¿åRÊ>ºn—Ôæ^q Úÿ{ú’2A ãè>çWümlÞäÆŸMÓ<:ý¦&{á%>ßxÏ|@«ßSEó L4íÀ©Z„ƾ’ñqrò‡·>Šf/Ï}2=]'s–Of¥gšGsàîÌ%c4 FŒŽúž(AÅÎy´`ë6N+ÐðL,=`°eÞg@%ÚI\c3ú¯b’p6WÈÓ v° ÜOå™(·€À#™MnààŠP%å·¿`‹ tA_ç¾`ó>È ‹2uq+D§iXBÊÚ #½È!ßÔÊ2̲E–ðßÃ8r*,"åCUquиP¾½­“2Œ“|‘a¦h—<ÒíÜøͱy5a«>gY¥ˆÄŸOb#€·RX½E‰óëyÉÅW|hð»²åñ2øÎ=Ö’ëÏ÷¥b8M¥¼}]d å­Ýœ‘ÁÝ\ˆRª"¿¢'@¦L¯(‘\¾ÿé3H§D*’ùoSp#Y®*…܇ÕH—ç»±ŸK -’Çñ8 ,Àendstream +xÚÕZ[ÛÆ~ß_¡·R€ÅpÈ¡H¶O{Icµ½õ.IFWb-‘2IíZE|Ïm†¤D;Z öAsŸ3çúÃU³þÔ,ý ÊfIºôãHÍòýU0ÛÀÌWJV3í˧n¯¾ûk¼œ©ÀÏ‚löøDK×?{·¯¯ï¿ÿ0_DQäÅþ|‘$©w÷~®¼·×oÞñðí|¡<z÷ˆ­ó0õÞÿmþëãWß?®[h_/#¼ïÓÕÏ¿³5ôãUàGY:{và«,›í¯tù±Ž¤¿»z¸ú»;…çôŒwM¼jaW,¢ÀOS힧â‰çµR¼ÙÓO…„wø¦~”·5ÒÙš–†npõÝ­ŒU°t=š¿¿»}%Çla²ÀvêÝðŽÔ{)w0ºã{<«nå¦]ù‰(v'î3} ,.s9§*:\ó2¯Æ©²·ÞÔ7¾UyŸŽ¶Õv­"A9(äPF xÜâ©IàÝÏåIБºeÆkqÿ ÑÅÔÐTeO¶Ô¤@ÍGž³¤@³)> ¸\NÞ2ÞÙ‹oì­%_…Í®ž/ð<^º:¶'nýÄÁ×m¶ö"³†AŠÇ¡wÝyùÔÜw”·‚ÖŠòÈ«š¥Ð$G¾' ÿ0o|î¼y’5Ûb8Ëí²åߺB—•,aEìéʽmmí¤\vs~ÖNj,…–ég„2 ¯&^í4PEüVÚþŒL¬-»@›nU¡gŽ]½7]™›)# ­íî=pÊ¡[ /»aVA맲Ûr붚=jì +[ Ü¡¨%Ph%ï®H»êNH©ÎH>3¦WÖ+S¶XUWA%ŠÂeè^Šmk¸áR˜Ž ¢ñˆæˆ=§)¸~oÈA!°ñÄ+r žôK ôÍ­±¼ — ÔjmÂÞ-ݹaƒäq³#óª¹çŒªm]=IɺpÆ&~®¹üF·ÜÒÚ{û€¿ Ò;k²R䮎ÁQkd¾^’Ì`ñºÈK¢ƒô¢âA’üâuÜ"UÅç:C¾ŒøÍ÷‘6БÇÞ]ÉA/[{y“ÕOöÞ¥±KúŠnÃCˆš¢y&7Õð3ÅAkÕ«è¦NïMÇ3¥°äÀ§u\Xí +žá-­’î;ÖÅb¯Ðçu±¿çñ˜Uß#.–>œ©0Ò]ƒ79ÉKpƒ!V9¢&<\M:>½§ö3¥˜Õ­¨pN¹©I¹ŸWÑغ#ïLwFÞ[çðÆq°mƒÈ5Š0U7bÏLú†™¤<ò ¤Qu%>ëÁÊÔŠ“ÐŽ4çÖ.ôòÒS”2¤Á‘/Ò¬—mgHWÎX߬=§~5IŽŒ×`ëQÑp´Î°Åÿyñ¨86…SÔÒ–€c>ÑjŸÀEÉù±±¯á-ÁÔ¡85<3Î&μoÊýœbË5*NQ°v”8£·uÕ5óX܉‘£heHÒ¢RQâë$•;þ-¬´<®+‹ƒ4[-=-jR¬Û³ kÒSÖ4¸F]óÏYÎ/L"ç¿)>ߘüãñðbnÐyÌ[¶1?atÕk8ix˜ÃÔÁ:\ø$Lj1b:;¡’yÿŒÏ¾-Æ[¥ÃÐ{[ìWÈatKØGw2Íb•ù1¼ÄñX½Úb›¶ˆß-·«šsÇ\0syO¿m© +ˆ¥¯¸Õ»†¼•rM½"Ç(ÒDG¶°D> "!g/€×$ƒäž,¶hÂÝÀªn9^ ×Ggé\,nÅÒvžÑ‰+ËGg´a¿¤-:ð—:ù¶´å¡#³¬Ö <ä0°$_Ö–,ò=pva8eÁ6+K˜fÞaÇa»å µÜD©S¥l„_Øx)=€«Öm]q#¡â+–—&~–ÆÓÿ½"‡ÿoÿN¢!{ˆbGéWE«s:eÍHúÿªIm(endstream endobj -4179 0 obj << +4314 0 obj << /Type /Page -/Contents 4180 0 R -/Resources 4178 0 R +/Contents 4315 0 R +/Resources 4313 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4192 0 R -/Annots [ 4191 0 R ] ->> endobj -4191 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [128.13 65.894 319.829 77.301] -/Subtype /Link -/A << /S /GoTo /D (passdb) >> +/Parent 4287 0 R >> endobj -4181 0 obj << -/D [4179 0 R /XYZ 85.039 786.531 null] +4316 0 obj << +/D [4314 0 R /XYZ 85.039 786.531 null] >> endobj -4178 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F36 4184 0 R /F58 3360 0 R /F41 2994 0 R /F37 4187 0 R /F66 4190 0 R >> +4313 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F41 3054 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4195 0 obj << -/Length 3150 +4319 0 obj << +/Length 2954 /Filter /FlateDecode >> stream -xÚ¥]sÛ6òÝ¿Bo¥f* ~äÍg»‰{ã‹ÕñÝôúÀP´Ä†"ŠŽãûõ·_€(‰’;“É8v±ß»”ž(ø§'©ñU˜M’4öM¨'ÅúLM–°òîL ÄL@f˜ÌÏÞübâ‰V~¦²ÉüÁ“)ßdñd¾øûx~;¿ú4…aè:K’Ô»ü8ÕÞ‡óëž¾˜Î´‡S7s}š©÷ñ·éŸó_Ϯ掄‘: ‘€¯gü©& ö×3å‡Y:y†±òu–MÖg‘ }…ò^ŸÝýËÅkÑ„wÝׄ©oÒððÂÚŒ\Ø?ŽºpßÂ¥Læ-à>Oõ ¾¤^WþWiSx½ž§òºæM¶ €L´|ê`”÷Ì0\³àÁ:oòe¹Fè²AõölœúŠè*ÜK¯kúÀ2¯ßà8oåÝåkÜú9àÎ-¦ò6|œ7óh†«›·¿Ô%J85ÓÈÈŒn~yÁâ¬~âÖ0òAv´¸÷™Žaˆ@)õæß·üb)N½o¸£#– ¯ Wˆ¢È{/ljW~Ã!mÄ›ÿÌõ«y‚¸saŽéve×çÕñ(ó~ýˆ`-áª6%ñëí1õÓ¯ô+6²…!•‰ô@e´Ò~¤BwrŸìãÓ*öS“žDha0î(©†ÅP;oZfÝl\UÍ–YÓð·­«â…'P7a¹îŒ3&N#?,§3€9Î ôcN!tŒÙÇ8ʘ!F˘w]û÷}ä·[dãFè}ü æd¼¿Ê¢?Ê“ø©ŽNóc s‚ô*?N Üòcã8?-?È(^PC -´¼ ÀB‰G´TÃ@T¥üÎŽ×z2Nô`aà_2¶˶œ\tÕ#‚åf¨üDǧ¹¹…9ÁMz•›'n¹¹‡qœ›ŒyóSÏ×vœ‹;¿ù/œ}eý.\n½zÑ·hàh4@çò"]Š—8"9[GÂN^zÚ8ç)Àn´u tD<*ôcœÏæ„xèUñœ@¸ÏÆqñ 0~¢K.++š¾­ÖµÏ›%†œëóÞò[&VâBµ„.l4sYlzcQÄÒÆ{^UµÝxÏ#ŃÇÂâªB-/Þ|œûð“¤õ]ÂpG Í’—H5E¦t@%Á¹àÓóGt¥¬(‹Üî–7e(hc1TC7·Ð‰ÀÛŽ¾”xx̘’‹ðt¸ÀXÕ~†H]*m@X±au4~àÎsW£¼Û®|̧!*1^Z8Æ °x -Üïøå²];«ƒ×‹¶é;p‡GÈV‘¾Föæh%o4soÎùg”bð@IÓŸ§ì)p‚òW²Ô— Ã’ïÈ{~ùã;†¼'÷»à¬W`­s¦{–vÒÿ ï¬ØšË./äØgVi^.mî—Ø™–MnÉCÙ UE»›n;#q”Á@’fœð#¡äÕà°K—lçäN„D¤R^×pÐ[”yâ]1Áâ»6'„Ê3ˆ!€r .´!Qw}NÅÄbv> b¯n›’÷ìˆ,ÝDvËæ…=~¹¦'ÝCBfk‹ ] -†µ«Ù¨ÂªØÔµõñ‹"g!ø4;>÷¾í¾,»© À¥<ŽP ¥¥NB¡’Ë:.áØÅ˃4%C ’˜ -· IØÇ`‰“èrð"Eõ˜»¢¡P´‹œ¸ì­«zQ'Z¹S0¯[Ôr<­Øç nû;œ cEÕ6ß’,¸áÅ,ÒÆOL¼ÃÀ1žøVQƒÄWPá#Ü5Ú8„ÍŠq²¢Å -×jíâ™Õp¡ü -Ÿb<þ@qGÖ™0*òÊ0k¾Ðe êq©åÒbq­ ‘Ò2\SVË•½0ØæÊ•,$Ù ¡‚ÑX.ñKÝ.!£¬)ÞÁëÒõG, ^èÛe‰ÂGÝ‚¤í|ÉÉõæbï/ŒJ,h3Ž‡„_—y÷v,Ì'âD Þô¹µ% y`1RlW®[|]à‘±ÂÜ ÞJéh6­ksfÀÐomý­”^gCMvŒÕ1ìÀA…„Fêí&¨Í+Vcî¡"Óô›‘€ ƒˆ:Ò|_Ü°LrÀʆa³†1Ý•…ýL0T¨ÚN 3¹…&ÓÚm÷árÁΓ<•-•ö,zW×쬡©rR‹¼Ï?‹†m¨ Øàà-© -kFy=¢‚Ü‘%ÈB´ ‡²ii\Ùy<ô²P6;-BˆŠ õ U¼àr¿]lOÝuš»)ø̱ܕ ÏX.àYWˆ(ñÉFG¡WÄ*ænrÇ oɾ›T«üy„#Ï«ÊQ« ÕBeT<¸6Ì.Z*¾H$) -`ÖEwׂ›•ì)Ï/Ö¤)Õ¶#’÷¸`ñPo0q ”u͸ k£Ìñ¾Ü'#Ý+F÷YaklBæcTõÀc„—!6M¬£Úð 6Bã2WÛÛ¾œ¢ÑcÐ\)“„ŽhŽr‚¡©zÌÀ€Cÿ#Êñ®œC¸Ã†5-ÄòûUÙìž{ ÛQ­ŸqxIò¡nÓÖbà¢mÕÎ[Zi®¶}g½ø¡Æö Q<ÕryÐ |åA¾!nIÈY¸®À×ø@ÿHé(åë0þòÀweF?äáýãÇúøAq¶kYðÝs¶ßn"ß¡«õãhТȔi8!ý,5¶=NHòÊá5-t ý4 ®Óäëê¿(ËBŒ‰øí¥hâÍõZO.[ r2 TŽ Îå®Än‰’ùqQ'Ö~סBee57H‰ù©!æ¾R¢¸ÄòœÒè¼jì4èbÍãwü¼'ç=èKØÄÖnp<çñ~€¨¿ãHÛ üæ‡ÏÛ®}pyÏ*BÆ E]•A÷üVpT¾©h+³ÍIwêìG°R#ÌÓÜç‡wÅ÷åÚ¥† >ã…ë_øõœ_ïàŒ+Ü{ñ;Œ>]ñ,ÝüjîR÷Cʯï°ÿÀ³œß̯.±…›eÞõ?©À4s¤E¸M•a‰¢‡¢°Àæ ëLIŠ4Çß>[¿´@ù;À5lÀ=ï8¹Ã Ï’®ñÞÚ½3»ù òêê‹­br(¼—ÒOØ ¹›M%¸óÃÈ€f1ËëÖe¹èšùI¼ð7Úx·®Á¾¬à‰Nœªu|øÇ=›…JÊO°ù@ùIB¾‰—º¥Øå§AƒÐBÏà‡¶¸&×`\†‚ÇLÐ ì°¸X宼 4/£´Ÿ‹Ö)F%S6ûØ—¶0A’½‹IÄ$@fâÁxßÜÂÌ@‡× ’Ø×Ƹ“¸žF éUó`¿ýwŽxù},óÏ–9¬nAŠ¸äï?¢ŠÜó Å25°‹/î‡ÂŽ<7œKG±¥ÃÀˆn cÓ}Õlû¨ô›ñ164îðÖ†¾O8ˆeQf|À7Ù†ˆA耓îË~80†©g£?€?V·ú‹™Q -ñðÈ7vMœD“ÐøQÈì{‹öÇ64 øÿ‹ë•Ïendstream +xÚÕZÝoÛÈ÷_¡G +°.w—ôÁç\Ó\Ÿk»pë=Ð"%±¡HIÇqÿúÎ×R”D;ò’À€¹ÜÙ™Ù™ßÌ,¥fü©Ybý@§³8‰|«Õl¹= fkyw¦dF03~YúùîìÍ_m4SŸéìnESîò߽˿]\ßýr3_h­=ëÏqœxo›+ïÃÅû+/”‡]Wwغ™‡‰÷Û?æÜýzöËÝh»…ñM¤q¿?Ï~ÿ#˜åÀÒ¯g¯ÓdöíÀWi:Ûž«}k´¼Wg·gÿ¨ð˜™ñª ©nÆB¥~ÚiÉ(©MÙCèVÐcDz[?ôA*ø·°6ð®Ûb—͵òZ”²„‘z +ˆboÕÌu€Ýøò¶Ùf4ȯ—MÝ·M5¡Ðסy=­ü$¸Svâdî6E[Ìaz7´×£êŸð_Ã#ÐŽ½ ;ž;îé7À[Öóˇ[~ÞC_Yçð¿a +  ÌßfK¤±!‘ŠŽ÷Ù2IžQÖøÒm¶²O%ìB­BVãïçshÇÑ0GzyzWàÎí'$X´* O4%©3àr¦Æ­‡(W9¥‡©E¥O¨xåULuN2)ï§ù„Ö+JR…Œ¥ŒvOHGúVIêÛ؈Öoû Ôù"CÒ°Ïiвƒc²©Z-«ºgÚ¹/¶ôèT‹í¦e&Â4ò–Í–ûjäú™eYfUUäSŒÙзÐÃ[Ü7íÇu;·¡×<î&øY˜@ù:‰´¹%é·¨«Ø”~ÎGÜ NŒEÐsõˆ†ûSƒÔÓŸ·!!±"$Æx‰¶ ¯hÊø–Ó*Ú@ô&?Åî²þÔTŸd„;»wÏB&[nú-ÝÞ#´„sÄE¼uÝwÓÑK+ K¤’¾q ’èGÞô¡ØâÙŽm•NìÓŒM6D‚{2~Ã7 -ÙY¢8þe·5™1NósºH¶Î³>{@#gB ,û‚§‚Õ©QíÚÁN—4”÷ˆÈ˜EzŽQ A À8MÂ,G;%ª8ñðŒ8˜“ÝG¥¨šrŒ³ÇR2bs”<Ÿ +@›rà6€€˜áŽA4zs‚;yáàÇs±×y$¶+Ù›òxßÁ0ö]ä[Šê4ú–ª '8xj県?•UÅ{/GðK‹c6 üD-ˆ*ë±èìMÇ\é(4X%‹lP®¸]J_Þì=¦ãåœÛq»ø\v=¬SçœK¸x‚KÁîk!V—”!gUù¿=¥„sBjeÄÑî Î¼0°vk$™‚Ý—UYìH)˜¢ tý„ 㶯a=”2Vê}œÅ¶óP,äI˜¸z­×㺠çf<¼ùBYïIí²Ž]rŸœgó<Òôka1?†~Zë'%ñIu¯ìªî}Ú¯¸KP@RMÞ%LN…É‹thUt¸å¦Ò±PWÍè=ã¡fÌÄÂU3'4’ñèB ²~ªH¦ÙŸ3å&M5ŽÚÄé~u¼y¿U³· °4Ûs¥±0pŒ/:T2q•p¿Ì ÿ–2݇Œß(]A§ojNÜßÌyB&dþ`O¡Ü} ëTû½Lq\L æ `t…$(*óx³G2ÄÌO­>/Ø@ÑÕs1ÞSÙŒ•¯#+94ðDG²f /äÊdÕÕyÁç7ÿ†¡k^sÝ6+§¶ø’®2¡I>ÚwüÒ9‡Ê1ç.‘OYß+¹DÉ7Þr…ª…÷,äáJ\¢ô¼÷k?\Âèäp­04–;À”~Îy]±ÉÍj@» \”£¸ˆ§M¥Â``ðVÊ9èHp;‰ó-RÁÃUùQ|Ëx¦3ŽÄ—W8‚hŽ4r?ã‚–VñQæx¥WY7%D[¬¨Ô51»ksì®à]æ^à%нx¤]‹[Þ¼{Åá.Éw=ï‘xñ9§|ÑAåo|éýµÆ^«Ì؇ó¡ÜáYm4F‰c,5~’hz™Ó+šw,ë•»"lvä~†¹\_gjÚÜÕö(ß!÷|iZÈZ£qà~Ŧ) ÚFŽØø‚° A˜Ð~ŒCŠ¥ýØèÙ×¥ß[*&õBÑâîß_½ÊÅd7Á4´b Çà¢@à"8EäÌ´Òeí³,t5{: 5.~lÝ55Üf\¼f -T;yÖü¤ëà4†ÿÃ4E \t@?WÂÏ5&c—DÒr]g˜—Ǻ§«·…û:Àc7M%#þRêL¥Ðt•~W@ÆeùÄ=+$”&‘yaâÝ€BA¾ åä»3Ê* ¼R1 }ÙX¯ø¢”zÃGÓTn"i0†l—®R”™iJ1qÓpêêÂ5á0éÇÒã¸@‚‚Š’ +qÉU#Vxðý,~Û®±T{%yÔr ‰A t'—ÒE‰ò~4'?0³)¿¾i²íÁ§TÔÕ ¸²*\í*J.>ïªá~±ü²5sµ«ñ”–bΗörCÉûюÎí³*ÕïÝῤñÃ;_,­Þi=wc˜‚Q-Ï÷¿U¹,‹Ðú.ò|.õÜZî.F‘–“Qú¢³.åå·JÐîñŸcõÔýåkŠQ¡$úå Øà+~ ¡åq*É´ôûEÙÿX@ÇПÆÉXËQ4Küþ*+‹‰³ŸŒÊ·ÅÉD<7çågLvTápy£öT õMïgZü +ê¾^_ý„€ºògDIú" +§Oè8ï!SêšyÁ"Ô„ôÓc©ö¾E¶0ú’lïk ~[ÐxkÁ?Iäî!Á´8oøÂ!vš7þ•¶ y õ§2@)úÕº8µVfQ å‡Iò’µ¦d„“ƒ’àÛÏz 0¡íP-¼êÜ6<±žs ‚ÿF3¾äendstream endobj -4194 0 obj << +4318 0 obj << /Type /Page -/Contents 4195 0 R -/Resources 4193 0 R +/Contents 4319 0 R +/Resources 4317 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4192 0 R -/Annots [ 4198 0 R 4199 0 R ] +/Parent 4287 0 R +/Annots [ 4322 0 R 4323 0 R 4324 0 R ] >> endobj -4198 0 obj << +4322 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [465.728 117.052 482.144 129.954] +/Rect [186.207 368.847 338.767 380.537] /Subtype /Link /A << /S /GoTo /D (domain-member) >> >> endobj -4199 0 obj << +4323 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [128.678 104.109 273.774 115.799] +/Rect [109.648 53.852 235.418 66.803] /Subtype /Link -/A << /S /GoTo /D (domain-member) >> +/A << /S /GoTo /D (NetworkBrowsing) >> >> endobj -4196 0 obj << -/D [4194 0 R /XYZ 85.039 786.531 null] +4324 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [256.976 53.852 498.646 66.803] +/Subtype /Link +/A << /S /GoTo /D (integrate-ms-networks) >> >> endobj -202 0 obj << -/D [4194 0 R /XYZ 85.039 532.034 null] +4320 0 obj << +/D [4318 0 R /XYZ 85.039 786.531 null] >> endobj -4197 0 obj << -/D [4194 0 R /XYZ 85.039 497.288 null] +206 0 obj << +/D [4318 0 R /XYZ 85.039 766.606 null] >> endobj -4193 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +4321 0 obj << +/D [4318 0 R /XYZ 85.039 746.277 null] +>> endobj +4317 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F64 4225 0 R /F18 4228 0 R /F65 4251 0 R /F41 3054 0 R /F58 3380 0 R /F36 4301 0 R /F37 4304 0 R /F66 4307 0 R /F77 4311 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4202 0 obj << -/Length 2494 +4327 0 obj << +/Length 2535 /Filter /FlateDecode >> stream -xÚÍZ[oã6~ϯ0údkF”D]؇©ÓÝNѤÙÄ‹Y íƒÆV¡¶”‘œ™æßï¹­ 5À^=^ý»‹û¿5¶^$B%ÁpÁR,X)…1-xûœÃª<¹|‚UÇc…«ùR”lõ–YóM™ïp±yƒ›¬~ã槪æ›]UþæÉ9¼Öð·á1;á³uÀ‚²F]òõö‘¯ -x­ÜóÆÞmCî$±gìz;LÏùþfÓ› zNÖ)KiŠÞ±FB=2Ü\³R}Ïû“ïtÃïùJËF™EŽwåÊO—gšŽ˜R¹ô…'gì²ÃšBi©IzR„^Єkrã¾<éE"Q‰S Á $^†„Î@ú7¶F³32P•ÌIõÄ×YSì˜Æíæþú½¦,#ºùž´ W­]4²•wjÈI©_°­B»ùƒtu˜ 6JB‘Â<]ÔZ˜ij hŽZ—À–Ú¾ÄQjm‰›ª®óÝ™)س=î*å8ÏçgmóÌëÏHY^sßCuÔ=¿yÊkh¤Ýktó~áÎ0úšÉxóàrŠf‹D†nš;Œƒf š¥Ù!°£¹'qœfK"XpS4g³o“%2ž}UvfÆ¡‹‡ë]vÊùîÝ^u|=#§ˆd?愾qðçì9'iµ­ì/8„i&0qk-ÜU|ó`-Ý ÝKï‰K§}ã¾J`_ýÁÓù¾Ö.sobʃñÜŠÐ÷d”§„D“ÉJtI:ÂG«¶0~¤fø0èµw˜‚áÞ³þóx2íah[üï íù m$裨wÂi•fÇßE7ýµ^,¼Ð^Ú€R q¯§7ï¥é½+c!£È½w;ŒcïjÐìÞuìönOâ¸Â,‰7Õ)+´MÆda¦É€æŒÉ%°5¦¾ÄQc²%þkÉЗB¹‰5­™%uRTGé…¬qB[Yõú1HC`Ç]¦[˜iz hŽ`—À–â¾ÄQ’m‰Ã"Ê—?S2J·›‰DÆg.ÉüøØ [Õh -Íä%|NOá‘ÒSxü‘!´°k‚°:óý<& ‚ª- HŽoüÚe(ž†tR€‡r”Zåuó7xU&­HÒºÔcñmIrá¦6¹j‘/¶Ÿ!»xÉ0íÀ6òßÍO7°å#hHuÑZtfÍKçàwè©Ø„aŒ¶áE=:PÄÑ_[B\¶©+÷Ù†…qئÍÚ¦C`g›=‰ã¶iIÄD¼ËÀux!‚°å@LóÇ#~$"å®-Œƒ šeÄ!°c¤'qœKâWĘÇ7ã¾Îù‰‰ÒY1¢wÆð‰F”ÑN=Ž–hVü4J¹« 3MœÍçØ×—8Jœ-ñ}Ùœa/[”Eú L¥zïBÃ0ºrûžNûMNÄù2¼÷ÝÆNG¹XÍ÷È4H!IÎðdå;îâs$xSÅ ï¹;“¼ÓÐÆÀ³ªLhÌ»0jÜ&åø:W‰HÝRqhœ1³ -Ÿ–ÖéûRܸº;q÷hëä¦BR#Ù«ÒÙ«ò).ä6çëÔ|…\´¢â©fô1ïlãÈÓaðk¾OŒ¥C|nøje;œŸ+ŸÃ5ÃIélß´õœ;kšHó¬sÿ@³c :¯4¦¢£¥u>¤M©æ2Ô zŒªÞ·ßÁ¬"Â.l¬lê¢N8Ј¯/úX£g_œ‹ÜùñÉ—‰ð#wêeaªA³&êØÙhO⸑Zÿ¿%¼ŒáóGÔ™¶° -å©Ñ¶hc22Q“ãÐ[ŒÃw~9Žu‚(¼° ˆQ/ˆT)ä0õD(a„«`N^+Êà)ùì­Ò€=ODŠÅ§…„ÁÓ4`ˆuOsïÖD ×ïOrqSÁ$Ö<õ°kk\Vvb+ÛOEƒúƒP(™˜\f%Y©Fã~¡¹îýò<®úà#yÃk;]ßÑÕÊÔñfë8§”xêeN-Í öfÍõÐç¬Üå{n(§ʼnì!û*šõXÀ©3Ê„1’úqÿ¥Í.Ýôœ±rð'Á3Ãg6ÒÏyM3ŹĊü*^1\õ´é§xÒ’£tæŠA¯-øPKý1)pÔm†‰Ó¼%uàŸ:Hv±B’DÄ`N–Èá—qÏ+H¥H.f¥ÝÂà3›|%'í–Ý“81gªo†vJùZN%RDa2R•–¤òEáïSbNøS Yw˜‘¦ÐéJ3ŠÜ]|›Ä°‡œá‘I¡y6ü°×§í¯–:Åj­¢ÊÑv7PX(–‰²ÊFô·8ŒmÓøÌÅc¬ºOg&Ä2² â5Ö¢]hs»ö¨OÆÑ » ƒÒå±u$©%ZÞßàÓÆ h †A²<½îžu£n¹(~­½ö¶Uï1k™Ü3ÎÌáCëÀº4 -_ÅŸ aÿˆ?ѵEσ쪒O ^ÎÍ Î‡©Â@ ¾!´`ü;Y¬ñ½ô›ãasüã1üçõ}Óï º“9Hg“‰tB™DqÕ²>˘ßKi5ãÿ»X¡ûendstream +xÚÕZ[oÛÆ~÷¯ΓX4—»¼8Ž&.|;‘Š éMÑ2JTHÊ©€þøÎm)Rbœ }q`À\ÎÎîÎÎÎÎ|3”¹ð§F‘ï¸:…QàøZÒÕ‰;ZBÏ»%îÈ8nàc×›ùÉÙÏ~0R®»ñhþH,óÅïã‹÷ç÷ó·&S­õØw&Ó0ŒÆ—w5¾9¿ºeòÅdªÆHºcëÃÄ‹Æwד?æ¿œ¼w–›Ç×û|òûîh"ýrâ::ŽF_ í:*ŽG«ãkÇ7ZÞ‹“ÙÉÿÚY¸ÏŒxÔÀ®¦–cª]'ŠÌ +ÀíÖØúGW…‡›ðãû<ðpRìêΩü!u–k˜Ö€®–Û*‡ÇzÉ:¼™ñó7".JÔá—ifœy¶FBÃ<+Ôr’"å)_†„š;›’=L¦^8ÎRì*W/ËU#xÅl5á«j÷:‚Ç 5iÏBzþ$Ãa­²(X¸ÜŠ¾jE´ç¼Î˵’T2ªÊ>o%¯²EWDƒìÕ3Þ`l5[ëk"þóì&;TJýÓá)µ›À„Â×lIƒš)åHÊG~>$užò6ç÷gW÷¢QRÈ ½àÁàiZEµVÑúð_Y}bƒs¾ª.xºpã^™ºª*KÞÖ¢5ö|¹Ö]óÄ<ÈÞ3°Šû«²È¸õÑõ]”<_ÔYXç4ž/Ë×Y +µÙ1cOB_9ÚDÂ÷_žs[“xÈÓ«o¨:z]ª¾Í²!±–ÉÔ¸Þøº\¢Š«Ñri_Ê€åB+irîòH—¤m2±4Cªÿ†dÍÝÎ…7ÙæÙÿïy–÷ä¨pdRq'²®Ë† x3x§IQìxØ¢œ’ï‚£Ð÷Ç´ñtž¯h•¾·;Å®¬%Ûa˳”ÔÄ]âšØ®¬I­bÇ3n’ªÁ’wÍ7¤‹ŒØE[;ÛaÊŸt,ó$õŠÄM£=×<‚¬Ù#‡M‹“Z™Tà[Rl¼Þ¶jzÙ}6|]6ø¡LVmd¹Gí—hp…Üè® bØaTãë¢}G˜íØÀ* NÓÞïé^¢æd.;æÄsNè’ùæܯÖu÷¸£‚0dÀ³!Øps8˜1Ó‚î”…èy‰üQisÑ…M@{,¥“b'<°¬uèåþÃ#PÏÔ`X5d‹Ç÷Ѹ¸rÆ,UiV¶nÝëþõ£4®˜WvqïÑ0vˆ¨Ü«òú!@ð ã?ÂXÞ:XŽ äD•ÿZ·‡ +o×Ùþœ &ÍŽ¼*ÿâGþ(ÏFž2yD0$…>: èc/o£Sd© +ð¹Owµè åŽÙ³~`oÏ/Ö†pÊŠ‘µEÈ2GY-H}Ë>n^tPüÖZhV-«_7Ü“·û©QyFÌß0­Wæ.Ϭ±*Ðg óAB²lUÕ½K¤)oÍDìþíÄêgX1JE$âTÇŽëëîŽ2OJŒ0ó`ûß‘ç*À Å¡<Í »£¯ÏC£\˜‡[–½?ïh·Êqµiµ Ǩ”átÑ_I×Mi u÷cÇšaôy³™8ÖÜÛi“¤ûAD8»Z©Ñe "öR2=?i º·?ühLrkÆh ¸ æ÷Ö" =ƒæn;ÁÑ܆ôxç>ñˆ Á²àÀš·“"¯ @mÀhpgZŠ3Yð(@… x;+$‹Þ.†k^7C`ƇM 1IžBEÂg„/}ábq'Ïû4 XÌH'ǪÂ؉aq+œwUK9¿ï^8™ ’fÓPf‹x攳¤ —%…Ž2ä’½â'Øo²=Fžâg\'Ël*Å £µßÇõìÓš#¦üÀ‰ •ëlçðŠzN¨¼®»Ú—˜Ò¡²Àd½ÇþS-y¨%=¨%ŸDæ!³]ÝHÊBCNñ¡Ï»~«á~†yŠ†{(vdÀxÃÞ÷»Ô‘>%˜à°DUÍK"FCqš§œIaxK·öˆlII{ŽòLïß—-Ì"f°[LÉ´B<ÄÝ6˜y<®ä¥ÍÌ°íc¬¶œ4-!qÓ)åhf)ä8Šcèî"Y=ÈÛýå…ôÖ̽ڦO]Šâ¤ñøþö.$Õ½Øök^«ZGÅ,›"Ï:;ôŸºA/-×¼c:Ž¯„+8q„qµ½¥!\œ·\j¢"7­y0ñe?ûGŽ¡8æÑGh¼­‡J:›žz1? Úû‚í[”‚>x_£gyw‡¾ÅÜză_lò§F @ij©;ÌÙÀg)/0i{rö¶ä{¾ý pü*¤¥lêõHÎ&•{û›eØí%’Éùí=…°ûNJ…­„÷ž $ 0ì@Bª„á¿d<üEŸ¢<’SwåT:rJ˜§ç‘þÐýöendstream endobj -4201 0 obj << +4326 0 obj << /Type /Page -/Contents 4202 0 R -/Resources 4200 0 R +/Contents 4327 0 R +/Resources 4325 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4192 0 R -/Annots [ 4204 0 R 4205 0 R 4206 0 R 4207 0 R 4208 0 R ] ->> endobj -4204 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [411.818 654.091 501.976 666.992] -/Subtype /Link -/A << /S /GoTo /D (NetworkBrowsing) >> ->> endobj -4205 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 640.541 308.036 653.443] -/Subtype /Link -/A << /S /GoTo /D (integrate-ms-networks) >> +/Parent 4287 0 R +/Annots [ 4329 0 R 4330 0 R 4331 0 R ] >> endobj -4206 0 obj << +4329 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [296.274 117.852 389.789 129.541] +/Rect [326.511 355.76 500.027 367.449] /Subtype /Link /A << /S /GoTo /D (ProfileMgmt) >> >> endobj -4207 0 obj << +4330 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [410.326 117.852 482.144 129.541] +/Rect [146.561 342.211 171.645 353.9] /Subtype /Link -/A << /S /GoTo /D (PolicyMgmt) >> +/A << /S /GoTo /D (ProfileMgmt) >> >> endobj -4208 0 obj << +4331 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [128.678 104.303 153.762 115.992] +/Rect [191.592 342.211 377.966 353.9] /Subtype /Link /A << /S /GoTo /D (PolicyMgmt) >> >> endobj -4203 0 obj << -/D [4201 0 R /XYZ 85.039 786.531 null] +4328 0 obj << +/D [4326 0 R /XYZ 85.039 786.531 null] >> endobj -4200 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +4325 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R /F65 4251 0 R /F35 3036 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4211 0 obj << -/Length 3513 -/Filter /FlateDecode ->> -stream -xÚ¥Ks›Húî_¡Û ªˆÐ@ó˜›c'³ÙJoì­9ÌÌ–Ø`¡ÿý~¯†F`û°å*«ÝßûjåÁŸZ%Úõ‚t'‘«µÊ/¼Õv~»P±óáþâý'­”ç¦^ººÎI=W§Ñê¾øùúÇåíýÇïëMŽv×›8Nœëokå|½ü|ÃËWërpéæGß×~â|û²þëþŸï,$U ÿ½øã/oU²ÿ¼ðÜ MVO0ö\•¦«Ç‹P®™×wÿÎâ½pÅO-Ñ«ƒÄÕI0'X邵v£0&‚/™¦ëæiÉ* ë`‘ÙÖ~êômS×°SâRËÛUÇ¿™€ß}ýðþêó§;žu úySÊýŽÈú__┯]Ï«Ò@ˆ¶PY´)O¹¡˜c¶?=Ÿ_¦¼ÈMtòÚmäüº +•òÝ@ùöu߉æ²°ÃQ_¶ð* úPÈ €Mf -³ *æ•€V==[Ö8÷œŒÖ}'ãmSVx|…ÂI@8p -ÈÙŒËzÚ#V·Íi·çSnèŠþÃçow ´¥}B''Áw½¹¨C–'6 -•.%Òž”A6AÌxáïwžyLP™µÐ<ðïO -VòB[î*æQK:Q5æZLÕïIgìã£ÔùšUuW7=ï|@ôsÆŸjrÔ7€ø÷õ­9„‰Eèw Ôõ¨2þ„ÎïþùÆ(2a=Ud¸*v&+| Nh?Už1qï^ ~Âf%—\ó>ëî^æ}eTƒ P‘ZbzÞ7íóšD«^°ž(Vn¯šó²ý · èµ  :¿qÑ„ìoI™I”UQý0fÇQòøæãý—o¿‘÷å…n°¤ŸU.@héuÉêú7"”0þЖåÒrR@ÚB•ÅßÁÈ|‚LÖó¯=:yt¢Ãu±CfŠˆ<"Äc™+"^z¡s$. ZƒyS“6A0ŠtìÜïËN, A«C^ŸŠµÌõÀ+É_Ñ=#Ü—f×ÐpTib—r@IC8µ—§nʾ6ÀጽïO/L³z¨»2?µ¨Ë=Rÿl”e@öB^ljn•qLå;f -cDK’ßèØZÈÕˆVIŽæ5SQ±«¢×#óŠ©Л¦òÊ…£©œÝ¸l*Ö3SA6dIQ[ñ& ›º² Áî·’è£ëÇ<žë%œ|Z'!;®8rîÀyÃ=ÛŒ§ä/á÷ØÊõpTAžÌÆ£†âJe<;˜Kf´†ÓˆXó8랧'ç’{ U¸;µæ)0ÎG$-G}Ú †aȼ”#xž'5°4Ä̳„¶ˆÄS×/¨ðqÂjÛ&{ÁÁÄ#ä‘Ķpò´gUTÃ%T ÅÓ\H¬Ç1"‹FÙ1øùc#=^ѲºêM¸„GÈ "`OQJNžwÈK‰SdCâ -ИŽY ›ý˜ö3<;cö‘¶15®Á‡'öˆò8F  ÃйDŸU[¨u€“Nç?GgÈùH‰"ƒ¦­yné ZÌN˜ÞY Þ’â"“D! | 'NCò&¼kú!­“‰%i5ÄÙ,&wÌ#$†‘8ß:õDéŸì^ï?Ñ*vÓ-ß Ÿ› ÜT3ž>ÃLüCèÆö;!—•vî¨Ã<; éæyh½%§ÊX#rϼlRNDzžr²ÿ!‚«t–T…ÜXgÕ#m®°Iâjwä€H¸B}Éy‘$¬^$ZŠËý£/®-2:ô”Q²ŽÁ*ÊdžÍq80Ä£dk–?Àe# °áÎ^hd€©º¥FšÈÞI‡úy6_W½§ä¸iìèØÓqMÎ, b;zÒ3ÒmHÞ·ìfŸ$6v E»ƒ!*ÑO6g¼{z1€íZ¼˜kæpD‡rcºt³`U×ÔYÑÃíNhV‡oœƒÒ£v$T:À?xBl¢UË™ëHwM.…É]Åk!4å_‰/¦ œ¼Oì—ëªëy„.Žï -$úðøißÔfXI†äCPˆ`’ñU@ -¢f>¹ Lø0•Æ À¿®D;^xªÈ“ñd v}|àgyAÉ>/’¯g• ,k~x¢0Ô‚•ý&rýfÁOæàZŽhKΩÆ:ƒpÁ «›'Œrs,¸,L-P’¥U‡±øÍ -;ªÎ0fu=?3†|ÞrºùÐ؃ {`q{V·n¸’ljÊ Zn4Õ}! #ÏU¾~5´`(/óa7t!œZ •§8 -‰IÚ 0I S8ò5âj‚(v®(PsáÛ P¢ÈÙð¦4gGÔY\W˹I—Kä¨ð1X¼AÅób[(H}7‘:ìž”BÇŽxÖvdßSwyäE"QKê6šÅÍÃŽËD, 6~T¼5M1ò6¯¯xL&ø¥ä@)ñ)Êv@ƒkmR'=RêKžÐôapù0|):;ÖÑUK‰Árz#B¾$É‚1²K˜AL 6ÿÀ«ÆQáXªSŒÌÄ\ê¸Í‘ñô–È0.È[ò rÅ—NÏŒ~1àƒÎ™Æ„I™¾^q -;Duà­v·âÁwKy ôÆŸkÏù™È²C§»#‘œ0„PAAf3aó-&hWó*q£8Z‘Ó/ÔP ³±€j¨³“8Mâü%p£ ¦:ÈKSËÀ;QÙ”Kµy”œ[Ê®nÏnQz¡“m5dÝTcåßÇšs S“erÒù±Úò²³~)ðY'Ào GÇé"GdcÁ ÎkföC…N6Aþ[„䇶d#9ë:0ᬘ‰)òÝø ¤ Ì «©˜¢Äõà V÷ûJºÆþ(ˆÿ¤û—™¾äXbŒ6c}çY‘Ñ!\Îóæ4´ `b(ð£iK¢¥ƒs‘–Eyì³-%1| ÷#êÓ˜~’Jií¦~2Qp6ŠÄ# O”QxgÜèû•s{X ‰Wy1°}Ñö¸Ö¨‘ÝSñŽ;¶=‹«ãj7i`«.²cžu^1¨ q=°Ï” PdˆÒ:¿ìFzú_xMö™‰8é1õȸ‘ F— -Rl€+ʇìTSû‡mME®Â7g²Y7H:^âŒ-»üÝj ˆ #ŽöïpNy`Db-½ÍZP[ì $ÎÖ=æ?<ÍÏÞp‰¹°Ð¸}ÕIaŠÝ‹ýˆiNýÌGÕÍ®âôžzpé¾á#ýBKÚ Æz´äù—k|ú»ÍžÏ; ¹,â‘×Õ[Þ34ý|cΆ@ãqVhõê«í‰Z -/¡¨ Àõ¸Ee£)Çdƒ#ÇB Ÿ'NÓæ„Oúé]‰_=P[T\(@Ä«o®(y–ãH€3}[¡ížúÁ횶"Wl…¨ËÁµ#Åu1Gak -WœŒ’*Ü<¶ïA*™èW=¶ó¢Ç60È/SÙeOÆa²ËÛ5uEÏáVNÛ#çûxjø*vf†Þħø‡I2ÁOâ¨>ë%‰Ÿœ»ºô€}RCI[ -ŽögY¿ã18p~% -¨lyŒÿ -Þ¥K+ Ec|¡ðÇ“}öŽ8ïèá%ÇeïF¥1%û¶FJïzƒzÅê€ê{x”RÇcÏkƒcn³¢Ø¡§} ì°E¼Ÿœ$PXBÿ‘ -Ó3÷9{Æ¢Pì–ü9Øk©ÖÅmº ¡9»EâZ -i;Þ°˜|ì†ÊCÙ~AeÒ(œÔÉ”IÈÛ‚¡ïŒW¹©Ó´ýÔ‰'ƒRÌ¥/YØ(}(½XúK/ÏÕ Þrë;Œƒu†¡Ëìy’ 5ràw)]#8Þ6^Vé% ,>}ã+t\?ï,H¾ð† ‡N3Í&xJ!D¡«be7—ÆŽp(}ºNš»z©]ÅÚ&sþö½ÁðºKv8|ΤRÏ´‘ÄÑvA0(E³†ûÜ37RÈG½”~uZ˜ -kø©:ñÆ×*o›®yiÞ> +stream +xÚ½]oœHòÝ¿´#eÚ4Ý|EÚ;ön²Jœœ3Ò=$y`€sa`{-Ý¿úh°ãÝH'?LS]]]U]ß––Ò +=á¨È +B_xJZÉî̱¶°óû™4Ž¥…ã{¸u¹:;ÿÍó-éˆÈ‰¬Õ†PVéûÍÛ‹O«ëÛÅR)e{b± ‚оú¸ö‡‹w7 ~³XJA7+\Ý.ÜÐþø~ñmõÇÙõjpÝR í+¼ï?g_¾9V +,ýqæ…Ö¬!£ÈÚiO O+ó]œ}>ûgO…÷´Å§f¤ZvKåˆ0Ô½xÒ›/Nï‘Û¬nsà¿Aö³ÅR;®·üUlð[Úqƒ¿Ênï ÂUµ‹ó’׌ í6«tYWHù Aç¿)ß +D ®ëÁÃhK‰È‹ˆÅ8#>µ” ¢ôHð¾'íÕܘ–’øÐdt_ݳø©F©v¸×°zì9'nÞT%rÛÖUÀ‚¨ÏÖÒ=º¾o-%ꕹh+8æ:v‚xx"Îwo¤¬i/‰¯ýbé6QMò¯ŽÔ £Ý¨½|÷ñ3ðH¼Ë˜V{· ÎÓ…äãÀfd·D#k ÅhÍí ã.zAQJÙâ¦5¢Ñ~÷FüÒ¸rË&‹ÐN`os6ÒßÉJëªf”D¨êï[T{…ä°ØãëùÚ~ØO₱w#Ûñíõ˜/smwG{·0VÚ + V¨¡Ów ?>òCÒ–*âÅ ”3’®‰ë8M _˼©Š¸ÍRð÷0²›ÃoÈPø öVâ*4>ð?6x9A-aööd`øDPµGq»Úð/Y1¢07(ÀCc@EÞ´¼2¯eø`Åàšü¿«¢ƒäi6”ÕãPgÀž¹(;l¯)x-­äÔJ;)òŒ]¦a]ˆš/ +°V×8Wœ´ýVnè)¬†Øœ<‰&:ááˆä€™—)nËéåu–¡Kí¯y챫>t®¦”î5߇1}¬l_q ó†ã8e½#üþ¶ô\p´¢1ÆdƒQªÇb™ œ"FÞXU %Ù…vkssoŸb&A>t•7ŸAKBù²O.€µPÚ¦ O(0 О}E÷ï&Â(?€T(Ñ¥P& ¥óíÿòÖõŸ1¢îɵ*1ŠmuÜæì†'¬º"ˆž`TyBJù|n[‘y× {]{~§w£æ=I +øM8FšÍ˜rc¹eb1£ Ü$ç-ßþ ‚­¬cÆü›Woxo…¿˜8õ€“fuÏ™2î´×'âšâ9‚¡Pvl±7Í0»ÑU¥Éµc |¾Ù­øäf.ßz"”¡Q ú¿ÖöEÉfE÷ýI êÇfîòC¡CÏÐxî®HhO¼Þö!H7mÙI0˜?{Â:‰ cë.»"tCѽL{Ç<±+¥¥®ìôÄ;õÖâÅíïÏØÔõD~º¬ñô/®va90à§éN<’”xP-.Áw¦j  ŽâªQTjR5âó‹(rç¼I*) ¤²–ðˆqúûwÔòúT0ߣÃ/ÔK³C?[‹.îUh›“p¹>VW½§NLæ„ éB`SjÌǤ–V¸Æ `A¼QÇV!œáõ˶¨Öqñmšd!¯ó +,Ùs=»$—ÆÕ¯üsyýþúöÝÅÍÕLrz ª:ìG'>¼»º¾¸]½9°›&]3Ú:N¾gè ƒ£mº†šiæ`Ç^‘ÝgÅèˆRs÷ÔÙ&«ëÌPßaeYŽ=B}:ÑDW+¾ìŒ¹«¨¨RüKgš,9Ôyû8B=˜Fd¾`ñ«mU6/bj[™3û¶9AaNËyzæJœGdVŒñËÍ )‡4fHx°ß…Ü}]mò‚™>¡Cá=x!_ÜÉ®¡œ—>­óû±A¿}=}øÁ»êè?­.$¯zßu˜#Z^ ÜÀý¸z$îœâ½RxÈK£{£8_CÐ ŸR\“Ôù¾iŽvE²K;ºp€…ˆ"´ÿmÖí&H?ç÷q}^äësðöu|Þ>LM+©Êâñ†ÿneÞÛÁ‰²Ó]^ÎqßYåßá~hÑ'GŸa¿¬¦Ò&€ßq±äûè€ã;Î\xÈ¡›h«úñ©c¥oȼ¼r± ðŸ*·!UËŸ›!½û’Z[š¾·Ê9§"°ÚS‰K¿›;nzʧŠ(©“ÅÿõS_à _ù¼õÌh«Î†u+]ÇÞ°WŠÈÔGÅ ËœT.K×q…ÄJIÃ{ø³3Å. ;¨ g˜£ÄÄÚ{¤5Uñ ¶ ÕzÒ®:a$R"Ðþ¼jºþkÀ~Äuõ±5ï:X :¦.Ú5³>D£ÄI+n¹aï8F!pÂåÕÞD‘áDvC}ÒîØKAŒã¡ÍËöm¼6性îÐÅÅÁxü2€âÕ ‡~LµŸÖTäáO×`¿÷Ûk°£B)<©ŽÝÉ~á¡G4)ôò:Ô¦B2$®ö"»Hã½)œN”*}àNyÇž)4û2óU*hq;†šöÌo7ËÑ£LtÏSŽûœšÃ†)¤Ù&FEkæ‘`}Z³ÊTýƬãrÑ›zn`ô&<¹<ÐEiWF›!¬ûy#úE|(ºAÇq2Qá’g}Ý’Ð:âÔø¢¿¥7 3÷ÐvÆΙ'y !´.fÈ¿&7K—†ŠÝÐZIÉ3)9Ê%Ø:|7FŠÐnbënà‹sð{n¯þÕñœË+šè7°– ÍÍn·°¨îÈ´Q7Ò3;rA™HIóyNµ+‚‰ÉåÉ€çŽv[MN1Ð_ßz"‰¸Â‹~œB$˜½³K!ýdéCä8v8*°8… †Ðû¾ŠÈ÷y>O²Ã–ø9ËNÅp°Óéé„1¤Ûÿûå.ÞSÁ¯À=¤óŠ9‚#¦°ÓM,n²;&Œ›¡}I³3Ï›”ÓqL3i!’ÁL3:ÇË´G—:*T(šO$yéC¶ +ç7 ÿÜ„´ x}> endobj -4214 0 obj << +4337 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [485.279 376.196 539.579 387.886] +/Rect [425.164 585.483 486.399 597.172] /Subtype /Link /A << /S /GoTo /D (pdc-example) >> >> endobj -4215 0 obj << +4340 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 364.768 109.672 374.215] +/Rect [217.861 170.209 279.096 181.899] /Subtype /Link /A << /S /GoTo /D (pdc-example) >> >> endobj -4216 0 obj << +4341 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [522.435 102.224 539.579 113.913] +/Rect [109.648 51.074 235.418 64.026] /Subtype /Link -/A << /S /GoTo /D (passdb) >> +/A << /S /GoTo /D (NetworkBrowsing) >> >> endobj -4217 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 88.674 313.187 100.364] -/Subtype /Link -/A << /S /GoTo /D (passdb) >> +4335 0 obj << +/D [4333 0 R /XYZ 85.039 786.531 null] >> endobj -4218 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [128.13 64.578 276.157 75.986] -/Subtype /Link -/A << /S /GoTo /D (NetworkBrowsing) >> +210 0 obj << +/D [4333 0 R /XYZ 85.039 669.412 null] >> endobj -4212 0 obj << -/D [4210 0 R /XYZ 85.039 786.531 null] +4336 0 obj << +/D [4333 0 R /XYZ 85.039 626.458 null] >> endobj -206 0 obj << -/D [4210 0 R /XYZ 85.039 460.125 null] +4338 0 obj << +/D [4333 0 R /XYZ 85.039 571.885 null] >> endobj -4213 0 obj << -/D [4210 0 R /XYZ 85.039 417.172 null] +4339 0 obj << +/D [4333 0 R /XYZ 282.599 577.858 null] >> endobj -4209 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F36 4184 0 R /F20 2961 0 R /F58 3360 0 R /F37 4187 0 R /F66 4190 0 R >> +4332 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F36 4301 0 R /F20 3021 0 R /F35 3036 0 R /F58 3380 0 R /F41 3054 0 R /F59 3455 0 R /F37 4304 0 R /F66 4307 0 R /F77 4311 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4222 0 obj << -/Length 2317 +4344 0 obj << +/Length 3039 /Filter /FlateDecode >> stream -xÚ­Y[oÛ¸~ϯðËbe VD‘º-pºmÚ¦H“œÔ8/Ý>0¶l ‘%IN6ÿ~çBʺ%Ýb-`‘Î ‡3ßÌ0bæÁ?1‹דÉ,ŠC7b¶ÚŸy³-¬|<†baHšß—gç‚p&<7ñ’ÙrÓòI<7HÂÙrýÍy÷éííòân¾R:;_DQ켿™ çËÛËkž~7_§®—øu7÷cçæjþ}ùùìbÙªÐQRH‰ -üÿìÛwo¶e?Ÿy®LâÙ|{®H’ÙþLÒ ”4ãüìëÙ[^¼¦f¼kê¼–bá{näûcqQqr NŽÄy³…p“ÄŸ’$üÈU^ –uƒ(ìR [Ý|á»JE°%]_.CË°T–oãâO°²Þ£•ð•§x -îEº0¿ mcØÛ4ÖÆÐü@›'Ô¦ÞÏýȹGÑ+T©,àkÃ>±)+þ¸Ÿ/€(Åõ –‹-OkÖü¦Þ¿ª­„pEL©=¾hCûºú‰p=¶o€ #í¿móòÍ™GùtÉè ­iƒ‹YY³¢…Þcÿ‡ðûÅÕÜ]âÉÞ^¿Ÿàñ„PVÛª<ÎñÆh£Ùÿåò=î{7¥³ü4±ý ëz}o­Š®ÐÜȔ̉Ö^÷xæknQãªÞ¿áÉí1­›.û€¸Ûƒåé#qÌ{§“rJ¡ -˜“èýÀ™*5Z_êº1+]ÍžIF=Át]îuV?»9/Á»bg¥ó–noÒ)¸2Ť¦•Õ±Bÿlô¹g‹£5)pïN‹Uõ| ´ ?Y‹ú ï«D­ëlj#c䰯ܖÅ·¶¶b&"šµО€È8…CºarõÍþ3U/h¤Ði©~¹žà#"×ä‰Ïº2´$äAåžP9ŸaÀO*ÈâïóûåH†XˆXºÊW/Ùc^š=/hC9Ÿ~{Ý;T—Ü:}Ù˜¤ Oþ”1wå>5.ÅZU|!!)ð‹CõŒ1¼¡ÀøûLž²½§¢KâCö=ET/ª^Y4ÈM“ˆH8.Qì×Öà6½„ù|+,œ4Öé¿Oâa«»÷óÇy8ŸçÙýy­9'aœ†³ô1¯*Õ´Êe>÷Üâå {ª²Æ¸BžÕM/4‹¹Ÿ8^ï³bê'³æö¸õ¿rÌQPýÔYÑöåÄ®UE*’2&ó|è©æ…ž7ëeºô†0ЀêÞ0hÍæEÌ`¢V”¸¦Œ¦Ê4.TjâŸÕ‘‹B œZzn“åQ”¸,-¤’®žÊ ßΖ†Jµâ‘LÀ…ÑÞ^y>†PøHŠ PYPÂ2Ù©W¿y1 #|\¿š‘†ƒjRBÉ+z*.wx±žÉYU8”< 4qåb× H@Ú „c‚߃í9 -lÞQÑô)áÝԊ笗ÓéMõÊâɳ| y`õÑ•A),Ã$$hŒæÇŒ¢¤Ø›Ò ¦(z§>¸8£bÍ$r噲ݿɊmÍÄÍN›m»4?˜¹’7z•åTChÂà±Ê³´+«EÌÄ)§Â¸¢(Ë8×Ã6Ý–v=‰Ö‡@ð8àP ¥<‡a†¼æJÁõ`Ó@yÁ0WÀrU²vU™óŸ¡ÉZ„b¦–yÊ•MÊ#ÀWÜ}*sx~¯ ½M9mÚÓ#ó M¾k£×¶¼Âæ2”ÎmÞJ™Â²­íØìð»³ð¤»åÏÖÌf«e'Ïl¶â™v{ÝIðÍñhÓ™Ñl—ü:/ñ:nth^Ä Kƒ'¼¾X^Ý Ð7Ø^‡‘ó•‹±"j"b€.Ô×T±4#]úetxRø=e! Z-@1V*ðÙ.; CB ©¦ò¹æͤ«Ž#TÔpñ2dnvSÕ Äë¶âÒÔ.ò¬øÔà„©•)î£~aÂA¾G‰÷×i» .œŠwp<åC¶ËjŒIý6­Žì,çYYØó 7T užóÇ—lU•u¹ixh+züîD[Þm ¬÷£—fŸz¬M¼NG¼í8ÏhzªÎ¨Á©2jShð¦CŠ 8M›Ýé°GÓ³ÞR'›g+“ÄûUŒ ¼ëå»ö!i¶ø6p{skâ “iCþÔöd¹iÞx%h•¢æ.b÷AØ[ lv';.d¤Ì;Ä~O'‡qà b™#ï( 8g@l=c>˜0΃"eËSw c~Ñ€[£2Gc}jCIjHp›„îÒFIfäó¯r´Ñ Xw"$£ð€%tÂÉCÙk»pίCì`/á—H ßò_…¯É‹èeHP·Û»›—W ñÂ@—­Î{Ð*WAKñŠ–d¨Æ IÜDÄ]=8”U"8¥åØ•6²hDé! - a·ï§µ5ßïeÒÏõ‹oŽãÄWÎEû °3â†Ü¨‚ogžÜ‘;ÚNµÐŒpAä†^øã[™RLgFœ¨8’ʆ‡åÆ®g,^! ·˜Ç™8 ÑŠv씵Ë+öÌ,Ƈ€É6ŒpvL¦ )i¡ïÉ5×¼j3qO]¸™©—F~¡Ô}©¨´0À7=MÎÿ̦ùQÑéÍL߃x„Û8„ÜJ勇—Z dúá|` ©Øùß øÊS„lÔõÑ>Ä*zˆ¢£!ͯmÞꆯ›Qäúâ& ÝdêizØÁH~d™ê_,¯E‡Ù8B*ñ[‰ÔfvÊϹàeuEè¯ìr2Œ]«^Ê¡H²ðy‚ÎÎ3/®dEëú”êÖLÉÀé£÷Õ<ÓQNeŸìË1¥ ˜Ž%—<䟯[4 ؈g­"Ty4Œá&ñEöÉÒ¾©ÒÊ.x—› 5/p*[ÃÂHamæ Nà7}lÓïÂdTà)ÃÐsn6Lµ*¢‘òB61a lüÁ'Åæ˜3=åW+Jc µÏ¦$ÜdEÜ6zuÀIrm¤4±cBã…ßò`j¨üÔů ®l'1‘_l? í5ÿ©gܾ)ÿ¬}·ÕR±›Ä/8àtBh”Ácr¨p cÈwrBã¿"›endstream +xÚ¥ZmoÛ8þž_aÜ—“Z+Š¤^¸i“v³H“\›;à°»[Žu•-¯$'à~üÍõb+í¢EH"‡äp8óÌÃqÕ,€j–X?Ðé,N"ßj5[nÏ‚Ù#ô|8S"ÌŒD»ÞÞŸýôÞF3øiÎî×$r¿úÕ{÷óùÝýå§ùBkíY¾ˆãÄ»¸+ïãùÕ 7¿›/”‡M7÷øöi&Þíõü÷û_Î.ïË-Œo"ëýqöëïÁl*ýrø:MfÏðø*MgÛ3cµo–ïòìóÙ?ºY¸ÏÌxÔÄ®&Œü0†øIbºí);±½C“ÃÒÔ»¾@­Ïïð+ñšŠ[[ØÔF$öðž5¸ÁfõÀbØ´œ‡±÷Gç»·/³X@§L°*š¶.`ÈÃþ´9Nµ‚70jdï~ï"Ú®pjZ,ÛòT™›¼Ùâ‚Ø¿Ïy–žße ¹¤™´?]¡ÁRÚ-赫Z>´¤5 +æKü‹;-žhøYÂç +šÁàõ¥màú‡6_ñd¬¼´² åÕîe /U-ã›M…›/E|‡}íÄ:·ý|å;ÒB‡~Ƴ…5à ñ”XßXð‘îìÃ`âì/ªmVàAE1¸0(²kIñªÄ¶È»›k0ÿ\^mó6¯–ýß±BÊZ?M-¯÷-U&ÝðÌ$)¯å,H§¡™%¡šPFV ”³/ó§íÍ|aÁ°{žÀ†^¾Îq"xÇó°èr4`›5°%_‰)†è>‹PE¾QÉÈ‹šf‰GTíË–ïpÉ%®õ²CšÁIŸ+Z~ÕlÊî‚ݺ1»\…bÕ®sà#{…:öcedï{’a4€«Á;=–d¾Ý<„@ª³’ñXÉ#=Z4ÍBr÷È ¢ï]Eè1Ò²“çÏɤäÍy‹Ê<£DUáƲ¢ýh²C£Ùö{òõªn}¥aìhÎNO=Ô¾ŽÕðÔuB6£ƒ?5• ü Ô"OÑÅžNô‡lÒ“ÉŽ¿Y´ÂYFP;?žæÖzêrŽjÍOˆTÈõÎùûÏxK°FG Rï]oѲÇ’ÞbÇ¡¨Û­Ü²f‹Ì’ÊÙQX›8õ>’/óû[S´ç¦‹1ŒMØõ6J†6‚ö’ãC +"_…¶O.õ”[_EÝÉT´­Uγ6="K|¡ ^æ‰ùªšÍ³Óž¦ªpO-küázÙmœ†TÈíÂù¸òÃ$9òq:!ÊwmñÐ…MêI\A˜»)!Ô1›ôÙˆÝåTĘO\̃Üép°Lâ=+YÍ%_|§ÐJpî˜7ø…Û 4(Àp¶^ýT,eØo V#Ÿ;MŠ ¢ Pà²ÆïaaY¿ìÉšÂx@z}V ‡ûÉîpD纔xwÙeé•,ôOCÆKªÔ”jiÙ6+Jž›L´·q{–Ì[õÃ*—Œ‹Á! "5eƒSÀàã$«B O@Â*H Ĉ¶qgý8ã—O¾’ÒÞm²Þr²9¥ÞLMH¥²SnéþTLÊÎöj·æ±ãmÁ5ÉÐu‘µ¶?`¾Ë8w€íšã=…AêÛPóôë;8%!$z› Ç üÈ$ßÍ<.wOåd ÇÝÖ4m•‰b+°!¼%ê;%:õCÈ?J>B‰x\’¼ùÎù¯Yöù³§ûvó†£qœÐQ`CÇGû=•al!¹UMlÔ 1tè£ ¿Tš~Åc~²¤”$ä{áN†‘¨Ÿq¨×}pášð€ #çäÄb€²]â––¼m‹ÝcÃ_í&“öŽ—0@#©¸c-‹²h³V¸¾,ÅÚÂÒw€Œºw™ˆýŸÜ_ÖEû5dw£ÈÞ0šh g m,kÏ}—ÉÂØœZȧ=þ^-Ùm™^9Þ|‘;wÌNm]¶@]mêŽ/ä6Ûeù‘ñ¡“CwA©)9d«ÆŸ€³»ŽIð’p¡`ä!e»‘¾m&˜Jð(­NÝ! pK7œóŒ=aî 5!ÊÂpF $ÞÔ~7„Ü\Ò]ûzŽ7oxùp{÷“ÏøµaôÈ_»°(å'*}3ìŸÂ œô¸¾ý€ZÈúÍ&së¢9ËŒŒ\2~,§KÎ\r{ÇÑu”xD˹}˜ÂûÖ>÷ÓÔŽˆÃûE%ô&…Ô¨‘o09 !å~tNBv|¨é^¿ç¯;Šè²#Ÿ/¬ Ö'Ê\ÔDjvsÿN°DQ磇žt,ì A¢¥UÀ ÑaWÉsd2Ógërè’°KÃÕ®‚€­ùUî– £iÜp¿9ô°Ó1§®¾J»¼+ât6‡Ak‚xqÖQ±?©Ä¸Ñ@âð‘Ó‡½?i¼› +׳äÓ4#jÓ§©¶à¨9õ~¦˜1žuå¬Ø{ÖP…Xe›Aj€šïª»O·ï¯¦.Ÿ›tNqšfíÁY35=à•›ì°¶ÄâÐØ×´•?4uMVó¡}!Ù=KpʯÆ*xÆeWÜÈ4Ýj57œÞ`úM6Lo¨IÆk? +â¡c¯ˆ:JÕŽî/B“ä.Õò¥)a‹©À†Ÿt)§~ñ6¼!õèE…ÈD!º‰ b?ü¦V›¸ÆŃ;:H<Ãí5_0Ô»+÷¸4:ÒÖÝ–šK‹ÁÄ‚ù}8F<–UdËò…{k  \¼ì#”¶i4&J*®J-5#E5ÛÈ '͸é_ï?ó‹»°¤ÒŠ2KX’œ qMiƒû˸$|rI?‰#)ø¤ß.†k?Œ§KáÒóõH8¢„gEÓ yü‹ÆÈú±}5ÆHþÅz`ð)RwYYQ0ø‰C¼…6ÜB’4s#òEÆ*t>“fhÔ’`Æî~3ŠÁãóàȤcµ-vÝE—ùDKK⊵àø_±î*Hco›.8br¥jWö-8µ ¤(‘[¿PâÛáî"XãvÍ"̘© ã(#ÍÐ"|¸§ÀºÐ¡äá£e³u;,“aöÛÈ|œc¤f£TçË( á)yät÷ h{aBƒß–°ýá'cû:®R?F¿6ü>£Àó1¡,øºý¿)ã+£&CÕŽ—¤¯ÿªD£˜‡ßœøxëëd¦âØîâ)2@”ýawÀ»+®®©ÓÐeR˜–šý1S~`ÒTsïà4íQÃOW[5»¨@¥Ù Àáf‡`¯°ód2á9âl»j퓤×ý\(Lu×ÚÑ= ÑQ^#0ríjLµÌŒã­.L¡­É[~Áô‚½ûo®%ô*2Gô +V9ýˆ%eÆÜÉO…j_À}âôúWY!‘…¨ež$d “WîÒHIÔfYW‚€ªq1A1‹QœÊ4ÛYÁ¥‘«ÃS2©Ÿvµ{´OêÊ,´›­_½uh)ßL]ÝÖÀÒvH š®8Û:$͈ÏBøâY”K“‚ÎP7 ª!¿ˆÁ×x¦]Þ>X+¶¡õv¤'¾ýo/¯/?]ß\LÉ3Üâá&°øxuqyþéþç)¸NŠbD–›ÑÈçÍ7m¥ÀÿÍAM¾<à¯U#Ñöú¡IÎ&©oT8Ž/,‰ K­ +tšLî"X?y=Ê®›púc‡ÚqS!ÏÑY´Åî‘ø"¾K’ÀÒ +ï£h1ŒrøþψQ!…CY*1ë.r9¶Ð–Š?ε«ól÷%í[òÿîKºgKÄ ŽR_YµpwHâÃdÈXšðxÑýÖÿý‰ý;I4NêkûʇcüØÿO0¡iÛYö«äÌÚ“Ê ËŒn>ÿœVendstream endobj -4221 0 obj << +4343 0 obj << /Type /Page -/Contents 4222 0 R -/Resources 4220 0 R +/Contents 4344 0 R +/Resources 4342 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4192 0 R +/Parent 4347 0 R +/Annots [ 4346 0 R ] >> endobj -4223 0 obj << -/D [4221 0 R /XYZ 85.039 786.531 null] ->> endobj -4224 0 obj << -/D [4221 0 R /XYZ 286.841 769.79 null] +4346 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [124.649 589.939 336.162 601.629] +/Subtype /Link +/A << /S /GoTo /D (passdb) >> >> endobj -4219 0 obj << -/D [4221 0 R /XYZ 85.039 376.337 null] +4345 0 obj << +/D [4343 0 R /XYZ 85.039 786.531 null] >> endobj -4220 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F58 3360 0 R >> +4342 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F59 3455 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R /F58 3380 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4227 0 obj << -/Length 2558 -/Filter /FlateDecode ->> -stream -xÚ¥YÝÛ6ß¿Â÷t2pVDQÔG}ØÆéu‹Í&—øp(Ú>hmÙV#[®$g³ÿýÍ)Úk'A"šœÎ g~3dÔ$‚?j’›0ÒÅ$ËÓÐh5Yîn¢ÉVþu£„b&$3æ‡ÅÍ«M:QQXDÅd±vrŠ(4E:Y¬~ ^ÿtû~ñæÃt¦µL8eYÌßMUðööî§_Og*À©‡Ž>LãÉ$†cÃpYÕÀ Ï~%ƒz¦è·)`$p€¶àôà‰†SÜTŒkvè[£¯6²»—¹øûc?ðhWr^Êvk9ª—Îصèxàÿ%¥ÂîÐÆ8S}94%îJážC[R˜P%éÄCË¿€½ð*‡»¢ñ— -B¬l=¸Zk "x;ìŒa5 5X4ÖZÐiÀ6ô˜ Èð_ð±Ü=ÄeÁíÝö‘apÎ.,ñÐö¼þºÝ]Û\©¶VüWÕiâÍË– Ÿ¦J“š žùc9Ó œqÝówßÿÀQС®xvYîelàq¹´Š½‘ ¾ipK¡2}ýÙøÌÑì®âÅ#ë™…|¬:¦ë?“8¸.íÍBi‡¡£Ê!ü±Çý’0˜–ËÞ)ô nÎi…ͪùB«, Þã¸Þ•¶8ÈôÜ"L–rç›pã!6d„; AÅÔ‡Ž¼ÆdÙ6=oJE¡c’¾eà_Tüà‹Þ³BÖG´t*@J#•[µ.—¶c1ë΀%ûÌeÑ™ã×hNNæ ‡O+nlK)½\ù¤úÐ['%§Ù5È‚«•Tyá*å `"Å´vÐÈec9:†—f>–}ÝcìÀ™¼'µ9.Ñêz¿:xx·à ·…1LœæL ÂBb0ÖFÔN8ø|ü].57z˜i\¡Vö$X²«ã+Þ™üd%…×3ÿèKDåíP/%IçÐÔ6:³ðšuÆÊ¡ I),5ü»í˜”*|©ÏÀÁúˆ|Ç®ÂÛCql#ÇGÜg‡ú<âh†{,\u†¢Ú•N"pÑ·£­mhâÒ0zÓiüE\ÓÕ;qfZÙ\2¿*‡#á ·³$âÃï¨C„yD ¡Œòì] )ÎjKŸë–d‚åi’嵶_?L1lÛ=†7®¬yoé×<É^KªêQ ÕHݵUE9oÀÌt4Ør‘Y×½€·•k–'.FÏ j±Ä4ž;—h²¤D~¬cjn “¹h%1„áù±kf/÷²ë ”[Ûð¸£IeÏ=ÈŠiž¶V‹=s[1‰Üþ±—þQ‹F;ÖMÃ#A¦ 1²d¤=8`0¢Š“`k4¡§¶’¦±î¿C -¼µžž*·‘´BêÝAÜYc›´¯¤ºýÍêgaí -õŒÓ\ciÃ^`äJsHõnìÕgF)©3¯#[má91¥¯7{FÚŒ± ¾hwÇAQÛË ðìÚ~`¾xe®ÙÄU¿¶žÀŠ#,…ûm½ìÚ¾]ËÏÿb¥Ú¯<”¹Ü±?, m¨ƒ,¹©ø'q²KmäÁìÒ–'¾UÑ- çÏò.— -C5J©&Ø>ø©4àüö4Za©¤À‚%ÉdlK% -tâ '“N¿m¾±Öcó¤!¤Žè8!LÓóÎlúö<{4Yò‡\s¤êg>Þt,™ÎWó•”1Z]dËuF'ÚgÁ“ÐY‘nîšɽ€¡Ù ÓX­¤æ¡öžwà Áp2cC· ußÄK'å×c3ÊÆ9R„BD%+’ § êÊÇØ‘òï8Š¾ø¡ÇwÂ/¨RŠ~û…4—zÍ«ï~Kœ€²\XP¶íÁÇÊÂZnɵ\ÝáfƳÊ8××'øGW¸=U¸Í–)Ö˸‡ùˆ8¤ÃL×%ý -¯\_b¸*þêõÅ£¹zËŠÓ&–[–‘[–ܦ0!j¹M±©0x¨†)ÄæþÓN!òºO¼pÆlÚñö…%xsìJzžãêrÍšT‡Yú kFš«—±.l©‘zÌñúLÈZc‚?$Fx‘ò6ŠÁ(ž¤`…Z2*’ -®‘‡¹{ïõ$J\‘ˆ¸ñ¬¹E8öl+æ‡æ°b¥ekÑ‹o1;K<©¥ÏßtÔ¸\ œ1Þ©¶ã;£]ïwV$H뫽€«IZ{5‰ª7ËäÞœaŒ_U’cÉŸ¹÷‚ä]†ô_‰wUdaGþµñh\¼»·c+'‹C­‹1ÞU 0èRæ§Ïü„„nc=’XO%ˆ­^V×ô΢0úÆ3ƒGs5²•ÎCUÈ=›ÞuA¯Ñ¡êÅ…yD†*‚yz«Â_·Ô&!1¾Q6bš¶‘ æÙ¸ªß"¡½¯~4þ£wœ&až0îä½Ð¤AÓN£AnÏl'f*Lc-\Ö¯¿(a;%/À×ïö£ºó“6†ÞµNÃ$ÍOràòÍ{¦Uê»Eùm¢¢†H.bÖ@ÿT[9ûPŠÿ -¿¿çÏ/ØR âÐiÎÕ -AÜm¼´ 0=÷š3‘þú¼3C‡üßabÔó·‰û{yT&9Käþd‹/e!µ¯®ÁH.tˆc–ž¾ú>Hó#, Nút†ÂáZrk&ü_ç9Ù¬¿ôŸb.Ó’<,ò+%ÄÀÕ!Í« Dr®°44¹¾ ñÿMíÌ5endstream +4350 0 obj << +/Length 2255 +/Filter /FlateDecode +>> +stream +xÚ¥Y[Û¶~ß_áó&±VE]NчÍ:='EºÉi EšÙÖÚjdÉG’ãäßwn”%KNPbr8Îå›áP«füS³Ø¸žNfQºF«ÙæpçÍv°òŸ;%Þ,p½ÐàÒËÕÝýO&œ)ÏM¼d¶z&–Õöƒóø߇w«W¿ÎZkǸóEÅÎòí\9¿<¼~bòã|¡$=­pôëÜ·oæW?ß½ZõŽ[nj<ïÿw>z³-¨ôóçê$žaì¹*If‡»Àh×ZæÅÝû»ÿuRx-˜ñ® «–c¡7ñÍ´å ´Ô$í>Waßvã`° ç}zX§`l9K´ñ=NB‡ÆÕ!ÍÁø’׫²­«ÂZ?q´ŽÀɪ;Z™ ·ÃèÅuºÐ(6pð„†‡eÕ¾€Q¤œ´ê©ÚÙ *D€u&¥D³“沉¼šƃ2¦-ó:crUƒ¤¯|à{fHEšeçúGçuËœ›´D *™¶0®OÅEÒ3 OÈ!gW¥UŽ×A7ðŃ˜/6%•°’ àWœÆλ}s ó-m‰1)y ÁÍ”¢obÙSÎjÏD”|¬«¶š/üˆõ«Š†é¨68„ÆMuîê™ÑʽОO€ Yúy‹gí6ô¬3#ãQym•uh:{pܳ8‹Îž†ìÙ—ÆYƒ! –ÖeëuªÛ<¥";?‹ŒÜ—±àlË •ìJå7ûrd‘‡Ë';8Öã®Ó&oÀ㡧wÚiƒVÇ`ŒÃPÐ >.²¾`â0/€Ðʶ¹ÐùGÞUÕ²£Ý[ÚÃÐ èØÙ@E¯åµ[»S)·L'ÇÄä.)pÚÌi?aümPh9 g !Ä´ïP +!Ë™ç=`%Dï5 מO¸õTggœ3f"OE€8‘YWó8àã`‰(‡´SÄw:Üèì.ã`©Ýgä߬§²Nb~BH˜°?K[tAÍa@!¥I‡ˆuÀ"F.Ä"µË˜ï¿\v¬/° VÜóyU£Nr@mê†Á³ ’²e¹]–÷Nű$R™ýá© e^Ê}øm÷U#lg«PÅóžnäɱ_¶¢À{àrôꤳ°\gx®ò¡ÀS i^dòΣJà¡Ô0G–"í¼¯xp­³‘*ŸˆÒmÈDh»Ï嘚©ŽôJœb' YPk‰ ξMuàÔ²Åê„/Æ06iÙœç2ž£ +ãȸ퀠OÈÃÁx½‹6›\ÿ˪äG®­ê¢©EÑe8i Á^põV X#¥¢èR-š|ׇ–Ž¤JE¶ôP¬sáG2é\5-3#¶j1ˆã›%„±x¤²û—|SWÉ +Ý2Ëo¨rÛ+,›1$ŸVÁ‚ÖX~‘qu÷)8²»PXQdµäÙ>½`˜ò0¾B"ðHGÙEÅ–Ò%V(¯„!JFI1îqº @óòAMyæÃZŒ*”´õ ¥=D3zšÊHå Sþ!¯œèfô£~‘ªY2…øž-6R©Ü"»åÂh ~䜅´Ýl7R¹Qáâk£Áœ•6-\JcÄž†Ö?²ôß±‰¤KTASû‚|øÂs‰¾R g_ƒ «Ñw?°g|cÜÀ÷VUÚKCûeJ¯§Oôþf^}6˜ðDºQÿOD‰›ÄAÏpä“\`}ëîEÀ·#§äT17ˆo}¾ó7‰¢A1%[W ”Üi¯¾¤‡£¤×ÕÕ«…“i¯Àû7>$&p{EãšHäšú꣦}ÔD1n’è©#ԕШÙ"rM4pÇõïí²óê çäUb\ÿß×Ö††6{ýƒn n8Ï][e(鞯ښ^+LÙ¾ëÝ%ÅòñZ ¦¡£O½Z¶ DÚ„àò%;žÐõî¨Öiñqê!ÞC8цÇ?òÏïYóM’ýM˜ù¸‘&•ð½[>¾àæFååò±¡jÙ•òAliŸRžÑ‡¬lGCv¦¶'r¯á°w¯]I9¦Pû"î?§õ}‘¯ïüò}ß].ã­»SÖÈñÕ§o¹+úº®ÎM–®ƒ}•«k, ´^ÊwߪMêŸýE¤D¯É#ÄÔöG‹ÀwCm:¿}³G0á(¼qNþöë:þendstream endobj -4226 0 obj << +4349 0 obj << /Type /Page -/Contents 4227 0 R -/Resources 4225 0 R +/Contents 4350 0 R +/Resources 4348 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4192 0 R ->> endobj -4228 0 obj << -/D [4226 0 R /XYZ 85.039 786.531 null] ->> endobj -210 0 obj << -/D [4226 0 R /XYZ 85.039 553.022 null] +/Parent 4347 0 R >> endobj -4229 0 obj << -/D [4226 0 R /XYZ 85.039 517.711 null] +4351 0 obj << +/D [4349 0 R /XYZ 85.039 786.531 null] >> endobj 214 0 obj << -/D [4226 0 R /XYZ 85.039 295.912 null] +/D [4349 0 R /XYZ 85.039 766.606 null] >> endobj -4230 0 obj << -/D [4226 0 R /XYZ 85.039 252.959 null] +4352 0 obj << +/D [4349 0 R /XYZ 85.039 744.844 null] >> endobj 218 0 obj << -/D [4226 0 R /XYZ 85.039 197.715 null] +/D [4349 0 R /XYZ 85.039 523.046 null] >> endobj -4231 0 obj << -/D [4226 0 R /XYZ 85.039 162.969 null] +4353 0 obj << +/D [4349 0 R /XYZ 85.039 480.092 null] >> endobj -4225 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> -/XObject << /Im1 4096 0 R >> +222 0 obj << +/D [4349 0 R /XYZ 85.039 424.848 null] +>> endobj +4354 0 obj << +/D [4349 0 R /XYZ 85.039 390.102 null] +>> endobj +226 0 obj << +/D [4349 0 R /XYZ 85.039 320.844 null] +>> endobj +4355 0 obj << +/D [4349 0 R /XYZ 85.039 286.7 null] +>> endobj +4356 0 obj << +/D [4349 0 R /XYZ 85.039 271.955 null] +>> endobj +4357 0 obj << +/D [4349 0 R /XYZ 282.599 277.929 null] +>> endobj +4348 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4234 0 obj << -/Length 2549 +4360 0 obj << +/Length 2996 /Filter /FlateDecode >> stream -xÚ¥X[sÛ6~÷¯ÐÛR3Mà­3}plï&ÝÚÉÖÚI;i ‰’¸¦D‡¤ìøßï¹¢,ÊÉ´£—ƒƒƒsý€pÀ/¥‘èl”¤±ép4ßœ£Ìüë,Š‰Lz4o§gçÿŒâQøY¦ËŽOøQ¦‹ÏÞ廋ÓëßÆ­µùãI’¤ÞÕ‡qèÝ\¼¿åáËñ$ôpèvŠ­ßÆ*õ>ü:þ2ýåìzÚ‰Ð2ÔøzöùK0Z€°¿œ¾ÎÒÑ´?̲ÑæÌDÚŒ–~yvwöŸŽÏ™¯:¯£˜¨ÀO”:Þ.ÉÙN¿ØNmŒ&¡Ÿejh§P%¾ RЬ%qŸâå·“M…Ê7&%Qì+³7FõŒá¨ZãúhÙnPËÐ*s4€»€eB/üé¥Î(;…µ½Ž¥šïHó‚JÓlÆ*ñf¸õEª¶ÐZ²O,«š³ñˆrœ/`z»âaË’„¡«Ë—b›0ôÃ$ûØÐBûºøYè!è¼ FÒ^•Õ ÕY~ÁýÉÈèÍ.ª-¶,k TÕªÚ6,óÏ<úÇ8Õ^Þ|gíÆ6-^Ô!‹ÿ ¢VŒ0®d +å wn«ÃÉ·W— ¬ݾà~AÆû~FýÃÖ‰/l‰#±wi›œ[Õ’inîøû‰²Ì¢§†Ç~ÿÈ´ï(Kmdåõ¢øŽt¥JP‚‰ý,ŽÀààQrÈ«1d¦SlhQl¸%Ô‡\:­›€Ái=6#ÈŽYQ - |f#“€õ 7¢Ö!B ~ô‘*pÔL’’x£¯#H¢&Ë4“ôÚ$üþL4pþ~Ž®*sÔ“TØNz|9Y§=ÿUA•á•&QѼF§Þ§®,8ÊÏÈÄ8¿71Ž’‰1iá,€b‡iƒæ¶UË5æ¡GYÑ®¥aatV”åÂg™¬˜ÓÿªBxÚí37ZÌhÏRìŽó¹i”xWœ|‘;•â5ßÕYùðÄÒºÊ -rìç õa„±÷_ÔCYÜ£ˆ9Ö‹XsÀâ!Eé(õ²o<ÎÝ›] ->>Õ;>dÖ랊N5¾l*n1<€t”³·•ÏRYíü^Š)žVÍpwRÏœ‘#¤ŽmÉÒé$€H!Ö‚/ê I£ðE¤³CÚXr"çÖïB†,qºçÞ·FOÁWÒÌURÆS ¦¹˜fÎÀ0rÝ·nœu²ÜÀè7?Q¾[b³³sÀuµÄ\ „…»-ýЛºÆ uªàĶu-ܱáÎÚJcÆ@/ öÖx€fÂÌôb…A؆'dNlXZyÏ\XÕ0 -¾S’/®¸_M+|éFCù¦Û²V[q-ìP¥è³¼C¸œz3;9ö{Šûo„:ŽÒ35Ÿ´nxÂI`yl\DÕÜûºs¡iYѲÆ6÷]×€hÝy÷ÉÄðå£ÜKPÑÌš´­Þë•N¼÷-sžÛí?y`oŸ¯ CšÞænÁ’Y-)ZíÐ]aÏ$Kл 5»Bgò,f᳄~ù²À¨ŽrÁ”EUrJÊ’¾Ú`Š¬_-ÇýrCW‘*6É›o³«Ú‰ÂNwY·ç”¼oŠy]5Õ²¥ ˆ<´Ë¼DVmÜ­ÜYJ'‡´öI]ï=Ê'WB³¨ö«ü°X™ÌO²×ñæ$þWÊøiøâö¢ÿ*þ‡ -€ ?t¹…& ìÄ v {“Ÿ:’RP^?QGr² ‡€nã„/4°#TRó>Þ·x‚7|` kL×HI9¼¨BË–E‹¡Dd笅FÜ26-Gô°@Ý1dþ ÀÍ(ˆV$_OÙ]¾ ¬p´“òêbµ&黄‰Ïd®&ð̪HG*‚ºÜÀw×t†ñ‹¥P` ÉŸ¹Ó8…Ðs. 4ˆÊÛ•ŒYô³c6{³æŒì -L@ï=qJQcá£îq‹IÙ>5»ÓGì wR÷Ê4AÍôt Löo”X€Îö Ô¥|Mƒ/×c Xƒ'}W»‰ÆÊAªœý/kD©çêßþÀkÞ”n¢iäÝݼåƼ,ö}pÁ•Ãاð€/Y¾–?‡>C†‘È’üÛ;Ǽuq†ŒºxEÁ7ž™M:©yöÐ -<ævCͽòJjĆ„1vTzaÈöüêAÀ‚q˜ŒÛ6Ò¯êUyò,çšÖ=ò!ékYÕ+`S\¦†=Þ½'"þe4ƒäá]Âk<ínH÷ä™ÉñÔsWTuIÓ?âõ†‡ !%„ºš’gùöàÒ‘¡!¡Dð.¤a/ñƒÍÎÝqÌ—»MOôŽKž€Kvt@Ãv r^?#¤Þ+ìg/Æ‚¶ç;NÚd+àåI`HßöP¦Ë_tÛ¯ s½qhõÏéT(…¢€1èÍ¡jmé.WÚ°áÛ5å4hÿñÁôÓŽ‘ Å>U}0éÈ7úărøúÄ=(ï R?KÕ0F‰ µ 8atE/ŽtêG©øÿñ²Úendstream +xÚ¥koÛ8ò{~…¿ ÄŠ¨·î>¥MîšÅ%ÛÛdÑ»û¶e[[=\INšó"%ÇrQì"@D‡3伇V3þÔ,\/ÈfI»Q f«ê›maå?J0¼Yèzq„Kïž.®þÅ3å¹™—Íž6„ò´þÍyÿáúãÓí/óENäÎI’:7?Ï•s}÷Àà÷ó…rôð„£_æ~êüüßùO?]Ü>Ø-B7Œä÷õâ·?¼ÙŽôÓ…çY:{±çª,›Ua¸Qȼ¼x¼øŸ¥ÂkáŒwMÜja0*s3?š¾ùoeöî¾7q÷È… +G¹>Ü; +3‡®·ËáÖqâ<îáë9ùªÐ%Bbç½îr5ƹäï§èÔëf^:†}þȸhSÉÎÛuÑ#rSOÈÏw•F•‹Àw=?°RÑÄ…žæià4ÀÈWÎr¾ð¹ú¾³j*<Å—9ŽzÑ |eôU™ëöŸóE¤Î݆a¯¨èæÀ“œèÿ÷ ¡Ëû\¾jpyX¢ËCº<à|à‹äqðæ}w§Å^Ž +ûýÌéé<ÛPt/›^Š~w|å´–;Tö‘NŽ’d`´!Ü Ö}½ê‹gÄÈ~S´F«¾i_릩tQóø1_á*q/zÜú:OCçV3Àõ:o»^×kÞ@÷dê+]ã™™jɺ© g´ÀÄX éÌu9ÇËŸ^µÙ£I–¡ç;EÇ_”)~÷tØÕ˜!9Ý!á\p„AèÎmbÛêõÚàN4ÄE%ã÷2««Aš/ÂõŒ_Ö3îf=͜逆ÜEáN uzͨ›f“Óù; ©Q î[çQaä&~2[$™›xG>t@”Ÿ¸)ˆ1Ñ„+º*T“á + 8VÉY2´É2<ìc*‘¤³$€è™XÙRⱃ?4lX¨«‰ð‹2  9û:S®fYÀ«£1sØD€«»JÍn8Ñl8T¹>¤ ßsã âN:w(@üü„'k–”k‘ç|èG~àh”óŒ""…„=Âø‡ÝX“ëÀ€ìøYvõ;è%šZiÜ’þþÙP\DB†/Q@ÒGÖѽnø šlc(8Ø@ .S|Na:ô#çWäZ_$Þø ' ?‰ÎJ ‰fß®îI—xF³'F¿œ‰‰XqÍ&šS/d éÏ[’?5 8Í9¥… tJ{¹/#³àa W–cÁãâˆjÙlyÐÔ}c8Ó§Î{Š!Òñ_ûåÄ¡ƒ8s•¦nD˽!ˆ"‚ca«Š¿îñ Ñ#ZàRxOÈF±Rv5³Bûň£îx]Ri æµNr1ѨÈÙ—&[p!¢Èr‘ºûbä<`FG(‹zË°§ Üß\°K¡F™ùUp6o(?ê +õˆ¨BŸ°š0Ê–*”É’}¯E3ÎbIô~™DßòìëÁ\¹#fɼ'¹Î–÷ïlbâ}hq¯´õ<˜±Ð‰qA»ƒŠG9w=ƒ!Yÿ£g +KNy¯Î Û§úQŠa×ù=—r0 ˜õìe°@~F|_ðJTõ”k†ñ«ùslÏ +¹j!Ù’“rzÕŸBBÖ7ÅtÝ`¯L¦±´¼z,~†n(¼S¥=aÊ»© +8PªÙÐ^rñ\¾„’,%ÄehA£¬LVdÌP›B$ymš¶ÒR‘`<Ë|ç!7^— —CÅÌøËvhš¹ Y³nBHŠiÀ9îHŽï,uPl£>–Æá1ÖtßI™"¨x‰õà!%¯R2÷³Ð¢¡"!0‡—$@åŠÊlä±ñPä§í#n1¯$#R(-é½a”%Ø O¬m‹ÖÕc‚­Y Dî¤r›ƒ¤E€ÚPE]HCAÊÔ‚!Ê2ݘqô´Ât@M¯ËR:Òt¿Ã(BE­ÛÈ´\=³ì)l4m?å¬wp9µ½!De.òøð‘F:ŠÌù¸k[†‘´Xo6W¬¨u^òœkˆkŠâH¸¹ð%3| 9Ý(}‰–±€ò ?žSí?j 6™¤A÷ö³Œ…×aÁé%ç Ï3RÆ=|ü¶ gǃzj¨Š<~¨“(À=iaXæ‚or4.SÓ t?Ù‡¯Ñ“¬oš–DÌC%(ÇììÅ -û|u+­¹ Ø$ €¼ìŠvÒR·ÒŽ[³€ñ†”­.„.ÕkdîÅMö¤Â±YÊùÆ­ŠaNË÷_óÞá88J+8·‘‚*ÄT‹ºÝ.ïx™û4ð”/(ò’EU! ô8É‘¸ëec›=ä±?ŠB|æ ¶……É,¦ +‘Îïi2³ I´G-²ï˜·Ú@‰/ba”ï¹"¡Ù–m´ã™´É¾óg³4=|,½@ŸçQŒµŽÞ1áÂìÞKÑ)ƾævÿ ^ få6Y"¤Ÿ4O¾uÑUoŽrÔ±OTQëŠÌ±°‚muOÞM ¿S@ËSØ ÛÓcl)QŠ±1©Á®B6‰ãË3îR^2påw/ò¸Jò¥4[zýlÏBÁ`€¬TÕQÃÀ}qL}~¸rá*!–‚ÝZt;¢7=Ô©íTh¢d†½iœ“Ð1^¥ýðĵ§¤lÆ‚ñð¼«R‹ÉáØ)\û£A¨v|eÚÚœx涂·?h”‚6T”÷Âî¨Âê„âZæ½M¯çðP ULªä­è}1ÿÆàÇÕZÈ­Š=—h²¸`ÂB쑃ÂǪ½Q~þ(„Öš¤†<ßÛ߇ØëcïøíiO·x~”Y²ô¬T b½íƒNÕ¿i¥ƈiã3ý†Öt¹© +¢AriD> endobj -4235 0 obj << -/D [4233 0 R /XYZ 85.039 786.531 null] +4361 0 obj << +/D [4359 0 R /XYZ 85.039 786.531 null] >> endobj -4236 0 obj << -/D [4233 0 R /XYZ 286.841 769.79 null] +230 0 obj << +/D [4359 0 R /XYZ 85.039 766.606 null] >> endobj -4237 0 obj << -/D [4233 0 R /XYZ 85.039 606.673 null] +4362 0 obj << +/D [4359 0 R /XYZ 85.039 746.481 null] >> endobj -222 0 obj << -/D [4233 0 R /XYZ 85.039 584.356 null] +234 0 obj << +/D [4359 0 R /XYZ 85.039 455.827 null] >> endobj -4238 0 obj << -/D [4233 0 R /XYZ 85.039 564.231 null] ->> endobj -226 0 obj << -/D [4233 0 R /XYZ 85.039 564.231 null] ->> endobj -4239 0 obj << -/D [4233 0 R /XYZ 85.039 530.087 null] ->> endobj -230 0 obj << -/D [4233 0 R /XYZ 85.039 249.795 null] ->> endobj -4240 0 obj << -/D [4233 0 R /XYZ 85.039 215.045 null] +4363 0 obj << +/D [4359 0 R /XYZ 85.039 421.077 null] >> endobj -4232 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +4358 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4244 0 obj << -/Length 3375 +4366 0 obj << +/Length 2754 /Filter /FlateDecode >> stream -xÚ¥ZéÛ6ÿ>Å»@4@FÑA]»‹2IšN‘9¶ãl´ý ±ä±[r%¹“ùïû.R”-y ,rˆÇã#ùŽíŸ{ðÇ?O#× ³ó$Ý(ôÏ—Û3ïü z>žùBq)$—ÍÕâìÍwQ|î{næeç‹•á“yn”Åç‹âgçÝ÷oï~¼¸ ÃЉ܋Ë$I÷w¾sóöú–›ß]\ú6Ý.°ôãE:wŸ.~]üpöaa–`-ÒC\Àïg?ÿê°ØÎ<7ÌÒóg({®ŸeçÛ3…n¤B©oÎÎþcxqŸ:çQSûÂÔÒðxÃ~4±á(rc•Ð†¯;ÜC·/áFÊiËMÞ—ØV`Cèô wôkØq‰åÈéª*O¢»Ü4OMÍÄuÙ£4ž/‚ÄiZ ùʃ·ÀÚ‹rÃõ¼-¹PMEKXî;ú–2oU[óV²:¦Xâÿ=675¨(òbçjù§}Ä’E½‡únÓãŠúÕ"»ôQ¢‰ h¶9΀ªi/Ýk¨dÞän‚$sdÃXìh-ØWíz=.GéL°ïJ¦ Ú:ÚæÏWP`ñuܳj„äz¸ø‰¹hhH—zÎ -Z4©µ°§¶¡ -•½‚›‡‰=²Cåd_ÞÜ|`_nª²Æ¾¾ã†g\*ib‰“®¹5oÅ&BÔSÉ+Ö5è“ëÍŠ¿ýº’[‹î´(K ×Ëd‰bp¾ƒ²ÎÜ}PDWX¶ÊudWs1gj£](?WÝ »Ñ®ñ»Á€>Aw¡ç9•0z$MåhŸ´Ð¼ëe`[þNÞÂ&(¬>\¤p–®lÿÀ–ÚRÀdUè; رbÐ6Zæ‹\†~ò1ûâŽÐÖ–;\ù מˆ9) j¬ -(üÖà6pg~ â+¸õ‹jU¾Þ1ãJÞåìˆÏ¸è¦¥AàFàóOLð¼†Q¼¥–[¶¢P² U]uÛƒ¥<ØÞy¼í¼Ø’EVF°mÞ£LÃ8vÖ9.-N"aŠ|c<¨`™@:×Zj0ª’AâûŒsÕãFd =¿x‘÷ˆnÓ û͆‡æÅf-„GÐÄ>“‘ - Å¸>­‚P»sþàªÄôØ8Pi"nk)R´S蔣4òÇœW´àß´·L½é¹¡ÓìY nz$7´ ¬ÔÎD­’8 ©€ÉV®^(Ê5I!ëò…'5^Ÿ -ØlH…e_1ÓÍ Ï2PÖzõZÙ Šê„ -DÂÍ„Xz#Ë-óÚðXôÇÝ¿nü–ÕŽäHFŒ( ˜óÇ( ýÓÏœ…<áU”dçÍ`„¸19-…éÜô³ð&óZ FU˼¯¢Ì°ýI*äB“T$ÍV£šµóˆ6¾ji ºÆz³q›¦cá‡t‚ K#Ò)Í«^¼f°Á¹ÆhœÒ´ŸÅÿS²ØŽÔŸ:«2ï÷Æ:î¡÷\a𬹲ͿŠÍá`MG§£¡Eÿ¬ÄRƒŒ1-•m”mµÐãuT2R‡ P$ÏÍy›-—#hìŒùáŸhŠqM¯ùØǧ¤9íž­*ôÍM4YoMè°N$xFã Žž= Jz;ØؘN¦¯µ´µc#H•9 â=«ølgA¢aä…æ¤9ô …¢’rU¶¥¦&M”hød_ûf7Ý4ih`nÅ·ƒ÷dQ}§V0:>í!J¹Tž ‹ƒ L°íË=~çûybKyAÅÆï;DpW%ƒnïX|ÜÈ(”%~k*!Îù£cjÂíp#NR -;BZ,쨵ÝVR'Å`â’+–!æ™3Ã(å¨9‘¢ÁuDB£p}ìW$OŽÿèPUÄ%ß×KÔôZ ’s6ËFbºÃ¥0´Ã§=Ÿ´JxLWuדÛÑÛAB±q°2+BÜŒB%{ÅèùÊ=¹0Zk¥F¦þ‰PzlÀSQ{öí Æl𫆈‘CBìâó߸6Dj[ xs&`oóÌ\áTœº~¼gZ4Ç×®,uÃ$4|põ¾{8™ïÅn -rj6Msz:ß\Ðåh¾YiLc,w=ÒÉ’K5Ô°£$ò(k@Åòõ½ “H† £¼(Q:9° o‡ÌýìÑ5êϦ¢0¨jŽÀTÄn M·<äéïØB0P7GS§z Èz•ÄPÊ—3@ {ÈpñK˜ $·eu}÷À­5$ŒAÃû;Ê ÿ†6ÂxoŠÚÃåükÂÃSW¥‘ôÿÍ_Nðð3¸ó+!ù÷ P¶ŸÅB÷£•{ZD|aòÞDWØ=äe8ôH‚ !}h/´­(樢7·cÒ©òm*°¯ §^=Áß Õ‡›‰P=|¸À\”wµÿ~øÑÃ2Ï,ÊNcÙ@3eBƒ3óXvb¶ËNMg°Ìš°,PéØ•÷jéljƒ*Kº»+>…æ‘÷\_DÐÂ$8' caˆ8È9“K}Ñ€VJJŸ‡›+6 Ébõ{Œª¾0f !§dhúR† Çq- ‘©³N—ɱ9ßèwgËêÖv.—ºïL@€GX#FÁ7Wý0-­pÎZÂ(s“08i-ͬµhÜK8k-§f3Örr:m-ö|l-‰?"‰§õ‘ˆvgÈÌÑaƒAR O¾J¤û.ÑŸt.ÐJØÇZTŽ0 I˾­ÊáÆšð@yŒN‰Ïè”ø#¢½¾®•í«)£Ñ—L¸ÙYÊYeÃQã¥ê´²šye ®AÍ+ûÄlƒ²OMg”mÍÇa\lhÀzo'1BGx( ”r4šRXÀ±!ÊEz;ÁÂýæ¢ÀJÈ[Vp),u¢I»¼Ò´¬ ´Â]¯ù00Ðåe%_髦»¢;3Íëû -–èã*(ñC&Œ•¶Ì °A•qØÎM&ǦmPòý#~å7ÆÎ}¯E':/ÎÅ3¡%Äiè9oQ½N…#—~]YY'\_o Ê›¸E™aGOG¬±ÏÞ!úd9†¥Õ9¿bå¦irÒ/,šY¿Ð4¸‰hÖ/NÍfüâätÚ/ìùk‘ÂLø/ üZ“(ì›’‘áç!mò±ì¯ëUÃÝBÁäÈ™ys¨‘è8ùzLkƒäèA™W•Wl Èmm2YS©<KàùþÄ[†J"öŽ$Ö¬ n¥‹´r#±ö JûcÿÔÚ>àô]h—%²‘'“ñ/õ7tCŸæYØUÿ붃§Ž/i ®è„1¾éõÏï#ÐHé±½µGj¤t&gÏ…v”ýá‘Ëw^ÉDkÊÕ`iM$‚÷çžÁðy‹ÞQ ÀTÙæagÚŽ·~óe¼80®*t(.Y9;‚Þå°f ¡wI¸ƒôMûr‘*g|¼©ÓoÐÍ,8hÜN< §f3àpr: ö| ‡fèùãC3ô¦ÌfLmø–ñJúDz=:JCë¤^ñ´á4E -}š†:ãF³X´îè@ãÚ”ôÔ¦œ·¬¦”žr`5eÎGcÔFž•ÉV±•É†J·c·¢F“”VÃ}ËnM졾x R€–\hr!@ȪsMÏiVÅP“÷kÜæw]’d «üÆQãŽÜêõÄÍr¼õ¿v³<¸î3 Òá¦:•¡ˆÝ0Ö)ŒU;DßÔüè¯ssŸ &v˜ \Tä\ëWg­PY°³±Ÿ,ð|kíKº„Wr …:1OÞR¶;ÃÃJt÷Öƒä `¨ÀÍÔéd¢E3BƒRHæãÄl`œšÎ†5GÙèv”­âƒ(´`ý¼ã:ÞkЩ†€à|t•Æÿ—¯?üüÚ·#7î‘ëÀ˜à…j¶B;ÔÁ÷{%ïy¼’òžöÇØU­wX¡OB"I7‰°Õ­ÇþÜzN˜Q^€ª”¡¹àÝZÚ‚63záXbîtÞ¢ÙxŠÊþ7öFÂOIo¨;T/~ŒèÞÆÈêƒåòúâÚebN%,x†ƒƒ Äs%GPžµ¼:o@€´Ù§¡;Ðá÷C=W¸zØ5VRþ¿‡ÉÁŸÍ’ÿtáˆAŒÃ hÑ‘îå&âÛ0W֦ʳ^²bcöZ$;jùì:4 ­ÕSV½˜ÈOØ×°ºWfŸù¾ù†Ö¢ïך~&sv£A„Àï¡U@f8¶ +–ŽrcI%KÆÑà¿EaøUocð•)s³h“ª F­E'Á2>ÉûCVU¾ÇdãÄÅËu?u$u•°ØØfi žïX+´:lÜTz~k®`¼)»#/à鑧'¦´R&¯‚l4þ±õ‚‡&KÍJÅ©Mò‘ôñPp˜3Ü}#è^DWTƒ`j4§Ä9åÆÆ¢XS¹cÔ÷eƒL2N¸ˆJi,F’4›ó¸76² èʹàÛ“Ó9(»†Ç7eWUŸ³ +[ë*Kñ×~È‹}U®ñæj¢ ×ÊîUc ­5§}›™rÌÂ'Æb‘S4¾Óvô—#¦ÜÔ“ûvž 4KŸ/¦†ÏSCÿÉRº†idîe:1!æ. »ªÛÇÀÒÀqðþ +ò ¥W£8{iö'ÿq1Eà`8’¿b£é‰Fé´v=ÆiÚAì™{ÿ÷ïÞ\¾µ¯ùÿHº>êÛpžòJ­[‚%$ŒnóUÞz`i}DpJÜŽËeo¹p®É-’ÚjS[ì1œýüawä|×vÁ×M.3ô@Z»>d.\Ï–*´rl' +{Xëûsű=‡c©¬WB»V?ÓÀwì¸t³t[µpSÊÜü^¿ºoò:]Ç-e.)Ç^¹-Þ;÷«¼É êt‰g¸?àe»¼\`W^ÿô¤QG¬ì)£lôMP»&k†Ç“£íþˆY_ãÙ’šìI®ÿIûêHþ”ìQ¿ô´€ -/)Ðhµö ‡¼êÀ@ükŠiÙosƒÌ’Ô)Ó¡B2n’ÍñM€óô šX燆§‡ýÈx²ˆd*tÞu÷Š‚6ƒ·3¸•¼ÙpëŠo$±9üÆ÷µî hi¶NÐæ¶ ÷É¥TÓ_€ªV—YXâÉ Ôò€’!•à%Y{¿¿P5í|£ zY£É]kÆl— >ðR2k¥U?CPl”Æt~AæW &!>‘’î]¡j¿Á}»~S™ CwwÑIqŸÕL)h6”²«]º`Éyql +ÌJûJžÖb„;wU÷3n|xû¸Ø$û^õM.«²‡OIF2xýtCÛÍåþòKÝd;.è&ÜYgø0¸jÿa—lÄý×%ÅSðñõØy(ÏŽÜ°ÝKÏП>Ô8±p#—˜Ìäÿ•ú¶_ž|ÎTnö¹öƒFç‡\ÞEƒvº—æ¸F⾫¤Ej^í³ÕêPË2g´©¦€úêö¢d2ìñƒè’Ÿ6`ö;¾2F"Ç,|ƒÍñ˜[þHV4ä…Ö¼© Ìmý&=КÛ8ej¹¢øº ÇJ÷MôV»ÝÞ„··´€/)1Nô9O»h¹ 8€a‹ZòLx±ûõ[ÔÎ竬÷~KEˆy~¹ZšÐ= +c”d{ÞñJ´j}$ZãŒÛu#Bè"ò gë#xôç®öíÐK •íè'þ¤³ÒøË {„²gò_¹=‹FGbž9þ…p9endstream endobj -4243 0 obj << +4365 0 obj << /Type /Page -/Contents 4244 0 R -/Resources 4242 0 R +/Contents 4366 0 R +/Resources 4364 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4241 0 R +/Parent 4347 0 R +/Annots [ 4375 0 R 4376 0 R ] >> endobj -4245 0 obj << -/D [4243 0 R /XYZ 85.039 786.531 null] +4375 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [498.768 228.694 539.579 240.383] +/Subtype /Link +/A << /S /GoTo /D (PolicyMgmt) >> >> endobj -4246 0 obj << -/D [4243 0 R /XYZ 85.039 492.496 null] +4376 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 215.145 267.944 226.834] +/Subtype /Link +/A << /S /GoTo /D (PolicyMgmt) >> >> endobj -4247 0 obj << -/D [4243 0 R /XYZ 85.039 424.75 null] +4367 0 obj << +/D [4365 0 R /XYZ 85.039 786.531 null] >> endobj -4248 0 obj << -/D [4243 0 R /XYZ 85.039 384.103 null] +4368 0 obj << +/D [4365 0 R /XYZ 85.039 695.734 null] >> endobj -4249 0 obj << -/D [4243 0 R /XYZ 85.039 344.061 null] +4369 0 obj << +/D [4365 0 R /XYZ 85.039 629.807 null] >> endobj -4250 0 obj << -/D [4243 0 R /XYZ 85.039 289.865 null] +4370 0 obj << +/D [4365 0 R /XYZ 85.039 587.341 null] >> endobj -4251 0 obj << -/D [4243 0 R /XYZ 85.039 222.119 null] +4371 0 obj << +/D [4365 0 R /XYZ 85.039 547.299 null] >> endobj -4252 0 obj << -/D [4243 0 R /XYZ 85.039 167.316 null] +4372 0 obj << +/D [4365 0 R /XYZ 85.039 493.102 null] >> endobj -4242 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F38 2997 0 R /F41 2994 0 R >> +4373 0 obj << +/D [4365 0 R /XYZ 85.039 425.357 null] +>> endobj +4374 0 obj << +/D [4365 0 R /XYZ 85.039 370.857 null] +>> endobj +4364 0 obj << +/Font << /F56 3312 0 R /F59 3455 0 R /F15 3032 0 R /F38 3057 0 R /F35 3036 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4255 0 obj << -/Length 3177 +4379 0 obj << +/Length 3283 /Filter /FlateDecode >> stream -xÚ¥koÛÈñ»…Š¢D wÉåí°\/‡:Ic_ƒâî>Ðm±¦D‡¤Îñ¿ï¼v¹”è´è!ˆ¹œ7¥üS‹Ü„Q\,²< M¬ëÝY´¸‡™¿)ÁX ÊÊù¸9{ý½I* -‹¨XÜÜ9:Eš"]Ül~.8ÿxóöÓrÇq`Âå*Ëòà͇¥ -®Îß½gðår¥½¿Áѧ¥Îƒ_þzóãÙÛǂǤŠcdàËÙÏ¿F‹ 0ûãYÆE¾x‚qª¢Xì·&‰å½9»>û‡£ÅsÉ‚WÍ×ÄyhòøôÀÊxVJ‡±Ò‹Ì˜0M2:ñ}½‡£ìéïýr•Dið„Ǫá}Ø2àêŸ&ø\ï7nñÄ„Ôó|‘ósØV8ÈĪáå¡AZŒÒ#´†z/›á>=¯¶¥`=°)‰§.ª¯ÞLIDú§¥Î‚¶ÀÆ£}€÷ÇÇåŠædQÝã퀤V -YÐÁ7²3лÅíˆ_dn=Qqðë¸Öåyp …ЮZÑd±¼mª ãLD‡xŒ·nÍ}M"°{ò(ÌmIâ¯D¦´„4ËNÖoZ:ÖÚsG²Ü#(hï½¥À· »d° Jo¨ºi´{VîH­Å «×ö,ÌVø’†G*LÌ·­Ð¡N&Ê×Iœ‹bKyù%RÙñf*JÃÜäßÚÍ¢o7oãvŸIÏ6¬Õ=Š! Š¯¯¯ø–…B’hœ(Xâ¬=ˆŒ÷‚hûvàAW}Áû©ñânwÃs'È«†‚¼+ù²À~éÀCçeaIl­Ûð·MStI Ð’Pgà â(Œr¶ósÐj×广-ùõ#Ð|sÉc§»MÀr=È Tƒ¢óëgR²Q`+¾ò³iïQ•pØ“°Ð>[²áðÛŸa:¡Ü‰2òMó -F p ›²§YÙ•²ÏcÇ(¢€»©Ìžûj`ïd}ÃÃŒ² “(DÉzm7"y£á–"jt€ø”“[Fmáéׂ-WV}e?Dd×Bjhy”<±Ä^2­T™0Ëôÿ<@ÁMdfƒ=+Â4Ã\ƒªÆ$–nTaŽ®¾–»z/º¿·ÎÒ3GâüAÑÉrº>Ñþ¤0¡JÒ…§jÿ¿Þ¢i¨([¬\òô»LIƒºèo;£’0Wc¦#Ï@))’Æt3&„«-e;y< -rIé -À Œ¼€|îת¸¸Ücm”«dµTJÿ|»Ä’•ÈLÅN„YbÓ":݈¬7Àÿí'¥„8sÖß–ô§«ËÉÚÌË>¯1Ѿà¨qèÝmÃŒS*6 7/ÝjžHöQþ¼ùùz8¿0f†É¢-:“„N¦–$"•=TËëFx×µ ¤I¢É¬hb+´<{G’”ÞÓijLô§ÛŽW[KƱŸ±Ã+ÙçDê°Î•¦–‡™À®B¿Ê‹É÷èˆÌ½sé¼zÍ»•qm mÓîáž’ñÃ#S}ÚV{Æm½¼QJ.÷©%¿¾¹ yÉgªwšÊmFÏ]é,6rVEíŠ5ë Ò°‡?=ó£çìûúVô)6ŠÝ Q§nÐ0kˆE~íBp:Aí¼@‰L$KŽñ¾˜à¶ë–b âÀݱE‹²œù¹/ªûR72‡áÅä¯æ\K²8 ¶˜nªà¾_µÝ1BS‰ù"‹Lžä -qPòã^RAvO‚ëü¸ ‘q(*±éÙ·péi–ÿB£„<˜¡Û–EB¥«vDCâéS'ô¸O¤”ë®$Jo`|ÉCÅý0ëwïAfÎæ¢BLVEè7ºNXöúûxR.Di˜@%‘¿0Æ4‚y#óT·34 uL£TPþ:CBiH-Âûj¸@.ß}¸f>÷ñI| D=ëÇ” -¼¡u+x¨}¹«:ö6LðVl Ñf -[sãÃ9;×h°²o¹Ý ’<4qâç; +ƺDYÇ™xF°Égz¶›ˆë¦öÒÁLZ&°€ã0#Ô|²Ûºß2X´„â¹(/?Ó>üt]™,vŠDóW!Îy%ø}¶HMJŒH奇 «ÒuûœÂøâØÕ"p…Û=©”u’„T«*#ÍOu÷R ò²w‹½òÐOÓ÷cšx›Ý ÷ÒIG–åGìÅij“ùì”çÛLSB¦° îÿ{LqZ©89%àn’KQ)—.’q8ÓÔ3OºŽ—-shm-µÊ'w}.°Q´›t^]r¶BʆÍ:ÛV"-‹EËüt%·í6ƒ…–Ô~à·Á6ļÖn^øõ‚ÎsnZXXŲžóDŒ8ˆPòüI²@äqÙÇïMâ{ÉÓG))ÎLsu¢asuœîçÒpÄúîx£Û àfÞÝYvOj)/#ŠUB Aë£*ášžÓÛÚ0"?<'mW…=Ú£rCñu’íÃx’È|+Oºdܘò«ø¸BUcq ŒdÃÔMÞ°wT“ÄWI¿™´yÏr£è<̨ÏÌ57€_I²›Õ”oqF¥­¶c5S2„>Ѭ­ø´ ¯8ÕsÝ ¸Ç¥˜||`ýܺ>µ–´^Aˆ -¨ãfe¼&N#®'-µnÃÔ¦ÒÇ…±öGäTH»–¿Ÿäø‡’•w$4len¼Ó—¨½ ‚§tøê)]ÈIGQü‰¿µúK‡zWÁ½€_ÃÒ£gà‘ÁLI2Z>É–,'A¡ë±w_±:ÛS>…s.1X.)+ø;1çûÛ‚9¥îX?=d—¥ÂøÈ Ú\ýÈuW¬sO%ò¹H>R)YΘIÓfGe]ÙC{Wn&‹ñì…rˆó¢Xóuá“=3 N¿Eô©çÆó礹OÛšM€§Ë¦s¹ï†ã ‚¹m¤ 69ŸJñâý¡Ž‡\нsÚHÍ(>þf2£n$"577Ïü²¥BËI׎Ç~~ø¶¬â.MãÚÁ\÷ÁèyÉæ5ÿ¡‹f«á¿o8žê3ý¥Øë~"ÜÓ.–¶5"]éW¾½RnV¤z@ÈXõ -Í|ra㇡—/üÖ•­ØaBv©Dnœ€ÇñÑî¯9 gýƒ´åOoñÔ¦@½A«¸mª?€Qö®ul¡ãZÁ]N#*µPÙ6üJý*+¹Üî+i׃lëkö\ÐãŠÙ~ `}Jf[b¤OßÉ—ŽÞóŒ`U%)$.¯ý¯~¢c/»Uø©‚¶¨¹¨–}ÜkæßTòaåØ7"¹;¡tÚ¡^ú›0áçÔðŸÅò»~\â5ûÃ"×óy¹„’Ó2Cß-N¾ÑÛ¡œrü—Ó,endstream +xÚ¥ZYoÛH~÷¯ö(ÀbØ/ìøHf=;³±Áb2´H[\K¤CRQ ìߺš¤$:YìÀ€ØGuwuw_U[ÍøS³$ô“Îâ$òC£fËÍI0{„žN”P3ëQˆ]çw'oÞ…ÑL~¤³»"¹Ëõ.þqöóÝÛó…1Æ ýù"Žïòý\y×gW7Ü|1_(›nî°ôa®ïýOóßî~måûŒ[pƒôåÏe½ÉðÜqirn`¨4ÌÙÔëuÏŜ΋--YÙ1džfÃÆ!/Z–Ôšw„ÅOÅØD!Ú6:¼«Pº„-Çú…+SKR‡[En´€'ï¸{GvpÍ•ªîxI¶B8×÷àð­¬Kb†ßBnö].3™£qò’µu%;+Û‰í·«¬)ÖÈ1‹:œÜMbP.-œ€» ÐR<$Vu(·½œî‰vm^_¢œ‹é}‘¡v²f_AÝÿî=A'ôüùB×”Y‡Öžû¢„]Ÿó¼¿ é9>ŸŠkñ`íz÷׃õ|7ZÇ~òè³e·>©ÿŽI|Ïè\m`nÀ^£ ŒôØ]+w`ÍÖh]·Âm©À¦äRš ±aEÅ©µ”qË8ÓnÏzt#;BÝ·Y +T8Åf£í¸&v…YwC±|‰‹“Ì "Y{gJÒ,>™˜];nD \SYѹ ½Å2c“æ鱩År"5˜šŠKõ3 QÑðWÜœÉðŒ«—bB±òèVåºà*øòœq‚§J"–™;ûµtßóº\a&j6ÈÇýº˜8 Ɖ¸—Š!„}$Y"ä‘2|IÈ5,}tµ£>#ªNŸ‚0Ⱥ±÷V¾S|߈šA‰ S:è+ŒÈCy]?“­9(BÐH ¹5\]²#ˆÓü×ËNtâL¶<¢tKá¡„ +Ù¶šnÇXž¿l -],~Ì‘læBÛû`!¢c·ŠØ”"«Ú.0¾ÿB;â=÷ t×ÛuÎMMÁ@€½«A#S÷v›*PÜðKH°Öå  818>‘Ë÷×0éÙÞ`ÿ›wf ømì+­×ü• ö0OâÛ$”þ?ªû‰)FA$$Ÿ˜@_»9nŠî™¹z |«À«²Mggbð|t5J®H VÅ(M8:Û8@£ÔÙÑraÃ=úì.$¡ÌÅ:pÛ¾ÒÝè€Å”Ü«bµd9 jfÕ<ñE’øA’ŒaÐáê:^]ûDš°HRéÚàŽËŠtºlWÜÜ›N5ÒBÀ%P„¯€™ÄoVå®GV{—(ç½) ½3„n ¥ð–I»ƒH@*˜ûXÜzsì‚$ þð?ø±rUGanû:Ò0K¤ý0¥¸”»šG‰g?üð ,.”Ô–€nYWˆÀ‹†1Æñ¿>!f iê<×sÖ¶;Œ¹!EͶp‡þ0ö“À9L¼ÐSµ‰D”TèÇirrü¡½ŒaaÑŽ›z£G)Â؉X“‚FíðÞÃÙX%´Áð‰¢©À;cQoe4ý3P§÷¦"ÀÅö”ÚÞð!C×#Yp(9lܾã/jv_# ÞSEk[…Ù7ºjŒÎ ‹ä@Ú”Mâ©xLü©,‚g;%$:†+ŒS¹ðDÏSVÝÌ MÍW8?« AÖzO>°×1û°e’èðîã~'"?"vâÝ¥Ñ{½GÚ0aß|tAÃ)¢ºìV%ë7eë¦Èò®@•™2þô±:t»[E§@‰Ô¹Ò« óפDrIõuÚ!—J¨83 ãLSŸ»óg©ÃY¿Sn™³2Sµœ­[‡z‹îûë §9å/ƾÁ…—Fs”¦'\&6Š…Àå¾bK"Ç8T´ nqQo?ç(Ã\YNú×Cò#w¹\Î¥IÐ #»°2ÀÂFN LÿìÖלæ'ÎÚ'A¹­2k[m}NfPNõ¡îÙ:Å»·ÃÕè© Zç\%F™,µ[n~ha—$ƒ}Oˆå„,r7ÄããAŒŒ£Q~!Â_–Í¿cò„÷¯ E7å_ã+ØwñŒòMc6˜ä¶šœ»Ù•pŠ`/¨) +œÄ¾)ºå‚[ù„pC˜¦Îßž¶«#<’ŒÀR‚†eÃ%F5ñ^ïœÄvñŸèËŽ_3@ÿ1Ÿqÿ1£éîË™hCQå>WFp÷ï07ËÑaq~{)ƒ0—&91¬×‰R‰ÁÑúËR¸—> Íù¢–¡&å]ËõšKÎöyÝÁ¨s²V;Ö¨+ÒfÇÝã•Mç“8[sìÝèÑÂ*í=“s»¾á:ð­+—lV²Æ(½ÃëG‡™°.,çBYsëðTf)##I 6’>_DI@ÿŸP-…`Ó»:ç]¬Q¹+5~vÖìó( 9ÎÍÑ,¤äŠà‚÷ˆÎ|@úÑHÏ ¦äõ l¨±.ûFX¦.òr‚b€G=6Æ-唊b¼ò ÎñÀe·ËfÃÑV09ǽtÙnU¯Žrchݹ\x·âÜ0†x¶‡ GÑî`4þ">kxk…í¶)&†’ìÀÝ–`Ðçmqàkyú±‡ÐÆ»ºô'lµÂ§wL[k‘¤ß÷_2VûÑ(Rø¦åÓC…f/Eö_Á²)endstream endobj -4254 0 obj << +4378 0 obj << /Type /Page -/Contents 4255 0 R -/Resources 4253 0 R +/Contents 4379 0 R +/Resources 4377 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4241 0 R -/Annots [ 4258 0 R ] +/Parent 4347 0 R +/Annots [ 4382 0 R ] >> endobj -4258 0 obj << +4382 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [243.979 292.112 364.253 303.801] +/Rect [161.305 442.548 230.355 454.237] /Subtype /Link /A << /S /GoTo /D (DMB) >> >> endobj -4256 0 obj << -/D [4254 0 R /XYZ 85.039 786.531 null] ->> endobj -234 0 obj << -/D [4254 0 R /XYZ 85.039 514.811 null] ->> endobj -4257 0 obj << -/D [4254 0 R /XYZ 85.039 482.593 null] ->> endobj -4253 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F38 2997 0 R >> -/XObject << /Im1 4096 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -4262 0 obj << -/Length 2577 -/Filter /FlateDecode ->> -stream -xÚ¥Ymoܸþî_± °¶¸•E‰ÔËh‘ØÉÕA/I/{@‹Ë•WÚ]]ôâHr|þ÷7o”¸Þµ[ô’+’ÃápøÌÌCZ-ø¯©ñƒ([$iì›H-6ÍY°ØÁÈ÷gJ$V"²rd^­Ï.Þ˜x¡? ²Åz;éÉßdñb]üì]þýå‡õë—«(Š<ã/WI’zWï—Êûáåõ;î¾\®”‡]ïÖøõã2L½÷ÿXþ²~{öz=™à©¢ øröó/Á¢cßž~”¥‹{ø|•e‹æL›È7:’v}öñ쟓.Ó žuj¿Vb¥2? Íó>‰c?âÉ'!Œj?Ò±ëcüX'äøGy—]ÓÀ¾»'Þë¾ï–QàõÃS›-'¬ ÀÔÀOƒèySµöSØ–kªò3c\SUÆ;¦*O¡½&ðÎáû›s6vßy‹Öv#wÝÀOà•Ü¨ÚM "wE‰2vÆÐɃ¸ë|³¯Znó¦|jÏ -¼›þ—mÍ2´-eŽQ ã~îÁm½\®th¼ó&ß,ÃÄÛW`š¢ÃÌÚ ÁÝö!ÇóoaD§Þ§À#ö<ÀÐmµÉëúú+Æ®/ þÆmâïE9’²‹[ÜÃ}!êÆü3*+^w܃ŒØ°ízh4Ü趬Ì8ex‹k4¸¹’ ÎhË÷̇ã âO2Ÿ%|çhßír…æ´/ƒg¦<8xïÍ2¼¾¤îW¡ÿŠ'¢Kr\¸`Ýݸ/{rņÚûh57Ôü›8ôßãn:Tt>ò”M_æc)æñžMä%â{â ΂٩ÊCOõ'ü‚Èóm˜ø$ì_ïÑ­*ônñ(º›ºl¸] üÛµïéÄWj>#yèÓ¾Ûõr,(v7Ø` áŽ{·F»pÉèë–©ÆsˆÓ€²d»:ë|:.„UY;»Wÿ,Ë÷[;c3Ö¢üØ/—ÖÿqFÞÓGþ‡ð?tí»;‰2à(Ã¥èF yÜ;,sñ&àTYâ‡i‹ã¢_«Ûe‚é$xÅaÉM‰z×)‹êñÒ´1ð\f=n‰’„ýTT±Kž°ö=„:7ÎþåTÑI«1’¦ì+áµïê’K™]Ïѽ÷€WèÀ}‚…÷ØÒ^µåÞœy‡®ÊâByáÞ*8q¸ëËS e8žK7]}¹ÙŸæ3„ÖõÕŸžH¼Æ€Ëãø¨´pJ&0'+-€*ÉÀaæI54)5ü%Ò‡Z¦D¯ÓÀOÒ™~ÄÚ©_@;´»uì'Šæ]‡^Ÿr¢»K+ÄR*©‹/ å:Ë"q¾ÉøyOÔqqݨÅUf.KEíÊÑË%)uQhŽ³0"I8–¸Ÿ ¡Õ×ðñ/kGáÛÕX¹'} ”6¤:s©)ˆÜuCàN± 6Ld¨X¢{ÓQ>i˜Œ¸ëQ“F‡)¥ç€+ª¾¤Ú†9d -Ʊj§èš·eÒÍÅmnS”AŽ§,džOÒ5çd÷¼tf|œÊÀÿ'„¬ -’Åjb€â!˜>ËP4SGÏ/Å~*Àâ -ñzÛU-ÕzôÝŽ¹TÑ59ó) T -P¢¸¹À&çl3À“+«†‘”í„Œ!"m`@Ý];>‘t¤}=Kpdžäc:!íö?×P¡Œñv%ÓjŒ]…Òhïöþ“9¦8ËkHÏÅ7i9Bó«-£(?1 ºmçrW!¸Y·üîEüŠÑO.l}t½ï¿à!¨¡ôû‚î)Ävˆñb߯œ -6ø@° §¬ù¸ªnú‰Y9…ªÊéÔ(£««™ƒQ–†m@XÌ㛑E…ü@¹ÌY}Ó¤ß*fãTð@ çý‘6Fe‰k3ªÇ‘Þ®™Ï耱œ—³ŒMh¥’ŒýÝ0Š©@ÜÐŽü󓔊RŽÊß",¶Ôr  Ï… Ä°‚óGÇ¿í,yrΣI1Qf+QðˆÛóÌ-q¼F¦/0JøÕåö• ˆl™Æa‰Þ²hÞòQÏæÄŽA°ÏQåש3}…6Ž&¹µ²·CE®]ú;däI£uá@ .^}Xlœº‡l*dƇcçKA/\ZBº—#Pz춎¬vï »ž"ãö\, tŒîræÀ¬Á^7©Å÷OiäVüdœJWêRWh0Á9¿"p æÙô]Ï›%ÅÉVE™ Daô@ @¨æ¯©¢`cÜKbŒ A7%‘œE°ÐfÆ»ÜS‚߉ øTO¨¢ë\YšÒ³ vî6¹†ŒìrÜ»Y˜SÇ`¯lØU1IEt§ò.€=üºBÜ,’¾éxD>ianvhº SÊ–;I¾ËÉ*ÿ‰2pÅôÙ2ïÈbÁ? w\”Ž[ŒÀš8u¦½ºZÃG¾éƈ"ìz*/L·33å÷Œ˜þ´%E¶Å)°ìU´“å‰féÐá¦vhnL…Œ^Ã|WRmጽ†°8ÐZ^ÃXyk[pHŠNñÜð,>rÃYè¬éÈáÃ!†7ñÑ‘ËÝXŽj®Áƒ˜$T"&Ü3eÕ;P82šÎ`<\øôó‘}Ù"ÜbR-lê¥U€i÷ùع[Nl ‚"º¹uHšž µÆ½“IÏ)­D;ƒˆÌ”þ{ÇßÌQµ3ŽÚŒ¯¯¸szÄoKlµóò¨60•îËqà´ ›/nXO‘ùÍôÒ) Y3¹‚MÙuz^L’LÛ@ˆ<× ã3< –›M– †ùšÌØæ<]lÉ\x@¾OâÆñ›ˆ)ÈžPfß•@Âé¾´RGN¦tΙs÷ì¯^ÂïxþQ8!¦ß•ã+ºþ¿ÿÈo¿\h,¡Ã×^rk˜x+ÏÛ]Y ?Ãè Ô4½¬Ú·J¤bhJÎïØüò܉ª®·wúÇOÒ‰<ƒrÁèj¸ÛšÁ:b(C]?OeÌY–QíîyýDVŽŒ¯£èôŸ8èo?Î[’Ÿ¥áéÌn ÒâD[c¨x¥ 6Qê›4:añï¤wðendstream -endobj -4261 0 obj << -/Type /Page -/Contents 4262 0 R -/Resources 4260 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4241 0 R ->> endobj -4263 0 obj << -/D [4261 0 R /XYZ 85.039 786.531 null] +4380 0 obj << +/D [4378 0 R /XYZ 85.039 786.531 null] >> endobj 238 0 obj << -/D [4261 0 R /XYZ 85.039 766.606 null] +/D [4378 0 R /XYZ 85.039 665.247 null] >> endobj -4264 0 obj << -/D [4261 0 R /XYZ 85.039 744.844 null] +4381 0 obj << +/D [4378 0 R /XYZ 85.039 633.029 null] >> endobj 242 0 obj << -/D [4261 0 R /XYZ 85.039 744.844 null] +/D [4378 0 R /XYZ 85.039 250.662 null] >> endobj -4265 0 obj << -/D [4261 0 R /XYZ 85.039 709.638 null] +4383 0 obj << +/D [4378 0 R /XYZ 85.039 210.801 null] >> endobj 246 0 obj << -/D [4261 0 R /XYZ 85.039 459.663 null] ->> endobj -4266 0 obj << -/D [4261 0 R /XYZ 85.039 427.445 null] ->> endobj -250 0 obj << -/D [4261 0 R /XYZ 85.039 203.168 null] +/D [4378 0 R /XYZ 85.039 210.801 null] >> endobj -4267 0 obj << -/D [4261 0 R /XYZ 85.039 167.758 null] +4384 0 obj << +/D [4378 0 R /XYZ 85.039 175.595 null] >> endobj -4260 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R >> -/XObject << /Im1 4096 0 R >> +4377 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F15 3032 0 R /F38 3057 0 R /F58 3380 0 R /F35 3036 0 R /F62 4159 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4270 0 obj << -/Length 2397 +4388 0 obj << +/Length 2302 /Filter /FlateDecode >> stream -xÚ¥ÙnãFòÝ_!$LÍ«yì˱³O+˜‡$@Ú"%qL‘Z’¯ÿ~ëê&eQÞƒ1»«‹Åº–?óàŸ?K•ë…Ù,IcW…þlµ»ðf8ùÇ…/ AYŒp¾[^\}¯â™ï¹™—Í–kK'ó\•Å³eþ»sóÃõÏË»_ç‹0 åÎI’:·ç¾óáúþÁ7ó…ï èa‰«_çAê|üiþçòÇ‹»¥eaĤ†ÈÀ¿.~ÿÓ›åÀìžféìÖžëgÙlw©ÐUQ(ûêâñâK‹Ï¢¿5%¯ -SW¥á©À¾šX)7Ž8ovº¬A0?sA¦û[XžÓ´ kV ˜»åü‚ -Fé·ãŒi¬ª²¨©g¤5¼ß6;>ä7š¾£KXÊ»ºÎå£Åç†à`€(ÌÒó–9¡×Ï0½ÓøåW>xš/ˆW° èhᣠ-3’¹-:$XôlÏCWÖ^%°Øòš™…E͈먓=Q_¡¸H DÎA;Àq_V%=øS®á"H\Lˆ\,™~4¨¸£¿Â•ùØj$$»®7ÅgÑ”áø‘Ô‹WÔFs0tPY(œ -¹jv;AõœuÇgë¦`EžðBÿ »ú>{ˆ…n²ƒµMÓ=_¨@ñ7p±)úªYéª+s\~üéöáúÃÝ唵&t'@èKæÅŸâ…£ûÓw½îËu¡‡¥µj.kñ3ÚAÓ:ÔŒ -0WÍÝ1Î )¹}fœß®^yóÞÄß`5èÖx.¬ÿð”‡ly‹Â‘^‘?ü >Ÿt.Sº_3¤'^…‰‘îÉ{ä;ƱRóêÔ{ºãhGV0‚vÍVÞFžÄF‹àˆÂÜF¡rW£ãaÓóÚRÃ~ªdÕ7üDÏj6¼n8ƒÈI'[Á–ÈLjZ$‘GAtê2M‹mÊZWè¸É ö06á‘8+Ž†dà, SHdæQ¶k‹œñÖ­h ñz“`Í»j‹¾sûü‰¿ó‡çGULÅÀ瀭«¾hQPŸÍ§@ž¬²Ü¸ÿ"†¿=“,Æ®z*ö[Ãp²h$i |û3ŠPÊYÙã 2E¢i÷LYS -ÊT¤÷jï‡JQ§¾›¡oÚR¤BÏMbNˆP”\ø~*SÊ“ü'ÕW[rPÙCT.0,çœ+¢W•²©›ZtˆU¢³‘C¾ÿ®ÎÙ’e±Éñק­Éè¨g/vîñ‘p:y•uÃGŸÙ°²Ê‡S[à†—7¶8® r´v¦Úृ£Áz7‘Õ z!?PÐK©¢kÊDD\ȯ8?ì1 ö…â’•í„æÍ7¤p˜<@5áÿ.MÚxSîʉ7$ñŠ¨ôu8}âàŠ"çÓV÷—ãRY¢8­7¿œ,»ø‰„ÛSkò„ [r€cÇsÁ<>1 àñ“´‘1.~¾½á—lÂà–º‘/¤ú k>!‚H¹ì!²eðØ–¢ÔÙ‹Eä8‡‘º‚µ!×"PDGTðÔ~Bm‹ÓÊ€=³dʺ®uÎu?È¢I~§[-—û^PÙ=‘PC­‘@?Ç'$GÝ›Oœ8`w̽NVÊ)§·C5ðG<ååÊR&ZX*å¹ÕB@Œs>qJ2ö©4ŠsÝÕÝ¡ÒâiŠÅWvÆ7kÓYrñä]÷*45S‘HÀå¨ö³y¦úÆë‰òáSùD¯L€àšŸƒÀ½€l:0†õËDM¦Dõ¶-µ²ˆ¼Ó„rЕô:ˆ)m¯& <â«6<`-Uט›x'AœZiÕ´Rœ{–6 ÉHÐë@uó*"¬@¿%·PɠܳȈâç*µâ§6u#ù06\õ [K#‡4)+ ð(ÿò¶¥Äݔޑz>»¡Ãl¥iß½œÓµÂ~aOé>ƒ ¤>Qï§'ÍG¸\>ÃÜA=xuŽ©wV5Áq3Ìl8VØØš°`£ªìIMjõî­aÔàËLF_•ö×ÿ«>$Éá«0ˆõœ²¡÷ÿçÄ ólçXÈf‡–VÑ>x#Ð7}?k½“שb£Ì¨ËãùgÈïî?>" ‘AõŸ—ß\Ê·÷vÖ,êܨ+gdÈ­§>@=]’ðt«”ìá<†.TBU}OCªèþMkä'h0›…QBw -ÿõê"tƒdúâbah-FÄN›(? Ý4 ìQÔÎ7,NÂúrp™‚ÉxFKF# n¨¿‡—äB¢}åm)`ÆmHõ°½bû¬®öš›Œ—œì$œHl#íŽÃ­c¼=p‘¦n’…çârú.à±!WPlkà¸ÙWðÞd(D±·á³¶`× ’Ñ[׈2IwˆCiž³ŒÕÊ®.iÇf˧Úp)';î¹ãíh"†Õ¢¨ùT¦\ÏyÔ£zD¾hešbÞõœ¬ ¡XÑå>.”âhtÍ7± Ä°‘Ö®*vè70SÄ #£*ZÉÅou+¸«¦îPeC5`“ôqÍ·MìLÈخ߈+~!í(æܬÄ‘«’àÝe„svÖ -Bp¸Dg-%³Öõx€ÊKšpBÏÏq$”ÞåhÀ9;5^àf¡?55)EƒÔ@Ý÷ÅnOþóØϪٔ‚Æ ê­ñä¸Æ!d¸s‰Gב°ÑüâÃ2ºúü“a§—X3‹‰Gc˜!Û!Œ(B`žuÓît%Ý+ò¦xÕ‚Eñ>ɪ¥6Ñ/¶|_bîü\„ùaèFqö®?pÎF˜ï)7KÂq„Åaä„2@ŒÝ45_cð*™À¿Õú ¡Uúü…ùÊ»Ü8çðÝ4`Uýõ›hû%¼>÷É·}ÏY/¼ß•ÜõÛJÓ ÞzÔIÐ+ãìï{<~!&„TÛ9º‚?Îër¼¡h䬾í1h…úW6œas#u”¦b=ôÈUƒ´¬“!i+òW—g4*7 -' ÿ™Ôÿõ»Ž5W”ºYL[KAdÇId˜!ßÊÞ2l~ÿ9åø?ý˜˜=endstream +xÚÍYëoÜ6ÿ¾Å¢W ÚCD“õê‡;i$v®Þ®h „^É»jôp%m¶ûßß<¨ÇÚr/¸Å%@D‡Ãá<ܨ¥„¿jBúÉ2ŠCøj¹)r¹…•ïÊrÈ¥2 péÕzqö&—JŠD&Ëõ=±¬ÓŸ‹Î?¬_ÿ¸r}ßw±r£(v.oVÊy~uÍä‹•«$]¯qôãÊ‹›w«_×o¯×“ã\-tèãy¿/~þU.SPéíB +?‰—K¡’dY.tà‹@ûv^,nÿ¤ðš^ò®™[¹¾ŒD¬"ˆ8ÖSž'¼Ê^æ*|fJ ¥Õ¬fp¿ÈRFÏŠ¡MÄðÈrŸJ „/ƒXÄA48&ÔK¥DSÇ\×`ðíÍY:‘GöYþ¾TBê$ñyu2&=ÇMD8»*Õò²–£R~"<ˆŽPH/´RñL¸¬w+TÂB;¥Ùìò*ã1› êZï+V›ö­á.óÙîëvvO†;þ0°F{;¦V¦Í(¬›œ|Xy‘Sc6ŸÚÎty]ñ^:§ 應Pà +WÁ7¾Ê®V¾ˆ zÝ!Dÿ÷˜âÓgÿÿ•±‹(ö¾ØÌ=Ëa B®?ÿW±¬<Kõ…Áxο®¯þ#г^¹Yuªž½ñäd'DDöáíŸó‡•¯ ‰ïä/IX¾¼å# ËßÔ%Z¢¤˜=9¦÷ט‰ú_”¯¯V®Ö¾³Í:tu‘‚/aIçãO«Ø‡RŽk¶E“™ôȨȟñŸŒ·þpõÇâ_e\ÍñRã,ß~¶³/9 ]^ Ñ…xøŽnø´¦B‘µUó·:¯x%­K4þ ²M4F±N誛†R'ís¨Zy (f +t’”è+åìaõáþ)ò,eú¦® ‚|Ú™€|È¡ ¹^’8¦bJFÞD=¶‰Y'è>pÝj7žO»IæØæD€áDÚxGKR9kô +n㶠+\ç$ ã„.&¾ém­BBúp‘£ú£ðÞòtˆzu8\Uèä¡J;G<=Ð[ÍÑŽkþ‚IM—ñØð‡t¨÷2ëºçØ€ }ªoÜï :£¯Ç P9#4ïZÒÓìÞª€wHí¸mŠ.?ÎDÄiüú^H—€¸¼K- +/€BH¢¡?·â%R#‡÷‘5SÞ‘¢y‚B ŠWÈ„ã‰íÎX}Q$„aŒW.¾í·…N¯Ê`à¾ÅâS¢îpÄŒ.a|ÁÊÒŽõÎÞñ¾.Ðf5n8Øh›Ø†k~ß—L•2˜:P=+r ¦-ë Â’) +‹ÜzžWJÍ'^;5 n{Z1£®ÚïfÂ)Bñ£å;,bÿ€ ·¬°ˆá€Ê-þΟ³¾ÛÍ âäx³Šµ³oº!C@Íœ£LËd0=ŽÙ÷§Ù‰tÌ2üŽåRÆT†Ú–l=Üw7MÃ|µ=Èð”ñ-êòiÛÔT ¾™hb:{$§—Vr,¬@¦Œ#³j™¶—1W+mEu}Hܱ +ÀÄ`õÁN¿aA;ì«0j)SæÍÓÌØÈõ©ˆ¦‚GÛ¬/ 0é¸<w™‘â­ÙÚ„sƒ$p.v”â[«¿b=D×­TïXš}; c=sÇ–C<ëvÃ%úgHÁ¥å%“òñÝ‘Râ BCýRÕö¥Rš®ë½H Ãα2¸÷°¯-Äë—†ªãŽ*,·ÜÑÄLËW \‚ßfs¸€x|®ñ-®áÒðãöØvYÉ°ƒº­Ëíçïj‹Q~Z%;&7¶“!úÿB•¼"¿Ï¡•$NžG+ö9ö_áŠ+nÿj¬¶±ìãAMÂwÒÖ¹ÝKÄ{ìžT ¼íno= csße ÷XÛ· µ†Ú1uâãÏ Êa¨õ Ÿ?ÿ¦åND€(¥/ã±çÜ®Vâ†Ã$µWºš‰`Bl~¨ìÅCÅõhLŒ°0v>®ûuZ9˜}í9›Y!WÁ®V“œ %·žP=qóK&(†~ËH׃h¶¶…ehRgcÍ|Tt§£g2÷8Q{z†®NðPXcºzš‡=à¢Ô‚<-Fœ…?'pZãîN*‰§ø)™à'­›Äü;éié$LÔÚ*\퉷W—LlAW›8¶à‡CŸÑŠ4Y×öø£KïXNj:Ce·µ’cÕaÜ4TM†¿ôÃ^ÂiLdººíæ@óô}šÀ…í;€+ÅpQŽÅ&8Ög ‘ÃcHG€`/Žc*öÀwê"ØÀñ ÓÃû0b圑£a:äHd{5œ{ÍÓýO/ŠQ}u¯pýêæ»~`;HÛ4€'²+˜tÀ£¦Úf)ÔóõÄ÷ÈTW¶¸à„ +Î#‹¢gŠª›¦Ç<¼0ñÐph*ÂvF<’{5XFí…3¢nÆ­t=vÈ·ð¦ø³n¯’Ñ?žäDÚspÏëK.ðLelàñ4€z`ÂBkq}bw•zéäÕÇË 8ñÐ *<½ñᔜ—¶?£tÙÛî¸W?Å·Ö`™mÞû– ;x×e¶v ?NV™}Ui,ÜÇ·ß“ÌF$/9ä™ÍÙ™ç=­{„0Ñh<èqZM2Lc2 +¸äùXºQˆ©ú{fO@­z+pA.GÐo,ÈA«¼ 5ÿ –óÝšºîþö”CÃ*ê ¼¸ó” /nÞ]^Ÿ¿ýb+H_(/šG 6z¿î´'B¸; +{y„ò±Š–GNüV¼9endstream endobj -4269 0 obj << +4387 0 obj << /Type /Page -/Contents 4270 0 R -/Resources 4268 0 R +/Contents 4388 0 R +/Resources 4386 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4241 0 R +/Parent 4347 0 R >> endobj -4271 0 obj << -/D [4269 0 R /XYZ 85.039 786.531 null] ->> endobj -254 0 obj << -/D [4269 0 R /XYZ 85.039 556.144 null] ->> endobj -4272 0 obj << -/D [4269 0 R /XYZ 85.039 523.723 null] +4389 0 obj << +/D [4387 0 R /XYZ 85.039 786.531 null] >> endobj -258 0 obj << -/D [4269 0 R /XYZ 85.039 264.572 null] +250 0 obj << +/D [4387 0 R /XYZ 85.039 548.597 null] >> endobj -4273 0 obj << -/D [4269 0 R /XYZ 85.039 230.03 null] +4390 0 obj << +/D [4387 0 R /XYZ 85.039 516.379 null] >> endobj -262 0 obj << -/D [4269 0 R /XYZ 85.039 133.469 null] +254 0 obj << +/D [4387 0 R /XYZ 85.039 298.079 null] >> endobj -4274 0 obj << -/D [4269 0 R /XYZ 85.039 98.927 null] +4391 0 obj << +/D [4387 0 R /XYZ 85.039 262.67 null] >> endobj -4268 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R >> +4386 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F35 3036 0 R /F15 3032 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4277 0 obj << -/Length 1514 +4394 0 obj << +/Length 2361 /Filter /FlateDecode >> stream -xÚ¥WKoÛF¾ëWèHцKrùÈÍuÒ6A§±€’6%±æÃ%©8úã;¯%iKFEx9;;ûÍ7¯•^úðO/S£ü0[&i¬L¨—y½ð—{Øùm¡Ec-*ë™Î/›ÅË_M¼Ô¾Êül¹Ùv2_™,^n¶Ÿ½ë߯>nÞ|Z­Ã0ôŒZ­“$õ^߬´÷ÇÕÛ,¾^­µ‡¢\}Z©wó~õuónñf3B˜ÔaˆþY|þê/·öÝÂWa–.`í+eËz™P™(”ïjq»øs´Å{Ñ’O]òׄ©2ixî°66FÅQB_±OÛ¶¶eÃë¼mÐ¥¡k« -¼,ÐÉŽ·ðm{\GÞвÌ6 HÛc“¼ÑŠáÀ§QÖÚ|X‰×v ¿c4Žzb¬äoÀEÞæPö,>öGK N‚ñÜ¡eB)ȬØ>”#~õ\x€· þIM:Di»ZeÆÌ)ÕJSC”¹ -îM½1¾wm‘8öš‹¯j÷¼h"VÀ?ºB!€ÏÚáÆÅ7ÁgÇ[«Ð¶BŠ ònv([¹ÅîP<8õ¿Û4”Ñb?Þgyã^ iÌÏx™tžMµ8IUiNµÝð$úcžãgAÑîwGدªo -ò³k?…û µÅ¤©ñœ$nÙ17,·xV’bGþV³´ÃoÈQ´KÞ$¯¤kê2³žµ{N·WȲåCe¢—7 ;™”J$2ÉX (+¾ø:$[äú è™ÎÕ]aF&öè€'h`}b˜ñHn^P’¡2d —Jw-RÛl_ÀgŠˆ¼…•³PÙ².1?FžÂ9ª±eä¨åرeÆ4†/ê9ñÃâGÙ‹–d%÷‰â¼ µÛ´Ãy;¹·}/½d˱/å.JÖu.ÝòA=Š; m%ò9¶}8±ÉKè²H{Û£\ kªWP˜]SßCõa™VïQŽÃÀ™ÛóÁÑ¢ž¥} c`ñWÙ0‡¤&m ätv´’ÎçqÖ-^µuv&¸·¶F+ßì:œcë¾ÓíÝ…¨îZ’¤LgÕ¬˜M¤Òçìùh¨bÝG•E*Ë"Ñý⟫2?v*ƒù‚;䦨@C³üœ·,ò.à ¥ýÄá©ÜHƒ Ã~ÞëÎÑžŠ'O8k÷аãÀxׇ‚ Þ1¬5c' ‘Ñ©iÌB1‚ÍÊG`ï0€— ¯@€Øç¤ç"(Œf@×r²†°hýˆ¤9j왑(Œ»9'›€ÝrsïŽX -ÓÑ'<áâW¡(h!뛫$äÄýQäG Ö+>s¦3e|ÇôPôýí Ð"_ëïü÷_J@°¨UœD(©Û®¸I« ›¶ÙJ§;N{7„ÇMæûÊÏâ‘ãYËÇéÂY(m£ÜÙº‘Ú+L(æ½äªê±×k°Ê#‡¸–²Æ?0@9(ÀE:-B¦}ÛÀh©¥+pKE×mÓ·•ØYóŸ÷-u2îÞ-D¤£±†9z¡ë‚:XJž'1ô?üîÙÜ Š%ûؤ Þô˜²Øå.tN¦qšc‚õõô–Dñ>â§m¦ -IpÏæ >bWk«2?ñwO Ê -ãÖ‰ÚŽŸœ[»aËÁzÊÏxy[(ŒžÏ¼dµ[ÍÉnpYò›{*rÆ¥qØÖ=ˆ%/-,î;œúÑwìKE]èo:SIêòü¶XêŸ+0¯)ô(*þW¥Ø÷ð¹©Ô ÜJäzÐy]îË]7<6N¼­»Pe:K  ¹LúDEñ£·ÎÛÙk†o}O¤·Ý`§'A8½&èwY—2›¦m8µS÷S¤wê¹Ù®{$>”ü‚ \G”ï³&½Æc¡¼7ù}è¦ËžNç,„FEüSîé›þs&ü¯ŸyãË:JU–—Ö&H¨Y - Cì?ì~ž#þS{¯bendstream +xÚ­YmoÛFþî_!ô +˜"šË]¾}:8vzçââäjùÐ(-Qk¾¨$ÕÿþæmW”Å\è!H´;;;;;;óÌ £füQ³4òÍ’4ö#­f«ú"˜=ÁÊ?.”p3ãq„Ko—W?DñL~d³å†X–ë_¼›^\¾ûi¾ÐZ{‘?_$IêÝ~˜+ïýõÝ=“oæ å!é~‰£Ÿæaê}ø×ü×åï–£ãÆ7±Æóþ¸øå×`¶•~¼|¥³Œ_eÙ¬¾0‘ö#£e^]<\üÛIá53ã]·ZXŽ…ü45îz:š¸^׶Ãßæ‹(Œ¼¦xÐCÕ®òª/×L¸|¸»½Äë\ý N…,LàÇ&!QŸæ©ñÚî¹ò¡l›ùÂÄÆ{Ÿ¯ÐÛ²óH‹¼å<Õ^·Bæ˜óz…“U»oæaæ =óæaB÷™ - +ª^xÏ·”@¶L¶rÆm[ç¥èð9ˆAc¼$è3 «Š×à–>î6V\Ùã½ñ¦ +¬ÑE–uàñÕrÔè©@Uz¦»Ãaü¾¨ñ¬Çùþ-:á@•D‡gg0ŒÛ¦•€ïPVðvà1 +KÉš0É+1­-«ö‰-[SÈl¬ICôfm¼%PG—4ݲíP›§²É+ôòÄÝJë˜M€ÄUÞð@.ˆ“Ôë +zÌíóÿ)ºbÍ|4z[3<›²{z²àª+†ÞÖ|Îç@™ªÀW‰bÐóÈWCÑ¡MÀh|‹‡÷bÉ-Ï¿KIæ-IÇ W&ÞvâÚ6öb p–N[,p÷ïx…RÖXî‘çx'ãÌ|ŽYêÇéWPiF¾Nb¸!•Ÿ¡÷7òc2`›( +è :N0à¶øp *J40Ü*Þ ÷$ÞoË“õ׸/—¯Øk÷d>XÁR£ì™ÄŒõYÁ'ü¨(AŸŽ]bÝrÀöì6”q\üYöâ@­p—l ¿»ò#b`q‰qaŒ÷i›—Œ"È{èÚæéïßYÂÄ S NKÒ_'ÆÛQ>Vb†ö<\å{E ØDC`ƒê/¼Íù6ð}¼…ñ ªÀ³Í)êÉ°OLÊù‡tG‹•ƒ-Üý~î’æ<ý¬·7>Ozà÷h>؉!6Z¿’5éU@r5ü[¬K|P²$L»üœ‹º(áéÕi=G*?å3d%Ñ£y?”!3£=¼ ¦ÍÄ&KëEÆD§1ö$u+Ô1˜q*5œ(òš8b +pÞ/[êWþ´{†Ñ·wXÓÆí?”TöJ0È‹Æ÷ßMÜ6ßí8¼š5Õ¡)®iñ†X”—¾µ²ø‘™W©žíÿªžS&öu—2™õíOûa2ÝßáJ£ÿZI¡ ¾Ç.³`zÔvŽüCZ{Ô{œ\ݵÈÁ>Ø&!ýÂÓ²ó¶ô°¼áªVWè>(ñ ÖÌkV—WÙÔ±ã—è¹ÚqêÁŠ†DhíJý1¼óž‡_\GÊ“Wlw‚ט +,ж¶¼Ö;V¾s/‡G™ÌBðPäñ »tYáâxœ¿?6Ö²Róž{žºl“YP"ˆ¤÷ÂÁS¬ø¢“6‰ihÎs/vh +ý-~iÀßUU•Å[éMqÂ¥òk˜ õ;ªþР[:ÍÀ™¢`b+î­{×T›BAèXKIÝcU6¾`lÝh+Š½Òzú¾Rˆeꨣ¥ÚÔW›©Ä7Yò?5S‘4S' ÒmÙ»j=èÿÜ…Y„ þäÃPÜî“Â,&Dmy=½ÔNÈ<5çé+Å–Pl»Žã =x}²ã~i®>…Að'OG_Dì×ô˜¶A ´Õ‘º­‘”zÔ–@¯5…½í^ŠIRòEªÂ©”¨µE(—±˜t|ÎÝÏÚŸjq¨*=vѱ|ƱCB45¡@Ï ”[Ϋ eR?ÕÉYµAÁbªŸHŒo"- ;Ê_çÕ ô‰ +… ¸,Á~Mú2нͨhìê¼¢Z3Rd™¶±ð'ܹ Î„… ›ÃDùAŽk![oËNHƒ/âÌ7qø×ã-–x#W•¶"î¦m ´D­©¤¦·òÏMþ…Ø*xßo~‹Ðߎß٠$ŽPŠUx›âÀóQÂ%þ@5?òmÒJ¢¹Â„$,½-Éón(ÖDjŒÖÂEá„ç¥Ê&ñÎÂ'HýÍ}{ƒÉ¤+jCÚª²š€}8Feµ8oG8v9<׌Ʒ-}îI > —pÞ¸ …%é"9Ë´ÏÉK÷ÍJrUYÂ2$…´Ë,<8ý:ûLîG j9N_ûqã)q€R$ƒ WÎÔƒ-JúŽéÄ{ËYlª(&Ì;ÍdG.“aϺ;ý܇eˆ + ׺!È•ì1®òèßدƒ…ý¦ØY|bKOEšÒ‰ªt:ÔDó¿öß &ôc€¸ÅQØ׃&Vg•/ócÿ…I7½endstream endobj -4276 0 obj << +4393 0 obj << /Type /Page -/Contents 4277 0 R -/Resources 4275 0 R +/Contents 4394 0 R +/Resources 4392 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4241 0 R +/Parent 4399 0 R >> endobj -4278 0 obj << -/D [4276 0 R /XYZ 85.039 786.531 null] +4395 0 obj << +/D [4393 0 R /XYZ 85.039 786.531 null] +>> endobj +258 0 obj << +/D [4393 0 R /XYZ 85.039 656.966 null] +>> endobj +4396 0 obj << +/D [4393 0 R /XYZ 85.039 624.545 null] +>> endobj +262 0 obj << +/D [4393 0 R /XYZ 85.039 365.394 null] +>> endobj +4397 0 obj << +/D [4393 0 R /XYZ 85.039 330.852 null] >> endobj 266 0 obj << -/D [4276 0 R /XYZ 85.039 738.261 null] +/D [4393 0 R /XYZ 85.039 234.291 null] >> endobj -4279 0 obj << -/D [4276 0 R /XYZ 85.039 703.515 null] +4398 0 obj << +/D [4393 0 R /XYZ 85.039 199.749 null] >> endobj -4275 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F62 4047 0 R >> +4392 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4282 0 obj << -/Length 468 +4402 0 obj << +/Length 1369 /Filter /FlateDecode >> stream -xÚ¥“MoÛ0 †ïþ<Ú3¢(ꣷ¬I¶[¿æ[ÛC°nE¦] ÛÏe»Ž» Ù"õ>$_}¢ á!z&ø¶+ ÜëÎÇ‚úˆº©G1šb±d0™ÍáœdP’‡æîº<þ´¼hÖWUÍÌ¥`U‡ËÕyEå—åÉY÷û¸ª©Ì¿Îš¼ºªl,Ï?W·Íi±n„$1g€—âúÖÀž9Eø£kƒ”ì -'Œâ¸ÿ~,¾—ÃYÝžƒ.k®Þ׈Úku¦r!…^Žäx"g &LÉÎ)YKÈt=Úœà¼FÕ"Amÿáö¦#ŒNÐçÂôç‘E'Óï.NvVÏÊ—ÓÁ’÷hÓ~°ÞCĤo«ƒŽ#³Bj{cÄlõE‡s²¬-"‹ÆÑ\QÓâÚŒz”ÒØ‘µÞžš6÷¿}WÅl¬c±!åˆ`p¹ü~4áLZ ù9Ò=Y3a{£sxR–[>uÞ^«­ÿnwÙ×?uù˜Ù•«çÝöáé‰#[û¿æ hl"Ú˜ÛæЄ0‡¯¶³êFzß]1í 7¯@91½Oað SÇE;ßd±}pÀ¢Vä¶Ç~â=ሢMéƒFÄÿ®$ýBendstream +xÚ¥WKsÛ6¾ëWèÍ”|¤'×NÛx’84“C’MQk’pIÊ™üøì¤äXÎ¥“™h ìãÛŇ]8œ+øÎS+•ÉæIKkÂyÑÌÔ| ;ÍB¯¡æ‘T±Å­?V³WÚx*™©l¾ÚÊjýEœÿ}öqõæÓ"0Æ+A’¤ââjŠ÷go?ðòù".}X¡ôi¡Sqõnñmu9{³: +D2Š Æûoö囚¯ÒåLI“¥ó{• ³lÞÌ"k¤Œÿ®gËÙ?“Þ‹ælu"«`ÔÂLfÚžÎ<ÀLm6å®a9„{œ»•±„¬ÈÚZ%Îó¶u¤'⬻-Ë®K®É«åX¼/›kBQv¼ùyna”ènÀºò¡r-ïm†QíKè*ÐhQ"aûÄýóºjitôB¢&”©žò í‰3†è¥ÄpBÇ™èQÞÃbBA[}¿Ù×°T?‚N¢Ä¿X€ š »’÷ָנUN¿ÁrªÅ¾?R»­ÃÍžm6yUóÆ}5ìXr­wè6>rëÿs¼Ñxlk[ÒïëE…ú`ŒÙyõ aùU…†l‹+Jœ@âdTþ„mÉžì@X§ž÷ A•ÎÕ5ž¢N#Qx® |…·ß –=¦½þNU@Ï4š£g,v^5½±Ë½?ÂæÝ婺=ñ…€ÎÚA¹¾ Š1GH´þ€GGó«Ì­S• hp¬cò MÇ¿‡J%2q›ó‘ðQuk^­zÿÛ®ëFÎ\°HÇ‚ºÇΣÂxMŽæl„eL…÷¿ÞP î൹…[u,õ›Ì8<žhÚ?q5’ êDZ¿L?Ñâ3qJ‹f=¯uUN…O íš…cÃ%–¨Á@-0˜a5#îÐ>¬m ¶€:rvt[µÖ2K"gûbCÛ²få'W;22ŽC¯ûUYÅqŠ}w@U :½¶-kP +! ·ŸçIH!4—$±#$jxÀè¾Ú¶ØžÃ + iË(|RágáB|Hq¾›(‚PoÀ{Rxþ/,±´©¸Îù“<”à ý™È¾PÒ0³R+íñÃQb¼–Z<ö@ˆ»£¾‚õfäVðŽ»uêaÚ=á‚kq°FS¤Y0§ZX.*ÿTýL"U6뵿8‚˾÷ã×llžŸ­$‡‰™Þe?Üæ´j«­îø÷;ÿ4®+Y"V£P;wCí?°¨$еGá.¯÷^ÄŽí÷z¿ò¦„I×˹©'ÀÎêÞñ ¥¡ãolÃ4]«¢s½Û þ“X ýŸfÎt!qëܵ½«½Ùwþyç¨yÍß˲^W cYc G<"^ÚH‹Õ®â±E¨Ø—«Ù¢êÙeŽŒ½[X*jä׀ᨽðo:?(#e¸Š(œû™Ò¡ÓHiñ?s ˆ-ðš´áêªxäïžð"XüÊ;¯v4tx›8:›T¤".J£'?Œþ+ž¬¯–Ó¤N2`–¬{uKMÊ}¢”œ™JT"Ñ¡pÛá0ŽF×~ßÓûÄ­…‡]’¦þ,Ë…e8PôhSht)ñ+o8)ñÚć‹j[ ˜§åIûÈûxYA²Ý ¦jJ&€äël´’©²ðÃ[–ÒÖÛS!R°Í-ÕØuC>qԘà E¥aêzD|sô€Àq ‘aÕö¯Džäžûµï ü”2F3»ÐÁ õ¹u†Ñaí§kðü Ãß*9ýõ<øïþHCo°©~ù õϽŽ:øÔ>7Áendstream endobj -4281 0 obj << +4401 0 obj << /Type /Page -/Contents 4282 0 R -/Resources 4280 0 R +/Contents 4402 0 R +/Resources 4400 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4287 0 R +/Parent 4399 0 R >> endobj -4154 0 obj << -/Type /XObject -/Subtype /Image -/Width 599 -/Height 387 -/BitsPerComponent 8 -/ColorSpace /DeviceRGB -/Length 25699 -/Filter /FlateDecode ->> -stream -xÚì½X×û¿-E@Qz°VĆÝ`#»&V”X1Š‚ÝØPQQDÄŠŠ‚ŠŠ+Š‰Šˆ Œˆˆ½»‰`”Ž÷‰çÿw˲.°Ï}k¯™ÙÙ™Ù3gÎ=Ï”sþý -pæ´´´_ýµyóæ4§¶¶6 Ðè»wï.ÓÖÖ–ozÇŽÙW¥—ƾڿY[ÈÁ÷UíÚµ³³³ù&bÏ]‚||ÿý÷™™™¼s&&&—žÓÔÔôæÍ›¥—©®®ÃM¼uëM)ËP={öd_õêÕ«¼444ܵk$ b¤’’Š§RRR||| hb·nÝh"›„hiiIÛ·oþüùì¯ãœœœhbݺu³²²ø–9tèÐr'Ožüã? -4Ô«W¯TUUMLLH²4ðúõk!ÛYzâÌ™3i3 A– //^¼°°°à½8éççG£-[¶ÌÏÏç3//ÏÁÁ¾Z·nß2cccÉhÏž=£)¤Hmmí¸¸8«[½z5Môôôœ>}: øúú–K‚÷ïߧOÒ7$ ò$öìÙCÓ{öìÉF;uêD£GŽ)=gdd$}Õ¥K—ÒË´µµ3g lÞ¼ÙÞÞ¾¬Õ5iÒ„&Þ¸qãúõë4дiÓrI:wî-YUUõÕ«WlÊóçÏUTT(®,((]‚„‡‡G§N A•—à®]»hú?üÀFÛ·oO£G-=çáÇ˺'HÜ»w—šš*puì~¢@h±å’àíÛ·¹‡d A–à‹/êÔ©Ãk=v•RàÓ¡-Z´ ¯üýý¿)ÖÒ_õëׯ, öïß¿\$Úµkçåå ¨€srr|8eÔêÕ«ÃÂÂh]÷îÝãëì€ü@¡Ššì°oß¾E‹‘ z÷îMõ¹ªªªðj¿Fõë×oÛ¶-yÍÍÍ<²~ýúààà#GŽ\½z•¤óòåKr–¢ç)ìùóçôw.\¸¹sçN__ßY³fÑ_þá‡Ú´iC™ðͼRWW·µµ¥ù){}||È”á/^¼`  - “““>¼qãÆÉ“'÷ìÙÓÑÑ‘ÝVÕíÁuìØÑÕÕ•"ÁÀÀÀß~ûâ©ÇSˆüä%##ãÑ£G¤6Ê"ʨyóæ3¦{÷î”5kÖ,+‡ÕÔÔè|ƒvÉqíÚµ´k¿|ù‚ü€JÆwOž<9qâ„ŸŸß/¿üÒµk×:uê”U›››SD3räÈ P~êÔ) -|^¿~l?~¤,ýý÷ß·mÛF™L~¤S Êö²Î@hgÑ 'N¤ÝñðáCÜv!Ê£ïàÁƒ‹/þ駟lmm^ «^½ºÝ€<==·lÙrúôéÛ·o㊜ ¡ G;"88xæÌ™trr¸ïH—ÖÖÖC‡¥]L3“R0ª,÷îÝ;~ü¸Ï?þجY3EãÆ{÷îM¾£èãܹs¸¥@ÐΊߺuëäÉ“i'ZYY•ÞÅêêê´ë‡ FÑ"†§OŸ"ßJIAAÁÍ›7CBB&MšÔ¥K -èJ‡ ­[·2d… ‘‘‘"LP2rssY°?þ|ÚÑMš4)0êèèPñ˜>}:šWP - -)Œ¬·cÇ///²›šš_ugffÖµk×9sæ>|˜æDuWeOöíÛ7wîÜï¿ÿžŠDéS£6mÚP,IéÊ•+¸gž|8sæ ’qãÆQ¨Èw•N¥¨h‘©˜½yóÙ-ÙÙÙ±±±«V­úá‡ø®pRõE•ØèÑ£7lØpéÒ%:çGvòR\\|ãÆ *BC‡¥âÄwZU«V­~ýú­[·Ž -aaa!² ñEFF.^¼¸M›6|÷tjÔ¨áêêºzõꘘ˜œœä/dº“'OR8p ±±1ßIWÇŽ===©p¾}ûy#¯_¿Þ·oß„ H||5££ãŒ3ÂÃÃ錤ɳgϨàÍž=»ôùX£F¨¸nÛ¶ M"*ñ?ÞÊÊŠ·zÑÔÔtqqY¾|9®Aù¡¸¸øêÕ«+V¬èÒ¥ ŸÛµk7nܸ°°°´´4d@¸øŽ=Jâã»ÿ¢¯¯?`À€õë×'%%á = ÿBLLLôõõ¥B[£F Þ’L{êÔ©80Hj/^\ºtiûöíy_d ˆ¯_¿~>>>7oÞ„ø€âBB¤ó7*Ì:::¼Wò©ÀÏ;÷Ê•+x=€*ÈçÏŸ7oÞ½E‹¼×ˆœ===O:•——‡\U¢¢¢ÈÈÈ3f4mÚ”÷X CcáÂ…gÏžÅI ÊôÑñ>vìXCCCî`×ÐÐ8p`@@@ff&²Te^½zµ}ûv:xûYÖÖÖ¦C†¦ãW”¿ÿþ›á>}úð¾ÆnaaáååõÇà>¥ÃCŠùå—ÚµkóvIùã?Ò¡”‘‘,@þùôéS```ÇŽy›œ¢Q??¿¿þú ù€(WW×èèh<Ñ €”)**"Ò¨®®Î½ƒß½{w²!®Ã FXãù?ýô“––wÍsèС‡Æ›}ÈÃJã„ 8Ò°;wîÄcØT†Û·o{yyq½Æ¨ªªöèÑϺ Ÿäççoܸ‘RîÙìš5kΙ3çï¿ÿFæ :>|ؼysË–-¹ËžÍš5[»v-šu@!ÈÎÎÞ°aƒ¹¹9wÓá¼bÅ -ô³ €pâââFŽÉ=Œmhhèáᑘ˜ˆœŠ•g…^~ňŽŽ¦C˜k‹FMMmܸqçÏŸÇM|xIKK[³fMýúõ¹Ûë}úôK‡/Õ䃟~ú {Yá 1bï???ÞÑáÇÓmcó[YYiiiÑl-Z´ˆ‹‹87³íÙ·o_óæÍi9vvvþù§À¿Ü¾}ûøøøË—/Ó€„rµ¤¤„ör=xêëë“ñ°7¨ -àŽ ¢S\\Ì®y¶jÕŠZŠì¨º¦*ÒEEE4@6áªkš_]]½,IQ¬÷ôéSÞ‰üñG›6mh ööö§Nø×/_N›6ÍÑÑÑÄÄ„b%îÛ²$(úöðýY:#%RtÆF_¼xA£Òl‡ðîÝ»îîî\›ôY& ˆ¤§§/Y²„ëʶnݺk×®•r'¶¥%8lصkWH45kÖTFŽÞ£Gn -I"—Áƒ³Qsss.”#E’8Ê’EŽ7n,}3.;;›¢K###nNޛ㶶¶ÞÞÞ)))t@ðJw6nºèÛ÷QQQ¥ÏåNž<)å /,,ܺu+w´V­ZTo UR X<þœ÷ŒŽÎu:$“3ºÒôóó‘ô}@gç. Ò°oß>ª#""¸)ëׯ733Û¾};={öš5k¨–ÎÉÉá»'P:“'O>~ü8Þ´iÓ³gϨÚ?sæLýúõÙD:]¤Õq‚300ˆ¥Ã'---$$„[ßlÜôòniýÀ¼SöîÝ;dÈYÅà´vkkkîv!U)?FrΣG†Ênü©ªª4èòåË2ÜHTR)÷•ÕÔÔTÚ§t¦ÇF…<)P:ÍõìÙ300†Çoll¬®®ÞªU«øøx."³²²¢ÃÇÐÐ’ ÔÔÔlll|||¸åðÍ&ÊÓ¡B$Ha&Ù–¯E—ÏŸ?ëééÉ6ÿ!A”†ŒŒ OOO®mÎ;Ÿ9sÙd{¥ÂÆƆH==½åË—ó=ì B‚ˆ—OŸ>Íœ9“Sa›6m¢££‘-@ÊP©³µµåô·mÛ6ù|’@)ÉÎÎ^»v­‰‰ ;Æ[µjuúôid ±±±NNN\+¸òü"Oi ΛçuæÌ1‰¦víÚ@‚Hœœö°.;ÒÛ·oƒl">>¾[·n\_™Ë–-+((óm.-ÁQ£~ -X-ÑdkÛ@š*ô÷÷ç¢BîQ[Ä£Gúôéà -XõêÕçΫ(MÝâr(U„ììl___]]]vÔ0àîÝ»ÈPIÞ½{çææÆ^Ò©U«Ö’%K« 0H€*Eaa!E…¬¥UUÕŸþùÕ«WÈP(Ö#å©««³æ¦OŸ®ˆ­»C‚TͨpÁ‚ì½Bâ¼yó¸FÅø&%%%»víbW(9rä³gÏô¿@‚TYÞ¾}ëêêÊ*CCÃM›6¡9nðM¢££7nÌŠM‹-nÞ¼©Ð ŠsûöíÎ;³ª I“&Òo( -÷îÝsqqaEÅÈÈhçÎJð§ A z9•AÎwñ‰'È€lSmmm©ºC±Ÿ?ž8q"{ú¥zõê‹/Vš‹ €!AFaaa`` žžm­ººº§§'n‚’’’õë×kkkS©PSS›:uꇔ¯rã•ààÁý½½H45nÜTÜrBiþ|¯Y³<¦;6Šý¬)9ùréÑ6p3”µ1”BC·Iú¤î›IQ$È(((ðööVUUeýö†„„  û*KJJŠ+À]»v¥Qå®Ü˜IR 1M:µ‡Z‚5jÔ(+Þ2d€Ø%rõêÙÒ+¢mೌ@\]‡C‚àÍ›7Té±-oÛ¶-Þ(¬j|úôÉËË‹½þ`llY*7\"J½e6fÌ°qãFr©sçv• ­”­ˆÖËFù,ãî>Ž7uìجäu°Ô©S‡=?}útEiT’#GŽXXX°7I/^,ÿMŸA‚@&¼|ùTRÒy.y{ÏE‚:µ×ú4ìâÒut´§BÈ6iÒˆW‚zzºlE´^ä[Ñ’%ó ÁÊ“••ÅE†††¤EJÌû÷ï¹ÖÏÚ¶m›ššZ¥*7HHA‚­[;r×*i¸k׎ÜhÓ¦z÷îÉZZš—W‚³fyÐç±cwíÚ Š‘;wî´nÝšý‘þýû¿~ý…’Aÿ¶mÛØ]]Ý­[·‹·!AHðÿ—`ûÿ#ÁöíÿÛ ’`ZóæM§äåå^–=<&Óç‘#aTº AÉU’:::4,ÞJÈ'OžtêÔ‰ÔAƒ½y󦼕ƒŠŠŠ‘‘ÑÏ?ÿ¬pOC‚@ÊlÓ¦%ëÑ°ÐHÐBȃ1B$w:::”?~ìׯûG:t(Wm ä:“ `ç6úúúááá ñèéÕ«W ,>|8$ B‚BÒ¢EsHL,Ñðòå ¹Ñ¹s=}}½¹QOÏ_ØO’’.q¹4~ü˜²$ˆ{‚’æðáìB ÀÀ@¼C¡ Ð9L»víXùœ4iRvvv%¯sRX³fMn:)ÕÚÚºzõê¼³}íµvž¡¡aPP——É—†=Ê-ÇÊÊŠ*úa‹-âââ.°Y³fì•[·nÙÚÚB‚@úÔÕÕÑÓÓåRÍš5$ôt¨ˆ–Y¼x.ÐêëëQ244X°`&“`ãÆ ÙDé'}Ú*å“ ÝÜܸ¾z«ÂJÆ–-[455i÷™››Ÿ9s¦2•7œžžnbbÂM_¸p!÷f=¯W­ZõéÓ§'N¨¨¨°á“'O6lØoÉùùùþþþÜt¾.^¼˜¾¥uëÖ-[¶LŒìÙ³NK45hPTh Jù=A%8k–ï–ÌŸïÅ$H2’aC1ÜV)eÁ8wîÃÓ¿ÓÖÖ¦J!¡¢€½zõúß‹´®t>SÉÊ>‹ŠŠ?~¼qãFÎG|ežW‚œãH‚Ü°ªªjé…óÎ÷@ -]\\h€þKeZùC$* ÁøøsW¯ž˜nܸ([ Ž1TSS£´£¢•µÍJcÆŒPz þûµÛúÉ“'³ÿèììüþý{/r~)ÛÀÀ€=-®ÊA]]ÝÚÚÚ××—{\ê›,køåË—Ó¦Mstt¤ RCCCà­[·Wå %(o‰W‚ãÆÖÒÒ,-A²’”·ÊÝ}\U #**ÊÈȈõ-NÃ8dä¼¼¼‰'²ÒH1Tff¦¸*Q¦‹.A[[[ooï”””ôôô‚‚!\°`Á¼yó*s- $(.þù矾}û²?;~üøÏŸ?ãÀ‘nݺeiiÉÚܺu«/\‹]‚¨ÆÆÆ¥¥¥…„„‘à7´´´*Ùã $ AHPŒ³Ç-5j”œœŒcGæï6nÜÈvŠƒƒƒØ;É»£¢¢¬­­ÕÔÔlll|||„HBÅæÍ›‹±rƒ$ Vž×¯_ÛÛÛ³žw–/_ŽÃG†dffrÍ -[¶ìË—/Êôïüüü*y-”YYYJ$ –‹¼¼<Ö«³³s%Ÿ?#11‘õ©¯¯¯|nÆ +ØB‚‚vòu KûëÀ]’~ƒF”ÄÚ…åœãdzJØÊÊŠ*dXIšìÞ½›=ZéääôìÙ3d$( êèèü¤ „+U¿ 4`mK®X±U®ÈÍÍ;v,+u+wGH’ ^–£+Ó˜|–“;wnܸ(ó””t©¼|xãþýDyH¥%XV‚¼40Ðwt´—h²··ƒ¿ÉáÇY_$ÎÎÎ\ç8 ¼<~ü¸qãÆ”…Éê%¾²½bÅŠÉ“'³á¼¼¼I“&é|ÅÝÝ=??ŸûI…»äöíÛ×¼ysšÎþüóOH”ŽÃÃC¼¼¦Ê<Í™3Cˆÿøãè¡C¡%ˆË¡òÃ7¨nd ¬¥¥¥!CÊ YõÑ´iS_|eûùóçdd69ùré̓Eb„þýû³ ÈÈQ $_P¦M›6MæÍò•í/^p‘ ¹‰{J§¸¸˜“cå»,«un±Hp„±»vm–hrph *¨åüž o*-AnãÙ Ü( T>-½y ˆP=ɺå¥þ­[·"C„畧§'Ë«M›6ÉIåÀ;ºlÙ2ò677çšýðá'ÇÊw)(Q Žù“ƒƒDSÇŽí!A\ûåPî¹P–6´æ•`ûömùftªWÏ… ²ŒZµjr£,ººº²L:$?•Ã¿_Ÿý믿–.]jeeõþý{öÕìٳ׬Y“›››““ÃwOP¸¿Ù¥ D%د_oI?3Сƒ$¨ ”ç÷B40Зa«ã è„……±û\ãÇGëj|äçç<˜2G[[û÷ß—·ÊA]]â¾qãƽ~ýšûJÈÓ¡Â%øÍ.¥ A:ynÜØFì‰þ$ˆHPìIHË-ÑÑ‘{÷n—f[1|éܹ è\¸pAKK‹²«wïÞx…ƒ")gggöQe^ˆ!A¥” œ'H°\ܾ}›ªzʱN:Qå )((èܹ3‹)s!’–àÌ™Ó||I4uéÒ„!A ăfff”i]ºtÉÊʪÊY‘‘‘Ñ®Ý-±×«WïñãÇ(R ŸŸÏo¿…zxLf/ Þºu…Ý…¹yórÅj€ØØ“¼wsnܸˆ÷´œôîÝ© ¬©©©ÆÆÆ”o­[·®²ñ`ff¦£ã/”5hÐàùóç(Ò‘à/¿L‘hjÕª$¨ˆåTÔ6ååï¿ÿfò¶hÑ‚{çºêðñãGkëÿžpnØ°aüû2” Ô€ˆPiPÛT€—/_’èPjÓ¦M•Å€NNN¬M¹W¯^¡$HG‚^^S[¶tN¢`BBH œ7oÞÔ©S‡]ÍËË« -977—¤OÙÊÊŠþ>ÊÀ7-Æ7Pa Ê$A‚á¼}û–]íСÃçÏŸ•ûÏ’è[¶lI¶~ýúŠÒ¿Æýû÷¬§§§¡¡aooZIA‚ €—/^è˜êÞ½»ǃ………¬%UssóÔÔT…ØæÇ›ššîر#+++;;ûüùócÆŒQP Žçjnn&–daQ‡ì B‚ˆ‹§OŸ²÷{÷î]\\¬|°¤¤dРAìø‡*Êf=Úßß¿¬¨¶¬cJ÷XúA2ú ·¶¶¦Ùþ¡ýn€ŠÇâÅ‹IÍZZZ àj¾–– xŒY½Ú„#=244¤#‹b åó ——ýµÚµk+J È033+ëÆ¥þöXº1´… r -²4¾U«VùøødddÐœ3fÌpss¸À²$¸`Á̘˜(–Nœ8Ô©Sûo¦Áƒûq?¡Ä^Œ‚!AÄÎõë×ItpM™2E™þ׺uëèOijjÆÄÄ(Ö–«««—ÕÐë7ûü÷ÿö(¼EÐo.hРAff&&åщ“À–%AîeyJ&Œ%èÓ××ãÞ…¿råÌС AH qñâEªxéø"q(Ç?:zô¨ÊWNž<©pobbÂÛh6/¢ô'ø¯ÈÍbsiÜ+¥ûäý¦9C%$ÄÐZuY bׯ_÷ës¼õy½ B‚H”ß~ûMUU•*·ððpEÿ/—.]¢ª‹€€EÜþaÆùùù üJ”þù,Æ{•›o¶o.  ñíÛ·}W®H˜¿‰µuú¹§ç/ˆ!A¤)ƒ]?LIIQÜ‘ššj``@dÆŒ -úîܹC!(((+++'''66¶W¯^ì+Qúä­[·nDDçA¾Ù¾¹4n`éÒ¥7n$QÞ¸qcàÀŽoݺ2}ºû7“·÷D‚ RÆÍÍŽ2==½¿þúK·ŸâÖNxß¾}¹ }ŠHbbâ÷ß_»vmuuu{{û•+W²é¢ô'øïÿíFÐÊÊŠb|vo6ÑŸýòåKHHHƒ 444hÃ"##Ë%Áž=»U²ÃÓfÍš@‚ ’†êºþ;ånÒ¤ w¡LQ(**¢ˆ‰6ž¬‘½)+„G‚Kˆ!A¤郎2:ÖºvíªX/MxzzÒfS$øòåKìGHTˆrЗ„’žžnjjJyKZQ”mŽŒŒdÏ¢›xH„!API®^½Ê°Ü³güomRRR5hkƒƒƒ±ï AHPáÊ ¥µkW,Y2O`¢¯$ÑÆì… §„¯«¬í¡´ýË+=”½rþ°hNNk ÜÝÝ{ „T‚uëZ”éÐW’0Hpðfáë|uíÚ¬ -VX÷CrÛùBIII¿~ýh#[¶lYXXˆ]&ŸlР^%û -444à“àÍ›—[µjþ•F‚––æ_Ÿëî5|ø .Ñ(M¤¯$'Á:uLËZÛBW×Ἡ{÷®`Õ!??ŸuDÛ½{wù|ã`íÚÿª;CCÃ/^`É­%Ñ€vbâô,¯|<~|_RÒy.Ѩ(Ü¿?˜"8š ®©WÏ’]»v7jiiáéù ¯;vt*k];c¿‚«$—š5kR>“nämÛ’’’ÔÔÔTTTbcc±§ä³r;sæEgâJññçø$¨¥¥²‘R‹Í!Á*+A¾ ›«V-å]²dï(Eså• ->©ø‘^!Á*È©S§H4Õ«WOHHŸ­ÊÌÌd·çÌ™ƒ}$Ï•›„“ ¶¶6«Áºti Vu ZMÿ“ ®nµV­þ» ’ ­mãÍ›})-]:§, zxL¦ÏK—~_¹r $X5!Ñ|½³Ó€kTDæ°[m۶ŭÀª,AMME‹fQjÔÈD$XH!¼víü®]›!ÁªIQQ‘££#åöÈ‘#åa{8Àž\U¬Ž!A±K÷!AJGŽ„‘•¸¼‰w4(hïèòå þŠ¥X–qO°ŠóäÉ“ZµjQ†“€d»%¯^½ÒÓÓ£-ÙµköK••`JÊÕaÆ𥨨C BK°U+‡Ž¸D£’{:TDÅCëׯËYrݺ•L‚S§N,íPi&Ú0HPÊìÞ½›2\GG§¬~Ï¥C=h3 €=R•%ˆ÷•¬œHÿ=A%Èw5•]ke’mC1܆¡Î‘&}ûö¥|ˆ¹¹Yi ’’¤¿a®®Ã!ABúúø±î«W¯¤¼jöDhŸ>}°ä¿r‹ˆØ+«4k–$ B‚@r <˜ržëî\:°~"ôôôd{G”«r›8qlݺ¥“ƒCs\…!Ae’ ¤·D®tÿöí[ö¤(×ø¤ÉÊÊÒ×ק5nß¾–Q Ê­¬fÓtuu AH”­ÃÂÂFŒÁ;ÅÏÏwtøðá4Ø%%✒°Ë1UUÕzõê?~¼2‹"Ñ¢ÌÍÍIOR8^¼¼¼¾>>ÝJ>›0Â%èé9ùر½,íÙ³¥, <¸»wïž,ýüó(Þ¯–-û•ûjÍše¼_ù#÷ÕÑ£û!AH‘ôôtKKKn455ÕÔÔôáÇܪái%“ }~ùòåäÉ“•YTqqq‡¤ÓñîíÛ·UTTÔÕÕoݺÅ(¢}|p¯?ÇÄ)K‚«¹PÑʪ~é®”cÇŽäýÊÄĸJ½,¯d°æÈÂÂvÊCŠˆØ[Õ.‡¶mÛöÉ“'lxÖ¬Y÷-[¶Œ’ [·nMyyy“&MÒùŠ»»;×n­:<<ÜÚÚºzõê|ÎZ¸pahh( $$$899Ñ ÆÆÆ®®®ÿ–êL™Íoee¥¥¥E³µhÑ"..NàlÜÌB¶gß¾}Í›7§åØÙÙ ì`[Haa!­±’‡ä;w(¨$7‘¤$zìwëÖ¶|úôéðK• f™üÚϳ` jB‚ $X~–.]º{÷nÈÍÍmÒ¤IAAÁ”)SÈ2ìr¹ì߯Ífúùùåäädgg¯^½zÞ¼yÜ‘N3po«q[²cÇŽû÷ï³áºuëÆÄÄÐbIµ«V­â‘Îüýý6l(p6nTÈöÇiE´º-[¶888‰ÉÑ£FªüQIb¢eRH(¹ÿðáô -:‹øøñ#üRu"Akë"G‚&U-ÄåP\—)R;v, 3›„}…FŒqéÒ%°°°ÈÈÈ`óS=Ì]A(©¤¤$ò)7ÑÔÔ4((ˆ¯ö²ÍäAáe{H‘jjje•:ÆĉE¿Ø[™™™ìyR•$Ê:uê|m¹(rQ\ Ž5tÆ•,­\¹°, FEš2eqtt¤ýÂúÑ(/ôÛ={ö  "ÄåP$Q.آΑ7öîÝKû¥eË–åýá•+Wè‡&&&_¾|©Ìa%ÏüðÈ B‚ $¨Ääç盚šÒ®¹|ùr¹~8jÔ¨J6; ÊUå¶víŠ fJ9EDì…!AHÈÙ×tÊÑeá»wï455UUU_¿~­”‡ÕΛªšSR®Þ¼yYÊéîÝk •Py`9äÅ‹jjj$µ¬¬,@{³oß¾ÊznY%±'44HÊéüù“ $ ™C:+WÿJööö4ÿÑ£G!A¥‘à±cÃÃC¤œââNC‚™sìØ1:ZíììD™9)é¿‹ÛFFF~$F 'Oþ¹cÇv²M›7¯«²LL¼#å”’rÈœÂÂBccc:`IpßœÙËË‹æœ1c†¸ª_–ÈA2¿R±páì*+Á |½½H9=ºÈžžžtÀÎœ9Sølý™››Óœ×¯_—„gÏžºMúÉÅ¥{— ^‘€¨Ê°¦DÍÌÌJJJ„Ìváš­aÆb¯~™ÉG2©ŠÝÜFUq âeyH€*©ŽYÒœy¦NúU !AD‚ˆ!A” R³¤¹²f  ‘½Y/Ê­CH‘ "AH‚=öinn^\\,p†k×®Ñ õë×—D  "„²ÅÒÒ’[’ÀoYÛ2•.D$ˆH ‡LŸ>]H‹ -[¶¤oÏœ9 "D$  |àÊêTâŸþQQQÑÒÒÊÏχ•O‚ÁÁ›VK9EGGB‚ -WZÚOSbòòò´µµIviii|_………‰×  \IðÂ…SgΓrº~ý$ B‚@® šŸv)oú¸qãhúúõë%*ÁQ£~Z´hŽô““Së*.ÁsçNP\&å” *biaiÓ&¿+ L>>‹%t¾ê￲ôêbcO²o +k“(ÅÅFŸJà›°"~þùg¾é 4 éÉÉÉ•àÖ­ë㤟FŽü±ŠKbpò‘”ÓéÓ‡!AÅ•`Ó¦Ê -sÔÕÕ%dSS“Ò«Û¶-€};}º»à+8x3$¾ iŽv••ïÄW¯^ÑD}}ý²ÞžÀåPå¨Öð` $X^ öèÑuÈ~\<¸¯D%hbò_+Ç}úô`«377+-ÁæÍm‡›êÔ1…ˆ”””èééÑ>zùò%71<<¼òB‚ò\­á H°bòôôä¦tèЦÄÄÄ@‚ˆ B‚b“`õjÕºÿ öîý$Ø» øìÝ»…R«V%øÇG|i -‹ -!AP.Hv´Ú·oÏF‹‹‹kÔ¨¡¢¢’•• "D$ Ê<þ` ¯W®\ ‚ò’‘‘AÊ#ñÑè;wh—ÙØØHô€‚ B‚UG‚))Wììím)ÑÀâÅs]\º³QJ£GswÇÍ@•÷Ã=¾ãfã~N©, âž ¨¤<ÚM·oߦáýû÷ÓðСC!AD‚ˆ!A> ~÷]Çzs©_?‰>*W^R"Î)¡¢~ÿþýÁƒëé鑆ìííCCC¥VÚsssUUUÕÕÕŸ={FÿÎÂÂBÒ$¨ˆDEEQFijj"+ AHP¢LOO·´´äFSSSMMM>|ÈM177§y”I‚?¦ÿ¸cÇŽ¬¬¬ìììóçÏ3FšžÄGÿ+..Ž>;wî H„ex9´mÛ¶Ož¶_{8 H„e(Á¥K—îÞ½›]©kÒ¤IAAÁ”)SتíÛ·“Ëh`Îœ9~~~999:­^½zÞ¼yܾ£>|øÀ¸Qœuÿþ}6\·nݘ˜Z,©vÕªUÂC<ÒªaÆgãF…lyœVD«Û²e‹ƒƒCéU˜™™½yóF†žÄGÛéëëKŸsçÎ…$X Ú)Ü1›’Ÿ#'é΄*"AŠÔÆŽKÁÁÁÌ&a_¡#F\ºt‰]ÁËÈÈ`óüø‘»‚*PRIIIäSn¢©©iPPýJÄëœäAáe{H‘jjj¥—¯®®Îl‘$>Ö‚è×–ú A V@‚Ê ÑÑ‘ÞÞ ä$?²ŠH°¸¸˜]ólÕªUjj* PdçììLM›6e¾ ›”””pó“GÊ’ÅzOŸ>åøÇ´iÓ†–`ooêÔ)?|ùòå´iÓMLL444¸oË’ èÛSúÿÒ*^¿~-ã˜õ®;räHî­yH@‚å•à]%—CeþŠUÈááá=zôà¦=:xð`6jnnÎ…r¤Hî™ÆÒÒ¡ÈqãÆ¥oÆeggStiddÄÍÉÛ¬­­­··wJJJzzzAA¯yg㦋¾=¥ÿì°aÃøž€•2  ëÕ«}Ò‚t$ˆ÷!AÜ”ÿ{‚ÇŽðòš*'é?Ž–K‚ÚÚÚ2ÙN{{ÛÊKpß¾}¤'Þ¦KÖ¯_off¶}ûv6:{öì5kÖäæææääð݃(É“'?~œ oÚ´éÙ³g………gÎœ©_¿>w£VÇ ÎÀÀ 66–¢Î´´´n9|³qÓË»=¼Ü¹s‡V”••E?§õ’¤YàI|´aÓçõë×¥#Á­—/ÿ!唃H„E?f>¼qÿ~¢œ$Ú˜òF‚2ÙÎaÃW^‚¤RyŠ›’ššJK{þü9ò4¦@éP4׳gÏÀÀ@?~¼±±±ººz«V­âãã¹cÜÊÊJUUÕÐÐZ[[«©©ÙØØøøøpËá›M”§CE¹ó˜˜˜øý÷ß×®]›¶ÊÞÞ^¼}Ú~mXãÆ¿ûGÒ‘``àéßãhÖ¬ $ B‚å=fåÿr¨]3¤z¦ÿ>ÒLîîãåªÅ -$>ÚSuêÔ¡OI<§*D‚***úRHìHiÚ´1$ B‚¢³GŽ„É䶅À$ðr¨®®nY h“ÝÝÇIùL»iÓF ÂAâ£=¥§§GŸÜ3®Ò‘ ––ÖŒîRH¬XB‚ $¨d‘à’%ó\]‡ûû¯¤´°@ ~÷]çE‹fK:?TPH|ÌGô)ö†Cåêr($ B‚å:f/\8µcG œ¤øøs¥%Èuª{÷î5®S]D‚ \äææ²~ÁèSo, -”`PPÀ¤InRNtÒ B‚ èÇlBBÌ‘#ar’ã„H†KKfÓ’.ŽŽö ÂñåËv{Ž>¹·%-ÁÐÐm$²† nݺ¾JL¼@£ô)– &))Wy››`‹…!AHP™.‡ -— ºR¢@ⓉIRK—ΧtèP(ûŠ -3nØà+–¢xìض|–×@‚ $X®cVþŒ‰?wüx8M Ù*P‚{ö±Ÿ§¤Ä³6pØ(oû3•¨dòn!‰T\ Jùr(ZŒ!AD‚•ù¦#¾*åc AH” ÞºuåÒ¥ßå$ݾÍ߀víÚµ--ÍyQN‚ªªª|ßJ'Õª¥ *ìÁ)¿" B‚ üKðôéÃ+W.‘“táÂ)> –“ löŠ„”_–wqéN>’~²µm B‚ ¢_½~ýÂÙ³ÇËJ7o^ò­tÒ!AE½,/åfÓd $ B‚ --A…H ¢ÀšM“ZÚ›7¯#É6;v„!AHÿþ¯m©u¥$W „!Á²ŽÙÞ½{"U&A‚ŠëJIjêB‚ $¨bLjüÃ:Õõôô¤Ï€€IK02r©GBéÏ?c!AH¬$@|à‘H|tûúúÒçܹs%-A‰>³gOP¹$¸~ýjúU§NP AH€ª ‰á}ûöÑç¨Q£¤#A»ï¾ë$Ƥ§§[ NŸ>…~ellŒb B‚TMH|tÇÅÅÑgçÎ¥#ÁÒ/ËOœ8¶o_SxxßÏ;tp‚!AHP^H|t?{öŒ>-,,¤&Áää˼mÏè‹~ÙÓÅ¥;÷í[×C‚ $¨$>:„¿|ù¢¡¡¡¢¢"öæCEŒml¬hú´i“|| IÍi6ÿ•ˆ¥/A555oð™:u*+áûùíÛ·Qº!¹¹¹ªªªêêê4ܤÉMŠ‰ý¨,K‚wï^ ¢töì1N‚"B|øðûyttd%%€¬ÄKIÑ!åÑ‘Hú£áа؟é"ÁððJ±±ÿuìÕ¬Yc5‘ XMd?g…l)o hoo  sHyt$’þhxÁ‚4¼lÙ2™\­d*K‚[¶ø¯^íÍ—Xðˆ÷ =z4$€Ì!åÑ‘Hú£a:ixèСRàÀ?ˆ·×iKK ´¶n€´$);ïܹCÃ666Ê ZYÕ§éݺu0 7%æDH@‚‚”Ç= S\\\£F •¬¬,%“ ]Ó6m)™˜C‚üûµ;]R‰¯¨¨ˆMéС˜111J#AB‚ìè0lß¾=7eÆŒ4eåÊ•J#ÁÈÈ}ûöíàK/þ H€*ΪU«XÿÜ”ððpšÒ·o_¥‘ z‘ @ $;: I|Ü”W¯^Ñ}}ýââbHHe¥¤¤DOO×/_òNoÐà¿ç'“““%*Á!CÌšå!ÆT¯ž%$ A€ˆæè´²²â›>nÜ8š¾~ýz‰JPNú„$@Õ„õ¥ûóÏ?óM ¯ø$èëëíî>NBéܹ €ß„j~:Iy|Óÿùç--­üü|1J0>þœ&ÿU €¨jäååikk“ìÒÒÒJÛ²eK:<Ïœ9#F ._¾PÓèÑÃ!A PÕ ÁÑH²øí¢E‹èÛ3fˆQ‚ÜÈ3gŽ9VVJI‰ïS£¸ - AÓ§O§d'ðÛk׮ѷõë×—„…?sòäo €ÅÒò¿ -Hv¿-))155¥’’’$$Áºu-š6mÈ›444 A $ ©Ž>sss!oÄO:õk› %$ÁmÛü’’Îó&ÖÒuY<}úð˜1#¸täHß K—Îç¾:u"ß·/þÎûó°° €¨šÚèè#Í ™çÂ… 4OÆ åD‚»woá½jêï¿R`‹1 CC¾o;€´$ Hmtô‘æ„ÌóåË -i¶ëׯˑ­ªU³&Á¯¯}”)AãjÕZC‚  -CR£CÏÌ̬¤¤Døœ^^^byFTœT«VM]˜55…IPµZµê €¨ÂxzzÒ¡7sæÌoÎÉnQT(/ír¨±±.‡HÀGaa¡±±±è}ÚÛÛÓÌG»ùe\`à*Þdff"D‚÷îý™˜xKwï^ã›!9ù2÷íù¾½?‘÷çwî$@‚ ªqìØ1:îìììDœŸµ/ZÉîñž òë@Ô&âüïÞ½ÓÔÔTUU}ýúµ¸$8uêDgç.e¥ØØ“ €bçÅ‹jjj$µ¬¬,Ñ5jÔ(!mËT@‚r• A PE`-‚’ÔÊõ«+W®Ð¯LLL*üx $$€lÉÏÏg-¡]¾|¹¼¿uppøÚ_íHHEdïÞ½BºNhh(ýÖÖÖ¶’¼|ùÝ»·ÈOºwïOH@‚Téˆ#U,Š433£ŸŸ;w®2LHˆùí·PùI÷ï_‡AyK²<ƒ’ €@H^t€˜ššTl «W¯¦%ôìÙ³2ÄåP B‚HŸ^½zÑB"«ð222ttth!)))–`TÔ!Éò“RR®B‚§s(7¬±PRXNNNe–3þ|Z΀PuH%E´EGÇ‚ *¹œ´´4mmmZTrrrŪŽ‡oÖ 333Å»ä 6Ð’›4iR\\\ª—C$  Q¾|ùbggW®^“D'??¿N:´ð   rUxO@‚ R€ôDG„M…›ˆÎáÇiùÆÆÆ?~D$ AHù!33S__ŸŽR•äÖÒ­[7ZÅôéÓE¯:RRâ¯\9#? ÷$€òAb¢Ã¡C‡]ËíÛ·UTTÔÕÕoݺ%bÕqöì1ŸEò“nßÆÓ¡@©¸s玪ª*¹‰$%éuyyyÑqתU«’’Ñ«\ $€$(..¦ŽOOO)¬.++‹]wݾ}»(UGttäܹžò“RRâQuH°Â¹¡Ð»åY)!ÑÎ577'=Ig‘‘‘´F==½7oÞ|³ê¸?‘¼#?éáà ¨¤GúiÑ¢9ÒONN­+#Aö_TUUëÕ«wüøqyðÛ¤êÕ«[XXŒ;öÅ‹(r \¼}û¶V­ZTŠHLÒ\o¿~ýh¥}úô^¶]]‡Éarvî ‚ÊHpëÖõ‰‰qÒO#GþXI þûõ]ª“'O’täD‚ôYTTôäÉ“€€€ üý÷ß(u@tL¥¨W¯^R^ïû÷ïYWƒ‡Ru +R ”TÐË¡œÂ - µ´´x¿²²²¢)‘µhÑ"..ŽM,((˜6mšžž^ýúõÙÛǼ\¸pahhhi3r£4°qãFZ²¦¦fß¾}¾ZÅ÷Û+VLž<™ çååMš4Iç+îîîùùùÜOæÍ›g```hhäå奯¯OÃGþwx7lß¾}Í›7§ìììþüóO”s…D{SWW÷Õ«WÒ_ûÎ;Yë4>|(ýíf¹‡N†Q„@” E‚$¯Q£F•žDãïïß°aC6º`Á‚3fddd¼xñ‚ÍÏydÇŽ÷ïß(2^׬\¹’"»œœœùóçO˜0á›|þü9¢Î™3ÇÏÏ~›½zõj÷“U«V}úôéĉ***l˜gn³Ëú;¼6kÖ,Š=Éò[¶lqpp@9WÐ ¡FFF´7IF²Ú†=zT¬Ë] A™HcâĉÛØ'qYØ°¥¥%ß<Ì#III¹¹¹e‰Œ×5ÜÄwïÞ™˜˜|S‚d%uuu6L6$ÿ²aŠ"icø~»©4¬ªª*üïÜ0’¬ššʹ"Ò·o_Ú•...Â_U(êééÑfìÚµ {@‚Šr9”j~Š€:vìÈF_¾|9mÚ4GGGò”††7Ù¯­`…=}úTˆÈº†ÂOÎnB~K!' ÒÚ¹Ê6ƒû9ïO—õwnØ¿xjT1Ù½{7í8!ÏgJ‡ЖPIKMMÅ~ BHÅ\tزa[[[ooï””Šûh:7[:u(‚ã[Â¥K—6nÜÈ{B0Þ¦ºæÇæææß”à²eËÈ_l˜æçn#ÒÏ99~S‚eýHPixòä {"”$ÛÞmÛ¶maa!ö€å\‚^‘SH\¡±±±EEEiii!!!œf̘1sæÌŒŒ :ÙvssãõÅäÉ“¹—,ìíí·mÛF‡? Ï™3‡×57nÜ Åfffúúú<¸¬M¢yþú믥K—ZYY½ÿž}5{öì5kÖäææRÜÊwOP¸Ëú; r@{–Â|Úk#GŽ”“M¢Þ A1öe$(Ñ{‚ÚÚÚtîúòåK6=**ÊÚÚZMMÍÆÆÆÇLJ÷ªéøñãuttêÕ«G>âõEX={ö ¤aŠ -›7o®®®Þ¬Y³½{÷òºÆÙÙYSSÓØؘ—]Ö&Ño)î7nÜëׯ¹¯„<*\‚eýHP9`'Z$®HÈIIITäTTTè û@‚h6 r’àÔ©S$šêÕ«'$$ÈÛ¶­]»–½16$ B‚@ì\jÖ¬IåŠt#‡›WRRÂn¶lÙ7rKpàÀdÒ%t‹öh@TMòó󜜨ÀwïÞ]†ïD'''‡ÝtwwÇ.ˆÑ‹â‚´B¥ÝÊÊJ`ó,òCRRR5hSƒƒƒ±×$ Py"""Ø»x)))ò¿µ¬ 555´È AH€JrõêUMMM*ê{öìQ”möôô¤ 633ãžÁV”êN¡ëj, "–X] „ôôtSSS©u˜+.ŠŠŠzõêE›moo/ðå ÉUVè+ @‚"rÿþýÁƒëééihhСʺ„Ú# îß¿¿S§NZZZô/† ¢XgÝà›>lmm©„tíÚ•¯?ùçãÇ ÒÆ÷íÛW:Oò ¯4 ŠÎãÇé{ÇŽYYYTÕœ?~̘1 -'Aúí’%K(X  -géÒ¥íÛ·G‰U¨20`íâ&Mšì‡KþIMM500 ¿0cÆ i^]A_iè+ ü&£Gö÷÷ø•ÂYºhñuÓɦ„‡‡[[[ÓlÿŠÐð 7@§ú‹/&5Sñ¦Ú{o¼ðÖ-¹¹¹¥gŠ‹››ízª¢ÿúë/Åý—.]b74™e¤ ¢¯4ô•&i *Á{‚fffe5¿/¤p -,Z¥:‡ä&di|TÚ}||è¤9éØd­•–^ /ttpçNjÓ¦ J¬r@Ê ýNúPˆÇA…C!ŒÊW$݉-úJ+½Rô•&! †„l½|ù)§„„1F‚T‹ŠŠ~õÍÂÉW´„7ÅùÍ¥q 4ÈÌÌdäDAU®_¿Nš =>eÊ%ûkt*8hÐ úkúúú*±è+ ”²µ´´fÌp—B>|ˆØ%xçÎ*KAAAYYYT©PõêÕKôÂÉ;Z·n݈ˆ΃|³}siÜ#t -JÇ/ntp 8ð›e˜U:xoݺõôéS:§å=_ -Ç£G iw3Fá^ˆ*Øýû÷§?Hg†’ˆÑW$¨Ü—CÅ+A"11ñû￧o*¢t²·råJÑ '_™¤Kl± P>Þ¾}˺êСÃçÏŸ«Â_ÎÌÌdÝB5jÔèÕ«W(@%H’Zºt>¥C‡BÙW¾4ºaƒ¯X$xìض|–×@‚@ù P¨N:TŒ[·n­ô1 /?~´¶¶¦?Þ°aCî"H‚h@€JòòåKR•á6mÚTAP<èèèHŸáçÏŸ£<HU‡¿ÿþ›]mÑ¢E• …è·k÷_•R¯^½Ç£THUÔÔTcccv4''§*gEAAAçÎÙ{ ·oßV¦š“o(“]\º“¤Ÿlm›@‚@Ñ¡ªžõ1Ô¥K—¬¬,d8;;³÷èÅØåô•ÆNâããuuuQNäJ‚² -m@ö>`§Nªx ÈK~~> ‹Åƒ¿ÿþ{å¨}¥ýËó.0 -‰œHpóæuä Ù¦cÇB‚@¹pá‚––{#¾°°ÂKII‰««+ëþСC•\šrô•VIIHP®$ˆ°°0ªå¨ÄŽ?¾¬LàAOOOÖ.ñ¦M›*³(åè+ „!A P-Ç%ª ‘ ¤`òjÚ´i_¾|©ØB”¬¯4HP~$¹Ô#¡ô矱 P¾èfòäÉ,ºÙºu+2D¢¢¢XÔìââÂ]`,ÊÔW$(W”èƒ1{öA‚@™ÈÎÎfý&hiiEDD CD'11ÑÀÀàkËùMÿþûïòþ\iúJƒåS‚vß}×IŒIOOJUÝ-Z´`Oþ_»v R^?~ܸqcÊ@2 9±\¿UŽ¾Ò A¹•`é—å'NÛ·¯‹ˆ)<<„ïç:8A‚@™ ZŽuݨQ£´´4dHÅxÿþ½ecÍš5ÏŸ?_ÞXRÑûJûWÐã©@N$˜œ|ÙÃc2— ôE¿ìéâÒûáÖ­ë!A d>|¸F¬ÓUEï5Oæ9’ÝD£˜‹»€\E‚66V_Ÿæšäã³HHrphN³ùû¯D$”’âââ… RuM%ÓÍÍ /Š‹M›6±KúöíË=c € %x÷îµÐÐ JgÏã$("$Á‡o°ŸGGGB‚@9ÈÉÉqqqa¯{SÌ‚ /—/_ÖÕýïá› C€Ì%B)6ö$MoÖ¬±šÈ¬& ²Ÿ3‡B‚@Ñ¡j¹^½zT ãââ!’ ==ÝÁÁ2YCCƒ»§€L$(Þ×ÞË’à–-þ«W{ó%{ö "9rssÇŽËê%‚‚ä ¾ü÷©˜Ê'KK ´¶n€´þœ&ÿU ?~tssc…¿}ûö©©©ÈE¤¸¸8 €uk¥¯¯Ž<“àòå å0=bçðáÃfff¬•æÀÀ@€ŠÎ“'O:uêĪ²AƒQ„ˆ<å• wòÌ™cGŽ„••RRâÅûÔ(.‡)€ýúõce¾C‡¨-•:“Ù¶m uuu·nÝJA"²T@‚ÂŒ9yò7H(z%©££Cè$•÷ïßsͬµmÛW¹A…%X·®EÓ¦ ykÑŠÈ;wZ·nÍŠzÿþý_¿~^¼x1:cà¶m~IIçykéº, ž>}x̘\:r$Œo†¥KçsßN:‘ïÛ‹çýyXØNHˆ…¬¬,///uuuÖî'UOŸ>qûÝØØýóIKp÷î-¼WMýýW -l1†ahhÀ÷í±cЀ6/%%%¤¼:uê°Ž¦OŸž——‡l©R¤¤¤ØÙÙ±Z¥k×®4Š<’• Uµj¶Â$øÃÂ$h\­ZkHˆƒ7oÞP¥Çݺ{÷.ò¤Êž ­_¿^[[›µˆ>uêÔ> [€¤$¨V­šº0 ~mà¡L ªV«V•£  ÀÛÛ[U•JS5“¼>þ=-- Ù ÊU‚@²³³,X ¦¦FÅCKKkÞ¼y¸ý*Æ»wïÜÜÜØ33µjÕ"-fee![ AHÈ'………þþþ$>ÖÈÏ?ÿüêÕ+d ¨$=âÚ[«^½úܹsñV)$ y‹þ|}}Ù}bÀ€xûˆ—øøønݺ±V³fÍeË–¡Éµ*%ÁË—ÿؽ{‹ü¤{÷þ„Á¿_;§èÏÄÄ„•Uª¬-@BÄÆÆ:9ý¿Wºtttp¯¹ŠH0!!æ·ßBå'Ý¿„þÖ¯_Ïúþc½ßÆÄÄ [€ˆŽŽ¶µµeOOOoÛ¶mP¡ÒK—Cü½víZ.úkÕªÕéÓ§‘-@Êsæ ²È qqqÆ c…SSSsâĉ>D¶(“>¼ñàA¢ü$H°êðîÝ;///öÞáââréÒ%d C=z4tèPö^¡ªªê Aƒ._¾ŒlQ FEš1cŠü$\­ -}ú´eË®£g:÷4hPtttqq12‘ "A¥ýè`8p ÷ʃ¾¾þòåËÑ,?¨‚\ºtiøðáÜÛ¯õêÕ£c§‚ò)Á””ø+WÎÈOÂ=A…ãåË—t€›ššrO¸¹¹]¸p9ª8d½5kÖÔ¯_Ÿ ûôéQXXˆÌ‘ ž={ÌÇg‘ü¤Û·ñt¨bP\\üÿµwî±TÿOŽN.“RKÖV´Ýä–1'Ó ÉYD”$Š¹•[S1t˜Û䥆Q“º¨„a-Ò²‰2T$«Ð\Ê%¿ýžÛYŸÙéòë××·Nz=vþàøŸóy½_¯÷óóü|>ï÷ålnnÕcæÞ?zô(-NJb”——;88°ÙlQ¥(++{yyÕÖÖRd$Aér(ñÿRRR‚VPPe‘´´´‹‹ËÝ»wé¡‚ø===IIIk×®öMMM>ŸOS’þ^,)úJÎëñãAÉdpp0>>^UU•)a”sXXØÐЇ ~œ††??¿yóæ1w6lØ™™IWQ~‹>yR Ý‘œWss‰ D1<<œ˜˜ˆ"eFBÉÉÉtuuQpâ§-**²µµeFѲÙl' -éq²_&‚NNvø255!”„ -E1ººº²X,Q¶àlzz:=ïM“Hÿùóç9sç™NNN%%%t‹áßAI†Dð·066†³S £}0€fff©©©###‚ø÷xûöm\\œ˜:;;çååÑ4“N’ă®˜šé—CÀQnJJJL@ûh†O‚øÅtwwGFFZXX0ÅÈf³½¼¼„B!‹Ä$244„²Úµk—¢¢"SnÚÚÚ(ÀÖÖVŠAüvoª££Ã”§´´´­­-=ECÿ„ÑÑÑÜÜ\.—Ë \+W®Œˆˆ ið BéïïOHH022bžOø5::šÎW âijjŠ‰‰111a†·ccc¼ÙÑÑAñ!ɧ««+--Í‚™“M4_·ŸŸßÍ›7é¡5‚cll¬´´ÔÃÙß^4.ÉÆÆ¥Ô××G!"ˆ?‘@°gÏfy_Ñ|õ\.7..Žù%þràì q(f^ //’Áûto ¦ pÕÕÕÞÞÞkÖ¬™ø€½©©©¯¯oqq1:$þÓ‡3Cfµk(cÇŽÁÒ˜#‚˜òö0))‰ÇãÉÊÊ2=€ŒŒÌúõëÃÃÃËËË© ¦ÞI`MMMpp0’|â>%%%¹sçhZB‚ø ØUTT„††2«›‰†ZXYYAëëëI‰?—ÚÚÚØØX$óÄ¡ RRRHøÀÀÀªª*º?N„ˆÁÁÁüüü}ûö1«ý2+~Z[[£'yøð! "!ùŽÂ…¤x¡ ±===i‘2‚ ~D322 ˆjjj»8ÄÍ›7Ÿ:uª¬¬ŒzBr„¯ºº:,,LlPX·n‹‹Kvv6­UMÄÏÑÙÙ™••åêꪧ§7±{‘’’ÒÖÖöññÉËË«««£@¿’ööv$ž¿¿?ÒRLø–.]ŠtMII¡™"‚˜t‡(BBB¾ìydeeœœ"##ïܹC릓Žh9$—ËeÖcÎÇŒŒŒ|}}‘œÝÝÝ+‚ ~ –••EDDXZZN’/ê”444ããã+++i°ñŒ×ÕÕ!…x<žØ}j   `eeCWæ ‚ZZZrrr||| 'N´(bÙ²eööö|>¿  `xx˜ÂE|IOOÏ­[·$...P½‰Sÿ‰¦ÃEj¹»»#Í^½zEá"BbùôéS}}ýÙ³gýüütuu'¾¡¢¢Âáp„B!¶¤ÇÔÿBFFFÐôYYY[¶lAJˆ% DPOOª‡Dªªª¢'“ ‚ø£»»ÌÌL777±k§¢îZ¹cÇŽ@ðèÑ#ZqŠñáÃ4knnnpp0FOìž2PTTDzx{{#U°11Uill,((·±±ÑÔÔ»ðÅ\A577÷õõMII¹}ûö‹/È ü) ±jjj’““áãЈjjj_61‹ÅBÓÛÙÙEGG#ÚÚÚ(nAü@ÝD6NÐÖÖVKKëK› šØmÅŠÖÖÖPÆ3gÎ\¿~½¡¡”ñ7ÃÞÜÜŒ†ÈÈÈ8tè—Ë500øjÛAÕÕÕy<š?~ü˜Ì>AÄwd±¥¥¥°°6ÁÃÃÃá,X°`Ú7PUUÕÓÓspp8räHBBBqq1úØÎÎN -ãdÑÛÛ‹Þ¸q®AÞ½{·‘‘ÂþU ÐXØ`ÿþýh¾+W®@(éÚ&AÄ?dtt†Q(&&&º»»oܸQ[[û[ý°h18 ôÆNNN'Ož„>^¾|ùÁƒÏž=£aÔbôõõ=}ú´¢¢!B ‚‚‚ tfff œœÜ·",--½dÉ4„››ŸÏGÓÔÖÖ’Å#‚ø•ž±±±½wVVÖñãÇÑ›››£gþêE9±Ñý‹-Ò××ß¾}»³³³¿¿lllFFÆÕ«W«««a|^¾|9Fs <þ‡sïÞ=@žžuøða²¥¥%4‚ð?cÅb±´´´°=ž€Ó]Z‚ Iv¯¾¾¾´´ôâÅ‹p‚^^^666ȉ+¨~8͹sçÂéè蘚šB18|âĉèèè´´´ .\ºt©¸¸ûª¬¬¬««ƒè455µ··wtttww÷öö¾ÿ~ppª:22266öŸÏˆt|||oâO?~ÄfØøÝ»w¯_¿ÆÇ[[[Ÿ|Ö¬Y³ Gl6{ÆŒ,Kê3"³9}út¼)##ÙÅfØXYYYEEWWW×ÔÔÄ?Ô×ׇa°{öööØ©§§§ÈÆÄĤ§§ã‹Á$Š¬hKK ì'5A|Ÿÿ®*üendstream -endobj -4283 0 obj << -/D [4281 0 R /XYZ 85.039 786.531 null] ->> endobj -4284 0 obj << -/D [4281 0 R /XYZ 85.039 723.602 null] +4403 0 obj << +/D [4401 0 R /XYZ 85.039 786.531 null] >> endobj -4285 0 obj << -/D [4281 0 R /XYZ 85.039 723.602 null] +270 0 obj << +/D [4401 0 R /XYZ 85.039 766.606 null] >> endobj -4286 0 obj << -/D [4281 0 R /XYZ 292.716 125.59 null] +4404 0 obj << +/D [4401 0 R /XYZ 85.039 746.277 null] >> endobj -4280 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R >> -/XObject << /Im2 4154 0 R >> -/ProcSet [ /PDF /Text /ImageC ] +4400 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F35 3036 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -4290 0 obj << -/Length 2900 +4407 0 obj << +/Length 2810 /Filter /FlateDecode >> stream -xÚ…YKsä¸ ¾Ï¯ð-êªiÞRïÍžÉ$³•T¦2®ÚÃ&Z’Ý*«¥^=Æë|H©vª"AAàÈoú…7Eêñî&/2?Ûòð!¸y¢‘¿}•#Ic?Mj_ÜÚÑmùA’_åÑ5¶y”øI‘€çîþç¯Qp~–Å7÷V‘Œ ¢âæ¾úÝËüÍ6MïΔϛЛ›mœåÞ—Í6ôúQLÓ é3uúnÂÀз›ÿÞÿúá¯÷N'šT ÃwU\ñ°Šazþ.Ø­UŒS?MsVñ®ÆšX~ f§Þë&*¼~F'ñÊãÝ&Úy)K#3ñ*çP›Šˆ¡÷$}ì“&"í›Qˆ#¯PNMÎDÌïHÍ–̨Âæâµ7b KY­¦=ì5]QÑ é*v}ì(`ZúÒÐd2)Yjâ´w¼õ²ïþ„ɯⶱ+<#ŸrØD¹÷€–¿Ð¹Aëf«0ésÏv™±mëA¥Œò­ê‘0åa³Å+!g‡Mî@.•ÝddPà$ehxº‘Æ¿Wçn¹·+ö˃?—ÉÛÇÎبÇÉêÜó–r=³ibÕ*0ÓñËØý65m3ò³(?±ø÷/Äþù|ÃaPøYNÊÑ7IwWÝÛòlWL—Û<—„5ý7‚)Ý‘)¢wcia±Ñ&~œd«PJ³€`ÇF{ˆxOvÞ×Mxµ™æí8"Æ3ﶫ$Ø%æºÞ7o駒ßUpáy3ØS:ò,ÎXÃ{Ê8ˆ<ùÆÇd­íGãHSÚ¡ç@œd¤¢†´Î8¢çvãFÄ™ ÂzâÝ!t©žq>Hì`¬a¹µ/‘ûÍ.ÐK|èL(×ëL&Ñ 0ùeo”áEÑG}^e`¿LqûÀ» -£ÄwÝwàLB¶E+ðÆÉ5«Á`µa! )ÛY6L;c›Ž2døÌiÆ'ùôƒÒa©ãЛrö28íuÍU|™íý¦ˆÉ™VI¹yKJPbç 2“H]ߢæåF5ã¸9Í´_–ÈÎöÔ~UÓÊq¡4Gó Ç;q¢Þr•¨ÐrU·ÍO–1ÔÕG¢ëLr€,´;“>ãpªa¹"§N£QA|n½=cšÉìä­±šFUh_…90þ+&cNþ;™Vfå.âµGq‚,Ä8¹=[ØO•‡—§©÷M8‰)Ó³ŽÕX¢ÙZˆ5K¾ä:Lc…aŒ~n+çÏOqaU?.ç1ŒÍ8ÕK2I™0·ê¡³Ëk¶E‡Ábq‰+†ª*ÎÔ¬ä(æ\àËòXNhÏWB½Úâ:ã¬B÷¦¹¨¢"ðó‚*½Œp?È}xR†uÆ´ÌÛ…û<Ï$b“¿öûjWx%%6­'Çi0é<ÝùÉnw¢Ûœ[–w5Š©>ÝeÉZ£R탵Ù?I±±¦¬ÍqGêõó$ õ¡AzCýÇÜhiEU¿5o繿‹R9ßTŽ—A,ŽÄ­%tcïÙžÙÈÕ ¼¤’öËÆÆ1Ú - -Œ¡DÖã+jQcã$¤Iy)ÙÃ1¿ªE #Cìs=RѬ%¦o=4Êý`'¹ùജƴ -%ãF¢Mö|Z)£,e@Ã×híªÕ!ØN3Âq'1þ¬åHg5"HŸ5Îyƒ‰ cƒ,LbkoéN_é~çâqÉž¯2 å”]«»—®2eû´ÎQ}©‹o%žd›Xhß¿|–†§“LÚkªÌÄy4±éˆÆ„'öþñKÞ~—Þ-Ï/ûÙa[KÑ(VÜ«´ ¸ß×ׄ<œ2_+åíêZ_KÇå!±+Hfµ«þpèušØpœ,Ûéú‚hƒf0ä¯@ó×"qlO1˜l3:{ÿtùseý{Wf%Þ3fæW —.tИs¡:Òm)ø;oNp!¹rTo¤sNI” -pÂQSI”ˆÃ¤^Ç•Àˬ½!¹È%LüqûOiTfâ`4£†+d‰Û¦ÞÑ ìó¥}š¢ðÀb"(âLJ%6JÑlun¥qúþ¿Ô}ÚŒAF“.?=C|¾(gKÑE -|DxÖ»;+$WB·9¼éY±Š¼Cn74¶¼ uõ$šßò´}X]ƺÕø0³G’s™ïSvB±è¸(W¹4X_ ,\­S -3.× ‰©Bb~viHÕ8“}Ì“¹ïxƒÔjåÖ![.äâ4Œ%[©‡Ú°­ÒÌfEj5º‚ÜÛˆ`ƺ+k™"ˆž FSE©%õ@ËØ4’]QîÊMêzh¤—ž ¢Â¼{+ÕÓ‘òX'ÚÄžè•TêèJnЮ€Ã„N¾«!i–ûuǾøˆØ<Ê÷¤ÈÆÚÉðT ¤Ü=r°p˜„½µóò ÄKÕ¦ît½ò:صqr¹ÏB#-²sI×9Y*A-ÞB•©µlÈÃ@.®(1ðÍ1ÔÒp 0À¡ár žùêNˆC}Än©õÝ [¥Òzù’ñÝL-Ô¡[ÿÜêåñt«|„=l¡xõ¹¡&xäèˆ PØЩÔZÏ4ú°–KAŠöìÁ*Æ:«=ÄpÂ[£Z%æ…àÕéSïº@<….ëA~ñŸ‚à–>prp—F›Ù†ÚY;u7!F•âdöÖŸž_óux0®b,ÉøÔÝrºµVûÞ>—ÆZ¤;Ê%pÍⵑQÄú•Š´†zQ±~¹’2²Z½_FE¶Ä!?¯b†-;y'®ìÄH”bóxÛh´ËÓ'ᵎŠ‚½cèÿ¢¹™´1K{ìßTG«æ‚i‰¿V&h¥Îe˜¼kü{|úš%«W¡S‡¸£Z0òÊgþ£1ÇŸU~0ã8ßywòRHNŽ[W? ßâߊ’_o˜ŠUàV×gê¿Žâ×ÿ²(v~½ÿ—ÊÂÂ/\IxòïMè'AlÅ`CäùåßE™_¤Å{«Y–óåNÿ, -#?£õr?NÞ‘~PÿŽ3³ [wËi>»ãêá«/s©¾{hÄ|TAª±}8{×jåÄòÕÛ®‡Æ†³†…¥j7*ö£8½Ž…‘Þ§}xµ6Ó@''—K=ÝU6wuW£qéX£h+Z3_ýs„ 5RàÀñc0ñgaSá +ˆaÐõ2~ÖÆ Kâó+.´¡Äè¼bÔèÅoP*‡´él}àã<‰ÙL× xn ]nÀ\âR]šò9âžËŠ^Öœõ8—ð~½õèÔ0Ã1¾!T ç©™?9s{…»(ɘ`1W„¤Z>²€2&±]«f|Ç?¸9ȪI©/¶³nJU#£ ,“ô O¯§º³c5?°Ë.”p^—* +ùWºüRü´ÝGRŽ£ffRŒÑ) —Vð8[õS;Ÿ# )Úþ¸.Ö$NzV)‹ ØîŽj¸4C<^Ȉþ’F©ÔÅLàRyiK[»½1ű¹²«¬{w{4Oóã‰Ç*+Ëq¨E<6=ø ;vKèÖ´±ºÉ-JÃU7¬ãˆu\?E´ GÔäÏï™\Z=Q–,½u‡{Pñ­ŸÉ¿P_YÀÄ”œûáÁÕM‚Ăÿ…‹Â[q’¥kÏ…1'ê/Ë<Æ·žœk ˜9;÷ÖÞBšó³ã6T4ɽu„4Õð³¾ç¬9h¬.tË—¡rh|¯SXNÛý‹,Oy +®j‘ÿ‘ÿ™qÏ%Sc}<„»e @À˜0)¥¤ Z&JŒ0&Ùˆ_±qEGâpr6Nlcë Šcïux³¬Î”J®‡èfcÐ2¼‹ÔøÒÕÄ¥ZÇ#Ebè æèza8—80OõWåÍxm!â!Rp„†BµªBOå܉E×À¹±KÎq$\p–¸`{ûXA‘L>ò4¹F§zÂm>a˜΋ J·å„ºäݦ½ÅDÒð/¶°ºNž]µåY”?â0a!â0%‰Cª±p|Óø8ÿtÍœ¿Ý~á‡Js?ÉãÈ ÕŽÿ=Ðmw¾Úë‹X\è¢á,¸Át(ÙÂH¥vò>ì©ñwàÎßZK_jqôEarˆˆW‹6¥¢tIÂ@‹ï£YÀR,‹œ†‹U ¬Ü‘æKSˆœ4“5‘åñዳQ'Ãt§˜EgÄ‘Û•©YÄ‹IÁ"jµ,çèa#C•ÕÕ¯ü°Z£\Ç*ðæʳã‰Ñôƒ„&½÷= ðjùø%œú /@ïi¦¤õƒçZê,V Ý€.„0ÝÈ&ÆJ©ŸF‡&¥uŸ€ësšç¿Rî+ƒU÷L£ÜNE°-8±rUÄX'¶¬ò¹µ +/÷©. [òæRòµ ¨Å®²f}£¼€ÕÍ3Ó\ÝghbëF=Ð9»¹Åœò +h~½C¤çjÞèŽ^K j{Ì0ø~WÊ0•HjëÀ4›o0þÅ*€å“N¬\>5"͆KãøÚ5#Î-?IûhãÄõÜëÊ[´¥pS÷üŒfuµç º…ñ![j¤Tê¨ ¬Èn¿øüòùý,—B‰ˆ³\RË­ã§Í¼!Þ’H­IV­Yð>xÚ¶n=ÎmÑ‘›GpýîQ R½>rœãÃ=uäzBQèº7h +¾Å +c·hbà«ìÅŽñ–ræ³mÙîXW¬ZZ=–C[@†EXúhñ€I(Eز§ÖÌ-@Ès`÷—}u”î÷ £ÙO±õ°øþ`%ÚʇpC›ªž?j¨d x&™©¿¼N*Ôoyæù´r^ôàFæÀùH¾OÖ!Æ9½ Å ¥v©,/ +ANRÝR2jÚÙ.±'Røa§[UJŠË`ø»ÃxíSmm~¡Š2\4ò¸Y-;©ý~eÑW¼«AmW%¥ºWÀŒ–ÒññAÒFÿ ¨Ãž†NÙÄtèE ·êJ2œyæJ2ôæèG:îSö %T‚µÂ”¯.ôåfõ¹EÅ…¤ÅÛ¸~ý¿_”(oÛ–5Ñbp-•_©9õÕê+O óa¼üµn +¦QúWMÁêÍÑ6ÎØ|þ¹£Ï÷Ʊ9J@ˆ»ðç<-ÊFò9ƒï2<Äx÷ÑÝøãÜ3-蹃FüêõG-•ùI–îEì‡ÙÕØ÷ÇCåG*û«ƒ§ÑêÓ`úa˜]wXíÿÿ”‡Nendstream endobj -4289 0 obj << +4406 0 obj << /Type /Page -/Contents 4290 0 R -/Resources 4288 0 R +/Contents 4407 0 R +/Resources 4405 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4287 0 R -/Annots [ 4292 0 R 4293 0 R 4295 0 R ] +/Parent 4399 0 R +/Annots [ 4409 0 R 4411 0 R 4412 0 R 4413 0 R ] >> endobj -4292 0 obj << +4409 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [366.67 618.891 539.579 630.58] +/Rect [335.952 618.891 469.757 630.58] /Subtype /Link /A << /S /GoTo /D (samba-pdc) >> >> endobj -4293 0 obj << +4411 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [277.079 478.871 360.727 490.561] +/Subtype/Link/A<> +>> endobj +4412 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 607.463 109.672 616.91] +/Rect [511.223 140.141 539.579 151.831] /Subtype /Link -/A << /S /GoTo /D (samba-pdc) >> +/A << /S /GoTo /D (pdc-bdc-table) >> >> endobj -4295 0 obj << +4413 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [279.784 465.322 360.495 477.012] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 125.986 99.975 138.888] +/Subtype /Link +/A << /S /GoTo /D (pdc-bdc-table) >> >> endobj -4291 0 obj << -/D [4289 0 R /XYZ 85.039 786.531 null] +4408 0 obj << +/D [4406 0 R /XYZ 85.039 786.531 null] >> endobj -270 0 obj << -/D [4289 0 R /XYZ 85.039 766.606 null] +274 0 obj << +/D [4406 0 R /XYZ 85.039 766.606 null] >> endobj -3022 0 obj << -/D [4289 0 R /XYZ 85.039 658.638 null] +3083 0 obj << +/D [4406 0 R /XYZ 85.039 658.638 null] >> endobj -274 0 obj << -/D [4289 0 R /XYZ 85.039 592.02 null] +278 0 obj << +/D [4406 0 R /XYZ 85.039 603.448 null] >> endobj -4294 0 obj << -/D [4289 0 R /XYZ 85.039 549.735 null] +4410 0 obj << +/D [4406 0 R /XYZ 85.039 563.284 null] >> endobj -4288 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F41 2994 0 R >> +4405 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4298 0 obj << -/Length 2731 +4417 0 obj << +/Length 3178 /Filter /FlateDecode >> stream -xÚ¥YÝs›H÷_¡Ú'T±Ã7Ü›c'wÞ‹ßZW{U»û€Ûœ%PÅñý5à amRW©” §™îé_w½…‚Þ"\d‹$Ý(ðÅöL-aåïgžp¬„eeñ¼_Ÿýü1Šžr3•-ÖfŸL¹Q/ÖåïÎÅ?Îo×~]®‚ pbw¹J’Ôy¾ôSçâŸÿ¾eúåçë¥çœ_-Wžsä‹Ï7ë_—~â|†•OË?׿œ}Xu,…½ @e¾œýþ§Z” ø/gÊ ²tñÏÊõ²l±= £ÀÂ@Þ7gwgÿ2{ñZ¸à¯æΩ¥Áñá½È:¼çùnàù‹$ŠÜ8Lèôu§ ¢mú!oðÔÃôÊäg$T»¼‡…?-ÿ–ùP¹xxPdå'® qßóî¹·h°Š·Içy + îoËU†Îò´ÛŠ­ðù®øÍë[fUžF§ÃÀ°!BÏ6®©@oƒúþ¡¼äP˜§b7ÒSÒ4Ë¡¸y»ânñtyßãqK8í=˜"€°Ã÷¼À¨bË7%/ ›Â sbîó-¿Þç}¥·x¤8rÞ_^ o¨È[$ bæ¢kÞmü N ’ZÊúIæf±Šôl*p}EN·[FžSðËWO‘à9誗*ÞkrðÔsc ðV1¨F{ÞÍkÑex¢/« ö ÊÁ”F{ÆQTx”1ˆ@„]Žûäú€H|@]Ú-¿à¾ôp ÔË ~ÎÑžA¤@wÏÙä…õñð¤ÃO6¨ÌvÊÏw` )¯×îŒ9aÕõUj›3HÂÑœøò½æ\éÍléÎ9QÔ-aÝ€‚VÙ7ÅP£÷‘Ð>H -à ¾þ©Ñ§~âÕ¢¥ÜÝ¢É<çGR

    .SÓI~_ z¼ VäÊMɈz U“4u!„¾Ýì4(nKÏNHĦѱ‡=âÄ#=pÏ.Åô’/šV–^pŸ¶{Æ·xT<•ï1eǸ~퇬zO¤Ê¶ý~Ç¦Ý ܈®# -Ÿ»êËž¼?f&žØòô®£-YTÑnè|.ÛxýTó‰Ñpd“œñsjgÝjÛ;tuÃq­†Þóa/ -!#¦Û^\©ƒNi9º÷ë2Š¼¦Mï7ÕX+@™RTJC§\|"•žv‹çmd×Lí§l?”8 î¶ÄëœÑ[ªf/Ô‰×õ¯Ma—QÀms¦º àÂ*RHÛo6Rp)ÚÀÔ/ ¬y:YwuÕO¥¸ZE±Â ¹u¤Îe?Á¢Ýs1L¢"Ðß›}(ê#ú÷(÷Pª×X·5g¶“Þ­Þ1oÅÿ:í;÷u_"MI~ … -éSUæT:ÿ…ô£ýÊ!œ„a„)'/ï1?~û•Üß­^8­à8ÚŸ¶W6’Êùf#§c…s÷(8@ô-÷ømÝèpß}?È‘*%¹“&c5(‚ve¯AI†¬îujèZiLd¥)MÄDKAzmn’Þn<° dEÎ%Ã&n|óy-ÁÝZ±[ ÀÍCE˜†n'¡Âây*4Ó_AÅ)*%ÎB…-ñónÄæNC1Al,‰À~­ VX}úÆÔ -ƒ1¹çú'à/ITΠƙÍ-@‚‚!IQj>öüHMqÛ”ÚJ~ë¤|ÿ:Ç-& …4,ÖÍ÷‹M¥ Q#Š|çœPÈG ´¡ÛiN”yó¥©CZ2ÓØfwú«Q3ó €„È» ;Ìñª•¬›IÞòì00W`>•.¹aãá -6PRy8®P j-`íÇÖ5SGà…úê¼ €»kqäÀ§êB¶¼ÜBÂĦ‹Vá§2C¥»”ÀîR”€‹bpQÇà¢\ŽQ ‘FÃLêØ(‰µ›+€A´KÁ“€©û·%€:ó³“ÈbñPžû°ºA[— ŒÙ¡ŒÙ±ëƒJpçà1é K åjëÙﱿƒÃR‹ç -]úÐ.åtÛÜê‰ç´|7Ž’ÓÚ<Ç(¥÷ñ09GÜ9Ma„Ñ؆Ï-'DGо1ý#DJ½Ò}v¬|纆)ºo bçÁuÞäœý± ±sE>½Æ—yï´ª4Ì6²œŠÐÈ„xË„*ï4àÃ7»®¥¤¥Þ†2&†ÐÎE»Ùú‘ÚoÒ`æÈE¾ËïkêAå&93cè~ž ®?QÍ¿d?éL …ñSÏÍؼN;6{5F•Ü­ã÷@zX°$ÏÜhú›æÄVØíŽ#è,[6.Ok~ê;7ëÀõ?¿ðÝ ¾˜N¸Ã> »j# iUBÑò3z;Þ›¨tEÆ5½íl‚ð«\Ôhª&H•A ˵ -ÃÖÙ ?0ùFöÖ»–ÇÕAú(¶õÀ®ÎùÇÔŒ~Ç,i»-¿ÐІrk‚Ü“´Ög¦kWï±+thQsÁ/OrIƒñX}&]íò@Å•®'¨øMã.ÊÒƒ¶ö”jk >ŽäÉð¾Õê%!{¿áWVNÏ7k^»á‘Oræ$uî@l]T¨8Àh&ß5tð}'’Ȩð;˜²<³V¦'­çÕÁ àXTQo9wæŠ`…®MøªuÀ_¼¾¾ãÇIÈ]!ž5zÑ]ãtl'ßA¤TòqÎk_'0öÊk^ìVß„:{?­žvi­ÑLïÍh†,y7wäÚº7Þêù–[E»5°§²ÉL#×\Ü…~³F«//¸3ÜÌוi!D@Àßê(¼Ìs“8>Y“-ÓQxn†Ymj²Çn …çx‰‘"|Ã&|[RŸ€ŽE `rq7à’F¤˜’¬1Ô”`Iãqèªøô½»Åófoá¾ë‡ñTËÃ觌ý”…]6ÐÁâ=/Õã-­æÈ:T5Ð#ý†r6ä—Ÿy_©o!pþsË¿·ír{ÂÅ»ó0óܹ4 xû®²E`[Ýd̵úCHæÿöbÎ^PO8‚[~Ì™íRo‚€Û]˜É‚Ž¹q C8Ú–i~Ô)f4ˆGD%Ã˽lBFMôµÞ¦.Í„*ÒYAO _?kXKÞèáñVBJKÉwàÒµ$ÑxCzM½‹Ö –Ý0 HFŒ0ò±­4¦I¢œ«‡c„†Tã¶bKàô2÷£Ëd\Òò—ôçŠJäytfªÓwÁÞüeNè ªmq]èù aU—ZÜÁª~UÃËýÐvØðFú㊠’쟘Ksa€Ë_æó»óëwÌvº³†ùèU¹ÊŠ5 û2›¡¨?¡Vòõœ/f3d¨Ü‚Ö8Óˆ²Šº©Š;Ý6E)+ –6ô¨œºÏ˜ïÇ®÷8Û“uk×OQÖqàz*~Ž8tu¨G*LÁ6Óï30%…³‡—¡—sk7e“×ç`y³m]ƒ‰d™ë=C C7òõ)X#×W°¾õý&¦=7Òɱ õî*r5ì .Ê× o_gu“W(0îÐ "ÍFÒì»+ôæ ‰½·yõ™ü¾êK3Ò €³ýâ7ó®7Š¢£x¿]‚~3 GÌsÙòŒ{Rûwvtxqëë“ìõ˜-LĵvÊ ì¥)VÙ’wQ“Ù.·4jBg³À KpÝT%näscó¼æeøô°`Š‚cqþP Þ=í¸$Ï–IËÄ-¦Ök~ù±X ++wã ˆXHª|³ÄoPÀÏš\2@Sò5cªY¹Z‰ßÑð*£ý4cÊZÊ©l&À¡öm­f:Ñ•{Ð}O ­ÿM¾Û!ƒyéÑþ+Ô=wJ໑zÉP뇥¨çuÎ:¯ÀŽÈþÝ$N¿Å£å ¾Ùòð_ß ;‚9ÿ{;bÿ>fCâL¤Ê +6÷i†ààΨ¬/opßÆY‹fAPJý>+–öu sè@ìn¸P±Üqï‰R +\º¨%ÔûŸñÔ–ì7¯Äý-V֥ܔ""'Ï–‡ÝóÂ>qzMµ›è£9ê^zê8Á²'ˆžW3!ÝÕÙj/a†°¼?š´k|33 ÕøëX!=ÿ‰k†5C ù:oèÔ¡¨³#uµ5(`qŸÇ‘v²Õ¦`»Ä¿ïyI|Š½²ß±Ù+HGè*’±Ô`ËÕèŠ ¸â§Î×$p`j]¡Ÿ¢;dÜ .†–¤#Éd¼s´/fGï{ •7‡C¨ï}Ýe +½”œý½Òg¯ Ä+ñ«à™U>Ð!H•zÆÝl5õ >¡æ¨þ_þÑöŠ?L/¨æÜ) À!ëÛìî[€|öž–[Û+ãT\[|4Æ  =œv¾?Ôœ8ë„šÚ1GrDÔñpÖÑÚ•ÿi§[ä›Ù‰ÝÛ_Åͳ™'J…¾Â²ý 쬟Fbø–: óÒM8‚ù«²‡|¶&0íÄVv¿zJcñµ­2P¥(IàÙKH-6üÔK)ÊÊ%³Ìú¾8݉¯.ù¹Xš¼—UB²,º +YcHo#ÄÛl/Zî2¸È,ì¹Ï’Åq¾n™ÛH²èå<ãÉsbbe"úÏ|LDùž«“pÀFzš |7U‰±½¯_šÒ3G]l†®ö‚:™…ÌäÖ%)’ºÙç`Lã•9¦Á=‡5m…µ.æ]’>á™ÊŸÃAî~pâ(@ÏOÃc9êœõ]+1 F¥ž÷ÌšÁ"JõãÜö½ðv‘Œ&ÝÒÿ×”òñÊ€‚ß·-5ŽEÎ͆Ç÷$öL&$‰TuÃÏ­¶í¤ù+˜y /O£¨i”êàTÆ—uþÈ‹Á¢@ð$n„#Ø¿@ãpxß:Iz(Q`HБ’|f&¢F^Ö†ëG~FW)«>pÏߦ GÔ;¾CMv-àmÝÙs1Ëy¶£ƒdxC„_ÚFÝÚ6Cüê=5/fètZwkvš]^;íªìzß`AB¶áe+Ü5¯_S6G@E ``á Ö¡Siƒ§séWáÂ.Ô ?í£r½Îg˜wý˜ß¥œL/&ŒûñnZv€€¦~õB/Ûò§™¨˜ñ'iÚÄ+^dóŸÇ9²eÁ>fL4&Ê…™P¼A/‘Ú¸?.·ÉXpCØHD‚Î¥LM¤lâ°ì!¯ZG„Aî)ÝqËŤçí}o=Òò=©‰‰º]˜íÖŸóÀ\Ÿt1IY=7…Y#ÞÊÌÃÏÊm[O[]Ò¶udá·Ûªý Þ@0Z7%³()«•)!} N«~v§ù^)ë“t•ïÜ^\¿â×ËŠ¯·œð0NUÖ‰ˆr.ö¶ +ï#ôú‘‘Âo«WÌæ³=6üÀ<ílUJ5ÀÉ€1j^ï‚þF5ÄñšD…ü•r]ä‡ {g +D— <=»ööºu2J­{u¿¸é©ZÚ¹]_¼0ƒÈJÇ‘²N}ª5ƒâý9:–€*Ün˜‚«ß1ûð®À{iã1è¢ø¡WËyoUg´2)Xë@¤ARŽ4lj¢³¬è£ãTN&ñ®Uf½!G(%˜0AR¸C̹5¯ðÇ·Æ¿óJÂŽÆO±ØÞØÞJ¿…ÅÁÃ!‚ßÍ„®X‰×o­ãt›ʪƒ\ýÜx®w¨ ðÂ/Xû5´öÝ(ÐöÏa§ÕH÷Yšßøþ„ÃÅendstream endobj -4297 0 obj << +4416 0 obj << /Type /Page -/Contents 4298 0 R -/Resources 4296 0 R +/Contents 4417 0 R +/Resources 4415 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4287 0 R +/Parent 4399 0 R >> endobj -4299 0 obj << -/D [4297 0 R /XYZ 85.039 786.531 null] +4418 0 obj << +/D [4416 0 R /XYZ 85.039 786.531 null] >> endobj -278 0 obj << -/D [4297 0 R /XYZ 85.039 386.929 null] +4414 0 obj << +/D [4416 0 R /XYZ 85.039 766.606 null] >> endobj -4300 0 obj << -/D [4297 0 R /XYZ 85.039 341.854 null] +4419 0 obj << +/D [4416 0 R /XYZ 226.606 772.58 null] >> endobj 282 0 obj << -/D [4297 0 R /XYZ 85.039 191.766 null] +/D [4416 0 R /XYZ 85.039 399.649 null] >> endobj -4301 0 obj << -/D [4297 0 R /XYZ 85.039 157.02 null] +4420 0 obj << +/D [4416 0 R /XYZ 85.039 375.097 null] >> endobj -4296 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F20 2961 0 R >> +286 0 obj << +/D [4416 0 R /XYZ 85.039 225.009 null] +>> endobj +4421 0 obj << +/D [4416 0 R /XYZ 85.039 190.263 null] +>> endobj +4415 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4304 0 obj << -/Length 3511 -/Filter /FlateDecode ->> -stream -xÚ¥]s£FòÝ¿Âo'U­X`yÛõ&w›»ÍîÅNå!ÉH¦Œ@eÿýõç0’°“ª+—KóÑÓÓÓÓßCtÂ_t»N‚Ðä·Ù: Ýnö7áífþy ÄJ@VÌû‡›·ß%émy˜ß>lž< ’<½}(YÜýëÝ—‡o\®Œ1‹4X®²l½xÿn¯wÿþé øüi-Þ}\®¢Å!Ž>.WGûU-ý±LÒEÑÔ¸´«ò ›èXºí>t´y0²ê®kñ‚F黦©zþ5LBÜø8zçB8\º!$+¼)àÚ*B¦æÄ…±t+»ÿ‹ªÐE8/NuÓ0DOX‡¤kK=á`ä<ñ‚-ò×ÄxVÀ‡#Ìž˜vì¶ £›Ø,Š ÑÚ—J?ÃÔx[b3s„ÎŘC! Ärl Ëá,zÇîHkLJ)gXÒW»¢/¦nwˆ%qcë8вž{@”Ìóâu²øIøÈ3r ŸŠ žæ‰Î! ï訛îÈx´¤£Å `xêi¦„$£ d ¶–? .¨ÏÇ^¹þÉ`*)r0ÿlºý¡©ÆŠ{m5"ä$÷ÏÌWW ²øÐw¿†‘Ea•[b<·I`d¸*£0z™"âôŸ*½ JDY)aDìWÔ“î‹é8Ê+ïÈ Ùc’µ´ëͱ¡ŒÚ|1v<ëDÚHÝ?dU©º5<Ý×Hñ¨Î¾AhÃgˆ­6&9…ŽÈñXÉd-ã/žö/H¯F< -ð˜V_ßø®'Ý:Ž¤¾æ¤ž"¦z'ÐÚÊë8Qj:Ô ;@/>Ž™—Qùº6À"¾1–aÁ²G£‘±V·²©ç‘„®-Ýþž;'gdéŒÎë-ÛµÞ²Íè–3¢Æ"ùd™øõ—µ*èÊ=¼¿ç7"£­Ü bE¤Gº}¢†°õÄmÂòƒÖE;ãHM¡sΣý -!kÁ”Ënâ%¡öã—O3œ@ûñLb‰»¼!òì6ð,¹)øýtÏ¿?Ó6xƒê4ðÂx± ¢ð wa7¯IÓ!zØ@‰Š³ Ì™¨¶Šk½r9  ^ÛºŒvôbY­·ís9×ãŠà"ÊÀ)2H¶0ÊdùeG:]bɘjÁèiÃ;Oà´$Kaÿê5ODíÐÁEž[¿×=7ÇÞW#œ£çƒkÉ 3‰­¶Œý îwŸ…›4ôƒ¹¢ŸÖÎWh˜þ-#J%ow}îa -4ABÚb/-ä©5S˜dAØî¾Ao¿³‘äF(wk– ]»Ý1ÌY ¥I€üLÒ‚{Ë Üß@¥ ÷_UÇjoâŒ6 â(þûA ‡;>|Y;^o€ï_—`ë0aÇã"6Wµ¢—†Ï¶³K¡9t} NPx+«Ø˜`D—¦îŒC‡Ö‚Í„J~’‹ä‡ G&:¬¦Þ8= Ù$9K܃U¢ÆẎ§³3 NŒkÞ³*?“gX‰ õ™V6ý¤·!³‡¾¼ì@(k_óÀ¸s?ùLaç¬éêe* ¶Ï0›äueKž@ÉNq,87^oÖ^ÈrR¦QÅ” ’5—ø€DŒââ#Cþ!Z¼¥0º§§3µ‹¦ Û_>@ûŽÛµ ؉Jy¢÷•'%¤Þ£sÕjĬY/>¶ªfE)@}GiÜ0¶Süìàì˲ƒ–Á±ïZÂÏàm³‰ ’,}UÛ<˜—µMþJÛ^ÛÐiÛ厳ÚæïøNÌ° ÓE¥qô¸”Gñ_a¶ê±Â*Ql¹ˆÁË þ=j‚UñЩ.§U…óIc¾´æ48öœ>Ý0Ž˜p¸ã_º]l€æ<ÖÍYàð -戮þ¦ÜÅ)¨ø³ÊÞyƒ€ƒ&Š…Bmü+.©%WŠã£\£~ƒih>ÕfÒH‡ªøê’‡æ(»ÚŸùD"jË[½'ÆQõæùx๒q¡Ó˜sófÍK3‘»]Å(Æǧz|r;GÚXs9#‹ª^L‹•…Öd›ëë#9gGi>“aØ¿åßùBŽA`~ÓÔ•l=›; Q|:.oQÖ±«¸I¥OPx)²-¨…#8sRÇö &ûr­ã‰=…ªõ¾v9.wRŽ»Iù+vÑ>rzío+tU,&!ªÁU –HMSÌã†Ï6SN‡aQ ue \gSfgÃ<È7¼Tgà­†Ò6 ¨{…>8‹é/WLé L K±¡&70@ÇcgÔ:«kRUV¥°›÷'o†Éí‹gû -ÑÅ\§gÑî*êÔQ¸Ò´ÏóVO•—õbôÁ±+ÉÒŇôT€Fö t³ï…•Tœ“ÄÀE¼0ÞI É! -4Î"óB•Ó(·°ÅufÁqÍ HáÉ’º‹J/¹Ã&›”©®41¹ùÊÃî¡÷E)-*%õÕF+Û ->Šwð·Uš°­u^XU´gî#ÙJTtR'ŠS€Có¾Dž¯ºæ&;TìÁXî£Öä©TSIásJªÜåŸMÑìÕRø9²YÁ—©§º:%ÌJ’;ê^¤0àÒ6»æ„ˆ(Ç#%-3†Àºjªå0G´/¥†NµV“ C~Ò»Ê%F}WÅ»Yë -Z¨X”úƒ^Ü-«f,xÄ«¬c·@ßø}ˆn‰!2FbC…„Yp .¦-UÍy¾ÞíØ&™) 1*,fñÆ1Há\…‡|çÞm ²g¬g Í…m>†WŒ”šäþœAÛXj@箤ï&¦2 øbéö#cŒ ïâ&FŠ”ÆS^ÿûÑ•ÆkŠÝÝ.œÊ³Ö¼ t &’¨ËDàÌQe¦—øfS“6ŒÒ3'}ç°ãÎeîVpüÌï2:ÿ¸@ÀÆ+$b[˜De’· -ÑÃni}ðW1“äñ$_ä+ž0 ô³ùîqô3õÑy’3{@I‹T@Jk½ÈØ»ãÙãBjj:~ÔBHGÞ@LvÏ/;RîñæÊ#7{霕“åp*m@;u)‚ÓñäÕcKî\Cƒ¼ÃË1Ì}´ÎÖ/Ü$!ån¬øˆÀ=gŠ.r›ÉrV3=ì(úf|©¶sÕ©E=j9pñØ= ¿œ‰z»TÑÚ9çËAUÓ7¾ÜhÒJÉ&­ê¨f?*’¥ àk¯ä$>!?€ ú>ñ¥Ó¥0…E?NÑ:6$’«IeŽ•¿_ªv +ˆu©sî™:úøîÈÀ4ÏD ©øF©ƒs… y¾ÔZÃé©vÇV<÷ê -ÓÕŸ¦2#FÄLö ”¢×H{/fì0GÁJ+:odþ²\RŠ6k3­à"ã´ ã•9¨®Ñ°swÓ׌ðª,XóÛ³Ó'é‹)ôÃòDSMEDÑhŽ:ýŒFüš .vÎ -ÂY¯Šï*Z®‚qñ4A†G’êJË‘ÅEá“$?»¨Š°P1;ñÚÌÖa)òÏ%¸µ¹™üsùûœšäâPÉÚÑÜàP[Q\’KV–ÇS”Eƒ’´Ü¥·ÏQÚ[)~cB¦BÄ<Áp¼gÀZk¡«¬ÝƒQâ=ð+K¿ð‚DÛYë³LìÀ½ ¡c¼S MêŸêF:¯Š-dséç SÐú¸e,™âÈûÆÚÊ (¦T’­W[Å6‰h½«[ -Ô4"Á5Š¢;ømä!øåZ=ËsºRy9’à×A8Üy_Ð0#öü‰Cåž¾…o" -þ‘ÒcÀîÙg'—»)-{©ôž""Bù”H^uxIüWðê1’3k.싶Ø1ù"çï…ò¦j9å'pj‹ŸŠõò±‘ø*ðŸq›‰RËÇØø\`DŒüÑG¤pŽ¯îÃ%oÏQ ¼w_`qÿœã¡ëóòw%h€Ô­ï‹)­{©pj’ÀšÙGøgäÿ×7{Sõuäëx¾š€¹J3«ÄàiR{I°~ÛwMñÿV endstream +4424 0 obj << +/Length 3698 +/Filter /FlateDecode +>> +stream +xÚÍZKsã6¾ûWø¶r•¥ð¾r›ñ$»“Í<6v*‡$Z¢e–)R!©ñ:¿~»ûk€ $O¶j/[®2ñh4~Cáe@áež¬‚¸¸Ìòt•Äáåzw\niæï¡B—f¤ O½½»øæû$½ ƒU—wr·ùuqó7Ÿï¾ûéjÇñ"]]-³,_¼}så‹›þüãï>}¸ +oÞ_-ÃÅG Ý|úx÷ÓU”->ÑÌW¿ßýpñÝ·õÒ¬LóÞ\üú{p¹!ò~¸Vq‘_>S;X…Eq¹»0I¼JL¬ýæâöâ_ æÌ%V9áÒB,ã`•çÆ5Lε¯¶e¿!rëv{µŒr³Ë­ÃPñázôêÖÎtÅídñóÀ•B”íåšyõHKè›5ƒ®»CËSã€QÞ¹ËûrP°‡®÷¶%Éâ]·+Ý…¡åwŒ‹jÅ#“¼6\ìx®\2÷™å!3£³ŽuGgˆS&TéÀƒÑ¢ÄgÝíöM5VèµÕÈÏ|«‚þI×ržjÐÅû¾û- 4ºòÚ|nÔ~Ôq⪎ÞÓèaEÂéÓ€ mÔÚT–0!ö€ö¤»r:ŽåÕé‘™?q,ö ÐõúÐH‹FM±;ÌÚ+å6“÷7]µ¹R†§±Ûc cÂY;{ÍÐ1K¶á®;¸–q¬t²ÖñWNû—M ñ(àkPy}zþmß1Æ=ÃE©G‘íThë¥PkWZfG ÝI×¢j:V;–@-ÞØ I4À%`Âiø‚7 ÷å ÚòÌø;Ò9 ¬wJBSïêq`^>¹/&ÑÛ(­Ôlkú÷Ç¡j+ùGOääVÄû®¤Ez^–Yo­,ÛC°úÕV•* 4n ¡3¸x«ë…ÓØK¾\%4ÙÔb^FËÖ<&á ÊeÇF#ƒV·º)s²ÜYâxäA.‡Î³3ºôŒÎÛK6¹½d“É%gBaòÅ2á +€úËZ+ç–{|}O×*¢­^ ce¤¹|¡F° õÂmÁÁâÃÖ’a#ÑRêÌù‚1Ù¯T²†±ë+Ý­nOH”Ú[vJΙ‚Nªd©äÝc¾!ï~ ÝÌvø~¸Å÷Ù†o°ãC=XøñÓ¿I¯Âà]ÚÍk†Ú$KpáÊe«€|u«˜ÛK÷PˆÑà©­Ëdǃ@XÒ|ºjÏåˆ7ƸEð®ƒ)²ü£©«+|̦!†èþú•½Æé7ÀT+FO«ï<Ó’,¥ý«×µ”‘гeÿƽâF$·)[®½¯E<' æÃkÅ  3lGû3¸ß|Xa”.bPmç¹²ŸÖž9=¯Pþ1„^îß;*±Ý©0¥µ-&É|5ç1¡òÕÅß|û±K¯âІjßþÆæ—ºÝt,› ™ÔwR_­õ¼/Wdbˆ=yO¬„Ò]öÕD§Œx1€ˆ(&Ùãp‹á™Ë(5«8Ëõ“¸&Ù±ŠB7­¸%…Š[°pÁN¢©×N9hoR€¸%S Y Åϳ)N&ÞBžÄoVÃ/A}#ö ZÚOÊ€ÜØ÷Gç ˜²ökÆ™,ÊÜ9=I¬çÛ‹ÂÚ‹^Xåö\ÉäˆÌòuŽ‡R\™8£f0:õ²N–( F†ÔÜT__Þ7Þ¾º]Ý#‚ê3s…#›Ã¹ÂäŸÿd§oÏäQX¬²,=ò‡é*N)%p¡¾ Ï„ú$›Ù1ÞdeÈçò”ólúðILTd©ñ¹¯weÿ‚Ž“¢áí»Ø1½µÈ)µöµ Už0pØŸ9üÙ ‘ä·é¶Šr_Q$:Œª,âxØ—fR«0åFúN² al§ðÓÁ™×e‡uܱïK­ÑÛêX¾ÙvDY|¹L åÒÙÿ—ò¼Qûh‚tQÙ¨…z qaã¨^8ÈC=V×ìRÜ{‡e l¶Qaè¹ÞL«Jç,J`>6³28ö%/]îð•Ëâ)Â}ÝÌâ‚·`Žèê¿£(%Ý#Åê™^!†È!¬ñÝrý!5âãx|´§¨¯9'+¦JEšé´Cµ%c/]qˆ9«ÝÌY QØê­0NjO‡=æÞiþÁÖüœO;o¥¼„)‹ˆcÛjô|/yHJfêñ­²Å·ÞíŠ]¥¢uö^…„;“Ñ­ÿtù‘[êwÇ«(Ë`…Ä +é©ãîßuSëÆç3 +™±çv‰ÅÙÆ™8íM,êÏè‘×÷z,†€=2N–šSO%Ñ܉8 ¤wQ»šrÂéª +DKËj$A`bH0t¹WÚ …È+´œýÉÎ<yS ­ÒSÉkÇDÅØ3ï·[÷"’!Œ•9»±•-ìÎÕƒvðö6Ep[A1Öàq¯li]Ga‹€26¼L—%®¶þ³T ÌF7Œ.ƒ†¯)&w‰¼¶Ð³s ?t_§&›ªK ?ôR©UÒO/\‡rÆ!…+{ y^0,oôÕ€Wš0Gé\Ù¨ï)O:(Ì&u¦ñù™Âé ž’X{å ØY¥Á•M½UŒžÎ0 eýíÀ_Œš/E,@Û­'AÛÍk Ýýè×Àˆ8>RsIÀl»;#)eÆî…³2ncÇØåÒtü¨•ÄŠdr­~­Ø‘rËpZä½-%f¸/—1‘çš«¶è0µûÔ¸pÏTVðkàƒñl­+˜ÞþP¡#.nôÕ¾A9Gš¸Ùé²E§<¼ŸJ†õà²Ý—31‰LJ¹ÓÞ³FÕç®0L>Ÿ/1 \9•ÛR—§ïIô–qôfHþ“$¥ÌR€fŒg(\¦ñAmEšäðÜX{Õ å=¯t%›;–Sy¶ú% ÷FKcB}6K­'lÌÏfîõ¨ê—^ZXÙWÒŠN¯©ÍÑ;©Ìœœ>C Ï²UžEUÅóclR¥o“ùa6±€Æ|÷•ãËãˆ÷H:x +Å‹µdJ£S©DmÁ½§fîo†¿V-SKkBñ[¬¼É­‘\D/I !‡²ÖÐú|”W² åU%)üW•¨X&²¿0¹JX¸ùqg Ltbg)êc&]å±ÑåS”l51˜41t1µžkWßõö,Lé}£GEzÅyï^¿ÃÅ„l–ԋƾUé\†Y²Ê³tv™9åA,³orEüˆƒƒ ë¯*@zO›\ ËÈRݹw¼lº%îˆ&1V?hAQæ ðRI!ø>Ó©€ØiûúÌÝ–‹©\hä_HùPI^3j‰"smJÊãHuÖÖԵ꠽Èv{ÿ 0xŠ¹XµÇÛ‹œ^w{žêBœu¸7؈Ž+)lÝJGêF‹¶Y+’N)–ŸµÄ¯×^ Yóȼò[LeËÿöƒH­Ò8q<þê“Kšª0³WœÿJúfÿendstream endobj -4303 0 obj << +4423 0 obj << /Type /Page -/Contents 4304 0 R -/Resources 4302 0 R +/Contents 4424 0 R +/Resources 4422 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4287 0 R +/Parent 4399 0 R >> endobj -4305 0 obj << -/D [4303 0 R /XYZ 85.039 786.531 null] +4425 0 obj << +/D [4423 0 R /XYZ 85.039 786.531 null] >> endobj -4302 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R >> +4422 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F41 3054 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4308 0 obj << -/Length 2946 +4428 0 obj << +/Length 3468 /Filter /FlateDecode >> stream -xÚµY[oÛÊ~÷¯ЇR@Ä,wy-z/9'9­7V‘9y %Z"L‰IÅñ¿ïÜ–‰ô)З³³»³3;ßÌ,½™‚Ÿ7‹W™dÅ¡o¶Ú©Ùz~>ó„c!,‹ÏÅòìíOA8󔛨d¶|hçI”$ál¹þâ\¾?¿]¾û4_cœÐ/¢(v.Îç:v.ÿþ¯[¦_}¼ž{Îù‡ùÂsn˜tùñfùi®#ç#ôücþuùËÙ»e+NO`ÏæÛÙ—¯j¶Á9S®IâÙ3´•ë%ÉlwæÆ |#ïÅÙÝÙ?Û¹¸ÏŸñ¨±½[Ž…—¸‰^×Oº¡ -[ýh5¢Ÿ pC?"ý„®va‡žën?qÞýHwO2PD9·W—ܸ,÷¿*Ïߪ´ÉËý”JPV¾.cÇC2zÁˆŒÚseHÆ»ÄÙ¯@ ?‰ïh•¬ªQ DŽv5÷Ü[ºÃî{l1±¡ÃZgI‹â…GÕH:<íi¾€!eÕÔ“¼kø+Q˜g|YäÂV¿AíRZ6¡]æ¸ Z µ¦÷ ê^ÁŒvºØyF–šé7K|ñß°…´R†é)°/L8ÿ¾eÂmU>°MalmµQîÓÍ®ç§yì;¸;Ç@‹8¾)¹çžt•ñK¶O‘¥ Yײ²H–2Ë-ôó‚YË2f#{J+¶ö7`\tBUBÎØ@ç6cÚ— Îò>-¾ÂsA"Vt*‰öÊã¶rŽa\ÝnÉ%%“Y…o›¢b¿ãŸpÓ~¡§Û/NAë4š8úaƒ{†§h%‘ 9Bs‚¨7I̘y*p#_ƒ¹A4p±ãgër@aC# ×ѸÏY.Ë„&y÷£µÈ“u`ñâD : \/ -f½…N¤±<¯Ks<JsM.•ïÒ‚íBGx‡»wWåžì¨Ù=fóœÖ@ø”{åPmÀ7Ú}ol§ˆ,¼¯o$ñ\åE³Ðá0”=£Èeõ¸©ÊC -ô~\¸z‡qèÓ<6ÎòýˆŸXhBî]Z7´Ãj0É âº?88K.È&~v:tìx{¾šÑƒ ëh8ËÞÿÛøzépÎ_‹Aœ¸~È;»ËØu+: -¶Æ€Qñ¡@¾ßÔüŠ{Ï­¯+†8x|A6(:^_‘n±T1¤ÁãË>klXøÊCëmZÙÉ -ŽÖDØ[ØÍdšF::hQ2"kzs”û ¿=ç´ácBC;:="ä:V-øé˜=¸ÂHè=bJ,»'ª¬J{×wüüL§{͹¢Ì™¡â–d†>«Á¢ tˆ*ªLßHÖ·ÍLR¸GÏÂÀ ˧èŽì>0].+ímŽŠ/µ+tCÉJëN}Óu•8˜æ¢$4’{á:ùiÃ/«ósw8‚Ô*£Â%_µâÙU‘•vŽ Nâ¡ñLÛ7" -ä¡ — <£å|@*„˜¢Œ»|Ÿ×MÅJ°z$Ñ$¹Ä<Å/‹ ‘G¢;˜v“6"4$ªóE²•5”òbžŸˆÖáyóqÉôžµD2Xxva& ÈãveSh_d-H€ Q‡Ã¦Ì+ÏÁ©Á™ÚS˶™½9Í@øì®=NÙH-HÛ— 7z)·vlï`] Ãºv%»¼±Ñ±’l#’o† Çî²t/ÍöPáË”ž ž‡º<’—UŽ"®DðT&MGL{‘Ò1{ì%}Wœk´ ƒ—Ö`ˆÓÃØ-¬C…ø£ -1¡û“[COa°rÇÑëhÖã™Ä`ÇPÂë>ÁàÏ[R:àê·e;9æ&YÍ´t€Âh‹|ˆÂ¤œŠI¥t1@BÒ³¹QAð×!û# ùÛĆ ^ãüƆ{<“ø ØÅ@Ìå“Â<Í¡ &ç,¹¤„:Š9¥A]è(â”)¢ýãÃÇ÷NF[qWÜÅÉ48ƒƒëÞÀ»s¼Úº@þs¦lSY>«l“w¥Ä`¦›¬¡¡>Þê^ƒÈŸî$”ÀšçÈÿö'÷ËL¥ÜŠ%E£ÿÌCEº¥ÿÞjl¨·_Xþ:2Ô&H„PŒdj¯ ’}†ö‡Ü—„L§7º@é9oKy½Ç¾ÛÆlšÂ‡šº‘P¼—Ål–‹%áýŠjT“uÓ†%׃䋠\_¹q ´¼ÜJÐÞ¥¨”ÇÖ³q–X÷ê{ÀeóoKÑdZ4+Õ$b;`œ²Ž5nÿ¥íîÇæPt5ùŠí<7 -ƒ¡í°b² ÃÑ%­ÈÝ•*Ãê¡@UGz5ÚÐ]K_¯²g?dK¼LpªŒ<,'ãÐ5"ßZšã‹òW[³ÝWÝMñXÈÜAÚrupµI’ïäm—¶…a¾Ï†_coQK¦2&®þKüÏd }ÈE˜/ Àû’c4Eì5A™\NsìO¹ç3Æïa¯[´C?f ”TB›’ÊÚÎ8(ÞV’6dÕT - ’¾ºá–e2Ð*q#Åî9®­ —eð<)Ë”o¯ï™á-Ó TûÁ­·L§+|Å&›¼ÅgÖç9}Èx´WP¨*bà¬F”ß‹ ~w6a†f±© ¾PœJåëÅHfÏõb!>K\,ø#ÄÁÊñ5‘¯ ªÿ5AsŒîü¸«‹3½Š¬Ï_ZxV»'èj÷ôÕxî„]-^B›¶îrûC#Ó´j'-”×v:¸»¨%eãžæ² 7÷%ìjÎä£l€_˜ÒJ¨{i…û¹—ns/ c3•«ßä«?•_¯ÑZ|×*T‡½£LY/Uf -Ýptûçˆî…nú¥[ä#Õ#k,‘àílXùDLåùí¡’«_`3EìøvȪ<“1¹Ì˜ò„m– ]«Ó"ÉTð"/»Ãž_ ú|îe+Äi/äù­ wÝy¨R%6 -jÚØ8åȹã*: RÒªÛ#û‰Œ>VæÍe¡c[¶•f͹A´—ÎIÔ»¤KX;†Å¸°O¤p0öëjVÈ=¥'@]·7ì-:'Qß?U/N|°k#7áB›t7cW(™ ~p` Xv£mV'òüC¯ö{©Œ¶ÁQû#{ÔòÅ)£¢ >vÇ q¬y–UÕ^äXù:rÈܹÿW(ë·¾¨Öy'!ÖÀæqÁžÈy‚Àƒ2cªò çxÐÝ~5û>‡z%-ò5)v>•˜Àõ§¾‰1þ?_‚üØMâ‰AŽÜ0ò­0”dÇ&vƒØŒHü/gendstream +xÚ¥ZYsÛ8~÷¯PíËPUMÙÚÇNv2ë8Ydz٪™y %Zↇ†¤&É¿ß¾ÀC¢œÙJU  Ñèþú€ý…ÿüEl\O%‹(]£üź¼ð[ùû…/ÞB»^hpèåÃÅåk.|ÏM¼dñðD$›Ÿë®Þ?¼º_®”RNè.WQ;/¯–Aì\ÿã§÷ÜóîíÒw®Þ,W¾sÇ]×ïîî—A伃‘Ûå¯?^¼zm½Ò®îýÛÅÏ¿z‹ °÷ã…çª$^|†¶çúI²(/´Q®ÑJ¾‹‹ÿìWá1½àY3'\YŠ•òÜ8ÖýQ}3sÔ¼Ö}ßÉ[ü œô¬wu™vù:-Š¯<ºÉʺËð¤î耪–wÝ=hn¼¼¹FJ—¿vËauþõû9y¹_®@ªuƒ»B/´…¡´ÅEp8rhçµ ÔOü{Læ²ÎuÍSq™º(²e÷Q ´L«t›•¸TÆÔÀ¡ö#àÖŒ‚c33~N‡œ§!çø‹â!βPÕ<ýâùªg{R&ØS´oÝåØ®xMB·ÉNh‚~ÛÎòøi\õw<†|ù[!ð¼÷=ársa¶(8oP¼áÃáÉëC±á®G{ * +Aú»]*“>¤%²ò˜®S´ÜZãztß@‡ÜÕLVÉ®ŸWvŸœ¥Ž”¥¬ç;\sÏÈw.hæÈ Õ8îKo‘º]Gy£“r©€ÁÊ>^Ž4$Óß ã7ö'¥áŒ°ÿŽ˜ÚŽûQ7p.iñsùZ­0P¡z‘Øb[>ºëºzb‰¹êÄÕF r^Xܘ11À ž‡¿U Ý$ŠzT¼TÝÀ… |×íá9¯¾¤å^öTaä¼GÇX R¤xÊLàúÁ(†Ûs½@=P/é˜Ûœ®œþßÂÖIì|Æ~Ô /uükƒ6­í§K…þÀ ^ ©²žéÍ&‰SÃÂu.hôíaϸS7(m,ÞEQoI‡dè Mûa n¬¨#MÖ#P}D ¬6„œ°ßÎ(éºÈeäj7ƒÏÆ„×pØà«-²©œ§ËB¿FH–Ùç)î#-Ýð¼¿çß÷d}Oí×Â5¦¸X×ëe¬«€rj¸áŒôæŒteEE&›¥Â”Ì{£7×/fÎß2àR‰«4iIKvt»Ø7$ÁÄ´L‘Û}ÖÎÙˆ-SÁâlŒ9€¦ŒÍâ ±QZC¯rr?‡’ {x´&¢PŒt­›N;‡œ¾vãHŸFhQI„¦Ž"4u¡á2n’s"ñcÐ’d±Š\…c‚ãßÿénðÐp7ß(44yr9ç~+¢L nÁ~•™<ãpMüÞ@±EâïOâ}éãcNà<¿dríÜÞàÊWLa ƒìaÝ2ƒÅ¬»S`P‘9ÒÀSM b7 b°‡À5áO à +âsÝ|Ú6õœ€üÿ¼}sóêêþá‡1b¢ß§m»ydªÇtý)4Ï,6é¾MËï//‹‚ê]Ývß«8™>ëcpV™¶Êa´Ð׬ýÆ$rLíܤ±ÌV CHøê\œªíÿ¹\WQ®Š¿áá?dré¨y:Àp‡'×AÀxË^¿åž"ÿ$x‰_éôCXû¾…þ]]fí,òC–[äOñÒpó¹aÁ ˆí‚UÖ‘œçÖ •…6Pkwicù,l\Zó6Ufó)üꤷ‡}œ#x%lµÄ>8ôí +UÞ€„ÍÔƒN¦„‰Í [¯Iý"M=Š)©3%ÁCô`¼À:=âëæ;nb/ʘ—Þ4ù$3¡%|/Œ·5ÿÖ¸´XÇ~å-w岘Í°ãõÁK˜q…¿&³A†)”ÀíÁŠþÊ0ÒcWY7™E-–K9J,¬b*èÚdO“Nmà‡àÓýÿ×Ù^ïRܱ³71/D “Ñ£Ák™Õ§¿&v®%Pñ1†”2Ø#}å‹Iü!Wp‚²+aR aÒÊ@Ý¢s˜º™In®aò$·0³0žs‹Ð¾Tžs…ü£;ÃIV1‰æáÂïjê:E5ƬÀœË5P߈A>î¬ÂÍ¢ÄY3#hxÑçrã@Ê?%—)¨©[¢ë “@»GþÏeÖù½À„ÁãÚ RÕÜüž[ëK­ï=Î3£±mò7GJ@@¾ÄªWÓæn>}»a/î¡Û:°Í¾ý±¡ÝÕ›œÕ‹ŽÎÚʼ~$E -eͧô‘´YŒ[Ò‰eS´åg®ˆ›{!Ÿ‚ø XÃ3çëx>D‘¶YýeÖ­/ë}Vaà ˜³ßœ«ø¼d‚³…½Uz„{Èg¸mÇœ q¢gOM‘g«²ÜʸqsÇ„˜Aãw*¡£Á¤È< ÿÚ—,kº\ô† ­èP´ŸŒó§.¿ûHÚ×òT‚k¦]GÊ÷xЇˆkþ­¨Üs<ýÄGjíõžçd¯»ž»h`ª“¥V{›¯ÜÓí²oúÂö; 5†ë@jý•;¨Ì¹è]„Øæ M-‡¢{Áï\á0Uñ:.¸¬‚æ‡Ó«>ÍϤ‡ch b«Ú¬Óf#C¥UüèKqø±¥F)XzPâQò-âFÉaf:ÿ±z¹î®ŠîŽoÈØOP¡”ôcÍŠ#4ð¥l+{ 9Y¾ªAŒó¶DÓ öN WKó¢å…jánªvûY½Ôɱü ‡“1häÕŒ î_Óû^+oŠ£”#¯E– Á’:›ó~KzXû”ÒÆ>Ø¡”2¯Ú+Ö(4J~d6›zLÛ|Û„öå›#€Ö§5_­GïBüYžó»-*„¨)Ǭ˜ðÐR ÍTºðI•rVÝRä²çS­0,kj=à›íUµã·Æ™CÞŠ Ý1Û®“sÈ;13øÅ3ÞÝ~ Ë7>ÆíÆ !2&©?ÑMP8ÖN&d<~Bö5ö+m[\¢Ò·âXöYyƯ¨ÀÖ!N@Ùï]È”eðȾRÖœâÆ::†_¨\ßSg\!üÖªÈÕ}ÁžÞ"çÁ¾FÒ»SìÜÛ§WÌ çGè½ÍÉ_ø´šð xHG§^79eÙL²n²´ëŸê†ŠÈÜrub«DÏÉ܈/N]9IO«Ä ==BXGñ) ‚ì‚È8¿øJô¨"€VPÊÁW‡™s! Rù0ý ¿Õ¼éx I©YΆ²4Æo7õ%Äòy}„ã°[ŸXRý7¦7Tæ½Å†áIÙ;}Jü/¥t†Øendstream endobj -4307 0 obj << +4427 0 obj << /Type /Page -/Contents 4308 0 R -/Resources 4306 0 R +/Contents 4428 0 R +/Resources 4426 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4287 0 R -/Annots [ 4313 0 R ] +/Parent 4399 0 R +/Annots [ 4431 0 R 4434 0 R ] >> endobj -4313 0 obj << +4431 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [213.892 559.249 384.824 570.939] +/Rect [478.789 607.973 539.579 619.966] /Subtype /Link -/A << /S /GoTo /D (samba-pdc) >> +/A << /S /GoTo /D (minimalPDC) >> >> endobj -4309 0 obj << -/D [4307 0 R /XYZ 85.039 786.531 null] ->> endobj -286 0 obj << -/D [4307 0 R /XYZ 85.039 766.606 null] ->> endobj -4310 0 obj << -/D [4307 0 R /XYZ 85.039 746.481 null] ->> endobj -4311 0 obj << -/D [4307 0 R /XYZ 265.175 682.906 null] +4434 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [300.043 450.136 433.847 461.826] +/Subtype /Link +/A << /S /GoTo /D (samba-pdc) >> >> endobj -4312 0 obj << -/D [4307 0 R /XYZ 85.039 614.633 null] +4429 0 obj << +/D [4427 0 R /XYZ 85.039 786.531 null] >> endobj 290 0 obj << -/D [4307 0 R /XYZ 85.039 544.981 null] +/D [4427 0 R /XYZ 85.039 697.613 null] >> endobj -4314 0 obj << -/D [4307 0 R /XYZ 85.039 510.235 null] +4430 0 obj << +/D [4427 0 R /XYZ 85.039 663.47 null] >> endobj -294 0 obj << -/D [4307 0 R /XYZ 85.039 413.878 null] +4432 0 obj << +/D [4427 0 R /XYZ 85.039 580.979 null] >> endobj -4315 0 obj << -/D [4307 0 R /XYZ 85.039 379.132 null] +4433 0 obj << +/D [4427 0 R /XYZ 169.887 586.952 null] >> endobj -298 0 obj << -/D [4307 0 R /XYZ 85.039 269.226 null] +294 0 obj << +/D [4427 0 R /XYZ 85.039 435.867 null] >> endobj -4316 0 obj << -/D [4307 0 R /XYZ 85.039 236.805 null] +4435 0 obj << +/D [4427 0 R /XYZ 85.039 401.122 null] >> endobj -4306 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F38 2997 0 R >> +4426 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F58 3380 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4319 0 obj << -/Length 2968 +4438 0 obj << +/Length 2509 /Filter /FlateDecode >> stream -xÚ½Ùnä¸ñÝ_ÑÀ¾¨iZ©k‘ð\Yov<“± 0™¹%w £–z%y=Þ¯O$Å> Aà‡¦ÈRU±î*YÎBø“³,¡Êgi–ˆXÉÙrsÎVpò× i dáÁ¼¾»¸|'3Š<ÌgwOŠ8Ofwå—àÍOWŸîÞ}ž/”RA"æ‹4Í‚×Wó( Þüí×O¼ÿöㇹ ®®ç ÜðÖ›7wŸçQ|„“_æ_ï~¾xwçØñ–J!3¿]|ùÎJ`üç‹P¨<›=Á:2Ïg› +kež›‹Û‹¿;\|¦güÖ±»[ˆ…ÌEÅçå“$" 'ŸNµP:ñåÇ"Ñ)É' -„ë¢ 7÷ÅP1¥æ×äáZzù6‡çv‰V·î;Ô}ý‡‹² ^61|g´Ä9ïàNgOŒ#iJ;‚wMt‡Õ†ø+ÚáT,*и È1[:›†ØÆ`ÿ²)^nÍ]àÎO%¡¿ÓâÒ™îú…³åÓuáGDŠÜã‰Ë{¸é\r‹…WM˜¦øm(= y^”OLÚHêãÞK0æÎVFeÄúS:–è§J+/kW/ñÃ@àïU4”%ü Y[[]P2Ã,1®É·9ÜŒ°è­êb@^ÚwÑIuBß6ª×S¶€umP FîIÅ,üÿa\¸¹¾åð¹aMŽÄ£²ˆú‰oØ#íÚTM;^ÕLFÅ”&àÑ¡&ÄÍaMª­¯"T$¤.(O\Œü@×™¨Ç&‡Rfï+Ë>ÞQý²©+R!É+w©Ðp: ZJ§:ó­BwKƼZ¿âäÎòÍ=×Ë oR‹ÑæhûŽyáÞÖ\:7Î ›Ë%ˆ¡Pf±i² Ä0ãÒ 9Z,.'0ºþ-øÇÙ¬ŠEñØW¨/k44Ö÷T¿ñºíølŠ/´ÍÊBB-"3ÀÖëÚ•0¥æ \“Ï-Et* ZôÐ?<ö·Å0pÒ§r§tù9¾:&€_Þ"ð•é€‡®y¤þªUªMI»±uÞAÏüÆ…)8è jq"ÍAO+$ôšçÒœs:ÍY —ÒÜ9‚.ÍíS<šæ|Šœæ2½S׃‡HžvÍ0ÓSÒƒ5Yvæ·¡Yìz|½ôz Àikg~ß²ã,ÕCê0³¡ ž]種 ÜÌÕÇŠÓÂä½)V¡—‡Æ»»ÇŸ!öVÆB¨ó‚8#Ö˜ÍSžjëÁBY^lƒˆÃIµd*~/šìR#ÃEOõ-9:‡¦SÖ>Ûì°àœÕ¸¶wxu‚ÊAÅ}÷nÞò³kia Å6”“ê«ii³Cž49Éa]qá‰:¤òqpT……Óû²£°±qI³¬JPY¢ÀO OÖ^ lp’‚Mò]¼^g8µ7 ƒ@²BC òÇá‡f§AÇÞ‹;9Êø>_ÇÏfz„uÍ‘ÖÃ%Í‚v­:K÷,¥©ÍŸÌMûDüQ!„óe¶s&þ ãÏ‚SüÙ£x<þx¯Z“d4v¸ÕØt+Ô6> ë‚:¢hª«µ™¡h†‚›§C ‚ºCïÛöÍŽuh“zÿܨZ0®²qŸÊÇ&lùxh†¶–,3qÐ*|±–DwÐü-m7]oM£§ˆ…d¤( aéÝ®ØecmzRÛO†\«3ç¹Ç¹’SáK1?ŽÐ ÇÆr;v+WôƒÛ¹ä^çn‹@~{Ý„s†gì‹ý€º"njâê”DY"¢†êŒK‘cuìF¯Q‚íÆÓÐXGDqà í{±ÙR|Æ™01„Ìý£á(Î^ú{0'GÃQ”ˆT²·¼§A0)ÒÜ«ýrÝ¥µ-bx*¬v§ÂTÙ¸uO/NºuõM˜†‘/éU^;Í€:»: 55T4šž( Õ8ÖíêÔd:‚H‡úðûCš§æûƒÚûþ ¾? už7K°Û4f‹TÄiâCìÿN1ª¦ ô°ˆÂHä*9ã ”B­½ûŽJÛ¸ðdäaí@QªDÆ3Ð7æ<7û˜›4Šª7öë‚I¢Ü~ES:òR2~0͘I‚`k{lëHï\ýˆP§/?ö<û¹f2õ¦<ì·f9M›?óχë·è²WŸ±Ç¼ûé̼™3õh”>êàŽD7ÿUŒâ˜§Œý›7Ÿç<¬=Ry¡þ‹­.i`J±r‡‰†&KÛæGx¸¼ä>Û+g¶ñ. 4+ñÛce’)Žj55«&•I¢Ž™ÎPÁ›ä÷ñÏ…8©"¥ÑÙ'Ã4Ä*ºFËxÊ!2 ¾¬Hâ÷EóuŽóOÌ"\XšÖNšNWÚBš“{±ìZsÌ`»èÍŒvÍ V¬­os;0ùCÖõ½ðÐW«Ú+ÿöÈ´. -+n¯ðS-Wf:›y’Ò ä8‚wöO °+J¡³Øœÿ —GPÈ4¨ È_Ž € ›ÊĘlž¥¶'Ë‚\ßÜòÖÁd' 3žmE²<°é–­i˜Ã–º¤û¦Úð3·ÙD¢åOp°y¼>&ª™ú?J¢6Lò| Š¡DÄQ¼£¼›j$Í]¤Jxá žÌ­B®3×8‚U¡t2‚ýMU¸QUh¦½¡?;†²®Ñ}Sq=4˜&5`ò܈…fCy9¤ºEZL¯§©]áICe&!6«ýd±ãÑ’ÏÅ(‰w:Ÿ(I0”á6ŽðòÊ=)JRçæº)yw4oM5}²¢ƒSæeJ¨ÍC;ó¸?†#I˜ž3éÑxZ׶;D΋Áü2Ÿ4Ó‚ÐÌ»“¡ÌíÐr¡"hêç)c0J»Ï³}µãså¹Þ‘z„MÑ?›áî» ¼oþ ¤ck뻦ñ¿žl6c¡Õ‰laÌá“-t&òìD²ˆ£T$©¶ÌP½žì3+¨¨A7‡ÿ]SSendstream +xÚíkoãÆñ»…€~¡ÐhÍ}ðuH[Ø’/qŸ[…?$ù@I”%%úHêÿûÎc—"%ÚçäТÖîììÎsgg†ràßÄðu2ˆâPZæ›ð+ßH‹áŒð×Χ'§ïƒp }‘øÉ`º$”éâgoüýÙÍôâv8ÒZ{¡Ž¢(öÎφ*öÆÿü× Ã'×WCé]GÒûÀ ñõ‡éíPEÞ5¬ü8üuúÃÉÅ´Ezd„ 5Òþtòó¯þ`ìýpâ ă'ûB&É`sb-£íñ1àÎï +8/¶È¬?ìÊ”Ô_l-&iyžï½ëñèÈ‘úüP†B‡à§ÿÙã@=:<6&xãᡸÔ>³×§o&Àñ9þ+ :ª!­Ó÷:nm µqíÞ¿3Bç\©„TÒ"\oY¨¡qËsZ¦Öž]ß5$%E“ªH7¦ýŸT#JÚ§7Í£7ê­«“ _–Ú]ªîEû†ç“W¨KˆXþAòUžâ”É1.ZêØRÖ*OëzeµHî!#DZ>ê6r!íµ ÊÑmd4¼ÜV»‰_µ¾–BIõß”(jyË$êõÀÀƒýé;ÿ¿¾Côñ9=òˆÞö%y7L«& ¾AXxpC?¤äÎ#bñ2*H:t 19Ó¡öVÝ8”–”h壦T±÷‘¡½é/ýâ>§0À§\ø.P‰«’ñZ"G T¨yŸå†“%̨òEkÇã>ùœ¯‘ÕgF¯Wû­-NF=‰Ü¦4KGwóºõÖåtDƒý¦ãZ‹Äå Õf&@[Ë÷1‰½wöÊš|Ÿ1¤6·ªVÒ~Ú6´®µÒŠÎk%X¼T> xpûÝ+·úâ7~úåZò¡PGñ#ʨnyùÜãئ%ˆ« ÚFÄQOqAÄãâF7ú¨¸AŠ$ѽ!ÒEÅHQØÆ8üý#j9ÊmÃÀƽ7éåŠ\¸^·O=È]í¼®êº¹ó—fP÷7lyÈ™—€]ÖŽª@­c‘¯#¥D¶ªÀ¸Ï¬B°#ÝÕö…zL«j•J ¢ÆÇ .MþÆ?ù"}¬ÒÍ;ü}wzº¡°&>í²ís*Šò¡çŽlèÿ9;ØqÄ0íÚ\wܬÅð$AŒïmŒxžüº*œù#ù‰@hvRRº086ò½W:xZZC¡¾w6¯×Ÿ)¶EÞd]fsˆá+å‘ ¡7!§ØÐóãêrÞ0.¶uYä=«‚¸„—SèWóƒ3ôÓ ðŠ%þ[ò ÌòŒß÷¬‹quÇ¿÷kz 8ÐÙS”ïûÑa.w¶m€Àyܬ·ëª.Y NÄš Xœ"ûEþËÇ*X€iš® µbŒñ½;ˆœÀâ ùiP¡R¬nøEScëÇéÌEAe3ømúI„?P•l@çÈÊ–íÈ5(:§×à˜I5hp€Eï8À'ˆÃ6f"¬ºi7eèPÊ Zrs`—¸žëè8â€es Xq¸0CêÄ›®X¾·ÉÒ­6†»uîcƒ¬x‘Ó”=ÖNì‘)O©b¾ÝcáÁ ©{ÆÎwŠÜš“‚¥Hhl›ÐXìŽ.>é»>nÁ™öª›‹¾N“A¬¿>ÞoïW¤cž?íÒ|MI¬4$fÅá6µÁ•rjÙ3aÎ rˆ*—ÞÊðY=Ô>„øÇaüã?zd‚J$|é•‚0ŽÕëÁùÂæÏÜÒìëîÃLl¥¾)ÿ8‹ãöq'Z€æ0EÓ}+vÑÚwu9¹ÀVøí0ÖÞô{FXÙŽ(ñ`[Å|1Ö®Ž¨³òµ^,(‘<öò_”ÈxÄx.ͶéµG ôt‹Â² «µo{’öX˜8°ë‘ó¾#ȾÐ& "W6ÚÊ/Úk ½¿ü`E9*Œ¢€/òâ´(eÆ`“äébn+j†’ëE{õpãËnŽUP˜ŸÓKαu!ªæ÷ûÈåGl¶C7EÿE,n#óØöã ž5!®cÆŠk·‡dÖŸvÖa€“¾•à·‘»=/œÛm_6¤N|꿽Ւ³ž3—ЯXR iTÛ’¶Ïɔ±nbœu“ãÊ}:å"^Glp¯ß½ýÞ ±é?,´QäkïVbó)ËtQnÒ<fˬ#å‚¡,pP;i›7€WÜëh|5†€ÞÖæyÙd‹’»(*L0T)ÈÖø!ÊxRSôV¶8*ÁˆÆ ¬óÁbü»à ‡|1qcºå &1½lmj<<‡hÁ¸î ”>þ¬2ûµjžÖk*ÒÓȧgzgù"àž«&¤KÌ—iI‘ŽR§,•p°î”ª0µ„™,`aLý´ÛçoeÚIÐ9ïªùFEqAú¶› þmr•„ž#לL[ÈKp¶Ùg¬K»-m1tà÷jú¾qݯš’Ù†Ií+#•wºm8éÍ°pIòW@@áÏš?ƒ5Yí7˜ƒ)²YYP.=·í8»‡¤ÃQ™=¬›¢t6¯,G9uÉ,*ek»&22Qï8Ã)=ÌìÎ0J¼[š,÷ÂÒ°BO¾  «1ê÷vƒî  "‡12ö`Y5bøQÙÀÃ}©‹Ì9œ¾¡ +Ë@²In°Ä±§ ŠLKª¬è{2@¦(òŸ›ÓËÞØÿB1úcYØäß4ºI¹5'æ\eæÊÕxäÝ•ûx:¾|Ç(ÔÂLûö¡Åmƒ.-m"Ky õóV=tØvpgð:ùaFgÿë¾þ%Bmš[ôªQ£ˆ#»fþ7dùÈBendstream endobj -4318 0 obj << +4437 0 obj << /Type /Page -/Contents 4319 0 R -/Resources 4317 0 R +/Contents 4438 0 R +/Resources 4436 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4287 0 R +/Parent 4446 0 R +/Annots [ 4440 0 R 4445 0 R ] >> endobj -4320 0 obj << -/D [4318 0 R /XYZ 85.039 786.531 null] +4440 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [344.225 502.667 405.46 514.356] +/Subtype /Link +/A << /S /GoTo /D (mulitldapcfg) >> >> endobj -302 0 obj << -/D [4318 0 R /XYZ 85.039 766.606 null] +4445 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 81.715 144.542 94.617] +/Subtype /Link +/A << /S /GoTo /D (netdiscuss) >> >> endobj -4321 0 obj << -/D [4318 0 R /XYZ 85.039 742.055 null] +4439 0 obj << +/D [4437 0 R /XYZ 85.039 786.531 null] >> endobj -306 0 obj << -/D [4318 0 R /XYZ 85.039 286.231 null] +4441 0 obj << +/D [4437 0 R /XYZ 85.039 488.918 null] >> endobj -4322 0 obj << -/D [4318 0 R /XYZ 85.039 251.485 null] +4442 0 obj << +/D [4437 0 R /XYZ 259.599 494.892 null] >> endobj -4323 0 obj << -/D [4318 0 R /XYZ 273.205 216.485 null] +298 0 obj << +/D [4437 0 R /XYZ 85.039 398.004 null] >> endobj -4324 0 obj << -/D [4318 0 R /XYZ 85.039 134.663 null] +4443 0 obj << +/D [4437 0 R /XYZ 85.039 363.258 null] >> endobj -4317 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F35 2976 0 R /F38 2997 0 R >> +302 0 obj << +/D [4437 0 R /XYZ 85.039 266.901 null] +>> endobj +4444 0 obj << +/D [4437 0 R /XYZ 85.039 233.218 null] +>> endobj +4436 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F41 3054 0 R /F38 3057 0 R /F35 3036 0 R /F18 4228 0 R /F58 3380 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4327 0 obj << -/Length 2867 +4450 0 obj << +/Length 2873 /Filter /FlateDecode >> stream -xÚ¥YKsÛF¾ëWð¶`• ã1xí%%‘ŽW‰,k#º6[I J(“ €¢ýïÓ_÷Ì4Iåàr¹8ÓÓ˜éîéÇ×#äÑ?”F®f£$Ý(ôGËÍ•7z¢•÷W¾æ˜h–É€çf~õöç(ùž›yÙh¾²ûdžeñh^üáLÿsý0÷Ûx†¡»ãI’¤ÎÍõ8H鯟„>ûøaì;×·ã‰ïÜ iúñ~þÛ8Hœ´r7þkþËÕ»¹g °†æËÕy£‚ÿåÊsÃ,hì¹~–6W* -ÝH…z¾¾z¼ú¯ÝKÖÔH¾:§{¦n”†§ÊûÑå£ÈUÂÊÏŸKÒ&œŠ”(6ù3ßYäKhöF(·ˆžs€òà[¯…«)A)ˆR5岓ºgš—0ÇÛŸã`pºŸhDÆÁ‡j;gQm‹B˜D‰kÞ}‡#ÖUq¾ÉÙ]-¿û¶4ç–B¹›Aôë™Aº¼Ë¹å«ð-¤¯×ÄðÂzÊzNÚ‘<£I’¤ÉhâÃúKòévÖâö•“oa0ñ„÷–º"bÝõÓ={Ëï2Ë—K>nO[×µî%Ÿñ<×#¯ýgŸ!{E^tÖg<’›Œ˜¾â{ü•GûÈÈ°ïcÃ*R‘¡õ¬X|ßÍ¢×Eá¤ül“÷e$Lu_“¦t.¿×Óp{ ÅF‚G_F¾ë©, …e0fé{­˜ðövãf5‰9Hª· ö•H‡^dnœD£8&áõ­>æ$ê¢.à-“p< ’È#ç­Œ+\w×ïÐÕÁ§ö|eeòùÙ–a¿É/Êwvüõ“à"ù²÷æ4t(ç¨ r>nKa©W²%ù¬Ì»}#sßiÏ0V-û­wä°+¨¶´‹C„P)|À¿|I¬l§ø7rrŽõrZ!=5$GÙߟž±8_«Åq„‚•”f.ì\ã؃Ì9b)þd†3`0~j8¯Ü±7aÐàAÖ¸l,?k!Þ¬±ÁŸ^ä­ .­±†|a1Vú OàÊ"×WñhP‰ ®<øÁ‹*l¾›fêU`› °i@«Ê I£›ª,u醻‹]EN7éLëÍfÌicƉó®¡BzNÓ^@Pf—פð\DÊ*&Ÿ¥¹F5ÊF+¹KL*ý›Ë{å­F¦[ãí¨|²F‡+ÏVu#ƒÇ|ÏYh:¾/õ¶f€êNÆ_]e‰[œ—½šý×&#.rX®?=h•m  ]tÆàãkŽ²Àùµ”ˆ8U¼OÞqÀæà&×]ðkêxª¸ kœ“µðD|~É©âŒï› !ô¥ñëÛóX7³@Õìã)Wß+{™ïøpµÈs>Pç4¤“ -9\îz¹¬÷ÛÎhÇ”ŠCºÝr'ëTˆ+”Ú7²xà `vÌ–¹vÜ[™õO—ôó(ŒÒèuýzž‹Ž&ÔBınñèìM½°.²2UmdRs±æb³Ü3Fó‘ ·2ü{i•+¶9(çt× YC|D ýAŸÐ|µ.µpâë -ç®b\M+DT­åÌõºN±è¡ P¾^S¿ÇRÓO½v±×Õ™3.– ôz 0vÂâî~µƒD "çüLãi-‡Su·´1ùnD7}7°”Ùv#۲׳_AŽfßj‘r1+¹™¨ÆÄ%ø¸nti¡µýŽE/(ºZQ6<Õ{Ë™#Íز=hf’T.éõ™ÐÕú×ô™×[œÈbnbÐ(^››[˜Lž° -œ Ð×ÈT À¼ÏÕ¶ßù´+þ]Þ}YÐTgZÏÊ~^`òbK¯>ðÐ@Ó΀Ë3)Œ½VžÆ™ï<^ -ÎÁx"hÖ±`?y˜uªïls³¢Ÿ Øº;Þ¶ã||t´q/7:6Qz€JLGþ#VPãåÈÝvyÃ84c/Á¯rLyü¬ã§ZP5óÅþR¸è|ܤ=’®¨ š·$Sœð¡\t'7-$ 5Ôìôæî*eÎNÁÛrÎñ»×?¸£´[ƒŠËþ Ó‹fS°¨ëj¥ÿ“ÆÈ>'Ñ‚X¶4‘73<ÚZa•<ñäÕ‰^éòÊ5L p¢õf§‰µsN¦1Æ1ëú‰ sò\[Ï;½=×M¥t—üRšWþj[œ…À{’c€¿rZh¾ àpÃgèb®-A#ÛÊa³¦”T7]Y¸æä q=‚Žýãb:ú¥m¯{SŽ ß‚m[ˆ+—Ö»6È›òœ”,'Cë›ð…’Z‹¸¢”ßë[!Ö€“é Õ‡à|si?øžÙOº‡Îâú€ý *œ‹Åu>LQ°ž(Sy¢ Ãï ×1*s+=Ínfèù=q«Œ\~$ðZÛÔ ^A ˽zÄÐAfÓKØ ï¡‰<«]Ä&ž‹Ø+ð"7ŒÀW Á×T€R H 8 Ì„+ñbÆÙ Qþ¼×ÈËVfZž¢ç¶¯ºkÖ”X8pè×À°û¹’i{ ‰^H¿ÿ mÏs‰ù‰OHSâáU'ØReÙQÉ2!üô‘¥dà :J•@ã™ -(–ä’"ˆ9?ˆ›@b•°­±,ÕóÜT˼Ó{g:{tØS¯[Yz>rT>I',¬~³k¢¯¥ÞÉqωíÛi T›ÅK›cgÿGð•ÎQ,½Q"0”Ä™S%ü­DÑý†=FúlÞ\Aæ´J»1Ì(ʆjgˆ!­/ÄI%ÿ–"bÏëÌA_ ,I™˜¬øæ5ÐÉfZ}-çg™™‡f ƒµ£T+Ö•·_Aƒª}.‹ï‚øQZ@c« ¾ Ï%eŽ1‡hFTð“\i¬ÿˆ‚ÅÁ鶋ÕÇ£…ß6c†å˜Þ€EÃ!ÌU÷, ¶¿ýiTÖŒ$Ro‡¢EïÝæÚͦ¶ÀÝ}P,9V×–¼’¼¹ý÷7Ò²­ìZ(Dä 9Ã!gžÒÁć¿`’FÊ×Ù$Icé`²Ü^ø“'àüxÈb”GȺ^\\þÅ“ÀW™ŸM+²(~ñnÞ\Ý/^¿ŸÎ´Ö^¬¦³$I½ë«i˜z7ûùžéówo§wu;Þ“nÞÝ-ÞOÃÄ{œ¿O[ütñz1P=3ÊÄuºøå7RÀò~ºð•ÎÒÉ3´}dÙd{a"­"£¥¿¹x¸ø‡“Â<3áY#ÎìˆY©,ŒÆwa†VG™Û‡ÈP¢á>Ä*T`I;E¾÷¦™jß{[ãÄ+øú^‰æwHŠ½œ9¦:ðü×"ó#Hèú¼¯ššù¿ú© nWÀì;nÏ›mŽ}vÓÔ= h6@Ü”í_톎X£ +ÀdkMœêb]¶°\ÂJm£Ç3}Æ#kyEËÓ0°FNÏ£¶då)뼆ÕT¶iø»/HZ"/ï­*þ0«ÙGlDê²a5-r7`ã+ ›ÌkP‰ Ie¿fáQiO¼=7aLÁ&㿲EŠñ7÷—·÷ÌEk‘VÖùãÆÊ-˜—×ÒèE£‰#¯é¡½¶¢ž×e-‚z¦àÐ\„>‚Y VÖJÊʚ”?ÒÑôUõ©:X+òoîpIÑx?br]Ž·û#‡,m7ºåÓY쫧¬œ0Q>Êùà6¶åFhÒãý M<ÜOJÔá:ï‘”ÐÖâ÷“"ó͆âºrv &´eç‚dÏA†ºªÚ-¡ÙðJDU¿–™ûN–߬xÎüîá³p m“ãØ›»~¸§mGEÇ«~ªpeO°©I6b>RžOñlRF!]¿Ïn$Z9ä\‘vô¦ÊŠÓ©ïÍq·Ú’™Mû§r”ÛíT‚¢®–u€Ûb¸¦pkž*¶á-…Ó«Yi¿–Ã@Uä5_v{¢¶ëÜ¿/>WÉìËìE Kçˆm¾Äu¢7Uµu)Ô çÑÚþ'<ÓJºÈÉw;:ú_Æ 088nX}`D[±c€q&¼·M+ƒ«z…kl·vsh5d&w$"¹³jh+ ;w$©eF¥Œ½LlŸ&ÜxÿãWÐø¡\Š~ˆB`k¥OeÇ1¤jì 2ØËÕéô™ÌŸ‘ +ã—ò Äö0ž‰vy0@W|¾cL¾¦€Çdõ Ÿñ°GàIÎNÝ׸ƒÐ绪$L_X›” â¯gµ+ +xßÃbä›È©(ã0æ±k!ëna.CßÿýòŸ@:óîÛfåÜ¿©ó O ØlÚ.ƒã¤J¾%>º…øövŽ_½ÇH_¼áý:ïsŽ‰îT ]†YzœJq)™àƒ)ô0éâÈGšØÉ÷ý ñQØA6![”÷¶SrClûh«7DIÂOf³Åk>Ô­ÁÐïOÂ^¶ea—›o:–ò«ùª8âÜÔ]Þu²˜‚ŠÙ(àÔÚ7§'bÎЕ®³noõK`‡,‹*Øþ<à~³© +{ j¬:ÈT˜¾”àB£tüÁäþGÉw0‹UõËÙ7ùZöM¾}uIï¿E +λt¯ Žs.º§nÅñÓñ]ƒŽ!É·8¡’/‡Œrb¾Ù +ÎW§VaË!'Ô_rÕ´O#ˆ*Èé|uPšÄFΘj|£L¨OnUš1'Ú†›9Ý  :z¦®¨rF YÔe-h|-%d÷ýnðWó›àÙ+ž‹OyoáXEæ4{ ™á&„ß|íC¼0œå€éò3òèåj¡œ»×ón`éTµƒz‰]ãÞ]°ÇÕÁn*üˆ¯ l×–»Ü¾¥‡Òg=ä[t¯GQx(Ž‹@ŠÜÂWÍ@RGoö!‡U¢¼ü½xïê–±*aeS·-‚ѯåúÓvƒ( ]bsW™‹£WÅÎÖiG»@å½3€ˆfßoŽŸ6€˜Ë¨»Ãà~úýØs¹V±ŽÇœ ŒÍ”L0â`Yr*6R&ŠŽChÈÊ|Ù¯ðAÉÞyu’x·snpÒLøn‰ß‚$6cA£sOxØkDŠcßcF»á6ÝŽ¸à¥Š[·V}.ŽA·Dä²”½Ð˺vΫgç—ïj¬Ÿ }»ÖÌìÌ´Ø D¾Å£Ì ܲoZª€að³AÅ CÄÇ6åHµ‰ŠÃLöw×VŸ!Å_¾½ºys{÷Z¡Ê‘âÃ/HWET¸(,Nj‚Ãâ)fø–ÆÊ®U4Ö%u:0 B•¤¤«R¶jÔ¤ÀO”KpÖ¢®„ê¾ïT_<þ‹¢,‹ÜS¤ÓFíªãÕìkÙ–Éäu@.÷Z¦HùåÞøq´»yY”ÌkÉ–^¡IN6¦g¤qσaË›+†EÏ+@ZQu»åNΟ{ÖX0Rè'ùÍ+a +(a[8Ü"‡;O¥}^uàI%a˜&Vl]>sÿ˜xꤲç/TÖm?Ûï¦|†Šó¶?VsŽ›gÚ>Ðx櫱TåÎ5°ÆǵcÃ…O”Šñ¹¢‹rdà HΠçͦ€·äÊi쵕 r·‡›«È!Ï€oΟ> endobj -4328 0 obj << -/D [4326 0 R /XYZ 85.039 786.531 null] +4453 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 625.663 152.096 635.11] +/Subtype /Link +/A << /S /GoTo /D (adsdnstech) >> +>> endobj +4456 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [203.801 348.584 271.854 360.274] +/Subtype /Link +/A << /S /GoTo /D (adsdnstech) >> +>> endobj +4451 0 obj << +/D [4449 0 R /XYZ 85.039 786.531 null] +>> endobj +306 0 obj << +/D [4449 0 R /XYZ 85.039 766.606 null] +>> endobj +4452 0 obj << +/D [4449 0 R /XYZ 85.039 748.602 null] >> endobj 310 0 obj << -/D [4326 0 R /XYZ 85.039 522.931 null] +/D [4449 0 R /XYZ 85.039 611.394 null] >> endobj -4329 0 obj << -/D [4326 0 R /XYZ 85.039 487.62 null] +4454 0 obj << +/D [4449 0 R /XYZ 85.039 574.523 null] >> endobj 314 0 obj << -/D [4326 0 R /XYZ 85.039 429.586 null] +/D [4449 0 R /XYZ 85.039 450.864 null] >> endobj -4330 0 obj << -/D [4326 0 R /XYZ 85.039 394.84 null] +4455 0 obj << +/D [4449 0 R /XYZ 85.039 416.72 null] >> endobj 318 0 obj << -/D [4326 0 R /XYZ 85.039 230.737 null] +/D [4449 0 R /XYZ 85.039 333.141 null] >> endobj -4331 0 obj << -/D [4326 0 R /XYZ 85.039 195.991 null] +4457 0 obj << +/D [4449 0 R /XYZ 85.039 290.188 null] >> endobj -4325 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R >> -/XObject << /Im1 4096 0 R >> +4448 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F38 3057 0 R /F35 3036 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4335 0 obj << -/Length 1645 +4461 0 obj << +/Length 3014 /Filter /FlateDecode >> stream -xÚ¥WK“›F¾ëWèæQÕŠÃð8¥ö•ØŽ¯rH9>°­¨ YÑ¿O¿ÁJÚR[[‚žîžîo¾îi¼© Þ46Ž«“i‡ŽÑÞ4ÛLÜé3¬ü:ñDc.*óÎÍbòÓ/&œz®“¸Ét±²~×1I8],¿ªÛ·×‹û/³¹ÖZ…ÎlE±º¹žù±ºýí–ß}þ8óÔõ»ÙÜSŸXtûùÓâËÌÔgXù0û¶x?¹_Øp{Zc0ß'_¿¹Ó%þ~â::‰§{xv/I¦›I`´c-ïåäqò»õÅkÁ”­ÎåÞk̽ÄI|ó:>aè„nhññaÕsc†øã„ADø„Nà@†1ÆUoë™vÕ0#µ¬ù÷þ„ªÉ·eºYÚ!P9K»õà¥Ý Þ!ƒè€ôÈ؈‹¡bíÓÆzdj¬y‘*„)¿vMZõê[ºn:Ú"R­ØãZ®ø=ëw:–9nC[vÃVüײ-E˜Y ;„&…xpaZ;‘Œˆ5Uy`Ñ¥2¥!Œ(ô8£U¶ Wñ¾ ¤ë]×÷’ï;l •Ú³8èCSãSîL°JDzµ‰ƒ(e ¬AiÅØe/5H-¥20ÑdÂU¾ç‡®ØPТlAæ|ê&‡ê ÜD蓾>da13£6y·®©€e›¢÷G¬þÛd%QT¢íÈPyQ2ùØú¡Âi,å›…zn.Á6–nKÒ,«wÒgN»Á¾(KÐ3Z=#¢&€Óà>FÏ+^ðý -% U»+Ýté™S¶:½;M@WY#éŠúRÊÏ ß]M‡ …1v†°;å«púé ‹]ó”¯0z‰'* _"õf#ÀC¿$|i÷Y¬%n »‡c¼ðEÃõÃ&u-órQÏAXŸZž™ï œn¾:ß t.®ÆOœÑØÈØzË]"äQµŸ\CEƒªe*,¤ØïJ^¤{±`BHÏ -1Q€¯.ª«‰ôÇÔ 1@Qþ>áÛGKKÃh6ö‚ •P{Ì~<"ʨÆÞ?üôò˜ò”¾‘Õ­ÐË‚¾ÈÊbÀ8°!ýç—Œvà¶>û3ï}ÍÎN1ðcßñýpB‰±¥[Ž6“jâ‚e»µw†¤õDµl^süó¯þôš7žf0²¡SV8¥]à†f ¡Bxâ%%´“®œÔè>m[œø€ +W7÷v5?—,@|Ñ^›#aÇ#…o7Eç†ç— Ú|Õä]+ºl9!+c„ BKºmék^tÈߨÁ wì7ó@yK8 P·xŠ8ð×+¢ó¼Í#olbOÀ?’ÊÒ‰}Õ±`¾0:ú±ôþURen&Ž€*Èð@›Ûíímñuêjbðn–¼žbºÅÇ3,²Í³¼¥¯Dœ8oP£QãÛší9vö ”hÒyö­ +)Ac’Æ,Ū®n§n>±ò·÷£K¶;ù„ÀÓ­ú¡Ôàæ妥÷þêòŸØR;ñ‚nÐ:Ž´K—i›3J/m¹M^ˆv—ícµB_q×e¼Èåü‡„w¡}ﶩ7<µs{¸¾8·=µ±Þ xž]œ P[w–§UK®Ì;1Ú%ªˆIìîjèƒ×øøý›DÊ]닼[½@ß¾bBéá6¥±¤i•MpSR„I0ä¶nêíý3)”ó7w)Šî þËívëá)r~iœÂÝC£,Vi×K×DNº&¶Ò…KwÀ}¢¬PPÜMÍž—¦Mœ—Ü#¬³~µLkïÔK„‘1ÃHxkër;‡<O\Ú(kái?Ö|š?¥CÌ ~À¸¨À?½K7xüeʯ÷6ô!‚äÃY»Oöâ$v0Zi;~ë_š=×mYÜÒ•mø¥s{ ÏM=¬*£Á3¤KS‰nòÎuÝ¡Ñ»<‚SŸšSìL(±&ä4ª¢”h§Q¨ÈV£˜ú(œÒZ‘ÚÁ©£Ñ4Ä[1‡x +Ù?8(ëL`|%’ÈÙ±=‚ÃÔÊ>÷ñzÄ +ⵎÝ&Zdu7…HˆËõЙݘëÆÚgÌn+îå½$ñ}"_^qÜ $Hrƒ¡MâæR(‡ÀÀC53ëB1¹d² ÷+ªÏ„З緵óç0Ð{N o×v&UæædsküÒ;eÒ^gAøÿ°“\.J.7Ðò“´ ØIñ Æ$< Ǹ1¶QÁ.I=¨]ìk٥੨‘§8Êð{È0pÁ˜œwm0~;ØqèÔúð7Æ'¸ž³qiƒM2Øßwi€ #m~@¦AÖUÞ•õïN+ãµwic¬× ëi°»çøru"³[Âû&íÜ‚‘Qgí™®Å8{{œ‰/qí6{EÔdV¨{ù¡c;ÀÚ îœ`5zè†ãH[¯1Îk㳚®šχX)XBfV3Dž€0놧›¥çnÓÆlæö™8n»z“v ¿’·éSIcÍÍtÂ7Mc…qýÐ5þ%í…ÿ»^¢¶ƺKm¦üP”%·šü¾,v•®|OÁ3.*­[¢)à(Ošô/T#â\·ùžØèÓu£œ]c÷ ›àQoÓ$ŵð”*Š–ÄVÿ>µg‡C0PHÊm2rgÁÐ +¶‚Ü-™Ä#·mC¸’´¦ðŠ(f¦L•Nfsj1BV}…gOÌ:±Lú9 PiÖ3n¼ýõ©2ÙW\Ó{<«í þtO«±ƒ>Î÷P9¥ +ß`C‹8š(ÊGId‹òÁ^Q>8(Ê£ŒDrTËX€ZΑ£‘ì?ÿ±¼Ü?˜ iò7Êå5jQUlÒràoòŽ@Ä^4`“a18ݽÈP +ãGã­|­À‰„¡ãT"~˜‰'¶ûöÀ5ªbþÌ×—¯NßÞüv$ßÊ–L¶LWŸ} §bq´M7/ñùòÅ‹¶L¿ä |Ÿ·yõ˜ŠºYO¥­MÜ—†-U ¸Võ3s´£9ùD¹`P±ýžÝô#Šá eä1§ :.¿ï;r DÀߟŽ+à¥Í÷‡9ÍAq–eêë²^¦åÇç¾ ,X9žöЖáBBt<…ŠáÁóéоv¡+l5/Ž\ý´¯lqÜu5Wá)v—‚$[‚àÔu]ôUxÊ FgQûšd=T¸*Å2“‚(ô?T¾>;µçÇßv‰à_§¾™Qìæñ¿ÈÕ ™ jø›ÊàN8V…Aõvu;Øá?.¯°6çá¸ç{7ØéÒ[i`³ª™Ý=e{ËþÃÀ†»SKÆ ¼‘ß&•`e:zF.úÿ([;°d„’㶫ï*ïÎ.ß ˜tì¡´µT"\BÇ҉şHDÒÒ‰-72X·C„õ Æ/M¾.ÚnX›äb Ð;ˆ‚íMÝôKÍx`7A Z.åêÅ,ËiivWh‰î©ðœÚÛäw±g}îÔç«PÈÞ.Æ{«"Ðà½/S*£ýÂË°& +3â>‘gR[Âv/ Yc?îÚå‡û~wŠ¿ ÆSš¦Áy†ê› p9¥¬>ÄYó”¢)@ÔN(w…Ëⵟp*1 ¢×-U› |ðë#EÖ;ì`ëÁ Ö±Ùä#«Í˜”JØè“O ½n +÷]œà‘»/l" ½”ú±Ge6½öËy¬ Ìèax욺´pˆ5V¸Jßþâ>?Ô-ˆM~âD2f'<`vBäÌ.Ñpö¬˜»ãªãÎþW £¼*–¶pÀ*ú>^TÙdPi‡¸\BÒkó\¢æç¶u•A».4Âa½%Ñ{_a˜'‡;%nëòKŸ‚ø@+}•Œ½Ëeß_^´‡…Ÿ_ûÞ!h´Ÿ9‘–¿×bGÔ€r ÉC¤°:Ñ\?áÇžÕ›i$³ËB¾ã7Z èaJsϘäàP@#Ç ø¿ðSendstream endobj -4334 0 obj << +4460 0 obj << /Type /Page -/Contents 4335 0 R -/Resources 4333 0 R +/Contents 4461 0 R +/Resources 4459 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4332 0 R +/Parent 4446 0 R +/Annots [ 4464 0 R ] >> endobj -4336 0 obj << -/D [4334 0 R /XYZ 85.039 786.531 null] +4464 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [129.861 391.091 191.096 402.78] +/Subtype /Link +/A << /S /GoTo /D (minim-bdc) >> +>> endobj +4462 0 obj << +/D [4460 0 R /XYZ 85.039 786.531 null] >> endobj 322 0 obj << -/D [4334 0 R /XYZ 85.039 766.606 null] +/D [4460 0 R /XYZ 85.039 467.277 null] >> endobj -4337 0 obj << -/D [4334 0 R /XYZ 85.039 746.277 null] +4463 0 obj << +/D [4460 0 R /XYZ 85.039 432.531 null] >> endobj -326 0 obj << -/D [4334 0 R /XYZ 85.039 555.076 null] +4465 0 obj << +/D [4460 0 R /XYZ 85.039 377.342 null] >> endobj -4338 0 obj << -/D [4334 0 R /XYZ 85.039 522.655 null] +4466 0 obj << +/D [4460 0 R /XYZ 268.962 383.316 null] >> endobj -4333 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +4459 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F62 4159 0 R /F20 3021 0 R /F38 3057 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4341 0 obj << -/Length 2402 +4469 0 obj << +/Length 3021 /Filter /FlateDecode >> stream -xÚ…YYÛ8~ϯèGˆÕ’¨s_ÉÎfLÒ ´`vY¶5­– IîNþýÔEŠ²ebŠU¬*ëøÈïøÞ剨â.ËS?Qá]ùò.¸ÛåŸïBáˆå'q ãâÚP×iäq¶È#:ÖYûq#ÏÇÍ»ûOQp~šª»ÍÎ’‚!A”ßm¶x™¿Z'IàýÚ½èzzíj­ÒÌû\½ÀÇ7ø½ªõqõÿÍÞýcc5ZY`SÞ´Éá!›Âä. ü"(\›Tâ'IF6‘-`HdH”¡%ð¿XB4v€¡ -<Í3ðz'6;I¼?«'F&v;þ}Åu£nø‹8º¦hTõ8|4ðÈ“͹÷M¤“'Vj¥ŠYbÆ·Èò1vÌqÔ=*¬Ëú¨ÇŠçôÜîR=Û&:|¸ñà rÊP![ÿŠ6ðe9)ËI|~®Ë¾ºÝȳ¿‚â‰7ƒ…”§ž¼€¢~0o N€¯‘èß‘ˆ^ÈÁVôÈ–™ž`¨ÅΕæ ~Éx9¹eëãäšLŽ˜Ž0Õw¨öµÞ¸n÷Žáä4üÒ/ºD¥ŠWªÐ ²œOŒ•÷Hȼ±wÃMg]v'Þò;Uyîuã¡êßêAÖ#ÿ¾!SwjØ 8ƒé„j@m¿q£¨°û_*Ž¯™úZÏǺ[Úõ®Ã)ÛoåäðËî’Ã7Ë¢Ì -^¶9Ôæt!«ú8’kR‰y>€‹Cþoìæg´¸Go±€BŽß¡úMæ’¼£8~Ô´M:OœÇ\Àe[Ékœ[8/ÊmJ?•—ÁÆ[0ù -.÷ë7pƨ(ñØL×Õ -Dš¨ÆÉÏOø{_ëv»¼¡žé¤³©ù„°@bÐ0I"Í/‰ˆÈ€Ê -HgüÙ‘ïlY3e; úЃºÇ‘÷†sܸ:ÐÃòÑlÅ0èþÇ/ ¾ùÈLúDAâzfT3”½`€u -‡tf@{£ŒãÜ㲂ã¦â. µM9ñV³Áí|’JS¶û¾²Î:øýJÛò¹ˆ8»á‘O 7Ñ?[¯¢Bžk¶ nÐ-½ÊéütÅùÔP™n(§¸·´<´–Âø¿_þýûýo5yúÎ"Úʘá!‡Þd…*&MzûÂ9!…vkbT¹«›í{YÉ?SÀÓB4l[õP0ĤÆ8‚3¸YØ-V¡8ˆ¼Ö½&;v6s)áâ(àM—œ‚雸ŠÓ’sÔ­iäeoÈ¢ù§1傾ŒÖçv–SÖ^”µ§zšDÞ¿º#×ÒÆBƒGëǃÄR( =Ç6ΛdB[}«›†«"–ßPÚq³›(·\- Mœ+?Ò›Æá10+Œ}§¤‰“ȶ1Ì -hÅ…÷i¿Òã©·5"M%Px}¬ÚŠŒçä¹b¡H¾iáÄstÅ`s+²Ò JìWŠ'ÝÒØ&ÄŒÄìÈt A'DE¯ë‘G$@ÛìFZÇ¿çøç¸G¨YI4ÐT-c$´•DYd(²#¶ˆH -5Î"ZlLX‹?Ò.Ä^“Ž`¶Éxeĸ"­Å˜?u!³`Ø"Æ|Á n™Pꦩ¨tÝJrçà Âü(Ka'¸ƒ'ÈFª¾Oõ¾åÑCË g'ž)?ƒ“æuØа'l²ä,Ò 7q@³]?büZá lp:¤ØV e_[ddñ„-¥0>RÛÌvç\7Ñ%¸D\"5צél®¶sÐñ¢ŸW†]1ŽÝrÍ’5–d2T$ঽÔ<¸] -ZâœE?§ÆšccÆ””6¼Žs.¦&oÑGfÓîË&ÆAâÝówß—‚¹!st¢\óφŠÒÒM„åî¬á—¡]@‘]Ú”Ü9š‡)S-¦Æo“Å\^Eæ°–ï­öv¶V|]+Ñ©X€X223h þž# \F>ÆÁ0¢Ñ?°iT®](¸f—ó{’Þ¾®’Ô4!½¯†¿]é®QùQ¨nvW‡‡ºk:µ6 BàŠ„æCOÏÎõ…AêçPÞo)4<gÕ= #_…ÑLãbZ:W5õu[`!V„7ùj9Ì®„°`_™:L Ê@c[滊†FöÃ5g«ÄÃÛPÆá¹álaú©³o(œœ}¦qÙÙŽFIâÞÈyB—ÒæЋƒ„\ö~}R00ÀµâO®¤6K0ÌWtÑFâý™xs²Ibï а1ÙÜYj>Iì<]€Iƒ=Ø„¯Ì=&/~0t†½€æ¸lÖ_Þ?|æ16Ó§jÂke$>”ö †'°êVïmÔIcÒVšz;v’<ïä* øª ôü¢Á’åú„ùóÚ°Ôøݤ©Ìe¦‘Š:p¬¿'‘ JMYȽç¼9.#k L0¥÷S¦mguÐí7N®Šë–S.Ì!”ÃüfÊ9<×SÎ0ý,ån)´)w®q1å\­ÜØÉšîYD—]æ¾lÐ'Øé‹ÓçMáH&~dú#:±ÛI>Á©Ðkq±ˆ¹\Š¾ï '½¢È5À ÁkŒËæNpÆa<øË—žÇ(ìö¦fïtY75¡ÙÊ↥ ˆ¸HÜŽËr#˜ç§p]ÛsuËç?©3å&ÎþRb#m1Ãâ,žŠaœELÇ%N>£‘SNÐÅyÄ Åã¡ïN\Ò‰Õ4FÔ25¦Ñ»üÒ]²kêò;uÿ ìIùÁb÷eJ8÷þãÃoR Þ˜M^,äyìŽ<ñH}®âÚëGQøiÝ Œ‰åz`ÏÏã†6gêÃQ·9Pþžö~\s_ðÜÓÀo†(™×˜ʽ¡4u´>òßpÝ*L~æÎ>ö¦…6öÚ>Ýñ[ãô‰‚¥ûf+ï¼+.cYwDaM½ôü]R”¡iÁbôG)òçj,"©´‘êê}åZ%«x½8ëåI*8n@"Fî%-ÎU&*÷“\ÝÐùpöÞendstream +xÚ¥koÛ8ò{~…?Ê@­ˆõ:à°H“^/»Mšk]ÜööƒbÓ¶P=\INÒó¢$Ûj·Ø"@DÎÃἇV3þÔ, ]/Hgq¹a f«ò›móöBÉ +o¦]/ +õzyqù0š)ÏM½t¶ÜÐ’åúwçúŸWË7æ‹ œÈ/â8q^_ÍýĹþíÓÃoÞßÍ•su;_(çžA×ïï—æ~ì¼Ì»ùË_/Þ,GG/´«£ÏþrñûÞl ìýzá¹AšÌžaì¹*Mgå…7ÔÌ‹‹ÿê©0NÏx×Ä :Ý(‚kü9NiWi5y0­tìêÐÿ&ÚåÙåÇtB7Hf*Ðnà©^ø‘ž)å¦a8þ} ÂëPªfB‚qäzqŒf_fÊõtšŒ‰Óa.oK5»©¥ÙÀUº>X€¶tܳ¥’ ›ø˜[%²õƒlÌZÎ'-sW]SÏ`(k˜V7¬í;*óÌËoo@D‘ú~ŸWðÙ2zƒ”Wy‘whw_çIà€%F‰ë‚ ¸ÒðÊzĺ¶Kµ;4¦í‚DI§`D!Ý«Ûå€ ÀÀO$ #SX†ØN€òEòEQãòg\ë÷ ×@|–Æ«1pÝšWÞ/ù{S÷Zâ͉óiÌ)2T‰œð¶çgaBÜ*Taœ¤Î{«>8‹Ô«X}0@ 9¿Ë_! ´3fn¬Ì=ßÙ£ éÐ'»d=Æo¬œž›Dî‰Ò*¶¦EÌ¢2š¼Ú2n0˜àíïqÍ- þsùŽ,÷ð"HÞð8#åyÊy{+'2›åù%Ÿó¢@÷A/C/2øßwVuÕæ-…ªãuÅ_.z¸¹~Å Ìy}sÝ2Òš£‘†ƒb³\(ÝñïÞF´2QÎ+¼5jX´ÐnÊðöl“YI;É´*Î8¸á„tYW6Ú‘ò +ôT_Ü-—IÎúÀá +®fÖx ¤®q˜Rqì*±¬òu™í…~è0NadMìïL»@%dû¿]^–Y+ÞáèËÁTœ à_vY7[áiß¡.q*ߌonáÃ`TfŸç:p_¯jÅbUè»ÀÛQÌÙ2 Ô·¼µYÉsÊ~)¶Ö¦œ ©"àó€ÁîZ‚;–;îHaO1”3LÝ‹:•€Ü!!øî¿zàÙc6:Õ³gÌ +ÚkrÄæ˜eŸƒX3œ÷ÚùÆZ>G»ÈÕ kP¬s j°¡$Š7 Ôêç4­=vê„B˜ú~<½j¹eíX¾¨pÚPñ´ãTIð¬ŠuÂp€UcÆRÌ^IY:²®‰‚ P3uÇ›Y!P b^²r_˜1«™,&+"e6ÚÓç~H µ{nPŸ8°­¡ÜGóS)à‚0T` +ƒEn½Uä¸8kù ú:lóï2ÄÛÓ<©æE†Î_XŒ5KØ*¥º4§¬lÈK+YkM†…4-0ü(rŸsiúFBBóTä°>´¡‚®d¯±ŠÃ1¦2^ÇÂ<µ|¥B7TPZù1$¬”íÍVV|xû“lóÎLz”²µÔÔÓ6è)Ö7¡ëó#É„GC:|'ŸSŽBÇ =ç¢<*]rEeدV«úPu¶M‰"ç7cöâœ/{\Úô{¶±Áw_;4Œ"Ã7ê Ê–mRÖc@ùhÆÜ# ’z²ÄÕµyœ8vC$% µ"Dî$Ñ“%zôÕ$7‚)Ý›”pBÞŒ,¬j@ï%@Ó=El•‘´ƒ\6u`„cIRa†=Úô©¾€?¶ÜB.ŠT Öt^“¥s~¦V`¶_Âñu-'×E1Î]Jò‘‚ü¸ê¨ÞFXfaü9*›ÏÚ@Ô¼E'Í€í¹òΔöÒÀJ­H~ Ñλá2ç7½ã[íòʺe½\ÐÉl41^±ÊÁD9mp/>ÀÕPHþãּ댬:wSåÁè²KNˆ¦·E³Ë´ÏÓC€Çe½M>Üôج¥Ô?ªX´5îh”UØsˆã“â +AwöBœH8S6Œ;¼°¾ÁížÓÈAT°òІ¼³$QJ²«ŸŽ*œPñlÑÊóÓš ^a­ÇÐœ —L’ŸQhy-Ö‚ãjT¦ã\DÀ\@íüp³„‹èÁÉO#¾-mY ÊŠÇmBë#6rŒïh@\<œ[E/[^Í~µ€\i_®`tÄ5ä4zWÍ |›Š‘Q:¢N•5&¤ŠÄ .蹕bHQoéý Ve`í¥}Ì#uDÜ|àwO¯Ñ±$ +k½´­’KOùfêÈÑ´åÅ”7§M…ÈÄ@-5T0J.¨x# pÓ™u_FRa“Œ$´è¬ÆÛäùF‡tÄÑ +¾Ü蘲 Ì˺‘íMýØp˜ž¦aQIGBç–“ZÁWˆK‡7Ok›x8U¦:‚Œž èw)š®³ïúÄýþÜŤ¤åE6Žl(¾Ñ³À7(.9훌ͼwÒÃ!¤N¯8nç2>®ÌÚnLõ//™NKšŸjìð)&‰“oU™¡ÄÑU™¾T™×ôŽn6U×PF¾–RÓN³•28¦RFʘB5C• ×K1[ËO¯ÝKÍ“~àYþòÊR•~¿.½¯1whÉ(ÅŠbn>¶Š{âD µƒ}æÜ£çääÇÙðj†±MÝÍ*ÙZÞ‡ÔîÌ䆒Bóƒœé¿†™º›%¯ò¢Š fiKˆu§Þ΃õäÎ-~4=siê[ÃñûWÙÊ`þ¡ç$_Ë%›*LåõOCàévŒuÍ8úé;ÿ'ZJÊWüJHBδo‡+èeBlÔªÁô yiùã:Ááê„=ñ³ z„¯ §ÏÛ£2‹êc\áÇç;áÀæ ¿^À}lßKé.§^úè§AúMén˜^Ÿí4ý6"\ôés"-g%Ì[Ð{®5ÃÏë¦1•Iíïý=hk­£“ÌL¡¤EGhjrû;˜ì¡Ü¸Þú¿¸ÐâçýଔÁÐ á*`A‘-‹o¬ûÌ‹;§âX¹'¦Ý].üs¿økß‚°—ÞwCGì5ü¼æ¨áÿ?KÝìéendstream endobj -4340 0 obj << +4468 0 obj << /Type /Page -/Contents 4341 0 R -/Resources 4339 0 R +/Contents 4469 0 R +/Resources 4467 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4332 0 R +/Parent 4446 0 R +/Annots [ 4472 0 R ] >> endobj -4342 0 obj << -/D [4340 0 R /XYZ 85.039 786.531 null] +4472 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [199.558 410.106 221.005 419.674] +/Subtype/Link/A<> +>> endobj +4470 0 obj << +/D [4468 0 R /XYZ 85.039 786.531 null] +>> endobj +326 0 obj << +/D [4468 0 R /XYZ 85.039 507.584 null] +>> endobj +4471 0 obj << +/D [4468 0 R /XYZ 85.039 465.299 null] >> endobj 330 0 obj << -/D [4340 0 R /XYZ 85.039 766.606 null] +/D [4468 0 R /XYZ 85.039 395.837 null] >> endobj -3023 0 obj << -/D [4340 0 R /XYZ 85.039 658.638 null] +4473 0 obj << +/D [4468 0 R /XYZ 85.039 358.97 null] >> endobj 334 0 obj << -/D [4340 0 R /XYZ 85.039 483.626 null] +/D [4468 0 R /XYZ 85.039 181.318 null] >> endobj -4343 0 obj << -/D [4340 0 R /XYZ 85.039 441.341 null] +4474 0 obj << +/D [4468 0 R /XYZ 85.039 146.572 null] >> endobj -4339 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R >> +4467 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F58 3380 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4346 0 obj << -/Length 3094 -/Filter /FlateDecode ->> -stream -xÚ¥ZKsÛ8¾ûW¨æDUÅ4ß½9qf“©Øã•Jªfæ‹´Å EjH*Ž÷×o¿‚e¦R1ÁF 4º?t7å/<øç/²ØõÂ|‘f‰‡þb½=óÐóï3_8Î…åÜây»:»ø5N¾çæ^¾X=˜yrÏód±*þpÞ}¸¼]½ÿ¼<ÃÐIÝåyšfÎÕïKß¹¾üxÃäë÷×ðþvyî;ï¡ñùîÃÇÛå_«ßÎޯ̬%úaˆâÿ>ûã/oQÀR;óÜ0ÏOÐö\?ÏÛ³(Ý8 -å½>»;û™‹û¢šÛ­æ8=7Ë¢—5Çn¥F#‘oiÄ÷|7òÂ…fB•üéùéáö|/q³8[X“ ÔžMN[«}‘8ÆcÇÈÃMñ³iå©yÊ ž3HÇ·‹ ¡mcÏd#È¢Ö´“;˜W&oe„"ê󤉣摑æ©QçÄ¡5€]­ëËî’͆Þ݇9ho`IǺ (:^Jn¬-%ã<ªfúUKêWí†H…Ô=²ð¶™ø§{´d6|ª©s³Š.îÔ§½WLº»¼ÆFÂZ£m?×¥‘Š…=„±‡c‘ -0Sêe4'w„¶F$¿çæ=ØÌþßʦк.Ož*Ò¿Fàùé -Ç\Þò[QuzÐŒþy™E¨bìÂ#ÀçJMg¸\óÆ@úlPþÕáTÄL>õÐ)ð*43tß• Rÿ¼%yìf o'ñÆâ!ï 7rAñ'IêziFZLÝ`tê\ßÁÚ’ÔùJ‡^´ËÐsžz¡-C8 ¤€•‚¦rî‹;#°ÁÞÉíwíˆm]“ ˱ŽØšR$v¥6Ùj ;æ™éxwµsNsš¡±°ïõ’¬¨µ1àþ”¥€UÙ¼‚aH²iMÖh{»ôöZåmÇ>ÆäÊ,þÒb'f„9ÎLä"i û…¬'%ÅOÝÖ8‡¬ãD,í_'’€0 ÜÐ{9ϱxN×U4Óku•—šºÊ¡ÄÙºŠ-ñ“õì0—FÒÝ\@„—3ŠF:†ö| ­ ]ØeMKÎê{fñ¥‘tÏVù)›J¢‚Ý„“‘—ëÛ@nêtåE˜ì¤7ÇŽoÜÈ‹œ^®ßqatI/À£ˆê¬bnP™í­«^hÂ+ù´:\æàö1Äy:¿n»­.BéÒ =? d f(ÄÓ¹dÐóÚ楽…Žo§+QH¢e‚©›J„vÔfiªÇåš ö¥Ä¹øê -£Ã#¡ ‡œ¶íͬs0š=‡r¬‚‹3¹¨…Û´Ò(—” [¸.nF¨è1(0*Ù)R1Žî †<Ñ%—±éÛRÑ))%÷~¹¡Äñ¿ÕíãlñçãÅX¡¤I€á0î“LZKoU1 š*Êvýˆ¢#‡®¤/$õJRá7ܧäÀ&‚>õšŠY(<4nVÜ`÷¼£T´`Ê4›ÄR_ÑS¸˜áu31)érdU÷-·zÎäPI©?ú¨ïÈÚ1un¸õtäxrš©oyô|—Ü.D(MÒß”ä')WEñ ç¸6GÈÕñù×|/õ,ìD²‰û?m¼˜GOî–È -rŸ¬(Å,3%ÊäÐ?Ùà0Ïî„ðC¡ZjA6XÍůù¼ç™›ú¬×Vj‡9"ñM®0s£4¶73Á]êi†âþÄ,¡ë§‰p¡¡dó¶¥ ëCk–Þ6}Ž­îk L€¸mÅ¢`Ç©xñDß #Ô®sE8+Âm]Œ•ò±`{ÂçSGn]Ê-ÈÝhͱ>CÑ;f’C'’µÉê Šü²•ZsÙÐ9Öãy¥ö±Ó;x¹T›g¢“#‡2z[KBV<¢+¿Xu:÷Dp@<à'/'ÏéàD3½œ¼$Ð'‡gƒ["Ƙ)ZPg®Ý^]=]ˆ@&†Ö0M¿2íbÀ¿«Öª®Ÿ™w&^A2¤ºå@“]LŒ -kÑ_1*çoQibŠûؔѻ®}.p¤3µNn".²å'rÈÕvG©=]wl%›(ù•.H|ZÂ5VAZE*¤˜´7 F…¶Yîߘ è,{D¿‰o]]´Öãe*à‰TóÒò«~6 AÌ”ï f•ð -%‘ ¼´-+‚±RuµLוu) ÛO˜œåØ[9 Kg°å«,Žu6Ÿ°Ùpž ˜Â%xŠPsyçQ+Ô!Ÿ÷aŠp`yÖd‚ô{]«Æp|ÉÕZ‰µg}àQøÊï#4Ë ?`žW pZÚøS€©¸ù_Œâ¾ôUó(_Ä°•šSq¨l…Lwö÷uûã4 ½&cQTR*…6~;6Á,Ndl‘¾ðÈ#fü•9ÛrŒLÓ¦Ÿ£âs@vXâ”ÕìõÞ³±j‚9t1ßÇÀÞjüŠOBXûc‰v[á•Y9³{æëjݵ}û 3ŒÁì=újÐþ„_ÓVæ£:ĤŽ^×JÔa¤v{¡jù'*-±ÍP†ÿ¬¤ô[cøQææÙ‰O¶1\IéÅÐWiïpÁ1„ÖqάøÿðZÜendstream +4477 0 obj << +/Length 1613 +/Filter /FlateDecode +>> +stream +xÚ¥WK“ÚF¾ó+¸y¨ZÆÍH SŠeíØŽ›59Ù>‹*BÂ’0æߧ_`aT¥8Hêéîéç×éð3ýq¤›ôGãXGÖô›^Є“ß{F8‚¾ÓAáÑí¬÷òu÷M “ éÏVÄ2[~QÓ7“ûÙ«‡ÁÐZ«b=ŽFcu;„c5ýã¯{¦ß}ú00jòv04ê#“¦Ÿ>ÎáH}‚“÷ƒo³w½W³“«‡N»ØâÝß{_¾ý%˜÷®h›Œû{x´I’þ¦ç"«#gå»è}îýéµð™ë³Ô‡ÇÐ$: £ëQ¢×QâãÙ%:C¬O,D Šõ¦Ø@íÁ×x¤î*~¾ÅG¬²m‘ï"m3>h×™Œ›Í|›6 0쑺d–×(Qd¿]‰T¨mèž1Ý=½å&º’Á‡ ¯Ù¢úLÊ«34VÕŠŸí ³ †ùš#gÚ L³_òÉ×À82?óFHsÙä-ÿk‚(#êmËlëTøÛŠoœ†ÌŠÄ%ˆV¥|ì×Y™ÕÌ¿@»ÖhVù˜¡.x]ÞúÏX0|”RÌ{Bþ§5r„NmPeŠ÷y+Q¯ÎL¯áëÀì»ÆS^à¥a¤NCƒ6Ux¸dö3#™”‹ØÑE$–ül×l2Hä@•ú÷¢õ4òð™–B_‹%(M¡†uÔ©¬;7}â3®¶Ëq(mJ§n連IŸå¨†’=ù‚BHé.Ϥ¬"»7Éù™ptV?NÂ]ø°Zµ­%S¸¾¬*3º/㈧ 0v6ñ éÚ=˜4èºc[ðåÔ–Óœq¿…#6©à{ÃQ¤ÐÀݦ£&RèBÀŸ@kùï%JVµ(&®ï;ŒÖA«´ÈXusƒe«\Äɼ]#_eÕ²¼oï‡È3—Y¹¨hÝ•¤F‘ +EÎ)5;µÏë“Nˆl¨f”ÉØv…D—·,I垢¾ó`Î*~å>ÆÝ–ŸÏd`É"—ÕÉ°‚+<«6rKgÒýP§B¬ºÃΫnQÙÝ”UPý0ãeµS[ŸéƶyyéÜ UÝÊ…Ä¥&ÛøK,Òò(Úxl‡PÐÇšu¤bF*÷ÕÍ–LÐÑR1¿|‡'¸Ɖ¶‘ô¦A±f¶3x@~+\yËIÀŠ^Ùž ís¹êš.¸ß¶-ß3ñxŸqÃQ,Veq¸bûÐY«GÑYÀkô¢yÅêÄŒEe[§eÎUW5#Á>§dW»¶Ã#î°šÚõñ ~³"âá°Š1‘Ûãâü€Ôupg¸Š¥OAÇ&Ò£iŽ•°2 ®²=¿´ù†fÑìcUg€ +.H¤,“ˆÇr‚Þä‹Ô&k×Ù,×ä>ê–¿}£—bE)|sµ-¹”;Ã8Œ®k)O,ÂòLŒ­}èZ¦@IT;Á¯K”ÙçEÁ Õ£DX2ÊvwÀ Q]ÝðIÍñØÔv^8Rȯ˪¶&ÒqWˆÁ—EjÆ:‰»F«y$U›˜%BQekÆÖop鮑òä²NÇ°ÉžöÆû;ôp"ktîë¿ÍR®¼'« ‰¶AüÌ2Åé’ÑÚcì±SF‰˜w×ã*;[3ˆÆjB)†šžÇvÍ<`<ìÀ“{¿³^ÛO6ÎýzA•¹ûd¾Ù¦'ˆ•\µ4½Æë D«¢pïKýþ”¾¦-5Úrþ4ˆ&1:0ãÿú×Ãj˜ÇWÿxÈɯÝ*píK·l;W ÛÔy»Ûz$âi ¦Ï©%Qš»Ä¡Ç> endobj -4347 0 obj << -/D [4345 0 R /XYZ 85.039 786.531 null] +4478 0 obj << +/D [4476 0 R /XYZ 85.039 786.531 null] >> endobj 338 0 obj << -/D [4345 0 R /XYZ 85.039 695.833 null] +/D [4476 0 R /XYZ 85.039 766.606 null] >> endobj -4177 0 obj << -/D [4345 0 R /XYZ 85.039 652.689 null] +4479 0 obj << +/D [4476 0 R /XYZ 85.039 746.277 null] >> endobj -4344 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +342 0 obj << +/D [4476 0 R /XYZ 85.039 557.197 null] +>> endobj +4480 0 obj << +/D [4476 0 R /XYZ 85.039 522.655 null] +>> endobj +4475 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4350 0 obj << -/Length 2231 +4483 0 obj << +/Length 2480 /Filter /FlateDecode >> stream -xÚ¥ioÛFö»…à0U„Ô ‡§¿%i²uÑ$ÝÚ‹.ÐE16×F/üéEzʤ‹8‰¼ÐèE^Ÿ©Å-œüëL „+ îæõÍÙê]-´òR•.n>tRå…i´¸Ùüê¼ùþÕO7o^ºÆ'ö–n'Îw—Úyÿêêo¿û¾_/]í¼…ÅÏ×ß_ý´üý懳·7#µ1xýŸg¿þ®`õ‡3å™4Y<ÀZy:MõY/ Œ|Wg×gÿiñY°`¬9iC“xabNÅÕáD\­}Ïh‡¡1É›5K?qžD°küõ_Êf‚µxô€bö|^ã:Ëqû®l¢Àýš`ªnù ÄáN wKÍÐEÇ'eÏÞw{[àÙ†€ýžÉ9⥄ESöC— ­Ìòœ¸Á›H¶Á{Î6>(-H¿ì>{Òg §úTÚ ” ¡>S:>¾O«ÈKÂä‹Z˜“ç-8¹ñü#*ÜE¡‡;¶ |!|ªJƒÃP9ï³ØÖ¢Èyƒ•”m"PÑ'þÅŸåwäîø}³LA™»~`¤Wäꨴ¡N ¹þ‹bìaN£ÝÒñˆv2pà‡˜g´î~`cQÜgË›à»ô[s¦ßÖA*dËR6ndüsï°7 7‘üx’fy¿äœ@­%öÜÍ–²*o»1¸§ÞONœ8T`6–k(‰Öa5ÇîS¡àåªfµE “Îúˆ#7‚è¼¹£‚`y&ð{ç‡MkË^šî‹Q¿E†Wï"bAãkOƒ—*âÿs¹]Bu}`ÀS¨û~$p3i áÒî3ºì]d› ¯v}Ñ]’\jÏO‚ƒ\™·r |„GM )L™b¤„_”¦íjÎÉTmh#NË`ÖZ„R<ðB´«S­“Z0c¾$%ûÔV·±ó0Úo ©ЋǬÞV‹Xœ©g–Kv/{ä µ [HŠšüd»Ï¸Wt—l3µÜ/2Üvm;|‰\tµë»U¿.›ꟌÛî-ÿj¥dCV›âóªÙà¼óïyms ~5e~ßduqΟ¿i¼:ötâOCÀí…,rð)«z¡ äþ@*/Ø),²{*MŽåØf=x½0U=CäÈI•òQÚ³o__'j}:Ì@5}¾´Ý›Aª!Y3SYöÁ…b?–) ‚Óðò}߃¼!a“cpÝ¡`s–xqjq‡,–•Tê9û»~!å‘8>V_Î÷°ú²c³A[öšúêùn/¿½„ÞþÕ奂¿_Ú[ârt¡Kv¼¦­ÚÛ²9Ÿ‘ÒµWOìDáç§Y'_‘í%ÊýÔgcQiº'†}(Ñcñ°*1åãÞ` Ùê@iOöS\€ -ö"ÔŒÎ_œó"Ûr=N±A·P -’!µ%@éB®¹ËÐ*›‚Ç?¬q(P:ìd^ž æܨøˆQ e 8ó……ì' ð~7£:#(­Ðlk¡µ)Çæ*‡áCP|ä¼Ã5%q3ÉGÌH5We¸àÙ© -ŽY¥ÂBä\lZDÞ’Ï^0*kDF)Éã®È=“6%ôæë ŸYH(˜;éåªòÞ*O Z~={ßÛ§——¡ -ÉçGï–´7õð}^ûZþyŹ£Ý K™&9n^Ž‡1ìPé…(/†šùÕÉÜx~…|À}¯£°6µxö1$™te"»¯ùÄ¥âSún9Ã"`²Ù‘ΗÄÄe +ŽíÉxܦƒ{+é9°r³@U§á×IAW¬ È‹ øÓ6µ Áz «z½%|u"ü£ø±åfhcÂì#½OdT}] ³cͼ*âв3EŠGè*Fz,‡—?Ï0ã•'t(Z­ÅTzKH`Tu- ¯Â!Ùì=“űíñJ`+5¯°÷ðcåŠç†@ÝMîn^ið> ïŧu qÕý0x}²|öÔ1bO=<Œ.Úñ>¿üiÅQðÌQðØMlÉÓŽª¿£*½6ÑßûÃó‘ÖSë¤×°ÞãˆUqê¾pý¹!ø™÷¼EŽ’<Š„Ľ¾Ù:>Ç3™ÊT¼žOÌ0¯R±Y¥a^¥L¬M>Í«fVf}Zè$ªK{ò^Bç¹p\чº«‘T± ¡ekù“úqFEv¤sôe(ÄÑŽtªí(ZT +ÙwÑÇóI¯9uØ—Öß»ŠJoÍ€¢ìøÔ¨áœ×¼¹c˜‡#°œܳHå /vµ¨LpkîBþ\NUn)j¼zô®¼tnœ +¦&º¥ øªIç¬7¿Y"˜~%ËB`qÜe Naå§Hm`ð’ëOÙ:§6Á3-R½ƒøÁàlv¾t|p¢…ŽU¾’s…€Œ¡w_ˆaðÞ$NS +g˜zîûÁ¢Ö¦kÉtî •å`kÜÖÄ¿jh‚„]ཅñ4VÏ¡H…`r‘WjÉ+Wî"rbmÛ{ÿ[oŠ´¯(\“kÊեʗ$crÅpæ÷$K8XÏÅ Ž”ÞÕÀå’gIª„këè¿üS@˜PʘbDà¯$8üJqëa²MXþ¼1<¸æOš$ßy4Å +^ï…¦’§AC§æ‹ˆàÙÇÔ$äâOü%WØ¿èÙg€kýä5dØé¼à¾Y‹y|G~OSØ«¿{ÛRèÔ± 4'£1Å#‡R¾.­ƒá ©¸ _’:2MT«ÀòÖ™7^& %:NuCS“"ÅX­üÑI͉‚rÏÔ~3G O=/ÂÙ/•mÜ}ª©O<+Û/Xj®ÎŸÉÖ\…rÕˆÓŽÝ~xÕÓLíM·M•è7ë¨äλI†Ž+ci¿Žþ"õ&•­P1I¥CÉÏ‚ /sþÛupŸü‰èá´D*·ßX…3åŽýПæÂ>vLV³a_å±Î¥Cñר™ø ¼8¿7‹ ˆp¶“Q$ùbº~EOè½.)öt¬Ê¨Fö^ØܺŒÝ&˜ŒûÀ†Ë.*ˆOò1?¸pcå•ŽNø•ª?ùì n(å3xŽQEÿËDŸ„³øÒ–÷%—4¶¸ê*vÏ !E7Ñ'ñÝ/ߘ Ì¡Î×®¶hy‘7õb­G#âóŒ†ò3×D¼š).¼µd&VëâmYË—NJ/£Rb~gXf”ÆziÊõo· w‹ªEé®×z–AßQã@~T‚ྥ¢GÔš@4g)æPL:€sºB†å= Ší²„çuÔ¡~çæCY5mC¹"¿åu1š$ÎÍ[uzPmÌ3‹÷fµÞA‚e¨(y8 rkÝ=•sj}XÕÐa»çö!8Uu±±œ‚N+îQ³¾TŽõmS½ð<ð¼g™‘ïûAOµÙabH³„%Ÿ7…<4»øö˯3eS¾Š‹4÷"!7‡™·t@ ëã£í%Ó¸%çMí…z¾ƒ0ÕŽ7fä›=ÑÚí¥˜º^¡HpΡ¿ˆZgV.Ö5{”Öy†±v¦· +Ê8˜ì$ï”=;”¾ÝÅý¹±+ˆ´*ìsJ®—^ÜlWPÎð²¶Y^†Äjìxhq78N®-¡]¯ž¾\TùþþQk䧚ðÆüÄ皺-ó°ÚÙºÖ¾41AHP_ywÇAϘKO@‡ÏF5Ù–ÁO²s._,©(õàêÔëÂÞ7t³mj XÎú~RJ“¤ÑôWZäî,~»^¾¦¦„/áø`ƒ|)UœH&Ó‡ Èì¯L¸ÑË _L0©.V.¡i¤e„å±Ü50Ȥ( jK£\w¿^UC9ú¤À9ל4U±VÅÏt§HÏq¤:Ó´˜ê£ûþ€©t‰endstream endobj -4349 0 obj << +4482 0 obj << /Type /Page -/Contents 4350 0 R -/Resources 4348 0 R +/Contents 4483 0 R +/Resources 4481 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4332 0 R +/Parent 4446 0 R >> endobj -4351 0 obj << -/D [4349 0 R /XYZ 85.039 786.531 null] +4484 0 obj << +/D [4482 0 R /XYZ 85.039 786.531 null] >> endobj -342 0 obj << -/D [4349 0 R /XYZ 85.039 683.458 null] +346 0 obj << +/D [4482 0 R /XYZ 85.039 766.606 null] >> endobj -4352 0 obj << -/D [4349 0 R /XYZ 85.039 651.643 null] +3113 0 obj << +/D [4482 0 R /XYZ 85.039 658.638 null] >> endobj -4348 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F62 4047 0 R /F35 2976 0 R >> +350 0 obj << +/D [4482 0 R /XYZ 85.039 483.626 null] +>> endobj +4485 0 obj << +/D [4482 0 R /XYZ 85.039 441.341 null] +>> endobj +4481 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F41 3054 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4356 0 obj << -/Length 2975 -/Filter /FlateDecode ->> -stream -xÚ¥Ûrã¶õÝ_¡>•š‰`‚ xI¦ÓÙ¬7Óxw»vºé$y %ZbV½$µ¶ÿ¾ç’(¥ŒÇ&œû  õ$„=ɬ -M>I³DY£'óÍE8YÂÊ?.´@Ìd6€ùöîâò;›Lt¨ò0ŸÜ=xI r`uûCÍ~=3i.º„Àž¯«rÛñ¸«åé z¨'ÞÆÛ€Çq`®˜&IЕëi’/‡Ês,èXEàÓÀæä3h&×19þ Ƥ’^U4qy½1“«dŸ Ä´³^›l6Qª³“$ˆoÝè´»þ¬×/àI 4Ηq©#OÁµàÙn…`97” Ñ5»¶à9:’¼ì8,%‹ºn~O#¹nU“.xÒ-’îq@@Ÿ‘ãê ñLˆ°£ð ÷‡cÔž× -|$ª+Ioô.RàЋ)Âà®z»·ûcEñTcÌM±N.e’6e×,PÐ{Fkï'¦ÛS hþ}÷îÝ·ÔdË¡ñgÐþ=oÉÂDHÛö &øHBâˆÈ>—ÄåÄò5Ùˆ‡ýaÆE³,;ÓI á½])ée° -¼HZÔ<²c~‘4J#¥£TX½¥|}³,IÄò¹‘-IUù‚7`â?F:‹Uy²0¢LÑÜ,§Áè3el&è mÈ9¹î$SàÀ×sdl$oË9Mª¹PËïµÔ |~¤8;n¡`hô€Tí"ØÒî°mk³ι­ëµêÝzÁSBf»® ™‘¶oÏÄ[•¦éX'©8Šùâ᜼aí䫦yÊ ä=–Š5`tªr¼×èóÁÿ&.œ)ÃCq£4ÕÁµzóˆš&ƒ¼üXø¯9k&'Y’ Sš«Ôî·f}š”.jîÕ4â>¹JrwFz÷Ïntê{'<É&x1€9íIƒ´âÓžt†ZïIçÈyOÐ{µô.­q2iå>iQÝXË‘u,qÁaÑÆÿ_â‚ó¸ÊóóÚô §•É HÖžÖåiR½*ÏÐòšì‰ÝžS‡ÑÊú»/æ®»$,°Hž¼ìÒ¡VY~þ“úæ´zINëç µ^AçÈy è]Ó…P:¸Î3lE×6õ’_åbƒöù+牻ëu½Ý'ÆQ{\%š‚ÎsµÃƒ®Öy(Z9¶K¤¡ó·éža4_y±™©§p\œá§Tº|%:úH*0®kiܵXôAÕ >4AbÓ*ÉòÑÄFÁH $¥µþ;Ìoý‰ÓÝ8 Ï£¿†:ï5wyøO½‹’>½ >]¤RNüÑ}D£I¤@ðFƒ…>Íäž ýN%ZH&1ÿ¯Æ¡7Â/«éOý‡ Â9;ÑèYhŸ“4vÌнytÈ°ûcŽÿ G»>Çendstream +4488 0 obj << +/Length 3304 +/Filter /FlateDecode +>> +stream +xÚÍZ[oÛ8~ϯæIbER—yK›v›AÓf›S`:²¥$šØVF’›fýž)ÚfºìK âå<$Ïå;‡Ž#ø‹ FiyœY¨Óøx¹>ŠŽï ç_G±PDÇ*Œ2]¯nŽNßêì8ŽÂ2*on‰ä¦þ#xýîìêæͧÙb×󪱫Uíæ*:屯 +'S66xÆx°1JéìhÄ{Q´þÀÅEµÄÙðñ¶©g1—j¤H‚§‰c¾U:ø¾?ÇAgW\«‘¤§Ë±ëŸg… +N¸«ëùû­­vg8[Ží7Y™9o{³8ÏAT°Ÿ8¸ííiÒÙo—ã¶oàDãp_¢æI7ÂM'ag~ Ÿ'E˜ëI hV!¹+06apy ¼dyð;ÝqÝÍÒ(x¤m–ÂÙcKÿ€;VcÛmN¯ñ~ãà]3¡*TËûvÓpýfVÂm¼“, Îh×Ën»ŽÀMù [IñXÿX¢aú´(‚K¾î{:Sd¤(‘"FX&PÚˆòŒx!Yç†và/]~—¤Ý–¤~¢ï+3BÄ ÖØV¤ +ШN¦Ø’X²ÜÍ’2[š³!à5®€²uHyâ5n(pwO¨j=ð¨f/©ìD)ZEÁÛhz”+îCVé‹F {ÊŽM¯;± Ýje¶Ós× «aXC{YFÁ…Ìð;±š×!©Ü Û1´.m²[uwFÁTŽJŽ·ÑÊ÷a³3­”“ +aoå9”¯qª^óöQÅF]…²IÀò'þ2›*ÁV¹@MƒúÇ(`Ð ÒØÝò|€PàãÛC$ôÉÒÓ~2¬?ZÁGêÒVLŠÝÝV&vîU¨à¤wÏv•MŽs£0xen»nÑÌá!a…9¦[ß’ÜÜqI8X´;ëÐìñ1ÒlƒØ_&L±ŒµÃÄšÙ/À™Ä?v<¡Äw¸É16¡Ù˜¾¨äýÜÛÊ¢à±hûO8S××ÜŠ÷’ꒆꥫG2Ðc õ̧÷Ð^-G2ˆl¦±e4 FPªÞšXš/eiä»qÁS&·aF7Ëm/³ñòë5òKLà‹Ý€³ð\íS‹¾+Ý{“€ò˜ Çvÿ…“ž*h¿1 +†ãZùV<”UØ#I®šûoÍžÈûÄBÇÝä/'³`Îi*a‹¶WmÉùÒ…·ÿ¡Ã¨¹Û?’1ÙíõƒG& @Eµ¦’>𙿺øx +3]äpQαòWGšÚ¢x#™XCÔ;°ƒú*¤¬¹[ÄŸßq“¨y3X§ÅÈ*+ýXÞN¦óô®ï¶žMš š•. }5qÂ&î 6|sšDÑ÷Ó/W|‚W´Ë[᥇ažärÕ6vVl –°à3a8;Þ3{t’CîÀ^'%€.²®Lå7ý‡{-¿Ÿ^"öU¢ƒw]W’ù]äÀ}uÇÔ›nD¿“DÁ;!½iNŒS ºýƒÃ9pù柮Ë]d¸qYÇX÷ÜT1ŸWãîVÓfý¦/Ólµ2ÍVKO6Ê ò;lNªÉæ3ºbÝ$ººãî!/)]ÔÓ±¹l¡µ-¤öZHí±„óTTC* ‘ #$¥¦$¸¯\¦`o)Ѐ™oäªq–Æè ³~̼Ì÷€eRœ,\Àb…y$Ø2Z5E¬6øÕ²%* ‹Bû‚¶8 ÓLAÑÄl*öÄl_£8ߟW‡ +n0òMŠ]îœ/Æ:›L‚Öt_> ƒt^°í_‘â×<‡™kd¥;}« gñ$* ³3ÄâѬµG°¨– Ãñ=† –´ÓÝì¬ÍV +bñÅñÐúÌ-ÊžºÛ’âÔLÎH¯p¨'{q’ºœÄe˜¤…p2¬á²ÛÜz8V%”ôtwʃ˜DÈ +Aä¹èG¼¶ƒ´mªq+¬’IÈiaCµçhV$¯+1$D]™Þ‡ÙKʬ5ÝÑÁmjó¬ c•ºæ¡waí†*$2–›ˆK ;Ì"Í$”zRa4o%.ëÞh“8z{›^¡zwƒÒç¬èTðݪF˜€E{2ÒsË_Ú Áwp5‰TÅ=¦QܦGàŒ2LR€Rüä\­Â¬4âRö¯vó– Û‘X¼XF˃¡òÏ.æ ×VÛrÜRç'"щ +aäOU‚s|ÁR<áj¨Ÿ­â¶(°Nò;QÉ?_œc2ä„cäL]’ƒ÷Õæ’¥‘éEÀßf³ìŸQØGö)O<*¶:äpÝÍ*ØÀ÷Ðú`qµÈK˜H¸kçW±H‡zÛÙJe½íåâ$EÄ +Ü8|a;é`TF3hRlö¶|Íáí,+‹5O²ª«GÃnµ>aƒcÂ>$ëÅÔOTyèžfb–x°¦ƒI1ƒW‹Õ>b‘«^Ó•æF«¸2¥òR“e‚V0“yÔ9)Ã4Iÿ‰:ƒ«Ž²C«N|´µäò´â;ÀÖæ;¿p³×®ôáF;á×Z6Ø6hA8 n⊔<§˜%åÿˆÝÔ” ö÷2N ×·ëÇU³vòMýr^=ÎðžñÏl”1§½}‹$I¡å/JÌ¡Ž\·JO*©Õ G¡æƒ‰º)…¥ +Á{•¨"Ì•q§Í¸<}Q¼2#ƒhýÊâœ"•Ü/LŽ\sD„uÂÝÝ„Œ¥äx€˜ß5’+5Q~Ž?¬upñ¸U”lÖoS‰Œ®rÌ _ÇB€ îÈbŸeñn€8v2¥ùþÆ诵öÅ:¨lÇA!¯Þ$J +hj±51=®ïuë +mŸ<#Y>&¬Á²/©×ÛÆA`¶q!PSõ+™®oVXÑaw€}Ë›§¡8gQœ]Ôb²f•óÞ‘´1§ÐòyO%ô'[(Ä—ž×höEiºQׯ/*}¡Â„ŸMGä9zˆ„ïžË&4N {Oi(£È¾oyŠï2'3×Ö›A۪ݸ@>N$}foê„E˜ *»8 …hüõn0¬3J´\og™ûò=È7&‹Š7*ê2=*8¡ížH퉉Åå æ!Ÿ1¶„íA —ÿ\ðy “žäÑ”ÙÏcÊi\s³äm8o”s8¡Æ‚JV×Mï¾ÎQÛ%I@uÇm˜·-’ iUæÑ$VX¡|}.ÏñX°o P¶iÛ½|&ö½ô>xâÌØ$:™`läh +œÒÿ.D‰6½l<´#“‘Eù6CalW ìjç‹ÆšS…ò%¹DÃaÇxû–0NI®«YpehG£1*Po¡õCP5O7gQ RŽP: [™¬jã2¥ëÒS—¹BzSódîIaĶ®:GÉLd:šDêÎK"ý4Á £ ìÎU/ALRÕö-—ÞF†±¯Fó‰Cw÷²BB —?™BâòG<Â99ÆÍa1¸þ„¶’§é†¡#¡õžÉÄgCü|èÙØ—µÂvz‘€oµ;L›¾#†sØ°@sê CœŸê$À……yˆ¦`HÒ®MÉiÞ“x©´ÿ…ÂÓn(\ĉºÃ åaLÔ)¡Èü­ E ÐîS*a˜V’xüDgNp‹AÉ`Öh¸ Ù(|U¥ß89?zñ×5šÒbÞŸ¤Èqý?éRI˜9)Ê]žîó)4;¢ü_Îêuendstream endobj -4355 0 obj << +4487 0 obj << /Type /Page -/Contents 4356 0 R -/Resources 4354 0 R +/Contents 4488 0 R +/Resources 4486 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4332 0 R -/Annots [ 4359 0 R 4360 0 R 4361 0 R 4362 0 R ] +/Parent 4490 0 R >> endobj -4353 0 obj << -/Type /XObject -/Subtype /Form -/FormType 1 -/PTEX.FileName (./xslt/figures/warning.pdf) -/PTEX.PageNumber 1 -/Matrix [1 0 0 1 0 0] -/BBox [0 0 31 31] -/Resources << -/ProcSet [ /PDF ] ->> -/Length 557 -/Filter [/FlateDecode] +4489 0 obj << +/D [4487 0 R /XYZ 85.039 786.531 null] +>> endobj +354 0 obj << +/D [4487 0 R /XYZ 85.039 722.931 null] +>> endobj +4312 0 obj << +/D [4487 0 R /XYZ 85.039 679.787 null] +>> endobj +4486 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R /F58 3380 0 R /F35 3036 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4493 0 obj << +/Length 2142 +/Filter /FlateDecode >> stream -xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù -ä -6\>RgÈbÏWÖ¹j[†› -WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream +xÚ¥ioÛFö»…à Pª(G3ÃáåoNš´.ê¤[k± ´Å‚–h‹ªHÅöþú}Ç ™^(ŒDs¼y÷Iµð§I(d.â$a ›êL.îáæ‡3e!äÂ…xõv}¶úF %E*ÓÅúŽ@ÖÛß¼w?^þ²~ÿëÒ‚À‹ÅÒãÄûþÓRy×—Wùøúý5ìß.}彇ů7?^ý²ücýÓÙûõˆ˜o„‰¤öçÙoÈÅúéLŠ M°–B¥é¢:3a BØ}yvsö÷ ß™¿š‘É7::†E E’˜^8ÎWåÈs·¦›¥¯o+`ù» ÕÒ7&ôÖ»œ%Ü \s€Ë=i÷{M½…£¢¾g¨|¼ú®Œ—m6ͱ^ÆŽ¯ªl ðO¼¹¥Ç9ƒnyÖÒ-ßfGÀÙ5UÖD6+a_Ú§À㣠zǬ„ÛÄxâTç@t,|‹4Õó>àk#â¸×“†S%Ò0ë Рb˜? ¥wÕ@‰"ï²_45î@!wü‹þmvEó~½LAuǶãG—È=©¨kÓ3œF(óŠ ÙDIVS Ô’Iñ,´ë|Ï»¢æß^w‰‡ª&õÑ©q9@,X’m}Æ ×Ù ¹#³[ÊëeÐ3–N. »@êÙâåß®áßêkX°$ÈEiÚCà£öPU +ã"%o&à›´-ðÁÄÎ= 3â]­>c5«@ *«ìUÞmVû¬m¶ ;1 7ƒ›ðÇõ®`{ ñU:‘n¶Ä©Ý[Œ&Âé1:€w¾ûe ½‡&t*Â(±p-(oÝ8 ¢véìw˜ Ãwk);ßÉç¤U8M„Rz¢ÜMCÞ¶Ãg¨<Ä›¡ +ÁÒdbøEšCeÍŠFnûÇ7 ƒ¹Ð§'ù/¬•`I„ÒrƆ"þP»F[Ç°»†Dƒ~ùÐÛ{Ä ižçYµ/Ý+bqÆ}2N0?½w>úHöådÙDu“Urk_°ˆ‡/x–.fœ k@ ¢ &B‡¦éþ E‡ÞêØVímQÃ"?dÛ-û÷ü[q*ií©½]mó/«úX–öxÿç•K<¸«‹Íç:«òsÞ¢ÑIfȈ*™šÖ·øWÈÇ]V¶ù„ú¿Íö ÷ò«„:t" æª|ɳt6VÍʼn†ÈT™ÖÙ-‡5ª—uÌç¤õG4yæ}á•'Ý.?Ø%ù‚E!EŸG‡ü¡½öÉæÓŠ÷÷rÍ=ïPµÕ$;ô9ã}À5[:uÔGáaØË,›3þ¹ÇäWTÙá‰Sã=Íñwò˜¯)(\¦e¢”ÏmF=I-DU$5kðt®¬@t•ÔL¢ .^Ð;'¼“”=£›sÇ}Ïú.kgÄí£°âÜ„=FÛWßó‚hþÉU„O””Âay觚¯¿}{cŸ:ƒºÌXÑö;¾$þÉ@ؤdõLë2dnØpæžæ3Y\k-ŒmvÞ`ßa´ÌDˆ8uyüˆ,eÑ¡2žæR‹¯#%´^Ê0¦Ã1™$ƒ©Æ¿™ÄêÅ·J*ø'/.$üý³¨·ÍCû<ª/ú|tÁ©¬nÊ澨¿ù?Ñõ-Ìs‰@Ua]áDÜ×¼œšÂZ؇$®Ê‚ÚãœÛ Ñw3pV÷.[ ¸ÆÐév| ô͹=Úïc(°ͷèG&1E˜»lš‘¸»2œ9‡¶ÆOR€·Œó€š"7PŹQò§Q +qâkw¹[R gjÿñ MNx< þþS²èhxÂn³EzpÑØòŠœÒQç^sƒ<ì +-ˆ=Æ’G=nP Èót>vÈp$ò±´U—ú ´Z¯?œæz·Z7­¿Öƒ¢ œñ À]¢í?/]Øcxíl * ZðÙ±s£dOo./BRõ1c+ó8n†ÊûZÌ\r"jE|ÇoÂdœD"hݬgÛ‚“)†R±¸aF +ã×ÇÓ@àan8Å Ø~žNfæ'öŒ„¡R:{qÆ…Š4d\©íÔ‚†‘c,›Cŧ+z‡@"A+®ˆR  ÉŸÉ°6bÑà°2ö +‘ Z&Þ[ÛðU#¨wMµ§ 5w£Š˜Ñ<ø‚‘ŒÇŽü‚ü ‰î!ÿ¢¢W 0¯|“¸9'»m›r²¤°ß!žõhTèøpT“AÍ°þ˜wôUä +¿—Ü0°µ ÜÒ°D6vFBb…ÓwêHÐÈ`IÙ¨½ÿ4.¥ØQ×ãÜ6UVÔÜø¢tšPyŒPÉÎaý\J8¤„Í\Âçâ@ô RÒÃÕ§¾˜eõ Ïp0ë CÎ ãÙCõE¸ÈÀQ?#ošûºøoî¸*溬Ìö9v”™LùC‹ÃƒþÔú û§cÚ\÷õ‘ºp¨¥ÚÈahÔAÊbãéx°Ÿñö;BóxˆàÏÇC†À>’ÖW¬á(yþy ©k!âÞ§-Æ–Ã`Ï8°'$!¾ùd1ˆ 2UÌóãóê6'Eõ“Ó–N'ƒzÊ"ClÞed"Û|ÊQüI,à¢eé®YýµŒë‚>îpÇ,ÙÞ£ + +mÜ'+¹|Ï}?·Dz„-Íè~™ó¶I7Ý×pè¦íjÒJÏõÑJ&B÷5¤­°‘¾…⎞9_߈ÂÈ•–É7 ìZ;¸!§zh8ò‰ç‹?$—Rò¸Jð¶ºÌŶ÷«çô³aŒÐʉT‰D¾ð-Ûê÷¯}^6šú @öò—ÇØœ2jaä˜ÁÿÐ?Âéendstream endobj -4359 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [497.496 355.905 539.579 367.898] -/Subtype/Link/A<> +4492 0 obj << +/Type /Page +/Contents 4493 0 R +/Resources 4491 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4490 0 R >> endobj -4360 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 342.356 401.53 354.349] -/Subtype/Link/A<> +4494 0 obj << +/D [4492 0 R /XYZ 85.039 786.531 null] >> endobj -4361 0 obj << +358 0 obj << +/D [4492 0 R /XYZ 85.039 737.655 null] +>> endobj +4495 0 obj << +/D [4492 0 R /XYZ 85.039 705.84 null] +>> endobj +4491 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R /F62 4159 0 R /F58 3380 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4499 0 obj << +/Length 2828 +/Filter /FlateDecode +>> +stream +xÚ½ksÛ6ò»…îÓQ3'˜ >Ú¹¹qâ¤uZ9i¤4¹éõMR/”¨•üûÛ@Qí´IzãX,»‹}BräŸÅJ¸~2ŠâP(_Ž²õ…;ZÂÊÒ`¸£@¸¡Â¥'ó‹Ëç*IW$n2š/ežÿæ<ýñêÕüÙëñÄ÷}'ãIÅÎõ˱t¦W7· ž>›ÂüÉx"g0x=ûñæÕø÷ù‹‹góÞa“@¡§}¸øíww”C/.\á'ñhcWÈ$­/å øf^]Ì.~é¨ðZ0â]2M,ÆÄwEpR ·_Mœ‚ðqoÝ—"ƒ´N³U¹)NŠ<áy ?+/?Ǭn `r“® G2x±ðÏà”-Ü„§½ý<¾Ç^ä¬JmŠ¿ŒÛ¯IÛûºy9Cxàl’®TÀ%tæ8éÑ{}s̓zÁ[ÈÊ,nŠýñ©°†J#D©¬ÞmÆ^ Û,ƒP£‰tÁ +]¼¸„ÄY›¢I5±š£y΢©×lmšÎôç 1bˆV ·°˜ÕMS´H`;žCõ&'––ŒúæöæN™“Ž8»jüLJy"tý¾Ù™Ÿô"£ùI0ƒà» „ ä u€ËÈÀa?H‡v¹@‡GŒÐQ»ÆØ«55GJ‘(Õ7µ5é%FÏàíYUÍc]›¯]ÌáZÀrP‡¼1vÊ5,]ÀÒq:º¨Æaä| +àFa‚\>€ çã_oLÒöàòfí®ksÔó§DxÅ‚HD~Ïõ‡¼jš¢ÅïRøWUŸÀD<ß!KhŠT—¸¶d`ÊŸ)E¶/Ìw>Ž§Ùµš—¯2Ú\ïÐÙ l×’¹áP¯ÐCqÄ.¦W G0·žÃ‹k±Èò? ƒå=±H<^“׸Gî‚öïÅáÿqDüÃgŠd2ëÒäšî‹Ó31bôœ¡Ðy[nò]eß2üwÌyñÕõSZÙah½Ò‹cgÆCà÷ft._Nº,ŒE  çSp/ŒDq\®i,jþîWe¶âa±Sy;ê’PHûðÍ,cÄWÊ0ÃKB#&͘ñÊœH@Œ°|¯öÌ¢G±B}?zÿ­éÂ0B+CàZ)ù”R)$gx¶BÞ6K¢Ùm2¡ÆÛ´m÷¨0º¦&ÿ€C Þ³z×0Á>ñÒ¹ßU›þ¥w•¥±ç3'= §ŸFü]^ õÀC‰E·0ï ™c†Ñ0±;–ŸdºLùÓ!›/.íi Otu?c¾Óbæ¤Ñm¡ŸpªƒMœêHJ1pW`rÒgS†ðÌQ¡`¯ã®è¦c[· b²ë;òî¢1PtP¤IW‹€Ü˜òA ¸œBŽ¢Á¾¬*Fl‹æÞì©wš)#UéØKœfY È˦0™ÐfÇ]K·£r³Àó­Ou|è}2©±u·;ô%±9c2h©Fœc£-£æÓ{sêe]ÒFaˆ’M¦d“T’ä;Í~˜éFXxBEòëòjIDC&]¹øåÉx"!±Ç@ËsEä —Óº!ùÇ]âñÜ O€øðo¢”‹¡.]’³ ÑC̸&ÕSR%çVצ¥9Di`hr8ƒPÛÛ~Ke[€“Â-ª,¨1„ð°¢HÞ€šì© Žeòx%}ÅpØÁë}où¼¸†=6»Ò ^qÕÈâá¤Íšr«J^éÆ"±eyËáeßj>âÄù¢mÝaEW¦/“ÑM°ÍgˆÐ¥uÜÊq¬Õ«ÀåâpÌyÚ—í +kpŒ¤1øv³8©æoçC®mf‚ñ ŒwL‘Ôtš¶0 »è µ­ ¾ŒgÞ`¨Mõ€RO„¡%P?“ýŠå'$Úk²OÒÆlÒÍ'ÛAе¥¿!~ŨÇ6Á".&ÂR3ŸÎøû–<7·ÁxoÐPÚ$®š÷­N9P‘K_¢ß·Äâ1Å¢ë~Øå»WŒöª©aµ@-­àf•kJPDÑ\¡Ö•9hÁ_ÖS]Út\ð$!îZÀvÌþ9ïÇPZ°Š"³)­ºš6g?½£ Òs™Ùë±>~¿|ùóŒº3óÌðŽça" … ˜¨¤"½¬Š OŠttFN`›L“ê ¡»G§b5ó²+3]7¦ (Íê!kï6}ñÏô")¢ŽÅظt¦ËF cçò„±ðü.dn†46 |%’0>2˜7-š9еZ{¼¯,ùÿ¸Êå Vk“õÉp÷“­~Ý ³Æ­Õ´<_ÔÖsgü=2И 8ƒËDÐ+8“ƒÖ¤íÎGÃõ™ëûnç¾Чe_?¬Á2Ù.|SþLˬ©Ûz¡yj|´ky_: 9Ó´àÙ‚êÉ’ªBØ°¥àbÚ;ÈyÄ45 ‡A´´zWå 2Çlª:5t¨=Ä\ômñq×>`<*nšÛÝrÆ;x¤ï†öeÅU&hÚ¹7õ\Ä( ÍëŠÈ îxg[jz6òÁÓÈÍH;‡Ùiì¤paa;9¤Õ +Ž†ƒyŸ"ÄùhúþÆlŽe÷|däë vCªxñæ:™Óé Lfê›ìÝÎØrW/pñlªi[!w¹€ÛŠ, +Œ}=”“žc“½kŽ“3ÖáÈߢ>Ôàh˜] ž?´ìèUq”8؆΃*ëOFî?ÌóØNËM/ÔYáΟÔHäªb+ìË*>*cŸ1ùû»Ó*P„ ¥»—˜g„7Kƒðú. ý¡r¥õö»ËËv·ÝÖkë„"«×—y±Hw•i»ýø¯6+ó¾¿û¾ØLÀâB¸šïeE™ÖM(%T¬ø½èì¥Î®ZGúÿòë©Àý“ü†R¨ŠJïñrüç”8lQÓ{=%*gsQK3ëeóX€>òz ãðªóH±vîSצþ$7h)¼“vo”?¨T°¹‚üµs#ë“]P/ø½·o¡üÒyH”Ò“`ž‘ñOŽŸPeŽ¡»gïb^£ŸÌ°ã¿òœea€WØtc[€]Á„_É 2 ACÀÂ"ÇfÍ5Ĵ稜ò_WÏ[2Íh ÙX,ˆÝûÝ`ÐäÙ;v,‚‡ÌK‰@}–"Å14‚£×öµy[2mQ™¸Í·€½p¯‘ EèÚ¬ô”ºÝ-5Zš»Ó‚D`[n +º©ð&½Èï"î+Ìûæ +{Z•&ùœë(ˆl3;me¦‹¥þ‡Ú¯sED¾Þ>£‰äË5áÿ…š€Yö +lÉ¿oшŸÉÜ£Õ®’ýê &ûÒÔO¼¥æoš¯)Õ•Ç1¡áUK¨ .Åw]á)ïäVå=~+±P²+±ºL[–8œQµþ/"ˆ¾ýêíÏLâϱð„0‰ÌY/z$‰>køZ|Ed ¾¹y\-»Î¢W˜<c’.ÆPÀ†;⻈3ЩàÏÅ7ùËÝK}sýÍÓ‚…C×l^á“Ûá ëô½qÀ¸£?{cªxøñP`}Åÿ'Bÿ¨Z{X‘:åÓà)ø5'äendstream +endobj +4498 0 obj << +/Type /Page +/Contents 4499 0 R +/Resources 4497 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4490 0 R +/Annots [ 4502 0 R 4503 0 R ] +>> endobj +4496 0 obj << +/Type /XObject +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/warning.pdf) +/PTEX.PageNumber 1 +/Matrix [1 0 0 1 0 0] +/BBox [0 0 31 31] +/Resources << +/ProcSet [ /PDF ] +>> +/Length 557 +/Filter [/FlateDecode] +>> +stream +xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù +ä +6\>RgÈbÏWÖ¹j[†› +WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream +endobj +4502 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [401.962 342.356 539.579 354.349] -/Subtype/Link/A<> +/Rect [90.021 275.511 447.598 291.053] +/Subtype/Link/A<> >> endobj -4362 0 obj << +4503 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 328.807 298.441 340.799] +/Rect [90.021 261.962 447.598 277.504] /Subtype/Link/A<> >> endobj -4357 0 obj << -/D [4355 0 R /XYZ 85.039 786.531 null] ->> endobj -346 0 obj << -/D [4355 0 R /XYZ 85.039 538.26 null] +4500 0 obj << +/D [4498 0 R /XYZ 85.039 786.531 null] >> endobj -4358 0 obj << -/D [4355 0 R /XYZ 85.039 506.042 null] +362 0 obj << +/D [4498 0 R /XYZ 85.039 539.854 null] >> endobj -4363 0 obj << -/D [4355 0 R /XYZ 85.039 278.031 null] +4501 0 obj << +/D [4498 0 R /XYZ 85.039 507.636 null] >> endobj -4364 0 obj << -/D [4355 0 R /XYZ 85.039 248.811 null] +4504 0 obj << +/D [4498 0 R /XYZ 85.039 213.132 null] >> endobj -4365 0 obj << -/D [4355 0 R /XYZ 85.039 223.834 null] +4505 0 obj << +/D [4498 0 R /XYZ 85.039 183.913 null] >> endobj -4366 0 obj << -/D [4355 0 R /XYZ 85.039 183.186 null] +4506 0 obj << +/D [4498 0 R /XYZ 85.039 158.936 null] >> endobj -4367 0 obj << -/D [4355 0 R /XYZ 85.039 153.967 null] +4507 0 obj << +/D [4498 0 R /XYZ 85.039 118.288 null] >> endobj -4368 0 obj << -/D [4355 0 R /XYZ 85.039 128.99 null] +4508 0 obj << +/D [4498 0 R /XYZ 85.039 89.068 null] >> endobj -4354 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F62 4047 0 R /F35 2976 0 R >> -/XObject << /Im3 4353 0 R >> +4497 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F62 4159 0 R /F35 3036 0 R >> +/XObject << /Im3 4496 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4371 0 obj << -/Length 2613 +4511 0 obj << +/Length 2622 /Filter /FlateDecode >> stream -xÚ¥ÛnÛÈõÝ_!lQ€¢1/Cr¸ÛHœdãEMcY ›Z¤-Ö©”ÿ}ÏmHJ¤Ô‡"ˆ9sæÌ̹_FÞÌ…ÞÌ„Ê ’Yl"Þlµ½pg°òë…' AY pÞ,/.߇ÑÌsUâ&³å}wNâª0‰fËì«sõáõ§å»ÏóEN¬æ‹86ÎÛßçžsóúú#ƒoÞÝÀüÍ|á9ï`ðùöÃõ§ù·åoï–½ Àë¿_|ýæÎ2 õ· W‰™=ÃØU^’̶: T¨™o.n/þÕÅkzÆ»¦¸µ /Q‰ž—H©È:‰ø°ê©$ ‡ Cé˜$+_—È" ]ç§ß‘ïr Gë‡ïq¸ÁËO £(v®ê€á/qÈo{žû±“Î}ã¼ð>–‚ë¬ø€´ô¢|`à6]!þš`BO[ÃL¤ã‚àøÚ}‰gâæ¿ò‹ínó"[a¹’}›M…;že¸Ù‚ÈZMB2¸M·ˆs—²‰³$ê'„å5ÃÚŠ¿DFmyN[$6Ðtã:ßò$mø[Z´<Ë3ÞþLVcáh ODцզȅ?Â.ä ÿ ? ˜ìÙ8YµM‹RYÎüX¹à+ÄY[ËâyÀŒ3ÌbçÕºEÀŽHZE4〥2¡¸u  Àj#qÈŠýŽxE'¡F6ð‡­ ¹ÙÍZ°·¬³Àú÷Çë?ì=¼c\`^Á‚ïP›·ëŠŽÉx?§;ÆjN÷dÌb[¬À6Ð`´?Ò*I ©Ñ(e‘‚Ö–2€Ž)cx!– È{z4°wuíw0ßa¼(:Çù× ßEZÄ:ÿ¾/zQ1pU•ºžðþfB)ÎÀy˜öm” >NvAu2€  û;.÷M}IËwÖ9Ä&˜fóNó ù^fùÓeg›¬"þ=×Åâ.ïøè{°4¡iqÃKåh1üC?R‰9_ð pN–7¡«¡*ÓÃòFKys“>öY9b)y|sËEË -žyàqBkç ê:5žÓ´)I]ŒÂZQjߢxÎS.ó”OyKgCB›ËåP9å[pF87¯O Çõ”³8+œçde¤#¨!“¾0òï ¥Ô›U°÷µ¬Z‡Åñ6}”@DStpßx$;üZÙQœ‹ç†Ñ(ÞQR|D‘QÀEtôü—#t4/±/I@–hEòîo-#YŸýD¸}š‡ êºKGÍD}.Úµ­9zW: ÑÍ®~ÿ…Ç@Âúù„µö”Ggµ8ÀéL|¤EO+7ŽMÜC#× ’“L×wÝlk|â狀ºÏ›ÅR•éæÅrÓYŠ{œ“vÄ`wWä_†õ¡Ž¹h…Ö_¨å.Ã1áKBü‚ŠRtìwÊÂ*W6E4×,x~Ê\E2hlX5¤éÐ GÚÄ{Xz¸oWw6FV¬“à5à¥Ùd9e¤íÐ1$†Lç«Z íš’"ŒÖTtÃŽ]<>›ü¡¯› ×Ìðµy<Г¥‚Ç´ÈTi#Å>mé½ÐÆ` ‡´Ü«ê ^³-]WpÂÆè^oIå5±+T®°\Š( tкðαN–Ê„d…ƒšk´J़‚EGT]Á7ß×ظd£u€cžI ]A,y÷ À’Æ'?¨Ä%ÓvÑ-ü2ŽFÕn©Š·‘è¹°Ùùž"ŸL - P¶C³BS `(å -sÊL%݃¨ñ¨c|¬Úüçù"ö}ç=–‹ì>Èpe»„ºh¥Å…¾!iª²±.-¾î•’4›>dÇîæ÷-NÈôŠN "¦§AÈ8î³ÉeÛµVûMÆ ;ʇ¹å@´Ú‡"ÒôÑ‹…ZÛË¢/¥Gb¬ÚÆ{E[=uÆŒ¸QÙîø¾ªÇÆ1°ôÃM‚[”ã=—yK¸Š:›*ò¹Tð¡ãO·2¢äëKŽ€‘O#ãâ!ë{ËdwÅPµplÃ4®O„iF²¡òü4r!S9¯Ó*á—l‹XAœì¯¬À|Ý{G+mFêG\ƒÀ„®EäJìk!èqÝ6aˆÍe;×\KC,Ì®q|ÏÛŠ–±Iv&>2Äù–Ü9„ÃÞÂ¥#Û[Ôó+2üÓN´¾§‚Äâ¶ÃÜÌ7ØÛíW<¶Ø¼ ™£žŸ¥›1éÖ¥´ä»Á¬­L軳}c«Jzj˜(>lú©¼¦Jž‹:åöVÒ :úîùïDÓvKZ“c,£=ø÷T6o\ÊmlNúT¥)_Õ–—aè*;ûr0ÔDÃt&?ŠýrêÙïè7-!ög“ ÷ B¥ƒÉßÚà?Käÿúa³0*1þ´ ‡£X[b(´Ç‡Q¡ &(þ/v‚INendstream +xÚ¥Y[oÛ8~ϯ0°X@jY”¨ffL/Û 6nãAèö‘äX[òHr.ÿ~ϲd+mEš¤És?ßaỖj–„®¤³8‰Ü0P³lwáÍîàË?/”Px3ízQˆŸ~]],ß…ÑLynꥳ՚HVùçõûË«·Ÿæ‹ œØ/â8qÞü>WÎõåÕ^¾~{ ó_ç å¼…Á§›÷Wç_W¿]¼] .[hWGÞö×Å—¯Þ,†~»ðÜ Mf0ö\•¦³Ý…7ÔÌ·7ÿîOáozÆ»&dZXŠEà¹I¢§hTàœÑ ®Â Á#÷T„ÄÕIÈÛN ]~÷Ä« +Ôk§Û<ÈK³­ïx|;_ø±SÏá¿'Ðá+XMB'Û–ÙÜOœ{$ +a'|*xܘ&e-Û̺Ú^Q#óËw¾7àÃÁý(n.ó|¾ÐÊw> ÝV<þ<0xNsßâ¦Ã¯% ñh$©×ü{S4øé~誑È*¯S¾\EÂÜÂ^;+¬c”C§€Õ¢Ô›-š1¥í½ÔvvHkH'›²:®Wf'#äµb¿dEÃÚ<¥íE[äü}ß \¨òTe^ä¯øƒ©ˆÂw2ÚGfHvÊ2;ªeàï7f‡4·†½­%Ñš\Ø#¬ù7ãСM'þŽâlŠOL+!bÉ +ptÞþˆÓ]¯Øçû¨äSHu)ý}¥¬ì!–Ù8y½3%;59Cìz¬I2r§¬À\ç Ϭk\Q,y ¹Ö™ ‹¡Øë]—ÇæÀ•ssð‘Mñסì5Ô2±áo¼?6iyÏI˜ÜˆÜ©þøpõ§l;»ò…œ³;ºƒÒUÐeñ„õœ®X:$uJÚõNB0ï@Ñþ™]IvtOÓ¡Ö®š ùqw¶L|à¡¢½ üë°‡ùóbÙÇÎOø-á»Èî@Hª$e‰*q1«+É®w‡fGà™ö_ðrƒõ ÙNìK:§â9m¯€rß1Y½ïJ.o!Ðqn F5GC]‡!§vwëoë‰$¬CÈ@6 cb­6$%\=eDºS¾Wµ0tT•$r6Û¨T9dåkV7'n†I’Ì?•¤®òã‘šÄÂX”2Îu‡c¶Uv›ÚlÛÖ§ )l0C¦ëļ¼ÑÐ9½/@ž +Ù÷Ec «„¿‘oô÷¦cª•ÖIO’ãžI1]±sÙ`a20Xè¦ €ž"®¾Ümë[³ý:aݱ—ýMexœòÝ´Ìöÿyâ ôÈ?\—lÌz&kå6 “ƒ#Ž0詆kPW4$ nsÝ©ëDæJÎÿÇ„¼ „O>@à³x }Š—  +NÚ¬¡Áñ/ü³<´Í²½-+M¿m!¿Ë¼xXV‡íV–ïøWys¢Õ€“ ˆahuQMñjI†¼.Z¹ ¹XƒG +·‹kþýûa +4x‰ëÅê%°ã»‰N~ìh;×æ¾/ë€uŒ­q0¾¾a ó™<1§Ì‰Ð÷Ñf6 baÌœ'X˜’4<àaš>å Q`)âªb¡ ç2tžÀNúØÉÿèäCžp‹,ãªÜ_)P}̾ä×÷¶Àà7 pü„JÂßÏìõ¸H8ÑÕÐ(€f(5#1Ÿ ¼°ü¡Ï‡r¥a +)ø’©z -$b$ÃcÆ<~˜‡ÀhÓ׬v¢Â<–ÅšSÔ©‡½I1=ZzÂX ”’—¬%Ytè²gæê]V¡ÓêïÍÏ\Ñ÷¼§åŸ¸ð‘>6õºh[fÜlÙ¯^Ï¥Wa4×M:Wì'/;—VÑ·½ëó,êP1èÓ¡èÿ¸Pl»c¡Â9ÂDÜ!'V /r(´î#̉ԆIÞˆéqéšîgˆ<ð¨²:Qµò¹mìåvÔ oß7õnß1·x£€3¢2ÕP™DV‰4‰:†ôß’ä²Úm¨ÜÁhCvì´ÎC¹-îŽJšô%:7"‹÷Ò ^䌲’³$^plq8è%q.™—Â>—õ2ßÑuek»"Àt¤obã:vd¥kÃEC@ûcøã WÆ#ª×U c˜Š\ÀÈõuï vƒÀ»¦®»©þâ)µåŠ2` 궬Ý!üÂûé-óދ\ž°èŸt]ÔJò…ç¹Q ‡0ž¶öþ/ÍÒ|‰K#T/8ls|‘ÁOçI«Þ3$u6a=–XÊq´¦"#“rmŸ2$¯5ÜÔPΨx°IZðå„ŸÚ¾»’•1ÙÙ½CüHà?›HÿŦÚv¦­«ö•mf +Þƒ=ˆ!¶Ô­S[–ó6F•íÕ·3>ûjÙ«Õb)/Ç`™[ÛîÖû +ç-Õ³.ô˜Ô.âã\xË'b§÷aû +%z«AFÛ¶o¬9(NM7²ƒ8„MH£žºáJ^wS–cl12òÖÂá°,ºlI2L½LE¾›¦iß‘¯û©¦N‰ žf@ òâæËcŠ ³øÒr¦|XÝv£G"{tÙž1!^nEžÙKêÊ%úÐÅÁ¹#UÖSí¼$øW€‚Ú¾xŸv„SM­rÃÈê;5(îðö@ý‹ðO´áæcïX¶ƒ¶l >¢WT¿vãÔåni Í$?O´\[´v¥=ó„ŸsìŸ/`0|§„é7ò±åã”ó+ÄDÆð%ä7J-o  fŸž ¬M³´¶ÇKÚ¼“éÓg§P 3Èá> endobj -4372 0 obj << -/D [4370 0 R /XYZ 85.039 786.531 null] +/Parent 4490 0 R >> endobj -350 0 obj << -/D [4370 0 R /XYZ 85.039 766.606 null] +4512 0 obj << +/D [4510 0 R /XYZ 85.039 786.531 null] >> endobj -4373 0 obj << -/D [4370 0 R /XYZ 85.039 746.277 null] +4513 0 obj << +/D [4510 0 R /XYZ 85.039 766.606 null] >> endobj -354 0 obj << -/D [4370 0 R /XYZ 85.039 526.981 null] +366 0 obj << +/D [4510 0 R /XYZ 85.039 724.712 null] >> endobj -4374 0 obj << -/D [4370 0 R /XYZ 85.039 494.764 null] +4514 0 obj << +/D [4510 0 R /XYZ 85.039 689.966 null] >> endobj -358 0 obj << -/D [4370 0 R /XYZ 85.039 441.176 null] +370 0 obj << +/D [4510 0 R /XYZ 85.039 457.121 null] >> endobj -4375 0 obj << -/D [4370 0 R /XYZ 85.039 407.032 null] +4515 0 obj << +/D [4510 0 R /XYZ 85.039 424.903 null] >> endobj -362 0 obj << -/D [4370 0 R /XYZ 85.039 172.858 null] +374 0 obj << +/D [4510 0 R /XYZ 85.039 371.315 null] >> endobj -4376 0 obj << -/D [4370 0 R /XYZ 85.039 140.836 null] +4516 0 obj << +/D [4510 0 R /XYZ 85.039 334.444 null] >> endobj -4369 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F38 2997 0 R /F58 3360 0 R >> +4509 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R /F58 3380 0 R /F38 3057 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4380 0 obj << -/Length 2819 -/Filter /FlateDecode ->> -stream -xÚÍÉ’Û¸õÞ_¡ÛPUL\S•CÛmÇí¤—¸U™ƒÇJ¢ZKb‡¢¦­¿ÏÛ@R%gÑ!åª<<¼ oƒõÀ‡z„Ê·é N"Z=˜®¯üÁ3¬üåJ ÄH@F-˜wã«·Ãh }•úé`<¯ñ¤¾ -Óh0ž}õÞº~ø2Yk½X Gqœx7CíÝ]ßÞóô݇;ø~7iï ¾<}º}~¾ú0® h‘¨­Åãÿyõõ›?˜©Ÿ¯|eÓdð -c_é4¬¯‚Ъ0°ò½ºzºú{‹×‚ïêã6´‰ -{Ì®{Ø C1±{;Žë{Õ"ÇöÖÙthbo|-72W•ðµÛVü•M§Èy±ƒÉÍÐ$žÌ/á{+ -þ G€K°Ð.Ĕ㠫ò]lFpúè7_‡ûaxo`: aºCÙíÌíåSñ<ØL³jé€ß/²Ís.T¬àªD5Ò(É”XÏMÎdl’ðY6I=<ªXË ¯m²uŽ¤ùÖË63ž«EEH¦ˆï;#¨dÖ¦¾H¡ÀÕHÇÛÆoiÅh£"?êÈþÊXÐ7%4ùlËÀ™ûÐ*‰êü#ÈæEÉ(~¥³fð*Dß÷ì7?ô‘•+¡p -K¥Ík²4cÞ’;ûyfÉdüCÂO¼‰|’ßX-/?/¡Ÿimœ±ÕÓUƒŠ˜56·«BZKaÉ“uø¶U j‚)^*Ÿ<øÒƒµÀeÐÅY_0±š6L,K¹QvT$q<Ù z„éAœ(8ªMú‘ÎÌy‚»˜Øiœ°ªÔšóÒÀÔ& -öD- 1ÇZLÔÙæ Åt„,¡(öîœIà,È\>zG\zÊË?D^ýĺCÎÛ‚9iÎa&Ï¡t¼ › oÍ'ñ -gŠ9þÆìt€6ò¥¬½´Õ‹‘‘‚/7µ',V°ä< ZÜ[ŒÛ׉èrœCâ øÙ?·èt{OÚlr¼ì¡£oùʤÂcº+ñ’UHÑã»ñ¦…Äߨ8ñµ7FHn ç2²$03Á-‚`–cô'" L’@²Š?²ÕŠ»­c€¦wè±ÿ—uþK¯K·¥I]Bt,–~Ìÿƾè0mù)Rè -£‹­ Ùèq0²Ä -ŒBUMÏPR%g°¯ÌŸ—, ¼ 6[Eawû´g‚­3‘9eåüUsDÔlø÷~lß=ÜmE‰à“)Ù°v‹fsƘ¹Uš­ši¢,VÅóã/^ ̲‚À+JFφCÚÜĹ‚Ѐ‘´ä¼aYç‰BÒœÖÖ ˜Eò' -ÝuÐFÀ›e™ótÙ÷×#äÿúæI"8{rʘ‘ÓËŽp¶ߎžë‰‡ÝŒÁ8£ÁÕBüý*«jÿ 8­ “–7‚ ÿ” zÀŠWlbžŽ›ðX°×eÅ¿ÛE±C2ãÏ B -ÈtEòƒ‰¬ä™j‘Un$@p‡Àâ*¤‰ 6l Öá˦ßù+ßÌÜéÛ±Ïå$¦M©‡RA¬™Œ®Õž?fËmE>e91BÍz43[ÃÌL1Y` " -"{8¿XV°hZÝb)y,0¾+rp¸•ä), ´2¡T1Ha=:âZvä" f¹mø£fPüífh"ï7=ò*ZÙœ$yÀÌo6ô®Ù·€b‚~, ²¥¨âÂMûÆûeËSÈmGå 9€¶zƒkâîæ>¯~e‰åsÍ.‹÷S"óS©^™M**õ•1í” Îrƒ¦Ý@±‚’¸*äƒÛõS …ö@sÚa‘°¥b;LW´$ í”ËP½‰¿¯u>…aŸ°ËŠg¸6@,Êuæª=IÐLc¤ ô¦µºam!:¾‰Ô å›lââ(öBJ¤Å(Ìq8åõqK‹y^9îwäÂa©k£¦Æ­Ê–& ‚9yjÌe¤Ü±/ÄvæÀ¡´Ú÷p¼¬NU 6Òpɳ‰x ¦®à - 9Õ‰8DIGIS5hOc²5=–™’‹°r¢H²œØ»Ç¹qÀÕJˆý WMÿ.óöˆŒÔ$}dËÌ„ÊÆL,œmÎÁ†*£‡™èÏ[ÂB€ Oz[ÂÍõ:…†6ù€†G}ˆ¡¯’(ÀX žˆƒ)\¨8˜8UZ³‡l€úß·’ÇnÈg‘+:V*Xºªhùï)v¸ÎRlc°=¸mŠŸ¨U?ÔZ{ÿÐG“(Q1èä2Æ*È;âûúÿ¥fð¤Ú?ÑìѱVIzŽB¥¥©Áå‰ùëÛûq«ŸÖt©°+~ZßÍi—Pø9Ú¡Ú'—Ð~w{ƒ:¿þ2g4þtRç—¡²¥ôä"J/¥ó.CœÊqSŠ-&„«9XóãÁ/Ré€Î!M%mßÓý®Þun=ùüÓVÐœ +8Ç•&‰9äæ«íÇãL»Öÿe軸þ/wé!52­wŽÄÊcá'6ýúÇúº^ßÐõ§väií7‡_BûçX±ˆƒØòòP?ÕÞ¼×òZ°‘¾ÿ ,=Üwæ¤m\†úË„ø·Ä@N' pfi§þßÞœëäÛ5AdÎvÁu -ÅfÂÿ¸,ëºà ËyO ì¼kÔ¯pøU?~-«Xé{m¹ÌQ®'J}Ø9¯au•·‚¨D¨ÃG¤ƒŠ^yäl}¹–º°ºŽ…ýuI“¿(Õl¦–‘X”+wZí |†ÆBPžu¨A*e³Y«QxÄo§[Î [@±ªÛøȉPÄÝ8|}^“ a¾ âAZœ®’Ç~âüŒ”±·x$e÷Ä…ýŒ.9$±)dÄÄn¢{{ü5Õ)v{ÂÔhðhIRù£j¿o±fö•ÞtQ ߟKRå‹4I—›æ)­‘Q3Gb¢†|˜ê²þßdšzEÙ¡A8îI=úζŽ7yõ Ê·Ú ÚAöP‹µHÚfúÚ~….e ¥?Iÿùd)îÓž(Vþ3—$*MNx”ÄÅ#†Êù K°ûï.Çÿ ÿƒ7Fendstream +4519 0 obj << +/Length 2731 +/Filter /FlateDecode +>> +stream +xÚ­ËrÛFò®¯ÀmÁ*Æ`¯£bz¹"Ûk±Ê‡$ˆE$$ € eý}ú5x7Þl©Jœé™ééw÷4”ÀŸrÒÈtæ$iìGZ9ÛãUà<ÀÊWJvŽñƒ8Â¥6W¯ÿÅŽ +ü,Ȝ͎¶lŠ_Ü7?]ܼý´ò´Ön⯼$IÝõ‡•ro¯oÞ3øöí-ÌXyÊ} ƒOw?Ý|\ý¶ywõv3ºÌ3¾‰5ÞöçÕ/¿N½» +|¥ÎŒ_e™s¼2‘ö#£e~¸º»úO…׌çxòìOe~FË|{Èg”õœ‡Áç‰úÀÁ/2™û¹ª‹f¥•û„œž€÷8vßãxcp’¸o`ÿ¡*ëÎr¿pµ6¾úìÕ*Z¸úføŒv»}ɃÛ|» +wø«Z`›UªÝö|êxz½EJ¶Í¹^…©+À'çHª1.mhE‰ƒ¼+ ÞtÌéÈ9? ùψö®DnSOè0îMaÑÌíª_e¶yWÙoö€L¹¥âÇqÉw0„']Ù¢œH¨´Œxïö|…Ž2·hŽy…˜£Ä­ó#!EÒbãÞî3r¥.Õð°nÖË‹mñ¾?x…™ÁýÊhƒK_‘ ;Uä§ZY?hKÌŒ›óÏ›æøxF&hvÍ÷ +H@ë +‹†ÀšÇ¼Ád¼Ñ]=±ƒŒ7\æ§R÷†ÅŽó XQEsÁU(s ºF¥Ã]¯xÚÁ± ãòkuê*ÒÐyžˆ ÙÇö…b&Èõ–Lø#ý³•ÿÛKÎ×¼Ð5üû{CZÔ¡ö/-ºßn€1é–,('š}k2aâzwI3Ažì.)°S "€‰»X;>2÷?p„è_4”ÄâYô"8ÔÔÜïCDàBíÔ†]hLÛÄ…RÒÌÔ‹`óÌ‹àÜq8s»MD"°ÅÄy!R/R 3Õ;ÂÙ‘š×ƒ–·Œ‘°Ü»è/Aà§&¹ô—0 ð@öˆ^ 8[‚Mð;žX_ ‘ Ödrx9Xò¨q2øŠÑ äÚÊ "…³Ó€Cƒ 'N3ö“4vGk«j¢½#‰cLâ!%Æ}l’ÙCI‚+ظp'Å\8‚ÌüW2|×´<øLÀ °=É9fÀ£_ƒ(¨üÒ' +#÷‘`„Áµ#™˜4OçG3r¢3gè]N›1læ Q÷º8’³T‚ ¬(ïˆF­_ô{ʃûÁœ ˆ—·Á1€tå/J…Yãrsh|¨¿™›µäf`ï>—$Œiìÿ„ß5,2`,ç$$™’dÕ…OO¢Ÿììg1%sÁ™íù8Ê«bN¼×&‰±Ã(…(‚1ðÀÀöÁáÁ§¿ÁÕ]¹•8Cõœ¾D…¾ +㵂{ÛL»ž†M‘ŠAÉ©Åê%g¾Ž§:]šxªc«Üi %ßZ#|LKD¥»²ý"qð+êÛ°Ù“šLêYG¹ÒP…–HºkÙµ[Y{´ù‚E_%`L} hÐLmHZ)¢ ŒÇ–†DÌjÀÔf&¶QÀωrD§=+² +Ó!™Q¢ÀC–Ù;͸óPqâ$qnÑ0;$ "‰BÈ¢’„¾v ¸4€ºØ$TæB%7ÜãAP”˜ÉéXd$‰äOòÃç“å€Àg.pøþʦR\zªì‘žq¼¶h¤4ÀÉ®–q²·#ß&(ºêÞ$”‹”SñT𴿨•·\0 {쀩ۖËT¼›¾ôɾž8æ"Mœl îù#¬rîýF¿6Þ¼’8‰J!ª¡xBM¨98 'ÖÁÙ¡ÝP8ìQ°Í¡yxÆðÏËS/ÁÊÞ˜]=› {úñgN¡³ +9OÕË\HÚqÆá9Q¤¤°ë*ëa¸q]µ%ƒ”Èóq ÚGþ¯×w+T2r„›êbä´WÒ6®btºãágZ/ˆô'‰ú’ÜaÕfØCÞõáÂç"ž§ã4®w?ì¸ÈØ®"ÉÊíI*”ªãßÓ¾9£Êp|Ûd} J…YÞò´Ûçt ‘z +°:p$¾fh;•l8%“„qæÛ?ʺ°ŸÊÃŒ®9 «‹våÆúYÊ+x˜PT¹‡gî(´QTp8ti}‹)–¥†(T†Œ!|_u²á,»iõ„©¡å±°.U片'$úñ‘¨k- ´rO¤¨V`üxXsë¸&¶É³ÄjžôŒŠŸ×«0æwâG^EËÚ$ €| »Ë÷FîõG-`uøðù*™¼dï¸2SAèþëÄ dŠNcšÉIŸe÷ŠŸÒöØû²ûÌ“ñº²º±âmŸù%ÕVÎ3º‚''yy75K㢠P&ò“0ªMâxŒ +‚YóF‘§Ô¼¡âæ¿·Š°ö7j±UD]žÀ^î8Ñ¡ÐðHvO±D¾N4öÓdèÅÆQÊÏPC±ð¾á0†¢›W¼PUé˜ +^çOGùÉ2Í«£1Ñ9"À뛣rÖ Pä DéÌ£Øa5ªaÒ…æóÞÖæ&4.Æ0.”qFI9”¾PSc{ `RR`¨€Å ”lÛˆ¹?Ãp™âš {F¸™"]+ãnߧi¼pôôÅðÒ°Æ)ñçýË÷8ìÛ>Åk{¶•Š!¾ô™Á6ÀWÛ¾d$R)Å!Ýá½D\ØõÊY§Ôü^T|;¾ÿÈ‹ ¾–GÄ_1êŠ!À[*8öTâ™,¥-’m]'Ó±{Óñºô&KF%NF­°>KfÉÀ ®‘^pp¡FÆØóñ¥× (šÉ“\¡[ ,¿mEÚÌ9â¸géÆo.û^z<䔋¼¾/DE«‡7hÞõï3û6ãWØEI&P=Ô£ÊaüB+šYÜÒqæ«âV ®šD<¢IŒv¼¾oý¿Ç5OAŒLDiì¿ü„ùxèUäÃ`÷m¹Cs4†üû‚ë‚u¬¾ÿUùfŸc…Ö÷Ÿ{ôj¡‰àUfrj-/b+js +é8!rîºÌ&:òãìï¾N1"%š{-HѱiET”üh_ +°Ú÷ôr¶°Ãýû¾?ÓKŽà[érá˜^¹ÁDjZ³XFͼñ‰èòí¨‰›„dêÞàÏz„ඔNÎø‡ #¿íŸ•͉/zê¨×/·Ë"9ª¨jž âê§Â0bF—ýÈüþ0tq¥í«§m(‚¬§¯ *Ÿ—8Ä…yÓ˜[ÛÒ7–îøö¸‰> endobj -4383 0 obj << +4523 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [342.437 635.375 479.339 647.064] +/Rect [342.437 547.034 396.551 558.724] /Subtype /Link /A << /S /GoTo /D (domain-member-server) >> >> endobj -4385 0 obj << +4525 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [155.273 414.06 312.906 425.75] +/Rect [159.804 172.41 297.486 184.1] /Subtype /Link /A << /S /GoTo /D (samba-pdc) >> >> endobj -4381 0 obj << -/D [4379 0 R /XYZ 85.039 786.531 null] +4527 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 68.406 129.975 80.096] +/Subtype /Link +/A << /S /GoTo /D (assumptions) >> >> endobj -366 0 obj << -/D [4379 0 R /XYZ 85.039 697.007 null] +4520 0 obj << +/D [4518 0 R /XYZ 85.039 786.531 null] >> endobj -4382 0 obj << -/D [4379 0 R /XYZ 85.039 665.591 null] +378 0 obj << +/D [4518 0 R /XYZ 85.039 766.606 null] >> endobj -370 0 obj << -/D [4379 0 R /XYZ 85.039 619.932 null] +4521 0 obj << +/D [4518 0 R /XYZ 85.039 748.602 null] >> endobj -4384 0 obj << -/D [4379 0 R /XYZ 85.039 579.768 null] +382 0 obj << +/D [4518 0 R /XYZ 85.039 608.667 null] >> endobj -374 0 obj << -/D [4379 0 R /XYZ 85.039 361.265 null] +4522 0 obj << +/D [4518 0 R /XYZ 85.039 577.25 null] >> endobj -4386 0 obj << -/D [4379 0 R /XYZ 85.039 324.398 null] +386 0 obj << +/D [4518 0 R /XYZ 85.039 531.591 null] >> endobj -4387 0 obj << -/D [4379 0 R /XYZ 85.039 309.653 null] +4524 0 obj << +/D [4518 0 R /XYZ 85.039 491.427 null] >> endobj -4388 0 obj << -/D [4379 0 R /XYZ 309.697 315.627 null] +390 0 obj << +/D [4518 0 R /XYZ 85.039 131.043 null] >> endobj -4378 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F62 4047 0 R >> +4526 0 obj << +/D [4518 0 R /XYZ 85.039 96.297 null] +>> endobj +4517 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4391 0 obj << -/Length 2526 +4531 0 obj << +/Length 2390 /Filter /FlateDecode >> stream -xÚ­Ymã¶þ¾¿ÂEQœ\ÄZ½Ë -Ð{»wͺ—íÙm\îƒÖ’m¥’éRrÜý÷™7R’­´rK ÉápøÌ3CÚŸyðŸ?[Æ®f³t™¸qèÏ6Í7ÛAÏ_o|±!‹Á˜÷ë›Ûq2ó=7ó²ÙzkõdžgÉl]|uî¸{^ø2_„aè¤î|‘¦Kçáǹï<Ý=~fñÓ‡'ø~?_øÎh|Yýðø<ÿ¶þtóam ˜è‡!.ÿŸ›¯ß¼Y¦~ºñÜ0[ÎÎÐö\?ËfÍM‡n…ò]߬nþnuq_4ãYS»Ã¥/ÃëíúñÄvãØM¢”¶ûÓ|:ê4_Dqì4ó uN°£·Ö±0¯éKáWâì¡7ŸKçWü§Daêt(-yÀ1×ySv%ÎѬÚ²!á+´ŽŒFu¤¿=ãâJƒ h¹“䥌ìÄ€WZº2?pª¯ tQjîß‚¥cnHvo¥n­Z88pâÂGgä”üÔÁÀ}yÀù]µÉq;a‘€n/‚Ïktk±xˆgJ…m[ü'‰ó<ÇŽåDì˜!Fè5býk’(~«‘´.͈%½zC3׳ÇpHiºêÚ œáfÃdÐò7GâIA Ãmƒpu÷Ä ŠJ<‘:þZ¤|'‹ÊÙc›Hת¤Rg¤áºˆ9¨£ä$b];±;û }B°÷°·Y%ˆ—ŒMZH íZíLgÎr[ ƒtúÆ}d=6ò/ÂÉb£N6* óL‡%ÇF’½è¼´ç`kCÿ¶œ`41ÕõÞ©«~­j3kw‘y)Ã,ÎÕje×iÇe݈ûF?ÎQä<¢dˉºÛW¢À”‘íÉÀŠ´o‘&ê îße„‘Žk)1‚…X×b£320e|Û•/zÞÒòÞ¤®(?ÑÉ8£ÕKO_ö؃³OjT¦×‚D>ÏS]ôxL J[0ÀPâ‚ETÑé/·ßOÀóöÔêÛz|üy}Û.X·’®æXö3ýݲ?!»Ö튗7qdéÐ~ü4â9‘R. t/O(”¨ÑÓè0I`Ï‹Üi±-ÔDEëp¶Yæ`z€0 -*Œ!½–” 2ó¡ú«æ¹ƒ·(z† -8›vã¥ø•.Ãç7Ęhãû}r(Œ {OY˜ZˆAŠY%ð»›ǹÎC—`~f’”|x^íõ¦l°¢ BË9¤“y¶–ÏD>¤•|øA5h i¹=.Œ»“½‰ Æå¢ßcaŽÅ£âîš5(êÌ¿ïíjq]Ú2×Èñò"mƒ`È1¿Iç´L£Lãj]Cv¥èBà¼òí—=²M]Éý©eß‹—½'_Mb{Û¬Ìa/Ü©y´>i.±Ažà&œ´&Š„ìóúB-¢'b†æ¤Ý±o¢pˆøjGO)¨f䛶—•üúKû;Ò¡#¥âpx‘­PíI^áñ¸¢Äaªd6þR€6Šéü"uîôoPaìFüÔåïFð?;ëúyÊþÖ-ÝlLÿö·7I#c žN_l~ƺ¶ø7dþê2endstream +xÚÝYÝoÛÈ÷_! (J!Ã]rù Ž4> N«=ry DZbC‰>’:Çÿ}çc—\ŠLì+ÁµÐ—ÃÙÙùøÍìJ,|ø‰E¢,Ý œØ[ºqœ8—ï–Ây{~uÍä·¯ÞÂûË¥+œW0øpóæêýòÓꇳW+K˜za ´_Î>~ò9(ôÙïi²¸‡±ï‰4]ìÏBx* ô{uvsö~þ.xÖÌž\ÃáŠÔK¥šãQìÅ©Z¸±§âÈæ8}’Y"9c–Õ2œl]áž °B‚Ƹé篅²&(ÜF¤g½8µŠŠ¼lâÛJÐÑFèyÛ¢¼#Øxƒ;te}hO—„ç§b¼ìÄRRBdD`±äÈo±*/Tá"ð½P†û/¡'U2ë?ˆþI¿º Mòaiîñ*©ô" bô†}ôÎZìºè(,¯ÞÝ`¨Jçí $L<‘O%!©^ô¿Ö.òˆª'(wCɲB8ÿ§úp „ïï ÈÀKTºpqZúGpà`"õmýXÀFy½”‰sߢ CGúþ—ç×+†ž¼ÞgÀCcdÍ(1Š‰{1ç³=Õ÷QþíÕ%zøüÃÐaõæ[Vÿo‘—&ò)Vº$þ ¥ýûþò‚ýyM™Ú½ÔÉûˆƒU [ßÕÁ—ï°î¡¾ßɵɵò©7q-añ%¼_ðûWá¹I`1$ðwhö/+}!8³CÎî^^^Èÿèv£Êf1 ¼T©ùŽÐ…*Ÿ$ØåuÙ°O!;Ÿ±5¡ë#¿ìñåØvüFÍaBÙxî–[‚€ý¦±Óî×Þ¦>ÜÎtUaJ- óýì‹°ZrAÕÕ,¦#Áø¡â7 2vÖ8bb‰=Û]­U•hS#÷=¿[-À®9- ÙÞlìÑÞCÁÒq@=“+chÈRn¨w®¼Õ‹ýì+¿ntlåh& ˆ9C[-Cù±Ó¥ +РìæúOáa¢ù**§Z²ÙB¤¦}Ü¢½êuV}í»L&Ô·c‡ gÖk~ðýh×YþbfÏnEžH6g"Æ[w•TÎßø¡=4•ç*/^@ˆH·ˆ_t\nÐÙcït`˜©"Ø+²¬õ}Ý|Þ6õñnÎø g=ÁøSJzB +=ÜÂ>yÄ¿o=jRD`J©Mz²!Û¤ØÌœà.æq£®veË’ËÖXrØ<£<ŽL4Ù_íôºÇ(Óô¬xþ]“1ËÖ3Í¥ØO˜‚F¡9”ðǯ;Ye5v„Àù«–ˆD£Uè'tÖÊ]žºb6'céÉØD}qØ4w[ï.k[°kÞΘOøõGDv¡VÜ7Í­à;J5ûC1·¤^ÔÚ âAmZ÷“\íD&à\ÓÚò± ¥žÂ2¤«.›9v8¿+7âm¦sô4ÖS¾ƒíz&Ø+yüu…_18ðÅ<1ÝhóTAšfÇJ#+­An+ºŽ"`«¸åoÝ®dǢбËÌŠ s‘‡º³–…˜‡à,*±®˜Y¨Pj–V»¢Á˜”:Òáy¨õÓÌ-r&P2J9# wù ™Ì ”O‚î“×ÇŽWÂm“h]Ä,-l!Ÿl‡çøÙÃÜ8ЂЋ£èI(Ìcá¾ÊVo’(~ jbÒq¬%¡'ühdå>)4¦Íè +½Pdtøi6)À ³èÆ #ÇkŠ«¬ª ‡Î³¡2ÓÀ.×ûšô¦ÖæöÁªÜ€Usð hMVD`|€”ûÕ`ÊHéTxaþ~åûñ‚€f—rTcguµ‹4ÊtjÓã—Ô-/ò±¢¡L.µú>M* ¯„ +8¸£.‹€T 4#¶äpösÖÙqâ3–.|‡óñbü˜÷¢f¼jjj 5"P8JL[DœsOéƒì•ØuÅp§•¬ù¹Ñ²Y$Z + $B-5Èj\Q_×ÀÜ„ö*#&¹!¸ó&£ž{M­ï;÷%ªŠ£®yЃšŸ¤ê˜Z:âZ— ¸c +gœ:øU@ÿë"Ù+‚t +Hœfï1JI[3×pPÖ}¦q¿P­ÏxǽÎSÄ…ÈmpÝì@MšÔ…†q/¥~¿À%1¶ÇáØöHaHð¿Ã„Ð\Çe?™Bà™«¯d¿Œ†µ–QÕfl_¶<¼4- ŒûÄIUµvÜÂpv^ÜécLF¸%‚ýز%RFæ +Yã‚ê@ÎdÞsŒ[µ0¸눔 u_ +ÍivbÔ˜CžÃÆâ~cØIðÆ´ éEÃø‹ÇÞöÇ r€ü_™?jºÔ¸qõˆ×Ym¥é@GèipP—ž9(êÉ8ø×ßÒ‡AÂêÝ®6B"ø£¿ðð·“?Sà['%¾Ð®¿d›]I\¦û‚ˆ‘º|ÛÖA§l÷LívYÇ3©WƒgÎå­08+ìÚúEXi,SW%¸á-µ}Þ2aM‘Ÿå›Œ#Ê]g­iJdÛ·|<¡a±V,øÊî¢pU !ý߈–ñãG _!ùú†…ä”Z‹FŽŠwSF}ï˜f`;EèÀ{h³'{X›C>ߨ–è³CÆþ4í™%ÛruÂË|¿ß•‚q B¶IJ˜þJâQ§aîŠÃH£Ù;º|>MÞY¦¹¦y`´©‡C\c€±­«£Ã9L[ѱŒóŽptå×™æ]blîÍQx`7ÇÀÏ•l¿‡òÿb¦#ô韭(ˆ¹jÔu÷'NÒC¡e¬ŽÜ›iãþó<(,ۮɺºùsŸüÓ7¢8»¯ÆgÚ©fp˜ŠúK®Ñ3|eµ­Y³íÿý+z¬·ŽÙti¥iÛr¨Ó~ž|øû¤w¨n4<Æ3kì‰:à/t3|Û°ËæÚñÀºØùÖÑAy‰HNšr8w¼Ê·c‡O†ø£þ‰&õYŽ‚ +ce8 86 8…ooŸñ 58°¹ßë{jSiê(áÅ^Ïöìú@@ _Nžþ- èñ“tþ>ö‘ûú§ýiJNe_þýn7N&×ÙÌ3ú3ù?‰/›™endstream endobj -4390 0 obj << +4530 0 obj << /Type /Page -/Contents 4391 0 R -/Resources 4389 0 R +/Contents 4531 0 R +/Resources 4529 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4377 0 R +/Parent 4490 0 R >> endobj -4392 0 obj << -/D [4390 0 R /XYZ 85.039 786.531 null] +4532 0 obj << +/D [4530 0 R /XYZ 85.039 786.531 null] >> endobj -4389 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F62 4047 0 R >> +4528 0 obj << +/D [4530 0 R /XYZ 85.039 766.606 null] +>> endobj +4533 0 obj << +/D [4530 0 R /XYZ 309.697 772.58 null] +>> endobj +4529 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4395 0 obj << -/Length 2644 +4536 0 obj << +/Length 2170 /Filter /FlateDecode >> stream -xÚ¥Y[sÛÆ~ׯÀL -΄Ð.°X™Ž92±¢Úì(3I "Ñ’„ €–Õ_ßs[\HHv›ñXØËÙ³ç|{n»Ôž‚ÚKã@E™—¤6ˆ#í­÷ÊÛÀÌß/´P,…d9¢ùnuqùCl=­‚LeÞê¡ç“© ά·*~ó¿ÿñÍíêíûÅ2Š"? Ë$Iý«_Ú÷æú†‡ß½}ýïKí¿…Æû?^ß.þXýtñvÕ 0QGnÿñâ·?”W€¨?]¨ ÊRï Ú*ÐYæí/L±‰¤¿»øpñžÏWÍiGi§Ñ¹º:žQ7ŽkR·9‚‡ü©Ôáò‡h¼D'NCoi¢ÀFŒPS×Ý_Ë8Œý˲[_V‡ª ŠË6ßßç<Ü”m—7³›H°œðcŠz± ¿D8[Øøȳ-¹ý/h×÷Á øÚx§é«&0¢!LB˜ÕAÇ#Ll˜èJ‚(€MC8ü8VþÝö$±Ö¯Zþv(é¶Z°¸6ñïá£ü’Æ»²áÁn›¸Õ–ëcƒäÝÈžyð[æՖͧ²ùÛKÚ…Q~I»æÅ3›±¥!¸‹0ó»Ýó"üo@ ÔÀiìó -O ª§ýrÑLšª[„))“ŽèC¾ÇQ<{ìÒi¦~Ù2íÿµÃ‰Ø ]Kî<ã’ú8š©÷ÜÙB'_€=|›$®]ͳë¦Ì;á±ãÖùŽûÿ¼¹þ•[G>½iYl©Á…b€x¥h¥ ‹YPœŽ‡;2v’» -òãîY†Ø7ªp ŒIÑ_§ –M&¶zD( -ge ™Å¦âш½fçÍŸHœÅ_¹„c˜Ðæø‚§>ºÔ=µ·”$Zm)€íŸ±ÅÅè·ùF†)À—aØè8—;ˆí{Ç4}€BÑûa‰™ËÌÜq;‡ÌÄÕÌgC‹Ù‡O…@%ÿW!Îê–Ǽm]zŠ LáFhC+‘#Ä㟄6²”uïo¿çF_Íä‡J„ctD˜O>çk, ©ãTF¾‘(ðÌ4*)38*‘àÂÙˆï¸Pœ)f"fA•_ð`9žR”ÊÂÏÁ(N}þÂÙXê !;0x¸7õ)u4€SE­N’„‹É@1=O’©kúJ³ã‘¦Ü±5È0ÕŠ²§[Fòôø"Ÿíl -†‚ˆ0Ê]"2ÆÕ¨3)nj´X Qþ®b… -%;g[ ªqà»D©“7F•AÎ#Ó²­å-*ö Ù0çÏP/Õdéë‘Z§¨âž}HÈ Z#{§XD…áVà–reô÷»5*Ž0¦@î*@ü+oFeh÷ø£ g "l‡ˆïŒ~tåDc¡¯ÕÜ-UMݠ屩ÈìDX*ø°‘ Ogr31)”vW?lŠ™”-KÞSå¢RÌ”BCò)=~,A 4–U…£¼ ®e€iƒnˆ-Y®ælÖ…+£©tì"/†÷ŒJ¼ -×ß&çº"²ÂMØÅë9ß»˜¼A "Ñ­ú£½ \ö )=ä(y΂o_ë¨xœafß—Šr0DAsYL9Y™óˆˆ´’¢†“¨ÜÞ#g øÜRvÁ§ÕŠ]yÅ[ŸÃö˜7ìÜQdÉóðÛk%3æ ØÆrs{¨ A%“ÕgŽƒçÇØßP§k%7ä! ZU1ºsã! ’ع»ÏBûn¶=JÝ:ï!”•{™Íè 5¸¾úfrËŽü]ÕvL͘¹[ _I`ÉãvKÛendstream +xÚ¥koã6ò»…CX3¢D½ +‡ì&{Íâ²Ý&îãÐöƒlѶZYòIr\ÿû΃ÔÃQ¶- +53Î ç)9wá'çq \?™Gq(_Î×û™;ßæ?3i(ܹn êírvý>çÒ‰›Ì—"Yf?9ï¾¾ù´¼{¼Zø¾ïDâjE±sûÍ•tnî?2øáîÞß^-¤s‹Ç§¯ï?]ý²ü0»[[(¡BOûÿì§_Üy}˜¹ÂOâù Ö®I2ßÏTà‹@ù潘=;í¸0NÍyׄN K±ð]ǪSNʵ;7mA 8´nx}ªó^5¿¥kTm­ñ¿1m…OÅ, ]VíӼĵï<Ý<0AFG¤«´¡ý?»dDÞðóö›‡O@sûÑo WìtM;6°®j͈ccÎjwM|ýÞ*¦\¸uWõOL2Ò]ƒST<)¯J”`=ÏXQ¢"YÚƒ‚xÀÅóEè†ËM¶Ï˼ië´­ê/iÓœª:›:Û÷Dd¥Cý•ò: ⺨¶h@¥¤S¢ÝöhƒK’1Ï@ÔéÊ‹<‹ ›ªæEjx˜‹«Žå•—€QûóRób/š­ ƒPø øÐ ¥îï¶Ôç«…'ΡFû=çë -ü{‰KþÏ4c©q½y¼ˆÎÌKÝŒ ñtZà†ŠGg’Äœò]ç~Ã'¶»Üì´Ïæ¸&=5‰ÖlŽ°©xƒ¸Ø9“ŽLxÊ‹‚™¥Ö'ï‡nÙîÈ +äݮ߱•NpX]ïIÚ´`À‰Þ² + O†Æ† +Ñã!¿ e@³cRsÀ +åttÁ@2AàüÐE³ÓL[™®yùq‰l¿-28ýÉ]EZ¯½Ë[½fbéë‘âA竾ál»ìˉðÃ$ᇴéC· Wx}jÀ5¼˜ŽñævÖ£j#;ÃRæyFÁ ø6¯õBïÌéøoëŠPÅ/„}º{ü^ò½ŸµN‹=/þ÷xwóßWUèY>véËèAÒQâÄ'+HLBoÀ$”ÂMl’(u;qŽ'…çÛì³ÇhGŽôYÒœS&C)êvw!¹'& ép¬‘U»D{Â÷Âù‹@˜Ø$B2¬Œœr¬ÈCE¿VȤ4oì °hº{´·ÆbÈ­´äÚ¼î<ð§¼ÝQœµŒ£|…Lžór;f±†;jõÅÑã”c(ɱ1SNtH‰œÛ‰¸¯ÊÑ¥‘‘?aÅB ‰U6&)GR–%/ÃŒ ™ ©¤ïðÉ{¾›Þ¾eãj"ÃHGÎÕq»ctW1g$ÃØ„J´o¢j˜èø­ap¨+¼sÅÄ 3ÈLC¶8—¼ûd¯rH'îTê,5¦A`àÖ¬mµ7í€_ÞT0©Â¦jçpY>c\çû2`C±×BTC5«”__uJ…±gUFþìJU¹Ø;m +Ff]¥Æ7¼xLI”¬H¶ókµÜçDBå ’òƒd™‡ +gŒíäAdª{Yï“‘õÔ²ª÷iQh@ª¿’¯M}]Të´¸ Wéõ¡ÎŸ!È® ÑÖ6¢ÍVSÑRO¯u»6\»ÿ<‹.M½HcTQó«¯Eó˜¦n#¤¤…­ÁÜS•Á¬¨8òÚ$4püñn{Li1f²t5¤çaC§e^ªQÖŽÇÞ먦{Î=×ÝÑQ¦!‰œßÈ3 7n”ÂWÂë–’æ¢Ð½7›N„Kàúˆ-= ŠPêqaZ™z@|¶…³Õ{lÈeŸ|7ÀV¥s5ØbÒãÚ‹‹@*ÜÐY§µææ¬81éàpʃ¾) ´eÂ<›ÐœÁž:ηìAïMc§ÆŠ&Œ®€»Å6­Mq G¦ýQ¾€×,ÕãUÉÖñà· +à·ÚÜ$¾ðäB½ï™ywi Öë"לbPª •Zšͱá*‡ÇÛ¢úöFñŸŠ»½XÐN¼ìÝ–»a–H­ø} /‡·ÞKëôÔ5S ­HšòHé}EõaúÀ®A•Ðm%sËpz¶¢ZÙF¬Ž-/l¶ÜWµs'4U3áÃz½©(VhîηŒ8ÑôR ’. +nöcïçreDGÕUÕþ‹;DJu0¶"ãŒg{È ÚN|¢PDáô7 +ôd•„Ý ïXŠ/·ä#á Ùƒ¤.4Ïäu¡sßð“Æê9ouÛ’Õü¾Ä s;þ2v…’¶m8‹œY¯øÑèúY×¼w$›tcE¶Ký÷„Úžƒè­})T}þóÅ»#º'ÇO¸â>†¸y]ÈxAlªýúÈŠMØ€°Otò5Ö>Ô>yqlê ŒÁÜ’¶í°ã ¡±»âçhò¥QzªÂâ÷±´.ÇÓuZ6v†O(ù†Ÿ·vâ§NïR¸‰àƒô+Â$2ž#%Ó(9üÜ {v’š`(ƒß@G45j… ìç"ch—uc>I%üÄæ[Jæà~ão¸µ)ÊÏÓDúfÄ ¯Âžé.•¿“Åý·£~J†=¥6=G{dfN`Þ—j 3'L¸’‚ÛýÈ]ÏBðÞï3Xu;ø¡‹ÉF¿:P ¾›|Ÿ©9„?_FƒÏ—1Ï8ü)0ƒ„òž×Ê.!¹7 úM}0Tn$"˜¨/2éˤKK5ÿÙ'di×ï?î}6ÃFÉ¥„†Æ +ø2ÃÃendstream endobj -4394 0 obj << +4535 0 obj << /Type /Page -/Contents 4395 0 R -/Resources 4393 0 R +/Contents 4536 0 R +/Resources 4534 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4377 0 R -/Annots [ 4398 0 R 4399 0 R 4400 0 R ] +/Parent 4539 0 R >> endobj -4398 0 obj << +4537 0 obj << +/D [4535 0 R /XYZ 85.039 786.531 null] +>> endobj +394 0 obj << +/D [4535 0 R /XYZ 85.039 178.887 null] +>> endobj +4538 0 obj << +/D [4535 0 R /XYZ 85.039 141.688 null] +>> endobj +4534 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F62 4159 0 R /F20 3021 0 R /F41 3054 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4542 0 obj << +/Length 2858 +/Filter /FlateDecode +>> +stream +xÚ¥Y[oܸ~÷¯ /2¡E‘ºèƒãI³Þ]§n|B7‡ä»¶ý1Êñä<4*¬\áÅÊ,=’,pYúör­ÃØùLàºOø MuLèq€v}éKg×ý«ÎeÛL¯â\ ‚ö@5^ça®ç©2â!†°'ãŒ0Ê_EOBn^¾ôÑÈ–‹z÷„s`>xÇ}ìž»¤(:8ñ˜½áç·ÿdT|¾Ý%eʉ𓾠êÌE؇i¡}n:·èå}=gÊzbú2ʶ|š” ýóÒ`%ém²'rlEMs¤tÖ¸Y‡NuÁ»°J’Æ£f×yku sÃ`d¬FÒögÌy .k³"mszŸ(dm†m˜u‘õ¶ÍžþêÉÍ‚u@³F«QV â±¢ãa^€¬`#Z`,3ë>Ýßpc‡E+Kˆg˜†oö-Ùµ„ètö¶Ø#|fÜ¢³G4•¤„TÃ!v>´ñvcZæ·Nñ5A'ó|ži@@÷.€y68¥¥¸Îƒñx-¦Œ™™Vv@å>‚.©AN9µÚŒ÷7¦g¤½ê€§¶>[¬¶L©³‚`È(¸üdδˈŸN¾¸<Úà欬Ak·3ü!þ˜ÅªÝWÄÊâÐÒ€„fþÛõ]¼ÈX¹Ø½Âœ?ï»3¥N’¦Ü˜¸] ŒYÃGÀ =ã¡—ð§óMuÆönp­©PñLr Ü>´ìÅpÁDT$lØæZÆf¤5зô'Š Ž#ïYgt+Šêq¹éÀrÝÃÀæ†éÖÒù2æq·ëÖ›x‚èó-à-ä’y»…YšLš»ïäÅ ç9("û³hàE"š6®LÊlÉ Ïy1ˆ2»ˆ ÏYD­eýÂÓ0`ýBbšdô‚ñ™ol‡'QѼšPŠ}D ~ÿ Itði´É®*K £=.ù8© röã*\Ú níù!o_4ŽØ˜~¹&ûÚrÏgÌû!§ªÍF Ó +Rù=w,±s8s$%èIÓ6`Ò´Œmg*ÌÊ]bf¥ø4„ÿ;³0Ê.¤ÉÈ„ÌðL×s¡RQìÞuq/žWñ*¼gËãhlpúT8fõÇY‚QÌxFÞò(>öñŒ³a :›A µ˜#x16ÏV`N@Œ6S$¢n'²÷|ÐüE™Î¶Ôë]0¬¿ßÜ\½#3UI^Z—ئ´¦Z\’¶˜ Ž 'âÁcàá×θiÔ{í™—óäTob´µ¬4O°ÃÚóœµYm‘â¹™5%C|êÈL]@¸5…šÅ’?®C–£òâf §_øÉv½ƒXR’%Ó|M1ª«ÀJ]&ˆM|¤èÙ1™ìÙD”«Ùá÷Ï9ý¡[‡‘c¾””g‰ž&&f1gz¦{4wî÷ìÙœ—²kƒÏ=áOGLp Ùøè™ 9%5Û¥·T0HPÃW#`ùŸ±ä,)M’Ráhõ\A`ûÑUmœûí©Ó6–‰ŒOÔÜÊÓ¬7çøN=7Cz¼œUá™g/D&K¦å]CÂ[ÜnÞØì=ãF‘S‘Óî'¦ØlhÏ5‰ÓòÆfÓGt}©Tå¾ËµÞLò°ÆD ¤)bš†®¥¯…Ž<Äq(ü8¦£³Š°GX±‘BÅþÿP’ZHHØ—êC ÀT' +^݆¹° ·hv8ÙÅ*Z…JÄ*èêG^I)bDgŸ@¬£(Å…z—/"¾ÐêëJ +WÇ”þ»£6ñÙ/"ÂÕíQ®6p´ê™R±ðü`åßPq_ÖŠòú»óî€ëÝbc߀À)û·v:L†8tmÜèRD¶¥Y ™P¯3rÂɾf|HÉËÉé_È{=rç˜ìÊ’çÈÿOήvZÞ—}ÔE Bz½7ºJÍ’T~¥MÏ߈ r¦uAŽar +¸+”°»T^T"´¸ß?ëmdÒÎÈœ±Û*f7 <Åž¹x'µTÁ9´íéíÕÕóó³(òòüí¹ª‹TìªãUß½²1k,ü ÚØâyä€"DØòé^uD—¿à8qhÅ”i ºH»á²´@ƒziKWØTì;z ¾ç-ÛÕGÖ¶7uȉ  †r—  +Í~3kä¹Û€Oɲ 6+jµZã²øÇŒÕEŠs}½\¢_{Zøn¯ðµP:Ê0«:Æ2eÊAè\oP|Ø jcPi + 0~‰†¸kÅ¡:fpêùiÁ”y"ŒâWT¾Òû~¡}K±Eh&ü¡ÐÿLuò|-Zð§Ã‡œ +åOR©NuÞ¤uH@âŸ}¦é úŒ»“¶¶i4  ±YðPÅ"dê løšË[FàŒ¬ZY³hñ‡\þ…s"ÝX +­¬Ê‚–£Ñµ‰ø¢’ë@AðÿèøÄúI Ö×–í_ÈþÀOâÚƒèÇFůÛÒÈq> endobj +4544 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [153.691 493.507 264.18 505.196] +/Rect [156.484 711.882 386.244 723.572] /Subtype /Link /A << /S /GoTo /D (winbind) >> >> endobj -4399 0 obj << +4545 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [128.678 148.709 182.61 161.611] +/Rect [168.081 380.93 222.013 392.923] /Subtype/Link/A<> >> endobj -4400 0 obj << +4546 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [246.527 148.709 369.156 161.611] +/Rect [286.128 380.93 500.027 392.923] /Subtype/Link/A<> >> endobj -4396 0 obj << -/D [4394 0 R /XYZ 85.039 786.531 null] +4547 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [146.561 367.078 305.181 379.98] +/Subtype/Link/A<> >> endobj -378 0 obj << -/D [4394 0 R /XYZ 85.039 650.988 null] +4543 0 obj << +/D [4541 0 R /XYZ 85.039 786.531 null] >> endobj -4397 0 obj << -/D [4394 0 R /XYZ 85.039 616.242 null] +398 0 obj << +/D [4541 0 R /XYZ 85.039 327.467 null] >> endobj -4393 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +4244 0 obj << +/D [4541 0 R /XYZ 85.039 289.366 null] +>> endobj +402 0 obj << +/D [4541 0 R /XYZ 85.039 234.961 null] +>> endobj +4548 0 obj << +/D [4541 0 R /XYZ 85.039 200.215 null] +>> endobj +4540 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F59 3455 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R /F65 4251 0 R /F20 3021 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4403 0 obj << -/Length 1688 +4551 0 obj << +/Length 1949 /Filter /FlateDecode >> stream -xÚ¥XÛnÛF}×Wð-P®w¹\^¨»­“:I-A%Ñ2a^’²ký÷ÎeIQ‘ä ‚@{™™=sfhåHø§œØ©'ŠCa´råD:+Øùe¢¬„gE¼‘Ì‹ëÉÉÏ&t”‰Lœë›AO"…IBçzùÉ}ùëé»ë󫩧µv#1õ¢(vÏÞN•{yzñ†—/Ï/aþbê)÷W³_/ÞM?_¿šœ_ŒLTZãõ_&Ÿ>Kg ¦¾šH¡“Øy€±*Iœr-L í¼˜Ì&¿ºx/pøÔ!o{ O%"ñÍÓ CÊpˆˆ»ÐA8Žˆ1" "ŠH$ƒ w––óBFîéz?ÃIèÒ¸.Ó‚QñþeVÂdåf î·0¿Í×Çâd|›øi÷2d¸2žRE" -ø)¯oóvêÚwùW»)O›zƬny¶ÂI¾ÌxÖÕ,Úf]—W+^D‰5!S?vçV•’ygõ½ÎðÛÀﺿt·Y…G»|‘vy]±tºâ°µó‰hSåa´ žÂçMÈ«eJZ_bT¥dH¾>{)xtÊ?7i™¨9mòO<ò:ÛIG;QQ¢h®Ö… Ó¶Å-4¾$¡%ŒÄ‘ éñÓ¹¸€§DbÌèýÂP‰@›-ð”«}Fº³¬Û¬]S-ÝzÓð ‘UÎÅ¢®nŽÙf¡¾aÛ r[¡ ?QdÛÇi¬ÁŽ$!bƒ/ˆ³M›ÙðÙ…‚b—öû€Þ¿Á¿g^!$yC³`½îðëªÌ-€= -£VîsŠI;ž”cØÌ&K‹’OÿÈJñá¿w8>ˆxæ+¤¶Óß.@°%ÙŦAó¶àî8=›OñkfÕ¢y\Ó’ÅaJWµS¸¿Æ»—í¾±YKʼ‘w1'øDFî‚ã‹a•±Ûb†FÀ= -“ Wiõ¬cÑ?¤ -0Л&ã…zcwl`ž¥õÖ*DõYsÏÑâýMKä°½à÷.–¬¡JËìäBMÉÄ -y ²qëRðÆþƒ02€´ÏŤFPÝì‚#2fp¤m½¬íÂåk¬4$ƒ3Ãáà „F¨Ðü‡2Yg¤9XÑg)…ô“£zè”=<"qý•š!å5¥·…0 F|-A Àp¨9R1‚ßÔŒ^|¯¯Ü´Ò:I l’yÎG $‰f‘јŒß:E '¥rÎj0ÓYjÕz#½ÌNñˆ”›‘q|Z“ôô0=AÙ†Šæ‚cNÓFa × xUw,²«8qà÷"™­¤2埶œ¯ÓíƒÝ¤ƒ…¢O„¾*ˆh´2u±$¤ÁZäYÕ!èò¢à­™p9Ýô¹‚]†} d Nÿámz{Ú€×V»ÙrƒuCZä.ú7ª“¡"üÃÏÛ¼ }cº¦ènë v¨$ïX9¬zf ŽŽò/¹mµÞ¦xEc™!ôI_µ´‚¨Û–î˜h¹glštV)F"½Ïp(ð|ä<Ša<"œ¦å|mm#"°X‡¡êqâ^X‡`+·ç³¿Pݚ߆Â×qÐQSÚõ£Œ)?b}o/ò 6yÓµä†ÆîÕ‹à#ºŽœ¯VÙˆ½ØéÚòà¶Z4J]~oëí2î^tæÆÖ-êÀ:ÚY¡Œíϸ_ê¯^Ѿ-âsºzÄ¡lîõEAô­èˆfþ?g!/*9K¾›G})"ÿÉ~HäMôd³¦}¼$7kþ·šµ“¬[œÜaºaàæ=ѹièç ›qÜÔ­ÌÑÞ͇ÖòÍ~X@”ô¼¤T9رíva@½š-w VXÓÀQ¥åý¼}ÎlªÇ†@Ô-BÍUŸŠ|¾ÌnÒMѵŸ ðà„ŠýÝVŸþ´]œñ Òþ||ûþJ¼>¿zq~õv­Ú¨OÃ*` Kè Õ¿Ë‡Œ/ø{? ï–‹‘Gj  %Àn@´Ðpùw|Ÿ|_÷-/ã€x=Q6,ö“ Ûê¬íͨqweÔø…pÁ‡<´”mp)WØßœ^žÿ„ƒþžÜ§SDÆ0(Ó»¡%5-7ŒFõ·gÚ¾–l#»<Ô¢õßT‹Qƺë¹hÙ3Êö#m d8ððåΗޑd1ðí¤å -ügS¾ëïCƱHbÿpÂ`½1Ä Ñ× ëÿ ú0,endstream +xÚµX[oÛF~ׯàÛR@8ápfxY`ubíÆuteg‹"”DY„)Ñ%©¸jÑÿ¾ç2¼ÉLÓË.üÀ£™3gÎå;—±t|ø“Nl„¯'ŠCa”tÖû™ïÜÃÎ?gÒrøŽ~hpëÕÝìå?LèH_$~âÜm‰ånóÁ}ýæâ›»Årî)¥ÜH̽(ŠÝËwséÞ\\½åå›Å ü~5÷¤»byûæê›ùÇ»¯f‹»Áež:TxÛ³}g +}5ó…Jbç h_È$qö3m”0ZÙßÅìvö¯N +ïi‡OMØäi †Ž§|÷3.ž0î1­ë§²ÚÌ=·ÎªOYÅôßøs*•xȪUV•µ° g–I•ˆH'pc"ühäégÚÉ 1èïI0Àü_H-¤–“¾BŒ‰>+†ù †)âϤ¡b' +„ö{_…Ú‘R$Æ }õ¶„Ð6ãl*¶FDEÄùÁ‘Â×I¢xw@“žý!Zxyµ—Îe 9½RàÉјõø”S!ünk·<uânJT 0N +Æ–ýP6Ì2&cˆJвdZ¹a‘)êýê1Ô¸U?ÙÍÿøRÄýŒrÓü;YD’kd)òìÐÔÈç»OyQðÖj–Óc³›£ƒýк;‚¤]ZÝj´Åñ ¤:‚ s#!ò-[9B=P¾±FÖÙúXåÍiÂFŠ8hy ¢L’n¹o•Èhn¹iÑìÀ÷Ò½ß1_Þð×Ú…äpQòNL£±é<ˆÝjo7[ÿ!]]”spÏSÍK'ä¥`ædëCÐ7 +Fæïð’OèT¥Q„ÇÖiÁÕêi\óÞFúx»ÙeLl†‹sÌ«0Òù!`Uý©ô4èAÉóººöÇË‚'¡ÄÄ +ð!%§ë¾€¯dÐeVàO$|$´Û¨ù°ùº< Üïú'ŒÜ—Y³~ùP­ŒX—‡íDMDÇŸQ@I!Í µÍDj h’€/€J¼¢ – ýÔîÍÕa‡äy“å{N]‰è¡µk(ÞmŠIª8@7ЀÄ^^³œ3É#Ê;d”pg{Z°È؃à -@@±S¯%]…¢6YS¡dâÊÈÖ¤¸Sû±{QX/.oÙ¤Mé }†²!ìÓü€Z$FÛ¤"2Ťk,@›¾B˜3'ËDKU[OÒ&³ë·Ë¹”Òý7ý ÜŠ-‘sÓÞ…Ù@DWîåÛ[{è§ò0Õ ½ù€È/X ­ÂIøâNÄ­áó}»ëÈËÅÅ×7âíÅͲ!Ž¤„dÓmåß‚0(7K×XSvüëúò5h1~)ÿµÖà—´ØÓÀcnAäèHbÕ¥ý'”’aHðX»ú†œïƒÝ¡ë%G†™‹œCíIèÌ’jÜþß×VûA;£ÜEÂöÃòkÈ#¯ýÑg=Ò]c;)ºeOb-»¶Ê O»Üb’½Á †2¥UÐOshÊ‹tUŒ ì« +õ„Á|D"÷)Ö#¥[qâE.hè)nY@T65ž£I*#Bª9_„“·Ô‹3ÿîÛÔ8äûvÔ˜Ò#%`ÓvÞ¦Þ_'Ôòd Ã`£èÒ¥Š|µÉ¶Xêäi™Ñ· ßS=g¾{÷~)®ËW‹å»[.ž>þ@­üqnN ^ðóÄ™‡Íú7½©œ Û‡g™ˆ´OPUZ¿DÓ°8¶®m+".vµ¹´ª!"5¯ð˜‘mË>}žA¼ ú¶¤ŽËCjô^ž–páH ÓG½&-êÚ‡ûz*ö>êè]IÙ¾õ~ÐhÏgÍéS;ûˆm²Ú[¯ÖÞºZö3ð±¨ï7(ÎüiALxgHÆÿSHšÿ"ÃFíh´»y¬ì‰ [êîñBÕΪ/®ì4‰4½ºº–. TÊ©ò•ˆ°mr0äÍÄÓOi¡àUÏLïoË~dwÖHD]gýû„ C†ò~‡¤3w@=õuË”Ò m}LÚΊöÕG›ehw¹±¯¬£ç> endobj -4404 0 obj << -/D [4402 0 R /XYZ 85.039 786.531 null] ->> endobj -382 0 obj << -/D [4402 0 R /XYZ 85.039 766.606 null] ->> endobj -4405 0 obj << -/D [4402 0 R /XYZ 85.039 742.055 null] +/Parent 4539 0 R >> endobj -386 0 obj << -/D [4402 0 R /XYZ 85.039 686.81 null] ->> endobj -4406 0 obj << -/D [4402 0 R /XYZ 85.039 652.065 null] +4552 0 obj << +/D [4550 0 R /XYZ 85.039 786.531 null] >> endobj -390 0 obj << -/D [4402 0 R /XYZ 85.039 344.017 null] +406 0 obj << +/D [4550 0 R /XYZ 85.039 608.524 null] >> endobj -4407 0 obj << -/D [4402 0 R /XYZ 85.039 310.471 null] +4553 0 obj << +/D [4550 0 R /XYZ 85.039 574.978 null] >> endobj -4401 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F35 2976 0 R >> -/XObject << /Im1 4096 0 R >> +4549 0 obj << +/Font << /F56 3312 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R /F65 4251 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4410 0 obj << -/Length 2444 +4556 0 obj << +/Length 2570 /Filter /FlateDecode >> stream -xÚ­YYsä¶~ׯ`*• -§*CÀÃO‘%9–••7’üà²ý@ ) ³r–ähJùõéà€sÈ[^—JEF£ñõ…^ÂKuÊÌKÒ8ÐRx‹ÕYè½À̿΄¡˜’¹CóíãÙùw:öDdaæ=>|²0ÐYì=¿ø—ß_||¼¾ŸÍ¥”~ÌæI’úW?΄ÿáâ掇?\€þ·³¹ð¯¡qÿðýÍÇÙo?œ]?Ž8" -)qûÏg¿üzˆúÃYÈ,õ¶Ð‘eÞêLih%M¿>{8ûÏÈ‹ç”Ç«ŽÖRÌ# ‰¾d;P‚õÑíBÐŒ«ø$ZnµÞã2Þ@ *ãh¼XyB™Öx y%@M ¨º»t: rË}¥Zê0SfÈÑûì‰ TY&™Äi“ð»3ÑÀùÍJxW-ˆé9’¶s‡/I*R+"Ê‚8Ñ^‰@Á(êãr†RÎ¥~ÇMáçШW8ú+Øô÷žfó(±ô [¯í¬_ä}Étí,Jµß°Ýn¸³­êš[/¥áy™7À¨iM÷×P¨¦@˜fþ-²½ºä‰g ¾ ñ…É®ü¼)û¶.PÏxíQ”ÑѺ2§CÜ·Hƒ'­jP*Ü.¨Â­_˜ªjª¡Êkî,º²(ì÷<ÀGòn<Œþê¤,»'G(jÏ;Uæ‹Ê™ãd_6=lôJ”"ØG‰Ê4¡×ÞG1Šo>ßW–TAvúÕö©ƒôË͈uvÊlÁž-‹v•W ·óaȈœeY çáѶ㵕ñÐ$7ÛUõPv´ÄcRhýÆdŽKLvòíkÇ\Ask:ös‹·Q·ÆÇ‚ þ GÞ¸Íì¡a2Ô‹á%A¶È™Z‰·ûeÞÛÌ…]ÅÀãäïsÃØ‚ñ4ý¦3‹G#Á òÞD ¼–ˆ-ì žª—%Lgg,C„=7xü¼ç˶ ±Ö(ó‡î)éXùmʦ\ãÆF44*ËÝ1ªC,‘…¥¡kaÐc„¥‚¤Ä -ÅÁ; ¶à¹ùñ œ› ê4ño¦œ¹SP,üûÀÌ8âá6Ö±Óá¡FÓF‡P–¥y_Úê|¡’‰´ySl˜È K²/T”¥þ­÷xâÖƒÁÑèT³Ôñ‹ØãÔ ³)Ͼ 2ŽƒH$ïjÆÒ¼/žŒ³@%r"9ƒ,óÉ…blE‰šÒÔì6ça<ÂóäÜ] ›.Œu-è¹Àb •jâ"ÁÝð#EÛ ìöè%Áðûgâ3½I˜ö¶jx]J]'ÞÊd•žNß}ÎshH‡Q蔫–‚oÊÞ" T{J Qà È2¨ð°y 4hfoØsh7ÍpJFÉïɸ£9é.$ŽH“Æš7Žœ¶é­ur´¡‹;ËÜn)d¦8ZO¯“Ë¡¾¯Z±ÚýÈõó™×Äíu¦5î4Ö\E5Vk‹¡µ1SÐ[K@h3S]ËHL <ÃÑ@ÅìùwÒÕ„J%ƒXrEÓµíðW` -üäpba:ÓsBpíùOü½(VP/ctáþ¶Îû~Ûvʼn{‹À—«ôý{shFlíß[$Ð<§Ð.•ùg2D[Ý >Ÿlð50ƒ\¤EŠC/2å}4è¢ß>&P$Ä* ¦›¨ ÒÉ»‡°4¾+óEDÙ±èáÚ "QÞ'ù‘í…2ÑÚqAàä0Ù÷ãR*J=G¨ÃÀah$Ÿzo*}£‰è.ŠédØ‹0ìt%‡8">¼Ø˜eO"BuWò³ƒ-qåÞº`aê${tƒôÄñy¼_KV8gÇ*"€Ð®_¥D¾E,'úöM‡>ë27æK9$?µŽ>eŸµµ7 yfG¶³våßZa­ßïìëjM8µîÇqÚË2/0Üñ„ó3ÙÚ€É~ÝË7ˆÀ±x³#ÉiÈ2 eW¥Á!ùlìÒsè¬ ³àÒ©€X>3Šyvƒ·®¾!m¯fGÞ2£8 â4{OzK²/þ·ü¤ŽŽüãËM‰]4‡^Ä%"|ëöŜȥ ņ-ݱ=ºbºÌadL‰¦2’Ÿ®ïï.ð'«ëÞãVÿþ`B>–J1A&ãZ°âÚ>¯†ØÕö§BÖvÉ5Pô28rË<3d ,ª‰©a¶4fFZ(§´ã#†(ÖÄôÙ8 žó¸Ç„>óWý47•YzâùNCA'Ê -CÁ#=U‘Jüüýªiendstream +xÚÍ]oÛFòÝ¿B×â +ˆh.¹Ë¼9NÚ¸AÒ^ì"(š>ÐâZf-’ +IYq~ýÍ×R”E·ESzàìììììì|®Ô,€Ÿš¥Æ¢l–¤±o"5[V'Ál3ߟ(¡fÚbƒS/®NN¿3ñL~d³«"¹*~õÎ_Ÿýtõêý|E‘—øóE’¤ÞËçÊ{{vñŽÑo_½…ñ‹ùBy¯xùúâ§ùoW?œ¼ºm¶Ð¾Ž#ÜíÓɯ¿³úá$ð£,í|•e³êD›È7:’ñúäòä?žÓ3^5q¦…£XDŸ¦z8œ2‡Ë—KºÙ‚ÔõïI¬ óÀëqÚò² RvȲÛႦDÁ –ˆ VõÊ +®©ç8±PŽk~Ó37嵌©Ê2Éû²©Ÿ*+í\Ö™·Í ªþô»h|à(É|€øÔgEUÖe×·y¬ˆø@; ¡^(TeÆš:LGvïú|½v²¡eå‘™¢¿µÄ^ÕT$ «N¡cÔ(}(QEƒS»Žéà ˆzóòœÉHIyÍRÛúI®ñØžì´íPµíJ¸¢–^“ð%¬$a +|§GÓ´µk+ +EcÈRÏ8\JÃÉP„?F ñ>&Èk¹n#Ø0XØ›-lÝóØöx؇ Þ¦l’ðeÂ÷Ûkã;à³Þ€rSÜBùx˜Ðû™°M‹—²­ó^ô ÈKáºCˆhÖ–1yksÙQhè¬}‰§œÒ +†Nžó.UE-Peð|ŸýÇN¯´ñ“0™-À ’à 9® +?EÇUàÛæ/„ ¥}¥Õd˜€¤€×O³¡E°aH¨¹?JgqìgÙ>FÆz¦”Ÿ3#ï8}Ï>8öP¬fŸfÊt–E<;‚IÎý"Bœ^Tjö²‰f{¡¢Ì1PÃáãQtK'¢Û•‹Là­óÞ¯¹bdµíÐ$Ñ!šL14Þv³qhE –ŽÁo`)ynËðÂMi°+!:´²²ÍGésò’ºq¨@éºà ß [ôxœ¸!"Ñi²µŸ¶¶c7,&ý6Çs¡AV_®ÅTA‚Þ¹½b*ˆ} !€ËÖ¶Æq÷ c†S·î„lë& 1m{}¨œ¦ã­JùBT¶ J¶î`§{¢ü;ñ#+‰âÌWøId|ÍÉúo[íBƒRÈŸ \–}# N±Ñÿ/Øø©Éþ²*˜z“BOöÿçÀðIÂ?qà![¡¯Å¹iJùC;#”Wi–ò-”L©aDÇVzoÛŽÄtë<¹ßsç é¹{¨—·-eŸò‹-0ï„÷Ë<Õìà@/ÐÊŽØ`z1ùúúºÌ½A»>á¶ç놵¼·Q©×Ý¡Üv‡£Ìë’©áÑê ŠõŒÜÝRê²Bb{Ng(øŠYî{Gw§ÿF¨nøëê9Ú¾¬*JT‘mi÷qÕFK»ñÁ «’ØÅD f *Ó¥L î-é>Hæ-G¸îé¡c0 è«ã ~Ÿ/°l–ëé‚{¸m´P¼ñLÑ‹%ïƒWSV.^cMŽØ•À²©Q+´ß6¿Æ„&3T«dâ ˆx3­bÜm#Ü6³{§Y“)€•Ç*†Ä)Ë ·“Q¾ÅÙ³;õýM2–”X‡|¹jèp +îűl‡šš¯g!ˆ |œg‹ÈÙ¢ªØu‡^@5†5ö]œì²sžMÚJ¨Vš!;#z‰,b a›ó-œeo;áñòÝ%k©jÏn²at#¼Xþ¥. +…{"!¾9§åTúþDx8ƒc?C/‹öŽ¤^WÉñ‚Qá‹èÖÞVÕŽ*œ[KP¹Ûnxe•odÚaŽtHª'‹¼µ-£$ ;Qö¾cyqñã%SâÝäÕH +Rƒ[pØîëhé;Sñ± ŒÃ}ß©c®ðET%ÊA<4AØÈâÀ ‰Æ;¯rªò´†Î¦Ï‡ÞÔºÖÃ5ÓR· teÏc2Z¸îm ½‡¥Îƒ2l/ž9TR: ô0ëµ+ôö­8ö•kê™8Z*ƒ°Jeß”÷kIÂèJv´ž‘”sቼy¢®»­Dmm‚½Ïà%"¾E;C¨-W·ó0£–È% + è¢ ÂnÇ}y˜ò GÇSÛ/Oo›®ï&ºò8ô L)­t+ƒãÓC‰ÁˆåÛŸ€Ÿb :cÞˆ’îþÈ=¶Ë8»'Œ¨Çiò@”½ÐËåº 6x <„Uc´wqÈ™~¶ÎžaÒsäÞVJÙˆÛaªÈíÒ¹eŒ‡µ5S0æê¡¡:ÁA>á`.)¹f`TúKÙ¿ã=Úï†Ø:‹løû;žÂuÌ à˜JGÅifl®,*rª©²q/r¼–ÇÄp÷{oaÅý(ÃáÌ ¤Ã×^*oE9NŒËuiÇìY©Gr,Ý»1Ç·ŠrÃ4¤Ò] ¿EÄdÍq!“@K m2jvxª]Iéüþû?(!.íß›xƒÄ×Íã=âÀÅUøãF%7yêé]j~:ªÂОù:Œûù»Òkâsªò´I¯ü$›^ûéŸÊž×ÅcŽa%]Ì ¿V\ýO‹ÛZæ_[(Í †÷O|0ÀÒ\k5ÆJ"¸³YÄL»2è¶c@ÚôlÈ+ä‹ +F‹ášñ¡&<ˆ»²ærÑð‹c;Ö…©Ÿ*=ýþŽ@gÉ Ÿ0˜hNÅÆ#Š¢w^àâD" çMÅÕ5-#Ï–Ëf[÷-XChž ì;UÙ_Ù™¼qÈ›à¶s£+¹Ð@‚[yGx×–½Dyúl«²#ý“‰á„ûRÙ"þ’ …*Å[jzioËû¹‰½á=ò ¡ .:cµí¶üZ-¸VÊXlOÕ3ÁÑkêó‰<¯k.-ڦ鿅]€--X” ±ÔíøB‹Ÿù{ðàþïMÞu»¦-&r¼Û&¡m> å7 iþnèkã*öƒrÕ1zÑjàa¼•œËríå²ÙÙËKˆ3å-ªEëÒn%Ú ²lªÍÚ~v¨ÌU^—_èï<›È¼ûl +ª¬èO–f¼È(αFê€ýKݾQ{“¸’Š–4Áÿ×ÃøñY ½^ –þÉi©Ã[º<ºÎ[¦iZ<`¾°|>ª`vKS=¾˜@†ºÌY×ù":.j½¯rËK…•e7®.ôþÆY{SË`hUÆœCýE6ç³Á|`M÷ÀjÈ?îùD”PQè§ú‰¿÷éï+þÍÓ¡ƒŸréÓ1' þ]`šƒÄó_êÓwendstream endobj -4409 0 obj << +4555 0 obj << /Type /Page -/Contents 4410 0 R -/Resources 4408 0 R +/Contents 4556 0 R +/Resources 4554 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4377 0 R -/Annots [ 4412 0 R 4413 0 R 4414 0 R ] +/Parent 4539 0 R +/Annots [ 4558 0 R 4559 0 R 4560 0 R ] >> endobj -4412 0 obj << +4558 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [445.319 411.826 539.579 423.515] +/Rect [452.032 269.161 514.226 280.85] /Subtype /Link /A << /S /GoTo /D (ads-test-smbclient) >> >> endobj -4413 0 obj << +4559 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [110.886 398.277 250.888 409.966] +/Rect [84.043 255.611 147.825 267.301] /Subtype /Link /A << /S /GoTo /D (ads-create-machine-account) >> >> endobj -4414 0 obj << +4560 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [272.982 398.277 367.214 409.966] +/Rect [173.049 255.611 236.831 267.301] /Subtype /Link /A << /S /GoTo /D (ads-test-server) >> >> endobj -4411 0 obj << -/D [4409 0 R /XYZ 85.039 786.531 null] +4557 0 obj << +/D [4555 0 R /XYZ 85.039 786.531 null] >> endobj -394 0 obj << -/D [4409 0 R /XYZ 85.039 370.458 null] +410 0 obj << +/D [4555 0 R /XYZ 85.039 229.915 null] >> endobj -4415 0 obj << -/D [4409 0 R /XYZ 85.039 335.713 null] +4561 0 obj << +/D [4555 0 R /XYZ 85.039 193.048 null] >> endobj -398 0 obj << -/D [4409 0 R /XYZ 85.039 238.488 null] +4554 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R >> +/XObject << /Im1 4209 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -4416 0 obj << -/D [4409 0 R /XYZ 85.039 204.344 null] +4566 0 obj << +/Length 613 +/Filter /FlateDecode +>> +stream +xÚ¥TßoÓ0~Ï_•G"žÛùÁÝÖ±M+Œ­< ™Æ¬aM<—Ñýõœc·êX%„P¤èÎw÷ÝÝwgÓ˜ÀGãR`ª¸(s,çmDâ;°¼‹hð 1Ç$Ît8‹NDS‚+RųoƒË¬¾AG§ãËÙä*Ic¨ÀIZ%:þP4Ÿ½÷ÇÓÉôÃ$¥hÂÕõéÙer;;&³d)Ç> endobj -4408 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> -/XObject << /Im1 4096 0 R >> +4567 0 obj << +/D [4565 0 R /XYZ 85.039 786.531 null] +>> endobj +4564 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4421 0 obj << -/Length 2777 +4570 0 obj << +/Length 2449 /Filter /FlateDecode >> stream -xÚ­ÙrÛ8òÝ_¡ÊK¨­Càõ”Šìx¶ìÌÆÞJmÍLÕ0$$qC‘Z’Šã¿ß¾@RÖᇙÊA Ñht7ú„ü™üYºžJgq¹¡ògùæ›­`å¾`,e1Á¹|¼x÷1Œf¾ç¦^:{\tRÏ ÓhöXüê\ýôá—Ç›Ïó…RʉÝù"ŽçúÓÜwî>ÜÞ3øîææ—ó…ïÜÀàóÃO·¿Ìüùâæq``¢¯ÿ¿‹_÷f°úó…çª4™=ÁØsý4m.t¨ÜP+™Wÿhñšžñ®cÒZŒ…Ÿºiž×H¹‘  `ÕwÓ0œj$ ÝHǤ‘ØÕ.H ÿ-ÂÐsçià”½h‰bçy®<§Ùµ<ÃÓ"Êw3õÚmO© -dP:ÏûˆC¼ûá‘Û |7ôñ~»„ãýØôµáñ›²Æ‘ï<̓ÄÉ:œ(§Ûå9òg:’m¹ƒ-Õßq-ñ±ÙÉ®²ª˜Rg ïÍx^£¸û‰çy³Ùîz ly{F§äÍ®F¢½å`%ês- ¯yŽïi{yûé±ël#7K†XñÐ.(má£E¤¤…‡lƒë_36_дßF÷0R |?ä}É 8×Î52Õâ¹oÚ9E ¿y¡‡k²¯'íÂàÍ¢¢à(ié°7¼¶PSöÌêk˜ý[Øê˜~F‹¼tÕlpm ’t­ŒAìzà(ã'd$ é*àó¥¤ý Šò„$“È <ÏãU§„’T 7‘ÒM^W‹2¦©S›žñwáÕ¿áÉï>jbv௮BÏ%>êå -þ2ÚžuªÀƒX°:¶{‡Dƒd¤w„˜¹*Ò–Ø:k xgäyÎæ‰bK¶»5™DUðôëæˆ$U³ZY(EwO%˜ªð"W+½gEÿ4í@í îy¼¦;TW˜Ž~` -2‘ƒû†¿ßÆ7ÀŒ?Û¬ëØ{ИÛÐ0æ>»1RÀcÊŽ'ˬÄ+¬Ã°E†‰ÓîÄ:åĪ섽¾Ìç Æ7R~ßÉ×eÁGgܘÀÄ¡BÒ„øÑ>1ñ¦µ! ¶¼ïpïç ­Cç5úLl0e?:ë ‘§ž˜‰§™:çm™øJŽCNžçè$ »GÂ|¯o`iç\]^Ñ÷Ï™ôû9R`fñùü:Á9™M"4Ü4œf“ðx6)ÉV _I ™cóÃœ“³ËÖý)~½Ä^ãwÄ9™AB°þ$ †¸„z/€‚j Nå£=!¸›½b‰öˆeà ÆC)šUYO¡ÚùBá -Á/ƒ5â4í9ž8Ðß«!”‘Ž‡eÞ@F“W [IJÄQ]Úþñ(@žª!SJGÞ+x”zƒ‚:»12LºAÄšÝ f'fÛ<¹|æëfHfñaͶ/›ZÖÅË`9Ç“×ì;M'{FqÚF¸É(s­…Ó2ψJxÜêBº©µº ÎI/ ¨BõÔI"q’û¦9Áï<ËÀ€rÒê5”ª*åšoH#: -²óáŽzRèCågõÊ ª bSÖ倇¶‘aÍ@‹˜¼3.­žp+Õ…lš•ÉÆ#à|Ôz.öDxKª)ĽpÇõ¯P(ä½Y%…›NCr.\Ï[“õB…J´ÈëjÍy`èÇâ,úsLãlw¤ù€!êX;Å‹_¿åŠYÇ¡TfÃ31S¬"˜­ûÅ­Š|. Œ*†äüjo¡Ü >ÞY,,­Å„Ø¡…Pvû©?œˆRrÚkÙ³Ñ{ü#H¡Ñ€°ÿ—ð)´^áJ±4Š÷øÜ|[x!ѦL*Q]öW0iigR…Þƒ2˜mÔ§bí¥ÿ)΄Ö+œÅ±Fj»>Ýa¾ÂïXh•è„±‚~™íÐëúŽÍöúþq;Óï¶6tâ%nìW•wTè<µ©Ò“2&ÒnA³‡ó›çkÀúAœHŸPQÄš-,§ÆÅ&Ã2 -‘¸‚ëNÅv œF*=Z'8Cl×ÐD“تÐœJp§âG§Ø×lÐñk®tnÚ¶Á>º=ç-•sÜLpNFz´S¸kî)QªI"eÍ´¸ri‡ ëIüfh²C\DÈ;þ¦2½°µ³È -Ü8ÝW4›¬6F*ªIy ˜€|U¿Ëzä3㎽áJÃxg…1­V퀉P«÷|¤GîÛlË9$Зñö9Y „Ûu~1 ‚·ïP_ží[q<ºŠ¨ ÐÈÐ8Þd5 rTe‰ ¢-o-ÜBu–$&K\ÈEš¬^~j›zE¥˜rn{†•²uK'cÓ"•V•µ5ô‡Ú(¥L³ìÉËxy˜ ½+)éà<¨§–½©>r_»ÜŠ^Ú,Ñ ºàM’—:Ý^=X`Õ{a^•“„XØo’…ía¨P¼]Am. gÀdËxƒInÙØ$j"t–Ã5G´“õ½^$(è—ðE‡½Dà|Ã1†¯ÑÎä ˆ^ˆ]-î,R -éÚÈË Oæ‡höÄ7­Y”u•Oõ†!ø<ùÀÃ/tg\‰ð}‘q oèðtm‹ }æÑ°¢Ä¹µ]¶†úº¥®5>”ii_µo-·eªpp>HBl$¦—v&rðt òŒß`ÀŽ©©Õlk>(8¨ËÅ¢nÛæ+Ýèƶ* ÆãÚØS¡f<¼å®©vÒHà zQYKÇ¡ôUÏ<ëÊͶ2Ø»@݉…mÛ{ØC4ŠUxBŸÕ…õ'&Ì;¿BàÝ÷ž³l@N"z¡â°$õ·!¸Â*½aÖ9 -ÑPªígyAhäÍi‰hy³1¬±ã )Ð1Teç[Ÿ ÎÉÖ'Wcvô_ZŸ+zöˆ"çž<[ž›? áà.ËÇÂù¥d -PH*ø^cž¡4qBæଠÊÉÄê'‰ëÇüCÂ`eÖ>`0ö¤­7ŒéIÁòÔõ ¬M · ÏÒˆ1¸„)ð‰/œG”Q'b4m¹"ê`Å´ßæTDØp˜6'ÌØs)“ŸŽ€hßPJ%@6MÉÐÉÅ6²ìBkõÂh¼¢ ß®g«Š~êŽc1 X»7ö‡X­‡­ùxƒa“$zÐÚÑcr,ý´Œ²5 ²uáV®DìÐï‚‹iº¯$u.o>"â§Ï7<—ܾ¯'©µ±%‘,©':±€[;^ÈøC7ÆœÚ~ 6ò>1Vä­ì^ã¡3ûufošª»Þ2ø½œ<à –#ÁNH¿ûùäò®·ØÄh\í“ß~÷G3Pèç_è8=BÙ2ŽGëcµ°F»úêdzòŸnî3#5°§I+1‘±ˆ•Þ÷÷iãnçÊØy(Œ€Ýh!a×ÖÄÞ§±ö½²†¶:‡?÷¸ß2°Bz—UUŽµô*l¯Ûý(h…± žõE©!õXÀY¹³ \eÊ+£JÛ 6ÀÔ­î,JWHË5Èmr§²ôfØxyÁýÿ{~d2PBG1«òš–Òh9MÖcy÷ÉxbdèA%ô¶h?\¾áF0#ˆd\©H±´,¾úÒ€àb[õ´E‰¯¾õ»¶u‰3~ï&H±¹,@gXˆ4IQdÙŽ€á’%“bÖ®9Á(Œ/l_DPL@›‘Y¥—¯2 Œ%ÖɃ[U™€Wíìš,—`ËŠ%0EÝ$«k@ýó¦RqKãôÄ¿dš&l$BzVù=êS%ؘg 7ž±p*vûMf»%œX@¦Ye®’T»5ó¢;Ðtgyé‰çà˜ÈP ƒ¹¬G ÞŒä"søLf5þ[’µ¸²!,—ëMS3\çŒnîÝ"ô3W)hÃëG":–ÞÛýë8Ò^¹àø¨¡3š¿Ê[• ·¬á!»Žf™qMZ®“¼àÛ:/¨ìé{Ý_VÆZ`´£µò"oXÈF=!m„Z¡ÏÓË[g‡"€éÏ–zoή/–QFD¾v3ü4°„¡ +]ÿíåÙ¿¯YfÏDœ§C ̈ {ZîtÙ›ÆJ¡Määf›Î+´6^ÂmÛºu#¬=.Ùä(€Å¤ær•/–c{«7%Ë'³™+ðgí‚b¶/KGˆ…ß¡_(_¹#çá›ýâsQo7Ïq+˜Vš~ÐÎìiõ´iò²8mÅùe–>PJXsCƒO\Ÿañ|2ehM@“Ñ<£±8à:îæÔà)û—N®ã@B ¸i÷¾óv0ÂUD‘FB@8Fƒ¨} ²¯Ð ŠÔÝsÌúžèvÊ©hŽð!óR/Ó!̪çøˆ!„ø¬õê– ´O ›qÀ“+—,‡ÊÂյ跚v’/N¸Øüœy LY½¤³–á±ÆÝwÝ<€°—®À„Ža‘F@1;œ )Y UŽ€„‹8¡ø s`1r¬`K9?ðú÷[êwŠº MÓäsfU8ÈñÔë6$»ÐXwŽ“‡!2a\JœD¹Á©(5(wÅù»‡-vÐ’"Š¼_ú/>îu­*ÝN’-«ÅæÌÓSŽ@'ÝìK·‡à»Ü&pnsS6Ù‹£>…iÌ÷¾À@8;|P¤Pëì’H© ÆÆÙ:/òN “ ¦Î{!€ÞGJÌxæº9WY²[Bóµ1ux"¹9Ñcç_8ââœ{ö®xîbbËoEПVYÒ¸Yøy +êŠoùC¤3_è@1À`É}VÑÀ/¤ÍŒI""ŒBÿ‰¥Û[Þ¢B÷pŒæ:Ùšk¿Ð¹Mwi¦=P7“¤ç¯ >$NÀ1˜ðõÈ®…»ëP\w=»_-†rðÄý²-ðL­ÚÌÿv Â×4ØÎ6~ ùÆ'âÂX_=£‘üø»}V³ds`SFúûWoÒWmCI0I.¸šeó„nO”7S÷ÜÀ‘ö¤vÏø{‡`Rþ‰sÍ2Ù°?Ò›b5w÷ðü‡þ|ö2³;Àw/Ží•3mžº¡X(=‚l5 ÑfG"­ÛÓ_ûÍ êÞÍ+,‘9¸K°ÌÞ»àÿ×UŒendstream endobj -4420 0 obj << +4569 0 obj << /Type /Page -/Contents 4421 0 R -/Resources 4419 0 R +/Contents 4570 0 R +/Resources 4568 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4426 0 R +/Parent 4539 0 R >> endobj -4422 0 obj << -/D [4420 0 R /XYZ 85.039 786.531 null] +4571 0 obj << +/D [4569 0 R /XYZ 85.039 786.531 null] >> endobj -402 0 obj << -/D [4420 0 R /XYZ 85.039 766.606 null] +414 0 obj << +/D [4569 0 R /XYZ 85.039 766.606 null] >> endobj -4418 0 obj << -/D [4420 0 R /XYZ 85.039 746.277 null] +4572 0 obj << +/D [4569 0 R /XYZ 85.039 748.602 null] >> endobj -406 0 obj << -/D [4420 0 R /XYZ 85.039 636.371 null] +418 0 obj << +/D [4569 0 R /XYZ 85.039 565.636 null] >> endobj -4417 0 obj << -/D [4420 0 R /XYZ 85.039 601.625 null] +4563 0 obj << +/D [4569 0 R /XYZ 85.039 530.891 null] >> endobj -410 0 obj << -/D [4420 0 R /XYZ 85.039 545.916 null] +422 0 obj << +/D [4569 0 R /XYZ 85.039 296.962 null] >> endobj -4423 0 obj << -/D [4420 0 R /XYZ 85.039 513.495 null] +4562 0 obj << +/D [4569 0 R /XYZ 85.039 264.744 null] >> endobj -414 0 obj << -/D [4420 0 R /XYZ 85.039 413.639 null] +426 0 obj << +/D [4569 0 R /XYZ 85.039 209.035 null] >> endobj -4424 0 obj << -/D [4420 0 R /XYZ 85.039 373.476 null] +4573 0 obj << +/D [4569 0 R /XYZ 85.039 176.614 null] >> endobj -418 0 obj << -/D [4420 0 R /XYZ 85.039 247.696 null] +4568 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -4425 0 obj << -/D [4420 0 R /XYZ 85.039 215.275 null] +4576 0 obj << +/Length 2455 +/Filter /FlateDecode +>> +stream +xÚ¥koÛFò»…ûBÃåòY wpb§UQ§¹ÚEhú)‰>rÕÀýø›×’”ŦÀ hwgggç=³´Zxð§Ièz:]ÄIä†Z-6õ•·ØÁÎ÷WJ0¼EàzQˆ[o®^½ £…òÜÔK[ByÈsÞþpýááö—åJkíÄîrljsóóR9w×ë÷ ¾»½ƒõ›åJ9·0ùåþ‡õ‡åï?^Ý>L.[ni¼íËÕo¿{‹úñÊsuš,N0÷\•¦‹ú*µZÖÕÕýÕ?*¼,øÔŒL+‹±R©›úá¼Ü+”3LÉ}®¢©ä±‚¸a:÷ûl©=§+›Eί}Ñá,vÖ7<Þe‡C ²7»ž0xN:1K­œR(Š†wï³ú1ãéM[gtR5UNÑõ3:ôÝ8IÿD(ºJùƒP*œ1'\¼ô/M9uvèyöëûõ¿xvì‰ëx¢½ÀÉš'¾³ëÚ#€í™O^è•9ÈMùÉSlÒaÁÄ'¹`}#Ç„œv¾t‚*$¥hZ?’Rrøi—~ìœúsî&´@KdS4|JRNøÔ:`>aýg¬¢«)²Šø÷ÏøR8B„ÎÃÞžB.µÆEvÀËFó<ëçyÛŒ «¼Ó09à‚/™XËOC7Ub²2+1Ò™Iuàª(¤þøØ?õ†x«™z»åq0¹Kš˜çzq¾»^Ê +[£÷dpÐw¼¾³Éh]ô¼, #•²SlAˆcÅ[h¼J—uBËœ« ³ª Ði€39Àø hY—'Æ%D‘²Q ;Qbäºþ%nkSŸNtøÚMS_”Údu±b,=5ÏÊ¢M}îï3ä7HÂÁŒ36TÏ¡ 03jƒ³L(zÆqðÛMV1¨mxÌ*ÔÙ£dOç ’}6MØg™è<³îgP3¤Y\4…DÃ$,ðnÑ)LäÓÀncxUYÇ;§}!8ý>ëؘ¼Æ@«óÿùÊõASݵÈÕ×ÁÎ I´\ žCË·ëw÷<Ë0ž$nß¿»wm˜8ôÃ2`”£ V³/fŒ#Jc±ÁO7K?t®?Ì%¤W/ +¯ÊÁsW!àrxÒ´?n·å3fNS×í/™+-óÝÌM+•ø®°@É_ÞGó×<´Ç×kDx™o^9ÍS†³¶ÛÍpµ‚$'t‹R—ôyg©IŸeÄëÓ}ýènÚf;Cšjª¥ Äyÿ› ”§][ÎÙ™³šPÈ­[{=å4r÷½Ý+Ñé¡ÎV’G½ÈÅ4Š~QSR¦?÷G¶ß ù¢çà~kxÎòî$Ó­4êBÐúÇ&ÅÔö‰7²ji³4 ¬çuÆc U•å5HBÓ¼™QS mÓ`_ªÔS¾êì³D)®ˆ»¢3CæE~Z>!î-À½-€Š",Á#4fG9¢S_ÇnÚœ&‡²7]fʯÃŬ×}* m'© dwj%Ø'Š9ó`õ/ †ÂYlºÂô®Ég´En4xñ±'VwßÍ…v¢(’h:‚º¶5>¡ýÀPA®O9ë~uâ ³"%¬h…™éúâÈM¸wžëû”ÿ¯šÙHšÙ·m]/¥‚@¿yÛu-5·C·9w¸’§¾ÝYb á§>E.M@øÆöä¸~Ê bdXmrV꫼¨ +µïUgëè%·õÑ©S–[ MÆz'ŽcºgE© 8#6í‘«¨ ÌÞGn»ñ· w…“S"½£Æ›ÐhL\A” ®Žð#……ma2Ìsˆr ÚÉ…xRòpËV6œcÒ”öìôIé *©Š“‹Jêšx™žm0Ùâd×òÑ“mçÛfN‰³ÜRNÏÕvÌ4O3Íu9¨‘9gÓšÑR¡³oYjZ´[S4<í-ùÇ~c™*§ ÚR|$"ÿÄ#VŸ›ô}¸5v}ûcUÒïPR%n0Ó£cØ‚@ºŸÒ5ͪ#½rÞ̶†}*ñ#™±[¾WZ¥K%eÆÄÛÐc%”§M ~/sÞšq]O]7Eyˆ f6²6œ/í(w4Ö. 9v;À°·£'uÐ×Jeiz]ä Þ»»çñ#ñ!¯„=Hƒh"ÇÉõ™ÜV¢\ÐçM©!€¶Û }dQ¾ ö˜{Ø!î±1'Ö+º¸fPSLKƒï‰–·»¢d ü8©›ÙцzÁ¸˜wèìÞÞGŒ§ÁÂ#’&ÃuíãнÖ"ÌìÜ]Á­yäômu4¥Í°àÞ;Â8°´h't¾Ké0vú²>Tãrá”SIí/r¤Qt t“Ï…ˆß{á$øˆEàGòªœ·z¾pp•ñ™ÕvŸ%”.RÞ–²ÙFzœ!ƒbÝ52ÊÛ·Èú§±K9ž´øÝF^™îL©K7âb6S‡üÐÕÐrM+rSdðY¥SŽÂru÷mÖ4ÔpA"¼Îsûµf#Êkútž«œÏ  &âìãÌ7Š#¼Ãýíâˆ1w $á=va‰4EÝÇXAà~0+©˜p¹nÒEÌ9Èé”\’ðÛ®ÜyrFäR2q~þDdØóÒxy+•åË4NúC¤“Ûô‰gEJ~õð¦,!uVOË$Àgi/tá9üî\ð² Øx0ùwkºIdo"`¹åqÍ[üìKù-A“^ú}^=ÓÇeLãóÑ ákRϳ”®•8Š‚è$ׂ‰´´y¡q؇ÂQñLBóÀÚâΖßIH2=ÏDì åÁ‰–UCçDæxâcø£´1ËŒs}eª³¢6'X¿äÿóšWŸ›!ÕLÒ@Þr–lÀ/ù€†ue?ùfS†>RÀÛ)Ð'¢ Ó/f^Tì@qÊüMý`4¯èÂØöª8qÈeâX\öÞæÍúç{Þm†£›Ñ‚a—$jEŽ½ák™>ßÐ/IÁ¸œ_àÄÞ–w"¶áT84Šæ2Ƹ/¦v(9ûšÅ]'¶3IzÖJ3„TŠ¾ƒÇاjAn†F9Œ6tØ0¿ì°oÇéÍéKâAø„­^®Ìò¯¥í®Kœ¸ky¾7 uÖÌùãø€„JRÉ{oF{òy(?û¾*wòñÛ^ëyãÀ=ŸxŒ‡¦8.-©d®„©±Q4_ÃD¨ÿï¿ oÌñ•üÍÒ“„ÏYoÊàám¾endstream +endobj +4575 0 obj << +/Type /Page +/Contents 4576 0 R +/Resources 4574 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4581 0 R >> endobj -4419 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> +4577 0 obj << +/D [4575 0 R /XYZ 85.039 786.531 null] +>> endobj +430 0 obj << +/D [4575 0 R /XYZ 85.039 766.606 null] +>> endobj +4578 0 obj << +/D [4575 0 R /XYZ 85.039 742.055 null] +>> endobj +434 0 obj << +/D [4575 0 R /XYZ 85.039 440.883 null] +>> endobj +4579 0 obj << +/D [4575 0 R /XYZ 85.039 398.598 null] +>> endobj +438 0 obj << +/D [4575 0 R /XYZ 85.039 272.818 null] +>> endobj +4580 0 obj << +/D [4575 0 R /XYZ 85.039 240.397 null] +>> endobj +4574 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F59 3455 0 R /F38 3057 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4429 0 obj << -/Length 1792 +4584 0 obj << +/Length 2140 /Filter /FlateDecode >> stream -xÚ­XYoÛF~ׯÐ[V@µ!¹\y);i\À‰;HŠ4@iŠ¶ØP¤KRqüï;×’”,;@[÷˜ùæ\ûsþùóÄjϤó8‰´5þ<ß̼ù ìü2ó…b)$Ë ÍËËÙó×6šûžN½t~y=ðI=mÓh~¹ú¬Žß_¾z¿XcT¬Ë8NÔÉ»…¯ÎŽNßòòÙ«3˜¿\,}õ -ï/Þœž/¾\þ:{u90Ñ7¯ÿ{öù‹7_¨¿ÎuH[G±ôSöiD¢HG^4 À®¯Sk§ˆX«£0&Dbm5hÖzêhµ*ë"ŠÕY–ÃÎ(aP¼Ü7ü=i6YYã8R¯ÆSYYY÷V „ ÌÓÂ4$¼o˜3ðµõ ÿçÑ -n‰á—„U†£>ÒÚªY‰ºëx+ð¼ï¼Û´üýtÎßs m›ë¢C]»²Á³YÅ{\$€Ñš˜Ìa0ª_ËÂÚ,‚X]ሑóÉ1O`Ü0;Æ-P×€YÇ|îÎýš2ðYúhý”Þ$!É™ÝàÅdõ?ÁÐÔåZÖ6(q ;Ãy‰Ê›-hÅuÓóàj±J9—­V…d½c‡ÊN&%‹ ÷Ñ-´ÂÀfr mödüiÚ¯¼qK#R‘lÀCcÕyUd¤^q@ý¾½çÍnB¨*ëY`…<ÂP}\ãU÷??s,‚X{[Èâ÷EöߢΑêÖ$A+6rAÈ}å¥#‘ É¨-pÆoVËw52tV@kw$Q]îx”·=KRÖü½'¶­ÈGÈàҕΛúšWÿðüpÀ U¬:•=ðÆvO004X+HóƒØZ xFª!w1¢-9³Â7»eÃÑoIÐãò5ºvËcQ xáÝs¾­ˆáuÓ’±-K;îá‚;ëL.F/MTQÔ<]9K5yíäv:}WVꂨEGˆÝ‡Îµ*®¶’G¼P•hùgO@]º½ÍzN䬡:Ež8Ï'N:vŸã܃ª!¶Œö $²Š—È‘=3wCÑÄ—n¼f"T·rÜÇ©˜oÅ[¾‡ê¥—u·Pá aÒAê¿Ð†Sa@Ä)_ͪã;…†6 B1Sðï8dé>Xé -Ùº[—p¼¿‡1Å6{]ˆižó¼>Õçdu΋HzUÉ%y¶í8gò-eWhåUñâ‘:e£T‡ñÓujBCu*ô'uÊ÷|BrD(˜-Þ¿Ï÷"ØäÉ ̓w*£ï²ñΗÎ]Þ–­=O1pFz L¬9çk_m³ª’l[|/;ª0FJ'|Ù3Êj%<³Ü2ÖòšÑ È+g ñ ñ!¤¼¥!AƼuŒÀÅJ‰u‰dôB€š¾d‚Å®_7-å!‹§à'ïËo=:Z@»“£¯½`6;BϘ1pC.¯Ëï(ÈÜSº vˆÙW‰ä YXÊy²ÐKՀ¾.jµH cîjd±¥nÁÆ!í2W5äŠÑ˜¸tGWÅ“±ðÉ– ÇXYŠ6;¥tû‡·§ŸÄYî;®¦›©;@ã@‚öû.„дFþ܉N‚èÇ}°Ñ ÝÁ.xéx-'̺zAÇ툨tÕ«‚E¾N¢ðÿLxý@°(Ñq¼+Øã‹ŒëxÆÀ^9„ÇHbõc‰ òJ V|214O$&!úabzâÂ11íÝx81MnÓæˆ2öÃÄâ’ÓNVawwÙÄU—iíqn-©]{#g€.…fÒZáôyÑásJLü:¸ãìóo3´aG2$óàm©džã±5‘´dðæT…ñ–×ÙFv©ŒÂJÆînøcL0‚è§ìO0Á9€iˆ|fÉOì µd–všYJ(­Ë0ÔÝ…ã#Á„/ÃãŸxg‹:”UIïƒ{# -v‡FЀRŽ b«ú·ß½7Ò®Ë!¯’‹Ô<ˆs¯KßH×mÛQFNÝrdzb車1ŒÆ¾ȳ–»§¥oá} °ÿˆA3aGDì¹ðåZù\*­Ž.ÄS—‡­-=¶—=ŽÛšT¾(R¥àx)=¢­jÔ>‚kª}ßQ6"VÇïØBf^Nrî,‚¡‡‡1jJE‹Ÿæ¢X=8‘MtäGÓÇÉãoÒ -¸Ľf$q u²6Ëû¢•x®‡wÉäÍo¬æ’‚«Q¬·Y^ÈùCM -Û\ºyÚXšƒíüg7øO/’}˜è4 g^ ©(ŠC' ‚˜xû[“h›˜ÿέ˜endstream +xÚÍX[oÛF~÷¯ö¥MæÂkb‘8ÉÖÜzkiÑXš¢%n(Réªþ÷{nCR2]»/ >pæÌí\¿sfÌBÃgi¤´ËI«È™E±»Ð‹ ŒüãÂÈ ½•Ž#z{wñúC/ŒV™Îw4ånýKpùí››»÷?,Wι QËU’¤Á»ï—&¸~sõ“¯ß_Cÿíre‚÷ÐøáöÛ«›åow/ÞßM[…*ŒžöûÅ/¿éÅúx¡•ËÒÅÚZ™,[ì.ÂÈ©(tÒ¯/n/þ9ìÂcá‚WÍÈ´ò3V&S™æå^¡œQ6Hnl€M%OT¬@ 2G‘Þ¬×U³ã$¸Î Ù¢À4š’É}Ëÿwí.¯lÇÁ‡¥ÓA^Õ0­›Ñ‰UΆ/0éŒJíÀ£‰f¬ó«q!0›3oaäøË‚ODÑviÓàˆ¼v¢ÖØKƒ¦í¹q¿@æ䨫u)sò~rJÕI§Ú•tö/²ÖOÈ倲gíá3÷°âÐÞ#$Îü*´  ºÌI²rFòþðÄ!–oXsÎuÞÓh+õl†Á§-øô÷¿ù=l¢4Dîñó2uAû‹#PâZ ÷5wYU%ý>3IôŠËá´’‰(-þóOÜH'žiâH…à¶ìŸ9øæ*²ZeKæÀNWª}Ï‹OÜÚèT¥&“Å$0pô„²Û^ã¦k\ª´eI·»WEÛ<Ììf*Ž<_¿j–@CdYpõ0QÀK2ƒï¼"Cp#b$l®ˆvÝ[æ­‹Ä«°mã÷‹¦Zeó0È÷ì${<¸"3#ùÂSEáû[ü;>8ïa"zU¤c&¤(„iæÈÛ\N” žÞk]¢r/ òÿ +G²áxZy$H«g|¶)1ˆ!Øò™€ªúNÐg§'¢ê# +‘&ÁUS†¸˜YJŒœyœÕFE™÷€ºÝ°“Õåe=ãQ¢¬³S§›ŸzbpöeÞeÌsïÕ"GKÆTkô+ït¥#ꢞ},ÔÊÆñ)$´Œ‡òß-C‚\Ö¹ ÖîÈ +´¢b„¸DÊàÙ2òÙ/–•Èr»é¸ãaȌ㶢•[#‚@`<óV¸©d‹tʪ&.6j™nÈ¡×qƒûZÎ)òÇ®ô wlŠú‘àùë™j" ¥Î\5±r1z†O¢¡™K¢Ú$çÛˆAPë¹Mqhºçlb¾óJFž·ŽO;ƒ|”‘æ ¤¢ <æu-Ø_þYu˜çHåþÓ¼ÊqÜYN¹÷Efm©G+SÖ^¥Ï]gO(²~¡E…n=…%Á˜È?5ðe{ °Šp¦›¾úƒ‚€©è½ÙÑoLðõLT¥ˆÙ±¨ôC…U‹AAŸv”aŸ% œÕA÷èñ:ÇÁÕ^tx”‡F³„Ô‹:^b~Lõ„ÇØ¢äÎmRÃĆ‹•ºæÖ€îÐf·¤>“Me±1¦QüãwW?MôüÔõåŽÀ. ±(Í9hŒWÜb±UL.Ý7×Þ‰FïhpF¯ÎÝd·XʼnJÂøÿ4vNJ¹ÑMg|ßÇωã©­`óÆ…ö_Yá\‡jõl²°NYãDŒ×e_¼Þç]w\ϸvlU–ùÄ2I+77k씵_PP‹ú«ÝXøÙlR’pKÛ,ž³’›|'­Šn6ÔÌymMq·Á»vYÉØêž:o\3yêñ˜ÿˆØðe“E»Å’ÆGÊp’·ž3=§´]ù‡"ËcVHl§ +±pËôƒ¤ƒêÅ¢u&ÃÇJ[¯:*øሤ\Ë„s8ßA<0á$šª6! Ž7 q!`âü:ªZO5Á„¡£‹Ê°)²þÄÉ–elª¬5³Õæ”Hòf t>t;Ù–È_‰|™€ÜÔc>8ѯI`´WÛŠuxAÁ˜Â—P¾–èZ/9%SŒPò9^ ø$…¦·è´G¡4l}–Ü×-¬'kc•B,N*ùb,= pÐ&ùB¬<ÈÉ”n%}àyfª‘û&ö÷yqZÖœ!:G•hri§•N“gJ`£bý·w®D¥Îë}ÝŽ}<6r]Ž1 –t'±±P鳎Û åù(¶µx>&‰ »ôz Èä %É8¼&˜Êïs._ygÏTxV*W½@Tçôìf‡Ä¶‘g’;qÚ9y\I&^(°÷¿üNñ´d&òVv}öX‚ÄsÉ›5¯:™xz®Úç±¹Ðvb­I¬_®Lh•3É ïS6R.‰¿èÍÉ#Ú?Š]æÍWROÅIð‘D¡§%&äüûD¤5. ŽÓ­ÖŽ[ô¸„ã—^„¹g´P™0üë’ãù횃•¼ÅÊ16CÜþý±"ü–¡[yïÄvWmbtCyJ—uUŽž`‚áz³.e5>ž¾nÿ‚‡4ÊÃrÒýŽ”\`¸Úï ; ¬¥.ç9¬LlÁµšq§´ÜoË~Xàþk_€(XÏpB÷3•}SnÚY\±€ª>µ~ÃÎ÷´<»ùO®¥â¯E»£È ï® +¸]NÒ<"ºòïÜv8I\d¸¿øæ}PsO°qUé N.ºúß­!ŠžWãf/{bŸ³(sNêéÿ6ç¶òendstream endobj -4428 0 obj << +4583 0 obj << /Type /Page -/Contents 4429 0 R -/Resources 4427 0 R +/Contents 4584 0 R +/Resources 4582 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4426 0 R +/Parent 4581 0 R >> endobj -4430 0 obj << -/D [4428 0 R /XYZ 85.039 786.531 null] +4585 0 obj << +/D [4583 0 R /XYZ 85.039 786.531 null] >> endobj -422 0 obj << -/D [4428 0 R /XYZ 85.039 766.606 null] +442 0 obj << +/D [4583 0 R /XYZ 85.039 766.606 null] >> endobj -4431 0 obj << -/D [4428 0 R /XYZ 85.039 746.277 null] +4586 0 obj << +/D [4583 0 R /XYZ 85.039 746.277 null] >> endobj -4427 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F62 4047 0 R >> +446 0 obj << +/D [4583 0 R /XYZ 85.039 359.41 null] +>> endobj +4587 0 obj << +/D [4583 0 R /XYZ 85.039 326.988 null] +>> endobj +4582 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F41 3054 0 R /F59 3455 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4434 0 obj << -/Length 2602 +4590 0 obj << +/Length 2511 /Filter /FlateDecode >> stream -xÚ}YKsÛ6¾çWèHÍD,_à£7§MÚôÎÔîôÐö‹”Ć•¤âúßw_A‰òø X,ûøv±7ü…›\ùA\l²<õUnöí»`s„•ŸÞ…B‘¨ØWIã•ÅYÝ¥‘$Ù*œ±Ë¢ÄOòi><½ûîSl¢ÀOÓxót0‚¤ H囧òO/÷·;¥ïqÒ]¹{hú®Úîâ4õá7ô†oÕ0nÿ~úåÝÇ'{Ø›·ÄqhHœPmÂÀ/‚Â'V¾R‰ó8mCÏHC"‰ -oDYªáÛ6Ê=ˆ&õ0ÔH\Vçí)º’WB¯ÃÒä^àßûV=è™YõMcy÷²>æ3ºjBÚ—m”y=nø -ºË`á O:™#_y§+Ý—_ŸP‡ š]ˆ¦,讥ȇ¡×Ò[dý wÈø–q¡2˜äpÁ;î‘•T÷´ýPñ¨©¿’‚øëÇýðõ8ô ?óìÈf…‰oBË_¤a¸OgÞgW(M -zå:]3#ŸðEÿ>;¢°Æ£¥…ñVQ£Òƒ‚¹Óο‚09^£Ò×Qó0®a¬B4ÿ´f¾«[<äÒò<<0ÞCÜQC=É•èÐ…ðÜÍAÖ Â] é+ëZf]ˇn„M©'‘pM륜U70-;žÙWt4TºD‰´D{š®³gKŒFÞçu'ä!=IÜr1fßòïÄ´ÊR?†#ߊi‡Æ@L˜ÀLêÄ´JR¿È ˜A&)¼OÛ8ð*=]ëA€4ìáiæ}¨º --O.~u ç7%œi - -?Èï¢N¬Ò[ÔÁɽÆèPÊÄ)ÏêÑݲ§ "QÏv§1Ó(p v‡½qp—AWU¥ 1œjŽw=™P@M‚Þ@2¶¢4Šl\äªÛscdZ‹Á}OQtF#žÿ!t…Œ8zªI?,2pÙÖCDºÝ{%1ÀòhXד¬N'œØQªèl-»…ëeb1~dñ4E9“Œ«aÐV¯LbÄ>pX¹»X"‹Q¨m _áÌ5Áe´€®oD™Ìàó8’PKñz8ªÉÉc²kUò¸ÞŠïÇ„žð³ŽÊÄàÐËÀ^F[œ%c"À:š©aU¿Ç™Âë¯Yœ‘‡Á¯Áˆ`}Þn¬'^jµÁ~¼ZJnÅÆ°ÙÆÞÀ:Ç„MH’Æ'È.JH °°ðÁÿx‰ .À1¼*,ɾ!ìdÕíì¾ßc*ïäõ/®• GžëAŒÔ€(eB†FÔqâä -S=ÂtiØ‘b^˜ìA[ÃíC5T±0r8SµBB9â}²ÈûÒï¸ö*ä$âD4˜ÀÁ%ÂGsÉ‘ç ØãP0Áž5ç]b¨e Y8÷„ï¦:ÖDßP"«g7ĉWÙ´•šàÌÁ9àE ¼™œ³µ|hÎjkUm¶±Ë•û$•ÅuØÆaN”nÀk«ÒŸM +£ABÍe”Œ'eŘ9Aµ&H¿,TÈ¥dã½(„]¤'øÕ"O]Vºqè”Pàq "ºÍtšC;ðlÚž.ƹq!t4 To’¯ zV,¦Ûp©÷qÉ"LÄÃaKw§CÌ tš·s½›Î.†S*Æáu Síâ¿c¿Ë\ÀÝ:BÏ0TÇáÏXwÇFø*•j:*ò+‡&7ˆ½7¥ì+¾hTd*QCŒjüµ™›Î¦ši^Η^®PÖ‰+ EØ R|¡ñ`$­åðN·X‹Ù€˜ö+Ê!Œä*5§N+[ý€À²}3Ú- Y°£ëyÎâÑdsù‰‹sI_U?Âå0 Dãª/F{ï¼2Ðf*òŽ&‘“˜Ìû*aaä[Ý{o@Á+‡Ï¸c&ûj¥.æ•#àÃÄÃ;‘¼R„ÆÙEœ¾Y„:4wËd°¿¯2%er$eòºÓ_˜øxã¼²"ET(?Ëߖ¡¹[ -Già§YBRô,c$,Fb¤‡TSãë n "æ´Oì9aTOà4ið£9ÚBŒ ¨åðéd’p¾Òyá&oÇn—EÑÀÇáÓË(¸ßóÞ‰^õÂKyö4´ºôŸdëÕ•”UjrWñŠ3.PX8ƒ¹VÂä:ÕÝžq–ê^º)~ñs'g0Á'û\ÛUË:ÆÙ”{½¯ª^QØWžœË‚`Vlhž=âW#ŸÊy»»—glB{ÿTÒÝdV=¯ØŽtÛÛuÔÀÝ_[DÔû[y¢t¦ [ skäÏÓ²zã6÷b5bÚ±«ÜD¡±— µ™{ÛUà𤨠rþ׫ÚðÆ1sFm)l«Rv+§>µ^œOÝÞ¼ÉÕ¬¹…”:AÊßKÌSn‰¨2nšB4z2-MÌû*`íž· 3•ÔÚU!³šE#§“kÁ¯y)áãÜ6ædO/´{ÌÑ;B‚9TºÖ -ët[Q(ˆõE"ľ밨2E--V2™æx°…æœyác/YŠÈz;á@í®p›ÿI󨩯ýŒwË’9 ’bF™ìù÷Cû‚JÉb)ž`¶¬mÖ+ÿFȸ†M=Ml¢ìsCå& £@v¤xáT £ztØ%‹~ÇÎ)Ó3õÖA¥)¬°ªÇ#=;ÙK3œæ…  Ô#bH€‚ -zX¢Ø£<¬Ÿ#½ítáÇü>Ì‹E9ƒß˜z‘a§yz¨Ú~’-K÷|Ïq(XÚ1 šãÀCDp*çø[+YÿtÕµTNb›D:ª;Á‰ÎæŸGòŸ°9Ûn0y¤x³ëXñJÇ(ƒÂÊ>üÝ.þ[å/ä†.žÿË›&!÷½ç~…í¹rÀ½¼é­×—òáåï>{î?Â,éíëžì>À€aGo°ðúHÕ¾Êã7Îü*{X»endstream +xÚ•YK“㶾ﯘ#Uµ¢ ð!Ñ·Ùd×ÙT9ϤrˆsÀ”DE*$åÙù÷î@¢Öåš¡ÐÝèÇ× ŒzˆàO=ìÓ0Šó‡Ý> ÓX=çÑÃf~ú dE’Æaš$0^™ÜÚÙm¦Ã(Ù­­‰¶ñ>LÒ '?=øá‹ŽtfYüð| EÏåƒ}¸Ù¦i<¦-·¦Ù¨ k«Í6ÎvÁSÕÿCôÃæÏÿüðùyMJ…ÉN9)*}PQ˜G¹/åi¾, ka\“<&½*˜^fj\UV—ͧے÷¨ Ýè<yqwàïß»3N™zƒóDúHcßá>ŒæÞɲñ4éÒV#nyÛè]ÐáÚW°L®Uð|ªÞÚ¡r݈6A(ôENçULÌ÷yðsuF^/p„=aFÀƒñŠÃ5.ƺ“-çŽ%Dª]¿’m˜ð†ã®=¢jÝõÂw²ße­;§ +P¥ƒ¯–¹!›¼ó¯‚L6TV-¦b ~ä§jå€“Ç D"ðÓÀߢkTrÄõUÉÄ· #ì‘p®ÛúŒÛ¯g&  qžô­H'âP¢ªðfgâÉ›9ë8ÀÈ:U¢ /¬ø#óèc#?L#ûK"ŠZ,]æt§ÈY18–Å œÕ”´ò›¢ ' ij~‘èé±Ã¯ÕWë(ŽÐ&˜ŸXy¨£ýÜÖyÏR[%aœdóÔV˜ÜI|ÙÄQP™ñÚ³r˜Þæ#çù§ª­Ð{87~/Õã$¶þË©gjžêH( Ò`yöÌ0"ùË]\û‰C×óz»„ b836QЛª”Ÿe]Œf¬Ð*:ƒÄ¶¨òÎÓN¥“AUmJ‘>õùBŽ„YPä6* +¡‹ƒ›oQ*²‰äãµ7hÈvp÷6Û¥Áã á[çKK”¢QÁGø~sØ7\áFY3ž*–pê˜ ‰6L3Âm22i‰’@zZË8œ}Ë ¡¯×÷ýÓŸÈ0´'ߌ|ƒ ÚzF9ïüŠiÉŠ 1™’F„-"sURZ¸ÞHøÆ„)ðY‡@bpèdÐÛã4æG›Í;Ï£‡šŠôýˆ”<è–,.ÈÃâKoUp!î6Ö#OE°ÌÕ bÄ^xu±eO0EóŠ} ;8Kj³çF¦þ©Ã8ýÆ„{^Ø&‰LØ'|LË÷®XDñ¸X¼¬D#˜ÃHŒLë@Œ’§rá´Cƒ‰öÃHõ IT—KŸ+ÖÊ7f,ÛŸnMÑW‡ª¯ÚÂ&&ª–AFå éý/É „¸èI’¿‘GG™¢p™Æ4Ò;‹8Õp0+ýjØñjŠP4ᱦ- 'þ ¶bÈz1ú–Z< 79¤ƒ+_(ë^M*;ÚìÒ™J tN)ìç?’®hÓ@rÒ£õtÂÕ"öRÙ_íùW::èggW¿° Ò ó̺䑇‹$^k{Õ^…*Ußë{ÕŸ5¾ZßO¤S·¹cß]¹ ,äép·ÏïÝ ÓP©?ixŸÙ;ŠŽÊ3ŠùáKš{Ë“=)n›dC5ßݸ¹ðƒ<ž9Ìæq¸s8WRË$¤vg òÕò}›lGðÕs§i±ÉW9LÃû ¹ç$°P†o¨4åâ;C» +Ìñ}‡zù] ƒi«ª]6‹)î«b=݆zN0jYûÂåJÛƒáÕ‰ÚpÇœ¦\Ïœ9ä3Ç_=R +$t¦H„›ÁóEp‘P=W¦•á¸v{U$€U…Áì&(±Þp"VÈu¨Ö® %uæÅpÆÆÜnc•r:u6Eø +ÄÐ5óW™W.hA¤Ž¸Úñ>{2º²=tt³rÀ†“äb5¡+í5,“P¸âù7[MQa‚.øqv]°°®‚x©ÁOöB¬¨=õ “2ýÞÊÓ?ù,Ø2ë@ÐÜ]ïnôý7¶Ÿñ h¶eÙ,ìI¶ˆ TÒAÞ™ +{4´.Nû8“q¤ +—ZWsiºcÅW±eÛ(2 +¯^aÓQ1Ù{°" —Ò†@tì㵦ʽ¥eKè]K~÷ÁŠ +¬E µ—0¦7Ý‘b$]ºjÉUDÜ(4´=Qš,A +(SÇ•ÚŠQ °SÝú2uYŸúï$v¦–57ýxÊ/; s×. _l®‚Ú¤3H/Ì×gèˆJûŒc95É•QÄ°’%ið>M5ëf›P˜qÕL÷ìH.8[¿N÷5éSÑÑÔöáx°ß ¾Ü¿¹Îe¦¢lôÞQw»g–ö…l¥[ÄûxŒðoýë;Ž"lƒ¯#/ª {`pâÚñ›¥oœÌ»­üŽÊôï"²ã¯Ôû¤àÒ˜r†j†kψ™­¯Lœen:{,áaƒ9f‹ð½·º¤ÙSÏu éà•ƒ»iwûn¬ò\:ɯQÍEÜRÂOÅÛš®ÂÝ›è•æXßdh Íl-9#¨¸ó.â^"¥d¥^Éj䌯­saëN½VÆZs¦Ú¹ð|S(¥Z'‚’¥¶0RpЭÿÝZâG]âÝÖ—µ¶äÛä¤?z`~Á³¥^OFV„Øñ÷­{í§•0.ëß88µÜ•1å·ø4T`ÇF6P‚'ï«^º#¯ ¼J¥zN ¸ãdb|äiv~s¦Lß²©‡ï=Y㳫°WèclùøüË–ÂCžÊ¡U‘µgñÚ2賕èåÀ•¸³%îäE¢%–çhþ‘‰^èÈîúÀß5´gI·“ù?ºÍc.t£hGÿF.öŸ3~@þv¿•Ñ~pÅ+å'Ž]?Ùv¶g•–„ÂÛY–l`Àuëlé™øמ»9kôé?"Õ·qí¥uêdvƒZÞm´V!ô`üïÅûw›ýnÉ^Ç:Ôz7ÿ¿¤ýþ9pendstream endobj -4433 0 obj << +4589 0 obj << /Type /Page -/Contents 4434 0 R -/Resources 4432 0 R +/Contents 4590 0 R +/Resources 4588 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4426 0 R +/Parent 4581 0 R >> endobj -4435 0 obj << -/D [4433 0 R /XYZ 85.039 786.531 null] +4591 0 obj << +/D [4589 0 R /XYZ 85.039 786.531 null] >> endobj -426 0 obj << -/D [4433 0 R /XYZ 85.039 766.606 null] +450 0 obj << +/D [4589 0 R /XYZ 85.039 766.606 null] >> endobj -3053 0 obj << -/D [4433 0 R /XYZ 85.039 662.656 null] +3114 0 obj << +/D [4589 0 R /XYZ 85.039 662.656 null] >> endobj -430 0 obj << -/D [4433 0 R /XYZ 85.039 576.349 null] +454 0 obj << +/D [4589 0 R /XYZ 85.039 576.349 null] >> endobj -4436 0 obj << -/D [4433 0 R /XYZ 85.039 536.186 null] +4592 0 obj << +/D [4589 0 R /XYZ 85.039 536.186 null] >> endobj -434 0 obj << -/D [4433 0 R /XYZ 85.039 327.936 null] +458 0 obj << +/D [4589 0 R /XYZ 85.039 327.936 null] >> endobj -4437 0 obj << -/D [4433 0 R /XYZ 85.039 284.983 null] +4593 0 obj << +/D [4589 0 R /XYZ 85.039 284.983 null] >> endobj -4432 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +4588 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4440 0 obj << -/Length 2460 +4596 0 obj << +/Length 2595 /Filter /FlateDecode >> stream -xÚ­YKsÛF¾ëW°²°*„0x#U{P$ÙVÊV´7NÊñaD@$Ê ÀàaIÿ~û5(‚Ì![®213Ý=Ý=ýøf¤füS³8°/™Eqhžš­¶gÎl +ïÏ”P,„d1¢ùyyvþ.gʱ'™-Ÿz9‰cI8[¦_¬ËwËëûùÂó<+¶ç‹(Š­‡¹²–óس.n¯½½æõ‡kX¸Ÿ+¥¬ß®ïæ_—¿œ]/{%Fj*ÏCþ:ûòÕ™¥ î/gŽí%ñì¾[%Él{æžøžŒ‹³‡³ÿô²xÍŸ1×”ÅÛA욬‚ “ƒÀýˆL^nj0£êÖ°*ˆ¬v“áGlu0ÝÌÊ’qõÄwóØ·.>ñäŸNàÝ]Ôëµ~,„ú'@V9wc«ÍWºÍ«’|ªæ 7²Ò®˜“pØÄ(æÓ%L¦ü] šç¼]ÍGtÄ]ÛͼW­Ô[ùb…ëï°–¯Xy8pÑB¡2¹yÆ•d©Yý#°'žE f–íbemuÎfhä)œuÅQð––ù Óv YTó(Õ­~„eÍz‰™Ä,ÚÃ7­U(¥^Ã4ùdèÎÃ6s7{•Ãyê½òDÍ.ÍS³ƒgí¡tYµ@²éõMÔà>—Õÿ¡«¬Ïû()qÁAàÒµHyæ‘3cÿåxddDA®Ê„¨­ø—–tQÈ,yºaÖÞ#ð­ð÷*‹•4#ÑuÙ ˆÝ…–Pê7Òí„GŒ -¾‚äÖ[”ÿ¨qxl[XzsH;NS àG[+]ðø¿·7¿ŸäØB¦Ù땸ÛlËãnhâéª:åÙ”¬Ðº%ÏI·vuÞ³¥¬gUMÈâó¬¥#9o6Vx¼Ï¦˜Ž ¡3`˜›øÛn‚µðXqI|®LF»²÷v}ì7¨2ýé(ÇԔ]@5ZÛ7â`ìFÃÒïÇ+$º¸ãÍõ -‡ßx-+Ó=‘>ŸŸ™ðÇÈ L-›Ê ]ϵ>óù`ç<çq8Up®5/oÞ=œc›øô3NøÇÂiŸæt,g?µ!Öûº!„¥}¤­„alG^p²ûh¨¸°êÛžŽZAè%6´49¶=È"p€uý¢·;©Î^Y—U‰Ç¶îjÈ)\S¦4ó"è`§ëIŽ¶¨Ðqm'J¤E¡.ø®*Š>J©Ö¬y<ø‚çJÙ¸ë¬áu]‹„4kŒk®N0IÕÉ•êÕ¹áiòAh¾Ê[ŽQ¨‰à-ßw¬›VØi3Ÿ‘Ó¢i§›×ýÝt ¾^Í?T¹¨àoCÅaúR‹€8ZÕ™¦¬GöïFC U‰cÚB“ê2ÅZÍJbÞw«ŒWÛAq`Þ¢£;*éÒ q³ -b#{ÙÛ%/ù÷DÜ÷¾ËŒ˜¹™ õ7Þ=íA¾.©¨O‡X)[ùÞÉÑôÁ¯ì=×YàvFCô+Ka -ŽuŸ=euV®$®¨Gci±VÝ6+[Ó’`ífVSU¶8©ê@s4P>t}F©œŽØ‘’ ?Tø«ùâ"]TeñÊCé8À–Vï÷²ÐV… Ž¤×¿1º…0ÿƒ/N®´l£WŒTÉ1œË–+àA¶ìÓm”˜àâpÌpðaL“WI×tոثªD]‡ÚH‘RÒ¾žsÄøÅÝL–ó¡¼]£iº-q¹= møúmë!:eÐJfwÆ(¢1¤mÚªÆÚ‚“yyhxqDŠB©!Á-%á¸P9µç$®µT1É †ÃïTºq·¡Å†÷Ñõ°gEÙÇõØ{ôP!‚©1Œ úV‡Û‘×J”£¿¡˜ºåÛº­˜ -9ªí10žbp öç} æÈ‘ÊÁxc,àÃEGÄ›O¾ˆPŒ»¡ 5,†*Uä n‹¡ =¸„Îø‹¦_Mk X†\{ŒhЫ øŒÌ/è5a÷&T8)M¶¦q†Á@Sš©¦&ü¨_åM;ÁÓEÈ÷]H¯‰;h”DrõÞÜA½ƒ;(ªo'‰;UÊbdÀ˧Dá˜àío_ûTؾçÎð`ºø*C„Ž»>ìóèS¿zëN솳ÑFÚšÓÚ¼•DwIꑶ¹÷Tx&Ò–Ÿ ÎãfÂ))t¯\d,ƒ@Ó^𙡿½µÌb„Q†(¤§íK”í¨hæà ”.2ï_ìÜ÷èèê>ªD°¾Ö¬s›Õ‰o7²„ãûË®ø:ýr—ù¶®é2¹c¹ÿæŸO7WØ|.¨û,?L°€ @^5¬Ÿ<À—ˆxqËׄï¦HñUGÕfÀ1=7Bù÷׬X&ÒG&#ó}ëé到uÇm²=ìu€a›Qþ=æW ®¹ÜèÕìy›±û©FS¾^qñ÷„=k¯LYJ5rOéI;®úõ„Ih­ˆ§T(^÷üAo Í‘:åBŠÂÉ»š 5Fý³w´r¹>0FñIÈåªê›uƒÉ¨â¡s«ÄÒ¦ùÁ™$…óÙË›êD|²¸Õ‚¥¥|Ë´0PRÏ€ŽÑVØ+þ½Ç¼xwõëåÇú 9Ez˜S*:-oÌ^öeuªMÓUCŠ_Çâ½÷ oÏòšJ˜¹S»æ•¦øõ„îð›Þ!¢€äÐ}L¤wq™®y‚º8^û‡¼ìô*ípÛð„A2”‹`l=émNoTFäsNΰ'lçû§Ž#:˜x–ÁÙþ=â  €rþêòˆ¡I:o„ãàû‡u×àöž{[lJáoÌ;µ‘eÆEÁP§ûë¾Aè®h™ªCwT ¿çE¶í&ÞDõÓÉJ§âêK‘Ó£¶V=z>JéÊ ý$ïŸdLâÂ^Ïc.R5Ó|¾¹}øÛëfUŽ¥n®Ÿ”/LHÁ+]9õ)xHƒö´R!4ÍØ=y¿Ñ½Š*ü‡ã«¨+WÑK¸nÖ”cahÝÕyÙ÷μ\SÌS¶žþóȈæhLàãÉ{gàó½3 #Ÿ©[®ô]ç&zˆöÈÓjÀo óí¿ö¾þÝ69éã!žqÇä=.ÕH¦¥Èà*ßü`²–G˜AEó*R úÃͨ×Ðè1<ÅÏù»Ðyx0ÁÝ_bø¶ Ö€)³ñ/?9dá±7Ý/EÿO¿ôc€ît `DùFŠ`÷­ÂæïS‡ÿ4endstream +xÚ­YYoÛH~÷¯2/Ñlv“l.0 h|$8^­Ýì"É-Ò‰Ôð°ã¿utS¤Dgf7ƒQ³ªêê:¾*‹‰ÿÄD®'ãI¤C7b²Üžx“¬¼;f‡7Q®¸ôËâäô2'Âsc/ž,iË"ý䜽Ÿß..î¦3)¥£Ýé,Š´s?Îbª¥3¿9ŸÍ¯ÿqsÁë÷°p7B8ÿº¸»Ÿ~Yüzr±è1œ)W…9þ~òé‹7IA¨_O¯Í–µ¡‘ŒÉ«â-Ö@âøæ[ºWbÞG +h‚Ö`$˜Nác'Û)\€^‡'{ÖCŒŒ~ð *:EÓG[g–0«Ç´cí,“ £!œ^çôví7>H×x±ŽÓd[ÞºKj6RÒq•òæëI,7´R¼ïé¥ì{ªò µñ×Ó¬Yž’Vfv”Ð*rzN™ÈÀÝ¥vu`i”Õ¡\ß÷û\êu’–Ï#ÄBß!.yÖ·È™$(‘†-v¦àFƒß ÿôU‰ßu÷P;ö#¼­|ö„2aF8†KYñÚvÀ©¶, +þ½>ÇÕù-‘,‘ËWzù•Oô|£ Т]/Š¶–í ¥àÿ”{’Ê1Ñ‹8r½BeÎs’­¼Ã~Ÿ]]ÞŸ¢~ø…I½fš°÷qÊw&:è¡)4ÙÀ’•…;’v ÆÂO‚ðnìÓ ï¡)Hö³„v%8%hŹø–lw&”Ë0rÎÊiÕVèƒÀ«eð]Ðí¸2p!gþQž"†!ßý»7ŒvyÔo¹FÒõ!ÿyH™çªÕ„wï¾Ãë☠©V¸2BjÞÚ¬ËQ”ýáà1À‘û§Ù#õm7XùÊiñü®âÒ¹ké¯H4XNÈ4–eËí žd;gØæ³]ãïÙRfèÖI DŠJÍÐö†3{s³’ðçÇ«›{ΰJé¹Úž4ž/¢sn +J?d£ÎŽcqiò~I™še[oLÏÆku3ÜJ†> endobj -4441 0 obj << -/D [4439 0 R /XYZ 85.039 786.531 null] +4599 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [157.327 598.355 218.917 611.257] +/Subtype /Link +/A << /S /GoTo /D (simplynice) >> >> endobj -438 0 obj << -/D [4439 0 R /XYZ 85.039 668.735 null] +4601 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [478.03 494.957 539.579 506.646] +/Subtype /Link +/A << /S /GoTo /D (simplynice) >> >> endobj -4442 0 obj << -/D [4439 0 R /XYZ 85.039 626.387 null] +4604 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [97.146 201.325 157.848 213.014] +/Subtype /Link +/A << /S /GoTo /D (simplynice) >> >> endobj -442 0 obj << -/D [4439 0 R /XYZ 85.039 571.143 null] +4597 0 obj << +/D [4595 0 R /XYZ 85.039 786.531 null] >> endobj -4443 0 obj << -/D [4439 0 R /XYZ 85.039 538.722 null] +462 0 obj << +/D [4595 0 R /XYZ 85.039 668.735 null] >> endobj -4444 0 obj << -/D [4439 0 R /XYZ 239.826 446.534 null] +4598 0 obj << +/D [4595 0 R /XYZ 85.039 626.387 null] >> endobj -4445 0 obj << -/D [4439 0 R /XYZ 85.039 242.769 null] +466 0 obj << +/D [4595 0 R /XYZ 85.039 557.594 null] >> endobj -446 0 obj << -/D [4439 0 R /XYZ 85.039 161.082 null] +4600 0 obj << +/D [4595 0 R /XYZ 85.039 525.173 null] >> endobj -4446 0 obj << -/D [4439 0 R /XYZ 85.039 124.216 null] +4602 0 obj << +/D [4595 0 R /XYZ 85.039 427.012 null] >> endobj -4438 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R >> +4603 0 obj << +/D [4595 0 R /XYZ 235.584 432.985 null] +>> endobj +470 0 obj << +/D [4595 0 R /XYZ 85.039 132.859 null] +>> endobj +4605 0 obj << +/D [4595 0 R /XYZ 85.039 98.113 null] +>> endobj +4594 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F38 3057 0 R /F18 4228 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4449 0 obj << -/Length 2119 +4608 0 obj << +/Length 2519 /Filter /FlateDecode >> stream -xÚXÝo¤F÷_1ÊåÑešn¾òælœ»V{{k'9)É3`›ì³ÀØ;ÒýñW_ جt²Æ4ÕÕUÕÕ¿úhÔʃ?µŠ×ÓÉ*ŠC7Ðjµ/¯¼ÕÌüãJ ÇFX6#ž?áJynâ%«»û^Nâ¹A®î²ß7ÿ¼þpwóq½ÑZ;±»ÞDQìÜ®•s·ŽµsýþÇÍõ»½¿áùÛ˜ø¸VJ9¿Þ|¼]ÿy÷óÕÍ]oÄÈL¥5šðùê÷?½Uæþ|å¹:‰WÏ0ö\•$«òÊÚ Œ–÷ÃÕíÕ¿{Y’EÚÄí×`ÿcŠÛïrjºc‡ŸÈl°5x¹H"¾1|ž¬úv~Þ6ßDn^°¶Ý×6^ê&çQQÝãù6%G‚BÏ^ƼÀ=ŒAž·œvG<³ayÐ&=KÚúˆXTg#b¬ïÑå¿¥¶<×=¦ñœ1„xíaìÏÃØïaÌLÍS±¹G7’+kA‡ržñ_Ý|º44oZˆ£<ŒìókM/Dîë¦É)d»H8ODƾ®þð”y@,6yöCb‡šÎ<£yÈ›l(¬I»ºùÎ Ÿ>¬È{Tß2‰6Fö?áò†pVRäò®fñøõƒå‚6â™Ç›ðàžÍ<Þ´ x[R×ãm¤ðfÀöPÛΆZ‹œ²ôç‡äBXÀÕ)àܘᤆZWT¼HÒ8s¶{ ÈâØñ|Fða|z"q]@-“QÀ ë{~îqò±&“a-Óñ¤G˜âs}<Š­„ú`Sλt–ß°£"#»žFÇI <'†OÚù¶bÄw…8M‰¡_Òòx`«‘Fõ9_*R¸N4â¦=SCk#¦—U‘'RËQTûº´ËèH½õÚ”ó¦ÔX -å‡Ø¶Oë tÒfK…7T(gKšSêbv)³ŸX Ù7UÔ$08Õ;ÇúhMžfg¦’£+æ5†÷Šq¿+‹®Ë3Ë¡ãÛ‘=#)ß8xƒ¤rá•×-Ez:0îêPu×àRÙ{Y¶Ñ;šûŒÉÜUå{Œ¤–±aD¾’&{¥ÄÕÚdf (´&KÏe}’iì)N9–A&Ÿlæ6ÕÙM0é³$ä¥%fÜħ±!öùD™0Ͼǭm -Í(xÞèM•îì -ì·àRr]ÕÕ™û-}ËT<‰†ù:LÆⶉ´@Ë¢ÕrñPž3jœç<åO÷‚ÐL($Ñ\f]RØgÖ×'3ëX#ç°Èw~yÿö?ÛwŒ<ôë&C[JG™—ü^â‰õ§‰tg\—$2"hÐäDü±úDC#w0RŒ é˜ë…‘˜ÂH˜Ò=¥bêól•ÛÄ¡7˜Y0`–ž“¹ã1«åû<µ' [Ò7>€%Qj2=hà¿´db‡A#k{…  -wMÿ³óÄ^çF§™v@n£‹2®‰°TÆÞ""î(ú`ÌÖ4Ôsìå(tä9UZŠÅ§ d>µ²Š{W`;S=ÉÛ¨ïj ºx+>G) EdƒX[»~žÆ/|wO9ùPs”÷É^"U/#Õh7Ô|wýv ÀµÝ1mJ~Û´ò|âçùñÐäG}Ãp¢1U}ªºo&nU…û¦¸ˆû¨ô“¸Ác§=IšÁéd±Ç’Sr<*“!ó/p%†BÄ‹·9·ôÑeŽ)'uio2¦fiåô4\Š «7ºûm¿4ûʽCÇÚÍrÂñÌ',Ëôµ„µ¤°OX¯5N&¬±F¾Œ'à‚ÀOG4öÚIhKgÍo„<:2¾E2uŒh4Tx™l_pQgõbPJ¿¤“xüÕ$‰HWŠªlH‘‚†Z4JáúØ2ƒ’T bé:Áå¾›(Ü“‰ÑéCv,År&¹ä²Œ²L«Œ3º^©ÿråPCŸÓˆT²4ílá.¤øgE_›í‘à¥FfÅ/Ø¿¶ípm¶¦N;Ü¥DÁÑÛÔu÷7Žøòj¦áö‰šÃº>lÛ´Ü¥¾-Ü?ÖÏ!]×ÙÙåÇ×e—¢Ê:“ô÷æ¹›1›~ºA¼š ʼn“ÆÕ&}ˆõuÐ÷û±k° ˜®eÉÚF‡‘sÓ4õ?ô´s¶ˆ”EcžË¨&•D.üFAë{±-@Ò.·-„V‰Ó_ä²fs1.jk~Ö÷ô ˆQÉ«ÒLxd);a/_Iù1÷¥q8ð÷{¡çk&Mwµ½r Ì屿T~ÁÔ‰ó¶cMGNÐv]ˆ+³(·Ö%'#ÔÐû -B„ûŒë“XGŸ l<\’a¹|!ëÛüŒkÝgöTîÇŸʺ¾9Ì~] þ8ÿ,ðÓö;ëÿÿᾇœ‰Ý$ö§@óFÆCøׯ t ¤',þ6WéWendstream +xÚÍY[sÛ¸~÷¯ÐìöšF4A€·¼¹^w›4ñZNÓ™Ý} %Úf# +IÙ«™þøž @B"•¤ãîLÇ3&®ç|øÎ$fü‰YùÌfIû‘³UuÌ çÇ3aF3åq„]¹=;ÿkÏDàgA6»½§!·ë_¼Ë¿]\ß^ÝÌRJ/õç‹$I½å\x·óTzï~X\¼}ÿîŠû—WÐq3Bxÿ¸ºYλýéìêÖYp¡|K\ñóÙ/¿³5(õÓYàË,=C9ðE–ͪ3I?RÒÔ7g˳Ÿ{)ܧfpWŽå5–o‹VáA+4U°;¼Ý·]Á8¢)`%þî#Ã.žòâÁiÿÞs¹ÙpéŽ4¸üp½$ãSׯA\oŠœt)¸­)î‹ ˆhƒG™ ÓÇF%gH;ìÇÍÃŒ 7?~Á¢—9n§s!%²W¸0Iæ̈áÀHa§¡ú ¥ÞµÝyYweýÀËÝv;ÀÐM7Ò6‘~ÇÓ ~,“¯à^[èë¦àRYߣ[›Š@ ÖÓÀ‰°#[þAÈ*>WZp1²n3¨Â^‚LóT¼•…È¡³½Ùs¥f*?£gü§›O,`ËΣ‹¦DFY8èó¥©D'¸0)Ñ¡ ¼#ïÀDP5àÊJ7 Ë*£]7ÅŠEUÁ•Ô@Êÿõ°sX¬{Ê€0¡ ÕŸˆît]‘®.wv†ûZÄ$QDcÈÒ•7²Â)RT«@GýÏ¡sÁPˆ{ç´åö;’-1ÄG㬂{”Äž1;³]õ{Ûqÿš ipˆ@‰ ù ³†‰.~­0‘Ä8Ž=}ÏßÕ–ÄéºÐC€bi#Y×Å„ÚÇ—Ü¥köìs G>þH,¿Öä–ÛÞ1Ø9†V.¶Û9½±#Þ¦n>ÎSÛ…’[˜˜ô5|ƒñ#‰XÚT¦¿çU¿@6Aï4Üïâ‘[NŘDã1„¡'7f,›C³CMcn{É |Ϊ>ðM®ù/}gPêu9)0H‡RF~œÅçOysÞnµÞœ·yu—ó„àf‘Ÿ„vüŽÏ*ÙOIá«0eVý‚@?ÖD¹Žò8>£Ô²)Ö¯ Gé;cÞèUßmØ„ÉÔ»¨u½·I=«Ÿ`ÒAØ7IN¶€BNvìËØ¥W%&èÂPr,yùåÑ>Š½ïÞüóü-'²»ß±-b`Zñ˜ +­ß{¦ãA9E=Ã8Ìœ´8tÖpk”24«¢Ã»‰ó(C8¿©”¯˜pAÆ7fpìu^[Ç"gæ»ÑˆÓ²Èå¹(þXôïíØÂð¦È ½<@ýX“‰*áXÝk$TC8a¼WßIb ;K†0 q<òpL1éÀõ$Œ~Pˆ ]"¦ùŠµê¸½Î«‚g2=RѲ8ˆLƒâö¡w 7ÛHŠ±š0(â0¢£ÄCîÍá*~k+=l–†¾‚͹6»×t9ÄÙ¨P?¼ž m¼Ås¾ÿNa¿€mÞT\[´æûÄßóç¡)¶\úŽ!Eep—ÞÕÝwF·KÅ´ÔßóO¶˜–YP4n–—wN¥4\3Î)–šœMšeÍ#»Ó’üÝê>¯' ‡~Tg‰%§óLÈVÉÿ#me€ÆÒ9ºÁÃœÅ6j®=ÛÄ°49µ:‘ á*ä„Ãk0—&¢¯Ë>àZ—àÅØô»`˜(79ËÆ*é$¾;Î1O±Þ|˜-­»ïùØWŸpe*N¥~ǾaâêQ?×\ÞÖë½ÏŸ¯ËŠÆ¢*½6,ôçæ¹;-âØín §þn¥Í-†?ÆEtq¡Ä|]LX*‹!»µÑ´­î|s?‰2säÌiUÎUÃ2^ûÈà©í3Çè5%“°L—Cågü>üß<ÿ\!m漩Ž¸#óC +´yœ–;æ5!ñ• +}¤\1£‡_LÙR|ø¾ÌÔ7<3 å_N>3#fB@n”œ”C³Ã%;üPNäË6ŠHñÁK´ð3Dä°÷wøèÜqø¿;Cˆéù`öy&ü@e™äN§LŠs¨áüM%f?hÐh6(¶ £x—Ílxÿé„CÞלp]~å®—‹ž_z2à'RÌ?÷-k_™Ü è—Èúl:—›œ¬ÊMÙ™ËåtšÇ  (²b¥ar&"´I$DWž±æ ¿mÄ )âÁáߢ¨†øtxºŒ]ü‰˜‘ã¯T¼›¦2›„µrŠ ÐÏr&on=YÇxã6 9×ÍëS,pá:Ê]Y'Y˜BøN€ö‚„jñbAßO¦!yHR+VsmE á—ãfažõéÑÍÎêöoa¯L°îÕ…s»­=÷’3RâÄÃg9hËYPÓ»7UfÁ»ÜxSëâɼø`ô •÷¦ÃH{±Çb¾i5—@;Ç59^—0ÄaWg†uŽW|„25?šBC£Ÿ¹Â÷ìÊt=æ”êoðQ +X”ÒEž;7‡÷ˆÛÃLùa Ü\¯iöíÇô]ÝŸ ù»Ç2ŒaDd¯\üûÄÄr@HÑxµn¿7…¦™#”`XXôazrC?(pðýˆ¡$@¹Pi–|)ŽLÑ˲XuöŒèÚþŒÀ‹ Oúêx½X‘ˆ‰p’~K8 .„<¼7úQ’½ŒÚ +–@p[à¼ìeñf! v¥øëY»H§°5yÙï§ +"‰®_ÌÜÓllÁ±þ“¬0ãendstream endobj -4448 0 obj << +4607 0 obj << /Type /Page -/Contents 4449 0 R -/Resources 4447 0 R +/Contents 4608 0 R +/Resources 4606 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4426 0 R -/Annots [ 4453 0 R ] +/Parent 4581 0 R +/Annots [ 4612 0 R 4615 0 R 4616 0 R ] >> endobj -4453 0 obj << +4612 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [124.649 711.276 245.309 724.178] +/Rect [124.649 681.189 299.908 694.091] /Subtype /Link /A << /S /GoTo /D (CUPS-printing) >> >> endobj -4450 0 obj << -/D [4448 0 R /XYZ 85.039 786.531 null] +4615 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [304.588 219.728 365.823 231.417] +/Subtype /Link +/A << /S /GoTo /D (AnonPtrSvr) >> >> endobj -4451 0 obj << -/D [4448 0 R /XYZ 85.039 766.606 null] +4616 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [348.636 79.898 415.538 91.891] +/Subtype /Link +/A << /S /GoTo /D (cups-raw) >> >> endobj -4452 0 obj << -/D [4448 0 R /XYZ 85.039 753.526 null] +4609 0 obj << +/D [4607 0 R /XYZ 85.039 786.531 null] >> endobj -4454 0 obj << -/D [4448 0 R /XYZ 85.039 712.272 null] +4610 0 obj << +/D [4607 0 R /XYZ 85.039 752.658 null] >> endobj -4455 0 obj << -/D [4448 0 R /XYZ 85.039 672.231 null] +4611 0 obj << +/D [4607 0 R /XYZ 85.039 723.439 null] >> endobj -450 0 obj << -/D [4448 0 R /XYZ 85.039 266.58 null] +4613 0 obj << +/D [4607 0 R /XYZ 85.039 682.185 null] >> endobj -4456 0 obj << -/D [4448 0 R /XYZ 85.039 224.295 null] +4614 0 obj << +/D [4607 0 R /XYZ 85.039 642.144 null] >> endobj -4447 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F41 2994 0 R /F62 4047 0 R /F35 2976 0 R /F20 2961 0 R >> +4606 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F15 3032 0 R /F59 3455 0 R /F35 3036 0 R /F41 3054 0 R /F62 4159 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4459 0 obj << -/Length 784 +4621 0 obj << +/Length 886 /Filter /FlateDecode >> stream -xÚ¥V]o›0}çWXÚ <à`lÃcMñÅ—ýl¡tú:ß`éUÕ2µÖPpÕ–¸€s‡-¢ëóôFãN·õ -Šl4ëÙxz/£éd õ)išlaÂôt)Êûˆ5tQ2;˜f¹ÍMÓ@µÝjݘ(’×ϺP}P`]Ú£‚S# Ú8\ÒOÕŽÓ7§ôsÓ¤•à„Ét‹b -¼÷'€¥ž¿næ0ÓJDz¥ }Ð$*Ð_æÑ]Ïõ¦d¿ÿØõÇÁÀ£gGJ°&lŒsd»‚ÿà·bÔ$æ8¢r¯ÐÙ©d%<é7©+StsÊ)ŠÝŽV=$}G3çÍ+M“EïÆz5sÛ´‘i±Ê[tJ¦K>ï]Yÿ'”æU˜¶Ã4sN†0ÝVÿxuù£¾ºCÑ<ðÚ`o{«aΩ`ãáí0oê±ÿ) BªBø®”pÆ \•Ï5{¡8&Eò®]ÞõÿSîaendstream +xÚ¥VKoâ0¾çWDÚKrˆñ#/¯´¶M_êv»­´êö` Ш f“PÚ¿ãØС— + Ïã›ù<3†Ø>ÄŽ„·£8D#ö´´°½É¥EŒ¶}„Ã@‰¾§Öà"m‚ÇÜNç­J:{pή†÷i2r=Ƙ#׋¢Ø»ÄIݘ9ûsoxûó.Ñòq‚‘Kq~'£±û˜ÞXIÚô|ä‡L!þ³±=ƒ n,Œí ì1"œÛ¥å >3¿ klýÚyÑ2ßÖV=yy[ bQz ñÈÀ±8vAÄ9íC"„A€¡íE(ˆÂ®ÆáÚL‚‚“WàL”®GœìŠLQéÕôë!aÐã.ÐiÇuéÒÈ™ p:UÞåvs}QsYéÍP‚„ÆÎ[)×µ¿‡Ã*‡Sî4ùrq ¢Š®¾Œw·Ž‹à( +:UFâžX¿hÜKE€œµèE‰PÑUê°e)k2µTµ + ªvߟG#„¡.”ׇ…rV<*ÅöÕ-óV´‘Õó¢’ë•ë4p¾éåÇõy2¥W=ˬ™ä²ÖzKQf{†—ÐÃÛ‹®] /!›®«¼yÛÓ_ GIÆJÔõl¢u&búœ-g{v‹uV7}vpWí=u•§ëU}Jw*V'éZu™lͲª~.úF[ú¤¦$Å΢÷í8 0 +\#\OŠ„úP<«bŒj©W9¹&Kc%fFǘªmcÔË='B/Ë-~£dõ“E{{Ÿº1ñk5TE“K¦ü*õ®r¹}ˆó +úŒ;×FÚM·÷¸Ž+ª­G58¡·ÚÈÔ¾Þ’ÑyevdÁ#Ðîeçk£à@ñ&/ +½+3=€ <ˆÙ̼!r¾õcTJY®!‰õü9`œ¢0 ûKÏ$ù¹¿>°`Ç؇EÆñÑ»‡ßßÿI%3÷endstream endobj -4458 0 obj << +4620 0 obj << /Type /Page -/Contents 4459 0 R -/Resources 4457 0 R +/Contents 4621 0 R +/Resources 4619 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4426 0 R +/Parent 4581 0 R >> endobj -4460 0 obj << -/D [4458 0 R /XYZ 85.039 786.531 null] +4622 0 obj << +/D [4620 0 R /XYZ 85.039 786.531 null] >> endobj -4461 0 obj << -/D [4458 0 R /XYZ 270.432 556.3 null] +4617 0 obj << +/D [4620 0 R /XYZ 85.039 763.817 null] >> endobj -4462 0 obj << -/D [4458 0 R /XYZ 85.039 271.24 null] +4623 0 obj << +/D [4620 0 R /XYZ 264.144 769.79 null] >> endobj -4457 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R >> +474 0 obj << +/D [4620 0 R /XYZ 85.039 476.959 null] +>> endobj +4624 0 obj << +/D [4620 0 R /XYZ 85.039 455.197 null] +>> endobj +4619 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F18 4228 0 R /F58 3380 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4465 0 obj << -/Length 425 +4627 0 obj << +/Length 395 /Filter /FlateDecode >> stream -xÚ}RËnÛ0¼û+x$bI._º¶hƒh.ÐC›ƒbɱG -dýýî’R¢6¶!@ZïŒwf–ÔLá£YtRAÉBôÒfÛ—bOˆÜlôÌ°¤³ë3`± …7RÙp–3kÁXi£%Îçjóé›QÌ(é=°j·ñhD™Èªæ/¥(œSü»Ðü‡(Àþ³Ãº…æÍ @ó?T óü¾(lá+#Ïü2ô¿•¶O§±žº¡ÏÍ"œhdCU+ª»Í×êÍù›'̦Ï.G±Â€„Wƒ{¥‡¸®­ë×ÁAKì\St[ò{ò5Lͺ*þÎIâÚ1­d©Ê•¸+Aš`’xµïp¡Vy¾&ð}ýŠû™Ú1÷š®ÉE/ÈX®_Èeý,LĦN7#]OÍiÈ¿¦=í:M|lm}L{Ç°x ø픑éõ€uÝ÷í¬º#Õq™ÖÎ$lžñuèŽû…¹ŸYÃŽ¾ŽLitvš.o™bã}*0î6] œ•2µÙ¾¼°~pÒÂ?GñÞ©”—àü2ŽÜD÷¿¤ƒ(]„+šò Öþendstream +xÚ}SMoƒ0 ½÷Wä˜Èò¸nÚªMZ/CÚaÛ•´Em¡¢Tûû³ Ttj'¤`üžl¿ç ‰€G’Ôr¡3âSÇ­–d¹Ÿ ²d>“ÃXÍ­1_“MœâÂøkArc‚÷ùìîI ¢wN“|Õ“òòƒfœ%Ö +úÊ$}c‰vž¾W×,‘´l˜–ôÃ#bŽ.BÇ´€=Ø"¸àCS +iÖ§¶èª¦ŽÉ9NX²Ä(°¯üeö˜Oç4\È[”æÚë[ çÆ™©@i¸6îR D‰&£ ìßtç ®9æy&Ô¹ ´D +ÈdÓ‚ù¦3ŒptÉ”§›âÚºÐÆ\Y•1¨6‹ñ;[¦RÐßgª©jLvMüê6èS_ÝÓ6ìBqì=°6úÜEdB:ì .ê: ]Wص«…ÉÓ7»ê¸™“ò‘Õ¬ðmqˆ#Z„~H¼fY/îø šqP«×âøüÊR­õ<…;>ÙÜ_Õ’\ÃæÅÿ†gòoy¥WÊ_þãûéÐÀ»endstream endobj -4464 0 obj << +4626 0 obj << /Type /Page -/Contents 4465 0 R -/Resources 4463 0 R +/Contents 4627 0 R +/Resources 4625 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4468 0 R +/Parent 4630 0 R >> endobj -4466 0 obj << -/D [4464 0 R /XYZ 85.039 786.531 null] +4628 0 obj << +/D [4626 0 R /XYZ 85.039 786.531 null] >> endobj -454 0 obj << -/D [4464 0 R /XYZ 85.039 766.606 null] +478 0 obj << +/D [4626 0 R /XYZ 85.039 766.606 null] >> endobj -3054 0 obj << -/D [4464 0 R /XYZ 85.039 658.638 null] +3115 0 obj << +/D [4626 0 R /XYZ 85.039 658.638 null] >> endobj -458 0 obj << -/D [4464 0 R /XYZ 85.039 658.638 null] +482 0 obj << +/D [4626 0 R /XYZ 85.039 658.638 null] >> endobj -4467 0 obj << -/D [4464 0 R /XYZ 85.039 620.371 null] +4629 0 obj << +/D [4626 0 R /XYZ 85.039 620.371 null] >> endobj -4463 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +4625 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4471 0 obj << -/Length 249 +4633 0 obj << +/Length 235 /Filter /FlateDecode >> stream -xÚuP»N1ìï+¶ô^v½»~”€AEqPD¹Qp‘¢À÷cÑ è%ÛòŒgv†êbȆ$RŽh°~ﶹëxf¨ šj½/€þõA2Í‹¤ÙÄ›&´,s5t· Æ(0¼BH‚… ,DLÊ0ŒOî±v«^Èí½—˜Ü}=踳ÃþexøQRL95%_2†Tý´`fùVº?WSïÙ­ë§M»ŒM0ºëÝôL¬Ûö¶_Þ*¾›šjw3#Ì 4&,1,…¤j'-”¿è¿Uˆ¡Ê©‰š› •6¿PD±3§ŸãùDVûn]ž„Î=¿q-c‹endstream +xÚmP=OÃ@ Ýó+n¼ 1þ¸ßL Ù€!jJÅ@*U…ß/¥…VÑIgËïùÙÏäÐ9€R\ÖQÈ­>tCúe„(C°|ìŽhÇ¢P‚.‘H4'ã hàJ¹é›«{Fg•”Äõï3µ_üs+ä‡VÐïöm')ûG xúÉCûÖ?ºd͵»+ +œ‹íS@If¥ëñ{˜ÚŽüÊšÖ5«`ò·Ûé)l¾jm7ì? ßNUµ¹ëÿ¬ÖŽ +Ù´œ¡ †Ègè%‹™@(.8;§è¡`ùï¼ðå +lÚÌùüôÇø7_\Ûendstream endobj -4470 0 obj << +4632 0 obj << /Type /Page -/Contents 4471 0 R -/Resources 4469 0 R +/Contents 4633 0 R +/Resources 4631 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4468 0 R +/Parent 4630 0 R >> endobj -4472 0 obj << -/D [4470 0 R /XYZ 85.039 786.531 null] +4634 0 obj << +/D [4632 0 R /XYZ 85.039 786.531 null] >> endobj -462 0 obj << -/D [4470 0 R /XYZ 85.039 547.583 null] +486 0 obj << +/D [4632 0 R /XYZ 85.039 547.583 null] >> endobj -4469 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +4631 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4475 0 obj << -/Length 2766 +4637 0 obj << +/Length 2789 /Filter /FlateDecode >> stream -xÚ¥YIsÛƾëWàV™–Á–[dÇ)¥Ê²_‰U>$9ŒÄ Ð(Eÿ>ýu7‰´ß!¥===½/£Àñé/p²Øó£ÜI³Ä‹£ÀY®|gK;¿]ŠaâÈ‹¡õ…Íå°»LBÏ7éE½c™†Æ3™ÎÍêêúcè;¡ï%Iä¬6# 1⇙³*þpß[,ãØwïía¸v±Œ’Ô½–ŸOº—åת.šE¸Ï‹eàv&î]‰^À‘ï2B Ø£ Ü´ àÏ]E”jll­~wŒï?u–Ämî'ÌÉo§ª(±yõëj”kà8 ¼ (ù ‡%b‡„Ëý|.9A’8àûV»Š¤ ]¹$×2LÝ5Ø;Ÿ,Êzf$c¬ù²U½`áM»-E~ éö¼.°¹Œ·iÚƒí+:Ë0«çžAŠ‘÷8&7XåÅÊÏÆvzußÚõ‚¸{"[Ò’Ü R=-Á«˜ë#32€9¥ûÎ2€'å,ÿCˇ G,ZÕ[²YN|®Û¦ƒsQE'õ(m§hu!‹kùiÚÙñÁGèûÜ7¸ìqÛ6 uTâú±?œ‚P óÍʬ;Ú È5“и_oïî«Ò“{WÊúǬAg@ëaÐÌmöò¹ív®‚˜5ЖÌg3œÄNQ’»ÍF~ïÊþæöó½|ÔöPŽŽŸó Qê»·_äÛ‚ÿB vòÃÜsO‡î>¯À&zZ0¯üSãÿ¾5R)ö‹J; Ãûïš¹ü›ýº<â@‘ºˆØ‹¬Ù-ì£~AŒŽ"#²ÐE;8ûí«r_â8L½<áü÷íê¿|§ `þýÊ÷¢7àžKFÉ¢Ù‰6óEeY ŽJßÒb ši!oëAkU]ÊVmÇB­È•þ>UVî”®8-~Y÷Õ“øÀQADZVɺ¶_Td½ ̯ÔhÔŒ‘ˆû½äå”ÜuÓP¢¯êͬ§ºOpÛu§±xàxÏvée÷…Ë#\®•Ý®êõîO¥=Áêñ¢Án6Ü¢™8˜|á¬Ò­ÞªDKtžŸM{IœY*ü‰Ù;@o‡sù¿Îöaàe¹ùaç¥TX¢W=/%ìˆ$š:¿ˆzh&CÏ‹Ö‚,ë~DwZÚþÔ–³¶V†šÞ›².‘×´ï¹\×Ò?dqÂùns±‡b°ûæP6ìëA&éu=¤Î@‘ùÝ ‹–\©¤Þ ›º$Z5pw@.ÛC§÷€ÜÏòúc<¯.!µéYHI ”èL(-IÙ.È%q‹‰$¿ïôã¹i¹K1ÚW`¿:P¸î;|&H//Š{Nj ó°ˆä={õRYyU¸i!ÁÍDß“hX ÒÓÖÚ¿XÔ‡idP%­÷ 6šGÁã»ìúüEÌßAÐæhÖÑ_N:Õ0Ú†ÛÙáŠíßÎ!需]#]ûÄ\¥gêò©Tbr5ùhÝýG¬óÊ}LDµß7jÉ]ËHIßósQÔGÔJphP¾l­ ¾tÐÃò+÷ßŘß:×e/mèØÍ Üî-¨#mmO&'Ý™P“!u½íË7cÀ§ƒR?ñ›AãU+ËÔ*ílÏ>HgâfâM ¤—‘ΘQzà²ô @þÉ‹Òûvª´¹9—ÝB+|•žèy¢À6 ÐþÔõƒ‚;ÎÄãŒñîÿ˜¦’j¡‘eÈUu´ÆÆVJ?¦ÇnìTRü÷¯ÄÖ».Æ ² &ƒm)jzYo¸õZŠ}ÅúFà&+uÜž{íjm÷rÆi›‡ý 4DÄý:û儸Âve¦q8ÊGÁÚ®©RôõL`»¿^´K§ÃtßÞÖËK§ÝV£§Žï ðÏ,š\,"ç¹µoåݤ8­9R3¼G`9g\ õ ¿²3OÍ2`wA:É -=õR¬Gí˺šE”.4±`¤H#­–bªcd'±{_Í -ê¥|jÏ©pç’’JÖ,?-ºc[ÚB6[{d¦¦ÜÔH=Rmw‚'¶‘Lá«Ùe€€&ÖhßI÷¡ƒ)ÊšºÁŠ;\Êe\èbÌ Íã2º)_‚Þ%uF»˜žu}©3ﾬÆÍš®t«ý‰ð(r<¼MÙkêI©ˆÖÛò©CYz Þb«5m)ÐÏ "OãS˜‚_F€•J‚kk½FÎ’>HÍïã$C¿Û1ÞG©9 @..G Pc~y9ï“ÑŸ–òPf®Êáµdg)løœ¦â‚Ó"·S -ƒžq‰¤¤·W*Ñpêî†Ôß üyW­qÙNðeJR*µùŠÓ„‚8ñfDe6¨~µù;F¬x)åù–I}ŽMÊ™‡nµÇùÄ îJÁ)ÿæl$Þ‘brƒœœSt«úr°î•&ûTðœÿéFÖxC¼ŸwÁ“KéŸôQÎnõš›áéUâO*-žÿ¼Ñ2kB'<{AOG¶n_­O{©±<>êEšW;y -àù0î?IØսêpŸ”j—1â"yøÝÉkêv' u-]…€ÆAÅhëîR#GWÞØŽÜŠ—·õ‘ßóäÐõyœ|æþë(]%—ŒmòÒ½ÊÈÑ)v›ñ“{Z‚¬^=ÞШõ*)$©¦›X °Õ9 léð¢šAoS)ÕÄB¡>cŽÃ,µzôbÏ–^`ùBÖ&©dà!&Š4¿ë;ôºÁSE£÷c])_Z9CjKФÖÛ/»Ùp¨²8³njí·Cׄmts´Ïz_>$ÎôÄ/M}ûqìq¦ÅIÉ¢ËÙkµWƒ|·” ¯Åüz….«íŒe=2lÏ“¾G¯Þƒì‚ð³¿B×úà¼ß+@ŸGpvø—¿¾}ÔÄm¼¸k™%¦Ê®#Š¾Ôo²÷LÍû øêù|ù‰ÅÉ@ZÊÒ·WÆQæÅYôƒ;ÿ~Õìendstream +xÚ¥YKoã8¾çW{Yˆ‰Ôó8éÇ"$Ó‹Èaz´%ÛÚèá–ädòï§^¤äÄéY`Ð@›*‹ÅbÕWUL¸à_¸Èb?Ðù"Í?ÖábÓ\‹Ìüç"Ž(Ö~E0>3¹²³«DùA”žã +ùQœàäõÃÅÕW,Tà'‰^á‹@ŦY#”-›?€”®>ÚØAIˆÓÈʈ ã/™ˆÀ®˜å4ÙÈlö•ä.­Õ„bŽ£’ßçÊ°¸Ïw÷L!w.ÎÜ×/›±z¦ M½ÏV;Öy3ò9^Åí¢H‘+î…}ÛÕ5+I9W«4ßZLï'{±ð"c¯w86®“ûž–^)q{8T£ìFgC¹G±¯Êü¬ñ¿0J g˜ŠeLÓõ2²E;ŽkFôîÉVN¡'5ú%SÆÿCE>ðJ*u—loFWˆ¥t]¸Æe*˜ØO駪qªÏè¹v±} Žê*k_lÅÇ!~á„Føº„>‚ÊñR—i¥"į[X}ÏÃÇŠ!Ñ• Ln¡£#ÜÅâ/ç‰é¦h{«:™±ëñŽ#ê¬à¨xNdFH»oÚ.$‘©~ñʪçá¶äŠ+\á3k¾Îçpn¤“2¡NBV;uý‰t›0¥¼ƒ‹§M5ð^¯h!ÄÈ ÎZÈ;î;Š™îlß1­‘8+û²`ÊkžæJ(oÖW± I²ó]*0O¸*‘¿Õâg@o ÊE@z—‡¹œØÅÿçêj˜4#BÏãm'ëÁ¸bÓQÍƵV$i„‡×ì*‘;<òÒáQ@[:ÄÏG<Í(\à[f‡F¡­dÅH)§é¬HªÃhµ#Äuuù·÷ ¾_Ùêb®zr¨¡gC£ØbOŽG}Ê¿…ÿÓɱe¯³á¢¸3ÀWË=öñMUWÖÂ*â'[ì™ ;RtWS³¼•¾[»w…FŠ²Jª¿_ŽOue.¹ ‡ãäWÎsyÂu–ù‰N¿@ÉtlP6”¸µiWŒ–éaÍ®jK`~±‘ö£<‘èÉy0y£ÎÉ>ñ=÷íÅqãRX*),Íḓ×b}\S¡ Û¾k˜å ¹ÿ Và²^z`¢8h†ÍzJYqM_Ž¥TØ\\Ñ›‰¶p …ÔMT˜“É:rÜYèóª]Ç9#uô <}i +žìÍ¡¢®Ým:å=\RíöÌǗȨˆ«¸&ã¸Á¢ñ’Kn¡pMQ¶PVT:&R?ÇhΙ–Œèed/¾)u¸ëI1ºß‡àðãh$Hñ!‚ëlAtTÓW˜ŠJJ)±|®\À?ƤÒFõ%SG|Û : ™ÞI„üê†Ó nÛÊ6¼¦ô.õÁ¬Ç:E·¹çØ]°WîÏHß°«PðõuÍÕ£MRZÞKñ÷'1-‹ùÇýé?0P).N8œº<è?èF¬­õŽÿDc.L‰¸_ºx¥7äâÌ«·?ÎÕÏ^ý• +}¦üØýñ I®ßŠWZùJ¥§Ï´¿ïáendstream endobj -4474 0 obj << +4636 0 obj << /Type /Page -/Contents 4475 0 R -/Resources 4473 0 R +/Contents 4637 0 R +/Resources 4635 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4468 0 R +/Parent 4630 0 R >> endobj -4476 0 obj << -/D [4474 0 R /XYZ 85.039 786.531 null] +4638 0 obj << +/D [4636 0 R /XYZ 85.039 786.531 null] >> endobj -4477 0 obj << -/D [4474 0 R /XYZ 85.039 766.606 null] +4639 0 obj << +/D [4636 0 R /XYZ 85.039 766.606 null] >> endobj -466 0 obj << -/D [4474 0 R /XYZ 85.039 766.606 null] +490 0 obj << +/D [4636 0 R /XYZ 85.039 766.606 null] >> endobj -3055 0 obj << -/D [4474 0 R /XYZ 85.039 637.749 null] +3116 0 obj << +/D [4636 0 R /XYZ 85.039 658.638 null] >> endobj -470 0 obj << -/D [4474 0 R /XYZ 85.039 377.934 null] +494 0 obj << +/D [4636 0 R /XYZ 85.039 404.435 null] >> endobj -4478 0 obj << -/D [4474 0 R /XYZ 85.039 342.623 null] +4640 0 obj << +/D [4636 0 R /XYZ 85.039 369.124 null] >> endobj -4473 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F58 3360 0 R >> -/XObject << /Im1 4096 0 R >> +4635 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F64 4225 0 R /F18 4228 0 R /F59 3455 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4481 0 obj << -/Length 2543 +4643 0 obj << +/Length 2395 /Filter /FlateDecode >> stream -xÚ­YYsã6~÷¯ÐÛP©˜CŠ‡ÈyÙg&³NÊÇŽ´åÝJò@K´Ä5…¤¯¿}á DɵG¹,‚@>ðu£éO<øó'IäzA:™'±þdUy“ Œ|;ó…â\HÎ-š‹åÙÇŸ£xâ{n꥓åƒ^'õÜ('ËõoÎOý|»üú}z”ÓóùQ¼™³k|}.Ö ¨|zî;N¿ålg÷EYÀk¤o2Þðû+œ·ƒFI+Ty„½LæÇ _^/øåw/ò°£¨‘-ì`î¼ßKž›·µÚq}ÁŸ¦},°{ä×YE ÉÊDÛBãIõ°òe#À lú;÷Q½)飨v¥š]ѯlž41KR'íóº+ššÞ’ŸW(ÀJñi:l5¨¦B‰kç¤ÑHÖ£ºšš‡žstÃ…ËÍ%oµ)r&¤—W\Y6H{îMm¶©g¡8;žˆzA{Ï{léýª!ûÝóš¾êÙɉCŸÝ‹Yñøܱa°As£eLí ï‘““¿‘Ñ@í4Uº••¶i«¬´x­hQ’–X<؇5`æ¾ãªÍÏæ®—òæoµ3TY85½´úmÖcË“íc«èxL+–ÌX>iÅܨ|ãYOêXêgm~͈Á/‡uª°»©q«o2¡±&²ÿÈRÝ[Ǧ®º}!Ú§zÄ|×yô—7 aD§Ú: ÔKîõÓíÇËÛi‚*¡sF~¼àæî·^Óä—Žûfž÷Ê­üøÇ-?I\ô-Å;û­4H3¤…l¥Tªðƒy>¡ÿÔüÒ r“ÔÙ±«5mÏä:ïèÀw~d¯¼ çËlÜ·üºÒÎ2ôëÂø°ò¿ºág›—ùó4ŠG”Ãä¨Á0`ªòæáÖ;9ÛBVÏJåkÍУ’åg´HyÄ8«¡Æ|nA±c:Ä|¾lÙ55ŠÏ@54ç‚ÜIÈv¯yÏGY …è×E—Ý—ùš‰­qE¢ø4=¼@©,6*ƒ•®o–Ü×æ¢üE›¯c+¢¥>i¹mȈdWŠÿ¢"Ú«sÖ:Mì²ö»Å!¨ šê Âd•œ)¶Mkè”#\¹G"xìG®Á÷TrbÑPÔÁhèalEÝžsÑ(„ä8 ¸ªsGG9ˆç,W;-ùÁ4ðáÐõæ/G6%37MOoÌ¢9šDáÜM’ml9MÀqØ@cPÏ> `ܨðÈ®P¢Ñã·DcœÍ\wЀh[ŸÐ×_ 9½°/äŠTý1®j` 'Fâ a;yÉ–Á©•#R?d1Š ”ŠÈ±B¿Iåì —o¶tÊI/ ¢Ö¶á6 5"Nè›…ŸD}°`1 FVMµ{êMÚB£ÅŠŽ0 ŸNIèÚe-9îê©Ìdd(¢¬Ñ Š\Aìî‘hÔ‹ž‰UÄ…Ôæà>í8IÎTüî¶ÆA(¢(¸#S·: 3c@[謊VD?¢ØÉ -ô3DßšÙ÷*eèIþM®\9Û9@X;¥wÊ #OÅîÃ*½òÁƒ¶çt”­q¿`5k~Б¬çŽŒVŒ}ã4m™¿òK¡ÒÙlE)u"Âá“ß‚CÚQ§Í8Öç à”)•Í¦`ØIÃÈYŽúïèÔ"¸‚H>§œsõ× -‹ª†sÊèŽÙJÈõ0¬VÙ#¥ 1gY“7x&¢¾L)BÇ£ZeU>™‹Ç§#¸Fžëˆ§pÏ¢!Ü } ÷|ÏwC/Ð ¡®@íó}~¾»I”œd¨h8Ö÷gnàÏu"k_|0ˆŸk U™DmÖÜkÕû¦€ä°UúÍ iîZûÚÀ·„•ÿè„& ÇÒ‰cf˜Ah‰N[A“œ0Ó¼kƒãÜŒ †ìÆ-`Ø]eœî©¡ªn0+¨WùPGœ€C³äc® ORÂÔ¯NE³#ë7µ¶Ö¡÷ @ÜÙIÅ[4Ç5¯ˆÞSý)†Z÷ûG•os¼©ßi,jÚ|èù„&ƒpxqÑœIê #eÖÛú×z/5èqöQ*û#WãV%BvwÌ.qâΣà´] Í »Ñ»v9ÁÐØeã¸],ŽK¥œUY˜Â aû¡I`{!] ªë<`ì0A&+ê[‡=M¬FÑ¿·c öîUP d~Ô<¡ïÆÑi¼²hN˜GˆÞ5Ï †Æ<{ÇÍcqüÌ£nJ*2¨o‚CSª”e?Œ­h]£öÀïòVx­ÑZ¹•É±;b¸#EÑü´I Í “Ñ»&9ÁИdã¸I,Žÿ'“@²¯ÑLÝÔ˜T çÝäýÑã… ¦º³yb@¦‘$fƒ!Ü,ƒ[öd;ÊêŠWì¨Ï®à…#KEuÍë@ñüàî',ʢ뙠"Í6ÊÃê^„“—sì÷1—sî–ä§+ÀVEæ±Zn]© \Ǥ6cWTEëb›§ÖÔc)ƒ¢†ì«×w ñ{ÎäéìPŒyωg´‹¹Ú~P¥Ñš);G›¹º\ŒÞµÓ—5IêŽUÐ^àƒ4ñKLþÀÜ.¡—:eÅD¹_ódE$ð=ÞŠlAëž…°RV¢›]þ·-•ŠR„ì¼=àÊ·dw-j}+”J“Ì;4ðº©2sõèz»Ê¯¹áà½Òœ -üà¥?Zw”ykòÖjšùQÔ›±Z³|t€5¿ë‚ - my•÷[©|b¬õpóF•èmnÚµýCK3zŸµ‹ðì0Z[%øëÛo"ü‹ªeÔŠLŸêWMSXË K ûj>$–=5½*ȆÃ)æÚ<ž,ƒŽ|Ì€õfé\0¤`Õàw”…UÁ>ês‹Pí×—±“ª8‡X=1î¼14XY_ ”)é£ÎþÑD‚3´ä".-œµxT^^Šžê¶ž”ÇB~øÀ¬UŸ™I‹cú®ð&­!.vé:œø{SUj†ç\}Æà?yXG$.þòál¸y¯?ÏÄòÍOü¼DHæ¾²bDˆâùÕM¯6m„Ün¤ž1øFîz¢•'æVx€Æ⵪LÑõº¹–´¦è?˜ÿÕÜ«ONcéLä†Áh:ÿ,ÅÿôØ\«7MŽ\µ@Ïn<ÕfPmI²¿aõµøpÇÿS{Vendstream +xÚÝÙrãÆñ]_Á7ƒ©%„ûðK*rv9µÚõŠUr•íˆ‘ˆ €:þ>}Í$!YξØ)U‰sôôôÝ= æÁŸ?Ëb× óYš%nú³U}æÍ6°óý™/Þ,r½$Æ­‹åÙù‡8™ùž›{ùlyG ËõÏÎwÿúÇçåû/óE†lÏiš9Wïç¾³¼™™óéË¿yób¾ð/´„ÿn®/¯¾Ÿÿºüáìýrtå"r£$Ä;;ûùWo¶²~8óÜ0Ïf0ö\?ÏgõY‡n…2¯Î®Ï~´Xx/šñ© Îbzn–E–E?ž`±¬w°£þšþ7È@kÝ|d¹£žzÕt¥nh[š?H¹Â-Œt‡#}ÃþDܪÆuÅH‹¾DІ·~SçæòêÚåá·†žN1 Mž³H´ÁíºÈ´§¼†aQσԹő¥ƒÚðQN9‰Aýâù!QJõ¬Õ®/n+Åc¤’Gš°;ª5ìt¸Á ¸I=#«ºY3p/t!@£QR$¢’è:˜0” î¡€¯‡Ë]Cvº¨Éf¢‚8uJCŒÚZUû®|@"TõŒ‹q?2Úz(WŠá‰¾¢¸ÝfU©É× !½Çl[ÝÉùî¹cê&ð¶û9ªÆWª¿¸ütÍd2­-¯,¿û|~ùyžEŽ;VSLì~ÄcaìÜ” ^ŸO?’¥àzâž÷tþÓgžl‹9®¤L¹ŒWÅ®X•=î>3<ñ¿#õ +ìcI'y›ØE~v¬4Ýö¼q§[ Âd]k-Ð+ÿùMœR$ ÆøÁ«ñvÂLW¡CLR.[O£ù·U•z˜ÃME³¢ËÁÕ¢(r®Ñ12ç¶CH&/æÚI@…M.¨æÔˆþ™ EB§¨£.îSsÞ‘jÉä6HICÂ;’`hm˜øv"`å©›…áTÄòˆ—P\Û€ù 䛣ݪo +)nqNÁ¦ÔCž†ä´.¬FÊæÀ"ÇzĦìØ×INª”á®WÕ\D¯F¹¦×ÆËFõêdî>IBèAZøs‰µàÊâH`2MeéJrÎ5, +öw~¤žÒ Tcè”k^ÀoCËök¤™ý¹¤ù©¬Ãº»nÕ¡}’ï¾a§%Ápœ³*Ê>ýXžVŽ•+«ñKŠráH¥£ç,D> t%Y/ Ã+x™0ÎÑñTÌ@@„ÓõE`ÓfÊE?”¢Åñ1Ñ%Ì^ž-´AY~\¸š°|ŸÔ[Džÿ…En_E¶E`bèjue +¦ãØ:…qô8 +:ð"æ»Ö¨àVÞ|Çÿ±U¿,b(bmYõ‡{ò¢…:n£ú×"5rV\¡çzY:P‰…ûi ŸX¾í*[+R†EÒb :&ìAÌ$õÈ*y ®v”Þå²Êö +A]4ÅFb™-ä`ݾAš¢–³c›Ûm¶H:Côî©ðq ,ŸǪ‰@‰‹‚šúV€ô0ÊFÅžûá¸C3¨W7“6ûvneD¥Øbè¦J¨¬Íù1¸ :Ò'¡wrmF•»ß˜ÎÇèµxtåð`øv¢wqqðšDóØ`DÞœ½m3Êéóq6’LÌ{¾H_¯qCqÿ ª 1F©›ú¾õ¯Øû–Æï&ЂÀ±?ÍUÍh©hÁôvŠ9‰Ü,~ +aæúÁ1¾²ù?ÕKø¢7âÛµêNµ-Öñˆ¶.¨=EŠ² +ò?ξ^1`sAD†8~|¼x]˜¸Aœ½é:\ ȵ® |Š¼ÊJ +!4Jÿ0îÛV?¢¿“‘@©þ¿H>q“ÄàSÍ{"xÂ^»iBô9È"=tà„™„ÑÁKöŠB +úÓ—!žÌ¹ÙÎmiÕK3b=å>„ÑÀ7†È +Iƒ¤n-Ý®'…ê{ Ý,<–ª ÔØLÊ“‰¸´åÙY»)²ÒB•Up#nºkõÓóqèFaö;*0Â|,]îúVcoG×oNŠéÀ×ßn{#ÌûÝ×f ÿ+Poµ¾I¢ùQþ}7ñóé>òÄ÷l™çéÐLù’¥Îµj‡ Yf{cæ “@tîa±h]EÍÖ}Q™O™¤ü°b¿<ÙÏ +Yvš%¨¡’C.Ôæ V]´÷£Œvòaã±ì±÷íÑ3~£Aô<%q`kH/>Ïà†Þ‰—vª{Sq]K%2€×…|úÀI£lªõ¤Žòì÷,¾«–VæaLìj\B”xÏ¢²Ë;ÆÑèfD§,ÂÓB>_œ6^* +ºÑç Õ¿›(_²täÙ/U/ \[[5ý¤®·Cn¸ðýðˆúFË{¥ÄÎ7IÃéæ·°÷uŸ{#¸ø] È^.®óè˜P9¨×ÿ zxendstream endobj -4480 0 obj << +4642 0 obj << /Type /Page -/Contents 4481 0 R -/Resources 4479 0 R +/Contents 4643 0 R +/Resources 4641 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4468 0 R +/Parent 4630 0 R >> endobj -4482 0 obj << -/D [4480 0 R /XYZ 85.039 786.531 null] +4644 0 obj << +/D [4642 0 R /XYZ 85.039 786.531 null] >> endobj -474 0 obj << -/D [4480 0 R /XYZ 85.039 615.144 null] +498 0 obj << +/D [4642 0 R /XYZ 85.039 628.693 null] >> endobj -4483 0 obj << -/D [4480 0 R /XYZ 85.039 572.191 null] +4645 0 obj << +/D [4642 0 R /XYZ 85.039 585.74 null] >> endobj -4479 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> +4641 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R /F35 3036 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4486 0 obj << -/Length 2995 -/Filter /FlateDecode ->> -stream -xÚÍZKsÛȾëWè¶P• ãI¹Yk¯W›µ¤XÜRªv÷’ˆ´¢Ÿþº{CrR•KÊeÏ §§§§ß=txПðX:yà§ùü|¹ùÝûñç·ËO_/fq{„y1[,2ïî"ô>|¹üpâ½—Õ/w#ïþêúãÍE”y÷w²pýiyÀåWþœ«ëÏýüÛÕÇO.9û´´Œ;W ãlÿóì÷?ƒó ]ñ—³Àóìü™ææùùî,Ic?Mbý®ÏîÎþfiÉZr.»¦¤d0faîçQú}IÎçþ<˜[IF´šøq2w%™¦þô=UÛ¼uq¥ð]NFæ$L't.üE":ý©êp6˜jš½\d±÷Ž”@¬uI*ÚLæÞ=Øk6ôo }=cW/KM9(Zx-H>U ýû(«> TÜ»/—2ù#H˜O‰Õî”,}1àž·¥À/ëöbFxkôDHD#”¥UÑóŽ0½3GâQ¸!™'t?œI<”Ix³zÎY»£#Í ’(j8|ÀŠØX€Å$Š¼j·¯KÙÜg0Üoù¹¶˜@ŒÚ‡m{À „®ËáòêæÎ$ț½Ì(þ%XÌ-hì÷ÌSÛ ½¬\3Ã̽iÊÅ!$¦,MŽ¢'ÈòÇÛ÷W·2€®¾¢y!r~ÑmÄtâ,õÖ-Khœ¡jUWƒÈ‹öÂØsÒjµîÚ¾}„b5î§F¹7枢3ðÂÛ¢¯šG…«Ð0‡Ð°w:Õiåâ¿áYó4÷aô]Ïrp¬‡~ZÏšÇäõñÜññÐ q÷4—`òòŠ`7˜Asbë žf,xZ½}‹Ë8¤˜ò}ÿwpÞôÿy€ˆ1—wÅJZÂBeµHöÌ$ö -Í3cP´lr´ µBq6­ñ Q.¾èU_Û1“\Êø^1k Xx¿5‰>Vê€X/›u±ïµXÛ.0Èê‘YŸ…Ú¸XfÍÕÕ(ÄÁ&×Õ,ŽNÂ,þ°ta]4² wÆXWO|äs%)2Š§ÄF話°»1QÄRºF÷4F!ÄQ#V¿b¾ -ð´æðÔÿuL‹³ÀZ‹?‚0f¬õ UwãK×U¯A‹#3ÅG5;Iõ~[6‚ J 6îÑ* C‹ÜÕ'AÕôNYÞ"²ôòa¥qzéß>ÞJ!ÁAK”±ˆæ…#yÀ’dÜuŒÃy‹j›µ^Z «•ceJ¼À±“°,gÙ7LG ?È…éë¶ÛQÎ}Ñû&0c°W#å$*Æj<0f9I‚“t÷(ëb¢‰›¯’Hú‰âŒ hz#r]{Ê®‡Ëm)(D…Vh Øj™9æ­œÐǾ€ÂäÀÌ™ FæZâ¿n›@So[Öûþq7LSïåZü„¡"}ã±ÌÀ–±õI(³$lŸbÁí ¹–YXTéqçRYÅ’FŠ‰ «®Äô©§ +‰8øBè¬vUÍ’©mÝ•Fd䥠Xië÷”[Rfé_Töøà Üâõ"iÚÙ>Héw¸ÙÊ7ºbûz1VN"î…ð””iÇ„Óû¯Ûº¦°Ü6£ý÷¦äáX à+{ÌÊèÔ=îJ²ÍQ‘qá@#„Ö²<¢ä8ÚËâóÖœj*ÉQ¤x͆FQMÚ>ˆ™–Ž<18u+¶HhËæW·.»ÎñåÑÆ=ç—¶·RZÕSŽÔ£ìÌì¶ÊÆ–M½ÞˆO®˜X)룢)Î'‡Î-N ¹m¯mtÊòPêj|J¬—+Uqü„Ã*Æa;¨߻ªÇÂá^‘JË­–|ÀÝO6Þ÷rT5ÈXŠM¼È¹êDZ+m -¬ÃD'6:ö ‘ºÿ7îwÚÆ5pDÿyî]¾@ŒK¡»•¯ÓæFH¾Š dã¡‘ŒòG"Aé0«†_ØnÌ)~*ºˆ˜+zkÊnò”¢,]XÝàª[ÔêÓxL.Xd€C0p¬aÄG”®€­ ù¶7å]jTýèYYpÔÁèVDÓ!ïZÚdš‚4Ë=Ä1Š§‰)O¥5‘¡89sý¢U• ÁÂ.R½1)]g6^ÈÖxsµ^àCû_ø~¸€Vù.Ž=µ–š©LÀ+ †©‰FñbFeĺ -Q·N†… ±ù ú»\âN{¨Ÿ„á)a"ÉDÒnØj‰-›mïW*OëvÇR¯Àé ¦‡uò(±2!i.O#2í‡ -QIš™½Üô²¸+Ž®\kÐU²0÷–&!VŠdÆë.e^ʼnÇ.‡ié¡íRй€" Mv³ŠšÅ~à‚ЕuY˜îïÔdn÷£ˆXÔ¶às5žJvöÌ?ê6BóÒ¢VV¨E`ªZCtŽ éÁˆ­…ïp«‡?w+ -wØÔíHFtOYÇ%CDZy§’t>eç_«Ç­ÆŠ(¼Æ$†(ÝS8å1И|àÉ“ãÌ©°ÎÎ?ÈüTÇ;âÝl¤çû0.PÕT'JyWNYá…R{ÞŠU·†A]l¢Ø«üœÒ2NÅQ0Ê A›fÓ‰œ—D¢µ¹äƒÔËœ ¸ æ'þ¤F«©S2fbÉIIˆÔ$ýñæpL+|ˆ¦ºíd±z’HÒsjC îÑŒódì ûnDÐmá¾ -âä®<>JJ{MÀrež›¢Ž3£žòÀé/‡Yo8•l -›P^d±ÈÓðê¦×<ñÔ©»Ó ÖVc?b«cŠJP¤qj¤™s½ä´5M²“ŠJÁÔ® ]³¹wMæI‚s‚MÇ@ÇçôΆZƒª¶´ §Í›ÈÎxë5Å}ËÏ ˜¼n¥axÆe~0láp<ƒéWJ@ †=Ÿ|“ÚÆÛ¬&¡‰œIi±|+ξ­Mn~Q(”½Fó}ÿN2£Q•°`œ_ÆߦÚßæ•g¹ˆ›FÖrÞG¶Ë ³+T #Z~ä“]ãàt² !S»àf¥òÜk+2¿Õ»È¦þƒIÁnÓÍùâ´ØlºãŸfJ=’Ç©lõEÞqê|Ûþ‹<°Œ¯köµE7¶ -|uc ¹ÎeªI_PÛkŽg”i_¥`“AŽ‚LÁR6›±m“Ž -AÅüð@[œÜæ§j·ßÃSÔÔe!Étßë¡bëÃçš%&nÜç -çE!©2kÑŽ\×~¨4‘p%̈µÉØ( ŠªîоVB½[µˆSSȯE?اª$¥Ôd{ø$¦íâÁ±“5ñá–ÙIyuerì£èt_!ƒ¡¶ÏQk¹7’4b±>†R!R+ü =ù ôãWð²ô#6ÁÄ©–¨`k¯‚‹Ã(‹¤" 9TÇ¿÷‘u§¤îº—U.Ÿ ÛV*Ûµ¸,fæYSwÚàR$; ¥µf:^kì×Ú$3q+íÏŠŒ"å:1Ñ“V&ý2 •í"¤¡X~;m¹‘ýýá(I,¿`f"'æÌ¡ëæøÍ(ðÎHŸfñ¤2î\‰D*nÅ3*ôGÛP’yF”¯äÙyV‰ …¢Óz‰ùs2T¤áàôáP:~àèßú)1NýDþsÂëßè诈ðú ö—¾$óó,šþ¡/%Ÿ/à t–å¯NãÌO³x‚ã`Àb­endstream +4648 0 obj << +/Length 3250 +/Filter /FlateDecode +>> +stream +xÚµZmsã¶þî_áé'y&âñÉq.M.íùܳ3×™$(‰¶Ø£H—¤Îq}÷Ù]€Eešd:7s„€°Xì˳ G—!ý‹.ó4“â2ËWAšD—›ýExùH#ß]DJ^š \¥º¾¿xó×tu…A—÷Lr¿ýiñÍ÷_ßÞûñj™$É‚†¯–Y–/n¾½Š÷Ÿ®â|ñáãßdðúj->rþût÷î滫_î¸øöÞÛri³J°ç¿/~ú%¼Ü[?\„ARä—ÏÔƒ¨(.÷&M‚Ô$ú»¹¸»ø‡[EÆ̥̚9ÙÒR,£"(âtþôKœ6-Üùcê6AbVþù‰&¡C§¦X¼Åk:ø°9 }뮵œY=ÉH–‘[=Jg¤ûuÓðÂbñž–»“槺¥ÛB|¨/ +è©°ýȽø¯ë?3á£Ì: <>ȯ»÷×Ëu)][tå‹=ÚÕÀDå£L¥ƒ™$££Åûk™©dLgɼ‘[¿HÇújg` Öû'"mxÇ}Õ‚lÔíID,m\IÁÇ~®ÇMËS:…|©‡¦ïºÃ(¿oªñú݇»@~YéPóD:ùj‡á¯2:ÀÅ1QsT¬nhMt˜/ðÿ1—ÊÆý7·oÞÝJû¦[öÖ够Yòe¿üC¥|¦MÇÂþåX¯¡'M=Š¸òdQÃ'©7²#-Ïbî°ΘEiùÏ„¯²ĺj©|¤Ô¿O;lÊk¹ ÃðAénDu®åðÔq*¦`ÎRÉTós¶§A’­Žl'"kJOm'ZD0 4Ä%€‘ëwÔ÷-°³ÊÝ—ª—ËŸFog؉ƒ"ÏÏp“DA”¦¿mkwå²[—ÄLAa›jÏ’™è­æ}%T¥ö’¹;Ñ.UJP½VJ^ç´oX7éûÏ[h®ºV+B»j7¥U¾Â4‡THokÕ¢ hzzÛŸ*¡ê/é7›6éÛ¾É ‡&IO¬‚¬[lºÃl`|S¶²ÈVèÐ×@?;³y®‡ +!Ád"7ô}€\|ïƒýÛÊz®L4Žœ×£¬~°¯tß5uô]¹µ,•Ã8ãCäêN}ìä[ýF /¼¥gÝ«*1릶{+Á¾lËÇ#­ ho±Z|ÚU­Pÿ6lým­Œ.»ÃaíU1Ét=_)«°ÜzÎ…ŸöÇ··D¸ÄðÚÙzµkžsÙên0o†¦ÄÛˆxÕ‹LîœFæî€Ø#õï –í8 B +Ë`û¦ë÷eÓ¼è‰M’Ãg‘z“î›(ÓE6¥½ôýø–íŸÛ¯îÔ2"ºI ǵ‰ruÙÖIC>B ݱï°çXYÌK“°V9ÿ]…3Ê=÷An)X%©:‘¾Úw˜Æ) ®ííF'ùœ¥åÙæS‰ K¹‰‘U"^‰²Ò—lºö½ébW5OÃ1áé0yÓÅ¿ªU\ê•û²ÖÍ`ÝÄ"D.e_çê¦%3„n>†Ø^3‡4”G&zÜû«@ÃI…Ë¥eñn7ÉcVHñNøàQï-¬jÊÞ©JRÀ8æî#JVANðô>ȺٲÑ^ÚÍ̽DaA"ÖÉ37BLQ8扉?qE(:²›{½£Ó áÍqLWÒ±ïŒÍH:ÈàóÎŽªn¡Ó ÀIœˆÛ£/®™] ¿€–¤Ôuî'?Š)¼4C²+xÓ=úìzÛWGòˆGhÖM5sÛG1µÝ¯·37MhY… à +‘‘ÉM>ù$ü qR2¸¾bŠŒ‘;•"Ú‚¯åPµ×ûÁ—å„Ƨw7w²ÌàDì#Yvh&Z‘C«ub¶v)¦@³}‘Eádb¡Ý›ùaý”ƒûÚ¹ á™C{\‹Iç¿Ô=ŸÕ÷B@ƒw±ž ƹ¬G¨E-ýõd’†ô„ •Šqp>n+ó%A«f{¤™Ó Zñ?Eî <'÷¯f¼àèt«æªï1R +ñC‚–âÂXQ ¾ÍhlzÕÛ¥=»Sxi{ä¸õ°_çv°ØK:X9€ŠÜ®äHëA˜‡ùˆhÒ Ì~_@,BrÚ¹Î)[I +ö‚b•ÏÉkÆñçA–çÔïçÁêœÛW0ÄÑôñ…õìÐÏø…«"ûŸ¢€IÒA]Ô†²ˆÜK¡žW.vzja@_ŠÈÚ}^œøDPòmÒ÷àp7(€×Ð([V[©ûJ~ï¡œrŒõÒø)V Õ1|ÿ̪Î6ñJ» ÕnËØÓ[5EäW·*º!¾jü†~¥Q_¿è*ãs[†ÿ?%B$€0š·Ý8®ÛjãÛÞ[UŽ¨(Ä*¼°ü5ÖÏ2&åÝ!K¾;Î83HdHݵúŠñ‡Ô-À9´2Tëzë)­uІÝECÁ¶Ò×µH„²„q²N¦<¨‡â3Ç¥¥Ùh‚YÉЮ<ݸRž´‚²¯Ç圭¶Œ cÙ–ñ$i½~‡±æRZîEj;HDVpuè­p|¦Ì~C½5j”º¸MËŸ¤2Óõ# …†ìfå(^VI¨5€Î…’e„A(}Õhè­‚Ó\þûΫ=°¨`Y‚Pb£iÕ³HÀW¶ÈÊ´’R•ô¤üã +…Dä‰%¦sùH\tR-¶ïœZ+8Ti§ Z‹5ÌÁÑõãÎ8ø!£áX^mvä$‰vëªökG7JûTÒÏ•å´ìhÂÑŒºc%¡ÅX~Ùj“½b©«=sÝëÈU¶´3“1=!m|àaLÌ¿òÆÐ:C–fÅÚ‡Û3&‘Ìò€ói³&ñµ•‘ŒÌááx•Æ¡Ýs€8 ²DIN@ï8†ò£³XQÍ"«¤ÈÎ@E$ö‰¤™“šl×NñéÝ•~M=S,MŠô(TÚb7¨îŽ”=ê‚iÎq¤Ö8(£áR­(mËÖ*Ú‹Ðü¦¡EŽ÷)öŸ¸ Ïi@†Šâ`B8-IfÀ»lexdýDËw.ë6AÇ<ëN£Õ1ú{µAÑï•q@ŽDç¾á|TþÄÿÒë#ãJdÀ9µdÜiYq¤\ʱ5Á6¡¡¼Dз Ix0žíô¤$K‹ÅM7ÊfÜÁ`•‘úbñ5hßy㼡«`ìÙ•HYHRe´zyÒé«· oœë—¥³Úr/Ôð”Í[þª°jÕÜUåü·Ï«@(×zU]ùý–ÝÐ÷”q}ç*ÝKzä +òÙ; ]4]8^“N+YmÉúíTyxµ›úñ~Ö… ÍÅëÛ”Û-»±A«4ê1R<ô•0Ÿægò ÃD÷"3¦ÊkŠ4^§wÚ¡‡å±é°ÎÅAËRä÷øåŒÛž‘È“L·#6ì¡í®ŒÀæÏ[ß\¬Ì³d™sxW&'[±éR!I©ïS}¹ëMÙø%¬Ö•¬àŠªÞ«fÁå¡7ДIXÂz­àúŸÉÕ +?J‹zªfð ÎCY7Ã_ô¹‹«Üp×\á1Þ3ý½ÆÆB,“’ñºÊ‰I" Cm¹þ»‚!þ¼w…A(Ê^ç•òñÊxê§ÄÕ¢€R„㡦º\k°ÁÒ³…y×Êå-%>fLœ^#¡ｑ‘mœÇ_r÷ðè¬êËU +8Ȩ$wñ«¨oßqrÉ¥N;iøˆý–Nöc=¨™ÿ0GÈÁÍJžœ{20Οˆ.œ½zgÖEÏVÕb`ò£ŠÚ0û,œåA(6ñ'ß…c}ž^}ù¥9y»^eG¯jóoÂÅŸx–¿¿0¡}™Ó7¶ªU›Ûʨ–GíÅW{ø7Âé ˜Ð£à\¦; 2‰PÞ^›'è»ë¸O-„bi¹8È·_sfjÈýJ–MüL+ +­¥î{gûÖ{ÎG Ô$ksÙ@íS‰Ñ ¸ð•á(RÔ­Ë,ÑQŽkSÅ”ª½r?Ó–òQ½5y1WÃ*ÛNùl#§LÂ¥oªqó‚æÊ>Yg±+´Þb_y¤ ½Ô”H·/k=Ê ¤?£Ù!2˜YmR‘þ¹?[2ñô&hŠßÖÌ"}Í Ò„>ƒÿ·CLœendstream endobj -4485 0 obj << +4647 0 obj << /Type /Page -/Contents 4486 0 R -/Resources 4484 0 R +/Contents 4648 0 R +/Resources 4646 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4468 0 R +/Parent 4630 0 R >> endobj -4487 0 obj << -/D [4485 0 R /XYZ 85.039 786.531 null] +4649 0 obj << +/D [4647 0 R /XYZ 85.039 786.531 null] >> endobj -478 0 obj << -/D [4485 0 R /XYZ 85.039 766.606 null] +502 0 obj << +/D [4647 0 R /XYZ 85.039 766.606 null] >> endobj -4488 0 obj << -/D [4485 0 R /XYZ 85.039 744.844 null] +4447 0 obj << +/D [4647 0 R /XYZ 85.039 744.844 null] >> endobj -482 0 obj << -/D [4485 0 R /XYZ 85.039 659.712 null] +506 0 obj << +/D [4647 0 R /XYZ 85.039 673.261 null] >> endobj -4489 0 obj << -/D [4485 0 R /XYZ 85.039 624.302 null] +4650 0 obj << +/D [4647 0 R /XYZ 85.039 637.851 null] >> endobj -4484 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +510 0 obj << +/D [4647 0 R /XYZ 85.039 135.683 null] +>> endobj +4651 0 obj << +/D [4647 0 R /XYZ 85.039 100.273 null] +>> endobj +4646 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4492 0 obj << -/Length 2953 +4654 0 obj << +/Length 2517 /Filter /FlateDecode >> stream -xÚ­ZÝsÛ8Ï_á·“gÖŠ(êóÞÒ¸ífo›d÷Ò›½}PlÅÖÔ–\Yn6ÿýá‹íHNçÚé´²ªyðG’Ðõt:Š“È µÍ7gÞh œ÷gJ$&"2±dÞÌÎÎß…ÑHynꥣÙc«'õÜ0F³ÅŸÎ寷³·Ç­µ’ãI'ÎÝX9Þ\ 9pΙû៾su=½û‰snj뷳{|¿ùø/&¼ùH¯,suýž©ï?]MߎÿšývövÖn-Mif=ûó/o´€%þvæ¹:MFOðÛsUšŽ6gA¨Ý0Ðò¾>»;û£Õż`Ä£úP2•º©žF2ŠÜÈ‹Z$}à*7 CÉ0t£ &$<ín>`†ž3»¼=¿‚÷[X};|DÎÓx¢œÈͪÚãï†é×ø;oÞ\ÝÜ Aún&§mîdÈfö쾯ÜÐÓdóÅz=ž^ -Æâü·`×ùÕ-“ö»¢\òÏ2ŸwM¾Áð(ÏÙ3r~ÿ6#'«‹JH{¬jx±GU¬rUí¦” ‘m,E8$§!ÕzßÀKQ•€ikg¶™-ëb“ÕϬnCš«ñün±C‰Â-Oi¹hÎD{1ïÍ-ÿ¦1´†MÉ‘ž8uND°w làe!«(ѵ¿á?ÕÈô+—U¢@^)D’)3~ðD-kÎÂÿõT°fi~ ½ó¼™£à¹eÜŽ[± YÌôÏ¡ÑÈf%j¦8’`ÍÀÜ—X\óBÃÔ¹ÃEÁ êFïõ=QÂZw,eD¿I|Ž«^•„@µ|¶Ä²†_6Ù—dŽÔ\ŒM^—¹ h}*{€_뜌Q´¶'u‘±ß-ØBv%äÙ®ôrÅ톂Ԟ6t¢ƒ€„În¿Ý‚ëÄ€kcönÁ"hç3‹•†—¡Ÿ®…šáABÑ£ƒ„¼¼”Õ,d¢o²Ö@Ƚ)Ñ.£Žf®'Ñ´ƒ}d¥Øs±r†”Kžšx‰ÌMΔãÜÛç²jøÀ¶tˆèô6,ˆÆŠN?v½”uÞ·®^Šõò¤„Ï{Œwå‚Î&XþD€GŽïy³À9>ßÄô¬i7d³mdtS±°½«æÒ ~XHöý¾ÕµæšýÊUÑ+ÎQ4½á']W8ë“3Ö þ6£SðÏ@©Ù cÿd ·d^ú4qu¬[=”œÜãÉ”¹ ¤ŠS³™ÓÓ)å»Zùó]®ò9îõ„ÀrЀEáOz>|ev -…¬9¢Ï³¦=“ȳ¿ÁÏKBòü] l«Hñp sÊÇ%‹¹:Ò"r_àɾžõ¨Ò(÷ªŒÈݳ cpδߣ1]ûnÓº8H35MÐcià† å»-iÆòÄ(uƒXŸöÄNfØE§ô‡=ñÄl'žš®õDk¾){O.ñ.c—áôÖ9Wõ“Âv‡ôƧ¯‹–Ì0"ƒvéaNÌÖápjºk¾Áy·Nô‚€@P‘ ÜyF£Vù4 -\9ŽOCÓÉ C#2hj0 ͉Ù:hNM×BcÍ÷Ǿ»«Áµ,·By‹=‚Í.¯íƒØK$®ŠO_Ö-™AXŒ šÂrj¶–“ÓXìùúOÎbTe -Ù®9v:Pp‰ú§‰XU{WÎk¦|šÞÁ)×{µVd4Á5DØ OÕAvb®±n²ßM,Ä|ßÇxBÏœï¹Î…tÈ8ôüýïtöfw.®Á—¸œñgoôýÄÒøû³ÌOHº/âc8 êï×ú³Ó`Гa×u ã”Q°³±Í‚¯z;®9ùþ@­u΄Ϸü:Çe@%ä²j¦Í?dôÁÅY|„õ„Õ#Ñ2~LŸ‰å"rM1„ ®ƒ$ÕT${ÎÆIà`s¥[[¸ŸG`jÓ¬pJÙŠö>«Ñ -ª¯¨n•Š@"¢Ù {kø–&W´{ô}SÞ–¥ èúLTÀ³- û¥¸xäÛík7ð6q|g^•x§\ qNí„eÁ3*§i]”»ǘ%NÂáiç‚@llWÔÀQ´‹ySac…±&¿À-»Ãâú&fü˜Wu³2Sûõ×]α@¥¾d²TùÃh{/Ъ7íî Yspbïáà„SeF -/ãZ.ã%«nV}^“=ìòrŽD!µvà¬Òê¢ö˜*È/í""ã2Ñð""L¹Ô>€_+¬óq˜Uñæ%“»n*ÉZJ±µÜ×]¯>V\‘‚æû>_ÄñëBðBr=U4Û+ǃt5z=?ñÈ\Z’›ªÉÖÒ)ÀwÚ]i ~Dy$p›Û,L©ì¶­ÊOåP›þ°¿îe<§ç`…VJÝ ûÂêÚup3JQ®·×¢:èIžddÙ–O½D¨Øl3ÜøºÝ¾Îµótôñ\)< -9¡ñŸPjC ¬p’åŠöÈrœªÍFú¦=<«óÊsŽÛCŒ æPTÏãD“û„ G3Tµ*Ì®à«\…DEÓ³¨—ña 7W×Ó”[À…4áç¶uÞ¶T×vS*âæµ£PÒ -Ž$Ï*Ö´NÜîg ^G$½ ÒòuOºƒÈã»ö7Âx4- ¸Øú8VJ9ÿf†·v™õ·bžKxÝù¬êÅÎhÊDgV÷ÁRæù´I¸[«q£¬MÒ=‘ÂüP ëÇp¡UÁÉ+¥%3Øé÷CßuzÐé×ÒéŸRóþN6 l÷(r.ØFJ9˜7¬¥‰JŒEhÏCË=7xmÌ`óßW‰¦\ÞÌÅq!Ó´!JÇÇ 47•Õî$&º]eä~º¾úÌ侃äp›¢„ËEM]ï -ã%ržV•5Àæ§Ôù‰Å[³ß‰¿›éÂã.0ð¦Ï“>’Ø¡ü®‰¬Ôѽ‰ù¦¡ìí:£¤T:§Ju}k }(æuµ«fM[­}IriL U±î”4+sÞáecœb¹¢ÀÍÔ6öâK{pwEݦRTYkª6ù/=0ëý4¥è§Éá•Œ»²Hæë -Àz Ò¨:¹Œ®Õ¤KCtý²0ÈÅœç@Þ\ X _3‘‘;mƒ1¹cBTŠ$Ë ‰Yܵ-œýýAÐ÷Aç\}xðÃ1ÿ2ɾø‰ï$LÇ „¯)%_Mž¸o˜V4,cÒ§ïdëM{ÉÇ÷9;®&+JÎϾd¡”ÎÛT ¶Ñ.”1Ïë\.º »Ý͞者ܞ› :‹ïYŸi{>â,~êI†$HÊ1’fÍÉ𨥮‰q»jݪUôéÏtyÕÁ7›ØV1G: ¬°‘Á=7×lÝiâÏ€‰ÄËgÍ‚÷`çöÀ33íJ®kiíÓwP*„ê\*9k,L1‚šEr¼±ùŸ?Ò¹X7Öˆ£­B¹ƒ$)A&Oö&¿.wH™RõAZ‡MÛ }]P¾çÆÑé¯ – e’Ãƺ§ÜÀÓ­"Ä |<Ôh91aä*‹·W¿úk×û¿ùO°“FñK£º5‘ë[«G£×ˆw¶}Ù! -<7Ô¶Ýÿ¿q¬êÛ(8mæ[—ÚbîòwÂÉbÎ>{þQm‡ÇÚ ’j#Ÿ{ËZå…®TÖÎVæ˶æ6]A7æÖ ÅݳŢû(¿vúã. µ—güÄï’ÓKëtÕV¦ó×jÌÃC×¹(rÃèt#¾ö]‘yÍu‡gû©ž{dq¯ãZ¿â·¶vÛ“†‰×Z†ý˜ÓÎÆq q,ôÁ›B)šz<@‡n {?Á_Žä?ôŸˆ¬ö¼›&G6„CÅ1‘zLJîÚ‰î±ø‡WÌ:endstream +xÚíËrÛ¶vï¯Ð’š‰hà3;ÇJS÷6¶k«u;M°DIœP¤CRu=s?þžQíÌ´qWw:©Às€ó~ÀbÀb”F~ ²Q’Æ~¤Äh¾9 F+À|8†"…~Gˆz7;9ý.ŠG"ð³ Í–D2[üîv={3ž(¥<@'I’z—ïÇ›Ýeê]Ýü‡‘ïÆáÝÿww{qùaüÇ쇓÷³Þ•“Ðc…w~9ùý`´¶~8 |•¥£GX¾È²Ñæ$Œ”…Ê|—'·'?¹SŽx×€dK1QŸ¦¡QD"Þ>0-rßå%‰½OAL/oáGÎg pyEË€n›E>ËÄ[mU—õê‰éºµîxµÁÓõgÔK~¸ù¢Bp—7lω Þ´mõ}™ÃåQ"éráMîuK$ &Y×mǧàfM×ä¨tÔ´@d$b““|u TÛ®¨+ØAÂØk·€xO€‘º£"ì%@uü=ñºÊuƒ‡<ñF]– Ÿ_Ÿ^\Oò +X¶b˜íí“Õ-ý‚m™?òÌê¼~{üËÍ3„œ_èô—×ï]ªTè-jöÒªîxq,3²¢}{¦Lü ã3ïÖV2T_šzÚü~¼åß»…‚›àÈG¼7 <!§¿^#M†Œ±r7ü­»ÎžºyèZv5ؼ­Ë?ÉsÌþAfêÖº Wz“÷·gŽ¿ s·&56ö¾ÖÜVt +\’¯”, Q³Ú´Q§=äS Bt{2àt‡œ½ˆü,ñS¥†âî…Caùbœ +ÿðÐÔÓˆ·ùaôÕÏ׸Ÿp“pÅéwªOE~*R³#®e¢½#•ôe¢ *Å…:|zÆï +ã Ztï9e†Îª<è˜,ò¥–ç·Ÿ„ +ÁÕ5úX$#ïr† [ô¬’¸ž6ÅŸyÓâ2ïæìŠ,ô™3‹nâ°û§ßfò›ÛlZSÈæFšõƹ%£ëϘé¾"Xö÷SÿŠ3’ˆ—y÷ŽÝÈdÄ4ÁعæÚ“¿žÃo.ëO[˜Š¼—`œØwÖ¦mÞØÈ^Ϭѿä¯÷(F­mmã,Ðv‡Æ5I¢þ ÅŠP”Y C~ž^ÓðC8þæ*ùÑÆ(èDÆ*ó¶¦ã:çv¨)\™2H¸H½?~u;ã*Í(Ì­Lc‰M˜sfµûSë~Ñ{µÜ +VÂÏÀ Ø‘i ÅA¿ ¡¹Á~š 5ƒÝ¢â&_¦Þ»Ø!DÑ™½Ü âªß à±€²LÔšÓ§MÁ(¡óšÂÃIZo‡Ñ7 Eäý6NÁ·œ.Ñ·›yïz×s€ÐéöûˆTÁü¹Cíó7?Hò¤›W9é÷¥©zM„‘SªRÚê¢Z½e»Å²g7™$~'ÆnFœôæu…Õ|…­Rè’ «‚ý’Z/d­X u$Œe¸ï +*¾Ì„‹Lv´*ª PÞ©®+zšWt¦…S㼫›'&ÆQå ÍFÓÊjþ™×M“óa¶ièíšã@ºZ1˜µ¨gì(ÉÍ °¢ïíÈT—[7/ôîp ¦°]èÒøäÂvÑp¦iºBQß·ye]HÅ¡W/ñ—EƒÏÇ1õíŸqh$ˆŸ— Vv&ƒÕZ·¼­7gäƒPq;]Ó˜BÐÊ´»«m³›r„‡ZOÏ1º`…ÐýÞ÷—…Q†h ˜]˜_ãÝ@JBý88Žñƒ¬éÆ.„`ÿ¿%1AyÐt™˜oÓ60¤&ïË›7Ø«JcYFÑÖº²öοlwSŠbÆ8$­òÏ´¦a “†ãXP%4•L²'ßb„ï¹Õ±žŠÍƒFó7ÎCSÛŒú‰($=µÖ¡"ãPÑ.ÓP–‰¬E¦SÀ/Y­É l"ªÞlŒìh +¸G›N)›E»PvqŒ *l\Òèù„©(J9áQk`6™ƒL‡`Žè„:VI˜š—™‹ËiÆI¬à=*¼RßÒ…KC‚¤6…zKMÔ%¤*ó °Ž}ŒÐ pp2RTj²4•öîbšÎì1ƒ4r€eüf,„ð~a$æ³^üs3fF‚ñ»¸¬›ÅN:S› t3¤Ž*ÏvÎZÖ¦lœÍ{ÆQIöÅÞJd±‰høum"#_%»÷5 `h°âõ†ÚÀ‡QBà<1‰¢¼¯¦DSAåwø8cž¨*PNLÀ“Œ»qÌmEªÇ +`O3¸ô•|Ž]%`ÎÍ^nÝ®æÆ¡xPB'c'ôÂ*I=÷N¢F.©ÛÝ0öçË‹_yÕ{ð¢LiÓnÑ‹MQîa®!ëÖMË;×uïZm2AèñHö¾5£ñö ‚Ñ—5,5}š yÉ BºæH qÜ‚žj£JŽ‹PŠB!v^°Å¼©ÛzÙ1jêN*\T3ïStQîéÖ6’áÃ5r«µU@]fÅ÷fÓ …riª{2Õ›üÍqf™—YFeNf)1ä*]Â,€éÅ‹]3 ÐC}!Œºu ÓÔBÔ“]©¡–«_cŽM‹ô;OÁSLk øÃd‹Ø©Ë´”Ñ(Ó’B%O =6L–jYEC¾`‹¬„Cˆøíû~¿ƒDË+[Àé¹U¦ÒKŽ©?³7x¯"OÜv +:¦áâˆ]nÜ3~s>lP]T~u†ÆÍUî +-ð¦Cc9ž79µ2ÝuÒ…B ”éµêNÈYØ ”H÷(ÀºT Úo}€Ì ˆÝ=Iöž:È> endobj -4493 0 obj << -/D [4491 0 R /XYZ 85.039 786.531 null] +4655 0 obj << +/D [4653 0 R /XYZ 85.039 786.531 null] >> endobj -486 0 obj << -/D [4491 0 R /XYZ 85.039 766.606 null] ->> endobj -4494 0 obj << -/D [4491 0 R /XYZ 85.039 745.613 null] ->> endobj -4495 0 obj << -/D [4491 0 R /XYZ 85.039 621.549 null] +4656 0 obj << +/D [4653 0 R /XYZ 85.039 682.791 null] >> endobj -4496 0 obj << -/D [4491 0 R /XYZ 85.039 593.845 null] +4657 0 obj << +/D [4653 0 R /XYZ 85.039 655.39 null] >> endobj -4497 0 obj << -/D [4491 0 R /XYZ 85.039 567.352 null] +4658 0 obj << +/D [4653 0 R /XYZ 85.039 628.594 null] >> endobj -4498 0 obj << -/D [4491 0 R /XYZ 85.039 542.375 null] +4659 0 obj << +/D [4653 0 R /XYZ 85.039 603.617 null] >> endobj -4499 0 obj << -/D [4491 0 R /XYZ 85.039 513.155 null] +4660 0 obj << +/D [4653 0 R /XYZ 85.039 574.398 null] >> endobj -4500 0 obj << -/D [4491 0 R /XYZ 85.039 486.057 null] +4661 0 obj << +/D [4653 0 R /XYZ 85.039 547.299 null] >> endobj -490 0 obj << -/D [4491 0 R /XYZ 85.039 278.114 null] +514 0 obj << +/D [4653 0 R /XYZ 85.039 325.807 null] >> endobj -4501 0 obj << -/D [4491 0 R /XYZ 85.039 243.369 null] +4458 0 obj << +/D [4653 0 R /XYZ 85.039 291.062 null] >> endobj -4490 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F62 4047 0 R /F58 3360 0 R >> +4652 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F62 4159 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4504 0 obj << -/Length 3072 +4664 0 obj << +/Length 2996 /Filter /FlateDecode >> stream -xÚ­ZKsÛ8¾ûWèHUE ߽ű'ñìÆÉFNù0;J¤%®)ÒCRqòï§_!‘’³›”ËE°Ñh4_?Ê9ðçÎ’Ðvüt'‘úîl½»pfèywá -ÇBXÏåÝÅëßÂhæ:vꤳ»-'uì0fwùÖÛ÷o>Ý]ž/|ß·€s¾ˆãÄZÎ]ë͇Ë7H¬×Üûa‰OϺ¿¹½ú8÷ë~É·×w÷øþñó?™pù™^™çæöSß}¹¹ºžÿy÷ûÅõVÜXšëû¨ö_üéÌrXâïŽí§ÉìÚŽí¦élw„¾¾¼WË‹kYÜÌxÔ”•B?±ÃÄ›É 3¹®gû®7‹ÃÐŽ‚˜ìô¹˜/\«kª¯¸ª¢cËô[0TÁí,Ïá¥e¾ŽÜÓ<ˆ ¿jVYůo³>«š ¿ð€–¥·ËšŸý¶àFÞì²²¶OуÕéy| <´ðÀ5î¸vàøZ.ü?ŽÏç:‘„ɹ a;A¦óò†ú¶Ooç÷!â±ÒG»Ùž±zTºÂ­ÈžF†r@¾oêýÿ+Ç¢^Ð-ðíäÈ ýšõßLLÖÄvd#OWöóŠ‹ì H„ÇF¦Qc?·%¬·ÏVUa@¬ ƒ““9¾º"èŠ@51ÝÂ@ ,Ö‹m'eõ?µ ¹A˜~-såÎO÷ Ty,·×MÃzPU‚òÀZá^Ñà"—Ñ2‚ˆ´´bXÊð£8°ýÐ; |ƒç4ðÓKÀ?3á/þ±Ò“À7•~ø†¼ŸþyÝø¦nü)¤®'!š†¶^„¨ÙqD⾜¥Ö~Ç! Ò«pìÅ€µë¹…(õ¢T£Ûä4‚TŒç -©Èßo³ž¹¶yEkÕ' X"¬C½XâPJS 5¹øfÍ|ƒ`׺BB[pgƒËùŽ†Ë,\Èw!-9Ïp\ÆÕ[qÒWÂðÞWž3¾"L/úÊé ­¯)=í+†Ò/ùÊ ïç}å¬nÊW Ý~$I@=5GxŒ½²MªÃ»ËlvŸ ¯îlzéÐó(}LL”8vœ$Þw7cð¦Ð`†XõLyc˜Ú¸ûØûö;€Ó ­½Êì°B¬SgÀ%&Ðîóu®2ͳ*¦ ‹ü ÒÎÄ©/÷`žŠ.`$q“û#}—­ç^lmÉ … Ò -Ap­ srÅwP°!L*~ý‚<å_{é½É Ž%x@Àµ ‡œSî†xÏùÍà9í~Šé%÷;3á/u¿c¥'ÝÏTú÷3äý´û×MÜÏÔíGÜoy¢FOûÞfm¤¹SκväGÿ»³¹àlþ¯}ácDŽ™cð,/Ž¬`ì%7œ+¶ž;&¯«RÀ,ô&|VâJäFH8(Ëà!a P MSë~"ŠŽcq:X#yKq¯0:ÛbSvª³S‡:îòj„xK„þòæã’ (.Û ]ˆO¡£#ö?À¢q¢ea¿ŠËdÃB¤ì}ÀÈd…¡7S8—ÀÁÆR´/ÌêH¹È‰1×ÀÏÖðl„Ú2hIYWºˆEŽ!}ÖòVbæŒ'„ä€;ìU÷ÐG*~ËÖÂʆ@KnÙrªÓ´Ÿ•ˆRì@T²nŠas`‹o6ÉËð8–=jw‘ÁX{VÙIë¨9ò¢/ÚìÀHÅÀzÖ[?€ e¶Fžu#Kî k¡óžP–3e>Nååa\xÝ­éï4z›Éo–ðSßFªeÙÏL滹]»§d¶ËW7Äؽ‚QTñÛjœÞOx…~JȦEBû_ÞĘz·d‰’Í#aƒydP^QË™ — ‘]>ðóêV=¨ž[ -6ä_H(€|ѹÁzgO J9dÎgk-|­ÓŽ4’É Z4r¥Š„3ëèÍC µÒ4!Á;Dšž5cØÄÌÃû¹Gû‚ZE $‚Š{e‘0¨U²!(õè¥H©“pa FX¨Á™šZ ¡Ý‰qwždOpp;å y#ñЇ×v8Ÿ}¹úÄÝ`dùšo-z ¡hå1>›*£;|eb‚ZSíÅcñè(Šç¶λ¿wûÕ­=Ú*q(ÕUщ|$ÞÛ’ËSnî&G¸sÙ O>c‹·õȉ^Ë›OB@×É•ï¨[š¤"†°t{Ô\U;ô{³Dvb-³{•ñ°§V(Úùª ؤ›X‘Õ¢˜Þ'h¢éÈ)†åL£’i*öz’6uXtU<âÞ:“—”älÂD¡ï¿r‚çàJD w ¿™­Ú¡4’ì 0ÒÅZÈGýÐpŽ]Ó /G\÷Äj ÷£ ¼G˜´÷×4¾pÕÝdžú²šœ|_¯…,k;T0§N…˜ûQàpxiØ9‚{PÄŒöz ÌðÜwÑðôÇg6‡,àqñs˜s@øPå2ïs‰PGî}'ó“Ÿ…{ÊË™Ÿ˜Ž•t"Vº=—`,’€*-.¹ -çÓ%.ÔH‘µÜžÄ{€ÿ‰KŸ!ÁÓÉ+pfÍ/(¡Î"0ív1zðœÎØ-AÎ^D Z¡÷‡”Â5Ä£Sª¨B™„xbÍFæcÐO¦¦lÝ6þLâC5-jB[—¤ -›˜„») ]¡-ã4êJ_G -·ý÷?Ñ¥GVùVÃÌd=`(*"¯eQ@aŒp][á)«ä–žÊ•C[ð¥ÊeòA4‡w%]¯Ë ­X7«Ë`O¥F€gSO',µßlÊD•bÐÈ* T -Õß™\|ƒ€‚ K «˜ZÈ™¼ÝRÔ“ÄÉ á>0“`TÊc¿Ø/ñ d&RTÅúà¤ûŸxlLày $§ö4Âôž»X^ãmt€|323ÐVíaP4Ý3×ݶÒÒ‘¼•¹?t´á¬³•¯”5®Ý¹/Ò 6—DIŠbvR¼vÕqw½çr#Ÿ™÷wõÄêõw•¦ÂÏ·‘ƒ©WǤ Ãcqy‡ò€`ÌÆç= e"M?øXÙ±T-ž?ïÈ ¦+¡oÕ1“˜ ×mÈ6/ð]…´S{ØŽƒÈ‰½„è›P{àÄÄAÏ#“KhóªÕV!Ie.úñùЊ½0 ë"kÉÇD’R‹èâ›Æ~VoÔúpØȱ™\I±HÙ%¨­.b”‚r -úä‰N‹hñá ad!©ÝåãŒ3`X;…¯!I@ª:S¡T¬U•HkV=ß#ã«|sP9vOò݃ÿ`4þŸ™šïä]§ƒs&C³V„òBçD~W4hCx¹–·?q-×]¸!6¡°+ù›UëHÀl€<…ºn6“v”?·E•s‹îËà™‡¾´S‹B¹ÏÛRÝ^ ïÔډ˒Ĩ0‘Ìߊô¸c—õŸo^h]Ò`À¶-¸]g´Í­¼ÒÇ©#–iSľd¼á;-NUf<È8l¼BÕCõ½+8ºgš”NG3oË.ùÛ\Áôå® ±»k쟀ĮÑn«[Pu§†qYÐKäi*¦?ÇPx²5¬a5[Ó(6¦Ì„Wö2öx;ÄwXWÙq´nuhV>Ûbþ:{澓„‰}|˜g¼5owÉß•.>.q©/5.ƉqÔRNGé“Æ]%á=¨FÀ¡ÿ×[>“}Åü+ºÌP1¢]ø9¶ôÎå" #—Je|d #ÈnÖlER2êê§ -ë¦U_Y‡t¨yñØ£1xPöâá¨9ú¡Žü ÈÐ6ö«¶JÀh<:©4™èõÑyzød0qgì‡vÀ?™:¾4†ÿÇ~àrîçTÃÕsb§É‰ý!`,Š¥ 4uV?»kü7ª¼DÉendstream +xÚåZKsÛ¶ÞûWhIÍT Að¹Lâ<Ü[;¹±2^´]Pmñš"U’ª›™þø{^I‰Nfšé*ãààœï<X-<øS‹$t=.â$rC­ùþÂ[<@Ï» %Þ"p½(Ä®Wë‹oÃh¡<7õÒÅúžHÖÛ_×ï_~\¿ù´\i­è^®â8qnÞ,•³¾[ú‰óáÓ¸óÕr¥œOÔ„?w·W7ï–¿¯¾x³-¹ +Ü Ò¸æ¿þî-¶ÀÖÏž«ÓdñeÏUiºØ_¡vÃ@K½º¸½ø¯…û‚šÙÙ*7…¾•öÜ$ æh"WÅ0Å·9Ñn4˵[áùÞŒðªmvpOeàn¢Ô¿¼rŸÜtTö…Û•Pè‹Î}jË>ÛT… õ}·‚ßmÞ¹—Í>CŠÔÅÎßgüzÀ™QJ1tƒ01£Âf>¶0}ƒ ø³Ü¬„NUv=—š{ü0‚²Ì@×ë¦Æa=MPUE+ƒ7YW í–G0½XùJ¹~/V +’ÒâˆI»3E¬ü@»)€` åøÇD‰ÅdÜ­ðý&(ˆLûþw€â h6uŽ{Rê7=-ÁzÞzl%ø%Îj.[x4H^Ù©dŽ~—ÉàοôcçO¤/¤w#GE¡ëëp‚–ŒL àäÍ¡$øjf½^SKÿ˼/ÍX¿D ¶ÄUÞ7í±¥½f¼·¦åá ò3x$Ý4òžÑ ÏwŸ¯.Ýmƒàµwϸ®õ2EIϺ°ÔÒð»ÑÚ£}í;G¨nË T»t^Cç--»¿Øyê°Y;yUŒÜŽéú†¿~'G[`æ{nä%ŒËXÙg9壩 Ø„r¸6廪A g£ïs]þÕ£ô^m þ˜œô7OE;ã.!ìj´‘Ù]ÞR0%Õ#ò¿‰pôÁ!ÑsT±r=p4ÿ’Ÿ‡¨b @,_ßò÷}¨A_â<‰{Õ*™"z¢¢"0vr +Æè”±‘Ã( mjDnþ¸ï™(öT#ïÙf¦¦¯WÚE=F\Š¢$”¢›m6¥¯ÁAVÍWØÐZö¬s¸ë&ß­}W=“é®üÔÕ‘šè"X% +2 Á…8ïqÍf©J HÙmkZPŽ(Ûî|‹ÍÇš½o¾›É€}7NÒgØÔ!lÁÿºâI½±7U/;+먷ƶx€|K$6>‚9•Æjè_]}5êlo¦øÍ ½Ò-ÜŸ° +ŠÛsëqú¢l/•ûFf/ %Õ¬Zaa]ž7AQO°> qº0r0økLl«B°á4ˆÌPawÈÀ2Ž³ÆÙ~…eôÝT³—:kÚPÓ,!×¹äØÊÉ å 옷<§56 yÚ÷PÝq•ÄŠ‰ ²:ˆ*¬4 ÃZŸ=¦…ú€6=+ +ž4Kê‹v¢&fôˆ™˜1JÔÛ2Y#ߺéeu$ L‚Î;Š"[v²1T•Ó8ñ¢39Z‚²¬Žå°aåÈê~äHvŸÉ’W7²øÔÎÇàÀ—m·”O]‡0 <ØqHDtÂ{Ô)ɶ å_®ßÀ€¼¾e ±Í#á€iJç8_QKÊ·•™»¼çïåLtozn,JÈI°í@{ͪ‡ù…gÊR¤ÿgÔ žpʸ?;{nÓDò"±ëAháW”¥:ב/Þ»“H©•â–š‡o-QŠè]X5‘:Q 2%RTÜ+|Çf³êâ©“ ¡ÿDd˜Á™YÚN"ñ4t½ààvÎ&¶M-›ð¼Á üùò#L’¦Î¦m²­^Öõ`øu½£-eÙ5D9ªÇÅ&HÝ º¦:¡ š0Y£¯7Œ«Xp˜»ÑB¯Þ‡³©­a¢ô¼Ãj¹3A&D¨ÞâÅÊ­aíÜŽÛ}ÊlÀ·*M2ÚsCF‡!.ÿyNF¦ÍÍWñ›œ˜”9'¯B_1¨€´;î-Å4àh|-™`:· 0 ØdL‚JkÍißìºÖøÃÎji<˜$);Ž +fb‚u\þtíSœr› ˆ÷tüÂÍ›!¦ødË‚‘’¬OˆÈþ¯à˜À‚§Ft ×ÆÜlÚ!K“\s!CÅ2™Ê¾é…–½°z&o;D]ôÜÖ‚ó=²ÇÀH‚‡ÉÆ¿x&£„"Õ®¢3<åk3ú!@¥nŽu.c&IHªÜ@'2æ@aUì¢F_פ„F7uwæy<–@£€5™± +Ùè;:v‰q]×2ü,‚ÁC²Ë´Oe%öyì„ ë/È,Ë<³52ø‘w³&gX|*AÌ4C¿+ÎÍV¢\‹•áTãø‰Ž}Æ‘s{$ š4)“ý=ZbÊØc“Ÿ£•Â° '×XIhºæÈxBkøP&î(S \¡/Ÿä‘ɉ+ÅEÉbpʆ¿÷KÅÒck™rYÞ6Öå6[Ã'”)¨Æ€þØÍE¼Kd¡µG^ +k=ÆùÞñÀ1æÐŽŽ4ƒËÅ°Ró·¨ÄÈ­£Ç¨Yš e25¬éi¢Æ«KÐÌÛ‚OL@•qÓ/æH_qýZ’$ƒhzÕZ¸*Ç4R¾!3óoH~ñ @‰²Ê•Bßn¶)®\«a$[ÿÀ·|–"3î[nŠ^r¹ÓÀuf¼¶#£Tئ)E©>ÄÉÉÖ.\¦óÞlý8ä« ¹G•×9㎶)ûžµ7sK¨“Ô¹6Æò D#*Yèì"#µ™ ÁCµÎÆðÀKž‰-hQà¼9 Ƹ/v”Si¤òw_òã°Ã~ÏÂ6J²€Å]Qm§SÚÓ‘P¹ÎHÓ­T)ÃÉçQrp`E[.9׃†£¹¸$W¤“ÐÜ%…'wÛÜödî¨ÈMNV òÁf•¤óãÒr¾ÈÇ×´'ç‚Æf{©I0kÚBË|¤éÅ5·JŠÚq&”äÍôò%•”¨å÷ض̄É/R5ì±æƾù48Úå8Ìèo†ëÐÍ#½Q9s8—_½ž\ko`°³ç3>^HHÓÞœ7£îæO+èÜæVZR|îåw6ot¯t?1ý†®T¸9«:á…o›cscÅé/Ά¢óÓ)y ! —mècBî¹0Í»_Þ´maï +%{Òe §…n’1ã¬1³B²`¦ñ|ò’Hçu ¤ø½…DœDôÂV9ÈuçDÌôËztai‚/?ôhMEJsàiÿô?nÂÄõCþÅAÄô}ÿøn¤+ó¯¾^¤ñÙSШéCØÿm áendstream endobj -4503 0 obj << +4663 0 obj << /Type /Page -/Contents 4504 0 R -/Resources 4502 0 R +/Contents 4664 0 R +/Resources 4662 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4507 0 R +/Parent 4667 0 R >> endobj -4505 0 obj << -/D [4503 0 R /XYZ 85.039 786.531 null] +4665 0 obj << +/D [4663 0 R /XYZ 85.039 786.531 null] >> endobj -494 0 obj << -/D [4503 0 R /XYZ 85.039 506.75 null] +518 0 obj << +/D [4663 0 R /XYZ 85.039 560.947 null] >> endobj -4506 0 obj << -/D [4503 0 R /XYZ 85.039 463.797 null] +4666 0 obj << +/D [4663 0 R /XYZ 85.039 517.994 null] >> endobj -4502 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F20 2961 0 R >> +4662 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4510 0 obj << -/Length 2983 +4670 0 obj << +/Length 3176 /Filter /FlateDecode >> stream -xÚ­]Û6ò}…å"ÖŠ¢> ÜCÒäri‘M.ë"äò@Û²-Ä–\IN²ÿ¾óE‰¶äÅDäp8çÛ«füS³,öÏÒ,ñc­fëã]0ÛÁÊë;% AY88/–w÷ÿŒ“™ -ü<ÈgËmO'ü8OfËÍ'ï—=¿|õa¾ÐZ{€9_¤iæ=Ε÷üí‹çŽ¼{^}ûˆßÐûøæáå»y˜yyááÕò#Îß}ø/>ДqÞ<¼fèëßß¼|5ÿ¼üõîÕ²gܹšÒÙþãîÓç`¶+þzø:Ïfß`ø*ÏgÇ»(Ö~i™îïþÝÓâµhÆ»¦¤ëÌ3=“Š'ÄÇ~¥$¦ç^æ .ÇÞz¾P^]Œþ¨hw†Acº ´Üí`:œ$Þ - ó¥åieŽš¢%2@8› ’ÝÜ× OW Lk<ûb·%.ï˜BIwö¬ADÓÅ­Ä`_”dÞôoÇC+å(ɽƒ8Ö€Híûû f&ƒµjÍxøô¦!£Pô¨4hoYk(”•oß,qËxh¨‘?å"‹2o¹/…B7ƒÂ´L½a¢8’ë);¨ÙæDMS§h8ÈÁ“ÀòžNUNy–œH5ù,‘ ¾ - 7Ƚd¯éøuW²8<áRÆ^¬Üì -Au.ÃUÑ¡ø]u ðÑÑXpdDÅpsKgˆâÓâp ê='±‹A3¿ûâÆá oR#ùøÎÄá£Yòä09ëŽÂÄc´šJZŒk,z³Y”5AX/ÈaZ±ú‰ Ð@×àÐÆ^-!þ>¤¯hq|Nz£lZÐyÆK+öÆã˖䢯ݓD4§à .=ðªš]Àù}8ø\uí pÙF±T¼`µâÞhréÐ,pש×ٯ妿ÍMŠÑE4ÀÞ_{QìÈå-à²ù`\8FéÑUÃ<¥#¸Ó)+ëƒdqKlƒß‚Ô¼l¯²^GÈß\yø\AŒAvת…±—½mˆ0”ðúšq¬õþxT{F½AŦéµkc¬̳ÀÛžk“^1œqÓ_mÝ¡ýã -é~ñõ2iÙÙ¡â« ÛÄÕ!Lfäq§è5® -fs)D\›Ê©•õŠÝ½+«É‘WíÎÔ´ÎáÀŸÌ%Øz{53UÙ9Y×çƒ$3}Ž…ð¯È†áñK?<>c¬{6‚õý¾†ø-@S V’ÒÿF2g™Ÿ¨è‡u‚ƒC p«ÊÏÑú8N´ŸA>w…ì8ˆ«ÀÆqà=]GÉ€NRNéàûqvˆUXèëï~Ïà Q€|k) ïnq(?Vù¹pn¦íq˜ûœ´/ç™f'¯EÙ:žPîÆñ‰¶ÍðVN¦•ÖBkÇákø3Α˜H€5eåR8šASËÊñy¸Xù¤ó®¶,‰^E`û6gØ°¥ÙTDÍ…¨<¢ˆàqXW#Œ²/ÞÕØ:‚)ì°9ž:¦”§Cð1ðhJaî-\ˆ%ã[¿¸N \„Ì1*ŽX¹M=x$Cç¹'Á‡?=¼[þdQdÇòT€aZ†þ¼op7‹µá‰Á#©fÞ/’e6äÈ…UQx Haå€!‚CônÏ[JÙjª‰ûâFAà'—¤€mŸzàìhz'VVCŸxàl§e»Ìšâ"CÈ‚˜Ó$‰^"‰´Mº`qDå -JgÌ“›/ã|5~§\ÒÍà*?%=? 'öU¦s_M¹¯ ›T&dKˆGYv’yÍÉ|×k#dÚוyÿJBŒ‚féô†–¥y¼ãb -ËÀùt6ª¦Y‘ˆç,A[JMYyW®ËÛ–„lrÜ “äÑ­‚>ßq}ò±:€”³¤·†²‘ñÙxÕX_E’”a»sC¹b Æ‹†?ûìÁÕ³«`²LB<®¨å¼‰êä|嬹 `œ:Ž2%ï†Àòc[F$®³¶"@« #ï\™•X#ngç›H!9дUHr%š–1j9õ;*-¹«ÀCŒöÞLfìHW+[ƒ»I^eÛ¼€v‡_Ãû8vUçÓuª“˜Ñ&z/¤žÄDèa—A†NŽI-9îPÊOºe/YØŠVX7–Ùñ•Ç*ê6lç ‰YÉ#«>âgˆy´d“Ð2¾†Ò*ö‡Ò\#q–!e‚—þ¡ò .äçºZ£FÒ™ªnØéhdÈ1œèFPh°7h(d”NXûP%AÆΙ8«+JËUäd¾W¢’‰k±S·¾E*#[à‰I7¼sx2$LÙ"àTRðùÜ°Ù.1-aØâž:ò1.¶΄HÈù€#ÎGÇ—ÎGÇ·Ýú3&1¤3:¶!&†ŠËvóú-àÖ§¡~×\ÇÑ.t¥£|Úax¨Wæð™[ÛA±»(^ê؉â%¸%9ê‚!.ºßÃT7ãg‚Å~žfl/™"ø }è´÷þ<‰¥#Å@A©Dj!ÔâTŽ%½$¥áE‹R€Úm6à”â%—q  ’¬ØY8mBh¯»8黃iÄq[J_jÄ1£þbª§ýÀ{ãc3¨þ*ø BG19!ªÕP}6¬`CK\¢Ciw]´Í÷6Ñ$èúÎ;ˆ¿AávL°¶m1éÈvkÀWqP¼šü +^t­xZ/rÔ5ºP<óÛ Iî çü|£Ú ã*¹‰|Ò<•|ôÕ>zôƒžìçy8U3ª õÃ(œ-R?NãúÛW™*ý,bF¹ŸGñt™i±,^úÕ÷¾‡w’P†—ï‹æ‘Â4ôU˜Ïœ“FìXœ³sM ÙyyiÎŽƒÓ׳ÞÌÛ>äô/ë2 ÑØבšbxĸÅý1ã¹ò•ÎBÐL³r•r¬YÓI]n¾LçÇb¹ ÀE÷˜È©ï8mW‚Þiã´þ.guËÊr(¤iÎSÙ—Ä7 HÅ(öd“s!°õ¿ýšÚ7]T –é6]T˜øIš ¡¯0‘F¸Bêò*(ðó8?ö]4Î\'6Ô®8›¬‹" þ—¥…®õ8±¢Ÿ·Î£Q{òR秕²×ƒ©_ ŠïÝ3Î_{‘RNa†ÙžíÏ*´?và‚½Í(oWä ÊI­[ž÷¿IÙhxóÑ–LN?‰³™< ,Y!¢p`.©8¶3V_×Â,™ô/·AÇtL”[1X]>P˜ÁWÊÃk†íß|Œ9þ*šendstream +xÚ­ZYoG~ׯà# ˜ãéc®û'^¯³¶âµ´ðI†äHdÈQfHË +òã·®î9)k“…õU]Ý]]]õU Õ"„?µH£ 4Ù"Iã 2j±Ý_„‹[ys¡„"\Ø Œ#zu}ñòïQ¼Pa…Ùâú†H®w?-¿ûÇ·®_\­1K^­“$]^¾^©åõ§•N—?~ü'¾Z­Õò#uá¿OWo/߬~¹þáâõuoɵ llpÍß.~ú%\ì`[?\„ÉÒÅÔÃ@eÙba#DÖH»º¸ºø—çÂcvÁ³fN¶vkijýU4sÄ«|ÞäpŽX-[<Ç Îw¿ZëdY7ÇGôRnŠüxj€ àîã]~䑼ªjdõ nj$Û"Ãb×ãþx n`~•¦>”PüŽ#ù±¬LYßp¹!ÇÖ¯ZáêðÛÛ6u+õ¦>y‡j)+\û¸ÆkÁ»P(¥Œ„ð€ Ôͯ8?MèüļÄi·Ü‰ï +œ Ê’ö$™†A˜(gSìë#,éh¹iê‡VêíãaËs· ÂŒ®˜'ßç(1¸<è±hpá7AåÑ­nú@Ó­±Â Ýo‚m}¸™Y)‚]#t?‡ÊVN" Õqh–×w¥›ŸZiyᾊà>j’àÚh$&GÒcN׊¡#(îx)ÁÅÕP¦°DÅctÖ¼¥Ãâø侦C½À2碡ý±¨qZw½4U®S¦v² ª™¾qô¿\­•ÝnFê†}UÉ£ïÑk/2íýÕ9Õ,‘*h`B7´ÒöX~Æ%Šê±§äåuÍË=œe¬ÄýS:j”²‹þ…Š&¢[ÇîQ„°.pxä:¼‡{hE'Pk¯±~×±rë&¼£ÕIèžÚaO0ÉeŸ#\Hü{+¸Mð…ƒÊ7ܵ!aç»mί~½É[²*0vÈ÷41뮵­+2lOh\~z{yýk$B±3;Ï©{~ÜÑ4Üp7|Í/x­ u1Y)eëäUŸªÝŒ6lȦ"o²©áº*tF”j³&ÜX’ýY“ðJÏZØɽtŸI ½†ÆÏéÑt”­¼p$¢¥ê®! ¹'AcðœX&k•Ù ‘ôEÓ©obˆ9–;ZèX¶4>¥©÷\“K¢cÍeŽÔ»N„ÇÜ¢zƒŸx{`^µèTY¹‘ɮŋNÙÑzâ¼ö^rs(dg^Nåá–{ÄN5àgÁqH<:KX7~ËÛ#ZìE…¢²åÒŸ(Ù–dAaˆüR.ô9,Póc½Îw(—ÆsÐé¹w‚3y_f~ð^vÏ£2Þ7îÊ °ŠÈÔ³ ƒ7=÷y¾ÆX©Z±Y,åWÁÆç2çÊ÷—W/füŸ²I R-úý²8n_ÞÕí±sI Gù‚¹’sÀJ[sY‚ܦt$é<Ž¿¬C’ºU¡¡ë`ìÂpD…ª…Ëïê:áÛSÃú'ËO+£PBñ†àäÿþ€C1£K7Œ<е¡aÞt£:0::³O£‚TeOÃÁëUjȸ«9ïQô‡úh'háä)ÐÿšR~ +@ö’{ ÐÉæ " M$Fï©eAFt<¾`„a«Oy˜(HP +kÌ¡x³"Tž,Q”©¥[ÇÕqƒÇ5Í‘¸ùËk,Aéê}^:£¡ÃÂýž˜èPxgi6Cˆضò|BÒÜ_ +î»b ›"Ä ¸Pp ¸5`Ü=  w˜ª·I"zXª7ùÕLaçÏa¢÷™ºeo…mACÞ)6J)ažŒ2¦:q'›ƒ­\Hs.>ºÙçÍ#¶-n—Èé’™ä;¹xRœª*·MCE«Ô§Û;ž[¸Ì¥Ä{BNØ'.tt³mç×ͼ>“'¬r‚E-S²ÔÁC`3‚Gèqs bÄçlA¢ |ø ²Å2†õ +]Ànp]Ð~åŸ?Ÿþ9E“8‹¬¶ìÙ*‡ìh¸·iô4 b[䜥à]‘õžï©“¤*ìK†Û…v»©˜&¯È”>”ò$¼êñfC(A´œ‹<“e$>˜>{u0 Í±tgyO"ñ&ÆIä²üùð–qð=Þk¦—ŸÊ#Ã9ܘÍÜ#¿r @J,}b/qÉSCÐfàcÀÁœ‹ïE¨ÿ¦xïa(2è:£b†ì²Õ™ºo~a >ÊרÖlì ôÞ¸®òAܬUyÑðÀ‰°ò¦^d¤´ƒñÝ`hõ„ ך•D#J¬Ù®4Üï†÷aÃå[:5#PZÚ)<Ôï퇭ôÐãCÎSc×=DÚÝôr9³Ðô`*4øH¿’Ž¶‚dÆþq ßLü#tJº…g•›Ê=b+ø± +3Wâ#Oa–ÒéÜZEŠ‡{Er‡°ÂÈ9B¡Ò1¼ü\rpË° º2”º•…*ÞäB}¤ÂØ5q<ØIy„S+¬¼2Z¥Ü6{Î{ÂL4ªaK@Ž6ƒ°mªÝN®è4î-ˆ­úÀø:êY‚&駉?õ­¶Ÿ°v4~ïÎã{FWuϽ½(ÓfA]8êñnÍMɹ9”NGí¤3‡hP1C¶ža:v¾Øõ^nÎËŽ»Ýò1BN¦‡nÂÌC¬ß°ëæ9¬ÕÀ¤¾—@ê½%ç£\ˆL‚T»Põ§ÛªÞäÕ/s@^aâèZ—SqëЋ§EVâñF!CÃ2úë)3P¿$HtÜ·ƒÌÙ73‡ˆ‚ zˆüw¢Q¢ïÅÊ`ýo\<s¡Êºc£T,™$±ã+„®!ŒxÚ‚ sl{šâ¦hr4µ”’Ž£0QRDƒîû®‹&zÈ!š3°b–ó:-3c:9DÏÖOÕ˜Bu ¤Ù±“”¸ßÚeîsÉeáñ‚€ZRoãžâZÛÈâÆ?±¤<`€ú^-·KÙB_¯†ú›„Aêgé¯Õ¬þâoÜ:³Ê›€fD_W^›QOò½”±&ƒÚ¾^çâ¿Ú»Þ<ó(ÆŒ²@+ šiM¦1F“<ÔÜ.¸òñÍñåë/ÞøÖB5^)¶A ¾,ìG³çO¢vˆÙMaiƒ4™ùè’d‰|t1£.fòÑ•1È23Y+Ü|V" ¢d{Ë?%–oÆKT`bû\¹üÓúè4à_ÅÍx*VA’Ž.hò1 +ÂL?®M –¬û5x8áÌ“½ÿçYÑqhS“™zÞ~l + ½ÿOK!pÃѪø\Tú8šh¦÷( t¬Ï%•@ Õ_ûRˆ\L`Ró•”w,XTï4f› âL2 + ;´/9¼Ä!XŽøœïáÄ-¹ŽQ }l‡Œ›b·*Fý—WÂá~L„¦ê†ËC±íeK)ßýˆðj#__Žˆ(ø—Ùɉ„.½/¤”ƒÑ'`áÂú‘Y&_13Õ¥L¢^ÝKz\ÐÌ[3å%„¾$„¼üZ[ +à2Œª¤'N×ùê©Æ0ƒš»WeÕIÝ;M¨ÏÆ àWÒå·,<2Ùû+æý‰®x×}V˜ºy©ÃðËËÿ|`ºóºÕ"tJ¸]…êç‡ £i Sî‘X—1óq.EÑ©„æ– +R†"ÂívC˜Ï„Zé—ï n ÕWH0µ–WGÞ0f­xéÂ>ÁUAIçH ”·…‹k#ü`!9'Ž»/v0¶¯aRßÐç:§•t¤ ³ØÓ›¦¯S‰̉âVÚ“WÖ„3Ðy[ûÕSZ6aáìŠÜ× ÎÁW»Du§”¼X"öéä•ùW‡ÎíVF4´©3™ÐD¹9ïX2]f +ú¼kƒúSqÔAÁó¤ ÏáÂи˜†µ"\ê3A2:ÈâèyAÊ情¡y2¨‰#ý,\¨t4ýž$—õA`8MÚäIU ³èÿCB;ÐÒ38ÐÄÏÆߌ nÏÚz“E.ûOõü& 륻u{Çüè˜dE_2©áÓP¿$ô±çŒëÌòo€¤óØÛKùè/X³j™öÈSJ¼¶J¸@Þ¸‘£0,z 7ٱ˭MŒdÝO¶zøpWv?Õa'ëÜs= {êïa¢™F¨Co3Eïþã(PÖÌ£$yºí÷TV1<¥uÇì¼veé3Í@;ÿ /Ø^endstream endobj -4509 0 obj << +4669 0 obj << /Type /Page -/Contents 4510 0 R -/Resources 4508 0 R +/Contents 4670 0 R +/Resources 4668 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4507 0 R +/Parent 4667 0 R +/Annots [ 4672 0 R 4675 0 R ] >> endobj -4511 0 obj << -/D [4509 0 R /XYZ 85.039 786.531 null] +4672 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [143.255 323.345 209.945 335.034] +/Subtype /Link +/A << /S /GoTo /D (dmbexample) >> >> endobj -498 0 obj << -/D [4509 0 R /XYZ 85.039 588.614 null] +4675 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [459.278 97.156 525.64 109.148] +/Subtype /Link +/A << /S /GoTo /D (lmbexample) >> >> endobj -4259 0 obj << -/D [4509 0 R /XYZ 85.039 554.474 null] +4671 0 obj << +/D [4669 0 R /XYZ 85.039 786.531 null] >> endobj -4512 0 obj << -/D [4509 0 R /XYZ 272.129 263.494 null] +522 0 obj << +/D [4669 0 R /XYZ 85.039 629.867 null] >> endobj -4513 0 obj << -/D [4509 0 R /XYZ 85.039 154.574 null] +4385 0 obj << +/D [4669 0 R /XYZ 85.039 595.122 null] >> endobj -4508 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +4673 0 obj << +/D [4669 0 R /XYZ 85.039 309.596 null] +>> endobj +4674 0 obj << +/D [4669 0 R /XYZ 266.599 315.57 null] +>> endobj +4668 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4516 0 obj << -/Length 2530 +4679 0 obj << +/Length 2260 /Filter /FlateDecode >> stream -xÚÕÛnÛÊñÝ_¡·RÀ1Cr—·¢-ÇNêÓÆNc~Hò@K´E„]’ªë¿ïÜ–\^¤œ¢ç-˜»³³³3³s]Å_xðÏ_$¡ë©t'‘*±Þy‹'Xùpæ ƹ œ[8«³7ïÃhá{nꥋÕcG'õÜ0«ÍçÝŸß~Z]}^ž+¥À\žÇqâÜ-}çíÇ‹·ÖÎ^ýx‡ßÀ¹¿¾¹¼]‰sÇ 7W«{œß~þ .>Ó”q®o>0ôÃ߯/¯–ßV?Ÿ]­:Æ-Ñ|¥íœ}ùæ-6 âÏgž«ÒdñcÏõÓt±;Ó¡rC­d^žÝý­£ÅkzÁ»æ´ªÄ 5U“Ψ) ÝHǤ¦¢ý¨¤a}ìaXµ,TsX/ƒØÙ²j2>UËsâßÄÙðR±Éeµ­rhr¦×n Œá€ü«úp ZkgµL”Sñž]öµ™óLÝe;>È´!5Ðú§àâÌæ«d¾Ö¸’•¼´£IÓæ5ã<ÀþºB/ .8SoyS»Íñ"A©ç>ê<%%=V%l.y3b0Ý?ñþê¹-ª}¯Äb/ÚÐVñå TYùÍ>tM;™Ê£ì•á®f‡7€|»$"x_=_—=êï™_¹‘ŸNÍ/Nc1?52?51?T†›¦jÎò|?€%ôO7Œ#cüílÕOà--~ìzἩ$ÁÁ[¸úțѵ>ãuˆè°G»0&:âØM’xÑŸ3áÅ œäeDyù+»ÀšMMmÖÒp– Ûw:â\!¸³žá|"A=)A껞/¢ ŠL²BÓB“´,žÅÛT»ÌØñÅê\N9äÅŠ_)ÇšÉHìN3²ýµóäf†ÈsmÇ£ ¤Î7#uOùbÂsD+qÐ2ç0RòTöEáŠßâtÎ|€~þâÿwѽKqà¨n$'c7¤77ô}èU†]ØÆñ†®…†í¶à¨¤鱪yaWÕ¹AA Øó„LQ(sìÉr$©Æ„’g&e ”®ýø{s‡íO k/F0?䯼õ¥ +< «ÍJ+‰‘ð! -1¶ž»lD¥ å¼JúĦœ¢±s—‰1‘ŒòYÍìºóx>Ï5<à•)ó´Ât„ñ€Îm ÂÈyÎê.Ô僕¬,»À‚;­L‰S”‚ÐÖ’ÓhB¸ ]$LgïÁù4ObÚöS`_ìh=“7>æ5¹$’µ"àô6ÖÙ¡g?WAäì™ë®ŒB¾€À*ñŸ3$ãÏlþx^æ,-çÒ€ ™¾,é²=<3,Û›ó¶B¾žJb° B)³:ÛåýM´É[ÚS59p\ÞOÛäûêð$F×T&ÙgRm¦êÚVô‰s/&ƒ_¯ÆÔÈÉáXcm ï5ëûfί±~H“Õ'žqbXÀïÍ -¿)؉ø%߀+Aë|`s®oa‘Ѐfñ÷umÞ -zÅßÞ+a›}ÒÀ+qà•¸qNU·PÆÍÜUÏXJQ¹ç †×‚ŽÈL Eƒ‚5b®«O:Þ!ðT»‚ÊF $¨<Él³,ŸkéÁšØE$öž·-]ÏÓï”…lUeÙ©ÃFªÐÐÑæÒfWÏZÁÐ.þãzv\ûôõ¬tÇŠY¦®—ü†Å,´šJ©_^ËÆP}ÐwiÂàH-+H‚ó jY5­e¡gSq°èϙֲ‚r’—äåÔµ(NÂÐsî(îQ<‹Jöð½¼Eí}Ä7\Ãà†W.H­ÕRùS¥£?¢#4¯48-@s´xâÔõcÕ'bY¹&Ym¢eìdJ6ìd‘]kd ™­È^ãr–k' uO”6}.äUJí°|Ùù@4ÈŒc1=ÁöƒÉÒ-cì«ÖæH&ˆõlq ›Š©ýŠ<, ˜¼Õ®ôÅæî†yE¨íp8Ÿ$J,]c_;¯Œ°É3ä«ÄNDëé*瞲ᦠTx*×>¡† öG -©K‹w•g-e9[s$9ZÆF¢J¶ÇP)€p˜•$\Å»¸\pwWñ(àÄz¾D¸iþ˜•_0âȇ-Y¢¤.&š]© ;©ÁâRAØêê´²´ͳïs¥Ú¸æW:­fÊe}üq¶ÕùSÑE@Ö‹6šÐý ê@0Ÿ¾¿ð†ÍóâúöŽ{*í‘ÖW/ô.o)R\ß $oÞ«Är`•j7éPª?ðúÐÁ¡peÝ¿˜!ZñCáO? €o¥Ìa§í–{ -´LWAî³2Øýõ¼WûÎ3óls¼ût ãwˆ7l¢÷~™hnÑ vÀ»ÚS˃óªÝR£˜xhI{3’Îö2X‹SdÄÅ1Æ•õ™˜„`t;ü~‚…Ëw<îBØebŸÄž‰8¸‚a¿;ë1Mt™+tÑ„ :¥<¡$Ö{rL3rŒ›~" :B›îõ{ml¸°º\ÆìåY/âáàEhd œºN(ï‰y0élþ J“pô>i!A i!éÿú1|¦ïEÛèM)N§='¨¹~ßôÅýC³‰‘ äØ „ Bóî0õ˜áñÅo^dìVÓ4q%Ù§X6pٱĖó˾´ÇPN=ª)ñkjJÄ)Ç<ŽÈ#U͈F{¸GLÄÖ¶ì6©ß–”G 7•éK‰ØVÚmœXr¤}SNÜH^ká¾ÞärjõÈßõˆXt¯µÒãT;/¥;ÚyóL¥‡zJ'ÃfBϽ«5ŒÈY2’×P„te ŒkNB(j+‰úMçÐk.ž°É!Ø–B•| €œÁØäBU’(BzÛ›/~}OÁWcaË+õÓ‚ŸgÊ` ûhlp¬d³’ÑO€?|ž>Çr€½™L~!J]h-¦g~!"”Ó‚IàÆ^4Ì2ñN¶ç~»QO“ö­L§}ÏÙbö¨SQEV -0ªSaë$Tàb÷Þ†Y *ÙŸÔŽK©±p[õÈ™àÓ%ã¸Úób†.€¹ç¾æ'vlª+mÉfò.Ùo Éç`F}òÊ€î÷œd%ÿB@¡¬á²µ7 @Ÿéìi@‘jgKÓ¸ºÎº)šì¡2£– –ùUéeßmò [žtõ|0Ó‘mÃ]­Ô|.ºúu~dÒ‰›&GÚÔ,2Šµa/'Uc†Í5˜rüo±9øùendstream +xÚÍYYoãF~÷¯Ð£D½}‘M.v'‰³kÏìX€&ó@K”%D"’Š×ÿ~ëhRÛÉ̳Y]]Õ¬®ã«–šHøS“(ÒÄ…"0j²ÜŸÉÉ=Ìüp¦<‡œX!çÎgû>'JŠXÆ“ÅšX«OÓ·?¾ù°x÷q67ÆLaz6w.š^¿›©éâv¦£éûÿæÉóÙ\M? ÿÝÞ\^ÿ0û¼øéìÝ¢¥rn… êüõìÓg9YÁ¶~:“ÂÄÑäÆR¨8žìÏl`D`ßÝœý·‘Âsv«¾l^s̵Në¾:;¯ÎtÔ™ž:Ø´q¬‡4)儶z2w"pa›£û$«`ÀÄïþÆLöh¾íR´§Ecë¿w è”0`>ÙÖ4.ù?ùlG±Lv|D¤#)«ŸÓî@e‘ã‰=–HN=^öH¿À²Ä×<ƒÑº»'eÁžrèó›#1l«áHL(”²G¯‹6þé~—ß%»Ï¨Šì§ÓÔ*ß'Ûl6t0Ýã·<þ'?²|`Í.'Œ,yJË5EºN‹"]½v]@Ëò’'wéoéî„= º†›"v<"¡Ã‘kðHõeñRÀøQt õAoYlRÜaçH´†ãRž¥oHZp"Îcp²“¢qî” hd0àçìt8S2ù†Yµ#§L˜Xå~ͲÂÿÅgÈóöÔÇï +—’ó6êÎkÿf¿‡f!¾†?øÛÛoœzn%&‚øÄOFí`bGÎ Z&Ö^2g¨Ûœ(­æÌö3£Ásø¿ y=6ž™Œc5Ä$g±ÄÌa YÆêáÈzºK)š«-Ä3P(®éÉf£#«LK²ª÷€ÍËÚ^§Þßß| „µjÜ7`wl¦ŠCkn"ïô‰ÅoNK 'ªÍ¤Üoø…c–Ê5©Ì9Ÿ"[ÅÃr“ÐWÌñˆùI†‚ŸžOŒ¤˜K´b)êD œNDÛ¼\¨@ˆ}ð¢§rl ü†ÿR&&?¯¼‚Óô96ÛŒ5á|îùªÍ‘F[ùËê-U,¥Ú$UoŠmA+7ž7giàv}i­Æ(Ä— +3XqÕ.#ð^ÇùxZ|‡Ô¸ÑÜK“Kúf‚‹ÃnÊ䎪¼÷s×è(ùž_î(ÞÓeNf"ûÜó qMFh¶ ´+Ÿ¾‘í¼wªÀpWŸ<Œy¢ªÚ²›ãvòO^mŽü¡Âooàw˜ëW/¦G*.ŠÊ_?‚Œ­ùÊ£ ²oæk~¶Õ˜öòJµ©SM¹¿Ë<[¨±±°AÕ?Ke½ÃcôPæ("#xÝü½íú¦C˜ v)¡cª>ýQrõyÔ§‹mvïó'?®|ý­’_Ù».ŒŒa¤y FV(íþ‚0òtIðJ9¨hDÊg1¤þ¦6ºQ˜ +°Äéæ84!Ð Ç〲è\XÈéÅ{ôlopp ƒk¬¹Š‘à*X¨È»B7}›g˜‰î6.by6ÐbÂçê`dŸF‰HÅÏaªÜZ¶ê¦†ˆ+|ÄñjÕl ^û5K+Ÿ› ®óEÉDª³ ÙóÜRýX5a4ð¼ Å:ª›|Nئ»59%Õ‡º¤WLÌr?ðÕŒ¥ª«7 JÕÛîûáé7`Uu”ýu¡|½ðq„ãôFR'æzëxzþij«t«à;uÖBÁ.ˆ N¤£mP÷„fÛ}RªO6èÁºò¡ÕýJK­PÀ·ôÿxÁ7)q»%J|¯äŸþTQ2u»æç± |bBR¤<(hŒ»RÂ+úˆ‘N"¯{XØÉ*à·ó +øføø@Êžžý’+EhÝï-™7ië¾’nú·yèvêµå@ôR‘_‰"2#¹Èá—ýmµ¼ÌÂÆ·ǽZÃ<'Ÿùk1nÉendstream endobj -4515 0 obj << +4678 0 obj << /Type /Page -/Contents 4516 0 R -/Resources 4514 0 R +/Contents 4679 0 R +/Resources 4677 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4507 0 R -/Annots [ 4523 0 R ] +/Parent 4667 0 R +/Annots [ 4682 0 R 4686 0 R 4689 0 R ] >> endobj -4523 0 obj << +4682 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [348.057 543.875 414.747 555.867] +/Subtype /Link +/A << /S /GoTo /D (nombexample) >> +>> endobj +4686 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [459.278 241.083 525.64 253.075] +/Subtype /Link +/A << /S /GoTo /D (remsmb) >> +>> endobj +4689 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 99.916 280.066 111.606] +/Rect [84.043 58.268 152.096 67.715] /Subtype /Link /A << /S /GoTo /D (browse-force-master) >> >> endobj -4517 0 obj << -/D [4515 0 R /XYZ 85.039 786.531 null] +4680 0 obj << +/D [4678 0 R /XYZ 85.039 786.531 null] >> endobj -4518 0 obj << -/D [4515 0 R /XYZ 277.887 730.6 null] +4676 0 obj << +/D [4678 0 R /XYZ 85.039 763.817 null] >> endobj -4519 0 obj << -/D [4515 0 R /XYZ 85.039 621.679 null] +4681 0 obj << +/D [4678 0 R /XYZ 273.644 769.79 null] >> endobj -4520 0 obj << -/D [4515 0 R /XYZ 255.372 463.069 null] +4683 0 obj << +/D [4678 0 R /XYZ 85.039 530.126 null] >> endobj -4521 0 obj << -/D [4515 0 R /XYZ 85.039 354.149 null] +4684 0 obj << +/D [4678 0 R /XYZ 249.841 536.1 null] >> endobj -502 0 obj << -/D [4515 0 R /XYZ 85.039 338.087 null] +526 0 obj << +/D [4678 0 R /XYZ 85.039 412.113 null] >> endobj -4522 0 obj << -/D [4515 0 R /XYZ 85.039 303.947 null] +4685 0 obj << +/D [4678 0 R /XYZ 85.039 377.671 null] >> endobj -4514 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F38 2997 0 R >> +4687 0 obj << +/D [4678 0 R /XYZ 85.039 227.334 null] +>> endobj +4688 0 obj << +/D [4678 0 R /XYZ 272.356 233.308 null] +>> endobj +4677 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F62 4159 0 R /F35 3036 0 R /F20 3021 0 R /F38 3057 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4527 0 obj << -/Length 2508 -/Filter /FlateDecode ->> -stream -xÚ½YYsãÆ~ׯ`Þ * ÌÃUyÐÆÚl¯œ¬èÒÃz င€«Õ¿O_ƒƒiWe“R•€ééiôôñuÏ0\ð.ë:]ÄIä[.Ö»‹`ñ3ï/BáX -ËrÀóvuñæaà§AºX=vrÒÀ·i´Xm>yûûÕ?V×/—Zk8/—qœxw—¡wõáí’÷†g?ÜáSy÷7·?ür©ïþŽ'n¯W÷8þåãOLxû‘†Ìssûž©ï½ùáúòóêÇ‹ëU§ø`k¡Ö¨ö¿/>}Øâ¯Ódñï¦ébwa¬ö­Ñ2./î.þÙÉâ9³àUsVrKø±RÓÏÅi,ŸÓGŸÓ“Ï‹e觩šûR*˜Bø6Ž†ÇÏN·0MÀ ,±‘¯LïÂÐ\è¸úðú+¸+Û].CïÞʜ݋Œcóý±ÑUûI/_š¨ãxΫs, Õù¹º\‚ç×YÉ~'Ų¦Ík?ÔFÆKƒtG¤Áé¨ó‡ÕÞ•7Êú61sÊOý-¼ç7‘†~ (BÓ>=•ÕZµüŒß'_c$¤4»©vY±—ÝáÎP[ÙÈ_ùªW3KËcãd´óÎ8²ü-Ab›!Ï5H§ÙG÷‚”:ßY|ª  µ$³j8jÊü ±”<”e‘=‘¸QøI”Î…ˆW6á—Ô²E6ñMœÌ»Ði£Èk6R^Òö×mAq„Û³©—á;šÉÆl8Þ-ÉBìs€ÎÑ·+öO̘ñìÈw0¹Øjr:HxiFtüÄ+¿sзmz<±œÇªÄ´å¬Àùád…){hxLq‚Ú-»i­ -ù’í™Fó¥ct8ÏuE @Šæ 7´ôÐt÷SWÙÆ hÝ€·ÀÑÞu¶Fu·Ól•Ö¥J#™ý_]çÒòÔx€Ôf…”a•*„#|ÀLêÛ°j^„5Šäfu¶ËÛ.ód9UI4x!*so¼·±o3Qæ¹Î×bPáÝ» ïo †Š¬×p .|±jÚ™”n¶Õ¡ä¶BYàÊp¿_ÄHA䧋eÚ>+í Ú<Œ½·¯Ì¹É³Ö–ÇTœ3ØìV”&tifDH×Qà ‡²sÆlOûP[X~hœ°FúQrÔåkîL¦6¡@û½Sµ•BÄŽ®n¼ç˜†Õ^: Þ侬b¨) ¾È€¶^Vxð‚QQ4µH‰è›I`…h$¢RÄŽÁ—ñ.˜Ø·¹Ìÿ~hZ~“¾MxÄø^É:‡çœ´¦+h<¬ž9_ð]Я“,­äŠlÏ©šM³o‹‹Ÿ¶˜*ÆÙ­íÉ‘J¨ØõáÄ×21°Sê¹Ü{•j¾ã:Šé›å§Î™É„þ°ÙgTGzmH(öÊýiôÑH"E<éawPËi°cOñcl<¤Œ‡K -§jw!––ùïï®ažò“¨ˆRûÔ~'뽌¾LäÚƱoú*ÄÓ·«7ê'æ¸Ëë>†k%8j\ÍØýƒÜýÌJ5½TM™Èû£‡+T"ËÒ±:Ä¡†iÆÖÚÓj ¬Ýj+ýú.ûZŸ;9üµ_’®8E•žÐŸÀ•„=îààŒ`-S†@ öâ'ö蘅êŠå[%Á‚˜×=›6«[têów\~ZÂ%šê -l2¨* õdÃ*M~ñ¸;Aš ùûîÄÉCpÒLÚ:¬àsp‡Ù¡qá¥(KYB;÷-¡u‡L$~SO[ÁxS×òåÒFÎÙSÎ3U_kQµ[÷úLý[ÕöׂÔÈ1mëÓã[«ÙšGÊ;åjÒEõ¹hÂY÷Ô£/_—Áš™ÆQ**Y5Ø–·[n(©uꎰù  z„ÆžY× ,¢ˆrÜ°ÖÅãÀ‰îÈ7ãŒBj2ãz®ŠQyæž úe›³;Ô qÆÔ"B&Q&™ƒdI-?+‘q»»@“§0œ Öîœ RäC%÷÷xP$zÉÜÄ„9ø°Çâë¤AÛ‘˜.aðRPáÁäâ4~F'ÓÈÈ9ȸ;;ôP¬ö”²Íñœ×E·…M§Ýò•§¹^À‹KT+ÊkÄE.ϯòÅ¡/pM*”©À12¤Ð9ž}C{ɆÄBt¬êMo¢¸Í Êݺâ`=•Z‚éå©ûå³w§zI˜AÃ`ŒéH¹5’H!åÛ+jÕÞ¼³ÉðjI? |wx‹a Z“4Le -¾ -7Á„‡»‚l¯Yâø² -Žé¡i| Ÿk'î4~­Ý™u×5þºÉÀÑibŒ¬ld«MÎGL ?Uf˜ÓTutpkWF|ªî&5@ëŒz¨iCD¨ Ü\¢¤=¡,¼Ì…MÈ*‚é>€:J» œ?©¼·Êiïâ•ØVå\ÌbhÄ ÔÚ&ÞÏW·L®„*© á.ÎR7㆟´9œ` )ãÇ0p<Ü.˜üÜ‚Lt¡Ïˆ|æÙó€³'Û¬³¦S£*³ö$r5‡‡îª¢Í´vÜc=3ˆò¥DñÐÝ°êîà=!^:?$hnTj´:ÎLìã»è´²ÍP4´^-ïd÷Ü2Á}s87=ô ›V5ýY«‡ÚÕø¸Â‰BWµxZ”)G" ¢Ä”æöçÑu#§Nq`P¢“h&³.Òé8SÍzæn³ð­Ûrô‡Ø¸&®WyÑJIË+'VW¼fþNN[ßh=})qôm~%2‰Ÿ&jþ^ÏB@F±qÊ CRs¬°Õ‰o=£ñã8uvendstream +4693 0 obj << +/Length 2878 +/Filter /FlateDecode +>> +stream +xÚ¥ZÝsÛ6÷_¡Gj&b‚àGgî!iÓ\zMšÆ¾ñͤy %Êâ…}$Ç÷×ß~E:u®“X,€Åb?~XE-"ø§¹ #],²< V‹õþ"ZÜÂÈë %Ñ" £ÔàÐË«‹ç?›t¡¢°ˆŠÅÕ–X®6ƒÿþâýÕ«Ë•Ö:€áå*ËòàÝ«¥ +®®—qüöá<ør¹RÁ"áŸëË7ï^/?]ýrñêÊÛr•„IªqÏÿ\|ü-6 Ö/Q¨‹|qí(TE±Ø_$F‡&ÑÒo../~w«ðX²àY3'[YŽ•ŽÂ1ãÈ5V–sd$!i=ž¬¾þ~Ú_&ÍÂTg²]¿¿ ×ía;³]R„‰I„ïH%Ö&t”=û+@ö†³žÅUè0Ï +”=L“ }ž‡ºÛ7>¼þFxõ•Žˆjmd{`4ç;¥I˜x,/ô<¾ðçÓW±ÉC“¡r8™à Vç`¨Ï‚¡žC4á°(â¹8X$|‰mç1œÿ/µL–©P§ÉSõÒ³£‡°*»Z¶XÔ¶í¸´và=ÑÁ‰kô+ùÃ÷ämH»¡°1r¸‰µÄ ›|,ì$@ø +sL#i¨Ô)Œœ*šq§³Àb£·È»GQ;nÿ?‡vfNÓR,ùž)w]µ­º®Ú|ß´¶çÁ¦úR5#öhbº&,²>y§€ŠU VªþZ†gÓìÑ-L¨Ù¢é>b ƒãßÜP‚Æ¥³?/5fÝZ§’4 .Ë=eœ4 †–¿/+éï¤Ãí¼9ñ±cóˆ¼Z…¹*¾ C®w”¹ S¥gé¦ê9Iœ%Ž‰Õ'Æå¾ ¬Þ§×2ã#fØŸ ÊF‘œ„›pž6’8-£Í0p×µä”$hÕ[ÄSý)UÃyº¶ÜXG©{¸“$ƒW˜2[S«¬šñf ä{BWŸÑ] T4”´cÏÄ’?4rA, ÜE‹v.ÀU°W)«Kix´{íHNI¢Séìá+fü#2©º$¥AW±<"÷®í‡9€¶k@:å@j~©*u`ÆQd2_5‡*À{Ð9cw¼t•›j["Škžè2ÚŽˆÇžŒ¶+yVc1Ž>M Àèð) +»[Æ,̽¦í€Fév[¨Ã\8û÷‘Ø>0OpâhÒ¯¾8 ê˜tWq؜܇3Ž©épˆc»Ï2ô,"Ú9Ίà¿U× +ÿ?I³¥ã NøËöql6¼Gh­¡„ïYJ|Z!ejÞ¸»*)2µƒwfšO¢<@ØóŒ*ÕWö9zÌeûÑ*dÉž•a÷¡…»½‹PsÆüâ0cV*‡lŸ=Õª 7¦öª),£âÉ I¡HP¾rq|¨Xüz7L¯[Û!³âÃ’ÜÚ×ËZln!{ë@ûÉV ý£àoˆ¿COMß@`øhCñ Jõ‚iÃö£côHeW;y,ì˯õ^1ÇI‰¯3³ «À76©c“ËOñSûñS©Kðxø²ä´_r—‚|ùâ]Ò‚rôl4e†VØ/0 Gô/¼yÙ§»ìÃ9w&Öæ*Tö‘;Õ§ÎQd€ŽÍLÈÕr1 Y)ë¹x»Òø"èÒÌâ‘ÉNawº ŠÃÂ懪ŸYrŠÊmN!€û—•¸v…S@°ˆ~„iE¦Ñ4xhÿœ)i=àËÒkå-ÍËÙ-\ŠFÞ³ +»Ý.lÉصh™÷ŒÎ;yú¬ìÅå‹PÁCÞ÷ ¯ä§lÉOÞ³Ð~Ïrm<ÅãˆkH3ŸÕ@'‘d#Yœ¶$‚Î9°eê} L´ødBû5—X`°ÞòW)T33Ž}‰ÏN¦AZ”óY?˜Zÿ*†üRDùŠV³™0‰Í7½-ôwyNµ×%Amò™W¯ÉØ.0AÐO"@`\gFo‹5¬!³Ü BûÜæ€4ùe‰\5)•ŸØ!â<ƒÊû]‹5Àš›ñko†“~}ñN8ˆ@@^‡–Zo™J/ì÷ü¥sact»Du=_¾µLlODûdûºÍ»‚>pnU‰¬LmSb‰s¿YyQzÖañŠ"A–Q"±®íùwc‹Ú‘Dà€¸†?B Ì8ÚìäqÒÂÔF"I¸Ëž¼2„ÎÞjwƒ¿>³›Ï#-¥Gh8 ‚¶‹Ñ$\Íh‡ì(‰4ÿL•H%ÀC +¶uÅ?/%ô“KçUMÖ»l0z:$$W)LVÞž»ŠéëÂ=vÜïƒØ±ñ8‰Œ;ÒÏüIgf$2¿hdÙ–öÜ¡}ä_$37‚õþY†ñNèË/f¯Ò’œ×aep'Ÿ¸` SùvŠiN.w÷¤>ÿÆ&á%8Œó°Ê(å 1_ +”+ÄNÓSÛiZ s´.´Cñ¨§5ꟗ˜Î­—¹Èqpvã*¹©ÈíRlÁÅÒö¤½_ †Õg Ô… +lœÎ°-ë†Îkà¼u?ûk‡}÷~©7•¼(©r9°U–„å×< †~šF ËÃúa ¨ã™<¼¢ª¶^SÖäü]åÒº&O¤¥m‘UëÑ/½>†8ÅsMÇAçþCDnB•æó¿ÈyÿÚ—Иõœî¾ù#„Š&¿ù¨tú«Þÿ·dV¿endstream endobj -4526 0 obj << +4692 0 obj << /Type /Page -/Contents 4527 0 R -/Resources 4525 0 R +/Contents 4693 0 R +/Resources 4691 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4507 0 R ->> endobj -4528 0 obj << -/D [4526 0 R /XYZ 85.039 786.531 null] +/Parent 4667 0 R +/Annots [ 4695 0 R ] >> endobj -4529 0 obj << -/D [4526 0 R /XYZ 277.887 769.79 null] +4695 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [277.921 711.882 344.611 723.572] +/Subtype /Link +/A << /S /GoTo /D (xremmb) >> >> endobj -4530 0 obj << -/D [4526 0 R /XYZ 85.039 660.869 null] +4694 0 obj << +/D [4692 0 R /XYZ 85.039 786.531 null] >> endobj -4531 0 obj << -/D [4526 0 R /XYZ 255.372 606.975 null] +4696 0 obj << +/D [4692 0 R /XYZ 85.039 698.134 null] >> endobj -4532 0 obj << -/D [4526 0 R /XYZ 85.039 498.055 null] +4697 0 obj << +/D [4692 0 R /XYZ 251.129 704.107 null] >> endobj -506 0 obj << -/D [4526 0 R /XYZ 85.039 482.827 null] +530 0 obj << +/D [4692 0 R /XYZ 85.039 580.121 null] >> endobj -4524 0 obj << -/D [4526 0 R /XYZ 85.039 445.96 null] +4690 0 obj << +/D [4692 0 R /XYZ 85.039 545.375 null] >> endobj -4525 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +4691 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F20 3021 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4535 0 obj << -/Length 2835 +4700 0 obj << +/Length 2709 /Filter /FlateDecode >> stream -xÚ¥Ûnã¸õ=_aìËÈÀX+ê®}˜éL§Ùb2ÛIŠ ØÝÚRl!²•Jò¦ùûž)Ê–ÝÅ``òðçÂs¥¢üS‹<ñƒ¨Xdyê'‘Zlö7Áb +_n”`¬eåà||¸ùñÏIºP_ÅâáÉžS~R¤‹‡òïOùðóÃçïËUE`.WY–{÷Kå}øúñ‚cïG^ýz¿¡÷x{÷éÛ2̽Ç{^¸ûüðˆóoßÿÊ€ßiÊ8·w_úåï·Ÿ>/{øéæóƒeÜME²ýÏ›_~ %ˆøÓMàGE¾x…qà«¢Xìoâ$ò“8’yssó7{¯Å Þ5§¥$Êý$ÎÕ¤’5%‰ŸÆ©é^ïQšµQÒÈë«åJyhéwÛY˱÷Z7 ŽBO-î_ -Ÿ°^®pãÛ}ÅÀa'ƒ²ÝëúÀã½î!@'¬»i¾ö«:Fª¦|¼14‘à(X=°B(=\sû°3ÙŒ¤ÁK…­ê³ ü¨øk%ð*àÆzà‰>´ƒ=©CXà* QDaÌeÇ°º—íMg6ë’™gŒ2pì*ÉXeŒ@ägd”¯QŸtÝ€Üq°ÜL>ô^`̧ü^—VC3*ФÀvOŒõ†­º«Ê#Ñ#ªVf{ïy™n ɵǦdÿá[õoŽ(xGᆠ-o`xIdØ"2Äè®a¾Æ]Àpæˆð'¼”ñ‚‹)å«4º=Fr‹V•_$‰ã)üf9»øLìÙ * ¼¯ú5{Ø¢9edJœ&3Ö9Öò…vXNóÈÓð*ËÎEONžËÈEœ>çáDŸV³/㯧cɼöÐ×ë†$†KF•·²gÓ6 ˜@P|„§ÀñÉ¥áæFŒèr±×> Gä± ÷ÒÈ!ýq}0êìé[‡8å¹éêà)$ ÝPXÓúÀƒ–ä#óE³XhbÔÀû`¹S¥Uâüˆ÷;ò„%Ž”÷%°Ó‘Õ²‹½çY¢Rv#Lõfúg“ ;Áµ¡ Ý <Vp¤7sˆ†9ÜÎ襜ºÙàºÓùçXíÙ3 n¿Gu¬áTŸ#8xBáãØûøÆHeõ¤xÉâÖõ84q–ð zŠc³¾y¢ÝX@J#Ó^ €žã©ÂÌ -–ê®EAÂC Åh‘t#¹š% -•p” -¹ã9*ý"ƒƒñ@äP&Î¥r?rAéÅ(‰–ÚªH /-ÿZ)™A¾¾òLÔðÄ5qn\Çrò+ÉÖ=oÉÊ/,ä(;¹EÏD\‚½†Ä‹ê[©PùQ–Olã ÷§µÜ¾>p¿{àù'²žé ä´÷ѦCÚ’Oê˜ÖtbaRA1{ÍùxÍÖ,s›Üx;“Áñ4K¤ùi¥ðžê¥H# w¸[(?µÝ r,‘?´è÷‡ ñµrý*!ñ÷&¥å&LEà¿I°×eÅ3¾«í®‘rbí’A@NìiL‰ƒ»MIƒ.Uëpºâ=O('°é†&ªÂ8wžP-Óíq¦B £ªA0õ¡œ‰0ÃÔ0M°^(Ρ{Æ Ñ”o\Uo;ºÐƒ½+1γ{f°“\ú9 ½}ÂY8q¡ÈÙ‘´Ü-;ž¬‡Ü¸(È3¢£WÁ£‹i¹†›wÕG·Œ`“ÈvËyv˜aK7„ÖòL‚:ãY&ÚžaS 7¼gWow<ªhtsÕJ‚š$§þØU ¯þ}­=„€\Þf¨¡:xϬ -Žr™…J³«žªÎ»‚rêä3̼YAÌɼy[sè$}†v'‡ÉXBL®î:ßs×mM†t7àżÌYg˜8IÇF'#Jœ$æú:ž]é–pÆ…ú°iZ)©š\ãc÷ÆÓH·8Ø4uŶ*õ;ŠK¬ÛDƒkGã6¶@C~Úû §¶MAhôÜZ::mãAáqÇiðãí7ì~`ðhÕ!¹.ŠÂÙD"¿ GEÂ9,?-™ñYÇ„ÜJpÐ#`Þ"…<<!yl«AZ»I/w’^Ÿ44@Íihƒ²¬…'¿ €0z.­7­éM©#ÓÀÑ -E8¢utÕ¶¶ávl¢£$ƒ30I3¯°aÊk‚o^”;“†“š8‘à “|&ø¤‰hvÿS™Ô³%°¥†©fN«†™ ÒÔÏ¢ë-‘ƒsñcŽŠ -?ŒÃÉÇœD>æp“lôó„ÜçëeD±@ºÜÀõp*C̲ìØ%Xõ—زWÙq.~ØQA2yÑŠÂhšà|2±j÷Œk¡)U{ÆÔüóCðÖòp ûKÆ?m±eŸ üÎYøªaÞªq^ýKïéCN¨²ùQ‰)¯ËNÊah¸ äe3ŒNzîÐyÕÇÕËoû¡«Ÿíëi Ÿ[màÇ%})À;Ó‹cÖóå~Õ£Ù³ðŸ%û¿þ6ºUœûE~Á«èNÒ,6Ì *‹ä”aó7çÿ½¤Usendstream +xÚÍ]oã¸ñ=¿Âo•X«Rôa·Ù»æÚä®›Aq½ÙRbaeË•ä˦¿¾óEŠ²åí¢íÃ!@L‡3Ãá|Rá"€¿p‘i?ˆóEš%¾ŽÃÅfw,^`凫P0‚…òƒDã҇ǫwßëd~ä‹ÇgBy,ñþôç÷??~ü´\ÅqìÁòr•¦™wÿqzOË(ó~úô^ü°\…Þ'ῧ‡Ûû–¿>þxõñÑa¹R¾JbäùÏ«_~ %ˆõãUàÇy¶x…qà‡y¾Ø])ûZÅ2o®®þf©ðšZð®™“­ Æ*Ìý<Òó§_áiunÏ8ˆvÏ8ʇÿ•ÖwW|†Y½C'©÷Pì`º.x6l+Ü .Z\*ê=ƒîŠ¦C…+ÝŒ^"?ŽÔAãÐÏ"+g¨gîé‘XÇ™W.‘3³SolWÈ·ãyÝ3Zh$KX®àºÚ=µÆ5£?·²oÓ6M1Ôˆõ¦kw-^û+Ñpƒªbþ=“iŸE¬e”zGXn†ú€?²£?"©}5ˆ˜};Ï@5ÒEâm礇Mb¯¥cm6ˆŒ:¯œzÕ€ü_‘^EZ M+±×{£Ÿ¡‡›W*ôþ¾Ì€ê‘‰l!»v`H gÊ{À[§ó¡Ð³-hÃÀøx%ˆ9l™ "Ü€µ IÔ¾œ,†¯ÄoŽÕ0Œ:ßÍ›P`õa&†Q²1 ¦V²àêkÇLˆÈÄ°âÜÏr%DþÈ.þ&Ç$KA~÷}ìîT±ä¡ììwkÓîŸg8(ígVLR²â òÆÄKsϨÇc3Où}­›†G¨‡– ÊÜ/O +^¿±þ`”ê³>Â(ó³ çKA䌹ÃQaêí‘"úJ®'g—‹ÀA¶¬Éä*nepr³27‹cò012ʶûü‚ÚB ­!¶h@dÅŽféÃN7Ccu¼EÓYïßEAðÑÜC’GÞí3gΛKã/Ù4Ž¡z9Ú˜R⺽$®^kô¢ºD¾sâ᥷2¾sªI\Õhç1á0;qö('_ s~3 Ý苉`0ÃÅ€·°de0}",mÂ%«`D(»bà]&²²Ñ…°÷IBÐ(ô®‘(EG&E …Þç™3¯IGŒ‡çŒp HºnÌÁv=ûÊèNÉQphßf|«úr0SF®E·!ÛEUúF,Ç»ž¶†/*"ˆ(:¡2ˆ9CNt„±õ`ØAÎÃL ¿ µóØÝs‡$äË&9ªC}9”À`ÑÔÂBXr“MÍ!\ö-&Ž=kouîl;c{œ:ñ”*ÏÑÇ wìˆÔ˶AÅ+Ðño6ðvr*sL’Vð¢ .ïL2'–Ç¡"Ñ_ÈDŸÉvŒüWI—EË%ÃüDs"<9¬¶ÃÖÕ@&y\aô)gŒt˜Xš^Ëú)6ÎGŒc -ÿ’ olm`?[:Ìû/[€¨ùºDMê’9+¥èhÎw˜òU ѧû#Èyp ½ …€[pu6ÉÝÚ&/WP8¼5ŸvKQ¯)T4½p€‘ÓyE«ÈW¤9׶@NGŠ®ßªf&1ëÈãT·5™"³ªöb™œ?ã\ù:¦wÚr<‹"œÙª@M[qt"Uô¼`m™›¡n÷=ª$ÖÖÓ‰ úü¬aû ”õÄþê¹êºªä#_,wòÌ´)wà çeM¨ü(2eÍ[ÕÏ S(¯ ŠmôñR <˜I©#g½(Ir6V€~œœhR5£~Ø#Ìo?Ý€ª>Ì™ö{Šqy, +ì8bC犢]Ʀ9–¶Ïl +ÓP†?ò˜\š›¦®Ø-„J¿%+id}L°vì-Í‚žnïD$."ÃÈßaߘÂÛÆF9€ßWÕŒ·?=ÌÌœD»·0&ÇŽub‹ã•–R¦q²Vx …Ú,"µ{ +È0:ºÍ€œr‹r#IÂ6Kš£Òš=ÀñxBæú”Ñ›¼Ÿ„èÚ{¡6ælù²æªŸ1±ŸµDßÍõ¡Yêë(šëD(DO~µ ýSª™¯2ÍÛNIj_éÿHq’œÒà,³'9÷ Rò@ ÝÛhÚófH°ÁÖ¤¸J‰»05Bè¾à [\,yWÁP[Žè›…Á[L¥jD6³½ñ.¹'G¶ó»lXíøAŽïÔh"©g%׉þ(íˆ-Ø}v[-¢š"ø‰Jÿ{Cˆþï†@î‹q'ð0x[`qËïÕ¾g$ºIŠ¿¦G̶‘¢&ô&Á]N¥LÇ6¼Ö¦. [TË¥"KEÙ¾IŠ€6Le |à<¿;˜ÐJØ3ÙççÍN×Î mãóÝE_Jc?Þû]Uh2'…aî–ÎÜ9wÒÓ‚1ae,ó€ér|ãr»YØñÃ[\#UBÏ{–èa_×µóBÀ¦59ûlÚZ„§[ ÀˆbÓë vpë¾/'­ü0O~O‰gúls! ‚ù²‘—Î4--`öž¶‚+[£”c¬ÂhŒj“O„‡ q#ÕiÊAø`_+ ëˆçqqšr\B’e`TϼŽ¥ŒÉ8in}) œzf>H$Æ5W¢l’Ÿ‡,•¸„Á¡Xa;yìHÃ1ÜÎ=gz©§ó~†K”˜ˆq!"à1éÓŽòÞ÷³—­âs¶ú$pN¯s£(Ñ: ºê¥v:zó&ëL& ÜŠ?w+~HøÐùôäY0±JÓÙL0I´(v{îx/öÓ7ó¹z€Ø:À”§)}Þ›µŸ‡ñ…/[€¤òôÛ>Áiùwßò™­Xc¼ƒÄ>ð" +l‹)'ô}I00üÇ;J:÷¡ "RßP„‚úšfŠaíØ[÷O8±0àÙÚ¶UÉ §m$C‹²¤×“Þ¡„ݺy&Gâò¥Ø™jÒ9¦ä•"5•„°·Ú—KKˆ{™ÀŠ&M~ž¼Ð§æÉå<Ó]=~ÓÞ¡k×$9R‹¼§š{+›Äy|úÇOËLñ›?µë‡žÁ%W/•ì°_€"=Ú*¿Fü¸bWˆ +?]·l)ø‡_»Vx¬Éšä9›­ q©ŒÆÇÁ¯y–<¶tvù¬…-¥SšŽÞtZq[Õ¤˜ëì†k„öóñ —9yÈß·¦þsôgúý0Œ|¥óþ)‡úß¾ÖÇ©ûÑñëenžŠ&~œ¨iîþ7è3ç}endstream endobj -4534 0 obj << +4699 0 obj << /Type /Page -/Contents 4535 0 R -/Resources 4533 0 R +/Contents 4700 0 R +/Resources 4698 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4507 0 R +/Parent 4667 0 R >> endobj -4536 0 obj << -/D [4534 0 R /XYZ 85.039 786.531 null] +4701 0 obj << +/D [4699 0 R /XYZ 85.039 786.531 null] >> endobj -510 0 obj << -/D [4534 0 R /XYZ 85.039 711.163 null] +534 0 obj << +/D [4699 0 R /XYZ 85.039 766.606 null] >> endobj -4537 0 obj << -/D [4534 0 R /XYZ 85.039 676.417 null] +4702 0 obj << +/D [4699 0 R /XYZ 85.039 746.277 null] >> endobj -4538 0 obj << -/D [4534 0 R /XYZ 85.039 416.197 null] +4703 0 obj << +/D [4699 0 R /XYZ 85.039 461.08 null] >> endobj -4539 0 obj << -/D [4534 0 R /XYZ 85.039 375.549 null] +4704 0 obj << +/D [4699 0 R /XYZ 85.039 418.311 null] >> endobj -4540 0 obj << -/D [4534 0 R /XYZ 85.039 301.826 null] +4705 0 obj << +/D [4699 0 R /XYZ 85.039 344.588 null] >> endobj -4541 0 obj << -/D [4534 0 R /XYZ 85.039 249.75 null] +4706 0 obj << +/D [4699 0 R /XYZ 85.039 292.512 null] >> endobj -514 0 obj << -/D [4534 0 R /XYZ 85.039 166.739 null] +538 0 obj << +/D [4699 0 R /XYZ 85.039 209.501 null] >> endobj -4542 0 obj << -/D [4534 0 R /XYZ 85.039 132.197 null] +4707 0 obj << +/D [4699 0 R /XYZ 85.039 174.959 null] >> endobj -4533 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +4698 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4545 0 obj << -/Length 2206 -/Filter /FlateDecode ->> -stream -xÚ­Ûnã¶òÝ_áG¨¹¢¨kó°i·9n7—“xÛ}PlÙbK>’Ü4ß¹”dKi‹s°ˆE‡Ã™á\¹rêÂ?9áªdÅ¡”œ®wº…•ë‰Ôs2ïà\-'~ -©tEâ&ÓåÆÒI\$át¹þêüðï÷ËO³¹RÊÌÙ<Šbçq&7Wì;xõæ¿žó´¸ýñnæÅÎÓ#/Ü~Z>áüîá\=Дq·× ½þ²øñÓìÛòçɧ¥e¼#šT -Ùþïäë7wºž¸B%ñôÆ®I2=Lü@‰ÀWz¾Ÿ¤çÀV‰€Wœ+§>rœÍTVÈsÍ ‡t5ó"g ¼ÈjÞýŠ䈵cÑ>턱¬xFÖð °Ÿh¾0‰âÁ¨l“ÂAs‰&bV 6ÑöX˜¼æû= -ƒ–­Дü=Õ»ˆ¡„ãq©<’šJ}\®¿5Éó +‚ÐK p<¯gð‘6ø/µf)„;ßð·ÙiÀCv(=þXå©XéÙ1)שÒC†î1Â~è‰ø¯ØoqF½"TR¸~Lì/‘5/ˆ*;n=O òþòí1ü˜¢ÎSB&^ J’ªÀ!+f?«²ØàjÄûÓ‚'ÏäbšZoml -xÑøE«)«Uþ¼ãmÚ@5:î«4f—6šgŒ5{ÕË·Ys…[wÆ_€ÆÑ,#ÅöyNÊSkîƇ1.¼0Ê›RÄ‚{Ä_ö°5cÁb^O»ãÄÑ„BÉw‚Xõ;*üÍäFÓ˜A«¬á[ú·w)ûåU’;’‚¿'ü@$Q<{‘pcI{*cÁàqC&‚ð1¡T°/ .¾fbƒž²»o 8%g…w uÞ,%§è²b¼žAÿŸøûÀ‰fˆö ήi Á_î¥!.‰-~vlÎÇ=œñ[:VD’oH¢×]Veߟûz”ˆ ¦>„?L}]£Ì;86TûºÁÁA`ä™/bNZ¬9'_HuΔŒ ÃGá»\œ ¶z7&c %Žìñ…ç'ÀFÞÆð -A ê¸üù抿¹ûㄉ,{F¾Ik²bĹª8¹sp©`‹d¤Å=ÓõšbHÍi‘6•§>£”éz•Öì¯t›a,b™ô¼éœ Šu€¯õV÷BÌ/‹¡89¤¯·›”€ƒ\±¿„¶@½îwÀºë’8*uúAÜ9£R±ft /Æ6çò¥ ä„ÓÑ°ŸO÷‚€WɼÁÖ0n#ß5úÂè9‡vDIkã¶ÞŠ©.gÈÐó| Ì›–Z0"̬¸hT_…ÎS§â¯‡”Š:á$êÇzâë iPŒ¦üG·¸‡tM»B]¹˜KPEÐofm#y­é˜¼jwWÝ@óKëùŽwf¦Räð­+h@rîÊ÷CSãùHž%ËméGl#\ÆT¾"VB -Žd0R„ß^+ ‹27éûÍ›qÂôI?U¶)Éd`J¬ÙRsJSÏ{½ô|Òl¨"Ö´Æ­¶ÈVV§@‡µÁ5j[`’u~XSkÀMÝÝ’a/½~á¬Ö]èôpá_Xìš -Ö81ÀÎ6€À¯ÅH*P‘+‘6ͤ‚Îh*08¨“§™’Ù€È\0¼~ É`ìþ"ø‡®ˆ |ƒsÁH?øC3)CÙã ŋܶ)ÀhŽc8^Qñëú^$)_PŠÛµÒ˜®Iï0µÕ¶"”£FAÔ01µ#B6’1 WÃ|(NsfW"öû¹€8ßívR‰n“ÊÎì»]Z-{¸P´uØŠ’v«åN[¡/Ç V:²×ã%ÀTŃ[½E:¶J&¸i{©™Ô‡b±|ÑEò5ê¾o õ5ÏOGþîKî­_¨‘Þj`þbMÜmáÞxY;õž:¾­F*õŠ³ŸßJ h Iì†1&WLŠƒNĈu/™¶Sbq¤ý¸Ä¦âÔäåP®8R0‡Ðt¨MÍ©«Ýz×&U¥:9 ‘l'_æël=Ö®B/‚äý—®Îh»êÅ‘ðdÐkWãÚ®bAêk­ço˜±z<’1Š¼ß¾z±/⿧ƒ3Ú¾zàpn$ÛöÕ—Þ¹?øRÑKB¯ -dL€8‰#Ú âÛ”R’&ü8hgq•êUØHMvŽP´K„ž·„ÈJo­ä¨…{>ãþö=\çpDg4Öf|låy8ëwªª,ò®Y'ÐÕÑs ´¿_±£Ã~mð‰ÎØ#o?ô¼H.`Ð}E J[4Z˜=Úõqw·ŸgàK¿j.6üµÉÆD‘ß}Ò™YÇ×#ºEe5á¥Mk“‘§¼1ipwÍR1K«Ôý›9¢Mï\s+ÕRk4¹Ñ‹€´¿íÕˆºÛE±gM:o0Äî÷©ÙWêïÖC§èÜR[ñþ3 g…üŸkUÔØë9Õ¡6ÿ½FW¿Ðè”Î5¿ìPk6mÇ€ã"ß3®.“m…eÞžp­é> +stream +xÚ¥ËrÛÈñ®¯à¬ +g1¼¶*‡UÊq´YÛŠ¤-¼>@H¢D Fa*Ÿ~ ’ âõ–KÄLOOOwO?ÇzÂ?=I#Úl’¤±Š¬žÌ77ád +ïo´`„§Â8Â¥Û§›þŪ,Ì&O By*¾ùÛO÷Oï¦3kmËÓY’¤ÁÇwS<}žš4øôðw^¼Îtð@ üùüx÷ñýôëÓÏ7ïžGÎœr±Å3ÿyóåk8)€­ŸoBe³tò +ãPé,›ln\dUä¬Ì×77ÿè©ðš›ð®Éfc¦3•™h\úJe½üÀ ÑP~Àq +„Aò( +ƒû5̺j·.Aì8î¶]Ù è‹|^¶#e»ÂÕ*5=:¹€Ç|ƒê|Îá¸Ðí~çï¦3€Õ ²ÒâBlòùÔ$Á +@Õ¶àkÕ­pdƒ .ö¼Ã§dŒ-Œ§¼N‰ì ŸUmq +â- ÈÖèÂYÜ-ï@»ö0Z¹m÷(¦Ý*ï3g묮dù£¸¯fä13cR'Ù‰ãÜÞ}z§9ŽÈÝ"$Bs£•üˆp4/¼¼”5Þ‚È pü{ÙpeÐô7„ÇmËsÂ`p©Mè¦ ›Ü÷Ñ! ºüß C $£æà Î÷w$‡‘.da¨Š7,$Òʺô —'æ~á’Ž² ¨BKª¯&Íþ,@æ¤ +ž|)ÕB-Õê+O•RrJ6<%RY’Ò)ZÇ”šnŽh¿—™>CJÿðé×ûS¶ŽðsOt8ÂàëªlÊÏc bü›é®ÈŒF®H"d_¡¤#ÂëXÁÈv´ +`%õ™o‹±8aÐÇj‘ó!ªÿ{.ˆ†èšA©^!ˆ0ãШ,gKÈ.˜£Wdo˜%ê[p†_>Ü2ð·0 +©©˜çk†}ÈÛÎoºmjv1 ×–  k^¸»ço^Õ¢ñžÞ¶|@íõá ¦&l .:„˜mô‰GÍóVb‚5à1EAY‹`DØpþ0z@Øôöˆãјà\TªTXw²W4¡Es&Èåp¥ãTiÌd:”­,—(Óôlå7Á¼Þ¯‹‘²£âΦÁ/È7÷¨AìÈ€‰"^¢kè“·(q)›âÄß°_xK%ÔØî7}l…EŠ­ð}&ÆñóHÕÉv´`Cù?X ÑÔPƈDüÜ3ˆ‰K;Iõ:Â{¢¢¤“¹ùøášp#ûÈrh3]‹Ž¡(-d%;üú+Ð1ñ*ÖE„À‚åˆs™ÐÞ€7=w§–ô2Å¢òòBËãý5tH¶övŒ€WtД,nå7; [ SÓêÿQ‹¥`ÖqCª›²í" ÿÅ5ç—ƒ§Yð€mŸ‹ñº‘ã)ó½WMN…„¬>ãr7"ÿ&Gý8¥ J”AöŸ÷žƒŠìjÁ_Ò°ÔØ…T¯ÛºãÁ É‚¯Ç*œà W|~,çxFöÅϱrÀ1xýEå RÅ*u˜âÃúA÷Ýyä˜ö.@”@m—]Kq&«(þ£1ùö‚‚º7°lyr¼0 ÅbÕ b ­“MÒ€n@v ‚벡’m'§ +¶Ô™¸oÁ+G_ó‘Ò;š Ù\r%*>KÔ(ºdÐ(„Ša(·Ä6ܱû\"¹z¿c¼m¾‘õZÈôÎý@ãý,æiNYI€ø±ì¸(FŠá°NƒU%$ˆZÎNÜ +ƒvÎë±€Bžš€T;üÆÁšÓsýBä–LÜ]½ø葤ƒžîÀÛû«…cêÁÎŽüé¸o +'*£“&XMWtåC\9gž“úqeÄ‘ÜÙÜwØå^ +º£ƒž×åFœ–M¼¶]‘z×ÅHT9>ÔUQ—^œ8•‚ï΢úr{½‹µIüm]lú{»X¬™ i}meþxØÎù…çá9¶µgíÙ#OôÆ#ξ³Ë…fn¤Ë…¢ŒÅq‹Œ^Öá±×›Ω£ýnßY¿Ýîš(9 `ñàñ¥8MûÐp³ãp=æìYKÙ p.ð(ÝçRT´·Î©,>íéøuËŽËŠAnÈ“ªÿà™‰ãòÇΙÞ.9$vØ"3âZ²uOZÞÕ`Ô‡@{ä}†«°œ”´\æh¾,öÔºö¬š8]ÄxA +^žUI}iŠk–õÎÁÜè<_0pkpé@i +zŠ¿ßbó½:ÓJ§×;ð Æž¾½»aÁ(=Æzd}öZ 'ÜØ7rzRW Øw`N'TÇ9.ÕOê8\£·Ä;KÕ"³A¼Zè—kÿp‹³J¨ ©\³'Ħ̔}7JÑ"IAaÑéÐywÑ—žÆש@ë£9,áØ#¬ÎB8f<ì>l2|Îz3¥èÐ\¼TÄÊÆî´Pý/õMŽendstream endobj -4544 0 obj << +4709 0 obj << /Type /Page -/Contents 4545 0 R -/Resources 4543 0 R +/Contents 4710 0 R +/Resources 4708 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4507 0 R +/Parent 4667 0 R >> endobj -4546 0 obj << -/D [4544 0 R /XYZ 85.039 786.531 null] +4711 0 obj << +/D [4709 0 R /XYZ 85.039 786.531 null] >> endobj -518 0 obj << -/D [4544 0 R /XYZ 85.039 766.606 null] +542 0 obj << +/D [4709 0 R /XYZ 85.039 766.606 null] >> endobj -4547 0 obj << -/D [4544 0 R /XYZ 85.039 746.277 null] +4712 0 obj << +/D [4709 0 R /XYZ 85.039 746.277 null] >> endobj -522 0 obj << -/D [4544 0 R /XYZ 85.039 690.568 null] +546 0 obj << +/D [4709 0 R /XYZ 85.039 690.265 null] >> endobj -4548 0 obj << -/D [4544 0 R /XYZ 85.039 655.822 null] +4713 0 obj << +/D [4709 0 R /XYZ 85.039 658.147 null] >> endobj -526 0 obj << -/D [4544 0 R /XYZ 85.039 312.591 null] +550 0 obj << +/D [4709 0 R /XYZ 85.039 285.493 null] >> endobj -4549 0 obj << -/D [4544 0 R /XYZ 85.039 277.845 null] +4714 0 obj << +/D [4709 0 R /XYZ 85.039 250.747 null] >> endobj -4543 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +4708 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4553 0 obj << -/Length 3311 -/Filter /FlateDecode ->> -stream -xÚ¥]sÛ¸ñÝ¿B} -5S1¿Ù™<Ä7çk⤱®žN.´D˼P¤BRvüï»_€@‰N;ÍøAàb±Øï]Ö3z–ž -óYš%~êÙj{¦f˜y{¦c!( ç|yöòïq2ÓÊÏU>[ÞY:¹òã<™-ן½_~}ýqyñi¾ÃÐÌù"M3ïz®½×ïÏ_#8ò^òìûkü ¼›Ë«7æAæÝ\óÄÕÅò¿?|úÎ?Ñ'ã\^½eèÛß/ß\Ì¿,;»XZÆÑt"ÛßÎ>Q³5ˆøÛ™òÃ<›=ÂXù:ÏgÛ³(ý8 -å»>»>û§¥ÅsÑŒWMiÉ`,tîçAücM&‰Ÿ¨Äj2€ÙÈ£ÄÕdûI”’&Ay1¨/ŽrÔª&I½þ$Þr¾ÐÞ}É°PnÕ¬Ûy¨¼Çž.›¡ì©)‚ÏCíF÷µüfÃk¯Š­P¹.»‡WtÏ©4ü,Î~,ã‡dÔñ„·èÔO#ö–ßû’mÙÞá¯&Y.‘ ¨X•ÕppáŽÀ׎á¶e¨ `ü3svÔ ˜%M€GܬíeÄ”ý4ã½lzC*ZÏQeAÊJG½Zòïõí= .kÈ p­ù«’µ(@µ¹¯ŸÜ•«v‹‹¶´´Ùu¹ö‘Ap¦ ˜J@½+'Ö.xŸîIX)‡óË@Ûb…lÒMÉ°®ÜTý`¹ìYÍÕ ì4lw 톰NTüˆcTÌf!KTï屧„y⧠ïTENé¾ÐÒéØ[Z ‡Ø©OEJù -TdPUjêi7_€NĽæqâõžEDÈ·c‰J£?ú2®Ø“ˆ®yAîš-jðeÍŠ§6e§š©¥J¨uh£+æ«çï YP !æ·ª‹[À¯‰¦–›¿Á@çÞåÀø†N¶›P[Ãh]uÆÈ«\v.dIÁŸ{´oõͨ -&0‡¹ä r¬_©ï*$ŸGí¨‘ãâîÀ{&̲BCÌE½-,W$J‡ ©ô Œ]§£%êUŬ?üî…2Þ46ÇÈx6ÒyW ¥÷ESl0?â´âw*£pDîÑ^ntÃ~ÆŽ¸ÁÊá•´ï s=¡…%Mr¶*¾ -U„Aä°èÊ^,©æ2oבˆ}daõŒŸàŒÙ«îIFgm$‰ @·ó ÷žx܉òYÀêiÃÓýP>QL¢à”$ÌîäsTèâ ¥ú¨:ˆÀƒÔW9Ã_×5¸M”@®#ž€ä9(í!œ}Â[¥¨BžÚïøU¿:f›'‹®XTŠ³ 3a×e³!§Áî%‹¼å}ÉfÇ£´éÀ׳$ +éŸJzLiášHy{B `&²òÊ®ÑUÖ5HB£¨5«%Îj!0FcÇ•à‰ÀÇKôËHE”Ô"wr¡8¹`8edoß3|e´Nê‡Où‚tbP'ÌE4bx°PçÞ놽ŽVY¿ˆLðÏT‚¹¶£6‰e)¦ Îrê¥Ï{Nî]™!Äl±^áÖ‚þûõ»be‘Ñ?NуÔ© 1ÜK¨‘Ö"¸Ì¶¸²9ÎQPíÄ¥\P=[I¸÷"×­Éгc˜S2ZÕû55.¤6»†b•£à”Ê,›ÅYàqôSáah-b§¨Ìmwœì "üî®í¶à‚$)æ'Ó¡Á(qäŠ=½?z“œZÒsN©°—8ÀOR{ŽÕX¸gkv B}¡•ò€ª0/6ÎóÄô¥;ã‰D]#TWå½–mêªäŠá,äã' -ž6¶ü[·Þ£åévªŠ[G!,°7Fä¶ûŠÀÀ[¡VpP{åÚæ#ÛQSËmKq3 ú )éÂyô|8ÎÎ[‚y/Rj;ê”L„ò²ƒ`RnÞµÐÄ©¸Æ5r ¶)ß×Qê‡:œÅAæ«øçúaCká;õ}é1K쎓­)&Meš&ãÃŽ¾¬=¬][¬WE?0âÐ(¬xžz©5Ïlº²à–>ÊïÎn”-C³&µ.Â,‡î¦%,Ö"ñÐs1 c:gUͪä˜Lb°A:²Å-Ú‘Á¬È.¥Ôë˜j‹ý枢œÈK ³•%·¦WÁU{ãsTµÉ’´Woº Í! NX|\Âë7æt'ñ†«¨Vöc\·5{8R8JO‰bM§°(ßXIðc×™#,¹+|„ÓWÁãçŽÎx³Ã“0ŒC¯€áÄ'1”°u%¿êh³…Ì×Ûû¶§6_g„bO<=”Ô-J²'_¸·¢NÆh‚1;pOR_GãŽæ {[N*uMlDt@‚ñÁ0daö¬’à4žqúVb†‰,-õž,„žÙÙn¹í$wüË9qÅÕÈÞBÌ ³1^æ¡å+› ¡çÒ…Ú4iŸ± -t¿Šõ”à 3ŽC‡²šÇïÞŸ¿è©¬ä06÷ a~ËÝÜ0•Ÿ.sîžX3ToYu<äÄ‚8u…¶ÅÑèîÏ-òÞG8ƶ„îiø`ÅÇ%ZÁ€žk-îÙ®sl àãNÓ™ £¨ ƒBRÖ»ÞŠÀPÐs‡ƒÏŸb{F :ÁrÊB4’¿’ÕU?¥Ýê«$ÊjÙ›NQ~¼T,Ÿp»~CÊÙïÈæPÛAl÷ÀL”R¯ÛmA!”àM”-°ô}bhóm ®>,å Ý$ƒ+èB~¹o¦çU²°+ïÊ®£„æ¬d²!5gøžrÍÃ’|m™A´«¥+_ä¼!qÄù—æ €ê4…[qPçÌO H¿b¶ì•ží9•ÙWûÕ`â&Øu覦mlÉ)Àaþñ¾ª I‡38¶)öν¨ìyÒðaot`ìÄÊD‘†°këztEè^¢…‡ÌddM@SŽEOdt)h|í+¥ BjœN3çz8Ô 'Ÿñõp@¡ i+Ýh€).<(yçÞxÁÌ¡`¢JH_è_Ÿ•;(Á!ô–¿||yù‘ѸÈRɦ5Ï@)¤$, ±Ó!ÕhiŽÊÆeÖVÉÅ„F•3Ècéܧ_áo›+al-‰×OÞXkïe/-aj>6œ¯dÆHÙ ÑfI`n4#‰øu5‡ß‡ -n±õ5AÌpÄ=qa»CÄ“ëÕÈ\ÅvÆ¿a®—i4:~ã¬maâf¯Œ#Ò”=ýáÇä™ìkcëª=ÅÖ…Z n`P5ÐÍ> Žµq ->[°oü×e’ ¸ŒW¶Çíy!7c8Ÿ¯ŽuÝ袮pѸ®##ŒN*!#ìøl8ZH7¸+*½GLÔdÜo¼¤gìVs̶_± Û C§÷ín;4·}"È­*)Îí$ψpÒf&üÀ5å]+ZAÔUÁ®C“¶¨sn…Èíä²Hø嘥tÓõSùr‰Ù«åÔúLÄá=ž¥ìÊ )¤.œ—Fýsï\¡÷'jó;X¯ùõ„ Õ˜'§Èë÷»C{Û±OâŠWüódÉÊÕКn\¸%‹ñkŸµHšp礀ŸŸ7u{K-ì—Ó¬ µ•û#­Ex7Ö6BN*%îÙÁPcx?™Èµr’Žohfäàˆ"+X£xF£ˆôçÞ¹í@iuD¶é…ÊQŒ ì•,òAOþzÌ)©™RÂT‰ïY:ßd;rGÑSZ>ئäKÄŠÿ™×c¥~ÿÃ<¾{«xòDÑKsÇÏ’¡E -Èðˆ°“ã«óZ­Uà‡éá&%‰fZû9zÍÝ,W~¤ï4òÓ, 5]nÑ“Á‰ñÆvŽªn†cqͲ ÷_Pξ,9œBCBqÇ$ÅA8¼¼ÜF³7-ð;sX² ‡._þŒÎì0™¤pD28™Ë|™õ@}wŒ ^H¥n©ÍN±›jä1pµè;ÝÀ¯øÁo¶ésÏÈ©ûŒÌ½4ÂÁ]õʼIBk"îŒàÄ^œ†ùP­öµE¨Ÿä]¢•Ëÿ}O§hz^ô<Ë=k×°ì#qãõÚV±OÃI‡ çbkUÝq)¡¹á¥ŽNq/–_jÎCæw¬`žN¨€ñÒµ> +stream +xÚ½ÉrÛFö®¯àÜÀª!ŒF7¶Ã¬ØÉ(c+KS:8>@$H"%+5?okl„O¹*¥*¡ñúu÷Û—Õƒ?µˆ×ÓÉ"ŠC7Ðj±>\x‹Ìüt¡Ã[× œº¼½xõc.”ç&^²¸ÝÊíæ“óÃ?_¸}ûq¹ÒZ;0½\EQì\¿]*çönéÇÎ/ÿÅ“—Ë•r>ÿÝÝ\]ÿ´ü|ûóÅÛÛÁ‘+ãšP㙿_|úì-6@ÖÏž«“xñcÏUI²8\˜@»Ñò^\Ü\ü»Û…çÌ‚WÍp¶²+•¸‰Ìs¿Bnƒ¤ãß°qµ ‡üNL&qî®®o€Õ0rþËÛ}ƃ»ÄQnPÕR+ç©aø‚[gu™µKí9OøꇼÜ!^è\#JzÈøí&Ã×ú1«gÄç»Qœ¼À\¥üŽÌèó? ž¢§ÚòóhdÆ´q~õNÏÛ=À™žºY"‰K?rîq$‹»•• ½—w+”¬!‰À‚ë[~Þô»+çíexm«Åè¹,G¢òþ/žRÛÖÕá@’¦C „eHÊF‹HHoùÀš¶ð묽¼úå†_é饃ʌau¶Ë›¶#·a{ÏÛ†§KÖŒÚjGXáAL—4C˜©,e¡"ÙS]k¥ÜHGáê1Úõ£y‘™¯F‹2y>.WÀ}Æ>.ƒÐI‹3ƒ-ê³fÚ3+)zcs"áöP£ÀaAJXi1I1GÁÜ¡,[Oñnž'»Õù:㉼å' +8%d”%l´æEŠÖYdಠéJÐ;+!EÖÝL¢AmòÞ Z²1ÏÄF”G™ÿÿO² +ݦÝËËT@¡÷=-ö,ÎY&Òë‡H¬á`BoçÔû!‰‚ä…cf€ Üò²\6Ë ·9•D<þß1wÙËâw)N¼OËtÁ‡ƒ[áÉG”w›³p¹™÷_\4˜"Í!:ÊèÔdÆh…5Ú<}à ÎåÑìÓ:k8(¤`ÑÔŽ5Å\3qJ3µ…š®¡Ñ„+PTÍÃS3\ÞÇ !uÈã‰÷sиurÜÜÚ)Çžï‘ÑUž—(È ¡Þßëe%B–¹89 +âuQ’1¬(ÀÀN”o9n|IP&p@r<8ñ±ˆEB +ø½‹ui Þ,3« c€©Ð³ (ÙM»GïŠlþƒíˆòIü‚Le ¬ÂÈ ¥þÕá ¨b3¨óÔZ-s+L4G|k)OñÕÚ¬82È…éeå1…(?ˆ:3ðƒd¨„¿#%d$@×I<PÖu~dýöIù¡B~Ž4ÒvNõæ±2*q^—b£ýîO¼y><›}U·ƒ”„0F,y=ÚCzJA›íÃ͹_æRàPXØ .0O9¥¹0`¿8v»e²ŒÌ[[@©€ÈaèT‚i°8gÒÕx;yPì’Æ0q8‚ݦPÒXãV{s-HEÅš9ç½™ÔFa\9m( uÑ@BŸ<ãPŠškSÏ Mü½áÿßùœ|’CUÀ‰QŒ=mVIâ†q0Š9\ÜùqÄ<“­Ä`Lm…¢Äa_ç4I@¸«¯Ä^5Ö BÒ†W÷û=óÄ.ky0 ƒòò¼ç¼f¬u‘gœô¥òò„t>œcÏ«x +ÕYíx\ñÕФX± «y,k·ªè;ë´äAJv/P¶ H± £³ta¥•áê@En3SËp*‹pž³ßÅ„Æ• +æ^¡ä£_ ,ëOzWí@3 YzL„ìÒ°,ñæ3€Ž\£à0âè¯Nd¡24(\%RN$C`E M]¥›uÚ´ŒØÖ鯞 +× Ã@Üé9§ +F˜)…ÂöZ¾q£  ¯M—ÎJYª–8@•kqs§m_>.P“A²Ðu{²AÅ€¹F¡á)Ž08"5{ÛžLÐÑ’ð¸¶|SÚ ¬ëâ¶O6 éÀ§€žw" ÄóŸ9Kzª«wúCÌ$˜]éO¬ |÷þ²±µX9¿âA®GÚ¹Pù\r‰QS®Íÿ®Œñ‰úMÈ`‰¸8_•’‡\Åub“Üôæ=wˆ%ÊÜ…= +•‹¸ïÓ.ìÓûeçã#±1Œ»Ü™Ú-ÄgÍâhŸÙÚçØX>æº6Á¸+«a˜wE¢$h`}Ka4’>,7$hœ¹|æ‰n±¸aIÍ/ë £ŽDx`'Gò +yé³3 õ¡ƒðZ¾âá¹”¡–©WH¤b õ°«+j£0bëȹ®Ú9Æ{×õŒØ6 ÞTR†öôHø~)Æ+/è/7‡#÷¾³yOš8X»©ø]Êm€ðÑGâ”+nH¨BdZ +ÈBÑž-S÷E +j¹mQf”ˆiÞºE—-_ôPêUL×ßLëñ£<Œú;~‘YœâªÛu縸{WrÅÚ*YɯRNì(çÑX¬¥‘Ïðo ˜1YͱÒÈtwe§YyT\qNÅ:ÍKª'åçê^øôÍ‹µ(¶ujËÐÀiä(a ‡®îwC¹ Äz²âu¥MMÙVª“`Ñ5;õ…¾s%%·}Ïç+,áuQñäöŸ<^‰~çMº*œ++™ªå‚¶KÙiqžr¹Ü0|‡Œè’T=̽õèþgY“8Ú¦¹Œ¸Õ#z*ÙŠ®°¤Z θèå§ãŒÂӶͺ][¯;«ÉÇ }^6vý¶F7,"Ѧ9`Iõ¸NO µ±W¶ö‚-¸ÿXwáH_Tú5/]Þ.Áö+¹]›Är0¾i>û~E÷ìr+'¯bšxc6õ/@ú ëã÷·¢„ý6ì’hÕ¬’´ç¹ÊÄçJÊì׉àBplzÑÖî½kKw3äÅgýU§zFW+ ›AX ö+:KÍd¯³s¦Tä‘U.iST9Ù0P®îxŸjtxum¬Š^¹J‡ÃÏÍgŸÚXALŸÚ]˜oø°¯ (@Í^ó€MÅ„æ—?Ð"¶á‘`w \/"üüÐÿ¶!4 ¥Ü£~atuÀ’Â^I/CLíÜ/7òéújñ;(ƒ¿KÀ¿Á˜îàÕÕÁ,ÞT@Úbp•….T*ëéSñÌ…ßÅ=RÑ&ÊQÔ·78¨ÏMùÿ$ðAaÜ›74 +Aè¿k[ZÈ9ÏOO4ˆ$úºs ñàŸž¢kO¸¹Éðb7‰Ç7ÇóyÝò$z~A©¹¶-~[¯Zþ$}jì÷Ëg{Ûl—üBUªÆ¼™mÓÅ£¦ëú ¯Áeß:ßòIƒë­¤Ð«ø+¿ê’£„ +Ü\R!w`dÊ£žÓò…Éy†d:,Îøc¢\®h* ‰ñöog? €`£¼ì7‹ÓßåRPi7S_á²äû¼|á*Ža¯X¹aÏÿ˜å[õðÕß aøŠ‡¿ xùòXyz*@º:4ìÊ–Àÿ¡œþøendstream endobj -4552 0 obj << +4717 0 obj << /Type /Page -/Contents 4553 0 R -/Resources 4551 0 R +/Contents 4718 0 R +/Resources 4716 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4556 0 R +/Parent 4721 0 R >> endobj -4550 0 obj << +4715 0 obj << /Type /XObject /Subtype /Form /FormType 1 @@ -14872,310 +15570,257 @@ x 6\>RgÈbÏWÖ¹j[†› WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream endobj -4554 0 obj << -/D [4552 0 R /XYZ 85.039 786.531 null] +4719 0 obj << +/D [4717 0 R /XYZ 85.039 786.531 null] >> endobj -530 0 obj << -/D [4552 0 R /XYZ 85.039 766.606 null] +554 0 obj << +/D [4717 0 R /XYZ 85.039 766.606 null] >> endobj -4555 0 obj << -/D [4552 0 R /XYZ 85.039 742.055 null] +4720 0 obj << +/D [4717 0 R /XYZ 85.039 742.055 null] >> endobj -4551 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im4 4550 0 R >> +4716 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im4 4715 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4559 0 obj << -/Length 2927 +4724 0 obj << +/Length 3035 /Filter /FlateDecode >> stream -xÚ¥koÛÈñ»…¾D Éå³h -äáK}…7ÒÕ(Ò| %Ê&B‘:’Šëßyír)Q¹Epwvvvvfv^Š?óà?K#×SÙ,Ic7Rþl³¿òf°òñÊŒ… ,,œwë«×¿FñÌ÷ÜÌËfë¡“yn”ųõö‹óþïoïÖ×Ÿç ¥”˜óE’¤Îjî;ooß½Epè¼æÕÛ~çþfùáÓ2d)<ßσÄy˜à>ß ä e]0~3ÞwÔê-üÓ êsÇàåš±Vp;´}Ú~¾€­=•5ì*ôI¸û…‘à“è•®À-=¯ ƒÌsr9F3„H ˆÓ!¾9t*ÏYÏS‚”Ax  #iò*Y9á¹,¨e¡¹FXßðN5P𵆕1ÈW_pÒŽ:Î…õžùvËPïÙ5UeäLl<òBsèQCMmsem$²{<ñÁÝ4õnB ÿñü°’‹Áƒ'RJ“€ µ*6Äa±e¨‘ Ú€lý < Á^4…ê—Ǫ!‰V_…*IfÓ—ú¼ i;:;t*1?ä:r³$y¸^êç ‰ÎâÅx85mÏ oøC2§;¢µˆù>;á™m µq³Ãûdç6‹¶%¾DA¹#ÔG'¹~ÂSÜ‹QžÊnØš·ù^ÌÏgÆ„Ò¶Øåx‘ªSæÐ=ÑOgʹöŒ=á„NDV¿Ëqo^ÏÄã[¡L·ìvN,AÌ”A½’$T˜$T9«œM í<ŒÙTà«9 K  .z=ÏIÿÆð²—¯Ðíú¶!c®^x¡;>>ò%ÙÐ,âÄÀñðØ’L ^${‡oÎôZ-Ì ýK×–#¿ â+\È¿sIäý‰!Šh^\y×óÂàDN,þ·l7øzzzüˆÑðê/ølš_hž<òŸÈ#þø¹‰ßø"2æûöÄ¿’_AÉ<—hhO,‹g­`­ßîˆ6y WFúêþÆRAa(—þF`:å`©!vª²©³áÄr3,‹þn¸ù´bÖòº >¢ÕF`8îå - ˜ý«)Åm$î¢8;–]ÎÓKIYv(™aF`‚ŒLÈ5%²ÿ¦rÄ(“°³A 5Çj+ !R¥ì‡xH†V½ðäÓòš±ï%`%S+p>4Œ¿ü´æc umA–I(èx2¥DÜð†?F‰ˆÛ *û^dƒ¿©³oÚbB¨td^kc“<•æ9àéÖƒ›O«fJŠÌq Sl¦R')BÇpL40² ÚÖMæ[ñ‰´fEcô[Äð–g=*™š Ï{ô¢ -F°$PnduaS™’°p™R*|· )ssÜ[î,µÁ:2!êWÓçøH*&BPβéÑZRñ*èÙprO‘uœ¼X-& -£Aº‚²Ék˜·ŠÆT•›ÜÔðÖBg|˜Gž_ºÜ\ûJ"UU±šé#ûä?9* Ðþñ|\jj Úð×ä81F…ب5ü–²;gœM³?TÅfÒˆ‡ZoÓ’OÁ Ab¯Ø©´Çh xo;¦w‹Xm Q/ˆÆs.¶Ø™ÜŸf(½€¥|>ˆÁàø§íXd§ô¤é…FSu$àÄŽàˆFŒæ5#9`slbå`vaD6o{sA4µ)ù¦xrÊ£uåHn|¨ à—³ 4ÕÄsn(jø’ŽärD«+t’šÃɼB“4ûc«‘ -åaÀ±É°@æ^ÿªR«d -¢Ì S("‰×¿1Ƹ¨²ÖGÙ¯]Œ¦”‚ð™Ä f ëtÏ”—qâfq:²cÓè`ÍSÇ´’í+.Í9íØE>±éåt“k³¡ìýj ¾}nPV'¾]•„Ûp Ä,6•åÏa"qˆÉJ“4ÕÛPœÆ¦}¼ð‚έ­äE_§z9½X8R›áÔ - -6DxIbÞ”©‘ÆÆÁ©ŒJ×#¡•Qa¦8ªF<ýT6òvgW Jùš‘Àh@ý…±$ùV¬„@×®"Ôî0Û§.é³ržŽéùëW è'<ã80#ÇJYsï„ï‹í á}Ø ]è#ìæNz0§¢1ô­r¡Ø>³œlàQ"Nô®-÷Ľò*¯ãIN>¸T=ñÃ> “0"x¥‚sqŸuC L)7„ü“÷½oj¨@+v½ #X»Þ»¹BïXTSÑBù€ƒÅè, ‘¬/Å,Þ3Þµ¡ ƒ«O‘#7üŸ$}Çž^/¾¬nŠbä»~ö³×ïï&Ãcâ‚gúI÷7ÀÊ/½Bû/ë2ñÜ ÕrÜ–Ô%jÑ$œ®©$š.’ØÉ"þRM—Äñ–kW",ÄøÌOFj6•ˆ‚¬že<W!*™*w’ i_œÐ+!ÔÙ2Þ´ëx™jc<Ð4 L¡âËÁ0¶:eãÍ;Ò~5\}ðœX“×f¯ïʬÆÜž#·üõb£ÔêÕ1ëVâ3‚q)³£x+HV‘µAŸêè„å76§nkgò×?ÉظÙ@]N!É:ÒÝGðdÝÄYà&Qúƒ¬pá'‘›¦É¨¡øüT´Å”Û\0è?á8qúqzqŒßs«š`Kp™Ú(¬éAhîv³à[2ŽN5‰°Ó b_:U \–­f®©q«g|¦ \ú†”¨IúAwb±Gy,Žn_­yD]PŸêš+šÕµ©z´:tH\Œ[¿#ãµñËÍNï•çå‹ÚHÍ-îý#fÞ]êÕ ‘§:!QéDç#ÏÚwEµƒä$ö"JNqÈñR»ë‘&’Þ7Ô€KµëHýdÓäB>å6¢¦m¼À›ƒ€<¥:tËcû¦Ë…“K~èO¹‡±p~êµM•…nE?~F¾ ×öO2¬mqç Тܞ”Ú—îò²²›Åà {(»%|…±ëÅþ¨X“£À¦s\ôÔÔ!e2`º–"膻”s—ˆøÜ[Š#À|ƒ Ât‡†›¶é:!t| çÜóÊC;4—`'eÁ)„Z)­ätÉFÛNvm‹îßÎ6%}8/ “‚Ƨm=´;;.â·>cþ91¹\@Š~ÜÔ…+k›ÊTÖð,¢¤;'ÕpZ½•m8`ƒC'3Õ¿aMõhu¯£•öGM Ÿ•=Ø’ R0TRƒJÿ…»ö¦erO'oq‰z¯!öª™Eª8ÎÐyQò†¦–ÃŒn‡ÅÁ®:«¡¸Ñ¡6u_06KWôL¨ç5¨ÀüNjýª9­ßN?Uý»Ï¦áfB®ˤûâö}9èLüv¯Àa¨ÉŸîá/ßáÿúÏæ?„©›¥Áôïÿ¸ˆ8 53(´,=e8R©¥j‚ãÿ]&`²endstream +xÚ¥koÜÆñ»~…ÐO< Gs_$·h +ØŽ“*E7:Ôœ| t<‰0ïx%)Ûú÷×òqGÙN "wvwvÞ;3öÚ-s¿Fnø×VqSþa‹Yœ;—Dï®`p¬ÞÛiŠ•íDzÅq½n¿'ÊÞ?¶ES¬o ‚бÑöÊŒŠs=¦Ü‚bÞ âþŽµIT |tSìW:‹na®à‰x-‘^>¢fdDë›ùöwÕa‹ôâ²O¸¬ãéëÍ· Ûã{q‡à‡êÀKqÃüÄ oWkÞŠ³¡èyæñÈÏ¢é²(õëžèDÜtv JkŠ6«ÜÑ cR+êÞ“î‚2€˜ÎÑ™A”:ÓÄÊLX8÷<¸¥oø‰ägÑSˆoÝóžÐ<â@Et6Ö ÿ¸¢Øny6œF¾^üh¦F`Tk¥Äºým œîxáÌZlgy&ëP5sˆ”ƒUÊ#Œ‰¯Ë;¦I¤±%Ñ¢¹Çñ¨.‹®góŸÄ@3ø#N‹–í£^?8™xÍïÊX$¢ù I”¢H]'sÀäáR€†øÚÑ<ÓþËù2À‘øˆ"±.×Ü$`^® ¾›–ÜYÛ8sÁŸÏîÜÉ21ÇȆÁŒJ q à&bŽ )øQW“0‹2Eœ[¯ËþÕÕ¯7<8Œ"—3Úò¾êú!°Oƒ¢òbÝLïŸ*à}¦Jˆöß1¤àÈŠîÔ±ö +þÀWFPQ7‡Û~]qÚ°ƒxþ‰òr"à +Ùtž=$MN<&ZðÍ~/&ŽÎ¼å92.xŽ6éä^vàB‡€¢ |:\Ï0v=;­£#™j/$•ò‚¡ëa)ò› R/ýg,ÅB¦ëK!íX i0äxSõŒÖƒ.sÄ[‚݆Ÿâ&M;zaÿP KtÎG7>¹ú—¼K–µ6.ä(¨žàLÚ¤Ñ;º)ϲ1Üq½y¡“ä3¾² MÉ–‚’¥Œ¤Š¢À8µ³9;ûI¾–Íd Ô– ˆù b +hêdme¼#oÐ_mâ9HâË;¢bË\ãe§’‘c\À2Á ’ÐâÁÎzÀ-}ÑKÊM‹w+R%o,û¢ªÁcÖ)dX_=5@n‡Yms™u¼Šh( ¬µå‘Ò^ÑC[ŽÝÚڨěÁU #°+ÌäQ ©Â 4Oœpù¾i2F| .ˆóŒÖŒ©5X=Ð…ñYøÈ‚7Þ5ûc]~žl@Þa_v³p?V-É6„ ”÷Šr «\ô²[Â/ƒþÛ¦kvtÇå ›Ýú–’ëé G­~÷¢T7£§t^QTWwEpâ<:…½ hj:â»±|9qZP`q84BÖ`Pm+£¥jỸ¯îª#iaÕLñŽ8ƒ~GYuJ–ˆ¦QdÍ®(ïw©qå‘J‹¦ãì ©¬©-›8ÀH†ý5Æ! ~L Âu߬¹r=+}Ò¡€qã 7.N +wAß{JAdÚç“Jɳß^ ‡r‹zIóË?=°±ˆ_xQHÑ qïùÖ(de|™W¿YÊxp?_”"oHî>œ!Ç'ÅRïj˜ÏŸ©øPÇçâyMÚj'™e-é \­fôkºg&ɲ1'!H`Íc͇TiJ¾X\iãcXðçîX=¤oßóOÓŽT—ôckÀ  B¬ +dâÕ,my¹›Õ1j4v«‚"ô™ +§¨réxàQºhú4y%U Z3©¬²Rc~Žû†,i­Pņ(Ë(Ä—½wJóJ¡gˆ!C†0"!þ,†ðõ5@²\ᚢ• ™Y.âœÔ&6\´)Ö”0=,ì:SÁŽ®xrÚóD/…\îJ¶ÎJ9ˆîwfÀ«–î 4xK' -€ .‘¶ÇƒIž…èB™½ÄMC‘Qœ*ËfN5Å8í[Á²«·!FB€ìP‰²üÜ…æ}Tå³8/›vR?AAT. 3:6™›Ó;ÆôÚ½XÙ…ì;?gvz~”w±¶ö „+û@J%%dYùJÛÅ$ÜݱC“)P·;-‚¯Âº3¯Ø<½˜3Xõœ¦ ˜å˜TâÌü~]j‹MŠîùI×>õçß-LšG\A¥ùäÓN:m!Á ]Äð\þ¢¡èMeßäù‚sàqäzé¤LLýìª'ŠÚùg+ ¨ï¥p‘rŽÏ(d¿´¶ÒÓÖ V'9åÃSÁV½|D"vXæM‰‘ö““"#$«MÿÀÃ翇h§‰ýs ÔÜM¨!eG@hƒiíží׈Ht¬ó"ž»îÒ©  †Féxl$ÀÒŽ›qÚ^á +„†>Q?ôŸ`þÈÓw­ ]?Ó.‚5·í¼qɨ¨O”Aî ‡‘xÉØÛ®çñÐ(è TQ-$Š¿ôŒîù¨ÍÏj§Eú¨ yJ¢ò")îyŽ»\àÃp©ÞB8&n4Ò^&À³†mFèL vö|2 F85ôUŸß’K}–“Ó¨Ðþ1XŠ†ö5@98+wò9|++e/P”•Je‚øXü]€rü»ØûC³giP¼ó`¥ãélMp´œ7Õn½Té©Ñ3Ì? ÐC/‘6¬»Ç[€|H{N½ÒVáO'3½~¸Í/Ÿà¦*æO0ù8CŒòuyò{Ž4Oã$[þA‡°ñÿýêÅ@r4~|ÿâCTbO)Til(ûœø_ñá͵endstream endobj -4558 0 obj << +4723 0 obj << /Type /Page -/Contents 4559 0 R -/Resources 4557 0 R +/Contents 4724 0 R +/Resources 4722 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4556 0 R +/Parent 4721 0 R >> endobj -4560 0 obj << -/D [4558 0 R /XYZ 85.039 786.531 null] +4725 0 obj << +/D [4723 0 R /XYZ 85.039 786.531 null] >> endobj -534 0 obj << -/D [4558 0 R /XYZ 85.039 766.606 null] +558 0 obj << +/D [4723 0 R /XYZ 85.039 766.606 null] >> endobj -4561 0 obj << -/D [4558 0 R /XYZ 85.039 746.277 null] +4726 0 obj << +/D [4723 0 R /XYZ 85.039 746.277 null] >> endobj -4557 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F38 2997 0 R >> +4722 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F38 3057 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4564 0 obj << -/Length 1754 +4729 0 obj << +/Length 1766 /Filter /FlateDecode >> stream -xÚ¥XÛnÛF}×WÉC)4¢¸\./ySjÅq;©¥"Ò>¬EÊ"L‘.IEðßwn¤d[r€†AîìììÙ¹œJ =øSÃظžN†QºF«ár3ð†·0s>P¢1•ñλÅ`òÞ„C幉— «ÞNâ¹& ‡‹ô»óÛ‡é—Åìz4ÖZ; 9GQìÌGÊ™^¾›¢8p&<{9ǧï|½¸:û<òcçëœ'®f‹¯8þ|ý; Þ]Óu.®ÎYzþçÅÙlô÷âã`¶èMi°ÿ|ÿÛ¦pÄÏÕI<ÜÁ»çª$nÑ® ´Œ‹Á|ðGo‹ç‚!¯:æ¥Nc¬7ñÍËž C7ôÂÞ“>Ì*71æГƸa‘'ÁyÆ¿ùàCc¯ËÑú-‹· ‰RÙ†Ÿ€Ÿ4ÖNÓæ¸M!ÒR´—mþ1d¬•vÀXXT÷›Œ1‚¨¿igNMv,®‘Ûu>’vÚ½sŽ@§¬6¯zî¢ ¯J³Ú¶Yñ€‹g…-pUÚ‚E;îÇž³Ë ‘Þ?Š©­EacK™··YÃ2[¦,ËʵEŸ.%aP5ö0mÍSVá­P)­èpd¡nÈ{ÏÒÒçE÷ äjË óҌٮOa@ÌŠ_Zp"¨ãþ%”pÁÒ4km^4î‰RCíE¼TÉ{•“LêØõ’àÓhaš9uÉ$ìÃÈ™•mgÍ)TbïEX{“z¬iŠ™œ—X"F³[¦gLô{žuÙkŽ<pºÂÔ,À{Y+‚$¦„G¡±Û"«¹ndI.6¡Ê¶–ªï+´×<Ôœ«¶¢ÑH4Æ3Γçç Ö´;fJW·¨S¦#Ùüy¾Ù4å‹Ór‚è‘R²­KÆ]^6.Z²íI6âÁ{Ì3 ¢¢'>¡åL“¨ž“>yÑÇ“B”m1጖ `òcdB(ÒÉ¡A8Ý'1â÷#=ãŸAÔ ê(™s·ÛŽ‘,c:¦¶äö®sžPÊßWUÍEŠ¨gØlò^¦lh7Ôܼºš^Î^/¾}™½‚ùÆY,>ñËôììz6ŸÿÊ£÷Ÿ¦çs¶¦N[Û­3ä%­íâ[Ìù¢ö¬¢}ϹÊÚwŸç¬PZæL ‹¯ø6úö”ŸèlÃjTê-H$™†ÉŒÏAícûSÍ0•ÛjÜw }ö>Ý9>²éaÊq%Ú›¦*0Z¤Iu›oä cçC)réð€QL›7ˆO‰cA‚¾EMâcXY•bbH›ª‰¥Ê¯32Út•3˪1Ÿ÷ênR‚V±5r -êì6oÚú{ ûsÌÙó7XÈÓu—r [Ëû>{Å¿í()~Üdà$Ä,ï¿Ijj1@lÅ6¤œ(2Ý€¦åÖ“¶è[@ÐÎ nEd /ømÀɆ£²Ûqw$ÓÊŒ²w‡[P q'œ“nòò)IWõÉ^\7ÐG¿ªáŸ·û_¿@ô!b7‰ýã6ps„QÐÁó%ÉSÀzoë#ˆÿI£K2endstream +xÚ¥X[oÛ6~÷¯0Ú«‘uÙ›»¦iº6íbAÑõŽ[¨,y’Ü ÿ~çB)r"o†5yxxîçãQäÔ‡ráëdÅ¡0ZNowº“‹‰tþ4~hðèõjröÖ„Sé‹ÄO¦«;bY¥_½ßÞ->¯Î¯gs­µdzyÅÞÕùLz«›™Š½O׿óáëÙ\z×DÂÿn–—W³o«÷“óÕ@å<A¨Qç_“¯ßüi +f½ŸøB'ñôÖ¾I2ÝM£… ´Û“åä^ +ŸS¾5âÙ¼ã˜ËD$ÊŒ{?GoMÒû¯€,b†þà¬Ïñ½›KØ\¡«Kp; ½ël»Èù­msø­Ê¿•Ð*8aˆ–"V½ÒŒäaiwÕµëÙ<ˆ´ZUäeõ.o¦Ü\^-q¥¼:Û³=hYo1µ°ÞÖÕ~6[æn·Ÿ!±Á+n_Ýu 3¤OgoõÐ8•@‘%Ú™xjSf;òA'ÂÈÄqЂ¼È[tçaD6•·Bͨ)wþ´¸{UÁVtä½iQ N"” +R‰ùNHÁí¡®É^W¢’cñÙò•ÇÙÁ®‹Œiè&þ®9¢È‘£’ “ ‘RÞÙ†Á~þ¥½öš6G5…£–Žû¶Í  s¥aL,ªý.c!¼E'ÎùNrÀX¼ã4·Û|æ6G1¸@^V»Œoa¤ü£íøVšÕ¶Í +2‘wRè7ÝvEc‹W(Ry÷Î ebï¾s¯íû`STëŒÉ; +t‰›ÐÛÛMÖð]‹RæÉJL·-oܶË>r!²-H®J¦c¶P&U-ÒŠœ&N¬`Òì¢ +µÏÍø$6Ä,2¾šÁõèoŠi‚,ôv3£-S^´`°£¥%ô{ÁÔ4km^4b¤ïM 8|ªñ•:2?‡@Ú!нºeðá–×aä—mgMgÀÈBÁ?£Ì"Å +ÍK,}£9-j4¦ ,Æ-Ϻª4G~ð˜à¥fÂS¼Ã˜­gTÈHtvw*²šûÁ]ÉL螃¥R{`–¨ÍkÞj®:ÛˆhãoQ|ÆvpMJ2ÝõãÀê”Ê Sþ¼^lJéWd?H)]µ€çÐB=2æe#RÛŽ`c`D,cÇ÷ÊÕAã>ïzÑ‚ÁaÁ½ OMK@%{F̾È?;4õYQAÙž5v·¶g?,í¿7#–É †eä® +¸¡/`¤€Êù98çP‰ÇåGÉÇ,1þO$ _k¿wÙÂ@ó;Dk,…ªÞñ¦Âݯ#JçI"Â$‚@‹P‡$óÅÕâãùËÕ—Ïç/ f”ñV«¼X¼ys}¾\þ»·Ëý#i÷Û !OËÄC¹¸Š¹€Ò¬|ï*k__~Z2Ciœ1áJòÓ÷å30?ÐɆÛÈÔKp5ÂxOb;‚Ücú©‰çm5ïg–¾€Ÿ7àµG˜i¸ÖMU`_·™à|çV9A³BvE0ßÐã!]`‚±ENùØœˆªæƒ]U;Š%(ª3ÚtPƒ'·UíÈì>ëêžl2­biîAÌ&oÚúÔsàÐ]aÎ".f<Þ!ð×]ñáàäÖÙxdüÓ—ÆnšauºnÞº7¤&'6y÷¸ˆ’I¢³‰º*f(>Ƃǧæ¡$D¥'Tu€<„ˆÉ÷¦CªÇB[òf¬O°¦}¬úÅÇÅ›‹«—¾v"}cTë(vûD ÆB +Å„0¼>Ñ)(5"©+„i÷îòt0´Œæ)ýìÉ‘&Ú¢è\ ¨±w´nz&†5ᣛRq¸´åŽ“«©Ès +jÄîÀÉóÃHݬr*˜Ñx0ýÿÃG´YmûÉ]… ¥“WÜØí–³Ÿ2ñk¹Â*ÃjP‘¸Ûº«™¥g—O^h‚ÍGîY¦¤ð@H-ÓGu*uKË×ö<”6ý½uN/¦›ù‰•ú óˆòvà†í¸€Ð[¶Üd#Kƒ6$‡†×–Æ— Îth¯Æ•Øÿºáƒ:rô;‰˜]­Ø”æÂtl´Ó±QrêëR%B‡òh¶ „Â'³]ˆ“Kxï(ƒhÎþŽÆ–‚G¼wyÙ6£ß“Qœœúž4BÊù \,Á÷Ô]Uh(뻯žˆ;+ghi˜¯é¾ÏªCp©A«Á9±ÿ Œ4ªá!d!ï¿~ê,e²u²¡š#ã-д<ÌcYýPÚøVÇÆÝÚÂbgKW>Ú}+’Æû‘Ú)3ªÇA—8¨Iwyù¥«ztº—2ÒÑ48UÿïO:0¾ÍeÎ( ôS e5ˆÃÔÀÀ¿ÄÞTÆendstream endobj -4563 0 obj << +4728 0 obj << /Type /Page -/Contents 4564 0 R -/Resources 4562 0 R +/Contents 4729 0 R +/Resources 4727 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4556 0 R +/Parent 4721 0 R >> endobj -4565 0 obj << -/D [4563 0 R /XYZ 85.039 786.531 null] +4730 0 obj << +/D [4728 0 R /XYZ 85.039 786.531 null] >> endobj -538 0 obj << -/D [4563 0 R /XYZ 85.039 766.606 null] +562 0 obj << +/D [4728 0 R /XYZ 85.039 766.606 null] >> endobj -4566 0 obj << -/D [4563 0 R /XYZ 85.039 746.277 null] +4731 0 obj << +/D [4728 0 R /XYZ 85.039 746.277 null] >> endobj -542 0 obj << -/D [4563 0 R /XYZ 85.039 663.47 null] +566 0 obj << +/D [4728 0 R /XYZ 85.039 663.47 null] >> endobj -4567 0 obj << -/D [4563 0 R /XYZ 85.039 631.048 null] +4732 0 obj << +/D [4728 0 R /XYZ 85.039 631.048 null] >> endobj -546 0 obj << -/D [4563 0 R /XYZ 85.039 215.178 null] +570 0 obj << +/D [4728 0 R /XYZ 85.039 221.155 null] >> endobj -4568 0 obj << -/D [4563 0 R /XYZ 85.039 172.224 null] +4733 0 obj << +/D [4728 0 R /XYZ 85.039 178.202 null] >> endobj -4562 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +4727 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4571 0 obj << -/Length 2772 +4736 0 obj << +/Length 2562 /Filter /FlateDecode >> stream -xÚ¥YYsÛ8~÷¯ÐÎËRUM¼Ùq&ãÙXöÆJ9[3ó@K´Å -EzH*Nþýö’’)e+[®2q4Я/4¤&ü©Il\O'“(]£Õd¹9ñ&O0óþD ÅLHfš‹ÅÉÙ¯&œ(ÏM¼d²xìöI<×$ád±úÃyûÛùíâÝÇéLkíåtE±s7UÎùõÅ9ÎÏ^ßá×wî¯æ—7S?vîïxbþnqý›ÿâ‹Ôeš«ù{}ÿéêòÝô¯Åï'ïàƒ£)­Qì¿OþøË›¬àˆ¿Ÿx®NâÉ ´=W%Édsíš@K¿8¹;ùw·Ï^5†’¥˜©ÄM|sÉ0tC/ìôaV¹‰1C$qà "$¼ÐÜ`hŒçÜçÐ)WÕT{ÎK„‘3ÏZêâ?˜PN=)ç æå’„Îm]µ8XA×s–UÑ‚ ΢}=vNºQüx‚ØÆ3£xÂ6‘vÃè°Zh‘ÛpK¨wwé µïÆq(ˆ× -&¨d&Ú ÐXÐû©R‘“Ö%Âøìá`—‘Ædñ“¿á‰ -Ð>ðoЦô£³«ž\V ëd ®l;ìKâªxàIÊOà¨fšpŽIÞËŠÝe~³`ƒß6l*t…Zzí:EË`šª”Ñ?=ã)ø§xü™V]Õ¶Ð^’QvÕÐ%5ØP‘¡!Çt¹ÎKXžá²W&$ÆUA8¨äçõ‹&¤¼h2ëüîçMnÇX‚8îÑ7¯ãXè aŸÀ?gûŠ dõwö%Æl³!¸`v™²J Y=2ÉC-¸uø\W\AÈmÄqë¬Áî'Z{„N]m¸C`M›ÅС7$Dͺ@RÐÉS¬|z¦­¬¦IË(c‰zC7T¶Ø+Ò}Õ¯Z -„õMSÄ9]âðÀ\»©¹^›¾ëq ÂÂäâêæŽÆv -"Îú… -SzNñ¨-w€–Ö§2G͇ä5´H‘6.cÔ—-1y&káöáú‚è+)R¬xÙåõ{Nf_;‘ìy”r<€UÚ²0¸ƒÀ'SòCV&Äkê¹À$£j1¸“Yùbfx´¼Íê<åÁ¼á/YIª}ã Šqt•1O\EàR²Èx’L\ëUV0! ­²rIdlˆ•Ð½r¥Å·Ë›‘ó÷Xã9oW=Ä£iØ` †Kà)Œ,Sà¹&³Ëx ×mwøâè]ºA€RÞ%Äáƒ(báð|Áß—½§àÎ9Âå!O;,qæâñeIÛAG°ç5íÈá›mÞ¦ÖÍ%`î Ç:Q( ×Ù -•Äêçµßyê¥S ÷ÓrÅ ÆOÀx»Úz`›ˆóöŸƒùªÈÆüsAÄû#ã lèØó)$Íåû ™ÇöiÊhyQµmáVcïÐ&ã„ͳ…pý"+põÀ³xtÏ×p®8اØ]ài9>Á¿ª–]ÙÁkPÆ”½0Žœ+9:Ãký-SvO 5>‡£(ÌÀ§»yIBD’äϽ2_ƒ6CÖ­uÚpã­@Ô]¼½=»ºÅ¶ÇÚÅÁ«ÛÏÜ vûñE‘ EGJ*’ ñÊ2}(,bhFÊŒa£ì$"vŸñÞ¸ã¾xu„©¤"‚6íÐ1çÇõ`ìE¿1±BúUGš¯~V¬Š†¬L¨_;ç"\õØf"Â:}Ë+›ÓlrŒFw>®M€7ÌýåÆP×H7–µp>ºhW¥uhc/e#††Ç2úU¶;®-FåkQ)}õr¡X߇›[žhŸUi%Á¡ßTï¦j æ%.eåzPÔ•|Ï#œo`30qå|?!V5»A—rè³aL˜–<[TMÇXàÖ X2”6ü¿Ð P0)Ù÷¬ÝB‹Ý0Gä!ùb…Uö6âCšYW<Õ ƒ,®ã»€·sÜf»šV‰dÌ.,°xÄ;Fi} è¨ø•~Ç—3ìÖR´ÞŽåí‡zIVEÞ´R<³×iKÔ i!Í5žD~É…} ±Ÿºx¤yAëìW3,lþâÒˆê‚^yN‚Û™S>hŸòÑ“¸Édì:cB¸I‚…Pà ¶3<=´Q*#¡H¢§¬„ei ¿ ¦áh÷]vX{,”é)\K¦#™/‘Ï÷}¾e›f-gßÃõžæh³sÂå”<+ ¼Vâ0ÏtJû`Ô€OAVi"’ÔŽg,¨SwÔhqOkŽgÇ°ÃìW‰Ôôײ €—2l’¢­´9l«œS^õ°m™$½f­«mÁ÷t,h¬¬XQ±nèŠNûTæM'WJ-·r‚’릴´i¦>ßž pÆR ½­å”Dxà†Ûå€w™½HÝEh`”ëä(˜Eöv€Ld}ˆ !Äû4Åo‘Œ- ñnºú.Û¼ŽWsëôkÆýUþ§§tÆp›ÖlÈÆ2R)e_ȇ``Ç‚1°P4(rÞ£t.à9ÆBÃQcu¾ Sþ4d _)- d„JÖ0ã9.»ù÷›-$k¬n™|ü¢FP+I5—)&Fx³rÕ›a<® -1³7g‹)±[ÓŽöˆê¶U;«¢°œK[6ämg<ðéî7ÿù‡i¬ÿÈÀ\fnùÉuqóöæÃ?¼ú‰rMxüÕs@sðÕÓדG/ûêéË«ç<݈|Ì:âVò ÝP={@8Ùô¨p=ÍÁG!ßǧ݀„ûÈ™ d˜ö%— ø•»Ì +Ÿ*–tÃ0ŽˆÒ`æ -o¹âeÕu\+ÛKJí_zºGx.Ò¥4·MW¦C/µÌ1ñó­Còø®Ô,Ý?ør¶¢´ùd‘¯=pÚ5ønN×6Ìj+6U»|»Ç(³SÆÂ…1‚õ¼§I?ŽÝ$Œ&¾ -]™¿j×ÆŸògv¯Ù`³×:÷ß][Š³t¯î*XœP~¬êM*6€þXoX£ŠC×[〆$ ÔðØSnàén# }´ÏOy¡ãÍéCKóŠãJù®VþÇû«9þ”óFží\}ÉVÐö‘ ‹ÞâPüP&qUœ¥§9Šý”# {Pö8Žƒ2àøáú7Œ£w‹»7w%Ú6-Èrï ‡J÷z5 ÞPÁ¥Rf¥d[î!À´éâøvš#€ Ñ;°lã8`Žu•®–iÓ¾Á;²¡Ëeí¸O—·5¹ìa,¡[’¸[YÙäÈ©²*ìÃALú#]ÖUcŲMÕÚDKDO)»|(“šþEs3†“™ö\/æßä΋6«)œ·yÏ*œL„ëxržÖÃØ¿÷j·›FÐlJûH+>Ù¡ˆAUáñ_;’Ö 4?2„#Ü:;Øc7jvgYK‡=£ÌÞ†,"Øó SîüÈsð{ºçm¿V@hú"[²wXn b÷ùétc·: -ŠŽb°¬xÊálsÀ ´q}àG[IÚÿ×oà1?cü Ƈ´©:aøçíKltìšXˆü_ÁXžþendstream +xÚÍYIoÛH¾ûWhæDÍbqí[ÜI§Ý;[èô)‹EºIªæÇÏÛªHI´d.³–WUoùÞR%5óàOÍ’Ðõt:‹“È µš­¶'ÞìfÞ(¡ðfëE!N-ON £™òÜÔKgË5‘,ó?œŸ}}µ|{=_h­˜ž/â8q.ßΕ³¼û‰óáúwž<›/”sMCøïöæüòÝüÏåo'o—£#DÏüëä?½Ylývâ¹:MfÐö\•¦³íIj7 ´ô«“›“Ù]x.˜ñª Ɇb¡R7õÃié(m˜Zù}V0ŽåšÈaH†žs[B§Î›¹öœÇ$bç²è©‹ÿ`B9-ªâ3–õ=’DÎUÛô8Ø@×sVMÕM¨ÆwµLñª‚Ðýx¶ÐÊMü1Å‘äÊÝ„$åß g¸*P“z–b IžÝ†y° ·ˆ:>Ø%tu2 Á*¶ªŽ‚ UßΕŠ¬­QQ¨¹ ð°`›Ù_Àrª„þÚÄì°ˆNÏ·zö¦¶fg:u}}ìzIdYSÉ„¼A»éÀ©Á¦hHlï Ý!«ãËöè·Sô Éjžnj¡{ ’¦‡-¡P`âFè.nðëƒ6H °CN›>b¿•ÁÔ +‚dAóî¡Òt”ºÊèøÊõãèÿ²ä"PÚAË ëyß®… &°XAë?œÐÿkÐUŠÊ"É·¨+êg»®àf³æï];+°ÂHƒ÷<÷Ð6wЫŠ­èÛ‚ŒˆÖ¬z[·x¶h9ôY…$ãýØâx 1‘'Žêaâšû& +øÆv˜¬G‘ ÃWÊ^1Æ@ÇXÙf«¹ûf¸¾—òª·#}Ñ>ÍA”B„"ÎÎ?Üð#h…D›R b¤üL EA8ô¡„=w€–Ög2ÇÚ&©x -Rd¤+*^õFotÈFN{qÆO^èe$'/{sqCŠ'‹¿-KFNhj g!Z²7Þ°Ñ£ýHœµç2ˆ_`œ¨G]’  he_´eƃeÇ_‚qªýÐA›âh^𙸊”kœ'I`:µÍ‹vÌ@*dŠ¼¨WD;ë9áŠèIsµÑoWvòº&9¼@`·gT‰I%@0í…N‹J¬k›Á€ô¡½EØ¡eLGLÂä-Qæìz1ã†/qû%·˪âÖ0›“p³2cÓä<ß5<ÕÃÔFȶ ;¡PìP»}vOà`Ï;Øcät +¿ “"/W¸ÚO<ühmÆý¬Î¹>- çk‹>+…ŠØ0ãMÅ +TξG&ÄÕ’D ’âÈLAã%xc™`®Ž•Av‹û°½—¼ýHü-[ …ÝBQ`9ó£Ð í<~ˆ%´Ÿ¯œŒíàS n,'ÂVÕt²å˜AJãØ€(Cè H6íÅÇr£}E“:µÑz\•ÖeF¾Ÿë££›†Œ0“¸¹Ý%ӉĦ“&†‘žt€-ÑY'¼örâ~W›ä«cŽ@Õ{ $5ŽbáQš1…,fSIbUÙõr™x óm6Ô-tÇäe’‡·ESÛLìûsgÓ$ÊÌŠæe5•Ì‹ÒQBD +T䤉mÐÖu‡øxžƒÎŒß¬•F[¬‹¶-d•Šßû¢†Ì\tP,ƒVʱ¥NSÀ GA€ˆrÄŽ–¼ÊËe€A6Œßó¾H“c~þtÅ_ªu¨ñvÂ7‚š'&£6‚.P ØÜú¬l´’å½pˆ43J¸7¡vüµqø˜*Æ€är9!â:Û–|V¢)£Ä¹Á®ç§R¾Qa³«r"Z„·(Ž•÷T3þDzÅr)ê™éñ0ë¯NaTËyÚ†‚Åح䔺xäƾj%JÓÅ—ò 8a7écÂIhïŽØ¢úV8`ón(¢hõ8Iâ|Žèüä)MÖl æŸ2O…<ñ)»ÒÍt;UÖñ%á4À‡&pžw}ƒx1ÄþÇMÑÊÑ/ëì½c¿°ƒ©Üf²â9Œ×„”n‡e(Ç•Fn|ö£ž?h§Ç½“0òÈ—ÔŸÁjJî‘#¼2•uÑ•çëlî榸û,K»”¢39gÚáž«Åá€.[CRѤÅ]%“Tjˆ¦}3ƦªŒé"@»ü„÷Íס`TŒ ï@ÁX+¶šúÇÄ›—V¡ wÞgÞ0ýÐÕqømo˜¾¼a^fÛ‚½å¤Çsw’¶`è]Q…‰5>é/?×\3Ü`ßùpÏñY¡ð•‚†«%{Çð ^…Ђ.>¢q˜9ÇÁ+ng¯ÜÄ®/XQ¶Å•sºõˆ£ÂÀCEÅ6wöU{™9ó/A’\÷¹fÆÈ$4Qíû§©Rnt½l¸fg[mn(Ú°Mæ2£J.@Á ëj´ÝH|O»©ŸØÓ¿ú.§]?ž~Z—™—ÍKWÀ'{½DI¡ë¦Ýf¦’¤†NqÀîÂ÷b×÷ ¡=×KâÉïÈÕQ0b$PŒ@Üwgô{S›âTð5ánÏ/EÕÿ=ˆ5‹q¼XCW÷XΘ´iÞå~(1ß_üú˜¾YŽ……€ØƒWO ”øÚ|?o3ÉÕÙþ+Ò'?–ôgm“嫬“'––—=ñο¹:Ðxéð€6/ÇMeëI‘^mM­Ú¦³oGÛ¦7¹‡âÉýV®“¨J~¾T'þA/àÜ÷hó¾ŸÇ˳z¸8pÚÒãh*‡Û𳘵fï¥DyñÓ³ÖŒ jÄáeÍ›žõ²ÂOÑc­ÜP…BxZô«ÓMÓõSîí¢„¾P +"6ì¥$¤ ”E>>T¼ÚC‰ïTR±t/ì(pÓ$1¿U}¨ö¿?TO8lº¡FØ%n”èé‚ã[SÌ‹¿ßêØU{éêy”2:šað¸JMendstream endobj -4570 0 obj << +4735 0 obj << /Type /Page -/Contents 4571 0 R -/Resources 4569 0 R +/Contents 4736 0 R +/Resources 4734 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4556 0 R +/Parent 4721 0 R >> endobj -4572 0 obj << -/D [4570 0 R /XYZ 85.039 786.531 null] +4737 0 obj << +/D [4735 0 R /XYZ 85.039 786.531 null] >> endobj -550 0 obj << -/D [4570 0 R /XYZ 85.039 766.606 null] +574 0 obj << +/D [4735 0 R /XYZ 85.039 766.606 null] >> endobj -4573 0 obj << -/D [4570 0 R /XYZ 85.039 746.277 null] +4738 0 obj << +/D [4735 0 R /XYZ 85.039 746.277 null] >> endobj -554 0 obj << -/D [4570 0 R /XYZ 85.039 291.565 null] +578 0 obj << +/D [4735 0 R /XYZ 85.039 291.643 null] >> endobj -4574 0 obj << -/D [4570 0 R /XYZ 85.039 257.022 null] +4739 0 obj << +/D [4735 0 R /XYZ 85.039 259.222 null] >> endobj -4569 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R >> -/XObject << /Im3 4353 0 R >> +4734 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F64 4225 0 R /F18 4228 0 R /F15 3032 0 R /F41 3054 0 R /F35 3036 0 R >> +/XObject << /Im3 4496 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4577 0 obj << -/Length 2808 +4742 0 obj << +/Length 2654 /Filter /FlateDecode >> stream -xÚ½]Û¸ñ}…q/•³VÔ‡%Їl’¦{m6iv)pw´,ÛBdÑ•äl÷ßw¾(Ѷ¼@qhdE‡Ãáp¾­füS³,ñƒ(Ÿ¥ÙÒO"5+ö7Ál +n”`,eáàÜ=ÝÜþ%YÎTàçA>{Ú tòÀOòåìiý«÷ö¯o>?½ÿ2_DQäæ|‘¦™÷8WÞ›wo{·¼úñ¿¡÷õþáݧy˜y_yááýÓWœúò7Ü}¡)ãÜ?|`è‡_îß½ŸÿþôóÍû§qçj*ŠíÝüú{0[þ ü(ÏfÏ0|•ç³ýMœD~G2¯ooþ1ÐâµxÆ»¦¤d1QàgYüº$“Ä_Æé ÉX9’Tòã šY$åoJϯ§‚¥Ÿ%ÙÌ!vq Å¹8Q%î‰*ô#žœøîê'~¥ -†5 |kæ xþ»fX1So¨¦*JÆ^aÚ󸆡&œoB«ì` ¼²Á×ì+]3÷´r~ç(Zúyžºw~ýM#?L§_tai½.›(€Ä‰hzd÷åWO=¹g…ö¨ ¦º­u],Œ” #')<íp{’XB0jK†©‰$¿.[žP!ZÚÚd¡V)“¥g6ø½m[êžWw–¿úÀk»²-Á%A\ð"ní^X&úߌfIõÿ-§——=èvÔdf´»""?~âç)g˜‚š(Ú#§J¹¸ˆ+BñÏüy&%Óª÷;Óõ2Y‘ª:/ ظŒ<€Ïu_Œ,)ÅnÜ´Œwbÿ'Î ’ ¬«=!è~0–ñRšÄ)—ÒÍšã’€½ŠíñòN¬‡@emyÝàǺ·ô?x r.»|ÕAÓ»rƒgÔgØ*ï‡ð -@U7eÛñ2Ù9Àz«õk4™ìÀ6€DMwƒ/YËþ#¿ ,®™ÐŠüß%Ñ_îÿÉ£î¥ã·Ú –a8žIç E×åÞñþ–œÐÚ -'|«Å„u1N¬@]¡7_D¿ç±±ltP°TèºFO¥ hŽ´ß†ž(jô«õ‹l2ÌgkêÚ><Ê#sä‘'ÞmÙ·;ûÊÊóéxCááGD …‹Û†ÃßsÕHaçÃ&‰Š|ye$Ž;nÁÎ1>œq%ñ‰³Ü_ËW3‡b_«±ÅK'§‹—Ñ$!± EÙÅàEç9È¡Ø5UA‘{¹ô>}G/z…â.Ÿ˜²G…ïjbšyW&³A¤f{ù$óƒeø:ó#Îeà¶tÂÐÏâýñ#xÌÄàÕKŠâqMû *`…–ü((Vk7BÚæϾä\‡lÕ¡–ÇKÔð€ñ¼«H÷(#HÌzXW– k“-t#ô‹‚똤æ½uEnH˜ae½!çèrY5Œ$ÜË“vD‰ˆ´3Ì#Üfø´î@SA³GÐjË3»#o 1À)®¢!…§{•õvˆh-H[oX{=d'×À ýNËV-¾w@ˆ_¿à3\6oDÄR˘Çäax çA·¦åm‡–4ÝÎ¥@:vÝß‘%z´R3y1pÕ¼”xöëÏø`Ør/Âe߆ù-ê^:ž,xÃCütìƤ»£;e—>žgú¹)ê£(,‚^á-b ÜñEG£QΊhÿiJ:űmOuµ>É=½©ã„Ä•@‘/+MË1§eXÏQî› 1èZ Œ Zî­Zº< -¬˜Œ†0‡üN#=9íE9øi˜ ö‰œ’oç1:ïx\Ô•¤NxykQ§íñÄ~Ø©´zŒ-¨þ¾ºsö2’ h'âƒLJ¡qhÍjŒL¿`ÌÅëŒH|„@ °’âL®Ýv?ÊYec ²Þšè©Z‘žmà <¦?PWQ%G ü+)öz¼‚C/ ‚€(ÃA=fn(`)†´[˲Â{äHÄð‰Î)™Vö“ÇDàÊ–aHm ¶ød[¼P[ÊnTGıVƒã1µaœ‡ënòîþ^¼ªê%›ã!ôéíçÛûÏsð6bÌ(¡>ilÿ9c¢š¸Ž©¥"¸“K5N*À™áÓ«EBµXN.E@E´\á:½´îyÂi’¬ u ç•1Bc;!î Üþ‘Þáqo>ãüÍ»Gνâ(µúŒP-Ó¶eaó!´L†ŽV%O”Ú—†ˆ|` -ã°y&|ç ɈÞsií}øô$ ë_i†ÈžõÎìÙ -óGšÐ†‚ßÞ÷Ýu÷Ožd}4îõ3W'z½‹‡Î 1SŽ†‘"as$7?²u!\З)³ý:”Ãr0&™¢í¬ÙQšOh6BE³iLž¾CŒÐ+ÊF^é’€æ)ÝžÚéY p²ÎöìªíÎ&ß°"w4ûýpðÚKÆ”¹šJ™‡ú$ÊO[ƒêG‘¤¨¨;'Ú„uåh»T]|xàL8óHD¨Äë5Y7Ý’1†’8I±»)t!­7·ìëM_òœ÷m÷cq„63Ʀ©›’–žYQ†ãÄ{àšNî‹T½ž%Üaú!T—a¼ô3¥þPOÍÒZ8Ä.Só†I¢†§šjPœIS­Ýky)¸9JêñÀ„;²Bvƒ•Kã0Ä^J XkIj6sWL&6¹ƒ!+›¶½‰Œô„Êq&~¢B×oL÷lgìZ‰ªÔÏó×K4g(ÑÔ4‰Så¨<ðã–]w6­ˆû õiAêG…öMÆ‹ŽÍŠ¡7N׫g[Ëb_dpª²:ö4¤#©|QhRž 5+Ò„S’†w˜v=æGa¥ž¾Å•8œŒa˜R–1Ú¬™Ó0…±“ˆv§«\QC®ÄnÍ#Œ½Y9S#‰ÐPÚ!§ûBmǀꇳ, Ò*6¡©´Ê–8a·g°Téë\RÇ´S,¯ñ%ŽS?‡¸b#[ã„qüMѦG‘mÁ8¢ƒÙµ%~Ì?ïžÇ!øÏÇÿ¡Ÿ~^©ŸgWºIú¡˜á8¬Î9N¢ÌO²h‚åÿðg°endstream +xÚ½Y[oÛÈ~÷¯úR +ˆhÎð^ q’n½Ý8ÙØ… löaDÒŠTIÊ®þø=·!)‰vZ´X0çræÌ™sýf¤ü©EºžŸ.â$rC_-²Ý…·ØÀÌJ(¼EàzQˆSWw— £…òÜÔKwDr—ÿâ¼ûëÛÏw¾,W¾ï;0½\ÅqâÜ|X*çî~©çÓ—¿ñäÕr¥œ/4„ÿîo¯o~Xþz÷ãһɖ«À "÷üçÅ/¿z‹ÄúñÂsý4Y5®ìK˜4ÏÖØÞ§§Ò~äjýuËø®Žçí"3¯Ÿ¾Gž÷pºØ‘Ó”(ÒCã¢H‹•Ž"7"²—Ä´è£s¤ÎórDS9e_tØUÎr4|P&èþ¶‘ö-ð/3™$õc£E£æ{Vò35h=S0Èøˆ|T`ÎËÖÈ­1yf˜9²Vq °{“šê3}ÙÔ"®6àVNgO‰»-Ùb09RÙJ¡§¤ƒ¶ +ŽÕTÒiÚ¼hyñ‘¾•—€3jÑúÞ´£€=,Xù*aσoó€ßØٰЦçöL°]*öªÖ6@ðÀOIp¢èžÙæ_¼–YÂ/=?œ´ëyV¾ÿòp+?ô(Ô¦ +š9£D—rþ4#Aè¦qþƒ›©ïKAÍ?ó穬;nU»mÓõÒYƒOôÜÄQÙ3 +>nªTD›6íï"ÛW/ôŠªÜ•µ¡È9‘—œÞ +´jNëç³ý!†sëhƒCÕ[íÿŸ5OzœîôÌ|¤ÿHö§mþîkå|U~€ŽÚpHÿG1„Š¶c +L)8&þLc IÌ ”!dHœxq—õÎ/0™3£5åÁs¦¿¹þ·ºç®'•î„ªáqÜ“öÁœU¼¥MÌNxmD>ÕŠòëqRa)&É Ý„ÌæÓÎç2Îs°3f1§SUKNAàÜánÆÕ̾uÓZy ÒWÏRÒ™²iURéÖœçÉ€þÔ€:òÝHÙ|qYôÙ%Úß>3öN @%J¨ßÌð‹Ü(RSnu×=•}¶}‰ãlÎÁ°™‘U¹úXTöê—X§ÊüHèÝÓʶ›ýGt{Åá pÕz,Ý“õ L 8€sdVš¤ü {pÓ})¬vÎ}â\U„I1zÛfÇ[JИKÃô¾Wyˆ¡Ò¤×Hú™¡³ÉóAQ]g…½B5Ö™å1Ç—j€R …êl U^ ؼ"ß™ ÷ûÓÛ»)ðrZxE^îƒϽGÅË©Mˆ>ÂÌb8ÏåoRÂƆŠ½dÁçþúF˜KJcö- ÄÀæ¶ÜlíÕ€žN8tv; '¬}9Ï‘Jñ‘¦Ì_*xd‡t„Go0¾/ˆ¾Ç:€Œ‹>1jù&MĤ‰CJ)0'Å5ƒBÞý6Œíñ‘¨ªÆ$ ‹[.M_pŸ×mvã-§µì,b{Jùp”uo…`÷èD8ðÂcŸR \A%©%éïýê§ãľúµ;ÖÑqdÓXLé34´×Óe{ +FÁü#B~$Ä6?J§é Ôa“}ÊHÑBŽè£®ÆÜ°RpKƒïd5sa³ uâ&*xá*¤ñÑu V¡}O¯kÊQxg =J…>ŒNlθnn·*ø\‡¡ ÿÚžƒÓbThB^›Ùûš¯_’ÒWnò½ûÚatXÇde…»öRÕ;_Û4—FÊìáøh€¶ zÖngÎIºÀfgΞªi{ª-A< El×…´õ¡ X£ƒˆëj€ ²kxjz¿™pþ0àkWÛ»Y·[¿ô¤à7jü "¨&Ï®a P#XŸ±4Œ”îtòå> endobj -4578 0 obj << -/D [4576 0 R /XYZ 85.039 786.531 null] +4743 0 obj << +/D [4741 0 R /XYZ 85.039 786.531 null] >> endobj -558 0 obj << -/D [4576 0 R /XYZ 85.039 489.606 null] +582 0 obj << +/D [4741 0 R /XYZ 85.039 491.425 null] >> endobj -4579 0 obj << -/D [4576 0 R /XYZ 85.039 447.259 null] +4744 0 obj << +/D [4741 0 R /XYZ 85.039 447.259 null] >> endobj -562 0 obj << -/D [4576 0 R /XYZ 85.039 217.996 null] +586 0 obj << +/D [4741 0 R /XYZ 85.039 204.447 null] >> endobj -4580 0 obj << -/D [4576 0 R /XYZ 85.039 181.129 null] +4745 0 obj << +/D [4741 0 R /XYZ 85.039 167.58 null] >> endobj -4575 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R >> +4740 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F58 3380 0 R /F59 3455 0 R /F35 3036 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4583 0 obj << -/Length 3004 +4748 0 obj << +/Length 3144 /Filter /FlateDecode >> stream -xÚ¥YYoÛH~÷¯„,šM²yÌ[îõ âx#íz€™y $Z"B‘ -{üï·®nRÝEGÝ]}UWW}UÕT3þ©Y¢]/Hgq¹:P³Íá›í çã…’ ²y³º¸ú £™òÜÔKg«{»Nê¹:f«íÎÛ¼¾]½ÿ2_AàÀÈù"Žg9WÎëOo^#9t®¸÷ÓKß¹»¾y÷yî'ÎÝ’;nÞ¯î°ýùËoLxó…š<æúæ#S?þëúÝûù_«_/Þ¯,㣣© @¶¿]üñ—7Û½ðÜ MfP÷\•¦³ÃE¨W‡´Ë‹åÅ?íZÜÎxÖ””t¸: ÎŤô„˜´v£0&1ÝÔ]§ˆc§Ûƒl²ŽOxĺÇFä´ó…r°·îË-“n>¯F}¹ÌBéf‡¹;k¬Éº5—ëù:Æ›Q=q¶¸ò!+*^ñ€+f-²¥œ†i÷8¤á©“q )çë®N•sœ8Õ[Ó‘ã%À -å™’ÚŒ6D^¼Ø©ø&c‰Üypð·ß1ÇÊùe¾àNú‰ëlƒâÛ3å)Åv>,ÙäÙ°Mèpü#ɼùz Ê]‡BFßv<¯Æ‰åÓhÇìÏî¦C#©fŽTXÜÄ&à\ ‡Œî´ÃÕB9ë¦&îZs!H<šË´Ãý®!E9Â)Â$vsÄ]†Õm™Óê-N¦îeòÞJÂÖdÝ¢“R¦Ü¬.™°ÌH(댛µŒ‡‹ê“áÎ…Þ¡¾<±š°T„s l6‚mÆšíA» ´vßaQq\]ýé©p‡xÓä2 †J.À,¹ÖÂ…‹ò(ÔÖA_ûŽ; SÊ쪂E… ý¶-Ùr󼧴¶è1qU S›¬,aêÓ„F÷­è;#´±™ln-QÐFŒå½†Þ¬,‘¨­ -ÛOM»O;‰0q+ˆa,60XZÛ~0fI#¥þzû€U|îíøšŽ±Ìebì9¾çyXSÃL ˜Jwˆ${‡Då;„]Pb„Kö*±ßH$Vc‰À*çbû\pˆkÙ6ãâPü}~¹•›ÕžâJ˜ö|§µ«=°°™LRÙr}tƒÐÊ«‡‚À§b§UuLGwÄ3¡Pr5âƒB/p^Ó¡e‘›‹@ÑE9Yò9÷È~: ü†½Ê!¯¶$NX¤Û#T†ÈâÍBrd9ÏE—L•OŦ©Ûú^FŸKˆ#iS{“Qkd°,º‚­=X®eœ/Qžbõ°À¢®È—&É„8/Y€h¬8€àâ:E-ñ‰ƒZÖ»†ÞK”Ssi:ÐðI”%Ó÷&`šÚ¡cÌas=òmõ!—0K:Y#ËÕ÷®9€»(Û‡]ËO5ˆ±­¹¶'G$.zÖ~L.ú’I5BJG§Ç¦É;F“ž­>Fl+ÉÒ°«“mkp5A.Ä¢ã%‹6áÂ!Ò&å“0’Vv2ºÄ´´yRå;×”,x YP~²0ISkŒ÷·73Ç* ²rž'"ÞHéd99Xê¼íLîÛ>+_1éHÄiDͳèÓ) ¥*:j±€ 1i•ahœÜˆ¼Óò»Âê#r®KV"›[B:þ¶9 *CI4ð*aLÎiezà4•7¨H·)Aš1"›õN˪äÎljgh2‘ÝN8™NÀU»*¾û†2CHé{£(^iàÆbI£12çÃñµöœÛ¦^—öÈÀZAÑÖeßä5_àͬù=ÞFc^Dñ2ŒH‡¬Þh=Z«ú0$µ}b jóÔ¶zÕñ” -ñ°!é¬xľ–÷¾/EÃiZEÎõ²Þ¹ç`Ž“1²,eÀu)Kæå‘kÖi`£kð± fN9 ÙŒÌu™¦,æAHq'[s"Dˆ~ÇÄrôVP2 3p,}i6\\Ü›6EË„ÚìˆW&ò -#í¼&¼ Bƶ‹Pg˜Éþ*ãìšFLœékɨc~wÀÊ¢•N‘³T‡Ý×.ïÚ‘uµ5Ñ­8´9Ý2™£5÷Ž§0N=Ÿxs«83­\Ö[ÛÜŸzZ1RØ/림“<¸%ŒI ¸à˜‹{)ç6!åMQ–¯:ëÄ“!á;‚øCôJ‚qu¤@Ú¸'h*%fh;RPŽ~Ìû£k¾qìsþ„r[˜üÐ>Ea„’ÌŠ- -ãêC¨Fv}ªÇÕýþx؉ùCèCìé±{|™+¥œãû®+s©XMeU?dÀfÃ=§V¹Ù^„BÇœÄúÌâ0(Ç -_¿e‹Æ2ìÙ )’¶…q‡äE2y•bFr®”vŒpÖHÛ²ƒƒ¤;£ì&##]Zˆ(N^0÷YÃJrªo’-6gÞìê#Ý+œÏDþŸ›c›+Èƈ&‘e+CFqYvdr2÷ĵmmÕZûÓ·H“ö!K»’$+™N¹8ƒµÌÍ6±ô€ØÚ ×’¨7`è -È-‚¨¯˜J¹³ ;ZrÏ´$º6@­/gŒàœt8LT qè\ßÂü·?scSWÓ ÇŽ<ؾC‡ã›n™b| ÖÍ b½’ži)7Œ%›â®ç‹¦Ø@ŸsÆØÇÍ(¯ž8ò`þUð0‘Pä±8.È`^h%9·èiqâ$óÕÉ©•’¾¶ÄÚ¹+ªmý(ÁHà|Û—cEN|Ìš¹†íeÌŸžöXøÖnÏÔ%éãa=×ôâ  wmpv&Ÿh@Îuê0¯y´GŽ½²1´ˆÀŠ[α)炨D–™Çºz:Ôýˆ1”SþËÄ|$½Fö§3Úš÷ï«Žy}Ö‘·˜ª$šßPkîgÜ€ -¾ŒÜbÇ[‘öø[˜Òꦑ åÏ÷‘¸:ö¥U6Dïhz7á½2a—%Øæ—’&ð±¼ðÅg¿Ç–iô¬õ;Ònñu +Ÿçmö…"™ý¸@L¨+€û,‘ýI2켡Xa3äò?É+Íÿó¢DhøB©Ý0˜Lpá?Ÿæ‡¾²ir⦉?‰jßw}e™á,ÙαùÎòìÂendstream -endobj -4582 0 obj << -/Type /Page -/Contents 4583 0 R -/Resources 4581 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4556 0 R ->> endobj -4584 0 obj << -/D [4582 0 R /XYZ 85.039 786.531 null] ->> endobj -566 0 obj << -/D [4582 0 R /XYZ 85.039 419.173 null] ->> endobj -4585 0 obj << -/D [4582 0 R /XYZ 85.039 386.752 null] ->> endobj -4581 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R >> -/XObject << /Im1 4096 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -4589 0 obj << -/Length 3738 -/Filter /FlateDecode ->> -stream -xÚ­ËrÛ8òî¯Ð-TUÄŸ§­8ÎÌx¶âdmOå03Z¢%V$QCRqåï·_Á‡¼‡l¥  ÑhôR‹þ©EûÎi–ø±V‹õá*Xlaä×+%3V2eå̹~¼z÷Kœ,TàçA¾x|¶xòÀódñ¸ùÓûðÛû/ï—+­µ3—«4ͼ‡¥òÞº~àÈ{Ç£Ÿðz_oïn>/ÃÌûúÀw¿bÿóý¿p}O]žs{÷+CýãöæãòïÇ߯>>Z£)­‘ì®þü;Xlàˆ¿_¾Î³Å ´_åùâpÅÚ#-ýýÕÃÕ,.‹¼jŽKfÆJå~Ưs2Iü$H,'CU~Ç.'ãØO¢”8 ÌK}à›Æqà]7õRÞK[ð¸\)o |H¯X7uÛr»=?ÑPÙµ—8$ëP¿Nj?‡HUñÌ¥‡ÊM¤>Iëhˆr¯ÛAOÚM¹/‹–(b@ýŒßÔ{(xOv3á«ô¯ Š=¬>í -õFc5ž¼CŒØ ÄgœZ®ÂÔ«›®ÜðЈÓ)\ãô¢Ãf}äiL nˆ›¼à¤VVÒ2Ú…ù lZ)¼òœÎMœ§ù°=H$qŸ¶… -½'øÀ6HäqÿMUÒ¸ÕHÞ#¶‘ÖÊà f©–R„o â–ÆÞŠ‘—²rgèÇNW ºžÍL1=—EwnkZI|ä¡êÈÄo€¿¥‰¦¦<âÝ1Ñxܶ¾aO˜úh ²çq™i`ê* -äªÊ;900ä6‚Ü&H€]Ñ9(NÈÃ#? ä @ÞÝ~‘9î ´ C©ªJàw’žs?´=^Nó­u‰<MÑ™iy‰?¸M¢rîÊƉ\5DnjÜáM7#-§¢¥ M]l¬@¶C»¦^'küHå°# “œÍl¦U:ç~ ¡g”®cp},¦öA–—FŠ¾#Zî!ÀÒ<ŠîD¶+äbʆ§7Œ¥X3“5œÂ=qÌêJ”gÞ bÀÆ32®áö_ÂõígL½cq`ñ¦£G^±ß³„TÇ­YÒ]ãŒÑç$í8Å¿ÄÝMcU¦•iMq4"¶§K«ÈÀ -ƒá‰ ‰ Ý,…wØÀ ™Þë¦f€•¹ÆCãgSÙÝ׃þ9—Ín¢Ù s¸ò*_y_a2qG‡œFC¡_ -é.Lç¯iß«bH.hÄ” ]Dà7_¸AŠ´^Âa¿Ñ>B$™ƒÊ]¥SnŸ¦°Æ4CÃâ±À ì@¿FЮ²ºˆGŒB8¢à°¬+ZºXø\ †‚?¯m“ybH°Ù‘ýÀ‰F‡±½)Ÿ 4xûî-Oqã‘¡`©,ìÂfŽNr£Dòs‹ÜÝ—þ…„+?L_O¸œ967'\Q$å† -³CÈT~CÊ AThUQ&7(mb!1\74¡•ó‘ЂY~B(7=áúKiæ ‚iŒl@þuáÄQªý4{½®à̹˜bF‘òÓ˜­ã“ã*ס0áÊM(ZãTÈ&&Ê^i²þvׇº•J’B'ÞÇ)’}+ß2sx§@mÀÂÆ»pp¾'>íKIßÙ<VÈ,–ìÆÉÇaâÝÊ ÈÏʻ⛵jÇëðÉ&³À”úƒ|ÀÄ6Q,é>)( JU@ìÅ -as[Ê:VXhðIEíh‰ÍnÂÄs|¾³[ë̬¤Ã~…-0{ H,¬ATŽEÇî¾Ø¶Ü’¤v'>„`ÕÚú` -  š…4R<ñŽ®k«æëâÔGÐ'ãN>o­Š#išº]¾ìJ1FH(mŽ¶gr%w¬!çèu#o ðÙ>ÔÇ¶Ú”Í š@"pãÞ» >LÎáiͤ~HÕ:Ký8!Õã¡f»àƽ£¨föÊ™>ÕÔ1N¤}ÎpR.Rl Ì°/ñƒ¤xcJ! ÷“(q)3çuúƘ>æ÷*Œ´Ÿé #¶·Fjé~±Bé˜FÍ]7² -ÉþÇfìaz¡|5»GqìsAceŸqÜØvü/sË f—{³Í}Øã_ñ§ÂÚ²/ 2$ –’×!¨85ªCôUGͦ±{ !~¢ÞlA;æÏ41ˆ$º†e•X%í‚áP°”ƒ/îS<#"õ˜ÈØbÉIh{ï[‹ÏšÀ!QÒåÜ7Äx™K_'˲¾„f)GÖØ£kª¢Ø½˜™ cÙ°}ɾΚçØØ;TÊËØòïÖšt–F$–ú†¾¬©Ï'†¢´„B'ì[·z0U¸}µ®Hh¼™©ý´ŽCQEw—ÅÞ§Ñ!uA¥ë¿JS_Jj•û™Šÿw_Sô4WÃ_\+ÙÔN¨,ð£TÙÉ0y$ºi>×, %È$‰‡™h;V ¼©YF€}]#Ûík“ɈS±Ñ.ŒQåÒÉØ‘ƒ•ìýRq–áL½ß'VyìG:œ¯Îäé\åUçà}«–‹ ©S¤K+×Ù²]:‘ýá:¾åØj’¨#¸ §¦=òã4\è ñÃ$ù©«5¸V²9úYÙ‘%7L=’™‹`!ƒ’ÃçÉ|Ö)5ŠãF\Ë°¼WúYn¥îíµxù©á¤°F<è8‹³ÑªûñÛ”[¸Hg¿ bµI”[âÂÀbX2ݨ´Á!SG·<­W¼§Êo`Nœ»6 á“âMnd”G›5U'Jñ €Ì+H-Õ3œÁ¹ìvš—¢ƒI - åy«(H µI?틵4¹ö“KøÈJFž§¦­¯HòØ”ÔÅ‹…ÆÀÀ9‡’è>®ÆÎW ›šÅ0Ï}¥³~ä?¥;×ÊA6£;AèGJÙYò^ª£I¬"f`âDF<‡ÞïÒ`Æ D*õÃ<ú¿Åàzý(Q@˜ ŽrmÒrËžc>¤H8¾Ã#¡Â“nkûq˜tûNÏ ÜÖzê æþÔaѪÇ4ãËàÒ’Àîfì]:wd|Ö`†Á<ÍŸ½ÆîÔL™˜)ýv´®Lð2e_“Ês¬¹7¸ssŸ&Œ³XçJU«†aô|ÑtÕúLuŽÌÀÙÃGÃ,Ñ}Ä<æLÄ¡ñý9…|&òóTý\Ä!¸V²™[ŸÅvC£YÏöájBO¶R˜þ}£§Á¢aWlKžQÉ ¾Û¾&‹ —Æ°g{».ø%‚`ƒ+ˆâ;êFðËù0¢†»V®¤oUº¨8%»â^ÔùÄÕ´B\Ð §÷…Ô¡è#Åл] K¤?Ë{Öд÷opQÀS›l96“J£©ë@M• Ä'êç}=Ûã¨Ýõßò¨Fój|kG†c§Ý -NB±_6ß«µM ðý„<"0E«™emŸ‚u¤·c:¶p‰{Æ‘ºõï%JrL Þ‘ q¨dI*¯y°h¢ø‘I]0(«¸p–:|‘IÐK2¨%KmôËL‘Tâ_IÞä<ž¦Ä æø.å±´ä$ˆ ¤ÚE¢²áETU -úÌaÏźãVØ‘ô Û‡q Há -Q²„Ø; ¸8hW<èÅ8ê_Œq#|KÕ”êåqÙ<2÷ -ì)Zfý ¯…t/DpIE³¡_†4æܾlkÃ÷ÒêgPpAçCi6d %îßÑõœ^ºªx¡@ǪxáqWkWF¯y¦€lâ涖°Ýˆ¡Ž†ÁûêHq¶3±TÓRªhsÙ€ßÍÌ™À_°ÈÈO AoY™À•Œ«ŠÌwm^–au{îD7zSÌ» - - ß^Úµºð#žÈ%ÚÀ¹(.=8/Anòxoñ¹Û‘ìV]щº¿áágsr¹’W~½‘ý -çüäÃÒܨGYõ‰ŸÌ ]`cÀ$è ¥ïø‡ÊànyKç©w]œ[!D°Î†p˜¤”Ò„ýÍ@šN3¦É^Ü\!kæ'pt»øcôB~˜ƒŸ˜ôZÐÃŽ£,ã_7©hú,˳å숑%UïÖ—ªpdR'zZ³LfígÈrýMOæP\ Ùq3/!ò¦Jw'1 |é–"ïM‡¼;·¦¸«¼7<ÀngŒŠÀN´?Ò±'˜¬è³TS˜Àr‡Â.õÓ8¥F¸> -¹ø[7”ߍÂ8l Å%‰ËÌCŸÆbÓìË&ü1û~ê¸ýkaæçÙ…t'C?T–~$`1&C™ž!ù¿¢"Ñendstream +xÚ­ZYoãÈ~÷¯‚¯?Ý-WÖZ¦—«8N¼ÛOKí­–&ñþq÷3O¾_®´wGCøçáþúöÇå¯ëŸ®>­'G®?ˆ,žùÛÕ/¿ªElýt¥|›&‹h+_§éb„Ö+ýêêþêŸÃ.<,xÕÌÍVŽbe•Ÿ$ÁpEÎ\±oàqêµE‡Wh*¸Û3^¡€ñDyý¤]C3Û#Ogµ÷ŠÛ$Íf¸þ•÷ý¢t4uÎÝÛܤµ¥lTI[{ýI•Wöã +!j‹MCìéHd'/òÉn™¬y\®Lì50FÝ{`8z̸›ÑBn¿âDslñ­ð4Š.%Élª²¨qºÇãmໂ¿ùÃõí=·:⧈z¾ÛÓľ‚§Â=?¢´uB¬7=·y1uâVa®G:nâøUpܽ +´?6û¬¬yùMÆ2t¯ÒòðS# Ùö…nÝ~Ý"ËÍñÀ“ý..v¸Íé9©×e{9±–ˆRè29ÿv=d(wFþÀvƒuðûka0Û,á¥v<òRæî8ãem‘q«v·é‘mÇ;ª‰Ý2%ÉîØõ¼]SW¯“£øiZÙ‘ŽŠk›z<û#«Yæ´†nP½X¸n÷îÑæ zÝ(uíH ‹9ÝXÊ7¢àî¦Û ›yÅF‰BŽá˜'ü*ïeWô;bÙLôo×o¸q¢ôÊk„>«ãTh!¼BÙÆ0Ì\³P&GæNǠ͢ézÇÁÄòȆ/o{„ô\æ$Ó-ÛM¿#¶Ñ‚UÚgœÝPÛ?‡O„~lbØÙöÁÖì»À@ F— j€Éà¿@\ø:гˆK—I@ãïîC«ìÃ-&Îö }›,´ ý@E(GÁBk?E[Aù¶Y" 6\:‘Xû‘¡ë/~[h_ijyvÒ&NÇE4ðöz¯`i1reSß«AäG±Ø2jÆWÔ{! Ú€L?I&4àk"áñÀ˜p-c"~W23t +Ûc‹ØC<7éÃЊ;8Å(ZÐkÄÞã±ç™²gÚR–Ö x±¡¿]G¶Þ¾ò,:<üvbžDX"Gö]Ú«7P‹Wr©©.“B@jr†h^A8\'—B¸é5ÌÞb㧗XL´õnî'Ô%ù'ÙóvÀõƒ„ey.䢔ö»üY©ùêùŒ1Þ¼Ò륾a+p/fÅu2ÚÔ'Oe ñûŠpAØ%[ñ=ùÕÐ!Â!úUâ]Ë öå7ᑺà9´÷vdhâR¥uyçÈMlî MЄO‚#Eý\ðÔ²Ô=75…ŒE.ŽÇÄ÷ŽNÝžxXžÇ$¢@Eúëf£wÃØŽ8‰ÄÎm]xK2BäÒ¸)7ƒ£áí‰Ñ'/Ôˆz¢^L´ÉxôcIQV_²YÀ³„JѳࢌiµÖÞj°Wò£09\ $ bº³š–ÄØåC¡ˆ…""kköò"½á„|§@M\:Ηî>Üoê‚©2‰*yoöÊΑc{¢Kº"RwSû~Ö9&äŒA—/o2ôHÈnÊF©¯º)¥ü üs.cÀÙ1d«!ÜÿßýØJƒOL`/€|ÉŠ¾Ÿ¬—‰¥Ð3hdˆPd;‰x­ÐŸ'fW¡é"^4Fi‰ñ™bwèåœö(ñqôBþCÈ(Ø„ï±;fe –¸9 +g/eUýÎ l]È)¶äÇ© xczŠÓ$F;ˆÇ›JjåH§úÑP%b †5 Zh§ ÑÕF±œÐí}€Ù§™‚ô'˜æi°£s¢Rž¶©xð…#wlN¡~±%OLÃAkcÄ*º“Äæµ²A '2«4òµÑ’Έ/75)˜dÕ5Ü¢‚†øsd»ÁÝŽ5ˆI=I +»8…1êdÑÙî³IOõrlÞÊ2Xö¼¡áIáï±Ü«ö\DJ;;gh;·YwDM«‹ÞŸ…k”Vj8¥ÂøÁ!0Ò!Í-S‡—ÔVšTیР"AÙÅI Û_´ Ž¤dáÑùfŽqØmÝßñ#ƒâe©IA$VØO’]<|Ìæ\ï‚Ö\óÂáy@JoX}8ï„Fñ-Ûª# €dÎò4ØElÑ÷¶Ø7¸ehð1€SdóÒFRíÖ­)k—VŒÆ}byVû!,ÿc–·ÏjgÛˬÄ’„¾¶f¾È´‚pßÆÑI\}îÃÁ±,tÉ¡ò>·Ícåt4ÈF‘wWtT›9’ž3çYÄÿß©ù\cVJÒÕì!›@< ¼œAÜ™XÇ£CÅÚ¶kú}‰ë0òÓÄÊÁU³õ!‰ÈçEÅîi0èðyb¥„ïÀø®¨Ü"X’‹ _yFèZèv²×Ü×D¼…ìïÚW¦ÎfÔÓ˜ÔU0Þ„Q1°‘o#sbUñ\T3w„·QγPf iˆá +|-ž\,Ÿa^°åAΧ«bO/HVe¼w„¾–3¡‚[RÒ¡–È$D>„ð¡£gšs×.äUéb0¡#œqØ}°²À +&nÌ%¢ûŸ†Îb‹oý¬ô€,nZüÒT-`–ó5bd<å\ÿÐäƒH„°ÿÒ~žõ3¯ƾ‰PŠÏÓIâ'çNZM¢øÿÔ^ÐéAzÇ™èÄP0cˆÒ1 +¹n×+É_°ÛSô‚Í1ƒ½²G¹vÈÏ¡¶S ç0¥Céï¤Ù׉‹•æšíØÍ!#^pºüwÿéî_Ÿî欂Õ$a—(À +&‚×~S{.¸pTŠ¶3[FÖWCáW¨°í¬çáHaµV2}V QêBœOVçs Bô¦RýG8„¸-t &χgäew¨(Å 2ÚÔ KUÙ!•è49X|‚¶ì±*&µ0 +¤(ï”1Š!0'åû†J±ŽJÝ®98 I¢“â{2‰zIŽº²²ê¸ç‚ÂLÂä謾[ä “î Ïk©0Âh mÕPâUͪäTƒ—Ý ”¹ûÍÜýœ‰&jbÌcÝ< %À¹1m‚·:Qt|”(Š]Òœq ¶ €ï+ü…‡|t\Z#`J­‚ן?ü•[cq«.¨-ñ\¤&ëP PÖ‘ìÛÝ. R¦Ý¯Ð̇Ê4Æn2¸= dïŒ|ěˊ¼!VņKh6fdЙÔÍAWwKí>阰ÂRA4Î=ªõŒ`/¡z—Š½‡óZ—J±(¥¸b”q~(sÑ%u¿¨PeBýRâ¯<8JéB̉>PhÞƒDÍ$C9r˜™”# FržCuÂo>¸¾¬ª¸ˆ£sdî8 {Ýž?\èl½gÏ")oÀª.…Æ0 +tZÊdzò‰D5ظÆÙÏ°Õ)¦*…ñ‘ú.BÍ£:T"édƦ„^*a ·ÁwB²‡Ò!,áŸêí¿?KåÎòàÞý¦ƒK1W¶Ûô @iÌúŒßš¿X~ºyÿöU`~ÀzV*…cÒ9Á}L~™þ44„i½ûlªÐ­Ò„8Æ©Ëxˆ³®ü­ÄÚ[•õù­Òð÷·ãøÃC¦ppa”ŠNÑ^^+ñÝÜóô‰ñDòòÑô +ý¦àÞéO•˜¾¶23àt: %¬¤Ì¸._Èr(ûÍÝ(ç•<,–48ÙvWø ç~øŒË×¼üÅ ñÅå†éKÜoÒô4Wµ¼D“5î"—°cïZn¹=ÆË 8«”u§ G¸bé:ŽÞ°l¹¾5ËÝOVY't4” ÷îM€Yñž@ü*uÊÑBP‡³•rüìÏi/mãÒ5‚M'ΟÇ(™ÏâÓœÛ~dã!ƒ˜é)ÛÝ\ôcüD¹ðøÿZæ +)ÄvqàÞeŠmbH£­Ï±E4îÿª°±qþ¸×÷Óg­’‹ß&1 øW6ÇàVÄWendstream endobj -4588 0 obj << +4747 0 obj << /Type /Page -/Contents 4589 0 R -/Resources 4587 0 R +/Contents 4748 0 R +/Resources 4746 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4594 0 R -/Annots [ 4593 0 R ] ->> endobj -4593 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [226.407 384.444 329.642 396.133] -/Subtype /Link -/A << /S /GoTo /D (browsing1) >> ->> endobj -4590 0 obj << -/D [4588 0 R /XYZ 85.039 786.531 null] +/Parent 4721 0 R >> endobj -570 0 obj << -/D [4588 0 R /XYZ 85.039 766.606 null] ->> endobj -4591 0 obj << -/D [4588 0 R /XYZ 85.039 746.277 null] +4749 0 obj << +/D [4747 0 R /XYZ 85.039 786.531 null] >> endobj -574 0 obj << -/D [4588 0 R /XYZ 85.039 500.273 null] +590 0 obj << +/D [4747 0 R /XYZ 85.039 370.286 null] >> endobj -4592 0 obj << -/D [4588 0 R /XYZ 85.039 466.735 null] +4750 0 obj << +/D [4747 0 R /XYZ 85.039 337.865 null] >> endobj -4587 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +4746 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F64 4225 0 R /F20 3021 0 R /F18 4228 0 R /F58 3380 0 R /F35 3036 0 R /F62 4159 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4598 0 obj << -/Length 2536 +4754 0 obj << +/Length 2357 /Filter /FlateDecode >> stream -xÚÍZ[oÛÈ~÷¯àÛRÀr2W^Š¢€oÉz·QÒضû@Û²-DI®›þúžË EJ$ÝÖ,0çræÌÇsñŒŠ$ü©(wBš"ÊòT8£¢Ûå‘Œ`æÝ‘ò‰'I4'WGoÞº4RR²ˆ®îk>…®H£«»ßãÓ_Ž?^š$Ƙ('I–åñåDÅÇïOŽqØÆoxöý%>u|}1=û0Ñy|}ÉÓó«kìøôœ|¢.Ó\Lßñè»Ïgç“?®~=:¿ª7^Mƒ°¿ýþ‡Œîà=’Âyô m)TQDË#ëŒpÖøþâèòèo5/ž³¯ê’R H´™Ö‡ÛeEæ·3{Û™ƒíd”(Qºk'å@æ)ì“e¶IöI°ÎA H¢o‘p’ÆÓæZ‰ÔZ^á ˆÌ¥E˜~s±tÑYÀ¢¶DÉTÀ{Z«Ñ®6‡4rQÀ°#­0yÙT‹\2‡¿K'Kø§öõ¤¥ÖY£…Ìl× H;¬I‹…nå>g„ñvþð´žÙäd”„æÍ[åË´Ô ¢ÿÓÜL b퀻ƒçiàµöÙçDN³®6ö x¨ø ÜåfÿfØÛ²¹ß¬a BxÆÑÍ xÕìŸåòëb¶ÚjÜkPÈ5zcÀcTš¶@›v½!¨»U¯óª:´X0êTfÝbòD&·àXlKû áàÈLg:^•ëŽÈ¸¼Ág\=mñ©âçÇ™Ÿ¹EºjKÊí|õÀóÛÇÀb>AÖ4xƒÍö¶8¼˜o¶~c\U"Á?ðߌQ;Õ6°@ʨø¦çëáØ"Œï]•µ§_þŠ¥‘u¹½9#ñ»8Í.±¼Q¹g¾ò+æ›æJ¬ÛÃ[®è!À’}ç‰êž_eû8ë(*lžšØºŠ1ÓPˆ%Ô_}C¹Ì¢õaH´˜$©)âã ÷7¾Â°âné‡;NñY*œÎ!k‚¥˜W~Úñ¼’³®Â(äg©êù$OðÎBÏU³j9ãA”%5|Ué¶\pY’Îñ#©_½WÉóãómc=ØÒ— Ë’ÊQž¦$e$ª°"ƒSVSkgղĢ‘5·¶„~³FEÜVü$Òï+ªÚx»ZW+´íÕŸú%Õ~¶n7ÙaKjÜzžS1 Ôm­‰/¶¼ÃKdæ—׎C¼&T#ºoO³õw*2=xˆ~‡k¼@4ÓË.ƒå×â"â÷N©`whO -B jU%Œ}•9VÉŽWÇiªª°©‰®!Ä Xl×5D›Åñéâò˳k.:n˜Žëýçv^nC}ô©E‚Cú){ñÉŇKžY•K¿ _n>ý†­wŸPûØÿü‘KO(§]¢NH åkOî(N¿`œ§yuÒÁ4¦ Õ3Å_z8X?Ïa'±øSA™–º¯¨ök”¡êv¹ V -T^,ýì:±°ÏºL_4•Þ´ÙÖ`YíHÐ^–õJ^à‹ÿYÓ—`œ¬íðSa–Áo!P¿ÊDöŸä°¡ã”ç•4˜u}*”"/l½#WØâHòøW6Hdí™(“wsÛö^Gp L÷ñõ…ï -ÿå]¥ÎÒ=?œÖB« Eai÷;“ÃñÝt@þ7éÍë2endstream +xÚ¥ÙnãFòÝ_¡G +°h6»yí>mÎZk¶ç‹$I½ûså-ŸçaêýòøoÞüa¾PÞ#-áÏóÓÝýçùïËŸ®>.$Æ7±Fš_®~ý=˜­­Ÿ®_géìƯ²l¶¿2‘ö#£e^^=]ý§ÇÂ{fƧ&n¶p •ùYMß~·²þþ!,+X‰†÷˜Ä‡Ëj¸yÞmS·0mOÇ—*ïàêqÂWoê¹VÞ+¢¨¶·}š7ØÑÊOÞMhã©ÌÕ*Ÿ/LxÝf2nx¨¼2·-~q=ɼzÃß'Ø·ûy˜x/8âE¸­¯ÿD-°¹³ +&ê.¬¢áA9…T‘’mxâ0_€Ækä¡#&Ö™ƒÂE“J”É +7m‡·¨«s‘-!àyþAz¤%TeF×/‹¶C g»Eȸ=âaÒ†Ñ`"nŽ¸¶F^›"'”h¼:ò–xÂ%~W]AüÀéµdKÌâ +ĘÈ*Cí˜SÆÑռȸ„‹nHeãÚÙjr†áÑ—´*ä‹ß¥ó&¯@7!¡BB¬¶r1 ?—@°å<Õ0¦Mì±@sœ€ñJ5*ôµ•%‘+‰mÛñ¤=ØŠ1,onî›·AË)üÜ¿ÆiFz@äs2‰?æ$3ÂF\lCœ Æ„ýÎcâîØåÍCkb†Ïäѽ–Ì"ᢵÅltmÇ«]cAÂñJLܨ (³½Ðþ'GÍ<Ë„Ô078w®Öñr]å¼þ|wÿ$ÇsgC_-ÏÀ cˆ$Kç½îO(!Ø0xÃX슬à€ÞØ Ð-£ÈûèKd¼MÝðà>ï(8ÝýB;Ú«ìží¸Hƒ¸(XCˆ‚‚ÎË’Û²ì öOØFH9„‹®^ …бõZ¬P n{5—û•¤Rv9'ÿ/;î”ã¯ê=žÃXS²ùçh:iv2,@AàÒºèƒáªã/G·‚[Ž‘á)Ják—ε€ +S< +W#¼û®ëŠÑãäkaOÜdOŠ&_ ðÿ÷Ãv…4þè­CŒc)( Õ À„±ò”Nx€ò£¯XT; ã`dQ¹G²‰Gº¯r¸Ÿ Uoÿÿ¸Å ­ÔźuÄsTùªW<\½áJq®óE”r“¡•Ž¯¶ Ù°……%ÀÂz%#¡Ð`°õÚª-Ù´”wØ÷º+HÈ;KHkøíµ†gÎ49ª2i ©qÈ´ë•ø»`ØÐò^¨;éÁÆ—cÞ|/½`º”÷(j¢1Ÿ°79_ÑQ<ˆ€¸-˜¨ÂÈIƒQB(Ñ•OÇ{g¾0@iÜ'8Äf_ÄÍpm ¿ §ÐºtŒ6åÎxªâ:EnBþõË‘¬ªQ‰;ñT*+ɧý5ºexZ6cý!¬å½gXºÃ=ònŽ¼{œ<‰ƒ}.SŸý¶* ʘÒ1Êê4=K©Q‡EW¡P<¦L 95ÃôI’f«ºÁ@Q~ÇÔ}-¹†Ô›#)*rR3§÷ï|î¹pu0ÈËYt=¡€g2Úu_†éjý%é²Pìž„¸"YNäÙbÄôz‘J™L7z3ŠO®ƒc*2Ð¥VŠ.â`#{ü‘p'£…kÛ‚§•ÐÊa@Ì C°9%Ò‰Bï÷ÈTt™œ¯Å’Þì3QDˆÉ‡CŽ,¶dL«º‚ÚÃ`\86§ˆ'°ˆÚ8T#5ÀÙìÛÍÏ9mµvp¤Û3¸ûåMßnþ÷0O7¥ä¾2Eçì¿\‚b¤à|k}Ñ‹TžÎ]¡+zCÔQæ‰kR•¬÷ðÌÌaCjªŽ$Í°ƒÉ?Q‘'r0—M ’‰ƒ þ]œ„aÏÿ\Ú‡›OzØE™ ñ“0–^ªÝ¿ø  žµ[ 9j®t–ãOõvZî4y£»£èrÞlŽÚ»S³©°Ý„bšÒb¾³_©ešëÀóv¾p;§H ›m)oü¥¶T…ê­¶4ôƒP¿ß—Þr¨ƒ*~Ñæ/’&ù2P‚Åö*äˆIÅ^ïeÑ—ï\ð4ut—â Ej–,YT—+ù’ìôPºL¥½=ùËW—Ÿ”›’Îu‰QxwÂöΊcuöT¥M%¯Ÿ{fAõ›‚0–Ø(ã.RÑ[lq ÈBb·¹œãÖ, ªŒ¥5¥#®&@Aq1 Ö ™p†a¥pþ€F„j5£z²$5jõaZÚmË#©Íw’Mh­˜CË¥zι×öUšÅŽÃÃ$úgÌÓä˼²ûâs²qØÇDJö;´.WŒs/V ;Šûx–ć7DÿÝr÷½î5}«Â©×L¶Ó·uÕÛ\e¡G­.,½ÑÃäȯ#t¦½tâ¡N¤ø7QÏhí›äwv‘Óßû„N (ö2×:UÜ,¦¸æeüN>endstream endobj -4597 0 obj << +4753 0 obj << /Type /Page -/Contents 4598 0 R -/Resources 4596 0 R +/Contents 4754 0 R +/Resources 4752 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4594 0 R +/Parent 4761 0 R +/Annots [ 4758 0 R ] >> endobj -4586 0 obj << +4751 0 obj << /Type /XObject /Subtype /Image /Width 582 @@ -15234,6114 +15879,7195 @@ hР «;ˆ8wÕk—]Å°«®øȳˆdW½¦-Ç®:¨.»bW´Ç XÃÇÈ#f€Ô‰9r¤ÀOJϸ~ýz >@vðÅóçÏMMM=zD—·oß>fÌîeÞg5zôhº7{°É¤º/,zòä ³I“&Ì‚ÏÆ™ÛéÍÌÌ^¼x—/$&&Nœ8‘¹\PPТE ö_ùùù$;î÷´˜››³ŸåáÎ~å|aÑÀÃÃËŠŠJJJrss¹›ø¾¾¾)))x ðÕMÜïÉìÑ£G^^s900*2òs•ÔÖ­[·ÊÎú[îéêê¾zõªÊ§ÎÎÎ:t(^¼`aaÁ}ëWXXØÖ­[ÿ~ÿ1ŸvíÚ•••Íœ9“QÕS!!!Õíïj¾°¨gÏžt̳gÏÒežúîÝ»Tôá%À zzzåååìUR³¹eËæëû¶¿‡.Œ3æäÉ“rŒVåݾ}{Ô¨Q:::ƒ ºvíû(z^ü€íÝ»wÌÒ¢]~~>](,,0`]hß¾=÷KS+íïê¿°¨¢¢âæÍ›TâuéÒ…½‘ Àþ9  2«ŽÄرcwíÚEõ{ -;;ÛËË‹{·*&ÿ ‹^¿~Íý-z^¬:à 777²÷–ŒŒ ccã½{÷²·¬[·ÎÌÌLæ}‰UíïJ_Xäì윛›[ZZúâÅ‹Í›7{zz²÷Ä;CðHBBûî}†'Ož¿¸K‘ùùùd¨;wîp&óy4î¸_XÓ¿ÿ† Œ?žÙecðõõMNNÆK€Š‹‹ÙOX ɃÈ›ýõ^|±nÝ:á¿ËÛÛß‚šÊÿ2ÔÍendstream endobj -4599 0 obj << -/D [4597 0 R /XYZ 85.039 786.531 null] +4758 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [226.407 357.859 282.218 369.549] +/Subtype /Link +/A << /S /GoTo /D (browsing1) >> >> endobj -4595 0 obj << -/D [4597 0 R /XYZ 85.039 763.817 null] +4755 0 obj << +/D [4753 0 R /XYZ 85.039 786.531 null] >> endobj -4600 0 obj << -/D [4597 0 R /XYZ 85.039 763.817 null] +594 0 obj << +/D [4753 0 R /XYZ 85.039 766.606 null] >> endobj -4601 0 obj << -/D [4597 0 R /XYZ 271.155 445.624 null] +4756 0 obj << +/D [4753 0 R /XYZ 85.039 746.277 null] >> endobj -4602 0 obj << -/D [4597 0 R /XYZ 85.039 313.054 null] +598 0 obj << +/D [4753 0 R /XYZ 85.039 476.416 null] >> endobj -4603 0 obj << -/D [4597 0 R /XYZ 282.773 319.028 null] +4757 0 obj << +/D [4753 0 R /XYZ 85.039 440.151 null] >> endobj -4596 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F38 2997 0 R >> -/XObject << /Im5 4586 0 R >> +4759 0 obj << +/D [4753 0 R /XYZ 85.039 345.2 null] +>> endobj +4760 0 obj << +/D [4753 0 R /XYZ 266.64 121.218 null] +>> endobj +4752 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F62 4159 0 R >> +/XObject << /Im5 4751 0 R >> /ProcSet [ /PDF /Text /ImageC ] >> endobj -4606 0 obj << -/Length 4813 -/Filter /FlateDecode ->> -stream -xÚå[wÛ¸Çßý)ô(÷T,qá­oÎ¥Ûm»Ùvãž}hû ÇJ¬[ÚJrÓôÓwÀ€ D åx¶'mÏž¬x‡?Àø“V³þS³¶*JÓÍš¶.*£fï.ÊÙØóÍ… -%¡È")óâúâW¿©ê™*‹®ìf×,ª®ž]ßþeþò·W¼~ýÃåÂ3‡’—‹¦iço/Õüê»W¸ÙÎå÷~÷õüÇoß¼úþR·óßúo^_ÿˆëßÿð{¿áÅnÕ—ùöÍ7~ë7þöÕëË¿]ÿîâõuO.MƒØ¿øËßÊÙ-\âï.ÊÂtíì,—…êºÙÃ…­LQYÖï/Þ^ü)ÚòûìÌ5æ¥Ê´EÕšS7©jÄMUUÔ¶qnúöp¹°ªšîV¿´¿\¨ùç 8êÝ¥næw°°ÛnÖðó/ܳÚc±zþi}¸ó¬ƒ‰tËg¿|»]£…¾ìÒo|³:¼]íþÅV»×ü}„BÚ—z·¼¿‡jª»r~gÂ3¯ÃÙ«û{ZÄí+¿üjû°\îï–ûÃj‡Õ.Y(ôXç.ñÅn‹§úä. J,tUÎ[øµ¿ÚÕæÖ¯á¥à/øp‹/¿_aÁœÚóû5Wf³|p«{_=uð‹ÑþäIå ü6óíã¡ðWñ½wöÂ]–ƒ —ˆË·áñLKgæ@qãêæèâ ÜÎñ¼[­{Öýˆc¢'Ënþ,.°~…@›-VÎæ;Ü_!TY‡×fËvþà"äc<‰ÛÕø€€_g.‘+q ÷´¶÷¦–þgŸ:‚î_ËÃz»ñÖv«¿?ÆÖ"îsÕälN8:7mßS$>Œøá'¼Ž6½¬kçWï±.©®±©‡ªÃÐÇU@v‡ÞA Áhõ¼{¿s‰Õ€ÝÌ­»˜°BNÇå›Ý0>Âæ{ !_û°Å•[@ÁíGoü~M¸¸ÿ×¹Þ§„îDק½OÓ5¡÷1G½9é}ÐYE×鱎G =n ýNQ5uZâø7vUZuEmš6ô¢ªÚØUÕ:骨Âzº¾ì /¹¹-Å´®c×xíG]U¶îà|x؉st«‹¦1³à”2”9¡œçØÒiwãëgÿˆMu³:øÊsõÏåÃO÷},ècJ[š¢k«1ÊZ£mag G”š+Y¶²3SV?sLê›PÎŒ;¨3~)”Z‰Ã{]Ãn3 Ô³º† ë*çä·7èÍ#—)ƒm«f½±/#[,™²КÖ?$Ÿ.Cƒ†(퇦AUh«EhÉK‹U5v@û‡õþÄB¦®DÀ*¥ -=Ð"æ.ϹJ(âl)“oØrSÌj ¡Lé-Ž>7‚*}½a‰ðã0U£ T7à|s -—lÛXh²L¡›ñXS‹ÄÖUÛ NJõ2ýÞêßó–¶0Xµí„·tÕm#ã.²ÅûK׺P•p]ý2Ü‚œòAlÂ?¾`k‚¯¿ÕÃú|‘å3N(nd‹çƒþ¥¨ôÐ/ó|p÷c°Ï–à ¶&ø -ŽÜ÷*×6E§eª—lMàA¨Îø^ßiZ‰¦z|d‹ç³Z­6Û«¿–Uù øŸÊƒÖ\¼L=“­ к+ô°•LcâÙj+‚I¶xÌJÁØ5ÃærhÕ@_fd@ƒ­ ÐÓGáW4›µH (?CÚ"–)› -z“ŠÏ[LWŒg-:›µôf%²³]§”§Ñ†‰†Kú]™ç¦,hiMg,­î¢Ù|EÂO}¾ÂùI›¦¨UËúIWʾŸÈç' ã"ºÊöºµÐ„”Y°Ä’µxOcÓÌ’UÃÉZ2²Ä‘äªÔg/ód¶-L+B,±dPãu€qY UIT&YbÁ ÂµN+ót¼?A´º)LiɇhMéÓ >ÞÎ@l &ÏtvX¼¦.lcÒ ›Æ« R]æþl@²Ä!VÖU:m¯Î@„D¬‰C²Ä"BBWâð5"Â`Êg CÄ é¾® DC¿Ñ6|¢Ñ½z41Ù¤7,‘ƒp˜ªÅZ8ߘ±,Dã“ŒPê¹yÚZ$ÆÆ3‘ -ª=åz•ÍE$üÕç"œ¿L7aGõzê/S7…*k‘-Þ_êÑ4Ý€+æ$§|ŒÅ˜QIð[<Ÿ-uÑàÓš„ïE–ÏB]ØFÆdk‚ÏØ¢±í€ïežŸ·• _°5ÁW×E‹Ok¸ö;^‰ö }ë§!Ý;ƒ¬©ç¢ï•ËªèlÍÎüÃ}±{’çzå8&ýŒ> -!–~C«íç3OfCq^÷áhÊÓM|oËGWd»[–‡u2yîÊ,Vn’¬ 9YÈ»ÊÎÏ¢]aAœå5•?SÀÊO~v½I -<Ò|©»Ür¿õÅ>FltJd -ŒîüœKr³°x NÊ~ôGÄ1 Ù?Üa™? ‹…;Õ­?bÎgü -»Ã µ_ý´F¡+ïðW~ó’¶â¼v2_í§l‚aXyx^¬º€ç.14ãÇ^»0(lüIg¿ÇøŸOtí8¤[¶›ûÏaß*Îx?#ï¦>)Ì2 ÃÊp]UâcÊ6+×N¤Ñµó½Sb¸%‡Ò  -‹®q¢üu;=Ÿ¨½?žÄ¾°ó©;üÝ#^Ânuë÷¼ÇúÄ…‘[9ì‹Ê’j çsƒ{[‹ÄØØcpØÙªxFÿÃ]NªCÁõpEï¨þwá²ß»Æê/)ŠP`û}8`yï÷=àË Dõ› -ºmãê -Œ®h1ÁH$Ãj…šV>ä´ëtF1Û€YUâ“£öyy˜7µHl¤apk¬”‰'¤ÛUxØ\ -—ÖÏ=¦^!‘‹o˜GZ¿ù~½?„Ôÿ*j<Ú+G¼³±Í…6þ„:äÀ?ŠÔ$ œ!Ýî<ªÆž;wŒKÉïS|î¬ëfàÓ+^tÐM¹ˆÁ›k­ÛAÄ|p]©©ËØÅa [ª ÒÂ]•– í{·NÄGxˆë‡`*Ñ€Íî´†®¥aþèÝXu™#aUCˆTÚ̯Þ*öŒäSV¥²3Û6E£ºçåSÁÖ"16’OY¨H‘¨Ï§ÞÝ2¸$Ê·¾z Œ¿»ïÇ$ŠÝ±{vý’‚Ý6ð[?ï"ÉÖ"16Òzap°tQ!?톥ӆyÔ¬ß-'ƒ“òéOÂÌQïFú«}g+³\þ@V‹Œ4ËÖx£Ü|Ò, ]k;^šE…òÒ,óÅÒ¬ /Í:¦•f¥”_(Í29iÖåÿ 4Ëb^¡«Í²º…Ü£>C›•XxÆò‘:+…{²:K„7>caymwpðŽé³š’“º–A«áÞYáÔö×7ÓiÁ5-øƒ{Îh!ÙíLû4…VbX"9LRh¥œY…’Ph%¶ò -­”*«ÐñVß8o‘B‹÷©ª$ÜZ¬¿H¡•rM+´DøH¡Åó…VÊ7­Ð’à‹ --–Zƒx›Th‰ð‘B‹çó -­oZ¡%‚G --/(´R¾i…–_Th±|¤Ð4óZ" ¤ÐâABkÐJÎWhI`F…‹I -­As9_¡%J --4(´ çô$®K[¡%[ÉÖd×íd|ž€6×BñI¶xÐÆú9‘ñøÌæÕ Ï ¯þºæï  uºæóê¶@Þñ$ abX ¯f1IC˜ræU„TJDG˜Ë+ S®¬–PÄ_1³fýeLY”ªð—üÛ”ˆ¿Èï/c§ÖM¹òšBèè¡U2|ÁÖ_Ó¹GÛƒúÌg4%ä‘ŒÿÈÏgñÑ{¥|y}¡µ0µ­ _°5ÁQPÖ¼W¬>ÎT2ÕK¶&ðš0v¦áwžR®)(ÙâAQ-×5CG¾8O/'ÓýyKuëÐ4§!kˆa—œ `’-´Æ|@[ÍêÃnU¥e@ƒ­ Pœ%8ŠOVƒH9ŒÈÐò5ç0-¶‡–Íað溴æiÄÄ°DÃa’1åÌk©”ˆ11–× ¦\Y ¢ˆ¿ú†ó½Áû‹ÞcðW|'‚õ½‘rå5ˆô6ƒ½Áó…w#R¾¼‘Þià‹ïG°|ô†DÊ—× Ò› "|ô–Ïçß“4‡É7%Dðè] /¼-1¿óß—oL° ôÎÄ Ï}kBÓ¿7ÁC†7'Áxþ»˜ñí ”ÞŸ„åùoPˆ€Ò;.)îU—eñ¸g(;‡íûÃõX÷Ñ,»¢ê¼îÃÃíðÕ3Î<Šê‹(ÿ…‚PZ‡‹¸yŒÕ¡6[ÒÍéÓãBÜôù²µN•ßfŒ¦Új\Új -ûº;ÕWcAkãrFÉ{´ÿq"à‘z}ÅLÃ`bŸ-p¦‰­±§ÐpŸ§Mú`áa½wN¦^ · [»·BßD 5öÔºN# pWxA<·~Ý ‹qC°ï?3¹¼ Åýú2È¥MéǬç÷þÿú‚«¹Z¹™Ç´ñ=øÏPÞ¹ÀX…¡%Ž »8`¸Êíå¾A¼ #ËþŽ¾Gz/¨üµTÐi6í¼N%Áñ“Q>³²` Ð( fAI<ŸÙ¼Z"áù^·úº‚3™šWÔ(hþÖ˜§©‚Ãi5‡Iªà”3¯ -¦R"ªàÄX^œreUÁ"þêkÎ_¤¨áýE* EE ë/RÔ¤\Ó_á#E Ï5ƒúœüÞ¨_TÔ°|¤¨Iù¦¿:*ÂGŠžÏ+jR¼iE)jx¼ ¨„ßùŠ Ш¨aAIQ3ˆÃs5"˜^QÃCEÍ ÏWÔH`FE JŠšAXž¯¨%E 5)訢Æä5¬QQò’¢†oK&§¨%E ê5|S29EgTÔ°œ¤¨á›“É)jD@IQÃEÍxsÊfÙÙÏWüQ eºÂjŧÙÖ6~MåLázbX"Íæ0I¸žræ…ëTJD¸žË ×S®¬p]Ä_}šÍù+¦Ù¬¿bš-à¯>ÍæüÓì„kZ¸.ÂÓl–Òì„oZ¸.ÁקÙ_L³¾iáº_L³Y¾f§Ía:Í–À‹i6‹Giv~OH³@û4›iv‡g§Ù˜!Íf!)ÍNƒñ i¶fŸfs 1ÍNÃò i¶hL³YPJ³Ч ×%Xû4›ci6Û–²ÂuИf³ !Íf›RV¸.ÁÙ§ÙgL³Ùæ”®‹€Æ4›¥4{´9eÓl‰ìGZ$¢Ý ñó ו6Eî‘h(£ð…Ûò¿A·þ6ècû¿ÕîþµS¼:KþR7uøãÕAìÅçA é>f %Ü7uW~™þð¸iªÁ÷ž½¥Ó?<ŽÛ£–û¿Yíô§^Þ|Ž©@t”pˆ;~ëŧ^ý‹JÍ1:þ=pÿ ñäûÖ»þSè7‰¾3jüÜïÎýµóûÛôÏ|ï/ÓOŸÕ*®CE‘Xp}xtòÕõv“ûÞ«©èNù4¸'î/ŸÜv¹¿€ŠC¯V]¦Êêd¤5pÕšäùïendstream +4764 0 obj << +/Length 3860 +/Filter /FlateDecode +>> +stream +xÚÝÙnÜFò]_1ÈËr.›Ý$›ÁbËv¼Î!{-~Hò@(‰ð GæÌDQ¾~ëêæ©#,g4}wuÝ]]T³þÔÌ&a¤óYfÓ0Ñj¶\D³sèyu dD43a”&Øuxrðo“t¦¢0òÙÉ 99ý9xþïgoO^¾›/´ÖtÏYfƒ£—sœ¼ŸÇ6xóî{î<œ/TðŽšðßûã×G¯æ¿ž|wðò¤³å„&ո秃Ÿf§ÖwQ¨s;»‚rª<Ÿ­L¢ÃÄh©¯ŽþãWá>3ãY'[¸ …ÖD•Lq],çq\Tp¦ºÜâ1à˜&ÖÁ³-ÕöбÆB9_ÄYœA}Ópyw1—v³Y—8¬žÇy°sý–Ò<(V+nrûÁĪæÙ*Ør_ÑÈËMýK¤Ì9îÝ”§²nÌÅðc@ùž( à‹µÔ®pÓMóúÏ›ÍþiƒQˆªœ0ñK”Dþp6 ¶ÕúrU-«ôúosÓ¦Á¶øˆM%LP„+üØ=UÉóÔTš†:ó›ÞÉ:Œ³i&ÀžJ·’ö9ñAäXxj~ðxßqâÕ–ûˆª=cÆÒùbCÌP8¬CÓP,hõ]Ùðh‡†h¹Ú–\§>Äs–á×Dƒ…Jó05q€s*˜X!Û`i¹Y­ŠíµJ—Üñ¡¿ ö­*¦À³åAgHS,8ÁaWHD`‰sZXBŽ¢Iʵ u;ã(QDL?Aõ]}Á‡¨äTK<â¦&¸QXGÖSìO‰&öû×GÇMDV°ÿ<ر€Í Gz¬¾bT=þønÕEÊƘ”MÙøHô §„==°D'ì©”Ü<Ån$²ØIN…å÷±fKaY€h³„”$öþÀB¼,V<íÇŽEÃúáHq–óp„è',¢Í®ZîWTš1¨öt!¯6!@ð`SQ]öIÄCR~d> \ §)§¿ÍÁ0Bð°+ÎKûŠ0_Óÿs™)+2–á]wÞ_,ßæ+·nM^T¶´DUŸK܇jé=ö܈ƒ† °Vœ.&x}é îÌ–Êk.‘ê(–ý Ét°s?rëÍQìÙA±I'2„øL|$â5X¥G@¨ȬXã®ÁŒT× SÓÍ$P‰cuƒ5m=Œqˆ‚FnK^*4‹¢Ž¶æ4å’[ +þiØ f¥N–º¼g mgÅRlµ:«ìÅ0Òîá¶Jà𒌠‰±iÀãD&®ªíÎCÕAKXø-sMµJ`§ØºæÍÙDwßáG.\ ìCd*øvn5ßårÁŽ[UÐ^zaŠD±+ò‰ÌKHß„àueMO;º,kܱaeBH÷|¨Å°£¿€ÓŠ¥—~ì•iÞA¿Ñbgßc„&—¾fÕç}ü‘çÉÍC4ÕàÜÎub»”dAÇ”ÇíÝ O“¶ôÅiÎ@xÁ…ÉC#M7Ý0±”dî‡u§àÄÀ0n¾ÛêÔûáäÏC÷/J›bOâ³!µ´+v"ï_ñDñÆ䕸‡cŸLÅÚ[ªa&Y–U{G“Ä—Wņ3‡ +…¢(œr‹¢]äWHÏC÷î–%À¼Þ3a7•0ïŒÑžkîm£/zDEKêw +Ic=œZÐìägÕu ><3·®‘ü©¤‘oiÈ_iÎÌ^BÛ–®XÛ\bËý,#©íû1©õþb÷Í“GCE?R€=¸wa&#áC4Á° 0!®Þ싧_I_Í– ]‡º·{`Ô?Jóª” k‘ )¥V“Ãiû!,Ù›cGoýÚÑÓ^ Ži%X€…X}o.ÀU ½,ÂdA!·íýŽëWe̓|tˆ]“9g‹Cƒ‹Vdt±xQà¦oØBׄ—…s<ÇÃrÈs•Ø²ÝêšYý”5âR%Á ÖzfƒI›,ß„– ÷G;Ó´Z¹¸Ò”à© €.HËT¨}Ðõñ´¿šÐÅÏÈMG߯ùì[ô'PñU.J«UÞqÏóIÕÍ}Õ¿åÆâòÒ ]rhƒB6Ú:ôn\ØÃõð&šåa†Q¨X¥af)À}ÍùŒ ï^Ýro9Ak/¬ÎÐÁ˜ÑuÊäa,W aÔ\‡æî[,†.î⨧\PRåýR)èº&“³ç¡lèzȺȒ‡:5]•°-;Ö·s‘•ÄQ˜TYÔ^“N±i.$€nå¿ðXuÖ[•+«vìGÏg¬jX×Eêÿ\ÂÍ×;-{ +FÝi#€Êzµ—WŽÇïÄS±rÆSÔÄÀ8³E&YÚ1ü%b§ñ$KåpÛý°r4°ÚóÔ€=à6 —IžõÍÜT‡ +.ð=¦»%Î3áw>:×hÁ¨ß‹õåJÔÆø¥!N@¹ v=Åxlí üe€#¾ml`J…àWÜ#¡â0·Éd½›V¡9¬Â%Q“ýEÒ0Qéào’ˆÇû5_ú{zÀ„iœàsœ,ð@tv/@° ;WshîZÂ.lÖ†©}Ø2 Àrà~À‹ÛŽ4b? d‡Ä¦³…³|0ûÜòÚòçÈvÇóèñ ©&X)K…\æA0é$Œ`ó{5ñ²hÂ8‚0ôóÑñAÏÚü1Žo’ÜpzõÇ&·ï1qZþ)(px3¬8>,ÿùm X=^ÜFˆ'‘„—ã·”ÐDñcHB__æ-}™ü9}ߦ/“ëKkîÔÄÃÝSiŒÃ)…©ôcœ?ŽÃ8Òñó{y.©ï­1ãI™>…Æî ¾¼Òöñý»ÿm}¥?£¾‚•¬º—¼ê/&¯/&ôUW­§ÕWúËë+ýåõ•þòúJÿÿë«ÞGYÆó˜ÂœƒãLã°~–Ù;8¯“x­6GX;ñZLªÃàÜŠË>v«ûIZœ|WvŸ/‹¦Ø•BYÉðsÁ¶Ÿ)ò(ë¹ ·¬°l6ÛÎ#ç…\KHð¬—68¦´zBx ÅÞ–0ƒýÕŽåépóQö>“'Ë…Ê1‚™÷ß$8'éÅf]T5—‡[CÓè}ËPÚ.€K æw`l‘,n£m°½®éý; úºú£ä.zdÝryâIÂ7JKƒ×;n:õAë6 Ÿ‚ä”c&ÅŽOW-›ë©”—ü`â6EËœKkTÞÍAé<ºQ>Œ™m‘ÖI²'c¶=g€(ÕÔtžzð(¯ßr½¢ž6%¦ûc»äBÛU¥µâ@ŸE@ÔUòŠ…#èCÊÇņÎ#77¼G*¿Öwß/„ç *Oºï¯øŠŸÞrŒ´}{*øÉr9Ú?'‚ð64d±_N¬û(ˈݱp– 9!El0žˆM"Ï…47åyå$‚ðmžÇ’6á'zQÂŒ†N*Ö½u‰ÆŽÔ„©Jî +£?Z´GØàé3®”$ò/ãý$~—v®o²ζ´*»ÛL›IN7NõÃwE|yCÊ$¸ï0Æ’¨üæ¸*5ÙSè}„äcû²%_SÈKyÒBüÆ„2ŸèQ½ôß]ó`c—yèk‹¾þšS’(­÷(W+Ù®ÚõŸêÿæÃïÓ57ôqGû\¿€»P®ôä£=Ûä[ÓÉŠÅ—ñŽ¹†jÌ?.mÄø·sJdðZ_ûYB“¼+ÂYtK« øM)>ŒÂ›}½œ'€‚õœýdž±œ«ÈÂÎé’KöxÚWN‚”¿ž`8èç§o¹]^Л¹ŒÌpK¹@i¿dÏx5ùð=úÄ‚l–"×\sȾWC¹cÕ.GM·˜T¥Å˜›VË@ùtã1‡i·S˜ ŸFîÌGH—$“eó²ö_zÅSŠ1á¯Ñ$™sµBŸËfN;â)ø3ôKàÖ…iyGvù)¶q¨’¸k&øÉRŽþv8…*GˉV4Ø™8cÛ:¤†,ÖÏ¿2&ï®Ò—PZ—4J˜!ÃÚ¾Š¡=Ýaa5X3Ðò&nìwHb‰Ë£¬#ŸÜ9&k’ƒÍ2–‡L.uÓò@Iz?÷§’YÅœZžî%クÐ[t]£äûLˆ.[s §ba¢Ý§½Oª](/2U.áÊ¥©Õmvžû|, ußðî̲N2t6)›àí¤Á3TV­6ÍœGŽß9QuR,‹öS\\>\tŸd­/Wþ’#mn\Ï¡õéAYæ“’`D/û‚w¦ÓjÎj”S£A¼âN@QfÒ¥Ô°þG—Íöp ÓÆæÕCex¿n#ywg>|ã®"`|MïS­c/Áíç]’­/þzJgG…܇³îWcëÁu¸¦l*rc†éœ<²«"Æé'Â4¡/3&oü÷ý ðÖ}uÛ·:JEãM)I¦—ò_¢ÇîÚendstream endobj -4605 0 obj << +4763 0 obj << /Type /Page -/Contents 4606 0 R -/Resources 4604 0 R +/Contents 4764 0 R +/Resources 4762 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4594 0 R +/Parent 4761 0 R +/Annots [ 4766 0 R 4769 0 R 4770 0 R ] >> endobj -4607 0 obj << -/D [4605 0 R /XYZ 85.039 786.531 null] ->> endobj -4608 0 obj << -/D [4605 0 R /XYZ 85.039 698.134 null] +4766 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [320.705 426.743 371.927 439.645] +/Subtype /Link +/A << /S /GoTo /D (browsubnet) >> >> endobj -4609 0 obj << -/D [4605 0 R /XYZ 282.773 704.107 null] +4769 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [511.223 111.401 539.579 123.09] +/Subtype /Link +/A << /S /GoTo /D (brsbex) >> >> endobj -4610 0 obj << -/D [4605 0 R /XYZ 85.039 459.425 null] +4770 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 99.973 105.43 108.995] +/Subtype /Link +/A << /S /GoTo /D (brsbex) >> >> endobj -4611 0 obj << -/D [4605 0 R /XYZ 282.773 465.398 null] +4765 0 obj << +/D [4763 0 R /XYZ 85.039 786.531 null] >> endobj -4612 0 obj << -/D [4605 0 R /XYZ 85.039 215.867 null] +4767 0 obj << +/D [4763 0 R /XYZ 85.039 402.235 null] >> endobj -4613 0 obj << -/D [4605 0 R /XYZ 282.773 221.841 null] +4768 0 obj << +/D [4763 0 R /XYZ 280.606 408.208 null] >> endobj -4604 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R >> +4762 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F38 3057 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4616 0 obj << -/Length 2746 +4774 0 obj << +/Length 2627 /Filter /FlateDecode >> stream -xÚ¥YKsÛF¾ëW°rY°j‰˜Ák/[–í8Ê–¥Ä’˵•ÍaH‚$V¡`Tú÷Û¯€Ї-—  §gz¦çë'ÃYÿÂYûÊgi–ø± -g«ú&˜maäÓM( aYŒxnŸn~ü)NfaàçA>{Ú¸uòÀódö´þÝ{ÿó»_Ÿ>~™/”RpÎišyóÐ{÷ùö’µ÷#~~Ägä}»»ÿð02ïÛ#Ü|ú†ß_þÅ„Û/ôÉ:Z¨nûÏ›ßÿfk8â/7¯òlö -ïæù¬¾Ñ±òc­ä»ºy¼ùÍ­ÅczƳ.i)V™gê\Ma|AMqì':%5Ýmø EÙßÛæjê‹ù"ô„ô%ägc¿#ÖàMYuüÕÃ×®FšªjPW¯å~Ëó^˪’•æ Y­PŠkÿ1¥Á(öᲯbñœŸ9Ï|•*» -9ôO%…AâgqvM”e¹*+ #_…ÑXؽ©I ¡(lø¹jj¤¾ÀÁ}ÑÚÑ=? ³šG©·Ã¯§†^¹Ö ‘,xý®`þroV+ÃÌK`®dp_ôt¸bÓ>óÔMk¶u±Ç¾ãUájpOZÂ#µòjS2'>i¡·F‚j!B3§³n,:LÇϪ±÷n!*áo:} ‹Ñ ‚îïÌÀ4âéJŠOâ 2>íNÊínå´c&(íÚ>Cl-{)»¾ó'0–dÚÏáâ®lÄ3‰2˃ڈ&avMšÃÙUqhcyïèŠú /V¥‰×7øŒs{§´UÏ4;ÖïìHWð,ºjCæi¡U.«Â.u -_¤¾ÚK%ÂÆÐ^m{Ë Õr±0¾Œƒæ—v"Ênd‹|±Å¼µEÝ 0þ“rÏ›çÖâäXø~l@º¼ –2Ashq:£èKóÍò -¤´ö£$¾©gRƒVÓº"m€Ô5qR#y´‚Ãï |ÉÉóàÓêßO\ ’Jy:çÞËôÿ¡²³äš´Ž–ƒ üÈo]ÑòÍr -=À‘Nb¯”՜â¥÷øñÆÎ{áâÆ:CÚxÃOçè~çØêX*o€®ùg|–½*‰b¦âïÎx hCØkÄ/p¼ñø¡#³B§¨µ×pkÀ¹(ibƒG0½øWš€ mcÐùÓ†M×óÀ=qõ·wL s%«,˜Ð²(]@Ù ƒ?>)ßñ“ Ø^Ž8ñÖ¦ÌQ¥.+#¾gÃp6fz‰êëù;çám8ò%2·‘1~|¸ɳ×ßN™X &’×Sƒa>‚Qí+Œò¡8ÉýH³:À 2ÈÞû¦®ç”U’zÛ¶™«Àk»©íÈ2W·3ðL¦g¾Á5mç³ÙcpC\±÷ç¡èð&;þ¤ë¡Ò׳uƒHÂ]ë@|-ì-‘La_21º­ipc¶eˉÜèVAKIœ3~ ºØû/ùײäÓ~6²z´ 97ÀrqjÜ,Ú´å–ƒZQ0 èXóâð,÷«¦mÇ1Ù î´5Ê9´‘[’vF¬ ™p¶3#ŠuÖŒYÅDc™ø&b:æ™…½˜–,pupæÃñ„N[gèµó«hñ8p‡~Žrštú*ƒÜ!fÀpM÷3ú•ñ½2tòö*I<ÐZL­Ã¼ž9vÃË£©—†_ï!²›ø" °öp‰•YÙ .;èw¥-(( K+Ž˜ˆ é±b@Mjåg*!uæR²äN©M§Pÿ\÷ #žI#Ô På‘HYù¹ýÌÛ×6Kà”H/ŒkŠƒ‹/è£ÐØ‚„h(ÑiKB9ç%6ù‚ñQ‚Á|;ƒYWÎôt–{_÷k‹õV6†«µµ‘ÕÉã–­ ÈJ»ž–s!E–"©”ïÎl.å\ä±uhÍ¢gl#-"é5¦W׸Í$Ák†' ¢–½SÜ¡½ô%{üꇀ«  –¢¥=rÀ#qäxP¼½Cî =ò*‚F]I]Uð€Ù¯ùee°°BwÎ Ùg,Éç·VV=Ìèž ë%*ƒ1"b%Õïä.qdÍ)äóþ቙jó,™’ù^ÚÞH1ÄËØ ?Úf{JÂZNF3„v”à”#õSiØÈšm±0//6k‚i­-,/A@²µ( ÏÜ9‘Š*¨XïõöL?ES­‚2Ä+BøIé«Þ4w¹A¹aŽ±2q0ZáZ;[´âúTa§ùÑ\`ë©2qí¡(†å  )€Š+êQºhÞ@®!sY-ÁG[+ àÞŠW~©Jç‚ÐÆWI&aR²#x¥ ‡lÂŒRÆ¡}l³“lqKœ5#µÜ³ ²—-QoÞæ\YÓh[€ó’¤+à 1…Ìž«ª +‡À›7½ÞêÔ0¾I—#!P9Ҟߊã -á©o?O¥¿’¸>Ò&oø¸ r(H ›•Ûù O5JR¯£êÑb×|÷"ýÍ¥*VnÍnHþ¤”T#À7Gí¸ÔƲª³éš+§qeïðbwQ?ÓÞOsøÏ”•KΑ—ë—ªèe^[H°h{®¾:7‹*¶&0Ž7ænX«-õ¼%YÞ"èüôœu(<³T!‡ r©nÈ#ƒ=0ÎÊŠ?¥;zRz¶oB/‡žŒRŽˆ/@E€Db{žs\»‹GÍ…pØõv­x>ìÿØbÕàÝdG2»9K9ÂðI°Lj¤#Ö5®À³m±QcOΤáqPKÚ±ëà+œJ2£,õƒïTP#žÉ$3J"?RÉQ’I’ùùMRAîIê÷‚.ÃãÚŠ*OHwLØ TÙÒ(pQÒʹý–Ê–z@˜¤6ü¬ø2DÚ'g—$VxÁüšC»*º¦tçßí Žx&3Ê(Êü@2ÊÏ3%½JÀMª=ëÑÜâÊåæ`Ý+©±ìRqkãi®›ú×<_S•kžC]Y|Ѓì®L2]ƒž!KâqJexΡ³Æ¤Ó¡Æ;¶~ël»9å7€Kaà4.ºßJ‹ô£,ƒ¤Ž½÷Î Éí=ÛFñ¨!®F --Üe/Í nùÖ]ÈRJ¬U;µ¡›p}’°Ÿg\b¦êšau guAS mšÄ5„–žIm„ïÅl‹)‹ ÓÀ¾SŽx&-6ÔÚONÊB%{ÇF¶-Ällaøuo¸œ$ÎÄ–d¶Í\…£ÇwÖS¡¹Ò{ÏLÎÖŸy°hɶ̉SëÈWqvýÔϤ †@‰U.¯R~¦àÈÚ2X‰Â½6¹Žóä -®•ð‰PªúòEŒH—R1õ{V¦|­¯ÿÖ9°ÐIt8îÓPÏÊ.ƒ'˜N5†¯Hs}áqÛÂ#qOä鴱ؤG ?+×/g V¢,nPõüãy[|`ßØrÃX(=ô¬˜ýqÍ@!Q–rý1ühìo˜úb -¨T24.ãã&£¬&çõuÏÂòña†?…ÃŒ’úË—¯b_ó¯Á§×ìÿ¯_ŠG­!?Ï&RA´ÝfØ$§;¶?)Ÿoù«Špendstream +xÚíÝsÛ6ÀßýW葺‰Pâ‹ïÍNœÞõÚÜ]ì™<´} lÚâD–RQ®Ïýëo P$EÉj,SªÃÉŒEâs¹Xì‚Ào>áÍB™ b1-ùàêî$ÜBÎ÷'Ü•Š…‘Ƭ³Ë“ïÞëhÀC–„Éàòƹ¼þ9xûÓÿ\žŽ¤”dGql‚çC\~ +üûã¿(ól8âÁG›„>]üóÃ÷Ã_/89¿¬t9RLEûüíäç_ÃÁ5ˆõÃIÈdbp2ž$ƒ»¥%ÓJºûéÉÅÉËV(O ¨VË“|‰OX"t[.S ˜QÌtUK4­r"Ñ¢œËaéxŠOžŒU‘À§þî=ו:b*vµþÞÔJ$—\V„°Öšðž-æ¨ß‡Â÷*UpÃq?†?³lI)8@ÿKï¾L3Ñì” *jôº¦H)À|¢x0Ò1Sšo+«¡€(É’ø™ã VÂ17ÙØŒ­B3tåJ×[‰˜„qEW¥‰·ŽâÅýÕÖÐR,Ž"´W×ÀË ‚#+EðCW8sú)-–Ù¢)›1,2ºSÙ~Ì‹5É0ãØ‹ŽìŒå +ž «%϶³|Ã."¹Òmªá1‹øJ7­3òâFl<Úéȃ%ßdK«Æ:êÚ\1‘pšñÛµ+™ˆÛuër¶wý¶ÙsÌüÕ(@<¥€Ó70}…hA$,²ƒ18³"È6 ÌZÓ…lÁ+ñE%x·mx¬:áÜ‹ Z” `ùõò"œþêðoð‡[YT‹,J°Ät!ËY]Ý. ®X;°ÏŠ, D(a±*WÖ‰¬‰7–:ýÔ"e_Îä])æºI†’°~–[}UXG ÀgÇ€ÅAp%-"HÉL7c°M%ã´ðv›Ú˜Ž"°aÍyIpZJva Õcâ¸E«2žtþ ˂Ë3y,áQø{C[-*ƒ†:Y1œ£,fÚ£±Œ˜‚v0ïu;Eÿ¹`,·í¬èndú Šßm +ůâñw{ÆI+ÛÞÀTW/Âíà6šêêEx“¦“¥Àšr<jvX÷VæùÞŠ³Dëö#‹‘ ™1OØû)n/‡#%u°œ€'Ê ºù2„“`žÏ*Ð]Ñ^ú•šÎ©Øç½Ø-%Â5ü*jÏz¶|A)¸yŒòC¬³€ÜÏT£t9¶2Á2chØP¡Éœ®mW×Tcîú(ü^¾ˆ»lס Û‡|:uå­ø%§>u9Él\k½°"-~Gqìãiv,¥ðòÙgt6{ï*–V…%õÚpö”#é‡,‹.Q>e>›>º¼¬<ÈVfÛI‘97t^Û¢/Û}U(0¯ níéíK%A‘ÞyðÎVú OT²Ù•KœßÐoFB‘ý”¶œ¤øÜŠÓWW^1‹EvM978vxѲ ¤8,„1†,Rqï†VjTÏMö¡&;Š~uïåJÉ—^]?º¢é”2ì “½¯P-ÜÚ¢¾äIÍq,Áu­Ìn%þÈÀ-µÖ}æˆG†Á ïk*wYrFÂ}*íÎ +æ礶OûˆÏq…ZÅb‹9*9ÿÃê¡ §ÛôÚÖžæÅÒ•xÈÁ¶m"î$£Ôwó»4w]‚½]{½cñ¦Þm"j±åÝK›ý¼ÿíôòÅÉ:÷& m.*O†à­«Ã+ïðÑ)ÅÏtŠ¦W€´Ð†€‰¸È3׌uð[1-¼µ¯a¤³kª¼œÌ ×6U ›U#ozz©ËjÇ-–i3vŸÉ>áËÇt+!ê'-œ‚ÑäÈqÏgùVækqˆúº6 ÉàÚ߬pëšI£;›koÉͧø×$ÕïùUꮚüM=`åñ¢ôm…Kró /WQ)ýå¾XƒËRERWª˜Ôâ L½¦ÛŽf”›B”¸¸ÐÅÇmç÷—CÝ MpPF¶ìHÈDíÊ°õqƒ×ŒHã¸Áú®Î7¼<!7QrHB>ˆàIDO#:dñ.qü0ïì_‰@ènù*¢#ÙžD Žë-Ê®t“èˆèˆèˆ×€@lÜIíì èt'YÂØtnJí² Õ±)m–%Ž£.œÞFd&ŠýŸÑýÅ×k=1Ó3=1Ó3=1Ó3¯€˜1GƯÊ=!3«Æ:ê¡™W¢€Ý£±<|4–‡Æ²Æ}4î£ñ~£±§m÷IŠÃl¥ˆ#ÚJG´•"Žp+Eƒ:BsŒ‹·­¡Lš§dYóŒ„@2ÁÉJ-Ä Üà!¥gØîÅ°pGϳùl”â"o9™/ƒ[¦ËÜÓ X×~ŽB+ê¬ZR'y mäD?(nDãdULi„:SG~ƪ³[J´H#P`Ë2BRš#¤iÅϼaÆdÌh,Ì­Z˜ªÕ`F˜SòÜõ(éç!Ÿ"᪔<#”O+»"BÎ#DY¯+Ä"ˆãv߬:-$Õꪫ6Tå‚~PÁ¦:šÄ7ŽÜR™2ŸaßT~…9B±te*ªpv¬öÝ‚Z”Å©d Ì@’xÓ¢¤±5?oŽÔlã"ß[ì5N‡FY ”l/DIÿYøfJi?9 ©%­Áh˜H,!¯ënýXV­…TŒkˆ×†Ãâû婪37©9bŽÞº­B~j¿MíŒråÉKp±Â‘ø +Ý[×”##cÂpVXܺò"½ä!Ç_TÙs¶Shâ$Pir‘g‘e¤‚EfM#[¹·H;ë‹»¼°åÉjL«O_jÅC}àÓp:X®)Þ‘–IðSf4±‘¦B±[( –­ršØbê:#„/½v3Ó&¥Ël¥ãü†ÆqÅksh6'Âõ.%ÂÎ}æ@Yröp±ð=ßÙQ\MlÇ{ ¶°Hø½g‡ 9øBXR; CÚ$um­—ÏÊç<JäYµ}¢¶µw0PlìMÉ çA8¸tc†m5A8Ls¥ +¯Lj‡$Xw/ë€ÜHs¦á»²•òlLNí“‹ãBl[1¼%§Žñ;Aª‡äzH®‡äzH®‡äºØÙɉ’ë!¹’ë!¹’ë!¹’ë!¹’ë!¹’ëäX^îëXÞôÇò8–—û:–?Ô©¼<¢Sù~íö×Y»ï©üžÖnñW­ÝÚ‘JÝõÒåX‘Êo@/TŠÃ#•òðH¥è×nýÚíÛ^»?Q™táív$*u¯¬ß&Q©º!*5Ó¡þóD¥ûÆ—”_ UB #‹óx¶É ÝÙJâÝ.6µ-µ<ß|†Ÿf3Òc8«Ï=–DŽ0+æ K–Ÿk3kt&yÎoÕå§ÜŒ(Ñ*¼®~nÏ6WùÜžm«‹9QKž‹X"kN8ájemÿ;W̤ŒÛÇyWç¾õ¿î’1ãq-Rl¶Î×Ofa©5xŸÿŸ²Èendstream endobj -4615 0 obj << +4773 0 obj << /Type /Page -/Contents 4616 0 R -/Resources 4614 0 R +/Contents 4774 0 R +/Resources 4772 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4594 0 R ->> endobj -4617 0 obj << -/D [4615 0 R /XYZ 85.039 786.531 null] ->> endobj -4618 0 obj << -/D [4615 0 R /XYZ 85.039 750.537 null] ->> endobj -4619 0 obj << -/D [4615 0 R /XYZ 85.039 709.89 null] +/Parent 4761 0 R +/Annots [ 4777 0 R 4780 0 R ] >> endobj -4620 0 obj << -/D [4615 0 R /XYZ 85.039 669.242 null] +4777 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [406.304 535.411 457.69 547.1] +/Subtype /Link +/A << /S /GoTo /D (brsex2) >> >> endobj -578 0 obj << -/D [4615 0 R /XYZ 85.039 598.606 null] +4780 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [96.77 248.682 148.157 258.25] +/Subtype /Link +/A << /S /GoTo /D (brsex3) >> >> endobj -4621 0 obj << -/D [4615 0 R /XYZ 85.039 558.442 null] +4775 0 obj << +/D [4773 0 R /XYZ 85.039 786.531 null] >> endobj -582 0 obj << -/D [4615 0 R /XYZ 85.039 486.859 null] +4771 0 obj << +/D [4773 0 R /XYZ 85.039 766.606 null] >> endobj -4622 0 obj << -/D [4615 0 R /XYZ 85.039 440.49 null] +4776 0 obj << +/D [4773 0 R /XYZ 280.606 772.58 null] >> endobj -586 0 obj << -/D [4615 0 R /XYZ 85.039 287.006 null] +4778 0 obj << +/D [4773 0 R /XYZ 85.039 524.452 null] >> endobj -4623 0 obj << -/D [4615 0 R /XYZ 85.039 252.866 null] +4779 0 obj << +/D [4773 0 R /XYZ 280.606 530.425 null] >> endobj -590 0 obj << -/D [4615 0 R /XYZ 85.039 170.059 null] +4781 0 obj << +/D [4773 0 R /XYZ 85.039 237.723 null] >> endobj -4624 0 obj << -/D [4615 0 R /XYZ 85.039 135.313 null] +4782 0 obj << +/D [4773 0 R /XYZ 280.606 243.696 null] >> endobj -4614 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> +4772 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4627 0 obj << -/Length 583 +4785 0 obj << +/Length 2665 /Filter /FlateDecode >> stream -xÚ¥T[oÚ0~ϯð£ó׎m⺸¯Ñƒ3ˆšÁ[« )íØ¿—WN–°âƒÃ™ 9€Ì™C²u”–L+Yé‰3u¾5µÐ§f]B©Žð$gƨÛHjÍ:*hT¢…¤à‚).Id¡üÉEpºžàf´!­bg 똳ŽB·; -ŸIáÿÕñ‡k$ÍöoÀéÂõ§¨¤YaA“l…B–º~H‹ µb£°-³–ªõ&ÚK» Ï«"›ÝIVe c1OÚUvEœ£þ–Cvæú=ìbë³:Ü–Ö†öëßmSœ¾œ3«ìõŒ›Â¢ y²–+Ïwx“«=Î*è®ÀóÚW>];1€ó&ßè¿Á5ü“ç+MŽ·º\æ·ê­ã<Æ]7°jµvšá²£gü–¤g–·4.åÂÿèÛwŒ)ªdŠ$%9%%o ú·[¨P›£ù ô<³õ%ÜqD*¥h¿98xŽdBJÛ‹ -èÕMQW:…2_.ª¦×X“š)|N1…?žÅ½ ýÊ°Ðø—¹Ñ¾Ï|Ñ céüì´4LyaäDRDendstream +xÚµY[oãÆ~÷¯ú²P1$g†—¾ëínâ¤ë´k‹" J¢$Ö¼8$µ†ÿ}ÏmF¤Äõ.ÚLræÌ™™s¾sU¸à/\¤ÆT¶HÒØ7*\lê«`±‡™o¯B¡ÚbƒS×÷Wß¼3ñ" ü,È÷;"¹ßþì½ùîõ?îß~X®”RL/WI’z·o—¡wÿq¥Þ~àÉëå*ô>Ðþûxwsûíò×ûï¯ÞÞ¶\i_Ç +÷üýêç_ƒÅŽõýUà«,]<Á{à‡Y¶¨¯´Q¾ÑJ¾««»«:.<§¼jæf+K±RŸ¦Ú]143WZ¾<àÜ› ÞãØÁÿÌãë#¼ø®½áïeÏý¡Å©jËt]QçeÃï9?zä5ùöY¾‡|(xqûÛ%^¸Y>”mã£ÀPJQâp7<ÞÍŽ×åp(:ÙŠ6d1 }åö;â}vÈ»¬z¹ ð8·UÕ¢®žÊfÏÓOeUM¥qìþ2£E“øajæd*ØÃë‹2ýs¦©¯a0ÇÒøÚ|‘ãm^“8@äQWÛñsÓÖ8ú·=Egg~ùf J8àWÀÚ*·@Zà@$LÒ—M¾Ùð6L¼FýËdS Èì %Úv¼t×åûºhplè™+ÈWñ¢µEÎ~Ÿ!cck!‚5†®º³:Î{~V­Õ_.ÐT1ÓåKàE|A2Ï8Nppû wdÒåþ€#|ضC#`|ð1€Jl˜ôúEHG‰Û üX§ÿ=t¢?:¯IæCá‚šRIÌž!1¢ÆÉg3ð˜#À(xé.'7b±R®«Â²:Ç#Ž>Y5‘õÁÀ.§/4ÚÔ€¢Mµ¨ æ›Úi}iâÞ­qMÊ)ÆÒÝ\U‹Xý„7/D};tCx<çè,6 + +T>Œ?œaÏz†–_&ð(ûÐñÿÆúñÞW+zSàKF>ŸV@ø~fä8TÊ“£ ZþK*»Jä­u0a÷ñæöŽßú¢cÙ(€Ð±ñJáæ\ ±nðã™?œ_Aæ¹uStð–Ÿ9Gº¢g]‚¤ç]ùì9cñœx¨XÓÄ+¯x²·—^Ü +Qã`ï|Òžû#žP¶bïÑVÅýÇ5É*ßnòÞq3Þ-³¾¾ùñŽØ,gWœX1´.wpñÈ»?Ì™DÁŠãn؃‰CíÄú².«\¯M†C>H¸ÜYWÜ“ýïyÕ™G‹µÍþ†Ê¦äÀiyªóÌÅø±Éæs;‚¯bîFµ¯t<‰ÂP@Þ›¶®—Uœxo»®]ªÀëz»ùÌ*k‰^¶Ÿ÷9˜EF¨L"ï÷£s–¢4“Å,ð"VñƒuM:ácᔳx'?ÊnÒJ‡ÅËàkWìóÃ9¥7ÈgÝq¾3‚ Ü?5‚Ù‚ZLìý…Ñ•äøžå;¦@°Žù¬fÐä0nø±kÙþê‘ÇÞ{:'„èò;ò½ðF‹ 7äm;A¤‹E€Tì îAJCž;Ž³À6 ŒM“[YÆqæݵµœ„1ÔÀðòj¤«¡Ü9pÐ)f};¦üós>SãÃVœ†~†™Î9NCÌWÆÞw„Í'†ê›œ0CÙ±B/£ïÈðYà!&x8Èá^îòzóë-7 º¾2âp'ã,3܀¹]êB5`5D¡Æ? d!¿'«q(:­ü¬å—iÎçiï¿ÎˆIhæŤ´ê/2À™bpþŠ¬ö›wq4¢Ò8 #¤M½Tˆäüß2ñ„%l—Ɖ?v.ß;%¿*Š‹󺶢Œ¿ŒŒÄåF°b”"2tÞlÇVÌŽÂÖO8°¥š(2†ÚÆÚ”µ”£4—Q);•òM»ç;2T´¾‰¢ Æ)FÁÈ\†¼f„j?0É× +5¬…îk ~G$¢ƒpÎaïó€TNC…e–y@d\P=ðÁYÜ¡pkLÛí05u 0À®‰9‚K=Ä^FQ7DÈÓn+™¦Dž 0’eú: +'²!º=œâÍc’÷¥Ÿä”ej:¥ø„øNSï£+šhe¡鯶Wã‡&bBºÆ2’ÅÖðgkûøŽ¡B'¢ËîS¹)°Ö0}ùòÜjÊú‰²‘;PÀÑÖŸêôóÕ£NmmäëSÇCÊ ±À0Š}¨© :&Þõ™'Á±÷¨>é¯t&56¦ät¦'Ö +žß؇ØÈŒ°êcöG8õÉ!.±¤NÇ’Œ¿. Lå8T;ÀÄ3Éãȳ]>RV ræ"Pj/ËýME× `›rÚA7–‡*‚±ùßš?\1ï(Tu&šôþ™¹:CYJ(…¤íTO¸\ô:@4bÅh“wZØòÓé9ˆÃ®„À·“if¬Šý‘Jl‚?p6ⶃ™|7pŸ,•pcµunéÉ HBžÚ?E„{cF¤Mê½[¢¸Ëê”Чœ´§’Õ•¾°˜‹šn™í²¤§>l?/•¶b#{X¼\Þ~C¹Ž +EPôÊÝÈË󜢤 GFUYñ§œ c–ÆËSAÙlF…춲ÁRæ£Q³£áõgáÇõ¬hrÔPO'°püp|b•´Ây}:‘¬nY—²á«PkUš°½u2ÒÅw1ì¥4ÜÁgÍØCþØh-Õ0áÒp.ÃE¦Òøs)®ö“8ûº7’÷œ2¡SË¢o݆zw6•:í–Ž7p|mo gÉ’e…XG½PÆ}EjùK¨ô{ib¿©ÊÂú,ê4ÜÑâÎ-œãÈîºà¶“!%ƒí¡7­p™Ô5¶%eëlöÝŽ9éî55®kŽ.'dS|Ÿšé«ÿk™*Ž‰ΡJÚŠS©J¹‰×‹NøäHÎYñš{+Ï<æ:­Ÿ–PCæU¹å5Աŗ$‘Ü:ï© K!!šæl¸æØ[Õ‰•ÀxâÂæÒçÇÍxPúüÝeT9OOÜOå\2bRß@•Æ`è¿Œ`çAG§<MýÍ¡ ÈòpÞ8g'°˜ê€0ç—¢öõÉzYÒ”#ä·¾$¢‰Ÿ…éDᯫ^:/}Qð±!ešHþâDÄ(ZØÌD{8°û0sÑ$ó³Ô&ôö§QQ«³ôß„ÆÉpíäw3\u&I¤«saû˜ï‹9ד_+óùâ:HÔ×y%žç†É¾ÂÖºšß€æ§à.¢GC&cr§È’Túâ¬æFÿKU;ü#’îáoUвŽg®ù*úÜ A¨i˜½ì¼Nžˆ|Ç&Án‡ÌOd|‘ü!XÈéw¾¡|”>*Žork˜s?E|ŠÙCKÐúß~Uø œ €/ÿØFç' c)EGüOAendstream endobj -4626 0 obj << +4784 0 obj << /Type /Page -/Contents 4627 0 R -/Resources 4625 0 R +/Contents 4785 0 R +/Resources 4783 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4594 0 R +/Parent 4761 0 R >> endobj -4628 0 obj << -/D [4626 0 R /XYZ 85.039 786.531 null] +4786 0 obj << +/D [4784 0 R /XYZ 85.039 786.531 null] >> endobj -4625 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R >> -/ProcSet [ /PDF /Text ] +4787 0 obj << +/D [4784 0 R /XYZ 85.039 723.439 null] >> endobj -4631 0 obj << -/Length 2730 -/Filter /FlateDecode ->> -stream -xÚ¥ÙnÜFò]_ÁG¡Øìæµ@äxm(°•,$#âkVAân²ÕÚÀWó§juÙ1{Üz^¨}ùŒƒÔͳC¶²«ºî…÷‡–¿Ï« vÛþâ…1çŠG# º®ä+j˜¼Øs°‰Bv¼Ð "„®‡ê€Ÿ’ïÏrƈ[Œ…á7YŽ³¿ðŸp¡Ü¢÷P° ¯µBHI;Ðʸ‡Õ©íIÕ¦fmో¾ŒV!JP%qÓã~è¶[üjIÌÑ,‚‚q ¸ºX¨Ûóù /­Û•AÏGîñ‰€ó¢æOÆ7åcGŒ -É–’¯¾ -Ëï•è%Šh^x3ƒ»ÏÒ—Y}¦X0Þa— <:tåSEr'>­ò4h¶ë‚6$RÔ•\VÉ®*Ÿˆï‚¡I|µ}®Hápòó=CšID-þÜ3à Ñ8 O¢c\~_u%ïÄ_V‰vÁcš«þ³¤ˆJõ0”ˆE£,‰¥¼«„~Tƒ6À|Él°²…ƒã>#ÈfY!J—;¦žtJxZ^,™ š ;±7hØe§í`Ëß -ùžL9ˆ=?efn!¤•L¸ŒJQURÉÛˆ¿…7,º=4åäD ¸ó[ãýJ<¥€ t AÀHlÝ1šÎ^÷mœÅ%¢ì„@¶ä¼œtKÎcTÌ µˆ'´¢´Œ—tœmЈ†ì+Fߦzì²AÄålw>ÚE V[Ï{w†¡@n>óø< ô@2üRzš×!ŽÎB×®äÁ¾œør,¹ç|Ÿ³ ùe²êjÿˆzŠÝ/w·ˆî÷ëO•%tüÎ[°šùŠœ&ŒÝßV‰aß‚ÐÕõD##«zÞ‹b®?„É"ã‘ò@q@"’v‡IÏ„Æý‚ˆînÇ™voV/óUˆY! Pjœ0{’é"ÐW?ôïèÜ ßu”ݔў†ôÆwQj:R<ðÂ^¢4^FçyÀøÚ4ÌÞú$ͬr9Â(ÛË· ëG¥îI0ØUÛñ¦ ‰ Á‚TUX›Ó¢ÜÀ{»ðš4µ¯½4²ÒŠM–u.{adêr*´Ä U›É5•åæÀá™Ä¦¢‚ë([`Ú̹=µ}!€Ý‘¿Ì„†…0}• ÿ‘A€3³˜Áe1„ TdNDDÀ6:ß®þøÓw -(Š~¾ò=&Î3Œ}OA\l®´ÄZfõÕýÕæ¢IP­¸Î‹&4á8ÔÓ…Èõï2¦{rœpʧj¥`~Àul@€©æÂ`@Ç[†«f‘—4œ,°00‰¥Å„;Râa‰QXO*Ž¼XÖ\T³Ö÷­Øî¸L 0ÿÂéS®^S&? -i›Î¡j[)%ZDàÁŸ²áÈ…ÄSyQÎщÇl3×—â'/y]bf |ŠŸÖ%›0@pŒ¬µFÆwTýÂI¥à<Œ»J-T#£”{{®X¨”*í¦²¼.møÑÁ$`š †º?³”,d%“¾­Ç©ÜÇ,º¶áÉfèÄ^ꥠê%u?J*jY¨9¥ð:#–[©Ž:çÿÈî´Ï)¹.3k¸ŽE¥M±ª'3Õg< Ú‡¢<“ëq"éOßýòÀƒ™:”À,®Ž‘ ¤ža·ãô* ²®Ýg¶^åŠÊ狺ªEÆ 9\ÆÁ;¤WÚ,Š‘s¹HÑØ>r䦤©M ¿‘û±#o>ðêýíûž×·”žXà/,Èîx.0*àÞ†#§àZq -/›DqÅ:í±ùôb’#Mfky@ -—$‡ºr»ýn Âaí -Rq5“з2!œKݶ³µª,^¬ F¤PM¥ž÷Ê£üÛK‚èŸã¸úáÅH&°n^OtÈ4<è“|`Ñ:€PŸ¨)@2…w}Š±të¤>T4©£áÅ‘Ô5X$k/¹´ÐÆx©¡g¹óÍQžoÒT3ÈbLÄÏ<ÑÂõm£œ÷-é,(´ë^Î\ËrA):Ò\èGlfŸËQ0~a­­‡ö¼JžlŒam’HØDwM°Ý¯%{ôÍ\QN\¾ÝÀUo´Ö%ûš&[Ê—OÆ^@.ÔöÜeé=†„·A—–X´ó-ò’ëÇû3ÜÁÉ )ä·ÖeÒpk" 'M–ïÈ•Ä#Žž¶–>1 “†`|‘³°²ÿÝdÑ+”;k<–þß^(/IÍ›&í+O'ɲ#¦Œ!gÑa - I¦†µÄLê~ÀþW A¬›”EòNŽb÷]¹/¿úÊP­&˜ß"pyµèÄKãKY1J9»“’Ÿ*êàâ–‚_d[XØÃj·lAË/jõÈ! K/ÌjSaÝ3÷€ˆv¦"ðï;/¾‘9ðG’‰Àz}ÁAêé «Ü½&S´¡(|[¨3̤õ)$ -J/Š–jW®m‡¾ËrÆŠ› ,¡Øýi%š¥£³ÓœbÙCB½L¾ÏÐF_$?ô้aÒKüËV§^˜„ 3Âãæ˜ÁS³±0Èà¯HnVI÷a•-¾gbV:DÚY\qF†…9£ãä‰zŸ„ B¸N0: ¶Á1T‡6lÊ&Výæç:3r7¶ñ £¹gÄÍlP?€»¡{ÍÕU~}Èz2¦ç‚7¤U…6]Ï(–]N›_zÔ[Ü_¨˜ãw¥†xüï_oÙà£Ê$sý˜ØÝQµk J\ù[}Ø“  ôÁ\Cê©‹Y—Œä†ÞÉ«ªÊ%ªã™Ïœý0ŽuÙs’BÌg©¯"àQÇGînÏ(×’ü ¼»Ô¬L4£•R‰ -@w¦¡’•BQ¸¦×Ä(E.•ˆðýïØRKA] g%{lã ,/J7r”ûö…©§Áíj*Ò…ˆCלIsy€Òr=u -¨-I½Ôh­še½”ÖèfÑ/ÅÖ~/´|©­«rzgQª¥.g*]1~Ìm…çʾNOÜQ<>Ž½8Iߌ 3È«!A@H— °9P¡Ž¿åôè"¢.ö©óÖýqzÿI(H½ 5K$Ä)D q27p/ñ§ß`°ÙWMŒ)TÄQ_±mùËÏNÐ&ç+ ϶-·a§_gyÂÓ›Îdss-«ä‡„ÌæPã*Ç„ÈK“àÈ„nîº%O ÿ1¹ùP~ÄWa…B2çF¬ì$¼á7ìpDäõX,˜fˆ’h‡Aµ€ƒ$q?‘k|Ʀ‚ZGÁ1¾ÿð;ºÜÖŽ/‡Ùµæø÷! ´{5¹iÈ`ú(·½^˜M çÖ‚Ã(˜ÐQ†ö“Ó;C(‹ÂD¿qéßÊ«endstream -endobj -4630 0 obj << -/Type /Page -/Contents 4631 0 R -/Resources 4629 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4594 0 R +4788 0 obj << +/D [4784 0 R /XYZ 85.039 682.791 null] >> endobj -4632 0 obj << -/D [4630 0 R /XYZ 85.039 786.531 null] +4789 0 obj << +/D [4784 0 R /XYZ 85.039 642.144 null] >> endobj -594 0 obj << -/D [4630 0 R /XYZ 85.039 766.606 null] +602 0 obj << +/D [4784 0 R /XYZ 85.039 571.508 null] >> endobj -3056 0 obj << -/D [4630 0 R /XYZ 85.039 662.656 null] +4790 0 obj << +/D [4784 0 R /XYZ 85.039 531.344 null] >> endobj -598 0 obj << -/D [4630 0 R /XYZ 85.039 301.388 null] +606 0 obj << +/D [4784 0 R /XYZ 85.039 459.761 null] >> endobj -4633 0 obj << -/D [4630 0 R /XYZ 85.039 266.077 null] +4791 0 obj << +/D [4784 0 R /XYZ 85.039 413.392 null] >> endobj -602 0 obj << -/D [4630 0 R /XYZ 85.039 210.165 null] +610 0 obj << +/D [4784 0 R /XYZ 85.039 259.908 null] >> endobj -4634 0 obj << -/D [4630 0 R /XYZ 85.039 173.298 null] +4792 0 obj << +/D [4784 0 R /XYZ 85.039 228.092 null] >> endobj -4629 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +614 0 obj << +/D [4784 0 R /XYZ 85.039 115.559 null] +>> endobj +4793 0 obj << +/D [4784 0 R /XYZ 85.039 81.116 null] +>> endobj +4783 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R /F58 3380 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4637 0 obj << -/Length 3266 -/Filter /FlateDecode ->> -stream -xÚ¥Z[oã¶~ϯ0ú¤àÔZIÔuß²—ž³Å&»m\ôm[‰…Ê–+É›äßwn¤(Kö)pPlM‘Cr8œË7Ä‹þ yâªXdyê'*\¬wWÁâ Fþ} -ÅRH–Í»ÕÕ›’t~‹Õ£]§ü¤H«ÍoÞûÿÜ|]}üùz©”òÂп^fYîÝ\G¹÷þý—_îV8{Ÿî~À®/?ß^‡0š+oõéË}À苽ܼ»^Í=~¼¿þcõãÕÇ•åÓ9I¨rù×Õo‹ œèÇ«ÀWE¾x†và‡E±Ø]ʼnò“XÉw}uõ“]‹ÇâÏšJ¢r?ÉÕT*aâH% #_…Ñ"K?3‹îàlEä=_G™WÖ5™^Í?¿a §,ñ¼546ÜÝo¡­{þèú¦%™Ú5;ü*e¡õ¿š#ÌØ£eVµ‡ŽÇ¦…ÿ¹î+h6{¸ž4 -¼îPÑŠÊ{Ä‘vÇ›Gü ½ƒî:œøŒ‹6í†{ôÏó'v–û ^j¢ :÷¦¹^≠ÇqàÝ} VÜ–Ó`S¿…÷Ê´­ö·2Šjr}…÷+†MŸÍš«7Q¼0ÁýÍ-7~’àÞt}ÄÓW=N{åñÖº9ZQAç­ÆåõMÂ)°JÈCÕ~9sÄ‘Xq‹fgNro_ÒÃÁ»3¯G‘$…w€þ–Nñ­ì¦Û–6M{ïžZtîrëóE ç¸RÝ9  º •ne©½á¢´+ ãÔØ5LeÝZC½5 œOP}£ÛžDe™aÙ5¾û´ e‚á¹ö y·÷Ü3¹Nðw«˜ßð·¹[åu¼4óÐv¾a#Êü `6V[Ôä$PÞ -b¬¡Ð6³%©åóØÄÑœ£9g)£Í¾~åÆdi2 Ýnx")²•=Tµ«xHÀR ÕÉÎKYÕ Ä%K!L}¯wHø Á|ãœiÏÂa´ -®èdd|(ÄM9\ëZ÷F%ñ.*¹G<}2œÔ–5ê®$©ø§8+À#& ðs~”ij^SH– 9Í(˜†CƒÇ¬7úÐÁQOv £ÔŠÂÝò²ÏW~:ëï—f¥Ëœ…Qáçص5Ý.ˆ(ÍÈË wÒ»½Œ|hF<ðùõ -¼›¯ø•zïY!P%jÐz¯èZÞžžOÅ¡&ÙE‘š ç£@¤âÔO!¹œ¯¶%;xïŠ5›‚/½§fd]7‡ÁëÁg¿Á Î.#ûŠ7á X×ÖÌ£"\8-vG×WB,2.„ŒÞñ®0ôLÎõuË«iî·>³¢£ #Ï­}ÿ™aÆWžE‘,Ÿ;`LmK>ÿ ‡ … Œ4h˜ l‰D‘O -ñ2cÄÃþJ%^GòµÞv§¹»|éË}gNJñ:Ž '^«e„ÇdKwâLl1Aƒ:1RT;Ý’OzåN-3dÏÙîipÜ1G-PŠú{!®I,Íñi;s¸Þž„Â{¦Œ²©,&Ñ6ÜÛ–º£ ÝS_$ñtmP Œìª ÃËÑYqje"p JÒÈ»kz™LúxJϨ¤©ùó¹"@$Ä2{afxÝ ¶¯4T>³"ä¬×¢³è×ãIÖºÈÓ@3u4fPxŽcÔRqltвè7G{Çóêajêš4Èž <1……0ÏL8ƒIÕ|ÐÇþµ>h«ÀùVf¥îí™xÀÒËñÌ¡9Ï ÅæÂÙÛi<‹ýw¸”¿û²âhf~Æèew¬˜ÓZÐŒAp –`ÍcM¾óPˆgÓì´ÁCkÁ×(Ðʲe‰øó-c°¯Ðñá=ÿ‹g7{ÑèaË%ío÷z‡3† CqžÆqK#O5»=é›G»äŽ 1ÏMˆ"?M!ËuôŽ©Æø–IB¡Bk¢ì”-)‰'Ùu2suvh½IÊ1²ävSofX -“ÜÓ\vëv‡ëu¨{ÞÌ°–Ä€\b!6ÙëÎàãëç_0HkpkŠ—í€d‘ŸéH'(íȲiÚ‘'²œ²ø‘¬ZÚ)©„öL*Í)3.®aBÍ?äs(¥l_¹GlK9¦Â :Ð÷Ž¹@í"«¾Uºæ•OLŽf„°~P›‹AcŠB6&´Ñ4¦¼_×ÇŽATÊé}”ª!éL €B9º`,&×€};=X|Ç󫞇h5ì£+c†HÁþHFA‚øhdÝAèAÊŠ/ÀŒ(X1õ¿@ˆú4µ§N㓠ݽ²&—;ž®×k>DÇßÖô9¯Î -´N;l˵¡Åºê¡F8ÉCz)^`óWºƒAí²]æo®„beR¤ ‡Æœñowš;J"qo8èExAnxmÊO¢'* ¹“†¤gL;€¤+ÿ» ÃB¨(›\H2ÖT@mÊ1øÁÓVm¹îù³-;Ñ*ë…s2ºy–º }Y/õ—M,º¾Ï°I wwYõR‚ -ðœŒnÆŠ|aÕKkRêÈ#7A¡rž!W‚s AGBŸ…ËzÓIà.µ©)X³ §¯>!2|Déì-t‚Þ/“¬¦ø<öI«ºåÙóÆ»q*ØXãÀM‰¤Ÿ ŽÐ5!xÆn²zl Ø„€m -;·T·Ú=pÏx˜Öl€Z¾çb15Ž‚&F¤~À3š=kÝ>•f{1ⶦǦˆg臬C5Àl•®¹c¹¢ŒuOå¹ÜEÆRÏ8ä¤|yf÷0Ô7ëÞÔÖh•¢ûCÀ}¦Ø3•CR”§l80«µâìÎ9Wrá6ÏÕt¢<òó(½ˆš³Øи5ÄMœûE]ÜÖÐLö=ÁÁ±éÏhcÆÁ”6Œcñ šÇZ tñËzŸ¦5µ3(—ó–Ö™ÆN—Òí²~ãõ´è<Â}œpÜç ’‰©%â´ói‚+.Õ¢ëǶæ7cŠU@†ç -Ë8†Zš‘–â—ͬÙóp’ͬ‹ö!•­9㮃×E_T¹P‡!²"PyB©´æ!‚‡ÆÕNÖÙ F„ ¢[¼HåŠÐýh´)°ôœ®Ó ["‰Ž¸&¥ÕÑÀÁç\íºå5§–Ù¤~ø+ ÌEWȨÀy€ƒ*jïL;÷Ar}ãÖ’@ÿp ~$rT—ŸTÔ€ÔÕ¨d¥'ºK”u×ÕÅ`¤…,œ¸á@cPçä@Kë9ùuÀx- îª'\¹BY­5SP±%ûz9«—âºJî'ù/©M½Ccâ(';ÁD8wÜÜû¢:Jr3éŠT -iœ×¦6l±îs|1ç̆ߓ¡ä»Ÿz­„zo«üm<Ò…<%ÁoçØȺz|e®¾“ /LZhzßÉÂ$7ÊdA&é¥hÚ}?5Çm³“p·™Ä§Šß°BXÌ@p Sò@É„÷¹/Y|“£e(óÌIØÉÿnyâ(Ÿ¦Œ'…ðþ¾iEb­î…WØ”bLçÖ&Š³’œ·Á8ÌÙéš/½N—âLhغ`h×U78Wcèq˜‘ 4L3”I«–Ûòª"?ã4¨{HÃ@ -$8Mr¥q”}ÈZBÒÅUŸÚäÓÎi> +stream +xÚÍZÝÛ6߿¸'ˆQ¤¾úìnÓĽË&—uo{hú ÛòZ¨,¹’wþñ7_”%[›;$÷PˆÈ!9œá 3C¯šxðOMâÀõt2‰âÐ ´š¬vWÞäFÞ\)™áMŒë…Ý,®^þ„幉—Lš²Xÿâܾ½þ°xýq:ÓZ;05«Á4Æ×ÎmU‚Ðæñ xÏ)wSà·$®k&UÈ$Lœ´DOBl·–ù.]áš-pÉKaÓVü• ?ãJJ›žè±³±áÔÐÞ +-‘âïÒ†„ï¼¥&a›c“Qß=?k`êú‘‹znh¢¿–!ÿ=µS@!ß•K2a‹]íØ~ävEgܲ‘Ðâ±fÜÞ‘•W8c›—'z»M[æœ7BÁ­Œg.‚óv=ÿÀþÒú‡=Û™1žs §á'´ÒÕc%ôV„Dße€qÏš)Ÿ²ïÊÝC“Õ¯¾lÄø/yµŠù Uä”ç¨Øn¯ªRŒ£œU›Æ{ÑÊÕÁµÖºØ´Ö…vï>Pÿì#çþMkaO,44šNÄh0ùd4èÔYÏw˜”·ü]v¢Eèéx±³4íóöQ‘«ãpà‡¹æ{r†ºóJØõ˜·Îd‚¥i×6Î:oˆIŠ¼Ÿ3`fKEÖØÝlÊŸèÜ[r‹<»ðwŽ„ÇœŒ[$îë +}°Èvî†N:)a,µø óYnóþРùƒýÉÇÝ¿Ùý³=È~-ÝZ<Å0èyšG>|êu@ÉMo—­ó´Í +”%@ȹ>O@â¼HY ÙÔâP¸==ˆñJNaìQÃÜf›‘i`Ê'/ðPä—?„~Cµò¡<1‚¤«Ýšç pÖ÷Ýrž"Êm*4a!øƒ7C¶„€—8¢Äù…fˆÁsƒ£Å²Hܘì73*„+Ù`#ês€ýÂ$pæ2Ònå"\D^µTRle‰{éÀ§s\‚W·Ê…lüʪ +”'h`N}zÅò¼µŒLW6 g,Èœü¬*$A¿¼¸ä"쯆Åão9%´æ †ŽÉý…œ£ø:GÕ46(/ó‚R£œ¯äw¹'ej$®òãÿ%mÃLã"øÞ¤kŽþw qä!úSÂA¡ä‘§¼åcMãi—Cdœ!üy.¢2‘kÌó)eðßRÊwÅi«+ÆÅð6ÛÈ•Îmõ„ÓÐ)Ê$>q ²-ÁìxgÈß2Žàèm‡ƒ1&Õ¼†»ör¿+ÈÚBßXUu»ñÉ!5€3‰Ö †ÞþD¹iƒw ¬fËjK¸»LA˜×œ!¾Ëˆ6éJXÞ’g²uUÀŒ'îæ·$´3b8„Æ2•Æ1¯éŠ<"®B¼¢}s Ê­Çöy¶Ê¸ÖŤI Š½ãö%*6Ü<; +$YPÅöq[¼ÌÚ‰j~c:#¢­¬1'8ÊëAZu9ñ8r^öÌ7.o3Ý~­ŽÓ+Âþ­9ƧmÊUU×8aߢ¾U‰‚b¾;¹„æ ŠÎ[‹dQg_>{‚cDÞ$tf`¡ãj› cc%Àº§hÁum7%¿Tµƒz´´5L—÷¤ÀT.sR ®{دK¡€8f$¤·u +F ‰å &u¹#.«¤YÊ廄 +bWƒ„³Ä¸± ¾ÇTчˆüû„b³®žùÙV Ð~ÀÁl‰”[ ¹=…²e—@z®‚°ûõÅñ5VžÃù'¹œ-Ö<@e|›¼í2Lèn%(Q˜II¤¨)+´v÷vÕ|Ù†ðl,€ÑÂñJ‡g.{ïG3Á;fÆwrôYSòá´°\ÉE.@Q€£¨ÝAª‘äžc`걫ŽÊÞhƃ˜¤eËÛ~SlI[–é¹lOÙpÝé*ÛVˆè™W} $3£,Éœ_Ò>³±K$åÝšÚ"•d1ø Í U ˆY·)]yÊÕ)Óç4ˆ¨òV…ã8ÊÙp±fÒÒîŒ\3Iä×X&¦V©O:a eÐmò]—A æ*Xs Sÿ”•›‘SÈåF[7jFîu¤\/šÌbåúÉ×_ëy¹ÂºmÒfö‚>Ì@ùÊ=n ƒ1ÿ§§‘Cm‹áÑ´D‚Â웞ºø)Ñ8òr¥$˘J·Ù×=gº]µ’TŸ_ +µ­®é…SX ÊW\jë,#95ú¸½«AB–é[¨÷t½ÆÉU:ÆÊ~XÃ~ʬçw÷ÜiNÒ”ázL,ºûkä]³ðXÜ~x9ÿÀÓORžD«à0¿Ìµ-{?'*H'ü qù9q°‘‘ÇýK‡|`Ñ¡Ü:=ù 5€!Ú¾gLÄ4¸Ë1¸ÿuÑ,’K®íøuÄÄ?"Sñ\Ž”¬Ü¡3Ú÷pB¶µjQ§\õ©)ȸŽU +ÎÞAF#;šŒPÞi_hR(ƉcÖÉ„ 9 +L8 +ÐóK¸Pu¯t4©‘ú<ÎKxŒ9øÝ渑»µ}ƒá·z¦°èe<ƒ€ÃbŒ>å FóÛ>~ %|ؼËÚ:Ç÷S +¤UýxÊŽÉÀâ–Óå°ûj_¢C+¯ÎUaa>2ž3ßÈ^ýBæ›ÿÃÆùÈÃÈ:·;¥§xEe›Ïß” +BÝC*/"oø¬æ_„ Éc•o³á$JˆšÉT +.!Gè²¹qö3Øgùð)ôBŠçCÌ)êió¬ÛRZñœaÚN:ßõ£ë:å&Æÿ¦øD…p-¿hô^Üïlt²¿$Ö\Þ³ÙÆrMó(ú†è„îé'Ãû‹ýJèèžHž‹{ÒØ…{BÐv”#3¦c/™ŸD’#¥ØÖ/ø]÷º_æÁŒïG^Ý$¯ŒÜ(ˆûÞM\#Ÿjüés wäwb8FÙq<_$žá#oå÷!l‹SgÂ?/±xã×n"œ{U/Ÿ’ +Ó8¡”­/3 Ï5äE¤ X…GêÇ 7>¾ù‚î±6®D(Ö®>ß èw¤Q_ðÝÄ–$ÏïA/ËÈWIÉ;Óø‡ ±™ÙÃÜGhÔúüƘƒ’3Èëü@ÿÜ#,¿íÀCT܉÷Eõ”Ò—µÚéP+ààlßendstream endobj -4636 0 obj << +4795 0 obj << /Type /Page -/Contents 4637 0 R -/Resources 4635 0 R +/Contents 4796 0 R +/Resources 4794 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4640 0 R +/Parent 4761 0 R +/Annots [ 4799 0 R ] >> endobj -4638 0 obj << -/D [4636 0 R /XYZ 85.039 786.531 null] +4799 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [429.549 103.569 496.928 115.258] +/Subtype /Link +/A << /S /GoTo /D (adsdnstech) >> >> endobj -606 0 obj << -/D [4636 0 R /XYZ 85.039 575.671 null] +4797 0 obj << +/D [4795 0 R /XYZ 85.039 786.531 null] >> endobj -4639 0 obj << -/D [4636 0 R /XYZ 85.039 543.249 null] +618 0 obj << +/D [4795 0 R /XYZ 85.039 656.966 null] >> endobj -4635 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +4798 0 obj << +/D [4795 0 R /XYZ 85.039 622.22 null] +>> endobj +4794 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4644 0 obj << -/Length 3273 +4802 0 obj << +/Length 2011 /Filter /FlateDecode >> stream -xÚ¥ZKÛF¾Ï¯r Ì0|?ö²ð#ÞuàŒ“X†±HràH”ĘÇ$•ñüû­ª¯ºIJ”÷°0 uWWWw×»Šã/<úç/²ØõÂ|‘f‰‡þb}¸ñ;ZùׯwŠr7Ây¹ºùáMœ,|Ïͽ|±ÚZ:¹çÆy²Xm~w^ýûÅ/«[Þ…aèø¾»¼KÓÌy± 2çÕ«÷ïW¼9oïß0èýo?/}ZÍBgõöý=Ö^ó -Á"gÅ /^.ïç!þøaùç꧛Wöž£—øaÈ·üróûŸÞbC/úéÆsÃ<[<ÑØsý<_n¢8tã(Ôy}óáæWK kѻ昇™gá%WüxÄßÜÐi»I” -[¶MK÷?ðKŠžžyΆ4ã‰ïüáùÍê’1ˆiQÓëi¼'hÕéñ×Ë u>3‹÷H° ®…ú†7½ÙwG{JLN´Ð1f©ÛøjØ2ºc Póh¶ú/}Õoy-p*šëksjs¬Ÿ1šžÙ … K8yç3£saLÅ;óÜY7Ç¿ˆà‰ï-é™~£«OU¿çÍ?¼I‚§óÌ͘P¢«†³yŸrSõØ0M¸I–ë†ï;ç7ft9bT€÷ -ZÙÎݨ¨‰4mxf %Q%Ä‹Õžyžózõ[ûýREM ¯NyO ‡j·gZŠ÷ 7)…Mw~ä»±N¸Õ%Ž¿JÜfÖ7øÕs»²ƒ1 ‡á%`[¾Gja}S¹©ëå8 /"N~=Ôråâ€9©³‚%ÃS}úöîU ÿj¬‹šñZ±–»7|‰£>žáÄ «b€¨õü¬'ÑxUy!HöSˆE€£º…í#;·N¯ÞÎ( Ùqz4Â!™Æ¹ç|ä7„䀚-ÿÒ£÷bˆY §=MéSU³íbRÔußu_bÀ×U«†–iø½´Y3üÌY×U ( +²%uX¿êBì‘f}ùµWxщډ†7íjÈ{…òßV>­î4–LOU[r´s‡ã#Ù(©ËCDxe¿ dTêJ«4ÖÃä­9uæ6ÝœæÀýÁç´ÏpÇÝÔшú°·)FzµnD§äœ¶â…ÎvŸ9Ð_Œ÷öz{ u=Y„’žst⻫¯X ŸÔbtæ9¦î/“'Þ—OÌ4Ù‘yÄgyÄ êLÃm]™{«+ƒðÈ[¨àÓ|0®µ £Ï°pZ¼"}¢ÿ‡{²ÔÜ‘Ôp žóNøy°±žhXÓøžVï‹NåK´|À~tª„=Ô¥ŒY³(ÐGGœízyC±á0ˆCŒ¼p¤Ñ<ƒFø F©#ÎdÓq¬Œ#+Cç¨<î4”1éY¦vÀ'7[cÔýsêÁ“Y~Š›¹+^jz,L(D„9Ú!œuª[&èB‡Žª…##g]4§~í‡å)g6&êܪ–²O©Ë®3vQVªµm¹«º¾U»« bñÜùfN§Wƒ±CJX$ßñ½ŠÄÆ ‹BÇÔŠ&33„Qält ì*Õº½<1#ø¦¾Ž¤ÿÈwŠ!R¹oõld[ª°Ï"ÑÓŒVë³Âtœ‹aŽ@M¨#lªhey#g2ÙÝ`³yMÓ±xk ”i$¹½™l‘;æ¨×hÆ·°1?õÇFãs'ŒÎ+õ'ÞRÕpΙwpÉåÓÞfùªáe=ç±ë­¤ ¹$,šƒ$šz$Φ¢’&“k&w#B–BhI}!í9÷…Ý-ÒæKï›Rš߈Sn© ¥ÀGê cäÙz‹VPô´,4:ÊLbÄ%l2„žXÿrn%…d‘ 蕦֦Iq‹¥,ŠN"¸ï™\œbâ?¸ >w=òyWªÀã‰&2áC¡á™'u³kôJ[–„M| bUy`‰ÃÆLJu(‹dô,×}Ùð¢î{ÌÙÛ†kÙZ/˜+¿h2jÚÁã"yÝ ²Ì12e|y°$7ÞYrë–LÏ£J†°£Çš (G³„Þ›Ššª#ÒjM$ñ(ÃP“Ÿ0°˜á««TŠQt½4礩óª9D9ÜhLfTÕ’‘ÔR0Ç×Éuº³UÄwh–üµè-Ö™÷ÐzšižI#‹x¤(u~fËûðë;%g»©k'N{ßð9l:¬>1¶ ÖDØpÒ˜":A¢ÖY*®Iè„‚q`AÄ™ÐNÁbœ êÒ ÜuÙ?Caâ;øf+$«Ï40’áñ9+EÕ丶8”½õPתœ0¡ -Æ‹¿YFŒpl•ã»93Í–aØ2UŽïp{,¦;r]sàþ…)lz0†%—¤Î}ÓK9OÃÀ:éÒ‡r}j«ž7=_{@ä¹ÁÿzÀ€sµ -½Ì%9tB -¼CPô A)wõ^òøZš C:€øáCÊd‹–#k×—“pÀæ~åè0Ô™O‹£--y‹´:¶ÅÚv×BNCMg1”‡2xÏ Õ¯$QQ½o¦)—æAº:d¢±Þî3ÊrlÐÁx„gË<hòqF‡Cí~©×öåÁ¤=q€¤ïù‘ c{Ô´ÛA”ÖuÉL|$¡hØñÚõÜGe§Ù?["K“|*.*Ó€"Åð%¡ ´³Å!TêÙ㘪|4Uª¿b°»\Êàç—Ÿ« ÑA]ʃ¢Ç¢Q“¨#=HMo†Â*ñ”ó^Þæê­¦ü L³¯ÄxŽ+ôöȧö Péï}$„¦ó Â:ðì@éÝ+t&ÅÓ;"ªÔ§!ó“ ãr4;+h§‹ÞäÀ8ÕÒ¢I–œ]l–£fáˆGŸö0ßù'‰ª“—3ùz˜ŒŠsó“ø÷³ByϤf•L6°€ó 5êñëß]Ï.¿œø ´;æFöy}þ«½ø?üqArñDÚ˜¶cNlÌ®”4?—Ì™çÜNÒh¶Æ£…PÊÇ–0Æ5<8JfóO°Ïéê3ö-ÓZ©¡SÝô£Ìº‚;àU[´15Û~—%IQSa"ÿŒ„SäìÑX“ødÛÑÒ«-=¢li¡§‹úr¦–ª€ÅMÕ†Xžõ´ qž¤×GïI ¦.! L «6e;dL´§Ÿ kû)ƒ>3®»¶ùçNIŠ‰#ÓÝ‹Úl±±Ñ_«»¬”Ì…~œV´@R!Î|çHã©ØÊvk:øˆýÑ@¥ùþ5š{á «â&öƒ"ÀùÐ6µ4>¢oKùðÀCÓ=ólÁ‰­YØàø}Ú}9¸L¹¬UeI§Ô]¤Sù¨²åÉÈì/9!}-äò\ýSa§Ã‡°[Ø[-×~¼…™Ê¶çîK­ -ÚPtøñ4§ÝbËà5šRŠÍðþ±–=ÖOHÐ]›8¹Ö£‹3Õ vR5h6 [K€QyÖ͹η½6rÌEGíc‚Jò{êz̆j4ÿµ³“Z·e¯¤Â´¤Æ QԣƘV+ê„>Š¹^õÔ´YÍ×á‚:é/içl—`SÂ%…ÊŸ¬õ¦ž9uõy´Xx­›˜8œ§îE­E¡M„nj[2šÕùx¹‡ÕÒQu¡IÏ&Ù’¹É¤/pcð¡Hý3i’´|OSÓœÜl‡¨›:ùBøØÒKæWàpá™?*VCß7™‡Ò{`„³²6Ÿ`·ü{þ]ÀSz¦ÅtZ*O?*ŸZe4êO±¨wz¥¿Ã§+_{áÍá±èÕoÍv”{mÛ7CxÓÞ¦ÍîHïºgm7:£´±÷I®p¿Råþ´eÀÎ̪ccXökÓïžk~:ë$qoûe…ψ+2ãeûwµ.ð8ry²òO¦š(µóζ3Ùv¥ÁMx›r+PÝcí…GÌN5øíE{yd[ÈA>òCLxFy§EwSÇcÃ$.èC"ùáø£ÉÑÜ“&Ùuù5Š¡x¬ÏÝùÑ÷ä»$3)%¯ŠãfPn–ÕD &Ä&}^_û¼~0×?&èÄSÌt8Oš,µê,U;ù+ 'y®$ 3·bß8îÅ›Omyg«°âÁøÙÇ3aª_ £ë}ï+…|ìFáìçVúçþ_ÿb»QææY0ß ˆƒÀ |{t3¼ó›?”¹¼òu!þiendstream +xÚ¥ÙŽÛ6ðÝ_¡Gˆ^º +ôa‹4ÁíÅzÑMdK^ ‘-G’w“~}ç %ÙëM[,r8Î=Cª@ÂOY,¤Éƒ4KDlT°Ù/dð+ÊaØ؈ØZ_YŒüj”h!mz G‘É„\üaµxû^Ë@K‘$&Xm iUþ*%–QËðf³iO‡a™$ o—*±nÜ +Ée”Sö( ‰vðVèy­Ýâ+˜‚“°d¸yJO‡r‰f¢EÓ´|vó{Ä*"¤f˜LÁŸ²zìªêüÜRÅÕ—zL5õ€¿ºMpØK¹{Ò[ÑxCù\lØŽ]õT·'fÀpHãMÉHkÐ\’=tÈšßÕÕ Z2v‹hÜVoQþrÏßßkÒI‹r?÷ŒxC<Èà“3%‚ßÕ]Å+mG e&„ IÁEV»º¿",i~‡Ú<Uj1”H"mºÚñê7„¯Í-l<6CMR3íj—;æìèè´ ¬Xš ;#DØ·ýl¥=ùÁ–¿5Ê=z¬N…ÌY˜[|+sfÔ*–>4YIM{ÀÕ!ã#aü΢û @ j +^ äí%çsV…°<'ÐUŸOcª¡L<±Ö9¶:³©|H=H¥“¡åï±ó¶Bk—Ž„WŽ‹ ×vÛ_{_?vÅ€»¤e“<Ì»ˆü×ïV–÷7¿ð Øo‘Ó³ú*ój/²#ž½xÃŽv çx8T“Èf$sMdï9»(B‡{¼"ãÃÝíïo®G‹}ŸI“ËdHþ…å$,3Kž—B¾…”ƒ‘‰[HÅuÏ NßpÞÛ÷q>« Z¦ÂPõÃÓï°ö¨0ä3°?OÛe ÇX¿z^ù(cy‡¸70T|ÄYñQV +“kw•3ƒûNNÙÀn=šÈ;:j*26 ÎFîYô.¿Á>Nq<¸ (}ÔÙºÀ‹ÚŽ‘|¶ƒám¶™v^Œ–è=`wU‰±J)'áP®{𤗊0©Èbu½’yÎÝ`íC>\¾öGŸo›þ8…ò¦Þ~¥òõèÌf'CÌDžè3ÍaA+!Ä:Fn>U\N.˜ÆÆ)óþñ=F¬A }á`A±%ñ­ˆ2±°6†£´¹ÕØ‘|^üñ§ Jh[~Z 3dÁ3Œ¥Pùö #tjܬYÜ/~i¹•o75c¬˜õ(×”»¬«Õ§Æ©v^“á•’LB¶üÅ©{#NºHˆ?¤„8Qá­T‘bYs•Õg"UÛ fÖ[BRáXˆ+žCÀÙï<»ž¹\köï @,%iþÌ™êƒÏ¹ðoÊŠÂH°»AS½á"M1æ( (o¤Ù¢óÑÖ1÷àÒ¬%„%Z®d¾ C:Ô L»÷ú€Y»îÎÍÔ ÃŠž‡¼âÔ;mRbŽLÁ¤oÊèµ?{ÏÄÕY‰¤œñÈ8”ÉŠm‰Ìµ?ˆƲ¦±—k + +_wâ3ÕýG¬®¨à¬«§JÛT[÷ .Xê-pÂíRÝ“Ó¡±&ܘÈõ,°LÇ;Çzç0Ær“-y5FEÃs,N^X7L¬à…™ÖîƬ÷+( ´X2&4/¥w½_ûˆ™°þ‹œIC1¸[ñ÷YˆÝ$ ïoßõ -7G~`uu<Ã0ñ§XÂÌ‘q"ÇaV +´TŒ'Ǧ† Úz{ÃÉÝjp —v§"d®«†SwàqI˜¯üyãØÔÛir~Ü> endobj -4645 0 obj << -/D [4643 0 R /XYZ 85.039 786.531 null] +4803 0 obj << +/D [4801 0 R /XYZ 85.039 786.531 null] >> endobj -610 0 obj << -/D [4643 0 R /XYZ 85.039 657.913 null] +622 0 obj << +/D [4801 0 R /XYZ 85.039 766.606 null] >> endobj -4646 0 obj << -/D [4643 0 R /XYZ 85.039 615.628 null] +3117 0 obj << +/D [4801 0 R /XYZ 85.039 662.656 null] >> endobj -614 0 obj << -/D [4643 0 R /XYZ 85.039 367.905 null] +626 0 obj << +/D [4801 0 R /XYZ 85.039 302.982 null] >> endobj -4647 0 obj << -/D [4643 0 R /XYZ 85.039 333.159 null] +4804 0 obj << +/D [4801 0 R /XYZ 85.039 267.671 null] >> endobj -4642 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R >> +4800 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4650 0 obj << -/Length 1369 +4807 0 obj << +/Length 3014 /Filter /FlateDecode >> stream -xÚ­XYoÛ8~÷¯Ð£ ¬Þ"û–æئ@Žm¼èÙ<¨>¡²ÕÚJÒþû!©#²¤,º‹¢5ÎñÍpfQøÇ"£6JŒ&J°h±™Ðèv~Ÿ°À1 ,³Ïûùäè\éˆQb©æëZŽ¥DYÍ—wñɇã›ùÙ§éL3F¦³$1ññ”›øääúÏ«9îÈøâêIן.§ vˆç×W~ïw€&ã9n¿ŸÎ€çÏn§÷ó“³ymgË&Zù}rwO£%xôqB‰°&z5%ÌÚh3‘J%ExÏ'·“?jY~OFþT(ÇŒS’p~¨.±IP':êÄ:ͱ–÷ibZ)(Rš¦Ú<]^E¤R°–è{DuôêéLä‚Åvi9I¨dÕöÑÅFG§X5ÆbA,‡P4Y¼N­#C,üBü•DIÌÖÅÿoªh -?¬)® Ø8”¹b}à]™µy#x+ »’ÑŒóìái·‚|2. 5GçdsLsB!†Ôñ¿ëš+xB8Ó}æÖæU<æ½ÒÓ•„ê.N/oTjHf«Æj1”P¸‹3& MtŸy_ÒŽý·KQ)4IŒì÷10Iªˆ ‰0Dø¹Š×EW7/ðV¿àUÎàuûà7Ÿ‘ºÚí³b»÷”bíŸXnýò3,³í~AH¿ÎeOo‹ÒöO߀çÛЉ‹,}ý„äáŠÙ ©3$]!eñ„§²úé7Pâ®( 'tQäûßžÄi^ÂÎcñôðˆqt·QôΗ°éDþô•p“¢åá%/ü¢Ø¢&Žo©,‹Mšmýzåž34«ØnœD Ù¸|7P ¤5×b´¦·x\(¡4¡d”IE-È_j–tõ1ª‰QfTaÅs ñUò0yÊø+—·€Spü:¬¯œû¥Ï#â¯~c‘g¨Ò¿ B}'yÉ\<µt Ô/@K÷U&.w¾zú® -$æM¶[-¼ ™œØl»/Ó<_-‡"aZ¤á H`z3 # -›€t4ö¤¥ñ3¤$Ã+‡ í=6Vyê[]¾†ZtP áꇴÂó©¾Â¸–!hNý¾pjÕzð†gðÀô&à# -À;ûoiìÜxŒî«û°9XmFhñ #P1½…À˜Â®Æ^Úû¸\ ù ¹jEò/š(UTõ6;(â‰%F’î1~å¸ùPËd0¼QÛ´L-ÁObaZaf– ìæ0ò«Â÷,¼/7Khû&ÌzŒPi­ð,­µ3¾ñ©šòØá”ÄÎZr}lL;6Ü@´€Û2ÛÔgf 5ãÕoÅ ß1VÌÆÝxžH+°y!ué[éÊ5qãQ׿aë1}LëÔWf_Vò¬ÌV-Á®aÂó HJ|)Yø–Ž§AUÓêÝ᩾‹nZ‡w=…_úä[¤¡-×F„]ß•Ù"û–6! íá°«Cÿ/êrFº¡–ª®„Ϭ&{~=1Û… ºþ¨ùõÛÑÊkE´Õ££ ã†À}n&A€j°åa̶aꌀÀçF@Áë! ¯„™.LT½“pù ¨÷eÓåß5“lLzd ÔX(Òb|ÂjX†‹kày«¶Žh«KkG]oem©ëóú0¶Ô¡ïl+äø j–a×Ï[®h«]ï¨ëu½¥nÌu‰®Ó¡©>³ûÃÿ}ÙøŸ¾³àëÚð~‡4 ÎjcÐ!ƾ´•€ïa#zLþuÁã endstream +xÚ¥Z[sÛ¶~÷¯Ð#5`oŽô¸“8>±:íLÛX¤ežR¤JR±=ÓöP¤D9™d2c€‹Åm±ûíE‘3þÉY +?Hgq‰0³ÕæÌŸ­aäç3i9ü™~âÐÛåÙùû0šI_¤~:[>Ë2ûûüÏÅíòÝçù"OJ1_Äqâ]ÌUâ]^~úõf‰#Ú»¾y¤OŸ?Î%Œ&·¼þtÃcW84í-qàâí|=¼}Kds¢îNsô'Ü„y•;³Á7DA°(%žá¦J‡ž©2æNéÙ£lñ¤uDz\Ñ­Kæ"&9¨œ$ü)+RÖhØж‡õ^¸ÿñŽÛß`™¢Êèé`ÂS‹dí­ÊÂ>qË|f»ECµ³Ë‚u¯¿(ï2Mü'7Lãõ¾ô\§á•à–ö­bp#ààyD¤c´ejÖ3î|þùë¾ËW¬’¸: ¥:\?LD’„Óø¡EªÃ¯áÇCmϾ©AÏØÖ-BÀýÑ QïÆ™x³^ kƒÝ¬ðY„69÷ïŒZdß™–¨¸½- ã }‘›cÜdÄUP÷ùÚ§9îÉv­Y¿8”ÏBË0?€×àèâïFöýÏ=; uäÉz¦#H%8àø4¤‡ßé‰HÇû³À‰HR£¦>9,–UmÁ šÔÛ¡u yïìJÜÚw9t™j§aÛû“p†"––ïO_êrnw±vO [mÐâÑøiíy 7[ç(Yã|ˆBÐý4îâîòš0ƒþƺ]þÜ1Ü"…–`o‚ˆ¸³ø•8G€=ÚzUî2§«­ãȹƒÐ¡’Èû´7cùSâ}0Hû‰•¾2îc܆mï°V *ÛÎíeyÇš‹ØMâ&¶~ÉøhÒ;W¾ÿÌŒ¡É!CõëΉvµkزÁñ ÛªÞõBà Qì€Oc£ ‹g1ñÆ=|_ŸÿàS ™.Þ†#ìn›š8¾t~pYXæU6зÀwN–Õ5uÙºyÆÚØQž•››gn>=÷7,xèñ¢›mêGשÔ6ÞšðàVfÎ[ÖìÐófàMž +Œ/‚@ñ+åÐ$Ñ Ü,µ{?à`„kxߦnk ØL•N9^+#Я}$[(íç=Nλ¶7døª+5àrNL4Ç­+ÙzõMÈ·¡Á5qw—²dÑD¾4­]fƒ`)îVì-q)ÔwA5Ä`âب®;[²Óâ p! 3Ë÷Ï ±o¯CÀ7ðƬ;§40¯É9Z5mÞN{Ý-ŠÖu*|-¿Ûë–™Ù¶pÕƒõ5DBÏ}=É D4™àýõ­ùÝØÇ#6Àõ!ð½ÇˆºŠ>\aþyqËÙÝ¥}j^ 1-ä¡/¦ˆ)wþ‘H!GûÄD µ[à yo“0^{¨þ}¦ÅÃ6{$w¬t$Ra†&Ü{¥õ>iù»G6r6wŠE”¼šS²vr)<Éé~à‘ƒÕƒ¯`à'%\3÷§>õÉ«\¹åYÓù#Ïz”óhÎÊhÐŒǦD †È©·ßWG¾×’0{Ü&ïãÖt¬+NÔHŠ•½¦pc|ø´é‡Ž$… ÿ‡'Ù6}LMXS”/<ßØeía6Åz u¤ØD¬F${3…”$³z·F4ŽÉßH|vÿÐV5·=x˜–CT^[FÇUÎ+Ãex<Ή:®îíŠ ¦\a¢ûxxZâî34ŠŽ`<ÿ2xuÔ>|cÐÎæwX~|ÍCèË„UýX¨8ÀˆTøIÌ9X¯ÅFÞªd﫾Öðh˜€çZ'=fœ_KmNi7ŽÑ®†fßø EWœBdk¡0Âö¥ˆâõ:lS½NÙzÝ ÝðíTùíT©-„Œ8Qßíºì=ÃtY-TBú‡ËjÚ÷X"NÚ¦€¦çs.PXˆ zF`î ÆÈñ"?gæÐ)ûR?xÉä6w)ÇÞ‡6µëðµkiŠmó/†B1¸Š#^Ž"Ô®¯©8æã)ªdÁºAuÅvÀpÅi‡Kì‘t¹÷˜–Ü0ýk!œÅΛn¯.yø'Þ¨®ìÊû’Å +^]Ú8Šªížˆm>¦Ã§qŽuí8"!µ²\cŸ«byÚ5Å6K£ûêe@Ç@ðø82ÄX!¤çóAãDŠˆØwÅÙÃÒ ŒÒï]Ë;²ŒÕ”뢬Ç0Ó¹³…"TÑÐI…ê0ƒ~Ú€öœµÇrŸu•”c”u:oˆœikþ2<…«Ê4/LO&Òòê-³RÍ€ ñKaJÌ ë±­è¹êmŸZ—¹˜ð\YM–&ÙaÙÇ}Tã£ï ðå¶à’Ãþ1€Ægg%±•‡¢ãvXøl‹Þü`„Í/9JÈØ3ÔvµÍ¶Ì7/¹?âñM Tm¨Ÿ`µ`ñû"öéX/m—ozfç9—žahH•`ÊGy_²ÀU»Ÿ»0˵¯ÕIŸF6?ŒAéP†ùaÒç‡SÉ7"o6HíÉá¨cX¼x©á‹“Ñ°vB€F~<’NŽ‡ëC:’ȯ"H,¤L]Îa¶¦ÏlÒÙ²KÄ5 h2.¬:þ±¿ TâŒáDÒe± ë칺v> endobj -4641 0 obj << -/Type /XObject -/Subtype /Image -/Width 164 -/Height 349 -/BitsPerComponent 8 -/ColorSpace /DeviceRGB -/Length 6345 -/Filter /FlateDecode ->> -stream -xÚí{l×Çm•ºmT/[[m}ZU”‘Lf,ºÄ\Ic2A³U·ª–¡«ËP1ea4›„T¦H°#)mÊR÷)·ÒšÞKéÅï'9yò}.ߧ­Ë·}Þï?šó|¾ç|Îåunßç<}¾/_REQEQEQEQEYW ©«Æ²þÕbÕ4Ö©¥æ°æZÖ²DÖdMÖdMÖdM‘5EÖYSdM‘5EÖÆe6Sþ×RÇ7ÑPMöIÖdMÖM¨ãóçÏ_KCÕÕÕ½xñ¢U²Þ¢££=<|x»W²ÙlÆÊÊʉ'ÂàAƒÔ¬ããã;wîÜ·oßëׯë•J3Žf© - - -BCCñQXXXRR’²¡®]»øõ×_KšË–-óññAi£¢¢>|¨ÌtäÈ‘ø‹O:d\‘ʹ{÷nP)å§ ÙÙÙ°K‚hO\æææ*£icbb`\³fMYY™š5rüí·ß7nœA©4ã¨Kµ|ùr\®X±¢ªª -Ýõã?–NÎ;×­[7t|$"÷Ýw°£¾éééLš4I™éåË—³²²èÝ»·qEZ(kÊËËðôôö’’Ô1<<¼S§N°»¸¸;.ãâârrr¤M#Œ=Ò›ÃEŽ]»vuX*G¯T€ŽË'Ož¨tìØSÖÅ‹¥=((öšššêêjºtéb—)æp\]]+ÒrY×××#ЦMaÇä&ðÝ¿_™cZZæC\º¹¹?~ÜÀˆ0,ƒz¬EŽˆæ°T2Ž^©0¥Ë¼ìœ@íÛ·¿pá‚´£Žš‹è…õ*ÒrY#dÂŽå —bãÎñÖ­[°tèÐÁÀˆ)—zÍ(rĨqX*G¯Tb¨bœªLŸ>pQ¯¢¢"¹âÃþôéS“H½Š´PÖh¥uëÖ!€R؃ƒƒÅâ…qªÎñÌ™3°`™60bÄ%†üÕ«WÕ͈ÕSä¨ùÄ^½R!Âû÷ïÇô‹.÷駟*êðáÃèÆ llù`ß»w/.óóó?ÿüscÖzi¡¬###1d°žSØ9‚½(ÄñãÇ+sÄÊ(¶ÁC‡ÍËË30boŒ…vì÷ìš³"†r”[&»RiÆÑ+–ã=zôéÓÙáïªU«ì -;4//¯Ù³g#\[[›˜˜ˆ©‘GŒ‘ššjÌZ¯"-woé2øRÌ{¤¼»ÎûáYSdM‘5EÖdMÖdíT¬­µ >ï<¬[èDAÖdÝŠY?þ|îܹ]ºt - -Ú´i,Ïž=›9sæ{¯4{öìšš™vÏž=aaaîîîýúõËÎÎ~©úç}³GâñS§NÙµ­¦èìÙ³ƒ†ÑÛÛ{Ê”)êÂëEÐËnñâÅžžžÝºuKMM?~×®]>pà€Œ™™9dȤ3fLII‰±Cƒ~"/5KX__ïëë ŸcÇŽ•åâ Åf³!¾qõ_ë¥K—Λ7¯´´ôÎ;“'O†%66výúõÕÕÕUUUIIIh1™6&&&??ÝcÛ¶máááÆdãƽzõR³ÖôÓ½{w4>ŒøhíÚµj‡ÆÔÙ!NEEÅÁƒ]\\DøСCʨ]aa!¢“Ϙ1ÃØ¡Öš%D`õêÕha´'šzêÔ©2U\\œDoP»×Å:  ¸¸Xiñ÷÷GÁD½]žÿ*¢'Èg Šæ’(YkúAÏÇTŽ/;9Œ ™Òˆ°|bDYŒòòrc‡fXk–088¸¬¬L„As‹¦ƒÚ½.ÖhjL2vù>’O›èUÐÎ~÷î], -h=ñx€q|yyôèÑÈÈHäÞ¿ÿÇ« ¯Áavza¥õ•ÕÔsh†µf íeQ÷F‡Õ]¬?üðÃÇ+-~~~²w¡b˜;d­ì-¡¡¡‰‰‰yyy˜.0#™g-„‰.--ÍËËK¯ -vfg†uee¥œ¾ô*…ÉAù˜±qàY~ü¸:NuuõºuëÀuê”L˜’’‚Úµk7zôè’’a?{öìàÁƒÙÛÛ{Ê”)‰(ïŒíÙ³',, iûõë—­ŒpñâÅ>}úˆûä/^¼ - -úý÷ßÕM¡ü¯œgϞ͜9ó½Wš={vMM Y¯]»¶¢¢âàÁƒ..."|èС^½zÙÅD[mܸQÚÅ uaaauuõ’%Kf̘!ìÝ»wÏÌÌ”üü|xk똘¤BÚmÛ¶…‡‡ÛEزeËÖ­[رcGll¬Cψ³~ýz¯ªª*)) ]š¬%JyXŒ°>^í[…}ûöIÜ .LNN~úô)V®×fXgddØl6̇={ö\½zµÁðáñ Ç~;!!YاOŸ &Ìjþ~6ØØl#BHHˆxPÐ ëK—.a†A×BÓŠ„ gß 0oà{÷á­æv5YSdM‘5EÖdÍ’´â Y“5Y“µ3—Dï¸YïÌÚø°233‡ ‚´cÆŒQžvi:4è'òR³„õõõñññ¾¾¾ð9vìØ'OžÈT{÷îµÙlˆÿÒÄaº¥X7«Ï¬»!))©°° 7mÚ$µõša­YBV¯^]ZZZUU5oÞ¼©S§ÊTqqq½ÃÃtK±vxܬyf­wØ­,Lyy¹<ÔÖsh†µf ƒƒƒËÊÊDdÅ pµ‡µ³kÍãf3gÖša¥±¡¡Aë94ÃZ³„ð¬|âHó Š—&Ó-¸7³;n6sfíuee¥|DÏ¡RzçÚš%„gñÞ3›CƒÃtK±ÖÝ(Ÿˆ¯ù¾ø½¡·¨Qæq¿ÑWQ½é×åQN‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚› -‚ûܹsmÜ|ðÀR¸ Ú -*++›¼Ý+Ùl6Ùµ–-[†ì`ŒŠŠzøð¡2áž={BCCÛ´i£—œ¬›ÃúòåËYYYôîÝ[gÎœ9'''¯]»o¿ýÖ8eÔÎÍÍUFþî»ï`ܽ{wzz:“&MÒ¼©¨—œ¬›Ãúå«W`!€!¬ŽSRRâååÕ¿ÿ°°0___ÍÇQôXwîÜḸ¸œœ9((Æšššêêjºté¢Lxýúu |ƒädÝLÖahÑ¢E‚¹×a.ÊpZZZ`` ˜ù?.Œ˜Ÿ5o)«‹ª™œ¬õôþûï#ÇÚÚZq‰€z(‡Å¸îׯ_DD„··wii©:Lˆ___¯YÇ[·nÁÒ¡Cqéïï˧OŸšl»äd­§èèhä(¸„Ñ1bDjjª^ãh&'kcýóÏ?{_I‰je¬)²¦Èš"kŠ¬Éš¬Éš­DÖYSdM‘5Õ²Xß»wÏÓÓ³ù½.?¯·‰ÈZ©~øaúôéÍo1‡~Èú³E´;wîLžÊ``\¾|ùöíÛرcG§N’’’Þ¹sg\\œˆ°aÆE‹cÛpþüy²VjàÀ'Nœáàà`ùè&u·nÝ4Y 1 ü(ã?~ü£L/pc`Š0f’ÔÔT»·Õi/\¸ žûÅt±eË–ÈÈH„Ñ—ä³¾6›í¿ÿþã®ÖÍ›7?øàñœÞKÕS—’…777™DÓ2~]]xغ{÷.&ÿˆˆÐ¿z)ìG5¸íß¿ÿáÇ ŒÐG}TYYÙ³gOd‡^ŸQQQòSä…iœ¬ÕÂܨ|ÞM÷èÑ#MWJ¸~ø!F«e¾˜üüüD844‹i^^¦LÎvÅÑ––æååelŒ]µj•xì='!!aÁ‚òSô"Ìd­Vxxø™3gä%Ú {*ÐÁb‡YqܸqréÜ·oŸÄÅÍ‹õúÁƒbM·ó#þû4¬ßÿý„ „ß¾1ÏÃ^TT„EVoëÖ­ØÚ!Slã±ß30Š=[ÇŽÿüóO„± #ü÷ßËOgÎœyòäIãû -²º~ý:²rÆÃ| Xµ1ÁbbÜ¿¿°gdd`ÿìêê*Vpì¸ð=ú½÷Þ LNNVû?70¶Ðè?›ÒÖSL˘± ”Ń7ÄÄô‹E?++ËÀ(vÚaaabÿ!!!Ê9=püøñÈeÛ¼y3Y a&TÎ~M–ÚïÍ:k¬žçÎk~1Ô~ÈÚiï›QdM‘5EÖ”5Y;7k~ ßDõ|:kõÙ¿FÏòTÅÎyQQQttôûï¿ß±cÇ/¾øâÇ4¶“µó³þòË/•o2‘Î?ýôÓ•+W–””TUU8qBþ{µžÝʬŸ={6sæÌ÷^ cGÞIÿŸn³ÙÜÝÝÍ$QŸq‹· ………ÁC¿~ý²³³ErÍ#rãñÑÍ›7‡ &oÍÉz!2Ê£®—žÝÎmffæ!CP’1cÆ8µ—¯ƒPö(3T6ˆÉ÷æ³FŽrbÄä#š šL¢wiòˆ\3íO?ý4gÎud”çƘä`1¶«sDL‡‡ìêS{|„Q|ûöm¥Ñd• bæÀ½ù¬ýüüä:…Nˆ1ë°å ’(›B¯jGäY×ÕÕÞD‡1ˆ%Ò¼]餲²RNPz‡ìêS{|túôé””¹øš¯ ¼4yàÞ|Ö .LNNÆ„YÅ`ñ5“ÄîŒ[¯jzGäfX¿|u`Ý”´Œ5 -Ûl”°~þùçñãÇÛíÜæääÔÖÖhzzú´iÓ„]ï]}j/?š5kÖüѨ -ÊK“îotÞØ$vgÜzUÓ;"7ÉÂæVZ°wúä“OÚ·oÂ|õÕWrÂѳÛM¶èò(ðŠ+ä õÙíNí•Coùì³Ï¶lÙb¾‚òÒä;ï‘ò)Y“5EÖYS-‹5ƒ²uÈ kª5éÿÎM*endstream -endobj -4651 0 obj << -/D [4649 0 R /XYZ 85.039 786.531 null] +4810 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [432.084 661.2 492.961 672.89] +/Subtype /Link +/A << /S /GoTo /D (passdbtech) >> >> endobj -4652 0 obj << -/D [4649 0 R /XYZ 85.039 763.817 null] +4808 0 obj << +/D [4806 0 R /XYZ 85.039 786.531 null] >> endobj -4653 0 obj << -/D [4649 0 R /XYZ 85.039 763.817 null] +630 0 obj << +/D [4806 0 R /XYZ 85.039 766.606 null] >> endobj -4654 0 obj << -/D [4649 0 R /XYZ 327.216 466.8 null] +4809 0 obj << +/D [4806 0 R /XYZ 85.039 746.277 null] >> endobj -4648 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im6 4641 0 R /Im1 4096 0 R >> -/ProcSet [ /PDF /Text /ImageC ] +634 0 obj << +/D [4806 0 R /XYZ 85.039 359.41 null] >> endobj -4657 0 obj << -/Length 2891 +4811 0 obj << +/D [4806 0 R /XYZ 85.039 326.988 null] +>> endobj +4805 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F59 3455 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4818 0 obj << +/Length 3156 /Filter /FlateDecode >> stream -xÚ­ÙrÛFò]_Á·€U&„ûx”%9ËTtĤãl%y€HˆÄhÔñ÷ÛÇÌ``*I¹Êº{ºgúîì‰ÿìIä›–OÂ(0}מ¬vÖd˜/lA1$3æãòâò“LlËŒ­x²|V|bËôã`²\ÿn\ÿçêqyûy:s]×°ms: Ãȸš:‘q}ýðå~‰ϘßBÐÃ绩 ØÈ5–ó‡{ÆÝ `ž±DÄÕÇé h@x»˜þ¹üéâv©ö©Äv]Üå÷‹ßÿ´&k8ÑO–éÆÑäž-ÓŽãÉîÂó]Ó÷\ñž_,.~Q¼çMxUŸR$Å̵Ì(òÆçûfà…Jqž­)ζlӳ܉$BÍýaÙa÷x¶˜‘M4f'%͉DÛ×%ÚŽéÚΑįYJ]—¨ïך•ïX–ÅÆ{¬Êg@§¨ýºÎÊ"ɇ´ïD –x\-͈:ÑYuŒlÕёدMâ€:ÞX‹´zALZ]^­îeêûF‚+V¨¡tÝ%RžÕו"QÓœÕÔ°´VQÇâúõÔŠëSÓoÂgn“Öä4à3ðÎn3™9¡é„.ÅŽ±^å9¬‹cu¨*ék2n®€yšÏ”áà™ô{—­ª².Ÿù³ ¥‹Ëëù§…àg)ó¬@Œ@¹ßOaWFY‰åÉ¡Ùvva™7i2x†óáK–ðC³M¥äüp½Mòػʹò´Ø¤—Ÿ9šPndvÔ©°#ì -%o“"“Øc׬ÕU…ˆ'â@N‡Ôr×J_w=Ï1nÉO9™lÃÄtž\&BC£¡··†ßN5‘IG×4›*I…|,e#p¨½¤§=úü]ôþ”åÈ´AIï # {þ]kI~oJ¦Ù'xî&[eû¤I–ü+Ž 6tïû†ôÈÎ1cäç+ T_dó¢f½$x–¸(6x§¼ñõ‘r$àžú÷Û£€’C¦H7e“ñ¾!’ҬѬI{xÏ:¼5é[ÓvcË›Z¡œ¯‚.Eb_ œ V3×iVpéCVDxžò$á9TÉø_Ú–àuf_^hFõ}¥ÅªzG²%×­N9£Ô¯SÊS…ÛRV_“K“³—8fx”Ƭ˜MxÆ â“Œè…öqÖñBËxEaÈsVÉ -%cÁ×F>ôz¬t‰5ÓoRI% 9d‘‚GPŸ¾v3n­õ'’+)0öx×=þ›TÈ΋Œ*Q+’'dœ®? Œ„ªÄ,»Ù2ôkb(A!{ÜS¹§|Fþ•Á6YÝTï V™eCH%¢e©Ê‹:§@¿Æ!Ò,²¸¿…ç_¡y==­2Ö4ëÛ1´¦ÀjK¼ÆEòNDNGH³M0Oø'#¿Ub‰œ[•ÓˆD.J˜®'¡ì(öþIÈC¨Œ)=7Y©m Þ–‡\ø5P‹šÁ‹vbkUfVe¡d­d°œjâË·ž¨Ì£ÍKo¸ j´ –ŠüŸ”},±×„‹æ_Ä#¯ݲ; UZt" -(ÅY^­eu†4”«ùQÛXÅu•|µZÉÕäÒª•ãӈŠ4\®Ð7c’¾ø8<Š*E妫ëŠës(nNÜêŸ+®¡å¡R-%#j¿/J᢮¾ª™’*/-9P|µÝ O!²èO„µÜŸØC‚ÊiÄa”“9Œ®n_3jï £â‘(kQF…I2Ò2·çšPý`=.ü²@Ú[öÚXò‰oï~ €ÏSˆþÿ>âëçÂ&xDðÕ‚–} :xºY0vñ¸X~ž:¾ñpÿ#À~&fŒ¸ºAø¯óÅí9ÐÀûŽeV0ÚÁk4T¥ëtjöbДщaPvLØŠmâÄ .ó/Úè%)šdƒöuƒ{¢ €®-Ù¨±@S×B;’ᱜºä%dËþsx±mºQïL ftÓrÜÑCz~lº7>§H¢sƒŠÆlxRéJìUt‰˜þDëÉWôon<ìüˆ¤‡Ë¸¡…‡}R×í¬a6Ãx(k±B¥wx.R™¯CÊ×Ü’–±€Ô š©µêÌQ¢×YJÀºÈ(íT½Å©{tÿ»CÝp3©…j5Úøˆ1nSrÏ#:Í’¡˜Ç¶¢=Å[uà¹?1áAÎŽdë6ìS-͈O ¢³>5"°õ©ŽÄ~ŸÒ$ê>%ÚqÖ¬ðŽ¶i"°p#j\) S7e%o ’‚Ç› Z·cCr)Œ{Œ]‰}¾—bB(ž'®oCp!â;5€F3lItÎc•º{  Kävo©rU—X?p|#-•É6M’c(fèâNì“‹#<áWáѪêÉV¯†] µ×ï¿]@Äà$ŠHtÕ݈†ŒšÛ˜‹Ã@9ÅêÙÿUú|Я˜c7„ž¯â5bçª%z+jÙãÈy3äŽøYÐÉÐ'Òcåi͸$¯K~¢ÂÈC­sÍÓVPΠƯÕÑðLv¬ßµv›áã8Þð:ÑX ü¢†1¡G%¥»ªÜí›6±yZžöVq#ŸeP52çu[9ØÅdÀoÇ=wãõºÍ¸û1-rîqî|g`B\ÈnïΠ0ŸÆr›žvYÐmËu¸g®'‚÷;íøÀ8¨"K”z~wùøM¹—,äPƒ›Ã*MP”›ám'×·ß¹ù¢h09®…Îx6jiF²‘ :›F¶Ù¨#±?ioGFõs7 ý7‘Xòüè~Uôß»ön% -‰,ªÌàL¥êþÑ8Á#²¯zú÷zÈN{Ì0ÿØ¡Ñ ÛI³Ó˜@e§®Ä^;éÿž¤þµb,>ˆð‡ºMr‘>ÐçEy¼¹¾üxs͈’MœV‰H ƒú¡×ˆÆ¿Êi4ƒó…ã{&Øáx¼pþÂxQ`j³& |–w¦@EÙ“!O–Q NŽï˜Nÿý Ã1Ê Îtƒ’è¬[µÌFܪ#±ß­4‰ÿF7ÈʾékæÇ7YD°Y\1rûñIU^QuüZdlÉgéÿ’‹M亡 ã©Œ7‹Í°}$Ñ9ûŒ TöéJìµ.ñK­¾M`ºLv£EöçÑ%¦{±¬<¹“Ç|L_hÞä,T½d«V”–ÛÛöÀU ór£ÙE“G³2H˜V8nE2b¦9kai­1ŽÅõÛ¢G¦ðl›g[µ"äXÁrv¢JD$‚ Is˜†ŠÄV¤¸C„wè½:ËkÕ±ˆ%Úý1q}kZx÷úQìNthí%¡Í×ø'=lPÄo]ê³3‰oo䨽ët¢úЭ®kqÕ͘¯ñÏS&ÆùušäƒÁîú¦íŽ×xFÕÛŒñˆªæØVl†þñ•ß2î’ý^uáPHÀ*~‹¹5+„j)E!µä5W¤'ø×Ë ž4-xé¸ÓƒG ×tíõ*£Vrh¡´ûùoC‡·BÓ;wø–æÔ×å—}FT6ø­ð l˃¶öËîƒ[BQå\Þ~¸þ™,?¼1‰êæ¾£‰³ŠëµO´6fŸl-›‘ËZ$÷†_æ7\R€M{cˆŒˆÏ§ð®ôë~÷²û¥wêí—øù7–:÷ï[š'à©J¿ð|UûÁX\{Yäår ÄsªH惧$ž -óÁL.’.xJøu¯æà—Œ>¤£Dí‹ -viRœêã`ñN÷\ÜpÁ¿wCŽ‘â¹nß#†Ôô—JíuYdÆÑÀ°â;Ð}Ùj3’NwǾ™~äölùÿ=Üwendstream +xÚ¥ÙnÛHòÝ_!ìK(ÀbØdóztâdÖƒ3±‚ 03”DIS¤‡¤Ö6°¿uu“”¨Ìb=°êî꺫ZjæÁOÍ’Ðõ‚t'‘j¶>\y³Ìüt¥›i׋Bœz³¼zý>ŒfÊsS/-·²Üüæ¼ýçÍ/Ëw_æ‹ ¥Üù"Žçfî'ÎÛ·Ÿ¿~ZâŒvî>½Ç¡Ï_>ÎÌ&³¼ûü‰çnqÆ´³Ä‰›7óÀÜà»ûùËŸ¯Þ-8-´«£‘úëê·?¼ÙðþùÊsƒ4™=AÛsUšÎW: ÜPÒ/¯î¯~µ»ðœžñª‰«/´¹~ Às“D[¨p‚÷Ù¯°ÊÁ|¡åì÷¬åvÆŸ +†r¼Øö='«6Ü Ág˜í¨…p›\æ>ibçæî0u@˜Gh”95ó +Oî²®¨+†êèðŽOmÌ©AãXخථ«ß=¥wGo`øð6ðÝ"é‘Þ +i•ÒE??΀Eô³ð Tè<p6µ2þTù6"g[7wÄ ç,͸ÛâÜGö|±ÌE<g¹Ïÿ~³vt‚•ƒà¥ˆFÜ-ZùÂXµ.C† //ª‰»sœxý>r]%nœ$Âúü9;<–yûúÃ-€G"'.4vƒç7ùOîè/¬@kRŸ†èº0†â$ŠÕœ„ñ‚H… MSGb½r\ºÃ"Ü$NfÀ&8˜oÂ$Ô©½\:q +¼ÁA˜ŠÒDD…Àm±Ãý $ê:cˆò…—²ð¢<¢<“\¡ghGm1Z‚÷­KÞ2[%nÙùp±¦ŸpmÝæ,w5]}1Á¬¶X!³ý4)ôÓˆÔ¤)€ÐÔûw¿)# +çáZ^‡LÀï áI }ç®ãÙB qa@OÜ7ò¾+>œéjþ¶ÝYÛÆêwhœÔÏck‘ü‡ìM¤Cò›=¤#…­víõEö5r4Hbš‘ØÕ•s ó)0ƒfÖõQ˜‹"¤QlyŒFFÜmƒ-HB‡hwd]æ…¤«µ5>@ÒÈ œ·u#TÓ#¸¶EG‘ Ë’—ómÂÊE…]hå³u±ªƒ#Kô/´Lш5ÒÐ.‹¶7¿Æ4h¥ˆ{ôÝç`=©Ùä­ídƒßEaÐFQƒh–‘‚™G¼ð,;Á1YYÖ8ÿÄ»îšHÓL tuîк9ß›ps‡—vŽžÆ›´HÈ Bkz_îýÀÝa† èÆ‚Ø­æ:« μbÐÿœâªR妾ϘL!œôŤ¨AÊŠ +ßüy¨wá­®ÅÚ„3ÒãkÏÁîƒnð+‘¾.½¿ùÈ'ÒwT÷’÷Y™Ó°3¶9/l¡U !‰§GìExDÁ*³E]£[¢/,ê‚¢6VH›t)LÑKŠg@ˆMF|•µ²èÚð@Ø°šjÔ/9E=žGªÀ‡(1¡ê«–U‰/‰ëV¾´W|üCOÁÑÈ-´Ù&‰ÒÞ.oE7{ÕØ`Á`obu±ÛÏý”‘ú€øQÌ„ + »žcØ$Œ†¡ó§:cSb BVír9Õиà¹Åºã T.Q8ØpšÈ&òù€]ö&íÁ‘•ëy†9õ#Š²$na/1ب’ ‰ä%Ïs€ Ôj«Ë¡¡dÓÇò£m‘Bg• Ú§¿cÎ5©å‰šc“ð(ÔñH˜Éé$ÎÃñѨù*ÏùÊn)?ƒF‰=—ϱrÂit.ʆFJI 4abK„M£cÔóƒ±ÉYâé°%½Ðsªáhai+ÛgU͹ÚThf.nI+V•´fhÐÎ]…a ¥\ŸËçUÈY]ø#¯¤Ý\ØÀòãHpHž–ó8¹ÞWÅš¬ø¥;¼Ñ–30kt[ÁgêÈDX}ßÙ|.1:Jµó/¤5僆c’eiò²0úÅT•9–¸J6¡"G†JŠ½.îd<ã$‹D·n6&ƒ ù°aÈÅ+M`—b…¢É%¡;˯qÓ[ASìEnëf»Üh®»IBh*âYIÐ2Wëæ×A³›  ´CÙ@fÖµ-údÍ0ð9Ye¬ÕöÁ=µà“OÝÌÐ~ýt÷Gm&J½ é„D•§–‘où)§P3Ù 1 d76 À<¯Ë"·LÇv¤"°ª'-Ñ„Á×[Æ`«­)HÙ.sÙãCVÈ÷†RB›ª‘ðÝg­°Q¢/Hàßí§œ4Êøzíc,#Yc†Áç“EÓÚö²‹=–]3~TaÁyT§A°Jè(•Úú’â <§ÊØQlä;¹¶)Éc7ŒÏÎP¼(Ðœíƒ5½kjE‚ŒÓíõ{=ML©‹‹G]?=&ÍÆøkG´YeÞ¶Fú)#Ç™&ßANмŒ£Š—±AÞ\péF©ƒ0½Ä&ž4nZ9¯õ08œæÉ8óˆ²8ø¢¢-¸ˆ@Ö¡”@¦Ùƒ‹¦­ûVÈ7l¯2ælF>ÝgÒäZz2•Ã*°~t%,ßØ0ûIoQ Ýv¬RYƒ8ù^A¿.mxÀFì£Dúš7c9‚M V´dŸ ih¨Íùì®ýX‚hX…‡¶Ý’´ªP½ ´õ +ÛÙüiÙô–1çzW>%Awxx€%à@ƒc‡Hl2|7X? òÆho*EÔè‚Zr¾\d8Ò/V—\má+ ¬ pš‘ ܺSVOÄ–ƒª(ü±ÌÄ)R¬ù^f¯¥ƒ_“laÛx,ís*˜p"™ˆãA ‘áÔIPŠL‘ç¼Çd£…`RŒ¿æDP(ö`6ëäÃP[°³eC<Øz<Üîá…_¸SÖ»º:×™-BÂkI±uLÙ=dzkI`M°¯#gRÈp•]> Â+ÁVc-¸$½8RÈ SVàÂ"œÓÖ<+O‹H6xzA&ïš"ï –ìg‹¸Ë™ä\`=¿´Ä1‚]ó¶„ï0öj6šÁl"©R*výX›dTÓÏЧ’Öº–ó+ñ]Ï.‘G¤·\A;ÔéF&„VQö.˜9-–±žÀ2c + m¾€œ×¼nàßT(ÿÙä°i +ñy2¢Õó AI›}1]Ѩ¦å²ÕfaoxzTPÇÙ¢ÚJy-ìÖ×͆xÐfSIôº“Ñ-'s'¯]§\04BÏö°rÁÃm§RÛÔÓPàÀ#gd«8Äl0uÂà(q cþÅ´J]•œæUX®C7ò•Ý¥áÐïÞ弋 ÌÙ»˜ö¯¤m]ûWPÏ“€Îsîïn[†¥J=Œ|µ#…|¹"²é—§Ù’˜…kË»FjÒr”y¼ÃzªÇàìY*ż<‡Ïæ Ô']Ýž½I +$ýÅVj±\Ý]‘únL +JHZKŽí†â±ŠŸ d’Ï@b¤Ê€j6áè%inŠ‘Y/œî›JH«Ò¼–†`‰Ù¨R. }¤ÌÝík`ˆ Ʊ\]ÚÇÑs£úÖøÙNÊW÷‡ü4MA”‚E $“tžjv3n|ùé;iòû‚ßÛ%ªÀÿL(Gn¢’éÒoçGWúÍXU†{úÊõUÀ cÿÁøòžSõøÄU¾?[„Êãhºö!<ü±ñж|—ŠJEçUy ÚøžÿX –éendstream endobj -4656 0 obj << +4817 0 obj << /Type /Page -/Contents 4657 0 R -/Resources 4655 0 R +/Contents 4818 0 R +/Resources 4816 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4640 0 R +/Parent 4812 0 R +/Annots [ 4820 0 R 4821 0 R ] >> endobj -4658 0 obj << -/D [4656 0 R /XYZ 85.039 786.531 null] +4820 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [159.68 84.092 215.49 95.781] +/Subtype /Link +/A << /S /GoTo /D (idmap-sid2uid) >> >> endobj -618 0 obj << -/D [4656 0 R /XYZ 85.039 520.606 null] +4821 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [238.346 84.092 294.157 95.781] +/Subtype /Link +/A << /S /GoTo /D (idmap-uid2sid) >> >> endobj -4659 0 obj << -/D [4656 0 R /XYZ 85.039 484.341 null] +4819 0 obj << +/D [4817 0 R /XYZ 85.039 786.531 null] >> endobj -622 0 obj << -/D [4656 0 R /XYZ 85.039 278.781 null] +638 0 obj << +/D [4817 0 R /XYZ 85.039 427.576 null] >> endobj -4660 0 obj << -/D [4656 0 R /XYZ 85.039 245.243 null] +4813 0 obj << +/D [4817 0 R /XYZ 85.039 385.291 null] >> endobj -626 0 obj << -/D [4656 0 R /XYZ 85.039 135.134 null] +4816 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F62 4159 0 R /F58 3380 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -4661 0 obj << -/D [4656 0 R /XYZ 85.039 100.388 null] +4826 0 obj << +/Length 2345 +/Filter /FlateDecode +>> +stream +xÚÕYYoÛH~÷¯öe) fxyYäÜõ`ìdbÙA’J¤%Âé­8þ÷[_U5­ƒ 0/;0ànvUWWu’ògýù³,v½0Ÿ¥YâÆ¡?[mϼٚ(ÿ>ó•Ã›E®—Ä ½Zœ='3ßss/Ÿ-n˜eQ~q^ÿçå‡ÅÛóó0 ßwççiš9/çAæ¼~ýþÓÕ”ȹ¸z‡¥÷/ç>Q³ÐY\¼¿ÚPh-r ¼|5?'žkb|{=ÿ¶øåìíbO§óÈ’J}?ûòÍ›•¤÷/gžæÙìžæžëçùl{Å¡G¡>7g×g¿R„Íd×ÄÕÏ-Çyà¹iœ—æ©žGJûnžS'Å©úΡýû 'Œn“Æ`™}§cb^·#ë—…ðy©]|~±Mfo:Rf¶w}¹÷y@GúÁÔ¡vd»'Á„ÝßÕë]_‘36»C=çÇ{¬Iàzð¿8¶d’¹I–‹–ÇÈ°Ç]¼¹|ù<â…8ÚÇ +>2tÍÎÔ´Úµ²ÜÝÈx}ñfß2 Êô-ºÇZøiFćjœxCb)yƒO‘&ÓÁrªþ_sLxJîæAüÄ&ÎLj h™<+Ž÷¡¢•À¥k#ãØs.h¾½# €ýë °+ZÂ$u®:S 2}¹®’®«Õ®¯ 6=L"Ý÷IECßÍüGE'mºØƒ(q>]]üWfEKÊ–2G¸|%ó;šÛü~¤N×?òUíªƒ©áA;¦Zkiõ÷ý‘ ?T[}ÂC½­ÑËÚ(Çj8ìpàM±â­läǤm%bB‹’£Åö‚©s¾m=<£mIèlØ%‰‹oRýÀ”Åb¿òtмy ‡0u†ÛºÅ,qʪºC†‘*iÇFn&ÁÙAYAêw9D3U¯Šf^µå ÓUS½©~yœÆ\yùûª³~Àkïæ1_¼­Ìx[–qKÞ•ÎýÆÚÑ›Ò}»õºÆÅ×ÂÀsvâ\±æU—P¯É•¬Z§ÁüÈ1pÄ ~Qm•½åóå½²0dm9ç)˜ŒþЩyïŠÁÂTÂ=²}ˆŸ“ µͧPÁ:®…øƒ„ZÇ’2Ä ÂÂÞTYÁ:ñÙ±d[]ÝŒ–!WÌc +ºfgE'>±ž+·ð7Ï#„á8ÊfÇ¢º ,–E)–‹¢Àù¼‘ˆða!t^Qp"íì@7Hfšà!ÁB—Èåxš¾e \"&Ug2b.z•UÈðÕ#X»î¡[ ”êûw}”¡I<¨î?ä¿£3év²gU´pÍÎÈcYõµ†Â)Öæa8»¡êÿ cߙІVoˆ¹ï¶ò`4~Ÿá1v–ÌŒ¤™­º]Û= +Xx ¥sÑ×’8¥vdUd„^ÏE‚ˆBùXq:X²þêùÑ>è8·©õÕ¨“q]¬SŠ½lNcÞ¤l#<cê4´d8<Õ!Bªj¦·ò U +slÒ¼,L1PîaÇr­ˆ¹ßæ ”‰^êäl)8mï]^¢MÜŠÈbÔ ÚÁ?‚AÇ›®7@¦¥Œ2ut®ä´YÆÔ±u k…40(ŒÝKœ)ºëºØιPû ñ(G»j>WcWï+½á¶ÝÑtyкQ”hnî¶ð¦^j¤¢rt?4†7v„˜³Vƒ‘º:È"òÉgV¤”\?ˆÐ«Å3a˜"Þt*þ3íúÛuÏþgm€½9u?ìÛåA&¬œÿ|~Y!M9ÿ±Až;ø°‚‘^H1Éèe­ÿQ¯*YýV›f™ +AÞ 8¨×¶œƒlaOÉ”™‚««‘eÉ †ûŠv­kŒwì0û9/{2çåÒ£ñy£ãŽz‚tã;Š²ý‚k5 +£Ô¶ï¶3‰¦^U°:5u_5Ù4K»]·°06ü±_CŸ¥X‘"/•R…ü=Ìã›ÈØBEÉT ˆ °iEïµ ˆ8öO£*ëÑ’ 5ã¸]ÊNƒeùRƒ´®Ó?è®Î®B›óªÍÀÉÛ&³À¦2ðN›ÕŸÌÝür¡»íšfTé1ôÇ°±}¡¾Mã%¿µÚŽ°cÆîFÀý$D©É•Û3¹•”¦ ` ªÈÚ‘vÌUv[ÉÞDÐz¸Û¹g‚5é’W]C¯÷mo³×Nì—P|Qá…m¡2ñ@oÀz'‘¤_® +¡–êýZ[°$Žþƒ›Þ®Ýªß¿˜øXCÍ•›L~ô7LôË"¬‰ü‰5TïÓc±ø$yôélâkåÓ€.¯åoHý÷:¿’,£%¾u+„ƒz‘ø€Î½DáQ,ǶPÛz,N~Š õ~¿³¯{mTw/bëv0ÔTåÉD8z†êðùÿÀÇa»æ±\éÞbc¡ PRø§!²øìÆ”5fJœÅÇÌ?`ö70“;¹®ìKÁØ!¿etø{“ï|ûû;ËeõwÝ> endobj -4655 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R >> -/ProcSet [ /PDF /Text ] +4814 0 obj << +/Type /XObject +/Subtype /Image +/Width 656 +/Height 407 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 20725 +/Filter /FlateDecode +>> +stream +xÚí{\Ž÷ÿÇ×Ò‰¨¨tŽ1§ÑÁ9•dÎ-‡¶6C4L¢/¢B'ä¸ÉW›1µM1¥è@sØhÊD¤2s®T~ïÇ>ïõ¸~wÝwwuww^Ï?z\§>÷u}®ëú}*_{>kÖ,Ö0.w{4ŠŒŒ Rž®®nii©Üí|UUUß¾}iÿW­Z…S @Q©­­upp ß…††Êé!œ={VEEEKK«¤¤'€BräÈ’µ©©é‹/ä÷(¦L™BG±hÑ"œP + 3݆ äú(.]ºDGahhXUU…s +@Áxüø±¦¦¦ššÚ½{÷äýXØû퉉‰8­ŒØØXrœ›››˺uëèX¦OŸŽÓ +@Á˜?>9.**ªùIUWWoݺÕÞÞ^[[[EEEGG§W¯^dÏŠŠ +¶ÁÛo¿M¿ÅŸfPtojjêéé™’’ÒœÈÉÉ¡Ôºuë†Ó +@Á`o†gdd4?©€€JÊÃÃã—_~¡ããヂ‚ìììž={&ÌקOŸÎÌÌcÆŒ¡ô}}}ÅôuUU•††FïÞ½_’}~]—G±'Úbú:%%….Y²¤É¿ˆç×ɾ^\\\w ¥?räHq|ýäÉ“~ýúikkß¹s§Éû€÷Ã(’ýþZMMm̘1Û&%%effÆÅÅÙÛÛ«¨¨;vL˜¯OÿKjj*ý—••U»víŽ=Úœ}À÷×Rª¤ú7#çzzzvëÖ´Kiêéé¹»»Ÿ:uŠÛ@X¤êêêÖÖÖóæÍ»yófsv€ëßìñãÇ8³ öÞê°þûwïŽÓ +@ÁØ»w¯‚ÏõÉ'Ÿà´P00þ5 L™2…4·aù>ŠK—.ÑQVUUáœP<Ž9B¦355}ñâ…¼×:üýýqB($µµµlìÐÐP9=„³gϪ¨¨hii)@«> Œôôtòµ®®nii©Üí|UUUß¾}iÿW­Z…S @±ñòò"å½óÎ;é;EšÌš5‹ö¼S§Nr·ç@cyöì{¿zøðáõŽ^-ƒÔÖÖ²ïǵµµÿøãœDÊ@ii©¡¡!éÏÜÜüÊ•+2¾·åååNNN´·***ñññ8}”‡¢¢¢wß}—IÐÃÃ#!!áæÍ›ÆÊT¥"11qñâÅššš´Ÿ;v‚¯…ÛÆÆÁ5P Nž<Ù¿ÿ¡C‡ž={VØ6òîëyóæééé]¸p¹»W¯^âøÚÛÛÛØؘ²åÅ‹)))$}¶ŠôM²NJJÊÍÍ=|øpIIÉ›?µ´´¤¿ví[_ e + BìÝ»w#[€¼sõêÕñãÇÛÚÚ8p ¶¶VÄ–rí먪ª.^¼˜[Ò¯_¿}}ëÖ-šˆŠŠâVM˜0¡{÷îlZWW·C‡u¥Œöpd*ÄFp äû÷ïÏŸ?ßÈÈhóæÍ••• n/×¾NOO§ß±cG£|MQ3MXümmmŠ©ÙfÑÑÑjjjqOœ8ñàÁƒ\m¾@Blº=\yçåË—ááᤡÿüç?ÿý·˜ÿ%×¾¦Ý¦ß´i·Dœöðãdzÿ*àqóæMnË;wîÐÚ>}úÐf\ð_ °"KWWÁ5GjjjbccÍÍͧNÊ÷ŽÂûº¼¼\UUuܸqlvÿþýü÷ÍzôèA³UUU4••Åªå4ýèÑ£¶mÛNž>\¸p¡¡¡á† šùR™Ô|½À×4ƒ‚‚‚áÇ7V×hGEEijjÒ?š™™!ÐÒáÕ«Wëׯ'Sûûû———·èo1_gff"ÛVî!€Ü…ÕGŽiB"×®]4h ´gÏž@´µµµ?üðƒ¥¥åûï¿ãÆ )ü"| _ SaõôéÓÅ«ë ´7lØÀÚÉÉÉÈ^ qNŸ>íèèèàà••%µ•__xyyaŸák ïaõ¶mÛ´µµéB566>|ø°D’åÚsæÌyòä ²H +¥===)¬Þ¿¿”_r–__ËãÒßgøÈ27oÞdEññÇK¤O ~ ½~ýzh›››§¤¤ ÃAs(//_´h‘¡¡!]W¯^½’þÀ×ð5­Vùå—«ërõêÕ²@Û××6hQQQdj??¿VB¾†¯~X=bÄvq~ôÑG’ «h R[[ûã?Z[[Oš4éúõë­»3­èëÓ§O<¸]»vêêêyyy|©ôêÕ‹V9;;_¸prŒfGÍjÈl³k×®9::ª©© 0 ''‡ŸÂ¹sçèÞ¤ +<ՈبšÄãÇ©Žmee¥ªªª££ãîî^XX(zê]ngg7vìX¶Aii)UÝ)'Ùì?ÿüC[²‘^¿~akkk``Àô„¯’‡Õ_}õ «»téòË/¿Hí§)Ц²6Ÿ3gÎ 4ÈÞÞ^FºkE_›˜˜Ék¹¹¹‡.))áÛÖÅÅ%&&fÅŠ4=|øp‡={öÒì–-[¸Ízöì¹aÆ„„º÷MMMÙ3¶ª_¿~7nôðð éððp–øíÛ·—,Y’––F?J«¨Ö$zê]þùçŸëêê’Ži:::šJr4ûxä矦í_¾|IÓþþþzzzTÙ`±¯ÒBucª~³kÒÛÛ»¥?V­7Ð^·nhŸ8q'#,,Œ.’ï¿ÿž*™2²K¬UªU|M¾ëС§EfÛôôtš¦¸˜¦I¬!‚ò¢ÔE‹q›ÅÅűÿÚ¾};Ͳo6Ù*Vu§€šþ¥{÷îõÞ¼´Y=DïO½Ë;Fÿ{öìYšvuu?>ÍÆÇÇÓìŒ3&L˜ðæßoè§ ¾ÊFmm-?¬>tèP+îÌŸþÉÚŸ~úéÓ§Oq‚@]¨xg™ìЊ¾¦°”t¦¡¡1qâăr/Æ H¦i 7KÛó}Í-ÏÎΦY +¨ë®²´´¤âfóòò"""|||¦NÊO\ØþÔ»œîq +¨)lgR¦ÀÎÎŽÒ¤…‘‘QLL m“’’BéïÙ³¾«[1¬® •Ã‘‘‘tSÓ.YXX¤¦¦â4Ù§}MܹsgÓ¦M}úô¡}X¼xqs|Mu!šÝ¶m[ÝUì)6›¦Ÿ£UË–-ËÍÍ¥Y ñz÷GØòÁƒ9r×®]={ö¤ÙU«VŸ?ž¶¹wï-ILL¤é½{÷Â×@iÃêíÛ·ëèèÐEعsgªîÊÔî]¹rÅÁÁÚsçÎE  à멬¬¤˜TSS³9¾&oÒì™3gVQe^UUuÈ!l¶}ûöfffüÄë6• ì°å+W®¤iWW×   šýõ×_)5þýû³ ®^½JK–/_ÎfóóóY_‹ð5Pnݺåââ®À?üPÂêz툈Ú¾¯¯ï±cǨŠ»oß>uuõ¾}û6Á×ìÅïââânݺ9;;³Æj¶Š*''gòäÉÜ“eÂÔÔ”ô}èÐ!OOOªù“sYµ_Øþ[ž––Æʢ˗/¿ù÷ixÇŽi–雎ŽŽ´0;;;##ƒöJOO¾ÊVÓ-&³aµè@{Þ¼y´‰%K–¼¥dÃט6mš‰‰ Ý ººº&L(((h‚¯ÕÔÔØ›á~~~Ül»û(|æ?ANOOïÑ£)»OŸ> äqŠyé4‘÷…í°å/_¾lÛ¶­­­-÷¤ÛÛÛ›~ôüùóÜÏQN–·±±IJJB{8P†°š®yvá}ðÁ>”‹ÝæÚ–––T‡¯ákøZ +ÈcW*ð5P€°zÇŽ\XMõa¹;„¼¼<{{{Úœ¯Ù¼ +Oii)| _Ã×@I¸}û6V{yyÉKX]o ÎÚ'Ož„¯ákøºåprr255E +_é„ÕÿýïuuuéJ322âÞ‘køöüùóŸ={ÖB?4qâDú Ö¥Ÿ­[·jjjrOßàkøZQ} àk µ°zäÈ‘ +V×h‡……µmÛ–ÍÊʪ…íÂÂBŠåíì쪫«ù¹ª¥¥‰ø¾®ëë™3g†E¾Ò «8 ‡™››K2eögŸ}ÖvPP¥ÿÕW_q;jÔ¨¾}ûr£À×ð5ß׳fÍZ­ˆÀ×ð5h ŠŠŠÜÜÜØÕ5mÚ´VaP:vhh(hŸ:uJ²é¿xñÂÜÜ\OOﯿþ¢Ù={ö¨ªªÖm!‡¯ák´‡+6ð5xX½sçNVþüóÏJràh0€Ú ,l Ï:k-++Ó××çw®øæßÁ—Ééjjj&&&ÁÁÁ\¿ÖÂF„¯ák_„Õ좚:uªb‡Õu©ªªâmkkk6&‘¤jAì5€þýû“—*äqRÉÙ³g)OIIÑÐÐà6ª | _Ë,^^^u§| $%”˜˜ÖAŸR…Õu¹|ù2?Ð~þü¹D’ýóÏ?)F¦dI¾üå·nÝ¢…QQQÜ’ &p½( U¾†¯eþ×øø¾’åÎ;£Fb×Ò”)Sîß¿¯äBöÚµk%h×[vQÔL ,þ‡¶¶6ÅÔl­°Qákøºu óöö†¯ák Í°ú믿æÂêŸ~ú y´û÷ïO9£ªªêçç×ü@»Þ²ëøñã´pÓ¦Md|ôÑG¬s~[[[:k|+±“uíÚ5GGGZ5`À€œœ¶JØ»”?öõõµ²²¢z2\*£ + ù©Q…–Î8ý—³³sqqñ… ¬­­ivôèÑb^üð5¯°ú›o¾aa5Ýb?þø£ÀgÏžõððèÔ©Ý2&&&3fÌÈÏÏ—BQÜÒ7 h!aøûû÷ìÙS[[›¶××ן6mZjj*h/\¸°É¶°XƒÄGË)“O:EA}rr2÷8[Øèõ²bÅ +J§cÇŽâX»±¾>ý/YYYtÊvìØÑ»woZ¸nݺ–ð5ý9ëèÑ£‘‘‘æææ´déÒ¥u·¡IKK‹¥r›–Ìž=¾–·o߶´´d".))¡[† +ö‰"¹›j¶¾¦jÆ lô®W¯^½þ.%%N'YZNW2ýû¤I“ø©¹¸¸ÄÄÄ°«}øðá{öì ¤Ù-[¶À×@‘¸{÷.UDE„Õ¤rŠî‚“'ORáLµ_--­fŽi%NQÜ¢P&ŽžV®\¹ÿþ‹/^ºt‰¦i]]])Ð^½zu›6mX Ý´U˜¯©ú´wï^ŠY(Цš å¶[%lô@¾fµ© ÂÚõuÝ›RQÙ¾æ/ùûï¿ßyçþ{zu·¡ˆŒ–PÌ_K î,<|ø.Ú€€€zO"›Ž‹‹c³Û·o§Ù#GŽ¼ï]ÊêêjÚ¾GüÔØû$tK²¦žëׯÓlMM íܾ +V·oßž…ÕÜMćB9ºìY˜ANïÚµ+…ÛTx¶hQ,ƒÐS`˦ÿøãwß}—ÚSHêÕqIÁ÷uƒÖn¦¯+++iaŸ>}ZÚ×oþ÷ˆܸq¶¡j -yÿý÷ákéû:%%…&ø£Z‹x~Í]u"Þ¥ÌËË‹ˆˆ ZëÔ©SùÍbbÆ _E +«===ËÊÊêÝlÎœ9´AÝδYÅxóæÍ-Z˸ijjZ[[sKø¶­­­L­u}Í·¶Àà¡Íôõ‰'háÇüFäGaÏ(…-¯÷·(Ïé, +lC%ü?ÿüC¾ JT÷îÝoݺ_Kß׉‰‰4±wï^q|}öìYšÝ¶m›­÷]JZB³Ë–-ËÍÍ¥è¾ÊVïÚµ‹…Õ#×VsP©K—=׿–@ÃÄ*p×Ô½=©4611 m°Ø(Š‰;wÚØØPÉOiZàß|ÕD„;êÞøTŒÓ?’|iûäääºû6eÊ +¨ò/°*''§_¿~,Ц"âÅ‹²ìkúððpÎÚMó5]Kååå?üðCçε´´˜gEþ <<èÚµkÇŽÙ÷\ìUÖ(Jžb=5Á×u‹b®=œÖRÊvvvòµw4Ê×¢QÚ÷ÍêEÄGaÏ(…-ç÷Í’ššJµ/ª¿µk×îèÑ£ûÃ>ä§úÞ×_mooÏë¾ð5÷@[œï¹ˆ˜˜*©,MOOß±c‡¥¥¥––•Ÿl–NHHÈúõë{÷îÝ¥Kñ}-º(Þ¿?m3gÎâÌ™3i:66¶Q¾áŽFùZXç*2øšYƒ¾n‰ï¹øˆxà(쥰åüwÛØ«óæÍã÷¦þ¦Îûot.lllÖ¬YSSS_ø(L Íï†TD MJ7nŪT¢R¹Jêä÷GzþüyR-•“nnn………j]¿ù÷{.ö5mP÷{®}-Âòu½—R-‚ß_ŠŒ„Õ"|-‘þRùò5Ýn! >VË9ð5h,æ£ H¤?RiúZ‚ý‘Â×ð5ð5hZ Í £Yïx€¿ÒæŒ÷!_K|¼øZʾF{¸¢_‰ÚS¦LA ]oX-Áñ4[šO¾†¯qqqü·M| Z+Ð644ü駟'—/_–È0š² | _7A7ÂF¤ ðòòB¡_)Ú£FB Í«×®]ËÂjkkk«ákøºÕ}ÝØ/"ákšhÇÄÄèêê²@ûçŸVæ°zÀ€¬Ë2??? «ákø¾†¯PTTäææÆ.ª©S§>xð@™ÃjÖW¹¢_Ã×ð5| ä=ÐÞ¹s'h8p@I<77— «,XÀúXƒ¯ákøº^_¿~ý:""ÂÖÖÖÀÀ€õpÈ™HʶLëçÎ377×ÖÖöóóãÆŽ6$zƒ©58Æ.| ”'О6mšbÚTò„††²°šŠ…º}§Ã×ð5|-àk===’#»ƒlll8‰Ó–o—.<šg«„ ‰Þ`j Ž± _e´ÿûßÿ²@ÛÈÈHQm*ìììXXýÙgŸ)|X _Ã×Í÷õÇ)¦àV kÓ–möË/¿°À™áº÷6$zƒ©5jŒÝÖ…â¹€‚*·#GŽämºO)¬ ãÂê“'O*Õ™…¯áë&ûš «Ga¬0_ ÓV`3KKK²*›6$ºø©ÉþpØð5B ½cÇ.ÐŽW€ƒ¢€ «çÏŸ¯Cøxyyá +„¯h³"ˆøøã%hSXM) «ÍÌÌVÃ×-™ÚÏϬ½aÆŠŠ +yôµ’û _ N ½mÛ6.Ð>|ø°D’½víÚ AƒVÃ×Ò$??ßÃÃÃÊÊ*..®%^Eƒ¯eŸ°°0oooø(0ÇgöôéÓ›hSXM1V'''#{ákiB>µ··8pàéÓ§áke£9Ù_9 +´·nÝÊÆÝ£@ûÈ‘#Í «gÏžýÏ?ÿ cákéCÁõ¾}û,,,&OžÌL!k¾fñÚÚÚ¨©©±Ú2[õøñc___+++UUUww÷ÂÂB¾Î;ǧöó󫪪b«¨~2xðàvíÚ©««Ó±çå剙eQ¯^½è¿œ‹‹‹/\¸`mmM³£G§e,++kÔ¨Qººº”~—.]¸AÛwîÜiccC é/M (µÁq¤ÂŽÈÎÎŽîí£>‚¯RÚÿý·øauTT «»vízüøqd&|ݺ¼zõ*22’l¸xñb‰ô6 Y_ûûûëé鑧˜»Ijœ,nß¾½dÉ’´´4:¡¡¡´|Ò¤I|Ùõë×´èááAÓááál•‰‰ É:))‰þëðáÃ%%%b¦æââ³bÅ +š¦ÛßÁÁaÏž=4»eËÑG”ššJ• Úyª ѱЯ³Áõbccéß}||.]ºDiš6hÔŠ8RaGDË---i–îðák $6•‰‰‰ þËõëשbÏ,O÷&ÂjøZvxðàÁ‚ ©Øoæ«hôõÇIsQg½5aZÞ£Gþfìƒ +3)‘îÝ»³UávèÐA´§êM-==¦)z¥i2>ë§ÊJ¼Á!/‡ Âü(°|À€mÚ´yöìM?}ú”g{{ûFý¨ˆ#mðˆšvvàk §Ü¸qcØ°aLÁŸ|ò‰°@›n*évcaõ±cÇuðµ BB™8q¢µµõO?ýÔäWÑ$èë””šæ0- š¼¼¼ˆˆªýN:•• lFá$‰ŒMGGGÓ´††éÁƒù‡)fjM¢ºmÛ¶tã×]N²¶²²âï'¥Ö¨q¤â| ”'ÐÞ²e‹ˆ@›ªÄ¬vMÌš5 a5|-ãPLggg7xðàìììÖõ5ÝM4½wïÞz}½iÓ&š^¶lŠ—Eøˆ=ÛåfïܹCÿËNââÅ‹›Z|Muõz‡ô¢ÿåûÚ¢™¾æ©øG_¥ ´g̘ñøñc„Õðµ\×Bccc©ð§¸ìæÍ›­åë«W¯ÒôòåËÙòüü|V1f³íÛ·733ãÿ×Ì÷Qyy¹ªª*Õ™~¥²²ÒÈÈHSS³Q©5Í×lì¿K—. ,wppàÚß|¸ ã®Â×@a `èСÜçtË$%%![àkùåþýûóçϧP”ª£“JÓ×DQQ‘««+‰ÕÆƆn%¾ÅÒÓÓ)N$%ÑéHHH OQômll\UUÅ6cŸLRPÉ>mÚ4ò&-×ÕÕ0a÷![ƒ©5Ç×Õ7(gȘt,´KÜ+å;wîdŸ\Y[[×ýžKL_×{¤"ŽèâÅ‹ô´j×®]ð5Pò@ûÃ?¤KÚÖÖa5|­\½zuüøñ$͈nG•…ñ¹¤ß­Ê[B¨÷±µ\)| Œï¾ûŽ=ÈFVÀ׊ÄÉ“'û÷ï?tèгgÏÂ×|® A‚ÑÀ×´{öì¡KzæÌ™È +øZÁ¨©©¡ê¨™™™——×­[·dÓ×´-ØÊÒ?Rø(»wïf¯™!+àk…äÅ‹¡¡¡K–,èv@| àkÄäÛo¿e˜!+àk¦¬¬lîܹzzz¿ýö| _ ìÚµ‹.éÙ³g#+àk…§¼¼œß | _ G|óÍ7ì³Jd|­lÀ×ð5rÄ×_M—´¯¯/²¾†¯| €ÌC—ô§Ÿ~Zwûþ"$$D`¹@¾†¯| @K³sçNº¤çÎ+Ì×mÛ¶\¾†¯É×@±Áu†ÿþ÷¿tIÏ›7O˜¯ÕÕÕ©Xã÷_Ã×ð5€¯2;vì KzþüùÂ|½bÅ +úûí·ßÂ×ð5€Ö"::šÊóÏ>ûL˜¯_¼xaeeÕ±cGn|_ïܹÓÆÆFUU•þòGð5I±}ûv*Ï,X Ì×4‘œœLüq]_ÇÆƲîV.]ºDizß¾}ÈUø€dùꫯ¨<÷óóákÂÛÛ›¦SSS|=`Ànû§OŸª««ÛÛÛ#Wák’åË/¿¤ò|áÂ…¢}]VVÖ¡C›—/_ò}M²¶²²âþÅÒÒRCC¹ +_,Û¶m£òÜßß_´¯ßü¯g•ÀÀ@¾¯ÉÎ|_[XXÀ×ð5‰³uëV*Ï-ZÔ ¯kjj†ª®®Î÷µƒƒ×þäÉ555;;;ä*| @²lÙ²…ÊóÅ‹7èkâÊ•+¾Þ¿?ë~<''gæÌ™4‹\…¯H–Í›7Sy Ž¯ öð7ÿ~Ïeee¥ªªjmmï¹àk-Á¦M›¨<ÿÏþƒ¬€¯È,7n¤ò|É’%È +ø€ÌEåùÒ¥K‘ð5™eÆ TžþùçÈ +ø€Ì²~ýz*Ï¿øâ d| @fY·n•çË–-CVÀ×d–ÈÈH*Ï—/_Ž¬€¯È,lkd| @f g½‚#+àk2KXX•ç+W®DVÀ×d–ÐÐP*ÏW­Z…¬€¯È,k×®¥ò<((Y_YÖ¬YCåypp0²¾ ³¬^½šÊód| @f!SSyNÖFVÀ×d–àà`*Ï׬Yƒ¬€¯È,AAATž¯]»Y_YV­ZEåyhh(²¾ ¼~ýº¢¢¢²²²ªªŠ¦«««kjjV®\IåyXXò¾ dff¾%UUU555uuõ6mÚ´mÛVCCãüùóÈ4ø€ôqvv~K|H±d@@·{\³°ˆUbúZt +l:==ýÍ¿½pÓ4ÕU®_¿N³555ô‹-H¹ººš6ëÑ£?…_~ù……áô/Ý»w¯»?b‘°œl-_3***80nÜ8mmíM›6Á×(Oàk¤æë§OŸR@M‘ ÓÇŸþiggçããC’222¢`S˜¯¹š"žºfggÓ,{=[œRRRh‚BÚº +±JL_‹NA 5¯À4448_çååEDDPM:µîAqÿBq4å§_7j¸œl]_s<þ<-- ¾Fy_ 5_ƒ9rä®]»zöìI³«V­266>þt觧§ŽŽUu<È¥™™™““3yòdî5ÂÞÞžDϦÝÝÝi îþýû îOÝœ„¯ákø¥õõË—/Û¶mkkkË=Pööö¦mΟ?ß4_«©©±÷™ýüüØgPâ§PTTD‘¾ºººMRR’˜«ÄñµèÄôuzz:Ȥl*IÈÈ“XY +lø +º…=˜¾xñ"ÍR +27¸?us¾†¯ák”Ö׊qDu!ÍIs7¤Óû +| _Ã×À×rÊ5!À×ð5| __>NNNRˆèåÚ×´AçÎù]›9r„þÑÏÏ¿ͲNödpT8ø¾¾ +ïëÍ›7Óf¬럇ôÇ߬{÷î¡¡¡odrT8ø¾¾ +ïëK—.Ñf;wîd³h³^ehá­[·ØÂ;wî°nØ%¨Wø¾¾ðµø¾®®®nß¾ý|Àf¯]»Fÿµ`Á¾ÄwíÚÕ¡CÚ¾ð5€¯ákøºU|ML˜0ÁØؘ=ÂÞ¼y3黬¬LEEåý÷ßgxyyMž<™»V[}T8ø¾ u} äùõ5ëÐ5??Ÿ¦G5uêTš ÏêééUUUÕÔÔ1¹X[F…ƒ¯ák_%Œ¯ÿýwÚ2&&æùóçmÛ¶e½Ê³ÞV/^¼HÜâ­>*| __ƒæøzèСrêëêêjŠd½½½Ùp'ýõ×›ÿ>´nÝ:Šmù×jëŽ +_Ã×À× i0ɯ¯‰ñãÇ›˜˜|öÙg `K^¿~ݾ}{GGÇ‘#GΛ7O„¯ëUjË +_Ã×À×@i}ES”½råJná”)STTTÚ¶mËOiŽ¯%8*| __sÄÅÅ=zçEy|ýÛo¿±‹Ž…[øÍ7ßÐUUÕÇ7Í×-1*| __×[& Ð`·ðµ<úúõë×$D}}}šàÞ½{—R4h°k£µF…ƒ¯ákàë}-4àk)ûZ€¯ákàkø¾†¯| | _Ã×ð5| |ÝL_‹èòñãǾ¾¾VVVªªª:::îîî\¯LëçÎ377×ÖÖöóóc¯§OŸ|¸ƒƒÃž={ivË–-ð5| _Ã×(­¯Åﲺºš–÷èу¿Ù/¿üÂgJ¤{÷îl•®®n‡8M×K½©¥§§Ó4Åé4MÆgC6×ÔÔPâ‹-‚¯Ÿ={Fµøå | €úºÁn!óòò"""|||¦N*â;6¤2›ŽŽŽ¦i RÉÁƒ¹¾(ÅOMàñ:%¥Ì¾®¨¨øùçŸÇ§­­½iÓ&øå | €úZt·l\§eË–ÑÍKñ²ò§ØÜì;wèÙ¿xñâƦ_3~ûí· Œ9òûï¿ñâ-| àk”Ç×¢»…lß¾½™™ÿ¿¸Fo¾aËËËUUUë_UYYidd¤©©Ù¨Ôàë¿þú+**ªwïÞ¶¶¶¡¡¡EEEõn_øåñµèn!MMMIÄÑÑчòôôÔÑÑ!ù²¾¦™a333srr&OžLÓñññì¿|}};våÊ•}ûö©««÷íÛWÌÔ”Ü×?~¼¾¾¾OVVÿQ| _Ã×(³¯ßˆì2==½G$Yº…ÈÈ}WUU±Í +“ùOÀ§M›fbbBËuuu'L˜PPP fjJëëßÿÝÏÏÏÐÐNDllìóçÏÅù/øÀ×(¼¯›Ru«ÒB¾.++Û¸q#TSZ³fÍíÛ·õïð5€¯€¯áë–óueeeBB„ ôõõgÍš•™™)ºÝ¾†¯ákàë&ãäädjj +_7Š‹/.\¸ÐÐÐÐÅÅeïÞ½b¶{‹öµ²_Ã×À× …|}ÿþýÍ›7÷íÛ×ÚÚzõêÕ·nÝ’È^Á×¾¾Í÷ueeåÁƒ'Nœ¨¯¯?sæÌŒŒŒ¦µ{Ë , Üؾ};. øøȵ¯/]ºäïïoddäìì¼gÏžgÏž)RnÀ×ð5ð5k_ß¿Ë–-ýúõ³²² + ‘T»7| àkàkÐ|_WUU:thÒ¤Iúúú3fÌHOOWŒvoø¾¾Šá뜜œÅ‹999íÞ½[ÁÚ½ákø¥õ5kø¾¾råÊ»ï¾kii\XX¨T3| __yñõ£GNž<©ØíÞð5| ¾ð5øÀ×_Ã×ð5øÀ×àk_| àkð5€¯À×ð5| Šák ØÀ×_ø,¡¡¡ä¯   d_¾àkÀ×€¯øð5_Ã×| ø€¯_ AÖ®] _ð5àk¾| ø€¯_¾àkÀ×| øð5_¾| À×€¯øð5àk¾| ø€¯_ð5àkÀ×€¼“ýVcHOOG¦ÒgÔ¨QbÊÚÙÙÙÈxˆàñ{ĈÈ( 9sæ ‚k@ÞCl×€ì‡Ø§NB²€››[½²vrrBæ2b#¸d<ÄFp ȧOŸðõÉ“'‘-€,‡Ø®Ù±\2‹µµ5ÉÚÜÜYÈ,³gÏ&_OŸ>YÈ&555#GŽ$_>¼ººÈeeeüŽI]\\JKK‘-€ìžžnllLšÖ××ÿæ›o:uêDÓ;wNMMEæ­NMMMhh¨šš ÚÙÙ™ÅÔk³o»TUUƒƒƒÑ6´"÷ïßwwwg^^µjßËäñ5kÖ0»ººþõ×_È.@úddd˜˜˜ŽŒŒNœ8Qï6'OžìÒ¥ mCÓÒÒi€Ô Ø9,,ŒÅÎ#FŒ())±1EÖì¥qÚ~õêÕh¤Àƒ¸6ð•+WŠã_Ú†LÍüNîFÛ8Тdffššš²6ð”””FýoZZ×6ŽÞJ€– ¦¦&<<\]]å!º \Y»ºº²¶ñ5kÖPšÈX@R|ø½{÷$˜xii©‹‹ k_»v-ÚÆ€&ððáÃ1cÆ°6ð+V4§ \ÕÕÕAAA¬m|Ô¨Q÷ïßG¶/Þ~ûm²XHHˆÀrZH«Zú×OŸ>ݵkWú-ƒãÇ·èo8q‚kOOOofj'NTQQ¹pá‚Àò­[·jjjàÒ€Æòèѣŋ»¸¸˜››Sû–ÌЦM;;»éÓ§“Jjkk[Ñ×mÛ¶½víš4}MÇ»nÝ:Ö>lØ°ââb)lii©³³3k mNÛxaa¡††>þ‡á·oßÖÒÒŠŒŒ”Ù{!--í“O>¡Ý¦3.;7Ý•ffftj-ZT^^Ž" %äùóç³gÏf ¡2N‡û¡±}MÞtrrâ×ZÔ×>;v,+¨—/_Þmà ½®ZµŠ]îîîÍi + +¢D¾úê+®2jÔ¨¾}ûVUUɦ©õõõeÿF KÂÇÇçéÓ§(¾P~ýõW +¨™Œ>øàƒÃ‡ß¼y³µÂXaÚ:{ö,ø\G^Ò”çë+VÐßo¿ýV +¾>sæ ×~ìرVÉyªÑ>˜˜˜ddd4-‘/^Ц§§Ç:RÛ³gÁº-ä­UQBBBX·o:uÚ¶m]u<=¤»²°°ðÈ‘#ÞÞÞ¬ÉÅÔÔ4++ …Ê@ff¦††Ýø (**’ñ½¥òjëÖ­¬D>}º4+Ìפ++«Ž;rŸ€¯wîÜiccC>¢¿4ÝäÃ\¿~=+‡*6pa”””Œ1‚µ‡……5­m<>>žR Ë”••QôºxñbþÚŠŠŠÀÀ@r:ýU ‚ƒƒ¹ÊØéӧܮ];Ê ‹¼¼¼–;ÒÙ³g³ÚàÆeª¾Z/tU888°g4º…çÏ?ÿdMä>9ú~‡êì©âªU«¤ìkšHNN¦‰?þ¸®¯ccciÖÇÇçÒ¥Kô—¦÷íÛ×Ø*//7nkðüâ‹/¤ÜŒ ,ð\¹r%k=ztBNÒd¤ÿþäågÏžñ×’Ç)˜¥êEôT g«Hß$뤤¤ÜÜÜÇ7­7qX»v-{SBŽ>?§{vÖ¬Y´ÛíÛ·§üA€¢RUUÕ­[7ºÙ===åîcÛcÇŽ±ð³¥_–®ëkæšNMMðõ€¨Àg2zúô)í¡½½}£~%;;ÛÌÌŒµÇ=zT¦òœ**†††¬ –ªLM¨²SFòå/¿uë-ŒŠŠâ–L˜0¡{÷îlZWW·C‡-§iŧ¬ªòu#ÐëååE;oeeUQQb …dݺut›÷èÑCNGTÜ°aí?U9¤SLñ}]VVF±±±yùò%ß×$k*6¹±´´¤PQü”ŽˆR ‡ r÷î]Ìó{÷î999±W(nl5Ÿ‡¤HöŒÞâhkkSLÍÖFGG“F)'NœxðàÁ–h¦¦ŠkÏž=iÂÂÂäñF ³Ð»woÚÿÐÐPk(dMMM.H”Óö^½zÑ!PÅCʾ&¾þúkš äûš´Â÷5©GL_———?žµþùç²ùâ4ãõë×tÔ¬mü½÷ÞkTÛx½¾>~ü8-Ü´iS›7orܹs‡ÖöéÓ‡6xð-6oÞÌNbee¥œÞ tå´mÛ¶¥"Ò‡ªâTFMš4I®"%%…Ž¢k×®â7PD¼mÛ¶eË–5Ó×Ô :”5ðr¾vppàÚßqâ„,ìO\\\ÓJËÚÚZ¦q4÷êÕ+2µ‰‰ mÿÉ'Ÿ4Ó×Ä•+W|½ÿ~š3gNNNÎÌ™3i:66VôþGEE±6ðÁƒS Y÷ëòÛo¿Iá¤xyy±iÿž={jkkÓ¯ëëëO›6â¸{÷î >œµGFFŠÓ6^¯¯‰°°0Z>cÆŒS§N]¾|999™{œíëë{ìØ1Êê}ûöÑõíÛWôOPæ³½ÉÚT7³Êgmm-ïý¥SˆÝغ+@öIOOg/¨4¿Œj²SøškÎ'Ìì)6bšš!_íáoþýž‹2VUU• ú{.Š+'L˜ÀÚÀ—.]Z· œýâé:H§‹ þñRÐJU‘‹/^ºt‰¦i¹««ë›ÛÆ—/_ÎÚÆÇŒóðáæùšê-{÷îe‰©©©YXXøøø°UT7 GY¤««KÙÕ`ÿ¥Ì× q¬Í^læ“kaÇÅ¿6øÛðï:^SSSOOÏföDyؽ{wJPRC¶dº¯—,Y"©R½ NY¶lÙÆ›ïköv±¡¡a½o"‘©¿üòK¾©›ìkÉröìYÖÞ±cÇ#GŽ4ÊÒAįSG¡.7Kñ/ëdž–Ó©oÝŒåûš³ö–-[„Y›]}ÌJÇ×”W™™™GŒŒdUÛš³¬3ú‹"…ÁÝÝîëøøø-Õŧ™]„QL)ܸqCS·º¯©^AÖ>hÐ 6pÙ÷õãÇ555­­­ù ‹‹‹‡ ÆÚÆ×­[׊Ôõ5ÃØظ®µ‹ŠŠØkÍÜá¦ùš¿åßÿýÎ;ïÔýØ­QPÅRpvvF€Âо}{º¯KKKÃמžž”Â÷ßÏ7µ©©©ˆ¾—[Ë×=š8q"k_²d‰è÷ÀÌ[a}© üc]SЩ=z4ûúŒk>}ýúuDD„­­-ˬ¹º¿N;}JÅ‚ŽŽN‹Fa\,æëëËžçÒ/R\_XXX·(k¦¯I”Bdd$™ú«¯¾mêVôõ¹sç,,,X¸8ýr°¼½öÿ¡@Œ­Ñ—Zƒ¾8p``` )žŠwî4===Ö­7É—êgöÙ³gnnnæææÙÙÙÂö™ÂCÖ6nffvæÌYóµ€µ7mÚD³²àkª ijj6gOèÒ¢”1tŠÁíÛ·éŽ&qHÐ×ÂœB¿EQdZZZnn®Àdôõúõëß’Ø{Yƒ ³ŸözßåãF¹Ñ—Zƒ¾Þ½{7›eŸ °ÐŒ¢f¾¹ê:eáÂ…â<ê½{÷îСC¹ã•}šßMŠD|ÍNÕ š³'¶¶¶”r~~> +:€‹/²nœ%èkaNáS]]ͺS“¸¯wíÚ¥À¾¶VD_j úš{\Ë­bŸ5íÙ³GįwîÜYœj^qq±|ùzÇŽ2âk:‰\ÇnMcàÀ”ò¯¿þŠ‚àÂ… tG7¶_ë¦9…ÈËË‹ˆˆðññ™:uª0G7Ó×döõ®B¶‡ [+¢/µ}]wUbb"MìÝ»WįSÆ:99‰Þgùj÷õõ¥Ù˜˜˜fþ(ÕBùµ FMMMcÛÃé öîÝ»9{2dÈJ¹Ur qnÞ¼É>¾–‚¯ÙóÁeË–åææ–””´¯7nÜH)üç?ÿa³Jò¾™ˆ¾Ô˜>XâYYYìå1Ѿ¾zõ*M,_¾œ-ÏÏÏ×ÒÒjÔ›„òø¾/-¤úd3”µ'üóÏ?ü…”üŠqƒ¾fMÍüÊ’¥Lg +ÀãÇÙ|Rð5ý +ÅYÜ,mÉ»$A_³ÏNžBÊÅ÷\uû4?oEô¥6zôhš Y¿~=Åkì{7Ѿ¦½rtt¤À?;;;##ƒ–ëéé ü:ÿ“yäô{.ÖÙN3¿z~ó¿ns¸/ûöí£…Ÿ~ú©8¾¦W¿~ý´µµE\âÀ7îß¿‚€ÊÒvíÚQ$´„¯)ÈUUUŽŽ>t觧§ŽŽŽ¦¦&ûH‚¾þðÃ)…]»vÕ]%Ëý¥pmãMî/EX_jçÏŸ§åT%pss+,,§=üÍ¿#»ºº’pmll’’’êþº°Ó$¿ý¥aìOÈtìT¥INN>uêÔ¦M›¨²JÙ \Ro)Djj*mLç‹îÊföaþìÙ3ºÔÔÔdaÌt€D`C"6§g1’žžÞ£G*Cúô铯¥¥E‘NUU•}ÍÆkÈÍͶDú#•8 öG*ûV¬X!~¤Röuƒý‘^¿~ YÒüß---ýì³ÏH»¤KÊ333___~°,¬?Rª QukÞ¼yü!ɚƉ'Ø (âPØË+W®T€c¡r’5ï7ØGD3Çûh¡¶ã}È8MïCj¾s¼ÊÿN:Ñöb¾±/ã¬Y³F"Ÿ“d‡£GÒ}ÝÌ7Qe„;w²àNÌí›<žfË¡<ãiJÆŽ§9iÒ$a_ Êöööt,u»žÈ/l(aºµÏ;§eÔþýûåú(ÊËËÇÏÚÆ?ÿüsYnýúu`` kï½÷dÈ»wïÊàNÞ»w½ü ®®¡ýTsuW¬ÊŸ~ú)Å¢E‹P¸ `²WI©Z.¿‚cÏO©î¡0ç…¬affÆ¥f¾-,q’““¹6ðÌÌL…És6¢÷ Aƒä·úAWªAÑ-0J@1X²d {ÍIN÷Ÿ xѹsg‰|˜&;”——7ŽµñŲðmNuu5Iµ=ZÞÛÀxúô)ë]§ÞOåÖè±páBk($TL±—¥å± íâÅ‹ººº´óß}÷âšÚÚÚõë×SÄD8tèÐâââVÜ™’’’#F°6ð°°0…«ñ‡~ ÔÖÖfÓÉìÙ–‘‘ÑãÇQ¬ ¨deeihhÐÍ$G»}ãÆ }}}ÚmooïVìJ«¥9sæ k700ÈÇòM %%…=Þ¥ª]FF†ß 3fÌ`^¿~]Žv{Û¶m´ÛmÚ´9yò$ +4Š,XŸÏ~ø!Eܲ¿Ã?þø#ë*säÈ‘•••Š}v>|8vìXÖ6¾lÙ2i¶WWW¯ZµŠµ»»»+|—UUU¬Wn$qYæÙ³gÓ§Og× €sèÐ!mmmöŽÑyyy2´–——>|˜½`FŒ7Ž u¡ðйX·nk6l˜tÚÆKKKéÕÔÔBCC² ¼.ÏŸ?g£±°Wôé¾…Ûê^W®\ f}Àjii8p…ÊÃÝ»wÙ‡Ì ª±ÛÊü‘”É\kÖ¬Q¶túôé®]»²¶ñcÇŽµèo8q‚kOOOW¶¬ cµ#nÔr™ºXk£ÿþŠÑ3  Rxÿý÷Ù3SYƒ½¡C‡îر£ÁN&ŠõÆŒà ²bÅŠ–h¯®® + +bµ£Q£F)í0O¯^½Ú¹sç°aÃØP¤²ÕÜ<<<é“:@“©­­-% + qRˆšššÈÈHý >üÞ½{L¼´´ÔÅÅ…UÖ®]«$mà BמLÝ +ü‚%(YYYì{aCCÃãÇK$ÍÔÔÔÎ;³q¢O:…LšÏƒÞ{ï=Ö6Øœ¶ñêêêàà`ÖîææVVV†ì$EMMMxx8kwrrjZÛø_ýåêêÊÚÀ׬Yƒ6p %ÈÌÌäÚÆ“““õ¿iii]ºta£E£·  EyðàëèCUUuåÊ•ÕÕÕ þ mÂ^~9r$EÙÈF ¥©©© cþ1bDII‰ˆÉÎähÖ¾zõjqüI‘‘‘Áp122:qâD½Ûœ> endobj -4664 0 obj << -/Length 2961 +4822 0 obj << +/D [4825 0 R /XYZ 85.039 763.817 null] +>> endobj +4828 0 obj << +/D [4825 0 R /XYZ 256.898 550.354 null] +>> endobj +642 0 obj << +/D [4825 0 R /XYZ 85.039 500.413 null] +>> endobj +4829 0 obj << +/D [4825 0 R /XYZ 85.039 480.084 null] +>> endobj +4824 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R >> +/XObject << /Im6 4814 0 R >> +/ProcSet [ /PDF /Text /ImageC ] +>> endobj +4832 0 obj << +/Length 1649 /Filter /FlateDecode >> stream -xÚ¥ÙnÛHòÝ_¡·¥Ífó °Xxì$ëÙÄÉŽdL(‘²ˆP¢BR£øï·®nR"í 00`öQ]]]w•Ỗ?5KB×Óé,N"7Ôj¶Ú^x³GØy{¡b. ó̯‹‹«7a4Sž›zél±¶xRÏ Óh¶È¿87ÿ¾þ¸xýûå\kí(å^Îã8q®/ýĹ¹ùðé~;swÿ—>üþþRÁn¢Å݇{Þ»ÅX œn\ÿz9˜|ýpùuñÛÅë…¥sð¥5RùýâËWo–Ë~»ð\&³#Œ=W¥él{„Ú -óêâáâ¿ï3>5Å”P'n˜è1WT8Á•0t£ &®|.w@~^ãËŽ-?óÐ ³©«y%ãé§û»ÿ]½ƒ|€c?dùîÖÅç)s?v= Q¿)€i‘G]£'äÙ/p$„U…ßAæeÛK?v–8ÂEM‹×ïà/ôŠÕ¡);¼ö‰W¯W+Ä[#DNÇëï3|NöXànÃk9®tÙ2k @¦øŠlµª|²e°¦ø~ Š àåñ›å¥ -e’ÒK—óÀKnCw &3"—¯L8–È…ÀKœ-îf{žt5èf{ÎuËp(fA˜çŒ„gŽÉwcïó×Kœ¯k|*ßÛÁ¨¬w|8kW<"ö/1»»¢Y#%´_ô(ë1ÆÎ^3ñh¨Ç$ tOÞ²©[ÿðàòànÇß‚øÁ„£Ž Qce`ÕÖz‚±/x[—ЂkÒ[Ò¾57tñwXé•Ô&œ®$§ÆþŒ=Ÿ©á”Õ.ˆ"ß—ƒü„s—ø’ ™†¦è3gq#ûÃSº?ÓñêgÒ¶œèƒ3äb`ù-æ4š™ŒÌ–1 -åìÉI=òrI(´ó'*L&X6$ ÉÀÝéÐw•çÃñae¾E ÓA ,ÌÉ¥¸Èn.á½Ç2gT'žsnp %½ÏÖ |tG6ªCÍâ ¬Z®QââÔ*ô|ç#Z É4CÂsM±&9…Úh9 Å‹à˜9"è÷äåp¤nxµÜñl›udÒ¸öŒºUºû†õY0 “³&ÛAøwlö‹ÁP¥}o1µ¬í<µÔ¸Ò¨æqSˆL‰u·=Á¹nê­`gܹu[wrÝÐ^DíÿDm-÷™è©ÈÕ*y1ÏÀPDõaW¹)rÅFÔòŒ4ð‰O°é£Ì5J:ô $í÷dø°(vnê-ê ¦ îíÕ[ø‡ÓÈ.ß"ýx¬íšry芜×ßg«M¹ÆN?(Lb -xñA˜gS„0ŒÜ8MOýýÌ['ž³‘ð€ãŒ?­X¨›? :Nu¶*«>vÇ1BâˆEÿd$øÊŽ¿Œ«n q¹kÁòðÝf%²9<ŽŽªàõrE4Àê'f/’k<ŒßÂðÑß²›Ô Ie¤øäÐý4E6:Õò"ÞŒ_Œ iHÉFI2CWMbÃÝ]A8¢G Èû ´#ИaŽkúëÓ|ªdÂqXï -7Ö > α‘ÍâÐ&'2Þýx{ó Å8œ¡c <ñÆucRíPò{{Óò,#e ‰\öx^“ûÍB²@Ò¡†Lž fº™§0Kïöyƒžå‰”ByM3)·{Št}—±vü‹O/Ó p;ÁÆ€Ì7Ç9X”kþBè HE)—LÄü Û:6Øk7Y3HÝŠ²oQ+^ÙÖŒ!‘”r'€;Á»Gu7ˆùueH =ƒþñ¼)öû7èMò“°hpª,Û!“Í[ÆYÕ{2éÞe=Èë3¢¶µËÁ «†ôVʈö‰  ØÚ:¤Ü=ö…J°º´(ø@Á$³‘ëZÞ‘?ði~껑K† µÈn5åýÔõ%p1Åq“$‘)äH:tZqy”UIl Î]f|B³Í³eE}øJ›Í妔ðhö\™Û~Ï+KN– v©d’èg@Š “hæÅ:C®U<¡è:K€dcq[{Ò*e ¸g„¤®JK|Þ[NºF -†äÿ š¶¯ etYW7=®vC t•óùû0Y.fOºÍ€€i -‹œ´ï;&ïhl_Ä2‘ËKŽòŽ+ÿ<ÃJ27YG(|ÅÒì®ø›uX&ähmõÀT}‚Nb -œkÙ ƒ?¬ìMüƒ³õúü¬à4óWÏ䆇iÜŠˆÓXZú¬¡G­䛦z*ÃPIä&˜Jì†q4„8ÿÚœÄѺâÙ<ðµ›Fz:)1PEózš;&ûR#.èP¹±gƒ›þ’ºß½Z“ñaÑæ’u?¾ŠtôŒŠè< |'„‹U"èƒú{,dDJ¾˜¡b±åyú$å\Dƒ Ê>7êSnʶ¡ »&W|)E®Ô¡W¿ÏvP/m‹]Çyôâ2å˃ ò\6­U -Õ/ÓÚÃ<›MûIàÆ:ïžèt·áàω+º‡ 4Îö¢0æ&˜/ñ;V}4lyÛ€0ÞòCÉ1ØTÎÛ€ýO¶÷‚«6¦“I±ÿRðÚDyPŒ†µ{NÕ3‰‡°q”Ö`¹à<8øBí¬}g î½Úqª$ðCÀcF3øæð –æ;ù’>EáyŒ2•JRÿç¡ŽQ¡trÍL*Ä‚AFBSòìw0íËeØ´s¶ÒªÞo{ÙÀþòÐ ±`”[0ºâÇ0Ã*.§äDEž@Æ2dp»)ñ­QÂQ&ª!ŽÖ¤%08k»’Ñ®‡£ºÕ—Œ`wÅQð ŸlÚ—8Zq’ñ‡ë›wW‹ÿðüí§» ,‰©aCZ`õ7Ò(ð¨åj³;€­J‰ª£ÍvI¼ÔÁÆý“Éî,ß/ÜJ‚ãOÜõ†Ñ¨‰ìÅègqkSäfw vçïöY’—pv÷—`¡çL²Þ>jE2õDZp“H VXZ¸´™²¤A]’S¦OX™I)¦½š¯B×Ó½ÚæÙ¦‡‚x'C aWš¢<12eFÊémyØÉvœ>M“ªà„/÷g0Ï:`!)Ò' NéY0 1;š‚LAIÒ•(×>‡pî;òo0ECï†i>b,·e•5<áΦgTsÂ;Ç "ãÁ(“TΤ«¿$Æ5r~~† ÔÂ7ΧýKn3Œ\/6¸¸Œ|„LÙTÔAà9wSn;,™Q+Qw…ãê@°A§‚5Rû¦:Á2Ýôêöö'†¶okHÖƒudQåRAÚnùà’ŸN»Ý ^ö».Ò(ÈF˜e–tR~ÂÔù‰Oݘ®ªR<ûü´ÉPÜ!ÿ'1¥Aƒè:ÁS çW\Ä¿pÀ`¢×¨ÚL~&—c5oÛОí‹3ŒƒŸ þ!B–'Ÿv»[#*‘õ*y¥ùacÙûFºªZKY³°Å@m²vPäì¸]m³Œ1ª‰žÒ_0·eí h­*û¦T@ÏH=ýi©ƒëðL2À4CiµÆ+۹Ζgþ!kágœÇ-£¾¢K¹<Û¶#ç3%a§ –éGjø¾ÐCß*= (‰{´¥`Òk0‹šß957ç}z.ýVÓ¯£ÿ8“+ÄoÛWÀ×¼cØ„c$¿é'¾mÖ<ñÛ®5—A¥\w#jß°HÉlð>üᄇdä -ÐÔ¶Àc“AcsÛö‘žO¥üL´ž.€„C«²a+HÜ4ñ§£Vµ¯,1`õ9Åæ7ÿ1Éÿšùëendstream +xÚÝÉnÛFô®¯à‘Âñ ‡Ã%7ÇKãvÜXA +$9Ð- B‘IÅöß÷-C­T[4—¦ÐÃ÷Þ¼}£”'᧼Ô©3/Ica´ò¦Ë‘ôæ€ùm¤…ô"!cƒ¨7“ÑÉ¥‰=%E&3oò@$“ÙgÿìíéíäâÃ8ÐZûJ‰q$©:SÿììýÇ› b"ÿêæAï?\`SíO®Þß0î1‹ü "Nߌ ¹‹»ñ×É»ÑÅdK§ Q¬Q©ï£Ï_¥7½ß¤ÐYê=ÁY +•eÞr-L¤Ý{9ºý¾æ¸Èã[¦=EJ‘„ᡸ$Kœ8½'Nˆ¥•È²pH’R 89Aa&Ì6Å>¥‘•‘Äûr Áû')©„^"“õÀ“«eâ× ·Q(P™Ð&¡ ´ +‡¤öOŠ|DþÒÎWM!L)ð!†êäR™-Ò8œÇô¯÷c§"N3VsGÜ^ÜÕùõé-äÄkNµfI[—«Î´®\?ðóãÕyËÙÕÕ ¹ˆØWA%)8Àìêp Ú@TH‘Äõ„yõsy©"Ù–€D)Ò4úK¥T˜ˆ3Tóä‚ò*RƒrAû$náQ6tI>9ê].FèÔ‹c³8s"Èp‘³Ê›"ÖaüŠ¡úF¤.Í•Q–iÆnIÏÍ¥>ÕÕAªëL„ظ´HãZ*È°ë»qfÆÿd«¦¶¥'Ê2†ÿqËÏ·õ’u§·äŽ¨ª;>,ràñc‹ðSØN¶³ÅsLS|Þ37¢«—t5ös|@£dÁÈÇVL~M<–x+ñéÜ K©å`žedY^Á•×í¸.¦$uü˜£¹M»ÖõNyWð%ëÊlV/s$q¯e=¯«ÃêÒq&”ÄtŽDšŸJ® {¨›`Ý´ÿ}¾ÐtÓxAv¸áw¼ñLÎøLŠ²ä¼°Õœmÿ¯EÓZðÓq +)Ÿò ÝÏ÷Íà +@eùÂí +½üH¡¯] ŠÒ<íÜÜR6QXðz¡„ ŽrhꎳqZ—‡áÔWdš ΡXèØò¸îÐ_¤JöÙâ\Úë #븇ÜÓ¯ ZÊ<˜Ù.ÂDÓSBxƒ"4Hþ=éßžPJÉywÛÔXÜË° +òòaÞ³[ŠÆUøÉéŒ:º1ÜO©‹Ù>Ù¯Ÿ«8ç(²ÔQ +j;YœÜQ®£ ¯Ó²„‹Fû›Õô™Q¡€ŽÑMQ9÷2”h\Ç̵6u[?8Â;üX ¯“³«Ë;Ǽ´ss—›'ÀsÔ [8b;Í;K["ðø³+g²nÁ:⹈ç³E^³´,ªyqâÖO'=ÓºQ¯Mæ/ ;ÃLFîyeÛ%cfìÍic·F6æIýEÑðýdÂпÀÙšßãŒàAW§àµ¦+ž;~ÍW½æäÝlÇÄŒGïnË@({‡¶m~_&®]ÁêqoKKNu£`®ÈìÐmÂÂï´vÍcN!±SûÈ[ÀhžÁÓéîJ é^;ª(@µ\¥Ò¿ªÚŽ9Úò +/e¾uáGÅË’—¸„uÖwÀ*æug×ÛOa7*5›©[®´‹~‡8üqÝe.„ö õ¤ìu¸ïl%Õç\ôJºÒ¯«hó'ZĶJØH–F[æ–ÿîÉRÂM¢Ê×iZ0¾[¸CQM›Ô±[g)\:ª4àò²®0…£ ¶Lgf´å$ bnÏ}¡Ê#¶y3”¡M¬=‹I ò£k¯Ö«ù½ÃZ…OÔ%ššö$ˆ)Œ˜¦˜Û¶k^øÎVÕÎ H«(JØ%ˆ|,ûµ—Øo[Bè¼%;žÆÔ‹œV¶ågUðˆpéCÂv¼¯¨,Å€½“2Ѳo-¹ë8é9:R¦\Wqfã™ÈYîº<´¿”Q@Utü½CøÆ@þ +¡ï^;‘³[táj»¨W¥‹>¼ºŽ¶ùtAà̶‡\¨€ÿiä=…ìÛÚ3HpõjÀ u…â0P‰ZW3ž×™Œ]ÝžHb~¤ü? D,éKOë.R¸Å÷nD46Š}]nñ5 ÀéÎÕ~Gp—jfBJÂp×½ šWî¹êêàèN¡âTèDÿ%á<÷s•éDÀ×r°áu|™P*=øƒek³éü…h´¤endstream endobj -4663 0 obj << +4831 0 obj << /Type /Page -/Contents 4664 0 R -/Resources 4662 0 R +/Contents 4832 0 R +/Resources 4830 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4640 0 R +/Parent 4812 0 R >> endobj -4665 0 obj << -/D [4663 0 R /XYZ 85.039 786.531 null] +4815 0 obj << +/Type /XObject +/Subtype /Image +/Width 417 +/Height 459 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 17736 +/Filter /FlateDecode +>> +stream +xÚíwX×û·CQ@¤h”ªXh +bMŒŠb( *&_KÄ€ %¶Äš(bÁÅ؃B¬`ìˆÄ€bEÁŒ],•ò>—çúíµïÂËî²ÌŸû®Ý™áì™svîyžÙ™s*+e¥°°ð믿öôôlÕªÕ{|ÂÄĤW¯^¡¡¡•PK^¿~=uêTmmí÷ø††FHH©]‘¼¼<'''ˆ¦¦f@@@JJJ~~~EEjHÁÛÞ½{ÃÃÃutt¨ž¦¦¦ÇGÇjäÎ;ï¿ÿ>yÃÖÖöÊ•+<¯íÇ{ôèÁ¹}ûö¡ûPÆ×®];2Fß¾}‹‹‹Õ¢ÎåååcÇŽ¥:^¾|ÆÇL®puu}õê•U›’èáÇSÍÞ¾}‹~TåðáÃd ccã¨]åKKK;tè@õŸ?>ºP5Ýsqq!EÄÅÅ©é.;vŒ¥«>D‡ÄÙ¹s'ùÁÆƆÂ!õÝ‹AƒÑ^|óÍ7èP€8ÞÞÞ$‡~øA­÷âäÉ“´­Zµ¢ } +`Pf×èêžâUTT´iÓ†,wôèQt+€±~ýzÒrØ—9sæо|õÕWèVc̘1¤…U«V)X»§®êrZH«ªnÃ^3´´´,--ýüüRSS©Ã_ýÅî{A·ÎÎΤ…S§NÕ‹â222ÒÓÓ÷ïß¿`Á+++Z2yòd¹ëP\\L·¶¶vQQz@* Š´PRRR/ŠßòéÓ§;v¤…»:u¢Nž<‰Î\»v„ЦMÅ‹R\qÄ¡C‡há Aƒä®Æ°aè„­[·¢s§OŸ&!xxxðDqoÞ¼ÑÕÕ555•»!!!Tìš5kйöÜ–——OGØÚÚjhhÈ]o¿ýOrì¹þ(ÎÆÆFOOOîjÄÆÆâ€Ò£¸öíÛSQƒg–——×6QÕÑÑqrrBP%^‹ëÕ«%1Ìø£Gha—.]dT\jj*-œ4i’ÜÕÀµ8€%þ¢:}út*jË–-â iáøñãeQÜóçÏ]]]õõõoß¾-w5ð‹*@„ï‹{ðàA«V­(Íœ6må¿ÇŽ[ºt©‘‘‘‰‰I^^ž4Åe¼ãÈ‘#´±­­­žžÞþýû©î‹ˆ£¬§ˆ{÷îM˜0LEÚÔÔÔlݺupp°xH&í.mmm;;;Ê1E2”<Ý€Í} î#)1ðŒ*@Œ40B/ÎÞÞãÅ$Ò¨¿–––õ ÎŽ;3wôiÓСq0@Ø`U€°ùä“Oد^½R£jWTT >œjîààðöí[ô# Z + Ùí¸}ûö-..V—›Ý×G)êå˗щîܹóþûï“1lmm¯\¹ÂóÚ>|ø°GT[ }ûö¡û5’——çääDÞÐÔÔ HIIÉÏÏ—"©~)((Ø»woxx¸ŽŽÕÓÔÔôøñãè8€Œ¼~ýzêÔ©ÚÚÚïñ +ÞBBB$†oY u|ýõמžž­Zµâ•Ù(lëÕ«Whh(…sè&X·nøÀqÅP@qÅ€âŠ( 8€âŠ@qPŠ( 8€âŠ« ¾þúë÷€ÐÉÊÊÂWŠƒâ 8A*néÒ¥h +AÒ¹sg(Šƒâ 8(@qP€âÇsŠŠŠ®_¿ÅAqŠžÜbbbš5k¶sçN(®¶PÓAqŠã!ååå ­[· ÌÏÏG¢*íÚµ£†‚âÇ7þøã77·ž={ž:uªêZuWÜÛ·oçϟ߶m[333mmmÚOOÏj¥$þ¶´´túôéVVVZZZ³gϦrتŒŒŒ=zèééQiÖÖÖ.\ …îîî¢0FŽ Å(Ž\¾|ÙÛÛÛÞÞž2ÓŠŠŠj·QwÅ…„„ž9s†éÎÑÑQÅQÊinnNΧä=55UGG‡<ÉV‘ñÈoÈÉÉÙ³gOAA-¼yó¦ ýû•+WØ(@qõȃBCC)°Y¶lÙëׯ9¶TkÅ=|øPSS3**J´ÄÕÕµFÅݸqƒ^ÄÅʼnVùøø888°×ÆÆÆU=†D@q| ¸¸866ÖÄÄ$::úÉ“'5n¯ÖŠKKK£Ê¯Y³¦VŠ£ØŒ^PYÿúúú¹±Íâãã){¥¸Î××7%%EýBqŠ«_ÊËË·lÙbee——'㩵âŽ?.QyYÕC‡±ÿº.†x‹Ý¾}›Ö:;;Óf¢ŠP\ýÆ3îîîÝ»w?yòd­þQ­÷øñcJT ÄÞ&%%‰ÿÜо}{zûæÍz}âÄ ŠÍ˜£(¸mܸ±¿¿?wá”àS¦¯««+^š´KšP€âꈫW¯RJegg·}ûv9@uÿ¹a̘1Tÿ¯¾ú*<<œRN///¶jàÀ´jÎœ9‹-rrrjÙ²¥( ‹‰‰¡×£F:vìØùóç>,º4|ðàÁ‹/&&&jkk»¸¸°åT,ý %¹>„â§èX 355]²dIii©|…¨»âŠ‹‹§L™âææ6xðàÜÜ\JTEáÙéÓ§mmm5jÔ¿ÿüü|ñL“Î ÷R8GѹqìرlU`` ………†††èIÌÌL*‚Æ7BqŠ«SJJJ.\Hr‹ŒŒ¤dM‘¢„tëoQQQ“&M¦NŠï<Å©)~$%%QÔáççwíÚ5Å TkÅQl¶eË–Û·o—••ÝºukØ°a}={ßy(ŠSGÒÓÓ=<<ºuë–‘‘¡¬2ÕZq999-Z´=w`cc#þø-€â 8u!77wðàÁ¶¶¶[·nUîzꞨRkÜ¿ÿêÕ«÷îÝS»Ÿ;¡8 ‡ +ؽ2²}ûvžïÑ£G&Nœhjjºxñâ’’¥—Ïçåå5ö;2'$>ÿüsýæèèX^^ÎÛ)--%­‘ÜHq$º:ú¦¸~×0€â€ºC9‹ŒÜ¶mÛx›|QBJi)»¢N? ƒ)!Q‚ äxÂeddtëÖÍÃÃ#==]ÅAq@C¸ëׯûùùY[['&&ªìʹú*.::zØ°a¨3×09r$‡ß:vìÈ«îñãÇ‘‘‘&&& .¬‹ß©8u|.^õu†âf ÇŸ®´´tÉ’%¦¦¦aaaõòð#År< á(ݾ}»¯¯ï•+Wê«PÔòFµÜÖ­[ë½n'OžìÞ½»»»{ZZZýÖ¤Wí, "\¿~ÝÑÑ‘VõéÓçîÝ»gÎœ¡Ó½8pàóçÏE›Q/wíÚ•:ÚÍÍ-;;[¼„¿ÿþÛÊÊJ__?<<œ ©D<{ö,88ØÖÖVSS³iÓ¦^^^¢ùz¤ÕGÚlŸ~ú)ÛàÞ½{½{÷fo iËT¾k=66¶M›6&&&¢o#ê.«÷./// €½Í›7ó!˜¬GÅU;K‚HP}ûö]·nÝ·ß~K¯?üðCM›6MŸ>Þ._¾\´Y‡/^œœœÜ²eKKKKv%“­ruu]²dÉàÁƒéµhj†›7oNš4éèÑ£ô¡óæÍ£UŸ}öw}ª]>eÊ6©M||<)Ž´Fr£·;vì í‹‹‹éuDD„øÔöööP¨Ó@®~C¸mÛ¶5kÖŒNëìûÏêQqܳ$°ø–¢/zMƸzõj廑©C###E›‰:tõêÕôvïÞ½¢U¿ýö Ûè_DS3ˆSVVF›µoßž»>Õ.?xð ý/›Ô¬_¿~¡¡¡ôv×®]ôvÔ¨Q>>>•ïžL¡ŽŽŽF¢ +ꎠ  ‘ßèŒ_¿Óµk׊ŠŠxÕ>õ¨8gI ×´Dô–¶WœxîOo)l«ºÊÆƆ>Hô–2M:ËŒ;vèСâ…K«OµË_¼xAa‡Ìc—.]¢Ô•Ê¤/˜™™ÅŸ´Mjj*•OÁ'ê4ÓÔÔdŠûõ×_Ñ üQ\¥l³$Ȩ8 +¨èíÊ•+«®bWäØkú8Z5mÚ4Ê:)0“(¼ÚúH[Þ£GOOÏ7Ò©“ÞÎœ9ÓÜÜüôéÓ´Í¿ÿþKKöíÛG¯ 8P§tíÚ•z™r >?‘Ú0ǘ%A>Å‘jèíŸþ)±ŠÍïгgOöÖÈȨuëÖâ…WÍa%ê#mùŒ3è5e©³fÍ¢·ýõ•6xð`² +ÛàòåË´ä›o¾aosss›4iÅ¥óÝw߉ÏZx¢8i³$ÔJqì§Ò»wï¶mÛ¶OŸ>,‹d«ÒÓÓ³³³ýýýEWÉKKK2åž»wïöóókÚ´)iŠÒOŽúH[~ôèQ–œ?¾òÝ•½æÍ›Ó[f¼Êw÷Ñé•R}üøqª•¡¡!'`¶oßþ^ÃŽ>(®Z¤Í’P+Åiii±ßRÃÃÃÙÍ$¢UNAšøÕ°´´´öíÛ“å(ëLNN&õQdE &©RZ}¤-/..nܸq›6mDWíØ…_ÊUEwëÖ- +óHŒööö@¢ +ÅAq 0QU:j:ç)' Å :´ìo«V­ 8(Šƒâ 8(N¹ôîÝ›RWqPÅa¼8(@q‚W\Ãؼ¡annÅ©XqP 8(ŠS™âØsO‰*€â 8Å(ŠS%âs"¨ãœPœ0رcÅÕâ7Âá¦8(ŠƒâÔQq111AAAPÅAq‚T‡» 8(N½'zŒZ„žž-¤óxYYY]8 ---KKK??¿ÔÔTŽú4mÚÔÑÑqÚ´i/_¾„âTƒ»»»¨ýGŽÉ1'ÇœÒfgà˜ÐAƉ$ 8 ‡â2ÞqâÄ Κ5kœœœháÂ… ëBqôAéééû÷ï_°`••-™}Ú±cGZÈ&Qªv:ïÓ:³CqªOT¹çDà˜ÓAÚì âHLè ãDPP\q¯_¿¦…ÎÎÎ*¸ÂsèÐ!Z8hÐ iÛPæBK† Å©^qÜs"pÌé mv†Jé:È8xWÜï¿ÿN ?ÿüóJå͆)í³è|­««kjj*± ………tˆuêÔÉÁÁáÆPœêÇ='Çœ•Rfaà˜ÐŠu­8²ÊãÇýõ×-Z4iÒ„©IY³aVJÿŽü©¡¡!¾8#FŒ(--åÞ (N¹PòHU¥ï÷œs:ˆgâ³0pLèźSœ8ôm¤ä‚ìTãÅ“Z͆ɡ8R¢ø6W®\!Á9r$""‚BÁ>úˆM ,Å©Å`J«SUéôôàÁŽ98æt6 Ç„P¨;Å]ù?nݺž±â(e6LŽD•¶trr’¶Í† h ÷׊S.™™™Ôä" +Ì8æDà˜ÓAÚ, :@q@e×âÄQâl˜Õ~» M¹°´m^¾|IKDa 8 DÅ)q6̪ŸE'}WWW}}}R¢´m˜W»wïÅ((]qJœ Sü6ã#GŽÐÁnkk«§§·ÿ~‰ú°Ûƒ)À[¿~}—.]ħƒâ”¨8%Ά)þÓ©ÏÎÎ.$$$//¯j}D4jÔÈÞÞþûï¿///‡âj«8a FŠóòòš„HË–-¡8(Šƒâªs7(‰*@¢ + 8(N>¶nÝ*þ»€â 8(NHŠ“¸ãQÌÑÅAqPœ€‡Ñ}¡8(Šƒâ 8(Šƒâ 8(@qP\ý*Žc¾†'_øûï¿­¬¬ôõõÃÃÃEC:4„© 8(ŠSÅqÌ×Pãä ®®®K–,[Õ¦r€â 8(N-Ç=_ƒ8ÕN¾ðÛo¿±ðŒ +ØЦr€â 8(N-Ç=_C¥Ì“/ØØ؈Øë†0•ÅAqj¡8îùdŸ|]‘½üTPœê×Ѐ┢8îùdœ|áñãÇššš={ö”øOåÅAqPœZ(Ž²HŽùjœ|!===;;Ûßߟ^ïÚµ‹ýWC˜ÊŠkŒ7ŽzyÆ õ^“k×®Aqr(Žà˜¯¡ÆÉ +Æįæ5„© ¸†¬©—ׯ__ï5Ù¾};Å!±±±ÅÅÅPœjhàwCq GqëÖ­ãCeòòò¬¬¬¶lÙÂ=h0ÅAq@ÆÏÅ1Nž<Ù½{wwwwv‡WwôîÝÛÒÒŠƒÌW_}E½¼víZ^Õª¢¢‚òV;;»Ï>ûŒÝ; +Å(ÈAHHõò?þÈú•––.Y²ÄÔÔ4,,ìáÇõ¥¸~„6o„††R/¯Y³†·5|üøqdd$‰náÂ…%%%P€â€ìL˜0z9>>žçõ¼v횟ŸŸMRR’øÃDHTUÀå€ÔË«W¯V‹ÚfddtëÖÍÃÃ#==]-‡é 8P¿„‡‡S/¯ZµJ]*L!yÃÖÖvÈ!¹¹¹|F¢£@î_"”¨8ÁL¯Ð¸qãV­ZU]N~£DR¼žTZ­>”cOeß#(H@ñ?õ²èrŠÀ `ƒ;;»íÛ·ËñK„'˜é(«vpú_qÅY[[+¨8ñ=•} 8 ÁäÉ“©—ãââ¼”"¹»»÷èÑãäÉ“õ¥8ÁL¯Ð§OŸjµàáá!JTŸ?Nµ¹ÜŠ“ØSŽ=¢Œ•ÞÊ÷K:×p·xñbaïfyyùæÍ›)0 4'//OõŠÌô +TÒ—……Åš5kŽ9òË/¿°Á“’’¨´qãÆQ=GM¯©ÁåP\µ{ʱG^^^´åž={ä‹ŠkL™2…zyÑ¢E ag‹‹‹cccMLL¢££ŸW__ýúõôÚØØ÷óòåË_~ù¥OŸ>fff‘‘‘YYY0Å¥§§£­Ôö›¦*?qõêÕ:::ô¡îîîyyy´äÙ³gì‘.ªLDDÄëׯÑ/ ®ÒãÇ=ºY³f¾¾¾)))Ò¾uPW«äTt/\XX˜Äõ·•+W6nܘVyxxPÖ€®uÁÍ›7¿ûî;;;;—eË–=xð€{{(Š“‘ÌÌÌ6mÚÐgI» îÌ™3¶¶¶,i¥+z(‹W¯^%$$ôíÛ×ÔÔtâĉôm”ñ¡8(NâããYrêæævýúuŽ-)i2dKZ###‘´R²Ó˜1c(!õññINN®í7 +Šƒâ¸yþüy`` KN'L˜ ËÍ!ôµ\±bKZ»v튤ÈÁ­[·æÎkooïìì¼dÉ’û÷ïËWÅq••Å’SCCÃíÛ·×êOŸ>Í’V:ÿb% {Bºyóæ~ýúQB~öìY „â 8i¬Y³FWW— +ïܹ3wr*§OŸ²QЩ’QQQHZGäâĉ/¿ü’NˆÞÞÞ»víRÖÍäò)Žþ¥]»v5n=lØ0EJ½@ŽU2~®Œ%¨ ñúpÔ­.GÉ)}KNCCCKJJùê._¾\”´Þ¼y³á¶“&Mjh÷gZZZÖ¶•nß¾=oÞÚxàÀ5²µµ=|ø°øª+W®tíÚUKKËÍÍ’ ª×Ä8Jxûömll,åéÍR âÏcr¬’ñZG ¬Jׯ_wtt¤½îÓ§ÏÝ»wÏœ9cggGo©žÏŸ?¯|wXpp0UXSS³iÓ¦^^^¢GÑY ÿý·•••¾¾~xxø›7o$*Ã[cŒ9²ÆúTÛ’JQܹs稃­[·ÖéWŽÚÄÚÚš>‹Îã{öì©£³Æœ9sd¿ ÅÕâ(!MLLìß¿?}«'L˜@‘Š+&¡¸)S¦Ð—œŽµÊww{ÒáCG4ÉÞRH©§§W\\\­ è¤<}útJsè_è_Õ¡C’vrrrË–-©Xx c †††¬Y¨VìÑïWɨ8ŽX•úöí»nݺo¿ý–^SCyxxlÚ´‰*Io—/_^ùîYú=z4''gÞ¼y´œr1ñ\]])Oa¿*Ο?_¢2ôïì +¹«   ÆúTÛ’Š+Žö‘z–Õ677Wߺ'Ožøúú²¤•°ªüWÅŠÔªP\ý*Ž:¿òÉ'Û·o¯¯á¶$wðàAz{êÔ)zݯ_¿ÐÐPz»k×.z;jÔ(i1ØÏ?ÿÌÞ²[¡ÄW‰¢‚Õ«W‹¦–¥„GQÄ]5wãX%£â¸K`¯ÓÒÒè5€ôš$põêUz[^^Nÿ)QrYYmÖ¾}{ñØ¥u +öè_(LâÈFe©Oµ-©ˆâ(9 + +báâøñãë"9åHZIþ´ÓGwïÞ]‰I+k+:5S">§zÅýñÇ/_¾¬ßŠI(Ž¾óôÝ xƒq—.]¢djìرt\›™™Ñé^šâDß%Ž+H'Ož]}•¥„ÔÔTzASÕ£žc•ŒŠã.A¢4‰£CGGG¤¸ .PvIMÄžO—Ø)Ñ¿P´FíÉ¡¸ZÕG¼%åVÜùóçY±·ÿúë¯õòõ£“©(ieÆV–âXìýÓO?Aq<¹ÇÅ=zôðôôܸq#¥EôvæÌ™æææ§OŸ¦Íh/¤)N–“¾ÏôvåÊ•2–°oß>z‘P«U2*Ž»Gß^Z5mÚ4JT)ÓäØ)vEŽCqµªxKʧ¸õë׳äÔÅÅ…E§õ%­”°¤uòäÉŠ'­¬­ŠŠŠ( s>|ø°ÚN\»v­½½½¦¦&ý¥×P\ÃQÜŒ3tuu)K5k½ý믿hƒÁƒwîܹÚC^vÅ‘6éíŸþ)c —/_¦ß|ó [ž››Û¤I“Wɨ8îdTœ‘‘QëÖ­Å7e£â%<~ü˜¥ž={V­%¶,‚­U}$Z²VŠ£ÄaäÈ‘ì¿‚ƒƒÙÅÕú…v?..Ž%­t†½}û¶âŠ£‡¦ŸþyÕNܼy3½¥Ø;++‹þÒëÄÄD(®(îèÑ£ìûO‰ »ÄD§BzËŒ'‡âØyùîÝ»mÛ¶íÓ§KHe)¶ìÚµ+}:åeǧ円†5®’QqÜ%Ȩ8êPrW||üîÝ»ýüüš6mJg6ˆ+!===;;›MÏ.i]ºt!7²×^^^´jÏž=<¨±>ÒZRvÅQ´É¤JU­‹ƒZèdJ±.Õíý÷ߧ˜VqÅìJã‘#G$:ÑÍÍŒÊ.±‹3Ô)P\QÖ7nܦMÑÅ1ö=¡\U>Åiii±_ÃÃÃÙ½²—pëÖ-Š'éHÙÄd\%‹â¸KQqiiid ²œ³³srr2IŒB/ÊëÉE¬–Qh'í"[ff&½¥(0«±>ÒZRFÅmØ°'É©4(Üõööf6eÊù’Vñv»ÿ¾±±1µ'}«Å;‘Ý›$~¥”úŠk ŠSw”øôœRÒ%ÕìoÉ)åklËqãÆñ!9åHZ/^Ì’VJíïܹ£`˯_¿žÞ²[}DŠ#¡‰+ÎÚÚŠƒâÔ…+Ro¬ (N<9ݲe‹Zt"eë­[·fIëþýûiùòòò^½zQl,®8Q¢Jñ0…Çîîî²7oÞ´’—ƒ`@q@õŠ{õêÕ_|ÁÖ~ùå—EEEÕ~c3ªðâÅ G¹3fÌ çdfffeeÑkZÞ¯_?–´.Z´ˆÙ‰"1“ÖjD‰DµòÝM#ìÉ;;;;ÙoaŠcèbbb8D÷õ×_Ë¢8ÚkÚLTÚkv%- ˜|ûömö<`=æPàâ.\¸@q›çTZ|R¿ƒGq|z«V­Hk¢·þù'-¡MLLØ#Òõˆ¸âjŒŠ+++322>|¸èJ ›àLÜ{7n466¦-¡8(ŠûùçŸYrêäätùòe•J9^ž={¦««K‘•øÂG}úé§,i¥$Kö¤UŠc¼ÿþûóçÏ—€eTáããcnnÎ.ÇQÞJÆ»ÿ>íì!CØ”ÔûûûW½’V_ƒ`¨â0°¹0GÉé¨Q£Ø’1cÆTMNk¥8i÷ÿ×x›ÜÇË›7ohmÕ +éð_¸p!KZ?øàƒ»wïòJqÕŠNvűÇdØ :t(½ 5R›”——S£‰º€ƒ`¨â€ºSùî¢zÇŽYr*þ ·â$~w~úô)[ËqÿŠ“ïxyùòeÿþý­¬¬Nž<)­Î¢¤õàÁƒ|Sœ„èdWÜÙ³giËuëÖÑIªqãÆì.ÊÙ³g³gX233é…hœ®zQP}GKN/]º${ª(ÁªU«ØZŽûÿkTœ|ÇËĉ™r¹«ME}üñÇ,iU‹³,Š+++#ÿ±G•Ùül°…Y³fQøJgñ¯ßA0 8 FŠ“¶–ãþÿ'ßñÒ¢E kkë«MŠûä“O¦8ÂÛÛÛÂÂb„ tr¥öFFF”®zzz†„„p(Ž£/D«”8êåZœ|‰ª´µ÷ÿË~XÕêx¡£C4Ät‰ª©©é¡C‡“¨V¾»©˜M 4cÆ Ñ€€29¥®â'ë} (ÔãÏ ÿûßÿØ’±cÇ*òsÇýÿìY öé‰'ØoÊ=^ª"쟈þù‡"~)rÆ ´DSSóÙ³gò)®.Á€âaëÖ­µ}`Š«‹›F8îÿ8p ›aÑ¢Eô-[¶¬Qq²/·Ü‹n¡ƒ<)¼›FXZJmÒ¬Y3ñ½»sçY¢Çë} (N‘V]¦ræ­â*ÅnýmÚ´©Ü·þJ»ÿÿôéÓ´œb¼þýûçççË’¨Êr¼HëzÊ­Øóªõõ+*·â¿õW@qŠ+ŽoS9óYq•2<ÀÅ$યäTšâ”õÅAqr(ŽÁñ>Ï ¿~Ÿh¨ª8Çâ 8(®®W©þƒ)Õûs©âÔj0%(ŠãVÇ#?òÍÑœ‘‘Ñ£G===Ê}¬­­/\¸ ci5ÎÍgÅU6°!1ùÅq+Žã‘ùæh¶°° ¿QT@ÿµgÏž‚‚K«qÎhž+ŽÑ@6‡âø£8þÌ£ÊCÅÉþˆœìs4‹ÌV-Õ–V«9£y«8‰¤5))‰WLjøô4¸qŠ£€2©O?ýtûöí¥¥¥P\¥ÌS9WÊ5Gs||<½ÖÑÑñõõMIIJZÆÒ8æŒV ÅU6€I¡8^%ªEEE‰‰‰ýû÷711™0aKÊ ¸Êšù‘{Žf:|èi›¨¨¨Ú–&Å1DSESF/°©¢¡8^)NüЋ‰‰iÛ¶­££ãâÅ‹ïÝ»×ÀÇýÈ‚s4¿~ýÚÌÌLWW·V¥ IqÄùóçÙÞQþþ믿ÖKåO:emmÍnÃ`ãü (®Úˆ=##cܸqÔムڹsg]'°¼U÷#?òÍÑLyÙÁƒ/^¼H‘³¶¶¶‹‹‹Œ¥ Rq•ïFIb“äãÇgã%ª,9¥cŸ%§Ý»wLr +Åɸ=%°[¶lñôô¤6,,¬î&Eâó/ªüÈ7Gs`` ……-§¸…’#Ñ´ƒ5–&TÅ1Ö­['JZÙÀ³*HN}}}YMš4IHÉ)WÛ¤³Û¼yóÚ´iãääÇÆʰ⧡Ý!¬¸âˆsçÎÑé€%­¢qb눿ÿþ[”œîÙ³GÀ]Ã'Çt~ Jq¢¨þĉcÇŽmÖ¬™··7…ÊJ`¡8(N”´Ž1‚•RI+}—-[Ö¸qc–œR”.ì®aŠkP(~ëï«W¯6oÞL雩©ixxøÙ³g¡8 T6G³ÀÇX»v­®®.Ø©S§k×®)±žOŸ>ýì³ÏXrJǾP“S(NY­GgÀï¿ÿÞÞÞÞÙÙ™’ýû÷ïCq å*ŽÈÎÎnÛ¶-vÛ¶mJ)óôéÓ666l²{vW6¨;ØtB?ýô“ö…"²Ó˜1cè›ããã“œœüúõk(ŠSçÏŸ6Œ•ªHÒJ_ÑåË—³ä´[·n7oÞD—Aqò%° }ûö¥6"""33ŠƒâäÇdIkçÎE¿>×69e SrUÛó/€âªBgÉï¾ûÎÎÎÎÅÅeÙ²e<€â 8¹ÉÊÊ%­Û·o¯Õÿž9s†M2H)ÆîÝ»ÑSPœrØãÇ=š¾]ìyLi'P(Š«1i dŸ2aÂY~ʧ¯ßŠ+XrÚµk×7n › ¸:âåË—›6mêÓ§™™Ydd$”¡8(NâããYÒêææÆ´>{ölÈ!,9¥¯’S(N5ЙtÎœ9”8˜››çääH(¨;*ø +eff¶iÓ†>ËÈÈhÇŽÜÉ©±±±øÔŸŠSY›––öøñcÑ’Þ½{ÃPœìI+lŠ “HZW®\É’S$§PjÊêÕ«uttè rwwÏËËcÉ)ñ€’Óˆˆ$§Pj %­lœy}}ýõë×[XX°ä499Å + D™r—.]Dsú(a0|øp:šëkd~ÅPw¬[·Ž §‰¦€â€â 8 8ÅÅAq(Š@qPPáëë«¡¡qæ̉å+V¬ÐÕÕ•oŒMÅÀÅåççëè踻»—••‰Þ¼y³I“& ,@ÓAq¨{¢:kÖ,Z»jÕ*ö¶¢¢bÀ€... aú-(Á+®¨¨ÈÊÊÊÐÐMq¾iÓ&MMͪ©+€âPGÅ»ví¢ ‚‚‚î߿߬Y³¨¨(ñµ¥¥¥Ó§O' jiiYXXÌž=ûíÛ·lUFFF=ôôô´µµ­­­/\¸€Ö†âà›â(9õôôdÓx‘Ê^¾|)¾–Ôgnn~êÔ)Š÷RSSuttæÏŸÏV‘ñÈoÈÉÉÙ³gOAAZŠ€oŠ#.]ºD‘mF¾_~ãÆ Z'ZâãããààÀ^ÃlÜ$%%É>44õ DÅíÚµ«:ú:Åf´ÐÄÄÄúÿÐ×קȭ§ì•â:6…Eƒhíª”••µoß^FÅ=-€ÊwèÐ!Z¸téÒëbˆ‡·oߦµÎÎδ™ÄEjÔ¨cÇŽ?þðáâKsÁÁÁ¼xñbbb"E ...hmiP!„€‡Š«¨¨HHHpww§pNKKËÚÚzìرlU`` ………†††ŽPî@Žµ°4è$‚V îê1C'à@!PœØ²eKµ!ܵk×Ð8@q‚ äþ÷¿ÿ¡e€âÈ!„ŠX çàà€(N𜦦&B8 8árFFFÔ)={öDkÅ Þ½{S§ÄÆÆ¢)€âFii){dõ‹/¾@kÅ ‰ëׯ»¹¹‰~n |þü9š(Nìرƒ]…³´´¤~Ñ×ק×mÛ¶ÍÊÊBãÅ©urÆ"·¡C‡²È"ºÎ;Ó]]Ýü­§Žäåå¹»»S/èèè¬^½Z|UIIIhh(SßðáÃ_¼xæŠS#vîÜÉ’S{{ûÌÌÌj·Ù¶m›¡¡!KZ³³³Ñh@qj‘œ†‡‡³-  °°cãk×®uêÔ‰%­k×®EëÅñ™üü|QrºjÕ*Yþ…’Ö¯¾úŠ)qĈHZ€âøÉ®]»XrjggwöìÙZýïÖ­[ èÎ;‡ÆŠãUr:qâD‰ùûûs'§ÒÈÍÍuuu¥ôôô¨ûЪ@q]/uزe KZ;tèpáÂe)îÛo¿¥¿?ýô“ŠWRRÂbaaAßØþùçÍ›7üét +/sss“““}||455©ž;vTJË(ŽWÉitt4KNüôéÓz¬Œ(imÒ¤‰¸”Q\QQ¥cÍ›7øðaµŠ[»v­½½=ãôWYÒ¾}ûöã?f7nÚ´‰ÿ_ƒË—/³9ÔŒŒŒ”~Q@qõ˜œvëÖ%§Ë–-Ser* 2ÒرcE“¾zõJAÅыdz¸ªâ6oÞLoé³²²Øç&&&*¾,ïÖ××W£!V(¤pŽªÝªU«ÿýG§îìÙ³‡b–œþý÷ß¼ª™‡¬HÒ*RD¯9"¡877·F±«/^¼ÐÖÖîÒ¥‹‚•ÿùçŸY Ê·V•%¹fs uïÞç;(Š“û|ýõ×_³äô³Ï>«ßä”#urrrb® i(¨¸û÷ïS*Z\\,®8ò¥±¢!ÛSj©HµŸ={fffFA–VÇïÆ“'OØUY5­?nݺEçhj=:º—.]Êç“5%­cÆŒaIë¨Q£j›´Š+ŽX¿~=½>}º¸âHh⊳¶¶VPqQQQTþG}¤¾QPBBí¹J ¸zaïÞ½,9¥cùÔ©Sêrı¤µcÇŽ/^”[qååå½zõbw¦‰çáá!JTŸ?®¥¥åîî.ú—7Êþ3(•Ãn©U=ùÉ™ dªø/>ŠSer:yòd–œúúúR>"¡‚ª(ë¹{n¢££‡ Æ^GDDtèÐ Ò¥ÀÀÀ‚‚Z~éÒ%GGGv_ö(%Gy$—””DoÇ—=zôh‰ÍËË‹ A@»,¢Û°amß»wo>ôøÖ­[÷ï߯H GÑ>(N-¸}ûv=XrºdɉŠ© £ +ª¹ã]\D3fÌ çdfffeeÑkZÞ¯_?QÒÊDÐ z+‡â‰DµòÝM#”«jjj’Ê$naŠc0ѽ}û–ã?øà¥\Å’û¤#¾kŠÜþGÍËâËÏÏÇáÅñœ}ûö½ÿþûÔ\VVVýõ—Œ*PŸÞªU+ +ºÄ—üòË/,Æ£ ŽB»º®›¸âD¢ûù矫]qq1A(ÕUüé ¹O:Ó¦M£S˜âŠ#FŒA%`ðR(ŽçÉé”)SXrêíí-žœò_qÏž=ÓÕÕ%¥H,§d³cÇŽ,i¥|JÅŠcØÛÛW݉'hU§NêTû²£ âV­ZÅ~åÁqÅñ“;wîôìÙ“%§qqq?ðÕx@I»ÿ_âÅß²×÷îÝ8p »1ãðáÃl™!66¶M›6&&&ó0iT•s@@­MII©ZŸW¯^Ñ¡Çþq̘1²$­ÊUœHt›6m‰Ž™N˜0AŠ;{ö,‡ÇCöïß/JNOž<)ËuåÿGt³Çýÿ5*®[·nÓ§O'+²A-تˆˆCCC6LùD!q8S¢×¿ÿkNqT“&M蜜._¾¬zÅIˆ.22’Þ._¾¼®Gñmpp0»~Ø´iSª¤èŠ™²®ÅU¾û}™J òq4Aq¼‚Žµ©S§²ätРA?–ñ€’@4‡ Çýÿ5*NtË.lÕ£G(6‹ŽŽæ8œÙT8# U %­:t`ÉðdÈ¥Ü1Ë}Ò¹yóæ¤I“Ž=š““3oÞ 8îÿgqËœ9s-ZD¡TË–-kT™¶k׮͛7§Øòøñã´ÜÐÐPâÓÅoîªöú?o §U +N5+KQp.zK[:88(]qta£Íã8‚âxå†ì¹T¹oý•vÿÿéÓ§i9Åxýû÷ÏÏÏ—%Q­|7@¿~ý´µµI¨úéÇ&EM¼½õ7&&†6ÿ%¥ŽG‰<õE||üîÝ»ýüüš6mJá»»F‰Š£S Û_APÿá~€K-ã.å*®Æ¸~ÿýwڌڹ®—––Ö¾}{²œ³³srrò®]»(Ù777§ ]‰ŠcÏÛŠPÿ“ÖI“&±¤ÕÇÇGÚ“üD¾Çð•¥8Ãþü9iGGG§¤¤D_väÊ•+qì@qjDƒLIqj;˜RçΩž{öìQ÷ï «ìÊjff&Ž(N½h8Cbªö[§···ºIvïÞÍÎ)8^ 85MZE›ûúú +u`sÕóèÑ#JT)]½sçŽZCØoåË–-ÃÁÅ©/”O±Qú)iåóô4ê5‚î_|AÕPß/Æ¡C‡Øôˆ²< 8>#ìIë…»wï² ¯ÓÓÓÕñ+QZZjccCõç¸5@qj„€§Š®/.\H»`ff–——§^5///6l»íPöYÇvïÞÍ’V:ƒŸ>}º^ê°eËÿ(2w*xûö-»ÛÄÜÜœÍ=¡P JÕ644ÌÉÉÁAÅ /iíÚµ+KZ—/_®Ê¤µ¸¸˜MÏæ¬W|`ðzçÅ‹ìŠåRSSù_ᇲŸ¨÷Ù„ÚŠdÒÅ’Ö!C†<{öL•É©žžÞÆÓ˜=úðÃi¿¨=É$:Jy¹eggGGG³¹›7ož––†Š6)))lö%[[[66oÝ‘˜˜È’ÓöíÛ /9"Lž 8>³sçN–´ÚÛÛKvÛ¶mlv-JN³³³Ñh@qjD^^ž››KZW¯^-‘œ²º‰áÇ#9ŠSÓ¤5,,Œ©lèСϟ?§…ׯ_gO Srúã?¢•€âÔš;v°„ÔÒÒ’ú…ÖÛ¶m[$§@q€"7–´2† Æ":' JJJÚ·oOòÅ_ 5€â„›sA}$ŠPP€â 8ÅÅ((@q@q@‰ŠóõõÕÐШ:™×Š+tuu¯_¿Ž¦ŠS_Ååççëè踻»—••‰Þ¼y³I“& ,@»Å©{¢:kÖ,Z%E³¢¢bÀ€...oÞ¼A»Å©»âŠŠŠ¬¬¬ ÿûï?z»iÓ&MMͺž‡(¨Fq•ï¦~`oÝ¿¿Y³fQQQâkKKK§OŸNÔÒÒ²°°˜={öÛ·oÙªŒŒŒ=zèééikk[[[_¸pM  8À7ÅQrêééItîÜ™TöòåKñµ¤>ssóS§NQ¼—ššª££3þ|¶ŠŒG~;pà@NNΞ={ + + +ÐÔŠ|SqéÒ%ŠÄhò•øò7nи¸8ÑöÚÀÀÀØØfPà¹âˆvíÚÑ6 )6£…&&&Öÿ‡¾¾>Enlm||xðàÅ‹µµµ]\\ÐÔŠꥸŠŠŠ„„www +ç´´´¬­­©4¶*00ÐÂÂBCCÃÀÀÀÇÇ|(ðVq(ŠŠƒâ 8 8Å ¦Š<ŠŠƒâ Š™3g’æ΋¦@qÅP@qÅ 8€âŠ( 8€âŠ@qÅP@qÅ 8€âŠ( 8€âŠ@qÅP@qÅ 8(ÅP@qÅ€âŠ(T@ZZÚ{µáäÉ“h4€ѧOýæåå…æ5CPG>úè£ý6`À4@¨ÜŸþ‰†2CPkŽ;†Ð¹þýû£qB ä„Aï޽„Êü!¡¸ŒŒ 4 @B8€€9„páaeeE~³³³CS„ÇçŸNŠûòË/Ñ>pëÖ­àààž={š™™½Ç'Z´hAµ?~ü;wÐM€ÚrïÞ½ÀÀÀ÷ÔaÆý÷ßè2€Œ$$$èëë“=š4iyðàÁÿý—W5¼{÷.ÕjâĉTCª§ARR:P#+V¬`ÑÑ!C^¼xÁóÚúúú² +¯Y³Ýà 99YSSSCCcéÒ¥jTíÅ‹“â´´´öìÙƒNHËþXÞ·páBµ«üܹs©æM›6½wïºPÊLÉ~~~jZöëº ÁÉ“'Ùuû‚‚5Ý…;wî°_INŸ>ˆ3hÐ ’Cll¬ZïÅwß}Ç~(A‡Dܽ{WKKKGGçÑ£Gj½#ÿý÷_£wàN9€ˆ (å*VYYÙŠ+ºtéB £††FÓ¦M¿øâ‹ÒÒR¶A»víèƒÄ_3H°–––~~~©©© +Ö]QT¯_„uÊÇLZرc‡‚åDGGS9ƒþí·ßŽ?¾k×®Y³f¹»»¿|ùRšâ222ÒÓÓ÷ïßOšeÏéOž}Ú±cGZxàÀ¹ëpãÆ *ªQQQÎ\¾|™œ`mm­xQ”™’å8ž‰àVqèÐ!Z8hÐ EªÑ²eK*$// øý÷ß•5oHHåää´uëÖW¯^É¡¸7oÞèêêR ¦H5ØÔ)£sÛ¶m#!*^Tiiihh¨––¨§§ççç·wï^J„eWakk«¡¡¡H5L%'''£sñññ$R“² +ü÷ß—/_þÁ°_K{õê%ºEÅÙØØ©À—_~I%oØ° øá‡HaaaJ/ùúõëŸ|ò ,{¢ª££C©®"Ÿ;~üx*yíÚµè\@RR aĈuQø“'OØÕ9—ššJ 'Mš¤È‡úûûS!;wîDç>LBðòòR¼¨»wïV]B…{zzÊ¢¸çÏŸ»ººêëëß¾}[‘jôéÓ‡Jþã?й€sçΑ/JKK‹2Ó¥K—8p ==}ëÖ­]ºtÑÐÐ8xð 4Åe¼ãÈ‘#ô_¶¶¶zzzû÷ïW°666Tòå˗ѹ€·oß²ç­@•4åçç׶m[2IÆÐЂÃcÇŽ‰6ö—¶¶¶]HHˆâ7³Ý»w}´ø/¹€†ÌG}DZØ·oŸö%99™öeÀ€èVcæÌ™â¿{ª5£G¦}™;w.ºÀ¸rå +%ª¢çåÕ”ÂÂÂ&MšÐ¾àé-€8~ø¡î%c÷ø‰~À{Œ«eË–©é.<}úÔÔÔ”ö"%% +§¢¢‚=r©¦»JõïÛ·/zP•sçÎiiiihhüúë¯jWù„„ªy£F.]º„®TËòåË)"Q¤¥¥©Qµ=ª­­M5ÿñÇщ¢¢¢Ød +sçÎåÿݳeee³gÏÖÔÔ¤:O:Ýà†´6sæL& ;;»Õ«Wçææò°žW¯^]¹r%{V‹„Œùh²óÏ?ÿ°ÉbmøÕGT7²\VVº PÛpçÎýû÷gwbð 33³¤¤¤àYTáÿa%™endstream +endobj +4833 0 obj << +/D [4831 0 R /XYZ 85.039 786.531 null] >> endobj -630 0 obj << -/D [4663 0 R /XYZ 85.039 616.318 null] +4823 0 obj << +/D [4831 0 R /XYZ 85.039 763.817 null] >> endobj -4666 0 obj << -/D [4663 0 R /XYZ 85.039 580.908 null] +4834 0 obj << +/D [4831 0 R /XYZ 256.898 524.355 null] >> endobj -4667 0 obj << -/D [4663 0 R /XYZ 351.735 437.513 null] +4830 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F64 4225 0 R /F18 4228 0 R /F41 3054 0 R >> +/XObject << /Im7 4815 0 R /Im1 4209 0 R >> +/ProcSet [ /PDF /Text /ImageC ] >> endobj -4668 0 obj << -/D [4663 0 R /XYZ 85.039 369.239 null] +4837 0 obj << +/Length 2386 +/Filter /FlateDecode +>> +stream +xÚÝYKsÛ8¾ûWèHUY4Aðytb{×S±ãÉ5[53X¢lŽ%Q!©8þ÷Ó/€”E9©ÚKvÊèF£»ñõ°ð§FYì:¥YâÇZæë“`ô”(áF‘$1’>ÌNήâd¤?òÑlI,³ÅïÞÇŸßÍ.O´ÖžRþx’¦™w>3ïãÇÏ÷·3¤DÞõíN}þõf¬€šiovýù–iH¹È›!áüÃx\|”¨á+jó]ÔªÔÏóðx£­Sõ£vøö-÷x“KÌYØpÏbÏŽi¨'àž;ðê£ý¶z¯ßÖÿÀNêÙÕÊH.Eö› SÛ]Ù6«'×Ï%­Û;\×hq±"Øâõýÿ«¥’m¯f-v¸™Œ "¬.öÖ,˪¶×Šãýíõ%'òôW®u•v¯+}ØAÈì§êÑz–êžl|5»ûßæ?¡ou&¡œ%oý”Å®+]Vox ¦ýž‡€Õ…ÞˆŠ•Kõ-ËvÞ‚1xKŠ|ÐuËŸFuKAfË,áhCòp´¡M8Óuɸ +:þäðþyÚ+–U$¤–kÍzFÔ"ßÒæî~¿ÑëO6{¨9ÕbLS‡?e·ƒë.ÍêÝœÿþãJ 9?ÙËùÊϱ=Ìù”ñãÀ»1Û­»C¬Ô<ºF/°?¨tQÌJäqà~à³ÅLO9¿(6¼ß§<„«Ò‚Þ_^lx'‰d8Ü Ãs¨Bèð˜‘Zù™Ê¿SÄ»Æ5 CWSmUçÒJ$Q—³Oœæñľñ4÷4_ðnSvýÒè ‘eçÄj‘ꎳ«üè>KÇ º¿¾ÀØ8噿œŒ–'L#¢D»›)þªƒ«'ªq;‹Î ø6€z/ÊÀ”/¸MY2úG©7å7F¤Õîúƒ„ë÷ìˆ89LÙ_D¡{׈õŽgœÜÖ¤¥CTÄ^Dò¿¹9¡Šia”ðUÌ`ñÜÚÐÄxwÀ_òüþF÷ ¾IpÚíÐ1;Æyï9Ètã hú%]Øà$”rªGiW >?8Ñ(Œ°Õ†AxSôGæ=ù<¿á9ÏõÉûwO¤ŸÏ¹™Þ±ïyò†|Í™änœ[¤ÍƒáìÅ fÎïÈ»±=À iü-ªš~è7€-2çÝ[„û(xlzzçž0À-™Ü‘¹s¤¶Ü$ià7̇Ç"CS[‹E¯ çeòûäö|k)ÏSx/)ÝËÍÆàÇå ôšëç‹Ós{‡§ÓXÌÀÑÜØ‘”›³«8륢<ñ“4—|„Lâ0Ôᨙ×%\.há^Ë!¿å‰,”¦Ók¼6° Ù¼â_Úµ‘ž1M½Ò-JºP.N¢¬Êf%\ùyJ@ãë ùk¢²ÌÓxÏmEïYÙ]¨l³Æï%<ž;|7ûí¬<ühoÅÏ/s¾9iŽ¾l~ÙáùÚnÛ ó÷^S°ô¸d(œé #Ô¶M í¿cn? zé•'Еø+‘§´Üzyù^2J9_kö5†Ž­nTqæžIñ`Æz)R¨“5"…Oa˜÷Фu懙²pZ¬1ò„ãÊÔ!þ¢Ü“Ðw³¾Š’C™”àdb’ñ“,ßÃÈ–®7†¬,Zî*À»å†è¾€$÷ƒ,’›õƒG²R>†æ >z¨ áúV÷ï°0í=V:`À,Åþ> ÛZ*}lmÒE ¹ùƒY:øZKCsPèÅe×Zy®gåvÛ¢2Q*S·jÝóðÞY›µ4ÜÖ„ÆÞíÛÃ^øa.m8¼<öÂx¯~¼ˆÌe]­{]kï/ëªí=ºÙ¨Ü¶úÿ s²ïp{'vÿoÿTÖ© ˜t²ŽwŠJåoUìßÓ¬‚fwýendstream +endobj +4836 0 obj << +/Type /Page +/Contents 4837 0 R +/Resources 4835 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4812 0 R >> endobj -634 0 obj << -/D [4663 0 R /XYZ 85.039 352.003 null] +4838 0 obj << +/D [4836 0 R /XYZ 85.039 786.531 null] >> endobj -4669 0 obj << -/D [4663 0 R /XYZ 85.039 309.05 null] +646 0 obj << +/D [4836 0 R /XYZ 85.039 724.712 null] >> endobj -638 0 obj << -/D [4663 0 R /XYZ 85.039 215.279 null] +4839 0 obj << +/D [4836 0 R /XYZ 85.039 690.568 null] >> endobj -4670 0 obj << -/D [4663 0 R /XYZ 85.039 178.412 null] +650 0 obj << +/D [4836 0 R /XYZ 85.039 485.008 null] >> endobj -4662 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R >> +4840 0 obj << +/D [4836 0 R /XYZ 85.039 451.47 null] +>> endobj +654 0 obj << +/D [4836 0 R /XYZ 85.039 341.361 null] +>> endobj +4841 0 obj << +/D [4836 0 R /XYZ 85.039 306.615 null] +>> endobj +4835 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R /F58 3380 0 R /F59 3455 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4673 0 obj << -/Length 1972 +4844 0 obj << +/Length 3102 /Filter /FlateDecode >> stream -xÚµYÝ“Û4Ï_‘’™FH²å¾µ¥…cèzéÀ åÁ;‰ibÛ¹Ìý÷ìj%EN|>è0%²´ÒîþöS:1åðŸ˜&Šñ ÆIÄT ¦«ý„O7°òýDŠ…!Yx4¯—“oß©h*8Ky:]®Ý9)g*¦Ëü÷Ù›^ý¼|ûq¾‚`&›/â8™½šËdöæ͇O·K\ g7·ïpêÃÇ÷s«I0[Þ|¸¥µïpæÂÙ^½ž/€æßÞÍÿXþ8y»trzšˆ @)ÿšüþŸæ Ñ΂4™ž`Ì™HÓé~ª€©00ß»ÉÝäw­…SÚ5Š -¦’à¡PQŠEa¬Q9dm{šËxV79èñ™+@Tùö]$½|º1ãÀ7µûy g÷°¶´§œ6ôXE!‹À"\Ó¯²Š`¿Ÿ/Á‚>ŽmøåôÕÕ/Ÿ€0JSÆãhÔ<­v(ý’;£g×Í>Ûõêº1ÝŸND ìð¸Çtñ¬xIªßg„ã’Dûf¾PRA»Aèú‰$Û!Jnv9ݽMM ->òÒl.V 8à5–9é;ìêlÜjÕ ¤v^ìO|ÑI›zgðx˜«h–íŽçß-ú)a[šóààcsF»\6[:„lkÎÐ š½2¶rÜ@˜i‘ÏÜÓÈ’º·Å鶟û°U–àŒŸE^é>‡"ëˆæßœ6jDC¤@rÐwNó€Ã*6¯µí.Z骺£Á>ëVˆÍ?!x¶ͯŽMc¯Ð Ðw ¥¸«uN„kmX+jfØaæz‚I2¼ÏR;Êi<õ•+Z_µk×'å°ÌxÊÁg‘ù_uߣ^X7+*7α4{*w&¬u”›8¾÷Àê[†ë˜1+°wmøu{†šœ^׿ÍðËÜÚ.·wX{4So@0s³æÑäš¹0Ñj∗NWHků«Ù£Íº«É VÄ ìWmll¯‰#ÀSÚªnv8ññâ‡?„^_ÿt@ÐÎ¥[ßëübæÉ“5Ú2íeb/ÖsZ¥&ÃÛÝeË àÌÖ‡á¨+¦a"k6È^o/È÷_Жö@´²®u÷²¡å†[sº-Ñ\»GF‡Ñù)Ô¸& xðÞ±@™ò,Fá.ôDãH§²¥“á‹z -Ü~å„p¿AŠ_µ£ã> 6Ž‘îj\Ö¨Qy™&x·î—@㦼¶^¯}÷Û˜Àåƒ9 ÅÍQ¬um$ -ûëÜM¥%ÿ2€ŽK~‘4É>âCQ -³~ºB#F˜oÂÄ‘ívZ@à}ræŒDÏÙ"¡­[Óìf毻ƒ­ŠHåj¿[=mÍi:¾póƒõN·wSwÎGÈ߃ž× àrñdÑ’µŸ~³Hÿñ›…bJ¦ùD/ …„»gk…ÙTEN“èuøkÀø‚_Ó­ Eì¢'Ö.Ntv*³Æl"Üqøéöæ7õá E@p"3½„3†ÛµþÆX -r‡*•7tÁº8kM"¢ž!chªˆ…ÒºªµÊÐØz&[(Î!@5ºÛ té + í@yã,ßkç-ۮɺÒù’r`¡ÿCí¶hAœïŒƒï胳ѹü¡<³£5·^J,uºTžg£C.Œr>»âÁ•°ÝSÙÜ•7J.aé2”²{ÔmWê\MÒ U’^·ª‘­SÆó¢ËÊ]kª˜©›Ç¶¬6fR1×4þ¯žõšbmËnW÷º‰-ía`5üÌw G^ÀÍ*ÔÆô T®ÇZ_ôÂB'\]– -÷R9p U"ÇŸ<})“°*XŠÝ­{(ZREï°0à.ÑoŸ-µQ -B×6ËïõO¡û“ŽVÞÔû½n*ò§ääœÅrüyΣÑröìgŸZ˜  ¥‘$Di†zí.BöòœÂ»\(B?XpV×zìjñC?ã"‘kÿBy-XN«ÔiÍ{¡WftèGP»otKMËV ³ü̺¦¡½ëé­xÁ…ê?zn‰gÔU9Ìe¤¿w™ùG¨E,ÿÏ‹6>Ñß.Íÿ(£ü§¿8ç Á1¼§š~~–`p‡—Û?,\‹ü7ÐÐendstream +xÚÍZ[oÛF~÷¯Ð#Tcr.¼X,\;IÝl¬ Ú>P-áE©8Þ_¿ç2RåÍbQ0çzfæÌ™o¾sFÁć¿`á«dÅ¡0*˜,Ë ²†š·máO´ðCƒUßÏ/.ߘpø"ñ“Éü‘šÌW¿x×?\}˜¿þ8)¥¼ ÓYÅÞÕTÆÞõõûO÷s¬ÑÞíý,zÿñn@m¬¼ùíû{®»Á(ÓÞ+®¾ŸÎ Í4|ý0ýmþãÅëù`N3-t¨pR¿_üò›?YÁ¼¼ð…Jâɤ}$ɤ¼ÐF £•ÍÿvR¸NO¸×ÈÒg]‹YˆDšqõÌP&q +’P@‰*J¤€µ(P1¾w—n·9ä«5¬>Œ¼ëº,![Wœýt{Ó\¾…˜ ]ñ ê»5í._ìÛlÅåwér“WY3¢')’893qˆÀô;˜‘}HKܘE:S0Vì{>m8ò§Áim§3yÙ’¦˜P%ÞcºÌ‹¼E Ï\ÒnÒ–S%¶L?c]fåå-YVÝà|#×´5Ë4¯°g‹³É+Û2«ŒËó%ÍJ?±qº6àô[HÞ¢øT'–‘öA´¥¸ï ) -@ŽL´×dØ|÷…&¼k¸‡ÆoŠÂa¾´9àýÁÚ*#´„9X4Ð/³Ùàá·÷6A®wuÇå¤ÏÈê³Â9ã© Þ˜(©…{»Ã)Ã…|~„'8RÍ+dý(%¯8”ßò:$Z"=âºÝz‰o_ L¯¿:ëÎ`peþÁŸb•nጼÂï«ËKüÌ TÙNü¾ÏªçTÔ»õ«P…ß&º9+ûÄXH¢˜}vÜF v|›S‡R”P±zÙ­A‰%ícƼ›¡/fèúÔ!>ÝHHëÓ–¹mÀˆB 5Sâ<-qLe]9ÀpÌ5 ·®rk |ß;Æ Ò5AFýÈãg-²±“É‹ÂŽf¹•[§>,ãtß‹”(\óç uüÚ]­£ÁZ"~7M—ôé «Z€ã;Ð1´_u3êEÇ â®nÞqî¡~ì7H+Þ‰êC¸Ö"’‘[VìÖ¶E‡àjÌ66m‹gæééIlÓU!–uy-3N=žçC“Á2¸8‰ån8_Z#EÞZØ6d€ ¼V²kÉp]Å×°³u¸K*º»m¦wO¿äKÛÇy‚ÛÞ³'gDõ‘á©/"1îxûówœrn(æã„(f]¤»¼±LÄ¡eÝnI%ö !{°ž°«W–šZ†à£Ø»€(vwx"rÕQP‡ï”q±lØSV; ·„eœâÚ¥EþŸÞ<:2 \KéÚòçüuÙeàNe_¦&ô(Õt8ø~¿‚§ S£ÏÌÏh°ÆèïuƶSCÄÁÁ‰ÿç,ü†s¦}Õó Eö¦ºã ÇÅÈVû‚­÷œC£Ø‰lw€VY6\‡'6¢+£ÐaìzGžZ+Š¡˜˜lí+ÓŽ£—ÀŠ#žÚ ôŒaý3 Nƒþ›Ù SÛc‹IDªÿ2§«1{ !C5Äå önoè‰äçÎE°ÎÔ!ÕìÑn¶|}"Œ ’ÞÍôCõ>pW?ÚHJÀy„Ã|0vÅ©ô sÍ}¥ò#k=RÈ(8)âdejqŠyBS^¸`Ö<ÒÌJÎô°œÛ‘Àlqr¿íGã9ß( kò6;‘ +-õ_wÏ¥ï ˜Òçß`t,4¡Ïáã½¾¢P$na½¯˜UÑ Ñ]ZÁ PfUË/Bói¾ бbü](:ÿ.dÀ5•ò]ÇieÄ¢¹¯†NUWÐ1[œu(RÚ‹þ­ùŠÍœWÕtuÁ×ű)çî;À^ц^Ö2À‚[øÇÒèÞVCznr.Èé3QÙƒhôѵ\Ná¢]lSŒJ7Oc1ÙÐé˪1™2 Iwç+òV úd«¼‘©¥ã¤óš„£f±wä»Uï Zš¢â>^É=锟c´çn fnE½íã~{@ÜboQäPVUÛzö BñK!?a:oYõ¡º|Ë¡ÃpÀ´é|*òrdŽÚX`Ò&¾V +þ¦³@jn1D›¤÷øŸ¸ëp×¹„½g”æ¼,Nù3¿~w9ÿ§ñ yÉ9âœ%ÌýŸ.*ÑN‡/8^‘wO"6cîÑÝ’Nßû‰l|ÅM*ï~®9Ñ=´aÃOö5sŒ;| ÷Cï‡zðÀñH<çúÌRÚŽÓbÆjEú­H{Z«š Æ9ªØªÞn4åM¢G®±…n]ÐØ"³qx1ba"t(Ï“€‡1g}ñY^á³|`Ÿåé=ñ³Á×øÝñ>Ô§•Ã€`Ug)`ÉËÀÊSP4Q¬¦@: 9¨ì¦Í ~ÿ°¾;tpoè˯¡XÞ÷¢†_VÿÌ æ:(¢iÀq|q|…IDz€ %ÝÛÔóö%4¡¦kÊ—PÙ’–‹0m”wÛò¼Ý“J¦oWÚ‡p£ƒû†_¬|%tdìLÉ.¬‹šk-çغŸ¦g·^†é²b5ŒGœ†»=Z±Ý¸7ŒÖ6fÇ@™M|æ×7=Ÿù†_º¨œ¢!7:oôGˆÐI@þ¿þ}Œendstream endobj -4672 0 obj << +4843 0 obj << /Type /Page -/Contents 4673 0 R -/Resources 4671 0 R +/Contents 4844 0 R +/Resources 4842 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4640 0 R +/Parent 4812 0 R +/Annots [ 4847 0 R 4850 0 R 4851 0 R ] >> endobj -4674 0 obj << -/D [4672 0 R /XYZ 85.039 786.531 null] +4847 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [416.104 596.443 482.794 608.133] +/Subtype /Link +/A << /S /GoTo /D (idmapbackendexample) >> >> endobj -642 0 obj << -/D [4672 0 R /XYZ 85.039 127.821 null] +4850 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [428.769 465.098 539.579 477.091] +/Subtype/Link/A<> >> endobj -4675 0 obj << -/D [4672 0 R /XYZ 85.039 93.681 null] +4851 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [268.104 301.943 286.521 311.512] +/Subtype/Link/A<> >> endobj -4671 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F41 2994 0 R /F58 3360 0 R /F35 2976 0 R /F20 2961 0 R >> +4845 0 obj << +/D [4843 0 R /XYZ 85.039 786.531 null] +>> endobj +658 0 obj << +/D [4843 0 R /XYZ 85.039 766.606 null] +>> endobj +4846 0 obj << +/D [4843 0 R /XYZ 85.039 745.613 null] +>> endobj +4848 0 obj << +/D [4843 0 R /XYZ 85.039 582.695 null] +>> endobj +4849 0 obj << +/D [4843 0 R /XYZ 217.023 588.668 null] +>> endobj +662 0 obj << +/D [4843 0 R /XYZ 85.039 286.5 null] +>> endobj +4852 0 obj << +/D [4843 0 R /XYZ 85.039 241.426 null] +>> endobj +666 0 obj << +/D [4843 0 R /XYZ 85.039 147.655 null] +>> endobj +4853 0 obj << +/D [4843 0 R /XYZ 85.039 110.788 null] +>> endobj +4842 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R /F58 3380 0 R /F35 3036 0 R /F41 3054 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4678 0 obj << -/Length 1871 +4856 0 obj << +/Length 2009 /Filter /FlateDecode >> stream -xÚ­XÝoÓHÏ_aéîÁ‘°ÙODº‡BÛ£-½6$àÁIœÔ"Žs¶Cá¿¿™µã$N -w¨J½Þ™ßÌÎΚ; þ¸iŸÉØ £À×’;Ó|ÀœPþpËáY¯Ãób!ŒwÌ°¬AªpgóHgYM v T/™² jÊÜb‰æ@öVô¬ŒµÂ-0~Ëï4[¬ìlý³IM³ÆdE/y²JéžC'‰’ÁÐT‚¹@´ÊÔ<£ñÚ™ ­:ËCPÖ5ίT¥ ~Öaù! !l²MIòO¹ÓdLгf#Ïm8–8içPkÉšÔ™Á®í8¯Ü*ŠZ'•ñçqF¢¦‰tg…•m×?ÚŠ–] -<­ÌÕÜÉë)½4ÖK !÷ËÌä ƒ -ξ]Yª›Ë:›n–fdBª´‹È™ÚF*‹²Nh3ymâbi."”21îÉIØ(A¬.)•v‰(ÁäÄg²D£ DúÑR¶®áî2Á(£È8ÝŸwè43/p•gw^\Ù\±›Ö -TL»ó²ÈqÐ~HiÜDËþ„¦0 ª¡_L”W3€ž Ý$u •«AÀÝûÔ Íy@Xv‹’Ô Êwú<°â©\84¸ëÔ§†Ûë°¨}™èì‡ë7ªC½¯ú  6­›»›ýÐÞ"&tYžìßé»È\5ª$vâöÉ]ÿ€‚ùJœþ®Ôá9 åA‡ÄqOhÛxJ] `GßÅ·f+O7uzªo¤bTEý[_ï˜ÙJŸO»æTôì)™[QÊöà(µ¯èƒê¾cð“ÍG²ÿþ±µ †Šüjf/8Z_ðÖ“Ì\ï[¬eeWö˜ü/ Úlýendstream +xÚåYYÛ6~÷¯ðCÚ@¬ˆ’¨#o9ÛÉ&Í:H4\K¶ÕÈ’#É1ößw.J²W»MÚ¢H,°â1œá|3œÒjꟚÆÚqýdÅ¡£}5]í&ît3?M”P¸ÓÀqCS–“ûÏt8U®“¸Ét¹&’eú~öø燯—Oß̾ïÏ”ræ‹(Šgç^<{üøÕÛ‹%γçÏpèÕ›—s³±?[>uÁsOpÆ‚Ù'>š/€æŸ^Î?,™<]ö´œ ôqSŸ&ï?¸ÓöýËÄuü$ž¡í:*I¦»I }G¾ô‹Éåä׎ ÏS^5¢úÂR,|׉ã Ã ôF0hvsß›]íM{nŽ)núþ3¥¤aà(×ú#*\Õ›ùÂ…ó¿ÞÌpwUäY‰í¢A$²ú3ö²š©v8Va{–‚¸Œ·Y-ͼ>s1«Vµ[!)æ–Å +¹™‚Y“¸.º‚ø󲊧WsÛÂRSn²3ŽÔœwûcƒúO¢òB!’ )5GäRÕ){ ì¾lºag`ɲ"QÅ\*À7¶9Ë@ª­ix=–¨NÍÀz¢«’‘R³ß]@»¥½:l¨3›Â"Ç·øRËÂ9‚[–÷† KÄ6c¼Gm®r„,_ e…_}Ž.N!\¸Vü%Õ`†`ƒï;äV¦dNX~”i:uðmHç¦Ù…lÈ"C»Æ6ïÙªY!ë½”ÍÉz’95»ñ6CÏ%mÑ €c}:dMËäŠßFL€Î(ôÏX”°{ÆïkÜ`¾3õ5÷Ÿ rd[“‹¸ÇâÙHY ”Ý57W8¿5¨Î&/7¼Ìð6¨m¥p¿éÊîíNŒ¥Õ¿ãHBˆeGZ™’üŠŽiÆC)g§­Œ„GåN2ÐUèø!D½.šj$šÁ‰Îùj'£»cLqjÈS'#ìÓ’-Í ûœgXcR˜Øân@ÉUÑž«¶¼A_Ÿ¦Ôlꇴµæ íiȬ¼ƒt$U¿*R&º|ùˆD +F ‹³U u‹SQÏðr‡‹èt< S‰££°sÎ[¸ù¡ãéH¨îIöjËT…@øy®¡\)ýÉåòžˆ¬Ãd‘¤Þ­m‘ÛâÂZ,%U‰ì¹äb¤RlÛ‰¦2•¹J‘©3b…ÖNìûTDº]dÇ3À_Ÿ^Z‚«3›½Éö™i™èï°»ÓÏ •ôå¹ç‚êsö]?fÓY¨®¬ZnìL+…;tc.„q|u¨;sØÊ @€Æû¸½PÖmÕQ§L¸&;Û­‡Q ýÇó؆"É¡Øf²IËòxª:M¯ÚÀ\Ö³n˜EºáUË {•…ͽÎÃÊ®5nyô˜(>´g76ì kxAF²ÕYmýnÛ# ÁoD¸”®<ÕGºø T õ7¦½kn!†-Qä¤ š­tMÁe”A«gØR<Æt³+¸S•Ø±‚Š¢bÓP·gvrk–Iö6tz„!¾§i±=lÎóÈ bib:9£v83¹ ¦E]ÔÇö•Ü[½(&|ø`Tí½‘ûO¢ ‰è¯z!q»l½3¨ý5KmÍG¹½¢\#{©ö-Ú­*éõL½9ì²îš ¤Ížî*__“7<Ž(o…]ŸÔmeú¸­šŒ/À +âòO4.ñ9 ”{Kä„9}q:p‡’enM¿åA¬gð{bvg¾#ÿÔ& ØJ¦Fy(û¯ŒáEP[$ÑWXè;ë¥Uÿ’"í©ÅMìëj·—öš²=Óp„r"¶±w\§&1¥£þü4P8%) ·‹s]Lã`ØAVö( Ó×½ŽP)¼á…µ…K¤Vüeohï,Œ­¦H82 ~ÃSdJ\l_`ppMœ6UÛŠUoâ>¼æõ]™¹¹ëí!ù +skeŸ's²±·ÔÆzê¦ÄŠƒä§ðµ¯CØ£ˆË³²k¡ˆPuŠ8°î²,rSË"v^l¾½xþ·N! ”Ï¢0šÂ‘vSHN¬¬ûRäƒÀ7¦8ÔAw½´Þ ¯E4± +O¬s½¿ M å^hÛŠŸ— lOí‘ÇMpÛwô¢YPº‹o¢íû‘TÐ0鎼7oÚÚ´yçL~x%h󬿑žåx[÷×[[1!¯4kM^HlŸ” ¾üÝ4¨ò ŽC8úòX™L%§Õ{­í}’B]_8«`{gŸïö|Wƒ>¶vEQšáCt‰z0߬\ÉcµVó»nèNœ(¹åDZÓ?û¡Ä«ÎæöbzVa32ÊSçÞ’íÿèUºendstream endobj -4677 0 obj << +4855 0 obj << /Type /Page -/Contents 4678 0 R -/Resources 4676 0 R +/Contents 4856 0 R +/Resources 4854 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4683 0 R -/Annots [ 4680 0 R ] +/Parent 4858 0 R >> endobj -4680 0 obj << +4857 0 obj << +/D [4855 0 R /XYZ 85.039 786.531 null] +>> endobj +4854 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F41 3054 0 R /F59 3455 0 R /F35 3036 0 R /F58 3380 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +4861 0 obj << +/Length 1954 +/Filter /FlateDecode +>> +stream +xÚÍÙnÛHòÝ_¡‡} €!§/^öÁÛ‰³±ãÌI(‘’‰ðÐ’T<þû­£IS`‚Àî®êº«ººåLÀOÎ"ß:ž…QàùZÎÖ剘mòòDZ 13ž|ý¶<ùõÂfRx±ˆgË ¡,Ó΋W§7ËówsWkíHéÍÝ0ŒœÓ¹Šœ/Þ¾¿^"Ä8—׸ôöÝÕ\4ÒÎòòí5ÃÎkÆY"àô·¹ 8·€x~;ÿ´|}r¾ÉäÏ…úßɇOb–‚ܯO„§ãhvcáÉ8ž•'Æמo´'·'ÿ¨0ÌÌxׄênáÊØ‹•?mÍáǃ,KXñÇ‚í. +LãûÂYÞe v:;øH']Ñ'KsÀéò¢.K˜%U:¡¾ò´2ÏÈ£¥©Aœ@Mø ¹*æªk‡,~½þׄž’ÊnÈÛ¹k¤ï$ø1NWÏ]pW]ðjrÞ%OÖIÅH@]…N†“ÀÙJ‹.ÍR†ÖUñÐã);n,a¤¦ +¢È¹Ä]ƒ{1ö-“aÖ5ˤJ¶™]¾³ƒš·¨.óƒ¥õdûŒœ³*õXýS¹VWb Äßo¶\X³‘-0'V¤VÆJyÖÕ‹©øÖ^ ƒ)K`@Ô6rÂÃ… Ÿ’õ=Q)¦ˆ"hLó@¥žf’¦`º_Xì&+Q‰MøeÞ+~m^²'qG¾y°ŠA`‘À 0[×û +)t=Ø{*9’§BM_1¬ŸYŠ¼í;(GÚÕ¨5ë×~C±øŸ¥X™o›¤Ë¾S·ÁqJiá‰($ZXðŽ“L)Ïý#E Œ!ŒÝ0ªBª'üRîk QW ]ñÀ«ueW»;ÌÿŽWI NR9"Çš2Ç1ÁÔ€¸\Ƙ ç”Ç;+$–vB·8lÏ®Ãõj ¡áGdÇ& "/áAõaý •]‚5¬è3nc}Rà¢]Ûqñÿåd»w¤¼qÚ‹ ’Ú%-ésokÒP·ÒÚÒ¶ûïm¦£b Ñx2Íý®/ûC°XMyÒKK’ ä¨C ²o+kp oº|½/hD.5¾ƒ–£"Ä,릱ULœ¼#¿X»‹$‚1ä㉘Äþ¥ñÇ'%2ÁàÄoRtD÷r÷¨¦y½DB±pþtÜ¡Òh˜M»\›mÐ¥Hs+¥¥h„ïlšºÄQÀ ‘ñ¸w9è/ŒLUA8Eu Vkðh¤s›±€ìiýQ:¤ÎÈŒ§"jWÔlg^Œ±ÌsºFYöE²m{’Þ/Âò§)QZl²pÓíåÙ[iºÒõ]%]iL,Ô“†"4 +Žán2"a4àa&¨Þ4y™4LøeScµä¡$ˆõý<¤r‚ÇÅϤzÍ 4½Ê Ú„çüYfÍ®íšd‚È«ºÌé,o²5„ìÂîU¾óQjƒ¨‹ið ~~Ï«ø¦©7y‘»é%K²É¿ ž}µ˜`ÿ¦Þb‘iÖM¾ëÖU-ÍZäW Ž·JºI;³Dá&éîúýGÂ[ÌÖ*2Aë¬.“¼aÚ_]žŸ¾[¾š@<µ4k×Sšý^7ŸÛŽŽ—¶ªÌŠUVL™íj_m1‰bžß°U—“ÃýÏ n6‡¸ +®ÓWuõ ¯Êˆ¿¯KR õ£…4 Úà½ZN0øO¾þü”©ø—q¸ÁbH'âIkíÝfÝAI×ó26àðbBõ …BOòò'X­{y×w 8˜IáÿÌ&+÷½b;ÿ§Ìxt¨Kõ3· .R?öäa"}|»0:>èãðÂ{?:@¢Î‘÷íípµÍù²q°á#¸`|.Có +K’é§tø&«„qËuƒ]-ut0::O¤Ü„’ñÆþ¢5†c´ª…¥ÎäºÀ78ºÊFöç¸× üôù•Î’ hßÉbgÇέZ^ÝÐY]Z”Š·×E:q«X{Jö}x[®¨H'Üæû^÷~N©ƒIùjxûɘ« Œ™tkDB¸«†ƒïÓU :³rŒ=}»YßôûÑpÁ˜|L¢ÐÐ|«•G¯„íÏ\ôo³®¿”e¦6ÞƒQY„© ªΪ)—D¾Ji·üÛw†ö‰f%šn5z©»OŸ(a´ÐÓOŸ6ºîUÈÇ6þëžPê©œãך^Àÿû²•Üendstream +endobj +4860 0 obj << +/Type /Page +/Contents 4861 0 R +/Resources 4859 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 4858 0 R +/Annots [ 4864 0 R ] +>> endobj +4864 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [349.275 614.049 376.268 625.738] +/Rect [349.275 536.269 376.268 547.958] /Subtype /Link /A << /S /GoTo /D (XMLpassdb) >> >> endobj -4679 0 obj << -/D [4677 0 R /XYZ 85.039 786.531 null] +4862 0 obj << +/D [4860 0 R /XYZ 85.039 786.531 null] >> endobj -4681 0 obj << -/D [4677 0 R /XYZ 85.039 174.626 null] +670 0 obj << +/D [4860 0 R /XYZ 85.039 766.606 null] >> endobj -4682 0 obj << -/D [4677 0 R /XYZ 85.039 145.406 null] +4863 0 obj << +/D [4860 0 R /XYZ 85.039 746.277 null] >> endobj -4676 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R >> +4865 0 obj << +/D [4860 0 R /XYZ 85.039 99.834 null] +>> endobj +4859 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F62 4159 0 R /F15 3032 0 R /F41 3054 0 R /F35 3036 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4687 0 obj << -/Length 3016 +4869 0 obj << +/Length 2803 /Filter /FlateDecode >> stream -xÚ¥ZKsÛ8¾ûWè¶TUL|3U{ÈsÖS“Økw3s€DZbE"5$Ùÿ~úzæ°•ŠîF£ñu£i5 àŸšä‰DÅ$ËS?‰Ôd±¹ &KùåF Å­Ü:4ïg7wŸ“t¢¿ŠÉìÙò)?)ÒɬüÝûð¯w³Oߦ·QyJùÓÛ,˽wÓ0÷>|xøÏ׎ÄÞý×ÏØõðíËTÁhy³û‡¯<öG /öf8ðîýôhž€ðÓÓôÏÙ¯7ŸfVOg%*ŠPË¿n~ÿ3˜”°¢_o?*òÉÚ¯Šb²¹‰“ÈOâHÞ×7O7ÿ¶¼x,žð¬sF1·Qàçy|ÝpIâ§qf §ÇpEîGY414h¸È?^› -R?Oò‰ÃéDš¡¹.N©ÐTx ïk‹fÞ³É;0n…fÞPïü©xhXI£ßLÃÌ›åV÷=ïKÞægèëÚÐË™²…¶&Ò¾œ3-Î× äô„4ÂcÑ6*†Ñå®ÓC ¶á¡Zž¢€C ä ãÊ{ö/¹D”ùAž]ߣ‘†ŒÂhìGqê:wùYÈÎ þƒG'qá=N#\[¿ŸF×âK‡+I3ï½^|Çw²gSö—ô¾WõiN7UˆÒ´ðó0!ýžô:×ÓÛ0ν,¡U×cO›ÉíeW顢ݘȓê¥Æ-ª×õ€¬^y·Ÿsܺ\¶ŽÖ´%iÚ”E»kpTX–ýAÏu/RK–X/…cû,³Gžõ/ïï> åýç'ì̼žW¾١UÁX· -N$/~¨È­V¨R»n—À+ŠO³C'©§ëµÆµ­Ñ;cEžÚoÔ’…äÀöÆiâÍÄPH‡f1çãsÖ™â|Ö¥Ô½<7tŠª²Û®e°OÃÂûQ·;˜Õ3S-Ú¦âÆœ4©–u3 -U/Û5*Û í°ª{×qAXè­ž£fvó>}C‚¯®!á=î Ö!¨¶…G†¶É}=Gá0ŠÇá~˺-êçWiZá@gp-½t>w¨éP“ÂÏ/ktĪžÁȵø°Ç¹m'îžsµ’ £¼7ìJ¸—;у(Ø5WÔ”‘]G™Çd½øœEÑ;z̹!Äzcà‘ Í¬ÐyâÄûŒŽk¡©ì6(”\ƒUy3beËÍYœËw?B€«g;"•lsØHK¤™÷z3ÎЃœ=àþ–˜øE–³7䊉p~ ž3ŽÃÿ4‚æF]½y{W tôïP²„}g‚éäãJËù›#=a*ÁÏÂNÕw-:Ny{44Á¨–æW‘Ô¡±H¯ü¡Ã"i…~¨r镇 L’Þ#j¥)¥)ä%˜ÿe¸¤0ºªÐHsÚcH‚,&…Ö¥Ùrt¬0oïúºm.„½FžØÛÈžÜÓUCWW<£dâÑá„_Ý<Æl úRè…¾gô3Šì0ƒ3™Ú μœe•zvh -óÀ°úá¸ÁN¯Ñ´¯g_ßnä@Ä œ'ßqSâ²æ£KýÏ”„`Ëœ×8I õZøŒ.ÇîËóî|vC‚Ijd&šìÃÌp1¬oɃÔûßj<ž4wK™!\yf¥U³è^·Èš,&Š¡9 ;íI3±‹‚`šÓál™ô sé÷Üîk•HÝZÌ°¶°=‡‚úÂKÉm=ðì BšÊ¼ûƨ1Tº´£Üh%>ؼMXjD|l@r‡*j‚5ê“Eìea3øi4Ú«!½\7áW4{k3 |xâçžL€ö[3¥^U*Üê0Khl6âÙëÈ 6·[MH~]-ߢ}ïaJ{¬«§Ë»žKS^û¡">gÈ_õÀ¸M¹ÀdIÁUâÙ{1¸¼ûr)íÃÜO!Õ¿†=ÍE0Œå+•€a(`ØC{3'Ÿ–œ÷–qñ“ø1Z¨ä®GÌ5ÎpSeö"øH¾-`q~Mpó³âú=Õ¡¹ˆ§ ‚_Hk¢«e§)ªÞ‘?S -ˆQ*Tì3îAŽT~xMÁ¹Í’l¤\˜ðL†À!ëJÍ;Ic"UP8U˜§L”þZ¤9@Ž­Èðù‹OAí8¿€%ìz0Tn|ž²PIN=‘ÒÏg' -d°ß;άù2×L¹¨ß@:„"óÀûíËÝñ3u1»Ã±•³î…õi”®4ê¸Äƒ‘…ÈœuW†GTõêŠùÚ€Ù½^öŒd¤ -5a -;ç £$BÐyË€ïF‰²_§[AÓÁr»ÿ’ ÅÔ6B ØÎVU'Œtçrt¢gGËcäÄ#° —„îS^õÒø©ØÊs55Às¶[º¿kÙäSŸx6¹l_Ó…ñh_+î”<ä•ßÖº3›T ƒlˆÑŠœÉ®­›òˆb2ÐñÖUåa9ÀÍÉ©ÝîzØùíz Ã"õÃèzQÀ¡!$‰•[IXŒƒÈ2Ê.Õn® ´µ›c‰gk7®Äeb* Ïéú_(n¨@â$¶(BGAá­ùžÛ~Gsn…ŽoHf¶ÝŸHÙÌÁì -â™èx¯þÚ9ð³Ú€'ºp”y¿ ƒ¹¹©1j6¬ÆlV©Úm‹W"‹—Ûs@µ17l:×îm vÁ˜vЂáí`UГAˆÝpRíu»l¥‰îÇs˜ÅY1·5?I”×ü*÷«Þ$̆‚Ec–¹0Iµ2vÞ‚ªðТãqÔ9]ø†MC‘'D㇕äØ¢ûŽI"\À»zªFLËxA8²íêñ€uxt0¯ÌC.1có9g\CÛ¸W1 ×2ZDÄam##Û/õDf,‹í7P=EîFœPë3è]÷h„UZœ!Mx‚Áì êÅÐh´ä–±/÷ÐN÷)…[=‚”À–Ç %n‡¹¢,ä"A.ÿ$·qh® ’ý‘®éHâyDr$"ÅÚ±M(á‡wpºAÎטûâ8î -> -B—›º±·œ„W¡Û¯ZnØÍëëNd 2d‹!T\©z-:Æ%º÷CfzæÌqé-J%S§N¤x½G‰wŽQÍ Û4qDžɺzx˜ê~ÐsXJÄy $fºu/Òw£O'¸fXÕÝç4t62 -#_¥¬×Øa’þÚ,ü%'4ã`ëãh%0Í:e*S±ôÈsu#$î‘eñ¹9ƒ3»7&j‰ô‹]o®á\xc³…×Ï–Î&Uël>^o‡þÒ)TYì‡Åõ:ÍåShˆ~v -¯ ´§ðXâÙSèJ|ljoh|ºq¯4ê”4šmÆ2=ÒS&–…§5 ,#R=ÞBFW¼ÛJ&̳ùIÇ#‹.}1 -'s Äº8Nèñó ˆ¥Àqz$»–‹Ötû„sÔ–ªËÃ;뀥žã‘¢Øæî¡™½ÐòcÕb[Ä°ã:Ê@ת¬c¤,âÃÚ1ª^¶ˆg»¨0·™Æú&‡±ÓeÊ­ÿ»¸Àâ~ž»/+ÞÈÚ­ŠI¾ŽïÛýG›SÙ7Ì"ú€‰¾Èiz¹,á}¼Á´çJ>÷’ƒ¤…“·Ñƒi—ÇX«jueŠõQ–î¤(§¥ú}/Ø6šJ™Žü÷Iî]ÅàÚE3Jü˜ÿáÞá?3ý¿þVa¬åADÎÃó!" ñƒU†Kyé±ÆI”ûIQùo?•/cendstream +xÚÍYYã6~ï_a`VÆlQ"u ‡¹:ÛAæØ™²@’ÚRÛÂØ’#ÉÓÝÀþø­‹²ìV÷›}S¬b±X¬ã+¶ž…ðOÏ2«Â8Ÿ¥Y¢l¬g«ÝE8[åû -ą́0±Hz}sqye“™Uæ³›[b¹)~ ÞüãÕ§›wŸç‹8Ž­Õ|‘¦YðjeÁ›7úpƒ\¸Â©ŸßÏ5P³8¸¹þøio‘s&¸A«×óð|Æw_æ¿Ýüpñîf¤ÓÂ(“ĨÔï¿üÎ +Ðû‡‹PÅy6»ƒq¨tžÏvÆÆÊšX¾·_.þ9Haš™ñª‰£/<Ç"U–™)+ІÞ>ÚNØ'RçGÈ”É,/;i•±ÿUâ»{°L‰6Zúò%Š¿¼ŠO9&T‰I‰¿mšþoó…l°/–eQõü±¨ø·Û-÷®ëÊB¦Kþí‹eçvçÊ/¢TEi<[dZE¹ýßíÿßíò¡A?ºcŸj½v4û ÿ+™ÔoJ¶™ÍFR2‘$¹+˜ïd7›ª0µÂx‹Û4;/—÷Ä1.ÇÝ ˜Zrl,Ý +•ø*šè ž#h+ünpâ×P›õ­ë+˜!r5GîÇ÷…x¤µZ5õí„ÒƪLg§ž¼S);Q®B› Á´Q±IÆÑo þ­ÉƒOóXhÂy ~´xÔ$ ^»ÕWüfWfbÏ8ýõó—þ\ ºtóEd² ûÅ(¹l;œÉ‡[Áñº-]_ÒÅôÌ춼¯–ÀSm!0@ÔSªšŸº6¤9º·Us¨‘*" ׇ[ºNv-xÇj-›[Y]¶Ãl÷þõåä¼¾ú‚“iÐñIØy[´šâËZ:|_‚ni°A•šm³Y± Ço“ÀU[‡gÛ¢[<50‚lÔ’7‡¤ WfÜx÷5ä…ÖÐ=z߬3Çõ¬1îRuò»£0ƒ¼¶Ý +±YΣ<øV5èÊ u² ©K,I“r]ÕG¦¾aZy¿ß¢²­ðö›ªÀäd•Û»%j6\åÁ¯CÈïÈx· ¨uªíá'E[ÀÎ]µD!·Gr·gÝVÕíSêF$P˜nev‡ö? ¦}E +—¼¾¨ÐËV<fz¿/¶½ÃµM+îM¹ZÁ†ÑÁ v%¼ËƒèAìõXÔ”‘[Ç=q•#O9óâ)‹¢wbÎg3RÁí|þ$C³Ktcƒ+t$8 -e·ÁMÉ5X•~1y þpc¹wøŸ0àéÙŽÈ5dtl¤%%X¬Sà +×Kìô—‰Þª<ÍÀ7¥­¦#c².–\õྖµ”ÂïÆ•ðåeÙ¯.a°t—¼B70zœ•“ÊU$ ªžPaáYƱüh“f[,N7:BÎ`tüTÆŽTfN3¶V9îvž±u€°ÍÚ0ø„.쪺/ïûç³QÚ˜çóÇmá/¬EW ‡ ]ÕHÌGiÄ 1Õ”91y,Or¡Û´UyQ0õèC-OP.¹¥¨"çƒ*:§ÒJÔ¡^ã¶Ce€ñO®ÿ%»±ÎzÓ²%³¸ZvéÃ1~p[´àÃD\uÍND¨~ hãw2° ?}o92‰í ñÃ/Á1rs„?FÚF*Ê|µ9Ôs°Fë\EÐ𢦒 À;ŠNÄ>#ð”Îô9ilƒŸ7˜ª @‚'Ò š P„f|b¼²^µ{4a¢ÈjNä6‚Lë]`¨t »0e&%º†Y¿`ïñšÇg&ÊaTÅ+1éJÄÂÅŸnÔõPŒ +»žipݘu\×^¾tÅ@åA#Õ¤õÞ(":7¶¡Ê‡U/ê?öŸo•ÃJ˜|]Ĭd87Td¤ ^H’7ŒG ?‘Òx„çy,±BQ” ΢S«¾›Â @c–ŒÝâIŸ€‹Í´Ç΂“p‡Q„¡9süÈô>ܳFD~èú’ÂHTºÂrÏÎ +~£¡M¼xâ8÷5Èaˆm¹€Œ¯Æç$â!à ÍJ‰âK€ÙOXï^½WY9…Æ(z*'[§öåäHrr‡©ÌÇAèóÏ;4Ѫ%»ìûRˆyуïpßo)-ÈÚx¨ÇÚG*Žžêb ×—?Ÿö©ƒo•n±(„áL´~fƒ;Jqj&»Êß뉚©¡!ÏwŸ¸«EÛ4mÑM嵺Qã³Öw¼ñöñ¶SK` gèïSŸ¥*I“?Ðså0Š…¸õõ aF•·v«…¸qnT–$§0÷Øbû\‘CjwிBŠ+€ãJYÐ #Âd:ø3ã%¾Õ ß¼2CßÁÙͤŽ–‡O, 0»qt¡%+ÑW»ÒãY\ˆ•ôqªs+öŒÃüö¢,¡®Ä­;þظq_e)µÍ¥Ô•„Ü Ð±àiêí@†¤É‰R—B¦2ñùsÀ¯¡ -ü§'®Â>3éÔucJ-o6Ô ¦NÂq7Âñ­Û²b>+¸‰c¸uÙñjR¼úÒa©’|Œ(Ý~OðÁywˆãˆ¼†2XWõCÀçÕ@ìc6<±uíZR ça®"’-%Kr³ ®,ÂÐNçWXÊSGU?î/úM3¸§ãέ<™]CO¿:%*NÆoD'˜<<^Lz.—þÌ»Ó äŠ– ˆ¶ëù›ÍD%ˆ;ó˜En¤\ã lnK¿öoh놇 àg÷ñ­ÜRǼ\øøb~GpQòET£R§Lhò{¼ø1–¥¥tCNÎÂೕ ±:NÄ­8 +º¯vòåéÐÚQÇÍ<óðØ +ëØ”ÌE1\¼ndˆžæ 4Š` 0ÍñO ¡¸Ê}°q²b$™'£2T3<¶ ¹¼Ár‘è©Î™ [”Û`Ç–¨ê5;þ©}FuºíW¦˜ª!Á ªQ$ˆZŒ ¬aÄO"ÄâHìØŽ+DÍÐV{éì?Mßo˺”·"Üò¾Æ'œc{õCÚW§ÿÙ{ tuRu9 rï—þIÓC­zÈ @.ïlºµl£ +±ˆÉAÅøÉ”Üi×qN~ê 4IUj’¿`†Á@å#R·Àmg¹-¥E¬¤oäÔ‚®ØUõÐ"õ-]RÓ +ßݦáÁp=]ÕÊ^½†âIºZ¹^œèÄ© ‹Ã¸«+ÎU/ô±ëìø•/–ŠÆþ`åf½ àd7< +ÞxáÝhBjLÜöL¦'F˜9}²òl5x9äíq †ë¶“ÝŒn˜ê'&Ñèòâ(V:ñu‹€û¡^aÂÒO@¨àyê[fFgB#h.âáÁenž“`àojNÓt-ÁuçMÔôRˆW‡Î¿¶pÚ}1 +Í…Ç~ …= ®¼ˆjßwO•5Jç± ºªÎ›“4‘æ:ÉÀßrÓ»-~ÒÊCïÿó Ì …éY~ýs,¢_'¿>dØ¡ô,ÜR§ÛþÜ–9ÙËExÝ0­·Ü=þÛåq|™ ^¬86c8›Ô|÷mÅ/Ê(g; DÇ?›Žèé…ßçVpZoG?ýÌò8Ψ@¶£ÎEgäwÕ±19þ'/m¬ÕD"ù<< ÜñŸü®‹ÓÇãJzβ=ÖÏ×HK” ì9ø²IU™éYtùs›ŽS¥³á\Ïú°Žâs=ÇåüÞ"±>endstream endobj -4686 0 obj << +4868 0 obj << /Type /Page -/Contents 4687 0 R -/Resources 4685 0 R +/Contents 4869 0 R +/Resources 4867 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4683 0 R +/Parent 4858 0 R >> endobj -4688 0 obj << -/D [4686 0 R /XYZ 85.039 786.531 null] +4870 0 obj << +/D [4868 0 R /XYZ 85.039 786.531 null] >> endobj -4689 0 obj << -/D [4686 0 R /XYZ 85.039 766.606 null] +4871 0 obj << +/D [4868 0 R /XYZ 85.039 766.606 null] >> endobj -646 0 obj << -/D [4686 0 R /XYZ 85.039 737.087 null] +4872 0 obj << +/D [4868 0 R /XYZ 85.039 701.45 null] >> endobj -4690 0 obj << -/D [4686 0 R /XYZ 85.039 696.923 null] +674 0 obj << +/D [4868 0 R /XYZ 85.039 655.852 null] >> endobj -650 0 obj << -/D [4686 0 R /XYZ 85.039 555.668 null] +4873 0 obj << +/D [4868 0 R /XYZ 85.039 615.991 null] >> endobj -4691 0 obj << -/D [4686 0 R /XYZ 85.039 525.173 null] +678 0 obj << +/D [4868 0 R /XYZ 85.039 462.48 null] >> endobj -654 0 obj << -/D [4686 0 R /XYZ 85.039 428.612 null] +4874 0 obj << +/D [4868 0 R /XYZ 85.039 432.587 null] >> endobj -4692 0 obj << -/D [4686 0 R /XYZ 85.039 391.746 null] +682 0 obj << +/D [4868 0 R /XYZ 85.039 334.268 null] >> endobj -4685 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F62 4047 0 R >> +4875 0 obj << +/D [4868 0 R /XYZ 85.039 299.523 null] +>> endobj +4867 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F20 3021 0 R /F41 3054 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4695 0 obj << -/Length 2911 -/Filter /FlateDecode ->> -stream -xÚ¥ZYoÛH~÷¯ò²°¢y5  ÇNf£žU€W…Š?-€Yø’ÍY¿LU~úeæÞ¬ûXQÞÎê«c²l´èh™‡¦Q¯Çšng±Ù±ê™¶ËåV-;I÷ÕüæÍ+^øG ‚9F¿®þŠ·¤&¹q¬h0´¦EîýFRÑÎOL8¬êþ”ñ ¸$%§Ú ±àÔßžëª/xøº«¸¯ÉB¿cGyº,QÆ¡Þ¬YN%V‰0`<áÚN#Á”ü)O›¯Äü’0óÐ;Y…,ëUyuoögŽ-G¦ui|Pè–Sr¢]›¹ç - ñÍê¦!W©zñ°•_+Å×z3°wt†ï¨ -$yƒb_}ÄÛòÍŽQæïxEÌé’ñóT­«ÕÇ™÷´«K#ñΤa-rFɯ¢ ãåx=ؽ»ŸscÔŽ{§8c-u½~2û8{º‘‡NÝ -»ä`’ ‰úÇjsK„ lL.<©€Ä2 -¼ÖF1¢ˆ\WëÁ`’$ð®JÔU-V·÷UŽq;ŠÎ¼Ñvðkï0’|EÑZ?6ãn†AŒžç«-XbL Û;7`Fäq¼®lŒB{úc½¸~'¹÷:7o. ÝÜ\ãXæÕí¶©ÌMbp­æÅJ¡5rë™]WmñT5¢²ˆ–ŽH«åØ@®l7ÈD¶"ŒPMT¨H€×M¥;£ôã£-M®±~¢{Ú†Lš3ú%îuSEäÉÅ«výA†ò´1šéVd섉5¶¥iàH'×}"0m,ă›Zø3˜Œ„‰µ‹][±:8}qvØ;R¯7#t“(Ó ¸eõúÌ'qêGPH½tÇ Ýq:w`]Aláé Ùf‡û…Aêç*qCCs´ãžU…aäÇ`rîŽWplUxm¥)p§e÷FGß5¦&"`ýþgûøžÉ¾Zݹ@‹R5J úsìJÐh¬ãÂkêGÂÇÝ~!]°’Ù¬Þã ëµsn=ÖñQnÞ šÜ,©rF÷@èNa‘qheqû`,1”E&Ç»'!ø䘛Ïj²¶Øµ¶Ž¨‚Õ0l__^>??û[]6þbÓ^ -’¨ÌO‹d_’s74Gì™û!'v0ª6ÜÅ‘%Çv¾Qrͳ8‹ü.q/PhŠ2Ð*ßa)ÌM™àù(ƒ{ܬ± B[d8b–åäaD‹=öùmŽÆÿD9&ZƒßyÝè 0C²ïŒGÁ¬I^ÙlÊP Ǿ÷ Z[î_•-YU-oNÅöÓ‰èø3V1¸ àÝkRSg+lá.‰òüD£ü"òý't»^ž3 ˆOúO -ï“nÜê%¬~wûð -¯.È„ÎÉüÄRü¡QgèRøF‰ŸgɬZ¨gù±Uò$»¦ô5 à`Þ½^²Kû`aµ”+¾<®]þó?ms[þ¦C±/€3~E{ZV©*¢YR ,JrB"¹À`©Ó9Ahfщœ$~‘§–Óˆè¥YmƉAÞØ›¬ŸVòÄÝçº_ÉÒ ?¯9? 9û´4°qÚ󧈉佅¥ñN2À)+…^&È;S…_$ÙžNµ ¸û­ñÆ¥#â´µEõ£ìIÀÏþ§7gPµ -ÔÉ7gp,êIt– - -€ ·„zŸ‹E!Xf^ŒïÒiâT)`cIr'=b£>î6¬{¼ÜƒS -uX ¬ Ë™|™„~PU‰Ó&áÇ3ÑÀåmNn6 æÄ‘TØξl‘¹k‘Q᧙šD0”…©  PI -7$Ž¬#I#™€j~7”ÚÆ–’—¦Øè¸ÿ Q¥;‹…ébUqÔç—ª<Ï‘’å ƒ&yãš?ëêÔ3 ´úðj¥ÇRÄ£ÁVëñ¡Jʲã"ˆ=ÃH*j¨nêö ¤¦7Bjmwx²¦^PÄ?2ö€b˜¤Dzþ3EOpI\Vü5ÏÙ³ù¤x¹“Ì/BEéèÊ}õ\˜sï툔Wrf^tµ\-Î$J\fíà˯*•%uc ²«©FÝ«?ˆŒ#."d6à'ÜߎÙŽå“:U>˜f$ÓÍŽhkñHÜé£W5š@ ª’Ûµ!ƒE¼ãü ³ÿT*„W¼#ycÌÓv¤¼ÛAØöz[Þ·æW.ÞNÇw•.ñä8®ì‰Ä+ƒXž|ûîña §éÁ«t_ äI˜°“­²LðÙ^õ¹ÏÛü³Üv0ûZðò°0)=³ÀÜó”~žùlÁ L•µ}ÀX€Âî­XnaNlŸ×J6äM<{|Ò®JÑò;„`OÇŠì ‘ÀÔØêŽ9«¿õøÂ=&FÝ?u bÃô¾oÞB8Iåq™Í?öòØ·mÆ—B¨«–UçþÜ•2æ6™tÓ°ËÙ:Ô¾¾žýÙ*óÃüåç´‘ä|….4?*Ð_ØÍÖçÛ,Ïí^†*³#I ò&q¼'ÉY¸kˆeÚ+â8q›mµÆ÷YºOG…\™Y¾ –(!Sd˜ü,9ù´Ù€ÿÒ¯ûãËZh÷ŒþUùÀ“XÑ‘ù!÷è¶Í*GäÿkÕäendstream +4878 0 obj << +/Length 2865 +/Filter /FlateDecode +>> +stream +xÚÍËrÛFò®¯`å°Ê„Á;9É’íuʶ´&“=Ä9 Bh´¬¿ß~Í$!g·ö°)W óèéîéwíÏ<øçÏÒÈõ‚l–¤±þl³¿òf;Øy{å „7 ]/ŽpëÕêêå›(žùž›yÙlµ%Uþ»sóëûÕëOóEŽï»óE’¤Îõ\¥ÎÍÍݯW¸:ï>¾Á¥»Oæ>즳zw÷‘÷nqÖBg…×¯æ €YàëåüÕ/W¯W#ž¡Æ2õåê÷?¼Y|ÿrå¹A–Îaì¹~–ÍöWa¸QȼºZ^ýÓbá½pƧ&®¾0‹ÀsÓ4´2ð£ \wp‘Äs4|âÌióïÐ+ö¼ÚlùÛ?]Áð¹üìù!Œ78.‹zS_ XjÐÍ `Þ#l¡ëî”P×7mYàŽçÇŽhµ8¤}ß–„¦/„ý#̈n‘ó‰õ\eΓ`Ã=jj=_Àß5ƒêðQPÉá·5±‘8yñ§D³jp(Ä` gõP0Ôõ=}ÇãÇ—›9>àJ|! ºäšDµa1ÉZßð¡á-/ps¬‘¡~nO”òÝ4$Â}S£¾žøTK„·†TjË‚‰-)sWÐé„8:Mhñ ³®U∠‹s«7o~ö"ïÐ_ËÆÞÀ°£ +§ãÉ#ÊHËd£«Š3P‚ï »îŒ>KûO4ÚF>0FèR0›ÉV¼Ñ5ü­õÞЛ‚o|Bk W…Ú“žÄÍoK}[°gÀe!V¤J\/cHB6†6øÎEÔ ê¯xýœô(äö Þãn³±Öèù9"DÙjò5/­Á>€äŸÖZI.Bˆ.© a«nÅfŠ˜Œó­|Øàb·¶AᔡñÉ‘-&¤ˆ +}d.‚Ô£»TšÔ36©opRÖ»îõZ³ß£ç¥1z^g -Á +Ç}¾6†§÷h$™rª\†E9c ¨~Û;!s·® ¹ïà{ƒ»¼ñš£§ –XnJ§{ž•âOm1^%…oE÷Û RDƒ+Ša4Ô½ÁßòÑ„¾ÁKmi£ +CweÏ݉åûÊUÁtN]¨È ’Øf˾›EÑ8£ÀJèÅÅy¨Œ&Biiº~øijä[¡ŸBܨyÀ‚kÄB?; ¡¢ëœ{-ñÙw(·ÈqˆÍP ¸(ÈK!&ÓÏ~®n_ýÀú˜Ò[~EYëŠoG&ÌAcg©ó+±gÒö'LhÒ»%ÿ6ƾØ-ÞmzÞn‹/Ç’Â>ïi2µ'Éõx»·û²©‘[\Ý4µ¤ªÝ±Õ˜j`“t癞ø)I”“œ•aåºç`SÛ„(zKF €µÙxœ‰‰µ ¹‚´luâ*Zœ&§±23·µÌ´‰’D ïoçœN h› +ã\)*]à³³÷³Åƒ­ci/õBâ ‰Ià`8Î-t†ì¤°!V.4©œšÕ¨†+ŒÅHJ8ve½c ¦:ƒ¼ô¼)£9A!|\jbH' +sÖOxEЀP*K;ã™RcÏìÀ®ÂÐs®s`‰*%¹VO¨JòÁÅ]”)"F¦®$EQdÖëj F!Øèx¿¢úeÇG°2b6ýWB¢–seoU¢|{ûK¹ «Yû‚´qûê%µ·7¼Pî)Û¶}Á1_Ë•»‘ÙlSñÝQn³F@hÊ Ÿ%PºdB…9/œ×‹´8•MCç¦*tk~y­­É)–¼îˆ,,™tfd«QQeUödD…ä âtTÀ3áE2Et8AI4Ç*粂 v9 ÝEs$ܦ:œò`®Ð½t2éÁ6ñâ%äš0e öÎRîñŽ²çStôáHq¶zâ”r.ø…ŽuP€fË-O¶to&dß0¢"™jéJp튺h9>M‡Iã ÂXÏôºž¯Ä q$aFRR"•«ÐQå¼e#)•Ú£¦ý³CÅú±)B:7Öt_wÔãc®¡e6L¢a "!復åF¨ãâz ÃêÀö+¨b`cüÈ ›Aœæ0åLF—…ƒ`là +@iù‚RD×З{Áɱœª²ÕÕÃ8ÁeJŒ? DXEËag¯kj›ä8ORÏžõ(ÚC½–û²^ÀzŸ Òâ.çñ±uIU¹zŽf໩Ÿ}¿Tµ£M© ¢¡ðg[<ò€[úF +ðŽ±ðÆo×·¶9§ur•J˜Å¥Š"ɺd•q$b‹,:^1¦DÔ¤…6S_à±uâî{~CºgDUr[AbÃðY[Ï7a m2$›LCjŽ!&ñѤ&d· ++¹×W¥mQ­G[ +ý4õð¸qLiÕÝ ah”úJ…Ê49G¹!X›7…·Æ8§Ÿ¾àQ)™ŸŸ"y~Š0oô­mz¿ÚÊ!:O z™p£”%³EW—Hk¨¶oD£eñ_„;'Ûx&”ç}ãÝkvÐÒsؽåRc3ô=Sé@žË¤ß¿ðmô]• Ïÿ¡Z°U½ ŽJŽv¨„ô†K`X}Yô$‘—£7’Çœ“‚½là¹^š ©AAcúäæZêb\†àˆžÅÜiâ’íçqUoøÈþP‰W†apçЇ±Zçvg¶!¸Ë%¨QÅ}jM®?ðdßÈ›%¸XeÚvêß¿…µû÷ 6ÚRÀ»î~»ž: ¸ÞîàÓÛïØKåö=3…ÍU³5µIbƒÎ(&¡ë%Ù©1>O"sè| 4]0²6YÛmØgph>ö C¥K1™6Ó;J®|”m1L\h¼Nœ•½Sûº½ñÁô×hk»¢=–kSÄéHÔO)˜˜7ò §Ob +dCùyéGÙ„lÐf#°Yz óœåSG.‚ãëyšß—u ™s)*Œù!gâF3H“HÿŒ=Jì¼ÅêvnnHŸýøÕ=ºøÝŸŠ’‹áŸY°^%§O·Ôc X RÄ?aç:Ÿ&ãÈÇwK,W~¸]ÅÎHmS?»ør3_‘ô¯jÊÄQ<ª†dl^ñ$ŸDNÎ~¿Á_=Hãt˜ë8ÎŒŒr>|¹ÛBÛ©ù;Ô„Ž_†Nrqχaqüû lŒ+h +gC +Œ¦R`dýfqvŒ+©8nõÅ m Xã¸4À¯T’Œß›Ob>>ÇEøØÆGÐ +пÁˆßõ‚¶cTò[ÃP农î/ ·…Îñ渮+œ Ǧ‘ ”“¯yпð¶8ª°{~¶© 16¨ä$eÀl2ü«Á¡7tMC~˜™˜Šß$±-œ)gp+/‡&¸‘½ekœUÌís@Άƒ¸ g×Ó¯9"å7®Áž.!=Ÿ© ·dÛNJOóïw[)Q)Ré*¥Úòð£dÀe%OÅÙ[á¶hOŸáíƶ©*v6ëã·ô©ª7ñÜ$ˆþåÕ“XïÃ$ÞÌÊûœrì*_M“^¤¦Ñ8úý¯¼$”éž’@]ÈSòmyauY˜jú¢ª ÒgdâÇWž*s=?îi‡Œò?üŸHO€”ž¿º¯Â‹Œ4cü7O endstream endobj -4694 0 obj << +4877 0 obj << /Type /Page -/Contents 4695 0 R -/Resources 4693 0 R +/Contents 4878 0 R +/Resources 4876 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4683 0 R -/Annots [ 4699 0 R 4700 0 R 4701 0 R 4702 0 R ] +/Parent 4858 0 R +/Annots [ 4882 0 R 4883 0 R 4884 0 R 4885 0 R 4886 0 R ] >> endobj -4699 0 obj << +4882 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [342.154 348.249 458.69 361.151] +/Rect [257.336 213.363 333.407 225.053] /Subtype/Link/A<> >> endobj -4700 0 obj << +4883 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [374.665 321.151 539.579 334.052] +/Rect [254.425 199.814 539.579 211.503] /Subtype/Link/A<> >> endobj -4701 0 obj << +4884 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 308.207 142.399 319.897] +/Rect [84.043 186.265 218.945 197.954] /Subtype/Link/A<> >> endobj -4702 0 obj << +4885 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [178.437 73.761 317.883 85.754] +/Rect [111.316 88.431 169.521 100] /Subtype/Link/A<> >> endobj -4696 0 obj << -/D [4694 0 R /XYZ 85.039 786.531 null] +4886 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 61.333 251.309 73.023] +/Subtype/Link/A<> >> endobj -658 0 obj << -/D [4694 0 R /XYZ 85.039 711.163 null] +4879 0 obj << +/D [4877 0 R /XYZ 85.039 786.531 null] >> endobj -4697 0 obj << -/D [4694 0 R /XYZ 85.039 678.741 null] +686 0 obj << +/D [4877 0 R /XYZ 85.039 643.417 null] >> endobj -662 0 obj << -/D [4694 0 R /XYZ 85.039 539.412 null] +4880 0 obj << +/D [4877 0 R /XYZ 85.039 610.995 null] >> endobj -4698 0 obj << -/D [4694 0 R /XYZ 85.039 504.667 null] +690 0 obj << +/D [4877 0 R /XYZ 85.039 406.042 null] >> endobj -4693 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F35 2976 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +4881 0 obj << +/D [4877 0 R /XYZ 85.039 369.175 null] +>> endobj +4876 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4705 0 obj << -/Length 3014 +4889 0 obj << +/Length 3111 /Filter /FlateDecode >> stream -xÚ¥Ûr›ÈòÝ_¡‡S¹*ÂÀpݧ£ÈÎÆYߎ%×fkÏ>` ÉdhÅñߟ¾ @òéT¢a¦§»§§ïkdÂk¸†©Â‘x†«¬Ñr{fŽ6°òë™%™´`>-Î.>»ÞÈ2Ð G‹u'4 7ôF‹ÕŸãÙ—éÃâêñ|¢”[–q>ñý`<=·ƒñlvÿt·Àg|}÷§îoÏ-X Ôxq}Çk—¸sÎx ÓO瀙àÕüü¯Å׳«EÍgë$–RÈå?gþeŽVp¢¯g¦¡Â`ô -cÓ°Âp´=s\e¸Ž’ïôl~öŸ¯9#Þ5$ 1Q¦ÎiÁ¹®á9~-8Çj Î2-Ã1ÕH¡äþkZ~÷x–éŒZÈz5L¢å¶)Z¶¡,û€bò2M£,®øº.“"^¢°«¼€•7žÇż‘¸àïI—I[…‡!&q¡ØÄc‹] ÝcWµÙíâDv_ªj÷ËÅE²#– ø[.£]l,óíÅ -Y¶ßºÌ9®ç>)@9-?­h¶k¸¬é‹×sÛç,”hµ‰%U’gð¥"ºh‹’{Žø³ˆK”n¾‚¨ò¯/ Ì-á Ãn#ü+Øá†QñMð¦Jh?ŸOT&_ât·ð½°áMÆGÌÆ ]ÃñÕI=nÁ×c ôžŸ"Xëq—â ·).^z´”cøÊ;$xT'5ô;¤;8‘t}Ó‡ËÙä†]×ÃäË=~_Ü÷lŇ½¡sRæ47¶‚Ë;`f%Ò­ðo4l¥uĵ6]ãü†ô””U/g홑nî@¡@Ë¢½qLo¼ÀPþiÿׂ9¡7ô®Þœ ØèM‡â°Þ´(¢ÞLT¨Æ•B{¼M6ET‘<2ž!ƒ] Z`U2ôš¬qÛ»ZÏ>:Â9îú4×]œÈõõåÕôæ[—º‚M¾:-) sš¦²à-ï€fõ‚ÚRñùÅ¥ÐxGE­g¡Å>)D÷Eúµ°}I@¸Q„e²cSäûAkáT Ó6|ÓA»„på¾íÅ¡bN€è£jã“X–“5Ðx–³Y ùÍ'§O´k®çpQ§øE«dÚBw™&±°/‘ù%þf°q¡üåµF&‚üˆ2sÙÁÔ$cv¾£a] 8ubÏaŠ¯i©~°´¶;*s5Þ"/JžÒgàý.mJ¼˯/D$Ûéšp6ߧB:Ë+0[Hº]4ܵ$âêçü<§;wwLéw•rÙ€Ë=r³Õê[ñ¬¸¨Ÿ:]ü‘D½ècùPÒX#üG9,¯@ðáÁAðàI={1"ÿŸöÉrŽ@uB•d2½Ž–IÊ|Ãb/W6”]ªÍc?D ÈIÎ:x³c.ÛPûJ­sÔe;f)Óï¸l[»ìå iÌ€=5Ç7<Æ©Ž+%eù;ž'íÅ_JBð3úö»vˆñ´Ä2ù9].ó}V9©*à -¼“'mÁuõŽg–×Éná²m{¬È;€ÒKvsh+ÔKÛVµã¸Î@—lL¤®D$œZ!~žPAeO€ _ób€ÆÝâøÚÃëê&*«96Nx y€òPád­D%ßäÙ"ÙÆ ÀÒz=¼ö[²ü»³Ø?©fge³—(ÛăÌÞîËêØ2ÜGõ96åŽZ«¤Ü¥ÑÛ]4Äå—|?D˜n ­\É#ÇÎæXVUï­È×IÚ§.‡¶c¿¥‡þ©Œ‹ß!*+v»ïÒH¶ §¿b!RkV×ÍùQë´æuœèÄõ Û·Åf½V¨ñ¡Ëi¹?òRèþ‚C÷{^(YT/YÐ5…_Þ\¤Á²Hƒ#~VÀo^ØTw8¶ß°‰®/?]ªïpÀù[ þgñ4®¸s¨6íàõrãº::ÃU:%Ì‘Tö­^.&²˜Æì¬á°âžkÁàG®OšJ 9tÿûgJ½ëTN$Å©˜‚ó®™ÔÛ9g™ôQQV¦Q%¸ëè¦ùìÞnbJªßÕ€r¦Žþ3uBÚdêÔ Ÿlz€)˯<™,j6q¼•º—Q±bi ±ó-åÃí‘„*YÝEïáOÎpš­ - NfÛŽ8á;- =i÷Ó’.N”Ú÷¸ Dâß•›.C®eR{ÀP'9Ò0§Ùèbª“N8‡í–kcãÎ0C.’¿ÖUh…u$‹Òv])DaPÖœï"NŽ^W J— P £Á!ׄ‘.'’´ qAé¦7 Q8ÝΠ¯Zÿ“Ú¾\Ô#T®]ʪ õœP¤ÕÀù +±®¾) ºØIe ¿SwÁ IAàŒ?¢u„,%2«>.ˆ˜d6Mr'ó:¯ƒÐU÷Ók±x?ãù-›OjŠ½ZÃ"à¥6#Ow×ßxT „ÐDG8éÝƤï'åÍK 0ª)fýªŸiöñ#å’÷Ã<î‡-qãÓlñô8½ái-yÜ‘ìQypó¹à!|6ßd”ñGSW#$ªØŠ’Œ;~$ø³Ða¤o‚(¸õÚ#9ÜÂè>3A`@7 *M°I \s I£Ö¸Œ[Í -z„q<ö{é -Oìø”ÆƆè¹i’År‚íÛμ¼0ñ½4âŽúÁ탲—º­{y}¹#,(öH!M2í¼u[ó‘žPgX*RCÁ®‹ 1$ê@[ mJ6Y]ã´Ö5zt¥X5B¦2_ëfû|ZšòRíìbÙµ*#6_rM¾¢‹óò[¹ßzEã{T̛ɰeÕme‰‹kN4%ƒžªMûö)6B¦Pß²×T„‡^©97§î5yJ±#Z1d¬u¡-A"ËM²–Åæ, °t°É™œ0'_:š¼Sº‹Cù Þ±ØÍõ×3ù3=4ÑXËÄ T7Và_,Ž†<%"H²5©Ö6âœç°Í%Ø5dô$Lê²áÊŒRÝT}ãoöc䘄²{î·ZãÍP•¿‰«§¸Ñ¡QÛPRðǘ 4pE&¨[HFg«:BËgóhÒjà¸ý,¬!íGvBPµñW”’£†¡þýö’ig²û²å*@£¯MÙ þìAä›–Â(0}×,6'Ö`#ŸNl¡°ži>}˜Ÿœ~ôƒm™±æD2_þaL>oæg·Ã‘뺆m›ÃQFÆxèDÆdr}w5ÇÏ8¿úˆ]×·—CF#טŸ__ñØG Ï3æ80þ0Í ÏfÃ?ç_NÎæ-žFžé.2õ×ÉZƒ%ðýåÄ2Ý8O<^‡ÚköËu/é8¦çxzMì)V2tûé¥jùn¦“Ñ›ÜÍèó56~›_ïc{–úQ?ó®¸Á˜ß$j‹‹WøÁ/µšœX+ôûWd*d¨ýœ8!óØNAÑÉÞ<æqdÇà 14œžÿ‡Ê¹±kÄŽ±Q«"©è|[î!X +º*™ú |Óчïƒ?†?¯øóéÙøâëñržcFaÜ:ÏtÂèG§«Ö¨±ŠyÖž…íUšµ®c›]3F/&¯„l_N”ƒ'[™±*òýŽ›`9À8è×rÌÐ4²•bâ Ü·ABpA-=DK×VÎCÓœ,’Ú“œM·Ï³,-¸› 0ß‚5x0°ÚtF²®é9€q>B»?|Œˆ¢Z’ŽÕ#Iˆž y&81Û#;”¾ÿŠ*Eá¡g‚w:S3âcZ”}fÚÎ+mä:¦å8ÂÀÂMA¢¸©ãÇF¶Lv¬6’5Q°ä}—4É6È@Jn׸ f²åK ŒãY¾kh–¼YÒV-ªŒ`÷^s>µ] ­fúºµ šÞá!àøLÆ›PÍ=´dZ0_ Å–ç“Xh†gÅ|èLi®Ø¤`ȶŒ Cà=ÙO¡˜{Pnú T¦÷l`Å'o-FZ8D³&Ì–Lô„›äÅwySà‡ÔºJ«’HZÇ~ÇÂe¦ªŽ~‹*/^xÖL÷á ¨øF£ä±²ï"S©°%qÅÙ5Ùg?St~ª9¾G™ùŒõ–)ã`ƒl*' –@HËŠð…¥µÙ¡ø3é«×-ò¢ä.}žÉÀªDEØa­‘L'5ao¾Ïdëm^qƒÙB2í¢á®+„ç!)Ýó|㆘LJÑ6·rìl´ùVÜ+Ð󬳡G%À¦å†»b¨ ¥NF0ßWd’ÛT‚-cèAáÖ€óƒBÌÀ#xâ!ˆ(Üx3¢LÖäÿ•6ÜÄõßã.#Ç­)¶ÌºúÀéÿçE¥Ð]]?2>€B:±À)r×ù邳fúÌ z ™Ã¿‹ÌŽFæÅšN½A`@æ°Û4ÓᢤvÇýd½ø¤| ?"„OÁ× +¹[à¾TÏãÅ"ßo«ÿÑÝ·½É]Ä?¶¥äŒ‘ }n‰ÆäQmpØÞ¦ vÆ|4¿žÍ Çañ&H×iM9K¹ýܸnºmžqÄAI[¼Ù/Û“Û>$èfÇr˜ô9Ùì²´<½˜ŽoNKï“ÓMw.€ê€5Zô@6®'"Ûø«'¹z©$¨YÞ˜…ÚÁ V|6lð}ã[ƒ¯,N‰â™Jš+Ũ(éÈ:-Ò_zÎ;ÞF˜®E!q˜ßKa‡,AeøŽrö-Û„”ÜDsµÍÐ|0Xp!¿_žqëɈŽAöŽ»gw7ܨ0cc|÷õüâ||û;‰®ÈO+NÏfYr†K²5ÑÌý³ÊT‚ñ…–_J¿Þ± •—w³ysníÕ’ÿà3~>­éì¾…Æ¿ƒ´aÖB‹mw‹ËÞS^ôìq5}ìæiy‘”Õ,­ôò@*rMvÉWùv®6i0ôðÐ?ö«Z|?ìžT³3I¶ÆÛUÚËì徬^}T³dUölÂ:^ªr—%/WI—ŸóMz“`îÑ72-Ôã+ÇÞÎðºSýèhEþ ²îN4K åïÊ´ø 2£²b þájvú /µeµ×ãûBs~´:myG2òC¸39~*w÷#_r²^¦Ð>°›ª—I +`urmI‹$….ðV’‹¤â»ƒôBÃ…‘bÈ©CÏaBûZÅ„T©Jõi8íÛ–üVññ#¸¢»ÑáÍíÅíD‘Qî ,N7¹<2‹c÷¸Ü ·u,B„{PÂþ²…p*§÷Qhð¥t‘o8åÞ.yCœªª¦ ÷R:¼eœ?ðÄ—!ç£ÌIA eY|%Û·Y|…•*×'ãT²ãr°7Ýl|ÉëÀƒ¼žn>å"Ùé  ¦³÷<¾Ã´’:ƒž”IåBä¹[àš“ÞLØM‰ÏÀ¯7¶ùç2´K ¶ÁkY:?ÎQ\HùÜ<Á\Œìàg«ßÒ‚²‹¶¯™«ãÂØt<ç§RDpO76,#H½‡¾Ô–‡òŠ>22çߊšhP0qÒI¼ªë@hûT\…)JžµjaF+ØÁÈò¸&"–z$—5Ò¢{àÌÖwE.FXÞ¦í…]?Û¦é’"plØö¾ˆÄ„°ÀŸek._ð…~…… ÷Í‹m÷XÓ +i”íôm&fK³eÉ$”<Ëæ +oe²òžN)’Œá4G´–u3ˆU]9pLëÔ28šs+&í+Ë‹µÑVmkÅËšJ•u>1p¥×1n±>½Mðª]ßï””K”¬£Ó ì«K“¥Zqé—îÞMÌ8G´ ­bÙ›zíáy„ö`QI–ñÐmcGr|bìÔfÕ`uD0ÅKK Gj«b=ÉRÌ›NQ`Ê+¦!DiJ&­%ÛSè¤0\ìò>\][Þ×\¦¯¥éÀmêu+)ªTDºø¸oƒ™|S <G× I@$`Ð>hý3™pŸ[¹¡ÕN¤BÛgá¨c/p4¢aÕzˆS›?…%Øß²†w%w±b±•´¥ƒÓC ÷Q‰©ÉeÙÚþ ÿ%]-¹Âs2…ìtO÷´`ÐB¹^°…@@÷¸«´ÚqΟl-Ž¤‡©XðI†$`©|+Q‰ÓeËL’ªk3m”Ôçjjó²át½e™s‹–<øRLkK£ +\ãj6ãAí}ѵo9´ªÓÿ*ɤô,f§UlvŒ²ÕêIžÀn6AªQ‹÷eä|ˆíŽÓ’QÌ8¤U©ô÷ÂüŸÇ™}]L¾Ó1e.EnèÖ>TªûLªíú‹\Yå…|ã£ôUöñ;aʃýÇvI}DCÍZÖpg|Ï]T‹—Ùe¥ýæ£1êNÉtt~Túo¤Ì?¯ÎgŒgOºÊ¯²ž;X;6mÁŒ9Ò†üÉ…FSÅk_•lZg1®+¿Jðô·I²ˆL~Œpøm’Z$eUì5ˆUôÛˆ´[Ýnn1ŽkÚüSn=X”ø¿ýLÄ M;ª âÍÒ²íø:~ëÛ»fð?Èöžcendstream endobj -4704 0 obj << +4888 0 obj << /Type /Page -/Contents 4705 0 R -/Resources 4703 0 R +/Contents 4889 0 R +/Resources 4887 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4683 0 R -/Annots [ 4707 0 R 4708 0 R 4709 0 R 4711 0 R 4713 0 R ] +/Parent 4858 0 R +/Annots [ 4891 0 R 4892 0 R 4894 0 R 4896 0 R ] >> endobj -4707 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [238.407 752.227 452.306 764.219] -/Subtype/Link/A<> ->> endobj -4708 0 obj << +4891 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [133.74 692.355 276.49 704.045] +/Rect [133.74 723.192 276.49 734.881] /Subtype/Link/A<> >> endobj -4709 0 obj << +4892 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [266.863 665.257 311.734 676.946] +/Rect [266.863 696.093 311.734 707.783] /Subtype/Link/A<> >> endobj -4711 0 obj << +4894 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [216.195 534.553 321.127 546.242] +/Rect [328.165 566.096 462.835 577.785] /Subtype /Link /A << /S /GoTo /D (bugreport) >> >> endobj -4713 0 obj << +4896 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [429.952 221.732 511.188 233.421] +/Rect [444.404 255.479 525.64 267.168] /Subtype/Link/A<> >> endobj -4706 0 obj << -/D [4704 0 R /XYZ 85.039 786.531 null] +4890 0 obj << +/D [4888 0 R /XYZ 85.039 786.531 null] >> endobj -666 0 obj << -/D [4704 0 R /XYZ 85.039 637.439 null] +694 0 obj << +/D [4888 0 R /XYZ 85.039 668.982 null] >> endobj -4710 0 obj << -/D [4704 0 R /XYZ 85.039 603.295 null] +4893 0 obj << +/D [4888 0 R /XYZ 85.039 634.838 null] >> endobj -670 0 obj << -/D [4704 0 R /XYZ 85.039 520.284 null] +698 0 obj << +/D [4888 0 R /XYZ 85.039 552.533 null] >> endobj -4712 0 obj << -/D [4704 0 R /XYZ 85.039 486.14 null] +4895 0 obj << +/D [4888 0 R /XYZ 85.039 518.389 null] >> endobj -4703 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R >> +4887 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F41 3054 0 R /F20 3021 0 R /F59 3455 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4716 0 obj << -/Length 1714 +4899 0 obj << +/Length 1699 /Filter /FlateDecode >> stream -xÚ­X[o›H~÷¯°Ô‡`©Æ\éuSunãJ+µÕ -vØb \ÖÉ¿ßsLbÜt/*†™sŸï|3ØžZðgOÏ´ÜpêKÓsíi¼ŸXÓ¬¼Ø"1‘ù@æÅz²xã-§¶e†V8]o{;¡ezárºN>/¹ü°~ýq6w]×°ms6÷ýÀ¸œ9ñòåõ§ÕW”qµzƒS×Ù°¸ÆúêzÅk¯p攱ƅ˳9ÈÜ€àë›Ù×õ»Éëuç Ûu1Êï“Ï_­i½›X¦ÓŒ-ÓÃé~¢<×ô”+ïùäfò[o‹×Ô”µÆŠâ¹éîiUlo¤*žg.•OU¹‰ö˜Ô&šÍß3¢8ÆœÊr*p¡åù¬ØÂLYï£6+ ™#¾çÊ|Àª<ç© ¬v¢Ý´Yžópeb×6pH“ŸVW¿kÿè>.»ÎÑѶ¬á±Çå•aÈsuuƒePæEòw*4·±€!eÜâRÊZ¤-ú9Ì’ûÆØ@w ¯·uTðX¯ÎìX´-Y.â×-– 3Å—¾&lµ¶uÔ´5 -Qš-ŽêÔ<G™÷Deh»ët»—ah¾¢ä÷ʯÊt¡ $Æ5FRA -ý–_Íà•B_ú°ÅËV»®†Âc! Å™ —¡oúžóà2g1º\z¦ïRÌÔkPhey\F*^ŽÅKRž¦ ‰ªB À^¶¼€¨¡nÞ-I/1ïB#Àÿås¡Ñ²L¹òxÆŸŒXnûèÉózFÕƒN‹ãŽ+KIV•Ëú^"¥‰ú/”Lkè帖¡Ð´#xË -…Q߆ð( è$"S4F±Û”[„…ÄpŽ:ŽEp%Ý<â:% Ïô{ŒaH+;€$¢Ç$€û9-¶EÚLŒ«j61Ž!˜A ¹DNåŽÄÁ†k7ÌÛ£´·ÌAɱ' é¹[iÞû±N¥¸®òô.Ú3œ1g*Ê⤠وÀí —™²«5ΆΠy3æ5,mPç.Þ¸CüBÊ5UÀ›W—eû äxF\ñÜm°@\œY¤m¼(«´È“¨ZðÊ‚MÛçM¯Ò»ö9æ½äêÄy—³)ud9¥ž†Š«ƒùQ‡ -¥ïábêªPú[@‚Â]}‘I9Sðd乌œŽît¥±Lh³(QBd" œvGÔ¶¸UÙÑÒP„Ôð`,⬠Œ¡»5a±NØ7è@™Vópc'ð†ý~0}0µF ¡ôE‡q'üvÈ$¸$ES…&‰EŸ¨0är4Y/¢[J¿CH#Õ ~qì#¾Ǹ`ìVyD<²Šödà‚%!Llñc˜¨‚a⢄™ŠUZ׎¢}„-Ð;©oÝ”ÅH̤Ïl€åS–A—(¨9/•Ûaî@pD˜êF)rCû'zrD…Óð=Bd‡wÈÜuûÈŸêûgÏF[)1k·: Ç7-¸Ò U†Ì°ÍˆÆpøÅò¬¸„ÛÂp=“Å:ýÞ&ü¶¹çg’n£.oAÓ>å׌’[ç(hèî|¼Eš&Ú3·=ÉÑÙŠ}?¶gGÿ®eóøÁ?3úË]¥áøØ’÷³†°ö¿ -¥Èšóú&ü{’ñ¯*}Þu×_®3K칡‹í ÓÞF"}OÔÙñKý¦»7Î4%j£¹¬ ¢ˆ5‰â\y"E JR1ÉLÕòr§˜”/Ã,ƒ\('gÚà¡,<û6{|ô÷ÕÄ›g¨}X€«OÄ%gnýè²È‡Êž\™P‡ü4ÇšZÔÉHÔ§yË9Ä*ÙõôJvw9ò…†Ìé«ÒÐ(woëR9’“O›_ÂÌ‘$~‚Ö¸»¯Š`"܃ÅÆ'B‹`uš—¦Šqšº®ðê 7´‘¾LÒ;*7xUˆó¨i„²Òï#¤4ЈamÛó,£ªtM·y~Ty¶^¥ùI•ñ|t!š®ªè_ªdóÇ.mEÕ¡(ý(Ç.Kп…jÿ¿ÿMTê,Aô=>N+‘Ð}Aî -TFƒ®ˆ‘Ž -ñ ŒÐ§£jËÏ{¤"Dµ¬4ÀÐY±“xãtj°ÜÃVñø#q¸\®Ásid"H:«þs,‹Ü!…oöñÏY×3ÿzóøkþsåþÓ/;ý7± -Ì08óIì9ŽéØ}0ü>ŽXÿtòßFíendstream +xÚ­XKsÛ6¾ëWh&‡R3½9Σî¤v+§$Ó¡HÈfG">jûßw LZ'™Ö>‹Ý»ß.%çþ実Äó{ W&É|? ”ïªÀ7ï»ÙÍìσ^ æ¼ËâúrXÊÄM¼"éI´E±+i„‹ÃQ잆I>`ΫmÕ7ÙغŒ´¦Ø ñ„£ÀŽ[J ³(Ž!}}7ôC:¶©ªîħœ¬æ' ºA8JœYé.[Uµ.wyZ¯xeeqHÕ©¾ÒF[ Êl×çæîLTÛ'®ˆBÉÄ |¾ë%F”.ûIyQZtCâKº!sbpkѬ"׋<# ±&É4öÆÉÀ—4Îè˜2"mÈhñ-Ñ$œI")KKa¸ô”t£$œDc‡b÷xæòœ﹃‹†GßiÌ#e&íX$לeÌœHWAåE! •Áª/r œJ1$EÚuHR&Z5ûP0¡à0ÌQjã‚õN¥ô¯!‡²ª-Jí2¤@ +'žŒ%?v} &„jÈÅc¯áFb¥¼hë]úx•îµEs»qìŸrË™q‡VçÑb‡0jŠ/‚JüD&ê¶ÖM[•§3HʺuœCt逫CÍF8Õ–¡õè2„œFëÝ°µ5üDùÑ¥¢cÛ á‰G¥5&$-ÌW‘ßÇÔûPý gx®úv‡-ŒéùÉiíÕ++)Nø„zØ=žls궠ôÂáW¡DNN8·0‹þÞCÅÉùmóÈÏ\oÓ~×ÁNi©cq-¸ƧØ{|ÞØàdbp©u>M}Í¡>Pƒt×½x¾Äqâ|JÕ©?§âTÿ¼¦çAóóÊ¢µìW\@àï…bÉuø’ª_;>MT퉗uy`dC‰©šÈßиÐË« +¶”)u0ÓV¬Á¨§šPdœ¨B°ñ‰‘FQvì×Àv꺮ñ³…â£XÈõKU蚺l—¶­¡1ýÝBT£Ü ”J §nt{Öö›³§-öCÚÜbwh@¢íëš¾þð¥Î7Ý꨾/!–^<Û%0@à¾ÿ߀MZß7EŽñ÷¼N¨ç–Œ{†Ûb¥¢õ%R”.ÍáÄûT¿¶ü|DjÂAÚ˜•X»(o¹&È©’°œ5W†ICÜ|¬ÀÑM1Ä&r‰1cpkøVcÕFî^ÅØΘÞÍU¿ß`«ÅÑ8üžœl¸}qƒíˆ½FñÏ£Ï~ÊᣠšgëoFñû±ZŒ|ñgé…Ï-”!4HØ8 üÜê;endstream endobj -4715 0 obj << +4898 0 obj << /Type /Page -/Contents 4716 0 R -/Resources 4714 0 R +/Contents 4899 0 R +/Resources 4897 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4683 0 R +/Parent 4858 0 R >> endobj -4717 0 obj << -/D [4715 0 R /XYZ 85.039 786.531 null] +4900 0 obj << +/D [4898 0 R /XYZ 85.039 786.531 null] >> endobj -674 0 obj << -/D [4715 0 R /XYZ 85.039 724.851 null] +702 0 obj << +/D [4898 0 R /XYZ 85.039 766.606 null] >> endobj -4718 0 obj << -/D [4715 0 R /XYZ 85.039 690.707 null] +4901 0 obj << +/D [4898 0 R /XYZ 85.039 746.481 null] >> endobj -4714 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> +4897 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4721 0 obj << -/Length 1146 +4904 0 obj << +/Length 1096 /Filter /FlateDecode >> stream -xÚ¥VKSã8¾çW¸Š‹SEÛ²›*@`–)&0$¶fç ØJâ?‚-°¿~»ÕJÆCv‹ -iµ¾Vý’âY.üyVÈ—EÖ89œyVœ÷\k;ŸzžA dÐÂœÏ{Ã+>²<׉ÜÈš/wçD®Ã£‘5O¾ÙœÝÍ/ïûƘíyN0‡öYßí‹‹Û‡éwûzz…ªÛû/}vCfϯo§´7ÁÐö7ÎÎûÀÌx9ëŸî]Îw<[‘xŒ!ËÇ޷ﮕ@DŸ{®Ã¢ÐzÙu¼(²ò^À™ÃfÖYoÖûº;‹ö‹¬º’ÂYèðíg…ñŽ¬p±ÎÊÑQZ$ò¹?à>·›4™6ùBV›pÌmùˆQ‡‡¢}‹Õ‡-r‰ð‡4Ù³ðÇŽ‘…Á{µÈbv=<ãn·‡=ü]•æ¢zùT•ÍFÛzî»m'e.Òb*r U -ªm–È¥h2e"ª›â‡W^;÷`0'Éú¢’BIê*µ–Ô”…|"MZ@KéãQ½À®{!YbÇ=îâFièꄲë²TGTgX/ÒbXgbÓªË`IߨNœ¸,–¿ â^“€‚öý1°„­Š¸ª’¾+Y£VQQ)Òi xÒF éĪ}B.~P|&Q ®é0“ºS³£ ëeb(UZð!¦ÿë'öϧ/t¢Ðï~ù¸ï;¾·#£_nß}Íxû[|Ÿò¿ïD¨endstream +xÚ¥V[S£J~ϯ ê¼*!LÙ*Ôè·Üèšø´»˜Îa(uýéžžp¼ ®žJUhú6_Ý 0'€s’ÈøÔ™$±qæ¤å p®ÁòyÀ¬Gà„~Gh:\F'Qì°ÀŸSg¹6.Ëì»{ô÷ÁÅòørèqÎ]Æü¡7™$îÁpœ¸GGçWó%ZB÷t~‚ªó˯CÖ„»ËÓó9Ùfh]è.Ñpp8ôÀgŽÇ‹áÏå—Áñò&/ôØ#¨›Á÷Ÿ“î/ƒÀçÓĹ9ðÙtꔃ0â~r{_ ƒo]²…Eõ”îí<<øIv𨇃¼Ê䀎&‘Ûˆr%§3àG+o°„Í0á´ßÿ¢ÎKQß®U»5±,øãØ™*E^ÍE)Í´o†er-ÚB“´+ô°Ç¥y!÷Ä¢j)´¤né¤fWò–4y­2éQ½ÂnÞ“,±“w`5BÚjãzý‰ä/X+¥ÿzÑ8rýQ³Ê«QSˆ­-µÞš®¨ÎüTUë7‹¸4 JYÇ@éÁ¿ÑÔ„U+ºÖ²A­ ¢Ö¤38Ée¤kðÐ3”âÕg‰qCÉ,u)R³ÆÇ6ïbb$u:Ê«\û™¡##5Öˆôù¦Œ!Ïx’ôï6”â°»É=“ ú7Ä‹ÃäžÂù9rSàÿï]uñÄg`˜ yà\b&4ú‰•hÌ,X¤=˜xè³ð¿mc}Ûvh¨CöU-±#1Œ«Z¼A–ñ¬ +o"Wd8›VN ü˜[a„n([zC£Šº3z*]³ôh&ªm4ù¦4vèÍÞPr¹ƒa–Aµ„Á)ºf‚ä.ÅàƜ߳×;È̬\º·yQ Ä͈'Ôœ&X«VF>y…må±»ÜXǵ‚x KºíÆ g³Ó’~,}a"`7†Ñ"#k·Yh+•ôå&­“6G‹Ð´d±ÄÖ„¯’­¡ÝÀ“q6_ôP!‰Á:§Û³kZÑtkl×\¡’±·WЮßy}-ªü·Ð9ÄÍø4ÂÄ$âˆ<—UŸÈž¥û7­¬îÅHª¾îñU«dªÓB4Mtnt£|ÕC˜=@RëG(úŽ·ßÈaW; s©oUý«/±lÒ:ßâ±6™©Ž?Î`nÎf¸a(߉r[tÔÙ‡Ó ô‹‚t—ªOZ1Ëk DÕ÷tûUTâZ–²Ò¯5%­öɱÞûPÔ#lÕó°twš=ê8ì-§~™¥…Ôð’µÍj·¶ñYÒUôê œ'O!²Ø‡‡?ˆþ —K?Ãendstream endobj -4720 0 obj << +4903 0 obj << /Type /Page -/Contents 4721 0 R -/Resources 4719 0 R +/Contents 4904 0 R +/Resources 4902 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4683 0 R +/Parent 4907 0 R >> endobj -4722 0 obj << -/D [4720 0 R /XYZ 85.039 786.531 null] +4905 0 obj << +/D [4903 0 R /XYZ 85.039 786.531 null] >> endobj -678 0 obj << -/D [4720 0 R /XYZ 85.039 458.172 null] +706 0 obj << +/D [4903 0 R /XYZ 85.039 512.369 null] >> endobj -4723 0 obj << -/D [4720 0 R /XYZ 85.039 424.028 null] +4906 0 obj << +/D [4903 0 R /XYZ 85.039 478.225 null] >> endobj -4719 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> +4902 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4726 0 obj << -/Length 1980 +4910 0 obj << +/Length 943 /Filter /FlateDecode >> stream -xÚ¥XK“Û6 ¾ûWh¦=ÈÓ5#Š”,e&‡ÝlÒ$“&ÛØí¡-É^µ’èHt\·Óÿ^€ díÚN3íd²¦Àš{üã^±@¤Þ<‰Y$¸—Õ“ÀÛçÛ w3'2ÉÜ,'O^F±Ç–©·\zÒ€Eiì-óŸý篮ï–/>LgBŸs6Íç‰= ÿùó÷?¼["Gú¯ß½DÒûßM9pá/_¿G¼[äMúKd\ßLg ³Á‹é¯Ë7“ËÁΑ'\´òãäç_/ÞL&ÒÄÛÃ:`?ãg0 ¹DÂÌu&dÈHÉ,HÓQá¯ÑÚª²®ìËfƒÔÐÏtFժɉ°/Ñ¡Šöt±@ŒGt­œœéõfºA•¦ Ž¨zíÄ@A/ùööõK¢þpY‘jd”´U?Ђ<^Åõ+·Ááæì52Š‰¸|÷_; B UžÓ—Ù'÷YÑgÙ”¦ÊÕ–ååú_Át‹¦±¨ ­mTÛMá¾ZÒÈA-ÿxñmAìú©w- ½¥ -v7ÞÒÊZ’ß—p–«÷™÷7ò¾HRÙ³2Ëé:¢YÞNê›VW¤ *;s5IN‘´§`˜‹Ê («ÂimN³œj‹Åôv¸Ž>™0Ø…â+ç’Áµ~Añ… ˆ‚èlñESBÉB~QÝ€Z9é‡Z†¶%¢2% -t,=hF)ººö ]IÈGsÆ#n§ÁCcoê±—NÂÆâ4BÞG³@¦© ‘ÑÚôÉž¼®¹w«ÁLod©S;éµ–òd„S¦,žGžÐß\‡½)Ö6×{aøØU½RX£R†šÚÄÆï*³”¢s·;l"ââ-ÈQ.ÂâŽh…^ø'.é9XìèKSX¡œ¾anØæ]ÇS†t°=na„¾­êë(B.¡jÝKpÙØ•(Ľã3AŒQn¶}2™Ž™|EüÜæ•«5NÇ -Ï:<=_s èILøhµ6_¹ºS¯¶Øeúʳwä"k ó<2—±7Âã7ææÞl˜PþW¾…›‡ŸþD˜°t.l†Áé˜#ˆR$l” Å$ƒðJÁàS€ÿ\7Ø6X¡E".±AÅsa1{¾¢ˆ@²¹øÛŽ2”7gF°p²y0î—<ò×£fi;6Pc*y­ª 5=|ÚŽö¨ÖmVËOÓJhYY(UŽck'Gx È -ÃÐ×i§lŽ·Á]ïÀnB„~!Ól¡­vIí—»¦¢j”ÄÌGÒžÆr-Û••q,l7§ãÙ11e ƒÒc°µ£Ž-øî0Üå™õ -W( lt ƒcf;‹.¤j…̲ÊÉ|§†÷ôÐ-Mb­!JIáÂ¥Ít\<ÜS¡ÈªUhcY¸ð†N=\Û¸6hëÙ£jÔ¨#læ•ë"vŠ/ƒIhMT!ÂQ¹¿˜jeøX¨"rQtvÿ>\fãŠðžáGhC3J§ê§;t¦ºBzìÛÀ©íÈŽXÐåóžn†zÈ*"æÍXî4ݲ1þ…æ¼WÑëç63ÀΊ &’”=ܺ·¹ƒÐÝÐŒFå¸>Ð;»w}g±ß.%¤; õ5§Ê僉%wVšlìèi4L; ïÆu™¼'œƒ ”ê1péT×ep'kKzX Œd@U? Ê Ø ‰ä`…ÜZ9±­ÚôÊ\jUkZïûDZ N¬¸)¸}h€”]…2}ÇFÑaúoaܞŕ¯¨"`uÓ*”!$×9(©šô»ˆ§K¥O8„´^ëöÑÛÉ)pc1¼Ú”›DGO æåàWft{ ™ ÞjnJPÇV(wÀâ|—áB0‘|¶ÉE.ö?$Lû_ìúßµµ5³J[ì;*ÆûÍ©~k;£Þm° ¨‹Æ\2.<)?o÷Qæbs„©=Œè.¯ñl9JQz(Å=?ôîøDª»!¥Å.äަǼUí­õxsß/hc7ê#0\´§6AF¡‚ýF“ý쀫+:¯o—¤ïÞøÊ[»D#ð݇­ö¸£· £øÞMà |TW }\jI;ª£ Æþ¶`—ÃNU$Ûú <Ç£ êÂ¥ÑÇ:tnDŠ˜¤¼ƒþ“³ÿëÇ°JFÀ䘅!Œ©ƒ16BþØâþW³S“ÿäëlendstream +xÚÕVKoÜ6¾ï¯Ð$4bDQÏ>¬_‰ Ç»±äšæÀHÚµ +­¸Ö#‚ô¿w†¤äu½qjmP,°$g¾Î|3I ~Ôˆ|â°Ø£€øŒÙfækмšQp 8ªÃtöòÔ ê؉t%!iþÞ‡¡Ö­_5û/Úõå)}øy·=FJÏéM¡®«.¦¯(Ø o.ÜÍrCH,G€«”7€(ju7ò–(4ù„ÚÝ=º¯à?WhOuç‚w…ÖM@e¨¹V‘îNänDIDc}=µßny‹VC¾'ÏÀ!^h0‘¤ÚÌs Ôn×*f®0Úª’© ²™ãâIÅ 6дJ0”˜P¥l:L±@òá€\pëF¿ð @—]¡†VIÅJÃÀÁˆ¼8>;UÒßêUÊ5*Je*xv¥˜/ÕÖ9ï *'ËH'ìëµÿY÷ Éó\-ìOz¬ÔXÂÇ Êù–äåê‰f +¤ÃcУÌÄŠNÍñ„C9%GZÔI˜î¨"Ã,~S(õæ*úF­.Ô;j¹kÒ¨NÓˆ¡„*H-¯õ˜ËínÁi ¦`\n”ÒE«dR„å‰Í®•Vå؉:^®Ñƒîo¨r¥7’7~|hõ'{{;•eé¾G#u£GY„ð*Ý ð/Æäªendstream endobj -4725 0 obj << +4909 0 obj << /Type /Page -/Contents 4726 0 R -/Resources 4724 0 R +/Contents 4910 0 R +/Resources 4908 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4730 0 R ->> endobj -4727 0 obj << -/D [4725 0 R /XYZ 85.039 786.531 null] ->> endobj -682 0 obj << -/D [4725 0 R /XYZ 85.039 328.974 null] ->> endobj -4728 0 obj << -/D [4725 0 R /XYZ 85.039 297.686 null] ->> endobj -686 0 obj << -/D [4725 0 R /XYZ 85.039 133.38 null] +/Parent 4907 0 R >> endobj -4729 0 obj << -/D [4725 0 R /XYZ 85.039 99.236 null] +4911 0 obj << +/D [4909 0 R /XYZ 85.039 786.531 null] >> endobj -4724 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R >> -/XObject << /Im1 4096 0 R >> +4908 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4733 0 obj << -/Length 2352 -/Filter /FlateDecode ->> -stream -xÚ­Y[oÛ:~÷¯0²Ø ÄŠDÝä!§MÛ­“m\ì.zú ËŠ­V–\Inâ¿œ’¢,Ù9À. -Ô9ä çòÍ c-þχži9Ñ8}Ósìq²Yã_y?²ÅTL5š?æ£Ëwž?¶-3²¢ñüIY¦ùãùò›ñæÃÍÃüöËdê8ŽaÛæd¡q3a¡ñæÍý×ÙV\ãnö¦î¿|žØ|5tŒùÝýŒÖÞ -Ÿs9,Üü1™ršGNxû8ù>ÿ8º+9µ›ØŽRþ}ûn—üFG–éDáø™-ÓŽ¢ñfäzŽé¹ŽøÎG£ª³hÍÓ®!¥HŠ)³Ì€±>» -;ç€Ócg§¶Elˆ“Í\Ów|®~Ó |âðWÉƬÈôoñ|“¹­ÅlO³˜¤’D`²Û®ÚxZÞòQž’¸ñ\“ÛW‡JgadzÌkœúâšWÄ98 =¨,þ´l—s^íª¸á¿YY?=gÍšFŸÈIEsmÇŒÜpH´¾5íi#Û´ì`p“Û,@ ¿­òr:Ë¿´$Ø9ÂÕ:M&»*ã$ ˆ¹'…^“è;>]IZ ìN‹¤Úoq'n‚aŒäõó„FYñ‰eÝ9qLÒzà´"m¨@±¡ˆ7ig+EÄÖ‡90¹å£÷÷úIô ,Êêçª*Aþ-í‡Ìn¾ÌînØÿxå r,öTi7é’>¶q¥|/mÒª>~È’¢f…sâ"à k1~;£c›R¨º ÏëT¸Ð"+@°M±Ò©»'·¬J`Ø Î÷D,,÷U~JÞùšF#Æ5îZ—âüh’aÕ4z+P0#7A«•`ÎE‘ªËÄ…ê ¸Å"¥-á~Ow]×5¾ÄÍ:,²æ¸°lW 6‹ÉnGKu*Ñ94mêP”E!‘4Y@Û©¸nVµdeµ?.ÓŸ–gùh/xBãüB ð²¸ÁÕä8ô‚HbÀyYœKô,…wñ.oø¤=øã?¯‚!ïØŠ$A¼Ýä“wì^«Þ`Ò&†úà -ÂÀÓcm¹ŽÅ§0áOÅbÙá+ãV¾ÂpáG]^RüKBZúvEîQVÍ÷~ˆ€Ûc(}ð/2CY7å +þsyù´CWFÍaÅd4e"à¯NhFy¬ -G r/ÂyÒ\ŒrTáXB`P-Àg¥¥œb*#£t¹ŽK#·wC³@(=z=j6¤LD™UcM¡;a-áG;îåþ‹Då¦HÌÚdª1@ƒ¡ÏH gï¹*5Íýënþáþ«è~íʆL€óìë§Oš—ï0LlÆ/i­ÒW(“x/¶ú×Ñó ust{£éàöšõ°ê‰ õ3 Ñúçs4Û!ÈBBœnNÕPÕ«”¾+ÀÕ¤Õ¶“rGN¨ê ®²ÚÄ4™ÊŸzµ}ëôÐÓµ‚Àä°+Rè&.¶29ù“@eÌ,¯ÿ -Ö5•*FäM–mé$ÌóPHz -ë´Ü”dOû~²_¨ªâ/T™”]ãJ3îªK -ÿN‘yÚûîÝÍÇä&[ªßÊ­*b.–²<¼n1‘À®»t:ù®Ò"­1÷lé„”ŽþCZÑj­Fn–¥ª¨…K˜ûùš !5Žùø4“-áŽo•èÙ°Ä›¹©ç?„%¤>rí=•ñZç&¡b[%’FfŸy¢p3mw¨WæWc¦ÙÿÛë…z±qìÈ ¸ž»YAÄÂÐ }r°Ï„—eŽÇaâðŽrR Á´Jo ó®èÓ™„ •U^üˆ ßÍ!1ÚÁ7~´eW’‹bƒ—JÌsz¬Ã±àŠ™,`BBõñ;˜ýûPb¦¿UMQQ‰Æ"z'‹9ú†h€Yè!À/vàœIgR´08µ.ë”vk•ÓØÂoL?ØRA gªÇU©8¸|êPÁ—‹x^ã5ýÐÅI -u³•ÀÏër—SògŒ‘>SØò^<ÔPªÿR]MAÍ!?´­áq?*ƒÿJeð“V¶¢:ƒ™¸@n60h©Þ™Ð3S\ Õ(| ñxýËÃä&þ)ÞÙð“#!´™æD+£žH^Þ«w3 }%á@UË\ã-P±€×óQ"ðª#X‰w"%?›OóùBk X®÷uCVÐ/θHSzy>ªž=û=BŽ˜g$±h:•-”Ÿ ¤DÛg¦D'ÿþ Ñ`6cV?›ÙNhÚVˆòËWk× ¸ù­ŒGÊ%P cÈÓ³¬ca ã>0¨Ñê2½óÔÔ“ÛñÌ(ôOËÝÒͶ嘑ï¢ÜsaÑÐé•••JšÑÅ;½h•cjiYÌfZZ±D6²xìnÒ¶§ -±¢%ª[YñŠ´NduD‰WÖ®xÔZ6øÄ ”Ž,CÓ¬–_¾q¥ÊdǦ^ï^y—åQrÌø\ú³P¿è¬ÿ?E—rk³ak{¼òc¶½”±C‰=îÄ^è ˆü_M•¢åendstream +4914 0 obj << +/Length 2695 +/Filter /FlateDecode +>> +stream +xÚµYYoÛH~÷¯v_(À¤Ù¯üà\Çk±»˜ÌEÑ27©Týû­£›¢$Úž ;0`6»««ª«ëøŠþÄ$<_%“(½@‰I¶:ó'KX¹>†ÂŸhÏ\z5;»x„á{‰ŸLfD2[üî¼þõênööÓÔUJ9BxS7Šbçj*cçõëÿ¼áŠvnnßáÔÇO¦VcåÌn>ÞòÚ\9íÌpáêÕÔš{ |{?ýcöþìíl “«=*TêëÙïø“èýþÌ÷TO¶0ö=‘$“Õ™”heÞ˳û³ô\xMOx×ÈÑ]­/ a FþqB{B‹Qq ´Ú“âI6´É6<2Ô‡\OÅ&öƒ¤¿“PÔ—ÁðNnk°]‡VÌGì‚á*Ãäë¸é$Q¼:“¢ûM4qq³“75¨4Ùk¥O7xìEÄ#Žò*¨ñ¢›|êÊÄwð~ÓÕ<…·8q2Ô6…©ŠßÓŒfòÿ·¼£{4[:pšœF8w<×æHÙÀÄ7ÚØ0Ÿ’Õ~©r"Zð[W›Ý^{)ì—wF¡Åª¨Ðšt›è> kJ³–[¤¯Q ª±à(*”ƒ#bŒþnOî*äwñNs Áõhc´6Ïš¼k½n1gÚÓ†¡ªÐ.P‘.“>FÒ5Úý2"Æ w2qUèÅ¡$M]wŸº œv5_§m»]ð«»5ӤαO©0ñ„M\H%ÂW?åä®ÛF¶.nK~.î\yq¬(ˆ#9žâ\)=Á‘I¾+ýß…ÓØU{$8¸zçu]}ö…^n¼úw 6#çžœú4ìz1#:(éùœd8~‚fä>~à<€°º,Éi·‰õ5øaCnEÎßåMËÄicv¥Hþm„NZ”éhK³nMÚº.®xY]=ðd]!åŽ_ +3¹#GÇ£ãÛ7|EmÕ† ,KâøºEö©Ñ ÅlŠ’óNl‹îq$¼öA¨Cé´›5ìXcD:5ž·ƒëˆ•0!eõO‘Z9é)êUÚYŠv)ÍYÕ‹rÁы䤌ĩP”i¤éx¯û‡Ô88ÜS"ɼ¡;)r#ïâô„5jR¡"ž]†àƒŸ@J IªL»|Á/à ÃãÑ]=ðZ½îPt]µ&úƒaâ„ž–Ƴ0Ò!¿P„ÏÓìKÊp²úa eƒâ·\²2_ºnÙí~Á;mÐÈç#2# y-0ûËEºfœWi¸¨FÄF¡§td¶ñ…:D'ly Q@ötU¢à´lô€så˜$XV:yFR ÙVŸHz(J·~Pgcª¦?ÆoÙÔ3l7Å÷Ö Ýe],Vé_Äz•fE•¿À\À0âG¸Ó jåÃ|pTx÷õ©ÝUÙS7 Ÿ‘õ3 OÎÒ¶å3êòf§Žø¤-^tq~›¡ÍóWF’Ž %t'ãƒÔ¥eèª84¥Ô”ÚÌbªbNÐÂ'›²OÌ€#0JšVÖ\'¸¦œ*ø —M «´b0ͧK«XeD’¶5·EYò¨ª;¦ëuÄ—&ç2‘s¾Ä©G{®Æ z„¾p~åZŠÙ4çjf©Îagà(bÌaњܷæ‚zjè#âþ|ÏØAÇ^ÜÃ>„%+)£J¢Yh«6kæü¾µà+N ýð9¨ð¶@’†•uu³ãÙ¬Þ”ŒSi§)rD•yX­ñI2Ñ|„n·Fãá$^€H Ž—h‚\¼Ö,MñéúŒóö{aŒAéü¿ä±¨ákĉETO3öŽ·CJI¼ÐׄU=µ—DÑŸ‡¡‡Wdé íµÁaÕ!ê ­'H¼&؉Þ,|H+p÷U^ur¼B!è=¶G‚7@bÜàÕTB3dh8 À€.!­lrØöÝJÔòqðN{Š Áü]J`¾5ÀùoN‹]VBÇFZ[hÉ´í#a£Òˆ^™ð‹QðnN °)ô\ù÷¢í +<Å’;¢“ÛªÇì°Ú<œxâ.­ftY¶¼¡›rÊaŸÓ’i1âèÅ“£èy5AߎSïâû7<’Úrä²h–zÖHŒ^γ‚2²]-ìyIS¤±wdÏ›u™…Ï)·ºçh$M›ÖìÂåâ‹IŸ8±ÏVU˜»zF¼H ­íÈ>›eM5Š !ß !Ikž¢û Ž4œ$mºÚäÜIî[÷95HÆt4Â*~¦üX¥UÎiµ·²ì“mΔØ Tjøm¢ƒÈ©Ò—ÜušÙÒ¤Eâü¿ˆ.#1„ÅØ°é8Ŷ”Êù,”&Ý/¯z®ÛóEvùuc/“T%UR\¨›åߘ Û +0a¶l(‡­ù"q†2˜”Âȹ¼£ë©×¥eŽQB¼„Á×MN6´òú5º|zùü¹Ä·j(è„vÑÊyOn‡tûÖ‡rc}Üg}€sÐÞÞßÃÎωwôÅñ/ÃÕ×Í‚›yêyaî³ø½|¤%,Œ‚¿Y!é8Rô¡zy—]Ôë¼BDwaúCq+pý)¬òˆ9föKó0—ŒÈá‚£Ì5‡Ùæ½:‰÷ͺ«ðd~Øgv hi|‰ßV¦ZwŠÉó^;k¬._19E)<çiK­+ k#õˆ?Þßü›ß¸õ1Ûñ¢•tfzX.,–’™éÓnpû à$dVé—>™àVš°QǨ +LžT¡cZþÖ–Šï×{ÀòË)’X:ïÐW¿Á®Šf±€d5FZÑöô¼¹å>—„é +QÅv70/,$ÿUn.å4¸Ð›—eMÂ"æKÞ‰Ñ@¸äâ—Ù5{í-û\ˆ>þÔâ¢DÅÛ¿˜óµ¼»®øÃP14¯7ÝH€@úó|Û¾©W©ý€€4òMZ1m±rJŸNÈg W{Ë¡øƒÃ=ÿ…nDä¦À#p *íE>0–ô}Ÿ‰Ó ®²®°‰~º8FÖ61¨a@ñÄ‚›`Ám b‡“Z† oøƒQê8@N¡¢ˆ¬áÿÍFÍÞóñ°ÔS¦~c +ùnÇX¶µ­ù®M°!ÅS`V>få‹ŸA)hbßÀt=\¨y¢° ¯ÿp—ö–Íl±/ïÈÄìmLbãÛã+kxiû˜WÜ‘, +îûÊÐZI¬b ¸³±BZ tƒÇhì{œf1ÜMa©°È6ÙŸÐÇ‹Æ`lrªº1—ÑÊ Õhÿ#B(Kš[,º-F.ŠLtÌ60ŸúF˜æ×þGÅd„çmþmô“šò½ê5yGv%Û ”ÐCô… Æ劊i2øš†~Š8+Ó]ÃÐ ~ɱtÜù}O6ŒùSz¹É[~¯ùûzï-÷âðÜT{èeàOƒErÍr¢‡‚œŠøh€ó#Â:§ -Ôt€ÆpŸ‘—$Oô³†åÏývª"OìÕ{6X…LŽõ:•UðþØR÷endstream endobj -4732 0 obj << +4913 0 obj << /Type /Page -/Contents 4733 0 R -/Resources 4731 0 R +/Contents 4914 0 R +/Resources 4912 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4730 0 R +/Parent 4907 0 R +/Annots [ 4917 0 R ] >> endobj -4734 0 obj << -/D [4732 0 R /XYZ 85.039 786.531 null] +4917 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [459.55 439.554 525.64 451.244] +/Subtype /Link +/A << /S /GoTo /D (confldapex) >> >> endobj -4735 0 obj << -/D [4732 0 R /XYZ 289.523 769.79 null] +4915 0 obj << +/D [4913 0 R /XYZ 85.039 786.531 null] >> endobj -4736 0 obj << -/D [4732 0 R /XYZ 85.039 322.14 null] +710 0 obj << +/D [4913 0 R /XYZ 85.039 620.879 null] >> endobj -690 0 obj << -/D [4732 0 R /XYZ 85.039 162.479 null] +4916 0 obj << +/D [4913 0 R /XYZ 85.039 589.592 null] >> endobj -4737 0 obj << -/D [4732 0 R /XYZ 85.039 128.941 null] +714 0 obj << +/D [4913 0 R /XYZ 85.039 425.285 null] >> endobj -4731 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +4918 0 obj << +/D [4913 0 R /XYZ 85.039 391.142 null] +>> endobj +718 0 obj << +/D [4913 0 R /XYZ 85.039 186.188 null] +>> endobj +4919 0 obj << +/D [4913 0 R /XYZ 85.039 152.044 null] +>> endobj +4912 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F41 3054 0 R /F59 3455 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4740 0 obj << -/Length 2956 +4923 0 obj << +/Length 2808 /Filter /FlateDecode >> stream -xÚ¥YoÛFúÝ¿BHQ€ZD ï#€\;i\¸±7Öbº} (Jæ–"vüï÷»f4’(y‹4ÕpæãwŸÃ¸þ¸“$´?ÄId‡¾;É7Îd '¿^¸1™óËüâÃç0š¸Ž:éd¾ÒxRÇÓh2_þa]¹z˜ú6ù¾o¹®=Åqb]M½Äº¾¾ÿÇ×9žÖí×ϸuÿí÷© §‰oÍoï¿òÙ žÀ^`Íñàê—é `ðÓãôÏùoŸæšOC×÷‘ËïüéL– ÑoŽí§ÉäÖŽí¦éds„¾¾F'!ºÔ;žg=:G[.àgè E•D9@g³‰ÃÄŽbŸLí$ ‰9*+À[¶GD‚ijž²ŽÀHAY;èÀÊ«éžøÑóªø> ^€‡xØù ÊÑ1HV³ ¸ÎÑ_q±§Œfdù0³áe¹Ù¢ÿ‚ÃwMõÂ9)` 2-ØÑôå—’â³€Mß‹¬¥âŒbì¹D–Ö|Ä6‚EC¾.k6BŽ"{Bð£ç'â—C¶^ƒÊgAàYŸ1m“1ߦi3‘[5í&ë1°è}õ«É/‹>+«NxYñéÝï fˇ–/×@qÙ½ž´#¼ç£¶X­é©¬¿ƒ¸ó¼ª‚;‰ÂØN\Êî|Ô®'¼øfD¡‚žà‰{vˆY¿ÊI¯Í0U~Â,ݪ䵢Ƞ}¡%ên²>[dÝç~PV1X9Ê -æ<¿~œØN°Ç.Gz.†ÃX])¢í;ŽÁyʶ½ö3 B/õmÇA…Ŷ“Jb]G÷v«U/lŠå+àJSñm8ƒì´*4z>ä0ɇ¶ì‘¤¼Rrë†ÜH×(DV-³­  ØJ6èE [ J|+~e‹.ÕfBÙ“ ÁËb•!¡ŠâÀúCQ¾ãqÙ -aŒx|¯¨g¦#sjÎÛ×­Ô;ÎA "r¦$­Aº$JRh¨®âÓKþ!æÒåÇ¡ƒÐä%Ú…Ô -kSUÏÏœ_ÈédMzžùo¼ìÅUÍ(}a]Ïè¼U“TÊ8ý€Bˆ(½Žµ©ï’RþùTP¦HvYRQÁMÒ.Xð^²d­ËY–]Þ m¶.„_ʯIï²EUŒÉifÉ/Ÿƒñ•ó z¤Ó -6ÔÝyæ5葉 -Qx©sTæT͇ـ®AÉ_AÏDòÚ=HæB5{º¹/!ÀY!zÒK=#ɵBeE&ßðÃS¶/,¸†t—Ĉ٨[EõÚ˜ 4V|Ð^ëeIÒìUè l.Có§RlÀ5Lk M½C·«#ª FzR #ˆ¨„"B¾ÄÀ÷îx£J]•q–^tyæòÍ Ä|;òyÿé',´!_/¼¤xÄÅ;®õt¼Ü 1\.ëw²—çE‡.>,°Ï§ã¢~åÎ|¯M-ÈŠªËÄŒD7‚ñî6´Xí}Ý«%að`¬ò£=4‹WÅÜ廼¾|Ì6‹Œw®ó÷Íp¹-šmU¼_æ—ßà1ÃUÓ®E˜hçÆøSˆÿÆ?5Ê3>’ûQb‡qtv,7`¨õõœãË,?€¡8æua‰& ì| x¬ é—òb„Íå6º(ÍM_e”`rlx^5SŸ¾„Ê ÑÅF2Ð²È ±üÔöÃø¼X;˜ãŽ^áqb\{—w¨ôfÜü"ëÀÑUÎihà–Žaˆ#mÿ­’^Þç•Lñz@¿ß¨^JM³GƒŠ±k»¾t0š:ów3>aúx*}ú‰cmÐ×"b±1Æ‚8eÂ1MºKKŽûúŽ·Õ¬ë¦®‡\u,ùé…»QX¡ ::>– - g)‹ù(SGüóp‡×BF”#ÌÆ\¦2ˆ÷£ÒŽ‘̲LsGͲnè@¦/Šì(‰Þ˜eôÌ?ö¤CœÈ‘¡ä% ÂØ’Gj¤ÊMÖ¾òó²Ù \´Î.I-çZ¾ÄØjÇ*KÇ3-ƒœgÛB;ñ“=¶st{ê·½Ò&NÝÌ¥rõ>CŸ¬D¦FçN„½÷•vyÇÖõÀ˜gàȱã4ÝËl†æ¼”5祤9üy V†5‡Ç7¢9\_jŽ;_(+žj)âÃ¦ê± ­Píùrw1ôFãF|H,àšcá;¨¾t -k´Õ´!nx8ÓIŽÉpþÈÈ·¯rÎ1úæCº“VÿR¥ £$Ýññ¶YXm6!J«gÝQ<O$^ÏIíÐ9ÿqÄ€9}Õ«€Þºî=GP_ùRÜP¹ö5)jõi6ß«‚½ÆEv8öΊlÀœY½%ò9‚ZäCŠ£"›µÈwÍš\â1oKºd9%wÚ¾sþsŽsFnzSî3wrP—Û ¨å¦äƒq 7.ä¨èg,=çœož ˜3 75p†àNÇ5`PÜsö›¶”™„spl{§?à•ÅÁ·…NvÕݹ’º÷èT‘oÚÝm»ŸùnFÝœ¼Õj¹»4(S6ì”|¹‡i,šw45³³Ý-åHRÞ}Vþ6ðÞ^>ÂÄ‘UüÈ6Ø«cO«O6vK~ËGYÌæ_æxò V¿Þó›OÔêÄ13¡¾'űš«¹w:®•­yës5Ä×2~|¸¹–ýZvW9UQœÌ– òŒ5ú’±=—…),u}ùüU¯ÖðßØ'2ÏŽ½X ~¾ÁㆴÒxF¸‘íGêKÛÏóô¢¾‡ac*¢6Ô€-÷J1{”@ž¼¯8Ä¡?Ae7”ëSÝ”Åæ4Ï54ÂK^¾[ìn©Gú }ñV ß6A€&¤:S×`ºòIø00®Ia½ß×òÕSèí° Û 7;nO¨‘†ê±a»ø±Ív÷aLóØ0^âÚqèýO>áÜÇÈ#Àøÿ½Õ÷›XéŒ$µnW"ëãÄ$Úÿ‡ÃŒ Ùÿ×?Љ>ë&'êmèy¶çjfhHöüCŽCæìÄaù?§l?ûendstream +xÚ¥ÉnÛHöî¯2˜‰D ÷Å€é,7;c+èÒ9P"%qB‘ +/?o+²(Q V±êñíkÑš˜ðÏš„ža:Ñ$}Ãs¬ÉjwfN6pòû™%æÄ5Lßãßg¯?xþÄ2ÈŒ&‹5,’¯Ó·ß|^¼¿ÍÇ™Z–1›A8}3³ÃéÛ·7_®xâN/¯?àÖÍí§™§¡3]\Þ\óÙ;<=wºÀƒ7¿Íæs€ïïfßœ½_h<Í]ÃõdêÇÙ×oæ$¾ÿ83 ' +'°6 +Š&»3×s Ïuä9?»;ûw‡…ÏÜ ¿5"ú\AÌmÓlû˜\BÎ9 瑦-#Šì1J–aNæá¾qøK6°¼¼]Å;TÛVyÊzkØç‡ + ,ÃñArÒiÌoËâ/Ór馭â~³²`[?dÍ–WWlÀχ¤,LeÐ:Ò´c…†‚ß°,·÷¶p„Ÿ¯›¼\Æù7$EjE¥GtT§«¶Êš§Ùܳ½éÿ´uZÀ¦ÅªzÚ7 ³ëú¡¬’zðæSZ¼X¤Í2+²ˆwéàO7·—oô·³'‰O­ü. ÷‹u²iôNFr¤ÉPÃ?¨RñcÄ C‡y%‰ÄÉ¥ÄeR òÊ‹Uqñ).âMZ½*Û‹Ïi¹ÏÓWÉêâG›O1®Êjó⹉ç]Úg-¤ïî®xQ¢±›¾*h&ê""§HWd=Š+•'p£

    =J৹ԿA +£u§¬&«4Ÿ+æýÒÉÓ/˜I6éhDås%ÓùÜ)³­THe* +)G%]Y®´:ÕΨœû=d’¦̲Ódª£Aäƒ'Cï¡*•zÿ¼Äòü_¼ù«cúÑD-õòúËœ\±JŠ¯ë ÖŸ`Ù!"O›Ã;°k…B°]¯³Ç=º¬8"\BëØÆqüŽõOqìâÕ–¬vËÛr·oUŸöYà TµÊj’Þ¾\_þGÊ r™UÙŠ7K¶Ts´‹û„­j¥Þğεu:,ŒÜ–]\PªÚÈ)ZNoÈKä1Ëk•]O„ù^UI%[?Š%¥ÄÑfÕ¶N=Z–8ùqÃŒvÚ<³=ÏæxGåø¹ÆߤEJUž?Ç2Ö.”<›c+’¨¡¡N¹®¶Z—ÕHþgW,¿ÿBÞ[g€¤ˆ‰Žò/üÓfÉÅ?[©£f¹ü/4«ŠÄTe|ïÞ¬ÐK¥VŸ çžálìD>ÌÏ'.)æ6ŒÜÖß»,Ži„¡;:¢ûýÈL£©kŒ¦ ÏàÏpÁ/Ì1¤x¤ãô¢œ×é=ϯã9tᮀÄyN®ùÀ¶+JŒsª…Z?Ü3­TüzXîÑÕSž¨ô €&b÷ÑÇ]ß ý€Öó–â;5ªfj,£»ƒ¦Ê0j[U7îgž´*.kƒ§ /4üÀ!“˜a@b.¶©ŠgÛµxfg^Ü1§Û¸&<+£ÐÍShÂÒdž·ÒH.Ò’ 4ô®=¥¢×ác¿*Ú¢B¡‹ÄÝL)[ËZ•ÊBd”¸¤[ SŘðB¥l)c'IZ!{NR¦²é‚² Ù7ÎycÕË‹5(©oj5Pâ?` !ÓÄ®¬—Ôˆ¾>!þ…<£póLCúÖ xõé5]ö™îÐ:Çù]™Êš¾:¸ÏX«E¥»§£ ztù0ÃBŽš{a…tuÆ'Õf‹۟]mAê!Ó´è½LëRµkòsnÚŒæ¹Kˆ›x‰¥çð¾ †j›†ê‘xw ßñµxåI¦â¾:—kMj]¡j·t©WbÆv=# "X† ™‚¯SA…®íÔÉM}òÄϪn¸€ KA¥5x.¬´¸Ÿ5Ò•áAÆ™ ÅÙu#òÄ‘‹ˆÈ2";¹†A;ºü¤p_ÝFtÅqÞóLÃõÒ}\uמ)Õ d¯¯5 ×t +øÑ¢+b›¹Fà^Š3b¤G¡ôœÜÈ@¸‰…mDü2—þPª(Ø F‹×®Paõ½ŒšqS™×zÙÇg™ÚªFp­G4nQËR‚kŽðeƒ¶U™yئcÓP´ÄঔX† 9¦9lœ0pd„Ÿ;–ex¡poKOƒl…ß,oú§Þ«¹6߉11×vÑv´{£%[<–&?3„>àªIŸÈy}ôlB˜±Ž]¼f퉗rŸŽ@ìIÃæ’ö»Pr9¥ó¦,îòÓfquÇ,!“ÁA§ÍY’v?ÊãÐæ8}÷E¥’ÄŒû™ü2¡ ä«ÿx¥ Èò¢zû;¹¾„£Ky›èeœÜ+>Zq­Çøö,ÂëxËàTY¨V¶­Êb“Ó¬LûI¦”]¥FŠ!b¶©ý;ñRû|1Èy]:ʨ@öC≴LnðÜ´ Ç û¤Ô+WJã–dY zÈ(ôYöZæ`‹9Ž©Ž˜ªƒ²úÉÊšÞñѾ¢Ûç’º +®B9Ÿ°¸Aéâ'Ö®ö;‹3§kjåï¹Ãâ-®Y³#{ïðóÀqƒp?6} ‰Ó¶=w<Õ|Ä^ì„âJÞô£ôŸè GA渾°äºÓ¾¬E¢Ó +œ@—‰Â-«˜o]¸n²<çÓ=ù‰œu—µ€µû+ì†÷iò¬xÝå&X—y¢7€]>•liTE4 ï“F]¹¬àd†‘/íÔqô®J*E;ä³-25†{é$›^eýDjK¿šõ&ÁD+­z¬n|FSš´Îæ°þS£Y*zÊ‚J™9M¸—‰½oÛ}îÃWÐ3‚¼vÉ\¨ +aO!´£¬Å»ÙZB­„Êš,¾ã‡m<¶Ö +õÜfSÝFÖ£Á™™ôÙ ¡u’Ï‹î+T3ew‰Ÿ”E®¯ØÂ'ÑÓ¾`‘sªÁ­»xàæWÝ}ÍqÕv Ã´¼®QÊã}r²U‚^4PG_ûvъеÇGkÑãßûÖî`{ÞÙä§ý¯å˜GMµü½ú,°ü²endstream endobj -4739 0 obj << +4922 0 obj << /Type /Page -/Contents 4740 0 R -/Resources 4738 0 R +/Contents 4923 0 R +/Resources 4921 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4730 0 R -/Annots [ 4742 0 R 4744 0 R ] +/Parent 4907 0 R +/Annots [ 4926 0 R ] >> endobj -4742 0 obj << +4926 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [226.195 654.697 375.4 666.386] +/Rect [179.073 229.558 328.278 241.247] /Subtype /Link /A << /S /GoTo /D (passdb) >> >> endobj -4744 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [149.643 262.963 341.857 275.865] -/Subtype /Link -/A << /S /GoTo /D (samba-pdc) >> ->> endobj -4741 0 obj << -/D [4739 0 R /XYZ 85.039 786.531 null] +4924 0 obj << +/D [4922 0 R /XYZ 85.039 786.531 null] >> endobj -694 0 obj << -/D [4739 0 R /XYZ 85.039 368.576 null] +4920 0 obj << +/D [4922 0 R /XYZ 85.039 763.817 null] >> endobj -4743 0 obj << -/D [4739 0 R /XYZ 85.039 332.311 null] +4925 0 obj << +/D [4922 0 R /XYZ 285.281 769.79 null] >> endobj -4738 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F58 3360 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R >> +4921 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F18 4228 0 R /F41 3054 0 R /F59 3455 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4747 0 obj << -/Length 3767 -/Filter /FlateDecode ->> -stream -xÚÍ\[sÛ¶~÷¯Ðä¥ÒŒ…7^2“ÇrNÝ&NNìLs&Í-ÑIt$ªNþýÙÅ E2iËÉhÚ©)X,€o?ì.€ÒQÿÐQ,IÀ“Q‡Dr:š¯O‚Ñ=|ùÏ 5%¦¦ÈÔ+óüæäç2Ñ€$A2º¹sr’€È$Ý,>ŒÏ9{ssñv2åœ)%“iÅã³ ‹Ççç¯ß]Ýà1¾¼z¯^¿}5¡ð5æã›Ë×WúÛ ¿À;1¾ÁgÏ'S(s /®'o~=¹¸qzz=¡œ£–ŸO>| F èѯ'áI; Î@£Ö)…+¼x*ÿXÀ ÓÙá—%9^hHM:ð"ˆÄhƒDÄ¢ /¯<ÿ–ŽÏñá›ð©Z>}úWðñzðcá3LgØ« ëöjB$œw^ Æ9³mnB”.°Tâ‡KŸ²Râ²ÚPöa2Eõtê[…:Tؤ‹Û-Z¨$¸µ+—p)kÑWaG¹NÒ×_ëåƒM)UX|wun#ÒÒnXÍr¥R­Çµhݦ¢p°uª¹\’ÉTa“d|¼P¹ÐJ}Ñ¥¾’å‚Ç[P ²5”:‘Ù«©äBa¯?w*µÖ?ž¼úÄåÓl^Ὡl‡Š/r¥KÛdGÙÝ—æàb ú/Ço³»¬1/nFŸà.ž -ÏZ¤Òñ;*C­½+£“Í9¶¤õTy±¹ÓAs ÕN §ž©§²ê÷Þ`é"Å6³cŠŠíZå ºCïaŒçxÇŠÞ;Ýd)“‘L‘qÒ{_Ï·9Žvg"ÛkbêUX¬qÖ¾iÛ‘VÊ_Û´4b00é%µ;RnØ–>|•ùS™Ve·Õ‚·ýÉÔ¬Šúh‡Ôä‘Èù«™}¼€÷ï/Ì/‹kò\Ÿàpé>±Ê,GY‡ÂíÕrsk05.rkójU§:³]e{hÉÅ-ó«y&oc7@›¬\5ú«“«Vå·j|º¨–†ŽÑr”’®³ëò Œƒƒ¦ÍŽ> wðCîP´"`½ÜÉ"YÀÑzÀ2B/7ìö`@•‘ŒÀ“çàÀÞbˆ-\:Toܺè¤jl:éS=àz& ÕûH m±‘øÚÄúOÕ‚æœv»µ6Öâ_W SöëlÎlÜzfÜ~àà´V|U(˜ûÛ¼éí®PmÚ=gEotÜ  ´ÍË2~Âß2hËžÌرU¸fÎÖ–=—Æ7g·ÙeÕà¨Åßó -o×ÏÚ÷ÚîOtö0X<ÞØD† YglzËP0‡±‰u—;M¹’>„)÷éÊ%1â¾®­žè­Ðêtwîä¶ð<ô­Zp¡Â¡ -]j‰\vxßËÆÖ•9WlM;>pÝZæ9ÍÈD[¼rp6÷v;Óó“›Ë~2Þ»5ÿòîpsÝϬ­Y’²Ûäþî<ëœÆ ÂÔ -MBG+§ßÉÌçe±_M¼­×i¥cGI±ÚR7ñZ»¸í†BƒÝÕELS¡Í-´Þ„:ò +gd Óg‰4‡>7w÷ðoËÑPÎHÄbSʬ0z·-R]Évaâø[aKÜ«n‘!Òw‹1xž›x_Cÿ]Ë\¯ýËœ½]ƒšë³J¥wí. %0Mh·«S,´uö3Ät‡Ѷ¶=†?i«Õ0!ì@${Ä!,xi˜"kÏ¿r¡ xsõ%êÝ.ÛþŽq“2>{š¡óŒŠ×ΫUŸÖfšÔÔn=…âŽâ¹N%b%úot¼¯±n-чýü,lb=ÒE7††éúñ0Èž¼k³–áv>I’(iìbárÖ ™JîéÕ2€b2ˆkjVŽæ]…ƒÜ÷[ò…=GdC™­:s9«k­yŒ]åk42 -Œ‹B­‡†Õ½£7†à3ÿ€’ma5ó/æGŽYáŸvݨftØû¦1‰â®C›”ÆH,ÛÂê|ªUö?[u:éầUCCà´Omnð -⨦¸¬m¶ö@„¦ƒ©ï9n«Ójo¿Xb›#Ìøhðƒóà×bnu‡¹#^]AbÞuè3`$À;ðªqès†Þ‰pÅWiÿ! -¯¥!@Ø«7å ¢®øÂ?uè¥<Ôƒå m…ucd˜Ž ÌS0s²õê|d þ»&€Dœ é8` - ð+.@ø[s>yŽþ´›XØyÕ–e°€vÏ -düi½p,ßóÿP¤åí}|ÖÛ´Å.~9¼…%,Ř¥{z8uó•áš¬bœ6ƆƒóvWú¡Øßu¥Iw½cx÷Ã)£V3mt¾Æ’ÇDƼEåÿ[å„#endstream +4929 0 obj << +/Length 2328 +/Filter /FlateDecode +>> +stream +xÚÕYYoÛH~÷¯+1 Fq]—Õ0ÛÌâªÚåj×M“4ÈÐñ•¤æá¥1nx¹Ì‡óxóóÈ-Ûá,)ž³d°Zß‚1¶ŠrmœÙ•i}dŸw¤÷gþÉÑómõ#ØWÙC[ŽË;E» ÝŽ]ði@£PNY·“¾r­Ñ `æÖ¶ºÉ23ñsЇ8!ÞRøâŸ`»âéÇ¢¯„Uò×FB2Z.‹m^WHGÈWÉVÒqåF¢ F ÄŒô=\«/ëLâ%Ñ(\¶/#«f™â|ô¬ÿ€ Ù¼¬—Y\륯­´bÁe±ÁQpT$‘¬X¤xäßú‰µ 8âzéÃþmÃRô)JhÜ.7ËÀ@~ å»Â‡68̃åºÇOïß +@ŒŽgÆØUqª^vµ`íM¬_×9@ÏC+ÎAëêT•öƒ}ùs†"âm áQBíòtA[»¤Û +~—¯!" ,mÒ!ÚƒF…®µÁ\õ ä!r*ä +"ÚfüNâíçž^e¼¡=®“²âá¸ì·"EžÛŠÄVÜÛ=%9·æÕÐB¢ÀnÚ(!ÈÖ¤|ÍSq3Å?³ LŽÍ2Æ@3µB´qšwÐÝg×sËä1Ì”Z!ãn*0¢PNÂÝÚñSüÜb߬á p 8£ƒä¡š¯&Å­…­ñÀ-Lø:‡\ò Z(d䈃°/€Œ9«&ëëó/à ÕÏ9Oï“´ýÒ¦˜Ÿ]¡×˜áeŸì#JÆF£éΈ6qùÂ}ã,cˆ;òO’1,Úê<çTÆHâ²VÐ.ãÖ—àT–µö¦hܺ™ ¹´„†–ˆ¡Õ«Ð&¿® ^ÕE‰,‡í] +ü-ÑòŠ¿Á±!r,Ê“Ýf7ºÓÇL¶ª¡žùÚ‡<Œ³-Y ý¸4ha‘Û«ä1F7²š«¦Cya½;cŒ6Â2Œ×uÂßQ¾f8Œ[ç0‚]Nµ{Ž†cÚíRŠS‡:;¡ÙÄ1þPl’Æ*†Xœº„%Õ×_ÓƒÛbM š/Ë”àm7¿¨3ÄjÞæÞ ‡ÿÛ}AdMÊô+‚˶ÝÊuÜ0hÂöt@ ˜²5ül™0p´4Ó{¶’+›šÎö”Ù“ëB⣢¿þV†2‰¡@yáTõx¢©Éý†Ð+žoí<§ŒsîÙóp«ÖÒºÆâÏ +…wTûG¼ynÑ0À‰8žüFµ›&pÒ·îîaàÜŒx©Noø(gª188U(îŠaJZ°ó”Y±8«ñ餇ŸÙdlú\œQ›¨4®Í CE>l»0øÈ(]éJñaù#$ÙÍ‡Ñ²àŒ¡P"6zó¼C•i±Äßn»tx]*š| [>ÑwD˜T`Ëý©nr7ç:k(üu­”¯'·Pá‚õ²Y¹Ú<8Ë"ì0ËfßÛg¬Îš7ÒµþõÔo=Z0æõMñWr·ÊTƾÏBéº_$KÌ‹//—> endobj -4748 0 obj << -/D [4746 0 R /XYZ 85.039 786.531 null] +4932 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [436.059 608.276 486.692 619.966] +/Subtype /Link +/A << /S /GoTo /D (attribobjclPartA) >> >> endobj -4749 0 obj << -/D [4746 0 R /XYZ 85.039 763.817 null] +4933 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [511.223 608.276 539.579 619.966] +/Subtype /Link +/A << /S /GoTo /D (attribobjclPartB) >> >> endobj -4750 0 obj << -/D [4746 0 R /XYZ 207.409 769.184 null] +4934 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 596.848 105.43 605.871] +/Subtype /Link +/A << /S /GoTo /D (attribobjclPartB) >> >> endobj -698 0 obj << -/D [4746 0 R /XYZ 85.039 399.573 null] +4935 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [124.867 553.474 256.001 566.375] +/Subtype /Link +/A << /S /GoTo /D (samba-pdc) >> >> endobj -4751 0 obj << -/D [4746 0 R /XYZ 85.039 366.035 null] +4930 0 obj << +/D [4928 0 R /XYZ 85.039 786.531 null] >> endobj -4745 0 obj << -/Font << /F56 3226 0 R /F62 4047 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F35 2976 0 R >> +722 0 obj << +/D [4928 0 R /XYZ 85.039 672.636 null] +>> endobj +4931 0 obj << +/D [4928 0 R /XYZ 85.039 636.371 null] +>> endobj +726 0 obj << +/D [4928 0 R /XYZ 85.039 275.792 null] +>> endobj +4936 0 obj << +/D [4928 0 R /XYZ 85.039 242.255 null] +>> endobj +4927 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F41 3054 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4754 0 obj << -/Length 2067 +4941 0 obj << +/Length 1596 /Filter /FlateDecode >> stream -xÚ­X[Û¶~ß_¡Gˆ¸¼JÔò°×4íÞ»hÒÎ]b…?æiE¨ˆ½H‡D æçgÔ›åÝsc :<—£³ó[zŒ’˜ÆÞèe#'¦DÅ¡7š|ö¯~¸xÝ|BŸ12¢Hû®ý««ÇŸFH‘þû‡[Üzüx?`@Õ½|°´k¤ÀžôGH¸¸À3Æ›áàËèdz›Ñgç&LDùûÙç/Ô›À~<£DÄÚ[ÁšÇÞüL*A”î9?ž}ØȲ4éÙS}FQB¥Å¡U„êX…QN8g^$9¡ Í2)þ3Wþ2›¼Ž“ªI«7v§\¾]¤å"OßLÆo_¦Å:ÁUYMñ² 8`ˆ+6rêdþœÜ•Ó²eóÔɤ=Œ“¬^äÉú!Ùp½K«$ŸØõ•Ð=¦:âº^•ÕÄTŠÇ”SÁ.o®oâ›Û‹‹kq)…ºTLRyss çS•Í“jý®*—‹áûk'm°@œ\Ê( D,ÒUš«0qÈh$©Ðã”õÈ.ŸKÇÍU ÈEYg^ŒÇå²h¾é€7LæÇÏ 7·y2m}þùÓ ¬¾ÚnY§ÕžáþWëEóÏå➧¿é_ÿÇõ肘p\dôó<,çÏiå8cJûÜ>.¾ÉÛŽ;/§Y1œ¥yîN?gÅùsRÏú™Ë——NØq&#©E(£CcL÷à²^´ÆÈ?eã¯ß"x'²V“»¤n†i³‘QÌÅQ5ÿK*Je¼Y9O¯³ -bª¬Ö­åpó¼Ó5é´<ïq¤Ú•W³¤˜žÊá–÷~Y7;̯èa´Š:Òך2Òðêú‚Ça]H ¹Ì„·WÑ‘Â*¹&‘:Ý":<¦rzØ"$e$TÜ„® TsI€ ÐÉØê'5lÖ+\–Áü -ÂW„‘_¯‹ñ¬*‹¬Nš XÊâXǯö³ËÔ!XPJµ…{ˆ‹qŠP„ÿ¶¦ûQUg€6¹/µ‹ Éyž»56[Žq¹<ò'I2Äfæˆc~p Cø¿REïlS|xd–°€§Ä«à²‚IKcv ^·½Êš™]µ Ëà€Ç~Cz"ê—Y+¥°}}‰ŽÂç 1OíæPïù……! CéAˆ‘Xů·gAxÔßœƒVVÐvèAÆ$áF£)\´Óâ…ÙÌ2‹G$ÏK4ìÊ=ÑŒx[H6ãxw·gpœöKc;Ž,ø§“Q8«ß*+P™•iÓÚ¦6öZ!’²ƒ ±eaüZûZG„Ëf„™H#9êKNr7œŸ…sÿ‘í¡rA1ÛÞ4q¾4·Åk·±TämÕ½à…Z;e­Eþ¨Ì·L¡7îy=‚ ÓʃC¢Höf£c :w|­… ßQËñ˜P®O[nËsÜrŽÇ ¼\ä ?¡æ¤¾–ç@á®õ`©•ÞѸµ^Äû\Ä]Ÿ⦓™§Å¡5#j£ÉyÚØÅ‘ãælZÙÒUÙ½mHWOòlð”Ë°-®²Ùd¶;ßní¾“‹’ÝôÍ2Wâ¡ÀÚ‰Ö®€‡µ+öˆÓVÎ,TxÁ–Íž¬aŠ´;‹âþÎEkƒ^;C/"Ð&À)\)"°ÕnÚ³<;®ƒ‘/ ±I¨´‘ßN ¨6+L½¯æÉö:›^aíØö…ËV1Ù^¹h;¬ã¨çè -¼&— ×PçIaêÏ4í­'.šY¨ ¥êä(×áÙdƒë«NV0xy¼3w*:õï×ÃwÇôKè¯éßò%ÕDj+7Î{k¬Ü±ui k ó.½I ûA`Ü]©ÝXeyn™!ÁÄî'y‰ý ¦ù£pF14ûoº™qÒ@Î"]YR6Iü>J?®À°ØŽs’a‡þæ’ŸºÓ"ÄÚI*z¦F4šûà ô×ÂÄBbúäWc =Àc’Hãä"×/–¶MÐ9:.æt¢6%,ïÊ층)¾Ÿ“à(“-SÓ6f|Hª­Ö¬ØÕjQckNíHmɶÂY Æê6Y6ʸÿµpS`€Ajxê‰/°¢$ç¯OËLCDCÔõÎËÛx„‰í‡ªÈSP14†h ç¨ô"x3‹¢nÉCO“~ ^ÒàÕ.DÓØUzSæ%W6ãaE+¶EKŠÃê,Ý`º\Øi§¬0‚Úƒ¦ÚíY‹G8‘pÞÈt¨_7 'QxÄ ­¨`+˘¤{[—ë¨Ug²ö“ùPy€LÐpè•ßY+ê2Aq©»È>@b!‘ðnû= 9Q'!±Žª.¤ûÇkôïû[H‰ÿÀSÚ|ø𜨓ðBÌŽ_> ´ò/Ûpø â¼>’œðòòcÉÉ ¡tÜOtåïÿú ½ý®WѼ¿½@ Îb°)¸IØäåjÿ:í÷jÇÕü/ŽvŸÓendstream +xÚXYSÛH~÷¯ð£\‰9u¤*Æ–,‚Jª²yËÂV%G’ãu¶ö¿o÷ÌÈ[&,E´¦iõñu Ú%ðC»¡ôºAè{’Ón¼èî 8j%HWxÄ—È:wNΥߥċHÔßk‘ñô«3ø£;Þõ\ιC©×sƒ tú=:ƒÁ‡O7cäçòæ>Ü]÷(pCîŒ/?ÜÞràL8cdôO{.ÈŒ@p8ê}¿ï Ç;>¹Â>G§~t¾~#Ý)øý¾C<…Ý5ÐÄ£QÔ]t„äžÜ>gQçã֊ቮÑjyuWpßã>뺜xa(¶1à²%«tú¶çJ&Ù*©j†N£§o‰´H¥õg?÷÷ãt‘XyFE Bî‹à˜N?ŽëóLÍ*«ñõÓ—ž+ ¾S¹*f/¹E>jŒ.ϬèÈ¥®tu™AÄiD˜Kƒ0 2dÒwyäSÂCWâóàv=¨|0Wù¬ñ ìÉ9ÝXöhÈ0ÚlªõÇó¤ç²(tî!ÿE–Xë4ŸáiकáªÜ<_]ž*ÉQ².7æQ«—Fxt…E•ÑXšÀŸÐ)ê¹y¬Õ\ ïÐc(A5R‹~Œºq±27yp€:SC/©*ý²…²Þ¸+]ÀmR:ßͮݖÀÅ™Ò>V‰þýÖÄëI½µ„kšÛøB ¾›Åª¬“ò9)Vïn“b™%o¦ñ»«$ß(¤Šrö\áä;uCËešVËLmnÔVè")U65ô@ßÔüõ­ªªuQ6Ý"%ƒú"œžφÑð¼ß?㧂ËSIÃáÑò*Ó…*7e±Z¾¦t)#´Åv1üÔÈCÓlK›SH}ý"ÓMX2:òµ=½ª’r/pÿÄåfYÿ{º¼fÉ÷ðîá$®Mó—âc™™›Õb’”V2"„´UgþÒ³4Í“,³Z'“4?™¨j~‘ìehe-ÏöÜ¥­Þ¾m¸®TU’zk~‚ˆñ£×¼;Åa$æÅ"9KK(©¢Ü4ÃÓEQ¦êäxŸÝ#²×«ª~"üûèÜŒ÷ê0 ³PápÖg‘}! ‘)—ü|ìOïGÀ©G‰lß:\xÄÌe=si™¹°jPV€X:ÀOç¶Ç‰ +è¹F²èqê”P«ÜœÑ&ç¥çÇÀ/$UyËŠÁ<ÊØç8óˆajçhÛB0Â:år¸DÛit¦pÖh”/ñ$tôPÀ‰†+œ&3m¤8% )Cƒz^ -W‰9e˜I®Ì>u 45&—5”_#£ÐS}¥Ö8c×)ŽD¤ŒGàüÁPƒ€Ã‚ä|ž7ºy+n¥èéÌ,yKtr±ky!ñ·j¿]ê¸Ç‚ö•ÎržÏ x±|c¶UU\(Ð?Õ¬ö9ÆÈ¢tH³6 ÒÎÚÀ9s>Ý\âû1L•OÍñç4Ç«ŒE*#p Ëûk#Q䱎¨§#ê¢J‚ȶD´Ýôn ÃWdÌLnßS-íƵp]A ´laô¤ßhK,;èŠ& ºÀ¯¹B—â¯Ä°š éŸ=éCWM=Xíjn"`m¤½Æ„ïE‘¿}?Èža•³®!î.žÉ§þ^PXÿ™u`·„©¦¡Û´ç %üh FȺnšoJs³b. ˆèÜFk¢{ØJÞ›Î™Ú è.²˜´my¡ð8Öj1ñâî:Lz(¹…Êu‹Í«ç ònßG±£È+=øO—zΧCä•»’8×›ÑÇ«VåLQê…¿ÁС©5Üç9‹œª0‹û:É›£Eb½É +ôÊ2Ã5ÏTV4@çëæC@·0(ógV&ºÌ“µ!Òi¢ëwðsÀ2ݱ´ª¶ ÎÚP²²Fò'÷ !¯=¼œ¨Õl‹¡ÊÐZ¥$|Gä‰%î Jhy øñ :ˆX…†+¸Ö'–FÓªù.Á“º0f¦Ec®¹I5¥´~s™9Ø–7tºµd¦ì˶PÜ^û€i Ðø¤#m-Vç¬"í¥óÒIñìç?Ç5dwê/CÊÙ¾‡ÿ5°‡'ÿÔ=“endstream endobj -4753 0 obj << +4940 0 obj << /Type /Page -/Contents 4754 0 R -/Resources 4752 0 R +/Contents 4941 0 R +/Resources 4939 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4730 0 R +/Parent 4907 0 R +/Annots [ 4944 0 R ] >> endobj -4755 0 obj << -/D [4753 0 R /XYZ 85.039 786.531 null] +4944 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [384.118 169.232 435.505 181.224] +/Subtype /Link +/A << /S /GoTo /D (ldappwsync) >> >> endobj -702 0 obj << -/D [4753 0 R /XYZ 85.039 428.751 null] +4942 0 obj << +/D [4940 0 R /XYZ 85.039 786.531 null] >> endobj -4756 0 obj << -/D [4753 0 R /XYZ 85.039 392.486 null] +730 0 obj << +/D [4940 0 R /XYZ 85.039 274.542 null] >> endobj -706 0 obj << -/D [4753 0 R /XYZ 85.039 168.005 null] +4943 0 obj << +/D [4940 0 R /XYZ 85.039 238.277 null] >> endobj -4757 0 obj << -/D [4753 0 R /XYZ 85.039 133.259 null] +734 0 obj << +/D [4940 0 R /XYZ 85.039 128.427 null] >> endobj -4752 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F20 2961 0 R /F15 2972 0 R /F36 4184 0 R /F37 4187 0 R /F66 4190 0 R >> +4945 0 obj << +/D [4940 0 R /XYZ 85.039 93.681 null] +>> endobj +4939 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4760 0 obj << -/Length 2789 +4949 0 obj << +/Length 2693 /Filter /FlateDecode >> stream -xÚÍZYÛ8~ï_ሠÄlñÐì>$™d·3ÉfâÁb‘äA¶Õm!²ä–äôô¿ß:HI>䉂Z4Y,V‹_K’þä$„¯“I‡"Ðr²Ü\ù“;ùו´3K2м˜_]¿‰ôEâ'“ùmÇ'ñE„“ùêƒ÷òßÏÿ3õÇt¦µö¤ÓYÅÞ󩊽—/ßþùfŽ#Æ»yó»ÞþñûTÂh¬½ùÍÛ7<ö Ž@Ÿñæ8ðüÅt4ïðÕûé§ù¯W¯æœM¤Ö(åýÕ‡Oþdýzå Ä“hûB&Édse-£íïâêýÕ»Ž™ Ï:e”@Ç"ˆõ±UdpÂ*A B‘UÖi‹ÊE^»=2lÇ^³ÎT„¿¤·Ì?úÒ,™hý±—•öµ0¡á iY.Õ>7émÀÒ&½9öä–~“¢)™¶©vå -›¡WäŸqÀ2Kù±D6զϨµƒVû”- ½³ä%3ik¢XsïCÇ0ö–iÉ%T-îØo&Ѽ Ù#mÛlƒ«àr­åG:Þª"«8¸Ñe%òo™‚þB ÖÜUæmÛ适hµ¶È˜õ*kӼࡇõ€ŽÉj-¹ƒ š—w O¬n¹{“Öw9Œ”©å²kPö‹ö -´ëŒ‹Ò|>¡?òU‰ñЩÓÍTEdá”;w )X󾫖ÏïÖV$ؤnûp©K¦–ÜkHzZAÊ:kZt­¼›»´—–V¤]¦Ì7ÝW{Soq'‹¢Bê°OÈ»UÑÜõnÙæUًݬɉŠSw¾ZlO˜¤?÷«3m?Ù>[1ª¼÷7ÀP5·Øô†è:¿*ø` \G³¯öÖªþL|ïxˆôxl¬cŠ¤ “H„RŸÅÌ ¡ƒòÑ!Œ”5c&À¤ I /Á ÞË:CÀ°Š£€adý -«´M)ìûˆˆÀ1 ÒY{šQ íL¢HÄÿ!ÃnÂúàxy;5wñ‘‡{PË?v[~>’¹Ñ,y….ÿ`§€2v·t˜ GJo5`fA’ŽjŽ~øh§­í ÉεúÉeº¡®†©ÐC+n2ÇÕâÐ~FGÂ7ªSü«ÑD Ž%3Çk6`vlic€)ô MMpðèÖ}ÁÚ|ôŸOzÆ6FØ#ÉŠÑ)­épÍ4„…'ÏHmá¾è!R„#)C.­ëJÆô$xB´ØX9ëãúé®h™öµp#; -º›b÷¬°?³¿ÒͶ௻í6£¹/°SKàr»Í–a5àˆÃŠ7_A&G\©9ìZ\¸ßeuî„m˜–A,…‡Ñηخaúý.¯Ý ‹LΓ§²1ÞŸÍáT–aCFî¼úŸ¡ìׯõÐA|ô¤(þè   ¸9Û!²«ÓïõºjÚÁïí6mš‡ª^ñïR›¡‰â륟÷~\oÓv}ÝV×MºY¤×n›®·«Åõ†·…·÷ã487æ, hFÓ$±PÉ!`*˜U‰.u·«¨yZ “@®h@3 -&4B|fçkN¹´·¥uÇù„öŠt‰~ûÙºTSm܆_wœéTt’­œË~R^Ÿ2ébç’§Al­{_ÏûEmùåš@Âú=EðÛê™ó ¨•ð±y¾"‘”‹™Ãct[áÉî°g§Áwm'`<æ좃Íâc×Ï7g3¥µÀ—)¤±i÷QÁvkRLläoºìI8(…XŸ@$QÌ:Ťž…±å]e¥ø'?>TƒP7£¬bwק=Ÿ˜ªÃ¦gy‡… I”Õ»,e™Ë³OT°ùÄØÝ .eh ‘2†ì{e'8æ8°´p?B -t±Pq<Èñ`„³µš³\žé¢3»«ÁSÌÙBÚ3äQ]í×™³ÿa׊8kÊ'¶g é"¬¬à›à;º`d9uŠ±V SQ¦ŒOö¦ú¼¶èŠý¦`â]Õì5Õ~žâü¨iÓr9DzNó %1…³£Ü@%’ÀL Ì -íG?”8^³³c˜Q&JEÝŠ'sf"ïƪÐm&wVÈæNx0y€5öm‹ì«Ú@\-ÕE´w¼Îko¤«¶ùªöÔ´€cè =xBØVKC%*{)ÃÂÂö>2<Ý {¡(›&”Ù^*Puw{§Á#®­Ù÷n%{¨±w¶›¿í!sÜ!3Þ=9ð•²ómû¢T'-ÒÍÜÝ\Cdú2PŠð½]×”›ß­­è.Q!K‘«,IJ*o¹wº sëÐþr+ªEZX€ll²ÅŽÝ­4쀌+J"ë\ú ˆ£Ü ¡A$œo†w¸r%€§³HŸ¯Ê ‚“ -¾¡}ÈÂdŸÅ‡jà«ŽÊ`O=!¶á>¦j˜âoÏÓƒP˜0õpÚ³#ÜQö]NIéhŽ¤ÜÇ“N¸Ü ŽÉùò܆SMhß·n+Ò°|÷Ø]È¿!Ê÷aöbÂ@„atJÑ#…uBHÇË•±Òçhai€üXy° :c\hŽ\¸eáäý\† W3·Ó%Ê×û"´ô:Ï -Æ—ÃIpk€§ô¿_<Çì¼| -.· -|v(dàSÄ›¯"®4‡¢jØ_]FRþ’ÄÐèʵ?¼µ°Èeö6ÄÚÎH`“àßRņ"òåØ•LI‰º­®íy¿Ò%öü¬Ü1 âæ äÆ»¦ ~¶ØbCäQE Ù¿<áÛÆ¥eZ ›'c¾r ÷|%ù¹|ÅÄ"Œ“Ó6Oàž *P"w•ð> U8Æ‘¢_ó»Q,b -[?Û)¾@k#"#Ç1íŒ+øá™Ùuuùzt;ú•.qˆÏÉ­$ o¤öä^e·)•éÛƒº×“fðjbô|^BøŸËæŸ#• D  «R†ñ/@<)Úw^Ð/t /8'vç¹Ð .!üÏŒÒ~(bŽÜ+ ±VØ%åY˜¦z_=Ïûu.áç¤VJ‹H™=©`Ú]®µöñݿ„Ô?ñîK8ç1ã҉݇ÔÀuR&ð 5¿qpµË‘m0¼À6Ÿât ¢=ñÞ¤® \ݺ›{_Ûí_Ûô/Lº÷+¹-v¥ éÕciþE´¼thÀÊÛÉ[4–X€›üá%àn©oa›øÁ¸â†ò›Ï”¥q`ÈãAí€ÓRÁC˜‰ _…BÅœüw*eä¥uI¥ã÷(v -Üý‚€vdr?A 1hü´Iü^+긾ÙèÉ/:Èj¹Îz¶ìÌñЙU"ÂÝ[‚Öœ¿§ÔÒÖYŒñ¹ … Ί ù…?þÃ7a8HïJ©ã`ÖïøUÆ;œõ~,‘Øï p _©à³iyª«ø!¾òÁgLj«)®’‚CX:+°´n¾ì~ü¿›À&´ï¾õо´6_ðFBæÍ£u–®R¬pºŽª,™¬uõRßï¹u_œØnúX ZõÎÕ||e¿UY¤<ä¾3:–Þ½vÑš|•Õî³t¯¸«ùí…Iû:ËâÊðh÷Ö (˜k÷f Î9þ®ŒV=Ye4I $„©î4|ÿÁ³+ýèÛƒÕù³Ž!$ŽO£ÒWÙ7¡Rÿ^3†…FêƒÂl6ôFs T84¢ûÎR Dþ?ùü tendstream +xÚÅY[oÛ8~ϯðÃ>ÈÀXEQ—b÷!ÓËltÛ¤X,Ú>È–l •%G’›æßϹQ–l%íN]ˆIò<<ç;©™j×ÓÉ,ŠC×h5[í.¼Ù(¿](™áÍ× ’~½½¸|e™òÜÄKf·kšr›}tžÿóê_·/ßÏZkG)w¾ˆ¢Ø¹šû±óüùÛ×·H œ×ׯpèíû?æ +¨±vn_¿½fÚ ¤ÀXàÜ"áê×ùæÜÀÄ—7óÏ·¿_¼¼œi¸A¨ñPw?{³ Îýû…çê$žÝCÛsU’ÌvÑ® ´ôË‹›‹w=¦3^5qõ…±ÐžÇA/e&dÐîç ¸B¾ÂƒpîOž + £½ÈY2©Êq¬ky0mrntµünóˆ.Сs»E41vv)Êæ'µÈ¾>µÊp$tÊâ Ò…YÊ?tŠzÓý‚î )ßYR‡ç3éÜòè}Ï0vViU©–i×å;d¹?2 À á³(XBòÈàV¾yÓ¢¼Bθ,2¸r¾ÒVÍ•xí®+qï(t2èѬ.-Jžq¿µÂ€ÎŠˆÍœ&T<wùW›–YÔkޥ͙W©0:t8¯,º?z â!XÂœC ÿ¾Œ¹¡^¦»¹ÑŒ”‰~28rÓNdWl¶r{?ÆWµÏæljÓÒMªžÏÁóÐïVšœÈª‰Ÿ8¯+N+¹„‹ÄSf/î'ËDvZãc–e+îANÌ¡è·F±4‡UWÔ2DÇÛÖ$†ŒgoórÏ›õ'Ëò® zjâHCÙ„0nÞõ ›þ@nŒ ô ð[ôŠVæ'êÔ”îñêæ ¿:µ|´§sì01€^0 v ?p“(êMÝ÷&L.pa?ã"ÔÁ•œçMžvÖðé¡È/˜–.Ó–dr~$ßUþ#ð»Ð¾ëùúiðùb&9€‡¨¸ÃzÐa‡%½çæJ’`¡áVˆŠ;]º$©s/E¨!füh×ÄvU 6=ÈQ²@Â>ûü¥,®Òj/’ñqˆ!­|y*í'ð€ÎßyíúÑ4Ä åiÙ‘?X¼+ùhŸ<ã±RŠÃÅpxl]7<Ÿ•µÏõƒh¤ë«º<ìP°•ò%î°b +±‚ßÃO´Y¾N‘XvBH—eú†è/d +¾´JvùJ/ìÚC%×ο¥»}™·—ûly¹{hïJþïf‡ÝžWÄ¥"bOîĦ˜ +pÐåÀãø£Ë[­@Cg§„Ñ°úˆ%ßò¦°êÒò\‹+´,YσM~w(š#¾0jˆÎ’ð ƒÀùО.å3ìvb#°úÙ„¨0ÂÐn¨CºÃßÀÈ}p!(n.‡6oP£¥¿ÝÖm7èï÷iÛÞ×MÆýOJ$#¹* ö“i‡Àÿ.÷i·½ìêË6Ý-ÓËï¾×Ðzz;yÓñ âNd‰?‚v¾E»ºB=ÛšäMƒšÿ¨ùO&Aˆ!àD‰Š¿AÝ2]¡ò}!j !J{ò™G/Èxlu؉IŽ ’°ˆpî6o„“Ý}̉zWâ­qÄ·C>•·mv–7+¬»ÊØo"' c_¸®Ñb{`8‘Þä–·bÕ&H+ŠI£Xd¨uÙ’õg™®¾äU6aÊõGÊZò×¹ !-zÄÇÝ(˜‚݇^âÜJ`k„6þÝ-]@…õÄ~qc˼gwÉùÕ +d¬½ uþÁ?kg³ÝÅh?lôY‘åUW¬ (¦¦žqaÀÛÄ´¿R¡¨a*c 9EoRPnxÔŠ•:óÚXURAœÝ2·²¬ãA8QÇ¿c[ÜÄ¡ª&š'@W¢jÁ˜x_`„-Q§“û Ýv3ž>F½çZ[[d§BG j(aI]bœ’N'cÀÙviµê!'­-2ݳ@ʼn«c3[ÄÊõó¿ ȦMì;¯å¤ý;bç,\?0a‡³%©ÏžS›ä©ÐG…`W¾ú„>pCF;>¤èÅØ9Ã8<ñ„ë²r3rn?ˆGà "#gúeŒ<ê—­À`ŸTäÙ8W8XOŸ‰•jÎ(F)ù%4_—Â9ŽuŽx¨« _ªd§Ô€òkk¹Ox€°³)¾öÆMt̳qÏú°ÙÚþd¼¦cðø +¡r¬eÞ1Öš} DlðüåŒç†¾¼þ㦬—i9’F¹1äFr áàúd‰óž"eqx©ú<*±bPYʲ˜ÖlfÜxÿÛSf9#?…±Éé. Hâ`#Çyž%ˆI肪ÀY×3£,ñ¬>¤@Cb¬)ÚñûÕ(ˆU &íÀ5ÝPE²¡E°áÍO¸ÈY¤Ý {˃ˆ)A‹<^ûßs…N¦©8UŸ +ßÀkG>gvGNT€…4ü´é°ÇE4pùz§g/j8Öl€G‰ë›p惪éc5QÅOrC:»ês cs xbmµå¼- ƒìÀÃlŒzv‰d£^èüñ€õšw¸ì O=´Öa=XÃΚ¹äQÌé™(*t¤§MôÄÄ|m†&š££÷@Çé#hHäÅ#GKµ—Œ£‚cÑ(Pñ#gïèùÑIGþèHÌ2.D;H/E„0VWåƒlZóQøM`3!nÝo…FÅDDE½ImIˆje²J£Ñ$£›ÞRéN@þµ [_ž*²a€2Ìÿ¤$¸t 0½cG +ò7Ì<µõS, e)KÅõ¡bI,Y?¯B!}˳3ÈÐaâ*’­ ‘?eÁ 2íF`]‹¾.ý×Aeéf3˜I}ÿq$¼¦”}¼Q™c¤ˆm‰)©œ[É<.cuæçŒ'qÂ8¶Á²NÈ@ñØo|úÎYéü›Øü8üCq¬—èµ Sºô€µº¸\zp·j,.öýf `g}¬Ô³8X¤½#† |¨Fv€©þ±ò)ùßÈïá1!íwm\N¡JrR +Cä {›á*úD€v wª…ŠÅ®gs[ +Hïßõ ©Ž5d\Êw'\X35Ç”©½N|™I;þháÇFÐÏÇ~åÁÑ^‰±s*D¶úèžw½°prÊÌFH!üIip?ÕIêx&}uòúÛ7(èyâY7Êö—öŸ)ŒýqR¶ß-¤R´¥Ð»Ì¾wë¾›‰Ëò£Ð!°ZÛ•ø‰)“]q™ eCÞˆ CìÔÒsÿ¢-ì{c²rž €ú«‡Iq§ùo!ôå·¾ø¼ÇÐút'kÂ$úË1ô˜7ó ôòñ#ÕGQÉŸûˆ«± Ú«÷“Ni}îŽ\ÈIÆ÷üЋ^`endstream endobj -4759 0 obj << +4948 0 obj << /Type /Page -/Contents 4760 0 R -/Resources 4758 0 R +/Contents 4949 0 R +/Resources 4947 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4730 0 R +/Parent 4956 0 R +/Annots [ 4953 0 R 4954 0 R 4955 0 R ] >> endobj -4761 0 obj << -/D [4759 0 R /XYZ 85.039 786.531 null] +4953 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 327.664 135.43 337.232] +/Subtype /Link +/A << /S /GoTo /D (mysqlpbe) >> >> endobj -710 0 obj << -/D [4759 0 R /XYZ 85.039 697.613 null] +4954 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [254.018 158.548 305.596 170.238] +/Subtype /Link +/A << /S /GoTo /D (moremysqlpdbe) >> >> endobj -4762 0 obj << -/D [4759 0 R /XYZ 85.039 663.47 null] +4955 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [288.922 63.704 355.612 75.393] +/Subtype /Link +/A << /S /GoTo /D (mysqlsam) >> >> endobj -714 0 obj << -/D [4759 0 R /XYZ 85.039 525.394 null] +4950 0 obj << +/D [4948 0 R /XYZ 85.039 786.531 null] >> endobj -4763 0 obj << -/D [4759 0 R /XYZ 85.039 489.129 null] +738 0 obj << +/D [4948 0 R /XYZ 85.039 697.613 null] >> endobj -4764 0 obj << -/D [4759 0 R /XYZ 85.039 311.188 null] +4951 0 obj << +/D [4948 0 R /XYZ 85.039 663.47 null] >> endobj -4765 0 obj << -/D [4759 0 R /XYZ 221.091 317.161 null] +742 0 obj << +/D [4948 0 R /XYZ 85.039 525.394 null] >> endobj -4758 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im3 4353 0 R >> +4952 0 obj << +/D [4948 0 R /XYZ 85.039 489.129 null] +>> endobj +4947 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im3 4496 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4768 0 obj << -/Length 3596 +4962 0 obj << +/Length 1951 /Filter /FlateDecode >> stream -xÚå\Ûn#7}÷Wô›% â6¯Múe‘Lf6^$“‹=Ø]$yÐX²-Œ,9ºÄñßoÉf³%“±4\@Ø`€‘›Í&O‹E²HZÕðVZ’š›ªÑŠHN«›‡³ººƒ7ÿ8£>ÇÈgEy¾º>ûÛ;©*ZS›êú6”cj"ª®'?Þ|óå×oŽ8çJÉpÔ4zðåéÁ›7ßxoÄàòý;Lúþ§ï†Þj>¸¾üþ½{÷5¾41¸Æ_~5Až+Èøöjøëõ?ÏÞ^œ‘$”sDùÛÙÏ¿ÖÕ$úçYM¸ÑÕü]jLõp&$'Rpÿ_ýÿëÞY,&»2 © Õl_¦=Ùx¸¡ÝAHIc¹ÌÐRT ´ÜˆÏìãH|k’ÅØj(Æýås÷Ké¬c ¯–`Žj Y5uCw†àÝl:wÝt— ‚C&hÇ®Äãáµ…åñ1¥H]ë¾ë!gÖVÀÏt#§ð,Ñ—•G(¨$6=„o– ĸ™ºŸõ.H©XZ¥h ¡@Α3E§D=¥ QL¼l(« 3¢Rˆ -DÅÍ—w :Û‘734ö­ƒÎ~ãí?&-RÔŒj,@Í,~¤¦”M? ‹`tü Si-” °dŸÊH!,ÄŸÜ“F¥ùC†ø ?0šð–B-wœÿí‚GŠ;]m%¸“øa?€;€ž.wŠc13 òІ4TW -<§<5l€O³lë7‰˜EÎaMѧ«¯}rè}"ôЧÐÿ}NlìÀ˜>ÑpÊ*%)ÑÂù´ãµwXçãõÆY ë›N7Ç™£@ >åÄ |ŠÄ9€O€þÿeœífÿûú7‚˜©ƒûH4”ÝgÓÍØ{DvVc§¸‹»ik›zNïM”óŽR‡§»rÒvEâÀ®@ÿƒ5Dë„·a(YJ¥'Fî°ëÛaëì&xºã¼£Ø+‡¿A Båä „ê:€OpþF¿Z‚IÒ)Ï›Ó`“×09wîÇv=]-Ư¤JWx ªä 2 q Ž þ>”j0^uæt…œaRæXSr»žE,à¥T}Ä[ì³?œ‰ß®í"ê -’¬Âk EŸ0C¥Á5ÖAa¤i*iPßÎ@L–ãY;¾f€ìÊ/ÀÑØ–¢1Úc(ZpËÐ^Þ€»gzpÛ\áô˜jŸÐUñƒÎãÙëÇœåmŠÂ%$:á1[6šÔ‚§&¨ŠP©+©¡µ[Vôc\«ÛWÛÛ¨¢\ÎÁdŽ`Eæ›sˆE݃Æ"BÜòyë( Þõ*Ú–HÒµæS¶¸ gmdÊäÂÆ 2À5r3È[Tß|kî°9JTa ÞæàÞvð¢m Ķ9ÀP Ñ=¼ïp7z;Ÿïm£3 ¿ ‡#t’Å%D8eK\6nÒ,f¬®Ä_fõz¿l­,o³UÄù%œ¨®Î!ŽÅàƒsˆ¹AƒÛ×õ‡÷—ÿvúuZ§=?Ž7÷IÚ–À}ÊÎW„¥H+íb¤5aJ8w½-¯¶É -ÚˆW¯?†KP7èH„R=ô âæhûù`iÓX¹jˆBÊFX¿ž­Ú¸–›ÍrõìuŽêŸÅ:·± -À_ñ ëéÝÅp$„œÃ›o.Î_’.°ûóÅ;e“Ìa’¥wj C%™"œ6»ÛÄë›v2<{ÜtÓ» ­»ÊJ;=ØäúQ6¹ä@ïbçºî#þj¼ñhC°úuíòàÒ%¯Ðóm²\Dc$Z™ÙÔùyÌ´“¾õÌGƒáÃÓýÔ {7³«ÞiY${D œrŸ¨5áµH÷ soIáÊ…áKdÒSë¶oVŸwˆ•ïê/Ñ)rÒ„NIsT§(9tŠbQsÂÌaêOñ¸èÓÆ’I3[/¬æ•ŠÈÆÅ«< öìçnê*Ø%–ñü€àä¨ÖäÍÉÈÉpyK@äÍ!¼±Q‰1â¿'éYÖ);ÐxˆK©ôî6Õº‚h¿ˆBg“&~Qe%h™ƒhA?Š–% ZæÃ`îh!~a{Щûêòë$cK >eÇ€ ¢¨NOùXJdš(íbZîVKÔßcÌÚ¡=¸ë¤‰ÛÕY‚¸9 q# Ž"n ȸ9Äœ1-{€[ÞÞÙ¥¢­W}†³%Àž°ÊRMz6‡ÛÙ‚ -Òpå2·q‘Ö–¶Sˆèâ¡Žl¨¼u3’æF’ÅÜ€q3xyÃ-o#¸ÓÅÍêùq¶Ó7ס)lH+m'Ý“$© Èqž7 -Æ«”g‹qAxQפÑz/¨( -:Ïî¡D•`or oùúÜò7‹˜J(×=ÄŽÁó3¸§úÎ’<%¹[Dˆv"¸fv™2A^<[m*®ÑnÅç—cB¸á«ÙÛÕR‚½9Ì-{#ÌG‘·â@Þ`n$‘œ½¨d$ëôÍaæ¶ôÓõ!¸Â0¬&½M'`@cDöÂN‡sܶèj9? °(ª¶…sB´‡-b1^Ú¢ÐÀÜN\°ÌÝxY¿n“ÙÁ(÷”½)ˆNMÒ¨!`16ª­1sØ3#ì0³Ð@ÍÎv 6Æ™\‚-ë„v¦ˆÑ"½ž%5 6œ’Z&¼õ·LÙ#àíduñš˜´¨²\ÌA\Œ ÀÅ@s8#œi.–€uÊÃ6¼®yó'ã6x›´¦¹q[2nwu–àdN‚ÀÉH‚8Yhàdg;vg¢h ”'ÇWóvî˜)óÙ§ö¢\xžˤŠÂ\ú¾<6uwØôÒµîn¾Â¼ç³‰·”3;ZB?X]ìl§2)|™ˆÁY”s÷ùxÑA>ŸMº^ˆ §3_œå¡÷{®ß²+æ¸.ê~Ï1ÔÓ§¡í}šmÜlnãóÙ¦†¯ÛÚŽêÔÆ÷ãÅÄd#ZQý1€p[ÇE×]0s*¶Ï;ØBÝý½àîM覽±‰Ú2î/8;·Ú4ÂôŒvGÕæãν±Ä<~Âa#js’  7"b°=já³oG:§¸vöyMï’߸ïˆÚD׫™VSFìPĉв$ˆ9­,íÞ½ûÍ`|3`™Ú²Ä¼À_ÿ>õZÊØz2ýáµá~´ùƒèzŒ`Z&ÓÛ±í¯›”åç’Î_öþĽ?Ì?hSëFö, `ìèÁš=7Ó_L¾ù¿þÑî`endstream +xÚ½XmoÛ8þî_aàˆ Ä\QÔk€ýͦ½îµI·qqwè¨lɶYJ%¹NþýÍ )K¶œäpØE€˜âÃy}fH9¶áOŽCOØ*¡/<%Ç‹Íȯ€òv$õ +{ì +Û÷ôËlôÓÏK[Dv4ž-iÉ,ùb]ýãòãìúÓdª”²¤“i„ÖåÄ ­««ÛÏ73¤¸Ö»›78uûéÃD5TÖìÝí Ó~E +Ì¹Ö —¿L¦°æ^ßM¾Î~]Ï:2M]áú +…ú>úòÕ' ÷o#[¨(ï`l EãÍÈõ”ð\¥¿óÑÝè÷– ÓÜ1ïP}jVL[Žs|\ú8upœ::„–"Šœ¡“|[€A§ð¿K?ü%HoÀ×`©xƒF{€Qž²UÁêâÐ|Lú w÷¤ÿ™ó¢,þ°¥ 3«m7ð›•À²¬xЬaZ¯ÿðã»ßß3å!®kä˜À䜧æñCàÿ¥H+&H?Ýñ¾àGNSa \0ãTùBJw¸á€r_Vy9ó¯x yý EL@6ÏñP¶û´HøãgþÙ<Õßó‹eYì…Ù ¢óÒmV½½u¼™Ç/ïCveÕ?7žo⺻×ÚšÄM<ëtøXpuß]!þÆC×”äö«}[àÍj¿f5È R›lÁ¤˜=Hä…aTœ5Úß“){º%¯‰¾JÑ;-"*›”›¥BÅe¾Ý=]Ï>üç_·ŸþùöÓíçg¯Uz¬µfKoó¼ ð7QrÂaÆÚ* 6TZïwV8…uúƒhj—óú²!}9;`­á‚ZÔ¯Ò~‰’‘X'ô¿º½¹ºœýa{ö2«êמŸiÓœ×Û +'€*_mš;²Ä»{]¢ríÞ‚ôø‘jMvUÖh‹5¥Á=ñ€vàìßa®—' ô#¥gbX~Ú&ûèÏãbûÌ9iš|sˆ*Ò󄀎žp#ç墄«üÁ²¢)ÏãÊG–‡#½P°èÐÃEó +U`Ñ*SÇÊõZv™&1D¦ A€² ý\Ü%†ÂN§“2%†õÅ©L§FCÙèÌjhWõJÀØâ1;m?uÒ¤7Ÿß¿?2ªt¥ŠŠ’ãFiê€qåÿ×” Ø‘ˆïĨ µ.qì—@ÑwØ b:10õ¹Î&VP­Áv¾o}Ìcšj(q=;Q¶Õ2n‡Ãr¢ 9k^af”X×Å¢zz (K“ 4qŽÎ‰¦sªa;ªUt°5y×-=!e±ÊŸx2É7€²(·H‹W‘Öºèlk=S.uW’ã:(*UMúØô{F«*©Ïy~Í1Ûö+?hTiê­ÞjL‹‹ƒ#Aˆ0UÜ  ý Y%Åñ¼ývüà“·9ƒ$Îä™é“ð 1·µ.Ìøq¬ Í(cŒR;ÍãT¯ý–%)oG[b·—Vˆ²™Q)Çs5OÇóu:ñvSþ5+Sì€c5; +K<⸣a¶€e{¶ÊÕ~¿a¢ê9,s»¬ášÔèuäfØý}K˜‘’nXò˜c?GŒP»VSÝÔêº,­‹)¼¸#×)lŽdkÏ.ÚÞYO@¨·}Ý>¹Ç¶[µ™È§ò]V¬ÇÆáF…nï°Òv|~*þTävÂ7bŒ6¡…ßm{¾0VBÐ'&¼¥‰iSÝM׎öA†ëX|œõB„U0QÒª+IâËûŽüi? O˜5a „‰>ÿØ#&fèŒR×ÅÊ¥û6S4Êôp%I—1%k#@OJG„*8UB\¡ùZ|w5¾¿e‹6Y¡áý†Cfz5¡^Š" ûW¸ðhÉý)ŒXlÌ&‘·‹<ý3ºé—ñ„«d?fó|ÿ¦_„ËÁ‰¹#ôKœ›fš/*¬Pô²BñE¨EÍjŽ¤ CÙ=åøªSPJÓóƒ«nÝÄ”QCyó_.ðÞ+]€QN½xó›†Ð—×É+ZGuFmNÐ×·grA_KP\êÿaƒÜ#$mG2W}/iÖF=šn«µMp£>Õ6]Ýb]]N"Ï¢»Ä„’k<Þ*ˆ?Þ,à Õ´î¨Þjéq¹?ìG›ºÅçæ¤ü0k8ƒá=w8ëôEâLGGy1 »cÂÁ¾ŒDÜ€ ïDŸš…ݸKÛÊÞ}ôÀ[“yôHJºò.¶­I«ßL0¸«ND’bš ×ÜÕ¶ma("«­Aà¦>4ÎÉVšC~kjqFBgé áŒ(ãÙÖ¿?´ñ ¸Bºîó00[›çÖ‘ì‘P@ïµ­Òï[ô|•”‡õy6G“=gæŽñäþ5!hß$0_óp.©¨L— Q@ÝÉjMµ¤¨¡Äˆ©Î·e+TVÉÒG ¾UÓ"$2=?°JªSDõB?½eÔËÝ¿k£%ó4Éô¥uª&@þ‹e–§‡—*ÃË÷Eœ¨.¯½Å>ûЫ!Ãîø´Á¥rüãçÒÿt͆eendstream endobj -4767 0 obj << +4961 0 obj << /Type /Page -/Contents 4768 0 R -/Resources 4766 0 R +/Contents 4962 0 R +/Resources 4960 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4773 0 R +/Parent 4956 0 R >> endobj -4769 0 obj << -/D [4767 0 R /XYZ 85.039 786.531 null] +4963 0 obj << +/D [4961 0 R /XYZ 85.039 786.531 null] >> endobj -4770 0 obj << -/D [4767 0 R /XYZ 85.039 738.175 null] +4959 0 obj << +/D [4961 0 R /XYZ 85.039 763.817 null] >> endobj -4771 0 obj << -/D [4767 0 R /XYZ 228.576 744.149 null] +4964 0 obj << +/D [4961 0 R /XYZ 216.493 769.79 null] >> endobj -718 0 obj << -/D [4767 0 R /XYZ 85.039 216.086 null] +746 0 obj << +/D [4961 0 R /XYZ 85.039 517.607 null] >> endobj -4772 0 obj << -/D [4767 0 R /XYZ 85.039 181.942 null] +4965 0 obj << +/D [4961 0 R /XYZ 85.039 497.481 null] >> endobj -4766 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R >> +750 0 obj << +/D [4961 0 R /XYZ 85.039 359.667 null] +>> endobj +4966 0 obj << +/D [4961 0 R /XYZ 85.039 326.129 null] +>> endobj +754 0 obj << +/D [4961 0 R /XYZ 85.039 188.922 null] +>> endobj +4866 0 obj << +/D [4961 0 R /XYZ 85.039 156.5 null] +>> endobj +4960 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F18 4228 0 R /F20 3021 0 R /F62 4159 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4776 0 obj << -/Length 2070 -/Filter /FlateDecode ->> -stream -xÚ­Xmoã¸þî_á"O"E½è‡\º¹æ°›ô6^ ÀÞ•-ÇV#K9I®7ÿ¾óBÊ’-{ ´óeHÎ<œyf(êÁŸ?µðT2âPhåO—Û‰7]ÃÌ/ßH¸FÄíÉü<Ÿüt¯Ã©ï‰ÄK¦ó—nŸÄ: §óì«s÷·Û¿Ï?|ž¹J)Ç÷Å̢عÉع»{úò8Ç™Àyx¼Ç¡§ÏŸf>ÌÆÊ™?<=òÜ_qÆgŽ·?Ï\yÁϳoó_'æž=K|¥PË?&_¿yÓ ,úuâ •ÄÓ=´=á'Ét; ´:P¦_Lž'¿u{ñ\0åUc X ×OD"õeàÂP„^Ø'½à´ap€U ÀF?®ç´{Õ¶y¹`ÂÐ)q *]ZVÅn[òp†Ãi›rï¥&©-÷ÚÍ -‘Ó¦‹bu=4K†—Í9È9¾1GúB{ŠÌyhÙò†/õmæÊÈ©T®Éذ♶bÉMŠ÷þoügfJªZn§¸¢àv6³öâ%ÿ²¥ÐÈ`jt–Ù*Ž2ئ¯9v×<Õ VFP9WKæi} +eâ´WÁLÀ á ‘÷è¤.¥Ä |ç{º}3¶ùÎ5LóŽ&U;–ZÂ~ÔhH¤åÎUžÙE|\þ»ç«úæ†wdz™nW(¬ìÝûÎ/Fqü5üé>”½›‘a ÚJЛ‚ó V=ÞÝÎíÌ÷´wýO­ÑÞöØ?•ˆ0ÔÓ0 Dà釗QŒ—k÷r{›‘' ô %w'¢Öhù5*‰öÆôØ>ïêcuµ—ýR×îuY]í+¡dr¢.`ëóm âÄÓˆ÷}è ¡¿6®h}‚<1G—]•è=ìÖEpÅÍ~†ñ„ÍWvT -Š¼*^Î~\ì`xË~EÈQ¨T|ܨÃ@3Žã0_>²c¦XA¶%!ñç•éÍ!¾?½#uÿöÑD':kì,w[céÌsèìM¤¤~}ئ ^ïÒµX‚©mö‘©m#ÎÐ[(¥ˆ¥¼Ho=™Ž­}‘hÝ£7D"Â[‡ÈÕÚsþñéã™ÓíªK§÷dÎ’«ÁÕë'Vñ¾]r‰„pvvc½‚•Ì˜ Sªc&¼‚náHqéÇ"€whO—¿¶2—†Â^xÑ@á[uoªùòâlå##x¼_~ßDÎr€Ô><®ƒȳ€~C9¡êò+ †Ó,#•3ó.5u ¶÷TÓVüÊJ—¯3Ü¢Ìx€tisŽ–e‹øFv"ç=Ã6å@¼…TâÇT’Ê{î/+xÚ¥9¿Ï¾Yqä(þ?rºèZÒÿœÅ3ž|©ñù‰+{amv§hI[îü Iª1m…7Ø㧰ØNq¹®ÂHL"p^4ñGöU±3î´7bÃJ>~æ`0š-Î/„-³ée 5€„ÔÔËŸRu¡RçÖކŨX¢Â{´KÚk_â8õVW *%(ò|>kf{(•žÄmÃçï ŽÚhcJ&úxBË:Ľ™ñwsп*pn·9À×c¼=»ï)Dƒ2¤útÑ{ÌÙ²¨_[µÙ¢+·¦jJ›†Dk -œÂe£Icüéëº üÒâÛˆ–Bˆþ(¿Uñ¼lqÈ‚£LÎÓéåÏSl2c÷ЦóZ¸Fy‰%ÓÛs/×D\²(¸ÔÁ¾'ÐD/±rLª(d¨a– ˜ -µÆàÁ¾õS{gQú†d–ÐSÞ ýo(”çy¿Í4šÍ°%ÈwØ_¾®ÊÎ?Ž&ÒBÉØ.§Wƒ)4[Êàpp/ù²Zga#Ïyxa[z -.]r-¹ÚOWö‘rx‹¥íQ©Þ}9\Þu7YÚ -àÄHåzä™oQ}·gßœ«ù4¥¿Ñ²Õ˜ó?}Æ=Ôâ1ÔÇrœõ5¤WéwÊPj“ñÉ% «•ÿ®Z/endstream +4969 0 obj << +/Length 1744 +/Filter /FlateDecode +>> +stream +xÚµX[oÛ6~÷¯ð†•˜%ER—}HÒËRô²%.: íƒl)¶VYr%ynþýÎá!eÙ‘³Û“‡äá9¿sQĘßGšqÃ(`ZŠñb=âã%¬¼ »ƒãÆ¥‹Ùèñ Œg1dz[³e–~ô.=ÿmöüz2•RzB°É4 #ï|âGÞåå»÷og¸¢¼«·/PôîúÍDÀj$½ÙÕ»·´ö W@¦¼.œ_L¦°ç6>¿™|ž½=Ÿõlš*¦‰F}}üÌÇ)ØýjÄ™Œ£ñÆœ‰8¯GJK¦•´óbt3ú½ÓBkjL§\ŸºSÉY©¡0øÄ5ß­²:#>q¡Àø"+“µå ý¶+X°²†É}µ‚ê}Øt¬È®åÍ„-»½)jk’æ%˜$;Ì7ÑR°U“¯7“) _ÕN]§åŒvl› Í{‚Š¿}×—Lø¾àkX:ÏÒTi_{Óœ~¿­‹'·¹cà55‹˜~S?f\‡ø>ˆ“*胜ÓÀ:­bï²Z¯Áªs‚Ð{^×ÕDr¯nܽW€K—§î™Šï,ÖúþýÂCêkͽ÷ >qÀá£w™”eÕ’M¯«%˜wŸI_Ÿ°B +‰ø((¤ºzôF’£˜Q6hF‹ZYJ¯t¤ƒms÷ÊóÊ +—v6fI¶@ ²õ‘ÝUTK¤áw‡[ðBà·À ¡wGã÷o¯þ QbT-ªm9ñc¯ýéç†ÆÆ‘7ɗΉÐk¶µÝ¡´ÚÖ8 3íl•4´i„=³”•$JÒ)ùÚ + $+«Ù…Ô5‚[Z’ßP|ú¨F:êïG’…±}MÒ4éœ8?O_²2¥#ïùŒ‡ÚÆ(­½ë,qæué!òÈÃE›òEq(“ºHX/Ç4¸~ùKn2Òç’µ<Ö¬C¦Ã†L”,!-¾á¶ªI{JžXöåEÃŽïš‚ùBBjæú?Aÿd^dŽ¡å’ñX²)‹,ªòv úü€A¿ÓUm¡ +o`ªEq¬ó¬!á®s¨Þ滑¸%L€U˜‘Ê›ºš›Šm§Á SéÝÛá®~ŒÌ³¡t‡ðP—ôRYG[<šv•’Ĥ4ü]í-¬ +»ØæÈ’ÄÛìRBÍBÑ­ˆðlq@Ó+ +cê7*×wì™6;,°Ÿ1$C²QxsÖšZ9¸äÉ@R…~ Œ 2b«>.‹jžŸž“˜ÏPg÷è“9ÚLžÒ +·ìÒ3šƒg ¸ô7§ÖvÀV¶&ãºb Þ‡ðÆyQÐÒ Èêã"‰ä)p•ú=ØÞ°ÆĹ-]HÓ;Úš—û#„K| +ÐÜ åŠ×D#C 82Föá¢W¼@¨!­E]í«÷Íl‹™/vÕ™½'fè{W·´ÅVuBO›Kå@k0Ù—eÇ@e*65°Ô´5ɶ1–‡ì<ëK×Ü@|˜„Y.³û=ºCõÎÝýc±‰‰ÄwñŒxuvDºÚ!b€">ÙK¦Tü}µQÚÚxY•Hå¶Nl+E¬ºÝ»Õi2dqä’l±,¢½ë¬]Uió?4±V.°BÅÒ˾™ú–/ò¶¸#¤» +,F–”¯"üˆI?dþ1¥¥1q˜ÒgC¯X{`¹Í ïk•Ð#úN«IÇ]åhÉü.Õû±òšÍ>ñ/r|*S˜Ñˆ~ ³q€‹&þ T½òugS|ÌY(¢ƒxrÍ_ŸäE^e}Sm#gäß’õ¦W†ÐæŒKñ#h+=ð”îB {Ŧ!ømr1œˆ¢ƒ¯…ÙÊ|Y󈾰y¼w ÆÙ7J¦-m©6]ʨš¼µ›ÌW7mÂAíüüŠ NÞM×½|F +;˜`¼Ï²_Z0F?ö‰ ™’îHµ1L¯J|_Zöß è±µ‚8ÕØÙÜø—¹Œ°XVy ÐýŠ "èܽ¯ÏÑÙ›Ù¡}¦ýðtæï}vÿ(L¸fl(ip,D'Rœµûßý³òX/ +Ì@BêcEÀd ?‰þÆ«‹`endstream endobj -4775 0 obj << +4968 0 obj << /Type /Page -/Contents 4776 0 R -/Resources 4774 0 R +/Contents 4969 0 R +/Resources 4967 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4773 0 R -/Annots [ 4781 0 R ] +/Parent 4956 0 R +/Annots [ 4973 0 R ] >> endobj -4781 0 obj << +4973 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 290.779 219.43 302.468] +/Rect [84.043 566.54 143.611 576.108] /Subtype /Link /A << /S /GoTo /D (acctmgmttools) >> >> endobj -4777 0 obj << -/D [4775 0 R /XYZ 85.039 786.531 null] +4970 0 obj << +/D [4968 0 R /XYZ 85.039 786.531 null] >> endobj -722 0 obj << -/D [4775 0 R /XYZ 85.039 766.606 null] +758 0 obj << +/D [4968 0 R /XYZ 85.039 709.685 null] >> endobj -4778 0 obj << -/D [4775 0 R /XYZ 85.039 746.481 null] +4971 0 obj << +/D [4968 0 R /XYZ 85.039 669.825 null] >> endobj -726 0 obj << -/D [4775 0 R /XYZ 85.039 622.822 null] +762 0 obj << +/D [4968 0 R /XYZ 85.039 669.825 null] >> endobj -4684 0 obj << -/D [4775 0 R /XYZ 85.039 590.401 null] +4972 0 obj << +/D [4968 0 R /XYZ 85.039 632.958 null] >> endobj -730 0 obj << -/D [4775 0 R /XYZ 85.039 436.348 null] +766 0 obj << +/D [4968 0 R /XYZ 85.039 552.271 null] >> endobj -4779 0 obj << -/D [4775 0 R /XYZ 85.039 396.185 null] +4974 0 obj << +/D [4968 0 R /XYZ 85.039 515.404 null] >> endobj -734 0 obj << -/D [4775 0 R /XYZ 85.039 396.185 null] +770 0 obj << +/D [4968 0 R /XYZ 85.039 297.038 null] >> endobj -4780 0 obj << -/D [4775 0 R /XYZ 85.039 359.318 null] +4975 0 obj << +/D [4968 0 R /XYZ 85.039 264.219 null] >> endobj -738 0 obj << -/D [4775 0 R /XYZ 85.039 276.51 null] +4967 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F58 3380 0 R /F59 3455 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -4782 0 obj << -/D [4775 0 R /XYZ 85.039 241.764 null] ->> endobj -4774 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -4785 0 obj << -/Length 772 +4978 0 obj << +/Length 3278 /Filter /FlateDecode >> stream -xÚ¥TMs›0½ó+8Š™Z•©3=8©Ó¦Ó&mLOiØ`›‰ãqòï»+ —ÚN.íîÓîÛ/qŸÁûJR&´Ÿ¨˜JÁýyå1 –Ïwˆ‘ƒŒ˜‹Ô{%cŸ3ª™öÓÅÁfTêØOó{rùeü#Ü#!ᜣ$Qd„Š\^ÞþºIÑ‘ë›+TÝÞ}8X• éõíµ}B è"’¢a|Œ3àd<¤_½Izà9È„ ,Ÿ¼ûæçÑWQ¡•¿‡3£\k¿ò")¨Œ„“×ÞÔûyðem‘oo+ŠŠJ%N«Âå *šSÆ?‰À]"LUî—ëf dëí¦îFÌÒX)¥Ce¤v“m·ùÌÒÜaB±8V¤]nÍí§Ë·EcV½³:#Uxi¶A'FÞîó33å ´|sPS’¬œjLñ0(qÌh%&%FFDJF²]·ÊqBª¢[5p„ô¶¨‰InʼnuÓYä>Œ4˜ZLëñ5ú.ì›ôÿbN;Úû c³Èп^’,m³CAây³†”Ê9²)áÔ­_,Ì”½è,,«­Ò¥ §Êt$éŒÀ£É ¦gmæìE‹]Õ’,w 7º­óiZ¼ë%˜•Â -&ö¦×p2/3õrÇÅìVîbÚ~œ: rs‘:°´/ÙÔ§#mR)ì>¯Ëº½Ž¢ˆL–ì!Ã\5†ñ?sDjç5wes}?à_d3RDž “N$¸0?Bã*î·üífnnlÊßÙ>:Øñba +5ºÑ_a‹òþÁôHÐÚ­[ëe Ø’ùû–|]q¹ï­a-­ð7à0é[¢MA›…¬OÜÃ(ñ^æšàyµÊà4é›x‡êêp`_‡Ø{Å4Èš_U+ƒeX‰'ZÔ̲ÎÝÑg>ïô¾mÇ¿ÍëÈ mÿhšÚm¦ÁŒ£“¢Æ5nŠ !h%¨Aþ4™-„q<ã`s-:·ûgvâÄ)êAÅÞK<µT÷ÕzŠVì(ÖXNgÑ Ò¼î™X8âc Ay¹c ÇCžíj§ïÜ£„Ïß™|G5­FÎÿg/ìܦæO9ýÅâÿÇŽãÿ|åb?VÑ©S2ÔC{­?ŒÄ çÿ·böáSÐ2;st} Ø 0ñÒƒ=VÝt˜Rd99@TÖùV ûï®_¿·õ6`šð]Õ«¬1I.¨zX¶"ÒºÞÔ¸Û: „–‡¢,¹t“K, +]Eä| “60ió +›`•j¶XX˜ek´ÑUƒŸ³»/•ñ‰ð£¬Ö÷yí'© Ð X5Ðf[fÐóƱÒ6V«UÑäó¯†,îÞNˆÎ Æ·Úµ.’²›!¤·¦>Ö’Scþû9ÌUIp:\ÿ;ù/;þhuÓ ·,L˜„ã¹<¨YV6Õ}Þ,Ý…‡¦N`ìý²]fs:8Œ‡P‚É8œxÆDì¸ÆœIE×ñ;ò^ÍIuó©°pÛ×$Ts—ÕºÂBÙf'Ð' ´Ù"ì’¯1™l"º}G­ïÕ˜|oS19/Ï­‚°:­6¥]X‹}Êã$YˆÂÓa9γ&?î AÍÏmUàGêäÈ‹¨‡ã|X£ˆäiɇ«l}µÌ@áŽbËí¼ÓúÏQE¡ÓV* b©D‰Ný‚‚NL4D‚Ö¢G4Ë‚³b܆Ru8P'àá +VáH«,Y§Æ œ& —°˜ëÀæß(¸Ì¹Êá”12Á*7âJ2®¨´yØ¥Ørã‘ æ j§îà<î-IIu{ºzÇGÀJ¶p˜b*¶¬¼Z & £Ôû)LËa¢d™¯ónsŒÏ³lžÈ3‡¸Ç4ø rùåçN@ƒßB<û þcó'ú4€×æ^Ï꯽œ3Í^ý¡'$ûÙEÚœb—{Ç«‘Vc™)¬õ—=ÒÕñ†ïVQõ‘$=è«"ÖWÒ=Rèj½zÃÉV›ü Øa ž/RßÔ¬F“Vsɸ$8!œNÒhTO“‘e˜F&ŸãPm5M Ç®Bò±˜ÆbmóØV’÷Æ%£°ºqŒ­(‘†ù¬]c†µÖÄr°ºõ]?ⶼôóD’üÖ1ú'D²¶2×:lƒNÆcóó%ç˜ð€yU­òçuññàžNÿ……Q8ÌIø¬­ÁšÖ‰¤K/¢®¸‰Â£Â¦=] ü®²Íãw×W\³ÉC¼Ýp¤4£ ‚ŠMú¢RÛ÷ ´¹7dñš%bGšû šS``ç/#˜n=ñÆ!®(@W@ÔoøèÍ‹:`ÐÅØbT +(­£ÔŸøOBª÷ßüÉfé–Šïù‡ ,’måƒF2º2D×liº.O2þA ì8îìô9í…:±0tŽΰļÞP0JƒkÌýj­òÃÛz fìµ™`nVi—ï|k8(ß¼@³¥iÂUfºÒd6`<ÜZ((vCí-¶~8|µþ$…ÿãD9ÜÛY]lš§J¤³a¤÷*¹Y¢¹i¸ž€T«¢|mÔØë d`Ö>ñ ½Ýrcc‡ÙÐÕü’?(Æ”Óf¬³®Ï3s+aReXA¶4”™åWLëÛ`_Ë=ÇJˆ`|Ì1¼a¾P¦C{þ·üšŽkq¶ekX'JD°9f^š4í½Ï2“†AN¸Ðe5Ë’ØhAxV¤b” FDZ:/A§,È„<ÂNt‡åu›\ M‚Ê “%©ÝjB„¤BÚ+º<ÖI÷®9>h®Ã[‡pÊNv*–¾Šm‡ ¿ÒàÄ^cÒA°G‘ŸáÞ2 ÷`îÈu:À‡ö{»ºógÕz10¾JéQÓ­l^eÃP&mb‘k÷Ñ _î4[Ùë¸?ƾÈäK]-Š2¿A)~ú¹ ªœñû=œ©ä6•Pp1—ðžQ§Ø`^dÒªtaøC”¤ñÄ 9wž‘ BSëÖ@­™=ÿÜq~6"lAã}?”ôÅÇz1‚ '°ñ‘’Šñí«ÍˆT¥R°Þ€ `I<öθ‘ý¿Xó>Ðj’XXdÀòcìXˆ?ˆ£>,lŒ$ô·˜ÝõÀt²è¼œí£@"ýôèÉ ÀLà¤ÊOÔÉïq õ¾%ڗщáÕ£àuB¼ kÞucìæ EèÑ”Ê8+µõ`°eËO] Ò’6XÀ²sfðäb¬[V+Sš‡¯@œw—UQœú¥‚ã¥dŸèOBçž`«{«â¼¬% BFî: ?ØC¡Œƒá„lÚ½çÝh§?@¹Ô-~P”1Xîî*]Öî*öΘ¶òpC™7í+%µØÇŒ£’Büæ7ðxÈnPÜžjWšy8æñz 'ÆÆȹgˆ:ØsÞ¨• ÒVuŸÀ(3Jbi3þi4—_¯êÜfFM:|I¢´“ÅO»1nO%#^ü¿ÍëyM¥%xX˜ j ÊX6…Œ7¥Q&´qàJO]ÒP‰Ã»}ebIFØ´{Ýð{ÝÀŠYɼI5?ô2#°Ý!ßÐΠ—ÌŒÂ=ßpïAdèÇ±FJðû6ûè©¿Ø(öà 9æ©rf`݆üÆHù‘ O2Fqí#àÝØ‘lí&ª:7Ž²T¾ÔâÐQ>Õ8}>îžýµŒðS­‡ÿRê‘¿ +FŸxfsÚŸ,h‰¤ûdç¸2ê™30B‘Úÿë™ È] endstream endobj -4784 0 obj << +4977 0 obj << /Type /Page -/Contents 4785 0 R -/Resources 4783 0 R +/Contents 4978 0 R +/Resources 4976 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4773 0 R +/Parent 4956 0 R >> endobj -4786 0 obj << -/D [4784 0 R /XYZ 85.039 786.531 null] +4979 0 obj << +/D [4977 0 R /XYZ 85.039 786.531 null] >> endobj -742 0 obj << -/D [4784 0 R /XYZ 85.039 683.595 null] +4937 0 obj << +/D [4977 0 R /XYZ 85.039 715.216 null] >> endobj -4787 0 obj << -/D [4784 0 R /XYZ 85.039 653.702 null] +4980 0 obj << +/D [4977 0 R /XYZ 181.864 720.584 null] >> endobj -4783 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +4976 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4791 0 obj << -/Length 2805 +4983 0 obj << +/Length 2202 /Filter /FlateDecode >> stream -xÚ¥Y[oã6~ϯð¾ÉÀX!ER—}›v:ƒÛé,’b -´}-ÅQG–\IN&ÿ¾çFIŽ•Á.Š/‡‡‡çú‘Ö+z•ºP™l•¤qèŒ^íWjµ‡™WZ(¬3¡³Ú “?»‰£PÙd‘FöØ$‘ mj‘æ»»«ë÷‘ZE*Œc³º»÷‚Ä ˆŠÒÕ]ñ[ £p½qN?­uU³_oLœ?Ýâ7>WMÑ®žÖô<˜7SýòñæWn}èÚÓ‘Iþ¸ûñꇻQ¶qW^ëoJ?£!éµ[if*›Ko\è\BÒß(u7T |Ap›¦,gýán‘æ°Ž’`‹­ Λ7pê(šò‰‰ö >̹wM@”aÓ$¸?á;\‰;Vm“×´r}fšªçµ9Ž=®h©ªqÃm]òÌÐòwוù@cY÷=ŒF)3GžùìI‰ ›FÓgtØ-Ð%AÉBDxPøGݲX‹¶`.œESY7;RÜÞ¼ë¹Å&„†˜Zž´—°IÜ!ï)Qšë÷q4³F›P+2¢l~é—äG¦?³žKÃ,Ê„¼?ñaèÐíáã—dgIªQݨÁSQÊøSFEÍlLžb¢3 ,ëÆ †¸öb ·5Žæ›7Ü•Š´x„žZð,Z ¿YÿöB;<”½4sZãíX‘=§ð•hpqZM±ü×Õo¨UQñã• -M–®ž ­Be«Ã•:å¤__Ý^ýwä…þ¡m¨S÷*Z¥€·<ù9Ÿ1þ¬‹Â´êã/¶°"ÌœC f -$É!EqLÿ¼Ö:lÈy!Z^V–ØÌ„iDlWÁI2m­!’y›Ž0®ofõ®YW3q…ífÆ—ÓE:s8eaœ¸•‹Ò².Š{'9ü®´íú;ÕáÀf¯rŒj!0íÁ’ÐF7Ú°AûÔ ø7özæ?œgoÁp8b@cA"Ï*秥­ô>½ûþ ·00s’e!ж_´ãVUÃCy›ƒG&Ù°‡@5:'”Rˆ»’Ö¶ÈÏG%´{ŸÚS-C Gr«Éé÷Ä®ãÙ)¸`¾?R|”» -UOdÅÂáHl«‚žÙ†>´ÍýÃic¡þ!+Êd åó]GêäìXvÞYž¼æ~¤ÔW˜"„dÛq¢8‘;ƒAø&r\FiÞ!2¬†.§©ŸÙ™›ù¬Ïu½œ Å&Jì$!rR×ÿ©hk”á+ï„ÈoמD¼ÐË%¡ÊX–Ó™‚ÍWd| ”ˆè§% aAkè¤à™SÏà5I8!)DÉ”º!ÂIÏ0Íz†Ù,Ifôç°iÄкæϯŸû‰s_2@"ØŒnxÝøÛš\ƒàâÎÊÆ[ÄÞGZzì—LÊÊ…ü~ŸïdˆXïº -×p^Ó… -6œJQ†¼é,È›±eæs$¹*„RxÖ˜Ñh®ºZªÌÜ\‚êEÙW1Ž#,ä·ümÉ Òp€¼% N_¹Kr?û:5‹ñ¢cãDÿ@cµl4zvòÓ%g¨ ?ÃЮ“ óá'램ü“¨ jc3³ÊbÀ”¬YQ%ãÙàYÁÅfã^F²f'+[Q©§™yiQ2²ÊH2Þ>,± °cÏ­\¬ÿÄJÝVº áXœF¿:5 c&¨þÄÜÎ.azYç—*ýŠ}Oå‘DRž±Ñxý›¡ ¾u#&yàXñ€d2šª®¹5ù3r¯ÇÒÆØ_ítð Ýûtpýä;`DuºC éÁÏ¥¥9+j`Y¯—k¨Ü¡`kÉ™ó;X5âüȳ¨¡ª¸¦¸;øÁ}%·-a:0h–fà‚Áî> QÄ…4KÕ‚¡¯]cf姎·Ëõ ÷IäŒ)ž`hÒq¹\¹“É–0*b¢N/ÅKÏîáЛjwçMŽ‹Ç -YñZf5~‘+?²( ÃìžÅ _ŠS‚¸:“ŠÅí¥2Ãý³@Þƒ,iéôìzÐG Wîÿ ÁbUùTGçŸzö¨†ª”à]x”Ã/Y|ÔÁ7-¸ÅWøžfÃ~ΟóÚÇ+0CæÒÙÃ%jvÙŸ­b#cëÅl‘ü>ñ"wÒFÏÂ&Æc.¥=)´eO„R‡£8Õ‰S­¼hu¹ÿâòäóL–±{ÄœÚ  ÍRï`Ô",”"NíîåÙÎ{KÏÃãõ[©Kçβ³'¤4¨d7,ånÞQ©"²-ƒp/"Eëù—Ü@€ñêçÐ"b ÛÇØé…ª÷·gJ×Ü9å›Y1ÁHa[g,¿¡—ñiå:?!á´qlã»ïù|\ÒóH׋€¯^À÷"°3³o¾Ã/·uԫÚ2›Þð!Ãðs’ÏçÉ×+VäøbD‡Î8毃|§vèCbƒ½ÿ“æeíÇ“x‰@mV|ÛˆgÑ!¬!aó¼âFM2Ð$/¤V2KËê4aY˜| ïÁ¶È9Á¥È™vŠ<ËV¯¸K³ŒEŠä·dÂHÙírXe˜—ÎÕ-!VËðÁü#A"á-+;l!ˆÍœ4ÌRÀç;t{ÈÖâд~Á5’å2«°;pRB8º:K«ež7-4d`‘X”&Ò …µØ¢A©…:@\Ó6'µéöñ±èÙèÂå u“¬tÊ@øRïA‚óÁNÞ{PrXkZ™o„ð`ç(Ÿ,1ÎÓ +£ŒÀsÒi2§­7ýÅ•ºÆIÁ¡ áýE‘ÞðsEQ wù@È5 hÔ½‚nb®*¹ä?#†u f h‰ "TØt?žŸ}²­3||Pãêƒ,ó¡qh'¶§IVºÍóë ðn^é,.î¿)òåâ1H®ôԮ݀Ĭj¸JÉÖ1‰N>ØÝ…`ƒMÜqp –ØQƒ¤†%j_Nœ<ÝÀôê6žH¸Q£x7œž¿Dëh +‚&óŠ`âï<ž%oG«ýwÃñ+>¢»;"b„D]\÷ãŽ7èl)¢õª¡1é¶1 $„¸'S…rÀjP½p5xIeIOa–ðMÔÖ¦ÚG²iŒámBˆrYNYÞMù{yωfÝÛf‡Zx®±J쎴L¶ë£E¨½'Ê<&y ¾ïƒVϺÌ3®ô[%ƒV@ü»Z¢­ðñEà"xd „ï«}Œ$儨žYÌL7­òÀ,úo1¨_*/m(ªÑ¶amöªIéU³~Ô€&Üã©TªY«yqÐVÊÑó*R@è¶.{ ½ˆ™&¨Î ,u ü1ŠUqÕŽP·sô¯mqžÂÔÖ²yu‰¼ZZø-^ ¬ä»]¡ƒZS6{D“ï ?¨)'žOq"š²‘m¥À`‘0¾ß¬Ç»Uëˆh…USÚ”Mw&ËÚ…@ƒ)}AÉr+ ¹æ}.ÛÛ† ¬”2›®.tV1mÇ,l¥¾ +ö¬­°´–À ËÛµ„ÿZr7–ͳχ’v…¯ƒ}M"évrSRH>äßíÇ|Žgf÷;õ áLy€T([Ⱥퟀ‡xN'W[¤ÊGfsÛÈ’ª~ܦޡ·¡Ár8Ÿ),mµ´@Ôó¡\¾¬ês7kN­¢åD`‹Ò€é=¨*é¬Î‡ÒnA#¶>x8»Z ßs蔓½ýc‚É +æ,Aêó™ímÌÍÇÔâÕÉk±aË…IÞÝ&VϬ©j{r¶vyX3 ‚r¹`2È‹ªä®¦†µÕ „Æ#¸'‹UÜ(ÞÐZ¢FÙP_ï?ÑåÙåv%B?য়c€zÊ€O›o†¸®1^ôÅ.ÀŃ³ÓŸ¶XÂ\šW°àOô†xŠr5Ø"c %aàÉ¿HÆ­tsð}ýoU²ÇךXÈšC²ú… Ùc¾mL'6šéŒž.9Ä$ŸÛs¨à©xYW\ç6þñfú~øÃ÷ü íýåtÌ]tÿIIòïļ˯•@ZïqC EßPBézzÒU +¥Í[MôZ1pš&ß–mT(á ö±å܇W„Gh±]Aîï›à-&U¯™ŸÏøÂÒ3>¦y¹ºT{=w¶ß1ç¥=\Ä(Žéf-yÇ–N“ë󯬲ÑMŸ0ðLrÊÊèv0Κ“’ο^ áÛ„þ;€hã]2¦Þ¡®Ÿe®ò1•~d·ÿ2³y„ó¢¹ßMÆÙVðÕ? Šw„Yøﶹ—ëÇx—É?îýdQ[m¾qîmáNç*åúzU±A ‘‰©Æ[ˆMº,®/\×oÜ+{âÍIýó)¾ìÓ9ýjäfãçž]¥ü_âëÇêÝ?ãu»O@f¿«@È° ¿Ý¾’*Ø:EGûj½lü/¡¿ÝEendstream endobj -4790 0 obj << +4982 0 obj << /Type /Page -/Contents 4791 0 R -/Resources 4789 0 R +/Contents 4983 0 R +/Resources 4981 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4773 0 R +/Parent 4956 0 R >> endobj -4792 0 obj << -/D [4790 0 R /XYZ 85.039 786.531 null] +4984 0 obj << +/D [4982 0 R /XYZ 85.039 786.531 null] >> endobj -746 0 obj << -/D [4790 0 R /XYZ 85.039 766.606 null] +4938 0 obj << +/D [4982 0 R /XYZ 85.039 722.621 null] >> endobj -3057 0 obj << -/D [4790 0 R /XYZ 85.039 658.638 null] +4985 0 obj << +/D [4982 0 R /XYZ 182.091 727.989 null] >> endobj -750 0 obj << -/D [4790 0 R /XYZ 85.039 429.939 null] +4946 0 obj << +/D [4982 0 R /XYZ 85.039 455.374 null] >> endobj -4793 0 obj << -/D [4790 0 R /XYZ 85.039 394.628 null] +4986 0 obj << +/D [4982 0 R /XYZ 265.958 461.347 null] >> endobj -4789 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R /F58 3360 0 R >> -/XObject << /Im3 4353 0 R >> +4957 0 obj << +/D [4982 0 R /XYZ 85.039 229.986 null] +>> endobj +4987 0 obj << +/D [4982 0 R /XYZ 221.091 235.96 null] +>> endobj +4981 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F35 3036 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4796 0 obj << -/Length 1781 +4990 0 obj << +/Length 1941 /Filter /FlateDecode >> stream -xÚ­XYoÛF~ׯ ú" -°Ö»ä.¼n§Ç¸@šZ¢%Æ”èTbÿûαKQçK Úk®ùffiåIøS^b„ S/N"aBåM—éÍáäý@YŠ±%÷hþ˜ ίLä))R™z“ÇNN*…I#o2ûê¿ýóâvòîóh†¡¯1Çqâ)ÿâö~¯Gcåß¼çsܾãéýõÍå§Qø÷vãâæ’'_n®ÿæÙûÏHðéËíÝèÛäÃàݤ3·w!†hìÁ×oÒ›ÁÅ> ¤ÓÄûs)TšzË6¡0:´ërp7ø«“ÅgÚc®C¾qã@Š8öÕÅilÕ…;êÂ=uÒ+‘¦Á!MÊ"Ñ1(Š”Lܧ٥5B3 ñ~xÂHÚw#™Ä¡H¥iÇÈ@˜$Òîøüz{—XæmŒ:¡† ‘G ¢ÈKD -¿€‚Pj&‰§ãTH þ‘Ffð£v#hDOäiˆmè»ØرŒ7d-@-ªÿ–]iСt‡ïl‰´T <¤;O«Õ*Ÿ¶xkí· ¸onç˜Ö¿FAìWì’ÖŽ9‹lŠÇ Þ©ÚE^‹#éâÈ =ZÏz4dt§_õŒñö±!£8XÄŒNýK´¦À0M×McQ­ŽYb%œ´dCsÔ}¡2Tvß½õ˜òW£±Ž"¿Xd`£ÍJ˜–´1ÇÃØÿx‡£ñï‹Õ ñÅ.2ßLp¡yqÎ<”/¼QYS¤­–ÏkÔ’ ˆÙ3p‹”]$Q–IhSÖNÖ3á|^gK¦ÖyÆÂöTu\@fùc†êJÀ‹ÖÊ_7^¼ü . ä²gLFé(ñÑŽªÍÊWfïŒÆ‹Ù’ì,š¶ÎÚªn˜Ä‰±¬xØÇÿDÿåÎ „fmŸ•Œy®‰¼(óùÑ»AðYœÕ¯ˆíä+l§6R@†t^x¬ê%XY`g‹rtJ:^»°äÈv¶HB[OÀÍßÀÂDþÅz¨DI-f¦µÑ3ŽEF€Ë­D—Ñ0Ÿ‘s삨fö2(p‰ŠòŽ©êíü*Ê’gØOÜé´¬ø²Ô_h+£{¿òƒXƒØÙøëL€ZQèWs[OVVc¯•–7³º—½*DÀ!¡ÂÙÄB¦lÿd"Tê cEçõšüQÕC>^»ƒ¼æ- $æ.—¤a‰ÈGW=òØ™ <  } -êÏüš„[e½þr†6sH ì-P˺±v¬º"ƒ\EÛì舚Ë#w©!5 ¤€-‚­ Jñ“@å𸠴ýÈ$ó ¿W¤[Y]öÓ -½… › -2ヶâƒ'  QäÃæC?‹ˆ©z´Ì ËpÀ¡Î!C¦Øré¾C†ß™Ç•Œ!ãhaS1Fû/#Âkå«ë† Å&³¹BêbNÑjG¶8èNžµ™:T¿¶¡Í‡ºÕL Ë`ÑèžäŠZ&.·¶ Í“sKÃ=§íxÈ3³UãÚ€¬eVXE;w1Aˆª„ƒd¿]V, Å[VJ®æ7^pí=PK0ULl%™Äǯ˷4´‰O>X7$ûïÕ¾OàjIèá¼÷JW2‰IN©r$'u)x“‡*è+›Öü©ÐnºxƵ|tË ¯»ÒÝ=+ºf¼¦WSi_…}œçíôܽ ñÅqÆûeÞmñfî™R´—–£xdå¯TÖ¼ òÀ¯D«¥×£ÏŽ~Å ÍÿMÚÿ’¶©õ?}I'"MŽ|H›¾@Ug ¥V¸÷o&Â$á“ÿ!í¥àendstream +xÚí\[s›8~÷¯`ö Ϭ)Ä¥omšl³“¦—¸³;Óö_˜`ð®7ÿ~utÙ&¾¤)Á[MfH‹Oß9::礙äi>6L;Ð<ß5°´Ñ¼gjSRóGñ¦æ¦‹¡êõ°÷â»2À ´á„6F_ô³·¯> Ï?õ¶mëýçùú«¾åëggï?_¡ÆÑ/¯/ èý§w}Dj}[^¾¿fuo †”9ú*^½îH›Òðü¦ÿmøgï|(õiàŽkC§þé}ùfjé÷Ÿ=Ó°_[‘sÓ@A Í{¶ ìØü:éÝô>VOauŽÆîjxõh1°áØvSß4“4õ ì¹rƒÍ#ϵÀöWoxá1çbxéKw`—¼uÀo{¹‰ŠkÈvÉ©Ô ú«kÏ¿úîž@{óñŠÙW9ã$b)© ç´;œI–³*¸û›äÿ«Y@ÛÚÑ-ks E£¾åéw0¦ã4Úì©e†kntu }Ûó xÚÀòHsäíjLÆ;šåº‚àÇhAÈ… öáÇЛLòvÆ[¯?Å5l§ÆÑ¿ˆÇtä·@BØ2, X(òó;3ìÛ–~¿ ãh*nòË%ºÂoµ?gY +=*ÇìPl aÃÃOÒ'*ìÈÁÚnë‡jõÛ(ËI6%@Qá+c"}s¡Jˆ€Ž²d)ŠÒÃít6NA+”¤O_MläÚÅ´–zõùúòoàœCGÕZά"›°c%?«q•€5½oœï$+~B²úOBVÜWÉlc3ˆqMW[Á9§¬¢ëÓÓµ†þ´ky†¬^ik¿läÛÂÙö]<PsF&o=(Ùt­£…ÎAØVûÅ(kù>ÇÍò½`t…B £å{l¢Ê ÌWV@Þ„Ö/ Z”³V”°3òŽÙ¬V(º…³Z¤ùwsøÆÌÖb"†ÒÖW`®#éw\Œ¨fÚL3.Fãt?œø³(ÐèAÙyOZxaÁWµ&bú¦ÜÔ`\ùD•4$M¶ø°)¤ +©rwüJšø[Ð:Î÷ˆµ¢WaÑ :ÛCvj4÷[§ù(L…-C`%¦Ó±˜2ež+ÊW”ÇHL ²Í@{8Î3†± =”M@»C9Ü·š±9a&sW)‰YwRµ$¦¯=y„£öd#8UÙ˜èK¦S(|dBð7Õ¢lª£m*Ï^_HA0­<‹™VäØhZ‘¦`å@= +òÎiZÂ郆©aE­áœÛRs¸«ZJ”ÿ+YiÓ•CÌÜ< ”œßûØÕüÄ$Á¸s b±P¼ØÊÓY”ÍÃX˜*]óvo"¤Q£¢Â±^¥Jú/ÉÒiQû»²£c[ª¯Z£È8:*møhvJ¾½çP‡§5õN­$‘ÚrI+ýx`ÿ. ’¿L’­ˆ²ì|¶ˆœ«XÉà Î2¡ú`š‰ó5>îñ’).6؆3¾ú‘á\„åìW‘÷,/#Xr˜¢.¾súáÞÚŸ“-p ÷±°¥Þ½‰Áš¡ô•Y~Ïa„cVšQC(YÆÆÔø_"Ûyûò·ñ†î¥B´êk’bòÅHØñ¢¬×9]q*=Jm¶ÚÃ×a)¼A6rh’˜H@T„ùZ†žÆË”µ¢è#>M%±à|eÝ“&E±b¸w5ó;ÉÐM¡}:mp7e©r=à]¥Žmœd,Mi‡ð] Uÿ>?+Ü„}ºÈ³šõÊFmÀ-$o4¦ýH­œÝ¿›Êè§ÙÏg—4¯á’±…ý¦Ÿ)¢&Cxjé;m™6Ѩ¥¹ïHâµÔ«#\4ê> endobj -4788 0 obj << -/Type /XObject -/Subtype /Image -/Width 194 -/Height 356 -/BitsPerComponent 8 -/ColorSpace /DeviceRGB -/Length 7021 -/Filter /FlateDecode ->> -stream -xÚíyL•WþÆË~‹Ö…UQ›Šþ Zf:¶àhq£¦NǤqi4í—vDÇÁÒT­CG¨ƒ±µ­H“jÜ2ÍÈÀÐŽŽuu •Š‚#;(«¿'žääÍ}ïûÞ ÷"×ËóüaÎ{î9ß³}Þï9ç弯O=EQe/zHQý)¢HEŠ(RDQ¤ˆ"E)¢HE‘"ŠÙC=¶"žˆ¡!EƒE‘ŽR4ÕÝÝÝÙÙIŠúQÕÆÆÆÙ³g»»»ÇÇÇ»ººµº   ** -ñˆ¹ÿ~ZZÚˆ#žyæ™ÔÔÔöövý¾áÅ‹ †ÈÈÈk×®YØŠ]»vùøøŸ:ujß¾}¾¾¾ÅÅÅ2YPP*ìææ6yòä3gÎ觯 Ïœ9ÿúùù;vL¿sLv»øµ¥¥eáÂ…È2mÚ4u6l@ï=÷ÜsW¯^u$ŠV­Z…,YYYè1u«•6×®]‹ÀÁƒ?ùäÒÓÓ-¡ÝuàÀз¶ââÅ‹eee`Üex„ Ê”½½½">,,L¿8ýxeøûï¿?w,­ÎÑñEèþD5ÐÌ›7Ï‘(ò÷÷G–;wîh1?/bàƒÎihh@ÁŠhjjBÀËËËòÙ¡««Ë(ììì,ÒÔ××c¤bbb†Žx'''ýâÌÆ+ØєeiuŽEp¡:ý)«1zôhG¢ÈÅÅYpk›ÇeÊžžÄ4g EFéû±©Q†“’’ÎÌÌü駟,)Îl¼NX«st(2ÛŸ¢HæHy{{# fs³ ¦é‘”¾w..Ñ9Zêêê ± EXr ÜÑÑaaqfãuÂZ£œ¡2¾—ÍÍÍúÕƒËr$ŠRRRÄj“—>EkÖ¬ALaaaQQ">""—X¥\¾|Ym¡­­-''G¹Ž²’¢ñãÇ‹5̉',)N?^?¬Õ9J‰úTTTˆËE‹‰^2Ù­­­¢Xd:EUUUØMà=6räH-Š°)ÃÖ [ lÓ°YÖMÄc÷„=îÁÜÜ\u¿ÅÆÆÂ8“⎶ž¢¯¾ú -Û(x€ùóç[Rœ~¼~X«s”úòË/áßPt‹È‚5²`od³RbJE5€“ã=/Â<^RRbÛ½Ãc~BbáºÅN:Çñž:âÖÆm‚mubbbuuõ€ëÀ½t0@ PçðÙ5EŠ(ŠQ¤ˆ"E)¢(RD‘"ŠQ¤ˆ¢HEŠ(RD‘"Š"E)¢HEŠìªn¬)r°á E¤ˆÙE«W¯5jÔ¸qãrss>úžÃòåËG<ÒÊ•+}:"}}}—,Y¢®ªV­âÖ­[çåååíí½wïÞ·ß~{ôèÑþùç2ÁÉ“'ãââ799¹¾¾^ß R½½½[¶l3f ’%%%ÉW\a³¨¨(,, yõ{Ò$Ïäåå¡t9sæÈ*™í™A§èwÞyë­·~üñÇ×^{ 1;vìhkkkmmÍÎÎÆXHãéééׯ_x~øaLLŒþMNÛ¹sgDD„º¯LÚ;v,†‘øiëÖ­jƒú ÔÅ!MssóÑ£GœœDøرcÊh]MM 2âöY¶l™¾A¥,0ˆÊ`ˆ•MËÌ̼wÔéI-Š²²²P%dY¿~½¬’ÙžtŠ‚ƒƒëêê”1AAA€J„q;È·€•6ÑLå ¨e¡üƒ¾8 ¥O0’Ù&‹SF",¿á ¬FSS“ŸŸŸ¾A¥ÂÃÃei5ÍžÔÊ~÷î]Y%³ tŠ0ˆâåzeŒøLÁÃG%P~ÁlÛ¡›7obŠœ2e -:A¼M¯Ÿ^^~ýõ×±±±(}Ò¤I%%%ꪚL`¶8­°2í•ÍÔ2¨+;M«iÖôdww·Lo¶g¢€€`¯Œ ”ØÃ9+¿-£Õve—FEEmÞ¼ùÂ… pqp–S$ç_XXèãã£Ua£f‹³„¢––é(´ *…ÒáEÍR¤Õ“ð‡â;:Ù‘ÙûÔ3ƒHEkÖ¬ã½uëÖ믿þðÑw®¶oßÞÞÞŽŽ²d6Ǭ}øða ´§OŸîêꪭ­ÍÏÏ·œ¢>ø ªªª³³óøñãXê««j2Ùât(*//GF è‘#G–.]ªoP©ÔÔÔC‡!Í•+WÒÒÒ´š¦Õ“p){öìACnܸµ“2{EEÌ666nÛ¶mÁ‚öÌ S„¢O°‰ A“û±³(..ƶ÷v@⛸_,°‘±œ"T{¸ñ©S§ž;wÎäØ©˜-N+ ;‰‰‰Ød¡Ú7n”ŸùÒ2¨<Ìܹs±“š1cFee¥òãÊdZ=‰m)¶¨¨@dd¤ø¶›Ìž³hæ¦M›ä· ÌöÌÐyví‚Û¿¿tŽñ‹=6‰¯Çxzz&''ß¾}›Q)¢HEŠ(RDQ¤ˆ"E”ýSDQ5¸¢O6Rsss\\œìŸ%K–È¿šQTŸ -øì³Ï<== Õ?„‚ƒƒ+++ó÷¿ÿ}Ø°a‰ê7BB‰²!‚DÙ!‚DÙ!‚DÙ!‚DÙ!‚DÙ!‚DÙ!‚DÙ!‚D„l‚A"B6Aˆ !Z&HDˆ Qö€A"B‰²!($$äÿL)33³–_}õU“Ö|}}yBÒÁúùÏnöÀð¯ýë~ŠŠ2k™ 9€jkk+tµuëV+):tè~ ™áØúë_ÿj%Eÿþ÷¿Ù¤ˆQ¤ˆ"E)"E)¢HEŠ(RDŠ(RD‘"ŠQ¤ˆQ¤ˆ"E)¢H)¢HEŠ(RD‘"RD‘"ŠQ¤ˆ"E¤ˆ"E)¢HEŠHEŠ(RD‘"Š‘"ŠQ¤ˆ"E”ãéÖ­[/½ôR‚¶ ÖP4mÚ4ûóæÍkiiá@<é*..vuuˆ/GGGë›=zôùóç9RLLÌSºtéR?Ì–——«M8q"0096HéééWJGGÇË/¿L„¢ $"Dˆ5¸ !‚d%HDˆ Y ¢¬‰QV‚D„(+A"B”• !ÊJˆe%HDˆ²$"DY ¢¬éÁƒDˆ²¤ÐÐP"DY²POQ”u"E” )¢O¦ú=‘‘"ŠQ¤ˆ"EEŠ(RD‘"ŠQ)¢† EZ5´‡šÛsÝH)"Eƒ;‚¬)Ò‘–––… º»»O›6M/»víòññ >uêÔ¾}û}}}‹‹‹¥©   äuss›>^=²¼n¤ÈÞ(JOOG8++ ê¦èâÅ‹eee€ž0a‚ÒZoo¯ˆ Sæ½zõê ê:¬ZµJ§\ýº‘"{£~á;wîÅËpWW—QØÙÙY¤©¯¯Ç@ÇÄÄ >ñNNNFy›ššðòòR×Áßß_¿\º‘"{£ÈÅÅaøÑÔ -'%%!œ™™ùÓO?™LÓÓÓƒ&,u,)W+ )²7Šà(nnnîEX± ÜÑÑ¡•¦®®u¼½½ñ“ø~µ–}­º‘"{£hÑ¢E^¾|¹¯?áï¿ÿþĉê4mmm999Z¯Ç¦¤¤à§ƒbù¤e_«n¤ÈÞ(ªªªÂÂ^kà¾RôÕW_ùùùa94þ|ušØØX˜Õú`>ÊÅÎ N#GŽ´¼n¤h(ÈòÀš§¤¤‰ÛCŠõ"ø1¬Ÿ Cbbbuu5"E)¢HEŠ(ŠQ¤ˆ"E)¢(RD‘"ŠQ¤ˆ¢HEŠ,i‹V +W®ÔúI¶=??Á‚â°+ÔÝÝýüóÏïÝ»÷‰k8) ŠRRR***L&V†_zé¥íÛ·‹ð–-[fÍšõ$6Üa(‚µuëÖyyyy{{ãv~ûí·GðçŸ.Ó„†† ñ^ØÙ³geƼ¼<üäáá1gÎœúúz_ZZ:}út$öõõ]²dI_)ºqãF||¼ô3ZUWWûøøœ;wî»ï¾óóó»uë–º `cÆŒAå“’’\\\¤¢¢¢°°0T—÷ïß_¾|ùˆG‚'|ðàÉz*+Ù†«?ôªUîJÑÖ­[›››=êää$ÂÇŽ‹ˆˆ0J‰fîܹSÆ‹—¹jjjÚÚÚÖ¯_¿lÙ2?vìØ“'Ovtt\¿~ÖúJþÍÈÈØ¿¿>EÐ_þò—qãÆEGG5ÜÂr’"¸…Í›7_¸p¡®®îÚdgbv Tš…—.,,ÄÒE]"<¿òåúÿüç?ãÇ7²‰Ñ·ß~û­ÎºËóçÏÿóŸÿÄBî‡~P„Ò1_˜¥5— ‹axcñ6œNö>5•Tk•ëaá}úôé®®®ÚÚZl±•‰Íâ·mÛ†­·ˆÿàƒªªª:;;?Žu‹ºDܳÉÉÉ yñ/ÂH©®ÖqqqZÕKLLÄZB„ß{ï½™3gÊûZ*55õСC(åÊ•+iiiZ­]»Û½ööv §\ŸÀ¥ìÙ³ Á‚këŽÛçðáÃ$­r’¢ââblgà~±ÌÀ–GÙ™ اÀ'lÚ´ ÷ ;ÄÀ?O:{(“…~üñǸõ`÷cAA–ÏŸ;w®ÉçE\%~€bs´{÷n£Rp§Ãj8cÆŒÊÊJå[iÊdZ{¥²²²‰'¢!‘‘‘âËV6=‰U\¶À¶G{rŸ~X.LLØôI§1tNŠl¢8OOOÌ›·oß&Eü;EŠ(RD‘"Šz‚("ᤈ‘"RD EZ§b´ÎéFBñ— äMNNVþÛ¤A¥ìê8)ê“ôOŨÏéFB‚ìììššdÌÍÍ•go´ *eoÇH‘å2{*Æä™"­ÃHʺ555ɳ7Z•²·ã@¤Èr™<cÉ™"“ae$f(yfFË RövˆõUF§b,9Sd–¢––é(´ *eoÇH‘å2y*FçL‘YŠÊËË‘zäÈ‘¥K—êTÊÞŽ‘"ËeòTŒÎ™"}Š`'11›,lÜ6nÜ(iTÊÞŽ‘¢'Z<DŠ¬‘"ŠQ¤ˆ¢HEŠ(RD MŠ(ªß"E”M(¢Ôºxñ¢øï†###kkkÙ!T¿òðð H”5Íš5ëæÍ›@ˆ QýFHüeð$Ê„„e%B‰² B‰² B‰² B‰² B‰² B‰² B‰² B‰Ù!‚D„l‚A"B6´LˆA¢ì!‚4trvv^±bÅ›*õã?îinn~Ó”^yåq‚” 9B~~~úg†ÅÿæÓW·cö(òĉ ’c(??·¶rrr0Ü^^^ý£hØ°a»uuêÔ)ÃKÀÐoŠú‘‘"E¤ˆ"E)¢HEŠHEŠ(RD‘"Š‘"ŠQ¤ˆ"E)"E)¢HEŠ(RDŠ(RD‘"ŠQ¤ˆQ¤ˆ"E)¢H)¢HEŠ(RD‘"RD‘"ŠQ¤ˆ}H‘"ŠQG[¶lyS[K—.µ†"ƒÁ𦮾øâ cx›èèhýÁúøøô"}ýêW¿¸okS$ñ1sgg眜õ—`óóóûj³½½ÝäGeáBúyvjpAЙ?ž/üS "HDˆ\ˆA"BÔà‚D„’• !ÊJˆe%HDˆ²$"DY ¢¬‰QV‚D„(+A"B”• !ÊJN:E„(+Aâ‘3ËõEY'RDÙ"údªß)¢HEŠ(RDQ¤ˆ"E)¢HE‘"ŠQ¤ˆ"EZ“1"|ôèQ£Ê_eú .¸ººN˜0Aœåèíí÷òòBùôôtK(ºzõª€áÂ…"XâR«>¤è1PôÃ? 6 x³A¿üå/‰{_«P$¸sçŽÝÝÝ"&001€­¡¡Ì­–P„¦`å7láÊp™™™Y^^NŠ…"(//áuëÖ™¥¨´´ÔÙÙyøðáˆ?~ü¸ÉB]\\ð+–ß:<¥ìééA@Ls–Pd”¾°°0$$10xâÄ Rd[aõ‚ -tuu‰Kp9jÔ(#Š0(qqq‚o¿ýV‡¢ŽŽÌp5çÏŸú駱ikkS*^îhii1KQ@@bšIé‹*.Q+- uuu€¥µÿþ÷¿ˆôôô$E¶¢¨€¼=«Sõ T¬‡§L™¢Cц p‰5 Âøäû2RJJŠXí`òÒ§hÍš5ˆ')**Rîø"""pYVVvùòeµ ›““£\G }óÍ7ˆç¤È¶ÂâäùçŸÇ퉅è‚ À¥|;Õ¨nï¾û®ÖbX&zwwwì­>ýôS_\\Œ\„˜ôÑÛà;šô¿ÚnmìV°“š1cFee¥òÍKöSØþ`+„™"22R¼-³‹Wì±ÄØa5Û§=šV?he1jµEZ6D(zï½÷àRÔ&¦ýû÷›töôxÈ>/ŠŠŠúÇ?þ1@và¦àL<==“““oß¾MŠþÙ5EŠ(ŠQ¤ˆ"E×(;\H;ðM:¸¡Dù'T£®®­­]¼xñÈ‘#‡ öòË/ïÞ½[?ž eŠRRR”9”uxá…Þ}÷ÝúúúÖÖÖÓ§OÏš5K?ž eŠnܸ/Ÿ<Ë:¸¹¹Éo)¥odöäÉ“qqqƒ!99Yy(44‘02yòdù•Qõ%eWdff~üñÇuOò˜<ùƒFmÞ¼ÙÏÏÏÃÃ#!! è&##cÿþýFMŸ>}Ó¦M¥¥¥ò›ÀúñFf³³³kjj°$«±o߾˗/‹°ÎI“'þøÇ?þîw¿«««ëìì4ú~ )²9EMMMQQQÂcÈ:TUU-Z´hĈ®®®3gμté’~¼ÖÜã&$yˆB}`IXÀÐ+Yµä$òäOXXØÿþ÷?Îhm3õÑG½ñÆê®Æ¤píÚ5Ì)ò×WRÊ;7oÞÄÌ5eÊpåîî.“©,á'xžÊÊJe¤…'y”'”#&EMQww7WËíÃo`)by¼ÒHKK‹<=‡…Ê… ày0ûÈdêKøéoû[^^ž\ä<´ø$¼«Êþ“¢Çð`G¬‡eLbb"¶`˜ €ÁŸÿüçùóçëÇ™-//ïêê*GŽYºt©ˆ÷òòB^Ä×ÖÖæçç˲Ô–äO+V¬øòË/EØ“<òrùòågÎœ—ƒÄÒ‹=žÇƒØøȬ~ñ‹_<ýôÓXýæ7¿‘û,­x£©°ÁMaé²qãFùýüââb¬U0…‡‡c,Ë2:°¤¬8|ñÅßÿý‡Ÿä‘—Àcƒ³»ví"EEŠ(RD‘"ŠQT_)¢¨~‹Q6¡èÿ -¾ œendstream -endobj -4797 0 obj << -/D [4795 0 R /XYZ 85.039 786.531 null] +/Parent 4956 0 R >> endobj -4798 0 obj << -/D [4795 0 R /XYZ 85.039 763.817 null] +4991 0 obj << +/D [4989 0 R /XYZ 85.039 786.531 null] >> endobj -4799 0 obj << -/D [4795 0 R /XYZ 85.039 763.817 null] +4958 0 obj << +/D [4989 0 R /XYZ 85.039 691.098 null] >> endobj -4800 0 obj << -/D [4795 0 R /XYZ 309.595 461.859 null] +4992 0 obj << +/D [4989 0 R /XYZ 228.576 697.072 null] >> endobj -754 0 obj << -/D [4795 0 R /XYZ 85.039 385.056 null] +4988 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -4801 0 obj << -/D [4795 0 R /XYZ 85.039 342.771 null] +4998 0 obj << +/Length 2887 +/Filter /FlateDecode +>> +stream +xÚ¥YYoÛH~÷¯Ð#D4ûâñ˜Yo6ÙÌÚƒ 03´HKÜ¡Ž!);^ìߺšjIt&ØÀ€EvWWWWUW}UT³þÔ,wqbŠY–§±3j¶Ü\%³̼¿RBa‰µð<1¹ð³‹Tljͦh’ÙÂä±u)NþpuýN'3Äijf÷Dt_ý)ÏÎ%ÑûnwØÏ&Í¢å~ßÌU´/T´Â±4ú¯LÝñëçf[íæFEÏHÓó`¹­æ¿ßÿ8³Il“l¶Ð6.’”¶ùùãí/8wõ÷ûPB¡˜ßqžèQ|åf*ò"ÿn9Ënh¶sÕæ9‹„òk¸CšÍ\gÑ>-pÞ¼cë4ÚÖÏL´‚óÃìžß6 xk¶Ä3‹¸ÁWâŽÍn[¶´r}aš¦çµ%Ž=Í(¤iqǶæ™aÇ¿Ë®.+¢²ïaTçÌy–°ïI“ …–.è°@—E5 ¡ñ ð^k0•±Í À28‹V±.8RÜÝÞôü„Ö¢² =yÒ|ÂfYt¼×0R£4×ïR˜@§&V‰Cø¥\Rî™þÄd. ]yàÃСw›M‰¿$;KÒŒêF ªZÆŸ0*jfa4¸¾Ñ' +XÖ…1 ;ðÚ‹5¼kqÄ0ßrË/£R‘ГB+žE‹áïF–À¿•Ð뺗ǒÖx;6d@Ï)ö†ÔYœ,çý‚‚·,/]#“¥Ñc¹lÚ†Œû"#»ŽBÄ÷÷Ìâ}‡ç;ìy?!™áWì +´$ÈK?Ôží̯eÛ’Ž@Ïž‡×$NW2GCl†Ž\Ô‹›]:jU/› +ý;I¢çu³Äó¬ùÅÆߛݦlÐEA¡GÄÁ©²“¥t]à÷ô*ƒõ—=Yl7Ú)$ý|îøñ3…°*<NÕÔìsÀz8k‘‚—ýÛ¾kT…ì6žáòÌÞ¨@%«Ê_Àv2Š¦IàÒó«Xž‚KŠdð¸ö‹‰qU´–Cpq`5¼5íÀ»pñ–)‡µTõc‰;´Âõ·Ä%|IMxIMªâÜ_Ò…š¸ÆJAR±B\ó{nÚ–·<^(øÂZ|w3L_þ¹+ïÏôÖ“‘ÚzIWŠ†Ú¦z¾w’¤üE¥+Þo=«&K2ú’xõB@ŽÁך·ÖÑwëzYµ­NEêã󦬋3áAtlNÙEÎVr:tl +‡¤^ýú{2«€ôÇ«óÙ3<'±‚0±¹²ÊÆÊ*yo¯î®~ +³£J²ØªWÙТØð“PŸrq±Ég…õ#¤ \8&ÙÏs¥ t„0]&r—Ɖ#2û$.”µ†fÃg’õ¸ˆ®o7fv³©fGÁLk.€L ›Ê'À}ž\H ÁÅ2ïÉ•D§„3z\æaÏO|< œ| ½ˆºrÙï™Kл8j¸Dû%…¦;Ú7»'ú­x¼‘ù;\NþÇ Ä0§’ƒ]eLœsrMúõîÐR2Ì£-F[D-e›;/O!çéîñ=¬eü–(Ë)µ@.〲yìŠÌgëÍC¼Üm'T WžaC¡Ø&MÏìQ{9hÏŸ¶B9Ÿ14‹"  ÐÓ Ë9ãªyªE+à±p7Î?†f€ ¼¶mê~x«‘‚­¸uýºÙ3)‘ׄBÒnºœó&p§·èNý„f²°½‡GŒ—•¡ìz´!fH5ԮݩÅWåS-‘/Š¨33âÐøØaD\­}|ô!ŽÔtüH +'Iº?¼n†’¬ÀOÄž´S„g\yo~Dg=´¼©À/ЛV‡n„®˜.B¥I €‹•,pà÷®…ýdU¸¬ø¾XºP—sà¥Uœ:ýJ1±È%yXKKcÓ³ZJa5îúnnª”á«Ï +$*£~¨·5j´ß{UM•p¸“ú‹k¸òLŠhîˆÿMåLå†N0œIä¦ìXcÜ¢ +‡©æ3©T'Ì?ÞÛk$_˜"@1(gÝÝ!ÄX$'ÖÔCsÃ}šEˆ¬ßíŽæÄcäî=9íl×AÆ'„k¤N rÄX×ÿhHî‹Ïé‚1ô¹œý)bÏOÐlZÞ_©yd‰€ Fô£ ¸o åBÅ3c("5®xЩ»âð¹ªqì#Uc–_Ðtº0dü=/üÚåú—OLð‰ðX“‹ üÚSM‹¨­ˆ>|ø¶QÕ0ðX‡î-—a%w[ +/0ÛŽŽÇ;·Ò¡•,Å®å.çƒ ¹‡­%›s^<žFˆ:.Cv+Úü?_ ?ŸF••¦¬Ï¨¯$¬rÒˆ +gfÁ¿R`fH,;žêVRþëýW`Õ»f…'édWwç;8ØŠŸ©> ÇS¯ï!ó§†}¯û>iõ·Hû:Cl…a-÷µ0Ö§c‘H W›± ì7“=౿ +‚2Ê +ù§â'êâ-9u ìX@šñß°ÿ›Å:?+•üyìÝR§ÔPë[š¹c+ÕwzäÆA ·×c{‰;Mg +]@>r©EøÿM†›ã—™ «ŽUþíVëH¥õI\y{ÚÆű 4àNðXÅCI£rüà ¸! ÁO +àãxGg9 ˜˜:õMQ3-ìÙwéŒé匉†eL…-ó?ä ¾U(è^D¶^Õ©±î4aLÓ#VO³ë„õp¾‘ÞÃFèðŒk¨åªH¥éQåeåý ‡ +Ú6Cãcýr9„´âLGå4‚²vléN1K!æ—êÖºÛ)óä±NìÈŽXø8vñ…¢xhȽoí˜ÿ”´ŒŸíå7lkÓXgê¤0ô…-63FÀ{h‡ñ3‰ 5—N?ár=¶_ðq{Ìý=¯? RK[‡É ~È(¨¤üpý»–¯‚ÄŒb¶´¶þŽÆ¦Ô¦„w³Ù3šë¹¢AæGÊ3à.HsÄX€YÝrþ{j_ü7¯,åv7cÅþø퉠@ô øõ°´'y–åIñ òš1ÓRZ¢=Où¯Bý¾\ŠLM_iËå0FˆÆä„=·ò5)8Õ7ÜõGÎX¬eŽ?ÛeÔ”8ÆcÐ˳8ÍÔךñZa{󯲳2ÅEv66.ÜÙgyÿû?už°6endstream +endobj +4997 0 obj << +/Type /Page +/Contents 4998 0 R +/Resources 4996 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5004 0 R +/Annots [ 5001 0 R 5002 0 R 5003 0 R ] >> endobj -4802 0 obj << -/D [4795 0 R /XYZ 85.039 107.434 null] +5001 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [158.829 133.536 215.538 145.226] +/Subtype /Link +/A << /S /GoTo /D (idmap-sid2gid) >> >> endobj -4803 0 obj << -/D [4795 0 R /XYZ 85.039 79.729 null] +5002 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [240.191 133.536 296.9 145.226] +/Subtype /Link +/A << /S /GoTo /D (idmap-gid2sid) >> >> endobj -4794 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R >> -/XObject << /Im7 4788 0 R >> -/ProcSet [ /PDF /Text /ImageC ] +5003 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [278.346 119.987 334.157 131.676] +/Subtype /Link +/A << /S /GoTo /D (idmap-store-gid2sid) >> >> endobj -4806 0 obj << -/Length 1960 -/Filter /FlateDecode ->> -stream -xÚ¥XYsÜ6~Ÿ_1ë}áTy(ââá*o•bùP*–KŽw+É4¤Ft8à Hú÷éàPJNyK%h4Ð>¾nHÌ#øóÔ„‘ÊæI‡F‰ùj3‹ækXy;ŽcéX–#ž.fGoL<Q˜EÙüâj8'‹B“Åó‹ü×àÕ»ã¯?-–J©@Èp±L’4x¿ÁñÇð÷t±ÁÙ[^Gò9¿œž|XÈ4øâÇg'<ø|vú_½ý„ ><_ü~ñãìõÅ îèBB)TöÏÙ¯¿Gó.öã, -U–Îo`…"Ëæ›™6*4Z¹y5;Ÿý<œÅkzλ¦lcTšTG˜‘qÜ^ 9OŒ cu¾Ö×på-_ÇnsÈ`ƒ6±ÍÝ"ÕÁs^»Ã›Ö}ób‹Ó®½wHÑA¹?æ¨ÀíÝêhÝÔ=wL¾)«ŠGU½Xâi¸)îý¤/ЖGoÔXu¥CÃý´ -cÅ~ÍëÍ7/n_˜H¾øZÏá*ÛçÔzÚqœ†*ÑO׈çÐ~®©áTB……‰(S“>)Íó<-λk,ï½uÆìÀd×e˶ÏaR³Ïp¸aê½S÷~Cí¾×ž¸-#Ïç›rÛ>ã zoÇñp‰Î¹crÓoqíZß;S«zÃg"K>åÈèž›ºîþ½Xi‚mÑñ€Änðž8³yîÖ;Zx‰jÛrËÄA_œôÛò–y84Xºx\ú«b”ÖE_Ë$Ë¡Ë ‘N+álk”xÝGϘÝ6îäm±BrA‹-Æ&‘qgïXØ1ðÅDDšŽ‚vgWn¹tÒÈáŽ6x& ¶vSP âÝà„¡«WmÍ.ÙXŸY8kûÆI‰‰Š.n‘í¯/^Êrƒº•_ccË× -:‘×É£ ÛÊ… J¹¶ÍpPW8\ù-2ÑKø#øNK™„Rn©¢0J±ÎjÜ}Ã'}e=t8¬"êõj¨®yÔRÞQ÷Rh”ã«ôÎ%¸³]Ý´ÿòý"ÀdÔëâW™$pì8Ü1̵my‰6V&f›Ã8ìÖçNšKÜÞ5)@qµFÞéÃ!ö~!Ãçl§ÀÙ…æÁóÈ(ºeÂð Ç3€pµÀ_"Ââ(¾tF·…°*)ý39R&Nay…‘ƒ?*fŠ`œbœv°RP£c)‚7‹TuÃkÅ­Ýìª<¬#0òS]Uâ iÏÊtEÎ42ˆ!§®ª>wá$;q­ s -J2J¸ÍŒ.jWF*³ÓÐ’ü9F%^!ÓOL¨ï¯SL:†²h¿EBWN=0;]ȘnMénÕLž6Ø”¥.6 8ý’dæÍh”2eô–ÅqâÄ{sàÉ /T¹OSa0ÖH®)1ʆuõÉŽsŒ5uŒûîà~‰AoM•\ÕUÅ´Í!¶=¼£RlË«Øî¼z¬ÇøîÒÔ”ùKEуBu¼Z$v&Ê®VÝ7ËÓp-2漇uàÔÁæZ¤l|:=áÁŽÑ•£¡ó1 ¤Në%F2u[®‡PÈ™®$/ ùyŒQ’‰m]4^öHÂÉkÊâ*gyÛºÙتbÌx:ÒÏí²ÝaÄ¡A’(xçßc©¡ŒÒ];ÄÕQ†®ÀA -‘<}Û1™J™×û:×TèKd¿)á4À 'lN¤r3N gyÚ·ÎÆ€¬õ/ˆ^EH7÷±Š;È`¥S¸œ×¼vÞP©‚ -Ù¦Š†ÎgTwnÉûlÇ™¾Í)©1'R—À5äŒw¶mÙÉáI—  Ü(PËÛ÷Ð -®“ÀÝ·p>¢`–">ë ï0‚üò_ƒ“_5ËÚuG¸^_êÔ¹×@5]gP3‡ »1  €‚fßíq_4ž^Ù®ôaQÝΕúCÇ0G(øì¹$èÑ::®?ážH&ÜŒ`é’¬NŠï̽ToLŒŽé׉’:ÔB=ù:ñÐsAª3̘áé+³ ¾Ü*ÁÞ»"è0¯aÌeá>%HCAµgÝ7l§ie‡ y1êµIb6¿ÇArS\ù‡bç^¦ûg1?XY'4Têšs|öYÃ;».`j5‰¿ð˾ù¿þ‹7€¤NÃ,}#ȃ2âЉ=ÐØÿ»ïPå¿0t*7endstream -endobj -4805 0 obj << -/Type /Page -/Contents 4806 0 R -/Resources 4804 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4773 0 R +4999 0 obj << +/D [4997 0 R /XYZ 85.039 786.531 null] >> endobj -4807 0 obj << -/D [4805 0 R /XYZ 85.039 786.531 null] +774 0 obj << +/D [4997 0 R /XYZ 85.039 766.606 null] >> endobj -4808 0 obj << -/D [4805 0 R /XYZ 85.039 695.473 null] +3118 0 obj << +/D [4997 0 R /XYZ 85.039 638.419 null] >> endobj -758 0 obj << -/D [4805 0 R /XYZ 85.039 324.413 null] +778 0 obj << +/D [4997 0 R /XYZ 85.039 348.104 null] >> endobj -4809 0 obj << -/D [4805 0 R /XYZ 85.039 289.667 null] +5000 0 obj << +/D [4997 0 R /XYZ 85.039 312.793 null] >> endobj -4804 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R /F62 4047 0 R >> +4996 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R /F35 3036 0 R /F64 4225 0 R /F18 4228 0 R /F58 3380 0 R >> +/XObject << /Im3 4496 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4812 0 obj << -/Length 1680 +5010 0 obj << +/Length 1339 /Filter /FlateDecode >> stream -xÚµWmoÛ6þî_áu 5-Šz ÐÙÒe)Ö$kRt@[ ²EÛBô6I®`?~w Æ©Ñj”Tõ¸kUØkÛäë¡ ¸Ï<ŸO;;õÜitwçкY —}¡‚^„Xº"Vmz>ø6sƒ!ú®jÏ1ÀT^K#?þ0_ÄÙ|Òî0Hoš…+i9Æ Þ5TŽ¡ “ -Åmgk³¼L±  \ÝWµL;Úak$ÏÖ­kT*Ué¢N‹uY˜æ€_àÇ:Žž\†5©Ïe½œwœú§ÙX}{]åV[˜éŸ?Ñ+ñq’‹|§ lÂl-àÉ´Êé»Û4®îôÌ.ÌôˆªÈÖ¿º¦ïÛ8‹ò]¥Êz——·-Ú2‹ú(.‹a@ö¿Ù"¼è*P*Í.X•l¢3ïà9ÊçÚ¥Ÿ{›ÀRÖÛ2;àìü”„P~—o“¨›eÉ=ýÚ„E!36p"¹ÜhðŸR¾ôÑ’w±>µ9RôÇìx,(yüÛØ^Ûy„ã1*·£j8Tâi7]Ât)Á®­»#TzIe¾Ô½¡Û<êfa¸ ÆšŸ„—ŠÑèNªÖìp‹YL¢ÉF¢éÊ­þ©9ñ‡žOA÷©OR·V·UŠB’üœ>sÅhê^!´ d.´eaºÌ#2û8â‚YÞÞ­YÇØ@á.ó}»ÝQU¼çR(±ßÅ/më3~ xê˜þ¡_Dw¼¹¢"Dàv"œ¶¦Æ7óOë‘l·|‰‡½¸—§Q~g¹&Þ~g5ü® ;6Å]i¾4ÐExmhæw¶'v¯à’cÝñØ$ô½Ç½ÞëŒ^/Ë -àz åõ9T$+ð)éK’åÝžšZA€·Â'Ù‡2Ô½F8K¬/¢é>ø”œÿ´Ï -ŒíŽµüEuñÂDó|ÀáÉëwà·<N‡nfu¨‘$ƒY¥þ|L€DÚîà嶤ýh+z¸‹“¤ãLûÔPô›¯ùLXð6÷ÝU—Ò-®cõDkžtH|õOïÈÅKÜñ¶8‰tÔ¶´Ú³;ðÎu\^$Ÿä `I¾ó#®ž?Ëà5dø%—´ŽIáÑšqH)¼¼™+¼/ ZÐÝ;d) ußNó(^éV—Õjîù“Ó< ã¬áfiœUš³l³øŽt 1pb -~íFo*Yö÷ÙâèwÜål+«zà8ù"îû ü¿l£Š«º ë|à$ež×ßxÿ¢/†å+l_w˜úe!Gà>?J‘à-/†’véû0$žuþH w VáÛ±NÂ7°x7ž¨ð9txy|} ¤‹«s¾ñ?6¼Ú Sn/®NÞŒµ o=áøê„ï®.þœ¾NwlœXacƒF~½ÿ(ƒ9øñz$…I]ðk)Tšë‘Œˆ¬ñûÕèfôûV +ŸÙ€o „bÒqL´‰Ö‡ê’4ñêÌž:s ŒV"Mõ&%cᔎ´—”}¾HØ F–à3h‰ˆÞ}É<9Ú§;âÑÅÚ'ؼ˜3´™8ßÀd¥‡´v_ÂA¬ppV,ëå +ut¦¢ÖX ©µçµŸÉ؉إlfO]OF§îâ yÅÐXÔÕã#ìæÂÃ¥­[ˆE¦Ù°†uŽplªÕc ›¢*ž% +KÃF}Sa Á1ÐDA•$ñpM ²œÇNI J¢:3 :+ ƒN W¿xq¼hxéðœ€`ÿPàéÿxçÚê-¬à°Xí‚Єë¬a?\p\.˜P=Ÿ– +ÌÑÿ¾r9¾ä?Ÿ‘Â9»ƒQ¹-Jðk^aß~jÀ»H†WSŒˆ=ÒR>Ŧaƒ„y6+.D)¨]XsùOuÇ ŒÒ5*N…3©WvZ¢œE2ƒ„¼.(¤‰ /³2[äu3€˘ ‹BžŠÕŠ5fmK¹[?´L œ3Îi־ؚ•ÌRÌ»FR¢;-Ú2#æz¶Aõ'¡š d œ’Þ2[çó—yvô[AŸ»F惡Ÿ¸e‘Jèk}3ZË1G\àìV|1¤/YT! ë&g¾»Œ v‘DH€Z6]æTGZ†/Ϥò Z˜×ÙŠO!S€äª¡tŸP¯¿÷„¯ê{ M(ì a£a‰wH©™<ðš*–JújrŒs +lͦñ®ûk0¨Z5¼_ë¢Í(ØÍ'ÖJzw”^ô:o—|eÞ¹ ‰Èë„è8a¡ðÅh‘c9ï3þ4³Î°ãO7`³Ìüf‘— 6oz·0Ù¼ºCŸuƒÏžÒË>ˆzöŠPϦ3¢Í×^~My|ðª»ÔãæƒT¶å :vÛ â•R×R.vý÷€„èn5ç£Ù øRÄ;b5IwÀæ^ò†è§Ó?·Qk™ð1:0|#çÅ€×HÞép›z*P?ÈHÒôFQ'°‚â#D]†äJº÷ZªÎX¯måøMÇo²5Þý”q±°Mm^#B3JwN`²!52ôÁ²Wm6ÄZ­©ó}éÚÕ-‹oP?¨ÂZá.A¸R€p?Éj_"|ƒž&fŽðpµ—Ð ˆú’©ÛökJvÒÁ)ÜÚjßÛ˜–uiØ¹Í ÇÎÐäÝIÎã¥÷1&©u~¼”9T‚ÕþeºÎ’S¢›Fۖƪ`KÄj%Œu=ØΪ²Ìg]­usÀƒŽ†+àÿþàpS±,ý7j1ðJ«Tèôo +oÈ÷ýÛ2‰P/NýíÃBYyð<áߊí?þ(hXendstream endobj -4811 0 obj << +5009 0 obj << /Type /Page -/Contents 4812 0 R -/Resources 4810 0 R +/Contents 5010 0 R +/Resources 5008 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4819 0 R ->> endobj -4813 0 obj << -/D [4811 0 R /XYZ 85.039 786.531 null] ->> endobj -762 0 obj << -/D [4811 0 R /XYZ 85.039 766.606 null] ->> endobj -4814 0 obj << -/D [4811 0 R /XYZ 85.039 742.055 null] +/Parent 5004 0 R >> endobj -766 0 obj << -/D [4811 0 R /XYZ 85.039 686.204 null] +4993 0 obj << +/Type /XObject +/Subtype /Image +/Width 458 +/Height 382 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 15986 +/Filter /FlateDecode +>> +stream +xÚíwXWû¿,½*EŠJl ‰;Ec°`áFƒŠÆXbÁN"¢bIôµ|-ñ5¢bÇ‚¨Ø½! ¢"E,HiþžËse¯ýQ–awv—ÏýÇ^³3³gÎœ™¹ç™ggÎ|ú$×|øð!44ÔÏϯ]»vêêê_(***666}ûö]°`Azzú'¨kÞ¼y³hÑ"CCÃ/”ÒìÕ«W±quÅ7LMM™‘<<<Ö¯_OR*,,T¸)--}ôèÑáǃ‚‚455ÙM:•Æc+j™ˆˆ²P§N”f½rrr&Ož¬ªªJ«6tèÐ>`[j½{÷ª¨¨Æ_\\¬|+xîÜ9###ZÁÎ;+å +ä»wïjkk“yfÏž­Ä«ùøñcKKKZÍ)S¦`£dÍû÷ïYÔªô+{ýúu ŠÒ<ˆM)£G&µ¶iÓ¦ž$$ÿûßÿÒújii¥¥¥aëdĽ{÷TUUÕÔÔþùçŸú³Ö½{÷&Á`Ȉ’g¦M›V¯ÖúáÇtBÑÐÐxòä öïܸqCEEEWW733³¾­;ˇŒ3»€w† F† ¬‡ëžœœ¬®®.²³³±'x$//OGG‡b×çÏŸ×Ï0`\Ö­[‡À#{÷î%·téÒ¥Þ¶ÀîÝ»©ºvíŠÀ#>>>ä–µk×òU`qqqHHˆƒƒƒ™™]qSá½{÷f“š7oN_ãââ,--ƒƒƒi̦M›š5k¦ªªJŸ4,,„ÍYéW6|õêÕ¦M›êêêNž<¹¨¨Hš +¿ÿ^[[›ê€[³<š‰%##ƒ¯2 ®_¿ÎÊoÕªU9»¶iÓfõêÕ7oÞ £¯cÇŽ½}û6}Òð®]»8Ú• +Yµj»ÕdÎË)fãÆØ%¼@Š#«´lÙ’¯_½zE®½³‹4Xή‘‘‘ìkûöíÕÕÕsssYI®››G»9r„†ß¾}«¦¦æèè(eµ×¯_;<²uëV²Êˆ#ø*ðÂ… å‚ÀŠvN"µÚÚÚ +¿ÚØØhjjr´«è¯H°RVû¯¿þ¢2Û¶m‹]À 'N$«Ð%6_^¼x‘ +¤ ᘊ™á$r©¨]­­­%°+˾JYí¼¼<öX"öa C¾úê+2Õùóçù*0;;[UUµ_¿~ì+û;¾*»vèÐA˜ÈÉÉ!¿¹ºº²INNN4'û»*66–&UjW¶¸Î;K_ó-ZP±·nÝÂ^ö~Ñ3f •9a„ɓ'S8JWîžžž•Ú•¹×ßßÿÎ;ßÿ= ‡……±I^^^ô5(((44ÔÙÙÙÜܼœ]cbbèWƒ¦a^ú¹bEíÛ·{@zØ‹¥¼£©³fÍjß¾ýÀ=zÔªU+W¥výôùŽ,[[[Š?íììDïȺví§ê¹»»'''WÌ °7:::nß¾—j7ŽÊܼy3ö +€”äåå‘O¤OZŠ!??_GG‡ß¾¸+*šèŒ@ÅR¨Œ %iiiä+++ˤ8sçÎ)))%%%Ïž=óõõ¥óæÍ›òo×*vîܹØ1R’@>¡+wËŒoÔ¨‘ð ×666à·Úݺuã÷ŒÀØ°aUxâĉØ1RrïÞ=ò‰‹‹ ¿Å–••eff>|ø0##ƒ†¥5þïÿþ¯ž¼õ kèú|Ò¤I“ZXVIIÉš5kÜÜÜtuuUTTôôô(fþî»ï„÷—Vú¿¡¦¦F‘ªOtt´Lk¸|ùr¥]# vÈÉÉ!Ÿèëëײ¦OŸNË8pà‘#G.^¼xðàÁ… ººº²›]+µk\\\LLÌñãÇ—-[Ö´iS3sæLÙÕpÎœ9´ˆ¥K—bÇH O‘!E’ÅÅŲ^–¡¡¡©©)E°UÍ æi,âÍ›7-[¶¤‘QQQ2ªa@@:rðEÆ I)YYY²^žž öýû÷’Ù•8yò$>Æ;¾¾¾T~xx8ö +€ô´k׎”réÒ%Y/ˆE†ÎÎÎ{öìÉËË“À®EEEZZZ˨†mÛ¶¥…^¾|{@zX¯ªµðғ‰'²î´µµ}||Ž;VZZÊÝ®„­­­ŠŠŠŒª§¡¡AÕ«ÔüPSX¿¦äØÚY\ZZÚï¿ÿþõ×_³ûºté"LJp±« ™Y»uë-±E‹Ø%¼@Âd•víÚÕòr“’’úöíK‹7n÷Ì€¦¦¦³³³,êóÇÐýüü°KxáÇ@]]=''§–ýúõk–‰åh×èèh9cÆ YTfÔ¨Q庥)ñôô$±lÛ¶M¦KIMM­8¦ª®_+Ú•äߦM]]Ý””ÞëVXXhddDKü矰?ø½(öòò’éRÔÔÔúöíKÁaTTTLLÌž={ÜÜÜTTTNœ8Q•]ã>sæÌú•­­­¶¶öñãÇeQ·£GÖIz Üкººº@ é]¯dH’$©ÌÀÀ€bfÑw"Tõ$,UÌÎÎ. àñãÇ2ªÛˆ#hAË–-ÃÎàöSýìÚ4;;[GG‡¢ègÏžaOð ûÃÈÄÄD̳TÊ +ë¡ÿþØ ² k×®$™àààzµÖéééÚÚÚ¸Þ½{û@°7e“j^¾|YÖÚßߟÖzèСز£OŸ>¤ÑT•˜ƒÒúªªª&&&bëdz™Ì^Úò믿*ýÊ>~üØÐÐVvíÚµØôYsæÌŠåTTTöï߯īùîÝ»V­Z‘Z…¯YÌ®—W¬X¡”+øàÁZG{{{ôˆ¨MV¯^Mv%ÿøúú¾yóFiÖ«¤¤dùòåššš´j_}õÕ«W¯°­µÌØCUêêê'NoÞ<úúûï¿ÓlOŸ>1cÆÙ³gãããIò4~À€ÕÎÑ®S¦L]}:k”«¹¬«G?·±±aÚLOO¯¶>-Z´X±bÅ¡C‡ÌÍÍ­¬¬>|ø» ‡v}õêE\Ó¦MŽ!”³kdd$ûJÁ’ººznn. ¿ÿžâ7777Žv=rä ó(èrtttᦠŽ†µµµ>|H_KKKiΩS§–«pII ÍæääTmá\ìš••E?™>}º˜š×Bõ„ åRŸ={ö°¯ëׯ§¯ÇŽƒ]C»’:hÎ7Š±«p©Uô=€qijjr´«è¯H •N*w£.Ô×ýû÷éz™æ¡C‡ŠÎ&¦p.vŽŽ¦aŠE¹Ô\vÕÎV£ú\¾|™¾Vuóì +@ÝÚõâÅ‹4']ø ÇTÌ ˆúDÔ®ÖÖÖØ•e k¤/ªM + ¤Koºv£/ѹؕ½:vÇŽÒØUúê g«Q}®\¹B_×®] » ‡vÍÎÎVUUíׯûº{÷îŠÿj gîСƒ03““Ca˜««+›D×Â4'ûË&66–ýS±¶¸Î;×H_†††Mš4­\n¡Ò¹ØõÁƒ4>>zzzZZZâ çbWZÇŽ6lHWÙÆÓHƒšÚU²ê¹¹¹‘–Ù058M:zôèË—/«­;…¥¦¦:88ôèуVv@>íZPP0kÖ¬öíÛ8‚¥V­Z‘*Õ˧Ïwd±[ìììDïȺví§ÈÖÝÝ=99¹âõ,¡¢¢BA]UIE1úºpáEw´P—C‡‘ (¢³°° ψ)œ‹]‰gÏžõêÕK 4kÖ,**J‚Ì€dÕ-üÖ­[ô•J p´ÚúÐu»[€Î†ì–0Ø€Ú´+Îü0??ŸÌ0{öl+#Óûó«*ü‹* )Õ憨ÛçjaWêЮgîܹ3%%¥¤¤„¢&___úáÍ›7Ý®‰U””»jÁ®ñññ5†v666à·2ݺu“]Ä(Ó½z°+u›(++ËÌÌ|øðaFF†˜¿H€Â»P·v°+v°+°+€]€]ì +€]ì +ì +`W`W»`W»»Øå°+ ØØÀ®9‡½/¬Gh +€]@Î9þ<ÙµgÏžh +€]v€zȹsçÈ®½zõBSì +°+ÔCΞ=KvíÝ»7š`W€] ræ̲«»»;š`W€]@¹)+++ý—²9}ú4ÙÕÃÃí’ñöí[##£ªz7UùÕ E£-Zı+i“ÜÜ\´páÍ›7†††\ìº|ùr4pgáÂ…\@á«Wà ˆQ«©©)W€×¯_‹ _¸€ÄÌŸ?+ðNvv¶¾¾~E»âW’¹sç"p€Z_¸/Ì™3G4pÍËËC›€ôdeeikk#pÞ:t(©UCC+ðHxx8ÙÕÉÉ M<Hv577ÿþ=Z¤çǵîܹƒfiøçŸÚµkÇ2®6l°··§a--­M›6¡q@2öíÛÇú xõöíÛ,Ž0a b‡Ž,ÔˆÂÂÂI“&1‹6,''Gtjxx8{¾ÀÑÑñîÝ»h.àBRRRûöíY`ãÆ•ÎóèÑ£6mÚÐ<ÚÚÚ[¶lA£€xöïßϲööö·nÝ3gAAÁøñãY|ëç燞 ªlÀ?þÈl9tèÐrÙ€ªØ½{·žžý¤yóæ÷îÝC3€(?vuu%Ijjj®_¿¾F¿}øðaëÖ­Y–`ëÖ­hL`8p€½¶Y³f7oÞ” „‚‚÷Ž9Y²“'OfV2dÈ»wï¤)mçÎ,Kàää¯Ð-óÛo¿}QÏÐÐШóf¿|ùrZZšð뀾ʎRª599ÙÍÍeÖ­[ÇK™‰‰‰...T¦ŽŽÎ¶mÛ`WØ• ©©©K—.utt433»zõ*ì +»*4‡222¢U³³³»qã%çççÿðìݾûî;íS‹ÙuúôéõáæãÇubׂ‚‚ððpOOOcc　Q¯ŠÚõÈ‘#¸ÌTJ”Ï®t(M™2EEE…ÖËÇÇçíÛ·²XJXX˜®®.-¢E‹÷ï߇]aWQþúë¯ &T½¼¼öìÙóáÇJgcv=zô(D»Ê?Ož<éС;”Ö®][VV&»e=xðÀÙÙ™e þ÷¿ÿI_`óæÍ©´   ŠÛˆ&Á®òo×´´´eË–999Ñö¢Ñ«ììÊq÷ míëë+M Ü 3‰ãr9–PkˆÖ‡{ݔɮ,`kk{ýúõZXb~~þ˜1cXŽ=ZÊ,³+I 11vU »RhJjŸ>}6l8~üx +\9þ»®ZµŠãÞ%M Ü 3‰ãr9–PkˆÖ‡{ݔîtøL:•e $£l@Uìرƒe Z¶l™ åݺuºaW¹µëÕ«WŒ===ÃÃà + +jôóÚÌ ðî+éíZ›µåÂ’%Küüü`WQž>}Ú±cGvø¬Y³F¦Ù€ªøûï¿[µjEu ÍþùçŸÒìQì à¢7$À®òf×ôôôÐÐÐ-Z8::†„„¤¦¦JVì*Wvå¸FõÇ®‡nР­‚͵k×ê°&yyyßÿ=kOÈÏÏ—lãÒmmméóÕ«W•ÚuÓ¦MÍš5SUU¥O‰û¡…]%ËìÛ·¯oß¾´uÆwùòe)OåâíêêêúÍ7߰ጌ º4£‹öõÝ»wtUn÷`»Íìå奮®N;Ò©S§D'%&&R(¢¦¦Ö¾}{a/ñK(..^ºt©½½½‰‰ • ª1“ÄËG¸\1%°*%%%QCkÝ£G:]¿~ÝÎÎŽ¾R=ÙSítÅJ…*L‡†žž]M$''‹–@M›6¥øgòäÉEEE[[xÕˆ#ª­O¥-©4v¥C†äÀ²|óæ<Ôjûöí:::T%Ú( •ìÔIû3{(¬âNF_ÇŽ{ûömú¤á]»vÁ®²¶+¸'MšDš»»;5¸§N ì:kÖ,}}}:ÌixÆ ´«“LØ1û÷ï×ÖÖf‰ˆŠnüòË/çÍ›Gg^ú ÙFtÅÛ+V¬8tè¹¹¹••»™c S¦L100`ÿhP­èä.T‡˜Ií*¦V¥ž={nÞ¼™]ÙuíÚµC‡t¬Q%éëï¿ÿήag̘qöìÙøøøàà`OÍ+ZB›6mV­ZE® aºâ¨x LÓ&]›T[ŸJ[R9ìúìÙ3ÚØ!C¢¨“l@U$$$´lÙ’e vìØ!Ù…‰ŸŸ Ÿ9s¦ÜNH'JŠ(Ø£¸ïß¿§ÃÍÍÍ v•‘])„£#ˆ¶¦ƒƒÃ’%KRRRø­˜x»ž8q‚¦^¹r…†{õê5qâDúzðàAú:zôhooïª"Oá,$ÆrNسgûº~ýzúzìØ1Ž%deeQœ&ºÃwW1“8ÚU| løÂ… 4L1'ëñãáÇôµ´´”~8uêÔr%—””ˆ¾„”•Àî+¦—~âèè(æäRŸJ[R ìJ{#ËX[[W¼C[ÈËË5jk[Š09†:¢[033ÓÈȈΘŸˆîüìbMø:Ûjjj®üÚµ°°‚Ã~ýú5lØð‡~ˆ‹‹“Ñé[¼]ÙÙ“¢,v°Ó¥]½ÒîDJ133£@®*» +k+&[xùòeúÊþ²çRBtt4 P¸Xqw3‰£]Å—P®´r‰2Úÿ…v½ÿ>]ÎS :´âJ‰5ÔžbÀÕG´%Ú®tæúùçŸY6 ÿþr’ ¨ + +X–ÀÙÙùÁƒ5MªoÙ²…¾²ká~Bû’¨]éü»òh×7nüøã&&&½{÷Þ¹s'_ÉìJtêÔ‰jòÇÐu(}]°`……ŵk×èW›iÅhDŒ($¦¯k×®åXBdd$ ˆ^‹q™ÄÑ®âKàh×Õ«WÓ¤ÀÀÀøøxº´³R,û*æ¬Q}D[RqíúìÙ³¯¾úŠjKñµ¤\eª‚N¦t\Põôôèh­‘])DéÒ¥ E/¢ûI‡„™œœ:S<Ã&ÑÎ0kÖ¬—/_òhW:…5jÔH´©é +ˆ~8yòdÑÙè+ûÃEïlçb×/^¬\¹’N‚t±°xñbÚÓjg÷ æo×ùóçkiiõêÕkáÂ…Ÿ>?Æþeh×®]¥-ÆÝ®dlúzéÒ%Ž%Px@sæÌaã=zÄ"ñ“8ÚU| íjhhؤIÑÙ„—ÿ¢%dgg«ªªvîܹb}œœœXÜ^£úˆ¶¤‚Ú•jºLcÙ–‰*·T„ßî¸×S¦L!—²{_4h0lØ0:‡æåå}÷Ýw¬Jt™)æ–ÈŠgü„„„rvݽ{7}õ÷÷¿sç»E!,,ŒMÚ¸q#Kö’c…÷HiW6Ëq1XöÏÁÁAt6Úƒƒƒ?ÉåíbìZXXxðàÁo¿ý–6]NÆÆÆÖò)»Z»ž={–í9¬çö’’v0ÙJ`Wö_yjj*mÁ=z°õåRÍÙ±cGZ:]_¼x‘Ƴw|ˆŸÄÑ®âKàhW+++Òæ† >ìããCñ ˜"""„%ÄÄÄÐQ3xð`aúšpss#-³aOOO¶9(D©¶>•¶¤ÂÙ•ÖbæÌ™,àííýúõëJ¬¸ +ÔÎ]E7=Ed¿[·nݾ}›†i}¾#‹Ývbgg'zG³+ƒ;{öl1ŽåhWZšM¸Ú…XΊF>yò„LIIa·»ð%C)·G»Ò¡°gÏžó×UW<ÕÚ•ÎÅTm{{{áÁËþî½ù°Fv¥mÇþã¦Ë áë98–@!=íÏtº§?**Šã$.v_G»^¸p‚O:.è;tèù“Ž8 ˆ0#P$PUB•Ž\úJ%оQm}*mIŲ+¹:ubÙºv«ôQ·͉YzãÆië¿ÆÇdzK:¨%»J<¢veЂªr,G»R°Dgöÿüç?ì+èWì:BåÒ®hddDs*–]),‘²¿ßZ°«¢SU§|$%99HkaõåsÓDFFSõš6m*æÙmù´ëÛ·oé„ÂKÑ‘¹¹¹#FŒ`m>nܸš>8YS» +K—ÛåËý_-º^ €×èW$ÛÌÌLŠ Äfðõõ¥«­ª¢ Ú¿³]‚¼+ì*#« ))©>Ø•]qËa6`Ö¬Y¬nß~ûmvv¶4MWÕÃMÕ^FI|\Sý‡ BSYÚ§[·nÕÖÖ¦_µnÝZ4¥)#»Š:6++«¦veÅ>zôˆ†=<<†JdEZÍÒÒRja«ÊÃí°+(G·nÝj9Z–[»>þ¼sçÎ,@G_µ4!Q„7k‰y¸©Z»Jv\S€êîîNñ6]{VUç{÷î±EèëëïÞ½»ì*tìœ9sȱÜízóæMšsóæÍyyy$(–³Z´hûŸôÖ­[4 |ä°Îïl‡]ü ovŠŠbÙ€&Mšˆ±SE»–Cøª17UkWÉŽëŸ~ú‰Ù^|µ©2ìŠ:„‹]KJJèlBUe7¾xñâÓ¿wP/\¸pùòåt~M4ÕííŠh×áÇÿ”9´+]i2»Vz YM3bnªÖ®’×5²¶¶®¶ÚŠbWâÛo¿µ´´œ4iª„éCCÃŽ;öîÝ; @Œ]Å4¯pw¶Ã®vŸèÒ¥KM3UMóp÷ÿFǵ•••°/#.™ððpyÎ +W®¤™)‚?¾pä!Chç!e‰æ–ëüÎvd2Õþ«5{ölV·~ýúIó¯–˜‡›ØýQì®àØØXö¿Çu¥lÙ²EþÕúôùùPVˆh®fëÖ­4FUUU´¯ò:¿³vå‘={ö?~’T2»2hËJG–˜‡›¼¼¼Ø{¬BCCÍÍÍ«µ+—ãZÌÓFŠxGËÐj6hЀõ†'¼Ä ¾úê+Ñ9åáÎvØ•/è½W°«¤¤¤ïøi‚ªnºví§’ÝÝÝ“““¹d¸×Uí“Šø4r€§ x·«¼½÷ +v•8K þIX…à?þ`Ù³UÙ•¯'a•Ø®Û¶m£³(éZFnŸ„…]a×Z@L/.rNnn®°~³íÊo/.JlW6^Î{q]a×ZË(w„R"‹•Û®B^¼x±jÕ*ggg{{ûàà`ùéP~ì*æEÉ^hשS'º 2ё±´j_°»Jœ%˜1c†°÷l9Ïе§°÷ìj.¨e`×J©å޳ȮbQ”ì…V–––¤Ö¨¨(úµ@zz:ÇÒª}Áì* ´-„Yezó ìZçve8p€½ùÅßß_vo~Q»rô˜û ­ôõõŒŒ„R­”JK«Ñ ¶`W PÊ·®rbW!ì­…tÊÞZøüùóúi×jQ”à…V6l aMMMj„ˆˆÑC˜cib^°»JÈÈù·¹¼K v•g» +¡+böÆm]»vñõפ¢ØUü#Š¿Ð*%%…~ëââBóL›6­¦¥Á®²†.:Øûaé´(Úa{dØÓ +Ę1cä0»JYNaaá¾}ûúöíÛ°aÃqãÆ]¾|YÊ‹&E±«øG¥|¡m333--­•»ÖOŸ>íر#;|Ö¬YS'Y‚¿ÿþ›‚U– øóÏ?å¿Ñ`Wi ˜*44´E‹tà‡„„¤¦¦JcW––”g»ŠDQ²ZÑééĉ t- Z·nͱ4صöº²`ë2hÐ Ñ'ßkÒ){SaË–-I³ +Ñb°+/\½z5 ÀØØØÓÓ3<<¼¦E±ë'±(JöB«aÆYZZÒx}}}oooáÛ +ª- v­èdgddD«ckkËn‘5tù?f̶ÿŒ=º®ù]ëÊ®Œ>ìÝ»·OŸ>¤ÙñãÇ‹éC±ì*=õü¡e²+ñäÉ“:°CiíÚµ2Í|ø°uë֬ˈ­[·¢1¥¡_¿~Ô’‘‘‘h +”)K0yòd:”cW»wïfÙ€æÍ›ÇÇÇ£¥ÄÛÛ›óرch +”Œýû÷³,½½ý­[·ÄgÆÏl?0>aÂfÝáÇ¿ÿ­Ä/C† ¡¶=pàšå&))©]»vìAž 6ØÛÛ³ŒÁæÍ›Ñ8²€®¨…鼆¦@é¡xuâĉÂ[ïÞ½‹f‘¾¾¾ÔÈ{öìASPO ¤£ÞÂÂÙ™2|øpjçððp4õ„¨¨(:ê¿ùæ4…L1bµó®]»ÐÀ®€GFŽI톦víß¿¿ŠŠJÅ—¬Y³FKKKøÆ +À…Q£FQ;ÿùçŸÅÅÅEEE………ùùù¹¹¹ôí@½²krr²¦¦¦««kII‰päÓ§Outt–-[†¦« +ö1µƒ¨ÕÕÕÕÔÔX—¡ž?ŽF ¾e.\HS…Ä–••yxx´nÝá–(:ew¸qa„ h1ê¡]éÒµiÓ¦/^¼ ¯Û·oWUU­#*4;vìà¢V +kéZÍ@=´ë§ÏÄÒ ~~~™™™ 4˜6mšèÔÂÂÂyóæ‘éâ×ÒÒrÑ¢E¹±Iqqq:uÒÖÖÖÖÖõªÛí’’GGÇjí:vìXìÔ[»–••õîÝ›æi×®Y´\—Yd] ‹+W®P”­©©Â&‘lI­T~||üÑ£GÓÓÓëUÃîÚµK¼Zé¤óøñcìÔ[»ÿý7© b×úOž<¡‘+W®Žñöö¦˜ ëëëÕ7©Š†¯-Z´c×Q£Fa÷ žÛõSïg§ˆ”Fš˜˜Xÿ‹®®.Å«lê† ÔÔÔ(šíß¿DDÅÀõ­m÷îÝ[•Z©e>|ˆÝصR»ž~üˆÀ®ükeeE-cjjJ:’«º=z”]V[[[_½zµ¦v%üüüh˜Ýó j×öíÛS`ÌâÉ÷ïßSÐîææÆoå‡JKüúë¯Ibr»õ³²²¨m©ž¿þú+Ž»ò˜ Xºt)ËtíÚ5--M+ùìÙ³/¿ü’ÝðÛo¿q Eíš™™iddD×þ¢v%µÚÚÚ +bcc£©©ÉcµoܸA7•)ÿÝ×®]£–Ñ××G÷ævå+héÓ§ËÌ;W²UA­Ó§OgY‚¼yó†»]‰-[¶Ð×yóæ‰Ú•¼'jWŠßøµ+»ï"00P!v†o¿ý–jûóÏ?㸰«”ÄÅÅ5nܘZÃÄÄääÉ“ +Qç#GŽ4hЀêLq&…[ÜíJ!z—.]Xˆ.´k‡„™œœ555WWת +œ9sæºuë>|øÀ=Þ¦sÛÕžä„û÷ï³×MÊsÀ®r]Y/[¶Œ©æ믿NMM-'¥ŠÐEn-TŒ¢S___6íر#ËüþûïUe ÊÙ•HHH(g×Ý»wÓWÿ;wî|ÿý÷4VU݆ÎÞ\³~ýúÂÂÂj×eùòå4?ýª®¶òž={Ž?^£Ÿ¸¸¸Pkú+`Wa6€VŸ"«9sæ”Ë0)ÅUàýû÷µP7Q%Ο?ŸìwëÖ­Û·oÓ0ëNV˜%˜6mË 4èíÛ·\ìJ”Ë |ú|G–­­­ªªªø;²˜]óWëX +ƒiÎcÇŽIÜœãD×N‚;{—.]Êno€(ìZS.]ºÄn2119qâG)Õb–NB£ÈStÌáÇY–€ôxýúuY×MÔ®BÇnØ°¡RÇæçç >Ã=“ÀË9.00pÕªUÛõîÝ»ô+ˆÀ®5Ê„††²Kã.]ºˆfäß®jiiQxYnü“'O:tèÀ²k×®•é ¥í*Ʊ—/_¦ImÚ´áý,à ìZTTDíLïÞ½ƒ+ìÊ…ììì~ýú±lÀìÙ³ÅÜPíq]ÕÃMå~(ú• gddxyy±› „·ÔRMèjÔÞÞžbiaÇ&ù!C†ÐÔˆˆˆŠõùøñãÔ©SY–ÀÇǧÒ,LíÊ +‚7 +»~ýzöœ‚bÙ•`w¾]¼x®°kµPŲÆÆÆÕþaÁŽëÄÿá¿ÞbnªÖ®tØΛ7„L&Þ5eÊv]O¦%c—³Jnn®»»{µ}’xŒŒè·ßÊè8ñv-çX–(–…]é 2nÜ8–.ÖÓÓóôôLNN®hTÉìêëëK?ܳg\`WñÙ€+VP¸H«Ü¹sg.ÝÍUúʺuëØT17Uk×ÿýïì+iMÊÊÊ¢ˆtúôéb¬òÓO?1ÛW[ó'OžPehfÖ3‰< l7ÉìZÕ9îéÓ§3fÌ8{öl||< œÝÌ—]è‡tŽ€+ì* »V5UÌÃMÕÚU˜NŠŽŽ¦íÛ·‹Yz£F¬­­¹¬,ÅoòfW‰{-Ž¥¤¤„&999ñeWÖ«ØÒ¥Ká +»Ê"3PÕT17Uk׊“"##i`ÇŽb–neeÕ­[·j×ñСCr•øÏþC_ÃÃÃe‘øôùÎàرcY?•U2»J™Ó°+þÕ’ì¸óp…OôCö˜Oll,û‹J¼]~ü8eÊyûWKÊëkñ[aõêÕìÛøøøôôt~í:iÒ$úáúõëá +»rÏHG–˜‡›Xï…AAA´gggssójíJUêرcÆ )º¾xñ"700(·tÑ8+"·wd±ëëYØÕÐÐd.üJs:::òeWÖŸï=1ØUé¹té’°oÉž&¨êá¦k×®ÑxŠlÝÝÝ“““¹d>}~¿W¯^äüf͚Ѧ©¸t1Š8|ø0ËÈáÓ¿ýöÍ0qâDYØÕÊÊŠÚŸM-@ẞžž––»]Mz»vëÖ~xúôi¸À®5%++«oß¾U= «pyV¦v­öIØóçϳ›Ðda× .899‘`]\\:tðàA ‹¢¢")íZZZª¯¯O?D?„v•8KPU/.òÇ^\ddWŽ½¸¼{÷ŽäO!¥bõ7•˜˜ÈÞeQØU„=ššš*_„¼SÓÙß|g*Ð.A+Hu2dŽ»J ]*JïÙÖ¨÷ì:‡ÝÚ4nÜ8Ú:wìÊ¢o~éÖ­›Ò¼ù¥ÎIHH  +ëéé(ÄžÀºû¦ +çååḰ+_ÄÄÄ(Ù[ å–^±b…BÔvôèÑTÛ1cÆàp°+ïYÑ7n—””ÈC6@â7nËìeßFFFòß¡_bb"mwº4xòä Ž»Ê"K°dÉö˜U÷îÝëöM¦))):u¢š¨««¯ZµJ!²éÑ£ûŸHžë_PPжm[ªçO?ý„£À®²ãâÅ‹–––ÔJfffuuWydd$Ë4mÚôÊ•+ŠÛ˜ÿüó¡¡!­È²eË䳆¤}v³™ƒƒ:Í°«¬yùò%{[4]-.X° 6³EEE3gÎdÙooo…ËTäèÑ£lu~þùgyÈ·ˆ’››;`Àª›®®îýû÷±çصv²ÁÁÁ,K@—·µ°ÐçÏŸ³›‚ÔÕÕW®\© Ù€Š„‡‡khh°‡§H¶Ô¶u^¥¤¤¤uëÖYXX°Ìp\\öy»Ö&.\``£FÎœ9#Óe?~ÜØؘeÄ¿‰@‰gÏn0š5kFWâöukg†‹‹‹|Þ†`W¥'33ÓÝÝe -Z$‹kÛâââÙ³g³Ëç~ýúegg+eKmÞ¼™‚sjÉ:ïÙ›®Jzöì¡4vUÐ,Á¯¿þʲtH¾xñ‚ßl@—.]X6 44´žì?Nª;„ïáv•Ο?/Ìœ={–¯ÍabbÂzŸ¾téصÞf z÷îÍ®+ƒ‚‚¤É²lmŽ¬¬,4/°k}†ŒúË/¿°,™V²,Ajjê×_M%‚åË—#õì +çÎcïv¡O®ÑoOž<ɲ7Æ@À® µöêÕ‹e ~ýõW.÷pÏ;—ýcÞ·o_d€]AUY‚   fKww÷ÌÌL13§¥¥uíÚ•e–.]*wÔ`WyæÌ™35¢Vµ°°¨ª+þS§N™šš²7§ÄÆƢр]222zöìɲ‹/K‹‹‹çÍ›Çâ[///¼ØÔ4K°páBfQ—/_ÒÈôôôîÝ»³l@HH²À®@2NŸ>mffF-lll¼uëV###¶´´Œ‰‰Aã»i x•uÍðôôdq,vÒg X×È»™7oµsHHšØÀ®ØvÀ®°+v°+v…]°+ì +€]ŒìÚ¿•ëׯ—¿fÍ--­¤¤$4°+À®ÉÉÉššš®®®¢oyúô©ŽŽÎ²eËÐnÀ®@âÌÀÂ… iÒºuëØײ²2Ö­[¡Ý€]ÄvÍÏÏoÚ´©{'×öíÛUUU+æ +°+¨‘]‰ƒÒT??¿ÌÌÌ L›6Mtjaa!ýœ ¬¦¦fii¹hÑ¢ââb6)..®S§NÚÚÚÀÚÚúþýûhj`WØUHYY{sw»víÈ¢¹¹¹¢SɺW®\¡(7::ZSSSXÉ–ÔJ1>>þèÑ£éééhj`WØU”¿ÿþ›âOš‡¶ˆèø'OžÐÈ•+W +Çx{{;::²a}}}###HØv3OóæÍižr#)"¥‘&&&Öÿ¢««Kñ*›ºaÃ555Šfû÷ïA10šØvåbד'OÒÈÕ«W'‰ðøñcá )))4ÕÅÅ…f+—°À®°kUv}ýúµ††ÆàÁƒÅ—ÿñãG333---45°+ìÊŮĒ%Khüèѣϟ?ïÞ½S§N Ó°ãÆ;qâDBB®]»AëÖ­ÑÔÀ®°+G»–••íرÃÕÕ•‚X555kkë±cDzIÆ ³´´TQQÑ××÷ööÆ“³À®°+v°+v…]°+ì +Pn»‚Úvv°+ ¾±iÓ&2Õ„ лì +°+Ø`W€]À®»ì +vØ`W°+À®»€]vEçáÇjjjÜ_­ràÀ4paĈÕêââRZZŠ~Ã×ýû÷£¹€ßðÕÙÙ+ÔˆÄÄÄjÃW® ~~~\ –Ã×}ûö¡‰€ßð+È"|Eà +R2|øðrjmÕªW’” _¸ïá+Wà1|UQQavÝ»w/øÂÍÍÔÚ A®À#‹-"»º»»£)õœwïÞ͘1£wïÞ7^×˦¦¦]ºt™8qbFF6@øøñãìÙ³Áò 9Ÿ›““ƒM’““É]ªªªC† ‰ˆˆ 1eeeòSô´´cÇŽMš4ICCƒêiff‡ gRSSIY¶¶¶‰‰‰r^Û—/_~ùå—ìDpâÄ l>€|òîÝ;'''’UÏž=óóó¢Î¥¥¥£G¦:=zô ‡ 4ˆ4Õ¦M›¼¼<ªvYYÙСC©æ-Z´(..ÆvÈÑÑÑ,ÌÌÌT¸Êøð¡yóæTÿÐÐPlJ€\]_SÈJvZ±b…‚®ÂéÓ§ÙÙ!;; '³iÓ¦ï¾ûÎÄĤ*»ÆÅÅÅÄÄ?~|Ù²eM›6¥13gΔ¸¹¹¹$j …þ{ ŽÔÕÕi@Ê¢nÞ¼IjmÛ¶mÅnU„7ùW´«èloÞ¼iÙ²%ŒŠŠ’¸¬“„k×®aãꤤ$r‘ôE5ŠŠ:wyÄÛ•8yò$ìׯŸÄÕðññ¡8€ ¨C®_¿N.rss“¾(mmí’’iìZTT¤¥¥ejj*q5üýý©Ø-[¶`ãêö¬‡‡‡ôE ‚fÍš‰Ÿ§Z»¶¶¶***WcÖ¬Yx$Pç°§´ $}Qªªªå2 ‰ÿÂÝ®,–¸‹/Æ[eŠ]-,,444>~ü(ÃúdpÏ hjj:;;#v(4,ïÊË ¢ƒ¦¢Ž;Æ1P©]™íg̘!q5wÈ?æëžsçÎQQYYY’Ù5''§M›6ººº)))W÷ äïw%‚‚‚Èl–––Ë—/?sæÌùóçÃÂÂLLLÄØ5î34óêÕ«mmmµµµ?.Mp¿+@NàñY-âìÙ³=š››«~ÆÔÔ´k×®UÙ•!(~ XZš¥ãY-€üÀo?u ë„ý äô‘²ý»€ŒÀ» @à½Z ðNXì!)²Sff¦ÂUžBnGGG< O D‚¢ 6//Oª]VV6dȪ¹“““°›nÞ½{G‚"MõìÙ3??_!ê\ZZÊúŠ144|øð!6"@>IMM566&YÙØØ» ”[^¾|ùå—_RmUUUOœ8Íg’““Ù£ú¤¬ÁƒGDDкú–Ÿ¦¥¥;vlÒ¤ITO33³ØØXl8€üóñãÇÙ³g ‚/䕉'V|I"È3ïÞ½ûùçŸ{÷îݸqc¹’ª©©i—.]È«ØLðÈÿuÞendstream +endobj +4994 0 obj << +/Type /XObject +/Subtype /Image +/Width 468 +/Height 385 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 16157 +/Filter /FlateDecode +>> +stream +xÚíwXWû¿³ J‘nG,`‹±S$ +*¶¨1–€„‰EÞD”X°¼öã+ö. +*ѨHT4€ŠŠQAì"‚”…üžËs}÷ÚeØÝawùÜpMãÌ™33÷<óìÌ™ÿU=Þ¿äææfmm->Q´´´zöì9mÚ´‡þ ê‚H$ + iØ°á'J‹‹Ë­[·°ËªÎÓ§O{õêÅÌæáá±ÿþ»wï–––*O srrâââÂÃÃutt¨’GÅŽ¨./_¾´°° ¡5kÖ,))IÉkûæÍŠ{©¶`ûöíØ}U¤°°°G¤2ggç·oߪJµƒ‚‚X8!!; røùù‘Ĭ­­_¼x¡Z5 šRÜŽýP!’““…B!E*Wy‘HÔ­[7ÒïŒ3°+*KœÎœ9SEëýúuºv4lØ0=={ œ?žÄkllüúõkÕÝŠÉ“'ÓV|ýõ×Ø¡•ÀÇLJ¬¬Ò[A/{䬠 û ä|øð¡qãÆd­Û·o«ú¶°ç4öìÙƒÝ +PrŽ=Êž+SƒmY³f m‹··7v+@É &_Í›7O.¥%$$Œ7ÎÂÂBã#M›6íÕ«×·ß~Ëæ¶iÓ†Ö%9Ì %[´hAÎŒ•eí÷îÝ£ÒÌÍͱ[JŽ««+ùêðáÃr ;ÍòåËO}dãÆ'N411©Ê½ñññqqqÑÑÑááá–––4eÖ¬Yµ®@YY™‘‘’••…= Pf IVOž<‘±œÄÄDoçÎsssËÍ*))©Ê½’‹½~ýº}ûö41&&FÆKÉ‘#G°gJË»wïÈTzzz²õÕW_QQýõ—”e¤»—8qâM2dH­«ñÝwßQ cç”–ÌÌL2UË–-e/ÊÚÚZGGG$ÉâÞââbmmí¦M›Öºóçϧbùåì\€ÒríÚ52•£££ìEijjÚÙÙI_¦Z÷666 ÖÕˆˆˆ b±sJK||<™ªwïÞ²% +mmm%§dggßþ?¸»—Åϵ®Æo¿ýFÅúøø`çêCÜÛ¼yó† ‰§Lš4Iü÷œƒ–––ƒƒC­«±bÅ +Ľ%GŽùÞ‘#GRQ?!Q•o+uoll¬Œ]ú„„„ ß PräøœÃ_ýEEµjÕª\÷¿ÜÝ›››Û©S'ª ]j] <çP~ÊÊÊ äò|/Ê^+ûõ×_O:uæÌ™ÈÈH)îÿ-acc£££-Kð|/@%ã{mÄéÓ§½½½›5k&üHÓ¦MûôéT•{ššš¶¶¶þþþ÷ïß—ñRÂÞk“Ë¥ÇܹsåØŸCÝ‚þªú1þQ¿þ{wïÞÝ +P~ðÝ +àöv¾×<þS,Kß¹u˵k×ðb€Ê‘œœLîÒÒÒÊÈÈP¹Ê‹D¢nݺѵcƌؕÕÂÏÏôemm]îÅ4å' €jnhhøòåKìG€jQXXÈžpvv~ûö­ªT;((ˆêL{BBv"@¡¸Ñ‚TÖ¬Y³¤¤$%¯í›7oXšZ lß¾» º<}ú´W¯^Lhû÷ï¿wï^YY™òÔ0'''...<<\WW—=TV±ó4P9D"Ñüùó6lø‰ÒCqï­[·°ËjÃû÷‚ÜÜܬ­­)VßjiiõìÙsÚ´i>Än)9r„´9lØ04ðFTT¹×ËË M<»×ÓÓM¼Ázª„{€OŽ;Fî:t(šà^Pc¢££É½C† ASÏîýüóÏÑÀ111p/ðÌñãÇɽh +€{@9qâ¹wðàÁh +àÙ½îîîeee¥‰D%¡´ÈÈëׯŒŒ4555>" +©ª_²ˆˆ4ÈNpp0Ç!MMMóóóÑb ;/_¾400àâÞeË–¡¹@^Ì›7¯Zñ6mÚôýû÷h+¯^½ª6ô]²d  +äËüùó¥ˆ×ÄÄ$//­òåõë׆††U¹7<<MŠ $$¤Rñ6iÒäÝ»whà3ô]´hÇ‚ ʉ×ØØ877-ŠãÍ›77–tïÂ… Ñ, hBCCÅâ522zûö-Úx}õõõ™{þùg4ðÃÔ©SI¼šššäa´ðë;ÝÊÊ +MàOø?‚ƒƒqF÷¸5v¯@ @;ÔsÂÂÂà^à^À3‹-‚{€{Ü Ü à^Ü à^à^÷à^÷÷¸÷¸¸À½À½îES÷*Iû´iÓ¦ÒYcÇŽUžªJÖ§¦uƒ{€{•Š   åË—W:‹œL­§«çää$îkw„ ÕÖçöíÛÝ»w§Y]»v½zõ*Ü €Šº×ßßßÀÀ€”ÂDDž)çÞN:EDD$&&FFFÒèÔ©S“““ÙÑvìØÁѽTÈòåˇNÃäÉY Ø´iÓܹsi¸OŸ>ݺuÛºu+ƒFW®\I‹eddÌœ9óôéÓ)))t  éÆ «¶pŽî>}ºäæÓ5¥\Í]=úwkkk&Õ¬¬¬jëÓ®]»¥K—>>W¯^tOÁžp k%{È î@Ý+I~~>y㧟~’ceú¶BU…R¤,>wDݾ¡ ÷ ´î¥uûöí™™™"‘ˆ"®±cÇR„–˜˜¨êî½]iiip/ ÎÝ›’’bff& ­­­÷ïß/ßÊôíÛWqѦB WõêÁ½(sΡ¬¬,''çÎ;ÙÙÙR~¸*Ü €2»À½¸À½À½îÀ½îîp/îp/p/€{€{Ü €{Ü €Zº¸¸À½õ&..Ž´Ó¯_?4ðûÜ |¾¿Ü¿4À½ Æœ9s†Ü;`À4À½ Æüõ×_äÞ¢)€g÷4M¼qúôi¸xæÔ©Sä^4À½ ÆüùçŸä^WWW4À½ ÆÄÆÆ’{ÝÜÜРÊÊÊJ>"‰J?BSNž¢©©¹lÙ24ÈNHHÇŽÄ›6mš——‡Ùyýúµ÷.Y²ÍòbÞ¼y\‚Þ÷ïߣ­@^¼zõªQ£FÒÝ»téR4È—¹sçJ¯©©)‚^;/^¼úâñPsæÌAÐ <óüùs}}ýŠî]¾|9ÇO?ýTN¼fffùùùhPÏž=ÓÓÓ“toDDšͬY³ÄâmÖ¬‚^àœœ---æÞ+V A€† Fâ% 5€þ÷¿ÿ‘{ÐÀä^ ôZÜë¦NîÝ·oŸ¡¡!mŽ½½}rr2?§íĉY~ýõ×2æ˜{6lxûöm¸—g÷êëë+.·°k×.77·&Mšøûû'$$püG¹¸7((ˆËG·Ù±'K Ü ”2‹ãz9–À’õá^7õpoaaáwß}ǶeôèÑ +Ê3TÅ–-[Xþ¡cÇŽå´Y‹=¨©©Ù·o_º3…{Uݽ/^œ6mš±±ñàÁƒ÷ìÙSUnA¡î•]•r/PöuÕ‰{ÃÂÂÆ÷Jrÿþ}'''ÖäÚµkë¤)))mÛ¶e§ðöíÛe9¢Èxô—|÷ª¨{Ÿœ†-ZT®2ôïÖÖÖLªYYYÕÖ§Ò–T÷Ò5ËÙÙ™åÖ¬Y£Tu»~ý:k:wîÜY»›šñãÇÓð©S§Ê„t¥xƒu8üîÝ;:ݨàÞ:q/ƒ¿þú+e´w¨Å(Ü’oŤ»÷øñã4—E×üæ›oh”nitÒ¤IžžžUE­â>QI›åŒAq;]»v-=z”c /^¼ /00°âÁ,eG÷J/ Ÿ={–†)^e}ò°§´´”þñ‡~(W²H$b_“,áÈ‘#,<¦iݺµ”Ó“K}*mI5p/]M7nLÕ¦Û +É÷€”r#“'1mÚ4ŽäÌÉÉ¡m¤ë)ý¯äÁÏnôÄÿB×bºúÀ½|º—b˜½{÷zxxÓmì… $åͽìÊKSÁ­[·è¾˜n…H8¦¦¦Vå^qm¥d)i£h”=fÀ¥„ØØXìiŠË,Žî•^B¹ÒÊ%èèì»÷Æt`S=ºâFIžSÔžRNÏÕG²%UÚ½EEEíÓÕyäÈ‘t‘RæÚþöÛo,ÿ@·3wïÞ­‘{Ù¿Ó(»o't,Iº×ÊÊ +îåͽ—/_¦ð²I“&®®®tG#¯ÜBíÜKôêÕkРA¿ÿþ;ÅÞ4:þüæÍ›S%é¿Ä?ðI‘ŒcP8M£«W¯æX±cÇh@ò-{.³8ºWz ÝA³‚‚‚RRRè†EÊF±¬¯”Ó³Fõ‘lIÕuuëÆž€­t[”k×®Ñý Õ¹Q£F»víª‘{)€éÝ»7Å6’Ç µ€8ç››KhŠv8^È¥/_¾”£{½¼¼ÌÌÌ$£>º·¢ \ŒFÙÏ@Jøœ?÷fgg/]º´}ûö­Zµ + {ôè?Oµî7ož¶¶öÀCBBþýøH-?|øð.]ºTÚbÜÝK>§Ñ¿ÿþ›c ©©©40gÎ6" öÔ¥ôYÝ+½Žî544lÙ²¥äbâÄ‚d t‚…ÂO?ý´b}؃Lt´×¨>’-©¢î=tèË3PÔÇRÜ倊ð“Ž<¯)&§„õufdd4f̺ÂÒ½á¸qãX•üüü¤<äY1¸yóf9÷R¸Åž£¸zõ*ëÖ’ã+uìºO—.æèÞ+VÐb’?)²¬#9Jr1:È.\ø¯R>ç/Ž………ûöí#SƒÓ飠ÜB­Ý{úôiv\±/½ŠD"ª*2×½ì÷ýÇÓìß¿?Û^.%Ð’Ý»w§µÓ-ö¹sçh:ëMEú,Žî•^G÷¶hÑ‚¤ºnݺÇ{{{Óî¦ËYE\B\\St7-N›ÎÎÎ$m6ìææF³¢¢¢ž={Vm}*mI•soQQµË3Œ1¢bžml|dì1²ç5Å!äƤ¤¤ääd¦é“°Y7n¤}MS:wî|ïÞ=îŠ(—s`E±Gelmm¹?cÆÜË S±R Ìѽ´™´˜¸t€±\M¤›6133“=À#/Uʸ8ºwÓ¦M4ÅÅÅeÇŽuÕ]Rµî-(( {@{{{ñ©Í~eì–§Fî¥}Ç~—§[ñ JKxøð!í*ØÙÙQ9Îââ^é%ptïÙ³g)p¥³¦cÇŽ$»R°Ú¼ys’¤8x#ÉPœPU"—Îk¥(”­¶>•¶¤j¹7##ƒ.1,Ï°jÕªJ/uû‚¡”µ[XXÐÞÒU•.‚L}{öìṞ’î­ÖÀÝKE_|ñ½}û6ý{ÁP,d:P醅–T-÷Òµ›ç·#ká^U§ªnIYJr +ó°ùʹkèî€îÜYž¡b{Jî^ŠÏ)Ð¥ÐTr"…âd*Öæþþþ5}ÉT¾îeÐí…è¯^½ª…{ OOO +Ø5qÅŠ¤âœœŠè…-0vìXº«*‚âÿ9ÿZä{á^q» +ÒÒÒàÞ:Ì3²<ÃðáÃ_¿~-KÓUõ"Xµ·`µ>¯éFfÔ¨Q4—%”ʱaÖèÒ¥KUùÞÜ[©¹»—Ëžâpuu=z4 3©@j„ÒÒRj%q›+Ãsþp/(Gß¾}yŽ´•Ö½tB±<ÃÊ•+«ýC&I"Öµ”ÁªuoíÎë¼¼<KKË .HÉ”²üµwïÞ:w¯ØÀóçÏ'swobb"-¹iÓ&2í/–+[°`ûm7))‰Ä/oÖùsþp/P¶”‹òÔ'**Šå¬­­9þ@Sésâ—ݤ¼V­{kw^³7«íÐ,77w̘1Êü5.î‰Ddìñãdz‡Ÿ>}úïÿ=Oò믿ҵIò`«ÛçüUѽ&Lø¨#B‰Ú¸·ª¹R^«Ö½µ;¯ÍÌ̬¬¬ª­6¹wìرªî^bèСæææß~û-]æÄiCCÃîÝ»4Èßß_Š{¥4¾x–Ÿó‡{ò ä9‡+VpÌ9T5WÊ‹`ÜOÿ×-Z´÷(UâgT=ç@,[¶Lœ1O5j”@  =(™ñ®óçü‘sÈ9HGŽ¿µIyŒ½¨Âž‚>þ<ûáL¾çu¥¨ÓomÄ?ÿüà +‘ÌooÞ¼™¦…BÉç±ëü9¸WŽìÞ½;:: +U3÷2ÄϘY[[×ú3)/‚¹»»³ï£-Y²ÄÁÁ¡Y³fÕº—Ëy-åÝ+õ{ÆŒe¨ÚS¬?CÆ£G¨„ž={–;Øêü9¸WŽêP•ï©Á½µË?ÈþnEU/‚‘Ïi:EÅ...ééé\r\Î몎IɾÄ?âס{e·B=À»rw¯²}O î­uþAú;Å*Á¦M›ª}§˜7÷Êëb5v¯øâíÛ·+í;Åp¯JÃœ¦üõ”Ò—Ž’ý/Ü+ß¾tÔؽÿªB_:p/ÜËåúäùD¨âoXpéCR¡(¢Iõv¯˜ììì%K–(a’Êã^)/{ÖîCiñññ½zõÒÑÑÑÔÔ´²²ºqãÇÒªýpÜ[ëüƒ¸ïtooo5ë;]y€{+EÙúNW÷JyÙ³vJ377§s‡¶þ+***++‹ciÕ~¸ î••øfЄ ØÕŸ.ÓŠ>Iá^~ÜËøðáÞ={êü›AÊã^î/qsÿPÝ'Ò9.Vn¥TZZ>Ü÷ÖµüV&Ü«îS·ßÊT÷Vû²g->”¶nÝ:¦³ÛËËëСC’W7Ž¥IùpÜ+#………êôx¸WµÜ+&!!ÿoÄ+{¥¿ìYë¥effÒÿvìØ‘–™1cFMKƒ{Íþýû iìììë6Ïðå—_²kÊåà^ËùðáÃîÝ»ÝÝÝIÂ~~~ìëíõÁ½Ò_ö”ñCiEEE¦¦¦ÚÚÚ5* îå‡û÷ï;99±üÃÚµkë¤tfo(Ó)¼}ûvU×Ü+ Ož< §Ÿ 2X]Ý+ýeÏÚ}(Í××÷øñã7oÞܱc‡¦¦&ÝEr, îå?ÿÀ>UCŒ=šçüÖ-[Ø…žîªí:îU{÷Š¹xñâ´iÓHJƒÞ³gOMíV¡ç¤¼ìY»¥3ÆÜÜœ¦7jÔÈÓÓSü%‹jKƒ{ë„}ûö±üƒ½½}RR?§íĉÙñóõ×_×Õ Pp¯rº—QPP°k×.77·&Mšøûûsÿl¨Ú÷cVÏ_ÁP'÷t}ìÚµ+Ë?ЉB×uãÆvíÚ±Ó–ã‡ÚáÞzè^1?^´hxtØ,Y²DúTp/Ü«Šù‡o¿ý–Å¢t碠—Yþøã–gpppHMMU³£‚¹·^Á[?feee.\ðõõ566öððØ»woU¹µwo]}( îU(tH³„¿½½}rr²|äI“&±vÊ”)j“g€{ynä‚‚‚;v¸ººš˜˜P´P±—Tô÷ª(÷îÝëÒ¥ m¶¶ö† äRæÍ›7Û·oOeêééI>ÐäB¿~ý¨mÏ;W¯¶úÑ£Gaaa­Zµ233“|O“¹¨7êzTÓÝœ¿¿?ÛƱcÇʘغu+)—ŠêСí[· J¹3`ÀjÞ3gÎÔÏÍÿû￳³³á^¸WmسgË?PhqõêÕZ”ŸŸÏ¾yAЀZæ”AƒQ Ÿ>}M€Úä:wîÌò’Ÿ®à…¸è²<Ãÿþ÷?4¦âpuu¥v>uêšuÊ?øùù±ØuܸqïÞ½ãò_Û¶mcy†öíÛß¼yͨPÜÜܨ©cccѨ»víjÔ¨{ üÚµkÒó S¦La®ž4iÒû÷ïÑzŠfðàÁÔÚ'Nœ@S ~ܽ{·S§N¬{ÏM›6UºLjjªƒƒ-£««ûÇ ÑøOU ÞL›6Å´ãÇÏËË“œÉò íÚµ¬ðÀ!C¨Ù£££Ñ¨1;wîÔ××g}n\¿~å¾þúkæä‰'"ÏÀ3žžžÔòGES ÞܹsÇÑÑ‘õÿ°~ýz[[[–gزe ‡† &þˆ @íó>>>âGÛ¶m‹-@=t/Ýö’( XôE1›P(¬˜…5â·ß~ã"^ŠŠký™u€J»—8pà{9''ÇÈÈhÆŒ’s ƒƒƒÉÏtãlnn¾`Áq~2>>¾W¯^t׬©©iee…‡‡ÅÐ]ƒMµîýæ›oÐVÔ[÷–••±ž½»téBŽ-÷09¹yóæ—.]¢966–BµE‹±Y¤boLLLJJJTTTµ_§­WlÙ²Eºx6l˜™™‰† Þº÷ߨSìZ±£­ÐÄeË–‰§xzz¶nÝš 7jÔ¨qãÆPn¥Ðݽ½½÷úøø •¨çî%Ú´iSñKÍÒD«ÿCOOb]6wݺu {yy:tˆâg´¶$Û¶m«J¼t¥KOOG÷VêÞ'NÐĈˆˆ4 îß¿/^€îšinÇŽi±r‰b ‰X«VdòäÉhàÞªÜûêÕ«† Ž9Rúÿ™ššjkk£µË±sçΊ⥛…{÷î¡q€{«r/Æ>-tæÌ™ëׯŸ¬ÏœðððÒÒRñ¬âââÙ³g³O :ùà^ Nœ8Áž(³°°ˆ¯t™èèè&MšÐ2–––/^D£÷Yò ÁÁÁ,Ï0xðàçÏŸKY833³W¯^,ÿ°lÙ2ä€{Aíò }ûöey†Å‹K檢¸¸xÖ¬Y,ÿàééùêÕ+4#p/àÎÉ“'Yž¡E‹qqq5úߣGÓÿZYY]ºt Ü ªE$Í›7åÜÝÝ¥ç¤äzöìÉòÈ?÷)deeõë×u‡Æ%Ï %ÿ0sæL–ðòòzýú5š¸TäÏ?ÿ455¥¶577?wîœ\ÊŒŠŠçÐÈÀ½@2Ï0þ|–gpss{öì™ øða=ØGäW¬Xüp/ ²³³û÷ïÏò .”%ÏPEEE,ÿ@;ùàÞzΩS§ÌĮ̀=›7o~öìY…®ëÈ‘#FFF´.kkëË—/ËXû&Thhh¹é4‘faÏ÷*mžaÁ‚,Ïàââ’““ÃÃJ322ºwïÎò«V­’%ÿÀÜKåܾ}[iÝK=a„Î;7hÐà¥îAè +Hû}Ö¬Yoß¾Åéà^~xúôé€Xžá—_~QDžAJþaÆŒ,ÿ0bĈ7oÞÈâ^MM;}ûJ:\yÜKq¾Á'Jþþþ>|Àyà^…rúôiqžáÌ™3uµ7nLu°±±¹råJ­Ý;wî\ú»eË¥r¯äõ…šzÆ ´Jõ–]mïÝ»wèÐ!:ؽOëÖ­¯]»†³À½ +Ê3„††RœC 8hÐ ~ò UñàÁöñ‹† ®^½º¦ùæÞüü|²·±±±ørîݸq£é…þÒ0?Z£xž½W²iÓ&å?*îÞ½Û®];ª°¾¾~RRN÷Ê=Ï0pà@vùŸÿü‡<\çU¢øpúôé,>ôöö®Qþ¹÷߯?ÓÀ—_~Yѽ‘‘‘4:uêÔäädúKÃ;vìPôFÑÑŠtttdÿ=‘7JJJØõ‚n…>|ˆ“À½ò⯿þjÖ¬µý¥a¥ªÛÁƒYþÁÖÖöŸþ©©{‰ñãÇÓð©S§Ê¹·k×®|æååÑð»wï455º-{÷î¥ +hiiÕ´ e¸Ò­UžÏü?€{Õ:~þùg–g ¸—¢_%¬dzz:Y‘Yë¿ÿýoMÝ›““Cö¶³³+((t/‰×ÆÆFü/ÖÖÖT¾â¶‚$oaaAà'¹!wÞ¾}Ë:aÞ¼y3N÷ÊIÉÅÅ…šK(†††*Cž¡* + ¿ÿþ{öËûÈ‘#«}ðIÒ½Äo¿ýF£ÁÁÁ’î%ÓJº×ÊÊJ¡îekïÞ½»êÆ{öì¡MhÔ¨Qnn.N÷ÖŽ3gÎ4oÞœýÔ~úôi•¨óØ÷7)ˆMLLäî^Ò]ïÞ½555%ÝÛ­[7qÎdBÁ¿““ÇšüðÃ6l ;qŽËøðÒ«­ü°@ׯ_3À½µÈ3üòË/,Ï0`À€ìììrʪ÷D«,Ž;– OŸ>½]»vzzz´v##£1cÆdeeÑôû÷ï“!YþaíÚµÝKܼy³œ{wîÜI£>>>W¯^]pÓÓÓ+úVF÷ÒõŽ½ë“ À½Uå-ZÄ~Üïׯ{N€Ë©]Ž5kÖ°¹R^«Ö½üñ%3°Y/^¼ h600PŠXØ3½åú¬”´´´.]ºÐÂÚÚÚÊÙ!؆ äåÞª.Ž3gÎ<}útJJÊÂ… iÉaÆÉݽ‰ +áçX÷ª¢{)Öª…{«š+åE°jÝ+î G<‹‚pغu«”µ›™™QôÈec•ß½ûöí“—{«º8J"‰hVÛ¶má^Ú)T©g€{«âܹsâœC¥Ï6pw¯”ÁªuoÅYÇŽ£mÛ¶IY{‹-úöí[í6’Ö”9çÀ>pà€¢sÿ~LÆ.^¼xêÔ©£G®Ê·²»—ݼˆÀ½•"¯ßÚ¤¼Fñýcqq1 Ÿ?žýp&ݽ©©©40gÎ6ýîÝ»ººº5ý!©°°ð»ï¾SòßÚ|||h"yXÑ ¹AAA)))t›£8÷²§ûjݳ=€{ëUþAög̤¼æîîξ¶dÉÖ+št÷–••uïÞÝØØøÂ… œÓt»J®Qò©ÔŠ¨Ê3f´4+<<\Ñî%%¶lÙR<*ù`›ÝKWX@ ©©‰J¸—#gÏž÷áÀúT¬é-mU/‚]¾|™¦STìââB·¢\rÿ~ü@üÀé,¶³³‹‰‰©¸v)–Ø·oŸª¼[±råJZÀÏÏOÑîmÑ¢íº ÑYàíí­¯¯¯­­ÍžÍ“£{ÓÒÒ¨ZN(÷rG²ï² (sße\ò U½Ş{«}§øï¿ÿ¦Åí^º¶¶mÛ–ölÇŽmffFmؼysºÇ¬“::tˆ…ˆ666¬‡Iõ€î&X¾´iÓ¦™™™*Tó~øª­¯¯ÏOwî­Ÿdgg0€å~ùå>ótc;cÆ –g1b„úõPPPгgOý=zTù+üòåË¡C‡R…555?Ž³À½ŠÎ?,X°@(Rcºººò“ÈÈÈèÞ½;Ë3¬ZµJ]Ÿbzýú5K­Ó%fРA111Jøt5þµk×f͚Ũ¦Ûj;Áp/Ü+/N:%Î?œ={V¡ë:r䈑‘­ËÚÚúòåËêÝ°d¶¹sçŠ?“ÄÂ`{e‚Ýz0<<<ž={†ÓÀ½<çú÷ïÏò .TDþ¡¨¨(00ì´ãÄ_aP{òòò(¼ïÕ«—¤„•Út3fŒÊý,à^uÊ?ÌŸ?ŸåÜÜÜä=|ø°G,Ï°bÅŠzû¶Tzzzš2×ÖÜ«$üù矦¦¦Ô¶æææçΓK™QQQt¯Íò hdà^P‘¬¬¬~ýú±üCXX˜,ù‡âââü‘å¼¼¼êOž¸Ô.ÿ0oÞ<–pwwþüyíò ì9« DDDàö¸páäÉ“M›6e/ˆ‹‹«Ñÿ=z”嬬¬.]º„ÆîÜyòäIß¾}Ù#÷‹/æ’(..ž5kË3xzz¾zõ +ÍÜ jJIIIpp0Ë? 7oÞl``@Ã-[¶¼pá¸(ŽÇöÙgân† ‚<p/à’’Ö$‰yà^À³fÍ¢½°|ùr4p/€{p/Ü €{Ü €{á^Ü à^Ü ÷à^Àѽ^^^àÊ•+妯ZµJ[[;-- MÜ äîÞôôt---'''‘H$ž˜‘‘¡««ŽvîŠp/B³Ö¬YÃFËÊÊ\]]‹‹‹ÑnÀ½@AîÍÏÏ·´´400xúô)nݺU(VÌBà^ G÷ ¹ãÇÏÉÉ122š1c†äÜÂÂÂàà`ò³†††¹¹ù‚ JJJجøøø^½zéèèhjjZYYݸqM Ü 8º·¬¬lРA´@—.]ȱyyy’sÉÉÍ›7¿téEȱ±±ZZZ‹-b³HÅ$Þ˜˜˜”””¨¨¨¬¬,45p/àè^âÖ­[»Ò2$RÉé< ‰Ë–-Oñôôlݺ5nÔ¨QãÆ¡\à^P;÷mÚ´¡eÊM¤h–&š˜˜Xýzzzë²¹ëÖ­ÓÐРHØËËëСC蠸Ȏ'Nœ ‰iÜ¿_¼@ff&Ííر#-V.Q €{áÞÚ¹÷Õ«W 69r¤ôò‹ŠŠLMMµµµÑÔÀ½@v÷aaa4}Ò¤IgÎœ¹~ýúÉ“'Åé___ßãÇß¼ysÇŽšššŽŽŽhjà^ ÷–••mÛ¶ÍÉɉ` ++«©S§²YcÆŒ1775òôôÄ;ÈÀ½@’™3g¢/à^÷à^¸ –î6lšîðì^  À½À½îIÖ®]K¦ +@SÜ p/¸à^p/À½*uïwß}‡¦¸à^p/À½à^€{À½÷Ü îUçÖ­[B¡ûgw>ŒFÙ;v,Gñvîܹ¬¬ -²sóæMŽ¡ï¡C‡Ð\Àgè‹ ø}ô€Ü3fŒñvêÔ A/ðúLW™† ^ºt »P‡ôìÙ“Ä;dÈzòŽÃ?þHÛkee¥Š¿!Ôƒ#GŽˆÌÌÌÞ¿_O6Y$9::Ö“8 „”––vêÔ‰,ôßÿþ·^mø©S§Øë̹¹¹8 <³wï^RPË–- ëÛ¶÷ë׶ýçŸÆaàgggòϦM›êá¶ÇÅÅѶ7nÜY_Ÿ¤¥¥‘| >|øP?[€å[¢££q0xcñâÅdž‰'ÖÛX´hµÀW_}…ƒÀ;w&ó;vL^–””ÍZµjejjʺP4h›Õ¦M777gïÍmܸÑÎÎN(Ò_–¬t” '$$XZZêééȘ.`‘¿¡¡a=Lwê„G±lgQQ‘¼Êô÷÷700¸rå +óp‡ʹ—îñ#""###itêÔ©ÉÉÉô—†wìØÁѽTÈòåˇNäzëܵkW*G½ßæ(ûöí#ç :T^>þœ‚Ø3fˆ§$˹Wc“ñ4h——÷ïÇŽ‚)HvvvæèÞ#GŽÐð›7o444Z·n-cµgÍš…§¼1gÎrNHHˆ¼ +<{ö,(ÙIcE÷Šg‘xmllÄ£ÖÖÖZZZÝ+ù_¤_«½k×.ô®à wwwrÎáÇåUà¹sç¨Àˆˆñ”Š9ñ,2­¤{­¬¬já^–õ•±Ú·oßfïãð€©©)9çáÇò*ðåË—B¡pÈ!ltçÎk/Ü­[7qÎ!77—ÂW'''6«mÛ¶´$ûíüùó¬?ኅ°Õ}úé§2V»´´T__ŸŠÅw…Š†tG¶‘=h,ëŸÜÏÏ/ €"Ikkk77·JÝËÌìããsõêÕÉ“'Ópdd¤d@ºdɇfÍš•so\\ý×È‘#åõqyÒ>uùòe…’™™É^%–o±³gÏîÚµëðáÃïÞ½Û¡C2d¥îý÷ã3f666»ÚÚÚJ>cF¤é»¸¸¤§§WÌ9°Þ[·n½uëV¹TÛÕÕ•ÊŒÅP(ׯ_'ÛtìØQq«ÈÏÏ×ÕÕý駟äXfEË…Ñ£GS±{öìÁP(¬+ƒ>}úȱLŠQ·oßNµH$zøðáرc):MLLT~÷úúúR±’±7(‚¨¨(²§§§ËLII133–ÝÚÚzÿþýò­vß¾}[´h!÷Ö˜={6úòðÀáÇÉ6Æ “o±eee999wîÜÉÎÎV¡O`Qk,^¼@¡°÷ úõëÇúD"ѪU«œõôô¾¾~‡&Nœ(îB¡Ò_Ó Šr½½½ý+˜¿¿¹·B@\½z•uŒÀúÙ‹cGŽ9wîÜBBBœœœØý•º7>>>...:::<<ÜÒÒ’¦Ìš5Kq5üâ‹/h»víÂP(¼½ÌehhØ´iSŠ~«Z@Ê›kÄëׯ۷oOcbbTÃÁƒ£;¼yó†õÈúôõõiEïÞ½«{‰'N°Ï(+¨†=zô ò/^¼ˆ PÊÊÊȇ$œ§OŸ*z],›êàà°{÷îJ?…\­{‹‹‹µµµ)xVPSÑJ³²²p`Mÿþýù¹Ñ.,,üæ›oX· :::ÞÞÞG---åî^ÂÆÆF (¢z< 5š™™áðû ,,,ŒŸÕ=yòdåÊ•Ÿ}ö{†¡wïÞ/^¼àî^kkkò¶"*vðàAZ£‡‡ lß¾œ#îo7ÒÒÒHt´j___î9---EÔgÞ¼y´Æàà`HMM%瘚šJÞþóëW¯X˜£{ccciâÌ™3Q™¾}ûRáýâðƒ½½=içìÙ³ +]ËãÇ+N©ªkߊîÍÍÍíÔ©“žž^ff¦Üë–••% +µµµ¥<†ò…n´Itß|óB×¢¡¡ááá·{÷nggg@ þ™¯Òw+ˆS§NÑÙØØèèèDGG+¢n«W¯¦Õ1€7®]»ÆÒR^|ò§··w«V­H¡´:77·3gΈ¨êbMMM[[[ÿû÷ï+¨n½{÷¦Ñå€ÿ´ƒÜ;S îÞ½+ +éŠPéSÇ 86lØ@îíСÿ¿¸Õ9#FŒ mŸ>}:ÏY[[“‚vîÜY¯6<))I èêêòðfTdË–-ä^{{û’’’ú³Õýúõ£­ž={6@PZZÚºuköÕàz²É´½FFFâ~,€®_¿ÎBؾ}»ÚoìÅ‹4h ¢¢¢°ëuËæ͛ɽúúú©©©j¼™ÙÙÙŠ{KjÊÈ‘#IJZZZêú‡øøø&MšÐ6öèÑ£^%·ÊLiiéôéÓIMt?þã?ªÓS¯ÅÅÅ¡¡¡¬K//¯üü|ìn€R±råJ¡PÈúÚ]¶lYBB‚ꆈ"‘(99yýúõ¬wt" @¡/ñ@­ILLdÝ<Š±³³³W5¨Î’›Ð¥K—“'Ob甜ôôô©S§’²455?QM(€oß¾ýĉÔàÿI5Ôendstream +endobj +5011 0 obj << +/D [5009 0 R /XYZ 85.039 786.531 null] >> endobj -4815 0 obj << -/D [4811 0 R /XYZ 85.039 652.065 null] +5005 0 obj << +/D [5009 0 R /XYZ 85.039 763.817 null] >> endobj -4816 0 obj << -/D [4811 0 R /XYZ 318.781 616.398 null] +5012 0 obj << +/D [5009 0 R /XYZ 253.633 562.854 null] >> endobj -4817 0 obj << -/D [4811 0 R /XYZ 85.039 359.561 null] +5006 0 obj << +/D [5009 0 R /XYZ 85.039 518.093 null] >> endobj -770 0 obj << -/D [4811 0 R /XYZ 85.039 287.376 null] +5013 0 obj << +/D [5009 0 R /XYZ 245.315 315.631 null] >> endobj -4818 0 obj << -/D [4811 0 R /XYZ 85.039 254.557 null] +5008 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F59 3455 0 R >> +/XObject << /Im8 4993 0 R /Im9 4994 0 R >> +/ProcSet [ /PDF /Text /ImageC ] >> endobj -4810 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F58 3360 0 R >> -/ProcSet [ /PDF /Text ] +5016 0 obj << +/Length 2515 +/Filter /FlateDecode +>> +stream +xÚ­Y[oÛF~÷¯²K=^  oœ¤.Ö®·q‘mh‰–X‹¢CRI ìßsjdQnÒ̹œ™9s®ß鉂?=ÉâPÙ|’fI[=™ÕGj²€™·GZ(Ô$ +UãÔ¿oŽNÞÄÉD«0WùäæŽHn濯¾?»¾yýÓñÔZhOÓ4 Þëà§c“?Bãçã©®‘—g××0tqõ–Wü?Qp cïxäýÅÕùÇ& ÞËÀÙÕ97~¾ºøåø÷›Ž^ßx=ZÇ)3Þ={OÿÖæa†ú×ài:î.S¸z®ÿž)¢mäanâG 4â|ðIÃQh£Ä—¨1ŽòàïŒêf›®ƒoÕ¬Fv·)ÈZ»Jÿý¶)qßõñÔÄQ@Ò%áöÅ +š+7NÆÁå;&zg¯çð¿Açþ„ä“\ÝD'F©ÏLØÈ®OΚúa«z:±…ÖK˜HUÐ/K¦Ø;¾è+· j¿mmQËnmYô¥œ;/ï +ÜzÕ£DH¸¨—œn¹éÊérÀ64Œ—lX¥‚uÓ·¸É#÷,rë‹OG64i,B<›×Õºêú¶îFü%³¡¨ñ`´c:Œo<çó¨Ü(ÒÒ‰”¸(zŸgj’0ªÕÊéoQ +ùºœa¿¤‹uEûH™“„ÿI,11ò€ +ØÛÂF&èü¨ lï$­yR6.×Èg_šˆ¶{ìX­5÷û¢»d ˨Ÿa*Y2QÑ 1êŸn+2º7”Iáf†cËb½(Ý"fwŸƒˆ†Ž)UµÃö-ƒö†Ps_­VÜúMÅ +H©=[5Ý 5kÇtØ"AHY0cuœ[¼èzMn"Á ­¿×@¶’µ…œÍQŽïIžPQŽ"R*ˆ>È÷ÍrÌ, #3f”#6™f¡ÊœM¢ƒ0 U'÷ŽD¥ÀÑ-ñêèš;Ìý(#‘ÑÑWøG¦íˆ°ÀY™(;h.‘—pIBZ–mÕw£\@&Š2Ÿ‹);CaYg;–ðq ùâ©ÿy4ø!ZíÖ‰PiÓÄ$ÁÅ“cì)HVÖ]û¦9Ùè0Êô®–`;ÒRîBàœÉ–á{Ë^Ë‘e•5ºžLËN0x8Ôe DõŪ„¬Á0œh¶ÝßÞÚ0OŸãpJ\¢y’õçbÖ¯÷ýŠ4PÔÒ£0· »éÅ?Ý.w``ã2AÙŽq©Ééì‹]+D‡Äì½S‹š4ÑŽï$_çhëS›(ʳØOö=ç$‹,'zH°'¿\3Q]pD%äTò•×Å\¤‚çΛº¨äÀË“ð’²MÒ­DaíoÚFþ³ùt$š‚Xº˜…ÏK X!ZŽº-±}}þŠUÇ_âu^Î…”Ð…¬’%/Ó€òÄÌ‘¨Ó0KÒ¯ˆ;‘J÷übŽcãpè¡iï·¥G¡7kpöbáëì’”Ü yàB´+«ÑÈjröHøôÈԤ̅k§”ØÄ~_ uA–Øý@Çù¡\Bq°-¹½çBJØÌœ ©`% +ËžÑN¡@Mõ·&ìÀŸ–¥äÕU³X8¬Š=–o»žaåáÜ +11 îðF«»'r° 9‚‘nÎ!FÅ‹(“g–DÆ>‡èDýý±£L‚w…x"û©óllƒ´·v7” ˓ÖcÓnyÈrh€–ø–ë4ð¯‘úÝ@<·ãõì:àÒìpA¢÷jº 2à“Šn¤r>¼ã+Ê‘÷½Çص&Ä~C&ÀF±ré¥Z™s¢ÃĺrRö³†è#"…àÂI7«²ÿ§$%€‚«~ä°$¢ï0åÍë‘slDãå_–hæ&µbîù_W“ùæj:›Cà\F>Bß%&†È(PºV><^ò°—³… ‹%ìÔ ¥7¤8ì`6ãà3„ò–VBz¯^* +ÞgÖ t¦ úa¨•@}Õ•9E% ø_:á:VEùë^c¿¹×\^iTI$¡—Î1s)Ü)Ö97¢Í¶âÑ*Â’òb;T÷äEîÖ«ƒÛ æÒµÿv7 ëYSóžeOG탰µ¯œ¶iú°W¬Ëžtv÷Å^á‚æ{šøn$Qc=SŒ™ÓØ<ø€ßôîA‡ +NkªJ³qÁ!DfÑkïQë¯(ZÙ|ÿ­††qåFHXO¹÷Ú¡‚Ét%§mÑZ¾ÕR¬¡ + +}¤Î êlÕ5¬žºð©Û´[´ä,„ëÚÉ>z´kÆ{„«ÈÿúrJ×pÌÑvlsôVè£3••6îDÞ†à´J;ÑCjþî˜_b¤¤rniU¨²”îu%`k$DÆÛ"ó â­ùóxk¾"ÞŠÂ-EjíÅÛ!p¡Ëõ4Ü/·ù4½Àl¦x ~(~7]ç^†oQY8CYTaøÀááŠ:¨–ÛŠc|+ƒŒŠ°å%\o«‚b½?-M#e¼·_ÞÄA+Z,B —Øet¤Š,îlï¹ :Û¶¡DÁŸ½R9÷„M+øJô.£1»[Êî8WRfG³€jR:Ž);~Jç÷y%…cÈçg«+µñ•yßå„ye|Ì =4ì2\„ôœáë–½¼8Ý€ÅOý3dâÕ¸ÓÈ`ÁŸEÚ\GY¬’ +÷xÌ©{p²a7ív +~h_î=ÁàîÓÝ` …öËå×f5w.­c´??$ x{’hŠÎÃî.· N´ àw“½ÁŽ$%ÜyeÝó%ã;dŠ¯.Åþ䉥™Þÿåk ¯mBí:þ³HäïýÈiSÿóù’*Ò{¿“%P%D»¸ãÿtšPˆendstream +endobj +5015 0 obj << +/Type /Page +/Contents 5016 0 R +/Resources 5014 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5004 0 R >> endobj -4822 0 obj << -/Length 2105 +4995 0 obj << +/Type /XObject +/Subtype /Image +/Width 517 +/Height 42 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 4560 /Filter /FlateDecode >> stream -xÚ­XYoÜF~Ÿ_1ÈËr€ Ífó|Jli¬%­5†ÈXŠCI ó -ÙcYÿ~ëèæ1âH ¼0¬é£ºëþªšbíÁ?±NBדé:N"7”bW+o};+a(¶†d;¡ùy·zsFkṩ—®wwÃ=©ç†i´Þís~ùÇÙõîÝÇÍVJéßÝlã8q>l„sv} ßo¶Â¹¼à}\¾ááç÷—o¯6~â|6 g—oyðéòý¿ytñ ®>]ßl~ßýºz·Ä($¤DaÿXýö»·Þƒb¿®1>ØO\Ç8+ƒAÍSÝŽH¥+¢èÅnbBs²ÛQìÆé¬Ùñššä„FçqÒù\ƒžf®)4xÌc8È…’ô<>º"F4ñxàd3%¢Ð ^S¤9ÙL )‡pCg±•ì—=ÇHa\ryµ›ò—©¦3þ®‹Þ¶1C‹c:ˆQ¦w]SÍ"!˜}ï\†¼1(“šæŸj(cáASÑÉ°‘ë¿b¶ädФž›$á,häBмmªÌöG0¥¯b<ÔÍ$RÈ0¹F·›à€•ãé±óiË µ¬]’@wÿ¢rÅɈ#J1éö_ã‹iè +xÚí]{Peÿ”‹¡Ö€ +¹f +B2bV&Óð2R]d¢TœŠ¬(‹²I¼TD^ +¬4”Œ4Q IÍÊÈ!)TÀ+DfY©‡ ø~Ã3ß~;çÆžÝs–]ÎûüqfÏž=ïþÞÛó{ž÷ò¼==Lþ/ÿa"¯|üñǬÕ)PNŸ>››Ëº†­ kù¬Í÷£²V§ +ÈËËKJJÒh4®®®¸hoog]ƒÑÓ+ä¾ûîcÞ¢(‚‹üü|Üd]ƒ©>&¬L0 +Pc×€›YRRÂ*—©>V&Œ˜XƒTÔ5€íÆo4øSZZkRê·½½}Æ ,@!??ßÚ R:èìì\½zµ¿¿¿›››ùŸþ 7nÜàÁƒ‡>{öì³gÏòY£ªªjìرÆ [¶lÙ?ÿüÃé™iÓ¦999ÙÛÛCÕÀ˜jdâĉø×Ì™3›››9‚êÆ×èèèË—/+™à±N™2wÂÃÃÛÚÚÔ¢U€à¥;ÝŒ üý÷ß“&MÂ+BCC•à˜ð€8˜E*¥ƒÇÜÅź—¨ÁÏÏCÞØظ|ùòÔÖÖ¾ú꫸ÇWàÁÁÁYYYsæÌÁuff&ýäéé .(--Å¿Š‹‹þùg©ÝvÛmï¾ûîóÏ?Oƒ-S§NýàƒV¬X¯o¾ù¦’éàá‡Æ×ñãÇÿöÛoêR, Ø,0:`t@²dɤK¯¬¬ì²hY?#PhÐü®®®òS€éÚAZZZŸƒE]]]¸Èl÷îÝdö#hú ¾Ûˆ#80(SCåâ^®A( =½“³Hü‰'žP,TTT 4ÈÁÁáÌ™3jÔ-€íèèˆ, #Œ ßÁG{ؼyó!5p-0“ÆБ7ö ¨‘ÊËËq #Ü;vlõêÕÉÉÉ ,àû:ùøø@iÓõúõëq=dÈØØØ]»vuww››šÎÔ’R2„„„à:##C½êà‘d„Ñ£ƒ… "ñ˜˜˜Cê f W¬¾UìÝ»×[¶l1HÙÙÙ¸NOO¯­­…µoBÓ ÷µ©© ÿ + +Â3O>ù¤¹©©ˆ¾úê+\xxxpS'j€Gd‡Ñ-ÓÁ¹sçÈÕݱc‡ŠèhÈŸÑh:¨««ÃõsÏ=G÷Ož<9tèP¹««ë˜1cøÿâF„ø +ü÷߇§©ó–ŽŽŽ‘#G^wÝuf¥¦.:HJJR»kÀwF¶Lk×®EʳfÍ:¤6f ~F¢é »»;<<ü†n¨¨¨€eˆ›...r///èùõë×öÙgóæÍ>|8tû®]»8þõ×_×ÔÔÌŸ?ן~ú)ý+%%¥¬¬ìøñãööö“&M˜šêèàêÕ«È 2ÕØØ(=ͪª*x»Æ®WÜÝݧM›¶téR}Ƥk<‰‚Ey–——Ky;²€Œ ;¢—ÉÐæW­Z•Àè@8deeuvv +O™ÈeffªŽ€™ÖÈ1:MóçÏß~ûíÐ~~~¥¥¥|µƒB „– -‘CofïÇ@™f87U0x‹¾a$V¦·ùÄÔõsô@ázcA†ZÛ”E8P Bço§žüåûØ(ðŸáý»¾ŠO¾'¸iâ/Û6ô}׃0828–Ø~>.òÿzÑ,endstream +Ú¹s'>|á44ùüÙ‡øøxOOOÜwvvŽ‰‰áæqúLMutpàÀZ\*=ÁÜÜ\”ظqãÐ÷÷ʦM›xà777ctpøðaÐqIIÉš5khqÅÓO?--:E¦ÛæÙ¦sé.¹··w^^žÁÌ––$‹^ùÅ_¨Ž€™F6,µ­Òvè€uL‹Ô/-—å&GDKuu5¸ $$D{gÚéÓÿ±?þø㦛nÂMºhà\Ê” mž²ÐÚÚíààÜ·oýtíÚµ+V€ààøÀ®x饗¨h…9Ibb¢N)Á8 9r$ ø ÒA?Xà ÿóÏ?'H¢a #RRAÐüÐÉäÑO ð+++ÛÚÚÊËËáÒ––ÆÆFÚ÷]__¯³ŒyñâÅü½3ÐÌ:tœ Úݺu+¾&''=zŸ¸.((HwÙÜ2#n t:¿ðãüà]Û·o7¨êÅ_$ª•B´hpúôé«V­zë­·^yå4ïñãÇs[ôéàí·ßÎÉÉ“ Æ¡ã2(âÕ@Žÿ"Œd–3fxyyÙ8  ãŠEbjÐr0¢L[n}ÒLJØcîîî¢a #”)Ùèàý÷ߧ¯àúï¹sçpû{2&&ÆØ’’‹/°äûhÈ‚ìÝ»—‡3Bó#W®\& î²±eFøét€&¡ü tYTTÄ_NBæÍÊ•+¥ÐhĈ°mŒ= Oü_÷ìÙãííM“Âæ¾È%ZDŒ˜ˆ®_jÌÒíÒÄpw̘k¥ +3[4 d„2%p‰ËQqq1.ÜÜܼÿ'P/P°&2=€›6l0AÜO40Å'bxé€ÿ/n—ði/[x¤Ó‰àº!!!à >)yóÞ{ïI¡Tª¬´´T@Ö­[‡›·Ür‹¹¯r)öŒµÕÅJ&*‘—ͪ_šº’íÆ­¯¯/ÿNkkkýÿD8—!2BkàbŒ5ÊÓÓS£ÑŒ;Éž¿¿?¬Ö &À¶ + +B§›Ín»·ÁŒÓÖü…»£?XÄ×Ï|:݈ þ.t z D: ™稬¬Œ+ ÜÙ¾}»:ˆE"(䌌 Ô¦:Ø¿?X .†¹¯.,,¤ŒŠ¥ƒ—™ D¡úEgǧéØYBÄÃÃí¿££ƒ»óÐCéœÈ,d°xn¾ùfÑ0ÙÎ6¦{/]º„¢˜?¾Áò} +Úö lÛ¶M*™{äÅ ]¾|v8Ÿ8Mã~óÍ7ÎQ?]6é@âƒtRŽŽŽ¾ë®»÷˜˜˜¸¸¸¹sç¢èâããï¿ÿþ„„„¤¤$Gxyy%&&R{Þ³gÄ>@B§>!Á¨¨¨ÌÌÌ/¿üR8@Ð#€ÜÜWÓ¦Z5,b"ýÂ~¶ÈÂ6Ú¸n(p€È P¼‘åË—‹†ÑÜÜŒF}ñâÅ .ÀˆÅ¦¦¦ÆÆƳgÏÂJ?yòd]]ÝñãÇaâþðÃG­®®>räHeeeEE…Eè §ws®AˆÐ!?þøã¾}û¸©„Ù³gã§ââb 䧶hÑ"Üì±Ç–-[ã–²|‘Å#Óب~ï¼óN2V¥¿š àn¬]»Ý†1ú²››› :8Ü+x8;;}ÇÉÉ jA +šÆE¦TÝæÛÚÚ iŸ}öY ¦iÕeÕ"8wÐÙÙÙçù’ÐÒUUUœ;Ðð Í&¤8ƒ¸?Àæ@ÒÓÓ³²²äïe;¦ilT¿´°œ‹ø$QàêΛ7nòà^qwwŠŠBéÃFboo+wñâÅÒÃk##”)uµyXò}ôÜ¢®®®óçÏCUBËUWW3:¸víš "˜;w.¼-þóYYßDÿ…B¥¥¥~~~ðSDÄÐËËËSòÊ"ÆýØËŒ‰‰¸7æÒ¬q|Þzë­£:è gÑ.FµùÚÚZ:å“ÄÇǧ¨¨Èâ%c½]6"H×ÀÒ€áBÓÞ"û~DDÄÒ¥Káçæääddd +}¸}·¡A`4â_C† Y³fˆW³}Œ,øRséàÒ¥Kh玎Ž:3›jdÁA¦T×æ»»»/\¸ÐÐÐÐÚÚª¿»jà‰@:Ðjµ|"°³³KJJª««3ö¼Ev%C¥Ã«Õh4´NièСaaao¼ñ†‰•Eú¨ÀCadDSÅŽiƒÁUzŸË,<î¥BðÒ×wÞy‡¯-¹ú6â—ÜÜ\õª€§QwcÁͨ‘:::´Z­Y)°ó`ã%&&ÂäÓh4IIIyyyýB »† Wé|.³lð¸ÇÌÂCÛ¬¸%RüúáMN¥3€MgI\1Ëè@it Bêih`p¨AÓ+2SƒÁ®aƒÁUzŸË,<î1³ðTVVâkNNŽÁú½ûî»ñ522RzÀ +™€)ܲ`¥R&*¢ƒÆÆFUŸ•,ä\Bù©Á`×°Áà*=‚Ïe– ÷Æ,<ùùùøúí·ß¬ßÖÖV:,..ÎtœjE  0`<²Àè€ÑdáÂ…´¨@Et@+:€ÜÜÌÊC ƺ†­Wé|.³Uá………q[×¹¸7¿þúkŸxˆs›››fÎœÉÍë×ï‰'®¿þzÜœ> endobj -4823 0 obj << -/D [4821 0 R /XYZ 85.039 786.531 null] ->> endobj -774 0 obj << -/D [4821 0 R /XYZ 85.039 517.311 null] ->> endobj -4824 0 obj << -/D [4821 0 R /XYZ 85.039 477.147 null] +5017 0 obj << +/D [5015 0 R /XYZ 85.039 786.531 null] >> endobj -778 0 obj << -/D [4821 0 R /XYZ 85.039 405.564 null] +5007 0 obj << +/D [5015 0 R /XYZ 85.039 763.817 null] >> endobj -4825 0 obj << -/D [4821 0 R /XYZ 85.039 370.818 null] +5018 0 obj << +/D [5015 0 R /XYZ 267.428 732.854 null] >> endobj 782 0 obj << -/D [4821 0 R /XYZ 85.039 193.166 null] +/D [5015 0 R /XYZ 85.039 682.912 null] >> endobj -4826 0 obj << -/D [4821 0 R /XYZ 85.039 158.42 null] +5019 0 obj << +/D [5015 0 R /XYZ 85.039 661.15 null] >> endobj -786 0 obj << -/D [4821 0 R /XYZ 85.039 116.26 null] +5020 0 obj << +/D [5015 0 R /XYZ 85.039 425.704 null] >> endobj -4827 0 obj << -/D [4821 0 R /XYZ 85.039 81.515 null] +5021 0 obj << +/D [5015 0 R /XYZ 85.039 397.999 null] >> endobj -4820 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R >> -/ProcSet [ /PDF /Text ] +5022 0 obj << +/D [5015 0 R /XYZ 85.039 299.905 null] >> endobj -4830 0 obj << -/Length 1286 +5014 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R >> +/XObject << /Im10 4995 0 R >> +/ProcSet [ /PDF /Text /ImageC ] +>> endobj +5025 0 obj << +/Length 2548 /Filter /FlateDecode >> stream -xÚ¥W[o›H~÷¯àÍc)&ÌÀ0°oiœ¦©Ç›8jWU°!6 -†,ÆMûï÷\Œ/»ª´ªjfÎœëw.3‘Žÿ¤i×ócÇD¡«}é,7ÏYÁÉí@ZŽ±e÷x>Ì—uèHϽؙ¿tzbÏÕqèÌÓoâúÓÕl~ó8û¾/¤rGcc"q?’âj6ƒß»ÑXŠé-Ÿ#ù‰—_‡‘ŠÄK¸šNxñ<½ûÊ«ÛGdxxž=¾Ï?n滽€¤ï£³¾}÷œû<ð\?ŽœwX{®Œcg3´ïêÀ·ûbð4ø³ÓÅgÃRç°Ñ~äêÈ?Gê3àhí†!pæë # Ä ©ðç2¥¶ánq“Õ[æ\Õ€Qµ{ãÃÜR“s‡Í:iÙŠj4õˤà}ƒì¼$“É­¯mò2¥sò -N­åy?™ã’ _g¼‘õ—ŒÞæU ÛÖ…UÕ¯cÌ 6–jL(l›¤n(À×â¯Q@ æ…àiÉ ÔU5¼NЭ”×ÍÖ¯'Õ†‚ÈdÅž·JöÞ3}ˆ<-šêXÁ\ĵ9Ê°·ê¶,µªÁO)¬®d×TˆÐ-~a@—tü§QoÐÂŽ&HL,Å>Mâ&­J»(é›a‚ &HźgÓNí™èý/^H_­òrÅû¼dÉ¿ª‹×Ö ÁY°H›ÁSk̨Wê~¸žBÄi’nò0 (K­DB˪fáƒ> «ne¡ÉÓf‘%gH Ý&ÀÜms¬ˆÎ jŠœpzÅ­&@ðûÔ$5;L—L¼&?JÌySW©“2³ÛK–èg¶IiË°à·@¥–­ìõ9‡LBwÎdž&° ¯°ÊŒ´fC$–¥CË–,€vÑ/+M@´‰ä€¦¬ÊvØ -‡füÝÀùa‡c¡Á†´ê•q=}¨ºE EÙP¤ÞÂA­f+fH.ý8àlWZí0”"ë«B/ƒÒªTbxÜ›5ÓÛ,Á,ÑQ,æ¸ÁÀiã{^¼BÉ®l}_³! ¿oLÆÞðQÅ'IšžéæÝ–'t ±¨éÛNK&ù °&€p0Œa¿i››Ú““„„ÚÁõ`8ì GÛá¡AøÅYjbqMŒ-²¾ \”x /p5xLR`k/²¥P­èiô) >)F‹òbƒÈÒºKåšÉ¶2פ'Ô]rC>ÜOi<Åì!!Äï~J‚ ¾ ²ôÑ4XO°_vžÃr -Wåo:rÒ[í¸'Kê°ÕT÷Çn+Kîf«ñÄðáuÈÔlL•ò¡±šVÝ@‘Jܽ0g¢Eµj5rüT?ù0çÊÇå[Í04œ7YÊ2)Ú«Û)‰ŒMÛ,u8õí%βoEƳí\îëlC^oÐÜ‚4`}ªÈã|Áׂ„î´1¶-6Ð`˪,³eú˜€aòpu7å["½[ByÆ5¾±×Dù²:s“ÈÐõÃÀ²´3bšl2Â܈<#¨#ñ‘ÞO/ºª†õ}ûTÜàÓõqùbþ‰ÏðŽ¢›I©À•ÞáÍÔŸ»»mÿa7ÜC^5vö¶I뱑åÉMgò -z¿C]qñ4™}íüd>~çÂŽë=§»¿$‚È#uþ­¬•r•ìœAÇ¥¯=nßݧ.ÿ­Ôðendstream +xÚ¥Y_oÜ6÷§XôN T +)’+é€àÖ©ã¢u|ÎæÒCÛz%ïꢕ6’6Žûð7Hi×+§E‚YŠg†3¿™¡åLÀ?9KM$T6KÒEd”œ­¶gb¶†•Ë3é(ÄLGbapéûåÙ‹Íb&E”‰l¶¼'’eþ[ðëó›åËÛy¨” +dÍÃ$IƒË¹ nçq¼†ÁÛy(ƒ¤ˆƒ_Îon`êêú’wütð ̽á™wWׯçq¼sç×;Ô*RR“ßóPã9hÈü϶4¥ƒ~¶¶½ÿp³·W8PÁζv[ôÞYËSeÇ4–ö°¿îÊu]ä¼®â©ï`¾t|K¤Ác™Ñºp¬ú Ÿ¬‚çQ”f_9>uÓÂ÷l£ê‘™u½mÝ.Kª£²îîh>p»…Á«Æé›ÅG:5dð-ì—†•G}T–±Î8Ø"é¾ëù«F¡Ü˜ø1§¶ÂËÿJ`C#K:>òÇÀÎv¤Ú€„“=ruëüƒv$¢uâÿ{žêQäòw!õÊöeSó÷È¢=4€ÎÈ£VfüÍ‘º.ðC92Sk€ì ™( +Ðõ¬q#8OÓÙðKGÌy +æw<—nWhð÷ƒ½Ñ€9/?âd³çrAì;à:ëÌ?¢ÎûÑ:þÎÞ(Þ9)î½Å”ú IÞTlPÄv"9€¨\2Úö¾i·¼@€[Ü©xkG†»ï›-|¯læy¿åù;”ºç1päAí|ð˜;Úi'ç…cZ:Qý!ÞT2ˆ&@N + m¦a:ŒM¤’¨c˜–Q†ñ1‚`3 ³ $Þ€-/Š{»G{TN‰E¼íÀì¨Üb\¶ -ï:þ¶uÎD·Eå„}ücÁóW ZON L&Tˆ#?§€’Q*³A9…ªï6£çdtMè6D=Ï•µªž1„6ä gšråý !ÒæžM •Þ‘÷Sð W?t<}½Ô/b!>½øõ†².Žpq×ı©ó¬Ùs&}ð–BØÀ‰G}oK§ Ø}ªS¿$Q÷;T!‰ù&´ÖÁyUZ”O[BÛ²/ RÉåá—›¦ßxjË?CÈVh+Bñ÷ˆÜìÂ5SÁ}ƒï{8żi>Î]Á-àß…·W8qAÖ0èp¸k¹aÑ“- +6``Ï›ïƒNA~7ÀÖhªásŒîÇ ümŒ>í "KN’Sˉ‹Á nMã ±µÄ¥©#Ϊo, OØÇ;N”Áí^¢ È¥>:°fŸhj/§•A|ï8ÁŠw¶Và৾rHEn%äà7ºä+Ð5?ìK‡¸ZĺãØîv¸ÒÐÿ¥íÝ4­n ª}AI Ê´MáŽ#³¤Á ï)Ù 8|6>P®†iÆ„ÈõÍ“Úêòó»N;-ƒT-ÒÔ!Æ´˜°cçqæÛÁ´FsQª@“á·7™K%°ÑºæI" ©U[€rô ‘Ñ3waþÃàç <÷üÆñA|Ù–uÙõà[”ÖI¼¿Ó…†N‰C…[–ŸÓäÅ’ª­jp[J6 ÿ®ŽÒ<Ý Nc`>ï…¨OrVîY <ڽϰr½dRʘ""ï‰q‰ŒE&ìIòiý¼ Óêp š4åyó×X¢Å‰¡ÈJ8²Ìi¹…ôeßñ åƒòÿj3Ü~‚˜/Bªcû$àú–›‚9%O ïùû­+äºÏÁwçÊ‚mËÍpn…åÊ‚Áí`Üm@¦Ê¡~š]e¦Ácb,Rha4&R^k×3Ü^~&µ.ç)qçò% Õ‚|zŠÎˆ·8ÌáÏó<©b d“ {Ëø¨ã’‘§PÅr/´F2n˜!Î9Ø[»m…]m\Úí» BÈÂ&¤ê¨9 QµÈ")ðÓx–úªˆ~[E‰V³pxUùò%àAª;Lö'ÂqÖO{?öŠ.”À(qÂïÊ]!ŽÇÖž«W!¨ƒ¼D[ýk +~l-úü#Ó Õ®Ô>•®œ+Ð¥£4½˜Dü÷°‚d†¾«&ñËB<âèðéÞØ—=cÚEO£ê'‘£^‰xZù$±ü–RULóÞw.ajcÇ'Þv7š»p¼ÇøÈ™Æú7X´,¢{PÂJÞHö´éy}l/"¦{ZmŠö´oXû`â´6¾G`ä¯[ñÕ …Ôxu˜ˆ»A4ÊÔt¶å7¯ÖÝ$ÇÊvuqÜÔóyü¢ôP©bWNéðz§ Wíö¾0n‰ÝÓÆŽ?¸Âóu–2j¼RWJ_Ì@Ñó“q¯©4êÙçŠ-{›áCxÙrð2ã^-Œ/aÐÔ•Ó>ø¥ÑÁÁ™E ºÏ=]YWVõ:Œ×c˜¡JrAw7Ép7ì{ÆpåXÙ»jä0¼ÈôîF‡»¤_®f¢œ*Û!¦žcR¥qö¹×˜Å_{‰ÝkÌK²Û]åS~ ¢…æ~©åç¨éWý¯*ÿAüAÕ`Ö•­yP•=¨¤ck8XšÚåfßñÜú6p¦t<ÜÛr +±E-%½)âBn{ª5íð€]£O«x»Ÿ+÷½ÛFõÀ">ìóŒˆb¹pJÐ+»ÎâÁk† ÑÖõøS¯æR›,9,Y±H‘‘êF^>tKï’œçÐEv> endobj -4831 0 obj << -/D [4829 0 R /XYZ 85.039 786.531 null] +5028 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [278.725 470.023 330.112 481.712] +/Subtype /Link +/A << /S /GoTo /D (WKURIDS) >> >> endobj -4828 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R >> -/ProcSet [ /PDF /Text ] +5026 0 obj << +/D [5024 0 R /XYZ 85.039 786.531 null] >> endobj -4834 0 obj << -/Length 2771 -/Filter /FlateDecode ->> -stream -xÚY[oÛJ~ï¯È£ Ô®î—}ë¹dÑEÛ=@Rô{öA±[¨,y¥qšì¯_~$g$ËN°Íp8’ÃÛÐÁOÁMžlü¨¸Éòt“DÁÍöðοÙÑÊßߊ'Ñ&‰c_Y\ÛÕunü8»Š£g¬³0ÞÄy œ_îß}¸ ý›ÐߤitsÿhI‰?Ìoî«yA´Y­“Ä÷n›UàµõûÕ:JSï·f¨·¦_E¾7¼”yeWÉàn_®¢Àj™~Ünëq”m¿öVëÀë[¢6®þ}ÿw¿ß;.Ýù$G¼)Ç ‡å’›Àß~1—#J6I’±«§U’“tîÔàÖ¼/wø†Þ÷†ø'ÆVaîýÂ(맱ÆlX)$öJ–Œ–äÕÿœì¨Ã~U½Òqµ3YŽ¬ÂgžTr,µŸv3ð/?ˆEÕ~áUPüÀˤñAɲ *¸w,€Æk ;µåJ&Ý­IÁÊ0MO'…QæõøæDäkƒègÄJÁÄ-{• ?|)ã»ò‰tZõòíz#ƒŸL"ÄFúW ÝF90{Ê®³ níEÈ°\PÄn/ -f(ã>«†™kCÖ!ß*0¾ƒÕ‹‹½ÔHWY'J=äý¢…WV‡†µÉê1X)éF]…ÚÃ܇iÕ^a˜åbc=¶>žÄtÄä°m¨wåP1g;8Á-9qaY`R[¹ =ØR‡*ÀSߎˆ5 íEê Rcnzù»ÀYÕWôAV!£(ö~6fQD×!lZn•ˆc fÏ7†‰‰vÿÜK‘ea¨Y³Žw²â¬mìOƒóV=‚]®?Èä„]å‰Ùê‡ft~…NkLˆ™ÜX1Ãlã"æÒWXx0²<ð¾}ýô§ŒøÚ{og׎U¹öÐÃÍv¸úÒÙgÛ”ƒ`‰Þp)bâb«$Àw–·“…VÍ·ùÔ°€ÝÁ“‚m‡"¼b3;àßå`ší©åÑ•[<÷º¨ 3Š-)ëÌ·lo/²ÂQáã©l!ÌY*{7„â¢UiÀ¢aÀa´ð¯‡QZwa”±~ZugáOqa¨øÒ’‘²Ùðò\aŒ˜úp4‹ânæŠJ8´Î̸Sëdw4ˆ°=½ÈÂÒØxg1pgÒŒ\Çsc“Tz]Åi®¶ÿÐÖ™· Ì;N &Ò Ð:ÀÌq¹#Õw~Ì!·º¦,wLÙ¹j9Í.€B@RõphÄwŽdãbïÕ(Œy]AÂjx˜”7E;‰°ì"s¢‡EîͲ,¾î'êåë˜Üÿ~¯÷œA¡>>d¨»­oF¡Ùwµ=†Ñx5Ë© ÛRÙë8r …m8¶µ©‘í±¶o*«Î÷R-ÔON¾îZ*æ‹:í4Ä6FͱŸ´4‹®Ö(ÙÎéû0@´j§Ö<Ðâ;‚õr˜o$»×cêÝP×—ÑQ öÒö;ÄĈRêÇ¥#ê¹Ùí ÞgÍ•23µc¤ëÛ~÷"`ËˆÌ €e[Iâ•TË별ÿ—ŸøeÛÛ°DMQAàýþlꮚÕ+~†õ×< *2’¶ˆP ç=²Ç_¹I 1¡(\]Ø*Kb' /|Éå0¾‡ýE:7²Uò"’fP¾ai\?Q&fËä-={ $)Ý1—k8îììÑÕF]£n¾µ rúÀΩ!¡â¢ŒÔÏGÎ M7^z+¡÷‚ìíánqžÐSk¥Ë«œZk£? eÕ#SIÉ Ë@ß@úõó(a¶—¹ÕAœuÛ”­ànøDò,ã ^R¬È†ï:'?D:Êÿ[ÿ-ê<˜ŠMøEa+~*¯FÓsÕQq-‡%#_v½f´]#NßÍÖ,"#‹G¶Ú‘ ›Ú‰¹.„^(Kr±œúÜZc38V¹šçkt*õ¥ÀU½-+ }«Ið ü]†Ëx_ï_ó©h^¸/£Ôs‡×³ŸŸxG~c‰^LRØ0èËîÂÆI“)ŒM=Ì®±µ€"?F j•¯µ€À,žÈÛÄ꧚ÈûƽÚF n8¤$Lm€«G`ï ªÙ¤­=ÏAæLÚ±1þ0P7P§P9¼RÇIä,ÄC~uñœU"µëלô¤…­ñ¶`úf½ƒ† ]ç;Ç輄ë¦R9ØuilΛSfßèEWÕÄŒÒ [v*¤~›ƒ“z¸Ö<èÕ/§20‡”äk/ ëY’_©;v\}Ms)e¢5‘ -o× º(èlbjKî [vM:æwïÀõ0‹H)•¯3]sþe¶b‰}y®÷WT3Å‘y/ˆÌ!] -æj `ýùá³ÔíHnÏ‚­„zA,xlK#¦}xÛü° •<ÓÇeJ‘ÔläF=L7ð©ÓØ\V‚åjìà°Å».¶íV6›r'%zi6KrJ.o*q©ƒ¢\Ÿ4Øôb9k^úÆÖ¾${µûÇr«y¥±vuæ§Nñ•Îôýîη}òÂëÄåþ†³?ܦñìŠÎÓ;QÀÍDYŽZJnýù"Ëôç‹0”·.!Ü®‚ …3‡qËqÙ½nK„K¦ü¦)M(lIq0c3ðƒMìG–Œv³²åaŸnò$ë4‹²<»¦ã‚pCßü¸o_!â'Ò-zd·}—'ÚÂà·fX%'¤á7÷"« ­+äF™\Ç™Ç\\‡s–XªÛ¾“ß)FI±‡^ƒ^̼”R}ÄÇÑ™GÐT> endobj -4835 0 obj << -/D [4833 0 R /XYZ 85.039 786.531 null] +5027 0 obj << +/D [5024 0 R /XYZ 85.039 606.308 null] >> endobj 790 0 obj << -/D [4833 0 R /XYZ 85.039 766.606 null] ->> endobj -3058 0 obj << -/D [4833 0 R /XYZ 85.039 658.638 null] ->> endobj -794 0 obj << -/D [4833 0 R /XYZ 85.039 251.169 null] +/D [5024 0 R /XYZ 85.039 225.938 null] >> endobj -4836 0 obj << -/D [4833 0 R /XYZ 85.039 211.005 null] +5029 0 obj << +/D [5024 0 R /XYZ 85.039 191.192 null] >> endobj -4832 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F41 2994 0 R /F58 3360 0 R >> +5023 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F64 4225 0 R /F18 4228 0 R /F58 3380 0 R /F62 4159 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4839 0 obj << -/Length 3196 +5033 0 obj << +/Length 2253 /Filter /FlateDecode >> stream -xÚ¥ZÛ’ÛF}Ÿ¯˜Gª*Có*’Þ‰½™”3v<ÊÆ[I8%qM‘ -IY3¿8ºI]½U[©X$îFŽëÑþm»^˜Ý&éÔCÿv¾¹ñnW4òÏ_9î”ånÄóÙÍ›÷ñôÖ÷ÜÌËngK+'óÜ8›ÞÎ8÷?½ý4{÷yr†¡ã‡îä.IRçýÄw&w¾óá=ý £?>|~w?ûøy’†Î¿…ôöñGê¯ø‡õ±¯ÝKÞãùn_ÇËÂöùc{ǘ1r×~r¼˜ïMÝ4N¯­fXŽ—#Ò÷–{Ê7Ï“ØgÅ©ó´Î[¼òúc³«ËžõN»:òWº³ q=òyÈz€C$‘½1ÿÕXÖ+dµ³Ùñõ$±PŠ¾/1cÕ 1¯‡ÂÔõõz‰£ÔÕĉ!g}&&wØÁRÆÆ~H¯vNmÜ„ešö«Î›².»¾Í±0™Æ©•ÎÙ7ȳŠkªs1U˜7 §¹k,ëdûýÖ¼†ÅÌm¬¥|€vÖI&¾ðª¯€•%C-°Î­—7»¶#tH§„æfJÆ'‘Ú©g”°WO§ƒ_ÒóÈ/Ǩi C¬ ßm#9<,ær+,çy8'[Ž‰¡Ý #J®ìØ?m61z‚Û—_u ì׆ù„Kyü-p!.¯2gò»3j-Ú„/*^¶¢ž9¤ú©ó ~}.ͯˆýÌéŠj0YÁëÐ[CÏðp,Á^Ztý/ |Becfá>üD"-“[¼/ sØJ/7N6…Ù`: -oÊ;cWs!6[®dÿÒÙ[÷ÅM%™kLþ{WæÖœ˜tHÁiûE‘‡oŸƒ˜Ú"=…󢼈Æqº^œ\…ãÏe<6Lßäk ZD>^ñ,$W¼ŽÉ”êMû×àXÔø³µY2À(Ê(À[©TööØS0i;ž ôÐœê*x­Ü e™Ï˪dà`ÿ¥•èÌAÐ3äôÂVêo[lò²Ö¹Mm¥žjÂä[a8EÞ úv€¥À·ˆA u'† ú=âàLªøtàsÖÚÚx×·å|À õU(‡úÀâ ^è ´¬Í³‰¢·ÑþîK:ÚØW—|a»Í=”µDc -ÛZRpÍ*ç ÚŠI*èè*ôÔMJ­@”MaÒÈ5[ï’%^©(KÝ€<þHx.ƒ”aúH][ЂÔñŠgAj¼â/OG¿³Òl4¢bªF©˜UB¿fkv«µ8ëç§OŸÌãxÚ÷rÍ2¸¥Ûȭ𷊨*#¹(©¿Uêc†Ïø¡_ìâÍñvØÌ‹L-•í<€DTÇ}¤ÇÇZ–ƒµ”Tl fsŒ’E[½šòE -J,%ç=cªÝ« 7€èÑí¶º¶€Ê¥‚ÓÃR@ nzb¨O.EpÛ—UegʃM¹°Œ&\p›ZÈŸ«#$e€jvºû]ÛíÌu¡Öë ɸ4¯šÕ+¤dì„UÞ£²Ôܶ“M_M, =Î)I™c)lb¯°íe¦T©ôð‰ÆÄ@ ÷‹#a&¡I’­âóÑó6ï瘺抙K©X(JÓ#(‚ñÂèü©óÕ:H®‹ -dÉ‹9WÏay® CMO©sÕ5¨õ³×Wõ -#Eä Þ–­ÙIÜñ&«rÞÿF…Ú ]ne^? ]®ðLb³ÂS×q’-zæÄÔ¦Ž‰ƒÞÕKoË„E¡tžÑ÷\HJjmÒŒuþl[#Ø•If9²‚ã¸×ÚZS[ìA ©VüñÀnC:LY«FrñÐØ” çRe 7 -+ÅkMÁyÌ&­ûΛQäA™3VmëËI¦½(– ÍzÌeìÛA¢Q’ÕÆ)Z›»kc?òFºPÄÁ2Œ8 ,ͺ¹ólfÐld]®ÖçBd±j ®ÈBi„ÁPçæ•$ÔZå³”&ôâ¶%梸îÌC¹Ðl‘OÏv›È{ò]Õ‹œS³Ç™^Õ%e2¿£8+„ÝF”J·Z ¯¹Š5®az9YBŸ²Ò“3ݵö ¯ä éè“E’¨w$‰ùP–8¤Û¼· N’h‹Lù÷ÍŒi-i&€Úõ¦<2×òénhhš¨«‘ŽI§Û^ -ß ƒ|õ³6àAb¶n:MHöåP×Jæ •)^¶UÓù‹¡/Š-ïZÑÆTw|Pû(À×ÊjøKwë†qF‘¡-¾•Åþ4Uê;¼]’Ë+(l1™KâîJ«l]l•½gÅWªg[¹‘ßKß ªÃ7´_¯^8²ž ¾Æ‘©° 2Š]*ëÜHþ„ä8}¡ÿÅ.ÿ¯?/ú¢©›¥Áù(7ðíf$á;iŠš¿C9Ýò4°ðendstream +xÚí\Ûrã¸}×W葪 +1ð’7ÏÚãx'c;¶¶&©Ý} %Zb†º„¤Æãªýøt£AŠ’hËJ<:a¹Ê‚pmt4.ï;ðÇûbŽöýÀcÊåýѬçô'rÞã&‡Ó—Ìñ&½öÞ}P^Ÿ;,tÂþð^gŽµ~úËÉõðìf`»®kqÁ¶ïÖù€[7á[Wøe`sësëÓÉõ5D]\žS‰?ðCZŸ î–b>_\ž^ D`}6'—§øåòâïƒß‡?÷Ά5mɤç¢ÿêýú»ÓC?~î9Ì ƒþ„Æð?ëIå2%]ó=íÝöþVÕBi²O¥Ta—9l²P¨¦<’|ömŸ)ß«çØþÔÚôDƒ6‡ƒÐ³¢»5C¯­SŽ½~÷«Z å1é›RÞÖŠç2îz¬ ¡ݨ¢lôó Ø·Òì`cèãB 4Ã~ äqF¡Sÿ2E«´ ¸›‹Ó|[® 9¾)ÉŽr…’L>(×Ç€û\fŤ‚NxÌàí·:ÔÆ<6Z°ÃѪá“ÕèBTC!“{³¹`íÍ‘ÒhÛÏhÛX›6µ?j­.0$¤_°õÙ#Š >îèÓõ!¢Þ4øý»n‹!êPì˜R µ>– (`Ý’Ç…j@G”ç,»å±±X¤Íº-àZº¯¢&,°XØàû[šjä—ÓÅ,J ƒœŒAk3TV‚ “äE‹ìÈ0oS9ÎqaÞ(P,j'û~.óƒîr±#…Ï!_ÐÁ«ZÏ竧¹3/ÚbÞøMƒøG°òÇ›÷Ãóa;ð+:üþ üþÏxy+ÌÛ€äó ×q«åwD²€ÜîKdùÇ–8ñŽqÜ€It>E…æŠ}Zƒd·CòÛGò æº{Ü,ËË?Ëo×Éøi1[®ŠÏYKà¬þ?àÜíY¼&縱_h«¥iÜ({”» ìš<Ë•«\$¿90¹sk„1QÓÉbmiˆç,ÏC]¾Èä>¨ûÏAýHR¼êòµ .ÿ¨ËÎÿ¨ßjl ߚƳè?÷Ñx<èx¼sIÃö™>G§¤âóe¦ÏË›z—o–´ãa‡ñÎW9ÐW¹F€/ðŠM¢}”ÇÍëöx(Âé<”ÎCyÁÀ¿JRí}Ïk$Ýškنݾ“4‰òî(ñí`x•·eODª¿“±onÚÆïËO]ŽåNH¯îÄ^w¾D»x˜fº„ÿÌÒ°gäÒó4ö–Gz%¸XUûµ؈xºÝŒÆ;oäPoäöQÒÏhßZÃÛ7ðn‰‡vJç¡ì¡èMêæö­Ê;Ùðc±·r:öî<”Cþ>ÒgŽ_ÐCY¶⼃xç ê Üh$/!*MF{x,‡D‰Î!é’Céúæļšpg_õ¦I[¨Ùí¨ù zv Yè 5g¡RÍτخÂ`Ïþ€¯L,ÌöízÌ–i\ÞÓ—[ÖE„ÇàiNÑ‹9½}±ñ|ÎtBšŠç1ºÞPùÄÏ¢eþ(Ëü‰ÄÈâûòA‹bA âï©‘i^Éô›£œþqÊ<‹Ìp[F“˜5¼IÂCÆ=ÿ m‰€ùj­-Ñ’¹Ò«k‹ æ² ÖÅëºx³q²Êèb#ªgí{¾u;Ê’åî?6Âüð)k)ƹxÞZg†<õ¬Q„+<жÖȘÖôƒš+/6èe>È-%·n3SfqŸÊZ™ú +ij¥[VF¥K¯ïpbyt>3ÊR“„k;‚+º(¦Ès:ò4*„©^ÏZ•¢Åµv"¬`×Yu/ŒŒhqÔ4‹©KØh¹Æ都e%,ºQ¦k\Ü¡”æ~GNXs«8ÍM输xgQZ?b 7lz׸. øSð’Ì÷7ÐECw]Üâ1åX· Ecc@U>ƒð]ÙïÑb~Oñ'ã1εðfF…BZà³%MXt…| +Œœ{°xBOå:òÅÍ 5W~³Ø\ú ò¬réõu„ %L²EµãG3:%£D|͆ Âɹ¶¤°Š©Ñ„Ae˜rQþ‰Ñ†KÛaí"Û}4ª·’˜O.ÓhþšTä7®ªhà”Ê­ ÈlÒ§ÀÍsûœ}C`®ÕaW¾*´ñjd^è¿ôÕ Ë¾m +Á‚90¯è—Z¦1ñ¯[/'“B™ÂùìŽi\íò´ ™¬x:6¿T0Cim! ì’¥£;½%U–¤ñ/™fsæ—²i5PÍRV— ØÄÅTßÄšP–tMU8?LõŠ—’ví$C¯f-ñ +Öª·%G 9>º¤ýŸ'ÈfZ_½ŒMDÉ&zR"jÐ#ÔóÖ“TC#k +ù-— h¼™<Ô3äÁÃçÙã¦JÕ$‚áøÛšðDVÇ‹˜6ê@ÂÔ‘f–1%Gôo‘½û+ õÕ7ŒóKÀ M0©1!Žk tÖ@Eøå^óB?!4ž Êá¿Õ7d®Væ´%pÈÕ*£öôƒjǵIø¤iM˜ÍY36Ó£f<¦ocn‹ÆHKI‘èé_ON*¨4oèv0O"^a‹_ò†ž HQyb»õ0’ÎÒ¯qc%ÿ@ÕÜ9˜`Þ¬g&«œçs˜‰›êsÝñJ½ŠÖMhÐoŸh[…h­ã.húSÜšÆM& ~øÌ#䊛0E3Œ©2ŸÆ©ÑîöQçA8ãed1áúÝ»ºÅ²Ø¦yËñ­pÃ:.–RpQ&5"Cø¢¬øëÆ ;ÄTίöiãLA¹,¾C$©‰'qeŠó½ÔžÐ÷qTAƒJÈÿÒÀU¸p©WXq9­Bå:WT®cœGÈÓÍ£úݨ*4"·n—7ºAn3qìY¡¿ìÍ@\EõiùiârgõËaÕéÉMúþ7÷»'endstream endobj -4838 0 obj << +5032 0 obj << /Type /Page -/Contents 4839 0 R -/Resources 4837 0 R +/Contents 5033 0 R +/Resources 5031 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4819 0 R +/Parent 5004 0 R +/Annots [ 5038 0 R 5039 0 R ] >> endobj -4840 0 obj << -/D [4838 0 R /XYZ 85.039 786.531 null] +5038 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 191.093 150.733 202.782] +/Subtype /Link +/A << /S /GoTo /D (smbgrpadd.sh) >> +>> endobj +5039 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [436.437 163.994 503.126 175.684] +/Subtype /Link +/A << /S /GoTo /D (smbgrpadd) >> +>> endobj +5034 0 obj << +/D [5032 0 R /XYZ 85.039 786.531 null] +>> endobj +5030 0 obj << +/D [5032 0 R /XYZ 85.039 766.606 null] +>> endobj +5035 0 obj << +/D [5032 0 R /XYZ 267.924 772.58 null] +>> endobj +794 0 obj << +/D [5032 0 R /XYZ 85.039 364.87 null] +>> endobj +5036 0 obj << +/D [5032 0 R /XYZ 85.039 322.523 null] >> endobj 798 0 obj << -/D [4838 0 R /XYZ 85.039 384.808 null] +/D [5032 0 R /XYZ 85.039 266.673 null] >> endobj -4841 0 obj << -/D [4838 0 R /XYZ 85.039 341.854 null] +5037 0 obj << +/D [5032 0 R /XYZ 85.039 232.533 null] >> endobj 802 0 obj << -/D [4838 0 R /XYZ 85.039 259.512 null] +/D [5032 0 R /XYZ 85.039 149.725 null] >> endobj -4842 0 obj << -/D [4838 0 R /XYZ 85.039 224.766 null] +5040 0 obj << +/D [5032 0 R /XYZ 85.039 114.98 null] >> endobj -4837 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F20 2961 0 R /F64 4112 0 R >> +5031 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4845 0 obj << -/Length 3749 +5045 0 obj << +/Length 1949 /Filter /FlateDecode >> stream -xÚ¥ZYsÛF~ׯÐæE`Uá>ò²åÈöF)[òZܲSI ”°%ñßo_3 *U[.ƒ™ž™žžî¯Ð=wàŸ{ž„¶ã§çq١·gÎùŒüëÌŠ¥, šŸWg—ÃèÜuìÔIÏW½NêØa¯òß­«_Þ}Y}øºXú¾o¹¾½XÆqb}\¸ÖõbéZŸ>@ëG}ýõÃÕêöë"ñ­ß¸ëÝÍ{lÖýòîëé^x‰u…ó¯pþÝw_ÝÞ¬¾âÐí§»ÅŸ«_Ï>¬ôŒ#º¾ìÿuöûŸÎyGýõ̱ý49¶c»iz¾= Bß_Þ«³»³ëµx,8çYsÒ -ÂÄNalé;v’³4qj‡IÏ0´£ Öõœ‰ - Jô&ÛpÞ(¶îvÙº8>¨Ä°ern,;ÙZÑLövCcoŽéƒÌÍ?ƒ¨?´¾•5>oPÚ/öÅÖÍ*ÀFd]òÃsœWi~ÿÂÏ?7€yUw×q_MçѯÛláÅÖ_îKx)øe¿ãgßÈú¡ì·Æ°nÖfëžk²`lU ²úð# - -nÆ¢ð -S:Ón®¿©ã{ㆎgá¼l‹ËÐK†‡>pÇÀ ¼¸Žçs‹9Ê‹lsú¢•%„0)A#ËžÙ+†àp:ãk¿Vͧu­²‘&Î)¡Yçø?±õ¤+ æáwÄd_®÷´à0±¹—¶ÚÓqwê °<Ø«—$°Iô,?"ÅK(;~áglÕMÏ â°áv‹l=4ꪚ}Wx¤¹ïô >ãÖô–ó`&kgxK•¬?è µ,lÓ¹›A:(Ö¢•§²ÈÚ{ä¿oiâ­È¼ØvR&ûFªÖ30}Füaø9¾7fÉ·Ò“1ñG\½©˜#@$M˪#ú9k V¦fÌŸiþ‚*QÀãøoAsx A9HŸDKØÊבÀÊgm¿ðàê"@°¸·8R4–Æx%vlœMãQÐ@m>Zç@ò¼q-Cï[î^g¤L²B¹áç6Ë =žÍ†YKlŸ;þpB§,~èA/ÃQÙAì´pÍ–A4BO|eÅà22:<÷úü˜C )^û¢î)‚’À³®7ÜÀô hȳš_øÇûÇÇðˆ|ˆíaûJ‰É°³ø¥Uò6,½f—óS×âÆ·ëÜá9úrcƒM €3O€¯Ã>Ž•—š­5Ø{Çg¤9mÁClÚ,eð£˜A¢¬–å×Æ1P«àØ÷´d<5z„ ð­;Øæßg<¯Ü¨±¿ïf€‹® —v}²ßõ¬oh™5Â…@$‘aÜf%‰÷ƒ¦Óíã¬ç²Ù·¡¹±…ð¸ïyb)OÞa‰Gîx!…ó8šÉ–íõ͵ҿCQTå:ëÙw¡üÄZ'’ëŸ - ;t¬ã )/L­]ËçŽA3@ 9²†ýuÃOök<â#)AIóev/Tbûí†ðV‡k÷"‡}lwä„Ñ/k-À9JàÄ [‹­yB©ì:<9ƒ8$˜¿ÂééóÆpάEÚã˽ -XÀÚób“á~UO¡¸Ç’V”¬hY­V¡Gôt8““u ãaREÚðsµìœ6 -nËà‘×lP,-2|&¡c²àÚÇ"ËycXz‚!ê‚QEsÁ†M‘õû¶¿Ù^ÚWFX7·+pÐŒFžxjéSмíXÉ[žX?p7á ®žç±±>¦4õVíw1QW `GNf!`OûC ·ÁùUÅ÷_ÖN„NŠÇâb{OŠü×~èî¡%Λ÷{òÕÔnêظJºK0"=%ÎQeŸŸfTôóoã”Ï^}Ç‹pÒ÷ÃDzRàk÷¯Š¿Ä"(<Œ²G!ô]FnHi!Þš³NUEÖ‚ûNF,pn5fòäŧOèè¨Ø9!éì´7•q¸§©—3A™ƒM¤†€™WÆm’Ôºzwý¬’‰ŠV—ÅkÙõÿ€ó9©õ3¡­ÄÚø”MmZdk4=CŽ³”T9˜¶„DÎñH!w…®)‰G(r™Š‘ >%Öž˜àø|^ ¡7´w`ˆ†ÖÿaݳÞi|Ñ[ùÇgµÇÙJ/±ÝyiÈôT ¢5ÇiØbmµrß‹Š÷ÑP°ãž­W]¯•K‡iå½ÊvRN.ñ©`š†÷%yºž¡½2àA3\WÛaÜ­—V#Õ0C"ö™õ Ž‘p©c&Xå ¶# k Œj*²{ô²ÔI JàÞ§w{5–9ÅħòŒ lÇÞÌ3 š“y†¢A9¾Ç<î¢ -Ã(ÛØeôža?Är£T#‰!ˆßdJÑL¸§©gÇ©;b‹¡Ã? ¾Ü4Þß±‡:¡ÇƒA# }ÏXBZÒUâMÑâ[q:¥ð4Öu³U5˜(L3•apÖ£ŒšIÆ’iž""Mj :— ¸•Zƒng‚ GèÄiezíbð¶°ÿCY«`@ʉ@xy!Ä÷FTƒZ‘%¾w=W#„xhZ– ÞÁ­T)óÖÌN)þèŒ0Á¨w­IYŠ\í½@½=aGBvèFGvŽÊ°#Ô!|Ûs%(‰œDTϳøíÒ¦AsQ…÷Òù‚é éò–Üüw]¤>³×P;‚x° ôÞbRÑL¸ÉÂÜI½dÄ&‡ Á´Ò )áCQCnJA±ï„CMS4{‹W³žYšßt|‰‹²ºè¸ -æDFv턆63{:øî –®ãÛhǨ؎“bëÂFmÇ0û層 :éËB¢¿,Œ²ª¼`ZÒ -1§MÛ­®õS^Æ|¼¦ì»j\àŠ”)ÁŽQÍ0RjîËBmLhKJç˜AÊR’Ø„%”È _Ê#«bž2ÀJ‡#)‡…úæ¨$/tu‰C{ ìz:lîÙ‰bóø3öi‡öó"Äl­l`|OW:<ªÉ¡5”òÕˆµ}©ï…z æâÀ/ú›NW™Öz<ïªj-ªJ£>×HT–•µL=ƒúËëDÜÔṙ=øºübˆËú“ñĶïÅo¢‡As= ì¹Â'v¾é¸†ý2GS 2aAJ¾Rí¦.u\pŠ#›¡/ºª"~ª ׇO“%u}hâ3Y “­«ëæâ… UBºâBhu¹(TD©×¬$à:Š„€ Ÿký*2¦1¢q_Æõ)èø|7Ž¹«Æ—õ¡´•¸H ]â–¾™+·Þ(Ãõ\7Â]‘¬ˆ£ã7ýEKBc¿°!*€H^~C-mÇétòLÑé‚8®½î÷¨Ø¤ØEëÑD6îʼnæN¼ý:÷m`“ÂTT)L¬ÇA®ŒŠÛôá$ s&!ªrÎ-r@öÒ–:ã•¥wd|H®>¦pZ’„cÎÈÅ!#²9›W2ÖeÚƒê´Ö¦lÏœùÄå&±¨It¹‰ú Œªk¸¥•y£“$Ý…éGÂN“d• ¥‰Í†MÆÜè3°îw<—?ÈæB#†G#¥¬Æ+m‹þQI)6¥XÂl2E¼ÐmŠ÷ã™_–ÄŨýÛ².»«¢-Sv*€ù¡ü™„úË2p£0!‰4‹=RtÃME®T>¶ø´pÁsšŸ«g8:§ŒØÏÑqà0¦^~*Iú(¥Wü¼RYé.4­x¼_×Ï *6hnšÖÈÁG¯½Ê©U0ZŠ[Éóǘ8ëGÎE¾´øÁ¨Ú¿Cv[‘´ùó•—Žö*kµó².‹|o|Ÿÿ5£Ú?›dÂüÿú¡£þÕgØiâ͇Ÿ!$¨ž«™AI»~rÌqè'\û3,ÿ2U<&endstream +xÚµXmoÛ6þî_áu 0-’z-ÐY›f)Ð4k\d@W ´,ÛÂôâIrÝýñ»ã‘¶lËí†"ŽGÞñ^ž;™]øãÃÈg®Œ‡a0_òaR ÜáV®ÜH¸C¹K¿M“W~0ä.‹Ýx8]h‘éüƒóâ÷‹Ûéå»ÑXJépÁFã0Œœ«wÞDè¼âýhÌ[”Λ‹Û[`]ß\ÑŽ¯øðœ7À»#ÎýõÍË·#9÷†qqó’ˆ÷7׎>N_.§Çó‰Fþ3øðÑÎá¯.“q4Üí2ÇÃbàù’ùž4ïùànðÇîZó†´«Çc+1. …8UÆ¡Q'ÔÉu`4gq,ú4q?b\ÃqÈü0èJ?uL¸ß“Ë/àNU Û×@å)9¢ÃŸ;0äL‚ûÜ®¦ó'7u¶¬áصšÃÿ9kVÇg¾ÞçöY¿ó¨ˆ}æ¹ÑpŒŽÙ,“}zþi2ËÊÉL‘2ô ™ Ûôêhì ß¹˜Ï‰hW)˺ڬ‰Ü4Y¹$²¬êBåD7M›iµ;¤ªrf•q &);”jŠY[¬—õÚu ‹´,²ÌæÏ?%ª%ñIÚ&“ŽU_­æt}z^W"Ù˜ÆFñ“gO c!?÷ÉMµ5¬T¹LüSªÂ²*znWÖÔ­YÙªÒpU}´ÿÍ=ï³r^mshÚn«úï»ÓrÞãÆdÝï‘ý;›©¿û6žúRKv½Õ¤6<“ŽC'OùÄØôë‰òÓà{°NÛM]yàêú%ÊÜ~[mòy7Ïòz[©õ:-2Ê×zÒdeœÿ”ò¥çÒé—ÌÜÚíA@ „Q?† ÿ1|D‚…þ#â^±È‹ öÄÂÞ‹ªüËåºÜԪ̀¨JjJÕ‚ž ª-°oÍ,'ø +2Ü1ëºxhWÀ4¦iA¦T]ú,½YÙºeǦ :^ä^e±ƒCeÀ8÷öM<ê¹ß‡e^ÍTþU EºyÈ#ÿ¼Ì;UÝ$5\…èç¦öÖª=é\B÷óveøݤ•Ìƒ^Ù—²¸’ÎßPïØ葧}¬ºÊœ™ÀaØDµW~YöÄ`Ìýq€‹žPtó@Âð Y@A4@.‹¢}^õÖÍërÝó> &)÷¡>ZärÝwð©ËG¡øçÎ]+YC/UA»TcžôÀÍS¢µ0 ¯U8'¿L¢x16+³ö +S¶1#ÍÑ¥B(;ß3Â8ç‘3]!ˆk`f \föZÜ)‘傺ãðyœ³(4™CÌz9$âÝÿ>ì c{^§×À…åIÖHh^$­ÜBDêcÐy m¼ƒ¶ù/ôœ¤ÚÔ#Ø”XØÃô³Á'L_`ž4aâKˆ’Êïð6¨y‘•:%Z€a¨ ±Í Ìš* ›ÀÍ8—f‹‡Î~«±E˜%²Ù` Zzɉ{MÞÐÞÒfO:o â~:¯F‘çXÍY¹Àõ¸§eÐ'l“¨Ó¥ªµU8wMcÛKÌ¢NÁ@t¼Ï}Ú–ÍA´@̱ݣPëž¼\˜¯ùñð–UNšlŸÄR2FÔöÎ KØÆUYëR"t©r’Zjù\2iâÇL¸gç +øP°á¶Pž´ƒüõ0^ =¹(l†¸\Öu5’®S7V{ +‚Sø·1ë U§… W¥Ä*+tò]ä¸õ2U’œõ‰ˆâäYÛæ{I]x¯ÑcuÖ裌´âý.Ѩ-~{)ÔjŽÞ—žÑâ +V:È÷œk62ˆ ñ¨]l)Á]”ËƨÉ̳¦'™³¢S©f²ˆ&µ½X±ø’î±Î+ @d#~çà¦:>Þ®­Èm-ŽíÈM*}á¶Æ<Õ›°_û 5é¯ÑE™–dgÖR” r>Èén +Æ*f‡="º1ÜÐüÞ9B”ö8h­ïÑêp,©ö‰RP‰dt)SF*iwMÅ›Ã>gIá4û© Ÿ˜TÌÛýÇÄ®³ÄÅf%¸â l”ŽàˆW# ŽÈò¦Çh$âœú¿]fS*-á6 ÝÄñ5¡d(taû.“j–w ì-Ò;£,54õ f2)…QLS)×cê)Xú>ã‘´±ðt–Ðl èušPî>†Q5ô®á‚wŠ¾ÌEM:¤5&¥JlŸ„Í81륭‚ùüpÜR€œ½ùÁ°)}ó¥ð¹üÔ1 œÁ~2:íKƒ³¿Íð¢çT/îŒPzZ³.5ó„€ëAìº?dLu»‰bȈ¦%*Aèì ÈµPXÒ-XÚ§Y¾± K:šðTf—B·Qáë–xº8qM˜!a„í”@Þë"ŸW’Í™èRûÌ&L€JÛK¢=DžbÇ +ÇXô¯¶%3ÑÜ7^j±ÂÙ¬ ~rзÄB­£Vf–Úï{'6[Tçƒu}zúL> endobj -4846 0 obj << -/D [4844 0 R /XYZ 85.039 786.531 null] ->> endobj -4843 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F62 4047 0 R /F77 4849 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -4853 0 obj << -/Length 2505 -/Filter /FlateDecode ->> -stream -xÚÍYëoÛÈÿî¿B -„ŽÌ>ù0p\ÇéåàÄWÛE[äò–h™0%ú(ÊNú×wˇ$Rq[È-wggfg~;;³+'þ—“ØB'“(«åd¶<“ŒüåD: -ß‘ø=š?ßž¼}oÉA"’Éí}Ë'MÂÉíü³wþËÙo·×S_kíILý(Š½÷Sé}˜úÒ»¼€ÖO<úîÃõÅùíÕõ4ÖÞ?¹ëìÓ;lïÈ~9»¾pÝS{ç8ÿçßÜp÷ùÕ§Ûkºº¼™~¹ýõäâ¶]@o‰RkTÿ“Ï_ÄdKýõD:‰'/ÐL’ÉòÄXX£Ýwqrsò×–™ ϲVCáË$H”=lÑ0 B¶U0*ƒÄÚ¾E­ B‘EÁˆ*€UÃ?¾µÂû˜®ÒE«˜!Œ¼wh쨲Yírªá#ÏÖcFmµÒ‡µìhHKiü®d`…&-o²*cߥèâÚõƒûh{îà;]7*ϸ³|šú*bº*­a /Wk»‡¯²b/‘ ]!‹EŽ? ¦™ã X>×%ŠÄÕû50ÁÛ÷¡êi¯bt¤…õ¢â³*Kë !Ÿ¬ÈÈ„Ü¡Á¤«t™1“-HX»V “`ÌÒ|=€¾(‰úôúôú *H’AwÅŒ(ðV`£-Ôíþ¶þ•‘Í &Q À.ƒ·LÔP5Däáizé]Ñø2¦ý-lcÃÀ„‰3Íé®i”†-F“ž{Z64{ZnÉÙå„â>¶èX0d† í5¿4H¬¸cƒóó¯ü‘®æŽŒÐ6/1Ú¼ìí+c1Ê¡%í-M 0m„1CÃ:ÒÚÀ@TÐ"0êLK> #b–Œ²¡IØpËQosñ¥UA@óÃH€,3›Ú‚5"Px¡[ÎØþ°«÷à ÝvÒcùß+Ø0;¬ q £m?Þ0¤ÿž¯ÀËZ¡—©ãÃÏÒžù®öÚÄ N|íf‡µ×!€MF[ÚÿíÓ‡pcuQÛ债Ï©Ž¤.t‡6)G­  ƒDÇ jØR`A°¤ ºc€\\Óq5†ÑŽë10zHG+1ú:.]0º/‹ysªV£ˆ<†®"éª# Š·U}œSFò -…[LEá>&ã “FA.šŒc221ÊåT”Œƒ±cw 0RNYÄRn)W5`Ä€ó<C݇ÔE<&Jm«»üÏyä ©Ðšr È5œ„ZÊrq×eÀì؇”S•ÒË òn÷½j|ý2¤‹Ðcèß!ôþ6”ÌÖ–S¨€žŸeÙækÐö( 8"`!‘ ó];ê¦ð”ÿ[…Î;#ŒßeØ$ "®“F+oð -­»_ykWy¿ÇRd\usi€å7V5äŒÂ«¾q×Ùlå'×ðy^®ê -\:\#ÚHAApøΠG3Z[#Z,A5Žé òVPÎbÉ‚Ø¢âç‘ûÓù’*šœªäGÒšªlÌêý®Aqª³‹oÍDøzÎׄF´@ŒeA%=ç -›ÕœØæÄ!-x¨®Rº¼hËwèkÊz•x›´X;I+ǾÊî}´]ÿ,-1ã„mÅ—®$µõÖ.ªÃâ/ë1í‚n&ædëý.¤)ÜT'ÐE{iŽ%§B/^QÄ v™¯ùú‚–EB \a¸†(Ô©„¸Iïãf†c,fÔ¸kî•¥b·UɈ :¨fbüH9úÀ²°pÆ^ô* -bÛ­ËÊQc†\r“üV:c!ç—O´O¾2Ñ}:Ë‹¼îÞØ]än¥øõÛÞëöûK†ÍDÆ\·U»ÁEÖ®(ùà˜yé°üžPÈF͸P½%T Ýuä!¡dy)d4.UmI5£Rw¶Ç÷¤)‡¯”îJµ.ï?6llJ|c³,ðì]69âš»Ó;>ðÐiNHìoÁ§ö$^g|41ž[0t_a†cŒ #HR¢ë(\^ÔpË4ϺөÚx<ƒ¤'Q•§ÀKœxçˆYž´øûâ½‹Ñ }«Çn]uÙ¨éÎÇŸ|Ư«¬r°‹ªÜuR»T½yܬ:Ò|ïQCë$°ÊL¤‘ôuU‹ 7®ûOBŽÚï‘Üìð¤Ô£·PÈÒí+a§`‡ï]È(}ÕöŸ³‰â°:Û\ÚGP\ Ôª¡ÜJ‰Ïh+a!¥@»œ7VTYz¯ãÏ%•! ]ktÙ´[%ãäP2$€®?ÄĘ®çÚښTAa#ûcƒÝÏSk±Lm -·ûQ ~ßœ§N觫Û7Üâ¹ã{ –ŒÖui“©2¢Þøo‚ ¨når ÎªÁí1§wÎ~­­pJmÈ*”1×½'PA&Yñ6 ô}®Ùa² Z_¸h³À¼”—yŠŽQü¨/¼ŸyŒ—€ZUn ÝÍ+̳ç|ÖEŽÇ~7ÿ®pg̬Gf=mÍzÊ;݇²ŸíÙº _?³š‚C{ïJ*í©}³«2¯ÇÞþµ ŒÖÃw^ß¹Æ}ÕW{9dâ ‰GžÈ­R’­2|«•ìjluØX¨üo¾ÿ2:endstream -endobj -4852 0 obj << -/Type /Page -/Contents 4853 0 R -/Resources 4851 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4860 0 R -/Annots [ 4859 0 R ] +5049 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [495.92 367.731 539.579 379.724] +/Subtype /Link +/A << /S /GoTo /D (set-group-map) >> >> endobj -4859 0 obj << +5050 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [338.528 138.234 418.097 149.923] +/Rect [84.043 356.606 105.43 365.629] /Subtype /Link -/A << /S /GoTo /D (access1) >> +/A << /S /GoTo /D (set-group-map) >> >> endobj -4854 0 obj << -/D [4852 0 R /XYZ 85.039 786.531 null] +5046 0 obj << +/D [5044 0 R /XYZ 85.039 786.531 null] >> endobj -806 0 obj << -/D [4852 0 R /XYZ 85.039 766.606 null] +5041 0 obj << +/D [5044 0 R /XYZ 85.039 763.817 null] >> endobj -4855 0 obj << -/D [4852 0 R /XYZ 85.039 746.277 null] +5047 0 obj << +/D [5044 0 R /XYZ 314.538 769.79 null] >> endobj -4856 0 obj << -/D [4852 0 R /XYZ 85.039 704.637 null] +5042 0 obj << +/D [5044 0 R /XYZ 85.039 492.829 null] >> endobj -4857 0 obj << -/D [4852 0 R /XYZ 236.167 710.611 null] +5048 0 obj << +/D [5044 0 R /XYZ 225.25 498.802 null] +>> endobj +806 0 obj << +/D [5044 0 R /XYZ 85.039 298.394 null] +>> endobj +5051 0 obj << +/D [5044 0 R /XYZ 85.039 258.23 null] >> endobj 810 0 obj << -/D [4852 0 R /XYZ 85.039 599.775 null] +/D [5044 0 R /XYZ 85.039 186.647 null] >> endobj -4858 0 obj << -/D [4852 0 R /XYZ 85.039 565.029 null] +5052 0 obj << +/D [5044 0 R /XYZ 85.039 151.902 null] >> endobj -4851 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R >> +5043 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F18 4228 0 R /F62 4159 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4864 0 obj << -/Length 2235 +5056 0 obj << +/Length 2047 /Filter /FlateDecode >> stream -xÚµXYoãF~÷¯àÛHÀ&ûà1oÉx×,’KK´EŒD:$5²°ûã·®&i‰žH‚FÕ]ÕUÕ]_tä…ð/òR„:ó’4¬Ž¼åö,ôž€ó³H$|ñG2ß,ÎίmìEa…™·xìõda`³Ø[¬~ž]|ûñŸ‹«»¹¯µžE:˜ûI’ήçÑìfîG³ï¯€zÏÜË›»«‹ÅíÝ<Õ³óÖÇO—H˜Ù=ˆ}ûñîJ¶ç*]àù <ÏÛ·ŸwȺýþ~þë⻳«EÑ#­ÑýßÎ~þ5ôVpÕïÎÂ@g©·: ¢,ó¶gÆêÀ-ëÍÙýÙ¿z]Ì3Ÿšz-'á«0H”:5—d‰˜ÓGæô‰¹Ðó£ ËÔ”%íD1èÔÉXäD40Ö"Þo^`BÚw¿äaj² M2M;:‰ƒ /(ìó›mê]Öà˜7øæG& -Rz~ê L{\ı—ü°Ð¡ tšz6ɧ„‹_Bæð_t¨(³U‰gM¤*›ºÑÉs»3þè{¡Fè<ÖŒn\—O»¦ø¤„Nòæü:²£c± -BaHòŽÝU± TO¹Û»çdNÜ{eçXš»ý‚p.š/%À¼@Àïêõ#ÿî*ä¼ðâyî“ô¶l[”-ë -˜-gÐ/adŠÍêØ£Ò Ììמ»¿‡6bHxz&ñÔ]« - ý¹CÄ« ±Mâè)G#kƒ(…K%MìB™2a@ð-Ä,4ê(²“Á ^½@ò-Fä¨MÁ¸©ÖÑ ¦4T0μ‘¡ÓXˆÌ×½9Öôw®K^û’j(jÊ—SŸDöÄ'=ö)Š2ÒžITAÐ'¿Ù¿4þ‹ïûàÄcöC‘W퇹o•-Öõ¾*&±|ìÚ¢¡ -B;˼b¢)òÕ{&÷MÙB/År×ÑýÀÃåb5=蜑§¦Þ=O¨d*¯V§êBVd8g‹/Es¨+QWlÚâHÛ§Û«Ú)=të²z§ËnÍTÙ½ÑŌʨìÿm Ø·{£  X=.ÒYL ÃËS¬ŒMI]W4-/þáý©íÞñª¥BÖá"¡š•piê ±®äìcÝ°dçT︨AAl ¶&MgOtOaèP˜â„D )¥³ásÆf³±gZ"‹ZQ @ˆ"µÂvºbØ3w"è/d‚ gI“ç)$Û’x$7D>_ ˆ˜(›bÙÕMYеÓN –wñÉFÙÈ_Ë@ã¢2¿9ð™ò‘º{£Ö~Iurñ lÜ¡>_ó“ñ6½D¾þ:oïÞêIÄxÄp5L§ÞJ%Å—Ùø ?ÉôâE'°•àr_”ߧ ¸º¹®Ø¼d¨ fú8S]¹Äüù0ÈtÈÜåUý“/ÿc5ÐhâlˆAŠ¦dö¶Ì~(;&( ðÛ_ µ(Éùç$J©ÁÁÙ†Þc¶l/Ö{‘‹J‡5Ê¿º<¡nãEk.-Q¤ÚÆÏ4¬XcU@¦“aTîº#TÖCÙVå[: ‹º"Èõà £Èœ u'rrò¿²ÆØ às"¶ÑìÇ’^ºÞuNTÞ=°`²Èó÷6a§ÃD‡¤‚ÊL Õª`üa#:v ÉQE@FÝ{6qéŠJÌŒ–Ø pçÜCð'1`3@Éuë‚9í¢…«[ˆ \Üîñ%†\È(eåËšmáé9öȬ)¾+>Fɻ⽃[?¶˜©ågŃdt͇&KÂy·}–l¢¸ä§y.WDzJ›•]å ¿›e*‹ûh«,2CiÀU-¿Øàç&XÑWè%ÓŒ VDÅ€+1²0CI¿ë]¤QÈ™7•]P|ñî–uáÄ7&$’|zÉwîv+Ú3¶K9\Ší½k”NÙÚ©ì“lÁ‡IŸmH£1УBÆØ@Ïk¡‡C¹ýºnéH:{×WênJŸOúóïx›‘ û™a?¨Æ‰¯lY„†&öZ -JËW‘\¢Ç‚úùMmÄ@5ñbŠJ?Î\ -b´£6uÒ -ËQQE1®¤H¹î…ô~Í=bÍËRDäv -êôª×øX9]’ ¸`H #Cï›赫Š Š8!ý•lðÏÐñpÕ®éÉ7b¬=:ð°™‚ V3F<43é¶hšBb4ð¾CƒU…Äø‡aýžC…Ÿyµi·!js+”H1¢ -¾j^ý0Ø€ËR,BtJ8œI÷-ƒYüFAÓ_:ìÚ’!ä6ã÷°'Y£õ5š^|rNÌx×ÊØCØá¶*}¼KJ®êÎÕÇÂ/"¤Ü%µ€„†’]_tõ1dЊ\{S#¼Ioýº¦§…T+¾ü•þïºð(3Jy”nö~ó¿ÿò¢ãÄŠ;V^µŽ‘wŽ*˜¨ñûj˜Îi—^¹ÉœÜª„€™4•ái‘Ê5Ù}9EþdêSÃ× -€†E£Q®›Sƒ¯æ¾© Úz;<‚/]÷ëDl[Ä÷SËë¾¹<‡ˆ¾yè(y œa*N/?À›²us–œ‡EE5ø&c’ý ÀÑGÆÁéVÙkØ˽š…\p°.›H† ùH–Ž Æ3 ,\ÜÌ8–ªnvNÅä,Š ì»nB3}7£Ä€;«Š=¯‡`rXÁØYàþøKÞ<þIÑ@hŸTrÙDâ²™úPÂÝ>ÔF" ™‘tÍ™øBCA3ð9‡˜£á‡7¸Ú‰:ç ×þ˹12[0£/0°Ú[L²Âå­îKª'&úÊè0¸ e…ªª–ŽÔЬtÄq½H÷=¿ (ÚmðÆ_7´ ŒÖÓÜßþ¢?n¤A–¾ñ—3«T ¢Þ|ŒÈ„Ç[6Õ.ÿ[Ð/endstream +xÚÕYmoÛFþ®_¡ë}¡€ˆæî’\²@¯ðʼn/E“øjé¡íJ¤e"©#W± ôÇß¼,_$ÒqŸ;÷evgö™Ùgfe1÷àŸ˜Gë©x®£Ð ”˜¯·3o¾™ó™°ÞÜw½0À©¿_ÍN^á\xnìÅó«k¹Js^þãôâêÕ/‹¥RÊÒ],µŽœó…p~YHí¼‡Æ‡ÅR8(!·§0ôæÝ9¯ø?¾óÆ.yäã›wgï2r>ÚÓwgÜøðîͯ‹?®~š½ºظô]?Thä¿g¿ýáÍS8ÇO3ÏUq4¿…¶çŠ8žog~ ÜÀW¶_Ì.gÿìvá9Ϋ& X¶Ké¹Zʱ:k«N©S#u`´pãXNi  Òó¥vŽ¿äL¸äÕ ™lõ´ŠŒ1ç¨ïñÓÂU!|¨éá/×u;î ;ÄTü½Ì «@·×Õ~ÇÃèÔd‡&äåæX±ð=×?RzÕ n2Ȫ°3·ÈôUýi™À¹a¢Lá?ƒLEÊyâuc^"tàFðª, Ò}ÄHJÜ+“m†Ë›‰áκÚîÚU·9LQËÜd,òmnƒÚ«6S"pªkþҦȪ`&¥“Ÿá‚ÉØÙßáF'¯C9@IÀ]B[¬È½hRš²ì¢A ¬hsO8˜lkµVŒbÈø*Ö]Weú'#'7,„ö–ˆég¶ OÖ°­C»÷-ÎÙÃgk€îÑXCø@êó|yƒM }Ufâ*„=’ºÈy/p Žyò~ÍMÞ°Ô‹òÑÎd5&ÔNR¦zßÉ*”¤ë&ãájg@­U`·¥ÌßmB¦áa“]O:ë,1vqŸދ,|÷ÏÙ8¾“¬×x0Z>>÷ £m_5&7{ÃØø€ùuU³†"-|{ÉÁ$á¤*¸mXúÐŽ²ËõÙ Œ ´ +ynèc¶Í6v5†5…Óšüƒ·n_O߃ÆK!¡'+ŽÀ.¾leÑÖÄsTÜ$¶Dئ¶"hÉ*Ú¢ï蜸k{Nw‚ú l "õó®Ò=gI†r QÏYP ù.ìŽkL~š¦X¤Pø‘QaˆFEJI-mä…Pâ,¹Æ±}CQÀm^¨a!Å’Nt¼O…•™í¿^( M\P4—ÁçTÂDüen¾„ØLWÉR1Ò)»=³ —•uTC´d‰º¦KÏíîàå0»Å5}[ +-}(¿w.U€)…ú·E¦øñý¡H)x¼g•Ï¸¸®Ð Žrv'ó¡«¢ðKA~]P¨‰  2ŠÝŠ]ª×¸iªA$0)…ðÜ·ZçC+«– é¼þ»PþÇŽˆ<¸™H³ØÁ7üaÇPÓØo‚c)·ÛúÑ÷$˜O.À# Å™W q±héáÖÒQ?NÙ“c³ŸqJŸ0PXC<²ÅHû¦(ÄLíðéé{=c§•,,&…ªøKÊ“5ÚqÃ#|³m(k¦*–žwwòëw.è>\w÷¦+zª²UÐV= VÛq¡ÐοPò A Ô:)qª²ÖÚ’áè´í…óÃÈ9Ciº%ì1ˆ²E+"êçÉ…Ä6¡bûÀšb—·êá©A‚Édo NL¾¦4ùÖkžGu Îs6†×bÑŽU—Ve{\@òôXŒ^Çø-UÀ¦P‚Ýs»¨6J)îçV&iøÛÑT²÷µÍÕÏ+ R-ˆWMú!¼Ó¥½pô„pÌõ"e¹t\ç…‘@µm×Rµµ‰Õw7•Âm3¶ùš¸²`'Ù×5RCàúZÄÇC©þû Ú‰„+ãIÞ Ñùµþ0íˆ+G®‡üv +L Ýñe‘ÓõûÄ "k÷Ðà€ÄK“ ÏÖ†yvÉò*È+éƪ•ÿÛĆHÿQ[}¿¬JSS:¢¡°ŽË +¦î©Ýu.•íî[A°Ån«¤in»ÔQ§ÍDðO¹¡j#Èñ9-µ²ÏêøÛ½)ŸÑ›\+0猡‚«†íOÓÏ ÕRë–Q'_N+ì…ªx ™èÛ‘Qÿ·È¬YŒ±)ç¹ðñŸ›~<às.ÍÇ0(ßU¡zöKü×~FivÕþŠ»&$ô$¡ted—]T·˜¸»ß§²b—…ðG?€:,·eým^Øb¼Hè‘k“±}ÀõeþÎc÷¾óùw.è_ µÝŸºˆvåpãAYFéM@ /ÁÓ¿?Øe6‰/]-õ$(“˜pË;xñ?.¾ç†¾þöp ÿW˜dŠ9¤\¬¯c…¿uM?\¬Óžöw¥]uðåbÄFsÇìøÚGzRendstream endobj -4863 0 obj << +5055 0 obj << /Type /Page -/Contents 4864 0 R -/Resources 4862 0 R +/Contents 5056 0 R +/Resources 5054 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4860 0 R ->> endobj -4850 0 obj << -/Type /XObject -/Subtype /Image -/Width 602 -/Height 267 -/BitsPerComponent 8 -/ColorSpace /DeviceRGB -/Length 7907 -/Filter /FlateDecode ->> -stream -xÚíLUçýǧC°p'süh7Q+P©÷J·XìRÖ`§Ù Q»™iÜ’®%”Ç’&EÛ’NÀÒ®»³À„¸îGš6“ëh5‹.ÙIœÉœé¦ÝÊ¢ØÙué2ÙÄVP~¨ðýÄ“Üï͹Ï9žË=çþ8¼^ÃÃåÜç|úœÏ‹çyìcðÿL[€*Y¯õ¡VÎ݉öÂ}‡ éðÔ -°ö"­³^jE­èHÀÚÆTŒZQ+:°ö°!£VÔŠŽ¬=lHŨµ¢#kR1jE­èHÀÚÆTŒZ%x­ð¿kܽöycCl8j¥{ l€ ±!6ĆØ –k/üßÕ®X±âwÞ‘ƒ¿ýío^¯7ø²öööeË–¥¥¥­_¿þÒ¥KÚø7vîÜyûí·ÏŸ?ÿ¡‡úè£ÜgC£uâĉûî»oÞ¼y999?ü°yAä»@~~¾¼Þè{“´ÃOMM=ÿüówÜq‡\ryyùÇ?þqå%_½zõñÇ_p“šššññqóò-9ØPYŠð;Q>þüç?_¹r¥Ðçó½õÖ[q_cØfÕÞPn´––9x饗víÚ|Í /¼Ðßß?::úÌ3Ï<öØcÚø÷¾÷=鄃ƒƒ###O<ñÄ£>:{l¸xñâžžž‰‰‰sçÎIÌ "ßõì³Ï—ò{“´ÃËjikk»råŠ\ŽtàP…^òŽ;vïÞ-ëG*óâ‹/>ýôÓ·´¡rɹÀ†ÖKQWW'+D -»wïÞ{î¹'îk ¬²¡l ¿üå/ËÁ—¾ô¥Ó§O‡¿æâÅ‹¹¹¹ÚñwÞ944¤Ëm˜••5{l(?œÿøÇ?ÖíYŒ -¢;‰ò{“´ÃHgVê,ôe‹- -¾L.£˵ÿûßÿ§NTlîܹF=jdd¤³³3;;Û¼ ÊYé¾7I;¼Ì_v.·´¡¬™à>E–ìÌËk´ä\`C£RèîD#ÆqaCp· /^ÜÝÝzžÊÖ/¿ü²\à{ï½·cÇŽàù;::þõ¯Éøï~÷»¥K—šD7+å÷&i‡¯ªªÚ¿¿¬¾¾¾êêj#nß¾Ýï÷‰:Cÿg™Qy–œ lhT -ÝhdÃ8®1lî¶á¡C‡–-[&?¢ÿÄÀÀÀÊ•+u3yðÁÓÒÒrrräf”8ƒ°^}õÕ;ï¼355µ¼¼ü7ÞpŸ ßzë-©FJJÊŠ+^ýõàùÅR _µjÕŸþô'ó‚èf¥üÞ$íð²Íy衇dm”••½ÿþû™™™ÊK6úR£ò-9ØШº;ÑȆq\cØÜmÃpvïÞú˜t:Þÿô‰o˜ø^˜˜˜xå•WìÚÄÅì¿#ÿ6kOÉÔÔTaaaècRlˆ ÍY²d‰ìAÒÓÓ7nÜøßÿþÒ‘X{ØpÖî ©µ`íaC:<µ¢V¬=lH‡§VÔ -Àѵ‘Ú¬wx VN܉ØÒá©w"€½ð»Üü þÕµâ_XpßaC:<µÂ†¬½Hë@Ŭ×ZQ+:°ö°!£VÔŠŽ¬=lHŨµ¢#kR1jE­èHÀÚÆTŒZQ+:°ö¬OÀâ 6¤ÃS+j€ ±!žZQ+lˆ éðÔŠZ¸fíMMM555åæ榥¥=øàƒØ0ôÌ@ ??Þ¼yº/Ý}÷Ý}}}rÐßß?gÎíøÝwß•qÝ+{{{‹ŠŠ&&&äxrrréÒ¥]]]níðÉR±øÖÊ}ë -Àk綾^zꩧäž:uê6 =ó³Ï>ûÑG…é»ßýîË/¿,?ýéO=Ï‹/¾(ǯ¾úª¼>üÅ{öìéèèÐ^¼cÇïw’¥bq·¡ËÖ€;ÖžüŒúᇚ‹oÖÚÐèKo¿ýö–-[ä`ýúõÒ”JJJäø±Ç;yò¤r÷ýè£ }ë[ߺ~ýº»m˜‹» ]¶®Ü±öRRRä¶Â†‘^õç?ÿùááá‚‚‚7näååýûßÿ.//7zqooo]]|ŒoÅâhĪXÂÚ0I×€;Ö^nnîøø86ŒôªwìØñÜsÏÕÖÖÊñw¾óÆÆÆ'Ÿ|ÒèÅò%iq_ÿú×gíÞ0¡*–È6LÆuàŽµ÷øã=zT~•ŸBëë뱡ū>qâDFFÆ‘#G丧§GŽ;¦|eGGÇk¯½&{÷îݹs笵aâT,‘m˜Œë -Àkoppð«_ýjZZÚ’%K~øÃbC‹W=55µråÊk׮ɱ|\±b…üDþ²¿ÿýï^¯W{ÙÄÄD~~¾´¸ÙiÃÄ©X"Û0×kÏÝ6t_Ũµ¢#kR1jE­èHÀÚÆTŒZQ+:°ö°!£VÔŠŽ¬=lHÅ’«VŽþ 6¤#AR¬=ˆÔ†`½ÃµrâNÀ†ØO­¸xÂF}¬¼ÒÝ5tâɶ[+ÆŠÀ†ô.ª„ YQØÞE•°!+ -Ò»¨6dE`CzU†¬(lHï¢JØ€ é]T ²¢°!½‹*aCV6¤wQ%lÈŠÀ†ô.ª„ YQØÞE•°!+ -Ò»¨6dE`CzU†¬(lHï¢JØ€ é]T ²¢°!½‹*aCV6¤wQ%lÈŠÀ†ô.ª„ YQØÞE•°!+ -Ò»¨6dE`CzU†¬(lHï¢JØ€ é]T ²¢°!½‹*aCV6¤wQ%lÈŠÀ†ô.ª„ YQØÞE•°!+ -Ò»¨6dE`CzU†¬(lHï¢JØ€ é]T ²¢°!½‹*aCV6¤wQ%lÈŠÀ†ô.ª„ YQØÞE•°!+ -Ò»¨6dE`CzU†¬(lHï¢JØeÎ?ÿùÏòòòùóçËÕ­Y³ÆÆš‰ÁâØœí°}J{÷î½ãŽ;-ZdòF1«$6¤waCl8;WÔÔÔTqqñž={®^½š°zJ:q’´´´óçÏ'`U±!½ R«ÙSŸ“'OÞsÏ=áãË–-“‹3gÎâÅ‹ùË_+ É'žxâ›ßüæ‰'"íÛ›7o>xð tww˱6("X»vmjjjIIɹsç´ÁÑÑÑÚÚÚììl9OAAAø9uǺ­“òœQŠL¹;Û·oßg?ûYÑ™Œ/]ºÔdJÖwÐ&ߨT^¦Ñ”°!½‹*aC{WTaå’»ºº¾ño}õÚµkøÃrssƒøÚ×¾öŸÿüç÷¿ÿ½è2Ò>áŸÏwöìY¯×;00  nܸQ¸ìL8|N[]]ÝÞÞ~ùòe#è®N÷©òœ¶lët_úÄ'>ñ›ßüfbb"š}œñY¿L“)aClH•°!64"(møî»ï>üðÃùùù·Ýv[è¶EvmrpãÆ[îzŒÞÎãñìß¿?8’žžœð¼yó´Á­[·šŸÓ܆Ês:aÃ7ß|óî»ïÞ¹sçàà`ìm¨¼L“)aClH•°á,¯€ þóŸ‹‹‹ÃÇïºë®çž{îÿø‡è/Ô†»½ÑW¥WK—½LèöJ3l(Á稺sŠ…å`||Ü܆Ês:aCall¬¥¥¥°°ðG?úQŒmht™FS†Ø*aClhÄÔÔ”×ëmooÅè:í_ÿú×?üðÉ'Ÿ´Ë†/^ôù|§OŸ–r¬ >òÈ#¢ÝK—.…¾²ªªÊï÷ëv7yyy===ýýý[¶l ß%‰¸ƒŸ*Ï©qÿý÷ÛkCáúõëï¼óΧ>õ)“)9aC“ËTN bCª„ ±¡ Ò´×®]«ýÞEð?ýä'?!~úÓŸÞ³gÏÌlþÌV,ÖÝÝ=}ó·häX¼råJeeeff¦¼,++K©©©‘Oe0''Gó½Œí©…QD9yå””¥‹òŠÜš„ˆ ±!6LäZ¹+—ìP¾aGGGcc£¼þøñã¡ç—‘ÊÊJ]pátq~¶cRðÉ›LIW:[®È}IˆØbÃĬ•Ë„håzÊ7ìééÙ´i“¼f×®]uuu¡åU†Í8ÎÏvŒ -¢œ¼rJÊÒÙrEîKBĆØ&¬ gåö÷÷J³---mii¹åwE盂('©œ’²t¶\‘û’±!6ĆØ0Ap(ßPÈÊÊÚ¾}{JJʾ}ûffC{S £,ˆr’Ê))KéÙkÄMBĆØbÃÄÁ‰|CAv…@ 77÷èÑ£3³¡½©…QD9Iå””¥‹ôŠ¢·aR$!bClˆ ±!Ø©…î¾7±!6ĆØ€n ±!6Ćt{lˆ ±!6 ÛcClˆ ±!ÝbClˆ èöØbCl@·Ç†ØbCº=6ĆØÆ'âü´šÏ;·¨¨èСCQž*. &f“w_j!6ĆØ&ÅùiŸœœ<|øpðO¯$‘ c9y÷¥bClˆ ±aÒáP¾¡Vðñññ®®®Õ«WkƒÖÓûúú¼^¯ÇãijjŠ— c0y·¦bClˆ ¹V³+Åq(ßP›@zzzssóÐÐ6h= pݺuõõõccc­­­ñzR³É»/µbClˆ É7 íÛ²…ììì ZO”­M0p!^{ØMÞ}©…ØbCH:Ê7Ô¾:<<¼jÕªàC<ëi€q·aÌ&ï¾ÔBlˆ ±!$å¿zêÔ©ÒÒRíÁõ4ÀŠŠŠ††éê~¿_÷F6FÆ~òöÚ0aS ±!6ĆŒ8‘oúÕ¶¶6‘Åt$i€gÎœ)**Z°`Ass³îì2Œñ䣷aR¤bClˆ …(ÃYØÇ°!6Ć@·Ç†ØÝbClt{lˆ ±!Ðí±!6Ć@·Ç†ØÝbClt{lˆ ±!Äçò c–Êgï[˜œM;hË”È7¤/aClqÇÑ|ÃXÞ‰v6ë'!ß¾„ ±!ÄGó ulÞ¼ùàÁƒrÐÝÝ-ÇÚ 2¤ott´¶¶6;;[ÎSPP~Nݱnë¤GÕS,,ãããæ64 -þ³Ý†ÓÆa‚1°!ù†ØbC° §ó C¹xñ¢Ïç;}ú´|”cmPÒWUUå÷ûu»›¼¼¼žžžþþþ-[¶„ï’DÜÁOM‚ÿ¬Ä#FdÃiƒ0AÝ”œ°!ù†ØbC°‡ò ßيź»»§oþkƒÊ¾‘‘‘ššùTsrr´Á#GŽlØ°AÐÛÛ«{÷@ ³]¸p¡É95¬Ä#šŸù^ÆöÔÂ( ¢œ¼rJÊÒEyEnMBĆØ0öU”8”oØÑÑÑØØ(¯?~üxèùe¤²²R\8EœŸí˜$|ò&SҕΖ+r_"6ĆØÜoØÓÓ³iÓ&yÍ®]»êêêBW£2„hÆq~¶cTåä•SR–Ζ+r_"6Ʊ¬€ åö÷÷J³---mii¹åwE盂('©œ’²t¶\‘û’±!6Ć 8”o(deemß¾=%%eß¾}3³¡½©…QD9Iå””¥‹ôŠìµaÂ&!bClˆ !qp"ßP]a ÈÍÍ=zôèÌlhoja”QNR9%eé"½¢èm˜IˆØbC» µÐÝ} bCVÐí±!6d…ÝbCVÐí±!6d…ÝbCVÐí±!6d…ÝbCVÐí±!6d…@lp"ÎO[ŸsçÎ-**:tèP”§ŠËͳɻ/µbClI‡Cq~Ú✜œ<|øpðO¯$‘ c9y÷¥bClˆ !ép(ßP[œããã]]]«W¯Ö­§öõõy½^ÇÓÔÔ/Æ`ònM-ĆØ0öUHÌ|CméééÍÍÍCCCÚ õ4ÀuëÖÕ××µ¶¶ÆëIiÌ&ï¾ÔBlˆ ±!oÚ·e ÙÙÙ´ž([›`àB¼ö†1›¼ûR ±!6H:Ê7Ô¾:<<¼jÕªàC<ëi€q·aÌ&ï¾ÔBlˆ ’‡ò ƒ_=uêTii©öàÎz`EEECCƒtu¿ß¯{#£ c?y{m˜°©…Ø$#Nä†~µ­­Md1Ià™3gŠŠŠ,XÐÜܬ{#{£ c<ùèm˜©…Ø€£e8 »=6Ćt{lˆ èöØÐí±!6 ÛcCl@·Ç†Ø€n ±!ÝbC€Øà\¾aÌRùì} “³ébm™ù†ØÄGó cÙ4ílÖOB¾!6ĆqÇÑ|C›7o>xð tww˱6¨ é­­­ÍÎΖó„ŸSw¬Û:)ϥȔ»3£0A‹ûbò ±a,m@¢“ ŽæêfráŸÏwöìY¯×;00  *Cúª««ÛÛÛ/_¾läÝÕY þ³e[ž"a&h½“oˆ ±!€»ó •oçñxöïßQ†ômݺÕüœæ6TžÓ š„ ÆÀ†äbCª`Žæ†#½Zz¸ìeB·Wá!}Á稺sŠ…å`||Ü܆FÁ¶ÛpÚ8L06$ßR%»p:ß0”‹/ú|¾Ó§OËG9Ö•!}UUU~¿_·»ÉËËëéééïïß²eKø.IÄüÔ$øÏJó½Œí©…QD9yå””¥‹òŠÜš„ˆ íµ!$Z¾aGGGcc£¼þøñã¡ç—‘ÊÊJ]pátq~¶cRðÉ›LIW:[®È}IˆØ¸;ß°§§gÓ¦Mòš]»vÕÕՅ޳ʢÇùÙŽQA”“WNIY:[®È}IˆØkHÊ7ìïï/,,”f[ZZÚÒÒrËïŠ&Î/6QNR9%eél¹"÷%!bC® Ap(ßPÈÊÊÚ¾}{JJʾ}ûffC{S £,ˆr’Ê))KéÙkÄMBĆ\;@âàD¾¡ »Â@ ››{ôèÑ™ÙÐÞÔÂ( ¢œ¤rJÊÒEzEÑÛ0)’±!×vAj¡»»=6dÐí±!ë€n Y't{lÈ: ÛcCÖ Ý²NèöØu@·Ç†¬€ØàDœŸvÏ;·¨¨èСCQž*.-(f“w_j!6ĆI‡Cq~Ú-<99yøðáàŸ^I"ÆròîK-ĆØ ép(ßP»…ÇÇÇ»ººV¯^­ ZOìëëóz½§©©)^6ŒÁäÝšZˆ í­$o¾¡6ôôôæææ¡¡!mÐzàºuëêëëÇÆÆZ[[ãõ¤4f“w_j!6Ćä†ömÙBvvv­§ÊÖ&¸¯½aÌ&ï¾ÔBlI‡Cù†ÚW‡‡‡W­Z|ˆg= 0###î6ŒÙäÝ—Zˆ  ép(ß0øÕS§N•––jVTT444HW÷ûýº7²1Ê0ö“·×† ›Zˆ  q"ß0ô«mmm"‹éHÒÏœ9STT´`Á‚ææfÝÙeãÉGoäH-ĆŽB”¡ËÀ†Ø`Cl€ °!6€lJ Þs¬OÏärt¹¶”ÈÊ9éçØ’¥/¹l†N\ÑŒÏI?džŒ6´“§ÌøS¢÷¹÷ߟņ  ‰l8m-&O™ñgBø9ö³Ÿ}ò“ŸÜ½{÷-m¨=)ýÅ/~±qãFmpÆ ò©¼þúër©¹ªªªü~¿õ˜øhl(ÿò—¿ÜÿýW¯^e½aCHئÚ—¬Çä)3þ”óÒ¥K©©©çÏŸ¿¥ =Oqqñ{ｧ ~ðÁkÖ¬yàäcøoÑ(Å%ôSÙWÖÔÔdeeÉxNNÎ -‘ µr‰‚YrØ ”©©)Ù~ûÛߦØ`Ö’ŸŸ_RR2<> endobj -4861 0 obj << -/D [4863 0 R /XYZ 85.039 763.817 null] ->> endobj -4866 0 obj << -/D [4863 0 R /XYZ 85.039 763.817 null] ->> endobj -4867 0 obj << -/D [4863 0 R /XYZ 264.216 562.379 null] ->> endobj -4868 0 obj << -/D [4863 0 R /XYZ 320.069 523.591 null] ->> endobj -4869 0 obj << -/D [4863 0 R /XYZ 85.039 429.344 null] +/Parent 5067 0 R >> endobj -4862 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F35 2976 0 R >> -/XObject << /Im8 4850 0 R >> -/ProcSet [ /PDF /Text /ImageC ] +5057 0 obj << +/D [5055 0 R /XYZ 85.039 786.531 null] >> endobj -4872 0 obj << -/Length 3895 -/Filter /FlateDecode ->> -stream -xÚÍ]sÛÆñ]¿‚o…f,‡;|õÍ–ÄÔq-y¦4 ’˜€Võï»_w8í$쌆‹½½½ý¾…šEðS³< #]̲< ­fóíU4[Á“ﯔ@ÜÈóæþê¯ß%éLEa³û¥ÃSDaR¤³ûÅÏÁí¯?Þ¿ût}£µ”¯o²,¾»VÁûëüø®^ñÓ·ï?½»½ÿéÓu®ƒóÐëoñÂwöÃëOïdø:΃[|ÿß¿»ãáÛŸ>ÜÂG?ýxwýËý߯ÞÝ»xKTZ#ù¿]ýüK4[ÀRÿ~…ºÈgOp…ª(fÛ+“è01Zî7WwWÿt¸ø™™ñ[§¸e!nTqrž£i¦Qê8ÃSj“úM’05q˜ˆlLLÜ­Ëk]ëO³àmõŸHdKS[vuÛðƒ×óyÕ÷x·m³ëÚM?Å ™é,Å Q¬’2 ²03,÷k 0γ` Tµ›M‹{ôT7+MƒÇ²+·’½ƒçtÑõü.£áËÝšâu0[ÄòÎÛfÉxhñ*Øø@ÕÜâfô¦rÇ7 ;¥¼ÝÈÛ¥ Y—7`.œt×Ñ:¢íxöhÂ4Ôåœ&¯ˆâ7°ñF¡dć¶vÔ˜(xS-[ÚNUûžX„—%>ãM´KÜ­p ÷HwÇ -P6 ¾øžVØîùö ðAž|E/Ò¤ÕWv “Z‘ÆYŠþÜ[vÇ9í°a¤ëÉÒˆB÷P2àBd¯Ep®q-›žß¢eÃPˆ/Y1ˆ½V´íÏ<¸gùf-ñrƒ’Få½`¢GíV0Ð]½Û“9ÙŠ‹¾–{T¬ºßÕÍ|·yæG V…'/@U¥ÎÍÚä+0‚œÓ…§êƦêÙ®cWmy¸Ef‰â^Põ S/å^0±úXÄû%ˆà;^.Z«cx‡›°®{ða&SN[äe¡Cæ …Å Ð˜¹?ƒÇf–W“n)ÞZÔ6“‚p´ÈýG¾{VHVw­Ý¾c OÄrdÖ†_)ç„ÐueB1‹5"pÀ¸ýøz Dwübû^¦‡pÓñ[Zû$4å–ܦšu=mM)r‡OÈÀ˜CÃI#'ã‘^-›¶.ÑØDbÇx¸2¥Ä0F¾]å¶eÀ¦ߋÁÓ*½Œ{ºyæ²oÝ®¶¼'Å(;~XâÝnM;S³æ,xžG^y×3ƒö©Þ WŃH/ÞXê¾ê/Jö4½Ûí®ò}PÛññq–ÿ¡xÆE¬#ïXId ã’1îØu§Àè$ý«­•JIrû±ôQŽÄ…} 9e_sæƾí„;¦'m/Ú/.÷ëT7`M#ˆÀ7¯)¼Añ„Ø%½ÑeZ°¨€(2^®ëÕÚnzåâK݃]Úøh–ñõ³©JK$"YÔ Îé|¿‘{‹b[Ö¼¥Ä44#»¥X\9b³TöBoɵ^íÉ)ôÇÆBb§5Y|2ät!ÑVÇ×Îk¤´‡q -™ÿ8øDCŒš)ÙFvFÆ ¢Ã“•HoXÖžñ-°U\9£"Ñ*$P›Ë«,?øvK$´€ÀÆÛ 7³µn8ÐTâ,'|K”‘rwƒ~©%üÃaÞƾîmÄX6d¤£Ü9gÃÉ–|éxÀXG¾¦†Ã3ŽL E//ò>µütÕUIÉ[Ïd¢c‰ m$M¿ä—vŽÝÏ<°Õá<­ C‘i h;”´cŽ<­9 Ž½Í‚›5iÏ8hræ¼¹ö¦n~wlV4ÇðßÕ–¿24›–8¸É.ùVä˺VzµÚz!Ì‚áHgøBþQ&vnú¼¼Ozßnö.²ÉFÉd',í¢}tXgâX“¥6Áç“Y‘I>©òI}”OâÜaQħ¢K¥rÈ£bHºÂ$K}ˆÃÆ‘³³Ð4 u2äiiìE¤ÊQ¢v z‹PL]N){Œk?ˆg“44ióák;dN )m¡²™GÀ1•sDåhžCLãÀ“~«›xýýÁÝItäáíØúrõܨSD¯MÆI:»)â0SÅ9Ø$4‰™eEõçÊÎèOa¡w"ÀÂW"Ïc$.[l3ÔqqZ8 -È«` @܆ 9À:ð .÷Õ¹ >âeï;öèG‚ÊXϼÉþ8åÙyÒÓ\…i–h[õsŠÖÊG©‹ý7,ã¯9ø<þÐîÄ/¬JA²&ùeV¥bãpåÊIZDLq!‰ÓPçñiÕTÊ„ÀyÈC#…žr±­Ö¶Q˜7%úKHÅ9bãïbDí5ÅX@,%Htïûo¬;>­[~4N£``ˆçáfÕ•o‹±aNØü€uÏ/!fŠBjÊÕ6ÕŠ>?i……”Y -ôP‡B_D™ãýºzöiC7(´-„èÒ‹ÈFhmm–RR~é -LQÊÿhÚýAXsc³!Ù[‹>‰º– ÛÜ(!ñµ+[ùÌ¥»Ú_d-So<ŽñÊjŸÝ™åÝ>!½íÁ¢yRNgm1L›qÄ„€ÿêm‰c¼ ïµ%[¯x_ë:—…=\¤Àþ[±"î(-ÿ·5Gx®Œr"Ìp¦æª265ÅË25*6S¦V¯ÁÖÀ¿)8D;¨ŒbÍlÊÖ ø/akÎQk2 „Q{ç J-å«Aé©þ„²ñùÃû «b™†*äNŒ©hæiB?D°Pøg’¬~¯…_‹jI¥ŒÍηHÛ²{¶Ø2$ÞÙlrdWŽ ¦M4±’>hÕ±µvºº•×ÖŽ|©çÕ´ð_bïþ~öB¡¼š<ý8¢ÐÑD1L¨&dßmÄ„ø{S\@üϬã$Œ!7ð þýâ?ö(OåÖ[ïn]~ÅEˆ -¬;ÓH ´U3œ¡„—\¸0¢ÇÒ?*e‘ô·›Jßû´žo±þnДÿ‘o· õ ZÂ$s¿9VJÏSù»RyïáßÌ[pasÏÕŽj\¸”R¼á¼¤‰3¬æ{Êéw˜š‹©à’ʃ«^mÏ{³‹HãKœ!‹]Li´u¤f:ÏÃ4Ò¤ «}åÇ=í¯“Š<`¾„"Ÿ£Óhù˜Î÷Ëb,µyÖÏÕ—±ï•H„–5€Â`¶g¯œz6ƒî·ƒ‡’2ÝJ™ÁÅxº®ú E¹î¬ß³šwì™}’•rvGžº|äX½vǧ«ª?뀹ë«Ç‚ñ0 ÕsÙ -!%Q5o÷œJLkÏ%Dà%Ç‚:Ãþ5 ê0S •¤Ÿ gr\Zÿr¤ÃÅQx2¥PÃd—P¨s¤§*R<"}: í=]¿néøC×´»S~϶W¸£Þ5Ø´+νälÂJë9Ÿ4%ˆ—`ÝKŽË’4Lž²â*4)0!Â,âC¨¶Ù\«£|wJðì—¼s´&if’ù´Þz‡¤^¹£’óÞ“sT/xªAnã /P0{aƒ™æÀÚÅY§S¡Ý±ˆO‹è%˜ü¢# ‡i‘NGЭM -ûOÛÞUåÂãó”lX/!›çh¤X0öIü&‘NÀ)W­‡Þ‘0W/+¶p5œñîÖ·¢ôò 9uÙ–ŸÇa¿3¨ßRÉbTD„ˆÀ¯¹eº\ó¿¶ì»°ÓsZZ_j:¶¾µu±~\ȶïŽ3 MKü%öïEK¼2ᔼ TdfÈŠ<åV‚/¾ýÈÍp ˜¦6*ñȧöÇÞ£Ã/É‚j*ÜÖß^š¶?Ï©ÉÀ.æÉ™h›¤%2Ô@Ý+]½«¾!–ð^BÄÎQ™ÆqX$jDå·œ2þá€æ‰Nµ‡à`Ô@è ™®·L‹Û%øvqÛÆ >ÑP‚퀀í"=iv¾Ó;Î ÷3ç{Óch£tÜ›Koúw¶’4êM[wÕö ¿èxæ¡×ZÑI!ÊJ?¤_¿«u=6˜œ_™l]q…±ò>è(øËû5‡ômÁ¨=mÆknׂ‹åÜ÷-®ø'ÌîHôš›çð¹ßÿ^䇌G)õÅ!4`Ø÷®mKR-ŸÊ©­=õ¡ºãU/üž¶‰nõÒ‰ýž”ãÑw›„Û›ñŸ`ÊUÓR7x"}x!…u¼¤qÞrÎp3o©Û¯ö7›{Xd®äÎäTz8Ø=´x1Ã}´ð(× }ó|b«Žl;ÜØÂF¬%‹çÚô›ÈÜ:He›Ìá.æÎA~À],mc¿+‹H=\‡_л›qc¿ÕÑ"I=cÐãØóαŽwv \^?äqŠ»Üc[•EÂÙêÊçLèòD>Ê,ð¹k¹a+šØpHÈÙÐŒ€´r\i‘ã:K êŠô>   ³8 S` MÊ4‚jx€ÎjËÅÞ»8ØU7ÒåÈÊâmVÅÈf³\ád<2Õ‰6“ݵ˲_[9=m‡¤‡&)Î"fÒ²bãQ‘Æ#˪Ųþƒ,å¼"Z˦†i¶‘bQTpÎTZÔgI`&e®S僭Ô`Ó?~Ó°-âðù{Þ!÷Å/.dë^dÛÊEVD^ßNÄŸÿÈ‘WÔËìÀqâq‡ÓräsìIvD`¹`ÝèlfuB(êjW±1¯÷ÁÎéHÅ ÆÁ¯m‹eàæQ'íbS&¹âÖš¿M=÷>P²'0F)›Ç¢8Êc:u¤ð!¹§Ï4eÇuþ®ô80ùJ”üMÉÐ(“‡ÅT—[ñg¬1¤ FRœhŒïô ’ÿàÅÔendstream -endobj -4871 0 obj << -/Type /Page -/Contents 4872 0 R -/Resources 4870 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4860 0 R +5053 0 obj << +/D [5055 0 R /XYZ 85.039 763.817 null] >> endobj -4873 0 obj << -/D [4871 0 R /XYZ 85.039 786.531 null] +5058 0 obj << +/D [5055 0 R /XYZ 277.273 769.79 null] >> endobj 814 0 obj << -/D [4871 0 R /XYZ 85.039 766.606 null] +/D [5055 0 R /XYZ 85.039 432.204 null] >> endobj -4874 0 obj << -/D [4871 0 R /XYZ 85.039 744.844 null] +5059 0 obj << +/D [5055 0 R /XYZ 85.039 397.459 null] >> endobj 818 0 obj << -/D [4871 0 R /XYZ 85.039 686.81 null] +/D [5055 0 R /XYZ 85.039 355.299 null] >> endobj -4875 0 obj << -/D [4871 0 R /XYZ 85.039 652.065 null] +5060 0 obj << +/D [5055 0 R /XYZ 85.039 320.553 null] >> endobj -4876 0 obj << -/D [4871 0 R /XYZ 85.039 474.933 null] +5061 0 obj << +/D [5055 0 R /XYZ 85.039 239.461 null] >> endobj -4877 0 obj << -/D [4871 0 R /XYZ 266.917 480.906 null] +5062 0 obj << +/D [5055 0 R /XYZ 85.039 214.057 null] >> endobj -822 0 obj << -/D [4871 0 R /XYZ 85.039 271.441 null] +5063 0 obj << +/D [5055 0 R /XYZ 85.039 187.385 null] >> endobj -4878 0 obj << -/D [4871 0 R /XYZ 85.039 236.695 null] +5064 0 obj << +/D [5055 0 R /XYZ 85.039 160.287 null] >> endobj -826 0 obj << -/D [4871 0 R /XYZ 85.039 142.459 null] +5065 0 obj << +/D [5055 0 R /XYZ 85.039 130.764 null] >> endobj -4879 0 obj << -/D [4871 0 R /XYZ 85.039 107.917 null] +5066 0 obj << +/D [5055 0 R /XYZ 85.039 90.42 null] >> endobj -4870 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> +5054 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F62 4159 0 R /F20 3021 0 R /F59 3455 0 R /F38 3057 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4882 0 obj << -/Length 4709 -/Filter /FlateDecode ->> -stream -xÚÕ\[sܸ±~ׯ˜·ÌTV0 ‚·}ójíÄ©õåXÊÙœJò@ÍPËœ¡Br¬Õ¿?Ýh\9$íéÔ¤\eq@\À×¾á*€á*‹Yå«4KX…«íþ"XÝÛ?]„ªÆ¥ªréÔùéæâÅë8Y…˃|usgúÉçÉêf÷÷õÕŸ_~¸yõqsEÑ:ŒØæ2M³õëM¸~³¹ ׿¼‚§èíÏo>¾ººyÿq“Eëÿ£¢—ï~Ʊ¾†j~ùñ•*Þðl}…í¯°ýõ5_½wó_½ÿåzóÏ›¿\¼º1p¦F’ÿ¯‹¿ÿ3Xí`ª¹X”g«'xX˜ç«ý…ˆ#‹Hý®/®/þÇôEïÄŠZ­–®qÉ–r~:\š§j¸h0\t2\°º Yžó±‘`Z Ï`[Xœ&n…á_CZ˜,IRh'Œ »“ wvR×Ò•p+o6y².nk\÷V<“áJ¿xÆNkh$’ÆÃf?·‚GË‚håpB¥®sB¥7ΰ'îuUoˆ>€MqØ)lAYÕ–[¤½oZøõL5>lxŽµÃ5îñ¡êºª9P»ŸŠNNWus倯¾mên8-s–ÇñØ´N¦¥°p°yÎ’<š«3‹ –‡âÛP‹0·ùd7²QÝГªí÷bϦh>¼Ì>°A<ÍHÀÚEÖÖ¹©?¸úPR´Å¾ìå2·§XI‡ÉÊíß']w6O»ÈrÜ£ýç²Û"ÝRùØ<€þKbƒ—X¼=)~×ЬN ’å)KEºÌ¬²³4`ÄÑ7c$^"aÌxó.,1KRàÝ0g q•·­dÄ¢· ,²è>Mâ±.æF\ÄqêüQÒ{G䢑B¢oÔß;)Eö(;n”J9hÁƲ.ÍS G(/îe—l:KLü;@g1ñ„, -³ ìð”X„ fQÆå^ì*Xµ1 ¿Ÿƒe øÌÑÌEÄÁ=šo<1<%TôE­ …Ùz§ÑÕQÕã&\{gÒÓC©p£Q'Úg„¹©:Ü«sðýõlï»}÷æo2‰¾]©j †lu'E_!¦ï©–íãto*ÔA!@»+õy]wÍXKỂGFûLÑäe9®E[õ8WõrOçõ§Íë,±éëägÅ:I–¢r1!uC&@SLrøÅÄ9MG‹÷ u©‘QN1íž™#6âœÅYæû -†J¨êþ¡Ú?ˆ¯B¶ìK%“ ü‰êÑòd /_ù|Õj¾R¼ðPhØKäö«Û­:ÝöÙH^‘Žô— kj&sY«ºÓ ç£*>ÊweKj©&µSE»VS«~íKìÖùª A0AÖØÃŒå«$M™]Ñs'…ÏV[0F€•…ÞUO.N1€t ˜› !±7‰›‡Jmÿ#©Î®òÑ=JúËm… Ó»pEg¯°sç‹z;wµ4·U¯õ CßHAcÿP¨OU­N±¢~B†+6ÐóåÒ[Ý¥QŽ Y-qȶªêVmU¸–§‡Ž¬ð¿®‡^o‘ÿ§ùa‰Í;cÅ)‰sðSJw²4«$> ö8Oì*s¢o{sî~ù\°#/Ásóà™`9½y|w¶°|aÎÿ^¶ÐÚ‘Ýž¡&¦ÕCAèdD™a%¶ñœÕ#ÆŸP9PÓ€‚D€­—óQþ[|¥“[ÜüždÝ©š=Å7– %øfnzÈ7" ½ù9>-+Ÿ-úRPk`¡2Ôù<‚ó—vbœ(àþ*·Ô“ ß'Õþ݃âÚÒ–é©Š£ãikª¡­|¬Áð€¿Z Ž9c,î9ŠÜyžz4/ªycÙÀ.%|Ì 5‡ ‰ªâa¡LR>âQÙ²¥e;¦ÅŒfùÀK½…K ‘ÆÑ÷˲ -ãœñHüž4+.ãi¸`kŒ—k¢kéJÓiVb"Í*ʲŠ@}PÏÿ4 IÕ9!Ò7‹=ápïuxË7†]ezω"¥È%çtíò\z©/3ÐT¸ørzTÊOÒóЀɌOe×Åð˜Àb„ ˲ئGEë^K„¯N‘ŠxC®œÿ}êU_óÔgaÎÂ$ò¨_8A*©`BÄËÌ*Œ@ArŽÚªÈ3–¥Ñ¬7:@„F”‰¶U ‰JM5¦v§•¶¾²¹*±Ö$y aTkmȨ®~p´AiW´:ºal’ÎTºs£—]9HgjߎÈÙuyÀ²È['«S&@qŠ)´~;Ï€×試à|óéøh¢7xk¤æp(­Jà«î¶i›ôÐUv³Ü$0h\¶Ê`|]+Ô†Ž¼‘!Q$„3ͺ²¹&§êÊ¥â`Ó&œp*Ø…v¿;ÇÁ—г·®ó3³§•ýQŠM -‚EÀtÖ‚@†4§â¶pzb²¤È2ÐQHHm]e¸©«íó3Úî`Æ9Z1['¹Kë•ñÐ(dUN0õªØ¢Æýàfô|ÀÊ0íCTÖÊ¥…2œˆu­ÅS­xûíÞ4ÀÜM&épÛb‹×qDå…43j’¸:™m¼K,¾Þó2GE -ÛŸNek¦!K€Æ :ö(çÌ5¡lâÖˆ¢ÝíP yŽî$Î@ÏÝ/ëÚC•vg˜ü} ß=;ò_§fîIÂ_îʺÚW&D_›Ì a2oÒf›™ÓLÉ]}¸´$¥ÛáÙ~¬wúôƒŸOÈy^B÷ ÝŠÒ£˸dฬ/±?g-¨ã±3uPìÑP ÈÀ|4½²¯´vÑ–]S¥£¸aíf°À>Cx¦¹G¸U¡­Ñƒ)R_Gu¨m–õIZráçØ(¢»¯n¥{Ñ ã´¤S4 -ºÿ[¡7[Ù˜üãÐ}sìÜl0™æy_Hý«ëíÕ1'1Lü°Êí ˜Xþ³Æ2&¥gSQÏ/À&DÊ`E¦ÁŒ;?_Ûÿø#Mô ºÄšd÷‚”IÝ Hu'x çªRîKw%¬D®öCM¿/öÚ ~g¤õ³N²®w/ËØ^&ñ†SÖÁ‡÷ˆní%Vؤæå©s «¼»ÊôæT”ŽãË_Êù('eü’Åxµ³ÖŠ5îT¿¦ -–=Ècç³äùc;ÂK@è{èN e0 Ž×ÍÄ4 æa²Q$»’ 6Å'Çflk}yþû4Ɉv”qŽd™Dø$¿$ÌàÆ'´éðŽ¶ÌÈUçúíO3^yÕ/ÝŸúÚKܹLlƒ‚Ú:;Q¤›ÁÑf ÕÖ»ó혆ºUgNó­s_K›‰nŠ­ö½Œñ‹ãš7žê!áúV?9¹ 3ïýXbÏX[²”ñ<œÈÒ\¬¢˜%8¡ÌMp þ¥ÒŽ‚*÷Sy3ÌØÉôóöeu4ÿl”ÐêÖÑ%àõI¡Ô#Rjæeï"+·8ú¾”ÿÁ¿}ˆ\»×'¿[¡ƒË Ypx+X¢Ú~·(ÌUB`Êhã°>*x½‘:*nr’`°žõ&7)IÉu/¯¥³µØD¡JYî&>F¤Ç›¥ÛÖ9ůî'à,M\§OµhUAwžbË¢–ï0”( *ªø`4úÝ7ôwÛ¿ÞŽ±í‰? ë*÷w«†6Þ5l0¼(­ú6É]’8µR}kÜÊ(<^ÿôL-‡Ál Àü€ ìœó¸^ô2Зé$“bæ.ýmKqkM0äl²ÇáÎŒ¤¥ë»1Û>Òe -LåÍF³—T`ÜòÊ–‰k¥6jï¨h[¨fŽ¦#ò½ßñÛë‘…8QKªïnÄ ¿½øÛÂ,ίì$à…ãÿª4BªŸ<€¡äÝûj)ÓW¤`ûlÌÏ€ü:y3d™~R¼!0Qñ$9%‚‘o>cÙÉV){›¨ŒÎÀq‰¨9!ëì' -3óØj™N>‹è!I…Ƴ–é°¶ ØX¥IΔk êu Ó¨&fñYr_¦&“E§+‚cxXÊ¢ÖÅ'r'½ZÓè˜I>{»Ÿ¸äJ€à_mp2rynƒoO†Çjò˜tº$|jš<Èð¥Ú*N2“ -¯µ+N)r<‰×o‹Cq¯[5#­•H°RËPSMô"¼½ ƒ]5{y·ÏKñ+Ù & V}Œµ\ÜÀaÛÙ€²±RÇåæè¦=Ó¡ZJe§œ ›º‹5«½,觛z¡ûqÒ;v.ê´~|g,˜©±”Å—ò"™w;¦O^ê¾.ÎFNø%02#J–•_ôjXŒy‹<›põ‘'˜Vm¸u«>–d"¿¨ç%,J…·ùÒÉrçû6y蹓ó@ñaNÆxsléWGI3:«ñ••«*ìJµÁÒœÝ ÿCýη؃ä@EÊ0Y9»$OØ$T -DI•Æô5êËxÏu^h.ë4í)ãüþǺ+LÏ®?QÄÜœ¢ð(/¼í£KÄÁúűk_ÔÎ'·Šú…;ÓŸ71¼˜—æ©ôŒ`3:w±Õ½‚ãþ‘*{¹&ªu%\1*kOûG°‰ŽŠWÆ(Þis -à€Ê -zÒ 4{àK\Cük‘ 4Ó{íþkø\wuiû»SÁc¢Çãò ã.f"ŠÆÍÞ/¸#¿ÊìuY>9g<4ÄHÃVð!Åq”±8‹FHþ¾³¶Cendstream +5070 0 obj << +/Length 758 +/Filter /FlateDecode +>> +stream +xÚ­V[OÛ0~ϯȣ#-ÆŽ/±;Ê¥H½ ‚˜„x(i(mÂÒ ía?~Çv)˜u¨RãŸËw¾siiHàCC%0a:L•Ä‚Ñ0ß$\ÂÍI@[ rL¤0W_³ààXȬ‰³;«’-®Ñáé`–G1c ÑGqš*tQt%)šÂá2Š)š³ˆF“gñÛ<8ƒìÂI®F“á4JºjƒÉÐ.'£ïÑMve=Œ1Ç\2òGp}CÂäqÌ´ +™`ªu¸ ¸`XpÖ¾¯ƒ‹àÛ³wÇCgå¡"î4bF°RܧC†TàØñE…‡¯¿NAa®„3{íR`.öz¼(ÖEn(nMÍ=Y8^Õf¾*üÄuµq?Ò*7%ºß1pǬ‡JŽUªÛhÃÖ£HºÜõÖYì KÌ $Î`YWOàùÑEYm]ü¦rï·Q Z´óÅÂA§ÈÞ0ª8I™}¡þ­êÓ‹0´IÞ®ÛLòµáV¡‡Ž[±ŠÂxÑòº‡%ýÿ,éOgé°G‹$/´$¤§Ì>W­ÅôÁÃU˜©Ž¸[ÃBÓT¥íËßèü æ.̺ZV¥“˜vS¨2~¹KÛð|¬»ÖÛÚï2J4jÚ^´¶ ¨^™8Ëÿ +^¬Óàf¼¬ÿÜùé]¬‹ùÖÈ +gXû¶1ó÷<`ï"Áp@Òa,–‰cjv¶Ù¥ÁÞ> endobj -4883 0 obj << -/D [4881 0 R /XYZ 85.039 786.531 null] ->> endobj -4884 0 obj << -/D [4881 0 R /XYZ 85.039 763.817 null] ->> endobj -4885 0 obj << -/D [4881 0 R /XYZ 233.803 769.79 null] +/Parent 5067 0 R >> endobj -4886 0 obj << -/D [4881 0 R /XYZ 85.039 545.303 null] +5071 0 obj << +/D [5069 0 R /XYZ 85.039 786.531 null] >> endobj -4887 0 obj << -/D [4881 0 R /XYZ 307.409 551.276 null] +5072 0 obj << +/D [5069 0 R /XYZ 85.039 766.606 null] >> endobj -830 0 obj << -/D [4881 0 R /XYZ 85.039 351.625 null] +5073 0 obj << +/D [5069 0 R /XYZ 85.039 753.526 null] >> endobj -4888 0 obj << -/D [4881 0 R /XYZ 85.039 329.863 null] +5074 0 obj << +/D [5069 0 R /XYZ 85.039 726.428 null] >> endobj -4880 0 obj << -/Font << /F56 3226 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R >> +5068 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4891 0 obj << -/Length 3125 -/Filter /FlateDecode ->> -stream -xÚ¥ZÝoÛ8Ï_áG·VÅQÒ>ÐKÛÛ.Ú4×èv÷A±G¨,å,¹iþûR¢mI]Ü¡hÍ!g8ÎüfT±ˆàX¤q©l‘¤&Œ•XlöWÑb3ÿ¼–beIVÍ?ÖW¯ÞÅf!¢0‹²Åú¡ß'‹Â83‹õö·àú—×·ë·Ÿ—+¥T T¸\%I¼[Šàýr%‚o¡õϾyÿùíõúÓçeª‚ÿðÐë›7ØÐÁýòúó[;¼”ipë¯qýÝ_ºYÆ©Oî–¬½z»îàQ(…âÿ÷ê·?¢ÅŽúëUª,]¡‚ûåJ&AѢɠk`, šŠ»ÍÁŽ?²¨¸¬ËÛ¯’YÃ*ÛGÞÒÈ },Ÿ`ê‰_–U<—`æЊÈ&Hk°¥3 ¤¸A“À=æ9ãö¾Üæ¸é,kÔαc¢ºéNÙ -04ò‚ó¥>H wð@ƒ2|µV‰š1pâˆÎ> 6¸¨:Í}—£›«y‡þaCïû»°GÂegW@cìypòŽAm@´eáñ%iq"«Y #Çz Ï°ç0ö…$ÉMÛ*¥ÁÑšTn·MÇ&ufD¤ÂD&À„p\³:vìÈÎîCgàì-™…r  š[¬Á„4ÝÆ£û%^rè¨.ðnm @[ŽYoÊC±é8h•NøvD¤,D »Ã ¾Ô©˜G =ÿšé'`i±œ~3܆'0Ç®¿ç^Ub}LUº'ñ•GIû‰ç ùaèѽä“Ö -kžKJy‡†I8Ô⭧щyÕ_’âÒ¸2‘Ùû»=4OhýD»²»lÀÆRKÞå÷6£êâ;Yöz2ÔÒœ¼ß4Möc±bÀò©3ÍÛ%‰„D0]¶-þÛÔc„óɉ€„Ýõé êi6¹'Çȹå6…&œ$7GÁkWX2Òõ†_Dk ±¶~¡b:~ù]GÑr×ÚÅí©¤2È=Ó'xœzBÚÀ¥éùäÑ£™„µ€ÂÂHË3\+çp­Œ¢ï¯þ·S©ÞË|æÑL‚VÅa -9 -÷ ¡¢fœ õ%NЛYÄýŠ%¼eÂö¥í -6"Ê7twœÙ…ýÕ†EUÙv4Çï‡Üsñác/·c8Q=01Ã_Ø™‡;î]Œ!Ùw#A¥ÎÑ%”.’iPwÒ[xf:ƒ Òó -ƒÉ <RÄÓ™8ø=º²+Ù[à.SÀNï,Î#²â{¾ê’ݸ¬yò Y«§Z{é?/!SJ9ìm Å—ŽG»]Ç‘ç줨B -4*>4ÕÖG -ÖÒ>¬%V‹ÕLô”*‘8 d£ZUŸÙØŸˆO©Ïqã"¶O“€!çïD„I”L9ª%ç<£ž4 3é$@Ð'›9 ¸¿xÈÑdªŽûãО¦n¬Õ³/‘i¦é‰º½L5¼'+lÙ—¢ -`XîÚI^Þ«„X™¸@ñö[qxiêb ¡$¡ÉœBÞ!8V•­ûHÀKÌ[Z˜g«Oh¡õŒJ‡qbN 7z™‰ñ$+“d®ÜÊë-7¸vѧX8…C·é¾›}áías*$ä/]¦% ¬ÂnN²cãº!Õ>Q’VXF'‰_´àé–€âi…oÇl äòÝ `t¹é›DϱAêk—y£ê ^ò{G?^Ö2pdýh‘0.ñËD0WÚካ0ÃiaGîñ^¸Ýƒù²Þñ‡|}i°å- -š×E5räÛ˜òmQ…F9ûûˆ býÛzŸ^cw€ÄÑyW´µ5e”ÎÃòØ?%<Ÿä(ü~jhüg÷ãªe—é%> ø6ùôÈ2eŒÀv¾ìåÑLBlG3ŸeÎqë!ö,;±}~¯º!*¬¤†7ì猩pb¨-bì™ök÷<µâ¼ -õ¿«-Òi[Çã§ïò'.ë\Æ:ÜM›99´»á#S”=×ýH 95ø×WÝ8Y24±b–ì!æ|r 45Yo›u yÚ|d+¯•vÀ¤@QžØ4¿@Yœ¼t–/~‰4xHÔîѵŒ£!ǤL*YEÕìvä>cò ¨ö†{9ÿl›}Nîvð¶Óp¯Ue(MA¨ñ•wï"„ë €ÑSoEÈ p7ŸÙ“ÙK'ìå1°…6Èèš=vsäx¡[»E‰°Ë·ÕDØÀ“ÞW’/Èt>£åPÉmKUHÍaŸŠ‹‰äóñÒ£Ÿä'WÑÂPvé*‡¤F1r¤ßS$ît\þÅÒg¡œ‹O??ö`Á.Í«ƒ“…²¤&¤{´ÚÅ]ÊÚn@¯[D½ïqï…6pMx®oeUì,³Î)„à?œ'ÿÀ1·´.Û=à2ßT±ÊŸD‡±™¯Ây4“þÑÑÌ— æ¸õþq–ó>?|k*68x¼¬ÁàT} ’ö€¤×’?2˜ª-I=ðÝ™U9pýŠb4UÀJúHy¯µA™¿[äo\½ªf‰:Â}JàÑA0k¡xŽ|o[̓CÂU1Ž ÐÌòîèØéëCÜçÜ=ÿô€cζý-ü§ï’È«#çµor—?{øŒÁË ”W¶ÀÄÄ«‘*[#US÷“AjÒ_Ïoûc„¡ŒB:ªà8ß1Fàæ´;ÈæÕ{®h¬—påTME@7^$4&Ì„éc]†´MêÑÛ᪖_Ãœ,¥a’¦?tOº))Beæ+)Í´›²4(˜švS3Ü75Ç®wS¿Þ|¥1MÉ¥­ PãPöÕìR „Là'F&”ßÑ¡UÅŠÎð¤-3œlwú ™èÁhNûjÿ£]l3ã¾'XYúbQË“œ&rVEÅ"x$·v úäÿ,RÓg6“`ÆŽN áWHµ°Ga˜¿sb#¿s/à2RŸ,ºiË$Ùë¦YšD ®…{ouòÐwW!9Z œÏ,¿±§å‹bJúB,D_T¥öyùMˆ ­²ëß‹Ó*†ƒ[Tš^iÃXN›È*Éø¥9f s”Kã›ÅJ˜Œƒ7 “Þ|Z[Âb;wñ´ŸÝw¨ßáWVªÕÓ4Ťþâq²yੋ¦Ù(ÕAÈ/8 -ë OíÃ~[çÀp‡"ßbªÎ=®)ÿ{ýÞÓ°Ëɇ"ÏÎz$ûÍUEÞÁÃÞ_ùt‰©V£ÿþ²ôÿ×öêÃi˜¥`(–2”¢†rS­Î%ŽUÆ©ùO\ãªendstream +5077 0 obj << +/Length 2728 +/Filter /FlateDecode +>> +stream +xÚYYoÛH~ϯð#Ä +ïcß<‡Y$3ÄAØÙZ¢%"©%[‰=¿~뫪n¶(9Xp³ïꪯNE7!ýE7e¶“ê¦(óu–D7›Ã›ðfG3ÿ|éŠ4KÖYšÒ÷•É[;{›Çë0-®­ on“rf9&zxóî>oâpçÉÍÃ/zØþ;ˆ’õê6ËÂà¾]EA×¼]Ý&yüÒŽÍÆ «$ Æ AÝoåãÓ¾^%Q06Ò½Ûlši’m?½W·Q0ttÚ´úÏÿÞüúàÓ”®Ãè5zÓœèM½Qv…ë*¬|zï¶ßVYNÄÐùÜÔ€ª0 >~B_Z¢“XÅeð &™?M zãJGÒ æÐÔyö¿'ûÕc¿K^dÑqu27™UÏÜÙʵ|Õ~Þ̓…Q*, «` aÚ;’XÆs-.;uõ-˜ .E}ÅÌ0í@7ÅI OhK:böã£ðgÂLŇ[ò¶²øŽ¯åûS}À‹µ»¤í#ò|}Œô¯‘s[¥ÀìuàP÷½½hts/r ¿ ŒØí…Á<ÊkŸ•ÃLµ!T¦QÌRÅŠ/ õB°—é#ótÒ€÷~Å¡UPo-s“Ùc0S“&Ûã2iÖŠ0.JÁØ€­O'Ž@ÛÆfW[¦l'#îá–Š’¨°$ðQ^lO+@ÓÐMBˆ…íåÕ^¾¤=Žv‚¹m®ðƒPG&I|oÍ_ ‰CÈÄh½q(Å 1Àž%†Ž{+íþ¾K!ÓB„QX3w2ãÐ6 §Ñi«^Á*7¤s®úÄd cû·Ó«$v\ヘȵ}f\¬ÃJžù‘øW@VFÁçßÞÿ)_,öÖÊíL옱Ç$ÛCôµÃg×Ö£¬¾A(qbTÒÀ~ïV 9ÉY Kó[ËìÖ˜TŒu\ +3ŠÍ¬84ý®GÓnN]‘â¹Ö%ÝÙ’mÉ™7 ¾c¼½ÈNªh˜Nu‡Çüͯ²²¡%ÎZÕFøiø`3Z…×Í(Í;3Ê«¾[vMgæOרhI†R† OûbAˆiG³Ø)êf®°„M«ã^ÑÉê8ªa<½ÈÄH ^ϦÓÚÃÙk&2®Ó9ØJ¾ú¼JóR±ÿØ5éw-àæÒË U6 3qDyâ®TxxÚ±Øî+?úx·ªºüð¶uÇ©wÁ(H¬­èNË–lZì½j…°Â7£ž2fÃã̼ÙÚ‰¥€Lc ª8<›,3³V¢0MÝ&ÿ4 ,¨`µq»PðM¿Ñ ì‚¡·7:pSÇóm¸|ã|+{774Ž]cvø´‹/ÞZ¦Â‰ÇiÐ|s¯ì¯9d×i§†¶5 +Êaæ•gc-4íÔ>Žxßv§˜öÍ´hÞÄr<ø ýzM³›æÒF +lÿø¶‚eLȱÞ-Õ!J½yuÔcJÏ4Ž~è†Ý‹ [Âpˆ ÆM«õʲ fÓZ?ZÍ¥õ…YXwƒ5N4¢Ž*Š‚_ŸMÓo½¨ƒw À0ÿÚGÄFFœÉ}O¬÷WÄ#Ž!¥;t Ç6Ö Š‘r=N$õ”+}#[Å;Âu ö e;kL§ÃÍ7òÇ OÞ2°â%µ»&á  ×Ý=¹©oUÙ-`ʼn`犪ääuö–æùÈ~¤í§K!i™ÊÞÎ)-3ÚbTód–õÖ-ë¬ÀH½à¯$ðÄ¿Ú;,úùÃ$'¶Bì ½Ípõ7mÝÉú-߈‡<ËÈq-Ùžì“Ù”UÁN Kþß(pí*gÑž Š¿eÇËgHCìûÖsßB‚U°k} ³jjpÞÌôØä1Tø.Yÿ¤—Õ ‹øŽ¸H³æhà±…[ëÔ±™übv'm*.°m6õ–‰¼:õŒ¡þò¹Œ[`C~{vP§Hó£¹ée’ ïðºK ³àȉ‡1Be‚qB-kc•:³U;šf”1;ÇàÁ‰œ5Mž{ñF£ +ôÒùxëmÃ\½ûкTn’qY›În:ÂÞ¹j½ƒD!b~ÐÔZó…ÃØX]è™ó8·‰Ø´VM¡¸DØ.ø@×ìÙYEœ·jL]|ÕuºÍB´;.¼–ù`|ÖÃJ ·°©ŽRŽžüÓTË8í$î9‰ÒàИ½µe—¨{âÓ5*qñ¬1£Í•–YÈ£Ä)“‘®¡!zÄÐVîœ9¨åfH[<ûv¡pvdL_ Ø¥³å_ îÀû¸ªD!§bÜg–H@Åü5'M°h5ÞÀVŸZ?´‘„½*Uà˜ö3ïJmF­4lÎâÄÚpæé}™ +Ézqã"} [‘ª²öÙ e°âµ*™#Nˆ\Ž‘xe‹„±§‘uG»ç)ÃàB‹ˆÚhœr%r¤.G XzäÍF(™É$۪ï¤\.’LÏ"À$™ãÍo5Œ’°›ß¢r¼áqf{¦«ç·ÒE¸ùÏwÜA§g™šOÖíµ4Ç®6èƒ tíW—Í&»BY‹†šlx} +[ß÷j”ëíY{v˜Ð:éq¡ó»+O‚•†ÏÔu¦ÌB f|eSŸ…¢G'‘–ä¢í¬ª4ßyÙ^'CŒj¥â³ ml-ô¥¶ÁGŠ-±eálE²h‘fØ[~œfTyðÅå +™Kÿ䕬W¨6²?¦°µy‹àŽm˜]mù…Ig;~®\ž>‰DG[{¤‰èlª8Ù”w±å¼€&*B)ì[Yò⬰±ö·‘]­¶ÑÏÙ¢2„mÉÆf)ÓžÓ”þëúJy7)ÓuR–¯xãjä‘_Žhyš/ +ÒJÒiÜ£üÜÔæ4ºÌ)Ïç:ôOMßp„Ì¡¢%æZ¼XWaü㺲g!RÔSg„¨!)ƒZš)cªW ÐÂÌègpma-±ÆæóÉyþNÝI` T\IÀe‹ì,µ¥Sz½“HLqLÜ*²’<—swz¸„/I©=}ˆqy±—œ•þ.‘½±ùà ¨}ª7­$:­EÅqôouus븆Ǽ-‚G±M\¡3¢0ÿÀÝïîóôL.¾W¦ØvS|u¶?9…þä€Ü¿“÷«(Ê¡Šd¤Ioa•˜ÜK°áºHÒkXrªþø˜I£+˜!YËc³uJ†óê¯6ÿº1Ÿ™UWÎüü(~O¬B¢Nb½om²œiÉ¿³Ë0œÑ+ ë-ñ"³ âPq K¸»@½_=õ±O¹äž§Ki™h™¨'Æ <*€gêRͯËä æÔ¥ìÁfbÖ/øèEñc›e! +Õ Ê£àó4+d‰:ô t]( N¾g?È\èG§<þ½e#q‚D-¥äÚ²ëÌÄySsdÍ…ÛZ÷r@JíE‚EËm唽N¥&&x-Å·ZÂCvC“½cš\ñ#‹Ú¯:)B>IÛS·¬PÕÔ§2©¹>¦À+ŒŒˆë-´À!ßÝ°’r ºiˆÔÏ¥ÆÖNËæ$A2ŸÌá;+ºýÕ†=Ê®Iü™ä s +$ÃãRÉÞ¸HHƒ ÒàÊW¶¥ÒÅQ¹&E lý£ôB‘ã$]WÙâXÛþ5+[Šendstream endobj -4890 0 obj << +5076 0 obj << /Type /Page -/Contents 4891 0 R -/Resources 4889 0 R +/Contents 5077 0 R +/Resources 5075 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4860 0 R ->> endobj -4892 0 obj << -/D [4890 0 R /XYZ 85.039 786.531 null] ->> endobj -834 0 obj << -/D [4890 0 R /XYZ 85.039 766.606 null] ->> endobj -4893 0 obj << -/D [4890 0 R /XYZ 85.039 746.277 null] ->> endobj -838 0 obj << -/D [4890 0 R /XYZ 85.039 704.117 null] ->> endobj -4894 0 obj << -/D [4890 0 R /XYZ 85.039 669.367 null] ->> endobj -4895 0 obj << -/D [4890 0 R /XYZ 85.039 577.25 null] ->> endobj -4896 0 obj << -/D [4890 0 R /XYZ 85.039 534.481 null] +/Parent 5067 0 R >> endobj -842 0 obj << -/D [4890 0 R /XYZ 85.039 467.141 null] +5078 0 obj << +/D [5076 0 R /XYZ 85.039 786.531 null] >> endobj -4897 0 obj << -/D [4890 0 R /XYZ 85.039 430.27 null] +822 0 obj << +/D [5076 0 R /XYZ 85.039 766.606 null] >> endobj -4898 0 obj << -/D [4890 0 R /XYZ 85.039 283.956 null] +3149 0 obj << +/D [5076 0 R /XYZ 85.039 658.638 null] >> endobj -4899 0 obj << -/D [4890 0 R /XYZ 85.039 202.66 null] +826 0 obj << +/D [5076 0 R /XYZ 85.039 251.169 null] >> endobj -4900 0 obj << -/D [4890 0 R /XYZ 85.039 145.736 null] +5079 0 obj << +/D [5076 0 R /XYZ 85.039 211.005 null] >> endobj -4889 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F58 3360 0 R /F38 2997 0 R >> +5075 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F64 4225 0 R /F41 3054 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4903 0 obj << -/Length 2935 -/Filter /FlateDecode ->> -stream -xÚ­ÙrÛFò]_ÁG°Ê„1®}Sdy£¬#{-e­l "Q&%ëï·¯€—ÊUN©J3èééékúªIj’ÅadòIš%alÔd¾¹ˆ&KXùç…Œ™ ÌF8?Ý_¼}'…y”Oî=< -ã<™Ü/þ®~¾ütýy:3ÆÊ„ÓYšfÁû© -n¦3|¸†Ù^}wóùúêþãçif‚ÿ2èòöNlph?_~¾ðTgÁî¿Âýww ¾úx{ÿ—>~¸›þyÿËÅõ½`$¢2Ùÿëâ?£ÉDýå" -MžMža…*Ï'› ›0¶F¾×wÿö´xÍNx×)m9 ˜„™Î¾ã8PbÅ'‹&3š‹Óü,Úž9ô}:Þ†‰NC¥­·abaG˜Ç1Úlg( -pâØ ¿L•Jƒ¢­QãU½<Ô­lI’ Fd'$¹²¨@üÍI„A4¼½Ù˜É»xŒØ²³]bWe#—S:“4ž¤‘ŸK‰ßŸJð‡4æ:C[>îÀIÖàzq’7¸hƒ\kvüÑ_ñSöѶgüG³"kžo§3"º -ZoH1]W5uÇm› ô+!|ýT¶pn45¬ p× âä¹êWÍ®G“áÑr’ª-é˜æ©ÂÍËé |HOñdþJ@ÅF9Ÿ¨‚š¿ÊÿEÊ`ÞWO4Y¿ðRÝð80_Ï -Š³'(Ò/PòÑËÎb>Çe‡ÿ»ÑñˆÔ­Ø,­ -±\1‰uï$09ŒS¢Ó‡hØÚíÖ=ƒšGŸWh: -_Q9 êø¹æ•b Éqã|d9Øœƒ¹_”õ\8œ%*&Fèûà5q†–sÆÞ7 PE“¡\p‘â‘g ×3Ó -Š ŠFÑg:¶,¨Eì˜Ìžƒ*0• á¡Dèh6N@Õ¢ÇÁ¯¬í—ñÚóªa89Œ[^lÔ#Žl-˜,Ûf·å©x*ܺbì°F'> ØËÅlž‹bxù䜃uõÈ£÷`Da¦e,«½]å·íºšW==îÖè‘Œ9oê¾mÖ¼‚,’e áaвy*›LFÁðB+Æo¥“™Ï ?ïµ -³Ü¾šˆ“Ȇ™¢¢†UhHÄq'ƒlh äC Íƒ_1_&ið½¼^4S—©cØ% –$Á•×(,|`3‘¯ñ…Œ¢^ðêo·7¿óìiNÙ6àM'ÅC…–»¼@§ssœBÊ1'¥Æˆ…Yd^UIœ$a:ªMP%>¯¹C¬£=•¨@¡^â®O],I'ËC©œ ŠPþçXX¨•Êí¹½çñ®œïZÊ ¤3Pñ ëìëfÙÓ…´–篋;àp^ŒK±8JÃ,ã,Ny¬É¢efsÃW…,$—MCœyQ3å„ô€¸*«–ÁußÕ“K €ÀÉå'›K\Jeßs -“ˆ…Ê`N9¿1S ŽOžÁg°ûåšpCÕ#iÞ ¡í8“îHe IÐB†"‰dw06'µŠ¢}·—À jD9“»mz †6åXVô£Š¼ð#•W†µ‰_#å>Ñ!û»5£ÔMÏʶ0n³Ù"v#eÇøp™³ž kŸvï\ŠûHs%Ø,9‚VM'ÜcÁ]lИô VÝ©ºO¨ë±*›ZJú‚4Ís⩯\…hhjpš‰õ…æFj&Bíb¥ìÙf¿òrÖ!KÑvbj] -aH’½Ë 4Ü¡hYð ŸÅbSÕžJß’ÉDl¡Û•ý¾ ðÝÓËòè†esÁ2câ¤è{gìÍV`ìãI°”ñaSò°hÖ>Áôãy+|IQC¬¿Á²KÄBÞ'ù£äÉÓ9ù\Õì„?ÔtíÃ¥N–¤ª.åðƒzïØ #GC.n¶ 8^’ ±6Fœ§jáÎ#'ÑàB¼ç(X¡{´âżßQüÄ*–Š…%U}íPcž©&…à˜›¿¡³¡Êâï/ýL/¦ãòZöj/fbâÖH°q)¸<Ó†é<VriÃTY”šPFó3m˜:߆èžoÃÀ†¡Î±z‰÷\'zp™¿-ù:Â1î¼¥º¢Þ}cyÕK×óå@˜!¿¤«Œ{Ÿª‚19@=ÈWÕ1.ÇÇš®p³^;×B” ˆF÷'ÍA<)zéoœº{áЀ=˜bÌÎÕQ„0)F;¬,€þ\Z•5/öÜFHäâÂAq€I/w­Ç^ЃùD=®nLJrGÓ¸. Ø1>— G­ÕØ:öÜܾðwµÙRðj¸[(¤¢Ã%bRsT¦ä«­ÜçosÝi_s§Á˜Ò5ì ?& ·Ü k;Š©€…,Páߎóí^wÙIñ‚vbÃòÁwôDm—A$Ç!Ðõ”©ØM•ä¦"E¤Ò„ÂèÍ‚[÷ŠJ ý­kj -×R€: -ï]?€ä "‚ê¤?Èqõ8RÆè…!:Sç˱’ë,c<çÄê™æh~ ÖýÝÍQ¦úÕÊX›*ãWû­4ÄT½×héþS•Ï¾ž_¹êÃõ®‹!0\ÜßQ±°-T àh—¡øoË3iI£°*{]žçl¥¯ÒŒºèý4³â\„Ñx{oßê(ŠÞþþI*›uUr®–r­ãºœ½bËs,¿rj~öÍÌjÔ¹—RoUËQâÏM3\a†<  ï]}Æ£FÞä>ŠGúRp¤£þ@j°*“ò –ÕÐÉ:ÉÆåkÁ Ü"P­JŒ– Æ\P}캄¬¡AÁÀƒó¦åÝ¿Ý^1`KÝÎ -<Åj|¡˜Ž’Q2y¢¡3v¼$¡cÛÍ\=¾}ƒw=’¶«¢hΊ¦3=É©dyvaoqéÐÄFÞ„> mv_•î iì!3·aÄò-fÄ<¥ -2¼ÈiÃÀd`Ä# êþxNJ-EXz<³`0òtžSèi}¿‡›ð ôGQ$b_Â\$æ¾r¥4#^‘oÂÃÕ¾ZsQk>ôIxT_<œÐïA=ÑÈëØš01JLÂ})ä§á‘>ü¢þG'’¯JþèW> Ä_™îÍ &U 1!ËL gK øôíJîcV¡šÌµ{—> +stream +xÚÕZYÛÈ~Ÿ_¡G ðм)>:c;;†×öz´°ƒÝ}àH”ʇLR#ûߧ¾ªê&uMä%QwõU]]õÕA{—þy“yä¸A:Iæ±ÞdYݸ“ üýÆÓî$tÜ8ÂÐß7/ßFñÄsÔM'‹5OY¬þ˜ÞýòêÓâÍçÙmS/pf·I2Ÿ¾yÓûÙ­7}ÿ†Z/dôõýç7w‹Ÿgó`ú!½úðpú@Ó~yõù’gþ|z‡õwXÿð 仟1ôñýÃì¯Å»›7‹³·¡Æ¸ý~óÇ_îdEzwã:A:Ÿ¨í:^šNª›0 +œ( ´_Þ<Üüfw‘±p"«.Èä6ôcÇO¨¸Î|ZáxÑá+â>Ç=j°ÝS¯èÑúIr½ißÈïÓ,Š§YY¬²>Êa›÷Û¼•N£¿5­oz]ºÕ™ûŽÐ)ݶÙÓ¬r%ÝÇÙ­ŸLuæ¦xÂÙÊ‘Üi¶Dgɤ®Í·Lýéz!¶Ê…ÜýìzžWÉp›wèñq­î€GÁKxbÊ"øÓÜÑN˜tzt2.C\†n:]؃G—}ÓFh-öH£â$˜.¶ž.^ÎèV d»BÂ&»¶Áíž°z•§ð`ƒrûö ñþ\7ºE-¾V.ë! Œ¶M¥”íÌŽþþáþë…+ïŒÐñ*,/pÞM݉²›»C§ùR:¾mÊN¨¤ÁS¥_}_ÊÁ 2‹Ð¦6«7Jc%¡©xúþ°<µsj*Ä©p0¹B2ä’š{±ÄdV½Cï‚zÓ»&§›GNE²ðtS ÷ŒÒ {>dÕã,òøâÑ|ú°ÍZtsé¾Î¡Kuѳ0éè3ÃÃå\²]ìu-÷I©šË6¬ª„¿‘–#ëËÛ'-çgë{hQ½é„hß {¿Q = VÉ\c®üÀsB7ÖvÕ£C­/°¦NàƒtÃÒ˜ ÔÔêé :ï¡Ò% =!€Ÿú˜P `ìchoØŠ²´+¥a#£ñŸ‘&{,u„æ¹"M³W>îöm{dѬ+©•qØœ —ÍÒôS6£2ë×Í·:ØfC4‡Ñåz´‚D›yÓAf¼R’Bj|¢1Ñ ìûUˆƒ^°D“ÀbQ›øéöÙ¨½Ëz f8A%ÀÇœ¤ÉÃÉ•ß ˜@_¡j^<ýf}v®óäD°q"æd¥õ[ÔÛµ iœ¯r¡Á9Àɤ«’ƒcõ8 ›#ÓìS.+s¾@Õ Ñ:Øb§§ `•iáóéÀ­Ì%gQè hDõ6£-Púap¦£t^Ñ÷œ¯Hlk\=Fó:{´¥ˆÕL완¸JšqZ[m«Q%x0É‹ä‘ât™¢V‰db4 ±.aŸ£°üü©ÙoÖ_Tgx ûĘÅaÇ‘¹óÀà;ªg"Q:7tÃËu?òžErŸÈ¡„ñÉiá7ÅCo íÄÈ PTIûÕr™³ÿŽ)†ljɘÏ+w¾“¤W8 "ÇóüçËlŸ$E•G£Ó"ß`E£j€ UTVP™y²ÈGåIB‹MÍ¡?[¤á ÖY€ãí²•¶ +{’ÜmÉ<ª]9ÖÙ²MÌ´?ˆC¾àÌzeìóp­Žöa¾ô]÷Ç˯Ÿ$8Ã)yu¬DÎ4ôkú¬„³A‡ëkCdÛnòñ +®3häxTäÃ6R”cȪÜŠ1ׄ”-g‚Ô9ˆV‚­ÎĪVÈ1ú¸Ò9õ3±£‡êæý88*¦ÁndhÌ+úr©§‚±®®ŽË®ìnJ"„háï·3PÒÈòG)ìlr{´ŒC Çå#w&PËÖ’_Ž=éJÑÜqƒà°D”6ÇGÀâ9)ÀþX¼)J¿eo2€PH9̓"Ê°°xû Xs×T»l Ä×1òÒŒƒ‰Ö{qLLü×ÝÏØ›c%ÁW.C‚]—!*ð£kå9s/}£2N5É6zM”Rɬ"d‹;³V‚ɪhÒKm‘¦©Š¼¬îù*[4ÇÒ*Ïj«¥¶3×!Z¼„¨§ÿ’°HÓÖ£ {T’ÄŽ# > endobj -4904 0 obj << -/D [4902 0 R /XYZ 85.039 786.531 null] +/Parent 5067 0 R >> endobj -846 0 obj << -/D [4902 0 R /XYZ 85.039 604.832 null] ->> endobj -4905 0 obj << -/D [4902 0 R /XYZ 85.039 566.731 null] +5083 0 obj << +/D [5081 0 R /XYZ 85.039 786.531 null] >> endobj -850 0 obj << -/D [4902 0 R /XYZ 85.039 566.731 null] +830 0 obj << +/D [5081 0 R /XYZ 85.039 384.808 null] >> endobj -4906 0 obj << -/D [4902 0 R /XYZ 85.039 532.654 null] +5084 0 obj << +/D [5081 0 R /XYZ 85.039 341.854 null] >> endobj -854 0 obj << -/D [4902 0 R /XYZ 85.039 235.69 null] +834 0 obj << +/D [5081 0 R /XYZ 85.039 259.512 null] >> endobj -4907 0 obj << -/D [4902 0 R /XYZ 85.039 203.472 null] +5085 0 obj << +/D [5081 0 R /XYZ 85.039 224.766 null] >> endobj -4901 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F20 2961 0 R /F15 2972 0 R >> -/XObject << /Im3 4353 0 R /Im1 4096 0 R >> +5080 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F41 3054 0 R /F59 3455 0 R /F35 3036 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4910 0 obj << -/Length 2461 +5088 0 obj << +/Length 2850 /Filter /FlateDecode >> stream -xÚíËnãFòî¯|Y -°¹l6›½9;ñ``ÏÚJ²‹$Z¢,©%éñúï·^M6-j&@€= 5«««ë]Õe5 àŸš¥Æt6KÒØ7ZÍ–»“`ö;?ž(Á8”sç‡ÅÉ߯MJŽ¡µŸ’‡ §d$ËbS°· É¢a¿®òl¼–ÀÁ˜q‹¿f`9ÀÖÈa³û+038ëà»xëéÆÐý\Á¿@¤~’Œži«ðjý4AR¥~ªRAyi‰sãß|BFH“iD¢PNؼÌOL"̱J~‰”׈haFÉUJÃK¼²å½öH Í-ì~¸¹{`$Q$ ‘ÆÒkLÈæ»9@çì/@£EEÆlÎÝJ6‹oOGä*¦.©Ã„~¾½ù¹G0ò ѧûoÐ锡8ákp—éÀ= À[’yV‰—#âÊîƒYj<1Àa ­ÃÀr‚òÊš£]Z£”ûNüœQÚ®Á“ÕÓ@e!€Ú)Ñ)ßJçâžðX[Š]§ªñâ+§ˆ|›ÐκƳˆAÐÕ¼$Ú„Âè/—èåp˜³NŒÆ"chÚ!æÚWtº¡3Lò.ì7IuXà"ƒ àKÄ~ú=WtùaÔIàcQ‘ŠQÓa¢¡›ô0ýñš³K@ÈB|»zjŠ]üô¶)ZÈyu4¤FßjÙ ÄôÕH‰Á`±Ïˆ¦Nb“@ld^çË-/H5”‡÷œkÁ k£Ðk9J…|Í¿ë|Û¼ßõ) ²,HÁ¦[ï"ÊÅ $Î!gÐÉš°²&^¼‘<+·ö>‘ðvÁ -¿C¿;½’¤ÀÕ¡¿ôt¬¾´Oí‡&CÇ”‹yL<Ï5K“ß,„)”£& -!8 •ÙxUÝñBȦ ÅNQƒ=Ö{ìQÕÞP®x"5$CF…í¾0µ¶–{&@¹ mlÚˆ7ái¾ÄØ››¶ÁµEpÛdsÕŒy`I톒-Ê*æŽB¯ìø—”…—“à€@þÜî·9^÷Æ°œqW¶€5úD:´¡ÔVïà$e“!_›\®“Ì¿Ï\®b-omiã iÆxá¼F8ÀÓS±âƒ5ïÖ®çÒHïÿ*d…_ÐPчÔÅe^!×dz:~Ô¼P9ŒéëÂ)¨hò®$Ù°q_L÷gŒFóenÀ]Ê-%ø­mçí›”íÚ}‰me'¶£ÄW&”èlæFC&9ŒdhS;í%‚‡ŽôËq?i´r:Û~¸9pÈåòÁ?[Ž²0Ný,ò£Xd‚ß¼ã̾Ûw²! oœäˆØé{âôXŽÀך4æ ´o•b|/GUœ¸á286ÀÇÑ€>fb²%njИ²ò9qrè8ƒ.G­6'PX¼R`7ÏòU>­G8Ÿw¶'·q‚õ¶Ü‘Z§*,”ÌaÜw^¸5ï&ð—ò ¿>¸Ô1´Þq—$MÂHä?89bDl-€j1ž]Œ9+P$ð©œ?]ÒN%¡Ofud"YZZ˜‹weUBs˜“+5.pÑjˆWõÉbÙ±µ­Sv§©ö€mŸ`lÛÃ]kù·©¹tcª½¢óʲ18TvÔË¥«‡ß>cµr¢b¸<9Éy,÷)¸1q±Ì·Š¹]\cóšQ(mWìp#F…vyºÛa–Ç7‰½bK+ê8†ÆO4U#=v³a®‰Q›üI‘´#˜ÐΩ­#îÖ|¥¤Êwâ=–ˆÁMW†âHC€*ÏU‘‰ç|¿öoH[xDÉßxý‘" _–Fè]P0”m-øÌ¢4¸pü)?_àPªà'Òçf«ƒ*@ÜÇ­œÄÛÔ;þ˜y—SÝÑ£0ÃÏëÅg^´e7¤Š‰±N•˜ô«cçèhIã¨*V£ÑR45Zº.m!äÁ’Râ}(›bÙѨ ‚ ÏÔÅ6;pÈ PkÛcR@ÿêøëR 8G‡OZe~¤gŒH¼–øXÓÁ¸8òd²ãï1ÚH3û ‰Ø‹¨J8‚½ã)~ÓÃÚZ­˜'—4`⮶o0É[×èNµ‚¬ŸjÁ2gìÚFZZÄOµ¬”T’àÃ>|¤P‰ñUŽüÓIRa6Ôw\ï)Q‘q)HËZF¸™ã;<̤#„ŸÑ¸r¦Zô¹~‡é´x´/xÔÆ7œ -:ªXoŒ>?Áöôd_I”ÂÛª´ -ôöY`«‚ðai¹:è¼×Ã<âÿ4W õ_©et‡ËØ÷™Ú÷™Ú±™šy7RÓÃHMÛá˜Ôôû‘ -™´áD€ }Þ:ƒ4miy+´ÃñÉ÷éÓŸž>±Šsk¼>vÁ{{?;ÙÎvü<Ú¤b&ïw’"l™¡^êý „.”± ߧט¤_"—2ÑhjTÙé‘'V¨xšÓÖ²¨ù‚\-0R&ão'xD&$8®90$ŠèM»<錪»«ª«¾ªj‰Yb–„~ ÒYœD~¨Älµ»f˜ùç…0ÁLûAâÔ?–—7a4ŸélùH$Ëõ¯ÞÕo^^ßÍJ)O(¾ˆãÄ»™ ïý|!¼×ÐzóïÞß]_-?ÝÍåýÂCooßaC{÷@öãÛ»k3<—‰w…ë¯pýý=_}º]ÞáÔ§÷óß–?]\/Ì.´¯#…Üþ~ñëoÁl ýtø*Mf/Ð|‘¦³Ý…•jeúåÅýÅ¿Ü.<§g¼jB' K±PŸ$Ú)G„ÊYnóùBÊÔ{)견‘ù—¢Úàhâ­êʸ‡É¬É[&ýO ti–µÇ¶Ë‘dÇ ó¬;4@Nƒí`ï† þ}KZÿ½—¢Ûr ¾@Ôâ\Î#õ#?«¦nëÇŽ»Ÿ‹ +(×̨9àv‰ë.e¼Âܧš_„¾A!aì‹$œRNW2˜ÐÕm¶ÖT{÷ûlešœ'~¢SÞkê˜ppÌä•|[’ap.h(APMR^~ù™‰è.†ê…WŸ®»Ëæ2öŽLÿŸ„4 3‡=v5÷e¨¹±Â3·Y“­º¼1Gã)uµO‘ vV­QpÒiιÇѸa¸]•HbV¡­`ùj¹IV•á)G=_8+©xx…¬#h+\Ãü QY£z6àÎa’zï+^€ÊÃï©òØÅS匷È_»¼j‹º2[°¤Zã:+ËF–.ÅÛ7]±:”Útå”-É…ºÍ½ Ò’Äžˆž5D¤hõEËþÆ^UwÜ ¾kn7ÈÖ¦nêC[y¨~hi{äçyÎê™y23›fxo¥Ùx`8eüÛ$0i”ÅÃÖyc6î*믚n©îúv6ôTMb ½ó%ëƒlm-V9 Ò£üs Y@À†Œ{è½SðtHBÙ”tç˘b鸰 Ÿ–Ú{[–LNâaã@Æüû¡_mó,uópïòÐñʺ2[¸Ü§Ú”fk“0{–Çjœú)²p*?.oÔ0RG‰Ëj³ÀtÌAû—›÷®ýå—åðŠ9…þx„¨”ûÝk7qý»ãã`ò$%XLœtOö \æYÉc¢1‡ÒYÅ“ÀTʹ|?Ÿ{Ñ “ -†áç[.pÎ^$¬Ž4¹é9ݵÜ_e•5Qb—RÒEþZ´á×^NÃeœéÍš+q~4”@«šJOI1"õ^úŸ² P1z()§H† )X/Ԥ̾6ËÆv·uq47³i웡FŒ£ Òü)@@²\K…Ébˆ Â)IWí½ö…ŠËØncñØîV”%ïb묉”~µ²Q.+2'¤õlNW>ô‰-º´Â{Ïy¾îm¢1KŒr$^¨… 燥™¤4B Á^εàŠ5yNü‡]cÁŸNF@Œ™ˆ uyè(ØWl2/(RM¡Â¤a6Êæẟb•çU…B_Î*”¾ŒÓo.*ÞP€î! ¢lŒJ‹}Fý Ç)§%MOÖB$PX$ßYX(}^M+mn'ß}2Tpù4g‚gÎtåO¤µÒ„Mô0/-ÇJÐ[ª¥9¼š€·Ô‰Ï,#üYS¼×|n‚,¥,l,¢Ž­ð W!J? +ÆeI(ubã´XD©S6ilðãÖ Ê˜5ëE[ŽäEƾNÃÿå„|‰¯U2(º–?OÐi4/‹]ÑåÏ‹Kjh­ùr‰²6‘Š `mG+U»ÏÜÎ IŒ'¤Á¥Èh¤›U¡kÜsÀô(›p™ú2€ÕQìÇ:úv_hì½=›*ûý:¯ºÑ“hë½S/rî6Õßù"§“ó@C$¤vëƒä®åtÞ!Åž³§ºéx"ãOU;αKe2|ñž—›á)ô;|T %;Sñ4·x~yÉó*HüH…ö⇠k±ŸˆØP˜TmÈc=ºï&Ÿˆ\)Õ@qÌž×>a'Â籎>ú×$|£sém9‘fè‚>Ö&ø]ÕƒúÞTX0†JÁ/×Ol©ø2GGëÝCdüDK°x¡Æ°æƒUüœÝFù훉 g6ø"†´‡¾'ú7DmRÆ£‹·X…!<‚Í]}`§Ê×¼„mDƾtYÕ\‚*û¼È$»–ƒòvT(ØP‹ñŸ¡Žß½†%}… 'ó¡ÁÓBNmQZä8Z^àÞ evÀûǼ@ ÝocŠ‰…©‰q°ãߨ¤ÞÖdo2 WÌ »ÀŸ™t2¼Ô³KÇçaÁÍËÖÝ’¤·:À&´ÆåÒpe/m©´Û¹G|ü‰'(99P¦†ÕJ5’c¬ÿ­å©î±åÉzšs@0ò™_,QùIf™ÆáBú¡Çšæ’‡_èµhËä J Ö­P_Ó­R?„läÿR®êëÀ£:þ= ¼¾ÀŸŽ|`×LÏsÂÄ펑xáb¸e M«å­8ÂÀèó<Œàrƒ™4W‡ÂÑ+zÉ%ý²4Œ> endobj -4911 0 obj << -/D [4909 0 R /XYZ 85.039 786.531 null] ->> endobj -858 0 obj << -/D [4909 0 R /XYZ 85.039 766.606 null] ->> endobj -4912 0 obj << -/D [4909 0 R /XYZ 85.039 746.277 null] ->> endobj -862 0 obj << -/D [4909 0 R /XYZ 85.039 381.058 null] +/Parent 5067 0 R >> endobj -4913 0 obj << -/D [4909 0 R /XYZ 85.039 344.191 null] +5089 0 obj << +/D [5087 0 R /XYZ 85.039 786.531 null] >> endobj -4908 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F77 4849 0 R /F58 3360 0 R >> +5086 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R /F41 3054 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4917 0 obj << -/Length 3235 -/Filter /FlateDecode ->> -stream -xÚ¥ZKsãƾëW°xXeÂÏSJ^iãuÖ+Gb*N9>@D¢2®Vùõé× †ÈÝ8åòr=====Ý_7äÏ<øÏŸ¥‘ë©l–¤±)¶Þ]x³ ÌüõŠ¥,-šVß¿â™ï¹™—ÍV†Oæ¹QÏVÅoλ¯~YÝÜ-–J)ÇWîb™$©ó~á;Kßùx­ïxöúÃÝÍ»ÕíÝ"UοxèêÓ56BçÈ~¼º»‘áE:ïpý;\ÏÃïn?­îpêöãýâ÷ÕO7+s눾R(þ¿ýîÍ -8êOž«²tömÏõ³l¶»#åF¡’~}qñwË篚Җ¦Xú™›ÑyƱ{±ÑhàMh4ŠÜ8LH£ ÄÈ…S‡®ÚŒÂÌy_Õ%h Ž_ÊsÊnWÁ|ßÃ?UÛô§T!<ÏÊ6Òl~4![໑§H¶Õ ²Ð釼)`ÿ¼+p@9ÿøôáWníûo®ƒÙï7]»ÆÆË"HœÇjY0txˆçº¸üxb ã²Í9Ѳ®ì±ý ãÀˆö®š ¯˜we^ÌÑÊ<ß™¿tÕPšÉò…9úÎzS¨/PÃft.fkäÞa£êiG”•¼ bBÓ@ça¡½ËqY¥NYð‚‡E9¯Ü¾Ïwh¼9w‘qƒCË2NçïJaZÖ%IS2)“|Zñ/¿“Üy©`%´àPòÐewùž,v._¸•€ž½Hw‰Š¹œÐÇ -‡gT~Œçý8âñT(6öh7l|ý² -eÇ_a ¶L´=X25¶ÁìC•²±!)Û¶Íè,”<ï„Ãx$*&N\‰~áúX|³ØÞÔí{m!tкùƱwó9”Ý+þ´M‰è§Îc[£¸-Ž’ø¬ÅM#EÓÀ¶è0têªx“ö‘GÎ0‰ ãTŸV=.è*¨ êÙ_¹G¤mW㥸Šà'&úEC‹·hÊŽ»Æ‚ ½Á»À7½XÛ>ÊÊoGËJË:a\Tý3ê$Gm¶èµÀúœHSÜú hðÈe*ša b£¸àm:&:ð]r½HHªuÛKËÉôIä*_Éú-ÂsÖxýAâ;ìÔÞî¹TYæ*h“:#ko ^o‚ÑP±ÉÔ¯L2m*J¦¢F÷ˆQS¬Zd-*8}H4m-¸±¶â_rÃ2èíõã,…Žü56´ c -׃¸‰Ç¿Â!‚íòF®WÞ3´NøÝŠ”óJÈA¯ Ã\Ü#âÜbe<)N­[šÜi6ô`á·Éw¥HÔïרá-/Ïe ¼Ûă "ó°G³ A ÚnâÅ<¢njô !XIË’t-¨ õÙðÔ¾ßçtÁ¯Ü77ú߀pÍ‹Ñû=è…Ì}/’üÛóCè|! "2­þÃ}Å|»q -ó^d!w^årŒ+ꮉ9Ë5gnUcÎ9¡Ò<˜…xö¹eÉh½‡FÃk~Øã g`§Û\Zt ¶ ×Ve¤G&cÛ…¿–SÉ–îÆ›–'œªPL¿‘,ÇÙ …fèg¨Ö{òe2)¦ -ƒ¨7úIä5iF£c^†dH;~Ìdôrh Q#çCä|z;‘8†´FŸB#óFÏz§ýÝ/±JchÈ¢/E šÒnÛ»–8Ò}ã-”2®Ž½JŠ«Ú ?›K ßæE¯/Z_njxØØ5uƒH;ðùj‘ÃZ€ƒÄD‰sKá ²­žç¾Ü÷Àƒ@œE÷? ¸²zÀg?ƒ‹¼—mµFÂ-_òht* ¹£Ã¾e ? Œã-°ñeÖ)*’ŒÈ ’è@?])èª#ï˜)¶Ë@û>½Žl‡H)ªÌ—÷œñÃ=ä²É–ðg®žïBMßyW¥æ2n§ôÄnjî‹Ñ'sç˜~b>€“J?|ÅF f¼uÛ \¦åI… -’˜@Åvh^·û®”Í!ü“˜ö*Û5Ûtû$ÝÊ&ÔþŽ­ lÆìy£e“ðº¯à_8ìÏ­•\åWµd„gb+U"vØ<9÷0—º%ƒ›Â½Ä¢€ðRQXQÖZÞNiÆ9D-ìSÜég˜&.'â'³Ï‘ädbÆ«"u”’_ëhØ‘j×p -:_â“e†+hÐNÏ&ÌaìçEiN&ÌaÎÇcõ^WÉ=‡¶«~@ŠFÈ$&W@¿'aüÓê=;bCXÉ£ýk?”|¢–W(VˆƒÁŒ-“¨à¡ØèLúˆsò¦´(<úu‚Z‡Äó²˜AF×25<ÿ\’úŠ¬)šcc,}Ä`Ü gQ•8hÈ‹C¿òt5p@®¹"j,]mK0­–UÓ¹ -ñk´”¼¶B°#ØU„œTHÞYî™ ŸLž#WŽP¿§Ýí–Îünáû¾óÏ9O1Ü‚½–KÚ£„!Üœyì–°´@ ‹L9™P§P’R†Çó0f•©v½ƒÖ4¶ -Ø—_ròZêøUÇ“R\Î^T‚žÈÀGˆ]ÚóSxÝôSÓF§­à:LØC/GJSë®z°K¼'µ( ??YÄÙð±âÓæÛ!¢†ÙMcfëÜJòua‘*g*Ëâ”= å]¬[*¥±y'8‰·Š¿$VÇÑ‚p"¾œøU!qjGÛà0˜BÍ­c”ƒcbËØ4Q+Õ¥k÷·ñÉ,lŒçÊ'C@"óžúCÀŒ7·¤wŽ}Ì[¶#hAG3öU±{“‡yX¢ÔHÇ̆%í"¿ û>/däåóý{‘|¡óÖmÑ -òé{]ñ:Ò䶤òédþd¿»Ìãë{=p0U_ŠÙ£r´×a›¬Â"jÁ N×€\Ò"] c]9ì;6øgc¿[ }™„> ¾Â“2Èö´ðÙ@þD,aŸCã-ÑòžH繸½œÇ J~]c-Þv­÷`£¦j2Gž®µ¶ÆVý–«‘Jé;­¦#ϱ u -SX—úÊ‹Æ *ßÍÐá„„X¨*Âèy€:©ÚUT¯œ¢Ä±…EÐ÷)Îjc¬äu º<ºžiõÿ€º‚0qãó8q$9‰¹?rSߧý,^a¤—C$áÁÛL"“´âÔK$ÔýÊoLßø€$2®™Éo_ížuð±†9-¤7FÒ CáŽ1´óHÔ™w˜DGÑÕ÷ä‹PyÝnØ/YQì‹|ŸDÃ1 ÝV]Q:õdÒTòåD¡ÔØ-‘ÄíöoS©ç*ü˜Æ©%ÍINeþØùñ¨Þ"etj8ðÒr~IШ+óøzÖÐaj|縀Ï`Õd g^}Yè5­$ÜIঙøIÄdDQÂp#s'C­àJ„¿¬É`AÝ·<=~í1‡è3ÚIj± -G麶XÂŒãWS»ŒBƒ_ ãÌ—ÓÀ“llžNIe¬Ñ8n>á[»¾•³ù€7€ Éwöƒ†°'•²µ-Þ±•…u/^úMâ9H:Þ©‹¼¸Ž+’ížCÛT$ü@@6±Ðs* [ ÖÀÕìd,@›×Üé÷ãG=ò BÄn=µs"¢%Î#ÝLTUéaùK©Ø‚ ¸ã0”;ýúxáƒn\{Òò`­>V`%¤õèU¦J×9Õ’uX’…d‚Tâçßùqñï溤â†8(.+ýú>ßHâq®*?±2_îH¾Êéý„ñ%Ùü”uN¤¹^DXeÊ/Å›%ú ÐüŠ¤,¦*O -GúÖ={­8¥•M è.„6çŸÚxr¡æïx±ýY¼—ã4TDøgqÅ=¤Ô´þTXC “©³¦¯z‰Í1‰ÇÎ.oè³ý¾ÎI=’lLC ½ÞwæÓ »^ù-ˤgrà]çKØ髆«„¶8D#ÉQˆžþR«Óp‰${úF­¿&JÎô$ïõTe9‚–ºÚ—÷66ù}2ìÊÃ)úب•«‹'¿8Z`;ÔßFFyQ¢Q^VÊa' "<Õpº¤ÿ³^þ¯¿û± -“n–ž(òEA྆ tK©ÔR5!ò‹1)2endstream +5092 0 obj << +/Length 2703 +/Filter /FlateDecode +>> +stream +xÚÍÉnÜFö®¯h æÀLºXÅÕ7$OÈvÆÒ âèn¶Dˆ‹†d»% ?o+²JîÁÈ€!]Ëc½µÞVög +þógIè)“Îâ$òBãÏÕ‰šÝÀÎ?O|P³ÀSQˆ[ÿ¸>yý6Œf¾òR•Î®Wr½üÃ9ûéô—ë‹Os×ãøÆ›»qœ8oç¾ónîúÎåŒ^ñîù»Og×?ÍãüÎK§Îq8WöÓé§ YžëÄ9ÃïÏðû«+^>ûøáún}¼¼šÿyýóÉÅõ±nà‘AjÿsòÇŸj¶†~>QžI“ÙÆÊóÓtV¡ñÂÀȼ<¹:ù×p +ï3þjB&n #OÇ00ÊK’`ŽN§i™ðþ¸È‘ŸG^¨²¹ŽíäËÜ…I΂ø¬ü€K‚îìçYÏ£®6õ\§NŸ5/v}Ööîú^@šZθY·ðÿ¬/\Â1°àíËÎ5Ú‹u Ì)/ +â)¾C/A,»ZM°{YÀñõRENV/q;W·ÍÜ(h<[÷²ù×> ¾ö=£5£˜ÂnaŸö{°’ÀDί@D¸APh+d`bû.å<[w2hVüågßåÀîd5Ì–¼ÛáA¨È8!E¬aÒÓòß„…£¬•³³E`YY>"Ë37M½P3î +ð„„w 9¤ŠÎ,„¤àl$ö ãe$×(uh*°&¦£MQ–¯p㙑CF”?ä#Ÿ¹Ð$¦Œc$ Ìw¿A »•ýÖZ}&”” 1²°6 KÀ ŠE±@‚”$2 1zä\Kο?¼û w|ç®Þ×1®’t K§±šD´¢Í}Ó>òJI6s7÷Y˯xõ Ì×=÷®°b ãN^# =XÊֲ䆀ðå/V¸ÚT<ÙX³ÅJ⽸¾'Œ=ÆÚR·â/„´í­¥x’ƳHtì)ðqˆä +m¬BÄ®¨) Ð{‚\ +ݘ±Q§[:éxNw†aX=8ê…)š8.‚[¡³ BîŠ ßµ– U|SÓQ8¯–ñè³ +ÕÖ¥À%ðÀ[Båû&·6¨‹GøÒû +ÓÄ9EÃL§‘K×ZcMB@¦b݈IB8)[òˆÜ=€mÚ¢·zÇ“eÕ^oº—~ÏŽ0ÈQ;”‘5!!‚¼¿¨-ÿ*oózAèÐB¼ ;zBÅaäl9¼ý–Ç%ÙNƒ3AÓ¢!á¬oF¾C×Ù5«žw­Ùxà߇xN@dír†w +6T2Ί¸!5Ü oŽ6“÷WŒþJàK¾%xâОŽCrx ãÀYeUAÜg-/l +: ÂÖ;3èºwNkjñ*0F§yK^º+ƒ§ƒ×Ç’k„ß1Î×èkj>·æí® ýà (û¬Î›uG&@_½yœà¶jìUgÉH oêÃl§HyFÞ>g#A/ cCÙŒJb:óú6o…ò̪¬æXD³†/®H­[£Ÿì-·âü‹ìD˜âíÜ'–„&ý”žcò€9¥Ø ͽ*ê¢ëáÑõÈ®aoþêè +´dì@Hà+¾zDÂ?_q¤ç]ëà|5ºŸcf+^Š™íˆüü*Ž¥“nxw5¨ƒÜBvˆëd‡Œ¥äM__$|ÒØfBYyáì˜wñuSá¤ÌW’I®lnšIdÈúýl³³´ÎŒç‚Ü•SCN¼Ù²A1µ{$·IºEÛ\ñïkr%¬ OÑW ¢|‰G²ÁôÑÔ‡™¬éyC*맱9åt]ãê v’YßKÑHÆt¤¦=À¢Ñ„ÊyŸÕÙÍ@ø‡s«8Ì$ØQB8o ÐÌam¢!¹ ž Æø^¢ŸÏmí4Áà¡YàC~!+x³ÎR¶àEh(!¡"šè–Í\ª’-9‰ëu­þ‹€Y°ù½AN_¿ôÉ:ñ½HÅBø¢cŸ¿â¶ÌËœ$Å $WgU·ìðÍÕ@(‡xõ¡6£)‰þ@)Ä^¸ °ÿKâÞ¡}÷<…Ðö¥´‚M¨´õ' #(:SùìÍ>|d¢Ýšæ™f½˜þy1¨sU:êƒýƒ½D;×D£ŸÜO÷¨Òàô#µGÖA¡kTì%P&C„êç`¹8„°?_TJe¢þ½ÕSÇÐG +Žá‘@ïžy4Í‹±>ŸÔó)›4æw{2 +4TÂöäïO º„D9Ð$E9X8£jA.çò p6)¸ø%HõÑKCª˜\éoЦ"(2^DŒà%à?K3¹¡Þk’MÞì×ÞW{B2‰F Ë(ü¿ + ð¼GT-mPÁ½Ý', ½8^‚0zir”¤ª;®Ž /I¼ÌõÈû1m+>J“S§l +¢çK˜”ö?:†Öšz„ç¬Êx&‰_‚681py mÕñV±1I_Þª’ÁªbˆÐþžƒŸؘíEß ÓôE"û ÿJ8%½óÚjq3E­oB/ ’ïçÝ–¶_¥ÐÁNÑòhj!ø*“üp¡ÒR/±_ÍÒt ƒã'‹­ÄwTµe¤Úz[ضE/ çܵ¥×„G^:], -æ6LÏšºoAòÓXøLæ§ß,Á0åÑN÷œ[S{X¸ž-+*š +*¸”åžD¢‡T‚Ï5-µn¸Á§¹‹ñµè†ª:ñ¹g{¶¹¨Ù¯®)·çŽ¤4›`«o3*L‡š Öl-§SgM<ÂTËñm¾r'Úy+½j©³¥ÃXIÅO•ŸÊ{ գËu8ö¾`,±-´SËHoÓöX«¢ã¢•ø" åî@.`$‰Ú´©ó~½À½[F³ Î Æ1H‘•v-Š÷k.§tq‹UDZó%£~žŽÉuqѶk+Öp7‹`Ò;lð½©ÇÞ[˜7¼ŠjED,»ŽúK´ÎM’âž,£{º ´ÊEIMæÂ6Ùp¹Ó8ûå#¾õ‡,í!av[ïg K›'Jöa—bÌó +[àãóìe'ýmôw^/úñÑ$>6‹4>쳸ßüº’o{qÚq#~û‰"*ŽFö»Òíþ&N‡ç:?Aƒ³/<8å÷…í.]êl·E¨=ŽØuÜA€‚îYOSŽF$»]Þ÷÷òî}µùДK¹9XT™¥€ïw/s‡0qø>g:*ú¡›»°²ê‘#åeìt·'pÐý-Gç´Ý`“g–æξÙÎPS–ÜHˆ¡•VÙuöÅéý;\L:èð×-³‰lÓ£ÓÂýÈè ¦—íæ¡uñè ャY»©›ŠìƇHé)Ch¥Œ«B××2×oBÙòžÂ´ÙÂdâ§1é6L¢Ô“¨t*¨¦q¹WÚWÊÑÏ0Á$H¾‰¨Z/n³e£ô3¼m¾>3ñ Ön\þ{ytÁ{îÆå¿—ÇN¥$ÎÑÉÃ7ÒòãþÙ‰‰=?ÙNñŸÎCÀærGÈO£`·Ÿ÷_P-X”endstream endobj -4916 0 obj << +5091 0 obj << /Type /Page -/Contents 4917 0 R -/Resources 4915 0 R +/Contents 5092 0 R +/Resources 5090 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4914 0 R +/Parent 5067 0 R >> endobj -4918 0 obj << -/D [4916 0 R /XYZ 85.039 786.531 null] +5093 0 obj << +/D [5091 0 R /XYZ 85.039 786.531 null] >> endobj -866 0 obj << -/D [4916 0 R /XYZ 85.039 766.606 null] +838 0 obj << +/D [5091 0 R /XYZ 85.039 517.879 null] >> endobj -4919 0 obj << -/D [4916 0 R /XYZ 85.039 748.602 null] +5094 0 obj << +/D [5091 0 R /XYZ 85.039 483.739 null] >> endobj -870 0 obj << -/D [4916 0 R /XYZ 85.039 487.33 null] +5095 0 obj << +/D [5091 0 R /XYZ 85.039 444.889 null] >> endobj -4920 0 obj << -/D [4916 0 R /XYZ 85.039 453.186 null] +5096 0 obj << +/D [5091 0 R /XYZ 229.576 450.863 null] >> endobj -874 0 obj << -/D [4916 0 R /XYZ 85.039 275.331 null] +842 0 obj << +/D [5091 0 R /XYZ 85.039 342.418 null] >> endobj -4921 0 obj << -/D [4916 0 R /XYZ 85.039 240.585 null] +5097 0 obj << +/D [5091 0 R /XYZ 85.039 307.672 null] >> endobj -4915 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> +5090 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4924 0 obj << -/Length 2991 -/Filter /FlateDecode ->> -stream -xÚ¥ZÝs£È÷_¡òË¢ªf` o›]on/[vb+•¤îîKX¦VðÚÎ_Ÿþ!$'•ººefhz¦?¦û×-‡³þ giì*›™4ñcÎV»‹`¶7º…b!$ ‡æË‹«/q2 ? ²Ùò±ç“~œ%³åúWïÓÏÿ²¼¾›/”R^¨üù˜Ôû2½¯óEè}»†ÑOüöó×»ëOËÛ»yª¼òÒÇ›Ï8ÐÞ=ýüñîZ–çQê}Âï?á÷÷÷¼üéöfy‡¯n¿ÝÏ_þrq½ìpD •Âãÿëâ×߃ÙDýå"ðU–Î^`øa–Ív:V~¬•Ì·÷íyñ;=㯦´«ÔSu¬®0žPWû‰6¤®¯ J¢¼ÚÛÏ NÑìʶEq˺â÷]r—ûmÑ1áoAe÷«6LöÜÊŒ•l"oƒãúy?¬ÔBû‚š«›í^»—-?›b‡œj$úÿk~ñäM½ã‰=€Jbo[˜NÝñõã ”ñúƒßž¶e˲B#‚B!ê;#Ù¢Äx7K~â‰Ë|[opšxÄŸNúú*0ðÅTHƒ°0/vOîxõ% -+…Iè'i -çÀýoÿÌ$† 3i¡xx¶]WW|‘ Ϲoì†lMT!‘tü|)·[W3GcíIô±|•·ü¼¬jLêUü^µ—Ì°fÅ.Â4„{MêWÅ‘÷·›¯ÿÀ‘˜¦\ÛÀ-Ö™ag…·oä9Ï<9PµŠïGY¼0?—·=Û5;0È7yY / ’.+”ק®…ò’)Š -ÏÔ5o|†«T0m²—äÍ„“¡j•QÃa ÎF†O"ÇðBø† y{9áQâ'*’ß‚0Î7xñҰߥWk»²¶+XÂ5_ÑÜqi¾|b…8 ¼¥uåRøå[”ˆIî–™ V‚IW gÜ\v9Ò*; 3}€I¾šÃ)¾8ð$ÓÛA[5«ua2ߤš•“ -Öȶ)HÔ®&Aè&ÒZÁ Ãiaò”»’c>€pTãa†P¤”ãz;¦b“â -k6rZÒŽßÒÞõŽ½¢®Ä|ë‘ñˆõ(ÀGЈŽ¹8"má­§ª›NhH¬íOìñp|Ù\‚h û"n«ÃÌË«5._/™õ^öìù™WL…眿Ùm -y] -yÍ÷¨á™ýˆSÃê™ôÑ!‡·©«Ð±Â8ªÖŸRãµÏ+üè gpõò3Ñ ê-x=_±uÛþ–âG¼å³lÅ+œ@‡T‡å`á8p⨜ȵÜTu3böBÚ¡Í÷W·e!oêž{1¡‡û|‡Ò>äì.¿v¿æÐMøƒ¿»§ÖZ¼¤èº}bÃÆ?yåðe]ñ3çe¹áâÌIz|Ñû•Ž¬Qkò£aSaøÈ‹'Ã'r@$;USÌù–T3ðukïð?VÜ>oEDª—Eÿ -ЈbŽ^ð|`O¤qñ"çÏÛŽ—mB$ËÁœB®“ÀƒÚ¶ žè$¥¤ÇI.ÌÖe¾Å£TS~y)¿Yz{¾RxR:=š°L‡èEoa’ -˜PÒ@¯5/páçYé˜âJÅ7­è㯎­a&ðJúÚ‚‘»b¿…°Ía5%Ó«L?'BƧŸñ€'éâ•ÀY7¼Hñô9~ƪØȆtÄÞõéÜß9™1 cÉZÓ]#i0(ᓲC9œ> ] nøj.¢Lù&3:\mKÑZz3¡•`×gœƒo4äWú½×ä\“Áä…QÌÏ:A*dó¿f7…ÁÉ{ˆ_>Pßñ$çdzE9Eseü•Åí’ȯ“ËR¾­ÎõcN‡1u,Î.·—0w(m -9öÝ'4ÙæiËJ›ˆ±îˆH§¤”÷T;F¤é DEUÒ›êTü£˜0¦V~¤cTŽà+ ¹êúF'îñfr]Í×ÕöG#„id©À¢ø@g­˜~eƒ~¾et²ÄðC±â{v”wûRMûTîy:ùÆîµÄ*L.Å’3RŠ0[ƒÙHAmœFï¡Y§=š¥à­Ü«‡ædó@kˆöCë%\Pò˜T ktü†'è9Ž‘YÓò2¹3<6pÕT“7 Ó8wÔ‹”LiÄÑ>l-lµQº_ó:vmrJgT>È.¶È¡S°aÕ¸`=*#¨!§v1tŠ®¯s[[‘B>YZpÁ·ÉBÿá”!í›ä¼':4däÛ, zFRç™ñ~aø)ÜsZš£³TÁňvìÑ<;¶„oôúý„èÊ?1g%HN .4ïÉ}f·^ìÑv“R;Û= vËF¶þÊdM9¨By»š¢îº8¥8ðcWÈ@sF#Bô®JÎl8èd´ã´RœG6 -è -S+†nâi?‰”¯ÍùXåМы½«—3zí8­gÇco9Âþ®õWÉŒýÇoÂ…‘Qp–ÀRnܺ òÇGߊ…™a‚L wÚ ˜“Å~–C«ÈÙ|Aœ¶ãâè÷¡˧k¾4;ŽÓø;Å~ ²è_nÊ¡UñVnûñ¸ž…o$›ØsJ2LÉPnpU!¾¥Ì5à[l{ê„Bþ¥ð«W^q{á8—š[¿‰Æ^ ·Lõ¨“€ ÒqÕ‰7ª°˜°ÚÈ;b´é;°:ù¯ÙH‡ŽGƒœ\KÉv;ÛîL§“ãµ€(ÕRÇ_¥\BQÈNx®'× Àä ý#!ò7ÙÑö ôµ­J¹œ-œ$ÎI]ʾ¼Ú’ýÉ_ø+3’ª–•y£A>À7ᇠm”•Óã£\é#A¤Ñ×HÊߺíƒN Á–\R(PO=cYë›v÷Œ<Õý¹n[[ä€"áo©·@¿ºÞ¿‹EN"k[‘Œ‰Ó'OÔ‰˜ D}ÌæÙ``š9„ÒJÖ\¢%Ò„¶?8EC¿'üƒMäøB¢çÔ£"Ä1ˆÏn–úQ(a -ÍÉBsÐyÜÚöAñ¢ÄWÔ¡ÏÉoˆ\HÚ†²˜ð®Ck1aa ^·B ¶w~/£»™rOb†fóÔ)Š÷Œ©i`ôÐ4‚ñ j˜¯Ô‘.û‚°£ÊÒhÇáM£­W"Ýp·ŒœÔX)íÎÄg?æqÌ×âYVrá2üüŒwìv@éÂô‚#I õÓ­§ºÉ½&©™óÃI*ã«ò{#Þ¾uùhÛ·Op0´&ÃQgä8s ã÷›­@$Gâ-úÄpÌåËVZ¨‡‚ß‘› ³Àfp‹›âU®Úýa™+ìW……äâMe$$è;Ó¿©FœŠp »¸?Û`läîæF('<¨>xº¤Àu&r{Ä€ÉáäÉ)Ç iÊP×"ðB>UD~ŠYG|C›‚g¬ÂQÞ6Nÿ—‰Ô BÈLʲK\Ûí$ˆà1{=¸ qÑã8ïcüEÉFWeêvØÐ$Z"ž41–õ?pô€¾û߀š!(j7^ôÍY›aaœ‰~ªÄÂÞõ`ÎQgέ¥´­5œO‰°«í6ÖL@áHS[Œ÷–Î8¥'àø@ÍÉÖi‹çþŽÕ+?ý8@žÃŠýAæl‰d[l¹í´I|8€‡ù~¸ìS¹&Ëݺu†à’S&þ@‰ìƒ²dõ5ÿ9˸P‚ÿYôÿëO]œ^”Ÿ¥'ŠÐ -‘(ìC½8}TÜÙ¿‰9>òØ…Âfendstream +5101 0 obj << +/Length 2143 +/Filter /FlateDecode +>> +stream +xÚµÛnÛFö]_Aû@&3ÃÞ ôÁõ¥MÑMº¶Í"Í%ÒŠtHʲ÷ë{.3ÔJ ¤MópæÜæ܇Òð_:Iè •:qù¡’Îb5Îìü<‘C8ÚQˆ[?Í&onÂÈ‘ÂOEêÌî e–t/¹ø}v};õ”R®TþÔ‹ãĽ™J÷íÔ“îo×ñîÕÛÛëËÙûÛi¢ÜÿñÒÅ»+´{h¿\Ü^›åi¸—H‰ôww¼|ùþÝì·Þÿv7ý4ûur=ÛQÖÓ¾Žjûeòñ“pr8Яá«4q6 _¦©³šèPù¡V潚ÜMþ3pá=í0ÕˆM<‹á)á'‰Œ£Âãä­çñoêR7˜zaº«¬}iàxaºu³*:8`/:a„@å‰Ð“† ΃ÔЮË,oD„ÀcKT(5ò6ýžÿ~yɈ¯º~TèÆü^)4ŽC}Z¨Ú + Yæ¡#¿&“ /…ŒO ö„êS'm7æ÷J©ZJ¾VjtBê¿píÍÜhO ?Ò aÌ–ÅÔÓZº‹¦ZC~®0Sk:^Îæ Oâ6˜ªOøÇ ·€R î#-A]Q#BÏŠPÀÖ}Û¬pA¸!ÝÚÁèl¶Üʇ%‘¡<ŸzQ˜o”]´«²ë¸lŒfT‡tƒ¦Aê®WH87È,­¹çç2ks€TêVeýy{®¾±jJ «Uq6b>:õ¦.ZSõÚfý¸-‚¬¼ÿ‚«ž{ŽZ½ô!ày A¶X&­w¼þ+Θ¶Ù¿÷åª0gEÌAUÞESdä®Â·º±/RvìEÍT{žcK?•Å†y •©_N‡ Ñã-2Iûƒí;{BÒƒ0*ræAGˌԹe‚èóf]oQËú°ä!Tü$ëG¦XŠy«}p¸ý™‹³+Î7åÃÚÄ! +ÄÞ%!Ä@¹Od +àN38ÍÓ?$‡6‘øJ@¿ÐLU|Üžâ46íI´'uÔž0Òü4Uc)”¾Â¾$Càë]”#T_C]£#9_@¦uû$ B{ hAÅ‘Ÿji7ß¼]Ié\5 —³Ó9á˜IÑÚK9&}ÏzQpÂ#䎄F 9RˆÀÓ" þù¡µ£Ä’W;ë=GxûTÚÈܘð7þßw4Ã|à·Ñ·¥euN¹¢ÊBAÆ®âk®ñ‚™â%ŽÇç2/€àß7ê H#̨‘.¨>¿ÀÑDêÎËž8c˜=,t#‹/Û†—õPy‹ÞÇ‚s…»[–Ìi`d•ÊH(;~GÂã &où4 #7ã6AuÝp ¢¢Ri[d£éàýÌVdϪ ׃Å +r‡* vÖý̸¤yHóƒ-o` T:k³E?„Ž?2¼”pñ\,Ö=Å‘Ût‡Ø‰ ÞJáyá˜'CYóÛÅâ©€ñ°6슪+nÿ çe÷Ò/ËúÁè[B†Tö#L“G!ýHEÿlaÒ~%ß(LyNƒç»¬‚ˆôçé¯1£Õ” +ƒ¨/‹a~⌯™€ìŽk{.cÒNŸx}lrºŒç×sœœc÷GÞÛK{Äê-ƒ–òâ©\lÇ4*›¸nèçO¹ ±ú|‚êqê±Üê~|ƒab34šNõ#¿A›3-îªYe¥™Æîu@¾ýØÔÈ×TA¦öÛ"×q÷ÞË7HI¥¤q äܾ€xXAâjƒÔl?âÿšŒx4;¶ ÷V¹õÐpp2i2§ó÷Î, i §¬3NŽ#e²—1ý‘ØŒéÈ s½¬Sè7¼‹öòÒš¹ÜOÓg:%±§“€hHë‡Âf;Ùãþ=o.Å}[,ú¦-·×&D&ÏV-™îH1ÊÁhE S½0³òž moE„K¡2#¾º$ªðÂôV¹¬v³Üì-G{æžì€uxs£ ëÏáþÔ¬LƒØqª¾Bñaçö´1àeÝ IˆS^k/h6 ðíí•Ù5²·Zb¤ÙUsxQëúrIòùe‹CÓýœáÃÿ±´VªñRšR‰ P…á„9'q®Âmš¼ gÀs8¾4†IÆ#%KF(ص•ÝìXœ©†¤Å23,mQú5íVÊ:;ò‘j6+‘:¤¦Š[sÅÈ ‘P HpnrgìúŒq$H¶:[5¼45…+@s+Q† +…mð 1dpiÀá:îãçéþQR¤7ëÞ¢š¸&XÐÆüƒLì3øñ*3ó0J­ FÈæ•á`?O*ØwìF3h6öÝ®¤qÓ(ؽšL6ô .ŠïPÓ-†p¸›ÁàfŸ?[PÆݽHÊyÉX¦Y§…†½ŠnÞ7äßÜ®Yσpƒš„DlO¤0 ‘¨²±Æ u ×ìÈý7\4íâÞ˜´zé2öebo…göóDfÒ>k·*6¨ …s•{X³³9Ù‰sÔ3ŒNfªŠ31@?z®îÔ–ˆŸf˜C + <ùû5„—ÈøÑnÕŠL%Š¨üâëNõ·‰­b¼¯ªsâªÝ40›„¹á\( ainJŒ±jä’¶Ûý‰ÙÏxéû¾¿+tÀàñ¯€2<úX#£ãKÇ_¯ŸÖ×endstream endobj -4923 0 obj << +5100 0 obj << /Type /Page -/Contents 4924 0 R -/Resources 4922 0 R +/Contents 5101 0 R +/Resources 5099 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4914 0 R ->> endobj -4925 0 obj << -/D [4923 0 R /XYZ 85.039 786.531 null] +/Parent 5108 0 R +/Annots [ 5103 0 R ] >> endobj -878 0 obj << -/D [4923 0 R /XYZ 85.039 507.319 null] ->> endobj -4926 0 obj << -/D [4923 0 R /XYZ 85.039 473.179 null] ->> endobj -4922 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R /F41 2994 0 R /F58 3360 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -4929 0 obj << -/Length 2767 +5098 0 obj << +/Type /XObject +/Subtype /Image +/Width 602 +/Height 267 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 7907 /Filter /FlateDecode >> stream -xÚ¥koã6ò{~…±_Vj­ÞîÃ^6{M¯HÚ$ÅõÐöm˱°¶”•èMóïo^¤([Îî] &‡ÃáÌp^…³þÂY‘úA\Îò"óÓ8œ­öÁìVþy -ÆBPÎ?.Þ}L³YøePÎ6–Nøi™ÍÖ¿y—ß¿ÿéáên¾ˆãØ c¾ÈóÂû8½ëù"ô~¼‚Ñw¼úáúîêòáön^ÄÞôþæïоw%àyTx—¸ÿ÷ßß3øòöæá—n¼ŸÿñðÃÅÕƒÀ1ŒcdÿóÅo³5ˆúÃEàÇe1{†qà‡e9Û_$iì§I,óÝÅýÅÏ–¯%3Þ5¥­4.ü´ˆOÕ¦êJS?KrR×õD‰b¯i5ú -Å”IõçÓ®W«5Œv/¼¢·uÏ£'Õ©}¥i[Ç ³Ô#¬"Z‰‡»[na\ñ˜p€Ï¾ÌÓÌS»Ã°®úÓ=›¶3L dÕUJËx§À¬«)þBÏÇ›­-BTjIZx@@æ8p·kñNŸqšzŠ¡‡Þ -3-¸{„Éq@ºÞ¼X‚h¸J–Dè½{ìÚÞçQî‘8»5oyr¹Ç¨ûº'ýà´MÏtÚFáŸßƒ0ÙÉÏ5HÐF´ ÀŽY½^wõJ×-® -sC§*!Îé"Á@‡s¼%Æ®:6Ò¬A`•å~PŠR·j¦”CV‡ÅÐ(ð .¬>Õb4…|­y¼Aö»(±I 0'+m¿0šsÕ8EÒm“ W]/„;YWOˆ±«+9E·ò PÃì -ùÛ/êˆÞg€ª^¼á(N#P[jJm·6úY)ª ”ó"AXDi·¥¹·®íµ­tÛ½0ô®ä]*Æ}®w(O\»(øÈž7i 0z¹@žµGZF/Lȯe½_´z9l[óŠA-jî ò''ð%ŽÄ2ÆŠ êÏQyš³Ft`Ë„SHÿç̶%AxrÝêËrBsqimÿã!5#\ì0 ¾V¹g!¤ÖŒØB´LòüÛ¨A–IBˆflG-<‰bFÇt4­¾ð”Á;ºHIŽñgY>¡ ôѺéuEìÄØCã]&~Æñ+Á¢Pa:eÂìëe ÚÇíG"á´ÃÂ^ÑáÊè8ÒHÌÅ•¥Ý+…|î4Ó¨Ùn¢òI%0rnü‹!&l²Á™I62%£mHÆ7DZ¸þ4až2)Ä``ÓArl1‡‰ÕþdäÄ…ýtdóôÉFi8v•†s -î°sÈøÈak8º=çf ê:•[I¢°Æ'Y:NŽ<6­äƧÒÊ5†Ü,— -$Ê0SG`Ä<pÏšu-qÄÀªqÍ^¶Ú»Î8€&] -y˜(餮:ÊœQ&9CiÆP “P(áÞd즆}JS¤•z¶,Â-æÅ?÷.ߧzî·Ì¤|}F2”¥w½vÜXãÙT€ÄV3uóÈ(C:s[­Ü‚)c0ïlØg)Áoí½PÌ«1–äÍBŽªŠÝ²›s"­Šc¢Ñ©€‚uiBöÌ·žP±ZfJÀÔÚ0¡²¢_Å?½ÑÕˆ­éâŨ§ç§FÈæ ÚÄɪåÃq½Š‹¤ö£:îÿQŽ“òÇç«;¦²DmNT¨Ó’ryÝñR©Õ* -[Báø4tÕ•E[3u;°Ó7o5C—éšüf®W‡^3(%„”{„6N† èoÛæ-?Ã’pˆTLáòmð$õmZ*|L.î&~\ð‹uŽÌRìºggó¸dŽƳu5eQ³WO۪ΡÃu ÉËo%ÜÍTi]Êë7#™R¿Ì 0{x"¦!û·É’ð%'œohëߥèÎó|ÂPŽƒîÿ’Ú¦{ÁáÉÄβ£m«*ËvüílO”qƒ0G Ñd¸W–‰‡9%<”ÓW{=¦#X ýÐ>¦ãÓ?¦Q ´¥ÜŸ/Ò4ð®Ñ*5±Ü)sûY6˜¬æÐD@W<é5ù(&ôŠîÊÉK:ÞS¥i;©eyàìÉ+{ôÖ§' ÿg‘Ç~œÅSŠ€;J2?Ï’oh_„Ÿédû¯žˆYœ¥C» Ã#ƒ>¦cï%ŠÀs˜eº`p¸—2ð“Ä‚ËHĺnZ£ëêX ‚eŸç%Rœ}ž…~”eÌ(Θ¸¤"À»ë}8ûЛ3‡S!»pèr;¦pÚ1aTúYžÎ¢"÷ 1¡{e*)]â<ç’8†oÖ¼âp KzüµQ 0>ÜÞ3iiÈ·KtN-«Kkx=cý¤AXm‡=rÒëJÒ -Øì^ÞÀ–§ôP£ˆOLLÕ†¿Æ R¹þÑŠ¡š 7è{~wâ -KS°Ü… ÁX",Ò¼„g†iJÀdoYk2d’®b -+‹Âó%×xŒ.§@R‡ƒR(ðì†æý‘…Œïœ‰ÄQázC`¼!oÈÉìW8ã·ø­îÈòƒq ÛNÂýC;˜ojÇ=&R¶|#ÛrÁþüç?_¹r¥Ðçó½õÖ[q_cØfÕÞPn´––9x饗víÚ|Í /¼Ðßß?::úÌ3Ï<öØcÚø÷¾÷=鄃ƒƒ###O<ñÄ£>:{l¸xñâžžž‰‰‰sçÎIÌ "ßõì³Ï—ò{“´ÃËjikk»råŠ\ŽtàP…^òŽ;vïÞ-ëG*óâ‹/>ýôÓ·´¡rɹÀ†ÖKQWW'+D +»wïÞ{î¹'îk ¬²¡l ¿üå/ËÁ—¾ô¥Ó§O‡¿æâÅ‹¹¹¹ÚñwÞ944¤Ëm˜••5{l(?œÿøÇ?ÖíYŒ +¢;‰ò{“´ÃHgVê,ôe‹- +¾L.£˵ÿûßÿ§NTlîܹF=jdd¤³³3;;Û¼ ÊYé¾7I;¼Ì_v.·´¡¬™à>E–ìÌËk´ä\`C£RèîD#ÆqaCp· /^ÜÝÝzžÊÖ/¿ü²\à{ï½·cÇŽàù;::þõ¯Éøï~÷»¥K—šD7+å÷&i‡¯ªªÚ¿¿¬¾¾¾êêj#nß¾Ýï÷‰:Cÿg™Qy–œ lhT +ÝhdÃ8®1lî¶á¡C‡–-[&?¢ÿÄÀÀÀÊ•+u3yðÁÓÒÒrrräf”8ƒ°^}õÕ;ï¼355µ¼¼ü7ÞpŸ ßzë-©FJJÊŠ+^ýõàùÅR _µjÕŸþô'ó‚èf¥üÞ$íð²Íy衇dm”••½ÿþû™™™ÊK6úR£ò-9ØШº;ÑȆq\cØÜmÃpvïÞú˜t:Þÿô‰o˜ø^˜˜˜xå•WìÚÄÅì¿#ÿ6kOÉÔÔTaaaècRlˆ ÍY²d‰ìAÒÓÓ7nÜøßÿþÒ‘X{ØpÖî ©µ`íaC:<µ¢V¬=lH‡§VÔ +Àѵ‘Ú¬wx VN܉ØÒá©w"€½ð»Üü þÕµâ_XpßaC:<µÂ†¬½Hë@Ŭ×ZQ+:°ö°!£VÔŠŽ¬=lHŨµ¢#kR1jE­èHÀÚÆTŒZQ+:°ö¬OÀâ 6¤ÃS+j€ ±!žZQ+lˆ éðÔŠZ¸fíMMM555åæ榥¥=øàƒØ0ôÌ@ ??Þ¼yº/Ý}÷Ý}}}rÐßß?gÎíøÝwß•qÝ+{{{‹ŠŠ&&&äxrrréÒ¥]]]níðÉR±øÖÊ}ë +Àk綾^zꩧäž:uê6 =ó³Ï>ûÑG…é»ßýîË/¿,?ýéO=Ï‹/¾(ǯ¾úª¼>üÅ{öìéèèÐ^¼cÇïw’¥bq·¡ËÖ€;ÖžüŒúᇚ‹oÖÚÐèKo¿ýö–-[ä`ýúõÒ”JJJäø±Ç;yò¤r÷ýè£ }ë[ߺ~ýº»m˜‹» ]¶®Ü±öRRRä¶Â†‘^õç?ÿùááá‚‚‚7näååýûßÿ.//7zqooo]]|ŒoÅâhĪXÂÚ0I×€;Ö^nnîøø86ŒôªwìØñÜsÏÕÖÖÊñw¾óÆÆÆ'Ÿ|ÒèÅò%iq_ÿú×gíÞ0¡*–È6LÆuàŽµ÷øã=zT~•ŸBëë뱡ū>qâDFFÆ‘#G丧§GŽ;¦|eGGÇk¯½&{÷îݹs笵aâT,‘m˜Œë +Àkoppð«_ýjZZÚ’%K~øÃbC‹W=55µråÊk׮ɱ|\±b…üDþ²¿ÿýï^¯W{ÙÄÄD~~¾´¸ÙiÃÄ©X"Û0×kÏÝ6t_Ũµ¢#kR1jE­èHÀÚÆTŒZQ+:°ö°!£VÔŠŽ¬=lHÅ’«VŽþ 6¤#AR¬=ˆÔ†`½ÃµrâNÀ†ØO­¸xÂF}¬¼ÒÝ5tâɶ[+ÆŠÀ†ô.ª„ YQØÞE•°!+ +Ò»¨6dE`CzU†¬(lHï¢JØ€ é]T ²¢°!½‹*aCV6¤wQ%lÈŠÀ†ô.ª„ YQØÞE•°!+ +Ò»¨6dE`CzU†¬(lHï¢JØ€ é]T ²¢°!½‹*aCV6¤wQ%lÈŠÀ†ô.ª„ YQØÞE•°!+ +Ò»¨6dE`CzU†¬(lHï¢JØ€ é]T ²¢°!½‹*aCV6¤wQ%lÈŠÀ†ô.ª„ YQØÞE•°!+ +Ò»¨6dE`CzU†¬(lHï¢JØ€ é]T ²¢°!½‹*aCV6¤wQ%lÈŠÀ†ô.ª„ YQØÞE•°!+ +Ò»¨6dE`CzU†¬(lHï¢JØeÎ?ÿùÏòòòùóçËÕ­Y³ÆÆš‰ÁâØœí°}J{÷î½ãŽ;-ZdòF1«$6¤waCl8;WÔÔÔTqqñž={®^½š°zJ:q’´´´óçÏ'`U±!½ R«ÙSŸ“'OÞsÏ=áãË–-“‹3gÎâÅ‹ùË_+ É'žxâ›ßüæ‰'"íÛ›7o>xð tww˱6("X»vmjjjIIɹsç´ÁÑÑÑÚÚÚììl9OAAAø9uǺ­“òœQŠL¹;Û·oßg?ûYÑ™Œ/]ºÔdJÖwÐ&ߨT^¦Ñ”°!½‹*aC{WTaå’»ºº¾ño}õÚµkøÃrssƒøÚ×¾öŸÿüç÷¿ÿ½è2Ò>áŸÏwöìY¯×;00  nܸQ¸ìL8|N[]]ÝÞÞ~ùòe#è®N÷©òœ¶lët_úÄ'>ñ›ßüfbb"š}œñY¿L“)aClH•°!64"(møî»ï>üðÃùùù·Ýv[è¶EvmrpãÆ[îzŒÞÎãñìß¿?8’žžœð¼yó´Á­[·šŸÓ܆Ês:aÃ7ß|óî»ïÞ¹sçàà`ìm¨¼L“)aClH•°á,¯€ þóŸ‹‹‹ÃÇïºë®çž{îÿø‡è/Ô†»½ÑW¥WK—½LèöJ3l(Á稺sŠ…å`||Ü܆Ês:aCall¬¥¥¥°°ðG?úQŒmht™FS†Ø*aClhÄÔÔ”×ëmooÅè:í_ÿú×?üðÉ'Ÿ´Ë†/^ôù|§OŸ–r¬ >òÈ#¢ÝK—.…¾²ªªÊï÷ëv7yyy===ýýý[¶l ß%‰¸ƒŸ*Ï©qÿý÷ÛkCáúõëï¼óΧ>õ)“)9aC“ËTN bCª„ ±¡ Ò´×®]«ýÞEð?ýä'?!~úÓŸÞ³gÏÌlþÌV,ÖÝÝ=}ó·häX¼råJeeeff¦¼,++K©©©‘Oe0''Gó½Œí©…QD9yå””¥‹òŠÜš„ˆ ±!6LäZ¹+—ìP¾aGGGcc£¼þøñã¡ç—‘ÊÊJ]pátq~¶cRðÉ›LIW:[®È}IˆØbÃĬ•Ë„håzÊ7ìééÙ´i“¼f×®]uuu¡åU†Í8ÎÏvŒ +¢œ¼rJÊÒÙrEîKBĆØ&¬ gåö÷÷J³---mii¹åwE盂('©œ’²t¶\‘û’±!6ĆØ0Ap(ßPÈÊÊÚ¾}{JJʾ}ûffC{S £,ˆr’Ê))KéÙkÄMBĆØbÃÄÁ‰|CAv…@ 77÷èÑ£3³¡½©…QD9Iå””¥‹ôŠ¢·aR$!bClˆ ±!Ø©…î¾7±!6ĆØ€n ±!6Ćt{lˆ ±!6 ÛcClˆ ±!ÝbClˆ èöØbCl@·Ç†ØbCº=6ĆØÆ'âü´šÏ;·¨¨èСCQž*. &f“w_j!6ĆØ&ÅùiŸœœ<|øpðO¯$‘ c9y÷¥bClˆ ±aÒáP¾¡Vðñññ®®®Õ«WkƒÖÓûúú¼^¯ÇãijjŠ— c0y·¦bClˆ ¹V³+Åq(ßP›@zzzssóÐÐ6h= pݺuõõõccc­­­ñzR³É»/µbClˆ É7 íÛ²…ììì ZO”­M0p!^{ØMÞ}©…ØbCH:Ê7Ô¾:<<¼jÕªàC<ëi€q·aÌ&ï¾ÔBlˆ ±!$å¿zêÔ©ÒÒRíÁõ4ÀŠŠŠ††éê~¿_÷F6FÆ~òöÚ0aS ±!6ĆŒ8‘oúÕ¶¶6‘Åt$i€gÎœ)**Z°`Ass³îì2Œñ䣷aR¤bClˆ …(ÃYØÇ°!6Ć@·Ç†ØÝbClt{lˆ ±!Ðí±!6Ć@·Ç†ØÝbClt{lˆ ±!Äçò c–Êgï[˜œM;hË”È7¤/aClqÇÑ|ÃXÞ‰v6ë'!ß¾„ ±!ÄGó ulÞ¼ùàÁƒrÐÝÝ-ÇÚ 2¤ott´¶¶6;;[ÎSPP~Nݱnë¤GÕS,,ãããæ64 +þ³Ý†ÓÆa‚1°!ù†ØbC° §ó C¹xñ¢Ïç;}ú´|”cmPÒWUUå÷ûu»›¼¼¼žžžþþþ-[¶„ï’DÜÁOM‚ÿ¬Ä#FdÃiƒ0AÝ”œ°!ù†ØbC°‡ò ßيź»»§oþkƒÊ¾‘‘‘ššùTsrr´Á#GŽlØ°AÐÛÛ«{÷@ ³]¸p¡É95¬Ä#šŸù^ÆöÔÂ( ¢œ¼rJÊÒEyEnMBĆØ0öU”8”oØÑÑÑØØ(¯?~üxèùe¤²²R\8EœŸí˜$|ò&SҕΖ+r_"6ĆØÜoØÓÓ³iÓ&yÍ®]»êêêBW£2„hÆq~¶cTåä•SR–Ζ+r_"6Ʊ¬€ åö÷÷J³---mii¹åwE盂('©œ’²t¶\‘û’±!6Ć 8”o(deemß¾=%%eß¾}3³¡½©…QD9Iå””¥‹ôŠìµaÂ&!bClˆ !qp"ßP]a ÈÍÍ=zôèÌlhoja”QNR9%eé"½¢èm˜IˆØbC» µÐÝ} bCVÐí±!6d…ÝbCVÐí±!6d…ÝbCVÐí±!6d…ÝbCVÐí±!6d…@lp"ÎO[ŸsçÎ-**:tèP”§ŠËͳɻ/µbClI‡Cq~Ú✜œ<|øpðO¯$‘ c9y÷¥bClˆ !ép(ßP[œããã]]]«W¯Ö­§öõõy½^ÇÓÔÔ/Æ`ònM-ĆØ0öUHÌ|CméééÍÍÍCCCÚ õ4ÀuëÖÕ××µ¶¶ÆëIiÌ&ï¾ÔBlˆ ±!oÚ·e ÙÙÙ´ž([›`àB¼ö†1›¼ûR ±!6H:Ê7Ô¾:<<¼jÕªàC<ëi€q·aÌ&ï¾ÔBlˆ ’‡ò ƒ_=uêTii©öàÎz`EEECCƒtu¿ß¯{#£ c?y{m˜°©…Ø$#Nä†~µ­­Md1Ià™3gŠŠŠ,XÐÜܬ{#{£ c<ùèm˜©…Ø€£e8 »=6Ćt{lˆ èöØÐí±!6 ÛcCl@·Ç†Ø€n ±!ÝbC€Øà\¾aÌRùì} “³ébm™ù†ØÄGó cÙ4ílÖOB¾!6ĆqÇÑ|C›7o>xð tww˱6¨ é­­­ÍÎΖó„ŸSw¬Û:)ϥȔ»3£0A‹ûbò ±a,m@¢“ ŽæêfráŸÏwöìY¯×;00  *Cúª««ÛÛÛ/_¾läÝÕY þ³e[ž"a&h½“oˆ ±!€»ó •oçñxöïßQ†ômݺÕüœæ6TžÓ š„ ÆÀ†äbCª`Žæ†#½Zz¸ìeB·Wá!}Á稺sŠ…å`||Ü܆FÁ¶ÛpÚ8L06$ßR%»p:ß0”‹/ú|¾Ó§OËG9Ö•!}UUU~¿_·»ÉËËëéééïïß²eKø.IÄüÔ$øÏJó½Œí©…QD9yå””¥‹òŠÜš„ˆ íµ!$Z¾aGGGcc£¼þøñã¡ç—‘ÊÊJ]pátq~¶cRðÉ›LIW:[®È}IˆØ¸;ß°§§gÓ¦Mòš]»vÕÕՅ޳ʢÇùÙŽQA”“WNIY:[®È}IˆØkHÊ7ìïï/,,”f[ZZÚÒÒrËïŠ&Î/6QNR9%eél¹"÷%!bC® Ap(ßPÈÊÊÚ¾}{JJʾ}ûffC{S £,ˆr’Ê))KéÙkÄMBĆ\;@âàD¾¡ »Â@ ››{ôèÑ™ÙÐÞÔÂ( ¢œ¤rJÊÒEzEÑÛ0)’±!×vAj¡»»=6dÐí±!ë€n Y't{lÈ: ÛcCÖ Ý²NèöØu@·Ç†¬€ØàDœŸvÏ;·¨¨èСCQž*.-(f“w_j!6ĆI‡Cq~Ú-<99yøðáàŸ^I"ÆròîK-ĆØ ép(ßP»…ÇÇÇ»ººV¯^­ ZOìëëóz½§©©)^6ŒÁäÝšZˆ í­$o¾¡6ôôôæææ¡¡!mÐzàºuëêëëÇÆÆZ[[ãõ¤4f“w_j!6Ćä†ömÙBvvv­§ÊÖ&¸¯½aÌ&ï¾ÔBlI‡Cù†ÚW‡‡‡W­Z|ˆg= 0###î6ŒÙäÝ—Zˆ  ép(ß0øÕS§N•––jVTT444HW÷ûýº7²1Ê0ö“·×† ›Zˆ  q"ß0ô«mmm"‹éHÒÏœ9STT´`Á‚ææfÝÙeãÉGoäH-ĆŽB”¡ËÀ†Ø`Cl€ °!6€lJ Þs¬OÏärt¹¶”ÈÊ9éçØ’¥/¹l†N\ÑŒÏI?džŒ6´“§ÌøS¢÷¹÷ߟņ  ‰l8m-&O™ñgBø9ö³Ÿ}ò“ŸÜ½{÷-m¨=)ýÅ/~±qãFmpÆ ò©¼þúër©¹ªªªü~¿õ˜øhl(ÿò—¿ÜÿýW¯^e½aCHئÚ—¬Çä)3þ”óÒ¥K©©©çÏŸ¿¥ =Oqqñ{ｧ ~ðÁkÖ¬yàäcøoÑ(Å%ôSÙWÖÔÔdeeÉxNNÎ +‘ µr‰‚YrØ ”©©)Ù~ûÛߦØ`Ö’ŸŸ_RR2<> >> endobj -4930 0 obj << -/D [4928 0 R /XYZ 85.039 786.531 null] +5102 0 obj << +/D [5100 0 R /XYZ 85.039 786.531 null] >> endobj -882 0 obj << -/D [4928 0 R /XYZ 85.039 398.535 null] +5104 0 obj << +/D [5100 0 R /XYZ 85.039 577.027 null] >> endobj -4931 0 obj << -/D [4928 0 R /XYZ 85.039 366.317 null] +5105 0 obj << +/D [5100 0 R /XYZ 258.913 416.291 null] >> endobj -4927 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> -/ProcSet [ /PDF /Text ] +5106 0 obj << +/D [5100 0 R /XYZ 85.039 336.27 null] >> endobj -4934 0 obj << -/Length 1828 +5107 0 obj << +/D [5100 0 R /XYZ 315.826 342.243 null] +>> endobj +5099 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F62 4159 0 R >> +/XObject << /Im11 5098 0 R >> +/ProcSet [ /PDF /Text /ImageC ] +>> endobj +5111 0 obj << +/Length 2953 /Filter /FlateDecode >> stream -xÚ­XëoÛ6ÿî¿BDjFI=ºO]mŠ"ÙÛЛb˱V[L%¥nPôßï$ˉíbm$âãxß^?ÒKŒTêÅI$Œ’Þd9¼Øy>L1b’Qæ×ñàðÔDž D¤ÞxÖñIaÒÈOßøG/žý6>¹Ž”R¾Tb8ŠãÄ?Jÿl8’þ«=¡Ýã³Ë“£ñÅå0Qþ_´ôìüÚ¿²Ï.Oxy&þž?ÂóWW´|tq>¾Ä­‹WWÃwã—ƒ“qg@ÏD©ªÿaðæ]àMÁÔ—ƒ@¨4ñV0„LSo9ÐF £Ïƒ«Áï/ÚÓÚ†VK1’©HC³Ñ(Quˆ†°«…ÒQQcD¤c‡(€ŒF§þ‘].Á~[‚ýQìŸT•ªÀ¯ê]Ö3›½ê¬iœ:Òlq°ŒE¬ÉÁ§ÅTÈÑèG“úÇE•O[ÝãTûY9¥úpžUD­Œñ³ žš¸³uMk·°]ÙëŽç’׳*'.ÑÁn«0AF ÌÛo3_‹ZfÅ¢(a~C{‹¢nÄ ñÇ=²™] d; cÅô% 4’èÑÔ™Lº@À95>eËÛNݚµÉÞ;5K¢›9£–¼×ʃñ†Z0G>EŒ:Y0‡ª@h•Ã0%à‡gy-v8>‚°Oö_ì5I…R¤ÆôÜERhezQ(}‰(šÀ]£†U‹Aù“ŒÃ²´ VUÑä4l,}3¢½ÅswÎëÅ„vj-.œó]V™TȯXÕ‘ì æ(ŒE˜JgÕ?ÃQiÿLA9Ž1ðzϲIë-œÖ–`§Yãœ|w ŸE^ÓÚ -÷ X§;Îo©9‰fŠFÃq^·(ížöŒ¡jYÔ.$ -‹²Ý@סK¡HèŽ"Ú8YØX^hæ,oj!Üx1c3”Ǒ~WçÕÛÀWP‹6Â\>aï¡Bx»£À™?Ï+žCŽé 9á–p!ç~ y B¾§ìø«95Á«7§CŽÝw¸ë(¿Ì‰¶l¯C>­Y¼¥/^® y´yɘ“Fgo]­hw: «¡3~•t=õuVí)±q?ë÷÷¿Ùä½ÈKèùÝØÚ)sÚÒ$)#4ýî¡¥ðK‘ÿ]ÿ¡ë¼£‘&áv´LŠPvʸvU§56*&Q[Tþ©”ïÒendstream +xÚ¥ÙŽÛFò}¾BoKÍfó|¯Aœ‘±X$–#R±<&$eyòõ[W7I‰ãda0û¨®®®»JV+þªUºžNWq¹¡V«]}ã­°óáF „· +\/ +qëÍöæõû0Z)ÏM½tµÝÈ6ÿÕ¹ûxûËöÝýz£µv”v×›8Nœ÷kåü°Þ(ç§w0zÅ»o¸w·ýt¿N´óo^ºýù-çÀ>ÞÞ¿“嵟8wxþÏ?<ðòݧŸ·÷¸õ駇õïÛoÞm'Än7ˆ4RûÇͯ¿{«ôãçê4Yaì¹*MWõMj7 ´Ì«›‡›Z,¼¬øÔO6b£=7IË.0çq½ñc§êCå´Hù¹)rœz°ÓgGx¥€`ØãÓ‹Ž7³&‡¥×­L]‹ O<;Û^þÇxï„;Ê‘st>Héü€þCÈ(ºäãˆ‰Ï Ë œí±ìd‡ËYcè·oóœcQ=íÁ©d Ê…¢])qCÐxSs`‘š§À_Yv]2À¸íÊ¢gíØÓ”ÁÎÈ«r·†Ë¸â;ôüö‚¨ 6”3U99ïÇL ³ªâÁI8ÝÜ­t¯”,ðtÂ|˜õGšU‚9’8r0{Ä™ í;Î]9à~¬pŸ¾(jxNWd9/áÓ»¶–}þüæ© *ЪÏyʺ9²a婲®zf4g\;64¼Hì,Ä.øž0<ÃÛ²ÇJÔ1öGÖ#™Ì@ÀÁ̉Ž_‰DtêË/kf /On·™bX[¢˜ OƒÜ“5–½p`žoÃMqæÁü6"Ò‹ýK¤„Ì9¡ãšA9y9KÙ[(ÒV‘‘0O(ñptï0A=ºxXÍÉ­Ïvöä>•áŠ9J¤RëŽÄ/„SIt]Ôh†ý6ÞGq–ä§àШj°<#`}ÂYðáàd-ÄÙÜPT™ÁPŒŠ ©Y‘®“0(WãYÌ'nŽ¥Ë "ž&M@$¦‘ -çᘭ5ûÅÎÛ‚„ŒBeÛðÆínWôÈ‘(rîÚfèÚª7´-P¡cðêÛ©Û…+)V¨RœZXOG…ý¸Ù>‰ +ô¯Ð0#’GUd̆éŠ=f 8C¦¡Á_£Ã‰ò`oí§SíÆIüׂ B7QnÉB pHuô’„®Žç¢ÜöÒ@”£ÐJ Ùþܯ%+S`?ƒä) ×ß¼ÉúB/cz³«ý𪴂7¥ß6˜Ï¶Úð#Ip`ÊÍ£HFÖI·Dq(Å¢`C¡(±#ù›Ò|çÔ%ò_xbýþ„ŠBºçqÝ)çû¶6ê}9œ2*?Èpp “aú²v"ö|¦Ëf7`:ئ…$ÉK±…)ØÎÌšh…ÊpjÌZƒ1?÷Ö z=sô™˜9áo¹gTO'fÅG„Léxt¶¹w'{øÀ¶ä + ·È·Ð75&ÛB”\hZ˜Ìl#rýØ$£`?è3B?d*®MdcL*Ì5f¼e|—•j!ÕM\D—Å·x@ ¢_P¢ä@Q$vÂ(“r6 £hÚǬ¸4Œ@& \ Ÿh9ML,\:‘¸$>û¬_Qg&+ó½I&“†µ„U«ç–I‘à+i2(ÓΤ%H0{ã$uƒpž#C9ˆmڕËÁ%N«/Z"iz±èR/6Ɉ<ý´ÝñÎU¨T@< šž‰…C¹;AõÉKåæG +åŸÆôø2“QŽå™g\=zs!käâ}¬ -Bm¶#ÖŒ2ãÎÇ<âŠé‰”CÏë• +& ƒ(¬¥Êù8ÚQNº6Òk¡6 ¥¥É –âÃBœhè—¬*óÑRúeŽ=%ð†\¹xÁ}7HC.›¿?ñ\‹©ÉFžù#ÓáFò¢m?°ÚéT¹‹)'^øºò½¥Ü ‹jòFl $L£”ÍL +†Çò€Ï$ ¯œå_Ê~ìLD’·Fzî«¢Iuc“ Œ$/Á’"PR™uV² 3SÄàI}ÉÛ›-ƒz¡7«ñØcy@"ÚÓ’òI~x”ü#q«m¬Àø:V¶I†”Ì1ŒúZ9÷4$tøV`°ô|,ä!\þx2¾aU/ùÖ³E5bå»L‰`E52Þ7þFMQä–Ã×,™Dõ2§"%qXN}ÙY³+¸0¢Z:ç} +y*±+lKåGíÑ^J)fqË°‡IBnáOmrZ:ÄõYÂq‘™(;\ÇÃÖÉÜ3÷ZÔÂóÑÜ22îãœÑ€•îiŠWKéƒ-mRš Dÿå Éš:çWˆÙEÓa̵q¹ã¢m–MÙÞ(+;ö½Óÿ²MŠ®á4ľÛ muK°‹Km' ÐäíÓ¤ÛñBÍùn˜RAÆ«ÝaŃûß*Ñð‡„IŸ5ÀÌؿĤ®N±ýµÚj7Ò1o½|MAvyª'™í5p1óå6Âݼ¼Èéí>Õǽƒ˜=¦<–éÝ3\ÆSŽ„ õR4¸L—l“¹­k“¦¦ÿQ¯„Ç|‘-­œëßmÛyà~0™‹ŒCŽá"'El.’Âì릯 œÜer¨ñ·›ÝÌ!VæWž3JW¸Lj4ÍbÁ½U6Û]HMGsæå•*ð¦QìÆAô}‘ÄOrªWw$nš&/E?PI¨Ìƒ³¿šR< +>ð@–O}!« ¤´ãŽ7‘T[’!ŒMá娴°c™á {VÔ}i'Ž®wô»9güØü +¯×¼‡•Ê]0[ßK.˜tc7-|/etËבÓ£øúËAH¬èûþ3€Ž]•X‹ü¦hUx•x¨ÈÕÑEâñ?.¿#®endstream endobj -4933 0 obj << +5110 0 obj << /Type /Page -/Contents 4934 0 R -/Resources 4932 0 R +/Contents 5111 0 R +/Resources 5109 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4914 0 R +/Parent 5108 0 R +/Annots [ 5115 0 R 5117 0 R ] >> endobj -4935 0 obj << -/D [4933 0 R /XYZ 85.039 786.531 null] +5115 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 293.84 135.43 303.408] +/Subtype /Link +/A << /S /GoTo /D (ugbc) >> >> endobj -886 0 obj << -/D [4933 0 R /XYZ 85.039 766.606 null] +5117 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [125.554 147.067 176.545 158.757] +/Subtype /Link +/A << /S /GoTo /D (fdpbc) >> >> endobj -4936 0 obj << -/D [4933 0 R /XYZ 85.039 744.844 null] +5112 0 obj << +/D [5110 0 R /XYZ 85.039 786.531 null] >> endobj -890 0 obj << -/D [4933 0 R /XYZ 85.039 686.81 null] +846 0 obj << +/D [5110 0 R /XYZ 85.039 614.538 null] >> endobj -4937 0 obj << -/D [4933 0 R /XYZ 85.039 652.065 null] +5113 0 obj << +/D [5110 0 R /XYZ 85.039 574.98 null] >> endobj -4938 0 obj << -/D [4933 0 R /XYZ 85.039 554.435 null] +850 0 obj << +/D [5110 0 R /XYZ 85.039 516.946 null] >> endobj -4939 0 obj << -/D [4933 0 R /XYZ 85.039 527.336 null] +5114 0 obj << +/D [5110 0 R /XYZ 85.039 482.201 null] >> endobj -4940 0 obj << -/D [4933 0 R /XYZ 85.039 267.025 null] +854 0 obj << +/D [5110 0 R /XYZ 85.039 279.571 null] >> endobj -4932 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +5116 0 obj << +/D [5110 0 R /XYZ 85.039 242.704 null] +>> endobj +5109 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4943 0 obj << -/Length 1024 +5122 0 obj << +/Length 3482 /Filter /FlateDecode >> stream -xÚ¥VKsÛ6¾ëWàÐ9BxÈLª,7ödìVÒ%“æ@‹’ÅDJ®š_,”)[TÔfüàbñí»ß‚ä„ùN¬¦L:’ZCµäd¶î1òèw~ïñ€H$ia~›öú×ÚΨcŽL?ŽQí ™æ£á»ÁÓÑ8N¤”—4NÒÔF×1nâ„GïG^zƒ»W7ãÑpz?Ž­Œ> jpw‚Š&ön0u,l4û!ØO&¨ÞßMÇ°uÿ~šÞöFÓÃZGäRBúßz?1’û£Þö•Î’½—åΑuOiIµ’a½êMz|áž"huªZJ*R/„“VR!ÅÉpŒ$\(*x§›Úˆy7(ô±—„sA%$1ŠS‡‰×-4Šp¯ÑZÈyJ$õgd:­{xWú"ï Üó—emàÆZjX!ùF8eÊ9‰˜–\çÿ|¬ZÑ¿YsrUúLÉQ²è7i9®“å¶Å7® u*%©°”{$;]úd‹-ÒŸ“‡9ê·Ù:HY@äe±y| Çë_KÝŠá«/ µFÔÞ‰-t4[–û ŠŸ³Ù”ú‹²Ì² -œÔM–¸c³Çê+ŠóÍcõÚ¬]Zå4åÊV»þó¥ÔJE0s?ÇÇD¤žÜ²~êÔœ½. W”á`ûÚ¥u–Jï§Á@¡}Å0櫯-iyz­Áœ× @;ž§¶¿/öȅܤìà€’ÔHsÜÌu™£hÒT_ÊÕŸI¶:6éSŠ¡ù©Ð8‰àn,Ÿ²Û¥—x´ÊÃr^OèóÏ«ý~“¼Ó,m&×d§àŒEÊâ®`L&L$Láš¹·:ºƒÀJhê„;K“¦“& Ž ;ir.Ú&gÃ54iÇûo4IÛýÞ>…~‡"«Õ™ "¿”F»òi¶Dq°(VóËw9¿¬:â,kzÁµi}øe¶CõnT1®–X7‹Y5Ïv5?ƒ³¨çw”o‹Ø!rõ©ÕË 0ÿà›°™WÛeñAÙ&>uäU"æÕº¨SÝ%lÂýnMT.NTè6›ÅÞäËó7H^‹rI•°½ßþx¦’jŸT ü† â]3e`vºG*}ÑÓÅ]J¹=ï¶0Õ` Ó9Pç¢êl¸f ÚñŽªØÀSx>x]ùT…û š¸Õõ­˜Á²îè÷eîÚ/öæEŸUÍ Æ5¯;Hü@§>[ÿqÆ5~-€“à{ŽÞj9Ðì×¥oš­‡>h~E ƒKÿ5§^{Ì‹ -½ºÚ•ÕwTw:6Áñ‰ÖKM•<ùô˜ÃO}Ù>_È–:+N÷S á¿0ÉÀ¡¹f/3ÖÒRm剔ÿüK¿.endstream +xÚÝ[KsÛF¾ëWð¶`• a€Á+7G±§b'+Ño%9@ D± JQíŸß~Í !Y»f¹ì-8èéy÷ãëž‘šyð§fIèzA:‹“È 5Ë·gÞl 5ߟ)áðfÚõ¢«¾]ž¿£™òÜÔKgËbY®~s.~xùËòÕå|£w¾ˆãÄy=WΛùB9?½‚Ò ®ýîÍå«‹åÏ—ó$pþŤ—ï¾Ã‚v®€í‡——¯„<÷çÛ_`û«+&_üüny‰U?ÿt5ÿcùãÙ«å`² íê(ÀÙþuöÛÞl úñÌsƒ4™ÝCÙsUšÎ¶g: ÜPò]ž]ýÓöÂuzÆ­&öda8*uS?œâQ*qcíϱÆÑãð—¶5ò'¶u9O#'».q +X}B›ëãªÏ_«pÐ"Œ`Ù©4ûæp[¢ÀUAÅÁ,hÔQfÔ÷m6¼ÝY{¿âò÷M½‡¯}‹\Y[H%T]ÍýÔ隺l'¡BöJgq´³ö\dl¡¢ØõA4Ÿ`]jè7pãH}Ú‘ƒà(¬Mí†yÐ —„{ÜKäpÔ¨/ÚêËäÁ^À>>ììf]âÉjç¤dM¶-::ïæh½Ô ½E\øŸ'šzn>k¦ßmŽ³ÜàœvÝ&N³]°8¾Dr~D~WóŽ„Àב{á)Ö@J¨4ô…ÍÒO>ÿP=~{òüµ« 7˜ÉĶf«í¶,ôCgßMûøYÛÎN;«IÍÿiÓ¹éÈwêþEuoY[¦ÜßÖRØ”%–”s=_€9.˜¼n2¶dDVÌAËݘ¾Hì³ns7ï›í¬¾Û”ÅšÊh(WøÛAåm»dT5¤··YS€»Ñqä,o‹?­ejœUÍ”Ì~÷”. &Ö`ÈüØkGSª«VÈow+Ìí~Ƚl ×ÿî…©3mFÝÁ·’‰½¬p¡ÃÙƒ4ãôñìÇ ”üínQÙpõžvJ)Öq-, H%ôÛà%¤ÔÕü»’ߌG玫õ`ZÊh¨?ÍÀØ´óžÏ€ÜjÓèÅÄZ6XÛðá ¶*ïÏ]< +z <\ŠNb‹+/-‹{¨"Aà¹IžDEƶ$ùd[âÇ®—>Û—w2©µ*v#¥Ÿ¶%7u“lKÖà wÚ’¾³ÓÎjÒ–\É‘æt”rÜVµƒÐÉøçý»7¸Ä“‡¢v*ð‚XŠXP³Ž9Ää@éÚÈ òdmkäe]!¡îÛA¸2S¸ÁN÷e7!Æ;òvÛ¬y`A]0ìµÀ"2(P[H”å¼®*3H?–×\ƒª‰m¬’#QÐÖ’h³ŠÇEý'xjQ¼éä¹Sî)¡ +”«¢àÙ¢N¦ó1Iïû:í¤þ{I”‡’x)J:?ð×¾GÙðÅÌÝ-J;ÒÄ‹ÍJ;õ&Ò¾¶B¶bþ¬5=籸G>~oB7o?0ÓjüÄ;ï53¢lÓ¯‘mä…3ºÛäÄŠ¾ÐG'½é»"¶~œæ^ÆÅ2O&eõ";ÐmB2»ò–;?^Ë›*¯›¦Ÿ)k[¯®¬ŠthY%ͤ×Ê|O°¤cÿ-ž +v£¾ß®ê Ït1üª=Óz_  Du­ÿü2ÜÒÄ*˜`Ó™RäEP‹°pm$âÒñ;(dRiÕÃ:æ9êAQ1KUó/€æ~ú\7YÆbüô*¦ê7N™Ðå± £B,߸mH8ž j¢ÆxÈr;ÐMÄð@/½á!¯U·Rd7e½·6O&’åy½'èÙ}Uþì¤i€ðiýØTwY¹Y=+4½tVODý1N€ {)”¯Ûz_ö)¢ªú@t(üªQî%°ì•õ m5¤êIœ4äGC‚OÞ­SgDv?Ý­«òá(é³^Ly¡1hêR@ŒÉ„L¹yu,(Gúýä€J¬œÙV’LÔRPø£iü5àëG;V–}B vïؾ~T’Ÿ’Ä“[¸ô4ˆ=þLˆ½)2±o%š•/°KšËK8Í¿i. ôq'|dMÁ…µÍe­Ò^L \€ÂÍ%•Ü„)ÙDµ¦»ZêøGÆÅ|‹(Jœ÷ãY€Ë㺄ãQ tŸ"¶ÆPDúp—ßl:©=œ¾ šXpŒv¶Y' Fc? ´U5œ”E.ÙŠ»'ƒt¼’z‡˜†“Ç`öǖޚψ¯¿2;Ö"Ç/ÂÂ_Ú ÎD¶Z‡,ù:"¨H÷VÁ°m¤Ý8‘öíöÚp3u½G—háÛb¸†] Æ¡½"À9JŽ¡1Ô:v(n¼©mn1ëÐø×ÒÑ¿ÍÅ#P‹–‰ÉíB©ÐÕ‘>ÞÔ×ÎÆ‚_™qn îDÙÐâ àF$¿´eíí-m8ŽI¾*ó9Aôÿ„¶y}É3¼[Ù¢f™ùêá‹BÍÉ—z';)Gâ? +U>ýærjJ'#B)Œøw =²Â[Z@»”èî ®Ís¦mÀ„aÙ(“ð¬Dõ—w½«”›†áô —'žq`%œK˜Ú“òÌ} N +–¸°1øô% =ç-y’¼ ,–UE½Ç=bçBÜŽ?’˜6аüÈ’ó/§K© œlà§F"8Ì“¹q6;±G"»übylÔ¹óÌý+•wV˜îæ!8Ȳ¨ò!;L×Û™òåjÍ$ž“fîì$‰1[±È6Li*£ûÇfÃ-!§œƒÈÝ%Â'ˆ²¯ø}m²·ÐĉXÞW««˜H}7å"Ö2 +­ +7¸m”ƒÍvGñc.h¢®D%#Ú…c¤øÚMÿãXG§nLurܬ#Ï ãŽç×¢°ù¾sU¡z$ÊÄf=ãÂåS–ø.+»\Í èÃîaŽAªŸû èÈL,¤ýBE.‹ø”ü+WÃ~ ÕN»ŽÔNã&èT^¢à‰|ð¦èŠM9 R°•Wt©Í{iý”.Æ°&õ1]äë c(åU ¦VEVR†g¤JÌxKj Žýž¿ù%ÀLˆÈôzߘ ?˶ÈÍÈyw¬³ m/é±Á¡Q—¾m†&'«ï+΂[º² o¸åáu^ŒL=¸Â9& ®¬í’>'ÝWDÒžãˆù@q~íAÖÆÄ’@ëW„_tÃ=–7s›Ë¾,zC³­Gë;.˜0¸RʦãcÃeÝ0)Ϥّ©atÚwüöêømʯdÙVl“1š€Í~·Ôç¾çý}þá$x£‰ÈUÖ" ãþž [ÑDt¬×Þ@e¢Çgò¾·À„3±€H ¨)¶ÝtÂv+4;Ô8'm§®2–’~!Æ šË†Ø÷œ7sñk?bÃIÞi”1]M]ªæÌ';Õ‘70™ÂQï7Ÿ¶ã¢³wòÈj¶ŠªâÜÈk ìæî8tÖe}•\6¹ÕC?ÞWwEóPW,üóznKh¢PÝ€ +B7ˆëB¯GåÙA>J§¾—Hº%¶6¸®ZM!@~Ä‘­ d÷’}0ÊpNàdž4ÔòHÓk#”:áãÄÐw±q„WÒZZuòZªäO¾\‹4›!² xòt¹d¯~©ù!ZšÝó¦hÆ_š§OØ7;€°‡4ȇÏÈŽ5xdÐϤãu'z€¬héI(:ûì) –Èâ2Šïsón¥ÃzàÇ“k€¯Ä$MlFËtÕ—ÈB’àx3=¶òÈ4}›ÖK#ò%ûN†6s4 Ícu§Äw&Óõ#Öü%T‡Žœ,ÉLmîÙ±öh|d#‡9è‚`'V¹ˆú• 3G~* Ž²…`ªƒù?ßrJñendstream endobj -4942 0 obj << +5121 0 obj << /Type /Page -/Contents 4943 0 R -/Resources 4941 0 R +/Contents 5122 0 R +/Resources 5120 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4914 0 R +/Parent 5108 0 R +/Annots [ 5126 0 R ] >> endobj -4944 0 obj << -/D [4942 0 R /XYZ 85.039 786.531 null] +5126 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 338.008 135.43 347.577] +/Subtype /Link +/A << /S /GoTo /D (mcoc) >> >> endobj -4945 0 obj << -/D [4942 0 R /XYZ 85.039 636.145 null] +5123 0 obj << +/D [5121 0 R /XYZ 85.039 786.531 null] >> endobj -4946 0 obj << -/D [4942 0 R /XYZ 85.039 453.027 null] +5118 0 obj << +/D [5121 0 R /XYZ 85.039 766.606 null] >> endobj -4947 0 obj << -/D [4942 0 R /XYZ 85.039 224.285 null] +5124 0 obj << +/D [5121 0 R /XYZ 266.917 772.58 null] >> endobj -4941 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F15 2972 0 R >> -/XObject << /Im1 4096 0 R >> +858 0 obj << +/D [5121 0 R /XYZ 85.039 411.206 null] +>> endobj +5125 0 obj << +/D [5121 0 R /XYZ 85.039 393.201 null] +>> endobj +862 0 obj << +/D [5121 0 R /XYZ 85.039 322.565 null] +>> endobj +5127 0 obj << +/D [5121 0 R /XYZ 85.039 280.28 null] +>> endobj +5120 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4950 0 obj << -/Length 2595 +5131 0 obj << +/Length 2356 /Filter /FlateDecode >> stream -xÚ¥YíoÛ6ÿž¿Â÷©2®fER¢¤‡Cše× [zkr†mÀ)¶ëj[™¤,ËÏi:vrÅ EkŠ|øðyù=/dõ$…?zRæ*µÕ¤(Ê­žÌ7'éäVþq¢…b&$³ˆæÃõÉ»os7Ñ©ªÒjr½ |ªTå•›\/~NÎ>žþóúüótf­M´UÓYQ”É·S\Lg:ùþFoyõ›‹Ïçgן>OK›üÄS§—ßà K®€ìãéçs™žš29Ãýg¸ÿꊧÏ>]^Æ¥Oß_M½þîäü:(©¨­Eñ;ùù×t²U¿;I•­ÊÉ#ŒS¥«j²9Ér«òÌÊ÷úäêäÇÀ‹×² ï:f­Ì8e - 1_qœ-­2Ö=.ë;åtñ"Ú” õ>—™ÖFYm&3WTàž ]6ÑZUyŽ.ÔºP®2“tLó‚|xÙ‘G4wóܬ<-@Ñ -yN~›h•fUe™&“ü;µhâÝÅFO¾é@ÒÉž°Ìw1&auáMçNUY1)L¡*—“°×«)Ê9³yšÔ0¼ÎÝï8•U0_ýŽ¤ÛÂxýÄ‹Û¦A-ÍõËäñapˆÎA<<¥]2Åž8•*2Oð„çt=3~€C2`?Èqx”+ÀöV8m»ñÈYºT¥uB²!±7¬j8¢[òïYäìî‘# ÓU”˜]Å‚ãÖvSSuŸ0™¨ç¨Íª\éÌM¢HøÿãÊ–\FÄmÕŸ õý Õ÷{P*—kˆíé–“`½›A]íïèˆ3(Ú×ÇŽ¿‡f” •½ì:\Ü oaEÍ»í’W›-²û'þ\"’úçWu¿Ã:)WUQÔ ïæš$]vH2ç|BÛYø%ÌþÆ?ÿ©çxÞ—ØÕ‚ÑCw=‚:ÞÞlëÇ‹@^•—îÕ:ÑýM%IÏÇAÄ[ ¤s -„2!9T7ë¬5áÜväñ²›Ú4éç =Úq½çõÛ!¼ª7·5 c»ÆTÅ_›úËÔ†?{䀎…„&[Ù%0è𠶞?eØV¯…] þ%ÕÙÚs½ Óg–2 Ú¿ÊJRvìæ«¿¼dÝAÉψ*ð¶¾9êP¡ÿL+V.@ÐO M Y¦\¡7Ó2ï•{¯äºQ–’÷a@±½^³´-)RJ€ìA&w©>6Rx‹™<½›cb¤” ÄÜkþ9"Ê @z¡kŸm8ë é‹õŒ=,Åòòü†brà¹;G”ÀÑcË åí†Á-5cÚš ß֛˄#,¯.B!Ýòh¾î†LÂ3”äõn‡xdþ°ib™êí‚EZ4kΡ0¢„õöHW´³–©òÐõ“ßp¢ß}Si›qû`*hq¼õd¼íˆ|ľóÇ4<èúö®%ÖëW7¢õ$À ­Áu­éåd /^~bb&¥>òqë“×æˆö!˜3@0ÕQ"Ì{ñ -g§—<¸ßÓËŸxp3ÕZC|)eæ‹$ -œ kQŠË|Á ¶~ÿ<™•;‡`¦½ìƒ¹îÁ£fCi¥‹]”ÆhRÔ¡IÂÅê÷Ðåê×/ç;¿‚Q¹Ð7É´ä°<ã—iŒjfÁõÈ·’ߨ´†î(®—¬ç€L‹'xäÅ]PÈ—§û¡$¥üÐ|+¤âo¢LÂÀËÀÅTä²dY÷LRËD¤ t~FnOð[ßzÁàƒ®R°slÖkLFÂçBˆt0°pÇÑ,üæ!§-xÙ×<‹.ñ‰ë&æ*gñ}f»í³ƒ^”™úþ•hç܉R=ú%ÍSo#kéüäÎøÀ-ì6P™Sþ*I¥¼»P giáuÀa?η_f5ÜÓ¶ kœG âïЭ}÷»¼´8–îyïQ °¿§çŒÛu³¯:gA -´óÁ‘(µÉ×]ßîøs…ËÖô³#&FÌÉ#ˆÜ,µ¤’ð;Fü˜×[lêm}×ð؃Ǥ͓Ïhc³ÁéÐC¯¸#kIôžw,IY¡£š¥éBƒk¾ºàÒÁåÝMÐðdFÚqžµÁÃ/¾e쇷ɞþ¦„k—ïmLé’!Uû¯žRR`UHGNñåÎ?Ž0ºòÉpdLüåúôttßÌÇë0.µBò¸j¹Bðgp~Ô½l»ß«ÑfœÇÄpèð×2ø }—3qï]ª"3ÒwͧÖ$« ¥_ëïþ*7ë7‹ Ê³›ƒqFUU>1™Vyú5/ǪpÙñÇ$Ïk1ãßXjãœ*ò*œHoŽYßé,­Sº¨DÃë_U30Êðª™Ìí’]—éÞl£÷…ë´»~žaUú3m}bàÇK]¨”Ž]vDZ~ïûp:FRý¤y“¡‡A¯‹ž ¡HdÉ…¿ÆrH)ÿêD9H®Å¡`Ö45xiñ¾½¾]7‡—Ïð|º´gzDÏ›ƒÏ’„ë#C4Wó‘ý²^RtüÉÂæ*;þ Y§?õg»wRUå ïÛ¹1Êè ½ê@OòLâÜ–*/í‘ÿ ÎòÕ\endstream +xÚíZ[oÛF~÷¯Ð#Tgxë[ê8Û“µTdm(‘Šˆˆ¢–¤¢5°?~Ïe†¢$ÊQ[ÁµÀ5—3Ã3ç|ç29páO"_¸*„Q |%³âÊ|†ž\ICá´p»~˜\½zëéŠØ“9‘LÒ_ë_œÜÜ GJ)G*1…aä¼JçÝp$Ÿo ô÷¾ywws=ùp7Œ”óonz}û ÚÙ¯ïnLóЋœkãÇcn¾þp;¹Ã®?‡¿O~ºº™t˜i¡…Üþçê×ßÝA + úéÊ*Ž[(»BÆñ ¸Ò¾¾V¦¾¼_ý³…ûô€GõÈdd)F2±ç÷Ñ€d/ŒBá‡A—àð—¤x=R ãÀI¦KA‹H¶ +ýê­ô;#üV›aßJ%PBªŠ.è«{sد¾Í—Cþh$Y¥FmЖWÙ yiÊ +j÷LñqèÅH-l,°×u^®xÜIMì›i®¡T×Tå²>dÓaJßÛçóHô*„ƒ‘'µˆù­/´¯ž+ˆî¯A€%±7>9 ra.êýYT$W‘AéÖ zUrRÈ dZ.Q÷(ihIª¤Èiu(@©¥•F0øÓœú‘Pg1ú&«gÈdŽ,­Ö;0;b¼¾ÆæÙQómÉKèÁØo]b d¤Rûƒ‹Ÿ‚þ@npèO£©Îª,iÀ¨|ÏwŠ¤þr¤i0‚8,&ÿâ<õú…;2ò9û´v2èÊž YPy'Õ!Â¥™¦.¦bV®æ=^LÇd°LW$ƃ¬“Ï™8ÂIOy—À¥q¢]èð\–ˆ:êÕ‰’Br(; ”}2øãû3°²›ï²Œõ¢e²À¢}8üY“,¹^pCjqTs󦦆 ­í"[qûŒÆWü—UM¾‚qŸ¹ë͇1SÛ)33WS¢ :6‹ ýrûî_@æ«>°™¿éùžCA-Ð~ »wãS +AìyFÑ ò-CgœeL‘,ëòûÒ|ˆÑšÛ6äI\ë=ƒŸâ)(õ´\@«—¶/{ÎeÉP÷M†"úPÖŒýy¾ÌŠ2ÍNâ7ÛeÙêÅÿ Bs7Pè + ¤µ õ_cbe‚ÊNHÁYÁœH’å²Dõo UÂÍÆ: ÑvQrnb(·UÞd=˜Kf3j±¡§>rÚTþÍ•º“û5eƒ;›Éç;ÜâD C¾Šð0äõÂ?ÈjžÎf†ysÔPÕ³vë󲚙𿗠+<ïGvïyÍÝ1Ž±µ^^Ø­! +[äŸ#AM4„•†+åœ3Cv³ØÒzu®Nó†)ÌÌÕ¨ìEÞ¢ÍXZ3H“+`Xùr‰¥Lm‹–– µ÷;ê©…1RóÞÅ EàÒ@®âŠ`ØÒÎ,ðiU ²”Û§¸?ºïáu 2ƒïO“gåÛÿ.38Lt^,áZ&JäìÑ(Ç¢}>eeŠ¡©GÍmSžž+­%`…\8ŽâÐŽQ¶ZÇ…IÝ1ÓN’3f±Á÷_ŒáÏdˆþOÎ4:‡=ƒà ¬Áö& umí„@dSʉÍèNîž“!¥Ld6 ìñç%^}–‘¶ –Š¥s;áßÙ2Ϙ[¬»Nnúaš¯a®Í2il.‡ýf@qVÞÓzz²3¶€# 3IùÏ°„?ýGMÿŸ<ô!a'èø(2-s ÀÖ +0õoÑO#ëì!Ìb”:µDþ³ÊðË<5Þ¬ P¦°U|"Ðýغ">ta<˜„eç&Mü* .Õ jOh ©Ý\F“ý7¯›l53UÎrt7‹fhÙaàngEkBMÏû,O(ï$2¤ˆd|ÎŲlóÿÚJÈ–bTçeeÚ­daXƒÎ‘Zɪ¡eÍ›[ .¸#ÍLУX–°¾ðŽW…ÎõÂ|£¶óuæ6'¦ucºJb‘ÙQôtÂrts–SãÌö+•«ÂúŸØ9¾"s¿¥k-â0ÜÓõ‘wº&mëØùa»D}oml}ßby¢­7UÖ-$¾ šö¼gÕWãáúÔzÑiukœ¡n­â®n±jˆ•ÈYeöñÖIèÒ”î]MC‘¬ž\®m…¹6µtƒ;$˜‚î~TDw?@;6ÇÕCi[ø|¼2ï¸ '"Öí0ÔÐðá±÷O†å Èó$’·m<Ü$Š^ Â(SÇo{Ž u݉C)ls@.”\T>ì‚"»E½cáá¯âÙPµ È›YcÆ£d6 ÑÆ©ûI¹Ÿ)FuYø$ +âBø?ákQò¢_ êP(¾ ÅŽ :ʘ#8?ŠrŠ‰qB¾™îÞ™B™#¾ÛUÕ$OÓ°Âû1ÿJKi¹Ç§>-“=Ú“ìåߣnÚ‹Ã’¤PÎÍùÆÿø‡e£J›ôSøXš-àt§]ó| ×oÈ@Hÿ„1~ãuÛyïfU(dÔ})wÚ®¥¯RTÈ+!Ù{þù%¢dendstream endobj -4949 0 obj << +5130 0 obj << /Type /Page -/Contents 4950 0 R -/Resources 4948 0 R +/Contents 5131 0 R +/Resources 5129 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4954 0 R +/Parent 5108 0 R >> endobj -4951 0 obj << -/D [4949 0 R /XYZ 85.039 786.531 null] +5132 0 obj << +/D [5130 0 R /XYZ 85.039 786.531 null] >> endobj -894 0 obj << -/D [4949 0 R /XYZ 85.039 592.586 null] +5119 0 obj << +/D [5130 0 R /XYZ 85.039 766.606 null] >> endobj -4952 0 obj << -/D [4949 0 R /XYZ 85.039 548.745 null] +5133 0 obj << +/D [5130 0 R /XYZ 233.803 772.58 null] >> endobj -898 0 obj << -/D [4949 0 R /XYZ 85.039 492.833 null] +866 0 obj << +/D [5130 0 R /XYZ 85.039 287.618 null] >> endobj -4953 0 obj << -/D [4949 0 R /XYZ 85.039 455.966 null] +5134 0 obj << +/D [5130 0 R /XYZ 85.039 252.872 null] >> endobj -4948 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F62 4047 0 R >> -/XObject << /Im1 4096 0 R >> +870 0 obj << +/D [5130 0 R /XYZ 85.039 210.712 null] +>> endobj +5135 0 obj << +/D [5130 0 R /XYZ 85.039 175.962 null] +>> endobj +5129 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4957 0 obj << -/Length 2292 +5138 0 obj << +/Length 3079 /Filter /FlateDecode >> stream -xÚ¥]ã¶ñ}…ûfg­Hêóõ^sAs‡f·M$\‰Þ"KŽ$ßîö×w¾(Ñk{´0`RÃáp8ßCµŠá§VEŦ\åE¥F­ªýM¼z„•¿Ý(ÁHR¥Ió ‹[¿ºÍt'ùE9c›ë$JŠq>ÞßÜ~ÒñJÇQ–™ÕýÎ3’#±.V÷õ/k•D›mšÆëOÍF­[·Ùš,_[˜w›­Z×ø­rU¿1ñz¨yýï°ÞÃT­+˜ýÞt›ßî¸ùëýÌÐ|°¬Ô»,8IJJW*ŽÊ¸ Y6i”¦9±üµƒ3‘Ѽ\ÛÁ!›¿ŠõóSSmt±~âÅÊGZù{íヿ(€výÀ[÷¶Ã¯ –ÔzBà3þõÃïŒië}Ó¡°FB@švê9£‘±ñèÄ @zDAñú·=-W s^à{¢±1ñQýŽÇéÉ¡|Al[…¦P’t‡ÖíË$|´1ëÁÙºi_ùÃ}kj ]i@Þpèeçè,®#=bøÉïy½Gž¾áŸ˜,rćn<ËnèÜ]³ƒØDIR¼o Ž7]°N“d¤yÅEîMW¡L“rý ÓÙé8ÌlƒÕÚNÌõ£ëܯ±JHaã=é÷X p®šjj²H±xg÷(›˪> ,IZ=s -6a[´IžOÞ6 -X¶{™µìq°[L -åþÈ;ØÈÅ‚§†´¸ÐžžìÄÇÿxÇãÏd5ñò,X´£mÓ {9ýj^isÀ«• iJ8; -LæË}“[¶%Ç/<ã‹ bibÎo…†;m;ö‘?MçQ\r4»'³L3°r±àah·ŸÒ"ÐTRDe™Â^ÜžšÂí¼D ûD¯ O­2Á~²ÈVšŠÛVî05=ÞѶär°ò@®ekþÚs€B”†06Ì4a©Þå½pä[XFl÷èxJÆݹ­ðláGԌԂXŠ -XCŒ ãGe9â<öÞý?8w5 ýHj[¼]âƒN”ÈøTLþëÖd²=Þi"š GM1R“¥)ɬ )yÁŸ SËÃÉƆÂîç«”¢Ë™¢(`²÷j)¡!ÉN¼­²srW =o°Àü»¡" -¸uQT½ ä‹êvtÙý¬tR±í‡q{@Aµ ¨ƒ-‰2ÊGùÍ\KIÈLÍÕì¾³ïû•vŠ_}@w5KœÁ³ÞÓÎ*Æ;‹B^]¹‘t4ùe4lŒh¹–œ˜Ðú‰±‡Ýä8N.‰ýC—_ÜàX¢!šU¦Køîªþè3ƒäx>½ƒF†Ÿ™’nºÙíúYŒˆý°èó•V%Þášåalö‡v)P:æK#:&›GtÑÁ+õ¢”(]Bíý-^¶î?¹n6õÕç|ËØ{(•/±&°Çvò5L¬®Ì¶‘€ó~î $ŒQiûV*&¢_ aœX7\‡‚ì_ùöT~ÀvÈ?öёỹˆ< -Y8˜V?L¼šw~ùËñ Fwªoù¾Pˆº·¡sQw\ÚÀlpÁ ¦†ŒÙ»0rí2[J6±˜q *4£ÈO$%þhBs`ç‚5ãýÙx€7ª¿m0N³¸@zç tÉ°f ]A±×ˆ #1»—ôINÁtƹš;ubÖ?ÖN5¤oÔÔ’¾qùZmŒøTŸDŽkc^œ7ºZHQ°€•Ùåhg²”ÈÏ ‘Ñ·Zë}à`ý ó‹6„Fç5AÊ‘ ýøÜÓ8ˆÄ‹±?äã©Âe#Žƒó]Ⱥ敞ëî¡o[Š1wÍ4Ç£A\HÓ4¨ñ³Œ$óÊóg V¼v|üà›¥1‘E¸ibI ð%¿àÊuˆ…å!Ž?S©RoĽž¯ (Ì7—Kjˆ³PD¥X.ÿqóËoñª†Òú‡›82`sÏ0#ÕÂþ&j+Dþnoînþ1Ó‚Có"Ê }• mŠ Ïû”Ê\Âk¥#¥Í\ÂgÉJ©¨DwÛ­€ßDßyåâ€_zv:ÔÖ›[zlý«¦¦`õÇJA‹^–†Q‚91¿Ü‰·Ÿ÷jõ]l®N…ì6 ËÍFXÂ*]FYž®t’D…æ†è®ß»É×)ˆGŒö'å»ãðéÆ‘»gP¢˜ ®¢[âXÏ)ߨØB°w.jû2'>î¯[ƒ؉ùBý«_ï¿ç´>Üz¹µ½³þîîƒîÀW¥VB ù‚kÛ*å6À¶zâµ?í[DÔö%hÏ\ [y«ì¤L#½h`?ÿ»1¢½«8_myÛÿëZEE™¼Û¹ª¢Œ -£Þm®U–F®&͵–æú;/¯±:‚ÁÀd{Ùá=…w9Yp®öÐ -òR¢µÏKTÏ+Э‚8²4r°`_Ç¢é#•J)êÖ¹ƒ}ᣑ:ÉRBWèϹ©ž'ù½Çð5Ì-w˜R?òÎqÞtÚòQ]VÀm—+b¦æ*“I±K^hi5Hµð]ê€-­Û¤XÔ¥XÞàÍ Ç ŠŒ?Ó—&âÀMïìF 3¼3‚—ìÀßT´:MÍBisqŠJÑe9ÏQmº“}½(\ ôЃ-H4 ®k±Ñ-z-”„g<ѱš2‰ÒY¬µë^EˆFE©>‰Y{bíÆKòÓQf„3^¥&°j|‰C¸qÛÈuÂÒîù¤¥5ÆHªŒZ„±v_üm™§°ü‰ßy¨Š2E~ÅeŠâíƒSEÏEåšÊú:¨k÷Ÿ_>ÿ›gü.Q¼}ëxe`753ôôÁˆ/–€ìËÿsN ~&¬‹üHI;7Rct!ÿük ²Fy^Á|µã1|Ñ3:lwÜÏìÓÓV¤ïɆ<™††[$ÂÀH¯ÕüÞ²èì>; hW±à[,Q¹ ¥íÔU½ðtgüº³ço®Q9I.'B»tËÞ]/‡v“F‰9‰ìW#ü‚zàMl¢LÏä(Õ¤ú황)ÀíÌ;‡þ™ -œendstream +xÚíZ[oÛ8~ϯ0öeeLÍŠu›·N’îtÐ6ÙÆØÎbfIN„È–WRšæßï¹P[r$E·bê<::üÎ…‡”3þä,ò…ëų0 +„ïÉY²>rgWÐó#iG¸3-ÜÀÇ®_–G/_ûÁLº"vãÙrEC–éÎñ¯¯Î—§æ Ïóé‰ù" #çõ\:oæ é¼=…Ö î=yóáôxyöayο™ôêý 6´sÃ~}õáÔ’ç*rŽqþ1ο¸`òñÙûåì:{{1ÿkùÛÑér ìB x(íŽþøË¥ðA¿¹Â‹£Ù´]!ãx¶>Ò¾'|íÙçâèâèŸîÓ3ž5¡“E;b!c+jŒôc¡< +? †#öI­šPërŽ¹,P|}DÊÕøÕ/_K0Ã„í¬Ÿ÷µxBz4BÐKwX´/=k®çô:éTVãåõÝT@/‹zŸ}(E¬w¹¦âX„hC)_Dñ—ÆúBûz¦¤D>s!{ãƒlh’ l¸eGïr ¤•Ü3ƒÉõBEyªU.˜vΑb*³ÎZÆj_}2Ð"ò"×¾àÉ’z¾PR=FÒ“¬NPÊeÚ69NÒ.e¯œŒÈïKþ†d, ì+|™–ÔþlÓâg¯¿¯)t?\6|§uÝ8z[µoMòÚÒP-ø*ûˆr™u]`þ<ä—f( +£Êh¿-åа"W·æðݽÚïl´þˆâmÒ'ÝÕÜ—yÆELƒ =I‡‰'ƒëk» +7~4Þíè)¼GBªøOR'l۲ȓûƒ6رz¦H2Ô_6ÁãnÙ@´(r.ò”×ÛbÎÓL‚Ý×9âêŠéçs;ü ô¼àŸ-"¯Bsµ…´‚:Þa¦7FßGâyF 5²ÃV&@N L&DÄyL'‰.ó‚Ì)ψÙaxöúz²â¿6<5È)žÆ‚’"ˆtàmHJ!“È6éA„öÜž)–'…äÌþ0D_EíGN½%‡Ÿ%ùêžÑÒCòÝДkò~f‘fE¾ÎtkØ_äuír5—uˆMIyÞªtÄ~C?dܨmJ-6:P‚­tÈÈÅIåm‘2Éw8Êà¿{Ë·6‡ p7¶c-#£¯BD74÷Z‡±Ü+öÉ+ôƒc¹f(¯ *7ùÚæ>•Å-åÀ߶9Ò Y ;¢`Ã-™¡L0/y§')Œkø‡\®·†‚÷[L =· Zx®¾WeÅåõ­)¸}üÓOܸkK`·SvdB‚¹2ù¦nÆpî³öïצzÈ/‡X¶¹É·ÙŒ°\£ôýðžœQ>ÀÛPæ´‰açÍÈu¡ßÃü”8Sz¼TvLC“¨ÉÑÜP4ϘÔGý ¬q‡–acÖÛšŸóþºè­ï™’SjÜU”ÐDØÛ—Ý@î憘°›ó3ÌeÞüŽ¦>ž²áŒY&6d`ï– +88´yV¼*¯±¢¦´³l *·ózs¿ß ‚!F…’‡mÉ.Ãt~Þm:ø]ƒ>åeõ@¶î}Ål=z¶ÙER¨øѵ;z +Þž +¾lv+sc£F¹-Êäæ°ÕõÜž)V(E$¿ltg[¶%L4²6%ægmØh7mؾÃAÆz{åá~’Òh]`bþ #à]Ö³Á¿±|¯ˆd'm{ US‘e“Ö\g’±³B3 í¤r1F!ÍÚþNÒ„t´Düm?à~Ï”ÄÐ×¢…"Ÿá¦Ëí”(Ye(Ô[×ö{®óÜ‚Ž9\Æ~›Â±(Ó®*Ó)@c¹vÃôrJù/$½ÎÇRìliܘöö57WÝv>c}¿ )bM£›\»»ºŒÉÛ_ˬ۩C»¤l{m•c“$‰­ûÑja­¼hx¨d|$œò°¼á_®´`Ë\]u_ÃÒÛªBqÏÚœvã{ûºÔ4æ°kêìäÉööC'·×yj=SZ6}jP?¥.ˆ G|±ócHÅ‚G²û”Q`²ûßgÜïË&û㬲e °åh*qAòég6ø +ƒŠÂð«¢Ø¡ë:•­SŒm 6œ O+›W ½jÏY›ê¦ó)0¶Ò4fÙÐ[—ÜË R¸XHéwÕ —>¡o¢ôɦö)¯óKk×òÿ{ȃfVe&µ ºÓï¾¼”¶Î=¿òݶð¶¶aZê1‚ßûk5D,ôYá k·}9Ãr.íë ÿ Êy2ôµAóA‡WtNØHÚY4ÊÝ*†mgÅÝáJBkšc¶pÏýƒðà õ8§ S1` FýD!~\ÛùñÊ'ß²RýXÏý-+Õo¹|§%þîãi´ÂúΖ–› +¿Z‡} Fb²ŒM–ƒC­¾ì'1'Áô§´Ç熰” ³,¶ØMãR^–Rľ?}C²GH²ÂþÈYO¹£MÝTsˆ¥·I“³ƒÝ×W8zøŽ.Ux´Ëw /¿)6:Ú»¢0¼nà?Äñ­¹ÝÐŽ’R°O¡Uä:ïi_®¹ã"ë7؉©ƒÙ˜«¬B_»ƒí“ÝÐ4Ü1_Ëô‚ç`À°kg'T1\uyËS¸dÜn ˆ[É=&m·tòöѹgÁ•„×óHÓÞk\5ëñƒÞpk«rYû9|ÖØp¦§Üáùt(b/î.I¬·· Ñžºu,´ì2FbêØØcš¢Ó>rÉcÿERø²Ma/®ÍöpÕƒÐ9a'ZÞm?&Ĉ¥ÐA{\>ÂÂS…žM0žSõÕazL*ŠHE”Šà¯fH!+¨v-U»¹Çˆ|—××v^É”5Á„ªQ™eË8Î[»¸é_6^y ´V§çU‰§ïf:j›ØÏ´õ»öhG\ÖÃX«Î]i‡½sßQjçr=¡ˆûgÐ hOlÓµ{×~¤‘Êu?¿ü çS~_„*<aÀ&fºÞ…¥x5Þ=Ð,ÂΡ±ö;Wý’%9çõ½õ‡k´¿HKÚKp¨zœ„g„ÔgObtÖÛ>Q ™«Xñ`N*€³]C~èªÝö„zœ7o " ¿bâKëåñn©Ž\°Á…1d¾¢Ú¶ð +Ï}G¥s5Œa`<`”âðì³Yo‹Ìr§0@Ø #GT-Ž„ðSåW×m%ÛŸŠ|H--;ë9ö>—N}R.í¯Ê"í·,öJiÔÅ{š6{ŸpRAR´°ž5¶v/ÒWÃ`4|ÑøKz(&…n[ùt8üQS©. Ñqô²‹Åß Ãœ³áçȪ]Ž¨·;èz¿dÄóµ/Å"Šv´<¬Ôv™Bm ³èºöÎþ”ž>µ‰»™îŽÓßìÍ [¾ÓÄîkh<6zÛðÞçÝñ6,xwžB¹ ËHWŠ¤YHŸ0Ç­¶òˆ# ÓôcÝ_Ø¿Óà¤ìJ¦#Ý£’šKÏ>ÛUÈW9q4h!³¬9¦ñ¸ìÛ)«¡Þw1×myœë¹Ò~"Ù¡÷`ixàöYw±A /Å~!‰öýñMUá{ùÉà †!endstream endobj -4956 0 obj << +5137 0 obj << /Type /Page -/Contents 4957 0 R -/Resources 4955 0 R +/Contents 5138 0 R +/Resources 5136 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4954 0 R +/Parent 5108 0 R >> endobj -4958 0 obj << -/D [4956 0 R /XYZ 85.039 786.531 null] +5139 0 obj << +/D [5137 0 R /XYZ 85.039 786.531 null] >> endobj -902 0 obj << -/D [4956 0 R /XYZ 85.039 766.606 null] +5128 0 obj << +/D [5137 0 R /XYZ 85.039 766.606 null] >> endobj -3088 0 obj << -/D [4956 0 R /XYZ 85.039 658.638 null] +5140 0 obj << +/D [5137 0 R /XYZ 307.409 772.58 null] >> endobj -906 0 obj << -/D [4956 0 R /XYZ 85.039 603.448 null] +5141 0 obj << +/D [5137 0 R /XYZ 85.039 280.891 null] >> endobj -4959 0 obj << -/D [4956 0 R /XYZ 85.039 563.284 null] +5142 0 obj << +/D [5137 0 R /XYZ 85.039 238.122 null] >> endobj -910 0 obj << -/D [4956 0 R /XYZ 85.039 189.831 null] +874 0 obj << +/D [5137 0 R /XYZ 85.039 182.225 null] >> endobj -4960 0 obj << -/D [4956 0 R /XYZ 85.039 154.52 null] +5143 0 obj << +/D [5137 0 R /XYZ 85.039 147.475 null] >> endobj -4955 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +5136 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F58 3380 0 R /F64 4225 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4963 0 obj << -/Length 3691 +5146 0 obj << +/Length 2931 /Filter /FlateDecode >> stream -xÚ­kÛ6òûþ -;ˆIÔó€~ȳ—6—í%[ôŠ¶hmm,D–\IÞÍþû›)Ê–½‡kdÍÇÎ{† ->ü Y¬|/Ò,Q±ëÝ•¿ø 3ß_±•óòæêùÛ8Y¾Êý|qsg÷É}çÉâfó›÷ê/~ºyóq¹ÒZ{A¤–«4ͼ·ËÀ{·\Þû78z/>¼ÆFä}|S¯pêeôýõ«ß}ø~ùÇÍWon,VÞÖˆÓŸW¿ýá/6€ÿW¾Òy¶x€¶¯‚<_쮢X«8ÒÒ¯¯>]ýËîÅsÑ‚WÍ‘ Ö™Š3}Jƒ ž¡A«$J‰û®Òî—«0óÊn¹Š"ßëÊ5^²Å© Õ-A¬—ðçKÕÀÄgœ¼[O½rXÂßœ-K\Ûð² V¿û¦Á®lbà¹OÅ{·w×u%Ó=2"I¼›-®îùœu![6­¬—“yú@uý({µâN‡®|s(¹1´È* Û*@ªæD†ž`ïé]Qgc ø=ïK-À,öcƬD ˆÇ«Ý¾6öOT¼›ÃV€Í‚ˆ;ðöVÁ?¿T ­ELh;^9’‡á*/êšÁ ùqÍF6oùw£TÁÝŒôѾ ÿ0D4†6‘·® ;,ÑàøëOŠ78c˜k Âåά¬ói(`¸ž˜~€™=c×vCÏ0BQ³uâ¡ "]{îÒ"ºï*ÉU†J…Ã@èd*‰ó'((Q'YZá]ÃЊ4IepŽÕ¼íûê¶.yˆO IeJ‘L ß#ÏÒ=‹¡êïd àŸ‘D)ITˆÊýça¢°iÁ:JÂ|/Ò‰ã"pñÈOþÇû¹, ¦á!mÖ”Üþ¡?¼û7CÐÚÇQ²wâ£0ö^ j^ÕŽ–Òʉä :kÑ&@¤Û'¬&a‡Ž²Ehí+·¸®úÊ ¢™(e‘7Õ9&Ò'ÔÛ®Z$èyNh@`å}ú'L¼ä1>¹“ˆ@ƶ-š¸zÃ]ºÏ¶´F†Ð¿·},™=ߎ²ÄÐ%»È#ãÓÑX±á³–ºJ\LäC¸Cˆã­Ü¤à.˜¶ˆ[X•€ý¹YÍèßYŠ(ZˆXdèâT]`- 6ÒžKqšÄk­× [ýîÇ>üÌvä2a‚ˆBaH*v(ÔC¸Ñ¨Âh_›˜ˆ¢%CŒí>î'‡;†²[±¤ZýîÝÓÈ+<›„N|¬!xÖøD“ùŠªÉOBF¾lxí$¶Ž}!5¯¤0²ˆA4U'*K’ Áé²ß†ÔiÊ`½kªr:ÓZŽ%šÆºöŽÀÂN˜‡‹Ú °y 0N4KNšÞ’ü­ØH¶0Zz6{µ¸+¾G;ÏGSˆHm?#Š³ -Å£aÃ&{Ç("=(í ц¢`+SÝñï<"°°’ À¥²¿'U(¬›‹„òÖìAªøò‘§7å]A–AÀ?¡í‡Û%ÇLE”ȥrþ”óÈB Áv“ÌmÏ#“À¨áœµüJáAµ¶šKÜð¢ÿ2ɘn§Ck[ Œ‡fƒégŽWœˆ cV’:lC¢Ðär›n—Š]to÷³Ki²m5v¼_%;=Tìy -rhç¡ŽN2 šXo -u¦DP²ª0SÞ[¼:!“µ-…zÖ0!r(sQ߯ËL •1wÐ(jk ·©úâVB<­S7UƒžÉ*¸wFZÒitg‚û1ȃc½ v£ïºiQò!´¹9NšßCoµöPó‚;ò†Zâ -6js)f¿…0žR¤p Þt -¤¤äûoқɻxb^¢RñÆ'û4%橤K)f±ßh=ú¸Ôg» è¬7T"!BöèÄкǙ÷®á•”{ RqE_òRǪ'²Û?’’1”`ÈÆ¥ñ¹+ è -×äL¼Œ‹>œ„C=WÝ CŠêh‡ã|TÊ{Þ‚‚[>h§iRŽ¾`íƒCˆO6T(åò„ìåxiìŽåM3û…€¶æ†©‰å<.ÍK\ý?áË$á}ê&ï+¬”ÆXçû\u¬”Å`#؃v•8â8â .¤.öÖ$¹ñÁÐS(ÂŒ^™éˆcÆcÛÐÛ{ ºÉ yÃÜÕV¹|É9«Ä{gƒŠ+@$ _ds¶°L^6)OóB~…ü aÔ»ñeÁ.¡ËÕ¸¾ÚX}€ÁV’Y2­R é{?M¢f@tçbHëLD[6”ûÈ;„¤(6-Çd¤àÅÞ©SŒKYîê±kÓ"kÞgdÇä·næ±6u©i½§¶\YT “^'6ìÿ~lÒ\ÅY AM¨²0™5²r`¬;¶†B”²Ø¬Š-ü=95ˆ•êôâ±æä܉U -âÜ@09˜Ó}ô.«µ­RÉóÐÖ-@XFˆ§ÍݲÉáø%E +KyŠ*mŽ¶3–º¼ÂfèÑY%¡¼°ÊfýxŽ1ý¤av™1#ÌyÆ fÖÃP–S²÷éÝ‚êœò*NU¢ƒ‹˜˜T¦¼JÐAÆ\ÎòÊVÝ´ØßxŒi\5ϱQmý£ ŸxWW˜qÃ0“e¯A Œ›{r™°²¦G¡g¼ó…jMÿ‡"™!®÷)„‘KGìÃ,xÊ-Œ?q{kyÈ57Æyrø»ŸT·z>AÞ˜±¹‘‡wló›µ/Þ< Æðb@™ŒÀ=ˆpøj°¬m_9¡nÉ_°Œ¥ƒ™s}1_3Þf…ó±[LÂ$ãB=ýòÛ3d{ôüj|#ÂpQ[ÓLjǕn›’·‘såy-±½¢ÀH(7:3Þµ ½·µ È-jÌßd¦7UÖb8È‹ ½n›õÙйnõ”HÓà„÷é°I5iö.Ëå¾sü‹,bö(y抵›Væè‹#J C|LàãÒ 5ª¦”N„?TZÝŒÒT*uØ"3o„YÃÙ8 À¬$¾ìn˜³–ËÀå*ïKTþ@²§žæ03v,Wx”K˜ŒŽ¼N4¹š5Q’O8:ÙPÅ"ÉÜGîžG¸äÊ­’¢NÔæ—@µ54*Èá,×Ù’l¢\2ƒA«ˆÆÿK - 9{!ÿ„P §üL¼‚à3áIIî0~^7–æô¤œÈ –²ÐÍ#ä‹›ˆJ‘±ó¥nдü;ý„Gö$ûlÆÇ’åø•6çú(§Ž SE™ö$‚5ϧ&5<ÁªÝŸú•¥úp†1|qkß[6\ëÓÎç ü†TùÌ8㓬6×<®€#ÏÝ·¥À#ƒöЙp*ðž—_×õ¡¯ìWA™>5™|˜…Ùdúä«€8Ç/3}öº ¿$cŸx’V9&Ú$9æñìhŠÜµy·hŽ‚.¶ÊSÆÈ#å4‹Æ[œ+§à÷‰üáí±VÃæÛ_ú(w,Êd*ÏÂyˇ >E†Š2±>ÆØ|½{Šòü}©tendstream +xÚ­ÙrÛFò]_ÁG°6„1˜û°UŠlo”X²WRÊ»åäaD‚$Ê À hþýö1ƒC„씓R•0GOOwOß³þÄ,Ñ~ ÓYœD¾–b¶Ü]³ ìüûBXˆ`¦ü Ò¸õãÃÅ«·:š‰ÀOƒtö°&‡Õ'ïê§Ëoîæ )¥'¤?_Äqâ½ ïz¾Þ»70úw__ß½¹zx7O¤÷?^º¼}åÝØO—woìò¢&í=3ovvT­G´Â›A®™@®94‚ÖÔ› ÙúG)%Þ£á)ûÈÐBKþv7˜þ•«)yèÐ¥ó··@Ù?§r¬ãÞ*о[<_ÀA"¦ ñìîÉl(IýTK‹ðÓ?~Ÿ¸3 ²»$¢Ì¾X €±Ÿ£“ð¨Úe$÷'0šHð<§9¿%Š© +†› ÷#øxô*áúÑ8?«J¶A ;A’ôSõ-ÙV Jù"ƒI¯µ[3†jŠ(L½Å\±*VY=Åa ’ÖÃ4»'›üI‘­íÕ{ʲâe_¢”ñ÷ûù÷û S#8ŽTyu¾Ùb®ÞòÖy‚·Õ¡äXw@/SÐ /š‹°•CGq‡Ñ5[(pæ Ž[4o:»å•>:ãvÞØe +¾ðefi2”Â,3²à†1/mj€—USápï‚Æ£}*‹Á‹‡i磰L…¼ºÞG}œ ÙfɵÕf¢$ÅÂE‘ fÕ©PØwÁ¿Á˜ÈíÑ«뜽®€®YOšLýPG3 BHú®”H&üç¨l*ô–ߪÎX©0Æ»"G‰bdkâ³Mn¥’¯¯=⻎Ÿ1¤™ªK‰ê+º+›Ì²u•¡DR9Š“Jƒl\Šòæ)«OUiG,©”;ReK͈1U¯¨¶^"UÍ£‘mÔl¾ÕSWi˜•Qº`+\®…†edÆ]%È¿¹ÍŸ2×:ñ™²:;ËéÅ‘´ÀÖnѹ ¤ +÷‘šX­ák(ÒŒhá Bá°‡¢üL÷%äÍyµa8?ãCÍ¡˜³c +$;¬0·ä ¿e<¡÷¹wÚ%¯û–0ä^ä;žìI\4ZZßé‚Ó2#*<'‹†5¬Ìø0UWÜöiæ2‘ËCYÀáP8}0x®˜VÛs;.òºæäwaè'ÖŒ²î­™w=†±>†~ \BucêÓ/Jp¡ÓÅã¶b:1î“Ž•¯“¸}QPÁº:ì'.Ø[ £?e "ppPaŒwkž¬ŒKëÑ'%HËÙ“Ë$ˆvKbÓÕ*Bû:#©¹âuÃ0wˆ8|áj´>_æ-ƒ­az Ò‚( ß`Ã5¬™%­Z­? !2B.áábÈcù×ü9vƒü\í¢ëiYX 6(¨–šþÑ`*`Ò9hÌÅ”/U4j6­˜d¨Ô»¹ç„ÿ#–« +³³cÃk—Kð ¶këºË´ñŽÝ©›*@pG v½½þ/®gËÖXa×摼—DÇv· 0L_`t1 äËœÇA<âü,l2çÛ­ ­nwöñœ›ÖÜ{å¦Äî¯-ÅÙ·ÃÊ-Žøð}¶<ÔŽEZy›¢Ú4“üÊP¿ÀØ|"Ò¯—+)À¬¸vFêRåÝ"©ü¦à²T(a,Ìû–Dí8\á +%¯y¹4-u˜\XÎ55~@™–£QÛr¬³ o&®fÔæ ŠEð}ê<òëRj;ÂüËÉ*_ÛHˆ'­Ç§£‡’èÛ&9=)¼}Rð 6>O§’ô}÷ŸÖQ +’,ò‚Ò{nËÀrä¹í¥qIÏ]ŸÇTh,»¢í£2™qu&Œ; ?¿ Ý9~‡ÀÌŽp±j\1¨lI ߣ«5ò®¬„Õ³æ☠+è5ýbP²8m‚oJ.™pÌWæ®hÀâ#çf'ë¶ËJ¤ê*`Û^o‘žf¢µUÅ¡«¯×o0¶Ç`ø3ldáj÷ËÑXSaäŠ +þÎâvÔ´ Ñ +²³ŽÒ†·®-¿´ý/û–šÃwS1ŒMÎl~²âÍpîý=i*Ì.ñm®Þ5”F^cOvU$ŒŸæœnW6Ä5jÙwÐíO/â=/3{Õ8òÉo6 +ª}Ûû?z0Td<ó”wIتï,[Ùž9'T‰Ú>ºY¶Ö“=¸)«ºG&&*> endobj -4964 0 obj << -/D [4962 0 R /XYZ 85.039 786.531 null] +5147 0 obj << +/D [5145 0 R /XYZ 85.039 786.531 null] >> endobj -914 0 obj << -/D [4962 0 R /XYZ 85.039 413.08 null] +5148 0 obj << +/D [5145 0 R /XYZ 85.039 715 null] >> endobj -4965 0 obj << -/D [4962 0 R /XYZ 85.039 378.334 null] +5149 0 obj << +/D [5145 0 R /XYZ 85.039 631.583 null] >> endobj -4961 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R /F20 2961 0 R /F64 4112 0 R >> -/ProcSet [ /PDF /Text ] +5150 0 obj << +/D [5145 0 R /XYZ 85.039 576.78 null] >> endobj -4968 0 obj << -/Length 3882 -/Filter /FlateDecode ->> -stream -xÚ¥ZK“Ûƾï¯Øڷʤñ~ä&Ë’-G±[U>Ø>€$H"µÙüúô×Ý3X9®”JËyôÌôô»{àß{ôÏ¿Ïâæ÷i–lâпßï¼û#Í|sç+ÄZAÖÌWï¾|'÷¾·É½üþãÁî“{›8Oî?îY½þöÕßüø¸ÃpåG›Çušf«·þêÝãÚ_½ƒ™`õêû¯ÑˆV?¾¡©×˜ú@uôý‡×÷ý7¿}üîîÍG‹•ƒ·†Àé»_~óî÷„ÿwwÞ&̳û'j{?ÏïÏwQnâ(Ô~}÷ÓÝ?í^2Ý˪%Äa¶‰³pN?vhàûÁ&ôƒû4Ž7I”2Þ×Qè­ -ùéKÜo×6{êùêÒµë ]í0\öøÛë‚a(Ïè_ˆÒo+“í…W•t‡Á”ò«çGÔ«ù /h,Ž&ó7K+=n_Ê®+÷Ò{:UºŸJ퓶;ÙÉ_í©Qu%#€¶‹ˆ\kÔÌùö[ _üþÈwóW„@[¤Ðn»êX5Ô/jÀ­kÐ&#Ú¾X½ͲÕGlâ.¾Œ€òà–滲Ð^_›¢îç3úŸ€QÆáèLÕdül>`*b6ä©«³W2Ù×`D÷™S,ª6NVÛBoH½XöÆïI§Ed@ÇO@Az_€‰vŠ¯ýéfö6Y+Mãx5¡RÏ;Ð$$³ûÊðgWt:Fܯ‹ýU˜b(ÀŸ˜`B+‡ -"…CÐnN„]k¥[du0ЄY˜l -‰à{3w0λH`åZÎã! fáêؽr¯{àó^fÇsÂÕŒ¸‚~Cu©Çóe§äãúÞ(,– ™õTÅÀ_ý«Å¡Ï -Ò6»« ­’ä$ž‰E’“TªQèµÏ¿™0JÔ® °A’ä(œÁSÂgh;!Ýt ,¡×D—c) µ±CD«X{|Õ6=«_¸ú–¯õdeQ¤’%2#ÀG0‰WZ} ä[\}Ôñ¹8LÙM¤óC?! 9•f¦G觲‚Nn@@²ü£Á„,ê©"4¨Ãc ?±ÊÖ*`¼ï(·ÙøQÙK½ðïyÝ´+±~š *©kïçwv¯f¥ ->¯Òßc'³ìY'—YWçŠYÏ -æâ·iå·`2™ ¿¬õp»aXðÄ&—‰È k¼7·8ÍÉ#Æ÷äç6A-zMY;0ì4o8Ðå}ù©„"„Ií¶jÔÈíà þv‹ç øŸEÈÀÌ0šºñ$š\ (ý B~`Gw†Ïô2q¿«"D^ÊNž~êRt¢ö¥¿èÌàšƒXÈûo£Ñ%)-IF¿”­NF±»kl‰±úÙîϺÓCõÉAG°•öÈʽ±ó¤ÏI­^Õ¢ë8ØièZ¤U`9Õ”…s€ePÁëTªn`D1+¬üZÁ;Ú©‘±}Õ«2èLµ£Øà hL‚ó&!Ï‹‚ê%úÿyAa^T…}ÞVµ*“(IŒ°BR=’Ô1 7Iî3Ãg*¦æ(™ ôµY©öBÒÒ.jB¶Ý<‚襜Ú}©¾XÇ­%Ù•¨ã×Ë>KeæE*\ê«bà“Áñ¿f’MžGŸÅÉÀ̺±Á&Š¦XýƒcˆêrYÉ÷£,šÀº nMmbÄœ¯Ãê -¯pë%ö±Û•7v‚Ï=Œ TÕà]†ñöÊrÛ‹â§é&"Z„ÞÆËär¯Däˆ4FÃÚn½¦ãÑ« i‚¬èej8ƒŒÜ¸gcFŲþ·bK÷²Î„4²›&0Qâ^ SL±gcÓ(g‚aMC+û|X£¿0Ä,7•n€3luöÕHM7 Žš‚Ý®$3V›F „¹ÙÏdl ejg`vµ0ˆ<»ôÆ' o1Õ^ n9¬¾IÛÆ­‘7‘:êÎh"ÃûvÆ^†F ‘k8ÍÔiþÀA2 ÌÀZ/…ln¢Þrn®~æ8(pO¤ ^ÆeHšGš9à—¿º¹¦f<ÐíŸ{1Ågs¸A£¯ÎŒë³tEÝÚ¾ìMâôâž`­nr±.):aöœ,cL]Õ_·†åW“Ì\ªzÇ­ãð,›±‹S=ÀÜ i ‹ð—oãÌ1a„cn¼\ôûÃåò#8®rA Üûzôî=OãÏîw„â¼áÔ&zù†raÚrÄš#i®E­´æ\)ÏÈ’\:§Èçg£4`â´ùÚf×CY WK~Ä-$ºœ2h§‚‚ÎÖ$`ä g³1töd£gðwÂ>FóÊ0Ë5„ -WʱuoHµWÉ´ -ÔJKÍ†È œ\3»-UôÓsÎ娂Ï2TȺ¦å$ wÚ#CÃg‘¶þEcø³¬µä$Høzõs‰¥´·@¦p>_Øm¡˜‰Ô09¦tÁª)MSIï& «zÊ@‹£‚s½¨gøļq#ÎfFSŒ•íA/Ö÷\Ù}Š„òªå„5X)]=ÂÊÛêbËq[5ˆš-X6L8&6ü­Ù -ÔD#{khCуȟ«°zR%ã‘_½ØÛì2Õ½Ø×5"è#JkA€±=tôbIÀ¬lÞ\v!¬X¨àXµSI#Që ýÌÑ]JŠªÁ'K™30‡‚£¨Á˜=?g\ ‘¯\5¨Ÿeû½Q÷ÀºãH’!©’]iˆ%¦†-º3µóÕ•+=ÛÑÑD«è“?âS™àÜRªóÕ$ÅÏ^ð‰3S±­÷r¬ÎMUNÏ<ƒë m”ÂFÝF)ZÓ³EÙ+×þRŒÔvUÏæC|)b4^!W#*ÜãªQªãÙ¦¤ƒjKÔ›bl{­÷2´›O¬¥îÅž~ŸN%P÷¨†édoÃeÙ`krª–0\Æ™3 8·bƒŠ^Œr^¶ºÖlZ.Ó •ª²ëeÄÚ?t¤Ø£ qëIëá˜oð†ûk²ä÷ážüÞ>HïÉy¼o•{ËøSÏL‘X4 ¹õøhv%{)€Ë>†‘Ú7#êà Pשŧ«]{ÕÂk·v -µ¼½Ø×jâQ§لْ=g!™ Æ.ßiÁÐ æå¾dÌ…= ­»d˜¾Ô?ÀCÛ<Ì—ý$Ñ6{=ßT*9õ¥IX*©;¶f@Ç«¼Ò ÛÚ^ –}+Kw4v`<–¬ð0¨´Î¦?µü°²ûmí):G-[¿¤6¾4Vgt+EãÆDÙ+u—A؇ˆt|¿D[Ç0´ÊøIEËúbvKP¦¾ v)EñÞÆ&¦–ÓÃTŽ«Ù“G<æ‰xµW¨ æZ2/³1rDyè¡­%Ùð¤a$OtÖ±Ë{Ú¹lÄI] âÄp’Õ»ú¢Ã"×€²ž2ÛÝ`CÆê?š É;²¢#ÌýÄF¢mÎŽ•Ó#Q0Y,Üo[£€ Gàs[&—¨Ž&ΆžÇ)5qx2–»±þ=fQˆ¼\©~9Œ¥ý™É»—R“Ðç|yÁé`êýTw™-ú¬¬gÔ­«ãIdmòtÆ£J4©l^4’ׯËFÞ vz‚ójrV|_‘§«wº[¥¨Û:X ­Ÿ³¤ka®2ÅNF ¶^Æ%Éôâm ÏEéõ-âƒè@Àyß•,_ôÁ䯱¤y!“÷Ïí$~ï -‡xM™€qÁA{ÙÏúqÌ•ŸcX¸ëz®ƒò€êë*ÿ⇰ì -«–­Èf·#‹nXÉi-ÔGÉNø6uûÄðY”„Ï|~£P]Y“j“¨fj1ÉÓÓd–ŸôL˜˜äN´or™²Ÿ^³t#عPô×ûEŠÕª0ÎW\m©µS©[[ÃÕqŽ&â|¬/R»lä¶;GýÖ1%q¯_Høüdc°&L4¡»q¶P‡ìÍÅÖVPµ†&ñ[ ”i=éiRáDÃ¥zVþ€ƒ Õ û «¾ÿB,(Sì}GÈŸ¸²cA_‹¤ÿ -7ÐSdm,kõã•ãi]ÈÕ ðU}#>¼‡fxã£}&öΨ”ƒ”ä}=’Æ¥ˆz‡º¾ra,äó ŽMªõ˜Lbj×vÆ„rT"£æ[rꌈ.[h1s¾<©ú⤻ö2VÚõÄ~üüèŒ@” àÇ“z¬sQÐñÈ–R PÄ_ð³ŠÀNžsÿ˜_¹lœÐPë°ì·jçôiÆ -Ë©¼±ßÊéRÿa鵘SoüÐ$Hc„™íô©”²û<^¤Ž¦tôû'† - c1cºä ×7e’Tó‚- ³0ŸË\òáJª_µdžT r.L™KÎU¾XtGNõR&Ëøó%iíÜO¾y%Ñrù*Ëœ‚Æ%éK_ŠHê·$@*=\¨Ê2]¡9z$À‹¿cºò7~üuRäù¦È”¥ ŸeÐr[À@muÁvv”8…‹(Á]ŸªòÉá3ÛàŒìÉ<=HâÑ€öÒoÿ—|&‰—k³‚ŒZ¢äæ›®âÊé ³j&¡¦$4 Ù‡þ3²V¯ÿBæfþ$8ÈœÌk9™渜˜ùZX¡yW0qí¹ ÍœÌögJh•$˜M­<sóæáàö{Ú`¡Ò¾Ç-Æ ¨$±Q]¤y\®µÜœÕ×1»ÌCšØ-«'¶nò;&nè1âÑ@†ÎöÅIâ ³ÁΦÆ«Ðà aòòç¿a¼‰äëßÛ—}ú/´ù¿¾ ¶ß>GÙ&Ï‚å¯â ؾEÌðãècó ñåÿ-R1Žendstream -endobj -4967 0 obj << -/Type /Page -/Contents 4968 0 R -/Resources 4966 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 4954 0 R +878 0 obj << +/D [5145 0 R /XYZ 85.039 335.442 null] >> endobj -4969 0 obj << -/D [4967 0 R /XYZ 85.039 786.531 null] +5151 0 obj << +/D [5145 0 R /XYZ 85.039 297.341 null] >> endobj -4966 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +882 0 obj << +/D [5145 0 R /XYZ 85.039 297.341 null] +>> endobj +5152 0 obj << +/D [5145 0 R /XYZ 85.039 263.264 null] +>> endobj +5144 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F38 3057 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R /F65 4251 0 R >> +/XObject << /Im3 4496 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4972 0 obj << -/Length 3091 -/Filter /FlateDecode ->> -stream -xÚ¥ÙrÛÈñ]_ÁG¨ÊDp^ÇÞÕfc;¶RÙªÍ>ŒPD  €–¯O_s€åT¥\3==Ý=}ƒá&€á¦Hý .7y‘ùinvÝM°y„•ŸoBØ -ÈÖùéþæ/ïÒl~”›û½ÁS~Zf›ûêïÍ/¯?Þ¿ýt»ãØ ÿv›ç…÷î6ôîn·¡÷Û[\‰¼×ïÿŠƒÄûô–ÞàÒ|’Ùß>¼ùÛÝûŸoÿ¼ÿõæí½¡Ê¡;Œc¤éËÍ› -èÿõ&ðã²Ø<Ã8ðòÜt7IûiË{{óùæ¯%Þµ&‚4.ü´ˆ/e¦+2HS?Kr’º -ïëmšyªiÕCŒµÍŒ“ß½¬ðêž šV†¾«‘}ššab·W˜ç^ïjV¼«aúqDŒ€/g|¹×Lø,½a ‚ŽV/a~l‘‚<óæAë~:!²s>¨™š=??vˆ¤ENµ\Koæ=8;µBÀDY_Óx&ÖìmÂçf>,N@V[!c¢CFGü†X°ü -ïta`Å@¸qEFc}D -R“XDlNÏMÛòèAß ‹V·Ž@)ª"ÀšŽ‘Tšëö;O’<áy$íC-úŠÂªd–‹èhtNryp^Å °gŠŽhŒ¢ è—ðå~P2ÿjPØIâFEèíÚÆð·g>i±TiQX?ðÙ¨Óð^’ ®n@ÕB@%ØÆfz☯ ²Ûf§H+y¿(Ý8"§GbÖTM †ùP ¤°jÞ“Q‘˜§•+}°Æ³S'T–$,ÑáYöO­"‘—Ö‚W>%Íšã×øQZ§£qSH,XÔÀÓÄOÖ;žb29!­ŽÔzÔ¦Dsk6F [F¡øÍ0û,¨X€³pšÄIKkæÉ’½œ^Ošw059ȬÈcïnú…d–\¦oX3ûs“ˆÁ’Ù‰5šVãR0÷#©žh¯À“Qâ¡“ ôVi,Ã0lêæÚÅ ˆÌ†o!FÑ r°²'·Ñ1 -%§¯«—Etî`QÖ¸Ñ:äéÕZÐ8½©ÙÐ擬\_N”dÆžá/¡l°A`v›Q’2*ÐFp:;Á7q¬ßÄÌ vò°ùª‡HH’-Ï9ŒÓ Q ÊÀOòµ³€Ò3¸¹ˆ/ˆ¹‰;¢H%4XgR˜Ç¥{-în/ųÆÆn&Žát 0‰BVopüUÝ;!b`9ðÁ úÌi›Oi¦pÛX«J¦Û°2¢ïü;/ fžjÏh8­·#‘o3õÙ9xI$í©é)æä]c¶ÂK•j›'ÒsT炩ݽÔ<à‡#Qž8±¢‰bWqeëóåe0 -ØÒVyÝÜ68íqžPEÀN(Ž¹«»óð71€±?Äïžuÿæ#CXE5¾Ö_s;ë]€„\¸OÐ³× AñÇáH\€4ô¤å2ª(°;Ë’Ä=¶ÃÔQt¹NN¸Í™ëǹuO¦‰RB+©ÕBgÖ¶Á¥ž0· $¹Ž(p ¨ZY(AÃX@‘S…¢ȾÍ?1ÕÊîz % -Mt£|Åi»Áò|KΠŸxbOïΣ\Žr!KÝd2õANÕŠÌ‘ ÚoƒHź/œ¥ÜàÄÙi¯Èüž„^0KN@•ÆàáÏ“ì«æ¦2‰n›jŒÄZ ‚-<¬‘”àxæÆx!AËùh"‘ &‰Aˆº#µ‘¿š¯Ón{óívnºúåˆÔK6­iGÓ¼–·.“w*ƨ©ìn¾LX·ùõ ‡T¾¥'I¼%o¤2¨¿5“I¨°¾¦ÚÈqF4n:aH;'¾2.v™®FL•‚„ÓÞFçNÜÇ„F\=CpîñÀ/• m-‹Ê’‘\[ ¡Y'*Yí1`¶‚yžBÈI¼é@uK[1„ñàøòØð å¨:¸e8êfµŠEt=È9L¢ô<qXÞæàÍîªbÕAHp¢=iw4zæè’®«µÚ îÙÆ|n<çr9é®UdêòÂE+Â`Äå˜BL‚d?^ ’ó„òÂþ¥F…\ºP°n[NÈÆEOuB@JŒÖosÑëÕþN’å~”ç/ö¥êÉDÁeO&I"?&ÂÄ|81ôCjz”ÞÛo;¤åÄÙ J¾Ö‰ øß×»dIļ}†b3&C¦ÆÁ¢“Àóòe¢-ÌÕFR~˜r3íÃÿEyâ-ü­öŽú¨*†'Ùx}~«ÏÁíæ :Éep¿$¬U¢[=”Tõ~Ne“(Ù¯—G Â?M¢ì”‰!Àn§;3:„U«5ûŠ¨ˆ0ËÅÇÄ,S†PĶv«GÌʈ“«"\ìz¹o~©ypšl¯AòB{;PÔ[°›ÜûÉ-ëñ`vv<Ɉ]«_¹ ]Mrɵ ¶–ë±4*Šyójjk¼y,6‹+Žƒâjo,(×Óü äX[1*aàɪ¥;†ëºœ’aMR+éèÄDš0ýÂñ,qžW½‰ƒ¯JPÕœ){õ—^LbjU·Êé€^·_<3Ê8¹…jŒ„›§F·3ibF:[Ãcfð6™tî§9¼†nÙnŠ9Çg_?*§ð_V\4¯«\Ü{"gjÃ3qCõä¬ -·¦³¡xæä› ]÷ܺ­ÍÜž®…þ0†b'Š_ ˜ÌÕЂøÂ$; ý±„þ¾GJî`îwÖÖß¿û̃7lªýì–€î§ÈÞé–Z{µÔ¤¼È’…¹þƒ‚Ò‚ˆ8úM‘4ªÌŸ»ßyÄ>«Ì„ ˜±f1 ]”qYX½—wR|ÌRgÙÃNõÜ^Æï<ã ¼®ç‡¸s‘µ›šµÃo‹ØªfÿfrúÁwôNq‘]ýFÈßÌñCl710ÿºDÒNMlÂIòY~Ïá^•²ýDÜÛóêjä€ù³þ0ÌŒõ—S=ͼݶg‹Ìzó"»h[ÓúÀÔµÄ8õ“xÕ8à?Këÿú ŒíK~YDëê˜F‘…†²°4=§XÿVæ’äÿ“·öendstream +5155 0 obj << +/Length 3398 +/Filter /FlateDecode +>> +stream +xÚ¥Z[oÛF~÷¯öe) b8ÞöÍuí6EàdmmÛE[`)‰¶ˆH¤BQqýï÷ÜfHZt 0`çræ̹~g(5‹àOͲ8ŒL>K³$Œš­÷ÑìF~¸P2#šÙ0Jbúnyñö&Nf* +ó(Ÿ-hÊró[põãåÇåõÝ|aŒ ” ç‹4Í‚›¹ +ÞÍ*x ­7<úý»»ë«å‡»yf‚ÿr×åí÷Ø°Á=LûñòîZºç: ®pý®¿¿çî«·Ë;úðþ~þÇò§‹ëå€Ù… mbÛÏ¿ýÍ6p Ÿ.¢ÐäÙì ÚQ¨ò|¶¿°± ckä}wqñoO…ÇìŒWMÈdaM& 44ÌÑß²²¡²jr;`Záp¿J‡VE@‡[nú˜Nš t£@£Ö«+±0;Ìãx¨®ÛäÙ¡dË Æyh-Q˜}ž5›ç†Gmâ´_DoßíÕìûXšõ\™<Ô`3Æ„Y¦=[*›°¢ËÝn¾Ð‰Šõš˜;ñÝ]Ãýÿ¹}÷ëÛ÷À{UŸþä®#N|>v%>÷Øg‚ß#ew¥¬ýR<«Ø¯ä­:ò\Ú¨©»F›ÝŽÈlxÊ +왧uÛ’Íži@ópMÑUõ# +‘Ôˆv“ÓYŽÏÄYWOÆjá Ûª?þ?rßyhvGp›¤Á/8´-kìÚ窆Íåµá'ÒÄy'k…xsêúQÞ +hÏ51~”Mx¶YíÊ=ñ‚.jMP‘uœŸ eft "íàn÷ÌïÕ…’ ‘£±ºã!bU[b¦Þp›dIë6sÅ’¬»ªiã@óàfòì#‰6´Ï“ŒáùéeË ¨:~wœóÝ®GÞO+zœ9¦#;0iÜãÁö8q…Šç΂=ɤªç6EÉ¢•4ɦщàé•‚KGfŠc,·©¬‹š§®z£;v}W©MÙy‹Ü{A9cÆh"Íž_Pçê=?DÛ]óÈ Ç9±ú"h˜$U”ÎiÚTÿ½0¶°ÀS +¡yëò¿[*…¸c(P3cçùm¡u˜ÙÔÇ&M„L”SbѤ§(ø¹*ŸÐó¼õuFj…—ûr}jÁðŒ"Þ¦æ'Š4I -0Á’U!K¶ÅÜDèÂçÑXC‚‰_aܨ0SyT㉠z3Ï,kÞj°9`Ū<¸]Ú·:Š¢·¿~äŽõ®‚hÕA°˜©·ôîÇ×øú‰é4D'Czì 8Ç™¶›–Ÿ›Ê»ÛºkZ™Y¹åLCóLœ,oA±¼91?C&‚hÈÕ—9ÿ¹ïÊ®£(0&É m\qãP¢ +müÂñú9"Aƒ¬Ÿåp’%ìȇ#¿ž#Ó„£i/kÔ€16$¯ea–§¢•-&ƒ«« Ðü‘þâ8ÔJf‹fÚgÞ è^°Í± é:rpdåDÑܲcöÍG©, +öé¸,—LC {ä)+7%éÁ™È{š ©h~.pâíD%I˜&Éà௞9Q¡œˆ6èTÇØbÕ§˜?‰Q€…$ÿ”䟊ü…«sù+ðò‚ ÷Nñž3bÓJËÜ®X1Ⴒ·Ÿ‘‘æ$bÎm˜§#;|ªÌK–)ù¥ÛzwžÕ -¼kê㿦¸Žrž³ƒsÃ9ã4é¢qK§ì' so@o&Hâ2‡¼NÊÈ‰à™—8dsOX÷ò˜°õ4ŒýÞ(S×e{ÜV‡)Fu¨RgL&8¥BQ±òÍ,Çaš9kZ¡Ù‚ƒÔ,uP†l~!_.z!JM5>z¤Õ²ãÂÈ¥ðô‰·mddïA}Ä€Ùà0ã’›mùùä1H烬®ÿ“'""#ö$[çÕƒLúHát„¿så¹Â¶ÛÛ·K|FÁåf_Õ•“m×8©i1ËD1‡è<¢Ô¡Ï'ŠDäã[žÀ»F˜@ðLe½)7ÜCH)ív" BPƇFO«#râv÷k7›‰“'\[u=×N…U[RFwäAÆçš%ÐßáxEŠßJ ˜‡„à‘ÎíFj€ÂwËHÀð$S4à#Q‘#”C¡ò&çg¬$±x8Õ®RèpUSä#8 )—_ +~¼HÛÜIjF½T‘à쎟‡¶ŠM¥bÙQ4Ì®0Záþ(¸g^ß;èÃÉ9/'¨96×/dÙ 'HjCH.‚l6QC›0Ñæ,jxâØ%êCˆÍÕ0¹Öä €–!»ø@_£kvt +Ú§±f÷ÂT0ÀãÈSɬŒ xaøB&œ@Jc | ûÆ!À™oþæ«Øwë &LãYûxVÿ5œ½r˜‹H•¤}õJÚOÓ0Qñ·¦¢$Ô:ŸÈ@~ÕÒ½¡ T÷(H*AMÀ´rxEKÉÆxE䀽c:Üç`½<9×i˜ÛI-;öå¥ o ¼C6K…W-ÖŽÜ{IAlHHRÀë©‹½ ^óJéÞT”šv£}6?ÆBÂUõiî,RŠv^#ˆ’èP‘@>Œ †CÆ~WÆÞãíÞÝ\‰Ÿ¯ïxIÕ’û¼_Oе¥Îe%šfX±ÆÑ{ +b(l¨‚ð´Ð©þÁ$âáÔ"1ù˜9)ˆ¯ï?àÅ%öi‘5Ž¢ocÓ(ö biÁ£G,¾x·o&Xבódxü‰¨–ÒõÛë®P¾Î.ÞÄqïÉñIoOÛ†­P§PŽ§ùÈ +öe½=C› ˜"¬ÁÊÑAñ’:±rÒ.©6Ö±WíTQ‘…Ú•õró ßÀ¬[ +Y«-i r*á´ ( ªdú +ïSúK¹{™à"ä”PR»/øÎ :”8]‰!]l‹ûÆŠz5Ü°fû½åj`[®þ*wRšð]“+a + ‡Ð‰ ¾ozB[kÚ¾¢ÙXè¸q’¦„Wƒ:éû:«¯øÆiV¥ òØGl<û±œò£Š›)„ŽÔ~ú4º'óñÊÉz@!¥nFj ×=ò ä„žw”a]k£àP´ì„xüιÑØ¡$ð%Þí¡íë7Ž§Ã¡i»‰ƒf˜ÕÐa?6’N¸h&Jg«à(nÙC±›¢ÎÂÄ$ƒÊ¬Ç–Ñ{FAsêï[ÞßÅÿ|/Ç­8-rqì>LaõFÏbˇÁUPXÄ*])Ûç¦.§«ïÈ×¼’Õ¤o¨Àé"ËüØA¼åK€OT6³Í| dTlI°‚‹Ä˜‹Èqt0©§ëÑô½p¶k˜3þ‚þ +ÚrÙ2AŽO˜L{LEEó¹›õÒÕ¾v~"Oo?É[Õm¹u~Ý€õ³,í*¾‚›Jûà艑úˆO:Íym‘šPe.Ÿ¬çPî@J„ÿOõ IÂÔ:„ºnJì DyH¿s°)»{$öÉ á‘qèEU€äˆ 2{1){B/oሑ¦uY"‡KÅßù›Êº©ëþƒYH"¶‘dü…+ŸÐtNÖ3²L¾®´|ÈS}éIÞa’¿–Cù3=½ceEÝ7Ñ“9î30}âb]ì&sÄÍ=~´ŠGDù'ô-áO_0a€\±ôÇ!þ¨•ý¥/Ìs$­_yÂËHçø:üä…?­Ñ‘Üîá ?“W,ÈLÆ·0ùÀ[¾ò)¸„àˆ_=t.>îà*~6!*ò]ÈïW-Q—®'2Ÿ®“h@tÜ 5ŽÿTâÅ)Èþ™Ç.wýX#óùG.É™©ëFè\âïˆJío¸Ë¦Å"/ˆ•kŠÕN¨ºã¯Ä)¹Ô ú—iŒzáëÍòãà>®ò?)˜º31†”é+0Ùþïý|ɤHÑÓzý:MÅéKUª² þqc:sendstream endobj -4971 0 obj << +5154 0 obj << /Type /Page -/Contents 4972 0 R -/Resources 4970 0 R +/Contents 5155 0 R +/Resources 5153 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4954 0 R ->> endobj -4973 0 obj << -/D [4971 0 R /XYZ 85.039 786.531 null] ->> endobj -918 0 obj << -/D [4971 0 R /XYZ 85.039 467.277 null] +/Parent 5162 0 R >> endobj -4974 0 obj << -/D [4971 0 R /XYZ 85.039 433.133 null] +5156 0 obj << +/D [5154 0 R /XYZ 85.039 786.531 null] >> endobj -922 0 obj << -/D [4971 0 R /XYZ 85.039 309.474 null] +886 0 obj << +/D [5154 0 R /XYZ 85.039 630.904 null] >> endobj -4975 0 obj << -/D [4971 0 R /XYZ 85.039 275.331 null] +5157 0 obj << +/D [5154 0 R /XYZ 85.039 598.687 null] >> endobj -926 0 obj << -/D [4971 0 R /XYZ 85.039 138.123 null] +890 0 obj << +/D [5154 0 R /XYZ 85.039 448.133 null] >> endobj -4976 0 obj << -/D [4971 0 R /XYZ 85.039 106.1 null] +5158 0 obj << +/D [5154 0 R /XYZ 85.039 413.387 null] >> endobj -4970 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +5153 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F62 4159 0 R /F80 5161 0 R /F58 3380 0 R /F59 3455 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4979 0 obj << -/Length 3176 +5165 0 obj << +/Length 3173 /Filter /FlateDecode >> stream -xÚ¥ZYsãF~÷¯ð£T5Rx“9gãÉlìÔlU’Z¤%–)RKRöxýâÐÍ–Mùa·RõF£q´éÑþe¯½0¿L³d‡þåfá]niç§ _!V -²r`~¼½øásœ\úÞ:÷òËÛ{‹'÷Öqž\Þ–.>üüþëí§ß—«0 ~´^®Ò4[|^ú‹«åÊ_üú ;Áâý—D‹ß?ÑÖlýFƒßuõ×ß>üãêËOË¿o¹øtk©rèöÃ4ýûâÏ¿½Ë’èÿåÂ[‡yvùDcoíçùåþ"ŠÃu…:o.n.þiqÉ^t)§æX‡Ù:ÎÂ×<ðãÄñ:‰RæÁ·º¥·”Ý2ÈO½(Î<±¡åºÂ¨]ùb”­qGËOÒŮЅÌÿòü¨©G±YBàŒ¤¤18öÓůÝr¢‘c|¹ú—êzYùòùfÂH ÒbäUþ5Ä­ÀŽ»ª¯î ߈­'€a^º2v[@ZĹ•ÆæÌ ¦^iBöé#&1?ÅÆ~•²†Æ‘0 몔#wàÚ³Œ ùùRZp¢ožYÞ4uÕâìøŒI„n\Y+ù’êûùÖ •R2î ¹±å=Æx%~Y„À\‰*Aeç)YL=ó­?èß±îZ––ò(Hשxtu¿\EaâÊ…µ¢¯0Hîè'±óžòld-[ºìÃî _TlŠTT±6è„Mñ)J‚EÁª+€U ù˸q sQ0Œ:…`Ãà¸ä«}o°Ž»é6‚!vûÖÕ—˜YÑü¨®¤­ ¦‘¤ÆÅ÷>ð·²ÑûÂõ‡‘dÑÚK¢7ÃFx¯<‰óµ—‰‘“o ÖD¿†“#…_Üq¡V‡ ÙU[þÀsØ_BÙöUSwjXúÂLåP葤èŸþ}æ!q²“·ßaAÎúª$ˆÖ9¹E<ãvsR'âæv+Ú7ÊšJcTSª!ü Ìb4Uõê÷E»Q$õþг¾=²…ìùrXN—ðà•¨–1°ŒS•1»Ò­l¨ì7Ç~…§]Õ -ºÑö²2¨).½ìU»Aï°TÇPAK2|z–×lq®êWQ O£˜|gm}©zæû¤5õ {æwzŽ6ê"›gEÕ ”‘ @!ö^/`9žÜÙšC${Ð;…»êûhiÛ»pC#¾N(#…êÚm5Œ6t¾›ã( -B‘Í0ö5Ìâ8"aù//ö³0®ArÀãcJ—óþ økÙùYBsÂá.ȉâó/$d gVÜ̯g½®aFw2Ûj”ŠS|–ŶÝ)ÙûC±eÜéÀõWÎXÜøÐÔL"°%>›~bÿw‡£€;REŠ#°ÖV¹ïÁ†<šŽ ¤{4~oÝnÉ`7”`lÕ¬Þq ãPÎÿ–§´Ví¦;Š}U½ÚÎŒðEc?Þww68ïY9—Áhßõ•]Cî7bL{P)ó*+¸ ejO|+ŒoÝð)H{9Káz9¹`¾VEõ¶¨[M £„óê{Ù &ôB 1?¤4¥¾ŸaCÁ1Ú›**pAåú“[?…U“ÙE”èÂQ9ºåÄdpÒàwÖöõæQÜKè/̯•:¡$W3ÊjQ>.cöÎahAâWgTˆ áLËùS­¤°?¢‹ŽcÍžû?½9•ø2’Ó,/·Y^æS8ȼ³pzÀŒS¹Y¾8¶,'Ÿ­Üc¤™$¢¹uKïN¯×4;C•Â@Ø2–ä+ÈI·ì¨+Ù:¶Ó|>5ã§ÜËU\LÌð2FÑW´šÞƒ­â+NU›``Ш÷Ø>6œYLJEûÇÁ¿Xé«-Ã}£¨;µ!ã]m)¶I–p±Wœ'‰ù¹3JJã7S3ælŠE¤3Yö"ÅŒ5ż>6#4cõÇPi^ù±ÉK¯ØâØKž¡Oñ¾Ißs6wŒü€rLj黆 -A+ËuŠ&ÇNUpQþTü2IÂÄ&ߤ˜@€i!?l«ÃƒL€ïX n6ÜÀwô¸^Ú‹à÷,+-“rÔW/Ï+¤TZ¸šõL»‡šŠF·-xÁ©R-/˜ñ'Õ´-×ä×BSOJ®£ñßUoýUêŸTO ƒß^Be·—imâ™øÀf@nG‹¯M±a•æ³ò³ç Å\\i¥'Ò’N -¦£¨ÑowF˜³Þ<ô©Ï¢Þûn} ÏóMæ4î^ 'øˆçöœþ¹ý›AŽKËGÎlúz¬¥åL³RèöMÜÛ¥M¬q L˜4¯C“[QØ•#‡ 5 -ìäµL…¶ÇZµV¢É ïj“‚n8G éè­JŒVe¯ )ò JCH¥ Vï8žM0®ð1· ¡Þ¶²Tp\t7”ŠEƒmq¸Å*G>Újº¢œyìÔ`¦4êÇâ=¨ ¸—žû)û¢-_|*@ÍsÕ*|ÉnÚÂ¥C6Õ&„EÌXî:÷Ù•ˆÍU Ø‹w<ËξkëQõs¿*úJ<8z3Å -‡ŒBZa{öhã̵¯_>/ÕÇ7Ú@àWž?¿ñqƒNMܦ—mÜNáVl…–›V¼mÒnSÝ눿dwé€ÛgC¡ùL°ÇiÛ¤ñYsÐÄÎã¡–º¡[ªo;·—PJÌÚšUiÁÒˆüò(»R¨ªls‡þ—¹Œ*Ó}ÝžìØ8œzÎP¾üÝÈðž±î-e¦ ôO¾½îàˆï‹áa0í|bò4M±È¨M^f󯘽ZÏ×f‰s-MØúO² -9ñ³:^G¸Þ¤ü€/ë²%æêVVΔҸôeêäX;½gF­ŸËjü4ßÎj˜³Yúë( _d5©f5?²±ñ Í_¤Pí´ õ‹ò©c£[ S>|†t½òMÒ'˜³©Nž®ÃPXuSpUt‡ åeh56C‰ˆz9·Á°Á -% ëM×ÞËêÓÔB¤>²±yÖšçS–%ÖÛ>!wª<ÑŒØS‘K—tkhå;W0Ö)W“HÂÊâÉGd:õª†Sm™¬-s2qÔ À¡EM—(›JGÌ´·‡O»©c=¹œ8!˜؉ÐoY¡¯Òr_“¦wÖæcªÁë3àcÉ÷ÜöYžü•Î[Ø+¯1[,†y.¤ÒoÕjÙPŠ]³ æÂÝ\¹‹¦Ë·˜JÖO©—ÜxÃa‡•ùÌWxœ/Fç…žœuIyî´f13ÂÉðÄÔž|“>rÚo”¸i619ï>ù°òÒ”Û}øu18MÓ©ª£¶e‘¾s¢Qc©G­úÉN±(YÒßÄ1ç/ DhíJ)ÙL_pâ‰ûß,ÿXÿ|v±v˜]Å~œ(äö¿g¿ÿ,¶p ŸÏ_åÙâíÀó|ñpkåëXÉw}vsö» +Å ž5#“•¡X…¹ŸGz^n+”“έä"è¡G»’aiNƒÌ´¼_«òX5÷pÔ$õ>V0R—üÑ.UèuÜþPuåf€žÀë¹ë.»‡ª‡9}Õ6ýŒp"_Eñ3ܪÐÏ"Ël¨g®y½C^‚Üv°IÕmñ+ónð5 mßÀÁHT"|v»\‡ÎòXÆñžpÕ ÿOIB?Ê2™8nz ½X%¬-5®²YF©÷¥Â±{fǰǼ ·~4÷ò‰+î¹Y0õ¯ ¨[Yäv¹Šð*@ý¾9§,þèw4t$ÞARí‡ ÔÞrœ3×¼Lƒk ¼f“T¡½§¡Ï€÷Øc·GYAѠĵ-t†Þ?/?ý‹{[<ó±á!Öì½;Ýé?A×ã­ÒaA³pöЂfe1JVGÊ[cŸÝ5`±óé~•0K‹Ñö¨ÅNxÄÿˆXRW_¸ åLeï)ôþʪ ³‰N‚°ü ‰o.®ÿCd™«k*ñ#m4¦™YÆÓHÆ=ê¡Ö)HŸ[´Ci¯)Jè g4rGà9…fü·Ý(k“=U nÀ0å²>YZoI•P‘Tãp¼yh_Ò&ß®Ð5ÆñÉCtéÐã’ߨ ·¨¯ÜÓ[.¿Ú‹éÈUŸò)0»’:e9Ê|f/°|è­ª<ïtV“)pšq &ºÁe¹w‹ƒFæ(?låãÑ‘Šô½|‹)YÑéùBÍ$Þ_}ÿIæq윷³[[£ ý¦«Ð†ÊII¿ñB|’j[6H1TwÐýh|/,ÓƶŒa$l»‡¢®Åÿ乄Éݵ8•üÄR4ц›,yÂ?BßÅù•D[”œ9AM³"¾,wŠ¸ èÚ}Ä›h;!ÞCq[ô$?ߘ¹c-Ÿh±ÜÜŸqž°ÿ±ªknaœÈ<™`âJÃc…±,ãÒärÍ¿ÖÂNϱŠj«ž(ÄÅײ{l›¹#Ź[‹çØjoÝ WK Þ®H/9‚“NÍM9GƒÞcÀÔ[ÈÜK]‹*†*þˆ°ñà¬uÞ²­t-Ƴ7¬a+áÜ‚]’y¶{Ã/àe•¤ë ¼"š1ÁtÅ–)f\?òè…Yh°7’…Y®frGË´ë*ë7P™BÙ¼eZBÕ1b@öF/cVÝšƒª UˆÉ@åC31øeYøvh_D£?éúÁŸÃ§d‚ô9<AØLÓ ž>¨#ž¹Ä9€hFÐ "Í€ 2ò‰0ÓEÉsˆ‰ãW@â8 +Ä‘£çj¶$•-÷³oŒÃÜZæ»{n(¥wâ,—ì]q®Á‘¢6ž g“ž`c0;nÚ®+EÞ„)›­„‘SÓW`ù9x\fº+‹í[v–Ç®Ji—ßÊÍa˜ó+3ÿÊ1A­±Õ3§¨#³Jƒí‡bדּe+º‰³o8ŒÀ;+¶¬–¿¤“¢nWÊÂe]raR&A'‰¿œZ~æc…`Ü® óÑÛ Ÿo@8QÒ÷ñÍŒðÅÀl¤øö†Û·•9ìxÀ-wp̵ìg“]Ézá^­9Û«¥i÷LeŽ±gG:& mcLSpÀ±¬ž0EÔPaÜ9mWoÇ5¾ãÅgÎÜ‘Í'§×§”¦Û¡PJ$þÁf÷è¤ÛÛ¢fBŠY@rß¡5œjm˜Á–©‰@/E*ígw¾åEï("ÔkåkWNžoÂ\¹H?p‹Ž~^¾H0ˬMŽ~ž¢På¾Ê§éŸ@¥0pîAÒW¹-©$î#ÌÃÏ¢aÏ‚mëF(õ|žWœÖÉÂÛªß×dG vÎ[Éw{3EÃßp7§™»Jc_'Ñw’å§Ê ³jCy÷Ö‹F°}žù‘q+š&ÌîB úå`_»BZT¾sƒ˜±Æ<'½¼c2–04ÜÒìÈoBÓòïŒy żmç©$Ha––º¡ÚÈUË ˜]ž¹EørÂ@žŠÂ= ×nÈ8>°å¶6ýzÜ@‚Ñ0)ß±Ù{JÕ ‰eQÇ%RB Æ/á“7²šPZeŒ©,%<щØ~ b_9¥iÒï€ÄBÞG;ñ<­yÕm±í¹3VŽ2Ž&úÅ~Z(@ñ¥dݾÂ8Ýïªý¼z+‹P,üÄŠa dËÙ²-–sŽ»Ê¸7ì"E’CÊö]ÍX#ÊÈvp õ…ŠVôEÎ])²L•:I©ÐèØ*bš¢¢¸é……Ò8ƨY¥ k~š¾ØÒŒáíÈL¿4‹]Ö±¤£¸c8îDÇ~få}5#]ä\‚[\\¸”(„©`ª_UÂYD!¼±”ÛÞš?ºØL"6AùÒVZOƹXü³šæF…Ôµ!‰?‚ÜÄ!4»/òYDlü@û§ÕÈ·ÑÑxÉFf@ü'WZþz9ˆ³Üû{kuØb[EU÷üA!6NM­*K ›Š®v’Í®2ÅÃØ}H‰©êjf÷¨šIÝG<Ælþl‰¢—òÿìµù$ùÿƒL艉ŸÍ§ÏfãëÓÓºÀäõ,ŒÂç^Ï"?ˆ¾ó|ö¡²Ð“*çdª8ðäÉž Í ÇÂ2N‚C¸ÓÕlÿ6#xî/Ä°þ¿?®Q©›$¿0C=e1_—`îì0ø?4˜ð½endstream endobj -4978 0 obj << +5164 0 obj << /Type /Page -/Contents 4979 0 R -/Resources 4977 0 R +/Contents 5165 0 R +/Resources 5163 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4954 0 R ->> endobj -4980 0 obj << -/D [4978 0 R /XYZ 85.039 786.531 null] ->> endobj -930 0 obj << -/D [4978 0 R /XYZ 85.039 684.064 null] +/Parent 5162 0 R >> endobj -4981 0 obj << -/D [4978 0 R /XYZ 85.039 649.314 null] +5166 0 obj << +/D [5164 0 R /XYZ 85.039 786.531 null] >> endobj -934 0 obj << -/D [4978 0 R /XYZ 85.039 472.065 null] +894 0 obj << +/D [5164 0 R /XYZ 85.039 766.606 null] >> endobj -4982 0 obj << -/D [4978 0 R /XYZ 85.039 440.042 null] +5167 0 obj << +/D [5164 0 R /XYZ 85.039 746.277 null] >> endobj -938 0 obj << -/D [4978 0 R /XYZ 85.039 341.361 null] +898 0 obj << +/D [5164 0 R /XYZ 85.039 514.428 null] >> endobj -4983 0 obj << -/D [4978 0 R /XYZ 85.039 309.338 null] +5168 0 obj << +/D [5164 0 R /XYZ 85.039 482.406 null] >> endobj -942 0 obj << -/D [4978 0 R /XYZ 85.039 158.581 null] +902 0 obj << +/D [5164 0 R /XYZ 85.039 207.585 null] >> endobj -4984 0 obj << -/D [4978 0 R /XYZ 85.039 124.437 null] +5169 0 obj << +/D [5164 0 R /XYZ 85.039 173.441 null] >> endobj -4977 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +5163 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F80 5161 0 R /F35 3036 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4987 0 obj << -/Length 3063 +5172 0 obj << +/Length 2996 /Filter /FlateDecode >> stream -xÚ¥ÙrÛFò]_ÁÊXebqycdÙVÖ¶´³©­l†$$Î@’ý÷Û× @¤·j+q0ÓÓÓÝÓ÷ØŸyðŸ?Ëb× óYš%nú³MuåÍž`åý•/ YŒ`~Y]ýí]œÌ|Ïͽ|¶z´xrÏód¶Úþá\XÞ¯n¾Ìa:~äÎiš9ïæ¾s;_øÎÇ\ œåç·8ˆœ/7°tKw0ø"³ï®ÿ~ûùýüÏÕ¯W7+KÕˆn? ‘¦¿®þøÓ›mþ_¯<7̳Ù+Œ=×ÏóYuÅ¡G¡|—WWÿ°¸x-šñ®)ÄaæÆYx*?žA»I”’ š¸ˆ<ç8ª[øS ¥†‘Z—Å\…aÍPÍæËf¾2g3Rç+Ê wÖm¡¾2ÈÆÀ®*uŠ âkª‚'˦Ãïž·½âêw Ð3P¿èç®òŠ—9I´Õ¼Wâ MuAT?1¼âŸ{~„p·Q9«î„Lܤ­> -8'‰l àœìîU[Ôxz“©³'î‹ö±AqU‚ÇgŒ´1s¶FO£¶ª×MÍÛUÇ Ä$h_ `ZØ r> -–>XÓJH•åwÆÓ4@Ôæ¬MoP7üÛà®Ap­!’nÃÐp*¸£žm¢Ùwñ]‡|×®Ù¤®—ó¾%Õè-Ãõ;& mdÓT¨-kº"šVóh`ðš²$Ê_uýôó³JRß “ð¢;Á)DþÈ|Ïw#/´ˆЖôø<ßKÜ,Î.h`NN<0>ßÜÐNd2šƒ’ Ýû¢/]ŸÊ²cQ„˷‰ - r$;@XÕZÉ×bOϤ‹(|÷œT£È ’ø²T˜ R JõƒTNœ–êèÄ´¦¥ô*z,â|FQµE©Áµ ­‹žÔ 7Ð}|íÎÉÇO]?I.Ëg€¹ ú¡|.8ÈçèÄiùŒN¼#·F†Müö$ÍžY³BRd;pôAÞäxSsx0žg{F^qž»ivQ\Ñx§á*N#7óØ` J.뻸tðXÎ’xQõ¦@Ç“¤ÎƒªbMŽg×0ÞÇ!êüi‘e ]¯7 †ü†¾ÚHØî^Ía¾UUÑí9åˆÓÀM²à2·ÌÙèGž›ÄìR‘¸5ð䞃÷Ö²W×6Ät¼Ö ¤Á=¬<×ÄÚøFƒ\Bw*7ªñŸ³"ç@ÑŒ™¤é~§z©’#? -áÂcÐmÓê¶Ò£ÙÑ Õ’ÆÁôž-*Wñ)Ž:]7ÏÝD8ÚãZc¢.qcøÓ„CüZ‰stß© -‡/X«8VâÌN 4W‚¥á_µaßJi‘œ§øÔ -¬®ŒiKú—ÆàÂÕ’BâÁá·¤3PcÓ’Ë‚€íÉc+&ͨؤäîQìIî<1{üwËs|`K*’V©É¿}çõGºèjo ¸¥dåÐìÙ> “5ÿ›^tKaˆõ‡†À©ç¼Zn%»ÄIˆ÷B{]s) ”ú+ËL 8S³jSœ• ¤«•‘sa²'þT¼äŧP?3ôtjR •ìP½"iJK~@rx²ÝfK&D£DD06û)Aú©LêÝ<‹HÍ"?p*JÇp4È íàØÓ´áÙeÔÉÈ7wׄ‚ªÇ×M\s&g±uw&§…™ )â4I¶xø ýn‡à`ñõ×LÏtæ)%Ðcê„9K–…„…©‹ÑM€àìŸÕù;Oõ”ìÔ# w#8ˆ½!j‹²¶6Å –âó~Ÿû@ð¯dÅ»¢ÜË1Å·žGÆ1à˜ÙhÀ#Ñç„àp”j;eè?½½cê>ß­xuêç÷7<^}¸}àÑ=R´ü²ü„U)•±8ûÛç70!@ÿºû–ÄÆ? •²Ë·üA.o~{ów¯L‘{÷v‚ÂÕ‡Vî‡å'€ù—9ƒÛG^7%9´FjnAöäM„=%‘«MWQZÏ{ëXHóø#m<øÕœfÐÁ !é±ÍñÜ©­É‚Q(þ²Ì¾ -*iv2XË a *œL¶áŒŽD2ËÒйí…~á£5M#C(Ë©ˆŽMâÏYG ½¤z¢½OÎ-„Ä„›4 ÃÆCn¹iØ—ˆÌ†oºg‹šŽW)Û­…’Ó§Õk@4VcY¸qðÆèN%ÓeNÁ††¶¥˜¾›j7J¬=ÛXLfÍE<ƒ-q†­œÎFðuù -Æ×1ó‚¼l>ë!"Ò_D£d 4P0ôo°Ú‚Ìk=ê (Ý9ƒI>bÖíAÏÝ·v¤smÏò¡{•|å‘‹_¼˜4;𬡵Ieè`’Z›où«B–Y¤\Û¥9¨*'CÛ ³Lá6ÎÄiÚ6H(O’‚P3Ÿ KéÃæi¥¼¦ú€ -«Æ,#ï²NôáÇ…0$ʤbtoôQð`‹ñŽF¢ã†ù/v:~X©™Ó-ck?"óÀ•ý-ÙÌR·ôþiz{Ñ`1và±¢ˆ% Ç+ñÙ[/$hÉX ‘cº¨8¶¯•B¾íšd–¸{¸úrÁM¨KiâélÞŠ€ìHp4ÑpóÁuv>ôÄ"‡lm3J`ÊTüÒ3+¾éÎ&TØ£ÂhäŒh¬+ /„ÃêÖºØÃŒp2ÊгkÄi¯6¹“cIL}¥¡$¨ÎQIìÅÇ%:´Rz0­ -†Ó%qB> IÁ³TGˆ¹?è"®ng› a=8~Ng¡÷é=´ÞòèýÇÇ÷wó‡Çi¦¼ÿ0éöó=6´÷lßß>¾ò4ʼ;œ‡óŸž˜|÷ðyþˆCŸž¦¿Î¸y?w„i_' +¥ýýæç_ƒÉôÃMà«<› øažO67:V~¬•ô뛧›ØUxLOxÖˆNf†c¦?Ë´UN(ç©Ø ¸_ +?¼OtÜN£ÜëŸKêUþª<òz8¨K¤ÀØ–HmÕ—K^`7Áre»©:žÝ KÇ쫦e®Ïs&|Á½LkË~ß"3-ºf†Bf[þ剪?õî>q$åÑ~þøoÔ:ª:D%ätF”)E‘C¯…¥7|*úÍ–mGô†x—%Û¼†ñ¢çñ‚i(­u`ò/A¨ë’Û ³1¬ ÛsBÛÕ8tÍî´UÕñÝsÑÊ’l fqx?‚^Tà-«Õ±Ú¢m’ÄûPѱ¡ÕLa M›¤Þ}òõL92駩 +É%Ð:Vy7"uä«èšÐ*ô³0Ý—ãU+ØBäL5$l£+±*ah‰:}ö îÈn,BÓ +•x4.&¿]µÙÕlw—¼@ =ÓŽk+YZ—bôv öÜi$¥zåN¡0Û7[@(u ×Í»¸".Öà@ÔÓ^®%-êŠ$~!Y‘ÒÐêì$Vßaœù)4Yëg–“„©Œú¼Î÷´!ùrùÕž¯åÈ«³ÈJl¯ŠN—§×Õ¦ê‹ÞíÝD†‚i{Focº½¬åÒL›Ò%Çæ‰ ¨¿Y˜Æt(W…º©"PW³b±#=¤º(ÍAÁ 9föe[,Pè'Þ¡™iœ"’ºW€s´²Žp\Bš—ïPÄGÁªè^di+ǦØí(†®y„%úýÃÓˆŸ}«¾ âzR”D Šõ&òmKëŽÊj¹àÔ‰p3¶*q/ÖÆÞ*Î)fÞbÑìYG¾+Jý g±>®Lø•8¼+ÚbSöâänqæ¸[,Ôâr[:Žà.jntûÝ®iû7„‘FJæqðvÚ¦ž¦Üi:ôU’É´(¡Y;ÊüD%ÂôVνµ‰@£òi§ÍnØ‹£?9lïv(B¡‘ Õ:K\Élìrx–C…Q©fTê':<ñ€UQƒä u觔òÄz¿Ý.8çtŽ‹Ü›»EI[<$ô¾s²©ðëòÔÌí=§[r +m»ž;ý3J@þ‹½†·M/Ìh¦(u<”'‘0c±*÷CŠn—Ë1K)?Š"aá«Ðó=SVFnV™’sc·àŸº2gà[w:‘^¦¸÷œ4¤xÙ• áì¼–d/±*ƒT @’ óMFKe9l„rÎÊrcŒÀDî‘Y¨äßÈØjK†B½ôw-ßx˜Á^°$O”Q"5ºP–¡?Õ„z`ÄfZhS¢“6’Q“$/ÎþÃxÒbß—ß.BHIzs$Z`dT0|Kzì’D›=wÅ–”?ê#w6ŶÂX¹¯‹^¢;…桽 #·âä¿xæ¾³Wîݺmö¸Ê;jH«—Ì6¼Épíº2¾A(ùÙ7ÒHoœ½‘…SVƒ[¡Òü5ÌŸ9[2®ÙSþ¯O‚ڹĿ£ªÞ›e-á èÌÉAâ± SË@Û*ç^Ç,§°Z3hwåE‰y‰•– !”)Ææ‰Ý•Æ9ÍíjŠª‰¦ûVV.è 6Ç°±ÓÈ[“ï“……Ò¯(²F ¡Ëò¤{ø5w™øê.yÁCÛl¸cÕ—Ä^m¡`Ï4«áPAÞ8‰õ¸õ ŒO€ Ò ¿4€^ð'<Þ{Ÿ»žRgŽÍ·<ëpNÀä<o“öÎ^ÆQà§q~nqQRµ³÷®ë,öÀñ^¤1J _€?`vÓwuUʬBVý%TzÛ0íªƒ†Þe3_u/Ê©A—`ëT©]µ4JÂ*ÀZôO±áÈLªÔ ×ת<˜¡’WÅË5eí-bçT“ÌùÌ£ÁÏG%0|¥a×… +g(q'‹èú0‡ô‰s)c@\‹ìœD.¸JýÔ ‡±G‚òƒÀä]Àq±~ënÀѽÀ¾¬+±4š¹óžøêБ …¸`]ó DúÖtŒF˜–’¯¢ìÛ.%p~1­Ä?T0ÀT€ç«ìÔ¡ZsôJ^¢G[%ç2aCcážc)DºÈCÄQÊq· s !h¨j˜iX{§ ÑlXͶ¼ŽÙo)¯År°ÕÌ*î\xœ4;ÙŽyƒÏ«,¥þá ó4m¤c°’¡/:^ƒ±amúÅ°‡LR2zËÔj%¢pQ«åžáí´ŒÉp“c¦ËÓí¸Û³Í£—oebä}YÓË_*³­]^•4óíƒÛ–†YÖ,k?˜»<žÁy“ÐOiÕzÛØR•Ì=<—‚øOBèy™J¼í¬’%¹“}¯õÅçÃ%wsö¿NÂ_”˜WoÞ­H»Z€ÑäˆÌTðϲ²çXÐÝÉ4•â`ˆÓ0KŒÚPµcØ–;è5fß«/*\‘)‰Ÿc/­ÎwE¼”60ï8’y5V™,ÚANÍ•ÿ +ª2N‹A6Ô¡mc#^çb_÷L>1\ !)È¡©Ô+iÁœK|b¶À 7Q+V•0ì2ü•¬eÊbФ‡2†s'x\VáS¿½./äê ò³8^½-WÖJºf/L¿þ 2_›êÀc¹«!f³s…Å­NN)ÕRm-g§OÍ#…z)ãåV#y-‹}› +˜D£IÊ'˜‹ƒªè4ŒÖb·|7 5k÷¦•ÜåÊOóS°Âå<Ô\,¹È—Š5LJ¾± Gû¥!Í8Çâ:qÌŒÃIâ|f"ú¤Nƒ¡R¾9Éß8D×p­od +ÿ†oéU†÷àÝ€ÒiµE³ábëI>ƒ`êTðÍðJf Z™tqy—©l±~®ù‡ÖEGÉœzov%ŸòØP˜N™–²ž¦â™|ˆ±c(?É"ëê›æëXiJ+?Óégð¯l%°ßPˆ6åcŒª‘'QÀqßÚØ¡0àؘ}VÃ[!ÊG+׶ô%™‚—ËL +ΫSÄ›/’KÛ²ížá‰?R÷„&_ùæO,­ _«Ó;yþ‡aî'Ék08÷u[L!Á]µFUÔøƒ1ÒÖ×ƾ÷h\?Œ}ðÑ~š~Û÷žD¾÷|ÄÛsåŠkØü¥g¨ÊuF"·å[Ð%Õb»,ð«OkÔ“¤BF C»EËå*?mCoý—7Îg£aš]ö¦š&JûT¤ýP«×?ÍáS  NÁkâé¾eꎊòŦ4% öŽG{.k‚üŠÂÉ5ÓΪÿL> endobj -4988 0 obj << -/D [4986 0 R /XYZ 85.039 786.531 null] +5173 0 obj << +/D [5171 0 R /XYZ 85.039 786.531 null] >> endobj -946 0 obj << -/D [4986 0 R /XYZ 85.039 599.78 null] +906 0 obj << +/D [5171 0 R /XYZ 85.039 724.712 null] >> endobj -4989 0 obj << -/D [4986 0 R /XYZ 85.039 565.636 null] +5174 0 obj << +/D [5171 0 R /XYZ 85.039 689.966 null] >> endobj -950 0 obj << -/D [4986 0 R /XYZ 85.039 414.879 null] +910 0 obj << +/D [5171 0 R /XYZ 85.039 254.273 null] >> endobj -4990 0 obj << -/D [4986 0 R /XYZ 85.039 380.735 null] +5175 0 obj << +/D [5171 0 R /XYZ 85.039 222.458 null] >> endobj -4985 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R >> +5170 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F58 3380 0 R /F35 3036 0 R /F62 4159 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4994 0 obj << -/Length 3393 +5178 0 obj << +/Length 2582 /Filter /FlateDecode >> stream -xÚ¥ÙrÛFò]_¡ÊKÀ-Æ}Ô>Ù^;«D±wm¥’ª$C"'#+_¿}Í`@BÎV¥\çèéééé{^ð/¼.R?ˆËë¼Èü4¯·‡«àz3ß\…±µóúîêå»4»¿ Êë»{‹§ ü´Ì®ïªŸ½7ÿ~õŸ»·Wë8Ž½0ñWëÊèí‡7ßݼÿfõëÝ·Woï,UÝa#M¿_ýükp]ýß^~\×Ðü°,¯WIûiK¿¹útõ_‹‹ç’k^µÄ±K¿ŒÒ/³)Ëü,È,›"˜Mü8É\6¥©Ÿ%9± '7iRzŸÔa£àØYî}8¡zÝ -þôÈ”ñÔê3bGCcË·+„BØí4u»ãñ78ÞÒʾkžã_ùEZ|ù@ (Lî=Ìý<á{ÿp„ú¨ðº~E„#]‘"„' ·ÁlWQîYÊEÅ]87Ìþ~ªyôG­èÔ°üÑÊ‚_‚0ñF Ü — 4±ã‰{hÖ¸N'hö5Êfy7㜀–YK<Çñ¾VMóÄí¥½è0…ÙëòX¹QxJâÍæÄ7§í§¥GÐ[ܦƩª+™oñ7÷8Õ ²ªÒÁ""bé »–Ûˆ¬»g° kÅ,’9‡dì.’ ¢“zC7§pÛµƒ®êÞP¦„A„ìTDÔ( —8ï0#%^Ü׆ý¸”T #ÕGч…]OÓ õ£&Y/XdÎo…(µOpG0ñÄGÕÜ"ÎÀï“ûšÁg²”3£`xÛèºE¶ÈR—q8­ˆ€=Š¥Ñ6º¤šÇ‘@õÁ_±¨`Öâ/‰˜Œ)þAõªõöÔP %.*r¯ï6öÒGý¢%}Ýhµq€xÛ³˜cŸ´doľåÕúplÌÐA&¢Ò©YÉ;îÓ«4¢t="ƒžxy‹PsÉ»ƒþS]r¢e +ºjXó0°Å‰#wêÏš$TŒô~åjêþØ[»Róíߎ¤e`Oì D¹€mÇ}oõ®ÇãDè ^¢# Q’£)F(4ÇQ”«ó‘8ÌWÍD ŒÅš<–Z¶w$µ8{;W´£T²Vvàcômýš5»’0s4Þ¤µò‰sÄ~À1îøI†/4ïB€ã€ÇLÀ½¦;ܪÓP3,©R,B bÚíy;s©µ6#ÜNÚ¾ˆcIaøÂVópUÆîÚêqÏ-›Ô}=,…-§§)>—â–byw‚Lx‹gàÄ^$àØb`Tb°m&Ï7ŽuσÚq(ì´XbpŽ3ìÀû†?qó¼ÄªíY6îëú‡é¶DþUÆ%3/5‰Z -ÑmKÎK=h.¦ „èÓ ^ðé.õâàÍG$êæ'ž‘Ø2ç›.È|–ÒR/»LñméèqZ¸'3Âì׃YÆr>açcŽjJX‹…SãsI”6• }xV~h'éÀ8âä'"òÔcO"Ô§aÄúÎ&“™¼™¬s­HÝðp7÷LÆbZØÍd/I®¸[éAm¨RùœÀˆ¡L©Õü½¼“ÀÙLõù¼3ÎoPd¸²R\ÚÀûƒ4l±"t$dYáýðþ槗gRPÊ„ôÐÆÛþþ5·'³<`ýÚÇz§újr¨©q^œŸzrë€e0űîÔTRGlX6È¿ ©Ëå„ÊF ¶'äæä¤òh‹;Øj€ÜÈ­$*–ÔyCÑ-8ˆ»i Â×àÓ13ï{mjÉ}7t÷R¿|eòb‰Ä]0.'rJ66«§’&^Y8}äÚg¾œP ²»Z2«þ£òd5Ä©±ÒpØÓ;%NœŸy^è÷œä%N8óhÂ^Š’`@a-hÊ ÁE„/VçÈ»ž5‹×ƒ`ŠÍ¨m'ˆ;‘îb™Çä99^j58[·Õ’„C€H ˆ­¾¶f¤ÁL&4‘5…z[‹Ãå´ËÈÀèÃQiœu«ŒŽ U/8ÍZpŒÇ£À»¹çidþVä6#†+y¼d§p‹n)ìà cv±Í…PYa,ei¸‘ëÜ€ ¼YG>;âé$ÐYJÉðqä–æÖVuè½)’ì{ªJÙà#’L2J<{ƒîíY€C(+ÔP̾1vV’)ÀÙq`9´BŠ%Oƒ5N˜g—‹œŽ qOVèÀ{)Èe€y çÂX,Ü—Ï’tÿevv?00/…>ð ­ãä|-ò<+úËNpPÜ7{i"+±g@,h¹y2ø)¹²õa^VŸ§{„ä`õmǨ:Îrœ5‹EÈ™[ ²Å÷§È•úìCÁ‚½ÇO>‰— RN ÀLÈÅ??®Â¿`xÁ]†L­çÄýÙs¤cu9‘q‘X6eõ´€ËžÆT$lPRíºäÀE‚[ðk ->OˆnY;˜¡#ÃE.¥Ž _õ/JWœz9—ØÂÛ·„xæéÁ8âÊÕ¾¦Bs!ï²EîÈBl^I;ü™Ñ VŸ¦W‰¢Xˆk—Þߧ*SȲ¦ÂbJ„£)(ð,…„îƒ)ÏÙ›SóY¾!{LUžój«Å³‰Å«¶3y=©3z]÷Å]†üJà,4΋Íó· ¡­`û, ¸°*^j\à}gƒyÜ€Õ•{†}Zif÷ŽŸ[ÄY+„½¬Q³bñ—×*o%Ãi2öøQÆÀe¹z:Dô&Wñc`47¢æsE€¤Z¾9L¯žØ¥èÐì[xB˜¬Å¬çli䄤ÙdŽÁ<Àÿ©ÆýŒ…ró/½ûñ ŸýÄ©ŸðWSç_ýÀÆô·¾¨²ß%…_Ñò§CiùQh‰¡o¡Òâœâ4.ü´ˆHþó–æendstream +xÚ¥Y[sÛ6~÷¯Ð䉚©ho;³ÙÔÙ¦ÛI¶¶_:mh‰²9‘D—¤b{ýž@P"Íf2ƒÀp.Îw©EÿÔ"OÂ(.Yž†I¬ëýE´¸‡‘^(‘ˆ&ŒÒ‡þq{qù>I* +‹¨XÜnIävó{ðÿ¾½º^®â8T.WY–ï—*ø°\©à—+hýÀ£?~¸¾zwûéz™ÇÁoÜõöãØ0Á ˆýôöúJº—:Þáüw8ÿ憻ß}úx{CŸ~¹YþyûóÅÕ­§ìÊ„&QÛ¿.~ÿ3ZlÀ Ÿ/¢0.òÅ´£PÅba’8LL,ß»‹›‹_Ý*áĦÝm`^’íåÓå37û¶~‘]Õãw°{4$‚ò 3úÒZäô‡¥b¬qáÏÏíÉ(hPïC‰ªß“˜¬òŠçxâmk¹]òœ?"ev¼õÞ—õ¡ëÉðhdq/J¡Þèöº§E‹€ÉöèCø›“®„„$÷aðf$tÕúØÖ= Ñ „¯û<< +5œžñX¶yÚ°jCœª‚··ÞøÎéE +—¢Eˆ=Sqsty¸¯62‘c§Ðfb0ººé'ì83F2TT<ö‡ŠzÃY‚üû‡ZùåÔ)ICÞUÛ^ºv„SéÖúü0Æã3ä°Ž6ºÐÆP¬éUǸ䀂ån÷²„£ö.ÿ©Z8:‰Å¿ØB5ðït¨•ÎÃô["¡RJfìKŒÎ‹liÑ îÖž²Ç°¡@ÙñXÉŸ.@øÑlOõ¦c„âGŽȶbQ'†¾!…†gÓסé'tW9¸2p]ƒ~ ·aŒ‹‹1F(B,GhÄ9BOtÈ7Ün7ã>V Mg³zìeÁøÄR‚£ t¥t›ûê˜ÕÌy¶#(';>€›c“¨Q=S~¯×zýî…G$¬ý⣠b+Á$;Ëš =f=!µ†k„F‚Í_'¬—p$©çô8E|I¨Mr¿΀/ŠCe2¾•Ð^ìÕ8|=Ë åK„&ÅÄ6Z"¤üyį^Ä-pÐwÛ#ú3”lÙxl¿F;®©ŒÐ ýqT „!G°¬G øùä*›î KÂÕµUÇèuêu/ ù¨‹¤^«eää0[XDNˆ¢Ó:`÷v2¶:2p×J¾±Oá +#Uìa3¹j˜êÿÎW&Œt:‘¯,xT&Ù8™8ëÝ­ÉÕ¼%ÆôqWÛ,°_?œ”×ØåRß_GG[ýée­”*™6¶¸ÿ÷Èt«6|«6'¶¶"^ìiò bžª§Â¯lpÎSÍõ[zzïm•\qïtÊþ„dË79ýóÍY·µ¤þhÊé®*_„òqž{#°Ö¤RúñpõÌ„ú¸däÂp=z.Hìû¨®&ŠûsxqhR[XoÐ༗IˆMCXÅ= ò +õÁÓ}U¢ÙŠîƒçû&QhÜ ÕÿvVÒ06¹ÌÀ°B}5sd²ÐäÙù‘!óøqnÂ\e'7ÃËçò1\Jôl-À°îø0•rÛô&öè;Îxfî/w¡XëÐh=:53Y öVÉw ÷héÌ9œ»¥.¨ªÈ¹!Ÿ ìËã!g|›É½r;)±ä™ GΉ€€a¼”U$M˜›[ªÜ·×K…*ŸÄŒí ÖÁfÞô,“Ç,©Gáü¥*Áê·2Óޣȴ:wöáÚC½Ãßøk¯ ‚¤8ÔiægŽŠÒ}>z€ eœ£gŸ®…ú«n˜3H2²WÞ, |@ŠÉ±v¨EªMl¥Žç¯Ü yuàüÌIxlVãÀñKõü£0¨»^ª¹gþ%/Cêä·Àr³¯5HáеF×¥¬7\ƒ34vúWz}([¯„×`ßÓC-U=îßõD´‚}U£›Îö^Jº©÷j)Ü» @Ì=šÄöñhx+•€RÿÛWnzªù꿽ru`¦]8ÿJ–€ +ȼGþàÛˆüö@=üä3zeI¨`ù-K +ç;÷ŠV +»’:絓ºQ%‚[:o;^7¬BÛH‡Ü^±yîC¢Ö{Ùܽ:¥3΄%g‚ÿ’4®zwG¬±æW…”tUî!Ô舫ÿ–ßà8º°ãaJr$·´/fvº¢áÐpŠdq¹!öpbéšOÅy¨lyÒUû²ÝH°s¸P+ÿ¶É•¦¼Á—£=¼• 0ŠÛS<†ñ¶9‰&…E.Ëãk£«O~  YDµ,ÝíïBˆþv"—™"4ŽRN~c˜8 +’y8_y¹eÕÉû›{ÆÅÖþåÛž›¿Mdä•Ê€ÛbÈû: U¢æê4jýÿàã¤?_+hF LÌþzIòm*|XÏ4:ù}9¶ÑÊLÿT.›~߯ÏPQy•È«?-«ôLE…rŠòü/ŽþðCendstream endobj -4993 0 obj << +5177 0 obj << /Type /Page -/Contents 4994 0 R -/Resources 4992 0 R +/Contents 5178 0 R +/Resources 5176 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4991 0 R ->> endobj -4995 0 obj << -/D [4993 0 R /XYZ 85.039 786.531 null] ->> endobj -954 0 obj << -/D [4993 0 R /XYZ 85.039 766.606 null] +/Parent 5162 0 R >> endobj -4996 0 obj << -/D [4993 0 R /XYZ 85.039 742.055 null] +5179 0 obj << +/D [5177 0 R /XYZ 85.039 786.531 null] >> endobj -4992 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +5176 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F58 3380 0 R /F59 3455 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -4999 0 obj << -/Length 2551 +5182 0 obj << +/Length 2578 /Filter /FlateDecode >> stream -xÚ¥ÙrÛÈñ]_ÁòKÀÔÆà†«ò [²­µWÚXL¼)¯†(!.™V¾>} ”k“rɘéî™é黇jæÀ?5‹Ûñ’Y‡và©Ùz{æÌîóîL ÅBHš×˳—oƒp¦;q’ÙrÓí“8v„³eúÅzóþü×åå§ùÂó»\v\ øVž‡<ýqöå«3KÿŸÏÛKâÙÆŽ­’d¶=óÏ|OæÅÙíÙß»½çÏxÕ” ÅB%vâÏ‹) íÐ ;1¹€UvC1ú‰ $ãÙpa -ÇB)|×Û]‘Â$¢¬ªD±üî(ÿî±ÖmóòF=×{žÁž†TÁ„]eŽG ^•¬Âö8ÉX+›ª(¯¹Yû¼„á#ös76D\#/3YM¤ˆ­æMK+×x·–ºÁÉn¾âŒ cª oõ7Yiž°L׸ûl–—wŒXW¸ºœ»‰ÕÖUÑا$æø¶RÑóëi:•J,Œ[ù%ú‰u¼äjôªÀ/q ʽÙ!†E¹ð@x‡æ«aÙŽJžeu@sR¹¡ïÛ‰8é¿æ1ÈöQd¦K£bXÓ+¢Ðj‡“‰7‚“¥¢—eõ‚vAËѵì‚;²žsÑíÞˆLLLM¬fÂÎ^¡tfDñlá%6{ѽfsIq÷V%*<=7!šj'‚îØ—óÿÆŸ·( ]4Ùpm@K‹ì›6kËý±@&7]ß.„­˜5°Ä»ú=ÛèGܯåùÄæwÑ“bëI|A> —|²‰Æ‡.qʈÂe›Œãfºf?ÇqVŠ¤ÂSÉKÁÒÁO Eç‚ëßÜ­æ³tŠn^s°aYË2L¦8EJæD«žiRÚ¾Ká™\‚¥…´Z”‡ãÏ´cÊåQ̱¶™ -d˜@¾.»ÀaFDg¡R†aÄ/ÞK !t׬æ8U¿y©d´xG’ßx6©m7–Ò“ŽšÓþb)úi¯B ËeŸã+vÒL'dƒ~¸ÖDêf»õ©FeïÁqçŸ^pì)[›¢ÐdGl9eÔÅÛÈ_ˆEÁqò¥ þJvèÝ’.RgúŸ$l!T¨ð…'äÁÒcg¾^J9ãA¤ uÊÆ19™ÄQ×–V -%9C8¤"aÅYe§…᨞hE4‘à^º bÅ^0>Žƒ†åPŒ–2-ÌtyH[!Y¾HÔŒo”Œ#žqЛ^“R!‚k„î(œ´] ‚±7Ù¸â‘ã*þŽìùeS=ÄðàT érÈíŸèœº¦®kØÓ¸\)¹”ѦlÕ’ Ž’õ·´hÙ ?컩“µ5¿ü°8®º=Q¥2Q\ªlª³æT½¼–RcXêÇB -CÓè¾(«S Í?±Iä §+Däò¥\ö‘Üg|yÀq­©ϨRÁ•]ÌD’<• ŸKoÑù"|°ª¯¥Çdž·6æ‡#¿¯bpBäßšÖÂ…„„È<ð +5jí./µ8ì²#iÆ#_¨‡ãH—Æ‚ÚLcFt"Ê:¾r±M'h -?&õ÷VFëŒÐbe&)°Þ×OŒÂd‰)f·…€ð2Wa x¢šQC¿ñaÓH~9=¢È5¸pC†( ÛÁdÙ ¬®Ûõ¡Û%•úºZÃþÄ'鈂˜‚Z.›ïËî"t"Ó×ÙH0® Ý#@*ø›‰äŠðuUÊÞw­1ó\–ËÄØúDùRŽBÆ '}ø‚I›:§ŸKg‚³±äã'ˆf¸•k¡Ÿ·9ýGƒàÎ÷0ÙA Øêr-ÈÕ8eæqÎïàpÕMêì+¿r^^žªGY7ýÊVwQöAÜž}\S–ÁHÊ2äõqG׫JìóCW’yXÅÄ7¯8^¯#$‡ƒÃâ rű¹8ˆN¿›ÇD POvG´Òô:üÄ0¶'ŸWÖÙ౦³Ry<üßËŒW£´žœ®"½pÔ+3dXïH8ksl0]/â¶Æ‹H¬ˆòî²aèñ«íBé G:ý7êµie7®TqÐ$ÉÆt´ßæàh“q=Iƒ_è„Š×ÙŽõp,u$Áš|× &E‚pêS˜´ÎÈ4³=tÕ麢Bg E}è7¼óõÍ’!oÞŸ_¿»dàòýÕ-CŧãóOç¿àïnøså‰GªÀö§ß¨à¯ûýÙ¿ËÅv»Ó]ëڮ꘡g¹ 9ä8ðb;ˆ½ –ÿ Ÿ©6]endstream +xÚ­YëoÛFÿî¿B(uˆ.—Ï»O9ÇmÓöœž­ wh‹%RQ>T’ªkýßo^»"eÚ).?h¹;;3;ß̮Ճ?µHB×Óé"N"7Ôj±­/¼Å¬|u¡„Â[®…¸ôõÅ«/Ãh¡<7õÒÅzG$ëüçòë×߯¯n–+­µ£´»\Åqâ|¹TÎÛåJ9ß]Áè%¯¾y{su¹~w³L´óžz}ýs d_¿¾¹’饟8—¸ÿ÷ßÞòôå»ëõ .½ûîvùÓú›‹«õHÙUà‘Fm¹øá'o‘þ¹ð\&‹{{®JÓE}„Ú -ßÕÅíÅ¿,^ ¼kÆ&+C±R©›úá¼ÝVh§0µ–óaZÁL8¶+tát1Ø, =°—rš]tÙv(ÛNEÎ=N•°Hk{žäqÁ·ø1dMž-µr:üÊq%vn³6n2þú²¬à«à×Kí9ÃÐî›#Ëf–ÿ̇²¹›±²ïj?˜;¶ +B7öãÅJ+7ñÇŒ¨üØMȈ`çàO¸L® +Ô¬ËÈÚžéèI>´Ë><2äS>¡«“E»ArŠø(˜ñÛuk|Q̘'ôÝ("Ï/~Y(× ÒTóêhLŠž6ÑÄ«·µZ¼iA£ÅI)º>¤˜Ky±UK%3‰x›Z5ªµz<Žœ:;ÀG±Ó·µñ0,µ;þö@ñæÝ-O"/ˆrsĬnlöLõ£zýq»?íI?*tÌVÑ|.2›êá Ø¥ø³lakô s’?1ÅR:Õ{ ¸F.oÿd‰sX®ü2¤6qÛ“B-=ð¹¶@:ª "=0ÍâÔYãyK"NÚjØÈŒ1äQÁ¶–„¿7 AÂK”mÛ€ °Ü<½a-)/°î—¼X —ùãNûººì{sH‚˜][=Ðj1ðǯ%©âc^&6ÛcW’ +<›#‡¬jï˜@ãlÛXQ Iùq6VŒw~¼Ng|€Ïf¤H ™ð¬¯Õ‡àçÎ=O6¥”«RÔן–ý«ÔŒ¡*¬p_úi´Ro ðÒ‘ë{Á)oÙ¼} ñêG!Fþ8}Àá}Öó|ÓòïûkÌu»9~=)L·4×÷¼y‡‘Ó15ùíÜ{ßØ(‰þNÀ¥¼|_Vú}Ë¡K_ǃ¨)¼§).JP~38¦¬Ü^Š¢AÖɉˆG‘’aa²aQ̉ÃF’+ç‰óóæß7»÷G•ñf´èö/¹ø û²7Û3\¤|ˆ"BÑ”W ò¬.x¥mL õ,²ÉÈ°êˆdecôÝŸÈmFR +q¶<Æ +w8CIÙP +üÀ0kÚFñe‰'Ì \x®ÈìƒÕ0ÇBŸµ†› ƒù2$ÞwÂŒ€ª5 ­Dj6R¨·b$¸¹+ÎpÕ`x‚nŽlj„¶‚ßUe$à'©^3ÞT;–sÊüʶt¤‚ ÂŒa=# 'ÞI!Ï9†´Î *1hR-†ÁRÒ–“ò ‹›<›Ý*”:Í9þî[&™€¯\¥c¡àS§ÎÔ ©" +óe‰[cL£ø8¡ÈjTµaê8åñ |ýrÄ~´´²Ê!óF ¸­äì˜Àóçω=_}ä˜à¡Àx, 6Ò¶HÏÒ[¹ûø‰#kCÉ—¯~.:´çBCþTpÀU=Ž>ú¸á㊒Ǖ÷=Z¯³d„IÊ1 óÁ¾›”澋MbË¿òzò=â5ݯ¥à·—=Cµ¦”z&Ü𺠟7ì©?,“€Üœ¦œl8Ø1ê‰~hç ðnk¡!ÔkòŸ‰­4=íybT%•óŠ€Qü3PãüÀdO6it“NuŠ|H¸Å¶t©ÄA+6dA½¼…0‘ù¬Ÿéøóš–!ÄŽFNÑaÙíZ*Hí€ÅÓ0Œ%á´?¾®›Á <86ÊLq@v› +-°å…ÞÖe²¯Ö¬0ÐÞﱎa³IÓÃZǰرív‹\$QÛÛ÷Ù qeö2=~´S´sEUÚÛÁúªnÉ'tãÙQ‡N½ÙcuK"‡[ & ·UBÝ1‡VÖ¶Üñ‡S¨ç)yˆH•0G~­yÏYÚ÷¤¢êíëRhoòìâAŠ%Ú,6EaÞ(ãÀ>m¡/Ãv!‚;¯Ç6¹CZÅ×334}<Œ%jÄm²Þr‘ÔãŒK_Ó†l÷wÝ/¡³ºáßc_@ñ á_gjlŠo禎KKt&ÊpVB 7¦Ý´ùÃÓ"ð™"ŽÔ¸Ž+5¹ÁÙÆ7Áž§FÉÓ[ÐÞ©©yÕ^ìú*ž˜ØÚS›ë¹ûÅäbÉdPgL aªÕñ;\‚çÏz)ئ¤o+“+¶)…†ú-)“$£‘WDØ7/9ãÅ]qÏßÄ£©ÿÛ\â%æñùÑK¶v5¹÷Y´V +WBÇÞËÐ ÂrüJ c d+,…ûAú­ÝdQÏ´$¼lš:6éöòGº£oýXÛǃÿÛ,þg7Ëm1œYÞ° Ä÷ˆ…‡±Ù@qÛÒÙäÀõ‘Š÷˜yZɹɹëÚãaÒó<Dzt1sÿÝwÀO/áäÞ•ÈG/r,´è¢ÿ6Y]¼@…nUü†õ‡#à@HrE1üþýlþ>’ŸGpÝÊlÇá|>‡ìÝs²=+û÷?ø÷Ñ¡ÃÏ(÷Ï{6i\Oâx¾_ë|Úÿ%ᶢkéçq)Rçzª®SÁ4ÿ†î0endstream endobj -4998 0 obj << +5181 0 obj << /Type /Page -/Contents 4999 0 R -/Resources 4997 0 R +/Contents 5182 0 R +/Resources 5180 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4991 0 R +/Parent 5162 0 R >> endobj -5000 0 obj << -/D [4998 0 R /XYZ 85.039 786.531 null] +5183 0 obj << +/D [5181 0 R /XYZ 85.039 786.531 null] >> endobj -958 0 obj << -/D [4998 0 R /XYZ 85.039 766.606 null] +914 0 obj << +/D [5181 0 R /XYZ 85.039 766.606 null] >> endobj -5001 0 obj << -/D [4998 0 R /XYZ 85.039 746.277 null] +5184 0 obj << +/D [5181 0 R /XYZ 85.039 746.277 null] >> endobj -962 0 obj << -/D [4998 0 R /XYZ 85.039 704.117 null] +918 0 obj << +/D [5181 0 R /XYZ 85.039 442.889 null] >> endobj -5002 0 obj << -/D [4998 0 R /XYZ 85.039 669.973 null] +5185 0 obj << +/D [5181 0 R /XYZ 85.039 402.725 null] >> endobj -966 0 obj << -/D [4998 0 R /XYZ 85.039 426.232 null] +922 0 obj << +/D [5181 0 R /XYZ 85.039 345.214 null] >> endobj -5003 0 obj << -/D [4998 0 R /XYZ 85.039 392.088 null] +5186 0 obj << +/D [5181 0 R /XYZ 85.039 312.793 null] >> endobj -4997 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +5187 0 obj << +/D [5181 0 R /XYZ 85.039 202.278 null] +>> endobj +5188 0 obj << +/D [5181 0 R /XYZ 85.039 175.18 null] +>> endobj +5180 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F64 4225 0 R /F18 4228 0 R /F15 3032 0 R /F35 3036 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5006 0 obj << -/Length 2819 +5191 0 obj << +/Length 1210 /Filter /FlateDecode >> stream -xÚÅYëoÛ8ÿž¿ÂØOò¢VD‘z-pÒ$}ìµI6q7»èöƒb˱PÛÊIò¦½¿þæEZ¶”´‡+p(P‹3Ãáp?5 -àŸ¥‘èl”¤±i5š­‚Ñ=p^)‘˜ˆÈ¤#órztü*ŠG*ð³ MNOøQ¦óÞ雓«éùõx¢µö”ñÇ“$I½Wcå½O”÷î9¡wrq†Æ»>Ö)².áãZ¨ï.OÿùöâõøÓôף󩳪c·Òmú×ÑÇOÁhöÿzø:KGðø*ËFë#i?2ZÆ«£›£ßœ.æ™Ïr•˜„Ÿ„a¹$Kd9}°œî-Œ&Êϲph%~ -LÎö£$îJþ:Û`?~‚mIû¡ÙÅGEøX)+„:ÿ~Î×èñøZìq0Aû0V¿:=LR?ÓᨳRÏ+ó¼9‡šÐœ›%šS‹e»äiÐÀj-ô¿eV X µaZEæWãI˜z³1ü÷ÿ#‰ùáLh ‹Ó¡=ôÃ.²Ïï%S~ ’Q¹¡Â„¶òñ~UÝánVŸp} -9&DFܿɺ¶zÒx·QŠŠlò\HÇä€b“¯ ‰âíúøg¿ýÒÛ•ÂÄ ÉŽf™×ä¬/(•ù1l(N2ߤß.í‡ÉpñL¬ªÉN×@ú…¡Ÿ)c×CÛpì‰V~ -D>Š~€‹~ö)ö_lš;Am(ëéÓ/ÄoÐÇŸÆÙP’£“ÁEꃬq”ú&yÂsÖˆj”r·‹wç7°‰Øny"\~àï7'c¥”÷û9 ROÎxÀ@ .Î~}3½¼Òô ÍH½›“÷Àz‰Î9aj¿Bæáé%Mön?4ý„Y¹„ìvœ//[ŽÔ´´e=Ãó “+ Ñê+î@wâuň!½ßÂG]ÌYk._uf–¢®]r" “5zçϪ͂!†kŠðnùÄ‚ª(e`ªP«ÛcÂ釖áêd¸PQ±Û]ëv'‰ðÏ_AÌ‹EŽÖ¯Z)\Ô´÷ÉÎ¥ø@½;"åÍ`A(ï®G!ì-bL€…¹Ìj‹M[â'ÒWåfƒm´Ö~uã')d)-Sb5¥G#ɼf{ÆÍú;÷/˜÷@ðÂgHÑ5Ï$‡ç-‹ÀºeÛt×EÃ'†·Ú4B®Ds» / &äŒÖân–5Šš¡, uâ!‚„:õîÉÌ á%Spw(q€-\¤— Ñ &ãœÃì«-ÀÌY–ôcTÅ\I\0JÖxdI±™— ½¹õ«²`Fç?§ÒZDß})6‘{YmÇŸ™Z -îíNƒ¼CµP-&ÜÅÆ„Üäµ€$„{·Àx79WNÎ3œy³Š` ûi˜õÓÙ%\ |LY+4„¯gŒBÀy{ÃWˆ'×'ïϧ„JL%Œ»0ùÏK€:ctêpx}Ž8‡_„søaqmÃ,b¸CÁ~ìÃR.¯€Àp‡Cמ#ä‘Ä@Æ Q®c1e§.ØôÃõ¨ï]I‰2¡š$Ê,–Ë„£þNÚé9ÿ<E=Á“¾éySR.¼@_f^U3Ý5%HX œ“ê ?äŒ$[àp]©. üíš+á:ð(wšúqÁÆrEüÄzýž[öÜp‡HMÊ=wô]=w˜@Ç’BÇbâ p(|ªÉe)+ô=wØs‚Ž”ŸÀö;+}Ó<;çyó¤o5Zûqœ~Gßúýçàl ç‘ŽóKÎyøj÷Ç°s8Z`ÁÍ·»3ò¿mou¦ý T?¦¿í({ºÁµBßìpÿÿÎ(5ø^÷cZ^Ì'Å=ûР#èyãêÃÄ~X‡‘g\SÀÄ×HSï=öÄqâÝÍ«1@ÓcôËK>×t"ƒÏ¶Jø-g,òŽC¢©Á¿âÉŒô|ƒ=f{§ùl騧c×hÕÕªyʧ˜AøüŽw2OÞÂ4ÈãÌš. Ì‘NNDzüÍùçó¦Â,yÜw¬¸-h¶"ÿ¸,„Wc§²ÙØ}’Ä$JÌ’r: 9c6¦Óª´—k¤\Tu[‘>8w%?'¿—X”Û†Ī͞‘·´æœœ ™ÿ(êà ŽûèW‘›kh¡êÏvK­µÙ‰mBp[îDUÒéDQ"ÑÍ‹°¸5üÊ åÍå,—bC­ˆ¹BóÖ­íÜh™JÔÌfü.)§RÏá÷ˆ¨hž·9A,íaè¤ì¿p âºjºcü‰½MÑ’Ñxö Ô‰"H‰¼†±ó)ó¤÷æ k¤¾[Ç,‘x=Ô`.ݶ%¦Í=‹>^ÆÛèNß·4qÎ9*6QØ!ÈCN·…¦tD›$òš¯„ÉôÇaÞ Ü¬”Î|frÛATÀ SÝnÙd†Ó†0Á¤)`BØK—Ä|àD~Ì:!ix·Kk™CéV=“ÈdtÛ.•ñ*`’˜2Œ˜3*ÌB’—.C©Vûí¶ƒ‹€RŽnN0HößL`lÙ¼uYD\T05ßT­ÛEÍ´½ê_Û´– % ¸Í[?l©jê˜ÿ¡»»àÚ8€äŽ–ˆs€:ÜÉw‰hÄ™_WщH~,W+þÊ÷ -i—®A;lg -m<]FMèäߢªmÏž;ñ‚çÛ«êÜ¿ØsĨÝæ’¦·Ëè€1¼ƒðu¯»7ú†õ׌I=taÄæ°R0†Úº¥1˜YÊ…H·{Xé"ën JËå¤zP˜%NÖÒîV"JŽ„_œPV.=ÉÑdë\G:eQ<™JbÀ¼%¯Ä}P³]I! †R6“oòád¿:¨#:+6eƒ¡-*êZn>8Zw¦ä÷Òw.ïèAv^6«œCY) -ç„};P4ôÈÈ·g®h~Þêñþ@ƒ{‚™‹wËCÜ4Æì*#wgŠr4‚!"‹^C¦M@¤]Lùwán$¥DŠ$—xlâWα’(<<ƈØõþåP„tÉ„ÙsÆ!.„œ™{o³Íàyü‘»fÅ„zw¶›Ð°æ6gŽ+-äðµ8Ç´U÷@vjœÅ…LÚ·{¢+Š7Rwï&Í=€DŠk>m°@á•ýÛ–tE(Ç@ÒQå’Æ®5Õ«ô%Í°~ÖI‰ hr†•|x!k‰€1'(Àê3ê*Áª˜wñ8TØð»¦,×å¿-ì!s)µk5?‹U V8§° ¥iཆÊpû€É€-|`ë2”;|^á&çöÍ¿ßQ/ûrüÞnâ×ÜaLPìbê˜}p}a.c3Š W ùÇn¿|ß.xã„Õ–ýÁáêÖ:ÌáÅU=s†õŠ¿‹|]ž‚2i%@ø³m%Ø™TéÂ’_òY't6@²äþó)z&Uû–Ó Ž³ºƒW–PfÖ`GwªNµ[°Ø`Æ"a ivå”rÿ„7F®ì6m.G >d•ðFŒ@É¢UÿY†Ï¥ˆ¸`Qçl›‚ß×r_ÚUí•|i *úeÜË9¸>P„vXpêFÕÌ~¢-FVƒÀ/ý0ŽË Œs¹zPÀQýaru–¾)º 2É~àìRAE‡ ¤ÀO\‚#ßh=ü° éñcþ–fR?{êÁ+‚[v¨œ1ôt‡G:õ£T˜ü­²×]endstream +xÚÍWKoã6¾ûWèЃT4)’•[šG7Á"imèb»Å’m5¶•µäuóï;៑7Æ&(Š VCÎÌÇá¼8‡Â3šq™z‰‰™–ÂÎ:Üç׎pÜSŒÇY¿ :Ýk{‚³”§Þ`dEùgÿâÃùoƒ«^J)}!Y&‰ñ¯áß¡ð?^õ3q/ozWƒû^`¤ÿ‰¶Îï.‘P~Ä>œ÷®Üvÿõ/P¿ß§í‹û»AY÷ûÁ—Ámçj°cl¨˜Š%Zûµóù ÷r¸Ðm‡3™o4g"M½YGiÉ´’n=íô;¿oPˆ§<ÒjñI™”ÅR{¡ä̵+óBVÃ-8ýºebabÓjÜ/MÀùæ(ŒUâC”•>DÑLÏ(°ÊlÂ+O–j½Ö» +üÞ`ŠOk¸Áûê ÆUšJâîÐÖέ’ÝèÞÌ„wYEÞÖ(™²Nb&·É&LK² &jøÙCF‰_}##íÞªœN‰ª‹†ˆfb/нì-  S:u°uSŸA>ÒþCÙüž±dRÅN¼š#tìgëÃr°ª\C´¤©0AeQC)!´ß+²œž‘U-x$… âIs.µÐÜÝü `Ýå| ß‚Pʼn?Cà Ös\ÇþS6.ˆS¹J s²†Íîí«À[ý$|´Ì(åß8ö0[ÖEíôÖ@î€û¾Û¯è ¬­õ|Ï캃!@9üZß ñjŠè2Jýá¢Èš"'N¹VY"?ô!™ï ¦¾e¯æÅ¢ž”OÄ«FkRB1À[# ä3öv˜ÑR f°¦u +‰ÞTa!±J¼µÒ·Õ|¨4Ðu±×èXµõ#´O*.ªÝR7òÅ• SF“Ú!¤†ÊxñrÏ·àWÛ ËúŒŠGR¤ØUUþ-ZŠ2t‚¡’Ðb+þUåpR­æDþ Y1/h¹‹·{A!cß™„E‰ü/û´ˆ‹Ä©Yä¤[ú4tF]öGût O¢NÞ¹OÃGsqB£.kzÛé+÷z î×ÙÌQ™“È«r>>kI ¸‹DŸGßIŠ—ùpÐ¥6jãÅ‘¯§Ñ¦5@ÈWo +ê^k0ï×”zCkPïÞî¨=Sd¤ŸŸìS]‰¬â,Vå>«r"ã$ѧFvZÓ7̦û*]ÆÜ£Þv´±Ÿði¨–”ˆõ¤Â÷wš»¥mtßµŸ@òŪƿ^nÁ5÷£Ýü´;”s‘àÜW†¸ç2äQÈ­yz¦Ý¥¤%¸ÓvµP$—2ýñøëÿIüÍn ë¥ ¤óŽuÇë9?5?šj9œy>*§Åi™tzâÀLU¯{\µœÂÿ˜?J¯ó‡›ÑŒnç$̸ÖiU‚ã¡Ï’7¦X%#è ‰‚IËÍú•Îɾ:ò,;§ÁFg\Ñb’¡Ø·€&FÜYÇgP‡ˆÀæºvülîz¢ys1+k+TVs’·h#7Ç 3b¾Í†$ËãöwcæÞ‘Q5ÚIØ+š4ŽÔgܤí?iÝIoû•(á·XÇ«AÄÑ‹Ñ~èÄj¿Âþƒ xendstream endobj -5005 0 obj << +5190 0 obj << /Type /Page -/Contents 5006 0 R -/Resources 5004 0 R +/Contents 5191 0 R +/Resources 5189 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4991 0 R +/Parent 5162 0 R >> endobj -5007 0 obj << -/D [5005 0 R /XYZ 85.039 786.531 null] +5192 0 obj << +/D [5190 0 R /XYZ 85.039 786.531 null] >> endobj -5008 0 obj << -/D [5005 0 R /XYZ 278.932 769.79 null] +5193 0 obj << +/D [5190 0 R /XYZ 85.039 647.502 null] >> endobj -5009 0 obj << -/D [5005 0 R /XYZ 85.039 660.869 null] +5194 0 obj << +/D [5190 0 R /XYZ 85.039 403.661 null] >> endobj -5010 0 obj << -/D [5005 0 R /XYZ 351.735 483.331 null] +5195 0 obj << +/D [5190 0 R /XYZ 85.039 232.62 null] >> endobj -5011 0 obj << -/D [5005 0 R /XYZ 85.039 374.41 null] +5189 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R /F15 3032 0 R /F58 3380 0 R >> +/XObject << /Im1 4209 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -970 0 obj << -/D [5005 0 R /XYZ 85.039 357.174 null] +5198 0 obj << +/Length 2550 +/Filter /FlateDecode +>> +stream +xÚ¥YëoÛÈÿî¿Bè—RhÈìƒ\’ŠÂqœ&‡kÒ‹]¤Åå€Ò%±¡H)Ÿêÿ¾óZŠ’èäÒ ¹ÙÙÙyüfv¥g +þéY–DÊæ³4sQbõl±½P³5ÌüõB …šÅ‘r N½¼½xþ:q3­¢\å³Û‘Ü.®Þ\þýöúÃ<´ÖÚFó0M³àõ\oç¡~¼†Ö3ž}õöÃõÕíûóÌÿâ¡Ëw¯°7@öæòõ ÏM\áú+\sÃÃWïßÝ~À©÷?Þ̹ýáâúv$lG±³(í¯?ÿ¢fK8Ð*²y6ÛC[E:ÏgÛ‹8±Q[é×7? \x.žñª „±q‘I±ÛY;(Ç&Ê »}Ø…ø΢èy˜˜$øO±ø,#e³îæ¡q0ªxÒ(eCeBs_å/’”›—«ª.OOš$² ‘œuSRƒ]@ÉÐôÒê)i]tÊ:‹â,áe§,“(N¾Êñ]‹ÖÚ³‰«¿&xıö¡ÃÍNôæ pMdq¿½‹m³bº#þq.»#ݪíØ=và*›’7ë7E]éË%t^0§$qB#D¹E-ºH'Ús\”¬ñEW;ioÛ¥´þ,–IÓy¢óŠAò“Õ˪+Ý®íŸàà„ÃXéÚ:²cè,DèQdžy£ÖY”&`{ Ý÷-D{æ²I߇CÀ¬Óé“lh‘6Üêc.Id³Yj!Ýà.ži娟#ßÐ`²4ËI”ŠÀÙ¯3©8Ï-ÏŽÚ$ça <»Õ³W-H4;eóÈÀîFùa—Í&\övÃn£ƒþƹ +îÑ_»‚4 $ïò¡ˆ˜¦˜›<èdASÒÔÒÓ,a8˃¶©¹U­ø ‘B$]Ç=-èzî´³çÚîxtK2Ðß;Š×ÌaÚÕ¹Sî(0ò4X#aûp=7H@ö<»lyî“Òq-"·ˆ:Ûq«Zöe Ü“!öD:§ˆ—äGŽœë(…|8öÊnž .&dÚó#A^7NŽ„ÁC*g­JÈV« õž%:9GGñ2¡) W2\ÜÕ! îœÍXÖõ3iÒ A)ËSgþÀlÍÑ+,¶<Ù‹» \ÐàøŒ÷®¾ˆEÍÔ.'^àÑðþÕZ-è–ÀYç“JÔ€»úp™“Ä÷0ddô’fyÞ”2yê ØUêWb“ +æ¡´øpgjØ©qa¿}[ +üt@"lËu¯ê„UXØßÓûÃ]]nñuÁ!‚ ζDw“-ùŽêË ¿¯ðcÙÊ.<¡~‡LÇç;ÁfäѱNG÷ ¤ÚM&ÇöÈ'pAÿسé·<=z‘kYá9®ºVè(=i‚)ì +àœ_¶Ár‘ÍÜ×/Û‰ŠìpÙ Ioí±u´3Fv‰Áˆ½BÒ.R”Wb^'J‹O”ÿxGûÿÄž=ܘ`¦ì9Ím{V€7(Z:Kè6J„mÃßÁitÌO¥üRŠ]y—À枊,Ÿ pdd7 I]8f…µTA_Ê°±V_¬˜{)Òœé.r*÷z_Ìb7[‚ +Ôë?õÜø÷²òZp.l¶üurù0ÚD©5øÚ‘G.û=Fp—Œ'ŸŒdæðîj&®*ˆÀœp)›Â=ί t· •Gï•ÔQèi-Ø…D;˜:¤!á<€3C¨àð‚ šbw¨õÉ/MG0ù‘Ť´;yá[3DÜûBQ¾C`ÚKigÏ~Jq‘õáüÌÛ­endstream +endobj +5197 0 obj << +/Type /Page +/Contents 5198 0 R +/Resources 5196 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5203 0 R >> endobj -5012 0 obj << -/D [5005 0 R /XYZ 85.039 312.099 null] +5199 0 obj << +/D [5197 0 R /XYZ 85.039 786.531 null] >> endobj -5004 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R >> +5200 0 obj << +/D [5197 0 R /XYZ 85.039 725.56 null] +>> endobj +926 0 obj << +/D [5197 0 R /XYZ 85.039 457.426 null] +>> endobj +5201 0 obj << +/D [5197 0 R /XYZ 85.039 425.209 null] +>> endobj +930 0 obj << +/D [5197 0 R /XYZ 85.039 369.196 null] +>> endobj +5202 0 obj << +/D [5197 0 R /XYZ 85.039 334.754 null] +>> endobj +5196 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F59 3455 0 R /F62 4159 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5015 0 obj << -/Length 1838 +5206 0 obj << +/Length 445 /Filter /FlateDecode >> stream -xÚµXÛnÛF}×Wð‘¢ w—×¼¹²œ8ul×àIÐ"%³–H‡¤lèï;—%EIT›&) ƒ{™=sfVÒràOZ¡'YAè OKk¶8ÖfÞ¤Y12KF5¿M¯Ï<ß’ŽˆœÈšÎ[9‘#¼È·¦É'{üîäz:¹Ž´Ö¶tÅp¡}6”öùp$í‹ Î(ûäò®}3©1N]AãÆŒ^\?¿|;ü2}?˜L[­:zK­Q§oƒO_+ýß¡£Ðz¶#dY«ëiá¹Úô—ƒÛÁ­,žs-ÞÕçO‡Â õ¡¤×ãϾ>;Ò]‚5)šU¡E¾½,†#Ú³¸¦ÑG=»Èù›Õ¼ª~€m±éÄej3Ü2cqUwÿ¼,V¼¦ ­4WòÜ]–ÃHR áØÒ"°¯gW¯xÛg‹5wV1ö6ÜÉÓ41JüM`sVÅ÷K£Vñ„F»†*°+¼0pÞH¢o#r›¨»¦¹vµ©Ø+ÑlQpà"pËôæ\ÏC…Fžoÿ…Ç”˜e×ãÝåi^­ËFDK,fÇAåé‹¡´®ÙÅ®Ã9­x.ãHâxÃY†®xVe)íDv7F Ùè0¼r Á·'âe¸+3ÜENS-¡ŸërÃ{M7݆BHüÓ{¬¬1>rØ•ÍxjÙå <Œ ‡‰‡¸âÆÞmsVqD”Qÿ ‰€ŽÊqœ”ÍQwNG[B%Gr€ 2âpþãPf¾H Ù¬,g[óDoÀøå;âH±àyR8±ÿ½X€œî9^o±–‘Ýã5mr@ ·hµÚ“ÒUn … T[Pø®%¥ˆ®s Š)W‚Þ:!L k/ öºtÏJ³Ú”D>J´¾Y`±Eš—tÚ¤üÖ&x}¾’ÖijZMØQG.—>a§ô‘*~àYà5E\ûà%mÑ⺌hi¾3ÄÖrÉS€Unjˆºn33kÍ3Ì°z’Ç°ª«§=æ ¢%ŽØñLxÃsˆXad½-šPbÁß$«F=8Žïq«ÁînÕ.ZÜÁåÝÏœm*Γ†`ˆ Œ[õàÖ±]S[0 /2‘F¡] ÈÀÔµ[öL¹CLˆãÅš¸ëMèQO}d|i¦‰¿á›fDüà%uúèüÛöfê:¯äß!˜Ø`[¾ÁÚuZ5éÆ[šš¸¯×m‘Õ©cš´ÀÅŒ‚Œ`¤®Èø:åiúe Å2²Ö”ÞH<‘˜"›—ybƒ¸£òê0ú8SB¦é¸¿Í;ʾâ+wtî»Y8wµ®ÌK}ç ÆiÔ¸±6ªË£¬5?‚;,úE 5“r[ÖìR´£„RÒ’¾§þ_Ž†ó -^Ü0’–»L½ÃÒæ!—Ǧþ¡ËûmTÚ%i¹%i–n¸ÿ~Ã_³ºáë½´Ñ(t -å,/ ɯЬ“>vÓÒÕzR‰ö„Ë¿îÿ¸ÿ|îOý†¸­ˆB ~Õ_y -à$[eÐPéhÜüØx¨òßý°.”endstream +xÚ¥SÁnœ0¼ó>ÚRqllÀ·„4‰¢l ¾Tiìâì"hÁѪ_›í6E½T\oÞ óƆb +DŒ Ë@*3 +ö¯ƒ| +¨Ÿ €c’Äú(ƒ«›8”àŒd@¾Ì#²y‚ùíæ³,J2Æ e…i*à ¢ð…>¦úàÐ뻲Èå¶D‚Á¯®µy¼¶‡•»Ý”…o£HÀÜòs˯*×η²´Ðö¡BÏò>(ä…Ùcž0ëöGðôL@cºf™'SL³ ¼> endobj -5016 0 obj << -/D [5014 0 R /XYZ 85.039 786.531 null] +5207 0 obj << +/D [5205 0 R /XYZ 85.039 786.531 null] >> endobj -5013 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R >> -/XObject << /Im1 4096 0 R >> +5204 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5019 0 obj << -/Length 2207 +5210 0 obj << +/Length 2231 /Filter /FlateDecode >> stream -xÚÅYÝsã6÷_¡·“gjUI}ôž’lv7mšô6¹Ù¹i;;Š­ÄšØ’W’“Ëø!J¶•›ëÃÍNVüøiæ…ðy© BžyI’3o¹…ÞÌ|š1M±Ð$ ‡æü~öãG{, ²0óî-Ÿ, d{÷«ßý‹Ïg¿Ý_~™/8ç>Á|‘$©ÿqÎü«ù‚ù×—8ùg7°!ü/—0uS·Ðø¢G¯o/~¹ºù4ÿóþçÙå½ÕÊÑ›qŽ:}Ÿýþgè­@ÿŸgaÀ³Ô{…v°,ó¶3!y ×ýÍìnöËKÍ O­:fC ÒÿBXF†ò¨¸LBœfC‹B`£ZD=æbÝÇaIiÝ ± ƒp ¸C00S”RrrËM ÖíÐÌÅبš:Nì’8zß=„"˸"qÚ¤|¿'øñj˼5¨é9šj¶ ‡/iÊR@,Ê‚8‘^œÉ N‚î×sÔrÁYê_V9t6Å-ª¾ƒö¦ž/¢Ô_>·Šâ%ßÀè^Ó/ëꉧ}£x0_“}-« ÕsXûJ㋇¼-V8› 7/E£ÉÿeXV°`‰3›=´VÔÒì0K|ô¼@›¢‹"&£m´]Þ•uÕªH ¸±W6–`Þ-ˆdj «Õš|³1úbW‹£öÊlù¼©eõn¦IÔ›nS%ÉíÊ¥Z60.©†ã`Kêk•pm0†‹W1{ÿw8cÄ°0ñ¸,ûkÖdž̂ò”Eœ¼u/ss¥-ºé²_ÎõA2.Ý•Û=ØÍÉVºîxèrÚ™f_ôf>¼Êp³£÷J -ÎY…ÓµšC3BMô. -'ö(I<ŽBGâ [¥1ÕjðÁ´@×\h+p¼©N_t@§OSÐQé)Mú †¶ëè/ß*Ì5_ò1½ôh6¹šx5ÁQvšÉѺPßýz¨–Š.ËØ–ô‡¸kŠŽÞœŽ•¥P%u}†E£ŠÛSøˆðe5Ž&ñáМƇ!zS->ÆâÕ¨ìÈåÉ,…Á¦J> ‚"Â9ñ*è7ý’&¸@Ǿ¨õçƒ4á,‡á,mìS›ðÏZ}%ig¥CI³¿UKxÈ«¾2JyìˆÓ Yד|#æDD„v\€êñJ}-ž¢¨ßæI(xIù‚NÎ|ïfºÈTáÐpÞOÍé×#JžQ8>s#} p)II›ŸWjf­ZHñé')g{ía €NL(ãË%vtœ”êlùO]oŠÂúkL3Pk^mêìªu.'5~uÞÇ×õÌ_êEeüŽ4ùêÅ#uóͿÄ -®šÝ)•ÔÛ35ËcÇ–ÚÞË\B¢¤Ú{•wEÿnf ‡ -ÒƒÛ›S-åíÚT×M‘¯ùþ×ÏÄää|2Ãp(:£t:Ãô4ïQèüØ`øÀÕIîL"ÁP|-¤ ý¯sŽ{àP9ЋžÍþqâßAV-é2 -zñìsdí)¥µ°I¥{Rš’TQiOfúØd\|þåò_ß®o/ή¿ýzvñùêæGïÞÚ®Øb‹\Ç€q üw±oš¢ê.jоÞÜ-S[k±}WÛ¼úZ7Ïz÷8ø[ÞäÛ¢Ã_ïÂ0vÞYÿÙ·»]ÏùeÛ•Ëëzù\bÆa2‘þ—ËOß>|½Å_ͨ‚½#I1‡_vcŠÇ|¿é~2ôÁsºkö¤' -~ô -Êé×8ç%ÈÒG‹ŒÀkÌ*CP‹£±Æ’§Lù•ÿÝH£¢endstream +xÚ¥]ã¶ñÝ¿B}“X+’ú|=¤×^л Y·)ä–´¶p¶äHòím}ç‹’lËIÃ+r8ç{hå…ð§¼,B“{i–±Q^qZ…ÞVþ¶R‚Å&ˆ£Æ ‹·ºItFéNèmLDq‚‹ï¶«§÷:ôt$‰ñ¶/„´-ñU¬7qúïëµòÕzc’Ô·0nÖå—8OüŸª¢]›ÐïJ^ÿ¬·0T~£Ïu³_ÿ¶ýaõ×íüø(Õ#Ö¢X‹FÖTì©0ÈÃ|ÎÚ Ð†"m|ÛUGÚµO +äÑ^Òã¨ê{è¿ËNn„ „t¼ëd›µÎü7ž5Õ€³×µN®Ãp[žjä &ÒŒ:;´]Ï«µ| Ø]àîψÝìA © +ýí¡b” +÷ø2(WÀþÛüuÀ¢dj6'œé»cuQ›ˆÎ4Æø ‹²>¾ñ¤úR—3Ò9’Fd¼p×ÊÎ¥óµbNnGÏë-òôÿU“EŽhé­Ü~W° l£ê[ֶΓ¨¹!‚Ù™(¹1D…¦åþ{4µÊ—nälÐ6b|益ú5T©¥w¼,Ù +&¥þØÈží ¯½ù˜4‘³(ÐÊñô,ôí‰ÇƒˆÏd°lO2:²OŒÆ€$À/hGO¤ÄÔ0ÑhÏxüÇgþþL–W/¯‚E;ŽuÅ4X}=Ñ)+³„WÚ<ãÕÊŸYYL¸; +tþi=é0üʦÀ®Õ‰yŠ=ö-/_‹,p'è4óŒŽ O0qâ>Ðíé}œÏTeAžÇ¢ð«nä¤HØW +4I U"Ø‹lűøZQ‡ºÅ{Ù#ù ¬ìÈlɳ!’ jRÀØÀâˆ%=s gú=ßÂ2zg›}ÅCtcü¾`$j +<[øÕ"õN„ –„bÚ@ÐJ]9}aÙ×öm‡wÿ/ ¿dQ_HU“‹ÖëɃñ×™Œ¯uÁä<Ãú™Ì”‚Ýp™Å81L“ij¸–a|‡…=/¸3ahù3†Ÿ¾FŠvÇY$¦ÄrF¦È›MA¤ÐaŠYD²o+¬Àª†Œ·)„Ç$X`þ«® +¸uRT9¡¤“ê^貧Qé¤b! Ú»½öŒ‚:Ö ¶$¼sn@ÎüÅ»ç‹ÉcÎ`£ËBtK æÿ½wT×öõ$ƒ0# ÒMñ¸3_¤íH„MíRݨ«‘C¨ «ÛxÙÍQ_¸QWÍî4ÔÈíÀ„P'uTïP†)[ìkA‡¦¡dLÀ€&4;öh!X2ÞÿðFå—5g¶\”à]¦œR©™âÕ¬,«Åê›1 JØ\¦$?àd9âÕßc1Ø1î¿>}øøÕ »}‰xc`‰·3#ôú ˆOo€€ìêô{N3~Á%¬E~¤öœÌ3XÈÿ^g߇øñCglt¶?_UR¸2+æøa¶b8T'<8Øùó BzqjD²”Q„½C9È ±ÃüQ@ç!SÌž_Á¬±ªäê÷°Ìq´Ô_eÒSºg@:NίO穵uŽz_~ä *È Pzi•qÎ5ÇãЭ’ø–º6”B7?¸ïÿ@EÛ¹endstream endobj -5018 0 obj << +5209 0 obj << /Type /Page -/Contents 5019 0 R -/Resources 5017 0 R +/Contents 5210 0 R +/Resources 5208 0 R /MediaBox [0 0 595.276 841.89] -/Parent 4991 0 R +/Parent 5203 0 R >> endobj -5020 0 obj << -/D [5018 0 R /XYZ 85.039 786.531 null] +5211 0 obj << +/D [5209 0 R /XYZ 85.039 786.531 null] >> endobj -974 0 obj << -/D [5018 0 R /XYZ 85.039 232.528 null] +934 0 obj << +/D [5209 0 R /XYZ 85.039 766.606 null] >> endobj -5021 0 obj << -/D [5018 0 R /XYZ 85.039 200.107 null] +3150 0 obj << +/D [5209 0 R /XYZ 85.039 658.638 null] >> endobj -5017 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F35 2976 0 R >> -/XObject << /Im1 4096 0 R >> +938 0 obj << +/D [5209 0 R /XYZ 85.039 603.448 null] +>> endobj +5212 0 obj << +/D [5209 0 R /XYZ 85.039 563.284 null] +>> endobj +942 0 obj << +/D [5209 0 R /XYZ 85.039 191.425 null] +>> endobj +5213 0 obj << +/D [5209 0 R /XYZ 85.039 156.114 null] +>> endobj +5208 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5024 0 obj << -/Length 1731 +5216 0 obj << +/Length 3297 /Filter /FlateDecode >> stream -xÚµX[sÓ:~ϯȣ3CŒe[¾ðVÚ…B943Ì`ÅqOl+øBÉ¿?{‘7MZÎÎ0Ô+iwµZ}{QÄØbIÛñâq¶ôÄ8)FÎøV^„ᘖé€çå|ôü• Ʊc'ÏW½žØ±eŒçË/Öù›³óÙ§ÉÔóºýÕëâ5ÌRÇ\ ½È–‘÷ÐBñ”và‡äƒËr gÉÕ¤x°z2u¥°îÖi³N+8P<['q‘H•&H7Ú°ÕkÝæ\¤a[“”ké-Ln-]5m‰²u“%S”Î5-$ø³Épí–÷úêH‡$‰#BŽÈÚÀ¬àuV˜V+V¨K¡8ÙdìMËõ§2zŠ7Þš -tfL§/h¥DÝ °|_Zóu6!Wàõnn h‡´AŸ Zj¢v8ó’§lK‘‡ˆI-ð©aÒe¾cªÑüÍj“ói3à­4K pA*ìSØr};îã1±ç!<¸°*ìXÊ‚8¶=cÂAX.øBÂ5Þ¤ÕO:tÖT?Ñ;èSœ›•M•¥õ ;ÍY8à! ½!b…ãÚ®+ÆYLü*<ÿÍ»Ùßß!òή¾¿?;sùa†³7»ºI ¤è®Eh‹È½wáçmU¥es®Álߤ ‰Á³$­‘¾Re¡J>5Ž?ªJxïtDÐetº¡íĬsVªEž^oslð¾d(!U¼þ~ñùsð¦+-ŒüŠ#X¼HWªÍ›}0 šªM ø sн9¾gæoLhP$d_áwa Æù2Þ7(¸‘ ¤Á±1ºE•CôÁø%ÇJò,å`1bdl9^hëí½°5ܺÄÕÈB›òÔ@{¹O·÷1TU) *cbv["öP>Q&j:rÛ"g,ÈçÏ7ŽÀD±Æ9ŽjÖô \kÑ6H8À€Óì–%_!a²¥¿I¯• y*7ìš¿‰¢\ˆd®k¢è†y½O­´´T¨X±ú ¿µ.ŒqTv" ]þÑÕ¦~6ôˆd‡P -ƒ”ÛæDu)莂);¥d¬ú¯˜¡L;ݘ»aq³ÏG‡úˆï³ò*+7óu¥ÛÛõýúXl »ð›•«¬Ì0#âh±k)HnS=ušh([O…ódÀ„OŒçÁ­šÛñ¼Ø*¨Heº¤åʃÓXøà¬8¿¢Ê‡†/á fû`BQ® 7¶vÝ6)uÝ}8"% Šª”«ž1)3,³Ñí•â=i Ê%³êmWUÅVR‘æ²tœ8·Â#šjØ &¹Q£—JÓ! otù»¨Q¿5i®v¿á8ÏÇb£~ÁŸAGè›k³ -õ qYmaV²>^aôðþarE.ÄUþä¯ –à”ØM"3¥„z{¹:X«yóôw9b¸c_iLr£=¦º¨·Ü?Ìý}·Ìº¯öÍIÍ—?@˜o]>¿æY5ïdûwY]ÿ÷‹ËôË*U›Ï*;•’Ä!Ä¢ /Oþ xù¡è“ÑYÑQk(@™î§Nd ä!È)tbc´îpIñx_Ù~ÍË—isx§´§f.Uòø QÀ8¿Ø”M§ïG›Ö}Ä7D½9b,»2€ˆiÎÀéÄôù0&TZ[B—ƀȴáÐ+#V©z‘Aƒaƒ¤]BuãØúÑÒ“ˆÂåù8Ý1Äx§¹ÿ˜ÈÀ>#i:$Mp Ah-Â=1-A÷f0½À©W€€Ça{¬Çðô¯ßöü`ð -®k 7ê^Ž['ž¹h)v¡æÞÿ1ÈÍBXç9+âl·t ' ØðG¼ç9ùŒ|xpTSVŒÈ”ص8‡ "†rQž ›­q†·Ì´6šúšbY 5wåmÍ Pm }ë[ïUb3PC™8¹^“M_Ô™[NÔ‰÷Ü($=,+܃=JüÛî‰Xœ‚’ɾðøæN¿²îŠ-‚I}÷û§tÍVj„¿oIûVÃçŽ hE»©%½uÉ:Óûrʦdn¶è»Ø]Ž ú@QõâV–xš5*€Ä' ˜.¬+Ðt?Zþ×LÐ7ü””‚’xÜbס®èØõüB¹=Ø…Neü¡Ž‡Äßà8<Çf欩<] ž³ÿ½“y5­db5=$Œ]X’±ÍB†ÆÏoßü“[óöÇkƒÚü£Û?0MÛ³âp+9ü°wKftGÌv²ÀË#§ìÙÛI=ð×$Ë„¶pAæÑ•·ÈbÁ#½ÌFµnÖÓ`-š ûÒXÝž ™âXÇ0b×ù´7­NxÓ·DMfçŒNÂn¥WËJØÞ‰»Ë +»èF‰H6käœ\«-êœ8çÚ7Âý:^”Ý¢áæàÍxL+‚¾XódäÓ5 ‰ëAøCF¡$ˆ<'pnhð,nðÊäcFØ_îØpQ9Ô4!‡ýã(ˆ3&Â7Ž´y3Z«§Y«GÙÍ‹c±ö4͆· 8Qpßžçµ´YÐìë‚Ø):N€íAè‰&ÃCY˜R4†ŒßYD "BF8Ð +¼­-Za(Ê°!tvúÞäÆ8üÔÉȺS¼üˆÍ‰œ9ò‡¶A(µªí·/¤³ÜpßüÎ*•¨ßŸ¤Áµ{mð’Šß-%€0ÊœîZM~ÚŸó~“H «Õ•©˜ËCØ#¶aK²Þ©3±t FghÂŒÝíU ŸþbͪÌËÞl ä µyË5wq>È$i [€Ó„Â;È”=’$St”Òž;;¸UGéȪƒ$„Û‘1kp¤¡z`6ÌïQô§ž·Kå§2导úÁˆŠ|=ô†(†’“ÜT¨ì?€5ÝÀK&œ!Κ€LÈÙ»‹ð2 C +îÊ£¨3ºFC»-ú=Ú`=2~JkCNøP©9«Áœp]¹‹@¶¯FË¡E–£Ü0æBËmê¨rpà¤nö( '÷KHøO£1ºá¡/ˆ/oè®2Ì+9‡èFz3'ÂÞR¨DL3®En”(1a¸lî à·Œ|’ÛL¦Wn–¦6Ó¯B_ …¾× ß”€‘ÖnϽƉ¢fýÀ1)ƒo·Œž¤ +:[" áô*A‹3!¢»J"jàenûSCÑeÉP¥è‹vWÖ÷>Òý&È1®ã*› à«sA'‚´°±o%p~Z@ôÆ l½&¡ÌFóJ2ú}Õš%®EwãK#rG¹+{ÃÁ1¨,Cr÷øF†¿wb{§9Zw÷ì¢ TØÔØTâ‘ɯ.ßþr\ÄŒ=7 !’© rýÔ¾–©ÜPų•L±õI5WŸ|{ýör.eÔbšó™ƒ$®²˜uî`êiòîêÞ_^¼úÚ¤Ï@}ƒ||ÿæær5Ä6E"²D ³©À‡mÔGI 'Çñ78ÊÅÕÕÌAü,9¢dõL] <‡oØ`Dƒ©xTÿ¤@QêŠW{·×*@‡Ö;aŠ‚½§0pÇñÞf6Ì]ÅzF®q "~B®+?NÜÔniÿ§|“çäûúå‹9CaQ3‚ÊY ü'ÃNäÆÁ·0‘Wמ7‘S9{€ƒ±¹¿1>?aþ³Än@·ïf††íýÐ \0ÄTQä9×|[oð‚ÞR +Û×û)Are1G°™8W¡ctkMœkýŸËâqæ5*pU~Yå»pà'ŸŽ®lÆä é¾àmÃY0 É‚€0&­0¶˜’‰SÁ„³lÝ£¹Ÿ¼€#è´¶fmyaá4,kÙ’ÿê¦f8ò´6愦–_È~"E _¼Ã'Bâû4ë~.5WxÚ⮄‹æ°™:\š#Bb€^L€FÊO¡àD”òƒ©ŠMèL`JSÊ<ƒ¨ðx¬E‹ô˜XÄJpmð›½YE0½}—ÂÒÍ·–áÆjF6;M*‰ŽQá3‰o(fÀÙ±Å$\Ȇ€>šck,]¹¶F4M=™2-^¢k%žóŽmÈvwöu1772˜GæÛõHdI4”g¡k¾©y`) ŸÞX¾ægK¸C4rÃ_~&wÓÒ²‚Ý÷'!)rÃ(\¬Rˆ'é¬37 G§à¥Ðë•Þ¿ßäL3çß'¹;s=åó:Ïm1Eø±oæœXˆè†W"Cf«Q\á8ª(…¸1‚*¸Á +).”Fç%—~­U«'¬¯—º/ê|¸×Mdžfn¦²Å*ôÜ8L¾Zèm¬7%nŒã`b[°-ÒCzªÜ;ˆþ = •ÊÑåÙˆv0áñÕ|^ƒI“BŒ”^ª®fºêžÊ©‹Þ^ ÈMïÅPÙèD›‚N¹ÔìúôÉJI¿Z)Wxrs+h#~V€óìËÚˆ¾Z&ÒàcÚs6l¢Ç쳓š†Ö¹T5Hð Q­àÿX¬2ß……èïM<³ÿY0I°(D[òap.¿»qb2®„Ð÷á+à"¥|×{ƒÒ%?g£¿8€v3ÌèÍÁñÉ\¥Î+{#/í³9,q\¶òÍÓËQˆYzè`(ô¡]xá{|*\Ó·—oÇ”öÊY¸,€-y?>¬ê¦>Ùaô(‘k*MbïG~±pë;;š]öM+[™a›#ç_d¤ëu¿—öPA8~hê|?ümÃØvOćU¿ïH(Ì»©’?JU3 +ùK~á +'nÃÕ5fŽ¹æ!@´Gy|Iè!¤¬ ùâ‡4Ö†„K>ø½¶Ef^QõL–5–ï«ÔͲlKÿ·—¯'ÿêKá d|‘ûrìðãø˜Q?vUNãÑs;jendstream endobj -5023 0 obj << +5215 0 obj << /Type /Page -/Contents 5024 0 R -/Resources 5022 0 R +/Contents 5216 0 R +/Resources 5214 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5028 0 R +/Parent 5203 0 R >> endobj -5025 0 obj << -/D [5023 0 R /XYZ 85.039 786.531 null] +5217 0 obj << +/D [5215 0 R /XYZ 85.039 786.531 null] >> endobj -978 0 obj << -/D [5023 0 R /XYZ 85.039 724.712 null] +946 0 obj << +/D [5215 0 R /XYZ 85.039 401.652 null] >> endobj -5026 0 obj << -/D [5023 0 R /XYZ 85.039 692.291 null] +5218 0 obj << +/D [5215 0 R /XYZ 85.039 364.785 null] >> endobj -982 0 obj << -/D [5023 0 R /XYZ 85.039 153.609 null] +5214 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F58 3380 0 R /F59 3455 0 R /F35 3036 0 R /F20 3021 0 R /F64 4225 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5027 0 obj << -/D [5023 0 R /XYZ 85.039 108.535 null] +5221 0 obj << +/Length 3554 +/Filter /FlateDecode +>> +stream +xÚ½ZYoÜF~ׯòÄÒË'mýáãÛ¿}øéÛÍ7ß_½»™ì`îÂ8À>_ýö‡{]Ð.¿¿rwA–^?Ò»»ó²ìútFÁ. +ý®¯~¹ú»EúÂkµrÐm¥»Œú¶»KÓp&Ú…Ma™á»+Ìø¡üRÖt,N'tB:æZjðœý=ÚcçßËs’ ’(•Ù׎& {ÑÊÂ7Ç’¦N|§£ÅJ,[ÐKÕ•{¼m‡^Ï鹫ì…v8惴G†Öß]/¬õýqã§N®äíÃfë'2{3.Ë7­Ê4aIt¡q6i¯ßüLZ)Æ—0[ŸbŠ[] +§¼Yµ¶ÀÑT–Ñ[âË¡’Ú 4ÑZÆ>€xÉ’œï€?j¥ÇÎðNFZ“ Í·8úhæ—ê° #ªQ€NN<ŸáGà%2‚VnÀP +‚Ó‹UˆJC/£¡?Š›$:V@™ZŒçy~™x£â¥ëm#ëeØ@3ÛJ2Eý‡59šÕ*ø•JŸS÷<óCÕ©bѳëä‰ÈÏœÙd&|%3YêŒûF³uz +£F¤qjÚ»epºÍ’]'t 4ÛÅiö—£cÿÿÿ,Š{Ç. ¡‚Ÿ®îU¹} +KryÐ.­Æ×Ú¼%ÓÀj×u(&*­÷–Áû©“9È`FIêk›úÉL7‰Rr¶º/“ܱgìÙ +6FâÎì·~.J^¨2ËùùHHì"×)«lËhi­¨úûI,Ek*b‚;@½Õ,Œ’hð9E‹BÊââ?­gï«Ú®è”êÍ}AѼY÷óŠþ7EûFl¼T«nÚA^‹š³¥1E97ë¢T÷¨íÜ‚p‘í¬pÎßù>q.twq˜þiÎ}4>‘×ÿh¤á.öý¿`¤?²«®ÎPòwý¨2Æ?/|õJh=½ÑFÞ4óK¼Ü +ÍFµÏƉ©s´ *D$ CòL,Pî¡«Û‡rIÄݹIÂ7Mø„o‡úá m7ŒÈîhDð!'E–½tIÆŽ–"i?6^*žmµŒ+dœ d6MÂxj™èâ“<™Pž²dIÀ,ouŸy£Oà«H%üàxZí}ó3JA»§HeWä EBõ»Afæ³Á#—tí ;ÉB¡k‡.ò ¤ Ê ¡X¦N}{Ç»é}ªzôyÁi.ÚQ#{i2\‚º2wšÏgŽ¾Òd½ /óà?Å¿rÈáO2=?ZM ¨]’¢Hƒt~ò¾ÏÓä¡\âÎfœ0ŸýS/@z2‹›môÕ‰÷ú$Ÿbrm_ö2ð…9!YäÁ8HÞ‰¬/uå΀¤•Y_¾5Ò(?ŸK[;Xx?ud·ß4›e’®£ï™ €5øõû(›A—”RÞãLJ‡M„c8Ë%Fî˜E$H Ùß#8àùfPè¹ñÎw3D6z/Ó00q&¼‚íz©ub›^us§Ï„M~‚Mû®#á c˜îÊ|8[A ‚ëz¶Hƒ‘:Ï¥Pß®TUÀƒPÀóó"p#•Ô¯¶æl3©NÒLÓ8Xw¥ÒÜö†…Òhrª„n±F€Q®?IùÒeÑ Ÿ¯s*Gë|’¦\ÆÁsÓº8×Þà5ŸÆêÝ1o*£}'k Jøwõ —Ú\°ß@¼ûÎmn ±TÐ:¦T¾Ó”ƒ&b‰¤W3Tèž2Àü ä’â3nø£ÑÃÙÄÏÙÞéóÁú£3ûUQ[µž0ú¦*ÛÕ%¬1~ç·ŠUƒØÞ%ÚÁ§†þuƒ—x ÊV¨fVj+ÔÁ® ô.ËE=/a 5ië©°¥ ¬c$¤EPZTÁ~LtKK÷6žÔ …Ìêäâ°+ÇJÅšç!×­8 µ§lĤ’ìƒÂtÞåV ]>¡{î RСm…z aNcRNÑé½5žSmwMü¢“ðû™qÉO¦p¡Ä­î~”EO™‰Vð7Už6æŒå‹,ÙJ¾ý¹ îÖT hõ&ÿ¶HvÈmѤ˜×zÓñ¢ÅO¼9*K“ ÜöUÏ!¾!†³QþâT/ѲûÉ«d~]>´JÔ›Rh{® i’|«1Ö!©sIYÎs%qO稆ygo\&0×è“ʤ§” «ÍO-"tˆ8]–ÑBWį c/”·ñ1^y¸(ÜÔsÝxÔ4?S]=)¨Kjõ$c8è$]ff8qL†£ý'«°L–ÛŸlNw[î-@¯¬Ne#¡º”NA¢ÎŠV²PQ?è ¬è7¨ÆH¬Ë÷ƒ «iÍB.lu;"á/ÛGs2ÇÍä—¥²[5²%LÛÒ"w˜ßòfUœuœr4=qQb‚§ÒÀÊxë[Mêáš(§>EŽ5þ•¹\ØZ›j­fÅ®%ï ‚e!Ä`– +fá™Ë£®GQÃÙ…F˜¦›¦Çz7’åoËæÈX¼7#ÍZö&2g>wŒÍ^ì|¦{ÉlÕg²¯®åÊ`?¬Ù6¢ÌYAÔm»šâ Ê‚¶FtáλE~!!úY) –(z˜6’䜟/ÁªÖò0ëV2z‚Bø´Î#Ê/›Px–KKôóOˆbüBâ’èZ£U§„ñ4oXH•ý\éæËNä§ZZÌûfBÂd’ˆÅ/çª+@Ωç|âEÕ3WL;óA¹V,e’ÍŒ¥ÀXNNÏr•HKž\ûŽVvÉ îlBó˜æV·¶¼«í¬„ô´JHïe#Ç—e +-¼}.sˆc)ILÂ7®'£C.WÑwYx–¥Ho/*‹™`¬½2ÂøÜLX˜œ°{ÛÝë„ +²²Ù‹Ìd }> endobj -5022 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> +5222 0 obj << +/D [5220 0 R /XYZ 85.039 786.531 null] +>> endobj +5219 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5031 0 obj << +5225 0 obj << /Length 3169 /Filter /FlateDecode >> stream -xÚ¥ÙŽÛÈñ}¾Bo¡€‡÷a |í®÷°{#Ø]lZ"%C²µ$µãÉק®n¶Ž?†‡}TwUW×Ý -ü Eêq¹È‹ÌOãp±én‚Åf¾» b% +æÕÝÍí·i¶¿ ÊÅÝÖîS~Zf‹»êïõ÷/ÿ~÷öãrDZ&þr•ç…÷í2ôÞ-W¡÷Ó[œ‰¼—ïß`#ñ>¾…©×8õeô§¯|÷þ»åow?ܼ½³T9t‡qŒ4ýqóËoÁ¢ú¸ ü¸,Ðü°,ÝM’Æ~šÄÒoo>ÝüÃîÅsÉ‚W]cA~ZÄ—<Ó+hñ´¯‚îNu`¹‰ C3!…Z¢„»šö—6ðÏaKJ\YA‰Ss“kØðØ°NÑ°Ø8…›T?nëÚÐñpp/îS… tÌÅi Ì›÷³ô!Œ>Û®7‡}ྶp=IYÂõÔƒÀ;‚mÖÚù†pJµ ™spxâ½Ö]'6!Îrïí0èexàž †wy– ò¤_Ë‚Èr¾‘wb|èbu'º>6“Q@œlù²ÈàÞñĉàQ¦Ûº³Ð°øˆR±UÙL™qBÁŽÐ˜<™RaeÊ•0‚l’<í4‘!ƒFKÇ+F° D~pŽHJ];Ô¶LŸýߥ.&½†s¢,¦å©Y_¯'nÀéÉ_oÄ¿!4€Ã¼â¡V3*ê¡¡-kŒ(ð^â¡hD²1)ªÃ´×G«¿0šƒ˜*tôY {sÐÞA\8wYØó2*kkÈ»+ú[éÙû‰Vº·ýFtô¡i[£­ÇQ&ec@½&«2(º”±3î³ðd¹rT™#=Õ Ð›ã8%FtÕÑË)¢ÜD?°tÁ…D¥¸l²:*Sº/cqæÑJ£ŸP“å°H< qDü€¹ -ÜOñ‡Žs¤‹ˆµXмÞòw£»C«È.¿îÍfô£’½BF’zjZcRº…`Å=ØÔË{>p  «+c–%6øÔÉUÛ›s®'¡8 ƒ%IžÆºvƒ wñº¤ÄáS-6¾©fY'e@÷gè5–‡¼’4¼xÂÀ¦AâGIú¬…u`ÈÄ‚åŸMl„~Äv#‰òs|aùEZ<‹ÐÀ\`<1êaùq`|× ³‰)²Gé^â›)®š8Âi7úâÙ„…|*ÈL³ÁÙ쪽¤e¿iÐô(«°çZl2®x ›»g(‰@ ž:ÐÔ4œÌ¡Všº7|iEBAB*´•)D’ÆÚQ4™•ö«øó/H]!ìû7÷6šÌjÇ>·8qaq˜à¦gè ƒ ùó'^ð™´©âHB0½¿K¸AVæ7?“ìNb£ñʉ¢ øÁù•U"ìŽõpp¡çŠ2Îüx°fHrzð=š˜f•ƒ/y7ɬ¬kº³îË&0oÌwðêdbÔ[“ð;dT‘¸´ÍFD Q éÐÃø—+§uü8… .F»6îÛ–×EqÊfP8Eæ¢&èâØUéĉщ>JŒŒ£VÒ­n[mÏg -4S¤Š‚­éù[é#ÊÍô :'ÉùGµ6„h’n7nºvçt:¦Cc†å¡e:¶%&š]€«¾â†5ýHŠD¦Þ±„Bü"ÍDn¸’˜‡[¡—ÆåÌtŒo°g¦-odÜ'Ûô†ÁÇæWŸmÕ¦mj×óŸ†VçA~_sÄÃqƒFµ£~*„O‚Lòó!¼ó´M7@_³éÏ!´6ýãU›îb|Soùì¤Ö#b2wR‡¹çTOŠ0£©ÿPÉdŽîFã°4ô¾ÿç+ÔAï–7þD¥$vòí“ÙMÊüv#Ðü¼^èæ†í#)þt6FâX\ DµF -.բˉM27 ÆÜ3:K–Ü€z–”Ùll‚™°0£ŒE#¦a£é ¢Åì©F®bÈÁ`–••¼nx¯$Åyü‡g8O›.O,Õ -ÎcE·É³Ri±!Už$™\·Óƒ¨ Y<¢@–IÂ)>ï\"¬­þŠ§tܲɳ:äÀ<­Cèk:ôB«Cç¯ê‹QªIž]Žœ–I¸Yq‚þ‡­Y'ÝZ”fŒ©q §]©$Õá)r;nŸ—ÌÎðÏ…ÃI»©0ÒîÚ¥sd­”äÄ—ü+2& -\DÀ iˆ©µ²Z¸§œæú¶G%ÙhhŸ(2¸å¢\Lå„‘›%*qw”Å\Ê.FÖû!8Æʪ4LÆüáŒL #ìÒ‡mÖˆmÊ?±1YÊ»ÃtMÛ¨ü ‘œuà¢:Rõ" -ç(´ç2÷/k©°ÉV5­û€QX¡èñü'#«»e!u`Õñ]î|.‹0G¸µàDš-!´)îãЄw{-¯›c{k¬¹Ø˜9Ü˨ª·{¹Ç÷î¸qž…eD[-‹5›Q·T¶–ÝŧìA äƈtzePƒÙ’*!%¿#i-⢪lâA¤Ö—QE×´-‹HyÈÑbâ[‹—r`B’Y˜â2 ¹Y4º„(œK8a1 (‚ŠhŸltæÂâ‚]¤@CcÉϬZ…ù¬V´¥Ik £ä;‡§Tù²“Wü&Q얼ѣ›”]äe Û©Ý'µõ-èã4œUÞ­®YH>ñ{9T»—Ô±îwTß*KŠ¦qÚ¾U •\\®ÏÉá÷'+´X«‡Ë¼¢ÅûY˜ñ‘î KúYX¸ÊÅÅBJ²(#<{^¨ìnî8/vÞñ$Ý“$’”ešã‹Û[^ð_#¬m«|Wž|=…'½%[8ØÓÖ2Z ‚3×Ì÷ÏêÞX<—2œtX“Ü}Ô‚ÎnNór~ÿÃ/Y#û2ˆ#tË’˜¤–›'{ -C8çGÏG£"=‚™Êó¹ Ù² ¹†=l»Æ3õ×ÞÝÄ.De,éOÉžBËé‚ qùüÎp4ÆfN!a®°EN ->1òØ'EðÆ™Ž¢ÆTŒÄJ$n1N$%û1ü^TyÚ9²©c7† <Úe†¤‡¡v‰G‡÷T¤…îd峑šc,B¿Dtö‘ ,?)KçÅ"ôB©¸HjKå9ÀŸª5¿aÔæ ƒ»ø¼Q£ÚÕO½i„Eá‡ùó%7æÉW0Í|ÈhˆàÿpTûY,E¸ƒÔåi·1oL­žäŠ\„yš¥2²ÆÓ×$6¤¦¤8Çw¼ÑNâqò<÷ÖL¿àB'•An¿]Úáž“ØÏbþ‘0¥íö8·­Þ¨ö,ÇZýù‘Ÿßþ©hô~¤¿Ât…è)SøÍïCïã)‘¤Ñ©]³!¡Jý<*N”*ø’TÙ6Yg!âÙÀ¯ÞnÇzú+xê0cªO8¾’ˆôSŽ›Ú‘)ÎkóvgCQ¹.ù“ùò'eþ\Í=ü„r.ðŸÏòýjd.~YD×…,àBK iE–œSl~^rIòÿÔ>¦€endstream +xÚ­ZK“Û6¾Ï¯Ð‘ª²¸|?ŽŽ×N&›½öTí!›F¤$”)R!)Êß~)ÎTj7å* @£Ñ¯nønŠÔâr“™ŸÆáf¾ 6Gùþ.Š`“øA–âÐww{—f›0ðË Ü<ˆä¡úÅ{óÃëo?nwq{aâowy^xﶡw¿Ý…ÞOoq$ò^ÿüwl$ÞÇ·0ô‡ÞCã£ôþôþÍ?îþ~ûëÃwov‰Ÿd1²ðÛÝ/¿› +¸üñ.ðã²Øc¤˜™÷pÂÉOÚã@×BÏ‚09^¡ûkè¡%žt#‹5†>o£ù½æw×í¾»¶Ø=Ö=w]ú™njÚt@é£ÈCFIg}Ò㉯¶» e/€8ýçmÈ|ûf^”û罆:‚]é ªE–Þ#I²æûzxNjàa·rzòÂYcÇ¿Ú î÷DŠçþbÏ]1ɾÑ5Ÿz>å€W€tVèª5ûÔLú„í“aD¦»£¸|ÙCÉÉ”lÉ7%œI䦘ù㱩]a§$³CG×’;,ïHÀºÚŠN¤hÜÚ+ì‰õ 4& rïþÀƒãévJ.’w¦!{LÄZV€ò°æ°Ö ÔHLØ|dÉ =0G©û+Þ8HäÕv—Ð:Õ-oÚ]Hr£4ýj”GëµNݵÙÒ&Y2éE’¥^_Ñõ“sÍd.Eœ{ŸPÎgÜ…L‘ÉëV±ŽüMzÌJ@ö6^[12hkÖ¤›1m$ÅÌÀÔoÜ®Œ. 6©k3r7Þ4x-O¡IbÇpR}-ƬfÞø> š•Ó«q”ûëI H]ñ§H\DÞQ³Ò éØÉïIÆ] Àë€B§¡î`–~*ëÊXzD`µúy_:oÚÃ}Çe<' 2¼@[øù´%¿Iêöà}Ýhº-ÝèшÔŒ,³â6+‰ƒg/rÔ{&X¿AدÛ&®ŽÁßÚX }‘x0²A »JrzìÔ½1=²cÇΓ>žÖn÷e›fžÒzDµ›Ngt™H¡)P´gq@Û#Éåžç¤lß%º÷c+ŽxZ/góÎè|¡XmË#ŠP˜½î˜f¤ˆ)%…÷¦£Ó’O¯¿ò^ª­„Õ¯—¹Û–¾×™KØÚÝz?ºšŒÇysCïÌ›cë,ÚL +›g¬ð@Z·ÃUœ3~Ž'52>ð¯âº(ô.Úˆµ$Ó€9ØÛ±ú +#SÔmë½õ_¦Ë‚%HN;àIac°.r +MøõŠ½£b*ò4–ô‚ífÍ>.È¡â Eb™,b´`hMÀ•Ñ¶¶@)ªGbÈô™©43rùÐIò„ß )*ÑV%sŒDÈ?mE-¯xtÜOÐ.ô|fÙE²ŠþM–Z‘$ž(®†óqöÀçp¤ÅRuAĉ÷F•¦¨«e­s× ÚP²Z¯‡ÏÜBë§r- ˜ñµmõ=žôBG§1 UªÜ“ðA +«ÆÄêÖ–yöêŠÊ’D±Çæ ͈øÆߪäÒV"aÍÅá«@RrF ¯°›ƒcÓF§ºâþ‡7˜p앵YƒjeI0Y‹ÂöbžèÀ`’¯Oä·–b¸Ñí½këÎøòPJ‚!½%Aéý?°,üÕ­|ó¨±3ìšG%î[³*øcZ~ì)ŸÜ¥Œk‡Ž3©ø0òׄFÂÐ7zd#Ëcï^¨µ°Þ“K3\ ò¼Õ‡¥úÇ`µì°´sílñ)˜ö…ÔL4UèÉ€ÓÄl¸ƒq«<Ó0mêYT»‹7±høf å‰2«€‘¹ˆ3/¡d÷ušZ:SÂ0qr¾Ã«ÉŒ‰tê,¿ˆ7“ ÌZ.‚ìg.æ&‰Rt„¹à#™®Þ‰S€d?ûÕË Ïú@Ç7°âǤgÈÎȤ„Z»ÞªŒð®Ô]×üÿo¸îű[! £êG†8k>•²‚\‚M1„¢8àqܦÛÈ9APOpœTÝ:qARÇä@úÄЃ¹â.ƒÞpZ_«Jº-<Ã…¼—o<@isÍm“~@óÏw».e¾ã+IXä°k¾ÈMz¢4è¥1í€ÛÖpüÉ  ·84e±ðÑXU$ZJ„h-Q`lƒ‚áÓã.h`h~©wRƒÕz¶››ÈÇÉ5zT×åvH….ט"™u¹þš'še¾iÎÈ;J Øû{Ÿ·i$Å»ì» 4Èåi‘˜)w”!mÎS¢0;ð›å ™8@Ë,’ì[wn†)%¼.*ÅjŠò8¥ÿ˜Êf@ëˆüF‡J–…A¬ùÙÌdecš)ˆ#ÐÎî[Ce +?™8#5o‡ Ý®âæSÔq Ÿ›”#(4q7XœÞÉ®fC‘92ôþѸr©Øù3®™f'=Ùy¶Š)¥Åaá¦Å»ÛŒ¬˜TåˆÿïHx/d´àdI”…ôäjÜÔg ( +Š Ìv¶"smxEA»SÛ› +MaéB»Ò­«à'j Îì.ÕìÖntkªQº G¢D—Þ}UCÜ£DˆŽ`|éùbáx<“W=ÄµÇ }R‰ûœJ ‹q¬"c¯ O6AD +´?&Ѳ'¯e‘%Êü_êĨPö(ÖÊã °6ÃÈ„P¥¶¼xˆËÌϳdýÅb%~™ç¶‚+ü0ñ#Vý*¥÷öë÷½2lA1ב€»}½ß<"Žá뤖1¹‚ÿ· F~=󠲋#?ˆâ—Þÿ ¤åÉz #åºðKfÒ #Õ‹ÛuK4¸œ •Ü¦ŸÓR‰S3k¹êK>¦ê˜Å,&Î+™o†p„|Dƒ k!Á~oê-&2U«y2»„¨ˆ¨ÌŽeF>2þ"žJÊT“ŒÊˆAUK§¹]+÷Ê57®ÃTA¥0`÷a'I¹o’þÎMÖqc‹‘¶¿J‹}Zc>¹´½\µÄÕ8FLÖCéÅ‘'ëᥩ¥;™"tų12(×q|À…PœŠ AGH–*5/—ÜÉ>Aòè dá”90“6ܾ°=KœûUkãЙG%bš“©éêWk­ì[êF9uÍÛöC‡›FƒV-H›å´UîLj“‘AaØpì ¾ºGŽà\^²þªÎ—Ƶ$<ð/ÞÍ’³gªþ¬Zû0•å/½“ó¥§`…R¿N’\]¨ƒ(«fMmíOµ+5ÆAl’¼Fÿþ¢/ ?+¿ąGâÂÿymÈ¥]Œ²×;×ogÞ'Š¨ì»©¼‹òOŽíwÚ¹ ¿Þ«¿Æ[>kGå¹G¡”*-‰½qB¯ãÏ„ÌxJ[ ŽR~sLJ·â'Ê¢¤0£í°î&¥llYDZ2sGIyÉ gÐ1Ì»¾øEY*ª›˜Önœ×«ðpjíµ‹ž=#Áæüb͆Jò +-@Àögð­Ír,‚9ÄTîX''ä…•§H;Nä•t?Ö’Œ ”˜Æ˜RàLB)¢Ú˜{”Dî]šSõÓ(\¬›‘=—e)cÎM#Œ3¥&‚1Dã‘qèDUTh<Ñp†½Vc½R£âg7˜ ®HoT;_ìÓ„tq…,6Ùpå<9›‹«­õJ†Éšî² ‹ü n6.&añ$Õåå/1fzcþ­„çE?ùc‰§“6Y`šª~lþxá¦Ë·|\Q†ï]oÙÚ¿ +Y y‹Gzr5/ïäÛS«Bkï‰Ó›-¦rˆóXÛÆEi‚ösúŽÄG¥©ÇNR(óçsÀƒ€ƒú5™ŸFùºÇÞÿ¿?ë‰s?,¬^t¾aV,Y 3?†,"pü/ +À5êendstream endobj -5030 0 obj << +5224 0 obj << /Type /Page -/Contents 5031 0 R -/Resources 5029 0 R +/Contents 5225 0 R +/Resources 5223 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5028 0 R +/Parent 5203 0 R >> endobj -5032 0 obj << -/D [5030 0 R /XYZ 85.039 786.531 null] +5226 0 obj << +/D [5224 0 R /XYZ 85.039 786.531 null] >> endobj -986 0 obj << -/D [5030 0 R /XYZ 85.039 669.341 null] +950 0 obj << +/D [5224 0 R /XYZ 85.039 358.883 null] >> endobj -5033 0 obj << -/D [5030 0 R /XYZ 85.039 629.177 null] +5227 0 obj << +/D [5224 0 R /XYZ 85.039 324.74 null] >> endobj -990 0 obj << -/D [5030 0 R /XYZ 85.039 215.269 null] +954 0 obj << +/D [5224 0 R /XYZ 85.039 201.081 null] >> endobj -5034 0 obj << -/D [5030 0 R /XYZ 85.039 181.129 null] +5228 0 obj << +/D [5224 0 R /XYZ 85.039 166.937 null] >> endobj -5029 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F35 2976 0 R >> +5223 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5037 0 obj << -/Length 2311 +5231 0 obj << +/Length 3041 /Filter /FlateDecode >> stream -xÚÕYëo¤Èÿî¿í—0ÒÒ¦_<ö”D>Û{Ù[¿Ö¶´Ý<à1ò L€Y¯ÿûTu5 ÀíK¤H‘%]ÕÕõøUuuw|øãN¤™/c'Œ¦%wæ«ßYå§n9<Ëâõx~¼=8ü¨‡û,öcçö¾“ûLÇs›þêÿíèêöôzæI)]®ØÌ ÃÈý8ãÇݳS¤÷èâ_”{} -¤c$]Â˵=»<þüéâ§Ùï·?œÞvZõôæR¢Nÿ:øõwßIAÿŸ|&ãÈy‚wŸñ8vVJK¦•´ß˃›ƒ/,¢)‡f¹@ˈéHîû€ëhÍ’ʪڀ5ë&KÉM -Ÿwà ¥”{Ó”kN–0¼¤÷¼¨›¤˜g芚†Ê{zÖ8¶š‰È½›yð…½'Rš-ÍŒ†2òݲ4LsäÌ‹R“ÞmçT´F“T•²C#;tS6åtð†^Ë–Ç8J•³Xë¾£¸`Q¤£ª'À3ZûîUUÞ-É4˜„ðànò l¡Ïß|® ›%çð^Ðëù =/'@gâGiˆû5/Òr&}÷©¦_p«)ƒ!Æú5ƒ·<“Ȉ…ŠƒorXZñØ5Oá» }Þ!^–TÐÔ…AÐùdÙ¹šEÊeÄp^Vä,¤æû²Z%M^Z óľPl-ç=0–›"ER„óö+0ABf´Š ¡ZXŽëž+Zn¯Ç¾ï‹¡LtÆy>¯Êº¼oHÇÏh‹aép€h_XÕLL.d¨²ãI¡™ôµãqLåØP#æFDFøŽ¸ˆe84“kUÄ  ÕAŒ†Ù²x=ž}ÓrP‰© -TÌb¾©ÏdB0(ký’6…ÎЉm¢@uHf’»Ïu÷56[ Ü0 L6e6#ÊoÆç}¶¬AO˜7&yªG"š(¡°æ¤6ÍóæŠOÙ/ ûÁËöoy&SJGPg"Úpþù «˜n]®HÝ|ÕQn’GÄ”1P@É]ca® ξ£öfRÒdËgâ—ÚŠ3Bæe‘Ú:“›’hi‹Í¤MF”­3á£Ä²úͬ^YelaE7—0ÿJã[àK0G›.‚“srsNï ˜þNt¹⠻ϬÑêež¥j'ˆù°ïýß%­BÞX”zìÓE©eú%®b1Q”´TžkÒ–e²$Y–—*’æ`º~1!·,]=Rච— -² j RˆµHÅî‘ñTjj„?YRá¸Î’÷òqT$™ ãUêñLÖ¥°¡†ìﳺ© ./ÝU‚áÄl¥þ7D69”9&ïCoꦈb ZwRИi÷¨J¨ëƒA›úuN ˆmèp‡¼mn ÊMLÖdmº¸Ì®SÚuJ\ÈŽ}E«²;ú0ì$ ŠÖCühº2—” c¯ú\>.ÜsôKl<t£»Ö AE/½e¬·µ§²êào«ðlv½#IMÏa­À5º $Å"3&Ý8(0¢V“桬3Zªs]«EMo€›Ô˜ñgIÝP׌Ç4ïvÌ櫓u^ÓÓ´ëO¨A¨¶mtWÜa¬kñÛ¾OìüT±rL:Ýds뀉é½…$hy¹{rAgù]eÜýlç·rÖ´dY5ˆ "¯›|N¤íy!„C8‹Å‡‘]ârm!ŽÛfôã•› ´ÕMñ¬4 ‘8ô¾PQ_eã'¥F[RË-Ø‘|‘µ[bHk=Òøo¾ö­µðÊßÓèWÓФT§C³)Ñ(ÖY–ëÜ6×ÁÀÃ2êÕ 8ÂÁ$³ÑÜ¿ÇnY…·€[†ÁFhj¿òcÁ!°±nw í;«¾åó¬Y?œi_Xº@ˆ1|Ì»­È6 îØ)˜söáåØ -“ÐY¾q‰›Xá3 ?±ÙPke}ˆ)‚HÝ_‰û’ùQø‡­Á¾Ü”U²ÈÆLðÁÁê?–ûLpÍV£,Þ#j_ÊMcc/$ŠSìõîòJîÍ3ÄéåñRã¥ÕA¾–á-Ùˆ«žõ/ ²F>ddÛàôÒ¨ë‘/0vÅ›8ïõ2ŠYjGJ€}(_éÉZn¯ÇnvoÙ·r(}hšõ‡ÃÃUlÕV6/W‡¶åòá$ƒ´[šBø|˜ìnêÃû|™ååaMàú‡~~”,©×C«D2“"€tQ£HËãõ˜&;ÇLˆÀ¶—Û»z(^í2Àw[GpÆt”ó¥%}BÅÐKÊ»sŒWN)š˜"e.Nv‹»¦‰gQ'sÂJ‰Øš!Ã'š–-ª¼±]?åxÆÃ7¼¤»ÂÛ9̦wïG¶Ô ¡DµPb×ÄòB“ˆH®ò%ññ8ŽßïED p p84ÃWpÖr{=ö}œ eöpVoÖkØ'PK³ûd³l1ßÿZÏóôÏw?þ8”nŽ…ÛÔßÂî‡6:{>œóc0.ŒOÜ ´<^i¬Ûß•ÔõûŽ*k±³ïÇëÄç‚à·ÌRs¬‘apø€C$Í{øT2r¿àí]@èˆíÝqYàxaúTƒ¾QºŠEM•+Ó„ õl¿ !‚½­Àׯf<ÝI•±°ð}  }b°sœ°™‹æÑâfù·hDvÄ÷Ñ}‚¯!9SÑkX$^oË<‚Äy ‡eƃ¦;NhºD -ÔÐ_³Tp΋'~ hy¼Ó>‡’z@äÂgeý>w¤PÄñˆÒ÷û| ÏÒ0†(ä"> -ôîꘈØÙo>àY=tO¿››¤HŒÓ¶Ù8ij[¥fwpj°¹°Š$/KDè»·ˆM ‹MÚxq-¢OÁ§ô‹eŒÅRïÁw¤ †LD¯nÊ–Ûë±lÊ™o©Å§â°?ï¶Å;e´Rǽj)¤‚ t‚&-”›²åñzL# HzévDj¦¤[Ìw¬-ÿÕoP½ G÷ËZÀNÅ;eÌK ‡·?Ví«üoÚH'endstream +xÚ­Z[sÛ¶~÷¯Ð#5c©âzLsiÝ'iìL:ÓÓJ¤%Ž)R%©¸>s~|w÷[€¤E'Éd& `±X|{ÝÙŠþ¹³$\®üõ,N¢e軳íáb5ÛQÏ/®r¬fÁr…ÜõóíÅOoÂhæ®–ëÕzv{',·ÙŸÎË__|¸}ýq¾ð}ßqƒå|ljófî:Wó…ë¼}Í=žóâÝ+nÎÇ×Ôõ’»ÞSã£Rß¾ùŸ«w¿Ìÿºýíâõí@‚E° "ŸEøûâÏ¿V³Œ¤üíbµô×ÉìÚ«¥»^ÏAè/ÃÀ×ïòâæâw; ú‚FMlta8þj™$ݱNìøEK2Ç¡“ó&ÒíÜKœ=(iF[ÊŠ® ŸºJKP·e‘WÌÕ)WGÝŒ>;¬«µs»åŽ¼zä¤ ÿwå4ªÌñùPtºd}d2 ¦ùE”{°•iºKúJhú½Ž<gìÔXž¤Z;]aE_ÞÜÕ MzíUÔ‚D|6| .«j-š(Gæ¬ç4ì /ž̼Ø-™DÑâ·Êw)VÍ@©µ-tÌ€±'êKËòÝM.»ab) +#‹aW:(ß_X7¢¨ºëʹ먬ڀö–&HF±öÃé²ð‚å:Ž­Åx« ‹¡ká-iwéÓý í9ŸÞñ’WDûƒ‹èDæþÊiÐ~÷æ—,%O·x±Ý²I¨¨¬µ(¢KFíBÌ¢5bOHèK7ø†M¿U bSVÉwõ·X…"7z{nÁlm–ÿWÚÀ`-M¬–ÌåÔéÔ x úêêæ<¸Ì½YÇÎ=k¢Ú¡_Î6:O˜VE{ ÅF¤Ø[îÚ³]ŸÚË “ ›DÁ<Ê¢·µ]º5ÇRä"ƒ:´`N%æ·MéÆ\K"ÖwWTÜM«+ؼv:¶Bo-ÓŽö&ôMcdH•ÒäŸò¶Ãð;êmê>Ì6¸›Þàú4Ú_c†t¨‚P4ðYdÊjfàm…‰ê@Œ­ÇtÉJ©|¶Sâ¥s¤ö@ÔH]‡­ÝGÖÅÃ`]<¨n@ÉëŒF£¼ÎÓÂBx Ôš·]Ù˜¿‹N)¢âM'lA¤Ç` –ayÏ;õ e×-:6U µ(L±?Ï0dÃZ{D;ÅÏg±ÚÌ`äC rƒ.Y1äæ% Õ¡,’ÿs\µ¹JbŽÝS—Pj›wÉ¿r„÷bæDU L¼ŽŠ%Ò‹ÞšÓQ,µ®ä´TG^¼\‘§d]±Iǃs÷Bc´NívŸ6ChR•‘Ù|¨=î=3AZ`ò¶â¾’ÞWc^ôw¸Á|åоbk_Ôª•öEö!zaÌäâl­>ª‡lSèÁ¬„6“øY9Ökl/;9ššæó:Se,£Äû!%P‡rC’ø.’±¾²Ÿä[=ʧªÉË"ݨµ‹“A|€Aä{à€îE=ç{ËØ‹ŸØ')Üøëþå–ãÏ_; —Ånî@³1 ]âÏOX?9t¾? ¹‰­NÂq‡²Ü<’AAýqŽŽŽ'™<:îPcÚžš„‡}^aºÎl£¿ÁSfÒóEaF»LgáE|šµ 3ç‘ a˜Ò3cïr¿¿ØûÝÀ˜™Å"µµXx‡‰xpa¬‘s¨dêè±¥µqQ6”Wà±nu +uˆAE¶‘m;¡–ÁRæò&.æWÆ‚¶kºœ·û›än‰%õÿ5#ƒO¢Ež°Æ¯9G:êzk-"%+i èbu‘fyéÿ‡·Ú¨í™¥[sH€{˜µïlëjÖå™Ð<¦se…A§NœØædõ™÷®Œ.ª/NØ׸œg‹»é×Únba7,Þ³[¥‘¥¸ hhû¨ë”Fºã#ýpm„#ßí!l!Êa“nÕ ™\WƒÈ"Çp{ìâÒM!–.‚=ž‡0g…þ`†`:ª +}2VýFŽrÛ(rdÒ¥nÑøLNS©¿à +›LôZ›ÛÀÄW#"Î 7\ì7P—0ûÈ«m}½Ìåq + ÇJˆœk3<%ìQâm¿ÝøãPsèÚ“+|ˆŸÒ\qЭ¬tc¯,GTöqFˆÖ¢²I–çÒ3fÝ¥‘ED}‡”ÓX·M'x+§Ð>»³Æ#"!ÆõGèwcäç:F;/•OÜZsE ¿ÿ…Uø#Ô¢/©|™‡ŒŸ2[ +§X‹ãÅ ›J«¢‹%ØPÈ}ùŸÍpÝg<Þ„© uœÇkÿyñº÷/–Ïó)‚1[[*üà~y åd•ÜÆA(‚®õJ"5/N¢®Í\B³Ëñò€'‰pŠvR¶tÈ ù·eºE1†Çâç ²GÃ]¨î¤ñ–Là`0”óÇ© †*g)ºëѱ>»|·\â z&ã‘ö¶âˆC"ÚCQ–hMçËÜcJŽ²!8ÞâßTÇž(d¡D…°|\ åMsº2¯rãÐewÕyˆÓxBç†ÅäØ ‡÷“àIÕ‡oß:t>[#çȉ 8: &¤GA"5ÉN\M….{Ó°AY¡(Ãü¢Å¾>™i%õæéÑp>@-Í–òg i[\Qö9+Wxâe'ƒ°pÃDµ§¦çí¤”xì©­ þQÈ#Š b¥{/Á0PõáxÕlÊߟ»bpºÛŠ )oLx™ø?w#ÅݯxÁk†_ñÖa)ôu³Ç—¾}?ôG°EìËÞ>X Ê#7¾ž°¦sîòF¿ºæ4²=ÖV±Mµ¥³Ùz¿­‡1³v^]ÏMh@Ô×òÊBë[Ä`óhê~‰£Hmt*v/\)'T[ÊdÉ© Ú–u‚ؾ:¹l‰Ø˜ªÏ1AÈ•-­öiàÓ‚ù¹+u)×Ò +GkR:P›ŠÑÓB'­xÃ*øm½Ð0ÔÚ†¸ Ö]<² M4Vw{;À.\\Et¸ss +;¸Óý^¾ßðÔ[0ÝÕʽm +s?0ÑÖ%ÓðsjÉŸpI‰A#ç'¨˜š¿âe0åfe0ŒOE¯`4S®[U•¤æ/;¢ø­=õž›¾Ó¶5˜ 2ƒ—.®îÂ<¸T_÷g "ìÙ7#(2ÉÛbWéS‚9Ç!d«t}Á>aËAñQÖ©.£&ó•´@ßbà}JßkFEþ(t®*å×GPui¼‰‚(z3`Nñêå@ p<±‡»ce'^ѹéPãÕ]ãÛbëÛ¨.Ê)0™¢ïóæ¦,GIu8­xy¾p±³Q? )ÔHm>êGÃG±…Ћ̔&" MÑÚK;Ì*VÚ’¹ä‡ôYæw.[ƒÒW;bgXë0ΩäNA“»C ‚‰r%|rÿ€4È2m®·«;kÙœÉôÏ·l)¦‚ <ï\uÃDØÓãÿqlFs™Å(1<Úö=Öw{ãwt?pƒæÌz°’™|Ì=Ô(O”õÓöÞbïzP²/ç|wM°eƒªpü&ׯËOçõÑ×=4ß?<)(Ðò‹|”Ö-…@¶&$χ“©,/ú´6Võû9ƒ}‰À'SDo½ŒÂgž*Tƒß÷·~¼t{_=ÜhýTD7ZúQ@Í€ÿâCŽ¬endstream endobj -5036 0 obj << +5230 0 obj << /Type /Page -/Contents 5037 0 R -/Resources 5035 0 R +/Contents 5231 0 R +/Resources 5229 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5028 0 R -/Annots [ 5040 0 R 5041 0 R 5043 0 R 5044 0 R 5046 0 R 5047 0 R 5048 0 R 5049 0 R 5050 0 R 5051 0 R 5052 0 R 5053 0 R ] +/Parent 5237 0 R >> endobj -5040 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [409.348 675.624 539.579 687.313] -/Subtype/Link/A<> +5232 0 obj << +/D [5230 0 R /XYZ 85.039 786.531 null] >> endobj -5041 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 664.196 152.127 673.764] -/Subtype/Link/A<> +958 0 obj << +/D [5230 0 R /XYZ 85.039 724.712 null] >> endobj -5043 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [409.348 544.521 539.579 556.211] -/Subtype/Link/A<> +5233 0 obj << +/D [5230 0 R /XYZ 85.039 692.689 null] >> endobj -5044 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 533.093 152.127 542.662] -/Subtype/Link/A<> +962 0 obj << +/D [5230 0 R /XYZ 85.039 566.909 null] >> endobj -5046 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [388.679 336.453 539.579 348.445] -/Subtype/Link/A<> +5234 0 obj << +/D [5230 0 R /XYZ 85.039 532.159 null] >> endobj -5047 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 322.904 298.441 334.896] -/Subtype/Link/A<> +966 0 obj << +/D [5230 0 R /XYZ 85.039 354.91 null] >> endobj -5048 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [251.226 282.256 539.579 294.249] -/Subtype/Link/A<> +5235 0 obj << +/D [5230 0 R /XYZ 85.039 322.887 null] >> endobj -5049 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 269.495 160.987 279.79] -/Subtype/Link/A<> +970 0 obj << +/D [5230 0 R /XYZ 85.039 224.206 null] >> endobj -5050 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [297.044 228.059 539.579 240.052] -/Subtype/Link/A<> +5236 0 obj << +/D [5230 0 R /XYZ 85.039 192.183 null] >> endobj -5051 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 215.298 206.805 225.594] -/Subtype/Link/A<> +5229 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5052 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [325.68 173.862 539.579 185.855] -/Subtype/Link/A<> +5240 0 obj << +/Length 3062 +/Filter /FlateDecode +>> +stream +xÚÍZÝÛ6߿¸'ˆU‘úÎÛ6MÚíåš\²‡>´}e­Í[Yr%y7 ä¿ù"%ÛÚ`»Ã¬)r8‡3¿F-ø§Yìa¾H³ÄCµ(÷WÁb #?^)¡‘$1}{õÝ»8Y¨Àσ|q{G$·›ß¼7?]¼}ûi¹ +ÃÐS‘¿\¥iæ½[*ïf¹RÞû·8¢½ë_~ÀFä}z Copè4>IïûoþzóËË?n¾z{;‘`ùQ¢^ýöG°Ø€”?_~˜g‹Gh¾ÊóÅþ*ŠC?ŽBù®¯>_ýÝqá±hÁ³f6º²+•û¹Žç•±ÂÍǹS‡fÔÐ>lLù)¨"Žrï{Ükõ¸ ¯X†Êë*Ør’zíÿ¾Ã·»R†þч +çuV#3â„‘¯@f+ŽŠgÄù\ì—:óÖ0Εg`\"ãÇ]¦çá¢Áå¾{NY呦±ðë÷k¿l›;¦;Y2ü ‹„îPtÀǽUÇüiå—®iÙ ³‰³ › –‹•°¹kI'±Ž½c_u3«&¡…Zȇ.:ØÅtêí +ÜñvºÉaWq8²Šá Ά„+™²Ç¿f6[Ñ .½Xé\û:Ò` +h/9«dWБæ¹w3ºvϲNÎ|Ê–tA°åþã’du2£ÅßÌ{ÜCõ€ç6 +˜ˆ›y¦ç9îT„ UX/uî=YQ˜* +8AÔË:ø ‰ÛÃ2N¼¢3ÅÚ XoÞP´‡ÃrÛnEªNt0à^Ó´f±W·DMgpï6 $7üV¬…âf‘×6Ü_ð'é…N³«^¡©èHJÔ ìV¾I¿Á­)ÄO¸áBNÇüÁ%UúÁ[]Ôd@Àª-6äf¨=ô<Íz.:WÖP'oî‚8“†È_·ýÀ­Ù+ bMvQÜû–“Ný9rº¦ÅZ³aÒ)c\=¹«@"w‰VÑk·µØ$œáë¢ÂÌf±ƒJü0Á°gãp¤fâ0˜BzÎ6ö£8æ‰çLqhÊó$B/ŽÚÏ‚PÈMs¢£Ë@*?V/ôQ.ÒM£0­ {ìœ%b49Û<¢NC9Ìü¦ÙyÔD­ç‘·F> +~ÅGÕèœFKk*ëù0>Bÿ}ÿíífÿ_Ûý€ï@÷ŽÄh›†¤aÄÈWuây]P‡Ì¨›Ý»Jý0Kž×:òó4{)¸Î\_ÓŠè7Œñ*tûå’ò h#|aœ ˆ”ð(ÈÞ£ ¼òÞá>àöé çÅl?ã´¯ô3 „/?ÐúÅ ]=Š$Oj¦ÇF†ýØ‹!í9é\̓/â|†Ê…é°CÌŒ-Ææ6:#/7ht³7“ù~ãÕ &­%‚î:l‹Œ³&`-œaÚãL<àPË6Xu´@Ò„}6ü:ÿŽ}‡s${še¢“u/Ó[þ•°Ýjµ0 ú)tBköÎÄqJƒö•¢«-x¦)Ø;‡ººÀ§‚¼“]È8”,š5¡³ˆÈû—3Gu'¹·åíñß ÷Il¥ RSmÈù<ñø4ÌþP[Aö“0O Ú;¹1Úö2³áßqÒƒéȉ³Ý°Â8 .‘!vBdqØ%¢škÙ@mîYgBÁhsL…žÕ  Á½ÕsE gñ¾—ê%W-àéõLŠ©b-®Ù£•÷G׈3¸ùX€b©–PÍ„An-Ëmt}5³Nâ'I2³ +ÄÕ¡j‘àw ¦6Ì­†~bs[F?«HT瘂 wKL`:™±·wÀ¿&9f`:Jäþ Þâž'GäÓÙIùÍ~šÒKá‡y +N€SG‹ÂdîHˆwWq£«þDÁLWm„Éàì¨qÜ.½ÄzD¿ƒB†ðjIŒC¤! r¸ O<6&i&óNá¦Ô@™fCÌ€!3³û?³û”º`FŸ]*¥!e@Ì]»ª>È’$í—%§0D7Gx3-ìœú_â%À:7ýkPP–y¿«0ú÷ŽÕ%€q,edÆ 2t ;q„a<žÍ¤2$ñë1S†®'BÖGþ †ÈÙ–%°ÅáUY¤MNÕÅ­®F7–ZçÇA ‰N Ió.uQŠ_¬ü¿ˆC°%²0!#žàÜ’w@L)¥ŽÀ¯c?Íþ#X%¬ò7ƒe½,u…%ÐÎô€€Kàã'³Ý­® +òèÅÚPv6 øxú/ŽºdâÐMO"•Ö‰[±¢« (YÁy‰LMXÏŒq9îá.öe¼À‹§§§³7.þÒü-/ïØ29!€:‘^˜\2ít.\D¬CCÊý†“P2¨êË¥Gá°I¥í‹¤×MoF;Ð_K*?IjиàP9û"c7ÌkM÷NÐ4’ú^ä"«¸Ñ£”=ˆ‚¶¨úrüÉ)»YN5-”c1£ê¼ŸæÁéé¨ÆqyP‹:•R·%`Ö ƒ ˜.#ˆ60Iô¥8éDª7¤€¢¼€Ìà‘l»æ•l >Ä¿°‘á2k+Ù3¯)B؉ÚÄ߸,l*ʈǖ2y’ Öç´qbè'‹¬ê²ñ+EÓ ƒf„E™š”÷ð;ðîøb_j %ªíxmC.ÍÉ}!¯}‹jEÂB¸u¦¿çâb¡ ®†‹Ëæ‹ñuîý@`‘Æ2BüBñ§9ø܆;ºJ{Žß +ÁR¯ŠTŽ~3w_¡kSMjU¤¡Âj)cʉ׋f 0v8£4ýoößÒ£ÑG&ºÂ] 1#":´~{OJTÆñ<£J6Ž»b¸Ê½Ë‚e("ÉlñÒ8ÄgˆÊ:œoBaƒÜûŠª¾á¯iä›GÝeƒ.©.Êeã¾ËK&_G6ðã¶ù8eEîœ;(­<ö¹£‹”-Y|ÍH˨¦4ôn„Úˆè£6‘ªuRgj9¿ EæVIӬГŒÇÊ:3±q[¸l˜fèã*¿e;“Žiøt;WV.¹#w„j÷^dõy“MÍÄ^&œ8:àþÕ7Š(ß­Ê¢ç(™ÂuÀš§j‘Ë„ÉÈè4#,ñŸV»c\f²ÞÖ_å«“5Ðg`Ï$ø:A†4_EœI¥¦ïLFd/Ö“šSb<íï32sJ€kÞ œfŸºVžGO)×ÓÓìÄ«b·=~¬£ÓHÓña&LœU%Ãœor`ÌïÁf;ãî°Ìv 6Mys·«®Ð[&žË ‰+n|W°Ù¾¤ºfùŽÕµ-¾}Î7²ÙYgt’MSÖ$ ZR(jlpa ì¨æ–SãÓ÷¢Û¡¾G!;³N?=JDy:ædôd´<}=¸‹ˆü§kݾùÈcsŽÖŸó?ÓRÇò\¨ãIÜÀÞço2’nJhéøš ãü4¢)lw! zØÄÇ ŸCËóYïOlN ÷Í»4+T!²¾(I:{KØ­‡ÉäÍ0Qçï• óp„ßH4#’Ä$£ÃD^(™ñéóá+.¢:.“ +9wŒæÓÅ\'ì¦ÒOò­¬j£@Öc¹ãAn÷LöBN–=óŸ> endobj -5053 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 160.313 235.441 171.397] -/Subtype/Link/A<> +5241 0 obj << +/D [5239 0 R /XYZ 85.039 786.531 null] >> endobj -5038 0 obj << -/D [5036 0 R /XYZ 85.039 786.531 null] +974 0 obj << +/D [5239 0 R /XYZ 85.039 766.606 null] >> endobj -994 0 obj << -/D [5036 0 R /XYZ 85.039 738.261 null] +5242 0 obj << +/D [5239 0 R /XYZ 85.039 748.602 null] >> endobj -5039 0 obj << -/D [5036 0 R /XYZ 85.039 703.515 null] +978 0 obj << +/D [5239 0 R /XYZ 85.039 511.44 null] >> endobj -998 0 obj << -/D [5036 0 R /XYZ 85.039 649.927 null] +5243 0 obj << +/D [5239 0 R /XYZ 85.039 477.296 null] >> endobj -5042 0 obj << -/D [5036 0 R /XYZ 85.039 613.06 null] +982 0 obj << +/D [5239 0 R /XYZ 85.039 326.539 null] >> endobj -1002 0 obj << -/D [5036 0 R /XYZ 85.039 517.65 null] +5244 0 obj << +/D [5239 0 R /XYZ 85.039 292.395 null] >> endobj -5045 0 obj << -/D [5036 0 R /XYZ 85.039 472.576 null] +5238 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F41 3054 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5035 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F38 2997 0 R /F35 2976 0 R >> +5247 0 obj << +/Length 3468 +/Filter /FlateDecode +>> +stream +xÚ¥ZYsÛF~ׯPíKÀ-‘Æ}Ô>Ù^;«D¶w-¥œª$#¤&W–ýö5ƒ :®Úr•5GOOOOOÝ —>ü .ódåGÅe–§«$ +.×» ÿr 3?^Bá_Æ+?MpêÕÝÅ‹·Izø«Â/.ï6DrWþæ½þ×Ëß½ù¸XFQäñj±Ì²Ü{»¼ëÅ2ðnÞàLè½|ÿOlÄÞÇ70õ§>@㣌Þ|xýóõûÜýtñæΑ`¯â4B>_üö‡Y‚”?]ø«¨È/Ÿ í¯‚¢¸Ü]ÄI´JâHúõÅíÅ,ž‹/yÕÌA—†bù«<퉃dæÄî{´ZÙ¤D¾=2{äR¬Ñ÷«/ºh·’­O †©³œ‰[íæTøRî8ðÖmÓ˜S®‡•ÑB˜­|°&ÔÂ5ȹ·CÝ÷ºm–k£W¸Ÿµª‘ ðÈp¶øÿ’ËšIàîu­îq²†#Àà33ÍLv- +²cƒ#£èÁvâØ÷ÖÊlGK6Ð8ÔÌC ƒëVä¤c¡-‘ŽP¸{2ÒŠ;[Í7Öp- W¶û=QµÝÒµ†„áÌм†ÃÇaá‘Ýçb÷x€f‹î!×PŽÆ…"ÔÔªŸY:l·÷‡~ànÛ1‹®ª5A‹™{› +TÞIçé‘„¶'ø"×X¹HF&‰ü„Îb1 C$X_Ódý¨0t•¼•aáÚþ*˜vª€¦’ðÇd5Dƒ@€þ¡W[ñ5½BÅiÎß|¼ÁAçA&Ø–{Çûi€¸g>)ÃŽ2qÞ•õ¢¦Sq{rXªe0k­k¶ÐáåŠøá5V+!a%¡ÆÅiŒÛ)žÐäTï5ešºãæA]É’<»ñ|Q¥kiîÔÿÐ5°‹Jcëù†}‰§7ÌLñŸ~Ì-ÚfÜŠc3=Ú«(©0?«½çÍ(¯/ÈR‰]oÆD8'b ÇûÅÉ$¼è9Ïã\Q˜Ú³¬•ø*„‡œá&ïǘõG2¾ œÚ!9 Ø£S?£ºìq.«¿ +n"Iˆ º1ÁŠ¼`ü¬bÂÖ,‰ÎAE?¾wgj6H»uƒ­{ÁÄEo 1Q¤:P{“Oòà!vªA¯ÖVé¦ç&Y7û +çêýh!…xžº}×n;†~qÓÈg›X=Ž8\"öÏâ£v)BkôWëª#¹}l€äxËF 8Jž<â+8ÉLù “‚ŒõÁÿLî†j(­©¥5[|ÇZ–â»Ttq ?'ÃøäAÍ^nªñ²ë¯0¢ªâ~âÊzžøÝO|U÷-÷v9 w•ý‰A›ml”Ü ­¢ø\Nxö"ÜQ˜Çì[ÐEÇSCÕí¸E*óð–#ÍŒCþK-„¨¾€}þlñ!ô¨²b +n• ¶ß Á8¤› ˜À@ˆ¯5àk CŒÞÐ2•¿`,Ëàúat&œ  +Ò_¼M +§eé*Ì)t‹—%Ëp¤`þœÑêI !ŽVÀY£sˆcïŽò T€æ²Ö¼Viº¯`-±>¼")GØá¹ZéOqo´a øÛ™²cèTJg“£ä­}«a—yíu'ÌÇšfxGøð¼dEÓò€n¨p­•\[?¹ ûÍÞðÔgê_*×Ä"J4SpmÅ‘6£!Åcµ:Š§º›³ýŸ«Î¦w(tœƒéçéT./F=CÛFx6ÅC‹žcB8äÅ*é–<.Öçcì"›°ßƒÆ&u¾0ÝãˆJÇs™>—jIS_œÇG“RW„Ö­"p½W?Ì¥°íÉéic‚åcs¡L N¤òöù%gÃ#¥X6ö¦BoÊG8x?Âà0°‹CócF2¶œ£Lþ¾ƒá[n@àeŸIØǘ‚XÌ–áNLtW£mAû(‹€|Ã!L~¸Å¤­mÿxÍ#ׯ凜0GWœÓËÿ"S0Ì.à‰ž™z èuÁyïÁ.#ö}çͺ\Z›ê»^w©,'K©†s™•îÝÏó¯è—f4 +‚çgôÐaOÂÖç~À’ Îö&½ÁKÖ=N¢¯¦ªy¸=9…I ãÜn&{%"qÉ].…Wß`ƒf#µÃ)±>Æò‘“ÕÞ©¥%£Qæ{½"•d=w6Ö™°Åöß’q¥¹÷Ëûë__ÙDZŒu}hã¿{ÅíÑ÷XƒûXmUWŽX4Êòó_€‹û-§d9TͶA¨Ö¢Î×Æi¶|'âfäÿ7Ü´ŠÅ›lÕ?pYÎþK>}O‘.8~‡»‰/ƈ1 3õÞiS¥îÚ¾Ý Ìò¥IrH%eḜȩçØTf9ÿ Ǧ÷ƒ¤Ù|–ÕËîj¦nΖâ .Ãue:…Ô…Â"wÓ)š8“Êá”w6E'§*ÐÁþ0¥:þ E£äsXl"|ãZ ®,‡E:Êe`MŠRŽ¨µí&¾ý,þ<8ÉŸQò«"? +ÑOÍHEŠK¼¥+ùÆfìSK걕/1 ¶ºÊú’sš °YS@$5-ÄÄ•¸ ˜Ï¿ŒñÞíÕ»Ü*3³Säù¯83ÜY±ea-åÙÚ~” )-»kÖsÀ«&vʟ©ü&|.*»Ö’ ìÃ$¡9îÀIIyï[à‚ÂÅ(\”âÃYÛk>†Ñ_´?ôÌ^”Æì)¨¤0f(t¯ZŸ‘'ñÿŽ/tßôîænÝ|ŠYÆYì}Æì‰â?ìÝS ‹ð‡=ú„œÅÞù +ΗÃi®7Lˆú‰³bƒª~À"¢_Ìù«8;‡ 0aÜ/É@–ˆç ôúgùÅÀŽûzc;æaÐù\% e§?ÌUßð8Qèñ–Η.™3•E®Ø@$äO…QÈ¿G`TÐÝø%4UÂ0ô:‰)1~7ߎq%…ë@h<8ÿæÃ,´©Ðdd-)¬qB>»\ìv` +«8Ü›¾APÀË"¤q|OÔÚSá&$õ¡_›HÓªé#šÔ¥ÑW yž_þ‹VxPŽ;ùrEn!ò#ÏX=ÐòÎ8Äl^eKɽ¬>ÎýˆÉÎ>À­ønK5³.v¶øÕvæ“HÏS°+FVpiïñçX·‚~ÂY$~ZE¿ÑO>³~ZþZ늻L™X<ÕT]©xÒqíù …ãb.°lÌði·ûzO˜”Ý õ¬ jægIš®ÒøÌ/DSÿß/Å¢läVëßüBÇ"é*Jch:þ5ìÆ+endstream +endobj +5246 0 obj << +/Type /Page +/Contents 5247 0 R +/Resources 5245 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5237 0 R +>> endobj +5248 0 obj << +/D [5246 0 R /XYZ 85.039 786.531 null] +>> endobj +986 0 obj << +/D [5246 0 R /XYZ 85.039 669.341 null] +>> endobj +5249 0 obj << +/D [5246 0 R /XYZ 85.039 626.387 null] +>> endobj +5245 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5056 0 obj << -/Length 2572 +5252 0 obj << +/Length 2383 /Filter /FlateDecode >> stream -xÚ…YYoä6~Ÿ_á D Lk$Rç¾9N&q°Y‹E6j5íV¬–z%j<þ÷[)õå…Ô$‹Åb_ÑñMñM‘†‘.oò" SßÔûÑÍ3¬üü!Š$Õaš$ðûÂâÚ­®3FI~‘FÎXç* “"Aš?|ú¬¢…Y¦oŸœ ©âæqûG§áj¦QðÅÔÓЬâ [­ãàyµÖY|©ö›jõçã¯~zôgy. M|ñ:ÑÍZéPçú]Q³´3],E“P'ÙRT‡qž8Qc6)ƒ‡Î=ˆÛ©¶Mß]“Q¶¿+ÆLCbÄéM…eT.ÄHKª\‘»f„£Ó4½5Óþ,¼KÕ†î*£’]ÿäË™ò•ÇŠrÜ, Q‹h0^‰fËS|sþ½…ß“(& -º.8»'* -îñwC‡<1ÕO~ϳžŒ°ëe½âá†nZ^/‚]?Ì‘Gqð‹H8VÍö#Z( -nAEŸò–#àºG:•xI<)ÊAl½ŸxðŠ²à"èœ&È(}>þÊ“{§žhvoü},-> á÷§ìl…*·¼ç•Ž^(=3ú~Þò¯G'†Š& (w±>M‚¹Z¯l4ŽÜøöß«Bã=A c¥¤!ˆ½ŽÌñÌ~É>­@†ïn/xçPgwjö™¾óÞ3·¦àñäúðã¯Éû4O´(þ ò Š”•YÙ¿ƒÈE8‰‰½ÜrË#N.IðÒõ¸ýUNrl­m]ÒIƒJÌ2É©sBJƒqÚ`Mþ2µ[Χ§‰¦²—¼jç×à¹|mz¹¥wÜ÷£å_è×ZKÓUÖoü»qjÁ4“©9ÍÀ>ŸZìmxÇFþ€œ>ué™Fa,bpŽáXmhCM’Õ“ó ¦É]%Ü0ù K‹ÑygÎÖŸx®–—ÎÇKk¶,³žC ôÏ»¦FÜ7H’ÜWα`aBv-\¦H/^QX¿+âLsµÐkø¦Q.…žëS¢%ZÑÜ`dÔ’Àì0­P’k«#;Âôh(þ1 - 茹êæPµ#ÓRÉ›8F´¤O9°ßŒ¾¨Í~ºeVTáÛÛ¹øÑ ¹:|_·F–*‘Ïû¡ñ÷8÷aE(+` “ûmJ­åH ë•Ìwqw¬RI‰ ÁÌ &BýbzË—ÀÈáÏšÁ‹±$:lr¡(Å$tðñ4aXwä?ŧ¡Âhfl’J‚/…¸È²›³‡¿ÀÀÊ.èD²³àÁ"…gçÊ×”ùÈcöo\Àý{ á þF+rv<»}:/|ìåÚ©jØ7ë0# ¤3N¸0=¤æ[ƒ¡ï§ôÞáU˜‡É±¾XNæu¨.Ñü% e :ÓÁˆðT ÌŽ€jž8à9²·-¥8¹N³?´Î²ë Jß/ ™D;ÉiíìˆtsÐòaè-%`N˜¨”v±Sðæ–I<Áê9•z$ÿö…¿ÿ"˜°åÚ'\ÅëZrÅIá@¯Ê@ü¦wöcÜì+߈1+*‰2ª 9LøTA ja"—%艬½çÁ O:Òùxäá}›ð›Ñ))'ÜrÆQÖ§’­Yp‘ß®bU- pî`àCЭr—u†Çüu5”Œ93bØwÎHjFmÀàÓç´XäùR…e–W†*äu6«« Á¡© [€’©å4?kënÆýæI‰#EVŠ¤IJ#ìf ‹Xÿ~ä¹¥»Ÿ¸¶o¤ZŠ8E`¦ö0¨ëÛþY´âpFÁØ‚$–Pß²ä(ˆ¸}Lƒ[[ˆ~À\À~8ÞbšÊ"êh0¡6‚.x„›,¬¬f+N×3ˆuÁ9ñÜ2 -Ês碿¦ƒ<ÿÄ Á3èŸRE±0•"SÁ”ùV£þÀìâríS©8Œ¢Tû#t-ÈWlƒWÚòý^lSè¦$ú–ª“$Ì”:Rhß¡oxí”RŠ*$a,*YÝHZ xã6V¶œÔ»½¯ÉÖ02l¼o0%)‰»‹«+,>H#ò‘™¼è—Çp•›xÞ,s*¹Ãþÿ (hHÆ]5Ì,Ð_ðëÓÎØOC-‹›j”›œ§t°!Ch²#tõ耑0yFt ¸ÿR¥âL¯Jüñð;l¸Gš¿ýÉkÕdûµïP+†/‹=÷L¬Ix™&EÁw½¶5øc3Hno°¢#!¦ñipÚtØW*ú& JŒ»V{áÖÕI2Ò SmlFé¨Ñ½Ç›~‚ûò«Êyæ¦Ä4^ w]ïcÂ\ÙØ]ï=Ç•À†ß€`ÉȤJž-º’|ò0˜K¥p'ttz -á6—Õa‚²\î -­µ>wÂYwµøùÈã{yZú–7Ó -Oùv¼ v‚ÊeÉïbð½#¾5ÓSñ‹N˜Ñ? aÔËVrE¤'W’½0¹ô6ÃtŒÎ,‘ÒFdî»hA'G¤2àÞœž2·¾Â" -®}F6­ùxáÂ?6> kÛoGT_| £3z5»v æœ6¨Þ·×:Å8Â8}¿S\Ð\íc…¹8/tŠZ:ÅÇU‰µëØ&þØŒ5Æ!‹Š ë3µŽäKðýÀŸ©móÕðø7ìc0xÝ5Îâ3™k½¦îÝKÎ4W{ÍB…Eé[MŒ-ï>o<8æÀY¼”*Ô ð¨DHH!gü¹ËÇßOUm³• 虳·âóU\bR3€¶ãù?s¡8ÃÜ”‹þѵ,‰ZÊ‹âÜÕRÊd‰.=#m{y`ÅÈ–pƒRÿBp‡2±Ìlßèý¸—î‡;vè`3˜EsS§æ¿èÆ=4¥EüÓ¿åøÐ>ºÖ½r#~Ê ws.éê–Å¿¥"%iùÌ„O=ÁyMÛú+Ý&[÷¢e >µVY²jœ{í‘)f„ƒ×é—:O4¯kvÝý ÎM¸Ö-ž|ñHJŸðü:ãÿzM9¸ÚPûSp%ÅII²ß¶!š§N¾o‡Óvþ ÐÒÖ·+ñ¨Ó0ÑGÿjº–3éyTêð§òì(õdÙ险.´Ðïú?]¨Íåendstream +xÚ¥YY“Û¸~ׯÐ[¨ÔŠ&HðÚª<øÜÌÚ±wíIœ”×HX¢H-ÉñØÿ>}‡D]IM•  /|ÝQKþÔ2 ]/H—q¹a –ÛãÂ[ÞÁÌ/ %ÞR»^âÔ³ÛÅ“Wa´Tž›zéòvG$·Ù'çùߟþvûòýj£´»ZÇqâ¼Z)çfµVΛ—8ã;Oß¾ÀŽvÞ¿„©ç8õ:ïeôÍ»ç¯oÞþ²ú|ûëâå툃µvu .>}ö–pùëÂsƒ4Y>@ßsUš. n¨ù.¿÷»ðœ^òªA×–bxn’è^bÎHü‡§t ¼ç(D ü'‰³ƒï&ÿó>¯V~âtå·U¢ŸVkí)çÕ÷H;§(ëÙ@T´ø¡ÀíJþ¨p¾ãþfµöc'¯r<²ã vM}ä^·Ï™¬Æ¾àOÞìs“ñt½ãVŽoøk‹Lãq±즎œÖʈr²ïd÷2W+ ¬†ŸZ M£Pi)édÓX…˜ÃŠµV5UÆ~–Ü+`¶j;&µ³¸«aÍñHWs›­Ù”9Ô'âe€Ÿƒœš¯Y¶Ò·ßÃŒiè$ײìÇ®>€,?­@Í@E°<ÚÌŠºZ†li´®X8P_fº¢ÅÊžØ?±ý˜JñyÁ–Â~ÆK…¬ÙÕHu$ÕT==o…ÖDZô´‡ 3³Ûœxjñò‘s#´¢0k6a=\¦Èdrº±YCRÑ‘ÍÔÞ7ì¯D Ú=Ñ®ù ƒo]Õzu„׎WîˆÒ^Ñ\0Ðw8CÎP7¼™í¶ËLg>Ï\I¸-âZè‡Î߸yeJdPVæ_òÒg’G—iw- ù‘«Àep«[IGN(lÜ—èÃ:œÓ-Ó øÖÇÜÔSoh %º”N¼é o÷>‡tÜÆHôÅ~Á83YUqk¸¹fQX=²¨8r)ËHIÁXIlÜFØÛã†ãíÚŽmws7£gÐo¨£¹ Kö‚I/»¼!Q9Ÿè³.ô·!ë"@¸/%Ù@£ Y…žIo¾s FÌÑ0m!+(p(V×€Ž5ýˆÛ£p‰"á¾ä˜y îÊý]QæSÇ}òW÷˜mà÷/žÁo¶ÙÁï‹g¯ž<æ̱«;3æ +AÔGâ1¸é׳¦èÝkk„€If[æG›Ãà``&‰ƒsŒmÑ'Ó'“}N+)ŦÜ? *¸ÅÆüE<†ËZ˜­f¶É?M2b¦<º–3èr--Õ¹Œ¬ã¬¶åf7ؽπØíd…yý‡¸_2Ü|•¸q¤‹nÉF7ÿ{Ñí5\À¼´‘™ÃTùð?Å·ïä%¯ù®óMG„Œæ\0o!­©f Jyˆ#jUW)„Øî'BÇ.iȳs>€.¸éøƒë¶Ñ!Fé +~þá…zÁNVÛBúÿ|{óo;—toZ{&·µ +c7ŠÒqŒÛš“Ù uÊ¢³Î™¦ìµÐŽê;0Ü|¤hœQIð€Çx`²È{ÏGÒŠÛ™bÆÇõÈ©xôa?\dHðDÜÅEŠ]jÞŽëia@ÂvM×åÇSק,Ò\60®A ›ôìÇ)é÷–Ã9 +»j†ÛçÆa?‚x_Èô‰Ü¥Z +@<Ëd=p‘apY»'÷¡ô)™™NCýCŸ¹ÁÚBZ#ÆÃþGÚ1³µÜŸ7ƒb”Ö>Ùîo@»¬.I3ÃЇ+8yƒqâ Ÿ,]#O?£šâX¬ =)5ùL”¨µ¡]Œ| +O;³Ûø`k4ì÷Fʹ?"MCʨº¾ÔÞÁ­!B00{ª¦L–ï ö‡²1¼¼0vå §¬xÙ£å8E,ÊÜX1ƒÛ-?” ‰T¸zzm5EnÏì)‚4¹áÚ9eŸ Œ„žÑxˆ†½Ãi$ê‡N¯~$p ûäÖdÔQ¥–†fì<Âï&HØ`Í¢R³ºuÒñ‰f‘ l!O¬Ø ú—ÈgYŽ8,çXá‹ã´<]Ž\•sv?ä|X4êǾÈ^ññŒÁåPLŠ‡8|™êà艤ë‘# §);‘M9®ævâ̇€,›«=Ær ¤©bé˜ÛÙÂêLRßõ¥_^õõ$ÇyáÁÌÅØ,i’:®›/#mѲ˚Ÿ%ї܇Ú‹~ ëÔÕ¡¾ZYœ%âÀ2¨!ˆ'¹øA²œkÅã·¼}$ÛF½FãÒÄ›+15WõôÅ’­ò/¬ð©,b„ó7çpž.B;›ü¤À‘J~Hei]Í}Š „Ä>³i¶ŽF´YrB–_à¢AÞ·<ùœî º1&d+öEâÚ +úÓÇZR%ºI¬'WÍž™1é‚ê$aQ¹24)çÍú÷ ±}qBV´Ú]Q9p\¹ÇRàÇZJ³Ã\ÉâCÏ×,¢³ÿïSâI¯ÿGËûçªÈ "D¶ƒÿýd¸Žendstream endobj -5055 0 obj << +5251 0 obj << /Type /Page -/Contents 5056 0 R -/Resources 5054 0 R +/Contents 5252 0 R +/Resources 5250 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5028 0 R +/Parent 5237 0 R >> endobj -5057 0 obj << -/D [5055 0 R /XYZ 85.039 786.531 null] +5253 0 obj << +/D [5251 0 R /XYZ 85.039 786.531 null] >> endobj -1006 0 obj << -/D [5055 0 R /XYZ 85.039 766.606 null] +990 0 obj << +/D [5251 0 R /XYZ 85.039 672.636 null] >> endobj -3089 0 obj << -/D [5055 0 R /XYZ 85.039 658.638 null] ->> endobj -1010 0 obj << -/D [5055 0 R /XYZ 85.039 658.638 null] ->> endobj -5058 0 obj << -/D [5055 0 R /XYZ 85.039 620.371 null] +5254 0 obj << +/D [5251 0 R /XYZ 85.039 635.769 null] >> endobj -1014 0 obj << -/D [5055 0 R /XYZ 85.039 452.769 null] +994 0 obj << +/D [5251 0 R /XYZ 85.039 593.609 null] >> endobj -5059 0 obj << -/D [5055 0 R /XYZ 85.039 412.605 null] +5255 0 obj << +/D [5251 0 R /XYZ 85.039 559.465 null] >> endobj -1018 0 obj << -/D [5055 0 R /XYZ 85.039 150.159 null] +998 0 obj << +/D [5251 0 R /XYZ 85.039 315.724 null] >> endobj -5060 0 obj << -/D [5055 0 R /XYZ 85.039 109.996 null] +5256 0 obj << +/D [5251 0 R /XYZ 85.039 281.58 null] >> endobj -5054 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +5250 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F58 3380 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5063 0 obj << -/Length 2441 +5259 0 obj << +/Length 2961 /Filter /FlateDecode >> stream -xÚ¥ÛnãÆõÝ_¡7SÅšËápx P vºI4É6V›}K”̘"U’Z¯ÿ¾ç6äȦÅb¡á™3gÎý2V‹þ©EnÂH‹,OC£Õb½¿ˆ;ØùþB Æ• \y87«‹÷ß™t¡¢°ˆŠÅj;Ò)¢Ðébµù|ûë«¿,¯´Ö2áò*Ëòàn©‚ßþúËíOßóÎÝõ7×ËÏ«.>¬ÆK=¶”Öxå.>}Ž`(ÔE¾x‚uª¢Xì/£C“hù®/î.þ5Òâ½dÁ§æ$4:M®_‹¨ÌŒˆÆ„i’‘ˆídÈ¢ j@ªmÛííPµ ÀÒ"è—W*xî‡r‹á§å[Û½ÃUTƒŒIÕÏ ´ ²CÙ1È]9Tû’wï—Wq”xËζ]é˶)ùÈ~VH¾fÀï‘Jðº >/ãœéO¶iØ~€»Á> «+…ª,Hö/G¤Ô”½‡EUƒ püy™'AxÎœqf*~ÛË&2A »*,ŒñLE¨5{8–þeLüÚ#7Ím²¤ipoûrÃÀÃRGA×嚬5ÏkZda¤ÞŽ笻¤©ŸŒ‰×[p8NÀž 늾ª¦l][T5ðÓ#ÔqãÅî—`aT³åM¶ -¯w]i‡²³á‘á¶;2¤ÐZ|Aˆ³ŸðV{új#ÄÈZ´¬ìV{>¸A¿{­)ÉØOÈÐQÁ#h?‰òàæyÆS6åÖ’³ )’ <ÉÅ3kÄa»FȺ<È‘uÛ £’Ldµžá[¼eÓÝu¨UÜAËcˆ<¡>ª5^øÀ÷±LÖQ¬ÜƒRnyéTAºcà Û"²CJ/×GÐõL|P4u½ :Ì ‰Qdظ=ÕBƒ¢ÙwqEµò‰7(TW’¢TÝ3ÃOUE?¦;´ò‹®ƒ¨·ä†ZÆcŒ²A+|a¢¡Pö¸Ã”{Ö81±ñg¹¢&üÐáÅDãý,Œ$QÁz—"á6*sÏ—;Z¤(ÀÅ„ö9Cäª,•×d[ ¤@;º ÿB´àYrÏ–ýž! *6Ê|¬MéBi¶‡)¨éNør\=Ì9ÍzDÎqQ$,/CB°ë–¡°BAÖîØAÅçÒ… ŽZÁO” O´ UXœˆ`×k—¸Fy‡Ä :•²¯fض£ÐC:’ø®„¡5£u¶Ù k`Þ×â“"1•$&¸n¸?(¿Úý¡f“h°éQæÝy/c‰o~CDMXd984FM„ùü©òWiQÐ្Ï"Ušcm‰Ãè}œ02‚±ÜÀŽfð1}ã"kÌMÓ…xlÃÏûˆ¨\MŒgR2V«ZéÀr™'¾¿H¡FøSEÕ\Å^ç¾áóîÇ^U³‘ÔÁîÓ35, lTø¸dE¡b׶F¡.™È<ïÀ»é®FîhÇðØ{9ƒŒ­á´4A©É•ô‰“z™±¯ìú“jñ·~œŽ“Ö õcü\LÑÞžÖ”,TŠ=ù·±T)‹I½|lFM–Ò$ÊHüÂ%‰64¯"j綺Êée:VZy\Ÿñ$ü²û@µcp¬¬NR2m¹Æ ¶G€Œï¿3¹ƒ6‹Áò(ìvýØ2ÖIÅE¥FÚο܈c‰¾ÇWô×SsJ,qzÂŒ8[ÿ,‰oφÜÑ°r<Ìðœ‚ubÇr¿¿'/@xÍxCs õ\Œó,Lÿ$¿x8g`œÆaœ˜“¨g'mÊí;îÖbödHæ€ ‘[Õ3<›",Þ~˜PÎfÄ8†¬qhÝà„ eÞ@ñûõL À“×8ï<È©3A\Pë¿<ò\_py–¡ŠÛîSh¾X[å9”ö&8¾Ðô ç‹Ô‹9“¯…3ioÅ„3(ßü,àxǨ-ïŒe#Î`¢±~Ÿ‰h–±nïþþ¯¨3id—(XaëãG^¿V1ÔèW‚©ÌΣ>MO±¼"žZŽ?¹âÄ«bØ>3jAÖ¤ Ç4* ”¸±9m{©5ÕG7œ¬\Ö¤‰Ä"#Ïœ„Çæ6NªÍ“˺ø1Õh8B®Á®3ÌMÅÿ^æzD¦iœüžÆÜÉã¤ë].–¬œ³pÁã°…¥?¡’œøå<¢é•A(Äþì$n¼;7tUÒ²º,¾åú$ß+mPÂÿ«º+ÚtÔÇŠ{™1!sôpï˦“!p…üô®Ù¿³TžJ€P Œ¡ì—u-ËWNFûX"âXFj\ÕU?`Û‚»îa áoŒZˆJ¯=€VyàD=ˆò„5är¿+&@?Ønp-Ñé‘Ë1†Ð‚—3zíã›X!cJQ 1"¬õ*ñŽ«w\ïh? -&?:Lщ0™Ûý׌Öœœ|†ËšºgÀº¬ÛKR’ˆcLP»—Õ9…ñ„ãv´ø!£ðZªÙÇIï kLµ9'8×ìè.vqãç;Þ˜&|Xœþpc ÍñórBP¸?¦9@±üXq2Ê#üÖQ@påboÚï™­äÔ0¾éÂú&¼È£¥ðl±³³‡AZŠ:pê?ÙF¨¯¯ç: mÂDÏNVðŸIþ_­™ÆŸ<,ò3µÞÄЖ¨‘êNÒì%ÇîÏ:¯Yþ/iæ„„endstream +xÚÅZ_“Û¶¿O¡É•‰h‚ 23}p'MêÚ©}3ãø'ñNìI¤BR>_?}÷ Jâ9n7swÅb±øí.pj–ÀŸšYœèrf‹<δš-·Éì8ß_(é‘ÌLœä²¾¹¼xô]–ÏT—I9»¼¦.—«7Ñ“¿>þéòéËùBk)ÏÖÑwsý0_¨èÙSä¤ÑãçßbÃD/Ÿë ²^@ã¥PŸ½xò·ž?{ùãÅÓË‘ ›\£ +¿]¼y›ÌV åI¬Ëbví$Ve9Û^˜LÇ™Ñò½¹xuñ …yfÆ£&ºð=:‰‹Â„«lbÅuŠ÷¸‚¡r«ùÂ$6j¯ñ7.‘»nu…­fž–Ñ°ÀæÒ-ç©ÖÀ#ÖŠÇýš(³©dp»›§Et?/tæÌó,úæžYÕû ÜÔËzØ©ªjpÄP_ÃÇ}ÝÜ0 …b÷ªÇoàã¬n`¦ëdº~ MYÆ] }H¡>ÿáÜ Ü…Æ)ií»D´ó̶$ý{2Π ,M³Âv­jo&wEJ#ï†ûµ´ ‘ƒªßŠ\@Û±R·eùLa+å+¤Xè#,îÖ½CaU·¸ÃO6 ó_ì6Íqn™¾l1Ó;ÛÀ¨¶–“ÆŒ²¬CUÍbÂ.îj3ÚÑ´c·üë6°N˜ô?Ëè5*Õ¬˜Ô3m¹©e…àÇœèßbâa-íWLE¸/×m·uÍR˜Wfãu“¥Ü§ ~"êОѶ¬ý¦!œl¸d…¬Fuu;a¯Ó4Z¹Áq‹$·êºGÀÖàáÆ$ÑÏèí.\§vëÈ?p·È—Çê5,ñ°5©­aOCoÆž­trü)Öêä+tºŠYW®¯{t©4c÷ƒQ7›öÊ¡ùñ¤a§à›Ðö»€íѯAàÈÙ¡ç ×üŠ‘²nøWÁ Gßé1Úäy¬ŠT §ß^Åà©×Üï•L›ÌH?: ¼Ùˆª®çß~ÍþÖ„¹OpV•ilRÀ¿Ì~ZÄ?fu73n¼üþˆøô=s‹Ë܉#á´ ÔéL¹‰s˜ ÃðÂãÓá‹4³±J¡ ;,HçÀ Oƒ> ¸MqY꩘ T§…-lœÙlÜãô÷²Ëק+³*Ö¹ùXü:¸/„“‰nÄ»KÞÝn…5:Û|‚ G#0¹'Ø©w˜,ΓüX·³ªÓ2Nm ð\uˆ¡Y1¡ÿ>]o'`ã¡@†'q·i—·Ü¾® ø±ùþy„¤Æm«x=l}ï‡G^\jãB=ÍDñítI’Ÿ â~çÆþ~v¡c£óÉÜ9âίµä¥.tôª<|ôz¿Œ«÷ÕaÕ•¬÷èxL—`aÊÆ9ïÁyR·Ha}êÓR*”¢c]üÎ6WtÕUNšw–ZC½­&@MiçàK’põì]3“iÈõq8™''w® '³ªÎ'˜ÑL+`ÿkò¼þ(Û°¬6´ +Ê18v‡0ünžA&´áž×­ÅBÂåØÒÄÆqäÿüË‚DUá¤Þ3Ñ31þ¥¥=M¤(­AºûHÎo{ßꌺ•¿B +']—-™f[5«þkèšB†ª´ùVfoÚ§á\–²¾LJÉOpǰ㹑Šz4’Çõp:µ{°ríðë “ÎlÔQÖ<×Hƒ$®¼ö]Ï ¥{–òQB6´GëÆáè¦Ô5d†@äd…äÉ14¾ÏUf:¡„aWÁˆN(¯1µq5ç]8û%{OfG¹ jÑødÅàjÂ:’±Þàš)qGH?NVÆùWççF¥ÙgK0DyI|cz •q$‚êBýh1ÆÄ„~M²dU]»ýf€¦’ùÊñ|Y\ZžM©œfó˜»ãNYÚ» ×–ÉæYôøh›<¸¸8ú÷s ŠM€—Ñp¨ó1xe“PDŠI˲üã̪‡,ÓÀ ÅêQ4HêœÁ/`w|ø8#n›¾b>eìYp¢Mã–*ãRë#¿«‹ö¤qu„Ö¡µÍÄUíyܤÓ÷@+'öaܶz·ñìœÜÊq/DîXæ*ò ðŒ7?ÌJHn³ÞÄ ›ã®6Bòãe5;îÞM],pöʨêz«®@0›ï!gÙøêU +‚Øþ¦¨;€øñÕÉÇÖ§)¤šTÈý?êS ÕQªR¬úÊ81ê+PÓ?º@5PZ`§Ï^ Zã4Ÿ¥üY5-žY“=4E G@K¥@6±6ùØR@Á'0Mô÷Wह=Üøê„n|‘öb˜¯Ñù5…W¶û"0^‰.¹Ë3>š²SpsÌRÎ5OáÉ-×úD¢èÚM?ñŽ’ƶ(Xx“týà«Çåºê(®ILäøç¶ èM\Ÿú½ô¿[WÂë(‡hüzHB!AÍ1T"¬Ìα©oCVa¢çm7´$OG?S@Û÷ä@Ô­mŽ”|Ms®È¨5w">M’äÑĹþå'4}Ýa綻 7î(ëëd\ž³peÏ,ÔÃIW€¨¹¸çÃ÷<‘ÛÉËŽxCÚÀ— +ÛÝàóT’ßÊøåá F«‚R…QFŒðê’yE9ËÁFY®Qn×öãoüÉ£¦Èr”ö‘E0-Í2ð Ùr­‹hÔ”qRkàÎo–Hu†æüGÛCš† ÂsYçaGœºŸ¿Vî`¨*ÌðÔ‚:Ñ~ÃæN!ùñc +ì¹hžEý½¼ömñ;§Çˆ‘ÏC×OÔœ +£ÌËp¶£R²£“NÇ<-³hTƒâ|çùSic”!Ý€B %gæ3…sóÏ<•z ¤>û*8°J¼‘¹\úW<M‹>z$ñõË"…Дb%=2ÝŠ"<>}¦ÉÙ…³QeÈÒÝÞ<Á_Q5亦Ö£ZiÇɼ}Øï'–!Ðýa äÕ¼õ9}pCš÷VçßÎ{ÚD>ö‹Oa› ·À®^u8¦H“K:àÕÍ¡ÀDÊäƒ4–£>¡(„öi‚ÊU;*¡FÓ" °È=7³;ƒzuÕÁV ia‡°z\Œ'Œðz}¨„z\7BèõjÒJ¨2÷5ŠIüÅô´?Àˆñ(6È SéJöÙîô€R™ï÷Á‚âñ4)œˆ5Z?u=‚"™µ-œübéüøø<œ›âÛª©«Õœ…:_mmGOãî¦:º; ™!à«û;ÞùÃ; ÃNdPö@!$.ü‰έO¨žÌ14žH(£ë£ÏðÑs*‚þ“ÀÈ›Ò}/"}ÑrÈô×!H{~ɿס²¨e«¨'ÝOaËñ~ɇ> endobj -5064 0 obj << -/D [5062 0 R /XYZ 85.039 786.531 null] +5261 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [276.467 698.333 343.157 710.022] +/Subtype /Link +/A << /S /GoTo /D (far1) >> >> endobj -1022 0 obj << -/D [5062 0 R /XYZ 85.039 724.712 null] +5264 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [455.255 404.701 521.945 416.39] +/Subtype /Link +/A << /S /GoTo /D (far3) >> >> endobj -5065 0 obj << -/D [5062 0 R /XYZ 85.039 689.966 null] +5260 0 obj << +/D [5258 0 R /XYZ 85.039 786.531 null] >> endobj -1026 0 obj << -/D [5062 0 R /XYZ 85.039 447.943 null] +5262 0 obj << +/D [5258 0 R /XYZ 85.039 684.585 null] >> endobj -5066 0 obj << -/D [5062 0 R /XYZ 85.039 411.076 null] +5263 0 obj << +/D [5258 0 R /XYZ 274.69 690.558 null] >> endobj -1030 0 obj << -/D [5062 0 R /XYZ 85.039 287.621 null] +5265 0 obj << +/D [5258 0 R /XYZ 85.039 390.952 null] >> endobj -5067 0 obj << -/D [5062 0 R /XYZ 85.039 252.875 null] +5266 0 obj << +/D [5258 0 R /XYZ 230.493 396.926 null] >> endobj -5061 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +1002 0 obj << +/D [5258 0 R /XYZ 85.039 271.765 null] +>> endobj +5267 0 obj << +/D [5258 0 R /XYZ 85.039 228.812 null] +>> endobj +5257 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F59 3455 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5070 0 obj << -/Length 2393 +5270 0 obj << +/Length 2121 /Filter /FlateDecode >> stream -xÚ­Y_oã¸ϧðÃ+gEEK*ЇÝt{Í[¤·Þ§½}m%VW]K9×ß¾óc+9\[‰È!9g~3èY?jV˜8Ñå,/–±Ñj¶Ùß$³'ùéFÉŒ…LYs>¬nnÿj–3•ÄeRÎVžO™Ä¦\ÎVÛ¯ÑÝßÞ?¬>þ2_h­#eâù"Ï‹èó\Eï¾ürÿ÷ŸxäóûOÞÏ¿­~¾ù¸ò›b)­qËÝ|ý–̶ ÞÏ7I¬Ëbv‚v«²œío2£c“ié·7ŸoþáyñX6ãUS'4ºˆM¡¯¨Ìĉ—YNG¼œ/²¤ˆÎó´ˆì3wžá„ý|¡¢ûe4ìæ¾]­ç‹4ìþü†‹j^Su[nôvOKm'#ñ©{ad™´¯¾û¥À’?¨×OxÂYØ(]Mí¡ å£ô«èÈkv¶¸'cðž@g …*-IM‡S>#°{„Vµ‘ó§¹HSµ@niÆÉyôîpÒ!ydzÁ®î¤³«ÏÜ:5mËóŸhñÀäŠ?«»ÙÃvpT>&öN”æ¹÷ †pûö0F2†n™jŸgïˆI‚xî AÙµ9võ€ÌéÀ%ý÷¹Êj×0G ìÙË;ìd£ïàHÅÁÃ3ÏxbçgZãµWý(ÈÜ’xöùiÇSî™×‰±meËI»güï„«&Îÿqz3È–"08í?çpʈ÷. ©âÔ $ˆòjÓe„¤Â‡$¤ïow‚xpΞ“86`T ÜñQ;Õ±æøñ0"ŠCb]&Lâ-;žÛ<òÈ™nK¢xÃÅ%l3h¼´FÄ"P£·Âƒ YáãÂë„¡ëª÷q3vÒ|­ðÁ^gYpLèð1¡ÁÖ:xœÖ™¡Ë;È<þà9ÈûÜ€6PØ»âìa]€æYþ~ï,[4õN8ÅßVHÀ¸HÛvbdÐþò!Š‡žÅøŠ±‰B)ÎNŽÃvBYëÖ›Å'£Se0³Arñ1êé)¸áÈ£ 6cµý‰¶2q™ zÈýŒ¢íPtÝ*3…ðö{kÔÊ™ÛÈM -žu{í žeñ`)Zt–<Á|á3ÒÈ kÁinYfþkn‹@§ä+Ò}–DmÕܲbgØ&WÂïÞ›ˆ‡f­KJ.p|/h)Ṙa¾ˆ½‰0ƒËYµy…ãT¹c@‡’+kÄ`èTÁ«ã(­}i4üˆm° fÄ¢¤²é‡œïZÍþ¨¬KÞFl•”ÓŠ–«­GxºƒÔg2NuFY% žø†my-!5|œ×£V5{=Ž£s–×L§q‘—oæÁœW(b“艎y+ѹ¸û[ý®škf>3¶|¦ókB'&Vyñ¶ÐãœWëX›2¨¼I•5Æ>ÆhÁÑ•e;) ´ªµ¯X0ž«|,QpIPò%pÏ.šc¯j]ˆÄÞ¡ `ڙȋl EÏU >ÍoÄ‘6<¾e³9ór®èX×V-÷ÚûA¡J'’œá9B„OQ$dÌ ‰[ùÊm; a-j2Y1‰y/‚¯.c~âøÚ°En~ø6¡N‘†Ê9:ŽOM€ògyú)ÓX-‹XÐ$·i&Ta'‰ÕÛŒ¯ª’€wâx$·ÉeÐËË”¯ï–-]ûÜ›ŽŽµ3§”ËùBÒ–4Hl¡ã.4xYAÞ¶ëyX\,•d)aBåp^6÷5”ø¶3:_\Õ.äƒ |® s)øêÓ¨mz—h_å=!Qæ¬!\›„ïŽbVÕò[\‡pQý0íãW±$@÷^û¬u® -K-UFwoh­”0 -_;§ù®Yê«â)ú¡qµ§?®°¹Tý–*¿$z? N¡):0´?ÓKü -ÙRÜ´mÇ`¨&æ¶,®Z®èÖí¨4ëVPoÙ@öö¹w[QFC38ë øëPó5õZ7Ê8ÝN¨‚+,Je‚· ¶Ô§ -¡º#AÇÇÛ*®üû /ª†Ñ%_ò‰p ªä-i®GÇŽ+ -lßò3•€ö(™°¯ïFˆ“}~#{µ 3at¡6¤\ HFq¬®Ã,‚gKí-º:TnHY͘8k4Pè<ù2•ž‘TÉç2º ÛD„¸|Ñ$âK霸Ác píY,dÔaÔ¼t]΢óÆÝH=:B.YÕ¹pŸû…ï9–ô¯óתs>^£wXT”ЩÖí(ªÏ`ÒÑcƒÛðl(í#„ ÜX¬ µííTa|:튛p¶¸—E(ˆEƒwh°ìM=ý ©î”äuðå0 ©;ì~ïMhKŒÑ‹tëîšH£G@gSu^½8ô•bZ3…ðB•&—§P…w!~ÕÝÊNA¨¢YÕZ^ÖÂ×(àçÖü¡Gœ‰zD›8Ó“ï°ð˼þ§8EM—E:]Ó˜4Så…¡BlY\Jìþ3u-òkm¦Úendstream +xÚÍYmoÛ6þî_¡2P«¤H½í[—¸m¶4ÉYÑ…bˉ[J%9iöëw/%[Ê0 Û0ˆ(y<Þ=÷ð(KGÀŸtâÀ*q¢8ô%åv"œ[¼›H3B8Úa€¢“×oƒÐ‘ÂKDâ,Ö4d±úä½s±˜_NgJ)Wjo:‹¢Ø};•îÉt&ÝÓ9J|÷ÍÙ16´{9ъΡqizOÏ~>9{7ýmñÓd¾èY0Óžšðuòé7á¬ÀÊŸ&ÂSIì‹@” +@7¢†nÉpÏølîÀÔz"ã«û¼‚.‘.„@±F¯Ñ(Úö7¦[l=ŒvtÀ>\óPë |١ôŸ ÿðýâ¨]C +“š»Ö lÑÔɈ#,C÷Õ*Z×pTA\²M–’ˆDõsÝPÿ–ßóÞÓ•™·6êÁÕ[ú*ë#@&þ é  ƒC+2$Ù)&þ¦MHʙІ9ek)à +!>ó†GQ)¿pÞ`ƒ@¼duuþº*·<¦¤©–Ç@6ÌòȽhOƒúOëö/[Úã3¿Q%Uò³‡s^rÎgðUkºµ}á) $Yhp¤û;.SqV Ô°lif§ÒÔjëB@ÀÒ¦SŸ­ópØ¡ß°¯Êns&®øÌO=ÛÙM»Úã,O‰¼[`÷úp/èPÇ#ÎqñL%-§&¾›hg“U”ò¡Œ¹(:î2fPj€JDÚ£®Ó´Às$-®ìÆLjðØ}2_ˆp\Å53Ž¥¢NAÄâîá–„ƒP¹7mÞ#h,g«±³ç#qr•ŠÍ¿´YËÊ×ÏÜKN½KÉÿ8-8: NW+³Çð„„¨rhÖÏFZ‡@aˆ‘C ÎBô¶ãþê¹5Œ1’ñ¼]Íä*ZÜB{ìÆþËZÂæà šΚ²òp^d‹º‰Zû'µ”î7”TÝ^pð °ÓnâÕ€6}÷)GoøåCM­EŠoZŒ²1Ò;3 Ošþð¬¨wU«ÂòŠ™1„T‘=ÚÉsr¶nÍma•s"qºaG†,Cp[6cx#–R"qû)JÀ¶‰ˆ9ÏDÜ% Là²Gîò*.@ÔCKM0Á¹&ÇÛ×–BHý µ°x¡°@Á]Zsã Ü|ª@[DAspˆ€P*Š/¯Ñv>Ž:B%GÚÙäD%àü.Æ®Ü<‘?òeUr‰…›mlÙ:ZŽâI.¹íßf¤¼È f±ï%p÷ê]EW ñJ"áÖü ܽ¤–£ pK”€6ÿE54I€n™ÑûZOÅNzaâÛ R¨)½óº» •ì"ô÷È…@×0ç«#=¡“D±´×&;»IÔñúd+ã,r:£Tâùx/U^ÊîÞÜÛ0Zl´fØ@KuãfÃ"-70AÍE)ÿ²­»µ2l£çE +s¡ 9hatoÖ ‚âD<\g—qÏ®«žPcÉÏU^ÏFÞ´·7ñþI<ãBµ[F9¦rÕÁü‘OšÏKÃ4D ÏÖC#VaâIVÚ‹ýà»Ð4Ó°±nì3œ–|Àg’%]ó1ãåû»=–}?„|/¸‘nÚ¾­˜ážùíCøo«”¹‘¨ Eè:zŽÓN²5†©–°ï¦§Ij”ÛöŠcZÆÂöº¤S«cbD3p@Ѩµ¥èÜ–{?`8_¿U}Ÿ€ßdìC0”ªÜóþçùÇ/§çGoN¿|xsôþälþY*}…õñ[„Ëv^œG»ªÊŠæ¨,šªÜ\e Mƒ»L¾Ìjl¸üõj{ƒ­‹´J·”ˆµU¸_ocA +Û$¸—ów_Ž¯Ïñ“¾ +~ใO9’/ÇÙ:Ýmšö&`‘UàŽ/+³•J/ѵ „§Uð_Òu 4+£¿›`fô]GÊÓaø¿£k_Üþ’®í HÀô+öù—)1 "ö{]%b·+odÜÇŽ{SõâýøvGLËžëÉH™düfÄÄÞðÌr" ¾÷’9cdþµ»ˆ™r‚Ö«øK!¼—¯ø.³}Tï›ãÔ0@³³µV¯œi®iøãi¥/-e“±˜>dXŽÃ™µ › V¦ØæcËÜ´~ÿx! ¯†å>Ÿ“pÎôÜoOß=·ß|z6EÖÝîjsaß»ˆñ!jÜØÓåËç—Ž=éïJ¯öü^$à¡ð[|lóB_ÿ?ÃMy 7mèɪ}–>ôãÌ`·¯Ç;0Kß—{… Ùmüå±.#=`ðÐS@y¢oàŸ@ÿ‹endstream endobj -5069 0 obj << +5269 0 obj << /Type /Page -/Contents 5070 0 R -/Resources 5068 0 R +/Contents 5270 0 R +/Resources 5268 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5028 0 R +/Parent 5237 0 R >> endobj -5071 0 obj << -/D [5069 0 R /XYZ 85.039 786.531 null] ->> endobj -1034 0 obj << -/D [5069 0 R /XYZ 85.039 697.613 null] +5271 0 obj << +/D [5269 0 R /XYZ 85.039 786.531 null] >> endobj -5072 0 obj << -/D [5069 0 R /XYZ 85.039 662.868 null] +5268 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R >> +/XObject << /Im1 4209 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1038 0 obj << -/D [5069 0 R /XYZ 85.039 432.879 null] +5274 0 obj << +/Length 1820 +/Filter /FlateDecode +>> +stream +xÚíYKoÛF¾ëWðV +.ßLOñ+MêÆm" ‡$(h‰¶Ó\‡¤ìúßw^KRÕI1P0÷1;œùæÛYJYü)+\/Ȭ$Ý(PÖòvæY×0ój¦D³B׋#œ:ZÌžŸE±¥<7ó2kqE"‹ÕGûø——¿/NßÍ lºs'IRûl®ì×sGÙç§8ãÛ/ßž`#´ßÂÔ1N]@㌞_ÿúúí«ùçÅ›Ùébdºa  _f?{Ö +¬|3óÜ K­h{®Ê2ëvF…ô«ÙûÙ½ž -^5±Q'T™«RxÂÛ‚ ßpMlø´Î/«ââ®ÒË›vîD~{zõçɇ Ü v=~膟 +w…[QhFFJNŠ«|Su/Œ=>y‘ÇÚW”õ +†ôÖ>иs™·‰@%(âÍ}ш8¢¦¬aÁgª ´VÔ¿u¨”%6¾èÆ™@cÛå]©ë–é…Þ€ËqeÓëAƒ«¢%Ò@§yM^Ulr‚&㈼‘Ú+³CTõÈ+õÝx'ám6ݧJzuW.yÙ–ÿpI½=X…kÝ]t1pŽ—XNé¨ïB+Xà&@NÏqßž@Ž‚dLAÀMNÆÙ.æ)zÔñ³Ð¾BGÿ`/²—ÀB›¦à)}…O¼#µ ÁˆîF‡âb]³<*áÜbù†Ÿ¸¬Ñ×›ü–W•Ý3ðº§ï8Nœó^}bßœÍÓPl„SˆyÞâì¦í¸wIñ—)~7N1åN°òKD‰ð«@uCHæÓÝ“k“Jt÷Ø#Óp‘oà8á#œx@›5¥Î‹ êI<7 ¢©ãNÅÀË!ó E€°YÀn²« +ìçM)Å©±ÎI´¼ï02Æ­$# *dg(µ.†ÄFH·)¾lzVêÆ °ã'ö|"ë0D~H¨ÒÌ=%˜\/e«µÀKwëBèJèPÀƒ¾4cwÆé=B8®Ÿñ\/d˜šà&ª¯›¼Æ~7æZ|&õ8\!¤Ú]´~«ó³›þÿØ<€M D_,|À#ÌãÞuÇã„é<4%z°“C—ÖÂ\gjh3Ž¸¾A7Œ¶´ )o Ê†•äXôk{ØDó¦KO_ìScñN·‚®7©Î»" ä%TrFìnr?o–zS­F‡1>=–¦äÑ>›ng±¼Z)·XË¥ª5 6!U|íá|“G½jy†RÁܩƧ0Œù?ÉýÊœï&Øc_è>ÇˉE½á„Çû å0,(;~îAƦèÎ ÀŒT$½íTðss9*›ts,™¨•½[« +=wsrg8ð 3°tÖÄi20+´ÇžM“0)[nÒ¨—ÂD7Q“óă!†²%üF… ¿ÿíÈå§D¯¸/CGЉÈMÑÑ'ˆ©ÒKꈾòjùÓg³èS$Š(Þ/Îa,oéÒ‡­ª1‰6%JF‡Y¡Ùd Ù(¢mG¦F÷r’Dú‰"ûRŠ¤~(æÊ®¦Ê,VpoFcóº/vQBo[¸O kÄB\‡•[bèìsŽŒ›ZÑ`@jDÚÒRèÙGd &ùfÌ/¸n-Ñ­Ù+"˜¿1ùò­Š( (s½}TÁ;k9M{I2rmоâuãÌhy¡–:uw{S”‰QÄ󕆟ž°#à.™ÃñîSâ‘%jc f@‹.HŽ± +¥h| +ÝâÀeŸÁ9–ÒyH;µÝ(“¯î{öÖÍ#4†‰(dlŠºC&ñ÷Cj–í~Êóîîç„t|Ë*ï$ÇÇŽCûè»Ê㨂ÍÛµ©¶+'_ÃùÌGAÎÿ™TÉŸ„Ó¿„Ht¾ïwˆ ¡_]‡é@%ÑÞ÷ô7ÿ`Îøsendstream +endobj +5273 0 obj << +/Type /Page +/Contents 5274 0 R +/Resources 5272 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5276 0 R >> endobj -5073 0 obj << -/D [5069 0 R /XYZ 85.039 398.133 null] +5275 0 obj << +/D [5273 0 R /XYZ 85.039 786.531 null] >> endobj -5068 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +5272 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F64 4225 0 R /F18 4228 0 R /F15 3032 0 R /F41 3054 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5076 0 obj << -/Length 2259 +5279 0 obj << +/Length 1383 /Filter /FlateDecode >> stream -xÚ½XÝoÛ8Ï_aì“ ÔŠ(J²TàÚ\vÛݤíÕÞ;,Ú¢PlÙ¢,EÇÍóEYŽíôá€kP˜â ‡ÃùøÍjÀŸ¥±èl4M?Öj´¨/‚Ñ(¿](á˜ËdÀóv~qùkœŒTàgA6š¯z9YàÇY2š/¿xWïÞ|š_O´ÖžŠýñd:M½ÙXy×W~~ÿá7¦ÌÞܾ}3þ6ÿýâzÞo:PKi[þ}ñå[0Z‚z¿_¾ÎÒÑƯ²lT_D±öãHËwu1»øW/‹iшW:¡ã˜¨ÌÏÂøe+$‰ŸIo…¨ÊÏâxh…8ö“hJV€ƒkÎœÀùã8ð>ÌÇåÝÀÌícH¦Þ¬XlMiÇZyOç êP¿¬Ùž‡4Sñ ÿ„ÊMšÍÇ©öZv•jÐêk ¢õ¦@R -ß°¦À–#ÁnŠf¦ž-¹-a‘ìH²dÕVðQµÈµCÉ%|6kf4źìpÒš1˜&ÀÙ§N¶rûïÔÏœ¨äiÉùÝx‚¼¤äk´äå¯zhù:7GÚO4é—w\ÿõýæãÕ››ï·o®Þ½ÿpýUéhö×l~}‹£«­1Ec¯ÚÆš¶š–&ù ‡7]þ ·_L†QFr©êE[?€îʪ´OUñXT¿üc¹kÍòuÀÿ4«xà§ÉŽBÁ=žDQêMð'ƒxi–<á|ƒcSUÀSpeW0sÛTdfð5f`xWUɮˑá«cæÞ¤UÅ[¦;~ã†0Å{fgâAy¯€ƒ€@‡™Œ¥r˜oÜa×-©”[úZÂÐ?S™¢$ð“øåÎaÀÓ×L”(T¦H+?Ì”«™&' ÇŸk“/+f^ßåç -S(q?QhÏs¶Tê ÊiÊ®üT9ÃähS&àC0çÜ rÏ!azëm‘?7Õ“]ó\×0Ҩ߄”E‚Y ÇçÚŽ{2`'½@â¹LT|cíÃëËËÝnçwh3¿5ëËçÊh°F -ÝÜ2Ï,çxŽT80Ö¡]‡*¬ZÉË-#ð‚Jr(Ç:FIår±i€Ñ0ãôB> -Ôm³(ˆK’º£˜óDS@ð ù>.ì.H†œºôE”H¢,\Y0û¼¢)*çeTªj.NÕÑ”5Ì—û ÖÖ•V~;&`®—ëMÕ‹…^×Ru!¥ -Yj[^B5Šb½QŽºA¤'ç;tŸ¨'C,8uD >âTÕº%P²: Ú[–cÒ Í #ïê@J‡{0—®®g{¢nkøë#Pf¢L³d“V8Ví1령ᣕةŽ—5E$^o?€Ásˆ¦õ§/·Ò{–³x¥Uêë¾Å®®ÚºvP8umL;Ö-Ä]XÊ‹ºô,g¡*L?JRR† -ãZ3*"0he¢ÃhšzèuŒ“4Ø·*@Ý´åÑC•ÛžÁÔ̶h1õš*‰kú§÷æ\' ž1lü$*t, ä\Þ–TSœÏIáh¥ðà¸vѳÞpwJ²ªò~°Î¾˜DÅPŽ”&C_eqž¯ÔØL«ÀkZˤ;Ž2þ€ -=hNs3h¦“iâíÛƒ¾Q™b6¡À²ë»OÁ¤à¸]Ù¢aî}.üp¥9ØÌ’ŽtØÓ2ýî?а¶"ód_"º£í7Å6% -Ù:êÀ(:¼ ‘b* -¤‡‰u5æ #胖ãÔä5í]UÔ´µ¦ÈÜÊîîÔ86ûÚKqGBra¬9n#æšš>¹\¢ôܶœyÏ,°Û€ºa’¸r#+hjG¢q„"¶¦á£‡Í|±¢Hà+gÁ9óu§°—·ã#»Õ<ÍÐú7nW Uq‚2mk1£•5¸¨´#/šaÀsÑU”AKèù†6Î2BEæü3¼ïòc -L.°M¤ -eé±ß» ‹>»A¦w”Q°ú†Ðån0ék¹ì»ly®s™(ŠçáÒ"WÔ³qxaóÁtÎK—ÅŠ¥’ ¥¸˜b‡QÆQî‡æ\HF*ôøÞÌã¡<„G”×cÁ<ÕB$•þPã²Ú½°Xªo ‘sð¢ážUËOMhÚ»Ü5?H¡$°…qÚÄÁûO‚üË%´ë«Aè©pêå¯Èœ'િö• sN%ï`.–ƒ«¦!´ZoÜTÁ2Ž³4­·4ê‘¥qTg¥é¢B±•¢Ÿ†œ@Ä«7žÇÔÅ¡¬ôBwÏ8‡IqÐY0)ïb%¸ð‘Òðï¢Q>ZIWâ'ÙA¼ó“M¸¯¥ 1½ã ¤îíyì‚ÞµßÊ¥¹°bv,½0Oñ¾fêQ±ùé1i»ÞHóÜ· âK¹©ïŸSsvõ¡!ñÀ=·âqZó]4Ç`´=œmár­O¶¿ðŸOü?=·ï/Ù©Ÿ¥ái˜‹CÀ@Õ+ChŸdÏ5Ž5Þhõ •ÿ áÍó×endstream +xÚÕWmSÛ8þž_‘ö 1’_ãûF!PZ +=È sS:Œâ(‰'Ž³Bþ}÷E6&„ƒÞÝ—fðjµZ­ž}v¥È¾€?ÙŽðâ~4 À“ýdÕý9Ìœõ¤±}ßa€SƽÃÓ ìKáÄ"îgd2ž~³Ž?}®íçy–ô{ECëÔ–Ö¹=ÖÅg\ëèòߺÁÔ1N]pm´WÇŸÏ/ÏìïãO½Ñ¸ÁÀwüÐÃþê}û.úSˆòSO8^<ì?€,ÇýUÏ<'ð=3Îz7½ß[/<ç÷yÕžƒ‹ŒØ öƒ1ÀÃq ‡ j š   HKA ¬[Û“Va{Â*— ®jU§E‡#ëF—?ÒDóaÉëIAÔUƒÅn 2räÐ…˜#'Œ½6/Ø“œ;éù?þ¼|.î¿<¿¡öf[Õz…îÓ:•ˆC̉ݔ¥Îëã¢*²]Ó2¹BùBå+•ßåÒœ +•_U©VºÖ%Åc7r€Žÿ¨ôÕz]”õ&O«:M.Šd™æs8yÀ³û“Û+$àèVQòW’[Á‘äïDÏÔ&«k ès'Q— _Zrx*»µqùžz!ù/ÒÊøal¥ùR&ªÖ˜£}Xèz¡K€ÄB©§i‰ Cˤ.Ì|µ(6 Í¦!ôÈ:qÕo(¡Ž+˜ kM65 + PÝàƒk>LË"ŒŸƒÑ©Ì˜üMãã#4/¢ZE½«ÍÔ”§¦ ++^EàÁ·*V¦sâ(oÓLéÂxì¡÷+h¬›Œ¤¦ß<4—ìÔôÕ6pŹn¼c‹†ÉåS÷Ù)á=tý’æi¾/Êb3_¬Ù¿«  ¿i>KóûŽ&ÛéâZ›«tRÀÕôV¡‰7Ë*ê^x2ØSV¨å;„UJü[!¾YPÁ!QòÁ²¤ `Ž ]£IÍ&mYµõ6åTl›ÕfŸWê“í[vÏp«Ò,IÍF|Ë`×2Á—Š÷å0ö¢öân.i  ó ëÞ³O!Þ¯|s-Ìå†ZÈMþôÀWÞû£‘1':SÛ÷‘E +q „èò¢zëiŠ_{ ¹‚‰apïfš.‹2¿4‹gA³teŒ^¡BlòiŒX•Ñ«gɃ) Âlzþ¾.ÿ¶˜™ùôŒzì¿åT¡CšxLtwÃ6kh@ lÓ°{ò¼‰`§æø’>†­LUCˆiË!óØ1ïGœk‰d9?¼b-R“ßCx‰<2§ }fb´ó&$.ô˜Ž×µY"a®f5šæï¤$_þJ­–·*}­…É]Z’^ðêƒÎ„ýý:“†÷³ÐÃÚ”64¹ï&£p7P:^?*»þ„ÓÊendstream endobj -5075 0 obj << +5278 0 obj << /Type /Page -/Contents 5076 0 R -/Resources 5074 0 R +/Contents 5279 0 R +/Resources 5277 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5083 0 R -/Annots [ 5080 0 R ] +/Parent 5276 0 R >> endobj -5080 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [207.588 389.969 329.852 401.961] -/Subtype/Link/A<> +5280 0 obj << +/D [5278 0 R /XYZ 85.039 786.531 null] >> endobj -5077 0 obj << -/D [5075 0 R /XYZ 85.039 786.531 null] +1006 0 obj << +/D [5278 0 R /XYZ 85.039 766.606 null] >> endobj -1042 0 obj << -/D [5075 0 R /XYZ 85.039 766.606 null] +5281 0 obj << +/D [5278 0 R /XYZ 85.039 748.602 null] >> endobj -5078 0 obj << -/D [5075 0 R /XYZ 85.039 746.277 null] +1010 0 obj << +/D [5278 0 R /XYZ 85.039 579.186 null] >> endobj -1046 0 obj << -/D [5075 0 R /XYZ 85.039 460.651 null] +5282 0 obj << +/D [5278 0 R /XYZ 85.039 546.764 null] >> endobj -5079 0 obj << -/D [5075 0 R /XYZ 85.039 417.698 null] +5277 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F35 3036 0 R /F15 3032 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1050 0 obj << -/D [5075 0 R /XYZ 85.039 347.73 null] +5285 0 obj << +/Length 3242 +/Filter /FlateDecode +>> +stream +xÚÍZKsÛF¾ëWð¶`•‰`ðÆîÉ–ÇIlg-mùä0$@%€ 0´ö×o¿fuØKJÌ£§§g¦ûë¥ü©E¹^-’4v£@-6õ·ØÁÌ»%Þ"t½8©77?üÅ å¹™—-¶DòÿîÜþôú·‡»ÏËUŽ +Ýå*IRçÇ¥rÞ/WÊùõg|çõÇ·ØÏw0u‹SŸ ñYFýtûËûï–>ü|s÷0’`ºa _o~ÿÓ[ä åÏ7ždéâ mÏUY¶¨oÂ(p£0~usóo˅篚9èÊP¬ÏMÓОXE3'~Ø—J:Ýq¹òS§Ø”x*,d´ßÒ(kÓÚë[É0Ùxí_KdÐòäyé'Ž.{a´… jZnk¦Øࢪ„ Z~ÀÕ†sÔm!b5 ËE€†‰ôûÍ檆è6Èä‘Ç×0ÜkýÈ+Úâë©èzŸßCáMet÷µ®*# +Èég©ó×2Š]ÌpÇÃ$7nîg D;ÞgžË‹¾ ù¾l„¢ÙʲVwû"—NU|`aZã"¸ ÚÊÏ2ç+n[nðñ|OL·Æá~F¼'جß%0ùdåFŸº‚›UÓñy¦÷€Ò¢öo4mMc?×ÈN»sZ «ƒtÞèVrÃTY%ôa8tƒ0+!ŒD`k ‚óÛ20oСø]_P'âÄy‹j§Hyâعm²%ÊÓ‘n{*™ï&ÙsrE®Rþ÷ã=ÞE;Ox›Í ;‘³×ØcUÇPÔ¿ã È9¯Ò¨N·áÔï™—±Ñô=®;ì:&ÈËŽ^_™ßh`9åaĆ 7KXå÷$Do´‰×§^xâÃõš;«g-îÁ7GôǶA‹©Šú9ÝЇœ°ËoY/HȧúˆÚÑÈJBAÖÇ¢íJ"é_1ý~°1¾ Õ­4º¦6C9J]’t +¯’÷û»;Ù‚ pDSÅVh¨!3±†î'®p‰‡ø²LCGpëê- &µÃK‚ ëÊHŠx$fÖ2®%ζÅSc+/˜QÕ’¶I˜‚úT‘—'CA½3iYûȃ{ÝâV W‚·'~tÁAÙG`•®›ï©’Sm5^GÕ㢧ñÃFt%$@Ê{‘j€ a—Á2À¦aš hF¢FÚjiÁ :T„¦î¤WÖe²Ó|+´Gѹp a3`"-hó9©®ÝST—´”`#U»ç-“YkÅ›O1£Ì¢Ÿæ½ùÖ: Ÿ‚lÈÀ§¹µiZc3¨ì¥üò2¢·cS Á^Ø ÉŽº7&ÍSå!7wò//rÞ’06Lõ¤Nƒ‹É—BcKÏcë#{•žÉ†9'·×èq€…ó6²÷XãQ¬/œ÷ av7â5S…©ZOøIŠ°}à +dÑq^Ô>‰‡¯ºf£›ö“ 9tÓ0ú{AòÛbkŠ©K5ä¹^8-™„^@åŠCeðvˆ!¾CÀÁ•?ýçM÷Ã=à+¿én jÓX$2ß]q  +*n ùsQªE²c[H©Xôkæ… `ëI†Ô“[¶v¦ 3We{žšeŒf!-ÁP›˜CF +‹Ñœ‘vÂ_ ‹õ³8àˆý‰g{ÆnË*®`Ž .£¬—¢vPEIÖ9‹S6ÎâÔ]V\ã+„Údzuc +‚TnY՞ؠz?ÔGð¼bG¡«²øï¥Ø’“û±wÊÆÞ$”…L¡c·,-Çê8FÝBâu¼| +:a"[øÞã5qä«™WÕìxêºÚ3ÚÛhÛ²ÇL€Ù¶ â§èôÀ‹ï¨,M?Âôð`j^¤`†ßâ°CdU‡à•'àÇk¸6êó®Ç©þ¿âiŠ mÕ ð'…tÖü¡Ò¿ð¾„RùõîÀß‘o Û¿rr~ì» „„«T¹¾ñ 8Ñî„âó»ïø¸7§ÝAã'lƒÔƒdÞynì«—œ'ÅJ`<ð‡z%áq:Rôø m9CJÞ'Fq| Ã]Ï .¡Ø$xÊF¯®RggAì‘Ò«Œ«J Ñ t8Iþt½6)˜Jì‚ žò8µÚ5Æf8Õq…!ju®µuRÐ6?hrÖ£äŸ$PNûÿ Skå×̯ZTlßš”ÔäÇ¿cdFUˆ‹Ñ/ÕüÓYi~±e«D%—òÅmÙâq-ÓkV£ËUeR*Ž£2 ÿ…x£C ƒ‡ DÉ|ù_îãÿû§œ qUjïö»ê«’I89D€ÿÇ`ìendstream +endobj +5284 0 obj << +/Type /Page +/Contents 5285 0 R +/Resources 5283 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5276 0 R +/Annots [ 5289 0 R ] >> endobj -5081 0 obj << -/D [5075 0 R /XYZ 85.039 307.567 null] +5289 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [374.061 117.223 414.69 128.912] +/Subtype/Link/A<> >> endobj -1054 0 obj << -/D [5075 0 R /XYZ 85.039 211.006 null] +5286 0 obj << +/D [5284 0 R /XYZ 85.039 786.531 null] >> endobj -5082 0 obj << -/D [5075 0 R /XYZ 85.039 175.202 null] +1014 0 obj << +/D [5284 0 R /XYZ 85.039 712.109 null] >> endobj -5074 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +5287 0 obj << +/D [5284 0 R /XYZ 85.039 667.035 null] +>> endobj +1018 0 obj << +/D [5284 0 R /XYZ 85.039 515.772 null] +>> endobj +5288 0 obj << +/D [5284 0 R /XYZ 85.039 475.608 null] +>> endobj +5283 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5086 0 obj << -/Length 1823 +5292 0 obj << +/Length 2187 /Filter /FlateDecode >> stream -xÚ¥XÛnÛF}×W(EV†Åò~)I¶д´@ ´H‹l(Ò!)ËÊ×wn»¤$Úy(‡ÜÙÙ™Ù3gfWtæ6üsæq`Ù^2âÐ -#N^R8Å@¡/x¬å!ox ¡q.ù)6c+I<ÃjvùáÝÕ_,ÅÂyÅë]ŸoY{/£ŽoÜNvOÆ’²Ä=Õno¸¢ÙlLß„ ÷µ'C»!†–—X³`ùaMV°ÉõzmÚ³Íò¨…´ù¡ËBᦸÇÕÐ5;žê4C֘͂…÷¥æñ¾c†ŽÂöFaà âX Ã#4=AŸí cˆb0ËØîpôÔG¦ÃAg¦Æh‘ˉQ-ßI¬GkÆ‹µÍ¥¨‚Äú(NSfc]Ï»–G’˜—¢…7¸ãèHàª#×ó}^˜ûbwwÇ–Îñ¡¤2Æ"‹w¦Q¢Ø4"rÐ í5ãq^%çOÏ–ë˜m~Û9m§âÄÆ;JÆ/Ù‘9UºÖ/qr½¢‚ *ìh½C‹¦Ñ†‚Ò—,‡€ˆu bÄh±nHrä‰(9ußµ~Œ‚úxÙqoÃ=ÕÛ™ƒtã`ÙÉý$GªO2kb7—«“M—…ëQ Ðþ佺 ãoèòqZ5]Ñ2kâð¥^«jÔ‘ê[s›ëXÂ}¸=ð¨ bÍx0œ-‘ôïh|¸4õ J÷6Kvc kjõÒÌ€·¬²ëÛ”™&Ë&©‚+9MU®%|:¼B¦&0­ÉSß=qÃAä„0ØŽ’ì4’=*aÏ?Z;Dw¸Z²6É2UW -Ë<ìFîZ¦ƒ>n ›&[Ú(©^g4_I)š(õXšØá]úu$X(ŽmþeÇ—ÖÝy}¦žà#»çá,:°¾i¡ìÅȪf"éÞ m -”~b©œq5¿dÌÊn”¤T26Ä Usrý‡éº‘Bd¾õçÏøç L÷€Ê$VVßêlŽ{GW¤&—S©|×à~ssÀ7*,Ä #Ç,ØcC¡’ùܱ¤¬ù¹nêA¼37_Ó…àûö&n87Œ6õ‚§+(I¬¬šs#+ä¹ÑPšáKK.(—MË>M -PÙŧËåDm¦Y¦;d>B·–Á´$°’(fðb‡–é/ ò‚¡ÿîšT—ƒ®ã„Cùkªè§P^r-½.¿ºì›Ç<“ߎ§9: Nn:Ô‡rÀŸc·çý8:‡Èý'ÝN†êз08ÖYskŽŒ,—ðËúÜvÇw|Ks‰H)1lÍRv—nrë‘ï8^`ùÞägøãôÿ¯Ogæc[IìN -\×r }ôŠìÓˆ/¶‚Ø›ù?Ùúendstream +xÚÍYëoÛFÿî¿Bè' +ˆVÜ]>Sô +ÇNriüŠmÀ=4E°)™0EêHÊŽÿû›Ç’¦,ÊÉ¥w@ÀZî gfg~óXFŽ\ø'G‘/\Â(¾–£ùêÀ-òþ@Zwä 7ð‘ôæú`úÎFÒ±®Ärüáýóðâúíåx¢µv¤'Æ“0Œœwcé|O¤sò)Ê9<;Æ…ç\¾Ò’ÎaqiwOÎ>~8{?þóú·ƒ·×= &žð&üûà?ÝQVþvà +G£X»BÆñhuàùZøž¶ÏùÁÕÁ§N +Ó¼¿5pÐIË1‘±ˆ•?ìŒ Þ;w(Ø–°ã÷ÝL‚#|ßurX—pFéÌï`™KÑ$3ØB=Q¡'ªr¬i‰»§i]Á,S$Õ.QB+oZŠHu&J bŸ¥önÆ‘ç¤ì{SÙEMÓ¬õKÞÊËfŒFÐC¹à([…Æ—UÍ[ðý6·°mÅ]™ÕXEÎÌ0)/—5¾øÊ>¢7îĽÆsNßémƒ'ž+/$³ÁmŸ]ßnêjš—s“Ok³š™/J(Nï íÞÕô׺øåkˆƒò*©R“ðÓ¬]¬Ì2›£ê‘/BAŒ1)t¿zI°ðfd^Óðo¹XÔió‹¤ Øê-7O¬$2="I7è|Ý’XDÀ}{›’W¬ÏV©)~ý‰ Â@‡ÂYÄõm†®vå–÷y'ƒ‡"Á¿s¤™&M˜`øg^VÕ¨ëŽÐ 3€¨‘¸jÊ5n»È/)0¹\Ô)Z¹) @­!¼¡X†¿(ëF´$ó´I™3‡óB çÈßeü&3z'tH‰µ­b‡4ÏØ´®À¸øä‰-µb =¤ïŠÐ÷$øÔ‹ÃïKbe“ø¢*gy{¬•MHÕ+sO¾_ò㻬c"†€#cÓúŠÏ?»2˜§üPÌw“ Ô×y°/þŽB.~ ÷eürò3Ž<;ô«(èø8ÛpÖ©àß*`ïÁ²ÿ~¥C0ÃiYñ‰‘BÌ‹²Z™&+­„¹± Ž—å\` +lŠI¾÷ìœZùB»>¬é ¸U--íòý §;í’ *ërѰ8 ‘º´&½16 o“Ö€ìLÕtÂó”kX$U¬Ã N”éöõ¡ŽÄB*…`*ðÿXÕ«'xÖ‘Çt&<°At=Zt=m§ .@l~~ŸÚ¶tFï4بPÁµºc­¨ÿÄ (á ¹ÿcûÐpé °•«´ÉVOE*‚òÁ½Å>š5Ö¿Šq:_±­¸Xvåê‘jß +¦ÝyY$6áQjÉ´$m‹[ä@>{cÆ„å YÉ=PñN×áÜH`&J ;[MËNþƒß+ ‚ i}kêÝjØåH·=جñ°y–&b'ù{T®úVáž"Ð6Ò¿C)°“Áp-^¬¾Q ¼øåbï…¼ðz“ÖOh/xV B,^ìÒ©h(ÀX˜œõF 较9Fñ>ݾòSå¿Æ‘†¢ cº*ðçvxøÛ0™Ò(4ܶ1˜#ÇSs›‚÷h„á¶oG Þ£ˆ´ª3n¥š§Ôq›µÚã`£¢Œ²v0E̚ƒÔê)­žr3¶Ã¸vnðT錄`+~ <¬ž`ãná…Îë}. “TÎ)ú%&Ol÷aÂÜT¼xf7°¬Íú)ã+{Bj‡MCäÙl{ vLÍ¿ÏutA0Å’G/²MÂ#j-inË:eUëZ+jœâ,þC‡ÏMÝôî I{ø`;¡áØÀ™½P˜œÊ#ã¨Ýkúc³]Óìªuw9é·‚,¶j!Ûv•Î­#úzw˜ÓlÞ–$b=>>㇓lV‘Ûíû­œ5;§¬DR‘Õ Ü1ìhg~=P¢Ï×ê÷‡†*eÆs±­< +ˆ'%)bqåE}“ì§÷Ý%‹.£O GòÙ@/Â}¼jÙÓâ-êïÞðU£m£ØXJg=y¹î@nsžovQ¯hÀ=\DQ`KÇ?nQ¸ +¤exÖ…¨.{n,"¸ö¡ÖUn¨Ú +‚[Ýgó´Ð„B뗴ر`†gc=H68ºje?qLχ4D0ã„ß«âê4|dáÇ#›©´>ÄA¤îj’®nþקÑJÓxÑ”~k8‚ ö~Xî#Ã5] @‹ øîòìPn{¥…òäVì;ýžœ«G®ŒûõCS~Q=(ÐÊ2|O:¢Ö“.»¡µß:¼ÀíÏ"˜:<²ÒH¢}çˆdöÄS w í ¯ü +Њõ óêÏ·M³~=®ê¤«¶Dˆy¹šÚ9§“ßÍ–9¸ÇiZLðΦž.²<ÍÊiÍ ùâ?ÞiaêõÎÔ“Òò¥ ’Jx8WÙº÷âp±;Ìùq|sš¦ÐyCc~Ý>V˜LY7»‘ OJyq¬º^5N ßã1MV´·% +À5öH +ZQ›y¸áC—¿dÙ²¢‰ÌNGÈðáɇ¹óü¿‚bêüôŠi§¥}Ü¢tÚVÃÕç‘sˆ­²œ%Ë8Ž_ Í|ëIõf½†÷ LIº0›¼AP|ýµžgÉ/w³ŸŸôsÏÓ[è¤Ð”‘=¬ìǃ°˜µoõ[úÀܯ) “XR,ÿ4$ÉhL¤5&þoß½þ"Bv¯KpJ0 p’{þ[âé*õþS@‡p/ë_ËöÃM†ÑsCáªsÿ6^ÿiARendstream endobj -5085 0 obj << +5291 0 obj << /Type /Page -/Contents 5086 0 R -/Resources 5084 0 R +/Contents 5292 0 R +/Resources 5290 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5083 0 R +/Parent 5276 0 R +/Annots [ 5296 0 R 5297 0 R 5299 0 R 5300 0 R 5302 0 R 5303 0 R 5304 0 R 5305 0 R 5306 0 R ] >> endobj -5087 0 obj << -/D [5085 0 R /XYZ 85.039 786.531 null] +5296 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [409.348 505.988 539.579 517.678] +/Subtype/Link/A<> >> endobj -1058 0 obj << -/D [5085 0 R /XYZ 85.039 766.606 null] +5297 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 494.56 155.157 504.128] +/Subtype/Link/A<> >> endobj -5088 0 obj << -/D [5085 0 R /XYZ 85.039 746.277 null] +5299 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [409.348 374.886 539.579 386.575] +/Subtype/Link/A<> >> endobj -5084 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> -/ProcSet [ /PDF /Text ] +5300 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 363.458 155.157 373.026] +/Subtype/Link/A<> >> endobj -5091 0 obj << -/Length 2860 -/Filter /FlateDecode ->> -stream -xÚ…YK“ÛÈ ¾ûWÌ-T•E“l>v9Þro¶2ªò!›G¢$–)RKR3;ÿ~ñè&%qœÒ$Ý@ã (|è>䉘â!ËS?1áÃöô.x8ÐÊ/ïBňã'qLï ‹k»ºN#?ˆ³E¥±Î¢Øó8Ÿ6ï>|‰‚‡(ðÓÔ‰C~­ËîZÎÆv‘4¤ÿC!µVg„Y+h#ËCÝT(âH¢X©X|D9¼Ÿ #‘Zo?Îel›‡å!^÷*™v*>®°hÝ• -A4#;MÊå›î|ªláÉgÛŠ€m¢;kÁF™û·zÛw,Þn¿r•ÅÇ)Š¸‚”È}F5J¶ù -—}+Í›4÷“üçi~†ófš7¦ð£ÈØ4iš§„Hu†ëÌnúM÷,½-Ô‰³_xƒc“RFÿ?O8of}„¾‰"æ˜ÓªÉïÓjP¦0þŸb?J¡]Ú™ÃD%â»[î¬f¡®° œx'!JEŠäÙt3´Rm×®9ÍV¶¢-{Žj ¤ hZÍsÓ ¿¢8ˆËŠAˆKù÷¾áÐP™OõÈ9l-Î ø›B8 'ìerÝ©“,$µe3•®¡Q<]-Ñ)¡]'Hìcâ„óm…š‰AßïÓ9£´Ö›FYáû‹û°à$Å ÊÛ‡JòG×ʶ¶1Ë@š•ôy· øÙK˜jÉØ3þGð¹«õŠ#sÃy$™åÚNòI¸ù&–Úò$ùæ,Y}í°F°ðáÂÌpiF5*k{lBÑØB’¯†úÀÉo$uÔÖ[íz’}D‰…¢zÉÚ26{àeW5ÔÅI(4„''B'9M„SCL;{{)¸ -2™-êJ‰Ôz&éä ›¤Ý#d9Ëoý”WîoÈZtIÙÙóu'õý7WQ íöè -‹t!2[ÿ有 ²–%l£k7J eè£KÏ®q× hý>~‚¶vRõ5'$‚N½VýÓć}€U@ɬ cã5‹#iæËv¸œPŠ\$Q÷V&®¾ˆ¦­ç¸Š—’ÊdV -qùÎñõïF dŽÊ°fWõBQ£W˜m‡3ºƒD<]!àv£ìªfê•Ý“¦Õ$¬•25¿;‡·4­ª›Æ#æ]3S&«/·š=IM¾,„m>¤¢´ ø¶s!âHeÛq›ñéÞ7•„›ÌF~ð -["Øê ¤Þ -ôX<—=W õá$;]ÿ §$žRs°«þ¸”®¶AE“q·Ð+©ŒúÈË _}¥Õ³áˆVžjý4§²‚§X©‘ \›¾ÄƱS*£ÔH,?j‘.Ô#µ’k;ÁÝÍM–œ`*s–]U: ¹8?gµœœT=jgÌÄj¥lp‡êÚf0´å;ôR7ylLÉÌL[.ÁÀe;5¡6@ÖDˆ×ÛâƧÈX›œ M×u^åõNž’”:hêE ;M†­­wþAKj€—^jkÚó*쉕îè…qé,ÿc(ÈÌ#ðN3÷ŸÅ쓬<§¼GÎ’$åE¡öîé´ÀÂ|ø«Ý%h–¶Â S˜×Ì‚š‚·’¾ÙÖ×vŽQYp3eÂ?³€ž©Ï8ToÍØ©3Ôøìñ»(šSÞB™YB©‘­ïR²ò\“˜lînZk/6ÈæÑMm윴<ëèEU*¢sQlÙvÚý³c¡Uº.ô@é#?|IòYqM²Òÿ‹¸Ð\e™4úƒLñnJñ¨ð‹´Pdñ ª”è„Ð\IïQó±¤+ ÚÉ—d¶ÊŠPB¶<vÕ7½çú¸ ©Oˆ¢\À@”ŲÀhâGAjñT?Q>o®ûAÈî{Õ*–Y{ªqæé^ãq”JA~ËóÕA/ÒH;ÀËWnÁ’ Ó»ž+GìubVJZ§2´¬eþfgi2¾Ë¯xåamk®l%ɦ$EïvT'•W £A¥«G:gãó•8¦ŽÐÅ;œ¸à¡ŠåŽb+4\þ°R¹+rXO›Fá¶á@3U> >> endobj -5092 0 obj << -/D [5090 0 R /XYZ 85.039 786.531 null] +5303 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 153.268 298.441 165.26] +/Subtype/Link/A<> >> endobj -1062 0 obj << -/D [5090 0 R /XYZ 85.039 766.606 null] +5304 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 99.071 447.348 111.064] +/Subtype/Link/A<> >> endobj -3090 0 obj << -/D [5090 0 R /XYZ 85.039 658.638 null] +5305 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [297.044 58.423 539.579 70.416] +/Subtype/Link/A<> >> endobj -1066 0 obj << -/D [5090 0 R /XYZ 85.039 562.194 null] +5306 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 30.372 539.579 45.914] +/Subtype/Link/A<> >> endobj -5093 0 obj << -/D [5090 0 R /XYZ 85.039 522.636 null] +5293 0 obj << +/D [5291 0 R /XYZ 85.039 786.531 null] >> endobj -1070 0 obj << -/D [5090 0 R /XYZ 85.039 368.584 null] +1022 0 obj << +/D [5291 0 R /XYZ 85.039 766.606 null] >> endobj -5094 0 obj << -/D [5090 0 R /XYZ 85.039 325.631 null] +5294 0 obj << +/D [5291 0 R /XYZ 85.039 746.277 null] >> endobj -5089 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +1026 0 obj << +/D [5291 0 R /XYZ 85.039 570.746 null] +>> endobj +5295 0 obj << +/D [5291 0 R /XYZ 85.039 533.879 null] +>> endobj +1030 0 obj << +/D [5291 0 R /XYZ 85.039 480.291 null] +>> endobj +5298 0 obj << +/D [5291 0 R /XYZ 85.039 443.424 null] +>> endobj +1034 0 obj << +/D [5291 0 R /XYZ 85.039 348.014 null] +>> endobj +5301 0 obj << +/D [5291 0 R /XYZ 85.039 302.94 null] +>> endobj +5290 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F38 3057 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5097 0 obj << -/Length 2858 +5309 0 obj << +/Length 565 /Filter /FlateDecode >> stream -xÚ¥YKsÛ8¾ûWè6T•Å%Á¸7'öl<5ñdc¥R[3s %Úb…½$Çÿ~û©ø°•Š‰G£Ñèç(\ð/\èÄ¢|‘éÔO¢p±Ù_‹'˜ù×E(+!Y94ïÖÿø5IaàçA¾X?Z>yà'yºXoÿôÞ¸ú´¾ù¼\EQä…©¿\e™önï`ìúeè}¼º½ãÉõrzŸ—J{_î×<ôùæ÷«¥†©Û?îîøÃí§ûåßëß.nÖV2Gö0ŠP®ÿ^üùw°ØÂ~»ü(׋h~˜ç‹ýEœD~GÒ¯/î/þmyñ\¼àUsjH"í':šê!Lfô$~g¤‡â°…3ÁáÚ -ò´Ãsöå^uàoYl–*óvLØô»²í~á©-,jö¨¡¨CïxýÚ%xQÕ Kï˜æ`H6ô·ëŠö•‰úFöíúâ¡–%¡Ù¿G_P !û+HB9±«aUÑWÍ¡Û!ƒçN$k¥=X ´· -Q¹9iÃ9)˜y‹+™ÝYAÏ7‹Tæ` \tKgÌ@•ü½[ÇÜ ©IÜך‹ò}¼—Yf|laªb*žØ6ûA™ i‹kžëÛcÇæÑ^ÑL$ÝŠ7¡‹CWõÕwäZ‚oDZòÖ»ªc&d¯HŒBA·EÏsÕ£ld-èìR€2¥%t|¢d-!Y“A"1H çÁýΩkýÿe˜ØuÍKÀÅöÌëóÍõ%}ýp»¾‘6{-4Þ!߿ܳaì½€ƒ–f9Ì\sÛ."NÜܨ"Ö“P͸hÝ8¡¨©-ëB\B|Œø|)jâ˜ÊìFä2ö¥¥ÖÉÞ¸P ‚*;žÛjp“XË$Ö€SoE¹ÈÔš¸õ`Xv3§=`\¥°ÉþÍTï-9¢¥Ê{XBxe1óBç°r ­†”`Fd=@Cô-×?0ÂV JVþdÞÙãwÌÖ†´iëëuµ!¸Ûáú¦Ÿµmayc¼›¨aYÜhgú»òORØ4ØL(¤U{_éÛ†2TÇd*ž½º¾gòÙÈlj MUþè;©ä 6ãÆc±éÍ¥8éX»`¯=§3œÄ æ5’H!¥Sâ fÁâLõô`2ZŒðˆûÑEz4$׫ºkÐ+SLZ5›T‚NjS mEªpl/¾5D™µ¯÷œ•dcJÁHf].‚lÒ™œ3Í£qÊÁ#/y£)ofNÍþ£DC=…Ô10 @‰C4#ãB¢êwLòe>P±¤X¡•‰øñ Çá6+ö4@ÊtB)1­QŽò÷Wwoæ1NÁÃ^3ÎúX8 -ºzO<|±Øá:Ø°ªdæ¹Ç²èRp ÚÇ9 á¢äÓÉŽˆ©Š= -ö€-r™Höã¤D»í%Û ‰X…óWÙ(½ÆŒFÞ¨Õ·íçÀ\:q×!ɧäô´®yæiTZp ½8´>Âœà‚Ó$‚r€£üàYvØ‚’…êê•'ŒoN -5 °¦«öU ™“:ûâplNC¿àK@¾óº„©XÔ‡<õ!X)yú4³ÏCä$ÎÎâZ -fc?ŠSÖ&¡†/ÃZ@ôæ†8÷îÈj=ªé;Å~Æ'K3–ÍR©:Eô†ôx¬4쟃ZrAÿ}sø+ã§#©‹sì™C…‰¯â75ÐœÅ걆 AÄw–5î8”$ŽÆŽ=왵‡¶PáäÆt¤4Γ°<ð—tbÜ^Ò3å8y ¥eT³z l?sâHuÚƒT);— ·ˆ]Ör@°e‘™JDg‘*Ä“¦´M£÷ 4Z©œ -+|',øJsÏ £#ÓWžylZ^ÂJÙàÞ;ž:MP-#8 ½cl^™xä3‘òu ±•D“Y.1ö‰ÈÚäÎé†i•$ƒ—¯"H²|ƒ²Ò͈Ç~®Ìra°ý_¨0+ ¤´¦Ó!#A»nlñ)[â!ÿ¢Bn‰u]nçT•D~Ä®®&XLâ}‰*dð4£^€­?Jò³T‚›†ðŸž9…–}ùR”Ÿ¼.áÀš¡ï‡"s9s(Ò:J„×Õv;³Šü87*F 8墀‹2}.÷Í÷rÎ]r?³Th«H ‘6çŒ -äêmáŒüÉI/•¼?a‡ð¬Æx¢nÁŸçÂbH¡³ÕÖ瑱¤j´#NéÐOµ?¿ î°‘87ºÔ;{iñmn<Û–T’©LÊÐp»t®Ë8gªyøÁàs*!õ°˜»®z&ÅÆ}°”}ONíRH¬M‰2c¤y¥„ulg’Š͘²Èû¡(LK™ZP{nJûB“ÉÞð=Õ%.á–¾wìèíÒ®&,DllÞÎ2÷ÕznÝA"[wðÚ«3×àÌ©”† xž‡1¡6g õÈ„9>ð MqtŸ¿ð"È€%#h€ëÇv-UhTEmâ5Y¸V‰á‚¹6žËž •Œ`[YfÙÊnœ»´Çå\%!„å\·å(UApøtjðápíâ'‚6†d0.÷íÞ@d| =×dC(4?>ÍY¸¦ðw5†kÊÀµfO¯s¥Álòda1Ål‡“ Ø9¹£ÔWÁÏ›Cs°©n“:äɸg@ë§`ËqzBEì¨ÔbøÆkHëõ«™²)šŸHdñQã»,£™§ÑÂÜH:½–àè¾øF¨^àŸpÅ3'>E –ÇKÉÔÿ6Íá`ПôŸ„æ…"Î%Œ“á غi2}ÈÁ É{Äe°CwÜïéNDl˜_À?ipóÜ}ŽÈÌþ|ûªäÚÅÁ0=ÛDeh°#2´ï\Ùð2­ ½^_vpzÀ›Ø› [ÄdÚÁ­*Sæ}V IéÊZ~Bâþ'œkðšËˆ°=ãã¾,„Å|4F -?âeøD>rÌÕŒ:†›`ÊLn¦µ·©+RÐ7ìfqX’ã jƒÈO³ü-PéhTèL~À-äç=¥óáÁK>›Ö‚;µƒ;ó ÈÔÎ[¸Ö|㇯Ežæ÷ÀZ\v"…™¯õ?3öÝ"åñ4‹Ä~æ¢ç’¡œ8Êü4Ö#[œ ¥,°ÎŒðt+ùÚäQ nBÆ[B'^`‹áÑo³[^&¾Ê¿‰{©«8@´.…Ízû¦—!S¡‘®èxŒ¯æ fÔrÁú(Hc;-ùR<c…ãÚ'Ïrƒ -h²ò¹B%~Ì?·ŸÖøÏ6ø¿~Šž´Ÿ|-*‰R¾ -­0T 3u*±ùÍ~*òÿ!A ²endstream +xÚ¥Sßo›0~篰öd¤Úñ/lÜjšÒ,íÚfI“!í¡ëƒ$CM ¢æÏïHÔvhš4!¡;wŸ¿»óqÄàã( (“™PÓ@r”l=†Ö€\{¼‹`HQ¦]FÞà*Ј3j™EѪ ‰Ò<ú2¼Æ ŸH)1WÔ'Æ„øÊçøÆ'OÆx8ýì …c€Fš±èN'³ÑÝÍôÚŒn½qôJQTié$üöJAå­Ç¨´!z›Qn-Úz*4P²ó7Þ7o~bi1…Ú¬žBÉ1‚HFÃP*–AOÅU’¥Ÿ~^,sâ¥ñ¾º˜ «…VïåsÁ¨1`¾º³áå}¼Ô¥#Ò%a(¹ùšA«׳²¨ŠUía-¾Ë _„øy³L×Kh#cø2®\Tç Ëú”¸éÎæpÀ…ÌŠ–è—ê~Ôân:‡ú +;p7q7DEÞÆ«6oæÐØ!.J0ë}ÿ¬ª³¤ œ ˜øÀõäòuÇ7µÂx¹k¼mªüž¹ô´- +êFàiät~8s‡>$§8*Jw»ÛãÚÝ\ä.0Tx蔕٦MƒœõÍ&ÔÐgŨV¦‘Êu±¸þË#øU×»óÁ ÚïvEYÓíQMŠí ]®âý¦î*§Zš¶Ö ÉŽ«ÝáSß;jF#Þk%VP;Ú1üûkzC•¥ŠiD´Ö”qÓ¿òÝ@þoᤡ<< ÷¸M½:¹±ŒFS©ÕÛµy:àOendstream endobj -5096 0 obj << +5308 0 obj << /Type /Page -/Contents 5097 0 R -/Resources 5095 0 R +/Contents 5309 0 R +/Resources 5307 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5083 0 R ->> endobj -5098 0 obj << -/D [5096 0 R /XYZ 85.039 786.531 null] ->> endobj -1074 0 obj << -/D [5096 0 R /XYZ 85.039 547.398 null] +/Parent 5276 0 R +/Annots [ 5310 0 R 5312 0 R 5313 0 R 5314 0 R ] >> endobj -5099 0 obj << -/D [5096 0 R /XYZ 85.039 504.445 null] +5310 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 785.535 539.579 801.077] +/Subtype/Link/A<> >> endobj -1078 0 obj << -/D [5096 0 R /XYZ 85.039 435.651 null] +5312 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 753.015 206.805 763.31] +/Subtype/Link/A<> >> endobj -5100 0 obj << -/D [5096 0 R /XYZ 85.039 400.905 null] +5313 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [325.68 711.579 539.579 723.572] +/Subtype/Link/A<> >> endobj -1082 0 obj << -/D [5096 0 R /XYZ 85.039 263.295 null] +5314 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 698.03 235.441 709.113] +/Subtype/Link/A<> >> endobj -5101 0 obj << -/D [5096 0 R /XYZ 85.039 229.155 null] +5311 0 obj << +/D [5308 0 R /XYZ 85.039 786.531 null] >> endobj -5095 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +5307 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5105 0 obj << -/Length 1924 +5317 0 obj << +/Length 2646 /Filter /FlateDecode >> stream -xÚ¥YMsÛ6½ëWðVj&‚ €Ÿ½)¶“¸ÓØi¬Li´ÄÈœJ¢CÒIûﻋHˆ"¡´ψ$°À[¼,0÷øã^±@f^’Æ,’Ü[ïg·…š×3®-ÚdaÙ¼\Í.^E±Ç–™·úÒõ“,Êboµùä_¾Y¾[]¿Ÿ/¤”>Ù|‘$©s eWwsî¿]ÞÜRåj¾àþû¹Hý÷+*zýûržBÕÍÝí=¿¹yw?ÿ¼úmv½ê<³|çR¢__gŸ>ÞÆðÛ,`2K½ïð0žeÞ~F’E¡Ôß»Ùýì®/ª =j5Fƒ±XðŒe"rSÇ,âŽ*µœeQdSE,E°#Œ~Qø7ð~h‘•¢^\Uû¼Ä`&N€¬ŒûõsÓÒ竹ä~¾.w`Q¶eÑL±¤áœn÷6Êm(,8‹©Ü^Îaù-*÷ª<?Ç÷°2ô[r_ëG„ŽæmYšGÕÕ• õµF“Ê•mÞªÿþXNШ :óQt¨l°²Õ¹î}íTÑõ‰Fåú"›5öþH%›rl‰ Ž“#S¬Ô…ê¶EAª* -->>8| ð ŠÚ©¡Ÿ±}@hCïóŒOùQ¨õÑ´ùƒÒ_ ôÑŒgC&ºU‹Ü(°BÕê Ò‰oïéù;ó®*ðËë][p°ð!ž±4’Ý‚cF¿°Þe2™¦^ ^†¼S6Wz ˆ‚ba∱DÓfa5"/„v†=£¯Êí³R4U‹òf­b V€0ÊþDg¤èƼí¼Ó&'Ρ úA¬îZVÔ¡œ{j}S °þ†ó³ å?ô-•,NœTöf€/² ‰ÇÓPÀìä?·=b/̲ع„aÊdœu\Á¬é¹âg!lƈæO†ãçA s2õ¬ÎNÍ â‘:œÃȹ8B„ÍtIrà\T¼¨öO°L´ÐaFš½ _É w…ƒï¸yU‡>8 …ot ÓQl"Ô„°ºDâN¼,­Úè,­ÀžÖâ8­bOkÙOøŽGMMÓ–Hà–jÕ΂[È32 O„“ËfšctŽ`ÇÌq”˜y©™i»Ñ43݆ =3ê'jU#¯Ûò[³”6SõnÚH×4cŸUâ1§ Û†ê8ðº©îmTk£³T;{ªˆãT[ˆÅb­y6üõ -¬óƒa ה뢩žk]vÒÃrŠ:Üž÷iÀ²qP§ÎRçì© ŽSg!NS·Pw{·ú¿NÅ@p²÷ÑIJqp¨Îrèì9 Žsh!¾ÞU˜êdw[«Å÷Ôô)k]™¼·›’—K}Æ,=õuÀ|nìx`ýn25<“$s2iÙL3iŒÎ1éì˜"Ž2i#þ7&—ÖÝÏR0Z‘Iwj›Yñ#“SDb¥nF;¡ds–Ïi´žÎc¸q6{¸~®]Ý]+÷zù>=/p>Z¨Ý®½«¶•.Û”JŽjk3ªN_“1\›~©Ï˜"£)ÔGöú¯n£Êu -¥eí´°Î„’H΢ÔX6Q´ÑYU€½,Äq],Ä>¸Ò![­M†Ž²pr}¢;sî?Q ªM>Ñ &@0£–ìÕJNÔÚ•%ôm$jZº ùá.Ð̽ Z6E´ÑYE€½"ÄqE,D{ä¡A×VøázžÂ3§G«8º…à&¯UZ™ÀÍÍþɲ<´>|lë\ aÝÝpÈËí£*o^`AjOV8¥YR :¬jí%åEc¶dt¹¹´É»#O·@ “R2Ê}6!?–ž¹[´l¦å7FçäwvòGå·W¸D§Óx ¶ÅòÈ¡Þ/U„º¥a.„¨«,¬T[Ž*!«ê™Â¢²KÌ9ôCC×½ºõ=^c,­p'Ä®º©HÇN´0þ˜ãvÙ*NÅ>¯¨˜;Àv5•ÉY-'¡z%°Æuì°–›½ZÙ´uÞVD¨ð«/øä´½aÁp¦cÙéÚÅÒK’Ùº)f%s•oàê4KrƒP`?téCÍ°U·¨©[’pµ£f -S§§èÞã)A“ Z»íM¦%Õ6ç4u u¢àFUµà&N(¹uS3ˆWê}<¿Þ–F’.³è¢ö^äY÷ù¤ê¿©‹eÕl[ ò–Éó¸ ?IeÄB)Çïñôúý©{¼þN)eÙT² ÁïœQÿ JäÐãH¦ÊÈ—ÿ˜@M8endstream +xÚ½Ûnã¶ò}¿Â] 2kEÝõ˜¦»ÛíÁâl€¢hû ØtÌF–|$z³ùûΔl+ÍC"ÄËpf8÷¡Õ"‚?µ(³0JªEQæa–¨Åzÿ&Z<ÀÎÇ7J Ò, ³4…ñÌæÊí®ò8ŒÒb&Z¬’2L³7¿»{óîC-â(Ìódq·% »ÍoÊÂå*Ë¢à³^{³TA»\©àa¹Jò<ø\ïïëåw?¾y7Åœ†‘z‰jœ„I‘¼´Y„ižNYRi˜¤ùK +™J«à¶µ}¬¨`s\[ÓµŽ—¹ÛaŵÊ*‚•jŠúng@—•pKtVóäiA-;µµõv¢QÜ(Û1€• ƒ€–q€h‡q›%ÏzÝhÄê¡[ è¨È×Xþ®án€ÈÖ¦=#[·ü5{\<,A†A×[€ªù#è è6)l<£°P2 +¥"ü©ô+@€|Ó4yÈU’40íeÒïk4¬%/q•ÄÁN÷r®>`¯1t3˜“˜àìT40% $ [7 rd¿Iß"áiá]ê&œ3@0äy»UXªjÞo2ðq©—mäY™0ñÄóoyè5 Ĭ5/÷5R‚Ü`ÛŽŠ‚-,Ñ`sÄ-Öa ©Ñ`ÌgÑ-õâx {>Ñ LÍÓ{6 Ó¸}DÞÙ,HÝIðƒfå µÙÀîÕœ¨$ýu›§Á-êý +0¬%³kÏx¡îˆ“$x2¨Ñ†w†]‡{O<Û *YŸòŠt¾Åãî¼­{+x‰HÿH·àm²MØC^løE‚†¬ey*2 ø'WÌ膠1dÖˆ®P d{xó_—e—Bnœyƒ ·̹†±ß¼%äÓbxøª’hø`jQ­¨ö,ÁY[³Å#’ $Lä²$øÖŽƒåIcQ²ewµÅ¸%ð™²ða}´ŒvLð±õŠ€ÕÚá´;-„El£BG’·âÆ=¦ˆàOM|;(4/ÁL çdjð‚K»m"©‚î'_ QE ¤Q°ïèÖ0bÖÐ톈ñÌcã‚Zt Îù  àº}Ð|BÜ°BŽ}dAˆA,l°oVd†¬‰ó/¢ J€÷…ðÃjï㛣׳ó5žâ¥X)!ãOÞ0Ïhö+ö5p^Ø™52à¦x@ìs_ûÈ’GD×t‘H¼n'q^E¯­lÅ)åšz°º.¯7øª +K®/æ2}&¹z5ÓÇ’é?,1ÜÕöÈf4pýQ·hÒy|§[B&ù¯Uêµ*€\•‰ßÁÀîz-Æ8`…7ƒÀYþNÓ¹¤KZi×æ@öHXò€"{7À°çiÞ—óÑ=“Þ0¥Æ +´ÔoÆ´H+dª9iCù¾Ì¬Ò-Å4o©0ݳÁð]ò4Xd^àj] <¤&[,4•・ §m³§¡%ÆàŒóI©@¼#¯*OÐ@ÅAz†ø}vÐ (â*±S•J|‚ÁŽC†gV×ÏÜœH°·¦.ˆà°'9 ðgu › ®#†=:ªªTvÐÍ6t)0Å)š"qâé÷†Ü®àx ò4¾Ìàî™þjî]„.|tí\Q +‹1ë6[m9®RQp¼>g˜ÚÐÙ G^ ÛºgtT©«.’ç g×1{J¢De5#､aªO½´Ys˜TIìé–Å{è;I)»P(Í䤕\l‘yÅ×O›·[øù3¡bÃiH°Š¥5®’uª&|\b2ÓÇ> Mõ^žë=r +ÏTàÄ{|'*ru#mIÛ{žŒ5C+ÙדGÞ¬qBR0\)’pqq‚ÍeùÁe—ž`‘±Kuà \ØôÜJ]WþºX™Ž.áJ«k5ïî§ß}ȪI„®â°Ê + ÓèÞ«ûe†‰Hã‡ÊŠ­7oðñ]áY¬WQª8T¿GYttZóÅ$0B ¯þv`nQ<Òo¡}ÐPJ×ÅÕi IùÏù¡%ëíD®k¹dTUFEuœ¥Ä:Ô®™6¡&èp^‰ï«·x¢ +¨ÂÉé%§%A–N”¢• ;R\¦¤Ë¥Rbèè³\‰(M 1}Ë/ u¦¾ÐR¿®ªe_ÐO…Eéô3tÌ]‹ý‡S_ Ú‹ÆñŒú“å®E +ÜæBñ†åErõ;L]RÈŠI²F<Ÿ&5õ.Ï z&gR¼±ÓÞ¡ø­dQ¯9c)ô2V`þBö'6^Š®cbÐö’c.«GŽ pGIAQûøí5"Õ}=Û—!ÄÕ©(i¸âÞ‚ +æ4—j÷k½?8F‹ˆr1îa$gK)§J͠î*Qêo·Ÿn¨T'æD#†ùÏ –,,bþ˜5°HJ¨”5V¤Š ¦ ŒŒñn–Ï2#ÿ›l:}åÜià÷8x‹ŠÔ+²ðÞg)­ØÆã4Œ³Ó°q };Ó¢8%Ù­–ï“o]\“ŽVy–X%×÷o±¤Ù¸»ùôîö“òÝæúåLÈœ]·”ÑwT¦û’¦dÓyïN±–h•¦Üù „ñÕ¬N‹Dä“L:b°3&ÁÍmÝ”íÖªö`r½æf| À<¸‘/4¤®a˜÷ã¿rf”k\¾y?ÀXÍ8VîqÁxø½&J,\+GrH ~2XáÖHá'"@‹àr)×'³Ú÷N¸lýûå^úP.1N¥q.o¡é¾Üó®]×Ox½‘"UÓž÷‚P<†U GIƒ¹CãÅ{ýÂÿûø7­ØÍŽÞÕ¬ëkŠJ®f²PV†Uâü탡˜ÄXýTXÅù‰ð¿7=¥&®ºþYS©,ÝÈã-Æ‹L^gA?Ë 2—Õy¢Y.9¸ =o‡ôÁ*½rÒ¿|ñË®ZIXâ%JʶÓU¿ÚT'ÒTß-+t‡]k¨žÃŽú{T0ê— þ}‡]6Õ3ðýµ¸ÿþ¢yþ3ö‹p¨÷áeڛߞ£þñã<4t)üèõÌ“ËW\ENã2‹h3ycE²ér|ÔÀ1dj;Y­eB½zg]Ps/=¸ÅmL=ŒEº Žóµ¼íã +c‹]> endobj -5102 0 obj << -/Type /XObject -/Subtype /Image -/Width 541 -/Height 173 -/BitsPerComponent 8 -/ColorSpace /DeviceRGB -/Length 8338 -/Filter /FlateDecode ->> -stream -xÚíyTgÖÆe“8.•hTÀ%b0†¨qA (.‰(Q4.ˆŠ Æ#*‚;¨1"`DA 2‹Äã8Ǹ$Ñ™˜‰—cLœ8ƒ&愈q”Õïù|ÏÔé„´ÝÕµt?¿?8MwuÕ­{Ÿzo½OwW=|H!„B!„B!„Bˆr4hЀI „«ê“““««kpppAAvb»sçNëGà+E!:šATTT\¹r%..®C‡7nÜÐHl‰‰‰3gÎœ>}zRR+E!:j+«W¯ ïß¿Qý©G„††>xð@zË»ï¾Û¼yó-Z$$$Ì›7¯Y³fxœ-­§cÇŽ5Â$ÈËËëĉ5¶…©©©žžžX {÷î_|ñE±õíÛ÷ôéÓŸ}ö°R„¢Ç¶òßÿþ×ÕÕU<ŽˆˆØ°aCIIIqqqll,Z‰ô–˜˜˜»wïæååÙÙÙ‰Çùùùîîî5VŽN´iÓ&éyö²`ÁÌÊÊʶoßþüóÏ×ìÒ¥K]ºt=<<¾ùæ‹Bt×V0Î;::ŠÇè/¿þú«x|ëÖ­gžy¦Æ[Ð5ÐV¤Çöööµ×o¸Œa[‘@Ûrpp¨ýÆE‹­]»V<ŽŽŽ–š!„µ•‚‚i¶‚ѾººZ<®ªª’Úá[ê||íÚµ°°°ž={¶jÕªaƵ»IÖþ†Xee%Âøᇠ£Â“¬!:[ˆÍ–~åÊ•èâqÛ¶m1I‹ŠŠ¤vó»må¹çž‹ŠŠ:wî\aa!¦?&´•ƒ6¨E~~>ëEˆ™Ç»6¿ù)³··oß¾}nn.+em¥¢¢âûï¿_±bEÇŽoÞ¼)^Z¸páºuëJKKKJJj|¶R[iÞ¼ù±cǰΟþy÷îÝ&´•1cƤ§§>³wïÞ±cDz^„Èr¼k훟"°ÊÊJœ=Jg°D×g/ŽŽŽ˜›¼õÖ[’ïô°Þo‚ÕßV0×èÔ©“ƒƒƒ››[ttôã¶ÌqИÐË Ÿ¼wïÞÿøGÖ‹Ý í|óSZ¸¼¼«b¥!DmE;ßü”f+)))AAA¬!„è±­h盟†Ÿ¢Î˜1£°°Å"„ݵ|óÓðIôÌhúõëÇbBˆîÚŠF¾ùYãI¬í‰Å"„½´­}óSzÓ%t44©°X„¢‹¶¢µo~š4iâïïíÚ5‹B!„B!„B!„B!DIªªª®]»öõ×_?~<777--mçΛ7o^³fMTTÔ²eË€ñ$^ÂX ã-x#ÞŽ•`UÌ'!„ØHï¸xñâ¡C‡Þÿýˆˆˆ   º»»7mÚ´¬`…X-VŽM`CØ6ŠM³ãBˆ~)//?uêTRRÒܹs‡ æææVO#°³³suuõòòûôé³k×.ž{Úƒt!iR‘L¤Tº7!ô"èEØN1¶iÓF$°Q£F³fÍ:þ<3cHˆ4Š|"±H/VB/‚^„-PTT´råÊæÍ›‹Œ¹¸¸ —••13æƒ4"™H©È-’ŒT#áÌ ¡A/ÂZJddäSO=%RÔ¿ÿÜÜ\¦È‡3‹ôŠ<#áH;› ¡A/š())Y½zµÔPFŽyòäIªÅÒ ÉHµÔ\P~‰‘Ћ ¡wªªªÖ­[פI‘Š¡C‡ž9s† -Q$iùG!PzÚ„^½rüøqé*p/¿ü2g(êÎ\Péšx( sBèEЋÐcÇŽ»ìêêš““ChåuAP&æ„Ћ ¡q*++7nÜ(”Ö°aCôЊŠ -V_; ( -J#tˆbñ³?B/‚^„fùú믟}öYédø§Ÿ~bŵ J#M'Q2Ž9!ô"èEhö¸C‡‡f•µÊ„bq^IèEЋÐW¯^}ñÅÅÕ°S4Uô5P dâz(¢Fn]AèE[ö"öïß/~§Ó¾}{z)ú1P>ñË5” !ô"èE¨Biié´iÓDOœ8qâíÛ·YJý‚ò¡ˆ¢š(+ŠËœzô"”äúõëžžžâü6--´PJ1÷DqQb&ÄÆ¡A/B1>û쳦M›"NºñÖwvŠ²¢¸(1 -Í„Ø&ô"èE(IRR’¸b³¿¿?Åf­"DqÅ5ÌQn&ÄÖ A/B1ª««.\(ZÞºuëxÁ+ÅE‰E­QtÖÚv A/B1ÊË˃ƒƒÅ,¿,d# ÐbfŠÒó6¶½zŠñàÁƒ#F ’'žxâÈ‘#,í€r£è(=0!Vú׿þ¥€ü q»@Ȇ£. A/Ba/"''G\³T®+ˆ¶‚±7_>Ìo+kÖ¬‘+˜¿üå/æ·•÷Þ{Oö ԻﾫŒü qMTˆ‡ƒ¶Æ¡A/Ba/â矗-•ÑRc[1¾­,[¶L– ÔŠ+”l+ÿgÔC<‡n-C/‚^„Â^Ä믿Ž5 R¸­@0 6 - qèÖ,ô"èE(ìEüíoÃ{Ÿ|òÉ‚‚£2l+Ó¦M3§ÄÛ·o_²d‰ŒmeÆŒæijyó樨(yÛ -Ö–jXƒòmEØÚ¶ !q× ô"èE(ìE‹;cè–7$¶•Çj+Ð^```˜©Aoª´€‰;žCNƵ½z -{‘‘‘x„!û/+ÙV·­àÜÀäTl+$„MCNÆ5½z -{×®]—¯ýôÓ8~oݺUÏÂu.£AèEЋPØ‹(--mÑ¢8þ<Û -Ïgä¢B d¦¯¶ò׿þÕÛÛ§dèÑüq ×¹Œ?U¡A/Ba/bïÞ½綾^²h žm¶i! ÈL›m**++û­W‹‹‹QŽ–-[J¯ÖþUe´½zÊ{¯¾ú*^JNNf[a[±€̴ÙVpîر£¼¼üßÿþ·ÅóÈÿþó<äÈ‘gŸ}Vú0%++Kê,u.£)èEðèVÞ‹¸qã†]ãÆo߾ͶBáYH ƒÌ 6 ¶•/¾øÂÓÓÓÑѱ[·nbæ.ž‡J]\\ð|¯^½NŸ>-žâ¯Âm…Â3Fxè›æ|¨çááÌh­­(,9%ÛŠÖ¦0ô"èE¨âE¼ùæ›ø»g϶žÏ(Ä&„gÝmE Szô"Tñ"† ‚¿Ge[a[QˆMÏ´·/T•æ¡ð†^½U¼ˆnݺáïÅ‹)<¶e€Ø„ð›/he¦0ô"xt«âE´iÓüñG -ÂSˆMÏ–ÛŠ2Sz<ºUñ"š4i‚¿ÅÅÅ…§ ›ÛŠ¥§0ô"xt«âE899áoyy¹ÂÂCFŒ1Ñ Æ·aù„wàÀ‘#GšÏÖ­[)¼ßbÂc[±ô†^ÛŠ*^„þVWW+,¼ÜÜÜEFƒwÕHið‚ବ,ñXáåääÌ1ô ñøNòŪð@^á¡O½ñÆ&wºñãÇÇÅÅiMxâqvvf[±ô†^ÛŠ*^DÆ ñ×ð.ÞŠ §÷;`Ê”)~ø¡a>£b¢œ>pjÙ¥¥Œm0§ÁÔ©SSSS 㙽`¶cª£Û7ÙÛ -v?Ø8¶lÙRCu>A>I&áÖ„± á±­Xz -C/‚^„*^ÄO<¿Š}£Þ„ó™ùóçïÚµ+ êaaa˜Yô è¹qËFyÛŠ‘ç3ñøûû‹xp&‰xzôJHJ½­@xñññ9¿šÝ¬Y³0}Ë|ö%nkœÓZ§C;h°­@lBxl+¦Á>ܘ{ÖЋ ¡ŠѶm[üýá‡4ÞV¤kåa$Ç“AAC÷íKS±­¬_¿^ŠçàÁƒãÆõOMÝk‰¶bÌù –D[A>·<gVxòõ°×Sö¦h°­@lBxl+E‹-0-ÍÈȸy󦑹үÑùµÎšò"žõ½㽈îÝ»ãïùóçuÔV/^ðᇎ¾¾îò -ñä¦'ˆ'66¶ì+V¬˜7oVF†ƒ¿7uÛ -2#¥§‹ãÇ{ÇÄ,× ð 6!<¶cèÓ§ÏêÕ«¿üò˪ªªÇͽzªx>>>ø{äÈ……‡t3×Ãb8C[¾|¹(tbb"fcÇöINÞ)£ð²³³ƒ¥Œùééé­`U¿{Á¢ÈÈH/<<üä#BBB¶l‰[º´ñèÑ^Ä&„Ƕ"ãĤNèEЋPÅ‹€zñóP……—/²O®`äÞ¾}ûbcÏž=_}õÕ±G|þùçˆ$:úÿ¯Œ§AáAlBxl+2NLêD¿^„›[sMyƒw¢a¼!n¼²téR¶ ¶YBÒšð 6sn,ʼn‰ñЋ°b/¢W¯öšõ"PSü;v,Û -ÛŠ2@lBx¶ÜVdŸ˜Ô ½zªxbÎâææFá±­(ÄfŽ3³IU4;1©z<ºUñ"***5jdggwçÎ -³4ÄÉAxuˆf'&uB/‚G·*^ôë×>¬¼ðâãã×®]+¥ÈðÛ©©©‹-ªó¥ÿb˜2ùóßÂÛ¸q£a?¥Á¶¢°-ñ 22Ryáaljœ”¢‰'JSRRæÌ™SçK5þE[™á-[¶L^áMŸ>=44ÔLá!…‡!]­ËpAHDiqlWzl+*zsçÎEœ¯½öš%bX±bE=ä^``àŸþô'ÓâA±žþyy…7zôèáÇ›“%4J___…ççç÷Æo¨¢:Éü«óY Á¶¢–ñË/¿4mÚK~òÉ'²Ç€ÑrĈ²·•7ß|sþüù&Ä3lØ0 ¹’Ø6lØ#­yÒ¤I†Â3¬¸áKÛÔ©S Û -&,óæÍ3-EÕÕÕC‡õ÷÷—QxXÚŠÉ÷ù5HB‚œ *ŽêªC/‚^„Š^FWŒ]»v-++“wªŒ!N^î# +(=>xð`NNN/Õøm%>>CñÝ»wwª2cÆ Ä#拾ÑVvì؆õ¸ñHS(Ü°­8p@Z^^^vv¶ô¯áKH^­ý’h+ C† ©¬¬TLr$!ANÒ5½zjyÒ€€*È;UÁxkØVdA´høqŒü;wî´P[Ù´i“ ¯˜ª@]†mÅü;2`mXgTTr¥˜äUKœœs A/BE/âôéÓbvóÍ7ßÈ8UfÿþýÇȇh+XóÌ™3—Ÿ˜ªà]8pŠ5P&°kX!Ú -Öò¸òS¼gh½{÷î'}úôÁñ•øÅäÙ¿Bâ`®)èEЋPÑ‹@Qð.oooYn;.¦*Ù&Ožì/7èãbØ4^~bª‚·„††N”±fðXò“¦*"KAòó=±ZeäÁ@6$Äa\kЋ ¡¢qçÎñ*ó-MU,‘ò“¦*–æ±ä'MU,Šò?‘€xtt_›‚^½½ˆãÇÛÛÛ;::žVÁv@¹QtqŸAÈ€ ±&èEu½´°Å‹cÓvvv111¬…-€B£Ü(:JÏÏS¬zô"T÷"’’’Ä83iÒ$zìÖ}‹‹³ ±bèEЋPÝ‹ÈËËkÒ¤ "éÛ·ï?þÈÒX(+Š‹£Ð(7bõЋ ¡z<.\¿Õ}úé§Ïœ9ÃY((Ê*~c‹B3!¶½zêrûöí 0{{ûøøxïÖqÊŠR¢ (+Š‹3'¶½zª·¼åË—‹QhÈ!ׯ_gÉô ʇ"Šó”•'«6 ½zªsìرfÍš!ÎæÍ›gdd°pz…CùPD”eBlzô"T§¨¨hØ°a 1nÜ8y¯¥I, -Š…’‰Ú¡ˆ(%sBèEЋÐ»ví¿©ÁyïîÝ»y†£ý³”ILRP8”9!ô"èEh‚‚oooqê;hÐ ÞãI³ 4(¨J†Â1'„^½Í’žžÞªU+1áš={vqq1ë«PE˜(ŠÅœzô"´Ï¯¿þŠ±ËÁÁA\"511‘—“R”…)EiP ”‰i!ô"èEèˆ .ˆ{gƒN:effò$G­S$%µ@Qø;GB/‚^„~Á\L|Sxyyegg³¹(ÙPp¤]ä…@9˜B/‚^„Þ©¬¬ÜµkW»víÄàæééùÑGQŠ––’ŒT‹œ#ù(äHèEЋ°&1³Ë^½zÌ™3gÓ¦M˜,\¾|YÆ»Û`UX!V‹•cØ6‡Jó}C$BEÀ›—'„^Ñ8W¯^ÍÏÏ_»vmppð€Z´hÑ ^Zµjåáááíííãã3jÔ¨ &L›6-44töìÙó À¿x/a,†…ñ¼Q\-¼Â@0 !<ÖˆzDïBÅéÁâââ""" ÔµkWé›áæƒUa…X-VŽM`CØ6J!B/‚Ø………ß~ûí™3gŽ=š———™™¹{÷î;w¾ÿþûqà_<‰—°ÃÂx Þˆ·3‡„Ћ A!ô"èE˜Ìÿʆ&endstream -endobj -5106 0 obj << -/D [5104 0 R /XYZ 85.039 786.531 null] ->> endobj -1086 0 obj << -/D [5104 0 R /XYZ 85.039 766.606 null] ->> endobj -5107 0 obj << -/D [5104 0 R /XYZ 85.039 748.602 null] +5324 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [457.032 178.546 539.579 191.447] +/Subtype /Link +/A << /S /GoTo /D (AccessControls) >> >> endobj -5108 0 obj << -/D [5104 0 R /XYZ 85.039 676.933 null] +5325 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 165.602 259.895 177.292] +/Subtype /Link +/A << /S /GoTo /D (AccessControls) >> >> endobj -5109 0 obj << -/D [5104 0 R /XYZ 85.039 676.933 null] +5318 0 obj << +/D [5316 0 R /XYZ 85.039 786.531 null] >> endobj -5110 0 obj << -/D [5104 0 R /XYZ 308.64 504.152 null] +1038 0 obj << +/D [5316 0 R /XYZ 85.039 766.606 null] >> endobj -5103 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F66 4190 0 R /F62 4047 0 R /F41 2994 0 R >> -/XObject << /Im9 5102 0 R >> -/ProcSet [ /PDF /Text /ImageC ] +3151 0 obj << +/D [5316 0 R /XYZ 85.039 658.638 null] >> endobj -5113 0 obj << -/Length 2915 -/Filter /FlateDecode ->> -stream -xÚ¥koÛÈñ»…p ` -ˆx$wùºoÎãr>\œ4Vp-®÷i‹ %ª$Õÿ¾óÚåJ¢\ M`pŸ3³óžQ8 à8Ëb?Pù,Í?Válµ¹ -fO°óá*” 9²pμY^ýøsœÌÂÀσ|¶|´pòÀód¶,ÿðÞþróyùþË|¡”òÂÄŸ/Ò4ónï`íݧyè}¼¹½ãÍå|z_æQæ}½_òÒ—÷¿ÝÌ3غýtw‡¹ý|?ÿsùëÕû¥¥Ì¡=T -éú×Õ³ÞðëUà«<›`øažÏ6W:V~¬•Ì›«û«¿ZX¼§g|kŠ æÄB~–é—YÇ~¢SË*:¬ -ƒÐך™CÈ«azú¼0Hü,Îf°3„æÌÆ0v1†‘¯Âèã¹Ûíµ=r€A…ƒøç^ÙnŠzËã l¶E#Ó®Åk;¸§’À{{sǃ‡ù"JNžêï(ÏjËÓ.ÔOk\ä^±[l;¸ -‡»MMÄôu»eÂð !cX ì¡íû¡Þ>bÈ<`É"D!åôB|€Ig€?/ -÷_ø¯‚»€dšƒeZ`‚åCÓ>À›I:>’€N¼Gwí†'Ú%Iã¸T•|ÉJÆ,381Ê &ä}QŽ÷7¤”ÚƒHHP@¿µ´¾º@Y+Ç>Þ»òá7ý^“´ý€ç•öwK8™Tp› -ð§#¡ðTÙ(V¸Ï­·UIÒ ~×=›s†dÁ®öáŽgKÐü#Ö,pfÜ(š÷¶Ý‚ -è§}‡¤Õ@ )e’z÷Åæ¡àáÝrÑszÏMÅ+ïPx˜§Ëyïaõ—^~ú²Ïœë“‚ýGÛÿºî™‘eEF·êêP4Ô­p¾¹°"€ÅF`†¼4°¨p8*L -¾Œ:YÔzŽg^!$(­¶Á–üAÇ`X¢î¬È!rCHÁÚ½Ü[³Îðdhð•œØïð11ÚÃRˆ…†B¾Ð±›ê&üG5¸.¥^=ðʪÝ7%/!ËŠn¨Wõ®*ÞFÕ¥ãÌ/QÚÐZ î‘iòñθަ@¦ÿû5‰‚(Ä°¥çîš tܱΒ٠W l¿GìY[Ä1XêÎlñ¾`#ÖÔ"v£¡¸4ÈZUt‘èP<á¯e.¢hZCû(2Z“­?+'‚¯åÐåB~ã…g’½Ò7¤F©䬸ïÑî3xêB‡šPè0¶nÇ»®%…!MªH©:Ôq&^i˜Ýƒ¾;N¥dpÎJc´ A=ñA±-ô§hb5Ü5> -ÁY‰ÃØ|)ŒÑ] c>‘üM;T ‘¦äqŽV3ÎþiOD -5¤ ¼‡fVtd;ã[C³\¥§¶¾À-Å[Är¤ÙhZqâݼ½*¶<°xµ[oDãq§gén:÷ò8T‚¶«ŠÒxœƒÊ³Q"ŒÒz¸•Õ"ÒM– @?ƒ”´öõ–Mç›]jŠö‚C»RdÞ® óGë r6ʤ -è®ÅÅ¢”¦ emAfa-ךÊf r“<0~Ü¢¤aàëdùTŠ‚>\,„pÔðqϼzïúðs]`n~¯;“Dl­µ2Ÿ/¥:ý<É_Œ®Î›"À -ʆWh_§‘“"„^ˆyBŒÙ@BÊŽA_òY'úSªv”\ X½Hðxæb> ¡”Q’Ü’{ÂPQ’N‡,XæâYd÷•»1×?¿{Ëë’àPä/ëÖUæGªR• ´t¿Et<žà»ëÂŒCdž4AåïØ­æ¤Çû¨ _Ú±VK¤ÁLðY ‚®mQ–Tcª‹;ÅŠlò]Ö/^l;Ø´S}7' -¹t¨;:Ÿ€y¹6c·êÑb–g€¦%IÆ™Bë q¡£‰‡[x¤b;Á”}Oú©Æ’Æ×ýX\°Êkܼ=¯¦>"+†Ô÷­ñ/Âé1UŽŒ%(ûF[‰Âæ9ëpµ º!¤Öã"å-F‚Ø3¯ö&3' uClÄ-_ùRN"ì f Jå,²‰“’ZôMeH¢%yqlr³²¾ÂÌ)WF"´•ŒéI™dÅÅQ¤Çíû›°òWn^óR±•=æj†É‘Hç.GG4VøÈ%a?=ï×™/Âkt6µª$x¤Û8:*Lâ.%ÿ¾²¹¢Ô%l^› ?Hj -®sáºQb[>äþ '1 ¦~ )ÅOøÀV®„çjå'Š;"]Ûœ¸ë~󰃜ï€ÉJ{‹B¾5»=zósŽÝU>pÿñ  -øÔŸxú7ù7q÷K5<ïªÿùúMYVB-nçÐùŠ_^~ùa]¡ÔqJ/Õ±ôª3.S(€eŠû¥ŒyËz؃,ŸZ&.J)Ô -4ãc) XÊ>Œ8Š¡x(z9C€;È¢ÎÔ£b’Àž$¼V'N¦âã¤Sç,›òà¨/‡šü®ÑGÑ¢Û“jî݉S³Ç›E\<ý0QÆ, Üi*”·-6•¡gÒ€®ÉYJ~umÆõ×ph„2cã.x†ÖX‰xA„G‹‚=Nª­€õX±ïDþ¬mÛ °l…Uò!±Ýkôf u^†åÀ7[lÈòðuÒ¹jXP0Ø™˜DX:@a™Ï™÷gºJ嶆ÂçïD÷|ÄHšX WSµ• FÅÙ.Û…¥VmðÅ m¶ -P1g·Ôè€m›?©Xy…dÑp¡“%zJ1ðäwƒy)·Ô`ùniPI$]‚…m+X¸Fòy²€a2ýŽQ]k˜N0¤$ªŸ)ˆ‹nIâcj“ØteÁ]¦LbÀIÖ`s{Œªí;Ó• ïÀðl?“aŠ£Žê`âe×=ïl¹l_HïY8ÂoL3VùÇ¢on^ `C‹Ê©K‡kk‰,8fvÁ+Þ[w͇ÑAã¹'Þ¶¥Úò×^¶‡{;×US¢Ï€$òΖɰ52óº«Î‹wl<70™3ì€!—â|•%ÇaŸGÓëÁ17r!rR -ÞK×mìåI|sò(5ÙÂuòØ;­ÆžÐyûä”FÔ=ɽ¯ý؎ɽ$éÊWH0 :—R G„t‚ÈÓ$¸¹è×Ü6ƒ‰Tâç:zŽÏØ]o|䪮ú‰ŒGG~(9îtŸÔ€IÄ­7ÜC&pBIæ¡À°U;\ðEÊÓžSöm»Þ÷ÉQÓƒ?¥©!ˆy ÉJàÇ¡:Î ÍïfÜKr:”}]J“JÜÏ ¹Påëô”Zªƒ3,«(6S›~;Å°,óSËuÐ&Æêòo^ÙYí{ßrrX.!]åî6üM±Geô[3~@! C+N?M‚1@#‡Z2 Dîtïr=Þf‡Ï&« ò“<>â°TìÚ)·ã³RTjlçÂÙ#‡… œ¤Ú©ûãËM 8ç–϶ŽÎ$‰±'„f½›±g0cy®ïµàí…`‚-þj#‰‰’åàÍO[HðǼù¿~PQ™ŸgúPqùQh‰¡ÆYªO)ŽQ25AòzXòEendstream -endobj -5112 0 obj << -/Type /Page -/Contents 5113 0 R -/Resources 5111 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5083 0 R +1042 0 obj << +/D [5316 0 R /XYZ 85.039 658.638 null] >> endobj -5114 0 obj << -/D [5112 0 R /XYZ 85.039 786.531 null] +5319 0 obj << +/D [5316 0 R /XYZ 85.039 620.371 null] >> endobj -1090 0 obj << -/D [5112 0 R /XYZ 85.039 685.011 null] +1046 0 obj << +/D [5316 0 R /XYZ 85.039 452.769 null] >> endobj -5115 0 obj << -/D [5112 0 R /XYZ 85.039 639.937 null] +5320 0 obj << +/D [5316 0 R /XYZ 85.039 412.605 null] >> endobj -1094 0 obj << -/D [5112 0 R /XYZ 85.039 491.969 null] +1050 0 obj << +/D [5316 0 R /XYZ 85.039 150.159 null] >> endobj -5116 0 obj << -/D [5112 0 R /XYZ 85.039 457.427 null] +5326 0 obj << +/D [5316 0 R /XYZ 85.039 109.996 null] >> endobj -5111 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> +5315 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F58 3380 0 R /F81 5323 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5119 0 obj << -/Length 3036 +5329 0 obj << +/Length 2447 /Filter /FlateDecode >> stream -xÚ­]sÛ6òÝ¿B7÷Pj¦b ‚àÇÝ“÷Úô'+Ó¹iû@I´ÅV"]’Šãû’hçfšé¤Åbw±ß°šEðŸšå&Œt1Ëò44ZÍ6‡«hv+ß_)XȃùvuõÍ¿L:SQXDÅluçðQhŠt¶Úþ¼úaùnõÝûùBk¨4œ/²,^ßÀÜõÛ¹ -Þ,_ßðâj¾PÁûyœnW<õþ»Ÿ–ó–^¿½¹à^¿»ÿ¶úñ껕£Ì£]itýyõËoÑl <üx…ºÈg0ŽBU³ÃUbth-ßû«Û«ÿ8\¼–Ìx×”ŒÎC“ëK9(3!cÂ4ÉHMy¨€©DíþFÁ°“‰8«ùC;ÈÔ¶=”uó_ã·JoÏö=À\‰ûúþqgAÛ Äz\¨d¢xÇ°ã£h\3A±#¨ÜlpS‹Û¼‡çi¶«Ê¡n‘ ¸Â$Mƒw]EgôŒïòßx7 §…B1ÄwÙl… £ƒšN*‚ê#¢'ž‘ù§aWã™÷¼JÌT#0S;"K¾ëfSoBP?áÀü~Ï£ž©øc…ºÔ9é ,žÂJ›Æî2ö 4Ëý®~Àµœwáv’ȦbÙãÿï`òg/2`A åÖ÷u¿£sA½DK±¼¯ÂçT[©P¥úe³aHcXUaaŒ§Ž)üf9«#Xb91ܦ1Qp[Ö K.¶ÄM3Ñ3¬æÜÓ±Ü%Áä5©ÊUD7Mxšë0Iã ÷`žµ£Ô(°#M„¯v5ÒW$‘s°× åf¨?Ö4]YÍÄéNÖû–¡wd0ã.›õ±cmÙ²’§q,ï&i¦¨íWx•{9 wŠá“CÆfO²ê‰ -OxÓS’XyvÓ²Rw-êÒ^ȹԨ5B=±9£Ö ^#®ÐUÂÒ»ëW< ™Áú¦Üï­öÝ.ßÀÆoñˆ%Ï ­Òàfµ`WÔDÍÞJJ &Èæ˜÷hÍÆ£BËNœ…QQÈ¥ -ýrÂÙ¯‘JPbl><×DZ¤ŽÝC+l·–ùÝlZ{9ΣÀü]ÛMH†Ë7ß.ùkšÅ¶™fë+ö*¸¤~ÊdNLþTò°qú¤"wx¢b0¨ñ¸†—?ôâ"éë ðÖm¢RjŠ×!‚D¡°T°«x|  Äü‘áí¾Ú H&; gs:*À“ "ÑïæÈÚ£65¸*‚?±Q…q” -ø׳0‹-:çJ€ƒý=–žBÀÃÔ øªØ–,ì†C飸i‘ÇG D­¦ú„§¨‚”#Q99´Kòrè‘>§µ7IUp¡o’°(Ìu.[×óÆ`¼ÝO|Þƒs/è ˆ’I -Ò",T"h–ÛíÄIqæV†k -„CÛÐýlµÄ9…¢ï>ŽQ\:Û©D!ÉŽ0ö{²A…MÂ(5'‚¼˜ù‚hØ&Lt‹fuæX,h&”¾pð“ôeîв='^&#F¬5xsì\H"SÌc 'úÚêŸ0 厄 ~ùª‡1Øm;_S÷¼ðˆ“õ^ÀDõÜ!ûöþÞ†Vk e?ê=(Gi1Ed—›Bεm æ,îú‰ÕµìÔ†¿3xSIøìØËl¥ç¬CÀùó¼Wör¢t®ŸÞ±ÿÅ<µ.6©äò8rV›Œ+{4rØDä pðpa88ë4?~÷üo>u¥ä—p£¿¿›t'~®©Îãäço¨ªMøã¶mÎ2”óžO!ûáë–ÙCuk_W ‰F˜À )Žc*¨âXyÜÀ$k=rs"„“U׉qà—TI‚’ybÂ:B°å¡Â€„¼ÞU±/è7¬wÛŠ?Û;þöÏJ]@z‘³$‚¼ÀdŸ¯×ugÓÕúÂâZxÈ.‹ˆ$ŠCH6܉(Æ[(“€{ .Z -Ib¨¶ÿ4Z\Ÿ¡1ÉòŸÆ›·?½ýDüöæœ>¥a - -ñ%賸^¦Ï@RXÄù }ÒÃÁ{8ç4:T&ÿ24 -®ÏЈy¢wkÜ9MÇÄþBSI•þ"Z\/S˜ê<ŒrsBá-ìÕ+´¶·nV’Þ£Ã(IO¢%*Ë,Ê)—×™gS*Üæ\~Ü‘©â™ZÐmÀ¹Tq…¸`[O8ìA7«„g|—†ßìQÈ{Zú\c&;Lþá]UnŸxJBùD°–8»‰2-C6š꛺•o×@ƒqÓL¼×aúå^r^D=¦‡ëšö¸ßÊ”ë¾e¶Ÿ´Æ#kÂØB„ùƒ×P£vØ€,^µÍbB÷]IhoÛ’´íoXû%.àTK¿‚á,„êNؘpêóÁÚNÌs˜ßÏ7®Ç¤ ’ü벿÷\+O+ekþt©Ák˜ÈLz›»Ïa–ÇÏ¢¡M á‘@Ÿù,Û‹uf:u.+M¼Ö!”¸P&Îâ"!û¶e6 /öŒK mâ°ÂÙŸ3Ž¬(4Cxc¢}d‰&¾y}P³ë¨œy„ -Öň–]kî¹Vaš™Yœš0I„NlÅ9·%“礳§J`©»òcÅÓC˿ݱá¥ÁiEÏ+6Wfæµåù’òp^\{Š€Ç^h36€:PGG#AP-TS õÍØxö[_®ú•Ú4RËÐÞú·õØXãæâ…¢&… D֊쯩j±Š²Ù·YëcæEòb;9 àNúàI¨¡±¬à·Ð©íƒt4IÜ Ò*9´m‘T®×éú.ö¥¡øm¦\*UmÏ;2ƒ ¸¥{USïFŽ×æ8¯<™åQçä?y¡»—˜ùÞs»/½Ã)><}Ó1eŽÙÄŒïÄØ£ŸÎ·ùAÇ+`|nqí:\n-˜­Ró¿S0¶U犉ó¨„Ï›Fy‚¸ðŽäEþð÷qžÈF *{”MW¯O:?‰‰‚ÒkÖ0‘Ø~ÏC¯KÔpõ¦5$::ñ½Ðß&m†ŸÄÁum«¬Ö8kŸýûógÿX¯YزLÅÍɳ¾–×<ç$z’ªÝ”F£»ñu7­>üéE)ßd‹$Udôbs¸òO°òí•*?Žpév}õîŸQ¼Ð¾Êül±ÞËzûÁûú»›ûõû_–+cŒ§#µ\%Iê=,µ÷þë_¹ûé[^y¸ùñöfùqýýÕûõè€U¨ÂØà ÿ¹úðÑ_lA‰ï¯|e²tq‚±¯t–-WadT™WWWÿê¥ðZ¸à]3÷X9Ž•ñUš†ý…t4s!»ß+k¸ÃÎ6‡¼+m ´8óÚåJ{¯mWpÐ"#üXÞ°Ë›ke^Ù‰á°(ªzebÎ4Û “Ü‘]y(xõq¹ +¯ÀSv°×6…;‹N.l]ð–NK_1á7_‡xÜ–§¯Ë e9¢S^Û–÷p6x] Ñ8ÝýÓ%ÕE“? ¬à"°ýu™†žšq˜33Ñ|謂H™$îmY«,ŠÆ¶†x1 +NÒ6Qä{¿¶xlý„ÖN¼ïlÛ­nó¶Øòü¼ŠíŠ 9åR¥@™à-ŒV©Î¾ìý;ðt‡àžš¯N³²n»,¬= +†–©è6ü}ÈÈû˜_£×R¯Ûck‘÷ÔyGöo;æîö /£0&mÄ«-ïÙ!’pbÑ%^¹ä’_i­IÄ¡Ø–t’ê‚ÜwZB(ÙæxÕŒÏoñŽÆ÷¶Å.?â;¼F¤é ã̓!G.íJ 4äÏ7ºÄË’b 7¶®ÝÝØAôHp £¸¡;Ám›‘ma‚Ʋ-G¨öäìӾܠî{>ëÀæÉëöd‚‚Dùóý,ŠŸß„ñ k‹„¶<¼TNQ4 ¤€öÕÁyY»]%;‰d#xýÂ"T4²Ý‚¼6P 2T:zÒÌC~Øè‘7¶'Þ0Á€8U +^oçdb‰/En‹úuNb ÂıÛ p†ºǧ³ÚueÒTùI4qC/|€`"•ÆZh +âh7£H˜©^m`Aû?xžI”cz¿T’m:Él¶î“˜Ž1…¸Úñ=E'Ê[ä~ĵO}B’ä×# öI„¢V^@ yý$úÙ[ J™$У‘o «„aäÝÔ\ƒŸó>ŒwüiO/Š¹ä½ümÆû‘Ê’B?V:ÒóQEÿóÆ7Z¦Y 4Ƙòßá”f˜vùÏcl,ß'éþ;Æá«A×$ HÔš$'ruaÅœ;ÎØêLŽ£‘ÑåáÇ[¼õa0@ýe´a¤âÄHVv“W——êG`bÈãÌø›ù“ˆBX«Úisp©èÀ´\UJ!ôÂÒEƒaR¶uDǸ´mtì'"Ý”Ÿ–QìQ~E¦þ2wŠi¶å ½·yŠpƒpäqÐÊ¤Þ nÀaÝùü2€ò†ñhv2õ•"’›bwì3ÜVN…ˆh)¸¹r:‹4âƒ*‹‘›ª,j÷0âX¤Ö[á+¥.Á1¾Ð†À&hª|ƒ¶{¦àê°¸ Coû•móŠ…OëØ8Ý &‡¼yîqcË;œ¾h+GW%Ôæ5ey©!¹r%™T}!5§ó•d3“McW6š:QA˜½Uü&*Ì’?Wüãâ· w£[N.DáûïŠõ‹nQm®Þ •ÿ Û¹Ã|mĦ ~ÞûÞ°ÃoÃD‡V)7®­0äpŒR^FϘ ß$²žI*Bk,>ðø}U¥ô/°rö–§LÐ\Ë ý“©E‹/XÜYªlæN}LÀ¡pÕæžßƒœuÈ¹ä¿ „!”8Æ8Õ(É„Ô8 u\ŽLÀ/ T’¦³©z’d U‡‘«B>ÎA¤V&ìå@‚Ôx¡¶a.‰­t’¨X\Â¥œÇ>Ñ·œUàZM;É3ÿm‰zÍóßóͳýRÎI”Ö±ä*|SÎÜR6å¦jN'õ\†¨@š‹)Ú%¨†ß¢ìöŽ+c Ø×ÈųIöz0 Äbo]"ÈT2”lî9•#‡Ë±¡BiD7êH¾+ÒÆ_ pþÔØãËŒr ,V&J'a‡vÇ+¡Cfj:¨ÌÊDepßøÿPf¶;¿Ãò•±¨ÙåAjħ¿¬9§V5 ¼­‹%LéдRÇššQ¥ lZr +a>ïsåêKÇ ˜`YÙ–ðõàÂÐüÃdÚFƒ´gfæúZ1WܲpQúSØ^Êoÿaæì¬qÖ¾2À‡¹^}-RÓóŽ?:íxeh‚“ÄÛ¤¹"Ùræº{øæ'ÚÖ²j& +~q¹¿çñe5Â;ìÙG2Û¡Ž™¸1—ï„Óo °ý4ø,€j¸4 ûѺtXˆÔµK¶ð®(<»Ö` +•ÂŽøŸ ×@û²&ðrm=NFiÓp(is®Oþ÷bÔ1SN> endobj -5123 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [113.843 77.171 412.147 88.861] -/Subtype /Link -/A << /S /GoTo /D (samba-trusted-domain) >> +5330 0 obj << +/D [5328 0 R /XYZ 85.039 786.531 null] >> endobj -5120 0 obj << -/D [5118 0 R /XYZ 85.039 786.531 null] +1054 0 obj << +/D [5328 0 R /XYZ 85.039 724.712 null] >> endobj -1098 0 obj << -/D [5118 0 R /XYZ 85.039 711.163 null] +5331 0 obj << +/D [5328 0 R /XYZ 85.039 689.966 null] >> endobj -5121 0 obj << -/D [5118 0 R /XYZ 85.039 676.417 null] +1058 0 obj << +/D [5328 0 R /XYZ 85.039 447.943 null] >> endobj -1102 0 obj << -/D [5118 0 R /XYZ 85.039 210.444 null] +5332 0 obj << +/D [5328 0 R /XYZ 85.039 413.401 null] >> endobj -5122 0 obj << -/D [5118 0 R /XYZ 85.039 172.343 null] +1062 0 obj << +/D [5328 0 R /XYZ 85.039 289.742 null] >> endobj -5117 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +5333 0 obj << +/D [5328 0 R /XYZ 85.039 252.875 null] +>> endobj +5327 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F58 3380 0 R /F35 3036 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5127 0 obj << -/Length 1564 +5337 0 obj << +/Length 2402 /Filter /FlateDecode >> stream -xÚ¥WKsÛ6¾ëWèÍX A€ô¦ÆNã´u\[N'Í)‹ Eª U9ÿ¾û²˜\:‹x,»ßî~\ʹrž„ž¯Ì}öçøðaæ{Ê$óŒ}O3ßÏt¨¼P+7/g³ßz]¼§ç|j -†P%^˜¨Kd8Cz‘Ž ‡SÑìÀ©(é|JyzlrtÜ‚{ ®(ÑÖ¼³KQî_üÉy'ÝlP6o𷓆ƒ5Àª@<ä{Ú‡ bñ´XÂonYY»K[5EµqúîÖzIªZ¼äk™;Y{lZ§>EÃœxU·,¦US´›w…Q„–4äq±áÔ¢D}äÉ 'i…¿íù6B@  O x¾B#4—hÀ¡ÁCBùXâJq ×@ áSÀÒ ]’ÁˆØÃ!Ïœ³p<«÷iQ-zÍ0ž¶wuÍÏmmó¦½B„Â^ê–SQ– #cQåΚ‘Ÿ26?pàpb&rkW4<9XvnpІ[\·,”§L‚+¯·NÏE°œWÐãšPI–ªTÒÚ l­;¾¢{º`óÁk·d妭íW–¼&Ôœ¡i•M°ÆŠ¶GFV’k(wÖ#Ïù+^¶xÓóŽrfI–”¸Bþ}A¢0¢Æà(ô/ç<žî;?QbûJbµùóëÂæ›Î öV_Ãë#Å&. ¨{ì­ÔGË*z¬I87Æ$$H\®-• ±88'`ìBØE» œó.ðG„c"/R(Em÷T iÛªƒÄÏø)”@~”µ”쓃.×bi0©vf"Žv(/Ÿ|hBTri‚ -=ék'Ù¦ d^Vßö7¸b4‘8`| ˆÐ`û@ÌÔ:«ÐÖ-Û͆C"©¼dr‚ÌŠ¼8‰Ïrqà&_79n xúZ0åaâ·-%h¯ò—–áV#ðU¢=™˜óD‹\ÅqoG&Ü9Œ‘C01Ž-Õd…N¾sBFâï³rƒ“©ÓprÌÁ·µ;9„¶"îÃ…fW*yL vàè)žœchë¨äsÇäœl?b¤KRdŸé4'Pk™¶E]uê ”ïÒ¦9aQÖ6ã ¡Ôî‰{$AîãÏW<èIÇÛ–j‡üسµ9¿–¯¸ŒÎøÛñ=S$ó#˜{^3dvÃÐ!¤õä ÀEÇ$bÍ¥j.a„Íñå߰ਲr·—fÙPb¼R¹AG!Ú÷‰Ö±¤XøH'¸9p_×fØâ/_êA9S”–âÏE¢·›ä¬¡u½'¹m.©~“VÜÛVD§®¾» „ɳÅÉŒROaë7DViî`à;6y¿¥¸Q§{Ó)nP.(/Sï=t$ ýý^ÿ?’¡¾ D{JG£¾7„g M2ú -?6ý{ñ¶Þï©Ž±EŠÅµ5Ò£4aN§æ{æŒd¾Ù†‡:ö’$ sn9ÇsÛeW½~o‘¶ :Ô Ö]]5»âÀBAì‹fG`™±ø~ɬy첉'iËAÜŸQ ÞYW,Qu7µœHPöKÛܴ“"g^~¤> Þ™¥»Y‰Å¹-¹,¹æ™¬Ü‡Æ20jðð™IÝ2¹Õ¦ÏœPÄÏRÜ]ÈÒhÁ¼Ú‘ Ž ‡÷³=éÜ¢ùBµæ6ˆ^ˆô¸µµŽÿPy#0ÈŠ¦µ¿rw}“à+³×NöX.Îß*hK´šL9øg<ÿ×fŸ¸:×g0·axì¡2Š£×wŸ¢—&ÿÆéÓ¤endstream +xÚµYÝoÛ8Ï_á‡'µ"Šú\àÚl»—zÈmÒ§nU,9ÖE}’\¯ÿû›/Rr¬‡Û]ˆÈápHg~3C«Ej‘Å~ óEš%~¬Õb½» +O0òÓ•Ž`ùAãÐû‡«ëq²PŸùâaC,åïæïî>ü²\i­=ûËUšfÞýRyn>ÿrûÏŸxäþݧ÷ï–_~¾úð0Y`ùQ¢q…ÿ\}ù,JØÄÏW¯ólq„và«<_쮢Xûq¤¥ß\Ý_ýËIá±hÁ³fα²+øY¹©xæ@·Øqšz§e˜yæÀC_a#ó†mÅ”âq¹Bäú†ÿ„¡hKfèÍHÊ3-èÂÎîꪗ¦a¶òÏgxuøé=ÓÖ¦1Ê[µ+DöÚqo œ¦GÖ g›Tž°ü¹»»Ã{ÁËP¨¦œ´P·È>Ø5» ´Š56¡%Gí¢i,G‰B®?ê©JÓÔÏc-zÝï÷Á[f:Ó»# "a¶V^ËËŒ„Ž5¬I­§jàFå=ÜÜÉÖ.•…ä®Ú€LŠ©JKÛã NËL{`ºY{·Ó•‹e¯‹žÄ½…nz(ÞÖVJ)8dz¦¼ûb‡Ú{D çšU7¦^‰wœG^Ýó·A‡–Ùp-úâ©!Lls@0{²¹ª+†·ðÄãý©hw;fÛÚ‰´& U²È`š’[t†AV0LÛ½LEV¤Šé!hĆ¾.++Öî”Lý‚ºË!Ø;`ˆnÐY&샃F¤ö<©ànßù +ºÜ»ôTf g•Š+¡¤g¼FæH„ã1Yƒ­ÔÊÄÏ? +Eœ zžÈcÔÜTž›øˆ³ 3Ÿ§ +y%Ê€ìer 34㶱+±j~ a±Ÿ§h8ñU¬H îXy×J§‘ä/ž sÝÔdª<BËå¼(þiZÊl~H@Ößœ…ôÌ^r"&衼¿1¾"žxêÑÚíT?ž çÐ-ù%3¢¼öҋΣ.gä…ܶÉȹƒ¸ÀO/-Èwv~$) 7Üq%€«e*îM5.j¸ùHf)öÂÐDéÈÞJÒ@ßÀ9VHm¬)™qM.;`ô@Ö… Ïça^¨i,\ +z’…`S ”mOò +z3RÓ7#~ä¦ó šNhvlmí´ sÅûm\º‚SNä·OQ’ ãøèJ²ÙÖ66ü¡P¨{©ŽW€(¸L +ê¹þåÛ‹.ß]^ÔBF”¾RaÈæþØï7:…ÒÙô»ÅŠÊ—[T‰¯üý`²Áÿ‹G»endstream endobj -5126 0 obj << +5336 0 obj << /Type /Page -/Contents 5127 0 R -/Resources 5125 0 R +/Contents 5337 0 R +/Resources 5335 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5124 0 R +/Parent 5334 0 R >> endobj -5128 0 obj << -/D [5126 0 R /XYZ 85.039 786.531 null] +5338 0 obj << +/D [5336 0 R /XYZ 85.039 786.531 null] >> endobj -1106 0 obj << -/D [5126 0 R /XYZ 85.039 615.144 null] +1066 0 obj << +/D [5336 0 R /XYZ 85.039 697.613 null] >> endobj -5129 0 obj << -/D [5126 0 R /XYZ 85.039 574.98 null] +5339 0 obj << +/D [5336 0 R /XYZ 85.039 662.868 null] >> endobj -5125 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +1070 0 obj << +/D [5336 0 R /XYZ 85.039 446.428 null] +>> endobj +5340 0 obj << +/D [5336 0 R /XYZ 85.039 411.682 null] +>> endobj +5335 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F58 3380 0 R /F81 5323 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5132 0 obj << -/Length 2165 +5343 0 obj << +/Length 2234 /Filter /FlateDecode >> stream -xÚXëoã¸ÿž¿Â@?TÖŠ(’zÐYìåè^q—w‡Ýý Û²­[[ÊIòfƒþóiYVÜ¢Säpf8ß ©fü©YfÃHç³4KB«Õlu¸‰f[XùîF …±:´ÆÀxbqáVIF&¤‹46¡É Ò¼}¼¹½£Y…I¢g§HŠDq6{\TÎÖFÁ÷M×WsÔÛùB'iPðÏ{˜ªVmÓ5›žgÞUÌÁ‡ -ZÜ°<Ò¸\ãrÜãÎïËù§Çg& -M”ΠW%$óá¥ëË“÷-m.™wSóìCqX¸ýæÛGF§½MC™)+D &³\_5Q¢M+54‘2¡6ÉÐDQ¦&q&Rh$“Ãát”ElKT»cm‹zÍê¿-ëòc¤ ®õÝkú ë«*žhHEeg*ûåm’…™±¤âãô‰mŒÎéÛj æ?ö蜻Gî…ÀÙ>¶:øÙ¨iq¬‚w÷@3ŠéžZølæq|Áíë²ãù‚äµ¢–Ùfÿ]ùT´…#œêwðQ²À=òÜV+Ü\ìYð—ª|>gB¤øa“X01FxXa2ätì5 -jKâ×7C¿è‚ÂÖÇŽ–ÚŽ?»SØ%Á¦m<ÝïdªXõGT'Ÿ€ÍngÁKwÒö h—<×W½^6Fv²-IhsD¥iOéˆkGÌ'À¹ºìQä3º i?ÃB8aðtZƒF  ’#Gm‚ úcµÝ•òY Ñ—¹µAA9Z,é§"Y/óLo˜°;àÙ² éýÞNÌŒFÝ–,§üúTÈ©A@ì›bÍ£e~/êUEØ3eOÇ÷ŠÓ0Êù@÷óÌNùªÞ`Ä´6.Ÿ`I6oŽrr\Êi¹qq lúF~Ù¼£´Œ3@¨ÄÌ,€@b2ÎK\h·BñË Cõb@~™¢cžx²÷hi:·GSÐiMi†–¦%Œé^£GzÎ%8ûHiça1p¦ôLÍuUÇœPUvÌBÃT®Ä=™ME–M*N1ÍŠ3„EYå2Cç‘,ÏLÓ3#î ñ¨àt. R(”«0Åqà)þõÓ¿1 I/V(}GòJ–‡(ÇaäxÂÇâðÙU´Âzµ¯D{9#ÎeÊ-q7b y‹zôÙ€:l9M0D‹ -Ch.¦ÿ“í`Ò@(—ˆ‚ÚdÄáýÛ.‹Î×\ g3ÁÀŸÆ˜€µ«¦pÝRCÆs>W!´×Ìþ§ˆNßt<ß kô <š, þY»—½Tˆ*Lÿ^T(&,Jš1º46Ííœ#ì9†Øš?PDlƒC±–‘lgc¼ÂgÉ87Xï{ï¨x€À0Þî2Þž?w÷¥SFbF€Ýz#¡[°ÊÞcUõ„¼T…‰½:K’}±˜(C•qïÀ m1ú;æ‘  LWÛºèKþ,ø‡Jµ°!>6 ZŸÔMÏ3ÇΛöa®îœ¢»¢=©½/ÙÎ{Þ¶d&l2®äd0¥Çf‚½gR/­óDr -F—¾lñàÆw'ügìi=§†juê àë…é@.r’' œ:éßhæÌ8{²ÅgY©ê³²âë.!~Pà -ç ǸXû$9çè– ð¾Êƒ+vVˆÐU5N2lÃÎ"¿Ãæ5Â>FHʯlPÂç’’“1Õm¡su*[o&ýãèScÐ`ÚßÞëlXshgmg³ü)Î{Z¸´XYBÍ7ã¦CŠ·5Øžä!´Ì²¿Þl'$¨$Ô‰ŒÝRñyȧF•+_®àŠ`Øö´LZ ÄTçXvÄ“òKý$RP˜âà„Äz5N¿zÖBNQwV¤¤¦$l_¶ÄÙ™ìž:|öm/z4NQßxzz—Ô8fí¼K«f -®$Þ¸ð/%³¤2Œ”Ή> O“S]mœj1÷Òe z@,étÇp*×^¸JÁUùÍD¨Ä¹†~ç*ÓÑ¢ã0S- Ñ•àÓù xÿçàÃŽÁõYYZ•œ5ZÖzºâøÛŠ{Àž1ð¾@$RÑù‚àðÒµ?)‹×ôtXu®E½õ¯ð½!Ìœû•âa}vÉíÐË&ˆ£èë|ºåÿ¾äóýõäÄBŽHó_=ú?ɵð \K\½¿_Ÿð7v6[ƾ‹<Ù°SŽì¨G¾r—G`Ëù-âÏ›Ÿ¢ÙÚðo¢0ÍÓÙ3Þ#Bè¯g‡~ÂÑò½¿y¸ùyøj¡Â|úÑBA nc|× mj‡ã_ßö+hèm’áU% µ~åÁQ9"tÄ·Ó–æ÷ˆýo.®N)„¾JgIê8šëêŒ9Qž¼Ö ¶O”³æö„5#•MlÂÈš)•/ßÝ„öºêP*"ÔÒ9ŽcÒüƒo?MÀ'Üì—T+%Øëâ –þŸä»»ŸÞaÜÝýã~b»»$]tR'/µ ñ—ùöKë§ÉV‹Šsf·œ„Ò´ý-oo¯tl£Ë‚¾h,OÜGªNä˜JL˜%Ékï}Pê2ÿ4À(çŸ基È?ÿꦒ84œe¯¾º)D{+/ àØZ°r»k½ÒœÒMJ(ÕzW K¡Æ+å“4¯ÇvãSm©««ã—›S?8„ÀXž¼0]Ò¸‡'*$¡ôsC[€Ý3h2CÛ4ý_ Å„ ÏjÍ¿·pñ§PÁ“O†ÈpÓ®y®yHÄÿ‡C#’Skÿ+;Þ¿ñ‹ŽTÐzrÙ¿û¨´ÁªÛw²£ª?¿ö@­mh´¾Š,.âN¤3‘“سã—èt,Óê,´™¾"ô?:ÿÛAendstream +xÚ½XKoÛF¾ûW=Q@DóM1@Žê&nm'ÜE´DI„ùPÉ¥ÿûÎk—”E7‡µZÎÎÎÎÌ~óØu'ü»“yh;~2‰ç‘úîdUž9“-̼=s…Ù¶…8õæîìüç0š¸Ž8ÉänC,wëOÖâÝŇ»ËÓ™ïû–ÚÓYÏ­åÔµ.¿¼º}Ë3Ë‹›7Ó/w¿œ]Þ 6˜vù¸ÃßgŸ¾8“5(ñË™cûÉ|r€±c»I2)ςзÃÀ—ïâlyö›‘ÂsÁ„WØ1Ó37±/·u†¶…‰±Ö² ”ph-èÛ`[v†¡cÝÞMg®u ”›G,bk™­º&WSßµžF ölß ^ÐÀwí¹gpÃwßMç¾U³OW¸w]ÁæŸ7Øv0h2œ +@¯kVØRœP»¬šzsKå«TåuõŠçÔæd͆uQÔÈvÈ«-s4Ù6oUóÄ_8™á¾OÀÝòÂTïzÀÙº¡ÂìZÕ3qéýtæÅVÝ©×èœóŸý¡•~`ûœSàÛ‘‘ÁŸÞýzù××ë÷‹‹ë¯7‹wW·—Ÿ]?Xþµ¼»¼ÁÑ¢kš¬R‹ºRM],3EDþÂáu›~Á­èˆ Éý¡(Wu¹gÜçE®žŠì1+~øq}¨›õk‡ÿ|Vñè fG:Æ|(;r€g=NÃÈJ‹N>oF}—YZµœ}¡ýØRaYº¢˜ÉöŠå“^XŠ6 `ùŒ|6Ø=ýXT‘Rÿ¬ñçfù‡ûÕ9xÈø¾UEy“W‹"1”Øž#&¿‹í¨Ç¶7w ¶Ù­H!x³,ˆéàÎM¯È±§`7§P⎎¸5ŒéCcÇ „Žˆ˜ÑÉQŽÓ8’ð"ëjÃ\Y®nÈ’U¡wÆÇС-5ëj5Bbëdýrˆ«G“›4Z˜·üËæ(þP5ÿö®Ãh +Â>µª«ÊSJ‡‘\ðjÌÔi.Hׇa £®¥­ó)‰ý8OMÏ%¯£µbôWÙ¶Vyª²µ=VÔb¨ãÎ MÄÌKUîQaœѳÂ`<‰õû~Û¤k­:,«iyŸŽÖÓxž¼TOCÛu¿SP?˜<‘RB4­Ð1;`÷IaŸ”·ò§ 'À³Ïtr=ôdcR +IÍVæ>¾eMü1MvJí_ŸŸ»EcíºÙžŸJwl/ö´ôc“¿lð†íVÇѹ†CmÙÎu0È5ä™JzÊEEó4ºj••\Ç(žZ‚IÃ{G˜zÏ™7ňN ‰|À€„ÇipÓd“úh(šæày'1kH1ÖÖåJ~[žÀàÊ·»Âˆ…Ò‹K©—®µÎd)GhLÊ0x€ ê0$ή5é¦ ¤”cçeaòIE•5Ð’ÅÑd.E|·ÜìáœTHÚuÍe0€¬±8R‡0ü -€Ž%ݘ=QŸÖ5üõf–¢ŒIgä“Z86õ)kÛÃM˱ rúó ]-ÆNG” ´£0ùoé#”ô±¨ËR§<È—MSO}ÇjZ½ýX¢ˆ!JÜ]cR駨† s?‚#¶ðSaD4zpÚÕ­Ô¼=%µ©¥b„l/žÛvMŠ})z‡¾ºôUפ¢”Z) iË¿9‡bG >×çi8`}-µ…*6Üv'±¤",‚§”Q=ðû¾¾cs#®c[×_™2t¾'P&]3Å”ßS»—õ èAI£$`ê¿[}í}Öh‚„œ×t‡LæK êêc(âþÍT `¤ûQ#«ÅÀ“þ”éÏúžV.j$ýؑܬ5ÜîÔÅQK.õ 5оñ<èðUJ8R †ð‹†ì„Æù¢Ü›òF¶hÇô«¤GÂu­ï‹¬”ï;6 'µõ´¤ªHÇ–`«ÕHe]Éà‡Qº.óJÐáÀ½æ¸|†«Ã²°EºþÈ +"X4ŒPD×èv3Â[åÔ°)‘`Є)ó5“²PÀÚ¦’ÉœkÿÆí²¡*º¡LU«> £È\Î)ac߸’„ ³Øî#v½ŒÓí_nÎt’„¾$Ÿ±þ,Jì ò^ʯ±$ñwß=B|÷påÝcY‚_!«® +DÔvŠý‰Ù¶Æçæ¡e’ÎÅ×5/J L‰¯xò¾S<Ë7AÜJÇ "" ÒÞ³_‰ÌŸ2©þ§Öº¶÷¢±¾gÏ¿ûƲ#'';;ñ)ÜáSbª4áœxúÌ°&ð™‡"ϵ>êãF¦wxÚ8¸æüŒÈûÆ”ÏNèpßõðú"y\ÑƼÔ†Úù–©´t= ìªxFêK“%¼–Ôô¬?M_p&8EÜ:ÛÐe·@iñ©4y^€º…Çž”9¾jã)ã“•¾íá¼jR­xy2¼EÁ¸¨9§¢wïSÓ‰ÃÚt"Qé;ÒЇWôüš”ku®i.@Ü°¸3–æ +~Ù5îÑÜõˆ#HÁ¦î¶»ÓÇ3ã\Lb@¬­…àþI2x+rb«ÏøÜñiXÉð|4ôâÄܘ::•ƒVPæµ`TÅde­Šž +VWy3%Îpb.l@clóÅ ßp:céb«3-%ƒVM¾à5HÄÅDÁŠ}ófÄÉUF ™DSI} ØoÙÍ +)}Ó¦sh(óowÒ +›v@§=ºJ^!|Œy58Yiù:x„:yæyžwǬg1ñ¿½tCŸêλþ5‰¹sÿäîÑëÎÑÕñ'<Ó endstream endobj -5131 0 obj << +5342 0 obj << /Type /Page -/Contents 5132 0 R -/Resources 5130 0 R +/Contents 5343 0 R +/Resources 5341 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5124 0 R -/Annots [ 5135 0 R ] +/Parent 5334 0 R +/Annots [ 5347 0 R ] >> endobj -5135 0 obj << +5347 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [279.468 511.531 400.945 523.22] -/Subtype/Link/A<> +/Rect [207.588 376.419 329.852 388.412] +/Subtype/Link/A<> >> endobj -5133 0 obj << -/D [5131 0 R /XYZ 85.039 786.531 null] +5344 0 obj << +/D [5342 0 R /XYZ 85.039 786.531 null] >> endobj -1110 0 obj << -/D [5131 0 R /XYZ 85.039 766.606 null] +1074 0 obj << +/D [5342 0 R /XYZ 85.039 766.606 null] >> endobj -3091 0 obj << -/D [5131 0 R /XYZ 85.039 634.211 null] +5345 0 obj << +/D [5342 0 R /XYZ 85.039 746.277 null] >> endobj -1114 0 obj << -/D [5131 0 R /XYZ 85.039 634.211 null] +1078 0 obj << +/D [5342 0 R /XYZ 85.039 447.102 null] >> endobj -5134 0 obj << -/D [5131 0 R /XYZ 85.039 595.943 null] +5346 0 obj << +/D [5342 0 R /XYZ 85.039 404.149 null] >> endobj -5136 0 obj << -/D [5131 0 R /XYZ 279.417 300.885 null] +1082 0 obj << +/D [5342 0 R /XYZ 85.039 334.181 null] >> endobj -5137 0 obj << -/D [5131 0 R /XYZ 85.039 164.866 null] +5348 0 obj << +/D [5342 0 R /XYZ 85.039 294.017 null] >> endobj -5130 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F38 2997 0 R /F41 2994 0 R /F35 2976 0 R >> +1086 0 obj << +/D [5342 0 R /XYZ 85.039 197.457 null] +>> endobj +5349 0 obj << +/D [5342 0 R /XYZ 85.039 161.653 null] +>> endobj +5341 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5140 0 obj << -/Length 1725 +5352 0 obj << +/Length 1877 /Filter /FlateDecode >> stream -xÚ¥ÙnÛFð]_! ¥€ˆ!¹\}³;š¤µA’Z¤-ÂéîRvõ÷k)Ê:R ˆcîÎÌÎÌνÇü Ç™ö•Ó,ñµ -ÇóÕ(ßæí(Š©L4ç³Ñë+ŒÃÀσ|<»ëùä¹ÑxV~ó.Þý1»¼žL•R^˜ú“išf޻ϓл™½ÿô–gø‰½}?™†ÞÅõ$ʼÏ7°ÿ|5cä‡Dèìš–ç_f—o˜ÅÕûß/y…ø¯7³Ë¼]_ -…~šü˜}€+MCåë8'oÎPð92cmŸOƒŒ „UbhÛJ¬RíƒeÀ”~w÷ðs `«ÈO£T¨l/ò¿À’pËî¯0ñUâ$–w.ïØÓXÇ~œÅâp6'sV–k!ßœrú‹•”PFê€KZœ9Ì-Ó}tðŒ&¬¥´xäXçF5îT ¡æÐê¾23š¢¿Ürö?)XqYŽ ¢C¡+zï‹õÖs–õßiD.GYØ‘RqfaȬ¦®`Lž¡Þ¢yMm!dMßú8o̓d ÑøÕéÉYo@CSHØØWq2˜B4N!9Ï0ÞEXµá®íjEýtKRïÒ@Þ¨³óˆ:Âæ€:`/•B žžK5OsÝëºÜaúq ÆŽ•ý„éKe ñ3Ìö:š=‰»¹F¾ -£‰Q<—\@°ÞdÒð—}XJ¥%?GÐezŸV%l4쪸1Õ-O,nn‘Cr¦¾ãoÁÔ}FUb¶¾0 ¹Ö0=ß`×¾a¼qž:–qšúa|:;4Ç#Þý,âO ì#þ¥Äƒ?”x±6}°q)]Šk àšêW»cuÂüSÏeÎSj0e-=g^ÙΤì9™”ì ÇÉ£Ç ¬ÈË0âÍI¸KC÷ŒóÓîÚÒœp—ýÔ]'nÝõBâaw $^M2IE-ÎM ³ÄÔË,Í5dmd>dJ‹ã[lšÖGždp^ždä¹{Y>ífð ƒ-=ùt¼ÃŸ_mZÉ´… ¡Ç%EõÞ[èäQ9Ý/M•éyÐs®È#i”'ïVà¸}òâ¦åïà™˜á3Qì€høR,¨à¢˜'bo†ªñ#Ï=PÚfw´çØUÑÎÀt`ôÓcHY÷ãÎLŒŠc‘¯´Ãz°m ûÿõ7“múd~žE‡cYG‘…½2<Šd/5v\ÙWù_ij|Çendstream +xÚ¥XYÛ6~÷¯p •˜Eê*PIš¤)Ðs´@š­­µÕèp%yüúÎEIÞU’ñÎ|3óÍ^½ôáŸ^&¡òMºŒ“H…F/·ÕÂ_îaçåB‹„¿´ÊBÜzºY<~FKí«ÔO—›+ÙìÞxϾ{òóæù¯«µ1ÆÓ¡Z­ã8ñ.VÚ{þìõ¯¯~|É;O~xúdõvóýâùfb`m• Zøkñ歿܈ï¾2i²¼±¯tš.«… +­‘y¹¸Xü2há=»äS3~¬ÄZ§* Ây_×è[˜Þ°¬a%œz ‚‹Ú ÀÏ0ô½ßwà_yϲ±÷ºËێמ¬ÖÚÛnót¼û]Så<ú¶hóm߬ŒöZ”+@(©æŠ¿?õ‡¼¨ýf&€2ý€GF«$ÒáLúþÐÆþ¶J¬‡°‚ØËZœO]Âÿ¥¬XøFÞ»UxyŽ ¼RÔ ¶C®‹ÌJÞ8u$ÖJ@ÉŽ›Š'Uv<´¨÷,î,@,ÁÄOšþ€¡a=¬•ÕÁbû¥¨=VJHZ:n¹¥cFÊ8Ò"¥8ŒF(¡Ö;dˆáš|Å•ÐëNöX"b’ܱdÆŸëUÈËBVQ6#”Ý *iÚÝgÀ{›C.6š•Ý±úÚÈEE¾9E£"€[ {È ™5¸ƒÛõm+¶ýêCΡõ¦Ÿ ÌUCLLAŒ™ÁIE(r ®x"ÔÓÌxÛ¦þÃ׶÷§–½Ã勬ZA–Z¯tr€Te=O&Yîx¥Êã89²5¢àsˆ‘¡=ŠLÍ'ŽàdW´N˜9% >wþ±ò¡—¸yÝ Á·Æ»½ƒ“ïqáý¯«¨X†´W ?-œÉ £®BéSèÚ6äÇÆÖû c½ÑŠÔétì ¤³gÑq¨Þ¿wôEHNVbtI†ILAT6Â:ÜÏKvjjBƒ¢ øÍ=üMKü%üÚ› ßæÀ!<÷­f4ÈøÃF·Ä¢w…À88o1Ƃκ¸ yBò»¼st_S<}æZâ]Š­ ë­ëE ÝkS —jv `R+°™ßfÛ¾«Žt¸Ñe÷6¶ånÃ…8×söq<¨àâ|ýã«ßq¡û¶ÌY¢»#%}^ñ‹¥oÆ×|¨§Þ‚"7˜Ýíè~³ß;"ቆ»Ë(1BA9sIN¡»}„cÐ~»•[©<žÏdRÈ—HV +®‡)x˜î´]QS§§ÃõÐpo:æ`C¦ÁlÈŒ¥ß”2Æ çYÇ*ù–Ã…ÒAqÑÚ±Ä@,ƒmiÂ}3u.Òd…\o9Ýê¬Ø«Wx«§ yjyÆ Ç‘ÔXÞ¿À +g¶ãíL2Šcî=k8ùK‹ ‡Œ ôPî0>M ĸ_ +n8ßLàÅãQ0y8›*y>lw,rö¶Ð‘Jl"ók%€Bì>xÕðËAMC†'ÄúŒ×sî¸dõŽäÇ-oc_ìóÜÚ‡Lè@P•Ý îDYã“~3­nÉÔ´eÄü±eqà1t§¾hêó^åbrLoŠÄ^´O™ SéømUpû((u¢Éifbž70éÞk OUkó8~¬‹¹WçÂ8­Á‘ER3¶‰JãOðB'.˜½‡J­‚'IÊwV¤Œá6Ïë"ß)ñ<ÅDÚ³Ú›ÜAmªzJÇ+ÜßÛ;ž¨Äv<‘§løËœ¥ðQbDtJµãÉ/5Ko¹ ã_¹Ûª.º¾Í8 rlöRÄ“Ì‹¦,¶{qq1 Üíð4è»> endobj -5141 0 obj << -/D [5139 0 R /XYZ 85.039 786.531 null] +5353 0 obj << +/D [5351 0 R /XYZ 85.039 786.531 null] >> endobj -1118 0 obj << -/D [5139 0 R /XYZ 85.039 585.057 null] +1090 0 obj << +/D [5351 0 R /XYZ 85.039 766.606 null] >> endobj -5142 0 obj << -/D [5139 0 R /XYZ 85.039 544.893 null] +5354 0 obj << +/D [5351 0 R /XYZ 85.039 746.277 null] >> endobj -5138 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R >> +5350 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R /F58 3380 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5145 0 obj << -/Length 2802 -/Filter /FlateDecode ->> -stream -xÚ¥ÙnäÆñ]_1ÐËrÝÍ›ÈÓq #»V mÖ€í‡Ö£¡Åc–ä¬VÎϧ®&{.=$ öQ]]wU×è…‚?½Èb_…ù"Í´fÙbÝ\©Å#ìüãJ D‡~E0>³¹²»«$ðU”ž…‘;V©Îý0ÒóîþêÇŸµ”Ÿ$áâ~c I2ågY¼¸/~ótæ/Wq¬¼÷KíÕfàS­M½\…IâÝöÌÛq¹‚U=âzêÝíw;i¯[¿·Çå÷?_ýý~"É^–&~–œ%Z-VAè+­_å(î³8q9Ò𘸉æåH#OQîý´ •Wšqß—HâÀL™¶`.Þ•mù»Ò‘?\¢_P¿Jâ C$êx¡•Ÿ«Ü!1Î2?ʉÂÛ…Ü.ƒÌá£=”j’„v›±lqx†Wš -t#jèp€Wk‘’FÑ€Ä-^ò­Z—¼¶ézF7na]÷3$á±E‘òîL³ Rï–åòµbv=]»ß‡BÒj¸|}_Ö•y¨aí匪×hÔ,ÖH0%\Ÿºd†ëÜðæžÇHVyëº*YŒ¼Ü–#Ξ‘¾ xâu’R×Õ0ËŽwÞþBê(,gÏo?#®®²ÒÍXuí,+á#H}•gÄÇÛå*ˆC–_æ=žîuó -³Ù“‰¶’׉oƒ€/¼ðŸ”w#¯ß£òF'_¹ân4HXaj"P ´ ]c*9׎˜LXÉ€š#ÒhíXLro E3A3q“9rßsvpª]t±ÚR•N7Øxĉ·Ù#ÙkŽ#€t…W§ðà ó’zãÓ4ËeB0»%úÄ,ðÄ5IbŒfhí:ónFFI6ŽÀŽÐSQI1“oþŽÕãÖ¹ÁÒi·ëŽÄÚñÍløÌ~Il¢.{!Úe#‘ªµ\–…¬0»£ðKaBw×RÃÞ÷Æ -4ÖœÂ$¶ªæ «¯Ù‰j˜Ü ¶Ø_¦-í}—›Þ~["Um08ÔrÌ 3ãV\µ~—¬Ñ£¶O#qøL@aDaÌpìù¡©E~¸÷àtj¡¸ð[”Ã…ׂOQøê¶HŽb97¡£à—œ—6È`»½ÜµFÒ¶f7Úí~¥HߪÁ†£DÍñàÍ9Îwç²A -†²G;Þ±õáÒ„c,l¶:š@`-y4vüˆÞQV·1†€[Æôéžç¤sø~!,¯Ü(¥xtȼs.Ũ7hu½"%~…ñ´ ²€âçRŒ0Y¶XLdP&OÔ³+ˆGò3Ö4ÓN¡)b6C9e5ðó÷ueq0⇤6¦ ÿmÝ™B‚g[0ÉgÑi^P”e ® x -A¹7º9I¦dÙwûÇs‚'_©0¢äå=ΈH¤QY¿¾¥üDd?oPFoÜââš!Ùë&O4me“Xƒ² -îÖ˜zR&®¦Œ7’fj' yè•ßû~D_ÃSŽ@"ÿÙ=Rèεw·î«¨N{BúýIükÑŒ¶Þ¾{˜Â’ò·ESÍLŒÈ±»žB^ ÅJÂ1vÇšÄ)§Hƒ¹˜Ç’á‰k#WY8œŒ'{{i)ˆ¦ðªrÄbM£SoÃשÖ7¦©KVn”z×o &'·§Æë ¸ì_¦G¸k2ñÄ{;ðÊd^Å¥a×’KEÉ«.EÙ ›,èÀ« Ù6 ÜXP -½,ÏÆñ.†=¬hä~Ä{*ƒ©¼É3oCefƒ“œ#>®JZj˜X nK£ ‹Ž{Á\êÓÃP¤b ùÉÆ[©øe2]ó0¼ £Ôì´CsQö-^û‰@‡¹Ÿá«¿bhûž~— äWŒû%<žËõ¶—¹™~•é1¬+Lw ÖõÈîu!<[ü¯Ò9Ã\ü)#MýP‡D¦ÛÚ:’óÝ,åv³Réf°©©UÏV(ð—‚ràCbT2'gX«¤ãäyuÜòÅ•aÿ`k+[¢!ÆÍ)ÆÏ\æÁê/wü­?IÏ>ÔZŒMQvô[ u¥ƒ(Ó릢ÞV͵ÕŽ×t8§Ö3õ4ÍÕ`Ò[Üvc¨n÷6ô¸møÜ’ðì}ÜàŒ•mvv£5aÞßqYŠÛý -"¹=WìÌ0ÃHaÄldÔÙ‰=0îíbã9s@¨áej)ÙW .oì[=Çù¾?â"·¿BašZ»¹….@Ù&> +stream +xÚ•Y]ÛÊ }ϯطÊ@ìè[Öã¦i.Ò6AÑ] ½}˜µd{Yò•äl÷þúËCrFòZÛ¢X,$Íp8$‡<$ÇÑ]HÑÝ6Û„IyWlóM–Dw»Ó»ðî@3¿¼‹”"Í’M–¦ô¾0¹v³ë<Þ„i±DÞ­“í&ÍrL~||÷ásÞÅá&Ï“»Ç==Vÿ +¢|³ZgY|YEA;ÖýjUw¢/cÛÕ:É‹àqUÆO\eôŸucFKß];íyXýûñ¯ïþò8 Ý„Ñ[Â¥9 —zá¢ì. +7eXÎ…{0§U¼ žÌ:Y­Ó2 †Ë™6<¯Ö4Úõe‰o/]#¼4µ “"¬EJ +Œý…  e¤g ºÖ é…!ƒ”q<­2wO#Ëöµ/Øœ7I‰-5£ÐœLË)³…Æol#(áøJÖñÙ6 'yðŒ…²Ì’‚9wòêe¯åÛîeo^¿ÈàÉ —•hÔÅ$SÁÞÖà“Èú=Ðq3ieðÛcÊ4skÒtŤbP¢2m%/Õ$&lÙ©ô¯õÉ!Ï­LÕÕ«’2¸ßö'–Ôòý gÒ×;>6>ò™ wzòüüû'¬ºÿQ°ì¬©X¬RÊËx”S#O_Åe0Zfk`C¸S=™ýP"V©"ŸHó|¤ƒH Ìw£_Êäÿƒ6‡Þ:BØß*ïv;ôN‹”]¦Ý³º'QMfûú`úŠi2ríÛB³äÛò™|x$óLÀg0Φé½Ø¥x§cÍÁ q|Ñí¬²m'V©‹ÓÁGÁS³dƒ½eò–›b +RñóJQŒ¯â% ~ ³ËÚJ&~bdž Ä­úÁeô^ˆÌ sÏصF$ÎGÝ®»¾f`l¤±[?ÌÄõ#AÈ-É&!ì]FÃx»)²lÕQºIÒüTGë´ >¯’0`R\!DÖ€4¬Ûú×0JÙL˜—2DAý? LQ,A£ —2=E;—G‡³# f +!à *X†n†½\yÍ-Ú¯4÷ sß-‡©xŸ.½E±[ß»õ§þ:­¹Yø{šjR=Iïaîžék–ÁÁžlcÔDZ^ƒé'ÛpnЄZ£ Ÿ}â8ÊÀ×y~·´ëŠu¤ëÆ©›°õ~Q,% fÑ,Sáãêh;*hfQ8°ÄûÎœ 4"´Ž_'¯ûKëÂÍcÆŸ-4È"Ξ`kîLcžš‰?[kYwáÈ 66A-IÄ´ ÛíiV åæÉøLI…ÍpaÆG`)~•ESºØ¦Á{!4ìBò~˜ ‡OëJ ì¯ y—¨éµ¿´²“ÕµÈH½=™þåZ‚™Ï¯ð/2èäGg ª¹Î2õIµf·Êÿ¹+õP¬(%stŒÁ•Ãñ¸‡bH7ٻʥö-;Œ½“‰ #ç¦ಠé¬ÖÀJY{£(LÅØ;%_ã¡çŽÂÊV(3™²¡Š³eàPƒÂבÏå¼ úÒíÔÿ"Ú×½«ù’ø:/‚sœiIv:7ZJÄkD[‹kÍ -™Ô茧HâÜei ‹qκˆ$äçÑ¥CY­VÁr±+òë±Z¥Õ¡=Xšƒmj†ŸXê£TÌÂЉ.ÔTûѸâŽi—òä!¦°3åùAŠ™dÊÊRa +÷#ѾéΧÚxÌÛ%_ö©îìj£D,’ÄÁW»ë;¶o·_yнŸ€c*þÒà*?rÅDéRNHç4ÌÞJª%eÜè&ÕX“*µ9d.Jß¾¿Y)Ô |rgM®l§NU[Ë Ó‚lñ¦Ø–oufÙ&Šâÿžwñóò&µ%EDpŸ|@ÙS„š=Î>(iH SnØ||†!vƒPJ-‡$×tŽ††<¸˜o×G[÷¦gìŽN(ÜÇ··ƒ,‚r¾@³¾æ†©t)!7”,GŸ€Á#ߪ’| TŠéÊ£6>þ +ÉaXiGùF5”LbŽÊf<*ý””°q3Ó ÒÝ#9’âö<â ­G tÔLtP)¤†ªWjg¬u×8ûØßç rÖÖxÞ& üÑÎêwiVȾÛ< î+nà¿\n4E r]nEs¬'ÃdŠ)øl¥(€¥çÆÑ)×ÿ3ê¾.ͨâ1Xq'éÈœà•ð²‡¥´5аåb5ò•%z³æO3®³v|`i®–æ5îå0õHXƧFOSlë³2ó C¬z§)"ÙÉåw듦ºc$®rŒ<êª WÖõ:‰s]/(Íý>•2¾Èœ—p[o„›ÝýV™/±&.3©NW,#@u WyôÁ犟PÝ7¦ÐTÝ6M¤új¾·¥4ü·ºš¤`”Ç°tšD7•\ì†<çhä!ŽgÚa!BpžÄdgûÝ…û€Ÿ³ÝU‡è‡A%~BáŠ(ÎÌvÜ”Žth¤&ÁX-ØÂÕt[» §¦ën7@6³>`â£Øhâ+5—Ó–SŠ­´òàoÜyef](¯–¨7;M‘t8™þ »º¤Í"ŸŒkhùH;Š$‹¬$»ÊìÎÉõ]ZA’R¹ôïJ+·Ã"êÓä™ó…©ìá$+íÒÕ×oÁoÄ +ªÆú· 5(SÒ©Bõ—I:»`942#½*çÞÐO7=.q¹‘Jˆ/ƒ¯Òp~]$ZÿP|¨aˆ¼¥×Y«; úò£m¯±¥CA¬[8*õaé*Œu¦šâp¼*Õ*_=÷×–¤“~¦=èv$ÜSj-¦¥æf¾[öWHª£çwlôªÙL u÷Jë!ƒo¯K»”o¤+ah¨|1ÀÍ+¤Ü³?8?J µVêÕWÒ©´3ȉ÷ËÁB”r¨;¾Ÿ½b5Õ=Â÷a^×$oÆ=<'  á„Ñ8:™õ®$×k4ã“!>yjyŸÝ¡2_£"âCûù˜u ,Çn7eåAÆzKŽ‚\©›ºT„¹3Ç$÷aäÇZ©41Ó¶ X‚! v½úH‚GwÈ&™—üíbÄå©4À‡æü]o5' ²jœnP£ùµ‚܃Òi•Ewá Ò£\â†tv%½“ÒH;øásVΪè$7q–h-ý¸*Š@zA¹{UsS§PJ«ê>hFe³_(ój +v#(§ÍâäÊ|]˹õ gÅt­CÀ|+s‘oJ'1îÙ& ¦$léèŽÎ·ÑúA^gþ·åcž¡)K"RAרäRüFÖ½_ÿ|´rò9uȲmЫFsFÝ6|´z붎ˆ忂»î-ù¶Ëq|-âVnA,·"•|)ôA_ˆp2=»¨«+¦âë0ÈÌ×±ôjS?7†Ýp{pmEì…n}ðõq4+áB ð­x¹RÊG7‡N}pE*fØ$³ žøõ/_Š• ½Ò:Agƒ»:ÌP¹ÁÒM¨[£”ÀË«ŸÐ2/ݘb_¸Å ÌšF~â#å‹ëÄWÖy,aƒM§ZÄr5•c‹æE¯ìÐzŽlÈqÚ ƒk7ňÕ=Ä+:¾ZÍg¬dìÍxáìCÏ£™×›9÷|U17>¯” økdf±–:ŸÚ¸‹É$Ê! ú'ùð'=ã0˜ÿpÅÜØâ9ȳ•pÑôÀwf è)BŽæ©±ÓBB¡}ë–«…¨˜J¬Æ·¡³kpÈCñ!§„ýÛÙÆ«0o5¤ø^ºÁ‰‹r“&Ûù=Éëû’8Ún²R~ ûº$Úf¯ÙÇ !eöê7t÷ü!ûàYendstream endobj -5144 0 obj << +5356 0 obj << /Type /Page -/Contents 5145 0 R -/Resources 5143 0 R +/Contents 5357 0 R +/Resources 5355 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5124 0 R +/Parent 5334 0 R >> endobj -5146 0 obj << -/D [5144 0 R /XYZ 85.039 781.388 null] +5358 0 obj << +/D [5356 0 R /XYZ 85.039 786.531 null] >> endobj -1122 0 obj << -/D [5144 0 R /XYZ 85.039 761.463 null] +1094 0 obj << +/D [5356 0 R /XYZ 85.039 766.606 null] >> endobj -3092 0 obj << -/D [5144 0 R /XYZ 85.039 653.856 null] +3152 0 obj << +/D [5356 0 R /XYZ 85.039 658.638 null] >> endobj -1126 0 obj << -/D [5144 0 R /XYZ 85.039 653.856 null] +1098 0 obj << +/D [5356 0 R /XYZ 85.039 562.194 null] >> endobj -5147 0 obj << -/D [5144 0 R /XYZ 85.039 615.589 null] +5359 0 obj << +/D [5356 0 R /XYZ 85.039 522.636 null] >> endobj -1130 0 obj << -/D [5144 0 R /XYZ 85.039 139.723 null] +1102 0 obj << +/D [5356 0 R /XYZ 85.039 382.133 null] >> endobj -5148 0 obj << -/D [5144 0 R /XYZ 85.039 104.412 null] +5360 0 obj << +/D [5356 0 R /XYZ 85.039 339.18 null] >> endobj -5143 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +5355 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5151 0 obj << -/Length 2938 -/Filter /FlateDecode ->> -stream -xÚ¥ÛrÛ¸õÝ_¡ú%ÔL„%H‚—íSêng2‰+“v²y %Êb—’Šã¿ï¹ (‰L§;™D pppn87DÎ|ø#g©~˜Í’TŠ0Mg«Ý•?{„•×WRC,4ÈÂùÛòê—¨x&}‘ùÙl¹éñ(©p¶\ñnÞ¼º[þöq¾ÃГ©˜/’$õnÞ½ºŸKïþöæÕ;\Š¼;øüxû~9_Hïöýk†G˜Owwpmž†Þrþuùöê·¥%Ë$dHÓ·«/_ýÙè{å‹0KgO0ö…„åÝ%Têïêêþ꟯E3ÞuI*L…JÃsHuAÊÊH] 줾×̓Ô{š‰§'Úr]´Èñ¯sÄÞnãÇÒû\îác]ÓÞ–ç0ÓÀäüùæ~}^~`°< FYTD˪+ë=/­‹¼Ò'¡ IÝ–'Œþp|Ý59Ñ‹[sDumv s6HCÛ¹)hU'Ù@Õtûõ…9DxWÛÇú ½7ÿÁ —@JÏYkûªîõÚ´<§Ðïcúãáºèò²â1Ÿ2›º1ÞÉ×pQØÐì‘-ˆ ©ãÃ$‰ŸËá ÞÁæ‰Ö—Ì3ŠbaÀ\‰ÜWêØ©Ô»wDÌÁá;>hèxÁáf‘>çw_ù7ŸîîÉz”##Ž|85þ"‡Dw®.FPc’‰4 -FÑÐ&ÐðHC±Ø«b_¤Id£Kͤ^ˆÍ,óE$î *æ+r‹=€Râ¤C×­;eWoS¸Ò×ìð’É£!þqÆÄEÏMür»‹f¯Þ™C²F»pðr@t @™ˆ5S™qÆš½ù4ƒv@±Ä 6Ïö%{†2'r:ºÐÝi¬‘£‚ˆe`tõþ…6ùØ÷þƒ¡‡G0yÜø­ ¢8›8ƒ}ñCïࢠ¦ã]zÿF/Á†6“¥—ÛK±mW¶ÆÝAÖR踠°Ýtä;ÎtèFoxa—³›Ám«z7Îa’fkœG[·ýUÖƒ¿œj:)Ë(ž9Vôÿ›$Z½ô“Ù·eú–¾ðS5™^ª±ZC -|Çö5Œ’`û@+ -Ê@€,$j "ïç-¹/¸  OÔ>ˆi¯£P¹á•ç9Ì’VᣵAl­ÃÏ¿%¿öÀs9x.â<ä݈kQR‰@N'ÓÌh"¥!ÉÙ]bŒF…}ô§0ºÒqtƒ3Ù Àœä‰0“ó^âÆ4&b.ŠÌúg -@NÒ Kn¦…0ßKÊÜmèn1Ê&p‡íš%"3;[æ:ñ\WÔÁðd»µý—©@|w8×€{ó7}-;7s=æ,3J0^ð³)ää‘Ó™_GtÕFá´e;0çºÎR©šÅC¦}³¤‹bëÔifú8)Ê`pÞYr«ÆsÚ¯§sí°èŽàü¾ ±ñek mzFc$­ S® ª‘-¨8 ãiÙö0ã²Õ0Èk0.Û‰ÓzÙNgeëœç¤žÈ5Ý£M×µ±)­4uÑŠ -£SšP9"«0ENûfTViGe5uš•ÕäqFVîy—ì°µ¸¾d‚túúbÚ¿ãáÿÀºÒÎÁÍ‚[B0g§RoþÐQݦäµnN8žî…!ÔD}¬ëÊ&ïH±Ùù˜öT&$¿qíõ0ãÚÓ0(Íh\{§õÚ›:ÎjÏ9ï’öVUÝšRïÔ Ï}•¿:%Ê1!‘V?’ÓÒêaÆ¥¥az5.­‰ÓziMg¥åœçú…LyìÉ&ë?æºkfº‚ƒul†=,ÀÝ.§&È<3]ÁÛI#rH™uYi”µÛÝà"ÑbQýÉ: # Ãx3íñ¡}n9¤î^\js´Ü…1÷Âv™8H]ˆ “ú„“*v`FUl`’xTÅS§YOgTìž·4~H 8>Qbº+GËÅõY¯¤ps<£s¼ÑÆ‘²éŒÅ­†AV“qÑNœÖ‹vê8+Zç¼åÏ\üŽ½-÷]ر÷¥UŸ¤ôõ&|?7M§Ç$†ë¢*:·4ÛÌMU€NÚj<>OƒMhHu¯Cƒcÿcí‰ J¨_=©¥f´d -‚@È8”L.™î¸ÙÔ~‰.¨o>(‡œû-k]óÌÉY/¨%=S¾ÂÚ–U9þÓä;-¨¦cLb½ùÆz˜ÑâH¦©ð{Ó0ßÒÌÆZóYÇQ+…ôÝàBÊ}Bøí#ó†ÊÕìáò’TàŒ;¬Ø8C´œ  6uUaâšuô/ô>×dKõÐgÛNÿ•ÚÁȸàXï*›U´Ôö½¼jkÙŒcã´#™‘±jÛÀ„1^?PÁƒ£M­·´,:a -N’ÔF£«ù7§•o(º²Ñ ʳ0#¡€¤á“dîëc§‘n ötØæõïUËD>•@ò¹ j§üƯ»Á99‚5Æ=qÖŠJZ“Áñ몦‹[1¢wÈ´ë)¬$»üñѺ¥ £QÎ?׺¡A’ -eš¡¯/u1¡ Ëôú5ã¡æ¬2m+ÅûÒ§`>­®Y•óîî¡Æ.Ý×XWôJ¨¸õ@öÅÙ@œÈà%ú3g‰&ïþù1d‚¦{ÝWÒ'º0в~O|D’ •R™Y—S. ²p`¬ó;ó†HF‰¬ -öXïPãßµ$¨µãø0ºRØY-Øž»²@b÷3œ¤ÓÀœ:Z •HÁ=»”‚7ã¤ùRK] -iµ°ËŸ/è!…¯ òˆA'ˆ% N˜k€ã/Æê¿òDëõAÆž2Lbã -Ð#9®@àÓFàÝîÔh¤ø±Ê5/ƒSñÉŠ PªD¤~4|.,Ð ïM¥9U¾MlòceZª™qœú¥Žß©¨ÓDÃoŽÏp8(÷ôŒõ½ÄŸc®gk nZSƒk'X7Û»˜m·ùà­ ¦ðâ`?¾a‡G§ôIw›¶uk!Ù½¸ÔS>; ¹• ÎúW¸Á“¯1ù}5"x–$ÆpüÄX€Üâ˜< -¢n)°áèÔk¾Ä¬_šèe—ï,Â]ðç 1KÑŒ‘kãh´-µ¡ßF%Pc7öF£/yŠ$Ž&Ý@2ê4¹]MŒ¾ñ¾›µ4¬ÊÓ<6‰E¬&I1 §´ ³Øò0@ÌOîy¸÷®_êQþUw.} -%Î¥Ul -þ L±¤¬b}´A.vâP˜ÊлÝð:˜Ê3Äôû`lMSs¤kÞ'aþš}~Û-ô"‘$r`ðlydx×5¨#VVeç¤ð«\÷ÖeËÞ§7DÛÇ)û^%ÞÇR÷„ž©²>òvԸʮU6€"&û@^]À@"«Çr÷ЇBå’©À_fúOýw•¾÷Št¬C£ ï‡4ZÓÂÙ¿J¯ùo-gÿéY^endstream +5364 0 obj << +/Length 2972 +/Filter /FlateDecode +>> +stream +xÚµZÝsÛ¸÷_á·R3KàWßœ8éùæâKme<»{ %Úæ„"]’Šíÿ¾û’`ç:m'3,‹Å~ü°H|Á¿ø4OÂH§Yž†‰ŽO×Û“èôFþ~ EtjÂ(Mpèýê䯟’ô4ŽÂ"*NWwD²Úü|øéìËêãÕb©µâ4\,³,..¡ïü×E|>»¸äÁÕbW •_¯WÜuõñ—³EC¿^^ñO_®¬~>ù¸šI±4¡I5Šñ¯“ßþˆN7 éÏ'Q¨‹üô ÚQÅéöÄ$:LŒ–ïæäúäŽ ™SžåÙìÒR,uæ¹q»ŽÏ®/ÚÅÒè((å÷re–¸½aÄý½4vÃæaO×L1àpµÆ¿;èík¦äÁ ôt[+ëÚï ;I‚²vìÆÚ»aø³ìe $ïÚåؗآUjhŒõwä_áyè4X=Ô/E«Te+|F }(G«ïøw|¨€=œ*?Fµ´kZT'9ô5‹#Ñîþ=J¢¦ÿ2ðÚwÙ4v:Vص厫çï¸uóÓÅê#7Ëvƒ,x”¿|ý“€mÌ <9=7°øìÍ~dUdzÂ畨VO,=»ûÕ(èGiÐÓzx(åXwíð€š~ÄÊu@úÇU‹ìpU˜ÊAÃm†¾ö%©%ÿü‡‹Ó1V-Ï­GþÅvÍF¥½—2úÚ!×D,†ÅÍzûØÔVÝ´èHÀ(¸],UÆ4dÛO²+˜×Êœ‡Šò9‘UK¼•€/t[°¤ 7ÓàÊ»k‘íÕó#’ÔkgþB`ÙÓfÆùn9c¿ÛàwhÉUF4þ²zÂ]¦¤ð›IðùMpCö¿éhï“©(ŠxôìüšÉb¾Þ¡Ùº €ë®Å¯±zî©å—ô†»r=Ú.9JúØÀ_}ծ쾲~V¤2šãŽ¨£ÈEÍ’Å96Š[‘S§°CÚÀ®¿C­pT D³fèЋÓB<=U¨D°%맴©‚8ÑQs{nOOæã…ÆÁ ¾h…LB‚Nu°.9àòHw'‹*MÄ:±5wÐÄ0ªRpo6þnîÍÆU¡ªÉh6Æ…º%¬þ%í +9ˆ¥‘ $Øf«I­ ݆ÁsKy,«Ô±åÀÛ +k'G~P•ë…ˆ±4XÆt@8Êyf‹¨ ƒÄ_J{@H*À8–ËwU9î$(#1*ûi/Ø8Ò!.•E"€r‹rÜb‹lEËB[rpÎô— Käù,œýú=>XOºÖ°ì…lÃ&”MT¥G& +3\ЇáZÜ·ï§HØ“›VrÐ8…­':ÀæÇ*°¬â™§±Ó@—7~à€N_Hon õ¶nÊž?¶eÛN)”ºÆŽQøûŠ¹jmHƒƒ õ/ˆS*™[ Ñ8§Y˜FÊ9—ªuêЗ‚^j“ÎÑÀL¾oŠà’ÌhD;úN¾±ôð{CÆñBÄÓÀ}—äë?- EôŒ©ðûC×þÅæ~G*áz,½ +³âÑuƱz9®(íBÒ–XŒ ‹1€PÇÀó(ž»|ƒƒë衽£²ï…eË¿´u1GeMl²6R:F k‘r,.ŒN™ƒÿ#>—•+PžpìȇzýP«ä5GŒÃ<.ÞvÄO °/<3…b£’#‡Ãíh›œ‘ ’9¯Rsü…įz”0c·WâÈdøvúÄÆñÝó Úh­‡ŠÙœÏø:x­é3¥§òÞY¦„oâägùŒû%ÿh+þ¸ë%O㇠'ã–EõupÙ¾V£¾/ö±¹K†ÀML°aòN»Õf¹~ÇC·e/» ìA@ÏÕ‘ °iºÃóÐF,àËBã eZ¿0ñž¥hF–Ö ’Ó± xŒ•äb‡LÖ£gÉ4ÓDÛèï ¼0ƒÛÍüfó8x„( §dVŠïç ÜBpµg¹çD‡Š(0ô5Ë*UÏÃRsÎåÏÜÓ”³[[3ÙŸGsI&´gªC¶x…G2VÞÒHFÍmØ­‚Ýòy£°xRxßóT™ 6E€c]¤0!ÊE¾Éà­vž=±ãOh§”òγŸ< +s¯³ÍƳœÒ`,©]®õiEe%ºª¶Ý÷ÊgHE˜9*:C5ù ÏLe…ú±pVþiǤ€§Z +GøAh4§;8~–üóXºT*t6!âüðV•SÖDw|p*SÎÕÞ½A@†sùdv Kƒ¶ÜJ‹o`û£}E—€nœº¦á슋°¥†»ÁR¹m¦ÉäØ9 õ½0)×ûhÖÅ­Þ?äÃ|*„ÜÁÅJ±Ò¼P$Û½‘´9¼B~ÿ'A&ŒW™Zf;nµ•«¤d²6üê§ð&¾ÏlçýÂÍ&xAl\@ϲYF¯yFB"—‘0ŒåÙü¼™S%Z”ùd‰s»Ù8ß-1–ë*¡)wSù/qœX4B8ÿ €Ã]O¹Z Ÿ¤=´³ +°˜‹1 ï…ç±dèÈxµ—p.Yº8dúêdŒ¦fW½À6 +GõZÐB-(u¨lä{cI C0ØGýÖb,wzoP±‚蕽†ÍL˜¥ÅŸÃfÊb³ãøcSY€– @K=­=¸?ýÐÙƒ<ÓÞ‹¬fvLˆMZ|¦ßxé±y±C.è’õ ¢’ZRc僻ñàŽ€ ÐHzXÅàÞmù0¹`=‡ÖÊGô7, ǛıE­»¶µ7+Þ§D[1ÈÄ3 1M‚Qæ…A¶w2vå®mH |‡ÝvK×­fþsÀˆ{Þ 8Ûº´KT^ž†±'êÎ%* ×qw­ 6Å,!¤Õ…lIÑ£gª#lYŠÄÖ•“}”FDÌ¥±jõ¥Ú4ŒóÌ ëʇÇtªÈ’SõêÚ- ð§!dîô€Ë¥ $+OÌ^±z^?–Ì°Æd˜µÖ GöoüÌAøzz€ñÈ–†©ú*2aœ˜cà|Ûêy”:^Ñ/´à'ÉQ +}-ïF6¯#Ñ< MœjÜNüœbéÖ–g7' §KT„áW§DÛ(§#0œu{lÙ(=ÇUF¹[96ŸèŒ\Ah©¨)aÌL?&‹«¾Úp§õPl3†ÂRqÔ¬YùfÛB6ÝL5¡m6LȃÆ)CYQÆÆW眉Ø*ÞOyR©˜›6.tûòA¬Õÿ ´ %}] öGŽËW‹ôù ]¼\D®Gqr”Ï—©ÀÖùq¦ŠößSöË_•Ýèð¡éÆã1.¯WøÈ,"# ê`5îèÜ™xWŸ×­‘¼tõyßjÖ”r<‘ˆ *2SM-çÇ0·zé­êÍyYÜpí“Þvøõ¥k«£×'~ËYLg¦øÍV^…fÖJÞŽÝ|¨‡½$¿a™5)+ è]h~…ÄŽÏòBµWϤŒ¬°4ÁòÕÜçàà k~³Nâ¿5, $Θ‚_-¡1¼GÜñÎ2¨¸q×5rÉ·%`dGs®ØÒ°‰Ó¿§añNë™›¿y¼35aa^)üÉÿ»ÿ‹94ζÞô®8O%DßO1Íü71c+endstream endobj -5150 0 obj << +5363 0 obj << /Type /Page -/Contents 5151 0 R -/Resources 5149 0 R +/Contents 5364 0 R +/Resources 5362 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5124 0 R ->> endobj -5152 0 obj << -/D [5150 0 R /XYZ 85.039 781.388 null] ->> endobj -1134 0 obj << -/D [5150 0 R /XYZ 85.039 540.39 null] ->> endobj -5153 0 obj << -/D [5150 0 R /XYZ 85.039 508.172 null] +/Parent 5334 0 R >> endobj -5154 0 obj << -/D [5150 0 R /XYZ 85.039 464.806 null] +5365 0 obj << +/D [5363 0 R /XYZ 85.039 786.531 null] >> endobj -5155 0 obj << -/D [5150 0 R /XYZ 85.039 438.313 null] +1106 0 obj << +/D [5363 0 R /XYZ 85.039 588.046 null] >> endobj -5156 0 obj << -/D [5150 0 R /XYZ 85.039 413.336 null] +5366 0 obj << +/D [5363 0 R /XYZ 85.039 545.092 null] >> endobj -5157 0 obj << -/D [5150 0 R /XYZ 85.039 384.117 null] +1110 0 obj << +/D [5363 0 R /XYZ 85.039 476.299 null] >> endobj -5158 0 obj << -/D [5150 0 R /XYZ 85.039 357.018 null] +5367 0 obj << +/D [5363 0 R /XYZ 85.039 441.553 null] >> endobj -5159 0 obj << -/D [5150 0 R /XYZ 85.039 316.371 null] +1114 0 obj << +/D [5363 0 R /XYZ 85.039 303.942 null] >> endobj -5160 0 obj << -/D [5150 0 R /XYZ 85.039 289.272 null] +5368 0 obj << +/D [5363 0 R /XYZ 85.039 269.803 null] >> endobj -1138 0 obj << -/D [5150 0 R /XYZ 85.039 247.543 null] +1118 0 obj << +/D [5363 0 R /XYZ 85.039 159.897 null] >> endobj -5161 0 obj << -/D [5150 0 R /XYZ 85.039 212.797 null] +5369 0 obj << +/D [5363 0 R /XYZ 85.039 127.476 null] >> endobj -5149 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R >> -/XObject << /Im4 4550 0 R >> +5362 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5164 0 obj << -/Length 2852 +5372 0 obj << +/Length 1396 /Filter /FlateDecode >> stream -xÚ­YYÛF~Ÿ_!ä%`Ñl6Oypf}>f= -‚ÀëŽÈ1&E™‡ÇäÇo]M5%j‚` Éîêêêê:¾*©…j‘„®§ÓEœ(W'ÉbS_x‹;˜yu¡„b%$+‹æçõÅÓ—a´Pž›zéb}{àºA¨ëü“sùúùÕúÅÇåJkí¨Ä]®â8q.ß>¿^*çúÍåó·88WðùñÍûõr¥œ7ï_1=Òüzuõç–‰vÖËÏë_.^¬G±Æ A„eúzñé³·ÈAþ_.B]g;¤xƒAèäF%•yé‹´¸ì²›ª@"ít{xÆ`&+XÚT] -ÑNAü†ZHÚ¾³Ò©ÁðqÅa“ ðœªÉ@}J&¶6óÌñ+ÓœÙiÐx•‚ÝÔ…Ð6$‘Ϥ9ó Ø–‡ëlÔ:%’ÅÑ~ÌwÏ$tw$ªa<Š–HÇtÛyܳ8xA§¦v¬s4—ûòOb…Sù1Ô¦G£8v ù-ï¦{rì˜Óèå]iXÛtÍ-­ŒgК¦ª«¶!Öl[ù Y§.ÁE…é¼Ð{‡yt…dÞ]âŒ+æ+‰üœAÞͨ÷3d ã™Ó"– cFïr@ ”—IÂG&7%øý7²—œCJÇ â¥g‡àð§ø81õ)dÛTVÆèFY ¦jL*Á~x›íÞÑŽ?œzyÓ³–6M…ùÁƒ„ÊOŽ‘%2«¬‘b 1RLe²(ãÇmFxíaì|Áp— -æê`Æ?pòQ¸B@ ¾7Õˆ -Z^:›:dK”ŸCW€6¢8tÞ/ʾê0áQ:¾—ƒÍY͘”IˆŠŒ±ßZR¡GÝŠ]‘õ[÷ *ÒÈý(*¶hFP¸:ˆ,TD¡ë{Ê€zÂóAê­þ·–òˆÁTŠ~é?ŠÁT¬]­Ré§2úò…iÆRÔ…Aê&ÂÓ‚\zêB& Ò\:šÛbt©]y·“ò▊ߪço¾¼‡¡(Ðãڪ◠X°¼¦ìÏÎ8nú LÖÊù@à×?€:À7÷Û†ñ²Ï•*ŽX‘d6T½8b§Vh@:»Ããôv#ˆwÔ;7Uâ®+olüˆ"ý¶=T3$DÆÙÍ”a,×)—rGÔNñ'n¢âƒTr¾wtvÊT†ÉfàƒÃ3 ›E+ë&·¯b“­‡ÂåçšÛÞO_F¾ß!݉'@ÑqJ©™pbâ¡ï–ºn¡t+èö»ßrðv<ï™HÚŽpªùJŽ+íƒ 'ÉÂfû!è€! „vgĽcQ<†e˜e£†¶™^&±aúTÊDArb~ð¿6oÊ€ÍðäÑ„Í»8ö|‡t†Â.u¥i^Ç”X4º^¦‘óˆöC7ŒöïÄþEö觺I,E‚¬Ý±Pô8à>ŒŽµ(*ÆdG½Ià¡_0b=ŽUõ¬i×è8¤2¬"çA†ÍÐcÎzþ4nt‡«ÒÄ@˜ÕÇ/”*v…PšVÊ@®Ù´ÔbL(¯fâС*ÄŸj2¼µÁ¤»17ÝroêÌ4¥™Æƒµ ³ì¤_}ÆŽåææðþ´Ó—Z?§®ºI¡ØŽB¹xé ÅlÔgšÑ¬€¬”ß A‘üÆí…ÐÆv1õ*”ó;l¤˜§IêÑ Ò®ÂÕ_Ð4ÆÎ ²ÛR ÌV»F¬Î ï9³S· á™’Cœì àpJX>УBð¤ß16ÅžóFè¨Jëøý†‹¯1ljò›Y6™*лü=×Ë´¥¬bOŒ0ÐVQ·jû—n5€$Ïyu·¥®+2h 2Bî4í3 ƒdc$.ì²ùL)â¹\ˆœ"QÙÿ¡ÚMt:PBßw}edáÆ–:–7Ô‰&úTàÿPUÙendstream +xÚÕXKoÛ8¾ûWèhkF$õ öælMѤÝÄÅÚKq„µ¬T’“ýù;3¤$Z–Ó¹ØSä3ü曇Äþ¸£|æÊÈ UÀ|ÉE>r%¬\Ž¸‘p¹K§óÑÉ…8Üe‘9ó™'ßÆ}˜}™ŸßN¦RÊ1Ød†j|usgŸ'||=»ºÑ‹óÉ”o'B¿ÞÍõÔíù§ÙDÁÒÕç›;þpõånòcþqt>·¬˜zÌ $šñsôí‡ë$`éÇ‘Ëd¤œ»ŒG‘“<_2ß“æy5ºýÝž¢×=ã¿WÊgXÊhøÂú:CtæÛ:wh ] ‡îò‡Áp\Løœ¿‘.êbJyC*SÏ,€å»ËÃþ%‘2þöØ´ê³"Ÿih¿»¾ h.Ì"Z¥uj@¯S¿u¹©j=ÔbkØ°Ni\gœ€S ;|e©ã‘d ÿâ9Õ‰dÄT$;ÓNñäÇNEÈD(é× Ь£-"¸ Jà]-&Ùz9€ŠÏ™ô”‘KŠ<Î÷_À¢–SKeÈ´4€ÃóY ø6t¢apQfKB(®)3Xú´3JXk‰{ÅfY¥&þ¸_+ ÍM<:Ìñzë¶CÎ2­ŠM¹°±²N˜Wøí‡bÖBÜ(êW¡ì†h/.¿“šŒ&—«âÃb¥/±,é†OæÖxÛ"×Ô¹ŸÀ¥Æ&†6æŸÄÓåm̬ÚSíkh´Ieà¨iÓq!ÁÀ›šîËEŒã'„­Ð)·[¸&ÿ®Še±ÖÄI²žl©ÁûÏ4{fób•¥:;ëçå¿U×õ Æ_oà¡:Ô®ÁÂØܪ%YüdÞA÷6õÑ•tT`e,_8D€Û<6ÝÝέÆåÓýXCËëªC­–'—Ø  +wåëkÁo¬êí7ìÍh¾m9”·“ +`¹K*€„`ù¸M + „Š³å#-UÀ\¤(|ÀëežU¤´ƒ*JcÛªU0_Í€½‡â+HDí]ÀNJÄ2rÞ¯šIÏe¼”ç”J¢®•Ó¾‰dçëÊ Ôxد½ØBdŽ€Ûâ¯]gv`wÙP§Ùsr #(!T?à°–PÔFÒTcMÝ·Ù¸c×m¿Ñá“S,¬fINVgU]Æu˜ð£qñ€¿Jß'z÷§ÅÆm8nBŠÚ` Á4¡tJšèÓbdrÞ„Ë:[·Œ'á:k> pI!‘Kñ@SšÉ*“Bµ…]ÜÐËwx)<Šþ8¶^ðÓ&GX¯VÃ]àÒ kÖÊ6£™C×æ$lÊìá^‘úeÚ«$;/g:¢ß”©±¿ø’Õñ^X¼v+*ü.•è­Â78JÞ7-ÊY>À5Û¸Lµ)Ñc«?+í¨!ÓªŒj Ê5u1á‘åú ÅÉ駻ç±ÝÀãCi‡%¹m¬pÜË[2 +¬r6å&´Bvåq’êi‚;ͱµ2„ Ó¼!€Ð'Ýú-:ãºx,ŒØõÝ@Fú‡|‘Pƒ÷Rµ/-m _o+ד:²¸ç‘öë*¹ß£œ &U4ü¡ÔXó¾O÷2d\µ7{Õ•\í°ÃæUcàÿÄi¢Aendstream endobj -5163 0 obj << +5371 0 obj << /Type /Page -/Contents 5164 0 R -/Resources 5162 0 R +/Contents 5372 0 R +/Resources 5370 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5170 0 R ->> endobj -5165 0 obj << -/D [5163 0 R /XYZ 85.039 781.388 null] ->> endobj -1142 0 obj << -/D [5163 0 R /XYZ 85.039 761.463 null] ->> endobj -5166 0 obj << -/D [5163 0 R /XYZ 85.039 743.459 null] +/Parent 5376 0 R >> endobj -1146 0 obj << -/D [5163 0 R /XYZ 85.039 496.683 null] ->> endobj -5167 0 obj << -/D [5163 0 R /XYZ 85.039 451.608 null] ->> endobj -5168 0 obj << -/D [5163 0 R /XYZ 256.553 362.21 null] ->> endobj -5169 0 obj << -/D [5163 0 R /XYZ 85.039 199.093 null] ->> endobj -5162 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -5173 0 obj << -/Length 1713 +5361 0 obj << +/Type /XObject +/Subtype /Image +/Width 541 +/Height 173 +/BitsPerComponent 8 +/ColorSpace /DeviceRGB +/Length 8338 /Filter /FlateDecode >> stream -xÚ¥X[oÛ6~÷¯ð<•ZÑÕ–ì!+Ò6E–e; Hó@KL¢N2U‘NÚ!?~çBÉÒ,7-† És?ç;‡Rü±?þ8‰]/\Ž‰ï†I2NË‘7¾Êë‘o9f–eÖáùm5:zÏǾç.½åxu³Ó»QŽWÙ•óòÍñÅêäÝt†¡ã'ît¶X$Î˳ãË©ï\ž¾<>CRä\ÀöÝéùj:óÓó×Ì<ï/.þ@Ú4 Õôzõvt²jÝj ‚ KôéóèêÚgàÿÛ‘ç†ËdükÏõ\ŽÀ)7ŽB»/F—£?[UL‹Æ,5”‚8LÜ8 ÷sàÇ9ˆ=7ö"ÊQ…¬…‘¢ -"G«£”¸ ëj: xâ;[ä›[¦ÊºV5œXÑ^ì9ìÿž kˆœÉ9Ô4¦tI9È7ĽѹÉï)kè¸ Šzºbç+ÒÔ–M§bË­–Lž|˜&û¢ÏÕ„É&ÎÆ -‘Ro§>³<¾BnQ°k–ù†¹Cg q-ŠNqØž-Œ4†<¿¥u÷,×F³/MZ7¢d‡B/fû+CzÝ$AÏ>U _ >²†\²ì”VU–‚ì¿àC]‰ÔZ#5 œT´Öî¡.ñæ®ç/¿ÝÞ;‚vTß]ÆqÚsè¶yÄІŽ]0ëCjâØsþš†€!úÑó#t2E¯ ®ðTavç N<'—’h‰L3žÒ†—ï5áV¹¹ã´’©šªËÁÎàÙÁvxöñ<š»1…J¸¤D^l 'y# #`Á݉µÀ5FŒÄBré SçC[Q£V¿ŒKÈv²Õ²< oÆlÐn=Í¢ EÄKQ"dÖð÷!§À6ÈÁ,)lÏË~Ežæ¦øÊê¶ÚZÞ‡²ÚHMFÀ—šØuw’åRžk¥ØdLQhÝd~L§xÚñ0b¦ð.7¼™œœ¯Nhösç’5Œô¡A)ÂlçqìœZÙÛºí-ÍîÝpi¦^TLP–’tµ®å¦m,vrÀ0˜¨s‚YX&Τª« È´‡4.wc¥=ÏpöÚчfêž&–Á3£›ˆç1Î#ά'WöJOÓ¤E©Ï5SÕÖ ³[³¯éÖºAœóÝÈ%>~ w΂JôC¹Ï%–1žãB¡“å8¶E½E­nv>¢XÀ”lj=ms$ŽÕ”ª ôf&¨}â{žse$ËÒEë@nUJK;æ9@ÍÔ‘– ©Ê Ä­ï”…`èyÜjYNÁgˆ!ôE°\:i-w=ŒÝN·9£s}G•cë8â½9t¤Qâˆi÷šÀ°UEÓÖ¤[P¸ºõŠN¥H±·î¬C<‰¤í–nŒ7Û„DtÇ póVôw¨ü7|ç”íeÑ뎢…ƒ¯¢{Ç!N·•½¿ì Žù‹HiöÐfÇIR™ÊÞ]Ù™€xØÜ )ìQSŸæ¸¹á[´þ‚ѽ -»Ãb‹Bw.(¶Z)ó3Ügp¿óM· íf÷ü|䇄!SñrBofÕ#ŒƒyÔ•RÅcVç÷²~¬TmôãG?Œ®0óJfì.‚¤—Ð3…¯j¨K—k^Öoò[^ßäö*-keý9’&=Ò¢\‹#r‘ßÕyY’üÀëd¿rµJ¥Öt×9™š¯eŠãêN•R_O~\Lʺ#,\oɲW·…Z‹âšH‘çý¦jB¦dñòW~DQÌ ?\8UTŸm²DŠÐ¥¢å¥ìéð½I£Œ(¬Ut—ŸÔºoH´hkÕÝù õþ½Aœ©°xá÷ÅŽ •²åÙ7™åôjo3øÒ}£çj@Jn¶e'¥8ûèvf¹}~‘e6¢ïÈd!ü1èЦ‚¹^yóÿ#êìéŒ*0•×e“á!Ë=3"+óÍaޖ؇}ñ~¥øò4¬|Ïóy¸+ô`m;xj{Ñ2®uvHé`qèQT6#³æyñüYõœ×Ïô7›nPÝçžš!ñf p§ðãÓ ¢JÐÛê·q7V¥Þ–ò;QÚÃJ·]÷Yw.¹l2Ýe¿Œ3;ÿh<&<yê Îv¬tó÷&ɽ¨hBðÕðÝ(³M6ð1zn0ø)¿¬õýë¥ý ƒ;8 |ÅAà~ã {ÿõ·ùÍžÃÿõ¹ endstream -endobj -5172 0 obj << -/Type /Page -/Contents 5173 0 R -/Resources 5171 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5170 0 R ->> endobj -5174 0 obj << -/D [5172 0 R /XYZ 85.039 781.388 null] ->> endobj -1150 0 obj << -/D [5172 0 R /XYZ 85.039 706.019 null] ->> endobj -5175 0 obj << -/D [5172 0 R /XYZ 85.039 671.274 null] ->> endobj -5171 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> -/ProcSet [ /PDF /Text ] +xÚíyTgÖÆe“8.•hTÀ%b0†¨qA (.‰(Q4.ˆŠ Æ#*‚;¨1"`DA 2‹Äã8Ǹ$Ñ™˜‰—cLœ8ƒ&愈q”Õïù|ÏÔé„´ÝÕµt?¿?8MwuÕ­{Ÿzo½OwW=|H!„B!„B!„Bˆr4hЀI „«ê“““««kpppAAvb»sçNëGà+E!:šATTT\¹r%..®C‡7nÜÐHl‰‰‰3gÎœ>}zRR+E!:j+«W¯ ïß¿Qý©G„††>xð@zË»ï¾Û¼yó-Z$$$Ì›7¯Y³fxœ-­§cÇŽ5Â$ÈËËëĉ5¶…©©©žžžX {÷î_|ñE±õíÛ÷ôéÓŸ}ö°R„¢Ç¶òßÿþ×ÕÕU<ŽˆˆØ°aCIIIqqqll,Z‰ô–˜˜˜»wïæååÙÙÙ‰Çùùùîîî5VŽN´iÓ&éyö²`ÁÌÊÊʶoßþüóÏ×ìÒ¥K]ºt=<<¾ùæ‹Bt×V0Î;::ŠÇè/¿þú«x|ëÖ­gžy¦Æ[Ð5ÐV¤Çöööµ×o¸Œa[‘@Ûrpp¨ýÆE‹­]»V<ŽŽŽ–š!„µ•‚‚i¶‚ѾººZ<®ªª’Úá[ê||íÚµ°°°ž={¶jÕªaƵ»IÖþ†Xee%Âøᇠ£Â“¬!:[ˆÍ–~åÊ•èâqÛ¶m1I‹ŠŠ¤vó»må¹çž‹ŠŠ:wî\aa!¦?&´•ƒ6¨E~~>ëEˆ™Ç»6¿ù)³··oß¾}nn.+em¥¢¢âûï¿_±bEÇŽoÞ¼)^Z¸páºuëJKKKJJj|¶R[iÞ¼ù±cǰΟþy÷îÝ&´•1cƤ§§>³wïÞ±cDz^„Èr¼k훟"°ÊÊJœ=Jg°D×g/ŽŽŽ˜›¼õÖ[’ïô°Þo‚ÕßV0×èÔ©“ƒƒƒ››[ttôã¶ÌqИÐË Ÿ¼wïÞÿøGÖ‹Ý í|óSZ¸¼¼«b¥!DmE;ßü”f+)))AAA¬!„è±­h盟†Ÿ¢Î˜1£°°Å"„ݵ|óÓðIôÌhúõëÇbBˆîÚŠF¾ùYãI¬í‰Å"„½´­}óSzÓ%t44©°X„¢‹¶¢µo~š4iâïïíÚ5‹B!„B!„B!„B!DIªªª®]»öõ×_?~<777--mçΛ7o^³fMTTÔ²eË€ñ$^ÂX ã-x#ÞŽ•`UÌ'!„ØHï¸xñâ¡C‡Þÿýˆˆˆ   º»»7mÚ´¬`…X-VŽM`CØ6ŠM³ãBˆ~)//?uêTRRÒܹs‡ æææVO#°³³suuõòòûôé³k×.ž{Úƒt!iR‘L¤Tº7!ô"èEØN1¶iÓF$°Q£F³fÍ:þ<3cHˆ4Š|"±H/VB/‚^„-PTT´råÊæÍ›‹Œ¹¸¸ —••13æƒ4"™H©È-’ŒT#áÌ ¡A/ÂZJddäSO=%RÔ¿ÿÜÜ\¦È‡3‹ôŠ<#áH;› ¡A/š())Y½zµÔPFŽyòäIªÅÒ ÉHµÔ\P~‰‘Ћ ¡wªªªÖ­[פI‘Š¡C‡ž9s† +Q$iùG!PzÚ„^½rüøqé*p/¿ü2g(êÎ\Péšx( sBèEЋÐcÇŽ»ìêêš““ChåuAP&æ„Ћ ¡q*++7nÜ(”Ö°aCôЊŠ +V_; ( +J#tˆbñ³?B/‚^„fùú믟}öYédø§Ÿ~bŵ J#M'Q2Ž9!ô"èEhö¸C‡‡f•µÊ„bq^IèEЋÐW¯^}ñÅÅÕ°S4Uô5P dâz(¢Fn]AèE[ö"öïß/~§Ó¾}{z)ú1P>ñË5” !ô"èE¨Biié´iÓDOœ8qâíÛ·YJý‚ò¡ˆ¢š(+ŠËœzô"”äúõëžžžâü6--´PJ1÷DqQb&ÄÆ¡A/B1>û쳦M›"NºñÖwvŠ²¢¸(1 +Í„Ø&ô"èE(IRR’¸b³¿¿?Åf­"DqÅ5ÌQn&ÄÖ A/B1ª««.\(ZÞºuëxÁ+ÅE‰E­QtÖÚv A/B1ÊË˃ƒƒÅ,¿,d# ÐbfŠÒó6¶½zŠñàÁƒ#F ’'žxâÈ‘#,í€r£è(=0!Vú׿þ¥€ü q»@Ȇ£. A/Ba/"''G\³T®+ˆ¶‚±7_>Ìo+kÖ¬‘+˜¿üå/æ·•÷Þ{Oö ԻﾫŒü qMTˆ‡ƒ¶Æ¡A/Ba/â矗-•ÑRc[1¾­,[¶L– ÔŠ+”l+ÿgÔC<‡n-C/‚^„Â^Ä믿Ž5 R¸­@0 6 + qèÖ,ô"èE(ìEüíoÃ{Ÿ|òÉ‚‚£2l+Ó¦M3§ÄÛ·o_²d‰ŒmeÆŒæijyó樨(yÛ +Ö–jXƒòmEØÚ¶ !q× ô"èE(ìE‹;cè–7$¶•Çj+Ð^```˜©Aoª´€‰;žCNƵ½z +{‘‘‘x„!û/+ÙV·­àÜÀäTl+$„MCNÆ5½z +{×®]—¯ýôÓ8~oݺUÏÂu.£AèEЋPØ‹(--mÑ¢8þ<Û +Ïgä¢B d¦¯¶ò׿þÕÛÛ§dèÑüq ×¹Œ?U¡A/Ba/bïÞ½綾^²h žm¶i! ÈL›m**++û­W‹‹‹QŽ–-[J¯ÖþUe´½zÊ{¯¾ú*^JNNf[a[±€̴ÙVpîر£¼¼üßÿþ·ÅóÈÿþó<äÈ‘gŸ}Vú0%++Kê,u.£)èEðèVÞ‹¸qã†]ãÆo߾ͶBáYH ƒÌ 6 ¶•/¾øÂÓÓÓÑѱ[·nbæ.ž‡J]\\ð|¯^½NŸ>-žâ¯Âm…Â3Fxè›æ|¨çááÌh­­(,9%ÛŠÖ¦0ô"èE¨âE¼ùæ›ø»g϶žÏ(Ä&„gÝmE Szô"Tñ"† ‚¿Ge[a[QˆMÏ´·/T•æ¡ð†^½U¼ˆnݺáïÅ‹)<¶e€Ø„ð›/he¦0ô"xt«âE´iÓüñG +ÂSˆMÏ–ÛŠ2Sz<ºUñ"š4i‚¿ÅÅÅ…§ ›ÛŠ¥§0ô"xt«âE899áoyy¹ÂÂCFŒ1Ñ Æ·aù„wàÀ‘#GšÏÖ­[)¼ßbÂc[±ô†^ÛŠ*^„þVWW+,¼ÜÜÜEFƒwÕHið‚ବ,ñXáåääÌ1ô ñøNòŪð@^á¡O½ñÆ&wºñãÇÇÅÅiMxâqvvf[±ô†^ÛŠ*^DÆ ñ×ð.ÞŠ §÷;`Ê”)~ø¡a>£b¢œ>pjÙ¥¥Œm0§ÁÔ©SSSS 㙽`¶cª£Û7ÙÛ +v?Ø8¶lÙRCu>A>I&áÖ„± á±­Xz +C/‚^„*^ÄO<¿Š}£Þ„ó™ùóçïÚµ+ êaaa˜Yô è¹qËFyÛŠ‘ç3ñøûû‹xp&‰xzôJHJ½­@xñññ9¿šÝ¬Y³0}Ë|ö%nkœÓZ§C;h°­@lBxl+¦Á>ܘ{ÖЋ ¡ŠѶm[üýá‡4ÞV¤kåa$Ç“AAC÷íKS±­¬_¿^ŠçàÁƒãÆõOMÝk‰¶bÌù –D[A>·<gVxòõ°×Sö¦h°­@lBxl+E‹-0-ÍÈȸy󦑹үÑùµÎšò"žõ½㽈îÝ»ãïùóçuÔV/^ðᇎ¾¾îò +ñä¦'ˆ'66¶ì+V¬˜7oVF†ƒ¿7uÛ +2#¥§‹ãÇ{ÇÄ,× ð 6!<¶cèÓ§ÏêÕ«¿üò˪ªªÇͽzªx>>>ø{äÈ……‡t3×Ãb8C[¾|¹(tbb"fcÇöINÞ)£ð²³³ƒ¥Œùééé­`U¿{Á¢ÈÈH/<<üä#BBB¶l‰[º´ñèÑ^Ä&„Ƕ"ãĤNèEЋPÅ‹€zñóP……—/²O®`äÞ¾}ûbcÏž=_}õÕ±G|þùçˆ$:úÿ¯Œ§AáAlBxl+2NLêD¿^„›[sMyƒw¢a¼!n¼²téR¶ ¶YBÒšð 6sn,ʼn‰ñЋ°b/¢W¯öšõ"PSü;v,Û +ÛŠ2@lBx¶ÜVdŸ˜Ô ½zªxbÎâææFá±­(ÄfŽ3³IU4;1©z<ºUñ"***5jdggwçÎ +³4ÄÉAxuˆf'&uB/‚G·*^ôë×>¬¼ðâãã×®]+¥ÈðÛ©©©‹-ªó¥ÿb˜2ùóßÂÛ¸q£a?¥Á¶¢°-ñ 22Ryáaljœ”¢‰'JSRRæÌ™SçK5þE[™á-[¶L^áMŸ>=44ÔLá!…‡!]­ËpAHDiqlWzl+*zsçÎEœ¯½öš%bX±bE=ä^``àŸþô'ÓâA±žþyy…7zôèáÇ›“%4J___…ççç÷Æo¨¢:Éü«óY Á¶¢–ñË/¿4mÚK~òÉ'²Ç€ÑrĈ²·•7ß|sþüù&Ä3lØ0 ¹’Ø6lØ#­yÒ¤I†Â3¬¸áKÛÔ©S Û +&,óæÍ3-EÕÕÕC‡õ÷÷—QxXÚŠÉ÷ù5HB‚œ *ŽêªC/‚^„Š^FWŒ]»v-++“wªŒ!N^î# +(=>xð`NNN/Õøm%>>CñÝ»wwª2cÆ Ä#拾ÑVvì؆õ¸ñHS(Ü°­8p@Z^^^vv¶ô¯áKH^­ý’h+ C† ©¬¬TLr$!ANÒ5½zjyÒ€€*È;UÁxkØVdA´høqŒü;wî´P[Ù´i“ ¯˜ª@]†mÅü;2`mXgTTr¥˜äUKœœs A/BE/âôéÓbvóÍ7ßÈ8UfÿþýÇȇh+XóÌ™3—Ÿ˜ªà]8pŠ5P&°kX!Ú +Öò¸òS¼gh½{÷î'}úôÁñ•øÅäÙ¿Bâ`®)èEЋPÑ‹@Qð.oooYn;.¦*Ù&Ožì/7èãbØ4^~bª‚·„††N”±fðXò“¦*"KAòó=±ZeäÁ@6$Äa\kЋ ¡¢qçÎñ*ó-MU,‘ò“¦*–æ±ä'MU,Šò?‘€xtt_›‚^½½ˆãÇÛÛÛ;::žVÁv@¹QtqŸAÈ€ ±&èEu½´°Å‹cÓvvv111¬…-€B£Ü(:JÏÏS¬zô"T÷"’’’Ä83iÒ$zìÖ}‹‹³ ±bèEЋPÝ‹ÈËËkÒ¤ "éÛ·ï?þÈÒX(+Š‹£Ð(7bõЋ ¡z<.\¿Õ}úé§Ïœ9ÃY((Ê*~c‹B3!¶½zêrûöí 0{{ûøøxïÖqÊŠR¢ (+Š‹3'¶½zª·¼åË—‹QhÈ!ׯ_gÉô ʇ"Šó”•'«6 ½zªsìرfÍš!ÎæÍ›gdd°pz…CùPD”eBlzô"T§¨¨hØ°a 1nÜ8y¯¥I, +Š…’‰Ú¡ˆ(%sBèEЋÐ»ví¿©ÁyïîÝ»y†£ý³”ILRP8”9!ô"èEh‚‚oooqê;hÐ ÞãI³ 4(¨J†Â1'„^½Í’žžÞªU+1áš={vqq1ë«PE˜(ŠÅœzô"´Ï¯¿þŠ±ËÁÁA\"511‘—“R”…)EiP ”‰i!ô"èEèˆ .ˆ{gƒN:effò$G­S$%µ@Qø;GB/‚^„~Á\L|Sxyyegg³¹(ÙPp¤]ä…@9˜B/‚^„Þ©¬¬ÜµkW»víÄàæééùÑGQŠ––’ŒT‹œ#ù(äHèEЋ°&1³Ë^½zÌ™3gÓ¦M˜,\¾|YÆ»Û`UX!V‹•cØ6‡Jó}C$BEÀ›—'„^Ñ8W¯^ÍÏÏ_»vmppð€Z´hÑ ^Zµjåáááíííãã3jÔ¨ &L›6-44töìÙó À¿x/a,†…ñ¼Q\-¼Â@0 !<ÖˆzDïBÅéÁâââ""" ÔµkWé›áæƒUa…X-VŽM`CØ6J!B/‚Ø………ß~ûí™3gŽ=š———™™¹{÷î;w¾ÿþûqà_<‰—°ÃÂx Þˆ·3‡„Ћ A!ô"èE˜Ìÿʆ&endstream +endobj +5373 0 obj << +/D [5371 0 R /XYZ 85.039 786.531 null] >> endobj -5178 0 obj << -/Length 1968 +5374 0 obj << +/D [5371 0 R /XYZ 85.039 763.817 null] +>> endobj +5375 0 obj << +/D [5371 0 R /XYZ 307.125 631.737 null] +>> endobj +5370 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F41 3054 0 R /F58 3380 0 R >> +/XObject << /Im12 5361 0 R >> +/ProcSet [ /PDF /Text /ImageC ] +>> endobj +5379 0 obj << +/Length 2927 /Filter /FlateDecode >> stream -xÚ½XKsÛ6¾ëW0ê!ÔL$ÁG;98¦ît’4V6Z‚$6"©µýñÝ@Ѳœq“NãÉ»X,‹Ýo’^ÒË”¢ÜK3)¢,óæÕ(ðV0ój$­ÄÔŠL2Ïf£³ïUâÉ@äAîÍ–=JÄ*òf‹ßüç?œ¿½|7™FQäËLL¦išùÏ:¿œHÿòâùùO8ûo|wñz6™Jÿâõ+–G™_Þ¾}ƒs“,òg“÷³G/g½Yý†`BŽ6}ýö>ð`ÿ£@DyæÝÀ8¦«%TYz3ºýÜ«â¹ØãU§\ ¢L¨,ºë©Nø D,SòÁ¯h{³ƒ3ÉÌŸ54µèÊÍžéëIh™-œ·\ZöͺœãÌÉÜï´1e½ê˜º¡5­fª¬¶›ÖÎQIi60ÜóL±€ñB/X宲3è⢚„)paôØ*^èe±ÆƸ%SÜi]àÒë²Á¹Vàu@dƒãÇa*Rt#üESOdú ŠzS7;•èìœd–M;Q¡¿Ò¸•Êüâj¢$¸Ë’f]v<Ú¿¬Í·“iœ>Õ -UÅžW¨JóÜA+Z–ƒÓÕV¼¬ù»ŸàF-©¿Ü™];X¾Ð¸º Ö¸œœ‚7ä^§tÍÌKÚ ¢ý ‹{b5Ib‘…êÁ -NU:¬$d"ˆ¯ûÔТÔðÈJßÖÒ'µJ3‡€NbOJ‘+…7šc ƒÝJŠ$Ute¯wz}|J'(‘Çdž÷Ñ“"ˆó3 O=£ƒÐ8‹ýf¨PmC@Ô*i£OmÞÔàÌxµkqgS65ÃþŽµ!f=aN±XðÀà!5—Œñ¥®Ç{ c_I¿áo.ߺ‘µÖ4pCb%hOÈwÉ——óÌr߀'5G¾W¼`Úwx‡ÜMÁ1?m›×;6#b]D)Ù‡ˆ‰Cƒ³ªÜ5’±ëA @Ñße;¼¸¨Üf_ÍlÜ>µ ‰DöZé¶E‡cqÇ|íÚÒJNâvJÕà1gÞ2ë¬bŽF¬ù±‘ÃYˆAÑvƦ°m¾ýAØ$÷ºž{S+AU+¡¥Ý‚ýïqÒ¦ªÌZ”"MA +3О‡n…¤/eÍÃ2‘8|» ¹Ámü :Ó}/þŒ4¡I¯0šúVxíù#ûǦ/xGê¢aäÜß5C5öþi„'&…›3W€<Ô³—ASê͂ë\A G‡]gƒCŠ‡H#3òLŽ:rnz¦Ø {n¨gW‰OáHÇ·[ƒÂ(p²}_ȱm‘å&Ÿ`¿?”pÑ%vÖŠÈ6ùe·þN+@Y‹o]„ +‰sŸmÈ4Åú耓lå%Î)ÃÛéÑϼ”’3QC›$tuÍôtD¤;d 5Zo ~†õU61„UÌ;^æ‰, é ö +!š‹b¯„mžÆ?¤ú$ŽòU¢D•Më0ŒG\x}ýŠ»Y-tëÍñ.NÂä KkáŽuœmQCû©‡2î,ÄÕ°w¦‹©xú iö‚CËZ™‚” wÌý‘¤%‰ZD"vD±­ e”ˆF5RoPí@ÅlÁj?ÁÛÜHÅ$jÛ4ýŸà4ÂxwDÓG»ßè@;›L¾%Û£ü¥¶n‹3O¸ûðš´ Äå¸ûwù[ÒtÑ?žŠ?¼ü:Ï ávè—X>_.øî\òó¡h‹ý¨jýX<|“-ìéÏóM àl›Õ}  S +À•å¹4ð“€?¹q}‘(õ§¬Äœ.ò{&æYŸ0Ç›Õù‚AªÜš"Eù¿Iá; úÈWί¾ +Ÿä’P¬•¢ˆÒ±›Înå2`°IžKÜãÀ†Ëa¨7¬[”¾û.ÍÃ, €êìáÅR±´5cü4n6²uYv, C”Þ„(5…Ë{½|aÎÕžå¼fܽ/VŒ3GÙÔ,4ÙB#<ìãÏ™ƒÞ÷0£4}°)D“h¡% 5GŠ\ùÀÓ$Ì1a³QLUèW[ßäsÌ‘•ûÆΓ¨†'ŒÌåšì”ãžjÒ÷¥_˜J‚4vøa_kÒˆq«ƒ uÓrm…cV`ìÐhf+ î~àZ‡-`¡©ƒ'µB²Ï,ØùBInz:&ßnå(Ò-¶¨ÜÇgPÜ¢~˜îXÊÒo‰!Ú*)\ê…3,—¥µ %à±cä·o(÷Œ5ïwMãNbPßnª4µ@²ë½d6ǾK¬åÙБóœ¶è‡Ö”80¯8 ,4=‡Tá%BuþÕIQŠŠ Èæ«°ß?ìÈ2¥¶l±v‚t&&éÓõ9cãR0 }›°×ÌŠMÜa3¶w)Û31N$d⎢¶ÁO[ò+ú‡×ÚŸfpXÈZÄÝù×Q™@í Çuþ¬=žœ˜-vl æèú]Çd‰}Ð*…x±¢j°¢Å=/e 0@oð=dÝä,Ù Ãå ö‚'qlæ6g*á‰m4_L“;Û ‹ +}p´vnÅ/^FƒÁç´vn©P—Aƒ¸æJnOrÝ–žf8ȵâë"™,äÝjmb1¿þ=”ë/ Zè|!¯›Å $ßÊowÅøæt™¿>žÆ¹šÝðçn|îIdŠòÒ)4²ulPuŽ†žuJšAÜ!uZ ay?‚¹i $ø´VÀ…¢ìÊ¢[@aàzžš!ò§óP™û¯¸üìÎŒB7N}óìoÞ +`1ä‰ÏEÅõ2£f§_\w Ñx‘dž!Öí&Ôž«}5s›×|«eNx†íà’5ºi>ejqM•ÿ2²¤™$qýHËÒªäOƒ2È&þÍ”]UÒÓî×o1’Dn]#ªDyF *vc{)œõz2|t)ˆ¸6ãy¶T1Ü%Ž¨„žÂ‰l <ˆ±»Æ’À‚£Øõƒ¹žg¸m|¯Uñä§hKPŠ 8±Aqðì1N¢:3¨Ä ­ñ(Ö‰psД’ئH+bŒ~m¢‰òµ +&0Ê“ ¼‹Xd'D {о¬C`g²"‹”@ÃÃø3¢üžçÚE}y”ct>©*$»§ò`î½ÿÍhq8¡© .ôW'¦6øø—3 <7Ldˆ<¡¾.÷âwr½(˜?WNÔѪãKE,Ï¥ãƒGŒÿ,bÈ®´}ãC²7}¢e„wy¼VI2:Ö¼J +cWEÖÅ{ciì“ +J‡Èò‚ˆ¦èº˜¾l3u?PVÅÉ¥ +ò|1hA3MgQ”í"üÒóm˜B®ðÕòó­pðÿýP !ÄO¬4ß|„õ“ä)‹PW²N' þ#rØ´endstream endobj -5177 0 obj << +5378 0 obj << /Type /Page -/Contents 5178 0 R -/Resources 5176 0 R +/Contents 5379 0 R +/Resources 5377 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5170 0 R +/Parent 5376 0 R >> endobj -5179 0 obj << -/D [5177 0 R /XYZ 85.039 781.388 null] +5380 0 obj << +/D [5378 0 R /XYZ 85.039 786.531 null] >> endobj -1154 0 obj << -/D [5177 0 R /XYZ 85.039 557.09 null] +1122 0 obj << +/D [5378 0 R /XYZ 85.039 766.606 null] >> endobj -5180 0 obj << -/D [5177 0 R /XYZ 85.039 524.872 null] +5381 0 obj << +/D [5378 0 R /XYZ 85.039 742.055 null] >> endobj -5176 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F35 2976 0 R >> -/XObject << /Im1 4096 0 R >> +1126 0 obj << +/D [5378 0 R /XYZ 85.039 594.087 null] +>> endobj +5382 0 obj << +/D [5378 0 R /XYZ 85.039 559.545 null] +>> endobj +5377 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5183 0 obj << -/Length 1875 +5385 0 obj << +/Length 3283 /Filter /FlateDecode >> stream -xÚ¥X[oÔF~ß_±¤Bx¥zâ±=^‰‡”Ñ4…E¢¯ÞÌ^¬z³z…`B‚6}}úìÍ3°ÿÍÌcAÏw0÷‡ãrF1f]ÌÞÏ~ïEÑY8'®),…x,ŽÃûa^ØÃòLÜã,ô‚¹%Bœþôøòöí¸±XÄó‘°…–æ@#cÜg÷÷4žª«…; -oïF×4«+ÒºD‚RUHÜiê Ï|§ÞvGDµ‘ ¸HjJÕ‰Üiqòè.Ÿù€Ýâ@sŠ†èAïQ8 xKã4Š#'Å‘ø纥Xn5a“›q»¡Q}Û4Ežæ[¾kRo P0¯÷AbWÓx¾pÑkmù”Ýz”D,ð–÷‚>¢¹tKôè÷)ìA¿­qô±Æ€0(<~ù#JfKj;ˆÊ’Èö -ŸA³tÃ-â›"Ðõ€â(3Öpœgèe2£¥`ïrä¼4Ü­óY×D£y¹Öž¤ÝªîlºtB¥£h1!ÐÄ y]Ù¼Ò.F9ó|(J~ÂBëK}ÄZiã(•Æàq|µ’t×ͺ‰©¼ÌþB‹[ªM3Xc$k¸*¸CˆŒ[]´‰$6ï FÏ@Tj5¹†FDð”ÜŒÝäAÁõYÑ•šºî~X¸Âp¡Ž&ǪK[YžË㶨£ª‚Ñc0ªËR·b›x¶e™¹Ñw2dª€¯ôÇOÜ‚º=i±Ëÿ–MöˆÖ­OÇ”'4/-ÂÏîò¥”YiÃñÙ!týÙ(8ÚLÕƒÑQÊo‡÷<ï.?OºvLÚ爡·¶à-xÞ¶W1qphð?›ÂYnendstream -endobj -5182 0 obj << -/Type /Page -/Contents 5183 0 R -/Resources 5181 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5170 0 R ->> endobj -5184 0 obj << -/D [5182 0 R /XYZ 85.039 781.388 null] ->> endobj -5181 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R /F58 3360 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -5187 0 obj << -/Length 3218 -/Filter /FlateDecode ->> -stream -xÚ¥iÛÆõûþ -Õ- -°XoÈÛq’ \gëUî•(‰ Eª$åµÿ}ß5ÑDm†¡9Þ̼ûâªYÿÔ,Oü *fY®ü(Ïg«ýM0ÛÂÎ÷7J ²p`^/oþþ]’ÎTàA1[nÆ{?N¢ÙrýÑ{óë»åÛóEEžÊýù"ËrïÍ»W÷såÝß¾yõ·bï¦nß/ç åݾÿžáæç»»ŸpožGÞrþ°üñæíÒ¢e -Äé¿7‚Ùðÿñ&ð£"Ÿ=Á8ðlïo)?‰#™×7÷7ÿ´Wñ^<ãSS,H¢ÜOòè’*™àAøI†²G²†С»=\Á„–ûc¹frCÞyš‡9À5P5ÛþëkD‡«ìyi0„i¬LU ü8ˆìEˆê¿•¿§‚ÔÏ“üÙ ÌÅ‹'¼Q*ô#ž¼ø8_„™W"'VúØ—d¼®ÖÀŠæ«¹Ôàl®ªÍ^v°/À‘É]Õàù¡ìú9„÷—+r¾mx]÷|ìзé”~„q]¾ärX_‘AZD@ÐóãÀ\—ú=<÷ •Áù‹“2p_üÓ2ʺæQ%+O»j…ð;‡ßº¶%qµ×TH¢E®!¶üÒÑØEé#fp…f`uQà9ëÌ->øÒŸK:œD¡…)kD…² c†Ó2Ai¶7hƒ®åHÆ‚¿ÞãÝZ®©jÔ ž¬Yãßq¬>FDÀö§y÷ÕÇR^vZ à–Ú¢lé~ãõ]ÙÁ‹8VÞ]]jæ!–xë1Þ#?4zª‚8Ñ•5ò/X£áwБݬy°&'ñÁl䱜ى7Š!ëóœÈ'!¢1üPá,-_ý”LEƒËžîÐlNòD+[ú7£VÊyp ) -tBwåæ(|vŽ­Ù…"šÛf¤í’!Ö;pta™§:ž1õÃñÀS|ù0N@@$4ç,OºR×µ\ʪeèÄ•jpoŒ]ÓBñªÌ£' !Úã°j÷" ZhN_EͦþK?ÐM{žï5B|á «\'ˆ¡Z¶l<ŸËYÀºÓ,3t™/Q¢ ÈÁfE¡Ã†˜7µ‹sy™²§·Nê…‘‚ÿÅ#¯üF˜@û kä¡ Oé¸IaR£êcÊEâËFÕhkY!ŸtŬí,o1ÛˆR¤bÁö⛼"‹`=oY“o—.àOÃ4ÝÞòïçÉhBï•ÍSeäha$G…ÂMãj­nž`Ù<0²y`U…ÖŠ’q/hQ•‰Äsò)Jã­™˜%{Ðx‡ÿp¥¤‰SˆvyòlIãÀPÂnìGqêÀà|à—˜e œõóÞ~Êfm1KSL¤%i潑ÊÌp‰Þ´Gø;(î†k¸C…B}õ,î#ÌÕâ*2_…l,·ÍùcEî§qnà"Þé¶3|pžà…}ùìÙÔ3°–z%1íÄñÞëûoq€éPƒÜÂrìØ ruœ{¥3:Â"öÓ0u ¹àšyÿ£ø„€±z ½~'!¬ùgZÎ#ëé\´‰씟Ý"D轚åÍâ•9ÙƒUErÕùaÚ˜QT#NÕzp˜æ©) - Ûs -˸ Xœ¸Râ;%lPÜfÔñ$§±ŸÐ!¿Ø—.èz оfL(}gOŠ›RžášWÖ>€Ǿ'êqÙÔ°8.?“ÜuÃܹðaä“#'ïDPªj‘{^»(Õ$ð~™ç±9·BdÉãâK¤¦Of×D¬¢ Âgñ<+F+b:ªíÈ -Z‰+ò8¨?–F^·uûHÙò/Ü—+SòLáä~‘>ßáp`®âÏü\I -AÍð1A5«x£ïJÊÓÀ|<±4r„»õ¡óþeæFýVºJ>_Ûr)D×-©LŸ(’í™8n¹në^r7þä¹M zÁ׆!<6б#ðß|ß'o(þx;LzyùŒ^5è¬(Ö<8Py¡Ã$›HzéÔlð Ïø{š´qÀ½“Þ_¤Íƒrï®­é£*¶Û·*ys°_à2=ÃÊ~‚Ëlk÷Ï }Q_ŸPYnsCþ6?/¬¾¼à§M 6ŠŠ‹ôu7iÏ&‚¹„_U´æì.åCœ?U+B¡“?˜S¶˜ ¦Ï-úÀ7¸5^–;y€¼`Ó“‰–Wl. -üioÿYuþ¯?Þqº{~]éR%¯‡ÊàÂ%9Ç×ü‘ÏÂÿ‹7íýendstream +xÚ½kÛ6òûþ +îCd VIQÏ»ON¶×nÑlrYAÑ8­¬µÕÚ–+ÉÙì¿ï¼HI¶¶9 wE€˜Éá¼g¸z¦àŸž¥‘¯L6KÒØŒžû+5ÛÀÌ7WZ0Ô,ôUáÔ«ÕÕWÿŠâ™V~¦²ÙêPVë½×ß.ß­¾~?_c<ûóE’¤ÞÍ-À®ßε÷fysË“«ùB{ïçAê}¸[1èý×ß/ç)Lݼ½½äooÞÝÍ^}wõõj@Å"ôÃØ ¿]ýø³š­Òï®”o²töcåë,›í¯ÂÈøQhä{wuwõo· Ï…3^5qÙ…ÅXèÌÏ‚hš! d@”9–Ö‰†,.„>Ü&fD‘òîòý}Žc/oñ7ñºmɃÕ<Ó^sj» +6 ¼FNÕ{€äÕa‚o‚ðöÓÀѧ£ ‘­¶’‘…ºÇÓJäEW}ª\"XðòFæÛš±·yÇÆ¢~BÉ–MKk€Âíã ö–¼„ö^ΡʼGBCœÜí䀶EÐ錜n‹<“žpe( ð¦''î1´¨ˆØ5õr€‰$>”qF\¸G¬'ÖC:Ï4!J gHb0õîú5ˆg0_ä»]¹fØÝò ,|…G,’dªƒ‰­ly»Z$R¦ oP÷›¬ë=rˆ™3ÏñºØðl2d@o^-}{§ ñè4KVNaÈõ~R:ÄC‰ÇÃÚŽv=âWà.×ÕrõÚÞG~‹¢¶’[ü¡n&XÃ%È_büúàî“À}_ôÖ/É‚û>?¡>¸p J¥•;<ÔOܧ?°R6üõ&ÇåùF`¬™7)ÿ¡Á B­q¼§tùãñ¶»²èLöÎÚŒÊ|k±¹wsdíEU¶Œ?²N“øŠýåƉŸv;ç6€(&ÂõwyWÕ‡v‹g§NÈÀ/c㘳°Zù‘6#˸­ñŽÈ–8ðÖÀ?ãa&" ML>ì’Ê4ó2çd¢®‡©ò®Q×Q &éÓ~`Yz?™{5 +ù3Ÿ{lJô¡I¬¼'x¤ü0Éd‹åz=qJú˜‹œ‚úÜu¨ŒxY/ÝÏ}š“}°¿ÂW‚FÞ‡|/£úÁ2ÅR†:ûJ#Þv͉œukhÙë±â¢Yþ¤"u‡–ýæˆ +M›¶HyjmñjÆqç–âjÄY‰‹Sã"Y³ììÜûŽ±¸à³êD=ÛmI) =n«]‚œš ø`Ĩ7›¡ÙY[˅ʦ&“¯»—£ ÿdoR—°Éî)¨¬ÿÁnjӮaôjêºûû¡DAä5Ç‚zÉ5î…_eÛå÷»ªÝ +Ö ÈKW6fà˜I“†E˜fáÍm†«ž!&Öd íGòË8Û‹»¦qìXÖ¼ÿ@•÷ `Q,¢å”W{þË + +ø0?.@?’tÖ¬P-z» +õ®Z–Çò +ÈåaB˦©)Þg·ùñÃ@yÿ¹]'ÕÔÀÚE?M£/×Æ’éJCfþ8‡( =®}>\”<@„JRÞãÿJÆíÛïß~œ|{{NB”øiü$H¥ˆ VŠgd¤°‡ù ¨XqŠ‰ë…n˜Ô7éÿ€Á—ˆX¢®¿~ÊŠ•óÜ®^°“ÇÇRˆT:çü„>¬eSÎa‚Ì MÚBS²5ÖMç 2SÞÀDɧ²ßÃP jŒ™v… 1ÕÁ_4Üš‡Ps¼Ñ÷foÈ“H,WZZáCÉ{²9§\êÁÚ¯)×X7ꘂ=-çØtè àä$Óϧ=™vê"doˆŸƒÔÝ ‡EݸpY=Àg\A’ñ¹!…ƒ;‹Ûû)·|ã–¿Ü2¨¡(²Ÿ8ð3°¬¦Ì×O|ÕT4犭²±U""ô ¡¤1ìè`™^掉§Ý„ä3 ½gž‘α^DˆóÐsr>Ÿ§ä(ˆ"•ùK$(éƒK–JW•Lù?‘NÙ:ž§TöȵRpÎÀGJ/wĘݷh+]·rª‰+*Ùn—ãU6²Cl ™ÝñWÚ†iÍõÕyCàÄ4š$ð$ã+œzKHô ò^»¥4k·æ9NKž)£„@DZD¡ §¢ÀÂæ2¼‡¡¯C[J±p›"eb™÷º>lâ÷©OÐÿÆs?`ˆá@›èqáAF*F ¦¬æ(¥‹Fï–Œø³Í%·û…c=ŒÄ‚K)%˜DL]$AâM¡3׺Ðààà ›n*öG}¹‹þœ†T'¥þPþÝ@ìӓ~²Émh‘‚mx$Øã]"ˆ ³8òcnŸ’cɆ äËÄuQ‡óîf…=Ý}öÛLû*Ì2óƒ1ÑÙ/"ÀW7{=»®¢Ù Ò€ÿÇFmÀìäh“NDQ`–€lÂOh:YJU›ZV3é6éEŒqÒËØy+«lþÌŸƒD¼È‡5(N>‘užøÚ’T«§h€ûØPÖÇçÔþÁQ ‘YOX¶ëTŒÍ0õ]¿¥-‹¦ìZ¿[ß‹!Yö‹Š5Ù®¼Pe(”|­ŒÀ~¢ÌŸR,ëÆOÀô¸,ûsº¾Ð`7©A›öÓ칶qú‘JG}íÐ7a|Ö׎Ðï„™w‹¬^…‹»ûZO;éf»öÎYs»åî7%àé RÈû’¼?ö¥Ôd·;I³çºÝ‘¯õÚÝËyâú´ÁƒuzÞ!42?ÖʆÎ:„„Aõd[Q ;R}SP€öþ0¼(n`=^+Ë9ѯÙ|×Ö²7[;|ĸ'&k6Oüô¶—ÊO\`Ò²÷ɉ­••9 €;ÙõÁV±ÒÞ# °rþùH7ܶ$QÒìD÷ ®žQ£~çò¨þüå ®xWƬßWŸ©tÅ¡ä­åeª‡. ߸_‡ƒÁMíηq0…øHÝ&œìc<~R2в«!@ßÑ‚i±á e\¡JÇ%&«¶äÙBšâŸs%ÂÆ3³w@ù\{ÃŽÓt‚³•¶Å“ëJŸc_7¶¿Qºþ¤kÉØvGÛU¶áâRÄr]®Ç=ÅQ‡$ïLS}H*{éŸY?3©'àc4sži6ßó†_4|ª»Hé¾·Qæ(ï1|<ë*? *‹Cì!ø +âzh¨-ª}'€]±(‹8²QÏ• ÷Œ}£5‡õs7úYðÅÚ‘T=bscÇP4Õý¨ FPpÆV÷%vù¡ð©ÕàAJI ˆ G*´Ä÷AQ ÞuÕHB9ö“@‰‰-¸RÆ+lxˆ’Ó´¼…½\¶¼fØðÑ Wá£YÃ;QÚZî €Ü;Æ­œîµ˜ Ë–¥œýløH­7ôvÃ×@…t; kÙý7VX›ËJr…;L°‘MXJQ¼/ùSôdP‰ÖŒôê©DqÈóeïÈÙõ³#0=+ +_ñôÆ:øÀ;Ô²q1?´••"Ú>¸¤êaÂ]¸B‡²¯AÇš“°Q“QƼéÉ”RǾƒ+ù\~‘Áõ™'q…*š®:JpÀù½eÆgWS+ö}ïB0E)T$rÆ)ÝGüBEÃ߇º×êûªèìúÔ[ÞMpéP¢ó Ðmr?‡¶ãbýÑ)Rú £#åȉ7Ö\hû°8.sûĉkPáëZk—DO¼¯¶>¿W~¤@k†V‹+Àjûò¾¦ª°œÕ"ŠËìé7ÐjûÈÙN°aì?èMÕhXUAÒ…:Cb*v½ÌüÊZG¦¿Îô§Wô¨†däÊþµ`.ûnGoiÙÄ}p•óö6©…¹ðܾ¢=T+ÃʑѧgsS•ÿ™}’f5H”.Ÿ)#(vMbŸ†džÁðÐM? Gòz힆m ï–*ájB\M¤ÏžªçßH³ÀÏ’èü…vòIB«{ Ñ”ž{y7>Œ%§Žýcià ê5(‡ Ž¹Ëv/Ç-;šXܨcÐG%…AüÌ.‰tþÜŸ ™Ä‡2pÑïõ|øÕivN)TK&Ç!ýw)oóendstream endobj -5186 0 obj << +5384 0 obj << /Type /Page -/Contents 5187 0 R -/Resources 5185 0 R +/Contents 5385 0 R +/Resources 5383 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5170 0 R -/Annots [ 5190 0 R ] +/Parent 5376 0 R +/Annots [ 5389 0 R ] >> endobj -5190 0 obj << +5389 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [97.651 400.011 295.622 411.701] +/Rect [113.843 135.076 412.147 146.766] /Subtype /Link -/A << /S /GoTo /D (extbsdpr) >> ->> endobj -5188 0 obj << -/D [5186 0 R /XYZ 85.039 781.388 null] ->> endobj -1158 0 obj << -/D [5186 0 R /XYZ 85.039 469.785 null] +/A << /S /GoTo /D (samba-trusted-domain) >> >> endobj -5189 0 obj << -/D [5186 0 R /XYZ 85.039 427.438 null] +5386 0 obj << +/D [5384 0 R /XYZ 85.039 786.531 null] >> endobj -1162 0 obj << -/D [5186 0 R /XYZ 85.039 221.978 null] +1130 0 obj << +/D [5384 0 R /XYZ 85.039 766.606 null] >> endobj -5191 0 obj << -/D [5186 0 R /XYZ 85.039 179.025 null] +5387 0 obj << +/D [5384 0 R /XYZ 85.039 746.277 null] >> endobj -1166 0 obj << -/D [5186 0 R /XYZ 85.039 137.329 null] +1134 0 obj << +/D [5384 0 R /XYZ 85.039 268.349 null] >> endobj -5192 0 obj << -/D [5186 0 R /XYZ 85.039 101.919 null] +5388 0 obj << +/D [5384 0 R /XYZ 85.039 230.249 null] >> endobj -5185 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R >> +5383 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5197 0 obj << -/Length 1857 +5392 0 obj << +/Length 1049 /Filter /FlateDecode >> stream -xÚµXÛnÛF}×W~¢kÍåòZ @ÇI®b+m -7”DÛj(Ñ©8î×wn¤HŠ‘8…´—ÙÙ3³3gg©-~ÚŠ|å˜Ø -#­LY³åÀ±naæõ@‹ÄHDF ™“ÁÑ+?°´£b'¶&7[=¾ò|cMæ×öÉ›ãñäôr82ÆØ:RÃQFöÉùñÕPÛWg'Çç8åÙcè^ž]L†#mŸ]¼fy”y?ÿŽsÃÈØ“áÇÉÛÁ餆UobÄôypýѱæ€ÿíÀQ&Ž¬h;JÃôr ”ïégƒ«Á»ZÏy¯êsA%1rºîîvaÊv¦³ÙÙαF0›¾ÐªÐ_+þÝÿšÁ$ ÐB_+'ÞöÇSIUBx>§_Á¹ÉÝ~­,å〓òôõ/]—»^¬âÀµ;íÀ©döÃéjªá”)ÂYAkžÎ9f8’ãÐߎön7ÐX'åFhúaQÂÈw^ ,†ÎK¶íZ/VC7¶ËÅê¶k’õÔ »ß°æth…ÚSqä‘]×·Y>EOgq:~ Ž˜fï×0…#@MI–üÊÓbÞ³(ËqNÓ@rª+ØxQñˆºi®hªòISq—ãô¯­àxÑÜ–®ÅרQþ‹dM¢.oäÉFÅFÎ’{V¶J–i èQZÒY5¢X²_i0™/«–c54qÈC¸.Ž`]^öè-ó2É:Þ…-xä\;m;X;Nß™nhnq2CMwb57e_Ú@ìÙnŸ¶M!«fÙ"mš“¾Ôg¼nY¿"SEBܲºë–eZ–}:Ë ãRÙ²þ8CîØ2yO4î?»dÚ ŸVÌö®Lé^Η¡ïC8ÂÄQÁt†®—3ÎŽ - 9èSî¦À”ã³àð>P-g6 ÝnÒB|’jÛcÒØ]·˜}O¶Ê²uZ%~¾ÂÅ­ÈùövëEù¤IÍøX¢ªÇ._j'V®Z\…OÞ¸F¹aÿ};ªôŒDQÏ}¥]å»´QO®way¾ -üøù°DÏX^¤b³Å…ÆI3òCƒì¤Î¸/ ë[Mbü2¥.É3N+‰ãÑJZü_‰Òºü5Tvåéœá>ËÏ¢jÔÐÕS"@¢«Em"t;QéÇò3 ‰®'°™P¹Žß¶¢PÒP1ÿøµõ‰Êœ¾ëé»éª‡ üg’/ÒHšmux¤ïò¢”›2¡K¢YjÈBGÑoÿêy•”C-%9j*qÜ%†È#ž1Û ŸG¢kÔPÖCQˆ¼UÉ !_ñ®=¬J¥êHåšÎÆš;`OŒâdÌwÞ25‰÷< Fhö•êÈøàý¼·Sý:4PòNÐïr#Ï'MöÌÓ›Ï.C£BÏ&>JK(ÓaðO>ôí›|ͳI–q#^lP%.¤Î _²*YI[©Å%Éš‰ž¡~Ú“j|!‹08¾öh€Ò ß°šY²jè«+7z7-nä&†E:lûá²íÉŠ8ÝgTÎå  -ÄÀ²ñ<`ŸT&)ý—Òc~ÇdÛÐHHXº¥ú4©nþˆkð‡ç»Ñwþä§S‘ÏË°f ùñ4æTm"’ù†«d_NŽ¬%Œü2 l:;„x¾çæÖ§ÐY&u‘±“ûÌU)Äå­e^{ˆ£€Øl.54ø¥h”ÔøôÂЩ+%‰2ΣD¶å²,ÝjÍD¾åûŠÍVÛgRãeÔÑ€PŽ †“ àd6 ¼ ùÞIÙ0V~ä[® Éo‚Þ×µˆŒ2”l®Ó“l"C”?4”hDY0…d²HT/Í}BMãAìCTÉì@jÓbમü&¦²Ê>7‚ôM6…T½Ðwì«f%B#eÎ’~àÒ©áx“G°ÏfÊ G8—Ë„¢W6Lî9wgp‰&"ÚJ’å^\½äALD}‚•()ù对—¯pãÈ)X«uc˵¹1Ôq'œÀðÿ||ytŽUàK k} .äq²ù±2¾L—BfQÚg+–¹­¿žÔ¯¯$ƒ{Æ×QmÂ9h>ÿ8dwJþ(”VuL«z Làª%:2Ž»'#‰ÜÆ›’û5':NçEíÆ›C¯¡âqk®[ÈúšÂóMƉ‡£é×{*[ÓY‰†Ÿ zµLF±ÁÍX(G«¨œ 'ïÇW|%£ûÿ°‡…àt.^‹`ÄŸ•þºúãÃáÍøýiŸU­w¸AtŽ T~ŽøÇÃÈÃãÂÁSùÀ½ü¦Šº´×|Þ…´Dm] !É$›¬,ÚÉ!¹2_ÀcÒuõ¥`ÿ\¾PÈcEn"Ãß`ºÎÍ #Ÿ7ÕÀfË¢³œµ®ólW±Do/ýU ÔFq½"øN½â™¸Ÿ®|×U®®° ¿ttñú&26»€ÿÊMdZendstream +xÚ¥VM“Û6 ½ûWèHÍÔ )’úèÍÍn§w»«:i²¥µÕµ$—’ãì¿/@P^¹qséxÆ‚@€€gË@ÀG©áBeA’ÆÜ(lš™¶pòóLz h.bƒG?å³7ïLHÁ3‘ù“3ÉËOìíûÅ}~ûΕRLÆ<œ'IÊ–+ÐÝÜ…’}\,Wt˜‡sÉÂ(e¿?æ¤z¸ýu¦p´¼[=‚ñûåýcø9ÿ0»Í'YÌ5×±Â4þž}ú,‚2ý0\eipYp™eA3ÓFq£•ßÏg¿o¡3וbç£Å\ ž¦ú\µ4Wªî+,¾”0¬À‡fû*èQ?bΣ„u!|}õ&骽ó/±Ö7ï"1‰ …ä&N|œ›®)ê¶G´4,:ûÐE€ð%éסìeÆ]í­KtÓöGŠrQ‡Œ%ÏâØGù<¤`EbN.S¿ÍMG\"¾ÎiQ–˜ί„Pšg©ñÆë#&=t-ÝŽ_=TCGÏz€Òý½Mú/‡¶hÁã%±O™»vØ•+ØÄ1Œy­ä¿ŽÓÖàaOÏê%¸É)V¹F4b €Â¤vGoWïÁhO/ØÃÔ5^¶kxï¨S>¢³$;o9Ø×,*oX¢aƒ*h3ª›¢©¨ ix  .ê·Õ¾ê®ïup0ÿ˜aR…Óö'Á-^X‘KxÁc/id+;Nƒ‚[§+‰ìŽß Üw·[ý®>„ qÍ\#÷%]ÒvÞwÒˆ|ϤÐhß•/ }ª:8.æsOnèµ+ü……­H8¶¯i‚z½÷zÇ1J‚×· ÑÿRÑ`Az™z­pëŠ(¼Ú•4[šÇÂ’­*ŠI©Úg²î‡b{º¯Ýá iGî@¹öxoí¥‰eš=;¾ðŽ,“9©²¾d4<ÕHÏQ±²î[¯áèè0EϯÄu?ÿ¤ŽÐÖø†{¯Í¯Iñ/ƒ¹>ÀÌÿ÷ï&T¦çÆ|wPe&þ¢D‚ƒÿ.Óÿ„\Wëendstream endobj -5196 0 obj << +5391 0 obj << /Type /Page -/Contents 5197 0 R -/Resources 5195 0 R +/Contents 5392 0 R +/Resources 5390 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5170 0 R ->> endobj -5198 0 obj << -/D [5196 0 R /XYZ 85.039 781.388 null] ->> endobj -5199 0 obj << -/D [5196 0 R /XYZ 249.962 764.647 null] ->> endobj -5193 0 obj << -/D [5196 0 R /XYZ 85.039 316.997 null] +/Parent 5376 0 R >> endobj -5195 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> -/ProcSet [ /PDF /Text ] +5393 0 obj << +/D [5391 0 R /XYZ 85.039 786.531 null] >> endobj -5202 0 obj << -/Length 4000 -/Filter /FlateDecode ->> -stream -xÚ¥koÜ6ò»ÅÖ8 2•%ŠzÝ¡@s¹´—¢çºµ‹Hœ¼«õꢕ6+­߯¿y‘¢´² \a$"‡Cr8œ77\ð.²Ø¢|‘f¡eÙbµ; ÷0òÝY(KAY:8¿=»ü6NaàçA¾¸Ý 뾎£Åíúƒ÷öŸo®oßý|±Œ¢È 3ÿb™¦™÷ö‡77¡wóþí›pH{×ÐýùýÕíÅ2ôÞ_}ÇøˆóËõõ8v‘EÞíÅÇÛïÏÞÝZ²ì†@BŽ4}>ûð1X¬þïÏ?ʳÅ#´?„áÝåÇ:’~}vsö“]ŠÇô‚gͱ@«ÄW)4à(ýÇÛEYä«HÍn,–aøzžlšÀ:Ü"ôh²Ì2 •…j±L’†c{1‰^„¡ŸÇ1^L¦~’«EªS?5ßLq¡”wD†÷U ,n¦Ü5³’<ÖSŸá4°2ÿœ6c8.ßïÂ`ñ(^Œˆæ…—ÎÊDt˜9ÒƉŸët‘*çȈèÛ-Z‚tä™·¿P™w€~ÕôUß{„§Þ¾0Å®¤ã•©:þ6-a슺~bHŸÄë§>`£‚Æ -%cÕ4üPÖÃF¹wvéN¢˜Ä¶jVBfÕ#_éÂQÂr:Q’¤ˆV×åš{Ûò€“’ŒvnØoöá¾nïðTõGajWp{Ík€¤1îE#D}]Ë -Ìú„G–•hÞïA•t:™´a®p§˜ùÌhbqOÜ8Ìœ¨Û2ÛKòQⰵѪ±W•8¯úoA°õÔÉ‚ŠŸ8X¥? â%ª Î Ù#«tâºtv03*RNæa©#»g‚o(Í=;ŽmÍCwxׂfÍ8ªsq¬{£"–ƒCµÎ¯Úð(EÏØØ£YŸBdBäã -OiµA뜴©Ã`3àpa¤9}o¶Ñ:3ŠÞ2m† –å½—Ù;ÒIŽÂeåÞž©Pña -7‚”½1" sÈ“Y}MN°_I -ˆvÄ£õÆQi–¬V­Ú†)BAckƒÄ9B¦Ã :çí} Œ:Ž1º6ÑÞéöZÙÝ7-Þðšb”<öÚ e'jOb2€lÛ®Õq»3;{|€ÔUgŒil¬rA؉=bãU3Çlùyb˜}Å‚ËZÔ’z}b[vUV÷Û;ô—`§Û–[ð0ÏvÚ bÆ+·œ5A”—P¾AÌ“‘T$ÊYÂö<4«5%%Q˜³òqŽç9Äÿ‘ ¯Z’¾]Ñ ‰pj0î·h¨[Þw]™Àfˆ_Qkû×̼ÁrSZ*A3| ö©¶©sÕ×°d˜±öfÕñÌF¾x4­ÝíDÏÐáýó -g£T,¬SÁö(¶@+14º#D 'õ_ '­½Û!¼•Žuæ\O¢k„¡Î‘ÕÍs) `J‰#–OØ!­’´(Ïç/À×w"qY‹ ~·sÁ݇Inñ¬ ä‘룡‡— JaãbÀ+ò׈P‰3†æcÕo™?ÓÄaxGh^±m#4˜Læ8Xí+s&Dø ¸Çò(½ò (nÇí^*9;o˜¾isG¶û¡ãæâEE#^åkvâãF¸Ä· Ñͽ™$QÁè\¯:†ž\ƒD÷¥þ)– ¬•¥ Yv -ÝLùPµÇÎÄTƒ˜d#´)]"ozx.Ð@£¡ÒèÅ@ÃÁy6Ð08.õ…­ðD$IR úO{×q$ñ5 8ÉÖsí§`Ž^¢Ìàœ6&‚À_2"ÍĨŠdö¶ÆçÀƒý.4l'µ·êSW;¶¡Õ(<\I`ÈP îdé»a1Ë ¸pDûäSqyë2ÁV¥¹g#ñ%߉uÁu8>ÅAîa9—Ì’Ì0èpF” %Üa.ƒÃ¾Ù’ūׂÏ«º*Ía°ßјï*éÊÆpÁÜxÜV6M0…Á/+ÉD;ÙÓ\vhmÜWœ´ÃêBþ™ÌæéÄû72¯åö®%e‡V·/VÒœ ½yyéØg…[¯Ø—ì•þ†¿åá`2^Ü”k]A–@SÞ…ìãÑ;wCÙqjCuYåB¶¹öH‡/„„ö •Ml+Ç¥QjcþHµÄI¼LVeÃßóàœ×‘à† ÂÐ? ˆÙ¹ó(¸Ã…×JYâ*‰Øb·ô®’ÌOr5í\pûÀÁ#Ãh¾uýÕ3Æ,‚ˆ+V/gMγÆÌà ’ÙؘJPhÁ*Æ8ÉÑeÙ¯.m&…x'iRè+_"ÓàœÐy’&¥JL[{CÊ\ ı:Ô Ÿä ·ePͼýÄÝ -86 -F«my¯g8ŠJ”’iá”QTr0)’öu8iä$-Œ(ä8+dQœ8¹;tÜ -ößbû|á»yÍ]aŸ#bˆ -Fc÷݀ʪôq $e¢Ëcª/Ö² Y(Xà‘ :¤iÍ_1= -û£äb!\ñÐÖnÚ‰k‰Â¿¬Öçn\rt.þ¼²•J7þ‰ÌMH¡‹"Ãní”Ïë‹7½ìû”gµEPæ”Å”ŠõŽOäêË7 “›jK˜ùa¾D¤A™R9Ö¹‡E2Ù‚±>pI‡âŒM#VëÉÆ™ØT ‘ˆ‡Ë½?´’Ñ’„¯¬¥Ì§N+ûìhâ”ëG°X±P×tÇâsdw©±ž„!E-£¢k鼪¹1ºá3ÁÚýØyöj“Œëœg)p¨sy.”Ç”¶‘¤ŠnMî«üRìöµ;TVzLl|P“¶±$\ºÀ‘ÁšXÂxcJ夾DeÄS­˜ 9'Wr(á¤ÚÙß°V`‘ÌVÏHT Âïn6W$ÂUHrð‚]ðç乇èî¹<†Þ-•Ð{~sÎ .ïßc) ’Ć•Ô²D^´gÔFÊùsï$nŠ&5Uƒ±NprçÊÐGÍ•8fê¬[çxJ5…“­¬9­+#ð¡*¤iØÉ”1°ý/4÷ËŸ¯ßòËÄ.ìJ†9Ñ£¾MÝLÞUÛ Z¿Ew€kë‹Ð© h:)ñ›Ó‡†’ß…É£$Íœ©®ËS…Ž<ëØÔ y뉴¶O‘VŽ[„WMT¯U©€%ã„\G\‰q_¿M<¯Q.é-c/¬¥2¯£Ó7s;KM=<áŸÔÄÖ}rÝ5¡Ý»Ù­“ Ó{[]ÈÛÁ$ ¯$|xÏ°ocÙÙ#Rë‘ðJvMláµ2d*‰¸¦¹A×îõu/9[|=Σ—ƒSçYwkpˆ…{ª~f#º*V[±Ò¤†“øT¦ÚYæñˤœÚÆA{÷Œ‰sÒ»xˆ‰PÊjÚ  -[TŸÁÜi"i”˜ËM´© QºJ%Ÿ„ƒ¡(Ñ£Åkv‰ŸydÕîv6…YcÐ%TNÇÁÁ~KM? ý0OG’Ë×Í’_þ õª”´š_Ð>ó¯Æ2ÌÍÿíoŒäç,û6nÌc)g’ö瘈BÊMwÉC¹>Úu-R%”„7OÌ’lÖÆ|e\? ;wwWËgìÙ(}~Vü£ÐOõËÒoQž~FÁm‰D{΀Mi}¨L<$’Ïyæ¸Èù¤Y/PeP¦dMä>÷#HĺÐ<á?•¤µRÆ×bóɼÒ1ÓZÌ -{5<ßâ|²{ìFÐ<ævô;+DâŒMa ¹aÈÕí¥útùÛ5÷†Ng IÁ8CoZØ÷l秹óëhÿjº#//óìÝò;q³Šž§:^—›‚”ûüÍ븄lð½jù‹DðFÊûŠº+ÍãB’ª"ðÇ®Ÿ©3€o‚4:³u†~®Ð€¹³)4XuÄ…ÝwÃR8Ѳ y -ü4×#®K}(qîk’„Öx*)ƒ'‰‰„­@Pð}à±þp4¦+)¥ -Hf‡ÊþØ"a•–‚—ùU^‚Ù¦TòÞë&&Þ²?ìÀ÷Ö¥`’ÉHLB”L~Ùô¶à+”qw¨mñœ£H§N´.û¢âý¨¶¾¯IÏO.×Äwn½‰ªQ…õÝ÷“t¸²<“ ûÏüÐ7 -|þÁìÔ À?¾ç?õ`û+g 6%ÊçmI¬@fCC r3ÌÒ)½qR›E§ÿ·tæAendstream -endobj -5201 0 obj << -/Type /Page -/Contents 5202 0 R -/Resources 5200 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5204 0 R +1138 0 obj << +/D [5391 0 R /XYZ 85.039 682.89 null] >> endobj -5194 0 obj << -/Type /XObject -/Subtype /Form -/FormType 1 -/PTEX.FileName (./xslt/figures/caution.pdf) -/PTEX.PageNumber 1 -/Matrix [1 0 0 1 0 0] -/BBox [0 0 31 31] -/Resources << -/ProcSet [ /PDF ] ->> -/Length 557 -/Filter [/FlateDecode] ->> -stream -xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù -ä -6\>RgÈbÏWÖ¹j[†› -WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream -endobj -5203 0 obj << -/D [5201 0 R /XYZ 85.039 781.388 null] +5394 0 obj << +/D [5391 0 R /XYZ 85.039 642.726 null] >> endobj -5200 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R >> -/XObject << /Im10 5194 0 R >> +5390 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5207 0 obj << -/Length 3943 +5397 0 obj << +/Length 2334 /Filter /FlateDecode >> stream -xÚ¥kÛÆñûýŠË}1X4_ËG£pƒ$u8n¬ -åI<aŠ”IÊŠþ}çµËåCJ‹âpârgvwvvÞKÿÞƒ?ÿ>U®f÷Iê»ašÞowÞý ?Þù‚±”µ…ó×ÍÝ«T|ï{næe÷›§aåF*¼ßì>:ßýíÍûÍ÷¿®Öa:~ê®ÖI’:ßýüæÃÊw>¼ýîÍÏŠœ÷ðúëÛw›ÕÚwÞ¾û‘ñç·÷ïAØ* ÍêÓ槻ï7†,³ !M_î>~òîw@ÿOwžféýÚžëøpD¹* -彺ûp÷w3â{µÄ±ö37 Ôm6žÅ¡aSPßÍ”²Ù¤ ËëU:~9V 0–°[ìOF<¢IÊß=?ÒSî‰w’òÖ…Ô‘Ül(g„ç¦ë_t²¢ÐÐ3ó#φ Tzd‚Áù©“-°˜³†Î&îõy‹rp:ò;Ë„·m‘ÓQê;îÏùqlñ4™Ê¢•ùž™éÐ|j¨Ïã¡_­h/2tÎR_ DÌBÚ3&îi'k—µM¨&d‰]°òˆ]¨¦À‘¡UjN <Ù6§ŠN ”·Øç­´-¡I?CóÎ~ÏÙÜÈnK+ÈRÈŒ¨Ë¢Þ2çsÓöÛS/Ë5ü$éÂ¥EŠq¢ŠA†{Äøn¬ežs(qýò [›T²Ç™²GÍisÚq&<çm?3y¥5¬Uå‡ì¥Ï‰ñtøÐû„V­µ JO–®Þ‹ZŸõžÊ- -ç³Ù?’üGk/Çê"›–¡»â)?U"ðÞk‚*aïX;wá€÷”÷Ã*ˆÈÔéÐ o±µ+`/UÇ/lRB&ÈôpþG4û$hľ'™ Œ5þ|/2‡¬|ÐTñ¢u/ë•uWîhSQ -L/ƒš’—ÄjZ é8u=¿€ÃQ‡ÉŒø³ÜU l9>Ø Ü5 R>qNIæªTÝÇ^äfɲ·”µ…c<éÔ9iÊÃÉdoÉžò5ûÒ7HÅmp«d{}’КlJç„ÐÀ Ýä&Œ1#säC/s}¥Ft‡Áçr8ˆ¾£Ô! eK ÕØ{®¹».þ’\ðL R¨@,з#ê䜢ØàxÇR‹ü?clÓP€ófP)Ëý3H ›SûÜp ~=ð4~€Ìçy!lšs~‘ÑÈ8°FB,¨ ­ ”ýÄs¾–´ëóÂRQêzA$@ÈHs q_ñp½ª$5‚VÎöYÅØ‚]gU0dlŒA让‡Š#7 ojÇ€rU9…”sˆ%{rm&”xͺrAœb¦>´^”Ý¢I£L‰ŸXCÐŽ¨2f%GCËꦗÖm{QU/ñ€$èË{†iqÅöGÛo‹Ùù„ 5H2¹Šµ‘•ŽTÔsƒDËÒ‚Á~A åÆÊ´ÁT*°ú&þ«´Í¤À I@ǃTÚDó £®”‚^_ áÄ:€¤Æ÷³‘²u!¦:ŠFåFφ1*á¹ìt,f± s‘Æ£õ8rt༠¡èn9ÞKYšñY5¹ D–ã“xÙÓþúӑݽʔ³1θã¡S?À½TlËt ÝãèY·SÛ…ãP~6–ú%Çpç¶ÄYl”œâ>nw'TǃæE/½CÞÐt ò?2‘pÊÃùÉÄÆfŠ”­¤, 2à"sOÏ ç,„ ¶”’ å$‡®?w® =ÄÆØ0¾_´Ô—[°&^BaB+°’ž%WÁö,µÀh\nÒva'¡ O-V’¢Œ92…@tSBJ_‹6Ìïy¸©\'¢4“§nZL çªÉÔ8Ìs:Á@¾úš“}…‡Jþ‹|Tõª#v=æ³ÂWnîïugFÞØøÐ ‚}ᇾÉE¡§…¹ÔþûPlñ™ócQbpê´ýŠ 0R¹TXÓ.*HoÄmRJ±g+ç{©ûc)·‚oT‡Ð‘T¸²Nb¾ÁgI(f™r$vdÓä\ -7WŠ6‰Eá Ñqº˜°©ƒŽ8 ¡ŸŠqvZ[žK¡Ùj((à^­ëìvT@&&¥ÌÓ^eKóK>EÓæ’°ybfÉ.mf](ÝAóÎoïÞþ“[àhÐÅc³C„ÇîÒõÅᛥ*Ì\b…w\xò”–{/búØê¼¢L¥£c—6°S‰4À³f‚Íò‰Ÿv##î}ÍŠ‹´ò¯•—±ŠäÖ°±3†ˆp5.æí'!Iò#\½ïŠJ” ¢×xb‰J)²ðnYå™6 RaЯAºB ÿ±Õ<1t’Tg'³sÁ›ùBú@&éG‘¿`xöµ\Ì]”ç†~¼”» ‰XaCBá÷@Ã7­©UÂ#yë!ˆ+$`Uø°‘ãFÕKÞQX -eâx\G‡½¬¶£Õp2”$™¬]'³°²§”6y˜]I'·;éºL2Íw: ¬¬\Óð3›,¸©áÎU ×8Èšý© Y5n>[eŠäqt“3£f’ƒAšo“Cz¼”Úø…ëb#ý£:1Ö1©® °ZpŽy׉¹¦Ú[$eÎØi‹/'¶û»ñ´CÕ«—0†KÁ^9³ÜŽÒs~CŒ«½dèåðÍ–¿N4,BÙ-¥I–”:¿ìÛ\ÖÚq»li!à Ød}-%µ‡¦©Qd [êÊØGURÖðž¡ù–¯INâ09Hbç—šææ߈ö‹Wpæf/\Wœ§ ZÄ0˜Øê3DVÞDÛ ã`JÞJÊÇŠ‚EœÄº!á~.²K^å9d×­èowy@õÇ‘/–fѲ?ʳŒ¸¯#ÅUþœÏï,ëÍÙ8ŸWÐÝ =‰Ìñ~b -,ö’Ï¡Å -C -¡î‰S ɬyÄca'óªÜ1„)D@ÕìK©€GpŠÚà}‹“Ð% bu ò ’{‡B2¢«cW‡¡1’•Y´x–qäÊý³y %à…~ö1æ¶;•uåIÀýµ¬Š½ôÐÁÇÖu¾ˆ[¶À¶ÓFÇÆÎoDIJEV¤@“É5XŒ•…ýž«ùü®Ý.#èÚ+ Ž_—m0öc#êÊz¿à4SÏ ü@Ü`wb—¹æ„År:ÿ'Cî%ƒïlOÆI³S¿t£K®“h3Š{¨Lª¦ë=p0£#ÝÄõÃüjVš‹ÆÕQûD¸ï¼·vã - {Uh¢Hr^š~wÅÕ_ûÑí`Ö¹êê4%t§ÇªäÅÿ‹Bc|ŽÂ›„hœ%c7§7Ì’)V¶˜¬9çØšoÓQTÜÏõhLL8fýŸùùšQ0ªé®“0u>pÞ[ð‚gcûy¤’<}!Âs}nãƒ)xeH[PFBy®‡GdiÊ®ît»úEÏIª©·‘SNÄéÂsPyH<ŸÍÝcñ èwâ‘UÛ­”ªÈé:ÕšB’Z5Ü  Ó$ñ'ؽ[þ|á[¼PMÿíRÞc—JvÈo5mbA0OßšbÚNßhÌÍĘËä øÔ·ŽTQÛ•’¿C «S¡V*·ú:’¦ÛiŠË¤hæMJûÁö .ðn¬J5iüày -™´ìÐQxjTÕ®ŒÓë«©5P9ævxê„ßK%ÔƒþøVz@>ËWÅúè{8—¡i³òÀý|þÁ°å!!¨y~{­^$€+˜ÉáBx‡:…†IHµŽ"XP -–Þ@ç0höª¼”õrâš“6à“½ï¤²¯®ÁT2?óPq‡@ã+¡O -E*]ªp.¨ +Š¡A:QÑk‰ Vù±ùŽ€×­øžFB8œ°”´aìŒð…]ãÇ‘G¥ÁÄáKïR߸D:ÚJ=#/{ç ™-¢=LŒtêØõPŒÖJPÈ…^/ÐѳgŒ''€°S7q\°%{[› †YXÔž†”¹Û‰æbN8ÎÏã/0߬­<²ãg¾íO|wqÑ!† |áíï…Q'åQ—nì—}­zn¢â›¾Ö¹êk5q¡ +Ì*k"väpýż2¤:Ð-j4ÎŒœI^™R­È¦gˆ££èö %Ã( ob>ô€÷†ï’±©kŒƒï”'~ÚZdxQ4d}§0ÜE#9ª¶£úKÞ›¸4 - aÉgøÎÍ.`CX8-¾}„fU‹²pábò…|*3ª“.h!äÛš¿5(^gl˜;zúŽM¯$_×<ØåtsÍfÜ|ZcgÑ4MbnÆ22õóŠ{ùV<\óK·4‡Ê Ì­9œ»8 M¹| Ø7ÌË0I¨ª5Êåä.ÏÆç³tìÊv¸6äú»Ï•& -üp8m‚HÆŽüà\‡ÇW“‹Iì1å«Éýd‰ez5®4ƒw×)#.!Z-* ä<Á$þ÷£¥‹’¹ gÃÖXJ@.)褬öðŽJ -Ùg:k]d[(ùJ+H¤“’”Œ¸€#wW¿Ü ]Ï¿ýݎƸþÕað›»Øÿ¥È­2R½ë´hŒ 1³b˜ï+‹šîRK°2 »uàÛ`'v–»ÐnáµUÐ,?(Ò•@HEsøgÙÿ¿>f6ŸöF¡›†Wò#kZø+ätJ¯ -S8ÏpNðSendstream +xÚXmÛ¸þî_a _d`͈©—Z`·{›æpwE»[\‹$d[¶•Ø’O’³ñ¿ï¼Q–l9iLrH‡ÃyyFzêÃOO«ü0ÆI¤l¨§ËýÄŸn`æíDË +cCeþÈäÜÍΣ@ù&[ãOça¢Œpòáeòæ)𧯢(œ¾¬iÑË꽧c5›[ë{«š¶˜i¯ÜÌæa{7¿©XÖUS­[¦< Ð` ½7,ŽÔÏW8yO8@ú.Ÿ}|ùij|eüx:ŒJýˆÎ|>5m¾çåmM›sæ]•L}Îö‹ ·O~|éß(HT˜× {k2V&2}]hË£ ]hÔ†Iá¡ïåY{¬s”¯a±²rÅr>äeþÁ×çÚÆ :ö1ÜZwÇj;Õ>PÒþ±/[¼}f‘á 5»€ÿcKZ…©§bcZ—‚þf$,%5éƒo} >>=COóžò©fÐûR¬x7ß(7{R~V +µZsK¼óCVî¬-Jh6|N»=‹U›b‰‹³ïü‚æB½Y’¶Ð(ÞŒªDói°eKšX¡ÝÔ9ql+²®¾úéðŒÌÐzdž¦ê†‡ÍÙŒ"o]W{&·[!eËöHB³E½œšžô0±«f`(ÓÚ¢*gÝÙtfØË:§C«# +M{r·¸t‹E[@+ó|ÁUý&T_&% ¼ÃÛ…!H´£—{EŽ¡ñÖUÍȱØlsfô¼3k½Œ|.[PSÐY§Yzw¼°ÙãÝà=Úno#jF¥nr>'ÿzÈJg]¬a°«²÷¾|V.‹r#“´gÕc[q¿*»K‚úiB—|š%Æà Iì‘uÁõö¬p Ác-XÖ#\–Ͳà Î×¹lo+iYÕ!C§Z%I4ŸV:•8‰õFVüóí7<óT&½¬ €(ÝŠ5¹<îÉËúKy¼†x§Ã ~û8ˆ=x½l ~ I)v-yÛE¤U +öз‹Œí§w+ì1Q.¾à£Èˆ\‚#¦xï‚‚hΛöÙJzÂåö£q%ë¶fvâÐ t§SÿD’І÷PDÇÉÍ®"ávL°ƒqcçGV²ÎlÒÓYha¥±ØÀz·t +HŽ%)râlAhR¥ñÝ@t뫲@·ñÍí‡Á--|›ýBá¬GÎ7©Ò¡³´¬îzøÎ`Œÿ!£>òqçL_lʬÃö-¹/Ì“Î)‘Ön¢á™Œ‡O0ṳ̀Ú% ^»ÝOø ÑlI=Bø9?ÊŽ?¸Êoap¿ãsšq%Æ1IÈ7*îþ Êܺ]’Lºº"ìgAtx‰—ÙÊHw}—„ša5Ò4ÃÚ]DhÈGoT :øð'~Ë·#J~ŸèïÙV¯%wií÷ô@KÇa_ÉÁ±µ€ÁNΟ7=üê²ã=fÇ.CÞË Ùb +‘מwLüë€x>gqå–A ¢„ÀIJ¡œï÷ÉûþtþùÓÄW1Tè¯X «ʵý„¿r†2ÞMž'ÿè[ƒê`ùˆwcÙÇ`¥±²qÔ_qÙþ?!ˆ, ãÍ—7‹µ +#ó¿Vù ;»rp>²¬Ù¨]yØó©&1J»ü»ºŠ¸œ£0ÊpõÙ8|CàƒÒOi}þ:HwNÎ÷X`e»#öþ¶(*±2Û˳ÿ™›·÷¿>Þÿü4²ï²Öêï:åÍȧ¢÷°ìãµ#2ÔSo÷÷§wâÙa‡g¬Õª4cM¬ +mzë£2¦¾¶ã„g;Öv¬Çìj›X'ßÎE]‰güFÖÝJ†.ã'ܥ ;*òz_4½ïz N&üMÛ@ñÁ¹­ìÂpCŸ¡„#Ì“çÍ(dÆ™]uHì›0IW!±W^ÒEª‘Oþ:Ui`¿eÖ¸»M¿—Íuz‚ªJkÆæ¿Ü&6}endstream endobj -5206 0 obj << +5396 0 obj << /Type /Page -/Contents 5207 0 R -/Resources 5205 0 R +/Contents 5397 0 R +/Resources 5395 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5204 0 R +/Parent 5376 0 R +/Annots [ 5400 0 R 5401 0 R 5402 0 R ] >> endobj -5208 0 obj << -/D [5206 0 R /XYZ 85.039 781.388 null] +5400 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [275.928 512.079 396.9 523.769] +/Subtype/Link/A<> >> endobj -1170 0 obj << -/D [5206 0 R /XYZ 85.039 761.463 null] +5401 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [495.92 363.038 539.579 374.728] +/Subtype /Link +/A << /S /GoTo /D (dfscfg) >> >> endobj -5209 0 obj << -/D [5206 0 R /XYZ 85.039 740.47 null] +5402 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 349.186 105.43 361.179] +/Subtype /Link +/A << /S /GoTo /D (dfscfg) >> >> endobj -5205 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R >> -/ProcSet [ /PDF /Text ] +5398 0 obj << +/D [5396 0 R /XYZ 85.039 786.531 null] >> endobj -5212 0 obj << -/Length 3515 -/Filter /FlateDecode ->> -stream -xÚ­ZKsÜ6¾ëW(¾„ªÊÐÀçnå ¸’]¥²Ž7ÖÖ¨JÃ5‡œœÈú÷Û/ 9ï#å’IF£ÑÝøº1ê:€ê:üÀd×Iª|“¦×ÛÃUpý=¹RB±’CóÝýÕë¢øZ~d×÷#ŸÈ#s}¿ûà½ùëí»ûï¹Ùc<•ú7›$I½7?ݾ¿QÞû»7·?aW轃Ï_îÞÞßl”w÷ö/L4ÿx÷îgì»IwóñþÇ«ïﱆ A„ eúíêÃÇàzòÿxø&K¯Ÿá=ðt®@(? -|WWï¯þ>°â¾ðšGS¥Ø¨ÌÏttYM±òÃØ jÒЫü,Š\5E!© 4ù°L -Š¢À»­_@qâ}8¼Ì­’ÈÏB5Œÿâ² Gg½±¼6³¥À*Éü4'oLàµ%È\÷¸iE;—S«Øuø‡Èiy]–Sk茧š­óCñ‘uù¾ØöeS¯Q˜ø‘ú¶Ž44;¼.­D51Í}÷G¡—ó£+PQ,·A}Ç›N½"o;n,¥³ßCgï‘÷ >2ïyúÞÞèÄÛ ± êó§§b'\;„Ì[àÜ{xͪ‚ ¾åÇ öHðŸ°íAä=¶,ÉUæõ½ìÝÙ†5Ù$hR6 ÐàF¡çd¤“nŸ·À-TÚë|*`Õqö* ÚÄIæ½mú„ b}ä=Sþ“fÉ¢×Yúúoß3g4rüzáÞ=}ü.kÆnZ^Z9ý3.ÃTÌ`³`ª‚Þ{šö‰{›sË«š|4%é,™lèƒÚvÔÆ¢à®c[ùÈO»ë:K­ª°­˜I ¿Ûßïóßb/å6’—˜³è0ÕW¨IíÝV-Œ)à‘Ø)E¨aó?ž€E5’,§9YþSi5lBE6™MP[¿…V‡_µ¼i¶+äQó³ø\v=©¿P¨NÂ54òü5P! -ìr'•µÂw“&QÞŸ@q@¼Ž¤„¦žÈ5Úý×"Уà˜bU‘&Úâ·Óà>è+¸ú†ŸÈ_'Ì©hûœ\hÃQèzê8¬†Ï¸±lØp%õòDÓyDõŽÙãg%A¸wlîÀçMiÁ z~“-vm×ÿ™‡£1`?‚¥ )ªh‡ŒSÔ­) Ù¿°ü­¬Ø¶b©Vn§µàs_ -¯œÖ/0^×vb¿ÜzBö}yÈ{ê«^d¦¦è·“Y4íLª^˳‘nR5FfÐÁá.žÑ*î«ùa'i”F×qúYrgÉÆ¡Žºùacip¾ms8 `µÕ^S¨‡“ÑUk£[Íêh™b zì*ÔøKÑUm{:R`üív[tÝ|-&üT_^Œ¥Y¬frtš öu:YÍ d‡l‡ƒõÆ”–±ÈJiÍ«Ê_Ñ{”$~šdõîЬêÝÒÊÉ0@Mß²ö^ÿž8zÝAX´-¿zÝQìw>ƒ”Tš¸Ò} )Åë8 9]^„›8óá*–8S€ñ*þ#¤N_Êd~àÌ÷¢ÌDù©Ê.YÌ?1B : 'óï :aӌ㮼óÉÓód: ¼NÂsMUbyâ®1Ðæ<èñ†,f€‘ ß‘¸`{~æuc]}ÃÍFÅà/±žD*«•Ú C {‰ÅOµóQðû®xÌ9TRò‘xw=w”|Èš„OÍFšs~ Kú ^Nåð9óÒ$ààšX)¥p#´Ç…áí±: ö¦ ˜ _ -ÞJ#»îLÈÅ^^V€­ˆ«ÑAƒ §ærtiÖ£ƒÐ¬X0ÅŠ|wàÍv#ǧSÛ/Ò½œ5N. -giÒM \e‘¯µžˆ7è3Ȧ8ÍàÜ#:æH\hÙYMZ„Qb†Á›ÝtRÃmì°©ÜhMßqÔÞRŸ¸Cåv8‘èÄÆé -ÂtÁçÌMÈRígÊÅ_žMd¼Gúd›Ü0¦V¡÷TÔE›WÜñazðw¹™x¡s!;´qæe¼º‘†œ‚ûʶ``À¼3ŃHj'&Ãß 3E([#sZäÚ`àyvÏ­ç€W)g¡Ä¢ŽØ”ã)‰¸ ² âéÈdTé­´£kŽÆ™¦ñEGqhVÅÒ ää(ÍQŒIº!dZÇu剋nYQ~œ…å³4 §¾‡€ -§»—ÄŒÅme’’Í]Áo´I´ðqÖ§’Ð{h‡­íd•v`Ô¯AŒÌC‹Æ-s¡"G©ð?ä¾,Žä¾DØÔnòËx¹C-yœ%©IΣøÁ$ØXöˆ1ñÍ]çffð.`:Ût¥#?Ö1+§í7¡$ÜÿO¼¿Ü‰K{Ú?0|:µ{Rªv<ÁtÓ´öJeP¢Z5`Âj/ão‡fÝ€…æ\¤ÿoì6V~fŲ4 ¹¦*ˆc? -ÌD060qˆ²hhyËá ¡ ”í¬rÊTª;= 6¬V(? /ëq YW#““ yJ¿êýu³P`”ùq¬.‰cIæòÌÔùJE®@síU£þíoûq¨.ªÏ¡YÕŸ¥!ÈÚtb Rù'ØÜóDÀ@Åœ£ÀÿFÑ6œq q!‚Üì’¨–f!ë_C(ÍR=–ðu˜¥Cp 3DE»-;Ñ;öæüØJã ¢IˆÕ´â©-d`óÈmù–k+Ô6h,Á¾m*&zàÉH:JüxüNEðŒ;tZõ"®ªy<Ë'Õ%‹$zJTC$~ä²マJ€xÔö~Ûôvˆ ßñÌO†*Hb%ø# ìrD”á#`äV䵕ú\Q6”$f¨r:‚Ôˆx°Ëf)4#¥$ÜN;—ã!ð2MYÄðÿ%%Lo…œö,ÎHñ‘àÞb!XСW ?»ÙÇ^zóÊ–,ƒiQ~¶ÍA(Y·wF9§‡¡^dÁ‘¸~Îþ.(˜7RH -Î;ªSNEãF‚Dó(5 -š“í¹ÌæZèJ¼b?Í¢Ëñb¤YB3‹;6Õ—Ií¨?µr/3I»RýËé²ð*!(ë‰ôŸnø¢7m¾q‽`Q¸2-|A–f!Ò´peR?œ)4§ª$ ýªìØžwü=h:”r4¼°ûÆÆ &èvDaé:N¶ÓÖ±¯ô4nq]vÌ”¹ ŽkÓ±@xMKíSëZÂû+{tPîaaãŽðñV}÷Š1Ö& •wÛqï˜Wh©êRÑAÛüŸ‹Ûጮ¡ -„L`KÎÚ»{Ç-ùŽ.M$ %kº'Xºì(2íú›øØÛ¢ÿîîç÷܈‚sIj{í¤Ö‘†¬áráСYõUFFŠ/øÛ"4ñ ¶Zã’Œ÷6ÓöÖÞøäÂhÏM®lKmB£{?Iµo6νõ….<¤¾î¾l+x1æ/ö¥ç:$-/ïÍípØ89ží¥ócä¹ä†ÍÇ1à§ë‰¬myߤ¬Is0”‘<ŸuÃÏóSG´ü\¡s<²@euQ캩FLj’™‰z·l²™„ò~ÀÍ'§Éœt®žž†  Œ2[Wµé%r´£»æ`KðÕà’ùµ-xNJ2×?2±Ÿ¡Z‡fk±¢]-kbWlÎe(21¯8Ðx|¬ ør]Ùj¼M°œŸ60ýxAįܨñŠÛ8´kÄœ£Á©+©íóüÖØaú9k -Ô,zÎ/|è_¸„Rò[Á~+Q0ýô„2A0ñ»@®¤N³LÒ΃ln›ó`2¯’3Dª=ØD–^PÀÖ½“£fžu,µv}ùä çÚ)¾ F€uaG¤›™#wºÃÛí/cäÝì—:ôãžm›?²Gâ×4 Ï0PaúQËï–œYd4Ù!·¿ëÀF‹2pÈ$=á:£*‚‹³_DÙß*9†€ ÃÝǬTò‹¨­µÞ²}A&&Àr÷'™‰ÈNm±‚áLàë³èþØ–þ¯_‘804~jVx¤µ¯••…Ñi6—7‚Ì2JÍRà™~LÚendstream -endobj -5211 0 obj << -/Type /Page -/Contents 5212 0 R -/Resources 5210 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5204 0 R +1142 0 obj << +/D [5396 0 R /XYZ 85.039 766.606 null] >> endobj -5213 0 obj << -/D [5211 0 R /XYZ 85.039 781.388 null] +3153 0 obj << +/D [5396 0 R /XYZ 85.039 634.759 null] >> endobj -1174 0 obj << -/D [5211 0 R /XYZ 85.039 761.463 null] +1146 0 obj << +/D [5396 0 R /XYZ 85.039 634.759 null] >> endobj -5214 0 obj << -/D [5211 0 R /XYZ 85.039 740.47 null] +5399 0 obj << +/D [5396 0 R /XYZ 85.039 596.492 null] >> endobj -1178 0 obj << -/D [5211 0 R /XYZ 85.039 235.312 null] +5403 0 obj << +/D [5396 0 R /XYZ 85.039 211.516 null] >> endobj -5215 0 obj << -/D [5211 0 R /XYZ 85.039 202.891 null] +5404 0 obj << +/D [5396 0 R /XYZ 275.175 217.489 null] >> endobj -5210 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +5395 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5218 0 obj << -/Length 3940 +5407 0 obj << +/Length 2256 /Filter /FlateDecode >> stream -xÚÍ\YoÜF~ׯ˜5`,Èô’Ýl²™ ŽsXFm$o²Hò@ÍPmÎa’#Y€üÖÑÍc†3²³´!ð}UUó«£É*þ£…¯’Il¡Œ™Ì—'þäz~8 숙2ëŒùæâä_ßëhø"ñ“ÉÅU»Ž¡V“‹ÅÞóÏÎ.¾ûu:SJyÓYïùÏΧw~úüÙØzgpûëéÏÓYàþüÇ1¯ÎÎ~Á¾©QÞÅô¯‹—'ß]4l5…yz{òÇ_þdü¿<ñ…JÌä®}@÷ò˜:Tö¾89?ùw³÷…ž5´Z¡Ú߃@ìö…öCÚƒû©4Þz 2ãm@˜t*ch¥û´®¡%C¹W8®Îáv½âÎzmo2¾Xe4ra›q(^&^éY®q•[ü/ã®fòŸ~YÅ­W0¡\/{ë'´ãéÙ»$>©·Âu7Ó´5”¥àŽòZÙy½.ï§&ôà G~âýRß8Žµ»œÉðÂnÎÜ줻;%?rœ•– ¾YÀ O|à Ëßó uX†p¿”ä¦-ÌQ´Ë^!$-`F!¡uY§×7®¯x‰«2³-Õ&“âì‚Dèè}iÇV$ô"Ѻƒ•( ¬/ "ZkðßLkßû6»J·ÈD50ÅÞY™¯ìåsk™®øX£È»ZO•ï•Ü{›Nì¾ÞVÜð -†ÿL*¿ï­v¾½¬î«:[V$Ž’@˜$îŒ9¨Qä ß>ÿÿ¢f“vȈ¤¤=OË•»D0HíšqDnqESÖ8ð ¼F#|PÀê>–á»â‰KÂOUóÝœ–¯håŠÇ"¶¶!¯§Mç%öæE=Ëír<µ&ý]]ÛQW„²½tå -d ÊtÉ3³²Pq)¤ ¿Ò›§+¾X±ò3*$A>Ķw»aÙ;¤Räó¼.ªÓ:³ÃÖv›•TíÞH VYr´I+V©ð….Ó:'…³D›g Cß»pêe—­H@G âËr›1‘+Þ"éÕÍ4émJæëÀ¾Ì×´Ÿý)“N"ïÂÍ×°¤9 :îhÒ)æv=jaÙH{¸ávª#x 9=o\ÂIÆÆÏé€íÞêš'ÑVÀ/ÛP"„TÀîænÈîsæV†—¼& 4(&ÑèÈ«IÜfgâ¨Ç7o(4yÅ5Ö€w4ŠYA®àuÃD/#îr|j߬Öu>·kW¼­÷lˆëº1ã–ÙJèî2…ÏrQéè¼ÒZDJ‚<(ÈÓßyHÏ,È@2´#în²2ZG -ßwË ­H!}eäÕÀ`zCÛؘБ¿ íž…@Ýze/È$"QÆ®‘Õs‹üÈ—¿¬r»;^ÀÃím‰Q÷mF[ÔÃÅ“.Ô³r[þZ’xO|/ê>&ˆ -üH˜À|¼«CÂ@wÙ¤s"qŒzÌ>/„yAð€Ï C¡âh4Ÿ×ÒuÇ$PA"Bcz|,ê¬5³i/dÍ–ü…¬™ñîš²1„}ÌÎäT‘zÀù)_€ #8¿–ÚÐ9Æ{ïŸ:c;¦íéfÂã”k›OJÿ/¸-_d)O‹ÊRk¨f6ÙvÍÑ<Ýðˆ¯¹oîØÛT–öªÓÁ¹”ÐÚÖ}ìLZˆùzueJ‰o8Áz*‘ß»2¯3¾´Éë‘—nëõu¶ÊJ—ïí3Ž,vLÚwK¦6³ëP´­¶¨NX°)lqš"J|°æ%+ïò*Û«?Hm@º©ú\cÒç^®÷ù½CO†Oéý‡úˆ¶¹¬Fv¿UÜr—²à*à¼Rlš5Ù¸TEƒù±¨,¤‚”У¯Xy$ÛN";áXŒD“ìÏ%4¯Aõ~¨©"_HÙ 5a)‡G†ÌÕ‚¾àݺL11óî+Î6vs»_†aÔIÁØ1¥;. ü7Úµg ¬5„Z¬ejtÛ(3\v²ª ×aôL„²&'Øó܆jB2;…ÌCó(¹­ÈÙ´öM„%&WÖ©Ù’/l‡Ã>g¬“ Ý½ù€ì½6õŸÎ@ÖÎã îÏõj]f‹8PB(ë'ì^jnØ)®ÖÉ-PÑ‚¨¶$»ÓK›·ÿ¹sÃÂщ˜W«x|¯bÌy#©u[º {Õ[ÛÂ¥R˜ÚRmj€˜ÎWQ§šÇ±ºæßfˆç¡Âƒœ{àÞ8_n¯‡j „lnU¿N߸ã2öY3([2@šq¥ŠÕþ¶lËÑ[ïŸ'Ÿ¶±˜á ±ï”Ua­ pèTn³¦ÜoîT-Ll}Eˆ¾¬à‹5ÂÁß`½^!¿ QG3¼î-¹> &äK[…QÖi£_0ºozq$º]»Æ€1L¡ã¦-,æþ -?ÿ+—”fíËÌUªøBïh¾­Ba‚Àù•âà©ZÚM*À@9ŽßùÀÛÏ¢óuk!Ø°aÞÀG#b“t¿£B0@¥uª CÃ˃[ðÛõüfmÀ„BK=ª C¤0ª¾>X£ýÝ*]ö NE±/[nøpãêobéaåów3Ψf¦j#õ6€ HSÂÀßÙÊŠïÈ„–oAT¹r—¿¬¨”¨›9‘*å”ò©; ëðZú÷ê.r$»úgÍ·wSRš7|Gaü’% —HbKt߶ÛYó©¯" Hï‚B{ í¢S* Ɔ´¤­Y-xbŠÂwèƒM¡qØñ#ÐÜìæ&ÙÅ›£Ê†Bz>IÕ\µ«µ±èN=ÜÞS IG‰÷ªÂYà[#é:«êMJ‘Ž -8Fº]à ¾)¦.¬[p®e~c«þ:µI8°§qˆfµÁGÅcŒ?ÊZ¹zˆZ}“Ú8%0‘Ð~¼ -Ÿd²¤HÓt¤M &¾áئâ'­êÂØ”9ëÄI²‡»”-25 -l1ƒ3ÌÌìz;1”4¸ W6ÇzL¡¿òNë¾ R8.WwmÚ³{SBêFf<6hûW´=Žï”óêØÕ‘òØ-«,^öå„8VÙÚÁë-ñº?4 ùO45…•%ÛøÁÄëHÓ_œ8 ÍN]xÃsQy[æMk€è®y~ÚØèm`sʬ°¥þ\߯:ÕÓpƒÅ6/ðY‚¸B:*ü¥rùêXõ>øP™ U²û“Þô}Ðß“hêáC%Œ:¡¥¤ŠÌ Õÿ'þÞ‹-ûw'öþüVƒendstream +xÚÍÙnÛHòÝ_!ìËP@D‘lžvDZ'l’YKÁî" Z¢$Â<4$5Žþ~ëê&eÑÎþ ›ÝÕÕUÕuwÛ8ðãNâÀvT2‰âД;Y•Îd +¿^¸‚¿žíG´övy1¿ ‰ë؉“L–ÂY®¿X×ï¯~_ÞÜOgJ)Ëìé,Šbëý§©k-–wå…+üøÖ€ÞMg®u}?õbëÓæŸn—¼øN/"tyO÷Ÿ—7ï˜ÄíÝ?ox„ëÿ],o>ðty# ÈôãôÛò7mæ*;ð’qq…Œß"Á+\¾¸YN9scÛq=<æ_¾9“5¨â· ÇVIp »§†@Òj̓¶K-Ð\±õÚš¶ÙN´?"Éõ-r ø¾»E;ÏÈ“D@àÔ Ô.Ø­È3æÚ + •}Uï’4h  •Íæø0F6„׬ÉØNb›ƒð­açlžgœßBfêSJ0Ãy’pªŠQN²‘Œ£ÿNÇh9¶ºšÔ¥Àö_Ö×W¬zpÀÐŽÝðĺW+ +جålGã'Ú[™IÒB +¹Àá¤åÇzåñ¾:ó„*ËWx„CÓ=»4ç0i#p¡NÕ¿êê&7¹——ÉqñKу•N£yƉ׃E`í +^úh’Ð ["äÇ4š7‘êÖÑ0;ãéOÓÔ{$–S]@0ÉPn%>€Îµ´Ê$ãÖuóhÕJàï;Áx¿0ó[…¦²yõmå‡ÃÊ-‚‡ùu]—% +FÖMÓÔSå`Ô ß*—òÆØ»!ðFÓìO4&¡±?öÕ^õ5eÐ&þ25Y#åOŸLº&×ú–¾Iyº¥ƒì"]ᦧÀMÞ#/WÜ/I†çLE\H¥æÎ}XRQ›¾ ktŸô²¨¢Ç-+Ü¢Ê)<]¬I‰xø&ï´Ç؇Fz&ÆlÑV¡Ógþ 8-Ô-ÉþTŒƒºÞ +¨å=ìàha ÓzÃß!}Žò{×L@&aôíxpÖ[«šÄPÖ"9¶•A"A ©ÉM™Kõ7mn8lJqRó—(íÁö57 憴f“‰5B¸?ƒ抳ÑÚÓeyèp)¯ú]燕NâÄDpxÙq}ßöã‹l`«(8©²®€SžUY×r1ÍB_ñaÁf„2ûùãÝxôûT¡‚v<»££„Ö5\’f°õ¼1_¥ÅkŲœÿ“›,&øÄké ž®Ë¼ê/Z ™ŒÂÙ\¦“'ôÓŠ ®Ÿž ‹Ó‹@(Ѥ97[†=S!½éúÈÁ¬ua­ÌŒO¶Âwp¥cqF ëÐ+IcЋJ˜C‚3•˜¯.)æȺ@YiÌt©¬÷¹`‚VòañyŸxûídj¦Ì"Ý}¾ºÊ¿Co­vÏeÙX@Ç~]fŒÑå<Šø®rì“MȆEýí¡Ñ%„¬Ññ × ‘Ñd¼§®ÜïPPWŽiN—Øw’µ­µê—á\ë •¸ô²„[é*Ö·S€W¯µÖ¡Âƹ­eVé7‚Ð<Ñ„Úùyð”ÁóAY¼¾šÁZ.”¸Ö…^_Þ^y·€½ë~N[ŠkeÞwÉÕZDÉËlëœ:%p•}ª†Ì‰ßÁ­ƒœásâF!¥+üð­æy=ç¡Dð=;øŠNLGïŲX Yûo#®Û×V¥ßpÒro^¶ÞðÂv©M>í‚¥Ñz0-Ó;tÏrû¤k]ò¥W S ¤Gl2f¾c‡~D~Ù¾‘ä¡ÝØ=Ñ=ë:ðëïü™g?öuÓÍwoó½wÌÔ ïÜÌ쉲]ã+nnjŒµcÖŽÜÌ!8@€àDJy/ñXUp™S®ûÆMç%N«¦Är×ÎnE°žü˜ÓÓœêô 1qÁ`Ø8Ž^¥ú,Wµ8W¶–›6lÞÔE1|q!ƒ„øÌkùIaÌ€F5Ê«f–é6sY£³ð—´~ÉK˜>»¬ífÆB/*©†Dõþ€ºªLöÔ ·ê}ËÙa+áBî´$¬¨sÃx‡¿p#4“íOÝ3f÷ôGÍxî9|2×½ôK¥Þð4ø68ðœþګ˼ýNÃïØ¡]Ý($kœ?@Ÿh{~ü¿8þ¿wx…qeÂêÕÖÄM¼ç"ïZÀÿézendstream endobj -5217 0 obj << +5406 0 obj << /Type /Page -/Contents 5218 0 R -/Resources 5216 0 R +/Contents 5407 0 R +/Resources 5405 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5204 0 R +/Parent 5376 0 R >> endobj -5219 0 obj << -/D [5217 0 R /XYZ 85.039 781.388 null] +5408 0 obj << +/D [5406 0 R /XYZ 85.039 786.531 null] >> endobj -1182 0 obj << -/D [5217 0 R /XYZ 85.039 719.568 null] +1150 0 obj << +/D [5406 0 R /XYZ 85.039 642.242 null] >> endobj -5220 0 obj << -/D [5217 0 R /XYZ 85.039 684.823 null] +5409 0 obj << +/D [5406 0 R /XYZ 85.039 602.079 null] >> endobj -5221 0 obj << -/D [5217 0 R /XYZ 85.039 564.071 null] +1154 0 obj << +/D [5406 0 R /XYZ 85.039 449.2 null] >> endobj -5216 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F62 4047 0 R >> +5410 0 obj << +/D [5406 0 R /XYZ 85.039 416.779 null] +>> endobj +5405 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F41 3054 0 R /F20 3021 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5224 0 obj << -/Length 3353 +5413 0 obj << +/Length 540 /Filter /FlateDecode >> stream -xÚ¥koÛFò»…/8£³$—ÏW úpÑËåjè!͇µDÛl)R%©8îýù›×.—¥8÷1;3;;¯UxÀ¿ð2Oü@—Yú*Ï/7»‹àòf¾»âZ@®˜¯×Ÿ›¤—aàAq¹¾ñ$~œ¨Ëõö÷úûWo×ßü´ºVJya³,÷^ÿøêvz·7¯_ýˆS±÷º?ݼY¯®CïæÍw 0?¿}û/œ[åÊ[¯Þ¯¸øfmÙ²…yúãâÝûàr üÿpøªÈ/Ÿ ø!Lï.€)?‰•ôë‹Û‹[T<_òª%ˆë°ð‹(9/¦4ôãTY1E0úE’¸bJ? bH&ña›)(Iﶆªy1¤™wØó÷y¥B¯=tÜkW*ðžî¼í*XÝ ôI½×ín§›mJdqî‡Yq~# m"LÎ:L}•Ò^ÝÀC‰< ‹Iìiü$Þ¾ƒñªYE91#¿Á@{Ç@ºçÁ_ƒ0n²,·<ÔÃÎaU ÿÆë -§xjhù+4z¡zª µ_¢yz,O1²)!°FÌBô©ª¡SsçŽHËúSÙ2ãwˆç™Û·z·¸;X¨Qâ ÈëÕ¥ Ñ|¨€ÍÀi¬&w$>hA@€ý3`è¤Rî ùkðò²Éĉ¯²DÖmt]3” ~÷KmC¸zü¿6hpϲe9 <‰Úœ%šlTx?÷¤âŽ'XˆÀLŒ„Ï®¤ùŠöÆ¥L‚Œ…V¸ÛUƒÁIDQ~ |~ ûu¥èhóª"ÆŠÇ…GE¬0Lìá¢li§Ãg+’Žºš`µ -ÆÂ}Jc(w"‡8¼¯ƒ¡`µ½ä‘J7ÂCWþqÀwŒ ´Šsz`Xmt yGŒÚ¢7èv¸ìÐËøKuAÉ C*V Äz‰Lg·v¦öÈÑh±ìòÃwýs?Жv8É1! ¨)÷¨Î6­ ¶ˆóÊØ#>hÌì˜-C¾Ú†‘UCÏó„î©‘-`,h…«G=”†½#‹„Í¡%†Ð¢ˆ€c$ÀŽ:ÖÌûgž FèNF™î8ˆ")Ø¡BÄQ³r„JÚ‘ÆÎé–ÌÈ‹£Ó©HFH `ùÖh›5̼$€èûöŒã•Aßz¬(Ö§‘NR¤%{`&\‡Qn}³>Êü#®_?–¸©8e•ÇoÃ˱‰ŒV°ƒtc$Pâ)cðÇOFè 8ôè°9Ê{VîرÈØ$Û]õ§ñÅ8m•º@¥F6F@—$l>U†ª1:MLU‹À`’Ç2[t™WÑ‹è1|Ãa}ßb4x²*ÊÊÚaH‚4¦ºÇµ®R¢-Ñþlàž•’¨ ’oƒï‹®5^#‹->üÌè«ÑÃBtBÌU\ |0j\‹p€:B潪Ak»ýÈâ4+U‹Þ1Ê#+ßH[ÕEúPx乪‡k'­™ãÞ Ò?‰±4'ñX ™Cn—zƒ°Üsµƒ” OºzœÄ¸ËTö0îX/¸ä€ 2Ÿ8†nT •z7â@(P[@FžïêJœ±˜yÕL|h - -ÐÚkTOýÐiÜê£ p|U, R9ç°4”,hïY“s_È[b•úI¨$¹úe!G¹60®˜À}ôÂK¬2X)ð'd˜™ ßéM·J0(ГR@ 0̼DÃŽH€¯l»asz·~„ÒÀh‰¼ìÑôÆᎌ¤Þ’ˆ°o” Wq -ƒä5vFq%‰ Q}]óf½˜sð #˜d%Ê{%QQ¸É$ÛéTˆC…ôTñ¡ à¸«†hº8d&øYÊÐpœ½!¶úƒ1g™+ŒGÁ˜ÜSr)›dîÝiƒ”» OiDÜ <Äj “ŽrÀÙÓµE2óa•ÀYÔ‡Eã: °Ø©ë¡Â„÷y•Ç”–…|³š(wM— ÿ¢nP$n¶I£XÙ4 gMawÇ"02ŽÜ|i¨l`äè…“›†éwåƒî¶¼bïå¦6’—ÇÞÔ ÜŒï[J»9¢ØÐ0ŒÒa߶ü}Ô“D @mÆS¡"LWÖ™PäͦüâÄE1.À‚óøìEÑ¡‹b:†p”E„ûƒô ›Ó ƒÔÏÁœ#h`Ž(N\AF¾ -£ Å«ÞÜ aóW÷ü½fé¸ÒÞk² %7‰Ùìq ƒî ºÍèYO‰4-ü8OÏ‹t„9#Rú¤HÏE:£¸,R‡âÕþ¤õžBnËYÛ7 -׉Ã6] Ad1Ðϳó"aΈL€>)²3G‘Í(.‹Ì¡xõ âš÷Í.¿Q1%Aa„D(F ÉiÓà ™³}¥Æ²ƒ‹€\T]‡ÀîÅ?%Ì0ñ£ü|íÇ9#Lú¤0Ï…9£¸,L‡âÕÆæTÿhÿè˜%c´÷Q¸VÀ‘BnÇqýàúV³B$.®`,œ˜Ó±'‰$Ý-¹û{#×N —Få¹áÙƒq`NŒúÔÁœ#hfNqñ`\ŠWž<˜¾úÓ¤¡(T¾°»ý„`ݸyBÔk '™¦xFØ(ƒ$J~Û‹ì)äNöÀÿÄZôíÚxP•JHkY]—\‘®‰Ôµù’mï³]7­$-å¨rqR袕‰^TŠŠ½ÿrßîâJêy(ÎÊ,ÚKzBŽ¿XÝà!W­‚pR*;™c·DæNŠM›‘³¯«r‹á5Èä(‚"D`ó tÊ©ˆ ª¥&V?ó´•ÅnRKb» øÙaˆËme7ˆæE­`~ÿG‰)ÎÍTpqíX¦jv¬·¢k£\{ÇÏŠghg>y[Þk)%›„>ç8œâ -G”Enq–à7•äFD7çLŒ´Û{‡éaÝÞéú½ áŨ/Qóâv*3ž(=O`ã=œ©²ˆ`¶²„£ÓG™Š!VÆ%9çPnM¶Ï N5ØÜ*bRbËÌqÝ ­Š.<»„]X›]jÔ¤°y¬¿÷$ð"%ÌðYu‘™×WÔ´ ™!`U:FÆ#.3œ[ )2Ò³)rÏ}vˆÃÖœ!WÓ5å:4K—+^C%FisvÉžÔ”*Y÷Bïo ‚yE^<Ë)TìZ*›dÇÎyéÍZ?cÜø+7ñüÕ(“÷¤‹HĹÁ0×á1z9˜?.Ž“ŸÌ Vø–—€V&ùÝ×>ìÌÞ/¢hæ\{ÔÝRiì·ñ]EîQ÷¶¼©TnÊOØÔüAÛãVÿXÖ5jL’Ï„ªàqFÇ9OîQÙ› -¶òãÞª³2‰ŒWͦF¦¶†Îó>ÐkhÛìƧP•K ª«$BõLúrŶxÀ7è?Å&œ÷¯ÍKFÉ,ôÏî>b?NS.HnÌûÙa[ò°æUF©e”Ê}Ín–奖Y~ ,‡Ñ„ Ù¿ -7l)©¤î©ô#¨Œltò¬P“ÛÈB–:yÜ S>Ÿ0ó®f|”>Ý~ÀÞk¥-Ù¬Ž{ã+t4èåªí~·Åä0›©(ŽLïHÀI룵ҽdœDÎo1`ñrY34¹¢«Û‡¥B0â*æ?|8G—Ÿ@ ÈçÃnÿ¹kÓø @JUÀ`ƒüh ˜þâ%ÁdíÉ-eL1qŠÜ ]Ï”„O^ʯú…‡?Aøò3¦ÏïûÅH•Õ›8aó—§ÅvgÏÜnÂGÒ£$ð¤Î¸wÌD2 µñ¯ÚÛ§*_&~‘åì[óðèÔuþÁŸRÄéÌŠóF¥ðÂ*9Ê}ö 3åCd“—œ¯¾Zxë‰? RàSv(È))Wñ½ˆèú­Ý[âÀ¼@a€°WèS¿™R-±àÏäÿúÚX{S~®NÂ’(ò£ÐðB?+Â9¿‰Êý$WÇ ÿél›_endstream +xÚ¥Sßo›0~ç¯ðÞÌ$Œùaö–´¤Mµ6[𦶊²@ +j] KûßÏç£mTeOBÜÝw¾ûîó!7 *b\¦$Q‚I¥Èªq8y0È…#† ó&,!`cíø“(&‚³”§D¯mŽ.néÙåè›Îæ®'¥¤æ€ë%‰¢—3WÐ\Oo.Á'¤×&:u=AÏæn è,7þl¢<!ªçÖÿÐÙ9–˜L¿fhþ3×Ù5ºzž 4½qïõ•áæ É¢0µó4CÁÀN¦¦ô„b\0æoçöž“ÂHqåp&SEÆæL¤)iœ0‚’rð7Nî|+ƒXHðÔ 5½', bâIΔzWUF'T­»EÓën±©·_\/ +"ê—ÏOí®÷«¶)ý®ZîÊÎÚÿÚÔ«…õüϘW´e‡Ö¶íÑ(Ÿë®g0º?Çý¼0bJ(`ÇâPáîwF­ºÝwæ2#X½[£p’ÂýHÅé +n¯Zn ðP‚¬ÀŠöU‰yE 5,´êÛÝ F!Ù@pH[CVÛ`QÆŒÃü¼‚¬Ì ¨AäÑ$˜ ú6áŸÉw<âËMk)â±CÝWh5@ÿåÄ¢t–ñîÌ¿zåi«(︷µ‰÷u»5µV‚íºÇïÁ ÚÂdÐgÐGÐOWïMü$à,ÀíÄOˆôþo;e Ñ{-»zâÔê‰T~$*b&c³ÛÇÿzøçendstream endobj -5223 0 obj << +5412 0 obj << /Type /Page -/Contents 5224 0 R -/Resources 5222 0 R +/Contents 5413 0 R +/Resources 5411 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5204 0 R ->> endobj -5225 0 obj << -/D [5223 0 R /XYZ 85.039 781.388 null] +/Parent 5415 0 R >> endobj -1186 0 obj << -/D [5223 0 R /XYZ 85.039 761.463 null] ->> endobj -5226 0 obj << -/D [5223 0 R /XYZ 85.039 741.134 null] +5414 0 obj << +/D [5412 0 R /XYZ 85.039 781.388 null] >> endobj -5222 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F38 2997 0 R >> +5411 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5229 0 obj << -/Length 3530 -/Filter /FlateDecode ->> -stream -xÚ¥ksÛ6ò»….37¡n"à›ítn'×sÇIt±:¹›¶h‰²ÙJ¤BRv}¿þö”(åÃM&&°X‹Å¾!=QðOO’ÐU~:‰íúI2Yn/ÔäF~¼Ð‚1”Yçíââòa4ÑÊMU:Y¬»uB7ýÉbõ‹sýÏ«ùâýçéÌ÷}G'îtljs}{u7ÕÎÝÍõÕ-κŸo>.¦3íÜ|ü‘ñççùüŽMßYL[ütñ~aɲ )Òôõâ—ßÔdôÿt¡\?M&ÏÐV®†áíå†/ýÍÅÝÅ¿ìR<LxÖ B?qÃÄ?æGx*7Tñà?H{µ‡3%‘³Í¦^ì¼pç:‰ó„r„ÄN[ñ÷iFNVÃÉ_ð‚H°ˆvjTx.¹³¬¶[d]VŠ_" B@ƒ­b­[¸jv¿ÖØ­¶²ýcÑp+ÿ3Ûî6B•º›Î€zjÒNþ}‚J9S†wŒ›iäkJŒ0g˜ùqHó«z›mˆìðl° à´ ùU逛iŠ#ÞàC^€øbNÚæÄ µ0J©G>.bϲF6ì7²×šÈávû˜ IÈ›IËŠÖÞf%r9œ]VgÛ¼ÆNww›V¬ò“¬m ƒ‚´"ZÖjÛE<^­Ïœðú4÷×Dö­Ì¢ØsE÷'®y)¦»ï–,šïè¡›ÆÉÈvU¢é ‚ùCàþ\îÍõà”Ë È9LZf›Kf[\ã>»¼§/©ûÒ_¾YšÉÅNöúëN¾Í ÃÅ¡›xú¬Eëá6{0¸~õ´9 -ÐøˆŽ F,BÑ -Rç¦,«§¬-ª4ŠTøÆÎGÃi¸7©nùΧ)ÊeÎMÏõN„n˜Fç ïpNš¡ Aáo­ÔW5*±²1n§!šÖ`] sÀéÀw/ÌòA“/]ó‘ÀÔ@k›ÈêFž|µX 4©SÎà]]áWlÜ7 Þäï”É‚c,pú'£¡Û½fEð -L®O¦Ÿ{–¯A(3€b%ØXWëúÆ­yÌHÂ|50ê hdt|Å2Oeg¤àn Xæ{½;(艫¸Y›Ý7yÆ¢÷†¬¨òtvd„Ù6¯dÙŠÑ;ÙÇU· ìïYftÖ7ûzÈË„Ù3fÛ1Šñb5j‰Î&x‰ðǬ,ŒLld„:–ÍxJ/ÖìP¤s¶ì‘,"Âäoò„8Ùˆd{èÄ~(ûánöy~=&Ö`ì½@°~U¡B4Zù‡‘Eí¦A"ØŸQ]òm…Œ÷•û‡€ -ÿ,ihzxÚaò¹ÒÔ¹Î@|Qi›Š@µµ©xÀk L‹'û€áâ —ý<kpûF<êÕˆ²+åÆž!ÿnŽ31èüt{w7B0P)ÃÀ<ªxº]a}:îe# -BÕgœ#™pY4]‹ÏÞ5åÃ-ŒïÏV!ï¯ÊLÖ öåýÞõÆÑiö6"9}*V†ÂûB?f(ógn çŸðìxtµâ î.7{Oq0âÌ‚4uµòÎ:³9³@îG»òíB|ñ:>ÜO«ÈMàfÏmhpŽv\±ûïko°ãJë®g2‚$`_†•Ä㛊.‹Ü=ÂûžnH!h]ˆóeP?ÔÅ>Ú)ü~!!‘Åe, /Óä’s¥KO)Å;ºM™²ï®°F»x u}LÃ1§3B?¯ ¢ÁM^O)zUžóš¢œm‰<7I;;¢¿?%%aB;œ•’猔Ò7¥ä̆”ì8.%½¦À„ÀXü æ8=ˆ½ca€±04 ãMm£§Øþrì~þq1jè!†Æ_¡‘]­P"gnéRD2‚•ÿ †ìòñj/î]¢ºB û¯SXó…ØCŽ>,)ÇúA0>÷y/سúÞ Rv³ÝÕd–DôÉ ÃÉ8¼xÁùÆæôD!ô7o9£©Ä8Kºæž’v» ø²³ÒÞᜑvAú¦´ŸÙ°“öƒÇ9ÞÛñÈ&zqj¶ôz …T(t&¤BЬÍ$´HODLéAøŒ›ýãÙGçl¡è¾ èkßõ‚äù }ƒˆ©óžú{Fý„ß7(Ù(Óˆ”*'ois"wÄj"ú1·6ÀU€0çò¢× “o)€`Ïzèc28\“£9ØýÝG&…-eÙû­q p#”°RèEšÅ¤OᘜótyxŠ4е6qЖSOhåZ -@maʶìÑ MØúž‰j:ý¶U2F7x@2HÚ9åbü8†\%=«t=œÓJg¾¥tç6´Jw¸ã¨ÒõwaÙEå ¥Ô ÎX6ly-ðdÑ~ É)E’õ9 åjßë; ¼¦ë[öý²–M -S§+œáýßCô:¿Z¶”¼ÎP¹*:_Ýé᜹NAúæužÙ°»Îƒǯ³·#z­ª«£“V1†ÝýP Ƭb{P+µe]úŠYA¾ÇˆA%X‡£ŠŠÌFT-P¨XMÔ‡Gže£ Åf±›†c½Àwxc †˜ˆàZš¬Íî%#ˉ­häTâ,Mfò;Þ=ÛXlM‰W´) 7’ƒbU`]zÛ‹qDz©ÁÒÜ}Ãâ÷7yµº7KIÄM$sI™$`^ ‰˜W”°›ûT -wüÐÔJXðž‘—9®Õ2Œ˜…)[Éß=Ÿw•µ2_ò}l¶6ùÿn:ƒ€‚«±s/áàø¼L!S²{¡™æWüEiØÓ@Ñ<Êö˜pÒÄVfcOBåd‘â—êcSȪ~énÂÜéí;œz5óû³¥²É€ƒ¾Ø v(J؇¹€…'’¹:çú( -w°ùؼȅcÊ‹,Òà køÙÃ0 ‘HŒ4ñ»‡ÉNÆ´ -Çú6Š!¬µMÛÖ²ÕÅæÁ[ŽöŽ9Ž@¸"S:Ö¼ðŸ]ÔEX=®‚@²›’ø¶RWب R1©w‰›K]VcY›N\ÏVD¨ž·¢Ê”îÚp“kr.„ájßf˜8/Š:IÇÎ -X@œ§ðJô›V÷œ·/²,éÙ.©o¼‘:IŽ0Ö-» T$\|R¸pÔL6<†ŠêÅñïâxpJ@6ÔÃ'_Xƒ®s ?M£}¬¡ãùhI‹Õ¼¤- ±E¦PIزòÞVX„˜’QˆeW‰^çY#o~GJLöƒì~Örk¼šICXVøóòßsîS]­-¬XRub”å¦È»ŠP.ðK¨æ±z¹9,öZA¦:¹#yøB ”rIU³zLmî0x‹µÿè”gôƒpÀÊï1¦‘§Pyü -èáï…[ˬäÆá‹WoŠ:gáÝÈ mÊëCˆ–_üPeü«J‹Ø=½ǵ<™#ÁjGN¾olõ"µ± -¨Ë]ðÃ.†sk†ð U`©:ú s©ÊnÀáœÄï¡7`³}èx'ÜG-Èì22¹dæå¼]F.%Ô«§Â>Ù<ÐÃoè­lÈzTs œJΩtXpXIzÏT¶0ãŃ5†W…¿TÀ:|ï ‘Vù:£XJÖí©q½-D3È 5æ¡[0ÃkZz‚Óònòésm¡ävÆš,]rQ²ŒÌ¡3°Æú—d×Fjø0XË´]÷; è­¹ø°åV¾«g!T¿mþ>ú¸qh Ï‚Ÿû&3îϬlž?Y@„¾|ïrKÍ7”ó±zÃ9%x½‚ÈÎœÛcï®X¯ÓÚÊNÝîÈkcHâÎÓ\NÛŽ"´)î #²Rè&ÿ¯ð—L{k”rË6MÅø5½-ž*¼ pé1ügþþ_?Åë -ྛø' -c¡ç¹ž6´¥K~Mc~²wDðÿ£W¾$endstream +5418 0 obj << +/Length 2850 +/Filter /FlateDecode +>> +stream +xÚ¥ÙrÛ8òÝ_ÁÊK¨ªˆ!HðzLœÍ”§6ïÊYOÕd`‘²8æ¡”Ï×o_ ©ÃÉÔ«L Ñh4}K9>ü)'¾+ªÒÜU{Fᡤê_Fa1‡sQÀñð© +¾põŒkp<¹ã1²jw]•‹‘ÁM1àì ùk‘†“”Ú¦/ûIÞ°½Ýðò-=GnoöÔóòÒj»+Á eÛL²’{€¢ùYJ÷x·€YÈòKÝ;ÃÓ[€ð‰¾f÷ˆpâ­@¸vkƒHÏŒtŸ”W@~ûÜ‚†w¬ðå ñ¾DBEÜ6BÅ…ÈÚÚ”²ñ?¿r™G>Dðäå{ƒk‘ÛÓ+3Gw£.ærÖS J0{Úˆ$‚6Sñ‰A”\AÅîfßX1 øðNoä®cÐák˜Hno³£dB8»ÚÃ(l€ÌÔqÁ…jºJÝ«I’~#2Ê#±Ü’š|bßôüÊûíì˧]®Z’jË'³Òóõ ºæy¦ÏƒøžÆ^³ÈÂ÷äÂä¸Àé¶ 9&Ðê}g¬yèOaMú„~¾z'oƒÈd[°ÄÆ2.)÷»œôîq—,+ƒž¡’mo3lÅñ9ÐHø5šÓvT8ñ¬g®ŒÒÐaÄxlö– ©D€¸çàÕÔ2Bqá7/úÉÊ]sÞE¾"¨Ê9rTdÙˆ‡¶‚_òv´@Ûîå¬5²¶5»Á.w=È(ø›Øp J¬cr¯ÏÝ|w.$ ){TäëQ‡î-‰ÙÁÂbÓ²—£ xÕ‚GCËß‘éÅcë`¹aJŸoxNoß[2ÈœéÊ)ïû<š3)ì³)&½A}¨ª%=â7ïáuA¤œøûü9i¶xWŒbA¤'ST“)ÈdhüNA±Ñ4Ö5ÁFº°é‹1¤¡_V¥¥Á÷è-$á¡+÷oªÖä ¡À„x$Ÿ~@e¤yNnF[hÈ£ÊÜa`‘eŠ”]»¿?ã,‡ÑTJô(Y@1£!2!Tà_U¨¯)eúdo°nˆ+˜­~«\KrLk]±#ý‡ÀÚÃmï´Õ »âÛ¾ìæi&* hÑ°aQ¤kÖ’ïÝRfÖÕ3FÉG“ûHõä>`|$ Mñtdµ‚¤¯®éTù|õ;ÎÖ•_=~²¨„|‰/èVV"­8ûÔj*up”S‡ +Ž×¹£Ñ)}Êéó1ø5PYo…0L·…06/4O5aÛ²¬ÈTòs×Íe¤„7Cæ=ú«4˜ŠªŒ9ä<„–Ù«À`Ó2Ë 5TA &1,¯8OU1.îÃ&é5"Ù ÄŸBž$å¿s3I‹ÅÂsÆãçÄ^ȾèTB`§Ç©“"Q hzç÷«K†Ûð‡c¼Ñs?H)H ÿ-A])²¼±^ ¡ƒDUª7ÜÓ4(†TëÓ˜Œá>°ÒÄžÑÙyãº8’BØá<ÆnéO­`Ê_voÀÐÌng««œ^Õ·<Z^¿ür½òxxµáï3eM{Æ›B9Ï/ÙÞœAJót^%âaÅø S% +Û-í§7Ÿ-Ä£%à¸)¾¼z ÈÝ™7¿Ûsˆ +ý`b1ôh5¹EßöºÁì©ÈÜA‘áϦx⻵æ^–Ë “9 ž·”,jª™ KŠàE2´É2<ìC*‘¦N{i’ÔX;JyzƒéÞŸ[¶ŹäQï8 +µöƒPrÀ0£i±“ú˜Uekø©+ŽˆÅwS甆gTrw/IÆ(é€À‡Ž¶Äì}ô>°D%ìº=jl"ì÷kƹîÚµÔYs«„SƒÃÊÆÖ ƒ-­Ðâ[o§²‘š.-.'9Çò±ÿ%žbÀÕ›7’ŸÏs'^“žO +^4Á}€ÔòwÝáš[¢rö}ùX4oιÒé0rïhÙÕ¼ðK[2Fk=ÊÀ€Û cêD!öN¾¿E1#ÒÚz§™ío Q '<¼s¡´èÊJXã$4‚ d/§Oí=l^ˆ„ò §·¥k…øK7Äåĉª§Þ¿>½‘å0?ãø†;õ¥øßž^<ˆÉΙQîüêä¢1)€øtâ¹Â8ó”Ÿ8ˬ=øg~ÊáÐKtè,q[öÏ\ÛR›LV ¼4Ó/ý줽ÈOú³S ?;Ý,2ÍzÛL?˜]?—uØ~ðQùÀfÖ’˜þì·'õãßžæíH Ÿï@úód"HS,úm…õNàO;EÏ›¨&ñã©zX)}³yJpܧGH¿¿³é攵PÜœR”Š ¿­ø[ + ©AÓ–qêŸfòZ±6ƒ®Ø)¶^ê’z/U¾Ä{Å{1õÁõÁ<ŒiGϠÊšˆØf³ÐÞPC¢æÅÉ-O&Æ›"ŸºÕ0n9A”Ù +¸y?KÊ•äyg:›ˆð4$† žIò£t íŒ2Žƒ/«‘Êô1õhgÑÑÏÍöûßXu6endstream endobj -5228 0 obj << +5417 0 obj << /Type /Page -/Contents 5229 0 R -/Resources 5227 0 R +/Contents 5418 0 R +/Resources 5416 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5204 0 R -/Annots [ 5232 0 R 5233 0 R ] +/Parent 5415 0 R +/Annots [ 5421 0 R ] >> endobj -5232 0 obj << +5421 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 441.788 154.005 453.477] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [132.952 286.929 308.211 298.619] +/Subtype /Link +/A << /S /GoTo /D (CUPS-printing) >> >> endobj -5233 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [153.74 400.534 262.854 413.436] -/Subtype/Link/A<> +5419 0 obj << +/D [5417 0 R /XYZ 85.039 781.388 null] >> endobj -5230 0 obj << -/D [5228 0 R /XYZ 85.039 781.388 null] +1158 0 obj << +/D [5417 0 R /XYZ 85.039 761.463 null] >> endobj -1190 0 obj << -/D [5228 0 R /XYZ 85.039 675.821 null] +3154 0 obj << +/D [5417 0 R /XYZ 85.039 653.495 null] >> endobj -5231 0 obj << -/D [5228 0 R /XYZ 85.039 634.793 null] +1162 0 obj << +/D [5417 0 R /XYZ 85.039 653.495 null] >> endobj -1194 0 obj << -/D [5228 0 R /XYZ 85.039 139.391 null] +5420 0 obj << +/D [5417 0 R /XYZ 85.039 615.228 null] >> endobj -5234 0 obj << -/D [5228 0 R /XYZ 85.039 107.576 null] +1166 0 obj << +/D [5417 0 R /XYZ 85.039 127.276 null] >> endobj -5227 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> +5422 0 obj << +/D [5417 0 R /XYZ 85.039 91.965 null] +>> endobj +5416 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5237 0 obj << -/Length 3530 -/Filter /FlateDecode ->> -stream -xÚ¥koÜ6ò»…QˆˆRÔ³÷ÉMrmŠ\Î׸—n>È+9ÖuWÚHÚ8¾ûó7/RÔ®ÖîÄ"9Cr83œWŸ+ø§Ïó$T¦8Ïršâüvuõw„­r\¯>^ÿröúÚ‘å6 -¤éóÙÍGu^ý¿œ©Ðùù´U¨¼=¢Â$6Òßœ½?û‡[Šañ9ÏZbAbò0ÉÍ1t²ÀƒD…‰Š‰ã= Æ“5=,NƒË«Ü;üfAÓc¹Ùð`Õ70áË*ÊyV?à¹×¹·6Eå †[lºU¢ƒõ*‰‚§ÀJ‰ -6qƒ®qGÔðbmc­[»ÆíuAÇP‡Â7ؤº]²ÀIê8n–hrÑ@s]'¡v–z~g`34M»ÞàÅ©èÆ}b@‘¼(ò{ #¨-<ø©…FË.hW¤²sm‡£Òbtk@¾ÐÜ8ýàƒ - m|ľÉeuŒVñÞ-Çc–•À¹zíû‘(^ìê"öV2 ¯,àõ«#•†YdY½ßmÈP'd®Ð­" K†3ÎÂ4µúÎÿPˆ¹iƨê.Ú ÍØ,¯W„yáÖ»“㢦ã+:¢˜|†Mׂ1å6#öohà^°™ÖpÐ<òm]•çh ku”äî‚EIÁFm³a3tÆ--^Ñ_b‚s_.Å1Ñ–\¸:-I¾ÊM{»5½›ŠÝ¹ñä1¹ëØ$-±ËÞ’Y—C”쉚zÒâÊ·Ó¢—Öa£¥³^4jVŒÃ€²~82&EÆYüd¬ëáPœk_q”§lÜBMéìp? ª›ƒÊ=µ¡Å9ÚqnF@WŽf;öh5(>c‰D‘½ºÇªî‚¾Ë+ä·¥@#óÈÆ"]Ë –òe×ÿõÅïWØ×ÁUßÝY+1 àpÐ"âdâ¸nRýÈ`H!¢‡¡ö™ ‘Kíú?¹‡K÷Ý–'ˆ)„¡×|O@DH¨¯3Ã*&S9%ÿ$ƒÒ§å?áN.0µ€À ª<#Ä«µÚ%Ö±H­üSÜ.ö(¬ BºÈªÇ Cm7 -ã±AŽ!ˆqW®Ç–$ƒý.ì}€‚.f­ %œð·¸×"g°±'b…^÷µ]ˆ%¬ñSÉ"×½T쎳j%Κ+&í#wJiÐ6·!¬I$â\3q†t·¿Ö/oê%«S¸O.UÃÚDð¯\†ºUD§GÐØS¸µiþí‚÷ö•êkÒNqLqÙ´OW-°&¡RÈ:^AòüvÓ••$Béq^¥Òyr±á1ˆ„·ØÂÔ -vÄÔKe’RBã»+òð ñ¬}¶Â bº!ß1Ú–KM–mc·Ù2”Úõì¤,ÐT]RXM€u¹íâÒõóÚÁ ™r>—Šlª9Ê¥{‰ú9WOÚÀu3Ò˜ò4^]OÙjI÷GVÁb8m!°Tp•©Î•‰µÙ–ã1h¶ Û‘ÐÐŒ‰™:œõÛ»7¿óè1Atl´S[Kfo—ÿ }ãºC¸À¢+/@YÓ9£\='uãJ„8j…ˆíyE àL@ h¤hŒwˆ4%1™Íá•;1¶áĸãïŒáç*Öé#Øg›æ83Š‹‚”:ÙZ)®ÒØÓ8VìØ׺ûò¼ÝÔÇU'¶õX¤ìœ]5Šy‹ò ˜eÎãJÓü\ÊMwümk±:pð„Ï7øç?åô=rÃ@uXà \­Û@Zç|&‡i{Fpï°Î|ïÒ Ë@¸$Ê­1=¤b€Þ×kªWQÇÖ»RT6<,F«Ýgý`üŽô£ì¡÷(y®9uÐ8 ã"{ú 4Ž‹úF'¡¸zƒôÊDì'è(àð¿ xn°ÿ78ÊƆ1éÈÇa^ü'¾t€IŽY2\!SѬ*Ã|kI‡H¥7EÕEnl])WÅ\MT\JÝ„t 5’ðìĹñãÚ*|0{ŸÖiWRk—ôü°˜aFjC([á9A|ÿÁȤa[WøýRÎƉ ³—Xg@éäJ1æ "‰õŽd‹¶\jÉ „RóÒÆA¨‹ä tñPÏ23yULoñö©>,›µ`­ûºtu{“y.&| {á•Úa ð{Ê…ã¢÷–Ö’?'\‚¦’µ=”Þ¾]lɽ‚àùœÁW`"ãKT"QmŽ+A86{êeB¹¡Èº¤Íd쾜ê³8RÐñ0“ŽÉtû¼õù=KänòËm xÍžØMØU=ð> ¤ê¢k‘Ý ,)×¾F¤šßÐ`õZ‰ ¹+“ÂFÅ£“ •§’JÜkªëO5á{®<Õ.ºHAz{äƒ €d»ŽãØ,J‘!?Γ+"Ía)÷z•õR¥}潜5zF‘:¾C!ùcC ö·;—il=Õ-ÙØ# -FŽV¼ºÀ"öŽ„ÄŸÙ!¹g|@m5¢I~Âåx—,¾áì ¢¸,)ùCÐ*â÷– æRùÅúŠç(ÒQìî¦âVÏ©€"^¼8,@W‘ffþ¶„8–Uˆ´F˜ÜIUáErŠÁå,€)GÓj†¶Ä%A™‹^•IdݦíYEÑ-å¸À™ã´È—ÈÝ{eŠŒUÙ‹¹^ £žH-ÒÁ§ñÃÂu¦U.µzÉ^º”à 'QU׫‘­¼%ÐWöíÂÇV•¦ÍnØ13ZyšÖ¬RZOuoJ I§ÐÛ¢Éæ806Ia2ðpNZ‚²›¸èÈèÑYq¢æ|Ⱦ²¤½œvèùÕéyì€Ç6±•·¤içqÙPX£I¹,ȯõÞ×±ß×[/pG·ˆª•Æ ÏØ 6çpò~pÎ@ö¹›üžiïóÀèDtð^ž/pCO¼QðNÌaqÎ~øƒ`Ÿ­™#’×›™y¤ËE¿9ˆ´ØµÈc>`Þàˆõ¿ó%PE -,wyk…túvöT[ÀŸßÀÕ}32ÐÒè…=D¡ {Fj£7¾‚ ÇÅAçÑÉ·žH•×b”£o¢ĥzØ>ü­A¥þaXøziô9èÁVɟ÷E“<×!ó»°'–+#‘Z -fÃRàG$Âs¡Ì‚Öo8àrqMšsÀ5i> +stream +xÚ½Y[sÛ6~÷¯Ð>•š©‚àµoÙl·u&M½±<Ù¶´DÛLyQI*Žÿýž@H¢NRw2ƒÀÁ¹ŸZðO-²Øt¾H3åë,[lš³`q 3?œ)Y,"?HbœúçúìÅ¿ãd¡?òÅú†–¬·¿x¯~|y±þþÝr¥µöTæ/Wišy¯Þ¼¼\*ïòüÕË78yðùîüíz¹RÞùÛx=®¹º¸øç–™öÖËß֯Ͼ_;"¬"?J4ÊðÇÙ/¿‹-ˆùú,ðuž-îaø*ÏÍYk?Ž´|×g—gÿ±\x.Zð®MWfÅJ~–EVeϨ¼+†¡D=†å*Œo¼+¥ÞØ +hT2­/‹š©; öU» 3o¬`ÜÞ2}xÛÈ\ï¦ëe‹öýÿß•BÚõð…§dÞ7•´u®Ê»ýèIdO‡ÓÌ9u}) ª‘™µfºÜUDâÝ5 ʺoQX¢c‰B·(4XNö¸¯àÄU†Þ5ìN½Ž?É>Ê«¶æ”á»å*UF¾(ÔÞ{2Ä–”‚­÷3ÚõD'S1…ίX/˜Ê½q`&*²åu.ó«·çÿ5üpç¡é‘N>,ETðƯRÞe»¡sÀbQy÷¸S¸²Q†qÆ[äýk 4µ/å@4Û* +b²ð‘|ú–¢ Ͳ£qœx—qâ}ÕíY8¤mꪴ&õ?_š}@{Ø‘íÙÐß²¤ôQlpúŽ—v7ü÷þ®rÉ"×]´FW8S¡BNr<ºáóUÎ)D@c%pTÍŒaƱRLF2Ò © ‹È9Ý~`{M'ñQ …Ü„&¹>ñÜ îÒ©vÕCŽl؆LSš8úh…•sQ¬bfxdÊ®L7e1îíŒ03!‰ Š^˜7giùöOGQ <߬S?€b†ë×wz[¨52¼§ÜFã&³koì Rl¬:” ïƒÈLÀpщ².9LL.:1±V DÉ+ÚòÓÈ£ r"«îF¬_Dë& ÷"*ð¡¿·Öˆ…p°¥c,ðØzÆXV-è1äá®w\)·eßâVha¹SÏ¡f*7}¬k`_Ó¡,qæ]!+Ö¾.Dk”ÄŽnq.…f 8rÐ5TœûtQ>æ× ^]]\’‡cå7<Å~¦¨¢ö³ÃnuÒµA†] Zxÿ‰©"_Ej¶G‚USfcC›`Ã#Zq‰K,’ÄOre{h-”òsÌþ©‡ž£µwૺæ’fœkþh 2Ââ;W¶xüçŒIài^œ7Ñâ_ˆ¶˜¤Ó¹"ˆË&áÔã³9Xsò›VêÛ~°Ùo«LK·ÃP #›;™×Û¶º…†éÜãöFËp®yüÛûà~4;>¢þŽ²Ë9ràü‚Ñê5q´Âùج”÷?,ÍÐ8`QÈ9QÝ"ƒñ´7Õ`ŠÀ±Šs#éH•‘êØÈÙDù~ÃMAµƒ¶u-7ZDHcßnyjB"å?ŽÝ«“ÜW„ºŽü,Œ¿*îVè”B<¬p[þu©°RVð‚xÒö4‚8œ¡^ÞeAëº ˜Gd[ø3Aðþn*T6¸\¤g®D¢’ŽêRj´à1)0ðX®).ã¾ä{ZÅyŠ!†pÁ ÙL´ªû})¡¦ROó}ñ,„¼/Þp î?ñšÝ˜¸dÓQÊ6E;‡â êiJñ[8`2™D§™kYpJ-×Zƒá‡¸WVr5b2À¢?åJ 0w¾“=:ÀØÕ×ðŠp+ÍÜ’©hˆ„ûkÓXdµh1‰´éú^ê9ƒÇÚä±)–˜•l‰Ùüû€a€{ŸÒ‚Š`‹ÕTžLHeœRÞ½¸ú•½?ƒ7U€ó‘Ç°Ìétz ƒ\«2?ôá…Šï?Y´t¡¯À_¬ +ã™ë+à_¸b˜E¯Ii\`Ùƒ»–=®z3"‡¾fð4#±VtÃyÀ\îÍ뎩®7ûú´È ²In4Uiï)Z¶ ïÅ«³6<õ©²µ`ÒiÏ1•¿rãaâÓõ½w£B‘äÊzÌEìaݸ(ÔîƒÀiôÕ'Ó ðrÆŽåô¢TÔµô2bÉÜZ.Å–<·åðÝÜEGû‰NçÜ2€|«yÜ‹§7É̲˜·³Œý(þ,Ç9ŸvNw—çDÁ'[)rEmÊd£ã—²wŒD%¿/O4¶¦Ú¾}|±±Â¿ÜX.¶ÔôD˜z{ŒS`îé5ÆÄ̆^â\5ŸOý·Ë`Ãd;';Š& šAn+ÄHœ°y´×^¿Í3+djÿû”ð™ÛŽêÎ7Fö#´#—,r£Á<»&ÿr×D‹k6u7˜—Èã<Íb¾t=_8ÆÏšŽy<ýtžHÌäÉñ] +ö˜_@ÆJX.ÏÄ–h —‚5X×¹·Gî8–K<,}*OŽc(p\„2¿™íJ_§Qà'ÑWø,ùË}¶6ùk:·>öŠéüþo cÖ2€>ya>[Zøºñ|ñ>Ÿ­>['›Â¹v·¥½\8€éÚ½†—Ÿvµý¹¯ÂÔ7°f[Ö¥).{½=.$— ä”wÐ?±t­_P ¸ÏübRÓqÌåå>=s<Z‡7cÓZ6]{ò@†¨†kè8½à=Õ´“ÀÒG€º¨òu?rëÔW™5ËÓh1O~xH|D‡1ù^Žvendstream endobj -5236 0 obj << +5424 0 obj << /Type /Page -/Contents 5237 0 R -/Resources 5235 0 R +/Contents 5425 0 R +/Resources 5423 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5240 0 R +/Parent 5415 0 R >> endobj -5238 0 obj << -/D [5236 0 R /XYZ 85.039 781.388 null] +5426 0 obj << +/D [5424 0 R /XYZ 85.039 781.388 null] >> endobj -1198 0 obj << -/D [5236 0 R /XYZ 85.039 374.861 null] +1170 0 obj << +/D [5424 0 R /XYZ 85.039 369.66 null] >> endobj -5239 0 obj << -/D [5236 0 R /XYZ 85.039 339.451 null] +5427 0 obj << +/D [5424 0 R /XYZ 85.039 334.915 null] >> endobj -5235 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F20 2961 0 R /F62 4047 0 R >> +5428 0 obj << +/D [5424 0 R /XYZ 85.039 290.876 null] +>> endobj +5429 0 obj << +/D [5424 0 R /XYZ 85.039 264.383 null] +>> endobj +5430 0 obj << +/D [5424 0 R /XYZ 85.039 239.406 null] +>> endobj +5431 0 obj << +/D [5424 0 R /XYZ 85.039 210.186 null] +>> endobj +5432 0 obj << +/D [5424 0 R /XYZ 85.039 185.209 null] +>> endobj +5433 0 obj << +/D [5424 0 R /XYZ 85.039 142.44 null] +>> endobj +5434 0 obj << +/D [5424 0 R /XYZ 85.039 115.342 null] +>> endobj +5423 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F59 3455 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R >> +/XObject << /Im4 4715 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5243 0 obj << -/Length 2661 +5437 0 obj << +/Length 2955 /Filter /FlateDecode >> stream -xÚ­koÛÈñ»…à0T4¹Ëçš&¹;RÇ=ûp-R $Z"B‘:’òãßw^ˇH©Z$wggggfç¹vgüsg‘o;:ž…‘kë(š­vÎl+?]¸‚±”Eç¯×?úÁÌuì؉gOßö|={X³>þüáîáó¯ó…ÖÚr#{¾ÃÈúøåÃýܵîo>~ø‚KžuÓ_onæ ׺¹ý‰ñç·»»¯¸6´õ0|øåâóCËV{ °#O\|{tfkàÿ— ÇÖq4{±c»°¼»¦lßÓ2Ï/î/þÞ’â5oÆ»¦T`0nlÇÊ?¯¦Àµ½@·jR°êÚ±ï÷Õä;¶ïx¤&ÐL`ƒ˜äûŽõ±J“&+6 ‡ °ÔÊ6ÅIh}ÛϵkUYѼ{dÈý6™kǪÒSêñBÛwÿÃ1 Ãñ½º­â÷¦€£ÃÀ*+`zV!-“«šC†cP:kصŠ$¯'•á;KºtÂ\%‡*ö‰™‡ž•Õ j™R±>Å.!S¸¯™³àøo÷üý”‰;ÀtBë¥f0QÃ[Ɉ3/Ç6|J ¼º€7àieÝs«¤@]—2m…Á•a¬€;]3B+YðfŒ˜SJZåYÊ÷yžJHy@¶QnªdÇW½F°GãrM‡Ó¯PÚ-/?Ò 1hÕs¶’h'¸F[_“U“¿ Qc8ˆU‘â({2ËéC^Õ„òÓ꣩ZU‹#ö¤öIè‘ëB€Ÿr]‹Û‰÷Ú†– -mb3û'¦te*0ú}&_ótg )´Ö Œ ~cÝaÐ\¡#´=W6”L0Y åf++´¬r™ä ßÓˆwv."T)¸!Úªâëk:>ZŠÕ)¨“b`Ÿà;=ás b ¤ŽŠe„Øç9’K¼c e°Ûx °=9£Ä*¾¡XÁmúõòƒ¹èšèA 9¬Pw[ÆJjþ^‘f{%àª#OãeF†’To‚€ž¶æqïqÚúNªtŸ'+ c¼dÍ–-'AöUÉÚLð. R€“á¥Ц°à ŸÁ5“Zë#Ue‘£Ä'2«+Û‹ÂqåÆ¡Tú¨òУÊeòEMåg׋lÇó!OÛn4À8þ¶]im;”)~¤líêé”n° ªñókkÅ{1;Ô”©MÆZЮ²c­f½“FìœóìSBv:—ˆ(òS¹ü¤¯ÉnŸŠC9¥£)fÆL îy¦b×vÜpæ{¾íÇÂÓ&/—¨¥üqÂÿÄ îÒç^”h€‹äzZ<,_²ÞQêÀ†rÀa/ÖØs ˜vn´’e.D¨òBÈZê(¸VrzëpÆÎÓæ´ýÔÏ/÷=ñš6ú×6gˆJrlÃ[293Ng`Ù*£lDž›sšÁŸ7Ã-/]M¥V˜k]ÙœÞ@Ã÷üù ‹Æ £|eÛS‰çØ(YþzÊþ;ïÇG¯JÒÑ®Wº°B„ñ»)xéÓtFýdêj4­D à4SÊ£µ¨êš³ÂꚌÆÔ†×kb¤5±1­e5,†8.{Ñå}/ -§S$6²Eüòû€©Ó{@0‘±$‘ßzû¼©}¬÷—*3#Ïê¡ÎÆÂ-,²xbéÓ9BëІ:q*8¢e@Bpÿ·Îµíá€!]úl‡ÖUÜÄ}ÅPyƒš!5ýRöú%@ÂrŸë*œ©)OqFÑ'ò­´¨¹SŠ|.-’¦7I¹ £¾®JWÜiE*©×áÝ%ƒc>Zè–1&+/ZI_ák>²,&l¤%×øÛíÍ?xÔ+¹pZ¿Õ†O"¾³OܲŠ\¸÷lÝÃ9ù( |ߎ\ð(àÉ£À6þ uÿâ…¿©’­ù¥€"\Jvé^ ¨¤Á®Ðùá °î¹GãÆŒXUSúÊŽÀpÎ -Øáœ4@¥\;Ýq,¤¢7LÓªÀ†Ôœ0º¦2£ÂWxÞde!›åK=kÝH; hç9Ó’ÿÊ L iH7¶]MžrùkZ$CM|÷âõÒȵ,M%M„B¥€úcåGèLsŽ0ä1x %Td¸n’[@Ü°C „Š*/¦\Õ¾áx€'ü¡秖´Û#)Ø:bWTÀ’Þxuúƒ–ÎR{Á²·¤ª¬‘³Sób“L€åz ±84Ãå—,ÏE€Ül)£aPÚ({sŬ,Så‘u\ÿ¨þµ†¶°7Ô»99Í~W ß'L(kik/<®9Í@LY&8Æ·ÀL+>d`;®ÚÚWrJy@ íé{É“¾§´éè¼ïu8§}Op¤”Û²·¼g·ºæ|uÊ%ÜžžŽ»Ü uÜÀ« |uÑÎphpF,u -n+ðHnE/‚QØ~ù],Š$ðâ’y„±‰Œ û«c´ß)äK¸¥¢Q<Žy1æ-ëTž®Ík{¡rlå/|¢pÇõÂtQ!¤²6XhÝöÏmëôrÊ2" eÃY»h1NZcPIN^¢)‹k‹7C7)ÌwöR”Ç<¹„O7:ÔÁ8âjè"¡¶ãP÷ØêÌÀ¸EL¾K ¸»OX>zBG`xæí’1ž3E2n<.y™jØxË5Ç:ÌéÕwF¸M³Í–:¾¿žº•rŸß‘L(M†Çš»ÀEuOàLçg °Ñú-UàÊóº -\)%ù¿àIÝdx[9Ï.wm χ^2C*~[UJK9ó&DÛ§hžjò• £Š9㨠-¡Õ%ÂTJ±%o~àmaØÛæ;¶ ¾ÅÓþO‡è@·!:áÔ)Š0ˆ¹Ê4Y¡ßÑž åtféÈ AÆ¡þÝD_x^ =[<|´—¦œŸs{µfÂUã姯÷ sÁkŵK^/+þvÄ€=Ë¢HW ÏPÆèkßÞÈb½âãÀ‡vWSÀåo„àë>/«îÕ`¢4­"ĺxºmµüÚVsÁ‰8á+e+×ðBMQìóëk¬èô˜áìF‹endstream +xÚ¥ZYÛÈ~Ÿ_¡·PÀŠÃf7›ìy°]¯ÆfâQ,¼ûÀ‘8"”¨ÔŒÈO]ÍC¢¼NF}wUu_­üS‹, #íi¦Be‹Íþ&Zì`æý’Ñ„‘Mpêíúæö‡Ä.TºÈ-Ö´d½ý¼ûñÍÝúûOË•Ö:PY¸\¥i¼ûøæ~©‚ûïÞ|Ä)ÜA÷Ó‡Ÿ×Ë• +>üüž×ãšÜÝý ç–™ÖËßÖ?Ý|¿‘°2¡±iø÷ÍçߢÅÈüé& +µË/ÐŽBåÜbc&FK¿º¹¿ù{ +Ï™ïšátåW¬” ]œÌKc…Ü'®—G à +F’±<@qüÀŸU’DÁ]SBïÐ!ßÔÚë6 >ôr/¶<öFêŽü)³;5yWbçî––ãŸ&ß]«švF^q¨¯2 U˜©•Ì<èú©hàtº o€ ßæŸÃ2vÁi¿Œ³àa¹‚¿EƒYP?òï ¢=K$XØ€é#2ಮh¸«ùø ¬ƒC»¦®x5$‡ëR¸ZjyÝ)+ym/Õ´§é)Ç™ç²Æeø°å®*ò–¤B£çÄ7wÄtS<#6fRð÷©àÆ7åîý;šÑÁ#¾WƒÇÝþ Ç²TqÚXÚîBàë‘×Mdn\˜Z'ëk¡€ï‚£‘íç% ùù%¡½ð"’7‘Éo¤‚–þ"· $oZž~ñzëxð%÷é}sâ¯À·ø…Žä÷Gq­Tš€Ÿp©å¤(`Çï«ú!¯¸ý±`’q¿ ý%Q‡WáØnGêÃ/%­œe¶5’a’„F‰lÞÏOÅa”&² <ðIžvt9UÙv%jâ®e›J”\‡ƒBÄ=ȶÜÈŽ+´ÏQgM£»¡Ûïgȳ¡Ò~~¸úLæ^È-?Ý™5¯@ 8¥4 +S=kÓ¼ š¸¤ ‹î_ÇZt#ÑØ4¤9<÷ŸóûU”†VY>îêdtõ5g2ØÜ™u -ÿ~ûüu¹2 únÎX’0V™¬ß•ÂýÞ =xØ’Œe‹®ÙÆ "â‰|O#ž_tÝz2ðS-XP¦¢àÃ#o¬á•FWŠ•X ñCM¬¤hòCß±Ž¡!<‰<ÀGŒøËÂ$µÂ_W´èÊ~FIBЖu'<®¬ÊŽ‰ ÛôKÇ –]2yÄ¥÷Ød*e;èxùÈíW\RŸ¸Ó  ŲÊnÞ€:±±3>!fÁ×—š­ N&§V‰€mÿoÝFóõ.Ž¬BåG|°çÞˆYë}ð$Ùìq‡ÞæªòF©¹®üæÛ•» Týù+vR¨x†V¡=V)JI’ Ü~䌇±9+˜ûJZ@Õ*C—ñ£ß·?ö©ˆS#§· ˆö5ÜcbÙû2šhM䎬 k&zÖ»hj"ÔÇ9èæ[2*¡™T15óùŒa1¹ÃŽj:jj¼s*˜BºáØx+\͉‹L’vÆŽi¢À†˜Jßóq”%.êÙ&ÁÛ¢òÂÁ¥œÏØݶôØtsjù©1R˜8°åÝ€zx¬H²gbK.—ãÀ/­>ãÀrA y¿Qƒ2ù’÷ú„}ñ}ž™–"7ˆ“'QîØçÁBãû÷ gØüQä—Rë1[*ÙÅølì±W}.²ÿ½ˆ§kyÛ47Ãɘìð.õi÷ÄC”xj&ù,JÐVž}^ôÌ+ +R3±ZƒWS=Šüzêi2Ûç'ÊTÃUƒöB§8ää[Z6BRb’Vâ™7U)±¦´[KÞ3JØ/¶7EøÒËZOêR©õè³Z¾¨õàˆÎÅs~Î%À=„…”€öhÁùïÿæqMô¸>g+iÏäõ“ïÑÖ.ÞH`ñqE*DÓôùíý_/¥,Qõպ蒨‹r˜†¨j_Bxƒ°4ÄÈ äŒfÀæ™a1HR ¬ü…Ú9ÈSÕù–çiyÒѦWQ?Œ¢i9ÞôÙ¯½ðoŸ>NS<…Vsóš«°Ä‘‚$9þ¦‹VÉ• Þü2\Ãø ‘ø“´sa¡aäR ÅžÿM~”¨*òxdyÇ©ÇkÏjÓü¶uÓõ™’õ`}Ý·£òÕa‡ˆÅf/k®úÎ +‡ó¾JK‚VÊ ½‡ÆÁ!ëڜƩ êYs07“ËÖº* ø²¹­÷×¾´µGNåªÊ;3cM_#o¹‹Å2’š ‰ò 'tµO@ß©ñÖÿÐÔ/-Á­/‘…ÆeÃ'#‰û]ØÏ÷õÏÉùÉøC_\;ßDz£>(-ð[œ,Ãù#îå«%²ë=¨Ò&gw¾*PJð(Bâqœ9ˆLÙD¢P‹TÆ/§²1h|JÑçñî0Êñw•§v¶¦¬,àJÏÎ/E{ûs=çé#*²ñ*ÿ9ô¬8Æ™_±nNÅíyÕÎ \~›ñQ$ï­Ѫ@Љ–m'B Òü†Ò¤Ìðç\_"PC)ž¬“0ž&·|— ±®ÇT:ö_~†.õ~Ͼæ;lùÆ;mtŸµÿôBÁþ£šKéWfæ3¡ìý‡†#-új œ½H"íeù_øvEVendstream endobj -5242 0 obj << +5436 0 obj << /Type /Page -/Contents 5243 0 R -/Resources 5241 0 R +/Contents 5437 0 R +/Resources 5435 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5240 0 R +/Parent 5415 0 R +/Annots [ 5441 0 R ] >> endobj -5244 0 obj << -/D [5242 0 R /XYZ 85.039 781.388 null] +5441 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 461.841 151.348 473.53] +/Subtype /Link +/A << /S /GoTo /D (simpleprc) >> >> endobj -1202 0 obj << -/D [5242 0 R /XYZ 85.039 761.463 null] +5438 0 obj << +/D [5436 0 R /XYZ 85.039 781.388 null] >> endobj -5245 0 obj << -/D [5242 0 R /XYZ 85.039 740.47 null] +1174 0 obj << +/D [5436 0 R /XYZ 85.039 761.463 null] >> endobj -5246 0 obj << -/D [5242 0 R /XYZ 312.932 595.862 null] +5439 0 obj << +/D [5436 0 R /XYZ 85.039 741.134 null] >> endobj -5247 0 obj << -/D [5242 0 R /XYZ 85.039 337.294 null] +1178 0 obj << +/D [5436 0 R /XYZ 85.039 531.614 null] >> endobj -1206 0 obj << -/D [5242 0 R /XYZ 85.039 281.191 null] +5440 0 obj << +/D [5436 0 R /XYZ 85.039 489.267 null] >> endobj -5248 0 obj << -/D [5242 0 R /XYZ 85.039 245.781 null] +5442 0 obj << +/D [5436 0 R /XYZ 85.039 393.896 null] >> endobj -5241 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F77 4849 0 R >> +5443 0 obj << +/D [5436 0 R /XYZ 252.311 399.869 null] +>> endobj +5435 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F59 3455 0 R /F62 4159 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5251 0 obj << -/Length 3276 +5446 0 obj << +/Length 1699 /Filter /FlateDecode >> stream -xÚ¥ZûoãÆþÝ…à•žx|? -ˆsy9HkìàR\-Ñ{©”}úÇw¾™ÙeÑ.à`p³³³³óøfuþÌ£þ,‹]/Ìgiæ»a–Í–Û3o¶¦™ïÎ|¥X(ÉbDóÕÍÙëoãdæ{nîå³›»ŸØâpv³zï¼ùþâíÍ7?Ïa:~æÎiš9o~¼¸žûÎõ囋19o©ûóåÕÍ|á;—Wß =h~yûö'Ìͳй™¸ùáì›+–ÝDÈ!Óïgï?x³ÉÿÙç†y6{ ¶çú4½=#¡Ü8 -µ_Ÿ]ŸýÓ²’¹h&«¦TÅí’Í¡çfY4I“ænœÅô=7ö"«¦À›P“Ò@Më}Ùtè$uÚø&Îòyœ‡žSöOOî'tˆ$š6:ÆÐœHãÇ#iü$v?;gØÊ«~¾òÜYW÷ó ƒ ÜíÊb…Væ´Mý(­b¹ÄÅÄw”n ­6ÇìúMÑ•²ì®ít}]KzAºû9³#Î]O¦‘M\ðNË£­¶TYnéCÒÊÌÁ -œ-è–C/!Ýà¶s9,Iž³jÁå¡©!8ΈÁ¢AÃϪé£;"éªô8f‰:åÂS¢±®—±¶‘/‹ö¯ õ¤~áEÎͦ%˜)×ßq‚ª+·fvdfwS7]ï }¯³°"|¿Ïã\tm@Þ‘VåŽÔ•:º‡ï¬z8`êìeò£» I‡Y¶û½D”\ ¥ÌUºžÜ‚ãož­÷öXÐ.4NœË;á°ïEºô¡‚²Ñº5²…a&'-ºâX÷t»LŠ«dAÙ îõÐ)ôj©-Ø(‘>bV‡7³-%>][Pß2µiûá•¡*ÇôrôÈ~utÐ6‹JÌv_º'ínè³$IÝÌþ0 ³Ð Â`2˜á8ÔAü,^åiòc> #Õ"Ê7ÊrB(¬ø¾›CcBüÔMr’=ŽÜ$‘ÀÕÎÙ¡Á“£ -yœønÂÎ~Ÿù®åy($£6Ë8¼¾Üú³¯[tv$«°]øJ´ËÆÑ.NÜ™ðä'»tW«ßx« $“Œ1¶‡ÿŒÅPN…¦ûª@$÷Ùñ½i¯ÚmQ鸦‰û’SJÀ¼›•Ìññ08^lo{›BoKk§ -ªGÖÄR6ҽ盯V$øÊ°FO!êÍ|çëvkîrcè †¡kë¢c¨âØÄMÑòj”cÂÌ“0G³u»æX5²[½ã€ÌJ°Fˆq£, ô}Õ6t§þ«iѱC<É1±Y¿—~¥ß¦U‚¦<°Izx£ÐSç§;¡[’Ïô%âi’‹b±š{`Ÿb5|\w·w2S6÷UÇÉe1!¸&LH’GÎÃƺô“ÇÆWeú?{> óvE#± ¬X"±°ƒ¸ÀÛº”rJµ¯Àõ†Õ°a©ÇÈyºÇ -­GD+Þ¯k¤þ0!¹¬]•À;:,ýH®˜'ëÀÎœuý¾Ó–µB¬ß7#G׈6˜8‚{ƒ,·ˆ]aŒ¯ãÊNÖ­Z1Þ©{{@~æ.-èÙ÷U³üR 'ˆ%Êc×’Ùü ¤f›…T¬ØìßE¸iÎèЮŸ/VjäŒ ^ªÔ ô%åj\þ u(ÕüÉR´M d´ÓD©&4'â<)Õ¨MÃ#y`taX£C{Õ6ŸiÄ130Óˆš˜–(bb!ší°Šýˆh÷¨uj®‡Ð]qp»·ÞÉ0‡¢Óƒ9&h‚nyXÔÈ¢%6l×Fò)넽¸Ú°Ð.!”é§)‰¤ì2Heb´V'dËC±^[ø2¢ë…êØ:¥-»3h /uK*r(0x5¨ˆPh@Ò½hsšçmNipº‡Î$s.°Èâj†£Ã‘ù}ÙHÀXm9í¿êpƒ|€'’~榹ÿ¢¨†æDÖ#ƒ ‚È FÂRÌX–’¡mEí÷HÜ]eË®¿~4/Ö©Èa[¬J6n¦©I<Í?€ÖÄçêo£Ü¹ /ï«V ~Œ©Ñ œ×Œ.2clG>*„œ‘!5%×’©¦ú.;A‚Zl†iÊЄfÎ:©x©]Wýp.Í¢î[œ4t~¹ºüU×0–©&pÕ!㢬}¦±Ø_ùFÙêF¤ÖâZ…øR·]"GŠËÁfö†Ó°Ïp!ˆ½qÙ§áF LoJ.KÈ5åÕ&F6¬õ‰c%ƒ1O¦}úH£á Ð]Ì›@ôiî )wCÅhX&¹Ò‰ z'ë²)»¢–QhrËœ6·;Ãx¦0aËo;¤°S… l#‡´B¸æSµòŠÁb§GhÆLÑÊWNVœ«!~pŒ¬-(:>kbΘøGÁÈ•· «¶3µ“›º¹ÅèÈsI`Ê„û±PzüSlÙ0`ýLêmÕtlñ6Ôc¶Ö¨æ§£ - -½Ó—•^&VÑ÷ðmÖü¶—;o¬~95|4ëJi°µÍzz$[Ý -¿Ñ–Õ–-ÙQàLavq/¡°cÐz¼Ä@` ª¥;}P/#æ‡&/¦šfg ìä™Tª<5±éF/<ŒåEŒ÷5 -£ŽùòÑ÷¤Nò6')b§&ÝîE.Ä<l¶Íd…g^?¦Ž†ñ˜¤k÷µÀftá¤eÑ#VoG¯š¤ñR©¹BO#µq°¨Zº;©—x;®Þ±ÃÊ^"­&Q Ý -²å‹ :vŽ˜"(õr°Ðn²ÕË8=ð®`´ÁÅK'mkR?㈻‘ÇÙ:ó}ú®©ÏÁRË—B—kß}æG º?ú¾øãËÄÂû§4aŒDÝšRxâÒ¾1²Åòëý-#Δ‰dˆ4Ò)½xx¿¸BÁ”ãT íðC™{údÌ’0¢9…†O4qÉX1qøFVüBB½;‹+Å!èóîé[áÁ ß1î\ŠeLo|ðÿ¾~wºÈ™X"»y —<À™¡†J|'ì&s¬ÁLµ°†Úüμ¯Ùîvu9aÀ˺*íaȱŠNteßÃqÖà²Q©0Ù"«ÙG\ŽžH4o}?.à´ µJºµ…CÕÉsÿðÓU|¶4¶¥tô°N~:‰ Íew_-U à‡ÊEŒŒñóSÍÞŠÈPWUwPFÛ=Ê(ÝJšFåh뇀Š€ £;ÁR¶–:@9Oúæ°lÙvuï$"7.™}+_Q«…IØÈ‘=#DeÑžlOrö‘Ä¡@¥r’ÄÌL±q¸,øòÍ3l‰7P×ËØ!÷Pg{¨åYC·ÔiÁÔüÖ=~8²+¢ãbÅfXÃ\ÛŠ=¨%hN¤IÓ ~ò âéíWC_š_ØîÈêc?·[E­ÛKºzbl©Q8Ÿ‹WôÃçÒ·É ‹ËO…µn~ˆË‚#æ8G/ÍÚ~>b%ÒµØèA¦`ׇg ÌäcžDAüs¶0/Š"Å”2^:,rk/t¹•µ·£ø!ô‡ðA‹8úÙ7†0zúÆ€wÃvT]GSq$9H]/7¿ÃP±A¹/ÁQª¿–‡LA€B>G±†äQ&†n0ðœÖ£‘]PûýÀÈ¢({ò*2F ˜²~œ±ÓÈóÎ'K÷K‡ª×e¤£ÓwÞýAQ¬¤×߆ãIÄQè&aÂÔ$:gäÅâo ©xbªÄÓàÈþ»X¼ ƒ_³E)…Ü¿àõ=–Ÿuzi¯ºêž®FW‡ï9ÿ‚õ £H¦ø~Ê’ó {Ã&—W‘7_$ø½çí‘ǯóìüT)r‚‹ß~Óþì.êݦø÷ůoÏŸcn0ùRGræ?õŸM,¢«ÌÂg^ûâ pßÈ€.ŸÊ‡™gá©Àÿ¡“¢sendstream +xÚ¥Ûn›HôÝ_auU¤B†k¥}èV½ªêfïJUš‡±ÛT`(à¤Yåã÷\b’¶ZE +gfÎý6g,æü‰yºžLçq"\™$óU9óæ8y;Û®…xôÇbvò&ŒæÂsS//Ö„²È.¬Wï^ž.^ŸÙŽ”Ò‰k;qœX¯>¾<·…uþþÕËxX§°<{ÿia;Âzÿé-ã#Îߧ§â™Hka_.>Ì^/*8Duø6»¸ôæ¨ùaæ¹2Mæ×{®HÓy9 Bé†4ëbv>ûëÀ…Ï‚9SMXêôŽHÝÔ§½á õazð‡Ûv¡?ÀÒ{x" =ë[z–nrØúâ‰ÍßmÀú(²^U;ÜÚìq³Q]^íøà7¢C`Ë›ëwk•-ªœð˜ïÊMÂMÄ "œéCQÙN <«Õ$–ª(ðR°$ôª†aÕña¡U‹¸o—Wm¨‚jP½Éw¶ŸZ]¾Û8.T§3F'RÝáAËèhÿŽALUÚ~l-z»ÀX k…tÅ ŒÖ¦è¶öAëœTAéE¾Ê»â†%îÙ´ HÁÅ HÉÕN· Dú¾Õ5@R¤¦“ܪ$Ö +g¸ŸXÕ¾+Hs1âÒv@o]T¶Ÿp`!1™Z‹mÞ^G|RkÓ°,VÜ ®Ñç(…;q'eV{$iˆæàm(«5šyòFã-ÓÈõcßD½¨ÁäЭ‚Ô='·8=ÊÐ;m]U…ÁÍšüJ7=aÕt-Ëå•€šðD/Gí² ]|ázX¡„r1Á$…ºÍyŽu"b«#cÛ]¤š²·uO5Bÿ{_sAQµìÀº¡x\a¨²ÞIŠÏVP†x†ÿô.×´êLxïN"& ®ÍáÚ¨µÕì=$®Š‘÷Ôk‡‚Tg;#`g \ð—1´-méc +ÁÿlÂ)RBs¹nˆi¯mlò¢Ú™Ö³AɦÍP†€Yhò ºödRRÆiÆÞfT<­:†ÛmŸÜ¸¢2ÌëUž¡HHÖ£O£·ã8ÃÿÐ@sÝ°ïâÀ ã”]²3¶ªÁPùila!øiD®¦¶&QQDÑ÷<¢ì趆²/bªjdQ*”{ç{v`PæøÖ;B5ňù=>¤ÍžRpß1GÌâŒËH9Çþ•XKÅKÓîöH†Æ ¬ëXò¡îÄíð¸Aõßñ5 +ÖÞ»‚Ú¼ÅnDØîù¤ÙÌ8{ûÈðú;7ܾmj¾Â¡ŒÅ}AQàFi ààºy˜ñ‹‰ÊwÀ¡ˆà–®Œ®’ªê~ã®Òi(p¨n^9­ù^ñ÷–?zÓèšÁ'x9õ-µ±[jV·Ü¦n©AÝ~2¸Àké y6tc?y÷c¥2æÕ–K '¬ó Ãë¼ÐF‹uS½Nt·:iU¹T'@ä"þDÜN›j¥Û+Ÿùëßú¤øŶ*u{ùä× ÉVÝ hýØõR¦½ØÕR—tx°?Î¥ÞFnßþΟ 2Pª¨¿ï¨Ö!E+/õˆ‡ð&(»ªSÅà¶aðkµËŸ"-Áé‘|Ö£z MgÌ•2 ²S÷T¤ØpŽEfy«–…¡¡„jÇB?UTz·/.ÅK¯>CwŒ¯²ÌXô“™.t§Ç5Ÿ‚¸‘yqÿ«šìÇ­Z80\öž’<£²2ß=Œ{8$G[«•þav”êûÓJxž÷†wžŒí Ÿµh—möÓÉàЧ¨Gœþ{úìiýŒá§í£E7ÉîÛˆÍyßIP§œÐãë$£ZÑýxÞ…½TÝîKý“Y:Ê•a¹£Þ©PÀ¤Ö'å8ŒŽéÔùª1]wªqÚê­³Vxe;É•jN¨Cð]ðÓYfŠìÞµéÐ5žŒnÆÏô8ÛãÓ&äMÑ+)²Ìû '/zãÀ–™Tóõ ã_æàÎ&[Þ½{{áÐDϯPqâk43ÊËšOüÂ-h ôxp‰o:³}>x¨=3¼²~äZãî¾à—-S⼦·Š§ñª¡É”<íÁT,c×÷¥#Îì:&¢æhÔ4\j¡ú¿9‘×?¦e˜@‹¸a`I\ŽÑ>\A»V;ƒGŒ'CØß7¼XÓ˜+dÎ[™FJU˜÷*{y¿âÜCr•{’’¡ë x+„iâÊ4TG?Wˆ§–øñŸ+Œ?þß/'à\q7=ú³Hãû6‰ò6O‡ÿoš&endstream endobj -5250 0 obj << +5445 0 obj << /Type /Page -/Contents 5251 0 R -/Resources 5249 0 R +/Contents 5446 0 R +/Resources 5444 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5240 0 R +/Parent 5415 0 R +/Annots [ 5449 0 R ] >> endobj -5252 0 obj << -/D [5250 0 R /XYZ 85.039 781.388 null] +5449 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [129.861 645.497 196.551 657.186] +/Subtype /Link +/A << /S /GoTo /D (simpleprc) >> >> endobj -1210 0 obj << -/D [5250 0 R /XYZ 85.039 305.03 null] +5447 0 obj << +/D [5445 0 R /XYZ 85.039 781.388 null] >> endobj -5253 0 obj << -/D [5250 0 R /XYZ 85.039 269.621 null] +1182 0 obj << +/D [5445 0 R /XYZ 85.039 761.463 null] >> endobj -5249 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R >> -/XObject << /Im1 4096 0 R >> +5448 0 obj << +/D [5445 0 R /XYZ 85.039 741.134 null] +>> endobj +5444 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F62 4159 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5256 0 obj << -/Length 2748 -/Filter /FlateDecode ->> -stream -xÚ¥YësÛ6ÿî¿B—»™J3âÁGïC'MÚÔÖÑÅʤ7i>Ðmñ"‘IÙç›ûãoJ´Û¹L&,‹Ýß¾h"áO4I­:›$i$tšNV»39¹•7g‘£˜;’y@óýòìÅ6žDRd2›,¯|¬0VO–ëÓW?½\,x7›k­§Q*fó$I§¯~yy9‹¦—ç¯^þ‚Kfº€ÏwçËÙ<šž_¼az¤y¿X¼ÅµYª§ËÙ§åÏg?,{±úA„ eúröñ“œ¬AþŸÏ¤ÐY:¹‡±,ïÎ@(avß۳˳ô¬xÍLxט -¬N…Mõ©´ t%tM+…•†”ðßùüƒV¿ž/.gs«¬œþ•~§mÑÜ-×MyW4ù÷Ù‡²Z×÷nµƒ¿ïŒ”òê›G(wœ³X¼º$±_yÌ¢¾/šÅ«g(=NR¡ó'´¡&ì¨ÖQþÌ™$ò¡]øðÈ“ùôø4©*KzÛÄfE"³m“Ia"<¶B)6Í»â  k°+›b ¸xÞÍ®l[X(q¡†A…ƒöXŽ¡†©&UL¾À=³È ÊðO0¦ .N/Îwfòº†›L‚Ë8¶ó€/]&JC ©LĉÄF -§t›sS«$Vé´Y ¢5Ìäk¸ÉÚy©*îù{Ýàuï -¼çѶäVïÝìe„;$»‚AÎ$Ö-NvÏy¦® -7¸vÜfðÏ=±â…U]­KØבò‘AÕòÊnϬF ¾©·k -¼/¾=¶I¯©…‘ñ¨+{šy@D6ÑÀ•cUÚsÂó—Qrr¢„ÉôÓ':š“‡6µ±ÈL28q‰º-øÎùjE€ÜW¬7œÛ·d3ÒŠb›Á,(·*V¬E^`$óxãø¶ÌyiS·Ž/Á6Hu‡T^ ¦}ó¯yŠ¬ ¿rÄf¿K+KQ@ì7Æðf=m@ÄBwt3ôµvDÙÕÆ™°Z?m×€èq»z¢?²ë“'z»Ÿ8j×ðÄÞ®jáö`ST…2¡Aá‹Ð4X üFüÓx³ÂˆVöþ늌PðG•ï“K{Gg€Ž ª†ohì[ -=%´&„`¼ƒyb0ÐN E1÷o˶¢y -ù6c* ••ööÚkcîOa¢ ˆ;TUU¸»àé4èy×k¡íCÐvË3· ΖMѶŽ ƒ´h9 Ì@÷s§˜Ì¶8"@ñN}£Ý£ ’鲋̱»dƒºco¨ªÈ» _÷c¨i¤üÛ'‘“i(—Üv¶èÎm÷M™wü‘óc'5Gà|^eÓ&!§ó<Ѐ¦è|dw¡˜|ÓeNïYWÛ‡o W3Ê)4^ר¸ý–mzŸÉ¬Oý+ê,B"™Læ}}÷ÿ-A±¡EÊ…'û¼=-†µ"‰FoåaHTúÌêr()ønæ–W¬°”³&á+cû9š¦ø‚1Ó/°¸ˆÀ§LÐdë\âx¹r;óÊ—ŒgÈ+ï -yÙã”ÏrP¥š1òœ™ÞÔND÷›óô$¬æ#ÀXÞ±öTqBµ'þä õùÅo œ‰Y®m^…ð옘‹ŠæsÛå]YWÎ ”š¾½%™Ý -³çMᶬ ÌÕ!æ°ÊXØÎA<è\Ó>D´÷A@î9ÞRêT‰,~òýá@BMo„†4qˆ¸;ùŒEŒR‘€@bè > ®·¥ïç@ÓBËkÒ*κö§åy€B " ÄTï´ãê#W€¶_Fêé;hM:²"Î8môÓƲ­Þeb¶â¾¯q\rMPÜ>ðÆ•ÇŽË)ä‡0ßû¡‰Gr@-ÐHÊŠg¿ô§rú²rlNÍÄ$lË㦘»tF; ù/­@½†ˆÚ›}“wÜ -~7’+Þ¸ž3ÚUÊé÷þîXX"øè%·šâI¾š†‰ƒb0Ã=ð$™óÏ^ÙðUƒ°IË«ŠmXÔ*eKŸ[Ö^è#‰í ÄÓPc!_¤©ÛUd¤@’+ŸÐðBd,¶uÁ&c"2‘…«mÊ–gB/Îþ¬2p 3LÓï_À¶Ðß]âg–N¯ó†eç~[þ=-¬!q†b\æT»»í\©GÄ#ê!F¼G[\SùÐQ/ëŠ-éÐŽ)@Ú£³Þ„ý4±¿ÙðTçþ×Þ÷ŽvUß’P’óJwM²Î!ŽŽ³¡ÿ±SÑÅâé2hÆF2E3úJJ²Zf½)O¡ÉT¨Ø—\fk;Ýߎ¥¦˜Ç‹·Ÿæeåž{d”üðA°\œ‘$išè(P*ù#Ò½à-%ew7.`v[äA|‡ó(úR3uË÷%µÒÙÐU ø½.Û•wáö qÐwG Êûè…‹»Ê-d2Py¨œ —„&Zžñ#%¥­{Cê iãÀVu{]@œ¹ÄÉ ãä·$Ö1‘~24#/¥î=úR!c‘ ž:ÐÓœœ8,X#|¾Vƒ÷-5™-Mõ:Ãñ%Fü”L&9ÅÔ»]î]sMµMå¨)H—[~ó#ñc‚ -ÏϤH¬ hn©²æ¬¶-]¤£×¬‘Щ…’>àÞ—Ø'£P”fðø»™9!”õÞÍù¶¦—¼Z³Ùqß­6EÃOŒGrΕÑ"³Ù°Ì^¯EÈíå,š1AcˆñÖ êjÒ#ö**R‡ðgØšTèÔW©ô‚F¿Æ­õŽ›WAóýþâü·À] ƒêæÏÂÙd¦øéR- yÙžèýÔ=²OEvxbCÏËnEo›øóæý9#1:1"î•íº Ø[pðÀBávf±­éÊÑTŸ¦BÚìÃ"‚ E&y‰Üð‰IÙdxä‡ò?98Ö‚B«“EÙx¯J°À•äíA_K׋sí@qš ›pÏCàâ(=)áy•hê+dš¸Q —y×?šH¢.1x`ËŸ˜Á’âp}•c -ÃB×:f#]=×–>®¯ÁÍhÚ‚}ŠÞÖëkÏæ@YW\™Ð‡»f“‡-0í¨™€vz ›"ßîxØr°s+yXYX÷ø‰I¦Ûº”tUúg~ç¢EÙ¸ÿýÈš±Vé_BùÝü‰þJ -•¹üeK~Õ¡ÞÅ´Hõ#ÏbV)m^êѲøX^ÿ_­'ÿcª/eendstream +5452 0 obj << +/Length 1994 +/Filter /FlateDecode +>> +stream +xÚÍXYÛ6~÷¯PÒ‡Ê@ÅEê +ЇmzmQlÓ¬S hú {µ¶I»Îýñƒ”d[›¤iQ~0áüf曡¤ãÃO:I(|•:q"…JgS-|g 3ß-¤‘ð-ü(Ä©¯V‹³oÃÈ‘¾HýÔYÝÈêú7÷ù÷ç/Vß¼\zJ)W&béÅqâ>ÿñüj)Ý«‹çç?â”v_@÷åÅåjéI÷âò;–G™W/^ü„sËD¹«åï«߬&Gð´Ð‘Â3¼]üö»ï\Ã1XøB¥‰³‡¶/dš:ÕB‡J„Z™~¹¸Zü¨á–‘>Ô‚YœXÁíãÁ‘v¤iN-pÙ|=âšÏÁŠ8 K;o)|¦Šg'm:縈Î.*é|ÝÀ‰œñP*¸ ©Ñ1d2ã}ŽGêúÛl¤n[ŃÀ-jü—dù¬Zgžâþz鉛ï2¿ç•¼àŠ×¾T4Øæu_>𒛦£·ße=Ûx‡Ëž-Á‰{·$µÔ5Ëì±SXøv¨ïΨéw„&B(Ñ{RºÔk©´wÿDRßíöE¿á…žJR«§šÚtP”Û5K¸Ü¾ãîvš;^ƒÛPƒÏÕ÷E½5r©ïñÜYIê@rß=ƒ‹7M¸qßÛæàt¡ŠÉ—Ê<#~È|¹_1{ØCÇc›%*#±Î6(ñ†Uöö@»‚é@§¨×‰¦ ½ÍAih»~&r²M"S÷Woèox¸¸ÁEÀØÁÆH‚û¦?¢§/’ÜÜaô¹){/™0ƒ6EV›U&t[™ tòw|7’ÙôàVZûÈŠx$¶…½ÃÉâŒÿö8–µh^ '»Ah˜}}‚4´]Sƒ"Zž¤ð +´nÂGA¹"¯7hÒ ŒÁ1²Ø ƒÿ 4Ýó€a©*·ÖÁA"jZÆ€Šá4É$ +Ø‚a, ,/ B÷¶ÂD°N‘j <‡’”!¬¡Š½¸Á}c T˧³ öèô]ŸWØO)»ì˜ cã8£D$VuàbeñÆÚÈ‘ŽQ fHØZKºŸ—%´Ü‹¸+ºg|WuÓEä+Ú¬mšþ3ÆgÛæ·Üzz +ÚSîžåýæ¬Ã~ÖUké‚ü*- ‘äà UúÀd3 Þ—ü÷«ÂŸzŒ9Ñ +®À­Ž3$wì øøFŸõàOž0¬ö8A,| ó£‹H=ïþñ«ÑÄŸü—Oðy ;½ŒÊ§Áñq0ùåp²˜&E`a?p3òµî®¢šÆ8¨‚Õ— >6ˆaš<Lj67“õ-vƪ·“1“hO ¢Öú%{µ T¿‚‚Þ:ãîÈйÅý×eaž(Ù®2y€‰\Y­7CÇ#GE„Â\Çi·0ÿL(¨ŸF® ¬`ˆ÷ˆõ&)½1«˜zˆC^~0ÀY ›&[@j6s¶FngÆÛ<š¤m¥û*›^ð¶YÅÝzÔ_RI¹ê&ºshÉ­v…0š³¹¬©Ó+REݘÆÚBUÛ_|exçòßàŽðcb>§W(#çF¶nîó÷Çž!cOYÝ?™Wü ³‹®¨nËœ=ìüŸpÛé1J c!Àôü4¼šÅo³å•šÇêGçç!0”kø…hø•Å¦è­rN’½QÚÌT–û±ú[ÕC*’ØÖ_²îˆϱçDM„(óüÅ2`MõÉP$@Hó[Öp].R-üƒZŠÖšˆ%Ò$j´4ï=xtDÚ½j¾°5ĸ¨ƒ‚Ü’: +ôš»/6¦n0%Ãñ·(`S_Í= d$T¤ù˽à¥tú~’Œõ†BÃü9¥85Õ9û&¹Ì§%8Ý­ÍKsKûn=*!I˜Þ®yñƒÌ¬?™ÄtòÅP b5”ÿ+HÎK®Øí“-:zü{¯Š¢P§SJ¦â¡èmLâ›ßHŒt?ƒimíwXöRõÙØôb?îÀ[뀦ÿ/@_uùÌsûiüQ¯¹8‘VÎ@rW[€›”‰ S¦/,¹qáÃRÌÂ|öÂØ.¶;[uMSûP™.¡moúC;Û¶¤?þ¼0/…hŠ2 $.D)Õ¢6"¯²äç*ט¨²³u…«šÎl_Ñ]Š*+¾:quøá LJ¯TÏu‚IùþbÖ?û’¬ [Éï½N#ÓäøœS¶ü ©¦Óendstream endobj -5255 0 obj << +5451 0 obj << /Type /Page -/Contents 5256 0 R -/Resources 5254 0 R +/Contents 5452 0 R +/Resources 5450 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5240 0 R +/Parent 5415 0 R >> endobj -5257 0 obj << -/D [5255 0 R /XYZ 85.039 781.388 null] +5453 0 obj << +/D [5451 0 R /XYZ 85.039 781.388 null] >> endobj -1214 0 obj << -/D [5255 0 R /XYZ 85.039 382.96 null] +1186 0 obj << +/D [5451 0 R /XYZ 85.039 653.36 null] >> endobj -5258 0 obj << -/D [5255 0 R /XYZ 85.039 339.209 null] +5454 0 obj << +/D [5451 0 R /XYZ 85.039 621.143 null] >> endobj -5254 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R /F65 4136 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F62 4047 0 R >> -/XObject << /Im4 4550 0 R >> +5450 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R /F58 3380 0 R /F35 3036 0 R /F41 3054 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5261 0 obj << -/Length 3504 -/Filter /FlateDecode ->> -stream -xÚµZ[oÛ8~ϯÈ TjHê:û°È¶sÉ ›f§)fyP,9ÑÖ¶<’œ4ûë÷ÜHѶì`±(ñrH~çB«Ëþ©Ë< #S\f¹ -Mž_.ÖÑåô|w¡„b.$sæw_}›¤—* -‹¨¸¼[Žó$aœ˜Ë»êSðæû«Û»o~œÍ1ÊÃÙ<ËòàÍ»«3|¸~sõ»âàª?^ßÜÍæ*¸¾ùŽé‘æãíí{ì›å&¸›ýv÷ÃÅ7wŽ-· °P O¿_|ú-º¬€ÿ.¢Ðùå3”£PA÷ú˜ -“ØH}uñáâ_n*î‹/yÔ”,Å\a¡“óbJU§Æ‰IC¯ -‹$ñÅ”DaÅ$&LÂ6(I¢àC= ÍæÄfÁÛ®yª»ž+ËvfTÐq¥þÒôCã,ém×lGûÜ \*ñ“oVH\oný¥ýñú”TãÇšÖElÙrR#½=Ä:Œ´-ÛL]ÕO^.ßEMl÷5þ­˜£e×®…†?‹US3÷¯„ùo¾àžVm³Áª—s©0QhjYA >7+==–8ú ÿÔØ’›–¿(®] -é[œ¬˜¨"ùñpi*û¾yØÔd6åT0ŽMð—q,-°D¹îPƒ%–S#²+–CÖP˜xS®…áFI\µ¢e²’«7ß½#qD{r臎µXË#J<â6a2¸–ûΩ6jÐ*2ƒ‹I‘f±G…DØÐbß³ûQF¬Z¿Ù’j$¹¯C& •Šr\ÍàT+œ5Í­Ba% ~jþSv3X«šÐ¯" «_¯>×A‡Ù0(sR&¬ÜÜ}¥£(úêç[VctÃÍòE5j‰â5©(”íiâ9n¹m×37¼.6ÁÑöR*i¢ÏÐÚ£ÑY¼Þ÷-.öŒ¬ýç¥c ‡!+ÆQü»½ÇLJR§6¾8·—üyš% ʸ▊”Ú)06-[)ø+l;Þ„U~ì'%¾M»¿Šè -p[64ÅÝvÏX.;YºÝX‘} ØœÇÁ/hŠÚ÷®‘v×Z[C½Æq[¹2Ea7ŽÅ§¦~–FÙ–no‘C[»e]î†á iûØ»?zû4{ËtÏÍ;¹ú‚eÜõáù•<ÎÎZs¡òq£@Ü ¸ì°b©|Õðöÿ~k/ «UžŒ¼æx-ÕÊÝ?ÜWž0¢b0Úé»×¼0ÉøØ0Ý @ˆÕ<"þlÛå0ùú·;ì{li,ÿ­X9Q6÷t½h†%žƒD†_]ôEöì  }‘©Ú½ÝKƒŒpUNÚ#03ªÐÊ}d^ã¾ -@xQã9 ÞgäISgÅhGA-,J#A³h7LAYq+‹dE„‹aÊŠFE˜¥‰ceÎ «)º3a8±pT¡dŽw -×-;awgÙG÷"Þã_~¦XÌ„f£ƒ‹µ½[`ŦvŒvŸX>l:¾r1ƒqkÇóç÷]½«¹øìŒÛl…†RÖ^aå„M…²€ÌÕÍÆEÿôÝ»søMláU³ c‡Ìjà¦FP¿”oÝu´O(®i™¾/Ñj¢‘ø5J¢Ñð£Õ/V·.­¡©; -ôj†ØéÛŽœ˜|[?5 º^Æšqf ´Ø^œ˜°›œQÇA•ˆ”!vE>Ò‹3B,›yRD£Ãà ôe »Ã…2ƒdnZ’˜i~T< -ˆÔ1dÃÀFvàø&½u§\­êŠ€#û‚Çÿ2åöl=Ô¢»î4؈fû¨ÓáÌ Ÿ×‰³¿gåJÕô[_f9~qð¶åþÑBÐTb! -ÒT8ï¡uÊcwF&{e=Q˜CYC߆!÷ïNÕ¾wq½&/#n@í„E¾ž€ˆ¤R ¤¼%‹ýj@ɤ¬C^"ÃX‡&)dô/³ä<…½*ƒPǺ{AÜJ‚ëMÏ°R²U9ÞH$ɨ32Å„ŽÉýgº›vzý4³lRðÛÃ3gtG¬êD‰±§jè8ÚXŒ¢7«îdÍY³ñ¬±¼E>G¬8•ÁÊÀC,i{%± (­ŠÌAìB±g2z€\àý@ŽûÿH‘Ä)²ç/à¶À-øv.¹ÈHhQïV’ˆÒd®3S-! ¢¹ú t+™ÏC¥õGׇ®V"ð£ÿÈ°Wg×Ë•sæs?Ö³Ð*§EWÏJÊbl€ YX!œv5<Ž !<èÇ`G “ ô= -ôcåkf¤Bp†ÝD¸GÊìp=¥a·ãÜ‚–æhÅý» ÀRzoEÖÌ5‚øüxXQrtœÐ³ìØWÁšXW€˜¯ÝÎw[îñ’Ü€i ü6pû ʹêûVæ4,œŠSæÚ^øk·X5G#ŠYTV£\4ÆQ[Ó\᩹õá²ær½Þ/S>˜Š‹0Í-˜½ïNi†ÎÃÜœÏz4g4CˆþP3Î,8jÆÁŠÓšá­¸CÕ0Yd/Î1úš<Œ´èK§÷ŒžM¾…áÌãÞr™ÜÂû=:UÀ¾´I%ò‚¯¨ WJæÄypÏ\ŸôSüPs=°™šò7^"}Z•¿äbº; b«;q:aÆYY‚r¥T˜§ñ>\ypsuû“xt¡Í[…:è7Qå|ßoÈÚ -©1BÇ2L€q‘ dÓ ì ©Tn¡²î Ÿ…sçvôZÿS Ò})Ý¥Ç)zÎ=A©ì-#Ò`ƒz,~RvcDz\7«¦ìxZ1hŠ|¹cLÿ‰ü Ê“&Îé¤85Âuñßwk©³µÂÒðXRàYb`¹‰å×îÊ3_@|¡`çL‡>ÙLQ³ÕRXehÚla+0yt ž8öj)e• "N²€óúNq¨íŸågakýN¶Š‘AÇ’&Ñm,¶ÿv¹F–h¤¾M)kKŒ@Ž}¥Ð–üq ÃZVr€Š'S"¤‰P -|SºÀÁSã\ö -!Ó”4¢Aë‘&rAÁ8µÈÈ=%2C`E8“jÖà~Ź5ýzf ‚vS®jN§±pÆ0„rÄìOm¸4'‘ÒdLåò)aØÁëµp:ê$Tœz /kOäÐ.=kÉ~ÈÝ ôäE¨õ¾É šÈsã=ÿ“ÜžëÈêKÏ!ÐÕ¿ˆ{¾&û ž™ï±mÅËïšÌIÁ(T_ìþ’§¯¹äÅFÊeWÕˆêäqáËÈè3¨€°GÛ´Èpa×âcÎ%åq˜ Š¼ìËPÞ³c“…Y¾Ÿ&‡Å˜=$? -[1¦ðëMê  û^-v/Ú \èÁ=œ¤©`,–ðDè[­ù­ˆ­–œ¯? ^)Šy€Z F;ÔðüJÓîlìjÇ `_(*.Þ#É —­¨°|àëA1‰·@— ›qºbd„}_g€n?4Ï!ðXõ-—¼4߯¤4H÷zÌb6Ëž Ôš3'‰LË6‡Ú î&õ<Ì¢s&0(WØöæÔÊM5yU½,mN)E¯$¹cŸ|äi¯çÆ]ou%6^z +žÆÍ3À¡o)<êxb—îG½E½¼ÚûEs¡ÔÇ,ð…`<ç8Ë^¦Íìzçãë©ì~µ·ÞžϨJ&mIÖ’,Š½cP¯Ø@†'> +stream +xÚÕXÝÛ6 Ï_‘v(æ³Ï²ü•}¸uýDw»õRŵŠ­\¼ú«¶si†ûãGŠ’ã$¾vÞ†΢HQäE…M]øcÓ8p\>ŸF1sxO“bâNo€ób´„;õ7 õËbrö<§Ìuæî|ºX)‘Ezm=}y~¹xövfsÎ-;3;Šbëé›ó«³®^==ƒ,ߺòí«‹ÅÌfÖ«‹$2ï./GÞ,æÖböiñzòl10Áö?äh×Éõ'wš‚™¯'®Ãçñt c×aóù´˜øwŸk:Ÿ\MþèµÏŸÒªOm#aû°ç½Ë<q¹©ªî‡™x•ˆŽg²KÎZQ,ÅY[,¤*Wv‘•Y!rô LpbOm†ûÌ•šëºÉÊN6í'”8{Ά{Ùfï:¡«‹uÖÎl?â–ü*Š:—D´ëj“‚iOμØÚÕ­ƒF"±CFµ!"%üŠ²oé{ÒA¨Ù;úÈ›FÖ4|ˆ—ê"îòúË][WU~—6Ù­lîêªéÚ»k,þ•—܇ ÈeS%²mÕU¦¶¥¢uïÛ“‡#(½?{mÜc´2ZSs›%’ˆßÞ]-h´Ô3JZ,sù`DóE¥…¤€eåˆV³£FŽ>›½3g]QSçå:ˆ|hÀÊtoÉZ«ë²BžÐ‡¹£å¦3ÑPûÓðÏjÙ¬[šW"³\/ùåõt‘M„w)ŽlTMg/sº<ÍZDY£‡ÙÑî +XŸ\¦²„‹“GcT…º§hÙé&"MµGÿpA*sÙÉ·šÚ-qa»‰Øf‰&ýˆV­Gl:&4. ÂONá8ØF¤…IÆ1+{æ 9ÚZ$ò»ÙQˆ¯ßO+æºî}I²óhh‡¢ýÑ’Ë6½ÇíÑà¨O^kDló½|¤1|4ûþÈ*û2PrÕ&ÃCp*ªîµöÝi¨ѱO‹Ãá«ÌTï­³í¾W\9,̯®¼PUåÇ×qf®õv#S}±P“‚/šPcÕã—Ôl¨GžÌ!÷=tYèðÂý×g#\¸Ë¢cµãCj¸cJ‘5ÔÉÆÍïñY'É[ìð`àé|S®Ô¦E€î1[é×"Ešžyñð ǘGs­þ›éÐsâþAØêWµ¦ ^´dÕA‡±YêgêÌ/â:câÿÄÔ±šˆœ´y8¹UmWÿÁÐPX¨µ¯ršL³¾õMºªÙöBº“»=?r84C£¿9é£öß~ðáxÞúcûMÔ`õ±ÃÿA;Ëendstream endobj -5260 0 obj << +5456 0 obj << /Type /Page -/Contents 5261 0 R -/Resources 5259 0 R +/Contents 5457 0 R +/Resources 5455 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5240 0 R ->> endobj -5262 0 obj << -/D [5260 0 R /XYZ 85.039 781.388 null] ->> endobj -1218 0 obj << -/D [5260 0 R /XYZ 85.039 761.463 null] ->> endobj -5263 0 obj << -/D [5260 0 R /XYZ 85.039 741.134 null] ->> endobj -1222 0 obj << -/D [5260 0 R /XYZ 85.039 232.324 null] ->> endobj -5264 0 obj << -/D [5260 0 R /XYZ 85.039 197.578 null] ->> endobj -5265 0 obj << -/D [5260 0 R /XYZ 85.039 154.145 null] ->> endobj -5266 0 obj << -/D [5260 0 R /XYZ 85.039 127.046 null] +/Parent 5459 0 R >> endobj -5267 0 obj << -/D [5260 0 R /XYZ 85.039 85.793 null] +5458 0 obj << +/D [5456 0 R /XYZ 85.039 781.388 null] >> endobj -5259 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F62 4047 0 R >> +5455 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F59 3455 0 R /F62 4159 0 R /F41 3054 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5270 0 obj << -/Length 3551 -/Filter /FlateDecode ->> -stream -xÚ­koÛFò»…ÐÃ!Rm¸\>s¸R»i\ä\_¬Ô=¤AÁˆ´D˜"U’Šãûõ7¯åâ}m¯ îcvfvgv^+=s௞E¾rL< #­LÍÖ»g¶™ïN´@,d9€ùfuòâµÌ´£b'ž­nz<¾ò|3[¥æ§o^]®¾}·Xcæ:R‹eFóÓ·¯®z~u~úê-NyóKè¾;¿X-–z~~ñÃ#ÌûËËpn™ùjñqõýÉ·«Ž­Ž °#O¿ž|øèÌRàÿûG™8šÝAÛQ¦w'À”ò=#ýâäêä_*žóf¼jê,ÄÒ8*Š¼§Éw”ïxÝ1ipLq¤LhfÉS·¦@E~4`:¢faž&§µ«ŒvGôêœiYÂy¹AÒ/^î`ç¨À„@…€÷ =_£lÖEŽŸ¬\wÞòÊ5_+/veeÂrlh ­¯fÊÃm¾ËXúwy»•±-Ìgá.BP[º‘§\Í’u¢ ¯‘7ïØ+ -foD«`ùŒÔSH‰i@ÛB#É‹Lv¸ÍË…ÏÛ†ÁnªšÇ³d8dÏÕÍh¼MKÝ=Œ -@È°0´¨Ò.ûÒò丮“:Ù çÉ~˨ô\=v—_ý´v÷0¤n®sl‚0RŽ¸÷¡®Ò`|/žŸ§YÙæ7÷¨}K°Ÿ¥l:gØ©óÏWÎ_簸ȚGXB_ÅÆ}’åÌñ ±x<Ã#Àò -íMä£hþ³£=«¶Ð­-7Ô'ì/Pð4ÔÒ¢˜4v°€yÚ… ÁMÀÞž/–ž£ç÷ ^NÓÛ{¼‚q´Ø¾CEFª=Š=¯Êæ%£ï¬«CÑs‰šgÑÍq“´ùœžžÑ½pÀ Éã¹Ûæk"¥ ì-ÊH/ÃîO€•èÎ0;mVƒ€!%ÓÞö=C1?€ékEàt'|94©dÉãÌOqðì9wp‹7ÒlåÛ ùe.„+³TxYms{ÁÂù.Á¦PêU;qlI2£ÛÝ[lïi¢¢oòO…½‰(qÁP¹žXÕïÕ÷L -Ï“»|³%+³¬twvˆ;oí6xÑü=òŒ†ÏÛ Û‚Ž”Z8ó‡gqÏxXü%Ê£ª¦‹ü%lêz‚eÅJy|$M›Ô-> ¤+þ¬¹Éd|›å57Qɼ´€dA‹"iAÍqÎý©ØxÑfÈiµÍÈJjw¸8ÁmÊb©vÉ|²Á½]øÁ<Ù°eÊI-¬U7m&Ü4ÕnÀ3aæØvuçuML­{¸“CÜ37tª;Hj¾Eyª.Êk—´$™˜Ø-ôHцnBç D5°trt盬åF-ù¶à¹Ñ’”'ÃC-Žÿ"º@%HÒ -àx¿âQ×ÌŠ¸“¥çyx•ö9ÌÚ­µ?ä»Ä=e_Ú:ã.îy¹Êa‡ÅdÇZ^DšyçcÙ¥‚ó{Mòô±Þ–ÁPw™„‰ÞdÂÚ2Ë$€Mº¡rb±þ[T¼&¸§C^eœ‘ëÑ›l’–¸eºëõTe*«÷¢–`¼mÆj[0L' }d˜q7S7-ã¯JL¸;¥€0 [ÆVû_U!]0 _OÈ9!¶Mü¤#ñ<~aÁ!Ç3žçŒì—7ÒÁ†74èf¶[FýÀï¡É^šÜ´Vê5Ïõ1Ò=³G÷a{Õ%Ã({ß¹¨ÚÎcœ±M„Š•ìñÖQ+@?•ò•Úeóž!'nH㡃›©‡7£»jpøh3«2š0ßó(I¤ÈjNBé=[56ë;ÆÖ+2Üa'.aÖCV04Ã{qMu‹1Xô. c+MEç¸éLú­øˆ _jøn{Añ†aŒ7¹6Ø0ókãþ<828i¯;){”?@¯$õÁÖ¡±¶ 1|ˇíæëºjÀˆs·#MW ×yy±záÞ¾øér¸)ŸöÔß±fðOúè‘qˆökÒ†ï õ9ðÙèeí–§RQ¹Š'kÉ€6”výG< +å¢k§5 -`¨ ´øÈúÓ2‰[°“7CjkcÞÝü@B&‘{ÌÃ{ò‡8~C¦}g‘[††fèYÃYÖ(â«Çe]q¾˜Õmž5SY™¯¼HKVv–“Ï®6,q¼²$L¬ÜXV|‡¶ÑÃÂcä$Æ‚¶¢c<åcÞ¸žv›yÁ‚«n¹K7:xà¥È¥ ¾Cÿ"Â1±ÛGö¸ -•5•eå1Òa4Ì™ƒ$¡Ú*Ö££ü7%!ôŒ8X¶MØ"A{~o›Ö Y¨fÁäy©–;×tµÇÂóéÈÉoñZÀݧ„ôŸ†ÄÈzC¯Áñ2²Í¦$‚prMq**6¹2H;^Û‘"›R‘HŽMÜÑt‡î¨40"åFJ‡VägIËAªçÆÊÑfxÕ_çEg\( U¤ãž¨qôD=¶BrZ•¨¨Ã®±éêÔ¶€‹c -¢·ÕŽ7]¿·Ûƒª «’ŸuIA}§ ?@|÷r+pÖ³AË1X¨Š{°Ö‡2ªµÌÏ™MÖûÝO]|'Y¥@¦:Š|ìl$ëÂù¼€ü6a÷H¢4‰{¢‚R#¸I…¸QˆöÙ¥pè~M1VÊþJ²‹•Ø°7Œ:]åaÑ*ó½àüK(°{ÁÅ çÂZN[æ»D° cB/á±`âÅœrKç†{b_Š!ŽžÌÆ5#)ôP…¦È[f",Ê˃ù;ª¸b–%.|©hrÌe«8¶L2ÝÃ.ELuΩ›j»v jJ‡žZˆ+[Þ7XTÍŸ¨¦zÊéììD5•2Ö€¥Ò8cJ!„ áÁ†VìwÐ1o&ƒ› U æp¨çÅ ŠFÕÄ úç%ê±ákâÂùÓÝ) -¶ä´pšë¥]Uììùw`+œÎ®Þ¿û懇eH7 TР¢*rÃÿýa€N¾B,-®å?´D#ç(ôÓ!kÖ>´¸èGíÑ’ºëAm¾Ø‡®Ÿ}h?qìò”¿hårÖi^fѯ“F–£žã—³“FŠí Ã@‡ãd“5çºË_)½àØÆakô…в+ms٨ʤàù"A9¶Õþ9׈¾Y]‹­ÇÙsN—)"Jy(· #w9æÕÓA8â—ìŽ<(¯¨ø‹z€GºîäéÍŒp(Œ~‹n¸áô ÕÒâZ³}×Uqv{Ý@ó÷ÈD뺃`b¬f1(ª(Ïmš-?å-$û)Ó*¹=óô °¤ld -“T7Ózô–õ Žøð…g·W;Ø­×”œ@gP‹Æî9'v–Jæõ-©hó]cic¥<å5è«¥¬/'Î` -ŽttdyÙ‚ôÑʵøLÙUW^ü‡ÞÏzn÷Ì5Pu -Þþ†ˆu"ÌcÜÀãÍfÏRîmäŠ:“ûÑ`¢¡ ô‘3ü‚z -éÜØŸ¿àµf¸Ö‹T[…øÇd€§Lhqïm:É敘ê]~Ç;å7…Œ°ÛÜ۠ɵi+6xœ¥}»s•ñáÇF_dƒ—3;Ïå(7—AŽ$v{¬…xAdë–žTs¢È¨”€E(‹ˆ»Iûp Äù%«×Öuõn$Z1@ai6Iù¿¦´f¨²K͸ϲåUƒJúÔs­?û—¾-íÚ‘M×[¹1f¾\sý”Jvµ„q£ˆÖ¸]±΃ ¹­¬¶ÁäO6E6xÆqL½feÙ%ƒ7â‚ŸjK™2ì‹­%'~Ì9ª?Ûï°<< sç¾ÔëhvY݃Ž Ÿ2°Ÿßÿ6ºÍ>Y[¢yÙgm€¿€ÍdÙij(‰¿N›—b0ýqeÌ3ôK -º—UÕþe±ô]®èšJŽ-w—ïŸ%åmò×/ð癌­ùû³6ÑÕìc‡ÄŸIÈŽyÂ~õ&ËÓ¬ø”Õ8Ë7ù.iZ kíZß.¯0<úŠŒÐ¥÷1L]ïR†ü;þL&Þb>`TXaô‰ø !ü~‰‚Ò¸¬Ù73áWçåM%4^òijå¿.þ´¼ìK†ûàNâ¼+hÿȦ§ð¿ª×Û¼ÍÖí¡îpÿžòw I´Åqúõèúüâb…«{`mg\l7ûª*°qöîüÇoß] Õé±E oÎ.ίýKš©³·o?×ÏÏ’6¹É‹ìO"—¦»X¯‰Þ~Ÿ~|äwÆÁ¢ðį>àŸÈÿõ‹°î·#p…#?m»ÚòB?v‰££$ÀDÊÌ1Ãÿ²Š¢=endstream +5462 0 obj << +/Length 3330 +/Filter /FlateDecode +>> +stream +xÚ­ZKÛȾϯ69P€ÅeóÍö`{ï, ïÄ#à l8%1¡H-Iyföק^ÝlŠœq€sP?«««ª¿zpÔƒ?µH#× ²E’*7HÓÅæxå-ö0óöJÉ +oº^áÔ«õÕ‹â…òÜÌËë-Yo?;¯}y³~óa¹ +‚ÀQ©»\%Iê¼~÷òv©œÛë×/ßáTèÜ@÷Ãõûõr¥œë÷oy=®ùxsó;Î-ÓÀY/¿®»z³¶XX…nÈÃWŸ¿z‹-°ùÛ•çYº¸‡¶çª,[¯Â(p£0~uu{õwC…çÂïš¹éJ¯Xž›¦¡¹²Šf®ük³ôSç~é'Nñ ›^ª…K¼€k©ÐéÐ.;ìx¸.uréÔ0ÑôÐö2g—÷yÅÍÇ·ÜF™äG$~—óÈ}YÁ˜,Ý»üŒ]¡Ò7üûmÅN^ 9‰xÈ{CA¶7MûoÐSĤ•ŠØÏ;ú¡ÎV¨ÖÌlê´4‹|<¢ŽP1 +E–‘Dšz¹ò³Äéaþ€ÇN^o±1ЗÇöó³t¼…y`@ëd¸#v}g­‹;`qgYoªófi¹ÜËÁE½iÎm¾/¸ûH28,˲;ø!ebgCBi5Å4ÎÕdËÅ ,í멈"§;Á¯ÜnSîyT³¦CìvE>ñs‰è"çÔ›’Ž**Ù~Èû1!ê´ÅçÒ°MrS½ºâIÍï@WlŽz¬Qk…õG:µ×¼ø˜ã*áL/bQl#"!ì¤fN×Nñ´ÈsN´žÕ\ôEÛñð¾TÍÊA2$äZó,4¬—‚-$Š†;8÷@M—ˆžåZ„Î%¾)ìÝÓq0ˆv a•_<˜—.›}4`Ú#Â<•ÆfW}y”›SãMݹ(!€Òl„+¶Õ|ÊÛº¬÷?ñÂEžë2 +Ñ,HA©¢5IÁ#5G²fç:1Ø FTz +}ÂŽÁ¬ÀF¶s<ù®òÙÓ쬳=I%"ˆ¨" »ÌBçšm‹(~}x›NŽ£Ì +[O~³amqx1h{+?ˆ]pT¶Dïôë ŸjÓZ8„óÅ‹¼¡t=\ãâ÷Í ÃÎ!—mOgÙÁ¬ACìàBæ0Ñi£Ñó!=ÒËÃÄö®%3¡mÀ•B9^¢‘÷šY"ftZv0vÍ?m±ÏÛm±Õ,•,?$¬o”ÏàÔÊy8á#ƒßž¿ ›¼3äÕš[‘mØDÎ+’‰§-Ös¡z" Æ¡x¼o%çtül»ŸŽç|s¼fQ˜gW³Ç ýÊž±µkX +,éYc3×ÇŽÁfFÆ}r`B΢–¶èóÁj·<)W'aÀw~ÃhpN¸ñÈ׫EJƒûsþ1Ïg7 ?xBŠzÏkšÝ nŒb£xȧJsD(±ˆÜ,IÁôcWEŠ®ó¦:bi[ é˜ËtLïÝÍ}Xn8ø:¡äJւͱúØõÅQp$;€S[Ö}‰û"?r~æŸêÔÂÈMVÖUÒ˜öKì¢|1on!X¹?4ÕÐ# ¢7Xª|=å;´‚ñ247æ(°9ò i$÷󺉯ðëÈ’:žÖŽ +Œ± Lë8°1Ø; Ë´òê‚Þ\28xŽ:Å€ñìZ`Ñß¡ü‘ͳZ5H/-ûFŽ"=–Ehó5Þ‘ô&n¢—s‰¯hXõ@<c´«ü\‰ß‚™ áÀˆX€œ”èa!…&þöbÁ8æq5ÓœBe¾ËQþ4çÆ beR†C7c;€D'у$7=xFs]ˆVnŒÅqâ¼&p$…Á’=Ä¡}ÙÔ3Lùn’=ÁR¹J©ç³’ë M`ÛÃŒ÷ñX»_pãÃÛg(½™FàA¢ðÎþå10æ…|Ä%ßÖéOŸu/qYÀ«9HbEÇ¡¡$Ïi‹ÂñqÆŶ×t2É  ¤Å7{d4ATžnÖÀÈ + ÜÓ +Ô­Ú¢Ê{²/˜á¤ï °÷“-e?{ÔU`èdáÞ«Û_Vâ£Ñ« B…óì¢SÑLBðQ: „L®l‰[;„[‹£ÔùD>—¢4ÞÃ}ÇtKùÍùg+p8wÝwæ:¶ÞZ?ð‹©s ôÍÒ†(µ5à†žð—͹›ñ¦3ѽä"žó }Ê9Àë!ûH¸ÑaŽròè1t^á$F!s¥ôH«.‰âöCÑÊþ;+ýÊ Õ²çuœO†Îà}«JÁÜTVpáå55§cÂ, +u* C¯¤\š,Ï‹Á@÷¸Pü“8ß_ÿãÇw|󕵎{BäŠ-WÆ$âzOGßë,­88¨‚GO&#ç&¡?S £ú¯?ÞÜJaz÷Æ͈榗eÇŠõÑõ ÍΠ$z( ÓûØÒ×÷âù„U;Ä0O}rˆ0sIþHŒÌ"„I6tªô{HW<œÈÉ’HÊ^ǽpÓ:?šˆ ºG‰%WœhPÆÃfÔÊB‰(u¹)A"(Yð4΂ꢠ¯tý›æe`GÂia.%ÌÐj =Oï˜&hDù W?òê¼-¸!ªO äöe @PÑô?&0"ÂÝ›æ\Éù—GæïNc«7í)0HÉŠÛOK\¼\Z®gÈ™ H¢m˜E)[0XüI)ª‰¼§BMb7ö£ïË4ÌÀ&}Yg “ˆËÉmÁ~ß.Ýà<8,O›3eSâs˜Û‘!ñ£fëFïQ'“ç3e þÔ‡l?}*qŒ ‰G‰£r34 ËÄ’)Ì#Ïù}"-—·œ2¾YbDNá87ŒÝ‹ûn6q ü§’Ù@¹©ÿ|`²>–ĪŠ“°RWzÊn’¸_d\¨â_»v4M›]á< +s4AYŒy­“ƒÉoj»ôUÌ&ô‰¤ñSz Ý,IFz™aЋ’¼žK*Kÿóž²­»¼úªÕ±<ŸÏäýäi…„*ù¾F¦U5?p}CÌÍ|E>2± g=½ät‰$‰)Ãh!íÏíô×(ìØÑ ¸Ê+k¦ØHv°€ŽÐ[5œÎ‚ÎÊþÀ­ÏsW A_žæñó¡9ÝÜU ÊLííÅ ¡Ä ?Ÿ©Ò°?G)ÜXé`(×_2F´0•r³8åÕ©²a À)…à_gÈÙeÁ9Ž€u_3äº.95*øGøÁÎ +²FTÃÐMÓì¿0#cM~#_rMqÀn&ˆý‹ìB{)Šž`öþ€¹^Š!5v);‘»„ždHNÇ8ÌÒJ\6êc5Yí£Às®%wQpG?ö§Yeð’$V‘{îaÕ\¾¤7óg­øâ³ Ž@.¿ä\:9ÿ˜gÏÝ#$ŒfÈsâ#Ï<¡¿8ÒÞJÇ Øò‡H^%"á·R_À¤ÌS5Aæâ[eÇ·”õSµâ!1Ÿ©¼Rþ-.†ös] ³sý]‹ë@_†-d‘ô½›¦Çsþ*”ZŸ"”ñÛC†kÕ¿¥¸’ÏÅž]9ÄØåN´…ÿ¡ÍÂËž-÷y©õ¯Äø¦þCÄÀK䌒9ÉZØåqi '±lXIôCÿcàø‰¿&—ÂD‘ë4{dQ[ˆl@@Û3áèÜÝm$â”­~³¤d;ˆ3Kš0m—œ¬íðìÿ°$#ŸÜR¥o+ć¿“D!âša!’}œŒzÓRª7èDï!´žawÃ(ó켎m>RË'jÿ/Ê{"†‚ÿÛ‰«/ò¬§÷=oRµÅ±X þO±,´endstream endobj -5269 0 obj << +5461 0 obj << /Type /Page -/Contents 5270 0 R -/Resources 5268 0 R +/Contents 5462 0 R +/Resources 5460 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5240 0 R +/Parent 5459 0 R +/Annots [ 5465 0 R 5466 0 R ] >> endobj -5271 0 obj << -/D [5269 0 R /XYZ 85.039 781.388 null] +5465 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [98.086 487.284 165.183 498.973] +/Subtype /Link +/A << /S /GoTo /D (extbsdpr) >> >> endobj -5272 0 obj << -/D [5269 0 R /XYZ 85.039 761.463 null] +5466 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [249.606 433.087 316.077 444.777] +/Subtype /Link +/A << /S /GoTo /D (extbsdpr) >> >> endobj -1226 0 obj << -/D [5269 0 R /XYZ 85.039 703.031 null] +5463 0 obj << +/D [5461 0 R /XYZ 85.039 781.388 null] >> endobj -5273 0 obj << -/D [5269 0 R /XYZ 85.039 668.887 null] +1190 0 obj << +/D [5461 0 R /XYZ 85.039 557.664 null] >> endobj -5268 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F58 3360 0 R /F38 2997 0 R /F35 2976 0 R >> -/ProcSet [ /PDF /Text ] +5464 0 obj << +/D [5461 0 R /XYZ 85.039 514.71 null] >> endobj -5276 0 obj << -/Length 2645 -/Filter /FlateDecode ->> -stream -xÚÅkoÛ8ò{~…°2P3¢HYÒ~Yä’vãmâæ÷ÒC[,K¶…Ê’+ÉIóïw¤,×jQ ×}hH‡óâkÙj"äéÓÑ»î þÿ:r…ŠÂÁÀ®°¼>¦„¯•çG7GÿiIñšð®>ø*~¨u üŽ¢±Ð‘¾+|W³Êb‘-Yžþ>ùžï¼;ûý½Túv2θy¬›t­<„ëMY朿žü÷ùëBTÞÛpŒ¡\œO'7®|ów’ŠóË˨`q$Q‚ˆŽ¼HóÍÏ9ðâòº=Ð „ñçé&-’´hðÔúÿtl’¬#9—ßóg;™N~õ±/¯®²â©äMâæ)Žq¬ÿk„MO!ìªJŸâØû"yióÍûw•.÷BÕOö*§ÛÏ"Éó_&/ŸŠZžÎ^ìGåN½*‹¬)«"^·™ Ÿ¹E¼Í¸üqó¸ÙG=y!»ém$%äv0ÒJŒU@Ûÿ‡¹¹ÜBΖ‘³Ž‡^è<ÂÀs2wÙdóÓú3œóœf“qÃ4Èj$îq?m¨˜"á”OÛ FMÊ£˜?w¸miO„Ý[˜X½V@{ÄÊ å¹¡¼Ð*A+¬ Äß¾ë€Ípv{ïJ –ëQI=öÍæ÷®ïN˜•ÀEQ"?<ñ€pYÕD‘§æqM§ÝÁHù‘¡@égeHX­°~*8HB5å¾sš×%*7 º©bTú’Ps€Ñ8´€¶Ó饎 Š²ÂW¸•|Ÿ¨¥ï¼ÈNÚ#¹ž66ɈAà¬Ò*e¨‰—ÌF‚ã1Úððp¬àÂo~=Tì-ü ‡ƒPž4Û…°Õ(¥\¡ÐÒ<7ó-¼`:¡lë*>)Q“¿5ȈrVä×Ö9µÔ Y„Í2ýn³!Ÿ++³°(+ÈÕÍVÂ.Gó8ÏÓ„—!h—Wc¼säne½ÆͶÚÈ5¢ÒÄhÜ(šÄ‡¾3³ ±9^·£í¼Ámmm„\Ü ½; Wñ„©¬Ë^_±pXá”v[b.òO¢ðäê9¯oǸA|¼šèñÀ¨+g²` ëàH,~ ¼4<Ó”ŒUo»úíž Û(cIr…Å@]Óž’P¦¢ æ–VÚ#ú<:ì U0MA¢åç"4­Å š'k²ÒL0F‚² -ÚªP8àó$FdXqÔ^äÇ´ÊLNgçºîÉÛkžçYJ±©1^&Ã’W‘_S<…Ï-òY ·%jñ¡æéë3Á@ë[Ê÷©q;ãyr¥ó•CPâéUY7 1·x«ô3ð¤Ê(“£#Ñß‹w£f ¦ž5uá¼TmÉš<(‹Q(ÛX»oãéì·œ¨>îHÙµ•º 5èû0»Þÿ`rÓ>\D¬vw‰•û¯0 ƨ9ˆŠ*ƒF÷¾[{™o|äéxΉ³¦µìÎÜs\jVè€åv¹bÚæô¥6%”²AzJôŒ©CHo%Bt?¢?iƒ€r-Ww˜1áŒjU2D1é‰ÂÒS"6‚&uqxĪù›ƒ[P Õ.èÏ—{Ê7®v‘ò¸ +¿™ž1ÀEEl.œ´@e—k^½%£$lîšçžÆÀœ—•½šo$¿0:×6Á*P`)k0o„8}Ú=€|Ö“ŠÒÕ^ " -mX6\‡rî‘WÝc<¬ih¢Í0àµÇèù˜R N‚lVäÓ£¢I†8 T?ÆB$¶‰›•![ò7¦û½sIÜ7zÍHgvÞ‘63jÙñ“ý;W,–ð·Ç”IÝVcÏ_¡zoñ5èâþ?ë¡°)0›úéʱPcmP6ÁÍ í¡ç…"”á÷Óãü}HGiáiïûéôÑÀç4ýý$ÄWžÉ<|—Óáw¼“I|¼ò{ßÉІ¥÷u:´Ë: Yô}:í‹¢„NyícH-F„Wc1ˆ\¡%0x‹¸Ù˜–XqŒøBL‹í‚2B¢8ø4ÂÕQ¤¥ó;¡hâd²–ƒó¸t5dGºÄ)xG7FbøOBñÕ5¥O[µAT¨Ò¹é&pŒUDvO1šá$äÆ]ôÂNI¸S 08ÝôŒhoaâšÁ+§ÊšQ…Ó©‰%`RcÙ“ ®s¬ŽhÓßn*eŒ8 qËQÉíV¦iœð(/êõŽ)ø@j³&ÌÞ›jöS|Çm^‡ŠjÛÄ}dL:TÁpa hma{(ž-Énéd¸“/ [Mq9{Æã‡Nxo‹´j‹‹¬X21&9/ÓªHs†¯ÊV[ݪmÏĈgªL”+¡Ø5NX(®²Zô¦« mêHSøÅþÂ0NaÊ% ›TqLV@ä—­HÄ0®Y† †©ÌÈGq™jÐ…%“™Yþb‘†¼ßQKƒówæ%`ïÐSÔö:+°}v˜ ¡°0@.š.ëY™S·7o8 -X?Gàœ¢pÕ†SMß#¤/Æ¡}„´'æKÏ&¨SÚj¨Óö\[åBÉÛwiákü‡~în¯¾V"TQÿÍ÷=ˆuÒòB10Š¾ä×þ,~Àð? Lendstream -endobj -5275 0 obj << -/Type /Page -/Contents 5276 0 R -/Resources 5274 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5279 0 R +1194 0 obj << +/D [5461 0 R /XYZ 85.039 310.425 null] >> endobj -5277 0 obj << -/D [5275 0 R /XYZ 85.039 781.388 null] +5467 0 obj << +/D [5461 0 R /XYZ 85.039 275.679 null] >> endobj -1230 0 obj << -/D [5275 0 R /XYZ 85.039 137.201 null] +1198 0 obj << +/D [5461 0 R /XYZ 85.039 233.519 null] >> endobj -5278 0 obj << -/D [5275 0 R /XYZ 85.039 104.701 null] +5468 0 obj << +/D [5461 0 R /XYZ 85.039 198.769 null] >> endobj -5274 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R /F62 4047 0 R >> -/XObject << /Im1 4096 0 R >> +5460 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F59 3455 0 R /F58 3380 0 R /F35 3036 0 R /F20 3021 0 R /F62 4159 0 R /F81 5323 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5282 0 obj << -/Length 2688 +5473 0 obj << +/Length 2038 /Filter /FlateDecode >> stream -xÚ¥YûoÛ8þ=…o¯‡ÈAM‹¤ž[‡´IÛ,Ò4×8›Ò`¡XJ,T–¼’œ4{ÿü̓’e[ξZ´âc†?~3¤åÀ†¿r¸ÂÖáÀ¤ÐA0˜Î÷ìÁ=ô¼ß“FbdDF™7“½ñ;×H[„v8˜Ü­Æq…ãêÁ$¾¶Þ~8<ŸŽ´Ö– Äpäûõöôðb(­‹“·‡§ØåXçPý|r6Ž¤uröžåQæòüüö mM†7“ŸöŽ'­Yí„`Bˆ6ýºw}cb°ÿ§=[è0n\[¸¶C>XV ¬Ç­z+1åEDµŠkQc!°rh‹æè…Ät=ÎRh›•oÍXæq¨FZeÂ-Õ¢oÔaFª þ.Í8·Øù„¿óTÇbåJ¡.½Oê¸L†ZYIÉÒkësBáKe„a;íY“™YT–¦ÚRc)¿gRcB§õ¦yi>Í– '8ÙÚ`* ^–¸!M“¥9;NÂ*pÕÑ·ŠasÕ¢d´”ì„=x‹>ËÒšÖü#/Cw—aÀráü'â`8ò¨¶ÃÙ<’KÍâƒÅÂŒñ!n¸Ïâ,k;;8\~G§§ûìÝ«¢8NÌX°¾¤¼‹¦‰©.^ƒÃ¤H–³¹ñvUu§]¹.wäó¨úöª‚ÿ)aw-7³½/ÌB#þ,Š*­Ó3cÍMé×eR>q±LªE‘W¦ã®,æ\jl°EÀ _avwÉkŽŠy”毯Ž>>ýtþñølrà -Ÿ.^__¥y\5âï=I´é‡ò¬vÃçEmD¯(ÊÆ.õÑLË)³{| Hòy$ŽÅ æjŽ˜à^ÚJ $†ŒDÇJ¾§uƒç{ bÑL¡à…!i´kck3Ë}ÂI4)Þf€ÅÊšÈÈÓ‰K¸Ìøeì3¢è°˜Þ;L$h¼Fþêä̱¹-*M«¨Ò®»Êä(ì-–YÌ*Oè4<:XÉ“N‹«åTdQÆÕÛ燷%tÇa0þrŽÛÛŽ -hÆäÇÉœ·[oi@‚µVÚð‡’þPj•:AGƒ IàÆ^: ¼d$—Ú vÙâ¦bMƒKÕRPg4l&Ží1÷TKFŽèÁÓ§œæjsZ&À2O†ɧ}E’ërÓ(7)á’¬ÚÎy¥ç ,Íi,€˜ìmD×Òìùèz¤ÿ¶øß•ÊZ,ëâ´ãQn« (ê¢%j§¡òfY¶âÝØ‹…›˜4·0ëiÕ/"s¾|)³SžÒ÷ÖœÉLÕœÞ}sЮ餌Ÿ7ÆÔ8Wì¸_iO -é<{/\‰Ð•HÙÛW"­=á{lÜ}V(¡Ñ­Nh1÷‚5à—ŠŽß<e„J‚Øõ|ë]Úz -z!…-¸ýz1Ô %c³ÆÒ‹›]KÔŽ°ùüW2;ï}ÚVÂS|r/ -Â&\ê˜S¹ò8dŠÂ²t`ÝtÊï¹Æø jD ÜÖ*_âðŽÆ¤LÝ-bš³©Úâ°Ì`'@Ç zwÿý FŽ¥¡¬ÓŠa×òåÆ —g'_ŒÑx±Ýb1¶ÂNrÖgdMªÛ;s%9+Ä .2ïDfl¥Å$i±¬8%ñ9·!`“ù”Ó¸^7§ñ!ìVÆ´Y„ò-@0WJŽ±hóµ SÚ%EÐ[ÝJ}òÐ6ÍŨ‚ÙÇפÍ΀$¯®1…*˜ëÑ0í®(Š„KÙI'ø•6ie3î¢ÕD6¼è¦Q”5E›`º!ªjQº½äÁ¶Y7öX!С óò¡8#.š¸ÑçªYš‘E¥qR“;ÆU‡Ç1Yð°zšµ_²ZÇb¨m"æÝlm3!“™„2CÍy»/\¿7\?k§¤Â;xFi¸kÿYžéÈÏåt"—-¤í@è"0ÛßœOÚžÜàÙ ™­טMJ`i©Öf¤\IaüǬUa ßÈ$g“—ÜÉ·cl⤖[1›Áo'›áƒ¢‚kã¤yPêÝs<-=¯ÆæU…ƒ4¬nµí†"ð›(} |¤\×: óTÔø€ð”ÔícÁ¨QèâÑD·!?(ü€¨¸R!Zn‡®$–Ø΂Pø°lÃ?vÀD†RèðY”¬DvƒÄÈüFž™­…ÈÆt½éLÇ ÍµF…Û× zÕâÉ„D8 X¨…”?ów¡Û…ÔvÁ°Ñ=à€ JEYé½èpéY·ƒÌž\ìÁ«ü|Ø0¼ôDˆÉ -EÈÊWxI§k­ÍW'(ª€ßš ÕÆm`åEî§+~é&œWwÈÔ` xƒ"±»›šÒÜÓ²¨L¹«ÚÆéšsºá|Ã÷ÈÊZãC;±kšbø|jŒi¤Ìe½'@l‘¶ Ziéw_Ú±Ç|9 £°$ñÝ<ž7™èÑ6Âwi4n1â>q¶ÌsŽx{žÕ•'$d?ìYÝÕ”½³0ï§ ^µ±ffL¥ëDzOQÖƒã0©›çü摲ç!²q#Ô™,BOf|3ÇÃyöT7û`RYtÞz¤EªüU®«|·Íu•ïµïUXÆt÷žEèûîÆ] …hÅXèBëóï»|ÿÙpÒPºq'\–è¼EãKœäìûÒã¸ú~h”ºéLǤ{›ÂÖ­¼§m²i!z~1)îüòâü5.î ¦W—oSO¸—o^?ò¼›Í~Áµi,ÝÅôÃâçÉ‹EG/`A$Q‡Ï“÷¸³5žp&uìܘ3¡µ³™¡da ›y>™OÞv¡µÀ!©‘›z-‡çs¦|xœÒª9Nž'ÇÒ‚i-ÇNÒÄBÇS,Ta—áô×Z\„#ñÌe6hÈŒò” ¶÷¿?µŸç‚õx÷¤¯ì\§¸óF«tEnz†ôÕsšÏÊlŠ,~ìÖr^“ +Nþà"¸Þ—¨dåD%KƵèë4pˆ bÆ}DLˆàƒñˆÞï¯óbiòx”µ>úFÛ¥]™mAGP0ôC÷úYV«Ö¼0+Z·BiYõ„îÒª+Z™j]ÜÒ²Yõ…ir›ýeÊÕCûtõLÌŽx¶f“ö„ÎÒ:9;ðÜ#ÞjVðJWüÇmm‰ßÑ´,Šzd“º¨MÞ¹ ÿ,–}CÎǬ·ûLˉIÖòuvr Lr_5LIž¥í©«2»iïÓo‹VØWA$ü¾õÕ˜ó“b³9ìØìrž7WœµN¾Çšf™§qœ©×}Wݘò¬ÚE~V™ÍÒ ƒfY·U:Øÿx¿Îö×û´j.P|zŒ:ûež%`,Ó6Ú‹m~÷Û2«йë“ÍÝ é‹#\¼qðu8—,Ñ(˜7+#B›'jä*&áoz>&0E¤…,ú«q9ëÃFTWàþ2Kê´qÖy’¤ÕŽÃ®-¢ˆÅ:hs‹ŒÄ„ÏDàÿÎè˜,,ðÕ¿AÏOûr .ïIãÑ:ñoí‘è°.ªºg“çm)j$8³‹­Òm?ùë}¹,N]åŠA#èA¯èëð›;ìËÔ0qræË’`o<Êó…|$ln‡— (4à–Ôk [aχ[Š§õ¡^È‚SN3ÍôÈ9Äð˜xÆž.röÒç0‹~Ã7–Qd»(÷ïÓ›k@å8îwb÷i2Ú0^[¼… Ñä+e{DèL}å.qDĺÀ߈ê<V°f¥>“p÷ØÇÖĶÃÎ1£æ’( ²dšíª"ŠÙírä²+fÙtÁ¸7nY”ÄU¯â³ùs¢üÁCnòŠRÉSRCÌsÑK¬”ô„ ÊP‚›ÈÞ› +çáÐÿ2 Ð?¨@'×D²žÁAßÙH©ö(jíz×êtCûgÇ-ìZ Øç+Ò&ý²³'¥I f yäÎÊTm¸íWîuE+ïfskÜ!^‚ÉìÒ:õêÍ«fŒ¿Ïmf?¡»ßýÖÌÎ/ÛÑÛ7íÈØg‘^½Œ/PËõ]#»ÅGZhifÍæc¼Pà5t²¿’Yûœî&l +ÚóG.·ÊèÍ&Q.-ÓÆð +àÝõ¢ªiÛ)5GâKiÛ쑄ͽöþðˆ, J~Þ§û”†”ë¤ÆF‘w鄘LlÐÎ@Mˆ ¬ÇãÜðm)੬B,€Þ©f1´JQ< +éhKUöþ/VˆÃ64j¸û»„LÆž¢ôp£À‚iD¦.àN}âŸö>übBÚF¶¼8ŸAi-¬Gø×[uB–pv¹:ú¼ÍœNÉÖÌ- O ıŒ¦Å}ˆä ‹´£€÷)V‡3’¥} +# ¨ÆÚÍ‘5ÇBARn ñ¹£C UZÞd B±†ºÐfÄMšÓò`[„\ Ì³- q7«›özÉbˆ¶I¾·ßGpŒ’Pk黈%"Æ -î¤ùp14EÄ[p¦"›à磊öÀÛ ß³ö<ó ’ÒÌ +`V7’DýH6£‰i%wDD îµÉºóî嫵i9Û¢/%Ôw ,ÄŒ›Òd[Xj]&~ꕲU³rŠ>5x“0:)ð%îîá²$‘mA¿y±½&‰N`=v‹VÑú hDãCˆžÀàü——‹·„5dûa‹J4©"ËôIÚÙš+¡EŽ fü§¡‡€–ÑÇÅ'ᓇqDŸÑü'´œ#ßƆÍg ªq¿ù¼›Jî¦Mþ>¦•~BºÀ`IóóÒ—# (À¥m@a1)Sƒþñ±ÝHaÛS{IÄ ‹' G ‚ ˆ›iQ·Š!›Ã­iø`·ncq +„ Š)S;ÆæÊ=§²ÜkŸ/ðúˆz±xØ[ +?|l=ô^"Æl´#)f›Nö´¤ ¥ @Ê~̹¥íV‰½JÌvk·¿&Zb}8øx)ûe‰6±ÝÆÛÜ=·£µÖ¾”ÜpÔ©Yì‘kÓÁSL"> endobj -5283 0 obj << -/D [5281 0 R /XYZ 85.039 781.388 null] +5470 0 obj << +/Type /XObject +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/caution.pdf) +/PTEX.PageNumber 1 +/Matrix [1 0 0 1 0 0] +/BBox [0 0 31 31] +/Resources << +/ProcSet [ /PDF ] +>> +/Length 557 +/Filter [/FlateDecode] +>> +stream +xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù +ä +6\>RgÈbÏWÖ¹j[†› +WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream +endobj +5474 0 obj << +/D [5472 0 R /XYZ 85.039 781.388 null] >> endobj -1234 0 obj << -/D [5281 0 R /XYZ 85.039 361.14 null] +5469 0 obj << +/D [5472 0 R /XYZ 85.039 758.673 null] >> endobj -5284 0 obj << -/D [5281 0 R /XYZ 85.039 326.996 null] +5475 0 obj << +/D [5472 0 R /XYZ 255.947 764.647 null] >> endobj -5280 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R >> +5471 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F20 3021 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im13 5470 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5287 0 obj << -/Length 1932 -/Filter /FlateDecode ->> -stream -xÚÝXëoÛ6ÿî¿Âë:Df†=3äC–4mº$Ëf…"ɉPYr%9n±~w9?‡eGrn½ÊAÇÁŠ@#ÃGR—¶]ž=%õ—‹‹¬0r•p¿Mn5ÏYKË­uŸšŽŸz_¥»@ðP$ÏJͧ;HýX¥wCF=š}aIžÃªô€ú·‚išs9:ÝÓ¬! hÜ• Q’¤ mÉŠ&­ÆQœšéôRNxd‚yœˆ·qT7Kt麴PL¢úÓ!LýIÆ×Côº4ÖEÆDzΚìÁ(,¢‰}ž¥ÕWVi=-‹Ú,Œ«rB£… “DzÏ]þܢ؀×I9‰²âðæøúj8¸ÂîðøÞ\_žýa¦Ã´zH«Ã›a4¹5ÆK&™}Ø„&+îŒÉYž®…JÄQó œï”ü#ðpôˆs{ KI8&ϪxÄú­^\oïÆõ?ÜmU@Al«Yw‚êïÜxĺ“èšÛê@ÖoÖѵÞm´,˜wòZñ¶¾ ë¬ÃÝZE:ÞZ°îä0Ûê@ÖtÀi´­dÝÍ|ºµÀº‹ŽöüÛROÇþ]Åœ£[4•–s—gî– 9AÃþ©X¾â>G1OyZßÕ=\OS¼·Îçs¸YøÂú“~\ÁRÁÉÜ–¾Vˆ“ˆ~rX/Íz96›lX_aašðïÝw6ܽ}뢬 cÔ*{@¶´jåa&/ n¥Ö“(ÏÓjŬIT˜q«,r3ºü@j‰UmÀ÷.-Ò*‹áª¸¶Ã0mWÙÔFë5yÅF"½çÂj®‘ª‰†;ò™™ˆV"ü0œpë²l4ÿ0 Qº+Ž9¢«Ã«goºÐž%$¡ÒûmOJá‚$Yé¶<5vŒ+ŒÊdë…|±žÏõìV}+ɪ6 â¦Ä ’ò•ªòA Ê@ J³4Ó†Vi¬M,Q€Ù×Ù |§³Þen*Ñ‘¹AédD‰ |±5^ -¾—æä¯Î`7XÊ`¥$ \A’BÎ¥µ×lHvé3ÉÃ9QŒQeÓåý„xŃÚã‚Lìnvw>®Þo!ÕàSÄQú!|t’¯šÝ U¢{ÁpŸ†~[“”ô·c4A@nm]È@r´i_ °Xú‹S§RM»8òR³ÇQ“•ÆRy†i›“ÄH#‚¡ÂRÇmTÝÂ<Òj|Ò`·FÞÚ2l¹0G4üž\í5« Ú—¡Ž[I,¯õ˜¹>@환ÅdT}‚YšÂ‰š{C1u¡BnÍ3íP+t­ qÝ¢TV ö ¤a¼#tÆÈ%Ïö’3ÖÌw©™6:kõ0Êë’vè"tƒå®RZ&:ƒƽe`Þ鮺ûa°ñŠ^¢JGÝĸ4¦8g&ÀøêéNØ”´¡³VÞ]:|Ÿè[¥a˧Ašå ‘¾êþ8£IÑfVš¬*„è`¡°'ž7 1EïO¾Ë,ñè7 É×ße¤0. ˜˜Ï@»dôZ€Ñ:¾OãO`—çY֓盶ƒ“ªÍûìçH:Í0Ãuœ`ÙJè^KÛ´“íTú‰Eé4“ÖTOSÅ­8ÏZ(Š¦m› €ïWÅÅóP,x4+¥ÑÊ‘ - =ÏœÚCI&yÛ·p"u!±Úôa–M¼·ÑgŽÊnáRòJs*#€0;·FÔë€J¢  5p£K·øÂLæà¹Þ”€/\Ï5E^O° –Rc‰øHÚÔÒÏfgSšž¨ÍÀXa¿œµŽ­àa¶<`Ž\­¿•<µS0ÈË;d†ðEæeÛóS§¹.S„Ô¦Àò¤«J ˜U%–áݽa]*»†:‘®yS]øB@Å\ߧº©ázL·š–5pŠ`Þ^êéû^U–Í÷to„ì°ÓÂ| íï.~>à{Åþ´Ê “á:ù’×ô»‡ûøÿí-.ŸXá3ÈX±Ù›¯º>´¯Póö¥ nfÔ2ÊM<Ë/MÎò-æß~h¸Ì‡Æ³ìÚÿù¹IâE}öxVU]‚$xlÐíPc»ôù‹ìÁ™N —«Ÿ&ë÷Oè*"P¾k˜GMp[€óÖpVô‹è«!9DàêÀõ” ìÙtËg(Ø`×cÁ£ûí<šV-ÄF”:pü‡¯ -ÞÐÅgrãqdÂ?zÊïN¨Ú@…›WBÐDk º,ùÚ©Ó>ù¯üè²K7endstream +5478 0 obj << +/Length 3823 +/Filter /FlateDecode +>> +stream +xÚ¥ZëoÜ6ÿî¿Â8pZ KK$õÂá€æ‚´ç¢Íùjé!ÍyWöªÕ®6’ÖŽ‹ûão^äR¶œ´ xùæp8ß •œÆ𗜩ŠMyš‰2EqºÚžÄ§·ÐóÍI"#âS«â,Å®^œ}f§I¬Ê¸<½º¡!WëwÑ«½¼¸zýÃbiŒ‰’B-–y^D¯¾{y¹H¢ËóW/¿Ã.]@õ‡ó7W‹e¿ù†Çã˜/.þ}‹ÂDW‹÷Wßž¼¾ +HXZe3ƒ4|8y÷>>]™ßžÄÊ”Åé=”c•”åéöĦF¥ÖH½=¹<ù_…ûì)Ïš9éÒêLé +&VEaý‘“tæÈU_/–:³QÕឨõ]µ†¦›ÖÜtõ®çñ×Pî»….¢{šÕ@}w ,³˜rð¿;påà6Ç 44WöP®újKÛuÿšó|ºÀZ(Û!#ÏÛ9k¡q”A´ÓWáþUƒÔ?ð¬¡æ^Ús¬ñ¦ðzdmI|6ÀXÃytƒg6EÕÕjëm¸¶ï‘þRÃɳØD¯'C*<óØmq·jÄá+*"¯Û^}Õ×@š+HRk–°&•‰.Þ;n·­,Ðv¬)¬ºÝÏqb¡çö°œ9!W¹K“ÆQ·—*:Mø®¸ðš42®XZT"•£¬ÉE°ÞíáÀ—á=H_¦UY¸‘|«±év(>¥~ŽÓ˜”ë¹­²BÅn:Éé2ÕiäväÚ?øg×ÍìŸÄ…*b;!`<í-Ÿ2ä2ònir£4h±0eÝi[V :‰²ŠCü}V m’ò„C|sþ—¦’5³ú=V*î— °0P4cOM TKÛƒ}zªZFm]! w´ã-/ÖdÕEwNA<=hûÐPtlrbyJ&;þ½Ž$²PÙИ´ÍŠTîš¡¡¦š×©v(ƒFGBj +šÕàAªë¶aIÔc[»4Zå:?]–VÖÎÙÉTÙ%À{„bÆ<›îžå¨ZO¥Œ+÷ÍoU¿f ÓñDr•iYDÑd°ÌĨüï1ÉI¡•N¦èsÄÎÚòËú(Ã6fÛjcÍWÒoA\¸£ÞUŽ½¤Þ6ŽáFàB¤ßÛ}”ÕêÐŽÜŒjYß-øâÀÚóDhê»@;’ee£³L²Ì‚í¼7oºÔìÊÀ²CÛSÍsæ=NÜ1ïÍD»uªR¹+Ü^+°…73fÀ¦ªH +Çr´´pGçdx‡Uu`û $†æorã¹UYéLÊK”£utá¤+oAZ†N'˜³K±Š=åÍ +3AN 6¯±Oª>dH½Íå؉¢>K0kÝé/œíœá’Vi^ʸ›õnM'‚‹înø×]¾xYmQF®+.süÛÀMƒ³íìÔ`N+PÙ.†¢ÄUU$c»ã.Â3§Ò¶Tyj„Ü7lÚ‘é÷¨}þëekò¦nn7`‰ /¼–M'ü?w?Ы¼˜ð—ÀAYxÂrÈs°/KeýýîjT¬´{GdÞÏì2Y¤NªVlŽ·h'°™)k‚Aïxïuãp–WrS–QƒŒE›Ÿ¤í.s Â)Q.–fÔ÷l–›±•s‰§äJ#¿c7£ƒ xéìß¼NU^ÊËéÄlÀʪ,§¬ÞŠÝÑE(&9Sgì·°á¾!pM»Nš†˜ŒàWíU=> 3Ðij4šü‹Ðþ¿ ìÿ„®Ìa”z$).Öqb0á$qüÁ°uWz4¼=]0qIƒÓÈ`›‰Â£±(,!Á§g2‰ŠS=i<ªHÂQpð̉Ý_g–IɽrÿûÙóÃã½(‡…¸r* >Ø(À¶:ÑEJz=rñždv#ã¹mŽGØ„žH†!0î·öŒ7d:6bÿ‡ƒ l¤úlj=¸G@ †-AÌ‹, ›7…\HÞX£Ô½`€C6~ëAYw·n’ ¢ $Ó‰HËÉxY¤º­ÈëN7±mç¬îæHb‰Âµ‘‹õ]Ó‡¹Ž²xô°Úõµþ)ÎJJ£’´„‚…·æO#­±!,:",.þÒ]3F¾Ì•7ñ®Àub!ŸV0`fžVéïVäý}ðCåƒsÆ]….L7Ûfä"»ì˜é†ð>¹'ÂUÆN¸~æ*W¨À¥"ŽÎ–Á–6*¶é4”å›—+ÄiŒò¯“¬¸0’ŠƒE—äÈíZfòϪmj&¨‡kfÁqÈ/8ïšËãÆí ¢/qûàº)ÑzÚÄüúwzvaP§¬ýsbì®ãò¶ë' +«ã°¯p#“Œ +ŒÌSdу¨*tr¬·¦÷/Ü7³<þ¢i7.ó¸^$8˜™ÇV®º•á÷¶´<âA¥¯ÇC¿ •Võ˜„°*eHH¿Y`墻ÆyI5¹½dÅæØ0ˆzÁôÐi ï7ωêм¢aÞˆz!0áÞm]QÁØ(4=Þ,6¢Ó`7Ä”à1íg ƒ±©ó©¬kdíÜoÛÎX¨|U®ÉTë2ýÓŠ¬Ò +8§0UõÔ01PXL-ÓÂ<Ð8ÿÙžð§[hÞ\幬ñgÍ¡ÁºmÆq¡à@õ~S÷‚ GAz-{áîW®º4–eRÛ #—HDõÍ…â}RD?žkçÇKô€#¥eÝóšo“Qù¼ø; {ËCÓq[t +cïàÑEâs>ˆÎýQfmVRvé‹£îvÿojU­Ð8`qlæ¡m¦â<ú[ýlÌ­seãò 3^MÀj¢¤´¨°&J5ˆV¹ÁAXž´ðí}í‘b;ʢ趭KaCË‚ñA¶ê¶ü~Ko¡ Dø¦s‘‹$\[NäâhJÙ1ó1èUõH –Û`mº G‹r4 LCêE7txìÑ=ÎPȬ&åÀV&µ.l´.ýè#`Ìð³©9^nHñ Ácð§–ašÛ ù$f$ØàѾ*Q$À˜ˆ¬Ñºoî8òxüä¨!ÆüÁ³‰£<Ñ_ ÄôDäͱ2›/7¥-Óê¹w˜$W€Sd~xˆR6xA´°‰$e)e²i«€ÿ”ß’t­ý—˜`zsu¦ãøãÙO<æ˜äqè2/U‘M“óôVãÄ-‹%óþ| +o=(£2=+‹³ï_ß1°õ<ȸš ß™n*ÖUîçä „CÍ#y¿?ØDvÏ@ÏeŠ4x€èú9œ’C)‘Q_WíPÏ,¥ •ùÍœ§Õd&ˆnŠÃ8“öHµ²öøP2ÎZ*í“ñÞ¹ãé}ŒêSYN?—&á}ôÈ Äl +v¨%t7$9q$ÈÀg˜N¹Å̧dæåVC »!ó<ÖÊ_ÄØf9 ÞÇèÇlã¼R(ÙE(QF3.ÝŸÒÓ¬¹%  z9wK¯Â¸žžå‰!{’Ç\L»[BÀÛ6úzŽG|=Ùý.È­ë±jØÌÓ#Á¾%ŪðQ—ó¨ëIžmF´ BýO=†‡©…m%„}u[ÏåÔb•`8‘tlìüwKm4åÞBN,±³ø­€ôDiÔ[Ê‹\Í6ùÝžfRâÑ“è=w]ÖôÉÐÌWvüéÇ›î3‹²Éæ«ã{1OØ/æ³8Üg¿ÁAćã³;g=9¦ ,MÂiÌ"Út„€;iJþ*oÏ«M’\ôb> ©äƒ\â2Üà)*â(¸7V=ÚQÊûd‰„‘Ò‰Ÿÿ9¯çÌ/¶Wüó8È¥õäc@(zßÎþ›öø™8YÊ´{eÅ%ð¸ä¶eãfR騘ãìñ(!N/þK#æ>Í7z^3…o_öm¬Aˆäïà“J®cýïeòèø>ºfendstream endobj -5286 0 obj << +5477 0 obj << /Type /Page -/Contents 5287 0 R -/Resources 5285 0 R +/Contents 5478 0 R +/Resources 5476 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5279 0 R +/Parent 5459 0 R >> endobj -5288 0 obj << -/D [5286 0 R /XYZ 85.039 781.388 null] +5479 0 obj << +/D [5477 0 R /XYZ 85.039 781.388 null] >> endobj -1238 0 obj << -/D [5286 0 R /XYZ 85.039 282.399 null] +1202 0 obj << +/D [5477 0 R /XYZ 85.039 136.953 null] >> endobj -5289 0 obj << -/D [5286 0 R /XYZ 85.039 248.256 null] +5480 0 obj << +/D [5477 0 R /XYZ 85.039 102.203 null] >> endobj -5285 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F62 4047 0 R /F20 2961 0 R >> +5476 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F20 3021 0 R /F35 3036 0 R /F62 4159 0 R /F81 5323 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5292 0 obj << -/Length 2086 -/Filter /FlateDecode ->> -stream -xÚÅksÛ6ò»…&×›P‹Å“õMŽ“Æmâêbyr3I¦C‹´Í†&UŠòã~ýíbAŠ¢d×½(sÉØ‹}?@˜üç£}&£Ah¸/ÌoØà -v~>àcäPFœ£ÙÁOot0àÌX4˜]®éh_i9˜%Ÿ¼Wo'ÓÙëÑ”ÒãÆŽÂÐx¯ÞMΆÜ;;y5y‡[Ê›ÂòÃÉél8âÞÉéÏ„8çÓéo¸74Ò› ¿Ì~9x=kÅj‚ÊôçÁ§/l€ü¿0_Ffpsæsؾ9¡|­¤[çgÿjIÑžЩ]&ÐÒøÚÈmH½Ãšùš)kJjïx8R‚1€iæ­ŠáH í½H€É±ÆÜÐ -ÎHTäq3²tߟžœ1>YÝûIž®Âd8˜p-uð,Ff¬£§%ÉMÄçü×÷ï³Â?~>‹"Чa¥‚(øVVº«ÒïIJlZ•¸~J*ÅØžtZs:½és -#¦˜z¦›¤~–õ:J1¡[V& îöë(durzÒa%9âŒïŸO×>"€_í'º|Ò˾>J˜ýës/ºú`|Ë0ˆ¢ïÀ©JûÁ …Ôæ;Ãb‘ô• åþ9Ý[œ”fz¯åáü‘Tâ6Æìµ>XVoßMû:ñ( ÙÞ­÷{•^7uôÂ(þ¯Ü 9rÃ7X*…¡]äåüë’æå%Ëì?©#®”O‹EÛgâÛ8Ëã‹<µ¼F 3ú ú¨½¬ª*-jBO²*×eõ@ËÌQù̥Ÿ³Éû£ÉèÕùô W‹*+êpöQŠ›gmG†ÿz¬„áBÃþ6á¿è -“ãߎ^OÏ´‹c°Çú\\÷ùHGY‚ôcõ4Ÿ<^¦Õi­\ ,\ê(M]›]¯ˆÎdQ9‚:|ÌôXŠç¨s¾KÎ"˜oTGo²¡”lØPJfÄ~Œ6=~3¯ÒâTøÓéñVòëPm´µÝ˜ÅX¨1 ÿéøÓÞ½š¶É©¤ÈÀ²>-ëlÔUÀ¼ú.Úh8¥#X¤Øžp·“Œ’<Ð"ä*» -ã¥>3®šc[ó–«pöw,ãeEËpPA åêŒb½ ÜÏ`lK«¼õ`tb\ZØ ŽOÍr»…YV®–Û‘¼­ŒÜ«c$—ÇuVÀ…Ã,¬¤ñðã@ëH.Ñ 8VË<]ô¹W´Ñbéíöl„{Ö˜–ì‘íªuWâ2åp±jŽyoYgxÕ·`.fË:]8©b<~‡¿`¢©,&J¦ÚŽw²µµ˜µËÀßG#2+lIÓUc·”@ëÚ)‹âäØ1ѾYã}Ø·Ç1Šµ€ºãè”EþÐ9ŸNˆµ)`1/WH,¡URÒøcQZ…$žIhåvUZWYJŽp;×M\î2HU"RhhvªB[´F±éåÙWÇ ·[pÑæC]µ´n;È%‚ë†Û$ÂÚÄZâZ·žìŠ×I>\ZilBS&``1žN$d¹°1—ÏñœÍŒ²ôÂÃ4Å­Ö-‰ _6Ë·÷úPyÙjZa>A€áM…V2z]ppqGFÊ‘~ñr´•¨³Î@ÁG.Íp{ŠÞ)/‘ÄËiG3+à#"xJ›å‚QŒô²åØv|è%7xæ"&xB™š.)€pM_]î°ˆ €ð¤àk­¥À0LÛd‚庶¾Î{á PÞ¤õu› €n¡‹uòγ8GG ¨AñMÚì5m:Í@ÈЇÛŠÂM Ín­l+•‚«T®fÞȵÝT"櫈;21^þ%¼Ì©·ÓX¸ñµ 0 -1ŒðàRÀúÝZ¦¤¥„«¤‘²[»ï®³9¢_Ó3‘m YÓXòç*]¥Ø1–¶ Û&ª·­±Ò¯ÎpÐêÙ6,BëGÜ*‹+ÿ‘w(¡µIöäZÇ> ¶ýx$$@èýŒ?ô«ð5LyVEáŠcèU ´·7Ÿcbdö–໬¾¦Yœ$Έ,ŒoXô´Èk+2ßñÞÅ£À Ý)ÎlËé½uˆîqÛtZ-ÝVÚ†ðN¢áFL†/Wµs í°±ìE=‡S&ǽçÚÃޛꡋ=G.µÃÞ æaïýï°'׎ - ½@ì¬ÏðC|¿éïm•‡€0ò‘"¯…ðod±Ó`¢/oó÷‘-ÿ ï÷>9endstream +5483 0 obj << +/Length 3624 +/Filter /FlateDecode +>> +stream +xÚÅZmã¶þ¾¿b›/±³VI‰ +P× /¤—knƒ6HîƒÖ–½ÂI–O’×1Ðßy#%yµirû¡8ÜJ")j8œy晡£ëþE×Ö¡Ê®SÊÚëu}^ï ç›«HF„×:ƒ]¿»ºùÚ$×Qdav}·¥!w›__~ûúíÝW?.WJ©Edƒå*MíâËï_¿[F‹w·_¾þ»ôâ-<þxûæn¹Š·o¾áñ8槷oÀ¾¥U‹»åû»ï®¾º‰°ÒNÊðñê—÷áõÄüî* Tf¯OpQ–]×WÚ¨Àh%ÏÕÕ»«úY¸O_ó[3+]¹+Öj¿äÈÌ,yÝ« , m±Ë[¹ï`e‡Ñ¢+p¡ë¾löÜ›KGÎ;êßÃtÓÂM^ñˆ5¼ÛÅ#þ)öe±_2çCÓöëc/ŸkøÚáûø鼕qyUq×ZÛ’fë‹V8• (u×%~¿¬áàvÔu„ZÈd‘û_ÃHïŽ8GN눰»ZÁþq/JhêðVÁ7»†s¾¬Q,\I¶èór_´Ü¼…W¹gõ=N³ßÉD=<<äòX1~µMSã‚ÕYž:¾nŠmN£ä¥Þ ‚jˆaŇ–¾ÀjpÚ&µÑzÂů¡ ¿^Z’=ÕDÝbÁ<7,¥êø¥—žþ¡À7o¾Vcƒ‰Â0ÐY,fÓÕ÷huË'–¥³ Ë´Œ«ó=OŠ«ÍÙP1Z® ,ë]ÃÍØ‘ švaß•/Š3Cè[±qn©±íØõütZ²n!ïHýnÁßl…(É*2°&›°† |ÈÉ|kÒªö•W&Ð<Ìê f»ôBxcg¯®‹}ÏJŒÃ±MY#Ãþ + H’Åk–ÿÓóa Û .!ÿ\ÊÄYÊr̉hF"ÎâÃ3†ÉbÓÌÌ­bj +)|=’a¸Ú¦è¸§=>&°‘¿õ|‡¶ŽhÓ <l)·<:çËÚ)¥Bå‘cDâþN>Å«‚O³ÀBXû;CËÖÒ¾B¿Kx4#ˆI¤äÉ‘ƒA0&ÍÉf%ñè-¹—öz +|å±,NóÞClô;‹òƒoä _«ïòe šXØ·!¿¯Dµ*4àéTµèŽÏ¸T¤£ Á“4HuòÉNu@—pb\lŽI­²©[Q÷EÇO=(„ýüÒŸè@j¦¿Ä‹ßÏlH¢›:Ôu– ¦¸fÄæ©³Ñ * ’È`>ÐÍùfœ&q.Œ°™’Ï)ˆAÎmÖìÖ†Ã$(ìôaC!(9’²‹Û-;£Ó@œ£‡îঅ¹Êí™í"VQfÑÄ.çó0ù©ìŠWè¢ Z ‡Ä$ +Á؉„Еí‚­ÄàZ5¹ŒÃ¨‹£ÈØzõþxpa?…m‘€¯¢ˆƒS›×ì­YpŠ + ºAN79"€ñg̓å{ë +È …§Î‹ô4ü6#à,¯dQm‰Á\…šWšEŽÝnëŽ÷uÙËý"\Có47"¹©È„áMÙ™‡(HÁ÷¸±e+‚w9ˤØ"¢Qo‰3º!)˜G@uÖ² H:û;ä0zÆølű3 ¹)À@lƱy‹ˆ‡T›E´ÈxW´åºpHk¢t8Ì8:ŠD›¥%€ +ÏBÛsb÷¹LÝðuƒ*PE;Š*eN›Ž@ ½„ðæ´&ßFŽØ"Œâƒhµ’i&Ãg1Šƒ,µÀ23óé€è÷`‚…°Öï“`áÍcN‘èÍŒâ$ôƒ›.¯II³K¸ PÃ=: Ýt]8–`zÒ…YÆÒ ŽÑbK4tƒªm±µÀ?ëžà{ºÃЊƒÈl)ÚŒ4o¹Ÿ|Ø9ÍO²r®ÕâhN¶HU²Ê‘?74 F`xÆ“¦ÂÞÜþ›»$Ýéù €°;s@Cqj¸ýËMJBbC Cö$ˆèÿ‡Òí)#ýY†ñÆ—ͱ‘Œ®9_æÍÇQº‡ß(åÍšYÓVçl3"ÞØf(@ÉØH#Hõ•y–ºíçTeMÄ°ÚG/1ëKÀ„^Ós.Aƒ×|R‰Í;Òæ¨nI…fs‘Ud\š¡–屬Š]!s“ñÓ˜gÐNÅf”àL-_¯›ãl*Eë±ò†¬ë‡ý~©+a_Ðää!PéÎK¦hQ5–quê³.ƒRˆ±à#Hâ]×qDl÷^Ždu92ÍÄ”ÞäËÀl[nØvºá$ØÚܨìæü" ¤Õ>÷EQŸL7äØ9zšÍú Ž³Œ‹áGÉZãÌã%Þ:0Âq?·‹a7½‰oø™Y2¿!5-hÍeŽ¢æ$5öÆ­”¹Ó,-àç»DŽ=O3±3|“ô÷uªRäpZ€ô]ÉGO0ýÉfXM]p©žÎÖ 2Š,iajÙ3Fíu¹{ðÀAÚ©":¬ÈüÎè2Ç›Ùy¸…O’ñ¦r]œƒ€’Üa†á¬‚“×î¦'@Ó)Ó¯J&o_ÌÄ Ð*æ“™Œ„ ðZ½å«Ð·=e{ØpSô뛺é7Oƒ5(#6TUÍ‚PGŸ^<8ÞWiÌœP·5öÏÄi«kíK9=bΗî¼oŒ#DLlÛò©×Åb¬ +2?O@.Ù NǦe.Ž<\§•J>ÉÔ†<¹;å\>`‚(UFqÈá()@Ó–>èi j)±*ƒß‡­M3I‹)ƒ Ý> kFlNÒàáA +a¨kûîÜÉ ù=âs×|#,ÝlÕáÆ“ Á?>/徨²ÙjŽ)ŠýË Ò»[¾Þ: hà^”®Ôagpj²= ¥„c s,np‡Œ-­¢”ªˆ2Æ¥Œ£óJÎ%I#uláZ ÝMή¢Åß M7€Ewn(AÅÀòœ3¦ÉP¾…û*gLL¸-­¾–<Š «9Œ.˜)f£ò'žÀNê`Ø{*÷hèI¬&°Ï5òšÇ9YvõLs,í¹Kò'ʈrÂ{<¾"r\2iÎFV¢™šÑ14RÑjËù´¾Ú é™Yì y•lV¨d³Bùo˜+ƒË†Qà3‹Ÿé$ýȣׂï<9/×Á„zÐm¨.~ÀmÇ_ùغ¢¾C%Pr¼/dª‘¸ÏÑÝ, e&x c}îDˤ¶.)8F@D”8[|+5 TËãö©æ‹œÜ},ç FÁ1#÷”ʾ8â©$n¦žp¶7sRlðð±ßꔟçªJ¡õ¹ª2…6âDAMŒò ¬_WƬ?VÚ·z]Òa[;T,(àb+Ú®{ËÓDÕ°è0œÓV¿R#)ùSî;X)èwlhw¨%/î)ET1ûÝá/;FŸðtŽJÙ¶šjtôüi/*~¹“2û#ωö×.οÆ0Ä¿fR£«´;¹më²ï‹M0› ˜X_¯’$°‰žÿy¤Èý²ß&*¬hyü.žÄ¡z‚QI =Ũÿ1(Fendstream endobj -5291 0 obj << +5482 0 obj << /Type /Page -/Contents 5292 0 R -/Resources 5290 0 R +/Contents 5483 0 R +/Resources 5481 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5279 0 R ->> endobj -5293 0 obj << -/D [5291 0 R /XYZ 85.039 781.388 null] ->> endobj -1242 0 obj << -/D [5291 0 R /XYZ 85.039 255.301 null] +/Parent 5459 0 R >> endobj -5294 0 obj << -/D [5291 0 R /XYZ 85.039 221.763 null] +5484 0 obj << +/D [5482 0 R /XYZ 85.039 781.388 null] >> endobj -5290 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R >> +5481 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F20 3021 0 R /F62 4159 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5297 0 obj << -/Length 2212 +5487 0 obj << +/Length 2632 /Filter /FlateDecode >> stream -xÚÍioã¸õ{~…;Ý"2kHŠÔáA>x’É&ÛîØÆl‘Š¤ØÚØ’+Ë9ö×÷=>êp츃Ù)PùÈwó]ï0øã_ÙÌ :žÏmÇ÷;Ñâ€u¦pòó7=ƒÒká|¼?Sn‡3;`Ag|ßðQ¶TNgßZ'çƒáøÓçnÏq‹ûv·çy¾ur9u¹5º8\â‘´†~¾¸w{ܺ¸þ™ðg2ÞàY×w¬q÷ëø—ƒOãZ­Z ¨ Nÿ>¸ýÊ:1èÿ˳Àï<ÁšÙŽ ”­¤càùÁèà5+:“¢Úååø¶òm8ªåƒ€Ùžëu<ÅlŤöÁy/ñßâÄ~Ìâ£6<›/køïWWifŸ^^u{J(ë_Ü‘h1ˆïqÔ. v§×#Æëg;žÏ ˆÌ®Çg@Ê9ÛCÜÈþ­H¦öùåð¤W½“Ép¤ÉzÊö„ßé ÏfÑF‹˜Pé'Œã¸H“‚Àw_Ò,ΟVáUâï³ï¾ÛkÎ;Tˆ³~ËpA¿í¤å2®Ž'Õy·'8c S£î¶Ÿ4˜Ù¿žÙçÁ— Öèí6|q}ñ_¼ßBŽÃrƒ8Nî7/·HˆÛ⦾;2¤`ìûBcÇÝ¿Û¾k_siVV7{Úºeº-Z¯ÖQ”¬V÷ëùü…vÒlU†óyÛÈøýo§èª<›û®–0¸/!¯Lx`íxÌ*g°‘®àÖªL–ÕvB‹¸ÀóÇ®ð7ÈV³| ó˜À;ˆ ÏJˆKQ‰ˆòi–ðI -¬^hµ&\tôWDžgðë -Ë™dHWéšaAZPß”RÖ?»¾´@+‘%ZƒØ°Ê5ÑŽíK4¬P/XQX$÷Ú>‚Ÿf•I¨›B=Ј¥ÖkJ8èX­1Ò#j¾X„Y »¨Ÿ`Öiž–D®Y=ÃQ„¶Ï –SC[VLò"nßå÷FºQÇq!(—Úñʈå‹Z› !pÍ;ð„åk}¡ÊѬ4nh6´ á7¤Ÿë­¶À½Àö¡h)áæ}Ccpláín ½ŠW¯ÅLWýÐ澇¢–ˆfŒÆݸ&£×: -áÚBñ¢cÅk¿ŽB¶rCÇÉõhrròI7ã3ì¶ØŽ•„ð+ò‚Ü»Htˆ¯Bº0¼R&­ñŒ¶B2Ñl‚-!&9äW`=¦ùze¨nÊYGºòp)mé«û§ Á,̦(E@à,&ÎcI[)F‘VJ%ˆÐAK"pëtݨ‚µŽ*#k™6ˆ¬¥”ƒ²Wx„E꺰.‰Ca2‚<1Lu²Ð¦L´µ®ŠÆš–#ÂCW¹Vx7Ol]ÒuýÉáƒÑX˜ð—­#5UH[ ¡'„t ºbr&ñlõBØá3èô šJ¡é1ÇãWÚ#RUBtj›i?, %ÕÄF".*l ,ñ2ëøq¥Àø!Z80ø žNªêëî(Mx,u‡>•#á{ ûîœß —/㣺’6¤L±ª#²––#·GëXó¬+H²ÈÑ>\ÅI¦sìª#'¢˜Úe‰>È3 •À³R£Î U2¢kõ)³ŠMÅ9”ö#®TÍ¥Ú;›·ptö ¶=›KGÚÜ¥ã¸gƒPa»˜Ÿ2°NfIô€ÅÜã¥w1 žuªÕù¤¶ÎtR¢Mè:M>&tÁ´I’¸@÷<êÆ P½_·M6ƒ$‚˜žÜ#†fü–?Œ{ýÑàlWÊc64§ß˜+‘Ž Aˆ×œF!…‹t”u#œ|ë.<4Éø…©}Sä‘6D˜øK™ ]{Cšß“M…«½kê”V¬‘ixº­Ú¥‹×=*=’!“­2i¦‘íÄZ ÙjjöéseúAž™š¯'5(óÍ´!µèÒìw0#ÃÒbô&µHç2Ú^97ë1ÌÊL'ÊÛHT†tïžðbFƒYBƒ§+ZwíÀc̃—ÓfêhC#Ç®#0·§UåÚž¡ˆr]Íô ¥»–dt-gÃ{M=ÎéI[F°ô Õ®E7P©Ö!f"§Ô]á§ìRâéÐ *Fu96J‚TÅÒõ@[TøpNÃÔà=¥ Ã¶;„ Zs×·Z  0]AÊ<5 Üå¡3Š(û„°ñü…¤W¶ëKÌ>ÛuÛLúFh“ÀC$ÂdÜôfʈ02Ý!ªt‡{3& †˜Ä»Æ-Ë=k÷ãz¢W%T,Yyß6(-ÂQc"ú·ÅÚLµïÕ9j»Ey²úX ©ôw£L×Ù'¶¯»lÑæpó'7‚ø¾m‹HEÏÜ„–ÂÈès{˜ÎŒ¢¹?òºzÞ“é›Ít¦"6‰´Õ4Ì™[†ve}F÷—Gù¤Vv“f=‹ª|³A_¨ÀYì¾4lA›]Âú`»»òÅdXñŽ»Uf÷~Ì¿væÚ‰ÃóQÄMZƒ&[óÎ6u^¶‡pì)q<wêy +΀X¤Bჾár j%Ä»H·å™xwé§ÍQÝÒxmÅdPžDÜÖö2ôÐ[æHív↭×jÁJi¨Y¥µSxUÇÞ?‰k *TàÎ.’<]ýÝí›ã„"wSyQ˹N)èð ª–ÞÖ‘¸©«9Ћl}P…?ÐÁ.‡K™i_â1K· ØXùÈdeô[T)ŠÚÑ75½u‡DÚ’h‡k·©}ååÌâLi¨“ŒÉèUL\¥ “Häª>°·«´ä¡,\ÑÆVr¶?ttÑöw&]ˆœ«FÎ^V°€ŠÏM¨ÄÇKDÚñùv¸DddÕ)¸I;¥ìÖ S¦vu:ˆ»*$°Aä:–g‡yô¶Î3÷Xñ¯õ-pZÄÏx¨ï4v–µW`shùÉ]«»úïÞÄE‘-oûgº †g\6œa+v²C”C¢õt\c—£j ~ê‡yùTð»Êí’)ŸLãÜ‚ŸpVÕ¾´H360^÷]c=èƒGÁ:·Õ†±fM¹ò/'IŠ‘×LJDª¯Çf‹j½ÎÊv™™@_0Df·Æé>6„`U5dÒ6½dòõb6Ã0†ê” ¨Ôó°Î¼ëîW™»Œ5ëëàåõ¬X£%ñÕÅ)S:ZCÆñEhâW+v“‚ZNµªÂúz¨Õ«¯)a£«fƒXƒ¡¥^5éòÙ‘Œ‚H}g¤tŠe B•üù8qÜnŒSåk«» ƒ Šá,zÀC©øoá& c°ä\!©Dà©ÀC±_N“Ž¢`@óùu™×‡pQÕ{†7Š ‡ƒ°^¹È@)B«ÐePu@bvZ:®ŒÛ%¢Ð©¼Š£<…âDxÊšH(3'ùG“Ö{»tÅ|œœÜä–‰! èjËúêi¥ê%K„IdÛ:I3žZmZ¼TÊBðjS¢væë4@œ)ž¿”¡30`XáëÓÅ0,ÞÒå:/GÜ4“ç¸éçmÝ>cŠRûÂÏ0EŽ`Qrš+¢Ø +IËÌe¼Ü&t ÒÍÂÜ%ê/‡Ýæa mƒ  <“ñ¸IÙÓ†à)ÙBŽ¶Sìírή\†‡€ÎÆêÇBÕÏÃdžo|wÖeLy¨«5?‘UàÃc6ÈØuZŒÕPÈ„‰+x>Úl>!ˆº¬EØ Ñz`¼›–7Ì©Ä2]Ç甇:Çü²ÅÓÔY?—ü€@4övÃ4r†¥]Ö.ß2Pk5P{ ë•fUáìÃ?cö3Rn\Vìšù¼8”'Å*ä©$L&³0‘y½[Ìëj×<×¥­Ê0ºÃã4Ax9õÄI¢³’:)ÃO?÷ÊA"qT1É°Vs¡@#‡tÍQÌ +QWGkp†—éj´„j4dîj´Ž±¢ñ^m|TÜ92ɲMÄ€¨¢¸ï6îÚ¹êƧy}¨'¹V;@ÄÓ{ÁžQ‡&ÞÙ€ Øa7%‰ô3_¢¨«9ã d¬ÉG«ìXŽ8•„Äw^5bƒ2‘ØКÿ‹FáK&¨„ŽÞeÙÉš @;‘iõã„>¼ýæR]¦¹A'±E§Ž× D‹£Dòüª#IÒE"ã³ÑëŸÖ²ýÿ¼ ¡XÙKx½;¬*ªÒ §Eµ ÌN½½»€Qúx2H›—ØfB ÆñHVs^cý—Œ:AgwSnhâsö”Õ‹œ’˜¥`Eh¤Yݦ„k€ÐaÇ:³¬Õ¥Ä¼àèßðX/·uU8 P˽_ç.xÝÚx +âõãé@ó¡*ÒßTÿm€Î°Qpº¤’Buºä2+Ç>€Q×ÚÝPûĶñ¬×€C mQt×” .ÎáÜiÙ½DÞšÓaéÀwD7‚hŸèN/ `BX‘ÌÝjl΄J¬Ò‰.I¯5Ï)ÿôºHL  +#Q¼'!¸È‚û•¤ÚÖÌ4D– m‹põL(òÒNMlY›Ö¥Ô²e]oÌŽ0íÄT›<í±5ÛyRV£H¢¸ËcJ®›KÆUM±Mµv©lÿáØ´¹ŸDbÖT}Ž•A•½³X +uF4jŠ/‚¾vKknÃIÆÐß¹Að´¹”Þ(¨Ñ“Ò—½¨'ÁpŸÃèá朦Á5Z¶¤ 냒 Ýá’GÐ;«në ìR„ÍCª:¨û„PÑ–èW½é¶¼¶®h ÞJæø‡øÙàûŒJ¸I¯lÈeتÛ¶[TÔÅHl7"qd\ +åœݲg÷ lKIpâuÃó­·òÆ ]xš”]r“¿Ç¾Vm ÂÅôæúîÚ»¹eJº\R@àú'{îãGj}f×)¢×ÝMm³ÏÂâoÞß1¡w=½«]ª§üߟ£PgÖZØ·_?!,)"©þS„…nú?(´°Q=VLÙºÕw0†õ>]Ú°Öõ´-ðñÏÚ‹ˆ6äU[NÞ§:À*ìoÇüøÇWkçý÷ wæôM )ßœ¡Ã#Äôo¢†ô7endstream endobj -5296 0 obj << +5486 0 obj << /Type /Page -/Contents 5297 0 R -/Resources 5295 0 R +/Contents 5487 0 R +/Resources 5485 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5279 0 R +/Parent 5459 0 R +/Annots [ 5490 0 R 5491 0 R ] >> endobj -5298 0 obj << -/D [5296 0 R /XYZ 85.039 781.388 null] +5490 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [210.961 315.308 287.499 327.18] +/Subtype /Link +/A << /S /GoTo /D (ptrsect) >> >> endobj -1246 0 obj << -/D [5296 0 R /XYZ 85.039 459.145 null] +5491 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [207.785 277.085 284.323 286.532] +/Subtype /Link +/A << /S /GoTo /D (ptrsect) >> >> endobj -5299 0 obj << -/D [5296 0 R /XYZ 85.039 427.122 null] +5488 0 obj << +/D [5486 0 R /XYZ 85.039 781.388 null] >> endobj -5295 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R >> +1206 0 obj << +/D [5486 0 R /XYZ 85.039 705.716 null] +>> endobj +5489 0 obj << +/D [5486 0 R /XYZ 85.039 671.269 null] +>> endobj +5485 0 obj << +/Font << /F56 3312 0 R /F58 3380 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5302 0 obj << -/Length 3017 +5494 0 obj << +/Length 3535 /Filter /FlateDecode >> stream -xÚµZ[oÛÆ~÷¯ò -ˆè½ð²Ì›sk\$ŽOí =h‹‚’(‰0Eº$eÇýõg.Kr%Ñpê"M¹—ÙÙÙ¹|³Šœø#'&ô…N&±‘¾6f²ØžˆÉf~:‘–bfIfÍ›ë“Óa4‘ÂOD2¹^ û„~êÉõò7ïídzËë÷¿LgZkO:‹cã½ýtv5•ÞÕùÛ³O8x—Ðýåüâz:“ÞùÅOL4_//¿àÜÔhïzúÇõÏ'ï¯{±z† B‚2ýuòÛb²ù>¾NÌäÚ—0½=¡ü0ж_œ\ü§ßŠç‚ ¯SA¨}¬::H"?H‚I -?éà㻋ó+!ÿ\fþ»Op^)ÃPxgÐãÐ tƒW»r: Uè}NìPÀ"x­Õki¸§„Ш l&QðäÓÅõ‡CNq"<§år›È…{(Ô+G ÌÈ*<ât~qîpÒv’B>ÿ‰–iëðQ|á2ÿÕ-³ÕáežŸÏ¦¸u$…ðt%É¿À©ÎA+šç7†ÛÛåá™T¤cýügº+8¡£guÚ¯¸’ŒBcÌó³úøéòðP2‰cñìêû³ÎÖÌÍ$ι”2Œÿ_nñ¥‘®i"‰#¦šÕâ¦ávµâo“ÿÙ="%ƒÀçN¬åñšô.Í‹t^dÈêôƒtãû,‘~¤#H1HÀ¬Ïʪ…µAË÷jP¦6ÞÝTr˜û]È`‘¶yUâtâå Û †n,PðÚ|KK›6ÝÞò4žã춆v^"§™”k¦¡,úÞ02‡^Á{:À\ ÕTÅÞ=ï_ìa”,ÿ’'~‡KI‘Úö™®jhÏ|^ÀÌÈ!tò‚ 5gõ}ièZlÒ†çórQg)í›-«ôIû|ÁáŸÄ+ åj%ŽñJI_E‰ %öA:…ŸÂ{»É7 Yyù -¿1œ)ãÆ»šôwYÍC¨W¤­³Eµ.átKŸOµÑÜ®J·°lž>v¶0ñe>}¶†Î¶g§Ý> -ÌT):ÛE…–÷¬ƒÐžË)š(›+ž!<Ò=Þ[µ+–<4§Û¶KÀ¡ó¦µÖ>X ÒÝçpáÔº‚žóôæû65A·Á‚P2¡½kÔbñÀóVZ=0U»É›WØŒaaϬ(¸µ¬Ém;·û§#V¹­¶d_ì;(!XàG«<¨ã¾ 2Ö÷è‚Ep¤7¡é ÇŒÐ8w(Ì7R ȃ:XCÖŽù2-mÚt'6‹ -@Ì@УM XÆ -¬µ 5gË»´ä(Ò'–¶ -’º]Ѧsb¬¼nFÒmrKL@QÒ°ée”Ó ‡kòœóQ¡pr°! ¡ŠR¼“h³UU³¢(8æØÓvì®É@$|0Gy„ô ÷¹d_+¹ç䨤Ea½‘?`§²“mŃd)›´\gA8¢¦-X‡ÈnN~j,Ò:[a .ìræ²›T9%H¸ü ‰ŠòR¹f„êôÔÍ‚@yÿET@P‘  c_‚Š÷÷.òn¶ej&îòÎnîy"%ˆ€ÑÇ=¸Ýæ/¼GEȤâU{à…ÅÔ(&ß=”™]Q•Ùˆ"š @'ÆÊ:Tz -! -o«rÝ´<.±Eó’®á=Þ”M§0ÇÈqÛß,¡´ß½@ }‹†`QU‚±&ë4Mç Ä`g0‘Öl2yùí®Gv/¦*ó‘¨ÂÃWo5rîÁ‚2,^¶ÜÛ¤8×9‘†ÐJ»Û y°KPÐyš"(×]wZôµÃ’'WhŒµÝrPÌÜ"iÚ®(M‘3½²ÖÒ97,Ácq hm^1,Î!\è=9VüÝ;fasÜ wS{Þ¼=~¾p²1À)Ž?½?K/ Osú†ßs -¬lÉôà’^\ŸB-,N½D"zȨ ö“$xÈ84™ŽèG@æ)†=9ä8 -d\Ž½ê”I0š+ÈícFƒ¯‚[¨@¤5Qßõì£ÏQlû¬h~†&Òj§/AÉtàþ"ã ¤1Ưð5š†Œì$^ûz3§Ä -( !’æ¢e<ÙI%ý8,°`•ÄÖ± ó[‹g˜?”ÑžO®H øt`ß(°ìGt‚1 SIú„Á¦O {ˆkÝÊ~½JŒîòr(ö´'“Ä…<Ä`ÇZ$$GX µ~baôÙÎ(‹ìa–0ãÆ=„9Ûœ§–×ÕŽÈØ…`y®ÑVlÙF˜6èÛUR=Œ ¹øV8Ru/³PBi ˆmÁv2¢‘Øjë®û*«ï(„ãÖ€q~ É xXäTnÈðKÉÂŽ°*ÎÆí2§E6ûöiçõr¢©„Öþá úHû±êîm³eƒ‰P@Ö3¨ÁÑõZ~À¸¯( Aral¢lZÝÛåׯ¸1ßuK©„BÆp;@ë HCôÅF`œæR倎lÀÀÕ†i‰F‹x ã1åäýsYÕ¸FTt—/³î†lãÅ»ÚróÂN¥óþEñÀ¦• -Ä+÷ÉC{g%‡Û´ž»J(øZHMÓí‘Vï¯_¬ã8?ìºO<>VW/‡ù_ÇÚëÒ?t$Ûq¬:ŒTÛ{‹`v¨Ö¨I‹jÍsd/±ÞQÞN¬W:²’ -QË"åÏ»/WÝb*÷qÙwAc¼,–VA•ˆ\¾ ~"h†°°ïé2½:9öý¡äÌ5ëŸ H0=€2FkÇï ̨v^œ´ ,³tiAÈHI)òìó›3*Àß~½¼š2& £‰æ_T ‘å­w]=YZñ^nvØaÓ_Æ|uéT„_Ïß÷Dµ}Î:µO\§­Ýé´d›ÝƒfJ„>Pu‹«5ü7þ˜7„Š«³ÏüËœnFÇljñ“P? ’ÇQ£¥ùh|‚[ØBF‡Ý¶#BŒøùzqþ+¶ ÜLµíÌ &øòxjp˜ Ð_m·¶4åª#bäHðÚvó»)ä½´ÎSö~ÿè *4°8&[ÂÍûMVgL|=Ä"ožzçŠÀ-Ò­m‘Eº‡{8v÷ppÿ-ÒÎù´÷âû÷ïÐûþ‚»ô«.TuÖ8Oç oåòJ¡xL ^6ŸªùUûž¶¶ í`¾.÷^~ö (öuÇÖ\í£Ï·ÂWɘ9Á_Và?ú×"Ão0Ú7:·ÉP)_ÉN_‰àPÞî_• ü?]×p–endstream +xÚí\[sÛ6~÷¯ÐKf©™Kàm;}HÝ›;Ö[;»ÝIû@K´ÌT’ŠíßsJTâì:n6£ñŒ ‡ÀÁÁwn$ =òáOÒHùa6JR­Â4M—'þh-ßh¡ðGFùq„M_]žüýÛ(i_e~6º¼&’ËÙ+ïôûç—ßü2ž„aèéT'I’z§?¾¸kïâìôÅØd¼s¸ýåì§ËñD{g?}ÇôHóòüügl§¡w9þýò‡“o.&F™8DÞœ¼úÝÍ€ÍN|féèʾÒY6Zž˜(T‘ å~qrqòÏ®n3#~j`¦K1љʂhXœ}”uòüy€Œ‚ùh¼L"“yçu¹ja¾qâVKhZæ«Ycg:0Lh”^ì0:æl=©WäÓqx7|×(Þi[VÔœx³â7_› Z®æL“óe]SåŠmQsÝo~äWR.¡YÆho +ä:œ~¦b#ì¼Zã$‹ºù){<ÇJL$”‹0œ~n™Ú +TœÆòØš…‘7­–(Á\¼Ä>‘ã ó%WàÚ7*L4.xF”ËExœ$w5žÀM7¡7ƒˆ_”" +¤˜á¢Æá–Éy:mÃw9_¦X\â%Gáϸ¾­øJ²‡2LœH‹¦áñPÒDã-Š®'"Þä¸doñŸ0)#+XäSª’±y=q5…‰n¬ tp…ƒüžt\ ÀæŒÝ®iTžDµà†YY[MÛª¾çÚk‚”ÁséV³c§¨A¤†æùdºéšÐkÖ<¶àJ\–².Hv0ÜÝsÃ-ö˜,c¼òšG¼Ç–jÃd—KþmW4NQËs Æé7cš/PÂjì ‰–hHKÀž&í ÉïÀ6HUš¥`‹J‚˜K4XGàð׶¤©ç \æ{4œÈu%a&&%éÃ/Þ .ÑìpVW˲å*CÌï­,´2™€Ô=õD$(ŠiÿÅFt/»³Ü¢!le¾×l®è ®©Úb)+ +ÚKlS5AhΉü¡ ˜°rE cŸû½a5š”qÙ‘­Ò¢iш<Ö‘÷ŽÖÚ1ŠZz$)ÃuUñµ.Þl“¼nö ue"0-ÅLŠ$`ÀàÖa¥!”yõÙôò$Þ·ãÔx¬h¬þ²3Ÿ³Ñ7Û–¦b¥§Äź`µ©/¤‰«3Æ1’pÃz¶µ ¦ãyV9úS- @$ö8˜þ”y![ÅV´X`ÿ>(x € ©²ÓÕn4-b¾â’kI°ÆlåGÖl/:IA òbÅtÅ]¾\Dà†V®9_\,Ø¥û×Ðߦi]:ÒH2Ö~ÔÁ¢GX@¹]μ¨b[M q¹õò™wêVoË›Úròcw¾Úº V”ÛÜéäöf+iªØ.?\WEçL¬ 4¾sׂWEFóìz¯ÇÌ›Öù5)×¾0„YÏ2°DpwkƒŠN¬¢c™»^ Z Ê@+qÎS—f…u Žj-ÝöŒv²kD±®¹)ÈŠÂ$Çi]"?mÃaE4FÇ /Èô”5¸µTt¢À›5YN4î®0ØDæm+æDVÊé;F/ÐîúèL(åYV½¨šØz¾j@í5E&KK²íŸl/8I©®ÊB*k¥rÖÔ@’¢!XM“YÔ$€˜3Iš7D’7|M£]ç›…d/¡ù'ÊŸ ð+×]okË@uŒ9Çï¢èä8Á ÄM@\>•ô9„òƒðÝIÉp©I¿ýÄ[Xì‘ñ‚È™«·U‹’œÔÑ’ÁÕZÙ„C'ª@œè°ËI€€ô²j„Üuˆ `¤ù–)J +Ñý”úÛ”È\;颦‘˜Ol—ÐsôêÇžµ¤¦DO˜¨ó¥8¯º€,ÅŸÀ …YZR²'«Jª(C›q™Ü\‹»õ9#r +gÈ5‚ š6oI–P&g]ˆlVv †+¦˜`i3'µ²v^†ëûÄÄ»¼‘^š¼‹DÞÔxUìe#õ¿ÑááÈ× êý´—¿q( ;±ÀœÎh•¥6yÄ· `/‰]v®ËÏ#V£Ó]K®ÓÁŒ ëߎ£Ö¼7uXp¾QPHá’¡ìðz Nð½@âΟܟ ‰ 9è3 áo®XTa© pÝåý± ¾ãhÇõaÍ¢lÚÎÀ½„‘7Àåö9'[Ww‰”P4U[N 6#6Šã»}¼S5Í؉| îšLÿR„•92ãT]¶óìס|H+_ÛÄÿ–¢î~4$MC½h0X™}?Q6]h­ÀYÚåx.è4FÅVæ‚N2)Yäý04L¢Rc™}γï’.a%RZ‘Y¼Õ1¨_À‚w¢äÈÌ}¼S5”ÿî+¨[m1D+kÜŒ™Ü²Þ&oÄš âuuÅ…³¯…ëºp¼ºxp´oÇŸ{Ì0¶sàPe"Ów¥•SŒT„“;Ìy¹²ªŠšghteC.Š1Î;—63M4×dÃ8YÁŽ»ÄH“—a`ï¹årï4…•Œ•àº¸©ž¸ðËwïpf—èÌò+1•È¾Ý½;Nä«(A 8N£RÀ’ÿn·¹î´Æf:”8h.rêp ·”t`ñ–…‚jˆ„t4÷Üàf!b—ÀÕ'`YÒ°·pÕ­<8 +ÊC}ïjÓr¡¸›.6ݺH+[ P^ðkŸ2_pó4ïPŽÜS`•y§X÷ß_Ø^º—=’VÍïw8ºÞ4ÜÍL(V»Ò7‘òÍV]?p‘Ooòu;Õ<†Îž‹˜_,Ëc/Ï/X{$ÐjPÂf»“0d¦'ã‹Íz=Ž(êÜ èk¨2ºs±x:<ƒ=Ø[*DØk£|Ž:wQ©ÃHi˜Ý$äÆ.Åî•ÆƒAõÈbûŽ è†òx±2±•Ú?vYC¬ô5çðL¿¦XXÞÇÈ×ݶ÷îŹ:ðÁ1ýQ÷>YŒ.w¢QÿóÈ.m¤ Pj·ÖïÿN÷*‰}§ðÝ¥ìF0¸”’P÷{å‡EÅO7ÛoƒKx±œùžL¦XšI×ÍÇgGÖw Æ?œŒÃÀc墆ÚÓ^··¼À?Ø?ç\«:™àcÙ§µ¶Îg¹tЧŽB!ìé^IÉjsÕHìmtÿÅtÔ}¸y=ÐU¨üPK{^Þ tZ˜à],ÈUY¦û¬ʯÖÏzA/ìß…éèÑ—á°kß¾ª +CûÖS^-†6É¢ õÔ"MT'djFÿÄ:*,Ÿ?[³õ}ön5ˆQ ÒGQƒè“Ô‚þ‡‚·0 ƒ€ó Âys÷yá7™:p†Þ3µ÷SÕË^ýÿD?‚~ Œ¾A·w÷Äþúi0µ5k’‡Ò]ó` ½ýÿîíã÷ض£³?¬ N„߈2ô¾!¢2 iB’QöàhB@ > ]}*›ùYãý~=|ö?!·þˆÃï ‚·ê ñvôÑO⣟Ú$]ðÑÿÅQsÚšý=p‡ŸÆ*‰Òmª½tÐÎùõë£#>:â‹»i¾š ÁÛšë'„ÝÑ?•?~zœòÑ)ÿåÆqw·‹„¿ö}Ú˜¶óº¨ìt€Þ ½vÞH~Ïå›j1;:î£ã~lâ–b¥”ÝT¼ã’6ð>TÞ|tÚŸ¡Ó~JŒöÑaÿõÙLÑZXþw^;V©N?ÜkãÀ0® ztßG÷ýxHûlÏÝ¡}´µÿèÀ?׬ûIQò ¹ðI¨ ¨h•E‡~Ú ØÞw‹ñ߸œÎ¯e;[‚él\Â[‚Ÿz{Éi[°éÔA:Ú³ WÞO‹í¸ÛOÐÑÉŸíó½à Ÿ([¹6|Þ2L¼+‹ö„N Û~Ç;J±]~J†[ó±ô8N»“µûç>vÏÉ‹vÐ|ɚؾº¤‰JýÀ94 c9)ï}ÂÊ„qòg]v'xfÜÏsš(ˆÒ|úªd N-ì×tŽ!ðå0RŒG¤&çÍÜPÕß  /Îϸ@g +u¼wvªð,,\‘ :WP§ðGLð¢E!Noç•sba&$¶„(_àI +|ª­¸F~zaèнIP¸fkš¯‡äÄ&Ùš-ìÖgdÛ½Q¸=¦J‡½S!>Då`ºY735­V×ÿŽtǤ¬dìÜhT;áÛºl‹-Omc %*"wÎ`lp+5—óö,pÞºù½#»<¹57ЙÑ–Žͧ yCtJ‰ÒðHs+G%åÇ ’,ñ~nùÜgaò§¾ õœû] +Ô¯;p§ºP‡Ý7ÝyGlþ×{~¸ÂžÄC¨î.%Çhþ]‡‰ 31b@7©ê\Žãmµæ3tHC‡±°ä§ƒÂ*+iE51[,ègkɆ¢æ1ãü˜£ã©”gÏl-ò,¾ÀŸ$Iðµòþ‘Î4RQvÀè¿'vxØO넉ÒIæ"‡HàG{á8qú‡Ã?ÌnRendstream endobj -5301 0 obj << +5493 0 obj << /Type /Page -/Contents 5302 0 R -/Resources 5300 0 R +/Contents 5494 0 R +/Resources 5492 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5279 0 R +/Parent 5503 0 R +/Annots [ 5498 0 R 5499 0 R 5500 0 R ] >> endobj -5303 0 obj << -/D [5301 0 R /XYZ 85.039 781.388 null] +5498 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [303.924 433.497 356.496 445.187] +/Subtype /Link +/A << /S /GoTo /D (printOptions) >> >> endobj -1250 0 obj << -/D [5301 0 R /XYZ 85.039 485.637 null] +5499 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [404.367 419.948 539.579 431.638] +/Subtype /Link +/A << /S /GoTo /D (CUPS-printing) >> >> endobj -5304 0 obj << -/D [5301 0 R /XYZ 85.039 452.1 null] +5500 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 406.399 122.417 417.967] +/Subtype /Link +/A << /S /GoTo /D (CUPS-printing) >> >> endobj -5300 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> +5495 0 obj << +/D [5493 0 R /XYZ 85.039 781.388 null] +>> endobj +1210 0 obj << +/D [5493 0 R /XYZ 85.039 761.463 null] +>> endobj +5496 0 obj << +/D [5493 0 R /XYZ 85.039 743.459 null] +>> endobj +1214 0 obj << +/D [5493 0 R /XYZ 85.039 563.482 null] +>> endobj +5497 0 obj << +/D [5493 0 R /XYZ 85.039 529.338 null] +>> endobj +5501 0 obj << +/D [5493 0 R /XYZ 85.039 395.44 null] +>> endobj +5502 0 obj << +/D [5493 0 R /XYZ 283.333 401.414 null] +>> endobj +5492 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F59 3455 0 R /F62 4159 0 R /F41 3054 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5307 0 obj << -/Length 2604 -/Filter /FlateDecode ->> -stream -xÚ­ioÛÈõ»…àvaja±3Eá»ÑÖñº±Œ HŒCÒ‰THÊúçûŽ!5%7iëÀáoÞ¼ûË‘€riW¨xFÒUQ4J—Gbt;¿I11  æÕìè/¿è`$…‹x4»ÛàÑ®¯Õh–}r^¿;¿š½ý0ž(¥¹ãIFÎë‹óë±t®§¯Ï/pËw®`úaz9O¤3½ü•áææêêwÜGÊ™og¿½õdõ 1ÒôíèÓ­e@ÿoGÂUq4z„±p%l/€(WûÊÌG×GÿèQñž?âSûD UäêH e µ%)=WIojájá“êÕxâ…Nš"w‹ØÉqTŽ½Èi™ÕÉÍI]TäT-ìÿ„ûOOcüïÄ@¤,©“œÎ­—Y ÛÅNòºÁ'±¿u>Áµ×7(Úk”°d¸øCªþ‰"­ÖpÆÎc±XàH: Ñ–ó$áÏ¢hÚ¢<÷<¯îÌvw(ƒ½Ú¢×®“%ο_ñ|…+xJ¾hªu ¦áû¢§ -ð1DÙ‰ëÑÜ]Úˆå9"]/ÆH­2>ñœdY•÷MÛ1/AÅšxoçÖ%Ü„ó -'x-(Ä— XkØð·BRÏ8$Bñ|›Y^ó¬ç|æÓGTR™1ï¡óhp¡¥ãU·<é‰J2:u -ë^ì”U;¼dw/W‹Y?&n}WÜ* z&¡!oeŠF>œB¥ñ8+Yybx‡mZR´šiçIË£ì$5ª-Š}ç÷šW‰ðŒÇ??#jÒåÏC0íü‹wzÓà ˜Ê•'D_nÈIxͶ>\FëÃõ„Ï ùÝõ m[c$zkd À–%êHïX"œ)óG­ŒMâضŒá6&ˆh Ò˜ÅáÍ Ó’—«µ¹!J–«EΓ¢ÝÃÚ¢ -Ù+•g‘8²¢¸±‚@ÇâXÆR -†ÚŠU*pC„ …4éÀ¹¬Ð¬ñ -òÔ6M`<7ªFFCá¤Õb½,yÜÌٛ6®V3$©’ÄÖ²;7ÂÍA ¡»q‘Ü)®ÅÎ]U“t&‘rCåmÉ(ORTì …Ï7¡W…«ºÍ3ÞJjÖÒæ[Ò7Ò.ôFÏ" ,pŒTJ;˜–Hq€‰MŽl™ž…ÃFOÍ|Ëö„ÈãáÎM0’Ú²’ád¬I¾G ””޿寉P(U hUÛ4„$]C`¯(ædzA°1=?Î+0—¡[¬jFçRcN¨œœ"É® <¼ÀÖ É#èôÒÃȉJpê¨d¬ŒÉÄR €;…A5 -ª Ncª ‘Yÿ,¤Obâ‹2p^2|Ä•,óæ€t仞Š_”ƒ3¬³:<Ús=î4ÚsÒ¤äR£NëZm†JÞêR-.Š¯ƒRž3½ãe F9uÝ8º°ÕÒe´AA7ð,½J0¯‹ÍI–qÈ@cå!EÃH­7ˆ}sƘ€Ñÿth |L1›HìYmL’à) #®á6ájj%ˆ¢ EÛ¥ú,&MLÊOÙ¾ k™²õ±hK%üÉŒM(ºµÎílc,{·ç|ËV*;å•¢µý¶‹´@V¾î8rCZ–Î OÙƒPá+×L1^UퟰÒP—§é¢ÈË–§“Üûé ~€w ñÓù,•O"—ô!ÀÚ‚Ùìq~Œa»Â‰3ŒÕø}Š‚c P -÷X·ƒØñòy5OÊ6ižšîÙ»7—Ók!ÿÈr÷ÍÅ8p¨´ àØÿ.Ã\Ÿðj•ugoºÃöüÝÅ “:n[wÉÑ pñ3¨×ô -}&0øAW^àoò+]QwGãM®mL)_6Å—ŽM³Ys»¸Û£ïMSGV"Cª³)"»Ì“P7°ƒäÕð:ÕEpüÛ:_çfí±+ò‹¾ˆeòµ«x†ݲÉm4‘Ih8 Æïé®–Ø6 s­–ø„¡"lÝ:áÃô¹tÞåvà¢P* c\cáóÆ°|ê%=S‰Ô\ ’´ “2KXÄtóЮЀ°²aš‡v-E …ž4HÓŠŠ%—Ú@ˆÕä8 -43ȱ ·¨¡Œ´#þ8ãXsMÐ35F¶rSu=U,·¤3‘aèzBmYÎ<¡¦ê.ª`\sçîÅ‹ú‡%¢®Ä€üù–O4ó„jmKlvË䛇¶È~§Úº°âsƒÚv Ó¶}ƒŸM»Ò;Q -íJÿÙÐó¿V,‰ì¾.(HsQWÂ.Ñçø‘m7^u€ƒV è;µ¾¹ÚcpÚwut¥ï {ohpÔváë -ÖëÒsVë}Dž)¯­AAiÂ%´½¦wä÷8ccCꤿÇvIÛqŒ½NáÁPvŒ35„½Z"½‡:L©ׇÒá¥ÎÊ‚9ØaJ*yÃ36æ‡uYå=7zë):×Ó¸lšÓ4æ-iÛ„Qêqá@©àe60{CpbeÒ¤õúçw¯0m×Yøô€Ó#¾Ð -M>†_ûÝzè -Ry®Œ´ÑÒã¼Ëé|ß{›teoÊvpÈësëN¾EÒZzŒ0ûEcÞhû¦-/öOäy¶E¼ÏöÒ;%3Ü6bX&«?4óœVéÆÜÄÁ@Ñ+ÃÁÇUôŸ+‰Þk=(WÄp[y -s{ðû Â6-¹Ÿ#W8*Ê;S\ÐÄ|[fQsD_Võó±ÁØ=áöìÍ+>ƒº\ jPTÍöf2h€Ý(øï•P©åí‹Þ:1ØlI ‚ †‘È™ù¦Œh¬(ó”¤-½*ó|P4g\⪷÷ñ~™€ÿéa½›AßzÑ>½t´ Þлôv4üo:ÿÓendstream +5506 0 obj << +/Length 3430 +/Filter /FlateDecode +>> +stream +xÚÕÛŽÛÆõ}¿B)j”,š3ÞRôÁ1rY#MÝxƒ¦Hò0+q%&”¨Ô®7èÇ÷܆J\'F^k Ï gÎý6T‹þ©Ež„Q\,²\…qž/Öû«h±…™Ï¯”¬ˆ&ŒÒ§>¹¹zñY’.TQ±¸¹£%7›ï‚W_¼|sóé×ËUÇÊÃå*ËòàÕ—/ß.UðöúÕË/qÊoàñëë¯n–+\õ9¯Ç5ß¼yó/œ[æqp³üáæõÕ§7 ++š4F~¾úî‡h±4__Ea\ä‹G¡*ŠÅþÊ$q˜˜Xžë«·Wÿvá9³à·f(]¹«8 +óÜ $§z†äg¢ùâ3•x“* MË +à‚‰óà?U¿ã¥Iî-“0+2Yzl«C_¶ËU¢“àü³>çÎȳ0´¼øX¨ŠÀ€y'AuÇ¿ÈV»_ê,¸Å‘Lvø›ëf28ÂLU—ò¦ÝÚ +7êpªgX]Ý.W° ãfèÌÏÔyðÈËh7„ÁÉÖµ@»²çãð] §{$i±RqF@ €ç#HííaÚñPÕðbͺÃx”üP|{hÚróÑŒ¶€üŠ8×æ•6a‘eƒpu4#\PaÂ*LAŠ€_ðêÔõˆ^œ¦Á”³àÀãÎá1sdlBeF}šˆÓùò®‡Jd@‹4f$2П ïò#@š[^´³¿”AáUÝŽä s‹ÙÖÀÿyÐÔ$ß-¿Ñ7“sº²½¯Ö¥“0.ØF—º«Ó$,Àˆ<å•mö$½­ÂÁ0@¬5íÉ4N¾qS¢]0~‹zœ·–u'6ié|¢;÷a`‘| _Ð5#‡w¨Ç=žT¢ì¾’þÔ Î& ã,‘÷Ö‘Æoø{l6 Ú‹˜ÝÉŠ]Ƀ ðJ«vòFw Òý¦CÓàãÙ.tpVlŒXD»iÏ’æ+¢E™R&™É´ìt»¯z·§éb•Sz}.ÊŽ#®±æ]Ñ QLZ³Ú˜ÐCnÙ°Ïøû„[TFòý ulœ#y|M¹>ŸœzwÂ`%C*Ùü 8´åÏ'$¼å J>ŽçlÏk­ó!ˆ;îh‡íÝv¤]§Nà·ÌUbR4aC(Ž4 ÅvN€&ÆÀco‰Ï„µ'€Þvâe…Â=¿²·Níá¹Öô œ§Ž2 +[~"ÍQÒðëY³¯~qQÑ%‹FÐ|¨Ü©Žíí[KH÷Uƒ‹ÁÂ.Uabÿ0D”ã"™·üt/£à &URT¯u1Jô‡w56ÌǸHGsðC%*O†]@Û†·‹£È“Sº­%Ý„Ç1lÁ±„§Û¸: F5í^˜}ÉËo7äå +çGa°)ï¬HŸžoO”õ«êÀ€õ$ n¾Kƒc ¤G‰¨?Ý5-J»FjwüäkBÅRR/Ý‘ð,Œ•¼¥ |ƒùº½­çœ¥ÊB…¨T×HD†î¸æÓÅ3d°®FÙð ÕáìÅڒˆÒ`[»m-Žvú˜\{2ÌÄÇ”òêVïKgøÌ"7wü‹þÑ‚lCÿ|™V€ÏMgßÎYèÕvM…‰Š'¼Ñ [Ѿl[Ηè0É•l¶·ëv™ û&_ž ¸%E<– ¦òZÞt·m¿>õL !!.àX[Î +é…z3Äd™¿s»ŽBp·ã!ò§ÛÒÖ<ÂÜ5I‚92ôhü9ê%*e?Ù‹–§¡Ê ó+á8\íKÖH(b‹¶r üש°ØÀ\ò„pöl¬ë¾9ÈkGÌ,{øOµxˆ(=76Éj òzÂã²9¨?*(ùÆòf2]™¹_&)XÇiΖì 5’´í«5•XK1d+.«Û!ÑÐf¤š +€@¾ÄÓ€üÅa#Ù§6ñ!á¬G>î™-{Y„x)L_õ8(йLº>0m¹µí†_ìÇ=˜r?7|þ¾l "ð]C™1{鱈1=x9 ñÄo;É“0YpùHe%Kh%`ÖÖåÇ3ŤŽÒPëÙjR¥aœbaá*;£f*;íÙù¾Ih’„_<ߧü='•×Ø}xÎ׳»9Û/¼pÏÿ\Ú$l _IºÐf2¿?£ªG ³ÀÏ(üGgñÿü±ØvœóÑiXäÉÜzÂ^‘^‚SJòø¹’ÿÁ¸òúC¹2v ÍÄ+1AH”œC–=Öòž¦‘c¡0O,cFþÉ·þPÆq‡Œ],{#Ñ +dT[xZ%ì;Úm)•ˆ[ökE0U6ðÅ…9\%»üÄU¥Ü+®I8cûSÙô/*„ŽJ¡`ç ˆIœåìa¢ñ®¶ì¶BþgB „`“2Ê3—þ]J_¬dR•1ÌkW8;j8·î|.–uÀñͺµ.ZíDÜz}jÛÑ%s(¥œiþ*ŒTüÞ68r_4í„Å3p*ãúÙ³á r‚r‚±«n ±lf¯(ÔEú«Î^¸®@s¤ +µ9ØÚÉ(ŠÂ,d#×ÔVWÜzRj’Ã+nØؽc ¤ˆÁá7Q‹êªÜ<çÞø“ŒQi&qò+Ôd&›¶U•òêSwpUOý¬´qþ‰Î’Ü'`Õ JO­o¥GCQÓ,Ž!Se¥~RÆ…Ÿ¢vÛRJ`l®CŸµÿ-çÌÏßl*ñƒ£EšâÆËdFŸTÔçεëÔ ”M”¸V²®†¾j”Pj"Cè]Ê,/ FqÊüݶnnmýÌࠖSÚ©4³Æ<K -%.ž6u™\’ "ÛŠEvàyéûF^—¼Ú.2R³˜¯l/³·Ü>ci¦PzNZÅ\Ýã+ƒÏpfn±æ”Œ#n?ÓšI~X ]I­,\}vâuÄù¦HO®:<™aPšË1›1֙ܒÃÍ*‡]Y!”,ÿÌën0ÑþËâez—·…Ð"Ú@þöÖ%×0/µã}åûc€hxS6`ýr›M›Í…Ï$r5ÆoïgœØæC«´c;/Ý`Òó$Q°n9šô~zQ£ª¹ ÷D?PbÇD¦róº ü³q׎ºÈÉqî½@ÜöVHÔ±ë„$¡ÎNKß"÷[¿¤Nz¨h MÄÁ@ . +¼F  +“µr#Gt ÏrSè‘.á&.{ ~p-õJ»Ÿxmçî]¥¹0ç…ÞÌõNóXnY]2 T*[Õü@Ý}øíJÈs|óÕõ·ó:yld|ðî+P©g&Ýeœ\)lõ½Šéz±¹õThóø^i×Ì‚ÓrLäWIaØÜri¨UrîÎŬÝ\á¦gTZ8Ÿ±58n +³}5Ööq°=•Ã­5.#tÖÍiL¥t ×Êzð˜Ó†ÿ8b±Ìûª.·å´PöÍLR‘·Žƒ²y>I®˜Á¡O!Ë.y6à +—Ï==©0QÉo8 +r¨ü2ซö¡!ðÔAx›ºî#²[®| `s?sdV@ªåºGÛŽÉÑ|±Ëó‰öÿÍ»¶ºˆ¥mš$mu~à[¿¾ä'qtǺ|Ç€iÀð–;öZU±ÂÓŒœf‚¡™„^^ËÍ¢ÍKªt‘Œ!nr–8 ø¼÷k¬äXø2f3˜»ÏxHÛ AZg|Ϭ3röøÃÆŒ£nWÖ5¢¯Sȃeë1—ßÞlûwcÕX5qýƒaüQ¢á;|Nå®9#r-iÃ"Èò¸8r&Œ&¥«€æxœ (¢Üä¶âÅg¹_¡ê$ óÈ•1€$Ì´Kµï‰\·Ñ¹¡éÌi=™¯NGߢåc†ñ£L%¦e¥N/nY!´Æ€^6õ Ý\ÑÅYäËg3„údü2MfÊ%º!}@±‚:žo„äÃ’-9ÑÁÕæþoÊŸd|ÙGW,?aà™¡H«0O>øcí*Ôò¾uªËé§-4&ÏRלrrðC¼Æo² n¶Þ·2gcG–é0J¦%ã,Ña4ŒdœL=w4pðE¿?¾ ÚB?-ž–órC׃¤¹¤EU…öouî\«àòBP¾ø:x=ê!o©¥AÝ 7Õ±wNþã'[Y±Âê:›ÿHL„øû¾7Œ3ÙjÜëé¿t”ž#ê7Ô‚ÿRÊ4endstream endobj -5306 0 obj << +5505 0 obj << /Type /Page -/Contents 5307 0 R -/Resources 5305 0 R +/Contents 5506 0 R +/Resources 5504 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5311 0 R +/Parent 5503 0 R >> endobj -5308 0 obj << -/D [5306 0 R /XYZ 85.039 781.388 null] +5507 0 obj << +/D [5505 0 R /XYZ 85.039 781.388 null] >> endobj -1254 0 obj << -/D [5306 0 R /XYZ 85.039 611.338 null] +1218 0 obj << +/D [5505 0 R /XYZ 85.039 719.568 null] >> endobj -5309 0 obj << -/D [5306 0 R /XYZ 85.039 577.194 null] +5508 0 obj << +/D [5505 0 R /XYZ 85.039 687.546 null] >> endobj -1258 0 obj << -/D [5306 0 R /XYZ 85.039 136.435 null] +5504 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F58 3380 0 R /F20 3021 0 R /F59 3455 0 R /F41 3054 0 R /F81 5323 0 R /F35 3036 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5310 0 obj << -/D [5306 0 R /XYZ 85.039 102.291 null] +5511 0 obj << +/Length 3128 +/Filter /FlateDecode +>> +stream +xÚÕZYoÜF~ׯ˜—E¨E†ÃnÞ @‘¯ ÉžµxI¨!¥aÂcBrdkýÖÕMÎ åÝE^¼0 é®¾ª««¾:hµðàŸZ$¡ëùé"N”ë'ÉbSŸy‹yu¦d†·\/ +qè‡Û³Õa´Pž›zéâöž¦Üæ?;—»Xß¾|¾ô}ßQ‰{¾ŒãĹ¼º¸9WÎÍëË‹+ +œ5tß¿~{{¾TÎë·¯x>Îùi½~‡cç‰ïÜžÿzûæìåí„…eà‘<üqöó¯Þ"6ßœy®Ÿ&‹Ðö\•¦‹ú,}7 |éWg7g·»ðX°àU37]Aì†Q´Xúž›DñxådæÊ»®l†óe¨CgÓÖuÖäÜùŽŠÍ¶åÖ'–Í÷þÒãíV?úÓ=U’¸)0Å;ÿ=O98Vk7Jc™±êÝŠp«öá[Þ¹ÚuÜX®å¨9Rftõ!*œ°Ô*v£Ø‡Fì*ƒþ‰ïÑîá’È©³s;OÜÙB'qñO”ØZþ}<#'ëà5Ÿ˜ð„“`åtLh‘ð±á +Õ!k`BΛoÐ"¡ÇV™C«ÀîšÝUÂÃ=vÛZŽß–=·ŠOY½«„+»„ÜS“N*ñïƒ0ÔÈ¥˜3”*…a9˜+,ý0vš¶«³Š˜€Þ™€Í`€”ÄùÅSÐ*:«gZYtÜ£Û=õCA« UâÜn™e?LGîïñâûjàu÷­l0l‹9]I}7NôóŠzúú‰çêЮ ×ˈ©b(:¾‚¼kYö€‘Ä ~Àb +RZ™ÏŠ¬Ÿ„?i[0­§©Ã@B|àñö^æ±$N/¨À”ý4˜^Ÿ^+X ’g®ò‚À¹hZ9hÉ +'*’žé›>–*MÜ8 +Èf¼Dý7À°Ú÷ݪj7Yµê³ú.[ݕͪ~¢Uý¦+wñõÃá2tÓ8Ã=åÆs³ ð:Ã4F4Å0@êµ.H'(åG‘ó‚dôXTí®6¢öxð¦l6(š(vnðK˜¡]=ƒÚø{†=?Ñ–½ƒW3ì­É´H×µÇø¢¹ xDв;l-‘7퟾Æ)>Ø:¼äh“°˜ž°è¯º aiÇJÛv2ùÞù´7gTèùx¦ +%ש3ÈØGä*“Í!e+¡5ÐìÜ^…•)ÜÚâC_î~u"&^,žªu Ý4QVýGk#û TèFGö ZWõðâ‘R€3%¬ŸzΤi­3IYDY-=:©Åw€³6mÅÔª0^ï ¤„EC'òƒíÓO@Z]Ë–ëK™ÚjúüH¼ÇGìX»l˜8êz3+ë¦LŠ8Š.;s‘´Ã1×€ +”ï|,áj!`tÛõ¸ÙU‘±.ª¼ˆ6f<§²n0læHÓ¤»46§rtž\,Páf6”Fª8 ‚DW î‰Ý +Ò1’ÂßgtàðÚ5q´ÁIÛ¬)w­{q>Š@) +¾°zìÆ©ÍZ\³'5έ.DÎ9OD.²ÝV)h¬Ec¯o–ï×—szº±gfýâ…N[j€§ïf6 ”z&$zöRÔ-Ú™NDš„æ¡¡…xkÆ?ùž¨2í2•Ϋ¹Hbjˆw-?J¤t¯NÀó˜Ýa +ðšúÓ¨aß‹“;pd‡6&j®pC–¹aðn2Áh:îß¹ò\¿Ã«ãÍi^¿G=ÛÖ´¸éÀSQ ›Mµ·¡QÿÍŒçQ +=ç|TäúÆÆ÷jÆ÷ÅÇû†n†¼ðxSšî9ëÏnN,? ØÙ`C`²©Z;ùb¤ÒBŠ »Òz3$Ù¨³ç>Aüc0ÒÒp•&+NÃVÚó<>‰][9b.)Köãc43Ø’èàË¡áΙ«¹ö–‚$å|uN¢§¯(™QûH»Iz`„Çè®ÆÌ%@]N¾¬Gÿi‡¼©u41G¸A¬OßÆÞ¶gÚ#>JÆmë*âgüBL~áô Àw Ö\¢w‚´gmR+?«S;ÿ+# œË”HOÞÄ»ÀÌþ¾Ž\°ã ŽÈwl ¬;$U$u2öþÕg„ùº†8ù|TÍ£}ñý)Ižy,6úO%±M+H'ÉÉ©ÂÅʼȂæ—2¾ŽFŸíàÍ$ÊÀ¾øejÏDD'Œ@¯Âñ¢ŽÇ˜fƒQЖ§q ¹Â@!ÄðB‚ÆõäùlFOQ{â¼4#ûúM{gÂÔ.Ô«¯ù4I_Óó¾µ &G2AÈ(ÙBa}ð‰Æ¡«!‘þGU¤àÅ[V”\®·¯'IAFòèLåÅ®ÒúOèè½ñíuÛ™ µá÷­ùHN¢›S˾À×ÆUoaso2ä×"xEâHäÇ ýQh±GGè%NMåÃr‡¯_‰b]G•Ç‡-¯²ÎÖì Äh‚"pOÜ΋ûl_±«×ä±ìœÄÌé'ŸšÈ†KÉË7ÌK^lª¬³‘á‘4Ëì( Û-?·+}D­-úCøIgÏ÷BÐ Ìù?­þ±Æ¾ï¬»öÞâ}o +=^0Q—ž æ⯱l}ô¸ò€#SÿŠ}Î; *Ñäd190”¾þÛ»Ó ¸œVz¿ýŒm1j{¡YÃid…MÖmѾ°ú@ˆIMk‹´Ãqªî±¿ÆßìèÒ>”ñ-þâžT±…ámÛ #VLÖ=ñSÌÆ\ž> ,<«t`6í¾c£Ät)b£„í%/éÍWC1ó ‘³6xh›õG“‹û¬3C¥v›TÅÃôLóÔ¦#àÌ,ÒrÙI8Ú2γÃa¼~Î?õŸA„qüb¾ö°=~5N–òʼn„)ÙÚÑÓ Ü7ž®f<êKó}EÌåCCQd£4ÌVipùbç/[!"'vg-è’¬ËêaÂì4­ž“Äœ›í{ãmÛ·ô3‚¿\–ZEU-o¬"7sõý výÄ$P/‹î©mŠ¹ +?þi>pl¾£`ïukNn«œÞ š‡0Þ˜¿{=íŒÏ¹'xÓ'_œ ·á/jøíBã0™†*m#@ é±µ¬0.¸|à9l ýç«•:Õô.f?Žõ±?ñ?^üØUÉ´Öö|v¦½“„oš*ÿ ¯$¶²endstream +endobj +5510 0 obj << +/Type /Page +/Contents 5511 0 R +/Resources 5509 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5503 0 R +/Annots [ 5514 0 R 5515 0 R ] >> endobj -5305 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R /F35 2976 0 R >> +5514 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 414.689 154.005 426.379] +/Subtype/Link/A<> +>> endobj +5515 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [186.528 373.436 295.642 386.337] +/Subtype/Link/A<> +>> endobj +5512 0 obj << +/D [5510 0 R /XYZ 85.039 781.388 null] +>> endobj +1222 0 obj << +/D [5510 0 R /XYZ 85.039 648.722 null] +>> endobj +5513 0 obj << +/D [5510 0 R /XYZ 85.039 607.695 null] +>> endobj +5509 0 obj << +/Font << /F56 3312 0 R /F58 3380 0 R /F38 3057 0 R /F15 3032 0 R /F20 3021 0 R /F59 3455 0 R /F41 3054 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5314 0 obj << -/Length 2608 +5518 0 obj << +/Length 3575 /Filter /FlateDecode >> stream -xÚ­ksÛÆñ»~Gm‡`Æ„q8<ÝéY¶ceGµäf2if|@ -#`P²Ú?ß}š”›Ôµ-ã°·¯ÛÛ'¤füU³$t=ÎâD¹:IfYuâÍÖ°ó퉌¥ ,'8/¯Ož¿ £™òÜÔKg׫‘Oè¡ž]ç¿8çoÏ.¯_¿_,µÖŽJÜÅ2Žçüû³«…r®.ÎϾǭÀ¹„×÷ï®Kå\¼û–ñçÃå帷H´s½øõú»“×׃Zƒ@P!E~;ùåWo–ƒþßx®N“Ù¬=WÁvuJ¹a å}sruò÷ï3¦:f‚P'n˜èCèðˆ tä¦aH6h›¦ÿÓbú¡Ón³lSuϯËsÜüË'ø3PÆÏyWôy[Þ-¿çUª”Çëêq{kêÞtŒQ›ªò«³^ž-Ï?\^¡­f¡ûÉl©ðl))“U9cþP qõ˜#Ÿîj—eE×­v›ÍãÀòYßl"ì˜%<£¦6]Ê1íF:"©g··àü;Ë¿Ù‘j€4ÏtÁ @eŽóž7~ì˜zá§NÏ8=’è²ì‘¿éÁkƒ pÞèÛňiizDxe'D%¼T¸_Xi°F`kÑ‹QY4*½ˆ¶ˆš%NO2%/òl–=Wóö,ò÷2^ÿW¿ -ÿ¨[ÉzâHâš_áI¼ÿ;}çšÌŸN‡~ìm>1¸YáÓ^²†®³2uÎ;tհѲ3d¸K'>¼‡VgOXŸ„™ -1nÌÖt9aÓ¢»Í…$ãçœpÑ‚èV÷H‚Å­Ó-ÁÄAZv Â>=bÑÓ)ÄÂW -ã% õ£„’,].ÂÞ6]?áÉèþ>¾½kPï~yÎ~”:·_î'Š¤Z^¾©€÷7¼F ûQÌFñiÚ; i/w=‹¨Y<gy1›ëº„~¼&iäúaü;ŠøJè…G‹ZÓó€ß“lˆÈ6¼ì}.CñÔ¨“…# -fJq™XÍRÏ èhWy1]˜Z¡;áM|vJ‹­=7áì·™r½ M5cLÖ¤ûx$<¿¨ÔìUZÎ&Š -×åÈ–ôTÉ$ ”ŸºQBÁL\*Rï‘BÏ÷¦˜©ëypF”1!pŒNY1™…÷‚ ´Óçfƒ®áKa~ÀUƒÌC-øåŠ7ɹp±EÇi)¯öŒØá¾rÐëê‘8ãÒ.¦¤¾2Õ¡ØZFp}ZïE˜ÙqËÕ3õ#ö)Øå(ˆ*f³[ãÂǨ¥§ïú蹟ØÑY»…â½/DÇœq¯(Az[¡0´4Y³®ËQZI«a¯»e[¡ô®‡¨)òÃ~Ä@Š“#œ$ ´óó"´¸FQqžó‚,϶ ÜÞ`=m{Æ£âÊ"zpm|P"1=?7…é„ Ëàðãí‡K^tåº6›}Ñp #i¯ÝáQê™­¹ªvÕ %âœ+ð`tNÏìD§][Æ›I¯Àºß1Ä Ä»:·½´&{ÁÍÂ]‰îŠ{Ë·þû— ø¸-)3®ø•¨õ”óñ ¥ièª šMòÇÿžŒ0ßa‚YîWåG_¹I|qfбvSè\l:Á$¸4öË:HÝÀç´c -p›ÎùíJŒyEΉ {ȼà‚]›_.[¼8ÏÉŠ|G8ÅŠü¢ê#gÂ#­¾†úÒ–¢‰³2U³C?‚ҶŵÄ4ÑÐM7 z»)s¦iÐ[ÙÁ…B:@Ñ-G3â_NzŠ•ʳŸ¢aä9…ôš·¡=0}NðÚôŒ<Ë.xK©gO0f£¦=L'ÍW9·å%ß#e$(isiOÚaHÔíØüB.£¶›§À†‰6–I?®ž‰¾€ºß'ñþa7Dà†‘1e²×Óæå¹ÍŠ¨Øµ z:ž8Hþâ Fœ'#Ö÷bˆXn]^w“.+ ÍFŠ²â¦íÍàÇ+ò#šé´°¦J#Epr -Âo„˜ ­ƒÁšÌ4Ð2å¶WD™R¿’œ[ÊГ$*v‚ ‹Õ-CLK …ÀŒ+{Öcfh±Ž"Î4e.Õ—ídàÆ­azÔëd+r>åü8f-ä8…}™“ü`HØMK}­{bŠÓ3ÑœlÈØ+Ò×ÚŒcº6ÒTØÆ"Õ´"©02á ¸/õV2€y¨ƒEg3^³Cùy=_Èh§¶æ¡‘Ž(Døm Ÿ\_‰a¹L …üÄŸ ú´†N:öžÃKy~äÜ`e”·ìZ(cÕˆ0nuS,ÚT<¿Õ¹Õ*gÄÏý i&™=\åì†RôþïZÀC ³´ÑØH*žô«Šû9€Ms*‚e Ì;Ñ -íË`Ö~ƒ‡n…‚AêF᥻mð69¿®wì­’ø –ÙF‡K.s@$‰Ž\‹C–䯼KwdO&ö]ñø‘K{ô$…£‘·d㶌 OBáÞp|=­dºY„’ØÃÄ~B9Ãø4ÍjÐ$ÐœÖÍ ç­¡¡|<•JqQÛ–*Ñ+ü°zÅ n?éî>‰~Tu&ÉñA*Œ\òîz)› .¤^í:¡†Œ -êØ´ïêÕþ9†öÝx˜¯Î~å^¢Ü³%v¯ß/ÌTÿ€ç¡€$žç®"WGÖHÓæàϬùsP½}AqÛ{^ª8pƒÐž5!Ú÷CRÜŒ†CcDßCAuÈß÷¸`çE.{7¶šÃ¾©›ýÌ°ûEˆs µ…ðJÑY5dŠiòŠZ9XîlLv¯cÍÖÒîžÅç– y)¡&Çå˜ =Þ$ ËwCôiƒžCž0¹õùű^ƒ/YSvȆáVëHº„ý‘}µuô0ƒNr;Ë›œó‰:s[2i]Øjªé+/=ž-UL€ðW0ú̺ÀËOûÞA TŠ²µmG“i}Ñ1çAéÕzb*>ê†zy04ÓºiÛ#[Oå#<±ò­qiÇŒaþ?Qsî–7cwõ\¤t㇓J4ïøˆü•7 Ãá"³Áù{†YíO7Íz= ܸyì›$}›Àšà'tóøJ/•n„ Ó—:?‰©ÝÉû _0°¼`Æ÷tlå^3;]Ž¥Êý<Œç¥±ÄÝǹ•Gd”Ø•ˆ öa? +$Çì;R^[5Ã×@lp÷øpÝd¤Þ%¼ÖUi^¿íªÇ²ëù¥mð?9A¿b œ«‚[nÊiÄ*2›Yp¤}»2 VñŒoÊ®„AãÈ«`‚ž·‹0óöëE˜zHQÞçƒ)ïnÏ|Ê«hÐX¬KèÐb n$½'dx€÷BE]óÀÔÊLTM² +.…9~ß—4þ°°s„Ò#ôÚ»¡RÑÿ†ë,‘w¼gHN½_U¤¯úqO²€¶›T (:R,j?'q4-rgÚkÊ5ÛÓJŠî™Éw0 ”ÅÞžA‘‹0÷âí˜gÓáºii¤JàZncA•L¬#É¡¨Ñd'ÄIû†ÿ‚ÿn +ÒÉJ^Ú~°ƒ0?κ)»é|4:ªe·ƒ™Á¤:ÙߎÙà˜­ã~FwÈÔnù¿#¶M‹]žz¦­ÑtiŒþ8ÓßK­µhÚ »Ã'«©Ž?­ÿ­9?ÿG †3~¨ù¯¨Çc[éQE°/ßl#Lý çm­÷ÅVž¶åðÐÒÁ“éö½;ù +§}æÞÑ:LZ\õ“ŒŸ<ÿ©œ9 Žý〰´DÓBƒ¸?mtÜn‡Ö¢bϱBUúŽE1«ýýŒîÂÀ-Kù±ê yN`×ð£ ðú06?”áeKà¶a¡¡¿£1&ûGòë[sR ÓdÓØÚ ‘ÒªŽ%µT!L›ÛMgÙ( ŸÝõÂÑfýˆ`€ñi·ØL(à ‹8sXmøur‚˜t×vèÈÔ®í•oÌ ©°—_¥û£•zY©c@3ÝJ]¡ÕÎÒ7{C*— +Ä¥¼xmŒPŸøNY>§XUÐí[ M 3-¦ØÙ"v¯“wÉ´ Ñëìe%ÌÖš!h%l°™ $Aæg:k|¿£ †Ø2å²i?‚Ž¹¾š'¸1£|˜1zˆ²’Ü Ð?l‰°ØÝã5l‚Qø0·k‚SÓ:CÈ3ÉIÀ;„ _¥«êžß×-‰„;5`þkƒýØ{`piÑvTÆÈ$`9sÌóð7”íÔ×3ÛÆÐ7¾É™Ã!ÆTͺÆ·N y|žgç?}GhI»¸/ @C3ÆT(/|>Ò?óWl@å†e‰Ÿ'>=P¦ð —Ïü„G££ ð äeíw=kËm£ÃWN eÌRIÌB@Ñ•(ÒDjHåŒDÃ(÷³ÀHt¿« ½b6ŒRÑîçÀTg>,Aº2Ìè*òUlT°)w8hÛW0Í  ÄŒwg$H›‘7²¿Ç¡ƒ#¡ã£‚ѶŸ…j¢OŸ<ýe'/8:y`áE³á‡qw9‡ÆuÍQJˆ8VÖ¡X‹&s !§ø½sÐZ ÑlüOþÎŽâ„SŽm)sÍÚ°QƒU¦'b\‘1«ä>°@R/Lß äel?¢P´+M ƒmÛR¦”ïï3ù-ž®”0“rªDÔg8­f8˜;=7öusÇÃA±És6)|³§ÈÎÀJ…²Ç$Iý84vq›|7r‚'T&äÄÄG,äŸc‹ç¿\ó;– +ºöÎÀ'`hEmCh ,«[åp +†MŒ‹˜ó‘ÿFÞ ƒsÙs;%xH'¿Þv¿ñ›ÉtÈ8òÜO£ilP•ë ±uï®üÑχ)ø îGÿÅ”û¶ç3E/(Uç2r_aÙ¦ŸƒPíÇy¬ûrxY$ý‹¤ß®(Ùb4È;•KêëÀð#ZÎx-gÂ`k·“ôí3ÃF`NFÜë–¢÷mAèZWÍÒŽšøŒ²¿¢frÝÀ·YÏz¿ë‹Í•0ã‚QO‰“ÛRŠZKˆb<×¹€Â 21$P.ß"þÜ0Õ š R„òlëS@Û3v1¶:¡¢qèW×oÎ_á ßžqozyÓÜŸ1Úd9¬~_±X²°Ì¶S «EL¥ÔÉI>Â4vq/LÆ=¤Sî‹”1§7”=zк-6èèhŒ£€…$‡¼XvB–¢±ÙsŒN!v \HØ5ó‚Ʋ6Ð%³›5“c@YÛ%RÖce‰ºÈŠ'Qƒ Yt“L=æ¨j‰uõ›økðõ¢Y›¿¢¡`ƒ­À3YF¨³ƒOTTЙ'érÆEÏF„ÈÝI•ø0SçÁ¾£¶LxÄ…ÓF|ƪæ5°„8TQþúÚ)Bþ99ìà’NÑTfÚíLý¢ßuA’»œÍOê7e7×ö°í¥‚¶±‘iôã¾€>—q"ìØï˦ìŠA¸wfcÜ(ÉwM&­› v¶RRtê””5Ó<ç¦ÀÇÒ Àè¸(4V’ïíë«_fëT@1PPn%áZÇÅ,Ž¶Åy×GCL Ýb]V¥²lTO2©òà+…ºøðÀ>ÁíFå^ÓÛvz,˜I±˜Ó).ÓàÏ=l^²a$>= ‹½;pŠ·£,Äèš¾ZÕåAm†kHAvã±u K¸T!˜rg§NLJ³— R1xáü… Ÿ0ö£4ùc>¡\øpé;I½ŸW¬NLŠJ:\H}¿[D'†HvÓ}õÁÜ鬼í˜Éü<{i$2qüi·úo¼\|„ÑQÑQ‡ÞdX“PÃE‰èw8hœàü±êU¶¨O¨þXÙYâ«@Û.æ°RpüÁf˜È½~zÁ¯$Zøß”(½Æk):,e/ÇÑ3H™Ÿ«i¥læÚ­ߦí¥ÿøZĤhÊ,ÓÛÁ1õš»IssB®¦GLÌojb<ØëzÏÅh¹1‰”¹™QA *HãϾ»ª.g‹ç‘Ú°V5ê{à‹'¼¢àÄu4ÖòF:«ÛÑcm¸sÊ0·%mEé=«$I@0/lȧ'›SøO¦ jm®g&ÓÙ ýÏxKè L6´KmÄtè`ãÄOãü]~ᆌ­d/ñ ø2~ +€2à$D'böÐ~D, v·AæÃF¦ÖÏc“ÃÏT¬Šè{!÷}â{!Í8ϼ+ó‰x&üj¥>,ñ«$û~ú3kË¡ÆógÜÕŽÑ\@ƒ+œÆ­ôU”\¨d3ŸÁ®_ߊqç€7ù4ê¾¾Ä |Ç«š}ãU-a›ë±6L2Á3>OƒÔŽÍá² ¿!:œH†w¿qB:¦¦D&´£¨”gd¯ƒ¤ŸüÏu;-&ó×æŽ.±Dà‰Á©V˜!ˆ¿¡OÑzæ ôÉ¢¤c±v¿Þbš\Þ "ápt‘.×ïCùQ&B8ÂÿjžØ~‰C½ê%üT~BkO•M<¨@40ý…¼»NÝØLNò +“ù¤\Äöe­BܦFKÿd~Ùá +ݾYàž \endstream endobj -5313 0 obj << +5517 0 obj << /Type /Page -/Contents 5314 0 R -/Resources 5312 0 R +/Contents 5518 0 R +/Resources 5516 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5311 0 R +/Parent 5503 0 R >> endobj -5315 0 obj << -/D [5313 0 R /XYZ 85.039 781.388 null] +5519 0 obj << +/D [5517 0 R /XYZ 85.039 781.388 null] >> endobj -1262 0 obj << -/D [5313 0 R /XYZ 85.039 373.935 null] +1226 0 obj << +/D [5517 0 R /XYZ 85.039 761.463 null] >> endobj -5316 0 obj << -/D [5313 0 R /XYZ 85.039 338.624 null] +5520 0 obj << +/D [5517 0 R /XYZ 85.039 743.459 null] >> endobj -1266 0 obj << -/D [5313 0 R /XYZ 85.039 267.041 null] +1230 0 obj << +/D [5517 0 R /XYZ 85.039 300.07 null] >> endobj -5317 0 obj << -/D [5313 0 R /XYZ 85.039 234.62 null] +5521 0 obj << +/D [5517 0 R /XYZ 85.039 264.66 null] >> endobj -5312 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> -/XObject << /Im1 4096 0 R >> +5516 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F58 3380 0 R /F81 5323 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5320 0 obj << -/Length 3379 -/Filter /FlateDecode ->> -stream -xÚ¥ÙrÛFò]_¡õË‚U&ÌàÌKÊWec[k1åÝJò‘„5(hYÉÏo_3 •Ú-—…9z¦{zú†çü ϳØt~žf¡¯³ì|½= ÎoaæíY(KY:0/Wgß|'çaàçA~¾º÷‰ý(Öç«Í/Þ«^\®Þ|\,µÖ^˜ù‹ešfÞ«Ÿ^\-BïêâÕ‹Ÿp*ò.¡ûñâýj± ½‹÷oa~¾¼ü€s‹L{«Åo«ÏÞ¬,Y!#M¿Ÿýò[p¾ú< |gçÐü¦·g@”GZúõÙÕÙ?íV<óª9Ä:óãLò Œgx~DăMø55®ìÊf¡2oX,UyÛbÊî× 5‘J½ãAÛÎjo+Š†;C÷(–×®ë¶/‘%p ™CB˜i?Ér ±õb‡^Í€ZÃÈÏ-pŸªÈÜ´HÜCÏ€è¨.¹]~½¯ íÊŽ -‚çöœ)÷†éí`¸)å|o¾Bï¾nqPfé U³ÁÝŽ÷>x¾ óÌr ¼œH{äè@{~”WýÀ­®ìq-í><DZÌ{Ä-‘°-ÀÓGîÜT³_ðOÉ{"3y«k¤ÌCÞ¦^;àu€\¾+>[`å¶lÓ™Õwã¹B³eÕ3t#[¸bh·t™ -Ú»rI7Ü6Ä2jô`6dd¥œtw Ì¢`›‹hK'{äÎ5¢ä‘Wô•a?jænÛi¿à^M…Ëk¬Ä"èr”8þ™(øHDµ¥‚ví„žd2;<Ã-£(ö^Ü eÇ@ã-Â>wÓ[£Ón¤ÕïºÒeKL\—'@ÝV{‡Ì.7R·(Hýš#R|•l~‹-R] …âQVÛñ&‰þcwŒíOx¨f4,8ö@œê>#ÕÝÈ·Gl{’$¾R'}ÒBæ8 -]„~6N`ðx ×é>²0Hü Œè ldÝÔ¢†ÊסrÑ}¸7Ê\àûQ³Dåàq"¹Ÿ÷6,t,Ò0þt$.‰L"7oï@æÝuw-·èïæuî‡Oqq„9ÁFz’'ŽŒÜÃ8ÏIãËÎ -‘•®A,ØJj’ÊÝž ÛŒî[G ôi¶Œ0'Ø"@O²å‘-{çÙâ`œJ_yÕÐψZùI`ìÆ%80nd}R  Ù÷(qÅ×rΔ䉧&®¸i1ØenœE~®â“Ìu`Ž3×=ÅÜS-s÷1Î2×ÅøCu‹¶¬ÆÏè™]ÀèÎŒ/×uE–þ³ø>Ç#üŠS?SÉi~0'ø%@Oòë‘_{çùå`¼*kñ­3¨C?†X€^µ ¸áÁ÷Md³ï¸?H´¢{½¡ð“Ù ÑêûUôúw+¹ãŒX#Úž,Euø8COåŽF\4=º_ -—P¶k¢lŽ´(ðƒh¤,d_ªƒŽ‡_?ÈRŽ\!°ÁH°|À†%a – ‡^²ØÒè†Gg  n†~ÁzqÒè®—”˜`‰×°÷ŽL‹¢ÙîjÂb˜ÊA8îy#ã`„ÜSx\B0%ÔU‚ÞD=ˆê0‰´òóÐ0«n1Æ@±ÂPk>+Yš%nLr‰Çp#2¸l°@'­À!á#‡\¥èã̽ƒª¤@&u5äf‡bä|VÿœÙ*÷ƒ<4•Ã`\ts;gAÁ«à¯n -2t`eÉ@_bLP4åÇRÁFúwý_ì>ÜG¤y—\ Öù9*M¿k)9‹0™˜#X9¬)ÈÝÈ>—Ѐ­bg()JE©Œ> 4ûú\ò -“Ü»ïˆíÆHã¬ìfdÄv_Ü–˜q$Úf]£Îc…‘H›“¨bßf制½îp7“Üï o¤"3‹;J¡˜Hž¦{Á)¹Ò´1 <{[6eWÔϸ;×Lv¥Ô XEQFƒ]Ú ƒÙ­Ë”ößÊf-7òý®B¶Ñä]Yq&ÞK“3©ÍwŠfmŽ¤QxMŠ¬CÚ [+wKé®6Ü €¼Î}H[8Ýïáþx€ºœø²ÎñªŸbJmµ<¼'!0³Zd‘#0r‰Æ–ö—¬T{«;ÙǦ«Eß -}Û1"çmÙasq•rn•æ‡Y0Nã¥ádÓ -Ô£U(øóe' ±Õ†»¯Í^_¤º`w|ÇÙì‚ 3ÂÚ²vnµ.9¸fCâ*¡3H–Êo7žAV<»œñkD˜»• Cñl†O½9¦ëÇû¡ªkjÌÑÚí½Ü.Ú[!#Ä{Ù"Õ -Pw|Á±ch Ã%[á‘i…G'd=DX¹<‡ûØ}öºüR­Þeø3žçÃ$î co fbæ#66$¡SßRÞë¶ùûb\ ~˜[òÞö Ю(z™á1Öð -Vâ©Ã ÈÉÍÕÚ¾Û 6•EÃ5º™ØU§‘Ÿ%áÉØÕ¡HTèçh"mÕTC<el4ÃÌÏ0SÀ€píw—>®yè½x$­þƾëŠ;Td`à5ÌÊP²£{'rÙ3i0ŒShF–ý"¬#ÇŒR?|ê˜#ÌÑâ°c¼ŒÌã¶ÛeÜp·ØK$5ËwzZ÷ºÝ¸] -P\³AD0S*´;"µW’e.Êc¨ ÿuɃ¤ˆµõZlTŸ‹¦9%ÝËŒîi !%*[~¬î£à«âè$¯˜ãéz*:…ЦCûgÓ!#Ùë̱‡²†˜02±(™Œ‘©–œ ØÆ(µ3QY¢ü,5QÝ-6ZRijoñ[óxCBäØäÌŠÚ>è~à‚ób[QÅ4'&ˆà LüKݺ2ö•vD³âÔ+dÓ¾úƒºÏ9°ÌA‡Â|Z”ìö„­@Ë\™Z¥$ä\žÜþá«[Âh$zŒaŸ H •KÒÓ8Âœ@zRO %pã¼: GaÁsÖ†‹ƒ) »~·½™Ðl¦làqfÜ;wStíͤ¹ŸçÚVãÞ -'ÂWË$^1š -¬¤ -|G–ªI²}qƒ:“óñ*7À¢á‘ê0ÀCÒÀÑÓ GrýØl¤\Îâ4ˆ„´SàÐu]É Iϸô ²×  \®…–Í^À!(l„Ä{J¶R‚à±ÝpOÁ;wÉ'âëQ‡z~¬JÀEšó4ÿ°ÄfÊTÞÉ$g@{ác<[®(üiº²ØŒQ4@ÞUne#rM™dG ób”hÌ8¥b,ÌGò½Ð½¡ ~˾æ,<|tÉA:WõÈœ>1gwcÌ{òüCáŒS¡óÃ8É$‚V;B 3“dƒÅ"Á ‰2=|U M…û2çN¤Lë}ÁÅp;n…:ÁжíÊ~òÔCãN  ϱ3 6åEŽÅy®Ý¶¦3˜².èÍ ;$á7ÂFMðv%YaÙ&Le× D*Hz(À”ã%mH‹ëÕwàgãÞt‷˜z“Þpá5&±Á2Qu„ä!ÜôEó3WnŠ³ {C•[~dfœc cš7|²Qo؇®„Kw¥}v Š’øÁD¯6bA`¤7.‡é‰sq³ß8@ -þ’5Ï&l\xÄÌå9‡¨Œ•7³)´ßñõFºV"bÉÈ°1>'bð`p.KÃñi–vÈPLÙPÕ'¨ïðÃN¥¶>eͯ×8…8Uf_±åÆz~ý·ñn…F­¡‘ßÑî•&#+y-ÛÔI^ÝZ0•+Ϋ¡*(BýƒHØÈ ¦«àÝú²é«kþƒâ·myHÏ"O~’ñšSkÜò¨™±w‚e-w²\îY5{}æñ0±[ý]»«ùV±[5¤“pŒæqÄZÄe=8ÎP…GR/:¨zÐî‡%b—â)×(¯æðÁþÛÅ2ÑÙ~µKxẔMoËÊ ¯È©˜J™,mÅ}¸3þ¦&–úüSYn•:%7f“QÈ4·lv"Íì†)9;Š–uoËjkL2ˆК´Í:hé6‡H¶‡,±éy:Ä÷{1ŒÀeSÀþ?*ŠzäK@Õ‡˜Ùµc¡ÿo)f³l_äaåX§„UüëÁQØ]%²sž¼Fûðh—œCc¸ÂùµC5gj²y¾ãnK¬¢ó뀃ؤhÆ,ÓTðMÖ«>C¾9þò`Œ³Lì.U"S-¢ûé×Æ`ô†­ö)NéÃF—¹€¯cÚJYJWÜR€zw¼îø*Ÿ‹×á?_þÿõ›4›fDÚÏt>óÇJù*4´ KUpb˜ß®ü_h=~·endstream +5524 0 obj << +/Length 2440 +/Filter /FlateDecode +>> +stream +xÚ½kã¶ñûþ + p2sER*@€n/×Ë—ËæÖAZlïms×jeÉ‘äóèï ‡”%[ÞškqÀ™‡3Ãy/Ÿ„ðOTÌB™MRÅ™Tj²Ü\…“'Øy{ÅF8‰X˜Ä¸õ—ùÕõ_ãdÂC–…ÙdþhQ櫇àõ÷7wó7¦3)eÀ›ÎÒT¯ßÝÜOypûúænEÁ|~¸}?ŸÎxpûþ-á#Î/ww?áÞTÉ`>ý8ÿáêͼÇÂ,bQ"‘‡ß®>†“°ùÃUÈd¦&{X‡ŒgÙdsÅ’Å‘tßÅÕýÕÏÚ‹&tjDҙǘÉ)u"óxDäU5*Ø—°]éU3E2 t¹‚…È‚Ýàn 2@ôù¹CƒÃ38mì'J¤ÑÒÖÆ rtId~ÍqÏÝågÏ×?Z.9Èí©r +GZÏJíJ:MíºÆ˦"ÞéÝàÙï1 u +稊ÌJ:_›½ÔÒ³†;8`Oz[|F½A \½jØ‹ê)‡Sñkå­z¤ßmm#^ë™XYØ'„y>Taš¯á+‘Á·ªmmðc×´Gĺ÷Ê[V%‚ñòéòÄö5¨[ÐYôgCŸ–ŠK†R“ß®FŒ5 Yø…l^½`ó)Kwû`RQă¹çÓq¹ÅwYùÒ1M;ëöQõRDð”9)JŠÄºÏ‘DÞÐ/W„¼¤X¶2î;/ £:†õ÷´wÎPߠ픥’Ô¾,rC/ßÿÍ"•·è›‘ +–ºô?Ö }ÔæøHƒ&/—nn_Qð³á$DzýÛ@Ï + âuõTëÍ€&ún7«Q=K |kÚ~ϱ ÝGC¬O9ñ’¡ª{Ö[©Í³¶¶E¯8PTµZ´J‡z0oóGŠTÞïÜ ¢(šr(©=f[w9ƒœ‰ðÀ6§6‹8—CØÊÂ<ŠÑÅGç Ç.mˆ”…]Qš¿c.GW”IFTí +r™€g:›A.„ÒR´‹ûêêÝʃW í“ÇÓÚJ‡õjuB婨l*èsk½Õ™çhÙ|ç–}=ѵñ?©R–ñèÿ‘»·m%µof=%’KÂhà).¹‰HvRðs¬v5écœQȪ6•ÐD/f‹`kíØŃֿ5û4PäÎEÙð˜¼Õ#–Kø"N˜Œ¼Ò¶.<—Œ¦C餱Ü,rk©º>8`—Bø1ƒe9P D$Æn+1½<Æg0S%Yª†šÜçíšl[ã‰m]YïÏÉ, jˆÑž@tã’<]óNç]MEš„·á6(CdÎ’¶c–€Û̲ˆ©Èž´U?Mhñáí ûÍs÷p[Ÿ¥€9(0äéMI¡õõʃ˄ÏêP/–Ï1(.f‘:/ÈS N¹<)ÈåYAŽ±e™+Ux,˜Péd¦WŒÓßÿJ-ßœ +–Bÿ“DŸ«—² by`«2 |³ív@²s˜ éŸõ"‹™H3¨ÒÖ«Õ±€ñM>€ Qúfý'bߦóà¿!K­º¹kÓ.¯½Yèë•%ÖŒœZÔÕ¾1`Èfpö`ÆŸ '8–«}>0êx®J4¹ËH)û:oEÞ´£–ò5}ÖUÕžî˜e)$¦L†âRÛ +Qšÿ±) R,MÕË=æOÔÇÚz—òfW®È49öq2Z¶h*Z•Æv°jÄ”Íη'IFnÕ‚Pgb"® ׶­=8zP:‚ ¼ñ@\](%ÿ^-£˜âI‡3(©jÇò3<`CüV%9Œ<ÐÀB|m†Qç—÷·£U¿…ÏæàÚYWëlFGÀŒ/*@áŸ7ªˆÜ¨ÂÍ#|‰ÓK˜eë¡UI°;Ä¥ih»u¾ö…góÑ ‰Lÿ÷;Ô=~Ó‰Pæ üizyh™c3"”r‰ÌÑ« +±©û²ÈáP ù B³Y°eU>Ž0Å`|io‰ ›f¤ Gl¹¢m Ž\fPÈ›GNŽç®b. •ü¾‡ÄÍÖgÎ,pƒŸÖÏ©rÒeAWeOTt dtXtŸ td˜Ã½tcTÜK\» ?Ÿü]ӵ氱°Éšvö'ÃS„]š˜âUó@¤¨¬„4î,ÖG¤Ï»¯µò8dBÃw÷ºÍ+ÜÂw‘ ̓¿¸(º©¬›…e±a4ñ‰n>Öæ·ÂîY +7€ÐIjr®Æ"“s`ÞœwŽväzò¥ᛑôAdœAwÊhÌ !|¹¨õ™ßZ6F¢¾eg*vhßÒˆ´« 0Ê|g_ÀŽ*  +£Y’›5ÒæÅ7š¾þ}Ö‘AXäJ öK²\ŒHvš@)Î :ûÁÙÖÊi´J”æ¹í7Ž³U»7ƒ¯þ ¼,”¶•éÕvRÄÁ2[÷‹÷ðÔ6ýÁÚÛ§©`现nvº°ø§ª@¼‹Þ{{Ÿ(Š‚ÝLÖdoæÈ[‹…ƒÅŽº wòìs"‘øJ…pãi£ëWÚÙ.F¾·Ñdr‰è§…”ÅiÒÝ) /ZæJ! J3„¼£uCOv·Ð¸6õ'Ä4õXêˆ$ë"vµC‡ÝÚÿi`pÖ~C*O £ÍR(3O˜NÎ?öÇ2š„Ù‘ÖeKavÊ(OÎÛéÿ}Ⱦendstream endobj -5319 0 obj << +5523 0 obj << /Type /Page -/Contents 5320 0 R -/Resources 5318 0 R +/Contents 5524 0 R +/Resources 5522 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5311 0 R +/Parent 5503 0 R +/Annots [ 5527 0 R ] >> endobj -5321 0 obj << -/D [5319 0 R /XYZ 85.039 781.388 null] +5527 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [289.74 561.481 356.43 574.383] +/Subtype /Link +/A << /S /GoTo /D (prtdollar) >> >> endobj -1270 0 obj << -/D [5319 0 R /XYZ 85.039 374.861 null] +5525 0 obj << +/D [5523 0 R /XYZ 85.039 781.388 null] >> endobj -5322 0 obj << -/D [5319 0 R /XYZ 85.039 340.115 null] +1234 0 obj << +/D [5523 0 R /XYZ 85.039 719.265 null] >> endobj -5318 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F62 4047 0 R /F41 2994 0 R /F20 2961 0 R >> +5526 0 obj << +/D [5523 0 R /XYZ 85.039 684.159 null] +>> endobj +5528 0 obj << +/D [5523 0 R /XYZ 85.039 547.733 null] +>> endobj +5529 0 obj << +/D [5523 0 R /XYZ 308.69 553.1 null] +>> endobj +1238 0 obj << +/D [5523 0 R /XYZ 85.039 239.425 null] +>> endobj +5530 0 obj << +/D [5523 0 R /XYZ 85.039 204.015 null] +>> endobj +5522 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F81 5323 0 R /F20 3021 0 R /F18 4228 0 R /F35 3036 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5325 0 obj << -/Length 3307 +5533 0 obj << +/Length 3716 /Filter /FlateDecode >> stream -xÚ¥ÙŽÛFò}¾b0XÀÑ$›Íc÷ÉGœ8ñ1O]$y %jD„"’šñüýÖÕͦDi†‡}TwU×ÕUÕ -¯ø^gÚT~f¡¯²ìzµ» -®ïa懫P –²t`^ß]½|§“ë0ðó ¿¾ÛŒûh?Öêúný»÷æÇW·wßÿ²X*¥¼0óË4ͼ7^}Y„Þ—÷o^}À©Ø»…î/ï?Ý-–¡÷þÓ 0¿ÞÞ~ƹE¦¼»ÅŸw?]}gɲ„iúûê÷?ƒë5ÐÿÓUà«<»~„và‡0½»¢|+é×W_®þm·â¹øšWͱ@«Ì×™:åA¨gx _1ñàu¹XÆ:õŠE”yø§èÊï`,K½a ‡+H€> l×Õ»Ú{[>T+Ùâ#@·‹%l±.xU4Üh˜«Ÿ¸ó`ROU0ÑTCE˜Jä°ìüiyrpkoß4N0hÇãÅzW!!»•áŽ‰iîþè`Ø–(&àÙ2D–æă®,zÜ®Ej£Øë·í¡^0%‘vè…NKt=Tíhì¢ê„p`¦ZaKÖ|li‡uÙcß°µ ñZ„ÙhÕ`f¾Ò!d§ž&CW”‡ ]~ãe‡‘7÷ÕÀD ƒ6tî”l¡jV‚é CÉ¿r:sà†„ ½¥¡¶bžbç7’¨Š„xTŸbØ †uBÈ™5¥ueÔ5!ål¶Þ=±¦‡*À©Àòÿ˜ÉlkKàX±´¨Q *«hùûé׸…šõHįðÔ[å]S>36 -þ8„H‡Êa óÞ3!|N_ÕUÉR* ~«€¥h †ÝÞ-2P«nÀÉ -ˆßìP`;R²~xNðˆH¥Þ=1¢1錉âœÑ¬ÐÛ1 5¯íÍ´ÀÝ’ÔTk²J%Þ[Ÿ;\ ·¬ïÁ]ˆ•0Ø”â!÷šA±o‰jœMhà‰ŠŽpÅ”ª-ÖåZ ÛƘ-ðø}OT³4þñ'ßý¶èJn ¨Ö„ ÊÛ–õž[íÆLû¾ºýM&;þv{r+ò -u5ž -CÏ7„F©À€„Þ. :T6Ž¼*tjJ^Ѭ¹q¢p°†¨B î¢!tF½žµO‹VOš Po ]¬úìðpæ£ØáÂŽl[¹_À‘Z“ʼn®üuµêHutäõí®äÖÍÀŽÖüU³[»áEh]»;5g2±È›åADü# R£7Å5•|‰_ðeÙAã‹ø2d§Y×¹š‹òXê$Ȇ抾*{`Y4½ ÚðwÝŽÆ» uâ ±É&±<ªÝ¹ñÄS+$d[ÐzA=Éí š!¶ñ(Ý»¬!Ú~­j‚ŸbÉq»BL¸¦PvÈ€0`Tqsìãaí O• ]Ÿ÷[A¼Ä0¶Äû9Ç¡O¼>(\RÅnæØx¨(]A„.ÕÜ_•Q%„SÆóò·þ¦¯ºÑõ øÞP‘TW"gZÙòw[ m{¾Á›ïð›²!âìÆìU®{ùZ°¶Ÿ’Ü”Ü0¶§Žˆrc“8,'™¨ð)¦BY&*ôþ‹l²T¹fŽá%ŽñâÁþH§ÊSº-@«Œyà4ßäkv=q,ý2úf^þç–gEžkVµV¸Ø dRÏ ­ Aì¸SÌ 9ôx¯²ÏÝçkÃÐû癘^ëÔÏ¢äb2âÀP ‡N ¡Ên„&¥Çø ñ3]Dh`N0NBÿ0Œ|FŒ¯;+{‰0Ž—ï¢ÀÙ@'~$€W~Ï zò¸Pèüé@oU’ÈdEÑ+À´‡nÛr‹þ®ÏñU~]Nò˜ | gùzáÈ×#Œó|u0¾cÕ;½èÉ3 -‹)t ¾»;Ç“@ù‰ºÌ r# ó,CÎcù1E7ÏŽÝç½ÉŸ$.3w+2dLäzU&ZG“žÞ²/úµ £ÈÑË[ð°‰xZÔÈw¨žÅ·R6˜Pœ'¾NsY¿i)ï;+Œ8h^”†s^è9y\BhrŒqV".Æ«{ÔÊ?£t5µ7á4·¢ÈӟǪ†¿ÃñIçîŹ«ËºìÀ\àž=˽ Gîaœçžƒñö%Ü!öÂÎ3 òü„U8†IâŽàŠÐ»—>q§¨»²X?1¨-8`g[R=F‹nØÙ&爥®[[¿±á‰KQ]ô·z7Z*ÛæEÏ3c˜³2&Wí—s9QEõL;ÏI:Èü4Ó—%=Â\´=+é GIaœ—´ƒñ•XGœ +±ÁÒi‡Àð•!¤–‘åÞªé“å»19p™Jòf#ŠS×…ÚOÒѵa¤B |L;|“ %IYa›ª©è•É¡| ®å\ÛZïÛóÁÎÆ BBÛÕ”7mÓ”«á,¡IàG‰!T±KZ 'y‡nLá±Æ“€ç‚éûx?`Á'W£e ¤­Ðv“ã×±YÆœƒjœ fB%7(î‡éJη6­4Øã$eíiŠ‚æ³”sº¬¡™NYumrup§E/^XÒæfêm]G͆=F++ƶ¹` JǾÎò‹êÀœ7Pôœ^Bh ô㬺h…#íXp9UMðÝij´ìÕú,XØTîT1uäy(K†£“1ÃY2Ô*Ù43“È£ØI¸öºä$"’·$¬Mq¨‡ž,Ù?'¨(õãgädA.ˆ‰až•Òyl£¦èæe4¢{ã'(¿’ØÍ-Ùj7Pªn$Ê( ¤TglAÛ•ó͈íúU!Iá ¯@O‡›5±PLÉÆ~É|V‰.³x„¹Àcz–ÉŽ\>Â8Ïæ F|ÞJA4ÂàWrHC¨ñ—IÈñùz§àÂçËw€×Åúa¢E‰‹ý¾~š±“(ó•6W”T¿Q÷”¤Gö±gÀ)Ol"I˜É¯Nû½´órmQ‰è¨rÕʤ0¹*}ÉHÇK -]nîë(œæþ.¡¢—R„f±Emjl¨u#û`ºäG¸Ù×òMÌ5øy ‹48 8¾¨aÌy 3@ÏiØ%„VÃŽ1Îj˜‹ñ7ªîÕ" ¹j_˜Š:°Êõ ‘Šj­0`¯cVByÑ#Iî%øay¹aR¥¸0•9QRÖ^[´œŠ!¾q©uR¢Sô€5ã¶ÎJðà~ñ⥇àHû4Ü}ܲÇ‹úæš&­Ÿ¦¾ OÄ%Ü}8tãe}¦ðˆSÇuM¾îÇ¡6ÕüÞÞ;Ó'~7Ü´Ê:̱28Òq2DÙƒð!‚ œŽd©<'P7ÀJ/?_rmG &Ôs›Ð3¼_ʧ<@'9$̯gž‚‚Ä­êRŸ|´Ý9~"¦£C³.¶Ùò¨æÊ×yœ©¯Ú® ¼YdzÝw(SGïQfÝ -NÚâÖ!V¾â®$q΂o'猟)pcAî÷â´úCÁ콓u ÐÚC½6Ï Øý5ÍeÊoNpÞaîÓ-æ±¹rÍb´æ~Xó€öÐTR'‘0]OsµZ¨®UpÌL‚=Ày[Aï!:¬Ë‡ÝøÜ‚#üfÙ§r«z#ã3ãeìÓŽŽ=‰Wç¸~Nàâ0ñ¾Ðã)‚?èãØc…W.¦ÜºYq…cåˆLÒÀÓýÊîÒ Ùp†Qj¯hì`uÄÒë¼âØb“êS>»Y?9ì@¯§6ˆˆ3oÕ¢~Ð5?:ÀÑý¼è²gA…¶»šÄn¦&ªƒ¼Ì2­–7œ¼xÅ9‡•5£M°-ðn+T)˜ù\Byo˜¬„À¢æˆ‡N×Ï(Ç×Ñx±k‰‰TÂ÷0®·ïnΰ=ÿCÚãü¯<ø)MM~ó…+Öóïþ蚇JÆŸ± 5&RSÉL%9ïf¥®>œ¥Çy%A€Ò“³¾¢±Î¾ìï*µ¨Ù\ÐfÓ_øÏþ_¿ãkŸÊÏÔ™ZG‘…†<@dÇôšßûü?˜nÃendstream +xÚµZëoÜ6ÿî¿bq(p2UD‘zÐCÓ¤½4׸èÒ|WÚ]]´ÒVÒÚ1püÍ‹”ä•k\‚€—¢Èáp8ß ¥Vü©UùÎVIª|¦«Íá"XíàÍwJF+ãq„¯¾¾¾xþm¯TàgA¶ºÞÒëâ÷òûo®¿ùùr­µöTê_®“$õ^þøâí¥òÞ^½|ñ#¾2ÞxüùêõõåZyW¯¿ãñ8æ—7o~Âw—©ö®/ß_ÿpñÍõ„…µñM¬‘‡ß/Þ½V°ùÃEàë,]ÝA;ðU–­&Ò~d´<×o/þé¨ð;³âY ;]›(õ3x·ÖŸ¦fiLä›HŒÒH¤q̇=îáù·a0y¦~hó%ì=Ž½ç倲ØÀÞŸ÷ùá&~¼ÔÊë°³‚Ά^—]ÏÃÿûP4*|“fÌÑS̪hÙ+ f™7ìKnaYÜ÷ÂCû`@ ð¼ÆÈeÛð›v‹¿) …N­ƒÀûšUS0õîp–,‰]u‹ÝeÇ]¿Ê@o-Kå‘Öj{È€Û_­•Ný8Á_8ÐŒv±ípk™[Ú¿¼¾ú·„RÕàz«2Œ¿·Èd‰kÜùE¼V GëEÔ*ùdµ¸éÚ»¾Ìo`sçÊk_Åñ\9š“…SŒ‡êñSž:õäHì¨W*¥cÞ [3Þ£ÐWa"“Þ»ªxTª&£´ñuldÔKdüÄQyÏïgl)åI&ú}Þáé©ÄãâÓé­I üèåÐò瑩J>TÙÍõŠ”Gí—Ä­båG™eù5ý€–ww©ÐTø×}&•—¸òn¿fÔ&ñc˜=ÕÀ\gÂÚûVð±°_ûÍ”¬ÞÒ‰÷½Ø(iÉ6ë¢^?Í5‘wí B%Ö‡v†^?TuÍÍC{Y áÒc%¿[’¶rÕ=?Œ¢ãçS_5;nŠïq8uc`‘¶ªÚ  £¦²Ña{÷7Q’©È£Àw“šº*YFVòÃ¥½›¼/Q·ø­sªq⇉µD6†÷Öé‘V…’kàðÅÂѬÉ|ÎÎvƒÂSÞ!?Fþ‚\37sö.¯0|½]ƒà!¡H?Š‹éøw*Ϲ*FSexÙ6M¹ØðQ¸ ‰V'ë$¼(:äà¶ä§CÙœ˜°ž2°ƒÄšÝß—Ì­Û®ÜP¨+ÙY%ƹ¯Úu9; :FÒé€Ý)ú«1N7ÈN›ü"ÇGiWØîÙk"ß5w³±G);¡G}sFnÀ¥i;ueõJœ9úEƒpº\DAì¿ŸbW’Q–c·ù€P„ Å)¥•ZÇ¢Sڡѱ··B5:±Ž¼ã§¾ÂcÀÁK››¶A(´Ãve~õjËÔ@!&’Äñwœ={ê¦ùy—ˉØãF¤—0~ŸsˆåãÁIy#"áN%" +Þž.í)‰“k¬“Ø…˜\xˆü(ë#ñÉ ÏfNq-Þ£NÕ‹‹¯“ócÓ6몧É';çÌ÷ÄàÏÀ'¬“ÀOt4µó3¬¯ KIè¼Û™§3 Æ~§‹™ä' +½]?J‡f@‡[vøœNä£ÿŽÛùà*@G@º‰'zÝ^¢å­%¢ÒW~´ë‘£ä;„ó@ͼjËã؆nhé öÐóù@.I¼Ûʾkø÷5R¹ævÁ˜%g‡|¾‹ Ã,n”Jµà§{iHч[ûœÛyí`ö÷Ü}3ºÁ²á®[|_WÅ\à©ž†ãj¯flÓ8€DC×Ö5ã¿ÛÀA0 ¸¡ ôÊ9¶<ck»keü ½´°‰S@<6IMñàK+O$Åòê]‚:Rpd$¹x4<C ‡EzÄ}ºmÜtì®úéV"¯-:SP¾ÆnÂÎa•¿ÇÚ‚âÜO[ºÛêK`¨D¡Ñúø‡2 ˇa»Ó‘g•ÍmEDPYøn_Râ5.?üç4ûó ur©Uè4rBÇö‘Ö¯ÄTQ»ïªaßždè„Gdèž²…ôKŸÆ¹=D¹ûq ŹöDÒ|^›¡×²1.f,… »„ÎÑKhDlÖñHÏÖjKÇCw..nƒž9Ä£‹”÷oä%‹#zE]pÖî«¢j9*cA‚Û-á™ ñeáÇ!?JÈ–îéžPÓÆ0èa “Îó²ÔL*ašx_ç—b¦‰÷‹õô$™6çNòƒ)€mS‹w»º½Éë÷O­.g6T­,‘÷üËYq]#$Üj«üÒ +iê”—‹E ³pìHcŠ)†"–üîŽ\Ý`ËI“Çàsà’A)Ù]ÑrÈÐ2qƒ5qE)I³ æ g(Få§_Ö*Ìü8Î>T Uø&Y­qZöy@g9<’Œ!ÃK?9µÃÄIÐwö¼Û%¾ÑÙÿ“Û© ôƒä3r»¯Yõr‚ÖZaÒ͆m<]dä™ÉKC›ÝžÁÐó jsÏJÀŠñÇ B Õõ(©UÚ|~2ŸF¹jhÏ| šh»³Õ&²AŽö‹v’ûARFj¦ûÓtL”—ñÖ0€RöÔȬÐòÝnL§8½·^€‹vˆØÅœ´ }Çn˜ñ íi©rúY’J¡õÓKw­„ +VWÖç=YmýŠD9äÅ|Ü3®­tt`¼ÅRlœù:É>£{½Xx AŸ]Iõ ¯ús +¯à~Á6’§|z`Ó¼°…|WîÀ³»çÒ¾pš7Ž]y[µ‚pÞ¨]6–­ÖaˆŽDOáO€,Ñâê¹ít ¢$$ìÝ'”2'˜žï™ÔH™?R†™ bbhKˆRNè°’’ Ì%ZdZÛ¥K¹LÀ§TÅü;¡n+õØK,´§J®}‹Ö>ˆ ]U”O HrÉ6cª»ñF:t3Ð/V7!dH %Ì®?×X‡ ’Ø>gD•ú‘Ë¿u~êz/wIïŽt÷)V +õÅ{†GoIqrº…’±¯¬Mv¥ýˆArt¿P™„Àœf°­•¯¢è‰P¢QÌ’§\ŸÜÁD1?àçìþ*â#þew‚Ü#W¼AqĵDE£C9ÊLr_D‰7ÿ¼Á]›ØcFŽ·Lîü6„ºÙ- +£WAû€íSMÖw\tœÓ;\£Àuñp“î ì{)2Bn5xp +/Ò Í;à%w3Ž›ç8y=ywr5›‚ïg6CÛU0UÆ€ˆýÎ+h¼µLÓ?ù†¾Jõ¬ðÐÝ:Ü!{FÄSù¥ÿLÊ+Y¹ñ<Ÿ²jföc“0ÓNö†¬íîùÅ$jSÝ9œÔõãRQ±$‰:ûÀh¶¥0ñ³ÌyÙ¾ÒBH0ÍëYHDÆ7mç¼?rБÛ>bË~¤E'œrôcK¸ÐÑ0*ݤê˸7S~§«°1O©0}^ivÁ„ó¶m]Ïj¸ÆVo°upQ\G-+Ñ»È床ÊÄ5­x?L +Ÿ4œÐ¶ƒ0ÏAh7TÂa(^{é,M€nƺ† „Ðx³äãðèÕÀj_o2ëÄ`Çr÷²Eú\q-&™8œçà>ùÁPÆHõx†'ôqÃXFJµûÎg°ÊXŒT±h},ŽFÛËÔq$«õ0«o(&Wœ8ו‘§}yÀú/YTÎ.œ7Ã0m?##ce“§Ípê&XÇŒj-ÑB®5åuLF(²#Ì‚5±%ŸWpN& —£«hÀç}@©p™N›þ0P‡*8¯”ÈGbÿ%^)¶endstream endobj -5324 0 obj << +5532 0 obj << /Type /Page -/Contents 5325 0 R -/Resources 5323 0 R +/Contents 5533 0 R +/Resources 5531 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5311 0 R +/Parent 5503 0 R >> endobj -5326 0 obj << -/D [5324 0 R /XYZ 85.039 781.388 null] +5534 0 obj << +/D [5532 0 R /XYZ 85.039 781.388 null] >> endobj -5323 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F58 3360 0 R >> +1242 0 obj << +/D [5532 0 R /XYZ 85.039 185.292 null] +>> endobj +5535 0 obj << +/D [5532 0 R /XYZ 85.039 149.882 null] +>> endobj +5531 0 obj << +/Font << /F56 3312 0 R /F58 3380 0 R /F20 3021 0 R /F15 3032 0 R /F81 5323 0 R /F62 4159 0 R /F80 5161 0 R /F38 3057 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5329 0 obj << -/Length 2999 +5538 0 obj << +/Length 2874 /Filter /FlateDecode >> stream -xÚ¥YéoÛÈÿî¿B -,XÌ\¼²@[¯íl¼ÍáÆÞn‹$h‰²ØP¤JRqÜ¿¾ï˜á!ÑÞ‹EÖœ™73oÞù{Or&à?9‹_èdÅÒ×q<[nOÄìV~>‘–baIšŸnO^¾™~"’Ùíº?'ðM g·«OÞù›³ëÛËó…ÖÚ“±?_DQì¿=»™Kïæêüì-.ÞßÎÒ»zÿ3Ó#ͯ××pmkïvþåö—“ËÛŽ­îB`!Ažþsò鋘­€ÿ_N„¯“xöß—°¼=¦üÀh;.NnNþÞÅkfÆ»¦Dà(2ñŒ¾3 mð/ UYfËÖG›÷™zdFô•Š-1øD'Þ‡’£ó‰‰vƒ‚!Sž-t¢ý0V#a.+2£:=¼Ã_hzŸE šM…R¬p*è eÕòPÕl¸³ÝÀÛi)å?ëìWøé˪\5§8ÃjØÛƒˆñÑ…iÑTöÌôëÜݺs·Î»Iòû6³‡vÖ9²ÐÙñ=Ÿöpl[c bP°ŽËŸÑæäZ Hâ…‰oBSß3- -­`Ýãð³¦ì‡äT:^çR¼0¶ažËKþkÏ·³Ë"ÑñxÀ- ¸EÓnóÊn.*RÛ¢Þ±Íi|*kF×u^’‘½¸5P@i¹â° ÑWxéwŽ’‡–©}•8Ë\W$‹¬öùP»zñüE’aâBé¡€MôS¡­îñëÐáÊ œ‚!Òì\¤§É‡Jø±‰º0Fó«ðã¹W%‰/„:|ßîâ+²¶oœ•áJ»É9ÄaÐÙ8h»Ð€³/úìxÅAÑ*@<'# UBNý¬ ø8ØJ`áŸ×¼Fé­Zwáš $'KN &92Ÿ hšWÎCHY|½§ËÐI ­øÚ¶qw(­üeÙÓ›7o²ãË RTuK:ÂSÚ£«Í‚ÄøFF¿WÀ˜¢i°²pg-‡'c_w÷á?îQ8oßZÖ9%̶K ôÚ×sÈqœ]HU2JÀWäÈ®«špA˜Ñd»í´GnŠZ$÷_#/!æýÆO¨Ìy¼UÄyxù?Ô†k½Ú ýPˆ©«âHKÅL8 Œ€$ÿ˜–ìY‹ÁaZRÊ—2în<Ò“ñÞÁàìê½~m÷We5£A -Q22â.â`¶Xr¶‚3¾0äHí‚ÊÈu»œ …¿q›ò²ÉW.ƨŽ#‘oV±‹DðŒª¬FýÃÿ¾O„ !(r!èal,x[Õ1áñ̈Áâ¥=…H7ShÂç­| -mÄ¡GÝ…)-ƒÍYB;Ìß©5á»-k¦e›È=ƢОyÓ¦|ëvâr·6`ÆwÐh¦|¦x¾RÐÍÇ(ýO_˜ Ù¤uF¥O8f¿ ŽæˆPPAq—K®†É8(XlzŒ'›}–`,OQ§ÆáE—kž$[qùÅöåFoõv‰P†MزäÃmCTߺ ÙXVu FWRÐw_c0?’ Ìõ˜ÜÈeÁÜ¥ÓQJ;&¤‰`ʦgÙAÆçuŒµ}½’3ƻݸ´nQ½¢â-#Ó °†þö寞ðXàêYÐÇ9¼Bú0»ƒlàŽï“\?{¡£9ºq#¤TYÔèF”¼ŒId%-¿Íô§œp0|8}PADÔ³2û–/ç @ú;2¬€t—XFŒ„€º„4WÖNí)ÔGž%/‚’Ž\(ÿ/ˆÀLr(a«Î˜–ZÑ°¥ÁókrTÂÒF¦ïz -ÎEv•µi^tE¤„ç±(éË@ë.ç&OØŠ‚:A?ß’ÐfWu=nÜRùË­Ë%T!î‚eËsÌ…¤Jžní–”ÿAsœ‡ZRP൵M¸xH× IäA3$€Ú²¹K„÷ÛTK–Õß^R‹ H.>ÜðÇ =†×`Øéî/¤Öj»cöòµjE`aë‡öšóWŸ¥6†ªO^½/Q@øù²ÌÚª0Í£}“Õ¯ê -å…ã@¹âv wØsÜç>LRÿñ׫˲­ÝæýÛjw6½AF¾<èÙ#/øïæìÝOg‹›Ëÿ¸üˆã75Ët›½˜0´…;jð°A#ä›»ßÅýÞ¹ˆƒNT„”ƒ<*¶?äÐ/=í SÆ•")yÓ7¯V?¢&„×rþâ~}ì.¥šã”¿¹ð¢€O]f‚VH¬çâÏ -.ÄØmœ¤ègꔓplœ Ã]}}ïáL2°¦ öHëŽl˜àlOýX -ßhØ¸Ý ˜ÅÊÝùÌAO\@O3AÔ‡$š´!ɱ÷oûÏW;÷‹oJíßakûÍAÔë`°«ñ¦©`Ó¸¶ÉäÖRð»HM»öµC›=+Ð2-õE;c0A R ±U‡Ö)2FvI0ŽIÁ0í¶“Äèør}è¾ûNo-ÒR±û]Ë.ðMöçOœ8‚0wPòäšÝ„¶ùvØ¡Ö§šWøT2…®ÅÌžõ‡~Èï[>Àw2Ð@ J:^ø§‡äß@Çàú˜áÿêÒîendstream +xÚÍY[oÔJ~ϯíòàÑÁÆ}ñ—Uœ9‚0KÁ +ÐÊŒŒ=Øž„Hûã·.ÝžžŒƒØå ­"Å}©î®®®úê2bŸ˜¥Qªl–¤"Pi:[mNÂÙÌ<;†"œé Œ#œúuyòè÷(ž‰0ÈÂl¶¼$’eñÞ{òüt±üíõÜWJy" æ~’¤Þ“§sá]œ=9}SÚ[@÷õÙùrî ïìüÓ#Í›ÅâÎÍSå-ç—œü¶tXðu c…<|9yÿ1œÀæ'a ²tví0Y6ÛœèH‘V¦_Ÿ\œü}Ü…çôŒWMÜÔ·¾ +ƒ4Õã•E4qååºìÊ˶+Â-í­ðNÜ¡ÄF>ÀGű—ó§¨Æ©ÕÐv·<:ŒƒDxŸæ¾L¼²nç2õnxlXÈ„Ÿ:œH¡™iÃÏûmW5“¥Â!S:P±¥z0±O$21óyþàÆB±ˆ A¿Î;s5¸<7Ê|5¶×æÆx)3 ¼j0—ÞA§3×¼Åëµ;ìDxM ƒÙf“¡EFf¾Œã ám>MÆ,ì¶[’SÛ ¬A5.ÿŒ›–¬gÃzÜð1ßH¾¡¯U«Ä‘܃¾ÿ %LäÁ‘ÿöý·J¾Kã¹%Iäý¾2òú²».{n]u]v¦ìÓ÷mÕíDµÇïWØÏ Ž8;×áÜUþo'dÑ£,½go%O_,žŸÎ}ȼÀi½]çÿ<}·¸÷¨—g‹ ¢ ì¤×: C÷”È9d±xòg<Ç¢½);ØêèÍvá‹$ "¥]Ä8B!“ EäÍ¢ïÀ)0]¡Å$NáM3ÀÜ$¹wZÂ>ܲä‡ûD€è3‘‚ÒËx„20ç 帇²×å°–ÙaWˆg©·-»MÕ÷hÂ8ÑB£ÁF?ÎYœá³/p¥Lh„`üsÚt—ýxt¶Ñ³§-0=Ûó­²@‚“Iò•ƒÁéŸG +M¿+ÊŽ»øÜ +Fò˜.L›§šò†û¢¨£öÁ2ƒNfô" ’}‚FÎ$ˆl-ÁËðGÚ¦4K³"à mÅ«¶)•‹wmÓóÌfצ´në‚ñüÄ®||WôR)3Hc1éÓ¢@Ãc‡£µ˜ã‡P$w÷vÞݧ´³çäÛ,ÙmÿùŠ¼c»køþ8¶ëIötCɲ‡QRSñ`&Xù¸½6û9o’óÔºí;$Lj­‘êÚxC÷æ Æžò<½|'æC…UP ÿüéZv;ƒÝR°×_ÁÅX"‚»BôYT@¤‰ú?} À@x ¼v´û2Ðc«Ðw^Æ™Øm{MŒ¶ï-šÙÙ<쵡Óä÷äŠ!çÎäÍã;Þ|ÿr[‚Z:ŒÆMOûnªÆÄ7®@bH)\_Wýp쑦A/U „¤ÙW¨2‘ÄïXJ¨!Q|(„è@ PaÍhÄ9€JU×ÜÝë/lxÓQ$…ͽÞ}ÏÃôxŽE=hƒÞèš©xÀ˜Ó1Ø°m% DW„F¬f„˜ãfÉ­6ñ¢i¯'ÂK!uˆä»ÂTõ_†©î|ÄR˜ù Ž\nŒšuÌ7EÔùÀä›$žÄ$.\P›‡Dq؇ÍI±ÊÞ®¢ž¡)¾!T–©«Ø>¥»QP…ß6õí_xêÓœœµ "¹ÄóPOêáR”ЇhÖ‡ÔMªøÇb_§ (¿ë² \àú6Á^àÁ#%¾>½j¬õûœ;k’﵉èq„Ó«2's“A[Âø—]EùE1¥€I¤2úS0ýVž$À*›'1ø\£Í¸×Ìâ?ôrÒ¬¾%Í\Ù˜ ," ‘ °þ¢aC€f@츫ÊÞ€øïª5¢1ßÜäPJÀX;¨…œf4¤«(ñ@OÉ0üúâ{XÕUÙ åÀ}jºÏýU‹¡¹‰Ø{µe33 +C7Y0B–F:ç%ߘ¼™ÃE[ü×}†ý3铸PWkv#þH²Fs†ôŠÉGƒPÛg‚ õ˜C<¾ÓK4¼LG`¹!¿9%IPe\Á¡ùªì'˜@UJì]éÅ¥ŽÈv6³¤!R›4ç ‚q "ù!ÃœB÷ BÖ"ÃY²Ñb°3B”5¬íÊ çÅ㌪¢³1k¹Z%cðÊãÎÕ©'®AÃ/´ý„]fD°@“ÃlŒ¤‰"ãÛÍB$Þï(ûüë¤X#«²b½lñ æGåKCïóT£^P"ƒ L¿&W[›|¦ë,IÇñ ™A5TyÍ}ôþ4vÅt"b2„OW±PV‰“ŽɼM>¬pz]Ž³æ,w­}‚Îð4:—®4Â1wteS”è—çù(zm8¢u²ŠŒ7Øÿd"V֛ㄠüT%Óå>_B6ï៘ұ ß" b¼Î  À·¨+›#^qç)]µ2Q 4{eh¹ô~;š‡l>Np ¢Hã{˜ESÑ·}ÍóÃP"t +P!¼ÂŽ#3ÆÒþ’´¦F\3oE>Çʨï-Ç ˆ#³0ýùå8heâN98µ±íA¥K‡A[3ì7ŸL/'6Õd’öTŒi…F#1·ÎŽáÅ•"ë3P]’SZ¹âr(ƺ^1BèyWú&B2Ñk5ÌM½áέ"Ä£«þÖ­2 ÓûJ×ÖˆþºJïd;º×€ÇÝ™|¯(xwû¿i]ŠÒæE#yqk¢í–‰w¶iN¦À h\櫪†+S0XfXY®mJ±wÃl†o$n°iŠsëªÔdhx*óF ¡œf9:M4L!(¢A×x“šlLî× ëªç– c襢̻0D—9ñ‘à[ò6†•Þä90D` ßr³ÆP8eÕ6Û½iXµ¨ŠÜ€AÖ$¢‡‰ ”Že•Jºvk†Ë†# ìÒeàû¯¹ÍÃRÌç·–thb»`4sÜ$ ‡ŽSŒMÀq›7 ß{K';¼o?Šz–“SF([ëœD¬6‹ÍÑ;¦FŽ¼æSŤ|K~¨eoÄ?Ohç‹UÛFb0Ì¥}º¥}’…tŽ~ép_½§×Ä8ðõ°·F¡‘_þŽÂ„CÃC%#X´w˜M‹|È©šÐ[ Æ èÖZð“Õ*7§lñZæ`º('^[²ÈðòŽŒMн«)Ôåæ ¾ý–«|Œ¾” ~Ù•½Ì÷eŒÄ»$f6Löò‚p¦‘¥åll=Z€–Þic¶Ör@«êÒfJáee¦†®¢häó-þ fJ”ÃTÞßç(&“}Ž2QÚ«K6ÅZ{oÑàÌ\3þ>…)kÕ¯lžÒÛênvPÅL=Œ±%Ø°kI¸é Ò“¹µ;´ã .Ý{kœÂÒ›ó³w£QúnÍu`Sl›ãêµÄ_B$%&÷DàF,?öÓ¼J±ñ7uU +qôSc8–Áÿ!Ôšendstream endobj -5328 0 obj << +5537 0 obj << /Type /Page -/Contents 5329 0 R -/Resources 5327 0 R +/Contents 5538 0 R +/Resources 5536 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5311 0 R +/Parent 5541 0 R >> endobj -5330 0 obj << -/D [5328 0 R /XYZ 85.039 781.388 null] ->> endobj -1274 0 obj << -/D [5328 0 R /XYZ 85.039 761.463 null] ->> endobj -5331 0 obj << -/D [5328 0 R /XYZ 85.039 743.459 null] +5539 0 obj << +/D [5537 0 R /XYZ 85.039 781.388 null] >> endobj -1278 0 obj << -/D [5328 0 R /XYZ 85.039 484.308 null] +1246 0 obj << +/D [5537 0 R /XYZ 85.039 264.811 null] >> endobj -5332 0 obj << -/D [5328 0 R /XYZ 85.039 447.441 null] +5540 0 obj << +/D [5537 0 R /XYZ 85.039 221.061 null] >> endobj -5327 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F35 2976 0 R >> +5536 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F81 5323 0 R /F35 3036 0 R /F64 4225 0 R /F18 4228 0 R /F41 3054 0 R /F65 4251 0 R /F20 3021 0 R /F62 4159 0 R >> +/XObject << /Im4 4715 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5335 0 obj << -/Length 3197 -/Filter /FlateDecode ->> -stream -xÚÅZÝoã6Ï_‘îKd fE‰úÚ{(²Ûv›vÑM»9´‡¶À)¶ëb[®$ošûëo¾Hѱ,z‡b+~ 9ÃáÌüfèèËþÓ—y¢Â¸¸Ìr­â<¿\l/¢yw¡…b.$sæÍÝÅß$é¥U—w«aŸD™$¾¼[þ¼ýöúöîëŸfó8Ž«Ù<Ëòàíûë3|¼y{ý§Lp ÝŸn~¸›ÍupóÃ;¦Gš¿ßÞ~À¹Yw³ßï¾»øúΉå‚ÊôÇů¿‡—Kÿ»‹PÅE~ùíPi˜Þ^€P*1±ô7/~t[ñœ¹äUc*Hâ\%y|ªŒè UÒÁÍ,ʃ§Ù<2QPn6Üè×p¬ -ÛqÐØŽZÑÁ¡ã^ÇÄKÞb·²¦\Ö;ø>Ȇ»%/©w]»×0µ{8屄f[Â}ªötº+·È°â™'$+gQ<óæ¿…I¸@‚EØpK¼0Ü;~œ§ÊhÔžü¶©w=’^¡P3FÁÕm‹c´òHqi¤òBÖ7$—sc -‡ }×SÐìS:ŒM¬K”“Ï„#9Ipi-«Uy@©ûN¦è =wV¨ÑVC{]‘ÀPMž7+fôŒ,šwˆÕLu–1 Ô>‡¾Ú-¾"Í1Áƒe_2ɦ‘~# =l`¸†¥íwL¸€«îHGá‘rV-hË^%œ[v§ƒ¹j;<Ÿ1ÁìâxÏ$t4Rêó=ñ­Ž6b"2±G«t˜ížó{”–Œ ð@Öì7•RjÆz5Ið7hΑ—½é1¯J‹éhäHÈ#˜4*6©çˆi–¨"NH7 -T| Z£'Äi¼kú]ç¸4vŸ)q<š³!…(ÆþA­Aõ“&X¶¨ZkÏn˜Ì*Mr{¶­#7$µBx -núãmU.ŸyhF~ꮺ€XøWœ5UyšÉ±ʾnvÌöžl‰Ûì› ÖbSW;œèENÜÀI9Læ´3"u–ª "1³ß–Ï#ÎM«,aßàë?ŽQ‘=:K-Z„‘” ¿.àB´å‘…\òºÁ“¸_÷LÓð©dÁû°÷[¨MëÅcQÉH^ÍSÛráwMá\ØìX(ô¡8 -Þzæ`]÷ä_2¹©ú«Ž§Ù§½c[o>åâC ÷¾œZB~Æp$‡†!æQ«Ä¦PJ‹žx¸¯÷Ï ºƒÑ¶^ ÿG™s¡'·s„©·P ¹6tÌ0øf– -ßH@Ó–Û½sÏq¢ºq m†{{Á{‰ª^"ë~D5ÛrW> G‡7ø¾b‘Ðë"-ö Ã.X£¬€=}÷Š'È+|Ê=²Ü»Í>ǹ8(;ùâvŸêÎÞnP»xÒÑ^™Tµ´Y€eR¶åC[bkÝ}‰1X×;ÙÌjãÍé¹Aíxíq‹†l‰ô[’Y”  Z#ö?Íp–¶nÄIpaÝuh*‹™yHIEw kXËf2óÏŸñb+îì*wt é)VÐÄ }'Bc_î-tq…±®þ·l¶jd¨ãÞ¿š{nà•µpÎSE¼¯úÞíéaܵá/%bبLÉ/›Ý•t»¾i0ñvúÏ®&À/I"•MÁGãàO«£ƒ›$ÊT‘¥üé@c€MÂà#¨&#ü -³$ -G’ ÀGj~ØcL§p‚gà{Õ³à톂©]ñUkÓ¤Oh@gŽ%*M¢éc4gQÕ±Êc.9îØB°Ñ®çV'p#QVsà²mý°–À§E0ä=0÷©®žÐJª%÷!æ¡ Ù…Zƒ^òÚ[*)b÷Ð1Ù=FÓg¤Ùzœý„ŒGl ¤6ú½Ë5wÝAs=¤‡ÏÌû:Ý<ëeìëúöðð°ñåͽäÚkŽä€…3dÀk0ñX7 égC)µ —4V¶¶¾~/‹¸+ñ×F;cå’[ä…äßµ$izÏÅŽÀƒœ£W" 9"|ï9ÙqÝÎÓÍ’ Ã76v„’/…‡42ЋдÅ-Kĺ€vÑìVî]¸… ®¤Bû{¿vEÃk†/Š¡ÄNÂ8PmQTfYÏûòþ~fK¦¦à^nŸé:¢ä½°à;ÕÆÓºÚñôÖC‡rOq…ù™P”|´¬DÈ=‹Sµ¢<®¸ÂT¬$åÛb,^H‰QʹoCÕ&*hÛ`É„þÐ×U'ùÌHö©¡€·i+¢¥ÖÇGY”rÀ²õª^N4Õs¾‰«x‚à_EåÕ3— QaTaÖWá¦![kÙÓGÑ_k¼—NœÎ=ÀLJ‡÷Uoݺá95xæÖPròâC5“ -FÚ+i¡³oÙÝåÀX³'ƒ‚.²emåe.5ä]±Ý‹Ä@.Ë%b§F¬ëÛÊ¡\'å!¹5·]j$å®î+ ŸDƒcxííÒWøT’{ÜS¸£QÆ-P’ ìWÞ½!¹Âýof¬åI~|õš+<ã‚Óf†ŸæCKÌ÷V2”çh×¢mhKHÄ”$ÞŸðÈ˃ÄØc®ó²´q  -s+¤ã`Œ¯D|ñDv v­ÐQ ߟë]ô=R}ñËígLø3aìÿÌ}g_Ž¸=aÎ÷e ¯8©¸=ØZÂ÷Ö8=Â,¥0I&aFJJŒ¿=÷øÞ ñdM©!ƒ§‘áu Ät/¸愵l!áÙqd†1¹ÜgîUe'-2øRÑ€7’`ñØ£µ'[ysxÀf] ‚y;†%™°6AŒ¸ÈqŸ(è"õñXd8÷„ùûÖÅ ØmP¬6>UÉF‚uÙ”ÁQ ÉØ.ÇAH†mÛÜxB¢h {a×U"}å=8 ü€StÑ„xypM¯m:¶¡Â&0¾¨ÝX•ž*6Â&Hñr´RO”6ÆOW@L9¶¶ GÐgžkv=Y<$)·cRÅ© -C‹8K«ÓY+Ú7†§µ…#œñ+eÊÜÔGLQÝèfKÁuÑöˆR î×#Ü“DÅöÂŽXîìá(ûÁã6üµÙu®—/.Û gŽ²o¨ù%­PYvü¶zëaÏ×Cº£'ξå­p’Ÿ: -2´®;n­,U)/ŸØ¶ÛV6ºÕXP 8[ - þt©'¿áO[¼1þ.^.O‹EhD7ü6ô̓_n¹OÇkV¿ÜBð%Ñ^¿¬N2­²<·Ñ*…ªb¬:’¹G3Z»}PÁ×/yAå’Nr"‚i>p‘!xŽÏçΦ{º€|åÇãW®Rµ˜~¢ Ù;Ê"Ff\B&™{4ge´4T¾ä¥C£ Ÿbfi¦¹é°PEjŽØ}ðÞDˆ×ÕHVjr¥óÈ%¥PKû‚‰‰T×Ët«† -¢ªUç4hŒ*¢dZƒÍy - 2Îjp‚Ù Á)nNƒ»ŸjWlj[DE,~¿(æ$ ÅyD÷±  ùHâ¬e C ¥÷èJvâNËi(?¥EÁCÀ¾[7ü®„©ÖéEiæE’ú¿.‘8üÛ48(mªEϲ×rž…¼èVö<À…' F,GÇ@Yê›JsLœ(êB¥ªÒÔ¼ˆºÕªjyëEÕQÝsÖŒàö¢,Ÿ6£æ¼ òϚѳÁŒ¦¸93òؽwÕgþ½Íôm¹Ð]l¹£g[.ÈK ´[yÚ`îUOöµÄ2±s®‚~ôfóè!utfàöŠIHðhF!!Ïb·ªãÍ($LqbH˜ä#·ìóqÐñ+qã©ð/¢‚6Ü$Ť1z4çÅšIT˜bæŒq’›5FŸÝÿ´Î@$=­Áæ¼…f¦˜ œâæ4è±E“'£ñkQÁäé *àü9T€º 0ú¿ESdÌò½Å!¡Ç‚Låî/ PÂl8,ÂÇê‘“8l ŸfB›Û¡<ƒˆy”â“Ñ 8zù:c+Y¦ ›4•ä¬¥ÉdÜŸàäìdŠ•5×ÛüîÇ1¨™ôµTÃYzWíøŽ!Yq7­àflm[ÞŸÑ]ªHO'_ÉYÝ ²2çt7ÁÉénŠ•ÕÇkBw4€ïa‡¾‡ñSUZe§Ƀý‰2 -ý”y O®#?ÖÄ Ðhô…lÊÿÓ_`¹| þ–s&‚'QZ±²P°ÓáKyí_jüï‡"sendstream +5544 0 obj << +/Length 3334 +/Filter /FlateDecode +>> +stream +xÚÍZÝoÛF÷_¡(Ä’Ë%—}9øÒ4ç"çøiÑö–(‹(Eª$eÇ÷×ß|í’’˜ À½¢å~ÌÎÎÎÇof-Bø-¬Q¡Î™”¶v±Ú]„‹ysÉŒp‘¨058ôÏ»‹—?št…*óÅ݆¦Ü­ ^ýëêöîõûå¥Ö:ˆ¬Z^f™ ^½½ú°Œ‚ׯ®ÞâPÜÂçûë›»åe\ß¼áù8çãíí;[ZÜ-¿ûéâõÝ„…ËD%©Fþ¼øõ÷p±6º•Îíâ Ú¡Šò|±»HŒV&Ñò]_|¸ø§ÂcÉ‚WÍœôÒ͸ԡ²6™›¥J§@Ë#‰fÄñ[e§‡0*1†žÅ¡)ÍÈÌÐ|h@@M…ÿ?,/ã8 +üÑÁ”ß5· Mˆ;¿ü1'D2«’Ð +¥Û®j†²ƒ‰¡éð:Ú=ÜF”ô1TÐ]b«gjG,åÐ"! µ¢YÏl;¶¯ÖkÙhºë'¤ÿ_¤_,50°žÛŨÈÄ^¢&âCo:XÚîø¸E³ŒmðÌ#D¸áeœO=Ϲ¹{‡áç—?ßâ&‹ËØ&ÊÄpËÞvNäWuU©Uò ´ÝKÊ£ ‰´™Š3MŠÚŒHÜmA^Ú$A] tNm4u¨Ú†ÛUÏã{”x{_ÜÃoýÌcƒ[\´_å 42€Kòˆl–Žææd=‡ƒÛ`Å÷'»îXØ,-\Bû”4gÇS +¨«a¨…òX Ü~¢‰»%]Í.’HÈâ4Ný“΋Ž®. +Ô©Ax!fpÑÙ|h‹Ê2o¨c‘ÊqŸÑ2Àߤ +vˆÀí²Êé4U?ÎUŽºÀž®ztÓ®Q‡ú¡¨kht{Â÷ s:QQ¢¿n·¤±©5ÈÁP5ו‘7jèn7üK7Y±R–]ïhàoÈ÷Šª*ÞSÁ=Û¶¾ëçL2ÎU’gÇN`μ“X…Îî6-ÊaMv Ä‹ò»*‰íž”aÍm:²IãùMê;aþõg!|"I.z­S@öž¤6x·g“i©’ŸÈìÖl.=Ó~ =Ÿ÷àÇl¼˜1ãvïìe7gQDŒÃMɬñÀ~ZŠR¤q°­ƒ +Ø(“‡-¸Fgˆv¶m ¸µÔ5ktZC×ÐLL£ó§±Y‘½uç·_lp_ð'J¸e $Bã…72õr Ió(ÌTªí7"­Â,?Dr21€Kñ¹V±O‘© +1ÌÉ6ñ×ëJtBp¼Z¹™ˆo©Áá®v—¾fŽ¥à²ñhª#2‡²GŒ¢ÔÌ9ÓÒ•H¡Bêt4_â¡+¹!~›ù&'ðì°õ´<í±*eŽ7°Ü®œjI!Ûk:ÿ4vqtŽ­ŠÓüHš_±ñÀ;"l§äõ ëσ›# ì¶ÅÀ³¶…,õÞ?Î#. M›#-¶b§7ß¾‘ll”œ…Ÿ“¿€blJrŸLܹèŽü<¹  6 <‡$2:sò¨k¾´ªyp‚Í•NŽ²ëÈ?BÜÙyÜg(¿? +7<û‡ò±Bx¯AGX-º‹æ¡g_Aqî˜âvyL€‹PÀí@Lò'ñ‹Ð eêÎVdáÔ¯awéØf¿ ¡M[3&ì¥mtnx°°’x¾I¿ÜÀ™êº\£È!¾6(þçÇÛ³†2šiëÑO“€9Gšøænð±¯wùßä±ãžUž?ÖU¿ŸÊŒt&I‚Zã”K% ¶@Á2mr²y”­X†ú à˜Øÿ?f mnrFÉ·ÙùYr~†œßLi S¹B¿,™–s¾8Ê IKeÚß@9âPI­X/a¥fÁ¼ß5v~ëüžu`ð¦ÛÕ*ã¼)á2cG×bµ¢sÚç#­.êQ2ò÷Nd” Õø{¼$c,„Öh&©xONv$—)×bÃa¢lš§.Öc¢çÐÌ —Ú}EM4*ञZ–ÛàÇ¥MÓÄmɾˆ¢¢q…€HÔÎçû«Ì ‚ï³þsÀ4]!\O1 LášF|ŽtN Ò©ü¡SÃÛ¨Õ‚Ëò>²'Nhûd¦­V·À¢vóýLÑ3–$þ‹Õñ>”5{D)5âS΃v» èL,ðvyØóÌÚ»ôÁÉDÜ U4Ž¨Ûò4gw$wtÝT[•©È5É&ÈA]õÃiR5ZLàÚ䤄 ´_.‰ûK]Ô«‰óÔɼC„ªü“”•¸¤4ƒõB•†®3F®8M¢!§“y§õ\xÀ„Ò&b{û…H&§[zEq4U¯«ÛOÓº3!:ªx¾k(?+Œ&  °!:à„ÝÀ±;ˆ„ÝgK<Ö¡“QÁ`ؤÁÏÅj eŒâ‘DOEl½cD:Úfähtø8³6Å®ª«¢c²âÆ#BgIîy>hYêKÑ{ø–ZÓa'ßì¢9­*(Wͦ©¬™IrF¼;iÌV‚Š²£3.˜UØaΡ@wu\Ü”#0®Ÿ¹…™¤ãF¦Ï%‘%?ì â(žôïâçÈa¸?¸ƒfÆK€9ˤvCÖˆƒ¬Ü^UjD@6#A­œ[“qÃHuÏÓ +a­`J‡Þ #Ó|×d£€2FÕYîHltïë[± ³«š«¾”%g¹RõXyøù€HBC~€ +C•{€K„jàwM¢¸§´Zø¤mÒx +‡Àúë¼G¿[jÀõpŸÃa²«2N] ì;¡ôØ ¶æÊLjÆŠ¦¿C“DÁµp:ª,|x·Òs‚Àëej¬¡Ó÷¬Šâ™'*Ê Í©B8•$3¨CÁ–>ë_l¢#Ò±v7<Ô? LÝõ\ék‡íQJÀ*´-þ˜yGÂU¨Ü8üÙ¦/¸5Áù‘‚\§&âhHÁ/)’’ýÏã‰Î!Æ®ðaË•TÑzLógŠ$¡ÊR‡ß‡âžÅ˜èLe6=¶Ü͹Ÿ?KÁ0?òØ”Êc2"Øú<½bL‰Ì®Kj<½~ƒ;,¯Ú¦K*åšç±Æ^ +ý®=qz퇎«­SbhXmÇ (¨Bâ÷'¦Á¯íÁ)vâtØær=å§&2€f> Xçž"<±øopZîºöäùÙÝ—°Ò•Á|y±%±Ó-,Kußrk¬ñã;(=&–<2ÈŒ;ôuµá,ûŽUiŸ= Äñ\‚2-õàá®@‹´ +1b>ãT4WHÿÕ[ 7¾ú„qªÜôÔ!‘Ñ×~«)¼€ÎÃy-RþéÃ×Á’ltd8cš&Ö`þ¤9eL™cÕXæ6–t DïÜ‹^b<(ôå\I¢Z;ûò >é´lŸÕø¶‹ÐŸb㉫8Šu£¼f‚^35Êd9"[ëÜxÿæ«IÉJ¢-ÿýFªâÓ-ÒT…é1œþ2½¤ÇÀ:¤Li›}éµ×(ÀßöÜËsïÑ‹-;}~ûÅþáô•WBðÇ~âT©§ãRíjÅñ¥æJ¥cóÖu¤l”Ã[°SÀ)‚v¨›œdë¡„ÒÐL2ø8/T›˜ÇŠ›ÈLŠcç®+†‹0ÆÁƒ_Éwñ4;Í°t"ùÎúû £²Ø!’ßgŸüàãÉ‹ÐŤ˜QŠ¾øüŠ”àÉêA³à÷€æ*×æ\lU?Rl¹¹vçÇz€U&?Fi•$AþÏJNí7×?Kí¡Ýí|]UrèºòÑK²æ;y3Ô"ºš¶æ’`ºñ¸—ª‰Ç0-pÙ»sU“ª(JçµRúÿýÝ@‰Èz¡}UÁãèÌoLxÇàÿ‹¬M5endstream endobj -5334 0 obj << +5543 0 obj << /Type /Page -/Contents 5335 0 R -/Resources 5333 0 R +/Contents 5544 0 R +/Resources 5542 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5311 0 R +/Parent 5541 0 R +/Annots [ 5547 0 R ] >> endobj -5336 0 obj << -/D [5334 0 R /XYZ 85.039 781.388 null] +5547 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [240.558 160.194 308.612 171.884] +/Subtype /Link +/A << /S /GoTo /D (inst-rpc) >> >> endobj -1282 0 obj << -/D [5334 0 R /XYZ 85.039 704.69 null] +5545 0 obj << +/D [5543 0 R /XYZ 85.039 781.388 null] >> endobj -5337 0 obj << -/D [5334 0 R /XYZ 85.039 665.132 null] +1250 0 obj << +/D [5543 0 R /XYZ 85.039 675.326 null] >> endobj -1286 0 obj << -/D [5334 0 R /XYZ 85.039 552.746 null] +5546 0 obj << +/D [5543 0 R /XYZ 85.039 643.511 null] >> endobj -5338 0 obj << -/D [5334 0 R /XYZ 85.039 518.606 null] +1254 0 obj << +/D [5543 0 R /XYZ 85.039 145.925 null] >> endobj -5339 0 obj << -/D [5334 0 R /XYZ 85.039 326.61 null] +5548 0 obj << +/D [5543 0 R /XYZ 85.039 111.179 null] >> endobj -5340 0 obj << -/D [5334 0 R /XYZ 85.039 297.001 null] +5542 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R /F58 3380 0 R /F62 4159 0 R /F81 5323 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5341 0 obj << -/D [5334 0 R /XYZ 85.039 269.903 null] +5551 0 obj << +/Length 3634 +/Filter /FlateDecode +>> +stream +xÚµkoÜÆñ»~…¶0Uäh.wùJÑŽ•ØÊÃVm¹Nà}Ç;æ‘’gYýõ×.É;J6ò°“Ü÷Ìž: àO¦‘èì4I•¯Óôt¹= N70óäD Dpjü Žpêë«“‡ßFñ© +ü,ÈN¯Örµzã=~úèòê›g ­µ§Rÿl‘$©÷ø‡G/Ï”÷òâñ£pÊx—ðùââÙÕÙByÏž0<¼º¼|Žsg©ö®ÎÞ^}wòÍÕˆ„…ñM¬‘†_OÞ¼ NW@æw'¯³ôôÞ_eÙéöÄDÚŒ–ïêäåÉ¿ž3§¼jæ¤ ±ÐŸ¦fFiί–*ša‡òú&xÙ!ÊÈ7Ñ'1>ÉûkàOŒk™m%|×ë†?òwg‹0ñš}Ïßmñëæ˶XñÀªEøga:AòK  ŒW4Ö ®ZÖ,›ª*–8#X- (J\YÝÑI ?L4=ƒyFÃ?œ‰çŸ”zMWöø2(L·‚׶dµ<}È+k„èa¸±8 +$,#í©¢Ì&‘ßìÚ²î,U#0m|úë žÈOB‹å-ÏOÎoI +@w·Å!”×´x*¢)gîö¬+«²µµìRñ9 ¢À²«+ßU·øzïðô· ‚Öáà‰ò6L]Ž¨[„˜RŸ.@æQÄDnÏ4âYÀÿ˪ÄõECýÌñ¢ÐW±=¤îÖ7ø±ùú¦ÿp}{±¯Ån€=VK&ü1¡%±€·Àn­XnŸfŒòMÊÊe³Eè­³Ü +m¿KE1õe…îEz8Ü Ðh³‚Ý(êÚšûÍ*Q~¤"Ù:_­V¨GDg†ÜXxI ȺE²ÿ<7bþ±³%Ô~’¦¿[”9³žÌŠ}/ÉIäÚ—[êM9H‰,wFP*‘Ôýg *ôƒÐ|BP •8ÇQ¨ `„~}^TÈÛµä aíÔ¨• ¯¬“éóÒ9V:[è]žµcèu#QªÈ—ˆJܬ§Ñà}×Óçn@QÖÇ‘ §ó6ß´9¾] $AäèÖù¤ææ“ø&1ó)Ó"4~–$NÂ`.KHý؇MÁÅA™̻Xu_®oËztıwN¡ºü€Ilj÷-s­›ÉK¨î F£PõýZ}…©f©±q¼ ŽRV‘d©¸Šá“”kš`H­œœ¾„Á,„aeÏ ‰ï8`×f”÷ ñ@³#/ÖÔò*‹¼Ÿ‰Þ=ï +ŠŽ®ZÙRàðë=Ï DGà8Yç +~t²×ÚB’Y!1|™Œ5>(Ò±÷øü~>ÿ?£A•ðƒHËÑl’ÍÇ…-í(ù*2¯ö)NÇŠòã~¦skñ‹¹ë± Ã[¦Eœ÷Ëz=cßZûA4Ô±p˜ÂÊF…&ï1yÄ KnczyŒîÐH)y­ 4Dj®«ëÙšÄŨÜF ¨›ž_X­P&I⹤Æ£wUz“&žª—<Ï +•@Ú”„Ÿb¸G³ñníN›kvJŽÎÔ”‰õµ21Þ+tÖkʺú}Mj@Ì­Hz SrVŸ…Ú´#¼[{Ù …Pk&ü¬Ù/¡!eÌ>§íœ/Í€Þå ZÁðÀ®²åWFSóGYw}^UDoÙÈ édnrK(PMò{]Ü„²?¡QTŒC4*ðvè½S0¿(òòM!£¹dŸøެх’±ÉIÆÈé CœxMû­˜~DþzÇÛ2ã· &ÿÊuÍl¥c_¹ž ÓÄ}À@w1 +J[Ìõ½+é¡@øIÅãâN ¬yÏŸT)ñ¬4_v2D©±:vöÊL„£U$NŠ¨[ÉbÚNx©J”²²÷^H³É½ò®lmµÅb‰S’”@&c—ÒJá¼Á5¤XmÔxpÔC×cÈoî „±÷H‡¹w9)< ‘_Ô¶fÈ•LºDt"«0JýÀÊê¼µé¢ÔsÔsÕP¼ÖáÚ؆ɗ3¨c?†ÁŒÇRä¢ì¤&öÃ8ûL¤›Eº¤–öj–Zíg¡úLÄO]F¼c =ùpb w"ÄŽ¢m‰’¼Â„C;o®ÿG¹KÆ­’ yYâgÚ¸61#Yè€RtjÞ ÞÉ´ ‡ï[æÌ\)PÎ`¨1¢À…»0 (}L¨› +Ä}8‹PÇä««J)=¸t xÎ[àµsÜ)wî:çË1s°š+ +ða0u;´WÓ\¯—¼qqØ›^‚ŽíÁ¸P2j•[`1~Û̱Òi'=QMLÿ(¡jÚȱõåAÈÁò‘q0RÍ“Xƒt"xrêÉma(˜—ç’ òofpüø~Pèã;e=¤_8nÓ/ܪ-*®œñcÇ÷6VÊSÒÌûÊ•u‘Û˜»{zPHø:P3mÆ…µ%¹ÃeEJzwR_)Û…Þ#Oʪ”V1è~ “{ +¬ÔÀ¡D'“vÆ1•Yæ'ÊÉûî·+ŒÔvœ³”Dùibý%*=¼Ew´¢£Ì\(Ü`ƒ³¼§³iÀ‡wu69Y!bÕ§D+r›€#1¹œy,›i×!rBëåôlÔ7‰Ÿªø¸Þ£{<ƒš5”!Ã8…º…çÝÄ„’ÂÏ`ýÜ…`@6¥|»s9»¸ä(;h’DΑ^½zñõóöb¨0×Ñì`߈Þ«9jÍ\¿ÊÌpœÍ4!!ãœq¢™:Á± …ƒûpåmsÈ;›mÄ$Ñü%Â\>f ¥c¶­¥aŽ~g»2:õóDˆ=7l©e™wÜ­ÍyìuɽÔq– Ô]Ãó’œÁº G×Ù°ÅsU¾£’d'þ<b.xJZ6ä=âxPŽ89JÎQ3¨;7zne]ÃO”?Né€JcÄœ?C°=>¯4sØ"ÅPµ¦k„­¸¶ óãdš&`%®’![ãÏεP§E½ŠÇ²iÆñRÕX¿òýù7‹¯/®^>}>§œqèg™µyŸ··¢QPÆ6{lIãÖ­8PÉå9+ÂËUûЋ˜¹Ó1)øÉð7]3…Š¸+¸Q÷ˆUîØíÊF—*5SME²h¾—¨©æs“žè…ñEá ÉÇ[£H}šzð{÷PîË<þPüükÎY@,sæ;Q›:ʸEäÒéÜÅŽpÜÛ¹^^ lÛ[Í݇Ù6§mø«¡¡‡P5v:âªÂ›k= ÙäåÒ¼7ïð–ËHÎQ¡Í¹ªìö]ëaYÒµXê~¬€ëØ#ÂK[ä«¢Er‚²XL[ž‘ó—#Éš}7§’xï…¿U%ƒÄ +K‚}ßÑÔ7ÆO›¥,–s²À?X ßQÿWÂB_ÈálѨ3åéD‘‹ÜŒØcîf!²Ôx• ¹¦ÐTȧˆV!˜»~'4T¢d6,ó5<Ïlò²¦Š7kµOn„À‹áÚþäÄîâzYˆ|ªÈ8=îýÞ5CŽ–…¯¤]rÜŒ¢®J–òAAe˜5P,­ƒ-w}Çc6ß÷ÍÖAºN +^(´îü»n‰Ë,µ§?ª¼ÝÈuQ÷[<¢4Ù[žhÖ {|}Ö .f~:Óãu¥õâŸ5ų·~%5O”æv˨Ѩ¡¸€ÅÝðc‹Îµ)\M¥å2œcò²±Í;éjÀÈi¶yìöèvùrü#-{±í.äÇ7î„EmÖAÝKÔÎî«»Â_×ip@ ÛoÓôD#ŒÀ”—ÔùëùsñêÁy^¿Ïÿöþ=±%?QÚÓ ÞUé4D?Äe†°_<- è©Þí†ÎËM¹Í»Þd-äd—/1÷ù‚´ìKÙê9[„ÍŽ7]nW ùO~ü‘4ÌÔ¢o°o0³C,Áñù1ß7¼/ñ§`vŸóQôk>Úâ+f¦ò ,Ÿë?P=A¼þŠáÞ„o~žà²¤ʺЄó? øÜdîÞTjäû81¼çÇ|J%–±üômDàÿ+q@Iendstream +endobj +5550 0 obj << +/Type /Page +/Contents 5551 0 R +/Resources 5549 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5541 0 R >> endobj -5342 0 obj << -/D [5334 0 R /XYZ 85.039 231.376 null] +5552 0 obj << +/D [5550 0 R /XYZ 85.039 781.388 null] >> endobj -5343 0 obj << -/D [5334 0 R /XYZ 85.039 199.646 null] +5553 0 obj << +/D [5550 0 R /XYZ 85.039 761.463 null] >> endobj -5344 0 obj << -/D [5334 0 R /XYZ 85.039 170.037 null] +5554 0 obj << +/D [5550 0 R /XYZ 85.039 748.383 null] >> endobj -5345 0 obj << -/D [5334 0 R /XYZ 85.039 142.938 null] +5555 0 obj << +/D [5550 0 R /XYZ 85.039 707.129 null] >> endobj -5346 0 obj << -/D [5334 0 R /XYZ 85.039 102.291 null] +5556 0 obj << +/D [5550 0 R /XYZ 85.039 680.637 null] >> endobj -5347 0 obj << -/D [5334 0 R /XYZ 85.039 77.313 null] +1258 0 obj << +/D [5550 0 R /XYZ 85.039 608.186 null] >> endobj -5333 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R >> +5557 0 obj << +/D [5550 0 R /XYZ 85.039 574.042 null] +>> endobj +5549 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F81 5323 0 R /F62 4159 0 R /F20 3021 0 R /F35 3036 0 R /F59 3455 0 R /F82 5560 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5351 0 obj << -/Length 3214 +5563 0 obj << +/Length 2303 /Filter /FlateDecode >> stream -xÚíÙrãÆñ]_AóÅ`Õrvœ~Ii/[Ž³VVò‘²ý€%).c hU~>} 0AVª\•§”·ÌAOÏtOwO_#3ÓðŸ™å‰Ò®˜e¹Q.Ïg«ý…žmaæë #KAY8¯n/^¾KҙѪÐÅìönØ'Qqâf·ë_¢×ß\^ß¾ý°X:ç"“«Å2Ëòèõw—7 Ý\½¾ü§âè>?\½¿],MtõþkÆGœ®¯¿Ç¹Eî¢ÛÅo·ß^¼½íÙê  òôÇÅ/¿éÙøÿöB+Wä³Gke`zL©$vò]]Ü\ü½ßŠç⯚Aì -•Ø|¶tZåy<‰SJ' ˆ)Ñ*Ñq/&“b$ƒbJžŸÌè&‹Y°Ñ1sžšÑ…*ÒxDî’å[oYúk𮬚-ÛûÅÒæѦnA_qGÝ ^6÷<Ý}BôV–îàcb)–õšÛ†?"öja³èwÙ¬á}:˜ø´áñ="`Ø©c´5±§ž‹)3*Ëí,³ZÅ&›”’ ,œc!!eÖôûå>§U8•ž¥DçéxÕtnéÔ:±îpðõ ø4>>_¡ð›N’VÝœgQŽ%Jéé+P”3ѯ:Ñí§æP«5#=á<@è×y Eø¸ƒñ¡Ù3ufLv‹š®k\Uo…É"¥g;&°*‡'f”ͽ3¤HÚÒà­+Hb+6²duIÀØD»a1 }±©ypþ¹ØÛG2¿aŸñˆ9Ò$k!ÍR0³÷x@9©KAÁ˜S·ø ¥þŸ#åïp@ëuµ[áñeÊ~s²`âå;«ƒõ©SN[ H—ý¹¬ÉŽ¼A­yɈdbU’§²¤+ñÞ‚Z’œmì›ý~+‚ ®£Ý³@[²ðOleõ–§ÈÜ€Ûù×Va­ˆnþ¡›£eZüAÍSƒ Ã&àŠ¦ÐtdIKcpÊùÈ Àal7b+;ïÄm•üÙ›ïæÀ€Gü@CÆ @§!J[¡{:ì>ãÁªÍ–Z43uÊÎ\ªŒsç mÀ9mi‚ƒg³'Mí ±ÁÖÎQë- ZH¬ÍÙSÖfTnr1ëîîÈsui½!‘ß•U×’© 4bqâ÷ùHÞ¤£ûRÐÀ¹vç#s€sZЂƒtÝIAŸ!6úµ^йïûÀ¹°h÷,î»AÜ,At)Pû«ü(Qµüؾà!¹Í -5 »MÄò)%š"‡‹”ùŒÍZîü±ÂÈ˸çú:¥,p%ªpéYe8'•åqh|JYçˆõÊ:KÍ++$‡iTf%ÊÜ(8åBÙàAZö˜Ë$5Ñëf_JDÇ¥ü?šzÃ;Pr”yÅã–0: bsK^j-IÒnUVŒQ5ß!IÏI-d† -Ðù+>LÄåKå毗6V…M(Ö9§/o€^¬Ýà¢ñ£å|‘?Êš]=}Pºø«6Žî¦^VL:ÖrTÄìÐZ½Ó¦´¤ëø`-/ëEÞþe±L“8ºàMýeÇK7;ŸÓÀñ9’!î7Ü#P,"Ž­d•°î·Àí«²íBQ%$ 3êƦÑ#©“. ! >JJævŸûð‡°ŽÇa•QË”R$=îðfW<#©÷a_ÖbÈ:mQ B’A)4MçîØMo[Æ8>Jƒ4ë ƒ rÆU³K°…cÝÚ‚µCóhð´-OÝ rèÒðû¡íµã/f¼Ww8mù".'†¾~@H‰¬ã`UíD8­0Õ0a<ÒHLŽÅøÊý þ;r¶ÚŒ¹¨7¨[¡q,¦US¯HÄœ>Ûu¾ÁcÚ(²Êmj)i¡ßõžŒ×v‡²#A¥œÝ“=ñ¹6 0\@Xþ×çÃPºç{³)äOº¶‹ã3PH¬#oÀ™X°K¦7H–)­ùvÕUCœÈX¢0XKE&Ë <‰Ôìn -È@¬K-ÔŸC²˜ЫJ::ÅUðPÜ \8š8¿‰S•'>ß½§ó–˜‘¶´i®‹6Õc‰äVånŸ\®”M¤©*&Í™01%¾N@Êc·½’|è6ퟘ”õyùådÞ”(WøÀÍýh•¦ž×W“{ÄìD¿|¡¼T¬/LØØ”$0Äu6Òjó¶k¾pËÀp¼4–¬±‹~"¯Ã…)z|A²Zk^Vö%Ÿ9…üó5ÿ–^ÎSž€\\qBÃÇ"ˆ-Ä8/Ò=zÚŽ {L¤^ —½råÂ5‚Ÿì­;S±u㸿áìàŠø‹®¡gé·â+¤c—ü*(Ž¸ø¥{Ë>704ôM´‹°Îx¦{ˆ;¡'·…<û[«¹]ÏG]švÎPLUmRøkUa˜¢`<ÂÙçIÊQ$í»Jæuôiä™RòÉ©Bl¨ÎØ÷ ˜ÒL38fø4CsXÞ) 葘oÅ <}+6šdçO´\øÁ³ sÇñ›À6ðûšåïù›—eõX‚É3Le\×ϼ¹‹ãèÝ"ÅI4 ¡.ÐÍæÐ{Q„¿*sžÁaœ*·O¤)qPUlÖd´)[y,Ñœ “+šòT(´aèí 4=Ș7­R¼m;!Ê \–ŽDÜÓø3!„û"é° +£¬0#‡Ü—ûp«Ê¾¡ÅH’žIû"õéx6š ziD©½nêï1Èh"X˜À±ãåª -6æãX ½ó¢WÙd4^&y2¸Os\¬6’rLT}:W&IÂÚ¯=è‡ïm{²ø˵²±‘…˜_C64xào'¿!Ï\—ä˜/“x€ÅAðÁ©ùA:J¶ú{ŽT ÁÔÐÇáïq›wµô‰ò¢c:-EÃŽƒ[SÔª,¸öÖ9DžÀK´Œüþö ž¼‘žê®ãEþØ€Ó—8_—ÝùôJ:­ ãwh.O2EuâWÐîäå;ªzîìïÂó!„Bp÷£ôƒx<.WZ -€ê&,c(GÛ”{þêXI6ÆÕ•YhÖ}€fürØ.ðÊÃ=…BÕÁÍîª/=†2Öß—Dx.L4²yXL Hø¤Ô~wë€V1Ä"œ«úäˇ£S5of;(¢q\¯¼·Ú55»¸'ÿT1yÄ‚—=¶tò22ä¬îd„Sì±EäK?}Ìö‹¯dÎjeLþ_<“|)J&ŸÉ@*/’ÓûÐ* ûðˆÑ³gûôŠE¹hßrœÓU MÞÍ -|$¾u -ɨ<–ìîÚIŒeŠX¹œž]fÌŒÒqQ8F ÆÄóp¼¼Ú3{Ów³€AÙwlÌ]¡Q&mý,™ÙܨXóMºÅ D –C0Å k£Ÿ(¹¢‹ÊÉ­õÑt4ùóµ[+Æ¿hHµÀú‡ðËR`ï{//4K¹Õ úú™¾ÄuXÆ‘† ϬÿïŗϾ;Qñ›§I’"~EK¡’Òzò´þ@7fM·ÄYŒ(I›ÖÝÃN¡ÉWÕ I º®à÷­ou(OZõòžZ3Eô²sR{½€ß—RâÅ&ÔBá#T}·…ÇB:«2› ÖÍ%ÐþÛ«ËågæÃ8ú0±=X@b’aû‰½Mª\_U…Çw6úNä­èü9pÅF¥E6«o]ôí6nY,†1Åøþèû"¨=Ô¼oÇL¥‰ÊŠädû,å´îGÉ@>nÍf.w‚åõŽ(S¡ï›A>‰Âñúü â«a.5©ásYµPÀiâÆí¶4ßÛöÔã[ò?6Sý3}º40S'9´uYÔyû {%?=e›P”[{d›[®5¯›;Ìì|§Í uáNاKût’¤wþÔ»wÍÉ;B4‚/åIÒš âm2Òx_|»"‹Ú§–Eº_RŸJež8n/Šý§`Ë>ƒÌTš_0à’…Õ±è)°o‡¿ï÷e-­8ÞñKŒvýó„Ï”ZòÏ›ïoN6y)Éû—<¾7Ls$y¸?åe \HµocÝãNG‡nBW6WIæÿ=±S\—5u¦¦”îb•%þÆì9+{˜zLŒ‹D™8õ™ÉŸÈr0•2Øëÿ¬èO¥^i®ŠÌN½bé™èæOýTŸ•ÅN官~ K¬U–ò2eÙ¬9úˇÄÞr'HÃÿm¡endstream +xÚÅÛnÛFöÝ_!} €ˆžá o}óÚI­ÖV´‘²Î" ´HID%R!©Øþû=—J´h`±MjçræÜo3–rù®Pñ Œ¤«¢h°Øž‰Á +v~=“B ´+·þ1?;ç)ÜXăù’@æégçòúb:ûa8RJ92r‡£0ŒœË›‹ÙP:³ñåÅ nig +ÓãÉ|8’Îxò+Ã#ÌÇéô=î #å̇_濽±0Ò®òðõìó1HÍß΄«âhðcáÊ8lÏ´¯\_+3ßœÍÎþÙbá==àS=’Ž´ö\Ń‘néVdå÷ˆ|Uåß²j8ò=ß™$Ûì~¾Îò4ÛÜgÕŠ®òU¾MêÆÂÆR +ý!|1Á¯ü‚£˜YŒ ÿEµXçM¶höU‹û./Òò¡6Dçü}Œ‚¾óÇüM“fmq\þò‡Tún<™Ìq0{Ö¶ÊÃq½+Ë ®>ŒÿõöÃŒ•÷) +pD ×W“ñLÈÿ¤™{usÓ¡ë3Ù¤I–ù&ûNäÒtËÑÛíÒ>9/Ëb™¯¾#I–ðcŸˆ†äu¶Ùý‚×7Ó– º•”ší²"ÍŠ©Öß_µ/˜òSOƽŽûƒÉ¦Iód¯C6Í–¯Av]e¯àQߊôU„Ýìþ6²œ,.önºÙüÍTQÖÉü]_†º-‹¼)«â¨öÚ™ì7 D`Ò<íºçïäq™Iéj86ÒÊ T@ÇÿÝA¹‡®!ÐÎ6z‘ó„ß) w(›|‘ñ´Y' C5ë¶j^N+œ|Ãsv ìa11 _÷ySƒ'áÏ&©`m•YZp~¿Åßûáq<å’åðÄ‘^¬ÜP¶i º;€X '`©áH í€Ô`±]Dž«”Á€MC³fQ‚¯•< geUr²ÁH…+tÐñ“EÂôû‰•³.ñìC« VU…- +´tÚ ‹M]°vê¦J +£él`ô„ö1¨ § +‘¡v•·]&³¥ç¼¿íQ‚¯ÝX†æX^£æÁ¼hºsâ’rºé£D®ôÕËħC\_÷1º~l™ •DÎÝɘŸý‡ì’<~"=6†Ar\ã…l”-ÞïÀM@ãe…®¬•³D„›uƲ^9Zà'Al¬. tˆw-0©CÀ†ÚÁ®šý´ûš´P6Òéf“¥(_¨yB†~8`÷õ1Ñ{—@õ6_Te]._á$A@ƒ )»!Ú8øñü6ãáLF³%n‘Iå9ã%B軡c É +׆w›’w@¹C +CŠ”¡äýÐ9KôUu"K»8‰ócvQâøeéNÓxŠlå&ÑÑT› `¢‘|='IS2i^ …üÐ —& Ðʲ4ˆî`Gá&y‹ÛhQ7c¥’ìZ-ÿHóŽœäÀ?®Mæ¡'„8ÿ4eD‹Mž±ÊkL¼XòŠá,é÷¹jT8ÓK—3x ] K.À²œø6<[—uc‹@Æ(.\œ(4Á=jަϠ£o›YmjT¡r²Ã–¡›/Í—ý‘T{E8) \‡Œúäë2Å +¬€r!‹¸ºË‡fd¬{Z´1—ôè(iéÈ C›p?ïª*AEòJAZ´ú¹M}}[ÂåYšýzMåy2y‡ûzÏ9ê çà»”†pµÍÅ÷+ LÖU‰:]­ùD+`·¤ÄÂmYŸdƒÇ†PfKü©þDoöÌfNï1ãã65‹ßˆàq9íPnÛâñ!cNíØ“ {œ† ÎêZD®'UÇÆૈß8g*ÿ püqrÉ»EII„£0åUå–''ÁGß>bFÛ”Õ¡5€uŸ‚Ϙd÷§ñb\¢ ¾yqæCñ›¯³–Às¥u“ŠqØÍO§ÞLɪͦxì‘cVT¾°qÄ5vöœŽq˜ Rïï©þ¥y+Ò:Ì'6LçIFúÐÞxÖDéb(0v¿\2Ö—:¸”„ +oA¹~ž¢S=G1PšSå’Š R¨Ž4$÷yk[,¸·òï0;sQ²ØÉbqhÇŒ¾åhû\¦óì`äy1tÌ~×ÐÄ› ÀÕû»Ùõû](ül6´Àýô9ÐÛ˜m}ž=ÑÁ!× =ðú(vöø}íäMB‹´†«bÿxÕ“Ú•Zö¾ê F'½èEç– ç&$ãÅj‹¼X12F;¿gU‘mx|[¶úÊlo‹®åÎ40Z¬Q‚buèߣÕY:ŽãNm÷³‘@Ë‹msÁMò.QW†ƒ½Åa`Éü{+ñ{–oü[ÅmêM—MnVù Š*nR^·×Ñ Tú6/°%}Ó#TÞ 6-¨&AÙEkãtÛÑ(®,Ùa¢b(Y4F«6¶èz*:„ž0ÚÄáÇ:3'E†)~dßÛxA‡d#JÅ¥$7xÚŠøuϱaÖ­æ®Ús±Èê|U ¶°³lÅÁ *Éi¼ôeÔ (¼cC~âËh[Íšê(|í« +Úº2{&Ø 9e¯­€ÓF;.úg1n{Þ㫨/"Œ ÎÏûkI5ë†z´öŸBÿ%I¨jö{ÂZaÿ?ÓŒ%þÚ²µVmëBß¿©<©Oju`:ý#ÿ ÒK¼endstream endobj -5350 0 obj << +5562 0 obj << /Type /Page -/Contents 5351 0 R -/Resources 5349 0 R +/Contents 5563 0 R +/Resources 5561 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5359 0 R +/Parent 5541 0 R >> endobj -5348 0 obj << -/Type /XObject -/Subtype /Form -/FormType 1 -/PTEX.FileName (./xslt/figures/tip.pdf) -/PTEX.PageNumber 1 -/PTEX.InfoDict 5360 0 R -/Matrix [1 0 0 1 0 0] -/BBox [0 0 27 27] -/Resources << -/ProcSet [ /PDF ] -/ExtGState << -/R4 5361 0 R ->>>> -/Length 5362 0 R +5564 0 obj << +/D [5562 0 R /XYZ 85.039 781.388 null] +>> endobj +5561 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F58 3380 0 R /F81 5323 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5567 0 obj << +/Length 2925 /Filter /FlateDecode >> stream -xœmYKŽ,¹ Ü×)ríEŽHQ¿Cxaû xf€~ à _ßAefUÛ ú‘’(2$Õå´£ð¿ýóë×ë_¯ßþÇïÿ~ÙñçkžeÌqüçUÏÙk_Ç__í´cVý,½¿n?cÝO¯£ÞÖÙð?ìí‘¿^^*öõ[ãçó‹Ü௰`kº=úq­®öç„Kþz]6\šËĽÁÏ;|½þxýã5æ¹Æ¨Ç²s4ÝŒóy¬rÎZúñý‚!­[¥Æ֘дqú²qÌ8{Ážß¯:ÎÚ¦³ŸËñóÑäÎÜççYß°Àbž§Ýç¿išáŒ7¹š½‹·b ÙÛkÓçAäYå(S+Z9K…­XÐXÃQeÏŠ#Z=½OÞ¥›M­hgYq̆­ƒšSŒFé!¸ø’± w|`ÏÃanÜî±1Îàï×9§1ï43[q®N\ÎB4¶ ûÓM«ñ{, €óq¦Áþ sñ‹Vyq^gðZ1¸ã„ }ЦֆéLþ³™ƒ÷À8GkOkˆX[NG4ëo_…tUAp:]Yò^vFÔ¹ÃC¤à»Ê`öÓq6€Ój Èqo´Ñêr}gH.Ò°¬¹Ôù¾¢"À¶èÛ‰‹à {Ê×Ã3¥ÂØqËXáæ=_8½=e<Ãâ\³ Ó»âiÈÒž¾‚ƒýŒ–ÁCV`Nl°·~Áò Ø߯þå…Ü `b¡I<Í*8²Þ²„QÂB+ػƇ&/òýZ„ø¬÷>Ҭܗn^ØuÀ%”›Q„Ksƒ:yl‹Ç!sßôsÕÔ“ئˆ °ÎqƒUtÈ‚ 2b1gl( Œà#ädl-œÙKóÅ-—ã;²Ð8‹÷K¤¿2®[ñ-ET>lÕ¥)Ìj¼ÃÙ ü€`“•‘{zÞ¾ÍP’ÔÖ[òå°*hÄ]ÏJH¶ÛiÎ'0oÏR³Vj¢7Ð{ÊN(@nÔcϵ÷À®–ÞL’€]båH,úì–3«LáÚ_€O¼®ŒÕÛéͶQɃ`7sþÕÓ,šÇÜî®=h݈³€¢à"ßô¥›Â[cñÆ8¤2‚ˆpÐjA´]Þ¦™ œõD„,8+bˆ4ê®1)…!¼ZûÀHýÉŽký‘ý¬% éÑÀîúNöËú‡˜à¥Õä¸9ŒrORWêü~•Ú;§ à,t#S͉£ä²,vz±YÌ$”Í6Û-“ãg2ÜõEeÆ›ä†bé­Œ7®ðJX’dL©„áC¢` »YyuÏžI¯ö N¡Ÿ9ˆÐðwå¡·<´2”d‹‹8o]I+‹Îs$´û>c -®1˜i¤ ¯I£i¢·°†˜¹=è ÊÏ•…§ÕkÔãÅŠRMâöD<¿†ãµ¥WSxË&‚—rlœÊòžý&Q-ÆŸÝë~x ß%ªÂ…=4êqÆêjsà#‹|æQ“©(5ËdŸ¯— ¡è¢oQ3ƒUzixìIÝ3ô-æ8ç¬÷,¦#çÓœî2‡P{Šâ­&o© -s¨&ÃÄÊÄv¶ ·ìj)¹âÒÐCœM¹ÏæhwC¼²4ƒ§MiˆKWV.\V©qõJ˜Qå|˜ÂdLé=…B½ÝØ=*ë’qí§­Mƒ'*0*2î±gO¾Õ1|:›rËócܤDR®&DðÑ"wv³B\HTˆÚ8!§ƒFø~¯X’ëÒl—³œ&jÔ …à9“ƒPÐQjk!S ¥3‘ò ˆYhÇPÑcU§í|øB*²Þ8inË_ìæ[´ç‹ïGS8“»yö?˜n 2%kvjhXlzDgx|¼ðtúê󨿿 Á$ç]–šˆù¼Ÿ‹F¾Î\o7À0òaNµu™ZzÐ\‚´*n -¬ÉQ0߯+#ÿ±-»=ÀMUxËùëz´Ù_€Ë3û&[(t½zŒeî— “Fò=of¶ä{_h¾‚¥9SŒ]`ô¤ž -®Ë¼«ÂÂìï{š)Þn~\ÇÚ¬£ZqÉp÷ìû15LIcÆ ˜Ô¤9±ô~ûz%“º˜ÏÈgâ^• yöNî³åçióþ‚•Û“:%NkjPñÓ’{øøÙ qo@B%™6•lÑ?Êò»˜«tTMbH -­Pø3øô™×!ý³AŠ<5§!Éçãß[Ž«¹5{Š¸:,RŠ½¥?ôök8ò® #Ž$„6ã?û¥?%lgŒ¢¹_z€j„Ä5ðñŸzÙXÑ9I/¨Ýu›ê:¸ãš÷«(=IeÉŠºî‡”Ÿñþâ{Ìß^ÿŒEZ¢endstream +xÚÍZ{oÛFÿߟBÀå*ˆÖ\rùê!(œ8¯"±}±sÎÁ +Z¤-"©’T÷Óß¼–¢$:HÜá4ÚÙÇìì<~³Œž¸ðGOâ@¹~2‰b­ü8žÌ—îä8/´Œp'F¹a€¬§‡/‚p¢]•¸Éäↆ\dWγWGgÏßMg¾ï;:VÓYÅγ7GçS휿~vôYÆ9ƒî»×'Ó™v^Ÿ¼äñ8æýÙÙ)ò¦±ï\L?^ürðüb ÂÌ(ú(ÃïWÝIbþrà*?‰'_ í*$“å |_úåÁùÁ?ûU˜g&㤠ýêjƒç¥™m¿kÌ»&ê'Ë+¤t… ¦±¯]Tü[¯n¬;â3έײh‹¤._áµiPüÂk¬p8zÿØ·y‡Z&A+JHK]?/ÒOèJžÎLè9—ÓØ0UR>†ÆEjg1õçŽgTuÇ^àŽÔò[Ô7ØÄÒx®,ú”eÑŸ1#Å+Ëö'´é’îÏ~¬ÀO1I(¶pµB³ãa±3Ê·åQFÖ È +™ÿ‘ù[Ö¦!,yÂoiÓ5emÏŒk`l¸¥ôÞ.<ï:|ô¶+nÓŽÌÒóØ"à·^Én—iÛq«íH¿+ìi6aœÓ›Ø Lºc"›-4Ðìzënñ–Æ[ö@V¼æºņÞPcn¬Py9õ=ç'8ó² Û¨Ôè*Tk™i%Îä·¹E«z¡ŒÕЗ‚ÌÕé‡"ç¶:QP°‡¡m$Î*¥^˽´B¥v~±šÖNJ;æÙkÑÖ’‘Í~"ž,B²ÃïZ–¸Fæ݈²<+Ø#ƒf D PD}ý˜DEÚ*"q‹Á‘Ê „3ì]ÈÞy†Ñ¡ëCÉ@¼¢š—k +;¬;/‰•k'Ý´KYôÑð­,O?µœÑ~ê†ó_Ã:ÀÀ’^Õ;:òO| +;þÎŒ¯B?¤ šºîþ‘Ê ÀV®ç’°{xxñþÝÓÓß>œ’wþª}ó€Y³÷ÓêSú÷¯ðßC¦!›Ž¡#¥coËfsópžqãÒ÷>Äá¡÷%F="½:~ô[–«GÜ[dV+ü*r^eÙòQ†Ÿg<:ZUÇoÞš'[¶<ükgIWËo[ü!3'NÛQQþ¼ü`¬còËä¿vXó¾ÄQ˜ôþ3àÔ}1®”Rc Õ†ˆFÝt=¼ÁXÔç î0b[.9¼ºd†ïÌëåªÌ»ü±L¢ èKÌePjÃ<´ ¾ò˜>ßâë¦G5œXyŸB,ôæiÉã²¢Ù ÆüÒ¥2ãüó+¬IóÔÕ×)ÛòŽçb„O¨ VÚ×",8ÛÜ‚V£%×aæ2žË<;uð,Œh¨EÈ\á,‚­]‰zùç­ä‡çBžU°àÈ%­l_ËfxùHðW¹ÚB+ˆÐ#Ø)T®—Ȉ݆¤f¢´90ᶒiYn†­ÅL Ë™íÄ0¯Kˆ{t§R20Pš ÖàË YÀ€gôi^“LËþøHd g×ùÚßýZЛô~’C ®æ2¼®ì>bz^¸Í˺“a—”–3®`dK¾¦ÆûV(ŒïYKòÎ9“F:sçÍÖ¤6i@[_‹Î:Æ-Äte· LÓïXÎ|°¢õMˆQÀo“¯È=r²Ï aÿ3!›_#¾“gk9:rnj»ÈbC¼|}b\&§Í7¥;ìr:GGŽ*CÛùm™ñð;Tzvª<Ïâè5JÂRÖ(E·é÷.Ì1ùzøÖ^×á‡3.CÕPp S ƒoé ' @ª©¢²Ñ è›èdô€á„EÞŠCS=t¯.d.›'Œ$+4®Uê¾›‚#ž$uJÝÂŒ¡1k׉Ô÷К{O8 ÝÈ9e_ˆãMÐÂŽýo[õ¥tÿ1 ¸zS;áà¾\‰#r£u5ÂýHÅßQ°@¥„²&±³Z•1ˆ¢M8,c`w®Êk›QèxVʺ,å’À 9V!Œ¶µ»]œ±OÖÕVþ2ô•ŠUaÖ`ïÃövØŽ´Úw•güÿEaìñ°2Vc¯f‚Ä¿ç™Ç3 ¥à{²|yÈz]µ]J%£$uíÜòs•üRçj•˜`Ë)îk|Á#”¤cÚI ô©eÉŽ4'³N)J¬ŒÄœÌòÏ% +åO)dªÍBœ!@PŒ¢D&. Fc”lnEš 敤±¤á¬k¥e[[é7oHL™C%oßö‘Â=aº@ë0Ñ&õ˜ÈݤãH“&Š45¹EÄ8îy¿=ÂÒ_Z&3à(v1´ wx¨!›†íæ›Ì +tM-L!yjþ%­¡fW+N¦MJŠˆ‘CjÛ;ñ-Ï^ɾ±îÔ(ÿ=£×*N’wÃÄcØž®äá*a§GFÆ6Tkó;I]CÙ†vùü›¶éò:=Ì(øµ£yÜU¬­Ì”lwì7† h=. Þ‰áÑ8ñÁÁM´ý|w[3ê\äüÎôÓH¬o ¶@ø*l¬5z$Ö‚€Ñî²2AÀwEÖpÍÑøý‚œÝ¬“ÊŒZ»¨Ñø®srñ˜™üÆAã±bE‚Hüu”–ìõX™å*Ž£û¯ZžÂF‘ÜAŒ®×„‚i?> -endobj -5361 0 obj -<< -/Type /ExtGState -/Name /R4 -/TR /Identity -/OPM 1 -/SM 0.02 -/SA true ->> -endobj -5362 0 obj -2934 -endobj -5352 0 obj << -/D [5350 0 R /XYZ 85.039 781.388 null] +5566 0 obj << +/Type /Page +/Contents 5567 0 R +/Resources 5565 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5541 0 R >> endobj -5353 0 obj << -/D [5350 0 R /XYZ 85.039 761.463 null] +5568 0 obj << +/D [5566 0 R /XYZ 85.039 781.388 null] >> endobj -5354 0 obj << -/D [5350 0 R /XYZ 85.039 745.394 null] +1262 0 obj << +/D [5566 0 R /XYZ 85.039 761.463 null] >> endobj -5355 0 obj << -/D [5350 0 R /XYZ 85.039 701.152 null] +5569 0 obj << +/D [5566 0 R /XYZ 85.039 740.731 null] >> endobj -5356 0 obj << -/D [5350 0 R /XYZ 85.039 660.504 null] +1266 0 obj << +/D [5566 0 R /XYZ 85.039 299.767 null] >> endobj -5357 0 obj << -/D [5350 0 R /XYZ 85.039 634.012 null] +5570 0 obj << +/D [5566 0 R /XYZ 85.039 265.32 null] >> endobj -5358 0 obj << -/D [5350 0 R /XYZ 85.039 606.913 null] +5565 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F81 5323 0 R /F62 4159 0 R /F35 3036 0 R /F41 3054 0 R /F59 3455 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5349 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R >> -/XObject << /Im11 5348 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -5365 0 obj << -/Length 1720 +5573 0 obj << +/Length 1961 /Filter /FlateDecode >> stream -xÚ½XYsÓH~÷¯p±»¹ - ¤Ñ‘ª}0 G€ ^ì,†ER-:i„É¿ß>F²;YX’Š5êîéãëc&C ~Å0¦å„C?¦øXÃ%p^ „–k‘ñ–ÌÓùàÉsé …e†V8œ_môHÓ•Îpž,Œ“—“éüÙ»ÑØqCæhìûqòf2 cvv2yƒ,טÂ뻳óùh,Œ³ó,2Óé[äǘ>Î_ žÍ{·zƒàBˆ>Ý ­aþ¿X¦Ã5¬-S»€S¦týžfƒ?{UÌs‡¼ëÄX„fhˇaò„ézN“ \a†RnÃ$-SZ.ÁÈ„&„i@RZƬ]­aT#ø¨Â’¿\Õó<"ú2å×sä·\Ò®´n˜Q]ñá­{%*Å%Èܧ˜Âp#C -y „g:Å÷¶»è¬ðÉ…hZ¢x†ºŽ®¤q5LŠê^,-™”¡­{h_§Õ3ê4ÖÂv`¨Í -õ3Ó¼Z;üðÁ¢ö‹°fQ2—¿fMgL[*SÒ™0[ULmZÔIƒ­U K…èhce 22öÒa‡®‘Tø¶.sàTQÒ0õªÒlaYG „JrÑcÅ0P(”ka@á¸ù‹&C¨—¼û}V"l‚ g:ö>'Ó÷¬ð:­S&eÚTSæšrƒ2ÑÈöõ§5*‹ê„‰,iû¡6$~ËJ ;Ôš§y«`ŸÐ.Ÿ]1ïWm †q¤˜Å6»Ô!aÇgß´ˆE­ ¼›ÍXÁ*" (ϸB‘ªÐ¡Q·%F¯ï¸¸¢uØ2­SŽG˜¨œ†^°“涡¬:k­§˜ÒÄnfÁz?r’çi*š%q©~Þs+ù™• Težj›6mSZ„Sgߠó=xÀ¨eA·“:0’î€[b/ HÄ3gÝ u]µýi ó͇.ö8’,ôÕåÚw«+¸¸áWtP¶±ÒtÞtgá›!ÜÙû(I¾f¶ÌÒó»=K<™ÀŠ¥ÛHëŽDÏ3è¼å7_Užó9Þ·…«g­«[žé—¨àš†ºÐ¸¬¨»ppºlÇÂw&¹[½U›ëcgÓPplD±.Œž€Y³å¢ ›Ö1GîlGá:P(| ¬«Jý“É–P11JZ*~Mþx:Ÿ\Lgü>¾Ðb°ã·&ëT Žc~¥e[À(û ן# -Fš¾½;‰ã"aáßù±µåÀÉ·ÀËRµnXoHøüx‡FÝfÝPæ”tòú¬¼ªx%¼ö»ÒÝÙ¼-Çà1/ìUt…7Î4¶åK^MOÞðB»4îtSÁw8&ôëtrþz²Ñ2Suÿ· ÿ‚ÍË4KÒü2­—Zo¶ÌŠ¨éí„BX¼Âé0a3rñ¦/)ЉŸŒKq»ºŽJ5·\Ù%ðî{aÂfë~‘¾)ùCÚsÅï÷§¼·=»-÷Áp•GËæxa} ,ü9ÔšˆÀñâƒp\üÛxŽoÛ)ºóŸYJ×b¼Ö?¼ùñcøX­ -öùeöW•·x“¥¤ne¦Z¥–Q­ƒÛ%ü#ªŽ}Ñ~³Âñ~ûþ´ä"›ížGtÝÞÔ*ƒÆëGÿ¥‰m"ò*Ÿ £Ýé)¾çËÇ2íƒ_ÀÃð]_Cõ_°À±8÷|¿"m¸ì‰ÎÃö]¥˜2pöþo÷Žendstream +xÚ­YmoÛ6þî_áa"#’zÝY²6Þ’,›¤@ Š%ÛÂdÉ•ä¤öãwGžd9V]Ç[‹ÂGòá½w'Þ•÷-øËû¾Ã,ô=Ÿ3éûýÉ¢gõg°ò¡Ç aõmf¹.ý4î¿wÜ>·X`ýñTAÆѽqvqz3þù)¥4¸Ï¦çùÆÙåéhÀÑðìô—lㆠ¯Ç“Ãë˜Û››ßpmàKcäž²h'×ty׿ŠxÖyeúFOWŸY”¦°*Ü}¼kí’×ã÷G +jÖŽ-¤{$•yH‚‡îž ‘Û/ckã±{GÇrDúñü–.,0Rp J‡ƒPãÒœ󩞨ô²Ô”.ß L—Kã*/+ ˆŠæ[Q©çUÑÓŹ\„iz-BUn¼èÉ> endobj -5366 0 obj << -/D [5364 0 R /XYZ 85.039 781.388 null] +5574 0 obj << +/D [5572 0 R /XYZ 85.039 781.388 null] >> endobj -1290 0 obj << -/D [5364 0 R /XYZ 85.039 761.463 null] +1270 0 obj << +/D [5572 0 R /XYZ 85.039 184.566 null] >> endobj -5367 0 obj << -/D [5364 0 R /XYZ 85.039 741.134 null] +5575 0 obj << +/D [5572 0 R /XYZ 85.039 153.15 null] >> endobj -5363 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R >> +5571 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F59 3455 0 R /F58 3380 0 R /F81 5323 0 R /F35 3036 0 R /F62 4159 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5370 0 obj << -/Length 1655 +5578 0 obj << +/Length 2171 /Filter /FlateDecode >> stream -xÚíX[sÓF~÷¯ðÐé ÏàeW«kfú`R(¡\씇Å’mÍèâJrLúë{.+YND¦”¶OÂÞΞ=—ï\5–ðWWHŽý@ ãU>’ã œü4R†bjH¦=šËÑóW®7VR„2/×G>®p\=^ÆWÖùëÙ|ùòÃdªµ¶T &S߬ó·³ÅDY‹‹óÙ[À\ -Çù„®£Í:-F¿v¬øÌó­!¸:n Ú@»=„Røž?ö])\é ûÕ*©ëõ>Ëî&S×v­:ixç¡R’çMiöªô6©xþ:Iã$»Iª ¯L7iÕM{~¼ýIºr¾€ÿ•@+¸Â·|¡ä¨Ê²ùŽ©«Ýj•¥IaÄXÌ~y1›ž_μž^2¸ñ}¬ªVÞéŠÇ§I±ÏwUZ€$õSzм§ÐŒ!½·Êc¦þ‡þº¢àÄ9¹³Î¢M}v%?ÿ\ƺ`œÙ Ò‡É}jRImŒx -e†×i®\ŒÜ'\dœ¤¤ƒñ öL>9:ÉP)ëZ³5U/<7ª?ô³r<ᨰõ¦V„¾s‹žNª?»¶6:% -´x“À†–$iWd€$Nâg,J”eLï$n³’Rî*2IVš)AÀ”ãO -wŠW†îxj².bÓDL!N•ÉØ È /@äùPèÂ> -o„‰²•êhK„ràYË®ÖÓùG&;¤”û`Ö}<ï|y«h®ÊÍwgRÕúì ˆVà!øÒ=´£ú%AB—#uLj3ƒò￧¤¹#xôÁ–æÁ‹'(Qʆ:oŸ¼]Õ¤õ$ÂUY­‹WŒ°Â¾î§Õ´î27ÄŽ¹Ø”|XCÏO©¬ ½?ÒdÆš…ÿ}c -BT µFžê÷˜m¡Nó®p¶-ÒKØøŒuŒ™ø~?q"pÚ0*Öø7˜Ø¡wô»âŒ/˜ªŒ©z¨éÔÀJåPË„ú ø©\S¬CóRAÙêz,YÔ]ܦY²éòŠæÞ& ®_,–ecÊ]ÕÞ¥;æ)z1O Cc±Z -{0ÃkñM¿ãéPè -ô¹kÛÂV­,h5[éûò¶¿ z ðŸ†IȲendstream +xÚÅkOãHò;¿"FZGšxûi·#ñ†y°7Ãä& ]‰E+âÇÎØ ÷믪«í˜$°»GF'®W×£»á?|`´Ïd4 ÷¥1ƒÙ†nóþ€; +6P> 4¢ŽÏ~~§ƒg~Ä¢Áù%9O.½7Ž&ço¿ GRJ8 +Cã½ùx4rozúæè#¢”7é—Ó³óáˆ{§gï‰i.&“ψé¯Î9x{ÞSa¤|HÔáÛÁå$ æ/Ì—‘ÜØù<Š‹¥¥¯•tóü`zðïŽ áÔ€Ví°t¤Tè F’ùƨÎd©w˜'Iš GZh/+š´º‰g©›.œÌ×ܯgqÝôàBkB‹¸þzSŸ~…ÏÐþÁHû¡0ƒG­#+ò}ÙК˜>˲ΚìΉ-â…}[¥Õ «´^–Eí7U¹ ÑZýÎ4{É­Zì‘F'å"ΊÃË7“éh‚;{EôŸ§‡—g§¿¹é4­îÒêðr/®ò¾‰¯Z¦"ôYDL߬ª*-œ©IV¥³¦líÉj§— +§GŸŽF(gË +¶âŽ~•â7àh‡Öž<4šy'ÑŒy`7ë½éª öŸâR`r¬ƒ±t{kä.¾–±‚MÆçó­ù ¿Aýðre$Úe•ÞeåjˆFØÒ&ãó;]VX;­ ÔŸ?,@zyöÕÉBt§=NºÀnªŽ×]¸Dpbw ¶0Œ6 O 8é^À¯Õëhhjµ™[&VÆã°É é”,—6ÜÒ¢Ýn\gs=£,EtYA¨_íŽ$6 +ÈÛmr=vÞÛï@²ÌËÎÒʦRäã]^’‚ÓÄnrONB'ÅOk¢^Ž"µ |Á]æ,hâ Áì‚­XNÎäTü4i­‚-CetÌÖA)ñ€Òh¥`#—¬SÀ²x)„¯'ˆÂ¨kS¥¦Õ¨dé4¶Û6ÛÍükA¾ ÑwRöÐNˆ'ª$Å£mÇ9• ­q︙Û|ë Î 6P3ë¬×„¡×)ŠÞ*Á:êie@GáŠ0œÛ¨°ƒNÖ§~PÁÚq[û¶KyÄ|#xûF‡w )Á“Î@Š«¢3¨ó`·SRá–’:H?ÄîçÙ ½<§GLÛ²¶5!äÛ*]¥Ø/j[Ííû'…L[¶²YšaáfÿC²^eDTYÜú›¯¤íƒ¡0î~Ë –ˆîiS°O›ÜøR„¯ñ  "ï˪(l%”AèUK¬ãÞl†‘Ùƒ9‚ï³fN£8IÜfm?ä +è€ü ݤð™XëÆw=»ž¥ß›×X?Ã^EfJ(LVuC³¦óTN€il 0}p_S›s•À.± vw–kϲØ1™ÅÄ÷ÖÖ•â‹Ö»nâ­DXOÛðqµÆÕ+ªWqÒ®JNi€AU®Õ¤ì1¼ÓËñK{ë!*8«­©$ì} œ#_í`ƒ:üÕŽäâÜLÔ”æP 0> Ýïa"^ûMʶ£WD¶û‡rm@ úœaï¹æë·u:Rg‚4¥XÚPG~Ä·fFiÛöàô:mHè=V`´¤¾µtˆ^eÅ‘S±¤/Ü¥³ºqGS:Á)(/[ýBÐt\>:ÑÚVÐ?¦þÑv"6kj7 pZÙ®›Ð6ˆ;ö¶VÇ×qíäõ:.Ä“m+6c­=æ9uKÊ`àÛ÷•íÝÀé#]j,»V)¼y\?dK ª_.~‘Yš¼&X|Û.ê¦7¥«ux°é,‡ƒñŽ¢BÜi±»j8]^ö¯!µ¦³ëÙ$x¸©!\^õü/ùštendstream endobj -5369 0 obj << +5577 0 obj << /Type /Page -/Contents 5370 0 R -/Resources 5368 0 R +/Contents 5578 0 R +/Resources 5576 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5359 0 R +/Parent 5581 0 R >> endobj -5371 0 obj << -/D [5369 0 R /XYZ 85.039 781.388 null] +5579 0 obj << +/D [5577 0 R /XYZ 85.039 781.388 null] >> endobj -1294 0 obj << -/D [5369 0 R /XYZ 85.039 259.884 null] +1274 0 obj << +/D [5577 0 R /XYZ 85.039 160.457 null] >> endobj -5372 0 obj << -/D [5369 0 R /XYZ 85.039 225.744 null] +5580 0 obj << +/D [5577 0 R /XYZ 85.039 126.919 null] >> endobj -5368 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F41 2994 0 R /F77 4849 0 R >> +5576 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F59 3455 0 R /F20 3021 0 R /F58 3380 0 R /F81 5323 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5375 0 obj << -/Length 3206 +5584 0 obj << +/Length 2034 /Filter /FlateDecode >> stream -xÚ¥Z[sÛ¶~÷¯Ðdú@ÍX4ޓ郓¸=îi.'q’Τy`$ZÒ‰$*$eÇýõgoA‰’;§“dD ìb/v¨QÔ(‹ý ÌGi¦ü0ËFÓõY0šÃȯgJ(&B2qhžßœ]ü'#øynn»ub?ŠÃÑÍì³÷â_—oo®Þ'az*óÇ“4ͼ¿_¾+ïýõ‹Ëßq(òÞBóÝõë›ñDyׯez¤ùðöíg¡w3þróÛÙÕË2r”éûÙç/Áhòÿvøažîá;ð ¯Ï@(?ŽBi¯ÎÞŸýÇ.Åcшg © Ò‰¯SøÐ@££ÇÙ…YèëP² F¥"_eñÑuhVëð—!ﯫh?Tz4I¢ÄÏÒÜZ&‰`ŠŸÇ1ZF©ÔOr=J£ÔÏUD¦¹Yn÷õiÈ’,ó£—})?ˆòEµ"?ÑÚ: -[ïpVL#yh•8£­ðsõ ý»†zqŧuÅb´8 -H9[­BÍÌ{¹iqé¥#ð{þzà·ýp}µiq³ôV~Û€§ƒ êÅ/‘rô<É:|N’onçð—i{6 µŸê ŒˆTï/Õ«ç—ŒË+Üûøõn€ ÀD¬b™8¼¶Jüœ”Id£¨ÀÖª§1/h´Ü YÈ%™¶øIö¬P -“®–ÓoܬD:pĈ3?ÍQ³-I3ç0-I ³¼e™ÊÍ´l|öýýЉòØWQ2rÂðDu˜i? £ÑÄÂÑÿ5n…ð›+}Þ€hw Ò³© -”áÈ¡Âþ Tz€"¨Tê,vÀÐÐp§q8 -¸¹}Ðý$Š"o -æ·h - õvQ²­Éwʶ¥Á96 Š÷{¦(f6ÀÆ-VÖÜw¿ü‹p îœégþy@:r‡†;þ â@ØFÞÌ=bS±Ãpm@ùì°Æà·A–2Ä™©—x~r<™ŒgDs7ŽjYíÌ–¡µàmÒ¦Ÿ9%cðt¥ã“öwhŽÛß=fÿS ­ý÷9Úßå¸Cs­ªB¬"°¿)ï;ÔË;2’ز­ä×hñ«Xã ñ•À…:?Ãç–ˆ<á§/Ž#Õå³cª á`ÔÉiÕv4'T+DªöÃNµ{‡Uëp,Ú,ŸIÓeÑŠ¾Œ#â!´E—í—¢ÿ©ìÎ…Ÿv!¢ÉšG,›^Dbì@ëë®e·K8âèóIÏ’«’Dkž`0IØ:Æâžï»rwÜFAèçútvëÐœ°‘=j£ ;íq¶‘ñü1EÇ%‡ÜÌK„Â<›a¿ :ÐR5W¤œ•d0¸3§*š/Šb0bIÏ|ØèUÉ7Å€f>&ç<Ö·rúm4·Ø²Út¢¶‹¢å^ÚNýœ™•ÄŽlJ–»d¥ÚY—Ñ¥øVÇÃ5Jà´<í ÉqGšÇüà7ë{ì½ÀaÇGW&GüŠ¥—u‰i&ö0 fLƒvN7èkåDÁOEø8Eè\TMË_©[…ÓYä³ 8{Æ‘ÿR9‘ÙÝ ÿ¶"‚²BZSjq×­®QHp›0àL®Y"EÊ?ÌHû§”´¬´sÏ?bÈ C% ìm…Ñ>3GŸ3 ÆÃ^ ú’N©RºC-¦·R•ÖRÞ’¡ÇGyKšz«‚|¾ªt¡³°¦ úl9tÏí¾AÖ¡ßZí;Õ<5?öÓV* S@º°ª…wˈè4„Œ²»òò%ÉÓÌ‚t@2§±w-3‰«שø·ƒM×39±¼ÂR8ÌßpG8Qç< g“M™ec j·hFRÖ~ðÍJs¯µ'+6L6ÊÃÈ5œËZŽÏsžàÊJø),‚ ú¦\îRpÑžˆƒÕDËTR¥&8 \”G S0W´q1;È1Ÿ…ˆ]ÑYi}˜Š_Á öÎy]¬¹½¯üÆÍ52Ü‘ëAk_Ñœ-ÜbÏŠ J9;VÀžáân+C$êRÊûðúúÃÂü¡a­ö±°ô;¥v1)éÃÏôÂ]tZlÏÍpKû¹˜Ò¡G›ºè—+uЭԷõ•ܦcÅ–²[T(`\Ñ7À LE\™´*êÕÏFÌå­É²].øê! =ßìê› ç3ê“•aƒ˜®Ó,1]П%~d0Øsk.X°·à®Þ-zr(œ£ä$‘v"]§9!L±6Ù&Œqð\ÔýÍ¢¨E)®œš{q)¼”ÁoÎ{äÚIQü‰ Ûæ2¬ÎxÂ=å°ÈÇN¥é®=‰±S’~pGe õ¾ër[Ô¬ØV¦.¾¢mK¾Òs<‡‘[I 5@Ü[À[ÇÄtk&ëõ‰wÍÀg‹±Ã`à ²ð%_`K౩uÀ„LB¨¶aŠ’NÿJ°¬ºåßË))PÐû^–›e9sxÂo]¶;œ¿1Ï6‡|“¶z¯«V0–Jó¢5s]ðý;9N¤´ÃlaìC1ñ·üaýŠF73'ò±‡$æ…dá-w Rú6…ƒ8ç´È,+W–çÑÊFNRQiAAW0VðOmC & l:ŸYD|%Бw‰—˜‰ä0[nÈéA´Íwöo¹çg¦ùŠwøÑÛµ,EGÕ7”™Ò烊¬OMyóDŽ’ïº%IH¨h¤ZÉz|wkX±Vñº®8'°‹M#ì¥RvçR¦ß"¢|4Vø]AõæaŒæB]¥`3œÈ›®ªÆÜv™¨+ û±]UõÞ÷M3¾K&ÎíU—M¸ä,kb¶•«Z»ç ŠŠ¡Ü:í(Éñ{ -¡yìžâ7{O±ÇnðžÂaw³ÄågIbÞ†J:c8c:XJS‡<‚e£¤{J²¯I½EÃÔOÂľT½z~‰zž¼¿¢Çczþhªz«£’B•í¿TõÖpÉ, ¦((é¦X—,9¾èÑkžñUJä°ÛW¾TÅæal.7o˜ufêk¼Á´9s¢¨G¤bàfñiÝ >9ì®äzäC -¢mË ¾ÓÞ“¾é„’Ǻ'~~WÄð­¿1‰{³þ„ÉaÉ×r­#_åzßzÒÓK|Úá,þ9Ó¤dS¦d°x ,W‹…9·ùÉÕˆãSÁ¢4ôÓ0s Z¬NtœzûY}I(# t,y2vn»ëûšSLmiÈT֦ƘۚRåpÄHeŽkàabâ” n«•[aWOÄ¡·’N~·r -W± ÿpt„¯¿áÇð?úKÝSEègá‘ôXkH£,h­¢}yã0ócÈáþ|ÉùŒendstream +xÚÍkoÛÈñ»…š^a +°è}ñ!þ ØÉÙW[Q# ¹Â(’¶K¤JR~ô×wfgIQ2í¸ 4A¢ÝÙyí¼—¼Ãà/ïøŽÍd¿ãùÜ–¾ß W¬s '¿pƒÁ:Êf®ƒG¦ÇŸ·Ã™ÝgýÎôF£L£këô|8ž~üÒíI)-îÛÝžçùÖéåpÒåÖäâtx‰GÊÃöËÅhÚíqëbô+á#Îl<þŒg]_ZÓî·éo§ zÊV®Dþupýu"Pó·f˾ßy€5³y¿ßY(GÚŽ’f¿<˜ü£æBgªCT-7íU=⤬¯,–+çYVþµÛs„cåë0\&qZÒ¶7ó¿=Âé÷0ˆ¢(Oîãœöï¾&i”=´C«àï£ï¾£Õ\*´E‡s[9N§ÇQ¿¾ÿ.Zõ9gƒó³ÑÅ„ñ?£Ø>»¼ì2¢q4Éy„4¡Æ]¯£ŠtVÑ6÷ç—càÅï93£Àh$_†_M¶À樹¿]i•ØKlšØQPîPGñÍÎ~‘ÇG¯+ÕľO£]êåºÞÿýê*Iµ¶í«Ø‘E†›G;Z.¶M?¡*œ½ÅÚæñ-Zô„M†W†½ÓÙx¢©z•w…g3ˆL$WážÐÏÏœïÇwì¾:ÿ]p¼!^ßo ´·††Œýo±Ñâýw/z{œ'iYùö¬ágr­‹MÆEq³Y.Ÿ’¤E,—qd#çãO|·Lõ”´]éi ÛªkŒeX Ñ·ÊEá#$³ŠRÃ×€WF –‹˜Ž"€:]á[¨’Æ^d€.#b3‡ß2èy"§ì6ŒäßšmhO´ž+ÜÍ¢ÊÒJ#RQHRŒÒE°‘KÊ] Á(Ö·þ‰íôÑôiÜXfD‡ +z•‚DMVà Îs¯†A®Ïoà|³„þÄ…õ°ˆSZ•úëïw‹ i¡]Ñ\¸³Ò®‚ ‡:JÏ:ËÒÃ’È5çG8 +» Ó"Ðl mIL„•åÚZ/oŒØJÀŒ«ÊKXD…âëJÂ+UPÓ­n@x¶÷=¿û2ÀxÊUÚxÊ…²“Rdí4@DZ}æ™.8zÖ¬]Ïî+âÛ÷lGˆï÷l ½ÖmíØx‚‚^íÓép:›ìk!a®qˆô§JŸ&³ÓӓɧÙeKzÒöúÂàÆyžådàù¤ÀÿƒÛ¼èƒ§‹Ê¹íè“^aí[fsÌ‹û$Û†G'Ã|/ºÐ÷Ty|(®Úñù*¹]`H`„ÂŽl­TLsS‚н‚€g&&—u”LsØè@‡Eظ¬É+ÀÂÜ="¶s„òXgOU«$Üå5ñ(%EÀÞ:ü¾ë:ºs­懢3#epgª’kƒ¼øDÖy¢Y–EK–TQ2­¯rŒrʵŠ'" +é@go!@õ£ý;À¸WûW»,"*]‡ð0I÷Ø@y!Èš"Gù"Çê©‚N«ê땤·7ÑÇØsžuÝu®md÷I4·4©k-3c-„Gq$ËÊzaÕî+ªÔ&ë2A¶é¡èXÀhÏt0Â'*N´Ù–sÜ!uiïgy³¾í{¢Ós|xǨö÷KO(»ïyu" Ö’Èðhqm"ð§ζNqx‡rµå\†0Ô ºG#ô4[­k ˜[¶<`„ÍA?)l&¶Ï ÞVh>§¦;BÖY%U~e¢{¨ò­,0¸¨{ì!vy¸ÍnoÞR`”âyÝ}a)½D×£°À0ˆ´·³@…W;›`IQñ‹[zd3$’cîôÊHÓRK{ñNýzVHGYC¼dFQzzÄ …5*ˆ¿”O°¸ ²uÑš†+‹¡Vã¦q1—ª¡õ´â0KݾÉO1ª0¡=5äs¹¢i.‡Ù.ãÆ\~Àñ¾+…Eù»g'ǵ}¿ê9Í‘D7Å<[ùrLjÛ*‘QZ7ÚñŸ¢ñ-Âû¶„S¹—Ì%u} Ë,‡Â¯ôp¤Ôv€ÃM „0e*Ö?wt®µJªŠtèÊð‡Da-öxI^‡Û +m6ÇÂoÁ{Ý8IâX×bEHX×7”ƒSÀ8åØ}ÇÝ™³ŠÕ¼ùQàøxûì;^ãÀïŠ_ö¾ì?ß<›ƒ+›¾ª¿%„æ…øUŠß}÷=ùýú!z_E9l<;v{?ÄSUy½!6Ûõ \”» ¬?‚ ó0(ÊÆp:HWAqw[›þA9kiœgÙ +\vrèñ+Ð7"ÿ<9¹ž.~7ÛIœCq=¹††O}[Ø^ðM3ulOxæùDŒO7y^ÛnS”ÑMŠ­IñßÖ ¸Ó~øWdÅžz¬Üó¡ž™'!<É8ƒýd“û«àÉ€˜H1P¾ÑŸ1ÙÆW3–øèÛc<]lˆr¸6OÁê(ä@yÅ^e ƒaÏs~\a¼íóæððò\Ë,¼3ÆF¢ã^?ü4Wp¥lÚx’?§ îazæ˘b´öÓ|+þoüƒŒÏ’Ûä +²^Âãñ~ˆr€ÃÐ|¤áPà¥ûb(‰J0oÀ^%š‡gŸ?|Oü  …˶b”TŠÕ +Êý É:b¹?Pή˜½ñH2n÷_úm.þc_%ÖÒÚˆ¯ÎZ‚ûû*r×4¶†‚ÿD¥©Áendstream endobj -5374 0 obj << +5583 0 obj << /Type /Page -/Contents 5375 0 R -/Resources 5373 0 R +/Contents 5584 0 R +/Resources 5582 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5359 0 R +/Parent 5581 0 R >> endobj -5376 0 obj << -/D [5374 0 R /XYZ 85.039 781.388 null] +5585 0 obj << +/D [5583 0 R /XYZ 85.039 781.388 null] >> endobj -1298 0 obj << -/D [5374 0 R /XYZ 85.039 253.216 null] +1278 0 obj << +/D [5583 0 R /XYZ 85.039 391.399 null] >> endobj -5377 0 obj << -/D [5374 0 R /XYZ 85.039 218.471 null] +5586 0 obj << +/D [5583 0 R /XYZ 85.039 357.255 null] >> endobj -5373 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F77 4849 0 R >> -/XObject << /Im11 5348 0 R >> +5582 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5380 0 obj << -/Length 3193 -/Filter /FlateDecode ->> -stream -xÚµÙrÛFò]_¡h“ -YeB ‡÷Éñ‘(Ž­¥ÄÙrô …pÐÿ~û$œ¤r”ËÆ=}MwOwÓêÔ…?ê42Ž«ãÓ0RŽŽ¢Ótsâž®açÛ% Y `¾¹99c‚Så:±ŸÞ¬z<Æñ>½Y~œ½üîÅÕÍë÷ó…Öz¦"g¾Ãhöò‡×s5»¾xùâÜògW0}qy3_¨ÙÅå· 0?]]ýˆ{óHÏnæ·7ߟ¼¾éØê 1òô¿“·îéøÿþÄut>ÂØuloN€)ÇøZæÅÉõÉ:T¼çŸò©)9&ÒÇ:Pf ¥½…å¤A€æqî…³ -á–pN¦}­f¯`ž@Z•%L[ÚZʇµºi-Þ¹Ïö<Éžò¦ÍñÌšC–¶yU2ñ¶Âûå,ê.&YÛ{¡ˆ·Zf-JÕ³öÀK !`Rg th‡Èjžú’’*dÀqËëÉ:±w¸ÙLø³ÌQëYMB“l-“Û±’ñ6k²¡±œEåâ`Z¹ ½ðBÇ Á´ë¸QH¢_#· —=Ê\íp¢˜u¼Óª±4$) -ô:màÆOÍþ;|9 *F’{9ƒÂ‹@º#±Î¬Jð¸*D‘ŒFÃõm¬i†ŸÂ”¢˜÷}Ç -í£ÚrÀ<¸rÃbƒö@à;Ôy3Ñ|iMí¬‚Çw -ƒ,çooà81z%øál6síÍîš9ÉB´»†ÏŒœÍøNèr2F³@YCtc6Ç΃P¡+Vâ¨ÚÈlSÙõ±¯ÈåtÈI[ éº5]d€„²`/ -¾aâd/Ê÷oè*i‘w¡@ƒm‚·¡¡<[#öO¸Í÷Æ«½má9Ž÷6 ³¬Fq«šáx‡-¹¿}ß÷ò°›F i6‚ -ܸßÁ ŠjÍ C -Âà€Ë zê=¯P|X þev·³öpHŠ¬? *ñ==Ö-|OÛ{U³Åq”ÀçFyôŽtêÁ3½zp¶«æªÆ€ j¶k™^YÉ áM^®‹y‡®ÈKá•<´ŽHÕZXéŽØš6©ñd,¥ ©$ª=å+þµñ9Èb¸ÂI€GvÌËIÛf¤Ž-û¯ÉI2A4`× b@Ô;ÇqÙPxš±Q 5¬…”I‘Ý !Mûd…ÈÐ[7åKžxb0Îj6yß0¼gÙ¡(ísØ–R¤ò†·ˆÓ;$¾o3†Y‘¡ïŠM;PéÄcÞ .”?Px[Vôê5Bܺ¤9Û´ì"«ÄÎee]–#ø:sŽÃngI”EUcs$†k¯Ÿðz j5/27Ê$Äq˜Ë×>8¾vÇÔÚzße}sð>ãú¢K+€®¹Ï…4šFÞ…&\±„Ùîë‡æ‹‰Û?R1Ø çHlÓXOÅ[i"ñ¬s”Ï8¡]U<±ãMT½M ÜCFr¥ld_‹C=tÑ+[Ïe}`;䕤ĘóaWy¾[Ç -Ù!Õb7—çûaÏÙK&Œ¸òÒÀ´Ìˆ1Ês<ɲüÞ‹9Ƴ`U;NÅúd&u.(ª•@ÝK>7x€üøâüt:—7Ëû‘÷›EȆpv•£ctEˆ1Æ€K‚º#v€Cï²;û†Ü.Û˜kL¾‘¯ÕŽ|4˜ñ•g%ƒ$˜‚4ÙæÄ ^}UçŸ((Ãø =ÚYó9y ®Ð þ¦<=ÌqAañxÊ1A4v}ㆃ»4nDNUá0–[ÌxÂqý¡R°¤ÕŽs œÍ¼dÄÞÄÚ3bã`ŠŠ³Dì_K‚L¸‡ÙAa7¼O¾ƒƒŽCÉ˵-7M%àŒ‰²ñz1õä)…ú„}táX ùåƒìcN1:}UY7õ!oƒh°ê«^#+ÆÁ!÷¸¶¢´˜âÖBB–dÒPPÁ…3÷Ìb2îÊæ0ç(›ó8:÷zÎY¬¯+22r.áEÓ¹ÁÇ-‘g€/oarþáâòÜ=GçdžïƒÆ9$¾kŒ¸Ä…3ïŒÈå[.‰lÞ…Ëï*~¼ñ…læ@p„°¢áD»¼yÆcG -H˜åVš$€á—·ç´÷Kœ{çœë›hàcñ7É~¢ð|Gi):ã‚z~&U4F«8䇾ȧ½·ç¿\áBÀ¬Ñ‹}e3>—ÆæÅåÅ}¦Ïx€:-ÉäoûR>+˜±w쯔 - ãKÃå^“x,çb¶’Z”ÄäSÆÁªÕSªU®r\_‰âÒ¹Qød/´2 (o:ÖµŽ7T‡Êö¢A­—á›±¾½(`ËæΦRÍêd/À«6+yÈ)´õL\™,èiãÈ߉Â`Ì[+À#¸ýB -3; -ŠQDᶂŠŽ"€V1>Âr½'']ózW,©xXzÃŒ;7jöo¬zôŒjžV%;T‘<ž*ž$Ê5«Frœ¡U²NFy8ßü˜»Å³ESa9Œ(™…V’@ºÃàiÒŽ%Â|ô8­è‰ßpP° 8>J4a cÜÓ–Â|Ý#Eî‚ï9&ÔÙ¨}€ó’¿Â q¯~D´èº×_±Y‚åB@8®kí²\­'LWŽlœhöD*"íMàóµãƒWý.º®s±eMò¿Å‡>þ0ƒSOY3W{Žçë?Î)G„)‘•ãCüaÑ£Ù—ü8vŽ¬¤·³+&2öˆ;—uu—`™]ìy=íâúLÃCrFØO“mÞ&‚ s(fkj÷ÄfXNFšƒ€žq›e·Åp¢v&˜+JQ7í£aÛ &Ôá -©#|¶LßØœðƒ¾¹Yá¡G\ !Ê–<¤¾E5·Mëxœê§ß+ßÇÌH<ì@8»æ×7r!ˆ *\ʸY¹g3Œ¼Ê¬h„æ¾¥g­?Ž•Ç­¿Ð8Š5ÕXIqŸ9±[b7pꂧÞm9É—çA9¸ã÷hx«ÂÅÁ`ØFóa/jÏ“Aש´ØÒÔ&§°ø˜“"(çÅy"À‡ÖÜ|ó§›oüòx¡ãzzdK?–Ö \>T…5rA.I`uP†\Šãj^ZñÕäþ²‰8Õ1ÜŽƒOßr´dz§ôM§ÛfÙuÙ(w£¢CQaå ‘Öˆ¹-pvc½#—miÃãÛ±‹ÝSc +W)C“--G®ž¡ìfåéº+x!1×XßQ’á†Å/^±È?u-Å­4?¹§Ê |i•p"O²•e—ÐÊ[J`Ÿ2N@^pŠ0NûGC(öÂQ+Hî3{ÌL2¯vÂö ? W‚yyÉn¶={±ä5#´ùJ3qìea0ˆx Wš¾Ñ—ç«hgQÔµ€tÈ™´ýMj>î[Ì™@þp–v†»ô, ÁÅß™ƒª‹9ÒãHjS„}Ã_&ÕÐÂãí!³ Í_. Úæ8è]B%üœ{ÆCâu?{eòd d~ ™E&¿9ù.ïbZô o+á~•mûr™Og‹Ï¤ÄW.e³’ìv“FNµë×VƒÆMc-êÛ Ç¢¼²À/,ÿhœ¿ŒëòøêzË‹:½‡ð¶»ºÃùô²zñ7rü>EÁïqq•´÷ǯJûøw 'œnQ)_âˆÓAiü'-½v–E1I$i“¤Y9ë¡Y;OÛåí±G½¬ÊU¾þ+ˆû]þ9þ¿ËŠí_FïÜÛÛ‰—5+Á9[¤ÐüYÉ.ݛ˛Ï^ÁßBe—6ÚÛÑ0#‰¶, 2ùG¥HvM³¬?ý³DàηËôŸjg™´·Ÿé'k×ñâ©n2üevþÒƒézÒº#O·¤¥¦²¼ øž2‡üÚÿ.sÄðÿ¯øòendstream +5589 0 obj << +/Length 2868 +/Filter /FlateDecode +>> +stream +xÚÍZ[sÛ6~÷¯Ð[©™ˆ€$¼ONœ4nG+“î4%Ò×´¨R”ï¯ßs(Jb2»[wf'“<8À¹à\>P‘#ä(5¡Pv”¤2Ti:ZÜŸˆÑ-Ìüx"‡éPħ^ÎNNߘx$Eh…Ínˆe–ÿ¼z{>½þ8ž(¥™†ãI’¤Á«wç×c\_¾:‡S:˜ÂëÇË«Ùx"ƒË«™y>M§pnœª`6þmöÓÉëYO…‰u¬P‡?N~ýMŒrPó§*›Ža,BiíèþD­Ü{ur}ò÷nžÓ#^5`éDë(©M”ÓTw&+3`r•mŠæŸE«Ãõ:{"‘˜à|<‰âÈ6Vhˆ`¶ÜŽ'hç놑æ§gÂœ©ÈQ…Ph8Z+QSKbÎ/>¼|=½þ^¼{‡Rb!PŠ4 M +kâÔɹÎZÞè}öäHÊí¬Îdz¦Í&çí»iON$á)S‘FRŒ!)Ó‹7‹¦ÈÚº‰Âéô6"2;A&ѱ´]úM¸gté3‘|מ·W—×Bžo¿†yU¡ czeŽí,ò¤átÀ¨ï Êó{+òç÷ïËŸ’µÉÎ&Ûø¹D±M¿ç…‹oEƒVZ ñì’®fo%%Vh¡ÿ¤$³ç½žM. HRšÄ²Ï{P(êòê²'JIØJ +ùürrÌ–]Œci0â¯0(/n ÒQúür–Õú0iU[ûìÁ°lŠÃ`P‘2é_à;®ß{6E±JÔóKzXIÒF˜ç-Ÿ¾‘K26iš>¿(nûuÜ&‰xv÷ýÞ·,-µ=»¢(Õ2ù_¥¥RÙB-l3×¼ªw×7üÜ”ÿ*Üq$µù%QòxMö•U6¯ +uúFöqÄÄÊ0V1 EOj«º´ÄРëE* ÆQ0¡„¹/BêEÖ–õ +§mPnøÙ.±ÔðØ`A¤EЖ÷´tÓf÷kžF;Ù ÃÊ \¡¤…¬n™‡pÚ^2 +‡·Š÷ì)s+˜¨ÇQ<2}‹ò’+ dýsžø‡’!·{g¾zC{–ó +fžÁë Š6Œ{Ú ¶„ƒÁÙ‚'—Ù†ÉdÏ‚ªI-ñ2k<;ÞòŠxÊÛ%%WÒfç6ç<³qDÇâj/.ç´‡ýñŽÊ +dL¤}ºCvN5Ôk_0¿]¬Ušì2Ÿ›à^Ñ4.ãÆyn +qÜ ÔØ;QÞŒhôb鸉Ú4ÔPçxýM½#/ÿXðwÒ°*h@÷Ž^ú]"hå¢^¡«¬…¬B¯BZMp8§rÞùЩáSpGôR|>Qa*Ó>º8zì‡ÒvAGƒù¤ÿ  —I+;¦}¬‚W=UðY 8_‡iš¸µçùV`,1] M'v+ÚlîJ È|˵§`‘¥« 0ÌøqWP÷@È@X"ŒÁÑížž4ÎûÕVÜÔn@0‡}k5œ}ºvûÎÅ0Ð)âD-"®ÑõzâÒo…T(‹.„´eJ†ATùÞHvàrªÝµãi9ÁÎesfu[0‰ Á2‡¬9µ­~ÿ 2‚ ®‰ò>XŸ»þyƒmż +YlíötOj@ÇÉ·¥nðè»hë¼\=1ô™Ä‰ þÚÈ)wý_\]'=´tÖ`7× +½#×ü|ÀYRù‘×gØ„qf¯)ºõw;”èÄù} +ª™ +TÚ˶aÞUñÈÌõj¨Qm–P\m³Šª!9_2ê(µ7‹ § JŠ4Èk”ì”y¨ZtµNY×ë¬;¯ªôçÕ•pXåpŒH¡xÙ¾žÃ6Þ©´¥HR´¡Ü]–-­mSüà˜*·€ƒÏ)}É¡rìŠ.Z\€ Á“âKÂ>&•‘pÀÄæÉ­8hù†#i}¿ª§ç$ Z³ÚLYWY‹\7÷XLÙ%·‘.ˆpä<…ÝÝF‘ÜÆå ?÷¬©\g»ãWWö¾#”SÜ Ô‰ ‘y¯µZsjÓÓ÷@~Íüµ»Xöi\ÍNáÆ(N™b@†˜HGWˆ( £D‘ ­Vÿ¯¨D'T”ññ™ªeÞ¥ä†É`éW´ +»ÝÃ'8‰y2ö5 æ?wôê%ð]ÍÈIÄ3÷€f¨ )aÂDûvUpˆ+¬'p1âÛœµ‘vèÌ©!ÖÈ@Çá{Aÿ÷,)“P[ßR_p÷ÔFz¿|p7] ƒDŽqéïG@¹ÞGI@ábÙì²Ezxë(¥x³ z—2qòšýîðUßc/ÁE9TZ"¥ck5Ü;•.õ +þ´JÍendstream endobj -5379 0 obj << +5588 0 obj << /Type /Page -/Contents 5380 0 R -/Resources 5378 0 R +/Contents 5589 0 R +/Resources 5587 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5359 0 R +/Parent 5581 0 R >> endobj -5381 0 obj << -/D [5379 0 R /XYZ 85.039 781.388 null] +5590 0 obj << +/D [5588 0 R /XYZ 85.039 781.388 null] >> endobj -1302 0 obj << -/D [5379 0 R /XYZ 85.039 580.482 null] +1282 0 obj << +/D [5588 0 R /XYZ 85.039 417.891 null] >> endobj -5382 0 obj << -/D [5379 0 R /XYZ 85.039 546.342 null] +5591 0 obj << +/D [5588 0 R /XYZ 85.039 384.354 null] >> endobj -5378 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R /F35 2976 0 R >> +5587 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5385 0 obj << -/Length 948 +5594 0 obj << +/Length 2399 /Filter /FlateDecode >> stream -xÚµXß›8~ç¯@{÷ÒáúÓ·”m·©Ò”nèõ¤í> 0 RœÍö¿?6Ù¤wj7(ÆöÌ|ŸÇÆÙPþÉ(€$0}†aÌL74—räÆ@½†Ó«8:obãÕ;Ꙃfœ?ù¡À¥ÄŒ³;+|?‰â··¶C±¶ãûÌ -g“…¬Å4œÌÔkE²y;Ƕƒ¬éüFë+/QôIÙŒX±}0ÞÆ­PR§ïÆÝ=43Éÿƒ ˜¹“2Ho I -P—ôíµ±0>®ô˜kj«s! „ÊÈi =ˆ"žÔrMŸB@¡Ûáš×¼Ìx)òbÍÛ׶C1µî¾!âªKÚ"O)¦šuS”âO%}%øæ)‰¨[Z¶Ä…>ÈÖë{ÉÊAŠtpA°\–b<ˆù›I4׳Ù½(Â4 -O.:‰´N -¾ü‘ -’µõztžbÜm%A¾oNæA/‹ B5î,ò¢äªfü×\­‡BY­ë‘W]¡¼Ñz×Mñ°—§e^i‰¼î¬÷ÆOÿ›7mQ•{|–ÐËùù0)«RËÅ-…:ž¼éŽhAιš4éª<Ûfpóµ(³j×öþcý|dÞÿQ‰±ú•ÂÃJýt_ËÈ«}ð»Î§]0Ú%x¬³3{-¬Ê¼X¾ c¿-~Æÿ=_×/vô:l¶¿)ÄäKÍ>ÎãÑ2c‡’lÛ6kNâD/ˆ!ƒUgéhGä0¤–ëˆñ@Æþ¦ÃãÓáÑ¿éðøßtoøæ2I…-Î’r¹M–\·zUü«™æÕ;tXK8I3*Ÿ>@Ìȩ̈¹¬lílì[\ÉÄÚ5²B’'¼n‰•lõòÕƒ™j «K9Ú_éç7ˆ\/­š”™îÒ|ulß´ÊC!ö.È•VP.d÷ºƒè=)½RÙ‰J+g…T#š…æ¶Wèù£ø/Fiµ©“†Ÿ æ0WYB6¼c¹UtÄ_º‚¢$ån”÷Êb¥X¶ºQ+9UÃBY«,Ù-ÆQa']<¢—¡©*ñ‡^º6+ò\‹Øé6`Ÿþû†bM™tçêÝ4$C ‹ Tê8fqËè>¹ÙNàRxÜujq­¤AàÓ£žóe4çJ_yiÏ/ª°‡ÿd †òùhËSŒF{.j&yÏùî+ñÂÿbËendstream +xÚ­YmoÛ8þž_at¤$ê¥Àá¾dëÝ6Í5z‡¶X(’ •%W’cçßï g(KŽ’Kq‡|0_†ÃáÌÙ‡Šœø““PÙÂ&A(m7 'ÉêHLnaæ·#ÉbâÙÂW8õjqôë™ò'RØ‘ˆ&‹-²H¿X¯ß^,Þ~šÎ\×µdhOgAZ¯ßŸ^N¥u9}ú§<뺟æç‹éLZóóßHe®..>âÜ4t­ÅôÛâ÷£·‹ž 3Ïö|møqô囘¤`æïGÂv£p²…¶°eMVGžrmå¹Ü/Ž.þÕi¡9oB«FN:33WØaèÉHßv}ÐѹÓ#îø*dpxe{JÑÂC¥8Õ×)ՈγièYuµŸÉЊñ'°®Îçÿ¦5xf×í ôaÕ(Iª]B;oH0AÒZÅeJ³_…0_ÕÔIìnª|+®s˜‰Q¾œ:‘ÕÒ\ ƒË¬Îp¼ºÁX£Ië·zP {çpÝÀö£€OsyúáÕéìõÕÅ%‰Žì;¶ïIc7mŠÒ(At Pi¹2^ANäk“œHѱyì2^MкŽijY5-MÄ%¥4ºÛí ³£‰šKòlÖ`3+QIÛD_œà|‹N Òv°å:n´Ž-V5oɃùmi¶ã‰¶¢ß«j_’£Ü!6`Îy ^'I‘g%œL9Êš]×UÕþNµ;æ¡„~³r³Jëü.«›ã‘X9®g‡ÒN¬fF–, õŠÿà5®68ß·¶yg+°XM–Q#¦Ÿ‚‘)u|óò–Ö`ñ7. +j¤Žü}6ÓZÌèã@û¥¾£+Ù²L|MîÃÀ´–àz£uŒÔ´¦sü–·.ÙÂf©W)“"c½¾C®½Õ,dÀ5ƒ=}åY¯´S@®kå淡ߪ,î±åXEÞ´Øßhpf5ɵ˱{%Cß¡¹-_>çeZáé1ΘhñwúßFbvä˜(/³8ÅÛ^ÞBñ ƒ”Û©3IjNTØù6&Ö¡ú¦º¡€äæ¼õdÌp$\Ö‚YÌ-º¸¢=ïX÷úúhhkp*-É·8­e›–qÃ˸¥Ö:® @ÃÇÚhÐᬷÃãþ¥"ƒÝ[ŒnJ lWLcAF±dK«³XïQ¬=ÄÇÖRtßö‰Ãõ#u…]è@¢Ã¢ÕÑ‘Uf[%(C¡\PžÃîʨoUi{¡9„­R®5/YîVS;ÛÅ«uÁ«ó–öÌÙ:ʸÓh¶ê¡ ]ERŠ@>q}ƒ°Ã ÈÞ ×ã2 cêÁzB9Ì«®ç[:Wš½*IœÐùÑÈóÚjòšÖç¢,¥µ£Íµ6 +½a†°UÆñ(“¯x‹*±t)è„}odP@ &K,ÞÊj6XtÖh [“pV™ÅasšKtí¡šŒNó¤õÑ Ö&xšƒüƒ÷¼5*XÒ(¬Ú9(pc¸´áª#ªö~QÌ98·œÕ³°# j$Ë….Xäiã7&iPcLŽb¿!ê"š#+R©¬($iæ=Âúð„Oh³Ê±©ThJŒc};Z6²Î(2YÌ`bÖí²*¸¹®µQ.áàAj!ftà€mÞ.‰ w˜ªüy~î Žë~´÷L£fQÃaP¶1)Œ.yšw<&i«ú…}HM±t;2ˆì(ÆŸ˜©xR³TGŒ°Tàþ¾ ;:v¨«md]"nÀ„$Vì%TLß諆üƒêé¹NØ:Ãd»üZ³½‹Ñyø pléÈG u[8îÓtz@Q’¸¤ÝK¢3i +}h÷9ˆIÈQ˜jô*“uà»–ÓNPÖœùÌ@fˆ#ܬ£¸¿žùN¿4ú‘-CɦÇiJ¦ wS×Á›ü0*ß½×0¯XJ¦çû ]d;/^ƒÌP(SÊ N4€nWI$çFä5‚½%DîáÓOŠHpùýн+`ÕanY¬''4›s•‡æžR¢~¼Uýýáj8”Pgϵ}×'ê DùâJXtG¢!«0òUºžöˆ”úI×÷GG°uŒßØñ-{JÑ×*úTàÅêžÔ ^¾{s>¿òÏ4³ß¼ÿ^XlW²)ïR¬°‰–^¯S³øʬî÷ß½¿mRê1mçW°äÓéç—}µ æ¤ßŸŸÏOôÉžeT·ƒÕiv3è/kŒüSFõ¥ïÊt¸ºXwý?>|ÈKm-ù}Ü×ìÓÍÎN‹â¤çìóÅY_÷Ÿuv‹.ãGÕðyž°}/Ъ“UJ²ÿ ŸŸ@ÇÀ^eN8pÁ“ùoè F|ÑãgÂq¤#ŸöHZ&®}ƒ*i± ½2â²ñµNçÔÑ$Æóu†Î5ò”y%Ak¬Æyª[ët}OMqòŽ‰ØM¶á}ð«ÒžFj}=­'DŠ÷åÐCZËK™ã­éå^6ùua¨zÐçÿûrú0”ü]… XcùóI©þ¢Õ?Ÿ~Çy‚èŠüØÆÔ5šÑµ%n©£KKü5á3Ó†»ÝÓËÀ¹¸à…c¥Äu3®o3^kCɹúÉ!õ76üœ°ÿ„A¢À^ôw^YoÊÇ?I<ä2²…ë0M¨‰¬iû  +2ՆǂX¢uîz”vHÚžo¾ ¿6*Ť‡9„%-˜“ΰæ·ûgÊ"‹(©t\:†KŽ!ˈÈ(O_8p8¶ÇhZÆlÊÚ¥ Œ+¾Ðp“½Èïgľÿ¾¿èïÉüñc÷ž¤Byø¨5NùÛˆJÁ4ÿmÔ­vèf©/‹…p¼GЬ•~ùÜéïØŸ¬HÊÜRºQHîÂF÷:—û=:¯kÛ0®¾–µŽ]–lZÞ).G:ö QÀ¹Y!¯ñeù¨mm’F•c­7íØ×/Ï]5ŠSà‘Ìlo˜Òº ØÏ´»F"xÎ:4í9 +Þ]J9#†Ê‡O9¬¡´¥ôÇßFìÂÿí)n¯‘.O>³GšØÿŠ1ð/Q’Žendstream endobj -5384 0 obj << +5593 0 obj << /Type /Page -/Contents 5385 0 R -/Resources 5383 0 R +/Contents 5594 0 R +/Resources 5592 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5359 0 R +/Parent 5581 0 R >> endobj -5386 0 obj << -/D [5384 0 R /XYZ 85.039 781.388 null] +5595 0 obj << +/D [5593 0 R /XYZ 85.039 781.388 null] >> endobj -5383 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R >> +1286 0 obj << +/D [5593 0 R /XYZ 85.039 570.527 null] +>> endobj +5596 0 obj << +/D [5593 0 R /XYZ 85.039 536.384 null] +>> endobj +5592 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F20 3021 0 R /F62 4159 0 R /F81 5323 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5389 0 obj << -/Length 1304 +5599 0 obj << +/Length 1793 /Filter /FlateDecode >> stream -xÚ­Wÿo›FÿÝ…×u -HƒÜq™4ÉuÚ4Ušy£Mjûb#ap7Í´?~ïÝ;0Ž©*-mTq÷îó¾Ÿgø”ÁŸ*é2MCÅ]¡Ô4ÙLØt'nŽ8Ì‹åäô• ¦œ¹‹¦Ë»½éúRL—é{kþz¶X¾|g;B‹+×vÂPYó«ÙÍ­›Ëùì -|kÛw—×KÛáÖåõás»Xüg¶ÖÒþ¸|3y¹ìÃêBÆôyòþ#›¦ÿ› sE¤¦÷°f.‡ãÍ‚r¥/̾˜ÜLþìMÑ™?%­±H¡\©Äq „Ô bn„ÓP2W2_× )±r×Å’ãÌ“äÆŽ¾# žÝÎWo¯—îù”FùŒYÿÚŽ­x—l‹ œ¤E¡yÁü@ýwÂî’FxÛi\È!¤- áõgÌX¼kš´þ¢AN…ò@r;äµM‚s&!ôäŽÆâmî¦q;0ßIFÍ Ÿ…ƒp†’£<çå¸p“²íʾÛ¾~1[\RÍ ¼Œ/óCp'zµÛPÔ*´ég²M¾äÙ½›};×N€¦Í¶è¡cýÌçÍcÄ‘´2Þs——Ùàb|ËP=R÷CÐBÔøE†¨G}9Ì k¸ª;§¯ø𕃻¸L;ÉÐåŠ4Ï«hãš/à¢|²OYmî*½« -dH8)É[د«Ýj ÏŸÀqȬóÖù›”¹U#Ò·>0îYƒ›ÀºHU“ ŠįIBºuƒ9"K’ßç­A 4ÕŠ¥íEV›'qA'e¼Ñò†¶mí=ì³ -)«’˜ @³&ý¼i@»îòÏkâÛ¤"%£û+Iã†(ú…ÕÎ@ã’:±,#–¢®6´Ñös£ÜäÿL‚ -ÕfëÒ6UyF-=`QˆÔn Bi]UíÏtî°Ò¸ÈÍ£ÜâØ~»Ëé¥ÛŸÃö7Ú§p"_2ë¾.N ªÓl>%Ež!{ þô‚Ã7x]në¼lQó9:·ô<™¥›¼Ì›¶ŽÛªþå+ü;¡“ÞÍaœ„ŽŸ%)-þÞß*8]˜¹I÷yn$ÐuéùHì+>‘àÃTµ`@˃HÒª$æp|æBàfÁƒÎæ×Hœ¯¯0½\§´P“{^¤8q½µ\ïÈãÛø‚Ñ“yg‚Ÿ1³óóF*1âÃã0A¢(òÕ\è4ÔÞÅ­aù@y”æŠIåùOÌD~Ï ü0¾ÿ“!'}O´·Z©Ù”'º)\ªÐûŸ.ŽÈÛÜEÍÝv{ /µ/B <â:\g_ãͶÈhso#ïÕf§9ŒxV+Ä”UMüæ µ'GÍV@ŽIG¬h@3Ulœ6ë -MÝ›mO’u·Àß°Æ[U&ÅÎæÄ€¹7gÐqéí™’bX{\KV{æÆÍp¼pPù ×úùu‡ÃA†zZU¸TV“ú8iÍÑ:£EÒסÎãåXŽÚŒµšDz¤u)6$Ód‹‹ GZ¨Gš„ISãÈ:Š2ì'”¹‰KœÁ'vï´ÎŠZé(Ã~aX¾X÷MÏUÄ…—™;RÁt‡‘‚á˜ÉU›@±Ÿ+3q05ÐÀ†½ù1Ph«¼\Ñ$k+z¦4EëÁH&½ÇUìñtoÜo|¤æzÑ؇ü§ÄžôýÒ¡ÁÜT"ê?N^6éy®Ç»X°ÇÛ}çüc5eïendstream +xÚµXYoÛ8~÷¯v±ˆ D¬HÝ ìƒ›IÑíº‰ó°h T±d[ˆ%¹’'ûëwR¶c§-4yÐœçâGKË…iÅp½ÄŠb)¼8¶¦åÀµæ°òv 5‡kù \z9¼x„–tEâ&ÖdF,“ì“}v>O^_Ïól‹¡E±}ö~t5”öÕÅÙè=.ùö†—&CGÚÞ2?ò\ÇÿàÚ0öìÉðËäÝàõdÇÇ~è¡ ßŸ¾¸Vf¾¸ÂKbk´+d’XåÀ<øž/Wƒ½^ó-–:rRÇp82‰ +Ž{ÃÁÓIïåñ¸ p%ðEà'ö庪Šj'#»YÁWÚÓ)°,‹¼êxzSt ¦ºEÎD 9z«Ëšâ.oŽ¸F ©ä¶zJ¸Êëm•Á[¯Òr¨bû&:~èÚ•Ù1ÏZžéjþÞV52nx´Až0Ó¡Š€÷%öª)`ªB¾¬%N#%I7)•öfŒ½(°e0†3"sÞ€×båÛg(Õ‹Ò.gVmjI“+X^¨z®÷›i»,ˆÛe¨Ä(ïΤˆbØrjöÝGÇ8EÈNqŒZŠI­Mó}É»-ÈœYͼ0 /æ9ú:²o:Ѽ%­¬›‡aìÛz¯Þv`˜¼zÉÄgWú˜1$Ðb‘…=Ts¼xªàzQé›|C¹é² èVCOÙxÚmNé…3œbRÅ1êv]5­ÉÿeZe\Çéýµ(rv3É+DߧÓnùÀÚYò^Þ~Z:¾'B/bËëºûŒTb:ÕÅ‚Cçúÿ¸‡¿=5åï‰>FÇY™Hé2]>ðJ•–¹»ýýräœ]¯(!©xÿ¤eÆœñç'Õ“6G«S‘p¡íPÁ­§Ó¼mgë%ºC+Z¡ÅžPûxíÍHh91¡<þO`'é éˣ؉`ˆxOc0’rAS†}_O(ÓŠ#!cÕƒ’з¤H삈ƒÄ„]àòJ’No}³¤pý$ñxu‡&C·B4ñ⢔֫,²¶Fy‰P€jÁ]A¸5 ôb¥ 7/J¥=à§hE¡æÚf1çÜ®&?±ô4ãþKFIÅ/yœP`teÕBk è¶H“˜&3&9߀Xa¾5„@ºœñó¶üMQ{“§™V|K·Â’M¥U12rÂXÄq²ß PšŒ& ƒ`Ú®Ú7ë9„xà«„÷HFÚ*ÓÕï -˜s #C#‚ 0š5è”ê¦õ¼*þ#P6ç¥Âż5(Ý„ÓEÕvXMýõqˆñ´ƒP—qd@‡Çñcû_bõrá³™÷]œÓûv©9TÇë¼sʘ˜|Û°dºe^æi«É67èXo”ú$‰s\º†ñXóó*åÙ5 Ï|xÔfŠ*ƒŽ©í—7p_Ǧ›÷q©i–S¬mùÃ]Ý£ƒˆÁ|s«ÛV/¼6 °#\ÿä¡ÜJ7Ðù[`ߣàüzÌÔ×U‘a¤Ë¯¼É¾)"©‘P»A-mÒ !]h“!$  +Ÿ×²üÁ›ÒA¹äy}ԑГcÐ¥¤ˆ¹)yµ)_n¼÷Âô…ç‡^˜‘~Zž-Ñåý+ò¥4NÝõå†öE_iWÔóâ{¼A& ±kOólÝì5ÝcoÊ ¿ÿ¦A(xœ¼ÂTèÛ1‹û Ú´`dîuéZ'\‚Køžk81PÚ| v$¶5*ÈLKÀåBïZT‡ìúÉìâ7lð²2ÝÃèÜ‚Ùro<¶a;BšË£[¯xÈþ×ïmÀa-n­‰y# vµIh‘²¯pwÌ2ïNZ&‹ÊÅæBnö¸øø½s»o](S3—Þ`ׂiôãÚø¬Õæôb×ƶ.n$éÚЩžk»&-æ‹¡JìnF¯cji³×‡~jëöRh TR7yÐ]Š¯¹Ò<4Èá©î15n-Žà‚$^à¯*‰çý„ä!té£úÝPJÀ70ÐŽ»kàÿüµ¬5endstream endobj -5388 0 obj << +5598 0 obj << /Type /Page -/Contents 5389 0 R -/Resources 5387 0 R +/Contents 5599 0 R +/Resources 5597 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5391 0 R +/Parent 5581 0 R >> endobj -5390 0 obj << -/D [5388 0 R /XYZ 85.039 781.388 null] +5600 0 obj << +/D [5598 0 R /XYZ 85.039 781.388 null] >> endobj -5387 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R >> +1290 0 obj << +/D [5598 0 R /XYZ 85.039 761.463 null] +>> endobj +5601 0 obj << +/D [5598 0 R /XYZ 85.039 741.337 null] +>> endobj +1294 0 obj << +/D [5598 0 R /XYZ 85.039 189.052 null] +>> endobj +5602 0 obj << +/D [5598 0 R /XYZ 85.039 153.741 null] +>> endobj +5597 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R /F35 3036 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5394 0 obj << -/Length 3072 -/Filter /FlateDecode ->> -stream -xÚ¥]oÛÈñÝ¿ÂõK(À¢¹\~æ -ÇI®>$97Vw”–h‰gJTHÊ>÷×w¾v¹”d÷¡’³³³3³ó­¨Óþ¨Ó,öŸ¦™òu–Î×'ÁéV~>Q‚1”©ƒónvrñ1NNUàçA~:»èÄ~ëÓÙâ7ïê—7³_'S­µ§22MÓÌ»úty;QÞíõÕå'\Š¼øüzýe6™*ïúËÏŒ8ßnn~ŵI¦½ÙäÙ/'f–-{ °#O?N~û#8]ÿ¿œ¾Î³Ó'x|Ëë`Ê#-ßõÉíÉ?-)^‹Ny×1Œ©Êý<Œ_WS¢ü(ÑVM!¬*?cWMqàÇADjÍä>ˆ™€‚â8ðn‹õ]JH¯Ø NüqÓV›¾lñ#iå5xmß½¤9äUfbVÅGîT%¾Nˆ×ïÕ8]4“0óžºÉ4 -"ïËì" ‚€?¶° |NÂÜëÒ•í#¢—(J ˲­è:„4“),Ϋ¢/Ž „¦aê5mÏŸOU¿â·²˜O`eeÐä¼ÌÝ€“8òf«’h—Œ³iÚuQ×€ùÌGôðZ<SX•¨CPÍTáEç$ì}ƒì®Qá¹×Üj{ŸÐZÉTÕ[x;‡Õ4õ®~ýì~~¼þô¾ÞÒg¢÷s¼ß(ÃûEî ¤yô½cÕ(Ô‹Út;vKú"Ι§—9!ãÑ[¹íÙVu\·*íä¢Þn­íP¢ý0¦Û “‘Ú'JîJ¡ÛVða®Óœ%lÓæÌÛka”8:ÃH!*-tƒÚ©ÆTnÐ$È™P!U*C¸ÅïžùbÊ5ˆÏ9Gò-†YŽ^ŠDÓÃÏMÓóKkô6øŒ ¡4àßѵ±a#PˆžYéÏbÑzÓZý¶ éÆØ:Òÿ7 P9¬`/­ÐV嬶ü\Tm¹&û‘ë¥5°!G/ñÑ` ƒœ-¯® kÖBHFÒ^‚îùÌØtÙ]eÍ>ÈèpéŽä.«Í’á}S/ø­¸c؉ r±‘%<îqÃ5"麸«™­7¢ îÓª”£À¶…Ýg^BE”]oV+æŸÞ 17çGŒ¤È´OU‡‡Á˜v˜Ëa-ëŒQù07¯¨i—íœãd±ŠEÏ‹Ï£R+d̆(¾dä øyï;dà ßÅàºÕ{Œ™}Õoh[ˆÊtÊ­‘åXØ<0 Hñóºs_l·zždÈ „ÂÔ #¡/ F$jæÇçC :Ãà!ÿÓi8¸×ÖµX°:죱p(vÂól?¦ ð†®€­‘l~³<㋈ÙïL7€ˆèƒ˜…iÝ y^6:„xXr…$á»ZnÄ>5%O\ª›e5‡B07%›xHt§ð´Ù§î+Ä­K³ÏIržsZ¿‘ŽèÔbÁow”¼ŠÍÜ2ÛÈ¡÷ì˜Ä“¹8hÀõ=ŠZS§–døTv•„VŠ~+r @8&b¸™³cþX”¿*Ú” &sO^/]³–b±†hÞ563bјðšz¿qðïÏÏü±ë܈"üfá0,hï¾ÕcYhÕP]Œì[ƒO‚ùØ€’Fcoé9ØÂ[ÑŠ­?Mè^éï'5õÚ¨ o€…Lf«1E\\u6œ m~ 1õ¿ÞÓ8ò6ge®Ix<î ?‘áJ²ß¡às -ïhVìàl†¶^*c{–{ßFƒ•íå_è…¹E³l ±b6 |[Šj¨Y¥62žÀtÉ9w±óÝa_zØÑlšÙ¶u–Ç+ù8 ýL¿^É;8/¶QžBw–ÚŽTÚŽËǦZX9 l”º쳡\-ÜÞšdèg’~Îqv¡Ò—»–’FÇè\x:”®¸2ØHaúžÔ‹ GÑôqñ£<öÕÿßÁy±‘®Ì׊Ã*fË( -½)>ô¨h¢üµdø…žö¡Ã²1 ¼;©:p ëš•5‘’äeøÒõôtƶmî(‘íwÔ‡ÞgR+¢þ‰J¼ë9áíä¯e] 興“ÞæÍÀÑá^°éC‡‚„„t·DKç‰÷'±ØñÇJ -)ñ¶<Ù4ò‚å¸ÒCV•‚ ½:óVŒ?âµäµ¦²”OúwÁ°BP)£0Û!•6*÷FƒÌ««b¯èúóÃÔÊAš:V©Ž ’‘Ó½ø6%©kŽ²XoeÊûŽu‹`CˆzÓ3­¹›ÕTÉè òXY3B(_/Ó!s+,ë°JQ ž6&q¥‚û[® a›M,D<ö?À£ˆÕ÷õ±²m[P ƒ€¸]I¸WhC|vI‚"Enü;ç`N¬Yâê¥ëoç-%c¡ó¾­ Á÷­Ñv/¡´£B*àaï”+Dü†}ø­9dÔVæp阘M©²’èL \Ê -Þqço» —"³ÎC?IóWC“ƒc#säÃ}8¡I'ÊWyj"3„.ä ¸8ìÊþ%FãÌ‚ôuFœc¨µæì?3d,ÌdÌñ¹Ž½-É5j"9]÷¦M%ozÄ^”²§àÇ·/×ÿb,èÄÀRbôÿý~”ž¦†Ç]ûÂpªˆÏËÅDúíü`<€°ïÕ -ꨥÃÿˆÎݴǪ<¦²TTT‡yhzCÓ7ñ0(0˜…™H!jkç"¶¨QX®±ô1åJ^*ïx#‘®úaKq`:Íü0„gû)X™.´KÁøê„Áž:èdÚµˆ}š¨Ußoß^\TÀ3Z©ß5»v^B-½,¹ÂGþ|•…#nÊþbŸc¤~e§ažg3\ƒ3u-WA‡–E~ôª˜M_Œ¹Zƒ÷›Ûb*rÃZìPºcÜCAj^ïlÎX0\òc˜Ž¨Uû÷‰@Ö“7Ô•„ÈÉ‚mÊçD?³q+”ùQ9' VqâC‚Ú›àÕ¦éÚÈ$”jÔ‘Žú»;:[  ¶©mY‹IF¢­#+1¼ß—EO Ë-¢M¾¶îdšT™(“йHÓ²H— û®xƒ´A üß lBáÅiQqÊÄÕ¢ÚPªV‡;U[.˜þÈPÆÝç7ñgb}@M“Šó}ûH=T‡‰Œã öaL&ßWJY¼aPM—º´m9€Ö…¨y^Ð}+ïR¶’ÒÂØ{O;æô/·kܵ猇ùscz%&:P¹ÄŽ%Gâ3ŽhÔ¨c=tBÔiÅru1[ -®—OüͬgĺÛ=a. bÉe¢6D§+£Þ¨TbfD£œ:»¶àX=xîU©È±p¾(ç£ &boECBdn~|K6?É´‘›ßhgoê]šée$¤2|~¾5EãW,N®ŠóéÎN®ƒäxÏ8¿¸@Û–c œD4A"¶ôC¤§ª[1u„.×êÝ0b"Å à´{/7ᎹØ-eà -íþ°p–C[6Fì·5©Óöºx‡^%a©Œ Sæ…„ OhJÎûÈxZdï=¦êzŸ{›™±ìžï\̓»%¦Cš•ð´ëŠ»Z6KÒþ‰ÝÚæô“€‰”íX3…a%ð†ñNe£€y~õJ½àÿ턱ÖÃ/b6—ÔNO¥sì©JêQ²€¦ˆòZ˜—­Pá9EK>+§ò/gTN-].É£à9ÌTÐe³ˆË÷ñ6Ú¢Œ>hÛºiu»-ç^R Rhº8nÒhnóXÍK3dlÏ >fÐSÙ̱v§dh3‚K£°¡!ÍoP„“˜^ªñU„cƒ×k|çÅé‹RX­h·ÆWž’ñËw?%\MHyÍS4M“c(ªþþŸ*öõúoø΋%~¦ýTr,ªxO‹Š«ñ xÞÔu9·c0S ØËæA;7v¦_ã¹¼;Fë‡qi(×ìÞo_jpèKŽÉÙ&ÿ¯ÿ#0 š´Ÿéü¸q*à *0TÙ>¿±Îü8Ó‡ ÿMá$9endstream +5605 0 obj << +/Length 3241 +/Filter /FlateDecode +>> +stream +xÚÍkoÛÈñ»…P(D —ËgúÉyÝùpIÜØ×´¸»k“–ØP¤KRqÜþùÎk—”D'A’ŠÀá>fwgç=³R‹þ©EûÎi¦|e‹ëíI°XÃÌ'J ‚EäIŒSO/O¿Œ“… +ü<È—7rYüê=ûñôüòÅÛåJkí©Ì_®Ò4óžý|z±TÞÅÙ³ÓŸq*òΡûöìõår¥¼³×?0<Âür~þç–™ö.—¿_þtòâr‚Â*ò£D#ÿ>ùõ÷`Qš?¾Î³Å´_åùb{ÅÚ#-ýúäâäonž‹¼jæ¦+ ±R¹Ÿ‡ñ<5Vxû8wôaXÁH<¥ õá> +(Ç÷²‚N‡·î¡1À½“Ô{VãhÙH÷9Nw8ô¡¤&'ÞYÓ¦®aØ UÛXÚÌ ¦#_ö1Ï0êE»\…©G'\W°ñ=Æ^µå‰¶L³ 3BÇ{ü&ÐUÞ¦ävÕ,ñ"°`Íš1#øV+¯•…¼$· TÔ¹µ¼àÛ¸KE8Áòœ§’–gveÜয"Xs½Œ7 óʆ‡+ùZ¬Ä]•ÚM5ªTwÁ€Ã)Š3.òCç‰T[Åm€Ãë®4ZVØþÊ +;vؼ£æ4bÞËBÖVål© +ÒBº#S²PÁÐ= +Ô>Nëš÷[—7Lü¶³Nf¶4Ô÷fmíZdÞå¦ìy2¼ðmÚɦ¿Ÿ1qwˆŒA[…’gä_ðKx ‰Ä“«‚Û²æ;Ǥb®  ⑬`£ ‘w}GÁFÁ¶ç±‚£ ”ñ"¸}ÓÊ9ìñÊ-[<ß;#=Ó` ¯ËÛaéº]¯éÔõ Zd!ŠQèÝÙrÇàpÙamdÝöÌc¸µ ylF¸/Ý·pvî*èáˆû®¹ÿZV-°]·DaB#"\GlïÓÃ)ï¯3—vlÔ*tCÑ¥µî°\wûLOÆР³1”N&M!§n ݽ4Z™©[¤C2cïèÊ£0à¤èx-°åÇÛšTí®á€g.2eMilK}}·˜ut&üAÝŠ ,‡liX]87Ì"í"» ¢7 Z›~àïÛCŒ*žç£ŠãìÖ°W¢Î†:lêx7$ mbñžºÂv³_™÷nMª@Îßn21ÞÊîLâÐœ`vC»y¸>öõÃÎÊ´V™ÄÐDQ°g·ÄòÜ;xÖÝ;£U™µ<• zU*’F¾¶oøó9ƒªÒiÔ¶[ÉF„R¸y·T³1‚ɶÜåõkxP@FŽªø‰*…û‚½ Œ=¦ú$Î%Èž (Ä­$.ì„.5­§á¢½cÙD4¶#9›f„{χŒ¶ :b›`PŒÝzîe {¹Öv©Cï +Í„~ÇA@œù:Ó\·D¶-«2tm3VÌñ»Â™G<ƒv•ÂÐ5Wõ|Å2LQ< N ŽM¿ŸÌÔ&BQ³l¶\7†í ùɤ,ãÁ®„@1/;Ü2ö£ø³;¾™äcaÂÁ…¹¯s•½Õètþƒ„„Ê<‰D\o®P#pZj$r@‰¾DRè(ûYbÏ9º%F¬aj#×üë ~w>휖sÚœ'~œÚ¼«ÅgIõ ò}wRýX­ÑØÕøÿ‚‰&¤L­Œ¯®ëŠ æû}KåJ GSÛì¼ñ'7ñw'ÆEY['t,+Zù±Šm]˜‹ si}4± {Õ=6É‘sá8zÁG©„•@p>ßö½µZWõý ’*ƒãU&ÇŸ5R•U¶wŒ¯ü`‚.›ìFpݽÜû0‰”çÂË;îÏr§º~c¶cÍí0‰†fàRbI¢iÁ1žIæ'’„öwkÅæÌÚ*¼#‡u%¼xÁ ÆzV¤‚qõÓ¹’¬ªä¸iÉé¸Æj‡¶,9IŒAELÉÄ<é!ì +ý\éizNÙæß ïÁ°SÊÂRÖ•…KQÌq”ŸÆV.CpNlC`wj-ág¶ÊA”Ó“a°rجûy-ƒ/Ý”ièÚšíî9zaÓ”sKC pú…»~9vDzF’ÄϳýJÔ«“F\þ´É pƒíTOª©­eð(ÐÊ­-g NàRÍ¿Ýýt,ìD:dc»YÁˆJý®6'1÷{º‰ ëCÊlшK¥(Nw æ"fì´RU”®ÄÃðí‡I&…é‰Wî¨Îõp¬Æes(VQY<ɬk™‘êä °|þÑAå7s"~šX=˜+>Br< ,~ 0ÞÞ ãrùÁa\aU"””¡‹–ûÿÚM*ñ|€|®N<Ý LÆÆŒ/-=K—Ê@ìÒ=²¸hÞ‡[#—tâ­]6ªSæ|˱F=~6`A²€ƒÜ£\U +A4üKc®jyÍÒ’Âðže§‘K,q”$fwŽ‘Q΢8ö.íã‹lå²WÓ·‚ævj¤“lYeµ£ô|’Þ¨¼­h)0áˆj‡šŸ'`l¬àR÷yù¡º.â•«µ22¦ø:zíÀfT\;î¤LÛ=â1ä'¦+°â}nɘ»ôš±!‘úà ‡^*v”›ýi·ªŸ{ä*ª&aÌàD¬ÝÞÖåPú~b¿ÆjUˆÙ{ˆUZz%¹R‹†O¿ãw8'Œ!€ðóÉyœûIjµ¥<ÖÇ_µÅ>J¬ûäÇÔ>òq‡ßÉ÷f›íó„ÞKBïÝ2‹,ú{ÍšŸøBRò_<|çî6•ÁU~Qé|ÒÏ÷Vüp„«ÒÔÏâ‡ÞÛ*½ÿ¢÷öPÞÛÑ󒢇u+ÎÐqF!-Åå‘Âa¦K4¼÷j½âLºïëÁo¦òOGÏ/‘ê6Ò5Ç) glºye+Ý4ØQœvϽ]©´`RZw•r©ã¬7^_Rýøç )KÉG?Úª)jdq'©ÜȦ’]R?WÁH9Kgó•Ä×É4»ˆÔ }À•¤‡ÛbZò-Ë)V¦Â#EœÆ¥:‡–šê!F¦X~SÂbSäƒ3jû‰ ×eSÚ_PyN9î ®&¯´WLŒ[ÇÓ\b>€{ {ˆ¨Ç/^öm€ö±(mE¿µpEbÙÛHÈÒ‰¯ b?†ŒcâZúê?tw‘‘¶³Bcü¡í °ü†áÁmm±ú8­” ƒ ã"ÇY£IeÿwbD +c}†{AÌ~â~4>'KY–JÊ> ½ù\ÜwÁhÎGçÂoÔ\ÈZql\…³˜þ« ÀèdÞª‰Mÿ¶_éÔ‡|{5îõ‰j^¢9e¹Eðkú>Wendstream endobj -5393 0 obj << +5604 0 obj << /Type /Page -/Contents 5394 0 R -/Resources 5392 0 R +/Contents 5605 0 R +/Resources 5603 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5391 0 R -/Annots [ 5399 0 R 5400 0 R ] ->> endobj -5399 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [377.225 306.326 539.579 318.318] -/Subtype/Link/A<> +/Parent 5581 0 R >> endobj -5400 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 293.079 108.944 304.769] -/Subtype/Link/A<> +5606 0 obj << +/D [5604 0 R /XYZ 85.039 781.388 null] >> endobj -5395 0 obj << -/D [5393 0 R /XYZ 85.039 781.388 null] +1298 0 obj << +/D [5604 0 R /XYZ 85.039 761.463 null] >> endobj -1306 0 obj << -/D [5393 0 R /XYZ 85.039 761.463 null] +5607 0 obj << +/D [5604 0 R /XYZ 85.039 743.459 null] >> endobj -5396 0 obj << -/D [5393 0 R /XYZ 85.039 743.459 null] +5608 0 obj << +/D [5604 0 R /XYZ 85.039 496.846 null] >> endobj -1310 0 obj << -/D [5393 0 R /XYZ 85.039 522.834 null] +5609 0 obj << +/D [5604 0 R /XYZ 85.039 470.353 null] >> endobj -5397 0 obj << -/D [5393 0 R /XYZ 85.039 488.089 null] +5610 0 obj << +/D [5604 0 R /XYZ 85.039 445.376 null] >> endobj -1314 0 obj << -/D [5393 0 R /XYZ 85.039 392.679 null] +5611 0 obj << +/D [5604 0 R /XYZ 85.039 416.157 null] >> endobj -5398 0 obj << -/D [5393 0 R /XYZ 85.039 347.604 null] +5612 0 obj << +/D [5604 0 R /XYZ 85.039 389.058 null] >> endobj -1318 0 obj << -/D [5393 0 R /XYZ 85.039 143.319 null] +1302 0 obj << +/D [5604 0 R /XYZ 85.039 186.226 null] >> endobj -5401 0 obj << -/D [5393 0 R /XYZ 85.039 108.573 null] +5613 0 obj << +/D [5604 0 R /XYZ 85.039 149.359 null] >> endobj -5392 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F62 4047 0 R >> +5603 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F35 3036 0 R /F58 3380 0 R /F62 4159 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5404 0 obj << -/Length 2550 +5616 0 obj << +/Length 3356 /Filter /FlateDecode >> stream -xÚ¥YKsÛ8¾ûWèHÕ®‚ ErnYoâx6“xc¥æ03H¤%V$RCRözýö !¾\S[©Xx4Ð~|ÝŃb‡®'“E WÆñbwºñ{˜¹»šb¥IVÍ?67ï>†ë…ðÜÄK›§nŸÐ B¹Ø¤¿9·ŸÞ?l>|[®¤”ŽˆÝå*ŠbçöóûÇ¥pïoßÆ©Ày€î·û/›åJ8÷_î˜i¾?<|Źe,ÍòÍÏ76­X-C!A™þ¼ùío‘‚ü?ßx®LâÅ ´=WÀôé„rÃ@êþñæñæßíV<,xÕ˜ - ÅJznój -=7ô‚VM°Ô$<áž\"ÔÓú§ÞÚÃxam6`hhEhs¾+…Åñ¡µ–K?vžó4‡v±_®|™8ŠvhŠ¬@‚IÕ‘Ç«ì Ø)ë¼)«W¤õO¸auRM^šF2Üg¯ªÚ¹áñ+uR– r^jFûûç¨fRKÂwIÌÍsEËH¤¬â±”Æžq †@ƒ —•@K%t̳ÚáÜe¸vÔž„©§ÜÈK@—ëyÃv43†ÕDov†agØÇqÃZG ‹áÔ2¶†Ȉǚ‡ -c©«¨Æ¿ -wzåÅOeÅ]•…{{Jçþ„+ΰ ÒZ¢¦ió¾Ý>­P4¶®ÔøZ,º¶˜;a²uì»Q8YÍ´É Ñ[&›cØš¬ÏqÔd6ÇQ“ýæEݨã„z"ô˜Ëi­ÓÔˇI=’Ü*·"Ü=WÜ!ãhKàxJ¦ÔUã˜p0«òÄeIÑà œì -ݬ‰Ðß½Ðcçb'I`¤0.xôþd INåSrhwîù‘èÁ*°ÂvNŽ_½2‰üF«\mfå‰PÛ´cF^6÷Õ ™nÕÕnâÚbç¥EœÞ±¿l&f´ŽÔ£ç¢pÎd(ÈØõßHK 9¦³ÂMÂÐÊÞkðOrU68.pö!q‡¡çÜvÁ¿^ƒÛæô:rþIRæϦÿ°D­ì~ÐÏ>›Ý50ß»£Æ“& -£ØÖ!‰½AP -Ö#]‡k8Q>ñofA˜\‡BÅWa wÇ(žÌ—º)œ-¹^öŠkKtäÑÙj -œ’ý3» ýôëÓ’Hˆü²$¿lŽ÷Ī²§Ñü×Àjýr›ÿ4<¡Žµ&É Â h\Ò,åñŠ›wL|È(¤Ä(ˆà¨„HæuSå8piÑ -ǹ:àö©¬2ÃÓ®0äÑÓÀ·îi™dŸ?MówŠEëœlò!Dqßv2ˆ†åÒå5O*îîÿ›£‰¹Ì!%À\CÉpË8ý]ɬiþìy9)+›”²K£Gv<ÄU•µ+†Kâ -Zøò±[uÌHz‰©‘Xð¡á€UyäÔJ[hãaÆÏ4# w)Ãê½ö -Ò¬É@ ˆþxú™B§Ð÷Ü(ðgÃÜ¢™D§ ]€žkt’(î{ Aû¶#BÕŒVŒ£Ï‰t½7d´h&¡bßõ}¿ƒ"éÓõ‘¼ïÜèÉ'áêx|å¶âŸ”ÜDmU]­äAM¨^uRƲÐÙ²osçÏ‹JóÖ`ùs®y‚ñ)§aOŸ6›½1׸ûA­F<±ÈMî:é ¶ -äÚù L}"•!œ[éÅUYñÊ#yÁ¿- ßIêõAÈÈìaCé<[ëlCœ¥<ñýÛgÞ§E(Ú_ï£ÈÍ›‹®lp(åÄ^`0•*mc¶`-«Ÿ„Œ?]â UK~Œæ\‹.¿t“Ú玈#¯¼ˆ ”¤0ôm@œ¿#Uâ1îxjD6w霨,ìlMVB~c¾,åYÌ)økyr~Ò¢°ÏõN2æ|²Àï4 -ê´ðÈH®ì@‡´•p¶,tƒÒ`ÕߣàIƒÌØžŠG?×Æþ*à†ÓðJ#©„|³,öF¢*ã´~ÒYÚ:΄c(]ôQ'¯í -pw¡€l,Hf?É´wÀ–ï>¾]„À„¢®lxþúö»I¤)Z##Ç´ RµmÓJ?…è2N\¨·æÀ²#™Äs¹\? -®ñ<àyQÃpCÒ‘Ów!œ¾å,T4S¢j&³²v4“À—WHAÂþRj/“ë˜Óÿݯž‚hÀ€¹ÆJY¶?&\ÄàÞƒÜ ¹¬­Òr“{ùò‘ ­±&Àëä2 ºíÕö¨Yåz‹w¯xÎ -tªÑw5¬¶>}Å™_7_ÝswËïÕV5‰AËÕ$x0T“S^XÔÃ+DAI°3°.ƒ‰ÚÛ5"ú‘ë%±•y%W¾ÝûC=RÑ[Q|Þ©iªä˜®Ûóñ)ø–‡5~ûRrš|°ðÃÄ ¼hÖ-šé CôÖƒÅÃöÁ¢ÏqôÁÂæ¨ø¨œ´~ðòÒªP`[¤Âø1/:{?p­£KS¾ ‘•ÎÍÔMÑ— ‡—Ì«®£™Q&zSu3 ;Õõ8Ž«Îâ¨Uw·ù×߸eÒŒVÓžQΔ vñhâº>¼Q;óžWöêõÝ_T?%Š?­~Š$?’ôØíEë.¢|ˆº$ùa09>ÞO)C›“N‰€]}û# øÁG Í{˜Ù±fæŠI¸ê¤ê ô?œ±ÊÙ×öÍÆÛ2 h'³?Ì¥˜ú—¦`Ìx1·+»¾æs~#}²q,¡änt]g~Œ¦¨nQÌÀ‚ÅÕ{QÁ£¶|™Þš¡¨ˆm5sä©Bœ`_*~áªL¸”ѵ•,žÞ*S…%/Š¹ú±Eý±,ヺ‘¦\ÐeèLÝKå…õLo=gá”Þö­[uõÆ&Í›û|€äøù€‘-¼·ÊÜ°êé|%Ng{Œ?M0®Ý”Ÿ—jí£´ ¶b3߸Tܪ›Ì8Ÿ&ãsÁ”~ ¢¸„în`k{ó—Jõž)`‰ªJt³!ߺH‡Ý#ÒHzÕE:LôK´_7ŽÓ Ü@Ì_£-šiœ6DoáôçûGqÚæøT¶u›2÷$~F ½Ú¼ÅõórÕ˜òFULœ7Ù®¹TYïë‰öä½ -ú9eðA„à°dó½'‚Ÿ‰/‚šdÕÑŒØ"€wMCÕ÷ dø¡?SÍ0Ó$óÌäÚúM¿ú î[ÜXMaÑ~cRg~ÐåRQ5%.ç£$ãW®ïaMi}Â2@Ó¦ÉÖÀ§Òì5þ”2a…Ðs}Î[¡£™¶‚¦AÅø“V˜cf¬0ËL[ÁbVë·Ûid#t¾_ëxÚÛçFºHNÕs ´?Z\ÁN"ÿ×ýîÉNº±œ(ÐB°€/Œ,d‘ôå e솱 -ü?T¬Î‚endstream +xÚµZIoÜF¾ëWè0@(ÀM“UÜzæØVœ8pM¬À3Hr(‰l5a6Ù&Ù’_?o«bQM˃X‘¬õÕ[¾·TǧüŧEFz}šq¨‹âôzwÞ@Ï÷'±ŒˆN“0ÊRìz~yòôešÆQ¸ŽÖ§—rYþ¼øáÙÅåw¿œ­´ÖA\„g«KœÎ:­Ý˜±*±Mð +¡ß™±îZÛ&OÔgœˆk•ŽC-*'v\ž?çÍ•A£Â†ß£8A-âž¾Ô¾­êH‡ªÐb±¿GiÔŽ{àHzÇòŠ§ÌÌq2ãÉšy±ô·cÙ×·¸qt9 U®æÖ°¸Mœ‡q¡Ø& ³,—~"Ôý3$ç*ÊXÓ– «©8T±rTo@Ÿc@¦Â5`§cY,g‹‹(L”>])à(v¿#4A+É"’Kǯ ^lã¶4äÿÉ~ïKFlqø‚GX錖ÔåÛ³Uªtðœ1£¶¨‰ÖŸÐa Šd™ƒL\켺­¯åý'4Ý<(åÓª5î0ÒxxaZå$h¦Øxa-kRHj?'¥góîÌÿÔÑBõÀOùd`"Âi½k6ìÂ=U[BĘhºFÈRˆrøâÛ=·|@p¢…¼ÎeðÚ œU5K8§ÖŠ}Q=Ö†œÌŸDB)'h™.ë U;ÔWMÅ„î)9$èh8§mnqÉkV#Øp"AÙ#ê°È!@¸Çi +ì®ghÚóPæ2 £ *v‡FÖ©ÛšŽ ÜúÄ-âż$nø ,‚§Ó hï‰ÞŸÒ[©S"Šs&0 #„Þ<@?&Ôm»aD;’Mº%Q™Ö!>’ëC1lÞ±3ŸÐ; ®›ºòBDÌB|û0š~”I2ù`½p5_,v’ì¬?Vygdäõ³à‡Ž-™&”oFz «:Öη„jK ª†üi¾Ä +¥Ó+âà[I.·I)s„Cˆ•†)×H +¢ØWÚ‘vÈZÊØ:1ì!tÀ—Ò7øÛzæ\7V,´!KÛɪ-?1ÖÅQUÈ„¡MEÑǧÿAt!½8fÂ$Ú'"#öaü\Ë“$4\[S,‡Ø`±™_ã`¡HÓ°9zÒŒ¦77½Á·­¸²HpžéyŽÂS ›:!·é¥‰Œ†"EÀhÃY±ƒR x@£ê<Ÿ6©JÊQ`Ü %„ +™l„FB?\ì@JÔ™ŸYZbÁhΆßŽxdf%Ó'‚@ÿXX' seê¥0/µ†-S¬5Pt{Ï=¸C¢z칓"áiž]¼“žžŸ=G–¤W“Û’œ°K'ÅÌ•\ÒJP.Ê™óÂ"’€°ˆîÅÃ<•¨â˜‡ õ¨yØæùìsyD«?‰~bÄkÍA£85@aßð)8Æ1.•ý€Š_S&­m¤NUükŠ7Þ7®26"XÐÔµ\ÙyÂä:UÒ:ãœZžÄ*xŠQ(†Ç)ô¤yýüH`Éi†á“Ĭ0†úÌPWƒ·ÙeeÚA¶Úð³ìœpu¡ÎY”&$ÃœªíörØÅXFp}#[[¿9gÍž >jÍu#¨¬‚`êØò~«õ½ý›[ý<©êÉ¿¬×2Švùè³ÃXù„¸‡›­ì½‘½m€»ÜG$h›¡ GŒszk<Æ4Påɦ8 $Ç|FR×”=?*¦%^R AðXKªéòÎJ(ÜóÒÂV4>‹½ ö«ªrà×+©ßgKΊï$c³V}¾ÕÍIèr”™â劬üVª(?°¬ÿ¢ë0i¥!4s¡#~øYŽN²‰™ >èµ ì~G]2 ÜÆõ駦CFêÔ¼_*$)‹ž2l$SkÏŠ oSõ>ÌÂÆæ ´‹¸£Í}âàŸ •r¥a¡ Ü°:=¼>XØæ‚¿j&EÊÓî/™†IúÅŸ÷Ž½, +í2Cr\*ò[fQ&3ßðiT-"Á¿þ=×{¸™q³…W£ži’ +h&êXDø L>:z$•kç™þ2³Ô£3ëem­OO7È1?ú…®9Ø}á„_¡úÑOøó uà0j +BŽ+(Ð88ÿ5÷fß ú+å)Ð…T{Qcr‰*@u^¢™¶h<#sAg  ›Žrµ¿“ÁÉ£3ø‡úõ¦ÁÇ ¾.¹ŠÄ…¢jGLKuž®Œƒøï3§ôÑyñ‹e +Õú¯$K8Ï’é¢-Kç%UïN.Òèլܰ3¶ì¦ÁÛ+ù˜RzXr[õt¥‡¹ß†ûgËÌŠ2N»K¡Í¦Ù°Pcè)³6Náýºö›¥ âC)íž"§x*è/Š/‰Â,Éÿºø²Gß3«À±MBb[êÆ‘\j,iŠw᪱Ú‰.”é»)ÄƸ!–(µj„• X@˜xX‚N^ÇÖÉCGšxЃSox'Gúgˆ 9Òõ%žÆmroªãüe¬£0ÒöFêE׶Õõ¸@äi%Ú­$Àè?qÔ¾9ÐÝÀ–Óga4¥œnJzâ´Gz™´$%úm½ÁÅŽÐ:¥.öþˆ%- |nvc<­·\Õµé„Íj’£Ð[Ò”vMÓp±”Iuuز9¶sô”­‘“Xâÿa_ ñú+ì+tûú¾“³uS¢¬cÉ:Ìs[A}VÞb¬¥9—p,˜‚O`µr¤{ý1Ç Ò­%º·a¦ÂD%¾—‚¶\0gÁ9iÛÆšqX¾ÆMí*]/¼ Y'ŸGZx—ÇgøB\<ö¦^2ýÄ—…d%.‚ôJ+:‘ë©{ûå>¬½† jÀ¬0\~f’Óº4òKÖòµÕúÑ¥ó“yoñp8ôòFÖƒw³”SS%³@û¨2í Üuƈ]ìî]lKJ|¿²ßû…$öxéËÒà ãÞæ‡F¢Ÿ{I>ˆ 5-4#n©!€`Ýt_G'C”˜ø:SyE†/Ä‹ÒÌÂâ퇳Òèhi v|…4é× 5Þe'‘•EJ®· •n¶"vX˜KTìÔ^¦¡‹Z˜ÇB´ù;öÑ-läÕò¨Ñx0ⵚ¢qìXú] ¶—y+Ð¥oäUm]ù‡¨Œ¦Jv-¢þ|É]zúëùþ]– èZåÐOnð~‘béþ„=¨uçüC"#îRn×Þ+3÷ß ðu‰‡OîŽ?Z®ÞæTv"Wò€ëÍBéå8 +K¾î×…ÑãØûpÑ@é#]ΤÞïø?j +üendstream endobj -5403 0 obj << +5615 0 obj << /Type /Page -/Contents 5404 0 R -/Resources 5402 0 R +/Contents 5616 0 R +/Resources 5614 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5391 0 R +/Parent 5628 0 R >> endobj -5405 0 obj << -/D [5403 0 R /XYZ 85.039 781.388 null] +5617 0 obj << +/D [5615 0 R /XYZ 85.039 781.388 null] >> endobj -1322 0 obj << -/D [5403 0 R /XYZ 85.039 638.284 null] +5618 0 obj << +/D [5615 0 R /XYZ 85.039 411.774 null] >> endobj -5406 0 obj << -/D [5403 0 R /XYZ 85.039 603.539 null] +5619 0 obj << +/D [5615 0 R /XYZ 85.039 382.554 null] >> endobj -1326 0 obj << -/D [5403 0 R /XYZ 85.039 520.742 null] +5620 0 obj << +/D [5615 0 R /XYZ 85.039 357.577 null] >> endobj -5407 0 obj << -/D [5403 0 R /XYZ 85.039 485.996 null] +5621 0 obj << +/D [5615 0 R /XYZ 85.039 328.358 null] >> endobj -1330 0 obj << -/D [5403 0 R /XYZ 85.039 389.65 null] +5622 0 obj << +/D [5615 0 R /XYZ 85.039 301.259 null] >> endobj -5408 0 obj << -/D [5403 0 R /XYZ 85.039 357.229 null] +5623 0 obj << +/D [5615 0 R /XYZ 85.039 260.006 null] >> endobj -5409 0 obj << -/D [5403 0 R /XYZ 85.039 101.685 null] +5624 0 obj << +/D [5615 0 R /XYZ 85.039 205.809 null] >> endobj -5410 0 obj << -/D [5403 0 R /XYZ 85.039 75.192 null] +5625 0 obj << +/D [5615 0 R /XYZ 85.039 179.317 null] >> endobj -5402 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +5626 0 obj << +/D [5615 0 R /XYZ 85.039 151.612 null] +>> endobj +5627 0 obj << +/D [5615 0 R /XYZ 85.039 111.571 null] +>> endobj +5614 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F81 5323 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5413 0 obj << -/Length 3112 -/Filter /FlateDecode ->> -stream -xÚ¥koÛFò»…à/GÍå›)…ë¤Ú<|±ƒôÐôMQaŠTH*ŽÿýÍkÉ•H§ÍÌåììììì¼5sàŸšÅíxÉ,Š•íÅñ,Û9³ Ìür¦c!( ç§Û³‹Ÿƒp¦;q’Ùíz Ø~àÍnWXW¯.¯o_¾Ÿ/<ϳTlÏQ[W¯/oæʺY^]¾Æ)ߺ†×÷Ë··ó…²–oa|Äùp}ýçæ±gÝÎÿ¼ýõìåmÏV¿!° OŸÏþøÓ™­€ÿ_ÏÛKâÙŒ[Áôî ˜²ß“÷òìæì?=)žóg¼jJ¾ÚnϱãØŸÄQʵ=傜ǿ—“ - 9)°"o¦‘PPž}z8…ûñÌ 5ÞOpþb?/$®Ìýšý|áFV–¡ÄËDœã¨š»±Õ=Ÿ/|ß·–m‹°ƒžlù®ÒŠ¯çr+¼¹¦€u‰ÕV€Mñ)åÍ''pà§xɼÒb½ÇuWO]¨ëÙ¾~[:±¯Ì; -&½žžø“£¢‘Œeü 5ÎhÇcËÍ›;~¿ŒÅ‹ò½Fq¼$o^~…·S‘.Þ__ñ¸«…DÖ!Á´,y"ÓC ¤].ø[Ùs?¾DÔ ¸•÷à™Ø!¨>ê]%¬ºžU¯ñéF¤ê»Ro¶kžWY}ÐçÈW¼ða›W<*vûa‰pST›ñËݾAq29ÙÒ®KÆ'±æì3‡™T#ÂÊ­PÂä;B5–áÒŒ¡(- ÜCB(Æfá{®uÛǸ#ü¥ýr<Î|™¡•6EKÛ³Ún²§55Þ Ë}…³ÊšÔ&–"r†ô·E¿ ݬ¯¬Ÿç±¤iUþ5çÏà-ˆ¬¤S¨^5z ûÅgQeåaur¼Ô”D@‚X‘nŠ¡ÃI’È”ç -!¡u~¹×7‹¯S¾˜æ#²×^¹¤Û[òËÛÛßyð%Pv|ΔÒJH~,p›UM’n1 ø™Ò ¨èd ¶E]1Ô[œ *ëø4ãkǃF)&éÝÝGŒN´\[™W$ć#kª`VD¤zKšûc»apÁ*ƒÃ-˜_ÈÔa×ûj€zøÝÆ;è-+‹\k"˜‡ÔÜkò)BõBîˆÂ#3…õ¤µe®È‚°F ÃAÊÓ0û@#ƒ$°.…HÚv‡nʲš#=@~(Ê’GM¾‰Q±2Aê¶tP‰{˜Ð„¡n#ÞµÉ_£a5{ê¼éŠ\¬ -ò õ†qêŠ|)Œˆ8( +½ Ý§™0°FËjÆSWâx'¤DðùáÞ¢T¥»ÜÆXòcÈgt#¹€{†”âúîYÕ˜¶éá=”‰Ø{ÌZÒ2œäk|Ûa@ûHÚå;žèýʦh»Fâ HçÙ¡©ó«ß^¿Á©“xìAPŒâTë £PÈQBOPnY/™ z¾í9Þ_ÓóåŠÜccÄ•«š¥ßÔå>a7±SÛA~ÇNÝ)¾CÔß'fÿ j®oGnô÷ɽ¤£)šUxg†ŠöžãŽ.”ÍÐ Þà6RuÚ׸¡*†zg¸e€¡zá3E[á(ŒÓ2}Ðל €ôµ_;¬ÈRL‡E`m®´Åâ+qˆ¦@ûÊûDÄ3wIË#ÞF†Ûält »r†ƒ{NÒ?Ëœƒ½Æb{ù#Å;㜎M¸ùÇ…pJ­L"û£Da'A(‹ã·qÏ(2/´^‰ÐB -Ï5(» €ƒ0îð„NzUa7ó«ª;TpqF|gp;2¹“°"± ðN‹ˆ -B9<1¸"ã¡Ñ’˜=,æ3žïÒ¶|¯L)£HÒ.pZ‰uh… “!ºÀFZƒzƈx9ka´Ë6ÊÂ@'Yb<yKDZÁ -CæQJ¨¬ŸL’„¯5•¤*À° yK’ÒL²LŠd¨Q¤#0*‹]Ñ¥¥Eø®s  Ié<{-úŒ±®hrMƒãnŒ5–;½›.$„ÔHqyJÚ–¼›¦ÌQ²‘=1ÕiE ‹#ÉA ÷»ð¢DlàËÁïç¸ <áL*+,Ä(!GX\$1G牧Ó*ÅY+sÃI™Þ`Zç"1áX=©c݃ÒÖozdû‰ªÊ;vÜoVÕÕ¸.ÌB¬õC£¿ãC˜ð\ÚXŶR˜Ýù f'À6„tKª/Ï}…?õªšæž'!«Ht,$€dB¨ð.6¤aÄy -9[ÕÁú€G%ÑÃËIAÁ‹Z<}nPB;ðÔ7ÏmàŒk{M'ôm_%†5‚+]×ä¤XèÆ6<ñæŸõ›$èe¾ÚÈšŸ(„¶ò–BÒ™•òBFÔ7z¿/déðlë¾d…·­¶ÑrÏ[k~Þ/´ªœRvq—€×¥¤þ¼ûI]Øç‰c}sÇA‡œõéÞsNA‚Ø^Ù±§$yUQ?Æ"oÇ.hN@†Æå/DAZ~Ô€«¾5Ö`>A$¾Dw×q9\Kԃ把aB\ëL.žIYŽ=‘F¸l·Ï£°sªk~Û~âμÀ±ãˆu áÍFÞ›­DA^ ؤuž¹ç EŠ1]·~qÁÙš‚mVóbÚÃ~_7½+²¦nëuggõîb•¯ÓCÙÙi»ÿúc›«ßßýW ¼BˆŠ?¨8QN0:‘ã€IøpöÌ}Ú|4ÎÂ@Ûïx6dY=%‘!:_…ÖóÇsĶ–WÚT‹á{'ð“DŠ“VðA®k‡ß¯9¾Rg²^礙TüsâŠU¡·ö“Á¼ËNSqUDíž|vÇm!®OÜTh†üÒLPÐß5š~ïã÷œ­ôZq0–€ ØÔûoÁUµï‘øprü}·¯¸;NÕÓ$”z·û/Éè…Ÿ]ÞmkŠ¢Sqæa‹egŒ6ˆ‰"§YÊHn𥿼¿“»QØUj;Î÷ݤæÒ™hMá9b dN²TGÞV¶ÓØ틆‡ã¢A„LùodÝê6I!Dô“ÜjÝvü6T'k–S½@rµW›&íØϺäipîµD4ÝdÄÙµŽÚ¿ÿÅä–]´$4© ¶¹Tîœ7¨ÞÓõ×¢3”c’"Q{Žš7A`¥¸C™êN'Ÿ: ¸,ðGJ -ûh¥yuI=à‘q€Aõ˜84ÝCÝç{’î¢W<ñîÆÌwÉR¿žÝjÔåçG'ŸÕŽÈyé¹ã&ɇ6éjùÌ,‹?,_öHº;q1•?_¢.9….T,ؽTqŒ.^°í»-[†´Û¡Äã!Êâ)8¨ÅG}­˜SFGþPœ¸“V(r9…ép«àb¹òM¨Ÿ†(ù×Nj<ÑWSûqã²h»‰{¤tB-ÆqŸdR]±Yø‘xfq—’tmp+nñùq€Å¸(§?Ô0$¥‘ö9å`>Üû ðݱÄpŽ<›Ïž]ûòê_¢u~dºx«…·"ÞÞ -!ý:.$¤j D§ïØlÖò}éä‹¿4<×1Cu)ëÙ€Œ>$¬JpV¯Š1‰ÓpÜú‰§%+s),Ì[zO¦>Ì1ç -[GÀVÊënø» ¶mRlŠ¸P ëWñ)£½Âø¸kGßf©óÓê8x ÓOÈA¾„ ½,L±ºÞjkôÿR¥¸œ˜½q·HÎ?pÑ¡8àòÑßÃ}Eg/V• äyþIy>þÚtw—f‡} â—¼APQ­ë.Ï\ÈqËë7ç²ôóÔˆïa¢ø?™¸¾9Ÿh1~ÏÎÿhã©Ù±Ýd*ŇKçýï -£¿Å`2]&®k»JóBu¦;ª³/¶ƒØ3ü?¹~Cendstream +5631 0 obj << +/Length 3227 +/Filter /FlateDecode +>> +stream +xÚÍZ[oÛÈ~÷¯Š¥€ˆKÎ oûÒ:ñfãE.n¬b[dó@‹”E„"µ$e;ûë{nËD(Šç~æ\¿sÆþƒþ"\O'‹(ö]Ç‹ÍþÂ[ÜÃÈϾÌðÆõ‡^®/~x„ ßs/Y¬·4e}r^½¹¼Yÿôq¹ÒZ;~ì.WQ;¯Þ^Þ.}çöúÕå[2Î 4?^¿_/W¾sýþgžsþusóÇ–±vÖËÏë_.~ZHXׄiøýâÓgo‘™¿\x®NâÅ#|{®Ÿ$‹ý… ´-íòâöâŸý.Z*Ý<§¾oÒ=·ëê|;"©Äå´öMœNN‚Þ2í¶ðS7{îK+h U[KÞ]ºÁ£¿ØÝsÊÄGn%ÄŒMÝ49»«X9WtÞCû1[°[;ïS1!=æÃùÒ®UyzKÇÕåhÆsŠŽ‡‰Òn¹c}õ’?~ó|Sæ-(©Ý>T'4Zþ!uHh#¬od߶ßßRäp)Dœ3‡%ĺ•Ž=gS9‹nªßùŠúÈÓ6©ÌßÖei/ŒËUv‹´¢CëûúØrOÛ¦ +{îpíW™¿ÙÐpKí÷²+_ÈÛNFŠ®•ï&:uJäS œ”•ŠV(o´B7Š|YpÓ¨pËó&&d´k”–ypKTº¼^t¬"µ4Q¶ÄTh‚YkŸyÐâqàGR²:ü`gƒ~U*Nø¶“¬F ÌjN#ËPÚ{áô(çØò8ªŠ1Îë%¨DSïy§Š4WÄíºzÁûôG€È‹êž;Û]},ź ùˆd‘î~áÕä%`€½ÄŠXTž¹V«Täzà¼ðê½µÀTí±HÙÜÄOTSM×ÆŸ6o +Tl”ùàLJ^~HæÚyì­Ò½ÕŒx,gå¹J[fù6=–`u + ñ°¯³|Fè <퇽Ðå„û¼Ê›´C)#§°K(άtÐCñ8z•Ó=X!`w4²±±½c_œÑU=Hó® ›†ŽÿŠrõ!@Õ{™>±÷–û‹²äÅ[älµé +´hÅR´l”)E·ã¯^>c‹¤í‰UKö’ÐfõêxA½µ$¢bÈ +ò†Xæ+Ô~?Âfuâgö)*ÕWtž«B#áÇ'šxƒoKÔÈ Y +¡³eÍ,I_ÅíX‹|‰qÜŠû†9d,øÑ‘ß– ÑÒõˆT¹a:ÉÊ;^³IhŽÀYÙøºã~+ئ$«IÉ­Iß +m>¶gºl=f;Œ­¶ê¯½X¼2| üඨ¦Œ¦üó° B ¤È8`f¬ð8ûIlÃŽ­öÛO•°è~e[+´Z–Bùh š¦‚qÛ…}ãs­‡D‰Ã*_nô ì[Á˜ŽÂ¡«‡ˆ€ŒP`½È…Í5ˆ-<ç2Ë +´ˆN+†Î+’FÎUcÿ@ÄB×uÕJMÉ°„Èz´q}£¿Ê~F D¸tQ„zˆFÍ*œ<Ø4îØþxÁ(ÖÓ6ež!F‰AdeM~ VHpvIÓÙfåÀ¾Ý›e!dB(7ëA; žÎKZÀq† ,Šœ~ûŽÃ.l¾Eõa0‰êÜÆá~¼ýÄ5Ið]Á;TÁiðÆ`-Ú ¿ç‘7I(Xî;/ПA@-îw6¯—>ŒŒIä°NœR‡nä'Srg¨Õ‰ëõÔ²}%‘Å”¾õslD3Ç:e“œºªòMçºÖ˜NÎ +|W)‹—@|¡Nœ1ræñ¾h-š‰\ (h +£÷Õâ0¨0kà!„À¼„i(6ªºãÚÀ‚b\ÙíOÂPÊ?Ûü‘GøÖ›ºÊZD."­£lDš:90-ÛZöL¿X +­ttrïØ ½‘M{åŸ(&hMBU(B> hUn|„•!i¼ÅǺjAþšã.h"ö¯†fÉ{“zä³< ú +Á岿ôN´GÔƒ!—¬r›t@ƒ9¸*T3F¸XÙ±1ƒX¡Á‰¾^"pzÊç ’Z˜ñÄ`R®d%oúÌÁ‘}ÆSœŒO‹ðñkê`hÖdžSŽ2âÙ›ú&pcÞ`¶æ[áÇ·n•€a{êÜ áé6ñAÒŽ­U3顉ñ Zé¬Ízérr£_I‘3ñ»Ì+e Ð<…›Êóž~ø÷ c÷ÊÈ·¹$Y}Ì9ü’4 +ÞiäÛéi8CýæXee©Cìv—cÃ…®·oÞäåávW7Ýæص§^y¡‡ÆyˆÜæ; +(™ép¶|‚#(/~õ\øýx¬®Þ¾e:­P_×e6ë›W +¾µg&ÚWK2f}%%Glðû=ë»f1áï¯d¥Ù(ã솰Ȅkë=#k˜Jº¦.O9¿2‰« ä®-Iô?eü»Ëë÷î«iýCͱÞkâprÉÞðÑksí|ä•žÖ¶'ÔÊR~.VÈ¢¢j ‹‹bé™ÚÀ¹ÎÕÜäÖ1 Ók,ŸÍð‘õSmÐ,6 ÎEúØ@z:0“O&×Ë\w.â‰#‹.0´äe&ÞZK)q@^[Êë¤xð, D6M¾íRtM7s¶ŠG÷¶¼wêò7ñõsˆ? }â7ñCVFY;ˆ³2Dýïh7§¢i;›P:[IÚK]ˆªöq^Ì‚ Ö¦²#å ˆ><§–\‚B’ˆß|mbpŸ‘!»‚-Ò {ò™É…À1ó c´ïÆ€6¿™z\n'¥(0 ‚0Õ)óSð1Wà…ñ³ºá9¬ÆºßiH('ð,Z)ºv®„£`­ú|: ¯æi±?†Ï`¡-ôüufH{ÈûyFKA¢ÐÈ„v—6ù,HãâÍR˜CÉ~Ü'û ™Á¨âIýo?QÛí‘+€˜m§ÀšŽÈFYaè¹â8ì4ËB7Ý{¼CÙ§_„Îaú¸ü [~EGŠù[8ïPRc" 9=åŸ]zG*·¶þÆi{Óæ–έ\®žÁÊw8·(³QôÌÙÕ 1Ž†l–ú6œØ6ªN´ÜI5`ø$T§ësé³e>üN©-dÝÎÎg¨Ø>{¹J¥>FD„üŽB›¶Sj¨ÁnYö{®¼„V2L+.í¹à;RTÊÇ…âXõIЃãŽPå=½ ðlû.§àÚ'žÈfS2U(˜r:Ê[_HÕy¨4áôÙJ“Š Ä8ëÈ.ë¿Îƒ2[@(‡PÒ2¾¥Í +ßm*­îåb…<ÀtzwíiKïS +JÂUí\ö¦¹èûü  ¥ +Ä/!Å–ˆ]ÕÃNú®YCð³ +謋؉nU ÛùS +±/—zÀ!†ÜôI¯bOTåìülüºÃ×Æî½x %êŠ?äyvD+6´„‰MãÛ¼{¦4rM¬|Üå”ù/æl +Kód(<K +÷s5 ߸Ih¥iæàt/Cj,åÏ¿/Wa¨Çå—QIÏ=a'>Æ×ü;ðÄ“:´¡¿K¿uqºâW¬´EƒÙÄ<—iéÐ }›$¥­Ð €÷• &ÌÜ ¼J¯ØÿÔ6›ï=}Ÿwóú51f™€PJÿ×¼ššb—Ôr;ž-W€Ÿ)ÿœ£gè?ó´·a‹¡}ú:„ Nêpþ€”†sNJGÔ7”‰`ÑÕ‡[þèÃẻíÙUUþ‹ýáÎô^ÖB7ÑϼèÈÞî¯h4¦žÎoFC¥Ì)¡ãÐl ü/3 Û,endstream endobj -5412 0 obj << +5630 0 obj << /Type /Page -/Contents 5413 0 R -/Resources 5411 0 R +/Contents 5631 0 R +/Resources 5629 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5391 0 R -/Annots [ 5417 0 R 5418 0 R ] ->> endobj -5417 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [497.496 347.146 539.579 360.048] -/Subtype/Link/A<> +/Parent 5628 0 R >> endobj -5418 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 333.597 401.53 346.499] -/Subtype/Link/A<> +5632 0 obj << +/D [5630 0 R /XYZ 85.039 781.388 null] >> endobj -5414 0 obj << -/D [5412 0 R /XYZ 85.039 781.388 null] +1306 0 obj << +/D [5630 0 R /XYZ 85.039 624.724 null] >> endobj -5415 0 obj << -/D [5412 0 R /XYZ 85.039 761.463 null] +5633 0 obj << +/D [5630 0 R /XYZ 85.039 592.303 null] >> endobj -1334 0 obj << -/D [5412 0 R /XYZ 85.039 433.802 null] +1310 0 obj << +/D [5630 0 R /XYZ 85.039 333.152 null] >> endobj -5416 0 obj << -/D [5412 0 R /XYZ 85.039 388.728 null] +5634 0 obj << +/D [5630 0 R /XYZ 85.039 296.285 null] >> endobj -5411 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F58 3360 0 R /F35 2976 0 R >> +5629 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F59 3455 0 R /F20 3021 0 R /F58 3380 0 R /F35 3036 0 R /F81 5323 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5421 0 obj << -/Length 3215 +5637 0 obj << +/Length 2995 /Filter /FlateDecode >> stream -xÚ¥ÛŽÛÆõ}¿B0 -X,š3ÃkúäºiâÀp·Þ òø+R+6©”׋þ|ÏmÈ!EiS,ÎÌ™9—9÷YµðáŸZ$¡ç›t'Ê3I²ØnüÅ#¬üp£b- kæo÷7oÿF å{©Ÿ.î·Ã9¡„fqŸÿº|ÿã»Ûûï?¯ÖƘ¥J¼Õ:Ž“åûïîVjy÷áý»¸,oaøùçûÕZ-?|úáæçÛÛâÚ*1ËûÕ—ûŸn¾¿ïÉê )ÒôÇͯ_üEôÿtã{&MOðí{ -–7@”FÆû›»›õGñZ°à]s"Mâ…‰9— -gdú^è$ƒ‹¦`.Ë–3æo_g-²ÜñD½åßn ²çÔ‘óʦ>p˜U‘Ó•á;k²wEÓ~7Wœá"Ö¾¨x–IY;0Ä£ögxäñm^M±)ßx:ÑWÑY˜3|#™*?ñbæžèˆÕ–%“±*–ŠT'Ë'ü¯n~gc‹e…s Ÿ Ò‰Rã•\•ŽsQ:†¤óÇY{*RW‘ Ȳ‰h´©p„í²Y8zu¨Wk`:‡ùS{‰ï(ò´¾Îvr™k!¦«KL_ÆÔó<Æ4Ïò€ª­›Ö±Á{N—¬"ïÚ¤žz‰éæ2×Cl—ç|§^¤W± ȶ çàX}3B—åùJl g¾*¬òÇ ü°üûà!&r§Rõf³éʺº$.¥=_›ëâ`.‹K`H\ÏgÒŠ¼ ®"3di)»ƒ}i×^—G&.%/¶Ùi¿3š…ŸH!DˆÖµHêÀíšÐŽ7möß|ŸûØÈKÂä*B s†q,-’Qz„ñc)ja¢t©ð'&¿ËžEe%¤zðsGJGA­-hÿÌ+Å·²íÊê‘96Åײ>­úýcýÝBM6d‰Cµiª(F‘Þ²ÚÖp1!h±[Y¸ýûo‡èØ‹ÒHöüæ‡þÓãèQïñ.Ëqãbmbí%èµÂô ¥-‘1Ç1øw~EQLÚüB2Ëkb¦å¹œô†¡š–·>¡„ps·ã‰·Ÿqç#º]ÖY@>µMY,M.Èå3…š-¢©ö€‚?è*ŠF°;È1Ç({¦ãˆeŸQ|ḃƒÀí_G¤t6/Ñì¡æß÷?ßbÖRUÏÜ[\_E¤]­ÓÊ ½ “SÅ !‘ -…Bè;øË¢Š}y Ñg}V€Ó¯Þã ®ˆ& Ý”?½âeðŽ¼Û2ÕØ™ï&Û׌çõð C Ή®”…=²Â({~ X|!ë ú F®4àã™ýL»#KØKŽWÕ¶©“Þ5ÌZ!Ñç…šäP“ÌQ°ñȦ‡IfEä\ð\*€äøºãêA®ø-†yÑm]Æ6x­1ºy§5 |V,5ÿdh€9^jÄ0R'S|âHðÑÎ9øžŽÌ‡s;çnbP`c.»@mºS¶ÇHóÌ´Ia€Ÿd¿”Õãµ`‡$>·`»¸²ç#rËÍW>|Ý ð©cíÔ`M1ø>׸±( à”9•'ëesªøãÞ3Yý¢ ÅѨ!Iáp²eU·¥Nqà]š.®g--Ô¤íDy™õáE`žJô“øåR@Æý3ÖŽwoß¡êJt‹F$FÑÄ‹£JÐ4Q1Œ:– Ž:´‹‰…“„3šÀ”²÷~ P×ͨ‡Ž½4T¶Ë\?‹hzLWBKž»Ò´~ü½Ëxxã™ËKݸp1ï]!*¡SÏ‚‘Ã"Çh½D•´¾#ЋéÕ¸ð±œ÷T„D3^-ŠÀUÇF(-”†˜cáo^¶›+Æ1<‚à3„Ý—–6MZîvb8ÏV”)5oÐÉòêéÒ…Ú G”cÏ#Ñ$àŽ­xÃÊ  œ_”¡»V$ 3rñö—yãæ”d*e³ƒåŠSd'¼šzm%Æöˆ4ïë,')¶M® ?6 (ÖW£E¼çϧuFà'k‹,]_Ü ©ƒpå -#“àw’°Ä±†¢Š´5P²—" -ì™àz.ìÀ\Ž)襠r aU¦gÊ‹qˆ+±^þqª‰XÙŒK®2( :^Ÿ$³¼§æ-äÔ¨;ƒQ`rÇÓ–Æ…CÑ8;¾vÜ~(w¢¸:$±¸æbœ×QDµš½D3ãKÇXQ‘ýpIbŸ¡ßØ÷ʬÿöƒUÜ37QfVt;Ž9Or§‹÷rœgÖÆý`i?­îx‚,!@&h)Ó-ö2û‡–ZÈ]±Œp¾¿ÎM™ ;Ë-zãGTùñ¸hô§5Œø‰À„#?aüdVmüx¾Ht|u{§h§é‘Pp?õaAyfÓÚìÀwâ‹%¡Û2ìzŸ‚€H³ -<Ðp®!B'Q&ötl žò=?áÞ'LÖ`g¶ØQÖ†”UÌMŸ¼ç¼¾/+ Yª-a`m¢åa¹œörhÖêJë/ -L·uV1êlßYþ̧ÃY¸R£lSJMyqŒÄH­<ºbùL‚¬Ão´|%Öƒgˆ  –ž¤¥0ãЖµŽkj¢8é*ÌÓ¤ñÔçm5î}7¬F©E×”Qµ]Ötö@ Z¹$üyIkß­Ö¡Ï]€ºzÝñçC“«lÑÔ§5H³&ðãß'÷uˆ`XeÀf+ÂNùHp{êÉo{äûnq-³/ m±e…TËrÃE†d©ô̺òPŒ=N­ÛÂ9K¿¬þ*Ýëᥢ3Å#\`ŸAB‘‡Bk:ºût -–Д[q— »x,ͺʭ$8Ù;Wþû%Ù‘Ï«(ñvÛ~jÐ8l^®†—‹>£ÇâÒ>rð» •˜ŠR/HÌÕJ̹\‰Y —*±kûJlŠq¶s1~2ôxrRV2‰*šõí/ç.í³ ëÇg_yÚ¢;åaÌJV=öŒ„–ã·ÿ¥Ä°í;ÄÙtÖfLÏ4õjGVAjj’àú­ 0WnM€^¼µ+‡[›`œ¿5£½5Óð6‚šlÕøJ¨ÎH®Ü¥y5Wûº˜½íqd¬C‚cÉòIë—·LHÉgÅ:»ø4ºéºj/×3CH ‚dö 6&6•ÎœÙÆ|Ÿ9Ò¾ŒÆÝì Š„#Êã©°†¥5'rí;žiKH)îľ”ÐvÊuˆB§r–žW(i -ÐKZ­.ìÛGÄŸH8€“gÿ~\wCÃ+ë -,½[ëD/‹o]“ñ®-6žqnêrqŽžˆ%vEŸ+pñ©”ä ”j´øÝ·pPÕ]¹)²‡½¥ëÖ ôëvù…Z“üw:0p».ÚHG”KúfpØu[»œê`ì†r™ìSK8½”-d‚&~÷lÛj 4Í6F,S!±pL¬žé.ã̹K­•¥r—âkìªÅrSÖ'n? @Ö²nÉU6,×ÈÕúAxh]ról‰+Ö+ c˜úAÎ+>4¨ +pè„oƒZÃLJÎŤ9ħNÚKÞ_WM^SÖ+K +Õ·”ñïz O—´:Å··åg$7p:XÐÑÕPs?%÷%3’3¹ÀÄÁx¡=†yJ@7§/Ù€èy}>'†0öþö(^º Q8°&F,ŽŒ>„mŠlŸ×.Ííhë4m}g î°Áú¤÷"z—·<3X&v6e×YŽ%7Ñdãßî€3Y‰W¦?¡–‚CgEN ²Tø¾cWÚb/@êîxŽ}£ª˜9†ãÑþ #¼[^<AÛ=å¡›Ã.Þð…a$ ’•w¢dì!záÔUQÝn™H³­Œ"ô«\&W§sP‘¯“!R#ŠG¾Ž7RC>‚ ¨ÎûHHÖ¯“Ô{Ûô ° ÔÈø ‚ó†u*°A“¡#IŽ=@'±Wv0’IT ݨÄ} úømødB`4`ìý¨ï “µ|–Ò*Ñê§6ekÒ•ÁÖ©`j žõž¡à\Â,$,›Â<öº]kN(bt°¾¢%5Ã9I¶?€Ö®QÍF\Š‡i‡ˆÈc¶Á1çú}¹ídFð›FÉ0%b$HòCÁìEÒzÑc-’ìº!ØUd©÷7[!(àK±OFÌH5¹e/o俦{ËrÉš.–많c£´\”Æ2ê£Eš§öÎ%ÀsBˆÁö¥ìVŸËnлFoáïH+åÍ,8I²!˜ ¸µÅª-°µî0Äá4`Èu ÕUDLzX4›Wñ¯` mv=÷?Oc¼-¡¥C0…®ÛicÔT/ÆÍ„ÌCMqô_xo†wÔÖâ8á;*׆Ûb{˜-áÊò¿BLžg +—ùï97ÜC¬ozLœ‡í]D*C†±RBp,Ûè¹ ‡uG—uyë«{fL!T¢ÑC›ëúv·ZU®À‘h¡½foî¸GQ + ~SéÈÂN¶mèÓ€–…âàâ¤alŠ¬æì²ÎâŒ=ÃNÇK±ÌÆ—'Jœ;Â…axÈ<"À§ËSIf)9*2k$ííYÊ€ù1ØKÖKÖ„ãd2ôâºÝu )ñų¸Nܯ ဘæ c NmP`†ørÖ7Î;MôZ)ªfee”/îýnGV;I¶÷ë18Ⱦj‚‡ÿL2‰ö0•UÇeñQ1|Û÷È€‘° æ:ˆX¶ +ÄzT ·X™E¢ ¡òÜOÔPh0¿GgèKsªÄ+_åj,1h;ñ˜- +øØ>+ŽÎ¹'*– b´²;¥äʈÊv,ÔŒã³0ü,P‡µR )é¹”¤ZØÄ@ †+÷B·á¯›ÜB—pë‹Qúe˜_­1w×Ìã¹\Ãêp—5e‰Öb‚àØbŽß!ažoB9qæ¦ôn]!–¦¤'v#K(ÄŽ D\‘á4238tŒØÄ}Ï/¢<$a¶lé¶Æ0¥Eìªaн;•ÒÙ+ã¡Þò” +m–2Ü8âøQ‘{Cö\½åïXÂÛðÀr¨9sɃG÷Ú……È;z P&ŽÄ΃6ÕC{ &‘Rá”z”u YCÑÛ!–çìš;/‡pAUBEæÊTš×ø0æ¾­QéÆ®*ì­À ›&á¥E‘„ZÁ‹8TFkÛóø%V锡ñ€»…ͦ;ø]¤¹Ò +ßÏùKe¸æÖ’éH®FÕóã Æè8IìÇi~*“UøÃDͯf²Ǥ3úY#8E1ö#*¿Cj 'vËxB|7í­ =‘GÈèºÏO$ê:ðƒ,u¥yœõƒw + +ý…³|tžj51O9ñ³‡ÕÚð«‡<;ŽÁý\e¶†Ý .Më?¼^ÞaÃÄ7>üÞ§ÿTyÛøËO˜kÊÙð;€#oëÔËLËóV¤ôŸ»)œ*N¬¶ÚiŒÈ*‰24…wä5LYbz *ˆt놡Jyý %«PÃk3ú¶¤­9aĆ“0’쥜g!U1ó¥çÆXÜÊ-uê«(ùÚ]:Ëü$‰\äš·æ–Jû@yað¾ÿ¸DŸDßhú{[À{ù½HÊÎENÝ° ÝEÕtöG) tCá¡åbÿÁF­…yrZ&0++ƒð£‡ïÝð{¨9;x9dŒÀ«ÔŸþÅ1åÔOÃô{ cgƇÞòÿÇC%tÐ$y¤Ê/éÃ_ûùÍ<R‘¯ž1 ãc9UâÃûäPoÿ©Ù¹endstream endobj -5420 0 obj << +5636 0 obj << /Type /Page -/Contents 5421 0 R -/Resources 5419 0 R +/Contents 5637 0 R +/Resources 5635 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5391 0 R +/Parent 5628 0 R >> endobj -5422 0 obj << -/D [5420 0 R /XYZ 85.039 781.388 null] +5638 0 obj << +/D [5636 0 R /XYZ 85.039 781.388 null] >> endobj -5419 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R /F62 4047 0 R >> -/ProcSet [ /PDF /Text ] +1314 0 obj << +/D [5636 0 R /XYZ 85.039 566.364 null] >> endobj -5425 0 obj << -/Length 3348 -/Filter /FlateDecode ->> -stream -xÚ¥]sÛ6òÝ¿Âçé=ÑÁÏÞS’&;mê«ÕÉÝôòÀˆ´Ì‰Dª$Ûÿþö $RÊÃM&&¸X`‹ý¦ÔeÿÔeûÎ/ÓLù:Ë.WÛ‹àr 3?_(ÁXÊÂÁy³¼¸y'—*ðó ¿\>ŒûÄ~ëËeù—÷öÃë»å»?®ZkOeþõ"M3ïí¯¯ï¯•wûöõ¯8ywðúÇíÇåõBy·f|Äùóîîwœ»Î´·¼þ¼üåâÝÒ²e  9òô÷Å_ŸƒËøÿå"ðuž]>Á8ðLo/€)?Ž´¼o.î/þe·â¹è’W͉À`,Tîça|^L‰ò£D[1…0ù:J\1ʼn $£BNåÉà±$‰W”øVòººªá©·j·Û¢)O $JýTEçYqˆEÏÜ$0•|“K` ¨Ý¼OB1T~œæ°3¢e¹ëà²jä¹¹Ö¡‡üÒ¢ƒÝ“ÀÏ’DÁIN³ãØ[ákÑðËx¤^…/xèæ¿Š€Âzt*’ #->“ÃÏõ$Q³`³q «®ÞÁÄÀ‹ÛŽ§v]»FÅ–á´î¹Z퇪4dÂÌ{aì{@ƒ·/…g ‡~Å ' /1ñ÷Ob¯îñ™xIi½¦}N’à‘Ãœ¶DœÛ7ð§©ñïZ–_³‚àø5ZÎ'^ùС,qTðƒD¹©«ùŠuA{Ññ6ˆppC{žâ u7 …U÷ AUJ…J”vÜÅe« _{’NÀr‰rŒ%œ'Þ¾qÀ›Ü'@åÂéÒ\7üd&˜#Äbs°„/eoàqÐïW¸æ‘!…Ì  -txÈ4Öa¢€Í^ÝÚ+I.]‡[V×ÌÈH¹*e5Z-XžݑʶÝÀ{lÛ¦Z¤ójFbÕ@—êÃa €øpŸË GAê<õvE7L±gpÑ™yœíÍ -R@ |· ?ñPø$Hál -õ -ű¹B¿¾ûäóšÛÙãQ¦À‘‘Ag¤ÄF„ˆIǯF€zNaʪ¯× Z¡Ž48ô34D΢Ð{BN 1N ÅÀ£z`ÌU!KV]UàuÛåš.œ˜zâ÷SüÂv¨MÃ# -¸Ý¯…zWÄÓZ(´]W­„®kI«bÇ+*v•£é -ï(Šð¦‡ßTë‚Äô‚FxýKÏ꺥KuŠ"EN g§Å6*ncêÄUúi’ŠCÞ슒T¦nf|w”ûJç|w¤rR¤MàV<ÒÞ¶deÕ5ÞI• «@ù—Œ°êhº`îÒ$r¯a ü4‹\ÿZô$¦±ª rÓZ'£çg×)9œyůƒ5[u֤Π|ªÑÿàÈ,§%àhtµ?ŠPP¨Íæ…Ç«ßΊ¦)$álS=ñ»«ܵ ž®1§ÕŒŽüùñößœ=íŒGã «ß1þèźÿjû)Dœç%Oœ“YNœä~¦S›åhÉr~«×]1ÔtTˆíç5Wo7à‘€½zU ï¾b0ä?å?bñ -qù(@QAÄ:q”$õƒ(=”çd6kåç:±ÙÐBÇ_ ³^!ŽÀYì¢ðòPÖR+žž\8ÀÊÏuU vU¬+7b0ü "qÔ†và1Ç5Rµõæœ4õ5Ø]œ’rÆbðÔ~Àƒy•Î#õbC ýÐF7ª½© -=NÄäQ(}F}@/Š®§áPâžqª§ÓÑUoRo!ûB æÆ==y -*!R;Ѿ¬P(‘Fö6Æßî7èTÀÛøŒóï{õU!¶‘Eó—¦w&½TègÈØ#R zàá ²Úîùå¡ÝàÑHºOözKž¤àR}«[I"q¨ü†{‘ó¨4Ð4ì‡vÇk÷½I^š»à-‰;v‚D§èŠm5X )Ô—aR;pÎ2ìw”_L%ñE„QFƒwÙZ;¦Äi(Ž(ÒšS?×ÖíØ 8¡ J!šK˜üs d2¯~৕..Õ&½`kÚ;y4¢^}"åÏ IuqùÆ ]ñG¾6\™Ì‚ò"ÙÍHÂÉ•5È*8å…<®›~ý(hW0ÁWœÕ\lFÏσX©³˜}!”»$=xÚX)"zOÈî®ÙîDMpˆ=%lƒ½ -< ¹œvGN†ÌÛ/ÂØŸcƽ¤Æ<‘¶ë,ð>üŽ"ø´ü_߲ƳŠOA'è"Óœ<œ! ½ÿ`IOW `NÊѵÊõ‘¥°ÃcO{jð -°Ut#‹;²ú–“—Ìôlh a×mÏPôWm7õ~®®ÿx"Ø@ªèúl°qp(ØDÊMÆ ½‰ æ6HH.?=¦§‚ÄÏâì,Aƒ3¡xÞTùZ…íå„)„™ŠÊ^¸ -ªsR±Ô-®|a—ï8Øí$ÐÐSàÁ˜r°a–ä埰™cÐĹÙRÌÝ¿$ªpMOCnor ªÌÄu¯\ ¾Ì¨3Tžh:A$®’Ý…I÷{™êØ'PÜ6AàGü  Ð UŒ*˜Æ{\3ïƒhÌî‚xV'Èm$ï5éîDfˆEó̪YWsŽ $8V¡ÖŠûŸÑrH½|'gµÜÁ9­åé{Z~Ž ÕòcŠ³ZîR¤*5rb¶Ž””6ß%™XK_åʨd,éã˜ášŠµÌ‡u¬ç¨Ùµ¤{£€Uº× T¦Ú§ŒM¥‰Ÿ$ç{ÓÎic3Hß3¶s­±Sœ56—"VQ œŽap—°¯BÔ¼GJbàiR{zÁ– .™t×lg0>xuÍp-—ª¼ßhŒ8CÙ*‚)ßÇÁQ{.R™ÕÞ(ÿJßä;Û©Æ%u×ÜœTõíf?6kUNÞŸDžøù»ùŠLÃò -ÐÇâIv¨—¢m]ÌŠƒÄNv³_ ŽÖ £5EÒ\wtùH½ È€/£/À®ÌÏl¿0ÆÄÄtGƒp’鮜¯ù8?¦xGwcê1â¡Ó»7_12˜^n·®§Öº—Îy(jV®~äf5> ý(Ul;8Ñ­ã׊{á “éY+$rÔðûñæ?ÔÍÐû=xøU±a]ùM5ÜLr¥<öãLòudÓgÂͬM²NÃ1]󌿒KY÷\lw¶j¢û½ûŠ~%K%£ñǬg5ÿBe?ö-)’Áîèîñ9ã<·ï©›Õ²Ìþn`Woÿ¼»gɾãŠqz§‹{¦øál½ ÿÙ,þ¯f]SígúDÍÃ=…ÊðB_ªÂð˜ßXgt«†ÿQŸS„endstream -endobj -5424 0 obj << -/Type /Page -/Contents 5425 0 R -/Resources 5423 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5391 0 R -/Annots [ 5429 0 R ] +5639 0 obj << +/D [5636 0 R /XYZ 85.039 526.201 null] >> endobj -5429 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 119.05 296.579 131.043] -/Subtype/Link/A<> +1318 0 obj << +/D [5636 0 R /XYZ 85.039 413.364 null] >> endobj -5426 0 obj << -/D [5424 0 R /XYZ 85.039 781.388 null] +5640 0 obj << +/D [5636 0 R /XYZ 85.039 379.224 null] >> endobj -1338 0 obj << -/D [5424 0 R /XYZ 85.039 761.463 null] +5641 0 obj << +/D [5636 0 R /XYZ 85.039 213.848 null] >> endobj -5427 0 obj << -/D [5424 0 R /XYZ 85.039 736.911 null] +5642 0 obj << +/D [5636 0 R /XYZ 85.039 183.761 null] >> endobj -1342 0 obj << -/D [5424 0 R /XYZ 85.039 599.198 null] +5643 0 obj << +/D [5636 0 R /XYZ 85.039 156.663 null] >> endobj -5428 0 obj << -/D [5424 0 R /XYZ 85.039 556.244 null] +5644 0 obj << +/D [5636 0 R /XYZ 85.039 118.136 null] >> endobj -5423 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F41 2994 0 R /F58 3360 0 R /F35 2976 0 R >> +5645 0 obj << +/D [5636 0 R /XYZ 85.039 85.928 null] +>> endobj +5635 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F58 3380 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5432 0 obj << -/Length 1411 +5649 0 obj << +/Length 2546 /Filter /FlateDecode >> stream -xÚ¥WYsÛF ~ׯPŸ²œ©hîÅcúä:G•IS5V¦Ió@‰”Å–‡JRVõï‹cESŽä>t2-,ø|»–ÓþÉilý@'Ó(–¾Žã麚Óм›Hg1s&³‘ÍËÉÍ[Neà'A2]nžüXßX=]f_ÄÝO·‹å›OÞLk-dì{³(ŠÅ݇Û{OŠûùÝíT±€ÏOóKo&Åüã;¶G›Ï‹Å/¨ób-–Þ×åûÉ›åÖp „`LO¾| ¦Äÿ~ø:‰§X¾u5 |k´û.'÷“_W¬3SÞu ‚“ÅL&~¢ìË0…Ò7¡`R 5¾6á&ø60 zofM"ûUY@Êݶ¨ˆ0‹qAaÝç-Ê"1¯7§ÑViš¦fyQóž[ܲ&ÕcΪ×'/mNJXõ¸? ;²ðúÃk<ávq wù‘4/#ñdCHH{¡a¤òÀæ7/6"ç¦8eÉ°ÛC¬ŒxËâ´æ_Ôî¼™ŠE«´wûû†Õý¤EÇÂ.wÀ4ns·mÚ¾‹#ö˜%×01~`Ô‹¹Žl®V= Ær¨ºuU¿kªjTÅ7mËÕí®Åãü\ˆ'€ ü8Ð/ íGñY°ÒO¬«B˜ö³`¥± Äœûì¡àö -Eå:¨EØ!•žÅ;Ä;í°tL‰,cÛÕµÎr⬩_yN‰‡Ü-Òõ:ï®Â¡z½œñ“ÍÕV´‰ò•Ž)ã×P )^Áñ*Âi™Qy¤ØìOm˜³Šú‹Ö -&ç [±qwiGÆ…˜¸ŠqØklÙ»=Š´,œÕ¦iyÑoÝYŸ?Îç9=žBéóŠÅ6Hk·É…UÓÓHyÜ™]ß´yæâ¨`j!`;K8<¥g0 :G‹fÿ)+ò:ƒD¡Z˜Ü‘M¶i·åÇã6iˆUš2çuV´=ãÏ›¼§Poºmš¦àï€HP²Í¡èßqˆ—ðfŠàš9’…²?mvÅ-D™ É “éCZÔìØ›±¸O+ܺJ¿sã<XŸqKäŸÂ]…Š¿êSb:LÀP[Îk.4ÚÑŽeUæy„üBâÎœ,™ šUšõ¥2nX+ºUú 3­"_‘3;‘bÜ£|­å”Œ¥×ÒëõúäëÀWÉåWŸsø¿þ z xêäòDX$yŠPJ?×êØ·±þ6à©@]1endstream +xÚÍYmsÛ6þî_¡ñ'jÆb|ë}¸qœ&M¯“¸‰îz7M?Ð"%ñ*“.IEõ¿¿} ItÓ¹úæ:ž1A\,vÏ>X©Yj–F~ ³Y’*_§éluÌ60òæBÉŒ`fü ŽpèåòâÅë(ž©ÀÏ‚l¶\Ó”eñ£wóÍõíòëó…ÖÚS©?_$IêÝ|wýq®¼oo®¿Ã!ãÝÂ뇷ï–ó…òÞ¾{ÃóqÎßooßãØ<ÕÞrþÓòÛ‹¯—Ž + ã›X£¿\üøS0+@Ío/_géìíÀWY6»¿0‘ö#£å}wññâûA +™5±Ó…Ñ™…él¡?M;‡¶®¢‰­«Sm#ßD°ÊÔ +8ñÐÓß?Ìaâ•h£-zý¶ÄU^¼ç“ú* å«Û¶ªû²íxÞ‘`ú™JeÞºÙ‹²õOõ^È°¸[èieÃçÞý‡j³‡©×/V»j5Cü<_˜4òššŸýô/±{-´«šæ—- +¢€eŽ|¥#?3JVi繇¯›í\Š$~AIYÂ+f©·Ú?tÛ¦ë'L«ÀV©²RaiÅJäuÁŽÜ¸+Wø蹯šØɪaw‡ì›¿Îe~ìÝ—ÃØ~" a¬ý$ +Áà‘DCQ¤q/}UvOºÚ~l~§«õs»ú†œ¢ƒšß öX¡m¿)kvT¾›ŠwåƒyejŸß=K ›?Ïîé¨WsBåmà»8†ÎrMqÒ–õªì|ö¿pij߷óè¹w~Í°_—ÞzG/ß5îÇÈ»”5lbaŒñþVòåa:5U'Ÿ¢&>åW:…ØØ4ü¼ËG“ƒ¤†…ô ¬Ní”&$HáiévnKÍð‹É"H“)kÀyÌ ¹~)N%¤$Ù°ï’6“¦bª&b h5x-YvÕóôn:Ç_ÍQ¤ K;œ‚‚šýN<âœfÏ/Eã.Öñ˺mînÑ玽³©êšq›¢WyWàç@yÿ†÷}'ʬò¶}äš½ôu è#Y‡’/ò„>“ÑöÅë!ä&ré7Jê ¯­:Ðfl^56Jg)ÒTúó;JÈ îú3þ£yöþSÑ~¬ãÿwpA% +T¢à)P }XP¹.>ç„'+6p„ hB?LSZe0If*o׸|>Z £ì‘C£Þð(Å(÷Ii³Áñ³<ÅTYðô8„Å%¾Å¨}ÍýcàEtL¹QcÇÓQÉ'9%?eü8‹Ý$™³{÷hJo‡ +´¥VYÃJ¡òÊ ásµ³öٔݓqð_%ØðOžb^ ¯óý®Ÿ¢™iæ+‹€;4]ß75EÈs$àg§ï‡,ÌêQl´m$É!d”lQ[ÿ$‹äwÝ7 X1>âJI©v×”åU–xEÎA$¾·*Ÿ8A¦N­ü<™Þü/2½ÒÇ&ƒw7á+ÉÚÃ…‡°aE'Þ ·²i™ç™FQP3 +Iè4A: ÷ D$3õ®[ûɘ€ +½ªäÑOŽI#;N +ÍÏ6qá ++W?8OIM]r H^„¢ßKÞ¨ò¢KŽ­6lʳü¥½k__úŒh¡ñ³0ø®ó + '-i®ä‘œ6÷È#Eõ)Pºl˯œ™ ‰3fB‡!CbS(‚uøÞqçàÞî¯@#8ÞJï¡£¬ÎüƒÓ¿i†3GCœMZÈNÂ{rû,²–é‰ õh:t*©®!@ºØ®û€AÈÅM¥æÀO›š©üJJµ_¯›VÎؤ¡‚ÏháÔä…,ÀHë#ã UŽ ÅŠÏ3v´IwÊ‘qÂJȨ Žyoɾ²‘{ž8†p%à Á•|*WÃv1ò=ì.Ðà™àõƒÙŠäbÙNð%#%Úð BÎ +‰¸¿´¥È¹¶:ÐZçAõ’§—‹D‚— å" ïZ¯ up+": ‚__üó–Õ€“aõÃ1^ΙœZêîÊ^ ƒT’,„íÑ5áj9ŠOsÁÜõmÞ³e¦7¾‘ #àºíï*¶áhÕ”¨ Nr5Ü9,ðÑ îõ›pü0°)a +öŒM(7cè~îø¢ñ¾,å„‚UI… +¬ÀÈ‹ ·4T DÐÖ^h‰&î§|«ívTéÌH¼G£TÊÇC‡(§±ßs¾®Àà8Ga#»°#§´Â ô´j(|åuR€MYŠ©]´“À‡$#pñŠ? Ý ¸ù|·Ç°½nZg¼l… ˆ'ͼnžˆ¤ŸËö³E¯—y{9Uc b °c‰58l™›Ù´y•MÄ£•°mÛN¦7# +AABu¥À ¨­ÐñÓ2B¬éÁ››²¤1>ä&÷Re·mœ5ãgãvÃåÖø/ÙoÊ|Fû*µ7†KL½ià--= þ”1¢Ç 4(N’Ì!€Î Ã0ÓSâ¤A~ÞóÐïî§_Ðü¡Ð?¤™áÚDKÉÅ]ôŸÌ)WìZ÷7€@Xú;ÜÚWýÔ òV¦’c?£ÉO#îw¾o¯³ç v¸À!ÖD°¦êXûljÏ=”ðùe0¾Ž*(²Õ>ßf ?G¤ç÷±ÒIX[Â]ÇÉ“¶,¸ú'ú"&âóc:žùny%æ%$ËôŽKýKöGšéy<²º†­†D.l—,C,œô"–ì( ZT·ˆ¿?ÁÿŸ)…ò}†‹›ðZËBZ3&·e~Ïoý–¢ZSEŠ.£ZÐT3ê(¬..¡ú)•Ba9Wœb)HÇxžFž$âD£¼æ)UáˆÊlŠâ±ñ¢JQ{Å_r­àœù¯±¿^õyËJÑœØPsæ’ +¯œA[wç +zãUméÜ%Wö.ÛH¥)=àZ¹óŸÔTˆÄ5„T¥~•1Î~½U&ò“ƒòNš˜é³% +þØ/É:H"ê7K aŸí*–¤à(øT{0endstream endobj -5431 0 obj << +5648 0 obj << /Type /Page -/Contents 5432 0 R -/Resources 5430 0 R +/Contents 5649 0 R +/Resources 5647 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5438 0 R +/Parent 5628 0 R >> endobj -5433 0 obj << -/D [5431 0 R /XYZ 85.039 781.388 null] +5650 0 obj << +/D [5648 0 R /XYZ 85.039 781.388 null] >> endobj -1346 0 obj << -/D [5431 0 R /XYZ 85.039 761.463 null] +5651 0 obj << +/D [5648 0 R /XYZ 85.039 761.463 null] >> endobj -5434 0 obj << -/D [5431 0 R /XYZ 85.039 736.911 null] +5652 0 obj << +/D [5648 0 R /XYZ 85.039 748.383 null] >> endobj -1350 0 obj << -/D [5431 0 R /XYZ 85.039 694.042 null] +5653 0 obj << +/D [5648 0 R /XYZ 85.039 707.735 null] >> endobj -5435 0 obj << -/D [5431 0 R /XYZ 85.039 653.878 null] +5654 0 obj << +/D [5648 0 R /XYZ 85.039 682.758 null] >> endobj -1354 0 obj << -/D [5431 0 R /XYZ 85.039 653.878 null] +5655 0 obj << +/D [5648 0 R /XYZ 85.039 653.538 null] >> endobj -5436 0 obj << -/D [5431 0 R /XYZ 85.039 617.011 null] +5656 0 obj << +/D [5648 0 R /XYZ 85.039 623.451 null] >> endobj -1358 0 obj << -/D [5431 0 R /XYZ 85.039 520.654 null] +5657 0 obj << +/D [5648 0 R /XYZ 85.039 579.209 null] >> endobj -5437 0 obj << -/D [5431 0 R /XYZ 85.039 485.909 null] +5658 0 obj << +/D [5648 0 R /XYZ 85.039 538.561 null] >> endobj -5430 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R >> +5659 0 obj << +/D [5648 0 R /XYZ 85.039 512.069 null] +>> endobj +5660 0 obj << +/D [5648 0 R /XYZ 85.039 484.97 null] +>> endobj +5647 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F59 3455 0 R /F58 3380 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5441 0 obj << -/Length 2913 +5663 0 obj << +/Length 2294 /Filter /FlateDecode >> stream -xÚ…YYoÜF~÷¯Ðê%`Å°ÉæµÀ>ÄŠ(‰cÁ–‘6ûКé™aÄ!Ç<$ϿߺšÇ2ˆ}TwWUW}UÕ£®øSWYìQ~•fʲìj¹{\m`æ—7J(tù±ÖÐ>3yãfo’Ðtz–FθIUîGZ!ÍÛ‡7?¾ƒ«0ð“$ºzX;F’,ð³,¾zXý×òÅMÞíBy_î?/n¢$õî¡Ó,n”W@£êŠjÃãŸûýZÊ«ð¯éx´¨dÖì€üÑp/òƒÅÿ~}óîaàÒŸ&~–œ•#¸º #?JÃW…L@!:§B* b'S!Ã¾Ê ©PL{wU×Ô$ª_vE]]âQ–ŸçQƒèuUì‡a6ãQùyOxŒ³ÔOg<*OÉ}¼G [Óá-ômQ©‰g*쯸óÛ¶²JwíAܯñ:¡!^U|æA>å0K‰×‡­²Ð»­w;d¢F ÈÀ€þ¸ûÏa„™×ñÜç µHÝÙýÄ'6ƹ¯£p8øƉf#Ÿ&8ê› ù©Ç{¢ ·hìÇgg™Ÿ§Ùüì#9šïœx´žÒ*VÅÖ´¬€ÇìçÙeMZ¥>£Òls`Ú=‘Ô{P^_š>h yàýTB»ä%;ð¹8ñþ†‘ºá¡ßÉuq«þï´*† ÀmŠ -"?G+Pˆ29±úØy­ˆòÌ«jÜë…;í÷B(ÈÁý;þ¡ì¶¶hxhµ ©”·††éK¡ÜÓùlÄæ†Ç‰¹CKöAr&Qâ=,²È«™€ÆÁÂÜ;ða¸¼›ÂK‰e)ÌñÄD·´ô#ñ’¶—]Íš/I娪`¦£uÛ•‡E¦½ÂpVÒCx×x }+½—E˜â¥(æa4ý‡h>Ü£P¤+ºëÒò¦­ÐÛaùA†ˆ6d -+r'Ó À"#Œ<âFf‰<ñ°ƒrN^¶Åû[îÂí¸µ¢ëÿa”##Õ£CO´Áa„˜Ô*EiOÜ•;®QC±fþb੦ƒa„$ˆçÚÅè\P®—k’ºZZ^¬6Ò,d#l]産doõcÉv%̈ ÈÄ°KÅäuÿ8Ù ˆX 7rjuü)úd®TÈ‹àÛv¦‘Ù•%ßÚl8¦*RïÓà)ÔhxÚíòleßëÛÒ1µÅ’ÌU.Š²¹æ èú·ª›nlÊ–îE%¬}%ö_“{u¦¨ZÞÙðdYwçÄ^£yD¨:à½nv†`Æ€å­éd– S{®´Ï‹8쉈Ö]Ð hž8]˜úAž¨ ÚJØÅ÷lÎ D?Rá×¾èøeÈ8®í ÷Qñúù×Þò”AçÂÆ~ô 2AÛ¬ peǶépŠÆ„O)Èð'^LQŽÇv[GŽ0ˆëÑøÂeŒ¨–#Êâ 9B’[FÑáÔÛ6i™cëÒðЯÈ[Ñ pXÓOÃÓÔ±ÙÞ#‚:‰‚-•}AcÔÚ{k {GáðhnØl1LR„‰hAcÇÛ ¼uƒA[5ú­0ÅÙÃd‹®1+ƒÕžÚÜ,| I(ác–e@›Ü=Ð1XD†$L+Sìæð¥Á€‚a”• ج…Øì ©Ò«äê°³'o$ƒ†ÞW)7L[æÂ&÷ÝtéÔ‘y¼_ É@åð¯hϨ§"{W±×b(ÅãvJ³ÌûdDõ|‘DÔJ“ÌHNî±áÇéшøH{‹#_k>óÀš rÇ;tPØÍÈU,1B,‡åhAxH¸ª‰ré0žó ^Oy)8Ù9¶´fŨqÀEuÏ–GBíA‚µ/-»†Am°Lò²ŠÚÙ@ÔûôÑý élÀzAól»^œsw[a€°lá­Ð=‚W.yò$8ZöÄÀ‚7ßvþ…L>‚,]Åù«™ü„æbÕ%ÊO3=«:B©:>>[ªûžQ°£ œÈ¯r2Ò\¬)"@öDO€=ŠsöÎä0S1Éß*u<`˜bß IoÇ#­x »X9 NC TCyw²Üñ"ûKžÎùYS¢FÍ'ñxr¹*üÛ°Úgƒsž±j² žPµÌN-l˃/Zš&D¶Åt>cvÑ -ÊèPer†¤»iu8bˆðWˆLx½Ô'À š*-®˜èî´ÞKí’G>Ô­SÕ]Vû¡ŽND’Ø{G¿aË¡@cðpH)–7OÜ{=0L^q€>–;ÖÀX:‘Öê9¢¼V’ûh5^b'¹oóÄs§qƒu’yÆØd„bšrjF,zkÂ_ÒØÒì ÖÄEI1ªp`@ejíÊÕ±(ü0n÷'#:ÛŸ,9Jû°¬¬«¢«ÇóbHëÈû¸æw5Oªë9îHiZ¬ùë"Í©ØTGëÒO Dò8ïdxñ¤¾}‡EŒ‡ti^Ú½7ÐùåJV7›ÞÁw.¯(óý)c‚¯¼t#´þÓ+¾T=<ظÃ\´ÌEä•cªAÓ}ËV å^B¨¿£ ,ðy樒÷´š¿öÛ¾Òö8ö¶ÃÃ1LÖ•å[ÛP1ëáí‰ô†ßYx‡Ñž€Ž3%hœ+R.kI±õa\|b=q|/Ä -¤ÙÜ’g4$súƒ?xá-˜K%›Šà›¼þãË„æâY*€3ÓÜ•l¡ü˜õ–/¹[òOB·u%ê£øN¯Úµüî@Ђ’LÒôCÇcã{{{»¿ýÝ-g.ü‘³È®Žga$…Ž¢Ù¶Š£8R#™óà¼Üÿ?x¹cx¹^îðrÕ˜ +B™/¼H½ˆ2OÁ`v +ªm6…0é"Žô 3Üe,µÀB­aù–[4šÂœx‰÷‹GÁ}éǯîPÆuZB£í`û©íh¬\ÐyÊU ’z}ѵ„^%<"€£Š­õceTv q¤ÙNªŽÜòà=´œÀÝ­¥ÕÔ¬KXÏÅ»õ*!v˜k˜pŸÿÄ9C7JÃí{Ôý<†–(Ö`¯vÑÞçqR‘ðÃÀ. šÇZÚÎÿm +-JHeÁrÕWSXˆ©Å"âË\±n‡Ž@U¨~_1<%B(CôÛ+œ¤} Æ´cÞ׎EyáP' sž.P0BÉW?Ô¾ï:ë~Œ¤ÕðOÓYDT_:· ?dܽÄù¾äLÖx··Ø•­ n¨ˆe1¨“Gåƒ~³eàW¿P ßN„ N—° ÆTCÑ ¦E±Ãa‹"Ëq9ÔzÍ`>L_Bk`X¹§¨0®M&ÓøæâukÒKϼã¥\VܱР};Þì)å‰gèúÂQ¿/ì¾ã|¢%DÖ¤ë,+kxÞNÍ–1”aÑŽhUùóï¾EZ÷Ãc’Á)„+N4ÙÞ‰Ž]“É(}-¢!”lû!Ù8 '³Í„'m!Úöì9rf]rÒ¡Ep>ß0„7WþròOl +/0ßB“ï_Ø$¥à=s½ò#ûø}´ŒÖíx™t$¤”GA@¥¼qI¡”¡|ÙVTól‰ô d'¡Øt‡„JÒô׸W‡AÇ3K‹§9ÿ^ca³3vâ½X—TX ]ÌÚPŽf=Ÿ‘mˆ#÷æ— T@5qgÝÂAò+ÁCÓO\>@!­…7ñ®17ßêÀÅû"owÙK¯#!Ÿµ®»?ó[¾ÙoÐuùu~~½ZsqmÄ`Å_ÚlÛdFp±åï×YÕ—p7}‚²úk29é˜ë·eÊÂåÏhÉÄÝz%ZZcm†²X›á÷sÜN$ñŠŸÿ,sA:¹½¬îknIò¾+<ßáXüîÙo¸y“ÃÒŽ +iÀ²³4žPnèskuþ–Æ¢…U=:Äo³Ëê%Ã.Î.ÿ~vP³îš,)ÿÛ6ü¼o¾Ïò4+î²æÁ¨Íò2i‡mb)ÍDH«5æÏÿØKi‰FLmÿq›–O hü êvê?(à}ÂÝ>ùx4úß_hü‘m°õgß¡J…_š( +Ø·þ\GIÃendstream endobj -5440 0 obj << +5662 0 obj << /Type /Page -/Contents 5441 0 R -/Resources 5439 0 R +/Contents 5663 0 R +/Resources 5661 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5438 0 R -/Annots [ 5445 0 R 5447 0 R ] ->> endobj -5445 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [258.436 549.863 289.974 562.765] -/Subtype/Link/A<> +/Parent 5628 0 R >> endobj -5447 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 242.621 135.005 255.523] -/Subtype/Link/A<> ->> endobj -5442 0 obj << -/D [5440 0 R /XYZ 85.039 781.388 null] +5646 0 obj << +/Type /XObject +/Subtype /Form +/FormType 1 +/PTEX.FileName (./xslt/figures/tip.pdf) +/PTEX.PageNumber 1 +/PTEX.InfoDict 5666 0 R +/Matrix [1 0 0 1 0 0] +/BBox [0 0 27 27] +/Resources << +/ProcSet [ /PDF ] +/ExtGState << +/R4 5667 0 R +>>>> +/Length 5668 0 R +/Filter /FlateDecode +>> +stream +xœmYKŽ,¹ Ü×)ríEŽHQ¿Cxaû xf€~ à _ßAefUÛ ú‘’(2$Õå´£ð¿ýóë×ë_¯ßþÇïÿ~ÙñçkžeÌqüçUÏÙk_Ç__í´cVý,½¿n?cÝO¯£ÞÖÙð?ìí‘¿^^*öõ[ãçó‹Ü௰`kº=úq­®öç„Kþz]6\šËĽÁÏ;|½þxýã5æ¹Æ¨Ç²s4ÝŒóy¬rÎZúñý‚!­[¥Æ֘дqú²qÌ8{Ážß¯:ÎÚ¦³ŸËñóÑäÎÜççYß°Àbž§Ýç¿išáŒ7¹š½‹·b ÙÛkÓçAäYå(S+Z9K…­XÐXÃQeÏŠ#Z=½OÞ¥›M­hgYq̆­ƒšSŒFé!¸ø’± w|`ÏÃanÜî±1Îàï×9§1ï43[q®N\ÎB4¶ ûÓM«ñ{, €óq¦Áþ sñ‹Vyq^gðZ1¸ã„ }ЦֆéLþ³™ƒ÷À8GkOkˆX[NG4ëo_…tUAp:]Yò^vFÔ¹ÃC¤à»Ê`öÓq6€Ój Èqo´Ñêr}gH.Ò°¬¹Ôù¾¢"À¶èÛ‰‹à {Ê×Ã3¥ÂØqËXáæ=_8½=e<Ãâ\³ Ó»âiÈÒž¾‚ƒýŒ–ÁCV`Nl°·~Áò Ø߯þå…Ü `b¡I<Í*8²Þ²„QÂB+ػƇ&/òýZ„ø¬÷>Ҭܗn^ØuÀ%”›Q„Ksƒ:yl‹Ç!sßôsÕÔ“ئˆ °ÎqƒUtÈ‚ 2b1gl( Œà#ädl-œÙKóÅ-—ã;²Ð8‹÷K¤¿2®[ñ-ET>lÕ¥)Ìj¼ÃÙ ü€`“•‘{zÞ¾ÍP’ÔÖ[òå°*hÄ]ÏJH¶ÛiÎ'0oÏR³Vj¢7Ð{ÊN(@nÔcϵ÷À®–ÞL’€]båH,úì–3«LáÚ_€O¼®ŒÕÛéͶQɃ`7sþÕÓ,šÇÜî®=h݈³€¢à"ßô¥›Â[cñÆ8¤2‚ˆpÐjA´]Þ¦™ œõD„,8+bˆ4ê®1)…!¼ZûÀHýÉŽký‘ý¬% éÑÀîúNöËú‡˜à¥Õä¸9ŒrORWêü~•Ú;§ à,t#S͉£ä²,vz±YÌ$”Í6Û-“ãg2ÜõEeÆ›ä†bé­Œ7®ðJX’dL©„áC¢` »YyuÏžI¯ö N¡Ÿ9ˆÐðwå¡·<´2”d‹‹8o]I+‹Îs$´û>c +®1˜i¤ ¯I£i¢·°†˜¹=è ÊÏ•…§ÕkÔãÅŠRMâöD<¿†ãµ¥WSxË&‚—rlœÊòžý&Q-ÆŸÝë~x ß%ªÂ…=4êqÆêjsà#‹|æQ“©(5ËdŸ¯— ¡è¢oQ3ƒUzixìIÝ3ô-æ8ç¬÷,¦#çÓœî2‡P{Šâ­&o© +s¨&ÃÄÊÄv¶ ·ìj)¹âÒÐCœM¹ÏæhwC¼²4ƒ§MiˆKWV.\V©qõJ˜Qå|˜ÂdLé=…B½ÝØ=*ë’qí§­Mƒ'*0*2î±gO¾Õ1|:›rËócܤDR®&DðÑ"wv³B\HTˆÚ8!§ƒFø~¯X’ëÒl—³œ&jÔ …à9“ƒPÐQjk!S ¥3‘ò ˆYhÇPÑcU§í|øB*²Þ8inË_ìæ[´ç‹ïGS8“»yö?˜n 2%kvjhXlzDgx|¼ðtúê󨿿 Á$ç]–šˆù¼Ÿ‹F¾Î\o7À0òaNµu™ZzÐ\‚´*n +¬ÉQ0߯+#ÿ±-»=ÀMUxËùëz´Ù_€Ë3û&[(t½zŒeî— “Fò=of¶ä{_h¾‚¥9SŒ]`ô¤ž +®Ë¼«ÂÂìï{š)Þn~\ÇÚ¬£ZqÉp÷ìû15LIcÆ ˜Ô¤9±ô~ûz%“º˜ÏÈgâ^• yöNî³åçióþ‚•Û“:%NkjPñÓ’{øøÙ qo@B%™6•lÑ?Êò»˜«tTMbH +­Pø3øô™×!ý³AŠ<5§!Éçãß[Ž«¹5{Š¸:,RŠ½¥?ôök8ò® #Ž$„6ã?û¥?%lgŒ¢¹_z€j„Ä5ðñŸzÙXÑ9I/¨Ýu›ê:¸ãš÷«(=IeÉŠºî‡”Ÿñþâ{Ìß^ÿŒEZ¢endstream +endobj +5666 0 obj +<< +/Producer (AFPL Ghostscript 6.50) +>> +endobj +5667 0 obj +<< +/Type /ExtGState +/Name /R4 +/TR /Identity +/OPM 1 +/SM 0.02 +/SA true +>> +endobj +5668 0 obj +2934 +endobj +5664 0 obj << +/D [5662 0 R /XYZ 85.039 781.388 null] >> endobj -1362 0 obj << -/D [5440 0 R /XYZ 85.039 761.463 null] +1322 0 obj << +/D [5662 0 R /XYZ 85.039 519.062 null] >> endobj -3093 0 obj << -/D [5440 0 R /XYZ 85.039 653.495 null] +5665 0 obj << +/D [5662 0 R /XYZ 85.039 486.845 null] >> endobj -1366 0 obj << -/D [5440 0 R /XYZ 85.039 653.495 null] +5661 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R /F58 3380 0 R /F20 3021 0 R /F38 3057 0 R /F15 3032 0 R /F62 4159 0 R /F81 5323 0 R >> +/XObject << /Im14 5646 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5443 0 obj << -/D [5440 0 R /XYZ 85.039 615.228 null] +5671 0 obj << +/Length 874 +/Filter /FlateDecode +>> +stream +xÚíWYoÛ8~ׯR,"KŠ¤Žûà¦GÒmS·vöÅɃ*1¶®$·›þúr4´-'FX @Äâ ¿¹gd’ÙTÿ1;’„òØ#FxÙiiQ{®wÞYÌ ¨- $l½šZ/ßÊÀf”Ä4¶§×=dšÍœ“ÓÑxúæ‹ëqÎ× ÃÈ9ù0š¸Ì™œŒ>À–pÆšürv>u=朿C<`.ÆãO°çFÜ™ºWÓ÷Ö›éÀOpðá›5»¢v¦Ý|oQÂãÈþ¡×”°8¶KKHN¤à†.¬‰õy£÷„R{"õ„IÄXÁù&d.÷„<#ús®Úž$¡éGHXô»M]w/\OúÒi–iZäªêœŒ>¾y'ã ÒÞ…i‰¿Z•6ʽŸ‡ªZ•Ë&¯:Õ´‡½AcA@qo/-3Dÿ¡L/ÂRìÈ\ɼ=žÑÿ" +Œ…î@ª¤TdzKÆüo]*+cÆv¥d/”©6mòe—×Õý²GGúk¹,ÑåÓüߺX• +©×£óF&cݪëæIÓíó0­ËRçöx¦U!üÑ +½=¹ùߪ ÙØHî8qت.kòïªA,f ק*ÏTñU5s_>ÏˤíÖà-ô’JªÓN%;8ÜFÞÛ?÷X~¤áñk°¼§r“Ušª¶½^ÅÍÆè]s]mxwž;ù3ª{¤>«OÉùÑnw‹á[â)£¿oR‡/€ßkôïïòw ªm¤ª{þ(µý«çÕ0—¿ù¸¼|ˆ¥uONŽ=q¦ +d蔉ëGÎ UÝsç«ëi®B®‚#bÒ t@šžÖó*קş@|·HŒšnaX—”‰FÃZ€ËiRF@ïÔèvàÜöƒˆ„‘9ä©Ê徃«u3Ý +5 I¨È(Ó.jˆî‡ëë(²­±[›â`R¹t6å°ÚKð[›Ôzú,—ZaÞ-`:I…UBdK¢Ã|·íÀYæÌØBAÖ¸Œ7^[w¦¾»˜qæ4¨ºÏÕR³*2d-úb­‘  +¥cëå*¹þ%ÚÁo€aö1#Ƙ2t`É(õ‘ý‰¥¿} X÷SHà…äî]Å4æó. +Þb›&_ßؾ[€ïG·ýdá¾f ü3ìs]endstream +endobj +5670 0 obj << +/Type /Page +/Contents 5671 0 R +/Resources 5669 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5628 0 R >> endobj -1370 0 obj << -/D [5440 0 R /XYZ 85.039 615.228 null] +5672 0 obj << +/D [5670 0 R /XYZ 85.039 781.388 null] >> endobj -5444 0 obj << -/D [5440 0 R /XYZ 85.039 580.685 null] +5669 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F62 4159 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1374 0 obj << -/D [5440 0 R /XYZ 85.039 387.159 null] +5675 0 obj << +/Length 2967 +/Filter /FlateDecode +>> +stream +xÚÍZIsÛȾëWðX%¶ÐèÐpU´G3ÑÔÄV,:š”íD€2$@cÑ2¿>o鲓øâr¹ØËëí­ß{œùðOÎL(|•Ìb#…2f¶Þø³[˜ùåDZ +¦……8õzurösͤ/?™­6D²Ê>zoþ¶¼\¿Ÿ/”Rž4b¾ˆcã½ùmy5—ÞÕÅ›åo8¥½K辿x»š/¤wñö¦Gš——ïpnn”·š^ýzr¾\a¡…ŽÞáËÉÇÏþ,ƒkþzâ •˜Ù´}!“d¶;Ñ¡¡V¶¿=¹:ùG¿ Ï鯚xéÂQ,”/ŒÑý“e8ñä¢äÛ·wp—åÍŸV0¶o‹Šhï“/u¾Í>ù¡Öh­½å(ÚœˆGûÀÓÏ~Ž‚Á2ŠD ²ác›¼Íj ,péý6Ïk^4ºe?ÐvͺÚ!õ.-3>«éÖtÏ<Ïòì”ÇÒí–EÃy˜ÆË·[1!‹$ ¦ÕehÇ=ó•" Ã!ó@E@I¤§€aè{Ë,+Ê[87Š½·ù7.ë¢láupQ¼Ryp‰æÚ»œ×E™Us%Ẻ·Ø^1ÁòòzâPAøÂý•F&_—þë'ÜÝ€Ä7iÙ¶ÈÆ8ò®Òòí&åÓIÂ(Úâ•¢¥&Àm\Ä{ìç¨1%.£çâº×Ý¥5ë–}çú¨QÐ.óŒ'`9)^6ˆ¥qä4gw#ÖU¹™Ð£†zm9L”(ÀžR"ˆbKjÔLí¨D8ýÛTøÚ,¯QÚÚxKìÒ +\ +O"¶ ‰˜Ð¢m5_GÖiKo4>ß ~Û»‚×+#qïž)µ¥;̲š@ã%P"e…|î•ÈÑ! è \:y$ …ñkÜøO ¹¸[‘%¥KŸg"oå<n +ÚGdÙ´nà]±›g9®E’$#;0£*‘eOÖ@7¯&4:Œ…4“*-#¡"”…Óh-'44*~¾m(4Ø­?µ)N ÷œ´’³?T–NJkf*±/ô:§ +¤ù@ÚK/òÒ›­]ßVLM”¸„˜¾fÓ Aô§Õ/Éóµ£ní6i9á_ƒHŠ0pVòn¤àTËËÞË–èeAÏÏaà|¸Ï›˜¡]phÚùèrê€4ÃÞ‹ãîÖ}cX˜2¡@HgAäøÈT´;LX;BšL³]Ü-š¶NÛâžü6ûpv-÷8¹Ío{O3ô¹° fƒ«ZîV6¬„føq%’öV{ç Ã ´·8~F Ú×s†#à3-“*‘Šàm +~㡶…h ‘#4 Š‡ß ua"3 ÐÄ‚XÄJ¿¸­òan9òñ>!@'ˆqZ„ÌwöVÅ~Âr!¾of_fRø:IÏÚtÃÃ"8»Ø†üTÁ]f‡ë¨Dp¬öE°4Sö97Ú«Ÿq‘m©FÌ€”g¯{ï{–.ðýdzßaô’û?½»bbvqDûÈ#GdîµæQÔÒöÕDÃ@ ² ƒ·­»2mXÙÎʼŸød{ØÓ«ºBÕÅ>fÛ­ +&)©lW˜?¥ðõáâ¼lk·ÑÞþ¶¾;gbORiü?eÒzL¤»ZþýõrquþþŸ€Œƒ€gÓÛ…"ÌØØy™îlp‰uaba|5bÚ›m±þÃZt9ÐAMgGЗ(–[S—u¾á0˜—ë¼™8WúRÄ=*8²o¥PÁÓ&P|Ÿ±¡ Bãÿ€_HÈgñÉXþX±S›*@ì$h˜’“·¦ÇÀ¡<Åζ¥ÉÛI•W©\ iîªç¯3nŒ¼øCñgZgn\ªÜŠ‹’åßl¨±×RUú«6ÆÜönT3AŠr,ßĘ¯Z"ôº¶ƒ€–M²ØõÍý<Œ€U總;æñãÁ±"ˆáÔô Ö?–¤?ì‘IUj=cÊoêñÒƒe=ù¾ç¸K«ã4ôƒL¨CdÀ‘99~$á[<3|¯ÒÀ —üå×ä,þó”¾HP—>iE§%^ +üúIòc eÙØ…’"m-oF"¬trË3'¢‚PÝ3Ù¬Ekëœ^³V;Dd7`0ëRòÌÂ8ܸÞæt³†`#ÇÒš}6z ùÒåÝ·n~,†Ÿ?¬Èp—W€IS°;ÛXwh„èû54 ôÛl{#FñЦ² d¾v¢y,\ÞÑËÏØR?ùÒ9;´ d‰âfUÙ_¦S»ˆÚ ·oHƒòü¥Ô®Ã3·hýöœlˆ¡r—ÛT_3 Äzú“'§ÓQÌJ8Âr…W ±ïÒZ +¹îc@)YÕCÈÍE†=}Îm¬¢§‹ûjË]Õ´ÜBcb€ˆ= i°yÈÖÿÝ•.‘l)šXŠC‘Éîú€GTõt«©«}6&±ÇÀjS5>Ÿ.Ø(&@|ì= È= E +½%*¦ÒuÍ`Ï(›pù‹áSÕ#Ò,ßæèÈŽÂþË7‘ +›ª¯äÔx(@ì|Çî„tOì½åëYó$äŽoP¨÷¹ÞナFŒ–?G>cþ‹ŠS ižWœØ–è®)^ìÉ; 'Õ—.Û7 ìQz Mâd¿€­oSv)Ü«J’}ÒG2ñŒçRþyô?#Õ·¥œüPA’ÇývUmÏtå@UÕö\vEå c/AÏËï-n¢²&Ò 0T³`Šü*.n`ñÙÀ‰q­3HâC]™#Ô†*£h„8éžOmþV>E<œjñ ˆ¯¬­ããìq\7²î˾)ÒÈ@ûa<0ÒÿÉ à±Iè +t‘¾rÕâm"[¤86ú‰qל*Ú²„‰9²†·[ŒÞ‹8ŒY·´^ÕÕmÍú|—kþàiB|º?œ|QHJodž-®xîti¾â¹!݇·¿ÛãX‰§>5ΛÒ{íMQ÷шœuMz§q°­&rdäzäëYÞ®ÏH^ët?UiÒ6.!ñéTÆ-t_»¢ÍÖݾ9s‰õKÅq©B‘$γ T è&àÛL÷ļŠa#Å„?úV³F \û€ÓOBøæÛÅúcI±±¡FcõwÄÏ2–G)azBûŽ÷"íõY‰ît»q¨(ˆ C0lP5ç7§Ñ”Ö.ž.Òƒbœ¢’&xOZç4)ˆÙ÷¥ä™?ãìÇö¾Æ)}àCl"8H;q·Ââ¶ÞQ9Ô)£½DÃ:‰™9ýŒpeÏé—rºkó W÷’{8$ßá]ŒîW£ž&_½'¹±ŸÃ1îÖØ`‡ƒØÓ}QÜí[Kdçè[ŠÅ>¤Ÿ´ÐÉÚ¥ B¸jR &vY¡Ú‹Íá¤RBª1رrÃÈʥŒûå s\.6ë)y:Ì·4ø÷º²Ñ¼ÚØjÁÈÇÙ¤Õ=ÔÂlx´n¶]]>CÙm5ª§èi-¦øȾøXð*ñù»ò´èí.¦rçeu€@¥´sTt}ßà÷ «•Ã'ø`«euüƒT±í°nÿ!ë±å%ÄAß}EEʪÑŽ¶m8¤JÕ›R>ã<÷.¡mŸa3PÖ¬tnaÊÒªº^·«*\{ÌÓ…eÁ_»ÔVgQfø{ÛåM;И…ª !A à¡]ºXóðÎaBì<ßá W(ù[}ŠÄ*|ÁS¨Ó¿2›MnŸS$ìõhá¡®œ‡MBkr÷ýGbôþE€¬câgí«¢úZæ*f˜<÷òÁž­ü­Ë)¸‡/½siò/T,Tÿ5·Ùág«›¦MÛn +ˆ‡qô_“‡ué}¥"D"Ž’é/òöÉß÷×j!¿šºArôjG» þëedÿendstream +endobj +5674 0 obj << +/Type /Page +/Contents 5675 0 R +/Resources 5673 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5678 0 R >> endobj -5446 0 obj << -/D [5440 0 R /XYZ 85.039 354.738 null] +5676 0 obj << +/D [5674 0 R /XYZ 85.039 781.388 null] >> endobj -1378 0 obj << -/D [5440 0 R /XYZ 85.039 135.061 null] +1326 0 obj << +/D [5674 0 R /XYZ 85.039 732.512 null] >> endobj -5448 0 obj << -/D [5440 0 R /XYZ 85.039 89.987 null] +5677 0 obj << +/D [5674 0 R /XYZ 85.039 698.372 null] >> endobj -5439 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +5673 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F20 3021 0 R /F35 3036 0 R /F41 3054 0 R /F80 5161 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R /F81 5323 0 R >> +/XObject << /Im14 5646 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5451 0 obj << -/Length 2932 -/Filter /FlateDecode ->> -stream -xÚ¥iÛ6öûü -ûEjY¤D³H$mÚ)rmfºý P­±µ‘,$g2Ø?¿ï"MHÈÇÇÇwñ´šDð§&¹ £¸˜d¹ -ã<Ÿ,Ú‹h²‚•_/”`ÌeæἸ¹˜¿2éDEa“›»=&&žÜ,?/{þþæ—ÓYÇ*Âé,Ëòàåï§*¸fèûWoo®ÞþŠ³€*øã=.¿û0Íãà†‘®Þî—Ÿ¿yñœgqM?Ýü~ñËãÔñ\ÈæýÅÇOÑd "ý~…q‘O`… -–Û à34I,óæâúâ_Ž¯%ÞuN+&ÎC“ǧjQæŒZLš(!µü'RI¢TÓ™ -@)¹QÁoÝTçÁÃTgAõ‡´ØÖÓ™‰â`\óŽ$‹‚Ån “1–08ê60¼„´ÝÀj×—#|kX¦%7Bê3Œ7|öÀŽhäÁˆ¼<àJÇ;ûª)ÇjÉ<·î+:y¬a²gz`Œq [npqDiºm -œ)ÔoA -Y‹ð³8Kƒa·ÀÙg&(èqÓ‡ºixýv:ãs\îgìZä‚¥&þJTvóÈ8‹¾b)hêlÉ”xŠÂÜ–õÆÚhiÏø#Á‰¯yt‡RõLω£èÂÓ ’¬ÝˆPÔ~ª¢W÷x>Ü4zÙ– €”Ú6µ¥UŽ5¹Á€Ë hÍDV†¯e»uNw >•Àåë÷âòþ-nÔÁœ°ÆÅ|‹6«ƒWã½Ö`Œwµß#¼šÂ±]ߢéqùÅõÏÀ„ -™ìk"»*¾¬†D¥“ºU_¶è? ù!° ºš%qx¿«{¹€á®Œ«¯õ0ž(6‰ ögø–üÙz ;µmyÍ¿0u$o@M‘K¬„§¼ªgئlÝÀ£lUh7€ÿâ9g,ÞWw;{·‘ ¼ù}ÎA¡©‰ƒ7èŸÅ»’(Ëcõhqw=ðw`Óú¤u°ršã°C—G¨Xk#~[Ö¾:Xž²G®‚„)ÔU?0·¯0¤“N`eY‘f8£æ°Â•ù«T{±Tea’BH&´›Å©Áh8,C2w¼å0üBŒ†ðË[Ê z­Ê‚å[Kˆ%ˆèjÆAÎ^zXÀ@×QYìZQ“øÝ6ϱŽ‚¦¶fˆU¾ÊÆô²×röÝ a¤ŠV§T1ýwƒû¡†f*JÃ(ŠõHÁy×s’‹=óÐ)÷žòiR¬Çíå|Þt‹²YwÃx™Æj¾ìP¹›‘4®Ç¶9f/Ñy˜íØ;JÈç„©8¦„L…O)„.£ŠoE¦aU…†5—ýS†I’ÑYPé,€Aј(xMö3]¨z´¸|ô‰[tòF€<ÔäF0ÂRã—t È«žF'¡ÒúÛÒìqž¬eL¡Ã8âïºlÑÇn)ºFú}IÑOÄÈ©ØÅ;ÃE Ù™ðz}[° ëzË»(Ne]ª™pvtö¢ÜðàÖ’'(ñv[7^6Gš¬J¡*q2Æ‹ ãÛ¾DvÏE§Ý–ÙïzŒÂy’oÀ±ÒÉ)ˆä -3Œ ;ŒeÓxÙÖ%bÙÚ!㺖5ÿ„¤ûò¡¼mª¥œüÞ« kYÝQÔÈá\¦à -Énf3rv.ú.¸|Âh^7X'éÄØ - ãÙUO< -EWtû|×3†ÆÊ`9†NRÖR4—DÚU™àÝïZt”Í8–AœÕilcž  Åq°ÃȆ4Y^U~Ñ$¨…¬ç6$ÛÀ[Q1N -“†TöÙQÛEA¹âqtŠ°¦f…`F -‡*øPÚà몯\ŠÛLJ®貆Ä»ਮ©Þ05*‹0ùúìQE -ßGRì»ÌÒ+t›ž]ô‰BÔ±Z …tGˆñ§‡1‹¡";±yœ(º O 7‘Vñ6áÄW'¦ÙD?Y½!ú3þ¸æÇшé×_â—+ðÇW‚ÕÙ£-~\õÀǹpÛÖ€®¡²ûow‹¼j“÷;Šz…á®"O‘µŠëmrø8xÇåHÿPÛºOÃÉ–d+B’P™”ÊJ`A¾~t¾Xµ ú7DÏ-^OG‚Ét‹°B^RW'QªlÎT`7cÖõå4ÖPáœÖ]q&¹–º«Ûº4ΠIåvIí­ ¾Þ¬(!fÁ;A+ùóš•îù•!$æã@‚’Fã<ÚÄ`¿ :‡8Ó¤¬S‘t–…i¡„Õtp*Va’ÙÂsGÂ4µkÄ2ñ›Œo’ë)ÁJtã3nÓ¹ð¦ÊYê^,ËÂêß›°ik–BCcÍmω)»4‡“mÏþåRO¬u@ -‡ÅÀŒ+ï®ùK-a9‚EZºbÚp䀥šJPØM Éf1²ý`…Òq¥½&Ð+¹óthaYû‘‡ð÷{KÞ%¯·ü?™˜Ä±«¼dK”œ°'Æ)wS]7þ¼ -ÄBÃÒேu½Xóxho— ù·ÃÐ@n˜2ø;ß ý0æg±ÐzÑ×$Šô2Š"äòŒ(°sÑ?nÇîoqÑbÊoŸÂ‰(Ôß ˆb)+?Mùcÿ>¹'‡Ú¿¡àTä˜BÝHBºmyÜá¸úL šû=_”‡Ef#ÉOg…j;ƒ-Œ ¢a 'éÝÜ‹™wÞa >¬Ý‹˜.üö½1jYq•#ír2y¥.ˆçΤ“ÓQ˜©ƒ§Zè‚h“úõ–±e!Ž_é@º•¸†Mî½ö’.å—"¸ºs„$‘Áì{U/Ê}±•ízp¯Ÿm¯‚ðgüñ ê“Ϥz…"'º [ÑøvŽ¡S/bå:uÌœyŽ¡‹òb%S°|o„ˆ°Ã&Â(jŠ(®$ÁPÏ„q™-¦Û–KcÉèTLaD –+d´Í,ò]m :T—AÅœI‰¦gÞHÚJ¸îûK&~“sÆ-ÀÎí–ܳCÇÒÆnDª}9|]MÈ®Ç>ë‡'š?(q¡ÝUãQ\áKµ9û(Žaj¾ BîSthWtxÄèÉ×n*•‡Ð¸vúò}ó\D!xïDC’Œø¦Ü@Cx$ž ©4 ó˜úÖÉýD…QR1£xcbz/ æW­R“Ÿ;`oâq(tganˆ‚“†œ™‰† üº÷©Û5èX†«¸Øh/[ƒël¸÷å”=P*…R1O¨˜;LoÊe|ºˆ<æ2¿Ä‹Ì¯OÆ PIˆëìøñÑèyø°Oì\Ÿ`Kôùbå¥W¼óƒ0b«ª3éØúðRœ’ߪÅÑm†Ç±¼8b…Ç;ìÉèóä8kÃ#©ä‹\üYD~… *_ª9‹¯„]$—¼©µ†+ŽúB˜—MØ\0ÙÞh ,ÛÆsÝ0=gòV둇ò1¿.í‹ô7¸êä7îÞ¾b§žÁŸõ[$Äv2$YaßqèT‰1#ïhwôÔ`6Ô;ÿP!¿­vè0˜Ht°þ9*º÷Uìëj*;r bÞl;Ûù& -än÷ï:d2 hãåt–BKïé·Ö‘7ËžaùùAà † P– ª»-ý8B¥>íàWï„Ñ¡ ef†/½é~{KuïX9@9Sv9Y[þò”2ÿª‡k÷hCè m'\úÿ´ùp#=äºß_`|Ï»Õe…„’ÝG5óÉKgR˜P%éÄ‹Äß×1y¨÷³éw%›ÉÎþú -ÿYåßõ#¯ËCPµæñÆFëPC*ˆ£P³‰µ6Çj´?3’ÇðÿQ•Xendstream +5681 0 obj << +/Length 3731 +/Filter /FlateDecode +>> +stream +xÚÍZYÛF~Ÿ_1ëÝ `qH6O¿9¶“8‰x&qŽ8%C‘ +Iyì`üÖWUMR'X /‹Á€}TWw×]Õò.]úó.“ÐqMz'žc’är¹»p/74óÝ…§îeà¸Qˆ©on.®¾ £KÏuR7½¼Y3ÈÍêÃìÙ÷OßÞ¼x7_cf^âÌqœÌžýôôzîÍ®_>{ú¦‚Ù[ê¾{ùúf¾ðf/_'ð€ùåíÛ7˜›'fv3ÿxóÃÅ‹›ÑDgøãâÃG÷rEÇüáÂuLš\ÞSÛu¼4½Ü]¡qÂÀh¿¼¸¾ø¹Ç"sÁ¥¬š¸éÂB,¼ÔIýpš Ü>L{zø4ìÑH8¦‘€ˆàÍ¢Dº³Ônp馞nš(ž½ÊÛ6ÛäOæ‹ If¿{&x–UÀêÑlYK?_êÀ½j•+†LFW-hß]ÏäM^u2ýãÙŽ&r´MÖw̃75ž“xÃM½p‚óo*¾ä3Òža:û2÷“Y}NÖè(.B—àc¬0”Ìîí¡»­ÀÐW°Dî쾩x£«™tö+Û¨°UG½"+ÛÇB +‹¤‡6ìÒJXkÁºãSgU«Ûëp“ÞG;º\·ÕFÛþu•(Ë J™2õø(,覾¨)Ûdl«œ3ŸCƇUbÅNüŸÙš*¬t ßfY'k:u‹™ìøBGŽY#ã™|úñ™ýus's0àjò£+뾟ʧ8$°Æû៭Óõ‹wdìо)ªî_“ÆÃg †É=Èx±§>™B:±o­gÑÊy—õA¼oý»»(¦GbfõÖ„ƒg6aÌ~ +tîX/³¥õ¦õ¡5Y#»¤.Ó€cG *ô!JcÏu]®Æ>”†ì²%K2c¾F©‡<·pcU#6,QoU؈KB‘3û²lÎBŠ"¯ÀPÐç†îaP\ëRXsÞ@¾Œõµ½‡1á¸`EK=ÒÝ$HØžœ\7ðܳÕ~VYSJüsÑ 6Ò;34Çt·%Ò[ø^¡»ìN¬Akù$1 Ù„B#9~ÞŒã 3Ey1/dItáˆö˜OÏ‚¼²Ý¡Ýš‘½> ˜¦HûÈ‘¶¦Êd'±8nêÂÜTí!Ûú>X$ 稡¶¦›‘©þ÷< tµ?ØM¬ÁmÈé·Øä–&XØNwi%Æçž9Õ›)LKÜs›óçNp¬9ZØ)r‰·NØ|Mô£ßfF÷ñïŠÝ‰É¡… @Iê$Ql# ÝœÛVÌ)»;´&' Ff )”ÊÄk鎡¾•6jìêF£ÿ£Æ˜AÀws-rGèw2@üÔ³Ülu“eYŒUáyæ8¶ê¥û}øÆ<ÂäóvKL |E/o8še1Ïor¸o?X 6‚Y'œ¶¨-ÞFo9 X!G-ę̈©(ú•™tÙänÛ*¿=Hz†©r4éMYÁx_î3ÃØäçlá«$5!‰”¹ÀÀ—§‘“Ë“$øi8»=t2ÍÙ¶3ùô’ZmJE[jçü$f«ä'¡³õ†’‚Áxº¬QÌÐW|X$ô±ËZA¶l‘*†9×)Ö%ÿAù”YÄ ;«uvL¿"‘f¬á4 ‚tyÎ'á06R¶@p»¥ \h8r ‡!î·Eiµi$˜êíÚõCg×½F€¬{2å7˜OäÔÁ'2K0Ì jkØ@+u`SKÀ`'ú`¹ð•6Ï ^Õ옾Êj¤ÍH‡d +Ý‘Õ5BÞÇø§HŠ~еT­‹äðXÌF ÍáYvI@Î p_ØL^k!˜¸Ê#j¨Ä¡YèWœ¡Äìi8â:Íõì 57Ýi§Jãÿ9Ùª* yŠ!»¡»½ ®ÚÈþ§t¬3"²mšóë/3uDãFSÁ‡¡Ô•7X× ;Ÿa¸­å|÷¢f@ w¡9!êB9‹)IÈhê®7Sù^ñwk¶_tõb•uŠ¡™j´çÚXÖ§{XŠ#–‡%æﾟ™½L(û ?ª|œfuZ›2£dX µÜ§îŽC¦!&@ŽV0V¯mµI㮼· >i|I²P=”ªyiìx¾÷@™Ð'oÿoõÐPë¡7sÄ:w¨…æâÌŸesÒ¬F{ïàðA+)ë=q‚xínK1çú¼±þ“­Š~[”yû@­3øµÎ^Ý‚4±.t]˺еË¥“îzVîr&~‘E¬‘C²½>ˆm v%­^îx›ÌŠ0z$×`$öÉTNàP# Ìü:«$æY[p © æe]m,Uy}­pç"¼çwÅòPRkzélÕÇUb³çºÁì9Ûž¯q( +CIÇׇQE5´Õ 4pʲ¯3ÈØB‹Æ8cÖ!í´l%‡î#‹,t×*ôèká´7TK?_½B’ÄlêÅ„‰Ò¢CæM¥Ðóà~\üãÕû—¯¯Ü«‰Ø6 ©•ô5ŒÐã#P* ª>|Åóm“Èñ¸¢DþTâî9&‡Ü%²q8÷J,‹æ§LêS^ + °‚§6?¤tæõÍc™ÜÔš\¢Jà$~zJP­ØO–;Œ$gt4þoItåO‘ÒsÊË, vü 2Û0¶bN2ÊW2À©-AÞs¾ë~¾úí­dVcyy­ìÂk(LÐ Ão…Ý’jiÆ@†'Œ‚#2WÉV‹‡Ò@^"úðNXÅ‹Ž=‚AÐd5½¿`/N7ö ½™&}ìÄ©%ý2«ØÇbŸÞüádÇ”7µá{Fy~}#% ï$ŠŽèò3ÐìŸÓ~ND¤ý4Ž2¶VaVöQLê6Wcè ÆaØ*]_’âzkÊ +¯–rAövUºm¦¨· -j™Ó€ÚCݽãÚ„MfÐÈ–ÝAJÈùç¹Áp^È}°Tg&sœS^®H\ + Ø—Q§ñÅÌãÁ=w2±æ"ZR„Gˆ ÇOR2|ýòÄšŸûò/20”•‹U.x‹)KGùíÈf~E¦UŸ2ìÄXHž¿yý4¬ýÒRæd|nïëºDƒ˜NaB‹¦ˆ7Zòí»d]O­tì¼±o(‚G°Öž#¬[òÂ$ð·y. )ê©S“2Ö,³}ÑéÆËœ2½¦}¬ò/8J†ÔÌÄ(ä[ð~—ZE&æCw¸3Zêó›Æžã{ö}i)qõNëc!qÛÉ–×"ª\>ð¤þ¦é-¿W”º¦¯üé˃íŠÏùJš‰†:[8”šéXÖêõ”HtB_ªn4Ïá:-ÕJäÂóH<ïˆL¹ÔóPÂG‘H³jÉÐQÂPÛ|ÇI¿a%ñ£Q¼NQQ2Æ™¢Ü"Áñ£¤àYê¦=z5ÀÏ—Qêøý›dƒlDˈKŠn%ð5þlêE0t¸/¨I…NØÄðÊ%wà ^‡ýÄ=¾ ó7“üZŸS'Mýô¨žÃY¶Oè—òè&bà¾è¶ÌõNú™öÉ3 +UGY†&Ïo*€RfÝ虊R'WRáíP/çdz¸×Ku5S×2†úµž!“ÏPœSÔGXDyùÈÕb¢p?x¬jùfû}S“Wfba@¬˜´5Fm$ÎØKÉáDtŒ û}aUŒ¨ lnšðÔ÷’Và ëC$ÜB%b¾öçl·ïÃu.3›q™Ù×B,9 <>½·^i¹–ù‘óábùPOé“%€‰oµi-5>ÍCÊú›á­”Ž8vÉ,Q‹wݾ?ÍàÓŠF6ÌóD…Ží`<®5òS'³vôs öÓüBÔlxˆ…«ÂÚ‚e= +I¬÷‰“ÁuçG¿v~_Ó +‡ã…j´å0u[h™„@¸0=Jš0ã˸}mBÛÈŒ˜Ç®u&ÈòšO<ÉCŒÑ?ÆN⎞‚r}–Â(jµô¸"®ar—FNèÙw€çù>¯VyÕ­mzšYùÅÚq<m­å’—ò‘> endobj -5453 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [204.407 665.788 429.761 677.781] -/Subtype/Link/A<> +5682 0 obj << +/D [5680 0 R /XYZ 85.039 781.388 null] >> endobj -5452 0 obj << -/D [5450 0 R /XYZ 85.039 781.388 null] +1330 0 obj << +/D [5680 0 R /XYZ 85.039 761.463 null] >> endobj -1382 0 obj << -/D [5450 0 R /XYZ 85.039 651.519 null] +5683 0 obj << +/D [5680 0 R /XYZ 85.039 741.134 null] >> endobj -5454 0 obj << -/D [5450 0 R /XYZ 85.039 617.077 null] +1334 0 obj << +/D [5680 0 R /XYZ 85.039 407.857 null] >> endobj -5449 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R /F20 2961 0 R /F38 2997 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im11 5348 0 R >> +5684 0 obj << +/D [5680 0 R /XYZ 85.039 373.717 null] +>> endobj +5679 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R /F62 4159 0 R /F80 5161 0 R /F35 3036 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5457 0 obj << -/Length 2589 +5687 0 obj << +/Length 777 /Filter /FlateDecode >> stream -xÚ­koÛÈñ»…à/¥€3Mr¹|´8àri.ñ—º±ƒ¶Èå%Ñ"cŠdI*Žûë;¯]Rå Ð"@´œ÷ÌŽý…ÿüE¢]O¥‹8ñ]•$‹õîÂ[laçí…/W‚r5Áùùþâú-|ÏM½tqÿ0ÒÑn¨Õâ~óÉyýîÕíý›Ë+¥”ã§îò*ŽçõÇÛ¥ïÜ1ôöÃÍûû›÷oñ+ ï|¼Åí¿}X&ʹg¤›÷ãö«ß~~Å_Êõ–Ÿï½xso9µ<W)²ùï‹OŸ½ÅDúõÂsUš,ž`í¹>lï.€OW‡J¾«‹»‹¿[R¼.øÔœV ÆH–úeÍE¾FÊj.€]ßMµžjN{®öBÒ \þ»ÒÚsîJøصU¢G±Óã×Ê]7õ"Ô¦ïäÃPÖÛž!ÍRyNÇø¯I¯wçÔ&®§/ 0⾞1½¹*"þïÑzÍò*ô40 ¼í‘c\ì²eù1ü`Ê)ò.GÜÈÁ­ž—Ck‰ÒhaQåøŠ¶PY/ƒÄÀz{… ÖÙ@Ë ¢†L*ö-Ÿ|„¦FwË vV¨÷5b5Hé÷†H!<[U9ƒVY_®™Ï×¢dÐÝ•Þ‘’6ú} ×í¦þ|ÆQ»©JN6NcqZuä´êÄiñZð|5gJß Ý8‰Á”®Ž£)Æñ¯5¾Ÿ¤nD‹«(NÀ²g¬o° Jüæªhb-YãÖþ‰‚(u£X/&7°cp^f瘲swÆw0¹|§ï ª8À9ôŽd•kEs2œ&Á}Y–Ôw=?^Daàš#ëÓ¶jƒ¬ú<õ4M›U“ «(g‡R¥‹Ðqd¡~d”g™öúŸ=P ,ë-Ÿ’ÃkÔí^g-©³]~ÀÀzß.'—±ëAª%!-û@€Ó|÷Ÿg®Z7œV$0QÞƒK^¡+ÝÎ+åDm†—_]jídxâºgO¢ˆ†ÿ§©®ûÌ:G6Ãæ -6(Ïiœ®ÏV“Ø{j›Q)*{…Â`²ùn3n÷y/ -iâssgžºrø.Öô‰±çŽ¿hz2ï;Ûì2e´kXÓÃüý“\µ11MîÙŸÉ«!T^OÏVgô9H¢þÿÖ(ØêÄ¢ðÅ*í‰Ï5²(1 }¨zôCL‹¯Œ´Öìù£Îmò¡faÁB09×Æ5CZ*®ÓdÆ”{®xˆb*®©^A6㯓aýTNx™ReHVÉÖ[4aÖ¥)šh$?倘ÆJ@¦ < -À¿þ"$êÍŒKÜ’Øýp·îJLx_¬œß=?4žŸý~e¡:fé8 ;Ì -ˆùâ|Ñ×3l]•9 CºÃ+òw Æï9ëWSržή酕æ¯1ò©É«ș7ç±½mω’X''>YÍÉ_7x ôDµ%Ä€Âd„ÔŽ °·ýȆCÁÅ-g¼Gá‰öˆóà@™\ ÝF˃ÜKžJjÆš½|7-e½¼¶.Ç2Þ{ûñ†YKµ¶\gCÙÔ ä0ôudráiJ9°t00 -@+‹’QâîC!¤â\¼†(¢ïãì‚° ÉƧºžaeÝàÏùy 畽ªÊ$.e‚埄¿i¹eÔÚ}šZná–ƒêÇ0cwÔ^DeD€m6qIà3¿ø×2¤¾¬#7K5g5Œ2!;Ï ì².¯dÍçÉ]Rvj•ØTðaZs\›ú›ñ±Ú¦²Î…Éu…Ü?ÊÕxâãû›Îòèĸ‹ñ#s b¼3ëЀĮQ)•Å]90hÛehŠ¢\Óy°aþM¶(çÁï-% X`•$’&Ø´1Òó훲3}Èz0 Pâo‘O8:l r4Èé$™ ø<ë*1Gì9ù·µé=÷}9Zl‚rŸÀ܃¤;Ïy‹½^Ÿ8ë¨W‰<´ÌP6“º<ñ@Ø;ˆšK†œ0PF6î†áT¼ÐŠ´sI¡P7¢ä‚Z› „®•ó›k°Q^td@i‡½ßk… M³C6D)ã~èr~§`ô+íÜ< "»ÆDühE0 —žž}qlœj:ç„Ž¬ñ÷i;É~›ük¹Î±”OÉ™Øõ‘<ÊŸÈF\ ð{¹¢­ü±=8ºR×6—g»sÊðÊùÀ-=C<$M¿)ŠÝ˜ºz®ó„ÀEªÅäiÖŸ;n()ï”òŠÙQxæu¶ï¥ëÌŒqÔ´f*©™ØaÚÂÑ”‚GM„{¦ƒ Rí¦:xq<2Á9;ß b^ÞÓùŽ’ùÎoÍ´ÓÉxrjKšú&ãž&9vRÈ?2õ‰»|l̃Ÿ˜?¾üœŸú@Q‚Gåˆ5âœmi¹¡ -H¬w4ÈQIÌVJ"òzøì«r[Pu$?ƒ Š¹F’*¢H!imgò§¥µ¬ñq^Á«|Ûfš³¤´‹nŽqkòX§9X–<åÜ Œ4ç×왟m^çöˆwf°s:;A}Û¹o0wè„Ô@¿ðP—àWÒHðz“c]ªs IÜ~î-Ed¸n -Ö“4êÀ“ć“2šd4£O¼À­Š{ )Ñ`Eh>Ü™§»¼jRÏéÛ±¬KÖdzÌàü¦6E>L‹ÁúL±-jŠÛ)«ó”Ëâ¾cÆ)Ų1Ñà¾<åRÆe+—k9AÃâ‰48ä†|¤;¶vùBYIФoN¹‚Âí܇!6tâ|±íšª†âW›fqè;mÖe»üpŒ£Óé ¡–£Â lÞñüÍN$h_Ü£1‰fýzص×cÄ´Òv)F>¿Û¦XØÚä•°6áÿ¤¤}¡™u”Æ®TocÈ|¶±jÆŽžž]þ8V~pÚìhÀ@zçøþ¤\ðÈïbv.És†K>õ»§=ö "!È—?Ù»yB!æ“CÛ®¡aöÿÂ/àíÞ&”Ù†MY‰™T'=üòõ:Ä,! iƒ”£Iû­!ËY7~•}Í…‚樠¡LÙ”5µ«içýQŸÖtŒÁ’»WXôä-šI—+dQsÓ'€Æ)2e¦§Ú ŽÂñÕËE;¤ÊÌ¿=ÿNòBŽÊF? Mß‚`2yæ•Õ!QOTÇ× |ŒG‡ÂúfÎ{tn˜RÂXÙ¿q ¼µˆì¿¶?ƒ½ñï]( Í¿’¼N•Áó/_„¢Þ ©´AÂëÓjb»Cˆ¼žñl[WP»  Ñ{¤Ü¶O7?–~#W5r.³ó&€ÿ(xxøÙøÄWŽ Zp\É,<,öÀ©^ªÖ&Íl8×­)Ï ÒùiŸú?Mû”›¨3c{nà^õ ˆŽùÕ*qu¢Nþ/¹dŠendstream +xÚÍXKo£0¾ó+8ìðúÁô–Òn›*Ͳ Ý®Ôí“"‡i»ÿ~mH"Ú’®ÔÆÑ*J2–gæ›?æ“‘ 噌H|ÓcÆÌda@s.gÎ ´Ö€¦ KÕÔqd|ýF]AàCߌfJ”ÞZÁù0ŒN¯6!ÄB lÏcV0NÈšŽ‚áXM9V(‡W£I4°‘5šœµúJç: ¿«¹#V4¸‹.ŒÓ¨‚íÇ%*†ãöš© ó€€øÌ|’2È÷Í…áP¨CÖãܘ?¶^Ú9Çl­z2µˆ€/ílcÎ6eB{R>)³G^lŠ©5‰ü¨oƒX,E+gWŒBØÊá”Ü©¼T2Hâ7^†erŸÕ<©WåÖÃM&ÒåSµvµÿÏÌí³ïFÆõýÆÇoDõ•q#*RâÌDýEI7ÿb®’ˆúIDEæ Íó ´Åˆëx–åü£¾Û2Tsð\¤}9K1ËæŸAh¢_eoâ_œó¼ø´{pŸ[çØPn¢¦:¼à"å¢VÕG!âURä‹I´k ö²J*‚‹]UÚF-r‚õBÄ«ªJËG½ rÍ‹4ÑŸH\Èm×ÚÖ\í]zz Ä”œDÔú &ÇÃpNÆc£0Ð ‘ÉcÆŸæZAÒªÈ߀Ðýbð4«5ŸÁ"yXh¯•*•Þ4f™àº/E™HÙwÎ÷¹èZÒm…zV]¡h½Ošž>/_Ô«ÓÕ/—"«—¥è»Þ²ÎâU^Ëû;®ÿ¯4m‡†¼nCΆ¯u¹ÛHÌ–­DŽëq'ñŸ¼¬²¥Ø àñÁ¬T²1h»p5¥ÿ 3Å»™éäãÔ´q>jj¡‰šb½Ô¿CM÷tRˆáuŽ/%5ÕÕñ!H>©Ã uø¤ë'uX?©ÃúI]çˆ/Þ¶W+ Â`ØŠãXÌWñœ·£µjÿÍþN¯é>–ØIjÚ†#§ÿMgíøs*ĈmƒÜ¼– ¾×LÐë@‘ ˆëH±à_ší^endstream endobj -5456 0 obj << +5686 0 obj << /Type /Page -/Contents 5457 0 R -/Resources 5455 0 R +/Contents 5687 0 R +/Resources 5685 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5438 0 R ->> endobj -5458 0 obj << -/D [5456 0 R /XYZ 85.039 781.388 null] ->> endobj -1386 0 obj << -/D [5456 0 R /XYZ 85.039 761.463 null] +/Parent 5678 0 R >> endobj -5459 0 obj << -/D [5456 0 R /XYZ 85.039 741.134 null] ->> endobj -5460 0 obj << -/D [5456 0 R /XYZ 269.675 691.919 null] ->> endobj -5461 0 obj << -/D [5456 0 R /XYZ 85.039 461.055 null] ->> endobj -1390 0 obj << -/D [5456 0 R /XYZ 85.039 295.952 null] ->> endobj -5462 0 obj << -/D [5456 0 R /XYZ 85.039 261.206 null] +5688 0 obj << +/D [5686 0 R /XYZ 85.039 781.388 null] >> endobj -5455 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +5685 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5465 0 obj << -/Length 2375 +5691 0 obj << +/Length 1160 /Filter /FlateDecode >> stream -xÚÅioÛFö»…`À( ,iÎ ‡G[¬¤Ý­ãM]ì7@i‘¦hS¤JRvœ_¿ï˜¡(‰²d°†oÞ¼y÷13þ‰Y¬=_%³(žŠãÙ|yäÏ -ØùéH × ¸#œWWGg?êp&|/ñ“ÙÕ톎ö­fWÙµóúç—Wo>œºJ)G$Þ©E±óú·ËSáüÊÐËo/®Þ^ü„_…óÛ%n¿ÿp+犑Þ^l¶ÏyuÎ_ÊóO?^½;zs5p:ð\%ÈæŸG×ýY"½;ò=•Ä³GXûž€íåðéé@™ïêè×£¤x/˜ñ©)­X Wú^$åþuQ™ëÔÎujï:æ -àYMÝIOÔïéHvÖ„Ž<Ã"ÒÂó“Å„YÌbY$4Ù›O ãtyê -g«*g]ƒñ¤ßòû]•KyB&³ÑM{ìXœçÙÙ¥„ì¼8•±“·m —ge  樨`Ýܤ»8•ñ¨.Gæû¶Ëºèû‘[Fhj# -ØM™8=jw… ÂÐS ú áöÝÁà>/d{"šE"ð’8 ¯‹ª¹A­Wñ~rt”„vW- ‚jèQ uÁRüæÈ÷à«î…ÃótÅGêti`i¬Q[ç5¯š4c” Uá‰1•'²î ”d4òz ¬À’‰tSÏr¿%¡ð•[£å+]Nó5¡‰o]léîìáTk'Å#g{<°ì4ð7všê¬ƒ8€o²ÍITû 2SÎ_ÒÄF§Å:ïŒ<Íý;|lŠùǶìÓ›Q8šÍ fŸ:wø¦ñÉÜÄKš-2æ´mXQý_øûïæª “íÈQ·Ý€é_w+Òn>/!rw¢MÈÐÓ´ÔžLôËù[y2šÎÞ®¥åŽˆMd@™x1+‹´¯vPWÅ^¬Â¯sS“Ž¬À¤›®&â‰àeo|t\˜k™Çz;¿q2üoøºK®Ët™5Ö×¥&ºæ©{øÒ¼dŽUœŒPFc/~ÆGMú2†Hël‹¨XPŒ/ÞÀÇ¿¾çí?²tHD,Fˆÿî‹`:'·ÇÈÌÙ*׬ ñ”>H¼ýð£l—5ß ýÐ`œõËÕY7¨zÕ¢½ª1šû+Ÿĸb(¨ŠÒœ¯o‹‰+\B3¤Ä–Žø S>ÞÒº'«‘©Ü[,Ýia…†P“âÿ-¬acò넽sOîüÎ=Aqßñ×gòö“Ï,úœ¿æ“âGPàÃà?%¾á«]ZÿâL#’Ѓ¾ñ‹ -M=•ü˜CåËKžÒù3ôõÿ¤¶Ü£°m?q~Ñt½ñÐÌ.eЧ-|ÏÇNÕçéà0”ÚN­[ú52zÙq¯FÅèÉL) ¦Ž¾­FZîˆØDŠ/„ ±H(Æ'LT¦ø¦}bSª@E„‡¦$¥%§:v,Ú ‰ø¶ -UŸx‰ÔÏ•ÊóAv ›4Òáh¦” *‘ Ñ¢‚A Š†‚‡´žç˜ùÃÈy^#³w±nÓ¾„ïiùexA,žen„³oKG'dFäîy%OAÎÅÝ ®³¼z}RѤxÀÄ@}®*^ô ƒ2ojSˆ -rKˆptüìÐìAL‘(¨*ÂîÚ4èHÁèíi["kOæ2Þ½µ±ôÈ`îWš oT<Îvzœ ¦ZÛzp‘÷D¥i1넉whT -ÓDüq@Â,¦ñ~ø“!»‰QF‚ISsBÌnZ:EJ1¬}æ#¼Ë•]Þ¯W|zŽûMKçwÞ[5 ÊÚ¦^æƒI©>l ˆÍW:GS72¦Y´+¡Ã*LßH-¢-šµmÜòûaÊWܧz‡‚‚=†AøÙ Üà )Bx ¤!1Kj?¥áT¶ö×yÝ·Ôy‡!õµŠ[B_vs—Ÿ`û¡ƒCAc!`¼Ô膊üÒp¸,‹…±8~Þ‰6gçÛo\{Ãrà‡Ž)©-6ʯGô]Ç‹ëŠ QLÝ ü€e/«œËž¡¥9H’–Tšq Æ=R+ì¹¹\'ãM°3Áhf7DïèAêØ9¯ºÂ"jß¹ rÚšÅF bM°!qð…xÓrS4p~ÃïkôBŽ‡¶´Éq˜;óÁ}rN²â­°ÈöhS$=nÀ!–µlÍ‘´È‰Z fýde°gùEVCˆ!Ã$/znÑ¡e§Ç cJðš~E†ÆjjäÊÊXZDIŒ]ü9Þ~ƒ@P7åa(}í1Œx:ÆE$àõÒ¡ˆwôšm ý‚QÁÅùþzÃÝ|Oè©!å¹|‰¾"Vú‚‡Æy³ÍÇOAuf¬*}§\.ðѪϱyQT$¾ËÜ^8!A'èfENˆþ…dhøEIª¾þ;àhjgÛMÞ†³“IcÃTjи9†[iiˆö¥]Q2ʇÆKãTWO¨ƒÚÚûv\¦E‚»Ì€Þ›Çë*ô?[5àw_ûüŒh[f×¾Õoõ„æ?$Ú ÝøÀ”s]2=£1¾iFº@y±J¦›-¥'…åÕ&e´Ë¯V±§cµÏð¿0 ´³endstream +xÚ­WÛnÛF}×W°nŠ@¹Ú /K( È‰£ÀqU[F $y`HÊ"À[HÊ— ßÙ )J¢ ®ýÀÝ™³3gf—g)b`ø'wfás‚çF”O°q žó Ñl8{®p½YM¦ï\Ï 80Vk YÅŸÌùûÙrõöʲc&áȲ}Ÿ›ó‹ÙµEÌëÅ|v!\Ž¹„éÕâreÙÄ\\ž+¼ÀÜ,—ŸÅ™¹²¾¬>LÞ®l9¾M>}ÁF 4?L0b7îaŒ #Ÿ8.C®Ãô<›\Oþì£(Ÿc¨U#•ÚÂöâ.íK&îHÉ‹5°¨yoQßLĘ™÷5Ô¶zÖn`¦ÇŸ sî,ÊÅœ˜u“–…ZNOÔó3&N–4 +±²¶as¢nD|]v¢1̢̙ƒ \!Öµ¥Ç)À˜"¢v4yhŸ#•yÖ‰Ø%±5D4-=é+†­®Ér+è´¿ªî{céM4¸Ý–šTb w+V×É©H5}Çö·Áv( +<_&®Ë²ýÙ²]êšMœ®×jHíu*é‹ ÓÁÚE>å#Ïá2@T4ìÅYi øÎp\fzÅ]Œ›[ôPAKÇÅû¦ã2Ú6U ‚Àw÷,OàÑ&«öéÃìJììf¾¼øx¹Bgð–qcóUr¸ª,O—„xpø=²—êw…ÝF £Õt4¦-2F{ˆ=-Ü6M\ß +ZF ­âH7C ‡–£RE¬°‚¦…í zgo£ƒýƒ¶w–cü¼¸fç(*Ú®í;Ã1øòÍl¹PMWàa ¼XÎ÷Áá¨Ju4rÅšÖûUÑ]šÜ£ä!ùÑv4nª¬‡â'@ßòBD˜gE´N‹dp0öŠÙÅ©Ÿî»Í:8ç#¬j|[:”hâmÝ%<q8»Â<0l×C.Q"r&õÑ7‹²Uƒ¯–Ýi;7×à,³N2cüdÙóÍ3©û}Wë{5nºÚ‘„‘Pšu¢®ïß¼O[íJã†4RÃLsK˜K)ÕIòP„~©@Ä’Ò/áu²Ó|H¤Sw +Èzì…*Õ¢ŽR`vÒjñ~þr«ŒŠªÍè¾à¯EÇʼSÁLhÒï8ˆ ï}AÈ;˜Ï] üðJ}ƒT?ŠÁQ*ÛO;‘v‡wÀoj—ZíÅU,»ß$Ãö4ù×(K¡?9ñ’ºñiU§E+V¾R^ûF=_Ïâ<-Ò¦­Ã¶¬y€¿×ÊÓ§Ùß;Rî“(Vƒ¿ý›{SÖÑLu¹¯Rm逩ç™/<#ÃRA·/õI\J;ÄU +›‡ ZK/…t¾¿X· åÁÞ¹ð$”œ(µ7W›­Êø1|Ô×4VOLO9ÅzF1¦cz}œƒ¸C‚ pø RÈ2ø.ÅÖySUˆL8v9uþÇJÆÓøÜeŽóÒj† “IúM‘Ikþ_[vð­îù>¢Ž7þcB×ü²/yæ#Âûþ=û™NÙEâÁ­ ¿†ÿN²&øendstream endobj -5464 0 obj << +5690 0 obj << /Type /Page -/Contents 5465 0 R -/Resources 5463 0 R +/Contents 5691 0 R +/Resources 5689 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5438 0 R +/Parent 5678 0 R >> endobj -5466 0 obj << -/D [5464 0 R /XYZ 85.039 781.388 null] +5692 0 obj << +/D [5690 0 R /XYZ 85.039 781.388 null] >> endobj -5467 0 obj << -/D [5464 0 R /XYZ 237.129 764.647 null] +5689 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5468 0 obj << -/D [5464 0 R /XYZ 85.039 330.546 null] +5695 0 obj << +/Length 3251 +/Filter /FlateDecode +>> +stream +xÚ­ZYoÜF~ׯä% C³Ù<½OŠ|¬ÛÑZcx8ÔšaÄ!'$GŠö×o]Ýì9dØ…‘¬¾ª««¾úªÇjÀ?5Ëb?Ðù,Í”¯³l¶Ú^³5´¼¿PÒ#˜E~ÄØôóòâÕ»8™©Àσ|¶¼§.Ëò7ïꟗ7Ë·Ÿç ­µ§2¾HÓÌ»úpy;WÞíõÕålŠ¼øü|ýi9_(ïúÓ{î}¾ÜÜüŠmóL{ËùïË_.Þ.‘%uøóâ·ßƒY jþrø:ÏfOðø*ÏgÛ‹(Ö~iùn.n/þegá¶hÆ£ÎìtE¡dùl¡?Ë"»eŸÛò§[ýÞóv–fiì]Ρ +OÅYÂþ‚8ð–›ý|‡±÷±xæð3_kõ:¯0BÜô«wÊ]j¡”Å1(¦ýD'´ìu Fƒå¶ó0óžù½ú«Ø?ž°¡B÷`P&^õh¥4>ò¶]/Êú[ tÕK«òVøR Ü:n +1 xíÎõä̵Ápäq’{W]»jöЉz×Î÷7™‚²0¬Û;ê¿îÀv©ÑuUôÕ=NÑ Iðð\L»;虧Þ@Ê6¼AÐxdñ¸aI˜gÞªëûãö}ͶèY{p-ê7°ì7)íU±šƒnüJ¼§¬“øñÀæ¼uœ£«D:ôÞtíð-ZôUóÌãÀ¬ñÙ ]»®©/·ŽtàôŠÖc_¡y+Y‡bøŒaP,¦ØÈ0þqt[/Ï2_…ê<-ÂØç°!‚Xù9ºÅ’<=ÊKÐ!ün‹í]Š$‰‡N¬`ôqÓ×툠“ Iãuàõã`t;£€Ž|M˜ ÎaÂW²\É‚¨cÁî„x€‚ÈÛõèÆxØe°®ãP†Y­£C¢È¬‹±’6~쨭ëGžÿɸ߸ávÇ…iy<)^¾êÑA• ªh™¸í°Ó%úù+ÈÇâA¤/ãµ:‘ÙžqÇîž‘íD¡=UZ¬öáf©^Ÿ¿0ÔK¥ÓOgfIýP™ö«_?¾ÝHý‚Uèõ… :†XœC¼_‡ƒEûêÏ}msàVò;m<¦àA™÷•Ö,ÒüÀM«¦væ0_Äв´J=sW:ö¡fC£(¥#Á&'ÝP¯5‹Ç®)¹cqG–ïöÆÝ3)4¡eç1ày¸TÜ1ëɼƒàµ7•,7ª–’U*W±qS§Lƒü ­9yý„+ÀQáñáyª-`Æ8GõlÞzc8üDÍñÉ'Öb’-³,š¥XÓ<°Ñ‘…+:çä w8ñURD>ØÔ1X¸ÙÍ ?ÚÙ©+ÿAòžf¬v,aL‚—ãD‡ô`eÄ‘—`Û¦@lÙ1gðôͲaêÀÆqYËŒC²K)›æŒ Çà’†Ø +xI’§ôì)夊_ŽQeçSQžûIœ ¸[j€´ü¦ëšô4!äŒ eÌ1áB=$"Ø:{ºx b*@Õ´N8GT!áŽx_1BðÖÔJœ”ƒz-ì +M]ð 5ݺ^Aò&™v8—ž™“æ¬ÔŒ\HÐ '·@§âpô ~#è %‹’ßÈ7›¢]ÕÞšŽG51{r8E<ôÞÞõ=;°­Â8÷, ý /ßÂ$0»Àó®wÍ$ww`‘!œ±¬·fÞr +*ŽÕêV沫‘÷8³ +öÏ U ÿ Eê3ï·BÀÉ …ÀV·§à0Èê¶ðÚ7å™x¥Üf‰÷ÐZèÉ0þ M²ô±cŶ<ÍÉ2úk‘-Àn6"a+ê'.< ®¤dZïa +8s¹RL=’ШÚývÇ.„µê¶[,aNJ¡¯3ÃÞ65W-¬ÑŠP4KcË2ÏV™†ã›÷Ó0=‹egL^Ür™å/ô{:m!þI ¸[÷Åvª…Ȩظ¶õ²XŒÝ@¬žãTWMAãB˜ ìD5™€Æ>ÀWΖOè 9l8Œÿ•S*•ÓåcW—6=C•t'GÅ¡|Ò®ªväÏ7d=Zx:ë#äH…ƒ2´?¸ŒM:G{€ãqZù™Ê¿_zÝâA1' ‰$Ö÷ñ}w» N\™@ Hí¡BøÚÜæò-;Ŷ +€¹š†%´Fwg¯&¶†'aúˆÊYî½ÿ@ÁÝ C¾ç(Æ•yÃÕ4ê}J³qb¨ÁQ}yŠä¿q$…Q`(TàPüGw'¹$Æ´³˜¢%@»¶Òå ÚDÖyßñÒdL@¯'4`írbÉì8ÚÒêFRÞ®å“þ–RP½¬ç‘å@B”ÈZ9q{:'SbLÇŠ/eU”‹ÁÞˆ îO Alñ+Òê".YN¢äÞ¬›,Ö³¸–f68+°[l ®œ÷BX:IÁðyx=Gì¸'Þˆ6Cº#¦\…µ• +„¡ƒ÷–¦ÝŸRß]A`¸·£ ˜’C¢  €o,g.i“.LÄjŠ6xÿŠw¹=ß(±„+6>•[³Re'¿qnçðû¶5×Ã<;öÉJW8Ï$U·<ìÆ  ºÐ‘wöbùC Õ .[—½¹‘k¯s8œtMð"ˆEYxÃ$Êä†sôt ˆtkDt€ôz»Ã[*ä¦#îrž‡D`^ô«¡Ï‚jš¿¤Nì+¥¾©Kª ò×w"l`áh :h!*ÕÈ;®ƒk*meLÁ/Ÿ®ÿͽ°Då‚®±÷‰(ÇóÀçt3œÞ® o×ðyY +•‚1Ç—(ûZÿ§èH0þÞaCÖ=qþ#ÂÎÞ ÓeXœ<êÞ¹#ØïZäEY  +[&XiÞÓòðjl•˜² ^Ш“›,¤ ©0ÜàØ[:Ð*9„Ô¯À­dtÖ(ï×Òáóûïü†±ÇÝëW¯jÔ\˺}¿ª`“ëÊ7U‡3¿á›Õøêä7ç‡úØv<ãuÐbÍô]Ÿ£*ƒÒ·“ú@’Úù˜ÜÝŠ1Å 1dßU³/rræ¸øæÎV»9 +Ù&²œ€xud¯Í•_i¾ +©ÍXò†•­³ák¸®Åø}6ŒS‚Æ*<8\0"fÒו€ÕDeú)SîW²}§¾“ºÓbe½¼¡œ2ãQ Ÿ+Ó¿´\{¢Ê#þ˜±Da +/x×D~\Æ5pÃh0ƒË¡‘¥5µ*¡oô*?FPÁ綞U‰Öµw)Ã.`š7ýrCBÕBÏMx¬$šø®÷Gµ:ÔåÜu`m:ñýªdYN¥t@Ø^!ïT™¨Ë§ƒÓM»ÎS±'HG7Áð®ç…¥2ÐDNô@esÃ:VxÑ3X•O¥|‹`Y« [™Ä‘)-«tºÉæwÖÇÀçtUÆÒÓÔùSù{}ÆLÉxqgùJ'ßJ”q$0I^©ãÛ.2aJ×Ú%=¸ÜÇmø‹-$¿§tôƒ¤lÈ…ÈtrŒÛzâq|iÀô†*;gÍž—©¤°ÑüvtÌ*Z¾æø‹õù«æ±v É Œá$Cלl+5õ0Åä¶5mlöÅžæ*X +Oã<Ø":í¹=EÎοÞcO-7¥›isµ?uãá¢ût§Q[¸ŠµÜ´[£)Ý»k⇙ZC&ßNj“ÄYsÅ¥ÄA-–©íåµ0/äkööÄ¥¬Ç¿„=áXøåâ,ðœ<¹¾ÒE‡CÌ¡»µLÌÁlµb¯Þ-ÆnQ¢ëœÚâ¨b¡ŠÇzuù½€¶ƒ9•\°Õçñšûªé{„Î •¹{k«Ó_fmºŠC?zá—Ù)ßÿÿ5C§À2\îð2Aµ>ÖS%¾N"fFÁÿÇ÷|éendstream +endobj +5694 0 obj << +/Type /Page +/Contents 5695 0 R +/Resources 5693 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5678 0 R +/Annots [ 5700 0 R 5701 0 R ] >> endobj -1394 0 obj << -/D [5464 0 R /XYZ 85.039 308.229 null] +5700 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [377.225 192.829 539.579 204.821] +/Subtype/Link/A<> >> endobj -5469 0 obj << -/D [5464 0 R /XYZ 85.039 283.678 null] +5701 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 179.583 108.944 191.272] +/Subtype/Link/A<> >> endobj -1398 0 obj << -/D [5464 0 R /XYZ 85.039 214.884 null] +5696 0 obj << +/D [5694 0 R /XYZ 85.039 781.388 null] >> endobj -5470 0 obj << -/D [5464 0 R /XYZ 85.039 180.139 null] +1338 0 obj << +/D [5694 0 R /XYZ 85.039 662.383 null] >> endobj -5463 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F38 2997 0 R /F41 2994 0 R /F20 2961 0 R /F58 3360 0 R >> +5697 0 obj << +/D [5694 0 R /XYZ 85.039 629.962 null] +>> endobj +1342 0 obj << +/D [5694 0 R /XYZ 85.039 409.338 null] +>> endobj +5698 0 obj << +/D [5694 0 R /XYZ 85.039 374.592 null] +>> endobj +1346 0 obj << +/D [5694 0 R /XYZ 85.039 279.182 null] +>> endobj +5699 0 obj << +/D [5694 0 R /XYZ 85.039 234.107 null] +>> endobj +5693 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5473 0 obj << -/Length 2908 +5704 0 obj << +/Length 2328 /Filter /FlateDecode >> stream -xÚ¥Z[wÛ6~÷¯Ðúe©s*šxSò”dÓÖÝÆñÆΦç´} %ÚâF"µ$¯þýÎ h]òÐÓ4Äe0 æòa5‰à?5É“02óI–«Ðäùd±¹ˆ&O0óÓ…Š™Ì<š·÷W?&éDEá<šOî>I'fr¿ü=x÷ó›Ûû÷Ÿ¦3cL æát–eyðîóíTw¼}Ã=FÓ?ï¹xï$u2€Tsó¿¿ÿM–p¤_.¢ÐÌóÉ3´£PÁôæä “ØH}qwñ/ÇŠçâ ¯:¦K1ƒ“Íur^s© -ãÔ8Íi˜Uá Ù;­ãÒSë‰çžqú^Ä$6anRЇ çqNçø7./ëeClxÙ?Ú -¶±›š¿TD¤˜©L¾#ñK”ÇN\¶IÃ,ñ¬úR¿JŽn¤ÃXiûCÓ¡n@ñ=ÐK:eÕÔÅz ­=Ï-šúHÅ0ð´kQPs sñ<ø|sýSm‘CUOõ<žâŠoS®×ñt±`M×Ș‡HKÀõa:Ó/XÁl±~äñF¾w`Àñ¡ø{ǨV¼wušEÑ×UYã`Ojmá­%ñœŽß–[w–i½3ƱB“Ã#uÊÁÑŽŒc³]ólkaÕï`d‹± ̓û•]\µH‘‰2‡¾è¾rëwGCG.}Û¢.ž„s¿v¹DyŠ)è m˜D— ÿUhÂ8…Š££àèúˆ*þÓ<ÈÍ€l«ïdY.¹‹’׺*7<ò€‚î¹Á -¯# CŽÓ\Y~0ˆ¶AªnàÒrÅ 7¨²¥ó^tß~§äö²“åø†ãñ ÓÀó`k²´üßv°§E/W{¨Ò¸6lÉå¶ÀõØwZ×ñ`å$q¬5iŽè#k·¤éªç‘Ž?mY,÷!mxϺò·-ÔÎEÚC¶[=–„4TÂSbàȆNŽÑ}>‡è.k¬¥K&¸sŽÆ\|CŠÎŠ|¨%²µ<"„Jy$á[ä5¹l°#­Îg`œƒ”iË…‡Êuå9m.™-÷Ô‘«Ö…Ö˜Bó²LŽê…’…y¬põ®¶b OFÉ -gþÙ::çF$úVQÚ#Ma­µcúˆ A“†›KÛDXPu h -ʾ®efWUÇRB©²#Å‘€-X Þ|¼—½…3çæ=wÆG\ʃ¶½/Ú°¡u°vƒ™Ã«§œÝ´_ÃØ7Ñ1¨*;‹}=š“Oxq8½<Œ¼<­3H¿®»)YL%Z‹á?”ýŠBs°ìx„gÒ¿€îE²sHNbû8Õá\ñÉGuªŽ¦_Fö…´xÌÙrqà 9ƒ`ëŒrP2£¨.Aœ\òEòQò]{é)åх͞цExD¯’Wà&„û²Ó3eë z‰¤{uJÏF‡¹žŸWô@CšŽ•§iÁ 72Ž#%•½ÜOEi˜'ùÙ -ÍÁŽ£»UJ‡lþŽvÌSŠHŠìHÃÐ×~ú7ckNm  Þ39±ÖÊ §k}!úÐ ,”}ÐÆD˜ÆEH|pë”cl%»ï³õRÞ âÒâ5a‡«A9ƒ"Lž†Yž‚îP¿N!Üõ‡¢fÒ‘Îf–v„=z4½Í&>¥_3š£tßãñŽ{ï4¶Ø@cm…¶¨ŸàÏàî2 Ug±ZW¶~Œ<äžäàòj`~„³JC“Úý_@££"cسö[—Šaˆ †E®t]µ¤Kv§‚±™ëPåú¬ y4§]È}Ï…Îmè\èåŽG]ÈßqYúÈ›žiqðË—Û[zÚw"/0hdfCœdQ&.†œQJSàv½nŠá±„kÐã`xÖ'£äY’ÏŠ°ÄÝD†¯˜!8„e]<¸¨‹;·ãPŽ3 Éö±qyKéÙ …cVOؾõÌå˜=Û°qøÖcIæX&¢äQÍŠÁN%½{ĺr ò9IòœÎtì«âÖäC#rçòƒ ¬Ê=·¸,µ`]¡ˆ^Ûc{Íùò¹fdvxB `iK¼¹¿Òÿ¼úí–{cõŸÉŽÅÂ4£X¼þîé?b9ù×;*^}àÒ3>ÚQ#3¡÷õò‰V½;R4ø”°â¿¤1hz -peRGøRH~~üÎØ83 AFy6@dÕ•|ä]} /ŠÅ˜gÛØH²%* aØoÆÚ£ ‡Ö¹E•L‘]týÉ0‘å»an 9‰9u–‡ižŒ@g, ó=´±8%•ƒ•_)¨$¯-C^’ÏZUk‚sŒâë¾²%ëÇFf¨t¾õ¶°PöŠì¢/ûY×·e±ùÛ Eè, ÓùylêÑœ§:€‰€Š ˜{²Iu‚;pLê=ÇReo‰)š­¼¸Áå0.ééêE•Žé8í½ž£ªO*Õæ”kß+Y0zTÃ'÷|ÆPûk•W¹:þZ؃m©îTž‰xÄâ멺ۂ¥Ï3ÌÐ*xe¡òGžøU¯Žéøí™z/\/y}=§ü#7;[\ov–|×–W‘Á¸ÀŒkŽUqœ|šÈÔäÝß}ÉÓxc´®h÷CÕfèy¨‹G*D'Æ>D%P 5dèŒêèÿ |,Äa¨uÅ™{¡±ÙþE˜ñjHгe"¹ú1’!7Ê%;Û×®€Ê¶<õXQyšäü/nÍi¤e‰¾‡´ÎmèÖË"-Ç«²'ý^-¨vL–wµ©8Œ‡RõR€ÓS/d•F¡þN À£9£ !ú®2Îl8(ãÅŽÇ•áíx^¶p ËÆúEî|Ûô+.V[ÜŽ°«¨l›m®­<¸‡µpô=r‰,Âk–QQŠKà2iƒ!LŽk•p7RMóóçs¤ö·€”3½úÜ>Y"5ÂNd¼:»Úb¾fÃP@_S"Ç,î%ð“@&<^€ÿYoéxe“07'j‰Ö¡VV<„ÖùKy“‡Inþ?tWŒendstream +xÚÕYKsÛF¾óWðÖ†0€¼rÙò*¶¬Äkk-¦|Hr‰2Ð(­ö×o¿IPå­Í!.W™ƒžž™ž~|ÝÓòçüóçIèz*ljïª$™¯w3o¾™ë™/Þ\»^âÔ?V³WoÃhî{nê¥óÕ±¬²ßœ«w¯oWo>-–J)ÇOÜÅ2Žçêýë»…ïÜÝ\½~SÚ¹…ÏO7V‹¥ïÜ|¸f~äùõöö#Î-嬬~ž½YDXjWG +eø:ûíož˜?Ï û@ Çú¤.ÜÇM„¡ç|Þš.ÅNÔ–‡70ÜíÊwÔÎT]û÷‰Û®º(ŽòÝÄÄñà óÜìö m¿§kÙ…ü¶Âº.Ë|‚tÈZWL®ø·«KX\—-?Ô Z\r€û=pÄNÝÐúj#ë¶9qäü¹©MIß?N\Sy®—ÄS÷ô#WE`ºþšÚŸ¸ænºLãMmŠSã='UwÛ 2PoEÖ_,MImiâÆrVlcJ&6ùžµÕ]<óR&ÌÕîÚìLW¢iÍÆ4 {ÂgúÈìùOxRËSA$D³ÓðUšð^ckç ª„½;¥[e(Tñˆ ¹ØqoÖ 0ß—E9fÃFsOµ vƒXA¨xn¤“ïÁTìƒìê1ŒüX;¨Àﺦÿ[º·±6;úºÉÁ\'{*ˆ-\±‡MÁ—‡Í÷¤æÞÄŸ‘mXõ¸ÒªˆÇ q.[~½ô»°€Ÿ ŸÒoQ±r|Ò’)K~Ì‘TÖ¢KZÖm‘[>žŠ²äQ}äβùؤm eDGG«ø©ƒ±×Ô;‘ŒÎÈ7½=ÙR½¯ˆ$¿{¡Gq<aƒ/4¦Ê;`õ5añà-ïú3N}l= '¸ÊF?òUÛT ~€sË[›Ö]>hvèn¨Cc÷“ÍŽ'vžDÊ+=qÓñu$%°ðVë/ ¤õäRb BWÅá·åÙ@òìÕ£QîXTì m"™ŠGû}‹‰×¬¿ÐâÝŸŸvWˆ:òXE <Ìà&ü°E‡é)|Ç‘#Ë®ÓÁ“RgèÈ c^Οqm&Æ3:+[K®_sòÎÅB÷Ýí ÜÁ¦üÝ(jx[ ‰&˜L:XB(‰€Q5âvÿîxJa!œ`@€Á!Ë3¦?$* +Çá¹?#CV´]S á0Ô4@çäËã]ÝäöÌqRÆ€E§7º¡eRél‰§ûH Eàèžá…bK'§æS:æ„›Œl‡|T”Á¤áÏÍ +´2‡?)æ:JO÷íø½®ù(C§’ê6¼œ”•_”R€jÉ~ƒW‚jr«vÓÑN-|x;¬*¹>%}B‚ŸÞ +ØÔ%m!ÆÃœËA‚¸• +À’°èù$…Ó ê Û”s-˜Ì îD`‡ ¼zôK¸}î(ÁŠtªéwd.åa&"ãƒÝ rTL€Œ~d‚oÀ¥’ó¼‚Äv:©(Kùƒ½A—Ï<6¼*#ã›{ÓæÛÄR2Æ£´ <;Ó›+±Ã_1ó¦ ÿ…e…áì=äÓÂðŽÞ‡«[þÚqy†»o—ÞeªÂ;©Z—¡§7_¡:ÆT« ÛœÿÌŸTKÀo9!Àˆ¡bEÔ„­iy`„ÛpÙ(èX@àd<ñë§÷ÌÙCNh}—¯»Õ@’-ª£¬M&|~azE$á€I4‘ @ ‘ç9oú‰-¯šÊ¸ƒ}˜Â^!›‚ê ®ƒa]kߨ›Šn$6$ ®­jøÀ¿fâÓ¶ Ž^“¾`0¸œv°Ö³ÛRžÀí«p—‡çÑ•ÁÉE”¡ƒé+"ý\Çx¤tŸ-IŒóÏ<7Þ¹®†qcqæ¡/Þš‚逽‰¶oÂñù{¡å‰£¨#/Ž}€ÝN$.Èhuµa»œk¡á|½Û ‚(vèv¦³#4°¼Qø´õÀ£A.[.=©ªe‡Q|³à¿›î)dS˜ûn˜¨?¡ÖÓg˜[µ ªÉñE˜!ÛÃôg„ª³BM­v}­_FÚÖb^ ] +΢=GG†êô-ª!VÉ€}qØÙ—Ì­Ë¢/²ˆWÖâ>’‹¥¹/‡#†'΀7£AV“ýNë¸)tí¬A2ª€ïÕ[5Ö’NÝ0Çý&HË+”¼[¾ûøyõÑÝ·¼îH»¾ö]O˺!¡)߇ZðÐû3ЇZ0HýÂø†RÁI„áD[“—¯m? +HC +hj­ÈµPK?õÜHÅ/—wJ[O\ÐvÐŽ¬GqEšK9(¹Çƒ4i)†×ÿ£: éÉ{­:Jóµ¯)ƒ0:.¶©•Ør¡O@á믶{nY@`ÒÔØ›¥r¦nlÃÈîØòá†Y8“ 0œ@‡Â™¯‡>ñ>[¬EºÅä½Ôù ³-Á6¨q1mïâüuÇíÀ$ Z9QPövRâøNÿôJÐ mÇ#.×çKuÔÉ­˜zÖ´Ún(&{¥”؇ ZésP +'9s¢,äîÎúÛÈ=$ø0Hÿ¯…«oàó¶'ÏØп1T0õç([›fˆÔNþÔ…œxbÿFS>@Ú÷êÅ‹Z)?^ÎJ +ŠÚ`ºâãüÐTXô†~QkÒ§rŽMhü/Ö/0õendstream endobj -5472 0 obj << +5703 0 obj << /Type /Page -/Contents 5473 0 R -/Resources 5471 0 R +/Contents 5704 0 R +/Resources 5702 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5438 0 R +/Parent 5678 0 R >> endobj -5474 0 obj << -/D [5472 0 R /XYZ 85.039 781.388 null] +5705 0 obj << +/D [5703 0 R /XYZ 85.039 781.388 null] >> endobj -1402 0 obj << -/D [5472 0 R /XYZ 85.039 761.463 null] +1350 0 obj << +/D [5703 0 R /XYZ 85.039 761.463 null] >> endobj -5475 0 obj << -/D [5472 0 R /XYZ 85.039 729.511 null] +5706 0 obj << +/D [5703 0 R /XYZ 85.039 741.134 null] >> endobj -1406 0 obj << -/D [5472 0 R /XYZ 85.039 524.557 null] +1354 0 obj << +/D [5703 0 R /XYZ 85.039 574.042 null] >> endobj -5476 0 obj << -/D [5472 0 R /XYZ 85.039 490.015 null] +5707 0 obj << +/D [5703 0 R /XYZ 85.039 539.297 null] >> endobj -1410 0 obj << -/D [5472 0 R /XYZ 85.039 306.182 null] +1358 0 obj << +/D [5703 0 R /XYZ 85.039 456.489 null] >> endobj -5477 0 obj << -/D [5472 0 R /XYZ 85.039 268.651 null] +5708 0 obj << +/D [5703 0 R /XYZ 85.039 421.743 null] >> endobj -5471 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F35 2976 0 R >> +1362 0 obj << +/D [5703 0 R /XYZ 85.039 325.386 null] +>> endobj +5709 0 obj << +/D [5703 0 R /XYZ 85.039 292.965 null] +>> endobj +5702 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5480 0 obj << -/Length 2940 -/Filter /FlateDecode ->> -stream -xÚ¥koÛFò»…`P -¨ÖÜå;÷)I“Ôœø9 ÍZ¤,©’”]߯¿y-µ²(§×Càp³³³óž‘žøðOOÒHùA6IR­‚4,6gþäv>œi˜ ÈÌy3?»xÅí«ÌÏ&óåO¤Â(˜Ì‹oÞÛ___Ïß}žÎ‚ ðt¦¦³$I½·7×Sí}áÕëÏ—ç—?à,„EíÝ\ãö§ÏÓ4ðæ tùq¿ýúêÍkžÊŸ~Ÿÿvön>P:ÐTeHægß¾û“žôÛ™¯‚,<ÂØW¶7g@§ŠÂ@æë³/gÿPñ^8áSc\‰‚TEipÌ°%òUä‡Ä–ËšŸuQö‹éL{‹Ý^ÖÑxSmJ¨ESOMê=t?3ô*§)þW2úœª:ž¬+˜Ôå+dÉÅûÀ%!R‰I'³0Pqùv»®y_5õE³èË~Öõm™oàâ(‰¶êB}ݬÍeÛ—ïŒï:xî̽,áç.Â$`rém])+S“xø¢†~÷u¸ x-oºnzt´-“€oy¸hÚÖ^ôë'^]ÂRÓò¸%>òäkUÃVÑÐ]z‹uUÛ;Ê¥­d˜]ß¡4Rã=Õ;†ÚäøºÏðõˆ™dÛ }|¾l‘_ ;3ª•s,SP„Å@}^”Ký1å·k+r| ­~B´=ƒKû W‰¶YŠáA¼v(FX¶mÓ>·¥ C6z‡™ŠSóck -”IÆmifqÍdǦD©Š³p¸ù³nYþ¨†û‰ŠÃ¿`ø­1%ä“d*·p - ò Ú<²õ™‘IT’%Ë<­UEøâÌW¡Î&Qª0e…øØLI·ñ¥Ïi¡ÃT%±FŒ“?&Zùa– ⌉øý›háâr£'¿4@æÄ¡TÐμ,›Ô‘6 “$šD±Q±aÙ”EÕƒE€|tÄ$[eÖ‰çú±´.{9ÚBÁã~ ¶G}sF–CƒJÃŒu¿••S /»šdb_ò™ÌzI6Þ.JqXéÒ©4ÈôD†B{ç|åÀôäí&3“ÅJ#»#·ZZ‰65¸Ÿcº"C#¾,Gu^7ä»1Ê|•&¸êt>Ì"¥ÃxâhØßWW´í'“Ùïþ¾è~À˜ußFPX•ÎÞä‹i`¼û»¶ÙžG°M@é-”^°ËRï–Õ‚:êc–®ÑgCNXkèû<È/ïp©b}›ITAp°s®ã§È*h»§Žƒx¢ /÷«¼fRú6/5OtÝkhjRZ¹: SŽj0¸%ZIQ.sôÔëÞ ‘¨Íº±Q,òéaæí8(¶<ëþ­%™Ì -K4*^…~Îç7e^ *â™Lö#žvÜ'ìÕV©ñPK.Ç’(Ãð Q¶ î÷`«rÃ’(ÞΟ½L'ï;òÂûbf#™yÑßMè]'XJÖ½Š‰fGNd@TØD7ò&ˆêòOI,†#ùv@¹ldPîß(Iÿ¦i¥¸—u×ÒÕÖÎñÂÿ‰æ´&󧺯CuPöÝNÐeÆ™g¿ ö8H÷ -‰«µ}. ƒð{.Ѫž»qWö²€.àÁx¿€5í·¤^´³hduPÎ…\w´ §ÏkÌá(-è[‘DZ+µ>,4>ÖÅ!2£K÷0 ¼ÇUec¬¬™Xq…ÆȘ1¶ WP"ž _³ú/€éBFUw=ÌÊÛ+~ì]")KÞÛK&ô,ÄA #щ¹Ò“Ð ±s„ 9½†Ò4ÉèM3¶%åZ”uå½õ¿¸›‹¬v=Ï3ƒþ»x˜F1G …U„×Üqã+K]cz]µ±Â$W°Ý}µåÑàyáÒ¶ÜäU-Úrdä´Ð$¯_Z+¯:× s¼ - òTaø±2œ£Ÿì®90”-ß©È`g -i¤Ng*Ppm„~£ùŠõ >Ž½eÎÞIR¥*Ÿœ˜Ä‰wUö+ôW c@“84¯”ñn»nò‚Ç[D¶ëx’óášî}ä5ÈtO0Á$©Š~Àæd/ „¨’$šKGšN-¥Üöqp…| |)MFÅfÇÏcŒv_fŸ¯ß -ìaxCˆc×B–í´ ‚öH=w\I==æa­;eØ g….yp ô'´LXàp£ñ>Ç“on9óï¸a8¬Øß±·ŸÅQà½ÇÆ+¹ €ÉGQu‹D,kh‹¿aà"–çôØ/ÄŸ’Õw•Pãb)>b‡ ضÁø/Ä-­ÊÁÜ*õh½I!ñ•œ‡Óÿâc($Š¢LÜ=*ó¤–âW׃˜q=·ÅiUDœ_Àè¡’bíüšÔF’¾ŸêŸÅµãËÎ÷Å)‘”<‚0_wÍÈóÛrYJ›³olÇUZ§ûøö@>ygÛ•ÄyÙú17—ëæ`å×Oúuþ‰§oˆ8Ä©sÑãC–Y2n§Cj8>âÕ˜+ØN¯ÍA°ÉËŸ‚kÁñbK¨éxÓžzpY/Êç ØðXÙÙ°·r -Ö -\´žœÒ ýC &ÝÖ• 9è Ã9jÖV‡I¥E]§‚¤»)„NÞbyZÃ}uÂaêب0 _t˜ 9ÌP»];_+°œ² 8Ÿ<¿OCèI±ôzáB stã‹ÖÚ¨@›ƒ]>|¸¹”VÙùëBÐkë2G ƒ€ ô?dumAçq‰¨£Xei$5ÙŽ¢ÕzhÚ›ÁtIU]ƒ‘p–Ï0kk$]ƒ…ÕŒeÍMã’OC¬*PîRöìñHŸþyJrA¤‚,zYr{˜$'@?”Ü î%÷ìÆqÉ97º’ãŸ36ðpä ëÒ -²ãDÃØ>ÜÞT.ZþuG]ë¨H³P Uö_èÍG\ÇæÀ¿-À#'—÷“‘kŒ]oý¿ û?Èa˜+@?ì îûìÆqÁ:7Š`G˜Ÿª$µóKä06'ún„…a¨"?Ð9e Ü9\åk?怹ªÄŸ b`Ú«ü4‘Ú²´.Ô¾ðgèCB +®b»‡Ë}œQÒ_n Ó>u×ew% {¾)1ÕI"ï5¯Ö壜ÁàúC×XN5êgZÌ`Ü@¶¢C”$>çGIÜÑïö§@'%’ò$C´¿…D²Bò)C¡æðƒbµ<ü9›ƒÄø°t\^¬f@‘Æ4þ8>ÿ_?½†ôŲ̂VGÆ(£--ÈGc²çôÚŸèþ/”5Ò¯endstream +5712 0 obj << +/Length 3054 +/Filter /FlateDecode +>> +stream +xÚÅZ[oÛ8~ϯ0ò$µ¢ %K3X™ôæi§Í&.2‹é<(’•%W’sù÷sn”d[énw»(Z‘‡‡‡äáwnt݉ÜIØŽOæ‘kûQ4I7'ÎäFÞž¸ÂáL”í„ý²<9{„×±c'ž,WIJÌþ°.Þ_.__Mg¾ï[ndOgóyd]|8¿žºÖõââü)ëºW‹Ëé̵ß2?ò|¾¼ü„cÓÈ·–Ó?—¿ž¼^¶0S¶ +}Ü÷“?þt&ló×ÇöãhòmÇvãx²9QoÊ—~qr}ò÷N +© Ï9éLy¡íÍ¡á;v©18ºbǨà FÔáÚ‡Gˆl<íPd`«@ý3‰õv:óæVš¢æ + ªÊ±UN½ÈjšÎ”RÖÛ¼e…¶ëœÉv[kµ­qFÒæ| »-ôŠ*ɘ+ƒž®sÝV8ቪrOž²j³î¦2²êãÀ=î¥ëi`æ)ø;·qåÿkŠõþëŠm6SÐë-kwL¹Ð#ýÖç}µµkfD-dxd=Ô±|q\…sò‰ßQIüï«Äÿ¿`mÑБvf°a=$‚˜sÄT†Ö^k˜[mŒWµè©þâüuyÊoèfÈu…ó.Æ5¸`¡þwÚ~8<£rGÎ73?ŽÊùßêm_e¨³KOÉë×Ð;TÓìêòBX‰ˆ´EIQˆá¦FÙ´±ûoÇ.†”Mše Çv¾ö©”ízàVøõzôÄU·Eç¦çeZíÌYòŒ'>¬ó’[z³í§UÁŽtyw¼ÆbÃNŒÅɨÐxU0?©–œ ®ƒvF˜¹Ix˜dC¬ƒix†$e*êbŽ‹ñ"& èc¸+ß#·áŠð/­—ãÙpä~„VRë +§·o5äw·4‡Ü,ë>ÃQ÷çCÂdNQþZwÓàλn0à*×z3Š¦Yùc +Î_@/˜[7„+„X…‚äŠñ«Ë´ØeÇKF41ôt°χ +ÍZ_\_oÍí"χ„/§¾Á-Öº5“tƒ î|\þÎ{°óè”…%¥H½Ñ¸RV‘¶fŒþ¦~!éV²ÉFcCˆ] \iáÚ?ÐàÀ; +> +yq68Jg37˜¯€vè÷»C!?êÔ6‚Åo¡ä%2RÇæÃdÍÈÁæšÏ̲zXökÙS}üÄ)Ê3[ZèÜ€ŽCT/>AªB +ÇCâ#k…ù]Ò@† „  †ö9p*³ ¬s’4í®3°:Á(˜tQp«Î7¢*Æ&LíšJ-ñ#ABù.‡û« ­b§×­ÎeBFÉRQÝ1OU’[… g;…Æ.3šm’ÊVh`õÈ«Rœðˆšº,¬î Ie²ÉmÎ=Ιò ݉&Wð•)…¸À¯ 6–½ŸÞtv1L¦“b`ä÷LhžÈHÛ|sîÝ馭%¶$Êàxgoüýh<ì»÷~Cù~j@¶.vu—íEU¶uU\ç-¹‡M¸œ’h¯Ë{]Wå˜ywl¶ P\Þ;šAˆ;‚ +9|ŒÜ(pì‰Æ½ ?Ki2-p“/p ã ¤7«ª“"d„ó»ÎGÃ2)åz ì ‰Pg×ìo'`¥a¬ª€áƒ&¤›XÉ6ÛÀ¬±ø²’ +1)ÐáŠE:{ ‘Á°3H +‰}.¡þå鳡,Ž­0™@À€(ˈé v}”ðÈ×"~ØT¦z£Û¤¥Ø} A&@øö·†ÞnÍÈ`»ðš¸±Ø˜ÕLÖ+¢Ž`G£Z²$ˆäyшïj#Éb&N¦@sGÔ\Ñͼ0æÛFú¢zΡ…†’¹K¸À1Έ gqÄRFRzby&ìã”N kŒ[’² V1[$k‘òTŽõ‚Õpç=Ú‘jØT”Ž?þ5ó](o½®ó€¬l_…{ï/‘ 1܆Š1rÂv²e!¤™R'@Öý0õðxðO4 -ŠD52ëƒn×Õ®åÎç†0bjÒDÏP}‰+<~¶òìyüÜ9Ûu½ïW”dW +±ªŠ‚¡@ê¾c*”Ìô}»ááÞPŸ*p¬_$ófÖòœ´Y…±V$tž'¢é*ñuU¡®;œnyX¯xnçÓXæ]i£Ø`ñKN˜bL!Ò8ìÍÆêŒùÊ,ÏqlÍ)­íKEÚ›ä#A<Ð` IM45¾«°  y#>fSmNŠ¯>7¤ì§6%[ÀéÕ\œ^ñ£HùÌÀ¥ ŠFHT%µ|oº²êAÄ{x*×r^Œ¤:àØí`uïsˆ/å)`Ž:µÎp ¾Ž«· . \ë¶ÝþÄ5ÿ¡$>;ƒzu[Õ­½Ñi]5ÕªµÓjs–å«dW´vÒl_6©Îþöõöçîp¦Bˆe?»Qì:Á‘qÇs;†ÚÛ+ÛÄóðÇW¬l¡F_`) ¡.)ŽÒ£‚^Gwu«'×ì™j€Ñ…ÒŽUü È|×µ~¿Ä¯ƒEÁª TX=RF ]êA›ñµ4EXÎu–'"œØ¾’m¹”7Kd,œ^ +Z™W2­+T; òJÛå^@OêÁ‚eCñ´J¾5ñøP¢8ƒ#æ÷°Æ*#BÈ{'¬´Ö·{™–Ç ~ìR(tÑ[V=8ĉ1­^Q‡¡'òLèÁɘ!Iê<‘Ì7¬Ê¢i‚Iw)ñhif™|wù*‚i,­à-¥‰Ìëb)eÍq²I‘ÓWTh ê ~Ã5W¦€aþ*kS5&)j_i¬v¼oâ]ÉwÎïjó‚Ï÷ª²üÍXq  éM}˜óÖ»2+ +߃,òî-f ;méeŸ¯Kª™qôìåwjYÖë9†Hãû°VWŠ !oÜ6̱ø뛤 )ͺ•ÊbÇJÄ°ÍÝé’SÌC~çÁÍûcÛ?fššQÒÈc\šªÒ@^˜~¿47O¿ øAÿ(M:š‰8‘ßѨÈë+L +HÇGcìgšnÞx`U~Õ‚Æ ™4 H?žAlzÒ-dì7xo¦º +ü§A.²M î•øÝḴ&>.Ñhï™ 4D϶h°Ü&ôxøÄc”e _S™:{UÛ]eÍó»tá§d%p{ˆ­Îå¼óúݘr®˜X +ñ½nP8½ãs–¬e¥±·åfwwDz¤îsbR6Q}qS8‚Ÿùþ;' ñ†ÐlØâUoetcº»u7dT,!!üã-»¥þƒ•BÆE°Z¤1Ì)B‘ÛJú}Š÷ö‹žn ÷åÀ¼¼Xɯh;;þEÇ‹}†Z̾á‡m3™§Wü5x¥yÇoæÁ@c{+¦’ð0Óa $Æ{p㚟 ð9&Au9®y¦÷ù‡D¿œ(yå0z¸9ÈÕn“&ÏŽJå}’B01V"Œ@ø9çÿyÀ·=ïÇvVJC¾§ø ƒÓݶRð>¯±§ËUÕæ©YïlqùêúTf}{æþ‘õõ¯y}z”yw‰¯xvä«ñz´ÏËÿƒÿaáÏmw¯ùÎ/ùþQ0üåÖlð/I¯u–endstream endobj -5479 0 obj << +5711 0 obj << /Type /Page -/Contents 5480 0 R -/Resources 5478 0 R +/Contents 5712 0 R +/Resources 5710 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5483 0 R +/Parent 5720 0 R +/Annots [ 5718 0 R 5719 0 R ] >> endobj -5481 0 obj << -/D [5479 0 R /XYZ 85.039 781.388 null] +5718 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [508.95 292.95 539.579 305.851] +/Subtype/Link/A<> >> endobj -1414 0 obj << -/D [5479 0 R /XYZ 85.039 306.297 null] +5719 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 279.4 412.985 292.302] +/Subtype/Link/A<> >> endobj -5482 0 obj << -/D [5479 0 R /XYZ 85.039 271.551 null] +5713 0 obj << +/D [5711 0 R /XYZ 85.039 781.388 null] >> endobj -5478 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F62 4047 0 R /F58 3360 0 R /F20 2961 0 R /F41 2994 0 R >> -/XObject << /Im1 4096 0 R >> +5714 0 obj << +/D [5711 0 R /XYZ 85.039 761.463 null] +>> endobj +5715 0 obj << +/D [5711 0 R /XYZ 85.039 748.383 null] +>> endobj +5716 0 obj << +/D [5711 0 R /XYZ 85.039 721.284 null] +>> endobj +1366 0 obj << +/D [5711 0 R /XYZ 85.039 379.606 null] +>> endobj +5717 0 obj << +/D [5711 0 R /XYZ 85.039 334.531 null] +>> endobj +5710 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F41 3054 0 R /F35 3036 0 R /F20 3021 0 R /F59 3455 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5486 0 obj << -/Length 3146 +5723 0 obj << +/Length 2662 /Filter /FlateDecode >> stream -xÚ¥Ù’Û6ò}¾B5/¦ª,†$À+ûàò‘uœrœY{\Þ­l8Gb,‘2;ùùí $QòÖËŽFw£Ñ7ÎøβØT>K³ÐWY6[Ùv^_…±…óâöê‡ÆÉ, ü<Èg·÷#žØ×±šÝ®~÷^þüüæö§÷ó…RÊ s¾HÓÌ{ùñfzxõæý›w·o޽ƙ†ÅÐûxƒÛ¿½ŸgÊ»e 7ïÆí翾xÎ3åó?n¹úéÖrjy®rdóËÕï³\é—«ÀWy6{„qà‡°½»>ýX+™o¯>\ýË¢â==ãSSR1 øY¦/K.ü8ÐVr:t$¡¯53@(ºÿaz|»0Hü,Îf²‚æ„b»ÃÈWat@±ß€tK¤ ›¹À™ŸÂ£µö]±Zu»;†<@ç~’F9ô€¯ÚVý<ʼoóL{>Ac?UŠäd©‹NtóEèíðÌÝ|¡@Ñáoä­ªn9t´]®x©øš¡àDê K<·á•UÙÕ–ïpháŸ~S¶¼ØáD¹mðÈ#bõÌ¢Ü{Œ‚GÜ)q¬¼GÀz‚ ÞFìízž—_÷Û¦%éшð4ýÝ9€[£²äæm5¢ëK$‹«zÍšN×ûfÄЗ;Võ¢†¥ƒ,q§Ùí ¡ˆûòv4þT0ß«3çåðÇwoþÍ£=ÓE¨žNE»DQ"Š\öÞ–ÆÆä’,óU^4†T2‚]í+8î#‰3?Çx bó>vôÖÈc’’\øPìî -œ'x Z/jžÈêꡨ—¨)¸ói®BXV(\Zø›kO:EŒó5ÝW×~®¯­êßßRƒGˆà6aêç*"F+xÂwƒ$š®ÿ°l«}Ïk¯Zć˜Pùh‰ÞaIój¤Ý«s²U™E—ŒsjîO |°|bù9¾§Šh@3À$ÌD댮«0÷î›­˜ˆU8DúVuÏ@Íuà½nÀ– ý‹6ìóúÛ²ÒñuÃèDád¶k +Ö_ ^TBÉÀpSÖ‚îúG^ÔÓGÆô¹6vŒ³ !Ö1~ž û »Dm -2ï™vûkœ¦`(ìfoö>íy†ö)âBs/z­h_–[güAü ÎüqS‡…›½ -€×=y'‘ëÖŠ öh‹"Æ?Q -w°Ýtëk¢¯¼­)-?¸8¬»@|Îõx¯_ôÅ„€ËA ƒuD€Ÿ\À£Ôr¿!Õb—Dî¶ßØÇŒ:“Ú )ÅGу_XöðT4=HÈâÑ[ñÏŽìÉqˆEŠ¶ç}rå2-J{·n­¨º¦—¹l†-1Ä¡"3˜wä‹+° ¼ögL6† ™E—³)æ|N`€¾—\"hs‚cŠ“9KñWÒo+Aj`:òxFÃLÂhCòm —ðIñw]ö<Ø5¼:„Z¡­ó)úʆ¿jÙý8_$aì}ÚનA»ñ‹b:`Å©V¼o}‘cv„оX—DàÙ„ŽÚú£)$xˆ*O(¬ã€ ʱf8°.Ù¦ñ kþ_²ÕÜãoìÉæŸÍÝYXh•\¤jl5½HØõ L§jìY[FH²)œŸð‰ä¡Ñ*±p>‡äªe±å5<ÞP‚eL\hŸÅœ$U›Î<(ŽÄÌEeAmX@r`Í;Íä…±‹­ãS£ûG{Åñè°ž1Xh?QáEƒu`άúžÁ^"h ö˜â¤ÁºO 6ŠFo«£ß“¤œŸI™V¼DV -:vºÅ?®yåËÐô²Ù}3É*+, ƀ˶Œ›·Bˆ¢wÏ[¬wµpÂ섇êTC%‰€§–pø”µ aU 9aµXts`L3†–ÔŒ}™‰Fo®«ƒ.ªLù"Ÿªõ>£ü¸ÒVc~tV #åçß©$˜ J(@ßU G%<¢8­„Åc%T¹r¢†Ê#vVåCÕˆª D]öl¶OÚÏ Q"Žö¶zAà­ ]•w¨œëµ¤¸§}œPÀ¢µÃ-ªEtF ³ØwÒçºþ|p°.%¼îF×A›×œ¸`®¥‡Èi;ãï4°ßÛŽ‡KÑJÀ‹¾—F …I1ÖýDäÁ„†Œr*5Åü‘rƒ'GÙTk¥’¹&ÞPþÞbo¯1˜!`T”jÃ)Á}®hò¶%×r¶' C›'ñabf_ÿhÕSÄdìdl7VÇO0xQEœR÷¦µ)*¯Ö0°ÀEgêmË¢­yXHª<È™ —°R´fÜ,‚Qb\ ìSöf£ÿÂsã¡Ô­ÞSoY©Ò„>OIEùlß—E?X‰tS¥›ÍG#ðrc ÃmÜ-Øq¼lvc®VA)ÅÇ1ïÅߎ·KAJæ@É(/³ü1£ÄíeS/mæ× 1lã\à¸Í…ûFL¸Ï.¹ù{€L(Á¨?(DP1¯t*‰/l°—…û¦eЂçÖ>»¥mìí)l55CP  ¤Ö^"¬­ma“ÚƒàQlÅ@&Ç2v¨Ÿqà(Q¢OôG§Òÿƒ­øQy`Ǹ‡ ÉØ° é¼8®þ\0Š?Éò‹Q̱}ÀÐÏãØéUEQî‡yäôC/Äf \ú5µÏÞp®‘Þß'zdÐpÛÓ4ùlÊX¢‚ü >˜n„iϤ0g.A4L.77˜³ ¸0‡_Í¥õ;LwR.–9ÝIô„ªâz̺¿M]Êàž­"Á˜› ]Ï3Ç·P¨õƈ «C¢GÇÜ6í‚|¸¥°â8¾è›… …¢M‘? S6#Æ¡³Îf „%% -<…äiµ£;VVµÛ¢'“J¥£céÂByÎSâhB/ªðq»1i`ªYbðÛSØ-yro°sêƒß>ð/‰©èïÉjvâ ës’UªÑŽ¹%iÀMGes»ˆ2.ÛîÓ1X{=úôêÆeo·.OEÓõGXÃ÷Š;éFQp|˜¹iÅr!¡ 䑦àZ±l©©«µÔPxh'j -¢î ÷“‘È‹ ë‘‡ Ý D¦½De€˜È"M¶·g¾Pê@ûa–ȇÇRûk‰À§_*æÈáw¹8è©©¶*¥ ~9‚à±)1A%Â\wÀøùŠÌ*±âˆC…Nîb 0z=ü-¿ö’ê<¸ID[•¹ÉË·¼GÚ“\@\žù (î3­i¶Æ\ð‹P‡Õ˜ÂO§c°mœ–ÆŠÅa¿âp¢¡ú‹£CÍcV‹´)¡¯ˆ5 “Ü»–F/)ƒø úh‘æc–"¶ÄÕR’K";r0z¬lÎ…º!ÇþÓŠOÞ¼zÛñÅ5!vÃ,¶ -ÄMÕ<ô^•}ÈãÞÎé}×µOß&T±¯aÅ>Nø”…¤uµZÈBŠ2N2p«ù¤«á :ûwœö8Ã{’­µndêøü#×Ý6d§‘뻫–WØw×× Jú4ÂÌÅ.ƒ“Ç|8L.&C],üêrÂ?Ab…º´ßîÙUJµl\f›C7~ ÖÇ-!¾÷¢¤ÿpçª*ê±4ñäK–sÙf›ÒœDìíabzˆ<_úøç2^(¾£É|þòUÿ¯ÿ‡26þ”Ÿ©|:¿Œ£ÈBà ŠÌô˜ßXe~ ¾å„áÿ·“Dendstream +xÚÍZ[oÛF~÷¯Š–"šÃáµûäͦ­‹ ëô!Í-Ò7)óG@üžÛŒ(Šjº +A¹Ϲ~çœQÔƒ?j‘„®§ÓEœ(W'Éb½½ð0óã…’Þ"p½(Ä©Þ]\þF 幩—.îhÉ]þÎyùÓÕÍÝ«7Ë•ÖÚQ‰»\Åqâ¼|}u»TÎíõË«×887Ð}sýËÝr¥œë_~äõ¸æíÍÍ¿qn™hçnùþîç‹Ww#VDixºx÷Þ[ä@æÏž«Ódñ mÏUiºØ^¡vÃ@K¿º¸½ø=…ç‚ïšáteV¬´ç&I`YÖá ËíPçU¥ýå*ôCg×–u?”. ½¸ÁöÛëWußîyöÒ|kþ~÷›Òþ]»®+ÚE‹½²~húbí+/\ÝÜ~‡b¸üA_¾ +´éˆHø©h –kÙñ7c‰V%ȲC!÷<Ð<ð·ßÀ„ìºWä<³n¶[ìf5¬Èé€Zî µÙ––÷EÛ}?UÐ*tƒä–Ä®ë9ÙòÏŠÔ÷fDz™ƒ|t;¿O/Ðë£ZÿÌÑjN[yQ=1Ð1¿óV³;ð`0 ÷®¼‡EÕžgŠOe×—õ#³k‹e3,íþS»¢USˆƒŸŽ(õ!APQ*ôr€Z†`l¤®oþu;¥ DidåzÏŒ'k¼zÃo²7‚ZbßM ½X)ˆ½!í€ÀA)ЊÐ9ëËH_ÁC¿RdB·ið¸çŽ‡s²^ØÊØs áZžóúæ õÈã³^ÉÙh9Ê\Ò œã3… ¼¦ÙŽÎ‘¤äLßÚoø…žâbGVƒ”x>\b¨èM`Tìô ~!™z‹ÉÓ-ˆS¹„Ä×gàãf<âÐüð,xUë~È*>(-…ºŒ|XHF Ù û®\Sž[á00¹.Øà|~‰ÂØàî 6¡ÇYvÈ>Ñ0˜R¥0Ô¼æž.á6B8ÊÌì!kyæ9pç[nC vûŽÍoËý¬Î¥Ñu Mh½ÄI™ÙP!køt²Êè:œf¹¼"ôdß+ƘÄð‹tA±5TÁDGÖÅ‚(œ×¸™èÅF‰‘=ˆ‚ããxh‹¡ë¹G¨ŒZ¶pƒÖKáÆZŽ¦¤ÉBdľ‰‹±­û,x ²6r%/Õ$˜S4‡Æu>Xz2FD*ßC#§/$]í>º0ýA±øßóÎŒîÚ‘Š +ʸ±X£s[¥­Ö*…ØL7dHxUŠ dã¥!^‹wà€DÏðëLÛP­"7%‡ÁÓp1‰JP–Šëo—Ú‡“Ný4ŠÜpì§h±§ÇQ‰nÎ[dsàæSáÀ<GÂN6 )7+Ö­ ñHsÕd9I¶’IrÅ¤Ä Ä}4ó—Ü|Þm1Y>,m¼åšr€™¹ #cl†þ8P£â%{ëÓÀM‚ð[M> endobj -5487 0 obj << -/D [5485 0 R /XYZ 85.039 781.388 null] +/Parent 5720 0 R >> endobj -1418 0 obj << -/D [5485 0 R /XYZ 85.039 688.307 null] ->> endobj -5488 0 obj << -/D [5485 0 R /XYZ 85.039 627.421 null] +5724 0 obj << +/D [5722 0 R /XYZ 85.039 781.388 null] >> endobj -1422 0 obj << -/D [5485 0 R /XYZ 85.039 256.689 null] +5721 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R /F59 3455 0 R /F62 4159 0 R /F58 3380 0 R /F81 5323 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5489 0 obj << -/D [5485 0 R /XYZ 85.039 219.822 null] +5727 0 obj << +/Length 3443 +/Filter /FlateDecode +>> +stream +xÚÍkoãÆñ»…¨ œxÜ_í§Ë5×8H.ל·Hò'Q2{©ÔÙþ÷×.Wíh ˜ËÙÙáìì¼Wê2†?u™'QlŠË,W‘ÉóËÕî"¾ÜÂÌ?.”`Ä—6ŠÓ§¾¼¹xù&I/Uqqy³!”›õO‹×_¿zwóÕWKcÌBåÑÕ2ËòÅëo_½¿R‹÷ׯ_}‹Svñ^¸~{sµT‹ë·ÿ`|ÄùñÝ»ïqî*7‹›«_n¾¹øê&`ai#›äá׋Ÿ~‰/×Àæ7qdŠüòÆq¤Šârwa%ÖÈ{sñþ⟞ +ÏÙK^5³Ó¥ÃXš8Ês;‡£ÒȤ@Ëêqü«ìtId“„žÅ©¦Jfh^,­²iº+/îé¦ëyâgel2ìÊŠ·na¼ý‚çC…°~ø ¿7ÝæiXZ‹ÇŽã]Å”×HŒh•ŒDÓ›^À„‚°[ƒXU_1!F¼¿ÒÙ¢CìNåˆØ];D(›Ë¥Î"’vœg´É÷ô¡0`a1î€øiÃø¯ë?â\²Ø÷ãU? 0]”}ÅÚ¼|µi™µ,½‚O3¤gˆ ¾ˆ-@0®…ìwrÀ +w¼†¨×»=R¯A¶l’ö0ÓƒPÅÑ£Ûðó#r_ÑâÖí–I#”è½B,H6G{‚aòìZ$¯ˆ¹ýrì–¼M8±±ŠXˆdkw,ëÅÆIãžß«‡÷]ò bÕµkþÂÊ‘?Jã¾7Ö;!w_/ü‚v‚ÝW ùG !TüÒvc½ªÊãð]O›§£\†OhßtºÆÆ‹UI*XLäðeEªÇ«{Ì#Ï”ëõtòt²Æú3„·Ûj-˜- òźjXáüÌÈOØfãN˜E¦È™¨Ï':ÏÞ­ ‘TñàŽÐaÕNƒy-¿á±žŸ_ýŠËëžyCKd3ô&kXMí¶Íäñq?’ ðÏXl[9Òì ¬ÓÐý‰g@)³2 ˜H¬úux¯4§À€ŠNÝ¢÷yOÍG 8î(K¦¤l#cÓÐABØQ@ ò¥GnSð +kbbeàŒêv$Ù§Ùâu·ÛáÉŸGeÅœ˜¾¢žwÕ7l¿/ߤ:˜Õ*J€,£€nîIíù˜ŒFàEG$SˆDi*‹Vì‰é¥N>n´ +|ùàÜšN2´`ôI}àÿW'éñ‚’ç†À[€&5Ô0/ƨƒSû¾Û’ÿØ1œÖ=T«™t葱ß¼}(%ä:²6 ­ÃœNò½œS½Ýzíw’â–uA¤çhj-G>Y~Åz€ãW˜}ÜòJ¶•üËñŒ¦¶eàtæÌ úÝðÔ>ðc S¿@îN;ä¶JZñòÜüý‡‹tŠWð&ç P9p:4c€Ç'3Á<8!–ÍÑ>l¬Oâá°Â5w )e†‚n<`ÈD+:ÄÐÑÆf±&q„ß ¸M‚˜€ò~q-«A×wg(‡î®™Æ®kë±ã°}.16“Â.ù$Úº ¥OFÊ_ä9ÜWÙ—;qÿýÀ`Ê(ü<-¼i +ˆðt» +UÀ^÷‹@s`üêÝmÄ×™uŠŠ¥ÀuœáðLèf2„›{C½mÉ¥§”±7dʦJŒ… ï(Ö!¦<½wñ/Þþʱb2%϶Õ=¿‡6àü,*m¾ïðœ·w¡ŽÎZD¡óì«• L@>ŪÜ3²‹ùH…w;#ŠQ*]4Õ¶\=ò˜Nñq+’倪¥crhF%ÞáÙ¥ªÌй_W©ŠòĈnöåÚåßçîÜfPX¨9wŽŸvÌîº^>ºãôÑhß2&oÁ»&Ù j7Sð$ùØ*>/•úÔr©ã"ÊŒ ]o95ÉXë’“ ðàÙé´Pb©ö +Í¥A’H~ K»åÏe-=+,8ÏârE¯·”Ô)+¾Ÿ)Æ#á 0ÃSn5Ë"y*­þñíõ¿8Ù;¿Æ)ÌpøàJúO3ù‚z6NžJ^ +¨Õo'/Z’—ïêm/¹=*?V ”®4ä‚4…:pbìèIÝÐ@F*!N AXó$)Hõ©î$)°Ê@Dü$ŠÅÐÈU‡±ÛóÚÃà ½Ûd’Ä{5ú…ûÑ L>…^*d˜µœ-Œ$ÍHâ Šˆ›1™»Ó8¹r-ã˜j\®\{çB¸eż>ð›û6¦/¸Tå/WÝð3(í(ýçJ’‡ mFÔ[Ò:h#e‹âáåwUk½âDèlE¸³½ psÊ1ÑóÛ{Î Ñ— CÁkF;`s&E]”ÖÀOˆ8ê6L¨”Ò¶0ž@NH‰]L.‘«x2@\!eÍ£)ÍÒ`ŠÜ¡aDA‡‘QzpWãɃãKšO´X|ý=Jâöæ{žz +/øõœÌŸÆ>m\’+‘@ðoì†Ò‘ +w?p]ç:€üþT~lPÖ:Þ H0‰Á;ôÂ_ÙO¼îÉú»Á{ÆÍŒ¤ÑRR.ÖvYáQUºö¯³!;Ìæóê©zÛ$Ÿ² r 7Dñ)夃ëG†PP,Ö¢Ff¸ù‡Ô0#¶IqflÃȈH§)>ÓÂkRË)ø8NÈ øBN6W÷Јû匊NΔËl¬Ùxbv¸åGqN6ÆPOW”˜>%wˆJmqxÞ’Q0²xž¦þ;5 ¥Å±ál XUiHŒ^Ò<øÖV> 7àÿÜŽØÉU'ÝPá×'4â‹€@P.S<“‚qrãb¤ŒÆÚƒ-´åi±q”ÚÏLE^µÜf¯ê!È^¾1GV“G‰okŠ%ѺÚÌXX†=Â|bÙ6®ñ®§Ö‚¼wmÅŸ³R +\uØêZs7¾^C +­­sÆ+ˆÏ»×<±/û©ßåRȇ“@uºOñ2à¯T~¤]¿Ão¦6Ê ãeå¾ÍÕTf[º_Ágì}!Lwg0sï=ÞPàt¨áˆÒ@ƒ‘%O×-ãLGc0£DåXŸ2ÊwÍDË‘å°Ûã®=#ÜQ ˱x¡Ä"Í9ÆY¬4šSžºQ¬• ºŒ +ÇîLq|æ4ÌÔž9>/G¹uâ':0FËCû1P¾§îþÉ„ÛñÒ•¡»)”v±h¿c¥§R¬8o;»uj7Á #÷$Žž¸låT„aÊðü¯$ …¹ßHÈÌó.þØœ|‘½‘{ÑŽ³›F|¬À0œ÷¦rýêU8…´pîÞƒ+xúÅ‚„Ow¯j,»-êû|äT¤—‹Lé±rT#ZÝÔ£tZèÕ0TÖÃy´5qN¿áp›¦ŒÎ’ ƒÁ7>ˆôüw .ùqêru–™ ¾x]"þf“:‹€*Êÿ/þ4ΟÂÉçV¤[lÑá¢,d³§atƒ(¾uÁá9ÖQ¢õ‘&w;{Ý@-‡DM–Š‰jº£k/Äv—s®%hLØ7Ám,¾ c'×ü|‡OÉú¡Ïíõ[¿Œ¿ôƒ„âÚ—+ ðÈøÝfF¤&K`ƒÅê²(ÕGuØ‘7cgz(FšlÝN’棓TOì!¥G&`r»Ø·ãð¿s­s€m;7wü'wZv¦»µìýmhèª ÆRâî7J¶ôó+ÙLØ5JñO³|¹†Ó$xú6ÝnU*ýé¼JA™ +ý»óyeÔL>ÏÍW]3Æ7ëp|t¤ôQ…ôÂÝmM„ºÖõ9×ßåõþjO!<30ûÙ+Ñ×ÿíGˆ& ÓþgN›3mõÈ1ø_à\\endstream +endobj +5726 0 obj << +/Type /Page +/Contents 5727 0 R +/Resources 5725 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5720 0 R >> endobj -5484 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R >> +5728 0 obj << +/D [5726 0 R /XYZ 85.039 781.388 null] +>> endobj +1370 0 obj << +/D [5726 0 R /XYZ 85.039 660.603 null] +>> endobj +5729 0 obj << +/D [5726 0 R /XYZ 85.039 618.255 null] +>> endobj +1374 0 obj << +/D [5726 0 R /XYZ 85.039 480.542 null] +>> endobj +5730 0 obj << +/D [5726 0 R /XYZ 85.039 437.588 null] +>> endobj +5725 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R /F58 3380 0 R /F35 3036 0 R /F81 5323 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5493 0 obj << -/Length 2768 -/Filter /FlateDecode ->> -stream -xÚ¥ÛnÛFöÝ_!ô‰"–ÃáðR`Q8qìU±I¼±7hû@K´ÄF"’JÖûõ{nC EÙX  gΜۜ»Õ$€j’?ÐÙ$I•¯Ót²Ü]“5œÜ\(˜ ÈÌy½¸øùÚÄøYMG<ÆŒž,Vxoþyy»xûq:ÓZ{*ó§³$I½7Ÿn§Ê»ãÝÛó÷‹ùûüŠ`SyŸnñøÃÇiª½Íß/ß½¾ä/íÓ¿¿]¼]ôœö<W²ùõâ¿‚É -Dúí"ðu–N¾Ã:ðï.€OßDZ¾·wÿîQñY4á[ç´b!f Yš—5+?Šu¯¹N•Ÿãjξ "Ò Œ|6x÷%|T«zªï{ òljwՔߊ¦}…_±TÞÕœ?òjÅ0oß]?§£(óÃ(|™ë# q­Ì™÷V±¯cbz^Ñ0f+à˜ Sf64Þ‡»W|Ømà¬àÍǺržw|¼¬+¼ö ÿ+ð!Z\”µ ÿvê^—‚~…{• }ÀËOcr{ÄUþ®hø|Õ fr-h<ŠÀ…Ú»;+½Ò™†‰#êÔ6Sh )b¿¢D ÞÀÂ,ðrÜÙÂ:ͼ|Oçå’å.‰u>"ëu“ïH)ðº|…È]½ÎŽ/u›¢lx¹*­¶ö°‘x5­sK˜H}ÛÍJ¡z‰7Õccô7S¶'\ÿò5pùÔ1(H}¥¾i¦&é6ôZp{95D4³°®ž®Šo%É,{^Á»<’¬3º ‘X^’øIb©kê^Ò m¤4Èš?Bv\ðî’^yË[õ#ÿZ#ÁËð ´WvV•ÅöQtôúö€Øø˜7,°ç–ið[ O5º˜Vœ†Þb#Ï„7¨c$Hæ@Q°ÆDLWa¥¸þ¡çm%/D¦àõ²&#Ú‘ßÌÏÊ?YNåòš¬î@Æ^šD䙌x»åE¬STiCæJQ(1^W34¢jÈb¿AÙâ;d¾)ˆýž8%˜ž Å'sœÊè@-šPlÔ(Ø™Û3¶ib_)±Ô@”¯]6lS†®Ž-Ë(?LäYS‚66ˆG =ý’ÚÂSš{rúbΘd”@øŒÆüƒ´Z²FкÁjR“‚ÕMïR0{ -\Ç`†{£`&Ûö½ùd[sppÃ+ -ºÌ+6¼\5X^Ûåd¹½´*ÿK–Ÿ°¤*Æ#ütô… -›±¡ b}U±b`d>k·§ÿy‡¬Q«”¶ÃŠáÈÚJ–NÎË -ÕxèÐå²È»\bÐF,%ÄœjÍ@÷Ÿïæ÷°÷ùæLÇ·øéž"/Ú,ñ>cI\ÂGìÝïÎ)F§"Ú8 ‘€²Ä|÷¾'ß/[>lzÓ‚T ôÄG˜'Ä…žDvú—[æ‡VX˜O1£+˦ ˜Ši‡¢66”‰[6²]Ù -üx¬ -.ঃ—…ÝŸ``DpM!hÆ9ˆ,&Ï‚V g²„Þw0“ãý],»>$€š%x ÎG -4;‡€ b`#dHé±~Š# ¹Âj[V båÍñœ83“,«Cqfó<®Õ¸ÎÈMt’¹o ^Ÿ;zÜvKÖoáŠ5¹v6݆†bÔÆŠ·¢Úä•dPCñ3É;ÔOG„®ñy·ç’húAêäPt”0ÀŠ[y¶fÑ\¶H…ðëè¢W˜Ž•¤/¿²>³rXÉ 3Hb7¨*2-&R‚nçTSòšS%EÈa¡Øõi  (écfÆžaHpæ”JìS6=.œÞïx{ð„þ3…µ1¡©ðÿè>Öûæl÷ÆÄ~ -íÀsxèVxxeÁ‡xúR>ŠŒoÕ—òqä4 YàG -8×Pî‡Ü€¼¯9 Ëë¹r -t”BºcŒ“¯åQ–iqÖÄýQ*Úøy¾S“«Øœ8œ -Ú™ƒ—›×T˜ù1(׉eÌê‚b-–©xrœõ‰7) T«ÜŠdKn<,å—ê|(>î Ài`$,B|ˆ½Ëýžý‰hlrNž¸^nê¶T0³?t²@@'ÂVÎÝÄ8дKkÌ…T8TPÕ‡Žš|Ê6ƙ،J½G)èHâr°‹2Im'.1â¼Æ®üjöéýü÷ÙC~¬0_Iè.¥\|B Ò1ï_*VÙ¯¿r®Ç\—ÂÆ»œ]*ŠC®¯cåýÎ?¢Z_åÌœb¥ãËàö‡“rò$>ÏšñáLà‰8í -R6pHtáÖ ÿb7þA[ãtoX/S¼ièÁ6P°Jä -Ž¥¸‘è».+ÛNŒTG>ÄÁ Iºåè‘ŸáB+¨þ"½½º>ƒ-Œü8³E骀:‡_õ[”ì“b””°**[›ˆ·¹ Ëö30ßû2ŠcÄiÅ'dü@Â(§(&ñ^öãQˆ˜3hP£Ñ'£}ŸeggaìkP?ÐIýŒ6äç\†#@`šöí/q˜$JBÚÑ*4uÃ`8Žƒ -E„ƒYh 50Çit ÈSLvD4‰ µöÓ(é ÖœœîäAUV¦©|PAzN¤ÑH®Ìœ;ÌCèã!^äáº\Ћ°ªR™¯Î1a(öüË)¯aø¤3ÌöÌY˜w:§˜Üh2nrkÛ-ÜÔR­Ýò!¢ Ÿ[§ÿÌ·2¼–/§~¤C?+{Aï½HÚÀЀÂUäIrNl°Z(,2õccM´}åÇiòâàO%Ô/+Ô9*0ƒq¥–q%æN§·Ü¦v¶ùÛçoê -ç—}zÊ+g&AãÌO2Î|·Ôº´Ï”\–•E:Â<;ËT衱:3Ë£(2T½ñ“cQñ) Ž jcLûiMU2<ˆÊúJ"íƒs_ $ý”Ž¿d ˆ¤ÊI½2H‡½/|¹*¶ZN¾4j—OÄ!°a³8Îèî@±Ï!ÒÄ&‰TtÞ89 cj†e9ö³IêQz~ö ¸¨!N0 ·\*QŸÇ£_«+<§*¦‘;ÌÚù[tRå\);ÁíŽVxÇ:ÿ×TO64§ªÇVð±vv<_Å7ÒÆ£v\k°yÄ/Gw¶W¤P±'Щ-hR 5ôæ' 8ïÚÓ­5«¼•öØÃ× ðÖMMc¾•ÐùT±ºÂhj²õ9«EÒ,¸Ï!e==gàÒšm@Fq<ÈÝßS3œ0iÅóV@÷õ@uJÙII‚WxÖƒÓOGáÆ-Õš­£F<$5&›/¥)D4¨6ˆ_ ›ÕdóÌ–Ë–sþÙ¯åp$˲`ú”S"Øh8é>ÑîŽëN\¶ì°ÝêÇêT†Ùº 7¶åÀS’çø;ùzi*Ô䫲å?F %Ž/+†°¬ŽæEø‡‘xÄRy‚žü‰íVÈK>6¢'ƒàÜ­èÉëBœÅá_!î?ß0œAQnGCOÜ\a/ñ"þæK$¾)Åì¥æ $ëúH³å[|íËÓpQî,Ù‚ãU?Æùº¦¿šÜ°ôÞT=“§tÁùÜ.šú¡Ü~lö¡(ÔÙùTgB¨J”å_&Ô£ŠÑèÔ7©3ü?»Ø Íendstream +5733 0 obj << +/Length 1892 +/Filter /FlateDecode +>> +stream +xÚ­XYoÛÆ~ׯÚˆhrf¸åÍuSWAâëZ +Z éMM¢"G%)+ú÷÷,CŠŠ©´@ =p–3g›ï,£`îÃ/˜'¡çËt''“džW3þ ;·³ÀRøsåùQˆ[?¬gW?…Ñ<ð½ÔOçë'"Yo~wn~¾¾_¿{pRJ'H°4;’AbOt€*Z±7­KGÆ-«ù‚©Û3çeî˜zdÏWˆH5º·Sðó½HYÐàRól÷n"r +"E×íÞ^]• WYw­×š}“ë'ÓØGƒÙã$àœYöù¥àÅΰJf¾gé^'ËÃÎÚ!Q¾”¹æ,ü:ýQú…òTèíŽG¤­E9ZYQ’PtÅ Û^Áä¸%ÕH`¹á#1ê^gá %].'Éû|o +Š ’þ3K\cYÕÍ®×­CÛ³WA‚ýôRúÄŠT6¾`ÁßG˜²vcªj1#©íU›&'¾¼¤@ì©4>S ðÒ0œP pÔ"ô%ÇémÙ‡çÇ#¯< @½Î?ê–µèÅû庄 K½´¡nø{Ç\bç–PÓsC®‰édpK^ŠîÀK‚ôÛÑÒ„FÒqà{ÂA0ªTqõĆC±§C¬dò@o.ϸw(Ê\ðƒY½¸aU¤<RÂA_QìÓÝò7^mŒF]ñÎg?ôû6€×øg¦í-‚i:nÛÎ4˜¥¤Œ8ËðÔ‚ÉØAóMS1f%$Èì´î«ã‚¬ÎÐÌ#“Y[œsµ‡>û²QŽÓ:«@<èõUW B¥EÙ‹¹Ò]~ÕÙƘöìú"á¥ÐÀ2)¸%xüeWôYq—. +÷†F¬÷GG½'ú Ѓ:òÌuÙž+³­¿9%o)”“=gØHñ°¬BYœFJA—Ÿqs‡N²ÏìX5ð á×ÿ¬ûÞ—‡{=.p4m’•ópÂ)òã$j³¸F™öV#-'€bKšA/5}XÈ8‚¿p±$ +Ç\´²ŽwÑÂ8<çÎy>0ª¬3â,kºÁX!·í[;C05CžfIÜ0k&ȹe †Ö6ÝÔË…±ÀZn»Ðy4¤'GmX ÅŒ!Â^$ÎR9)ä`ª\èw6ëm¦°ª¼ +c57¬?= á=â÷Él·|óíÛ‰àXX.Pù½z4ºcºïdÐu@¡EÆ_$™¸Ù;}àýÕÇx@‡M³yËÓVƒ§N>èî¸ÓLTÿs._eížš±Šþ‹%lêKÒ=>%¸¼7­-)Ú.­v\°ð-…}ÄP¨ P†¹P³YèÑ!ß±µŽžEÜîBñ‚È;®ÉGRñ^Ü[kLƒèÏÐ÷ôœèÔTÅdÌÓºŽ?]¨o/•úûú&±¾¹¶LØÞTuì@)ÛŽ Ñ ù¿ñl7zq05”%~ÎVvÎݬÚ-ÛŒºw(8G^¥‚‡ƒAô8-¦öÌ¥1?~Ž³³tkpí‘Îr +¤U†‰çÈAÌ…K(eî-OÔôÊg£á¡‡}âj©Î½ðƒËæ@ªŒÈŸ5l¦Õˆ€Z½ôËÓ +èÖª¶ÕÙÆr#àÁÒ®1T+)M´”·D‘ÍHhØÁeoã¥X›O‰p䛦ô e“uöy;ÑMùÒ“é¼Úíñ“„¢šŒ[÷ËÐ2yÕúGÐ>«óüÿó‰®3endstream endobj -5492 0 obj << +5732 0 obj << /Type /Page -/Contents 5493 0 R -/Resources 5491 0 R +/Contents 5733 0 R +/Resources 5731 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5483 0 R +/Parent 5720 0 R +/Annots [ 5735 0 R 5737 0 R ] >> endobj -5490 0 obj << +5735 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 706.436 296.579 718.428] +/Subtype/Link/A<> +>> endobj +5737 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [266.286 580.269 350.369 591.958] +/Subtype/Link/A<> +>> endobj +5734 0 obj << +/D [5732 0 R /XYZ 85.039 781.388 null] +>> endobj +1378 0 obj << +/D [5732 0 R /XYZ 85.039 664.197 null] +>> endobj +5736 0 obj << +/D [5732 0 R /XYZ 85.039 621.244 null] +>> endobj +1382 0 obj << +/D [5732 0 R /XYZ 85.039 564.826 null] +>> endobj +5738 0 obj << +/D [5732 0 R /XYZ 85.039 524.662 null] +>> endobj +1386 0 obj << +/D [5732 0 R /XYZ 85.039 524.662 null] +>> endobj +5739 0 obj << +/D [5732 0 R /XYZ 85.039 487.795 null] +>> endobj +1390 0 obj << +/D [5732 0 R /XYZ 85.039 309.275 null] +>> endobj +5740 0 obj << +/D [5732 0 R /XYZ 85.039 260.785 null] +>> endobj +5731 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F62 4159 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5743 0 obj << +/Length 2734 +/Filter /FlateDecode +>> +stream +xÚ¥ÙnÜÈñÝ_¡ø%`‡Ëf7¯yX+¶¡d5lç¶F\ó˜mr4Öߧ®&9‡¼Y4Í®êêºR]Eð§®ò$Œtq•å*Ôy~µi_DW[€¼}¡Ã$:LŒõàÚC×iF&»„]­uš$Eà«Û?¾‰£«8 +ÓT_ÝÞÒmõï@áj$Qp½RÁ§÷WkfÁ{xp«µ +jXtcÝmyÿã~·ƒ• +úüsãê?·ñúvy© #•?ÃP¬CÅϳФfÉ­2¡6é · +ù5EpÓ®'^ªýf¬ûÎór´ŠÂ<Òß¹·ÈŽîUa‘$ç÷ª@‰²Þ ø¶QE{gÔN”>Wüð +׶³_"eÆá;Ìi*3Ë­’+`·ˆŠåý·©‚•ú¶E îZ'EðéŸ7ÿb™¬îVqŒ ûø[b¶e¤/QÚLe:T…òž†[n+°o¿ÃÔ5ºË ±¸¿L½öy +ÀŽb^Ê9¼[A‹\ozU$ÿmÒÔ£<í­ßáfS:4K¬ƒŸš†Éµ%l¤Á¯íŸøuSûoŒQÕÃèл×(xA‡™ÎÀW0² +bï©“k‘u”¸ìQÇ~ÆD”wø›¥ z°µchµR,×=,Ê}#È;â‚íV#ù-£“áŽ-¨Óè$¸]å:èù<í—tþi•›àŒ %¼¤ÀÂÎ0Ö¤äí +”8ßQoʆcÏúmäÂwý06BÕé‰îJ©{Ϥxã€\õîë@öÉÁGáŸíwÍJ̃`]ÅÈx'þ:»-ì!÷B‹$&Öáñ‹Òæ®)7Hñ+o¡ëälo/…æêz”«ÈO ©ä¶®_òZNñ³`¨é™°\ãcL‘£a©“„TÒôbJEĺ‰Ä&EWe¨¯xÐNjLðj?2>݈ïãÆø`,ëAhòOSc# CžîÛ‚•±ô–ýˆ¹•Ð”Ì.ä]ž~×ÌP”A˜½±bÎ{ÏâaæPÏ]bK‡Ò5ûýºÇv;9¹A ƒAaù0E-0dLÄ0hFË‹ jŽlº­ã=ô„ë¦_¯HsäÉÒbáµ}é z¿@¢=[´¬} v3ƒ¶™•þ^8FœûÞµ¥¯9'’Ϥµ!ki­Á§’ëq•¤ 'ȽOQ°¾F”OÈñÇÐS†êùœo!%7H +t#z„Î AÖ£Pçä°yoüŒîP;¿í-ƒJ4*.„g5L¾™Ú7BÁÛ¤‘;rÙ DùŒ!U7óµ³ËaÚÃóhõriD£ ºÍœ[q’6%19†1gÏ#këÊa7 tL}T¨25¦+MÙPS=ñªt‚S6>üz†tö€ÎˆhÙ…öCŽÅ[MÀ +ŃpÑtÀÙÙÈQpï°”áªÇP¦¸/HŒ®¬H V pxî^äõi¹€äþäëýRˆ§ü µTQ씦!ÛsÄ‚ÕKúwO¼Qâ •¬wXéš'Fñ‡@; +²^ +ÝW)’Yphlµµrœ+;eùÌ”K¹Å\òðP/j.iýp)ÑLrcÍòàC)*6hwÄ(Î$F¡ÓUsŽñuÏK‰d +†b´øO¦Çõ¢EÙR¥¸ê¶Ä@ňN©ð+. èfßÒ1NGœAèÖÅPÃœ*ÀÎ¥}¢‚ºçtAš‚ß’s ´K»ÆrŽ÷YÖA„œ\P(¥aÚñ)‡ž~¶ì*øóÀx>—ðPƒ"øòï·Fyœ;¾  ,+Y‹ pž6‹æ+MC?;>$0>$ÿ[§K§þË£¥AæmdÿgÎÞýc-ýêq§˜jJéÍò‡4ä¥ô®‹Žw(¡åoº&#!è™6ÛÝ9îyúÒ7c€‰?¤j7p¼©Äb§,í#üÛÒ~k8{½ýn©K v¿šG¡Â;JšI톭EÃsÝcÝðþRŠ£ý~œC‰ôÞ0Çštâ÷8Q„BŸ6x] [d`ª¦ÐØœèÒœ‹!BCtv¼ ùkb«ž8·Î3jTÊíy9|ŧfElÖݲ¥bù5lÞ¾á)Q—éˆz`£ 6 EV|&zrÁù™¨PÁ»Õ<&F<þÖÔ3\‡=k‹r °MÙ1ö³¥¸-;pT\œBcÐö¬6*qB"RM¨ôÐ0`4OT'iðÀc]òB~>ã!í"m`ÿà¸9áZ,‘ú¶~œJlÍÙ1N<½]SŽÜcµëé…Æ”)}ö}ähãkÞ»ØìNÅ®]ôp¸aŽ +6ïˆ4 9ñØ úõŸªãòï'.hJ2ð4MÊxÓòÖóÎp9HÚ–[=Øh¼Ëâ!ÙÕÂóC~ïÏ·½³ämÙ˜†.à¥ÁÛO7¼¨}Lß—+j3 a4Ö[|ÁtÃÏsÝç i$ž´Õ‚¬=§H[ñEwÞ«c³k'5<æÖJVm}+dL¢‚ˆò¿½– +g|ï»EIŠ«øÄeJ óó×^¹ +ã"ù£¯P˜÷Ë‚pBÚäa‘ý‘÷)<9¬ùÅ¢vÅ0ÅgM¥aØÛ8+½B©-ÀÑæ*G-ùá%ï,[6ëAÓÖ¡ ð½ä nÁ]&’åµDd) pßΗ8ˆWÔFßIŽùy:Áw$…p|\ÆÐpãËßéš™s çÞÄ$ìJ‰‡)«êçì0|ã“ÉÈk™"%ªR'î—rÔù‹xTq”7á–{žþR)”:;Q³ä“¬M„9½ò)xÉäåÅâmnR}® Lš2àÐqí“Ž$CÝú$Ù”Ž÷6å®Ä$\74_Ö³>d@§ùjžbÞÍä>S¸T³³é³îç ¾«ÇÞM™\/ÛÉtð :%ÈËÑÁúAÔ÷üëKÀ¹Ø4ø™˜º0h1}£zÃÔI:Y´åh1q$ñ\UÌT|é­c%§ÝvïsjÝßxJŸæø•::ÎÍÅŸ ïÓ7šjõÄÅÀ\è Y4IÞ|áò…$>·4xI.;׿76l8øµßvÍÔ½& e<ÝÞw–ìs~æK|méxè5[~7ÀDf—J¤}ÁÅlöI~¨lrKÇ«wóá3껓ÝÀ +ôü,(Ô”ç ËDzE´»ò|‘|©`¢ˆsóÜš<þÝO±|¢xÅ&Df6üQàzúÂrö%…v¯1í¡6û g å楼xŽË$T*þþ s©ÇŽ‹­€ÕNzܨ;þ¥T…‹yòÃç¯z€íßèåõ*×aabhïBH›÷Œxħ)ÂÈ(ÇŽ¿ç7íKF&ƒ®u1ô‰ƒù ЙýÈRï-?ø7o¸ŽydüÆ5)÷t_üe@Çaš&GaÔY[ÉеèÉy¢ânjµÒÓ_XÂ$_HX$ažÅ"!$EþÊv® Èþ©öû+_A±Gêð“_W]¸"Y8RË+ —ÿñ+dÚ<òú„ÒO¯’~‹û¨œy …eõNÜ\öä;è©_Ç*“‚¡çÝ:ÖÅÙ)˜ë‹ääCªÿý/w0*Õendstream +endobj +5742 0 obj << +/Type /Page +/Contents 5743 0 R +/Resources 5741 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5720 0 R +/Annots [ 5747 0 R 5749 0 R ] +>> endobj +5747 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [257.234 549.863 288.772 562.765] +/Subtype/Link/A<> +>> endobj +5749 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 242.621 135.005 255.523] +/Subtype/Link/A<> +>> endobj +5744 0 obj << +/D [5742 0 R /XYZ 85.039 781.388 null] +>> endobj +1394 0 obj << +/D [5742 0 R /XYZ 85.039 761.463 null] +>> endobj +3155 0 obj << +/D [5742 0 R /XYZ 85.039 653.495 null] +>> endobj +1398 0 obj << +/D [5742 0 R /XYZ 85.039 653.495 null] +>> endobj +5745 0 obj << +/D [5742 0 R /XYZ 85.039 615.228 null] +>> endobj +1402 0 obj << +/D [5742 0 R /XYZ 85.039 615.228 null] +>> endobj +5746 0 obj << +/D [5742 0 R /XYZ 85.039 580.685 null] +>> endobj +1406 0 obj << +/D [5742 0 R /XYZ 85.039 387.159 null] +>> endobj +5748 0 obj << +/D [5742 0 R /XYZ 85.039 354.738 null] +>> endobj +1410 0 obj << +/D [5742 0 R /XYZ 85.039 135.061 null] +>> endobj +5750 0 obj << +/D [5742 0 R /XYZ 85.039 89.987 null] +>> endobj +5741 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5753 0 obj << +/Length 3071 +/Filter /FlateDecode +>> +stream +xÚ¥ZëÛ6ÿ¾…÷E"®HŠzäÐmÚ4)Úf/»¹~ȨÖÒ®u‘,G’»Y ü̓¤d[yÜ5 XÔ‡óø ¹ŠàO®2#"¯ÒL +e«M{­î¡ç‡ iGD«XD‰Á®oo..Ÿ›d%#‘Gùê掆ܔoƒg/¾¹ºùþõ:ÔZ2ë0M³àÙ›«µ ®™zõúå/7/ùßb ÊàÍv¿z½Îtp³þíæÇ‹ïofˆ±ˆ뾿xû[´*A´/"¡ólõíHÈ<_µ±ÑÂÄÚ¾7×ÿô\¸/^ñ¬…Ý…nD¨#‘e±ß¦4 Ûüw$ãd®Ö¡ p“R/ºµÊ‚‡µJƒêlVý“uÇ&·46vù\ÏÙåJ¤2·<7‡ýPŠM·»ã‘G '„Rnd·CîÀ¶/ƺÛÁ:J‘T@j*|ÕÁ»¼t(ÏÃÀ”^ÒŽ }Õ#m¦dB Së¾Ú iÄ6ï_-/ÚT1ò H„ýcß5(ü*”&Ij•¨ÕœÄÞZ…qÃaƒëoáÍäAÁÄ™ZãDuÓpÿí:äåqTû»…Ýà ‰Y48õ‘Ç¥w'{+í\Ô‰m·E RçÁO׋ˬöš—¿ëznŒÛjÆ¿£é“fwí[4„Nmx¦:fQ£„e¸/ðI‡‚Kë$(ö{<ÈzçËJ×)(ÈDnSŠvïmð)ÛŒÉf6#³DhéŒæª¯wã¦Ø¯C£LpY›Ë½#Û›ÔJ$qbç»r¿RB«ü„ýó®oÑ*p‘o¯¿[bÅ"sžd¤`›‰ãD¨ÔÚŒ¡ÞŸªû‚ôøȱµÒw÷}ÑLèîÆjÇMÚïl¼L¶ÎGÁ¦úPãéY>øThˆ´NfÅ6M:CâÌ:‘™³y´"XîÏgWlˆÄ|W´ÎƒhMK£z\0¶~1±§YwÀó0THŠÁüù¹ïym\J /fÁÏè—ï¬QªÌ€«YÕà‹Å8»ø9Tìç´šc}ïU9g¢\œḹ1¥`FGJ$7ÜsÇiôŒ!<ÇàÁeÌšáÉ‚VXTL5·«Ò„3«¶@«Ḩ£j– £ó™‘‡ZBLÄ€·õ«´ð(LbGIcÓæÐZ}ávIW๴ŠÀ‘Ýyh™M)]º( ñÚwgŒ‘+Z4Å»Šù<,£m”ˆ(ÒGŠzÄÝ¡g[;ÊÀqêm’bZ=²f4³§§IX*Hœ ÜàÊ 'Pìèïíˆ×?pºÔKér;Žû§——M·)šm7ŒO-/Ëu¶IQb;¶ÍéªJiXßf ûãIYœÎu¬Eª è%I¾ jBÈ'U>ß+ K‘cšX’Q¡*4& +~"¯{GöNŸ¤ÁÐÂË-ž Pj:Uh¡±×Ü·A/FEïh‰¡[À;WÍG¤Õdþitr]´x´·Ì"l 4—HöŽ]1eÜÔEÃ=dß>ဠÜ{îð€L(+’Û"•–Jaß’¹ σ.Ÿ³‰ÚµûºÁ,‹]V3Ðâ‹­¦¾%8Ó?Z)ì)b`\ßÎÃÁÏ`M8>ŸÂÿÆùaØ®Úoh,ð(æ›Äþmêry)šmß$8goV»â–€V)8__yWŠ2ˆ^wÅ×Ñýe˜Û°éÐï=Opk1¨EYÇ–„|í–B¢=±dœàaÈÖA~陌wt`H¼%îkNOh ^­1éИMG9„¢ÚD¹cà©ãj”¡b=ÃüH%¾¬àO¨'æ‹RÕñ†¹ÝÐA¾óx«œ+ƒCq_ÌN{rkÈÍa~°^x +¹#‘dÚŽüOR“€4Ii›0 ×øí[‰›„d§9ÞV»OÿЋÙùô•,%w.ä“ÝÉ`Ê;ÊÃObTÈÀ¢©<Dj˜ÏŒ6ñëÖ±ÁDmä¹æ•Q +àÉ.;[g|V¿Ò€‚Sy¬àíƈå†=Y@—b°ëÿP5‘ˆáìyÜW,¤O™{»•ƒ·]Kp)Û‚pÞ7h±/툎iM)„=-Ôñˆˆ¸2NAZäIv웇۶Fƒ1YðŸîvšAàä=šSEŠ ~;TóΑ±èøiO ¶$EC|¨Ñï4T&5•4°-PØíT‡l°}ýX¸åö¿ø±á¢ªE(Äv +Ä$×-ŠÝB*J*­ Í@3JDYf*ìúb à÷aáL5ÔŽÈu{*?±ÄÕYB ˜üÚóX +Š3xE# ¥#ôƒc´€LÙx«uœçS Ãi T- +f8ë¾ó ©4i¦,ö¢¤H´‹"ÚKS»R× £%Бù°É˜4`Sð¥ylë\ä±ð˜£–„襥 \»€°ëì´)!K[I±©YLiƒJݸ?Q^]ó“ŠÎb„š¸žXÔj‡Ô£êõ½ÛðÕIU`”yœI ´ãÎõôKÆä¢-ÊŒŽ±kYc­úãÄO%ZÛÚóa©ùt!dá “†SJˆgßuãß¹~Å¥ÆïÛz³åöÐÞ–¿/È¡nH%‹„õµ-·C #.GáFâ(ReE(æybÃHÚ?îÇî VXè1ÅÂ"Ó&lBêü‡8ÎRés~+àßo r¬ý›-EåÜæú¥K³XŠ8ÒgÜ l§ÌsI ™¹dòõRÖŠ…ò¨àÞêéGžÂ¶] ìµfÏs·²)(·)7ž!Ýè2ŸÉB4”DxK9SíœfÊñ=…r! Î$Hžð2]aùœf#®äŠžs¤É'‚—¶Ë¢åLy†¾ÄÍ° ð°Qçñ”ѲYJå’™1пb¾Gy|ΞŽ–ã8ƒ5Œ#òcûšÁÃåZMS!î—Ü`%6x£±;`I…^cÇÕÈ}öžmÖñ^Ëè (yx½[¼/S"OSgííìZâHäœ6uN{F–÷;³…4*XJ5±ÒPûb8Œc þäŽYåþIé t^·óòªði†X›rgö'3ºˆŸÛ™^¾U|=1+E¼=ýíì6$MUÊõ¹”z^êžÝËK°Y¼Ð|óð™¯àË2–‹_Ð |(¾Þ_äC³"àÃ-®OøáEA†ÖÚ—âYÎ/nêýBŸ‚!ä4sõ~%EãõÎÚ$á4‰—/[¯¾ë@–Õ$ŽÎ…2É*įÓéj [º@{è Ö†¹ šâsº_Ï“éÊÏ–+¡ @©àÌàrF›àŽbZÏ“É©°ÑWÅ@w^J>´ $Z_eÖÓ¥vq`Üq×óvOž…}¶¶h†<ëmGK—]xIoïæi¿—?9LÅFN·üжwŸ£½À]¸FW¹ˆc=/E0P±ÿeÇø6QñTŠàšÃ#©ð,©aW/øsŒ·ð7¢”@hêwà>|@üa8ÔQUmx[ûÆ’ NÒc$tŸ:0Uí*ú(„;¸ƒâ9<Çú~;róÙàzu}Éå ]öYÝ÷¸ ]ÐÁ©‚˜¿néº=Í&ñÅ^Wê4Ÿ%–t­aP{Æ…³ÃhK%ÆÚXFÇŸ·*¦ñ‡hìÉðè°FW˜`ÚÀ¾ Ù[Fg64p¦ñ¶³5lãQ;]Š±m…_cé㊆`žétn6JÚŽYÖAê?¡™ D—éSÈ?puy‚¼•ö÷BSY¦âˆ!~_-ˆ–C8HÝ­v³ßTÆ |ù¸ Yª–ËñÌCšf•Ýwšiðˆ>Ïô½ƒ8ÆòãO‡_¨Á¥5at< Þ~Nè4/þB~ï±\ÿ"ýÊr§ÑþSƒ+ôNcM»1sîÌøDß¡»p€T'OiiyÃñªÓOn󬤓\ÈÍ6‚œœ¦-A‚—i‘BÐ ý÷ÿ?kãí}K„)Ø‹ÒËãVí? èê¯ÏOÞ±ƒ žÁš„¾‘}­ø/Ž¼»endstream +endobj +5752 0 obj << +/Type /Page +/Contents 5753 0 R +/Resources 5751 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5720 0 R +/Annots [ 5755 0 R ] +>> endobj +5755 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [204.407 665.788 429.761 677.781] +/Subtype/Link/A<> +>> endobj +5754 0 obj << +/D [5752 0 R /XYZ 85.039 781.388 null] +>> endobj +1414 0 obj << +/D [5752 0 R /XYZ 85.039 651.519 null] +>> endobj +5756 0 obj << +/D [5752 0 R /XYZ 85.039 617.077 null] +>> endobj +5751 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F62 4159 0 R /F20 3021 0 R /F38 3057 0 R /F59 3455 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im14 5646 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5759 0 obj << +/Length 2630 +/Filter /FlateDecode +>> +stream +xÚ¥koÛ8ò{~…Ñ/+1#ŠzP`÷zm7 l/Û¤Ø;´ý [Š¥F½’Ü$÷ëw¤,YJÓC "‡ÃápÞË… rÂUÉ"Š¥Pq¼ØìÎÜÅVÞžIƒá.|á†.ýóæìâM.¤+7YÜÜÊMöÑyõë/W7¯ß/WJ)G&b¹Š¢Øyõáj)k†^½¿|wsùî-Î|JçÃ.ÿûý2VÎÍòóÍog¯oÇ®|ᇠ+Ïýëìãgw‘k¿¹B%ñâÆ®I²Øù¯Ì¼:»>û£§Âkþ‚wÍÜne1VÀuâóXფ—` `( à ¸ü[ë\—0Ùí«nFN‹³µØèú!ÊE:yוõ¶eÈ­^*×iÿIèzF.žPO2ª¤ˆå‘QÌ(ë®—+/öœö°Û!iÇ•ÿ#–ÎOÏŒ<y0ª j¶ ¼ûs^?Í”Èïa„‚À#ANòô„ÐRE|Äé­”p£—ž>«-ôÒ‹ûÏPN[¢à[<ºãS‘ƒ¦¬—^â ÄWM^¥]ž)ä„yX"§¹…¡nÍ‹7jx L|‡‘=Öj”Gœù±ˆßàuFÜy®{Q(Ç)q‰¶²A* ÂX‰0A‹DËLØ¿ÐÈÚÃÞr‰ ×ÿ8&l[V +,%¾çM](J"ãBêÄ…ÔÄ…ÐúE’¨9ÕH7®—,V‘@GŒÓïÿe% ÐJ&7‹ J…þØLž¦Ìx$lÍŸ'{¯ÑfÀ`¼]á*BÉ*dª£af¿[zi¬×ø5‰&ìycÞ&ÑF©X`èàáBJu ªñ ÿ·•^§Õg2 —í! •J§ÀUàp²îò¦åÙKþ<ÂU{Œ *˜þusØ?‰»I÷ŒT§»üÉ]^$\ˆ­Ä°åæó ÉÞíòºÑù¥ªxpe¯1¹ê>íŠÑž‹¯isÑîµ®.Út·NgŽZ7ú¾ÍÓu5æºÖs7=¬«róâÛòÖp¯ï¾ÿ¾)»gXŽ²ž`~C‡yÃ(i¶Ónj´îÎyø3ÐÄõv‘D1P]á¹OåÈ1‰ü±Ü‹TTê™lT”˜þ¸£ù¦h +2á#º§>0´¶®™g¼z«¬Ó5ˆH Ÿ%¢²[oy½åD s¼‚*¸3o½ìø{_Úã‡1Âr†„ÇÛ&Å°R”›stùCg†WÿzKf’ÖÙŒ&¯ènmw½iJ¤ƒ'øóÉ•¾‰‚GX{XïÊ®³÷Çëû¾s‹ÜéNBçOâ4CF©{³scCYI;9û‘8àÒ>Th¿2:ò’¥ÿ‘s?rvº™@LßòÁF+ Ïþ¤è™õÙ1œO3½ç Õœjù9‰œ»šIà,vŠþ&¼Jùà¬Ê:3ÐÂÊÄõ;æ¦årŒß^¨n©ŒûÅ\èƒáJc¢øŒšLkˈ)¯¿ýpi攕!’¤]©k¶*²ÆH1t=TëLt¬ÊœiQ3¡Ó‘¾  ñ8EŠhVY¸RQqálÀ:iÞ—:@ cÂ2‚ñ®ÆA²b ³aó"Ë $[.Ùæ(º/BÒýžìŠ,,E¡Áµj§ 0úK«®ÓõL„o»´A‹}”*Ä‹‘³%1<#} ì”å$¡óß%lg£Dk€|?ì¹tWÍGáZ +Eà#OÛ¡¸0´$€aCî‹Öðpó a°™DS熷¸R•w†oDøðîò?ÏYÔ|‘#—aBn‘6¨!â;4ÂÅÁ q`Š" +L¼D‘¾ŸhpK%ä®Wâ±â Çnƒ§ge_m:Ëš%}‹|À» Û¥®ò%á'ëá&3A O’L H~à¸u°*Ck8jNNäixN¼Ž`B¦Šx³¦Ú2ø{a°ðI*Hýá#ÿyÁ[ +s?Vlƈl¹4\sìèŽ!ÖíFMEÌ’±ôq}Ê‹¨ÁºÞòq>Ö€bvW.i舫ŒJÚ”êܶkr®¹1Ny¡sy{²•ž&d¯giÏù&ÂK˧¶Üð|šç¦—Îò¯å&·¯ÀâÑ~sŸfaŽepžØ›à˜ ˆ”¸¦è–6Î_dNm¹®Œ+°ÒÚú`˜wŒMÔ#vÒf››ÃG±Íxš·Hç=ÍÒŒ·ëÚѼ³²èiSÏÕ‹à°HµØgàö‰žˆÿlOäG»IBwšé^(O>Õ½ðBù\÷‚œˆ§üi«r[…™¨ˆÀn ȬðpüÀð§[H“[€‚u0–,·³ý χ‡·ô¾£¿€TcƒgªËŽëÛh¯®ëló:o s#ôD' JV½çÅ3ïr„'Ç<·7©KÜ@ÕµojlÎxUœˆFŒŽ÷·‰ +˜ üŽ\e9—ê¤;\1*6î2J¼‘¬¾hd{@Žò~û;D=|P°•œcBówõ§$Fz?0Lδ$f®%…«ì|–ùhdß>úH‘Ûô—{-1“ß‘5¢u¼`ìOnà’©1‘Ü@õg¶-n|ì-%ÒÃvIºII&èeƒLǃÂ-ÝPˆeÏhVš/™‰Å«ªã;ՊϼŸ0ìYÏC\vV{MK‘Ÿ?=‰½(*þÚ‚£¶4/UoDé‰ädªÔ¾³ &m¬Mˆ,zåÿ†(ʯ5„û .Ô¹¹ÁÔÛØÔØM@¯ü¶üD›E~Î=¶]ß3ø†¨GÝ"}¤z¬ìarÜÚý‹$çµJÍ–šªÿáû‘ ½¯'aíø3^°ãw&$N…]7%½c¹ã.½ã†Œ'ÅöÑ(ÕiQ «à¢-84Ó†Ô,ž$%‡Ô@ol …¡MøSÿÓ2 ‡þ‹¬O½6BR]ƒx/¬<¶_­²™‚Pø}ë[ÉSú+ßDä…#á¾ä²´Ú›ݤ<]…‘brP€Bu¾ò3TìDÄ=‡ß,ã<_N˜þbñ7Ùî)5endstream +endobj +5758 0 obj << +/Type /Page +/Contents 5759 0 R +/Resources 5757 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5767 0 R +/Annots [ 5762 0 R 5766 0 R ] +>> endobj +5762 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [156.762 713.243 222.892 724.932] +/Subtype /Link +/A << /S /GoTo /D (cups-exam-simple) >> +>> endobj +5766 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 234.311 150.357 246.001] +/Subtype /Link +/A << /S /GoTo /D (overridesettings) >> +>> endobj +5760 0 obj << +/D [5758 0 R /XYZ 85.039 781.388 null] +>> endobj +1418 0 obj << +/D [5758 0 R /XYZ 85.039 761.463 null] +>> endobj +5761 0 obj << +/D [5758 0 R /XYZ 85.039 741.134 null] +>> endobj +5763 0 obj << +/D [5758 0 R /XYZ 85.039 685.945 null] +>> endobj +5764 0 obj << +/D [5758 0 R /XYZ 265.432 691.919 null] +>> endobj +1422 0 obj << +/D [5758 0 R /XYZ 85.039 296.948 null] +>> endobj +5765 0 obj << +/D [5758 0 R /XYZ 85.039 262.202 null] +>> endobj +5757 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5771 0 obj << +/Length 2187 +/Filter /FlateDecode +>> +stream +xÚ­koÛFò»…À( „4—»|õpÅ¥AÚKÐsÝTÅ}H”×c’«”û×w»z™²—€µœ÷ÌÎÌ®˜„ð'&Y„2Ÿ¤™d–MæÍY8YÀÎÏgÂb„„IŒ[?NÏ.Š“‰ƒ<Ì'ÓB™–¼×ÿ~u=}óþ—Rz".ü4ͼ×\_ïw†^¿{5}{õ3~) +ïkÜþõýE&½éŧ黳7Ó=±¾ +T"Qî—³ŸÂI ª½; ™g“ ¬Ã@äù¤9S± b%íw}öûÙo[.¼§&L5bï0ü( Ò(z,.ÍS+N‰“ÄÒ"Ès9&)M•œ4ˆÓxáø—¼,â/¿ù +þ*š _x+XÕš} þŽ¾?ö_ +MÀð}I§9ÿzwežîº +ø–U ÿÌ|QÃÚÌŠš£!µñì5ê1 °]µ‹ž±o¹cÓj^¬ˆk‹"ꎕ"0AD‡Ú> +•›Â,‚E¡v™XôaQ£ÖŸPÅ£–ÓèÓ ó…G±÷Oþ™¯Wý)Üy±b¤¶hô“T1Õ¦(yŸÈu×Ýë-M”!$&)ìpÇTž›¦ÑípÀæU]óâÚ Q¿–D—wEwÙ¯Œ©/û¢™c4ëY]ÍOi¼³r±Ö½ÕÈÜ>…nùnºj(fõ¡[sÊéPǹZ¯1JQ6»ûD1ÃK^þ xâþ¡ó™Ë‡~¥ç$ùQbª$ˆÃfydùóÅHJ&£¥Èî<µÖN_åA®Äó‰À?΄ýÄãMå²`YÙT4ë§^ßÿ#yü=¯ý/g¬¿ïïž=c·^õC1œÂ¶§œQ´åž/ ¯^\½ùï÷¼ü³,ý'|ˆ0™ÃMåÒëü抹üIîG$Ê( ÂÆå‡å hQ$yb1.‡fuÙ7³U×µ±vÿƒ© †;*JH;KÕŽ°õ•ˆ¡Òý³¶gÕ¨Eþ¹õ^ïŸÛßøㆉLQú¼aéßo˜ ó Ð~8Ÿ±ì³þ™áïüów¼zðÏløçóÑà hÃaúm6:ºÆå ŸÊHª Õs5s´²®™£èX2õ353þ»Kæíº;wKÓ6µJÝÞ„ý=MUÔµÙ ënfŽKnœ1Œ}¶äfßZrÓçJîוí°%’ê}É#€€ëé ‘¹ÈqNµóñãÑÙ@]ñm3,:AtJšç[##«@ªdßH` a(‡¨`·€ï®hç*§LRï5m-‚?†B-Ö]1T¦È#†O(!cÉ¢­£Cæ4üñˆˆ£¡J¼ ¼.u}·÷¹› (x1,-ÊÜ´¨1«ëGcÒ›p ÈøÙ¿D@FÃ2@xw ›½å`œq‹®BÕî­0ÞEn U42;ÝzÜ l}É÷Œ–igÓ•Ù+=ÓÝ¢Ïs8ƒ47S‹¤ªâð÷ Ð1ʇ%R¡ gàïŒwh 7|,Š¶zÜÈ+yÔqZüzÅË9b”ÝmYχúž 8ˆšÈã Ë”5“'‹½) 2 ½›Î¹æËÚ­À%¹‡Ü£4ä,Ý·ß Y¢›WèÃÔÇù,Š¹¥&ÇÞsœÀlM·+Ûtì3§â¾ÏzBä\»Ç 8¬ûªÕ½£à/¯®øº¢)ˆwÎδÞÆ7ÍÍ°3ŒèêbŽ·üU2ÏjA»Ö߸±`à ÙiaK³îõ­Moàºâ;V0víUtQÀ@Ë%SâúÐTf¿Yê–WEk2G…o#Ââï³™ñ¢²€ýwwÜýX(v 4Õbé‚ +Ÿ»’ª\^˜Û(i{]×Of飰ÒòŠN7ùº£môR…`]U[û·Jªã.z¿¨†mi÷áÐ&º% ¿•¼†xB­Ë]Þgz:¨'Ê{USÌKޤ΢ÝNL‰NYﲓú¦¡7¯¢rEúÑ ׬Î3Îô®2¶Ý+%­J=#ÌvÈ=y!øཪd_¡+^uSœÝa9RóAê¯-™ÄC]pGœà@o¥!ŽeG* ”‰„9‡4 5#ÁÇ°)hAäy\¬]‘#õ‚ÁÁß‚SWqÃfHÏEÞ>Âå'±y›!ð«&9P1ujÞ´gûIŽ¼½XZ©-‡×|Ù­ÔŽ”´JÞ÷¶¿Cn(:y5ÚåN8;ÙŽ_È´+ UÓ°ß+šµ›íîñ‰/ÙÅ® c¶‡{I”¦áQ×5ƒKb8hÞìvYFãåÈ2-,ζ愶ŸÑƒ"~ U£IÃÜ£S2Þ͈º®hû›ñ¿]¡jxŒ¡c 1ÛŠØa¹û·Üþ F¬ZG`ßoùø±ÁÔ\ûÀÛ•˜¾û¾ˆ’ LÅxç·º~Û³¾L±{GxrˆˆTt¬¢H¿ÿÏ£]endstream +endobj +5770 0 obj << +/Type /Page +/Contents 5771 0 R +/Resources 5769 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5767 0 R +>> endobj +5772 0 obj << +/D [5770 0 R /XYZ 85.039 781.388 null] +>> endobj +5768 0 obj << +/D [5770 0 R /XYZ 85.039 758.673 null] +>> endobj +5773 0 obj << +/D [5770 0 R /XYZ 232.887 764.647 null] +>> endobj +1426 0 obj << +/D [5770 0 R /XYZ 85.039 309.226 null] +>> endobj +5774 0 obj << +/D [5770 0 R /XYZ 85.039 284.674 null] +>> endobj +1430 0 obj << +/D [5770 0 R /XYZ 85.039 215.881 null] +>> endobj +5775 0 obj << +/D [5770 0 R /XYZ 85.039 181.135 null] +>> endobj +5769 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F38 3057 0 R /F41 3054 0 R /F20 3021 0 R /F59 3455 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5778 0 obj << +/Length 2796 +/Filter /FlateDecode +>> +stream +xÚÍYÝoÛF÷_!ä%PQ\rù•>µiÚºhSŸí\ +$y $Úb#‘:’²+àþø›¯].-:w‡+pE‘j9»;;;;ó›«Yÿ©YûA”ÏÒLùQ–ÍÖû‹`v3?\(YÌ´$1N}{{±ü>Nf*ðó ŸÝÞÑ’ÛÍïõß\ݾ¹ž/¢(òTîÏišy¯ß]Í•wÃÔ«ëË··—oÀ/ Då½»Âé_¯çYäÝÎ?ÝþtñæÖ9v¡}Dxî?.>| +fí§‹ÀòlöãÀWy>Û_è8òcÉ÷îâæâo– ÏéݬX€ÔyOk`7Žs«ƒÈ +(±«`ùp¡nÇw]Ì#å=Â}“Ô»j«ºçáMÙ>Tõ=üïïó(ðÊzÓàoËSßµÕCÙvüÑÔüû¨dÝcÇ›_ï* –ó…òê¾›PdèGÏÞ,R~¦†›©xâui:”îÔÃAm±Áóúª©‹ÝF'ž[7õÇ@i Ü[#Ðætî½{{ù¯: ‡ªž‡¹'<;Zˆ;æaæÙ¯Ž§‹5zØŒ™DÊ®«ù"LyÃf‹ÝÓù½)öÈqU¼ì˜ðT ¤>â69c½«Ê‰¬>zq4‹œ®ß–{–×:wÔŽç»Ô*©RªýadzZ‡Âª?倓dÞíÖl®Z\„WÝ ‡¾è>óèO/:æÒ7LÜuq/œûípÊGi©˜ƒª_ˆ4Ð\z ÿïȦîy +uG·AênB¿7+yo[à³lÊ ¢0Q/»-÷LY¡¬'£Ï㋤r(àÎ:ÑpçÊð"ši»w‡•[f¸G”…èÏ¢'w?J¿'SÙŒY™ƒ¹ÉÖòÃ`Rë^^÷\tÏ\±1—‡‚ö÷#Cg‰ó€4Gt“»…®‰–#Óbs’d°4\Ñ{ÉÆ‘%[#hßOD@%èäx%±²¤’•ð‰J½­ûÉ5ÌãÀ°àcꢯÄSÍĤ˜Að`rYÐéYÉÎD§ +—*`˜¦ãó t¸0!"=ñ6È´r‚Èw øîÀ´/Úû²çñ¦|¨ÖB¯K+(Ü×ð´…‚ä"ÏíÙÜBð˾.Æzn*Eë£PN‚·'‰¤ùA+|[ß0 S?€ …L.ñ"Qj†âÁ]W­È”"¹L€¸dš„â¯x¥FþpT䉈Ôò6 7Œ™)¿ž0r%¬`åVŽì +öZþê „6® È1}®´®¢­ÑyktÖA Ñ$ÓÆØ ñÞoËšç‡\>\Ãç +DöRˆ~îéž]@¼Ã;¶<¾þf®”‚Ë™Áã9“˶¤¦û-¯Ù3”ŠUEqì5’ÐÕ1^¢úc°«žwUݹY‰£!”t̬©áµ+2˜Þàjr¸‹ôšûÂð9<˜,m˜Ž·>A<}ÔÖ5Ús¶‡–pÄr +½ßQo+^‰ÞÏ؆Îøžç€ï²Wlr'ŸŽÖÁ˜Ã€p1H9èÜ@ÈÞ²€ ~Àý÷„¡†3ªðá39àHZ+VF 3hÀBÊgÚrmAR¹«gÍ]3G™D*kgh“¥cŽsd¨.Q(ٚà +wk#¶ð4ðIö¸˜¸;‡G\õPQäÕ nÈHEâŽi”DŒuL°UèA)$â—Œ< æ½­d+©¢èJ0X Æl ç+0áÅš^8FŸøcœì!Å„>›W£Úw–XL(bwÓ~ö'Ò]•¦~èg^€U§ÿY*I*‰FßõœÑ¡ÈŠ Ø$å䀘œ“s¸É9/ã»IþMR/RO%äÚWZ9!'Ÿ +5&ÃäÜp-JÆ9[&ÀÉ#pGf„ŽD°A—‚äÎ «¸’Ñ‚†=çccL¸C—¬×\G [ +÷MF•­,$:ðß½š*q°zK§ž\%~”@h5ªÕ„FáÈô)ÛØÛçO™â”Ësºl*èaŽ Ä•€®Øˆèƒ=r.7§¡`´”µÙ+ l+‡Ä¾8…ê?R†eP-Ø$œÙÈÚ¯J±Pɱ§ªÜmdlNI@‘zù=ÔÁÃ]£,ñÓ,‘ÿ< /j¼8-©eaÖŽ"}—9TŽôtÒ +É’$)Ñ3ÊŽw|Xä¦ÂÀUl^Š ü)É +P­ÄÏå ò-¦ç«8äæfR¢êx0ù=æqM]—dÈgp„p¦Ñl¡?ÑÙ_Ë@¿+MII€éØœ\Š› ì!HÏðç1úsH boW€b™> 2ß5ÅFRÿ@’hXîò~R8Á,¿v+Ç §9eA<Ù¨U<Ä9dXÖSa´XY°BœËµ"Ìã' ˆ“ ÿÖÇßhGWŒ†Ìè%^ôå•“¼&‰qx_J¶æÑDU#BÁÝK‚ßjQàÉ}Ã`ÜÛÂÍvé³ â^Or±¶›J®újËB„€òÄ£b½6.Ç¢…@„a6~4“?~ØBÂ+aU2` nçê ßšÔ™V¼½]†AðÇò·+þžÄ7Ñ G¯1ˆ4SÆA*†s…{~ÅîãÏ778^þ V¬¨‘…Ùà*暶½ž€Š0ñ³çqÂM]HsPR2::Ö~€A1->²ê8KmLUé*1õ!+FHiÙ^ö¢<Óª5ì©#8åorÕÁÕ¢H ÐjÀdž¹,ö“,ÿ/-‰×cOFÊä55)"B.…“5dô2[2•^¥`/œÞ«í¸Þ5Ø–•kq8q­Ý¤n‰é9õúE×·%@ÌTO5®_Ž=UÇ_ÆÞKÊ[rÓDZ£K8EF¢ŒÖyEsÀ0ƒõQN¸¡‚ÌAŽŽ×1j?MÏF=ŒD©I0”í£ôç8 ·E!âìW¬<Þeêø×$8–çмM¤øÁ+ŸŸi"­YøŒkå½bS€«û,v[8¯ã‚*qº7DÜmxƒ) z`v¦mÜÍ:pEÓ5Dg­SÜ6™žr,Kd°R϶E_ò4¾ÙŠöíiè‚Ñ UFçp|G4Áý«j­@µD¡0×ÚŠð1.@Ñ£þÊmƒFMk›kv4˜éL¬‡Ó%¯''¨ÇIB¤íɦ~“Ü®-§’ú8õƒ0ù¿åLÑ”ß.Ë~½\ÝraÒïO‡²{¥…÷W¾ä®ÝT¶nï0D¡o äØô” DugQ™N(¿u[9yöTÑæÉS'‰LSjrp+õN& Áä¸÷F*Ý'ObÞ`ôv©é)'Üø§lÃVKi,=§Nd¬>ŽµÉ¨š=U±ÜQƒ8q0âÜS§= ’´Ô œSFëØ»¬'Ë—ØÏõ¿1¹§åŠÒN¹ò•aP–³Ó kK&Lº@‘°–ÛjGžúë×+ÎWB¨mt¦Gë¦Û®¿«,}ç¿Tk£‹¥”»ÜÄ°a—Žÿ°4ÜÛäxÄr¢_>©ÓÈO¢ô¿ó‚In ·Uu®F‚½R”£ÂÌW™ñò?[9À:xñòPh\kóÔ‡na{Ð&¸ÁÆ€[¸:f‘žÓñ$Â)­ý$O§!qÿí/øQ +ú³nöÅœ*ÔÑSA]œ5þ ùøµendstream +endobj +5777 0 obj << +/Type /Page +/Contents 5778 0 R +/Resources 5776 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5767 0 R +>> endobj +5779 0 obj << +/D [5777 0 R /XYZ 85.039 781.388 null] +>> endobj +1434 0 obj << +/D [5777 0 R /XYZ 85.039 761.463 null] +>> endobj +5780 0 obj << +/D [5777 0 R /XYZ 85.039 741.134 null] +>> endobj +1438 0 obj << +/D [5777 0 R /XYZ 85.039 538.656 null] +>> endobj +5781 0 obj << +/D [5777 0 R /XYZ 85.039 504.113 null] +>> endobj +1442 0 obj << +/D [5777 0 R /XYZ 85.039 320.751 null] +>> endobj +4618 0 obj << +/D [5777 0 R /XYZ 85.039 283.22 null] +>> endobj +5776 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R /F59 3455 0 R /F35 3036 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5784 0 obj << +/Length 3046 +/Filter /FlateDecode +>> +stream +xÚÍZ[oÛ¸~ϯ0‚¬ÔŠ(R·¾õº›Úæ´z€nKŽ…È–W’›Íþú37Ò’­´ ìK‘SäpHÎå›2jÀŸš¥‘èl–¤Ê×i:[n΂ÙŒüz¦„"˜?ˆ#z¹8»|Å3øYÍ+"Y_¼W¿½¸^¼ùx1×Z{*ó/æI’z¯n®/”÷‰{¯?^½_\½ÿ¿ t*ïæ‡?|¼Hµ·¸øºøýìÍb°ìÜø&Ö¸îŸg_¾³¶öûYàë,=@;ðU–Í6g&Ò~d´|×gŸÎþë¸ð˜™ñ¬‰ÓÍ-Å\~šwLMój»O´×¯aãåÅ\y])=aâ=\„©×pÇ2µ£â¾¼êmÓs££aùØùŽ›Ë¦míäe_?rï +ºš–ÛmŽ‹=ðÇçj CEC]´˜ñ–uUn±C¸ï€¢­¤GyÕöî ¤¡÷H»Þ3Õ&ǃÐz!/œ—Øhp<¿lQ]¨#…ÒËH8V(¨ÞÂí>/ʉ/ßê¡DãìN‰Xo¶ùm ÔQy}ÿËfû­l{þXUv8`^#í(£ü Í„‘ìÍ NÍ`bŠeÛ6í±Á…YäÇ`öH?´;í‡É´ÕÉÈ÷m©nîx7#Kñ·5W` ¡ûŒü$‡6|bË*Lümœ9‹þç(ãƒð&ϺM2à>Ɇ&À†[B=æªÌâسÐI#63¥ü,Š†Òxß\ &Î’ÿÎþœ²M–i´iŸ‡IÔqyµQ³× ìh6PO懈bÚOcuPR:¡¤7EÕ“o®L –¿.'Œ9Jü@Å2eSmJ­·SòC_'ÖìsrZdœ<Á [édȸÜ•?dLUòŽæàц° —"&ñÈ)éA-̤ܮOÚe9±žN|Cr§õ”6ˆGâ‘òÎ æ:\bÄŽ8V$½ x@Õóo³¤;ÝVV9¡¡«Ô Áí” Æ‡ý‰?é8óUÀöŒŸ†Ñ¿²î¹£%xDœ–ý;‡C1ásû*ɾ‚eIàÝÔKb½ãî”·i8ä(‰4Ë=3ÈÔð8—ó%2ÞŽ•C(o Ÿ¦?v©§6ÜM˜Ÿoynßæq¯œ š"ú8„Á€M2õÊŽÇ%âQpWBcç`Ì˱H^÷lZ`§F +¯ëÆÄÌÐñ3ˆ¨|ê–¿0´à`Wn î)ʺe“÷%SýDÁŽÆ:zWÝ¢é=òè-…Ðg<¥âÞ‚äüÁËéi‘ +1-û­Z–ƒÿ<†·Xã”N†qp_3Lð²²Yü(sš5ŸˆÅ¥ Yèå¸QCÁ]¼¯Ð«ó=Çvà¸jþA~í‚EŠ„îfÅ¿ŸÊ·|ÎÇËû>_âáîù»Ù2Õ8þBÇPNÜ(e: Qy€&H8áÈ÷,”´®'Û—ãË'(÷‹º&¤‚0*ÆcâO†‡ Û¿ËYáÞ0Ú 6hý{Tl¥s³½'“cA3qA@óÑ«ŒtÏïîJáe­ÛìÆFE^.X°L§~–Y0{wõîäHžÃª ;/ßíêj™ÏseÆ(/w¼l–}ÙÏ»¾-óÍT +„›‘ Lh*ZÙHí=ŒO,y®3) #“‚ß»†i{û 3H/ÕO.#ù#ÈÒã½|ä‰E¹ÊÉÎûgL}HJµ¤Ÿ„2Zà„ÌÈ:g¥²“쀓ӹ=É"’ÀŠc6›€zPÓn<ÂÆ:˜~Ž%TËöaQ‰Á¾Žfr”¤ÞM™o…u¿FÛÆ–Ølã8|à á%Ñ·ŒGÔnø\á›ÓPKyÕÓÙ:Ay˜e¬ô0K©P`×êì²8~2—Dzò<ìk˜÷üI8 H£œé €²´ëHÃ…¿85Ä>Ç"ßÉ™«Šã)~Ë£±…H˜ƒû;Üi³ß‚)ÿÚÕ”™åÇ<ù–Òì";RVSV•yöý„Ò,gÂØëC0³ôð÷ÍÅšãpà®ì¥c]rƒ¬By—ŸÀ…á·bZ0²l¤‡Â÷ µqHa³‘KÏQ©êfS™C+*ˆ‹=Ê¡Y`ZŒ| y…jP‰vïF{ëŠBÆš H¡C³5ahµXˆv‘® –Za^s2±±Ë6ªm×ÃWYà-D{WœFÐØA'ðÁðJ‚‰ÅBéIm! ôÔdn%Þµ\#£i›˜¹­ä²!ë±ã#ŽæN[œÛôÜM”¬HÍŠoQÌÅÂÒZRN›Žœf ÷0†Ì§ÚX•¢´¶»¯vܲŽ‹¶å&¯¶b6§–d¤“Ô}Å¿=ù¶ØUs\‹ðþ¸®µ9dÖ&š¾xš‡P?&‡«§0˜¨Uæk‰@ÝÄ×`! ªª›]ÝäâØ{WRy¹ÆÐùe7QfB >µ­üTý +g0Р­®$U‚@GtHöº¥µ¬aæ)ÓH-"!~­òMUWyË6|U´&C“/,6aÈŒE«{ád“nloËÛY +­KµñÀñs”¦µ<ñØñ°o“3 wpIª6Þž¶Õà5Ð?3w£v☔_äöò +{á—2YôC›Y`û^2Î?^¿ÚqäFŠS,$ ¤FA¨@‹Ýw²¤Û¸pïx +‡0îfnŸŒÙÐ9çSŽÔ +«Ã}PÛõ,> ™a”úˆÙ}•m¥žOÕ04¾Ž-Õ¦Øе +J •ƶòîÖ˜Av‘÷ïmÙt.÷~•5Êå¾ãÔ½ÙÚâž×®NÓR#éA-d+®JÎtkéÊ9`T¡Ž3žȭu¸’Œ(K;V䈙ŸDÑH'놄ŸD,|9OÃ].£…öé­kÄ]W‡ŒP6NÃ1„©-ßÎʬ­àôØÛ äâ +Yi”{aÇ7ªËd—ЯɎŽû 2ûåz`öç¨9ºñ¡ÚÚIØ·ÃbÛ‰8!õ|ïž7¤ ´£†àÔvœ§a‡Ãó+!üíîîóâ¾j p “Jb±iAÐ}ØÛÀ NÐœt 0cïQF2~æGÆ6Àâ݉³ÝgÕí±TÔÑx9%ŸÆŸ£,Ü”ýz„ݱÈýü ãr5/±£K}òÜö„˜ 0ŒF)ä+<Ä6`ÑçùDDT!@H¢§b¢Š\Ìà–Û¨‰HŽùFð#žẋÌnÎV¿â#ÒÕ3Ñ5¸Á‹ÂV‚Ú»>ªF°ïsõwÞrE `˜ Á.ü8 e‘ýŽËÝŸ0øš,¡ÅoH¶á3Ÿc¾ÛH¢ Kvû-_JL=SÄ~Ùjþ4œŸ¦H'ñ!ÁÖ?§ öØH}îd_W®Þ‘+^ÔN7(R'QC'!x^¶»ÃàÁÔÏ™… Èó•o´*¨áæýÕÿæØæç·öÒÿÞ…±Ïý@ÆÙO*ã«Í0ƒ_\”óÑšúðHgž´­Áa3? +m[ºP€7UcЂs9dÖñ@¾³uMløWn¦ñö‹P˜x +©Ôëò¼sÍμLá¬åAX[[Âõù +[‰Y ï7¶Çq–È8{´ î`kkUl_[Æ¥ìI8·ï˜ÃÄú*—éÙ‡ìQF$&ÅÑ­EH| å7Õø™’M|÷µ±èÏŸ´Ú$ôã þ¹¬VÔ}šmªÔOR›n.÷»./Šns;•qè§Cb +͵> endobj +5785 0 obj << +/D [5783 0 R /XYZ 85.039 781.388 null] +>> endobj +1446 0 obj << +/D [5783 0 R /XYZ 85.039 403.988 null] +>> endobj +5786 0 obj << +/D [5783 0 R /XYZ 85.039 369.243 null] +>> endobj +5782 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F64 4225 0 R /F18 4228 0 R /F65 4251 0 R /F58 3380 0 R /F20 3021 0 R /F81 5323 0 R /F41 3054 0 R /F59 3455 0 R /F62 4159 0 R >> +/XObject << /Im1 4209 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5789 0 obj << +/Length 2990 +/Filter /FlateDecode +>> +stream +xÚÍZÝ۸߿ÂÈËÉ@¬Š¢dIׇ Íær{ÈÇ6ë`[Ü݃ÖÒÚºµ$G’³—öŸï|‘¢mmZ /A€9$‡äp>~3ŽšðOÍÒØt6KRåë4­ë‹`¶‘7Jf³È–1ýmuñ—ŸâåL~d³Õ=MY¿z¯~~y½zýq¾ÐZ{*óç‹$I½WŸ®çÊ»aêõÇ«÷««÷o°QyŸ®qøÃÇyª½Õü÷Õ/¯Wζ‹È–÷ý|ñëïÁ¬€£ýrø:KgÐ|•e³ú"ŠµGZú»‹›‹¿[.<ÍxÕÄífÆN…ñ´xã8³2ù:Zº2\<Ž2ïå|¡¼âKÞ¬Ëî»L¼+¸i3”HßAsWÁŸMÙ \ÞÃÉ`~ËQ–üd'gú…|×Ó{ dQ¿2’Þ¥ËIÏž³Uìhw¢}Á­˜¡† ”ÜØÓ“3g¦ùsë dØï gV|”˜oN&~ñ ®qAÛ“À‘ïÝî+³úJî4† i/ž¦å¯<?‘>¶o¸=}sgjwCÙ1áHýŠª–E±·’#£OèÊœVµ‘yä­ÛÃNqrOÌÜ:oª{¼ø¯úã„F'ŸèI{VK_/Á'X…ŽÔ„Bÿ¨ä”mìGqÌ O™âËsÒHÞñýíM"•ÉwØKå’-É¡ç 8!}g¾~7h4ب[Giâ“"+â1äƒh0´«uÿã|±T±w{¤ç8{ß‘>—²c®(Úªàqk¸´G6Úç›’6x1¡ó·Öƒ¥è@ÏVqh°ö™1pı„ŽÀúYmÿ%Cí=~cOÿhïæx„E¤—ßÜU.H¾¹±kѼOwh¸Án€ôÒ q‡¯çÛŸ‹#ïÊ#€;J·«ÖùŽi[2éN“Üï™?ˆ]°S1¾\…¦³yÁ¶E§¨Fg¦é¬tUÜl³¦,ÍعDãµ3R6:Ìè²µW#7t6 /NÍ=M˜èÄ@ˆÅÉ÷n{Áèõ°COCþÁêj` .p ’s¦º/À”Ï|ÁAÆû¯le æg©÷i AdÑðÙ¶¸dWðŠ†–sÛ91<*ùN:äùÍœ0q®vuÛ‰ºIt’ðÓòû£+Xˆ&Õ­ÛY.ïé;(rÜTG1Uô“°NM¦;ŒÊœ8q×RºŠƒ« _“Ú g}çÚ¥Síxv†lYå—ª=ôh—f­×Æ&Þ±káÙ9Ô¢í6´”ü­åpÚÚìéhZLrX  iŽbö¦j†KÿåUÓïüU#)Agkœ¿µ –šQiZ³1ªb<‰½1¦b¡"™úA˜ökã1™5ý3h»Šì®É—ùøPQ$æ%ÛÙ°³ŠòÕa³‘7>÷§¸€ÂÑŽ§‹Ù™Ç>†ïWüÅ«=­mJ‰{õhþ4øŒ…ÕøAšÐ¹V[ÖrÜ Íw=7×¢€À](’œ„! •+Ú„ïQ˜™aÆoÀ|±sçD&$œ¤!ˆn![ajÛÎ`´YX%¼ŸJE`[2Û»Í `É`A~/ê¨÷™øö;L¸ç¤NŽ ´‘ðÔ | • AEë+€vœ2øîʼk¸™ †=È3F„Šª˜2(f¤kT::+\7.J«ƒÎ:—­¬måw;uÀ¤"äÃ÷e>¬Dú©„ÈÅ0›iw;Þ´GBd’?l±c{ÝÖ#ˆªzÀÞ´)~{.…)Y¡D&³üêáðºmÖ’ ²e6O¸%«.ŽÎeÄ„ãŸÞ_ýƒ[.`Wð× %õ…˜„xk|u#m6儳åÄÁŒâ¨1T­¬&_T(‚´‰6/ TÔ!d®Ã:'˜`‘a]?çè2>9L"´AÆ_Â쇄ãO8ÞÄKŸ3äÕ9…1‹ ¿^ c;vî ë}/6>Üðw¿#÷tON²/F,_¢€p + õNøäâëÂx9"…ü“ljÝJ,ÏRMúÄRÔ¢¬H£!ý0pÓâš50\›Ø€Ãhëâ…qÎ\ç\°ˆ$ÒÞ.øD°íœð@S·emÛ¥›¼ä‘Ȥ/ÌÐ\ü+¤FrœÚžÉœ×_±Dµ +™Ø™S¤¦”ƒš»JºÀ©,îšÊ0ºæÍl‚Ë!+ÅPidîø.«cøü:Á32×}×rJXó¦•sT[Q¡#s7²XEÕZÚ”µ·®¥w.—~È9Žu(kZ}ÂöI ãûQt6J£ç~¾î¨ImÔ{\# µä>_;ÁÛ¤Ê8™ždpV²Ò©­¦Øí%‰3ïãSŇIMjEwªZÄ™i^”lóè1í·¢ÜIyàÎTàý²hn%ŠYä"ªàB|ƒ»D)¨)ñ^¿ûiêx~¸ Ÿ„¡Ÿ¦á·áz¬ð<%‰BB,$8§Ú6ˆÝ£Øõdw8K÷Ôà…s‹VrMìXÿŽé.¥bq⸠+ÙQ€øÿAv{w#· å*øqbò¢ÝˆÅt¬,VãK¸†CùÞ‚Xv&8½k7Íúê#»†µ'¥Uä6ð×1ÖŽYö'œ½óóPn6çeR_Œ ®ä/Ñ_]=?æ­¾!X»ßš_Îo~Y~©Ð¶£ Ä·')›k€Ã’t0o.¯ÄFƒoÙ“ƒ¸c¬ 'ÀÀZ~ §>æ +øµo óQìHƒlž§š9-ïò^f"bd׿cyÊöm/¿Œ2„ߢX@…£N¹0.CM°¾’&ìÞs¡ròAy;¿+=7L Y!æ)eɦkƃd¡¸:dEZ“(`Âö‰×ÝÉk!ä̤ìf‹Q8³rƒFOÒO`#ó[áĢʇÀ<íDÿßÿ·Ð‰¯R+Ùoz“0ŠOOèVzÍÿ„[Oµendstream +endobj +5788 0 obj << +/Type /Page +/Contents 5789 0 R +/Resources 5787 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5767 0 R +>> endobj +5790 0 obj << +/D [5788 0 R /XYZ 85.039 781.388 null] +>> endobj +1450 0 obj << +/D [5788 0 R /XYZ 85.039 761.463 null] +>> endobj +5791 0 obj << +/D [5788 0 R /XYZ 85.039 721.768 null] +>> endobj +1454 0 obj << +/D [5788 0 R /XYZ 85.039 361.796 null] +>> endobj +5792 0 obj << +/D [5788 0 R /XYZ 85.039 324.929 null] +>> endobj +1458 0 obj << +/D [5788 0 R /XYZ 85.039 160.22 null] +>> endobj +5793 0 obj << +/D [5788 0 R /XYZ 85.039 127.143 null] +>> endobj +5787 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5797 0 obj << +/Length 2845 +/Filter /FlateDecode +>> +stream +xÚ¥ÙrÛÈñ]_ÁòXeb1ÀàJR¾¤hkm+U–k½#"±­(_Ÿ¾E8IÅ¥*aŽžžîž¾©ü©Eº^.âD¹A’,²Ý™·ØÀÎÅ™o¡]/ +qëõúì—ó0Z(ÏM½t±¾'uþ»óæﯮÖï>-WA8*u—«8Nœ77WKå\óêÕ§ËëË8Ó°¨œ›+Üþøi™ÎzùÇú׳wëɵ+íê(À{¿ýþ‡·È´_Ï<7H“Å#Œ=W¥ébw¦ÃÀ u óêìúìÞÓ >5ÃÝÊB¬ÏM=°©Â6Mù±çä@x³\ù‰“-WÊ9Àt‡ƒ¢^ÂZß!7 ªt‚#ŽÜ(Ђ¨©O8ÌÚe'é_Í.ש«@þBA‡(çqéÇNQULŽ™»0þ³ ÷x¡ÿE;wYèú‘=ôÕ ½=PØ–ÌÌLáuÃ0vÖÛ¢-î›v‰Äï/á†Äs¦ìV+RCØò;n-ãR…‚Ý“d‹VxÍ ‰e±ò}o,V +ß,%»xb„ÊÉË&­bâY«·pú8^‚·¬p”[ +¿zJø.r¾€ÉÛKÁƒÏÛïé?¯ ׄºßZ¥¬4xËcÍp9É‚¹“ý²Fzb”jçU†‰XÊâ{Yoèó—ëËÏ°öå‚÷Ž8ÆWùªýO ÈOcç  +“ȹ. +^½ìð›8ˆk;ÕÊ|ýý z]:_v¼ÙObzá¢zâ­Q9Oˆ ÞÓÎìÄŒ,3‡NHè·2hêÉÚ‚`j¾kÓȶDK`jYƒvek£jt/§Â'æ ßV‚auIÀ1(„¼;^a¬šñRNƒ¯¯‡+Í*ºóg‘õÝ à“5lêŒó‰Å•áÙ°]#Ø©R›¥hF‘3*…Ô®9´,@"—õ–vVÈ—3úÐÜvFF.d÷„xàû:Þ4üA…¯„Ú4%6šv‡:‚»Dƒ©*‹Ý¼á»š©ÎŠœáÞ½9/'xP9ßÁôý9ª“ËÇÖˆb;1cÀ7îxyB¶PL2³wÝ-ýŽÆ(–SIìÉ¿°ë¡g ‚YŸË9ÉyLÌÂ3ú)ØÄÀ;@õ|-#ÅŽ/dýÞOÌ ·’1øTæ0eßIZbÀ< € +\qìÇÀ ¹G±ë$†)?vŒaÄSý?DL¥]¥ÕlÄôäB/ü!:å1¸~†'„|b‘nŽ15Ò ¥ÜmwŒ©ö«(–Ó !0†Å·…r=‚ÿ§ÝɘÑÂ/—;µxÛE‹‘¨ u}È_|ÈhüI¨OfBýš¼$8Q[)üåùóG‰%)“ytÝl]õyêEѧu„5Ñi6 V5o%aá­ã°|Ycß ã𘸓 èØÕUˆq<_¯|Ð õs5*»»(V?ºÂ‡àÑÊ÷f‚(¼‘vé€j3ÏAË‘çª%áõ¶È±ùl½iêïPd ®r"Iw`rã›Kž¼6åçå ™ZÜ©Ÿ/k¾y$+j¸â7~/Œ©ÿ”¸8W­%:!_„놿¥(¡oÍÝH“ÁW ñ1vî}Yõ<+)åë‘ùÄù(= X{àÃuQa,ë8áFÓŠa‡ÀŽ«œÓˆ–—6N\ªT_q,²•ªTû¥ÌÇÉ)bqâPõ´ÇW-Ùz›‡ .ªäb JÇ=ªPè†ÒÊ +÷9ý—3}Ç•Ô=Ï{éupez9Rö‚{0Ôã)®L f¡ÿœÒ©¶§œ pTR9žJg×yXiƒyS©ƒÐ¹¢¡ë¯³¶Ü/‡} ùš•Åô ld·’2U¦©:†âŠl'LÓn%Á[J87(<ÈÚQ"ધef¥#o(8­%‚Úâ4+Û™ÚFÓS!0Ï h¥…Ä‹!’Ò›4¤x_ßùv0UI’°HôðŽx–$RÊ¡ñ¡£._±ýùÌÛŽ +ÏXM¯`|•áéÖšë¦àõ‘LVÐÌq>*LÖxÇ9&Ì¥ükPˆbmÁ¾!\ ¸â³5ú0îÌP¢Ã™\jÊÃNL’5Õbîx˜—™µØkä|Þ7—EÃ2»0l9ÆNÍË^¾r +¶òÈR_ÎÔô¨„A3)'[ÖÄ(L©¡ƒ=¢/ ‡Wh/ARú #z(; ³Cts¸n¦ §Á¡ÚDz¶a™2½Ãc øCš1.ÍA åõFûÁØQËLnO›M3géÛ‚Øô,¢©ˆF<Ùi×´àþã¡[·i7/ÇFK¶ÜÔ6[8ÂÌ!GRÇ`Âa¥`fgâI³éEošª›œlyŒ¥`kö$È Sön:Ûp@/ziÓDb¸Çc»J~’Œj…û‡Îvž9àÞ<È›áF[L:À¹ô²*­G@˜©gÇ®á3‚á¤|Áp¦ê!ˈ“l6È}Ç]Ø‘ìð‰Ë³^ÅcR+€X„åªo‡˜ÖO1‡Y-·ä + +R°Do_dqlóÍX,:íÀÁ¤é귮ΩÚ2!c|@rÙ%ÔBœÖ¶î}œð0e)¹f¢/ørÛå‚ៃŽ÷¼·åFþ3Eš4V™ß"ÓðŒ¡šé£{ñH%v ú¾’¦žšÎxœEèÛ$)çÕ)”¥oª;ì‡öõ±z^ÐFpR÷–oùCÝRÃd‘oÚ¢ +³±¬:äKi“È-fF3™€¯ÕÐÑóµ‡! +?Wo~ã½£><Þ.ôN:XÚoÇðô¸‚—ß]Ø7™\ò/X¡ŸpÀ‚"mÑjPnwdP’NZïp€Óµš'lðö°Ü8¡§¾·éûÒÊÛÜUs=P’Þ +üž’Ù8N^ ¾l+8:™0Þ‹ÕÙ‡xÕ!ÄÂünG\w)Cm¦Ž2je“c…Dƒn›¶¤„ªã54ûf° {]ÙYß´%µ;T±W ý¡–gÝ»ˆb÷×> endobj +5794 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 318 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5500 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 5802 0 R] /Length 15650 /Filter /FlateDecode >> @@ -21401,7 +23127,7 @@ q[ ,·Ï¸qÜy eÇc1Í1äŒëPo|¾2^8ú‘µ˜µ1¸P)ß:* ’È4“‘ ³^¦çw¿ZÀU½-Ыõ©\8U1¡»{¾›+ÇÏïjÀl3¸žû¼o1nƒ<”óÌšáýH‘ _Z YQ-ß…—£ªóÝ󲬇,ËkpNʬÎ|Q×)¸#¡À’s?¥ex‘߬…Ûç#Mc韯…XäÂ÷×B㩦Tw»Ò8µVÌoÚŠBèeq™WNu™£µmˆr-lž­U©¯nÞ¬*æS\øÚ\ÀL”‚ä3·‚8•-¡WOÍZÜò]ç <èÙæ>$ÔîÝ­cÏ1ÏväÂ×您C­¯˜¯´RÂ-¸‹³Ç=•#p#Ãiª¦»ð!‡q·Ž5D.D.|q.´a¦4û•íû!ÙG-4vfŽDíÃP¼XeЂq·Ö­È…È…oÁ…ÎÊÍ¥žÛj@-01Mª>¶QïG†Wbƒ Øý¹¹ð×hA5¡?h¡Pµ™`Âo¹àSÜ+ÐÂÀö!%w VL3ÃÌ)×nŽ¹¹ð-´ gÌùþñ~ò¼ÜŽ~u¯Æ¾˜N=ïs’¼ó Xª›;þ#"¾°þ¿Ú~WÙD.D.üZ¨•AŒÞ>¹¹ðµðkïêöÏ‘ ‘ ¥>a‘ ‘ Q ‘ ‘ Q ‘ ‘ Q ‘ ‘ Q ‘ &ráOiañ†/ÿ×·sa—äY&‹×Z(žx¡þµº~xš‘ ?ÓÓßÄ>äž<ѶW=¿ÓðÌ+½Zå'‹g^ÈD.ü¿MeÖ}ù?U•2;Çßëñ¹ð -jáIXäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ¹µ-r!j!ZäBÔB´È…¨…h‘ Q Ñ"¢¢E.D-D‹\ˆZˆ_BäB´¨…È…h/ZÐy´‡[#"¾Ÿ §ãŸÇÿÑ,âöÛÙgé<6endstream endobj -5500 0 obj << +5802 0 obj << /Length 107 /Filter /FlateDecode >> @@ -21411,99 +23137,65 @@ x ííí|||•••………«««ÞÞÞÙÙÙœœœýýýúúúrrr---âââÕÕÕåååÿÿÿŠ”>­endstream endobj -5494 0 obj << -/D [5492 0 R /XYZ 85.039 781.388 null] ->> endobj -1426 0 obj << -/D [5492 0 R /XYZ 85.039 761.463 null] ->> endobj -5495 0 obj << -/D [5492 0 R /XYZ 85.039 742.197 null] ->> endobj -5496 0 obj << -/D [5492 0 R /XYZ 85.039 426.321 null] +5798 0 obj << +/D [5796 0 R /XYZ 85.039 781.388 null] >> endobj -5497 0 obj << -/D [5492 0 R /XYZ 85.039 426.321 null] +5799 0 obj << +/D [5796 0 R /XYZ 85.039 502.952 null] >> endobj -5498 0 obj << -/D [5492 0 R /XYZ 260.019 216.657 null] +5800 0 obj << +/D [5796 0 R /XYZ 259.868 333.99 null] >> endobj -1430 0 obj << -/D [5492 0 R /XYZ 85.039 174.953 null] +1462 0 obj << +/D [5796 0 R /XYZ 85.039 290.302 null] >> endobj -5499 0 obj << -/D [5492 0 R /XYZ 85.039 145.059 null] +5801 0 obj << +/D [5796 0 R /XYZ 85.039 260.409 null] >> endobj -5491 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F66 4190 0 R /F62 4047 0 R >> -/XObject << /Im1 4096 0 R /Im12 5490 0 R >> +5795 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F59 3455 0 R /F64 4225 0 R /F18 4228 0 R /F65 4251 0 R /F62 4159 0 R /F20 3021 0 R >> +/XObject << /Im1 4209 0 R /Im15 5794 0 R >> /ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5504 0 obj << -/Length 3759 -/Filter /FlateDecode ->> -stream -xÚ¥ÙrÛFò]_ÁåKÀ*08“'‰W©ÄÑÚr­·²y€@œ´ÌÝŸß¾fR’Ú”ËÂ====}ý…ÿüE¹žÊIê»*MÅáÊ[ì`æí•/kYO`^Ý^}ý}/|Ïͼlq»ñDn©Åíæçõß_ÞÜ~÷~µVJ9~æ®ÖI’:¯?Þ¬|çÞ¼¿~w{ýî-öBô78ýóûUªœ[º~7N¿üéÕKî)×[ýzûÃÕw·–RKP•!™¿_ýò«·ØÀ‘~¸ò\•¥‹h{®Ó‡+ ÓB%ýêêÃÕ?,*ž ¼jŽ+‘JÝ(UÙâG3l‰<7òBbË°‡s”«u¤NÛqÛw6¦QÐ߾ǿ N÷ Úlñ¸Àõt‚>‹]"Iˆø“ ð‘ïìðŒŽ v½Ì¾Œ‘çlJÚDïjØEãŸo5@s/~|wý [‰³…Ñæˆ`›|ÐM=’–Ó CµÐìš¡Y­a¢h*¡Åƒ¼ÅSå-²AHA^ñÄǾìöÅÚ7T4ð2¢úº^!me‡¸rf`W>lH<Ãñc/Ü„qÏA2è›ßãÚ’¡l–XÌ0s£ÂÇœ(¼C2+= ü‰A·¬Y¶t:k)cÍqÀÑã°äÝàp‚ªy#‘“ Õ}s ŠY‘ Í›ò@t|øža—_Lœp HÀÿ1^åÅJÎý®o¶™ñ•<%ð[º¥,9Ó+Tm‚,Éhv$od2F;qEE§Üó @™Å/J5®]²@Œfi´#M½dØ;„8qû%JA3r†®­»èÖÁ™ÅÅ ô ;ö‚Ԥt~Xïg¤dŸO}¤JâK#«’ÈiñFî*ÝïéF`„î €­æ@{‹PUÞ#J|çš‚a–Qþ£`¡©XÂJËVÚ,ƒJeâÁ}Ù†rã³õTv“ØÒg=CwiO†3»Î&à·óyEÎoÌG#±QH^‘b¾Á]}”:ý>oGÆ™QØa°´×f¢"cÁ–††¾Z<[7J‰'izcG]-©¬ã¢Q #…[‘}gÁ('C|F¶Òno•ýA#òa?â…ƒ{Š‹Gx¼noÅjzÌ®NÅ™3F5š§b3H x^")%l´Ñö½§ŒChIÌ3ÁŽõ{Þ.+´²s=0o¨ûŠ#‰œBD$"j¢… iDIjîö“«+ô¨0İDz‘ÓÕŸXœØú? -ø`…l”¥|Ð{ÚŠg r|¨¸FÐònLà»l ý=y ÷„dneƒ˜Š!΋P1±¡sþˆ‰3[N# ’„Sbð1q0ð%ç¢!\!n›ÕrŠ~à{é„„ÌðÁ˜6 -ZYAgêqc8eAÇP¹"ä™#·SDhŒkÁü¦!Ïl¯51½Ðmöøl£jC 9S„¹ËM&2cE(¨IG€@½hêÂúßÇèvBˆºÜÞ‰ ha½>€g¡™%42±l‘°/6Ò ¶§Ž›ÔÍ@ö²’~ùeB‡6¤æݸbÔœ!ùjÀšu=ªe ±óó–g KŒßžÓ‰]8²!v(D— ŠGrŠ»J+vŸ–V²bÂ]-XYÙaÀ2óË€æ¯ç!x9Ènõ†g$>Š*ò³Æ CgøjŽö&[=/Óöà Éåf–MVT’ð<¬ÀRLÈñŽÅ˜—ãøÞå°¢ÑI”cí;%0@ª˜¨Ñ½>«åè7ÊÁ¤ÔAØåüé_†Ûý‡Ðw(A輿”Ü ˆPiò=±—Ç¢Çõ—²zìoHî­#„Z ]{1Á¸šœãÈѵè -œñ­±åŒQa„#òœ?Ÿuù€œ.%ø% ¡!Æ…HwÏD­Obm»©ÕuŸ¨x…IäÆ©z¶z7¡2U³¾›!Km™*Œ¾áE³Ï…tXßMÒàI<´Ê<Ü2àçxläCf‘ €âp­ežú@y Pß5ÌTäÑÅ9ÚÏ7MCĸø}á»^˜eŠA&m¢~< |}}ðo s1¡TЮ'x9T›:?ÈÜ8‰ -Lê-ùA!ÖÖ(¼9î‚H9¡ù~GžDZ¼Q¬±æ¦¢Ñ3p.1ÚD÷llVµ“ä&Yõ_þ€ï¡„š¶®<>ß̺æÉêDW>6‡á¡xr‚RØÕôZ››7kÉN26|v…¼‡@Úä#ù¿èlûËiÖ;S Á=„Ö‘ÃØ)wN€9U\2ZÒ0kþ‘„[ò?§].k[0Šî2o d9qð¼v¶=ñ,y0lM=tM%£•4š–ëÑ<ʈZs~]S¥‰OßÖh~À°-–g’c[•_@ -æb£~È[®²î°\pv¬‹=›×…ãÇQŠeÿ®Ü2v<¨M¤_Ä=zòÀ$ç’Çs«ó¦Aä© {Es¬68ûÕ {)uôs±>8(¤Ôç’PêÉÃaÌñ‚"¾ÔŸ–© -¶:Ó¿Ù·_8oc´ ¹‚·¬ÍÓ9®Ÿ³²´^Ní—DiWjämÀäÎï• U”q2C)ŵ8Bhy$zM¿ù@j÷‘uãéúa¼˜Ò¿`–Ñöû¯íïAþ_qfã½,y6Éõ! ŸØôwóìzõùìñãç ßJùÑÖ!MЋeWô&öU„@¤l³­ì<Ê¥"ëqR¾Åm¤j -jÒ›—Y¬Œ6F¨±w?½L*U_ôM!xºóó•è9ñ¹¥p8ä7HnÈë6™iõLöã{ž¨Tr”JsBHk ç.&6’Æ~¤ä¨æ¢ÛLº£b7±ÓüÓ›_ Û+G!E< Ÿ¶òî$¯ßøÓ¨0FϨ0ÂÂ%Ó]Î$3&1 ¤%P‰gÅ1Tß[`éÑdW*L%sÂ9k0òµ?)À+Í<çƒ>{³‹¸14? -©¼¥"š.&? âÝ×T-Bˆ+¸ÆE¾ãúçbwz™ -ÆçâPK¦4>÷ÈÝ‹Û|"yG×2û•7ôøN`×þ M¬ž”E4“I:†÷[—¶XKuóðicN7˜WrÕi±ãì#ŽW\‹Ô¹¬ï”<ñsû~‡¦>i çµIþe4°¬÷âì-~Û˜ß Œi tÆÊ=MËZʨz0q¼±\Rn…ð©€\VfsÕAøÏûK¿ìkŒÊMU6o}£ pßЂŒ TpI¯ùà#‚ÿÓZFendstream -endobj -5503 0 obj << -/Type /Page -/Contents 5504 0 R -/Resources 5502 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5483 0 R ->> endobj -5505 0 obj << -/D [5503 0 R /XYZ 85.039 781.388 null] ->> endobj -1434 0 obj << -/D [5503 0 R /XYZ 85.039 475.683 null] ->> endobj -5506 0 obj << -/D [5503 0 R /XYZ 85.039 440.937 null] ->> endobj -5502 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F62 4047 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -5510 0 obj << -/Length 1248 -/Filter /FlateDecode ->> -stream -xÚÝVÝoÛ6÷_¡G ˜~‹Ú[Ú5© ,óbÐöAµ•X¨-%²R£Ø?¿;’úˆ¬x -ìa0`RäñîÇ»ß~,0ŠP‘‰aD¬÷3<ÀÎõŒy‰Ø‹Ä™7«ÙÅ•Ò£$¥i°ºïõ("•V›áÛ÷—‹Õ»Û(B„,%Qœ$&|{·ˆX¸t«‹ÛùÍj~s_Yx·Àíßn##•šßôÛ—¿¾¹t_‚ÐèóêÃìݪCÚaT)Â|š}üLƒ \éÃŒ‘šàsJlïg€“()ü÷n¶œýÞ©r{2p§¦¼ÒJÄœ’„óSsIšxsbdNœ˜£A̳˜²Ä5Ì€€äDj>‹¢ï3ŠOQÔ®·£E˜$)J¸]áZÂGÚî^Ì÷L¿T,è±ÅŒibL4L8LZh’Â?Ä_PiÉ¡RN4¨D|¢ŠfðÇÆâ”wRn­§ntâîöHÜŸqø€„#½ˆáªxx®s Œ±äå⊩Á)Í åè”ÿùkB‰¡ÉÖ›c{ae¤m-j`tQFÜ„MÓòÁ¾©Å3Ÿ$(PšC³p]£äcã·òz ]r±—gÜÜ]A äRÈ2B“ÉkG9P—ýXb!Ó\-5Š+¢t_j8ì””P5uL•’€+¥hx½Ey_¡ÛÐ_Z‡â„Í6w“eußD‚†GüË"ÁÂ¥s'};_¸É}…ûµ;SVe¼@Q0±6°ŽuËž¶¡lrœÖ‡Wj”bœp#Ï;¡—9¥“’Pë0nè„÷9+7·‘½ Éñ•_‘¤åý 5Y¢ †òÒ_‹5rî«· d!¸^2Š"tuúamm#GÑK\ÉZ‹[·A‰lSØ$¨ÊlçDmù(7îã ¶ž‹ÆŸ€˜ò$¬Ã1‚Y^ßãþÎ+ß&Írx%àçP˜‘çHQGŸ?«1¹ Æ–†Ï°d¯”oÜBUºñîfþÎf,Üe â¨ê½F2rÎ'Q8%8ÍÜà F‚ÈGw)fuþ“£–uc†²/»ÜE¼•›núi6f‘(ÂLº]5]¦HÊR/RÝ;4Ÿ(“»È§ƒ,À8í-ïN(„A…ºs]Y~ÿ¼¿õGQ•í.&´*á%µ¥NB\Ý¡ú»[ü‚'«lãö.èV庩ŸÜA¼(¿Íjt…eDV;฿ɿk{îà2?;ŒxÍÝËÍq,ÜêÀ'ø ØgÍXwPçåêÕ<,íé¶F´([V¨·zøî,óáá7–Àwœ@áÇ#.¢‚Ì«¶R¥#KkÅËú¬° °ã2ᣵæß$T‚o§Ý@‰+€}z!/½é­uû&ºÃÓ¢w#&ÆtU”(Ïôÿ¥—’gz)®SBõù^ŠKÕ¹ïÕ^ŠAû"px ûG½T{$îÏœöR#½½”ø÷½”€r¡ÅÖ¾—ò"cl/{©—zþ.Ý Q¤´T®ðÂÄ œ”öé‰ýÃòªû6t ×Éë.¡ÓbÒœ Fßq%Jgúßt\ڪĴ Ÿ£?d£ëY¤ F¤ÓQSðörxd%Ü‘š 1ö †(#¼Ðð_•¤Aendstream +5806 0 obj << +/Length 2954 +/Filter /FlateDecode +>> +stream +xÚ¥YÝoÛF÷_!äåhÀb¹äò«÷”6mê¢Íùw@ÓZ¢¬­)R%);>ÜóµKR¢“â&9;;;;;¿©Ej‘Å~å‹4S~”e‹õþ"XÜÃÈÛ %ÁBûAãÐw«‹o~Œ“… +ü<È«-±¬6¿yßÿôúfõÃíå2Š"Oåþå2M3ïû7—Ê{ÏÔ›Ûëw«ëwoñKQynpø·—Yä­._ý|ñÃj´ìRû:‰pÝ?/~û=Xl@µŸ/?ʳż¾ÊóÅþBÇ‘ëH¾«‹÷ÿtRxL/xÖÌî–ZçıŒ?Ë´Û¦Šg¶¹Ú• ~’z7—aæ5]ÿ~ÝØágòÞÛæ¾-ö{Sß#-ñª¢¾?½¸—¹¦ãgQ3ÃGiS£ÀGüWÒkoš&½bÖ;$=3ûëMsw¹ SOÄ]×kÿ +^ÓØ”wUP­^V‚èh')om>JÿŠy›ºÃ#ƒ,– +–ÓŽwÅ .’xwƒœ²æu¸¿»Êt»rÔ¾aæ~#2q‹\U¾§Ê»&å€LÊõ-ó)w}ÓHLeJá2²”±Óp;p¨Ø“h¶‡É¼ 3hSÚ!qÈl«ßÆÑá ³Ââ•7ë¢"ûàı÷GI&$¥tè} â` æDRŒÖ^·+Fæï„z(ú¾lqÃcÞÊÔN)!Ѹ­–bÌ^Ôhr­¼MÓw°¾z¿+MËZÁ2hs‡"zgÑ—„7º@{®Â“Aõ;”,Ò`Á‘=b2‡=g ¡ ÇÎ-«!òÑØ8°/j +–#.VôÂŽ:ІÀÐ%( ãœŽÅt}ÓöDÈ ¨z˜ ÄMg³íY/ZeguÞcúѱ÷;{qìd©fˬäDDJÍcÝYœ¬ Æ«?((ZŸÙuòITvæ)˜¤P$î˜`• sÙÆ9hÅ£kL øÂ1Vj{‘Ô‚Slð÷³¾4hí'™‡Kí9Ø!ʽ)æÞp%dä.ø!¹Ì.‰) §÷¬%Šd e{pQ +"cê b²¸-;@/ÀçÆtrTüÙ©[ÞÛ¼D>{Ù’°ª²cÁµ”cu‰¬"êÙ-Æñ‡Ü>žvèý +9œ9'ñÎsýA*ém×x4VC«LÑ–ÌsWtÄ2gV…_boÝÔëÒVÏ4>M5Õ,º‘µµgöTE ~_ ;ðÌ'«beÇ1¸(¹ËšuC^uWÉwùIT@²±*²oÅÞ4:p„N®é{gGÒƒ +Õ\6°nŽn¸œ œgòº#äJªùƒ–àìþÀ”kšŠÐañóe‡E&ç)üiD* ôÖHŸz*Ëo›v/«QF…—‰ŠO¥øvGº•üÑ’¨‚UüñRŸwk·ñ†Ì¼™šišWÃT#Àø?’ B³ëÛãZTÇô§{(Å´“FžKçXŸ‘@ÁOWòHž‹s,5e/® c¡C 8©àG[tâ¸ÜH|‹njï¶pÇsÆ"Z2Vró¸.ºùTÎÝÁý¯SÂNר؎?)ßÙʃ„¡¢C²ßë”…ÏB‡ ÏÀÀçL^aƒð‚¦¤Š‡1Šß”$ ò²M;•Œ‹Œ^씩‡vœxýStÌ(-ósÎcöeûcœ ¬üÝj€³ÔµËhÄdqþ +,¨ÖBZŽxy»ƒ0 ZEªðœ£öÐBý‚R‘ò³ðóû}Cg›{Þ]ÿ߸ˆtL¬ +:ï[ +q¸à‡Òž|€mI½Á§-Àç–Ï"cßww‘enÞI¹ Za¥Pcï¡3:™ËX¦-šõÓ¼)»ƒ€9wk +r̹:½#NÙ¨»i Äb:Ã᪼/h§ˆ­à$ÜÆïh±+f»sµCŠÉ3e×Ö€Hûâë¶0ÈT‰tNn|™-?]^Ä-åöŽ€Äq†>O|È1>L 3È +0Šíj-¡ñk‘ô¢"ëpLHÁž@úâíó©Ä|銒Jì„sS>šµÅÀzrå–‚t½2zÌ’L+²¿æczŒÆw¾“t‹Ó®^Í™£ê(Y†ˆ“+Ê㙢T Û1N€ïk΄T(àó¦åã@ ìµVD·×7Œ£-a”W‘ÄÒìÝ•¡íO# 9¸Æ^*¹©•ug¬M»"ŠU½§Àß–æ°xb”§§^„›ø; ¸~í( 8fÞñ•Ý†¥Ä"ŒÛmØÆ" +þý§|f&‡í äéPZŒˆnŽò2rá¥í:›aÈ–8pìä®P0?&º}’†iF$‹ErV-2Ðêé2„§ +çVµO®náLùÑÜé¤3úÙ/ÄÓ=¹Ø'!+ó{züIæ'YÎjN–›mÜŒo°îîÍí¬ ù Hg¦§¢bð…PMu9C#pÕ÷UŠÐEûAúb÷\@}ÝO—è1¹Ÿªôóý’ŸìO`€W'?„aì§ãËŒ½œAB(Ü{ä._I$—¯áÎÖ Ç–Ÿîæ’{“0ñPŸ<áþ*‡?·>Â6uy86˜“šÑôòà’ïF7¥^eMÚ<òR#ØŸÉh+¾¸a2t}iþîÇ·+ D‚dk¦küxcgíšþ0å—qs§á5úæ Ð~¹bB³í‡ß8iw +Ù+ùW:–gi§ÇÖµ,"À¦ûG}sºƒ=L7ƒ5!cêô…Îœêë~kÜÉiÌÊzÙk¡R…dÁDO£ïšTÔõendstream endobj -5509 0 obj << +5805 0 obj << /Type /Page -/Contents 5510 0 R -/Resources 5508 0 R +/Contents 5806 0 R +/Resources 5804 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5483 0 R +/Parent 5811 0 R >> endobj -5501 0 obj << +5803 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 265 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5519 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 5812 0 R] /Length 10989 /Filter /FlateDecode >> @@ -21542,7 +23234,7 @@ y ¥ãj¬> @@ -21551,13 +23243,57 @@ x QW4?uO4U”¯éº*J‚ 0#‚$¸Ý½ws~ïs~ß—s6ÆŒ1ÖZÖZJi)E)…‚žs´ÖRÊ”’÷žÂ‹1 !œsµÖÖƸ÷xïýÄð:Æendstream endobj -5507 0 obj << +5807 0 obj << +/D [5805 0 R /XYZ 85.039 781.388 null] +>> endobj +1466 0 obj << +/D [5805 0 R /XYZ 85.039 611.557 null] +>> endobj +5808 0 obj << +/D [5805 0 R /XYZ 85.039 576.811 null] +>> endobj +5809 0 obj << +/D [5805 0 R /XYZ 85.039 255.96 null] +>> endobj +5810 0 obj << +/D [5805 0 R /XYZ 269.095 113.498 null] +>> endobj +5804 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F64 4225 0 R /F18 4228 0 R /F62 4159 0 R >> +/XObject << /Im1 4209 0 R /Im16 5803 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] +>> endobj +5816 0 obj << +/Length 2452 +/Filter /FlateDecode +>> +stream +xÚ¥ÙnÛHòÝ_!ä‰L›Í«؇Çq<Èx5¶¼X`2´DIÜðPHÊŽýø©«)*¦Ý ˜Åîêªêº‹R3þÔ,<_›Y’*O§élUù³-ì\)Áðg¡çÇný²<ûéCÏ”ïßÌ–BY®ÿp.>þ¼X^ÞÎ]­µ£Œ7w“$u.îsåÜñêâöúfy}s…o!,*ç~Ûÿ¸§ÚYÎÿ\þzv¹±uC/Œ5òýzöÇŸþl ¢ýzæ{Ú¤³'€}O3«ÎÂH{Q¨å½<»;û} Â{áŒOMÜε®ö½4 ‡kªhâšÕeû8ÿnË©áwÏúͪ\f tGQ>iÃßÞ(¸M¸ß2{ï¾|æõôé0šùt¡žÁnGAT®­…‘oàOVôzàC4b$±rnH¯Oÿ[Ó¥cèHsêD;~ãØ‘Þ.f7ylüg§½¿¡!´A¸hñŠØóÉ-]G¨òPƒJ³²£^>KT4xŽ‰Ò7«½†,ºÎ_¦‘OŸçÂÃ6!v–ÃÐöÌ 'wJe2+zë‘YY +¢U*Â'1heà:õÏŸÞñV i±î† ÅN£BŠ5á¶y™gŒ„ÊK£SS_a›:W7÷úâÃb +íGЙSR¤9Ì—.0ä|äÔ–Ë·žwPt†ÄúG’{Ž±¶(®G õ Œ–s:Ñ"•¢› +*"Õ<ÐȆ.*· £ SO׃Y¬Øk^µ»ö³¿Ý ‰þ!ã•î¹ã ­¹ãÀùÅZCHÎ3|Á¦YÖ9&µ©N~UááãY‘,Là,±èåm¾á¬ƒÉ[GÚ¹D°[ O“ó ¸È—1¡c$I™yÙŒ ²æ=kz8C‡Bë}²,—¿ºçSÍã«žF6 ’©oçèZÆy*Àý%Åy¹cˆŠ?z8l]TØ7n ä +¹^6Mqi§O ±tD‹±©kM›¿ÅùDîjÐ|ß ƒÔi o à™EÇÏ7EmùË7TtÐ*ã嬨džôð±çÈЉ{’«brؤ-îÎ%*0·È èéÓO™=aç7¾+.f_†ýìó ëÜ¡çÞ]žËW³A晽¥R̓²Ž#ç=!`œYM`”|€Á/,«ò0\®ãEùbSb#ó#Ï=¶y¸ +Î(ß|Ë|öüÜ«@«"Û^²4Âl>ÑÿDnkd`¯}wv*‹c‰õ…ö›kK׃ÆñËÖ‹Ñ *‡§|ì¬LJsáMØYx ŒEîðKÂÿ?θ +F£hãA?5=¯‰Ž~ìטÓxÞ·´^Ÿxƒ0ý^…*ötžŸ';endstream +endobj +5815 0 obj << +/Type /Page +/Contents 5816 0 R +/Resources 5814 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5811 0 R +>> endobj +5813 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 265 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5520 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 5821 0 R] /Length 11734 /Filter /FlateDecode >> @@ -21596,309 +23332,312 @@ b Ž‘²ê±^`^¸M, l͜¯É4%JP¡4¥]©^Ô’çÉtÐ4º"étsÒÃk2¦Êˆuœ£Š£‘„jO= ãÀƒ¨ÛB/(Ë¥h'M£À•H0DêGb^¸Q,(Óuûn•±ÂÛ˜Ú—Ÿ2—ʘ­¬2û †ë4›a_jÿX¨±|~92WiŒâñHÌ 7Š…{C‘>Ø"ÔÃOú“X/0/Ü ”Üú/Ö@§þ¹ûË*5[Áó™n «I ý/°°¦m¢ }:>6AˆõóÂÍ`a5âŸ@çá˜Tõèç°^`^¸,|­±^`^`,°^`^`,°^`^øj,d^Üœy?°^`^øl,ÌEQÞ ¹ß¦n÷Úú_à 7k¿L/Tå­šü%¼ O·jó›ôB·lͯà…og?T/(ÞðϳZæG𷳪¾¹1/|/0n Ì _ Œæ¶¬˜ØX/0/°±^`^`c½À¼ÀÆzyõóëæ6Ö Ì l¬˜ØX/0/°qŒôÛ±pÊØ>Õ^¦ù>}®y:3Û§š{IŒÄOå³ ‚tí“ÍÍÏa¡à§òùO¥û"œ³uendstream endobj -5520 0 obj << -/Length 105 -/Filter /FlateDecode ->> -stream -xÚÁ¡@PKXBÔÕ†0ƒ(Š’$ü¦‰¢¤‹Šàœ;Eÿ½½wιÖzïåœ1J)k­9ç÷}Zk¥”!$¥dŒcbŒ„Â9‡RšRòÞC­µcç\k­÷xïý `;/endstream -endobj -5511 0 obj << -/D [5509 0 R /XYZ 85.039 781.388 null] ->> endobj -5512 0 obj << -/D [5509 0 R /XYZ 85.039 758.673 null] ->> endobj -5513 0 obj << -/D [5509 0 R /XYZ 85.039 758.673 null] ->> endobj -5514 0 obj << -/D [5509 0 R /XYZ 270.807 575.51 null] ->> endobj -1438 0 obj << -/D [5509 0 R /XYZ 85.039 525.568 null] +5821 0 obj << +/Length 105 +/Filter /FlateDecode +>> +stream +xÚÁ¡@PKXBÔÕ†0ƒ(Š’$ü¦‰¢¤‹Šàœ;Eÿ½½wιÖzïåœ1J)k­9ç÷}Zk¥”!$¥dŒcbŒ„Â9‡RšRòÞC­µcç\k­÷xïý `;/endstream +endobj +5817 0 obj << +/D [5815 0 R /XYZ 85.039 781.388 null] >> endobj -5515 0 obj << -/D [5509 0 R /XYZ 85.039 505.239 null] +1470 0 obj << +/D [5815 0 R /XYZ 85.039 706.019 null] >> endobj -5516 0 obj << -/D [5509 0 R /XYZ 85.039 411.523 null] +5818 0 obj << +/D [5815 0 R /XYZ 85.039 671.274 null] >> endobj -5517 0 obj << -/D [5509 0 R /XYZ 85.039 411.523 null] +5819 0 obj << +/D [5815 0 R /XYZ 85.039 577.558 null] >> endobj -5518 0 obj << -/D [5509 0 R /XYZ 231.163 228.36 null] +5820 0 obj << +/D [5815 0 R /XYZ 229.648 435.096 null] >> endobj -5508 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> -/XObject << /Im13 5501 0 R /Im14 5507 0 R >> +5814 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F59 3455 0 R /F62 4159 0 R /F64 4225 0 R /F18 4228 0 R /F58 3380 0 R >> +/XObject << /Im17 5813 0 R /Im14 5646 0 R >> /ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5523 0 obj << -/Length 3435 +5824 0 obj << +/Length 3182 /Filter /FlateDecode >> stream -xÚ¥ÙrÛÈñ]_ÁòË‚UK,ƒ3©Tʶd¯\^…±äøaw $ƒuäëÓ× @r¶âr¹8GOOwOßšyðOÍ’Ðõt:‹åê$™­vÞl;ï/”@,d1‚yswñÓ»0š)ÏM½tv·ð„nêÙ]þ«óöç×Ë»«Oó…ÖÚQ©;_Äqâ¼ý¼œ+ç–W—Ÿ®oî®oÞã,€Eå|^âö?>ÍíÜ1ÐõÍ°ýú—7¯y¦]oþû݇‹«;K©¥¨J‘Ì?.~ýÝ›åÀÒ‡ ÏÕi2{„±ç*ØÞ]nh™W·ÿ´¨x/˜ñ©)©ˆ…0~ð'®a…^8yhtä*?~ò<9Ácß*ô7Õ±}«(˜)å¦aˆo•zn @NAì¦* ·º+÷§Ò¨ÈÝ€e0ûc¦\/HSÍ £1Q=pC ?]]6@ßlD¢à]Œ‰*©“òS7ŠÃYìû@uB4~†÷ïæ åó…xN¿•Á«MǃÅöVÍwYÂN¾‘m±Â¯<]Êfî'NËó æUÅãûLʪ_”µ\“Ïénå<”+úíäºfÍ·<ÏýØiðœà{ÃmÓõDöª!+§GAã‹+T ”X{ t­a°D²j0é\öP+Äž všt{¸!q˜›ùxÆ ß)Ü9˜1(^š“È ¦èåB@ò#ÄG<]^áÏ¿ôúíÕßö5 6~1ö¦>¢¥àåý©'>úneø*÷ý|hx\ivDÒƒ/„ë2]Y?ÂJ üâ63PȤûZÖ_×Ú{ðŇûꇢ5[ÂÂR®÷‡Ó' ‰‹²&A‚R ‚ØYÞ ¢÷<ùÍSAE´¢WKçÆ°³3ïGô™ã (Oa´æ¯ (ñ—é‘ *-¨aYËzÙá/èð–õÇ;áX v‹‰‡@ ‰Q½cz>«\G¡ÓðzEßVF1Ð/-¢qàlJ긾%kzdÜÅS¶ê«gž”æòms¨rôž )@•æ:Æ9+etzvüÞÐ9¸%ðàIÎ Ö}°©¶+›ºc¨A`«5†\YWäÑóïQ¶H7NÛbs¨2ñ¸P"½½5ØóòU‡z«§œ³qˆW¡qú©ÓöÍzÕ%ç¯ü¸Þº<¹CÿQ '„˜e_fU%Û,!È°P¦8³Šãƒ{ ãwHó/zÅ•¨fm],òbœ  m‹)-k "B_›x£ËqÆ^ïo>Ë`N—Ó8ëø·c! MÐ2Óá'j8_O=/YOù ø¹‡ó{Öÿ‚߇ÞO˜Cáútf÷ßð^¨žh‹l6‚°¹ÏîññE˨q|êÔ‘8Ôú²îz«4U‘3fÞ Ù›Nî»Ív÷™ÎsÇZ·3L„ð@oäÈÄ^ˆ.[g "gÓô<èØÛ:ÅŽ mèÙV¥U/E‡†—úÎݶh‹u3(bä\Ý.qNÛ!<¢²Œ®z(ªF¢XΠ#:³z‚‘¢&VjVÖ¥ùÌ̓u\ŠŸ—/=)踓x,áÕ²jBµæ•ûÃf"yâx/'ˆ<ëkðö¬bXòð¤‰Ýí¹9€ }z(zçAX……¥å ¹•sÝËŽÿ šHÝ`¾ËØñ1B*ëj -co‡§Eâ­`\Óí;ž@nŽIöéry‰Bfÿx˺¼€$°X•äé2²áé:2ˆcW«o×Ä#.bÂóš8àe"®‰¿l©¨ÀáAùK.óŠ, »ž`Á¿ìs8“ÏÃ3ä -à7Cª¡?ªš°&…­3Ûàà–„Ä>£¬}œƒ—ÈêÍ¡ÕíJCá¥IÎ_~azb˜K{›Nuâ‘+aÅÆC8±gz`Äù”ä÷±À)En%'i˜~”Lò -ÖGZd×r–“°ƒÅÂö´ ùHÝO° ¶¦ÓP°<"A†«çy  ‰AtHE²¹ÅWÐ1¢W`†q…<ô=±26‘ «1zŽs°\U™º§ëcÝtmó0„€ýeòAà¼Î›Aò>ÜѾãñq>ç̉¼ºgVìI–%ÄáXÄY jêD´;*B„Äs‡ìÑÀÿŠ}7œGÞ®†2BÊ}¸2_˜c© .³š ¶&nŸxëN!ÚQ<Ö€ +*‰Lìo¹/A­>öuä¥oMørkŠž#cRŽÍå`«ÛRF)¡T6Xo$íÁUJÙ4éR'K\¦w.Ë‚ùçt½”;JÔk¼¤òZ;«F‹4- ­á…ý5½NÙ˜MVŒ†¬曢.ÚLPÛ c+bE1 kÃ!˜ò]doºÚÙ”,N¹wÏéQJõ¬qÉÀU¤­lað—ó4‡ãÏ -Š0¿ƒÇQµ°Þ;ÕÉ]S‘Óáz·VY̓RR"’yÔ¹Õ‰¿CÑuã%“ƈÎel~ +ÿ\b=»·ÈžŒĽÏ\ýÊ?Sã‘·vYmR_ànŸ‰ô§:U}Ëq¨coÀʧ’³5 Ä^â|Á*œ-ÓTä§2'$âºSKžËÿHU@[ùÜ<–Y)µñ˜rí;r¦âªŠÌ<Vñ¥T‚âÆä|Vu êlgÄ- M°æÁ(é=iDÁBÌjܳæm†Â?lÝ›·ÅEIUŒlÈ ·uªÂ¸†þÅö´¤œÆÆ–mH”¢ÙG˜Æù“TœŒ Í^c!Z›6ûX.¦ªÌì¾üJÙ»ˆ\]×Öcs×A§C-%ÝéNúÓ„J?&¥ür«-3Â7©mÌ!<¢r‡È­áYFOµjc4¦ô#”TÁ`Ï¥ ]$€ë99]6¿–œ¸¢/ÊÙ²’s !wªAgªç¸nB¨ÉD`Œ­©á"Í}xŽ/¤¹‰É¢ÂnŸÚ†ÁInYà9ExºšOœ(®žj ‚”æ‰bÒ@®$£Ð,5 -]Æö…ÜÅ„L(®Eà‘†b¸ã%1”δ»qµZÇ‚œ§Â¯B€}[Œ­ŽºI°L*¯Ãéñ;ÿÀPŸ¯‡MˆLÍFÈãÚ6‚ØÐíM®~´aÓz8|è&kF2«x|ÛPƒç¦#ˆö)·¯|§ÙKCÅö· L¹æü¤ˆCÒŒ²‹ÒaçÐ ½kÓÊd]\ È‘ `äÛ>بs­GÒ®¾/F·£‹"±F£²&²™›åîÏ:Úx¢þCv |Y~øˆ£Øw>¼ýÈ ¨Ð¸ zL6Ò.òBP×Ö³Yï ÀãÏ`" ñŠ±?ò$8c 2MéyžfËÓØ·?zÕQ/¶~–lØeeƒGÍɦŽ³D÷…"\ÅÚ“ïÿ¼ŠeQýÙfŠ@¿øqÕMø‹ï‹ßVU乑–š®ZlMÏtúCk»‰çËwV¿Ìümu<~á;«~ù3ë€ö寬ÊO`‰©}ÇÂÒu£ø£ùƒL¾ú¤á ‚u$ȆñËg¹>c÷J{gßWÇ–C4½@Ç‹Ò˜žrF«mY^Ô3_¾¶_ÏùŠ1R”—Ü=$‰¾:j’ò·“‰v,5…“Ð6 ü$’C!`¥&´²3ŸÐ*É_±ËÄi±ÅÑÙI>±Ð÷·gÆLÀ!óJXÁ{Êß ÄæBœ¬âœ’3tõ‰,ù&Ài,}Ng¤÷# -ºfÝsü!ÛÁOƒS)ÅHÓ@ïÿJP•­¸yþŽçÁû²ªXóm‡ºÙ uÙîôŸ—ûÿ=æQ÷9ùþî³ï*M5dá?Ké»þêghëj7ÑétW7*|ð¬Ús}~_§B u↉ Áÿ¼¦endstream +xÚ½ZmÛÆþ~¿Bý +8Ñ|I>®ÏNÎ0œ«}W£Hò'RcŠTHÊçë¯ï<3³$eñŒ´F‹¾åìììîìÌ3/Š»pè?w‘„¶ã§‹8qm?Iëý…³ØÒÌ®r8‹Àv¢S»½xö*Œ®c§Nº¸Ý0Ëmþ‹õâ§ç7·/ß-W¾ï[nj/WqœX/în–®õ^¨7ï®ßÞ^¿ý_]ëîÓ?¿[&¾u»üíöõÅËÛɶ«À"ûþqñËoÎ"§£½¾pl?M4vl7Mû‹ ôí0ðõ»ºxñ÷AŠÌ Y5s»•áXÑ©S/œ×À +7ÓA‘]¢„S€À¦ Etû0t¬›¥ïZM׿_·å¡§kG±… ·Ë•k•4¨{ŒŠV¦®ŠŽ‰|µÇ¨©eêW'tnn®è B•2ŸïXźüÕqƒuÖ—Ä~®DÏN“ô‰[ù®í†ã˺áÌË~ØÑAʪX®<ç÷ºŸO¸Æ¨nèy‘UÖÂY0SWàßÚpª”²“¿ÙDh¶åÉ„õÀRY|+ü&«·G" Œ¬"\½Å@TßÈ߶8àTÅô ^jõʵӃTXlUñÈ×;*[Éúä燤¬ Z¬¼øTÊ•Ve›­èIpõ:/jHê…÷aÉweùI`]ÕuèˆYµÂ¢Þ´­HH. |÷QDhýk¸ïä#Ó«ñ¸âå¶x$²² jÏKü»êq©VX÷tÒÄ*¦³ ¦ûÿ«”Z˜aY›ËNm1£•‡²ß-W“Zƒ.>•Ã«ó5;UÆj³²bSdý±-:r›(ŽèÒQŸ}Äž…0²0ìÏ_ÍFþfU%ƒ~'[caŽ ü¢-êµØ€E­Ì½£ -]}›v\™ÑkC¦Äà©.Èq…C£Dä’­<>{˜4°çÑs|`ÃW‘­j‹Æ§â‰Ä.’Wo“¼µ¬6xZ õK KižH<’õ†3Ÿ°~7œÑiçîUr¬‹–Fç~"Ùì¥ÐĨýXe q6fø +X`8´ÅÔég€ÌÐÓgþN¸î®ÇÉ2«š­}›þæew0ÉôÉĪhñ±›EX@9Õ‚k¬Þ5%R7|s°K& 'ò<ÃŒ0ƒš‹àüº–‰a3¹0´–†'“ÇnpíÄÓR¡tÓ¬FÑ ºF¼pgÌ Ä¶¬¾‚/ <•:žnIv¶.v®„y„ýàb3¾Ù7¯ß`{Öëo„– ‚0;G»Ê =,ìóZ.Æ®~©p{Á—˜HüTFi¼ ¬‚«Â½¦š§W'?¿øý`4“÷#,ÍÙ›N“FûËJ× B;öb‚Û(²=ןV¼g5¿K˜œpÍo“=ü‰ƒØnàÎvpªæèI1¼È!12RîS)¡í'T|Ó±œ±Ë3]‚;¾\³yPd=/ù#ÏN|bЙS7@wÿMÆ|Úqž]ïýÅUCçZŒGóSÛ £zŽ;ö +’™^ÁsŠ ó©¼1Š€°ÀEÀ¸ ÀãCKeÉA(ÄbrålD¾fä}&(Ës“²S*¾Õ©™z“XG;&tBÜ°7Ï‚ÒzWR±Ï9Œï0FyZ‹­VD8ðziŒá®Ö첊òÿ¡°¦O@ŸÒÞ¢ct) rIa‹Ïê"ÃD×g‡i|”s÷ê(x¬×»"7e—cÍ•g|vG\[ÝíøB1_d[ôò½Çýë'ñ|ú2Nê¡ÒíE ¹»~"tc¾øüåFô”*HÕ­[L…Bkº÷˜'z®nÂOÞSU˜ž{-÷$ÔªãˆÛ 5ý$=aÊ^ë ¢bü€v‡ËAxÑ åR(éWÈ{ɬÌŒÙW"ÖÝËp#iIl6Ä÷Qš“l‰g‡+ʱÄÆ:IeµQ¡÷“tͦ—8$=¦ÔšíÏ°Á‘±] +¼N¡6Óúûê•ÂmÙõeU !"çÚ¶Ù6v†¿~”>þÆ‘íÄé7!ÒI;&œZ mÛÿŸW.jB²h'ÏsŸè„z™Aüçú»±öwﺡ¶‰( åT9o–ä{Ýê7ñl_r,âú(³IÒžðÍU7Û¸õŸlG'núõÆí‹»›÷d#‘â/ +p|hÕ-þCOz ˆ¹’a/îKœe6´O‰ohðjþKiÑœ SåÇGîXXD®ÑPuáRŽhªÚªTÉÅ£±ÁAR•r^¿›ûįm)œ_Ž¹¼GåÙFþr:4à€¤Z³`ðª¶Æ”k`y‹ñ­Œ?¸BÇe2˜¹Û;]M^s)#´TdŠíËPL0©NÙK1“•9åÔZ:³z[`-GT­þýDœˆïzâcij;rÕ¡‹×‹îµéz¦Ò–‡èLÃPÛu0š6¢Éf@rÓ¬“>Ÿ7<™€/ø¢JÌ¿óa–½ÐTèfÂñQ=—}´•øöVÖM°ÓÒl¥—œjjÝ+xÉ_žL¿S‡à?ø¿fß8ßq”}6ÿvìÀK¾žß蜃uHÑ/ÐŒÛ%µ¥©dÙÓñ7­{*å¦{'á×Snók‰h§zÀËõG¡jãËŸ–ø$|?°#j™ßæÀÎx’_>Êø†[ ¶Õ+MƒÀÚêÎÒ›êÄ#$¤SGL¤v«sï~” ùsak×÷‡ïŸ={xx°×ÇC'm´•7A±¦Ý>ë‹®?rû°;{Šû¾Mš×3q4°}öá¯ê×tgɘ›7Ùøù¸äƾúdšj\”˜ãŸü8Gù`¤+ÙáéK: …,”'"j+Pq¬úNÓnŠ©suOÊgèb' µýØr6íÞê?¯# +z€3ô‰j 5Hs‡0&Øí¤kÏ3›AL+k¨$/’Yó–Èù¸Þ ™µ'÷Áפ,Ñ^ÈR- E}Mî<–³ñyaÌ'ÅIÇY—‡_Ø8 Ò`½S£eZ±6¹{L©€†fÐЮ%…þ€ãxæ×A^™uº€[Ž¼;rkª=¦ômsÔRDšr^ìr€ÔµuÅ2ç2ò¶è(+Xk£Û1²jr®µÿx5óCÖ©áéOl-c?'ë¨`Dã:ЉgƉ„Þb¶yþ·áæÿ&U'ž ˆæs_Uá·ý_!~LÈ:<ÇWÓh/HÏ‚]dûœéÿ L±pendstream endobj -5522 0 obj << +5823 0 obj << /Type /Page -/Contents 5523 0 R -/Resources 5521 0 R +/Contents 5824 0 R +/Resources 5822 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5483 0 R +/Parent 5811 0 R +/Annots [ 5828 0 R 5829 0 R ] >> endobj -5524 0 obj << -/D [5522 0 R /XYZ 85.039 781.388 null] +5828 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [406.399 117.186 500.027 129.179] +/Subtype/Link/A<> >> endobj -1442 0 obj << -/D [5522 0 R /XYZ 85.039 503.818 null] +5829 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [146.561 103.637 234.462 115.63] +/Subtype/Link/A<> >> endobj -5525 0 obj << -/D [5522 0 R /XYZ 85.039 470.272 null] +5825 0 obj << +/D [5823 0 R /XYZ 85.039 781.388 null] >> endobj -5521 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> -/XObject << /Im11 5348 0 R /Im3 4353 0 R >> +1474 0 obj << +/D [5823 0 R /XYZ 85.039 761.463 null] +>> endobj +5826 0 obj << +/D [5823 0 R /XYZ 85.039 740.47 null] +>> endobj +1478 0 obj << +/D [5823 0 R /XYZ 85.039 307.173 null] +>> endobj +5827 0 obj << +/D [5823 0 R /XYZ 85.039 274.956 null] +>> endobj +5822 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F64 4225 0 R /F18 4228 0 R /F59 3455 0 R /F35 3036 0 R >> +/XObject << /Im3 4496 0 R /Im14 5646 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5528 0 obj << -/Length 2812 -/Filter /FlateDecode ->> -stream -xÚÍYëoÛFÿî¿B -”Bšûâ£÷)m’ž‹ÔucåÒCÛ²HI¬)R%);Æýó7]’²)_p¾‡ Ö>fgggg~3;³þ‰Yb‚P¥³8J’ÙjwÎ60óÙ°¾%ñG4ß-ÎÎß™h& ÓÙb=ð16j¶È~ó¾ÿûë«ÅÛs_)å‰4˜ûqœxß¼š ïšG¯>\\...Àž†Aá}¼ÂéŸ?Ìå-˜èâr˜~ýÓw¯¹§‚pþÇâdz·‹^Ò^*E1ÿ:ûíp–Á‘~< •&³{h‡€éÝÈ­l¿<»>û¥gÅszÆ«¦´â(|8Y*Íóš‹D #ÕkN¬RcÆš3a`BMš–:€ÓÆ 3cBÐt®PgQì­–7mŽÈ[–%7>UVÏ•ðîç¾ðZX䯡zÍnÙuyÆëþ#¹¥lxìêêM{JV°g8ÐÐ…™0 *bËøˆ‡‘‘ðV((;Û9¶3ø[æ8"ùdØh÷ð›xùÊÇ«z‡?{¤,`µL½ŽéÈzà(¼š~•×r_Ÿ"Ç…ïw3–Üî¶vËòK¼Ã…!ñº4›¼±\×uã–À8ñ+ìÈ®¬ÛîzÕ¸e‡*Mùm%¥³ïj:I–—-Ü®–Â{ ”w¸’xU¼K±f–K>ÂÇË‹_ÏßtÔÃg¿(é0­hPÒ.gBfDJd9áD$" l¶8i5UÕ¶±]â¨yìrRAWÔUž1QM:° -ÔMѱpÝÏ×VvwŸE;¥«àe -U†¯œ7xVÏj.c°=.›0‹’=.GzxÒ0Ð$š4&õ-µÏ4Q -`³¿f"uš*¦µIæá,4p~±bö¦éf#-[àËqcìB¦A›™Id -¾àÅ<ÑJK¾–ƒW·<ÚFÁ:†ÈÁ]{ˆäd¹¼Šì~iâÛàq¼üM•£jím¬]ýX[*I#T/2ÅLœh6–âÃ(z:jDNjPcW|ÌÕ°íºý·çç÷÷÷Áê°‡@ÂaRPf2vˆºÙœwyÛí÷Y°ß>¹])L`@ÿ&J A™Nb?"zzYÓ £†ÅÇ c_ÖË¡û€ лyšÚ¸0Å?é¢Ü!÷,(Ë^›»‹ƒ…Œ0ÚÐh{(»–²¢Ý—Kñm2VXŸñ¶ØQ˜Ì3² ¬åf¡¥“!“ E¸Ä¹PŠmDu€ôÖά{6 ¯üKy–2GÉ?»b5µ’ð<Øc4ÃV¬,°ápQ ü±¹,'B-Y°„X€(Jª« -m€’‰xâJ=ÑÊe+ÜÍ+\uSæÙß`ÔÏŠpyœ_KN…“{Ú™%v¹ˆÛ kÈ nJ»¦Ã¤WWÞU>q0È êC³²˜ÞnëC™1VßP±丮½f‚cÓƒßC¡J€jOi뼶Ž5vš@èh6ÖÀ4ÆÆ3¿f¼(v@.}Ä5b^Lq5®À- ×(Q´µÛ*r}ï UŸ-Ä ^t`6Aí´»¡'t -†…G€IRVí€JÅÒËܵÝ«Ü¥‚±²YhSÞJ÷µ)*w½0~G/iÜÍﯴ¾s -ÌÜ{wµÇŠ¥Åbw?Àm‰9ó=nÇÑ«ehê…öf­¶µû«Sp5rÃÿÞ§ÿ?ÑJˆÄ|93ù ¼’ò?‹W -@ñ2f‡AØcÔÿ0e1>R*J9»Xcgì,]ŽˆÒÇ}œ^;T#ÚŠyldÿ¸ö.wÏ(vŸ+3½'ÖSßS!¢s×bÌ]ELb˽Zo¦$Àò¡‹_s¼õ?ÚÈf'Ñ‘–ðý^-wùT°A¤\À„W~M±‰lφ€–‡ìb›ƒYÚQÙ@‡ -ž ›nÇnòÀÃ÷G™u3ð¢Ò&RŒ³cweÄðøq¢Ì['/{0)Àžh|þ¶ë}²¿s|Ëhã½+lðPìú`D·Ü¥Òüò³ - %JþšDç’‡É<|³ø,˜sí§zÄ8ZÎohN»mÕ:=øPöž“x·¤ÍÉŒ{„Ì/Àù£–¾8øÈ0ˆEúli\†q y«“µ‘è>¢¸Ú2UûÇš)•Hmý¿åº¿M,`l=.êWuå_aßADg‹ýÍsN”²D"!£gO5¢9YðôÆ£Š¿6’ŽàÓ´Q#ÌA«6z\®á -üäiWÍrÝ ÖLcSZît–é–ƒBvY Râ·€Ž§öœ€Su*OÀ³CvH{€ ³›ƒ|Ëf*e;´F×YT\dž-•E¹¼±¬¥ì3[êPUÚNUð[ÃØc?Ž0œ|…άÆaêáßØ­ÿteo·ÁÒÕAi`kc¿«¼ QYpT>g2žù¤q¬EÌpSïž> l¹3äÑ©-ÔïlogmÁ‚‰­ÝÃTâU=—Ÿah[ïûç=µÎîÅŸ"nmY:áÒsÝ<ݼ¢G¥(½E8Øï  ù¨ Ã[w'1€£gÂ& ¬ÕSÖ@æ«;’Ü}Ú²•o÷¹©¯”Db01ü|B©ÝPáš?¸ôs„5fú€ŠÝ=¿yXõ.ÂŒùØ úñÈÇ_Áèdð›Ã7 Ñ“(ßÛo)ôe§ß¬~ôÙŒ|¤ -N=)`¿é9TÙP±~ျ[vãÚ{5|¢rw‚,šm‹._u‡&§è¦½ëÎVý8Ñw< N  -ž§°þó•¾èCr˜Z‰J§ÓHx- ' *N*óX^£ªÃ>øßBöeºendstream +5832 0 obj << +/Length 3074 +/Filter /FlateDecode +>> +stream +xÚÍZëoÛÈÿî¿B +”B†Ë]¾ú-Í«>\7Qw÷¦h‰1EêHʎﯿy-IYTzhŠ¢`îcvvfvæ7³«¨…ÿÔ" =_§‹8QžN’E¾»ð˜ys¡„Â_ÏBœúÛêâÙë0Z(ßKýt±º!’Õú'çÅߟ_­^}XºZkG¥ÞÒãÄyñéj©œ^ücàÂsfÁ«f´sµ{‰Š±á%‰™ÒœÐªh› ÆJÃ? ™2ž2jV2Ð/Õ^žgC‹|`Ã-¡>æ©- ðÇŠÌB)/ÚÉ}^*;Y[/]å”õfÎ܉—Æ)²Yü +"§Ê QñߤMÂŽ‹hàÙåN/^6 Öb”L§ .¸Jì&dSÉŒó¼^±Ó,ƒÄi—n áSd·®p´éúy[î{ÛeYƒïôªÓvOQÐ<œpWAr²ÇºáÅuÓ3í‘$4°¤‡®@ÚÔé·Å _m¼ ŽEwñïeÉP*²14ò™­ \`d¹(=#¼òÀjL”öÝ„y9ÇÜ<Š”,¸ºzÙ±7° …µ°\yQŠnŒ1‘édÆÃW±)´ë¼ÃÁ”³P6qþƒ:õ[ˆ^£Ñ2Ü]Ó1Ü•9}á4`4¢¥PT4&~妬QŠÇïŠzÍ{¹,BsW®y™rÖÌÕAêl¤à¤Ž¤ø‹rîq“ ÙüÚ:Ûs9Ò‡¶I©oІlCN—sFèxØ/¶9uYw:ÈeË>Ûsl<ðð½u5Îï#¯¬ª˜â´†”dî¦C UÑYy9lÉ¢ÑTÿ®Qrr0šÐy]JúÐïà>·Ü1è; ú8—”6åÖÁ?“èY0W¤p\–®;°ÿƒ…˜ù€(v'®ª0£ ‹£8a‡=”´¹]RñçÍy1xL¬¿èÿ«IÏ…2I€\*â4ž¿ ¸Aé.Pcà$«ãþ gúp9A8ÅËI;Ï«®ÁVä|êÐU°%uÌ‚é9±CÑÚÔîŽ5­÷G–Ü. ðϾhÙÝOxEžQ +ÒDiR…sw®O(½ ˆ +:c ÉPOP }>4’xU=0mÞf7ý¤ÞÂ1N3wzaºå$QÜ­É#‚¢æ=Oí)kœå;°vq·+FÚÜ–AäËfKºCw ªŽDUŠ*wjsß-CH#e•]W‚*pn(cî¸3@´ïp éÈ0ÔÊæ0…©)«QuåÈñzšê•àéÿáË`cè³[ÙâñÖCÒV’´Iú¥ ò£“Ô|lLp«8uîK<±-w† +Ú$b7õvâ°t(°ê†{y=‘æ8´mö72^ö²‰ØÞ²º:ñéJÑ´§›ƒGØâeÐËæ†Á?Ï¢íJÌâ¸u/`Šùc6Yá“@3çt~°ºç3Ó(¹$cüA"·à‘Ñ›uÊ7:ý[¸AU°|ѧ?2Ó=ß…¬sáäš(d‹oºRL=A‘Tµá-²áï9ÞMV§RìÉÇfÜTIFydŽ|Äv”c„¤\¸ád`+:KR6‡´»LrXÎ8†Wª1<ì±`iéøÀ`ÛrȲyR#¥E~Éé3¤{Ü„ÁQkoóbÀ5mΡxêéH¡¸ñà&ùÅCt“‚“`‘P0ÖŠIŸ_—ƒA6îm¾-û‚d·ÅÚ ÇIz‹¡ŽSÁ·±xEe%”WyÓJ‹‚}â’8&-®óèà {`_*vÜ/;&¿Îº¢¡‹g„ß7È»á%E||‹\ +M¶FG+ûÒ.ê—œ*€ýìú§ç=BóÀ‚N×’@«é'õŒ¨©ŠB&Aeß1 ÕZ÷5E}ìü‹¢þ`W‡¾…è + Kï½<+&6¢jÆt¾"à°¼—à[ÐÅ·³ÎŽƒû +}u³žP¸šçŠiÒ8æ]cË+Š¯I*p ÑaC5`èªW ÔW´ÈgM7«ì8®mÜ’% t;î[”€[J`eš][g¸×bvHÎlËF²Ò¿½|ûŠg{2–d© +¯&¸Å +>Ìxy1cÊŽ#/Žô§VÒ×T¥8&ÏFÚéÀ—£0t¾Èu Xó4!~³š¿eMÙ¯Ì*?ô+¢zâƒUkA›Ÿà²Š{-C5«Ê/¡ÄgcðVŸj@”²17åwõÁŽÀM¦ÂŸ«A\„"Á%ý9Î&XѮ僀ÎÑA0Ãr·¯J’ :¿ñ94LM_N÷ÎHÆ 8¸»Ò–I8C;Í0–ã¦ÛŒ†dŸ¶¨ àL2J½è&ûÎg&‡JqRXY}Ön +|;ÀÈ;*lÐÓ@Øž:F€Ð"L·p9%PR'?tC‹Ì†;ìÑ´ß±!i1RÈ•³ÙÔ#0"=•ØøVjÄùö0‰âÙP@µ8ÌrÄd£#LG~ÊÙϪα`G§÷ñåCp ÇßPüÔB71Ç@(s.æqóè{îfü‘šçvðv;ñ?•T DTT§z(9 áˆû_‹°™àš̳+ƒØóá>hßÙ“Æò”IFlËßFÜÔŽ0¼ÂC’ 6Ö›¨ë¾?Ægy®ÁfG€VÙ²¥™0ÖÎuÙï2„ˆ§ò”Œ [Ê»riÔkê‘ùðÀþˆ)‹' ^Ý0¨þu¦úPPøBæš«?T5‘á‡L*?Ž^€lù:ÆùÚ·Ÿ¦¡¼3üû’FGú¤ÊÅ1Ò›æøº‰sÞlá +Àá:Öÿ‘ž¾HÚó’øZ‰8‚›™Ò&·Ùaß=±Ò„~¿µû—²mWÖ¹ˆt|Å€9…å©P +”‚ý4t –äÒtÄ“£ÏØ É!!–9S´Y×í™Z›o³ƒ†š5|ýéï¤ÄÃ2~rRDcÀ±^¸Æ÷"“üúL*ÉyCˆšúâ;ä38}ä38ñ 2ÑŸ–Ê‹é¦ëÇghÚ…_¦%JßYJÙrSÔ!9waûãÝè2j‚Í ûnîÎe»Ç+òðN®0….F»áè|mcÌ{;>Àå²;´Ò²üŠ ³¥:OkN$\ìC(lE ?ÈášÓàÂQ«.RçÍn_VÓ·¡ˆ¿…œ0 +úÜòð=þBÈ¿fÓ‡MðH§â$' ¹Û™7mm<_Û7Ð/3¼\ú^¨ôÑAlÚbÅjJ?–ÊÓjxüûh¤ƒçÓCC¤bçýäÖr_¢×ê4˜¼¥‚ 솻mŠ¯öysàrh¸ê ×VÂüº-2ü½æô8´¥‘ˆð©Î® + $—Ã/øñ]Ñöܹ)í´?£Ž2Ê‹•Õ‡²Nêw¤sGžÒjþš+Öü¾ÿm¡cOïéß„Š ôË9Å-+àïê5endstream endobj -5527 0 obj << +5831 0 obj << /Type /Page -/Contents 5528 0 R -/Resources 5526 0 R +/Contents 5832 0 R +/Resources 5830 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5534 0 R -/Annots [ 5531 0 R 5532 0 R ] +/Parent 5811 0 R >> endobj -5531 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [388.516 578.594 482.144 590.587] -/Subtype/Link/A<> ->> endobj -5532 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [128.678 565.045 216.579 577.037] -/Subtype/Link/A<> ->> endobj -5529 0 obj << -/D [5527 0 R /XYZ 85.039 781.388 null] +5833 0 obj << +/D [5831 0 R /XYZ 85.039 781.388 null] >> endobj -1446 0 obj << -/D [5527 0 R /XYZ 85.039 761.463 null] +1482 0 obj << +/D [5831 0 R /XYZ 85.039 494.207 null] >> endobj -5530 0 obj << -/D [5527 0 R /XYZ 85.039 743.459 null] +5834 0 obj << +/D [5831 0 R /XYZ 85.039 461.99 null] >> endobj -1450 0 obj << -/D [5527 0 R /XYZ 85.039 207.299 null] +1486 0 obj << +/D [5831 0 R /XYZ 85.039 365.382 null] >> endobj -5533 0 obj << -/D [5527 0 R /XYZ 85.039 175.081 null] +5835 0 obj << +/D [5831 0 R /XYZ 85.039 322.429 null] >> endobj -5526 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F65 4136 0 R /F41 2994 0 R >> -/XObject << /Im11 5348 0 R /Im3 4353 0 R >> +5830 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F65 4251 0 R /F20 3021 0 R /F41 3054 0 R /F35 3036 0 R /F15 3032 0 R /F62 4159 0 R >> +/XObject << /Im3 4496 0 R /Im14 5646 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5537 0 obj << -/Length 3684 -/Filter /FlateDecode ->> -stream -xÚ¥]oã6ò=¿Âp8ù3¢¨Ï}ÛövÓÝmn›}8ôú ØŠ­V–\IÞlŠûñ7_”([I  Säp8œïF/|ø§i¤|“-’T+“¦‹õþÂ_laåæB ÄJ@VÌ7÷×ï£x¡}•ùÙâþqÄ©02‹ûÍÏÞ·ß½½»÷i¹2Æx:SËU’¤Þ·Ÿï–Úû‰gï>Ý~¼¿ýxƒ_!Ljïó.ÿøi™ïžn?ŽËo?|ó–¿Œò—¿Üñî~ t ¨ÊÌß/~þÅ_làJß_øÊdéâ ƾҰ¼¿:Uù®.~ºø×€Š×ÂïšãŠ…XÁͲ zs±Valΰ*Æ.ç"_E~Hœ”°+ -3äövÜ9Ž‘wȸ8ñÞ—ÀŒª/Ú²ÞòÌÛv½+ûbÝ[ÜR¼Äœ0Q‰_'w„!ru4#h¨ØgAß#}a˜x릕Q󈿱×Û%&§þãëp [èž;¤»/öü]vüû 9-Á]ãÝ@ÿR‡¬ Š@p$èf×t}·n‘I‡ž¡'—ˆ€û‹j™†ÞmÍÔå› îêËF&ú†O½YB‹¤êB]!îÅÊø™JQ@%"Ö}–Tê{Ç®À~^×ì 5ýn‰b‚µg´ËF."Ž²ï¤Y‰÷T£n¤‰÷o4’æhwG>ìnÙó2HaM¾~“ƒá\(ê Ò&ÍÓ{$$ǵgž@êr<Ž7ðä¡:¢Ä¶DöFˆ«y­°€Ú#‰!aFÙ“n˜0˜ÜnÆ©eWè{»ubSç‚âfó>ç‘E!éâû¼—MHd½qÙ {,¿‘æË,ȉ×!ò'- ÕiŽÝŒ¦™(S~‹ú|¸ÀïÐ#¯>,#8¤›S¹TEq:*]6ûŽYÖ>³…:QqNØF&²Æk4{¶u<êOy=²‚ø²Íà/é(2®EޯŚMkÃ˨Òø›“äb8ƒUx=cXZ«(°–•ûf×Ä 5"ÝÎ]È’ñª±± C )ÚÁÚ?Îo -и" >M="IÆÛR´–ùÄàƒ"=áÓ‡Û°åSXA_YÄh/ïaäˆFl¬©4…{oIŠð!ÄÁÖ„ô–ûCUeðñkUÃÐdpðKDF%{AC²èʇj\!‘9îçÖxè.§)9§-*°)_Î’–»É¹èYÏ­ŒM%·°A6ø^Ÿ·Û¢Ç1p)ELE‹úÄÞ£‰ èª yBÜNŽ‘Ýß±cÜ1²]ƒxžøã1’Λ2’6#D˘›-^¶Èk!”—éÖ£¨ÚnlbüˆÒaBdMo5˜¾îñ~&F%Dïæg`à"í“¡ Æø)X¸AÓ?#œ 5‡S®óªzæmŒ£?ø3çŸ'ô¡Mû±{Ësg -à“$ìtÉ¡Ô#©bª‚Nµ÷\çïÔs¢„~'| žRÙ­A¢|Hqpëí#'\âaÔÁ©ýcˆd°$ïPH¬äýOÖU‘nz¤Ë.%#9q.: àt-®¢Î{Üjö¥¨žg4ÎÒ ²)NBîåÌYl(LlŽÃ¢59ëÆVŒmÈ'àÄ5C´y–Á`dX<&4œ» ¹’ ¼Ëoñí€Åz©^Ò»¿Pd80¯èý©Þ½rà¨w''Îës¢Õ» ó%R­öùé‰Þ!ÄDïp"gÈË6ï&á­åùM+®±½Ä‰Ì{Ú±¤È±È|`éù <Â¥p[Ôåkþf·ˆh¬Ôñ¾áßœ†¬ó‹h‰8¾Ó8-™ÉÚª/š¡Õ)×é*Iy€ñB€Ü3áŒ'ÿM®bð9¶2’ÌI|Á‰©JåÂK,³¹ðñ%a†OØ‚{N,§¬©ãXrÕCY9Ùâ+/šùìX ðë7^}*á,rüq0qü)Tâ6 Ý"Yqæ­vüû_ÉŸÈ1ïm[¸Ë ‘Þpk K×N܃9”:Z"õ pãK¹¡`ëQhq@YónîòI¦’ÐfBï— ªS„©v9®1}âá ;´AE`³3Èé×+%µÈá،Ժ…ºk¨èu,LÄï!¯Ç ½rÀg\÷ N¤éִ毮‘o9Ðí)qa`T ™Í„¸Óg y¤SLN"°–{òQ(™i[Å€ÁºÊ¥¸fu„ãLªâ(;I^.Èc°¾i“s¯“hò¼"ëð¹+ÍŸ]¢T(F/MTì‹^ÂDìXbl¯p(ìê¿Ë ùd„–Ë„gén“úA{B” Qö¼soÈLÆ>0ÉÈm§ g&!m4Ã$ ½ï(IgÏg“i¹5Édxͨy0¼—dÝŸØaãÚ¹˜˜ -Ùü W¨lûƒÓíjð½Ý±¢P§Qž†ƒ²ê|³:o`ƒÏˆ³ña€œ#Ïí¥»añW<}ž?ð>ü(oqóœ¾`Rþ { ² ïbÈø(¾K] ;Ûc5~Ð3gÌùWž+刂òé -øfé-…D.'dŸË̦çæ¤;‘‡É?S×$S… ,¬Ìy%ð‚€Úñ¬ôp{LÊ)íÉÖ}¹'0uú*+H\“Ã?'NÃþê‘þÐAÓÃ-`íʽM+ ¦ŽâV0íM7ʪ´R -e÷†±™8c•)vTl«3d\x½ëÃŽ$ˆ<E0èzüë´rÿêowÿ|OÖsîäW.âXþ`†þºŠªÎ¿w¹l/¬l¹Ó„S²E±€ÑÍ=òŒx 3@0µxp¶†&/ó}¾¥ô%¶B¶°™iZűJ2Å3L0“Øàh/ß–Û¼lå½mã‚èâij;(Ô˜> +stream +xÚ¥YëoÛÈÿî¿BW (UDk.wI.EÜÅñùÐäÜÄA?$ù@K”Ä–"u$Ûÿ}ç±Ë‡D9é XûœÇof–ræßœ™Pø*™ÅF +eÌl¹»ðg˜¹¾v…?ÓÂBœúéîâòMͤ/?™Ý­iÉÝê“÷ó/¯nï®ÞÏJ)O&b¾ˆcãýüñv.½}ñg+`í× _¨ÄÌ í ™$³Ý…•µ²ýââÃÅ¿:*<§g¼kâv ·b¡|aŒî®)ék~¼ÅÛ„ÆË꺪yc(`äÛ<+ÄÓÛ™çù(ª ³ñÙ—ºÈ@Üaàƒ AN$Þ$›Îã}Å~–J/ç é`vßü…GÓÆþòÏ +æ2\ô9-·Ûs(¹ù„T+$S3#×ÛªiZ]ãº}û&"Ý­¤mYÞny»±Ì²O¶0c¹ß§í÷mQ³Eä‹Ðf ‰ªJH×ï>ÎZÃÁ°‹ÎFšË:ßC¿å©´\a#öj:p±¬vø‹+ò"þt{ EZsh²cuJ­…ôUw.™NÔ»âýõ3JºB¿}ŽË£óÀe¬Y÷ÎNÏ“G3”­PµN¼æ°Ÿ/‚ 4ç« +<Í +T˜¶¹³ +œÎþ½úpËâb£ÆòÆ#*bß©ŸG¥!'2ñnhhÚk:+cnª¯®ƒÐ++»ä?‡¦å!ò*é½äÞ=4vFù>7ª‘ÝàöUö5_Ò€%Ü‚í ©qï³ú°ãÁIÎl8Ø8§„¼yHy¯ dàU% +ô‰;é={`»Ã!i|8^‚X´Š½ŸˆÉeŠÓà¡kü…ÕÛܼGYVéÊ’?´{+ìžñG˜™2:Œ¼+„Ý[>æzxIòLÞío·ÙðÖVß,ÈUã”*c\2&aV8¼&;ƒFY•0¹À©ùq¼a¯#YXEV7¨n•°Ú`¤%±wcÏ"£”Zêwj' +ëÉ»¬ì¤³â}÷¸ü‰ÛÿÌKì¡„Q¢5÷[±¨Ü†)¯ñV5·É]Š ™4{gat‡Î á±ðéûP¡ÌÈSøh¸7 F¾Gü§ŽY¸g¯ÅH=kÑq7ÊçÉ|p.{*(hà“fêj¾OàÓv ì- xÌoeÆãh€øë| +©î*òF%ÕV»(“ú ‰§ +‘f¾æ+Âï¸=¶Ñ¨ a¼7s£Äv<ËËAb-¦¤%¯çÓKîÈZຆÅGx æ+bß̉F‡ÿ/>—yˆŽDGcvs‘’ð[±ûŽÝ>æ“É72;àÒ ¢HZ;y¤l— ¥#‘èè;!àÝ÷Ò=k-íÜ=02ÞªÊKë ºƒ õÓœPj0›—üK¢ø0Ôf{ ‘õ^˜^UΚžaˆq_ËÁ­¹O¦‚ ÊN”– xËãýáí¥«’ÀP[TU½ al—–Î&qƪ-y Å,ç_,¼ ³.&²ÜIÍp´äT`û͸žµn ÛÈ¡I7D‹¨Ç½ÓƒHZ^Òa\s °Ýð0å2x¤‹‹ ad­U”xC“ÎjÛ1¯\<Œ9#´ñÈì- 2T$U;_ ­Bµ8ñ¢.æDf:æÀŒÊ» +Ó1ì‡N:/>é]ž`ÉË ìSº@¾<Ô*ž¸ü`D‚Ê£twxà‰±Ú;wCøÃiëvÅðæ0\2Æ@x€ª(¸ºL$”LÒ:üºš‡Òr¼ ¥ìyÏ v0ÚØ-/ù5™Â…@âÇYnÙ`ó ÊÄN ÒEi’éohGI‡[ K‘ Ø÷¸U](à ÌkÂÐ÷ÞÞ@çíê-‚,4Œh&Êhcl²€ +¶j‚¡7yA!ð´Ö „ +Â3ÜÌ™|Oe¦ƒÂaº¢”Ðê˜Í $3¼R~ üÀIþ2kÁ‰….wù.íÓ>k&´%A2Œí&4ë-bÅÇ¡¹/¶fõ1 .eÛJkÂØœ"6nœâOC‰ÎGýí,KP¬Ä¾¶Ëšœ=2U +ZjÁM‡îÒÁ¥o“ötg{èëy‘ý·„ +Ode0©<[d“@×âì®[‚W=*N0«aÊÇ¢@ +.î#Z!ÜRf·…ÆÛ²5"ÐÙ;èDŠƒÄpS掵úp|T»M[n¥uvšÛ@œÄ9¦5‰úÂdsÃ}(9¨Çr Ú‰½ôÐV Ë®KÌh¤øÔϺX$ð!¸³>}‡=l Ly,·Gd”º /ÇonY$Éጂ4²ÇàsŠ˜k~È86»ðÈø³¾Ø…ÎØé5³¡ ®æ ‹mƒi;zÆznx'lgòÂ8EôžÂ‹€i‘ÑßÍcÒ¹«ÔV¼ÈÙ 3Q¬Q&ô^ XCžº‡ƒÂn"µs'¶Ã‰g¤Ç>Väÿu0ˆòælj‚á“s @È"ï¢ÔÞ•R„.ò%DJ¾.÷](_óöˆ•í5m͉‚“ÿòÅíë7s'( ~B$ :¬ñˈ­d˜®&Še¥¥íækþMùg TIÑ1ݹRf·ôȔ蓠ä è™PHº§Ž=ÜêT©À%¾Ÿ!’¬ê1Ê%˜n(ƒ&ʈÝr"†«X„Yê$¾ST(’È™¾“So¶Œc|½vÄ[ ¾°¨qú>È7¤¹Ò%ÞÊØôÖ nbÂ!Žâ’¼mlRÇ&a´{©`¥r̹òyÍšÊwn Š ­S‘$òÚ!âîÜR¡[Æ”°ìQÙÓGü3,h3’¡:rjôuF~9­u‰’ô‘W +Ý Ó b9’髲røÃæŽÑ{®²Ü+Í×ËÉÝœp‚?æ›ý‹¨«ÃhuËÂÞ&wKùÍÀ:/´_àèk{¸õ¢‘h}-tà¼èïS€vvÞ×$l‹Wüã^üà¸|±àÒ9{A7²7…ŒÒ•!Þ ÕÆ6TrbCô´ÝpÛÕ¡ÔvÛ]ĉUÿD†à€íGŽàF ÓÅ*šHùmŒìôS"±|‡"ÛO…¡ Hó›4¦IH„Ž Â9¸fn]>v S<d”Î(ÊYá 7Ü~@\¦Ö©Hû7ÂEù"’càêì°™€Q@HÈ´:û8#Wöš°A%T¤ÇV<:äÛV,![—c+>KašË@Q<.Ïòv ")w7Y™Õbâ!dmöQæƒ{Åékb5Ö“:‹’R'"â)”$˜©_¦Ø´LÔ1ZŽ¿r„DŠ@¸c ‹°“¯eD¿–Iô;¾ÍAÉ!µœüÒ'"y†Œ ï;Û¢Õêˆ +Ø—™E˜¬ª®Bc9­_ÿ=—Ròº¤œŽcþñG–™ý,'RãgEü´‰Ù~ \ÞìÔìulÍ_òðÔä+|ôÕ«™¨^_Wå_©& G.×Ã'2ëŠ [O⤻´BôåáÒÛ·6å:ö œÝ×<±1f;žÝA¶b¶Ï +Ü94T•bÓbƒî[¿Á)Å9¿}k9Å6°à°sô¾Î¶V;K„-ƒ«¼¯îZzñ€šCVÔä>2`Ž ÌŸ²*¨••ˆAã‹îËñ7ôÎiå³æ¼QP¬›3O"ýÉ?ñi\a@~Ü<ÿºç6" Êÿ&è¶øendstream endobj -5536 0 obj << +5837 0 obj << /Type /Page -/Contents 5537 0 R -/Resources 5535 0 R +/Contents 5838 0 R +/Resources 5836 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5534 0 R -/Annots [ 5540 0 R 5541 0 R ] +/Parent 5811 0 R +/Annots [ 5840 0 R 5841 0 R ] >> endobj -5540 0 obj << +5840 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [243.069 432.524 323.966 444.213] +/Rect [288.652 733.837 371.819 745.527] /Subtype/Link/A<> >> endobj -5541 0 obj << +5841 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [339.156 350.622 424.694 363.524] +/Rect [338.118 638.387 426.686 651.289] /Subtype/Link/A<> >> endobj -5538 0 obj << -/D [5536 0 R /XYZ 85.039 781.388 null] ->> endobj -1454 0 obj << -/D [5536 0 R /XYZ 85.039 761.463 null] ->> endobj -5539 0 obj << -/D [5536 0 R /XYZ 85.039 736.911 null] +5839 0 obj << +/D [5837 0 R /XYZ 85.039 781.388 null] >> endobj -1458 0 obj << -/D [5536 0 R /XYZ 85.039 282.157 null] +1490 0 obj << +/D [5837 0 R /XYZ 85.039 569.921 null] >> endobj -5542 0 obj << -/D [5536 0 R /XYZ 85.039 248.017 null] +5842 0 obj << +/D [5837 0 R /XYZ 85.039 535.782 null] >> endobj -5535 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F62 4047 0 R /F35 2976 0 R >> +5836 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F59 3455 0 R /F20 3021 0 R /F35 3036 0 R /F58 3380 0 R /F38 3057 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im3 4496 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5545 0 obj << -/Length 2704 +5845 0 obj << +/Length 2655 /Filter /FlateDecode >> stream -xÚµY[oã6~ϯp+/b…I]E¹¦4iv’Ù>´}ÐØJ¬®-¹–œLþýž%9¶g,ü`^¿s£ôHÁOR*“’T‡&MG³Õ‰ÝÁÌù‰Š‰L4¯nNÎÞ¹x¤U˜©ltsÛóq¡uft3ÿ=xýóË«›·ÆcL ³p^áô¯Æ© n˜hzÙO¿¼xõ’{&Tã?oÞŸ¼½é$íd©2óï“ßÿT£9éý‰ -M–Ž ­B Ó«3tÖHyr}ò¯ŽÏÙ¯:¤gÒÐ¥f_-Æ Ô’©0‰“Qbâ0sŽÔ’¯×Ër–·e]­ë¦mf›rÝŽ'Z9äåxâ"ë†þ¿i7eu÷ШÓ¾ƒ½?þ£²?ÉhæìJ2qa¥£‰5al’dÚs“Ú`UäUYzï^Wkƒò'¢ ]Ø0ÁJÛeQå+é/rYZã²BÚOW¶@ËãÏöž óòZ™ B8*5ã ʵÔþgILÐÂÜ®02ß6Äw){Ó–m¾rº‡²] BàÞ&¯5£Ó×UÁø"±áŸÅh¡Na}u×°]:z:/äñÃw4­“PÃSÀ9ˆÂ y€&6Bñã¡MB›zÊâ Cí"¡øéûE)£0d2Å)k lå¿aEäܽ+ªbSÎxìj¥À­q†Ê&]­e%] ˆ—„Ó60úÍÙ Æ.ÂýàÚ_-°±ÓØïrà *—ãÏŠè8À=mûuÏÜr=‚(ÉÂHÙ£|h•>Üòä»|:·j8’Ètþ#¶x»ä-ÈX ’G6tIL'¼¬Û¨Ÿâé9…Ú™(Œ™ãèï‘•Í2Ã$ƒ6IߟŠΦ+=zSƒ˜£¤Âv2àK’ê;²0NÜÈeð‘¤7 F`„(ÞcÃÍÿTpß‘<â€Ê¬¡“n›6¯øÐ8=/e¦ØвÊðàÉO´Š¦Z\ú0Æ®Òv-Ž<ŠyIÃû¡`Ëœ¶ãñ‹)Œ\¼å­z\{îþ$Ͼþí«ëÇÜŒ37‚×ØÐf®3ĸÐ>ÃýÈÚÈ­a  5° µJ7±í­Ùe@'êwV597Ô2ËB—°/NÀ³ÉQqî½Æçál»æ‹ÔÁ¤—ræo²\’RÛˆ‚ó'3MŒ_ax¨´ßå²8¤.ª8{¾º´2¡5Þ“»KL@0(<ÔLbƒ¶æ™U88÷¨¾/g2DÁs^ðþE5/ª–¢ü ýÙ'î×k‘µáÃk‡VÑÎáok¡±>–Zö¬èÄ»ZtÏD×õ›¶\.™ºÞJ„«˜÷ؾºæºh -Ëèþêªù1$XHDH)«šwÇŸóz8;¯­‰tEú›/˪ßJ´oEu_nH¬{T›…4èžVæ0óiY48ŠRDúl‹ÅQ²£ñûXÑ.#oõÿsçð™ÀŠ$~dñù}!àV béÐœÿñjüE Ðv -š(«¦s‰m§j0#@Iw‘:î#rx"™£òÚ\XBšD)´“äÿ†®' £Î9Bº˜BN¹×þõµÜ£j±+Öí$Š8Œ"ǧÅF—D`GD&/½ŸH  -ù­ÎÙ0íV?Ùu^Ü—&äoÄ`‰£Š…–¤KHjè88@â 4k´?fIúÅ,þ¾B›g>Û]7“Ak(Vs–Ï’"Cô9øO’ÚÞŽµÊvû„[.ËÖ# goñ?¦åûçã8ä@¡V±©`vÝ´õº9mˆói’uø‡¶Ã -`Â)ã×NŒ3Á¶)¤UVÞy‰Eç>W¡¤®bªx˜Üû·?âLm> -‹Á72N¾‰i絧;‹mAf÷upê`/;„j0äA"öŒ´sG­@”®t|V® Bfí³Ù@I¬­ûÖ£ õ‘„œ=4â/&¬(Žâg€ßÆZ'A¾©ÕÝ‘¤Ò—Ð(Ÿ´5&H2lIZÍñ¤uÀ÷xÒjÈAb®ŠßÔÕ?Z._¨·[o†RÒH•è0¥êÓ[šZq"Y„l©â\&ïÂ,>b2I!ZV6dù-F[$îÒ»…ˆò‰™qgÛ ©ùà)É<}%û…‚—,mXðž-9¯3„ÍOÎË ûÅ–íçq ¥ôQÛ`âØŽédÏÃü­œsv÷ïö_­ ¶B ‹ï¤Äâê,¯¸±”FâíËë×Sº)öÁ…Ÿ)[ÒYðóÕäü—S Ëo`Ñ»Óý$àIn¡©þŽx: ú·°åMyyÎC{ê–ÛôjSeçjï -ž¹E*ôw ÷1vÃØ©ÞyèÁÁIÉÕ幈yÀÍôËmƒ÷è€ßžK;‹º­'¯ß)=Ù]N>€ß §Àï¢ç‡Ë^]ëó)Ã9Ï_IÖQIvÓÔ+IDè¡hŒ‘¸NÏÇB­Ÿñµè,tø*aԅIJ+IM ±lyÃÎ †^×Õ}±áw6P Ü8 >Œ11ñÅCsì`)Ñ×ÐÓµ¦F EX¬6E>Ǻ?‘šTÓ€TÔ5ä†ÎYÔYçů‚?Æ+»oürHÊÈ?ÇÒGk~*Üô[,»ÔŠÇðsÎM¾kZÏÿ|ºÉî&¡Å5‡ýl“¯|¼P\-ö®”^9ÏEm%G¬¸;|¼¤’„p7xHi„+G“†;3~-Ãêˆò*âµì,!Ã~¾âȹ–î´m¹'Ö¡¼uÈ‹¯êÖpy¹Þúòú‰€ º ÌÑÒ]>(òŠ ù4˜¾%WÅm¯z*N6ÍnÞ˜vpi» ë’àaÙ8Ð/„E.Äx¨ [?^Á–Ju— ÒKpÈ[…–¬Dì… ôÛñ;Pï3˜Q¸¯¨mé&ó%»“™€†»9õñPþ°y_ñ͹ .¬—²Têô¡²ÀØ-PmÿZõ°Åç|µöi•.•t:ïšÏ{'·,ÿ3öiï÷BŸ‡v¾ÿ%aç›Æk“$rÇ¿t¸ÄÆHèeÈÑO±<)¢ -œIºÇé¶ µºjõ髳Âí‹|Z>ºµÉÀ•¹aÔÕâô„÷‰úÚ7Ýíïœ$¡R査A}ûò$øýÈ3 #§üþ豉/DÙÖü$˜oû×Ñú€¬GwX,.—!%‹ÃêŠîS^æ}¬á«= 8ìa³ä6Òdw$÷)"6òE°Þ± ãw¡e·<Êv@#·²!ã‘Š]ûwfE5’O“ïñS¤JL²m·z³6òP'çêaUo:+ÈÑ×ílš§C“mZþÎÆëâ˜ç(J¢ÎäûG³Qa” -Îj$B=ë‹gÿ=„©ÉGxAø×^TBd’§òú/£{ÿ‘"?‘endstream +xÚ­Y[w›H~÷¯ÐÃ> =Ñ4 ôìÓÄvçŒ=ZÛÙyÈä d1#F Çù÷S7Ø(“Ëžœõ½«ª¿úª +«‰ÿÔ$1ž¯í$N”§“d²Øœø“˜¹8Q²ÂŸ„žœz}w2{c¢‰ò=ëÛÉÝ’–ÜeœÓ·?ÏïÎo¦®ÖÚQÖ›ºqœ8§ïçSåÜòèüæòúîòú{! *çý§½™&Ú¹›~¼{wr~×»Ö ½0Òxï_'>ú“ D{wâ{Ú&“OÐö=eídsí™PK}r{òßîž '¼kD;7ÔÆ‹"h°&¿â:z*T£×ÐÊ^lŽ‹M»|8‡[íòá9c¢bëE¾î …¥–™G*¹±^@ëk¶Øok÷‹b% •ßJEŽî;¿­Šu>"Db‚oV\ƒO(-Û5a8–¼Ž4ÿÞóƒq'Ë]Ñ.‚S¢˜µ3tÔc±@ܯª`©ègUÉ–F‹àêGÞŽÚxÊý]wÜ“»p[<̧^a¨Ès8þ3èÄ)€¿@b“¶7‡ÖA¦Isî4Â;ØþßЄÉà qÝ´¬™X0Á¥½¡/gQ"ÄŒÎõcgŽ—ƒ°·,,Íg(D“r§h)¹Î×KBX}‡Í¹›¢DdƒûuKmh:p'{âm ¾IZÖ-ð”Ó½'ÝQГñ±Õr5„/ã'ÎC‡ŽS‹NÙ¡J|2£Ô#© êàûè¬õjÔ–Åb'9³ü±`ŽwëC€ ™Â…88² ÐDßÁ;Íê¾mŽèú_ É¯À%ÄèP'¥ð6&-ÝáÛ»¼f¾ ÷hýuÑq^i÷°ŽKÙÄŽŸe´Œ'²lë¦ÚÖ#"C7Êv×4Õ!¤j²× ¬uöì(Ò#Þ(nÈP8žpLzBX»dÝjš¥§Õ¾ï`¾7?ãIBoÅ ²JÆV¢wì{AäPf,§~Aa‘u1kÂΊB`¶F“ßùùöô’PuÉý&ÂРMè¼»¿¼â]ó³7m‹}"Òm›N•#{ÏpÕÿ.qNö¥>°±i¹8‰\ú "-«M5ì‹šâšñ/ K‡¾i_î[ͯ/DH+î.ßÔ‘uÞ!tÎ/¤7G©šÊ=ųÎdôöýµ{“Ö8Ó1–Pw}%gbçõU»ãâÒ½ÁÜ/}Ý*µÊBcSírvkÜ̦çÀ*ÄK^MÖtGÔ©+z›EËF) —qItÕZçhÊ/*¥ÄòŽ&ß‘ ÞXuTbÆK;È=Š»À©1€ƒŒ·@Þ÷ê:˜3ë(‚ÂÍ*’WÑáÐiU>bnŠ²ƒÚÈ:Š›=źzDÄâÉ1 µò૯qÛ«ÒLg;F¥61^K°³7ºœò} Œ–Így³˜a˜mŠMîAöõØòé`“J@Ààü% OŠ96$_ÇfûhÝóÂX™n:d@÷ðÚxƘ¨Q4ÞFÓ•_›–íë=\=1ņAâiãÄa%9)â«&±°…æ,v9!¹!ÿ,~xÜKWr·nÒ]³ÇJBB“×Rµáä—¸Y*$õù’Ob^V÷¸g †X‘D±€fsÁž¢÷éue1("´Úƒ>£¾æO"%ÿ²r]5–<ÈA¨+Þ:Ç=G*ï€Ú¼ŸÈÎb5nÝ•ÓÇ,Þp„Ǿ|ˆ·ùNÈ?máJ¡î•<<@´Yí„N>G£UHùoi’­Ñ:]ŸøSF÷U\è“÷l×ò)†6“Ï$¡âG¨Ÿe‚€ã îÄR¯ $83:-¥Ò»'ј7ð»Š7¼L8li1?Z¨ùß@3‡¾³N‰æ Õ~‘ç'ã;çƒÐãL˜ó"e¬ç«öƒº˜aÌŒòBdÀ‘Œy+!Øýɽª¹5Q`š¨w)˜:-Ê‘k£ÀKâ~deø/T hÛŽ^©=Øý›Bàk…‡¿”% ÁZ‚óçù¥IŸxŒÒ´‡Õšø&êO/»‚ŽÒÐœT-G 犲ƒÏFÇÑ1 Yþüú²4ÕVCùŒ§rÏý‰RÇýGýb˜à¹ˆ*òtò_íZÿ]RSÐendstream endobj -5544 0 obj << +5844 0 obj << /Type /Page -/Contents 5545 0 R -/Resources 5543 0 R +/Contents 5845 0 R +/Resources 5843 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5534 0 R +/Parent 5811 0 R >> endobj -5546 0 obj << -/D [5544 0 R /XYZ 85.039 781.388 null] +5846 0 obj << +/D [5844 0 R /XYZ 85.039 781.388 null] >> endobj -1462 0 obj << -/D [5544 0 R /XYZ 85.039 269.971 null] +1494 0 obj << +/D [5844 0 R /XYZ 85.039 483.291 null] >> endobj -5547 0 obj << -/D [5544 0 R /XYZ 85.039 235.225 null] +5847 0 obj << +/D [5844 0 R /XYZ 85.039 448.545 null] >> endobj -5543 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F38 2997 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F20 2961 0 R >> -/XObject << /Im1 4096 0 R /Im3 4353 0 R >> +5843 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F58 3380 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5550 0 obj << -/Length 2450 +5850 0 obj << +/Length 2540 /Filter /FlateDecode >> stream -xÚ¥Y[sÔ8~ϯèÍ“» - Ë’|™7†H¦f™,„‡-†§ÛI|ÃvCòï÷\$Û}…YŠ"¶¤c£ïÜÕrÀ?¹HŒTºˆ)T’,VÕE°x€•×ÒRø–ÄŸÑüz{ñü•‰2i.nï§}ŒÐF-n×¼—W/nn»ô•RžLÅÒãÄ{ùþf)½w<{óöúÍíõ›×8Ò0)½÷7¸ü×Ûe¢¼[&º~3-¿ø÷¯/x¤D°üxûÇÅï·£¤£ UŠb~¹øð1X¬áH\B¥Éâ¼BÂrur -£•—ï.þ3nÅkzÁ_CŨD˜DÂ¢Ì –4q/b‰Ô‚%kÛ²XeCÑÔÏ¿Ök±iý«›×.}šÅ¶é‡~Õí°ô¥‰EöeÓ>”CÓöÀóWrÎÐ7"“…¯•P&†·›¢g$ù©½aPæüµIf_-"7 ï6íÒHï$'‹HE–ö3ø¶)VË0ñ6§¿LruããÙ‰ºl†ƒåŽçþ¤†©rþÉÐð)n–aê5´å€¶±â龜 xG~ @o›9ÞÍjÈ¿º<«¾‡,[øUÞå,KÆ/ Ü2Œ½oˆAÃJÕt|.$¥£<Â8£¥–ŽG§øåˆÐ‡êœ‹üè÷›¼,áè{Æ£PÉ ð†üqp*íù-=¥­qéy[fE ¾ªLðìø#æ„aè•ëŽGbæ€ CååYÕ28ªGÀì×Ãæ˜KΨ´µJŒð?nÁ‰Hgíhi%0œù“†Ÿ,W÷™GMÍÏKÆ ˆIï’eÍúñ«ØcõÀ(³'á¯ÁEk%»ÍÐòY¥¤_BèP¡ÜÑ)û©Öl‚+` ’ ¿À”JدÉÉߺ€#)°P&)H‹¸$Kv& ªs:ïÚùÝš)_l¨ ZR׌yÇì‘I6Å•ø NHñ`÷ɳaK¾ƒæž÷¹½ü‘´s §‘âD@×±‘IÏ&§ EáV%ÇÜ19iˆ$a(!¼ iÀÒ_¡Ôåã±£Ø{›Ù]^åõП’JCˆÌy©&’jÇüÜ>2±Žœo0X.¢€WWÁý„£ýpË«¦B3»#ÔYÇV¹Æ:ͤWÈ5ï^<-V íþµ'«’ÞUcý,÷+¾æ.ªbˆ#]aë„œAfÍÀóeQC¾æÅkxnY0›y\èá¤èÌLè èôø†®ÕåþŽÚŒPãî:Ç/YH>ÔÒ@¥ÿÅ%E² H/ä®Ûhü:¢Œ—vÈpb<5Jüì³åD/Léœ,QÎ//QWîàÄ=žÇ*Ä…+ìõp$“fGØ[m-€½v@èÈ#gÕéoÛ<º£Ä›Û¥lmßHDLûXbâÐTD6Gᬨ²’W;tR’U6¤Íıw}Ï’M¦Ÿ „¸ÉÚ MÀbB•Ðq ÃóRÆ -ƒoc¯)€á,uÇ(Il×ÂÃŽ“u”×7.}àè3pýÌù˜S'Q"ÝÖ—¼fà'‹X‘ y?7o¬}–Æi°£zeóI•¯{Ë4sð„léÛaî£ÖŽp¢Cèmp=LYŒ›»:¯¶µGÁG”\ŸZ7·E`V¯G*ë6¶†r@[xmm79šÝPÁ¢¯ÀGocšÄ×yYe«›¾|rÒõÅzª‡ !Àêí_'¬ -a‚øÊy‰„æh9€… T¬NîC_°¿1y¸·ÏØPf¸¸éY¶Ä­%ÄB׋vÿx–JF@%©{X|YHè4UL2{'¡§ÃÐÄóëJÊÅo ˆ·˜Ih÷õgsêÙ)“ÂTDP -‡I(\Uf5D›Cmsɘ>ã]¾|37ïxtRô%¯ÞSí×ñ˜œjÏL2´•nbÚ³rØFq­ 4 † -¸1ó^HSŽ&‰•ë1p¿†÷?t—~X³H*ÉðYÔ-º;ÙsHÌØ7$‡*žæ¶ÃÅb4àf;PÖÔ $”Aùö›f[Úï‡l–*h—MÞ»0CÃdVXzœRº‡­UŠ7o¢y%±{À–6£Ô6Ì{©O(ò¿oûùÊP ¥õÆUÓ.B4-ƒÂcSÛé¤É|ùÇ}ã–¡a¸8Er¼p³$þŒf,ÜíÔáñnº¢Æ¼¼Ï2Òànñyž–æ€é®sD©HÀµæL{„‰™ÛO`† “±­¦9«„Ú!ˆ…Ò|Ù:“Ýæ<ƒ™±f€|‹A’÷Â:wâ§ætðÃü­·±’¹¡Eqjn)wœHÃT±ƒ-t(`MÙù¸Reš)£³JÑœVª#BI>aî³ÓZ¤2>ÏÏÒ0ÜU(ÔýËç Çx]oG@;ìÆpnî,׿ñœhÉè6øÉlŸOîƒ9®® kXŸÀ6ŽEœ†ç±hÎ`k‰ð¨àë‡Þê; -ÍÇ=pÐÐEÏ9ÎÁí‡n´­{ºªÜ%”¥hÆxõP`ƒ>ó໌£eçïX=n– °óݖ˽pšXè(9çDsNKD­ -Kw}¶k¯@«õy¦–æ€ë¤Ô s®ÿ R¶^À¬r÷SÓ0^ÝmǸt -: ©Íyè&š3ÐY".á)¹Dn°3(tβ´4<÷"·Ø–ìðüž£ͨ!Ì'ï&8çŸV3¯îüyžDKdTO["4ùI(ÏÃ9ÑœÓáÑšK´#xK}ž§¥9`º‹g,dæ·ÇW -G…áÃ¥‘Ði|öøÉéÓ[šñ¾.' ßg R+ÈßçxZ’}¦{§DE»LMðWk cLÖ¶‹»àßèÑ$êW±TÎÇ.&X|&Ç]‘øž—*—7¸mWæè¦ -+ÊÇ–;|jÚìuKì­É×3w‹¥Lº“ôï‘0„ʚ̻k¶ÐYÂXÏ -Û¢æë8_Ké]×L^5ãu-ŒVYOW³*¢>§¬È8õ5ïžx2ÏzûFw©ðü6F!,O:›ñ/œ‡¶¶¶G‚ož©µÇ=ZÔÏ/ÿ]Èúٺ.Ì”ï‹~ÃçN™dûgÛÒ»»ûÞc/듬¶óm"ûìºâÁþ -b܃ÛMB©£ÅÔKþDcŠÝ¯„6Ù±ú©nYj¡õÑš þ3ì?õûÚÔH+‘¨ôø© CR'-BVs¨’}ÝïpL4øiuÄendstream +xÚ½Y[oÛÈ~÷¯úDÃáÌðÒ—"›«mâÆJÑ"É-ln$Q!);úã{nCRl“m šËáÌ9ßœ»Õ$‚j’Ù0Òù$ÍT¨³l²ÜžE“kØyu¦„"š˜0J,ný²8{òÒ&…y”Ok"Y¬>Ï^?½X¼x7i­•‡ÓYšfÁ³÷S\òêÅ»ù›ÅüÍ+œXTÁû Ü~ûnšé`1ý´øõìÅbpíÌ„&Ñxï—³Ÿ¢É +Xûõ, +užMî`…*Ï'Û3cuh–ùæìòìïÝ)¼g&üÕˆt3O1®óØŽ#0C‰mÞaò‚;Ä°!¤Azk£àe “MëêéL8Þ]ƒìI¼½åµ[\tw#’Ç¡~”­ÂLõ¬(;ò‹W;¸LEAáÛb7³àfQl‘ªFx{I [$¹*w°^´eµkx“æô‰[ñ÷@l?y©‡×ÇAl•0±-·.\V»Û†I8µi§±P`F'Áëj§Á²àné¼±>G 0+Õ¯ï¤BΪ–ÇÄsëÑnéka·­˜ä É<ÐiÚXãäÄM{è˜HÕÎ5<ÚÃbíf|¦bÖ>FÊà»"(&Š»/Ò@´tá_¨ãÈ<’-á%h€gn×F6bŽóà®î5ÖS¼ÉBìW›„@ÕñšæzÑÁûüø-q¡ZóoÃÖ‡Bš(øLB®Px]ø÷Žæà&eËŸ‹ñîIèî† O ¸»)„|ò%vέ„¬ ûxyÊR˜öZ„„Ïõ <„Àâ»»_ëq7¡Ó0ÑéÐK´÷{7æ%eBYÀ‹ùœ0VñírΙ?°pÚòï]¹ÙÈH¬‚gì5Ší†Åk6÷^¦\9Œ,ñê)xî,yÄ­Ç&LRsaNÜzaÆ“CŒ]‚°‚¦€vàvm3ST¬‹)qÅú»1îI½Ñ³¡¡:Täÿpç£ÒFô+õüx…ØzÓÄÉŸ˜bMv‡övÑð +;ø,£µxS › ô¦½UÈ·ÖðgpòˆâA–cÀZY ¦]yõ<ÀH­'*„Ÿr‡ÎúÀJ?3Ê„1(æÐüQ=aCœ¡ž2’@Ö•Å=üjH€º™d_ážnn*ô|¹µíð [o\CCXÞG¨ñ7a‚¢¾>øhé_æÏÌÈ>0/°¯¤Cc_K”Bùð@­‚ߪ+ÄìéýjÛ…aÈ"ÕrjAeö%Û;ªž +UdŽ ¬ö>÷°Yð¡ÛOÕzfCcáÛ4 +S=š01Aôm»º¨Ë]gFÿ~x‰Â„ë‘ãíàøoX$½œFÉ„]¿æ.¾…ÄZÿ‚Šçò†+JzjˆÞ ‘‹.¦(›£ƒÍ0{ã“« b JºÑ* ‡~ÍÇ )pŽ‘ñÄ¿ÍÚj€Ë¤?ü¤N£ï‰oŒiþï9ú{ïáü°í‚t¹äu¾”tŽ;Ï5ýÒßpñê›pQÂ(Ù˜óiã)lü²õ°e? Û¡yTu‚ýúÛ´uWÇ 2ˆ” ´×éRU—×¾€ 8(gîïz¶ël h[ÂÿêÐ¥]#AÜNÒŸV¬¶lÅ £dÃ<ý¿š6{`–ˆ¢P—WiÜI˜¥ùOëÊ’Ý/àœâw•ÿ/­ìvj“ ØœˆÑ¸#ò®EÁ¸2TNqѨ˜wÑ„úêÐö ÂI„H¡–N³>$f!2„ò ý +\9¥Ú¡q¶q˜›ü§m¢­ æSõ• ÃÕ[|5„bWVFA"çKm•÷þK ÚírG*ñ8ï–-Ÿ0Ê·x jšw·eÓôîø\b\W 7Lê¾îYÖ]¿À¨4XmÁkÿ…ì´75å]Pæu°Psf˜Ì<–fÆ@›ô0QJoó`ŽI*©Y…ë{ì=é,^².½ÂmŠùðë˜ìž êVûŒgÿ@b¤{‘é +œ +"µÐ-ërßßT°øT=ÃîkÙ€Ÿ¿æ™Ï#$·"×£Z +ÿ.ƒgã'y\wÝ•Üpu…•Å˜‰':Œò˜B©NÌcõUš<ý}<#¼‹ÚI„·ŽUO&Tæ;ÕÓSÊfAË;¥¦î_uàBvš¶hÕü‰ .ƒ¦EÉóÑ î[N‰K9Œ& –t"ÛNMVÆë3Áéš~Œ½E[}sß¿™ÿ“¢6F"Q¼o “Ô.ÛAîï¹Éã¶ái_àå4ƒôÑÁN¶¥u>x_]»« ñóuÑt¹)&)Œ¨ÒÚu> +XΆwxåËɺMÇ5èI”gÄö/Ô ÁŠŽ»'0BUì÷œñqwÔâyp¿o4Á¤qd%X|í|£Uò~%­9"óù‘œ[Õ­“ï¼4—üÉÑû5LÂMÍŠ%îó/èñлRsCéA#&5Ùo3ÒÁÂú½WÐé~—˜uPañnm@=-ø•RSCPïŠdÚ8Ö6n k\Ò=2˃ùNâå²ËörœèrÝ´hJuÁû²LÂM8››µÜZÑóaƒåQ¿: N¥iŠz§:xzùlNžrÎóÖ}EUŽA×/ž¿<ç/ž£\ÿ˜Ÿ3 Ö¸úúböê¯!x­ˆB4‡vYù´ÖLØw—Ú1Ú&H[Êo±!/Z`öžeîÒÁß`‰j¼ã=­¸idGÎl`Ô`›rI%x²S£81ÖÆP: +­Vƒ„€sBj:Rèˆ ¼:ÙXl¸û£+ÂÉêÈ]Ò[q¾Ù÷eײD$–üÅÐøhÎݼU»J®$³u2qÔ·TuÈÃÊ­8¦yi†êáo£ö°V‰·í$óC°|å-Œ%¬ó¬ëÄÒ)SqÔÃ#w f<:î&+Qi:Þ÷ØaB˜AÚ5Èc´²C`{ßÙ\µo$ Áté)ÿeåÆŸ=øûÇðÞS[Áƒ ¶ÿ¨]ÀoÌqWÑk˜4!†hÐŽÝ®•ÛâÚ1ý±Ë;GËg×yª±ÎÃXùn1Ñ‚LcàãÔë¡—2°®y+’TT_,»=®y){Cƒõôë‘ö«‚2<5ñxv"ðýÜŸ:uª¾%ùÍl$¶ú!‹*¡äé(Óÿ«p-endstream endobj -5549 0 obj << +5849 0 obj << /Type /Page -/Contents 5550 0 R -/Resources 5548 0 R +/Contents 5850 0 R +/Resources 5848 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5534 0 R +/Parent 5855 0 R >> endobj -5551 0 obj << -/D [5549 0 R /XYZ 85.039 781.388 null] +5851 0 obj << +/D [5849 0 R /XYZ 85.039 781.388 null] >> endobj -1466 0 obj << -/D [5549 0 R /XYZ 85.039 475.659 null] +1498 0 obj << +/D [5849 0 R /XYZ 85.039 761.463 null] >> endobj -5552 0 obj << -/D [5549 0 R /XYZ 85.039 441.519 null] +5852 0 obj << +/D [5849 0 R /XYZ 85.039 741.134 null] >> endobj -5548 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R >> -/XObject << /Im11 5348 0 R >> +1502 0 obj << +/D [5849 0 R /XYZ 85.039 644.474 null] +>> endobj +5853 0 obj << +/D [5849 0 R /XYZ 85.039 610.633 null] +>> endobj +1506 0 obj << +/D [5849 0 R /XYZ 85.039 228.672 null] +>> endobj +5854 0 obj << +/D [5849 0 R /XYZ 85.039 194.13 null] +>> endobj +5848 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F59 3455 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5557 0 obj << -/Length 2058 +5861 0 obj << +/Length 1893 /Filter /FlateDecode >> stream -xÚµXYÓH~ϯˆxr¤qã¾ì6/«áZ`– «•€“xf,’8ØŽ¿u´$ž€XV#Mú¨®®ªþ겜Fð'§ÎŠH§ÓÄI¡›.7“hz ;Ï&ÒS„ž$Ð<\Lî?µñTF"Òéâªçc…±zºX½ =?¿X<ç™ÑìÃâÅäÉ¢“´“¤JQÌÏ“w¢é -Tz1‰„NÝô+Œ#!a{39…5ÚÏדËÉ_+Þ3S>5f•–"ÍReO[.–Âĺ³œ‚])Rk‡–³‘°‘!ËK+@[6³6 -.ªü}$ͺɫú.¥ýñ“bô4$†´#(c¡c’⼞…FÚàëL%Aæ'uV¬Î`¨mp1S.(ëße9 eP0Ú5Lˆc:Í Œs^&Â|‹G›*[㢠H9Op´eµÉ<›¦äߌŽ|gú·¯æÿðòǬÎW<ÜÍP挗o¯½Äßë&Ç[7`ÍØ¥ÁÓ™3AUnÐ’` PâC¦¤r§Ò²*_sÆÐzÄ^çۼʚ¼fV™g^ñö -eMÆ”‰®X}ø·âm¹…¥Ð߆;# @#"áP'x{ÑŠ¬.Q䇷D«‚¯7t7OŠšim·›Á /.Ð4ZÃàŠ¿“ ·|¤îèV¼[nsÞ)=ysãê[¹ÃqœmáϵZ^òôŠ^ÕËŦQ½‚iÐüïe z½ nZ“mù0=Àà½,é^Ýâ;#Ê"ÜÛUyعÉ=^èDF½Ld@{”O6¼× †» ‡íS3Õ4x/¬ê¡eAöNîÊCød•g±' —«Aá²"Yãy¸ýA ¡K“óËGs²ýœçlýoZ§ÒÇOÏxï1Šÿ÷œ¹Á[Ñâs$ ñÐ3ü)xuøDM¶"p–›víÊ_Ù)\ûTÖÖMg†š7 -ÿ N/}L!—®;ŽÇ–x9 ÄO)„"o± Ä‚Ü ‚Å‘p©x@¿.–3«àô¯‚ßàr7³_²^¶‹xíECÅ"‰[fï#møMzÿA‰:—K -'«üK±¤aÍþ‘“ñB´ÐÉâ=øóÁr×ä75Sxpc[z -rÖœ„[ʼnˆã=›å´íÇÞå1&­0ô¨$|0)yFž¬’ÑÞŠô£×Çä28ã³™Ì0kÚ#)¶ù7¿ÚÂßÓ”¼ß ‹“e¶^wÒÖ¼¶«›rÇFAûY‰PU68G«Xá1xvU‹Möº.>a¬†û(F‚RÕ-*°ms.aØ@…ND:ä´É®ñ™À†]úªÏxM|ŒU•D"‘Îã«Ø ŽáuŠÖ#€„Ô§²Ãã¾:2ìDóÆëTÞ6KrVÁ§bfë¯øŽ­ç†´‚ênVŠôVü&½ÿ¹QÿK”ˆUücÿû²]‰åí®É¢ì‹AwU1îðä2ÕÀeZÆ›THçz1PËÌ»Ü}ÿ¾uC8kÃâ Óºà(€YŠ†o°DÒ–S?:$j“(`éݳ<ú<šgë‹ -Š> ó~g2.bðÜG~ƒÕªøÊgýι©üà4mºœ‹;ŠG[¨˜íqÉœ¤‰/™õAɬJft>à¢ÇJP©´p÷PJ%ÒX ii±€ÂI¦Ÿ§h=\oIÄ$š;M­,¥S×mߟoàÍ— Ú´—.TÒ-©p—bPCôt RŒðБ¡Ç@}e•ë°–!m'FÉ)Di‘¸tL¥£J¼=±jˆÒÎ(ÆÓâú–R£^ÊŒ€;V"RʃûÁ¡¸ -=hTÚÞDLr$ÜÞ-|¨jîmŸü+*³®€Z}%dðE+Va¾)œí;!W[ê#…ŠNZ¿ÓKÛXH°pˆ’xLw¬©Óò¿uœâDžlÃt‹ØÊ“Ý Fõ»× Zß R2¼«ÔÐ|ºíI¸wÇ] Ž!µäxUß‘’T -"¶ñ–«»ˆƒë@hSîæ`sYR¤úB¥LÕŒÄr‰3J~W5‡Q¸u ®¹ï3ÂüLñøKÉ ’€«2süHÕl -ÎÇ>c,sõvÜà PqÜ/{Óáz:(CÛ •609®{€M±m+)0½'äB6¹p¥ž +\‹¶bÂaGÊ' {᜽èN-±EdÅ¥¡ß O‡œ—xå^¸Ñ†(«?õtYí¥7蹩6[ç߆!‡{Õ¶yávÏ7ó-®v3.G³mß|Si¸Ä‚ú¦oœ1ç{^9÷E‚µ¯¾š÷­[ãxØAú%È‚?~Ü•šUl (Ó¿%5«¤fÓ~¤ú}©99JÍñ‰Ô,£ï§r³T`—ü(7;Gzš‚nÆýdjæ#af,3ïñIÌö3'x›cY‰™Ie;HÌ{|è UˆCl?þ‰¾” ºçå€Ò×”…ÛÖô0k«LO˜»ÏÅðá|*Nþ¿TÜô„ØëN~ò´†Þ ¶¸ágÚ@3¾íÖš"¤„×'‡.½í:9eJ>ÕmÜ »V¾ì tÝ5ÑtD¢ˆÓPîJë¼í¸µ|œü=Ö2ð‚úŽÊÏ*%”leAs)Êk¡¸°N ü/5v©ßendstream +xÚÍXÝsÓF÷_¡áIžAg݇t}¢4Ð0¤Ä<Šå$jmËXrhú×w?î$ÙQB[(Ãd&’îöv÷öã·»–A 2Èë<°™:Ë‚ÅzW°ób"E§ ný<ŸÌž'i c‘Çy0¿$’yù>|öëÓ³ùÉÛi¤µe.¦‘µYøìÝÙT†ç¼zööôõüôõ ü2°(Ãwg¸ýæí4Óá|úqþrr2ˆŒ0©F¹Ÿ&ï?ÆA ª½œÄBçYðÞc!óf¨ ë9>v°2€…„·ÇÈ ×K:†gªÍߨjùy ‹Eƒ:‘2Jäì#ÑN9)Ó"Á’¹%î´EËŽ®·N—†)ŠÕŽÉi o·LF kô]xß ™g`¥äPÑ;ù¯Sð½Åø˜³é8F +âC~Å”B©•÷‰H@´ÃË~I24&ø+p]ø%In›¶Þ6cñ/´2÷ÒRdª‡ó|Äi=ß#¯&V;ª +¡’ |…yIoÇ.ÆUI¾¤mòWMi}3%ØDªv<À±6ùz> šI*âĹw9GÆ@î{€hÿž-äŽÎœ$ð‡‘YxÚâEuø/WyLHáZT%o ÐHám€T„©E;ø¨Üyv›BÂÀʦñö#¬EÚbµâýryS-8íH>—…%9 rŒðþ&C{¢:Ô€TWP€° ±;×ëbSöäl|º"ïÛéKìº[åh™J†ðÇeíwÊý–ÿÏ +u¸âÅúÒé¶oqwßBmSi26-•ÉÁ ÉÙ”üBä›*t‘âƒû{):¨:r¦Z†ë®<5¡È*T\;r¾iÍt­¯Z¡“úô¹·®AxKe¿K]3"ù†•-V¶üneC¹ù7-lÉÿ\ØžR¿2 ”®¹éÚ²e„ÿ—}ø¾ ì[°¿‡yq·y i¡JåòK5ÍdB‚¾GMSJXkn›ç×Uãê¼ë 7µ»/–$ø„žô fÚõrçòÆ£B×I̸s}Á°_¼ÀürÝeåùïˆâÉH.A…‰ÇG™ +ºà¦[9r+ð£=f‹YqÔqŒ$Ìý–:_®£[ + ,+û~ÛªpGtå¾µ…F ¸¢{6î@ÍÏ o0¤bú²dDq”tÉŸ·¸YïùƒÑ±¦æ¼nÏt×·ýV2 ®nûíC•>H[E¡Hé‡Y$åãô•D@“d¤ä#‡½µ‹‹^P®°Jz–.¨Åا‹Ý²ôÇ—WˆØwò Ì%”ÕÐ$Ä"5öÇ +Ž³=æGÛWÀ$Tø0®à§° ï|ÙLÂU}mÍŠw1H^òÁ#l®—ä­Ö­_º#èG7â:2Üðá±:âñsµ oDþ¦ð@¥Á¶F.z„Œ¸¹}Ä'.ñc³pø÷°{àç?Xî>«÷.Ü`c¤áø429Ê\A3 ›×~¯/ÜbÍÏÊ7ySò Ò é ²þ‚$è܉¥FjÍ¿ ø57N¸PÔÃëÀ0$¬JÝ¥f7ÅnQ4ã^ÑoR¶&D­òŒðçØžJ(­<é댆&4­2¸cÖ×cÖG»t!3Ù5éÇá”)‘TÑRå¿w0‹­þgƒY:̦ÜV4-$οÐdÞOhÙ=ZÏü¸ÍÑPÙì`Jƒ!—f ä}1µÅ/pê ¹…þ'2å"Oïix¡¾î÷d€ÒýÁzóøö}Pœ¼‚-jfÊendstream endobj -5556 0 obj << +5860 0 obj << /Type /Page -/Contents 5557 0 R -/Resources 5555 0 R +/Contents 5861 0 R +/Resources 5859 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5534 0 R +/Parent 5855 0 R >> endobj -5553 0 obj << +5856 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 412 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5567 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 5869 0 R] /Length 17146 /Filter /FlateDecode >> @@ -21969,20 +23708,20 @@ i b±€‚‚X@AA,   PP ˆÄb±€X@A, P ˆÄb±€X@A, P ˆ”×Jzb,ÐÚFAyžóbåÙ‚X@ARœ ¾W¢ <[nÔßûÇ—à¿endstream endobj -5567 0 obj << +5869 0 obj << /Length 105 /Filter /FlateDecode >> stream xÚÁ¡PS˜ÁEQ5(Kš¨]ÖAÖ4UÓAÏýß{Ç眵֭µ”c¬Öº÷.¥|ßg­sžsBÞ{)¥sBÈ9WJc!÷Þ‚bŒ±ÖŠ1RJï½sÆ:{endstream endobj -5554 0 obj << +5857 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 418 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5568 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 5870 0 R] /Length 21835 /Filter /FlateDecode >> @@ -22064,86 +23803,74 @@ Z Å„…_GWÑÁ©Ì0ØFvR~$Wð„Z½Ù¤(8˜'±0,~¤J·§5"+SÜj©B.J.Ì*~œU@¤Ÿ¢“¨ÙäxŸ4”~$MÌœ5’Ù³%HHù‘pøÅÔ¢ý¬Ô%ðb%«‹IÛa¼N\Nrù±.NÂÂï#Î÷z¯]¹¦À`Ø_0ª+ºë ðÓ§à~o×X¨ÂQO;}´bÎ^î,(ÄyØh£y¡<¼p……tÖÉíQ°k¼Ò‘pã"5=±¿ £iû Õ5ƒÙÀGÓ°Bµ¿pídŸžS™®jÉ6aç69ïRì/˜©Ø_¨ù³¥†XD;7ZGèÄþ‚xðŽ4æl¾ˆ.Ïh§¹Taá×l‡c6X|e Æ÷q¡¤çk4K³jÚÄ©Š}gÙ„O!gKðmN×ônôÁ¨}gmÚ`ÁV½9*Ä2^†«´ÉÄ^mgTdÔ¾³[¨ýeÏrÊvqpLXק³(ðй-TÃË}gkµïŒ—™!Ø[sæÎmîvž”.‡r„5¢™AûοW2ˆx¡ôs,xÑÕ‘>Œ[šm‹8 :k¢}péضÈ/mø•~1õØà:­ëf2Åf‰¡^t×*ƒtrì¹ç¸)ºîò¿Ù|w~Rm@é¯B5‡‰ÆfÑ`ÛAÃP|ÅŽj½Öä½`ú«¡ˆórÏÏ•‡Š‹m×r; ç§Öü×ãõ%*M°Eú2)}¬#C]ƒ¹@ñH€‚UÝ­È _´Ááýö³JÇù:ŠÏ5(Nõ¯a½+òñŸb!¡ü…?A—U`\d…ÕkÎR ¾ ©|Æaêaá·Qê-?=ÓÝö5géd÷q"Ýý¾!u¶ÏPb™;ˆˆ¨ÑC†°@DDX "Úa!³‰ˆþ> stream xÚ`ŸÿÛÛÛttt•••ÃÃÃ"""‚‚‚®®®gggWWW±±±¸¸¸ùùùõõõèèèýýýÍÍÍCCC444ñññµµµìììÑÑÑ£££áááåååÉÉÉÕÕÕ½½½²²²ÿÿÿ`a?[endstream endobj -5558 0 obj << -/D [5556 0 R /XYZ 85.039 781.388 null] ->> endobj -1470 0 obj << -/D [5556 0 R /XYZ 85.039 761.463 null] ->> endobj -5559 0 obj << -/D [5556 0 R /XYZ 85.039 743.459 null] +5862 0 obj << +/D [5860 0 R /XYZ 85.039 781.388 null] >> endobj -5560 0 obj << -/D [5556 0 R /XYZ 85.039 564.002 null] +5863 0 obj << +/D [5860 0 R /XYZ 85.039 720.089 null] >> endobj -5561 0 obj << -/D [5556 0 R /XYZ 85.039 564.002 null] +5864 0 obj << +/D [5860 0 R /XYZ 246.898 607.127 null] >> endobj -5562 0 obj << -/D [5556 0 R /XYZ 251.11 410.338 null] +1510 0 obj << +/D [5860 0 R /XYZ 85.039 563.439 null] >> endobj -1474 0 obj << -/D [5556 0 R /XYZ 85.039 366.651 null] +5865 0 obj << +/D [5860 0 R /XYZ 85.039 528.693 null] >> endobj -5563 0 obj << -/D [5556 0 R /XYZ 85.039 331.905 null] +5866 0 obj << +/D [5860 0 R /XYZ 85.039 445.8 null] >> endobj -5564 0 obj << -/D [5556 0 R /XYZ 85.039 262.561 null] +5867 0 obj << +/D [5860 0 R /XYZ 259.11 331.337 null] >> endobj -5565 0 obj << -/D [5556 0 R /XYZ 85.039 262.561 null] +1514 0 obj << +/D [5860 0 R /XYZ 85.039 149.472 null] >> endobj -5566 0 obj << -/D [5556 0 R /XYZ 257.292 107.397 null] +5868 0 obj << +/D [5860 0 R /XYZ 85.039 115.029 null] >> endobj -5555 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F66 4190 0 R /F62 4047 0 R >> -/XObject << /Im15 5553 0 R /Im16 5554 0 R >> +5859 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F62 4159 0 R /F20 3021 0 R /F59 3455 0 R /F41 3054 0 R /F35 3036 0 R >> +/XObject << /Im18 5856 0 R /Im19 5857 0 R >> /ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5573 0 obj << -/Length 2910 +5874 0 obj << +/Length 2239 /Filter /FlateDecode >> stream -xÚ­]sã¶ñÝ¿BõK¨‹&‚íôÁ¹Ü]œÉ¹î¯Ó™$´DKl$Q!)_œéï~¤$Z×™v/9…6Š½äb5œŠTGfâPt?G*=¾Š’0³ÙdpØ A‡sBQÙ!E¥C£ôŶœÎT°.çøé@ÒÕv ‚΢ [•¢\’!§ðZ)½VÐñ¨^„Ž‹»KF‚ñ~;ï*bèÌ&™S{Þ}p^C‡ôµ7]ÖZǪ‘>À›¶í(Xá”™g| N3À0Dñ+Uˆ9›C<¬‰Rvæ©Å·{¸í×$3B/¹ïxG%P"ß°vûá-/vhY/;çMBÞî‰1¶""y…z{ýŒ–ºçû“ÜLÄÁWkçÎê«Êý/p8ÓʱEFßq¼FÛ‘¸\ìðü5 -ñ¿@xŸp`ß3ŒKXøyA‰µÁà -¯Gñ5„<Õ º‚Là·µ(1qqW6eá’œ¢B<Ÿí ùm$G)X/ˆ„ŸQŠjÃÑ+S²Ü÷~óYø0èáZ^-ø³,·eƒAÔX ½GìÝ wŒáûÛÀ»Ôá”Ç™‰r¯Üœ -ViÀ¤f ¶×7Qê8ƒ˜6íjÊbë’z̦âø×´áðÖìW8¦Baï™8W’ÈøXX2´Tÿ$˪Ïú¨XG,y]ÝÞÜÝðÈKOaŠ?2!E¨’$¡Na’Ö“U”ráê«Æ‹P@Tmvë²+±Í@èƒð„äÑ'']2–IÀ×Ǻ¶ZnéBF²XdþUr ÚÖ1ƳÏsn¦àbYHbL(ÅVN«¶åïGœ^õ<8Ø¥D–S¦= -ßX/ÜÓŽ¿>PÓIkRü±òõú̜ -ãóÝí?17ÐÁI>ÈàCeB˜$@TKV2A-Èf^xâ¯5h¦ß¼àýK,e {tRáPå-Šá¹Ðš¶>cØcÑŠfД¥¢ƒ÷ø‚48ä¸Tu¯`Ù值tð@~nóUÓrœš,ÝÓÈ2¾¨åˆ$ÚªØ-ŽSü=a½–¡,4Å -ÄKSmxXRBÕ%FŠÃåX;èæJ ç’:N\cïè¼X…)þ¾Hȳö»·@÷Èëíþ•âžtØNIåXäËæu¾ ŽBŽ·O|+÷Éù³;„/Ø‹rlG1|ÃÔL#É»r¢7š;R:æÝ»Txξ¤eò€S´¿ºHˆ`±y›,ÔqS q¶âï¿—>LAOp\\©oQ¡ÕÉà§GàjS-Wî§E-m@ô¾T›PšSWÄvŒ¨s¬‚Ï\pÏHЇ¯ÀB5 -iúßÚ-ÿúØç&*øÓ+½(…:¯Ó…Ôÿ§NM˜™WÊt«u¨•ã¯¦ã“_ë-¼°ÍÌ)Ãÿ“»vendstream +xÚ½X[oãÆ~÷¯Ð#,'œ/R`»Ùu¤®»+’<Ð$-±+‘Z’²ãüúžË EIt“"iaÀž™9s.ßù†rÁŸ\¤VD:[$©:MÅî*Z¬áÍõ•tш(¶øêÏ««¯>Øx!#‘EÙbõH*«ò‡àÝ_ÞÞ­Þ\†Zë@fb&I¼»¿[ÊàKï>ÞÜ®nn¯ñÉ€P÷wøúo—©VËŸVß]½_M¶ 0±Æ}¿\ýðS´(Á´ï®"¡³tñ ãHÈ,[쮌ÕÂíž·WŸ®þ>®ÂïÌ‚gÍœ.ô¡ŽDššñ˜ÒÎshÁúD}Õ=-UTü˜÷î—ÖUSuùT°?tpÈý2õ¶wêe‡U[TÙ-Cä vmçæôø×I‚ªÀq [Àÿ_p\•è?N6±ZGU:Û»¥…õû¡Â•3”]ýTáÆ=O=9pœ +ù™Ãfé-ƒ3z{ònÝ8'&‰ˆSµ%z5£é쎡âÀ—0«B“ŸjÑAªÿ÷îl8.ê#i +Nœ}‡š ú{ ·ËK²*3™£RaÔLê$YâRGŸ¥Ž¾HXFŠ,SsY#•©LA#2ÂN5Î5­0ÒU_`eéÅ8 “”d K:áW7;-¾mÁ ÅѦP‘@’†°¿•jncÿKI«™$þP¯Ä”J5ž ¿‘RNÿësCrÄiÆvžl7[3wKÊüáSÑÕ{ÙÀÑ£R‚|¸ˆ­«„ª¬)¾.m:Ÿ¹0Šc—q—™irf×E½k›‰0,”kIƒ=×PË4âbkÑñÏK,»îñ€õì¦Vù@¸Eûôçqœ7ÃÔªËwÇ`Ò›Æ×4BÓ¡¬Ž›Xvá>‡# PD'AÓ8ªu‹ã70‚^´[ÄA#Z„‚:&©ä²GJ֣㶣éN‹ì“&xðc¤ „} ž4÷½ñš¼ÜT<~l·xœýôL¶®ùE9J¿Ö0nïXÉg®Ÿ°K­£ëÅÔ–Ùð)wBœ=ò‚ëùc'Õfæsò3àš§a]ÍøøL©£ïC 7¬jäIÞA*ødú×ÌZZDÚ/ÔU{^êu/!ð;¿á/(Þ“tˆGœõÆd<Çèœðàǯ´™»™ÆžîŒ\òømGÉàž/â%~pcÿCµ£€³ÂÑ°Ùž%Ö‰ilçy’[þ÷}å׉ b=®õ:YRÖ^|8^›SÒ÷oƒ¡ðNendstream endobj -5572 0 obj << +5873 0 obj << /Type /Page -/Contents 5573 0 R -/Resources 5571 0 R +/Contents 5874 0 R +/Resources 5872 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5534 0 R +/Parent 5855 0 R >> endobj -5569 0 obj << +5858 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 418 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5579 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 5880 0 R] /Length 26233 /Filter /FlateDecode >> @@ -22221,63 +23948,20 @@ L A8m:ŠóHŸ=ýÐïµà…7”hí/>† °Ï1_ªöÆ‚óH*È…I…Ÿ™H ic&ä¬æ.uy¤œþöIÑghõ¥¦kc…Ó]ÝÚ @h–Ò¢´Æ#ÒÑO‘ÜiæÆ‚tšÇÂ;c¤8Ýëª*™c i¿ -Ñ®/ÔE"v¹ë šÂò¤+0€\A˜UÍÄcÉ”§1°µ¶qo£¬ q¾øáÈÁDò427Záö Äà {Y1q}-Œ¤ÒýÞ–i“pÞ3*Æ4jP²žÇ.Vg¹†¿»©#¤Ýæ´Cw¼±èFt£S’¯ ©Ðu Æ‚ÞXXû§é{,¼ sÎpE.ðß(˜G}azÓíȬ¹Ò;åD[¹¢¹Â÷Å܉nTæ¼ïHmQ´iAW’_(&j°mò&*YÉãËÍY»ÚeÐŽ2*슸hb¥$”/°É=—Ía¾WØ«=ƒÔØó©¥â Ó®süB¼Êßö‡²µ=gÀj^i+ôr6îºÚo]kôq7±>w~Ù}j§ËjÛìlÿèãÅSh ¾ôâêõ¥œúp»¿ÜÜÚK;yµuïhyíSµÆßïߧêåäŽ×DÆ‚þJž¾!½Ü~9]á±ðr,„O,ä? É7aÃN/6`®Ë JŒI`~¢–¦©‹o©á(ýyg/Öo~Äغ?z†ïÀ¨Zåû`x¹ìái Jý ZþÅÛßÉ‹—?²'/^XèI/^^.s,LýèÅËË¥ŸìŽ/^¼ìázñâ…düj«Oíendstream endobj -5579 0 obj << +5880 0 obj << /Length 107 /Filter /FlateDecode >> stream xÚ`ŸÿÓÓÓCCC‚‚‚ÛÛÛËËËgggµµµ°°°Â£££ñññççç‹‹‹¸¸¸WWW›››!!!­­­|||“““tttììì555ùùùáááõõõêêê²²²åååÿÿÿ$<îendstream endobj -5574 0 obj << -/D [5572 0 R /XYZ 85.039 781.388 null] ->> endobj -1478 0 obj << -/D [5572 0 R /XYZ 85.039 664.766 null] ->> endobj -5575 0 obj << -/D [5572 0 R /XYZ 85.039 630.626 null] ->> endobj -5576 0 obj << -/D [5572 0 R /XYZ 85.039 534.789 null] ->> endobj -5577 0 obj << -/D [5572 0 R /XYZ 85.039 534.789 null] ->> endobj -5578 0 obj << -/D [5572 0 R /XYZ 248.731 379.626 null] ->> endobj -5571 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F66 4190 0 R /F62 4047 0 R >> -/XObject << /Im17 5569 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] ->> endobj -5584 0 obj << -/Length 2416 -/Filter /FlateDecode ->> -stream -xÚ¥YÝs›H÷_¡òË¢ª†a ÷dg“¬wïo,?eó€$d±¡ZG÷×_ !¹®j+UÖÌtOOwϯ?†øþù“X»žJ&&ö]Ç“eyåMžòáÊŽ™°Ìù𧧽þø§7åíF€ Î £s&üm·Ìú=¬C0@á‰\Ôá}þ¼¯3ÀLL 4¨ÊÍ{_vEëèäsªk‚a¡>£k§›e9Õíè”9!OêÙtæ;5 ÒGmV3ðw¸VMgAì¬ö0\5ÇÅ-sì›|ûÌÃ\gÍÒJÌwí©=!^zôšï;»x& 8?t=sÖv@n€öÿY¸!þ—~5…1¨õ (*„ÖƒåúÃDjœ` õhí9è¹2}ÎÚj~R‘qÒíŠ=iª<§N¼„óé%4Ûqøº¦=ÏVŽÂØѤéínÙÀ]ß¿§pßXO“ZxÕ^è´Yk2¼Üe›WBIeó¾å9Á†˜þôüÆÓü Dßs^ð‘TÓv$JËVG'¡  %SÄ$#J«- yζY¶YÃÓÔ¾jÚÇeïp#/¯aXW%º”.¡À—”£ÛÑ€ÈYWu™¶ ÜVhÌþ¾³aSš—¸@w$÷CË…¯á_Œ -´ Z %£9ŒÀy (ûºn™°Ê;Ï-Ûâ J‰æ¢C§,K‹+?c”ç%o7ÕžÌ[ÚŠ1*1r±p¸u,ÀuÍÉ·ÄYoRP?Ú `ã84[Ø‚VàµHùÎ=Í™†ž@){†ÌŠW˪éÕºµön™ÖnÒnÔ+›vèŒ{tÂ~Ö˜Í@4Š,9o¿ÁÐ:†ÁÿkF -AM'…á7å”ÖìK¾s²ø¿]ªyš”yÁ?KDô†xZ¦WkþíÓm ‹áôÉQëç7B]a'¡üWC}Às1))­ÁX}””bIJŒDæ¡/;Ê?÷T (UEN³Ãv²%ÒÈ£S½¤¼\™×•ïy.æ)ønè}Áš b³¡ðÆX­÷¼þÑŸ#~q½©#L[å ·ê?È>Ì}Ri ¹Â‚ŽYäÌ]MÈ1‘Ñ6®†¸¯WôH(¦H‚ŸØ½H.=± ¹6m´YÉÝ3}åbß#&Lœ›}Sߨîâf¹ßY17=ú­7°nÞ†˜/)ý (g̱Âm•búÝQúÖa‡–‚Çù‹V¯Zé-w Ù®©¶v×±HrLÎC]ÏsîzÄ4ÎjV£v{tvE±ŸóÝ‚dh5NuLwÜ×ÀäÛyŽŽ~ U–ëÿ²Eäq2/×8ª6pp½`Š‘¿âñÈê^ûN!÷Œí¿PÒû àz1—Ö -yë¯äküE|¡Sö¼HÅsXèq±óŒÓ0€y“7ÿ‚Y(ɾ*iOBi¥C½n$ÊpKZË ß6mZXþpºÀã¼…K g׬^æ2Þ‹þ^ͪ­U¤:c5Ǥêï ñ߬)þB-&„Z*µ&9W |ÀM…*p*0ó\è«s2Õ™«<IôÖ µ ¦ªW<ØI•àÇ•)4Ì/¼lbJQíJ©sgüaÛt9õýƒ”24§Ùs•€|ƒ”y¹›=œ8„«ÕµT -+U(ÞBUèËʆY‡þš{ Zù]ÔrÿaC3¤óæJçS””aÎæÈ+÷B‰ <·ŒzµÄ x.ÖÇ€ŠNxT©oŸ`‚€Ãòx—.¿M5Øh4—ôy¯êÕó\,}¾‰\ÃOµ95Ås ÈR<Úu=L¨ç€ß”yà G -æÕ®ßÀÊóÌTD •-ýÀ(åéõ"%Ž„-‚ò½±7¤p%°µèÚpF$(ÐQ4cö¹NK9Òöôcx7½|Ì–>¿p0ŒæY¥«¯ÛŠ'lˆÚ£}TIñ¸‚ç«ìï|I§€u1´ÑàìZxÑ%a KpÊÊ`짌x\$7ŧÎèH†òÞ<°5ªçmM¥|·îæí\CÓÑÚŽª¸FBĹ~¸&{Ç8º“Cµ 4wÔL×ÌÊîÁ6k¥¹Årò Z¨¨¶jeǃ,EU–Š‚äbX;M”ë´sx”(çݨÉ:\Lü*FøôêøhŸ TŒ6d„ÆXsÒ‚ßMzô~ˆæ±ˆ½î‘0{ú|ÍtÎý ç<¨Um÷ʈ»\ly;e{½Ç+®öôh›Êà [È‹3.“öm„ð!AÇŽI˜'ÆŽÀoJRr¨5ï È MÁ÷Ñ7¯¼N9 ñ°ÉòZXŒô‡4˜ÐEr”ˆ€§¯´¹}ßfLa=qYHå –ûw¦HLE®ÉÂÉ’Þ±¨C–1[÷Ž'«6rȺ*¨D¢/b÷Ø%EÞ´”x•ó»==Ûqïm?ÑÀ°Ìå>qÒ$É‘ÕÝ&zþ׊¸ºMËΣ(.•F^i7Xêƒpïž²Þ†Wzó˜Üm$‰?Òr'ÄS¯“kÞ`}ÇŸx`áÓ#ï>NÛJÞÙÿ欲ÿ1z?(ⱞh߃óŸÏ…cÖ³tÝÁiÆæbô)Ùr¼v–e9=ì¨äûžq•Š†§Í7ö[Òb×Fª+—eb3Îq{ÛA¡÷ߌžïè›ï²ÚnûŽÑ~§&Wj‹9¼íÜn™#Ãû,ú¯f"½ûXfìû×èaä_úPà¹ArþÛ®ÄÀ?ú¶ÛUn¬’óÞ×Aà¾Õ„£ÿ5Ð*Ш±Âÿ\Qendstream -endobj -5583 0 obj << -/Type /Page -/Contents 5584 0 R -/Resources 5582 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5592 0 R ->> endobj -5570 0 obj << +5871 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 348 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5593 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 5881 0 R] /Length 23954 /Filter /FlateDecode >> @@ -22360,77 +24044,63 @@ Z ª¦ˆeÔ€"S Z‘©ƒñõNür‡¹”gAk†‚¹ñ7Dp97â àt‡<ŠÿE> stream xÚ`ŸÿÁÁÁéééÒÒÒ±±±fffîîº›››ËËËVVVÙÙÙ£££FFF666µµµ&&&ñññùùù‚‚‚­­­õõõýýýŒŒŒ“““uuuçççÞÞÞ©©©åååÿÿÿ >Œendstream endobj -5585 0 obj << -/D [5583 0 R /XYZ 85.039 781.388 null] ->> endobj -5586 0 obj << -/D [5583 0 R /XYZ 85.039 758.673 null] ->> endobj -5587 0 obj << -/D [5583 0 R /XYZ 85.039 758.673 null] ->> endobj -5588 0 obj << -/D [5583 0 R /XYZ 244.345 534.01 null] ->> endobj -1482 0 obj << -/D [5583 0 R /XYZ 85.039 484.068 null] ->> endobj -5589 0 obj << -/D [5583 0 R /XYZ 85.039 463.739 null] +5875 0 obj << +/D [5873 0 R /XYZ 85.039 781.388 null] >> endobj -1486 0 obj << -/D [5583 0 R /XYZ 85.039 380.931 null] +5876 0 obj << +/D [5873 0 R /XYZ 85.039 720.089 null] >> endobj -5590 0 obj << -/D [5583 0 R /XYZ 85.039 345.521 null] +5877 0 obj << +/D [5873 0 R /XYZ 248.216 605.626 null] >> endobj -1490 0 obj << -/D [5583 0 R /XYZ 85.039 235.673 null] +5878 0 obj << +/D [5873 0 R /XYZ 85.039 439.91 null] >> endobj -5591 0 obj << -/D [5583 0 R /XYZ 85.039 203.858 null] +5879 0 obj << +/D [5873 0 R /XYZ 242.83 255.948 null] >> endobj -5582 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R >> -/XObject << /Im18 5570 0 R >> +5872 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F59 3455 0 R /F62 4159 0 R /F58 3380 0 R /F38 3057 0 R /F41 3054 0 R >> +/XObject << /Im20 5858 0 R /Im21 5871 0 R >> /ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5596 0 obj << -/Length 2012 +5886 0 obj << +/Length 2032 /Filter /FlateDecode >> stream -xÚµYK“Û6¾ëW°r¢„ð8U©­‰ñ¸²^e"Ÿ’h‰ö¨,dŠã¬ÿývãAñí­Íl¹F$€Fw£ñáëÍ -ÿXb¡"OŒeDX›l š|‚‘Ÿ,HdA$kÉü´Y¬^+0Jrš'›W=ŠH%’Íî÷ôÅ›ÛõæÕý2B¤,'ËÌ›¾x¿^²ô7ß»¾¿{·¹{÷3¶$t²ôý‡ÿu¿´"Ýx¡»w×áÛþtë[‚Ð埛·‹W›ÆÓÆð*G7¿,~ÿ“&;XÒÛ%"·É_ðN ƒáãü$JŠÐ>,~[üÚ¨òc2ñ³Æ¢%2N‰á|hÎä&˜=sb`Ž&ŸÅ˜%®‰`ìä†HÍÛ"}QŒ=øŒ"É—„(êúãÓyhL† w=ÊHläqxuwdyòòž%Wç2Æ4± ׬áð ubI¿A¥C‡†·ÿPE øaý}bšŽJªa6[Ñ ÜqNÖšä}à-ö5£¯÷Ÿžª@c --z³zÍTkÌ¢vÆÉßôÝåaãFÜmÜ‹2÷:vúšÐÜݱøTzH&DºoââÌ;‹ÃÍj½ÿºBTÕ­oh˜þãCŠv?2¦èbxΈÕb1-™IÄD\Ú¹X -šVÅÁÅgÈ>ÜòYÓQf`» ®ˆºcÜC‡[›~ómô`p¯w~ø -’¸‘UØnxEJ7–Ç£êĺ¨ð‘È@wéÞˆp¤5Ó©(P ÂLgà੪c’çcÜš€1”=â[„NA¨9Pš$—TÕˆI€¡d¹bäƒZ/*çupHK‡ó$²&^=¬«Ì4²‚Œã¢í·`€( -\ éaÎd”Øì"Š(TÇh #À‚##;„Ž]®Az–“Y§ ×BŸƒvuí±ûÃíìØfV³Ó9uU¦KºørçÇ…ý1À­EcÌóˆ”ÈaŽÀ Q%!¥)õ„ÔÅytÙ÷ñäd*6…)Ì(ÚÎcê*3© ƒëƒ„š]토‚ìNŬÍ(30Ú•"VÙŽÕMM€ÊsTT}ꃊxàó—õýêL@/MAž üÔ2ÍcérÆ_¨òT}öç -롘oÜÞŒòÔ5"e"â0zæsæYÚUúm¶ƒ.Ï£u Uê¡X(]”TŠiiÔ:-7«UUOuÙßO(Æ ¾€Êî$”ýw-A¸™¨£®¬¥l¸ï‚AzHF!\òÃéR<š¨çñËiúŽW"'´½z,Ž%†Íå²aè$Ü“h.ŸÅŨkÞI <,´é8ùå)‚ä)bªã¤PDåæyœ º¾ã¤°ÄšA '¸‹i¸ÅòY꺊L2WA[·ç³ãü“ã¯í祀¨Ô«7ع†>­Ó·î Õ/ñº*·ôÁåV!æü‹"}»E[ÆmÛCOrJL“Žu«y%º±!¹0†<€³põ~ñ‹°ŽòÚ‹¸Ë<©Ï@Ö*Ox³ÆA“¾õ’/‘o²POOSHúmŠª®¤ùƒû.).&Š>i.5zs%Uë%zçŽJqÓq»ÖÃ>w­À—˜…¿Þ,Ü@+Ã[Ÿ9ÝÔ“¶ó1¶‘@qÝ´³àKÑX7×@©°Í€`=ÐÁÄMÎ&/ IªÒYœ_e¦dЧ=ìõHv¦fÖZXäfˆiÇ\ÈÍz&7ëAnÖßÉÍ:äfxÞ­×øbBR®›l¬C6vÀ1!k3rñÐÝ.˶4Ÿê¦\¬üÔÖ·˜èvõµYN“ÕÚ$dicm»þ{Õ¿…À©h“å¥ÌC"—Ò†k- -gÀ Šî¡XØ.ªr¸6v“øÏß,ç@Êþ$ü©¹§àª¡ù1Z>.,ß| ÷ѽèùSŒ¥Ä)ÄɧÞF¬&!œX©k‰æêo¥˜¨*»êûø¦áÜÙhW³}:_n)Kè3¹TÍ»…Ÿåºn…¯á[Þªw£öƒ—©ÊÌ@Íís¸Uͺ/Œ ¦í|!ÃêGÃN=‡wAÓ¬sÒQ-o»7STÀF(nfÉö*2ɵAÄÕ§u=µ€Â9S^ o©÷••j› -÷jÃ_jÜw>Ãúwj¥Ø0ænð|³Ù¬ýü¦ûø`dö~£”ç™M¼ù‚Ò'Z†ð}áúêF0þÿ<‚žšŒõ<Ÿ¦¥ VL”­ŠsÂYôw‚KÞ÷ê'€:ü×xendstream +xÚ­XKsÛ6¾ëWpz)5ÒAD{jÓ4u­ë(§$Z¤mÆ"©t2î¯ï>À‡$ÊÓ¤ÏXx,û·»^ÂKUIë™T„2M½mµŠ¼;Øy½Ž"ò’0Ò +·~Þ¬.~UÚQh#ëmn‰d“¿ó_þöÓÕæÕõ:Rú†ëÀ˜Ôùöj-ü7¼zu}ùÇæò×8K`Qøo¯pûÏëu*ýÍúÃæ÷Õ«ÍìÚ -ñÞO«w"/Ñ~_E¡´©÷ÆQ(¬õªU¢d¨éæ»Õ›Õ_#ÞK<>µ ]0P µÕ²ÔXÙÑ1, XQs‚B´W*òKWÙ]Ñ7û”ÖÆÏêœÓÖZF~›u}Ñ. åY‰¤S1I$Ô‚W.ëuká÷÷p_ãØïàWøÛ¾lh3ò³øMýæhz¦ß·L/üà}$’]?LÛîPåYdž9‚"¸SÔk`Ò£bMM´9³ïï‹e¦x33wý]QmÖK|…œ›®³m‘ýÞQÝ"¿¦b2(2£¢!ÉgèXK†¸mÚ‘ ïÀ?ZYÃVjêtf> Ž4‰³aÉ~š|tdë4 +ˆOK¢Ä/;üUþc7ØWÁõ´ºmÈrŸñ_Ñö¼˜²-¶Hß#Ã'^uÆI9*LÓ!’d,ZpWÇþ—²¿wFãBÁƒé† ‘DfomåDq²ÞmÎý±ç Áå®Q0ôµò/ݺ¥ã᤽4Ò¯šÖqknG{Õ¼G‚dãÄÑQ˜¿™ŒÅë磣|mà +úf;Ð +"à4F~b˜"Ë=ÑRemù7X‚’q ¸(¼ï£G°Å$1:9€FôK‘3ž¢»gÓy˜€uë;w¨c’¨Ýr} q‡‘E‹BÞjï<\¿~~-ïÉ6|B¶ðÓãKd¢9çÖ*DE¦ð¢N ÜXã \A¹Þ'¸FÑúðKò™”–ãòAJi3] ~†Û™þ‡cë4Ôé¿öÐå’ÈA†‚¿/q‘SwàpÖáH5Ð4!tÙñ5bzÀ¬"N!– ¯Åk)(89àVNuô¬qË/íš}åº ¨Y¨‡4Ü“6سø‡îtÛw¼‰:Ý€+ó‰eæ^—Õ>¸âò2$éA[_pžM] æ<\GŸ" n¼÷ÔØPÇËD"Ú5Ü8qx’ã2×/0“†c¼¼™5.Éc]‡ w¡:†ËÈø(‡¬+‡^¾… åwPäçlû°–Ô¦akÖ ,U5I(’äùªfCŸ ÷ÛA˜áú<ê¾pÄÏV:ã?ñdVÑòÂÑgÑEF:Og®t‹§.‡ÿ }3"|ã 0+A…§Í:»/ 8&G9ÏO0@ªPLÞµY厹#Æõ¦Åa©sܽcíåêN ¾ -²üiª“(*¬›ºR‡Ç®ª €žNÉÅÕd ß:Ú¡³‡a抳‚UÂN8*ÉcCÑ0`Íå!*ÉsìFh0º„¤Â°înBŽTfCõ®ÈlPh-¸ûÖb²½NîßuÌ—Œ›§l|X ô³/gHQáÒ»æÞnû€`©qÄðkÆ0.fìžxi·ž=9,­£é{Ëm6\Ñ^¹¢Úv3˜»xÁ4TÎv‘/fò9yN¸ GÙi3Þ˜RLÞ ™pHÐ÷”·×—ßñ—îÓ ?å¼1ô `!$Œ¿úwQ>õ¹bÁ‡?“Œ¡Ï¢> endobj -5580 0 obj << +5882 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 575 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5601 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 5894 0 R] /Length 36251 /Filter /FlateDecode >> @@ -22556,65 +24226,82 @@ G, ÏÂr™CNå›QakÞš¡ß‰ŒÙ¨ÖF˜ö", fDå5°V@/ªÞYr8&2¯ÌЯÅ•¬¤zh¨)õ((—Ÿ²9 X.&˨œÌ óÊ ýZ,¨\¶@×CC¹bz‚ªµ€¥-‰ÅTÖÜJãb5ô[)¤âaX0§’ ¢Þ°@¥1Ãa¼¼¹P«¡ß+P¸”³™¬ö‚œ÷XˆTW°>f †~5¼EU#ÜË… ¨MØÍdáØ"l(Í3ô{± †˜š® Ê^(ÜÕve€egEgùhZ{ÁÐoÆÂè!•Sp-«€u˜ÆŸå€¢,,Nƒ…•\£#ú½X0 —† ,2d°`ÈÐý³endstream endobj -5601 0 obj << +5894 0 obj << /Length 107 /Filter /FlateDecode >> stream xÚ`Ÿÿ£££ÊÊÊùùù•••fff:::GGGýýýVVV»»»¬¬¬³³³ìììõõõ}}}ððð&&&éé阘˜ÑÑÑää䃃ƒÙÙÙ‹‹‹rrr’’’ÞÞÞ™™™ÿÿÿ¹¡<Žendstream endobj -5597 0 obj << -/D [5595 0 R /XYZ 85.039 781.388 null] +5889 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [366.134 672.595 421.945 684.285] +/Subtype /Link +/A << /S /GoTo /D (small8) >> >> endobj -5598 0 obj << -/D [5595 0 R /XYZ 85.039 758.673 null] +5887 0 obj << +/D [5885 0 R /XYZ 85.039 781.388 null] +>> endobj +1518 0 obj << +/D [5885 0 R /XYZ 85.039 761.463 null] +>> endobj +5888 0 obj << +/D [5885 0 R /XYZ 85.039 741.134 null] +>> endobj +5890 0 obj << +/D [5885 0 R /XYZ 85.039 658.847 null] +>> endobj +5891 0 obj << +/D [5885 0 R /XYZ 229.428 361.385 null] +>> endobj +1522 0 obj << +/D [5885 0 R /XYZ 85.039 317.697 null] +>> endobj +5892 0 obj << +/D [5885 0 R /XYZ 85.039 282.287 null] >> endobj -5599 0 obj << -/D [5595 0 R /XYZ 85.039 758.673 null] +1526 0 obj << +/D [5885 0 R /XYZ 85.039 159.496 null] >> endobj -5600 0 obj << -/D [5595 0 R /XYZ 230.943 420.51 null] +5893 0 obj << +/D [5885 0 R /XYZ 85.039 127.075 null] >> endobj -5594 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R >> -/XObject << /Im19 5580 0 R >> +5884 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F62 4159 0 R >> +/XObject << /Im22 5882 0 R >> /ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5604 0 obj << -/Length 2486 -/Filter /FlateDecode ->> -stream -xÚ­Y[oã¶~ϯ0‚ÇV´xÑ-OÝnwÛ8»9‰ƒóШl+±º’åJrÒüû3R[Éyè"€E‡äÌð› 9óáOÎâ@ø:™E±:Žg›òŸ=ÂÈOÒrx–Åðü°ºX~ -™ôEâ'³ÕC¿N L g«í¯ó?¿¿Y}¼]xZë¹LÄ‹¢xþáþf!çwL½¹½þ¼ºþüö åüþ‡¿Ü.b=_1Óõç~øý¿xÏ=-üÅï«_.>®:I;@ªÅüëâ×ßýÙTúåÂ:‰gÏÐö…„áòäѶ_\Ü]ü§[ŠÇÌŒgMYÅqxÊ‘RçÛEId·Ó'Ûé³íü™'Af=µ“ -…–10$F˜P YNYÑö 3²Ìþš‰À'ºû’„Q”ÀF‘"ŠcèÄ¡^^—ÊŸýXd³^8OÊPÄAh„‚†C@Î`øhß:ã‹Düæ~ -?òô¤dŠŽ*ðAšpJ¥3{»)^?‡ePž¬‹2|Êu˜‰ „ Š²ü$ƒÁ¬P _¡EÿêTV‚YUt¨qaÒNÙc‹!y¬™Ú_¡ójÆè}^g›¶ª_±™¿C²blà$%äµ»°o"¡¦(×IÚyÉ´q`˸¸9aÀi{Å'4¾BîjQ † —×ðuäçT‚%$zCU«†¼ÑpÑCÿ0 x5…ˆ‚Žo½ÄêfiÍ¢Àœí·äÀ%vÖ°QQ ·ÓÀJåN2 \‚àÔ…G|Øh ˆ·Tkוo^¸Gå*|Ÿë›ƒ£‹ 4§0ÏgD„õðìHHZ8¤€óïvÎÄö &Rm ߎD–ÚtG’ZðÀc÷÷cqpàÈ„}æöºÊ×+ÙmB˜7i›WV'Ùßm‡¿Æ9Î0¾O¶¡/ú6ÆwÜÆ0¤Àì—†—*!†& Œ±Ïx°]ãßTÇUH8]ëë¼YÚrË›x(¬²®íXºM!”iŸËæÀkmœ.iq9¡öIª[àÝwN8 -†’Ð^Áð€©G6@®a -æŸÕÚNOí7ã IÎgŒiTkrÕÇÀ+_øÛêjyÉ£§Q‚†qíz88sE2ØÌÖvR–<‚yˆx“ó?M˜`(J¤¾|Âç’oç[¼e=vð Ét`^—Œ‡ é° -Rå;mç%s‘ßá^ËþN¹$<‹â’ÇPÄë=·xSzg Â5¯cÃb܇ÅÀ2qP`’½ç|;ó¶ÙCz$ëÃ$?<½Á`Žþ¶œ§´„é=;p4{§Ô¦íœÕ·Ñ8R^à²×Ý©N¹üÒ-:aè+¼ÁcÂËè=VIk»ïŸhñÆ -ÉÙœå O.ɤ%K\Š©ZlP_S‰ðÈYw Àcç9§S­Ží ƒŽv^È’<žò´óòÇf¸Êæ°QP´{¥ƒIçC‘ŠY®ÁœL;~˜P¥#›N+ª °Ç¥­øš4‹7 -/-£þi†Ëý¬¤ µ°oqÿLB¨=°d@+²ÑKYÃ+¶ni6/·;qËÑm‡FùÃÖ® -Î]@(Ó¼àÖ<¼‹EëpÃïîï>ùÖ.J}íÎ DÞåå„-ÜÓ^ZPýMeÉKô ,$Ns€Ñ¤Æ‡;“'àJà¾Ã§ºHøöMö3V8*™‹‚Õ9PCƒKsvcL‚ƒ{]2å[Í`Zê^“’k«$ž*ý(!‘{þŽŠ2$ £.RYú±I×…•–êÞÌf/rt:ƒ×ÖxH£»Ì–#‚Q>W|¤;V47µÖ`Óz‘oæ_ö–¿ÍìS.õÜ+¶ÉÎÔà`@ÜÉ‹ÍXØÉ£×B$LƯǤ+­±I 2ë)ߎÉH, ø H8Î!ç7|ŽbWžøÚi½¯š¨=;ah¾#ºG­"ïñPÆÜ7]‡Bttá Wnr%hxü,JmºÖÂCÞ19où[ä Å5?™•=cʬÈ2T[£ë¡R€£E¨ùè»…¨±¨¸í=½òŸ&¨•U2ý:n ô^ǵˆu2ý(%”t² ÊèSy‹n–gÿ×òŽ€endstream +5897 0 obj << +/Length 2051 +/Filter /FlateDecode +>> +stream +xÚÅYÝoÛ6÷_aôI&š_"ÅÃÐÏ5]Ñe‰û´íAµ•Æ‹m¹’œ5ÀþøÝñ(Y¶åt‹×"êxâï~÷AZ 9ü‰aš0®ÜЦ‚©4N—>ü3?DààC͸IpêÙd0~•˜¡àÌq7œ\{–Éì×èù맓——£X) ÇF±µiôüýÅHDWD½¸<79÷#¾i ŠèýNÿ|9JU4ý>y3x9éˆ5ÓF¡ÜOƒ_çèöfÀ™réðOs&œ.:Q,Ñ*¼/Wƒ_ÚUhNé«žÝÅ G,9³RŠ³ÎqjOœ:J æœê“$ S"†ö_vXöY¦ÐY†Ÿ@PâéÍÓkhSO*ãâø|)ÕðEú ·*YÇœÅíÖBöImžÞ»Föx÷Õüã¦ÌÁq©w®C__‰¤Ãj$ã`=â?Ûw¦I™I©¹#ngFÜeVbÕŽ%¨.è¹.ab¾É4ªó2ö¼ëQ,m”Oq<ÿ ,SBÚuüKœÉêŠí«& `ÆrH¬´  ÷ ¬é“X$Äi€…Ugiº·^å«)X,0C·HíuÆ`œMG`[4R¾š!]E {kåà- +O"›Œêf?€¿ø°Ë:¯+Ìrr8 ;/ð q¯µˆÞåä?þ'þ+ÊÛðQãÒ»99^cüÿþò¼"¡YI<8ÞT~õÍÛõЉ>ØÐÎ[¤ZjníV€§À]ÍKz¾{‹êìów´ú¢ðò:e úv«."ŽÔ¥™F_«Å=-[¬ò°Væî½²z™f+Tyg¡kX¹,–;–'j±•pÇóÕG¢.P ²º74~ÊsBÿ¡=pßr°¾7ã °åï0zYŠ¦¸c|oÃêš0DŠâÌ*[6fÅ×e†øº§—»QbÈq°ÄÉw1 nˆØnµåÜùçl¹^ž¾C}@kšj,è“~¾ +Š–eÊ#Ü[öó–6°ù ´ƒ,S^-$u¥ûb¸“x}ìIÞ{› +cÂØè¯}J²T勒cK÷†õäý«˜öXàS¿w­øN. ioѸ —Á°E¾÷XoŸáD<-V«×ÓÚ?fļF3Ï).Bâ Á‚õ\Éè銃Ãèó+É +¡‡ò ò_yPÆB@aÐÍÄor–ßͧmØws»î¤(¢ÜϨਮÉ×L +¹õÉÙÃ`¼Xóž +å3Êþƒ2Z3› F4deûhpTy9÷éØC|@iV8Õi€š¨ ð4äOÜ¡çë¢ûe‰±•-÷DÜÃËìpɼ¬0IコQ›<|>+ƒ°›œŒ8h½ÄNúú !ßNêúþŠÿð!Û̾"á}€J·‘G“H¦uz2bÖÙ¦ÌÞ+Ç “&J-É?ÄNÚ“Z¸Çw²‚Æ'hœðhOÖ(-hÑ’oÓ +ò5üäxü0kv‹\‹@ôå·(}i™J@÷<[8y¼HÇ´Lvðâ³IÓP<Â<µ¯’ÇXºí,7Uøp^õ¢ÉB~·®õìFx:’slè-ûM³Häé9gZᮎ G)¦|g~ZÖ&¶¿±tv<ÈÙ‚'õiñƒsÞÚ]ž½rƒsY]g¡wŽ ¢ècZ%àÄÂöüêœ^º€¼Î¦y¨]÷=žðÃOÀ¦F%\ýÏx/Î KU)z°dupÖ‘ú™N(™GCiaÙhv¬ÁÁ³’>9 )žf!Åí^ƒ£¸{°tá2ÞÔÀ÷¯.Ço/^ݻğIVt*¬»@†¶¦íSxoqkÄC½Å3[RóM*¡¡ÎyP9À’éö=M´‡¤ÿ¦Ð%†‰T¶^œÇe¾,ê|ß…RÆ“F¯/žUÓØ4õœTÃLëoÕçª4ÉÎ4n¿$,G¬`3é·ÐáÓ&ßúÀAJV§K7ÿÄ=©DJ?:–JTš2ƒwFš3£_—ž®×ˆ×+¢Ñôv¤Éõø5/¨Z½ñè®_øC*ÖèŽä¡![ªÓ“v¦·i—ì°€³Ûäø*Ö¹^ÀyÀ‚çSLk,FáD½]¼&ŽßxÂ3 · ±c¾"ÎÄýxI‰ÓOû–÷œöXÁ(Ì?ˆB+…Àw~€2®§üåaÕUÞ`»m„#-q¬Ã9„®Ç€å­¨:°@zî]OWý¡ôá¡kçvŽ–¼ó,+į¯ª2z9 +í=/ .\ûJˆöG|!¬ù{ º‚“!qÒ# Y™÷AMB‘LUºuì"ÍÈ@Éa甌Ñß=`KŠáK4G·Òkž2gÒ.—™wÖ=Õm óÛ늢 =­tpx5ÌÙŽ¶ÇJºˆC/ ç"Ë8ý²ðU«Êt³®¾VQÿ¢p8Äßåå"b…6”‰=„öáão²„• endstream endobj -5603 0 obj << +5896 0 obj << /Type /Page -/Contents 5604 0 R -/Resources 5602 0 R +/Contents 5897 0 R +/Resources 5895 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5592 0 R +/Parent 5855 0 R >> endobj -5581 0 obj << +5883 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 369 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5609 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 5901 0 R] /Length 24902 /Filter /FlateDecode >> @@ -22717,249 +24404,307 @@ JA •(làv«ið7ÙüÌï‡ù £I’Ù§•5B…éT1Ç¡œXR^KÈCy\H[t­¶0MòŽ\xi!eŒ=8Nõöü…I.x_ãî˜4ƒÑX.D\Š0ãÄ’Uüªðþp»€}J­T´=éQˆµÄØ…LŠÌC¹=¬©²*—óÃüô\»ðà8Õ‹5ço± ¾½¸f(¶.¤=%1p¤*PÆ$ì¾q×Î^„;Ú;'2—Í·\Nva/«­ ÈUa|èù8)i½“]xÓzªÿÈ:qamoÑÈŸÛ·×Ö‡0þ¸PPß|.€âŽvÁ옵r™NÙ‡b90 å<:jÞ}ü…Ë.üæšê-vÂænŵ±2݉ ÞÉ.”1*‰¥¤ÓÄD§Š|¶ìëÝìBe!ɹè !hǺo•ð×æíR‹óPïÌ5ÐyŠ¥V!“7äÂKû Iž—«_âÂÕvÞgŸ â7î Àë<œãB=üV{6{âÚ³1£) ·y;½ë)æö©\X)oaSÅp°qo³G.øÞâ6ŽJð³C°fccŸ¹õù„çÓY0;‚x$ZÐ3¯" î S‚rŠ&¼8äbÄÖÖšªïÍ=Õäý#°˜ÍxJG`h×t/q!G÷47ÚÖšÎÆ Ù³1h{;ÂGƒµý¸×Úóš8Ã~â·¶/;‚¸Ð¡]q¼Ä…üòl=a¹Ü›¸ §¸0Õ.¤z6÷Ä{6m5Å…ý&‡ýê Šžì@"ª­§bˆpÍ):‡þ,ÅÙ„Br’_=‘Zšž£WÚ~ÜRP•D!.<ÈKM/ÓãÛoe·øý·Âµ 0è†h xS=s ^Êý/Æ»w8ßQc>ÍÙ(¦z&“àèðbe{ÝUüÊ8zhendstream endobj -5609 0 obj << +5901 0 obj << /Length 107 /Filter /FlateDecode >> stream xÚ`ŸÿõõõšššÛÛÛ‹‹‹éééËËËIIIñññçççXXXÓÓÓºººíí탃ƒsss'''¤¤¤{{{ùùù«««³³³üüüiii‘‘‘•••999áááåååÿÿÿ=Œ=±endstream endobj -5605 0 obj << -/D [5603 0 R /XYZ 85.039 781.388 null] ->> endobj -5606 0 obj << -/D [5603 0 R /XYZ 85.039 758.673 null] +5898 0 obj << +/D [5896 0 R /XYZ 85.039 781.388 null] >> endobj -5607 0 obj << -/D [5603 0 R /XYZ 85.039 758.673 null] +5899 0 obj << +/D [5896 0 R /XYZ 85.039 758.673 null] >> endobj -5608 0 obj << -/D [5603 0 R /XYZ 265.428 523.51 null] +5900 0 obj << +/D [5896 0 R /XYZ 265.474 564.211 null] >> endobj -5602 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F35 2976 0 R >> -/XObject << /Im20 5581 0 R >> +5895 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R >> +/XObject << /Im23 5883 0 R >> /ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5612 0 obj << -/Length 2976 -/Filter /FlateDecode ->> -stream -xÚ­ksÛ6ò»…Ï®ÔMÈ|³_nœ¤ytr©š¨Óé´ý‹”Ć’ŠëÜŸ¿}„l:½™»ÉÄÄ‹ÅîbŸº ៺,Ò ŒË˼PA\—ëýEx¹…•WJ0|Añœg«‹§/ÓìR…A–—«ÍD' ’4¾\U¿zÏ__/Wß½_øq{ª ~žÞóŸ– å}àÙåû7ïVoÞ½B(Iåý´ÄåÞ/ŠØ[1Ò›wÓòõ¿ž]3áâ÷Õ÷ß­,§–àªD6?]üú{xYHß_„A\—·0Ëû à3H“XàöâÃÅ–¯%—¼kN+ÃÉÊ(ýºæ2$Yl5Áª -Ê4u5—†A&¤9 ™ -¨wá§iè­OÇ¡ÛÃŒ›õÓ—‹8ô:PüÝã ³Ìû7~ro×-båÝ2P-|E¨°>î¨ïú-TÉÈHÍaìx4îj,8l=žpG_ÿó1M'yª¿}Â!ÙaøÐjTĉ~Å¢²TÊ»vÊ‚˜m£±&†`4,ü$ ½½^D…wÇX7 ” ,QZeÆ{ÒÂ02tÛT¼¤<¤ydz'& - Së¼0,¨–Ã0ê¶aܸ¢,QÞ/‹"ñºïÝ/¢|¢8ΰ·nkÝ£ZA[¾BS*I~X9¢»‰'1`¼ÑkwV[ fƼ]ð)¬'šL¼ò*øVúÏ„ÙvG:’¦Pö,VE«÷8xŽ8V€xd™ºc[£©‚·®v†ü£è^6kþ\­v rV1¸Ä£4NŒtèÕœR*äÙÇI€"Z+~åf†ÎN2åƦÅ;ú"Ê¡­‚” `x¨®¹HÝ2Ê+€v`,¤Óu߉5Zš4GîAt!¶ ?C¬¾>TuÏã?púf``ÓõÌ0ŽÁ,˜õg+•àµ}‡†tÓšù•Þ߇í  s'Þ8§–uŒàÇC‡«·åg&F' ÓãŠ×€«Å$ˆ±¦Q¿qä½®{Á3JÄñ-b ܵ2ƒâ^QÃÍaËçûŽ¶zC÷p4’š½¥¢K©hÈói\p[ƒä‰JpQ R Æ+bŠýoÀkÄ’Ö3ië–7h9CñÆûŽþ6zzWŽÛÀFBÂÓêyŒÇìdϨûm-ÞÏ䋨t¢Øœ¸0Ž2ï4ðµ3Déñ…Vù€ ŠÝál*ËÛúP÷ @Åà†ÄÚ3À‘W/)p±IQ Ô£ðJ}È;ôw^~A×üÙ‰;´úBúFrP}(ë[$ZÐ}üydcAX,;èpjk•åAÙ7þ‚õE[9kº:ô5qÝmñZ›/5W -e8i€ R'}’D9·dEÎÔZk™ð3(„ -'¥EY€?¿÷.“Pϲ_šY˜ -æÃ÷-o‰Ý-~¬Š@XÄAç´õxÊ˦ëþ[ ú+0â¶YùÝáéçC †ĨƮà«ÊŠP¾—W3lúiG…œÈYB8™ )¥æ dþÄSnÅ;HÔPsJ&…Ú ób–Œß2›„øØÇ:†)¼êAV7g4"2Û勉ž ¡Ñ’Ð{³q9®wĵ1f$3œ&ïR”ÅàÖ4cÒS4Â*ÁœXIðIf/º®ÁS¾À³l8•€Í•¬œŽø¥ ›8ƒã³´ŒS pcwñ1ôÚdDB•À‰å!Nè£w2¥ÄT7Ý"UÞ£f@Qö¸½¯º™ ΀Q丘t‚a•n¨œˆ‚wžSîÖ6³%ucé‘HbÁXBŲÉY,|5–L¼åz÷^²G§Æ*踓Ülœ•óEfâ¢rƒªDªhn]]xkfìHád­G1Ž™,Àˆ{MÉÔF¤¨(½Îˆ=0¬Qä±ó‰˜û“©N(öGE1Å:Ü`ó7Œ¹rlëst±n#4ø:K¨iËÒ4>DGv32º1×u†?º77:aÿµ¸–«ŸÏê\Ð}%D2ã~&‡Fàsx÷Q’rlJ!€­QQvf%` ¸Nx3¼ a„Èâ¦ß drù"…3mk8GÜñ«bÂW ’7q.JbHÍ\â™:I‹þx7F2ij!•“p&ª jÑ®H®ÃÃjWsÃÀF\>Äa,-Eˆ¾•¡x^›6ƇNpöÄV=Rñ&›xp]u7¦_À-®"È‘W”9uI \ó”·ñf»£ gP·ƒéVC‰„hÈSAÊ UÓvjIsõƒjRlìvWcq¦N”`ìïdÐñ·b³8´\Çcc€ ‰ÜAœZ¿ä+ -eà¼Éo–Ž _¹ä3ïgZ©Øü jxzÝ65㣂Rz×¼p3)t­•`€ÉBöH¤¾ïúzFf¾ >ˆ£Ü‰±(/&ÅÒq‰?°æ{Æh$Îå¥gš?ðWóçÜïêP÷áy5ÓxVÚŸúÍ~ ;gB”jA^Ý´vV>ÐJ‚uøqª±)tÞOVy”Q4“¬|ªcs¥X‰ÉYxpÖŠl•sT« ÏÏ´lkcŠg:é³9ܘi©ÙˆccKadzÁ'ÎoÌÀ~Æ݃G(\Ðí¶ë¹ÝÙ››™‡YíèÁ -ŽZ‡TM©ó()¶yú¬OÃÈe²?4æáöü´Ü,”q Lw'ˆy¼Nâˆï­ÎX?ã»Q´UŽ]/íJ‰?SCgÛV˜vc”ï–ë¸×¼ Í”zK(aúð=òþ”Q=PÄ’™ -¨G(T­l¡†¼àäSÖû)콦fÚœ˜çqûPH=ãÔT\!$ÙÔAéTLßòæ¹´\$g-n£ÀÔõgž"Ù~õ¾•ÇJ,îã85ÉFÜàá“¡nõZPœ°*lØÑŒ2ÊCèmóѤd˜y»|O’‹E?ûðÂKmÈ^_¾øÑŒðã=ë‘£¸¶l¾¤ÅRórùxoF–‹êµ¼ÛÊëÙ$ûÓüÛŒXrO#ÐY¦$éþöÈOK -_RõÕŸ–œGVSª ²<=ÿYMÉÏj+ós×sI¢õhÿZ'.®ç˜SyÿsΣ¿{Á'ñ†oQQî¼EEyÈ®æwW^&£ÉÍ/U5øü‰ßέê8x|n0Gyä.ö²ºH8†È•­QC·b„í™s%EŽltné!Ãå¯Ö&øcl˜;#ãò8ïÖ/Üë̶3öÇ–ñDm:›E—8>EÀ˜úå §^nÄ"õhÐeÁvàÃ=ÞcOˆº>í¥þ±‡8 ¢rÎà?Ëñ?ýmm*‰ƒ".çM*¢ R†Ô[”$÷ùMã"€ºò!Ãÿ!Û„endstream +5904 0 obj << +/Length 3131 +/Filter /FlateDecode +>> +stream +xÚ½ZëÛÆÿ~…`-UD—\¾îSS;¶/(ì«­Cغ’(‰>JTIêÎôï¼–ÏN |ÜÇìììî<~3ŠšxðŸš$¡ëé$N”$Édµ¿ð&[˜yu¡„›h׋BœúÇâbþ2Œ&ÊsS/,6D²Xpž¿þázñã»é,G¥îtljóüæzªœ÷SJ‡¥3i Ã3kàX +XðÀÃs5Jö°/r˜9ÜòžIšŸÛù±•»ç×çÂBÂÂè_ÌþXØ ý7Ð/«sÞÏoøâèx(À:»ËW´rvóîJVƒTxRopƾWà0•ÝìÉæ/ƒþûkÏÁ:»„“¨ÔEàŸ†áe¨9“–ÔG% Ò¾’õøTö(ç9{ÜÕЃ>ðÈëkþ¶O:¬«•½)¤.çò*?r4{ÏçU¶/Í#›Ð^ì†)ØŸÆÁ¦ùu+\D£6×ì»I ù†;GŒ™Òêt¬Ëâò4b#ü½BàLܳãÑÍ묺Ë*z±#\0ÚÑ×£t +2é?A&äü}Ü8Žÿ„ýfŸè.á·A›ãèûí$î<_ë´aPœ6H°&²d`yè´‹L&È[Ã’¾WíáÉzgªLx.­=CÛðççœâB‰3÷6À2te%™u-pè‘;?xQž§Ž7pxvÜÚ ÂdàÔÀÕK¨_[§v‡Ò®°•Íð/»EŒÿ¸åÎ4LÏ®ÈJð"p[“‚³\óp~X§–y=æ2C7A,tD¡’'^‚º/«ÛmUžŽs6ÂÖñî¬Z/öþr9?Óƒ´\M]îë¿ÿ_[ƒ×W8<ÒÁYwqê‹:bäŠ4j=\ïòn’"# ‘‚&¢ ­ZòbøYq§o¹Oq7 + 6 +û÷ :l…þ¤MN¡ºÁ}XZОž¹Ç‘%ak•ËúX–ÅȱBüR?¤±jϬØ"*ŠW6"/Ž£²çG”Œ€ÄÙ±2~ +æk3G<Ù§ÎÕ¿ðSopH“s¤Ä)+“]g$HÆÆÛ‘¸ù€Ã%ÞUÅÛ<'ƒxg>ñøy•‘5eE@ àô÷(C †Äwò¨½mdª$C³b¢¾(㪢«5 Ÿm2oÄø"¿Wb7ð,^)È“hgFî&pþ}¿Wøð4^·ý4÷‹-ÄÎ>>$þ-þÊ$`x¢yA¶œcðž†#|ŠÌnñÜƼc7M⬠ì‡xuÈ Ð%Dþä>8uÕðÎì·µ“FšÜkX×°y_åMÆÍîJñ˜›=ðÀ¸e Cß\xV â©kZPÉ(‰±ªrÔ¤†:ðÄ ð|ÃVhm‹á9,=œ³{¶—uNú­ôÊ4yyhw?W€ìKÓJ^[ãÁ ™?~Éü¡Áq@?’8«jfµÇx£Cç-Z@Æ“-6µe¾*O!M)&Ð òf¦áVwn ¹G1ÖÂúÒ›Föù¨]™ÝÊÇÏFN~oU(›c«î»JžQÑàôŸË¥¤f0a„_„É î¢7£°X‘ØîxØÈ,´MInû>ö ì°P5TŠÉ\gþU3”­…Jþ¢§yñräH.\r‘P>…‚ÀH¨#¹Üz³Í—$™>¡ö’@À<©9|qáiäÎP8_„“æX1§³0Y+ža6ª}’ôêÀ+7œêº¡+þìÈ}€ÄÖ+ò¾Ò`k%H2»Ï×cÑym >QÑ0r„pLŽœµÇ”e 7NâÝ"ÎPq¨ƒ7Ð!ËÙÁÊ¢±6ónW1œ‹’¸"Õ:e¸–óã÷r: •ß»ÙJöµ©'¶?Ÿ¬e7ÝžhWÜkSÅ”\H„@•NP‹1àÔ½7ÅÆ-¦ŒÓÙ€7ˆÁ¤í ׌9‰9›&¾ãCŸáÏh’ŠŠï¥’ⷞ䥄¼=¬Ü"=c\+Òå¡ËÛ1ÙºäÊm›—eß–ÇQBamÇt&úêÅý"k,ºÁ>Á[¥Xn,$˜±î ˆ±(„‚}A‘ z»}åá}Êóý¾»AX„¥>œ1õ­}ìîòýȉI¾›â~J%5õœB?8O²YÜX•UÕ•¥xläÂiQï\r7"P 7x ºØ(7ü¥±±ïaµ¼<ôLgÏͬî-³™ SÊÑü4áhÂ)&"P%8ðwˆÓx &Ȥ”ñSm–…HK@8“F/Ÿ¶Oó=³Ø9ƒ5?OEõ-¯ç˜$li©‘ËX{Úy{ú&³{]ÕÌãk¦Ç£b`^˜¥ä–83@»‚×yd£‚š²›¤¸îòuï‰h½<IÆúËiGÚ¬˜%°Ž+~,©’ƒZúkHoÞðE£Ð¹©[/µŸt´Ê=RBó`ߊ4»+ë…n[9šÎ¨¾—DYë"¯I¸é È +GßIž@ªciöLùÊMÜ„Ü(ˆH˜ï Ô@ …{ý›šï&žÿd@»”"\เyðüƒý½^¢•V9Ÿøþ»Z›x™3YÇ|¯vžšíOFÜáüŽðŒÛ[?“”ÈZRëñ<¹ÿî@ôŒ?ÌŸ’ñ<Ûè^3züSG¤áC™i$7OÕLjž*ã#¼Ò>fƒj¾kG{ü¥DKàeÇx‡”ñ¶js¬=OŠaSÝ»J,V–‘a}"ô¸Lϱ”J0EjM‰ ý±ÿó#ˆ]Õ!õ¯þNç‡ÉÙ°‘ òûûÕË–˜endstream endobj -5611 0 obj << +5903 0 obj << /Type /Page -/Contents 5612 0 R -/Resources 5610 0 R +/Contents 5904 0 R +/Resources 5902 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5592 0 R ->> endobj -5613 0 obj << -/D [5611 0 R /XYZ 85.039 781.388 null] +/Parent 5855 0 R >> endobj -1494 0 obj << -/D [5611 0 R /XYZ 85.039 761.463 null] ->> endobj -5614 0 obj << -/D [5611 0 R /XYZ 85.039 740.47 null] +5905 0 obj << +/D [5903 0 R /XYZ 85.039 781.388 null] >> endobj -1498 0 obj << -/D [5611 0 R /XYZ 85.039 145.051 null] +1530 0 obj << +/D [5903 0 R /XYZ 85.039 283.392 null] >> endobj -5615 0 obj << -/D [5611 0 R /XYZ 85.039 110.305 null] +5906 0 obj << +/D [5903 0 R /XYZ 85.039 246.193 null] >> endobj -5610 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F35 2976 0 R >> +5902 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F62 4159 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5618 0 obj << -/Length 3048 -/Filter /FlateDecode ->> -stream -xÚ¥YYoÛH~÷¯„–"šMvóÈË"猃IÖ›8X,fç¡-Q'<’²Çÿ~êj’²dÏ.‚ fÕÕuõWÕ-5 àŸš¥Æ¢l–¤ÊÒt¶ª.‚Ùf~ºPB±’å„æõÍÅå{ÏTàgA6»ÙŒ|Œ¯M4»Yÿê½ùùÕõͻϋeEžÊüÅ2IRïÍ×ë…ò¾ðèõç«O7WŸ~ž†Aå}½Æé~^¤‘wÃDWŸÆéW_¿â^ä‹ßn>\¼»$d©2óûů¿³5¨ôá"ð£,ÝC;ðLW §ot$ýòâËÅ¿V<§g¼êœUÅ4ËBó¼åbåë8,¬ò3c¦–3oM––ÆmUF3&ð*èUŽc«¦¾ëžÒ\x<+ËHC²(sÆ‹*ö£˜øõ|¥Ãȳ‡¾Y®Kå55ÈÑa«o¡uXõ’Ï–Ð-±­½ýb¦^Ó]ã·eÎ3ÿ ”.û¼ÅÁzËc«E˜x;°EíÖC§ßuÜÛ4-7l½3ï;Ûân›ä¸EÍR~¼úøŽ[=N=°ù Ó ®VÞšçãZÔâm -¦Z*ôkFÊïq:âNÐíz[¢¢´t p’Žcïõ¡gÔ£A…nXˆ»ÀPÈ֎ǪXçŽ97÷$Ù×}íMäì/cü¡!T8ñrrT¦Æ˜á-Z½&»N ÷”Þ€WLp³ËÛœi+’àœQšMï¯q¯Ø»å-ñoâÑƶ£ùî*žz÷̧û[Ür‹Ž¿–ùq04K>P5ž&ÇÞ#MÃhüVœ¾C |8$¡øCSlÔ@¸,‹CǶßåÜ ûÚÊibÛmÞÿeÔ€]H ÷5ªØI Bþ7XþÜ|»gÑ`wêìÆ0@·dÚ«4~ÁfY3•3)ΣzÛô[vSPX=¢ŒZY¾jÊC%hâÇ„UA"ç> ‰Ó[‘þÔ†L„*(í¼Ì*·9™0gÛ0ÁêÓö(3À ­š›–tŶ&mˆÖð ÚaWÙèUYx&£Ô{ÍÉ9`|Fá}KZŒŒÊ!¾ˆÂE•–†˜ø¾¼ÃNw¨¸šìYOÃÃrV뛞ô…æÜ!"wW,X?G´Æ™)b¸fÇép³P È+0$·æ$vþÇÞUTB@D°`΋ÛæгKÏ$˜8ˆ}“„ÿCnU˜eÌÙÜŠæ@{$OçhZn9òc>CJÓY L¯±ž¤×,ðµÊf&‹|*ŽÎbÿX?Gi?¤|?û>S~ ‘-QLÚ$ô¨ \^UJÍÞ6 Þl"¡°]Ž|9禓œ«ÂÌ33q -E‚;?bYê1”öýW0FçRÎûÃ既œf‰§‚ àžyüTPLvk<†Ø-¹…l›žùZŒç²a€¥‘Š:­Èâµã¥xq˜ª€úL¬Ã~Ãþm›×} '0ŒCQËç;÷®D ‘`@ª 8R¸oQbˆ)Ý¡¬–ORRN€¯è ­;“"òƳEœåláÑ -°3¥˜p_+\ž­ r`s†À©â„d¥8‰Ò -&Jö 9X…vÙXD´4`g!'²øÍWhÓ±‡‰nƉE÷.S $$[a&0…Í=!º±áOA5@~F³9E”ÛŽ qAÁÖ¶<䄪‰‡%¸ -¼÷ƒßdÉ/T¦ÒhÏ$¤¬Ñ=Ø8Ž0†/Å»5‡í®|à¾âå¿7·ã²Þ5iª—´ô»†™¡y‹2tOµcx$1ñ–Ba„-.e¹ŠˆEöl@WàýQT`GÖ¦ûgoeQe†Rƒpè]“¡º¨HžÀÕ™ñ•Žglû¤D8VA2[âºì‡á; üDeÏ^3t¢ü41Ï^y´Îü LŽ¯<‘\yæŸí"RìW Á˹ˆ‚Ÿƒ®¦`?Ÿ§´Žý$Ÿ—p¤yò"¤•öÓ”¯³ÿÁ+)•i*õV¶æx¿äÖl¸ÜâU*W>Ý[zÁZ»v Üb4•X'ò:[»ƒ­q5`å¼¥’ðžk¶õyšƒÉJjÇ>ˆ©à=¶°„¤ÆP¶³HG…O¾¦£žqñqzž˜6Æ“ŠnÍ=‡pÚÄÌ2—ñ†Ç¦ó{.¯¸N\CÚ9}HPtsnÜTí5xÁB -–¼:g(â‰~s*Äã+ÎÂßò•Å¢MÍ5 -µåÒª¾ýBNè#+|dF[™7¸”jÕ@" Ȉ½ýæÊxX Ž—P…àŒ–GUkçHµ'š}à­º¡¦“½Å/xõ·YÛÞò4Ünº„5]èÅ ÀÉí±'aÅÓÓæ Vi§VÙI™Tš€uôl@ß1¾¡óýà‘F…äHœò%ŒÍ— 7Ðj–py.|÷}áxù@÷ämXîíG2Q|ÉN«†\QÙZˆJ -¡\ÊqÀÍ8©Á -¬XÙ5Übã÷§£Ã^”°C\6u)‰Â÷C~È%w Æ»¢Ú»<ã*6Ê#üÀB7a–¦€Û½»¶`"«'\èqí-·‡ª ¬LE/rU„ÜÁÕ€(ë—¨Ïåûh -” ŽüX^‹þدÜÛu…(v–×ümí=œøšN!ßñ·kVßòþåå%äú`+¥_f -1‘½ã]ÕÓ»Jñƒ„¨Ü¿Â0¥b>'1†dµ­\ „`:¬g@ ò¾cèÌ_¿j©>_ówTR1gµØžwüöC—GF,¨pɾmvB9MMÉ3˜,&Ão¾E—Àœÿ|Ísòþm1\ªWýœòÆIœòd_u0ylºßx† H¯®ùk‘t-WõŽÇÄ5>úŸÒ à:t Yæ®Ó­0Bß዇ŽH“« Ož92Àz}­×üŽ‘QIŸëë·ÜÔß±ïãpâ{H{~’Æ /* -Ñ…Ê/Ýèˆ.÷¶ß]öÍ%„ýãþ4 χ™^d4º?0¢Å3•Cƒêyòÿ žµŠBy” +…øÑ ,˜>Þ!d”¹Z¹©Óép.åB>È“Hvyi)Š€#üŠ¹ñé62Éñ+2`u\Þ3Î1\0•‰€¦os - #iÈòpËm—zäM—r\ÓNü!X“4¬ÉÜÌüÏa¤ò(Ú8Öœ@BØCñõ÷ž‡ÒÉ1&q ãÎÜF¨“œ¦•+/¸3äœ@±Ô”#ïgyÑuY™}Ú¢ˆAâl ÇI --h¸¨ÇùÎ6:•ïA5|„z½ÆÅG¯×.H{“êÓtÈû1~ûîÆÍ@Ê…„<îû%GïJÃ+ŸÔ§‘Ñéµ(ß\<ç¡yòþ àþ™øøþ ÝýÁî÷tTW¶wº6õ%Õ䀛y¿ì0«ÿûn·2?ŠŸÿ©lBóäÝB)8²Šï¯\’Ö™ã;ìIiz8z”»q –šíA ->¸BR@èLžqö’såêruØw—ÃÛî‘û;^;¸^XuÂ?ßÚv= <äoeÍùV?€ÈöMËØkÒã$>'ykµ0ô¬¸\fFa;Ç?¶:çJ¥~¦‚ç ÙÆ<Æ¿Xî@fòÓÈѲQ‘÷š,Äøxë°ÜAl<¾sãCì¡Ž°Ð0y|„äX;ƒIEX³ÔôS»SkŠfglzTw·ü¾´Î7–b¢Á¯ûc΂ÙcÛ¤òPßÜÚ[¾ÐØŽ1z’ÉÒÐ;zM¦kÖ€qãï餶†öƮ佬ßQv ¦ |D•Ê)¶…üd垶6$`uáÿM¤k¶¤üL±* ù½A~ ¡$Í¿s¹ƒÓóÌÑ]q-?ÚŒåþ_ÿ:CðYÄ7øæmKóY(xËÅ•ÝÊB÷£Âè¡>~T€é²Ùvg4/ .._>ZQåÁ9È‚ÿÌå‡~.U"?²ó¸gÂÏÉ‚R‡Ú<–×D©oÒèTà?íÉ%endstream +5909 0 obj << +/Length 3297 +/Filter /FlateDecode +>> +stream +xÚ­ZK“Û6¾Ï¯PùΖE“øÚË–c;‰SN2±'•ÚrrÀP”Ęe>f2ùõÛ/DÇ©òÖ„G£ÑhtÝhN¸ +à/\e±¨|•f¡¯²lU4WÁj3ß^…B¬´$1N}}{õì›8Y…ŸùêvK$·›÷Þ‹ïžßܾz{½VJyaî_¯Ó4ó^ürszïxôæíëo_ÿø-ö4 †Þ/78ýÓÛëLy·×¿ß~õêÖÙv­}(Ü÷ãÕû߃ÕDûþ*ðUž­ øaž¯š++?ÖJúõÕ»«Ÿ'.<§W¼játkK±VŸez:f/³:€Àýõ:ôS×Ð.±½ÆS8V’{ÞU¢¼#4;XeÞ`I;œHÚ^G©÷ÐãhäGž…5ô;ìKž=¾ã¡_QWåÝD‡¼Ënk +¡|@ÆÕ5®åƒz…K˜Ө(ð£\É™¶mÛ˜¡*˜ðäØqè'q.tÓ”GÓ ¼÷¶íf!a%è/ ý<ŽVëšÓšM¢T÷(f‰ôqDÊ"Uô+Ž¨Ÿª=ø Â摯'ŠñØRÚÄž¨êy+ƒ?¡wÃÛ×Ü#Õ]…·30î¾7Ïw£Ü1Î|KwÄ~*/Ñ>T¤fh¡5Pc2XM ÚæXã…PÇ å†µÆ1ËÕVÑ6HÔ˜Ã$óЪrS¹×’Ä %†Ì8´kÞe6L´º±Ä2.õ¶rFŽlR°´§ùÉ„]úÌC·¼yÉíIŽÄ3¸•bðTº\<8à“ÆtСeHiôì*àA´wÐóíª(õp]\ö]‹üÐeJa-7òtÁptæ«ôŸÙŸå¹c;$:È^Ô™l–äd…áU"ÌéÄ{=È"Ö›t~ â ìyÕE¦eãÆ#Ó˜8ÔÈ»¸¿#êà h;¨]˜U^»µË-AóTÌ*Œü(95«~¨Ð:u²è ñö¥A-Þ‹$03¢Aè óÚqà‘™ygp¤'ŒáŠC++š’¨2ŠåRrãùîUô€«zÔ +\aa UPÐ!{Ðk’$ÞìÚ‘En,ÝnψÊrÔ¤á–{ýL cq‰d‹„na¬ q‡ÐY#çtä>âV(ÁD÷È£d¾ð»a9Ô­ÙÈ "I‰¾ë ”÷[¨4¡P‹R0j…Júê†ð„Gžœrÿµ:l8Bd,œJ +#HIq-ª,´÷œiîX·Ãpª ö>öè(òšmYEJ,Ôq¯n üÇšéHţŰ‚µÆzø±O‘,b$†n?˜»Z¶cÌIˆè@þæ{Õ \S"9üIè]oZùy”…·5Bþ¥ó§ŸD¡Ð‚µ!É4šnˆ~q¹ÅZ‡šLË5±Ïí+B+•¡ËÌ8D¥dûx¦aJ`ÐÚOâ½ÀQÎ¥žòœc˜é å†æ ÞY>¬9.ÀŠÇ ŠpJà +M'L¼Û=£UÉ<öX˜udí­#²G¢ØF$¾)¨Éq—|PÑ6])©…‚)’àí_Bÿ{È,Ú!ýýþ_…µÐcÿMå( )Î#ï‰9"r×ãË3Ľ ·X4/\ÏPÝN‘ô,[@à +xÏmK>&W>§Oxúý³ó; ½KÁoÐAÞ”¿¼tÙ]y(;3kº.;Ë»˜¾àï› aÆ?ݨZvxÞ¶“å¸)!¶ïæøwC‰¹ûkhšÆ‰_ +Í`þ9Ú /ŸõÀý) +b§Àüç‘™"²Ñ¯]ùœNÀj´Obm›x?ÑùÖ‘ÓiàQ;±ê‘§ .´Ü:vH÷¨— î«s´dœ×àþR½?ZÎ<ÑŸ„î­Ì¢ÔEš“èhÍI>¢M™º¦µ“´Ôl[¸æ {”n}ÂMfñ÷íÐÊA `»ÆÔ Ú*Úºír0’ŽÓ `Z®2=åpY@§éÌv¸¶ñ{RÒô`@ÂEe  ð%Üàƒ0|Ø—l2l@/6µå3bSÎYQGõ†GÎàtåDZ¢|KpiÚ¥PÏaMGá|Qg€££€=»¬Ù¶Ü^†7Ò”›Ê0år’µŽœ«jëQ8Èy懳…ÈÚ*ùnªÓ 4̦޵40ì¼L3ƒÎ âí‚·ŒG/z¤¥‘<ÒÒh†9¶¶YO(þ—ÅüTAg}ÏŽ#„èU-üªÆ +xUŠ(HA¡~§$á\Êg`~›˜cìyúèd@k|BØ›À5[œ¤·Kʳ“m륎<ç£ 5ç`˜{MµÁÓÕÒÅer +h?ÛQŠ4¤_ܺe6”ù¡¹ 2ŒÖ>Sª ~Š‚o'²Í/ {0)—ï«ç§¦}{NÞ OÐ)já$ó§ªå_ÉÈEP½¬[E==ki÷`.™ÊL cÝ$vËLaîÇ­Ctý88Öª$õ^`8E‘¸©ŠaìÊ%)|ÅŸB…~æ_ëzÎi¸¡Ã‘rJÜ"Ñg{}YrÃx¢uî¾"W¢V˜³MFóS'ç\Ï.ì-ë gåûù‘qü‘×̵!59R–f‘ßk4£äD†©vcy K Êqªì £”ЖètŽõØÇø¡-Áè„)3œ”C”7=þ7ÜŸùUb öÉbl$¨-Ù¡‚;UñÿÃ#±Ã=±))sn÷½ÝtÉÄ´êÏ”S¹®©áB+YxcAż|¼ +¬cDÚã¼°í§(FÏJœ¡¬ ”qL®—ê‘„’aßs¼†Üú‘;SùŠË(å¯xÅ­9´ýÔ‰íú¼>õ¸d;Nà£â¨ ÛŸ–1íMïk,Ë É\5æ¾XbœÒ!¿™u0—¬Š +³^fοÛ9Õje_ûkvÆ)qËÿ¸•,®Ùˆ›¼±A­¸N5þ?(}LAÃæ +œœ_*¥ÝN &‚·Ûô8‰rûü阮$óÄæEÅ ++¡3–ì¼o«B¦Ñµp›UÊqŽ&:žàlGÜ·a_ÝI3ltÓæÖöæý&­âÐÖ²¶òâ q5=‰évåðY£ñ¥ ÉÑ»ª9ŠDl306ÕÏ”V“Ρ£ÙNn%Ïa‚3ʹµ…$=(w£û@Á ›i¹Ät°ªð.m¹@( д°¨©8ýôYH´þdçºô/“°)—h{yÌJœJ"ºße îZþ©(ñXJÑŽÈ*-b“q>á:ʽ¡Ðdƒf$øk0—Kx}zƒùoƒ*:Íb]R?PÛ¡ÊëGYs²ÍRî´ëÛä:“À§ §xØWœlÄœÈèEqšmí…ÌN‰Y{6¥ü³j@‰dÁ9?ÃîeS.ÈJ.^@è#ŽòĞʑӞêäU’û! ç:KüüËà¬\ù©V«5®Ë¿,¬Cˆ'ðÒ}J]|>ÉÕ|Ùÿ¦œ"Ìß¾”Às/‚dâ+)+àÿ9~¯žendstream endobj -5617 0 obj << +5908 0 obj << /Type /Page -/Contents 5618 0 R -/Resources 5616 0 R +/Contents 5909 0 R +/Resources 5907 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5592 0 R ->> endobj -5619 0 obj << -/D [5617 0 R /XYZ 85.039 781.388 null] +/Parent 5913 0 R >> endobj -1502 0 obj << -/D [5617 0 R /XYZ 85.039 761.463 null] ->> endobj -5620 0 obj << -/D [5617 0 R /XYZ 85.039 743.459 null] +5910 0 obj << +/D [5908 0 R /XYZ 85.039 781.388 null] >> endobj -1506 0 obj << -/D [5617 0 R /XYZ 85.039 471.875 null] +1534 0 obj << +/D [5908 0 R /XYZ 85.039 462.134 null] >> endobj -5621 0 obj << -/D [5617 0 R /XYZ 85.039 439.657 null] +5911 0 obj << +/D [5908 0 R /XYZ 85.039 427.388 null] >> endobj -1510 0 obj << -/D [5617 0 R /XYZ 85.039 174.126 null] +1538 0 obj << +/D [5908 0 R /XYZ 85.039 371.679 null] >> endobj -5622 0 obj << -/D [5617 0 R /XYZ 85.039 139.322 null] +5912 0 obj << +/D [5908 0 R /XYZ 85.039 339.258 null] >> endobj -5616 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F62 4047 0 R /F58 3360 0 R >> -/XObject << /Im11 5348 0 R >> +5907 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F20 3021 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R >> +/XObject << /Im14 5646 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5625 0 obj << -/Length 2407 +5916 0 obj << +/Length 2743 /Filter /FlateDecode >> stream -xÚ¥Y[sÛ¶~÷¯à艚‰ ¼÷-i“w&iNâLzú@‰´Å‰tIÊŸ_ö -²d§MÇc—Åb±—o° 4ü˜ O”ŽŠ ËŠòàŸŽp5P$ûáHÓHÙȼèÛ 16žöŒ6*ÖÑÄÕ[gO÷3:Uy’¿¸¡£9ÛñÄ^ÆX{²ã²I«Ëõ•NG^îš©H¡b†ç”h¢èe%i^P‚}S /lxT“/+ÁÛñe%ƒ<¢G’Ö¤Œ`a3e3ˆÔH+³÷¿éÆ øP–²§vìß%ø9 ֤̱oœ8žÁ!‡4À€&q¼n+¤ÀÀIq^œì'&"ÖÍnS;Þ -)ìd˜Õû¸W³žÛ,$±“p‡íý ²¬˜1wö‡|¬Ý?ršZdD8Áo¹ÝvQ¨% fÌcŒúôznŒ ›/bkÂÇtUs·“côósÒ aÃa‚“‘9hkwþuìë’äÄ ¡³ðšÑxi°7Ñ®—ÄiŒ´7KìâdhlXaÃ]ùU”Š½Á-ëEøqÓ þyゼmZ±&ÀJ308Ý÷ ,¢¿XOðÝÇÕ”8•÷.;8+`ð¯¡2Š·°‘ ImÍô»Cƒ. h¶žø’£ ­y®ÜÝÂéf¹qq¿¶k—} 9“^E$G^‚ëÄð]”ÇÚnäµQuh†ZÖ¡ÖY†ÌÉJäó6¬É™WlÆþ‚u\ºùîlžÇqxÝ2Ÿåä˜  ôSoJêºPÅDDá8pG õ½caˆjú¡­ -¶è˃Lkù.¾åL©ïLÖÝÛZHíõv;ps*Æq¿ûÁ2ÂÑ^€Ö2Ç1 ª+á6öà ;I’„ïPÛ‘ ùDÈĨ\§²ºrFCù:F†ŠÅ(Eö¡Ä ŒaÁ„¸ oVjN€`´„|WŽòÝnŵ¡F½p¢P¶ˆD Öþf‚!‘¨Æ?Ã=2~Ù }+ Æs#.Ç\ð”wÒvÉÚìÄÃ~+µ •Ã¥ÃèBQþíÃLž…Bâ.ˆkLMgdT5x¸§]”b[J AjÂVäõ(ÊíC›èÑ1ù]_‹á©KQt·! t’½8–MNaROš ãm"Âd]í©(ìq4æt_ò0$8pY””·SWqȼ;†þvGâp¶*ikÎ}tÆ3®º@„XOv 2ÚçåªhßSÑ![öD1ÏQq˜§¢ð¾“ì5Jž© -#+“Fá®~‘èäâ] ¤Ê -•Çϳ¡EØp‹¨í.Sjm®";•„i žÈ—'ºNŦ,DŸ†ÊЧã°¤òé¨cò©|°}¬~ߧ˜¸êxÊÕ¯š“5EzêGºM5]e9Òëö–\§_ ôŸœ+JT -54“ÎúëfªPg¼Ã=-%4vXi‹²Å‰ëTKr¼µÝ>^-±ÔH£R„cx¸$›Vy戛ñÌécp§ÁÑþß[1 Œ†SM/ß@žëgužïÛó«yÌ þ ÀÔR_ïúnÏñÃ5]~4ÈB2Œ”Eîî “3Á2|È¿:¹²ÄZÊpéM6e·[”rdÇä„ë¦g‚܃8‡“âlÇÃã¦lY”±/+bÍؘ › ܪ:w™£.Õ›ØXI “ª¾¥zs;žßeŽ× M%Mr ‚¯”ø÷¦‚}­YM7Y„5 G\Gë†f…„<»"…–ý£ÜÞ„_9–þ–Ù…7ç‡éæÄ×H½©Ü¸¢CjN,tf‘|å¢w¨957,Üyî(W{w}¦k!š­ã/.)å)÷M-ùóSÝ6ÎJøsËßÏNvô’‡fRÀáÊqÄĘCbdò–¿ô†C×2¸gĤ‡'¥ ð+f³.÷« bru?È£$NuÃÀ+Y¾ÌI¿íÆçn)»péî¶<40´É¶_•RlÜê¦Ù—ö«”9£`ëR?ø-›¹P@£¯ïÊ~²³ð]¡Ò‚ë¿RH(*aðÌH¿ôçO*ØŽ8ØâPOp-Ê žà:–¬,i@ z-‰ñ‘œŸ‡äczýÛ(R'પF6­wÕÇÑÑÛfÖï/¯3žßxöt¶3<î9¡twȾùß´äš÷0Â&Ãq&alá"©É?ªÖô6èszTÞ߃lUÕ릪¥sØ4SÞÙ»ିz²Cïà³!P“UróìÚìJ~¡ªçˆÙP¸»× d|‚—×y_:èŠS#ÁÙs'e‹çJ}¸é^z…_–îýÃdªaâHåQqùE7±øNÔ†Ó§òº¬œ ü’êYŒendstream +xÚÍYYoÛH~÷¯Œ–BŠÍn^yË5HVë8X,’<ÐeqL‘ +IÙã¿u5IIô`²°ðƒšÕÝÕÕu|UÕV3þÔ, =_§³8QžN’ÙjwáÏî`æ× %+ü™ñü(Ä©×7‹_Âh¦|/õÓÙ͆–ܬ¿:oÞ¿ZÞ¼»ž»ZkG¥ÞÜãÄyóe9WÎg¦.¯¯>Ý\}ú¿ •óe‰Ó»ž'Ú¹™¿ùpñîft¬k<i<÷ÇÅ×ïþl ¢}¸ð=&³GûžJÓÙîÂ„Ú –ïòâóÅß{.~ìEd “˜ ‰“ & WàI€™É(F•ÑžŠc‰T´¡Ód¼ö(žuä¡]z)í»ÂJ…N¿¤·‘ð«]™,:ºƒH±êÝ®=YX½7€J#_€ÄnˬBJYôAT§«âÔ3Ú°VC’˜íÛq8ìù ;n]!“'N ?`xÈyËŸ·Vß°¥-v|A28‘`µ"„ ëWEfA•'«J7o™»'OÁ“,ä"Q±^aÙêHI/ÙBúqÁõ¼HGtá¿°1Ë}¶Þ.éÃ]öü¨( ‰þÀ¿m½ºÏ»—‹¤x =e^¦Ê÷eÙ» ¿8>UÔ 2àíñc¸xÆ?gîŠËªŒ¡wŸñ¬'P²× Xg(ôªœÆ]¾æS +2,1·‘ŽcäÜŠyÐì )Ý%ïÚ7µàX áY—<ƒ‰'ÄzïehŸY½_òô‡¼{[4öb«î’’Ò(°Ù ÍÒ”}ßø>ÜW¶< éD™!˜‚¥WKþÍpéºÉ[‹g@yh$ЈQ¡sh^ÒT"°n„ãÈhºÌÕ†ÉO¨Š)øØf{)Øj½¦xŃùg¹|ËpÖ-;AŒœª'‘’%‡¡¥ŽÁm±Ïºí¢«.ÆÀ¹GA!¤¡ð"¥A`tÛBò2Æ‚€F†™gKr“üO·Ò`0ê½­”Å[ò-›pCQY¡LS–¹,ÍxKóËKž»&S~ dpšså`χr +S,\Æ\ƒánª*BP8Š×Õß„Œo¥Å$XÓ59yE(Y-[áÑ[¦ü†ÂÝòØf2 ·²WÓIüC¢ +u¦v†‚¯‡ÅK&Ö=£†#à nRÈ P×ýµc¢=™ÆÂSÐî<Ó&'~5ÂDø°ŒcÑ1@ŽvÞ×$cŸçÙ¢ ŠèÇVÝLR½Áhy_f|n´gM¸S1å#P®>¾ãÍá÷žd¥Ì d¼ÎéêVSkÞUTò ˜x†Ãapõ +äÞp^<Ô1èŒp +úN.¥/úĉ9-߬7çL¢B¯åT:Qàc”BfŸ.ñãÅñŸì6ŒtÙ~O¹Ê°^¡QßñljŠNàh²’šˆ‡RVHÏDûÉÏó°‚à×ÊØ"ïV‹Õaß.vŬú´ÏÛ ÐS ÅaÓ¨}¡#ÛAr…;ª} ¥QŽLæ(óýàÃ8W7…¸¤œ=öE2šµØªC+!äì¦d5Ї©ÈJ l¸Ú`Í`^Ç·ƒ†ýŸ bwýšgvhe /2=rç–g©‚íãÞ„)¸´ºgË!6TRŠÀcìé!Hͱ#´L“Hoø«ÏÕÇu{„4Án‚T Øàʉ[\{+˜ƒ\¶YmöAbþû(ÈéJ=2­l7„ ©nÀ ®n°Ô°âXf•{Ü7#…³ƒ\«nŠ;ra05÷~縼A)0éX;ÿ %¯{" Å‹Fa>Î7ŒR°k€eۥŶRŽÕy÷º¦Ñ #…u¾áì §ì2[5ÃÇI↨‰ú`Ñ–PKÛFœ®Ñ'ÆPr¤ì.g"¡s<˜Úh$<Ó¹—õ 0µ¸ï/ùL=Né_zÝŠÛe,¤;é´Vuõc‰†›ÂNûÇ«¨T6sçÙyðøÚdm>*@n¨â”Ð{óå +Kª¡óvsÈfª  ò÷mÙ÷S‚ nÎÑ,ôb$!ºEÑõò“Z×'¹¿˜´½5N²ˆÒ‰g5•GTäAQC›FŒšH#À?>åz& yã)SœóÔS©é$9 ?´§g  ƒX÷Îôÿ|ç²[í{~ÓÖ×5fZG}#‡—qHFNÎèÐôCÀsÉÕñš¾2:½¢!±ÞÈ$‚¢Lö‰³T_Ùb¿à$>qD©¯€ÕcߌSÛHb‡P§ÁøЊ,·Ì˜?=xK×.·ÉEFêjb|¹(9YO`Íõ«¹R +à×ÕÐìî†BYR‘†J«gŽŒîC/,°a3™øUfâ#b5Ô'ÆnÄ +2ÒU5{AàÁOW?‰‚lÚ o}pÇÖ¾4¹´•>ÔWi|¤¬nüTÒ¿Qo׎PM„ñÒ*}„Ò_muÝåÍè ê»´ƒô0gUã…´.œÄzõÑ_Ö†§‹#–ãÓ¡·(m‘4´ü.Ïui ©E!ê‘+ãrôP¿†T†2’;æ<|¤Ç²ŽIY;|Pp(*‹>:üølø^L¿ˆîþ³áêxl‡?|t"ÿTÎq•fü…}„ýendstream endobj -5624 0 obj << +5915 0 obj << /Type /Page -/Contents 5625 0 R -/Resources 5623 0 R +/Contents 5916 0 R +/Resources 5914 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5592 0 R +/Parent 5913 0 R >> endobj -5626 0 obj << -/D [5624 0 R /XYZ 85.039 781.388 null] +5917 0 obj << +/D [5915 0 R /XYZ 85.039 781.388 null] >> endobj -5623 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F62 4047 0 R >> -/XObject << /Im1 4096 0 R >> +1542 0 obj << +/D [5915 0 R /XYZ 85.039 761.463 null] +>> endobj +5918 0 obj << +/D [5915 0 R /XYZ 85.039 741.134 null] +>> endobj +1546 0 obj << +/D [5915 0 R /XYZ 85.039 475.603 null] +>> endobj +5919 0 obj << +/D [5915 0 R /XYZ 85.039 440.799 null] +>> endobj +5914 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F62 4159 0 R /F41 3054 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5629 0 obj << -/Length 3312 +5922 0 obj << +/Length 3238 +/Filter /FlateDecode +>> +stream +xÚ¥Z[ÛÆ~ß_!ø‰*¬YgxË[;ΰ³µ…“®Ä•XS¤BRÞn~}Ïm†¤$;i«¹Ï™sýΡõ"„z‘Å*4ù"Í´2Y¶ØnÂÅfÞÜhY.¬ +“§þ¾¾¹ý>N:Ty˜/Ö´d½ý|÷÷÷ë×ï—+cL sµ\¥i|÷óýRxôþýÝ»õÝ»7س0¨ƒŸïqú§÷ËÌëå¯ëo^¯'×®¬²‰Á{»ùøk¸Øi?Þ„ÊäÙâ Ú¡Òy¾8ÜØبØé×7nþáOá9»à]W^·r+V&TYfý3u|å™Eý´Œ² À?Ï=¼$Œ C?»ÞR.Wð§ÁÔÕn î­üîKÞ1rF{ܹYFi°wçl¡qª]¯›ŸÒ´xôŸ„[ŠfëÎç-8ñK¨m-mÚðÿ”³³¢ÙŽ‡bƒK>Ñ:¼·Y"%´~ƒýš’ÚC…Š契“91ŠŽ¡ócAÞGXØÁò(ÿXP¸ó¡Ý3÷ðÝr0m­žž>@«‹¶±J£t±Š#•„f*ê ‘ë(UŠt>ÿ„‚i«´ÕW žæpZôÅchSÇpKVÏO‰ÁøI¢’<ò +˜Ø…Ö*㩾k/ñéšÁ HÍ¿-´ +mžž´‰Îq ÜÞôâU -F¢L®"4v£²Dv‘]±‹×ÛÊéÂÊ&‰È»ýÞL­(NU¨Ùr¨¥Ú´ÍçžWÎÎM"eRíŒNTÄ&é¶Zi“Nžåì¬)ނ‚ñ‘jö<„׶’L¯KÀ!‚Xø²y$Åì6å•ûLª,ñîÓÆvšÀ^ó‚ìfe"ðsྦæs¤+´4àëî%€7„¦~¾BV +Z{¦¡ã¨[t(O×Þ.Íeq5\Ø“Ir¥C°'cUÅI»Wž–â½þÿ Ù„W¬@=c£¿î¯ÁÅ¢MÃàa/±uÇÃè¼SÚ®äVOK6'ôæÀoôó«‚]-ì/xYY8äÞ½¯ÂíÏäÄçµ<<°‡æ½CW‹*ò¥ )ZC§¸ŽTœ]ÏóM;¸§ U²ÆíyÄ“NõÀ: +j™Uè>Hj0òî*¹A~~½ë¥ž?•¨z`2ºbM¿„qx$~¶´¯¯pá3Ï>?Šî–éñ¼b(¦W¦³ˆP‘<¦7FþR)é@‰‰èêõ¾êy5¤jºPîÅŒ7”m­˜¸Ë U<àV~:îGa¶ü[;›¥É4ZðÏ«²©œà Û>òï‡1T#ý¤W ƒ‹©¼¼áßg#â;8vøŒ²Ã—öÈ—|̦8õÌ&$dɤ+‹^F8àâTÛ÷¼“éKõ5û´3^Т$'©G‘8ù m’í'¥ 7Ž5yµŸ›Oä-EÅ5¼à-[–<DÖ®ÜÝvÄ94ø€šðÌm±[Ü#Î+ΧΠcêÝøÛ;8éík”9XÚóq3šÁÝÇcÍŠkb[?Š@·-Žn†rX‰'–c§|野ÏÃâHã-*Ì\0-µ€Xþ wì«zDUNÖ—O‰sewóv&³¹r @j»ן3aq¨}ˆ1¼@Å ³º{{÷:¯þ‘YóÐcÛÍA$;DÜz@;ðö"˜v47˜ÍxÑ°/d Ù*ü~ÄÚxìI<×ðÆpüœÓŽÓRC~ëšÕ, ˆ“Ù¦fâ;Aqk÷h˜”0 tš(ë‚óm9ln7§c{ f{tøÒÎm‰‡Ï·!ï¿w—£@ÈCñŠBð#?h?>‡úßá"É ˆ?QÎ ÚÄ—w ¾ÛÞ[ýîo¶!Ê…krn +j§ƒ£"Ä›X`NÉˉ3KÁ’çÌIBù‡žqgŠÛιÅÖsgSm)|Y<í«©7•Û…1ØuÙÅòûŠ|ådéÔ/ +ÒŒ²Ä© +~<¥QEÁ0 toàJÉ8\šÄ‘‹Þsױш\°ñ ,ùx«#1&¹Ì¢W ü4ñ€% +¯à{°óXÁu:FEŽÃà~i€+ýðaÓUG4)Á÷3Ép6ÐñÔ«²ß49r~Fήç9än½Å£‰Ð0Öp ‚Î;–ÄÊ¥§x%Dj`~%éˆTžå_x28GÇ_Çh?QØÛU CVBaÀ„öÜyòÙ¨$Ù8x wK±aˆÄ™åÁƒ÷i08ñ0ËN÷ä•=`#sz…ûæáX(èM`"3„H´ ~(;¢ ¼­ )á•ì§ ê(’¹SÓ#®ËX¼-=è`Õ‹Þmœ¸Ñ6|ÌáPPÆŒIKhÇd œ0_1@•È#KºäcÞßÝsã )®œ…âb£Pb½Cdt”ø9ÜüïöA¨«KäLlÄ[WŸMåV×êœö;<å–CFpAÏ=:cÆ1’#®ôº‚£Âblnȳú’.m(R¬ð°{Ä"ýl’ÌÑÎpñ…Ðùœ(¶ê%Ð8*¹8$ÂëxÌVä–pfQ#…/¥Ú2‘n1*êaîgmBWYK`»L> !•„-ÏO|,îB–i¶œbÀ"èñ]ÃK ^â +\ä@éF¹Ù?WÕí®Ú ÆŽcÉ7 wHTDî°ÅÕ¥|ôãõ_ç<ÑrÕ.N=”Û›ðåA¸‚”ÛhKÎï ê+øR®µ‰±‹Ôl¸çRë]„ÕvDSÐ÷üõñÕ¤ÁÛ“u”¯ÓÑÛ +6ñÏpxYÕÃð±à¾¼nýÒ„% æŠ^-ôÆf²I-ÆßãUÄŽ<$*[U+ò ¨yD9d+§´#ìxË .ö²ê‘}.ç}% Ž—ëà ïjgòˆ4hà“N» ‘Ë÷ò +”ßÕØ´¤ÔxÞiò §T…yFK¨ØLÅèñ©†kðÓL"ž /Y cûbD'|Žì}t¼zâ~]Í0¡áW3&Æ)‚ƉÉßNÒe8¢]eXñ(Ã5#¯íåêÀ² “Æ8hBJï/yT³N·Ÿ–B•e9TÎ%PÆRtSh$NUsÊQ>ðã–M^ü+ð7€‹NÔßW¼ÌÙ'*ºµ”žqÌ!‡„Ͷ¹ýLÞLM¶¯:ÈoK!,I˜°Nô\£|†vª‚SÍ…o¿D襖ܡÒâgá×)±Õ)\úƒ“xgU:¦mèLÁAqt…q†0äÀ¶pÁU¡Ü9§ßw`Á%2I>‰/Ž€ª‘“‡²®=‘·QÉ…KPm#«Zž:õòέϋ"0ÃUTQÀÖÈ;f)ç°Ù<‡Ír—³¨@Œ¯$ Yª²03æ hZSv€Ï‰³)Úgú½/ò`×CzšcøûÙ¥ƒ8FQ +~IÔÇ;šh®i«"íRx*lŠ5q«¤4T³©ïÅlÈ)æå#HMâ+”OØhâD9'±v¢9‚@z&ßù²^Û•è m2ùbd 1¥–t‹ÓЮ /ëJ77.KÇ)þ9S@Ò¥OqòSø`€á~Š‰ò¤9R­+—¬aÐbÖão5Hƒ [íi`ÿŒ]QZïÙsKç +K|uV qßœ…u³1êVŽù…‹ÙZL¿kѧ·iK +ü4^jÕܪþØ*òHÅI2ý21‚µ8¾}¤ÑŽ†‡ÈÜ)¹!¦kÒ3C2éÄ¡½uE츰Aen +)ŸÜqxÍhâPeÉŸ¶ùÙëÅ…«M¬ò<šñë F7Ô'žú¼ _ξ5šñ«'F¸ÑuàÔ®'þþû$f/i;«¡Ö—<7OŒèKåXëçßf|ØtàÚDÁp<É’k5îk€Eê`TÊ?î.)S¨÷Àê8tš†æÈÄ»²);¹×˜ØåN/G.82%“E<ÚoÙ ˆ ¿ÂTN¨ý\qT‡{DûTJßv®î2ý|Âú2ǵ9¿¬{Œƒaük™#¦“O–Èw‘lL‰Êƒ+-eRÕ‡./ ðkóÜ+ ‹‰éøž¡“Ïþ”é;¤œøÚ®§ŒE]éœp&à¡ÛMOä< ‰ÙU͵X<~6žÉ=ŽÕ_( Ç÷Æo9å«Mç1¸b ö¡¼øœ¬³\…Fc2SaFߥy®Ûɇã÷o¾RÖYcd”¥s¥Ïo±¹2¹åÐçõ##ô«Õ£Q÷N‡CщòS ƒ©C!Ù.Kv‘T˜@#MT¢£ë,‘Å_û/(&U:órýêk¢ä‚C:Q&9ãТrœÂendstream +endobj +5921 0 obj << +/Type /Page +/Contents 5922 0 R +/Resources 5920 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5913 0 R +/Annots [ 5925 0 R ] +>> endobj +5925 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [273.074 103.785 324.46 115.474] +/Subtype /Link +/A << /S /GoTo /D (cups-ppds) >> +>> endobj +5923 0 obj << +/D [5921 0 R /XYZ 85.039 781.388 null] +>> endobj +1550 0 obj << +/D [5921 0 R /XYZ 85.039 464.504 null] +>> endobj +5924 0 obj << +/D [5921 0 R /XYZ 85.039 429.094 null] +>> endobj +5920 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R /F65 4251 0 R /F59 3455 0 R /F20 3021 0 R /F58 3380 0 R >> +/XObject << /Im1 4209 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5930 0 obj << +/Length 3274 /Filter /FlateDecode >> stream -xÚÍ[[sÛ6~÷¯Ðäe©!.ÉÎìCš[ÝiRoâ>ì´} %ÚfM“ªHÅ›üú=€¤,Qv³ÜYOf"8888øÎËYÿä,‰D¨ÓYœH¡“d¶¼= gWÐòîD:Š…#Y h¾??yñ6²3Š4Lgç—=ŸH˜HÏÎW¿¯~xyvþæã|¡µd*æ‹8N‚W¿œÍeð‰kÏ>ž~8?ýð¿ TÊà—3lþùã<ÑÁ9~è›_¾ÿþ%iÎ?ÿñäÍy'i'H•¢˜žüú{8[Á”~< …N“Ù”C!¡ùöä‘Ñî»<ùtòÏŽ·™÷:¤O±€™¥*:®9+…±ºÓœ‚V)Ò(j. -EÒ°ŒÌVÂÿ‹( -ƒ³¹–AÝ´Ÿ–›bÝ‚l ž6ó… -(T-–ò 7½Î „ê5Ö¶Xª«†Û~ £»ž½Æ¶JP#¹í²Æq“ª®b´ŸÜ›áX͘þM,"ù€FzÒ÷±$­Ð–òóÆ-®Š*+¡P~qÒ0ài4üq7WI£dH›så-IšUØÖrU[Ão’ówÀÊíU´+n½¬7\8î5µµˆ[\€¹ôÌÖ$³G…Pe]¡_Á°|Vêà‡|C’=Ÿ/L¨ƒö:w3¸fQaJ¼X$ ®Y¤j…Šý-$B.%¬òÏÅ’º.š5OeéÁð[(Í’‡¢ºúö6&4Ešô!ƒ–•¢m ¬»r¨#lA™ÍÇÓ3.Ü¡ÄÅr®bhH5I@ƒå ³ô¬ Õsù£¾pÒ•9j&Òè >1dœ¹Nù¿¦Üæ4 š4.S€(éÝ OµóÂÚà…Û01y–׎˜`•Üð3ÈÑ"øûÐè@¶‡«Ô2Å¥g®0x³K:ŠGÍÜGU;6nÔ/üµrËgqàåQÑ>? Š ?G Ê¶ N6Š‚yF†0ÐpUÆ5MËÈ64Â×êÐFëáLz°Æn³]O§“9N< ü6¸aËúªX‚­RKË訿ƒÅM"·äØ@KNr•9;#ª*œmm €ˆæ½ÆDÃEè‹bâÏ>ªfC?ô‚ÿx‡ô¶MOÏNû1\p^Ü¥Ží )œc0Ž -¥9 †½¡àXèÁðç^½:.ð°Pàa˜¬h@wÖ¦0»},˜ª–I€Åçç‹à–`¹´L@ãÇòG$@õ Úé¶([oäÀ{i%{“‚N5›·ûj Îþhˆ4¨/™ãAqˆñî¦Â–LFæý?ž²-Ò¶l+×zÀWx–) G.-ëÛ5"¦íÔ-|_‹"=)´óz0[’ Àø†E—ÃÜ\wõ…ù¸¾—~îwü]’f;ôkFâuÖº79¶ÚíŸ[÷IÞ ˆ]2%¸–0† -{nÖaPÜr€¨Qж†CU¾o\¥³×çF@q-Ĺ(É•pvÆ¢8G@~/Þêa„ääÖ…Ö.v YïÏÉ+ :=r¨å>òÉ4#ˆl//wì!Jùe”:¹ ÀþK>Ô³@…Ïb±¼BïJ%¿VX¾Ã5¯77<æ!cF×÷u]3þyPO«'D m‘ìãšÈ^~`ÃZWÞ»×ÎÛâêEFH.0¬Ês&à?»LR(oìâ‡_uh ój;`h=Øëì†kž„Ë'5:—–RŸËŒìÔ…þæºX÷ƒÃÍÑe\±—Mp•WùÆy­#¿Õ|îfîÝ•î6sP›mzÝ\¹Jÿ¯˜’÷”2œYS–ŒYÊ\¥æQ…›ÜõØÅò¼uäeƒ[ŽÐÿš'¤BؼÆÁm†`Cñ¿åHâ_N F\¸ô?xo£#£1ikWrÝŠóÔMÞa*×ÙÀ‡lxœvÃÛƒ†v».{‚ú/”§$㵂«Ü¹Kü ÜÂæÕ1=RòUQ5cI…ÐΫ|dŒš÷Jì÷âÜe»æÉÕ›nw€FõÝȱ‡¶)djÿÜ)Ncwî¤ï;é½s'œHSuèðDjàeððDD±RÜÿíŽ[”„L(LHÛPÈÈtç-V Ò%Oå‰P—çsØ¥f¥K…tBGxò@²Yab{íéò‘*3Œ¿/¤£Ùrg˜ûœúLýoMgâQˆtftW´×ìΆ™Û=IM‹D”tOb­¡p%dh…µö1ž‡šYª…ä£Óo?“ìÒ·1.Ô'.\r–±Ë¤;Å©ìaD¤©Pz¦u Œ¤SõkDéBãž%*/‘³óo—Ô3;.ª 5à"Ý##,7‡å3Ø,a£ü5Mw¡-©JÌÝÉñ½à&hÅÑ€ãô°y¥ €è­ÝcsóGÞŠ5ŸM’‹[ïžõë}LPÈù„6»’ÖåjxÄ&ÿÃÿRü¼ù÷¶>®Þ?»Óý©(¸cSœ9ì:.8GƒÍsßMú´`Fà äl”°°ÓÖ!8ŒÔa£…›ž÷¸9&©6À5ŽvD­òá­Á.p 8¿ˆÞ¤^”ãp™bÊÿ/3QXQ©ÉôZ‘Ä3…¾ÆðYÛê‹?TªE¼Gñ2à>^ŽÊj ´#^†Ò–ÙààÝ¥‰#›#«?ÉžpŒQq,´¶£1&µ°ˆ‰œ¿å릮ÒÇ8Šß)þ˜”ZKȯÕ@Ì7Ý9Sí6ʬÙ°¯à@±ü–“!hŠ#þb’™?áð¢¬ÞyU°‹ˆñ“+w¯ -3Ê< -4=ë)@sLÐ4Iÿ¿°™bîO6&fd«>6‚=·BiB>í®o -ºÿl³Ç¹›ŽûÀ9"ªV©ˆ¡8”õçL!V +¯yºæS šléδFïÔð\«òˆ©où•SY>íÍÓ~ÊÁIÃf<ÕÇA£SÈ…â]Ð<ÒÝôì§@Í1aµ²"¥!{iïÃœ { é °ãm&ÇÏxÊNGHÌÈ«¥ÔÒ™R‘°| Ñ´ì®KºI&·=÷)ðsLV%°gM†Âîï¡ß ä»>ñ=P¹íOÑ_ÑÌö ”I§˜âSH“Kf")‚”ÂZu!êaˆôü§€È1iuxÆÈ4÷À~ù/ä^v3’)&ù„à Ø1'b„)d‹X‡‘5Ýɵõƒðè9O€Žcb"8ÒÐîÈùX‚wgx]ûÀGÂcŠI>a"cÌÕh’b°"Ñ"¶qz†U?ì>¼§È1IudD -ÛÖ¡¨ßâ>Îö]ˆŽCdŠy>eŒØHÄceàB’*l*™ºs«¦{ë@'úá¤ç?NŽI+­¥ v(nVº³5ôte÷ÓA!øaæ[¼òÞÒë~Š¨õðlI¯{ïÜöÉï©Ý+‚ŸvÏH›Âc‘.â501Ù¹¬‡Æþ­‹pE #{ÁÏkÿB_â^åþžr[´ýµ»{|àc$?æ…JiéÞH»·Ñ>ÅjM/•H£ƒ·Øøx¸É) ÊÆòè_Hm…6êèß]H‰'7z÷ï.¬û»‹×ôè¡Vá3üKÀ—ý’Æg#ø™WÜŠë[¾ -X¾¸¬éÞ±«Xà;]¢ãM–µAÕ¿oûìFpÏZ q¼ñ­cQ]¼=a"¢ÄWFO3þ'±0ŠðˆÓ?`5»·³óæªøÊÒcÑ[{å„w(þ½kiÙùqL÷¦Í×{XÈLCé§ú((u -2Z$zäÖw¡¤—õ£L|_ÞH£†õ¾Àÿ?\ÿ endstream +xÚí[KsÛF¾ëWðV™# fì)ql'©”­µ”½$9À$H"¢†%+¿~û5H‚–²qi•ŠËU0Óóêþú9 …ðOR§B“’T+“¦£éÍY8Z@Ï›3-áȪ0vØõÍÕÙùkt¨²0]͉äjösðò»¯/®^½OŒ1ÎÔx’$iðò§‹±.¹õâý÷o¯¾ûß,4êৠì~÷~œšàjüëÕg¯®zËN¬²±Áu?ûù×p4ƒ­ýp*“¥£;x•Î²ÑÍ™uF9kä}uvyöïvî³#5pº‰§˜À®³È Ñh©80I”Kâ>Åá_bP 0èjœÅAþaUÀñS‹,Òxâó×Úõ¨] GÎdÈW‡,‰Ò&†ÇÞhŽ9üŠÄÜokfw½,7ðºO¢$€=è`ÆR¹+›%?ya,ª#§Ò$Ý_õˆ‹&ŠUb pQe­þ±SÖÙQìþ«ÒŒÀrÎœ…Æ„0 ?!±=œ$V„ºñA^\|ËÂû%ÔXµB6GBJUÇ^™ð 6¶-×cM±Å š ܃°ÍÀM¢U%Ÿc‡¤<Ú‚f´úõ—… ‹|¦Ù–iƒê1+êëߊFmX'fŸ’£}š-U«ÙX³vnY'¿»à¿%´¯¯ó½ ·n¶Ð¢R½hz¾·Ê=Eâê5?oÊ«ñCp°ŸÙó‚ƒ{¢GáÁ=ÍžÖÅÊv(åÿyƒ„èþ^Æá‰?»öܯTç6Ÿ$Vù‡Î…¯Dê°CôQRg¬è þböXlêjµRMŸ…áµ!‰!ÞÖ(Ó(ˆì¦\w¶Ÿ°Hf|úWìÿãÿ PDö±¨x"]¨pÿXTT×åŒx”gÏ ï®Qü3ØK4ÛP€(È8 ï%m”Ys_¾öШºÁ Lr¾ä ãñv㉼É!:ÐjüŸàñÏu)uÃfvU¡9~NYÅq–ù +á[WËAp¿Ú±÷Aïñ’Žq„ô._\ÇÃÒîI埒ÿAtñÅ9 ˳>UMõ¼ëKJKÂK8ÆŸþ?Ùô{áÿíÿBâÅÏqÄßÏöG‰ +?aB¶$ÔC|Ö‰Šµ}¨FS·e˜ÇT˜»9Ÿ`sù +«FÖf¿ÄmþÈïŽ]'6±Ák¼›C@l›eßvÀ)D­*r‡m6(kîËùÍMY“+Üù\¶. o@TÍù/së–À¹Íe{ÕÑz3Ú ãö/¾ O{ú'Ü@\ 4×cù‚fð—`;Äo#·pÐ0Gt‹.ìji<ºS'þ$÷Ù½œV™‹‡ïqñŠw¢°â²=4ã\®˜À)à‰ŽÎ…Átöã†óéù¼¢+§¶aBï¡â$øÏØ„ ¹z‡ÒˆcÌGˆ +(n &†_r'^i5åz1p+©,ÍNœÁh¥Ývð-¬y+–¤Œûè_To󺫣–ð6ñÑJ°£I@‘ݵ «”Mƒ=dfÅdä›bS5pªÐ&ƒ7ΠÐàAÃö$Vœä—P'‡Óòåj84)v¹ÞœƒÜy]n½¦BfhmL:m-§…Ë‚/­]ÚÃ1i½©›Š¸¸ÞŽÁ3XݺÉÂ'“ø¹@ê‚ïiÅUѯ)FŸëÞåõ´D;´í'øÒ†7·ˆª)ßÏRÏO…Ù+¾¼º¼à£½!÷Ƈ­§[º"oȤL4¤õ:Ú3, ¾N}””XRã² D±¯è8BAÿ%”=T±MŸ—Ä/‹i… ¾u‘Oð‰ýÎxö‹<Ó*5N&`qÏÀ6 +=qÊ97(ô4ŒXè°´V½%˽-«]Í]³â¶œÒ¸IÍ£ $ßR.ã§<ßPý‹xøX+ ­Ëb[0a¾õGÇ ˜Ù=Yù$k³à¶Ÿ¨šZÉôìකø¼)yÆÛRP‰Í A‰ÔŠhÖß¡{—¯JŽ¾¸Ía°w œ`Žî +)H4¥´¨Rfèó‘%“Èyy’­×i¨«yÃ^þË·Å‹·Z·ÓQ=Y¦àoK`Ùļø9T­'{K¢¹¶}30%%Ç›|ÁI½÷(šW)1¢Tøš·’KM6«™0ëçÓ.6àh„Ûð7Ðð;Ê„ì‹gø%t!º¶LºôÖ€TÜöÂl –[:¾Nì1Ÿ1Ð9ä‚H…FÃZöŽÎå BW&b†Øð0µòò¢ƒåõn-KY7L±,›e‹DläèÍ¢š 輎´r©Wdvüâõùa‚ôXÿµíIñ8†‚„i +3ãàmÕÈVùÔÍÀúIL_ª.?äf DО²¬e®¬¿'­Â4ñ‰QÕ m;’XHnò™Ø +¥Ð¾o,>xˆÄ®õXÄøpÆ¢kA±ªÄ~mIàH™ŒÌ Ž)%ùŠc–=LIwý³¢çþ¸AŠµD3•k")ßn©8»k8d‰Ù=áœý»b ¯hpç6i“°Á™ü$†Oã?àÈû¡¨»Û]µáÂ0¡uNJwÃ/?òÊ»ÛP‡/X +&%*KH6Q:IG†"S +@$eUbÀSwDj=*MÜ#Á“dºÅuëŠÿ®ªõ‚õ0Ú—)™+6!3îî ]ÄÚ–wÉs^®=˨K±&dBÅØE}zØç8ì^«mÀÙu7djYƒ`[†R’ɲà~yÎàð½÷y`€h·Åf•Oñ\ø&`?æpdŒJm*œ{À($EžËCò‚'Ɯ̪,ëé;$çíö®,Vò©Lë÷M +éLbý§%Ë“»6ô'›”Eœ¨f>ðÒ‚"Qö8e”5žSe«~ù Ü3*ê./µïLîyC7ظ£4wÉdÝ­ŽDcÅLËýMæÁ²î|º§òˆxÆJŽ('#—® l‰—šâddë¼ûŠÒ8èEj>4–²(ý×k&ªÀfAû@ ƒMH'œ›ó@–}+– ¢ Û… +Ö‹Õ=7æÈÔÛ²nñ¬²"[ÑR‰~L9Ç¿˜Œ‹îd¢­ìkç÷Iº»0¾L–³o#Ÿ©pwI\Y·%!Œ+—¼YŠäüûî=¥Å¾©¨JaÃÓAº)¹ô‘6/M’6Çp!WŠ%5A¸ØÉ$0Viš=Z_ѽåZDÞuKú¥æpÇœÝ <ýÈå*ÑÇ~iš íB‘Dg{å'QýÈ…T)è©~?×l¶ ¨Ï4ßP)¼nhš6Y$ò¾;ãÀË|ÏÒ1$ê¤YJ/8Â+òɸZ?ÿ¸ç0–qGóa½©rþSð•dº¾â@9u,9u—Ië—Cų¹PmèÀ®JJÊà¹"g`¹~ˆ-»ÂÃø{{!sÚ&•@LÖ­\5L(\«¸oÇèº\\-eµ£„)´bõmË"G‰Vhز¿yp¤Ïëfì—:ûƒZœ$Àžõ¬à’8¢,IÙs',¤ðF4i«=Sèƒ? »òÙcÁÄG©ÁþôÍ2—-4Kßvœ0E틯R…®¶A.g}2 Û»ëéç0\Í.V’VQÑø +뉄À}ëÏš.Õihcº¦»©¶íªØ®÷­ÐíK²ØÚ`:„6Åx`×V +´³,·Ÿ(ì†.§>$b{ íœæHkïUfíXb/ äNÑ ì¬d¥jݵÕ÷u¥Lè/$AÖ±N÷2LšAʇSíKPÎ +NîXÖŒ/ÇËg!» ÿ%kFÍì›6¡„Ù·¶u'âö±ŒþµÚµw‹wK6Àíe[iE ]ï'éuoƒý¾c(œÜwž&‘Oø#Ÿu.Ÿâ™(é +Ï}÷L>våó^ +sÚQkkUäu¾Ù¬ÊiŽžçüv=S¸×Ém"ÚÃÁL5…|7‹Û +Û Ü19‚¯ÈÍd¡ +C½'üÛ2oц!Ä—\÷€GÄù–D´Xúw¦E2‰V(2+>6¨›O!Ò‘ÌÇ¿áÚ«Ž<áKqrs,aô5tEP­1n4!ú€mÑú(œ©¿Ÿ¾4&'k°9(mìð †ðúáKjeAC—0Žn?'±²Î´•Wˆ–$µéÞe +Ë2ŽG©ÊàJeµÃ_S©4ì×!©6)ͪ®Žï¢”ƒTB†Ð™°y»þ÷ò±Ôt«ø ,›fóÕùùÝÝ¡ ¦Å9Á ¼R aÞj£–ÍÍêèaqà‰‡KΓ(Äû¬ wúAáDÇ*6ÉpçWõûÙ°E§ýkÿÓõï(ŽŽOØãýÿ !½«endstream endobj -5628 0 obj << +5929 0 obj << /Type /Page -/Contents 5629 0 R -/Resources 5627 0 R +/Contents 5930 0 R +/Resources 5928 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5635 0 R ->> endobj -5630 0 obj << -/D [5628 0 R /XYZ 85.039 781.388 null] +/Parent 5913 0 R +/Annots [ 5934 0 R ] >> endobj -1514 0 obj << -/D [5628 0 R /XYZ 85.039 761.463 null] +5934 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [126.646 45.931 289.184 58.883] +/Subtype/Link/A<> >> endobj -5631 0 obj << -/D [5628 0 R /XYZ 85.039 740.47 null] +5931 0 obj << +/D [5929 0 R /XYZ 85.039 781.388 null] >> endobj -5632 0 obj << -/D [5628 0 R /XYZ 85.039 367.73 null] +5926 0 obj << +/D [5929 0 R /XYZ 85.039 761.463 null] >> endobj -5633 0 obj << -/D [5628 0 R /XYZ 278.924 373.703 null] +5932 0 obj << +/D [5929 0 R /XYZ 280.44 767.436 null] >> endobj -1518 0 obj << -/D [5628 0 R /XYZ 85.039 136.342 null] +1554 0 obj << +/D [5929 0 R /XYZ 85.039 513.818 null] >> endobj -5634 0 obj << -/D [5628 0 R /XYZ 85.039 101.538 null] +5933 0 obj << +/D [5929 0 R /XYZ 85.039 492.825 null] >> endobj -5627 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F62 4047 0 R >> +5928 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R /F58 3380 0 R /F59 3455 0 R /F36 4301 0 R /F37 4304 0 R /F66 4307 0 R /F83 5937 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5639 0 obj << -/Length 2425 +5940 0 obj << +/Length 2094 /Filter /FlateDecode >> stream -xÚ­XÝoÛ8Ï_aôIjE$E}ì=µ{m/‹Ý4ÛfŸv÷A±[8Ùr%¹iù"%ÛjŠb‘Î g†¿™¡ZD𧙠#“/ÒL…&ËëÝU´ØÀʇ+%+!YMhÞÞ_]¿·ÉBEaå‹ûÇ‘ ck÷åŸÁÏÿzswÿîÓreŒ T.Wiš?ÿq·TÁgž½ûts{sûG1Lªà;\þøi™™àž‰nnÇå7¿½}Ã#FË¿ï¹zwï5õ:€V9ªùåêÏ¿£E Gúå* -Mž-žà; -,ï®@ÏÐÆFÆÍÕç«ß=+^‹¼kÎ*Žbe¢0Ëâ—-g£ÐF±·\¬&–S‘ -ãÈ,šî¯H¥ç§SQf6[L˜]t4•JT:4JŸH|_w`Þ~¹RÁ°\ÅÆu¿I0l+þxuð-ü]u¯xƒ èh«‚ásì+\ðÜ`'1Lƒþ°\é4 åu]4Lÿjã#úW¼©¬¾ÖkÑâE·;¼û|Ç›>Àä¶íÒaÝըꀻ¬z*§c¦adÃoW¨?þÖCÏ!5´ O´Í÷+ÊÁºÉË®i^pµýÐÕ/]}&qÞÕ‰Ÿ«u»/Án™ÖíÎ{†ìkøxÕ‰wÙ[*èJøêê¯K0{¨úÖÐØàô,§ÃÊÑ…JEœMðui“ èjtÞQ¤‘[‰hÕ3ŸI8€]b ^óv5,Їê?–+kÇ â•Š·]5Œr -9kdˆ {Ø_¶Â?¶qð´m™æ@q‡„_ë²â¹ ý/yî ‹¦ô™çFí;aûˆÌ:^¶õ(ïÔêhÙ×|Z o!Ž6¿G ì½¬"R¶¤Áþê×s¶ÀkD›0ú áBP‹…]°;õ *¸¾mÑ@+üÁqÐU4ÿš/Ò”ÛŸ˜á!º–ìWù@ŸQóÔ·‡:5„¥Q–’rÑDƒ8…’—ë~ÊT _»0FÊš¯°7O|A$°SÃ_‘ -ò7ÓlpÜŽ1AX×ð°Xª(9²÷H>›Švo5Qº´p¿D#¾v´*§èÃïÀNbRÈPê2¡¥y* Íœ%4s‘ÐÐóõ–è0Dg:Ì“’sRÌî‘dñeÙƒæÝ/i˜¦9J5ÍØØ s«×7;­ÿlA±Åï,S€e ->ŒÕ¡6©Ç²$Yd R‚Pf¢˜Ê£³0ÕVÀ|HÆ>GÐ8 ­M:OaÓ܉.U¶¬Æ=¬ƒžâé)_Îœ›#…zFUŽ¢²ä †“,Ô¹9¸á§seµÖ¡UùŒ²^9Gr®Ü‰”3>(k}<À­,†z}ý(`E£‹K$÷§¯÷ÐÓøï]N–ëw LŽ]Uwv²8MÂ(±/¸ÁŸÐä*Œt‚~“l6N!†!›ÍÝ„ÿ¥´ó©ZCh¢tÞ–B¤-ø›ËÙ{¹õ¹ö2ÞåEæyª\QJ¥€€\=‰#‡*ÑS/«ÈOÈak½¢Äy˜‰,¥£0I”0b´GÐ~Fx†¤œ¨,¸mÑ›ÑhàHužõAÁŠÏè qŸeN̾æTÉÃ$r$»¢™Kƒ:„ó1–#‘å,ÄWØ„I‚Qô¿b, (ºšöÀXÞõXa˜œ+ŒDÊSøEl¥1°Ù—Õ¤† l¯˜™ê‘5Ž˜fëVöcñ‡¿t'ê=*=Ðeð꤬Žâ$ Œ1;ç)Oåx”É©O“îDAbÖ ™¬ëZüÊ -¿ym@pRöÙ0â__ ‡¢a_^ÀK -ùj? Ù56Šo.t¡ø4E¡^MÈéz˜¨9ã‰'ÛÃá§ë맧§Ý\ãÇ --l«æn‡]s‰i~ªÞy³%4Jà9'É -"ÇFi0é+¸P)(Öš&ˆŠO\ÅWØR µüÙP´\„©1TqªY’W)bK^.öò±+Äø+•§Yúo/´å1HÜ0Ö@‡E7–#¨í†ªÄ ,o^ßJW&û©ü£ÁÃtÕžùvÕ¡)Ö¢Åe˜>p¥4ƒ6„:Anù£‡ªz½¢PÃ(ÀÐ,ÎdKˆålP6J爚K}¨-‘ÅÊÄ|¡ñ,;ϬªMEx ¾2]=u5OZ¨|ù—ššhJaàq–·×¥Û_` gpl‘©¥IxæÑàHjÂÇ–ƒ&5¡2§1³sB* J[“ÌæOÃÎÁˆ»+ €O “0óƒø—þd_=LfZáåShõ+¥ <öñ‚EçÇÛq™÷Mº;Ü\Ç¥Löýð9/zWíË)ˆQ½DgëG•ä¸ó¼O9>úª`rR ->豩Òà*6²â„ø¢–=ÂÓ™TiÖ/Z9M5€Ï¢SrnãŸyfZ zôEÊñÙcf.T°Dæן³3~8|æ7†œAˆW ã›Áƒ¥0À‰/œ&U·?…3}~ú9Tûˆ˜Û£oñ*¼€ù…‘€Þ/àƒžrM¦¥ž`TÌf{ ÎÝøFè ·ô{©2¦¼(–ÄÅV$µûq®>}Û1 ¿ß”<¨¦Ox0ƒFwÉŠ¡øâUœ2Ï¥ÿNÒ?>Ñ/"`›™><:¨uÏNnÖôèfI‰’4!ä^"¢=.½¨'wj):ˆšåÚîßc7>)ïú§Üã$¥~ï} ªeÏ÷ÛbÿO¿›¸ùÒÝjjåtAè8;×ך,´™¹Tø¿RýXoendstream +xÚÍXIsÛƾóW°| X%Ž0 0¿“Ÿey©²Ÿ­RI0 ‰¨ €–_Ÿ^f@­C..U ³ôLï_÷PNcø“Ó,±vS›I¡³lºÜNâé켞HOOˆÓ·þ{7¹¾MÒ©Œ…‹ÝôîžHîV¿G/ß¼Xܽú8›k­#éÄlnm½üu1“Ñ'^]||ûáîí‡×83°(£_¸ý¿³LGw³?ïÞM^Ý ØÎ0©F¾_&¿ÿOW Ú»I,´Ë¦0Ž…tnº˜D‹Äh?ßL>MþßßÂ{fʧF´›Š¹Š…UêœuÖ³Ó'ìô;Z +çô'• +-3àc¸!É)i"L2#Éô 0Jh=|IB›ÑÒ41iX¼~»UfzSƒ<ÓƒH*i°©¥ã¾äÝTx÷¶|Ø78.#çÊu}+“mš åàù©7­®Ž‡ü‰ßÑßr¿këmÞ•Ëëûz6WYÄ3 š†—— ”ŒÚ¶¬8ȾÎ`• jq°çžü— +œûø§ÒªÄ +gŽ¥= í´PJƒÇH35ž:sQ"ÿ] Ã-|Ÿ¹>GöG,ÍÔAÝ”Ž>£žßa¾Ë[²CÑòF·&"ò`’ .Êba”¿l×vu“·]ÑŒ¹Z‰Ôº¶·:ð°˜ÄyµÂ‰ŠòMpEÍ O‰Fcð bÄ<ø2'Jh¾Â©÷cÓŽ(¢t&½€¬FWCDs¤sZ'€t.Áè uk ¡sUÑðº×4‘lFšèÊrOZƒÆʘèõºn;qÙ”¨ZÇëhž +å¥=¯ŸŒV¼‹”xJ™ÄËYþ 1ZWWcjÉTHeÎrdÌCRd:ør£+Ϧƒñºð,ƒ8DP4CÑPpXÝxÒêÐKr®÷¦Œ3a²”m 8CÆD?[F%̈uV?çË™²Ñ_ä¿ +ï£&Xˆ(€uRãö#.q´Î›Ž7Ëê4[¥Ë„&·àUÊÞj¦<øø#°ApCDñ²bñ’CÜKℵé1&ôUFHíxë2Ÿrƒy°o»&ï(àYT^• ´î«w +ÙÛKöÔs2ܧáŠL¼ ò Û–!o<»¾[ñœR^âb¨á¸QW#áÙwoP@qUdCèRŒ@¼ +À®)Ô†ŸÊÜ‘hC^ I]#äv›/¼G\@MÂÒ‚Ç¥u´¾ÊzHÂ’Zó÷PŒ‡7ßw5¥Ç÷Wü°>ÚëfVØ$Ôá|·Û”Kê ¯w«û‘ äY:ÃËÞ8´R?™74Bƒ—ŽÊ¤ïh¹yÅ +Y7žn‹™°„!n.M3\Â]ÿ¾hyáâIZ 5<˜LÜÕ»vÄÌV ήoµæ§¯%ÊNå ¢!ÇÒ—]”NùÎhß·‚^Àå÷¥rƒÇß¿}ÿÊ·2Xþ(W‡ñ5Vð¦•ÉXTá3ž8Àf¤Áƒ'qÙá½cñ5là¦øZÖᦂ! ~ x,§ïëÿóDo2V£«!ÀÀ:Cˆl»OyìL$CÄW®æO`©t‰Ð±Ó¯ÕJà‹yþcTµN=Y³!«ÇßžÞÿî·tmþ€}¸ë2(©TŸýL3@È à?“ »endstream endobj -5638 0 obj << +5939 0 obj << /Type /Page -/Contents 5639 0 R -/Resources 5637 0 R +/Contents 5940 0 R +/Resources 5938 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5635 0 R -/Annots [ 5644 0 R ] +/Parent 5913 0 R +/Annots [ 5944 0 R ] >> endobj -5636 0 obj << +5927 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 546 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5645 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 5946 0 R] /Length 38179 /Filter /FlateDecode >> @@ -23117,63 +24862,63 @@ n †êéI\ßÍb¡ä•ÁÂ{p†K¼á¸ªúü í5íh©”ßX§ÑÅ{ ¾©¸™Ðþã4ßpõŸ¾ ÿÚü…C)ßÅWr;ûªÈ(æ+˜OXa²!ú¯È !ßEØ¢•UòÞû/ä•ñt¼Ê[ƒÄ0W!Á©ÿà%ÅÊ3óGÀåfSæ‡ Î_ø*^ÈMÀ ÔËë7ÚÅ*‚ÉkMÞu©ÐbhEV½ŸÃUeŽð”ýÔ&X ÃОì>G:Ÿ¶ÒÅu¼àü…‡¼ðõòd}¤’;,8á[yáÀÂs¼ Ö`gÉœ¿ð·yákÅù Î_ø=¼à°àüÇ ÿ¨ü€àäÙ—öŸp‚ ÂiþÊîN´ù´¨é ÈalßÑ̃ÚŽé´ê½üßåeåøá“îÔÇ„íþ_Üü6ò¶f¾å,ÿϵÿHiõ킹Fendstream endobj -5645 0 obj << +5946 0 obj << /Length 107 /Filter /FlateDecode >> stream xÚ`ŸÿÛÛÛDDDwww™™™555ñññíííËËËÓÓÓ'''»»»•••ÃÃꪪ³³³ùùùèèè‹‹‹õõõýýýkkk¡¡¡]]]ƒƒƒ’’’QQQááácccåååÿÿÿzÔ;¹endstream endobj -5644 0 obj << +5944 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [276.16 226.708 473.376 239.609] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [282.387 384.284 344.155 395.973] +/Subtype /Link +/A << /S /GoTo /D (cupsomatic-dia) >> >> endobj -5640 0 obj << -/D [5638 0 R /XYZ 85.039 781.388 null] +5941 0 obj << +/D [5939 0 R /XYZ 85.039 781.388 null] >> endobj -5641 0 obj << -/D [5638 0 R /XYZ 85.039 635.199 null] +5942 0 obj << +/D [5939 0 R /XYZ 85.039 758.673 null] >> endobj -5642 0 obj << -/D [5638 0 R /XYZ 85.039 635.199 null] +5943 0 obj << +/D [5939 0 R /XYZ 220.322 475.711 null] >> endobj -5643 0 obj << -/D [5638 0 R /XYZ 222.519 310.929 null] +1558 0 obj << +/D [5939 0 R /XYZ 85.039 356.232 null] >> endobj -5637 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F66 4190 0 R /F62 4047 0 R /F58 3360 0 R /F35 2976 0 R >> -/XObject << /Im21 5636 0 R >> +5945 0 obj << +/D [5939 0 R /XYZ 85.039 321.789 null] +>> endobj +5938 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F58 3380 0 R /F20 3021 0 R /F41 3054 0 R >> +/XObject << /Im24 5927 0 R >> /ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5649 0 obj << -/Length 2801 +5951 0 obj << +/Length 2439 /Filter /FlateDecode >> stream -xÚíÉŽÛ:òÞ_aø22)¢(jÉœ²/@2ý’Îé½wPÛê¶&¶åHr:=_?µ%Ëöf9ÚYª*Ö^¥ˆYÿÄ,SA(óYš‰@fÙl¹½ -g÷pòöJh_ƒøÌ‹›«§oT2a‡ùìæ®Ç£‚XÉÙÍêwïå»ç×7¯?/|)¥'ò`á§iæ½üz½ÞÞ½þüþÓÍûOoñ)†Má}½Æã|^dÒ»a ÷Ÿúãç_<ç'„‹?o>\½¾±œZ€«Ùü~õûŸálWúp2Ïf°ÇÛ+à3P±ÔÏ›«/W¿YT|Ïø­)©(™*“ÇbjB,* T“X–‡}[o‹®ZÂETêÍ¿Up±Õ®ØÃO»ð…7ǃÄëÖ°Q2оA Ý"ʼîPÄ›þ¨¸ëÊƼQ¢L@5™ÃC$â@ˆØFòÅ~¿Ò*ò -¤Õ!ÞW»§?v«¹óak¿P°ßvxÒÂó²©ö#\P(DQ¢‘·]qoØÚ­˜©³*¼HªèJF ¨f¾LT A¾@qç„£šqòõ›úï×ÎV‰kv„ẟ ‚bß·fë—xÀê7E èý‰çÇ"J½²Ñ¯Ì u5Ø3ÝÁwo«è²„½ÚÝÏC! –‘÷œ-6Êsï-œ’&ðu´± -žŽð‚hóU».W¸•i´|ƼUÿ"å€Êe¨~…0ëÕ¶Òo˜[ÒÛånZÔHµžèmµjJ2‹}ìqBˆ3V« -ŽÔxã¶X¢Ž¿á q·ÏDŽ„PtAEÎP(ß%þA>‹¦cDÅ-ð•"HŠ* l¸_m6këV.gú>@GÒic<Ù¡;j0¦RvHæÈh0ÂFŽÕU=ýœïX2(XC£a½sgÓ„:Y8Dð7‹,ÆÐhYoO‰'¼j×:J‹ôXvëšXYNÇþ$‰)2Ëc ìNE£ÁÚ€Ä$ß -R— -€)‘‚• -½×ðð³Øî7äBIâÝÕ zèŠIê™ðL¡Œ”d@/×EµkOñ-Ó ƒÀz–ïæd¢IB¹]ïØ8¨ Ä[˜p…küI½;£§~.í…¨¾Ãß„¤ÞnëÝæ‘wX_´¿<4:ÜA„f,&(Q²Ò{½Uãõi‹<~+”ÓæÐv Ù/­õ‚ì°n¾1úž¯c«Ó™ 0GQ„´ñè9‡:4©­¶wCð%Ü~ B§VÞAöðwÏ6ìœüsý -ÞðÚ„÷E öîš?”Ý«Ê:ß²óé§Þíú- F„™8k»/},sR6ð ;ߺáuŽE3º¦¥šÝL¥OLS¦ätoóœJ_=á³ô ï”xIæάOØÛ#Wΰ;æ%ëyÊ™XÂ0±e‚óȧ˜07Ø1˜òzŽáæ€Ün¸€ÕüÙ S‘²Džõ1†|,n­Š ¥E„õ§cz"L‚ J°s ÌÅau%¢2ú€¢*E›lPâ(cÏ5:›„ŠK«OÜàzcÓ8ôjÑòoS~? Ž†PƨY(ÞAûþiEjÙ”?1·k ø -.l•±âgÒu¢3q^ëƒk]¸Ž¬wÉI`[PVÙTÖ_þ~BÃ1”â‘HÎjØ9­atIÃçZ )NjØ¥Ø{bLÚÓQ¸7ó®ÔÇêÕ^èzi£_¬ZþmKk˜kÞta6;¨Ð®îtŠ‘¾4GíTg‘AgE—; ê&VwýC* Xk'Õª¸9«ÖæŒZ5ÐEµž!Ø«uDqZ­E«Ö4(+UhÿÔUèGöbÈ_mÇN÷`1L(H¤icK h-tõ¾ÐTQ¢ ¨MW¾­glY‡îŸ)¼×)žø¤7¹J ø°´½p©Ó]ë‹9¤è¿××üøþãkî ±mMµAém-*–)ƒ”Až¤Ñ©4ÍßDg ¥”Ƹ©ÁÂ[…Žl~Tåî±Ü÷¸‚9lVüZÛAÕ®—k]ôÓSa¶÷¢[~ 0ܲm î5Õ}Å].¢ë äLœô]|Áq,È¿a˜‹nsšZï5CrÓNÓ“³>©¾ÒŠb4÷¯0Ñô…Š2Æ„/öXXoO¹AE¶UúÐô‰àÃÐäa‡&7`kÆZË#³yŒ»ª\n§j*ò ·Ï ÂCšQt|v”§Í Y&ä$"VA)·ãÖV„É6¢J“ -·4õR¢)ÚCÒ¥N§òeSö-äªÚ²»Õƒt¾)N}'Lí1töG+ExËŠ)1c%dë²ìæcrvþR6~÷TuИNÀòxºä#ÓÇ0™œÓª¡2Wœ,a{U¢ÊmAÀy¢SkŒ¹ÔÏÖñÿ¦Ñan½~¥s4#0åîÍÎiÃðì¸þ?¾¸3ÿÃRˆóú dèçƒð¸3±†ª–..1ÄP1ÑrÀ6bݳ_ºBÑò3_ŒÓ@ÊK‚7H£øl s`NG:t)Ô#hcݘâd°s)i±d Üs>µþér}0i%‡h—™h×Ö(îå·rJÄRinj„éÑÕ&ú°®(iëЇl4…uØ;7¶†=}…Ö·.ãC‹¶·m c›Ó"¨ò —\ߘá‘ÍÁíaÓ¹£¦ã˜ ›t'œ¿ i;#1džë/[;Kð¼¢MÇ4nºFÆ!¡üˆ€a ‘ò>jîg¼ø옉öðc3ã›Iµå¾–zŠGICûüˆÁ8 ƒ,J]¬×ÀœgkŒ Ù:5““!¶6Ùñ™4Oõ9ú #>È` ò<šâL=‹‘ã0ˆå ÝCâÇ)ô ™}Ÿ*¤}óK *ˆ´Y*Ú‰á±0‡Oßo¡ÙyU[³ßÏd Ê’ îÔ·òI2Ë MHaL_‰"LØP`Øš’²ÄHpÑá& }¹Qq4u£#½™w|ç%æ"rcõ3²ñ¦º?ågô™Nˆ‰7‹rMŽ,2äïdüöæ®aŽøšû’³Ó6Œ'œM¨±5£H0zWuö}ÒEó,ÙYÉöƒ%´+€ ÓÉ&§À¯øÏ>6Ú%€»0=?áil'¼ãÍ8Œœ > çn¸CãWøÎÝèd­QÞbKOýh>Û¸Šÿ~Åf\jí¨Æ]šïh¦šBØ×<ß×o~áê‚çÀ¼u½®µš‘öd¡õd¢,r¾ÜaGå”p˜¹ªŽ2–ùÀ6ð{{úÕÕQ@½ùÔ…yÜg-Œ†Zqxv'é6ÙKÛQxOE×çð*OËà`W NØljѨáÔHS@îVâlÙÓƒœ®z4Ì¥¢ç 5[óŒÈM–<¹_ÃÌ“5m^œV÷ §u«a.éö 5«Û¹IÝ:ä~1Çßø‚4‰/|â3 §ªa.)ô 5«Ð¹I…:ä~ 0 0ÿÏL(é£|ºòÒRýïT^1ý2ŸöEп^P–Qœù5ÿìˆáù§, endstream +xÚåZ[oÜÆ~ß_±ÈK)Às†3¼¤O±e¹ +xk­Š$Ô.%±Þ%i’kÅ@~|Îe†—]J6j·UQ°ær8sæ\¾sÙÈeÿÉebD¦Ë8‘"L’åf¿–·°óz!-E°Ô"ˆ n½X/ž_˜h)‘ér}C$ëí/ÞË¿ý°Z¿z{æ‡aèÉTœùqœx/߭ΤwÅ««·—?¯/~3 ‹Ò{·Âí7oÏ’Ð[Ÿý¶þqñj=ºÖ×BG!ÞûañËoÁr ¬ý¸D˜&Ë{B¦ér¿Ð&F‡v¾[\-þÞŸÂ{zÉ_ͼÎw~ˆ$Ñs42agô"ÐrF¿2>~„ÚþðøPÜŸ)Í̙뻜ŇkÕÎNo«3_Å̤×òRW±˜»; Ë‘PU2:3„TÒÜV›÷yÇT“›ÃT$©¶T×ÙæL%Þ{ü‡î*áìí3¾èþ®€ÄÞ½ºÉ EÊâÍÙÀ"¿&ôþY]Û/¦LU_%ÞÙå &Ñ¥/£P(0RTUÄS 5îÂö°ëè„[>E·ƒ…βC‹ô®»¬@~Ÿ9ò&¿©šÜÎ Ëufÿn´Éð»ûÒR”ÇúV2î¹Åòrs»äÁÛרú¢¸=à ö9èCÒ“òÄ¢R¡âpjR*Ž?æÐÜ#¦I¬O½+Ncë]á‘w…'Þ>*Ešª9ûN•H4HCBÇrL1ç ÖI–àCëî/1hdΩhAÃ+µt{Ï/÷Ê,Ï+àj9r{øìDëröî‰è"õ€>H kâHÌQ"TjìßË:Ö"Ô—ªjuú¾°Žʇ-zzÂnÆ~Øõ£iy¢f˜Édz÷ ô…`pˆ¶Äñ<øû +/¿…RHòq´û¡%oG7Ø㤯•ò>ᳫCó{œe ¼‚ ‚ktŽ´ß¹³GйÙÞÎ[¦ŸÃ™ð¢ÒÕ É7UY:LÙtù–©^ÁRÝV%Ï®:äãÂË¡å¥BYÕóÔ‚,˜Œ¡Ó ¨RzsÑ#f—í,ÂÆZˆ-:‚Vå S÷!•Œ1KQ‚§9€ïê;àB‰ºÞÎ[n¬¢%|­õI°iÚŽç=–ßžCO³(kŸp›;Ôl,Ö—yÖì>¼SÉ÷s?Q=­PüÌR*‚hWæƆ€Ö]QY}"ů j ÏèÁù.ߤPvdE°“Yú&ÿp((`ŒÕàß:9Y|åjŽUf[ä£Þ9½ü7IæäNìeìMd¸0'‹‚—¸èò2ܨʱYzìXQÄoµßgåvGq5?**¦¨ç‰H'O6‡2e,ôžz—w9Ë 7Q ç#ûΧY@kóÖö8w´.e?Öu³CW18Ôœª¹õv&5SI,b“X†³ºÞ› méy½½™ñ^ Oõ`ŒwÚ€¿Aúµ¡µì…Œã= +ê€pãv7A£ÏZ›çâ"á©%ä­2 í% µ®ªÛÉé±ë>gô“Dö´(Á,—sņC2惇M>bmEŽÚvW›¦@Bû„Ÿ.z…£À›ÄÌ+| åXª’±+N¬oñð¹Ì]b£’^w&Èà¢(=ó#ú¯CrÜ”—G÷ˆ4o»-¯´]±Ûá0a袸ÆxDûï2Ê‘ p¥ºá¿FTx…‹Û¢Ììgìqèÿ‹x’šIMS÷XD XÐcÓí 5¤ƒåþêºOª~øŸÀv¨¤h‘îÉè^Èj +EÞNÁñ¼‘Uoþfª$¤®¾‰"¯°N#U;“µ ŠŽÕOùæºH俀·Ãª §Ð^ìmš<ëÆŸa†DÅž=¤êãîîèÕ°lÓAö/ÜA!’gq äÅšSVeÿ×2m‹&òî»#F‡´,o•@¦½©šfÈa ¬™"„EiÔj”Œu‚5ž€ô˘€<ö ¢}ÿÓvw…]§˜ºâ.±‹j¤œ3áÖ0,«Ž÷û¼º¶¢mìÆ–²Š]þûi0®Ã]¦‡:Í:Ö§«¼ö/q±³‰#ã8!«&k#ÒûbôÝ5!i΄„%à[ËH`Óùñ¹–º%¥HiÁ—ý’›ƒ‘º÷տ»›Oãg. 9,ÓeÅuªxÄ6jgÀk³{Ê>öR¡t8ô?‚aluë?Ž÷q*t6 H$©OC•+ÅìtRò¨Ï]Qê‘ž–„¡NúxÞvU“µ¶Ð:®x¤0i_`áÑìñPöYS´ÎénfuâþgÕ ©E0§Mðn@Œú|9L_BYF—>-]^VB6ðé,ÑÔL ÊÒ <ÃõY]•S5}*°n£ÍÀ÷´‡§Råm9#UAÔB/ìì˜#Aóg!çB- +„¨WhãQEÉ»}\³á»¯ï\þ‹…ˆ”+†Õ9BÕ3þ˜šo[•!$š`˜'¥>–ËF IŒ'ýNŸ ¿Ú»›Âb×ÆR£Ü\:ac›uŽ¤°DÛ{Œ•×¶öØö Q¢#SæÉaˆsþ4îSÅã8àCÞ€³ªl™›¡»Q1µUühŽÏ`t¶9¡âªÑíûNï¬é-dýŸ´çíõŒK(%b©¾°7殺¯mÌÛi#kÒ•à“AdûÞÉ·éÊOÚEr8¹¯\¼^Ð7é—&öMzbû¤OMäžåoÒªW³­zõ¯·êUSpãV}øolÕÃQ*]úQ*îÑ~M«¬44!a-ŽÌ¸Wöê#¡’ôÛ6ëÕ§YÿÕ|áÚfôÃXcqÚŸO¹Áù¹ö¼A,ÿ#íyÀêhú+Íø +#Â8ê¡PÁ2Ø– ƒD@ê†Ü ±åÌUuh6T’F1'ÍPaÚ^¬œ7ÅGÀ‘ç«Õy;ÓV"}è×h‹Æ<ŽÌoÐû“ÀâW"½K]}ÝÐ1…+'‰j“Ùï\þO«ˆU®µÓý@醪¡Ül™ŒÞ £†«ß×iöTŠD¯(K¹/(1`‚þ +î:‡Õž¼­˜ëÝž¶²ˆ7›¨Øß-éïè!بÇ#1cÅ .PÅ]Þ†¦~KÕbMiWÕPYçð|ߣ2÷'z?–Ž½ŒŠqúe…ž-Ü®\–òWSímÃ-ßµbî×€Ç œ7›ƒ|ÝÿCÆB&}>ó¨Ý©HŸü7JOƒsÓ¹{endstream endobj -5648 0 obj << +5950 0 obj << /Type /Page -/Contents 5649 0 R -/Resources 5647 0 R +/Contents 5951 0 R +/Resources 5949 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5635 0 R -/Annots [ 5652 0 R ] +/Parent 5913 0 R +/Annots [ 5953 0 R 5956 0 R ] >> endobj -5646 0 obj << +5947 0 obj << /Type /XObject /Subtype /Image /Width 364 @@ -23191,62 +24936,7 @@ x )ðyè„/ˆŒáWìõõ599y``€,6ÇÇÇÃÃÃASSS§§§Xsd-Ã’±êÂ’,µeoí° …V²08\h´Z-Û™ÉF 탞t~ðN/G 5Ä’È0µ«K§ÓEEEÁ[ þÕÕÕÔå5„¿tPC £ê˜O€4[ös}ùþþ¾²²’<¤"::zeeÅZFH‡›t>Ò×PF#‰ Ö¹­­­†?ZY«óH‡kt”c>ÒÐXÍÒëëëââbòR*•nnn~c4¤Ãe:HŠ=RŽl$-gff„B!4J¥²ñYhHÍ1ï2%&&îìì`LšµYêãã322bøoÿhH ÍÂ,MOO7µ3 éü>û«Ñ•endstream endobj -5652 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [322.255 312.671 401.824 324.36] -/Subtype /Link -/A << /S /GoTo /D (pdftosocket) >> ->> endobj -5650 0 obj << -/D [5648 0 R /XYZ 85.039 781.388 null] ->> endobj -1522 0 obj << -/D [5648 0 R /XYZ 85.039 664.909 null] ->> endobj -5651 0 obj << -/D [5648 0 R /XYZ 85.039 630.769 null] ->> endobj -5653 0 obj << -/D [5648 0 R /XYZ 85.039 299.226 null] ->> endobj -5654 0 obj << -/D [5648 0 R /XYZ 85.039 299.226 null] ->> endobj -5655 0 obj << -/D [5648 0 R /XYZ 300.398 228.091 null] ->> endobj -5647 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F41 2994 0 R /F66 4190 0 R /F62 4047 0 R >> -/XObject << /Im22 5646 0 R >> -/ProcSet [ /PDF /Text /ImageC ] ->> endobj -5659 0 obj << -/Length 3096 -/Filter /FlateDecode ->> -stream -xÚ¥YoÛFóÝ¿BÈK) b¸Ë»}Šs8jãXm @¿>Ð-³¡D…¤âýóß»äò…¢0 .wggfgç¦ÅÌ?1‹|ÛqãY Û¢Ùzwá̶°ru!ÄB, ˜Ë»‹Wïý`&;vâÙÝc‹Ç·=ßÝmþ´Þ|x½º{÷y¾p]×±=_„ad½¹_Í…u˳«ÏËOwËOWøæÁ¤°îW¸|óy¹Ö-?µË¯¯/_ó›k;ó¿î~½xw×pÚð\ÅÈæ׋?ÿrf8Ò¯ŽíÆÑìÆŽ-`yw|Ú¾çª÷üâöâ÷¯y3Þ5& ±p;Š¼iÉùŽí;^#9O’Ž°=Çi ÝÿöO'œÀŽühf Ô0ŠÂ7) -i»Bv(ÖO ÝD:H݃·_ƒ¸YÖ'"ëT¾¦•P/IKuÑ _ð&Dš×SÉ“ÏOÙz.#ë‰÷'¸éÃOFPU—¯q¾Øí’ý†àöjžèÕY±¯~ž/|á[YÍ$˜Ó<¥u…RY-Þ^Ü9º  ±$[M\¾%þK…±òD²˜ …D´1gešÔiŸLÀ †;8 °U0W´èYy‚2ø?űæ /$?‡ {E›7¦æ†Òú…æR!Ïöú"Ò²V(ð†rXe©Ä„¢ó¬›ãôà;Ý¡t>ÌÛ6˜´ïÆpµ¾sƒV[úÈÒWï‚ þá$â¬â—CI‡Ç­Ó’ç´¬pÜÂ:ƒÕ[fgSìš+æ|>ÒõE‰´T\7L›Gôé„&e¼‘ý¶p­ž¨R9ÿáGË9¼Ô0;Ös–ç½Û(½è¦,©ÂdòµÀH„bÞWÌE3Z*šÅDÛÚµ‘ ,£Öp$¨jÖŽãʸøQhÇb:Û5`N[Š:g*S[éS5“bãQ]ö¨äN!¦m Ë9ƒÁ0W0ØIGKÛ‹|eÇêaÌEv¬=íCBï—¹¦CÚþ’‰A>Lš÷ö¤È—I“À=¶Ù³bÏSiþ]<˜ »3vuº²•%¸‘‚£ÅÆÂÙ»{R[JM¬:RÚNj‹x6“œÅ'h¤&mÑ¢yä´ˆ‘gJ¸‰:Ŧ$%„c?+ ¬´=¥€PbK®ÒíHxß¼Tng<øl¨‡†^àCõèãì«G¶ãXC#¾åmVe2è9P ÊÐdpX8*˜i¶ú˜-û”QBˆÁ'*Þ´Ž+^·WñºƒŠÝ”ÍrŒçP¹PTÆväù&@‹ µ2û:ƒâ’æõ“øó%˜£¯6¸±BÓ«¯–;éÎÞÀÖìwÃÎ#aKXXx€x×J,f`Yð‹÷èxÔðÜК2 åÜ=ÁIÛH×CŒipozÏÂØÄ\HãÞú˜‘÷ÙöHšQDȱ°Ù2Ö^äçâ;®Gñ¿­º+˜]uïaBrP` ë½ò'ª"á=—ð>!LƒÉŠ1 ¾ží„£Š‹ÿÖÀá(„Ó9àÃFTVÁ -°\lZZ ¬¤°()¸=ß)€C‡Ò×w¬ÛâX®¹r!Eë›ûÕ-ÏlÊìø[ž~Ås«ÕÛê„!»¤&œf¹…Þ®Æ#B(Bbùó&¯m¢Hຉû´æÕ|`Ðu¢öè¤rÃ@TٲߣwÊ0‹‰)‹"R+N‰BX „Ôµ¼Æœ7†7£µ>g€¢Ã/DžR±U¨ -¥:\c‚ã§}#•® -*»&å·=¥>€(Éy"§P»=‚çx«‚rE ®W -J’›X¸k"±›(:ÂqE£Ø/ÆêxÜË©6†”MšÁS^†p–3ªlÀœÎº4й¬k‚ áây¢Üª3öê¤kÀÖhjf²õõe…¦âZ+#mAí)‹Ã“SÒ0gx‰\¤è‰ÈwtÏ«Éf(+ϨÔB ±Å²×:þk¯2%`Õìsp7ËcÕ%Wúe·a V})­ -L­‚i—µ -¦Ù’*EröÍy,JNíBˆØ"6{_Õq½Ö%9˜Üã‘[]žCÒ -ä¼À±^Pû§Ð•áS[!®rŸ‹6 lÏÏyãw`É‹ëNI{n¸×0¼äçò¸Ö{½Ô V‹{=¾Eöö‹ÛDRfÕ˜Yß^Áâ’°,?WøÖî’¯ü~‡ŸðâŽG ±õ6ÛâÖdø"°î?-ÿ``r\8¨TƒÔÀÔÊuÖlÇëÏÖMÕS¨9™îÙªXÏTŒÕµJü‡GzÐþÉk[‡®'uHñU×´ýUyaÔ¦º.€ ­ûÜ©r’áÕrÓ¶ŒTãd•äzý)ͼªüëžv¬µL<Ý°„Áã‘œâõr‘Ãô[SÜàõ‡:/¨HÍøA¿†‡WÁâe·6ÄÊa?¦½tjŒlnÔ!fÍ‘ÔE©‹'´ÆSþU@ 'CÒ¿0§ý«:ç_§6UmŸâ¨ë4)¶%j‡¦ ªÛ%yÚo3ðÚ]ŒHú*ÛÌ8_¶ýív‚x½¿õí¬ëAZîB~L߇†™fQº-Ü w!¾s…Œ|$'㣳v[eIyò¶x¬9ÇŸ¤LÙ‹ãÊ¡$ß÷ Õmƒ†â¡/ rU†žÃúŒùV!å±,ÂhJAI¯cû4)Ñ~0·Š"ËCï/£¢ˆ!_¶| 2ú9YD9è\{ Õ(Æij)lO…~ûz¤o Y­[S0AŽµîª ß”ÄÈ!ÅÎ#L^ì·U¶I½'5@UYŒX¿ìÙ˜•ÓS=äMµ§°£á„Ó fÂÐYC>Mð_&J}¶Æ­Ý`‹âê^É—P¬z¾nžä@})'¤aΰz¶'eOB¾ƒžû ìåÓ›¤±*tæ±*ö •‘¹©ô(Œ›>ãU<ˆµ}ÊÑû‡ªñKàIšá-ÙÇ&²„œ¹ x¯åÅ‹T„ʾ“s"ó ¨ndKÌó¼ýºÒªå×#%ÊFN©b‚œNÙ[ÓŠ¨`ÎéáijÿR {Ñ,à7ÿGŠ¶;Þ«>˜xÜRm³œï×jíÁáØ<¸A‹~%yõ·yó%™âù‡¦€ÜA­ýdãr©À§T¼üüÈgACú> -ð–[ç?ŒœªE¬D]Ý'ü¸$êd¡¿RH¢¶J.R%*Ë)ûuÑŽ÷§§ÿ©?Õ8¿{Â×b¯T -Í JFúƒÿzòAoüÈ2üñð¢(endstream -endobj -5658 0 obj << -/Type /Page -/Contents 5659 0 R -/Resources 5657 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5635 0 R -/Annots [ 5661 0 R 5666 0 R 5667 0 R 5668 0 R 5669 0 R ] ->> endobj -5656 0 obj << +5948 0 obj << /Type /XObject /Subtype /Image /Width 370 @@ -23289,166 +24979,166 @@ Z ¬¢ÐV³ ¬‚1¼‡ï/µ=ãÔ½q(,–ïß¿Ó2!ÚÂÂÂÄ[O¦•6MÀÚ*xÒ©çbaýÔ&€çÖ*5?ïÔ½s&Î*‘‘‘£.299‰Œ¼•&2Á¡XØ=  N±À*iÅ«¤ËóçÏa€„bÑh4° @Z±À*ÉÅ«¤‹ÉdBWx…ÿ|_àYendstream endobj -5661 0 obj << +5953 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [328.316 717.299 389.581 728.989] +/Subtype /Link +/A << /S /GoTo /D (pdftosocket) >> +>> endobj +5956 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [322.255 554.709 401.824 566.398] +/Rect [322.255 271.893 383.521 283.582] /Subtype /Link /A << /S /GoTo /D (pdftoepsonusb) >> >> endobj -5666 0 obj << +5952 0 obj << +/D [5950 0 R /XYZ 85.039 781.388 null] +>> endobj +5954 0 obj << +/D [5950 0 R /XYZ 85.039 703.551 null] +>> endobj +5955 0 obj << +/D [5950 0 R /XYZ 298.883 673.118 null] +>> endobj +5957 0 obj << +/D [5950 0 R /XYZ 85.039 258.145 null] +>> endobj +5958 0 obj << +/D [5950 0 R /XYZ 302.474 178.3 null] +>> endobj +1562 0 obj << +/D [5950 0 R /XYZ 85.039 134.612 null] +>> endobj +5959 0 obj << +/D [5950 0 R /XYZ 85.039 99.202 null] +>> endobj +5949 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F58 3380 0 R /F62 4159 0 R /F35 3036 0 R /F20 3021 0 R >> +/XObject << /Im25 5947 0 R /Im26 5948 0 R >> +/ProcSet [ /PDF /Text /ImageC ] +>> endobj +5962 0 obj << +/Length 3263 +/Filter /FlateDecode +>> +stream +xÚÕZYoÛH~÷¯²À„4ï#o¹Æv&‡6²wf1™†¢%Žy(d+ŠÿýÖÕ$%ÑÞ öa³`uWW_Õu|UŒ3³áŸ3‹Ëö’Y;–dz¬:³gk¹8s„Þù–8ôâúìüç œ9¶•ØÉìú–X®W¿//Ÿ/®_œ›žçNbÍÍ(Š—7‹¹c,™ºøxõþúêýö| :Æ͇?|œÇžq=ÿãúÍÙëëѶ¦où¡‡û~9ûý{¶‚£½9³-/‰g{hÛ–“$³êÌ<+ð=é—g˳ô«ð˜?ãY·35‡éÙVûS…“DžQ7µy‹' žf9|Ä¢ÃßÐئón„Fº&®sì µáVÕàtäV°Ô&­™ ÃýšÒì€Ö!)­ißX,^uOñþ33²­(œ™>lB×hótuGµ ,ù÷·§ü{õâùüJ÷.æn/q~mÒ íƒË-›ߢ-:dcyý+ïtõQclªmú…Û×óØ7Ú]èËŒW¨HëB¥%ß¼—i‘$£¦Ê™ƒT¢iµ £×’v¤²Z]h­AI#7êî©Æ÷ è:¤2vbìI»•ÊQŒv B!Þs[mrn¼ÄE{/„UþùH]P,ÍÞú­¬Jª•ÓQ»žé+¾\. w¬œ°Z¡„Ø¥¥ßäå–GÁâ}|š‘iÅM´n@õm×j +ŸS÷ù¸åÔÃ6Û*gëfJª¿/op"]ú)SÒŽ½*ßîž;·z‹|Å\Ã!Š–)†jÚ Ö:vfClðf&Ä7 þžñaÇt p´¤ ñ‰þºK½(ª-ÆÔBmÅ¥К¹ ®ëO-ÀLïžxàj½‡nºÉ÷¸Ú Üë-ÉÄj9Ò}YN/ThBÙ5b>•€ÓÅ`ZAƒA(¤씳‘7¥E-¢ „(4¨ì\ëE÷ܧÖ +k«i×<)eŸïöʈîÖë#Žõ[ïM!'á9ÒL¦@k;´l°÷±#ÍÒ’áK2Î[!]$îÉ/k‹-ûVBŠ”{wCŒ«™B¸ØRV׳ ‚\M[®ôMÉÊݪ„0ð¡¢ÄÅØŒ‘12étÛìÝXÜxb£P€¢NÖ"BžÕ?µ TÇJÐ Oí$V`Á6T‡ àh‚T•.L‹£¾öW5Èè6Írî.Qˆ ÎÓš¤kynðÀÑàܘ=ª† £À ¼…5ž TAC^J©†wÀ(”T@µ©2Õ@îŒ]Öã¸ÎÙXV¾;9²^ä Ê@¾å=`ŠyÿɤçTªýû5÷ÆΛMbt÷tGXIÒ 3 +}H& ÝŒâ¾o³ù¾Nruöç{É(UÃÁ-œFõò-·Pº¾wÎÂp°mÜ"%,ñ¼M#áédˆ0pÉuûS%g|hë üÙ|ÖG¡Êxú&!ßÊ÷ƒ£·Bš¯"±w;¢¬ü2ãÉhÆÈwO™V±Ó]åeG»GX<¹ç±„.εq¥T6,ª¢Le’[©älT¼Õ1QüÙi†L®¤SËÁ+yvtö-|Õ±PPÎCAMj yË%¹H +}QP²q…†¨R*ŒŒ×,à´—b¿pþe—hî¸2—Êú-‹>àSA0ÔgnôÚóþˆÿAVíÙvªÍ9ñ¤úk·üˇõ8Ïæ³µ<²áŸgPbÎ^Mkø—g”Ãý&[f½S>CCÛt¤Q²"g˜ñZê‹ŒTrˆR²?–m3=“ëé°ÔsoB:ýIZœfû‚ú3‹qàí#Gr“øÄr¦ëbØ&mc}R}%ª”ªÎ_êSè&CšŸˆ*!;á‚qÑá1ËJŽúAx/Ñ:Ì›ßä„ +Õ-e=\|žÂPŸE¼þ^àë¯#–¹&Mê +cœíÿB×Ü옞¥š¡×#Y±Ö‰ów}HZ1mƒ0r.è$²Ëð:J0žœëÍ®SýÒrE±¯|D„}|jÏ^‡p +ÜTÓ¦:ðùÏ¡;Š¶I +†rÍ‚9â1 Ïö„£ÙmêgÌé9%TÌ‚÷µB/âJM£þt£Ü¦« +M +;æ–·Y ¡¦sý+ÿvMv—«gçç°¿ãZpsÇ–8X)Åa è$Fü= \ƒxÎ!'Øœ«æ¼Ð˜Åì®LÜÒÔëÐÑCZçÐËң걵 ^hU±Þhs’!'Ç1öVÐÀc˜ãKœ@î¡`_]Ê·1œÚðp_ýíË`pG¯¯Hà^uŸò§Al0UTÛMrÃóG5Íå¹iW°S!ÏæHy½Ï ÞË’1ïÖLd_Š;£ÎSyTÝ@F30NzÌ}[(5¤‘4L ½G<­ÆØ8tù˜tàŒ›59·JâÈž±–ûu'È!; ÕÛ“b6„Å]>ä¿]£k¥T¬Á÷9´”\+yÌØ¥F¬?œRÒ+39Ĭ +±9úJˆ!¯ë <ü¡Kö˜Ä¶º¡ý‘® éï` ÿêŠßÃè4µ| KÕº÷°Vë?’ÚzS ~£Ôlz[¦÷kü¾²²º]meMuNNó|Õd»*¯¡ÍÁt­ªÊ“zOhC"q”}?šÙNdSz² ' ʦb+ +‚ƒtÊ·ËiöÉR=áÌ +ÌW¼H +fÑD±é¼Ž‹]lÒò–¡7Wê"þàœ¿’ÌV½;rVRM£:uèe®~’AIIÚNq¿ä:1¾Å/ŸÊ9S™qƒ¾Ôõ0Å„ 'Û?a:cEÕ¢gS +Bœ{à¿1‰¼þ»ÿOäE–÷²TÝ08©bêqú€ÿÌõ¶endstream +endobj +5961 0 obj << +/Type /Page +/Contents 5962 0 R +/Resources 5960 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5973 0 R +/Annots [ 5964 0 R 5965 0 R 5966 0 R 5967 0 R 5968 0 R 5969 0 R 5971 0 R ] +>> endobj +5964 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 269.847 180.062 282.749] +/Rect [111.316 746.78 180.082 759.682] /Subtype/Link/A<> >> endobj -5667 0 obj << +5965 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [131.434 188.552 232.166 201.454] +/Rect [135.733 665.485 231.498 678.387] /Subtype/Link/A<> >> endobj -5668 0 obj << +5966 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 134.355 171.288 147.257] +/Rect [111.316 611.289 167.157 624.19] /Subtype/Link/A<> >> endobj -5669 0 obj << +5967 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 93.708 147.857 106.609] +/Rect [111.316 570.641 143.915 583.543] /Subtype/Link/A<> >> endobj -5660 0 obj << -/D [5658 0 R /XYZ 85.039 781.388 null] ->> endobj -5662 0 obj << -/D [5658 0 R /XYZ 85.039 540.961 null] ->> endobj -5663 0 obj << -/D [5658 0 R /XYZ 85.039 540.961 null] ->> endobj -5664 0 obj << -/D [5658 0 R /XYZ 303.989 420.414 null] ->> endobj -1526 0 obj << -/D [5658 0 R /XYZ 85.039 376.727 null] ->> endobj -5665 0 obj << -/D [5658 0 R /XYZ 85.039 341.317 null] ->> endobj -5657 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F66 4190 0 R /F62 4047 0 R /F20 2961 0 R >> -/XObject << /Im23 5656 0 R >> -/ProcSet [ /PDF /Text /ImageC ] ->> endobj -5672 0 obj << -/Length 2843 -/Filter /FlateDecode ->> -stream -xÚ¥YYsÛÈ~ׯ`)UY°j Î`p:O¾-—VV,:Njw $±ÂA dýûô<½É–ËÐÓÓÓÓÓ_C=RðOBÏV&¡¶MŽ’âB–0òþB ÇDX&žW³‹é;ÏieG*Í[9žízf4›ÿj½þðòvööóxbŒ±td'AZ¯¿ÜŽµuÇÔÛÏW7³«›÷øåQ[_nqøÓçqh¬3]Ýl‡_þòê%[Ÿ}¼x;ë5íu­"TóÛů¿«Ñ¶ôñBÙ& -GOð®l ÃÅèi{®‘ïüâî⟽(sG<ë˜U:Ž‰Qvºç-ç)ÛSno9W,§•¶]eFšî7¥ƒýÝiåÛ¡ŽÂöDÛƒÎ<„„z)#ŸZiíØF;‡jio¨–p Õúp{õñî@/7°GŸÓkÒñü`IOÛ‘Žö,á©Wwo&M;vë\ OÁBÏʳÞ´U­Á—”þþ £Q`½CªaˆxR£yZ³Yu=ž8¡U!CÛà€oÅøQmPÜœYµ§ø¥ZàÓ…ýÃàOQ¡§’GÖ89+Ç ´MkáˆË9f!o*48Mdû*àE´SQ¡„ÇlžÁ{¹dÿ§|OÒúÊÀ‡”Á!ÒÛU kcE„ŸwÒ ¸žãÚ?¨X·,‡9CxÜJp¨é¨Ôÿr‹}€%N&@½…ÅxoÝÊ©¾¸! ošx™2ª, ]nëšÞekÀÕ$ wx)«ŠØ‡a¹ƒB€êânÀw÷Ü´iÁ¼ÿbÒKê4þ>ã¯a'i!I-Í3m$u |„¼÷˜jRŽâ|çºw§eC –k"Øz‡üZ`ŽÃ˜û^_óû°ÆÛÅ%¤×÷·Á—ˆ©²…ºâN%e1Ò éP`Èe³^`ÜŠŽ§–>bƒ?ªûAˆÀžW]õËgåºÞÞYq$ƒ¸<—]ƒ4I0’¹À›ðd̳ȷ[Z3­à 1‡ C«•Óg[I‹éž%Ų`Vdy,ÈnyÇ ºõu¥î8ˆ ·”ë›ön[6ìw7ÍÐ(}á’2Wyà‘Q 4®»êttg•ÈR xyËŽ{+ö‚Óo›´LR’2<`¨rVµò;«Nö¸Wñ.0§š5æ˜Þ´u]f+[ðSŽ±6}ŸVóÈ*–<’à -Puà i?yF¾Ý?Ðdɤwà6ÎdÚ:x”¬Ó’sûuìÏÒÐÈh_¬Jå@2£l߶ýκ™„_õÒ±N¯IÓ”Ë"Ú„ÃcDŽ,äDárËÉáû~!̺æ|Ÿ™Í]ÆC'¯âW:d¿æz}óép˜y!ª~^ê~'_þ-PÚoÔC¬ú¡¶Ez´gúMQL•P«E›–ü -VcÚSÆú†æjÃô$îz?‰eÏt…øCŸ%–Ç ŒìUÿ¤‰¬²½¦‚V -:Ñëã¦i{Ñ¢LK‰/?cê‚÷bzÏS—Õ)—SyD50ÍÎ ëF!HôA6Êœḏ×gÚFá¨ÖÔPVå æ4CNh˜ Ýýà|mß4£®ªöo°Adzòutº°sí¾ˆ´R<ü›6.Y†]¡CÓÀ6ˆgºŽÛÕ´­¦YWÆLª`ŽìrÒÉ!Õ¹$ß²t¨T©GÛ( ´"[®:¸{‘ußOãh/—;ø‘‹Oš³Œ5žø¥Ì«x˜Ä#!Ø Ç8Æú Ä…¤Ũ \J8˜*5”íƒ&:è•Ócu=ÏÁ¢ ¨Ø%ñ˳ҸQøEéR (ÍÂ$Âó†{pü– ,ϪMÍ_¼J -U1ÁžÈÊí¶Äñݾ—îš{œ²:)¢yŸËÉVÉNÄX¦Çê1¾ÍK“I¸lµßð.)xK–nR~Å>½áû¡¢Ó -.¡€éæžÑ¿‘(˜®|ž.¦&L -.p "÷1JŠ[#ÅmŒúòk7&ÃÇâ$y’—Á“:fŠiYJ·W_NhGA4r<ßTð£û-áž Ø©؉&û2QUÛ®!$¬óøyYW›rn7›ÒNªbJ1$+—Óy…=_Ù’¥·È·Wm‘ôadÐâ悔!/<Êî„}IráuòrÅ1÷l¯´eé»;×6«·½’£B;ý®»ó1,¸‘uCçÞŽ  gl@ þÔÖôÆb$€p½v½áë8IøØó}Íää1T Ä†®êNlKyÔÍžÝ×–çd¨þõƒîpRº£ïR0 G** g »‡§äUË߈$ ñÞø>ÂàOCXð0_Ùƒ”–.Ü‘ô´ŠEFú=NèV„Uœm¡UIqÃqßî úÓ½hó´ÓÖ•G0—a3¡ŸÃ²¹|†—ÂqI8«8_p“P-DõHÀù•l6ïs“<“_jÿŒ•§íO2(ÍSÝ´üÓl -\,>=cf¸Äиé»´Ž¬}Ét.¹ZºðzqÄ -_i«sÎr·3P˜ ’íè—z›u3“bi7t¥I뮯ãâøjµãÛçAÛsœ¼‘Á_”ã0«--2ï`5_û1(¿ö(3úÄÇpì5žX‚ €Ã8Щ¢…o -3~ß^õÐ=ïô1­OmT”<»Õ-ÏIû>ÀøÏŸã°iþTÅ]›áÁó†.E&÷1õ§~µ’žPBÓv{xú¥I -¨î•ðþ’êHME9ªüXUH©sÜzFÙÎÑÿÙ³ÿÒÈý @©šÔsÛÑ.xÎaÔö Tÿ¡9Tø¿ï›„™endstream -endobj -5671 0 obj << -/Type /Page -/Contents 5672 0 R -/Resources 5670 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5635 0 R -/Annots [ 5674 0 R 5675 0 R 5677 0 R ] ->> endobj -5674 0 obj << +5968 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 746.78 148.718 759.682] +/Rect [111.316 516.444 144.521 529.346] /Subtype/Link/A<> >> endobj -5675 0 obj << +5969 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 706.133 218.725 719.034] +/Rect [111.316 475.797 216.248 488.698] /Subtype/Link/A<> >> endobj -5677 0 obj << +5971 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [127.983 252.984 490.789 265.885] +/Rect [84.043 149.028 446.85 161.929] /Subtype/Link/A<> >> endobj -5673 0 obj << -/D [5671 0 R /XYZ 85.039 781.388 null] ->> endobj -1530 0 obj << -/D [5671 0 R /XYZ 85.039 550.012 null] ->> endobj -5676 0 obj << -/D [5671 0 R /XYZ 85.039 517.795 null] +5963 0 obj << +/D [5961 0 R /XYZ 85.039 781.388 null] >> endobj -1534 0 obj << -/D [5671 0 R /XYZ 85.039 237.54 null] +1566 0 obj << +/D [5961 0 R /XYZ 85.039 447.979 null] >> endobj -5678 0 obj << -/D [5671 0 R /XYZ 85.039 194.396 null] +5970 0 obj << +/D [5961 0 R /XYZ 85.039 413.839 null] >> endobj -1538 0 obj << -/D [5671 0 R /XYZ 85.039 126.4 null] +1570 0 obj << +/D [5961 0 R /XYZ 85.039 133.585 null] >> endobj -5679 0 obj << -/D [5671 0 R /XYZ 85.039 93.979 null] +5972 0 obj << +/D [5961 0 R /XYZ 85.039 90.44 null] >> endobj -5670 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F62 4047 0 R /F35 2976 0 R >> -/XObject << /Im1 4096 0 R >> +5960 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5684 0 obj << -/Length 2104 +5978 0 obj << +/Length 2119 /Filter /FlateDecode >> stream -xÚ¥XÝoÛ6÷_!ôe2P«¢(JÔöÔ¦i›bͲÆŬ}P,'Ñ [™$7ë¿û¢,KŽ7¬“ÇãÝñøã}Hy!ü)Ïš Ô™—Zhk½Õfzw°òv¦„c!,‹Ï«åìÅ“x* ²0ó–·{9&ˆö–ÅþÙ»—WËóó…ÖÚWY0_¤©õÏ>]Í•ÍÔ«—Ë‹Ë·8‹¨üOW¸üËǹÕþ’™..÷Ë/?¼zÉ3„ó/Ë÷³óeoioX•¡™Íþøzéý, tf½G‡‚åÍ ì L¬e^Í®g¿ö¢x-öx×1¯8Ž…kãÓž3a`¸÷\¬žS¡ -âP{Ž ]÷9Téøt*Lk¬76Qèx&•jTQ Ut qý÷z¾Pþj×Áoœ¿»w˸hJ˜|GÖ'®ɱ_ÕóVyU}cJ¾-xЬa¤¸÷ÿ- __°ðz“îþ3åshÂó0#Å»Ë-jïj1&²¼n˜Ö>€e)«_•àÍx…î'-^[Fg¾­që™òŽ±Voù× ’çtZœƒÌÇ-ž3aÿ 3¸‡ä4(ö<'@!Lÿ -Š -÷ i<ŠÆ–<€Ækw›ý½Þá<ìðc=½@ÜZóZG÷„e¯FUó/Nù÷ëfítÉ   >&•-ÿP[ˆøšWÆÍSŒáƒM¦ „V„ð­äÞûã*? ™ÀD©¦hÚ”$¿ªÁ]$o¨C(9¹²ey9ž¹WŒ jD-é7b ?Xcz&”ºÂîË›NdÞ°ùðFaýåO€5‰m`õé6à!èD°ª‚̘AìO" ±ßÒÙ!Ü'ØAÔ7&ô_7åWòn’úç¯áÂJzjIÂOÈè,º0$žUøîÖÛî)›E×I›÷]Mÿûèòîˆ?6µÃp¬ i9¡û&gJ^¸$KÆ”m×ä]-ï*Ö ?œú&G\ÑYpeÜ曲*st àщéîÑh,¿ Ì5 "M_ç&@uù¬Ô·¼¿»§3\¾ón÷À ¥ØÒMiè”]¿4óŸQ}aé•Â[­à…-wÕ·gÈ1 éÓÁ–6¹ƒ?L,<Ùí‘› -`x÷–×Ë[^ÙÖ½úvq á ¹¦7zýð{Ÿï?§%WAàø·’Þ g(I[«êPRѧeE¾ä²bü‹8÷%eºØš#WÕûqXä¹è} ·}*Ošr J¦Eš¥ÒXèQc¡':º“èXæŠÈEP§)“q¢‡,cVì² ;Aï/ªx¢»_²0M3P”FD‰2 ›¹å›(ö^×`™÷ë TTP**è8 t¢úÜ™$€ÿ:uS¨!¿ZAb-'¬ T›ÂY0@J©cgš¬²g1ØÄVDÂu$ÍxSÞíÓ–:N¥ÑœQæOle4á†ÇöFIÄ‘=fooŸã™Øw g, Õ]M -Á×ÓÖ -ÉûÂ78ÀŽ»îÙþÁŒŽñ,Pæ¤ëû#i£€'ßÇA˜¦ÇŽ È…!Sß×XsIRu²tCß!tO•›‘†GšƒrSÿÏróš}{Ž¿}§ì¤Ñ{ž'ëÍú:­ KŒ=DïšQƒ³„[(¶RkL¶¼Ð¹ÃZÆÁò“ðܼ—±ƒÛ%' ø.ŽŒ3+áj„ëpn db8°Éû {»oµúõÈEcÏÅ --sÇøút+ ÆjWC7éê7g"!3\7:žq$öÌÑ ¸¯­n»ëUS¢Ÿ;lú³ÄÇïSg¸ççç,â¿g½¸âY-‚¡ùs:† lßpú©Y×A•ìNp¬ØêpH‚çÞààÀ¯H|*‰+Hî±Â·ÈjRÉH›+•ýŠwTtÁw;(£°ÚŠbÿ¢R½EXzt¬HJ¢¶u’(1# ¢Ý‚c.>È°š)»‡ÃÓ‘˜|³Žxál‡þi,üX7êÐ ¾ÛH•¬Ã„Ë6XÜŠÃC¬Œë»†KUb¡[ ¥Ø^wÜ‚ãy -‘+û¦í sþùð^ô¹håg„k{hY¯ûˆ‚Œõ®Ã;Ú‰T -Ta줓㎔`O¸/~ôM¡v‡¢·vçÊ(ÊÇ.¯ê]UðW‡ÝðCJ_TQ­ÕßM”aƽ“Øàâù¹K^ëFrWÙ>{ÔܲR,¤ò펙Ú:€\ì’î˜6´åTvÈöXº¯-gŸ®®9àì#7ÂûÒV‚§J<Bmp<ù‰Ï¿+ùõ©"†ÊIgÇ3…‰¢ RÎtid¢±½FÛÀX=5øÀÓŠ©endstream +xÚÍY[oÛ6~÷¯öR¨UQÔu{ZÓ$M±¦^â Ú>È—Äl1“ä¦ý÷;7ʲ¥tÅÒ‡!€E’çÆs>2ÊñáO9iäù:s’Ty:MÅvä;w0r>RÂá;¡çǽœ^œE±£|/ó3gvK,³åG÷äõïÓÙéÕx¢µvUæ'I’º'7Ó±r¯™:½º¸œ]\žc/¢ro¦8üîjœjw6þ<{3:u¶„^kÜ÷ïÑÇϾ³ÑÞŒ|Og©ómßSYælGa¤½(ÔÒߌ®G¶«ðXèð¬í&–c¢}/MÃVM ¨ù¾(A⥩ûP³&‹M±*‘Ðá¡hÖ¬rΟ¡Y—3þÞÃHãAæ6L©WÕä\'0ÃÞ€iTÝ5 "O'q«IdåeQÔÕ|{°¸WE‘ïž5î[š-ÈÇ 5 —HÉað›5l` Ô&•ãÄm Óó’û—È;ãö´¢…î]³Z_V•Õj@z*ü®h­ $’âŽ=Bò¢ƒJþ¢7”;™çõjÉ”{–šf2¥F뛊ië{Ö]¸cCòàa‚AšÂ”5X: C—¶Z‘,ñÚÒBß~p5Ä¥Ÿ&C®V±§cˆíÖP¡0Ô'_%ÇËF^áà-ŠCÝ5úÕÊ¿Ø5ð 1D§0NÝ%Ù½5cÄ€I€²Ày9ö7ßx,'Wr»²+ÍÎÞ/ž¸ç¯.¸avhÚ{úeÊ'?òOßBÿ ZŠi{?š¾ Ýã׸ Eú=›ˆ’1\ éðaÆÈÈ·'lI#‰#1Õ´>F $` \÷¡:Õ°›$2’ïÅaúÿrøõªDÿèÔBÓA`Ÿƒä Tk× %w w{n#G_ž|žž1‚“³^U²~ë&hÇL/jZ}]Q@Q¹­ †JÄè»ó™%_Ø3NrJ0ÐN À·Zý’S÷ž”£‹+¿4¶(t÷JNºJÎÊ«Ugã5¢ô? ?HµLc:_ÐÂyyeó Ÿ£˜|MQöðbMõ‚‡ª;‡Wçß ‰³âm^‰Xô¡œè^äed‹ÁÐã}ÿ%ôrˆ¼cÉ•¨€'>]äðGD~|ÑþAÖ Ô¯ ø‰U:*ý +Å%¤±Sü.½FJ/†<×iô<Ôé'Û‹kW$‡7Œ1èŠc–“/ r^¯…£e=Œwd<®¤ÈµÅήn¸GÉ7•za6›cõn^ó·Ê¹öÂâ˜M¨ªtîóÒ–~ä*¤Zà.k³Ã2´ÄÌðLˆ U9Cí¾ýTñ—™Š²‘<øûB¦@Ùê›40©Ì]˜²‹¸Ö4º´ëÞ¥Íëe™*œ@`•C˜ya–uY¾l¿a£ˆèöK&)‘œVâ‹‹m8¯ ÈãìEJh=©y ìzâàôA¡•Ò C¥£‚§^E2¡w\‘ÅêGÉ´4û1Cä]ØŒ…6{¾W`¢Þ£÷Ú¢Ám¹Ïó“ä1d1¡žöîÃ'4NÔ÷ÀWôcàKÿGðõÓž:f” ’Á‚ *‰éyÍþ¨æÆÎì]l€vt©¢ J™CvêaÆöøRÕŠ4˜d‘Š2 Í¿µ9¨ª÷òWûàJ‹êˆC.:¾rù"ùwïTÞuR›LÓÁÇ´I”E ¿5ò—$X@ŠNÍM‡{Jo;us½¨ +zÚ˜£³ØŧÌœóÇs^âŸ>O^L¹gdaëÂtø4¢ìüP‚{=‚‡‹5APˆÌ·g؈¡ibox±4ü`}4‘ú.÷]Á¹ ž±!¯Þíb  B÷¢‘-(A³4 o$@¡®íJóìl 0¶ŠŠ`†)\ÿ¨ÙÕŽ–É·+o Nv•\îln/£?/ïßc2×lü–ò:•áQ1w•`/B‘Η‰fݾc-™ÞȼÇà=Žå¼Ô@iGò>«>c "‘^¹pnçm…ºegÉ€-×·… ÚƒÇÊ}Ðë‚Ù2\wFóþ«t·R,à´ä÷‡éÑ… -C‹Ö9Aâù´Q ×FF“.„ÙÏ[ücïå ¤©±;f$Æ™‚²Š-€‘‹Ÿg M¨‹¹\ãOn¦×œ°wÅWÃ=îyäÝ=®ýÜ-æ~Úÿ'tâœi×z¼ qÜ+ºA+à?öj Àendstream endobj -5683 0 obj << +5977 0 obj << /Type /Page -/Contents 5684 0 R -/Resources 5682 0 R +/Contents 5978 0 R +/Resources 5976 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5635 0 R +/Parent 5973 0 R +/Annots [ 5981 0 R 5982 0 R ] >> endobj -5680 0 obj << +5974 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 299 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5691 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 5987 0 R] /Length 22110 /Filter /FlateDecode >> @@ -23531,72 +25221,87 @@ u .´ß;!e÷vdùyv›êÌZÈy¶30Ì‘÷MLêíGëþ/éuË.'ÖBæBöqUGÑ…º/Ãfe”6Ìe¼Žb¨d5ºˆ|líWô+â0AR€7F!:{MyÔ2²¿ð7paQמã7]åE«ÌÀL)a]·9Ë\Á‰bÓ¸Áaëb Á¨6jÅÜ-ZÆÏ«…<Ž”ý…GúHªIÑÙƒ>8œÏUE7SO \TÕòc\ö‘$íY§TíFÏ«…Ì…Ì…G¹P§ìÀB5\ Ŷ)©wÝXû{¹À¿6“ícLíç9ë½m_C Ù>.~¯Nl쯻!D‘üýAßnW³`g¾=ó×sá1£ºendstream endobj -5691 0 obj << +5987 0 obj << /Length 105 /Filter /FlateDecode >> stream xÚÁ¡@P[˜Àª¬ K¢(Š¢(þª‰¢*Jw‚ ‚óßC•RÖZãsNJiïsöÞ;çæœÂ£Öº÷nŒcÜ{)¥RJBˆ¢Öú}cL)e­åœ‡Zk€÷Þð<Ùendstream endobj -5685 0 obj << -/D [5683 0 R /XYZ 85.039 781.388 null] +5981 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [314.771 556.11 376.036 567.799] +/Subtype /Link +/A << /S /GoTo /D (small11) >> >> endobj -1542 0 obj << -/D [5683 0 R /XYZ 85.039 648.834 null] +5982 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [398.892 556.11 460.157 567.799] +/Subtype /Link +/A << /S /GoTo /D (small12) >> >> endobj -5686 0 obj << -/D [5683 0 R /XYZ 85.039 616.413 null] +5979 0 obj << +/D [5977 0 R /XYZ 85.039 781.388 null] >> endobj -5687 0 obj << -/D [5683 0 R /XYZ 85.039 506.824 null] +1574 0 obj << +/D [5977 0 R /XYZ 85.039 733.118 null] >> endobj -5688 0 obj << -/D [5683 0 R /XYZ 85.039 506.824 null] +5980 0 obj << +/D [5977 0 R /XYZ 85.039 700.697 null] >> endobj -5689 0 obj << -/D [5683 0 R /XYZ 262.428 306.66 null] +1578 0 obj << +/D [5977 0 R /XYZ 85.039 541.841 null] >> endobj -1546 0 obj << -/D [5683 0 R /XYZ 85.039 262.972 null] +5983 0 obj << +/D [5977 0 R /XYZ 85.039 509.42 null] >> endobj -5690 0 obj << -/D [5683 0 R /XYZ 85.039 228.43 null] +5984 0 obj << +/D [5977 0 R /XYZ 85.039 397.709 null] >> endobj -5682 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F66 4190 0 R /F62 4047 0 R >> -/XObject << /Im24 5680 0 R >> +5985 0 obj << +/D [5977 0 R /XYZ 263.565 238.247 null] +>> endobj +1582 0 obj << +/D [5977 0 R /XYZ 85.039 194.559 null] +>> endobj +5986 0 obj << +/D [5977 0 R /XYZ 85.039 162.138 null] +>> endobj +5976 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R /F62 4159 0 R >> +/XObject << /Im27 5974 0 R >> /ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5694 0 obj << -/Length 2214 +5992 0 obj << +/Length 2371 /Filter /FlateDecode >> stream -xÚ¥X[Û¶~÷¯úR¨R¤nÎCš6‹v»'ë Hó •e[ˆl9’œí¢þÌ…”äë>AÖäp83œËÇ¡”'áŸò’PHzq¢„N/ßN¤·†•_'ÊrÌ,ËlÄóÓbòêmyJŠT¦Þb5È … µ·X~òß¼{}¿øåýt¦µöU*¦³8Nü7î§Ê`êýûùÝb~÷+Î •ÿá—ÿ|?M´¿`¦ùÝ°üúŸ^óL 9ý¼ømòË¢·´·¬JÑ̯“OŸ¥·„#ý6‘B§‰÷c),o'`§¶ójò0ùo/Š×ŒÇ».yÅqÌ)â 8W§±U§OÔé3uÒ›)°Y_ÒDB«ÂT˜(³œ²¢ïÁfdñ¾z"”Dw¿da§ (ˆ¤ L’Ô-¿šoƒÐû¹˼Á¸™R‘H Â4 \D‘à/$€–†²#ŒCÁ1þ’¡Ìà:”J"‘&„ý—Žtæo·e6ìa‚QžÈEÞ–ëCS@Î$”„Ê -¯Þªp´-JD† 7üxjlAl pçÆöÆ9–S㎴œÈA]÷ ät¹›‰ßq²ÿÜ”@ú†0Zù “‹¿i–:ÜPï˜ê~» P [%Eû›Ós‰ÈÜðy*Itº2¾xdÈØYý»2ü‡|„¤»<¡LD ÀÀ*$›‰FÀcÒLæ´‘1 MhRÿ½VtS­ü§©–~š/àª(ï—»®Ü­y†Éú±Ü-kf†}-/䆤Øu#Ú?øûîæÿ{õm3ž#v5Ȇ;`DÀ3à’N¡b‘jFFŒG·½TîHq$dzÓ3Ëyº9)F‰8Y/™•ƒêªÇQàïÒ)­M¾£Tl¹tÂd\q\ -2µµ“OCåg»]üÝ…JÓFÀvfrº`¥ÝÆ  Y#ëêu“mÙî¼Æ_É9¬¤MQ6v_Ó¬[Õ¸‹ª~€…4èË·îñä9™{Àà3ÛP$ F ’—WbèMè·õ–ì~ÚdX³Æ%å_RivSÁŽ„ 4qì¿«qöÔ{Ñç¸5fSœd”Ãg#Îv÷ýT.Àž¥Ü–Vã3 -© Ïjñ|ÈW ‘ŒlÇ“.û2eËoÓ0ÂEL±lmÉõŠÑm¼Íf «®kå¯H*f?OK$ÖÕ¼).TÖ# ¶™owº ˜’+NZw¦¾M`à\²+Z›âpý1µhÊ›ñ '“¶­™®;‹`íWâ¤F(mnÆÄCñ7j|kH%ŒÔ½ nU|Ö'Jè<ḥÐñœi<Ê8¥ ]QÁ‘Æß ëÏqÿÄ%uì‘K˜ÐöÑYÚ‡ E¢íò¦ÜêÑOuØ$‚}ïYè+žbøn{~à¹áyËô¢ço(<¢ñ²çG/zþ%¯ÐR_Käü¢q °•qW£x‡ïÅÜ *÷臻Ãfé$~+Ý+¬Ý•˜ãorkDÖvc£V(­Ùfàî!˜á5 ¥ð$Â/6xË"Ø×C9†$rëÒÏ §½ú8눩æßCKÌ„8¿|H^ž?%Œ}n1P±uÌ/WÎÛøq[XØÝ|Š^5F¡ÞÍ®X@M×Q·¦¨‘Ponã“U­ÝEžg¡MѺ„ɺcð{±çønI=ƒm¼¾»þtz!{«!¼2Mìë²áë -ÎŒ'{ÆïÐÛ)ùÂM¢!]³GºÅ’Øi‚Eì42Ú_,y­ïpRß>N€­Û4„óë ÏáâF<§Ý¼­?ŒWuU¹ëÐ;Pë}WR¸Zž·®;ª•E²$nŸž…j& ëjh ¡í­y½³·”½»\?õi]ÕdwõyììØkŽ -E·/œÏuØsL/ÁÞ-…=ìj¼{cã‚¢kÆ6¯ÿ±×ÌaOÉtÅA¯àÛÐ?â¹áËô¢n(|p¢ñ²FÇ>ȳýÈšÁÓ|ß^Rn?nlœé0DèlhC㶧ö>Ûræ &{M?ŒÏq½Xâ{,Röéb¶Ü(Q«g&¶T -¨dÔ;1eÉ(Å/ÉcÜm™q·*ûV“¤}ýJ^“Ý åY›êæBÝU˜*ûìàÐD#ín»µý-T5}` 5ûVÀá¸Ní“úV^£v-©i,Ð'8sÔ¥è”gô´ÄW-umQ ˜îÅ|O®cw‚zŒ1Öt‰4Å¿G^¥p»f ݹžJªcYÒû#€C¢ÅÑ¡7Ïðë‡Ñ€˜ÄÃ`Œ#ÂÐhI@÷}Ë2òxÕ7 ™ESæÛ7õÚ%r÷×&ö™ë*ýûú~îÜû3+ßê©jÆìÑYù1(ɱ.—©¿qôÑ»¡ØñšM‡}iñ—PìéaÔÇIU>ºg?Í9gYð¨8­í ³%ȲO¡¿yD±öç+Þ~ÍÒ»?Lyä'œ-ç+MyåY ÿ9þÕ'Èá[š‰¾ò-- (g #õ©½¡ND˜èsƒÿƒÌÝæendstream +xÚÕYKÛȾëWè”P€Õf“l’m`Ž³^ÏbáXr¼€×ŽDI„)R&)OÈO½š¤FœñaOS]ý¨êz|UÕ£ç>üÓóÔ(?´ó$Õ*LÓùæ8óç{˜ùe¦e…?”œúÇzöò­‰çÚWÖ·óõŽ–¬·Ÿ½7ï^ß®þ°X†aèi«Ë$I½7oÚ[1õöÃÍûõÍû_pQ{oqú÷‹4ôÖ‹/ë_g?¯Gl—‘Šâù~›}þâÏ· Ú¯3_…6ßÃo_ikçÇYdBe¢PÆål5ûW +ÏEsÞ5q»¥[± |•Á5»Ä&Â.|Ä.¼bBkem8Å)ˆU¨SXYÁÎÑ’ÇKŠ ÈŒKæ߀‘!ºû’„IJ¤y' ñåÍ1Hçÿ¬Ažù Râ«8{ µ¦¸º/Y7&¬û¶ØŸ› —’qu„ÆzùV›ÑÚ8U5²áÕck&‘²±f9/ø]œáøÝ6àEµR¯cçÙå;R@í5LÎÿ“opx†Ù®¨+¦ºowrÎþÖÊ6íQÅÔI¨b°·ÿœu–¡ÑJûM©ü$žšeþ¡ÿš÷¢;Yeƒ§X æŒí#3r¤Â(ëH Md½÷xé¼[„Ú»_„¾WãÍWPPƒÎ‹ª+ª=þôÿ©¨¶5/†}-O¼) TjÕÑ8ñþËŸ@¤ãoàÇøãå*;Þe£³Q×óXpë oN±Óað@t£y–Ú•¦h ôJKò`ê ‰Ñ@žcNîp <±Eõþéëü«ÉY¡àtQ`¼w5ŽîAâåãøe©Ò”¥r<¶|Çœ†‰‡ê¨…KY úi¼<§vßð|}£²²äÕÝÁ zÄ}ç Ê‚LEÂß+že-òoÒLÍAY³æa‘F 2jÉ¿P sfÈ9fxøHG8ëî@”ñçI4éç¬èj¦G²$éëHÿƒ<–1"6ÎwÑ‹÷¼k—gݹqûZ‡„™iæ¸8Õ"ñDJ¯[²0ó®”U5+¥¹/h.WSiòtjžBA£ÂÄ\@dHc®!J{qÊøÞ[†½ä0R¦ ¯? ©è¡Y]cM È3:ʦObà¿ùæ¼c{jömüfüi»†:ðzSm +4CâÉ®ÖE™ÄX†Ì¬/gpP~SÍoçbœÈõü ö\àIºa¢E5Ï--¶g8žð#$o)è.ˆd¬+Gef^âbç‘Ž×f¹ìæ[ô¬)…UË'$ Êç¢dB¼_}„D7.;–­ì"Mƒ²PÆ3ò—F/’þsy~Kiš'š§Û“x_/³„7e¸ˆí¬åàÕfpÑŒ¹Ž™öȵîp†óù–gGº’LÌ6„»{NGt<E)x'%Um$`Ç®F—S9ë²BÃq{ £KânHRlRœÂ ¨˜Í8 P^†÷ؤíñNmêj7QŒcN(!•ƒ!>ïËšôS~{ \)£–êê•´éèHÌ´‚ày*1u§¾£2PeþÄŸÍùÔN8 ­Ýd§ÉµÄ_e“”YYî¡>†˜½ð-MþDõbDî®ávÕfÔ'ãÄô¸[.Ûi–×TòJ±ÐwF¢æŠÖ¥œî: ‘¡5hvðw‘ Á‚Š;)`®ÕÆø>ã«—v¤ºúx̪í„öH;Q";ä.u3mÒDéÈ\Ø©<2BÀ癤‰Jý ÷0èjÁZ1Äçâ›Jè–?縩Jt2ëg-Ìí5<±ñµ¨ø;ŠWB*žìÚ~“´—Ó ‘Ë'ŽB“v{õQwSAbʶØÖ%Ö[eÔmÝe×Göfl4k×ШtQ> t[‚%@¶¡į̂·þp$8;-}ƒ÷䈄î@-ôy/ +Jf°5C$:•}ÊÍö¨¶>·VÐx³ÚˆÔ'"̶§ižA3¼Fž7¨¿r¾ð)éÔ=swÄÕØ×PpÈÄýEéã°ÞÔGŽO¸x™K%w_ ð×EÊo°m¥qJw”Y\î`«ÒOøuÓ‰U#ãÝH >²' +wB…·ë#G}î$æ6îD¦¤¾¾½\Ÿb\?H…áj±sÙò¬ð‹ï.ø6Y°×0¥ï’¹oN{(piÒHºâ4a ˆ¹ð„ W]É]wŠ·)¥Â}„¹p¬¼(\¿Egîõhõsä°p3cü{ + ‹ŽµËa¯éýokàè‹A.…7 zw ôP€@ð.ë&sí$ ë“$;^™»*ÌbÿÀ¤S_D´}S%ƒ°Aß#Kã65ÐòÒç„aºˆà;ŽUÁ……Äé6ÇÜTaôa;¼æEÂe°u`5²£>ñO0ŠyÃ5|ZÎXü® ™œÝÿÁ©,bILôQÌCØ‘ò6y#x˜ˆô®ël¥S•FvœÑ7¯ýÆhH.aþ4*q |'Dx¾§KT9tòqD$ýkµÁÌ›ö·~¶™ƒþáêÔY:ÿJ.^‰endstream endobj -5693 0 obj << +5991 0 obj << /Type /Page -/Contents 5694 0 R -/Resources 5692 0 R +/Contents 5992 0 R +/Resources 5990 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5701 0 R +/Parent 5973 0 R >> endobj -5681 0 obj << +5975 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 299 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5702 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 5997 0 R] /Length 23606 /Filter /FlateDecode >> @@ -23675,74 +25380,71 @@ EB# ûh.ôùCÚ ökÁsÉέ~~>R«þ@JW çù˜ ÒÔ~í#µGí‚z¨šÇíø¿ÊQqámoGø¼<ÕösÇÁЫǹÀ§ì¨ö˪ÿî¨=X;?ð0þµ{fÉm“y6–Ï¿çs¸• ©Ý-^øîí .d¯~,ÃG\Hín\HZxçí_¼ÙÄ…¤…C´ ýË7‘¸´p€8ù?h‰ )^8@ ÿ-q!q!iá] ‰ I I ‰ I I ‰ )^HZH\H\HZH\HZHZH\HZHZH\HñBÒBâBâBÒBâBÒBÒBÒÂkhá¯9£ÛwÓO¦çxá¯9£ã7Ó‚ßmj?7v þ¢3ê¿™Rû°Ý …¿©}#-XÉRû°}U ÍßuF÷ÿ{ÇØèendstream endobj -5702 0 obj << +5997 0 obj << /Length 107 /Filter /FlateDecode >> stream xÚ`ŸÿÛÛÛeeeÊÊÊ%%%¢¢¢ùùù444¼¼¼ÃÃó³³sssyyy„„„AAAìììèèèýýý“““ªªªõõõÑÑÑ›››TTTðððÕÕÕ‹‹‹òòòKKKåååÿÿÿ +<endstream endobj -5695 0 obj << -/D [5693 0 R /XYZ 85.039 781.388 null] ->> endobj -5696 0 obj << -/D [5693 0 R /XYZ 85.039 758.673 null] +5993 0 obj << +/D [5991 0 R /XYZ 85.039 781.388 null] >> endobj -5697 0 obj << -/D [5693 0 R /XYZ 85.039 758.673 null] +5988 0 obj << +/D [5991 0 R /XYZ 85.039 758.673 null] >> endobj -5698 0 obj << -/D [5693 0 R /XYZ 261.943 558.51 null] +5994 0 obj << +/D [5991 0 R /XYZ 262.443 599.211 null] >> endobj -1550 0 obj << -/D [5693 0 R /XYZ 85.039 508.568 null] +1586 0 obj << +/D [5991 0 R /XYZ 85.039 549.269 null] >> endobj -5699 0 obj << -/D [5693 0 R /XYZ 85.039 465.286 null] +5995 0 obj << +/D [5991 0 R /XYZ 85.039 505.988 null] >> endobj -1554 0 obj << -/D [5693 0 R /XYZ 85.039 397.29 null] +1590 0 obj << +/D [5991 0 R /XYZ 85.039 437.991 null] >> endobj -5700 0 obj << -/D [5693 0 R /XYZ 85.039 361.88 null] +5996 0 obj << +/D [5991 0 R /XYZ 85.039 402.582 null] >> endobj -5692 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> -/XObject << /Im25 5681 0 R >> +5990 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F20 3021 0 R /F59 3455 0 R /F41 3054 0 R /F35 3036 0 R /F58 3380 0 R >> +/XObject << /Im28 5975 0 R >> /ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5706 0 obj << -/Length 2350 +6000 0 obj << +/Length 2601 /Filter /FlateDecode >> stream -xÚ¥XKoã8¾çW}XÈ@¬ˆ½f1‡Lgz6 t7ñìzú ØJ¬mYrD)±~ëAJ²­ä2“Å"Yõ±ž³þÄ, ý@¥³8¾J’ÙzwÌž`å· a9–e1âùeuqõ)Œf"ðÓ ­‡sB_‡j¶Ú|ó>þëz¹úõn¾PJy"õç‹8N¼,ç»gêòîöëêöëo8Ó@ÞK\þýnž(oÅL·_‡åë/¿\óLùÁüûêóů«^Ò^*E1Ÿ/¾}fPéóEà«4™½Â8ð,ï.@N?ÔÊÎË‹û‹÷Gñšžñ®)TB•øa¢Îaá,aà‡&XÖõn¾Þ´)Ê|3_è õ^‹v‹#ÂçžG¦Ûïç {uÓó%PeâeŒí®â‘9‘T3©n·yÃC¼¡)ª¹L½–)k¼¸Þí²jkˆ"ð²Æ93dÈ-w·nE¶yur0Ó‹êÉ)Q´ÄgŒ!LIçÎОƒ`?É(•úA -xûýÁ´ùÅK½ÿ0󪈦e½&CùÇ -¶¤àB¥½B¨…ˆ-ÊH”xÇ‚ A²9@ýÊÔUl‹ºâiÖá”ÏÎHeB2#uÌ³Ï ]V à<¸îž¶„É"Iý”#óWøŒ*”Þ­;ž¼¢8™y¼Üð¬ÆÙ+ÞX1a“ÿ]ñc’‰ ußÐ ŽqF@1\P  ÿ¾Ò=Í+c£Œ—ï³2<Ø)¬(4¡1§GŽ †Œ Í9a´Û±•„ÓŽÎ_T—<0ÅnXã¸cë%M1Œ-¬™~¶ûïà6¼Þ&þ±#Jµ¯âøÜœŠ¡ÌT¿u¯‚ÒÌ!¬µ%“Ɔ*Á~ÅßË•ìÄQ,Þ­T%E¤„Uðôý>MªdÈæoû€‹„º!  ;r¢`A×_çj_ØߣØû\?`,sÃ\Ûl„ FgŠÌH{båHvVó1.lMÇƾ”ñûš N¤ÅЗÂòŽÂ^;aïTd(-åZ%À[Ú2¦ H÷†c,ÕŽK^ØËë¶n¼½ ºµgÚ#ûB'(þOɘT6õÌÅ®(³†™kÁ¡>£ô“Ÿyíêe†\”\MÈzä2—œV#A¡t”J -TVGœœP -{ßÆ©0oÌw&× ³~;©jØQ‹lGãïÌÇšSmÑ¢j{Uµ˜Ô¼Îê¯ëêqN -°bè£ä ›>(/Ÿ7,–-”hüßúÙ­# ‡­å=.PF›h¹©‚Ìì³5ž` >"¡&r 9P`ߪ¾a©™@Žƒƒi[‚,/ «\KùþÀ ˆþr•‹#k`ý™£ðh/9RWKWt¾{UaÕ0d¦™iê[.BOP¹£x†3ºœtkï¬^T߈c±†õI±É¹*iìÇ5’$é4¬+éÎå—!ž;ÇbŽäÚš+sâënoœÁ[£HUðm&ØôÃLèî\EÊËÍ5‹`˜ÖPÅbeçdïä(ƒ„S£#"¿s’¡á ÇÐÐw™4Ûš9·yV‚`^Àê—@ÌïÚ'éåãì)x›n\˜6kZ)LþœƒGZ•·®°û'\†À è¹#q­®©íŒŸ&¯÷¥%¼n¹AÃ1]´áC:ãJuô¿Œ\SWSö_ö†?ráG -b@»§p5.)ÑwŒÎï.y8&S³‘7ùyQnÚ¦{z< -¾MÙFQùa¸|‡ÀÀÅëí–|FöM•9éöÁwÉÚ¾Ävr ¦†GÁ«6˜ k†—†²¿AØiç¬ÖE¨¡7ks»«®J6œ´5ïÅaœbrY çt+;í‘AÑ"§‚Ï^QØ_n­* -ùB?¡¼M¾qn ߲߳§o…'4¸§šòO2!m àoÙε@‚í·æ˜Å|Ô†‰£ró’W†6&€ÎGUÞ÷ÂF#<¦,Ý;àiJŽ8ë¬Ýøa¼G}@Å(þØK`&tÉ®rBðï¦ÜØ¡}ÌsvE°-å$ŽÑ¶?´‚Iß»6’Dƒ_îzØ'¥‚»³Á'}½ ŽS5ìÜ֦內¼µÖž­9};w·ì›!gönCJbý©ïíTÄÂWà|ïU˜#ž¾–†êZG£ -ShìAµ«¥,£uê}µ…›‚¨4WñõúP/‘ zÞ¯÷)cßrY|w “åOÌg³7?!O‰åÏIIø½‡6½ÇÿãŸ5‘¼j-kgk|c ‡$½üTIn£Q -'ÃM/Uö«£PÉåûýE]Þ˜·–—±|áçÍ>‰|a{>t¯ÃMé•@Ê­ÙªŠi¿ñøä»L‚ßo^Šµml‡ïO6âáë¥Â[õáî`tÆ ›:Óõ_¤ú+jÎip׆|è}¹ã¾ÌĸÆ_›0=fë¶ë“&þ‰i2Æ/ŽçN9¸^ªlÔ®x‚¾“jxLd°ÉYWÇnÒ_tÉŸ4Ûmf¹ -ƒéZ†e&Ñû+–çWý&7äº ÛøiúÂÁÂÓg”ü1Žp›ŠÍʬ1sÛ\]²’ýúªmŤŽÐ°†ä#4Þ²¡Hʨ1ö˜Šù¿pq‡Ã?©ØÜ0ôŽÍqMÞJWÜiï Vw8øÝî6øµ•JgjQ¨ÁÔ R¿Ñ¾L§¿'XPþÖ÷„Þ µò•Nû`(%tÆN|êSyÝ7ú3ÿÇæ(endstream +xÚ¥YKoÛH¾ûWs¢‹bwó`Yg’u0“ÑÚ +rHr EJâ†"’Ša`üÖ«IQ¢÷20`ö£ºëõUuuKÍ<øS³8p=“Ì¢X¹&Žg›Ã7ÛÁ̇%ÞÌw½0À©®o–ïƒp¦<7ñ’ÙzK$ëì«s÷¯·«õïó…1ÆQ‰;_DQìÜ}^Í•óÈ£«‡ûOëûO°çàr>¯pú¯‡ylœõüûúãÍïë3¶ ßõCƒ|Þ|ýîÍ2íãçš$ž=CÛsU’Ì7~`ÜÀ7Ò/ooþÝïÂsþŒWMh·° í¹‘Ö×ì¢$v悹bB+7IÌ'ºFÅÀGiׇ•g$—¤ë 3’Ì~£€Æí—$Œbšùº\Þt2{Wƒ<³A¤ØÆØ‚ÔJOqµ_òn¨'¼û¾Øš“sU€ÎZ¾WÁm»: dÁ›KoF¾›„Šåñíaù­ÀEQÍuìtðQÎŽ!ô«H¹q7_ |\KDRz˜ëÈyÂë͑·ù…»ô=÷R0jWGf,ÙHŒ€ð®ï†±ž“…D¨¿‡WPâ&:|…Ú*HúXÔ0 € ‚sëÁ‘ ºjˆÂ ðœÇôð„f Cç!ßäů&+´ÈŽG?b»~úæ)¿Ì[K« ‘³š°jÛÒ¢­÷ù[]Íß; +çlj £hÿmŒrc5h3‰…Gôm쀄9P~ 1˜¼|!<œ@†¶›€&Dž…BvBhR¢k¹QãþÏhƒ +p¢Žlà=6EÕåMû}*EÀæ±ʺ™Ø Øjß¿Ø«JùÔvQâÆ¡âVi” ¥6·Ë¨$™‰†ö~i‰ûï­³Š“]y²""åõ‚‰i ²ºa½:Ê–;²/óØÇeÆKHŒ·±{/–´ŸË9b¼Èù‰Â̧üÙZŸ¹ÏQ@#5Fl)äÏûšwÙ§7N téÉv›úp µÂó2W`µ“©«ŒAòÔ OŸÕQ©°¨„AD9·çfáÓI ¢ŸqaNE"–_]ƒºïv%s‡ÐE½‰•1BLÚÎÌ¥Ÿ0!í Aì÷MÿØP-sÒ œß¬<:r=(²P ·¨¸ÞBÅ3BŽ=Ý[ž:ñ¶`uÐpÛ›òE2ŽùSÀȇÃZŠÉ+aP=„jM΃à ^®¦¯°X]³ ñw9‡MÃa\Ô•u6ž>"zôð—Ëê‘·yèÃçûa®HËz× +ƒ&­Ú’tÆmÎòô&k¯‹X,Gêj1T p[ðò§¾‚ÑZs>Å*ëÔuÖôtxË›)1Zd£G%,Ë¢µ§ýÖÖÁçU¨,* |Ê,åÆéNÔ»|{Óa•TŲN3N² åpðÅ©ãYÎe/²†á8„Ÿà`%YM®CJ›f°Íi†ÛÛ¦>Ll|{:ò(!}Zó<Õºð•Ë´\bòªÏùÙ\’Î5§’\Ê2ÂN’ L w(§”û[ow5K.c"½rª6p;þ|Áß+ò'îï|qéåäÿÖrä"_Ë‚¸Kù\{öР7,Tû bÐ2¶OywuÅ5ºÌ1‘Ào#‰vµ}a| £`&žô<Ù´ù¥® ­”Éð ¡~~å…^¼ô÷~´2‘‹¿ {½n?Æ×?i€xþØ%ÿɱ³endstream endobj -5705 0 obj << +5999 0 obj << /Type /Page -/Contents 5706 0 R -/Resources 5704 0 R +/Contents 6000 0 R +/Resources 5998 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5701 0 R +/Parent 5973 0 R +/Annots [ 6006 0 R ] >> endobj -5703 0 obj << +5989 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 425 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5713 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 6007 0 R] /Length 23871 /Filter /FlateDecode >> @@ -23828,662 +25530,642 @@ wx,$ ¹€B!P(ä …\@¡Ð 1C/ îì—?¦,zu_9ý˜RÚÿDz‘> stream xÚ`Ÿÿxxx«««£££555hhhøøøºººíííñññ´´´ÂÂÂééé&&&õõõ“““üüüÚÚÚƒƒƒ›››‹‹‹ÞÞÞÉÉÉÒÒÒ×××[[[PPPAAAÌÌÌåååÿÿÿÄ=endstream endobj -5707 0 obj << -/D [5705 0 R /XYZ 85.039 781.388 null] +6006 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [118.987 52.932 292.795 65.834] +/Subtype/Link/A<> >> endobj -5708 0 obj << -/D [5705 0 R /XYZ 85.039 692.384 null] +6001 0 obj << +/D [5999 0 R /XYZ 85.039 781.388 null] >> endobj -5709 0 obj << -/D [5705 0 R /XYZ 85.039 692.384 null] +6002 0 obj << +/D [5999 0 R /XYZ 85.039 758.673 null] >> endobj -5710 0 obj << -/D [5705 0 R /XYZ 270.549 428.615 null] +6003 0 obj << +/D [5999 0 R /XYZ 268.155 536.211 null] >> endobj -1558 0 obj << -/D [5705 0 R /XYZ 85.039 384.321 null] +1594 0 obj << +/D [5999 0 R /XYZ 85.039 485.663 null] >> endobj -5711 0 obj << -/D [5705 0 R /XYZ 85.039 350.181 null] +6004 0 obj << +/D [5999 0 R /XYZ 85.039 465.334 null] >> endobj -1562 0 obj << -/D [5705 0 R /XYZ 85.039 171.355 null] +1598 0 obj << +/D [5999 0 R /XYZ 85.039 286.508 null] >> endobj -5712 0 obj << -/D [5705 0 R /XYZ 85.039 110.469 null] +6005 0 obj << +/D [5999 0 R /XYZ 85.039 243.555 null] >> endobj -5704 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F66 4190 0 R /F62 4047 0 R /F20 2961 0 R >> -/XObject << /Im26 5703 0 R >> +5998 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F20 3021 0 R /F59 3455 0 R /F58 3380 0 R /F35 3036 0 R >> +/XObject << /Im29 5989 0 R >> /ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5716 0 obj << -/Length 3158 -/Filter /FlateDecode ->> -stream -xÚ­Z[sÛ¸~÷¯Ðø¥T'¢y¿dŸ¼Înª4õªŽ<ÉÌvh‘–¸K‘*IÅëßsI”Ü™v2ÀÁÁÁÁ¹|°;qàŸ;IBÛñÓIœ¸¶Ÿ$“ÕöÊ™¬aäã•+3!™4?.¯n~£‰ëØ©“N–ÏŸÐB²Ìµîþv»Xþô0ù¾o¹©=ÅqbÝ=.¦®õ…{óûåüþ#~ÐéZ þåašøÖ’‰æ÷Ãðí?~¼å/ßv¦¿-?]ý´Ô’j@ªÅü÷Õ¯¿9“¶ôéʱý4™¼@Û±]Þ^œvøò]]}¹ú§fÅcÁ„gi%ô;LüSµ¸áˆZBÇ€Ô’µÅtæ%ŽuûånŽ-kÎßÿrܶX~»Öª©§0Úge Ýe½†î8µöÌw­vÆ¿U±ê³§JxîZ"¥yÜÓì §/äÑá„wП:Ö6Ûí¡E\ræÝ7< Ç` šÛ–Y/ÜÈ·éú/«¶$¶Âkq÷Ï3sQo)m´i§³À,<ÐOŸ¹½ÂÅší6«s–'ðc뚊¸ßÒÈÚuÑs›Åà]-RèY c«…ÌΉð;ö©®óa¬ÌªfÝÉmVwíMî -–G«¬ÙÕuSÏú Þfpháë5* -Ã:D}š}ß+ÅcW†íœ‰sÖ -@¡_ð«FϪʮ—yϨœ¤Æν:ÐB ÊÂ]Q‘l«ÞVò{±í¤,?ø8Ÿ¥Ö -Ä¡FÕd(fâY/%­Òì{ÍHů2‡mR4LË—H\w2›Î)É?p-»’þç¶ÙŽ0þJFž³ÐbtˆÐ¹_òxÙñoË[¢­“J‡0Á9²³=y`-ŠÎ[!ân}HÐÞðÊhõ{¦‘€=g-7E+c¥943þyÑ«áñ¸yS<÷07Dv„2÷ Ý™¢­ÆX9xÁ¾…fÕ£¿£sù±o§I0t³±x[‘“I”Ó¡óÀÊp™ˆ,LbGžyœ‘c'øXî-‘ÐpµCãÛëKZ“ïxËhß“©JT¶FY»|æßWòÙ= µgCÜaù+´òMë" jÎœHþLì‘û« -–}±E rdœyAh{`¤Á¤Rn{œ©©Qu ·ºf«Ü¾(¥À‘ûì®…vÂØ弃DÏ”IEÙ*íáJŒ¿Ÿñ\i|ÿçÍãýüÛ;æð²ACL`÷DFáûwmÁ*3—Sá–_òÿ^v¢`†¯0ò(K/4ƒ0€‘)EøVM™z›UÕ+S²6²AOð1Ð1ºÀâû4 A˜!åæLú$ €¦m„ÔŒÖ@¾¶¸Ò|q¨:a^[ûÿ.øC²ÜµZë½D×²Ï Ê0íÈ‹.¢cƒ†ÂŽ£®¢UiÆží±™NlXÒEõ‡Ž>?ÖyAΟúå¤(¶j -6çĔŽ¿Hðû÷¤%h|;·áâN4ÉY<‹à×u"Pøs -ZVѱqºÖ_PÙq>¶ -,HgÙKzæÙd7ÐyÍí±ÃƒîC<Ø ¿šù”„š eë‚IYj±ø@Y¬f¹‘±;¤Ôµ thdÁA§šA\B· -繧ñʇ£$¢?ur'`AŽc=…2nw³5gì#Á[*"í­ÐÉôȃøa9qm˜Â‘ðWÎç}2—yCHe•=Q!Â#yñ½\)ª:.„¾ÒÓ î‰bCXÁøè{5 KÈwˆ¹áÈüEí€Xï´£š0_¸‘ß·åצC3œ±Zº1Ü»Ü „ ÀÕÔ/”%Àwh $ées€œõªÚÓ)ÑK9(p+û -CÙ«tYO G•R8{Ätiñ#ˆG¦\¨D31ý>Ìœ¦¨g‰£¸e%úÃœ•ÇrŽ…ù§¬ã(J° ¬hd tü$E(A{¦!ýg2TÏ>½"»Ž9BügŠ¶`“+óÈøÁ= m²9Á yÙs1¡òK@ðBåˆÀjÀþ[5›JŠÓc­$Á&ë;ª&sÞòÇõT"ß"aÌßÒK›fÅs×4%k‡Âãš‹qËñŸ3l˜pÚÎL×ýS.±Œ¨¥8É sHzMxäqEù|H➯‚ˆKM -ÇîàÊ-@à‹gùú‚ ˜”™sÿ_Wû -©?£ÕÝ8„ZsCô1&ð‚„Õ[ Ͼ¨ªNš’³±}tQˆ£û é^;öŽ-¿l4BßœÎ)Ú±0Ýí81­ÔžÑzà#p}ëÂw—Ñ80Ô×ÜOE8ÈHJ~›õ‘bÜ7Hß‘ -wƒéåLx)‚r£0åD”kà%‘ -±7±ê;æEÞ‰ Ì„†2xœÆÓ˜ï{(d­tÈÀX†î!7–:íÈ †Ž¤ah¬ªR€qGÀ6!L͇"‚-öuAŒU(O¦Åº”6¢Ô€‹xçÀÉg ÓM‡:eÌ,Õ´ -Ò$¸ÊEyÏ|‚·–̤3y`éÁÑS‚¤ÜÿœÁ¥+ÉÔ0˜w=‡7K™)˜¶¤Ö6ët.!µ”P‰x›õçÀ®¿žwù*Ø 9 vý .{&Úõþh÷+™qNó^ºs{.îe 9‹w}/´c'ð®†/*1$ÚjS].²¥3„ñ! ä<ÚýW -ôr ®#Þw„šB¬0uõ´^ŽŸX=ËÒ¼Ôõªi‹kîz#ÅÑ­)var®åJòÔm$í7Ûí” ‚( ÒÁ }=\úŘåC÷SøæKOhÈIÜ‘v÷Ëïï7ß×?pDÐ÷8ƒOr ‚Íq#òéÆnófÅI‚—>÷0]â…ðm)Ñ^˜ f‹œXð&R>«cP"vkÕáí½J-•ÄìëГ7ü ¯â…}Ë‘/ªdr-¤ -%AWÇaãIS"uVÞH7ïϸ‘vÝÈ !7 -\óÎÈqmÈHš_DºñÉõ£/&T4'+º‡—Žží»ÞÁŠœMšP6Á_þÑx©gûB]µè`  ã ŠÊ5À =(ÿ`0n¹{¾•*4ᇋÓ,Ò´V µùPmlÌ;»5O5³“ù\„c|±NÛBÛ¬NSÿ‰%9TY/é Óy†F$ÃìéáI#j¤ ídhvx¥öÃ9ƒqÛãÂÄ ¹`0Bô¦Á\Xp0˜£Ç ÆX‘ Æ Ø`<Ö‹'IZTÙf•Œ­VÍžû(ž¯¥›+fŸÞƒÊªROyØ%WpöÞñË@W¥¼¬ÎçIS¸îéd j¢]ÖuC=⟔ÈÔUpc×õÍnüq¸cS¯å‚Ü×ËyI` O`å°)É8riÖký¸ˆ××5³Ñ@¢0,ŽîÐ?ŽN×ÐÁÄs;Žã·Ÿt}Û‹ÇtgŠ×Ì`vj~àÛ°QAÕ¬Ypíq\(ž¾ø‰Eêzûþ—åOïGîÀñêÌUD½ªêQü —È5kÏíMF §':~pð"Î=|¡lé.çåúô¦“}øwdÿ¤@­yÍŒ®_QáG,^;A•×Ó¥V(¢·bÅ¥u¬8^q4V˜+5äqqGÀFÕ3à¡Fà‰¾°ãÀO@/§—hnxáýÈZ¯«â"‚:}ÐädæEf}¯b¹*¡áUøð›†ñž€‰ßãOcÆQA©^VbrE0PÛIØ;|‘§pN¤Þ-Ûû‚íÝ“Ç`;Thä⧈êl ò"¹R†_õ—mSq‡Ž¨Ð>¼rÀönsLí%¤Ë2¿k4)32ÈFôƒ/:Fmw”ƒ ô5¼âãéž-Ï{Üvá?/ú?ýá‹v9„‰ÆþCϳ=WÉ‚›ôÂðX^õ2'ÿ¯±Ì+endstream +6010 0 obj << +/Length 2942 +/Filter /FlateDecode +>> +stream +xÚÍZKsÛ8¾ûW¨rYjË¢I|Íž²™$ë©-¯Ö–+S5™MR3©!);þ÷Û/@”D'9ìaÊ’@h »¿þв?óàÏŸ%¡ë©t'¾«’d–o/¼Ù#ô|¼ðE›i׋BìúçêâêCÍ|ÏM½t¶Z“ȪøÍy÷¯·ËÕûÛùB)åø©;_Äqâ¼»_Î}çŽ[—·×7«ë›ø¥¡Ñwî—ØýŸÛy¢œÕü÷Õ/ïW£eÚÕ‘Âuÿ¼øíwoV€j¿\x®J“Ù3¼{®Ÿ¦³í…•j%ßõÅÝÅí,ܧg)¥)V›²ÝU8™}©û–ßú–æööQ}ö|Ň^²°Ïw>Þ_³Ð„ºVŒÓàž;PY|þÛoÿõêþæú×KžáySåغa±œ,í»®ìiÁñräë?ËÄ;x·&CWíoìyŽ®‡` +£ÀÁñK;Ž6š*sÊÁ¶¶ÛfuýÂ’|ÙA“@PÎ~ìÈÀòi†pŽ0~Ÿ eÁ¢8Lf6"º$ÛõÃ]ÞáÁìdÚ[\ézy|tÃfî›%º¦í7¤íŽg£ca´ØuãN€D˜€éiàZ¡«âÈÆt;›âʇ˜´J\˜ÜÇs=k(>Ü(rÖí\y°>|ÄÎMÛ,–wܱìPŠôÊn4‚vÂè+Få í”v}­¾8¡°šŽS§h1XœÖЉϖø­Vm2ÔèVqœ×kþpËö•îØ0çõ˜°+6ïP²Kt²:ç°¶íÙaÆÇ’»ZYš9IB€z¿Àq´Å3¿(JÆž‚…öK«4v6¶ 0A <¾bÜ’ÏB¿u9èé”wÖÓ¡ •"9ÛH›-hÏÛ&/ÌØQ¶e9ŠÚcËEÉKЉ=°¢Ü#ðFNVá¨ì¡.͘§*—…1YœC@AGÎ[ì8_ZÈ ‡¦uÛq¬+€[¾I`¼tF2~ØàG»Ü° dë…X ¥]£\»$PÆß + ‘bžuûXåY}É~šI«x®NÁyò£ ß 1µï¾ÆÃy‘†2P°#U =±-Z\ M¼¸ÛÑ8³I‰iõözÉù„Z¬ëÕo¯±e)zNÁñCÖ3†jÚùˆžÑ­¥çz`òŠLPqø²kõ=Ï8Í]IÊÊø5m{–h»––4Üm'Ká6‰tàG†ù«¨†Š|ÂäM´Á`9x€ygFûº.Ïã½Ëçô‘ =ž!RX²å–?HB“ïÀÏÄsàHç-m0ˆÈf=}dô±8T° …t7äêÆ©O¶+ÒöaÀQ¦èú‘b’Ó3+lgò1Y5€:ÎKbxKß|‡<¬6dÝ@­¸;í<[ÈÝpƒÁ­Cç²äË3m +˜…ɘ؅±«¢Dþïù~רjL%ç,*Òn’"Gô:2‘ëZ]qᡬëÞèSò‹ FuçÜ׿ðñšÝnesÄno™ŠAà‘tDÇ©aÑ #E¬% õÒl4×r5<-¤*h…'Ñ”Zs¬ NCß)’Ó22"‰´Ç£Cú=†ç®®8Šãs<ÁÈÅÓdl€ù÷=åCÃ1µ9›a +"(Šƒ”I>º†”=¦û2R‰³EÖñجççØᎨ‡½&wÈTšŽ–¤áõDÖêÙ,Åesvi¦‘Y0PH­|8Ö/{]M’TSÏÊf¬Ô0õS¾×Y}±‡ç<«æQæÙÈpÎù)~*õ +~Z‰œ'/d*ñç–¿2Ε¬„å윸.¢O^vf'ãÖ#(â°~¸Iœ~‹Ä†?Fbƒÿ?‰ýD}“·žþ{”Vÿ¥hg/1h¢\ R{KG” +úÎZpo+òFEÔ ôÜÓÜïêÊ„-[£GJ};ŒñN¦ZËÒ¼2ä¼íÊ7Üú,„ìœÂý@Ùb¦M‹-ϱ ¿ÝnECäGX9H#²Fϯäáøò†Ñác‚¡ÄÏ#Ö(.ŠÒtøò‰’DÁÑ^nVWç}½úÍðæˆɨc,!Ø"³àRÖF½3êð¶hwË&kJÌ €=G »øæR ˆ‹y…°E^,)%×ö¾b)"6ÛÃC~-¢‚Û‰$h)ZþÎd®ò™_BJsÈàFD E‚¦žãža¢­9?Ÿ˜“}‚½hšˆðØscN¸ÐðjbFû1©3>6t5¸75)v県÷ù ¤ˆHSB§ƒÌË&;ö]â/Ìf +–˜ºi@ó-Ýþá…ˆwÖ3$Â÷õÖ^ iøƺŜmÉêl2ò×Ú0.:W!µI‡ÄNiê­ì½kŠÚåÀƽ«³aÍ•¹UÍþ•³G*‹ã(AçB—¼—y¢ÏKxe +b5¿w#üMï‰é½ˆö Ÿùˆ3tY-}9#ÕÞ&hk5çZ| ›n=îî-÷'w?p •ÓU'ªe½3»¢HílÂím–÷B¼Ë’~t—õ¢Ä!ýÐî¦xÛ¥j.—oõèfr)T‹ˆ(3 ö–RzàüXÊ°ªáy¸¡áÊK!œx½[$À\ú°]v#'¶T‡VóïÖÕ«U4Y —ëjÊ7`3÷ÀsƒÄ?¸¤¶”Ø•›Mz´+—…o°J²?MÕ†aÖÐÔ†s1’ñÔT¸ð7ÙNÈWà ÏÕ 'èƒËY \T'z~sÎ/¹åKûÐ År1èëgŒkÿÒ‚ÉÆÀ"7”+ CU¶d™ D‘ftÏœ‰(‚Ђñ_ %ÞK^•PÒþ«— ì£\«={õ6…2/²¡än"_ðÌøA2 µ,òƃŽÈÚPNyÀ2Q*· Õ>ppEiÆW䕣ߠ.øåpÎhNj òë„Axðb/‰Ið^î&Q`XHdJÿD«•ÐjÿŒaß!/õ<Ç»‰¨o/N‘Tóá™Kµ£kknìGï'whù‚ÁõÀÕŒšGYæ‹eÛ2"“ŽlI©ÐÍ—)òãô:âF¯§ÉX¹Q¾rR¾«“àè +¤]¥£“+þî*áÙ|WÝgVóí½•jU}¨ã®ìžŽn>H_>­î¤æI–Œ¢Ñï™Ð(׋fà‘眎'‰_Û¨ï‡ß?á¾d a¿c·Ù +å Ë!ºÁDb³£* oÔ?«žp‚Æ~dGJݜӰuů‡ºE6Îm¦ÐlFìX¸Ýšl2ßÊ~*+‰v—§ªãJö„‡mÇ?¨É&± Á½¾©xƒ.…W¹³„†xnʲ෌[<½=Áv5pM;|þ©KÙ‘ï¦ÂrϪ®8ÓQ¾çIªæ3è_µYŸÝ¾áe ˆ«ŽÛFAÿ·‰óOpÚƒÁ0O³­=(þqsbž>+nÛJÃX½Æc4ÐØ£Š8OM§‡³óOJrùétLꊴ!q._-S#¼¥ßK¥‚ÈÓ5c0ç»ÜˆÄ¡@?dè-U]Én§˜5œOü"~,~”&}óßTìúɘr½¦A”žj8NÙFÁÿ0ñendstream endobj -5715 0 obj << +6009 0 obj << /Type /Page -/Contents 5716 0 R -/Resources 5714 0 R +/Contents 6010 0 R +/Resources 6008 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5701 0 R -/Annots [ 5718 0 R ] +/Parent 5973 0 R >> endobj -5718 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [117.472 665.485 291.281 678.387] -/Subtype/Link/A<> +6011 0 obj << +/D [6009 0 R /XYZ 85.039 781.388 null] >> endobj -5717 0 obj << -/D [5715 0 R /XYZ 85.039 781.388 null] +1602 0 obj << +/D [6009 0 R /XYZ 85.039 692.47 null] >> endobj -1566 0 obj << -/D [5715 0 R /XYZ 85.039 597.626 null] +6012 0 obj << +/D [6009 0 R /XYZ 85.039 660.049 null] >> endobj -5719 0 obj << -/D [5715 0 R /XYZ 85.039 565.205 null] +1606 0 obj << +/D [6009 0 R /XYZ 85.039 480.072 null] >> endobj -1570 0 obj << -/D [5715 0 R /XYZ 85.039 385.228 null] +6013 0 obj << +/D [6009 0 R /XYZ 85.039 447.651 null] >> endobj -5720 0 obj << -/D [5715 0 R /XYZ 85.039 352.807 null] +1610 0 obj << +/D [6009 0 R /XYZ 85.039 181.349 null] >> endobj -5714 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F58 3360 0 R /F62 4047 0 R /F20 2961 0 R /F41 2994 0 R >> +6014 0 obj << +/D [6009 0 R /XYZ 85.039 135.477 null] +>> endobj +6008 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F20 3021 0 R /F58 3380 0 R /F41 3054 0 R /F35 3036 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5723 0 obj << -/Length 3344 +6017 0 obj << +/Length 3411 /Filter /FlateDecode >> stream -xÚ¥ËrÛFò®¯Px1X%b1xÃ{HÙ²7vl9ZK.¥*É"  ŠQåç·_3IP>l¹lÎôô4zzú=VçüQçq`;^rÅÊöâø|Y9ç+XùéL ÆBP#œ··gÿúOž+ÇNœäüöa Ø~àßf¿Y—Þ\ß¾ÿ:_xžg©Äž/¢(¶.¿]Ï•uÃÐ믿Ü~üòÎ|*ëÛ5.ÿòu{Ö-#}ü2,¿¹zû†gžíÌÿ¸ýùìý­áÔð\%Èæ_g¿ýáœgp¤ŸÏÛKâóŒ[Áru|Úïɼ<»9û¯!Åkþ9ïš’ŠÆXÀÉ7xYr¡²ýÐ3’saÕ·=?K.pìÀñIrHÄø‰uWÔY3÷”µ›/”ÕÁÙÓ(+o«$R#<-yá&oŸòv„ù»8w·7ð£Y©, ×ÀË)åuÏ;OˆÕíDE/tÀ¡ƒª`BE”k‡«Èíº ~\«Ëûí‡ÊªÒ¹YÏ<¹Ÿ/`’3RóÀÀùÜðÊÇ õÜM¬>G`‹g¢õ¼½oi£i*«ÙR)ä ò÷œbp‘×K ¨¬#g‹ ´þHÓ2÷·Í½Pæå<°¾ÂçAœÅÖS\5õ… ²[(Т€dQÑ~ÂêçrF´™0°î`~‹s å{‰Uç„›ÁÌwP* -Ž\ó,åŸ -e¸E¶ú¢Çß,ÇE2$ lt®ñ›M×£‘8[T‡MÏ”2ä¸xš“D:&BB!‘Õ´,sáEŒ¿í¶æÏôëŽL°eY°úîÕøø~B皃hSy8xýŽÏ7îxVVüî(/o…/nˆ3† Ö#¬jèî2}÷eg##>Ëo:Mšd†Ô‹jP¨¦Ëµý°/ßÂ{.–4 [~{»DY¯…Tm„¨YH;}[ŒÐõ)êKQrÒ؇‹ž6º0Œm¥^öË#ã]” Z£ }׎|wä]”¥ÐÅŽuM×ÍÆObð®-žè¶q—YõŠ'âsp8ûľ¦ÎÅý\¡9¤jÊš1Ò2Ýv, œUiýÌ#t?´»¹/q½:åwBß±ýï‰`À9éwB'¶pæìw[mž’7x$±r¼GMI{ž²x§_nyáHk^;2úÊV„†Ä†!ʯ6ŠÊ¤¯ôwvp k­Y׈ۥQYXOù‡T}µfªmÑ=N˜Üy1/5÷‘Mߌ1Â"i=ü’phCduÏ{ۊ׊‡Šc÷ÁfAëtX®›žƒ¹”¨Ïc~Rí_”Ö“Ø¡Ùåe¹èÅËçÚzàZo4 -pÑêmf0!ˆ’¸±ÒÕû4ãAFÆ1fŸ jÞlI>´>ôú9ÏzßÌBSù̴ଠ‘k¶o+„Jœ0ŽBiµ)µ”ÃV¯‘®/?ó€ýÒH¶§‚š?Öç㣯é¤qr…ßnÏŠž­)°´k¶¨ªÏ´—Ýê{IØåƒjs¼­õÑ}6¼'GrÏ<ÝêèÁ§"¾“iš¶Ã'I± (‚àÓ'»u.Xšï;{â ï—HYñǵŒáÑV€÷²NŒ¥ZíqÁøšÐE(›œ)í—ò*˜¤e'tZ1kÌNîµJ:D“TÀ|ö¶ÜÊMÃìfÙæ’°¢E’öÅwyÚ¯gúëü›ê­¶ø ØQbqŸvE÷£†»‘íˆ4qÙÑå(B•¹/¬HLuÞ¦ø Òf€²AAF/ÈÖVɳ>g &Ó ¢pÃtHCJ ‡ÀǺA»Z(5üËŠ1hïJÉ)>óä8'»˜Ð‡|0jüDŸX“I“Ó b1Êgž .†ŸôIðµqä8òˆb!c‹iP à÷³X¯ÐWKjÓ!í• pŠŠCDXke}MÚªƒŽi<~`µ ¦ššnFBSŽ,—(š"¥^l­Cúk×(ò†ï÷fœõ›~Ø=(Ókt‘Ž º°ŠÁo²f8=ÌÅßû{y°·ïªX¶MY¨œÞ6ýš7ŠëÜøó±©ì )0Æ]£Àå eƬá߃F@$FöC¯ë‚¸óŽjçÂ>]Ðy”<‚[7A~¿m6ÄzoßÒ~àãRSqÚOzàñüðe÷?Â9éþ]ø oÏý{âþ/¿Áäúæµô5ÙÝÏñ+T‰U±4]Ѿ¡.i>ûñ¿nìÙ^øra„sÒ¯»2·û­£ž‰Ÿ$Ô“ƒŸ‰|ÁÇ‘›î2ð1éËuW`N3")mÜuÍß]0cÓŽDõåàWÒ¾=‡Y9 ÊW©ÖúM51_Õqȇ6ºC#£ð*ß/„ßáF3ì´6’ zjÈØ’ýZB»wĨ\ˆl¯ºPTlX –$.ѵðƒÌჸCpXš€3lwAí!#®4É=;é*%æ÷¦N!DIá&{L€k…†7Ì:Ý„#Ävc4ëof`ÃcbPw4ˆÔ#4R§N‡³Ú¾ë–Ç*– ²È¹ÏÈ>‘l˜Ê× }ºŽ‡)þHÍÛ>•"a›!³ÌB¹ -ˆ\ÑÉDjt,TDS¼Ä}úµ qk{Õ.¥ËA8Ýçm˜üõ#?ÂœêÏ.ku -ä„ÔVÒú‘˜µ6ÿkKÙ†É*1F·X9èÏSÝÙä¯o®xЯ©Ä€ÑnË»kÛNgè ó®d,<¤<± -íØñ“÷Dš’…4ã5㶟ŒWÊíc'z]Ò×%Ë‘>d/úåSÉ£¤©ì±‹Ö$vÅð2$I®ð5<Ó©”ÏjÜ¢ç<ÀîcÛ Ý‡Üì½OÉÆu£Ø·JÑ«GÆõËþvQ¬xÔåwË;UŒïTòðÇSqJÞ¡–Â[Ùõêû(Åö:ÜX‹b,Ge6ØDÒ|6¥¸ Ƹ¦«RÛ™4=Ýœ¡? _¿Ë“›“¿wR¤/8•Q»»°´êÔ §5p‡i§Ȇ(áP0£ Ú}ºÎu]Ð׶=¿0N^Ó¶£Ø¹¬‹OyÝÈÇ{êÞ£w»eÎ{![ùýÝøÁÛ¼Þæ¥|_OEMã,ó3!½ÊöMÞ÷f[H{!¢é«»2ß4Šõfþ³;õÍ,1ýNM8qÚohž œ[Z*­¦:÷ç±-tÞÍåwG=5õSWKÍ+«eز&Bñ ]¬ °?®‹ka©÷Pˆ´ ýêßW¤ ±´ÒÏ^=öÀï¥N[÷Ýû3èT™ _Cç÷v¾¢yÞ´¬ m×9´Ç+Iy÷M›Ý%F·Xñ“è¿Z‰Ú1† ÍSÓò´=V°’f»–5£=T†êb +µ(¸j¥]çYYêé6à…b3:déÎø0¤ýØÉ+‰X^ÈJtAP l”vør»ì–][9µ]]]¡·´K ]Žr—±”ö‚Mö‚MÄ®Sí[iØSWþ nIè¼nvtN±P…îxe独ö,ɈZXP. ö9ÛìJ]41ñQ fíúÕÏBܱ¾Å.ùVmò È„Ö™®{M;ï×Í}'[B£E[TXs†ëNSííÏrɇF\˜™ù¶|—î_€LSW2l[µl7OòÉ·]õJƒ?aÚìpºEV딬ú%]µ4wM®‚ͧ; ðš¾k`nä\ª»!Ùo†›yïÛ<Ç(7‘¥Òo“Ó1b¡nlU‡îµÎ‡j›Kã¼™R³²Qí૶«*yww¥Š\€–Á/0·¨K†À3Ü}¯â™cQ³˜|k'_Éoç02ÜŸõ™]š.æh÷˜±Ìj!ßá€e~»ï¬r¼xæRv®aJUÓÞ,êbÇŽ‚ÌÈã™ëã-ãkG{žnÛûJ˜’\#úÊËRXÛüè&G®3_çOV¢5{¿wDàöÕ2Kæã£Þ…†ØZ¿FìÇ+ì»oÆ›†™&4Kg¶„ϾÚÃÉú "„&N¼’–Ú?÷úûÐ_Ämo ܵÑ+”c×iD»Ösð“ÐÙ4\¿ˆ¾³~}úqdD¹pZçGM¬˜ Ùîì@¬IÒY,u#d°P›]@©ÛlEÙ°… í,±tº‘¾„\cå…ŸD\;%з8ù¨wsi(ÓÛ`‡+(¸ÚHïË%ßpVa.ý€ÔWš Xñáo¤ãªXÔUS­ZÒ}äEÎ÷U»V!u?ä(òŒ=/Ç.ö^Ї-o È Å;M¸3kÌÖËki_ýÃV>ŠMv_l•¯¶¸?»”[@1ž. aÏÞBl[½#°"¤BW¶ÌíYèò{uyχ+¬—*ºlÜÛl®™ÐÅaü `#·¤ñ×ASO¡éí¹%ø®S? ™á?&\Æe#AÿÍ–Ç€³²(óÇ<û¤€çgèeÃ0(k­G¬¶ÏáÍà xÓû÷pÓ7FbhÆèk0pZr;ŸdBñ"FMxØË+ã{dÔéQŸÜMÒŒ¨û ¦5´™ð<°ryXÕ¦‹KEÓÖa¯N%é +%:5U-7AV56˜:ï ^],Ú‚³„dnŽUçjºˆNL£€“è{øX–¹2ó5aÉ‚¨y;¿QZeyriG+5kL P‹xÄ·ˆän­ãÐ8á‡wŽáHOß08JXrƒ»ý*¯2tÁ›Žt¦h‰£½Â®EY¨¿mû[ –t©ÄÄ {>Xšlê!À"óD¯‡”èÛ)ÔÉõøÃÈÉŠ²wfaÐ% +Õ6³ …ü²êlÉëëfžäC]ß_i€"Ç£ ¿ÑØT0ºÀU]d*«)>çŸåcˆaîÜ ÛªJƒØ—2Þä‘øØIp©u•u&P‚‚!²3Ï ÑÓÍó:: +j=e ù§¢Kßà+y³£²¥P–•ünø¼8¬µPôÌÚ¶ƒT/¤£XéÐ#ä+ð=§ˆX2)X0ÄG´îDé Ú6¼mßLøÁØÌÂÄ·3?¿ÎûêÇ_} ë›oÅ#¿ìëWþp#3­Ü´tngßýjvIAšrbM?àäq’ŧUz#–ÂúXY DjD¾à‚Ñå !Šëï@)HpSøí Î@ÆáÌOB ’ßgöyz´Õp­Ø±aVC‡.BÅ47˜7òàZÑ0zW-àDW³®ÀßêÉe‰ÿ ‰œ¯‡y€Xç¼u²´\ïß@› +N<ˆ4AÆäŸ8s¨›Bz$;Çma¡&ôÿr#¿\å ¸E‘a߀@i|«©b»®ó\HËéë"øœú§’$ ›°v¢Ñ3NÔ8dÿABö¿¬ôÂóúܱŠäi†ŒñndÅÿq@²ç‘óNb¤Ù%j;|Ø!J'™J½ÀZɯM½ˆQ .·ó±Òš¡Ô›¸Â0¨7펓2^„J–¸ _à†®&iÚUè:µ”`ëE¸qã}oºTÞ\´>8IxqÜÊëˆ&Cí3"¥!58]B?¬áå±à‹âú}ˆY +[E*¡`3Ù}ÆÁsÙàÏL_ˆB† %Ûmimr"ðéš*ùpº”:Õ ”%”&·˜ + ¹EøÎGÀ¬*‰†õ0«+—¿™È]HzØf Qˆ •Õ…rwõJj³íÙáÐi¦B–ÇVšÚ}·ÞºÏlà*v‚3AêV3ÖÆ”§'Ö÷o®Çk+Zô¼) üÄŸ8¢‚±/è¸PÄ»þ ëÑË̾¼(@`KH£÷:¼•ûFW˜)æv¯nü zŠ½<Ž]_#†%Eˆª=áËS ‚”’úp#Ê= ÎK=Í$À$A Ý³©‹y —ù¤Ÿn®-sT@êê¸K•ƒ" sè®!徺GûÜ¿²JÉ—\Ìâëó ë(Ïm‘²zöã¨96‚­0 jbr&sY‚9qò%} +ì+ §²jƒíÄ+‹€ ´Þ©¿½Ê>VœðÊg÷PÂYï?…ø…ìÎgêïÛî¶ê£LÄü"ó¿O{¯ªº¯_×Rºê‹D(ežXºRö¨Äh4*¤Î­çºŸ…MüÑ~½Öj{%¿%'-÷Ã2x½×ñ¬â‘úœê€¾»¢œ|ÂMs]¶’‡UÜòm9†c{z7×8ø_tŸa¬0ËP¡öj7LÑPß•Kîë½ÃƒÌÆ"dì)¨Ñ´‚ˆ‘Ã"h ¨ÁZÇèžC‰fšûíÖ:LHàç*ú}8¸9òjå*˜[‡æúš–ŸÊ +Ѩí×â"‘Z)Skðv†Ocr¦d)ôùϼÖøz̾Ñá‡ïºg‹BÍ°­CƒÓ;“6£ ¥ÝúÞ¯I¤]e/[•w6…«·¹E(νäb›7x1 &+–Òdåmûiù9zT(ß"Ã*:»Zц(’>§J³ÞDmß³µ}j°Gc'Šæ@;Æ8ãRu U-dÆ K£Ýƒdl;Ç…{@’89ÄfÆSHwl"‰…1‡õNºâ2Ä´‘ã*'؇UNY ×ÝGQVù8qCõHÊBªs©ø±K# +ÉqjŸ™vüè°¢K"®´žKŒ——o¥Ëv©Åð\*N.«Ýæ0W!æ·E+ˆ:irøþmKÄ—a§x´K)´01>qò9¬PÍ_M2È_MúLÖÃ=­üŠQqsQÙ`9­RK™_^Ãr[2EgƒÄù¢Ù£X€öM «[•‚l"ÛEÉDç¹ÝŒ¦Ú× m/ì;gÌñ`8ÅWÄ£)K”Ò ž¤%tQ¨¢£ìÆGö»’.»´»ÝHÎÚ¿nò-t€‘¨â +¼˜ÓzÌ\Ù4 ½£·1^ãÁ­> endobj -5724 0 obj << -/D [5722 0 R /XYZ 85.039 781.388 null] ->> endobj -1574 0 obj << -/D [5722 0 R /XYZ 85.039 761.463 null] ->> endobj -5725 0 obj << -/D [5722 0 R /XYZ 85.039 736.114 null] ->> endobj -1578 0 obj << -/D [5722 0 R /XYZ 85.039 668.118 null] ->> endobj -5726 0 obj << -/D [5722 0 R /XYZ 85.039 633.372 null] +/Parent 5973 0 R >> endobj -1582 0 obj << -/D [5722 0 R /XYZ 85.039 444.292 null] ->> endobj -5727 0 obj << -/D [5722 0 R /XYZ 85.039 407.425 null] ->> endobj -1586 0 obj << -/D [5722 0 R /XYZ 85.039 310.462 null] ->> endobj -5728 0 obj << -/D [5722 0 R /XYZ 85.039 276.323 null] ->> endobj -1590 0 obj << -/D [5722 0 R /XYZ 85.039 139.318 null] ->> endobj -5729 0 obj << -/D [5722 0 R /XYZ 85.039 104.572 null] ->> endobj -5721 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> -/ProcSet [ /PDF /Text ] +6018 0 obj << +/D [6016 0 R /XYZ 85.039 781.388 null] >> endobj -5732 0 obj << -/Length 3028 -/Filter /FlateDecode ->> -stream -xÚ¥ÛrÛ¸õÝ_áñt&Ԍż³}Ê®³YojW•îv²y EÊæš"U’Š×ýúž@È¢”‡NÆ#àà炃scÔ¹ÿÔy¹^'©rƒ4=_mμóXùp¦c.(s ç‡åÙÛŸ¢ø\ynæeçËõxNä†Qp¾,¾8?þün±|ÿi6‚ÀQ™;›'Iêüøy1SÎCŸ®o—×·pP9Ÿ¸üO³4p–Œt};.¿»ùáÏ×›}]þrö~i85<W²ùŸ³/_½óDúåÌsƒ,=†±ç*XÞœŸn2¯ÏîÎþiŽâµðœwMi% -R7JƒCµ¨hB-‘çF^Hji›²ÿÝ‹è# A¢äñ}çyæ'N.“>¯ -ÝÏæ/gså¬Aþ¶+/q!t†Ç’1Þ­AÂ9Ÿà)o¬gø··8HpS­º¶o×O¸¯í‡»UWÖVÀŒ»êÚ ›y'G4­`=5È$"=#å¯ô5W¨ÎŒäZ@Bg…ùð{• ÍÜüÂZ@VóûªFfkqÛÜ ‰¸éA‘—8K’*Š,;Ü¢ƒ±0èƒ+&ŽèE©…+x µÝµ^5ê‚ñ µâS@Vâ±]s´îWó‚K3¥iŠ‘SõzÉq-vúj³­5jìt´7ïÛ†·®ÛNXƒ+¢þW°¤4Ý#‡[oîóêê#À꼫ò[µ„+:›¥®Û-ìÜÐMÐ ¼çc5 ±¾"þk%ìÜ.Ç£Ÿ5}Иã#¯Œ\ã­-|D²Ç  ÿm æUë;âÈÉþe#£!]X+ÏȶâЩIFEˆLœ¦=cÁmÖ¿ª~—×<¾Ñ¢jEZUͪÞúúdï  c¾zÜ×­´ #KÀHP”ûÔÆñ):4 Ûx»K¾ë%…† ¥ã†QBäK ‹0ô¤‰Vµ ÉÅ:ÃÎ&!¯¥`œµŽÃ]_ʾF˜ Ëié‹ -%ya„jàu2€ßªdØâéÏ OŸè„&Jc¬ÙÏÈR`ówOÄž4&ÐÇ“\ê·‚xú÷ù‘Ì)ˆÅ•ÈŠM‰³e›l·µ¬â!9²¬™D *‘_<0y+6Š¦×¨le¯/ëÐÏk­mÂŒËØsŸ^êlÑîîëªä9 á‰ãÅ#ZbÜËØ E,`¶í -h¥¯0uŒÕ£\AäüÌWe.g4Æ@Ã/LèQž°¨ Îî4F]æ£7xÅÓEQá^ðÊ®)F×y€ûoêï—S~M2|§ZsþðBmÇY?°Æ›²cx+Èyÿ7c–Âìÿ`ð+^¯`Þ’ß½¸œ ¶Ò§‰CqVˆóÄ+b{á~|Ý;«3ïº^»Grž8H\“ž£ù›…C‰Š«¡„±•¨Ä^â&AJŠ„” eaæÜ•Åb’û8-ÿ«¹c·¶ngG·à¤)e|E ÏMÝæÅ1 ¼ÐÍÂïH0âMµ¢8sÓ ! 0· -ÓDÜ÷m!¤Û¼‡ -€Ãœ "l)|¨Œ±²“—€Nt××/¼ò„ -Ûb{*Ê ÆÇÕ³ÇǦ1ä2åÖ¸`€¯êÊDaC¯bo§_î;tšæèv2÷Ò/öbÈ7¨™{rl„fŽÙO–ÒPŒ?eKÕ®E^0œ .8…~ß4omÑñ“A™.˜ÖªmÆ«h@`rD©DL8³ …nµÙ3×äƒÚîI¿‰!'›l›ž÷âû>”[ï¢Ñ|=8©ÈuFÚ€=ÎSܸs“›ÂŽM9ì_!C¶Õ JÁ8u¾g_ðÙ”2ŠÉ%=¼wí¾‘;9Ôø‹|;”psÝðA]™×•d %r ˆÇý¬’+v!]/x´£ö€‡@îzÒg$Ï¥qŽôHÈa6hò8êÊ:J!Dáiôks‡$Rç>ËI#8f -4!uçtSŸUµ&•¡À\s|‘RP¾%'݆…cŸr3T‘qðšÜÐOlǧ¬Ñ¢ÈsV»mŸE¿ÁK¥l;Ñ 6Oðà¥+~æz@Q‰!¥ xÀ—#R„i$ƒ“RX8G_ù®ŸrɹH"iFzBk–o…1pq¨ŒQÌ£ŒÞºɆ -Þ oÐÈ%•]×Y7ÊiÀåq%&iè­ë•d;Q¦K|Át4Ø~ÃïÛä°>áP ª°ºÜ[[éD¨|~|[_I°à ÊE˜ ´<Ó.4T/¾Øçþå+Ó2šÌ;WÅià|*7¥}&ŤD¯„‡ýýÄ•¬Ì2+I— -¶dÂ{íÈvä9s(Þï´­¤ʉ…JÓ–kŸ1óÝ8ÒWXþ™¯¦ÄôðÀ¾ í50X -¨óBjìôÚ¼óA ]ŠþãÀõ|e{ó&ß”’~TRYUCÏj@èz ï5O+¶ícõ“Z¡1 up -ƒÉ á¯Ë²=/n¶úT&Òç÷ºwkî†:b‚RWâÙv£ÔdÒ°ÐWuHú¡F"Q^øD$äDÔ 4_–YÏ'v/+Ÿ±"òW̱†¼sþ‹LæHêsMµ”𘱎áÔ€ -ÆmÇ´¾ã]cïkßáüH ƒKhÓJah%,=æ‚–óœÀn/” -?kþÍ ¾­fJ-hTº©Ó9šbâ…'s4 ‡r´PÙOßSn œFBªð’×ô”»)¼¹S5ÎÅ}g£|7PþÅJ2í~'9]Ûé'$%ipGMŠGëmµºåÝÇŠZù @óè,Œv'Ù=ç¿Sm”¹±ŸVíˆsBµ‚ô]Õž 8ªöÅiÕZO¨öžÒPÓmÚjc3…•ô¬¶FØù¦WRKeÕŠoãŒ;öRóû£:|7òNá³pNèX¾«ãG¿¢8­c‹b%ÝÞžœç°¦áéØÌ•4t05H—/aKOŽx ÷<¾^,d3j{è**•¥ðM¹^Ú™/ØÖ••?è;Õ|K¹í^•î€€—>§\ÌÜùa%cLŽ›S^P×,%®2!ÄùI¡Ós½”kÙŸ­>þ¾½äXø“RòºÐÓÕ=Œš0¡ïÜ./yÑ÷> endobj -5733 0 obj << -/D [5731 0 R /XYZ 85.039 781.388 null] +6019 0 obj << +/D [6016 0 R /XYZ 85.039 741.134 null] >> endobj -1594 0 obj << -/D [5731 0 R /XYZ 85.039 637.099 null] +1618 0 obj << +/D [6016 0 R /XYZ 85.039 565.603 null] >> endobj -5734 0 obj << -/D [5731 0 R /XYZ 85.039 594.146 null] +6020 0 obj << +/D [6016 0 R /XYZ 85.039 528.736 null] >> endobj -1598 0 obj << -/D [5731 0 R /XYZ 85.039 511.197 null] +1622 0 obj << +/D [6016 0 R /XYZ 85.039 432.379 null] >> endobj -5735 0 obj << -/D [5731 0 R /XYZ 85.039 477.057 null] +6021 0 obj << +/D [6016 0 R /XYZ 85.039 397.634 null] >> endobj -1602 0 obj << -/D [5731 0 R /XYZ 85.039 146.508 null] +1626 0 obj << +/D [6016 0 R /XYZ 85.039 247.08 null] >> endobj -5736 0 obj << -/D [5731 0 R /XYZ 85.039 109.641 null] +6022 0 obj << +/D [6016 0 R /XYZ 85.039 212.334 null] >> endobj -5730 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> +6015 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5739 0 obj << -/Length 1779 +6025 0 obj << +/Length 2967 /Filter /FlateDecode >> stream -xÚ¥ko›Hð»…•»¸ -k–Ý5Pé>ô‘»k¥æ|‰£ž”öÃÚ&6 -pÜö×ßÌ΂Á&éK‘Â23;ïæCþø0TÌÑ09a8\lÞp˜¿ÜR¸–ÄmѼœ ƪÉ{,ò¢áìîÀG1©Äp¶¼u^ýýb:»¸¹B‡GläA輺™Ž¸sMÐéÕ›Ëٛ˿ðM;7SDÿs5 -…3#¢7—ô‹w/_Л`ÞèãìíàbÖhÚèZE¨æ§ÁíGo¸“Þ<&¢p¸‡³Ç8 7Г))ì{:¸üÛ°"œÒ­>¯Ô®ï±À÷OÅQ`ʼn#qâDœ7t9è,ú$q/b\LÀÿLªMqültã‘dhÝ@qæE‡qÕ -YMUaÌ.>ƒ“õfärg §4&gCôàøóc§ûAÄd[¢Nô©ižÖç˜êSnF~àÌQô•Ê38ÝQ^Üå;ÔµD¼^Âiiov×àVñ±òÒ‘²WùÓ€[Ú§ˆÇƒaÀ%‹Bil¸]¥ùÝš~Dù&ؘ -‘Á¦9èlE#Š$ù‘SŨpAšcþ ’/#?t ®ìaµÅ È tªŽÙŠnÙËÆèmç²:¹»Ð[º‘éMÜ‘_{Ú^÷ƒ&P·öÀŽd@Ùgñ"7ùµ1$dnGÈ‹3@Ó~ŸôØ®Qêºcðøa¤”£ñʸ¤”•þ‡NžŽKmóbÓÃrŽs4hoê×ǃþX‹¸nWy†©ý¥uK~#Ub¢M“²ëV2ÃeõÈL—œ³Pò¾é‚q†‘Êmࣶ‹|õä -$ˆ)¢1­ß, nôf³‰ dj21V7sSÀö£”Û¼Lqû™N⵸7ULÀüŽžg›—Õõ¢À¸bo+½6†S ºËGÂsìË{Óý/‘j6öïÇÿMÏñ«lÁÓFhNç]ÍGJ&a 2{ß10ä‡Ñ‹ùk ¦¾4fɬâŠÕ:¦ƒÉâÏzQ¥–¤¤}Ä¢·z×ïMk_ņ¯+8ª÷ÈJ!'ê²QϘ‰ˆbe)®Z×Ôn‹ÜX,ÚóD“×Uµ}>ï÷{#²dy±—ù]µ×EÌÖÕ&=VL ð©ò»Šù¿¦9Q§€cN¨3+ªÇ:|î–Âw’’žšÔ;°GêBc¡"ðàê ¸ÚƵ·Í‹ (î²v®K 3ÑÏ‘¾¢>ýÙ dƒÎKÛ¯ ÐçY•^­ `Iì´i(ðÁvšíÕk圔‘ÃÍšŠ·ñð™€ïÍøXæÞS{rk­vxIÕ‚TÓºDm/O²ª.µ×Д›²£ÖÅëʻ֛ùHaŠ›×žò*]°Õ×s€v‘@Nu×_°‰'­AÐ/d ð§e¿”Æ_il÷2x¯rz.i ˜–L %»?JÕ^‘ÝzíÑ.9¢ÜNÎ8ÃOFÚ£6ÀðfK]ÚŒ]ßÙÙIŽþq‘õ >ûšlÝçÇêœú{RÑs_÷±4­·“ÃÀÔV­ëÉZÚ!fln€ÏÉu’„æ-›jºEžW°DAŸ6º™Ã燯wtÂúD€ùh$th2±ohHY’••NÓ§‰Òdge|:f[48?7ñÓ|Šx“?|ƒ¦,{R¨ë‡Ù:.mÑúJk³æBàkŸ#pNû¤]xà,© ,Ð~]ŠˆÜ'sªã„\.®§ÜÄ•&P?—‚Èžê -xùì7­wg˜v²ÙÚŸ1S‰ -ÃIgV±g¬¨SÄ= À&ï®ä¡ñ”ø®â•U/ÙÔÀ ¨ÉL#] §\4ía[a÷òÏÙ¯iãk"3UaK¥$~÷ª^Ò·€U ZFk1‰}f¹Á›¯dO*•–~¾3n5gM ÖÕ…Õ¨ÙRÏû¶´ubZþšÚ×Bgt˜×Ÿø²£Í˜Ö™!& ±Cwê gôVÙÝû®AÐHfwfÄ!±Û ú}W•örÝü&!¬çö Ànà† iœ›`¼+‹q¹ÖM>Œ[Íïh©³'ÌÖIÙúb>Š-«HÑÝËØ~‡ BS—þÉVU=7*[ì§=eY<l™¦-wó£þ•ÙšûK+s³ ‚A¡ˆYO|Ÿù¼Ö÷Uxº ÁÊŠS…ÿ›Ýùendstream +xÚÕZÝ۸߿Â88XkERŸyK“\n¯½ÔÍz‘;$ymÙVW–|’'ýë;_”e[Þ¸—ÁÂäp8$‡3Ãߌ¢FüS£8p=“Œ¢X¹&ŽG‹í7ZÃÈÛ%ÞÈw½0À¡¿Înî~ +‘òÜÄKF³±Ì–W?¿œÎÞ¼OŒ1ŽJÜñ$ŠbçÕãt¬œ¦Nßß¿›Ý¿{‹=ˆÊyœâð?ÞcãÌÆŸg¿Ü¼™õ–ø®\÷›Ÿ½Ñ¶öËçš$ í¹*IFÛ?0nàé77ÿì¤ð˜?âY§›XŽ‰ñÜ8ö»cª`à˜oqÿ…#$‰“–Knä+üoc;Õ^Fël<ñ=Ïi70GÚrʬfžje%ñï'eü_¸ýú5Lû·W•Lø—@]²˜†e¾›ÝþÀ£'ë/Æ%‚cèèÈÙdôóÄãým-khç_p:l .µ¯P/ [#Wƒb³båÜ—QnìGÃ64щkBÕ©WÙwöÕ †:O`]çUU~ò”¿†UaÅ–.×°ó0êYtVÕØxNÍ×uþ%³m8”E•.öªÝ(¹²S¸J©ç á%èÁD‰s@fÜF…¦ØgE2±Is´p†ùx¼ÊYgUSm) ( +æßÁP}ÉáEÙÅ7žÿ„W_¡üCÉ”-I ‹¬@xì,eWmÅ »:Û¥5ß3ÒÉ&Šœ  PÜgkYIÅD!û÷bÍBDW²v»Éú†VÒ-2ÏSÜM,¶R[»"™26–½ÓÀ¦ð–ˆN^…éXÃr9oéGdúqJ²ÛF¦EE=«q<KV.2gC¾sÇÁ1º» +ÕóÔ´i›We#[¨³Žì¾~¢ÉëÇ8ä }p!å¼ÂÅÙ0o™ÒòT`Ïaà9³MÆúÀQ=pw|ß¾gxY¯­'Z³°#yϤ–¼(ì”ßÈ:»ÚÎû‚\í¦sDHÑÜà¾e÷2›M3-p7ó C4žKqu“‹û›(g·³(ïÑ:"ðt"bsßäeÖ4Là +EEFñ;uV¤m&,dÛ@¤H¾;¿jäaÃ'ÓÃOÈða¨Ó¬A*›MŽjŠpAì‚ñ_‹p¾E'N¹ zÆE€SŽÂ(_ìwMº\6[ Í_€.Áêft2aåS QLAЦ:­‡äÈ-F¹oƒÎhÿZ„ƒ@­’ç#ÜŒüî§P÷Fµvc£…7*§ý ú§ 'â"Ï ÂX&ìÑvòÂÚÏùä9ºB¾Û±ISÌTè_hmÜ!{,¸½Ø×u/ŒñmÞ†–{ [¬-¸WXJ1[ވȒ™ÓœÍìŒG¶ä«í¦¢ýÈvZòV´ôIb\¿úÚ:-mÄ^Ùa5û`Þ‹­&¼Œ­@³‘BÄÆÃ^`% qOÃ*ŽÝ\ŽUüyÙ2[¬zl^[@SÌõ—9éHÆ?Ü$X³|Ä Í‚$Ø°hç}Æʤû«oí r9ΗÈDt# 7›N]rÚEœTÑ°²µøM›“è’}ÝQÜÌxõ¡¾Ô¨ÐH4›UÕä-™V¨$Ô@£áHŒ¡hÇ~ž¹-q„a„LS¸ÅvÞÝyËÖIÏIóîY4ñnÓ§.®7Lâû Eá‡ZÞÚ>áC^R'ìåg1½‡¶jbñ1rèç%‡Äóˆà%nÅg!„¿g#ƒVÖ 䉰ø¾‘u->ÅöK s¾oæ›ÒÓÜ´‹š¢uËä>’edŠ7NÔ‰êð\:ÒáaÏRéj°Qf|‡°¹ÌXpQ‰é-™Þ©;ýu×2ùõÅÆ€¬ÁøºE1G|ÙÊ»Ùö¼¯w¿M{wpâº& ]àìÝÅä!­O,o_Ëê$‘ŸôïØwµD|YµCÑ!vƒØZÅM 5‘³Im˜ÖsB5ET.ä#¬Ö@Í|çqiKÒê—„ÔX íÎ|ÏÆ€¼UI7‡[ÈíÚbVgL´BnëItICÇÔ|«èÓ´‰N) z!¢MYVÚÚC3`‡6®§Uÿñ(Óm&À'/å·m¸±íò8è ¥§k:¸k£lɃÜÖ¾Ù“À‹å ¼ˆó‰ãÃbm‡.}…È°QFÊÀ:4/Ò9ŠGVuµå½Îkö =FŠœÈÑcÐ澕Uv©$¥¸ÎZD• é-#!«4§H¥oÃhõ“&ÝÎÓÉGHˆÃŸÝ6­Ýõ¿‡Ì5H\*¹H,W¨°‹Ö¾öíåë@R²³‡IKf­N3©‚Oqøå²êp:Š;§‡Q +{as܃ìe“ +[Ê?t›h礢 ›•=Q_'½ü \½âßtI^ò¶´bUÍ‹(©ÂÀ5ž“*T ÀbI_ `IðŠè\nàúAÀÏ…âP_æ >½où$¤:T†@Ǫnm2a¨{R-¦8>XåZZébQÙØ‹ø¾ÈÐudÄ“ÿ7eQîT–'Èõ$Þ4·¢/›¢uc8Dgk…w>— pÕ7pÖ)âø/jŒÿÕ¨®ªQwÛ,)ç¡ÚÌdÿ“X,jÏØž!E}Ê÷/>ؾŸNerÛrúOo]&Kw‰Ô©­+‚4$«šOø9¨jN{™=2 ÕO8–Û, §€&yôûBO×.¹EÀ]ÏûY€ Ê=}¿qùP’tªÔ§ª‚Q‚ èI?v.2ý Áj(dò¸Õvhÿ†* ".ñ aà*3á3è¦6#õÀ¾r(â*Aì¯bçwÔlµ¬‘7À‹“4£â^™u@zTèP‘³ÎZntˆ„wjº,¨{É‘w—Ö-‹!KÊ9†VÑéKÄ$<’L8V“¯n­Ù£=ñ¨&;ý@µÄÞÅ- ðb´ç$ñsFõ뎃›¦>ƒ!#F'¾VÕ&?ùÞòŒ–òÌ ¨X©åYƲÌïãDS5œz³qÆ¢*W馕”€r¥„”ˆMç5›àOÔl¦l…• ‰SÓÛUJ ý2ƒ‹=7ôN“‡ç3·0tm‘ò-ÂÛžµàŠÝ3BRœtaÛ\må•Z,t.žÒŠ?ÞpÉMZ¾Ü»IWdJ›Þ:›“„ªdÅðb}Ý›Nb8þ3±^¸ñþí3󵃪;Aȸ6’9_#„$J©Ó×çºà 6ñ $Ú"W]-íi8H|§™1óWЙÊü5E®ÐNÛ‚G].KŸV(Ü?µ¬*qì@P^‹– -ßÍ°cÓØM?‰“릯‚àyÓç¸ìGžÓ}8atmky©Ô‘eY¤yÔ s¾d¤[¤<%Æ<%@Ô#’Wèp p¸¨i ©^˘5'3tŠMÛî^ÜÝÑ­êõ]S­ÚVÛ6í¶8_‰ŠIü½V%¯³x°¿ÓzbßHEßhÊ5,Ô‘¯HTõ-ô;ËÛpŽUuX¯FÛ«aó´?{+‹BØú O`FùEf{ eM— ÜGWxA¢âÇkë_YÈpMåâ«U¯¾2Ñ+8ƒ)3 Uq´­âÀxï[DÊDe- Q>Žö}ðAýD¥: >ä¸3yÞ5$tü#êeÃ(“»6Îò,¸uŸÑ´ΘMœPÕ;Ϙ-l³ }Ãu^Ï£ƒ¨WxƒÀÑô?fNimSd8ŠmR •ñvüJÝÚ"ÿ +`¢OAG姅ýÔ!ÉFº*ÌpJ{´ÿ~#3vDÕq§Îg#˜ŽÔ…w÷2»Áÿquàendstream endobj -5738 0 obj << +6024 0 obj << /Type /Page -/Contents 5739 0 R -/Resources 5737 0 R +/Contents 6025 0 R +/Resources 6023 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5701 0 R -/Annots [ 5744 0 R ] +/Parent 6033 0 R +/Annots [ 6030 0 R 6032 0 R ] >> endobj -5744 0 obj << +6030 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [459.436 164.389 525.64 176.078] +/Subtype /Link +/A << /S /GoTo /D (cupsadd-ex) >> +>> endobj +6032 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [345.558 341.001 536.549 352.994] +/Rect [345.558 87.442 536.549 99.435] /Subtype/Link/A<> >> endobj -5740 0 obj << -/D [5738 0 R /XYZ 85.039 781.388 null] +6026 0 obj << +/D [6024 0 R /XYZ 85.039 781.388 null] >> endobj -5741 0 obj << -/D [5738 0 R /XYZ 279.478 764.647 null] +1630 0 obj << +/D [6024 0 R /XYZ 85.039 718.657 null] >> endobj -5742 0 obj << -/D [5738 0 R /XYZ 85.039 411.841 null] +6027 0 obj << +/D [6024 0 R /XYZ 85.039 675.703 null] >> endobj -1606 0 obj << -/D [5738 0 R /XYZ 85.039 389.525 null] +1634 0 obj << +/D [6024 0 R /XYZ 85.039 593.017 null] >> endobj -5743 0 obj << -/D [5738 0 R /XYZ 85.039 368.531 null] +6028 0 obj << +/D [6024 0 R /XYZ 85.039 558.877 null] >> endobj -5737 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R /F58 3360 0 R >> +1638 0 obj << +/D [6024 0 R /XYZ 85.039 229.147 null] +>> endobj +6029 0 obj << +/D [6024 0 R /XYZ 85.039 192.28 null] +>> endobj +1642 0 obj << +/D [6024 0 R /XYZ 85.039 150.382 null] +>> endobj +6031 0 obj << +/D [6024 0 R /XYZ 85.039 114.972 null] +>> endobj +6023 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R /F58 3380 0 R /F81 5323 0 R /F59 3455 0 R /F35 3036 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5747 0 obj << -/Length 2029 +6037 0 obj << +/Length 1296 /Filter /FlateDecode >> stream -xÚ¥X[sÛ6~÷¯àd–š‰ €$xÉ[Z'©ÛÆume³3Ù<Ð$mq–"T’²Çûë÷\Šºy;Ýd‚ÀÁ¹~çB)OÂ_å¥ZÈ0ó’T‰0M½b}!½G8ùt¡,ÅÜ’Ì'4?,/uì))2™yˇ-"zËò›ÿãOïo–ngó0 }•‰Ù¥ÖDüeSæÃHúP£Ú¸ÚTݺîûÚ´ýÁ=+åvÛ¶ã½é‡¹S•v -³^ƒ#Î\¶*‚dÓ2=ºÕÞÛ4ÕP‰Wp8˜GQì÷zº«Áé›·4ca¶MÉ[ùv0kX€ÜÞÚl1®Ìd@jË°$^O³ å(wLþ/©¢†©J@ÒºE*Œ>R N¥rîù®ò£:¹Û"gG·@Ìt5 íú…Õ6ë®"çÇÁL÷2K#_œ©QˆD¦¢ (ÌR}²  D ùžeC—$°á•¥Þç2ÖÒtŠ“]ш#O)‘¡E”‡‘½ã Lätÿ:S*ñó®E àLuWT²õþ;2aÿ“5Y°3Œ6Wëл4 «7QײOø’ºjZtT-Ú‹¢HÄ2 }/·Û8–ŠXgs|ÜoßBˆ“-‰ll«v`*èw¸JáF¼å(ö"g‹5‰D­ìîPñå”Ø:DãýŽ·ÍÕ1¦êv0çá b‹=vˆÕP¥>¦ÿ¨jÉ{æžiùÐw‹~÷3¼O6cy ¾„°6Ì䥚Y6ÿæMVÅ ¢Pn+Ì°ª{ðwE>I3¼ð²X›'P2HcvZjç »Ö2à²À¾Â]” ånƤ­Áu¡@N‘…€–Ôv(äx9mzXaI‡Ç=9I·Þ‰Ê1Ò®5íaL"•¡kN…‹J½@YÅÚ@©åòÇBJµç‹-F„ªµ*r‡]£pÑÕ«—›É–G…%Ê´PQìM²ø¯—¬:J&Þ|œ5þz•Ú«/Áë3Ii‘DÁaß-6üt`e *ÇáäFª?1ºÔ=wŠ¶zæ'<ÿ†`N 1ܹØH3í^‹à­z6¶¢bÛ¥ÅD\Ÿ»'¨åxú2§è#”j#QBur­†€‘MŘÅø,P2˜ýXÑD›ù×Æ ShÜîâPHÉÞl»ñ–%Ðæ¸~I¯1UðÜte<¡YeUò&æä MˆÙ1À”Ú?wUÞ[£à][^ wôº1K¤_LMeÌR@"BQaK[>.ìåÊÆHcÕyVXéepZÀиáÕ¼lR!öæÔ}—|FC‹gTƒc¸3ˆýK“]WOºÕPABwòKM!;ÆœÒZÄ‘«è½ËË_€–ËE$SšPa‘Œ«ÇÈÙƒgê¶(`ÅW>£3GH2L-”xþºßâ€kDï°¥ÙÅðNŒA‹S²Ì—ª•Suꓲšúž¦!|†~nq‰ëÖ ¸|8wêÜ ’ýÐÕ÷Ô0íuŠ ]?¯L³cŒÑ£û|p‡¢>Ó6'p»°UA¼»[U?bju•Ý½³Ž -¨—%£!Ф1”‰ÿ“ϪéØ© =óˆKF¨Ï Õz,ÔÉnÒl GF ëÝ´‹DoÊ:`ø†ßê–)0YÇ6ÀGÓœ…WÛzÕ8#2þtóë[ÇŒwrš–_8ïvÎ{áSH¬ÓçühêÂV³qö9W(Û 8üázøY–·v&Óœ˜´x®ÝçÞXèÊ}SíÛ”(vóÁt¼ *³¦1fµs†S¸y87›*aœ¼ú»Ã„†šÎã¬l‰`8:ãþ¢2è§8XD,­¥[æ±Å<þ dó@…+Nü²¦Ò Âª«hƘè’?ª¨!ÝÇš>jû3æ¨4A¾j΄†gé½YéDD:Ú}áéÀMÅárôiFžÖ¡$$™öï_éi¼äêm:»éЉäoLSNãõ†I¾ÖNHË9Ó‹,]`ü𖩸˜ðÚ5Ó# _©í–\žR.©ý1‚¯—‹@J¹øç ªps=iåïܽ Æ"ú2:P1z½|Ë\¥]RµÇ…“àê^ ˜b*oF_U¥KLÖwgžÆ"QÙ«ñÞ‘P¸#µ7Ö*ÁHhi¸S©äP˜’±H¡¾"Í‘ŠÛï‰*¡ -¦âx¦ã¤Ó&jøº ^µp¤8o “ü/û΋ÍÛ—uÒº,4®Ä0?uXìOn'l ¥NúþqËù¿~M=Spž Ž`dWNT?ÐÙ¡¾îWÇ#…ÿ 2v)’endstream +xÚ¥WÝ“›6÷_Á4}À™"#2Ó‡4½æc¦©{ç<]îg3áÃlçò×wW+|Ø–s×ÉxÆHìjwõÛŸv·\øq+ +˜+bKFœ‰(²ÒjâZ+¼p­áZ>sÃE,&³¿‚Ðâ.‹ÝØZÜ+•Evk¿y÷z¾¸ºž:B›ÇlêHÙo>ܾͧ¡·óë÷ï?¾Å™/¹ýiŽâ®§‘°ӻŇÉÕbäÖñ™ +ôûur{çZ„öaâ2GÖÆ.ãqlU?,ð…ž—“›É¿+$ó-ZeØ3h8žË¤ç»“±Ôîĉ;qæ‚æ,Ž…Éç!ãn`9’2kœ>Ì<0À|õ Kª©Ãí ŒÊœÀÀÅ«S%d4„=]¶ÜUSOÚKVS4ßÔ0º§ÌÝ7- Ò-zíPžd0Êô*’n²U~ ÷c8º¦mR!‡Œãâþ#ã"CÀ·«²Y&åzR¸cVb%*ˆÎ ¼ÀÞ´EÝçmG³ßéñw†EJµ¨WGª°á#ÝàQ5M6¤S'U~q‘'™ ÄSÁ˜BN›ªÊëþÈÎ벤Á|Ø…!ê¤_-ší’vÖmš¦œuIµL k–m³ïòdY‡]7†n—e‘šÐgeìáѲË{¤  +ÌXÑ;¤MNüphX+*‘x§Èô0õ"»ÙjâµÃª¯0Øm®Ž¦c .DzÚæƵùò ìÛ¢›1cÎTO¬Ž“·¤‘d 2^Ó6M‘1´Ãˆv(|8ÚB„_ Pʤ–Ýß»Orn>ô϶Ø=—vyŸáfÙÅUˆgDìrÚŒ¹hóáÈ7uùðÌ4ë0Ê¢ëé0'€úAir=Æ}in”Ž=ÿ\ǾOˆCù¦z1¾ pûDçëÛîûýc rT: Á/f ÄVßM•ç ÊŠºë(:gÉé@9Èë.ÿ±!ÌFõ¤NÕìžÐé†RsŒ€ã  +©´ë\õÈ¥/B{`ÝØáŸ~Í 'yMSl`IŠ]ëË4U«‚Õ +{_ ­Q ž›W7sWJ·Oh¶96Ó’r×Ü÷è}²¤¬Hû +†ó¿á‘"N›;J¯1 ÃH'ùå8%'0!*@RgS$‹ÁÖÜ—#ÜO bµÉÏ.÷Ë¡èbiŽ=Ø ^7bawEµQWx©À_š¸¤ Ò¶@Àûî7Ø´+íýº  ³&m=õbäoG†{Ð5ÂâyPÑüð‹‘P9y$\Dƒ9àäÿÃZ¡!¨eS]pž—ùp¶ÄP¯Á¢ª+à¤G`fœد“´„CATxDüSÆ­!éÛi‚ýPŠÆª]âýÔ¸LZcF+–øþÆŸ¹ðAåšõ: + @ÄA(áÖ=Î^MzEOÏÚNG.‡ãႈäôÐ+iÒ˜ˆ»tW̶ÜRÖÀ¨™ÆI‹O ÁÐMf† I(“Á`O•ïé*ôE"= îE–¸«,×Zýú€_N*ŠùTS^™N•ö:®A¦ZÜïN+±¦™¡Úeí®eÙqቷńl]nžS$ —Ïc¾hüÌmàÄ*w#zÃÃ:Ç *bv|Ö Yª Tà&ÝÍ„(F:aÝ¢õÉ÷Ÿxæ^«qø¹¯C‡ü€éÐpHžôÎ>jÂó/¬ÿqØÁsendstream endobj -5746 0 obj << +6036 0 obj << /Type /Page -/Contents 5747 0 R -/Resources 5745 0 R +/Contents 6037 0 R +/Resources 6035 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5750 0 R +/Parent 6033 0 R >> endobj -5748 0 obj << -/D [5746 0 R /XYZ 85.039 781.388 null] +6038 0 obj << +/D [6036 0 R /XYZ 85.039 781.388 null] >> endobj -1610 0 obj << -/D [5746 0 R /XYZ 85.039 216.367 null] +6034 0 obj << +/D [6036 0 R /XYZ 85.039 758.673 null] >> endobj -5749 0 obj << -/D [5746 0 R /XYZ 85.039 182.227 null] +6039 0 obj << +/D [6036 0 R /XYZ 272.508 764.647 null] >> endobj -5745 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F41 2994 0 R >> -/XObject << /Im3 4353 0 R >> +6035 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F18 4228 0 R /F81 5323 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5753 0 obj << -/Length 2208 +6042 0 obj << +/Length 2086 /Filter /FlateDecode >> stream -xÚ¥YYoÛH~÷¯àÃKQ»žûæÄvƃØÖØÊΙ<ÈeC‹EÅ1æÏOM²uZ böQ]Õ_Uw-åIø§¼$Ò¤^œ(a’Ä›?ŸHïf>ž(K1¶$c‡æýôäô2Œ<%E*Soºìø„"7]|ñ?üz6™^ÜÆÆ_¥b4ŽãÄÿðy2Rþ=Nî®n¦W7±À ò?Opúön”ÊDW7ÝôÙõû3î!G_§¿\LÛ¶{€]¥¸Ío'_¾Jo~;‘¤‰÷ -m)L?ŸÀ>EÛ/NîO~oYñ\àñªCZi(ÆFŠ$ †5JÊ Õ\ Í)©D סêþ’*ÞE§d$’0ñf{š=‰*t%*-ŒÒ[ç›—õ& ‹E ”îu,tl£Lb"<[”#˜ð3ø«¿ê*ÿ>Ò‰ŸUkÓþ¬²“3þ> -#–³dlg–Ð.+&¯Ÿ2n”Å"³cä+ X”ÈàuÍkÒð4MN¯/°§ü™}%Ñ£1ð.¬øõ_`†ÛdfHi n¦§ZJyú'ŽM²%¢aSÖJ‘g+\U¯‘ŽpþùâɤÁ¬æY.ñ«ÑvA‘­y0·_ŸÃŒ¡VУóffF°]³„ÿkÝ juV/Kœ}&t¢ö“)CÙU(rOÃwÌ#MlcŠ¢Æ5‹B*²&6Ö”õBÖ/«šv²`ÐÈöí¿=72 -R%zðŽ84ýw¤!:vG†¶wdWâÁ;âJ<;¿D˜·7Ó{Š¸¾¼îëµø‡f¯%:Šw@`‡wGâa¼ŽÄ³óÛ÷ä­qŸ»‘RÊÿ_è0ן„ƒ š~Ð Ñ1ÐC[л‚v%º ý4é% ãa°ÍXKtì€ÀìŽÄÃ`‰çôrÂÑöN Ä=9ïÃ(¡äÍfKtó€ÀóŽÄ؉Wno>]½g®üóOŸúðª2ƒa¸-ÉZ¦9 -¶_Z‡u[Üa¨¸ fL×·7̃!ýPh¸™Úˆ€r78ü9±U%(n0>tÂ’‡ „TÑ žš~E7DÇ4=$°Uõ®Äƒºv%v~#$gÙ{¬‰T »‡f¯%:Šw@`‡wGâa¼ŽÄïça¼&MErä94ýx¢cx‡¶xw%ÄëJtñöÇ'"fot¤øP˜{‡‹ÌA1 û‹Z%·òm>­z5º?ÙX!Ò0D°©`4@¶íM 8kJnwqZjh¤t=¼ož2HSÃ$N›vß¡¢Ó«gå—°MÏÙ©e;vø²Y×,r±8ôŒŠ 'SìÍ!ëúr:õøª É q­W5ú¬ü»Í§‰¤ÍØq~Óèçp¢eEë=·l¹“m-µ%,É‹V[ëÝÌ9á*¤ª™Š†ýªü1V&C]‚e ¸ê+)JÄ¡óÂ2l1°ÎV5ƒ‡oࣿV’-ød]4L»ªÀ~¹¢2EFþkŽµ.} =Z‚üqÅeSÜI[0ÝŒB“qµŸqÃ÷ ±(8ôV¶³H³¶Ü©ÊŠâÀ¿‚æ’'ßo¹ŽL-ølÉ&þ?<Ü):¯ òW)l/˜¨¨‹6^—«­õ¤¬’Û´œs5¦üq¹*Þ€Û>RŠCá;¶üs‰ãàHØ‚T¬Rë G“m•ááF“ÔÙ9²8d,ªÊ¤Pv àðtu2’Ω4ÎÛÒKYGÎ~ÛÂóŒ2‚›³æÐN'ŽR˜{cºùŒm)v}Gi¶ -"ÏqG?áÜЃ*{c\—þ´ÇÕRÄG¢”™ªÖ9ié¸QK¤Rȯ~S)l“¯ì†pœæß6y•¯AQQdmÚb{Ô Û&ÏIÍìipþ2§×“uOàQi¡y89whöc^Ã'2í“oN;N¥=©Úv%зg£}Š©˜¾{ IíµÈhúÙÕ%·xmVÍYýÁ©dFGÒÉâÙ.ðI$šoŠšûËÒÊ£ç8‹:åû¥¿Ò^K¼1*Â'K€¯ûWzU"ë8éyÁ2qê£ÿ@ -Ö 4¶t£ÂöÃ:¯í¾K!!m„rîdž*Êò¦’hJ·I‚½Þ@ÈJ,–ãìG]Íæ5³±üÉ'Ÿ’2P ?Šá»Ò˜$bd[׳¢°‹Fž­JVf?ð-5ô”…_ - 5·³½aO“5ñ[”Dæä|‰,%Uøzf¤?A[”³‡bdWšÎÁãòÖüX?¸|É–HÎ{¸'„4/6 ':5,fu{‰tÕ'‹Âž‹}%Þu¬ý -Ë™¶‘ñ`ÂrJK„A¾²àÙ’¨3ˆeL 1 2å®S¶ïy8U¢šÏPcßI÷0ÇÁsoô`»½Íý ɯž°™¿d(›ðÍíšÙ*«òù~T˜yÖõý¼Ê_854:e¸9Ý6³°V8—tg  K‹ëWüåûkºÇUzW5þ#t‡ÙÓuU¦tÎp¶xÇÓë6ÖW–q{_ ýÑêWuj„4µjÿ,¼°û£]ò ÖGᕪ?§cÌ€r'îë$n÷ ã¨ÇØÊÿϚ翸R~ùÊ,·a!ÙS‰†^ØEŒt¥ÚgyjŠ»©%Ïgfð -WÒr[JǬÞ‡OÌûjz… ŽJyÛÏÈ3ÉÎÈ<¿$ùlàÆJ”îÐ <ÿ0dO`{*Îx„\{YukY .™Þ°×fÃóÖÎ/¨äœÏ]ìÏxCå¦9Àv ôDökéí9Mü¸Z›ƒÃû -à¡yŽ¯òÖÆ:í¥0xëÚô…NSO )…>˜ˆÀ–øS?mu F$¦§µZ5{A„:Úû½-4‰³¿át_hEendstream +xÚÍX[sÛ¶~ׯМóBÍ„A€·¾µq’¦i\×VN:“æi‹s(B%)kÜ_ß½%Ñs2§/µÇ&¸À.»ß^@9àWÎÓH*›'©*Mçëí,˜?ÂÌ»™´+‚¹AáÔ«ÙòmÏe ² ›¯hɪøâ½þñû›Õ›Û…¯”òd&~’¤ÞëO7 éÝ1õæöýõêýõ;|Ó@”Þ§œþåv‘*oµøºúiöf5ÚÖ×BÇ +÷ýcöåk0/@µŸfPY:?À82ËæÛ™Ž”ˆ´²ïõìnöë …çôœ¹&N绾†í”Ž©¢‰c¶Æôÿ^øQyb¹Þï:¿Ë·÷¹¨š®ÏëÏ€ŠK™Ç?_ÇÑß3GÕ<²¸Î<ô‡¼-aõ„”O»"U]òhW¶Ûªë*ÓtÓŒ·û¦øv¦ë}§*QÖf»Í›âf«#ìl^_uß®.û’¸–oå©­|­D¬’±Ú€ª*Ð^·n«¸»·¯³‡·ºÀWååøÒ›í—ì/k‚¢Ò{æ5»ý‘½ßÀØJ.`ØVO‹0õÊ–—þH]—ÏWÍ"Ì@8Oõ )}âà0EFÖÍË}×.» ¸ƒœ¼,@|ÙvˉÓJˆ$-cš·%éî“E}Æ"Õɉa{Ó>/Rí‰sÐK‰$ÄűY{\&  ¡›Eß'R ©ådœ ãƒRÁ‹bˆ)1<²«O¥DCæ`É4Ɇ8Šõ\J‘!ìqôy!eâåmƒ†B|^ +Ç(fþ¨œI!Ž¿£1){d"ÂòýVͯ ¨5?j¦2Bâ‹œj2ñ«=À* LÆ^Î{Dßã+xÑ©g»¨e\éÃřן`|sÇÌmY—ygyŽ¥×ñì À™ƒ$âPlê…àXsŠ0MQ#@+ŠoY<ï]‘†fb»X +ãW…¡HÕ)~94΢b¬Rª©ª°0Ì8eŽ)Ϲ]SƒHщâi·yÄ”L€À§çw†c?–Ô$fÞµq(ú +ÇØ—=Igö-bI™C°WX™&H½]Kh|ª +'­à ŒPj)ðü´ †¨Ç¤ ØÎ¥µ´íQ‰Ù +¦úMÞ[¢}nr;uOñÙ-cQ²ÁkÈ#>¬6‡ +õ£m7%‚©d4š²ÅÇ¡Oj ö¸V{W-’Ÿ†¶–\I¬F€”ù}Ûó tïW8? -çlIrœ›p“úhY=œE{QÜ€Ô/(®¤HÃc#>UTé憡÷·q_PŒ3õЊÐaxˆ4=/%Ó"þvœñLk'üÁÔcpâìçÊA–“†Ý$‹–YºüèÓe@eMƒõ’6°iù>Sí<z×To–aËßn&»®«’¡®çpƒ  ¡K5óç„Žw½zÅXC¡—€†]Ø­Åæ„}ÊÂA#ð» ÇB¿œ¨IÏÊ.mšïaäYè®.= èJÎÅFöö1!§Æ2'ÑÂÍbqw.m&ÊÚ.ûçéMx~j1H þˆô²úé?Oý=‹(†ÈQc]zÊ]ë÷…r¦‹×ö$†máÆIº¤=-0¿Wu~o; œÁÊhZÂ6A@ü–CàžÆÄ(jíâÜRÇn¨ÏŒä~b6åÊ?ÄíTÌFg!Ûñ…‡ÚòÕfo¥½qA +G_«€XÙ'Õ$ÊîL¸¦<¥`ŠÑâ73\?ÔSäu9œo¡å˜iW瘚 (m»oÍ*Yd³J–ÚüÑØ$ññ Á&íu{¼ïqƒaZÛF ù‡s +P¿{å™|)HáSãßû"¬7dÿ(ëetƒB_èF¡æü *®†_endstream endobj -5752 0 obj << +6041 0 obj << /Type /Page -/Contents 5753 0 R -/Resources 5751 0 R +/Contents 6042 0 R +/Resources 6040 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5750 0 R +/Parent 6033 0 R >> endobj -5754 0 obj << -/D [5752 0 R /XYZ 85.039 781.388 null] +6043 0 obj << +/D [6041 0 R /XYZ 85.039 781.388 null] >> endobj -1614 0 obj << -/D [5752 0 R /XYZ 85.039 220.091 null] +1646 0 obj << +/D [6041 0 R /XYZ 85.039 305.234 null] >> endobj -5755 0 obj << -/D [5752 0 R /XYZ 85.039 187.873 null] +6044 0 obj << +/D [6041 0 R /XYZ 85.039 271.094 null] >> endobj -5751 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R >> -/XObject << /Im1 4096 0 R >> +6040 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F41 3054 0 R >> +/XObject << /Im3 4496 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5758 0 obj << -/Length 2488 +6047 0 obj << +/Length 2345 /Filter /FlateDecode >> stream -xÚ¥Yëoã6ÿž¿Â8ˆiQ$õh?m7¹½ج/ñ"-¶ûA±åXXYr%yÝô¯¿y’üH®¸"HÄÇp8œÇo†Œùð#G±¾JFQ,…ŠãÑbsážaæÃ…´K2Ðü4¿˜þË„#é‹ÄOFóUÏÇmÔh¾üâ½ÿ÷»Ùüæ~ Qx`¥Â’Ø·!“@LX ××!€Ñ†à Y>“·L‡ÛÁHâ¡žC@vu;]W{\Qäð 7‰ " F%A:­Ž0ø·¤×`_vÕÜ@_®rBÀ¸—aÿ‚Ž°DŠ®’ÀIÄ.MçÂ-YIɃ€µdˆ°‹"û°‹9X"D…QA’ ýÀû„Ì.Þa%™„Õ—U.½+ Hï·C£#õ„£!B¶e€ƒ~J±õÂ%Aeø0ô„¸i§i7T9vO‘?¯ þP´’|Ïî”Ù9(Ä6m§cìÂwG:é<&°aðgò¨²4eû>ßrÃÚ‚ÚMƺY´gÜ+BC*fcÞü±%óט)"Ù{âŒ'@düÈ®]0mXæaÒVFò#xƒAu{ŸV<»¨vµ³¤]à,gÃ-*:P\™eKvÊHðEm¥è9¤£?ÕN[äYµ[4LQе¡ Á‘­;µYÞ˜dŽvb’ÂîÁðæ g ¸Ë?"Žh/¹³ñ6i^C·ÊÚÝö-gù²xÁ?¾?Ð2­\óá®0dÞ¼]`q™hoN†“-°}XЈË)ÐÞ‡ æå¢@Û-1jðçŸØî*X¤< -!BtÚðXj¿{Ü+ÃBb8šžQÀo¾ñ‹¼²éâf$×À<Ör™L¾ï¦z"lÏxhI°74 †,#‘¦‹@|¤`¶f 3MâéǦ^yæ²4öWé&ûÆÚ¯†ÒTé7 ÃÍ«u² |sX'G¶N~Ÿ~ÏÒ¶áJ˜\8$‡W|4è`a\•lpàe†aòŠÄv§7%îi^-e’Â%I|ëA`ìG„ÚA®¢J‚@‘¥v%“: áøI6`‚~ËÕ=¡¥å’;®Ždd²ˆŽ3N ;ææù^ÑÉ´t‚Xáé 'ÛFP2غ=za Y`xºkêi³†àVNO¡ÄmŠž~u&6†š8D¸WÎLH‡Yº´r’tå Σ²vV[}Ú©xqñÝZÿ´<{xJž:í[xb2Tþž’%Ìšé*,¨[’¶dÓ¢Óm/s§²¬%UM›Ó“xn¦C-qpÑ•¨øP©s¥¡hæO³cU,éBÄm—D2¦ {Æ™2ÍháÃçÂÇ[Xu‡«´&oªX@ÃïÄ:“–¥P¾ËÊ*ø%Ffá^ƒÊXʧš -ºZ­oÑg~ÀMb¬¹"‚s,í-IÛ@Ê­"ž\=‡¯Ñ#Ë’jÄgž¾\ìÐ,NΉ…Ž‹á&].›Î8—Œ–hø.Ë[TM‹¦âAµÞîqä´³áºM{¼­å­PÌSU$”2¡+G<°p Ô’ -#‚“SÚXѤ£2Dí½†àZce"ÿÂÊħ söa]Ô‡Œ1ó,Zån1¹>âÓ!0ØMЂCàPrFâ -Ar(Í7¤9`ãÑñ,‘Š¡Ã~dë$QL2h“Ðýah`z»‘rt]x£„–ïdÀ˜sÄA‰#3Ò¾Ö¡z·…Šf“:ÿ„N™¹{–JìóŒÒAËíšït•íòÉÒqí†à½u›6Í~À’Ë7¦zl\ïÐ…Ê¢‚Üs»IYÛù!0Þ[v/tá½÷ƒcC*á%?ÚÊüKku„ô§~ÌñêÛ‚¯Ùö÷ÏEžTZ"ÑfËçGÙë6µWD\—¯˜¤¿&A§YW»bÉm—j±í¶M¼ýº"…@s‹`o¼èª±]m§é1a vÔ¼–>•/‚äÜe~Yž¿õ‹Î)4Ô*9ï&D ,x~Pܱ¼Ê5«Sÿ ýS/endstream +xÚÕY[oÛ¸~ϯ0X ¨iQuÙ·4·Í¢q|çlm[Ž…•-WRê8?þÌ…ºØVºÅÙ‡mQ "9ÃáÌp曡#ü“ƒP GEƒ ”B…á`¶:qO@¹:‘†ÃxÂñ5’ÞNOF—ÚHGDN4˜.ˆe:ÿ`ýz:™^ÜÙC¥”%#aƒ ´Î&¶´îyurw=ž^¯pæÁ¢´&H¾½³CeMíOÓßN.¦c‡žð|…ç~>ùðÉÌAµßN¡¢p°…±#d V'žVB{Ê̳“û“7R˜æ xWuÚc¨†^ô…òAFãOö¸à£#ƒC#´ð´æ‡B‘Ô•)uÌÓóKÛ ­Ûñô^€«n.oOºpE_§ßÄRýÛ·ž8‡Ï-¥´þóu¢ï׆_ßM~(ÿŸ_€Þ—N°;W “óÊý×g·ãw×oí¡´0Îß½û¡n`‚8ws;îèÞ* ˆã„ñýž®cžc¶oK†Èñô #§ë8/ÅÄÅ«ï'ü‹„%:é6ΰò¢J ï#ÊÝýòªë|ÀÎÀû^OxüÕÍ·¸ñðMê‡ß¯ú=°'eHR†*ŽÞ‹œ£ ++Á¾+,´‘÷ õ\zB‚¡}õº‰äÐUír@˜]ÈÑÐí€ÕšŸ¶³OK)"ð[ÇãœPaj%=-ŠŽ„ç‘MƒÏæE‘bjgLš¶›hat½’ƒóT´Z3]h¯4>Ü‹ñý„}¸¸°‡ Â#§zµÄ©¶à‹ŠÒøtž3ÕÌçE +Ä/dJÁ»!r¼,Á•’ybàXÏ™X-ÍƳ¬÷¼ú-RÀAPVku„R6üW°‘ž/$ñ¢±1‹jxì`£#­1J™Â®€ã NFïQI¦Æ|6©×Útæ $ý¿æ#‘°—¾—×ïo.Þð¸V·Ÿ4£/C^ëÖ‰Ñd‹ÂÒ X2^ØãKŸÖùÞáóëT÷Cvºò£Öé¸ +Ç÷âlÿHàm®'Ï¥9+æPk‡b÷íP“ü™'ì“d—ˆÛþËË‹úÞè e\%_HœYiìÀ@¡«Ì×L1û)Sò®‘šl$­Ü¨ëÌ€% óu¶C¬£ø´>Ðði‘µ"Á_æ¤ÞbèÀ(²v,›œ‡äjY$æ¼ÆtŒ 8 ài'pFŸcM͵ãÎnÐ_Zô2ºI¸*ϲ´ )S¼É^UgÖàn:*J¤#cq™‚Ë:JÛ™â2‡è—&¤ †/œ ú{x8ôÀ´QÃæ¥ôÿƒôPà‡XظýoÊ¡ëBQsì•h!¶NÚDòéìósZ¤ë' 6Ÿƒ&0þUœµ@<'Çòe#ýq+KÊw…rõ+z*)BýE±$µð:I³È1·!¶wëmˆÛ œWÀÏ‘X2…}Bä•YªrþîÉz^×ÙøÂXšÌp]&Š§ ØŸ=gϹ9² BŒs‡„•ûi÷¥ ‘ì3Ó`W&^Ѥ/¶ö­8ÍâÇÌÀ'Don"Úd‚>ÁúÐâ$,ýn‡›òhšÙ´2¤Ø$F ÎíHm=F}ñ¼>£å`7fXŒ†4|©Ðº˜D ÷S·­‘sðlR¤Ýˆ³.«8Ë̦#t;lßa£H^Ge¥%~=‚ô®1†–;žáíâ7£¯E +ÆUÒaM+#½@˜r=kRÙÍFHƒî8i"_Ý#žëû5Ò2QËõ,Câ¼Þ±Ž+®ô|KhYI»QðäV_9# ®U ¼õÑ9 €bª47L„çœâbÆ°l\Ç .×Aä$eimå•4®Íñ¢'Æ[Ó%_²¶)y¬WÒ=5ó”ØQ™Žvê’Íš=WÉ:)ÒYK&t7eu?+Òi< õÈÞ”²°âS@¶DZȱ~'íx…òÈ­[؃u‡-GC=Y„AÒ²í˜/®[!(pm,'ó7L&/`ÞðK•©³ÆWMikü&éتcË7 ‹¤%…¯ÆRˆ©Uµ}Vî´Du‚:}Õ1ïgíÑ¥îvÂRc÷þ°GVÌvIÐLƒ0Ãõ¯9jT`蟘¾òP–t( C¹d'zËãf^ò¬ÑzðaÞàu2hà‚¢|ÅämíüÆ»´Ïë6k®A„5Ož’ÊüŽà¸"%»þ®Y+ƶmŠo¥\¾çŠeèmýË°· PY´-g¸«û;în\ôÑÈÚ­Ø‹¾µØû¦Ø_ð™ÜÕCAŸÐ S-Gu +î4™dChç%Fí˜Õt ÷ÙdÄ´6ô|¸’£ÌB`ΰE€®L‡_2óxJo |tŒÞOz[‰(Œ^o%¤Ö_o%LÆ—À‚¿Í +ÒŽü2áõIAÌ +(Ê|Q™.9äÔö:X@ãGêˆxR™mG_+¤ñ'­x…½7îy±~6xi Ø@¹…ÏŸ¶†ÇåS‹Ԇx Ó¾4°pæ}XW+­… fQ1Åa`ªFm „8ÆTÖ]RiR«„œ ®Á¸ ðËl[ + ·YŠmÓg˜N.VqÆ›LÑ_gyŒ=šY$1³âíá +'0_ÜOŽ›‡I"Á-RšòŽc·ïa5®Ž~‘qBƒ`ÿÇ0$O†ãîŠãNõÅݲª6¿ŒFÛíV$З”[1ËW#<| ‡ŠeµÊO„$žVû?2½ÙØP¡õþ¸††îµ)¸@QߦúUÆ`þ1) 2*@Ãß‹è=Û·eÖʇWîG©<ŒßÓ›·§?ñR¼2ÏXj=ª@¶ùµ‡¡ªSr<u±8Ïuê›×²K„ Æ.w§0`¢¡·^Ô¨ƒL´z ÄHƬFª'^zj”«µˆ<£Çbºr•Ü¡ ö|ÕÄ.†…oè·Irja˜À>'0? ׺m-ÞyÔS5?D`å‹¢NMîÕ3Pþ&.¬0)v<1/ö&Maé±~µÀ¸¬E—ˆ’2CA+Ò§eÆJ®¦å'+~Îk¢IÃ{Ðyåo¡Æ{ï’*€'xs_­ÐpezçGáZÁÿPÕAendstream endobj -5757 0 obj << +6046 0 obj << /Type /Page -/Contents 5758 0 R -/Resources 5756 0 R +/Contents 6047 0 R +/Resources 6045 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5750 0 R -/Annots [ 5761 0 R ] +/Parent 6033 0 R +/Annots [ 6051 0 R ] >> endobj -5761 0 obj << +6051 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [192.75 685.841 395.195 697.834] +/Rect [192.75 79.178 395.195 91.17] /Subtype/Link/A<> >> endobj -5759 0 obj << -/D [5757 0 R /XYZ 85.039 781.388 null] +6048 0 obj << +/D [6046 0 R /XYZ 85.039 781.388 null] >> endobj -1618 0 obj << -/D [5757 0 R /XYZ 85.039 761.463 null] +1650 0 obj << +/D [6046 0 R /XYZ 85.039 324.889 null] >> endobj -5760 0 obj << -/D [5757 0 R /XYZ 85.039 740.47 null] +6049 0 obj << +/D [6046 0 R /XYZ 85.039 292.672 null] >> endobj -1622 0 obj << -/D [5757 0 R /XYZ 85.039 589.974 null] +1654 0 obj << +/D [6046 0 R /XYZ 85.039 171.338 null] >> endobj -5762 0 obj << -/D [5757 0 R /XYZ 85.039 558.159 null] +6050 0 obj << +/D [6046 0 R /XYZ 85.039 133.806 null] >> endobj -5756 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F58 3360 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R >> -/XObject << /Im11 5348 0 R >> +6045 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F58 3380 0 R /F81 5323 0 R /F35 3036 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5765 0 obj << -/Length 3801 -/Filter /FlateDecode ->> -stream -xÚ¥koÛFò»…Î@Q*¨h.—ËGïp…ójS4‰/qÐm£%Z""“ -IÅÍ¿¿yí’”h¹‡ÂH´ÙÙÙyÏ.Õ,€?5Kèl–¤Ê×i:[Þ³5Ì|¦b! ‹ÌÓ볋—&ž©ÀÏ‚lv}Ûã1~dôìzõ›÷ì‡Ë«ëïæ ­µ§2¾H’Ô{öáj®¼÷Í”DY¦dÐ&êûSÑÀÅ«;5{^™³žRù!*Pû& '9¬ÂÌŠ§Œo’ÄF¥ÅShBÎ,žFù‡‡PFùÐ8@u¼ŸÀ<²Ÿ‰ý,JFûý\VóE(/ûóâõ n.·eQu-wîçaâÕÕ×Ìä~d¦^óGî—݆{ݦ`Àg`ÑÕ{î\ႺíÞ/›r×#[5%t>“ø°³8Š½—ýÈ T1…›Å€¾ei“‰}!à= ùzÅ#4Û•[Ú²ÁUs‡ÿ¤«y— ‘‘mæÒ¼ËçoŸ¾xâ?áÙU3ågÂÔ´<–ËïŽÈ-è x¢zßn¿ '8–§èF >) ¢Óú3zX,r'|PNîgõçô~¢?Ãý^ËtxeË¿U-ÈÅœ˜rw»Q Ü-ü¦™u¬Ä¶ÜÝäÈc„&UÂÆ@Ð[¾Æ -‚×ü¨hKBÈ-ÂÔwÜé,&Ôés ¢B¨Ô+«¶Ë·Ûµ³¬+Í<4œí¬^ÀØžm.Ú ŸÏ*×År¿k/FJbÕë‚Q¬J¼ìXÁEG±Î¼ëÁUqÄ‚û3 ŒIÇýräŪ½Cœ7¼b$3“‹ƒuÿ{`‚ž-D6þbVؽ{´ò}Wßå]¹~|á!áámÑpÿ¼Dhè$äÐÐÎyp‚8 òG,˜®áiÊŽ- %Y­Z6À›ùõ¤ÛQ:ACè++^ƒv·Ý«oæ H6$Œ$!YûXŶ5ž—ãšJÚeeÍ­cT9Z1Î^}Ë0‚TYû²G0œöÙ€¥““, IàÁòVbu@X+¦¶åoò]„/~¹b(±4˜F^çå–‡óŽQ#Ò‹€íý:O#t›Çܯ -" \–p «ÙëÜù,3ò,âS3P¹Àã©àH ·oqWöœ:ë KŽüW*± •XÙXzEUï×q£õñç«‚wWœc^Ù$"·C²íœ3‰Â¤OiŠqÞÛá! -ô8< Z¶ÚÎ5­n–¸qAªKSÐûr@&JV'-ÇçÊ+aqcøÙ·NF‰áPbìÜéš/Ò¨Ý2‰K2nƒhÃÎÆŸ²êyCš‚Æ¥Ú³8lÔa»ÖÌñ¤Jë[&p í’Ì9–ÇÂèˆï¡îÝ -Γ1 ó/<âß‚¯Þ1^»`–áºó«‘B´ç v‹ÎNNêö7kMøÛòŽ?•äáVÅ~BÕ¹hð*aæ5Шcã½/º®¬Ö­tŸÕU×Ô($“²+Ì«b+“W‡Bj'BµJR?6a¬•¬¦y½é”8lËåGÜ ¸"%ýFy+Ì ' -Nž*ƒº62C?w“[÷üqMƾGªãÐùSl³²nûŒeŠCA Ų,*ö"°úª©Ûá3w¥àñÑáä‘N *°†¨·Ý tNícM¾›(í2ßÖk†qZ2ᣧ‘CÙ?”´œªXZåRÈã³A™(+Žçä §h×1d–ö.¿ŒïmÕ£§Æ¶liÇ´§BúÄ9bh÷92tîY¥$Å);\á\':Õ@v6í†âØé4ëŠõklç\Ñ„ÚqAÈîŠ)F„~ à ¦üG¡Êr$¤0¸¡ðÛK dBëT  „Yc-n ñ£ì‹" -2äÜKƆxóÎeX®Ô.?—Ûbí*¾AQÏù"5ÝYÕÃu8?LN×=ÌÃåƒÀàI¢«‡S›ÙâáäfR; 6{[- Ž}"a(¢Q°2Óî—¤›|sÒrAN’®V”U‹Î­xÊé€IɱIÆ·9à9ÈŒq}},æ\üç“vÊÂj å7\öÒÚ v‰×ÊåÓrùu*ÃÄ‘õ»w\3@'ž(!—A ›åõëk -)KI®É¸Ö ›Û0~`’«¢åʧ”t’îœèá@)Bù)pv_% -%ÎSÍZ® ß ôÃB/àÇ -rˆSn̘„¡‡yKÒ”u4겇4Òx¤¹æ4e‡˜²oÁUÃÒ-­²±öh)9¨ª­Ör‚œgŽÜV:(ÂŒhŠ#!MXKhˆR×84L ¾Ìé¶4œª²j€CRè#GI̦‡Y¤@èBÜå.ß`?ëëmÀ9¸–¤0C LÚÐC²´\b Àêl"0GÆÏlŠvl&è òMlïV'vT©ÄA[t’£LlÉ`js…v³XÖäÏïòj5ŸpÁ¤¦*Šgƒ+ÿ¿ñ€€¯ -2±…{ùø[¯!Œ‡êä³’?êÕ™æ^*FÚOacºÛÏ€>¼sI12÷´¨ -[êw’ÇPñEÉÆÐÙœ?û@®7F× òº^{>ÈÁ4›Plo#tÀ·€žo#ø*‚ -ƒ$l -Yè*®jä«1]—ä±ð¬â6Ÿ³¿“€3áE„ çÀžÓ<À°1ÇOu¡1~0­¿RKAˆm(X…èlÁj!cáˆ×‘6Š“’ÐÏ]N„·’ª”Tµ_:¡õºRĨAPÔžˆ·®VvZh8¨qhâ‡%rÎppíó^…ÞKJ¥¦C莓"È“Ûe%)¾KVy‹•}"‘pí?C‹]4@ð—~•(½Ð×HGg·*é9·•ÜiÞ¶¼)~CïMSߎˆUD™w¾sÜ®]_"~ÛÒ½ ÷L€ìÄ[­V¤Ÿäþ]ÝÜê -΀èîŠßÍ!kÃ$¦ÇmÂZíÁ°Ýë¼Þ¼àž¹²-Bc µBƒ7ŒØyýêõ‹©ã‰°Ü íÅK32B¨Ï’Tô/ßí¶€“ad,?ÍÅnn(l—ÖÑ«² -B°«Ìøf«CïFœb”…|‚Ìzhpz)Î=Ê´ãeï’· Iǃ©ÞƒÛ´vêPø¾aýø©ðs ØŸ1SWÞBÊ`¼IÓæà*`|~6„c@a­ÝÎò`EÑèú˜“b|­ÞoHƒîQIÀ¶ó-†(lmæÏ/–!_oòc›¶wùº§Pbâ²Þ³aYsÄ)¾x:Tðal]ßÅç¼¹ØÖxì5ð Ïܲ×G_Ö™¤¯ô,I úëÇkm탛›¬´Õ¢ÇÅßhŽ>c !õO-0H³;!ú Œhü>Žæf¦gþÒ(Ÿ­G ³Øña âÏ|)K‰·{º¥“þµ˜o{`½t˜E$r'ÿÄ*9¡‹ -ú4#ëïÕq¯!»c%§YôD$Tœ>½_$ûï\sÝ þnëõZ¼É±—°eX.ŸËu|;“[Í~FWt¤ ”Mç¬óÂÉþñžëkV—÷FÚOõI(ªP¨,-ô\©¬N}“êc‚ÿäÆsendstream +6054 0 obj << +/Length 2479 +/Filter /FlateDecode +>> +stream +xÚ½Y[sÛ¶~÷¯ÐÙ)Õ‰ ‚Ipú”ævÜ™:n¬Lz&Í-Q'É’”Ÿ_öPdL§nÝÓñŒ‰ËXìåÛ]HÎ|ø“3 +_%³ØH¡Œ™­÷gþìfÞœIKáÏ´ð£§~\-_‡ÑLú"ñ“ÙjK$«ÍGïÅ¿Ÿ_®^½›/”RžLÄ|ÇÆ{ñþr.½+½|w~±:¿xƒ= ƒÒ{‰ÓoßÍòVóO«ŸÎ^­Ç.´Ð‘Âs?ûøÉŸm€µŸÎ|¡3;BÛ2Ifû3*jeûÅÙÕÙ/ý.<§g¼jâv G±P¾0F÷×”áÄ5ëÎËy`¼.kà&ÚÇ.Ü(ñº]Æ—D?§% ¦7@"½†¼yΓi¹á‘g³"[ã·C‰,_þ€ ˆ„ŒµåæÕ—Öù^5‡MíX{/é„N»åÃ4…àÍF—2ˆA`¼×™®öÈ-=¾ôöÝä*Õ‘öÞn™Ub±:aÓZÊ;¤ƒ!8 ¥iD«ÙB¢x:£Ì2¸¨à€Š¿»×Üâ¿ŒGê&«Sä…˜'rß»J÷ó ö®Q„Lv=_àšmÕ“îp²´ NûÈô +»9©=—4‚ÿùR9)â¼qè!¥ *”ä3ÔÊjª;Ôö<ؘš€µ‹8ˆ¬„?ÖM^Z¥9 SZ(°s¦ú×Ä>!ìÛùOŠŽbad4v»K› ¸ ýÄÊ%¶l£lÀP*´HЪ‰boµc1ê8ô^¡Ë^2 úgƒ¦ æmGÈN¸]§kTËçy±iã`^®‹ÃÆi¥åA<4®˜• yÉX0Œ* ù#+©]~Äc²¢àžMÉÒ|¾uH—þÍýF晕­µ"Tm(yx¬cPª¶ü}Ž4•µ*ºo#tÜÍŽh:+7ü£@7.8ZÂ$\&fù³Ý‘˜"öhCFžÚ¦û¼˜£Š , ˆô4âvîw²û/0§xªìsSǼC·ìkkÍ Õš2ßa"ú`Í-á ßyúó—o|õ½ø~" èDèÐ!ÊèV§GœÔšãêm^ÚâÎÆ›.í²ÍÃËO³ÙqHžæF½K*6ùÒ}¡4ñ£EÁÔî+‘¨è‰îký7»/°‰ú÷=Ç7|)ÆŠ<Š89Ã~Øj¨œ¦1%<–vËßÞ_°3ð»œ_ñqÓ>ÂŽ"‚¢9~„CK5étTãñ¨þ·ì ݃G(Ô´¤d°p!O3jâR§¯œùÑ¿ÓW¢ìÊ%sËo¿p’ íCmç®8z¡+اՅ†Âzeà@.J¢:N3Fï®h&N‡­ rƒQ¦‹[Jµ÷®Âæ;:=G{xL©v«öN°½àÖ½¨>Õή2gW§„ äÛYh£ºàXº÷ìIÌ·nÑÊMëÒ ® wC!XVbä“üÿoÍ…ÿº¬Á'œ~]·ê|Ú¯*ƒÇ—o¦çAÞKÎ"›üeÄä(endstream endobj -5764 0 obj << +6053 0 obj << /Type /Page -/Contents 5765 0 R -/Resources 5763 0 R +/Contents 6054 0 R +/Resources 6052 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5750 0 R -/Annots [ 5771 0 R ] +/Parent 6033 0 R >> endobj -5771 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [213.858 394.054 306.485 405.743] -/Subtype /Link -/A << /S /GoTo /D (printing) >> +6055 0 obj << +/D [6053 0 R /XYZ 85.039 781.388 null] >> endobj -5766 0 obj << -/D [5764 0 R /XYZ 85.039 781.388 null] +1658 0 obj << +/D [6053 0 R /XYZ 85.039 691.864 null] >> endobj -5767 0 obj << -/D [5764 0 R /XYZ 129.675 730.534 null] +6056 0 obj << +/D [6053 0 R /XYZ 85.039 660.049 null] >> endobj -5768 0 obj << -/D [5764 0 R /XYZ 129.675 699.907 null] +6052 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F58 3380 0 R /F81 5323 0 R /F35 3036 0 R /F59 3455 0 R /F62 4159 0 R /F64 4225 0 R /F18 4228 0 R /F65 4251 0 R >> +/XObject << /Im14 5646 0 R /Im1 4209 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -5769 0 obj << -/D [5764 0 R /XYZ 129.675 641.057 null] +6059 0 obj << +/Length 3545 +/Filter /FlateDecode +>> +stream +xÚÕksÛÆñ»~›™ÌP½ðh;éȶ’:“ت%7ɤù…1 Ð(EýõÝ× ?ZçC3úÀ»½ÃÞîÞ¾OjŸš%.M:‹˜$™-7'ál+ßž(ÙÎlF—ž^Ÿœ}㢙 +ƒ4Lg×·´å:ÿeþìïç—ׯOƘ¹JƒÓE'ógo.OÕüŠ¡—¯_¼¼~ñò[œYªù›K\~õú41óëÓ_¯¿;¹¸»° žûîä—_ÃY¤}w&Mf0•¦³Í‰u&pÖÈ|}ruò ¯Ù5ÁÝÂD 4ìÑöŽS6PVMDk±ß‹‡¾ +üö}<.c¦• \÷‚ìL© un,ø—5ˆ°;]¨y1!A¥¢ Ötw³w3„6M /ÆDêðÎ^lÔìy 4ͲLh¸þÄij{ºT2¡Ww@W½[çpÝ.ž?žê¦ Ï~,«—Ou<h–̗벨:™àÇÙ}!“ f‚§»` ˜ß³oŒ®‘ßTH8þêéÅWÁW¼oJ›±Šdß¿Be×…œ|[#¥ÍÞiñü<¯oN@- .9ŠF `T¯”Ð\‹-Ýj÷ Ê-À¬6óœfÈ.HÏËŠ?@×ë"`ëø`«í\Ä”ÌpW…»ê,gtøM%ã—ZÜÓ1ª¬+ëŠÏ¨oy 5óªx`ìÏÞÀÞË+â)üo˜±QÖŒ˜ª{ÙáäG\ ²ò–¿}y}¦Ã𷳟.y/­•D7o¸E&J™d¬á8Ä«ò”0·èi5ÿ}H½ctUATå"K×<>”[¸ÓdŽR1¡ˆÇ(R-O +÷ü5¼z‹ìÖÞ![CËi-üýtžOXFr›–h4nþ¢ch)«U-€þÛz·ºbjÁ ŒÍ‹5íèŠ/JÙÙ’ðQŠUWx!¡>éDˆ§†^ B=pc6O9öo>k»’‡zî-àoOY‚ +Îçkà y·œgÇI¯»°£)»¶¿1”·ü+NcÌ«#V»æí2"1çE¯nc+]lÆ‘ˆ¯ DÔÀµ8¥ ò$v^ó†¦ÈÖëGƹb¡Ë~”óÚ£=E¯Ë‚ô¼— .{ùâxäb¢9Ú%♾FS¯KÄ Ü¡¯·Œ¿Žµ?|›G¾- )ñm— ±ÚNù@pž¼ï¶F-ν5›XÍ.ä#ë–è(oP¦|ü}™Mœ†Óþì+¸ÐÖ¦G=>\§cÙøõ&¥ƒc:c*ºÎ+dµj'ðYHctò1|Úg+uÕ5À1ùrñÜêøÀý•gU±ž8ÊèÀõò< +ð|\üK݇ §ÐTMÊš¶ºëì[Êå[€«„´½ÖY•’SoEV K7™÷ÔoW ¹21+Bq›ÚºX²zÓ¯ bõ²o¼“gqAžBŒÝWƒÊ "+š®,¦¸u +²/40<›„!„Ô÷…ñ‘Ï€«¯üÂ/äe†*Z¯xÙ[ƒ7•ÞRì‡=Þ‰«J0£ñzø¼ñJF†‹H'î- ÒØÊ]†6Aü@"{Ȇ¶3¤ q +ª¦÷dwH¬ ­÷™î(ÈšwŠ4yÀ Š|iÇPÜ€…!f0|ð·= +ÉpØ´ؤ—Lá]ÑSB‰ƒ0ôÖz³C×Åa·bñDY]ÃðŽbÐó€ÑDd¢›Ž½{]‘“ Sd/á,Õù-ªXH÷sËë@zS´eUÔ•¬´eµZ‹§†©„Ir¯½»ƒýëâ¶óX%ãÀí;¯[ä½U¸¿Š1/#„]¹Ü­a˜z|ìþƒ ÿ3œÖAñ(WÁÅ3ø= +ûÌ(žÁ`2Ò#y&™ïZbmÅ3r¥,¤Ÿˆ©¬äÜ÷í’Oqf¼kïc‰™ÎÛØ›„pûX}MËÇH"‚×\8ö~¡ÈyÇy¾)«²GÜÐõˆÒІ-ÝJy_®‹•Ïq.‰!sùí@CƒÃBÊDi BŒ‰ ’(ú¼Úœ°°™-ú¢ô/8•Žƒê[ÐFª GîQ¥Ûï…R?uŸ]è*•Ú˜Oo×S…® +!zC,üŒB7B5Šç:’”ØÄ®s_UKÐ)mãÁ1ã¤/`qÒî–KïB@ûnw”›>òâPWß²[[I[q‹/Ó*•éúP™¡þceæ1Ž‚¡ªù7ãI- rœ\¬mé‹ÓŠç…Ÿ·½]bžÕMÛ— tIË;þ ÓÅ-ûéwË@®t,YÈsãR_F¿­©`[ŠÏätPÎt¹wíP²Þp™—óNðyÇú¦‚’ÂU3°Y‰Š¼þö—ÿŒbÁ¶£4êi•õ\÷ÒkËe¶æ/Å›—È®PG¶’~ûØ®b'éËÈîßO.æ)VÍ/JÒ,vÎÚð“ÂVèñøŒ#€n½ºÊÇYÅðâ7Ét$üw÷ô}¤L…‚"í/Ky¹äÖ@ÕM…LÐ +åCæ\ɇølª:w9vRcN`FÕE»ã”.ºÞlz›ÎBJ!ÂÁ1ø½ûLßþ»:Ð¥ I µic=ݧ^h npØ(£8¢0–À}‚õ¿ƒ2„t¨U©<.N¨¬ÛîjÙP÷ a¥‚þ‰À­íG4?'…=ÃÉ'Àž³³–;;ôAÑî=œAxOT:„"7aÞç” #!`0³(¤ÿ˜÷Ëô›ñ§Ëzã{9YS¶µ¬Ší¸‘‡u×P³!«Þ·ýíPzÑxNQïÆ·ßä;Ž$eÉ°‡`F]¦¦ýVZnþ eˆÍDnÍ-fJúÀ… á_Ýîe~w…2¥”YsÚ{^`L¢ &(~Tn¹âŒÅ*K]±éÑ[’ñ]ÖùÅUbc¶RÆ­±Ã ß_µL}%#:ìËwTL÷Ÿ§KLq²r¨>* +Ld9Hö€‰k¤èñ!ZXçö£ËxiŒsR#_JV}—qi]Œ“zãÝËçã&ˆòâÍ÷çGN +£µŽDíäÎó»˜&®’Å+À¥¼Õ'/X,«¢©šÈêüù+˜=ET0À—þ–¢í}ߨu£šŒéë5WºÜûâ%òkj—DvO{läœïÁ¶&õÒ`Üïv}¾Ø1Œ^K¢Á ž-'­âHyÍòò9åªë!Ê–YGù&,rl·Ýø;}þ ®:¶;é#®ãŒüò;Xþ¢•Žà²3ê÷á} þò­y‡„dÂiiE!€c~ɉ<&Ü-‚·Y3LËàßp7¯îéÄTj W‚;v-¤Q.¶ãÏþ›å"ø*§.k:y»€)‰ò¸#ÇT•³2ü•7¸ñ†$€¨áãÿÓ \¨>]úú#¾„JÚX÷“¤]{©¾ ÂЧ£u3u6ª?•Ö¢]fÛbªmÁÖÌïD¯/½žôƘÐ[Ç1rg!Ûó¹î—âÄÌÚIßD¥áµ/6¨ÚK"Л,o¥™Àšýf–‡NyM†Á^PDyFÊ·A»FP¶ëê%+[_D0Qd…ƹN¿2Ò;\Äj’~yuOk øñè+j>»H^õp‘ÄYvà ¦Ýwél¤ñüÙ’ÁQw× ¯‘Š‚½kÀ¬;ôÚmÛÕÛvâ"¬ +têÆOÝãÎ'bGHU8œÜÊ“hö–盺)„¦b‰™Ìqµ¤g2HÂðÑ"…šºãMÒ†CgGï™nŠUÖä£ÌÍäÖ•KA™÷K›> KŒ¼Ãõm?ºŠ%/ýãÄÁEãýCý‘À¢ í7Ûn×À¾“ŸmÁ¶œÞKúf©×e* ­4¹™ Ô“ÈS'8qlZNª‰0‰kÞJ,üp!>ÂÀB[0+ÿVåŽØXî¶mp_å‹óƒ¯&Ùz2þþŽå‹WPÍMöÛš‹ `vícÎØziH½k;JI¬å:b%“Œ»`õŽ¢ÚÒ~¯€©:0’‰[ÔP$ +ñg÷YsÕ:q~¶Å£ Zp¸©‰A™ŸØOèz¢ Š&KP\‰G¹ˆ›ê±1SÞhÖÞÉCè8³à¶`yï;Yå¶_µäo™B8‰ e·Á˹ž¿^Çh¿ü&ðUÑþ@iÂï¦-=zv>†ÕOÊí‚pc†o\‡=xéÛòm#äÐ~©ãÊÌ`ÕRõH~ ÒYù¾})™nÆ?ê韂ÐQ0€dÓQ#ŒÈaNªlDh 6 "ÿ&¥&IjÝ$¡·¡S/²ÿéå½ìnToéx83‡².€Ó-•Üܤuté+R#ç ¾3,ª¼*ª¢á q­·„<9þbPX—òßG)WÓ]×ë- •Ö/ ‘°,1ÍEk§Ž7 îêÉ÷yL|4{µí ¢Mùoz¹£Í2\½ÀäJš{E>an©ý{×´˜þÓŠÒ$Ч5{$8º¢?™n ;7ÔÅ&tèwA1ûdùÜ÷^& "õžÆ—èçý§¤Á¸7ö궎£#?;24Oàa +/endstream +endobj +6058 0 obj << +/Type /Page +/Contents 6059 0 R +/Resources 6057 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6033 0 R +/Annots [ 6061 0 R ] >> endobj -5770 0 obj << -/D [5764 0 R /XYZ 129.675 442.472 null] +6061 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [146.561 423.472 323.811 435.161] +/Subtype /Link +/A << /S /GoTo /D (printing) >> >> endobj -1626 0 obj << -/D [5764 0 R /XYZ 85.039 327.41 null] +6060 0 obj << +/D [6058 0 R /XYZ 85.039 781.388 null] >> endobj -5772 0 obj << -/D [5764 0 R /XYZ 85.039 282.905 null] +1662 0 obj << +/D [6058 0 R /XYZ 85.039 359.218 null] >> endobj -5763 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F38 2997 0 R /F58 3360 0 R >> -/XObject << /Im1 4096 0 R >> +6062 0 obj << +/D [6058 0 R /XYZ 85.039 327 null] +>> endobj +6057 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R /F20 3021 0 R /F38 3057 0 R /F65 4251 0 R /F15 3032 0 R /F41 3054 0 R /F58 3380 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5775 0 obj << -/Length 3438 +6065 0 obj << +/Length 3165 /Filter /FlateDecode >> stream -xÚ¥ZmÛ6þ¾¿ÂȈ|¨µ¢¨×÷!éõÚí!é^ÖAHƒmim5²¤è%Û½_óBR²-;Ec‰rÈáÌ3ÏP+ü'Ièz2]ĉpe’,¶‡o±ƒžo„–Xi‘ÕDæõúæöa´ž›zébý8κA(ëìƒóýO¯î×?¼[®¤”ŽHÝå*Žçû÷÷Káa«¢.Ü@:„nз˫¼§—7wo~Ðz¦ÓÌÄŸÄn˜˜`QMS¡:p ¸Íšl|K‡Ôm ÌÍDžçCZ ¦‘‡x‰KºòÙÄnªQ]W˜øéaú}[£-vûIS~×M××M÷‚Û5`—½QUÆe½ÛMƒÔ:$<x×xR-ÝöÜÇ–:ׯ©å@0š´Q»¼ã¦¢â&ô£sG@Á³€“ G0ãPØxë¶&Ð:%š8q#ù!‹1dˆI·#x¨lÀN‚i:bZª˜bD{–£ÅѾ˜$6ÂâriƒvÄl0t¹n&y¢ô‘‚`Ðü{™¯¥X` ¥’C ‰ƒYú$Á…:iÙÍVc`g&((R}€Ø?ú¼Â3Åóö!ü+n·Kò- ‡Ö®ÈrDZÍ©K3h†íoÑV{ýzT4ACUkÁ¬è8R7üÎÅÒ3¿ÔàH­noС:Q=-í<+]O›u -šÜSAZáÉ"ÂŽÙ$¹B“}3ZsZp.N‰–MùoWšRÏŽ»ÚU|·„¯ý5´ ¢ÐMãëäw"smŒÐ×ÐæšB‹6§gÑfªÑÒ)éä7€¼N~0åÌ-6óc©ÅóMÙcU:Ù )Ž"ÄÁ -–í™À:¡‰‰igøc?Æ'dÄô0^ŒÖ팿ýJ1Þ/¾Gä÷ŸL~ݺÁo:†ŠX,sÕÙµ€4‡0ãmÅM$DCêÂèBŸÃ UI¹uGCŠLÛ&74 …0¸Û®ç—×ÌH¿®‡žï“qc¼ï¯ŽÕ½}áú2ºîÞ£ 9›½ÂMQ›½Ÿ—iäg6‘ºàŒ ¯æÃÐsÞ HQ„²àa5€qtx_¸Á«€(&³}Š¼ç×7HX<'³\àÂêGÝ ¾þua"s*fž"Æç¯ ë½®:,Å7ËØpqÂ%÷á@ðB²uS˜ÒÕMoæ©rëÉ£óxöö#'yª}fÝ57LKªo>r#9Ôžª œ -´ÐyuBçÀ“KŽÏ¹ë*.ÿžœ"®Z¿ŽM¢é1Ûù)¤"›øÔï‹Ž•¢ööœ„Œ¬¡ª2ã¦Gº]=ðËmÞ“Èí–8 -àvd3¸Ÿ[–ÄÅßØɤ™óÑeÐYƒØ[üG6Òpô$ý“6l㛺¢Ÿ1gï@âg”Á°¢-Ù”ίTëgtŽ`@ºÇ„æ)HỾg‡ÓQ“OÐñ¥P¬‹™‹¶ëKy?±4nûuþÈ™ †>ée‘>ÂÝŠ§jùvˆž™éecèÄgÒ |¯ÄålÇ€u$G£²(]œ¢œoJ“ aŠœ¶æúEWVÄïàe:Ñ–V  †‘°Ã#Èí·ŸÆÅœY²ŽÛ1)§ð„èDÎÝ#Oiâ‰^öjzŽ8XqGGFQ%U<çžPå½ÕMû#í89²Ž6Ÿ~A3}lèÆ º`Rdéû¼2Ks Î9ÛA×µšlÉ€PÓŽ·pÕ£Œtþf´Úp°é·æÇDèqk?åfÙ…aVúŠ”†þ¡€A_9Hf_šÍ†?ŒŸK„Nï´” ðwŒu¾B²K½šÏ)ÊÙ.×r -Þ°üÊÊO¦­ëþ/pâ@km†Ùðûê=ÿ¢?ÕcÝçÛÿÜ=øžÏ" àS”Å)þghsÈWm®ÐåñWm·9nŸËz«Ê}Ýé×øð õ?xÙåÛ6ï_~œ©Ž÷·Æ/×Yi|úsW_d5s1‚EB¨ù”(‚\`¯oÚ¥MBy‹&Úø¬ôœêÃÃÌ"´‹á FxX)Ù¨Vòñšš&w^¹Ò -¸|‹É¥`ô…´‚L‡ÉNÆÎ×´Z㘳õm $v/9þdxœÍEì¼`ÿ¶W¹ø}‚È gðä(Ïä-·]°r5&‘ 4}‰Ph É~‰6îm]‰¯#ׄ±5ÝÐ~¡Ï8ƒ™Ï %J›IêÊ0faáèÓ¸†‹˜>äÆL&ÿaDë{$雊jün3÷¡^10=±„K† è/É4CiO,àk{e.²Ï8†rÉçýIé }1I-¾Ð$Å _p¶Å²>ÏM!¯ú—wîj¾Ï…GâHá¼ïòÓßY}aÁÓhõ…a¥(µËµ^Åïúo4üÓXØŒ_–è^€.øú×qË5_¬ÇøÁxÉF‡×ÈÔ–¥Îø$Â6 ¯….þð0^™GæÛX4½@é úZ€µ¡ /’ƒPè ‰>DˆyTÌû±pcin«ÇÝ<ªÊÈ|R}ÁKVz;½Ùf^éÅreЃײ¨LŽÕ×uÿÄJÿ5 -Ê@ „ó“„®Á§Ö¼3Ƭ?±Ô‰]꺼8¿TB"BÚu¶ßÐU–Òd§)5mÁ.†€ƒ¡”04ÓUü9Z+Û¿øîR!ç¹~:Hð?oëÿú««±”•€0é|4†¾ïú¬ÍèGòt½¡LÜ0‘ç þVºX(endstream +xÚÍZ[oÛØ~÷¯0¶BMž /ú°›¦»¬6Vº’  (Zb#“ +IÅñ¿ß¹’’è¤EûˆÎýÌÌ™ùæB‡—ü /ë:½Œ“Ð×Ir™ß]—˜ùù"”Á¥ñƒÈâÔOË‹«¿Ûè2 ü4H/—·´d¹~ç=ÿåÇÅòÅ›Ù\kí…©?›Çqâ=»˜…Þ .Þ\¿^^¿þ{Cïí§}3K´·œ}X¾¼x±];7¾‰4Þûéâ݇àr ¤½¼|&—÷Ðü0M/ï.ŒÕ¾5Zú»‹›‹ßúSxÎ\ò® îæFE¾Š¡¡?ILÏfh'ØÌëÃnÍìì€ôb6½Lºšiáx5›«˜•°ºÚðð¡‚N¶Úã}ÆÛÃhm•x9íi[ž(»÷ aÖ?•´kú ¦ù #_GÀÏ— 'øz„ñéáÖ7ÖòÆÓCqj|椬–[dP)ï92Ók ,fÀcÝv7yS"ׯh—Ÿq’øox¸>à’ýaXØâlQáBYaûÛ¿“¬×5Ý£•öò])ë[^DB‡‰Ö2z¤­ý S#””rÚiÉš9J õ4³ÄsÆ—D?êE*ï ¿Ù¡«çºwŠ¡Sãe-ÿv[ØUÑ”9w^]¿‚Ë^È’£Ýp;Xc2½Ò¡o#+í÷»2Ϻ²®®ö îÅÝñ¶£ A}’Tɶ§³¹ R– Þwúð¥2K[‚*#ïsmSP…˜E`RÚßmI‘›-ì 4÷‘µÀ°mœÓ*_i#÷ïÛ®Þ·dꘋ5h‚]¯*pU†–µæö®ÞlJ2¹rÜP£®5´7ïx =Ýáÿ_‘rj}Ë¿ûlS´|FYK´ê1­Ê¾¤–`ç©y™Àú‘u¶›~æ´ot4 r2Ó›£ž2GÇ„Lñ©ý I^ð¶nš²UºDÑ +€e•@Þ'4„ºË¸·? P÷$»º-HUÎ! HDRx³™ø;Ä,“:7é1X!{/X£þ”=<àJb%²g ­D\ìÔÏ€µEµvÞçP»pw†'®Ëçê*ÛÎìX¯³f̓à‚kĪ9Ûu‚‰g¸Tïќȥ„^Bû /µò^/¯T|¹úçûÛ š[I&פ¥øÀsc´wƒ|ç3àz˧:vøZdGÉÇ•¼G€2˜‡a¹9kœ_}Æ'“³¼#Ú«`H`9âRW\¯ +OäF¨À°“Ž^=N|§òô«™…‹ªŠ¬ÞÄ@*öñ´úsˉŒ¯CÝë¢ jñƒKQ,·ÃÌÑS߉K«Ø:žbTbK>Ž" E¼=8·æüx²êÏ™ eø"»Þ×ÀÖLüawèâð}I€Bhwh”ì%8öÁ Þ’¦³rðÓÕu¶–ä)Z;„4ä`yÐ_[ 7ÈI‚¤æTðÄ9 +àh¯AÅ-É£×>Ó,9 ëè W‡Þ9¶L“Ó#Çqæ-4Ý¡wŒøćœ©ñc¿CøVf”x(°ä‰pל 8®œFpœéÜɤ”ùžžÕˆ~ÐyyXU÷SáYªý$ +…Ø¿ä‡}û²^-Ëüc1–%ÆcÝgdÂwGøË1ÀXÑÓøy (¦”çMí8Ù–T}R+)È9Ù1áúp‰ ½déÿ¶ã?,ÂLI‚1è @m!ä…'—k!Îr8‚‘ònÇ¡tË!\ד~®à#n+çQp" ¹$@ÃâKWT­¸F€K|ÖSu~üq¹.µQžH(ÿ9 +k+]—òíä’ªv9NÙv&­¸Ï ƒÀ} Z&NbwÜ.áû”g’::CöçÚ»/éVhõ®tC¡º×²“NvgüÚuwœTü¶¼ÛïätäjSÕ$¯œ›>ŽQìÇ&úƒ¼ vA^Ðk:¹Œ§"„£ïÑ©cÄí hcìôú†>Þ Ð±dœA¡^1˜àéúE‹ÃÀ«u/†à´qž'­‘Ç‘·Ïã2z=œº%9¡8¿“ñâ½(†x·b¾(â¼5q†ö Cí£í£ØÁfÉÈYñz.l¬¸èñÀK³]]mИxYolQ⬴i»á~:eH»{Wp6*G<ÊïP= =õu…5²±é2 ;r¯[ +FC?Å{Э0õAáà,YxosœXHl16^³_<_ r‚îoä€ÊBXÅĻ낮ó™òÓä1zuè‡Ö~ÛÈõ@J6.$ø¡quôS—´w3Q鹯Š±x¦N|HšÂÀ¾tφ)QŒL$oY¬ YJÎ¥EmÕ<õ@FJžaʹbÓ:wùBÄJœj2 a{äVýyâëÇ*‘ùSÅxóØ-h·YSÀKGFy?®)¯ë8Ýý|ÀºæSW(,ߤç…Ô^y‹Åß°aÁ¢z+J¼¼Ì: Lpˆ‰­ŽœmË÷„KRvjxA)s\éØ<È)· ¼ÍT¹Bù‘uµ•«¢Ë¯ðÕ¯öûõÕtdX—8ÁóœKÙŒíÿå1⯷Áÿ} +Œ«)å9> )>ʦh^ø›å`-·wuží¶u+Q°Ö°ÊžqûÝЄ¦èžL¡ipÄÞÝZ1VSÐÏMTÐ Z2Ú9̨,êë„Ó´”H5üÈeµ|c4ŽÒòM+NYu>^pMàƒÊËólš“†}I¾é ‹{Î8 l.2¡„”•kOøsRÿé¿;ÀÔP£,(ì³ôy“Œ;çu"Ä +„LzP]þœ47*õsüIu ÑáQu ÇÚûP›â‹Ôá‘K®Ôþ´&£¼^÷,xH¦¾Â±'KäK,éáõ©¤ñcÓ%ýɸz‰ŠD%çÏäóî<‚`Ùì©+2ùD1¦×ÍÇ–»·ÝÏ…Ù±€èCDáФ÷å€86ae™\:€œ"5Çß)5>‹Àü©À[E~ÁÄ#©‚õulÿÃ\ÿÿo’á Zÿ˜i§‰+ÊêvÖgD¿Ò!ÝþÐMæ ZÙÇó†$L¿ž7,*:f+‡Ña0r€A*¹|`šÔfØÉ> endobj -5776 0 obj << -/D [5774 0 R /XYZ 85.039 781.388 null] +6066 0 obj << +/D [6064 0 R /XYZ 85.039 781.388 null] >> endobj -1630 0 obj << -/D [5774 0 R /XYZ 85.039 421.236 null] +1666 0 obj << +/D [6064 0 R /XYZ 85.039 447.979 null] >> endobj -5777 0 obj << -/D [5774 0 R /XYZ 85.039 386.433 null] +6067 0 obj << +/D [6064 0 R /XYZ 85.039 413.175 null] >> endobj -1634 0 obj << -/D [5774 0 R /XYZ 85.039 136.833 null] +1670 0 obj << +/D [6064 0 R /XYZ 85.039 162.463 null] >> endobj -5778 0 obj << -/D [5774 0 R /XYZ 85.039 102.087 null] +6068 0 obj << +/D [6064 0 R /XYZ 85.039 127.717 null] >> endobj -5773 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F35 2976 0 R >> +6063 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F41 3054 0 R /F58 3380 0 R /F35 3036 0 R /F59 3455 0 R /F20 3021 0 R /F62 4159 0 R /F81 5323 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5781 0 obj << -/Length 1349 +6072 0 obj << +/Length 1322 /Filter /FlateDecode >> stream -xÚÕX[oê8~çWDÝ]bâ$Î…ŠZÚ*XÛ³êVUš„SÔ\hÚ=ÿ~íØ“„–.h¥UEcÇóÍÍ3–¡ á?(HŠ)èŠanØ„x庇ÈXDŽçÜn´¯&@ ˜’)ØóT¤¶wß¼øÖÛ—“–¨(Jš %êºÑ¼˜[°9¥Ôñd`ÙëšÌTL„ÍÙ˜,&-CiÚ”i`m–{·ç=:S€Ôz°o—v¡i¡ÖÊ$j¾6î$ÁÃ&Ý4$ ˜†ðŽÇ€x9l`=R6ÓÆï…(º¦ -tWWÖx ÙØ; I¨NÂÞÅiúN1ù& ‹¡#ƽ-¥ˆ”¦É@5•"Rš*@L„H¤L ¨K1‰ŽÔ] B½é$QK„ÍEô£ìX¶EÓ5 2+¼b;L¨÷‘?nœ[°1,'´¡"ôc¬«À©ËÄŠœÜ\]hp‰eh:4CºFõý³e¨ÍxEÓã=W:ÀÉÐÌH}Ÿ²g6HðbÜe£g”²Ä'MÉÖ÷¡“‰G%ÎéŒN˜¥9uÂ'‡¼Û%{Ýxáq!4ßF\˜ùd™É‹#úMÝÄÏé({X5€ª&p‘û÷i@2 Jº ’mæa™¹•S’©ARPõôk2—£$Ž³_Z"’QÓ]-SÇóÒð‰ÎÅýFy£ßE43ß}”¡„ˆ‹ÈÁ€äœÑ¸qÈÞc&Â<“²œÄ]-Ÿ1d1ý:®ë“X“q»Nð§lÃÛ¡ƒëžÕï ¯:5¨“U‘CAm‰ÃЉ¼a“Ü`áGLZ»]ˆo/œAEý•™h­?%úþ–ú8²SJ$|92>”Ä¥<¼èRžÓðÅ[0‹ïù»¡•6o«½\­µzs’vºŒã M"ÑÎÂe[ñMãi.{8-Ÿ/³Í‡,—^DD@—uŠ„J@«=;‰O¼dñæ'i>ñ’·xA°…Å/”q8˜ŠAଵ(”¼¯Ã>žƒeE:!žRïÔ§þ:#IaHæŽë³é²KŽª†šD‰O®“f]F,@Qè¤/]<ô'ÓX²¢‡Î"êÞã>;óþú@·¦Ýû™5øΦS?ÁFuïYY#$È@wx¡4–ý8µ{ölú8:¿¹¼°­ÞíåãÅh8L#–Ø¡óRœ’Ä㌉“Öw³8ù¹q>u]}²BÈ|ø_Ê`'-CT²ù ˜{'s ìÓQ ù¼ÞÈXŽ·Ió`9ƒ’uÜ>­•ÉÒåke©ï*êâëAmQć‹êMç'w‹È‹ß™Î–M¿Ú î»HßyöOøDéðáë”S¨³ñug퉎5;eˆj ›ôîrÖ“ÝÕ Y­è2ÿïoàÎN‚ŽgcaÁNÆI^å¨:}Nõ­æNÛç*ïÌóUü\󤙾¶’ËøϱôyXªtö©×¿Ü†‰Øíº5÷?êÂû¶¯^ÿjdÙSp{uËCqä³Ï3x”Ñùåxª‚þäm˜ ýÀ>\ˆú6×B`úýË«ñÄžÈÄ÷<O?ÂÍhp1²†ƒsÐyŽ| ãéíÈ*‹/ˆg§»’éÿ|gaB~i!¾«ÞŽxe©=ù‡÷óʹ¯‚ò,GÀ+W€:@ŽçxˆEAø‘ðŒX­UÄ-ž½ófßJQÅãY6°T8ªh†úW8E²Y÷r†T«ƒèŠw U†bnÞŽøg „Û± ׺/ÈšZÖ)@†RUøéU”Ãendstream +xÚíX[s¢H~÷WPÙÝ +>ÐÒÜ1僉&cÊ «¸™­l*E'V¸Àdæßo7Ýb ˜qÆÌ>mY ݧOŸï\¾>M9ý g¨@”MN7 ƒó¢–È}A+W-H5DN¢¦â¥s§Õ¹T5ŠÀMÎY*ŽÇ_|êÛÎpÚdYæ¡ Ú‚®üÅÜnC~F¤ötd9#ë +Ï$„üÜÆË“iÛy§}ï\·†+(@ÑdŒûÒº»9¹vÝlÜ‹š&µUª"ÓyØšµþ,­5…#»¢dQÔñ†ÂêÔt¡„t‘5%ËTð **°Ñ3Ÿ.£Äê{Í›Dd†Œ¨ö®USM`B½,¦pSUÙݶ!Ôy7Ûä—ñ—¦t«@—Š$q/Èe*8©øÇŒ g·› +AgÉÜ Anq[ÏdHˆ*:­kÐhàÎßmCá“5aÉ[á_ˆx¢dA@ù¤h1i ’Á'9‘¬ÄÍ2¼õ­åø_ê‹ 2#jDægnôè’¡‹v{x¯—¬c4.Ûp¶ò/S{ILž™—…<ÕdÊš  ˆ8%A éÚQ(e_(9üó¤ "°l)"½\ÖEVê’&Iþ[[P%•÷Ö«Ìõý,z$saNžX…J^És/’<ð$(ª8-˜X(LFdÒFUzKpe°î"I«fÒàe½Lª'äéz^€Ë‹Çaâ¹áS’Ñ ¯K— ®úÖ ?¾ì² ŠY N×qŒ)OBI¢Èý.™¡ˆ¼pÄÔZ§Sšï¬RTø ¬üN#´6±ŸbÿÈD€ü”±^,IEYxÁ#:§Ñ³¿¤ßÊÒgC;«lÞu{µÞxõê¦l•$a¢“G«Ž˜ÆãBòUÖf‡­X­ü*ˆ€¹¾i!¤'7 ’Ÿ._ƒ4+&~úš? wÀØ…*ƒ£³^6‚ñ¡ {Ç>x +W5ëXxJ²ÓP@Äü #q/H®Ð骇ΠÔD B ‰Døè¹YÎÈ%•(ŽÜ칇¦€üI@lˆbDî2îÝ¡Ës&—æ=Ù>™õîæÖè3΂Õ»£ ‹$ ݽo0j93§ïÌg“óëá…ó`õo†“ñx4M(³#÷¹<&i%9±6ðò$ý¶Í>É]ý€£ä¥Å2 ~ˆÁnVE¨±¹¹ì˜s¹vGéC Y^ï¤*·¥ù°BB¡×Ñün¯LWÛ++x_{ÄèÖ†ÔÜÑá"~“ùÉí2ö“7ê³åçWC;AW­ªï=û',QºlùºU +u·¹în2ѵæãqwÛÜ$ýÛBód³ð"Ú*z4ý‡Ç·ÎæLýe!ŠÍá‘èÊf§E$VL\;÷>¹Z×Å­½X‡á·N–»aø`‡xÆ~Iï´¬Æëyd)âÙ÷¯ö¾¢±ÝÝžfÛƒ¸¡ûƒË‰åÌÀÍå ňϪè§P&çC{¦€Áô¯]˜­üÈ;º4õil7B ù‘ƒá¥=u¦Î= ÁÊß«Éo3£‹‰5ƒÁxÌ¢0â#ã°g7«j¾žî#Óÿï3õ÷œ»_ú:Óxò¿ëkç¾ʪ|^µ42:‡X6„w±ÎшõþPGÜÑ9˜7‡vŠ:«rt€•ÆQGÛ*Ô?i¢„paó§BêÓqßìdüÞQÆW~;júF!éFÕE¨YSÈ—©ƒÿS‰|endstream endobj -5780 0 obj << +6071 0 obj << /Type /Page -/Contents 5781 0 R -/Resources 5779 0 R +/Contents 6072 0 R +/Resources 6070 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5750 0 R +/Parent 6069 0 R >> endobj -5782 0 obj << -/D [5780 0 R /XYZ 85.039 781.388 null] +6073 0 obj << +/D [6071 0 R /XYZ 85.039 781.388 null] >> endobj -5779 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F15 2972 0 R >> -/XObject << /Im3 4353 0 R >> +6070 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R /F15 3032 0 R >> +/XObject << /Im3 4496 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5785 0 obj << -/Length 2450 -/Filter /FlateDecode ->> -stream -xÚµkOãHò;¿"ÇÞ G"ÛmÇ6§Ó -ØÉB±ÒÌèdbÖ8vÖv`ù÷[ö#$öîÞÍi4¸»ººººÞÕ‘þÉçSùדByÞ`±Ü3O°òÓžÔ#2jáœÎ÷Ž.œñ@šÂ7ýÁü±¡ãÛQƒyøÙøðñd6?¿Ž”R†ôÅp亞ñán6”Æ-Cg7“é|2ý g6¥q7Ãå뛡§Œ9#M¦ÍòÉÕé Ï”0‡_çŸöÎç5§5À•lþº÷ù«9áJŸöL¡|oð -cSHX^îŸÂ±•ž'{·{?פxÍð®]Rq”'Om‹E9-±øcaûöÀUcá;‰åf¦qú49–c,²å2HÃcžå«Å"‰£´äi’-‚ä9+ôt4Õß»ƒ<ËÊÑ"Ê~‘ÊFy áZî`$‘Ÿ-å Ã0_¢œçû÷qf¯Ïlaîƒd¥c6´L¦Ã|ïÇécVF‹ÿXÒtŽOήOÏg·¶8»ù÷q{EÌfgÇÓ»ËËåãåìø—懳۫ë©8ƒ=7'÷¤ß“>lS=¬7þ¡NÎ.®§ó[ququxv~1»™ßXDpòázz99E*û´y$%±½±}± ùˆñçOÈ’àUh´­¥‚¬lÈõ¿ÝpàÖAà<¾éµÞ÷OÉŽEç»B­MíæqZV‚:k ­Í CŠõbÅã:IÞ*œ¢ ’$ -Ee7–+LðÉÿ+mʤǗŠ¨ {¯Ò†h³j‘svÕ_"ºÃn·Ä»h•»N$]Èv8cÏpà*®_bò8YcÏxZž‘­q₼á Óo<©I€ðýÍjÇA’0V„˜!üÿ _mÚÒЀé»FVòtî|%¼-ßÐ[J­jýâø6à8IÄ\]äÚë -FúŒQ9gíV9ºÆ®s/bR'òê -}»Ü>ò½I!¬¡ñfî@ðzM+dàgÛEueR‘öoeÜMß9ò½#¨Ñš }s¦NµAqsÔÚRª ¤Óù‘õíè—ÙÆnº5Þ­J.qÍ UNQÑi‡¶+Üo‡ N·j¼¾Ým‡=§5vØw\m‡­ój;T¦Å…†wbõªUâ©“×P«ô¥¨ñÅ3ІK–ŒÀ®$bÊÚ®pýƲ^—ÑUiìãÛU;mì3|• T¬wÓ„Š¦1uœ ‰­wÁE–ç\6—:ñ“©D,‚|Эh¯o÷?:·pº­q§[Ñ=§5Šî;®Vtë¼FÑÒÑI\ÚÝZ$bhH*Á¶¢¥S)ºÉíÒ®—H¶pvÈà2^jJAâî¢v96:S§-ï32¤üÝ6'°FÑF1ÚRÈPtµNÏrØ ‚@çr™•tWÊ…ðúLµ¨k6OjìCÍ”24_ë¤è¶Jù^U•j€‡…uÇíë­3‰©ÿ{ãݯ1Y+¬®($ÖvX]¬`Êäl€E´[Åô"Æ覉ei¤ù‹ˆLV6¬!—YQÙ=àŶs´tÎïöøM& 16t ó:l.3Ò¡ïï SðªÍÛ퓨+ß8¯d¹q߀^ •ïÒ3nntäW¯hµûœ}ðû•œ‡Ü}kâù“YÓuu‡E5ãˆô˜¼clÄþ<é70új”ºòÑHe®5†‹šŽöƒÊUÈà]a®G‹$ -òDozeëÄíÚ@ã)£þö‰gYÊä0ý•Ïôùô¬÷è%n^©t(Õ»ùe£:Š–µ*²U]Û`lj.©t@%4íUŽ±ÎÀZé”±µ5Á¸myU:®K]B¢ÜÖºZÌê’´)k‹€ì.jzPͺîñù‰xã/¸«­ÄXqÄ×õôû¼î£¡‰æ·÷ú‰:X>°V=Bž› ðþ®ø÷jH:: èðw¶wðŸõð?ý8Ø´ôJxª£Et,KX²â…z•±³õÚ¦DÜbøw'• endstream +6076 0 obj << +/Length 2027 +/Filter /FlateDecode +>> +stream +xÚ½YkoÛFýî_¡ va +°ÆÎðe (?Z¶¬Zòº@4IÅB)Q%©8þ÷½!EYTì­›E€hwîÜ9sîchÙ³áŸì®°UØó)TôâùžÝû 3?íI#a÷´°=§ÞOöÏ]¯'mÚao2%‘IòÑ:ùùx49»é”R– Eàûur;êKkÌ££›‹áäbøö4 Jëv„Ó×7ý@Y“þ§É‡½³IkÛÚS¸ïŸ{?Ù½Lû°g ½GhÛB†ao¾§]%\­L?ÛïýÒhá9ÝãU§hí;±!´RÍ1•ÛqÌ›Õb1[|î\ǵâ|>É÷Šeg³tQq7Ëã({ÈKÓ Íïí~‘çÕÊ4.ÒjŸ“Jãñ{®ð¿7hsHbÙ’$)f_Ò‚ûïîf‹$,¹ô`•®½Öe³—Ô¼›-¦y•Æ¿;ÒvŽO¯ßŸÆZœÞü÷¨=#F£Ó£áíååZäçËÑÑ3+í Gã«ë¡8…57Çwªž«>hk=h¼ˆÂñéùõp2WçW§g磛ÉC +/N®‡—ïQË»}Z<Ø^ÏÞáþy”4¾³P¼Êo Õ}s¯Åp'D;lm#· ¸Q1[T5L§-ÈÚFñH¹Šã´,§«,{ªeÊ*ʲ4õîŽ/lpÂïãG`‰ÝI!wÓÊ´J¾y’öÈ«)õ?ií¸ñ| q—®*çß];à‡ç²ÀR + X \_ÈÀc +LûÇ ¬§¾Xù +;>à ¿Ðýƒ»›„±2» Jà¤]¯ØÏ2–Jf% æ8þÿC»Úº¥e +Ôï[yÅÝeT–¸ò‘䊄õAÏ·¢’Eª"ZÀz›B#ÅFÓ„%Pý"]ÄÅÓZ M-‹xV)¯|œéAÇ}”`¥”ŽgÝ“µ)TÔ»ÿ a¡uœ‘U9À"•ãX³)-s×R/ë#45¬44%Hª‡öyX‹Z£ c™‘G„s4¢A—†Ó¢È¹­­9êIÉ 2úLZËÚ€Ù ÁöI‡[‰×Ž'Ñ[•ýW¤_%@´3ù⌭:¥Ê®”:žômS p;~nŒVÂöCÖñ3ÔKf\¿ÿpv²……v…çêÿÃöÃ㫳ç›+(H´zûæ/^ÁÉõååÅøâb«–b þº5÷+¤ùgJ¤Bg„úÎ B(Ú ßpø‰—3Óc +ÄràµV¬tÄѪLQÒ³júc;&8c\åÅ HLqWºŽgƒ¯wCmC­ã†ä lÖr~ <3˜i”<ñ™õuVG*MXOˆó(VºA G:Âó”çã³ ‹²%×£©wèá´ÁóŸ:b2„dWF Á0ÛˆThaBìq‘å‘9lYc)Ÿæ7H}Ó"ŸøgÙ«/xþ|e0u<-œPn`ÚÞ»àò×p*Z¿€]$\»ÖÚš<¤O\Ó³ ÏQÊê1²Ó\Z¤â9¹×— >fƒA/£…ï… }Q 1©¯é Ï v•h  uÀí"I °~‘P‘¡0‘­–%~%ˆÍï;ÞŽPŽ»Ã%DûoûÐ!PµÐ¨OaRZ²/ÕþcR”´~DDÝÍÕä + ÆsÚ„q!6Ëšrx"\‡š÷•cÝwṖ˜àÉšbùÍýÕ9Ç\Ÿ¹G\’º&!NˆM*Áù|Ê¿”A±±4 Ü=MV íŽ:@V6<µü.”°ÝKJnÑ(:pyÙs•.#GËMή`btzqSû†k×^¤¸WË•I#h&Üøv  éJ¯åµ‰ˆóÅ´Ã]]ߤk”䀻ëZÌcêo_‹úç])_4xÄÀvm»›`¢ĉûu´Èfµ8³Å4½nP¼) =Žæ(q_kêôK »®lîHáëðUÙ\¿%›;ÂV®((¢¢±uPÀ6f‚U}Î#Ðòc +³8Fé—@ÙDƒS8TæﶙöÛGnz²)‘ I¥y‹™"Ŧ¨0âá×ëÉÆÝ&ˆ¡8V‡Ø±Y+²-üfÒ7¾Ç:?ÀŠáäÐ±í¯‡¿b Z+-ëb¯?™ :ž"Pýq D{g5w;€«¡Ü}C.ÑßÝ9@Ä‚+€xóQïZµ˜¯l>“FÆq8á ÿ)×›IÉÖ&e€@ú5mÊïÊhZ3èYU/Ya7U}ÃÌ@¥#Ö:"•'¤ßÄ´œ +¿¹Ù_3#ðŒ°iûHD_¥ðD¸ù=%/šÛ粂BvÄoZÈOå÷KPî÷'‚c"@ã%"€HÅùˆš”£ 1ÞdŒl° à±zŠ·Îé>ŒÂci丸Í )WUºÞp›# +R‘j +IúÚõ +Ž@Ù쇛a¿‡;ƒ‡©Þ ±§Ãᥠó¼<Ûi_ÊÖ·|©Í§º@ mïøk†ÙómV 7ö»òí3y&Ù´ ü ÔßWendstream endobj -5784 0 obj << +6075 0 obj << /Type /Page -/Contents 5785 0 R -/Resources 5783 0 R +/Contents 6076 0 R +/Resources 6074 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5793 0 R +/Parent 6069 0 R >> endobj -5786 0 obj << -/D [5784 0 R /XYZ 85.039 781.388 null] +6077 0 obj << +/D [6075 0 R /XYZ 85.039 781.388 null] >> endobj -1638 0 obj << -/D [5784 0 R /XYZ 85.039 444.99 null] +1674 0 obj << +/D [6075 0 R /XYZ 85.039 417.891 null] >> endobj -5787 0 obj << -/D [5784 0 R /XYZ 85.039 410.85 null] +6078 0 obj << +/D [6075 0 R /XYZ 85.039 383.752 null] >> endobj -5788 0 obj << -/D [5784 0 R /XYZ 85.039 380.966 null] +6079 0 obj << +/D [6075 0 R /XYZ 85.039 353.868 null] >> endobj -5789 0 obj << -/D [5784 0 R /XYZ 85.039 340.319 null] +6080 0 obj << +/D [6075 0 R /XYZ 85.039 313.22 null] >> endobj -5790 0 obj << -/D [5784 0 R /XYZ 85.039 312.614 null] +6081 0 obj << +/D [6075 0 R /XYZ 85.039 285.516 null] >> endobj -5791 0 obj << -/D [5784 0 R /XYZ 85.039 271.967 null] +6082 0 obj << +/D [6075 0 R /XYZ 85.039 234.046 null] >> endobj -5792 0 obj << -/D [5784 0 R /XYZ 85.039 231.925 null] +6083 0 obj << +/D [6075 0 R /XYZ 85.039 191.278 null] >> endobj -5783 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> +6074 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F58 3380 0 R /F81 5323 0 R /F20 3021 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5797 0 obj << -/Length 2451 -/Filter /FlateDecode ->> -stream -xÚÍYYsÛF~ׯà* V™# f‡«R)År"fËŠV¢ËNl?@HaMJ+ÿúícp"˜ªøeK%aŽžîžž¯É‘ ?ráªh„R¨0Í×'îh 3¿žHK1±$“Íϳ“³_Œ?’®ˆÜh4[t|ŒÐFfÉ'çÍåùõìíÍx¢”rd$Æ“ 7ï¯ÇÒ¹åÑë›éÕlzõ+ö4 Jçý5Nÿ~3•3c¢éU7}þîçsî)ᎿÌ~;y;k5mu­"TóáäÓw”À–~;q…ŠÂÑ´]!az}z -£•í¯NnOþݲâ9=âU‡¬ÒPL`g‘gŽ[ΗBûªµœ³RDÆô-g\a\M––`YØ®ôÀjƸÎe1V®ó[÷§.ø[¦ób™gßRîf°`ÁÍùvSÅIR­ï°ï;ób½Y¥ušðtµÏÖI§‚FµØ®Vð}²¨… ¢ã{ìhhÒ@‡ô…òi‹à[H -{´ZÙ#Ùz‹êÕL¶ÃÒó…ëiK¯žÆ^èÄøç¹O¼H:sìܧ𠜯8ä6Âf}Ï@J”Qg«¬¦å<ß³vÉb`­´"›-pÉjõܱ͹ƒ'^9Ÿ]©ÓURÁùi8¹f»4—§dù„{±Õ7æXfkT%­qÿ¹@DÄ!ò"Úx³ Ð)µ~ÁŸµÕ4^ÚS&WŠ‰{Ü—4_óxÃWÛz½mýz ~à‰L =š—hˆB¡Õò!Ä‹}aÒõEÀ8&­¡y!nP¼HIoGÞu™åuZ‚Éß¹(ÑÚM7ËÐ/È<éØ ’ötóÇ®6}ÝŽ‡% -4“†×ñ=xT$wöàI×°Æ€NÖÓ B+T 8„{5o‹QŠîw“´ÁDp0éHÙ8âÀD€µqÉ:h+­8)O|PÞÇÐçÁäï‚ñÕìÌC±ÿ‚öÙÇk†²§ D;PŽKöجNçõ¶L…Àå•'ÜÀ?ŽÃŽf‡–†l:ŒÃ#Ò:î‰;ŒÃž¼‡Æ ú8Än{`dðšÂÏØxà!Ó U_Å¿GËëøVe ŒÑ©€q{B›àñMŒ|9‹§mþBw€á'Å…Õ< +:´’âAá—,—»ô`)ÉÚÚÊ&‹ΩE Ûl^gh«7ú·VknsuS®”<•pÈ£e¥ÕqQ4“”†aŠv†g¶*â½òÖJ~kq›R\`äêYt-ïY,”6Mm5¦rˆk"Ý…8Ÿå ©“ágKÇ£}õII\•Ð`§8Ž¡íãÄ.Âw«tm'ÉE¬8Œ~«UŸpƒN€T ¾r.Ó2åE1Ó–i’ÑÁ¡ú`î"çñbqMk:.÷ž2–® >^m¸Õ¡ëD4v¼zþf×÷y•ì˜T×e¤ˆg5«É-‰ -÷8ìv5Å‹éˆÐªƒPøpøëû›ÄÓá<¦}áË` -r ·,õ^6lB¹Š g¨®6óuï¹BKÐÛ7 Ž$Û_cª­Ñh{»l¨¡  ºŽFsu)&éµIùnO4p6]ËÑEjŽzšZ¶“_N:á^Içà Bk v&Óš¯ˆYeo‘kÆbQUÀ·ãôé’Á@€Á‘üÌISPåS¯!Ñ0ân˦ Þ î°†K‹üŸI7ñÖº7·mî´€¹è mæÑÆ ñ•7ºBI².¨Ÿ¤t3˜^ÊtAÁ…| j’' š–¼ªË"_ÚâšÌ±æD”'¼†ìßœ24¶@*I°‘4 –˜½†gp«YZðÝu¡ºžZ«õ|7K:¯$}æö†¶ÕÄŸöú§I…²XsgÇáŸî³ù=79H.ï;‘¬Ì|¾-_ø,TXBjÔs¿ïmèÐÒ F“öÕ廀ùÀ;Z¡©\CúGße”)î¾Ë(û.Ó>´0äÁœÅÙAèsÛYÉ#¾s}7jsèã÷ëÍàk‹-ñeªÿÜBéb·¹e™ÚìÈ…ÈN”ãÒ&3Øeã}1N´5 Ï™uœ[rò -LW[[TaŠ²ß˜EÜrCLd3ˆ/o~âÎŽÆTö4¹°úJžj…Ù{À±ü')…ÇœôÉÍ äG à!«¦œÝ3Jù^ÄÏ8Ø(Úfy;µŒ9Û¹ìsÉî06s;ÆUîž…`æ?èúUͳ֣a˜Ã a¿ÚT‰(>»RY©u«ãO/#à ÍV>³+ÓCOS,vŸzº£Ç±ñÁÂYL ºÈ«×\ê©>¦@ˆV·¯weQÔp3žÙyjÄþä=ßM/ÞžßÌ.?K¥ñ—XŠGþnøî›ÇëôÀñqÉßÛó÷7¿_ý¿‹½ï¸Mª´äëý°>{¾ÜØ= í°Ò¿*êUYÍu2†t ¿âÇÏjWö:õó‰n©è™²¬ê.–™-‘¹Ú{Øv5gÂe^meœ2ÓylË<ìœ60³ø7oß“VòCE 4ºy1Œ=šÁèMO¤ö¢·ŽÞ¿¬Š±Â»ºí}ŒŸ²Rî­Ê?þУ ÔCøÙ’?ˆÚ38f¡}ÐŽËš»ñ½hê+b£Cƒ/œ¶ù–»¥3¤Ãx…·R -Û•8Š _· ƒUV…«j˜¸ŽPL!¹ˆ ì)'‹~Á†zßÚMp(œ*z8ëØ’§¹âÐjkOl—5“e±íŽÙ[[ÞVa~uñªwÓ±ƒ [,}ÁH[Ï*¿6÷'Ú±eqZÆí%Õ¢ÿaÛÈkÕ?†Ò½+?íÀ/ç»þ“Õ"ÂH¨€h> +stream +xÚ½YmoÛFþî_!à>œÖ»Ü]rY (zNÚ¸@S_¬ i“| EJâU’²ëþú›—%EZrœsÃÞåìÛì¼<3;V ?jâ¬:™ÄN íÜdQžÉÉ +F~:S~†œ!#‹CÿœŸÿh£‰’"‘Éd¾¤)óì}pñò‡«ù‹×Ó™Ö:P‰˜ÎâØo®¦*¸fêÕëËWóËW?á—¢ +Þ\á𯯧NóéÇùÏg/æƒcgF˜H㹟ÎÞ”“ XûùL +¸Éô¥PI2)ÏŒÕÂí¿7g×gÿêwá13áU'n73ÚŠ(‚NsBóÇ)#”Q'¦Ud„³ñ£ûÐ* ûp§»ûXPÆDY%b÷‚ÌD)‘X;ü« +DØNg*ÈOHÐÓµ'Ÿ&JH“$š}bô°†ç—¥š<¯€£É)ˆ”oáXNÄ•r'Ìá·©3AµUÇI°H·Ü©Õ½ï·kâ÷üÇPÖÇ ˆ6ò›,ö»&Ͳ¦„e7ã®h×ÜÛ¥ÓÎOË%Õæu㹨¸m¼›Î`-ÍXK¿Gµ¢hgÚÉ ÎËê jPµÑ"’!tÐÈâc]50%„ÙiÃíu +;”¸ì:)Óð€Ì÷¹iòN¯#p4‘Úüh½?|í/Ð8 Ë¼hðR.à äd³¹çÅ’Ûû)L]á•äè.w(K\³…³t$Y\‘ +VyË”éYžûsj&ì·ȸå»ÛÕ?¬ ZY4£V ¿¢]2¦YîGIè•ï×÷~¸çôKšœÕCe…7«óáÍ,[Ö†æ¥4Ž2Á-UÜ­SÏ!|‡Ð®ª¯±â¯ +íWÙàƒ´²]ƒØ`dͤÂÕ~sØ—×l [,sþ(+2¶–çz±U»¾+6"^n»û¤°fs„ k¦^¼ +¨þX}e!ø!‰‘¼¾ewPî+ߢ£Ò`CÞƒ=äÁßÄ ¾cßÔv á¢8©«ªýÛtfC{pêþž½äv¿IbƬ Fô[nwu±G~z:Ðœ©0±UOÃá™yÆ[f¸.yZp˜©X8§9ÒðfDZv†Â×Ã+Âãè+¼£-¨ÝZ¼¬¦Z‚Ã’›±›ÆÁëÎVÕj‹¾÷WïQp¹äIBÐ>n˜tQ!äîp2šnÞÒ&¯»ÞÓŽ@_6ËýgÞŸA!DUûÈ]µN%‡PbO‡íá rd0#D¹(?­DOLä01Üì@B¼âiéæž<ÿ‘3Á»ÀÇ è$Iª%w[ïq8ÏÀ8ÓÒr_T%8o›güÙ섵9ù¦‡\¿í–»)ºyèeòMÖ bƒ +»ëÒØ6ï$_©ç7åOòf‚¦¢DÖ÷äá˜L,’ØŽÀ í£ñ^Ü®ëŽä)¥g:]yͤeŒVÝÊi¿†°Ýí[h¾;•Ãi&ñ)ýs°ç«_‰‡›:aœåe·´ w™K·ã•Ž™öŸ£ +¸k±]bˆµhŽU2B~àbÆž„‰¾Ä`¨¤eîÀ˜˜KÅŽC’"3 QI`eÄw&N¸ ’°aè÷÷HŒl‰HîµÓ*ößêð‹¸ÿì¶&xK¶–QP½kØÐBkDF#K{5?¥üóüÝ•·Ÿš¬hóE»¯s GJ… °YÀm#Edž`0áÿÎ`t píócÝþ_ƒÜ}Þ`˜á‘Á„.*8i4Z +Koo4a’ŒŒ¿Ñí×9÷ß^¾2’»Ï€üÌS ÎÏ0”ºk˜œüyþ˴ϤCí X»aŽöµf*„·›ûïÍFs³¹é•1Ò…‰1 ´.xÉ ‡zœ@÷v¯~ÿÈãСÍh/CcDã|÷.øýã)EBb-ÂóŽrGÌÍ׌õ :#òà пAªLý LT¤q7éO—qâ>ˆ°Ÿ§´¸à4€HµƬ(Fqî‘ñ¿-v;ØÁCVù6¯Ñ:q ‹,ø‚£ó9 uOøÐA½§ÍèÞoîmྠ¤MÎ|tôô!ha +„îRNuØ?6‡Bã‹¢ÄïÅK|`yû?N€‘ë’“YzÊ¿"¡Tç^;’5‡ÚœÀwGo»[ìþ@RyŸ‰Rq»ëÃ9ê*­ó)“‚ìØE®O†N3§ómq‹< šÂAY‡ŽEÀÐôžïŒh¼¤öl.«Úûz’ˆ€n(~U¶h=Uš¡¯ã“‘²,¯jü( xk… =žè-{ø–ÕpHA@SÜØìñ~º“LÏ¢_’1÷<"mf~[û¦“hÙCèIï¹íªÛ¼ò…ƒü™9£ƒ—ùøåÙ=Ê8(ÖyV€´E÷̪–Ýsk˜[µÈȾå!ÿ4„^ŸËmvL8H Ì7ݦ›û¿òã\­fŸ§”´õO>ï‰ÌS[W£‚AKpã5ï£Ä(Ä)GH8ƒ—€§Ò+ +m +`Èœ ñÏ>¹Îæ"©¯.³ùÙ'ªl±&zR‘ \=¿u• Þˆ‘¶Ÿ¯²]¢aÄ!W*°-Yy9*ï†ê +0Ö—P ßäDÔ\:¹gbFÕ¡Õ¶jZÚn¿äö`l¸lÚo»­üÄ!"Ê{ðzʆ_Yß›uÓ‡þCE–„‚à —Œº8†ÔÒß1È›ì ôá®ó˜:_V]Ù‡€3FZ®uù]¸´3ªíŠ‚u¢úhV2FSÅ Èš¡åËû7â%®Ÿ$,):ó§t¿!“:ˆOûà½ß.EèbƒK_§ÀB‘œ=%ÅuG×­(pÀ f, äJþ ‚PzØA×sÂå9’Ãbò–_Œ:6OrÏqñÅ}»â‹ù&¥íK/c3¦Š/íÿ…:Êõ²û|¥ÁÉ£„Óf3~4þSfè_endstream endobj -5796 0 obj << +6085 0 obj << /Type /Page -/Contents 5797 0 R -/Resources 5795 0 R +/Contents 6086 0 R +/Resources 6084 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5793 0 R ->> endobj -5798 0 obj << -/D [5796 0 R /XYZ 85.039 781.388 null] +/Parent 6069 0 R >> endobj -1642 0 obj << -/D [5796 0 R /XYZ 85.039 761.463 null] ->> endobj -5799 0 obj << -/D [5796 0 R /XYZ 85.039 741.134 null] +6087 0 obj << +/D [6085 0 R /XYZ 85.039 781.388 null] >> endobj -5800 0 obj << -/D [5796 0 R /XYZ 85.039 697.701 null] +1678 0 obj << +/D [6085 0 R /XYZ 85.039 575.409 null] >> endobj -5801 0 obj << -/D [5796 0 R /XYZ 85.039 656.447 null] +6088 0 obj << +/D [6085 0 R /XYZ 85.039 543.191 null] >> endobj -5802 0 obj << -/D [5796 0 R /XYZ 85.039 615.8 null] +6089 0 obj << +/D [6085 0 R /XYZ 85.039 500.097 null] >> endobj -1646 0 obj << -/D [5796 0 R /XYZ 85.039 370.916 null] +6090 0 obj << +/D [6085 0 R /XYZ 85.039 458.844 null] >> endobj -5803 0 obj << -/D [5796 0 R /XYZ 85.039 338.699 null] +6091 0 obj << +/D [6085 0 R /XYZ 85.039 418.196 null] >> endobj -1650 0 obj << -/D [5796 0 R /XYZ 85.039 154.463 null] +1682 0 obj << +/D [6085 0 R /XYZ 85.039 177.602 null] >> endobj -5804 0 obj << -/D [5796 0 R /XYZ 85.039 120.323 null] +6092 0 obj << +/D [6085 0 R /XYZ 85.039 145.384 null] >> endobj -5795 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R >> -/XObject << /Im1 4096 0 R >> +6084 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F35 3036 0 R /F15 3032 0 R /F59 3455 0 R /F62 4159 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5807 0 obj << -/Length 1851 +6096 0 obj << +/Length 1406 /Filter /FlateDecode >> stream -xÚ¥XKoÛ8¾ûW¹TVŒHŠÕ=¥éË6õ6.²@Ûƒjˉ¶¶äÊJ²ý÷;á¶çP´°øÎ g¾y0Ü‹à÷Œb‘L½Äp&ñ›IäÝÂλ w¡# 4¯æ“ó·J{§Ø…HPjS$—L£ Á^èȉA¨TäOaRîšl½†AQÞ‚ñtâ7w9 fä~µk®u±mhíu]<ä5«’¾}.ɺ€ŸÝQ6O¤ J -óÌÕzšc,8"Ñke¯v±jZ¹¨\ ÀÑ#Cˆ,wDâ#N°^m¶ë¼É—à‰Øÿ…P©îk¢XÖx“\ëØÂr±Cbî#ó:ßfu¾$y+X¨œl2 *'­mÉ$HýÆqh*¢¹oÕÌÁ)qªü÷yíŽgí ch ›|»CÛZ˜ ˆÈ½Nÿ Jøö²ë%(Âj^¯@QŒ»ˆzàTá©Ç5®Àjv=+Ñzĵp`¡‰ãú€†Êh|6³JtÓå ,Hµ›žá¹ñß&öëÊÉψÛMQ: 0hC«8n/ÖE^âbn:G"#³˜ÂÚÒÙ -ž+œçX3BF$;çÝ=_ÿùt…Ë“ÈíI,pc>.‡\G²eCyž'‡Âx%C™SÒZ’Cq{qÂ9¤"¨8q•ƒ¡ÑÙ(pF„®Ä ŽÇŠq%\jŸ›¼Þ”€X@3ŽnwG ÆÕŠ¾×efgðÂɽÊ‹6 ˜úG»XÜÞ¹<›Ü¿C„‘ýE<åž‚ʆŸôÏ€æiµDÏyè”ÀÎE‡G}4”h3™¡ )…àŠ­bÎNU¹pm{ˆ¥ËWhí sôÏû|×Uù¤õ –GFž¶^OsÂzŽèYëØ[ï@â¸õWL.2â-¸íØb"¼´6ÁZ¹ ]‘ÝÚ -ò_nÚ|m|L¨iêRôÚ®/š‘pï1  ÅÁÔfJ¨²”ÿcc‘3“¶‘9y„)têQÛ^]Ve™ -åóÃŽ‚kGä²½Ò^ØC:/ð÷ÖÙ¥¤–`áƨ¯Tl€”‰õ^¢¥œY[ãà©—]-ÂÉ=åXìf™c•0‘`GÛ’± -ž(ÛU$Ú_å4 .‹ªì:>,ÜFwNÆŠìHï*¬}ë%qúNŽ§=ǶlÏ<ÍhÁºMWðt0ë«Ò‹ÝˆÛ¤PLF-Ö•uZU.£†àØuÐÊ%"uÎfµíÇH™zwæ,^/óú%à - -êÇ’¬ D§s õC7ÖÁË®L -èþ™Á[˜†¾…­ä0"Æë¶ö"qF;e¶i¡‚« Šò:©WXø)¤ûcC©áѳ_C®2Œ.aòL„Z[–9x -,•Ùynkr^‹ÇÐvÖ²]…¶xŸ:]l…ÿEãÅ}]w=©íCœÕ’„Å6§õp^d®¥Ü&ÖPRjêù`~fbEYe6ÌCÒxiÂdlžHc/€°eö¼Fò_Â!ÿñV^AðH‘Ú‹Úÿ±ÌCÔ§¢ÐÀÞõŒ¢^â±?]á h5ÕåÌ%F»BM<ò¶§´Æq߬\Ò`—·£AÈHô±uÛ5Äæ_´ãwÚës6ldÖ oí¡²íÖ¾1™ÃQ0ûá7¹à¦‹âGÄ€mt±Á‡Gj—'®Ä¬‚ƒ±¸G¶.:`„BmöÌ0Ïá™Â‰Î›{EpmÿˆCØ,W·ðÂR@¼· ¢ë®û¸ÿö8–£9S‰îÅŒ…‰fRË.ø†)ÅÆ …A*çûaàB»þµß±uÅê¥íÂÉ0.Í8ªuAŽ]ˆIˆ )ÖÂpí¸l¯ƒîÞ]ì©ÇcÄD:þðvø­‡w×èÄ’™ŽGÂ~š·ºØ ÓGMŽ’†)üƒÊ¡ÂÿÓ› endstream +xÚµWÝoÛ6÷_¡m“€Š¿©¾eiÓ¤ÀR/q°‡¶Š¥ÄFcË‘äûïwÇ£Û‘»aÅÄ$äÝñ>~wâQM>~΢T{?ɘÌ]ô æãy­&JK¦• ëÇÉÍä í©ˆn¼.íO¤2cΩá™R<³©ëî—$ÕBÇóí¦-ʲ]ÝÑ:½ ñæôöúÃU ÝÒøûå›·§×³‹O\*üG6áÄW7ÍrÝUͺXUh|=G½òÿIìâ™[ÚVÍתù®>'ç|ß©’ÌHëµû”éìªî*rl·ŸöóD¸øþÔD¸ƒ½bži‹vQµIÊã×IªÞ¬(R>e\5mG‹z˜-ánKÓ¦zÚⲩðz‰DwA¾”ø΋M’‚,êgb7ñ'ª9þÖë$pñâà=œ„£ÕŒÛ#)’ +Ŭ‚G•³\ëÝà´‚(® ?´Îž Dð§46>¬ÉÁh¶M7¢Œ`R¨#ºHÎÏq“ˆÍCD“ëw¤‹íóåÃ6ØTåÆkkÎ2å`:"X3Å9mÒ.j- +±qA²|D`ÜðVO)î¼çê­_krnlšÚïxÇUåvˆ‚öØTÚ¨W+ +ïX' # öGƒŒuIÌË¢+žÙ ‰ë{CHû<0bçUÒ®hÞ6ߦ>w!7 8ÀR +k¿·A7—:÷n$¥´`J™žSíÕ_¡†<†`QÒÅ!ŸŒ‹‡b‰/ü€÷/FCôÁOÀhâ"^¶tc‰¸'ò¸óóÆ©JÚèêW8±ÁfD,½ER°[å)§çõ Õ P¾²[x.&n +²¶·GxÛ.¢=m %HqràO‡Ñ–ÔÎÁ KV¼¬6·¡ȃJ _TDT–çr,t…a’»€©<ß=2åZQ”GO H{z?z ­ó¤ÈÛO.W2‹ÞÔ Oô¬Ï@Ý J€‘‹1±ýè3j/övÓ3@:ùœ³Áe¹^šÙ*–뽤>žÁ³Œ1 ÁÏwnëz€üݤ~§Âd¹~ €§“)BAÝv7óf¹éˆö¦YúRŒs¨J~,h8&Ë>YÖÿ¥&ˆïcóé}׳oFÀNÀµÙ‹D +À(¾càè2.x$ÊEÏ›Ç^TW•€*3ñ_¾QØ6t™ƒ5VRÏcÓô—7>¼<†ý¾öy°q/Í›? ‚Ÿç"©_€3Û>”+ð›<¾¨šp½è'ÈÐCYžƒßÝ”µÝ  +rv¼,l{8dtDܨ6÷§Í +¯e¤Œ%åÐõ®‹’ˆ,Ã܃`ï‡ø"r`þuYaêõÀ˜Yã¬ûïý:m|8z +FªSñy?Mô·ÿôË¡^#mÔž¯F:Ö»f¿âö a}Ð…á.}%œà'Aª÷ZÀ6Ä#)úÕë‘ø×–q§Ç€ÀµÓœ(>’€_ö-â½>ÚðhõO χtÕEè%G† Êò}¶L©ýnG²J –s7´S¢Ø¸¢„{’ps`F_÷ýxE9÷Ü—7_úåÃ"`¹/ë 골ü—/ö˜°€Å1™A?ö'Ñ«Cp}×ØÂñ…fÇ󽂑àmüendstream endobj -5806 0 obj << +6095 0 obj << /Type /Page -/Contents 5807 0 R -/Resources 5805 0 R +/Contents 6096 0 R +/Resources 6094 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5793 0 R +/Parent 6069 0 R +/Annots [ 6099 0 R ] >> endobj -5794 0 obj << +6093 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 667 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 5813 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 6103 0 R] /Length 44246 /Filter /FlateDecode >> @@ -24651,1537 +26333,1498 @@ T;8 ^ ô¤W"‚ÅèJkÂEÚ,éJ °$•jÃ*bÑàêÁ%ë‰UÔo×ñ¼p”OÀ ¢Šù±¶K‰Ó–+R8ɹ“jêùaâ„çN¦"ö<×æÄÚåŒçÄ%mŸ$í¤£|~{!Oýà…ƒ¸TÕñÔ^8x‹:úÁ /åà…ƒŽrðÂÁ Gù%/˜æ)ã¯ÅXøX,åyÊ1Âù‘e‘ÍQž¦ÉGŽr”£å(G9ÊQŽr”£å(G9ÊQŽr”£üûR ™Ò¨û”f!ãkßøþ·1‰ú*yÿCÝx:žéQ>gQHÒxâ©Äa+^mñ¿M}0AjÃ÷U Êã™å“öQV«TÅ4Ôj<· ‡CïÆÂâÜœÎ]Jý‹*ÛÛ •*Ý•ƒŸ‰®m©’gWÖ©1ápM>Ê'-RƒóŠór@XQ¤3ŠÕè$QD”œtêP ±™œ—øÚš²Õ)Æ䌺®"BšŒ8”¤£|Vƒê)¶WÓÕXŽ¦%áN^¨$ sFÔ3,bj'Tms¾zO> stream xÚ`ŸÿVVVÌÌÌ777úúúGGGÓÓÓææ溺º&&&ôôôsssÃÃÃèèè«««£££ââ⌌Œ³³³ëëë›››ÝÝÝØØØ“““îîîñññkkkbbb{{{ÿÿÿååå=c?^endstream endobj -5808 0 obj << -/D [5806 0 R /XYZ 85.039 781.388 null] +6099 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 613.295 147.083 624.985] +/Subtype /Link +/A << /S /GoTo /D (small14) >> >> endobj -5809 0 obj << -/D [5806 0 R /XYZ 85.039 758.673 null] +6097 0 obj << +/D [6095 0 R /XYZ 85.039 781.388 null] >> endobj -5810 0 obj << -/D [5806 0 R /XYZ 85.039 758.673 null] +1686 0 obj << +/D [6095 0 R /XYZ 85.039 675.326 null] >> endobj -5811 0 obj << -/D [5806 0 R /XYZ 296.792 374.51 null] +6098 0 obj << +/D [6095 0 R /XYZ 85.039 641.186 null] >> endobj -1654 0 obj << -/D [5806 0 R /XYZ 85.039 324.568 null] +6100 0 obj << +/D [6095 0 R /XYZ 85.039 572.448 null] >> endobj -5812 0 obj << -/D [5806 0 R /XYZ 85.039 304.239 null] +6101 0 obj << +/D [6095 0 R /XYZ 295.277 228.986 null] >> endobj -5805 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R >> -/XObject << /Im27 5794 0 R >> +1690 0 obj << +/D [6095 0 R /XYZ 85.039 185.299 null] +>> endobj +6102 0 obj << +/D [6095 0 R /XYZ 85.039 150.553 null] +>> endobj +6094 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R /F41 3054 0 R >> +/XObject << /Im30 6093 0 R >> /ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -5816 0 obj << -/Length 3043 +6106 0 obj << +/Length 3150 /Filter /FlateDecode >> stream -xÚ¥ZYoãF~÷¯ö%1l’Íà ,àØ“‰ƒÄ£µ‡ É-Ò3©!)Ï:¿~ëj²%QšÍƒ1û¨îª®®¯Ž¶Õ̃j–h× ÒYœ(7H’ÙjsáÍ^`æý…Š…,,šo/¾ùNG3幩—ΟÇ}´ê`ö˜ÿê\µ||w?_Aà¨Ô/â8q®^ΕóÀ£ËûÛ»ÇÛ»÷Ø aP9?/qúÃý< œG&º½§¯~úöŠ{ëÍüáâÝã é H•¢˜Ÿ.~ýÝ›åp¤.<7H“Ùgh{®‚éÍÈéê0~uñpñïa+ž g¼jJ+†nâ'ÿ;P–öô$;o¶P>,ÑáÉ}h•ûpËïï3ÜU¤´ë{ÑpWQ8SÊMµÆ»J=7T 'ßwC¼=¸«»”ÛÏÊ)µ*Ô‘NÝ$Q¸ãìÓL¹^˜¦“Xm’~< |s»Q³›ÄœY’ʶ k_’T%–U)?u£XÏ" ŽbuµÛvYâæÝ~š/BO;Ÿ±]V0^á@ä4uõÆ­vŽÇ‚éªÌ ùdÆ?ÏýÄiðGûQFÊ~Í­ëŸrùÀ{¿Òê¶+›š” ÿ´ð¡ ¸½†Eå˺.r«sT(Ý0 ŸágDzd‹@…Î34ÛfÃ'];ä„AâÜ>ãTà”=“äÍ|¬‹®þJFà@ñp å|£É R”²]õšõ(M’îúf“õåŠG¶s?uÚ²î Yš£KQï’ÓÖ¤ù&'­Ü:ú4qúF¾ë‚«ª,ê¾ãÎp³ &ºÝjE¦I¼s>Y"½Ñîd¯¬ÆFìÐúÞ˜N‘¦é2v¨î - ÇKäÂä8[Uâ#°Ž¥éT[Ri‰;öƒB<ßY.o°8h(øí›-Ï4Ï2`”î…Îj¦û…[“¡%¨ëVm¹íy ¸Å·öÖ¾³b‹Fý‘„ÎãÚºlI¡ ³7ü‹‰[Â{0Zï¿øÚ7‡¬ÏÐâ¸r>íŠ]Á$x¡ô]Ëúèló”1¥Ù¡ç¥¾Ó­32+¡~6¦‰Ä¡ÊïÝ5÷Hò†[£($C}â4i¡©ksòU ½<ôaaª]F3Ë-þ '‹ž\yñl1D‡ÿßó[;toŒ®>Ž®:N\?æàzù› -ÂÍÚ×N]ôÜØu7ªm¯.¹‰tø¿Ã{éŠ »[¾¸‘VÖ|«Û˺Ïò \:hœ±-˜L¸Q‘ݺÙUm0µŠÐÉȶ0@à©A\qˆ‡SÌ >ò3lߘúž²œôÇ9Ãpþ?°ó$ÂØ^I„ʺ^dÉêœÇºf3.º Ø$š5yªt¦Š³Wäzx‹Y-ÉF„œ±Á¬cX‰f™Dq8¼éxœÓO v^ZæÚ£fÞ˜ÒòÞ`ƒ+ãȉgËßÂܧr0²j6Ûª`‡iíUTå†Ì<ëeŸc%PΟ&ûÙ2MU™>HS*Cp¦þËm?u¶…žsÏg.$zIB‘Œü{÷4Ýóú<2\É+²YÃLÉV‹Íº‘@Â>£L9Cô'\Ô_HNbèý ‹ð1Éo (vЙû£¼-÷Þcz’Øy†O%C×ö2‰>ÿJ`3%mµë·Æ5ÉEå’AVL\’1ÄŽÓ ÅýèÈMøŽö‡P ¡‚ÀgTŒÄ^ùuyÂÇC|vã4:ëã-òñ¡²ë|O¹¡ ¡ô¿y*>䧼ÈM ÒŸchhŽ8îE¥|7PþÇ+ÒdCi"µ1B'’/,éFÉñ&¶R‡ Üîz.“?l¹(¡*þ§DY6åŸ=7RT?l1])†ùDÒâûÊÕI*Rìß3yÕĹÏzz‡ðÁKØI7ö%ó;>j%ŒÍ¾(÷Ïõ'ûVð8ÿ«hP,·Ž1÷VèÀ¤ZÌž(r–ýÛ„ü±r}¨«˜U…Y>æ]WvmPmœð`\ƨwXµ‡‡s¹˜ŸúPžOJ,šÓkˆ¾d°ç{ÈqÒ`mŽ7cðýìÝrpÊ~#¨„¡¶ûÍ^$¸¥§ª‚mº¼¨WÔ»d×~÷aâ"$žÊ;mˆ‘Ý‚Ç4¡ä -l9ÅKC7õÿŠtœüòŽ`xBÂ@ Ñ®¨Ìd{]†I`ûÌ©òdÆüx4«SV§=uÞªFš3V%D_´ª3 G«:à8mUGŽñppZUçVµhí”I  =íE¼À "ccó8vÚ”ùqÂoâåhä;ijS8ÂÈMPj6S’ IzàH"Ç'Ïã÷#ˆî¯6Gô »)&Ükì»Z3lìÄ=ÎD½ ~Ñ3åæÕÜg—K~°Y[KG[üòsë1(uÆš4«ó)ŽàA ? Ü*ª¦ÎîýXü“­ẕp·t ûdRahgô2 - Y6:屪À¸9a :[0®þÛ²ßdÛ)ébˆÒ«Ü\ê_Œ7ô,k_—¼aœÀ,ÈèóU¹Es³BôEÌža8bö€ã4f-Ž×k©¬º)@‚vã!gÙÃcèGxÄÁcpJ£Œ‘(ëøûÐ<÷P+öÜ+k|rÂÖR~'à¥5@á$¼¡S¡yjñœ¡¼U?q¶€€¿Äc×E‡ØVÙÊ:ÍÓ› 0¶ñ>oŠ×r ÕÞ¾':–<ÍG¶™RÕò#‰ÿŸ¦—r& ´]CcwÀ’o2Av†÷Dèñc)Ò¯bMpÃHˆC˜’ェŒ&?r„΋y| šô±ßq¸SfÈè%"³…œÑÖÒH)nÏJéÈÊçeÑœ”!ú Î1uÈqP6G|Eì×¼¥bн%ØÈ*3Å9vèžÎ!PÊõ™ªj]y¦|ÙQÚ3Œ¯E5•×ø,,o‰H5¥$Ýðd‚ÓKF›§‹ÊÄó¬oߦDöCWE&qò'DHÝ(ÕÓIü^ù±²Ó+eŠ“ú&D“ŒÆX‡¶8üÒÌJñ¢³žœßaXXrûýz|šëŽCê#£Ç¬ô@ÿ"[2âòAOê~´^e$òg ÓI£åÔÞ†BzØÀ€n²Þ9ÿ”Œ9­ç/_,š3¢/bì Ãc§1fq|8‘ÝxV>õË<Žð7Ä£?Ha2ðS¸sA½gp§ç1ŒáfÊÙï9Ó¬ñe©„ vƒÕÅIB‚çOjÓ›‰Ûý[½2>¬nœ¸í:•‘…0%‡òjH4d­GÿðR…³endstream +xÚÍZ[oÛF~÷¯ú +¨X‡×,°€k'Y‰ãµtÝ>Œ%ÊfC‘ +IÙõþú=·Rv± ç>gÎ|çœïŒ¢füQ³,öÏÒLù:ËfËÍI0»‡žw'JF³È’»~¼=ùámœÌTàçA>»]ÓÛÕ/ÞÙßN¯nß\ÏZkOåþ|‘¦™wöéj®¼n½º¾¸¼½¸|‡µ•÷é +»?^Ï3íÝνýéäÍíhÛEäG‰Æ}¿œüòk0[h?¾Î³Ù”_åùlsÅÚ#-õêäæäïnî‹fjÐçy{G‘g¹LkÚ©•C€ufí¦©ëbÙû¾½‘ƒåâØOÓÔ)6V|rå{5œ[:ðÛ?\ø™zW žþ©Ã}àšóÈOÀ˜ + ¦ ±¿h &å\9”=c{³ãÊ®£MAåËJ°  Ki¥Óuo$Faèühom›Ÿ¸™ö*–ø/ÁrÕ}Qìî ΦÑØÑìª/pgõ€ý²I}°É¶ÅÓ –c¸…ºåx"(É‚—\ŠrÃÜë_u|9q>º­C?H•ÜNÕÌAÓËyLgÅ%Žï>ŒýP[t\±ö¨í i?ËíÂë¥Y-zUzkV{(? _`”Ó؃‹^Dyäýã +¿¡WöøÕÞSYU\ÂËhªŠGó`Ã=¸ŠÙXÔ÷Üj¯ 4ÂPZ-\pX³žPV˜€Žâý³_š ¬1ÍÅïÙÜ¡ÍMÑ>í„nT”øÊY&è$#2‹šÏ¹A?ùlu”øa’îéh¹k[ €WgÙ:fMaKÙñ÷;Òêºé¨Ž ŒHël¶H?Õñ+M¦2ª°'ü#?ª f™È6áûÙy„Å‚¶ldû)h%õ.Ö<~°å8€KU™±úF¾vÕÎêB¾¦^ñ\¶\[lAˆ0ÙÉ¿5w|*Œ Êê½ûXãm k×IˆÂð£Ù¶BXêŒCöRûg 6üÌqhQ%ßcGÎ.GŒ}Ö]´„1ÖOé6ÚŽ<«AÑ:ž@¡0&õøz45pñÓJGø±,8ÆêóÇ°^Ø5Fþ˜ÃUß>ïóqÐÇ£¶Ív!&/#H?í…/¬ùkpÔãDq rÈ1¤ÉØY%³,Â9XuÜT7Ô—±âQ¶š%ÄžRrWe³ë› ØÃ’«û'›¸%œM îó„–P5f%+7¼ +4LÆ¿ŽÅâE¸¬´àb±Û-irAÙQCÁžnöÈÛ¶ ¶ë !XÜajH¸*‡ÿ®7vË …3\bœhF{D7v_pg¤Žcã%#ï”Îé˜/€R³IÝX§DšßŠ‰­¨6è&5õøülÓ@äŬi1ðÎIžx·F/•¯ƒ†#`sFþÅÃò°Ä«Ž[ÆÔÌ»`½/;Û Z­9^uz#¢ Û\t1­Ì#!½†›>]žq½çP¬äT2ƒùÁ,–Ì„!9y=á`1Ô~¢fͯџþC{uÑsˆ)ªm¯^sѺâ]qç\ñV¨×þ³Û×uoV›²žðdût@@ÑõÁ=áÒPYÎ÷àâ:Ðlcе³ŽÉ¶[«†2äʈß@ÑÐN­ÿCÅÉF‚ÂþfÙ–[ñ-Ð|}Á¾¦¯q—š4Ùaì×ÌŽ.›Þndª°ù–k¨6x³ZcTó 6Q6ŽŽ ?’§ÄÇ9,çâ?pÈ¿¯¸åÈÃbãHXè©DW%¶KÐ_v¬WY†qÿˆmœËÝ“_Ê3$—ÔY¿‹}Ví ö P{ ÷‘CMàõöØ¡–¤¤`y;r*áàL&‰º>¼5Mº­ƒ /¦‰Kô(”Y•ÂL5ůãÄÏ# µï‰B×L=\¨Ð&„2ÃfJû"VœS§t¯DúÅxk ”÷ýéÙ^¸÷”àh^/ŽÓéw%è…ìÖ^Ì””Ÿ#Ö«r$‡ÝT`Žiž>6åJ²7Êxu’xgm‰‘ÒshHÁ´r–ÒsÛ9@…\3”oŠ¾‡ƒuú,[ˆ&Âßš»ªØظ…ÊûÐt2)8!+ã9Ú¹°¡¿’ýi©f#»…¯…­4Ž<$ˆ‘ŒÔ"GHöÞðÌ„-9Ù"€kbŽjãEÒR?MŒÙ=DAy™ã(ÄŸ"ÎfÙ‚ùÕLF +}Á鼰­b>Ó|æêˆE>s˽  W|¤$öŽDKþFÐY™‡1M×sñLlê^V ]±ÎbÏ¥wĵtHÉØÑ À}˜+ÉáЄ³ˆù |1.ÚdrU¢IlF `û’øŒ\7Tî[ÞµªŽ#UGQvK)òž-‹ñõ,›Í¶*z‡-Y«¨Ê Aßô²Î±ˆýæÙ(¾æÙá£:q‰ëBê÷%V°E]` L¢À»æ3to1*:ÚKâÐ~„àw%.=•hRñÉ=,8fŽHRmè^pþløBV$Fì¶!†¯¶0=9åp·åÚ;Œ`ó´Ý@°KسA!(Ú`£ýŽWI÷)5v?°ɳƒ<,—¼–Úõ¸Û®Ÿ’k ¬\ß'ËGDƒ‰@ßóãS7 +¤ƒ +þÐÁD‘w‹?" b$ŠÊ—2«¢ª^Oøð<õ3­¿­wîSR 8?µ$"Õñs©ª†ô~$½[íÛ–­¼ô†¦-©Ó=êýÛ↯É|aÃyüp¦Ú'Ú^:D{Ÿ:™êDüHX£Þ[˜“ƒc4ó½¹+)Ýì­ ƒ»¦‹ïzëø3æÓÕdf¶Ç‰)³ðš¦(öÑJ¥ß +ÎéÞ^a¸Hƒ½¬ë–¾b™oî¥vQ¿øó@Q³¹¼Æ7äÄ»üÈ3:¦Ap©Y¬a¾{6* z¤8÷þ?³×ÐPÜ"Žýç››cÇ딤GÀó¯ç×çùýWž?qµßØY† &nìó© ©@c~r† r9 +”Ù·í\ ÍÄÝ/6½Å{Æ…eÎmxäË çä#÷<áÀ=D:ö.9Únyoo+L:µ}3&l7A„Ó]ß,&,ß>]éšZ2B¸Þ;b±ÿ2ñ£Óø‡ŸaÎóÚsCvuç^> endobj -5817 0 obj << -/D [5815 0 R /XYZ 85.039 781.388 null] +6107 0 obj << +/D [6105 0 R /XYZ 85.039 781.388 null] >> endobj -1658 0 obj << -/D [5815 0 R /XYZ 85.039 489.543 null] +1694 0 obj << +/D [6105 0 R /XYZ 85.039 411.914 null] >> endobj -5818 0 obj << -/D [5815 0 R /XYZ 85.039 455.403 null] +6108 0 obj << +/D [6105 0 R /XYZ 85.039 377.774 null] >> endobj -5814 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F41 2994 0 R >> -/XObject << /Im1 4096 0 R >> +6104 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R /F59 3455 0 R /F35 3036 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5821 0 obj << -/Length 2727 +6111 0 obj << +/Length 2582 /Filter /FlateDecode >> stream -xÚ­ÙnÛHòÝ_! „F Éæ™],àÉ1ÉLìhmÙE’F¤$"<’²'¿u5Ù²Žd°‹ VwuuUwUu]t'üs'q`;*™D±k«8ž,« g²†•ß.\Á˜ ÊÌÀùuqñôUN\ÇNœd²XtÛÔd‘}´ž¿¾š/^ÞNgJ)ËMìé,ŠbëùûùÔµî:¿}s³xsóÎ|ºÖû9.¿»ÆÊZ0Ò››qùêú×+ž)Û™~^ü~ñr1œt8œ*Ác~»øøÙ™dp¥ß/[%ñäÆŽíÂruç´_ɼ¼¸»ø×@Š×ü ï:&1ƒ›%^p^r¡kû¡$çÁªo+?4%8vàø$9 éº ¯ÀO¬7uק%\½,àO=¹Ö$†Ö|ª\«éú»e‹P\Þö¸Y/Ð"ä>oôª(óŽ7Vi½KK¤ù×>9³ë`^Ôk†´[øu­å’çu(î)yû¡¸Ñy Œ8$78b;®g‡Ûλòw¬%^¤ÙÁ)Ú.GžÙ‹D“eZ3b»“^ŒýF6,›ªB2€êZYÇÀ‡M±DBž¦-¬ ~ŽÈ.~™ÎàožeSfLº¨qµhÃ[F^»-@;b—; !¡ñ6°9±î‘ÑÄSÈPr”4pæ‚$r+Ê¢Ç} 6ßI ph[¹‚ñ/°…Ȇíûx½ áÄ‹°‘ “ÛämþÅ „·e“ʲ‰Š—lómÚæ<§ûã C9ãåZr\- -„çldm…|ú];w‰Ç6äà'$ˆ¬Á•‡ÍÎÖÙ'¬2 ÀýÀ* œC«Lb[Ej Cïò€™ë„vÄg¹iœóì\°~åz{ü¶­6<8I[9ʺKÙ:Sžâë•áè\aBJSýã]¾E¿áZÕF uZÑÈ·|}Ž'fýˆ9€u2½2c\y+Bm ˜ŽúºrãUJ×$µÞy¹5{~æ42âÏfÕòZÍv€~éï§Lœl&çM`Ä9m‚ƒgõN›Àn£ œc7˜€ÁoÙlåIâ¥Ù¹)EŠý9H§oøÑTÓß>ŸJGv¹g¥bàœ”ŠÆÁSª“R9ÇmÊYvZ*&¿vG±x>}z²çÀ€:!I Ã÷.…ÃmTö9vƒ² ~ÿewyŸ¡!-ÛGÔ áÐ5?e;å"Qp]>%È[9ÖÁ`Ý ×s¡ÊJ@¦TûT{l~¶TÐ$¡´Úèv}§ øS¯ç 匦çdzlJ¬}•cýS!tñH…Jì:¡USz»0ÿ¶Ók¹VC  |Gu&d¨¦¨*¸•i„—òò‡B¸Ü,öö7í‘×îýñôßó -ø}Kî„C¹MƒuièYטhÎnç²Z°[Ã!݇Ÿxä µŽ?[ ^°UË•U'UŠŠ=ð`C£ÅOÕ’%”® S¨Ì/¤í¡´¢ø>¡…‘¼mªÃrkðky/ç™ÅrŸ Á>™ëL‹=.¢­4‹´§’l´eŸ{)—‚)Çq®\ÇD–‰TEu)|º•‘â¡åžªv ²ýÈ?ç œ¡ ö7jp»Qdv!\‹Zð†®¸7ð|“/¿r' -…P"×^߀5ZK?¢šÊK„1µ-Rêcä§nãBªœÏZ œ“¿±âžŠyYðeÞ?ñ¢¨S*@¤rE`Ê?t“¾/%MãT/§Ÿ¯ ")(µg4-»äfXiÕcxyÍëDQÈôlhBw¦ùý4­Ô$¼M;n=¬Ùøžñö`æ^d;ÉbHïǧ8wÿ#D; -â!,‘ÎæOÙ~¨cñ?Ѩ¼£ä¼À”æ·lj|´ë#ô”g;á@îHêîÛI¢ñË?‡¤{‡Iˆ;d“ø{E½š¹Q> .æ…Yz¢ó »Èùá@:A8,¨]W -\ŠØKhðâ¼8…¾Æû-£‰‚.Î-rœ+Ê÷9K¢ÀÙԼʿÑh€ãŽP+T¨O¬›¦—eB¥tÎ÷öeÜ64;8Hz,8‘6”þåTÚa—äïÒì;ãÒ¾? ó¹´©9á-ÛœžHßpˆ;ŒImν¡:Gn^ Ê¡Õ‰íÅ:)Y›ù~VKbÂÀ†G#øô =pNçéØ]ñE å…?¶rG"€ùŠ -@8%CýGÙ2ôV`Ü¥7öh–vŒÚoš.DOtqäQ„ ”$üùûA,Œ!Ms÷Ä i6eJœ.Эka8.Ý£äP¹ÖŽ¥å†wèu F§Ì ®µÙ+…Ó¥‚´j¨ãÜ ¤:ñL*Ø÷L¾²CIåia™Ã³!ž8¹I«üÙ'WùGLåDãa»û'v¤}úWðŸ7õªXÿ•¯órûSøœw¼MëõŽŠ>D¼nê_ÆÒ]Ù3âx©Å÷홫@ÎÈhwØÉ…Â,ãiYtB ›>ú±²Ek,$ŠWµÑ©Ê+ݶ쨯³¯¡ÌÄ8Ì^¢27\“Ð98# Ý£þ`×·fßðòæýÛ·—C=kÄ;³uºd¹œÖò·«öžWë|0äÐᬠÝn«Ëˆ^V8ûq·Ãmü­ pšä‚%2C®É‹@8Ñ—“t…ñ=€OgL‰Qù'évkÌô§ –R„€“>ÑyJ2dìÖzƒfàÇíWGÜå10©Ò¯:oìvü2çn²¢|ÊAÿ ,gzþ¾hê´düyë+OØ"ì -€¬wô•d™âé+/¨Ó‚¬Š÷Òè.;0¬ÃËV†Ž_›Ì,‚õ¦>e©øÓæÅMÄ£2 -`Û=U"¤*5#xâg–pø>‚À_ñÆmפF~æ8? ü~Tq,L'tÒrH )#†îÉÞl‹£3 ]¶îöë§n<ò÷¬¡±£+”Óú½iÙ凛¸z¤v§|ÀÔýíUZ”'ŠåØÞÑ.;üç þO_~ÇCAíp¢SxØÑg¡Ò9LŸ7P±ÄêðÀÿ¬y~‚endstream +xÚÍYëoÛ8ÿž¿Â8P¨Yñ¡×âp@/Ûn»H²¹ÄÅÞ¡íÕ’m!²äJrÒü÷;R–c%—n÷Ã!@LÉ!9ßÌPrâßœÄðu2‰b)tO›²‚‘_N¤áOŒðÇþ5?yõ6'Ò‰ŸLæKš2Ï>z§ï^_Îß\MgZkO&b:‹¢Ø;ýp9•Þ5S/¯Þ_Ìß_ü‚=Dé}¸Äáß®¦±öæÓÏó_OÞÌÛÎŒ0¡Æ}¿ž|üìO28Ú¯'¾ÐI<¹ƒ¶/d’L6'&Ð"0ÚöË“ë“÷\xÌLxÕÈífnÆLû"ŽÍØ +^FŽˆà“/£‡—„ ^ø) yÊ`„çu:U±wÏü/Ê)oY~]m¥Š궻^4ŤÙ1ùMÓ@§n¸÷.­2è–ùt&=Kûäþk¤Ö_¦3à‘AŠ‡˜©H¨HOf2‘ Çí–‹(Ø[ˆ²ڄë€QHà? L⽯Ú.-ñDü«ðT+8UÂu´´×A*oñJaäýL‡GÊmÞ0émQ’<`áyZíÒyÞó؇ÚEµâ^³…_é-8£È«nÄÜ”ˆâä‘êN¯žVÖoKØÃøÞ¢Þ¡ð[mÈqZ>ÐÒ:Ž-qŸŽTm»(Á²HÌ#‚Èj¹«PËp¶VŒX`ŠÈ…)`^ÿ¿àâØcaâ K{=I¢c[ BïÔÚ´hQx|ü@ß’l­`ˆòuç¸Ú®¹+À*i¸·N V¼ÓÌŒW/ݤü˜=ƒaF.õ®DµgQ®_ÜäF:ò~'XÑß rÛîn{²O´² ì +í¡Yˆ­XåO«ñEh¢?¯sõ—ëü´Þ¢‚ª Ò”Noû(›CNøD±ˆA„Ììã¶)m_½‡aSC„€èγþ>Â&‘Šìøg?8n$B%íøãâ…_?Iþ¼xõ_.Þ+|ºM¨£JCô‰í­PÒ*dýÕT+ò°VÀi67¹Å0¹c I?R}~øËAR@zLèÄèwÀ„ö£lqÝz,ZA³ÀÞºèò`žuŒ}TƒÎrJ)Jt‡9J»Ûn),Õ Fƒ§ýöhþÖæ]ÖVSbDU3‰¢úŒ?L5¡ “N-«(òV5¥5 +‚%JIYmûë¢e +¢Ã Î¨ò¥>1é^"BbÄf¹õûm\ÞAÛteÉu5â«*R"£^ +…ÝÈE!Ä™ÀMtÇ_å7RÞ ¡¦i-P7Oé +¡wVŽ×7<3åP;Ó 7­Ì!~#r)¸6… +‹‡¡Âá8Ò›¼L;Ì”°Óî8‡‚Ô‹!Î[ã±H¨œ¢0°7b­ï6ˆz¤ÿRœìÂ\Ó9æË®~ñž{ cF" [þ–h¶ +ÝrŒcCIøL†ÏD¤ÌÄ<ÅÊ1_R³"šGÎó ÞàA¾Ån…éñ¦&gÁ¤x¬-™T[“‰ÙäPËf~.ÄíM¦@ú94ë—ˆÂOžgý~¯¤b³íãéfˆ¸dmÊXØôø™:TF:$²¶…Y‘Ú'öä*+§úÄ9fn3Üë +3´S®NÈ/êŽ]kQ—èkaÂ'-kT°@c×漪èl9Rsÿ+0ÙåÍ=S1Ü ë¸2fàK˜žòÊßIÒ6Cn™v1ç_äC! ¦+ßÿöê?—Ê£k¼Ißìuj ç׳«ËS$¾Q¾1]%cŠ«° §ÉÐÓÎÞ§÷-‚g"{ã‚E5¦”Ü&Ãim½‚3;bHlZåÔo댎g`”nPbØé!Ú\ì[k}Q½€‘ˆKèGªŽežvTh±I£,Œñ®S.ïRŽÏƒzT â›bS,énaS¿ÔþÞõ5UßO¼ H%dôØ B$L¼ H‘ ½ Hžß{͵ýé:_Üð+‘+Æê~"o¦öÂЦ'‡”Þ òÑW­‚Ç^¤ˆeòtö0Œ¹,á2ï^XáqR•SvãxôcˆI"GÏBHŸ"6N©¾I÷÷.wÙ›­o@¯¬n´-&ôXæ·Ó ôÒa*¸M[º °¤ßŸÆ`\Ôgúüûé«ÃHÚüc„y"¢ ;—£õHÐLèbì?áì‰eóbéæ-ê +}q5ÂO+Êп‘t6L¸¿ùæd¸Øu˜Å8EA@n÷×YvéÊ!Q\?÷a¡€odop._¹Í èšµG€Ä6¸fÒƒg ý°Œ¶YU,¢è0‚Õ¹’¹/kऱCLª+åßÁ›“vocåB–©½ùÚŽŽ<Æ ƒþ1¦/@ágMïHTäk|Ckò4»çNþ­Ø»ù£sdEoê‹®nìÂ&‡§ÇælVm¸É U/¬†Õ0ëÇ­F²¶jÝW±3#•{Ò¥³_ì•Ž<öÅr‡~‡}ùT Ëhïë‘mÁ+uäJ:Ú‡{mº±­´ŒÖ­}Š¡ým59X;",ôcý"‰D"ÃÞ‡‰ƒ`³4¾"Bhd> +›J ¨{ö¾½,V#;êDĉ;á–J-ûäÔ¹§õ²­p`T8»X¸¬)Öçw­F}Pç…Od wÐB|ô3J"(TÐùiKì\€~úâ±?Ä7ÁŸ±"íÒï™ÊÂúŽïòrû¬ùœÕŸ¥ÕjGU%N<¯«¢«Ÿsó|™îÊŽ'î/5¿ß>q•ÍÆN»Æ·_.õ°[­å„‰ƒ;úX-ä[ÅŒÓÕà,߸çÑ®§VEÝÛ=ÐKï“A³Ùåð+ [–¶ ®ï8á[ÙG9¸òŇ³³¿ wñAÀ¦y!àœ˜?š(Îõ:­òÞ¢CŸPžnx„S+Ùpÿ[;s0ÉOǃg_éST((nìÚbðù€fÁTaÀ q/né]ßölBÍÒÖ-ÙŽ•ÖpS?ðî  )(›fÕ|3ÈŠ¡³Iol8ÂÙ»þó÷éʾ¦rºˆÙÅì ¶u•–ÌŠ¿yÝpgY»ÝðCÈyGßU)®Àx*ŸÓ£2>2*^{øÚ}œÂj?æ‘o»VT?ö‘UCÊ÷bú¹:ÖO8ü¼êøÚÔPoendstream endobj -5820 0 obj << +6110 0 obj << /Type /Page -/Contents 5821 0 R -/Resources 5819 0 R +/Contents 6111 0 R +/Resources 6109 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5793 0 R +/Parent 6119 0 R >> endobj -5822 0 obj << -/D [5820 0 R /XYZ 85.039 781.388 null] +6112 0 obj << +/D [6110 0 R /XYZ 85.039 781.388 null] >> endobj -1662 0 obj << -/D [5820 0 R /XYZ 85.039 761.463 null] +1698 0 obj << +/D [6110 0 R /XYZ 85.039 731.788 null] >> endobj -5823 0 obj << -/D [5820 0 R /XYZ 85.039 736.114 null] +6113 0 obj << +/D [6110 0 R /XYZ 85.039 689.441 null] >> endobj -5824 0 obj << -/D [5820 0 R /XYZ 85.039 682.515 null] +6114 0 obj << +/D [6110 0 R /XYZ 85.039 635.523 null] >> endobj -5825 0 obj << -/D [5820 0 R /XYZ 85.039 639.141 null] +6115 0 obj << +/D [6110 0 R /XYZ 85.039 592.148 null] >> endobj -5826 0 obj << -/D [5820 0 R /XYZ 85.039 612.042 null] +6116 0 obj << +/D [6110 0 R /XYZ 85.039 565.353 null] >> endobj -5827 0 obj << -/D [5820 0 R /XYZ 85.039 584.944 null] +6117 0 obj << +/D [6110 0 R /XYZ 85.039 537.951 null] >> endobj -1666 0 obj << -/D [5820 0 R /XYZ 85.039 447.474 null] +1702 0 obj << +/D [6110 0 R /XYZ 85.039 401.41 null] >> endobj -5828 0 obj << -/D [5820 0 R /XYZ 85.039 410.607 null] +6118 0 obj << +/D [6110 0 R /XYZ 85.039 364.544 null] >> endobj -5819 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F78 5831 0 R /F35 2976 0 R >> +6109 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R /F58 3380 0 R /F81 5323 0 R /F62 4159 0 R /F82 5560 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5834 0 obj << -/Length 3121 -/Filter /FlateDecode ->> -stream -xÚ¥Ymoܸþî_±pQX du’H½E‹\â\$Žk¯›—û@ïÊ^ÕZi#iomÜŸï¼Q/¶œ¢(gÉáp8Î<3¤ü™ÿüYºžJgqâ»*If«í‘7»ƒ‘_Ž|áXËbÀóóòè§wa4ó=7õÒÙò¶—º:T³åúWçÍû×˳ËùB)åø©;_Äqâ¼¹¾˜ûÎS/.?œ/?œÿ‚= Dß¹¾Àá/—óD9KfúpÞ¿þüókî)×›ÿ¶üxt¶ì4ít­RTóûѯ¿y³5léã‘çª4™ í¹> o@O7ÔJúÅÑÕÑß;Q<¦g?1•k× b×KS9lœ¥ )1W؃ù!g$n¿ŸC#sð‘=ãpî·Ïíâ£*öÐ9È;à(À~"䶪YHuÓÚhŽÃw²ÿ9Kñig@¨nyñò€Aƒ´¦¨Õ­(ýÜܼðôuçPûÖEÐ:U?ÄíT£¾›†á "•fF´>@5Œƒš¸\zÎu¹ZÐ+/ɱ=‹Ø©!~„ò -7šgeËäíœÛ;s—½¤¾ŠÝá‡ê÷<¤þ(έ/t“0 õ1@Â!FÊM:8Í̪@ $„ }@ƒ|#'Šœ¼)O¤¹5kŒC4xÅt -“¢‹¯š©7xŒÜî„Ì´€ô 4^á=ÏiÈ“H¤LxDAÕž'  ƒ¡m›Ô™û¬Kì¬3p?â< tW p\mð ב9áÎàî )˜qtiðÞUÅžkH3r\©Ù™)Þ JéÈyÏa&:å2ÛpW¦eØ"EIŸU£ Ú¼*™~‹{ž¼Ñ_ç‰æÍ&ÎÆ 6ýöÊ2[ ¼ µêžFEb»™¸A‚P˜ Øf³•ˆ“ùŠ}!&ŽDÖÉÌ}Ã]†wä8fÓþÐÇ<íFi,NVÞÞMåËÈU‘Í^Ç…Iä\7{ÀZÁßÄï]W:p§°ª‘¿aj‹Q²åDt0ã×õj“·ÙªÝ×Ù1Ó¾ùJ“Ža µE0RñøSUÞa¹v%Ëé[ö./ iZC7Uy›ßQó}Vì¨Ñ »Ç'SÞí!2?WeÞV½œåã.;ý”7í—[¤5¯Þ€Mꢃ xÐMŽ'Žàl´Õ¯Äh>mQU'è‰L`BÔuVVmÖ0Ÿ¢án“owŒ=låzP‚j\PŽ±ÔÕIØ•Lå7Ï×wS‚b@ÒôGÕ^@' }„)Ô5`›‚¤²fØ´;!׃è†8*òVà·š4y—e@Y8ž¸ªŠ -=r!«!{Åñèü²™ÏÅ&ã ppY±FÔÒÚçÚJྦ[zÈe]¹h2‡U­¹$âa,º0ý·¹œ -Ð5U­´[X¿ƒaÆ|Ž-_Dö¥„)­ -¸2¼¯Fúß'ìpràñï:‡¨¬Î¤ ›(9Öp„¼X byœÚ}²ÇÚHÊ@a™ßm¤´Ó~"ÛÙ3`…‘…Þî¡lJ©²FÝ•K´†çœW­Ý©ÖC—pØØf:*†¡Ý'RX Ž†étc¡ày¾éýH cPšYc€3×ÛÐ Ÿ¸)š í›Ç•NE¸‚ˆ­¯iœSIÑ -2Ín‰Tz;(Zk?—„Œ9A«Äù^“) L#Êñ¦±•O6íð‘ìÊÚX Jì;°¦³úÜ|o€õ®¨Œ{âhþ©­õì”}MÁs Óv6Š}F ‹ñ&ʸ4q£îVÅgˆÙ ÿÔŸ©v°|u1qbq‚nTâw{ÑÃÖŽ:˜¸+â‹@ECÎÆW¡ßaB×Hw» -Ê|…ƒÝš³^ÐõŠ)[1:÷ä€ v S4ÞÜž^¥šÞrÐ#«÷)W¿ti|~½Z¢ÓÔ{ëz§X^(tا¢wNЇ½ÆŽ[ ¡ˆ`ŽGàà˜: -•ói›Œ -_oàÄÚܳ¿NèÊõ<{ ï«"Œ¢4¡)Qrà;÷¥8lòÕ†ÇC -ŠxèÀÊa@Õ tŽßJs!GãžY8[È¢£êá­á«z’ç (²c<È4vhörlq’„ØHŸˆï™¡ºàg’Ö1aÏ”6öa>1B_–rƒy>wkå|,\óŠt"Œb~3Ü?maµa> -È›ð~ Ù:òl9úßQ{ßÆ¢½” Î1”4‡‘˃+ -v¶t?y䱚î- ໓‚î³›  ór¿ºç®‘©› -Y#Ö¯ä^kixè|É¿7T ÓÐS¤Nb;½Ù˜šŠ{h?}ãaßS$þ0§@…ӥφûr3S:tD‡Ãº$yœ£¶sQñžª$B® “Ž‚¨UÝEÆÒvuE›ã‹âz?ç›m¸BLÙÒ:d! ®-°Ù‹ŠÃÈÄkË0ûøs® ë)%' ÃÝvhÌÑIˆ<6½d3ʦw<Ö™-¯ X.Zñ'ʽ­H5 w‚ÃO}M¦e`#Ež…r­½}òø‘êÉ’‡¼Î0Y@uöUöƒ,ãFdPrÌŠB$áuÉÊ€'2.Ú -e£K=×Uë§Þ©!G0Ï+.vùf -d³âSn“°yKWÞ-w O¹>ÿðO&ð-±¾oZ#¥ºaö»öî­€ö³¾ãþ¸"Õœ'Fl`Èç·’j”$}ž¦G"¥"—¢·Ü‰’;Š+tß0' ‹¤D²µ»ÊŠ«†‰û†ùØŒÐhk¹Hc[dïËu_²uxözŒŒ]pGrC⎑IE]>{*úÅÈl~M@Cª‡:éФ ßhiæ¿ñš©‚N\å¥7Â@CóãO;=Ë‹/„Ÿ¸*QãB%/„ˆ@ -.u{:â>´ãîð hî§òpx3WlhG÷êÞéy5¢°®æ ”?ó[0L{xi§~äzáÙjÏóâs¢Ÿh7Pl\ûܤ4"ÊÞÞÿTJ'´/'œ?J\¯{FüŸ|?ô9mu+ùI%“ŸG”†mؼ}G%îècÒX®ru—ä¹h–n«^êÎ~t™ ŸÒÂÝìoú,„!üŒô^hÃtÃ$ÅÖ?Îsšª¹cÙ¯¹¾:»<ýùìϯ¯®¾~¹|{ÂCçËŒüãìr£Â¾âßñVû¼·ã—:¾!ALøšU*êo_”è‚ ¿%a[j4~xAR@) ñŽ.ñ‹Ýk7ß– -0|Ó»xÓ˜S‘ÊÒ^è0Dqö5/j¿ÎÆ|€ØÏ,úaçVtø™èQ¦<ýpdÓôé €§<7H§àþØMþ¯¯àh‚å•Ncf˜øV<œ ~öiÞ~-¦ðÄøò¸endstream +6122 0 obj << +/Length 3031 +/Filter /FlateDecode +>> +stream +xÚ¥YmoÜÆþ®_qPQˆø’Ë%—FÑ"ñKlÃQû\µHòaÅ£$VwÇ É‹, ?¾ó¶KR¢´…aÜrvgvvvæ™™U¼ˆà_¼0:ŒT±ÈM*cåî$ZÜÀÌ÷'±¬ˆie§¾[Ÿ|óZg‹8 +‹¨X¬¯iÉzósðâÍ·ëW–+¥Tár•ç&xñéb™zñáíùúíù÷ø•1>]àô–Fëå¯ëw'¯Ö£mWi˜f +÷ýíäç_£ÅT{w…ª0‹{Ga\‹ÝIªU¨S%ßÛ“'?y)<—.˜kæt+·b¥¢Ð˜Ô3Ö3ǼZ®’<¨–«4K‚_b•žzÿþ4Äo8Èž-ÿ´p6X»¦Žó5Op®Þ/ôLéh%’G*=ƒ¹BÁ’8¸ h°9 æL‚€Òìk\Ô´,ìÚ D“ 1±`™Ù-áG w¸“(a·^g‹<LÆC£JpAx+1Ú« s€"N‚Ýnï†ïû@»¢*øÕ7üK‚7ÄxÞÐß2#ŽiŠ N‰ÞvÕS¦/xÉ=.©at!µ­Q«Uÿæu–Lnn2Œ +>HWõº”ðûR%¸=1™1ºJnÄþ2#µsíæ^àöU»·»jFj–‡*¦¿‚ÉólVv’†y¤eÝ­Dj~IhFFy©´`âÒq&¹ÛöÕgwyå‘œ5NÁyžê “PÇŽécÕ_ /âáµÂÿéþÇ3;æ10;•ÊfG±a÷ÜŽ·E§<Ç¡3Øžýn¥´󤘸Ÿs‚Ô$“"'7OýH–¼µkhƒ²ñž¸¯A/Á06ëЫ݂Ã(ò|°Bäc‚5…'.jÑýiAšÂšÅsv½l:zæk¡W6m[•z[^¡@»{µ)|ö£€™ÂÎv|bªÐíGbä²9QhJÖC3ÜVs.’…™Nå–+òŽãîàü¤j»9ÏÐaÞË<è3Þ…Qž?;DÁ¬T`ÑzÆß³ð,” œ¹¹ê-aR½¿áÃYþÙÖxC8j®ùw‚yˆ5óprÖI:öà$Ì ß¢öGû'Î ý9ž%œÉ…q¢À®Å|‚Æ‹J‹Üç®ÈqXà.C DØ&¯Õ: +>í7°YJЩU–Ó•Ò …T€%±®ö=“wKŽ_,a½©f”MB•¤_PUÅ¡‰‹¯§Ùµó,8ðÈTh<úVŸmÙÏ\zR@“É"¼_ÌuU”ã² îög2ÜÙ eÕœ°½€éU>›Ù–©W<öÀC&Y fÀÞ?šH¼uù ‰†Ô™Y¼v‡¤ærn*p2Zé“áÈ›à#¤¦$KÇÎu°xxKúUxÀ ×pàü7ê¶$½;Ä´4 Þ°ÿŠJµp[þ\êäHOR§lk4A_7{¦_û²dô"úriR>« n-j3œÞ@È!ˆU+”w…ñÔÜѬHÔy‡£t¢øAM_—â£%I}i…㫶²w'ÆFÖzìmi}ßìo°Ôw;‡rçùK’õºÞÂÐö–/šýu}CÃ7Õö@/sê,ïíþæaúÖÍÍ gýp¨ž¿ÄÿñiݳhÒUWA(a¥p:s¿+èPÆ'½¤ˆFËÂú¤«£'TZŒq¢ãé³)^5 Hµ2kù§«w‡­@£2ãb®€ÛLõ´2Õã&LMês!šjFŒJC•¥_+“0)sX>°³¢Olž¡šâ|pJ¨-4&Œ›H`7õ ´ö™TŽ‰9×UõÍ­«N<Û–W⾊Ébê¾ÜC‘iñº\˜ëŠÒ8uöE'Þ Èé8çÂMiCTëz!ÇRm…g9ü裷w‚VȸÃñqÛãYðnˆˆE0‚Äá‘š&Ç•`ì„B±i÷² dEQѤt?—M"þÝÔ ªªÚJ깑»k{·„Ɉ8T¯T9³l=îk‚IäZTx:º`èš#ÊØðº|;ßÍÑöƒìÖ߯ȾD¸u+|pä„ÛxN ˆ +Ù{?d¯ÎqT"â1a5Ü“FáEȤQBž™FjèÍ©„ó>ŠSÝ­^ü:~ø(=‹¯úPª/"N/õÀéõKd: þ‰oTéKø›Yëž',é6ã´ “.m<µÃ=Î0ON” 98ÔÙDV¹Ò%fCÄ#®ëoká˜(E",¥~Š£3b¦z‡òÝd8\qIÖZäʵ‘˜´ÂI˜,AéEö¾Ò縙A¦Ø„™ßaZí£$¸Ä×dó–I=åª.áN¹ËTE¨Édž릸õŒóâNn„¿¨ÿ#>vžƒ`þç´¡¶d¬Ø[ +$5À(*x&DI0N0{0®áx»Å`Ìâà-/¼­°ÂÅ©¡ÉÃ;ºÜ›ç˜¢ùö›WÝ3¾e¶»ýxþþ–K/0þ-Ï#,øÒºãU¶u@ ‚Ó—ck&âS4¸á7ÌÓ3ÞþºöROÉÛ¹ xA—†›’Ãk/Î-xãsÂa´‡7v†×RÙà7.ÀúË$ö© ¯ +-8㌀ðCT‚VñßÂ>ø§&8_¹ÝûIÞx6c„¡³ˆµÔØâlLá'ß„ŒÊpH–ç¶|Å(øŽ)¶¸Üe.¹àv3¤<Òéí3ÎPiú³(ÆO/ ³ˆ ã’R­‡Y˜}òÄsÃÕr¦”(ÛÍ· OÜÏÄü2i"€= “*F:z¡üÇ·XU ÂQú2‘€# + /o(ØXbá–os\r…S·öÑ–W¾˜—תŠß‘¸m.õpÆ¥õ‚7Æ%CÓKºe]­L±Ëíxþ +_#fŒÑŒ¯œ½ +ÁÀgó"–MpÐZ°]Vò',ÿ|LoM…߉Ɨ$fÃnбñ•Gß‚µ¯¤ª"öº¯Û +Ó$8á%†„wΙñà +3Ÿ½÷¢–dm'¯‘¥OK¢'Ê)3øeŽ~©TΕ8~ßó·¼ÖÀ ,‡MØk×/êy[L@øa™åÓùÛ0°iïºÞJI†éIç¾+¦E5?açÁoǪ}àaÝó/ÅËÓ Þ‘¿’bgzT¨¥•kbÁl” +ShjLšÏT؈~¹æàvÝjùíá>:å—L—äáð04hdÝÄè­ŒÖò¢4ɉIžq™ˆÜÆà\`®i‡5åÖ=Û®?Œd85ÙeÎœã# R¼ìö/*he¥ä²¹ç8•°ŠþÒsœUžýÁç8%Ïq +:Á#]g^~jsOn¯€öÙJb§gÅŒ:"&Âç„‘.‰þâÉßö}}þ^ï’¯?Þy?N±E8n¥aP]ðq?㺙 #ÿh÷_»®vNω„£n&>Ò0ÒÎËoF%å\9©U˜Fn1ÿ j^j’„:WƒÔÑK÷œX(R•k°»ãÕ)üã’öqÏãí8%0I±5§ÈÍ©¤é¤—q‚Û4&T‘™Ä±½±£glizjMâàÿQ[!×zRJ‡beÚò'Cè¡(ïýAŽŸ™òô˜ÈyÒ@©à£¥–úJ¤ûš[´á–ú¡/üÑq¾&r¢¹oVô’öñ¹õqÙ}ÝP{7”/>œ”ßÔÜ»W4y j›¦ÿ¿mµ‡<™^Ññsõé z¬öÏ]U¶UÆÄóõêã«Ç¿¡Óš’ÏÄSÝÓÙŸÁ¸Û@‚:›ýkAš/ “çÿû³ºÊÃxð©¯âAbÒÇÆ™¼3ü3\ùœendstream endobj -5833 0 obj << +6121 0 obj << /Type /Page -/Contents 5834 0 R -/Resources 5832 0 R +/Contents 6122 0 R +/Resources 6120 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5793 0 R +/Parent 6119 0 R >> endobj -5835 0 obj << -/D [5833 0 R /XYZ 85.039 781.388 null] +6123 0 obj << +/D [6121 0 R /XYZ 85.039 781.388 null] >> endobj -1670 0 obj << -/D [5833 0 R /XYZ 85.039 667.493 null] +1706 0 obj << +/D [6121 0 R /XYZ 85.039 626.845 null] >> endobj -5836 0 obj << -/D [5833 0 R /XYZ 85.039 630.626 null] +6124 0 obj << +/D [6121 0 R /XYZ 85.039 589.978 null] >> endobj -1674 0 obj << -/D [5833 0 R /XYZ 85.039 245.88 null] +1710 0 obj << +/D [6121 0 R /XYZ 85.039 216.66 null] >> endobj -5837 0 obj << -/D [5833 0 R /XYZ 85.039 209.013 null] +6125 0 obj << +/D [6121 0 R /XYZ 85.039 181.914 null] >> endobj -5832 0 obj << -/Font << /F56 3226 0 R /F62 4047 0 R /F78 5831 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R /F35 2976 0 R /F38 2997 0 R >> +6120 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F82 5560 0 R /F20 3021 0 R /F59 3455 0 R /F41 3054 0 R /F35 3036 0 R /F38 3057 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5840 0 obj << -/Length 2504 -/Filter /FlateDecode ->> -stream -xÚÅÛrÛÆõ]_Á²îœ1aì.®êôA‘¬X‰L3"ewFÖD€$& @ eµ?ŸsY€ ÊJ뙤I¹»çì¹ß= þ'z¾cZ*èy¾0•ï÷f«#«·ÈÏGBc 5Ê°…óÓôèÍ…ãö„eVЛηtÓvToÝgïNÇӷ׃¡RÊ9zžoœÝŒ˜ðéøúr4½ýŒ;…q3Fð‡ë¯Œ)#]Ž¶àÓ÷?òN™ÖànúËÑÛi#i#H ˜_Žnï¬^*ýrd™*ð{°¶LàÕÈi:¶Òûôhrô[CŠavouYÅQ¾éøjß,Êé0‹rÍÀqÈ,EžW éÅz6K“8«x;¼9>³ßÃ|ƒŽùì“üuòöú#š·Ÿ…²QížðLáËÞP œÎŽqÉ׸`ìþùéè×S^_fó|Rq¸âýǤ¨6aÊ›q‘dU\ôy§Ž‰ÅPð¥ÍrZÊ›4Çú£›««>ÐQY<|üÓ=v) #™í=;B¶phV’<5³’ |SzÙ¦F€ƒ 6D…ãXƧeˆbºà%/‹øË&)âˆwÐñÚ‰6a‘[uÿ¤£Œ]H¢Š€lá\áQ®16³YG–¢«gná¢c8”®m -Å3óZ¸ÈafR¾Ô•«0ØzñÇzøì÷Öb=_`¹É«Xãå› -‰l*ÆÌç.i:u†Ï6ë X®î;’ÖqAxWc¾’„F4D1F ‡,†*³K*–‚Qâ™yE ´Mã°`¤ -ÝLɧ,³]w§z=RªlÐG~+qqW‘çcneàâU5ŸPgy¡ç+þJÆ©AyÕùRìÒ]…¿×4=kklX¯BJ¬ÅÔ×ë4§†‘d > 3]$iî$ašü§ÁaרÙÊ;ª`þÛp -\R8¢Ä±ñ-aK¡Â»dH¾_p+"3Ñ£„Ržaåæ~ ÌW jTÖ\‹ƒÃ•í0ò%”Ì:: †X`¼þu $ -ÝQ>´i}'‹ºè -Ómæï ÈÚ>=Ϭºp –<‹)/ЋÜ!‡¶@{Û}SÅÙ,ß´†*âMYOS -õ‡}ºàZIsE<$3B„¡|aºZaeÎùº6æºéó•.×óʲ.ë›±OT"(x§ÏV¢U"[´;0´8ÛR !6•ðžòø Æ3 kœ=Ž»=_HS±Û›¼–>”iìdÒ§<Íjͨ˜¸dèºØN:uÂ-¿Â‚¿Æ¾îò<Ð"çBUñ–Ú9JÂò¸w†V-“’WðÛQ0Aþ@Ö! Dºæß´Ý@£4£ßþV.”ECqÙ×Õ­ì†è¢ Еð¹„ÁïhŠ5YPouɇC Ý}„e›Ê“Z¾Ú ò¶ Æ\ñá¾nn`ºÐ¬­Qµä#!Š±85NŒ´¤Ì¦–‹0oçù}˜Þ1¤ÔnÇ ¢(Ðj 5¯pÀBåLN$$?Çôþç¡$Öæ9âù$Ùâ<“$é»Iò Ãm’<áØ$-Ž³|áòÑ!%´”4Qé‰ø`ÿ-CÇz¤N!¥ÒÅ辶¶¤¥êùþíð½©d]YË=–qÑæºOÝñMËÝÒîJ×T®Ý$µOÊ‘Wä¤oúÂ9½%¿ù®6_ÝevôLß{™öÞÿ¦½ø¾¸êϨ¼œ4+ÛâjâXø±ÖÙ©&”³6ÔÏ55²œÙÃã Ÿe¾cL—ñ#b¸0<èâŠ!ˆWbH²Yó/Õ"ÛÝN.6”<«Ï‡ELÝ­õ†,o6 ×—}^ÔÓGÄñMé51iÃŒ–†º^¹Æù„ß]°Ï¸MwÔ¾Ý+Â*bI㸫Šã§Š&&7ú…æøÍK‹Ú >½+|a tíÖ“ýñ¸6•ãÕC0‰XNÍ*¤aT ¹ç3Άçèj -\4îY ÂXmç©Ï`ž]GÓÓ±¤¢ñŸdƒÁRpïLæº=Ùž}`XcC. |÷K6ÀZ<ÒƧï}¾E\j^/x¶Ô”"úŽ³…¶…·Nüɵr53ð•-øL^i89ŽÞš°ÙÑAŽˆÃß;pÉÁ< uÓÞÿnÕ~ú÷_õO:fÃÛ¸™mWè¢{ì£8“ç3<ªøi÷æ VDáŠÃþÆ›5~Ó"> +stream +xÚÍY[oܺ~÷¯X¸)¢² )R·-àcÇ'>uœ­w´HòÀ¬´¶p´’"ic»¿¾3R«µå4 Ð&@–—áÌp®1áðWLâ€q™L¢X0Ç“Õæ€O®aç×a)øD1¸õËòàåiNg O&˵!Y¦½ã7GóåëËéLJ鉄MgQ{ÇWó©ð´:¿<»Xž]üŠ3‹Â»šãö»Ëi,½åôóò·ƒ×ËØ™b*”(÷ëÁÇÏ|’‚j¿p&“xr cÎD’L6*,PÒ΋ƒÅÁß{.´§&tjäv3G1“œÅ±ê¯)‚‘kžNcå5Õf:ó}éu7 ~Fã&k§3áma¥èpÉ÷rûÛÞTÛÖSš~Ÿ o…œ, ß[á¸ÈtCÓÛ›|5õcïÆrkIÐ- +ÅÈÃXZñØ{“5Ù>.ižÝéM]Ø͵ÕÝ÷6ÈàÞ)‘Q¿Ó¨h¡»¼ÂµWè”—§rß3%Y(Cc¦ªº?MgxM½ZyVv4]=?ÑåïúÏwðç9­}ð9¿[¼¾|‘‚ Ÿ„T(c""&b2àŒÀpž­ž_g]Úäß²†ˆOŽ.þvDã³r]-º&Óš¿Ï›n ʛɼÉË.ki&Ÿ 3!˜ +‰P‰‘±Ú¤DóúùI<°“1Q‡’>~ÈË´ºm‰âbI¿wqøÙÔ²ìˆæd *ae×@x³XDC³½Ïšœ÷ŠÈ>úcü‡,/ô&sÄ£×cpÔ¬nò.[uÛ¦?üG.8T`®»Çãøć³‹‹%÷m—m¤ã¶®ª'—g> C(ýÄ!Ž É|q|y6_²“óóQ¡ºÓë¼È~Ž°³‹Ów‹åå[6ŸŸìI#7Wå:¿þyâðnóåÕÙS—{“õÏ•†–|s>ÿ<Ì'Y•)d:JlÈQ›ÿLÊà)üÇ(‘ˆòmUæ]Õ”ƒüg¸ÖÛ¢K!8»ûzŸôAšŽð‹Å’¬±¨6PÚ%t¥ºÁ¾PbÇ0µCBS…b‹ßpÍô›¦%Z,ò9|"ÔiŠK¶ìcYC²O\(læ¬=Š ®L©ïC:ÞÝd;Æ,è +A<¸‚IÁ +1æÈãù¡%Ö Õ +sÒ[+õ{YeZ¯¥¹®¨æË3.âaüXq…8&åq`”wVñ£ÈÜ?–ïû,Š«ÙyÞvïÖ§x‡ÇÕf£gmVëFwY:r'„,ðÝYlß~H¸¢jHl¯À§-ͧ~âU¤"§\V[]¹Úµôè˜ldù¦»Ë—UG–òeÂ$÷b³Ì2Ä,I„`¸§É'pŒ£o>0¿]1j õÚ‘õh Òª‡A8Ÿãªí«&¯§äXFE¡Un ˆpÉM¼50ÎÌ\í±vN#Eò¢ ´v{šc™»¸:??ÉÉŒB¤¹G¯°1`q¦âh-Ïü€É(ì¤Ë‚%~; Akܻ̾nу„H +L¸0ûM%7‰F˜§ ˜©É ´;à‚Ó®¢ßÅvµÊ( +ÜÀgÒžÐ_ +I¯¿ŒG€ð_Dzl<ÊJp“mÔŠ'žA¼N¶ÖúÚ.cP™ëàd†0‡aÒ¹“_1Ī΄wJç«m‡á²íˆ¢Z“Z¡?¬9AÂBö¤Øj[·ã*m7S‰hüñEÀ»I슔¦@­0È)1I^nåÚX6Yi +²É=Ü!Lï +@{*Kl"ˆö‚ÎÄ°ÆzÌdæÃ'Ü+ÝqÌF\0î…ßd.çñܪÏýNC¡3T« +×IŠ†5¾¥GQ5{} a£p§2ƒ6²u½(·è‡¢Ò©yL\.éÙc…™£ Ôâ_(Ì’>N@ð#ØÈ·áí¸Whó»†Ùïß^ÆÞ+k-,®JyK[°CT°FBEDð +V¾õ|SÃÇ´Fž%ÆL73ЛUdí–"˜+µŠšÚùXp¤X +q˜äh,<ý f͘ĩhØGB_0Ÿ÷JaøÏlUl>Ð +u47ôÊ;ÀÊ—,†Š¶À]1sáF·7€a‡J¤C R™4¯Š¢2>ÉËkÚÆ@jìó¸Â’–N99Ö¸uŸ]]öt0´fn ‘à%„³PEÿ_Év\Õc÷Ö'ˆqÐ8lf’LŽ¼«\qð^B_U#æd¾p‘„néGo9ÂIÐg8º•þ]Ž¥ à„G«ÿž¬þ?$$/“!bÖ;“ê +¸ ¼×a*éÚÔìÊü›Ã»/ .h¼Ù=@ Û=Ú¦ …¾I¤4·©€CŒrüuE@ e´ç‡´n¿´ÖƒÏ¨]î|æ3Æ!tØô‘ÆÖJS,ò¦Á‘”n¬Öý[ 7JjN/FªÁÞW‰›’Š©Œ8 “;kÖ®ÖøÃ÷ìÆ-dô²ò ãûçæ›,íõ¯&é+O.ô Yw¹ëxš:ض}1ßžmxïäŽfˆ-ýa4"#ñþ±Ô0Œ›¶q¶¶`X)&à™?Œ¨þ¾¹Âc-BsÞ ´X.öP-`AäjcyS̯tõ$0#& +n”ìY“àÙá«1÷»Øw g>¤¼|Ùj"ÑmÖ8÷ ï%–c>,Ðè‚Ðu¢rD‡z€ÃÏHÒ e_ÑØâ `8CÐü¡‹5Ä©Ouš(fñS]k±ÿîÿ˜$~ë­ÿÝãÇÁC=‡íÎ)øoÛTÏìendstream endobj -5839 0 obj << +6127 0 obj << /Type /Page -/Contents 5840 0 R -/Resources 5838 0 R +/Contents 6128 0 R +/Resources 6126 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5843 0 R +/Parent 6119 0 R >> endobj -5841 0 obj << -/D [5839 0 R /XYZ 85.039 781.388 null] +6129 0 obj << +/D [6127 0 R /XYZ 85.039 781.388 null] >> endobj -1678 0 obj << -/D [5839 0 R /XYZ 85.039 323.047 null] +1714 0 obj << +/D [6127 0 R /XYZ 85.039 280.017 null] >> endobj -5842 0 obj << -/D [5839 0 R /XYZ 85.039 288.907 null] +6130 0 obj << +/D [6127 0 R /XYZ 85.039 245.271 null] >> endobj -5838 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R /F41 2994 0 R /F77 4849 0 R >> +6126 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F20 3021 0 R /F38 3057 0 R /F62 4159 0 R /F41 3054 0 R /F59 3455 0 R /F80 5161 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5846 0 obj << -/Length 2813 +6133 0 obj << +/Length 2305 /Filter /FlateDecode >> stream -xÚÅYëoܸÿî¿b‘¶ˆÈ2¢Þr?ù|y8h\7^ãppœvÅ]«ÖJ:IëÍýã;RÒ>sh ÔCr8‡óøQ–#þÉQä ÛGa$…E£ùêÂ-aæÃ…ÔÍ2ðü4½xûÞFÒ±¦‹^Ž/<ßMÓGëúãÕÝôÝ—ñÄu]KÆb< ÃȺ~¸Këž©w_nn§7·päQZw8ý÷/ãȵ¦ÌtsÛO_}þéŠG®°ÇߦŸ.ÞM;M;@«Õüýâñ›=JáHŸ.láÆÑh}[H˜^]€žÂ÷\=Î/î/þщâ9oÄ«ŽYÅpL\[D‘wÞr¾-|Ûë,çÉå¤-…g»#ĦûjËpÿtÒDäG£°ƒ ÏÁŽÒî(áJggÇö ¬«À´ŽmUЭ³bìDV«j ÉØÚâ¨\ã ²’Z1uY›´–ÜÞ?\_¿Ã´~ÿþáolXU×”+ ZxN %NPòÔýèIQóÌ$¼°w)­`§"è=—ølcX>Í §à™¶ÜGM´·&ìÒö…ë{;NÐeB'°­UbÖÃ`=ða£J‡F"#팪@Ÿ]¯*̷Л#þú"Ñ9¦ý(©[W=Ë<Ï›ƒŒjƒ[O^RîžÊm‚ƒÔ¤sœŸ­û~U«a²2ä\ê¦ÚN¾'œ8ØM§UqÈ×Q¢:x¹LÓ•L”ƒ´rÁm—•â¨/Df;Z@ $„’º -‘åLèYo™HÉkFj¤Lf͈BvRMÃÛ¢IÊâj5'Y‹ÕT}6t˜›!o’À²>RU6¸.Aɵ‚šT·*…›ðc×úB²WJ§HPùœxÃSF ]ôg¢¢I£XœqEi½6§Fæ¹É¬\ËZÒèiaiÃ`â àíŸ@ã\ƒæ©¬Ûk"“e9<ªÏN‰S0;‰Ôºî ‰9›«÷,±,äl„æ¼Óó­¶ÖûØ‹imV,™L5n3'*tàx"t΃²å+f¥ˆñ0œõãX¸^DÇ ó ‡—çÛÖç¤X'èuA`ýL'ÃtôB Bë†ðž/i³²`¢A!Е>·÷­ªšçðãPØ?8Ç€ç0ï9/›¯é¬ è`ëD{ öË¡rhbÏãòí¹Eñ á¹ý ‹´”\ˆ½P“zHÀãÆñ–û´L°4Q}Wä1ëþ²qSÞÝë=úwdÈjrkÏíò 9;e±]XWÍ¡—RPX¹aŸ¾]W§ ÅÎÈ”„›: ùfÏ -ÕÏæƒ0völÎ+´†ò -Šk¹¨çÕMû†uؘȅ™eÉ4LhO5EÎò‰§ºà…éƒÐúëºgh8Ô*Vv6<¤™A8}˜­Ô÷*'TtÀÞZÃœÚ'Ù‹ÙrÅŒÉ\»:L£”¶·¦ÇI'Znµ ÙDLZ£^BMoàÇ ¥ns(~Fø%-Ž>xSêèãЃ1†Þ8 4 Þ•'cˆP­Ìf4°cÁÅ!gK²¤è<Š^ä’2çBqÀsŠq$\Q†‡RŠ8…øÏíÖ!þýíÂøâ÷B€s øë²lÿ¹Ëñ­¼JÒL*nWÛf5k›¶ªÍÄ ·M9VíåÛ· ^ðh”Bºò2–¶­ßéöŽÛyR”ÅÍ°KU¥Ç¯ÓsE õš>eÚàQM¥à=ƒ[Ò“„“&äX‹žïiTŽ=€Ø)’•†^`§! -….€1ÆQ«-âµîćZBÒôáeÏܘQÜ‹â ô’¤^³…ÈZá7x¡Nø¡ÏZ»¸èà¶ouç·!LÆ aΈl0¯ ÓKÆîJÝ4è²x9¼ö«íÛÄ$ž9?–*H„Ÿ05´?“@4-/.{ö§¦×ÞÞàÿ T2u^“ÃŒZÀª>|0õƾõ+}+€h+åEèñ‹pŽâq-Kºh",ÆŽËŸ »s -\Æ­N¦:Âw³9à9˜†äœ Ìs»u¹¿ÝÑÀtýHÄa´™u5'ÀÞêˆzÀ¹¿|‡M˜sûZülÀ'ÃkÕå<ÉŸÊF¯ý7ËZéŸ\;‡‘~Xy²l.íï‘?ߎ\9Ä×åãWézøûœªÉ,k$V8ÿvDzªšyU˜ÿˆˆ7o~ o¥Ìuù¸Ï÷sŽïxˆo×9RNxO%úâ†G”V°³º¾X&‰vLyÖç/ŽÀêî ¿T‘¡(±ôû^]òKÉ\Ó´µšèVSñê÷84 á"•Q„T¢V¥†™¡Û¥Th5K9˜ù[,àhƒô¥x)€-ðãÐï4O¶$Ž$¿<ö]Æ…÷àlùœ‘9u}ž`ŸŸI0ú­Ê f¡G_CÆÇï ¿ïYéoG.O:‹©¥SŽìË©xþ¬¿ØD¼¬ƒ' Úc™0PÁ›ˆ!9sÞAÄ„ôY®Ð4O&•hkƺøuønC`¢s0O‹‹ωÍz>‡$í!­Û‘²±[@ç<òà®Û-®{Å´…ùr…ÖÏû÷ôîýÎT»ÁÝÞh<¨@.œ¦è44€PÀ[& ëGãþ‚W+†LìÃ…ÂòáÙÖGíï eê.dxÅ´æ÷²:ö.„$É—¶•T•Jjîg vÌqó¤ð#37ã(&ðˆ­yɉ‹×XcKDþnÑ ¬i›jçƇœçÑӣ mÛºÊ u›"—)4NQ9v¶¼jküsã¡%w(¶×Æ·õm¶Ùœ¥(^w-¹ uÜ2T„ÎÚ$Gýåm·Ð-ºd±2°D£—WøåºÎZ=dýWL!7€6U‹¬0ˆBec1ï‚oq=võæÈ'AWâW_óüÏGÿgòñ·S_J¤ Çv΢§ÏIôdxp3÷$z:·[‡žö·;Šž° úÿ zZªVƒ§oç8¦BtBno ßÛ ¼•Ö]œ ùÙ·x–¡Tl¯Üÿ˱$TñÈ9¬Éµ×Ÿï*·…sôù -¿,ú¿úûlÿävEäžxqûŽ#it!\:ûúún¯<÷Pá¾a{endstream +xÚÍYmoÛFþî_! -B&Ãå.ßü-§¤©ƒkêZ2Šƒ +‘–XS$KRv|¸ó²¤(‰Žƒë}¨ ƒ»³»³Ãyyf†~Å$òWÆ“0ŽŒ¢Éj{æNÖ°òþL˜îD9nàãÒ?g¯ôƒ‰pØ'‹;Ú²Hn­ÙOo®ﮧ¶”Ò±3µÃ0²f7WSaÍ™zu}ùqqùñ=Î…us…Ë¿\O#i-¦ŸÎÞ-×ÚÊQÄ{ÿ<»ýìNíÙëÈ8š<ÂØuDO¶gÊ—Ž¯¤™çgó³_{.¼¦&|jäíìn‡-]'ŠÔØ82½ +”QÁ'W„Ç/á;Ê÷ùà1S\òþÏÅ&Úʬ(ª™ÚÂJk$„ÖÓÔ‹¬r÷ +èµÙ³*‹¦)n[µŽ×¼¢~nñЮi™ÅrjÃ4å‰^æfÔ–¼ù±Î€Ck˜3VA"xIpƒh ¯+R>K}[ÕYÑò¶h¨*©@‘Òìú~„ï„^hÖ?óú^„G®Èš®;é‹„«:Õ-IU`7б-ÐÂ1ŸÙá[‡V’Õ{U•u–’rcûÁVÇ %x‰ë*ú:‡U¡€½Áš-ú‡~çÇy`• ÁC`ð˜1ˆ˜C],Þ0–£ÞÂë‚,m<™á¹‡©ôNÓ÷!UwÆÙ +Ï”Û-E'^xŒt–7]|ºŽæ}Ì@`Û $„4??žd߬ñûc/æI®0–ÌÊ×Í5_L#e½¡$u3?FIÇ cæñWÄð^ãæãüf6{‡ysþãÍ?Y9½a벆œ«<‰-yy…þÓ;Íîy%»ãgç^àïa$&ÔGƼ·Á§—;ˆ~cŸ%žx<ð>²°p•‰˜MåÓkô¸¤<üÃØ0Pž¤9žñNÊ–0ê øån‹iG?͈†!Øä9%Ið jäVá„B5Á%3$©ùú‘»UèDP8ñI¬Ž„—¢wD,‹µm‘d (Xóú¡ÙŒ+“î…e³†½ØsBuC¨PƒÈ²¢}µ1s]VŒÆd߀”^¶  bú$ryÇû%ˆpœfp1Ï:.¼–å¼–2d 0õ“èÙGÌ…{Ï+‰²¢SMÃL7Úì¨SÒsš1¿„—ÍÍ/ßÿPzš,(‘Åø«ÇEŒC«ÏM«ë6MÀXíšhÛôHÂÔ° OÌ Fj¢“X“(.tÞ-¬W,è`U&É€›9C‰Fþa +0ˆô?ú°hù8h#åÄ­9¥Á‘TI°‹ˆÍ{¯–»ÓK¤q­rÙ§ãms>§Àþ5ñ§Muj¼i-×r÷§‰XH(Ùbo`/Ç Ûó=z@NŒ±@è*€÷ú`1ßw­Ÿu±ƒúÁ–à oéMP}d± ´.‹Æ”ºÍÊ‚‰å`(|~ÎÛ´jFºÏ‘žÿŒ¼R®}°ôA™ 0coC f¢k€.qg$mÎÍk%ÞaI (Dk†d`9DXÆùü‰Ç{©ægEbú…£i·7"^Ê·«}€ü‰²:5Ùû*Ì9a`½iFÜo129 ÊK„7‘FÍZË ùݥʟq°qÉ`6ˆ]ËO¨ÞTÝ´ç,Ãc‘ a¦aÝ»©)$Ö^êc–On@õïêý††c¨ba—×ìV„u>¢ôK•kr„®Qî8íPƒ³º‰:ÒoËSÞ¨WƧa¹kÓŒ6#.´ü4:L»šH;”Ë1)Nx/ÖÎnÌRþŒU˜°8Ì ¡7aÆ1sŒ±)ÄFzžë)„" vN;½x4ž@+R¾X5‹l25úÆ:ü ‹w/ûƒ@¥,‡ƒª¯v»ZéPRüœÝÀúÕÜèNŠjC9È냲l¿¤ò KV:Ùbcƒ»âçö©Ù.Û¦­ênáŸM¹ºOۋׯ³ FP[‹‹X¸®ÙøŽŸŸ ä&ׂ¾òü˾â=+]”Åå5ÔKU•Œ&vw–$LƒBaħš¡k~œи‚—AdT +$d¢·\Ööü"òœ¾§*åTØ rbÑ} äî}¼Âx†—ô]š'‡[JPw»C÷  ÂÈž™ÅCõáa^]q-Bziº +KAE÷i(KóœvøÀ[îûènyß'×w5æ´{GcÖ‡´};ü8Á±’Áç[FäÕ€Çbvõú_˜ &á— ”Â0ýæ"ªºç bž&Lh)аë1€åo¦š±lb°“+MåÐn²©eœ%­žoÉôo.'Ïÿ ¼ÿ; ~©ZŠú²Ð9kÑ`†ùÔ HpÏ윀Aû!RdΘ Éø».:`ù7%°K{8÷Äüæ$ÐQ˜2ê\Dè@¤ÄéaêjEŸaZƒ7¸öÃø1„?_¥÷IØ#½2èT®t¾)›öUlþ7týÿð–u³gÞ)šqï'è3ÉÀ…îr½n.nÝ/‘‹?ŸG²b¡·éÅ-J€÷Ij/³¶Ù”NWŒMÒfUgzý·°8?ß +JPèÅíñ¾·¢>c§§L¯ƒhSîrî+‰ºé:hœqo¥ÆKj1L¼Ñôé* †1kº¯vX‚ ߺ¼ãEÙRÅAýxÓR«‡h±¡+âÑáêöH¾”ç)u„  ¥ƒ¥¡/SæSªžóç0¬`ú$a‚f´À¶7d:¿x&¯òw¼#¯¿Ï0}“'ý^e ¶®”I·Ëä÷gÈóCè1žiI¾õãÒWÿù 1f‡ª¾jQp,èð e'à%ø$áendstream endobj -5845 0 obj << +6132 0 obj << /Type /Page -/Contents 5846 0 R -/Resources 5844 0 R +/Contents 6133 0 R +/Resources 6131 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5843 0 R ->> endobj -5847 0 obj << -/D [5845 0 R /XYZ 85.039 781.388 null] +/Parent 6119 0 R >> endobj -1682 0 obj << -/D [5845 0 R /XYZ 85.039 624.724 null] +6134 0 obj << +/D [6132 0 R /XYZ 85.039 781.388 null] >> endobj -5848 0 obj << -/D [5845 0 R /XYZ 85.039 589.978 null] +1718 0 obj << +/D [6132 0 R /XYZ 85.039 584.077 null] >> endobj -5849 0 obj << -/D [5845 0 R /XYZ 85.039 511.008 null] +6135 0 obj << +/D [6132 0 R /XYZ 85.039 549.331 null] >> endobj -5853 0 obj << -/D [5845 0 R /XYZ 85.039 399.625 null] +6136 0 obj << +/D [6132 0 R /XYZ 85.039 470.36 null] >> endobj -5854 0 obj << -/D [5845 0 R /XYZ 85.039 163.573 null] +6137 0 obj << +/D [6132 0 R /XYZ 85.039 313.22 null] >> endobj -5844 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F64 4112 0 R /F79 5852 0 R /F58 3360 0 R >> +6131 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F58 3380 0 R /F81 5323 0 R /F62 4159 0 R /F20 3021 0 R /F64 4225 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5857 0 obj << -/Length 1953 +6140 0 obj << +/Length 2281 /Filter /FlateDecode >> stream -xÚ­XmsÛ6þ®_¡Ñå&ÔLEÁ÷“Û¦©Û«ês”KgÜLŽa‹ŠdH(ŠÿýíbAŠ’)×7‰_†Øža<»${ðËÆ‘t=ȹ"ŠÆëíÈßÃÌë³3+2ëÉü°Í–Á˜ynìÅãåÝÁŽt})ÆËôÖùñ—Ëëå«›éLá°ØÎÂ0r~|{=eÎâ^ß\-–W‹×HùÀdÎÛkœþãf gIBW‹Ãôåï?\%\oú~ùëèÕ²‹´‹¢Š1ÌO£Û÷Þ8…%ý:ò\Gã=Œ=—ÁôvqºÒ–ÎGoFÿîLÑœ?&­¡¬H¹2Óƽ´0Æ]Áø8”ž+=ßä¥QõgUÉV]ÜþÅ„ÿS5[eºÙ”Õ{\ø˜1 !6*Uú $·Ív¥]Õʼnf“ÔŠ œ“”䫬5ɽI¶«d:“\:×€%@bÈEZg݆æ×åv« -}>+——ëDge1l¥QÕ]–Ÿº‡˜‹ñêæÃO7Wÿ+fæ?~ï`ͬUº, -ŒÕ…ÊôƒAìl•Þ”)Ë;|FxdÎFSoje‡°/pµ¶IóiCL8VS.œ}Ad‚s+Ãú¬:‰]nTŽ5:|¤(ɇ/5Üm]n2œï~8VŽB0±†ˆ´,îÐUY¡7–[íŒý -•"S¸z£«p•eÑè:™£3³ÞûÖDßýº,LàC®œ]Q“%mLW__pG—ød`˜ÆG¡Ö's1 àx s¹A­ô&khÔ€)3É”sçÞ*ï³<§ùªF>:ÜRì°ÛHlZhZí…˜ì"†¬ðÐ&f6+Tsö|ß™,7´£f¶¡"Ç\ -d™iÜ6$ŠR·özZµúj;c¹V)1òŒÄ¡Œd°&yÞÎɉ{¦*øaàJÁž¬p=åLön\¹"LšÿÈó7’Ñ“ÞZ™Gî+‡p7Žø)däô!k>ï0gn+‹c8{Ùá™…)”1G!ˆð£óÐÝ:µð$øŸQðý‰æI™Úµá(½ž¯wU3¯ªtÞHèG¨é^_ÿô\û¦ž›RFæ ‡Cì27ÅÓ€rúŒaù|»iý¹>¶Ür¾AÐî&¯†‘z9„öíù Áý_žô¥V-TœG‹f@ Ú¾§H n;^Y}ÕÞ|¸x*%ÝDð /‹{‹I@óv†äàe #ç_4†gÙYÕ*ùˆ¥O„T\0:hªspÞÌTË&ki¶>oÔŸPÊ|ÖK_A‚WôVÜݤ•®‰LÈV\H¬”*Z÷жM€0eê*°˜±•Êd–ÓŠg\x®'YÿÈeúÒ•ª‘ ûÈ ÂHÑ/qh!ßf°"ž7+é­DúÐØv)õT¢šäΧ]VãS!'HÏ]ÎÛŠjÜÃj$ -õESئDX®¦šc¨Ø»5RkŒV¥Tåͪ®4 o“8ÕPfX ¹?†ª‰žÀ>õM-ñ=î`»×а2A=4p îç¸%¤VA[e»³ ãC%â¶mj*iš’rõ<ôÝÀk³òb mø–Óο'÷xÁÛí‚¥Kh~~)ñLìqÙ°˜ïPº-ª¥©MðDG¹Ø›èµW´D¦Úã°hkµ&ze:2{V¹²í^I\º*‡¢µbÓ‚­ „&B†v`¡I€²ÜX›oŒQZ%¤—¶ÞUcÃé…òЦÀҺˉŧÇH 1h»¤móäñúÔ Îž*8—8ã÷’ÙZø˜|2Z¶%²VÚ -”Ù·:¦-1 \L=6CÌ„gwŠÎaG¼ –}†þq”Ðcbº"Ñõ2vûò¼Õ pk5A2t°JX½ ˆ_X÷_êYSÏà 3ÏsøáÅ8 ¤Û̼…Ò‘ÂJüž<ЀKû^d‡ûŒÿÛQz'ŽX@OO\0ëS ,if<ÍàÏzbç=Šùº—³‹âì¸;ùZ—fña$"ïy>»æë[øe2ò£çùµÍä7ðÊ‚Ø—ÏðzÒÏö¡}aV„)U2ƒ–HÛr‰˜a …}+-ÄÔªÅzêÖÒ;s›úˆ7ëM¦ávwІ¦‹^9 öOHß|h€©Ûî-n ¸Bvc.Ÿ[\Ï] Oøô˃ÈY˜³"è)8‹rO¸ê@îÄ× Æá7@ÿíǧ3Ÿþ›¤iÿ³Óä]V¤åÞäbIÏ/Q0±óÛ‡Þ¹ã7•|B§Êã¡5Â?þ¯ú zxÇn$âáM‘ºQÖÆ‚yâ¡8·ýðú(àÿH)´nendstream +xÚÅYmÛ6þ¾¿ÂØK±2PÓ¢¨×ܧ4MÚ´ÅÆÝ8×;llÑkaeI‘änôÇß¼²ì•›âàv±9g†Ã™‡\9qáWNâ@¸*™D±*Ž'ëÝ…;¹‡‘ï.¤áp'¾pǾY^Ì_áDº"q“ÉrC,ËìÖyùý‹ÅòÕÍt¦”rd"¦³(Š—ïSé¼cêâæÍõòÍõwØó(÷ ~{3•³œÞ-¸xµ,;ó…*\÷ãÅí;É@µ.\¡’xòmWÈ$™ì.ü@‰ÀW¦_\¼»ø¹—Âcþ„gX7ó½Px4”+âØïÍ”Á˜™[½žz‘óFÄž“Þ§y ¶‰€Mµ‹V…n§3él¡]Mg^ìTNPNZ)ãvMl5°DŽN Ͼœz‰ÓåwÛýz\,²Ýà…Yóºê4su[ÓøU*Ÿ¤îên ++öK3äJ_«¾"½4ñ<¢Išf•¸ è{‰~KÈènËšúnìø+$DéVívøI[¦å%I)œ…JeÖÜvÝä5tº¼*/™±ÈK; +–…aÞ4þ32ôVþ®®&á””ÖÕ,…Õ"ÿdLIkã[Ò®aâÖ.ÕÄç›^ãF¸àFóT:U©¹‘ý¦hÞ' 4@Iç?ÓØGeˆ±·N£÷“Àé*x€²bŸ¡©H᪻2‹½ax•òÄ:m)H¡ª1â~u×j×ÒB¬8xÍ-Y6zƒÈVa ¼@šønwS±«€bícÆŽŽÂÌÎ ÿ4m]Ñ>ìÒÝÚH°tÙàh°Ëç-SÛN×ܲÇÇIBÕvÜ«6ÌÑFI« +Ü[ë.ˆôÞ=O ¯€àüïƒ /ŠN7"9¤°ûó5xÃUÐFîyò¡Fºïúð(‘£Ã5(ÆQÎÓÀ ¯C:«ÌS{à ϊBÚ¾íCÎÌØ`ý†>¾Šï£åÌ;3•ÏÙÂKæ³ëö§ +7ºƒ" ò’÷N ÷Î "¡B¿ßì•XWåfd“ýDøåÛÀKXd(Â$2,·u“—sÅr^>,¨ ׳1ˆ<+ånD“H„žgÆÅi€£¹[MfP½`ûÆò;ìø šš×Õѱð〧Š Œo¬Ä£ód%â‘|[Cø`T—iÁ‡BARxI!½ÆƒöÀÌ>øųŽÇ/å|ý™º­©üÉHƒ@Æ4ˆ}Ü.ƒ”‰Òj +!Ždà‡ã FBˬ'’0&­›ªêþµÅ œ¦^¯‹\îRwöǾú~ aÍß«{ÝÑî£BHØ}‚ÀêZ –Lð®ø[Të´ØÒÇ.†:¨@Âq +ŽŽÕÌrß`¦ÀZ­) '³~.Ó~~{g)‡›üí’‘±7Ì“OÌš½ôö±uÃYƺV7½u(ÿ2=[å]»­ê»‘¼d4?;»ƒÆD´Û´Ñ,à3œuÕťы-†¾[ÇÑÌàü¶ C]ÙÁN}VÜ„ãRZ]oòâÌ䨺©Öºm«æùíc^é8Š’ÏF‘!Ÿ%Á§¡ô$†èDPRªÙèv_˜Å1ùcã—W77Þ_ÿxýö—ë¯_Ý|øöæÍ¿ˆn#5E #’zÍP&$4' ·mÍUaÌ5¬Ñ¦wö¨v·<!EU¹d éŠQ 2Æl=›…gÈfgñ`ÊDð°ØY°8b]!á’Bøy ñ¥†Œ¥ÐØ[äqÌ*@}5*Ó0D¬Zƒ$À@ªàðÍ4£’’Ë6”߆ÁÕ{BI5è@9ͨpç4‡°Hè¼(Y\Úua9uöº¤Ú½¶Ðm0~¤0¥t&”ÿI¨å%F‚¿Kïq6x°ÇL^-|“Mµ#$ÎãýJÐf\ÍX³•5ü„}à[¦T¸ÏÁþ0¡Œ¸p³«›Í£._”´™^Ò èÛ¹ú :Y·Ñ÷9E(ŠÌFÏ÷‰Ë”:ºL0ÖbÈ„{þ* +‰Ë³XC%‘Âèþ‹}Ç5?¥­…F1ù}Þ_w2Îzlp„%DÒÝ;9à +O¦ôøäÊn4 úç³;¾ÀÑi…48L£óyŸç”…1rž§Ø«>Ç^}¶Þöùw™Œ©¼Çá?O&žDÌÞj£»õ|½¯Ûy]góAÎÐ’ÈÅbñí_¼o›9•WÏ¥¡¥Î>n"òú_@pÖüÖ‹¶”/ \l‹ú {WcÈîÐq"N†ÔÎ Öwƒ£»$”sxJÙ†d/°ã÷—µÄé†×zºX"3¿F®h¸HŸÈp€à”^™Ï4^äƒÐù š3äXQžIZf1úùƒç‘€/j†_—cùˆÖÉrÀ+t!‡õwt?ê÷`þÚÞ¢ÂXÈ00‡½ñ,f ;~ÉbOgä¬o!ºd¦¼<ÜK;ë4°7wN²i–®¨pä]¯,ÑÛãò(ø–ãã{—kX¶íì+­H¼|L†WÓØnlLh¦º4ðHï ~5RÆž#|WQ2¸©kj•ø¸“£](õï”1-b€ÕÛØ£÷6óVƒÈ#Ž7†•aÏÃÔ–)`6Ïnò)ja²¹•}eZ½µïrxðŠOfˆB¬5;„%‹é¤£}Â9ºBƒÁÂ÷’¿t÷ÿÆU\JÅýK&a= åÊ#_^‡n‘ô#‡ò>Ùˆ~‘¡yÒ¢3®¤9•]Wd`0 ŒÓÒUaðth#ç:ÎÓÎάmð»ÎÞî„fvzq‹è¸§Lbɯy¬JÈÏHÚèÕ5øˆûä–3X³„gÞIGƒÉT…{8…iÈOœØ—0$Ñ!ÀÆ!1yç–ø»-¾:ã[ÍéÝŒ§¡©3+ÃÀJXuâ˜ËŒ«Î¤AÞâ´èOˆy»:}¡ålرK,*=ÿäùR¨Àÿw†Qãïý_Aa)ëMúS¼çÅÑ©¢24gq àßQojendstream endobj -5856 0 obj << +6139 0 obj << /Type /Page -/Contents 5857 0 R -/Resources 5855 0 R +/Contents 6140 0 R +/Resources 6138 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5843 0 R +/Parent 6119 0 R >> endobj -5858 0 obj << -/D [5856 0 R /XYZ 85.039 781.388 null] ->> endobj -5859 0 obj << -/D [5856 0 R /XYZ 85.039 502.054 null] +6141 0 obj << +/D [6139 0 R /XYZ 85.039 781.388 null] >> endobj -5860 0 obj << -/D [5856 0 R /XYZ 85.039 270.305 null] +6142 0 obj << +/D [6139 0 R /XYZ 85.039 693.883 null] >> endobj -5861 0 obj << -/D [5856 0 R /XYZ 85.039 88.449 null] +6143 0 obj << +/D [6139 0 R /XYZ 85.039 296.619 null] >> endobj -5855 0 obj << -/Font << /F56 3226 0 R /F79 5852 0 R /F64 4112 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R >> +6138 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F35 3036 0 R /F58 3380 0 R /F81 5323 0 R /F41 3054 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5864 0 obj << -/Length 1901 +6146 0 obj << +/Length 1628 /Filter /FlateDecode >> stream -xÚ­XYsÜ6~Ÿ_1åd+œª%E$jŸd;‡R‰¢•Æqª¼zà Ë<&$GGÕþøEwƒ‡DŽG+[Ðhô…ƇÙÒÕÿØRùŽ+Â¥TÌJ-ãbá.oõÌ f8lÃbxÞ®'?øÁ’¹Nè†Ëõvã;ž/–ëä“õËõ÷W+[a±ÐYÙR*ë݇˳®‰zyu~±>¿øFž&2ëÃ%LÿvµRÂZÓùÅ0}öëÛ3 Ç]ݬ^|¿î-ímÐV…`柋O7î2Ñ.ý¼pªå½î»ÓÓÅBÛéøž0ã|q½øw/Šæ¼%­š‹Š/”ã+1 ‹ Gaa\82K黎ïz—ø°o’ú®v’¯!)YC£fÐÁ¬=Ѳ­iÍŠí*tµZX•7:A}éZçf.Fí0—'· -­(CQÒ»´¤^d´F3q¯Ó毂Ìܵª-µ4Ìj²bŸ§DjÑï½Ö\is<Xçä0ÞgyN½lk 9Ï>§9„á‘Æ&–ÚÖ»Ô°ƒ¼çšŨÞò¨ž±bi¬Jj ¤ÃÔ»m–§à<“†¦l+aðw) Þð7ÐQ¸-ÕM’ÕÝöÄm·µhË£ö=`>ú¾¥eí÷´éždŽ÷£ù§¦qe=Vb+Sð—{nIö7„#þ<²´ûFç¡Eë=ØyÍÝçC9·ƒ)ošfž Œ*ôNb²b œµ`qàZ›TKVU]äîÄ$†-Æ †D×#°«ìj×ÆÞFÒ ’!ÃH–d0Frº&¬a` eÂ0è„ýxWaö¥4Œ / ‰fè}ÈjbÐRMoÈ&mœò8½YU ‚Pbžw~뉈øn»d©’G²¤ 8°óöŸKë€&se¶•S.>±[ÓÊç<ÙºEë@ Ì7 ?!ù´}ÆSßç½æÞ×æPxö’ÿ¥'}A'µ‚å÷ ï ¯!/<×&¹Énç<ŦÔAŠÕ!î3ŽÛmDdðCÈ¢³c´Ciî`5™Jƒˆšòйµéت--ßÓ}Òõ~e°)‹wDy‚TSÿªÍ]VšÛdh%Ùv ¬ÓK×è\KÚh€Ìз®+šÂ}F¼¶„”oRŽàM:/»¼©iU`)+£´ãă¹èf -]88\Ê‹©V ÌÝ–¡r„½ˆ…œ(cnà(_½¨­ã™¨{Z¤0îÆ—¾pÉÝYUÕ~C{ÞPkçÔž¤m|ÒDÅ&:¡ª 9ù(ø*8™ÙöÒE­c3ÓI}ÿPÛMm?¬lÎ\×âÄ ê5%Ðݲ’R]Ò·|a8~LÝÁ}ÓŠSnæøÊ¿ZQ ÝgŠX@­+N™Ñ):E\:nøŠÈñ—Cç뜙áøä蟛™ ½µõã-;î-Ž˜ÇuÉx<°f}WuNãûU1þR 5 ±èÚS_ *»jùµž¢^æ+Oý5½Tkÿ?´² ô|õå?{|E%Å€f*°vXéÝÓ@ßêT–%­€h âWB´(o*"xaɨ¤ÁNà]0Ñ V}ÀѦêA´ß×]`î@º˜ŒüqhOÓ©N㶪 ðcÀþ¤]Ñ:ø}º òGä&kƒâ¬«JbÅÛ¼ÁP¨‚•þ1hç¡tt™ÿ"´xŽB{Ǿª£Ðþ’¶ÚŸ«›…v®„æöžT½ã<ûqêÌýãAÿBLíwiy( däûÎ@\ÿ¦|úòdÒaŠ?94ÿ%–Û¢ŒÒ߶Ïü™w&=RGr¾ðH=/·•1îtæÌþ®mϪҼ°?ñ9Ü‹»Ð6tÌc»æÖÕñ.kuÎê~ÍǬLª{®‹5µ*ø’Þ˨Ýu2 œðû9IíMÖ6»jC¬«¾…]Ðãðg –7ÓSõ>j#x®ý]ñÏÐiΓwU¹Ín_£dÞ9ù?¥ùþµÒá»ù"´^¥Xª¬È…. †g—}(ŠÞy0 ym¦ú2¦ -õ†JGæ9 KD¹»þyÓ¬ –yOžSd‹™˜›ûýa lʺÎ –®GÎHíLÑ?¹È!e‡Æ½ø±'5äñ{–_jh>F7æáÇPUJ'à/×ËËQL5,àxxR_PÕ#ê3]³€xŽ+ÕßÆÓ&m“'ß×úƒ5 ÒNOÅõäkœVpDtk@29ö}o~ôÛ€‡sqÓ¿dÈ«>¸ö­O áüFûœ;œu¶€ã\zÏíí>ÌN þ/¸³endstream +xÚíXmoÛ6þî_ad CŠz¡¼O]ß–¢Ë²ÔY7¤ÆXr,T–&Lözf²§Ì£bé+Ûõö¤C´ÉñÙëדÓ'o ±ïÐ-È)ª™.UÓ’z!à`Ã[úO°®»¨Ÿõ2Ђ8Íz6Ëšf¾. +‹ +yÙÀ«ÈRöÝÿ^cª5/wfº,«–è:[A7P±(ì݆& VA‹"8Ëae¾#톹ÆIaDájªÈ9²K3äUØÿEJæ@¸ Ê€¡PIÝн@wž4Z;SÕÜJö¼CãK$Vh&³A ÞŠ¬Ú9už79 ¶øVÌ|§Èß×0Õ8ǤhäÇȔβês SH“¦-+s±úÐs[`-2¢á€]ÑÛ^Óöm'¢ ”(Q¢­¬‚á4.bÑùÄoÖ—UÓÜ ­É|[¡7xôxçÜ9š“v'|7 A67WtV6ËßKHÐ… Å2â‰SfYJ:‡ã•/1[æCðþ¶@>Òójm´ iCe”ÆOÕLåS‚L‰³+>cÉï¼ê®ŽdÏIE%¨Kš´õ%¦ÂAAUfwûV_é¼4WO/|ç·C¿Á.ʇô£mk`fÀÁQü¢wßR“ ÜYѦíDZ¢Ò4° |MîÓ¦-Ž¢5Ѻ?ƒÒ;õcÜÔ}°!ovZ«z© nàFkíÊ~‡+ÖÑ<Íô@aÿ嬻zÈhÞU£LàwžÃÊíP€aºÆÜŽë¦ë™ÄÎÜD Ý*`}ežTûæ#u[é«ä6—Åf›{³s „½­ÀV,ÉüʺPva`=B^t›W–‡‘t™¾›‡¥vÍY{2ÞKFœô&©qwËÖö0a¯&– om ô^îJÝŠÀƒqeîl”Œ®¶ê†Öìw¥/ åÕÖ³Âô¿1e,Þ îHs@i-Z½ÖŠYï%| *!ÝUg>H}¶ì펮‹]ë_Aóþµ³µ—E@B˜^ÛÜðÍ,H˜¢‡øãnfñÿ/ã^ÆÛþß>Å¿þ0öý‡qø_¼‹¡¨x¢Ÿ9ÿáÔ…\ý¬pÎàïâ3¬_ÓÓ\Ènœ„òá§ù£í½Íï±ûU¼Í‡Á+LÈpø‡MëèçýÂ(ñ}´ úA ô•ÚwTDöuÝsðo!›=endstream endobj -5863 0 obj << +6145 0 obj << /Type /Page -/Contents 5864 0 R -/Resources 5862 0 R +/Contents 6146 0 R +/Resources 6144 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5843 0 R +/Parent 6119 0 R >> endobj -5865 0 obj << -/D [5863 0 R /XYZ 85.039 781.388 null] +6147 0 obj << +/D [6145 0 R /XYZ 85.039 781.388 null] >> endobj -5866 0 obj << -/D [5863 0 R /XYZ 85.039 571.376 null] +6148 0 obj << +/D [6145 0 R /XYZ 85.039 761.463 null] >> endobj -5867 0 obj << -/D [5863 0 R /XYZ 85.039 324.501 null] +6149 0 obj << +/D [6145 0 R /XYZ 85.039 565.963 null] >> endobj -5868 0 obj << -/D [5863 0 R /XYZ 85.039 104.725 null] +6150 0 obj << +/D [6145 0 R /XYZ 85.039 318.524 null] >> endobj -5862 0 obj << -/Font << /F56 3226 0 R /F79 5852 0 R /F64 4112 0 R /F15 2972 0 R >> +6144 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F35 3036 0 R /F58 3380 0 R /F81 5323 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5871 0 obj << -/Length 1549 +6153 0 obj << +/Length 1611 /Filter /FlateDecode >> stream -xÚÍXmoÛ6þî_aì•JIë-À>¤/kS ™—ºëŠ4\‰Ž…ê­¢”4À~üîx”,'R²-û°‰äû‡wÇó1lîÂ6=ÇÑ<™#Âpç3w~ +¯fÌ l±˜gëÙO¿xþœ¹NäFóõv¯Çs–ž˜¯“sëùëãÕúåÙÂBX,rv„Öó÷«³ÞÑìêìät}rú -GK˜dÖû.ÿz¶…µ&ÐÉé~ùøí³c Ç]\¬ßÌ^®{¦=`!ͯ³ó wžÀ‘ÞÌ\GDáüd×a°œÏ€§ã-…g³w³ßzU´¶œÓ®1¯x"t¼PÜu‹¿¸…1îÆçw% ´_Þ¥ÅÂfV,6LY7eKB¼)P­Ïi‘´)nH¨ê´hp—'Ô(›Ü(øäzîÏÀéæ+Zl%¬0Â4%}ö -“:EЕ¬ŸÂÄÇ©"\÷¹AÃm†þˆ4سð}  R\W1Í •È—®aöXdŸJ6mEb®‰pi}m±êv2‹øÄ;Zm•4:vFPÚ(%Ú!)ð‚ó³>‚K¼=M;)‹'ÚC°)V!eB’fq«–•¶A‡Ø :Ë hG‡ÔȪ–WiÙ*ZR¬€¯m\XeÝí’ƒîÑÇ“¿ $.a%7tlp±q»jã8×k­{>.·Ê"ë¼ì -dgƒÎ˜ATíž&- EˆM-Ð$+$+gŠì¢=Y,·Ú\IÖÊì&xà:¡˜-y«²°»” M'@Ðdj –ábPwéØ< ?ò¼Ð±ÒùR3AËIÒ‚âsH &ˆV@LgGÁœ‰òâ‹Èaœß[*]˜7àq'ba¯ÂâmkÌõÁ³á½æ:Ì{A4Rƒ|î9^@ë²l¾‡ËÂ=«®â8£K‹Cû=®ýø þ™‰˜>Ÿ\ÊF—!ŒNä7*ÿÜ(˜,h‚?¡Ï¬Œ7Ù®TFã'&–:Ÿƒï†ÃpþIK¸{$%”·G𴌵ïè<¿Ù.º ÃÇ…Šý¿8£7~DûùrÖÉ“*Y÷'Eíøó%‘öç´Q»²º©†ùä4¦Bí 6tî½Y•uCÀe!/FêíC¡(‹Ë<‡è¿…þØyVÃ4}1°yRlK’„.òsUTø›‡ª‰n$Ü930ÔyŠQ4àÉXRØëx—62nÚºßòOÎ54»Ú4»NÇD>ëþ€ÒÁÿ}”8þŠÛJ%õUí$Y6jgÓlt¶üKýƒÐ:«Õ‹1ÏËb›^>Æ¢M§ŽðZfÕcµ;»¬‰âÛ²H›’n¯Ñ>êD¹Ý´Y“€/››ª‡žCÿGJí.¡ÿ溫² 6[ˆñª~§t¿&®Öcªo"U\§U¸‡U<^ŧèž,±·:§Þ»^à°Ð7‰œCWTao¬›âZ¿–ôçðhŒ1“”NÜÐò—¢Ë*Áã·ó<ðÊ#—îQÅ©»‡ø8Õ ¿q0Œ ŽË‚ 4ªãÁƒ½Á,R'4¡¹n”ßt¯Hs -h'B%\‡GcÞƒÊÄGýE¦÷RÀ#5·Ç¹ÃYÇ#Àï6ßî/7wÿÍOûendstream +xÚÍXÝoÛ6÷_a`*+JÔWÞÚôcíCê%n»!̓"˱0IT%ª©‡ýñ»ãѲlË-Ú`Ø4"Çã}ñwÇð©?|ùÌñâiqæEÑ4-'ÎôV^M¸áp¦‚9KÏ“'/ý`Ê;ñt±Ò,‹åµuþëÓùâÅåÌö<Ïâ1›ÙaYçïæ3n]u~ùúbñúâιõnŽËo/g‘g-f7‹7“‹Á±¶`"ððÜO“ëgºÕÞLæÅÑôÆãq<-'Â÷˜/<3/&W“ßz)´&¦´kÄ:[¸sCx‹"Ñ›Éý3/¤ÊÓ ,ˆ„µ–37²îiÒ* r«Æ™gDLŠVÒ¨Ô¼Ÿñ—æ[ŸZƒýZœ$n59±4´üÑá¢ÈZ¡Œ¨Ý8 ®˜Iý;O”!·xD¤Û™ âPrÞd)R²7ô8ÄÈ}ë\–uÒdè~ô9GÅÚX}RÞR¼îs˜ê8ö +xæ¤æªK~eELÉJi+`¨yTVÓÌg‡¶ÝàA$ˆÑ Rp ¿œèHtÄDäÓ¶C‘>þPbàŽHüèøÎÛ ³Ñ²¤€9'¿ŸÅÄ)_á҆…\»JÊ™çZ· M+‰³{âÁ@e©¼«´Ì¿(¸èÓŒKL`ÏmÌ“—Þ¾¥¶ðXàZ»FJõÑõ­¦NÓ"Ï*ESû®ýòþBJßGYÕ•xFÖ´DñÑ÷#÷„Î2¹{‰PÈ4)Ö²5Òÿ¦Ï]ƒ1ÕÒŸ¹fðÔ§A¹¡Cª¤¤Ì²GÄΛ¼ÒY‚;žk~¿®VÒhw6ÌK_o{ºç²:#Žk÷f$u‡Ò.@‡-óP¯±}O›t«,U]ÓïùWKyoÜu± ï—(øÖ¹óD­·2лøÿÏefßæª]˧5zàg}ðÜߣG.þJ»º]6Ÿ¶,ŠÑs•¬ò"ûQùå¦-oU«ê¦bóùó›c/ŸËj•ß=ä ´¡ËOYðkVÔ•ÎÖE}CׄŸ¾&—qˬœ¹¡FÄ0¯âã™-D ×a*¥AR–eR-‰p×Ú!¶sKs…ÖJ£(1láé:Ý5uƒ8.»­PXC6©±Ð°¬z °²6ª.ç~ýŽ"5ÀëºÖU?vo*Kmµ¶q·D‘^ᓱBh{Sm_f8."; Ö÷&!Sš §¤ëŒ–•™úÆ­Ó@ETÙ é㇠ý¨ÄVĬ(È(Dp0H#8LïÑ$] M$ê‚åXð*dT&¡È·k‰ž-Œ;;J›¾dR´‡”ÃÊï +?¬c¢,ß+Rn¾Š…1 ÍÔRw(Ø”‘«!"Ýæõå•Û㜅ˆÖ¬6Z©"Pç¸L|W:*)ZW]šfm»êŠbCâ@ƒg+SböÜ/[_Å•+~Ý +>¸Â1··šgI“Dçʆ&µ:Pâ>{¸Á‡1ïY ÁhÓ§n FýÀ´$°¨ÄÃcörë1ÒÜA_'¨y3ÃÄ(OÝήa­òíaC]îqœÐQ#½£†¸ zŸBuk¤¸–Æ¥^G¤|ê²sÝÕP¢ˆÚáVwÐðjqzsifK}w]5ôLDÿÀËŒ±@9KIßJ*ÚUm­AÀÕ­®ºŸAY‰áL4ÇÚœ¨C’ÑßÉn {û·y62PMþ®y (˜[;0‚8À·ž2Ïß<`'¤9aí,U`'WVņøwÚ¦²Ò¯ÓN­›œc`ñüˆ…<4 ‘U&Ô5¬´#WÃÞn:BWÜÿÔÚ¶—âà51æ +|K Žå®Ã„+Å–Gj\Ó0`‚oð{5¤‡–Áüæt…\b¼1RŽB…ñ·ÊPeƒ_cñ_¿eÖI;þŽé´zn˜€Ƙ´®•æx«ðÎTÿÎËæ.SõðAqø®©0¯™]ÁáàF/^:¦XPùðSùÙ³ñ—¤‡Gÿoís±³õØÒ-ÆeMoêHë>ò 0šŸÜrð,{3´k@¬­{¿ÊYËFãsY¾ô¾«ýfº„ðœ>ÕïÛسëQå3zïÐ≾8d~ŒÿΈzØ_Ã> endobj -5872 0 obj << -/D [5870 0 R /XYZ 85.039 781.388 null] +6154 0 obj << +/D [6152 0 R /XYZ 85.039 781.388 null] >> endobj -5873 0 obj << -/D [5870 0 R /XYZ 85.039 664.099 null] +6155 0 obj << +/D [6152 0 R /XYZ 85.039 734.834 null] >> endobj -5874 0 obj << -/D [5870 0 R /XYZ 85.039 80.616 null] +6156 0 obj << +/D [6152 0 R /XYZ 85.039 484.97 null] >> endobj -5869 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F62 4047 0 R /F15 2972 0 R /F79 5852 0 R >> +6157 0 obj << +/D [6152 0 R /XYZ 85.039 302.853 null] +>> endobj +6151 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5877 0 obj << -/Length 2424 +6161 0 obj << +/Length 2397 /Filter /FlateDecode >> stream -xÚµY[oÛ¸~ϯp½¨ ÔŒnÔ%X MÓmŠn6'q±§ÈöA–K'²¤Jr¼þ÷g.¤,'vv±)R‘Ã!9œùf8Ã8#þ9£H -Û‹Gaä/ŠFéêÄ-aä—GsL5ËtÀó~vrúQ#DZf»u¤ð¥7š-î­‹Oç7³ËÛÉÔó<ˉÅd†‘uñõfâXwL½¹½ºž]]ÿ‚=ˆŽõõ‡»Dž5c¦«ëÝðù¯ïϹç {ò}öùärÖKÚËRÅ(æ“ûïöhGú|b /ŽFhÛÂáÕ È)¤ïé~qrwòŸ~)óG<ëV¤ y/Õøµ8Ž+<Ç…ÒÒöI/eÕÁüÀª'Ah%Í$¬.O×Ådê@·Àþ–9&Ql%«¼ÈyŒ©PºŒ ¿#¡DÊ¢š¸.1´ï`LºV†dÕ(ä”VÞòŒ„?mV5(„¨Qi^«³ÉÔckÞàR°žgmZXP1O—)Ô;(aê Žb:Óµê6ÈY5Àf@È—´õ¼‚¹kl5Y…í¶Q8×±–rÃþÏêp,SL¼KVó„›­jPOª¡‰®UÐR<úÀ;ë¥Ìô6KÕ -<Œc}«Ö¤†ã¯‹ž+†-耑•…¦d¨p<8 $#4k Òp^vª¡}"i}¨ÖóÂLš¦ÔÌÓG^E.y6K‰´R7r=òc­PÛ¤‰\Ïp,1”^’ð3\‡™‹†ÀÊá>N'Õ÷šÇ3âÈRuÜÈ˶#ðÑh¡ŒMü@Z ‰;³I94°ï‡VZ•¥J»ÜlTêÍy‹7®Ñémß:/h?!¤ƒòÊ„]à‰7õÁ½7„|”q‹F. Tð[¡TɃ,&PÇ7 ;B§Œ}ô¼?li'å‚ù?NœàOc©F13>0ìA/¤‚œ†iò%¡³³æ)6ª‚Ý¥#É5é0ØÙÇ -Ò²7Ž¡½»ÜL#ƒ ”ÈB^W€’¹;¾èယóŒŠ×&†+3Î¥˜k vˆÁ'ÎÛ~üôðžrŽ5ÛïÚ8Åw\Øyƒ 0-£Ž„„v‡¹Â &dÉ$ŠœÌDçCuÔ -¼S³ *ð»íh˜ ýG•Ý[cIX£¨R€1Œoö½ðÀ1ØîZ é½í•1:9„lmVI’®Ðz^[Q¯ËøÜK¦ù#05®{è5ÃÐA´d¥¹ÈÐ0"Éô¥WgUÛ•À=î=Þ … w^ul·\›172Ö&Œ£ÉK—.c¿bÞí "à¨úS¥ënR8X»Ã]§ê"‡° L$dQг/VŒî€µÈ, õ—¨Z¼£(öIØf5WÐ0PëSïÇ'¥Ígn¹ÍÞR÷7¼À -ÌS-¸MwŠ¤+‘ût>lUz»ßórÁZá;ŽÖüïàQPöK±×­Bò Êap…Ð~Ëx-…RbŠŒ§ M€sW‰¾ê±ÓmkÅlE÷t­ñ‡ßî¸5')x™ Õl­ÆD°ª{Û¾„X‹ÏkÂJ‹¶ÞþF»‰yÚÆÜ"Ã^hîè/Å ´ýuÀùúyÀÈZ9– 2²&ž©¶¤ ZÓ•ô wªsm ¥…â…îÖ}ŒÇÈ”·mÎ:‚“šÐ¤³êOÜäTúÇ®b€Î}ïs|–=£rÀªŽÜ¿œVpÿWä¤R•cXƒÔ]°êkXðÅšá!¬yG±öÚv=ÖžïwkžÒîßÄZýA ŠºsB¾ƒCйŸM"Èbßç®äO—¯¨fzÇááþòzvy«YºMžªwz6.5Ãt´_C0¶ú‘8‡KP´Y&Œ÷™_&«„ ‹ŒXõ,í—ÇPåJ[„áëÏ1ž£¨2<„*ÿ(ª^Û®GÕóý¾s 7üD™ÑJ*`áÿÀ·­ÿ­wõ Ô!Q  Š$ }9¾N/¶Þo™¡äô ;,Ukn<î‘¿\+R¢gnYKæÕºãæÞ•Œ®ƒ±L:Tº.­JÌUìx‡ì(ØXT}ôÃn©”æ@ãK;Ú•YÉ`zŸ]îµà:>?¯[½ZmjxÝÏÍ·Ü-ãØP¿À -»’e_Üà¼*Ì«O`ž’¸Mx ì]ùŠ®Å ¾Ì‰mÿ*pöù³ýóöÖ@Æ1ýÆíHÇšõönƔۛ‹‹/† ->8Åïõ{ý—/—Xéæ–˜À_ÇìœSÀf[nð{4ö°Ç^É)SÿÎÅ ô -!ç¢ýÇÇzsÄkȃ¯ûª×xŽz­á!¯•G½öµíz¯}¾ßÁ»À bÈÅøÕsïŸ8š«4«t\¿Èþ4yE?o˜|·NSÕ¶Bˆ1~ÖwÈéSÒœÕò”îl þ‹czóm¯G»³OGÄèþñÙT8¡¾Ccã`ê\JB]7›Ä.{"=ÑX xH‹%N0ÁÊzÊñU(Ç -çˆÌ ÅÈ_—yÇóÒÖæ±:¶íô¼ÈÃê˜ËçO7bY±Æàj¡3@l¥LY¿M¬MN—Àñä^y±´ò&ÑÅLø†ž¬&VçØz‹Eoä[X¯÷ uFŽk£&Ý@V*¢a½ -IѶdA¹¾Y³¦©„ÊáÛ&b¸Ä,9‘j\£¢3‘æõeËaÑÚd©LýïÁÖs¨L"\™ýŸÑ êìX¶f 7>d3øåˆò·þj0¨.DäŇ /]W¸Ž‘ï†ÁsyÍ_^üÕJ4_endstream +xÚ­koÛ8ò{~…Ñ»Ce V%‘z倲}ìfK½­»ÙCÚŠ$ÛBdIKÉI Ü¿y²l+Û¢½‰Èáp†ó2îÄÿî$òmGÄ“0rmE“tsæLV°òó™«1œ‰´ÀÇ¥Ÿg¯ÞùÁÄuì؉'‹%¡,²[ëõ/—óÅÛÓ™Ârc{: ÃÈzýi>u­ ¸º^\]ÿŒ3 @×ú4Çå÷¦‘°Ó/‹_ÏÞ.lgÒ–@¾žÝ~q&í×3Çq4y„±c»q<ÙœI_ؾz^ž}<û­§Âkr»F¤›I/°½±£Höb +DÌFUר:ÍÛ¶V·EE /xz<²Ú0B\U×Ýߦ3ßó-Õ¤iYäUÇÓÙ' Œ<Á? Nùûr•w™*rÅóÍ®ÝÜu-ð­^2¤¬Ó¤\×mgغ ¥O\ooŠ*«[F¼^ð÷) +¾ qeLÈs<»aófÀòªZÖ<´Ï‹ì@›ÏU[ÔÕãÝzc †4¯“Mn7;°ØؾK•®‹.O»­ê÷|“`þ ÛyÒ­ ‰Ï®øsŸå³»¢k×uƒS2áßqt#¼?¢GþJ·M›©ege9*^Ò%ˢ̿—þÀ²ö|þfŒÅëºZ«a‚Bl‹çDø%/›¥n¯ËfŒö¿ëªèj2²!?f¬|™lË.]v»¦Çüpyó=4e¾Btfúö¹PÍ«í¦á(jO‚“¦¨$b醶yCÉÿË+•7'‘Î[\[úò@0ü9+ ö)%ËÛTM‡Qû $·QzþÚi½Ù€¾.nñ^½s‡™´W¼ê´o¦3×j $*‡úEV·†YŽàVCTÞât ð²köXŒBÀ×huÕodÀæ +9à¤íòFÃ=þ$ˆŸ1u+pBëíÃÔ‹¬\í\W†öÒ0;>\ŠP~˜b;¢$P2~„=ñ^Dg +ƳE +Á¡U´ú[µ]R–y†9`Å«(;i:ðšv£ÈŽ`È• p…g±³âvÄî0–½P@%ë•ûÐŽBT‰©òîX•‡°;¦ G%ï;&éSŒîIÁüìøÎ{ˆÿ뜘ÆÒ*X8Lø¹Aá)bfDþˆ…õ€õ+ð­Ÿë¸5¾ûö'­kÒDÇv@YÕ=Sä$¸Zã‘%Ÿ³Ñ~‡Vvúå¬jM¼æý¬ô˜ÛödƒÞMÝþèÚNdµüDSÁ¼qª„R3¼çkÁ²VÖûàƒ2ÈœbѦ2D‡”l=AÚ"ódzšÀ¥A#gûûÆáÁØ«U¨‘®—”K<ë q¹+óe£pïy7yäÑÁMõÁqQHÿ綗Kg5rY×Z Š½˜CWé쩤„\ê-JŒ ¸#0úA8•†¸Æ¢ÌsFÜQåÆCBöDH몂ìGÚ³4<ðÌ Ó±.5BRîUV%]>"+ù`‚l ~dQ9“ALn…óZ»wÅÓ¾ŽyÎ -Å‘ÃÓÞXðàú”UIDß ¬wSÐbò¤K¿kQŠ=Ír. ¸Ü1½e*ËÈe}ÇÅs€t=¶9ž¼îÊú”¡C} VUÌ?&c‘´÷Øä\ØöãƒÙ—YÖ}ÉY Q‰ïÙ"4•ý5[nDTéÛ~`Ð ÌN ¹xµ4ÆU…jë“W˱áÐso f$².u ðç OÃLàJ³Ô·fºh¨QÐñ§6Œl˜®)ZÁÇVÒìS£ñ˜õêÓi^±¢]éÙhø YÅÞž¸¾$ 9)…º^”#š‚žEDñˆŠ¡ +ôB½ð+èûñˆJ ›mÁ2¬–{°¼[SªZ1´,îYc&….4U¼Áãp–븆CRÄ@Q\4!%’I|Wöýshã}L6w ^jèx§2E®:áÀ/¤´®:,G=~7;ìt €—(œ=Ù—iPó)ï 2Fï0d9÷Ïj´‡Ð"%zÄ9Éþ<ÈþŠaI¶Ñi{¦Ej,M× û츲$\ o>z= + Ô#“ÁàvdC²]ŽÇkÔ7ßè< H?öáŽnmμ }†¤ª÷WÅ'`ï!0Z}2*åxn^À!!ZTÍï† +Jf:;}’Ös¬¿6#¡i¸5µ'7'ÒAçBWìˆãâà6ácßkï!1ó£C¥h«5ãíý&SOpBul×Pè¢jüÀÚ›…ôý}uöù.þæýGÞ¬{ Ä}zÁ ´ïMÕ벦„¤ÚÞ›š¤m9§‘okázQtszòìA¹oñíò -~1â>ø +5K†œî/PŠéwŠm•è±WPÖkjÍi¶msu¯<˜YY +§ôdÁBç”Ì>]½­:µû‹' mÅW˜e™ßZÌÀô!WGï/Æž i’Œß_^¯éæ¼Â—t†ŠŠƒÔØhê²"6JGÞ´bôºJs¡IûlI*çÀj¥êi +õ„„ûcŸAá–æÇœI)TÑ%H×[Hãƒøõ@M&ÎÁÿFëí>7— X&Ò„yŒåUÙRFƒ”p΀ےÚëÔ}Ü%H»¯í—McÊún„l"Óý“cXBðŸtT¢mVºÙFk¬óa–Е +Ûû»„Û§çoë^$m_Èï¿­{ÿ÷Ûú?·˜,©³.w+ûx®3®Éœ RºÉüà¢ó$záçõ`ÿK|Îw¡™8$ˉÿù· ; üñ¿ÓhKýØLfoõ¿Ô¼;'šl©þ„©Áendstream endobj -5876 0 obj << +6160 0 obj << /Type /Page -/Contents 5877 0 R -/Resources 5875 0 R +/Contents 6161 0 R +/Resources 6159 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5843 0 R ->> endobj -5878 0 obj << -/D [5876 0 R /XYZ 85.039 781.388 null] ->> endobj -5879 0 obj << -/D [5876 0 R /XYZ 85.039 457.872 null] +/Parent 6158 0 R >> endobj -5880 0 obj << -/D [5876 0 R /XYZ 85.039 372.982 null] ->> endobj -5881 0 obj << -/D [5876 0 R /XYZ 85.039 277.876 null] ->> endobj -5882 0 obj << -/D [5876 0 R /XYZ 85.039 210.13 null] +6162 0 obj << +/D [6160 0 R /XYZ 85.039 781.388 null] >> endobj -1686 0 obj << -/D [5876 0 R /XYZ 85.039 140.668 null] +6163 0 obj << +/D [6160 0 R /XYZ 85.039 379.566 null] >> endobj -5883 0 obj << -/D [5876 0 R /XYZ 85.039 103.801 null] +6164 0 obj << +/D [6160 0 R /XYZ 85.039 95.033 null] >> endobj -5875 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F79 5852 0 R /F58 3360 0 R /F20 2961 0 R /F15 2972 0 R >> +6159 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F62 4159 0 R /F20 3021 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5886 0 obj << -/Length 1847 +6167 0 obj << +/Length 2157 /Filter /FlateDecode >> stream -xÚ½koÛ6ð»…×aˆÍrJ‚÷néÚ -(/׌µ!rÅxk‰–ט6z.&3ù'ґ㨹˯ªRrÝç5(;U4Ýݯlè=gÚ¹–ª-öÑ.Q¼˜/?.–'Ë«ÅÇ«ùâêììÕbq~õû÷çà `æ…¡¡ àA `•¯+˜ý1L–`g°ànÐ2ixÕû±Ò¤dhoy„’{qñ¹íÔç ëGaß¾ÙBræÈ-Š)›MLçCí†_Íd-ƒ²¤‘ûì{ÊϘw²•E®1óKDtÀ5}n¦ÕºÌ1¨Ah<Šˆ)~K¹Ã -ƒKÊBÖ -MGšña_³q³­18Y-°_¶P’z‡¦- IìSõÁˆ›ZštÔ$uìíhÀ H2ÖüU}vja¾ã Èt¨}ƒõ%^ ,,V‰=Ó% ‚·5g{˜årQâû!ôh@šÙ]Dl²i¾z`ùŠ©^PiM÷eÁ¢– ±GÛ#Õ7wXÉa8!×UÎo–§<šqD†Ú'÷2mùäÎê&#uŽ˜g˜T ±Õ° ˆº‘ºNäaÊ"FŠN¹ëc Yââ‰a°b¤¡°}6(ïêYW}uÍ¥Ð×µ¼7êñH¹Ñ=W®.µUÕüȶަi‘ËRÞ¦NJµ‘MÂ[s®¿WGHó“’i-›# Lù{$Ëv³åN¬Ë¶uô/Öµ„,´-èGÕ&ÙÑ°ºhò2ÙÈãkƼ+Lå@™“’’Èc¿É¿ô­Êø‰ãžQ„©UhHß½º[—Áÿ»1ײÙ§6ÆÑWì–n2FûEÛ{”z$zWE²VÇ×Ö}dáÏÍ -;ãƒízø×+ƒ›‡žeR¥u¾m >~“ö¹þ¼¼|y3ž\°ãñ5”Ë«rY©fA¼Íe-óÛNÅU¥ïór¾|áüöâïËïÇNHל.ÑÇïÁÙØTmoÐçmW÷yX´XÏð¸é“·ƒp$mt[¤AVQ[¬ü­b´„­äŽ÷›ª–Ϲ‡b¡Û*9Ý5,ÁˆN]‚ÆVÆͨoì×R}S¥e®%…}ÕŒ sï©Ee2Ø)úùò°¦0DÉúà*J®­Õ_y<Øq lßùæCh€C¿§žp½`ð²ƒ@„±C’ÃÛÇvÏ1ä<*…Ab»Ê­gZ€ü,šì—¡qžSV_4ð„e}GÐGt/¶:>N$"¶ð¢Â‘Ú =ƒ:ñC?ÈúáºÄ8¡o$Jéç ñTÃú™!t]G+ªüHÍ–Â@v£AÈÁ„x,Û£¡»Ž+s¡h$f`Ûàñ¡Šà^?>dÂÊZË\2¥Ü­Ñ s!R^š#¡GQœ`}Ðc¤jGvª 7Ç1=t9æFYʉ8à· ŽÁJMš(~ü쟫Ž3¾›ž8Þ="ˆ¼©mûpö÷¹®µFŸ¸fÇË0; ×wDì‡ýzú‡Ö_i±Yu-<«µ÷ÀT‚¦1ÚRÞß´Wm§?šÞt‚PÄ]ËиE›]Àá ‰â8š¯oýàD#Ë'Ž}Ó²t8åTõ†ì,0ÄÅóáUÉÓ ¾(iüª’C?h©ƒ%„ -“í±êZ;®9íB“.nº›Ç†ü÷ÍãÖU·;™×<lé}Ά®”~¤—×N™Ã¶ö~` +; †{M!Ãp¸8®-\ÇÖít0üÞÎÂ}ÎGõœnìXž°|`9Ûni»}Ç|óQÚΣ±k¹FQgqšÚ·vE’Uu"@õúåùÕeVî=K2-è_œÿ/£í"*Uñ  +lnåvQ•Õ®ÈÐ!goåÓmŒ[x¶O›¹Z±c“Šã|4¶|CÆÒ(ÙËø7×ÝûtæŽ=-ó:…VÌ ˜$ÀI°±Åîqâ,·(à%-•ä[ï°3_¤jËÃöIµAÉ2ªâã¸Aç8Vè‰ÐÑ®½#²U ;V¶#l€[ý¯gWø–¯û?õxMJaÁ6(7Q¡Äs°Áñöpì›Â·Ý> ø"ðC|È>|HûhjPÑ{¦t…ã:)=«gʦkþ¶«tužE)´%85pŒt7é³úµ|eÐY©R+vÑš|„i“÷ÈÞ=öÉ·‘}òMhÏ6 +1eºÆ†Ð ÂÝ iâüâ7?šÒyi¤šžQ%[Ep| m)»KpÎ5P’¶¯Ðvßw‰‚jL»3{àäÖ€Q¦£wq sBóûõÔÑ:Jôn»¦%QA“Aôlô>r<<W"3…t\^ cn5ÃíVªx©„Ðú÷Huþ¤Þªe¾¥“«,æC¡C¤Á°u¾ÔW´€¦IÉLX¥]®#¦×³`á7vCÇøc‰F¡cÅ=ϵìÓJ÷‘Üa‡\m”§ÚzÛ>¦|(ÄðÕ›sÝÚ-¨ºÂ¼€ˆü¹Hùüb‚Ž‹U¦ºþJ²òFªâ¾t9î®ÁÑ­ªÆ=x¾©wÈ£ŸÄºã +Ûw5¢8ŽÛ‚óƒ6w¼¢ë‰ ÍÏ;**tŽÞÄ»÷B}Ÿ°ð:‹œ<¶l …ºP?a@¸ÆEãE0}L|Ѐ +^ i™³ÄU ØÃ?8aB}.Æï˜\'àö:Á“VɦkÅ_š¼Â'¸H“ûÑãû¾¾ù<ƒm÷2 oOb*UÖ˜ñÞöQÉÂõÑÓ×w…t€kàx‡ß~Ûðrõzß¿Øãw¸¼÷U;ÏæÓç»°]aº<ô{V÷¾µúüz:ŸL.§Ó·ó}–è9Ú‘| WXÞù!Ý-þRð£°æ70ƒ*fÊ(×nRiûÇ’K /J…i`¶ÅÊ_œªVzem:™ß ‡½æVýœ*xÁ¾à²Ý@8f)频áB]‚ì8)$Í›;p÷Û>ï4Ót1ºdÞÚFT‚cY> endobj -5887 0 obj << -/D [5885 0 R /XYZ 85.039 781.388 null] +6168 0 obj << +/D [6166 0 R /XYZ 85.039 781.388 null] >> endobj -1690 0 obj << -/D [5885 0 R /XYZ 85.039 196.152 null] +6169 0 obj << +/D [6166 0 R /XYZ 85.039 690.894 null] >> endobj -5888 0 obj << -/D [5885 0 R /XYZ 85.039 153.199 null] +6170 0 obj << +/D [6166 0 R /XYZ 85.039 563.277 null] >> endobj -5884 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F62 4047 0 R /F20 2961 0 R >> +6171 0 obj << +/D [6166 0 R /XYZ 85.039 495.531 null] +>> endobj +1722 0 obj << +/D [6166 0 R /XYZ 85.039 398.103 null] +>> endobj +6172 0 obj << +/D [6166 0 R /XYZ 85.039 361.236 null] +>> endobj +6165 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F58 3380 0 R /F81 5323 0 R /F62 4159 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5892 0 obj << -/Length 2795 +6175 0 obj << +/Length 2623 /Filter /FlateDecode >> stream -xÚ¥ksÛ6ò»…Æ÷¡T'¢ ’à#÷;iZw®i.V®w“f¦DIK¤JRv=ýóÝHÈ’Ü7›Àb±Xì{a5 -àG2íQ>J3åGY6šo/‚Ñ -V¾½P‚1”‰ƒs3½¸z§“‘ -ü<ÈGÓå@Gû±ŽFÓÅgïÍwצß|O¢(òTî'išyo>}+>Þ¾ŸÞ¾ÿg1•÷é.ÿøqœEÞ”‘nßË×?Ü\ó,òƒñ—é÷ßL{N{€«Ùüõâó—`´€+}øQžaø -–·À§¯ãH曋»‹÷¤x-ñ®SR±¸Yê—%—(?N¢^r!¬*?×Ú•œ|Ä$9 ©B®«@hZ ‰<ôšñDy%@J³!$‰÷A¦37¦-’zïaS´çd#§¼Èí€CÜ*}BÏ*ñ£„˜E}ä‰÷œ[V ø[ÃÔ{lü~Êߟ f›²‡™×Á\áŠöîŠæAEØ÷4)ðf;Ø tºÆÌ‘î=oª—ü5› ¯ãµ«eÝÀgËBAH]ñjc¢X,Šïìj^j .,­Îž›zx¡}‡‹Oý>˜<"/¦Y ˜Az…Æ“<Ê·±7G ÷Î=^ÓÞ 'OŒ×â*Y£p”·b°ÝÂjˆˆl-ñNAäuë‚¢] æK.?«²íš§K° Üåͦ,˜oúuoEÒô -ߦ¦jéžECBˆËvS˜…ð{,„%R­Aq§|ŽákœÅÞ+_/¬ÒH‰¸l:Ð$ðyüͽ½è‰góºú9P1¾Ç“@Û¨j\b¼ŽÔ_­Z>Õ4­Á;±¾¼g&úÅñ#É£³šÀDŠdW3ŠþøÎéäUÉÆ£XmOÈP10³ÅÓg8Â8‚Q¶D¾÷·ÿePMü< õ¾Ý<1”\«új¬H…XFËŠ%WY3]9çž­„aä>$+±æ× ¼FÞ2šy3ÙM›{Lº¨Z÷€w­+MRaÇÍÐqc` -OŽÃ„sÇ0qÞXúÓ‘~¹¬–ä[«g‚1¾á)ñV4ä%ö Žð5†Ñn1c,4 Ž€‹é(Œ).MßÞð¦¿ógŠrh†H‹°·¬1¾¿aØ ‰¡-0–ù' bºæ£ÈëWðÖ7/'pý9G-ö4ks4¼zkXsµAàìª2WBœ"ÌsÏRD±_ V›²…‚B„ ò|GFÏj`ÇaxSl–Äã6C¬à;_œ íœpß›ÖïÐg¯8·»8|p¿n}Î êv3ïω¼þˆ+­7Èþ4ÿL:LTæÇÙËéÐÁ9›¼uù*È“w(Éû¦¬Ì8"ÿâ=Ž@iƒ>ÙÎ?ýÎœ³‰ZëÌÏvůñ%áà Q‰m´ª;¬QŠû­©xŠÑÞÌHýx- `f/QoEœVJ:¼Úºd0~£$'*Íü$9'º¼(<ÃR§ÞÛÔolpª hÝr¸í%*¤*§ÞÚ¼w€ZP—’LŽ•ÌÒ2|[®Öö¢°ÃѼ¨ù‹¦˜’‘+Ñ¡Ö¤SŒËF?ÔW–Ièc­éÌÑÚ¡e™ŽÑ¹Ò†”QWnéœcÅSóŠâ1ªÅ¡¸g"õ‡0˜¤CôãUT¢ë«–×,÷°ìá<œP95Ôÿ0gÂêz] -TìÊ_Žìu%Œþ0&-Ûð› ™'ÆÈdä‚Nì=iÞÀ–bШ°ÿÛ;¡y²mf -D¡ÂVHÒT‡³!q!’hVPtÏ7Ò(¦›—L-S£Ja鑳JqaKj„óE…©ºíÅ4³§>–`fÇ‘h‡žÂ‰ –œâä“øYu®&‰ãÔ×QþbæwpÎÖ$qú*‰k’Hj’¡ÆÚ’ê<׺ðlëÜB ¤²?ãnÀ9[—€ùAHÌÝ¢ðó˜ì¿òð$Ð펔R7éû„Û_#û 2¼á±c)y|T±"¬)¶†zC m¡ÝtÚs†×ncÅM'œÈ- ,?R™I¶‹O‰¸ÛÑžƒå(þ°zùnxT(ÜsõÈÀ˜d¯XCqƒŒvf·³fKUWäìöìx­7©À­]Ž# Ês_C%ËñkQŸˆpJû‰²©mU[óºiÐþwÐ/ ¿¥!õV×'2iúQž{°· ë/UÞ$çï/ôüS.¨]„ùAºýåS`ÿ¡šëR$rf8nÅPǧità±”G€¨V½¦ZUµTJZjXm ·U3d­8QS’Ü,Â`´“ôPðxAí¿YÉÔÈ~Ö:½ci%P.—µòÄöëh„36×ÞLš=vRTŸ’ÍDÐ Ýœ‹*,W±C‹„X$w™KóÊ×=f”ŒR¨øºľWœG‘³4JÅ>Iuœ¦Ã^º: ×$€4šôÄ2iz*†ï#¨N·’f‡wš;%~š a'áH#(µ•@ þ?,U©_€IUÈÁgªKAؘ̭° iÕy…Ÿ aÐ÷²Gx“mŸa"Sä#²sÙ7K¤Ö”‚2¨Rïdž‘†ÆÖŸ=ùÀòV¢ ךգ3.øÅÔ9‘£­bàY?2Ђ˜H¹-Îå®(Ð~¦^îZœ³¹+„²4RéaîŠ%w}jɆVœ¯ qÍÌüìÿ4Kaª©^y‰%çl -¡üW)§S·AŠ·]cxÞµ<£â€F´ŒE|×a -BО¬ Öz•ârˆ³þÙNaÔØXŠ}M«"Ïi»¤¼~1€”¬”µœ†g„òÉnË„: R°a6<­â~wj;WÇÖpXŒJ£}‹“%?Î8yaªb¨íÆ *z¤–w-O9µ¼í4«½}õ‘çAy1*;y9r"IË” ¯PÓ$"èо¬²• Oå½ætéÃF ý4ã -¥©ëî/`|¡>4·‘öÓ0;Ç'¤úú9.M?×; @ížþmYA­êûþ?¬XÃÔr&óŸ¢Áüu䜾ÀE 5>8j2K𮣺i¢ÑðîH÷;ÖØDpÛýrYþ¦”àÓ8ñŒ‘.ç‚z‚Öƒ°ðP4åòIŽ®B €¦h»º@¹ä/ ;þ'Ðq.‡®ÔW ú‰N|°® -[X—¢í5÷2˜i~ËÚïYÞ÷f#`„Í,>›ÐÁã#/sŸñúl¨óÓe0ü²€þ¯@Ått¾–ÖPâ‡Êò‚b‚Àùœ_e¾Î¢c†ÿWÓ:@endstream +xÚ­Y[oÛÈ~÷¯P·(L-,šÃ’Ë…o¶Y ®+ÈIF"-I-IYÉ¿ï¹ÌPTL9n» ÎõÌœûwFbÀ_1Ñ‘Èt’háK­'Ëò,˜¬`æ×3aWåq„S/çg—¯£x"? ÒÉüž–̳Þ«\ÝÎy;I)=‘úÓY’hïÕ»Û©ðîxôöí››ù››_±§`Pxïnqú_o§Zzóé§ùog¿ÌÇΔ¯b‰çþqöáS0Éàj¿¾LõdíÀi:)ÏT$ýHIÛßœÝý»§Âsj»F¸›© ñ“0žÌdàk­z6e4Âæ¶)ª.o*Sæ/>Žöå'¼øåk1\>S‘¯…†¯ôcÓÖ«ŠÅ`6Hø6]΢XÖåt&¼ÒT/YÖ» ,°½Åtj/çN·.Ú|â7ä³:«©ëî¯ÓYF^³].7E^uÜíSµeÞîÎnì÷Ý9îù[›/›¼;·ƒKþž¯òÎ2ÎÌø9^câ8(ç”N_–¯û‰?ãÛiwp´ñ~cVí‹ÁàŸO#KXò…Tø¯ç;u¸MíÉòvÙÛ®¨«'·^ØÏõíõØÑ ¦äøâXõsr[·Ýў͛¼X8ïkÛx_TY½o¹s3¿ ƒàËåï·Ïµ™—_A÷q +ZϹ±Ÿ†‰g¦`_Ñi.Ð4´a Þñ’%Ú’©°£½]‹“)¸&-^ÐÜ„×bè„Þú›âJÃïó=÷˺ÉíÒúÞžVïšÖ v5Uۙ͆;xHS<àóÆ®íõšœ,¿Ox,o:A;Q„è*7sþn‰h5 A6<Òæ ŸæÇéN ¿|_zy‡àø Ç·Ç¡o¦¾ŒEBV¾Tñ0*@¼!„<¸9Ä18Õ%ãØ»E³/ªöïG®Õe¸`Áó¯‹MÞŽ¾ÐOtzâB2ò…û ‰±0uW—tí•d+¤dð¿¯|‘¢åIÓÒJ(a³( (e¼h_tknukK d\äv/N~ „Ú¸ÁÃÃjÁCtZl‰±ýÅ.Een9È™†”¾âÝEÅ+rk=öúw¦D7X` ±¢À £ƒžêICáÍ×9PQiè™&‰£BÄ ÝÐÊqYWU¾Äí­ße‹¯…ô™Ú.¿!¨} ýAös8A+Öˆ’gÒj×–¡éH‘øiÒKã»™Sú +"ÍXÞļʓٰ¨îë¼s}—ØÎW]¢Ã b H>A |9ð#!ì`Wå_¶ ½<;¥;`\‹'ÈƾNÜü¢ÙÔËÏ'(E‰&á3)!'Œ ôSÐÆóHUdš²ý3H•yÛšU~R¡…ñ³¯eó}û¿JþX¡œÆ[¸!xbqJ‰öÇ-æ¶ÇTCá‡Â©‰¡ÎIÙ9sƒ¸¡”òÞ¯MÇŒ‚'!±¼h¸¹Å¨Öl)ŒÖyòŸ¥ §ÖÖÀšõÉtù2‰ÒðS”À£t#<9' + ç@P‘_y2«ù‹;ëŽÛë#.ÈÑvKì­í1üy;b*šËñ!¬¢µˆãi¹¡ë…ÖMÉ·íã¡#Ñ[ƈò¬·Bƒ*Q/è-aãêa+ý„QÖQÖ zÕ&Î7€áR +G®íÏIQèëÐÁ¨OÄ)ý@»TA·§#àóë—|ÒO|9eXì ’ÞðÔ5±f¸óÒðU1ú$@€½!“#9Jåuµ{ÿ„v}ßå‹#àîp{„‚µPÆ$ÂáÔËÓ\nŠÅekÊ…¹KЩ¯Se—ƒF(J ¨Ž®9M1PÕF‡¤©ÀÖJÞ†ù¢ŽÀR3b#8ŽzA€Ï) S¬òS(Ö‘ùÊ× ðÿ£•Øƒø“0>Ø|º‹é™àÙxç¿ÙþHQšj?} +·‰|&n -nyYTf*!nÛÂîõT€&pòùh] *>U ¨8Ò§ –“Þ„S1êíp3€”+¤Šúˆ‹ƒk4Ô]‰o-Ø탙Á,f›±c’Øšs@FQ>a?VŠË\E» +}¦±{¾¡tmKŸ­Þ¯]"†uÛ]ݽzCõ›Ÿ¸p¾A,\£5’Qè•Æ‘Šà"ígÔP 蔫ûÎqÖðbˆçØŠñ ¿-U\äCR&Ç‘§{‡u¢B+“ˆÙ‡þÊ>ØÐÿ™]cS$¶)Hää\gI3VÌ8M»óÜÓªÿÃHš3&ÁÑ™sŒ“:ÏQ:/Zîdy[¬,Æèæ²h ·ó”ƒ<ÑQÊÇq¶“’'éÒæ7sp=‘7Ã$ˆó$c´­8ÒÇ„Ù<9?g£ù¹fÐvxRć¬2óÝߊdðÕÀå®r8Ñ‚W¦±™ü)‡ñjœÔE¹¶œÊB/OµqÚGÏ©°ª_²‘Ø£éE•2ÉÁ›æîs¿Ã4Õ¿ß\¸raÀ?’qÆ$^•C2h¦ä?ÊË8>’&z¾ó¿˜Ö®ë]Û?«â ½’)4!~éDçÕ{ŸëØ݇¤#­Ech™%W«µcƒQÞgC<£æïÞAö¢Ëg,-6™ÖRá÷<<”|àãÔ¿ŠˆT?n~7ia”Õó2õã@É*ê$´÷܇Z`}E™gbuT™ë”]Xªt\°Û×…ÜeA?ž·£À°–Ïà\Æ'3ø +==ÚºÑ kkÇJ‚ +.¦çìš°åÇJdퟆJ¶¯¼ƒŒƒ½ÝÆFƾ‡ÃÈ>êEh@°>Æú„¨ZÝj¦Ÿ¢4×È8Ê*RɈbhA}_Hº!!aÒË£“ø» æ T‚ ëP0G58ÕDt³êÜ’a?±†/1m± ‹@V]a ²gŸN½Û ’ßrì/sWX 2 §°1œ$T ¶!ÇaÊs_fŸüMS‚oêá+ïéÇš0 ¿½"¾pÇŠßvÝÿ Î[Gendstream endobj -5891 0 obj << +6174 0 obj << /Type /Page -/Contents 5892 0 R -/Resources 5890 0 R +/Contents 6175 0 R +/Resources 6173 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5889 0 R ->> endobj -5893 0 obj << -/D [5891 0 R /XYZ 85.039 781.388 null] ->> endobj -1694 0 obj << -/D [5891 0 R /XYZ 85.039 761.463 null] +/Parent 6158 0 R >> endobj -5894 0 obj << -/D [5891 0 R /XYZ 85.039 743.459 null] +6176 0 obj << +/D [6174 0 R /XYZ 85.039 781.388 null] >> endobj -1698 0 obj << -/D [5891 0 R /XYZ 85.039 618.484 null] +1726 0 obj << +/D [6174 0 R /XYZ 85.039 519.739 null] >> endobj -5895 0 obj << -/D [5891 0 R /XYZ 85.039 583.738 null] +6177 0 obj << +/D [6174 0 R /XYZ 85.039 476.786 null] >> endobj -1702 0 obj << -/D [5891 0 R /XYZ 85.039 447.539 null] +1730 0 obj << +/D [6174 0 R /XYZ 85.039 394.443 null] >> endobj -5896 0 obj << -/D [5891 0 R /XYZ 85.039 412.793 null] +6178 0 obj << +/D [6174 0 R /XYZ 85.039 362.022 null] >> endobj -1706 0 obj << -/D [5891 0 R /XYZ 85.039 305.814 null] +1734 0 obj << +/D [6174 0 R /XYZ 85.039 235.939 null] >> endobj -5897 0 obj << -/D [5891 0 R /XYZ 85.039 268.947 null] +6179 0 obj << +/D [6174 0 R /XYZ 85.039 201.496 null] >> endobj -5890 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R /F35 2976 0 R >> +6173 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5900 0 obj << -/Length 1800 +6182 0 obj << +/Length 1833 /Filter /FlateDecode >> stream -xÚ½XKsãD¾ûW¸à"SHÖè­ÜX »˜]s €¢dib‹H1Ç›O?FŠüX.T‘T¢VOO¿¦û›¶ÅÒ‡_±ÌbÏóeš /̲eÙ.üåV¾[+áZw&óÕv±þ6N–Â÷r?_n^ôÄ^‡Ëmõ›óõ÷¯6Û×ïWn†ŽÈ½•›¦™óõ/›•p>0wóþþÝöþÝwøS8¿lpù§÷«,t¶,tÿîeùÕÛ¯^ñ[èù«?¶o¯·“§“àUŽnþ½øíYAHo¾æÙò´ï Xnà§G¡}o?Oªx-Zò®[Y‰ÃÌ‹³ð:-a|#-aâåqLiÑJ™ÏWnÄN3` Ïh.§uÌSûÎN«Ó ½ª0p’‚´*ënï™j·rƒöw¦Òõ“ÔóD R½®;3ŠÍ´³q´'l…–Ö݃ší-U×ÉÒÔª³ÑÉVC±—–ß»J·Ã¥ À܃Ǟ•;ù±Õ²š™Ûi ‰¡€÷­ê‘14Y%ÅŽ¯><_»ëüŠ(DòèF][¬Bvÿ‘­âTG±—‰ó¹Ÿñ0ƒ*&+ÙyÜRCb2˜îÇmÁÀu^oYÀNÀóqò®·¡³¤[F˱÷³Ž&i.@&%EKNá`UÒí¡PÃ#3ÖpÛ–&¤~(&\žÝFjÞ€C!×ú–g]°ßŠš/ùKƒÓA1QÛñ¯hËáIX=C7 ï*ŽÔ¢_ðJhÎ` J;6·P¥«ëžE¨ ê¦æ©çïC?Ôrßjøã0ÿÓwÓ˜ ³0¿ÝPqx}Á´\ú;~×qåð?bã…endstream +xÚ½XYoÛF~ׯЇ’A¸áryE4MjiêÆv" ZJ\I„y¨KÊŽÿ}çXÊ”MÙ +4Â=fgfg¾9Vrîßœ§‘ðU6OR)TšÎ—õÌŸ¯a秙´þ<~áÖ—³Wï¢x.}‘ùÙürE$—ÅgçÍéëóË·Ÿ\O)åÈL¸^’¤Î›«sW:¼zþéìãåÙÇŸp¢t®Îqû—OnªœK÷ËåûÙÛË‘X/a¬Pîß³Ï_üyª½ŸùBeéüƾY6¯ga¤D*;¯f³_÷\x/œó©‰Ûy…ZgA4moe{°,a%ÛÈ@À\?Š|çŒÛ®lÖpå8v^ˆ¾Xà0qÞ•ìénâÒPGµPR¤ò^ Mxâ¬w½0‘NÙñ÷Æ RG›;œùNYo]ZÓƒyƒ›ö@¿Á;É« +u{õNeÈ0~YI|¢:ÐD)‘$ÒýáËîêzÒ±*]çeà +-q½m\ÚD­{¢ŲA±•äkà–შ! nyÎâQR¾)xËèÜŽr’³d-H’îê®M2‘¨=‰@ÈHëS’y뉣ǒ¥óøj% Q=é;uŽw^E:2.N6šUà3h"Ø®`ÙØäY&"²5‹vÂÞ2±L-ÅZ[µ–­1;`»íuxŒ“Eþkf#`.‹-ƒk€&èV±)½Œ¿áÚ¶,ÚÏ»ÚUƒhœâÛ)¥ >‚)·›Òb5ËÙî¡L'êÀî·†œ¨"¹÷Xgƒk%}Á£ À¶è‘vmönE"F^½*x¥@*>I~Ð<Æå¼Î×všÛóìuD©aEæRPú‚òô³ƒ¶©ì~;íÖ{½Âùè)BS+¡â”M‘ +w( €à©,sšA]ðBßò×hL¹‚ò‡©Å¥Àí­ÁPçŽù:d€TŒÄìfÏ2 }Ò ,°"Õcñ/ŽÈ÷Ì­Çÿ¢QZ©m; †‡a›ð¤ˆ}&ø9¿³Î xÁW'aø4„¢ÿG$9`â5;•Ç z8ªèØK„B…ñÃ^‚^Üa†?8\ðcûEs7ñ£¡—%ô6Cç$+ÓÖLñJÍîëÖUðhä† /Ö¢uUjé¬'’$;¦~$¤|¦!a•ƒ4÷"\á‚4¶ín¯mAÿö=3†'=×Ü œv¢HpzÎß9·ªæ½î=º·/ÃaÍçÆEÝ:¿ã4Xâ‘¿Sž”M×ÓC'TiËZ7P=–<)ˆ¥ýb"Üs›ý±½o«Š @·Ï¼áâ ©is[¦ÿí÷"…j¯à“ž 2õPCC a8Rðt²Áÿendstream endobj -5899 0 obj << +6181 0 obj << /Type /Page -/Contents 5900 0 R -/Resources 5898 0 R +/Contents 6182 0 R +/Resources 6180 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5889 0 R -/Annots [ 5903 0 R 5904 0 R ] +/Parent 6158 0 R >> endobj -5903 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [325.68 275.906 539.579 287.898] -/Subtype/Link/A<> +6183 0 obj << +/D [6181 0 R /XYZ 85.039 781.388 null] >> endobj -5904 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 262.357 131.853 274.349] -/Subtype/Link/A<> +1738 0 obj << +/D [6181 0 R /XYZ 85.039 761.463 null] >> endobj -5901 0 obj << -/D [5899 0 R /XYZ 85.039 781.388 null] +6184 0 obj << +/D [6181 0 R /XYZ 85.039 741.134 null] >> endobj -1710 0 obj << -/D [5899 0 R /XYZ 85.039 544.376 null] +1742 0 obj << +/D [6181 0 R /XYZ 85.039 633.349 null] >> endobj -5902 0 obj << -/D [5899 0 R /XYZ 85.039 499.301 null] +6185 0 obj << +/D [6181 0 R /XYZ 85.039 596.482 null] >> endobj -5898 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F20 2961 0 R /F15 2972 0 R >> +1746 0 obj << +/D [6181 0 R /XYZ 85.039 139.827 null] +>> endobj +6186 0 obj << +/D [6181 0 R /XYZ 85.039 94.752 null] +>> endobj +6180 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F59 3455 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5907 0 obj << -/Length 3800 +6189 0 obj << +/Length 3344 /Filter /FlateDecode >> stream -xÚ¥ZëoÛFÿî¿B5pT4—o¦ŸÒ¤IÜK_â Úâ@‹´Ä E*$åÇýõ7¯%—¤äP–»ÃÙÙÙyüfhµpàŸZÄíxÉ"Š•íÅñb½;sXys¦„b%$+ƒæç볋×A¸PŽ8ÉâúvàØ~à-®³?¬—o_\]ÿòq¹ò<ÏR‰½\EQl½ü|µTÖ'ž½úxùþúòý|òaRYŸ¯pùÃÇeìY×Ltù~X~ñÛÏ/øɳå_׿žýrÝKÚËR%(æ·³?þré×3Çö’xqcÇV°¼;9íÀ÷ä¹<ûtö¯ž¯ù ~ë˜V4ÅÊ×ÿ?¶eNpt;g±R }Å'ùÐ[ðá‘&óéï*ˆ`‡ý]…þB); ¼«Ä±}zò#;Q>ÝÕû”Û-WÊʧZê0pí òãâÛBÙŽŸ$“c’~8M\\îÔâU b. I…íÊàK’ªØ°*å&v‹H…¶ŠÙ¬®·K”rå)׺…a½t#«ÁŽÄopEYçëþ­wiW¬qúœg×uµÎñyÏÇE [VÀ+¶î™öf¹‚‡œš|_¦ë<ÓK°òÈãn+²T,–²îĉ€å9¬·L·#Þ ©—îÍ'¡ía§ˆÏq¿ä=èöP.W %뜊ÕÄ6Eùùh«¦ÀÓœ£9 M†G_iN@BŒ -8©ï:,5N´$$P/VNÛŠN‰¢¾å_P(kJ sÙ^¤µÕ‘³µy½˜…À_P7üÆVYWº7÷ÔEÕñOžÁF¡“Xoù~s“IÌF«M™æ÷<ø sß QÍs|Y0xzžiJbÊä ŸÞàOK -z>õ¹d§ðß¼.4¡øh„M½2ÈÉö½À´ý OeÛuûç÷÷÷vYT‡‡}j*ª]7›‹¬)îòæßeÑvözSLeô]ø¹c§AMhf’¼rÊ %Ã;Š"ë’ŒÅç@‹>ðÃaÏ–±r"s4Òî¦A½fhŽ~H…¿¦½O ¼Ë<+««ghòèZ›¼3AÆe+d¡°YƦbÒ±3À`paÚ¯íÈÏKY½ºzÕšæü²9˜•á±Aâ=…G\7Ç[ª˜|O¯¸m×;=y¨Óƒ'œ_¿/Ê’GUÝÉÔ’#IL„_qZÑmy™’ë+:OlhÛê„óæMÚQÌKãœðÀ~”„V]ÊònÑ<5„i "Ÿ„-P¡+ß!…A*±‘”ãüC˜r°Ù—^eÕÉæ4{D\‘ -PZT=p˜Ò'Çq˃nN[:Ê_ƒðu…Ò« •ü‘éS­OâÅ£êzÍe¬"ÅQ&q¬ÑƇV/÷YH>¥:aAX¡:avòTŽcÚVÉ,kw7¼z芲èô0‘‚éc&r" ¦ØÞê»"–‘]݉Òê¤Ì[^—DëÅQÔ…õ/E•qò”Öe‘W]{äÒ«]¾k¹Hçx5<«Ž'Ñ/Sr„¯Ëî1ÎSŽi šÉËè97œ¥©6I­Pv[)3ÿBÞ!«¬rmÑ/™gm!ÔÔÍ#?lø´¹¼vcˆÄò"1 äéÇÞÐRª‰"ÜÈvVÄG–8g“" K|Ú±'w!UÅ¥5Ú-5 R¶¹"Ì:c]©€ -NSí–#¯Ó¢ÔB#…Pƒ™M2‚{¶çCÊUÆê;%‹¦^äóì0åIIÎq– 9Í4í{>åï‘,ÓÒDhž–À÷ÛG˜œü?9êüàñ]1€á•ø¶‹§6l2øYÓg2ñ¬À€·‹ [ßZ¾oyŠœœÈ`Pì -Þ -Á‚oÇk·)!½Nú®k¥#)l -‘)ÊE‡sF0Ĉá¹Þ©ø€ïÌ4AûIbA‚Yîš»}½§|\W„ý<ö\Æ(ÍÝ2ƒ%ÃLoJYawDZ«q¨‡”!¿_Ôa'E‡Æ 3«÷Q€¹¬Á«@ÄÒ ¡yQ!0Áœ‡4cÒ‘õ Áq½8¶ƒØûŽ'hê•A~Ä'm‹„¾íkÎ{þ÷Ú"B½2È秚òDù\?`1F¦2»hWEP]¸cq&šÕ4O áºÊöÜp$Y˜¡’'íÒÁ+0ù`>¤¤]Zé:m.3͵TæqÆ%<Øi CîQÔ‚hpîx†§AÙDbk£óÈ—¬¼âdd62vlšÀ*v©–2ßPÓzc‘+½>Ðâ2–Ôž˜ˆ8+¯8gÔñøI9Úç3‘Àh§À§ÅºXç?œ(o<߇üôW ƒ¦¯Ñ¦å‡•™«¦E•i~b…‰ÃUØ9–eˆ*o9ßëú9/_™\ÅÝõ¹Uö{FOËÍë'K27Æü‘Ì/´Â‡ÐV“³ýõÁ­Pn¸8\«à€‹Y~jny6;  H,c¢TÖ©Þ©›¯ iî\Ú+ ™>™•ç*!«X Ù®fĈ©¡_Nž ­®Àü‰ëǺ „‘}×òCüõø0¾ï[çWh渚­Cg½Øl)ÛÒÎÔ6<럒±5œBVèÑø»+$â¹wÚÉJ_Þâayß ­È"ByVUWº(!ñäøŸtžÛ{š»xd_+8%_Ñ ´Ý§5 À÷U4A>TTÄ}r¦ñ¡ãî(ø‘ß™G}å¾ -OQpüòóÕ'Q‹E¬‡>lˆUשԈGúŠíd­1(+vHˆC5ŠFÈ; êKNV¼ÿJj¨š»+zgüú¾ò¾¥¯pfÛ °¾@©“¨ÇJ~è¶)ÿ$¡z·+ò*}×rú´dÂ^„;F+¾&X©¤hæÝçoÈ9-©ÉmN6nì~)&kç'.Bü‹h@Løu0ÓsVï´ÔtÇÕ”SMÍ4í:­d÷*c‚u½— Mߦ<8pï´áõ7ï?_Póîëá9›çpÅÕ)(¤\ôdn7]ÙS©Dg$×Ê©Sá±Zk'aÒìc7¹ô¦ç qÙÔ<è̦·nD1(5õNRq›H8pfwµnƒ³1U<8Χ¢Ÿç¹}ßëSe-)»E<:Ÿ÷³Î¥F—ÌÜËŽv±“Q/%÷ºŸ ± ˜{I"RykÅÌøi3í ”PtãÒ½ë?ùd c;Xtº‘æîý´ÕB—L>šsõÞpÒÊø+¯QUúÉôS ¬Z./a‘ÓÌÑ›]¾d™¾ŒÀêæ qÍÊ·X˜͵æ÷_#ÜÈZýx8>N_v5’/Í(”–n¾&Õ±¾3QÆÛsRAT¼”/²ºë²ŒëB ùX‹ŠG’ù×"~§öñyºß¦èáÄo‡9ÒlrIÊY.8º-ëIv¾•uÂ#àën!í«W혒öüÊãš1Ä@TWfC,­=OZuü-W>á/í¦Ë#~¡Ç÷7m‡ßþ¹D½.^£?ÌŠÀÕ\ü‹;ÿ´L̔㰠ìÈÑ„Tà9œDãÈ«ò5 -'opÿ¢”YîªÈ—ž,¡ëJÝ_‰G5Ô¦÷R9çÐë,“ô·ìWqbÇ^B¤&_Íš¯¾nWÂ`›6x‰üñSw=}oh ͼãAlÿÛ£gúŽK\¥zÀ®_²¥6nßDUœ9ò±’æÉ~4ka„Øû~bÛâd;Âüt,ÊÂÖ×ßúûʸø\Brðà;úàqUÝ»†]8ô¸4¡‚VgIxØΨ\¹¾Œ<%‚•+Q%bTôyw Z 縃¯ÂŠ)ý‰ŠÃG›>4<ÆÅ= Y>p'ï\ãQiãŽÉÀÕ‚(ãØ‹Q¥‰‡Í¡k7Ý.móÍöÐt›}ååÒµúÂó#if ê@:O‘‡žvÄ­«´Ï#°8!¨ÏrŸ„és=³ ¢?ôtzèNù‡ú†C¡¾Ã_í|”b{K;»"ó²§sÂ,¯jÔ”Íú/óù)‚úå9dm=åÛrhùÇö DÌT’Ūfê=®§À—´3Ç„ïhb0lFÏOÄf°=B¶ ÄpM8%±™·xÁ¥JÓ>¯5®(Ó[D 3þ¢É5Bdi`l?¡ÔÜÎHãç:A¼‘a+˽aè£ +'ƒôÏe—‡³K‰pº]}@Qfüykõ4Høîk¦ŸhŠ§ì¹k¼(ÆØ´OoIU‘PW§îÞv„ÈVì©X²¯ÆžöÞ y÷ê+žy×÷Í“Íæx³`wØò¤ŽÝ4ówàQàÆô í4 ó?¶A)PᘤÂÄzÀq‹žüP.H.§%S»"4˜ Ï%˜od‚Uo“÷dùÈÓ³[c}ü:Ë À»ªù·¬«{vl›€o O‹A [ˆÅR8?ÁCn=#¤qzîi UÏ‚dUƒ³Wù‘€öîT›ßõ’"ˆ†zN‘\(ψ +¾`p8O΂{~2æVŒ`nWƒ‡ |¥–"„$ñd½fÖY|/Çbî+ÄñXMâLø84÷x©‰hƒX£@TQ*ê?E/9hs†Œý-'6-3„׉\འÛbY…pÚHÍ”„òžûvà< yn¨gzƒtÐrBñ)&p7½××Ï;nQH6Ùò:“˜¾fz•Z…2q±Éi`CæÎV·Š_ Ú0Õ]‹Û‚²8mk!qÈY6Ž¼7®ûÉPŠ~Ç-®˜ ÷y•·xgü9=.φu™-Ü´ï+H³ýïEˆWãdˆ‹7vƒ¹—ÖäcáÅ¡<)|à%(/ÞO,ñC +ñ7l)û@ͨz¦ö&'£ö.çÆÓ¬œ.ksGÇi2Gµæ([Îb Qëøä œ°>òvçw‡7]e#Þ¹J³:*HìFfàãÐM‡XG„=X£L÷HÔ“Vk3*"Mlï¤ûŶ,ëЈhu‚º1x¢º‹Š£ÖÍús‘KšúÚ<ˆœêµ Q`enbÊ™­ŒÑ!õýkp™õÐœ0À8â¿,¬¨ª¾ûá w. fr!¬üƒ¸œÀ‹€,ÎKþXô‡ùF£;^$“åâ5¸A7ǨMë,ª—|$bƒflŸd±$n‚r„”ÈÁП/×8n2š‘ëÅ—-µÓª<[ˆ}/ðõ#|’Ï!ì[òhoǨ…`7ÅÖä " Ù½Íç” +!)µ)}fàÖÈKÜr˜_Whõ +½+°…åÊæ „èt‘›Á˜‘à/-žÀâÍ´tª‡¹.Ç€8Ž”~·-'‘&ÍR*Ô–ÅÖ.˜ö4¥äÀÒm‡ÚOÚ[köÁw1<ÜQÈ’!ÐN)îØý(´8ZÇd‹º$5?ÑcDŠM 4þtjÍ~¢lfùi=`>J ç¦ì:´óáíÕ/¹é$íAí¨Ÿ ¦žŸ¹šŒ´_ø§6^âyÚ鸗 2é/ƒ3¡ +«$àÊJ8ç•æ%>™(½âOª!’nø}¤ìF;ÃÌ»w •AÜŽ$ î` + uÛOüvcñýA 1™Ì™;'.tó%64Ê>;œ{zRØh-8óäš6-;àGŸS´Nþäx0Fƒ Øù´†ü,½Ï¹2Äç4ìø-m’ nSò¹Ø3Z»yAba¦Uõ°X½V¦¢ÛÛ‚Ø, XÍuˆ´¦Eypô–;fzäΤ•çªÃïFikjÈfÀäýáÁ¡Jª‡\rUó%Â< bA Bs¹,–'µ|”h”Œî:fã÷"<~Ñ e’h±·i +\½nRß9pHR|Hß]È°öòxâ´èf è¼/Å F9Î\‘¢÷¿‡†^Üç®Ç÷™ ÍI¿Rà×1Y+óÞHÄáÀ4'ùzáUN +yÓ1Éè¶4µ9hû‰¹µ}JN®ç¾;†¡A!}®ÀRB'í )\s…{'ÚHØ΂±”>â×^åøâ8”—v¿Á.¥sæÏ@`ôóX(MÛ±hjŸ%4>K ÖÞ–¦g@0᱑0èÎêƒYnV\Þœ„c%Õ§ç´Ð‚%Ç6,‚ÏêT 9M·ñÓ·%€äÿÕä—h®³RD?¼N·Q]'rY•ˆ…“o©rF ›Ê6[ Fl«¯±ï =Ï8GXPÐ ð…ÀœJ¤æ ÍŸ)¾_,¾Ò¼á¹Rž¹ïEB>fä"Ñß’ ]îälx¤siéH`}ÝV÷‘µ©fum`ß#‘¬ú_óœÐ›o[A2C¶þºê¬?œ¿l ô0ZNCF}úÿ„à»ÐT7¿¢‰‰:{\½ Tsû7áÔñendstream endobj -5906 0 obj << +6188 0 obj << /Type /Page -/Contents 5907 0 R -/Resources 5905 0 R +/Contents 6189 0 R +/Resources 6187 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5889 0 R -/Annots [ 5909 0 R 5911 0 R 5912 0 R 5913 0 R 5916 0 R 5917 0 R ] +/Parent 6158 0 R +/Annots [ 6191 0 R 6192 0 R 6193 0 R 6194 0 R 6196 0 R 6197 0 R 6198 0 R ] >> endobj -5909 0 obj << +6191 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [171.679 672.115 425.668 684.108] -/Subtype/Link/A<> +/Rect [297.044 595.054 539.579 607.046] +/Subtype/Link/A<> >> endobj -5911 0 obj << +6192 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [382.345 412.564 435.974 424.253] -/Subtype/Link/A<> +/Rect [84.043 581.504 103.217 593.497] +/Subtype/Link/A<> >> endobj -5912 0 obj << +6193 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [418.702 384.859 464.786 397.761] -/Subtype/Link/A<> +/Rect [354.855 441.978 500.027 453.971] +/Subtype/Link/A<> >> endobj -5913 0 obj << +6194 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [163.355 371.916 218.138 383.606] +/Rect [146.561 428.429 257.371 440.421] /Subtype/Link/A<> >> endobj -5916 0 obj << +6196 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [165.032 124.057 229.961 135.747] -/Subtype/Link/A<> +/Rect [383.308 168.877 436.776 180.567] +/Subtype/Link/A<> >> endobj -5917 0 obj << +6197 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [107.442 110.508 229.112 122.197] -/Subtype/Link/A<> ->> endobj -5908 0 obj << -/D [5906 0 R /XYZ 85.039 781.388 null] ->> endobj -1714 0 obj << -/D [5906 0 R /XYZ 85.039 553.968 null] ->> endobj -5910 0 obj << -/D [5906 0 R /XYZ 85.039 521.75 null] +/Rect [418.702 141.173 464.786 154.075] +/Subtype/Link/A<> >> endobj -1718 0 obj << -/D [5906 0 R /XYZ 85.039 344.098 null] +6198 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [163.086 128.23 217.779 139.919] +/Subtype/Link/A<> >> endobj -5914 0 obj << -/D [5906 0 R /XYZ 85.039 309.954 null] +6190 0 obj << +/D [6188 0 R /XYZ 85.039 781.388 null] >> endobj -1722 0 obj << -/D [5906 0 R /XYZ 85.039 186.296 null] +1750 0 obj << +/D [6188 0 R /XYZ 85.039 323.831 null] >> endobj -5915 0 obj << -/D [5906 0 R /XYZ 85.039 152.152 null] +6195 0 obj << +/D [6188 0 R /XYZ 85.039 291.613 null] >> endobj -5905 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> -/XObject << /Im1 4096 0 R >> +6187 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F62 4159 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5920 0 obj << -/Length 4197 +6201 0 obj << +/Length 3316 /Filter /FlateDecode >> stream -xÚ¥ÙrÜ6ò]_¡š—P["Cðfò°åĉíćb+•T%y †Ô לá˜äDVöç·/à¡Wí¦V  Ñw7`uéÂê2 ×O/ãD9~’\®wîåF^\(°Ä6`¾»½øúÇ0ºT®“ºéåíý°Nè¡y›ÿa}ÿòÙÍíï¯lß÷-•:Wv'Ö÷¿Þ\)ë÷Þ¼õööÕÛø@§²~½Ááwï¯ߺe Wo‡ágo¾{Æ_¾ã^ýuûÓÅ·=¦=€UŠh~ºøã/÷2‡#ýtá:~š\>@Ûu ï.O' |ù®.>\üÒ/ÅcÁ%ÏZ¢Jè'N˜øs²¨p,¡ë„n@dɳ’Ýeí•­¬N{ÖÝ•í%V±Æ®lG¾Õm¯À·ÖuÓ·vu€±Uï‹ýÌìx™úž»šÖËq£+{„ÆW-Ïÿñ* ,ç•Ÿr-«cO]AOU`sÝ•õ~²8 ÊüJÖÌöЗó0œ/^‡‘²^ÉÌn[ ¯€p¶Bº¦Dˆm1þ%,°Ó¦—ÿn‘LÈï]pãš—ó8ž³=ÿþþzÍSšâÐ0•ÕÒ_Ø+µºLÎàt&ß 5L#ªáž/å0:£* É„çÎe"J'L‘À0°/ˆÒ.HM¾‹dÆ¿;Àxý #-¢~”Õ5L½MÁ}oQl–1ŽRÏ â“ OÊp¹N0ˆïê·-2â¤ÀO{âykÝ¡½ß£(³öß«kè q¥çȬ Ž(ßúm BMC(øÛYUéÝDö>ògý§«|Y6kê£H"µ‡Åj¿áOÏu]üwÔ†ÇPKü¸ÏnT¡Ö.¯¨ß[|!P ©UÓxž1!À˜]#+ƒ^SˆˆR·ÑVmWìxOèL¬#3h's^ß<‡®k}'xO烡Z° IgElhÎ/<‡0ƒ¾t5%+ÒÝ÷Ð4#9Òˆ·D®–>¨¨Üœ%pßÜ ýÜk{àïM±/´.ø±ÊQ!ËA‹}¾üé†î†i§MX¿*žÏܨH™ïM!ð¨Ã%JF¿‹Ö²•ÒDJ  ?®0ûŠŠ¬Ð( -Sëv[h»Mû €å¸÷WÝuڣЯnpWØ|—iÝÀ¯¼ø»\Óæv{0\¢À¢H6À¯F\ÑhµèDÁ"ôNÉÉš¿Úm‰Ð²ZÎÂ%h•]Ë%þaÏw0ãXVhÙmÚ_ú‘p¬ž]Aºô; ´ŸóÓ"Òè9r‚5EŽ®mW7Èvƒ ˆ\bPÏ›rdÖqò»A÷ø¡õ%±f4Úu?éÐ!_ØlÄ`1ß¡®ó m‘°]ƒ÷\@=sÖDÅûIØ¿”=b‚ÉíUUxzñU_Àh_K,€B¤”æ4LB'—æ­¯BÛƒ1ÉíÚðƒ$,A©iêȇEJ¦‚EäLM¦“B_} -ƒß¬#üÝl„éÉö(ÃCæå?ýÁ½Á§c›ÌcQUv^ “÷&<ÏZÝ€…!@‘[ŽÚQÊV@¨XÅL°PD%toÈ ´Ý‡uC"+ÿ†¶G¼ÿsÖ: Ùûïñ~¢§AX7HÅc{ÍÓGAgoëñ#ç…Ëy&3°¸Óö×)XJ\üQº>wž-ïz,-^ì¸<âq_4†ô€ŸD¥íR–ójؽÍÐÎ1i þnË–G$*°‘Êññ‹ÉD$šÊK½Ø‚öˆAÄ3:î';Üõk¹—ľn>ÊWIû£˜á'ÙBÅAŠ2íá(Þ@ÉÒ_½à˜_&=Xåz€ª’X/­W¢õàÄjV¨ÕG6¸…("Ó——o²J´²$:ˆu`÷æCùwÃÙ«ožˆˆÌÙTz2$6`(&”a‰•«œÀõû…ÄýÅÓý”9 ˜ÿSj˜ÙŽ#Û¯”ƒÞhGM¼]oFäôäpd}lfÁ¤K½¥£½;6ÃtS°ØÓÖväàÉ‚êõ™EU}ØIN*ÜÉXÂÈÊÀiCé‹—¯e#$ÿö)®ÿóÆ•Då–g¡ †ýŽz DýÎx%ò,©õK|¯xnN¼Ãέë½Dt›c£c -ëᚧŽ¤u!)Å5ua ±Ý°| ¶ÚÞôŽ¿ÈDvéC?S'æÒÛûÛ³(³ž* ù‰¿ÞIù2`ž, ùa éÀ´~Hýh}<´\8¿aÎå¤ü™„<åšÆ"«’Až#yÙ뎺H&ž8P:¡Ú›0OV˜|X¨¸Â$"§s©úqŒx~ŸÕ`JƒßþÖ§#4aÞG2ö6“/ɉøxàß¹SÓÉ‘‘—ÀªF+Ÿ‡¤AÒŸ€(ÍF Þ4Ñж>'ÊtMJ¦N0üÔñoŒÁ„æô¾Ó•p_ -Ö”¹=‘¤¡ª«ç÷nØ8  fÜgæFºæ{˜¦ã˜æ_ðt¢/" , ÑvÍQ[¨Nøp¹ŒFë…¾';ƒAÙÑ>¹QsºA¸ú±]*Áœš/¹¼}QäEîpÙä춗„Öz+BÑ°}¢¢KcäÏåÍhÈ;½O}('pBÑZfm ž&5<èâzb¿9–@¯?¤¸AyÕãgè›çë—2mÅHdæO×+Y{1`kÌ׶—’i´´4y):ÉDÕrg_[†öRô€ë5Å~\N⊨bÑã:"WÙZÚ”ª§R\(`ÓUª®e¼0`„¤6]K=wxà¶/ÊÎy°\òHTäË‹].6\ï머 ÷”hzñzñ@™!®FÊÞ'£*'Yž¾òi\$$–œ,=1¢ÓwK‚ZŸ‰#À8ÙÿZë3F›óC£Á:wºœ(—ƒ ]’ƒ€à†ÝÅ_³‹]ûl×—šàs%¥ûýEgÅÝy)ã}åöÒ\ÁþÅlB,ÝžÝê–¸tl3AB‡›ËI-äÀB J8Èi²á^Ôkw¨Š‘…‘‚Ì\¹ÜEŸèÀâdTCÇo¹Çƒè¸åkË]I—8Wòù Ý׺ç±Ns‡›³õ…T@Är¡ôÄíyÓÁXc6àGjÈç¢A*±=±ö"3ôÄ‘‚·Ü7„˜Íì’ËKcGÅá¥ç%°òŒïÕж>÷Ó5ñÌ|‰BåñwºNþFb¨Y<Nª1No¬aNcâG0˜Ä#L0Œ5I͘IüQ™h¾“Dê ‰¤¡O£6]Qãë)&*(bdB7uâø$qä4!Ö•ÝÓ´±9. $JFB<\B‚3Ø‹Ö¸hÓÞ!ų`y &· ßJ!¬ÏÜå´…§ƒ® %ÄúªˆÆ¤†Šœ‹Ôéîté DW±¹¨«öÌ\7G})°¯/•¦É7×ñÝĪÈGa«=î8Ø¥Ô,æŒÜ¥;ÎŽ[½RfÍõL+ýØñCïR%‰ãzá9­hÛ_ÐÊÉšˆþmÉÉllýœíÌËJqI#­T -"Û`ŒÓT+æ4&¾ÝáÑvYÃVÝM†"ib„›Ø6 ¦±À1Y…î Ü9â@¹âÓ&d|3¾%Ié^ÈðKFá†J5 -iñP=r“«ÎõÖ\t1¯ßàoEg<¥„ó«8p‚ø,KØ6 8:^1Ãñ6ù„!áÃât}ßÍ0ŠC'ë8BiÂQ s“Äuüh„ _¤½÷’Œ‹ÜtÓÇ%ñm¡Ôð$3PÒ%ì7oùqò¤Ê.³E€@âkÈ¾\®¥¡ã{jdÙ&7$!_+a£-Äõr÷•WGe) ˜rAM" Ž᳆¶ ð…ÕdM²<¯Ñôdÿ<5àX¨SÆ -Ìé§+áζ֮|n¶ ùMý/<»†>ƒÁdMÄàw0ùÓ­#Ï`ýô‘æ̆Qä¤áxCô‹sýà°ɆñüA_÷*)«¨—llK©XVu°Y%v;¾O×Ï# ùy)hYžbT¢œTã AŒ?]y¹ÊAoÛ°¾‚xtÜì²Ó‰Èv1ÅÊ÷”o×ø…šk-\ Ì™=Á.¤¨Æž(ªÓs $CDÕÎä…奮þ àÍ#b÷$úBÒhèÓhNפ;ý·¿Vt=1OHBð!ÁIêh˜3Û¦ ¨Î˜# Á=È -éù—XCŸÞzº&÷ïÙ“M÷ñ}‡òÀæÌ®HçPÍÄAJtË ÖÅ”*A‚U"ÕùÜgñd Ha¾â¸PjÛ’(¡•Úë -„U)o|‰õ”zñ´~•@7U¦Ã×EIŸoHfúÜOzÏu¼8=§½mà š4Y“ž›%¦åº±†ts4Be*¬séJÂ;åངãˆ3ˆqЗ „>Ô×\ΠX¬}¶oùÁQÃß’¨É•M¹N%wQß೩ÈZýØ×)¥®¸b,OA|]éÂU¤!/ -¢Ñ3U±à}™ÊY”ók¾TäâUF&ªçz¤cÆþv¡ýÓÒJyŽâ’˜;×sè’>6('Öê_ºl*Ò÷…3º•jøøá0²þË3Fo¾¥~ÝtâÇráÕŸ§Õ±,=C@Ïq‘‹Ÿùk¨`ÓEKSŽ(êÇ ½Ò—i øÒ!d®¸S’œ%ŸØ5ÇuÿA^<ûÜáä=´ôèØÛ¯Yï›ÏóÀÛ©âŠgäÙ0‰=4ôe^‡{èê4ò9lÆŽŒ¿Ï¼*EHäÍèQ=³FƵÍùÉïõÍd1}J3<ƒ™æÿ×ríßÁ Ol4­‡Áœ1o†0 _>NÁÒ»³¢¡k¥ãÛN))¬ʹæÞÕû«·7Wo/ñ+„Nå|Xáð»÷‹4pn¿ÝüxöÃÍhÙeè†q€ëþ~öËoÞy[ûñÌsƒ,=¿ƒ¶çª,;ߟ…QàFa ßõÙõÙO– …ç<ðA“èlhFËÀOE +~æäGœÖîó¾ZãÆò¾A¢DEg@‚‹ªÕ=)†n0YÈ^ ™½Å¸NË¿cmÃ(5 ¥jñ¨¼[ܘ0:Ù[#³]Yin¶H{×ðÇ>§3ÑŒrfŒö¨K½|L +4ÿsUÐ!¼ÀùÈúc¶´ð’¼ÍK­º`š¼âA¿Ø8÷íÑrp×u_á>ŽÍZNr$ÂÂhü3j¶YòH3ŒàåÑÌñ÷#i úÕS!^RZL~Í…²ÒñÂÇDŒ<îÇbˆH +Õ†oIEŽ ¥Ý±]ÑZàŒÈe4¯»–[ÛFcîXÁu{0ÚCr{õg“ÿÁ(œÆ +AóèåÛÏÞ IfÎQèþÍ# ì†;P™»ªãó›ËõHVŠÛéŒòÛ¦êv"™›¿Fm¡«’eŽóöô·1Wÿ/‹ezÎ ’éU¥ÐΑ:§Ë£`Û–°[n°%ît1–F0@*#ý©‘la`ßêÒ0!¹ªÄ‰<.… C×¾¸$%…ç|x{õ3·Æ·ûñ“÷]y¿Xñ¤ÕÞ#Œ Ì»æ©Pòݺ²;¤Ú +”)`¿ ÛÁx{cÐW GR!.-~ ï“A`wg{–ºqª µ~èfIúÝ¡Ö—PûÏÐ.:מN‡ÛcŽ´ª`èõ; ÅoÞñç5‘æ8¼ ¶ žuÕ3Áóºž9…ï*ÿ±C¾ëùþ·Â60O+ïø{l‘1[äÉÚ)°J3hÒÚØ£·2ôþò+ ^¢ŠóÆ `~ƒb]Õ`€'ëľ›‰YgzFÀ„*à¡Çìú\ +¬UIÀÃ3Õ5i- &ˆ#šM¨íåô^Q™bZ¼×§L‚8s¬¯Á©ùÆÑê­¬§…=Eø˜|Ý¥¥ +8c6v¤èžµ‰Vý©L– +ìÓ´)3þK˜KüáÞ‡±ç¬Ì¾ñ–£GÝr?Ø(t¡žì@ùž'þ¼ZÍ«ø[j±á×Á‚¿ù‘ºÁw ›ÔçŒðGoŒå›$pPK;ÿàÓ¢ºè—\²ð)X‡ëã~§a6rC•xqÑLæFi8qv;*öðŒ½ñgãÞ­_Å(Õ12‚A n`è¢öæ< ÷·Çª09³N,ƒÃ§ P¥‘‰p«L°ÛUC'ÅÚv¨±oobwgCê„jÆ÷³8zBq J•p$ÙCHʹ‹6¸®DäUGR‡0xÙñHOڂ阱ä‡AFk—'lq¢>®û£6[.x´BàÒÚA("Á›M¤••(9{4vÈq…Þ†§FöfæÒ„O3’¡`š!Zm(\g¼Qµ® AîÄŽ†ØžÐñm×k>}?AɩȺ+˜ÊûætÅŽLPr†ØTµ€'è`ó¤fΤuÕ÷µ°[¡÷’ôbke*Û-ò>G~Œ‰dÆ]ÕïfÎO‚Ù´±?3„y _Ú£øáЗè]® l‚ŒpŸïGt¥™íŽ»ÄÚp5h>è–åÅÀR¬ǦÎ{f õS0¬…Q_íKðTa¢ÒUÝCD\õä·ƒÀß`8¾U{ê ¶Ð^3z£Ö~dÂMig"‚ß)äIV=íxþ+Ì]E2,†^âNr£”L\'kjÌÜBø¶žV!0Œa4VΕÌ4qmj Œƒóá®3<¼˜¢¸].0nϹ”U4.ðQq˜ -ÐÿüO`õ†ûôØN+Æa+ð¬JbÃC<²Æù)&ßAŠ¯üáaà/%ÇN Ôy³-ùã- í€Á×£0:Ø;»¢l°Bˆ•J®“‰Cež¬É¿=ƒø#E¸Ï4;ï>áù|ßùh!}ÃCyyƒ¢‚QI½#CûÄSZˆuÒ¡‘ÄX5jÆô`¸;hðÓ÷8½ÈüâÃêš;‡üÏCÞwÆ6k6rì¾¹kÊ1 •ÒÈÇJu( $¯BŠ}ÛõÌ­»ïØ+ï…½-B”Bûfõò´ދ¿AÂV–%“²>Õ~ö» '––’ŒÅ0±wTË9Ø¢šïGìáE¥ìØ”wÜØÊÊ£ ݇ïÇtu´xcÄ7HŽÑk]1¹%b»Áã A.ß&ÝÀ¾ÁgÊãµÙQ!e +²€R[χc'¸Á„ÚÎñ‹7Ö\ÐU{qìJãŽi%”x§ýCÞ‡êü‚–´‡_CÙrÙFŽ™"XCY¿!{B7Ôá&”ÚA*©j!#.‡`«³`ô0ª¿<šÂÒT˜£{SºÂÞ[´±ªî—•tèŒPW_Äbn +KåÜ@-b÷³WQ:r¡ëc›+^]ß2_&œø—<^ å{ÜbbB'®]ÑíÔ£ö’Ò!\¢I‡µ¸ âi†Î»†çŠ3÷±üÁù6Cƒ€Å˜“eÉ6Ä9À©Ù%\<㲊üJ]WCšj”2-Vr’nèeñmZJ”„¢W”X(ëE„¥^Óo ^“m1ðŒj=¸§FÙ´ ÁÛÊN¿Ü2DT¦$7:ªsPg1}BªÛƒ©š‰Ðs¶¼PUÞ&àKÓêî÷a–ŽÑOë ÿtJCÀ”yQrkþÀ+‡Lót{¨±Ç¬„k3£×ΦƒÙBÞèÝçäyˆÖ2´mäu'g$Ʋ¥¢I]rHÌfBÏÃäÏg3>øm>.``Ý\?•Òõ ìáÄ_ÚµÉ +‘ˆŽ­ö@5ù 8 Õý“NÒö-Y[ž«±¶âg Lü_.W> endobj -5924 0 obj << +6205 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [384.951 320.399 440.338 332.089] -/Subtype/Link/A<> +/Rect [165.032 555.44 229.961 567.13] +/Subtype/Link/A<> >> endobj -5925 0 obj << +6206 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [296.178 224.949 365.747 237.85] -/Subtype/Link/A<> +/Rect [107.939 541.891 230.603 553.58] +/Subtype/Link/A<> >> endobj -5926 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [442.864 224.949 510.766 237.85] -/Subtype/Link/A<> +6202 0 obj << +/D [6200 0 R /XYZ 85.039 781.388 null] >> endobj -5927 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [236.356 184.907 312.341 196.597] -/Subtype/Link/A<> +1754 0 obj << +/D [6200 0 R /XYZ 85.039 761.463 null] >> endobj -5928 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [208.094 171.358 276.783 183.047] -/Subtype/Link/A<> +6203 0 obj << +/D [6200 0 R /XYZ 85.039 743.459 null] >> endobj -5929 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [174.108 157.203 205.494 170.104] -/Subtype/Link/A<> +1758 0 obj << +/D [6200 0 R /XYZ 85.039 617.679 null] >> endobj -5930 0 obj << +6204 0 obj << +/D [6200 0 R /XYZ 85.039 583.535 null] +>> endobj +1762 0 obj << +/D [6200 0 R /XYZ 85.039 446.327 null] +>> endobj +6207 0 obj << +/D [6200 0 R /XYZ 85.039 412.183 null] +>> endobj +6199 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F59 3455 0 R /F41 3054 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6211 0 obj << +/Length 4128 +/Filter /FlateDecode +>> +stream +xÚ­koÜ6ò»…¯Àáä«ŠzëîS®mÜ´iê&6p@Ûò®vWVÚHÚ8.úã;/R”V~¥‡^Š’ÃyÏQ§üS§iäzAvš¤Ê Òôt¹;ñN70rq¢Â; ]/Žpè¿W'_½ŒâSå¹™—^­ äjõ‹óõw/.¯¾}{¶‚ÀQ™{¶H’ÔùúúòL9ï¸÷òí«7W¯Þ\àWʹ¾ÄáŸÞž¥suöÛÕ÷'ß^YÛ.B7ŒÜ÷ÃÉ/¿y§+@íûÏ ²ôôÚž«²ìtwF…|W'ïN~6«ðXxʳfN·Ð À:ó£y +,ðÄQfhà{34€Tà‰”¢0s–‡}×ìò¾\B÷9œ#7‡¶˜!‹Æ$CH:–ãŸ;ìðQ`´cƒ ò„Ý ‹HÛT<ŒÄ1lÌŠµE½˜‰¢¶ÁÐö!ñ +šÛ£ðò9Äb™ì˜óÙå,p©xùË3®¶egŸ8¢“iÿ!`m½XìlhõÚÆ$K›‹ c]`ïè\Õw®Éíx ¡@lèSðìЬyŽ[ÑùMÞè–"å¼$ε '¶Z(Ð2U3+TˆL{-{ }ù‘ä˜Í¶fíWZ¹{£Wë¬ÅÒÜœ³;Ì‘$ àÜò÷%íÐV…“t"•ÂrЉpýhJ]9ÿ¬‹[^eÅ Ëþ2Ú•;=³Ê[î£%@=pm\1çÍ\ià=jŒUEÛ¹3Dy#® 1ñ€É¸è¶éDÜ¡ÏwÖ´£çf‰Që5–Íy1h†ž1ÙâÖxZ¶8¶oÌ"7MâÓEº)D7Ït›—ßÀF?“®ÿ¤•þG U¦{ʼn%ñ¼ Üà1/ú«y†p,’ËŸ¡WñÑÅÍØ;&ëÇáóƒ×t,>*êÅñq"šæ=,2çŸ|2?Êœ?á'öÀ裰/w!fXÛ@,YÍøOîyMTA¢ü‡;H±1‘ôù¢Ê4¼µ-mÁk’‰]á”õ uèdˆ­BÇ7èšBt›Ýž5µ¢2«];ÛP–ˆÒòØ7P¨´ÉO\‚t„ :-Zü ô@‰û‚[D+<ãŽM_ËÝhóƒ ËD®ƒ;ä-Eàf«(„H-Æzn¦Ï¨«²ªx£òÝÞ:ºΑÐÂNapŸš$^ü˜¢t}ÞJæq°ûîrRËô2„ !üV(hyCD­}ú ^}HB?»µñÉÀ¬ƒdå+nÜ ƒEÍ]uA¦[šÑƒ©o8ò±Ò^ÅGvMíXì»Y˜ØúöþüHnuE¶tHL0ŒiÖý‘âÇnœ%÷1(Ê¢ÇD´ö•„ý8Ph{(Ét5­„ &d‡þÃQò„<¡A¦ÊÜÃ|÷t4v®y–¹Iâx–¯{+ G}¦Ü¢¸ãb©31Nû)²ÏMü‰r£ÏeÃËרÎW¸ÅÓ•}H•²IvÿJ -·Ç"ø„ç{„ÿÁ›"@¦9/¾›ÑSüYÎ4¾¸~Å ô­‰V…ðÈJbËV›f%Á(ŽVû…h¡yj«ï9߉µÎWVfE‚ ²ØMe[Œ‰à7nNi%‚ƒÇæÀ1ÙÐXtH0×dR$‡D‰ŽÁY³¸-S@®[šÄçÔ~¡;E!aN›W&áᙫ‚żjØ»²´ •`RGi’xŸVBa€á¸ +À>³ZN ƒ8Û+çïUå{ÚOäßw½4'õl ¿úöHÔ@ ’ì>‹ÉSdícÉ>/P1Ù•½Î•FY?JÏ‘÷K•«àLÏÖš‹7×™°#%L]Xðø@écš ö|åB¸ð9ÁÞ[ø E’&G$º$o=–hTäØ<È)S Y¾>Q¥S^.j|ÅUÊ|ëªH¥Ìw•òŸ$ÂC$Õq:g'¡ƒw ñcÁÆ,×ñL*Òu)^LëlÙqíAê*WŒÌ ηÃw”0'©Tk å«; +}ÈAÆ™Ž®å‹j”aKzûo0DÀ¥_U¾”N Ì¿`3"å +6?/4­[ä•XË! c¤SÄ­(³ŒíЫœÔÕp(Ö‘a´:3KN +mlÖWdŽ±6£<;Û2﹞âÉÖƒ'þÒœ‡¦I%Yé8ñ9ú¶ ƒ5">t)×cç…¿‡$T›R¦sÇ»‚ÕÄŠø'Z!Iùp(ÛÁiÁ)ÉåaSݱગ jé¦ [ç,{ß–ýÁ,Š{!÷XN† hÅŒyè¼f Á3}i Y ·i7 ǵ.Z52ÜÅ«ÞârÖ4ñ—b+B‚V˜E[h‹Â±ÓÌ“pRé9>-û:Pfñ—íU!š*Îy,»0 ÐdTãÁ#qpßJ1®_YµN® PP@æ(±­Ñiä‚G½çÆÂÝ,Iž|×É] Å—¬h‰sÑR5›×5ç¡ì Uè}±Ü–ÅǸ›¹›“ÐU\:y Ä` þ$g¹´Yñ“LÊ@¹Tž¤VÖ‹ÊYðkLP2uÙAêiCÑ}eaœq{ðCœ˜åâG`Y>{‚úÆù9DÍ+AMVBñƒŒò¦*¾à¢¦‡´L¥:Ÿ ê^7\%;–ÈAËÊâã(«SR­T kµr¢Áš.µéŠ@aS_Ni¢‚ãJôñqaB)rÑa +‹’Íi@àEc¦Ÿë׳ìS΂qºm"Ѧ¬)BI¾IhºþÝ^e|m•†t(bÙÁd{¡S2èÍþáðÉ®hð“K)Ú†ª‚rÁPÈ +‰£:ÎKx¢=¯ù7çŸî°¢Ø¹–^ vœõ¤äžÊýÌÙ™ØqÈ|ˆÏ¸s¸A õVr]—¥±Ø.ø½d&Å!_ÄÄ™R€V¥—.¯ÐÒ‘sÍõ—VfiPðú•µÁMÛaÃë35 +ÖD˜60ääÍøPœãϦËw3;ºä %$¤½Q&-çt£zÁƒ¥t•;ÎD³¯¹ãáM¾d,sî¡[˜;c tåRõ¥;ñÖø O Å`©¼6Tgƒ?ùgŸ[ÆEPïÊ?†k¥·€í[Íý»áTùø*—íg‘s”[H8Ĺ£‹œ! «o¿¨:Jd2ÛÒøÎ*¤@ãb¸‘ƒo¶Áøû¸¾ñ|Ë\ø$F 7+Bpc(Kê[Ô¼¬µÝòíëG4ëyS‹¥7ÇÜs7b¯ç$î;ð#'1IX¹NsJ^•jdÜ»ËKÊ.‘šÂ]s‚€#· G‰§ñ¡p”Î8,îŸK^tˆ˜ˆ‚¥æÒ¡ ÍÆÛ‰ðÐ_Š +wf.PÛ”6þl¡[Êih'mb›& ž`¡oi å2{a]0kÚéwÐÔÖx´¶”ìVÌimZôc’ òEd5–m¶²²1_·G‰À—„™ë…þÿ-èZÝ蛨¢Þ°ðücº{¸Ù=ï~b7ʲÇ°WT-?–øs`?ObšZO[ÒdxWAÀ$Ðk±"¥‡UøaÝF²(\Æ"# 3ítæºôs¦~¡<Ï‚l$“;);¿ê¨hʸÈsS_}~¬\™ s¹¯§˜—-rÂob¦¼óÜ$Ìîž½GK¦ÍE´*kzÝ.ÉöúчïU†äí ¿¨"ßšWÜÇÏH&Ë”òtƤFùâ*|}@žjC Ú1OBH‰“pÄ«(¾“Œ “qNØu• +šü¬’R—£ò?¤1ã} ›ñ]“Dúqì µ_?½2i¾¹žÂ¡Û6×× Ò“óc6ºô°^dáâ£ðÆ—XøKÇ©¹=~æd^4í{Ù°ÄQÎyÑI +¢·0™ÌéîĹ|27h#ßì妣£Wv ò¡\ü⮓ŒzÙ›:›b€ã‹š¯(L +Cóܹµ#l:k&@ƒó4Á ·‚GW*Ô¯7™‰sM‘c7°Ã/¬åä8rº¡j _½y3÷ª‰óÖ\œh¹°°â¯^‡0ƒuârPˆñZ–’Às@øÇ>%¯Ã•Ûƒ¬j<*h²¯Êµ\1ë„Ml”éÅÐ77²#bÙ´+ý2Ž&7Ã"ÇÛ.¯SØÈW±¿“à˜_n +y7„osø€ú­OÙÙ}v}†£w@`“ÿ9¢¿Ìë¥ë…_ãa¡Í‘4¨#Ù%LƒÚý1?x¡ƒóÆzr95VIaÞ5; “SKÈň…L­‹œLhkBpÌxÖ:Oxà80*‘ö²ØKŠÅ :ƒ!3h9³¥lÄA+,=â"äùjdá¢èL.tå PKðêô6%ÉHئyF’Žò ø”+JŒlk'¦VÏvÂ.Þi”xÁÙdG·ÓÛ +eÇqª…1·Éun†ï§w3· ÷•>¼l&½}k­÷xÊJ+U;½l`±’œŽÞÌá×ï¤5ÙÐç ›4V¦ rõnx¹z.÷l,aµì8}ð„:;UžT=“!&s×ÊʺÉ!ÌçÞD—¦nšÍW³‡@éoü'† qUú´Gg~=rŠ©è>Š™þ^Ó™endstream +endobj +6210 0 obj << +/Type /Page +/Contents 6211 0 R +/Resources 6209 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6208 0 R +/Annots [ 6214 0 R 6215 0 R 6216 0 R 6217 0 R 6218 0 R 6219 0 R 6220 0 R 6221 0 R 6222 0 R 6223 0 R 6224 0 R 6226 0 R 6227 0 R 6228 0 R ] +>> endobj +6214 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [238.397 157.203 263.419 170.104] -/Subtype/Link/A<> +/Rect [398.078 713.243 456.495 724.932] +/Subtype/Link/A<> >> endobj -5931 0 obj << +6215 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [148.686 130.104 173.557 143.006] -/Subtype/Link/A<> +/Rect [327.538 617.792 397.106 630.694] +/Subtype/Link/A<> >> endobj -5932 0 obj << +6216 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [256.19 130.104 296.471 143.006] -/Subtype/Link/A<> +/Rect [471.677 617.792 539.579 630.694] +/Subtype/Link/A<> >> endobj -5933 0 obj << +6217 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [318.929 130.104 354.71 143.006] -/Subtype/Link/A<> +/Rect [238.421 564.202 314.756 575.891] +/Subtype/Link/A<> >> endobj -5934 0 obj << +6218 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [194.892 116.555 256.309 129.457] -/Subtype/Link/A<> ->> endobj -5921 0 obj << -/D [5919 0 R /XYZ 85.039 781.388 null] ->> endobj -1726 0 obj << -/D [5919 0 R /XYZ 85.039 719.568 null] ->> endobj -5922 0 obj << -/D [5919 0 R /XYZ 85.039 685.425 null] ->> endobj -1730 0 obj << -/D [5919 0 R /XYZ 85.039 382.032 null] +/Rect [253.523 550.652 322.212 562.342] +/Subtype/Link/A<> >> endobj -5923 0 obj << -/D [5919 0 R /XYZ 85.039 348.494 null] +6219 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [192.315 536.497 223.701 549.399] +/Subtype/Link/A<> >> endobj -5918 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> -/ProcSet [ /PDF /Text ] +6220 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [254.909 536.497 279.931 549.399] +/Subtype/Link/A<> >> endobj -5937 0 obj << -/Length 3864 -/Filter /FlateDecode ->> -stream -xÚ¥ksÛÆñ»~…š™NÀŽ 8<ÓOvœØJkGµåig’|€B  ZQò绯;@ˆJ&ã‘y½½½½}üKþù—iäz*»LRßUiz¹Ù_x—;˜y}á ÄZ@ÖÌË›‹çßFñ¥ï¹™—]ÞlG<‘Fêò¦øÁùúÍ‹ë›oÞ¯ÖJ)ÇÏÜÕ:IRçë×+ßùÀ£×ï¯ÞÝ\½{½}çã5Nÿ~•*熮ÞÓ/Þ¾|Á=åz«Ÿn¾»øæÆPjhª2$ó—‹~ò. 8Òwž«²ôòÚžëÃôþèt£PI¿¾øpñƒŠçÂK^µÄ ±†“eAtžs±ï†±2œ ¼ÎEžy!qPúÊ…ãúnl‹Â yá;w%œ=Nœ×]ÞÜüØT?z~¸É‡ -àÛ†GóÍ]U~. ‘¸ñIvp›äúø¸¢>)ZÕ•ú€G˜øb%j͇®×8«O¤JH7è%8?ö‚‹<ÃgÁ õYV‚_Nvƒ:†Ý¹Ôõ+ÙmÎ-£„“À'’íZ\Zí*¼þ¼¶9£®‘ض>h¦Ã²Ð!@Røìr4>î rØ0üƒ‹úwE«ñ¿"ÂŽûtcÍÎ%zv$»²)»|(IÛ”Ä_²š¾ó F£L²)ÿ(nR£(2€^ÑÂΔÙ0ˆÍ?Krç—ªb¼>òk^ÛVâÔp' -ðß½eKi©üRlñJæƒÁP \Q‰–´t¼¼þ'Œ'¡%Åš¢¶A"¸Ó”dKWˈ5.Ùñàguæ—ôGÄže5K4•A3%ýP>vñ(í*@ª×G"o|f1¾;Ð)FI:Š¿{V+mGö<¹—;!Î…Ò`cMpˆQ“ÖâÙ»MÉ{ŽRè䨗Ñn9_zÙ1’¾úöêGœ§|:’€‡žCÃÏ‚Ñ xô -‘á]üŸ)V@‹·#ÊJW#×Ëñ‹ºoŸá}©ÑG‰óŽHºçÎkVhÁIVOµŽT~AëxÉ(„QJŒe©gåCJ¿P"ƒ!¯Þ„lEÙÕ ‚ “º–GY°G‹•“¹3¦&ÃöL‰ùÄK ˆ¹˜<õ‡<κž),¢»€ß“(ï5 -¦Û³-°…¬Gnüj*”ή2D§–˜@»)ï¹F”9/éµjU FcaàÜ% ºý†î`·íúÉ﬌©žà†M×ch©¡7-q‰ç@^d¬!…^P0}ª$qÌ%ÞÏ#14ÇOýË’ $y"8ÔÀëú4"›a<·:¨)›IÝIø@¨ ˆmúf¢@œ%jŠiú\"xõ«†ás…?Ç52‰f9ø3N÷xIŒnBr¦«…Qëj¡—ó3²u©Wßsƒí‡'¦˜xC1ŠV_AúùÓ&•~/K@ÚR”5÷onL.=Qn ü‰BÏ ‚§R ½¶À®}†“ï}k­³)ÍC5¢‹¡<ô'×Ãy½tJâüâæu–éÓI08âØ ø£3øî{[OIìxê¾Ë"Ï2’wOP„]êÆ–}*õdË¿ä n¿ÆÏ ’«!ÿ1W£ + -Ù䜑šüc9ÏÂ5ýƒ¸¹_)N>5¢EÅÇ<‡ÁÒL{‚L1èð*¡Ix¥s©±©¯Yù5bœÒ.÷9 XòG¶ÛQæ&ä’¨QêzÆÅeRlL`ðþq~*^ÊùÊÃ?p^Xpœq)`I¾—ÖPéV%@cR§"§3:\¿âú‚³¯äq,{Þ{SI¾Æ4‘)²Ý¸Ø>9ü‚ÚU¹…p )+SQm)£8ÉqñÇNèpÄ'ÓÞr;ßp¸‹RP¶ã 2ùž?Aeå4<ÉÎ D Ë=%¡sC±”Ä$wvPçySüdT<±í^Çô<_rÃ÷¼¿O dXóf#ÔAÔr&6Q¾›@ÿ¬ÙUVºŽ ¬òز¾(„“áÁ´d¥¬\TQT„æ ¨+!á}à6Y̆Bz ãó -bv ñ-s Ï5[”¤§HŽˆàä<¦zÊH6„;î+®º†u¡p¡j±Òjg²Æ@¦”qÖ^?ÏÝbÑ Û³.Ôå#DH¤ì¬Nï9¬~àž'9†‰5pzJÚ¥¥ÂÁñ`RK`œïOÔ¯¢¨Á—tÍ÷ĘÊâ0^9'”÷ l;¹_åOš9ÙÍâ‘3ÍQ$T$s> ¾¥ˆ0öJ‹ÌüLÊ ¤bQIƒßòIl},‡ð žr¤+É ûó{NùÉÑ›ö*É¢I–MMgÂS˜`7 ”¥à°|Kàž;ÿ¥ÓZöï{ŠÏo¥ø/™``êšBc\ôŠS£®Ò© Ö¤{ÆPiì&*>ûŒaÁ<ú£âÀUq4€‰åæ—y?—â_•Ÿ1®Ú—vìÇ¡G™-ÊÇ!” Ï¿·X0¾·¨ 5!éÛ–³ ùH›>OJ_ ðÑ’‡Å0–VC_Ö[A3$´…‚ѦPzÍ9X¥ä†·±\A%Cº$ò«1DR!Çä¶Ý9 !Á«ñžy.:@ŽtOˆAv:v]MV)é2_”±)NÔ`öyµP¡“ˆä¤éã¥C7ãúÙØRA> RzN¿ù­&µT«†ªÐÝžŸ¨Øª²p¬’¤sk¬ŽàÓ9„e©p8PyÐäCn©º/ -¯¨VV–ʶ•µ=ø6Œ’pi^÷-·èüâ̼ ¢RXõ™`éÑ—îêcÉ­AiS¿“t7ÔAè[žh?‘e>Èçg<íÂéG,`BLVÛ‰!D“ªíŽI?vùæ -É\8›·ë­¾g¸OòØ×LË|´¹+²Ÿ¸K±Tnü *”"¤\J Ò±ö¤ÙÜqšN-ä8ôDÚ‡`;ºÕã#€0€Q½ÌœÒê£|b*)±ƒÑö¦ -ƒ „(¨†0h pd¸3R\.\šØŠfùÁÆz|‚(ô®ìMÈEU߯±±»©ÊÎÚX †llèÛ ÏwCODH \@rR ñ`>JÏmˆ_B„Ðz¢NâƒÛñƒS²¦u²Éú~ßT'd©ÔÍ’ó|Ð0OìôDjïø;>RR?¤ø]IÏ–)ÆÛ‹6®˜}½\ð 1Üоzù–÷wœÞJ¢@RÖUdr`„T,H–ßË«.iÁÊÉZÇÓ¶Y‘¡O­K¥©¦Â"¿õ‚#Æm;´*v”vÛ¡O¬œ]k=^º4IE¬/âûÏy[¨ŒFöŒJbŸ–çsþ1y¡¥ÓH|óŒËHÚ´¡Öy'£üƼðµ›ÔÜdІeIÈòÊ<Ñm†£h¬>ìbÚn{Êçß]ýo4³½©GÿƒQû£ £Ö:]¶&“ž$"}†*3¿À«zôéËv‡`/ƒ³v‚yÜNh §ìÄ™ ÿ¤˜“µh'l²Þ\_}÷á„®î1Ï2BÃ<±eáhâO¶ü«TR Ul -ì- -œÈ™`LÚ^`ûÍ5ÿ¢Îà¯õrY‰„º „ó‹i Np^ŠiÛ mAÃs]Þì‘%Ö*r³(›½¥é -:Å°))ÁÊ·ÍÔ—û¤8ÁET\p”‹QG’pº¿ûÖÄ™Ð3éï¤?W¦—#Æ­”y™ .“d9®\–çŸÃ]ËRÁÊëŠß~Wü‘€»`þ’J«8›©t"=£È^ê†áùÏï,˜3Š,@O*òãþYEž‘µ¬ÈY¯«ýA»—k»8'5NÜÐ?KêZÃíµ -kŠ¾̦ñ_bc£ àûyüÓ?Z-ƒ°v1-€?æÁ_únÚØ\M-€l7ð5-Èó æôF¥D©:%øÿº;,¾endstream -endobj -5936 0 obj << -/Type /Page -/Contents 5937 0 R -/Resources 5935 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 5889 0 R -/Annots [ 5940 0 R 5941 0 R 5942 0 R 5944 0 R 5945 0 R 5946 0 R ] +6221 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [148.686 509.399 173.557 522.3] +/Subtype/Link/A<> >> endobj -5940 0 obj << +6222 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [417.336 699.694 477.54 711.989] -/Subtype/Link/A<> +/Rect [256.19 509.399 296.471 522.3] +/Subtype/Link/A<> >> endobj -5941 0 obj << +6223 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [126.184 550.652 219.086 562.342] -/Subtype/Link/A<> +/Rect [318.929 509.399 354.71 522.3] +/Subtype/Link/A<> >> endobj -5942 0 obj << +6224 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [172.618 537.103 264.005 548.793] -/Subtype/Link/A<> +/Rect [183.983 495.85 245.399 508.751] +/Subtype/Link/A<> >> endobj -5944 0 obj << +6226 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 213.721 139.975 225.411] -/Subtype/Link/A<> +/Rect [389.991 338.653 453.226 350.949] +/Subtype/Link/A<> >> endobj -5945 0 obj << +6227 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 159.525 144.521 171.214] -/Subtype/Link/A<> +/Rect [84.043 189.612 179.975 201.301] +/Subtype/Link/A<> >> endobj -5946 0 obj << +6228 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 104.722 168.415 117.623] -/Subtype/Link/A<> +/Rect [133.761 176.063 226.502 187.752] +/Subtype/Link/A<> >> endobj -5938 0 obj << -/D [5936 0 R /XYZ 85.039 781.388 null] +6212 0 obj << +/D [6210 0 R /XYZ 85.039 781.388 null] >> endobj -1734 0 obj << -/D [5936 0 R /XYZ 85.039 761.463 null] +1766 0 obj << +/D [6210 0 R /XYZ 85.039 761.463 null] >> endobj -5939 0 obj << -/D [5936 0 R /XYZ 85.039 743.459 null] +6213 0 obj << +/D [6210 0 R /XYZ 85.039 741.337 null] >> endobj -1738 0 obj << -/D [5936 0 R /XYZ 85.039 386.736 null] +1770 0 obj << +/D [6210 0 R /XYZ 85.039 414.441 null] >> endobj -5943 0 obj << -/D [5936 0 R /XYZ 85.039 353.199 null] +6225 0 obj << +/D [6210 0 R /XYZ 85.039 382.418 null] >> endobj -5935 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> +6209 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5949 0 obj << -/Length 3768 -/Filter /FlateDecode ->> -stream -xÚ¥ÙrÛFò]_ÁÒKÀ-Æ`pæÍŽdY‰%s-y×UI $€–•ýùíkð”wS. ƒžžžžž¾A5ràŸE¾íèxFÊÖQ4š­ÎœÑf®Î”`Le2Ày{öúŒ”cÇN<ºŸ÷t|Ûóõè>ýÕúéý›éýå§ñDkm©ØOÂ0²~ú<+뎡ÓO×·÷×·WøæPYŸ§8ýñÓ8ÒÖ=#]ßöÓonÞ¾á7m;ãßï>»¼ï8íx®bdóϳ_wF)éç3ÇÖq4z‚±c+˜^Ÿ¶ïiy/ÎîÎþÙ‘â9oÄ«IÅ`Làd±ëŸ–\ l/Ðä\ç€ä|Çö$$•¶á¸ÊAl¾[ïÆÚ±ª±VV=ž(k³‚Ùæˆ"¬ „ÐÜŽÊæª$5Ó÷ã´R¨s˜K -3õž€OmÕà{hý‡ Rh*Æ™wÔkž½If<ógîxüEV–K6«V«¬žñ–xY#ß·áî@f(»˜Îúùöú˱‹Ôû/ˆ¶Ç!Ñ*ÿ€h׎”¢í>äåج ðôm]Ã_~o‘ÉraWZŒ'žã[ ± L¥ÈþØ ­g{VÞÈô2ãAUF†çž4ø·Eñ¯yî¼YÂPYç=I|"Í -i>áÚ.‹i¯é~˜#¢X3<%N¿"<«iP‹À¬ÌcõÈxóª>@¨&Ù;[bÏqc@_%m˜x*†ËKwoB¡í†£ Šm7pù&^/áÓàNy2ÀÞ¿“ŠÈK‹·ÑVuŠ¹Ë€ë„¶Ô6;º`pNoì*eÇ^°µ3‰Ëu@× .¾*k_1m]Wx_Ù -¯ a`^ʳÀš¯¯}S$õî‰<åÛ®ï}§L öé³íÒijÍI—7«=‘z^h‡A|R¤ç…mw(á¶èæAÃßnZ#–D.e% ?ð¾ÅTP3ÁY¸v¨·ô“4=ÊÕíç×C£ýü¡ò¬ŽÙƒ"Ò^öAé*/XÍ÷*ˆ€gUèÛ¡Ò/ˆß`OèTk‡&œ²·3VÖ â ‰7ò|4¢ƒ<7­Ñ«–uØNl³¼saç4£žÁ<áѤÎD€»üÈZT9ª<Û¥qnµ`ìƒ^ÞèùA Ðå{ô‰xà`ض -p Z¡WBO{ÞÆ÷l2ŒôA/ÝÁž Ðø›šÈG0`åã?¿ðØ̞Î@qT¸Í×®œÓܸ:¶=ånq³LÞ¾Ýàöe–òk…&DðŠŸàXBV.DLÐ悵)QÕÈâyý¹1g—fÞdŸ9£:á—dŽñ‚ S"ñÌw‹bÔ;6šp~6Ïž8%{ -ä%HIàqCPÎè -À@/AMÁÈ›p´à»qäYõ0xÍŒµ6’AOH*Y¯ÔX…¡]W›ù+TóŠ}R33¸ùºåi²\VràŽ0Ó"2<Ï ™ß¤NÄ[I&ª‚<0´L0ph/ùã8¶ÖtŒíȃðJp“¢àß6Ìä+>`Uãþt½„æM[W ¸cÒ¿Ö¤47Œ¬xBÌFË阀ˆHÚïx -«;#Nˆ=<2›þ¿ž(8_s”ô]p$ÝÌ°ŠsÏ´S‚Ž_WrüÖI$¤D@(MÚ„GKÊž`ð@"β’W&)±šòÛRxæñ}ŽbÄ%¿9¾ó´¬Lú[ÕÂG"Ü •¤`É#± -«Ô«—¼âÀ]\ŒC¸&§üŠ½>BéøUgˆuŽÅF(RFÖ,!ÎxżÆPâ%F¼E^føû)‡+ y¬6øçò>eéû¤Åß±~ªÊ’¥ßr6郧9e]d90¿$öòü h\—zzžgý ±ã(­êI™mèHI‘·"ô˜0ãkz§ÃuZKÒ5Š Ó‹Š$©*lͺ~ØöL*`8ÏF-g­}¤ªð]È•Âð;êC…™°>!E¨ãdh‘dx$ØÛTº*ÆÓ‘]È€T“U4¤ù(v bÛ -"†Ð¥ÜVc²<ëÎ!Û S¹Žþ)ÛñâX3Ê`L¼÷G"Àëë•]TÀåhÀ¨ èrp‹†¡ÖmÈ,F^î^s){^Œœ–ò­_’Õš³ã¬³e ÉÜœ.pÅH7ÆÖàÏ#zÊ쮚óyqš´ žiE%̂ߪvh˜}cSrÊÒ? {§ýÈóÂsiˆ5kry” Ák›¯²#>܃:x®»M8tà7ßÖD„^ZÈ lSåu1M bšuF ¨3æÎÌXöÉçøtØ?VnšLf[~V±K2cßZYÒdû¾¸éí”l‰F¨9€á;ŵVÌŒ¬|9ˆtÊêd ÓÂN-V k>x6Ë©šÜ³ó(­úDO˜Ê‰£vfÂ@LöCì½Ô+á[mã¾"<§pÒK¡ - *-ëxD ' ŸU½ ?ÿEKeV| ~PBbzOH¨]&m,Crw\cÑYz—ñ’Bé(²Î±µ:½8çe¿9Ê£fF#³Ui69äüÝæN–Eî]6¤UtC -²¤0³_0ú0Av0×IšîÐ0IݵV`-¥«ž†Ü‘ÂFÆTûTµ¤a\ÀtÕ7ì»(†•&äÓ˜& —²î µã${d̦OQ8ešꡉù¤ #j·ç{(o4Îfï b_XÊtï÷wFS-œÕ9ÚOŸ r30w¥nùA9)x`·F`ŽÖ[d Po-^ïÙ:Ý•‘ñþ¹Sbå4®HJ"Ðý‚ 1Ò;V‚(C9`óßœ‰g‡\AŠù#7‰úK²t͈0åU°c'ª®DÆi*–pžH„<ô.‚”£Ä2eÄ'ù x"Ãp#¿ ¿{QuVm -Ô,Ç• ¿à*æàùPtm^™(ù™Èócgc wìÿpÑUÛÑv»¤3yíDÝ ?ÞOù9¥˜Ý² WIÝn³óÎc²4Ýl¾Ÿ‰Îær–Ü?â²ÏUç-ùK*bÑÄ’”ž4%`@k,8¤Ë©î¨Ø1  -C¥UÒD0G„¯y“,:ãñˆýN96ë)ÛA±?#óœ }²‚o*9ø²` WO¸Áa¿wþÙfݼˑٶó©xnJ`!%•âŠ¬Åë¯Âõ¥›}íãþ{˜Âðš­H`¼4ÙѨøI¶Â¦:Ë:? -r D5ž ˆO±è=ꀈ࠼fJ­8|§*ð€äQW4-HTN;B¡2xe¸v߈üõ;«Ž¹­ì°•ø%!Ô­Æ÷í2JÇ„(oxM´ÅV7çªG –`ZÈV— ‹ÙÓ¡ÃíÃX5îÀî¿(œdâjmÚßim¡â6BBñ¯,´#/êNæ+ ÷%ÞÒ‰¹ag‚Vï[a| îêEÕ´°HåPŒ^lÉ#C»Ó¦Y0Ô…ÖÄÏ®3Üõ¼Ët'òr³¡Æiõ刚‹Ë½Deòøhk…Â(­1 -Ÿ³ÀÈ7.߇ª¤g¦6-5œ0Ý›»(sNùI›k™ ¤(J<–l‘Äc JĽ_Ë榻-xè(º›‰À_.0ßùAP ?éEÁ±Ú«tU¨èÎéïA¦æ`­y EøÇíÛ9ßû,¥=[Åj›‚ÛàœÞ}—nO9¸‹8êÂ7Tíä²o?Þ\î}Rà9µþN¹ìÓ¬íÒ$É,ÚG¼šõžH\_Û.`‰ÁyaßJ‘œ[óæ$Ó9#!™›onLå2¨è£l2;OØ'HÔˆ£>l%)¯ç˜3\UÉV¢Ú†‰T¾‡‘ízñ0xQgÎ ðKœø7pÙýó‡E -Æz U"W ?:èª\2uÊɘ¢–/3Ló"yg¤‚–º®‘uÕÎúÁgs!(˜Ô¿ ã³¹ÓqEu.$y»¬>;»¿cÝvå9vàŸî° pº[×þ6tðÒ¤êZl.6ØÀ͇Í5J©Ì·öµùY’|«ÞoÅA„ŸRù³üs¨’³µð¯Š*¹¦8r`åë/¸Ç9ê¡"‡äÄï3*}C"è}Ø×@8–xºµ åÇK¡ÇêÇ|Ó{²PïõºJŸ^MýsÖ2-Ób3hP ÒÁ5Ðî´Ø:ô5Éæ%/!cÞ+´1œôjŒú܃¼û=gS.à÷>­i‰Ï¸î™½»äÂ'>SCÎô^ÕVß„1ŒÂå7Ûa•˜^š¥Ñ?x‘êÌÓ”Áƒó­ÕºëPµÙ±.¯c»{¼ðŸ³‡¿õCÇÁ'(pÿGžëÚ®2¼à¸‘Þå××8p½Ïð¤-Éendstream +6231 0 obj << +/Length 3176 +/Filter /FlateDecode +>> +stream +xÚÍËrÛFò®¯à-`• c0xîmã§ËÒJòÆUI#a €¢•Êǧ_‚$´râ=¤T% º=3=ýª‰j’„®§ÓIœ(W'Éd^x“[À¼9QBáM׋BDýx}òüuM”ç¦^:¹^Éuö‹óâí¿/®_]NgZkG¥îtljóâãÅT9W ½¸<ýp}úá ¾TÎÇ DŸ_Ní\O»~wòêz0í,pƒHã¼_N~ùÍ›d°´w'ž«Ód²…±çª4T'A¨Ý0Ðò^ž\ü§ç¸`Â_ìnf)fÚs“$跩‘m.Xp]ñ~.Vð–ÕS?q¶ít¦œÙ óŒw}Ø!LÜ0x / |ȆD ¨ ç(ø»†xýê… +`T즩?~l3?pu¬úùÞȎଔv»r#8µ0H—´˜â>ÇE±ó2¿ÏËz]å«Žç›®-²|d9¾«üÇV£}×cäãò=«[œ#ö¤`…ƒpòÖ4I[$IŸ]›— aƒç5ÙOZ†®j!]ây­×@ÛC¢i¶8.Ù- ½çÓÚ|èºAÏIJpëÖÍ-Š/Šœ—ÍàðpÓä8-}Öu2ˆŽô/¤Ýßàg°˜4qX·ò5¯}•Y%ISܨŸ¦NeDƒ -G´–h¿_/`¾®I˜²^$Åõâ²™ÏgnZaÊÂ`™ÕeË@SIÉcÔ×eÎcZå‚xÑ9b_¯x–Mƒ¶«›\X]¿A~víPAJ¢È NcnĘhO‘sŠgáÅŽÉPEWÔ8ÿ3*MŒ YÒ75¿­²Ïû‚ĉ'âÁ–,Ní%Îkô>²Ý +Ö?gðm¹ÙÑt5? ö¶1%ÚgÊ ³z`È¡UØ sK~,ŒŠ——åÍŠ]8Ïz’²_™?§`s¤¢ì´Ú‡–õ¯bº»û/áL‹Á'ž0Òo[78KæÚµù±ë;ŵ]‰ñ˜»bEê9õ‚ŸV ~;®æWOi:Φ·W¤Ëh©{¦N`»1Æ°|vÛÔttÚ¨žIÑ[w¸œ°Pm<‰;^VÁßãpŽâ™7vu¸çY>iµpaÍE¶]b>rjdt5ú20¢›w½‰s½ÌY½Yæà'þ5æâ†f=æUUäê‚[ïT5âTAìñ!ßÐ ÀéxcLXš[Á\¾ù®û¼Z‡³ø‘Eñø4T¨h°ôQ¦`ÀÓàÇ¢ÉQTQê´õ¢#µÅì_¶> Cçs>-@èµBŸþˆˆ3~!Gf„ª#%ìƒD$v OâU“JˆùÚO–ö‹B"åÐèú¨ð GwHÌæWÎHƒ0 ‰à¬‡z”g·´¿ÀY vRöiçV|»ÀÌh¨´?0ÅùÕsŸGä•9P¶Ìªà8R3Þð£¿) e©°F´®ØëýZIinV‡‘Zl‚±Í(×ÙÉ„H4Gk\RHã؈AÙÍ‚©ÛÕ0°=ÿøáôÓÎ'²ñ#Dzdè ÇÏΠgìÍ®h;bóŒiɵpô%‡Ñµì3Ř°J»õ£TmB¢™3$X¥Fÿtc~{qúîêp­\_ùYs”~‹5Z¡¶Úã\Z¼'Á¡ãn”q6aBvo/ø‰:ÏýÀÏôÖbi6{ö’þÕM'ëÂÈJœ–y!C6RI€‹2«[ᆭ7„-'Ô®Ý%%ƒ ©é¾/@‹#›?‘6æhZIâìåm6ˆÇ±Ã9i<wø6—dIf’؆ÃA‚‹;ÿŸÊ4y,Ââ{œ9³¼:„or!ZÖŸ ¢¾ Æ”EÇgÁÕŠ;b·ßevàôÌ.¡Ž[¤]•(1¶øŸnloŠjmý÷Å°.<œ9t•=j:üûóC²?xP4Á€øјíIÎÕ§Òh”dfó¦é°¾E]q|É3|¾4yÉ,ò)çÊsQ¸ÀÈvI:BJB›Œßöjáma+§¾`ÿªÛÔd}{¦4Ý ²m‡ èðÅ;Í)qqf}hÏú>Qfí±K ÊR(yâFÁÿ§ÅK‹çõ”‚š¦T|q…†jý 6L­$à‘ šÌ¢¯§)|jˆQ° ³·¨·ÜvuËiïü æA[3Í¢ç.¹ñ™™3æ1W<þ$_®¬ÙìE]Uy3ç)I À!‚,÷tòÁ‘Š)iLA”žhü}c7%€ðØIt269àŽŠ‚OÒu$¢Æü¬íÐÁ!¶]Ú%1q$í+à¶Eú²& ðaûü¢Ðîì:Á®•T wLùMîW*cY¶íì`K„,'ð©Ÿs Ûă/ü}{ä£l§«›ÃÁçÀs½TG; ^ÿ©`GV€Ö¥u,ø:šRYx}Sæ*/9ˇpìëˆÍy-Ðá’!×puþõ €ý̦Og « ƒGS©§D!™l€c禲ûúA5ìwEÑEòØÈwƒ8ƘÏ[ÛH˜Ý( ÞâÃGÄ<ß+Õæ+#û¯¤9ùŒ;¡7›i_Ÿ›ÌúX:©¾9¥Þó‡ +¢=öùeUQÆóšæ¨ú GYhÁEjìH! #Z'vÉØﲇì?Zy0ëÇÑ÷+L_/Ö<õmMM4‚§à2¬Vìn‚‘Ãõ#ÏPûšÆó!AЀQ(ð°-¼=’¤h(åÒ¿k¶ä²‘÷ù??ñêñ‘“À >&1()ž’Ø“*œ;+J>áµÞt¯ùyc[ý„]‰X0ƒ"*é\#lW:ÑÊ)|ÙH·üwvIâW1¤›`ßCñ›ÅáýM½’Æ!õô8Ü/,Í–Áƒ¤øn¯gpÐ]ýÖ°SØ2.°Ý[¾žBâ¸ßÜFðAGAÛæð*DAâÝÔ›û7”‰²üÚ¹¥-Ö£¥t—"¹7±a<Èë5MvœÏvöö¡oªx¡öäÆé^ìsh€×Bk¨ $’a -IÈLŸ.AV´¤˜ÞAr#—PÈiaØó«ñªæÑÒìƒ ¡„>c™a×^¾6Äh¬8þ™ÒI¬ƒ|?å3pì;$s{÷ÃÝoJ,pFƒ^¿4¾ýý¾0Rd”¼&Xb"ƒAzžË¤&£$š±r!ŸL5ÔŽ¡Ö#«‹í²æ—AŸ]Ög:~žQâOúgîh \¨\zô¥ +Z"‰¬ë%tÚç [³Ô¡(8®ðµPˆ>7•˜|ß>E†ùê¶èÏ…‚B¡º[2ë+ätõê¿]Jý¦œ·¦C˜J ]‘/š÷MÇûiu¡ñÖô¦0|=u¼9ºÓ\úùáÀÑb‡EÐl•o:’× Æ+²Í#eMAáj×Ëâû'VqíbŠt`…¤Ô0uÅ3â$LæuÔx;.S4þ<€š^ÚMö/Ù.Û1x&xÙ®(Qzúj_an®F¯öA¢IäF*~” }ä õ>(!’I¬Ý ŠûÕ–RnŠÞhƒ>Ôœ²ÈeÏáOB7öiï“/åzAšjÆÆ´ÎÝGx~Z©ÉËV4Ù-J§®Fßs#íBc2–ÛõÝnö6Šï>$©áÅYû£k0´ç«z!é I¯à™Õ}z¬°gÄÙ0 ó¯¤ñyYöj*Ÿ~ÆÖ ÎGÞžKˬ]“›¤Ä^»¢ÊÇÝ>vSñZ»3ìÁðžÆ›¯ë©øDÀC¢äÚ⨂jèõî"›ô•¢cçJæ)ÜË%WZoH]Âv¶·Ûåx€m¯ËÜ´cw}íÎbÙÜ–…üHÄð;g×bp­íìÚÊÃ+ZYOc3jQ“ôæUcÇB%¾ƒ&”i}A€óÂò +Òìþ73ßFñ÷) ÞgiÏõ¹Oq\€ï’ÐïøŽ]• ÚdzI?=jêÛÁvùѧendstream endobj -5948 0 obj << +6230 0 obj << /Type /Page -/Contents 5949 0 R -/Resources 5947 0 R +/Contents 6231 0 R +/Resources 6229 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5960 0 R -/Annots [ 5952 0 R 5953 0 R 5954 0 R 5955 0 R 5957 0 R 5958 0 R ] +/Parent 6208 0 R +/Annots [ 6234 0 R 6235 0 R 6236 0 R 6238 0 R 6239 0 R 6240 0 R 6241 0 R ] >> endobj -5952 0 obj << +6234 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [166.274 686.144 208.357 697.834] -/Subtype/Link/A<> +/Rect [111.316 559.497 139.975 571.186] +/Subtype/Link/A<> >> endobj -5953 0 obj << +6235 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [414.258 686.144 448.765 697.834] -/Subtype/Link/A<> +/Rect [111.316 505.3 144.521 516.99] +/Subtype/Link/A<> >> endobj -5954 0 obj << +6236 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [267.768 671.989 397.093 684.891] -/Subtype/Link/A<> +/Rect [111.316 450.497 168.415 463.399] +/Subtype/Link/A<> >> endobj -5955 0 obj << +6238 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [153.592 659.046 237.013 670.735] -/Subtype/Link/A<> +/Rect [164.585 306.85 206.668 318.539] +/Subtype/Link/A<> >> endobj -5957 0 obj << +6239 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 167.864 135.187 180.766] -/Subtype/Link/A<> +/Rect [405.811 306.85 443.349 318.539] +/Subtype/Link/A<> >> endobj -5958 0 obj << +6240 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [216.837 167.864 254.284 180.766] -/Subtype/Link/A<> ->> endobj -5950 0 obj << -/D [5948 0 R /XYZ 85.039 781.388 null] +/Rect [286.974 292.695 416.288 305.596] +/Subtype/Link/A<> >> endobj -1742 0 obj << -/D [5948 0 R /XYZ 85.039 761.463 null] +6241 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [175.086 279.752 261.453 291.441] +/Subtype/Link/A<> >> endobj -5951 0 obj << -/D [5948 0 R /XYZ 85.039 729.909 null] +6232 0 obj << +/D [6230 0 R /XYZ 85.039 781.388 null] >> endobj -1746 0 obj << -/D [5948 0 R /XYZ 85.039 417.541 null] +1774 0 obj << +/D [6230 0 R /XYZ 85.039 732.512 null] >> endobj -5956 0 obj << -/D [5948 0 R /XYZ 85.039 386.254 null] +6233 0 obj << +/D [6230 0 R /XYZ 85.039 698.974 null] >> endobj -1750 0 obj << -/D [5948 0 R /XYZ 85.039 140.652 null] +1778 0 obj << +/D [6230 0 R /XYZ 85.039 395.581 null] >> endobj -5959 0 obj << -/D [5948 0 R /XYZ 85.039 105.906 null] +6237 0 obj << +/D [6230 0 R /XYZ 85.039 350.615 null] >> endobj -5947 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F58 3360 0 R >> -/XObject << /Im1 4096 0 R >> +6229 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5963 0 obj << -/Length 3376 -/Filter /FlateDecode ->> -stream -xÚµkÛ6òûþ -ú2P)"E½ziÓ&¤É6Ù|8´E ØZ[]Ùre9Ûܯ¿yzY\‡`c‘ÎÃy“báÂ?±ˆ|ÇõâE Ç‹¢Åzå.¶0òâJh[ƒØ-˜ïﮞüä á:±/îî<¾£|oq·ùÕúáå³Û»ß­lÏó,;+; #뇷+a½çÞÛw7oînÞ¼À–‚Na}¸Åá·ïV‘gÝ1ÐÍ›føÙÏß?ã–縫ßï^]ýxW¯´^¬*Æeþyõëïîb[zuå:^-áÛu ï¯`Ž¯<ÝίÞ_ýR£â1µàYC\ñ½Èñ#ï’-Â`‹ï:¾«ˆ-Çd½’‘õ°ò+Ù®la¥+[ù¡UÜão`ý„{/V6û¤ÊÖöíísØû ‡#ëŸùùÄsªž|½fâL*èÈÖøi—Ù‘1Ÿ©3Ï*\À—U¤,8”HøÖ¶È[F´A2¥™žÑ” -þ}V2¶Îá:JnT0ÛÁ”[<`-1m8=œÎezâcû‚¤‹3Ÿ,âÄßmÊÔ¸s·"– tžT8±ÛÍψ#-Ÿ¨<ç‘ß\¡r†ýÍõ |7&nàDÁŒ¨70t¦J´ÎT¸ÂQ®W#Â=ù°OOà¸M40;R$„tABš‘^è„JGŪ»ÙQ11ÐÛîˆI笘Ͱe†8’ÓÑ ôé³Ã—âö·"lÙ p¤>¶(tÏÈÒ´ ¼ØŒgB–4Ь,5È&d©GqX–Zïvi© å‰&gaÖºêZ[°l(öì#6iÎíä°áuži·D‹þJ$²Ä$]ΈQ `y®ô¦9ÚÀLpTÍrt‚`ÃÑÅaŽ¶(þ‹\/òë:G‡LJÒ5ö9Øå£oå!þ9&[=€üÏØ_»¶ÎàÚtPá¡WÇ©h -ìx½ÖVwg`!à Ýbvb,d%ô9š×Àõ¹ ”=Ê=ƒñ-ôÆd&ÊtÀc?f¹‘üç$0hþ H‡̓ 0j±4„p)€ ‰híq]"ˆ§At˜Qì÷´ Ü÷&Õ9Ä+ˆV”ò!.„•_L¸i.’ØjqÅp¥þTa40&µ~¡[LJm f\j ÐœÔN¬¥¶OqPjÛoHYcÜ’?ÖÚÜCK¹$Ë—·<ô:9Õì|Õ„]±¥ø–¢K樰–È=%¬Çú(®&çi n@›MÒ@ôe¼B‡óž¦ÏŒAOÓfÆëi|šuÚµ·!G¢y8¼µAæb[ù*­>ª·|÷7éü-|?t"9|¾2ˆàäÔW9ßsPÎÄŸhVèdB×£8,t-ŠwÆ3”µÓ=&±;Ôfi3¶sW¦5v™ÿa€1ÛPËQ]u=ðÝÓ\«A&˜Æ0³<§Ö°¬Kn˜c 9ã­£”F°šjÆ$9w’9<œ¸EiVŸ³_£€” lbàúµç¢~fTá|Ã(>×n MeÅ`û÷z5y*®\—†ï¹³ÉÓ_½ÞCQqÏ}²Ï($Hʶÿðµû §ÕËå^³ûÁ…ýÕvGì)ò}[Å}bàªmÕ˜H¨@:q$'e¢3.hN*¦Öbѧ8(mŠZ0”˧„¿ ŸGN¡À7(‡±:e€ï^xπఠúÓÚJ§–£¦º³ÝySÝßø ©noüo&d«7`O´©æϧùi¥Æ’©«ò†ÚÀØ- Ë““¡9ªWc•¼Ç+cYóVÆ=[w}b<t£Àû&$§G1X¡Ø‡›ÙþHVQV «÷S¬.cŒ‘ª$Ë!P"‰OtXDrs_”X>âPB9ŽÛˆ´NvT4 -Ü6õ˜óIë,m,©­ìYqÔtv²ºëyŸ©¸EJ^œµ¥§’²œ¤67ÉË‘ W¼¾¼O(¿9aäO+3¡ühVù'6Êߣ8¬ü-ŠÏФ -´äÌBP„ªqЭ»‰)‰ö§­"šÔ‡¦:¶––±ÎN086Å"¢7z¦É™0ºi~«Á)c§ãE ¢pòtZ0ã§c€æNgŠ`}:}Šƒ§Ó¦x³×¢‰âØÒFð€Ú6£‚ŽÝÄ&ì)ÆÄžxä¿w\•9ßqï€{ÇÙ»Æ?j -ìT%ä„lë«ó‘1þªò¼&]×ôBT¨+îØÀd ÏCßX…]ŽÚ{}ÁÍŽ½ïã¬í=-È>¹Ó2Zcž`}>ž8 -ßkgWíó ‡%• - !¶ðÆêˆ c·€.… ‰ÅŽr ?ô);zþ |ÃqÒx¹ÎBæ=gIƒž³½¤¿[NÛü9ÍH§å{°}_9~4RûÔ0v h@›z˜ZŒô@ª_ß>§¯¾€§ï¨T-®GÁÇ‹70>–Üd¶ FÝÅŽ3[C_,»ËìÎYfçÇMÃRÍyàxíˆxמïH ÛP‚ìá ¯5ŒÝàu“á5h¼Œ)6”žÛÊß‘±ywáö÷ ñZ -HZ#¯»ØQ^èée÷q£ÈäUh™å2·ƒÙËø¶åEX6§H¦H¢N ûœ˜Ò¿ƒ±#cò Ìô~”'œ°…‰Š`%ót9ãغ퉫.<§¾`ƒµÛÚl ->‘±ýXokÊ^—G'<0i^¢‚™»ÒÀv=pÔÅ8«#¼O¬fLx:Ò“Uö-¸鯭kÀc—®’Zk›ªz.ÞðN§-˜‰8EÍÆ)›8¥Gq8NiQl²ÿÀµ¨¦š¸ñ9K1¸„ààƒtý9gLG”%·>•œ@Ôaª…Ô_íhà¼Ý™6•qa¢¡ËT2ö=²»íq­¡/еÑ=œ“ò§Mrä9x½ÙR²Æxøã[tÛ~‘S~£ë‚cÅÀo0!}ziXbáD°LˆºœH §žt -Iå×\nJ?vB¥¦ÅÐ͉a Ù¸ö)Ša›b-†à1”r×Üäsw ¥Úæn{.Ó^œóÅ82©_ Ôa5Šbbê†6K}…Ä7œÖò"Ùðl“õ kÀw—®¶¤¼.sF…Õ@_°©#¬}œ_!¬Ìv=ñ•VwTZ@±ÿÒ:]Á–à©Üx&¹3@³ÒÚ ›ÖÅaimQ¤ -¶ ½Ú ÊPZë‚e/ÉL*z|†£u¡:Mþ×/n0Ãj BÒÔD!¦bKtTóëK–”‡ÈúâGûŽÛ,ÔaK„Ã^™é¦ •5kÎð’ÓEÊ ×Lè¢Tkv‰Ùm^?<@ätëÞK‚PUer8“ºöÏÏ€ð­ŽÖWJ'Äøq>a¹ÀV‘‘¬j·‚¬_¹*\1#ò.R‹*€‰ógJ57]Uò ‚.°t6üíÀýæ1aSƒ%Ö)û·©ŸB+­ÖuÚ‘’´—k)8Äï*‚€Ù’~²±D½á®}È3ÖÓã˜k¯AÐÇ¡ ±AØ ñ°Ç·6Y’[†|ïán¾åÆ®¡ë[ýdŸÐE »æÉBº€ÉóŤB·`ÆÚÍ)ôÁZ¡ûºMñ=Õ­Î9—R=8ˆ¦P®@šËJ·S…'‡9RÝ¥º®«¹ƒ—Ò×';Dõ¶‘< -\Á%Æã! }ÁŠn<ÔÃ9S]F³øª“«~me])  ê…à8†ÒÀØ- <°‡©]*íƒ.Þlã© r¡w§_Œ.´ôýŽëò§¹5Ö¯ŽQVíšðŽ€—›:¡Ã‚xnÉ#E ‘FOçLÙÏŽpôBÔ`×8ȵҚšçO8ãÒ¬._¤\®éÙóõáúXß”bÇÒ¬Ëwë»ñÃZãʪт#ó4øcQùŸÞ7WW`ÓÇ -M>äÈêµàÁÈèÂ>›÷é þ­Åóendstream +6244 0 obj << +/Length 3247 +/Filter /FlateDecode +>> +stream +xÚÍÙrÛ8òÝ_á·P[CàµoÙØq’Í¡•šÝš™X¢,Ž(RCRöd¾~û@R¤’MÍú\eâhݾ!ÿÒƒ?ÿ2 ]O¤—qâ»"I.Wû ïòfn.| á]J׋BœúÇòâÅë0ºô=7õÒËå†@–ëŸWo^.–ןgs!„ã§îlljóêËbæ;·<ºøüöãòíÇìIô/ œþôy–g9ûuùîâzÙ;v.] <÷÷‹Ÿõ.×€Ú» ÏirùmÏõÓôr!Cá†Rè~qq{ñ/» ÏÉK^5AÝÜ@Ìë4§90GŠÃÔò ð&xøŠ|7„2u^Ï„çT@1üß«6_A3Šœ«ÙÜwT«îT“Ío²2«y [ã|ì [Ô¶Là$¤ëâ'?œÀi¹Ífsø€I"“ ±˜àðzfá¼á¯*á많Újæå=NxÎ!‡%®ô’jÃ3y 3÷4UÎàœ#tó[_-Û&+6(#^è|¬Z­ÊBÃ!RŒjÆ<Ыø»›™‰ìÀ#- l¢{ÂËL‰ôCç&-2X$R…4SO©óÚ¦zƒG×È ª|ƒ©p×äæ;#´n…ÇÜ«2ÿ“pZ›ø«þOQ³ FVàx»U­†Ô[®TÉ{”îQÀö/ž/¡[dæèr‚ìvË÷#} Bè![ýÀAÚêjϸÝ0BÖ¨‚ÿýáýüû ñyÍ£ZXx¬mà£Äs~Âó"c¸ žç.£¯RµÝóí®³¢à½!•]Ï—$wZ Æt6žZáixÈë"T!;EHÒ‰gdVM{»ªóƒ¾Q˜^ô¤Æ®Œ„7´ÉÑ¡Å3ª²a_¼Ð#ëuEÔB×Î3x8Ò€í÷¹U„?úâÈšâVõý‹‘^Îq?öÙ!Q½Fc†¥D­¡ç”Z` TœY׈èƒVúå0Î!ÄAop0 H63äQp¿2•`B ;ô t¸ôØX‘‡a¼A]OpÏ\#®zÅVàtÌ‹`ŽU+ô;mG’2«%°ÖñD.¾µGXHgU Ü D#0;!*- Þ‚?24‰ |•þ^ +xF8·lΊ£F¶¢mw¿¢[ƒ Ò'H2ðy³à/^ì¶j«f¯êSP"Qµ$Ôij¬µ›kÊðZ¤O–}Lý^‘‘õÁ(Ò-¯Ðæìx„L»OÄhý>æ­a'vÕzMF;¯:kàPiÈ{ŽW‹Ne$Ðy£î,àðŠÓW­ÙZ!°m¬ÂL+°±¼xŠ½mà•¹=Üå1#wÖòÁ)IÏú xÿH{Ä¿­Ž‡æu^ ¶èÀoF øðDƒ²§ùúˆ<$3¿FÞ‹Ày ÔiB¸ ¤–‘XlØè'Hcg­²½‘$ìoÉDZìѪŠÇÉL°= Æd†­8 „#3¹cÏY ³+fÖXÇí¦ÚöãæIä†B؇ì/˜ áÇdáªÅ²Ñ’O³†‚ÐÎp„Ðææè¹5Œ¸ ÒÞ¸\k<ÎâeØȈNeǶ€›>5¨0“~ú½ëÓÃb biû߉¸owè##ìƒØ ãð/`ÿ²çÀ¨r=&‰[ý o>»ãŽeèF­26ÅÝWÛÑV6©”âQDx‘ëÉaHðh …ì»—ë^ìAzk´;Ú!9/ð9Ñ`ÖÚc6Ј…>§Èìr䳺+ôÌÐëãÌÖý-tRRk|»T‚úš[\šÈûYÒ¾_¸˜H7™ ìUu‚éž +AÇD¸‚kW…™Æƒb’令‚ŤKI€ù¦_FšÏˆBŽ›\4â«Æ¸èD1ÙÏ^U8ýX•ZŸ,|‹¼mZEÑ,ßà¸(„­’ ßMüôÛrþ&£ôQêr€¾⤠i¯0ïð¢qÅŸÍ(mæPŠgûå’‡ÞëÒEý}ŽHþ,LBŒÒaÓYpg"b@cTP’ºÎ_RαԠù%ÿCå)MÝG + uª³”|5¹aí娳°†ç¨ŽënÕÛëåb8ñ¥$aÖÁ?(:0„Í£aùE¡`­ŒC@€½ÒU:ì4[#TСT‹*þö6ᬽ) +Æv¤ÉèçQ¼ˆ‚(ìr{w]Â`ÈùâØp¥´ŸÓEA?§‹CÊ`<·` +ÝEŒ=qÀÆa"Ó‹}bD½þH]˜j%;Öîü¦²eÀf[³ºj©à‚(r‡Íï×{´­•~ÉdÀ²¬lŽ5Uö„d²IR ÓU4„p(¼Â+ 4 +ÕÚ0ûk:xK¾`õ¢«!ÒôŸPòØsc1©å~†Möœ™ô'”N‰Gáƒ+Ã3§ä÷ä§^´T²Óœ©™´»ºK +¬€qe9f< <Sä^è¦hÍaT†ƒŠŽÜ$Ý8H~< 8€zŒüH ÝD&Ӽ´fSr#Þô£Æÿï’^m3Sr:eù”å ‰¢WÙ£U\²gK“¸ˆ owÂ)=Ïõ“àǯcMÅcý‚™Ëi*iÅ€Açw›‮æI^Þmfãâ­1‚nµ/ U9– ®,î¦øDɳ)}Zlúù/dË3ŠHÀ[¨z`tE²ÕI¸ Ÿ»A˜è‰»)+œÙkÊ~7¼´«Dî¬[ÂavÒ ò6ox—sWS”˜~pòI6Lï_Tg¬§|üc^˜»/Ìû8O­Ÿ&GçjlÚw¼ž¾8ÊÙÊlÂ7EÏ ÒU²zå£õy_GõñÐY¢¯¿™Ë;ÓgRCûºi¹²wN¥çF2~ZBø–´)5Þ/uVʼ» Éy?½9ÀÌ{ÕXæ¼Ë¬~§ý§ýšw,鱬e,á"I8@p$ëu/^²W®Ù(*Žé“Æ÷DÃV +»]NØ$BÈ•âèÇ ù›ÅÜÒýÎzC7Eafï^ýcÊylÆ¢BäFAl`§ü2HOÓ²/·Zä»øuª2Ì:uò.C¹Öœ¢{悆üŽÙ~rÞMÓ„ÏZb +2Äå®ág£Ð ¨£âg­o°º ¦ì‹°^€Æ±\hˆ%ÂÜ(½îô(´×çúx„Ùp³÷f™tˆð/ŒlÔrzãmðyßqoÜöXÜj×!äð÷¾óøô¤yv¨dŠ»Ä­rǪ‰ö*`7 (ß¿×c—z«&ÌP¤?n—z*4ÖŸ@¸©H§9";;ø Ÿ„.Š#öÃ_€(<Ó•}’©”„¾‘C„¡w0Á²:´#>ï9 «êVõ߃ qÓpX=¤ºR€¥˜¬U9ýÒ#ÀjÎILJ Õ±åþÖfrܧ+„/÷)º;' QCø„×? ñ0 CT#¬ßaŸ,:âLÃÅBM×Õ³zÂ;aä螢–¼D;‚¾Õ¦¯¥ŽÈ»²÷ªÅ¢_s`îÛª„v$tCìAth+¤MܺßÀÈ)w¢Ž´S¥»æÛN.9o’B`vxæ'‹Z ÿÚoE I¤éo29H“S<û7nü/.[×üendstream endobj -5962 0 obj << +6243 0 obj << /Type /Page -/Contents 5963 0 R -/Resources 5961 0 R +/Contents 6244 0 R +/Resources 6242 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5960 0 R -/Annots [ 5965 0 R 5966 0 R 5967 0 R 5968 0 R 5969 0 R 5970 0 R 5971 0 R 5972 0 R 5973 0 R 5974 0 R 5975 0 R 5976 0 R 5977 0 R 5978 0 R 5979 0 R 5980 0 R 5981 0 R 5982 0 R 5983 0 R 5984 0 R 5985 0 R ] +/Parent 6208 0 R +/Annots [ 6247 0 R 6248 0 R 6250 0 R 6251 0 R 6252 0 R 6253 0 R 6254 0 R ] >> endobj -5965 0 obj << +6247 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [148.013 703.447 407.73 715.44] -/Subtype/Link/A<> +/Rect [135.627 522.948 178.893 535.849] +/Subtype/Link/A<> >> endobj -5966 0 obj << +6248 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [371.497 676.349 539.579 688.341] -/Subtype/Link/A<> +/Rect [258.892 522.948 288.461 535.849] +/Subtype/Link/A<> >> endobj -5967 0 obj << +6250 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 662.8 273.67 673.883] -/Subtype/Link/A<> +/Rect [376.043 348.815 402.884 360.504] +/Subtype/Link/A<> >> endobj -5968 0 obj << +6251 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [371.497 567.652 539.579 580.554] -/Subtype/Link/A<> +/Rect [311.498 321.717 358.4 333.406] +/Subtype/Link/A<> >> endobj -5969 0 obj << +6252 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 554.406 354.349 565.489] +/Rect [468.792 226.266 539.579 239.168] /Subtype/Link/A<> >> endobj -5970 0 obj << +6253 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [371.497 459.562 539.579 471.554] -/Subtype/Link/A<> +/Rect [111.316 215.444 137.157 225.012] +/Subtype/Link/A<> >> endobj -5971 0 obj << +6254 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 446.012 273.67 458.005] +/Rect [311.854 118.479 337.786 130.168] /Subtype/Link/A<> >> endobj -5972 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [508.95 377.963 539.579 390.865] -/Subtype/Link/A<> +6245 0 obj << +/D [6243 0 R /XYZ 85.039 781.388 null] >> endobj -5973 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 364.414 325.713 377.316] -/Subtype/Link/A<> +1782 0 obj << +/D [6243 0 R /XYZ 85.039 761.463 null] >> endobj -5974 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [371.497 364.414 539.579 377.316] -/Subtype/Link/A<> +6246 0 obj << +/D [6243 0 R /XYZ 85.039 743.459 null] >> endobj -5975 0 obj << +1786 0 obj << +/D [6243 0 R /XYZ 85.039 484.308 null] +>> endobj +6249 0 obj << +/D [6243 0 R /XYZ 85.039 447.441 null] +>> endobj +6242 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F62 4159 0 R /F41 3054 0 R /F59 3455 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6257 0 obj << +/Length 3364 +/Filter /FlateDecode +>> +stream +xÚÕZéÛÆÿ¾…±Xgx» +·I6Ndã]#(’  DJb—{ô¯ï»†‡Äu÷ˬ9gÞù{oVÍlø§f¡gÙN4 Be9a8Û.ìÙf./”¬°g®eûNýãæbõ¥çÏ”mEv4»ÙÒ’›äÇù?¿z}uóÅ»ÅÒqœ¹Š¬Å2Âù?ß_-ÔüšG¯Þ½ùöæÍ·—ØsaPÍß_áôwï¡3¿Yü|óõÅ7ƒÏ.]Ëõüî¯?þlÏ8Ú׶åDáìÚ¶¥¢hv¸p=Çò\GúùÅõÅ÷žsg¼kâvK³béØVºSk”o9>ÐèXઠüd«àôžåzo<%ŠSCšÊ› ùæP.–:œ0ª‰ h7À@/œçÙÆnkîÅUÊf/â˜Öf(–=%ì¨ +$r—%Ж¥ûŒ Ëúû¬Ùc+˜Ã,jÚ’»ôEkð<í¦ÉŠ£lÚÂO.ïøÚòTh®CÕNæÞ]~àÖ 6קÄtR:aåÓ^žn÷­ÈñþøI®>‡{~v×Ò®þè³,]íÙR¡æEôLoéP/ٌޢ½;îØÄâcÂKýö}^žÉDißR~ð{Ïþ“í)!]óïQSRÔ<ïfNµÞ·‚ð#äNîàÝ·µÑ´9–ïø¿eD ™tП”ãÖbOüÎ6F%]*­IÁ?9=E¨Á ª?~§I‹}eÐ<î¬SÒ.lrž¸ ØVdàÜ–:°ì(z^îéß蹋ØëÛó ò \uî²ô[J4P¸ ºÔÎdÙ#ò¥h+î­‘Wàž‚ù}-b¡ñfOínoúYÍtrbéí«3 àÖ¥åL]hß4å«ÕêþþÞÿÚ>”Uvl2‘È€ÉÃeåÚ­Ê2åqýy?Þü7ÙÆÚ첿'Uv—VŸåÿI÷S"½¯®xõÛ¸N«¯Óæ÷—«¼­?­÷Åýgêô*‘o¸ŠÓfƒ¹ùFCÂç¥!ßuÃÖ—u¡¬Yž Eä‹Ðe_æeàN¯Mèbrx +Ø‘z‡æ7){¨Î &¬MÐÌ⼈e"î=SDCê#=×çg– ÎV+ý”e;!„GÿyZö Z­Ţɺ‘˜wÁb‹ÉìjœÐ,œœW7f[vÜ"÷+4ØDc¸Ò$Md}Á¿m21?™=ØK'©'ÁÒ.X³— (d02ŠJÕßK/°ñ”ŠÏKF(9°ØŠá£Ó™Ž©:ˆX7ÐÃhßÃx0üº•‘¦Š; +e\™Kg"RhZÄ·— ¬kÐöç­Ù™V€‘]­À €Oà…b/\qˆ®bˆ(”‘C¾ w…Cî±geò¼ JÙjrü.IB19áI—´Oâ„…ü_"Œqm/°7EXŠÒÅß-aËwØéCãŒéz¹Žka38YR¦–ô ùú–Ü=’ŠìŽ{Ø&üšu(–¢Ø²8/vܽ|ÿ楫ëüÎaÇå>:ßÁ%=³h4V€³õËþ3˶(D·w¤pÒyç)#mKþEéá6Â+wÊ«HaOQ¤ )aè~ŠwçNWYaŸ%Œ¯­­(R¿uíÁuA’±Ühƒ£{z5ÝN &{3<¹>bÄ+Ø¿[~£·É6 +i Ûdv”-ìû (?´ÂÈéÙ.=¦UÜJ€°ØUñá\¹T„èÜǘnùnð¼´ë:ÍSbCîŒyæƒÓxˆ‡ãqàNÈuã²+œdOeüÉèV¨d;çpöÕ—ÚC…¾æóbáØóû#EtZ<:³§-¥ÿOÓ:†ZV— +b$ŠÎ6r8ðéÈE^º¹A 'ß<†J¨ô—Ì3ºçíÄwÁr|;”—à) x!rBeiíèŠQsðÁ“¸Ú +?·åîñtÈ:c*Uˆ/rÜ@â +4ºd–öl¡©-G!\-8Û“¹l¾ËŒÒÝcäð8È0& ˜…›“‚‹†­™!ŧàÊ}‚ /*㺑eGÛ]L=nd4k&ÂÒ¦hsÔ£Ë5ÐyçÚ ˜IâzRhGóœLé¤Ç„óM5ßÕ<Äj†ÄŽx]#ʉïÙ¯‘=Òü!¾%VË>¶o×춯@WŽD®Unœå<˜5µ¸mpÓ#LbMa +ƒ¬…:TCÿ|nB„^Û5^)¾CnÚpÏÚ‚]–5å”ÛÀÔS‡ÃÔ{k.‹ÝxÁßסž¦\cIÂäãð`/AE8ôšb #.™b¦¾Å2õüFZAÞáéßíÛtç‹’ª +ÆCF±Y%nš…ÃnÅó!Èê¿{”å¸#0$˜MÂèJìÏ…„^£¥¢ñc*¡6;‚iE®¶žF“!/…Ž&^âoãÀÞUãfhp裠Žû)9Ð’nÇò•u‹²S£ÃÕxyZ»)ež’Ç„Þ%îà\¦©7‰f¥ÐØ3°Ÿ»®£ÉEÁe’ b0åN’uy®ˆÙCß&¡cëA‚ׇ ë®H(|¡³Èš?/1ÌóÑ+Æk .¸rK bäöÜÁÞ ÔnM*+Ù3â‘b+‡&¼òùI& +”ש¨Çfá<1q/gåq]²~*¬i{.œÁfÌ?»*eÚ\nѺ9$è9OãêÈÝɦ׆´“‚íñ9É›æüy—vªˆKCðKWxؤyžJ^8RG “n ­÷ijtº$ lÄT؆FúÀ«´Êú$ß^ÓÖƒ, F\.6ÑŹ?JÚq 1 ~«”RŒ hJSµ†°œ&æÍ;ÉéEb45ÎU£.WåRx0Áë³]ººÃ:øB0®ÌyfžFò’*oÛŒësjþBFª”³zVß¾œ@Õ6 -˜*ÈêG‘yx:ºD®ºÏìUîº8ˆã'S?H"‰ÈÙ– oÇ1¡ÇØ»ë\N&á†J`ðû6ëÊ!£G² «¨vX%qÝ dìê® ImØzò¤PØ­Û¬éœ }y¼\ι +õNHêWx×$«oI;¢Á¹9p*ì@0pVeÜìWM±:<.¥(n•åÖQDùýk”mùƒbqê›nS9™üf`VlʃÕÀ``ìk¾=|r¡ÔO9þd½HG>‹¼d÷ÎnÙïr lÓû%Íþ€åm²þ5Œb)Aå©°96X]ŒÆcäzJ·â2^HÓ ŽÃuàA&–·uµª÷q•®6mY¯ÄîÕ$Àˆ`›ÓÕkèûÌ×vÁ:ôЫH½LÏ ª"Eþ¡-¦'úÿ\òfŸÊëè`œÞÈ“Z˜—7t‡=9úS“(ìoºòÈéÜKS‡4ÉV‡Ò³úÕ„¸ñÏ%ø5_Eó—ÅÒt•—qrÀ¤;ËRñé ¥Ê¼­eêŽ˸‚[¦ù«U’Þ­òÒ–é/øC<©ƒ GÊ°¼2ž²îIá+Û¶B­Ÿ—ô¿DÃEDÞ‡6:'«‚>®ß/%ãCÏ—÷ SL†kô*ˆ+—\¼¨?a¢\¯ÀÖ( JÝònL¯Àåuþ8xÃè ü#Ïß ú‘,ìÈF}ÄŒ˜õð> _?“›Ò› vÉT]m…'™j¸·«® Þ‹züŠt—>`û_ -YDÈ[`à‹šç³c’±kœî€ª,DˆAÇç|äÑ#%t`·” ä<¸%Ó?•P²9§¬êþÄ„²"©ù¯-iFÊ+cs5]Œ™¥…ÁÝçÐCÃõñÑ qú`_ ä%Yód vÛR^8[z®¥¢g‰¯Çe`¥ Wc¦8ŸËLò´D„6½&pÒkFíi7ô@‹ƒÙq"ˆ*?²:´I)ÏÖ ˜¶:ÁÕ¶G‡_š@O‘¦?£üá|‹=3;Îûþ‘Ôü}Ò‡‘4;Žê1RŒùëF“×ô×’_ñªkWr†~wQþØ÷KÉCˆ<†ßÞa/kø·íΓeúÀ> endobj +6259 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 350.865 182.533 363.767] -/Subtype/Link/A<> +/Rect [473.834 747.387 505.372 759.076] +/Subtype/Link/A<> >> endobj -5976 0 obj << +6260 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [325.181 350.865 539.579 363.767] -/Subtype/Link/A<> +/Rect [510.314 747.387 536.549 759.076] +/Subtype/Link/A<> >> endobj -5977 0 obj << +6261 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 337.316 136.217 350.217] +/Rect [111.316 733.231 239.475 746.133] /Subtype/Link/A<> >> endobj -5978 0 obj << +6262 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [216.087 337.316 430.291 350.217] +/Rect [294.271 733.231 319.142 746.133] /Subtype/Link/A<> >> endobj -5979 0 obj << +6263 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [133.74 323.767 388.228 336.668] +/Rect [402.846 733.231 445.778 746.133] /Subtype/Link/A<> >> endobj -5980 0 obj << +6264 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [394.406 296.971 539.579 308.964] +/Rect [394.406 706.436 539.579 718.428] /Subtype/Link/A<> >> endobj -5981 0 obj << +6265 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 283.422 492.799 295.415] +/Rect [111.316 692.887 492.799 704.879] /Subtype/Link/A<> >> endobj -5982 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [421.347 256.021 539.579 268.922] -/Subtype/Link/A<> ->> endobj -5983 0 obj << +6266 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 242.774 492.799 254.767] -/Subtype/Link/A<> +/Rect [396.346 666.091 424.551 677.781] +/Subtype/Link/A<> >> endobj -5984 0 obj << +6267 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [342.861 147.627 539.579 160.529] +/Rect [255.4 571.247 279.211 582.936] /Subtype/Link/A<> >> endobj -5985 0 obj << +6268 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 134.078 245.034 146.979] -/Subtype/Link/A<> +/Rect [414.496 118.146 451.671 129.835] +/Subtype/Link/A<> >> endobj -5964 0 obj << -/D [5962 0 R /XYZ 85.039 781.388 null] +6258 0 obj << +/D [6256 0 R /XYZ 85.039 781.388 null] >> endobj -5961 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F35 2976 0 R /F58 3360 0 R >> +6255 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5988 0 obj << -/Length 3477 -/Filter /FlateDecode ->> -stream -xÚ¥koÛFò»…à;\(œE‘\’"S‡$mÓ½Ô»m®ÅµÄ†Y>"÷ço»äR¢äEà;;Ü™Ý÷ÈŸyðÏŸ%‘ë‰t¶J|W$Él½»òf˜yåkŒ…FYX8oﯖßEñÌ÷ÜÔKg÷Ã:‘FbvŸýâ¼ûþÍíý·Ÿæ !„ã§î|±Z%λŸoç¾sÇÐÛO>ÞøøG!}çç[œþéÓ<Î=#}ø8L¿ù÷Û7<®7ÿíþ‡«oï{N{€«Ùüóê—ß¼Y[úáÊsEšÌðî¹>LﮀO7 -…WwWÿé—â¹pÆ_MJ$7JÄé±ø‘u,¾¸Âf«Ès#/¤sY—]‘ÍA’8470Jç°EÄõ(ly~'?σÄQú»v«NgþEŒÑ)j–Ú’1‘J^00oÍp×âGÏ0ù«ù7x9pR 2¥?t0ÙÂõEžÓ5 -_|çúNâw_4EÉÆu]@½æ!ìu!–”²«y‡0Jφ¸EØ«†?Ûd?R§Ù ÓóÞ¸Ñlä÷6b«ÅÃ3,fLg_”23|yNYµy¹çw<“ºÜMlº_dö€w¡X¬+º_|Ëòšq|gÝÏx|îÙŽÓØÞꢞZ8$¡o ¤ç»¡'ú…Å_=uLÏ÷b7‰’‹ Î ÅI°)¾Ù—(«[—zQû|ƒÏ „{h«jEêѲÌó\%k–%à%à“küjË ±r{u‡úè‰FƒÏØÜصÄâ>X%nâ–‘ï»m Ò@ëIÍ£ÀYw,a:™j‰Õ¸áµNN"^%z-Ö†¶Ä]ÑuÏ"õ]ßOGòóá„$öŒô㥽ÐâÂc3I;D@…¯9 kvŽ«ìH‡Õ‚ñ$RÏxnMúŽÜ“ÍøÌÐv+[~{èð΀á¯lŽJòx+§_ƒYÉvhÉp[\ -Moœ:Ö«ÄGâlzƒ‚ !ä€Tõ€¬9<¯T²Þãû -θlŽqÞêo¾)ù°®‰‹Àù ç󆟲hÌn`5¹g¨z¢UQ(Þ»&ÌŠª€CkÓí¹Ù*–4µ©¯O^$‰¼¨§Š$YÑ™ê«Õb@ò8ÝàðÓ€¥”‰Ç½ˆ˜OÈÀ³&èb ·ßÖY¸ÕLðÇÖ%}w<5ÃÔCü¢ß™›ñÆõmƒßßkÿ`TN¬—Q€Ó¯ëœÄó†a½g…wbôú•†ðfvÊ’£Þ&À´í¡Ô“ìwŠ´ž™¾|ÂCç«z§sÎ }K,.;§ç‚sÒH/:§ çtDqÚ9YïJ PËèÜÙP0mYGª·*0%8ú¢UZ† @áóǼ· \‡• )ì Ú\/ØÐâ׌ôH¹ìŽú‘íK÷d›Qð7à#ÐU ÔD -¾‰¡¦œÐó½Â°&ˆ - á£FÇLë\ 8ì“FzÑ>] 8ا#ŠÓöÉ¢8.jceæ‚¡‚Y•›X‚ÒrÑ!Ö -+º̣ë)Ë®©—u F)yn°IËÇ^TÏP+5‰†EP¶ªV6‘tTQ<•¿ßΓÐyCMšï3Dzì_ —Ã'ª :m=6² É5e\ñÙ‚Žå©¯‘wC€Í‰ -UP¡—8ot‡Ù*ˆZVš:®yšZ#kF~㚃õÊt2^í_¡Û½•Wµ]èm€päž,”"T¤=%ëlõ<[÷Ÿu"PNÔcŽ»#¢îÈ5£Ú=Ê´j§•N'7ãÚ0‹jng°…¬ÏeyA»+ð'—4ÑÂ9¯‰é%M¼D°×ÄcŠ“šhS¤ú9ðCÀ¼Zçè9¯žø1å°HÍ#ÔZ‚Üð:kpÿ­^Sjb¸Ú³©$é;×_ؽ†dåƉé¬A—B!HÝQÕ î.!Q·tq¾Òq¢^ÀÌbÏ(˜òãówn ’"ÍE@ãþaDû§9 ·Ÿjb€ÕfÔ.Z ç;<ƒRË»Ÿoïø -ð*IëÒ>xIDÄ,zq0€LÊœßdÅfpû8z«ˆJÝtÞ­¬qÁ®â&ä°‰<ÄR#ôv¬ì6[qh\†gˆéò„ƇÁu– Á¨oŽ'ø;‘âyâ'¡—òo½¸þ±WQÏ ÙÒï´¯[i¸êc„ÒLîµS»”ôzn0Y?&÷—~Ì6Tä…›ˆ3õ•(ÜÀ7¼àöàÈŽù5?z;aøÿà^«endstream +6271 0 obj << +/Length 2544 +/Filter /FlateDecode +>> +stream +xÚÕYÛÆù}…Ð0…Dá•>9Nì8ñÖ« (â‘ÔŠ^‰”IÊÊýñý®R×.Ð ,gæ›ã»/ù3þüY¹^˜Í’ÔwÃ4åûovW7¾ìðfÊõâA?¬n–/£xæ{næe³Õ†¶¬Šß??¿]ýôv¾ÃÐñ3w¾H’ÔyñÛíÜwîxõöíë_W¯}…3‹¾óÛ-‚ß¼§¡³šÿ±úåæ§ÕèÙ…rUâ»n~ÿÛ€Ú/7žféìcÏõ³l¶¿QQèF*”ùîæîæïö†©Ÿš n¡‚Ø „ž›¦Ê’éGdêº@ôç »¾dJÖG ¢ç1»ùÂwJ¦¹ßÊ&}È¡…Í¡­à£Íñ]UÃô÷7ípø±|x#,`,—;ý¯ˆGw.\áº|ä ñ(pcÏ—ûQ«çA +ˆUOK{~0¡ï#îhAgÝ6¸tbÒZ÷RV‹ †ôõ¦ùìÇnƒ,•?ÁßwžŸ\^¹*Šøàå¥ß9)³×›sªhÒéy8qIDµiæ Ü°×}•/P”Vuø kþz;O•óœTøçïx-7§‰¹VÒZž~Üãòo¯àÿ÷,·ðù…òÜX¥DBÛ4ý7óEDN^ðwyìÚå®Z/óã¡[nª]_¶Ký?»š¿‹Ž¿ÿ:m«|ËãM#t¶ÕáÙ„Úœ?f,6|ªíÓS Kêa¸iyÓÆmÕñîÚðãÄ@ÍG¢ÈÑh;½ÞÍÅnêÚõæ„\§{a ®õÜE>zƒ³Rv¶t¬ƒ==qù~$”Ý¡+H‡Åã÷Ò„¨}ƒ˜æbÄÊÅ Tê°õ’ õ îþê§6|8Bd€‹lJ²ƒpâá©ê·|ù\z‰v¥è:oüŽ÷¾Àãlqá„ Ä×_B^Fì·¿x@Ð;µ ý¯P_‘7 >:ÏŒ¸’7¤µ{ô€tQÆàa\°ÈXö´«dòiW„O3PMhA¼brê [v=axÏ€[by×ßåÄÍCÏËïñŽ5*ž –B¤Q@˹õ¶l¶Ê©P.y²óü‘°k²uŽO§ "”Oâ45OIµKëêa…CC +®µcíãåŽù&›èßTÃ*MõÈà²Î™Ž¢,xåJö¼l˜mzÆÌÎ<§Ü£c[ó…Ü“²ÿB¼·s‹Ìû+Ý ÚWAäÓøí-)8Mt+P¡º= ó¦îúöˆLÄé;/òúV[UD…ƒX? ¸ -ã ŽÅôPË!αÂFÁ(̶p¥/o +i¸Aøs '›³6_¡AÅèž5£øˆ Ñ•Þ×B‰×ÄBåpø$²—IMÌ ›Gž €é󹧄eÿ‰Ü d{Vˆ¤¸+m‡‡ÅÃñéÞ>ÝrVb¯-t¯yDTâùæ¸3„ˆZ=ðtZÿ1f +[ö ”ÁŒI2^t.èÄï7lRçºh)nÎò#‹©õîÈ:6Ï=Y¸rþ‰!Ö„oLÊâû§“/s?þ²²‘ç@@8ïüPmØ#’i[emýÖ(xÃ&N¢gù¾€RçyüþØDÆ| ã‰ùÖ@ËšR˜û­lFi$þEèBG#„E\@[®úóšõñ‘Š(;O(FZÕÔåDÒx"ÜRíÅᶽ¶¡¶1¯Œ7ß^àé¬TR™/JV&ÃÒ1 W†ã$m‚]‰rƒ(PTä Æ S—i¬°¥FÁµlq;{OŠ”$ùëDÔ÷€y^,ÏLeÝr9?ˆÜ,3¥Ê×U0XþŒœYè°‰>üÏC‹V]”¿¢ÁøBy"07Tñæ45ý²Š=Oì¨:þ ©Ô=ÏLìÂ1s’ŽNåÛóQcÒ@FÝ6;›æŒÁ<¦ØÇ9^’8ëK+“Åó¹Žë685ƒØ4Uâ·äc0<æRœØ áÖ«±ÙTÞë¡’1ýT™ö¬Ž”™Í²sÞ¯s¢ñÌäÞ&߶©jÛÞäT}E€¯Ë#>­|×á$ÊÜ4³m Jû©ˆ’¸!kpŽ<ËÉàÆTØâCùŠr|å‡Vg•‘ÚŠó¶vy%Ö +†°Ã‚ü!'•Bî*Ä] +žÍDe¼»é õÛQø|Š%þgdn2ÚÃÛAê&ÑаƪrCг‘@üÌ…E *n…€Á½tSŸSlClšcM¦bBmc…È€jŽ]÷®¿4{¿0r}?ø´Â¼ÙØlŽ¬h¡¶µ†×ßýpäbeÁØz†{ݶ„`ظ<5wµ>mËVžÁn½–€és#3Wár5X£åƪÖ¨òœY[à–“Èw•é‘ ½Rð$Tã¢:ªP*RÜæD JC½–<'”¯©ð²˜ˆ¤.ìÍj¹Q3ìÒñÒcÜ(Ǹ:”±ÆEœŒ _ÕéøšF@RΈŒ­ÙÙð,X®n£¬zÄ–±-fÛa¯ð ¶Uú^2¦-(tŒhSýaL٠裔ÕVŒáåÀ¼¬­G7LS~0 Õ¨w¶cà8¹ˆxëî±³?2 D‚É3‹ÊèW64!â.uÖZ’ÜÉ £ÞR0Ñ°ÛϨ»üØqó‹T"M¼YÚãN m³ý•T:|Ì6Éäº å…{J·'aßEý¦‹¦\ÊØÜSYL¤4AœŽb!‹ù²¨/–™ŠïX““<+ûÊBÙ46ýÈØÙÚ•ë€ê¨[ß +¡†‡{ãiàf*> endobj -5990 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [140.74 415.925 539.579 427.918] -/Subtype/Link/A<> ->> endobj -5991 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 404.8 119.036 413.459] -/Subtype/Link/A<> +/Parent 6208 0 R >> endobj -5992 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [439.559 374.975 539.579 387.876] -/Subtype/Link/A<> +6272 0 obj << +/D [6270 0 R /XYZ 85.039 781.388 null] >> endobj -5993 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 361.425 440.258 374.327] -/Subtype/Link/A<> +1790 0 obj << +/D [6270 0 R /XYZ 85.039 305.335 null] >> endobj -5989 0 obj << -/D [5987 0 R /XYZ 85.039 781.388 null] +6273 0 obj << +/D [6270 0 R /XYZ 85.039 262.987 null] >> endobj -5986 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F35 2976 0 R /F62 4047 0 R >> +6269 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R /F35 3036 0 R /F59 3455 0 R /F58 3380 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -5996 0 obj << -/Length 2698 -/Filter /FlateDecode ->> -stream -xÚ¥YYsÜ6~ׯ˜å>˜ªÒPo¦Ê¶7ñ:[ë(–RyHò@ ! ccžh}ú@ÌÁñÖªD Ñ@7}|Àˆ•b•Åžæ«4^˜e«Ms寞aäý•PkŲ¶xÞ>\Ýþ'+á{¹Ÿ¯žæub/ŠÃÕCù›ûîßoî¾ÿt½Ãйw½NÓÌ}÷Ëݵpï™z÷éÃLJßc/¢p¹ÃáŸ>]g¡ûÀL>ÎÃoþûö ÷BÏ¿þãáǫFÐ*G5¿\ýö‡¿*aK?^ù^˜g«=´}OÀpszzqª~}uõ³YŠÇ¢Ï:gͱ}/ˢ˖‹}/ö#c¹HX–¾ð"?\i&4Ýï¾Hw'üÄËâle-v"PóœH±-Q^(‚‰[ÉvužÀÌÝõ:ÈÜ®)Æj³¾^ ·bµsø@@»¨Â(yˆˆÃfæ5_ìß]ÃB²Gvè -–Qµø ÜÛièoëêoiú­ÝpKFh³€áv餃L—\¶ýÌsÁöŠé›¶¿ p¶ý‘Äó¶·$‘ÕÆŽ¿ î½øLcLyZ8íÑxí‚¥’<ñB?½h)‹gÙRšé[–º$ÐXêXâYKÙßoÑ9Üúxäpq’Ã=‚RvœM1 Gr·BwÅfæVˉí3÷Æ-»¶Ùò4Ê„=B×¾nš¸›®EÂØwèÖ5É*YƒGxáö¸UëaF»û×-_ -ÇG˸>maÝÂÁ8kI%§½n€‘V¤IsðŒŸØÜA³g§(¡9mT [å1}Á¶2¡Ädd.Æ‚™1ØØ:ìcŠç…ö<©I‚°Sê¨l§Y<ÑÑ"¯^ì4LÍn¬ºE·Œc/¹¿3˧džoúä²´Ù%Å÷ÈYܲC‚P"3kzœyI%…&6­ƒb;$h£ØУmw³k·@++üþäpR-~SãÇH+I—¯*ƒ°j·æÐR·”5»N$å•ckßGú`ò2‹ïú‘ÈS°Q°´ìa¢šå¥¿?—Î ¹ù:‹¼4d_i—½ÜõšPûCO«0:)'j‡&md-iÁQ–LuÎíÔa'¤rvÖ§›×5U«Pó\ðqÅôM'¿ pöò#‰çÝÜ’x1w­Ã$$$3Êr` -æ—$šöÜçSêÌ -Ä×=ñ—ÓäÀ\ŒÀƒz.„Ò!µ0ã¹Hég™Ã‡¶0Ž¶Ë”êùj<“ˆuöçsßWbs9^² ÃoÁ+â,ð‚ürâ³x茼0J,¸å#„ ãPq¢L‚JÏ4I꾡bˆêuSK£+ŽîµIi_@„~¿¤7 Æ4¾ìÍÏ©oéuÀµž?=$ ºEi€ÁÞKl‚ éÆ—IFs:{¤öò¹èK½¤8”H*Ncz*N‹Áá>íw;WDÕ¨”ôû¢ÁÉsSš&·î•PôÌq[¨Õ+=ŽØÀÏÜ_I|I5š¦´sÕ½®$kI³Uyc^ŒªÊT—LjiØN\o°S ï£Â H ì_»\Í* R1Ë NÒ*‰#¡hÐ_ؒا@…ï< £/N9¸€Tˆ1 -^bµ«' ¤Vʨ`fqBÍ"÷f)ð8§`ðe ‹ËbHݬÚ \>ñ\`Ø!Ó“>RÒiBB²:)l–rG C¶&ù[¡”–¥èZŠ´^5·Žl ”azÔ^ð2Œ²aª*6¯úy‘i€ŠFúú³Ÿ½:绢W˜L$„Xñ[Ôd‘aá‹ÚHùÐaظ2§@ܯ®ˆÄ¦wí?Ñ£yšÂµTË=QBmx /46ÜU–¹Ô ŒJxxkƒØ-Ï€Ÿ ‡ÈCkàOl? Å1µfEª²Ta"À7Û’[Óª”¹(ðT½P»èx„>@°4¶¡Y¥R¥ÜN\Ôîü8¼p’§O-H=?Ït.[GQ¦°NèÎD±Ïñ¦Ú†kŽ¾rµƒ<ÔÏ“pË[V`à)\upí®•ˆ¯‘mÎ0- Ð\rá¾FkUÙªÎqD)•Z˜*E–éºè0͈íÅ®cr-.ì0q¿åÊœ[¦lŠ–s2ÃN1˜Ò ] -Â(rMÅÿ%’”p*‚Ñ?;zD짲óF˜@ÁPǾæTËèŒf‰cGvºARF>wjªQÆK0;mk -,ЋւcÕH}y³Ò!lQc©*ÈAQÏn¹„(Â,÷²Ë€bf1xBx9Æ©Ë€„¼(‹m@þªÚ 3Âàq¸2mð®DénAõ8õ`Ç—UŸy“›bnC¤ú„Ñ;"rÕ…V@N†ßU˜ë ðmº~~c­À4„@hj<²Ù©Ã >j¥J t®Ha‰0©4e+Züó vœÉY˜Kwtŧ?­Qw;öGÓ©ƒ–Kt Ú­±G/ -?.M =¾8<´±®*Ðå7ÈyÂñøöž"§/˜ÂH1O̱8XÃZ5t~šöü^ý=5êÆð² -µÁʤæϦh-Bwj‘œx¬Qï(à…I‚?;VZ ðî(¢/tã - ÝåxoÒb¥¨õvJ–,Zµ -ßyíúŽž‹þ…ieoß7øxÕ¢æÆ‚HW7Fæ}6µ–TÆËeÆü[GKçH€ÄgÐ_ÎeÐàKe]ð”wøìè4èbOÞ¥¯ÄÀaUð[„Â…z‹‡Öõlb§e–®16v†ùÑVáŒÚè8è‹1tÉ[¤ÖB}žŽjïhžØ¯<é1F-‰ó«õZª7ÝpZžs¥VX–7 -AèçýÓ˜d†)‘ÚS£Ÿ)nô;X]ëWQâéÍ_Ç¡RAZý¢êªãýàÌ¿v¡eþ±!}/ÈÏeY¥LðýÎkr5@†,Ìϧê8¼@h]ÐäA–뇙gá©Â• bmendstream +6276 0 obj << +/Length 2746 +/Filter /FlateDecode +>> +stream +xÚÕYIsÛȾëW0ά2 4v¸Ê[^bgâh,¹&©™9@D‹D 4šÖüúy[7@R\I“â½¾~ý–¯¿nª…?µÈbÏóEš)/̲Åj{æ/ÖÐóöLÉy~c×Ëë³ó7q²P¾—ûùâú–†\—?;yqyýúãÒ ÃÐQ¹·tÓ4s.>].•sÅ­—ß}¸~÷á-Ö"hTΧKìþûÇe:×Ë_¯ßŸ½¾ž,ëF^”„¸î—³Ÿõ%¨öþÌ÷Â<[ ì{*ÏÛ³(½8 +¥^Ÿ]ýh¥p_´àY3»sʹ΃xÞ.î8έ hVÐOmTäÁŽl?Ž}çJCÕ¬aÃIê|Úá7q~\ºÊÙ·CÑÏì8ðÂU•—©QϸázSõK7H2§=¨˜;EƒßÔÑߊí®ÖÜ¿j·¨È:•Sr[{Ë7ÐÔ.ƒÔ9p½ká ÝWØÕîaP]rK¢ôÀR +þì ¿«še;Òñ§ÀÆEAÑJbä)× +Õï·d7j1ÚcÇ7Ù–rÀ°P\£ É?èÄœl°ë ÎœAw{M±¥ù%VçF_ÐS%iÎ}ò ¥ž¿ -ìF¡—„ ­Ñµíðgpr;õ®(·¸¬¸;þ²pLPOËßµ7.õº;ÝUmù<ñ£Ì÷¹õ¢©ÔSYÀÛŠiÅéüÏn]m«á¹òƒèTú®Xk;Àç­‹k¤O6$“è]põ¾–°ÈÁË(‹‹d£¯8BwwÜDÞ`gPlˆ½qnÇ -wXsgŽD m(NÞ箶ãÞ%¶üõ%·Pœæ¨Ì¡x‚Æ_üØ?`äV+ŒO,MµåAõã8GE¨R?Àl5K‡jØp4Q Í…šãtà¸ð)ù+=-°j›’­€`‡ºqïsnP\#[Óxý5ðf AE±—«ðP"/M¾—Á¥‹v®;Öt`\*š’ê]³â~ÊÍý©óbµj÷ áÙÿ·Þ,³ˆž*D„+,ù7вBUqlìØVÌXÐ’ÜA{‡§ ¢I&þ¡SL§S°¦Ó˜@Ñeσͪ’½ ì0⌆™ÑÑ'fBì£=<šHöt&8jM®ýÊ!´6‹luG!,ásB—O…#;á²I`!43|£·&˜eÖ¡ªk.ÝÐÎ5æ$ÍhÒÈjAÔH¶³a‡Êh£ë©çí_4+²Î"Ât’U!0ÓÕýƒdôo攣O"@†wX¾eA6aAø”Æ0ô|» n¡xjÜ© vK«Ë–=]êú)ϺcÞÅ«MÜŠ=`N­e2?' Pâ°,UÍR‚Bn”N¶ùvêÖ+K&O•ºZþ,ij·ÓEyÇí sÛBZÔ#ÍŒ(tV7:çž8Ý?ZŠÝü• EvÝ?8‡Ï„ +Gví>OSÙê„yÃ)·_Z>WHÂÓ©´ï"¡OÅ +ŒZ£MÖç!§¡N\Ýc`Á©üƒE÷ý7LKs±Ðµ‘³ÕmJ’lØì= +æ‘,W@ÿ"a‹ØÓ­eÈÇ·ð¯ºê‡ò ×¼øó×fx^&À?ÑÓØ Óä;éi(ôôEIA;rÃL/èÍàŠ+—ÈQM^ yEœ• †!Ún ™ÅÊOUSRý`yLâ\Ô8C7ƒ¥b3ì6z„Ý“Û—šqcŠ$;Èr[yðKS“È`@‡]ŸõTv˜3žòX¥¨Æ‰ì°‘Ø$5Hc™­É'Ö-Y€6'Šxu +Т +}ù dA?ûpgRL ó¤]2á!þi¬ «z ìv`F‚Õ˜Ø,~ùÚ%J:Cî)OmØÓËDâ&dO†L¬A׈Ҽ£ä_oÌÒš/ÍI0q&0[ÏÏ2q)}B æü§Wì0÷Ò0•ÁF‡©ò`Q4ädnÙoê¾Ghè«RKøP¢›,óéômÛҎ¦iÅé÷OE]NÛ.XH¦Zü÷r°PTW&2‰+ãŒJ¾í­µDó‘+õάƒÝ‘Ÿò¾œ%Ø@ˆ¯¸,‘N8ŠƒöÌ;‘âEAÄYßQ¤ÈäBd¼ÿÁµ6+Jk=–RÉ’·]kn^¤Éí=MÀ +µÈÃa2!œDªLŸ+fhM±ï§Ü‘Aƒh¢\Ï zûÏÀ*NÃUù‘«ä{Ã5ó@8,Ç]à¬Ûñä©Ž¯Ø–¬ÚsRÏ*'ˆ?£1ü^n6÷t‰3/…žÓò&d_GqýÜ‹%Ü8߈Ѧ™1Tš)AW,Dz pvY¬ G¬ð­ d÷Ô< `Ë$ ¹áqãˆ(ÅfÌG*0~òM›{à!àÃõyàûßÎÿq‰wÃ|Š§ÜÀ/_ãÝ š ÍàòU¬×˜Ð¦¹áâÈó|¹íã…‹Nœ¶á…¥87@ÄŸ¾Œ†~ ŠÇ6ð{v~~8¼Õ~×{m·>Ÿñ²Rr©Ó¢7Jé™0u½ØWÇÉÂݾØÞ.;Ùƒk´·þmn­(ð‚D™0,ÈPŸ—qâ—›x‡é)ób|'Iç±¹ò,Ä#”ž.øÀld„¡¡,ÞP,ÏÇuåßÎÿí¯±æËý¬:¦=a? ŸðWœV œ)Azizl·õž¼ZÒóîžÍ½;ÆçÏ>;‚­Ã$b^H¬'R3¬N½ô¾Ø˜(ã,¡Ä®©Ìù¿7è +,×usW?tÕ ˆ;¦)ºAØPÇ Þ=ÍL‚4´î?ì¶åÏÌSywÀ«—lß\Tú=r_lÌ寈Þ2 < •ÝRåªÑ0Á #“G/ßæúÑ1¹â\^¾2Ï!ÃFfâ²æµÃvÃG ¯Q4ýÿ™#øéïž=ø•Ó¼èËÄxgWô½9&‰yì×›#3Çf’Aæ©ÿäì>¡š¸PÛŒ¬a#:Ó©œó+ä“™sSL¢KwâÛãœü›%ôÿ3>–Ó³Üøl°"6{ô·ÎôÙuò¨6D”{~:5Ðýïþ¾ñ¯: àî?ôÕÉ ~â £àïð^žendstream endobj -5995 0 obj << +6275 0 obj << /Type /Page -/Contents 5996 0 R -/Resources 5994 0 R +/Contents 6276 0 R +/Resources 6274 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5960 0 R +/Parent 6282 0 R +/Annots [ 6280 0 R ] >> endobj -5997 0 obj << -/D [5995 0 R /XYZ 85.039 781.388 null] +6280 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [478.862 386.474 498.491 398.163] +/Subtype/Link/A<> >> endobj -1754 0 obj << -/D [5995 0 R /XYZ 85.039 582.296 null] +6277 0 obj << +/D [6275 0 R /XYZ 85.039 781.388 null] >> endobj -5998 0 obj << -/D [5995 0 R /XYZ 85.039 539.949 null] +1794 0 obj << +/D [6275 0 R /XYZ 85.039 761.463 null] >> endobj -1758 0 obj << -/D [5995 0 R /XYZ 85.039 389.86 null] +6278 0 obj << +/D [6275 0 R /XYZ 85.039 741.134 null] >> endobj -5999 0 obj << -/D [5995 0 R /XYZ 85.039 355.115 null] +1798 0 obj << +/D [6275 0 R /XYZ 85.039 570.447 null] >> endobj -1762 0 obj << -/D [5995 0 R /XYZ 85.039 184.428 null] +6279 0 obj << +/D [6275 0 R /XYZ 85.039 536.308 null] +>> endobj +1802 0 obj << +/D [6275 0 R /XYZ 85.039 372.205 null] >> endobj -6000 0 obj << -/D [5995 0 R /XYZ 85.039 150.288 null] +6281 0 obj << +/D [6275 0 R /XYZ 85.039 337.459 null] >> endobj -5994 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F35 2976 0 R >> +6274 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F62 4159 0 R /F59 3455 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6003 0 obj << -/Length 2684 +6285 0 obj << +/Length 2053 /Filter /FlateDecode >> stream -xÚ¥Z[“›F~Ÿ_¡Òª²š› o¶ÇÎŽ7ñ*¹¼[I°`$b -’"Ïþúœ[C Úª-W¢¾œîsÎwú\º5qàŸšDíxñd)Û‹¢ÉzwçL60óãŠ¹Ì š7«»û÷A8QŽ;ñdõÜîØ~àMVé¯ÖÛ¼^®Þ}šÍ=ϳTlÏæ‹Ed½ý¼œ)ë‰G—Ÿ?®?þˆ=•õy‰Óÿú4‹Ü½[5’62€T1Šùçݯ¿;“TúpçØ^MÎÐvlÓ»;Ó|OúÅÝÓÝ/ÍV<çOxU*ÙAä]â‚XÇŸ`ùªV@‹8¶Ê,›Í••rïXÍæ¾ãXËJ]ÎÜȪǧuïƒ#=×Юvر-t2n¯‹<+qÍñÀ”¿9“Û ô}«>•¼o³Û§¸}þN’ˆµˆ¸Íê 6TL¥%Þ&H¨©if›¡}¬¹B,cR~=sÊš”ë ÉJ{ÞÂÚ›#v"+Y¯±0)‹uÉKhnx6­JVWY ”,¬Gl?óF ܪsÞ!«yucžNxw«Êy8»a"ÍŠW¼ê…èNÌÍ° ò®xM‘Éb8îO=8¤¸gÜÚÍ]ë”â«ŒËüº*[`ëãõ¢ßåC¯î÷`ª„öuÞ`8gC -tI -­¦z®pxGÃÄÅ¡¡+vÇéS 1˜2Ó Ð,žƒ¬ÈÜùןó¥å•¨ëBï|&Pëobg²€#q0¬OÈ –#^¼ðh›U§£Ä›WŽãp3Í$/Ó+8|ôHMÄÚؤâðŠ'Ø'³nÌñ|ß^x‹É‰í""… -œ¨7BñÉšzn_~{¨ý^× ÁY®G–¤ ÖóôÝô:›ì¾¹ïª(eGÔ.ÔêF@¡W¦»*cDî0ÚÐÍB 1saVÙ1ž’&܆áÂvb·x”oƒ’œÉ p¬×):™Çh† ˆD)7ÞRúyâÎr:yì¡Fp¸¿²úÀcÏÖÜù’—)õÏHH¡õ¶ÀYyä±ÍC0ùb\ñ†d0Í„ž H(ÒûMÆ!´¨%Jê+þ…Ÿ$–Õ¾ª’ý Zûc^•Ü>cÐN¼@G¸ÓAÇo#ܾNu ‹x(²‚êC-X‚2óŠ(€me·/x KÚIÏ €—‘á"ßQè”l­tFôCŒ -ÈcƒïVõÌÃÄ =;)ùF#QHJd¾¬duRð8‚ò©ç÷ÉCDÊdÇmMÙk³Õ}fºçEä›æ”‰0šG{j·lw¸Î$”`”uÿ”ìP¢¯3‰üREäM${…£wœf¤ëËc‚¹1FSj”ŒÐMÉYjŽsT¦6EeœÁÊm¾Íx·6÷P+$áÌ€õ‚N<¹üV(g”‚äÛȼ×Ùƒ§Óy8ºhp.Áˆ¿M:[xÖbù0噯íŽyø¤”¥(Cä[çº:f<™ðÏtù¨~šÎuÂk3¬6¥»ÀÓÌä¨Y]é|DÒ=3Cu–Ü2=ÖíeÅy‹=)¨hdSb12pN(°CFûI­ë‰i†#Lodj“›&6w3Ôt8Vur€’kjdÏc²¡ÒÑÖ⹦Y¼÷3ÀµÆrÖS¾>Ô„&F+hSÀ‚)F]°F•gdÐ!ñ’’;¥`áŠi{ÞcÅÒ=œRÀpЇ.ô¹Æ:\)‡&„LÖÇÕ½ûÏû/û*ßË(…¯r3HÚ>HE1I…؆â PrGͦØW¶*\zFiŠ*òη(ÚÁï–jãþŒ÷(Ãù|¶×§ý¡)x¥fnp™™>#sú?F›Èúšôyç4”‹öæ¿Ó¶äJHÍo³ ´šÃ@ÁíñØž±Jç ÷pÕŒŒd§׎T L‘Æe¢¹Hˆ*²ãP“èÒ’94…ä‚4þ~ÿ3ü¾“â’j¾\»­x¨hN¢úÖ]cæò»9%ub”’Qÿ0êýØ·ýñTß’Pª÷•©™£lßñô6¨dE—™rB(·¢1nš¤ËîHåÚžrMvÚã)#bã\çÇLJÎR.ö~šo³$¯@J4o¡ÆahiFp¢›@Œ0l‘èpì‡ÂàØÄRŠ xnŠ‚GÀÿR‰4äD{:ÝärrIäN¤ÃÚ‹n¤ˆÑ³“..èä•×A×¼È _.ÄB9PòJd+û¶Umçòý/KÊ¡*Õ÷Òæ¸ÑZš£ ÑM£0lÖáØo4ƒ#¡–ø&„Æe»pY«pq×·•¡I{MEóíu G"½õÅe³Ü›$7q1‡áÕ¼{ÖڶƬÁ¸qZšãÑMãŒ0lÓáØoƒ£ö¨=äÊÿëêı•!ZWuSE®Û*d+È|î jšh1Gaµ'`î9¶Ò‹·8×_@ùTrƒ][;.Šýèâ}g¸NƒÛæxÚs—ê8_¡¨¶…Å목Íó2çfº¼ìì·“òE¼žËsžŸRŠÂó·?$izhvžòž i>pÇÁki_"ÜصCÏ%Q+vI‡Æ#d7C±ÓO'@zuÒ@+9·R_Çß{¸1z~#Óÿ`Œ½ö­æÆ^=ïwŽCL@òi§þÌ̼Æ%øÖN÷Ö"ë©~ãˆZ\ÙîgA£qG0’†BW=7ØãÏŒ¡Õ ]<‘4ÉDÝJ$c ›DÒåØ›HLŽKª‡Ì§(Y“]6¤µØþºÜ ÑZˆnj=°պñ_kƒãçƒY`•ãÚNd{þø‡?ƒfDm!º©öÃVíÇ~µ ŽèM?> (ª"e»ã‡º%VShni9­Q²Ã®WGƒÝ*ßIœÓÞ¼7NxûÙ¤O÷À·Õ¨nÐŒh/D7ÕaØêßáØ€ÁÑÌ\ñí¿mHDxC²Â÷¦`üúbÐŒÀ D7aaØÂÐá؃ÁÑ„ŒâËBûz©¯rNÖÕ>φîtqLeÄ&-É0$Bs ‘n v½xì$§}å/‹y¹1ŠRȵ»DÈp¥Fe¯Ùè{YàÀ}‡ª2)èËöÀŸ¸ Þx~hI†š[@pk€ê°ëÊ`gž›muÐ7Ý»W!WõûaÆo¾Tk k~:Ãb>Õχæ)}-+/Kž×Ö¡gÃxÄpqsã>Hà?¾Ùü_óÑÞ’=;òâÏ™®k»JË‚°ºÑ•õ߆\ ü7ô¹ƒendstream +xÚÕY[oÛF~ׯ°¥°Ñx®$Ç/‹lÚ´ÎCëE”DIL%Q%©¸ù÷{ÎœŠ”h7@ +Ô†kîsîç›C1æð'Æ©a\Ùq’ +¦Òt¼Øøx 3ß„_ÁÇšñØàÔg£«×& Î,·ãÙÊ-™-ßG¯~xy;ûîídª”Š„e“i’¤Ñ«w·ÝÑèíÛ›g7?~= ƒ"zw‹Ó?½¤*šM>ÌÞŒ¾›u®j¦c…÷þ1zÿ—@Ú›gʦã{hs&¬ïFÚ(f´òýíènô¿öšÓcÚ5ÀÝ4¬˜*ÎÒT·l +3Àæ/HjyœÀ®8Zd{jTy¶¤Ön2QYW9$Q6ŸLe[ZÐlüD7Ç•«0ûŠšæånçŒí³¦(ý]®vÖ.r€ÉlíGW@Èôêu,;œ¨4a\¤žŸÅñPí"ZÖ»‰’ÑœvôxŸ†-S’²nã¯Üðû ³@27¤b$• ÄŠhû™^xÆÿû‰´QC ï‹Æm•Ñ+œêšKgÔ8ÚdÛm8i}A{3\°¤ÅåWø ¸ðýªÊá²”.SÑ + ±ºÝ`šþ"Áƒ Oк4C%€m9ìS©YÛÖj$ féZ øƒÐxü›ãjNÅIt@mÝ(¸d©ÆÞ_Z¾bV›A»÷3Óµ-×HF½.¼€‘¦»Ï{’úŸç”MY’ÆÀ5SÒ< W*ìã~pªÍI¶½™ rœ'øvÑäΫjZza'À„·:ï8ˆ®á,Yuo©fŠkOÃì%O˜ý2Ék? y7Óò¯†øGÉ_zš„Ôº&º¯ã%ÿ„6œWÁœƒ;/[µÒßhÝóë ¥IP¼’0Àñ4Òšˆ™Šu‡h-ˆþ•‹äütôñvv~(NuÏ4„[ÔzA^š{†÷Ù.¿ä"a2Qî—[û´˜xG-AxGÖý(éÓââM9'n¾}VtÏŠÝ™C:FåÒÈúY™eà§MçØqì`V#\à`…7»g¥­Í‰wÈ2ƒÎçòU'—(ƒ’ÅsRàKb`î²ê¶Ø¯;ˆÂúÎÃ9„=pÈ^ý2„Vå¡Á¡rŸm•à^}ƒm0üÈDF÷=2×QmHÄ ÂfW¯MÚ9%I R„wŠñò"x‚ò$öK^`¾%xQì½Äó]м<ß$ð çƒ/Ò,°pÝTÃ8½ýþ®XÕ#$Ä*o@—l*Ëd¯æ>>#_Çú„•ÎU1³Jø=Πf)—}ñe¤‘XOéI†á31(b躵(7UîwvÑ=w}²‚7f«Žíº¸©x†/Œ¸¡¦à0VL¥úŽ£\òi,˜kÇL”§ª %kž¸X^¹B +tnné—ÊH½ë‡Rž€·uʃrºþÉ(I@“<éA +¸dù˜Z-N€ö&óÜz‡àÿuëò!ï0}¶ïfg^ ZÚ 5œÉEëÖà”6Q›ó!›‹˜yk§~l.e&kNµ+8Û‰~½ÈÛòÚÔSîðq_èD£8e‰ìj_'ð–¢²J°`¼÷¤è”ûœ§×Šö}Cñ©p"sCXF¢j¼Ñ«”¥RôóFéA5½Z„Ý© r€D0)‚tcô€ ÀÓm°vYK K 2“‚ “‡Š‚ù…EAã‹‚·…x¹FQÍ·9UæîµM‰S˜'&¡€÷֕ʯ-ËýÜè÷ vQõ÷ +\¨K9•9Œ_5X­ž +r¡—Uy‹í«¼_ïUýB½øèË&ëü¹Å“ùî?CEÙ'XÌraJZÌ¢hëÒÊn1hIsá‹Š5¼\p¥«¨W®r¾ÆÒ9®L¾ûZ`} +ßEVûÝø&Á‘6áب E)wŠ­0^P\óA·®2ôðí±#˜ß¬¥4#-'5”3X5X(Ò/ò| ‚¬«<Û …éT¹’òß`tQ)ÔÕ4Ó¢¡ýÑ¥˜ÄtßÎ;oA°Vùe>@ùº“rõ¨Ò/B¤öÓ`)jÙ.0yÂV]®š{ЛñuÅ3Nµd:IZ~zlãµûh£uén[S Uï¹´ý@»qÑý¸ÞÐÿ2—ÑÛ›[¯{ê»w1ú6v…ÜïC'§Æaã„]‹lK#mØÈ)ä×¾r\¸Táñà +óç–>!A#,wÁèS+ÛÓM²gù¾–BŸ‹ÜÆOExbæ[®#|õúº‘*aïhZ¬" Ò«tÜ'øDî¿òendstream endobj -6002 0 obj << +6284 0 obj << /Type /Page -/Contents 6003 0 R -/Resources 6001 0 R +/Contents 6285 0 R +/Resources 6283 0 R /MediaBox [0 0 595.276 841.89] -/Parent 5960 0 R -/Annots [ 6005 0 R ] +/Parent 6282 0 R >> endobj -6005 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [343.74 706.133 512.885 719.034] -/Subtype/Link/A<> ->> endobj -6004 0 obj << -/D [6002 0 R /XYZ 85.039 781.388 null] +6286 0 obj << +/D [6284 0 R /XYZ 85.039 781.388 null] >> endobj -1766 0 obj << -/D [6002 0 R /XYZ 85.039 691.864 null] +1806 0 obj << +/D [6284 0 R /XYZ 85.039 718.962 null] >> endobj -6006 0 obj << -/D [6002 0 R /XYZ 85.039 657.724 null] +6287 0 obj << +/D [6284 0 R /XYZ 85.039 684.823 null] >> endobj -1770 0 obj << -/D [6002 0 R /XYZ 85.039 351.546 null] +1810 0 obj << +/D [6284 0 R /XYZ 85.039 196.83 null] >> endobj -6007 0 obj << -/D [6002 0 R /XYZ 85.039 317.406 null] +6288 0 obj << +/D [6284 0 R /XYZ 85.039 162.387 null] >> endobj -6001 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F41 2994 0 R >> +6283 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F20 3021 0 R /F35 3036 0 R /F41 3054 0 R /F58 3380 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6010 0 obj << -/Length 2644 +6291 0 obj << +/Length 2947 /Filter /FlateDecode >> stream -xÚÍkoÛFò»… ~(…Z wùö—Cš4­ 4ç‹]܇\p %Jb#‘ -IÅñ¿¿y-¹’(hQàÜÇìÎì¼gd5ñàŸš$¡ëùé$N”ë'Éd±»ò&kØùùJ Ä\@æÌW¯Þ…ÑDyn꥓‡UOè¡?yX~tÞüòúî᧳¹ïûŽJÝÙ<ŽçÍïw3åÜóê݇Û÷·ïÆY‹Êùý·ÿùa–øÎݾï·_ÿöãkžù®7ûôðëÕO¥ @UŠd~¹úøÉ›,áI¿^y®Ÿ&“'{®‚íÝÐé†/óíÕýÕ¿º«x/˜ð©!®„~↉ΰ%ôÜÐ ˆ-¿äu>›kxBÑð7+ù›kkxc¶˜Í•ÓòZµÂ¯ïìf:qžy XxÏ«MŽ xè+îóì{˜ÒÍ¡³ÇëÖù)£tê¹qÒ“õ"«|WÇÃŒš›»æÖeç|Ðiàz‘>bĶZó{þã©Ý -[ÚJ؃kÛCÓÖYk¶6°&ãUUﲶã r–Ì“¢\lK†ëÛ|×àüyñêo7×^êzdønäGD]Q®ª6_ü÷ö^{:žÍC:ŸuË£ÀS<ø¨õ«×ûú•ö<ÿFy7:¹ |ÞúÁSž÷‰Ç-;ßí²úsÞåZv³2ÆU>Òœ+PÀðo Dÿ)J‚ôo Åÿÿ!%ø+¤¼-ÖÅoYÓæuª”ÇG«¦1¤èaR|ÿF닪rÓª(³r‘Ï—ùþ˜p;>kó‘©y¢Æ1Ñö°A/(ßyB‘ÉäêÚ¹}Ëß)plz c0ôuQÎtê´Æˆ¦*¶@s#öŸ{–Ø”L"´(ÿ¯z¾kn]6äYRð?ªÃˆf˜2µâ9q| ×òÐxHËïÖNƼ‰‚ù&3 -*<$üºÄXBŘk¸q ô´ÊBgQ틼áqV.yð÷Û­å®üˆ] îN¿Ûáj†d~î<|Kü_#Ù~l‚“ÄÇV_íp9·w|g¶D§XçÄ!ÃVlˆÏÓ0è*GÜ,/ ißfÊÜOÚƒwn2!ÔèÜ.@§4 G@ûbÒ>?L{Šº1L:!áîãË ¦€ N“E)gÊ‹+| ½&ôFøføÄ%¼‘Þçáû`AExŽ†d4×¾d -VÝeUi^ïu”&d’KºÂ½"gnž?ž% Z…ö‡ ?©åœ† _|I!tÁb˜DÒÐàþ¼ rû©{! -áÁž§Fó: †ÌKîrSŒ>]~Ç4Ç#Hå@É‘™¨2¡çÜÍ|EÒò·¢7÷¤Gn¡SVÀ4ÔIð©Í%Zµïú㔈‹‰V*7o€tþµ8k™·À¼§(ó'cÀÕªæocÔ¾ªÛEEVÇV&ÒËê\ıÉk‘×Sù/äÆú LU›Y?•†4äžD ›i0Ê †X(‹ʃ·{~wòžŸâS^ä&a2ŠÐÀœaÂhR4äDUæ“2Ûå¢Ïë|…’0Y+K(ôžÈq•ëí3ÃBŠ¸6çØé`.7CßAC2Ĭ1èV¼j›·13©D½äXh䈮$+¶r×¼–· (R—„å®NÃqaõ0# …5‚°Ö ÆaaY‹’_[6eۂܶÑgJv!â ,ªß•…±YáÁºÂ|‚<Ä7Uþ‘¿§³uuXƒKÐAÌÑAâL?ÜÞMI•hJ:ž2ÊҚȱý†„ЋlË+Í&çðßÈü@ÜY{Vª—žy³‹"äñ¾Þ2ƒi;!† -@W¾â*‹ÀqDâ‚:ókÅCóe‹ö.ãÏÙŽO -{5D“}%ŽCr»aÐ;í¼‹­°]$SÁñŠ!!½ö½”Š§—²{ ƒžNÉ:jIPW!Åz`„íóìäõu4$ˆsfydB3Îi( @ôç¨ÑöÃM%A‹ #Mç1©n^Ll2P^+®Í„¸v“Iö!F:ìÚ xÓÃÆ\›sÙµ —\ÛÂεbtm6Æ ù%„óÕÂ1ZM³×ÇAgl0n2T Ì ÓðtwÍAz- OÑ]”•«0ÿVpúV´¦S;­@¬ ésÎË CÈÖì!,ú-ªÉ_àõ›|@ÛÎô>£ß,++!Á;÷{£à¼aëÊ<Ù~&™í’@>˜zz\Iz˜% •da¯$'‡•ÄÂhx²cWYÎ$/ º¬»Î3É?ªC{bÌ Ãɺλb“úlۥ锗ÔGgÚ—8Ë9‰b*2"‡J½>© êcË^ê.VÛ(;%—N7ñÆ“k 沸 ÐKâC؉ëã ¸lŒ¼Æy¶™õAn-={ea_í¤)~ƒ>”ŠÀcIcò<èí·Á5cx•Š›«pk¥¯ãbÌp·2"-B|y)”táÆv¨]¡áø¹e÷dwñyC‚¢Âh\Þ=̈¼èEy ìå}‚qXÞFlÈÄ¡%oœÙ£$¸¼ÌËÅc9ÇM®ã#‹Œn âˆ$nAc4µ‹o(°;OÉ_ ª#e£ãKî ™¦LS~Ïiî­óÖº;ÿ’•œ‚­[ÞÉÉÁ5œ‹™½w;$]ðMF'É88N'ÙÅHx dƒeô¶Ã‡Um&%éú|ß$æ.hòÅÞ‚Ö±«ÇC@r±³ AӒळIgá¶Ô>à$'Š·ù×|[íwyÙ^ŠN*MÝpœ²äb/AE±{Êj£êØãmbÕ§±2úÕ˜ßm¬y6õ>Ï9VÔTb²(S‡ö]³0Â4{”B¨ìЉæ>’ŽRÓx@|¦€Â1çà¨Z²Pì¨þ=ª¯•è7 åx¨\RšdôI?a³ÂœkèÊ„´£_ó”«o.IDãï?ãõ²sÙ! —ÒÂÎ!btH6Fé '"Oª4¤V‘ ÷žŒõ`îˆ ëŠ¿âëef4(H¶8é‡?P£¾ÏK¡¢™24ק¬cBC›m?ó…WÔ9ÿpˆ>ìY :Trd_ÉÔ‡5Ò0¢["ÚÀ/P¦ìÔt‰Ó¾ ‰“3¦ðªé×À°y.<’ÞY,Ù0.e‹ömyñ¨ 4}XJVöº ËKÞ`ïš¼ŸC#Wò‡kMœ·'8CCÅY)y®ô}u¶í’B“&fÒãm«½4©J«38PñA®2Ò^ŠR7‰ÆïA.‹À¼d+#Ø:S9A7h):«è:.l»PŒËΆ¶¦Å·«êü¨]ÛýðP¯¼Qendstream +xÚåZKwÓHÞçWx²’ç`EïGfÅÐ CŸ: a,ʲb‹È’dBþýÜW•J¶‹ÞÐgN®Ç­×}~÷*þƒ?‘Å®æ‹4óÝ0ËÅþÂ[laæÕ…/Þ"r½$Æ©ß^\½Œ“…ï¹¹—/nïˆävóÁyñŸç7·¿¾]®Â0tüÜ]®Ò4s^¼¿YúÎ;½yûúÍíë7¯°Á ï¼¿Áé?Þ.³Ð¹]~ºýíâ×[ëØUäFIˆç~¹øðÉ[làj¿]xn˜g‹h{®Ÿç‹ýE‡n…Ò¯/Þ]üivá¹hÁ«Î¼n‰¤Ð=7Ë"óL?>óÌÛÝ2Ȝð\qîTwü;îʾ”!œJz±‡Lku×ËoÕš¸µøaÝ(Ûê+ŽšÃ¥ê”:-IAßv¨u[°î~AaÁ3ôzÙ©ÞÙºVà–µ6‡þ~I—öyÒxÓòïpè:¾M?Š*hF@{Û·‡NëËô ý¹ôàdxúúÜÅ°ów31¨Ÿ'‰½ØáPYiú)¸±5«H¤°LñÅ[l÷IçÕ¤’Á ;’ 2ú<ˆÐö’#¨½ô5x²ÓªqÖbE¼£ü¦ÖXì 7Z+ƒÁÝv< y1Ck†]äºû>íãòâäç2‚?%n †I5¿Ò€Þ1”¯Kû¶Ÿ˜k¯ñ ™°Ÿ–EÎß *Þ>®Ù󚔺Ԝ©ÎŒ1AìÎJ×ò[+½ðV+VÕ|Á_YY³’ í0š³+Ù@Çži˜›¦B§Á±£)Êï'NÄûìÿ…÷C»·3¥Ñ”múÉÙ µµ0•¢*Ø4éy÷¨L×UÅÓŒõ37Nü§Nî2ø1ø&rÃ(9Æ71B›(G˜ ¶¶©øE ¯Ú†\j’8ÿUâð+ö³r£s˜&V?„ÔAO9En…“$T[J&!‡‡]½Œsk#ßó]Ï‹e;Èò‰dv¼6ÎS-mÄ +¿ð–Š½>Å6Ž•'M7 È´ÕÈ}.ëÅT`ƒ¯(2…IíÃå÷_#0*âz 6×—ƒ~¡ÞÊ¡$NÅ ÆjI$º‰qcåƒÌ`±>Гà%Š—R‘Ùðè/õÈm²Ø¤("ÚXö  4o-šò›7>o¬ÚF2@H¤"GÕMaz¼¦$1g,oÄ‘Œ²¯RÃky*Í`&†¿&³ÆT#%´È XƲ7‰$ÈЗg(Ï™|È#Oq&µá=Šà(ëÕp!%4*OÝ%T­ÇCTõ)ð©Œ&› )F€Éˆ®g 8'^Zɤ©< â* ¬$oc2]†Ã¥¦ò +âöå6$gÅ“«O)DeUªp¯lžÄÄŒcA[:! oʯU!ý÷o__2UXedxÍ:Îu2‡‰NÖÝæúê +D`bmq_ŽV¿ž:U×MÝ8Z½Nõ ÿ²¾¾£—#l±ê-A}J÷0¬yÑ‘áä)ăPî(õù©N#(¡m ˜\¬d…Žß¸®8t߀Äã«—ºÄ}ÈhæÚ9œñÛAMßøíñœç®×N®yª/Ã欦aRï§9†;¹~Q6·¢–’6i³Äö°«:&ÐÉ…ùnårïvW>¿ ºy̽0yèbÉÞ6Ü룩›ÃˆÚ˜ZNÛðÐi<¹OÚ‡ÝBèÅÎï&; ôµs2ö"nÛoÑ^X<xÍ Y,rÀGÏRêKôñ8ãñbò}Eå§J™äÌCT.y&¿µå_Â> endobj -6011 0 obj << -/D [6009 0 R /XYZ 85.039 781.388 null] +6292 0 obj << +/D [6290 0 R /XYZ 85.039 781.388 null] >> endobj -1774 0 obj << -/D [6009 0 R /XYZ 85.039 551.001 null] +1814 0 obj << +/D [6290 0 R /XYZ 85.039 570.527 null] >> endobj -6012 0 obj << -/D [6009 0 R /XYZ 85.039 516.255 null] +6293 0 obj << +/D [6290 0 R /XYZ 85.039 535.782 null] >> endobj -1778 0 obj << -/D [6009 0 R /XYZ 85.039 227.22 null] +1818 0 obj << +/D [6290 0 R /XYZ 85.039 340.417 null] >> endobj -6013 0 obj << -/D [6009 0 R /XYZ 85.039 192.475 null] +6294 0 obj << +/D [6290 0 R /XYZ 85.039 300.254 null] >> endobj -6008 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R >> +6289 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F41 3054 0 R /F20 3021 0 R /F59 3455 0 R /F58 3380 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6016 0 obj << -/Length 2856 -/Filter /FlateDecode ->> -stream -xÚµYYsÛÈ~ׯ`ø²`JqzÓzmGÎÚVdºò°Ù‡!‘S‚%1¿>}Í<$W*•Úò3Ó3Óç×Ý#äÁþ(‹]/ÌGiæ»a––Þh+/|¡˜ -Ét@óëübö!NF¾çæ^>šß÷çÄn‡£yñ‡óîo×·ó÷w“i†ŽŸ»“išfλï·ßùƳ·w7_æ7_>â(‚Ißù~‹Ë_ï&YèÌ™èæK¿|ýù×k…®7ùsþéâýÜrjy®rdóÇÅz£Dútá¹ažžáÛs}X~¼>Ý8 -e\]|»ø‡=Š×¢ï:§C1 =7Ë¢·5{nìEVs‘?Ðœïùnä…#C„ªû—ç§ÇÒù^âfq6vr¡¡9¹Ñ‡7úúÁÁÛ´[/Ô~ª=+¾[—MÉÚ~Ö.ð`1™©#+ín +[˜Êœéxó= èc×–MË´]ÍSzówÉå¸Kˆ±Z.'SàfË› œÛµc¦Ò4CTªxšÄ‰£6Ëò5?BPlò¶ezš7,#D?µÌö–9ºñ¼e7þÿ,ÓÖ¨g!¯»5›Ãwd½Ã‹y{%TÄÌnSà0>t+´õV/_3ÈîùùÛ†èiH-¬únÇpI °“ˆýðÄ\`&\‰cÏù -ì£0È{’:×Ë%°ÙéÍ -Ç `IN„ðTXû -¯IšÞæu@sjBsN”¸1qz‹*ÓìÇ×øVÕþߢfß¹d½n'Aîìÿ^wê’õ‰¦kdZ^W•¬ü^¯îÊ¡UÝ×D R7"JOcÕ¹a” D‰óÌÓ̪=FG¹s2…fÏò)8ëªXáŸUÇBjùÍÙoñ8 yUÝq®‘¦Ä#ðQËq#D¯À¹;ãâòyAà:Àd´ì úS׋Çñ`Gù²$¹Óõ¦•ëYG êdØÑÅ[Fº“ŒŸ:óµ&¦mç)ùÝòoS¶ìhQp½pG)8bN‡ˆËMA°â¹ú^Ø…IÃ1¨NÉÂ@žFÇ‹òI£ƒ†)ºbì¡ „iŠC¿Fɸ>.ŒÂŸPÌ¥I³@öý7c¡ úè¬W€ª*Ž<àj6Cb0 ’ ³°–ºÁâ#N/6hJýýxM‚5˜$GnA„Ùê -¾`õÔÚ!–_Í.Mi· œÃÊŽäĤ úñÍ)a¼œ³Çx¹ÛBÑâåxöa’E"d:Š®2Ês˜f®}‡Áäî (PÏ×B¢PhA,>|ô~q 6²†%*]m°5"gÚ e½ù…ÓÒ´ä»[^z6©ëœx‡.ÏÌñÜ8sÈCÕ¾…yŠ9 Ì“uSðÌ-r¨¸‚c°%rd¿˜Ö0FäèŸ6~Т5;R)‡*À¶ß5AÈîÅf–ÜÁ2É¥bb,'`Ëë–©[“+åªC<ÁÃdX§T•Vœ¹xvmÂü$¶¨1HB‡êQepg(¿Ù%Æó¢¤r4‰(‡VÜ0­ÉIøýy­ùÛ¥IAzÛñrÑôþÑÕl«ri;€¾kHï#V k­€’¤:9‡b@dhE¾gÔ")úO~³ԙ€#/åò0ˆ¹D¯ˆ§Ze‹w¡"VµÍ¸)a;ÌS©ÛÄõ_˜'ôajÀT¥­G!ZXqƒx`éVnª±÷ÎÊ-N±ÎïKlyu xЦ2÷ž‘Ÿ-²ÖKL÷aœ±‹Äê_¸ˆÙu%O(^_ع!ìxiY?²cQlW$žœJQ x+¡o;µ’u£ -"‘¹þf)Mv¶º!ú/I-çjŒQ²?õm§ÒŽ7äÌ%õs{Ô–—È­g -Т‰qœb$Cª±UuGqy,§˜dÞÙö&Ÿñ¨zW<|°õÏOPMÖ„ -âĘÌÁ‚ª‘©©Ú¤*¢V·-p£ÚnÐìœýA£kn”½+ßÀcÉ£Àw†@ÅU.Ü7Ø¿"…µN+‹M‰oÓ,¶¬øєӃZ¸å#¨ Ç[kSÝL\ôŽ‡pb6Þ†/\ 72Ë ÄÉ£F¹íÌca|+©tÁ`M4jgN.m»/íwßWHY«U×וD,ÈAFùj>>³÷,ipšviuxû›< ôµó¤ ®8on²‚»¸IÈOÅ|ÿA#’Bu­’Gº-ÏŸ6…‹$ÓmÝrЂbÀúra|&ÑOÏÜ8ç ˆÒƒ0ßšwð¤v§luÖÚˆ–p6(³&±È Çïëñ(;ŒKFv*ßmá‡PÒ™£åÖAnE'âú¶½ßQæÜ Ás)‰JŽ¢V—t÷Jõ=[áâ÷ç›Ïï1óÃŽ‰&ÌGT4»KØgPx·ÝËú¢¥åƒ-ã¹Ó—%Ñ\Å,q£Š_XÌÑÇZõÏV¥ñ“||ªíQ §qÓEa@½# þIÞ]bCËsÏkMõFvès ƒó~]=娬`BraKêôøÝc&%:ö™Ü6%4˜X1ÅÉQ•J£B·Éc' -Pÿ§ö¹d³*@´¼„Τðž \qö¨K÷Èàìï‡Ï¨ÛJq×힩ץT†ÒÞ)rж±ƒ*@pÍ{/õ)BVÔúÚ†·Ùª:§Œ—/šž3ËKlzÄ;l ‡T¡Wªá&N,›£ç 7g`\çÂh 2Ý>Je’C¿{®†ñÑœçÄæž–›zgÛäЪ{øj*@©;ª¦0‚&VÉÃô*oŸfÍCøZõ‘}bšÉß-gƒPD»Òí¯Ø64ý³´{6Þ¢äâ®* Ð5žóØMƒìY‡¸}×i;gA½QÏúžüNÏ…îÏòíüo.8NCYÒa–Ck$cæÀÙ6ƒ>Š‹ùƒ!PP;F Ú’º‰pðGïìT9<™¿weœxpŸÃ*ç©ŽÃbûÒ¼µ—{þ²`ÂñCýº¡¿—ðKT`J†;Œ†ž£øö¨¥>zæULcn.m9JŽtE®†Òc%” -MÃ_ãé»Ìà(‡y"Š 6çJ -J|Ñð/0صå=2†Tœ -àÃá>õJyx˜eäΛ{¦Ú³­…A*­}#‰I>Ìþ݉Wø&jàEðhfà/H߃ôK/;›)¡wôÝ2 šyÛP(Ò;QÁoŒþñƒ×× -[ÉÃMÇ”×XëÑ“Ã ±q#”/BpÔæKWbEÌ%3ÕÈMŒÁ Nàë4†°mÇoE¸W]½òîznpö/ðÏýŸþ|kÿvAŸ…¯ü¥&7ð /(GåÇüBvrã,> +stream +xÚ½Z[s›H~÷¯píš2- ¹4©š‡l6™uj’ñÆNínyò€$d1ƒ@dÇÿ~Ï­IØÎÞ¦\e /§OŸ>ç;—–îÁŸn"åéô<1¾ÒÆœ/·gÞùôütæËïû[O…ûÂsž5±;׎pµ§Œ ûmúÑÄ6o6E;sã9%p^T9ìà‘8y}¾³‡žl•Ë8Á5ö¦NWós“U+i‘!ñ«ç‡HS>i0<—û4Ýz›uÅòÚSÏ©«¥Œ,:~npYY´Ý/—8%§‰íY*ËG^•zêjçÿåM— CD‹Y…ÓÀ#ðQ8)í½Û{±q>\~x‹o1ìH<Šp(ˆI.‰•Ç"¾l·+‹%l£®æ÷ÕJÁîZwW·]»lŠ]ÇÓï'© +u"óA­Â °§'{i6÷=(Ï’?ªºãÓÎò ³+ÞǺnxÀûzAG¸A©ØÓrÈšÏþ¾¨àqyÚYcS½ÅÐù;©Æ +[§:G2Ì:þÈš\^ö]í +¦¬&¤ø‘JQOÄY/»¼sۮɳí”uªthåxrô@BÀp_–’è²nV´‰;ƒ1©ÏbˆˆÄrˆ0«;T3´i­¬Ç+ƒyy©/ Ïón9ÇSŸo‹m®ºÇ]ÞNqëå; È€ %”Ù’„£˜1?ñUpP ¬bŠÈâÂ4vPKÂN X±êúd¶Ø:èŽO¶w‡6Òd ±Aœ–aߊÃ(ÿV j”9ˆ/Ò† ²ÚU<ª±ËÜe"@Qè+:áWC2]ÞŒû·d°#±í–wê¦:r^£#\4¦ù€LÔÍï³(­ª÷Âx`"^`B !±ÓÝ>Cz :-|À•kB +™º°ºˆ3"@¯ÁØúNO=šèß=öDÅ‘”“YwMÁP ºE`ªeÉÆFÞ¾þCQ–ÊíHÒ%‰šÎæ h“IÁx ¡·xŸ£íp\Sà€ÎŽ&íëÁ >ÈÂÕÒB> ͳ#Îx¢Àk÷2 +þ“a@^È¡¯›8úCŠ¸ûSÆšL€­Ôckrùëvþ””d­‘e1îêÀ…Û£¦h’]¯øÖðäxh‡Eƒ®f,Ýë~7Ô?r|“ØÖÃ)~,èXr#¢C€Ù|e DI@¬¹À6Ýû*2vœD \äY4LånÃì þ¥h:r䥠pz ŒO ÚɈ¡Åò6¡Ü!DQZ‹n¯r6gzW‡ZÐß~õuèþ öå£ÃK"Ž`2HòCh–= ¦CGߎí½ÉâǾÍ×ÈŽ"÷†/6 ƒ×âOÞ>·ŠÛ +ààš—kõÈG-<¢fg<‹A\b¨ÌöࡇW"㔽ÝÁ ÈÆúÃðôÀMW®åÐ÷ ñ‰IãôÒ ûðØ©Ÿœìýñ+&u¨ÐÐgâýë¦cJ¯1}ƒ½—ÔqÉÍ,–o¢©ÈMÃŽÜ0rã¡Æù +…V‘˜‚k&ks`†O€.<­ƒ¸ÛùBï+öH·/"ͳ¾Ò:ª‘¯A†Ô(Kq½(Ú zÑ1Sg…‰À„þªhè’6OÛ@±š8ñH…‘—·¨uljfä©"Œ’T¤¿#ßÔrNg›Òó|yõvüó1§"Oæþ_—‡ÜïN‚Ï#>B ùZúða­Ïêñ-ê„u¢¤oUþEL$Iâ§L$Æ|“=8â^})¯…±ê€¡L”²Ë¹%›È³|ßW& +¬ÞœèŒ Û6ºçå;dêø YqzÛWWÌ¤Êœè „Êæ{Ïé¹µã—Ö&}ÙI*x`7 +tðp°.ž©´QIRa<ð°aˆ¢Šw9ÂÌd”Ñйӣµ±ç‡%+ÓAØn^Éæïø±Ëú˜‰R„V&ĵ4%ØÝÏ&bà +ûL3ˆ´Óä”öÕº·<ˆrt|ÙÛ@«ÆFá‘PaQ<á†Ä"dª\Æõ-”ÚETVä6ší¸]shd+yØÐG¹ôµb‡†KÜU<Ï>i#Y!*$¡SÏ?/¬+£2 +ø²“ªÖ¨‚"C@úÙ6?ˆ]±ø2Òò—Î8³¦š‡ïü†;\¸.JÓ¾?Å'Çw¸»®¤Å¤x²¬wï\Æ+3‹51¥Ø‰ÅBiЧz,l4ŸY ¾“Ìó*ÛJ I¡z Îþ²ã1rÊ: éµj;H¾(M‚N +ASmk¥¬ž#‚Ë=jP¶(e¹!è®'²{ ¸õqÔ|ß6ó²Xp†ÏÖÚÎ'ìÕµóNå1a!!G'÷ñÆnâ@#±¡XËÓ†a!Ä:K,„ ùM+Ñ/w€‘TÄĶ—Š˜XÔ^ø?«brR¤C•@03vh\»Ò¡T§(©€ D9Å›Ð×· &‘ó¨ø¦.Wî¾êŠòÇ¢Zåë¢B—7Á\ @Å£«16ÕmÌ›sQ‚õ+LÕ„w6ÍI ½Ž‡|Åœ%ßçÜSˈ ©+ek­¾òâä@9H³±8E¾]„Ô•”ðô¸B…ã ´WÃp)AiÅ-[ÆÌ}&4›¼Ì32¿ÜÒ]3»LŒ,ÜVÛÊÖÕ ˆ.JÍ€¶ÚÄÎè5³‹}Ý}½d;ÔJúRÚP·TȈœ¥M0á Ú4öä$!¦ÔE¾¤8Æ„Ó€˜]Ï—ÆÀ R•œ eüX[zü]ÊÒ\j©Éœ k+z +ÿîr¦góÍŠ(€ŽzͬlHú”v6ƒß;•$¿ A¼ ÒtTÒÄV\§ r¼'LQʶ’Äi?æ°wøÂR¨8JÄבK`ŠTJ†gfsª>\qGWósÃ9ó™!¹ªAÃ@Û ¡ƒnC·ÙW)lCƒeÀ!ë"TÐSyeÕäÞ[¾ä©×Ö­ƒÄ 1}Ù‹**²fö®ÊÞþÀû®éõ^èR…ëté!ÕØi‹#Ž3¤½!U¨äÂgo¤Ï÷.<ÏãÆi¶¢VQSŸÁwõ‰F$U”Ául³†­ã‚¢¶µ1=$Ðè¶YÁùÇÝ…øJòý¶æg]q…î85¼P…tgxÉô*ÈE%Ñp«@s¨t#_?…d a ô5)FW»´¢x¤¶JƒÍÌ´GITœPá­å²Z~Ÿ Äb†0Nœ ´\KÉhà敹ãÝ¡q±þèr6PIúÄÖt¤ z>ý»†0 Ža‘Itò”#h|^5cÃ"IÈ2TºÄØ@š¡§|k÷Ç™«gTØ{ó]‚:uùX. 옙ìüžoæí¡Èæíˆ-ºüײëãöïà  8µ Û-ÖŸ1Tü2Áa ¹“±½Ö.U yöÇž +µÛEfy*Ö‡1'e:b è­Ï'©üŽö†/é2-B&qøç#x4é´ÞÆô*2@ñ#w EâSjíBûóÇKùî;¨…SK»_XÝxð³·…Èñ;̶èFÛà¯0°ÇæoÐPfà¿núl­äðêT¼®Hg,Çù=éK ZB±ÿ„LS¤÷Î¥éó¹JÙt ÒC}ÄD!¢Õ\‚ï飌½ÑQØ»Õ×SâaHwÉ<çx–¼í>Õøà ©ö:Y\IÓFQþfFFiý¤Cˆ”—è‡à«qâÄ!øªfáÏKàƒa]^e7X¢à”œM&q®ó®o«îZn| ßv%¤èùjâ!„{ +ã}H;Ò0ž‚3úeÀ¶¿sÉz—+}ÊãéhlÅ\àN.Y†ŒuƒÚăAë’·Žã÷¡2Xh=*óO%²þ(±{Y£ŒM›üÕÔùâ]ž˜˜Í÷k&,ö&ø¬ða['5ÃXé8är›eð_÷uDendstream endobj -6015 0 obj << +6296 0 obj << /Type /Page -/Contents 6016 0 R -/Resources 6014 0 R +/Contents 6297 0 R +/Resources 6295 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6020 0 R +/Parent 6282 0 R >> endobj -6017 0 obj << -/D [6015 0 R /XYZ 85.039 781.388 null] +6298 0 obj << +/D [6296 0 R /XYZ 85.039 781.388 null] >> endobj -1782 0 obj << -/D [6015 0 R /XYZ 85.039 706.019 null] +1822 0 obj << +/D [6296 0 R /XYZ 85.039 270.665 null] >> endobj -6018 0 obj << -/D [6015 0 R /XYZ 85.039 671.274 null] +6299 0 obj << +/D [6296 0 R /XYZ 85.039 228.317 null] >> endobj -1786 0 obj << -/D [6015 0 R /XYZ 85.039 627.939 null] +1826 0 obj << +/D [6296 0 R /XYZ 85.039 145.672 null] >> endobj -6019 0 obj << -/D [6015 0 R /XYZ 85.039 587.775 null] +6300 0 obj << +/D [6296 0 R /XYZ 85.039 111.229 null] >> endobj -6014 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F35 2976 0 R >> +6295 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F59 3455 0 R /F41 3054 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6023 0 obj << -/Length 3103 +6303 0 obj << +/Length 2496 /Filter /FlateDecode >> stream -xÚ­ZYÛ8~ï_aøeåA,ë>˜‡œ3äèMw€dƒ@¶Õ¶ft8Ýþ÷[)©-wv0˜ˆd‹ÅbÕWEºÝ™ÿ¹³$´?ʼnkûI2ÛTÎl”ß/\áX -ËrÀóâæbõ&Œf®c§N:»¹íå„vú³›íëåϯn^Z,}ß·ÜÔ^,ã8±^~¾Z¸Ö5^}ºüpsùáwì0èZŸ¯üñÓ"ñ­fºüГŸ¿ñœ{¾í,¾Þ¼½x}c45:€V)ªùýâËWg¶…-½½pl?Mf÷ÐvlÈÕèi‡/ýòâúâßFÓ‚Ïš²Jè'v˜ø§fñÃYRÇŽ£xû‘†!™å—Õ/‹eÇ¡•e±ÉTÑÔ«»zkoŽ‡nÙf÷‹¥ë„ŽåÈw‰û\½q‡r—¡{ÉløväÇ$7«·hϺ_x±ÕK0×–-˜ƒ$ë¿Žëçl©âná%V^>0¹#zMü´T˜ –r½ÄN‚vM«” ¼k•:¹¡í¡ðÁjj@¢;>2ýFš{¦a{mP¿I§^Rí¾Pûæ}ÅýÛc‹}ÞrÿвL˜J[Ë;Z¯@;•œ-Ý €fK/¶8MTï]Ö)Ø>8Ù3ô€«ÃJÔÙŒ¬·Ïv'ê=Öþ¶AÖ²A2žœU@·Þ _#I¡¢¿²ÙF.âÈ)Flß)Ÿ84ê6mq+„ÞSŽƒT‡?Õ÷«·ï¾u -æŠz÷í¶(Øíôàœ‘ý‰VAKxžÛï¨,qÀ³êœö´åžœ¨çÁIµÈ¦rîeSŽäºS‘8Hõð8|= ±7 ãÄNƒøç쳿M„ïRËZ„1h 5òÜÀNÜĬˆzÍNóÔ¢F1‘õÅ\Ç)† > ùädØÚ( päB¸þ#ÊŠ¬Ÿ(›v†#e)ü§½Í 7c¡ƒÑ¶ew[S$"ëöyYvÝC0ÉÿÃ@ÌwÒ; (€‚iWÞºÆ("8!hð@RÀÒE¸O8ê†V›W B)G>b˜±DlkŽxø'ãÏ·LÁööÍÔ° É1s÷ØäZC¤ž¬^œöÛ ù¶i«!-¤Pè ¥1>U΢Ù[ÆAô’]­ùB§Ê{àsS²)M¥4ƒX0°Å†(…Á>×ÑæqÀÜmËíáÚ|YE{´y[°ô‚mÝs>c½ÿB¶1&PÂÌ¢8¸a Us[ovP@p¡²©+¬¹³Ï¨*­ž&6(ò<¨yÑ–pëiWÞ7åvyÔh­ -´×o½·9žG]¨|ªžòR;Št¾‡Š<ð„À$õõR~!'h@h°Ú…¨o(ßùQšó¦æ†/¨9—%.58BÍžºé(0Ø‚±I¢"½Þ1°3Œuôhä>JDÕÜ­2™kó2Ϲµ@p®á…dS -Ù­h§›·™jŒ4EK±wã¼B¾ è}‡Æ±0ÝJl)º'M¬'àAÔ'/¬ùf0«ÍJ52É\¢¢_7ä§Àƒ0 p‰ˆÂ ÈÛêæT’Bôï Ræ,3ãÏ­¿ç~#Aèx TÌv2ì“ÂÑÜòwzÉ»Û|ÛMl—9 -&>¤V*zÞH`uM%‡G}±ãF…•}LþUÔÒ0xÅ{Îû¯û yƇŽ‰Å,$€Ä\f–æÛþ07‚02R'‚1êÝéú±fÙ¾æjÁŸ}~ -Á#ÆS9/NÁp -šÉ°nŽ¥‘v—m¹£ýÛ‡Öª  díè"Ä a¢§­{UÐIšVÆ[B šÎa'³÷BsgŽãðà|G Ap¨Í¿Í=NÉ&N}dûUÖ28©B_„ ˆÑ.ù“Ü£(ù¶ôlp]B:1›óèô%?œŒýôÉ‹U­P¨v£Áƒ…%nšðIÞ¹ ìÉzNž¡šå+€&U°£²#D; ß!_b*÷Z):u¼Þeä‘ÄðIb‘k†ȸäý¾LxCé!ïÎìÙAA(´ŸÚó€‡ö<Ê(Z\ˆ„i®¡ƒ£Z#´xÁ¸N£Sä``Àµ’±Ó·z/Ã-6»½ôM]ÜðÀ¼“ýbàD\Ι„€X´ò*Aà]°£aù¸ÖÇ:gÆÂ,¦ l¨Ø½&å<0¡’ÿì~î»pc {Ä03Ð+=®œ»\éu™Ï(rÈÔž‡~ãÕÝ"¨nWÝxË«NDgÌ>Bª¾Ä6k}¬@ûË8óu_y¸ÓóÑ ½-pàÖd¶aošú–®L˜OwƒK €¹êŽp™Ö1Q1—oM&¶ÈÝŸÁ’>Iÿ¾bdþpùn‹t³ò®»j«¼HÒÐz³@ME‡”ÖT±¦¥krö’Ë•ÓýÏ+éw¥ä †\ FéÁ‰Pé¸G?ɶ¾5˜Ìž'gÁÔ‘Ë¢ÎÃ,ö©/Nø>£>‰Z²à”Ò1:Ù`ÑsÐéá-\zŸ‚‘N—Ÿ0 Œx‘cGq0„N׋O:p4ÐaÀèkj„‘ݱŻ:ßKcë:Wª6ëx0ÿq@ûÃu5ßžÛE˜”?CÿÉĉÂÿ&eDendstream +xÚÍY_oÜ6÷§X¢,–)‰ºCZ§i´©/vŠ^“we[±VÚHZ;îÃßü!µZ¯¶1âP°È!9g~3ÃU3 jfc!u6K­ÚÚÙbu$g×0òã‘r3äÌ™Ä8ôýÅÑ7oâd¦¤Èd6»¸¢)Ë߃“Ÿ¾;»øáý<ÔZ*ó0Mmpòál®‚s¦ž½?}wqúîGì ªàÃÿú~nup1ÿãâíÑ£mC#L¢qßOG¿ÿ!gKíí‘:³³{hK¡²l¶:2±±Ñ®_ýkàÂcfÆ«&NšØŠ ÆB-…µfjN,L , DrBgmÑí]ñvª ¹ü©ìúf®UÐ>À“4ømž© è°“ÿ}|Z¥µP–÷øÒö*žØþâ¦DÞ± nç‘ ŠÅXƒz‰š]³*¸µ"öy ÍÊMh®ð››K¿ÊeÍßÅƱR´ü•^!™ÔK^üoËûy”EU90ÚÃ%ÅÚ1èo +ÔÄ,T +ì/ëPx_i¡"mâc˜)î$®“ã~QfáTøák‰Ae*Ò²”,OèoøÔØ>A¼e"¡[Ã7 — šŠ‰xβ-¤©¦…ÞÚ©ÛçÉȳ\àqoXœeÃßÜñõêa=UÐÊ[ú8G#ávÞyYrG M…’„Èá +tÃÎM],Ùµ¾?þ|öš;‹¦FE÷-ž ¨¼hR}W¤À=1ÞfÀKwåÐ$þEÏKÁ„™…Òæ7<>óxÁÔÜ-ɹ»,®ò ²Í;T@ð%LR‘šä¯ò²7¤Tö*r±hèì»ÀRG‡},~šÅ*™ð1¤âR}ν¿mg­XÉÕ±!zJ¾†k&| —± Õs¤:Þ±,ûÃò¤àw`)ÎÁ2+àw,k9ø—‘ÜIð"3¸}²z´’$ÚšOÇ3 `–ãN´Ð;³ìR80áRÞaЮ³BÜÄ};²Dhàn 7Ñß5/˜gî&zwÒœOxÙ'ždÊ>ýžiŸ(Û/ùggžíc)_0Ê bœÊžm“¸æŽv±}çð‰ê€Æܪ­ Vùçr…S6+„ùvà&/é>‹–0XD6r06°Ê{&ç­Û–írÝsÏã14WÙsÈÆ™F"‘»àß@Ü‘©tð+®\àõFŒ“аAíd…ÿ—dh(P,ƒï .k½æ \qStž³hWåªì÷é ÂìÅ=óf®Öƒ{÷„Ƹ+z¿m•n²º¾¡ç=jçUEQeßR׸ ½&†‰&Üoq9vøôÐ 7{èú‚ c5ÐW¹´HmÙoP)ŽÁUÓzNî€0­ö§¸ç1ˆ- úPýôŠ)9Eô„ï^ƒ¿‚ÜÖ nx_sw«t\ÕŽ¥í ®«ñ‰c>0[Î!„#œ»Æ•2 q!WÈÙ²Y³k1՜°DШ‹{^ëÃ,ïKÎI2oË<¥->:Ÿ)–xä(¢Ü´ðnÔ—õµgïõ%½«¤Á†Ã;Òè`žtyVéa<¿Ü†ß‰Û&¾>_mÈÔ{ˆîí+@x8.¥CÔ.Fñ–ðŒû.r÷ƒò0°w<&{Z”Š(Õ”ìJ›2dAžtQÌŸP»ê×ZÒµôœwä.³èXKdÒõµ?ê¼Åí V°#ÈRÖˆHi\ˆ’`&gEû":OßA8¨LR¥ÜlÌøö9F +F{ ÏÚ²î'yf™ˆâÔ-B€¨öÂ̳)FK¾’é²(ŒŒHÓx  ÈÇð 9‡Jp›m+–˜À„'sÂb ð”ƒF;/ÂÄ6ÚHŸþ< ¼A°$OÑ.Ic7iغȆG %é‚oår5ZO³©=JËcžñ€ › wêÂçž½³Ü&Ç)>ì ±¿P×mÃæIÆú‰¢ÏYæ„ÆA‘U£€hÔT–*}ÌvI¿ª¸útœçkò¤*G"a*åÌ@2¾Z—U±dj~Óé Ù>õxC•EBÉÄm[•— vvl´ˆl6œ8–® +qº¦wË{65.9\ÂœÏL¹dd¡vK°S³#O õi"l‰9hÿ¹¿)7 -:ÁB:Û¶nu¹|5!dE¢“­üj?#óHe¤HŒýÛÙÚòÖ&4fX~éõ  .»šºÊÌíHóv•wi®&ÏX|kÄ»ÒßÛwЬ6ÖÍûÖˆ¸Þ÷º;¬vøÊìï¦öºáxߎô©) ÏÔ¤vþ?W ÇW°È×Á(eIœPgBÆ;R{W +®É TBgæ Oe +c‰š|*äDJòËC|h•>ÜòÓwùÄBÛ™M…±Û7C°—ýØø®á·!­ý8CMdÈaöi¦„4Y¦ytÔ&A·‹ˆðÍéJÍ^7 Ñl+”ÆÀŸÌ@]JnC¶²VvZs=Ú-ËóÓN“%è íª ÆÑ“AJ½ë emÕœ1qg`ÑR4Fo Û¢Ê ,y΂«`„ùVÇDøªtYý¾!ê(V§cKtˆìvÕšÕjH¦vÎoà‚¬÷‚ã‰}R[ŸUëOóKŒ°™þ¿]»ú¿Œ-RO–ooPûÎÃmâãhÃ÷3‘¸B´5ÉVԢ۬ܳŠ–±HÀ¬¿BÅ”xBðM9m¢’9³AyM Û;-Ý<÷úƒíÁ:i‡·ÁfS¹y\›µ+_lÒ7hwwnÃÚ=ZRf°oŠzá26¤ßÓìžx7Û:íŽlÐ|¨â½ÞI\³ý®¢ýïŸN2òÎ0Ž‘~ +XZ¤€Ï!®Ëž¡˜µ%Ô$Ù¡r¼3•'ÔÚÕ¿dP9ÅìISãcÛõ¦Í{ÿt ªÜÇÆHè(> …V²ˆ‡)Õô`Û”:Täôäƒ%Ü<¥ö0²tooHrÕDÇ]Ä)—TèA‚©4™3?FV9=ÜdÃkÿã"$†:ë ¹LÈŸŽ)ˆ6 +¤¼Ç%Êÿ0±M Ågš}Ý.—> €‘añ];Ï·5¤»ž?²÷x_9DÜ>¯ÇáÅðK ?¹ÜgÝ×ö–{ Nyæ^Éů'¯÷Þ½Wy!æO%ý@/(ñ*ôÄ2]´ˆw¢ËªîTîrTeˬ«5Ã¥G Ìr¢õ½> endobj -6024 0 obj << -/D [6022 0 R /XYZ 85.039 781.388 null] +6304 0 obj << +/D [6302 0 R /XYZ 85.039 781.388 null] >> endobj -1790 0 obj << -/D [6022 0 R /XYZ 85.039 410.739 null] +1830 0 obj << +/D [6302 0 R /XYZ 85.039 512.736 null] >> endobj -6025 0 obj << -/D [6022 0 R /XYZ 85.039 368.392 null] +6305 0 obj << +/D [6302 0 R /XYZ 85.039 480.921 null] >> endobj -1794 0 obj << -/D [6022 0 R /XYZ 85.039 285.443 null] +1834 0 obj << +/D [6302 0 R /XYZ 85.039 193.787 null] >> endobj -6026 0 obj << -/D [6022 0 R /XYZ 85.039 251.304 null] +6306 0 obj << +/D [6302 0 R /XYZ 85.039 161.569 null] >> endobj -6021 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R >> +6301 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F41 3054 0 R /F35 3036 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6029 0 obj << -/Length 2128 +6309 0 obj << +/Length 2578 /Filter /FlateDecode >> stream -xÚ¥XëÛ6ÿî¿Âpœ ¬¹"©çùn›vƒKΗ8Ÿz-J[ÊÚ,9’¼›îï<(‰ëWrk¾†3Ãyü8”ûð'ÇI(|ŽãD -$ãÕväï`å—‘´3K2sh~\Œ®_†ÑXú"õÓñâÃÀ'A¨Ç‹ì7ïæ×óÅÏo§3­µ'S1ÅqâݼŸO¥÷Žgçooß,nßü‚£&¥÷~ŽËÿ~;M´·`¢Û7Ãò‹×?¾à‘þô÷Å«ÑÏ‹^Ó^Ð*E5?~ûÝgp¤W#_è4?@ß–·#ÐS„¶ãbônôŸž¯cÞuÊ*¡ND˜èc³ÈÐ1‹”Jh©Æqè‹ÐÈ.»éLÅ^>I¯„#eü½ƒSÅ‘WÕÜšU»¹ŸªÉpÜ®ó²ë5ÍÆ´ø<ðÚ_0®–ÜØ÷–<Ôù_ù -·´y cEv%.mëªâ -ښϛ-ª³ßÚÅŠ[Ÿ›l´ ò0KèÄ®Aÿ€±fm™ÒÙ‰é¦a~Øà„“V(Ö›E<¢ëAµ ¼Å:çÈò©‹–Ç$+wvÌV{¾ Áph¡bpö…ŸÄ$þ¿~èÏ:禶GÄ~ÑT¶—‘WZÔ´*Ma%v&BﺠÁk&˜¼6Ÿ_UËÎó©JÙ¬õû&¯'LdÊl RØÐÌ­ŸfæøÇ‚¹¶ !` zË3Ñ%‰Hâðbæ:4¢ -V¥HÃÐÉÜ( -„ô#2$«ŒP®Â }P*Ÿ­ð¬´ämôZsN'Ëë¢NÍqÚt|T*ÒH‘N/§IÐÛš¬ÅùQ?rL•w¼D‘ í¾Bc~´¦·>3%ÆLµÇ_Ê„<»bŠGdXíyPæyær <c¤OL˜l×u—>6TÛ5%EÁ?ÏX(LÓ/zÍ¡! Ò_ŠÀ×=#ŽnÊ‹$L. -ìhŽ$ž„2W¢4LG1[48†¿™QöÛ1bO†d±÷°Þ¬Ðtkb¾ânrBµÝ¡‹<ãIsg(Óš–Ç“‡È6ìw]–M˜æõÍ€ „}ä)ÀjÿŹ´ÿÌÃ%C õkŸ²‹œšYæÂóOÐœ¢د-¸Çûsr!AÃ0JÅ—]=Ð\pµ%ú¢«/\} ñ´«‰†ÏýÎÐ=°43²?Ī*?ðá“G|zGê$€gÖ(p.­ÔÍc-Ò€ôM…AÇ@|pÎŽZI¨¨RKáiª™Äé“öéhâúv+Ç?U æØÑÔ²9|97à‹.ƒ 2‘ñäk9¥ðª` ÓÊúÉtÀ–3…¡":UËáÝmGXîñ·(™A“·ÜÙapD`Îê¼0-Ýf°Û¢íÀ$T@-6»ëí€Õ“ý³ÅÝÖ³+„ÒÔ+¸Îý#¨ VI,®(’ê­%9Ò슱¿Ø!r˜=fÀiB¬S¨NHY¢)z͹ÝoŸn¾ ?a9„_·}W#ÂxsW² 2&°tÄX¢#ëG‘×Th–ÀîÝö̬ͽå\V<³)ŽÂ}^®ìÂCÇÇ´Œ¸Õ,¿·ÅâÑ=…wžSÈÔì¢X\ q˜A -Dc'á¾!}#¤g¸/ýfLQ¾ˆÕEÀ×Q(4<ã.·:P"HŠ[m‹Û× Ó,Š¼› -ÜíkCP‚V«žÆM€Ò±¼¬Ý@s¶ÌÕ>@CÈeî-"z”:µh”p- ™ÉÒò2Õ¤Ðf¶µ5°­;uìS¦aÝ'Œ GÕ?æê|WŠ/ ㋈™ì8Hø~îV0ÿœ÷"¡‰®–¢½ÎÝÞßPÝ^(zm†ŸtåÓ#„òŒV<JѪ¯.` Hé L÷àhÓòð äŽJy~Šÿ£e’¶‡–šŒYõW‹uHo_u’‹$ùÄL±êàŠà©žóR±ãáÌN?›óü³æ‡fA°Ä¤~FêMø²¬9$ð´6í™w8Ð*R"JõÅ€vhút #' •ÖŽÐ§[Œ¾€¦{/Š½4“ó€jhÓT!z#d.Ñç9¿}ÅYm­”‹Ú4gÓOþZé'ÝôƒÁúé«OArUµíQÜW¬/E#…Çß•|VMË´ýèW{ ²Ý¾e••Û‘H -u$ì.»!Ê‘SeÛ.{¡ó~þÎ2«¹=x–YÕͦ°É}]Ŧií3Ó„_k=ºª¦ñMª2ï^ÛöšÚÞ~øø=Î|*çó5.ÿôiçvùëíïnGhW¾ë‡ñþ~ñó¯Þ"Ò~¸ð\“Ä‹{{®J’ÅþÂŒøFæåÅÍÅ?û[xÍ_ð©îVvÇ +¨Nt0/r$½ 4€}×øáXpŠ€óÀOœë¦¨º¢ú +̆¡³]®”ÓÔ{žTnxÔ!¼æñ—¢Êê¥QÎ=[¾^Ïéºt³Ëš1”.ÏÞ7›v£ä6Là*¥z6L<£ÊïðÊË÷*­Å®²þ~ûÂŒÒÀ‚rŠ=’’#@9]-ßbo!;ü~Ì[ÜIgêŠiS,‰_¸þ…ðÀÙ-Q4:Byà¾M*–:vê#O° ¤±Ô ÜJtƒ–ºuÄ6Ä”iSÖ”vƒÄîHùVÐÜ êL÷-3švHvºA’vyv†>&¦HIÍ Ê„ øX°l›e à”š•o”ÂÙ•³ hûMºGëôo`[‰v>ÖÍ>-Ë !Ö"]xA%hÛ iÉ‹4©‘™*§q‡Â&ÑÉíÒZ%L¾àJ•õRo¼«ÛNÕ 94¨>æ×îñèD9eÆ5;BÝZÉd'…øÏ7oPôÂð&Äp·*Ÿ¤›²H‘¥2/Î,®[NÖÂAÜ[jbW´¼7«™–×PµìÛƒJsAÅV벆wì›øÄØ}Ð{“óY’)©Àl™pøG¾á ›ºª¬El:±vßéayÖÎpNdD!I/"éE ×Ï*²:Xµ»º߆›¾RD}ñàD`ªÝR¤Ÿ¶ +Ä.PfM›ÛGã…[6 `$š#ÙÃ9í.m,kãøÅS~Óc~-÷¯)#Ã-ÿY’±LRæiS/Öá`@0®z{Eô8äÀê‘™kg_$¾þݯ—¾í»¼ÊÚ™Wéûn¬ÕàEèò.-ïdDèÄåÖn[^K+¡¾¶ZÃe‚´ý^ÃpR9h‡¾†ð/çÄṿB1®TñLù'ÒD-‘á3~„X¶…$i +j•ÛsÖ {¯-pf‹„gN,â+év¿ž°†ì#ˆdË/^àµÇ† ls!‡p‘ŲbÜÍŠÝâš}óÉ^š^bœ·»\Vˆ•bkg!>®ÿVvŲÁÔÃÔaìŽmøFOfÂ]¯8R/gE3x€ºy@W‚$™À¹ÝIÐ3¡Vzw‡š¼-²\V€ ©<µ‰]Xa]Ûæ²,Ö—›ã¡½\³ _ÎƹÀM‚„Ž!M¤ãðÄ71-¤jøâK’<`#`NÌ*#ò#í…Oj¦8Ò½Ö•_2Ú0¬59¿ +ÂB6Ê ŽfÔ;!<“ò§} |¤$xÇûlè?%1Œ\øí¡®Ë¹÷»gEG/™îÜ äõ2Ü$Îòo…¦b8>!<ÿÆVrì$ª]ÍP ;7ò1EpC-M]wUêÀ)[þ®Jþ>n“˜Ó¥rFf¼í=kî¿5+üb•ç9†7#n :ˆìP‡´Ç˯á™ÒÀ@%WžÏCw†Œ šð)4`ͼüwÌkøzùFWJ(tçð¬Îñ¨GðÐPya¢yÃû|-„2­®´ …ä´®þ_ÈòC;‹¬Ddô÷ 2ÂÐœ©IE‚H_¢±]×Ĩ¾ãoq8L äO2ËÓS¸Ï0ýoò ü‰5Z˜‰'‡ËCöT´‡Aø<¦CÚpûRtZ…b(?¦ö™Ém®”¼C¶ÍÀù€²y‘½¨PÏ¿ëCïI¬Áj×Eu‰k+ôE/f>Ô±ÿ¼¬ÛM[LmõÏñlí’ð(¥À„lñì×3,#Çã€ò"†£Dé?Àp .¾{1²Äû#ÈŽíÚbÒ$Òñsáè·û]±Ùõ"#Áüö_‚ÚB£ýó@ c¡Ö¿ò“'Tr㽓ÀúaËM+Šñ”’XஸV6ýkZ‘ Á€€ßú|µ{ÅàM“§˜uã­E7í½Gã|%‚mŸì)@Ÿ‹…z_$¹ÐÒ@FÝð!pÝáÌJ-Ü°¯¢v)Ð䇞-þ%!&Ð=µyºn [cññ€cå`é\Ø4Ø ¤¶_Óñ‘-¦ÔXŽãj}à /úhK åÑP=Å ˆï+„¾¢Ú”ÇlTV"Ðfg8î3Íâ°”úq±^ÇOë¾Yù@5’‹½ƒˆ«l€s„V÷©Ô¬8I˶ÆQ2$>eŒ=5Üõì(2A0n»0¤=®-Ÿm—ïÅþp©Æô™‡dÁØ¡ð¹:FB_ÉR-áIn2°)ƒªiáß(ìuÛïžú–I§Ìƒ2˜T-­[çz!WŸ}Q‹U-jáPkµŒ;þžµš¸Š÷,µgÜHÙÊü¾¨ÒZj¨Ý@YK¥v x‹HÙx^1d¨z¨ÓŠÈ“‚v¤O[®#$åOFóBà ì²ÕT“aèj}Z”Ø"ñÁ›½k¹¦e~ È–Šú&õ´`²'šÈ^Bt™ ï÷õÄ5/p—Є§ S‚à;H»”'$Ú/­%Z£¹¼Ù7¯P-ÖZÅá1¡CÖ™õ}*˜Ø»©×ï+©8ž´uqïHkñ•=mÇ ìŒÏŸ[$ÂNèÄCR}㶪t]7tµ` ÒvHä‚´’Í$(ŸÊ6yëí'ýólj(YÁæ…Ë® ï ä!¦íTï:Öc,ê¤<–B }#÷KyÉæSy„زÜ:Ó,¢ HóV†r–}v#w}x¬‡‰PFÊlòMW>0 •+˜«¾ßÃÀ¾3{Iö8•Ž´9ý à®-u‘MDO§©Ìù #&J~£Á‡Á½%ö‚g?Gà-òú"Ç~ïwÖ®Ÿa°:ôÁñuÕr^¾}ÔãÞ•}e±%ãâwBj‚72©·ö%Í5KI‘Ì؆m‘\wèðxQA àHˆ_™×x4ËŠ[Xc. ¤ùñyÆ <küßJ!¤¢ÆP4ͧMqp+éq舊ëƒ)÷øûŸ+Æ癟D"H­Ð$$ãâþ+¤1­ýÍ €uåžd±|S– ¶Û1ßÁŸÉ ; ל8æ3ñJ™rˆèé^¨†f»bÔÔŒgú‹D=‡ Ž<Ÿôe‰B’Rû=ˆâjægÃ0Ö®Qfþ—CôË~‹æUÜ+Íþy–…3ßlÏIT¡kBlÖü/dŒ endstream endobj -6028 0 obj << +6308 0 obj << /Type /Page -/Contents 6029 0 R -/Resources 6027 0 R +/Contents 6309 0 R +/Resources 6307 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6020 0 R ->> endobj -6030 0 obj << -/D [6028 0 R /XYZ 85.039 781.388 null] +/Parent 6282 0 R >> endobj -1798 0 obj << -/D [6028 0 R /XYZ 85.039 688.875 null] ->> endobj -6031 0 obj << -/D [6028 0 R /XYZ 85.039 657.06 null] ->> endobj -1802 0 obj << -/D [6028 0 R /XYZ 85.039 365.343 null] ->> endobj -6032 0 obj << -/D [6028 0 R /XYZ 85.039 333.126 null] +6310 0 obj << +/D [6308 0 R /XYZ 85.039 781.388 null] >> endobj -1806 0 obj << -/D [6028 0 R /XYZ 85.039 262.693 null] +1838 0 obj << +/D [6308 0 R /XYZ 85.039 761.463 null] >> endobj -6033 0 obj << -/D [6028 0 R /XYZ 85.039 222.529 null] +6311 0 obj << +/D [6308 0 R /XYZ 85.039 736.911 null] >> endobj -6027 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R >> -/XObject << /Im1 4096 0 R >> +6307 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F38 3057 0 R /F15 3032 0 R /F59 3455 0 R /F35 3036 0 R /F62 4159 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6036 0 obj << -/Length 2494 +6316 0 obj << +/Length 2518 /Filter /FlateDecode >> stream -xÚµkÛÆñûý -Åý -ˆ(îò}ZØ®\»®ï £H„)‹5E*$Uùþ}çµKJ¢ï\\ ÌÝÙ÷ììHÍ<ø§fIèz~:‹åúI2[﮼Ù'€üx¥c!(‹΋»«åë0š)ÏM½tv·Î Ý ôgwù/ÎËŸž¿»{õ~¾ð}ßQ©;_Äqâ¼üðn®œ[^}÷þæíÝÍÛqÀ¢r>¼CðßßÏß¹c¤›·øù›Ïyæ»Þü·»Ÿ¯^ÝYN-ÀUŠlþqõËoÞ,‘~¾ò\?MfG{®ðî -øtÃÀ—yuu{õ{ÂïšÒJè'n˜ø—jQá„ZBÏ ½€Ôòï¹Nœ¢íæ å” RSw(QêÜ# 9ð$kTÀ8𜠽†Ñ§ïæ‹ RÎݶäuDé2ÜÌG#¦¹ÊpG~,ó¾[9šÖx¼Ë>ŸïÙ4-d1ëÊ¢e€pk9Œ²UY!=î¿ŸÚú ûù‚¤íåð_½ÐËê-j\(ÔrJjIïƒôø <%vŠ5NzVÂXˆNß0´-²œGý¶Øý ‹å§-’êÿ -j çÏ àI}Í•TìÆ…Å€Cö× \?ˆFö’¾lˆ•@0€à붬A ”&Šœ JÓ6;žA Üò¨Çõ†ÇË:oæ¾rŽÆd°˜õ„’­ÙÈ`&”;ŠŒ¥Ö8ZÝ“ºÀó¦…’ÈÕàó ;Âùª³G¡r•¯IØ×ó$0"y`»]!#'LÇ+[üq0~ÖõeS3…CIAPÐÿhÍ(t¶ ÚòÈ;‚ë¬æÕ=êœF5”W2bZC¶ð!4=âø"”¹ÀK•Ö‚‘ññh ^!/¦ðÀ` ðÈ-™÷Ä}MnÑtÉ„‚d¢}_HlÚy¨PÚ%+‹ÀWn¦'¡s›íðèU^@ô½mÚ]VU”*Ūةˆ_ŒG -¤¬bøº©k£ñµh–7È3¶~¤ ËYڎ׶M× …†W¬¦ALsbË(G6M•ótÅËÛòFèãdeÒ `}¸}Áƒ¦H{ò ³@A´øª*Ð/BŽQΡçõ~+¾ƒ“œ5ÀN„t¿¬e:ÜÑðoÔm,ºMÕØ¡a[P¢‚QS£zïyB®'ûß¼î(ˆ‘bm%†Z ygy¸”yÐ[ê9ÍÞÌÔ°œ$,A’Šñ“ôÒ‚pê¥!Eô ]¤àÞÝðvf±í - ·ÀÓpé1¹piZ#MÙ˪ç£V¬oÆxF¤ >Æ‹¿z*hí.áä¹Ðb&´‰ÈE7RPHú©Š¬=Q…Ž‚qÍ!;Gô=®Fzèäœ -PÈm© ÐÕ<Älû¹¨ón"HƒÀM´2 -ÞgÕgÑJ|’˜$V8 ïHBnÈ{m(ÁJgq‡ëÞª½4ÐP9AùôÂѹ/ *NÝT'ÞÖmÑJè+p‘·t…ˆ½ÉôÈ8)ºµÕ:̈|I§ˆ‹ž8¡×8r¢ªn·šÐ¦Ön›ì‹õCwhYu]An±èä­ûÑ=ñ]ìàM)¥ÎÉC¹C:pþr[”˜.7"„Í €ýÖ#`!ÚKSW+}¢=¹¿ã¨38GͶ’›ö3 ÖXÛ/ñ…‹ÀÜÞ¼n#îÀùðž%>á»´ðv‰9ª\-ׇ½Y[ž3WçK"®’ø°nÎäz¾Fpˆ‘;$›ÈXÏ:ΟëJÓØP<í1Ò­;7&i(aÒ“\j”G`_ÆŸî~W•õgFà[Hó^¾;.?Ê“MÅðã¶\#t;Éç0¾Ù´S|)Í#òœ‘â ÛíÐg+:åš=Ø{°‡×¶ù1i¤mšþO a:UÇßEÅß塱ºåŠ3ÌrB«}Óg²G‡þBÞ¿´ ün•ç9>c#qX‰ì='ÖƒŸCüÐÀ—•^{Ýo!=DFéÁ×o|­„CwŠÎ✎ú -@#ЋRͯ‹•PδºÖB*D¸~/îÿ ­bßÒÁ*$F‹üÁˆÖJ*Bú:ƒmû~/Nõþ–ûýÓ5ûF¨‡ˆÿOH…Á…7špO6WûüI¤b&Q=N êL.2Ÿà)1yC$Žò&3Q&´­$4öù&‡œSÅö)þÆ1æ†ÇÃzo3‰qÊBݪ¬—[`.z²ª#«º[wå“…6~I„Ô Ž¨Ý-B»Õ„Ì(2@º}ÓTO–8N•þ‰ÈñýS]+õ¾…Ö¡[B:†j6yì:ú¯Ê­Õéå÷§(ÆÀ>aäëàü"Љ°\é&9« ÍÍ7Óí1e›`€74U>T*Bn_Â\GÕßϹô|ºò¥W´6µ5·½ziJ•ýwË×¢Öî!µ>PL×ŧ²K™Õñ›…£Š'‚w^FÍ 5<A"éŽÛÞ½2±O%¿)M±Š;ñ%{D -\ä÷Œ³™Û~•­‡iü‘ìÓ -14ÀgóFAYoF•Â ½1ÖÕ!¿á°«bªLÛÚ°ÜË®c ´/Ýò´-97TÉyùCfû pzÕ5<Õvžy"Y/e"´~Òæ •î°2õô½}È;S£Fƒ•.IOÔ!€ =¸›¥¤+¦DÄ Kà_踫N -^)Äaø‘¼û¼!u‘UÎí<}è‘gì{ʾ H®Òó ðMΞ‚ {v,ë±^Šö°Á›FñCìãÁÃãA"æÉ?ô¶q1¢9Ésú ºÔŠÆõ¨§jÊW]'/1d¸ÞN*e˜‹¬–))ľÙÀWÛ6ܵ:÷“Àɳ>c<9GXÞJ¿‰Ä&ˆé³ ”€Ñ‡¾1éaRLµÌ.š6±ôIa€ÞS~’Æ+/ákÛJ”$ÎG2ü¨‰”$ã&.D¬6à³³–WѸ)Oh.ÁŽ‡‰H8eU!Z@ÑYð¾nxNã{ô^8~8'ß—ÚØqV¯Q'£~†NNß œ}pÕfÄ·Òá¤oc¬d^126¢Nt~yÞÈPörÒmeãÖ^\ÍÐJÎÈ~m±îщq!ëO¥²dlb\’×]j]Ž²ÏýNK}KǬªbPsc•ÁðDñ°GCùKzjôª@ì‚x¥|Û¬¿È éy—(Ù£$CØ»bè9ïJi•0o©pç˜N³ùÊÏ!¾çêtêÇo&ªzÒ/Œö'¸Ä?þE%ÔÚÕÊð‚¦ÑðÚ<ã×üyÁð‡Kâendstream +xÚÕY[oã6~ϯðvF*E%YÊb±;—Ì4m'É& >0–b«‘E$ÇÉþú=7Ér¢ +´ÀbáñrHžsÈó´šøðS“$ò|Nf‰òt’Lë#²„žGJ$üIèùq„]oæGÇï£x¢|/õÓÉü–DæÙ/ÎÛ^_ÎO¯¦®ÖÚQ©7ug³Äyûérªœkn½¼:;ŸŸÀZÊùt‰ÝWÓD;óé¯óNçƒeÝÐ cë~=úåW’j?ùžN“Éʾ§Òt²> +#íE¡–zyt}ô¯~î ';wñùúütþæìâúüõÇÓc‘nV¦Î+³ÎYü‹Ò!úc¢”FÑÄU¨cJ*¸—,s¼1í긵Ǘ—ïPöø½jìvCCíÅzFCç+˜?ô•ƒC¨°ž‰³mZ®ÝL]¨ŠŒ¹)as¨8­åƬ€¶•³A°Ç×\j¡Ï²ü2¯òÚ´2UÛ­ Ö‚L…‹ÊèÌ´†K·8º~2 5õ2o;]]šg¬™rPE8kq˜8ï§Iˆ Ûü]âz¶i¯u±™*ZZÁûÓ uZš¬†† ߃@;¿A}ÒÛ®3çz»šöev§VÜhdÄŽ–Ý–÷¡sg݈mC+J×®€û Dæ3è"§Ù5Üv>—Ÿ™ôÜì í)îQ2¯ÁI!úfÛ¢gÎne¨; TÄT\ydY&³üÅ=»åb§_${ÿ%´óâÂ~DÃR(¹Ý,hµœÙ7Ø%³±PòÓ»±Æ-ÿqÑ­rËè´Ð²˜5ÊëW͈SV74§@CMf˜Zí-Me;SÙ¨°ÛÏún‰«ØíFRÄUg0Ì7œ·¦Í»/úóšñT|ÖO ÓÔù7Ü-÷ìwUÄ`Y”[Ž³²­ÐÇAøhQ?™žM"4Qè‰GDäÓ0 ÷Ö#B£õøÅEQ00N¼`¦ÐFpG'"‘å÷Å"wQ…OWg]þ.4¢ ù¿þx>ú_ÛÈT£ê';ˆ»þ‰§ÿ'ÿ>;ŸfÜÎTí{~Â÷ÜRŒüAjÀ +”WÒÑcÃ=†;ãã>jÂ0h,K.ís ¼/A» uä"(ÔçhÛÔ–† a—{JŠ=†Áÿtøµ!‚pc¸‹ó_-)…Û¾ø‘Oê{0léaêâ·Ã–@« n,åóÜVhé Á6ÜУP ¼œ^w(´¡$4‹Psû0²+$0žÅ¼æÚT””œèû3' Tá R`EG²-d­RʯÀðPëY EÀ>Cù›Œd31ÓÔ"Þôþ´ÅÏÑq® +€š&úÀýQ蘂j°ß>¹ b²ÉXÙÕž½V¶…Ú„ÙÃñX.í’E øÂ2oD@º¶ÜÚvie ùšý¬xÆ!Z(—ƒfvÉ­ðIj‰É¶úžë+â“`%9-¿—ÔD «Š±Lß’{¢˜²ÊÁøÂ;jÕr;q2,Ò€›­OŠ°‘t1…Åò|9á·l—ôuC‰DtB†ãp‡¦YÌÝYC +%Λ¼í¨(­ÜtaD‡„[IáëˆÂÕH¢‡.Ä\Ì ô#7ôx„fzy½b¥«Î¿n;Ò}2߸’Âõb@ói×<€ ÷g°mH˜82Á×Èëп÷zÈG´ïÁ@•ýúwýbÐ\åíMaÇNß³9öÄ©±å¶E¥ Q€ÞÑ·a(׸UE¶-‰P'ðÌBÅ¡TÁÃOL*=nSÄÒº¦í›‰}|Kð/WgÖBTðóˆ2‡å‘ÝŽas•ÑÞÔäôÇ1?äy&„Ï2#{îfh¤y8Èå š€nqÑŠ]÷UziŒ?,¸Ð©cÕgéšCO‡ñ0K«ÔS lêG;ÕÚqL×O÷=º¸„8(*Üýxæ¼]Ú§f„\Þ,}AyJ½>jŒ5Ð-C¸[–|Aã•Á—¸+…YýŠ]Ë”,$ÐF‰eøÝõàvó͈ášoÎØò›½i¼1êœxQüÝŠ»ßÚõZ‚zZоS÷^Y–øú%f^˜ÎP^ŠPõLå(Ôâü3™žÑÒxFUÒ‡ã§rˆÊäU+;oªW|ÉÇÚYÕ´¦C¨¿«‹û¼=iòâ©PžŠ¢oŸŠîù"„®îÙ`‡%üÑš°JqZ{š„»+¢CÜ =¸yëgØòjˆZnêŸs°B+Ëåz–[à@hÍ‚îˆÔ†t®³_¡."Ü—[‘Ñö<| b›-P†øá;$Søbézø”ÐIÌ~ëÓÏœ^[Ò='ááÓ…¤ÃPk¦!=d³¨cè­lË…žñ`¥­MÕÜæõðŽŒí»r:œ¡ÇTj>HïØMO_×¼›UiMö ºAïT:Ôv½íD.=sðÍÃŒÅm@lþ)qHÜàþ-¶›ÆdÜt¾ãø)Ï7 Îkv#æM—s'ôÜr˜óˆ+L>¨^"ãM ¿,—qÌ‚ÅsÚYˆ47¯²”æ„…ã6£!¨ƒèåLTúíüá uá¬ßZºDÉðZyp•k`¾Ø/~¹=D¾úÝmãï<é€òËû.<]*ñþ±ïùmFAQûª¿N!±ÞÀ]—Øe# +ÅÚ›©NžV[¢ç÷Ë'Äk˜Ò)gD<@•ëÁ!”~’#ŽÊÇžŒŠñYJ÷&, SK8ˆè‘Ãid: + `‚ŽÌIÊÙyë£?ÀwåB…"OÚhX^¯‹ŠR%Id\ÈöW†vìjÀ¦úað’3]ÐÛqéµ9î<¶q³òc/ÕÁÀϨ-_çô®­£=&cÙPçÂn;È[:‚(…Þb{|˜Íö 0y‹óøÚÉ;X﹬?XÊÏn’4™dË5¾%@³ÆOš¥÷óš&7¥Ç‡ª(}Óƒ¤¹ã»m¥pûdæRÎ×F†vW (oö´š4Kžcæéù³á•<2Z»ÂL„Ât2…ó´õ#³ïCÚÚòâx»r÷¼Õs"¬¢+ædÌHcð›¤^„ãè#*ÿ±?¢ô hloþ7LûÏžº†d‚ÿG6µ}endstream endobj -6035 0 obj << +6315 0 obj << /Type /Page -/Contents 6036 0 R -/Resources 6034 0 R +/Contents 6316 0 R +/Resources 6314 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6020 0 R +/Parent 6322 0 R >> endobj -6037 0 obj << -/D [6035 0 R /XYZ 85.039 781.388 null] +6317 0 obj << +/D [6315 0 R /XYZ 85.039 781.388 null] >> endobj -1810 0 obj << -/D [6035 0 R /XYZ 85.039 717.788 null] +1842 0 obj << +/D [6315 0 R /XYZ 85.039 411.346 null] >> endobj -6038 0 obj << -/D [6035 0 R /XYZ 85.039 675.441 null] +6318 0 obj << +/D [6315 0 R /XYZ 85.039 368.392 null] >> endobj -6034 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R /F35 2976 0 R >> -/ProcSet [ /PDF /Text ] +1846 0 obj << +/D [6315 0 R /XYZ 85.039 325.523 null] >> endobj -6043 0 obj << -/Length 2386 -/Filter /FlateDecode ->> -stream -xÚ¥ËrÛFò®¯àV« fðÖeײl‡I,q%ª|ˆs ˆD 4ŠÖ~}ú…EŠÞMÊeb¦§§§ßÝ3R#þ©QèY¶‚PYNŽ–› {´‚•J0LA18Wó‹É{Ï)ÛŠìh4ìéx–ë9£yò›ñö§7³ù»»±é8Ž¡"klAh¼}˜•qÏÐÙÝôf>½ù€3€Êx˜áòíÝ8tŒ9#Moúå7¯Þð̱ìñïóŸ/ÞÍ;N;€«ÙüzñÛïö(‘~¾°-' -G{Û–‚åÍðiy®#óüâþâ?)^sG¼ë”V<'´¼Ð9V‹òN¨Å³-ÏvI-ÍäHA;4¶U96u`,Ç&Àjü­ye9Ö¡±Ž³§‘Õò•yY%iuϘ¯SÜ(+[ NTFJ /4%?ÛÊý& µðQ0KÊhðØ=þ”ÕF"ÞJÄ(Ò%ã(#+‹I¼ƒ(½É–qÐóð0hÌT¨Ðˆ4ð)CjIIgÕlÎuY7ÿd{§ cµ;u`Ù[”Œ–uç9Obþl+äJ+†í‘XF¬2€¥†é{ƒÈ ,bP{`|APZ ÞmL°ø±Ùy…Q”Ÿh¤,*f‰@Ër³Áµ˜d½Da&ï¡o€h®cùŽO¢UeÙü06=íù6N6hiœ˜[þî³b[e‰Eð'þÖ›Åådòizs}ûéþæÝüjz{óæ㻉`×ë¸J‹x“2úg帤X¥ P½»˜3Æ™lãf=iÊÉlvÍ|ø´Ùn%î6 ’B8ÀÔŽ¥ ‚" -6¨ãA0°ÛbmÐbðp[¡yÐ"8ÑF¼ÈÙ[]Û!GCŒ$«Z^6Œ‰æžI«´H«¸:ä8: CÄM̓Dz2í†&Æ«´ãPŽ¸¤e"‡ØôÝÈxO[‘ÆML‘>PùŒB­nî—U†‘‹ä¼—~\#Ð5þØ®Œ]2´M'8¦ÜyÍÍ:Tçj-aH¯Ï–’,éÃha:=ý—‹°›9ãKrø ‰õDáEÙKGÆÕ®AncO ëÐçŒqC“gæžq’’¿Èà#[þtrîk-)–¨ú5cQ.ËŸ/‡¹7[à’PÛg¨ä!fÜm\šäG4ö¿XˆÛö”GÞ@®B[ ùc}B)˜ùT‰©C{œS±+à¤D’ ß¸([QY(ØÐ&êUUbÈl‘B02¥E$Xbh=!?Išð:ú¶2.ч½¦a¥·‡©v™ïÄ·‘\§sWé×]|B W”t{ð±Ü±$JÆm8¥¢´¯åhHs KÒ§lI¤Í‡»©ÅÀ_3NÛ’Š‘ÃŒ6_¾Ò&xÚµïlÇÓ£PewÕ i)² í´dP"¨¬ÁËÔí[!$Å3§µ(/;È‘JiËQzx\M¹rq ’B@áoï~Áχ;š<̪Œ)*ªÂpE~çÅZc.§b‹G;Á¨‰7\îNkÔË÷ôY•p^×i‹ô=¥ž;°ÓêËOªuxâ^%;¢ -ñçKòXN{D¥ JþÍ&€ao…€æhˆikRxW¦ar¨úôÿÕyEÅsÏë¼Ç9£sAú®ÎÏØëüʼn§u>8ñ¯ë¼Síw<;2šŽ0‘ZSêáîˆ*4t":€žÞ±-;äÎ榤†Á 9§PQu¥uFhWòŸ°Äp11©U¼›2ê>Ã.G jöeãSå¦me`Ž Sîa’·©™ç2UóBžQ##̘®ë÷ ݳϠ:qÄÀ^£O’%©ˆàyŸmÏN­^Ï rí[½ˆÿ ò¶d’ý±,°@‹ÓwÁ5š¶ôõð&¤­Ðw¤ËÛR)†&–ªÌîÛ‰¦ÐU–ß6…K>scO®]*áôý•£Yør(h̵ï‰=¸‹gD*ÌdÃ#®«aÑ·ì¼áDÍ1ãV£²«îºý¬Éþ+Õ¼JAÎvñª8¨~+`#6®°piò«gù}‰“}{XÖ4(Â$c”<㊠òrżèåi}–«ûRè.)Z®•ð{’°šVr§ËŸ`Ö¹!*¯e¸Ü6èøe!çüTʤ“NO΋4tìq?ÐÝ‹CÝ·hNˆ¤S íA7uMð†SšÀA&4²Ú}#ƒ@2\Üv÷!Á—oÊM{©%X»•¢£E:Î;51WiÓ¦:y˜Uä°µ Ž®¦!MOôEC¾ñÈg¦Í =Ž¸ –žu¨‘®n|E ²–‡øœ(ÿ`ÕÎËV¬„ STÞZ'Ïù•à´îmcã¬Í8hؘúó¿ÈI¶Q¤Í"+OyGEàtu™ïÄ᱿å/å Õ=WÛ®È/mÉ㈠Š¤‘\ v&ߘ?­.cÔÇ®¨AUÃg¬áÙ½ô0Izo…™<žÈE#®2VåQ~-Ò4‘¸”§JãCEðàí‚nžôXQ %g2˜ß; >ع_sM¡ñ 8êAç7x•p=ãÒÄ´j½Ò|8.ÔIû|=À¡V@êk9®?xs”²4‹¯"‹ž -ÁöÆÇrìPhq^ð}¹Ó;>¿bå,æp´cÕ âÓYýÛvh¹¾:Ïvóê«´ - HÔ=€þ(›ç9gAvn¼²`LÅ+¸‰š«´/ı¤1zŠ}6ßÓƒLÎÏ@ˆ†ñœ÷—] 1‡.d¨qûPVθÖ4»¼‰r  ¾}€Ž!<XKN$Üw÷3yŸög•<ºnsÌ$+êÛ2yÝcà ^M%¦ï²›’òT)뮲àû­DB‰99òY7òÀoüÑÀAþº·¡C+;™¸-úÛ 4øDpòÚ ÿYë¯ýÍͱB':„<­-­0›YšÍ¦#ç¥Û¿R0Ò€á?€1& endstream -endobj -6042 0 obj << -/Type /Page -/Contents 6043 0 R -/Resources 6041 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6020 0 R +6319 0 obj << +/D [6315 0 R /XYZ 85.039 285.359 null] >> endobj -6044 0 obj << -/D [6042 0 R /XYZ 85.039 781.388 null] +1850 0 obj << +/D [6315 0 R /XYZ 85.039 285.359 null] >> endobj -1814 0 obj << -/D [6042 0 R /XYZ 85.039 340.005 null] +6320 0 obj << +/D [6315 0 R /XYZ 85.039 247.828 null] >> endobj -6045 0 obj << -/D [6042 0 R /XYZ 85.039 297.657 null] +1854 0 obj << +/D [6315 0 R /XYZ 85.039 181.355 null] >> endobj -6041 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F58 3360 0 R /F41 2994 0 R /F62 4047 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +6321 0 obj << +/D [6315 0 R /XYZ 85.039 144.488 null] +>> endobj +6314 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F41 3054 0 R /F62 4159 0 R /F20 3021 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6048 0 obj << -/Length 1394 +6325 0 obj << +/Length 1497 /Filter /FlateDecode >> stream -xÚ¥WßoÛ6~÷_!äe0±ü)‘†!Í’6–f©‹bhû XŽ#Ô–I®“ÿ~w$%+¶œ>,’w¼ûîøÝ‘a…?hE¨0AªZ³Õ„ ¼0¯{•x óf:yu¡’€Qb¨ ¦w;;ŠH%‚iþ%<{wz==¿‰b!DÈ ‰â4Õá٧눅ÝêõÍåÕôòê-Î$,²ðÓ5Š?ÜDZ„S§tyµŸþóæÔÍ¡Ñ·éûÉù´GÚcTa>L¾|£A!½ŸP"Œ¶0¦„x5œDIáçËÉÇÉ¿½)'“Û5–•N#攤œºKMê݉=wâÀ b˜Å˜'. åàGHØÉäPe_s˜Q%xˆ¢v½ûZ„©6„¥"±+I0©PøÕåŠëàï -;p1c’(–BÌL¡LÏ€$ 41ð TZv#‰–©eÀWªh?lÿ¤¸@%ˆDFõXL ïöăMðpß2¸(›z´Ñ–‡,E8¯.˜ìK4á^ïãÔMÓ1¼=¾Nçß3?û–¾%P»„,¬aT” ÇüYÄÓðV²¢ôet€Lk’¦éK™ $({F¢"rà'ûµêA:b¸z±Ÿž’”©>O¤À!™ ú‰` I¡Ñ`šÀ$ÔZ+i³jµ‚¼T˜–$ Ï뺊 ëæHOè쌇 Ç£©x,UÄ(ñ ,”¬R°<ÕP€ÏÀ²!bEÃÏLJóèÏ–8—­Ÿfåo~hÕš6[.qž„y]ü˜×GÂê<¾„| sHÇÎŽ„Ä3׶/"-êŽb)yøÙÒQKÉ€ÀPäja¹ZFÜ„mã4ëùñc¡á¼EÞúñº¶QE\÷,·öJ¤ö -æÞJ[9Émƒ²ß®;ï]5Ô^ûKåmhï –øñ:Â}77›¯”%'¶?YIöJ`¾-3€äʦ¥êôÛ¢O!ú{?È1ô↧…ItL.10”oQRÙSFÙÂò“¶ÎJ˜…w½ŸK¦­Ö¶÷_º…'krã¥_æNÄC«œ$¯Po[.«Ì[ÚE²rªè´®üä£;0w‹#rŒz1ÞDvÔÛé- ŒRö¼h¸/š“ÙfÝdyÞ¬nO\y|`Ÿ¯WYóÝRká¤w® 8YB`¥òŵΚf‹*š©s_r¥ÛPÚœ@µÍ˼èL"ÝÑü®¤‚Á7ùI*:G«AKÕÊÝ ï2<5Ç'ô.wÇ …6êlc¯‹%ONð§SÞt|š×¹…þ™Á݆ÜÝŽÏoU -O¿Dûë±YE‚‡·LÜ´ÍÇ®SIÀ©×o+çcQ Ý×.±ˆ¡uòÌ öè³™m>Õ¦o$>®ÿð¥è¢à®AA`õÆ_ ù:Ì8\þ$»”#ŠY‡Ô‚ɹ¤rלéXfwù2%\»ôIcÍÚè„ñv+§Þ÷ö ž¬‘Ћ0+ø¤¹w ƒÛbï‘cvX„Q¶>QÁuK[Ÿ ±»<ªn‹×Ç‹½«i½`ôd ™$p¤j§tk;köÝͪß[ÝâYz‚®»ÂÓðnðy¹·Ñ¶ýÃí¦WS„€£÷‹-Óm1›»)^^ÛÂzs`_[? ß6^üb1 dÝ]‹¸š9;xáe6k½* ?Ç[íXëÞºãO!Ó/½þúž'¡ 3Þò焳 æ¹Wa‰hqøŸFN[endstream +xÚ¥WmoÛ6þî_! J3ÃW½Ê-iš[—%.ú¡ëÙVla±”Zr‚þûÝñH[r”"@ "äÝñg ø“Qf¹Ðy”f’ë,‹›‰ˆV°òn"ý.‹KÌ&'ç6‰¤à¹È£Ù­Û2[~f§¿_ÍÞ^ÇS­5“9§iš±ÓW±d7$½º¾ü0»üðg„’}¼Â忯ãL³Yüeö~òvÖ3;5Ü$í~|þ"¢%¸ö~"¸Î³èÆ‚Ë<6c5·FûùÝäfòÏ^ ­™ˆNÜnvL•à©ROÍ¥yêÍé#sú‰9pZò<×c–„Q­á¤Uý-Ç[-7|Æ-ÑW0d<|‡i–s™&N$à¥HÂâÉåFË謿¢ƒkRf<“î îËQóáëÒœ¨‘4ŸW«Ý¶„ f.Ë2ŬœKÛÛ›d\åÖx}œÖÔðT‹¾}go ã`ïÒEɶ0ªêi«”­ARTµ?6•™y’z-,WB"!5ËQðOäYþ +9Ï•}Æ^Üæû +S YÛ†êJ2 Åe­`ÿJm»û¶X.ÛÍü'ˆB’²·1 +£ÕÄÚÛ‘Ò‚K=ë–”ƒ7£‰™­!'*MÙ.F`ÅÏ›[ü&Á»° +N†á&VCqÛªzÀiÙÒi<õ¡¡±#‡3¯MHsç-Ü‚¸ÙÒõo*ï„sÚ²ì¯ÒYl‹•?ûi]Á† é`!e爮°péݹBuNoëþ“!4—6ÌxîâñÉa±#nÛT«5Þª#dvkÒ‚K÷¨±™ß•šÏÑ+ß•*å"'•ê ðÀ.¥Ù77;œ(VÖÅÜßE²%Ê$hÇëÕÎv¹¥}.Î; ”d+ÒÕÔtä—‰¦ßÐÙºji´qy-êö5V|ÎÎ’üpª±ž*8^ÐY:Z­©@ ¿ÒÛß‘q“…õ?›EÑU襅DžÀÍj¸R;¢W + 1óÇ~{F­ñë”; }ë„ýlÆ´§\:"y‰Ó'{¯Ÿ*²,Ù¡›ƒÒ’ŠîAx[Pt"X忽|‘€ŠoKÑß¾ +jÕyâU#g,ù¢©oÇÈ[r%R¿³Ûƒ:ˆ5Ub'ª›Ž|X–sßhV,œï´Óoíÿ µãuÓv”•jÕ0HÇdZh¶Ý9\»±cÔ2GO˜E ãhbÛlÔF[vÙùÔåý¸ +Ò€ŒEl¡2wøÞ,G…i“¾y*¼_qÍ®ôÓ[úî±ký¡ï]À_¹tå×tåÝ·83ìKá˜ïyõ2vq•ÄUØA\+ÏJäŠÈÃ3À8]ÁÇ\ú÷òZA„uúzD¥M üM„ôpQO/èÛ›yÑœ‘¾Üš¾x`  ¯'†ºØ”#Nj‘s•äGů,O´-2>òq'¾$Ok]'<ËÍýYµ±j@¿ +¡Y"%oK—ð® +$‰q¯ê±(¥/*Se®M’êîóÛ„wÕ§ +§¦àÑÎ?HEíOù ì!âžzX{Í›‘~Bª„‹L?×BVRýÂþÆøþæݬʺ£Îæ´¨_ÅtMœ5u].ü„È%e7&ørƒ§î5Ä—Ð;<Öì.þ~³ó±õØôÄ@ªÒ„—¡ÝÄÞyÛÝ®I˜Í¹µ>Ð_c$6±[—®—ýDÈ•ïnA"ˆ2\'‡³}¹ã¤ÀVOÝÑÑè†ÊŽc¾ +xœø ÎùN‰dØ©¡–‡ª|D ø› "wæXZz\îÖžcà‡c¿ÅX"ש?¸ÖÝù¾*=°8÷ý|çaxè[šÐ4•#(á·Ó¡‡ø슟¶e²_§†køåH»~Ѽ¯B¡}#7x÷…Þ®!У )èy¦ö”ûc¿^5v{úþ.HµÈŽ]” „Á ý§›¯°endstream endobj -6047 0 obj << +6324 0 obj << /Type /Page -/Contents 6048 0 R -/Resources 6046 0 R +/Contents 6325 0 R +/Resources 6323 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6020 0 R +/Parent 6322 0 R >> endobj -6039 0 obj << +6312 0 obj << /Type /XObject /Subtype /Image /Width 559 @@ -26261,374 +27904,337 @@ Q /2%)-+™üÍôéÓ7mÚ„ kkkg̘¨`´wïÞÈÈÈíÛ·w^•¥@z÷îÝ–v#ê Q€ —È> endobj -6050 0 obj << -/D [6047 0 R /XYZ 85.039 758.673 null] ->> endobj -6051 0 obj << -/D [6047 0 R /XYZ 85.039 758.673 null] ->> endobj -6052 0 obj << -/D [6047 0 R /XYZ 309.807 377.657 null] +6326 0 obj << +/D [6324 0 R /XYZ 85.039 781.388 null] >> endobj -1818 0 obj << -/D [6047 0 R /XYZ 85.039 327.715 null] +6327 0 obj << +/D [6324 0 R /XYZ 85.039 758.673 null] >> endobj -6053 0 obj << -/D [6047 0 R /XYZ 85.039 305.953 null] +6328 0 obj << +/D [6324 0 R /XYZ 308.292 418.359 null] >> endobj -1822 0 obj << -/D [6047 0 R /XYZ 85.039 305.953 null] +1858 0 obj << +/D [6324 0 R /XYZ 85.039 368.417 null] >> endobj -6054 0 obj << -/D [6047 0 R /XYZ 85.039 271.411 null] +6329 0 obj << +/D [6324 0 R /XYZ 85.039 348.088 null] >> endobj -1826 0 obj << -/D [6047 0 R /XYZ 85.039 213.377 null] +1862 0 obj << +/D [6324 0 R /XYZ 85.039 197.231 null] >> endobj -6055 0 obj << -/D [6047 0 R /XYZ 85.039 178.631 null] +6330 0 obj << +/D [6324 0 R /XYZ 85.039 165.113 null] >> endobj -6046 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R /F20 2961 0 R >> -/XObject << /Im28 6039 0 R >> +6323 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F20 3021 0 R /F38 3057 0 R /F58 3380 0 R /F35 3036 0 R /F59 3455 0 R /F81 5323 0 R >> +/XObject << /Im31 6312 0 R >> /ProcSet [ /PDF /Text /ImageC ] >> endobj -6058 0 obj << -/Length 3322 -/Filter /FlateDecode ->> -stream -xÚ¥ZYÛF~Ÿ_!L‡Ý¼³› Æ_IÖžõŒ‘ ?pDJ",‘ -I2ùõ[Wó¨Y/q¬>ª»««ëøªh5qà?5‰|ÛqãI)Û¢Éb{áLV0óæB Å\Hæ=šw—¯ý`¢;vâÉݲÛÇ·=ßÜ¥Ÿ­—o¯nî^}œÍ]×µTlÏæaY/?ÝÌ”uË£7ß½¿{÷þ ö<TÖ§œþðq¹Ö½{ßM_ýóÅ÷\Û™}¹ûéâÕ]ËiËp#›\|þâLR¸ÒOŽíÆÑämÇV0½½>mßs¥¿¹¸½øW»Ïy^5&C1‡›ÅÚZr²½Àm%§aVÙ±ï÷%ç;¶ïx$9ØR;6\סù¾cMû]¤i½½ŸÂõƒÐZå0ýÕÜ›‚ˆ”Ub'°nn®yôwGy›Œ—Là*«âÉ´•…; ¶² -µm9c ¬®“UÆýÃ:ßà÷†ÇÐ8¼Ç®á) bqíØ‹è:yÍ ü^6xË¿<Ï—HX?Eó*!”ƒ{·¯Ù…ÉpìÛ­; 7ÊV¡ -&ì’Ød <Ø"»îw5G[#ö00½›Eï±Ý]c©¦|LšWfw0©ÖqÁš¼Óð­ác˜K1± -¸ÉrD…|mÇ‘˜oç“u˜ñàê~`%›œT‘&` us/l‘+–Ù\î›Ëv‡ -—ò#JpÀæg‚V B[?¢:’³PÀaÄñ‡PÀ(ðYÏ3 Ø|IñlÆ·Ç^YÙB:$ -ø½M¶÷ÉxÐ5¿ˆŶÿôE:’³±×÷C°]äSñCºï ´­ÍýÉ -=W6²oÉEQrfh’>Íô9Žø`ˆ}6%¤.—­C,d„3RÙWÜpŒ«ý Ktét|}Ç}k›ì°!J«½JÝðÌ>Ý°‚ÒwzŸ}Ãs LqÕfÃ#¢ÏLŸ0Ã1Þ‚pNžòPVU¢çØÛJZ‰ïÌ «ïà·¡I¾Î#ÅóÑEóâk¯—4Lwxd£4+r#AaÐè3…ŽÎ ! ¶7= -….8–‚À·Å¹!ï ‹¬&Ôb¯mLÄ¡% -I”…î‘ãˆ8 ´õ³y0\Å‘È1zw]K¬Cºß’nøÔ´çÙ¡×BÃ9ɆXŠpÈ_‘rc•É´+s|*ª'àYÄ}ª6¿!Îg¦$Cè±Xã‡ÐC+áI Kf*0oZîÛPÊãKÒEŒ2aØ ´kö»“±²NæEGµm3<˜^ehCQȺ…{°c¦ìy¨ù·Ó]¬²SÛT¤Ñ+HÝ<­­«‚âJÐAg¥æ¡Ø3¦°ç>p6ÚÌÚ9ö&¡¬(»x Œ±âIÃs'Æ£©jä;ƒ³përE"øÞ7b¿ŽSSFøëÖE™áø)ù}"$™¦¹‰¸I#õ™q¿â!Ò(¸¡¿Ly€=7«ˆŽ+á‘¿GqF€CÖ(‚½¨R‘ÒCãFܘŽcÿ•Ä#a)´hk¸ÓÝš/<ñQ^dq “1ñl"°êÐâ¸fä®”Ì(·óWÀ‰õžÏRš+@š73 ˜ž(綬™ÆlÁŽ­á´(¯×\6ñ(&ÄPô -»Š˜¸i•ÍÅÒzky?>Ï YhTùjml–šð/Û¿0páTÛNëÀ±”æbÍþ3–±‘ðÏõ‡[&„„i›Ɇ{‡! E:’ãj ¾:0å&¬—Vu3Vq{E0*Æè¡š#®þâ²!­÷To}Ç8&›*–+ø3rŠ«íP›8óæêý5òõËë‘ }À³aÐm8VI l70•Ÿ~ñ;©jŽóïp W©¾¯8– &M‘o½ìgqâ‹Oä‚ÜÁu£oOƒ¶ÖÔFtL¦—š& Gj5’ì‹´gÌ´ˆ—à0C·k2Ñ(CFBƒt_Ïz/ŠÃå¥0‚|)ˆ©Ü(Çf¢±œÞôÒ9¬×Í”§È7l8/ÒìhËãå-\ãnÝòÞ/oÒT.…BÝƵý<ÛŒž¼Ï(Y;”!) `°÷\Ä3Ö%µñ¯±ú ‚Ô1 £ÖZ|…ñØ¢‹é3~Ø´ÙÉ×c'A5½Ó¬ÚMJ>ÿþÑK5Øïc©Wbä¶1Ña¤”幉‘ï¸h¤â=’qj,ªë§“ëÍÙäò-q‡Éu ÉõÕCI 9à2#$…9†è^Á(K‡%#Ö“~íŽL¾ÈW–vʉ²XÉ÷#´òs÷&Ãü/÷îhÎfÚZ‡väa>L:{Ђ+7¡ÑêS—â°‡äQ8ª£¿w,¡íÇÇ~Ï:“ÞŸÎ.ðö3ýa6œšÃ¢Ç)¡#“š›d¾w¬â¤05—(Qƒ¹6=¤ZB%в™ŠRžíÆCoM¥ptÓÑ2ápŠSEŠ Œ”¦ä5/%»+ï*<òX*ö†tÄ¢Ìÿ±!¹4Î K8ùÿ˜¶{92V.¯Ÿû!Ao2æÜœ?„ÂðH­B¤°'O@Ê:&RÇŠPI鉎B¿ÆÀJVð²d‡¥ÃòŒ «ÞÒèc—ŇÊ$î´…Ä’|ø½¨a LrVÞž†V¦ -»¢Ñ üÎ"°>fÛ²÷ÅqDQ¦-µ{<Ÿºäßî¾T°ì´rX¬ßµQ“OÐ4>ç=UC¤žô"=š³ÞSyž}ôå=ßùi·oýe#%HúÆK#)$=é+;¹HSm¼JÑzÝö‹y4älˆèËýÝ%—%Ù'› -}îƒú*—/ÿôMÝŸ{¿É¶dgEßÜž®ç÷hκÛ"ªÃ<¼Î+csh–]¶¹¡¯^Z»œŸmxz -˜dÊM ê÷Ü|¾ªÛ+¦ÙâøNˆÕ¯â?‘{•Å•ÔAªZ6Fóû [sÒůXíùˆ!ŒÁr9„Eð{Ï ÿ×UUî œÐTH¥_@rƒ/ï„âT‡âü¸Ð6ƒäȦ·ý¤ø½9T®©Jþr‘UM[¢ª’Lig}ŒkhfuÌÝu'¦éXM•ˆ˜é?þ&9§4¥6{Î’]ÇGð?öýsž®zïÚ‘{RøZÓG æ/§cÿ˜_ß꺧 ÿËFíCendstream +6333 0 obj << +/Length 3413 +/Filter /FlateDecode +>> +stream +xÚµZëoÛÈÿî¿Â +„N Éå3E[øì$͵qÜXFz¸ÜJ¤$"©”•ô¯ï¼vIJTbàZ1—ûœ™Ço†r/øç^Æí¨ä2Š][Åñåb{á\®`äÍ…+3œKßv‡~ž]¼x„—®c'Nr9[Ò”Yö›uý÷«»Ù«“©RÊr{2¢Øº~¸›¸Ö=÷Þ}x{;{{ûß|èt­‡;~ÿa+k6ù}öËÅ«YïØ©oû¡Âs¿\üö»s™i¿\8¶JâË´ÛM’Ëí…(;ð•¼o.î/þevá1ÿ’Wp7Õ3¦@uâã˜"ÇAbdàA· =A_°rîZ°Žu›€Ù0²®&S×Z,ª}ÙrLJ|Q•e¾h‹ªÄžÐZÖ8§ÚòÛǢ̪‰r­ö6Üé9Î×ÿ¾ãf“ĵêj?ßä͈è<;‰“3¼(×vƒî>Ý`ä>ß—ÀÇÏá¼È·¾M¼Øªöø¢¬´–^šQá\`ÛmžÉ”†g´k™z¨«rÅcû&ǹ5¿}rgYÉKþ5ÝâضÜä?Agìã^Àá‹×ªO©—8v´3½e5¯²ooÚ6¢ÀÍÆ_& µ¡5âÒŒÛ{&®«yºÀ¨£áÍ€&-‡†g¾úJ²­ê¼æŽC±Ù`+!¶ÜH™ý\ßDË3ÓRž-öÑèv'K;Õ–”ëx¶{I¥«´À-}V߇«æG†„r\Å,ÁÝ-õX%7X³uŽ +‰ƒÂ ìÈÌ@×.4²d<¥¾ñ”9µ[jë´Ô[/'¤ø¨£ÒÈxI%ô’Zóúh’ ݃þó/!r­ù~¢¥à ØoZ&L[”ê9ÞŒt1‹¸7X{Úëkq¿]…P‰d¢ á$²Ÿ¼¡¹éJ6hQåÓ¶7#ýLÚð¸1o§ÉEù™ßÐS#K+ϧídm–—E_L°&]°ï "¸¦óÀ,±v‡ÞÀë\Ëv¢2/&da˜0©=¶ë”Z@­ô¬S™¶HÙ s8¡ä~¤©¥9 +ôŒœ_EúÁÃz9SÑ¦ó Š‚Ä¿î¹5ÜñÔ€qov¾BPÖ_TöygßVç£>À‰YŸ]§ó:ÐF"‹ÕZÇ>'9Š}!D—ù2a™à.6*Ú‘'ã³ +}–(?nÜÈ™)¿ß¼gàŽí6¯·t+é†;…¾â*-3. àNÒ³vßíH£4ˆè~=ŠoNôJÜAœ„X&ß±.6bº‘;< IjœÜV<2§m„œºâ­eNUK†‰º¨Iî(„Š%Ô)F-ŠÿÎP£\Úk‰÷*ˆÍqM]ÍSDl +ˆ²÷ÚåÄHØijïÆ‘™KxznïÛ×¥öxÔózlô‹!T(?JoÖ<µDµÑoÝ¡ˆðLZÔ +wƒ†z¶—¨s‘"NÄG8 ¦dxÕÞxî?ôà-în^V)ú-í™q>út}+T8ùf€  ʦÅR•(2‰Q‚qDÎ*ÊEU×Wa†ù²„K®o}È·U„Ó;Àµ§_¡c‡žÛ«2¡·]ò³¼©8zíJ;í¼‹X”t´\)¥D¯hÆü+رRÑ9÷Š¥)õD÷‰{}Ø­ÀLįFb!rï¹ç2 Üô N  +gVqØG{C¾Š§{JÿxJÎ"<ð(E¹¤òÇ6分} .#ZJ¨œC¤âPÊ}Û´Øp¶´)š–‡vœb6&‰&_¥u6ß!câ&ŒùmîÏ¿òVy]tæ  ªv8J ìäOe½éiò`r;P +þ\ï|$hSF÷!gXÊ7 +wýý}FÎrt +ï +ÍE]5ÕRTø$ëãE·³]ÉÜC7Õe‡^d;IL\¾.jíó$yÎôªMÞJòr•Ï³ rû*«zIÐtßhá +º©‚íªÏ…ˆ))-dùèAæ”°iÁ¸°ÍÖèãÞËæIƒúéÎ=M’µä÷ƒ?ñ’øGH§ Âõ’ˆ6vÌS.…­jvÔwWË1hç Kž€Ð=;Pꢣ×sÁ,›^í÷èˆ6‘Ò®r€¼€PÔFÆY;ÂË<ܽÁLªC›Gt%¡íš¤í˜œ–9‡ô~„&Èj!·3ëßÀM­áü#“1& Cê¦ea`t&ºkÄ‚ F«1 ä‘cñá×iùœ3NôѸcÌ€ù«Æ®I³¬!üŒ'ñW¨3©(6€ø#`Ž57ߊSà¢4î{wsýÂ7WÏ»jÂLªRD^W%6òEÕ‰®–„æõŒGkSü òžÞ„Ô ßJ®n£_þÛ.#¶fÁëo<Ü +™< Ù¤Õ Ïà NHååHå4Àö"­˜Füs†Ó‡y“k#¹yÿîêííT'žÊöPîíÕ»Wc_È|;6©š.‡PŃ~98ˆz¤îØ |’íãa¥#Nôö± PÕДBТ¬«6çH§¯Úì +u¾¿ÕlÒa!®y‰Åw°šªJ½˜Te7Î8!”BèØýï:8ÖÊÁT`¥i/ãz&)® +ûAÙÔ!”. ¬‰X`ße7Šì0ÔÈå©qÛÓ|·”峉‚sÁŠ@ÞäRFM";–ù“ZÐÏ€ªè,Äiü]'õJò)Nì²|Ùé°æŸ#xýß]@ØðDŠŸ…ùbݦú€”ÃÒ‡lKßöhƒµPÀ_ܶÂM/¢C =ëírHÇ)R=®Úhê€-ö ˜ò!å)O)é'2ƒüZ’Â’±ÛþºavѦ 2ǽª²ƒ‰4‚·m¨z$CCfIé÷)u­¥ÇvÏ$ ªÉqü;ÂK¥¿ÅJiîH@'7¡ÌO`šAåÖ—ï§ØKÆFá£c«ð ÐþبTPÄðó]w®œä˜B7”Ÿßôü/Ò€R‹endstream endobj -6057 0 obj << +6332 0 obj << /Type /Page -/Contents 6058 0 R -/Resources 6056 0 R +/Contents 6333 0 R +/Resources 6331 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6065 0 R +/Parent 6322 0 R >> endobj -6059 0 obj << -/D [6057 0 R /XYZ 85.039 781.388 null] +6334 0 obj << +/D [6332 0 R /XYZ 85.039 781.388 null] >> endobj -1830 0 obj << -/D [6057 0 R /XYZ 85.039 761.463 null] +1866 0 obj << +/D [6332 0 R /XYZ 85.039 761.463 null] >> endobj -6060 0 obj << -/D [6057 0 R /XYZ 85.039 727.186 null] +6335 0 obj << +/D [6332 0 R /XYZ 85.039 740.47 null] >> endobj -1834 0 obj << -/D [6057 0 R /XYZ 85.039 617.28 null] +1870 0 obj << +/D [6332 0 R /XYZ 85.039 535.777 null] >> endobj -6061 0 obj << -/D [6057 0 R /XYZ 85.039 582.534 null] +6336 0 obj << +/D [6332 0 R /XYZ 85.039 501.638 null] >> endobj -1838 0 obj << -/D [6057 0 R /XYZ 85.039 526.219 null] +1874 0 obj << +/D [6332 0 R /XYZ 85.039 418.527 null] >> endobj -6062 0 obj << -/D [6057 0 R /XYZ 85.039 491.415 null] +6337 0 obj << +/D [6332 0 R /XYZ 85.039 384.084 null] >> endobj -1842 0 obj << -/D [6057 0 R /XYZ 85.039 287.329 null] +1878 0 obj << +/D [6332 0 R /XYZ 85.039 273.572 null] >> endobj -6063 0 obj << -/D [6057 0 R /XYZ 85.039 252.583 null] +6338 0 obj << +/D [6332 0 R /XYZ 85.039 239.433 null] >> endobj -1846 0 obj << -/D [6057 0 R /XYZ 85.039 169.776 null] +1882 0 obj << +/D [6332 0 R /XYZ 85.039 169.568 null] >> endobj -6064 0 obj << -/D [6057 0 R /XYZ 85.039 121.082 null] +6339 0 obj << +/D [6332 0 R /XYZ 85.039 137.753 null] >> endobj -6056 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F38 2997 0 R /F58 3360 0 R /F62 4047 0 R /F41 2994 0 R >> +6331 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F62 4159 0 R /F59 3455 0 R /F38 3057 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6068 0 obj << -/Length 2967 +6342 0 obj << +/Length 2831 /Filter /FlateDecode >> stream -xÚ¥YYsã6~÷¯péaCÕŽh‚xäa·Ï'v¬©™­$´DÉÜ‘H…¤ìÒ¿ß¾@Qç>lÍ!  ÑÇ×Ý ºàºN¬èô:N”¯“äzºº -®0óáJ ÅHHF=šŸ&W7ïmt­? ÒëÉ|·õÕדÙïÞÝÏ·ãÉ»ÏÑÖÚS©?ÅqâÝ}•÷È£ãÏ÷“û‡Ø30¨¼/cœþôy˜hoÂD÷»éÛ?ÝrOûÁðÏÉ/Wï&§ÀUŠlþuõûŸÁõ ®ôËUàë4¹~…và+˜^]Ÿ¾5ZúË«Ç«u[ñœ¹æU§¤â(Fp³4´—%)ßDº“\³ÊO­íKξ I¶ ®›€Ð¬ ¼»¬üº-\=Š½M“sc0ݬ›l6kV0ù4)oÀU‰¿ŠYyÍf<ÓäõK^sûgŸ ˜>ó¶n -=jã-ÒÝ“¶I|§—ï¿£¡û+{ÂrTä눮ÿ¶ŽLxÛa˜xÕ†;fMy9÷ÛgjÀ•K˜É¾#mŽó³!‰ijØ·h·¨y ÌVù?Á,ƒl ®‚­l/<Ìä·hݱ@S4|ô+šáÛ‡£H%ž(Ĵ¹'^9ú¿o?}¼½¡8AJ#…f”Ò½n?¾Ãá›÷Fõ¤µƒÛDSÎð—©öĨC?]<¦‹k›z#äåÚqè­ñ’E‰ŒµyàÍtÒÛ, gÐfÿ8qš -}#Ó6@T-Y¥ˆÈµñSŬm~œ“,ê -Í›Lচã¯@ Æt°HŒo È3`Š9:ær–×Èh¨þ–ù”¥Â»<: ¯å~<ŽÐ_WkB’nó–eÞÈþ™ãmº,˜gaµäßî¶aè Þ·}qï3ÛfOÞ›eòœ;üGÙ5ˆ\,ÙåL´}¤N6~”tA†DOî>8\ç»À0sfÔ‡&Ñ\ŽH(œíÎ^p7ÒEÓfî(gÖHºgÖp@Ñ>ÛCÃáZzˆÍ{‚``¸G+°QK$ê<Á²WÜÜ°g!4ÎU¼EÆÝ2åF_€d1‘¦pš;‡cgr»8ΡÍ:°q.@ G4-☲Œc°P4nÝ’ƒ/v˜ßŠÄÑOKwNB"ž ×tÁc;©ÚNq5Cø®Àئ阄{¢?KZ§Œéú[øq¬/eæ,úƒx ߌ÷ñà”ÀW²¯ð×›oÈϘq|ðê¡F¡:QMœùåÓM I‹f¡R&§ —ŠøÌ]0´—+ WÉ1è¨B©~ZÔ•E6á¿ x´AÈÙi>´¡‡¼r~KìâäXâ xý‰ü$k—‚¬2ZÌÜRHê(݃øaÅét•$Œ)Y‚¸;¹*ðÃæˆkb‘†`·)%"ÌȉÅ5ÐHªb>ŒLñFHÕ!)\͇ҟ­$"ÂrßVÇäÃ+FÐ:<«\qjÉöÈ)Oônv˜¾ì]ã½\ŽR™¹øƒ¤´‹4¾GÞ/ÛyÎú T.Z]¶˜ÍYë7¡ñSX¿Ú³þ¾éOInyÙ²#+3Èr¿ÛçÞ¨ê'Úš€µ¥”G2£iVrƒìÅåJ|ï+ -°{$˜˜c·¿W·d) «È$Pí6òÓ$&¥§&¡»ôÔgÝÏ §æ²0w4gs.G~bø•ŒbÆ&w£Ðû6Æ_rÍ-{¨ÓhÈâö±¹4¼í -3¦¤ -¡µ0õSÖè@X@M\5…ëW´2Æ‘œë²Ç-¯Ü®¹×›|&K$ìaóÈŽc©óœ0V%z¹îP¯$cšüÓ†KÅJváÖ.Pà`&Ä}ž‚ÞËco±Ì\dCêy%$ù~ÌÙrÂÂ@3sIg,t ®Z’~r÷yÊXg¼¿L¬öJišêI3°M±lþŠòDˆ½£õ„Zì†ýL<„lj,JçŠeÑ}ë‚9"üeÃS„Ûøê,“ó¬æ¡ê#OåÓ)ÿwµÄa.ëpá=½Hò7.@Æ¢ÙR`âñ9Û-xŒLÉ?>òÀCÞRyYÕßOf¶Iâ‡Q$ç’º}/?@…Ê€ G—­hGsÖ-T’úF– úD6Âgü±:ÃÛç?=š³V­¬õÃT÷ò˜oãÑ#JCí*B6myíŲ™vÚµø”}¬YF¾Só¸b&îE@Ô!4?cÕ’7m§Ü©$ÕHVu¦?ÝžÒgøVŽÇÒ´‘ý:oÜUÝm‹¥xµK¦~Ï›¬1©Xn»2žBI˜Æ~F{¶IðŠÄUìö‡¸¦Ò""lÀßW Ý+í®ˆ¼/M—„ЪØ[`»Ú¬Ùdο›fÿ9‡í¿x÷%“|•Ü#<`}·å}?ñç k½ÿì^¦€îÝŒŠ¨ªÆÌÌoQñx{ÊWVôÊÈ‚æk–ŽïKç®*P¥Aõ™‘bѪR KC*t‹ZG)Ò#ª(ŸÈ‹Š)¤‚1è+5Zy#+a{(9°æ¥º a¨ÈÊÍä ¿ÃËÓ]+ß#Pt'õÑcCÛePßœ4#&r/%"JcÙ®`b?lw0ÉqW*R·{/!nä¹tdâ3bÖÚ7q(½#y¹<Åuâ&ô•q+ȽLܽ{Ò£¯‚¤§Æ†Ë:~:(¹S•è&Iœëâ /íq¯rãJšàw•MŸ»¹¼ám -ÙbNQsó=*·"•£ïŸÐN²HõN; èõßz7b{aè‡j?É£h\=QrLžœFý:äI1ŧnpJ®Ñ(÷€!ü¥åCÉ))“¦+áêmÑü/õh?Ž‰UõÉ{_ƒœF”íi:¢eØØE+0Á‡Æ~¼4*b(´… ›]ž}ÊBûQbv±‘…l }sÞ{¬g€$QzTqŸ -O¿òu/!î……«Ìe•ÉW=\6'®ä»tÆŸù2÷ºB|¸ÌÏg±ÕNGøÇ·ø¿>_ïž -´Ÿè3^-§ã¥¦Ñ!¿V'¾Mô1Ãÿ«ª©endstream -endobj -6067 0 obj << -/Type /Page -/Contents 6068 0 R -/Resources 6066 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6065 0 R ->> endobj -6069 0 obj << -/D [6067 0 R /XYZ 85.039 781.388 null] ->> endobj -1850 0 obj << -/D [6067 0 R /XYZ 85.039 761.463 null] ->> endobj -6070 0 obj << -/D [6067 0 R /XYZ 85.039 741.134 null] ->> endobj -1854 0 obj << -/D [6067 0 R /XYZ 85.039 671.269 null] ->> endobj -6071 0 obj << -/D [6067 0 R /XYZ 85.039 637.13 null] ->> endobj -1858 0 obj << -/D [6067 0 R /XYZ 85.039 540.773 null] ->> endobj -6072 0 obj << -/D [6067 0 R /XYZ 85.039 505.363 null] ->> endobj -1862 0 obj << -/D [6067 0 R /XYZ 85.039 450.318 null] ->> endobj -6073 0 obj << -/D [6067 0 R /XYZ 85.039 403.949 null] ->> endobj -1866 0 obj << -/D [6067 0 R /XYZ 85.039 307.389 null] ->> endobj -6074 0 obj << -/D [6067 0 R /XYZ 85.039 270.522 null] ->> endobj -1870 0 obj << -/D [6067 0 R /XYZ 85.039 214.206 null] ->> endobj -6075 0 obj << -/D [6067 0 R /XYZ 85.039 182.391 null] ->> endobj -6066 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F38 2997 0 R /F58 3360 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -6078 0 obj << -/Length 2863 -/Filter /FlateDecode ->> -stream -xÚÅZÝsã¶÷_¡ñK©™B€ß}éø.éÝ%í{q¦é¤y %ZbO"UŠ>Çÿ}÷ $d‘Hš>t<âc],û[,¤!üéEž¨0*Y®U”ç‹õá*\l¡çí•Š•¬š×wW_ý9I:TEX,îÆy'ÑânóSðæÝÍíÝ7Ÿ–«(Š]¨å*ËòàÍ·K|Ï­·ŸÞ¸{ÿá-ÖbhÔÁ·ØýñÓ2‚;&zÿaì¾ùëë®E*\þ|÷íÕ7wƒ¤ƒ Ubþû꧟ÃÅ–ôíU¨¢"_Ð,(l¥Ñ’ -R¯EüÁõÖ0sD<»¥fæ ʃ²í.æ$ [î¹g£Ùrë¨Gè²$¥°AÂrßn­ÄXíQ>8æ¹³i&ÎUh2¥=UË$:œ˜òl{#0p£…Ù°ÒVp*š…æ]M{„ŽB‡ÁÍ*{G ®ª¬´(êiB<Ø{8q~¦Ó}‹R¶Ÿ'„4 dš[!w¬Þ$:•”®YâØæûðœTRx௨ƒÃ„L:Ê”˜lH˜jJc&Ri,dO»²çɇm‹LÔ¼ñUƒv!²ý]%dAc%©6"[Ë_9\¹Ùê·üDÛÑÑn·¬J¾è‡;aH–ºÒ¹Qy–ž)—¦B#å©pŒLž›˜Ãw#_ØafŠüÁR•²ÑØøh…·E닃wlú×2UÞ¢å? Hp3ù.’ísg+ßoÿøÒ›eZe¹Y¤q¢Ò/.$+‡fÒ›Å:æ!Õ¼äUÀ{9ŸOQ¨pÃås·«xÅâºSÏ˽~²N£m¶×Üæx‹ ]عu¢’hõ„dåÐÌË(4„h/yé0¸+¼Ì,Ÿ›áÈÃÁqÙ}cJBe…ñÛÒH3oLBƒrD³Öäa6š“Û`O»¿€CF û,'Áêzßr¨°–Aˆ1.wcóa9âZg½ÛJ¼0\Èwoe~x€ëÏ{à5 ‰†e„~Xph&a!Ï¢aTÇëIXðqbXðò±»ìð`áT­éÀ8*üÈçp‚µšY1-|Ìcôr³Æè²û?#CœÂ-O~ Ž4ó/8ø˜ôq4谛ć8OÈYã׆ÃqŽANÝjÇýsð%ºëß -qÁ7ָȎ§Ý d°?瀀B `Aü Ÿ‘žÛꉕ à€t¿È]1w0¢˜Äˆ•I#•%fÚ#­±ëk¾L™‹.Àø½¿C3o.Bãõþ>f£¹ø¸ æâ°{CF’ŸÙµÞC—jØ,{Uz[5Œ”pA˜8w¡J“á~YÞÏh0*ŒÊ²È«A‡fVƒ–¹Åsô14èåf5è²óhîÁûÚ/Zd*É."”U”äC4²¤ó„ÅßD)Ü<²Ä¯Ð‘f^¡Bƒ‚%³ -õ0êã6(ÔawÀ×TO㥱¶ÁG„çc…ª±7ÐïøF}´q‹\w/âg¨Zo·rÆ­*­ÏoÈ1]œí~‘¨«lŽ‡.Ð$Þ\”çLf’·6Jqh&£”Ìèa2ºÉ(Ålj£/»õŽRBL¢Ôèá7¯07i­Ú¯9xé†Ü׺¿æž³€eGšåÄÙ¶ý†‰Æô Tlv Ì]„ -ž®=8=—ïÇ`aKwJu4[ò_Cº¢gë²Ã$!I -if’ê(ì´šÊü±­˜ÀÕ%ŽP³1Ü°~ áÊ{Žr±kxÓÙ˜‚öc‹C3»›–ÆÌù˜ ÙËÍd—ãã0dÏXäsØ©bp…7èé6_àZEn‘f349„ÔÙ4˜Á G1:xGw‘Ãoð/Ý5æ‹"¨¾ — ´àg¾õ†^N4‡Áõ[ÊÁqFÚÒo˜æ#¹÷kL&ëTEÃ]£qCEæ!å[›²ÓîÜ[Z"éÐí¶ª­£wVrÕÉÂ9÷*Jï¸A‚`ô¸•¦#å ¿àÙW["8qÆ{Æþ + -ýY‡fÞþ„Æ -û˜öçã6ØŸÃî÷Ç6çPü5¡p‰*#ßÕ;ürÑ™2…LrO.¦'§0«e+¦~-4óZoéc6jÙÇmвÃî〦d?‹®^DA=¿‘û£†!.b8º§W\$_J)‹m–X`â†Räஓ_s!£'¸Ü¾¤P&Jÿ‹ýÓ°áÜoÿšÙý³4ÞøÕÇlØ?/7».; ·2#áV…[ÐÞžÝÈÅñà³gªƒ7íáX -òãÐ1g”Eò“ñ{}wÒÐB©Ã½Î y­SõºÜ3ŪåY†5Âf„^h½~mw4¹ÆÝ~ߨèšq}¶‹/€õ*ÌY_£ˆ…v=v(WÏŠ{ÊFÞ#±‡ÂJ|öc' ‘9‘âS'`À{±!á7]BõøÕ‘ *a_VQÏç€ôŠ/Ûá«Ðcå}9Ä7"l%žh'èøì¸ïliÕÌh# ý„ΞP^z-u"$œýúÒj•ªkaVã{ö@WŽñ¼7Î[®¼1öŒ³2¡ÄåÝ¡lÄd½<\Þl‡p/ÓñòåÕ*ùéÇ}ÏVˆ]Ø‚/Yô^츬Ëë;™s -~þ=Oá(‚!yT]JXK¾Ž¢-¯ùÐ5ú­1éП˜ˆo`Ë•Œv1’3U¤¶©JÁ™WÜr&@S áÔì¼ë–×/¦×¤pb¹‘#éæÒ{ÂÉQ&±¾"Ž$A/ -æ~ °º>õt¥ÄKß¹²3¸&„aØÑy©¤ˆ%†hˆÞ%©h¿'IÃvÀbè„qt|‘‰JUA“xi¾&·œ´Ÿ~é6™Í–Ì‹wª~ù^]›áå’Î\[nHá¸a¨ÊvÉã87IÀÉNêë}-¦,ã×¥,t_jà(N8Ãк“¸0Í•&ìUÉ>b*‹` Ümè"Y«É…Ëõ*{:¦ò¤¹½‹Š¯‹ØÙ¶û=sçˆ@X|]K§rͯÚK~ ž¶1ëMm|t3…À:QaaóFÖÎ^L¢¢á!þõä±JCf§A;:Þ¹Ô̯fÌdB6\ÈNüO?[~yG*f’º l§ÑV -›‹ì¥¼I±œ ÿ5L·endstream +xÚµYYsÛF~ׯ`ùaV ƒ™Áá‡Ý²µ>”ŠeF¢ÊÞŠó‘ ‰0(…ÿ~û˜A:b×–ª„AÏîž>¾nŠ‘bkÏ—É(Š…'ãx4[Ÿø£%Ì|8f…?Ržjœz;=yõ^‡#á{‰ŸŒ¦ Z2ÿîœ~|3™¾»»RJG$ÞØ¢Ø9½šŒ…sÉÔÉÅÙùôìü¾) +çj‚ÓŸ/Ʊt¦ã?¦¿œ¼›ö>ë*O…¿ûçÉïø£9°öˉïÉ$ÝÁØ÷D’ŒÖ'JKO+iÞ‹“˓ߺSxNx×€t®]á×I ‡5à¢Ä:étYE÷u äÂÅcWkßù’Ã[9»Â©ÆR8w FNàû½ú:á—¿V0ðYZ !t.³Ù·Ô¸»ÃÔŽWNðŒªj>ù W50x1 ¼ÀKâäi¤ð„ÞߨÐ7Š\1s¥bâ +?·#cí¦v<1 p,~ˆºÆqÚ[VÂƪåqZNÝñk»Êx—M si‹"V%«?ñËe“/K+ùœésâèÏËê4ŸøÒù&¤" "‡Ø›gÛ?bõÑ-£)$$þ'@*XDäYƒlËk+š²• 'z’áT»âïá8ÇutÈC“dÄm(#>7$K‰m‰Íšé‡2òyéþ“ÞÀýK¸Qù9Ú“Qø\sÆœßÌ×y‰iÚ:m+´Ìš-ó4-KRŒÏèžðÙœ' PË\Ãì‚Ál{c׺@ä\áGp‘kȆ•'Àmµá/¤ó9ß0„ƒn„ÂY¥4Wìýˆ¦Ñ@>½åññm4¼¯ Ÿ)¯CcÛ­™;Žk}….<«_ð†ë´ÉÑDU œ)ÚFn>»¦©1¤ÁÜøŽwokøÖùA67[Ðm*Û€‰[ã "ál(Ø”ø9¸+¤ùÎ*_3÷Åæˆkq‚ueŒÉÅ#Ã&Ss Õ]ï@ršÛ±†éu±ÿü¢2K2{«qwMjåP4ßcå¼Ä±ßCÿÜò®u¾\Ñ—øõyJùÞø|«™¨)fª§…knó¢µü«íl‚˜¸Pt¸´ò&ÅÃò"oó¾…Áú:>Ù8ÁAIoÐÏç¨ÀS22GQD¹:Œ=!åþ¾à-’B~ªMtŒ”±Õœm•(…¹3¸æRÕ’éVDšEB»ÊùNñ¥*3ŒV¡v>qŒ¾¶Ž‰³©9ºZRä¤Ó̺T»i™D” +í¤˜3%ݶÕÂ5ħbǤ¼ q‘¼wI†t0ëži’ŸwAàî…z Eñ0 <Å#O%Ñs£x`¢ø„]ÝDëSˆƒËŒÇç$8ì‡;Îï1Ðo˦«†I¤=Ü1Åu.&Éž#´Í ‘zÄ"y<–¿G³Á0!Ex™™2CŸ§€â¼DZâ`J‚{Y B; B@!1`óùô矙bd|æJ\%cÕ†^\Zf{àò¶âg½- ’Üî­çi¡ïE§]‚{%ùzÀ“dìi›•&äßè3a ùøæ …JhZö4™$žªohß|í×ºëœ ¸=f,݃g%çžšþ?&dÙÞd@ʆpu¹JAûK~!S¡‹—OïÃÖó¬Å-wø¯Âcnš¡°!´6lä}ÅÂøƒÈF@,yÐ'”=Û%äNÿŠ‚LИ/'â)ä!Ÿƒ<¾NÜK”D`îÔÎ>ÅÖ&£a¾™u`6 …FŸ]0§™rnçú¶ç^06mëÎHȇ @w‡@ßñr´ ¬,V>Pwª­ó£RÜ8ï"p‡ìauä‘©ÍÃôî8Ê¡g(¡QZ£‚€43|¬©p¡Eh=J0jgnCcà®yÉUÓ³iYSŒÞ4挟aARÃæㆱvÎJ^ó·WÛ ¯¼ñwLþ|Fáü—ë–‰ïæTŒUõKŒðñŠéÖ¥ÐÐzFÐÏwÀ9:G¢ÓªD·]nk ýèò²Ÿ–…x:±NñÏO@4iâr«çÛŒ?0'p½kº(žEs‘‰þ´ =†O}ZÙº¿*Á˜ þÕ§i™KE^àÇÏ=½+‚dâqС W#¢FálÅúcr¶|$¥Jup=èR'G9HlI-¿Ø›–}.D—@YyÞ•j!Øs«”çwb“'KSÝ{|¦ò=Ú«½¢*¤ƒÔˆ–U‰ âh!¢å!J´º£¡âsÎVy™™s ¨uE¢)ë–Y^ó²÷Uqr¹'Kx±¯zš¬õª +¶ Uˆ}àï AÚœ´VY”… ›*ž¥AgyÛ-Pu”x:¶:üwÞ<¨ëÄ‹; ªê¡£$H ¿GÃlE"ôüD¶ ŽµÞ2hÀ!£é!3Aiy!Ý`{ŠÁS +Q€@[¿8êú*òõXTéÜ4|ÖÕšW]¦k\C—ÂÓÆ3Ê9NÙPª5Á÷Gšú¹¹V ÂÏÏÈÀ¦‡,ý¶B׸Â.†QÆù@9MËŸZ¾µ°{g46‡3J 1ÏéØ;³™ûo”îÿ³]o iñ +Xh~^‘–ü–·ÿ»LŸñû5çܖ߸;†'Ö•)ƒgǘ«ï¯Ã´ž›=œÙcBÀDàöBc–Rr†i"Y€¾¶-¦7ÍõòªÚ.W þ"ÄÁV”ë–BÙ ñ‡ò&|Gr¡“YHƒs=¦ÀóÚ`.ú„¿×žôãnUÚûD +59c•š°¥“>Д`®=T­1)fJâ ï‘~?ÀËý& å’ª…ÐX-qBÚÈXôÕÙl¸Pèù‘ýjQ!{ÕÍwðM¯>Öêržä‚2åv–Aaºëø o&2ƪÜo¦6$6’VÙš)Ç©w+ƒ%ðe5ÜwêºeÔ_C¯T°O°¨WCí»VxÔ¾V‡B5¦EfÀ-¡FÁ<'½¾Õ€=Þ;¯ÃœÁåQóÜ÷0€ÚU©mI±_±ãe+å|d30a:7»W]\fú“6©Llsó·+z^ßF(K £‘Aõ8ÜÍi¯=“ÞÜ?9öÁ§µ§´~êÀéÊ´µ{…(IqgÝ¢¢‘(ØŽ£fÌë¡pA6üm&†Ê4~Š‘ãÓýc!©|þ^é>÷Ú¹t;Á¬ÀU…zOÃUIEØ*{A¿á̳ú(åBùj’ +$PÁS¼_)–I_þ€F.l‹ÕžÆ½Á_T8Éö~ĉŽZÉH£’sìC±á [lÔÙºj³ åR$†î5áÛ’«j’BÙè%‰U/ÉOŸåš˜3}ì}I“yÉÏYexýËL¬÷íÜíÓØ)®õ1þ³9~««³… å,kyÃ× x?TÑÐÅ$p1ê©‹™ Û?Ôï¿í_mãÕÄÀv BöÓ.¼ÎŠŠ“$UO¸©äf6ŽëŒ mfp¨k +û.^tùc¨y–ó=úÝó¦ËeÇʘDò1ÿÚéåaáßÞ?92ªŽ• `ÕÓÌß —.J&<=ðs½1ËûÝ\FØ:T<7Gá&ôd¨Uö?¡»´þendstream endobj -6077 0 obj << +6341 0 obj << /Type /Page -/Contents 6078 0 R -/Resources 6076 0 R +/Contents 6342 0 R +/Resources 6340 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6065 0 R +/Parent 6322 0 R >> endobj -6079 0 obj << -/D [6077 0 R /XYZ 85.039 781.388 null] ->> endobj -1874 0 obj << -/D [6077 0 R /XYZ 85.039 761.463 null] ->> endobj -6080 0 obj << -/D [6077 0 R /XYZ 85.039 740.47 null] +6343 0 obj << +/D [6341 0 R /XYZ 85.039 781.388 null] >> endobj -6081 0 obj << -/D [6077 0 R /XYZ 85.039 672.724 null] +1886 0 obj << +/D [6341 0 R /XYZ 85.039 761.463 null] >> endobj -6082 0 obj << -/D [6077 0 R /XYZ 85.039 640.515 null] +6344 0 obj << +/D [6341 0 R /XYZ 85.039 740.47 null] >> endobj -6083 0 obj << -/D [6077 0 R /XYZ 85.039 613.417 null] +1890 0 obj << +/D [6341 0 R /XYZ 85.039 685.425 null] >> endobj -6084 0 obj << -/D [6077 0 R /XYZ 85.039 572.769 null] +6345 0 obj << +/D [6341 0 R /XYZ 85.039 653.004 null] >> endobj -6085 0 obj << -/D [6077 0 R /XYZ 85.039 542.682 null] +1894 0 obj << +/D [6341 0 R /XYZ 85.039 556.443 null] >> endobj -6086 0 obj << -/D [6077 0 R /XYZ 85.039 512.595 null] +6346 0 obj << +/D [6341 0 R /XYZ 85.039 519.576 null] >> endobj -6087 0 obj << -/D [6077 0 R /XYZ 85.039 485.497 null] +1898 0 obj << +/D [6341 0 R /XYZ 85.039 463.261 null] >> endobj -6088 0 obj << -/D [6077 0 R /XYZ 85.039 444.849 null] +6347 0 obj << +/D [6341 0 R /XYZ 85.039 431.446 null] >> endobj -6089 0 obj << -/D [6077 0 R /XYZ 85.039 419.872 null] +1902 0 obj << +/D [6341 0 R /XYZ 85.039 319.215 null] >> endobj -6090 0 obj << -/D [6077 0 R /XYZ 85.039 390.652 null] +6348 0 obj << +/D [6341 0 R /XYZ 85.039 283.805 null] >> endobj -6091 0 obj << -/D [6077 0 R /XYZ 85.039 360.565 null] +6349 0 obj << +/D [6341 0 R /XYZ 85.039 216.059 null] >> endobj -6092 0 obj << -/D [6077 0 R /XYZ 85.039 316.323 null] +6350 0 obj << +/D [6341 0 R /XYZ 85.039 186.84 null] >> endobj -6093 0 obj << -/D [6077 0 R /XYZ 85.039 275.675 null] +6351 0 obj << +/D [6341 0 R /XYZ 85.039 159.135 null] >> endobj -6094 0 obj << -/D [6077 0 R /XYZ 85.039 249.183 null] +6352 0 obj << +/D [6341 0 R /XYZ 85.039 119.094 null] >> endobj -6095 0 obj << -/D [6077 0 R /XYZ 85.039 222.084 null] +6353 0 obj << +/D [6341 0 R /XYZ 85.039 91.389 null] >> endobj -6076 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +6340 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F62 4159 0 R /F38 3057 0 R /F35 3036 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6099 0 obj << -/Length 3630 -/Filter /FlateDecode ->> -stream -xÚ­ZYoãF~÷¯0ŒBÅîæ »ë9’8‡Ç;–1 ’y EJb†"’ÇÙ?¿u5EÉ”'‹] Æ컫«ëøªZê܃ê<\Ï$çQ¬\Çç‹Í™w¾‚žoΔŒ˜Êé`Ì‹ùÙìë ¢ˆEIc™sù¡èÖ#$% ÈÇCÑÏ“(ròö«C+4ÈÕQÀÈíÙK|¯—¢h@’µT‘?à2óÔÚõ“ð€§i7fÀp»å’ý¦CÝïEËïèÒ¯ç3ýý짾Dl¿ZòÜn797¥¶°m@”Sæ«°ÐHÜ/_á†]‹lñÃçåÙ$ÚMü@Xóª&3P¡ÐÖÈZ–ÄÀI[9¼ þ¶^v˺"å“ÍaÃQcƒ‚©‰%»»ì_ànçHæI˜ð}…÷5{0“~¨¯'pøº“l6(±—?Gi%9ÅH©p|¢óàøØŠ^W£’e7èW_ œ¯i6Ò^Ÿf»ï†VÛÞìXîxߢÊG¶1«´ G¾cE‡¤á„àÎèRÖ— mßÝ.šb+b õ‡·aî•Ü¤¿`¯Š—´ä¦Gš¼ã -  Àc‘ -$©]qkGú³»GÒe #ÎåOE6iŠ[À–n’E5o¾¤HPcµ@ˆl¹(k3Çë^s÷„» -}ߢèYw5sÒ[‡`)}OyëP¼õb·mÓ,kÑ+ܳ‡ÍPÚ%ò­U-¾üab<‡\/ùêÜ-̃þ*°2ñÈ-½"HË2ÏxÒ—jŠJôkìô*r½O~?椳à«A’Iï ²B$a5ÁæD:;cyðAÅð){6lÅ@5E±È¸ Œ/I}¨‡ÊúŒÓX¹ˆ·8Øk4ð÷©žDÊ”Õä îõq±ÉÐÒÆÎWø!¤5sƒ‹£¡ffè€zôèÄY Èêb3\a•nrÛWp#I6„¾I9´D~•5äMÞªDy ŒÃ>¸åÊõüXP@™ÜPh€,ôâOƒhãêhBOíZÓÁbOEʘÐM@Þì ’©9ÚñKŠînŸÐGô øø¿Ð(k}‚ÆظF'4Þ]ßÞ½|ùƒ’Û¯1pùyê÷2OJŠLÞ’øÕ-]EA^ûÑâ²àÖµ³u™Fló÷ׇPqÐŽ`Yë\Ô .šœe|UYlŠj¦œ ž|?}ä2D -–FòRô, o¯p^Æ«²j»®q£ž‡‚µ•Õ˜S¾÷Àú:' ~¨´rZCC±Zߣ‡­q¥fMÞ¶>…Ò¢»=Fù‡ÐXLd0:ÀÐÕ¡:à'Òm|= k»-Ù”>Uì0tã¾6[²ÜlJÒÑÜê£I ¸¶ce5À‡é‚¿Ÿñ˜Ý¦×ÞÜâÌö³‘ÃiO»Al§‹”ó–P—6örI(Q7!R"$é[|WIO:f² ¢,k²>@\BÎ…IÿBó§”AD¸þ‘œÖâ©ËràÇï°&ZÚ\ütY´H ÔÑjc0F †Ó–>±ðÀ€n7»‚Ø5=Ï4§›G!n•Õ)$ÀiÂÈÖÆœD~ŒJœ!HÀ zö¼Ùè¬[B÷ìcÚûþYËêd4,(gm*ÔrÆSW¹@‡&·(À¶¤K+e4’ÊébÍ5Ú#¿ç•y—îo|øõ,köCN¢?ðÁ±¿û–1£©@«=¼ÄŠˆ”= ˜4­Èöv- w²„w<ËK,¿Ä›ZêGŠíe^rGV4våEW7²+ -ôáš m¤ÕX*…;í - -°@M!láýmþû.o»·²‡ÞÞÒÌ>Nˆƒ›Y»åA–.ºû)Ûàع§› Aiø"äÉ\‹LF/¹‡?FpŒ…öíÝt=à’©ð‡0T'Ðõ%š@×SžÍ`s9Z²Z^¨%±ƒB* 80µA¼:0Õ®êC¿Æ殎Ã}„-: qÌ&ŽzH;¿àŽh_kîí+Þãa|ÏqÍFŠJ;óu~2,ST:°veC‘s7f³×ïÒ½E™HÊnñ«§LOÔ@’…‚[ÛÚ1©(@¶i(GÔ9&:]xÛvÆCQj´ AOæ.êjÉfhl|S„#:ůY?Xt-FÍvd8O0˜‰ç²¶öš³ÔÒ €r$F·Óqø¼È çqqGëŸ9à4Ðþ¸¡ÉË"½ç÷)ib(‘~Ö) Æœô—&ˆ(sè/cë/›}æȦ¬\Iˆ{acáí…Ãí’€`‚µ“lõ \nÐÁNy’ßþ­¾—RZYh•vË—‰^zÇf<€Eâ·Ägø¿ÀØQ\¯Â4J¿aFŠ?aú%Žíu•ŸJ¢lŠ~‹ Æœô¸ÆK\å±R_a ëG6Yâûèàö^˜Eû‘‡‘þfû)Yžr%¿Ç¬`ØVAøb9šA¬‚û\”Û |ôPn¾Ñ#ö[Th(¦/ÄP§%7ß]_ýÄ‹I8 mËZÖÇÉÍ•À:_¦}¼yΨ‡ aómš6LœMï aJoɱÒ¬H¼ƒER|˜Iy¨§×Ój*gA&`@X~Ñä)Ž†ÕKþ^\‘ð’( «´²ÝË2e“îê‚È6ÈÌvÄdmò>›Bÿ@#óýyÚY5µï{Šq;6Ÿò ¾gÐ2AeÍû\”¬H­êKv¯”79B9Ô†Ço–,$ÇB„&û<'x+ÍH(Ë´ZÕŠ§ݹý7J†#Õà÷Ò}BŸS8Ü 37\Bÿ䛀¨„*ó¥Êlr’fÞÛAË´]³ÅGQ´ó’2 •Ð.[¢Æ ]­íŽäN¹Ò²Hä`¸!/[*q¦8µ+UüÝ¡PýéY{k¨”nˆúBE7\G‘¼ÿ3åÅwÌz1PñÁät§¨»à½ -PIù#¶¶ÛÇ­&éúܭäÁõð>%Àñœ«fHÇ^¶¡gn'jå*n— ú€Œ2mV#Τ‚‹¤‹ÛC&»¹à¯¼â·d^]mr‹ðÇý¼Jb7Ižÿ­À`ÌI ¥"åúI|„¡ÁP?°éÃœUïqBñ8‘sIÔלȹ²öHà -f¨-@ã—ýÓE¾ÈÛ–Óy–5==påâàõãâ+B€*ŸH¿ Æœ„<ÊD® øgwöMû £¤ñ·ê0£„‘Åq2o$½º:±ñÙ®(Äà•€yn·ýiÕC‰Xžv3VzóNDäk”©?x”D!4ü´kð(—ÇÞð ù@¹›±× £!ÐÓéÜçè[]>gÏfü³ Êϳ©þÇìøÁ‚ ˆ¢ƒTÄôÚr¾Z®ÆÒ}±+ûㇿåƒXsz‡_ßYa>e<ëûjÿ -²ƒ3l[_r4(÷’$—ËUÚÉÏè² Óš-l{gôOq8ÓÜÓî$ËZ42”´jD¼LèÏaƒÙ¹>­âø€£—¯Þ¼xýùØ‘×õA"S«ãdŽÖ¤ˆô첤 ç´8Vèwuí{3+¶1{€M”'Ò{‡ÎÌ濹õ’_Ö¹lW“À± Ѻw…׶Π§—u*ä[¬6•Ó 9ñ¹›ÿ!¯¹”t  ÷å8VCûzp`¼l]SðM§Q—dÏ´Ÿs^´Ì}[t'ƒ‡Ï/#þ3©ÿÓoÈö¹RãÆæÄÏŸ J¢,-ÈÄÇô&¦Ç'ÿ?p¸endstream +6356 0 obj << +/Length 3045 +/Filter /FlateDecode +>> +stream +xÚåZmoÜÆþ®_qð—òßšûBr 0l)N”&¶jàq€RGžD˜G^Ižõ×w^vy¼-»I"( ‹Ë}ßÙ™gžžœ…ðOÎl$BÎ+…¶v¶Úœ„³hùîDºá̈0Ž°éåòäÙ«(žÉP¤a:[®©Ë2ÿ98ýþÅÅòÛ·ó…Ö:©˜/’ħWs\ríÅÛó×Ëó×ßá›J\]`ó›·s«ƒåü—å'ß.GË.Œ0±Æuÿyòó/á,‡­ýp +ÚÙ”C!Ót¶91‘‘Ñî½:¹<ùë0 ·™š8ÝÂèTDÊÎ:Öš©>VXc¡ä% £ dïÃH"qšðÈãI#a¢ès“¾ÙÎ* ŠùB5 +Ným«<{¥ÂÑc…´Òºh˺/ÚŽûLl”Heêú­› +䟭8Þ÷BøŸˆpZhV(£>·÷ë)@7êß!‘·åÍí\Ù _¬ªr5á|˜Ã&ASóålál ˆ¹JƒžØrØV8!A©µ°‘a[lš¾ØÎu°0a¬U¼ˆ•Áj·ín›®Ÿ0Íz“ h٬ιÐá^ŠªXá³?Úô +VÀÓ¿ö\±)¨b7±ã…Šdz…ÜÍ7 1æoû²˜R€H‚•øSNß» El&ï=…2Ÿ»¡Õ´!„´êo½öSºl‹—èÑóªiÛö°ñOŸáŸûo&üÿ§Õêâ‘ÕzdûöÈcŠÁ“,h•0©žùÇŒ0gE½¡O9-%´ŒPz…ìÌÏ׸¢æáq+E{Ï\ÏÍ`?dÌQ¼—ÚÜ ªfh¡÷Ô=w[ßAuÿô ¾¥x­î(Ô i0Z®­›ž `´7~ +ÆP8xeiÀ IvÏ&e•tˆ’±þï:OLÈJ2~q +&aÝWÅ„æ#.QQóMA\‚nUþ_8óI?uFÀ½ÎvUß‘S´,=ü<×tÓèÿPþþÍàrÕÞ;ñ­¼~²%hu~§ö¶uç09»îN#æ”c‡ÕÔ#/8u)2µ Ó¸È÷,áè ±v‡?ÿ*üÿ-Ÿñ¡,á}L+àµqîi…NƒÓf³eÈ€Ö=«À®µ¯mF­®®a/‰¾³åš2÷+sHSÒÕ©…Ö0ˆ8IóPÏo¦ÞO¸n› —_Šè‰ëÓZ…ã(â…ÐOƒ˜¶"äÅà8´ µžÁRFÚ=* A ³'nɈÕÜsK^¾¥v8'÷¸FÛ/žÏqjƒsˆGlê?õ<’º–N‚;~ß Ê=†û§,5uåVå€ +¦¬²®çR3\ÝS¾š»ÛAïoyÔÁ‘²ÀÖ»ªèÇ¢rˆ ðl]\1#^¯µ$æS!Å"OpÁT¦¬ªQ_">ÝQpÈ ·¡KÑ÷ìÃhÒ4pÚÕn²ÚQÇÊugÂ…k&§<ã RPÎ "ÑîÜ×MËC˜#C÷G¨¼1x×s|[Oœzï!@¾C 2$¯C­¬¸i/#Íí¸³bôbnÔ°Y(³€6n¯gÜ’‡¨ ÇèÍÏ ¡4êÓnu4½$e¥E8/€~Õ1³(Y¾N´PQâÙ¤ã/æ-%ƒ ÙZÙõ-Ve=›Ò|,ü,cñíSà‘FT<‹GÈ­O;D* +²|SÖ“[ Véøú0!¬2®G·¹ ”õ ÀÉ&ãœÅCqX‘ñâ5ž¸@Š”wj%dêÏ’¡½ý¯Ê!Þ1."kPwîPÅ«&Ë;nð7etD¼¶ÜŒÒóaÍKJVŽàÑtv<Ã*«¹êa6JiocŽ¯ÙXH­Æ@¸W™Òq4†ŸzB<À÷íYÛ’|Úê_G%¬4ÅwATeâ>¨ŠdìÀ–ÅAMUñêŒïäž Ç Û†€15GSiYÓ'6 +¸$Ò8ÜÚW’"1žn{­>šCèØ_ïËé)öŒ=»¦ÝÑ]óM¢Š=týÞÙH ê¨âéd4‘Äé଑—H‘âíµL&¡e3 EaðSƒÜ¡ NÐ)oÈÕðëËjWçxK¤3H)ËzD-Aýè +¡ç%òëåÇ¿+ë¼™kâç {5_ôqd+´Š>q>-I‘%#gà%ù8J)‚í 4IFè›m_nÊŒ'„üX¸ÜE>É–AG¬×DÀ\eŒ#m. V¯äãK^4-ðϲ*ûû©… è^¢ö˜&½_Ír^­ÿAÇàé°úâ’Ÿgc¼Ô ¤ªc‚¬ûŒ² ¥¢N=0^d7î4ç /ÛþÔ«âØì)xÝL¨¬Mýy «N ’6é¼&ÙxÇ;ðƒ;|'mBXz¸³T‰T©/ÚÙß'3Á$"‡„7Šõ§Òó2dj í§YÓ¥“ h…ŽÕ+C¹k»3R~ˆYËÕLK pzå{îGàrF0+Â;ºýœ1¯ãàûõò™ +Ã_Ÿý ?ñíB½ +8€’*8NW67ו‡òMÇõcñRÅš!½ÐŒ‡¤gZC¤‰Ìò®F?æ¼v猬Y÷ë¦îù ÜzÃ%ïâ'®&5ÂŒoæHáµÒÿ²†:¤ð cÂà~Uóà}¼ÉD˜Au–óä³+èyéÏ–ªCè·¶EH§ÃÆ7DÞºBiF_6õ”ÞEĉw Ž}ã2¿x°pX‰ò#Þìúª¬§8‡ ]ˆÇŸ6&I‚«ÎÅ%Úô ýdµî/Ǫ^nÑ1Äý8 +**®RÈ8M”k~ß3OxÉ\Hƒ³ß2ŸrNPÕ“êí®]Æ«\¼`8d0„¸®¿R¨Ý¶œ¾¢oA­#(!fÎôaBÉçYQ‘×-h]* dü¥œXàÍ`é…˜pOVƒ#–Ÿò¿ =‰_ècçñ‹Y–çúÝkv›g ªêøõuã¼ó;Ô¸†>½}`_zhªØ—¶~GÁ´Ÿ×]O ZQ:\ìmë¿ìz/ïçHý]ÜÐ7T¤l,=q #f›ÿƺT ŒlÚ°žò7¤Ë`>#µ0‘'i(<ÊXR”ÿAŒà ®'Œ ’‡£¼Ùçª;^Œ’–£ÝlXì îÑíV¬´÷nMqWÅùùãMF±ˆ†dµÁÅQðg|ÀDEïÑ! Á †@9bœH}â;\ZMqßA%Áü_¶aƒžMŽüYËû稑{ÜÁ“ë†ÇÑ°ËÏþî@Óg™©_¸–Ï(Òrn ðoüñÃÕåñn ˜ ÿ8óU·qõúòêôô[ÄÃËWø£Œò÷î3G¤]î¡éH®%aÚ=߯J­Pé!øûXôaêCg¨§ïUÀ§\x,Ýïã9ó· }ÖúºÛ@­ÉùLHeˆÞ)é2†±"›B•k÷+}(+Î'ñQ°üýÕýæDÞÅ„¡P2>ÔJ÷…Öå§4™ïm z…ó™UéRD9§ØÂMì¼Ý&8pQô»ÉŸ`X¡í©ÝÜ}ëbýì&+§òâÎÈ,ºV5íÀ¾¹ýŔƸqŒ‚ŸÆ-~ãˆ!D0‡yöüUendstream endobj -6098 0 obj << +6355 0 obj << /Type /Page -/Contents 6099 0 R -/Resources 6097 0 R +/Contents 6356 0 R +/Resources 6354 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6065 0 R +/Parent 6322 0 R >> endobj -6100 0 obj << -/D [6098 0 R /XYZ 85.039 781.388 null] +6357 0 obj << +/D [6355 0 R /XYZ 85.039 781.388 null] >> endobj -1878 0 obj << -/D [6098 0 R /XYZ 85.039 761.463 null] +6358 0 obj << +/D [6355 0 R /XYZ 85.039 761.463 null] >> endobj -6101 0 obj << -/D [6098 0 R /XYZ 85.039 741.134 null] +6359 0 obj << +/D [6355 0 R /XYZ 85.039 747.777 null] >> endobj -1882 0 obj << -/D [6098 0 R /XYZ 85.039 644.777 null] +6360 0 obj << +/D [6355 0 R /XYZ 85.039 707.735 null] >> endobj -6102 0 obj << -/D [6098 0 R /XYZ 85.039 610.031 null] +6361 0 obj << +/D [6355 0 R /XYZ 85.039 680.031 null] >> endobj -1886 0 obj << -/D [6098 0 R /XYZ 85.039 513.674 null] +6362 0 obj << +/D [6355 0 R /XYZ 85.039 652.932 null] >> endobj -6103 0 obj << -/D [6098 0 R /XYZ 85.039 478.265 null] +6363 0 obj << +/D [6355 0 R /XYZ 85.039 625.834 null] >> endobj -1890 0 obj << -/D [6098 0 R /XYZ 85.039 382.572 null] +6364 0 obj << +/D [6355 0 R /XYZ 85.039 599.342 null] >> endobj -6104 0 obj << -/D [6098 0 R /XYZ 85.039 333.878 null] +6365 0 obj << +/D [6355 0 R /XYZ 85.039 571.637 null] >> endobj -1894 0 obj << -/D [6098 0 R /XYZ 85.039 198.995 null] +6366 0 obj << +/D [6355 0 R /XYZ 85.039 530.99 null] >> endobj -6105 0 obj << -/D [6098 0 R /XYZ 85.039 162.128 null] +6367 0 obj << +/D [6355 0 R /XYZ 85.039 503.891 null] >> endobj -6097 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F62 4047 0 R /F38 2997 0 R /F77 4849 0 R >> +6368 0 obj << +/D [6355 0 R /XYZ 85.039 476.793 null] +>> endobj +1906 0 obj << +/D [6355 0 R /XYZ 85.039 336.596 null] +>> endobj +6369 0 obj << +/D [6355 0 R /XYZ 85.039 302.456 null] +>> endobj +1910 0 obj << +/D [6355 0 R /XYZ 85.039 194.672 null] +>> endobj +6370 0 obj << +/D [6355 0 R /XYZ 85.039 157.805 null] +>> endobj +6354 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F59 3455 0 R /F58 3380 0 R /F35 3036 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6108 0 obj << -/Length 347 +6374 0 obj << +/Length 2636 /Filter /FlateDecode >> stream -xÚ¥’1oÂ0…wÿ -Ϋ/g'öˆRJS0b‚@‘ -¨€àï÷Bhˆ*èReðßóéÞ§ Ôü¡t4y™9rNÎ7BË+=WG|µÄ O;ˆ§g›JÔൗay›cÁX’a1U—Vº£(&"…¢8ËœêLòÕ¸ºÍGýaè{egøÕ$/å·QäH…ÊÔÞäÖk»Uu:š…è†zÓzÞÊ—k~‰éLËG ä€ Ðrá‰ì¢À»KáeÕ.¯AZçeQƒñqì•~oúbj<ÞûìA.¼~¯ÜNëtÂ96§Sú+YÃão¡5«]ír…mMVqõ-4¦‹í™Í»S7Þ}£Íó¥ðEt‚€ˆ ðK:µ÷€?.j¼G,—®d®…앱»@ðÈåt ‹|™(mxŒ5ÍxÍ-…rt@…=Àc¸ü&à1.¡=¯2š²)+¨=ÚiJ^­ÙX kríÎÖ¶%M¶HŒú;FQx¿Q€þèëŽÝÒ -²þ6ûzÈêæ¶dß‚ËlóD ¾ u‚xWÓz_rhçSš¶çN_›ÐN›ÜEöº? cÛcqØ×KQ«É"ÀtØžà‰I¨[ª``ÝJ!Á¦#:☠ÇPPAø„W GÔ¸ÁÍß±•2Î(?L„³­f5jÒ áÓzÈÕ¶¯µOAkÖ¤Û%T¾¤íó·¥'JÕÁî$/˜›¬#V~$œ«?﫼€ýU˜?A66i8ô˜ðf­Çë¡å’ØW:²“ìu3°P¨}ÕzcNÀϘS—ùÑ*$qDe·­ „›5 ë‚Û?ñcžay…Ñ÷DVÄ€Øü/Øê;a«[7¤€¾çŠ‡Àöú9&úžJ|%Ü4OI¦Œ£ÈK‘¦´û÷LL#L¹PŸ#y""Zp±âf(n"4€PÑÃÉ„y@ÜàŒéÁî „ ²NžC9¨{5àS¥}Ó®[ïæç< +Ø×BÛ~ˆýG ‚ê˜ãB21"xJáªK”ÀPFó·[V¡N‹¼AÁa,d¦S®vø¤ƒIÑc%÷Ë+«û.çÖaΆ†cα†°ÅLÜ÷$0׆·q•‘ …·a‡ +hÄ…öÅtÍòcNæA©(í¢Á²úÓͺÍSÄö3àì4Úµ8sx†‘/“ø{sír‡Š”´gû¯h×!;d\}“nQŸlÉÕß…TÛý+®ü ÇÕ“ ¾mɆ“‡Ä%? ¸œ×ƒ‰€<›ja^N®°*ÂS6g@©Èxر†µ”?Ý𘯧²-œÆn[k–Ü—­á+î†ÁoÏ3áí–q3‘FRø¼ÛÂÁߣUõr~Ò›àCý÷`”Ñ™ØXÝÊÝ~›ñ[B-b5èt˜—\e˜Eö^¡ÎåŽ+ÇMÚÅbjûÒ-¯Û•ˆ¹5»iãYÇc1åÂEk²,+uÛŠ˜ð¤;·¯q ùë‘+½Hrœí@n,8ãòÚ.duà|Ë®W¥ä$¶tËý~ãRÁÉt]•vþ6÷á2[¥èümÓusćúϪ˜UxÑ)YT¡d@¤6ëDÁœ© +ꔆ` p!}1cÄïÒ~ÓÂ~M¹ƒO«Œ è°|½á¡ä>Þ‘W—ì?ØÆÜÊDP»nãZ…úå&v:ºé¹±=Š‹# +>ú”ÖÌü{¬]°°m×"*ö$ÍrwëBaËÇÀÿÎÁÔÀ$·übköþVq9’‰”„ÄØzÇδÌòEÆKÐÍåMÃÆTyVûž¦9èÞaõÀ=Q ^‹$ªdOR˜·,/»—Pæ(:hÉH 씇m»ÒƒI³0±/#—u½®ÊcÝmʪ¹†)jN™¯Ë¡$Š‰§4, +€%,í ž‹ [p…À’H¢=6"Ù!g×±‹*ì0t‚„ +Ί8ìÓ&ÝiÐú`R¾)o"pÊ$œh*Ff'ÒK¼5‚ëäøš¥í€¢¤Ú^VèH®X¸xDE,ó4ˆ(=º‡•'\ž0‚öûÓk˜[ýRþóVëÌ¥”lUhÄœŽŠ V¶ŠØL’à4¸*‹]÷<~’J‰%çC¸Ÿ˜ä{CcÃÚ3[¸‡ +~RZÙG Ò³œÓ;Íé +Âz·¨ò½M(®\vôàŒÞåÛÌ&Š«r Ã+® Ñ]Б.—5½I½:“8ªÇðå¼ñÞ]‰ K‘ðU|ºáŒeˆ8‚ßÅ6·ÙÄ{ÆÀ-2öCã®ôô“è–7ö²ÁrמîU +*Ÿˆµ–mv(cA\":¾q/>Yi0ê œK.ßа¾·Ëí9»·[ö§»e(ý8ü.»á’ºcô›¦Ç¼Ý¡×yŸGSýÛ”)ƒ·ÉÉ}:è‘U臡ó|1 "ø7qþr¿@y“{þ®YMÖ>”tPap:Ç99Û/°‚‡#oµuŠ\Í(úº‹xÿAuŸa>Éð7OÃ!ppT{×>pT—ye'§=öÜb*÷´[gÎýaì ­{î¿üùãë·? ­ùàu‰TŠøÉ[Jà z8A|DmM9`»I|iÜÄŸ®®U0 †žPÇÞ¶€‰—ŽT’S¾ åÓû('JR{—ÅsUË=:Œ¹ª¹Õ¶?92x•tÁöÎsJÏ’PEÎ|ëeˆm ûxÙ·lè!%è¼vìñ‰@‹G±—®»<Ž¦kt›NJ¸…ñLÚK $h—¤ï¥í¦.ô¤ë¼±zN‰‘ñÃ@ŸããËXôø_ùðÕç°P©Œ÷‘²ì¬zȳ#S¶c}û Àíÿ­rgyvû|EY6¿ØÃ6h ¿$çÿùÀ /3ù%;†¹ÖÝÑoƒÝYR´YÈy¼÷£.Uºëv¢<ξØsëSòW²Ô¾íö·rïÙÔÄÏ”]ã¡$HXYX­G\¸}ÿ‚Éïò5Î\ÙuÜ™ýt~ÄC"yzçÜó“>CÔDéÃü°´ñƒàÌ““Ý ÿßÎdœÖn¶ã-EøTS)r¬ú†þ-BØyendstream endobj -6107 0 obj << +6373 0 obj << /Type /Page -/Contents 6108 0 R -/Resources 6106 0 R +/Contents 6374 0 R +/Resources 6372 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6065 0 R +/Parent 6322 0 R +/Annots [ 6380 0 R ] >> endobj -6109 0 obj << -/D [6107 0 R /XYZ 85.039 781.388 null] +6380 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [418.104 216.174 479.369 227.863] +/Subtype /Link +/A << /S /GoTo /D (a_small) >> >> endobj -1898 0 obj << -/D [6107 0 R /XYZ 85.039 761.463 null] +6375 0 obj << +/D [6373 0 R /XYZ 85.039 781.388 null] >> endobj -6110 0 obj << -/D [6107 0 R /XYZ 85.039 736.911 null] +1914 0 obj << +/D [6373 0 R /XYZ 85.039 761.463 null] >> endobj -6106 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +6376 0 obj << +/D [6373 0 R /XYZ 85.039 740.47 null] +>> endobj +1918 0 obj << +/D [6373 0 R /XYZ 85.039 617.679 null] +>> endobj +6377 0 obj << +/D [6373 0 R /XYZ 85.039 582.933 null] +>> endobj +1922 0 obj << +/D [6373 0 R /XYZ 85.039 407.402 null] +>> endobj +6378 0 obj << +/D [6373 0 R /XYZ 85.039 370.535 null] +>> endobj +1926 0 obj << +/D [6373 0 R /XYZ 85.039 286.553 null] +>> endobj +6379 0 obj << +/D [6373 0 R /XYZ 85.039 243.6 null] +>> endobj +6372 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F38 3057 0 R /F62 4159 0 R /F80 5161 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6113 0 obj << -/Length 511 +6384 0 obj << +/Length 428 /Filter /FlateDecode >> stream -xÚ¥TÁRÛ0½û+t´Þhµ’,õ(¡a¦ỉrÈ„6x†@¡aøý®,ÇqO/ŒglIûVû´ïÉ($?(œI^Tœ›]&Å–#—vˆ²ƒ”ÌYMfÆ -”à¥õ¯ã>´!Qßßæç_¦ËúbU”D”£‡¢¬*—Ÿß, ̯ãêr5_ÔóÅe˜i^ÄüfÂßV…£¼Ž ùâž~=›Æ,îê«ì¢î™ö˜•4_²Û;)îùHW™òN¼óXrx—1O0šºùcv}ï·Š1-bÖXWˆ’4xkNËU¾êÊQRŽNÊIQ"sVc•´%J+=(c†€:oxÄñ"ÀÈvýðmùURƒ¶.& w`7¬ Oæ;åÅçgæ%ŽÔJ$Öë8ÀÊöú[+Ýù‰7Þ@D°V·úÿF®ù…©N¡°6¬ë¤FtÒíCJỷÔÀƒÉ¾Ã¬Ù¾½þdǸւè—É Í Í:P>4.$|JɪŠ@#íÉ )¹ª$ûDrlé=ÓÃü•GÍÓ6:~S¨*à•uóWÞ›ýC{ûÍ?!çy·Þ7›”°VA¦ÿu·'Nš½Oì.Ô £²)†©Ø°ø±ë$Ûk‚Ö—ÀùÁÛÿ¦4A0õ¨F)PèÙ®,y«ɓ߈¡ö^t ῲ÷Cendstream +xÚ¥S¹RÃ0íõ*í­VkIt\P@¦b(˜‰gÎ0ü>ë#ärªŒ +I{½§}+ÔFêÀ`(j(=ž+£'â¹PØFíÀä\¹N +Õës®Ñ@4Q¯uHñüœ^‹óQšQ‚ÒÌûœÞSLîëp4¸.×Õ͉“ûaå¾¥’"},®Ôy±›9p9U¸ŸêáÑèg¡v¥ P úWÎ0F=WŽ ØQ{Ÿ©;uû_¥ñ9Ýdu¼.[FdÌ@È»p>úŽ¶àhNH#ÄH]HŽÁ +JŒ`£]ØdpÌr’ý)0\Û—{ÍÏéo0`Ñ®õös²úì]hé³Ü‚g¯3+ä±~¹×"ç¶Cä~9ùùzýB­1†J³^_š¶ŠÍƒ<Û„£mQ½ƒ(¥Í:~·Qc…7“ùX"&_r*ß&Í(Së“©XžÊ·Æò[.¦­ïçCßUÎûüiQŽ·9 £´"l’Ø r2NÒÇ eú½ïþ™•ÀÃ&Tª°Möü=¬2㟀¼ˆ%Où¯µ¿ç„´Ó°(w›ýú-cÞ\endstream endobj -6112 0 obj << +6383 0 obj << /Type /Page -/Contents 6113 0 R -/Resources 6111 0 R +/Contents 6384 0 R +/Resources 6382 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6065 0 R +/Parent 6388 0 R >> endobj -6040 0 obj << +6313 0 obj << /Type /XObject /Subtype /Image /Width 499 @@ -26741,45 +28347,41 @@ N Pfä™KPê \ly¶`†søw®ZWótùê~+ƈ‰vMì\w¸ò´L5jµ{ýõ×:t¨cÇŽAÛ²“F:å“$c744êÿ€¶›U|WüxäQôÂ’™#¿X‚²YTZ ®^½Z­Äàòƽ÷Þ›ý‘cÇàÇå=$RÊ­‰C HZ¶mÛ¶¢¢âÓO?…göØcË—/÷‚çÒK/% i{Íš54qÐ|%ÀŒ½3:9ÞèÒý“ƒ-Êí·Ä@„è²ÃÞõòä …>ƒä‰]”ÐÅiíA#þÕW_Mž3f mÐzVƒ ¢mÊõõõqÐ|$ÀôÞotéþIƒÁ–¥èKbÀ5º8Ø»^ž&š¸Ä.Lì ƒ}÷îÝtQ¦¿ÆO³ i.¤»Kª²$ö×_’ µ5`À€×^{MÕieKÚZ\m[tåÏ'Ü©û¾!öéàÁƒÅÅÅÊ“¾]Òu×]×ÜÜL‰ŽR£n6L¯!ùúÐûhÀ’¾ë½3:9Æèòù'EsO8ƒ³ÉNÑ—Ä@„è2nëiñï=Ñ‚’OìD4}útšYãÆ3®Ø³ i.¤»Kª²<ŠñD÷°ëׯ§ªÔÌÊ–´9´¸Ï0_‹®üy»ó¹+>Ä>Ñ=õ#<ÂízÏ.æÎûðÃÓ6]¹*++)œâ- |åÕ–Þùœctùü“ƒ-JÑ—Ä@„w:„&všhxWbç êË–-[»vmâÂ×BfÏž­ÎÊ6¤¹+Ý]R•®#Fèoõ%·>|˜ÜµuëÖ’’ï Ê–´9´¸>Á…üy‰óƒcab_…|ûí·¹]ï¿{íÚµ{ã7h»¶¶–¶ßzë­x ({‚o"࢚ëÑÉ1F—Ï?©3X¡}I Dx§ChbÇ?O¹q´áÄ8Fˆúž={h%©þƒß»wošY‰¬Dš»ÒÝ%UézöÙgõ¯;ÒÌ¥¾“»ÊÊÊÞyçu»jeKÚZ\¿¨[~+FâüàX‡X¯aÿþý´êS&|»ê4W^Ñ_Š.ßÇä ({‚o"à^ ÀõÎè丢+èŸÔ, €PŠ¾$"¼Ó!4±O˜0aÅŠÈäYrSNň4VE‹–Œü@)›‡xîܹúSß.Ø]Éø''~9‹è楸¸X½Àj!‰=F¤¹kU‹-J?R ›‡˜îæÞ}÷]n·…p0º’ñOËIì·ß~;AAAAAAAy¦ÿ®\»endstream endobj -6114 0 obj << -/D [6112 0 R /XYZ 85.039 781.388 null] ->> endobj -6115 0 obj << -/D [6112 0 R /XYZ 85.039 744.431 null] +6385 0 obj << +/D [6383 0 R /XYZ 85.039 781.388 null] >> endobj -6116 0 obj << -/D [6112 0 R /XYZ 85.039 744.431 null] +6386 0 obj << +/D [6383 0 R /XYZ 85.039 724.08 null] >> endobj -6117 0 obj << -/D [6112 0 R /XYZ 273.413 94.474 null] +6387 0 obj << +/D [6383 0 R /XYZ 273.413 114.825 null] >> endobj -6111 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R >> -/XObject << /Im29 6040 0 R >> +6382 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R >> +/XObject << /Im32 6313 0 R >> /ProcSet [ /PDF /Text /ImageC ] >> endobj -6120 0 obj << -/Length 499 +6391 0 obj << +/Length 417 /Filter /FlateDecode >> stream -xÚ¥”MoÛ0 †ïþ:Ú3¤¨ÏÝÒ®éR`©—:§¶‡bÍ‚K‡[û÷GÙŽ“9Æ.…[IñõÒ¤PRÁrT>pêû.CµËuFGÙ¹”'>u6™Y§!bTõã>ŒeU?ßç—_¦U}µ,JfÎ)BQzòËUUP~×®VËù¢ž/®ÓÌÈ"å«*™o—Eà¼næ‹£yúõbÚΰx¬o²«º'í„*&Ì×ìþÕ³é&CàÔ»ŒHÌ»L8Áîæ?³»ì[¿Uk3ª«ÊÁ£´Áéót>ú.ÒñY:T% ³ˤ0Éã=G§.C×T{aN.êUÅfýðm½’Èë6‚ØÈÌƃ}2ß1ªÏ¿MéJ"ÒÀ ç^ΩQÞ¢FÓȃ´+œIhñI^4¼*Mœ0T”µ;ÓYÁ!å1¦eÐ'2ì›fÛÍŸýZDRL,“Ù“0@G+yRÀ§3Ø ‡´aö×¹ áþÉ2اé‘UuhQ÷~ûRèÿ–áöeӮ߾¥¥õþm»~‚Œà´ýO{@Ölpr…FnÐBD¨E›ô±ÎÁ¦#ÐÙñ”"?ØœýÉ0ŽãŶZƒ¦(²”«mjÍx&CËAªÂÓ ð_°c -Åendstream +xÚ¥SÁRã0 ½û+tLV-ËŽmn,K¡ØPÒà ØNg¶°0 üþÊIZÚ4pa2“ØÒ³Þ³ôB`ä!ˆ '‘c„»µ2°”Ì™¢aÀ¡©|NýhÔdê+ ƒÉ$h~·æþ¦89?®›Óy©™¹ „¥!'‹º¤âº‹ÖóÙe3»<Ë;'A*uNÿš—‘‹¦¼m.Ôi³C«ºŠ3ﳺ¹5p/Ò.”ANÞemR‚µržÑ;î÷ÔµºÚVérºS#·Ó„„–ì!]H¡§ãЉh”xŒÉVÈAû* Û3„zt^4g< ‘oã›o«0DÓ‰·ÑÉlÍ ?ŸD|hJ %ÐVdw÷Òn¾íx+;2Þéjùúò “‹ít)åiM¦äw°UD›|àh8Îà0Ii³ËßòíÕØÚiQ÷®ù+yY=–6ÿVË.øTÚX¼å—h’¼`ÞVïyCb’»›¯š­Y:<ËèÄè!ŒÿÚʸé{f”*Á #?NAùdú¦ß9`6ÙG­Ï›Ìäš%­Ü~¿þÅÆØeendstream endobj -6119 0 obj << +6390 0 obj << /Type /Page -/Contents 6120 0 R -/Resources 6118 0 R +/Contents 6391 0 R +/Resources 6389 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6125 0 R +/Parent 6388 0 R >> endobj -6096 0 obj << +6371 0 obj << /Type /XObject /Subtype /Image /Width 780 /Height 1135 /BitsPerComponent 8 -/ColorSpace [/Indexed /DeviceRGB 31 6126 0 R] +/ColorSpace [/Indexed /DeviceRGB 31 6394 0 R] /Length 95337 /Filter /FlateDecode >> @@ -27082,7837 +28684,8402 @@ B ì²Ék§l"°ïFÄ2Ña9æ­Ó»Nè¸I5äCœ§˜ØÕZZæ} )í!Â2œ ÌÌš4Vµ9|•ÏE¡Uغ¥EÀ¸´gßrŠ©FKåŒ-ûÈrò$Eâm]‡Poá˜v1ôûÊØøYö=Âh¹ «>´íIØ5±< ""éIeÛUeC—=e˜_:„H'6 ¦ÝJDp£_ù½oC}“À¨ÁiFáöþ84jmá71<ìO0Ò.|Û§S(By¶“ˆû6öÃ8{ñ£ü_‹iC¿O•L]È-<ä}ÆœÑÙ=µpvOûü˜31ˆ7ùû²‰Ê¤Æ*ò¼4ãfCCÄG»t$ûÌŒ5‰„H‹lûQÑÔoï -«Ñúc¾ÓÔfblå7´X|R¦Q ý'(«R’‘‰Ž#ôü# Œ¥I,&9¢^â&xÖyµˆ`ãB)™0à±½…–v)4˜Jì.ª GìHŠ ˜¦˜.áL&b|ƒ¡ÿÀ¼“5þ<¥åŽeÙˆ.òÈåa+óìMÅÜÒ°´ªÈ±­²q­vŸSÃhx™êÊf‘—m;µs+ŠFÂÒOA96néYn3xa ÷>6Š6ôî4 ¢.ŠF8cî8½(mkÌó:*G;ijf+h6Žm;yIÂ2šE¿ˆl@çþ,’°ÉÇ¡Êãv´ì'O ?êÇRÙŠ<„ÿ|Ršüì†ÞžòD8yãŠbðòÚCØ‹>j"y@[P’¸¨½¶´G«EÞŠ°vòl€h¨„ÐÈv›¼ŽÓfa_ à9JáàÝ©›@Q÷€“dqÂ"¶K£hCoO`õe8¤a 0(ý¥Í1¸ƒ ¦_‰` ‰Sç"¯B1‡m8ˆÆI¦±ÌäKJ~™I/Z4‹]†%á;x>7“»s&j»%…=dEkmèí‰ -ËÇóË_3€Ú6xbÓXa5´)‹6l³¦µÜž¸ÙV3WQT”mâBÿo'uÛæz\02¾±EÔ/VÔ¤mmåFцޞÜqð±i̦~ñ41’QØ83Kª S•ÁÇ€ÒÊŽ‡˜êE…ØÅy£a¬ð3€)¥”ªu ü?¡ñ2¥DÄ ie2ô_/ÌóºHàþ°>çZeñqà}d®ôÿ–<á"endstream endobj -6126 0 obj << -/Length 107 +6394 0 obj << +/Length 107 +/Filter /FlateDecode +>> +stream +xÚ`ŸÿFFFÌÌÌšššÂÂÂõõõ666»»»úúú%%%ñññ³³³«««ééé“““íííýýý¢¢¢ŠŠŠ[[[ÕÕÕ‚‚‚ssskkk{{{bbbÚÚÚáááRRRåååÿÿÿ¡ò;Pendstream +endobj +6392 0 obj << +/D [6390 0 R /XYZ 85.039 781.388 null] +>> endobj +6381 0 obj << +/D [6390 0 R /XYZ 85.039 708.183 null] +>> endobj +6393 0 obj << +/D [6390 0 R /XYZ 289.792 130.722 null] +>> endobj +6389 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R >> +/XObject << /Im33 6371 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] +>> endobj +6397 0 obj << +/Length 1861 +/Filter /FlateDecode +>> +stream +xÚ­ËnÛFð®¯Ð‘"šË]¾ +ôРq ÐØ $9¬ÈµÍ†’Š¬¿ï¼{ó‰!ºë*\fè׸@ìZÔrÿ0AYöºÕ¥3 D”ÍHD¶ð3ßÓ,ónª~Æç‚ +ôv0N¼¢EäôÛt=ãt]3ଉÒô,Ò=#‰AVÙÔXþ}D€b 2ЕdÞZó'¼ï +{Ho|òɹƒ,£|¤“Aíô¨SeÁ< iséõlŠØJ™THœa–þ¿ªlÕþŽZ°šúb×÷ð[µ›*Nñ|q¾¹ƒŠ3Ýl†) +èÖv‹M©r™"c~ä:`Ì9ÌŒ f=@}6Œ(ÉTª-,¿jÌÚLd,¡j£‘t`Ìä"I Ï¥“byCúÜcÿŒóQ315¿¬€úଳ2º–»BÃ×=“½-‘PYUW‡{¸X™Y +Ç cf®:WaÑ=s·”¼Á|“™WW뎕±Lº³òNT;~jÂ|ûæ7rÆ¢À<ú-+hÒpóÞøË÷ÈͱÊÚó#¤3èÇ>H¿v5o0¸Ð —R[ +9|¬wF®)VÆšH¨áØ÷Æœ´¾×ä*vC)•÷>Þ}¸ú£"-¨ñ‘ ®ŒñЛ÷o>΋Š,g/nýLbSaìíðâT˜Ø +ÀÇkpÃÔ±×Ap|7€Ý¥ªHyEÒÔ|†ï—rÖzW“jÝ13uõðØîn7XS“5u‹>îmÀ“$Ä€3GÕŒ“OÛK#±[R¯IŸÁ†{y•4=UH~õê:Î&µ/a¿‰À;àa°µë¿LÁÃþ¬W$yäÊò_h'E{;¹•8V§Â §ñ·áºâyÚ(3Ír¬,º V ðD)v"¯ˆå¬mí#¼ÑÁ9•Ä°Ýd +¥a`V"A +Mvó¨ÇÊ«Í Î.ÌΖÁº½·©‰#‹€³ÉLél¹ÇqÜ»4µ9ŠâwÃ¥©Í$ë#:5©l…hþé i;ÀyjWSÔŸ^ð™bÌùÌ.ÈÖX؃£<ÆöϤî~ÉÀû×Ï „Wãõn}§YÑîx®)Qéé6ý´à‹á5‰jC/KŠù¾øü5\– îí" R¾8 $Tw³à ]Úïzq³øs:ïDç³û±€Õ9“r¹Jƒ8M¦ç¿ÿ).¿œ{– ^ÿ20=/”»ìïøŽïxïš +M]@ðÛ€fÚ¹Žï†Ñe©‚X$§6\Í9u`­O`À ›Ag=ÚdžÌä: \Ad»¥”±cH°M!u ]¬*,þÓ@xw‡¹Ý÷´ÓÖ» ïo2äGò¥ÖÔ (©¿;z÷âÀ/ÍìÇ)€%sO+7ßæ¤7Å<;ªÓµó¸–LË×)Ä’|à…s3ÖòÅà€‘Û!¯ÉÏ[¢Ÿ½>HW•Åw"³ç&]$² ÎY×Ó:¤ˆÏµD0GóXÍÏÑ¿LØä™endstream +endobj +6396 0 obj << +/Type /Page +/Contents 6397 0 R +/Resources 6395 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6388 0 R +/Annots [ 6401 0 R 6404 0 R ] +>> endobj +6401 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [441.346 377.246 508.036 388.936] +/Subtype /Link +/A << /S /GoTo /D (vfsrecyc) >> +>> endobj +6404 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [217.831 137.811 284.521 149.5] +/Subtype /Link +/A << /S /GoTo /D (multimodule) >> +>> endobj +6398 0 obj << +/D [6396 0 R /XYZ 85.039 781.388 null] +>> endobj +1930 0 obj << +/D [6396 0 R /XYZ 85.039 761.463 null] +>> endobj +3184 0 obj << +/D [6396 0 R /XYZ 85.039 657.513 null] +>> endobj +1934 0 obj << +/D [6396 0 R /XYZ 85.039 657.513 null] +>> endobj +6399 0 obj << +/D [6396 0 R /XYZ 85.039 615.228 null] +>> endobj +1938 0 obj << +/D [6396 0 R /XYZ 85.039 531.042 null] +>> endobj +6400 0 obj << +/D [6396 0 R /XYZ 85.039 488.757 null] +>> endobj +6402 0 obj << +/D [6396 0 R /XYZ 85.039 363.498 null] +>> endobj +6403 0 obj << +/D [6396 0 R /XYZ 280.235 369.471 null] +>> endobj +6395 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6408 0 obj << +/Length 1995 +/Filter /FlateDecode +>> +stream +xÚÕÛnÛFö]_¡G +(Gœ 9d€>¸ŽÓ¦›nÒX Èæ–(›-%zI:Žÿ~ÏeH‘ek·FáB€8œ9sæÜ/C9 à'§q(Lm,…Žãér3 ¦×°òãD:ˆ`jD…¸ôÃb2FSˆ$H¦‹5,VŸ½óŸÎ>,.>Î|­µ§1ó­½Ë™ô³X{g3{ç3_zÿ€©³pôî‚¡?½©Kÿòþõo0ï_?O.=*|#L¤‘ŒÿL> ¦+ ôçI tOïa™$ÓÍÄ„Z„F»÷br9ùµÃÂkfÊ»F˜õ[˜°JgëŽÓ{Çéƒã€h)’D$ü$SߊІ}ˆý'I]†#R¿ø¢J7(Í[JÑ üÕ«}ZPpœ÷O:Ž¹ÞÌ”õ®`]"úr £5+é>onxD@wxr“÷ øô†ô©<"­œù ý¬ßð—á\½Ož´V(£†ôhG0WP€¯#!¥ÙÙd<ÂÃç&«›/x)ՔвÜl²m3óCzßóƒHÆÁââr1²ç6E¦{æ«´Iû€!ÁÝWy“¥W(‰ðCV༪ÊûúTà¯ëš—Ë«ß³eS¶dßÒÍm‘½rO9˜‚ PFз;_v‚0~«t“5Y58GßùøÆpd#Ròø.»o%~( Î W¾W”.P ¥‰HTtä´6>ŸìOÁ´ÚD}û7Ô]ïív‰¦·BÛÏà_G‘÷ 8†–Þê®È:w?*ô1V­0à}: â -îÓ!=‰Ä€¬Ó»UÞÈj9-ÊšfæU[l»ê%›ßáKA~ùÀÃvôÝ~L9*i¡ÆRǤöÄø¨\|̾5‡E±P¡f9<žU´HL8šSp%ê‰r”˜ApîXµŠðG˜<%b/nrlu¿ Ëx®]ËW;åLo9i/-0i%mñ£æ†Œtþ&R½ãdyP©}nöˆÒ¾uè€ZzÚ¤t¤W4×wšÏ¾qž¸mZ"R7ʆ¨;ÓZ9ž€dís4§%Iü•<EVVwX©@ö„ í `ÙK>F‚Xj|Þ=ZlVüƳ²Í\#R +´ˆµÞÛP+ð¿“Kë€ >:è;ä,°ÝȆý¬Gx…±k•qYEö5+FN Á­¤qÐkˆa¾ Pà¹cùHm|çŽÖEÃð·<ìLG÷”FŠØ˜N(WòÁz„2 ÄBs ”3‡hËM—à6¢)‚ä+n_H›YÓp5PsðJ·+î]Hš!Â×ĉ甼r!qH}êGWmüÃíÊj•¹3©ªè¿!ûØ{‡ HÙó}­C!C¥/8yBõ(/U×S||¬‘£ö¼iÐÊýCLqìäæPÄ'P*Ĉ€ãía¿Cín¹ßžìwî²c&‰<î—àÄŽ“}è±æ-ÅZ¤…ÔÑ©¬R‡ÝìBJ«Æ3SÚBû®¼æÅ·[*6« W”®ÚåÔãn!ß°uHz –³·„Qæ„ü~›øh×Ãu KC7rÐC,P†€‚ñÒh—’FÕÉû|—}ÅÈahP˜$"€´ëwÈþo¢T("ˆ-ÿ U¯³&Í)à×<á³Ùá}Ï;;ä;rpv(÷øõý-…t×Y\y¨%eŸƒ;µ +e‡Ï·P/ÀÀeí]ŽºXpñB¡ŒSzøL–ø çX†w!}Î×Y›í9ø²ŠÑ¬Âç u ÂøYTþE”/Eƒ.ÃÑßpõc¯é¯ïÃL%¼¥Kùy]wÖq~“º O÷+‹x>§~¢ÛP™„yöôò—›N¶†0}?ÃËxºQ†“ó®wàºóQËy9éÀ7¼æ»^õÈ}¨‘•ÇzðTvR®]¾Nÿ˜é)EPÐñŸoÄçñ[ºœÍªM}Øã實{f®¸ÆZrèeÔI¹Œ‡W§íEŠL°«Œ©™Ä—ek~7!TŠÂæ¦ägZ]7Á3K¾]¡æšç> †²½zÅ»CÈ¢âUÞ†EM¾ûvC mï Ã]¿/]ÓÇÈÀ§´®¡‚ÉË”¿.¡£|`·ýÐvj#é#ÓvÕ¾ýöÏ·ÿÌ’ßH@Fõdƒ ˜À+·Ew#Å(o¾ÝEàƒK@tß +«(¾ÃhÇÖŒ)ßÖ È—Dnè^’¦™#ÀöoûHª;GîÚ> endobj +6414 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [419.195 254.193 470.581 265.883] +/Subtype /Link +/A << /S /GoTo /D (xtdaudit) >> +>> endobj +6409 0 obj << +/D [6407 0 R /XYZ 85.039 781.388 null] +>> endobj +6405 0 obj << +/D [6407 0 R /XYZ 85.039 758.673 null] +>> endobj +6410 0 obj << +/D [6407 0 R /XYZ 258.872 764.647 null] +>> endobj +1942 0 obj << +/D [6407 0 R /XYZ 85.039 580.209 null] +>> endobj +6411 0 obj << +/D [6407 0 R /XYZ 85.039 558.447 null] +>> endobj +1946 0 obj << +/D [6407 0 R /XYZ 85.039 558.447 null] +>> endobj +6412 0 obj << +/D [6407 0 R /XYZ 85.039 523.905 null] +>> endobj +1950 0 obj << +/D [6407 0 R /XYZ 85.039 370.421 null] +>> endobj +6413 0 obj << +/D [6407 0 R /XYZ 85.039 338.606 null] +>> endobj +6415 0 obj << +/D [6407 0 R /XYZ 85.039 243.234 null] +>> endobj +6416 0 obj << +/D [6407 0 R /XYZ 257.152 249.208 null] +>> endobj +1954 0 obj << +/D [6407 0 R /XYZ 85.039 140.763 null] +>> endobj +6417 0 obj << +/D [6407 0 R /XYZ 85.039 106.017 null] +>> endobj +6406 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F20 3021 0 R /F41 3054 0 R /F62 4159 0 R /F35 3036 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6420 0 obj << +/Length 2452 +/Filter /FlateDecode +>> +stream +xÚ­YKsܸ¾ëWL%‡pª<ñ"AßlÇNv³ÙÝXÚø°»J¤4,Í ’²¬Ôþøô ÁÊ>H¥ƒ@ ntøº‘«þäÊY‘êb•;)´s««ýYºº‘¿ŸI/‘®ŒH3‹Co/ÎþúÁf+™Š"-V×$rQýš¼ûÇ›Ÿ/Þ\o´Ö‰JÅz“ç.9_Ëäbítòf­\òn½‘É?¡ëÍ[lýðž¥ÿóºÎ¹ý¯Ÿþö ôã÷ïߟ½¿ˆ¬Øa2fü÷ì×ßÓU–~– +]¸Õ´S!‹bµ?3V k´ÿÞŸý{\…ÇÌŠg-lv$6:Ιq×Ò.ìzØ‚©5˜žºä +÷´ƒï¦ÆÖa­ŠdÀ¡Äʱ5Mø¹ƒvû[*Í®æQj³€Lz–*ÐQñx…«w5iÚnÔÕópÙùu°“†‡òr\bb´M.¶—ï±·šõÖ^ßâÛ°¥]S0rÞúú3~øíñ~Pº½¿Ùb¸0F½WÌ£ ïŒTÀÇC³Ûq¸Á6^¸ãÞËõ†ÕàG»Vy~è˜0 £Z%¥_tØzU3£a]{ãEÚ{œí—õºÈ[§A/‰Ž&Åh¡XÀ" £ÐÙòqÙ(+t>ÝRÖÆÐ3¢,n ,Ö¦ „õñŠcuªM ­ìÊ´N_ÇéÞìGrêñ¾zÛàþ6„\tíí:8Þ$û–ÂP¡_v5‚ÇØä¡£ó"8D¬«W¬{t·ÜsUîv=7§¸c„ó ¨á£Rм뻡®Xx<Оá,'LVŒˆ¡eYDÄ)*ýñy ŠÐFe gë‘ÈE´Ë¡.+ì³I{Íc~Íá†û«zW³d… ¨¤?m({Ó°¥þ“ðŠ¾ÜÓ†ù«†júfKxÝ2š[bHQÖy.2í|¬?N@Ú˜¬ Óœ22 èg´$Ôg”H•›¹ëm¿"O?x¿_µdñ Üu׋àf•‹´ày‹–*ò’¡Úæ %Dᢽ`Zî'z)“Úå݇¢Äs ãuh ¶àϳcfì¹ÿýÜÁ®íˆw ãsSOãdìy úõÀË€.É-÷#.× &üì0ÞöAʦý¶ìB7|Kv½3”bψ¢\Žá¡ÿ%±Ú#PJÜÀ]8K|`¬"êŸÎ@1®þnd8°&…%üôWÇôè÷JðìÂ)¤hè8 +ÂQ¤ÚÇC0wÕ a³©HM6,<1¼ƒ GÌÛî!æKÄÄ.˜@¬P—ÛtªÁE±«¶5úøiŒ•á˜tý0}„™ŒàÑs³ +Ñ%Ÿ^“É/=À›`ÓH $rÄ?ždq˜}M¹~Ï}Š]pka…2öÛn5…°áùÐ͈ *.¿ƒï®Ù¨‘9`Þ´Žƒð¸FT·ñL  ˆÌñ–¼¾­—»zɤÜ¥C¤·œ•eô”°SF`Ú«Ædž!üŠ'"“«Ë)€=³|H&2N&*¹¦$𓯳äA<.%@„Ç*_&4!”~Á‡&Èœ¨vÃ¥ÑÏCòß.9Èz|a½í”}¢”å+(£"ƒWâbu´ä9îÅ3[Û ±½C5íÁ/„†…zfŒs¦¢àH•‰Ü¹(ÐOàJ +›I/6/XUà.jõ-؉__W0+Œ…’Zæ…j±îf‰tV3”1Þð×k:kX$`š´}9ÂE¼•åÉÇÈT «,¯¿¤ÚFª+¨#EM}ŽÊ¤SšSEarSÕŒ|¨k¡©ŠZ$ ;1•€x¿%ˆïª…RjUËÕIÙº‘€V£!&™y‘8Ü¢ßk_±!3,ˆÍ¥æiÿ›oùÿÜ3Ôc [ +àƒíè½±…g¢˜:Pl!EÈŠ8r5Üw“¸¿Àùº'‡1ÝÀøíHþwþnQø³ƒH,×ÜoUÐ> *Šú,×¢pöÉkÔ2–"–2cfƒæåD²TÅÝ|oˆ­ÝTmÏ.b§[E0Ö›w¥wÞ&fÞùI¥÷xý¸\{Ë šcIÔaàŸ¿T?3&ú‰;³l©Jdö9LW¸s +Èê@Ùè³K9k¨;¸oÀœ—¢O¹´tIËÃÇHÁ>NN¬€‡h!Ê_{ÿu[üò€Òô8€]³ÌŠ#I‘Ox”1Ó[ÇT8Ïð8¢Êȃâ¯)ÒQÐÌýÝ:ºø‰òQÄ7YQ$?’ÀC¸ý㜙}¸ZT`õèAr.F·0˜Qò¿¨ÄÃÑq[86"?¢*3Öó›Ô†ž¨ Xp!}dá?cÏnƒÂÓj~½¼nv5¹!¹æ„hFÉŸ– ËdÀΚì% ?ÐvO€ÝIaÌ3°þUVVPÛ?ÁÊ +¯3,EM&ñ'ÆIyÅï½ÿ®ˆãjžtDËÊ_)–8>Àž©««c;,N=ÒŸ7|–Iù,ØBdJ͹¹=*öºãüi°f4Þb^ŽÞöå—çþ5a9+¡¬zFÄ?4³Ôeýƒ!ež ¡—*¥îfLÃÖ¿Ò ÊF¡ {Ïo{ôy”µüDªª,Žà±&åù·.ñ¼ÈÚÆ›Nµ[Gd‰I°9Š¤ø‚9{±l‡£üêÀûaL~x±hŸ›µ™ôy> ~¹B¼ßWOböÿ¬Zù‡†nÝNqäÜBÉãâªÅÖYNú·›Ü ³î®S±›á‹Ï 4æ>ƨqjÎرX +a6ÆLÈš™Y:OƒGTU<3.¸¡b½ô×3¾"Ìá’nƒ.…Fô½1ýHcn…4>¤_ÿ]E‹lñ7êÿº5X·.ƒM9Qäϸ¼kex¦µi©Å¦ÌAˆ£„£Móã'“fD&T%Eæ’Oôž„3âW\9¼Ð Dº÷d‹ŸGohM„wFjä·>¸ Ù“`’É«H¾˜.ÃU1fŸcÂ)<á˜cÂyß¹©¦8½Œæ{zzÀŽ)t,çÕô+Ëx9Á7fvz§\Æ·„£¤ôKâû@EÎ纣ôç+ûÅG#òü9`û)¼·:zs@WäérU˜‰Î^ÖÐX² <- ƒ +òô“â·»¬ðÅkK €ÎönË`ÔÏÁ¹ådÈ„–;†Eã'µ‡ðSÓj£t†‡pVØ”·áÇ +ÂÚtíQêy4ü^³êT( \BÑ¡—¾ò:Ÿ÷£®Î…œ+¿B-ó\dBgGUðÿ(g\}endstream +endobj +6419 0 obj << +/Type /Page +/Contents 6420 0 R +/Resources 6418 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6388 0 R +>> endobj +6421 0 obj << +/D [6419 0 R /XYZ 85.039 781.388 null] +>> endobj +1958 0 obj << +/D [6419 0 R /XYZ 85.039 719.568 null] +>> endobj +6422 0 obj << +/D [6419 0 R /XYZ 85.039 684.823 null] +>> endobj +6418 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R /F58 3380 0 R /F62 4159 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6425 0 obj << +/Length 2328 +/Filter /FlateDecode +>> +stream +xÚÍYKsÛF¾ëW°öV™oø&ÛRÖ‰d-EµUqCbHb ¢µ‡ýíÛ¯!ÒîVör•1ìééééÇ×=#5óàŸš¥‘ëÙ,I•¤élµ»ðf˜ùîB ‡7 ]/ŽpêÝÝÅåMÏ”çf^6»[Ë]þ«óþ¯W?ß]™/‚ p|Ï/’$unçʹ›§s5÷Sçý|¡œ€tõGŸ®™ûþH·<þüÓ‡_€Ž¿»ûþâún¤Å"tÃ8@5~¿øõ7o–ƒ¦ß_xn¥³Œ=WeÙlwF…ü./n/þ6Há¹pÆ«&»° •¹™Mdˆ²Á$>P¢±IÀ + G‰ÀQä9•ét§Ë{² ±Aè*ØÛŠUÑ„¥¯ØRƒ4úµ«ç °pÞÃ~¥AZ芲äY£[4¸á_+× ƒŸoÀ_Ðdgª•,¬×̈ÞÓ»¹Ÿ8Kñ¤®`œOéðÕSa9—mB‡¤nqaSàš s±&Íc±24tÑxv?q=ð 1œG1ngêô9QäªÞá’= 5¢DWËwkÕ/_Òð¹•ÞN„XÈ’)§«Ø bœÁ9¡špØ 9¹!†7%§Æ2'þµ¶F@[ÖÌ nYSâÔ}'NnŒîŠJŒî^¡Íö¥ùP÷ËQˆ¬QVóоa¶ a8˜ð€0Æ]4KïxŽe§>¡V«ÁŸãã£cý$ü§²íG õ0¢à†O»ÕDp; +Üñò&/Ž•›Âˆ%´»¥»ª«5ó=Û$ÌÜ(¶¼&ÿ)[Þ¬"/–s ó†D›ôЋŽl?hGD̲"Žºáï#ùŽ²~•EÛ¡—ÔÊÎ0ZŠz˜Œ ¥°d0@,Ìè:ÏÙ2’[¾£û®ÞA­tY>ÍÓð×¾«Ô PêgàügHºp¾$ DÃ̹Gn°Zıóúô%%P®uQꥅ¡8q®qÜš¡‘iÌk蛀çü×æn‹pFȤxï +ðÒ‘+ÎäÒü)8K~ÛðDZüÜA bèu/+ënk Þ0×=ž;Œ‡PP° xøø¸†–èŽÐÑ›#‰âg+zï9¤ +äL\ö%¸÷¨-LB‚8KœUª7"Ô= h¦aÇ3S|fé·0Ë ƒÛçe(Ô+Ü£Ÿ³Øé#‹×Ý0_Wâb 6ÖNº­E²eÓÕs3"í«y–än°BCb„*€ÜbtÊ•²)Ga¬<*~nzþÞ£"uæ"¬us䯮‘ù Xûþ^z%¶ŠÂó¨ùi!e~Ämßi¡ +ŠÃ¶Lª†@¬¹h…„F·%Ãp£=±|׸¸ZQÀáJ°"ì`™ÖüåR.Ä!|LÝ“ípûº/sfµ°DóÅnOy4€P¢8þežŒ ´Žwîý&­ªT,ëÃìN´Ð$«À À"7HâÿØ †iJzÁÍJ!‹ZÝÜþÁ¦ð—/ŸÎÚÖz)ŽHi62õå;–LÉÚvÝþíååáppWmëvú©¬›Þ5yù/ÃbgšË [³n/‹*7ßÜývª@àÇPƒÕty^Q çJÇ}ÁËç{÷t*\%®òýWO7)éšPvÅ ÷©¦_œÍ™çc¸ø/¨÷%ùÿö1Š“óäG"5j6¢ý$FÄ=ÎÀžÃ؇ëUÃ-Â= +ÂüÚãò4Û‘CóL ÊyêÑÂNãlиç‚TÀ„)ŸX)êõÀ£íÍ¢;ôcçcÇ\{ÿAQVFdJuì#¨ŽúД¢OP£Ð§Æ ?nsJÎXškŸñŒî ÑSËV9…Þg7ÝÈ\•ó`3„ 0G .< ÿ´€thqY2L‹Â¨¤ðÑ'ðŽ„ZÊ‘ÐGGâð;þèÛ!@ ¸býâ¸Ý•.­W€oèÐÚbSº5\E•u³¡;\ñOº éóÏlOXžaÍ‹3W$¾U’4î ?} kbÖ2ùUáUÓA¿Ù¾ùËĹqþ¶¶7Â(t~0OdU:SŽ‹€œ±7‚HnŒ5ë +Ô‹1¥píy=b[ðUz*)á… g57ÖŸ›¤øÃ4‘ˆ…duý`Unm˜ÞÔ_ /? P—Š2iz7Ù+äuLÜBÖ ê¦p·¦·e ££§ëLP‡ à‚¼tñUrùRá±b«hTB€ZHj–Xˆ¡Ça«ž¬:{=@šæËŸl\Õ¼L·ìüZs¶ú’DH'q~Þa;@ݳd¦ç‚É£C]fÁæ µ©+{é‰caöJ[ÈÕµ1¿£¼¢±÷fÛ‚5}õB·te›?µ‘è€&DSœ?ðÇ*™*gŠhˆÿ6ì÷GÏäŽAÐ[Ä9c½{†ÐЂúÐé¶ý†Á§•~ŠL$“ôîÑIÎÙL—9ò+*ÓÖ¬eJ‹W\œNؾŠG†Ýż™ðÛ¶æëY÷iЈÖÊ;›]›-ãQ÷ Aá±Ç áeÁP¿(SkÛñ¶\L]‰×YµÖ>emÅy‡¢Ýž:”Ì)U”žB˜üHàÕõº<>OIœŒËÃT»§ ¥KÒÿC»çK»÷ˆ]ÞJWÎ.¯Þ›JW]ë[êÃåY³Ç®—f/´B*CsÅg½Ðä¾­Þ-õâ±kœœö‰ƒXXíµHJyÅHU¯‡®dÁõ{5¼TÃóô¦ï^6îNž8ßØpãŠÏÅ ùŽá;¼¥Q«Æ!y:]Ow¡Ñè…¹!ð¨BÐs‹zœvkç~¸Sãž©Ç—)øÒm®èšú®ï~»¤§f)´1˜a«ÿî2ÇOØdñ±‡DsaÀ#gþÄ[o*¯·-)ÛRïvGi»}1$V·‚zSþÁöAÛSíeRvºÏkÏÄÿ!\@ºÎ>L¡K™%Óè"!ðÇþÆÀÕ(ÂéUD TzžëÇÇX«à¿³oEñendstream +endobj +6424 0 obj << +/Type /Page +/Contents 6425 0 R +/Resources 6423 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6388 0 R +/Annots [ 6430 0 R 6431 0 R 6433 0 R ] +>> endobj +6430 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [113.74 387.621 442.184 399.613] +/Subtype/Link/A<> +>> endobj +6431 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [101.164 360.825 167.187 372.394] +/Subtype/Link/A<> +>> endobj +6433 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [113.74 148.125 281.822 160.117] +/Subtype/Link/A<> +>> endobj +6426 0 obj << +/D [6424 0 R /XYZ 85.039 781.388 null] +>> endobj +1962 0 obj << +/D [6424 0 R /XYZ 85.039 761.463 null] +>> endobj +6427 0 obj << +/D [6424 0 R /XYZ 85.039 743.459 null] +>> endobj +1966 0 obj << +/D [6424 0 R /XYZ 85.039 602.955 null] +>> endobj +6428 0 obj << +/D [6424 0 R /XYZ 85.039 562.791 null] +>> endobj +1970 0 obj << +/D [6424 0 R /XYZ 85.039 450.561 null] +>> endobj +6429 0 obj << +/D [6424 0 R /XYZ 85.039 418.14 null] +>> endobj +1974 0 obj << +/D [6424 0 R /XYZ 85.039 211.065 null] +>> endobj +6432 0 obj << +/D [6424 0 R /XYZ 85.039 178.644 null] +>> endobj +6423 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R /F35 3036 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6436 0 obj << +/Length 2236 +/Filter /FlateDecode +>> +stream +xÚÍY[Û6~÷¯0öIb)R·¼M;Màb3ÈîLš>È–l ÑÅ•ä¸óï÷\HI«i¾†Ô!yx®ß9tÔRÂ?µŒ!u²Œb%t/wÕB.°ò~¡ìhó™Åµ[]‡¾&šÛ#—k „¸øÃóâî/—¾a¨—Ï{ÚôœýâùJ¬ÖA ½Ï+åõ¶¨³·«µ‰cïS—¯Ö:Œ¼fcè=¬ÖÊk*Ø—5/Ýïv͹î»Õ¯Ï?/~zžÂ×BGþI¨„‰ý©„ÊmÂW’Œ&ñÞ­´ôò´?·9ÊÒ±\i±4?äuþE*ƒkß•IG"‘ãµ*X* ”dzí¦^ù±×ç‡6í‹õU’Mã§ÇÍÿxÆ—ÃäC†ÙáÕmÓ5ûž©ŸÁRÊËäuAy•òŸyì+Ü|†¿‡#“R>uÆCª’[îesp2à©Ô²Ú®ÖÀ8'kØå]SwE–·îdŠv@¥†LBº}QÚ›½À&m¼CK^-ÿ…ŸÚ#÷ˆWï>o›X·9w|`×T§sO!sà½V?ñ¾mƒ +TŽ£7hÓ¾iy’òP6îx_T¹p¢ú‘IL¢>st¶ÂUŽà„Úš~°å¥=ªAN(P»¢ÇË_xíBäڽљvd¯ùèJö,Îȳ8¹õ,R?#µ=‹Õƒ½ˆŠšö+ï/l<µÍ ‘äÝ^É:ñV@`6ç’‚<ðº3Ä…vJ#…œG„´gŸÆÚ£Œ‘Þ¦ç=…Í•¢šÞž’¿á9¯÷ÇÔž˜ÚV¹å­;LyÇC•³ýR +Ú®b*{å=¦í'ðQ]:Ö.ƒw`Y;'܆l÷Òq V69ñ0rGÙpukïÀ·#%]q°á­ÏÖЀ„ÉH»r¨|VnÎ'¦±Ïë¼íŽÅ‰à5—¢?ÚüY¹¸'-ÉAοäÐïî]\ÁÎ4ê/ŒÄ¼ï +ž 8lbŒ"¯1y"ˆ0)ñ:ö0d ‹Àk„\0:·â±§´Â[{œô>“¨v +½d?…jåœ cåq´¸³„(.šÆ}“‘{MÀæ" ãóxÒB|Á}[ ”9ÝÇ°°¶šOƒÑgË Ë^=Hn jŒƒl˜Aç 8¡fãa™”'~(v’ù¿´Ð—–e÷†çKBï„›µûó˜8$\_ì85Ѱ.aw¶¾Íøó˜xOè{©S0'öŒ¼Ç´²³§![¿áEtgΞ 0w¨èÑ2hx=H – Snª^ñÌkYSq–wî`°»ž'‹/ik ”?p†`"@'ŸÉoªh2vn’ñ4íYOFäQÆ­UÊDyedmt•£°òÁ Q˜­ý€À#,½sÛ!íéÁä0ÿÌ@¾%L˘ €s­Ð_ÊçÿãmeJ6eø“˜sÚï)1v„+åP¸MzO­s¹8ËÉ:oÆR=¸rr¨ +vmÓîÝSöÆ¡›KàÀn¿>~A–XÔêKZ¢o®rß&ç¼ +„ÐÔ +å.ha'{þDµ#ímrMÌÔ½uýÝ´×”¡ðýp®ÙT¡Ð¡m§©é3j¦éE¯ùÐDó}8.MyÎ6’÷Ô'-»jô57Ug7©»j RË‚ o-÷EòQ,"¡;î?Y‰×š wüH[/%ÿ,3m2g¡iì6èšòLš;Û±â¶||Büû JÇÿ,¥orÄÁ,"%8똊ŠšB!íÓmJ3 sq)Ëi=òåšñ+±}•ˆ Yºß¿ü*—(ðóB + &ºÀ\ +R-4¿ÊÅÓâ?»ò} ˜[,DCÑã÷–e¤jb 7æG®Z܈#•vu}ÓL€ö–Skûþáºö}_Äar…¬®@Ïñ>(1@ú´Á«,¸ÁÒï7–0$Ì©©'XÅcô¤ÆÀú¨æ‰Ì~`ra—Ç$ϘOS—/<ãf&¯j `wø¥xênûBOìÄLˆušG” ±´cŠVp™áÞ‡’›hiøûÓæáî=ì"˜¾±ŒÈÏ]Q4a4ž{°ìKâÙðìÝ™=½x+ÇÀ +s$·ÅñŒ6ÎîU[ Ï–ú@ÅXšãGaÇ#÷ŠÃe¨åö4u*tÔò ·Ân<ÛìmƒO"Ú7±ˆühˆk`O,b0Ý}Íg{õ(¡öí‰AªI{A ¤ÎöF»ñÍ/é‘Oa a tpÖ%Á©ãŽü-|œ[ð¡N¤7í?‰@Áh_OiÆ4ª<0ž;îLI“(îÄ9*ZxuL=þ¾A®dòÂ.í¡fÛsÏèÄ¢\H‹Q_q1œiˆZû6ºÛüû£øþ£}Á!ÚßC`Ë-ø+i„§À$Wà󛚂ãoj +@0øsd4Ê•bA™ÊMþ!:$ ÏhwôŠK t¼Œ´Hôø#Ô)¥D‚™?¢ìcƒ}-wO·]‘ DÌ +-[*!M’h^ÌIÎñî6•Z>4 Ñrû‰ðƒIŒàÏ•t›Gø³Þ°Òsݘ¼s]òL™¸Gù“‡® ¤W¢Á¤¥N°fœ…fÖD ‡xÅ%ñÆ$Ô$\ŽÅîȧ8¢)@»9ÑB¨iÉ_Í-õЊ¹_ +Œ{œíS›ø±MÝÏG_Y(rTcKV ]¿jmNÞ”Ø9Ö ü¼‚kø.ê=÷Ó±çR‰èfIt\© ‡Vö»¼ßÝÒ®»Ì©F"4th$^qÄŸgC=eÈ¿”Ìðƒ¸õÕ5?·¶ÆÐ +}OK[öBÏŒ +´˜þ•óàè™â~ò+yßÕAð\Ín A‡‰P2‚ôtÌßJÔµ‰#M&Kþv¬àP¬²”ˆtø=ÐkA#÷gMØõ¦Ô@äÕ/¸ñÿ'båwendstream +endobj +6435 0 obj << +/Type /Page +/Contents 6436 0 R +/Resources 6434 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6439 0 R +>> endobj +6437 0 obj << +/D [6435 0 R /XYZ 85.039 781.388 null] +>> endobj +1978 0 obj << +/D [6435 0 R /XYZ 85.039 761.463 null] +>> endobj +3185 0 obj << +/D [6435 0 R /XYZ 85.039 657.513 null] +>> endobj +1982 0 obj << +/D [6435 0 R /XYZ 85.039 657.513 null] +>> endobj +6438 0 obj << +/D [6435 0 R /XYZ 85.039 615.228 null] +>> endobj +6434 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F41 3054 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R >> +/XObject << /Im1 4209 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6442 0 obj << +/Length 2900 /Filter /FlateDecode >> stream -xÚ`ŸÿFFFÌÌÌšššÂÂÂõõõ666»»»úúú%%%ñññ³³³«««ééé“““íííýýý¢¢¢ŠŠŠ[[[ÕÕÕ‚‚‚ssskkk{{{bbbÚÚÚáááRRRåååÿÿÿ¡ò;Pendstream +xÚÍËnÜFò®¯äD!Ãf󙛟» +É¡Iœ!GCxHÊ$ÇŠûñ[¯n6gh;@.Ó¬ª®®®®·¬VüS«,ö¯ÒLù:ËVÛæ"X=æ_J(‚UäIŒ¨Wë‹ÞÅÉJ~ä«õŽHÖåoÞë¿|¿~ûËå•ÖÚ •y•¦™w©¼ëË+åݼº¾yó#c?ܽÅEèݾcÀ›ÛŸ_^ßðúåe˜y¯qËëÛ7ë»Ë?Ö?]¼];Â\E~”h”æÓÅo«þé"ðuž­ž`ø*ÏWÍEk?Ž´|.î.þc¹0.Zñ®…;_Š+•ûy/ëå +õçV3!€#_G‰«PFꈣܻnǾƒ{*¯Ü\ÿŠ«Ø+Ú’?#¯-ê¿ï†n72ô¾n\2§7߬ùw_ ô3Ëyü(lª¾j'G6pø*¢BôA¸íÐõ|ZO˜G€ôÕ@<˜ ñ€:#ÝÃŤ†ãPáÎ ”kÀâ¡G~ÇGþ¢»a ò+F”°kO6Y$~—5^½Gn‹}ÛÏCM° vS›ãð&"iæ72í{£‹Ì$Ò‘·Þ›ô®ØÊÉûbpïåtù¦(Q\ØVìB¨[”<¡gÄK3vB‰fA‚餬b6FZÓƒ_†©×1RϳÑÓX5ƒpl_8d¬eZâë$ÎH¯ðÌdü¨‹¶ê}s¹0õðJ¼ÜmkdÑl”]ÓгAô ÆÝïG®D@–C¡ILWF{##}f"T$-6„«H ÂýCîºí+QŠöjk°ò€ÆKŠÃaºJ[4DV2»É¤z°¶Ý‘ùˆ F|¨ƒ'8hû.aŒŽ‹lÐyÃH n붤+ÐÉUÂŽáyàÇn@j/y=3üM@ι£ áûop%¬Žõ(ønÇÈW»‡¾0ÜÉÒѳ0)­”}`‘8Å\Ü1Y繫t‡ž˜‘&1@D¡&Í¥üBÆh3þ—Š/…¤¾Ã4¥Bot¨ÞZ¸ `W6FàfƒØ=vt±†¡ÓáýÎÊv|Xgûé=곕 YM!ü‹’¼WÂAðqñÄ)dšÅB@[ÁˆH/‘°i^YAhZüˆÌapß1†`²EIm%Dµâ•cTbvO×Û•×źþÚ¹h?YàÀÑUSšS WÎ Ÿu¬{£9èLò5¢ÃòÄ{Ú³õЉœ[þ8TEÉ„dÄð;<·ïéÍÛú¿… ~ì» Yrcô’'ß0Fbmœ9OM¨õXß“”Æ}ž„5`ðe÷¶x˜õùŒÞHïI,¨_äðlËü”âë\&©×qëŸ «9·g§ÔÜvôpaž“½ã˜‚™DZº©kA$Õè>iå0n äŒ(«4àÀ4¤ÐÞ-ê`[1rœ&õJvG+â­âbj]ñk~K„<™jõ s€ƒPÎSbNj`¶y7Šhî²´N¼zgFÕ3c¸5£F¾~W:j9£LÝÚwŒ3Åj|*ƒvêwÀÚ£_Žaê˧‹#Â3u 懚dÇ¿ö¹Û9帺]š á­Ž4ªfGëÙ|g(ŒÉàWcF1†°¹ÑÍõÝ÷RM¦”˜ç„Äm«­ç¯ºö Sö…Ï5wO3E™"óÑÏšu’›©‹(6ŸÝ@v=2”Ë­Ð9·yv3-ø1{Æs˜&)äó¬a$GÊ|RVØ—ÏOÚdaÇIT›Ü‰L¸œ¨z6%~íÜÅ,%cœWå-…J‘dD +ðç¤òGx×3b*üÚÊu€M0PÆ#ïÓÑhD†q|ªm˜ˆ&cþºÃä%óß`¤•½py[täNQ“Gⱑ÷FL·¾îøýI^êÝÎ[’ÀÚ¤þrwàÍÅ`¤Ãt†+§CÂóM>c;úîÜÛ$´)ˆ2¿È72Ãæ9Ÿ™`Ks2¥©ŸÍi„ É+Ùœ¤˜ŽÉ%׊çy°p7:ýŸ +mÅ„T”á×ú·Ò§Cáv:q^h¡î­E°q’eÁÚœ1=žó¨SÆ´S4óãü¯†Aäýz%­¸õcóGvÄ¡6¥x!†+,JÇâK~5AšL /¾áLÛÍ `¶/E²)GÞÛÖlªÆ1™NÛ"ÑÍaRû”Ìð<ùžL§r£·Ì1f£¹ÉIcñÑ4ã’DÏŸÈ̱óÃ;íva쇙tò÷d"šÍl44'‰ªv‹™ÎØ¿*ɬÕ?ЩÐHÑy*Kà§þKÂDQÔÚã’4™ŸèDˆÐe!'¯M4³Ôþ¶ÕÖ1?ßNÈüˆlä_·=ÔiO…0‰à¸,«±êŠ{„ÙÓ(€'K* ü0Wn¤é+úëpoæFd“*×ä¶~Þt2:´‰þԸʴWIÕJ¼“¾›êÀq!,†cþô—;Jz…Ðœ–[´¯NOûÚ­¡QÚÞø8 ]¹ôIFøs®Åáű쳯vø—æ­MþÂè:L3?ËÔr7.‡ü½ÿ]¶Ê¬À_m¶A©§"º#S#àÿÕži"endstream endobj -6121 0 obj << -/D [6119 0 R /XYZ 85.039 781.388 null] +6441 0 obj << +/Type /Page +/Contents 6442 0 R +/Resources 6440 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6439 0 R >> endobj -6122 0 obj << -/D [6119 0 R /XYZ 85.039 728.534 null] +6443 0 obj << +/D [6441 0 R /XYZ 85.039 781.388 null] >> endobj -6123 0 obj << -/D [6119 0 R /XYZ 85.039 728.534 null] +1986 0 obj << +/D [6441 0 R /XYZ 85.039 761.463 null] >> endobj -6124 0 obj << -/D [6119 0 R /XYZ 288.958 110.371 null] +6444 0 obj << +/D [6441 0 R /XYZ 85.039 739.701 null] >> endobj -6118 0 obj << -/Font << /F56 3226 0 R /F66 4190 0 R /F62 4047 0 R /F15 2972 0 R >> -/XObject << /Im30 6096 0 R >> -/ProcSet [ /PDF /Text /ImageC /ImageI ] +1990 0 obj << +/D [6441 0 R /XYZ 85.039 376.433 null] >> endobj -6129 0 obj << -/Length 1834 +6445 0 obj << +/D [6441 0 R /XYZ 85.039 336.269 null] +>> endobj +6440 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R /F35 3036 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6448 0 obj << +/Length 2960 /Filter /FlateDecode >> stream -xÚ…XYoÛF~ׯÐ#D—˳@4Z»A'+‰²ÙðPxØÖ¿ï\KÒ¢äÂâÎÎÎÎõÍÌZ-=øSË$t=.ãD¹:I–»rá-`çÓB Gj7 ø¾°¹¶»ëÈw½ ¾È#w¬c•º:PÈóán±¹ñ½¥ï¹Q¤—w«H”xn’„Ë»ý½›«uzÎmgv?VZ9f[¬”“­Ö:Š¯7·üQÖðë9ûÕZ9=1´«ïw_ïΤ_ÐÒ[®}íêØÓ„(ŒÝPé© *£¢© ~¿Êš Ðˆ unV cfº¾ÉPÑuSíÙˆY•}óT€{ÝUýEô›*Ž<¤¢ -—ÊsS/¨&‰«ü”T¼ÍÁcÕ”òÓĹ5åÊ-ÐÌZ¿CdžN÷˜5²Ì-~¦NÛaq„EìÔMÇû Õ ·6öc‚¡(²)ºo^èåkÞt=^VðÎM>a»=µ]V¢G€[! ‚Ëš.Ý÷ *“í¿RŸe Ž¦%ñ;¸£­0qÙëùˆ‘ŽÏO8×gt°cz‡i…ŽÙíÊ{-ÓºG›—¡ÓWhà /(¤¬%.éŒXÅçš^¤O$µÙg{¦K–£á dºMtk{¨Sç%ä¢dÐúŽ¸–²«qãiR²æ’/L‘ÐZ -éàšÓ-£éø‹üR—rè9ïУÈ&µ¯ÂC”ºo`Åe’©€°g‰Mv€Ô£ìï«íÑr8¥Ù/uJSIRáÞÕœ¹Œ2¨gn˜¾² ÏÕB…ÂUCð¥ü†wŒv}ÛbÈêêš",àM=–«`âÐõ½„ôø|/D©ƒÞ©;þ¦œD·1[Š3é??Jœ¦ ŠèÄeºC+Ñ«edÞvMŽ¡í;4‰Nn©¸˜æÄË3x¢0„^‚%€õ1QîãEipuâÅ#-8}E@Sse)%E)2Ïìç ªŸ=Ì]†±,KÁ×$I¨¦TBƒ¸¦!„©@·AwäñA7‚/8»XN Yn%T?È*!åþúη ˆhÒ €Ló<ã·A‡ž¸*ãeõpO'æþhO\ݲ’~±‚T‘ì4A3z¢±B -Ù!ûÇ:ÂÄ-¹.#¯U‚Ô¡Dq P›C·ù,þø{ó{N·ôR<Ï*Áç¿>ÿãZ+üØõR¶ân•hÄ6@Ïé±Äë –‚àŒny÷U«'fŒ]½YN>05o´yiÑ[˜†¹:¹|¸³®$ôAlRÔhÙ3º8 ¸P C^‰…ÀÔ™!¼ ðhSfcõR~©b…ÚO§CË -œ­™»N6¨‚`ʧ.CÁ¨š5UnPD.ÊSñ¢nÃý¹ªL>D(;¼*72$ÏAÆwmWt!1U¦Ì†¬ôaxÂ(‹ÜìÅ €*²w—\RsÒõƒ¤œíj†l~ÒršYnìÕc^ÌSðˆK«Ûg¬z—í¯¦,—{™Ò ñ8í -éwX¾òê—+=@Ç) ÖXà.î¿{Ë=ô‚/ ÏÓxù ßž« å‚q-ëbq»øs:Û*7Mõ¥N¢`(q8wÃ8š2œÿ­Ç÷7‚áæ‰Ô â+ÍÇrY& ËÇL¾IìØÜ•£f>ð“'ËÉMsu„çÔ9“D›‘kçîãe‡-y«Çæ@Ã×ü‰¨„||A×ù«IxßÖ9U®§â%Üíêû÷½ÁÜçÝ÷iÖ‡ÓþVJ,I}}Ïúÿ*GmÆnÐÓIfRo²q{º¬£Á=ñÌ{+…ÌyŸ« ¶‰üö•ÓS—ë.Bd.÷¹Æ—àhàIºÑå!‹‚¹¯áU2sí æG8\]{BúÔ¬:M¬ê ¬jÖa´óCx¤EoŽv¾Ü`KÐÙçyÊu¬‘6Ý·ÓV<©PÃN­hOAË ‚€xÌiR{¸eÉ0óSc‡ÓGí_wlÎaa4ÄÄ‹#ŽuÔ‚ ¦ãžW;&P}†_|ñוVŽ›1=AÄ.¤9‚›ÀФ ø¡›&øo Ô‰g8f{åh³3”Gæ¢4µA€2ä!TÓöa¸¶áÔbäF<¬óƒÔP¡óÖ~ \’ešÌyÅØ™¡àyœfnîD¡×Ûm~[ÓàÓÆf 7êßÛÍôI¶áñAK«El÷-p²1;S¼æ.àø–LÉ1|¤_ 8? ÓèBjqGEÚa‰©ƒ¦T®`·#èæ;Ù?ŠéäéFÖ{võh†bsD¤=I~éÖØ -ØêВ›xe˜}ì˜á4³ógy6-×)Úª±ŽmG ã•©Zfúf‹±UdàœxCp‹&Ôç†:qÃD_¿ñ?^Ë&endstream +xÚ¥YKoãF¾ûW{¢€çHîͱ“Ídcw¬Hr EŽL„"’Çùõ[_Uu“’èÉnVW¿êñÕCþ¥Gþe»^˜]&©ï†iz¹Ù]x—[šù×…¯Þeäz«Sß®/¾ù>^]úž›yÙåú3³¬‹Ÿë®î×ß}\,Ã0tß],“$u¾ó~±ô»oßßÝüSf?=|‡Aà|ø^7n¯ÞßÉøj¤Î5–\øt·~Xüºþñâ»õä2ËÈV!nóûÅÏ¿z—]øÇ Ï ³ôò…ÆžëgÙåî"ŠC7ŽBý®/.þcw‘¹èRVͼyi8–¡ç¦idïÇ3¿* +zh5TmCÿóº~]¤‘ón±ŒÏy¬¼é MA´(pö}µ‹ q¾€\”=è¡“ãáðä‡æžK^=T›œ·g¶¾ì¾T›‘Ã\ù 3ϼï’V´¿éžrüÐÊ×]yOÃú°Ýæ¸[] +ÃÕa ™CÐ>Dñ Í2ÜŽ¯CŸ|ê­B?vnå`ˆâPãE¡Ÿ8¿x±wi\ÝÒÐqåô¯ýÀ›íä—Ãÿ}×b÷/ؽ(eƒü@ÙÀβËeœ+ín-Ëp‹v—WÍñ 9oó*z¯¹÷–MþT›'Ci>=u¿‡œÌ|§Ç$Yú*Éœ5TAä~ ’wþTÕlz,fû¶þ‚ÏR¹éq2À‚®ÏÝ ¹ý,ç÷¯Íëž;>½ú³j¶2³Ï{¾Ë ¦Û®»aí«¤äã_`o¥*qòä˜_L:ÁÌPî ¹0’×A , 2lqÒùó˜¥+…E6k»‰ Af}„lèÌEOÐçbu-duL°3Ö£\¢_·bìTu]v°4w9âÔ]Eó· "7I¬›DõÝ ²Ýœ`-té  [{Îz‘‘›.BÏé¶$âe¸JœO=©õüäÀ ƒ·N}7õ³¯# ƒHæ“Š²LJ¡Éõò]-bìe£©InÕ%‹D‰ØUݯqï´%LcFzºDÃ4zCý`Åùø¹áê(~Gn­Nâw„Ðeά•Eˆ†ã6Ù¾ˆÇ$++ +í̤êÀ…æxBá:øz_3ªeçå@f"ïW‹tå¬‚í½ -ˆõÕ¶á` w`ÕÌ.¹PYÒuuœ¯Ó×7¢UïÌŠÈQËiˆ”Ó󯄯n bÒGwÀG£ JrùæûU0ysä….¹”¾ü…ø¨Ø£Ô¥(„ùH@KÃ}órÇÅNˆ§h± €Ñff.—OpLþq¯Ù$øÛBÒ`žì¬lFÚgdtåï‡oõ<®žp^×A°&1ò$aJ™ ‚®M°jv+dÈ3¡±lJ »š*#uWp5&"í½{  4‡n”“êªÛn…º©+­•LJnà é·ÒY<êãÓ,]>~GX7u—)jãW:Ú6¶Ìk­Q5mÝn­-êéÇá#Ôä×£t ÜMÍ–ÉS›<ÆÖ…DMWYX´R45BQRÆ£åË„KS¹9¸I|7N÷Ð&vÃ$þËr!š– ·\4wmß~Öbá#Y9§Z6÷@Ò’œnS‡Î&Í]£ò‚̾‚A‘ëGѦø0q}-;1¨5“¯ÏFY/òýjmá†Yßá–žSRà ùÖ˜ªlþ™ŒEEfëPU-CƒHQvG™ŒðŽã/‹˜Švvºö ÀòVq,Æ5|@®¹ÊŽ¨|¬ðN7àDŽ8,¨n´s1ç™æ­ZmDçˆÀö£máZ=KUŒo+«ô( Hé\Û³â1}ÏŽ˜h„,L„)Ö;P#±xøx-}l%q£ç€ÁX”BÏ•^Æ”ôÓ~BÊ pVm8ÇŠ²”õÏXHã]k,#ʧ™´(A!¾åQvZçôcB+Ú½¨5ˆÊûÎt%™yÔE‹¡]€®_(da.îŸd™ö(êCañœŽîD&ò¹Nwy“o…Añ û’4I¥o¶ž¢D±—xIÇ‘(½Ø…váj‰’ˆ¦¢¯jÎvÚÃöYö¡‡ÃÃ+/L# VÖæ+•›2–QSꢹª2¯ \Œ-‘r7-·Ä ÌRJgZ‹dã`½çwíòîUè¦ß‚¹³~‹¥Õç;7ÆB‰k:ØüÏ6HÇ~X • xOüíÓ8”Wžó¹¤8¯ûVâ +2¨JL‘¡¥˜ôšLÊ<ö(5´r抸©ð«³&¢1š ò±É›“ÂѬŸÆÎ#xß±1 ˜Ê¡SëEý\9xÖ뉼IÈì…@° "WŒD»… äkC6¥ xôTùag+KÎ:‚ÈŸ¶Lìt6ú Ì(ûg4ÜŸÒÍ9íŒÚîdq–B°V*ó%³tÚng€ Š˜ép„©öe8«/¹®$^뾚jpŒgpãý¤e¨8ÑPâ„•/éâjäåÝ„¢›AzšÒ$šÒ }ý•Öù6I;°™lèû§ïòÇöõ +áb*¯¼Ù–Bš`Ú›­b‘ ]÷ÛW=†ÕiAP«·}LhqÛGÑ+áߣhGò*½íý͵ Ä;äEÝœ/KJëY “¯ª‘¨$v¬¦\üÑVæcÂxwù¾Mš})²÷8ùa1Í/µÉ==AvjÇ2•˜´!G£‰cè¾6)õÔÐÎ_Öä;Ó«˜©lWT«zÉ[¹fâFÙêÿË5ƒ7sÍ«ÍP})e|ÕÒÃй~Òÿ¤4&êó-ìøo´°ÆßÒÉ‚ŽÏóõ”P>þIŸ0%îM÷²Í%àBÅ¢×ýTÕ´TJ¥ÔmexÚCËm³‹Ö¾TóŒÞnØÈ6j^Ú&y1• -¥»{Âdb¬ŠOÁ ²dåüâ‡Ñݤ“ ÚíQäñYê´A+µ¶îßɹ‚ÛÏl€Ä&Qª™|ð¶èÓGBüˆÀ|-ÄLäGDCË8¡:züÍg+ë~ºÁ%¯îñ«{ùßSÐlŽŒíÝybÉÀxü¹†Æ·c>Ø\°“¹Îä …–8žiLš`L“’ž´þ8‚77«' tsµò|Ãj|XAÒV}¾Ó‘$abp3¿0ùn˜½á%j ï‡ë0qýÔÚÕW. üÓú+7\¡13¹àÿ¹éé3endstream endobj -6128 0 obj << +6447 0 obj << /Type /Page -/Contents 6129 0 R -/Resources 6127 0 R +/Contents 6448 0 R +/Resources 6446 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6125 0 R +/Parent 6439 0 R >> endobj -6130 0 obj << -/D [6128 0 R /XYZ 85.039 781.388 null] +6449 0 obj << +/D [6447 0 R /XYZ 85.039 781.388 null] >> endobj -1902 0 obj << -/D [6128 0 R /XYZ 85.039 761.463 null] +1994 0 obj << +/D [6447 0 R /XYZ 85.039 691.864 null] >> endobj -3094 0 obj << -/D [6128 0 R /XYZ 85.039 657.513 null] +6450 0 obj << +/D [6447 0 R /XYZ 85.039 657.724 null] >> endobj -1906 0 obj << -/D [6128 0 R /XYZ 85.039 657.513 null] +1998 0 obj << +/D [6447 0 R /XYZ 85.039 505.996 null] >> endobj -6131 0 obj << -/D [6128 0 R /XYZ 85.039 615.228 null] +6451 0 obj << +/D [6447 0 R /XYZ 85.039 465.833 null] >> endobj -1910 0 obj << -/D [6128 0 R /XYZ 85.039 544.591 null] +2002 0 obj << +/D [6447 0 R /XYZ 85.039 367.151 null] >> endobj -6132 0 obj << -/D [6128 0 R /XYZ 85.039 502.307 null] +6452 0 obj << +/D [6447 0 R /XYZ 85.039 334.73 null] >> endobj -6133 0 obj << -/D [6128 0 R /XYZ 284.478 383.02 null] +2006 0 obj << +/D [6447 0 R /XYZ 85.039 143.325 null] >> endobj -6134 0 obj << -/D [6128 0 R /XYZ 85.039 260.551 null] +6453 0 obj << +/D [6447 0 R /XYZ 85.039 106.459 null] >> endobj -6127 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R >> +6446 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6137 0 obj << -/Length 2293 +6456 0 obj << +/Length 3207 /Filter /FlateDecode >> stream -xÚÍËrܸñ®¯˜#yˆ>T•ƒV¶“Ý8eǞ݋ã5CIÌr†Ê²¤¿Ow Áç8åqUJUhôû òU|•(Èt'œÉ$Ym÷ÁêvþzÁ ÄÚ€¬˜_6—ïT´âKƒtµ¹ëð(*¹Úì¾x7»þ¸yûÉ_K)=0lj÷ÙçÞÆO¤wí‹Ä»ñ×Üû;,]ÿ‚Oïßjè?ÞÁÒgýüo~‡u|ÿºùíâí¦å¬¥ \¤ÈÖ.¾| V;á·‹€É4Y=ÃsÀ8lï/€/¦BiÞË‹ÏÿlQé½p¥OMiÁB¬A’Xˆ1¹8 99 'Gä‚ÕšÏrŠRš0!"P7S±r†¿-k<‘LD -Ž(΂´³WŽ…,”B½}½f{Tý#<•9ªâ&àêÖ_+åý;'[7usÂý’í[ã]åôšó€C!:_¾j´$Í}H~åƒy½eÇL[¢É=ŽøI4߃EM`±þAçÃåóñLŒΔH§ˆ ÈAüÇ2$²œ²T¨Å¡â” .ÛØ°2FNPd8¥c2„šð~=lÑÖO;;‡ÿ2Š¼=„±äÞî©ÌëÉ-ºiÉ!2“@.ó¬b¨Y¼Ç3dgŒ•Žg²÷xæGÆUàeO»¢™cÎœ[¤ßÁŒó‰ -SÅNä¯!±ÅW ú¹Mx1hÊăˆÁy*½Ÿáâ®ð1Ñ¿ÚÃÙ–âOû`­×ìAH¹}ˆ¬~%´Qu¯·ï²mQ‚ìí¯~z PH§œ“óUYêÌQ`N7ç«GJÒù1k -Êõ†|v4'5±{ŠLåW3jÁb.ÕìÀšCîGŸüÄ¡¢AI£hãAÄ•,´0#ŠýrÌ!(aÓ¥X? ä3"†œE|Ù“˜ ÐIv"(N‹èPÜV‡C¾m.wEÝ•øƒ)s¢C -Q|9ñ80 ¢ “¢/ìDPœÝ¡Hx4¢VXK_M!|¤ÐÍõ%mó¬É/¹ kˆoº.O«G&¿ çXR3¯ tJ=K[õ )Nªg@1t:«ÝqO«¦¬t×qy´mÁ¡í`óË'|))Ãü ðp³›çT¥,î:+ö·¹AVêó0˜ž^šŠL×Õ"¸Ž{¢§è!’ÈMqm.:´ž¿lsÛ6–Ì<æ·Î;#10€R˜²º7ëXqñ÷–HWPx±O„–+„¡-鵋ƒBŒÁ’™–ú¹íßq·Ô-£ÝDýÐß#è­’hÙEˆÁh¤‡`«™îL7&8ï¶/×Ú0´î*Ó®RçPÊ#…ÂZQ;ÌäfâAÛ,‚1· ª‡[™m¨EÜΑšÏ(A>ï ç½~§ç;ʽ”hdÂÖvck8x¢ùËR¼µÉ_p|jr{¨Ò‹¶UÂç)hIÚ…Û~Y–PQŠµ‘Üü¨û%Ý# _ÇT ºÄ™b4ð=fÇ.M¶#Eqk¸?zí>èäî[<-¿×mœ×ÔZ08Ú̽­Žm|/5wÚh!~Þ –Æñÿtåqð¼Nr–ÄÝÀ 7÷( D¾éS6!ó'tÕÂ'ò‘ŠX¥&oa ‰s%Vññ-ŒqØÏ{Lí¥PÓ×]nòõI]¶ƒGc¾¯Œüz ß°>0¼g' -¢)†GŒËŠÖ±~±‹wj%¨Ëò;j'Èš„Éìt«3ì:ýd ‡5ä Ànk„@K͸…„®6ú.‰Z‰ôÞçß|)L÷Z…\Xq0ÿŸÙ2ŸBÆC1Éç›¼É -*4µ^XkÆ‹[½n<;ì̉z_è{_õëèïPP=ûoæ’ú…3‰‹–ay­3Ãÿ•§ð4`I:×'Gœ pqL$i¤‡Ä`Î3LgðŒE¾D ŽÃ_78¶´ùÿRÿ¼i›}›5•Œ¥ÏÂ~ÏÒÉY,­Îeè8‚æ==aèïõ¨Ìg Ýa:‡¡—øj íðE†6Å|ÆÌýÝOΠæî„ÞGlmh·mÉŠºnèæ!£Z3syoçêø Žs¾Iâ„çDÐÿFz”³žÓa:‡ç,ñÕzŽÃ×Ïô\tüÅýàãxFh?9Ý´c”BfìZ;g Z‡tÆ`=ÖÿÔ;É¢˜/Žÿ\†LÁð¼t1Âü.л‘æ^ä.ûÓ—Ú‡¶”alþØÕˆFµîpMÝŒ(ê;VéãC~ÜÏ}{ Û.-ú¼z:˜ÙÛ‘Xµ1b.GxÒ¿Õ·7c<ÕC> õð²µ! ?Æ5Ô¬ÃaKá7+KýÑŽ†Z\ùTé9°‹aí#œíX -+úÙ¡¨2ˆwE7ÀA7WtßV ´!jôØÍÌð¢¯í‹\”ãylæ|Xüœé¯¿ìã VŸ?ê æW‘rú|ØÙ·ß‘Éâps½€*©p´³Ã…fÛ²ý\!ƒîsEaìÝoǹFól©ŸŠ;¥8ÔM¦§t\Fyp™äÁ…Ǫw‹RëåÚRÓ9µ{Ù€ Ç\§+º§hôØsæ‚.`sŸýN¡ïJÝ»d‰œé -‚[^Ð\0Ä ùU²i"Ç ÿb°endstream +xÚµÛnÛFöÝ_!ô‰,†œá5o®›ì¦@”lí Ú>Œ$Ê""‘*IEõ~ýžÛ I‰NºX, ƒs=snsn£pÀ_8Ëb?Ðù,ÍB_gÙl}¸ fO0ó›PV³È’§~|¼yõ6NfaàçA>{ÜÒ’ÇÍoÞý?ï>>¾ùe¾ÐZ{*ôç‹4ͼÏóÐ{7_„ÞòÇwËŸ^ó짇7ØPÞ‡·<ðÓ‡÷wï–ܾ›«Ì»Ç-÷>-æ<þ|óæq€Ì"ò£D#6ÞüöG0ÛÂ?߾γÙÚæùìpÅÚ#-ýýÍÃÍ¿ž‹f¼k‚æ…]±ÐŸe‘#>Œ'ˆ7í|‘gð£½Ïetoj$å,S*þâÙõ¾,*œê¸ž«Ô«O°c¿¹…!x¦Úàœò­ik†²UuY=ñèz òµÄ™b„Åá"Ø56v2X7²ªø=“52zŒŽ;»À9X¤©±îʯ¸ª@ BäONä#½*÷VL6˱<÷Ŷ2tÓÁdYWþ„DǹN¦uo¡b_§½ö)ý<Ž‡…‹|€¯Aïâ8ð–ÖIê=Í×rMÄ{@tÎe·ÞY$&ÎÓ‘Fßøã ªLËAØz`€D ÁGÒ0‡ ØlU®¼ºÁ å-pÇ-wÊ–Wîn Óš‚;ÝX7ZEr/Z<̉Žæ+þ >sïÓòݯ¼¯>Â7õŠÆt$ª'nŸÛŽ0?´þ„tß!ô4öÌ~ï4Z¥É`Ï—Õµ³9ôºâ±öÄ´ Ù¹Ãu„>êDeXMZâE +Ø—{{b ó† •½¤ž*¼S+ÜæÃÐõù]ÍßÎ +©¶Þ‹N/Po¯IßâÒú€y<ï¡Ó8Îkz„"ÝáfÍ A£8õÞγˆDŽ«hæ/7ÃbpË ÍJgè™}]ñ*\À2ÄÖO­›/0'Ë™Z­°KDEIz2Ý)(;¡ËÊm1d@Lô[Vj0åÛ†‘æ„- °XšÏÀázË_`QŒbë\7rôÊÒ¶3´‘m¿Û ¹Yàáz”\æ‘2{^B  +Ð;"¼8àeÏBp¨²‡t¤¥–OH¸5Å;> qö]ëÞ¸¸ìtX¥ƒº†_Çt´–ïièõxsBeqû–Œº¬™dD@¸ ¿à“nE,Öú".»BÀ­ëª=í-¾8˜äÞ’|òw6¦3«þžM]V`MÞDÄ.VÏÜ€1»Øˆs_>p£í­£»t²”¹Àí]Ývl´ŽÜóP´›%V9C¥R?îŒr\[¢e}À6|Dk¹/ׂ!ŽéZ?5æ@0­-Œ¬Pèb;l·f-p‡û—~/-À9¶Ñ¤ó½{•:æá~+( +8߶>5äµìÑa®ÖÕݼR§8ų罕ÓR0 –t\"6æ¬iÅIkœyÍPÇžšút´ +A~7fŽdªSYɺ^iH·+çb)ÜnP };¡ƒ–ÄÉ•›A+[ã) Øð¸»KØ1üùŒˆá­"#Á¤áøò‘¿¢ß¬£ ZŽ¹ ùUë—÷Ü[ƒJÐþŒ\YÍÍ©¸,Î,Éó™(|b2¨ø5ëµs/½»Å÷Ÿ¬ÀÉ­“Ó@ß3ŸˆÒè'ÞÑv†ˆ7 :QðL66ˆá† Ó<óŒµ7pw¬‘QyäY§¤²ˆ¯^DDH°F—ŒGû’€µR WÈI«ZZiVb˜1üùÄæëWî Ç·DgÁ©ªæýÝÆÑÏîr¯¨%çÉÁ9‚åéSo·o`ZŽ1EÂá„ÀQXqM;§–Mž ÞÐvDŠZN›6õÁ”bll"Fק§ls×]àœ&W¢ŠÈÛ‹k!·‚æ}L*á"áü˜TT±¡ýÍ{û«“˜õ¿<.é$BDjK0ö<ƾœÛì_ 1144FºÿÕ[= ¾ÃTù*’üUÑ­_UmKѼ'lyÇ(\ ØÉ4Qþ|Y„Ò%üˆùà —cóÅq°µû^úZÄÙž\ă®W%¨³Búþˆê/¸áˆžtÙ…B°ïž?¨ 媡»û|±µå%¬Ý×lSaîç©úïø–ø‰å4Kg€²5³DÖΆzГ,¹æ ÜÃEÐßq`}? ÕØè±Ú}E­ÛÓaÌÜó‘È”¡wܵáüé¦Ò:ÌûÐ6süMN [$å‚8–Cû÷PGGÓ’žŸñêþÀãíEzGûŠ©ÝŽY~{{·áãÏ”A .š dQcgzm0"xà>ìÍ…vÖ_ Ÿ{ s¸’ŒMŠwP¢Æ'èÅðZG%.,d¹ÈK†ËDãKÙ½ì¢\€ØJº#×̃SwRöàÅ"Û .tM9ðìd÷†¥±…g>ŒBÐÍ0GfD¢¶lC»ØÀ£‹|Û³Àco[q¶=ñ`Ï.ŒJÛ×MG>Ø…0ÞOtʆÔè¼y –.椀›eÅÄÕ[Œ $LþÐd©$cìÄî÷ü9o˜?—è½pFdÞ ¢•µÙðÃV£ÍI.Ž |Ÿ_Z•ùYoUüÃrYÞQ¹‚5Âtè‡qöýÂö# |ªl'3®6£§j3Äf¿­'˜e~‡Î®…¢öo˜üõÏÜv ²–Uè‘­ìô…ì"?’‘î~ƒ5 ¥•¯ƒÌ­ÿ³FÔnš9qê+'Pt–Qæ=ÚÛ_p®ˆÞt‡ê2«†,Ò3±Êa ùó v«ÄàXfÉ^¡æa§0Δ@LE‚NO*ZŲ¾'Ž‹8WÖè‹8k:£'÷•e.¥Çö Go89Çѣ͸Ð1÷Êr.xdpµÙÄ?sn»«“Á‡8Yz¿Âáe\µ´>÷YÒ×°2.¶fœ•I +†Ã}Õ„™™wÇZ9áô\h•)Èlœtˆ4a'̸Ò&R¢AY”‹ñkWQTÝT`'~˜Ù8yÚVáí +C0mIJ&î4Ué÷LÕ¹¬V ‚iS•„Ââ[N½ÀGçCï4¬ohY4r²:Öo6Ì7ŒÏ£RÏÂ`ëê©ó•òSƒn¶Rð1·&Ÿ­Ô÷¢ñ4ƒ#µOM¨ñ `ÅÊÞ#.j)R¢ügè‚.I£I3ÁYZÌ™|Ü•[Cb˧0S☠+<5̦m0'¶ ‚ÍæʺÁ Ë1‰BÚu@+ ‰ÉRT.f/Ú«÷£E˜G~’‚j‚÷²ø[ÏHÉß{FŠäé#ååOOfµ—礻°„Þ]èV¯Q\cáL1õÞ#õ:­×o‹vâÅ ü¾Š^Àâ¤L}ûýi€˜µ8ãæÄ…šÉÙ”ÍÙD¼E1øè¢ó|c[3”/Õ¨:&»¨Î³ñ=ãî½8 hÛR^Ɖ4|†ïBØw‚Yµ]cÖîù‰¶‘YÚI•´\L˜BW¼ ”‹ü©Í[©èYþ{°¨³|pùhE~®~*ÝóL&%îv?–Dè„ã0doßX5—qå¶å/ÛûºmKÒB£æï8½Ú>3ìMI¯«î%i¢&vb,¬q %o=Ðθµ\9\=yù± +Ùʱåч/Ê’½cdGHÔ'Éòw†ý¬«¬‰‹TöƯëñ¤ 3¨e„”ò9‹—J`V_ù>¡rµz Ïmùk¸,Ys¯Ïµ· %²jG›(]¼—ZLð“s"Ø“IÌFvŠP)à]KAÐ-è D´ƒÜ=ý]ÓŠax_€À7ÿŸKòt|{ o6âtédI9OÝkuHf{é ™¦kL<ŽàCPMRÎ.‚qž Þœòô² +˜ÛwIy²ËŽa܈ÑÕ¯ž*( ¦_94’b»,ŽÑlî^íç®lé^\xݨ„|gŽßrɃȓ¥}‹Š¼å;y‹¢"xgV¦ lp +Œ8¨¼|°rÞ¶N¿;NýÌ!–è œ6û7üæÏZt +Ü0|Ù…h¥®b¼„JÁÁÿÛ4í·endstream endobj -6136 0 obj << +6455 0 obj << /Type /Page -/Contents 6137 0 R -/Resources 6135 0 R +/Contents 6456 0 R +/Resources 6454 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6125 0 R +/Parent 6439 0 R >> endobj -6138 0 obj << -/D [6136 0 R /XYZ 85.039 781.388 null] +6457 0 obj << +/D [6455 0 R /XYZ 85.039 781.388 null] >> endobj -6139 0 obj << -/D [6136 0 R /XYZ 263.114 764.647 null] +2010 0 obj << +/D [6455 0 R /XYZ 85.039 719.568 null] >> endobj -6140 0 obj << -/D [6136 0 R /XYZ 85.039 601.529 null] +6458 0 obj << +/D [6455 0 R /XYZ 85.039 687.147 null] >> endobj -1914 0 obj << -/D [6136 0 R /XYZ 85.039 579.213 null] +2014 0 obj << +/D [6455 0 R /XYZ 85.039 203.111 null] >> endobj -6141 0 obj << -/D [6136 0 R /XYZ 85.039 557.451 null] +6459 0 obj << +/D [6455 0 R /XYZ 85.039 168.365 null] >> endobj -1918 0 obj << -/D [6136 0 R /XYZ 85.039 557.451 null] +6454 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6142 0 obj << -/D [6136 0 R /XYZ 85.039 522.909 null] +6462 0 obj << +/Length 3063 +/Filter /FlateDecode +>> +stream +xÚµÛnܺñÝ_±oÕYYuí›c'©p7Ù NϽ’×j¤•#iíøï;7RÒJNZE“’ÃáÜg6þʃþ*\Oe«$õ]•¦«]}æ­ö°òáÌ—Þ*t½8Â¥·Û³ó÷Q¼ò=7ó²Õöž¶ló?œË¿]Ünß}Zo”RNà»ëM’¤Î×µï\¯7¾sóöúæ꯼úåó;œÎÇ÷ ¸úøûÅõ Ï/ÖAê\â‘Ë_n¶Ÿ×n;{·³ Ý0VHÍ÷³?þôV9üÛ™çª,]=ÃÜsý,[Õga¤Ü(Tò]}>û»ÅÂkáŠO-¼ycvl”ç¦ihïG ÿZÖAæÜÁà;ùzÂÓ]¯èø«(p’9ú[àë€ïìËîËæÀ{jÇõžÎÕô—wñ²!Ô]‡ëϸ޴¹E§ç'o×iè\üÎLjO›ZÀx¯wBZß ³‘Ã>¾=£§•‚ÈwèľÕxTE1ɶ<äð·Á-ÏòZ\ºÙâ´.׆®†š·}¹¹þº—Ž)«A"ßw¶¥Öœ®fWý÷Tô´—¦U³ç-ðJY€Tf¡¡2‹€Ï»u8t5sÁÈ wë ,èTàð±Cj€²[ï5a!öã@x¾ìõ>_pÞ¢àÊZ·/¼ïª©5=æ— ß„[šª*Zàd äl +BWŒ_ÑAÄœ0tvÑ„ŠÙMìë)ážñ¸0ªQ¶ æºÉäFƒñÓÈÅ'Ü6FVRF êõ·ÑnºõŸž¯Ša@ñ¾²5 à٠Û“G–ˆ€Û…Q“0Y/ ¢·ŒÏdÛT" +6 ל ×o‚ç¬ÅaBjßá4uvÍñIÇ cP@ûÂ{a©%M~*é%‡=/ì&be¢ª û;¹ìÀHé™Èñú–¶ìú¦¥Wž¿Wc7¤›E™8³ó¢ß?êÚÍÏyïÄåÅ‘gl½oZ¾Ðk–_ÛÜ:˜@|}gyöTî„häˆ#uãÈŸ°žjô`Aô?–-c +ƒø/Š²Ø$~æ|Å:¨iÕ;ŠÊpp½ˆß¬}?Z~ÊÕ¨Ž8Ö:/xfä5Áÿˆ’«éP3c³ª¡â] ÌÅ‘Äâ`ÕŒ°Kªý@Ë–[ª†|Mó­ãõããèh)ÀÝHsiu¤8¸NîÆܼ½/ÚÚz6X ¯jä€z ùXÝ Ò¤s¡b„xɳÚ†ÞkQ©Ôao[ÐðAìkUʼR™ólɃö:# Ý„1Äó +â l“ØV´÷kÒ^ñj°R[GÃÎ @:·öHŸ|ý¡x^$póøŠùËÅž¥½8UR‚F…óÓ¬aì-Iúi f×½¬af8UÅ;­ýàÇÁ°£È;Ynxb¨%Éé ¤”Ý"Qé¢Täf¡ñ +à;N³6ÙTê“Gnþã—Ù›rC/æn²b32µ”‘=—à[îvÍ’óÝ0Le§Qå#;uòG¡þ(‹¦‰ú<›,Z{IÅÜK¥’9œP%^hü*ØîyWìŽmÙ¿,¹Ö4t³Ä—Ý¤à„˜2G¸xÈâ,ìÉȬ(¡¥²‰'ÀÈE#ž¶`øÓ“)›–%·L º•«Ñ«€–䜴 D¥ÆnœL9¥+›¦…áÌõžXio|*5O¾²aÞ™ü*§j"q>HOY¿ó-p2ga¢ññ°ÆÙç‰bn‚ÀâØoP*^j÷+ž|úð“ÄÿòA£&˜lšî ¢7,\ˆ¨#UÜ$2ªp»Nb yGßj`„jÄ‘0K@½£qÀ¸*;Šúåݱ—­«¦X)E{²ì8M\¶.gúN/u3?0ˆJåÆ»Z|0©fCuÓ<+ì´jºØÝì™zø¤È âh¹ÂDþ‡Yb/ìCR/‡²2tá®}]ä9_:T$(N$"ÀäÉ¢áH˜@ùé;W<½À)#6 +u›ïˆÎkÍÀUAø +ÉÊŸ–ý¢2©>8PŸâxnS“0=~ÕÒA”§¦º3æYŒ +Ä += +ttè+[  xð›íyày?ø>µ—©\@‹¾›^ %YÒ±¶^‚–®xü +^²øY¶SæSÓÇãè¦Pj¡¯ÀeEÞ§ë+°e€®øpfFª&*¤{ÿ@H0¥Ç…\°)Òÿ¶°NÍç@Ú65~˜Ò ÁÏì|¨|#E·Ž÷iµ¶è@ f²%g{¬ñ¨ÍVŽá«´\ŒNsïAÞÈÔDr¢^—›\ដZ<š¢ p¿á˜l‹¦d”&RêZ¾€ä½L)#JNŸŠ¾:\Êý ïÙ“åhg¾]÷rNJ¹$’²›¼tiÔð/oûWsgï›sB’Ñ'›_µ¬A9Ÿ¨Wt%õRŸÀÄÙõ¬”TÀ 1èä´aîçІPI¡: +S.pÏWÛ 0"p9`<©ß@D”Ü¥_v<îÅí£æ'Îyª¥(Ưmê)m•Ž}„Jèá%Á +ë"€;ia\ßOº#,®‘«ƒ³ë`H _cË]¦bIƦÝY( ‚Œ«¤ö¤1Ó—uÕ—‘ÔǘŋBö¡{“â+«ÀCñGÊ6¿K ¹.ü`j¢±Sb»ôÐUŠL#pì +`&-¢„³¹Ž(Uy¬læÚÉuôð(˜‡8Ã=´©(ðêbEB$qe.ãY_Ò£ç’"0̺@¬±˜&{–#º¢íjF!."…8NõˆŽQ +Žˆg8*-ŽÂmÁ×Wg—¶é×8%l^êm)q÷Â!twǪG¼À? +*Š—¢œ'¯–„wÏ Î¿=‰€hb9?ÎÜf ½ +ž"›ÅQˈú…#·¼HÆ·å” é;LH ðPTù &!:¿›k4ˆàN3#MDîJW)sü¡±Ù%62ƒ xàŠ`ÂJ8ªI·Ét•5eíŽÈYå˜ÎæAj¦®”3WO|†š•š;TLÏSA?٪גÁ t“ÿ0}%}ýTtÔ?é9;½Ô;ŠØ‡ýÿ!½ÀX¡œ:•]Æä‚8fy`ï½æoÎðäÌÞŠÍjy8ܨy¨šž÷RÛ/ŽF±‹n¥PŠ¨Äùë@>‹Ï“L›oÖÉ„AàlQ ïmÅ¥Ãvrˆ[œ0±¤õq¨ïüϱл~®°Çì®`e°Ôàm”ˆ©…v À†y¬ža}ôóÀž—ˆÁ9‹ÚÆUå°µY|h,e”BÍg˜S¿Ð )¾‹ÃNVó v´›8:òúù‚³è8#Š£i}±ü7tlϹeIñÄR$EcigìÙ0ؘ¦»-þqµ-ú#.¨+€¦”µ,sn¯.UÇãnÔv^:7i$,=\Wx@å{œ«”RQ#@óÐ ÷ý¥:@vW]óÉc`ˆR7pDà-&º—ÏqeÚ Ä‹§âˆÔbüª Á°`rs_BÈ´h4í_j +seΫpÍv‚§>Áf¸‡›K/ÜŸ†V4²kPüš6Öñ Ó¡+%õ¶ž€ºýÿÀ|/wó‘‘ Ú&¬ +Zyèƒ^JL‹e;¾í?3rKãS©¤ÉëF»¹ÈN–bàJ;vî©ð¯y§MÕa~‹Ý‹KžÛTŸ +‘Úæé­Á2û%1'Ⱥ“û­ž,%¨¯×W0ÙÑ'‘8á$žÛ"À~C!ë²&iMOY$É`eƒ¢w¼—z|0(æÀtÆJ+²4ÿyàõŸ’h¼RýZ§¾”D„š £~^Èù2ÈÏŠ½í¦o6FyøçrþÄýQª"·à]#õ]‘J¹£ z£LáPð“K LúnËY„¼øû_*qýÔrï§ ‰ +Ô)‰~ìª8ä¤!ðßvÐt3endstream +endobj +6461 0 obj << +/Type /Page +/Contents 6462 0 R +/Resources 6460 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6439 0 R +/Annots [ 6464 0 R 6465 0 R ] >> endobj -1922 0 obj << -/D [6136 0 R /XYZ 85.039 369.425 null] +6464 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [418.723 584.796 539.579 596.486] +/Subtype /Link +/A << /S /GoTo /D (pam) >> >> endobj -6143 0 obj << -/D [6136 0 R /XYZ 85.039 337.609 null] +6465 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 573.368 211.804 582.936] +/Subtype /Link +/A << /S /GoTo /D (pam) >> >> endobj -6144 0 obj << -/D [6136 0 R /XYZ 85.039 239.448 null] +6463 0 obj << +/D [6461 0 R /XYZ 85.039 781.388 null] >> endobj -6145 0 obj << -/D [6136 0 R /XYZ 257.152 245.422 null] +2018 0 obj << +/D [6461 0 R /XYZ 85.039 559.099 null] >> endobj -1926 0 obj << -/D [6136 0 R /XYZ 85.039 134.586 null] +6466 0 obj << +/D [6461 0 R /XYZ 85.039 522.232 null] >> endobj -6146 0 obj << -/D [6136 0 R /XYZ 85.039 99.84 null] +2022 0 obj << +/D [6461 0 R /XYZ 85.039 330.425 null] >> endobj -6135 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R /F62 4047 0 R >> +6467 0 obj << +/D [6461 0 R /XYZ 85.039 296.285 null] +>> endobj +6460 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F59 3455 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6149 0 obj << -/Length 2524 +6470 0 obj << +/Length 2965 +/Filter /FlateDecode +>> +stream +xÚÍZKoÛH¾ûWhOCÍ&›¯¹,òšÙLÛkÃì(‰–S¤†¤âøßO½šlš´`±À"€EvWWWWW}õ`Ôƒj‘„®¤‹8Qn$‹íñÂ[ìaæ× %ÞB»^âÔÛõÅÕ/a´Pž›zéb}O$ëÝλ½¹]ø²\AàøÊ]®â8q¾.•óq¹RÎõÛ×ïæÙßï>àƒïÜüÂïo>¿ùxÍÏo–~â¼Ã%ïn~¿^ß-ÿ\ÿvñam ³Ò®Ž”毋?þô;ø· Ï ÒdñÏž«Òtq¼Ðaà†:÷òâîâß=žÓ ^5sæ•¡X©ÔMýp^/+ÔC˜öšñaX»ŽlÍ€2BPG¨SçcÕvY :)³®¨+8q9Y…§ÝñË»ºú§ôþÜà P1N•à»qú²P‰¼0ék7öâ‘Ä +ÎN%VÞbzpƒÊ©:¨©AL…UÎyûLº™Ýí*P¢ÙM…3–³>-pUÚi‘m¾Å¿†5ïršÙ6Åf¹òc''úÐé9?œ–,˜Î6ßî€ ®ºóR ï3ìjþÝUÇ/_qË +ÍoSTK¾>Ÿø7³ÆäXá@QíAI:`S/d9Î +©9*CA³M™£ÊèªÐÈRRC}|ð,p`ò ™ìH=N€‹-뢕1ÜWeçî`N B¤ À­ØÒmk’¬CÍÔ%ÝãsÃÏ_ùÄ´ó£ð~_IfV Šl„¨;Ëóþ råõšßaƒéQŸïÚñ=ï;#ÀíûwüpÒáCŸû3ùŽ ‹$¤)Ò «æRfÏ[äà·L¶éò²Ê;£;€AwºS>âjÚµ,2#Ò]v¤«Î^ÅqÜ0vU2‹'*rƒ0©w­fÜà!~Î6t5x°7ǧlž€VSž_OpŽ0vÚC}.Q+a‚¸C»š_;pÓâÆ7—t½4µœYk°›î8f‹‚!c¢ZûÎzÂg7ø$kvG2¢íš¬#ãÔy+Î6yùÄ#dÖ#†ê¹€ÀÈh;‚Q"<ÂÀ¶‡Œw:wÒ†Ä#`ù³MÉΕse¬71Ö›ZÖ’örÀ;C† XÆÞKq-B’ƒçe…Œ}ÎEI|„ÁÆ x"%À³³•Í’±TÓsœ[r_4òŠVÑcYÖÈdÕ•Ñg.ŽB¸ ¿‡Œ J<W·DGð7'ƒÙv[S¤0ÀÚɶ|`_&Ö0ðÄã~ë}ß&^…èÇÁb9ŒŸFÿo¾%D¾%1^7Ëmž›eèÃsˆep8~“ƒ©íùˆ÷AÙB÷š'&vXK@ÍnÍUÅ‹ý1EOÉ°Uìû›ß± +'lxOmVÉÖ¼3 GŽÛŠmRîwÏKŸpÃúÌ;eÍàÅñTšýŽv#MñÔ:¦¦8¢|¼G‘"çWƒÎdE ™pŽÏEKáK1ÔƒÐCΊ†0G‰xY[À»ÂyÅ”ò»|ÏfCùwPùý™èêùŸ[Û»µâxÓ@žST)nz tŒ:äY¨:ñéwÆ.f‚ÖœI¤•…¸+c eW½ Ù8K+˜ØŠÚ"äËÞCš™¼˜§†n‡?–§ú’§~Éÿ:#ÒSîœó +ðf.s^Ìçå&*}=_ýöì‡z°g?D$ÃåU"EÆ?óÅAÒ$A.çû(¶„䇃â~òudÝÌÆY“[ ‰M3ƒÈæ‰iÎ-›å%£Ç¯ Q†b(•C¾…:,„:L9ŸðâCªÖø¨ß‘÷í?foŠŸy=ѽà@‹øAÎN¦½ +’ÈMu8vä²?A æ'±g% -Ü.¨?/1훞)Õ®¯Ì‘p³í,L§õ)¥ÈN'Öâ0qC_Ë⫼Û^²£»›Ù&Âc á®À|ÛÕÆÞx·-×U'(ÞÎ)q$4*1ˆR <áÐbl‰å·x­?uÌé7TäÉ,êç7Ÿ>p¼º¹–‡ë´"LP溒åvÔú,åOv,ð’|ÊÄ%õÀáæiâ¹75ä.ìMÁ(ýàúm&“ÇìÁø,ÂXÇ£Užôã3(VGËáXa Gô`#<–õ^è…sWóï×¼çŸTWåî ¼¯Y÷[zàEÎã×ã-z–ó^È5JÖ£0Œˆ8ø¸!™s~É6r~"²(FWMcè$(àôU±Y5òg0¢ w+$ xŠ¤"_-Ñ +(ÝÄ-2ž¾§Ba‹~Ë&Ãý Y͙ϡÑdLê +“N?¢|¨”tMÎÐѽyhx=].þrÅg§ +ÚOÁ:bPä©–Dgš½|ùõ•39L%Id•$³’Õ”åùž©*»®¯ú@²É¼+ÕÄ>ÝbL;t9:ž»§èpŽcA¹%„ðÚTÂ爰¦¨ÀÂÏÆ(¨b¯«–‰¸û™¼¹*k +`X°U‡'ÇVmç»$ÃÔV†8JЙwù¬Íã- Ìé`Ô¿àJƒG=1÷Äp„«ZdAÀÜVð[K s[éÑ¢¹ +XK[‰¢}“ ]:xÖðÂtÈý+mÀ‡zWZºZð{2`?JQL8¯ˆH³‡|®s'%÷¾µBbAN7êZR»7æÜa`ÛÑ\JŒƒ¬ZîÚ}zÉ©„Iôˆ­ìߙݤE‚/|#2C¹,;‘5² +rŠî8Jvö†`’Fsg\f…Ås9´6=ߊ@†m4Y5-D`*ø-óÌh _m!†t +&ú“0“²>MÚÄ®ØPÙ‚j-$·š*†ÎÄÛò·¾± ¤¤F桨B úü(Íõ[”\šýM~Ÿ |Жu(;ìn˜9'!lóÏ0Uáç¯0–ÖQø +ÆsHzèºÓÏWWîCÞTyéÖÍþêtÞ\•Euþ~ÅHåÇ'º–V@w-f#WÓòX%nì's(ÿ2¤O«ì‹,ªb7J_.²½Øÿ±";"{½L}óuE™&Mc¿©Ú·üë†jÑîP|¿í£xM È©WÓq¾þ¡1ùì¸Ú¢–Pðç¡ çÀR‰Y ÕVÈ šüÍ™€kÙ€ÇÙzMÙ˜óÃÝóT§O5¬¼iÇ´£dEò{à+_“LÊC»VükcÒ+hLxær×è‰îc‡ŒE÷õ º¯Å9ùèæ+óÔ©¬^óNÆLÀÁ¥ò«ï8Ëøèû©´OpwŠ'„AØ~Ï$*àK_£àËä«œÆDdœ§ò¬ºäcrØÎR—³í™so„\!Šì¬;šL¢•Á-ÒAÖì8ûïÑ_N¦Z +#JÚ`0¶NlxàÙN'JH-HtXö‡ºžruúÃuKõ½*ü9—ª›'ÙþY† +¹”ê?Rnà0Ak+E¬røŒ¡=oˆ81 UHÑë)¸Þ€¸Ä?õÙAšXmò!2.l̺þ Û¶Ïvðû"‹d%Óž8» )JªÖMŒ2Q”?Uîf + {Q³5òñ?üþgƒûË`øz¯¬ïFÀ¿n¬endstream +endobj +6469 0 obj << +/Type /Page +/Contents 6470 0 R +/Resources 6468 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6439 0 R +/Annots [ 6475 0 R 6476 0 R 6477 0 R 6478 0 R ] +>> endobj +6475 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [513.95 283.417 539.579 295.106] +/Subtype/Link/A<> +>> endobj +6476 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 269.867 167.796 281.557] +/Subtype/Link/A<> +>> endobj +6477 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [354.316 188.269 539.579 200.262] +/Subtype/Link/A<> +>> endobj +6478 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 174.72 137.581 186.713] +/Subtype/Link/A<> +>> endobj +6471 0 obj << +/D [6469 0 R /XYZ 85.039 781.388 null] +>> endobj +2026 0 obj << +/D [6469 0 R /XYZ 85.039 761.463 null] +>> endobj +6472 0 obj << +/D [6469 0 R /XYZ 85.039 736.911 null] +>> endobj +2030 0 obj << +/D [6469 0 R /XYZ 85.039 736.911 null] +>> endobj +6473 0 obj << +/D [6469 0 R /XYZ 85.039 705.159 null] +>> endobj +2034 0 obj << +/D [6469 0 R /XYZ 85.039 467.996 null] +>> endobj +6474 0 obj << +/D [6469 0 R /XYZ 85.039 433.251 null] +>> endobj +2038 0 obj << +/D [6469 0 R /XYZ 85.039 160.451 null] +>> endobj +6479 0 obj << +/D [6469 0 R /XYZ 85.039 126.009 null] +>> endobj +6468 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R /F59 3455 0 R /F58 3380 0 R /F35 3036 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6482 0 obj << +/Length 2083 /Filter /FlateDecode >> stream -xÚ¥YY“ÛÆ~ß_ÁR V‰ §ÞV²”ØqbÇÚÄŽ°$v‰,I0¸«Í¯O_3¸¨\)ÕŠs4zÝ_ÓÐ+þéU)ßd«$Õʤéj{¼ñW°ó§-!ÙôhÞßÝüñS¯´¯2?[Ý=t|"Ffu·ûÕûðçÛŸî>þ¼Þc¼ÀWëM’¤ÞçµöîÖ©ñn×Aê}Xo´÷Xº}£>2õ??ÁÒgÿõÇoÿë8ÿíîû›wN2w&H‘¡Xÿ¹ùõ7µƒWøþÆW&KW/0ö•†íã È¥¢ÐÈüpóùæïŽï…+~êš"“ª(5S5èèŠ"_E~Hjh÷ {ïâ§Þ_òó²ÀÑid^‹[ ånÔ=ðS ãê_¾ïÒ˜ ´×0U~‚…ïï{]ÐImU»³ÞÎkáó‚‹´Ýæ÷Ž!)4‘w·/…¾ÁÕ¼-<·óZ ßÛW:”Å M)ÒÏ8‘×ã÷Aêêò¸Gû27u •cB~3:&/åáÀö?YÙ˜qÍ«÷ë ƒ“j$vû¥.á¶u˜ÀË…i»—£BƒCõ($ÕŸ¶ré`ä´)”¨h:ø%TsàÔ™Šâ¯8VGCˆ -`W«,ŠzˆŠ³`ËŽ¾dœ‚µ¢È÷ÀÚ¯[6áu!âL«ô+BôhfaǾòÅr·h܈DªFh°¹GP‘íCïP> øX‘Õv¨ÆC!XûeoYÈ3¸K*/v¼“©^e÷Dþszâé6'œs@ ²å Â#±Ç–ìg…E<ùFqn;þ2˜úÉ ‡w Ò¶’ß}qÖâ¯ö0r^~;ÄfÍúç|åU\<5,_Žü“Ä«xϽéT{¨8­ÈC^%z-«ÎÀä±d™eê ÆM~”QolH/˜9¹ ü²»ÀàÍÏ}ãƒïI˜7<©NWTð QìH{/â2Ûêˆ|ΰqi‹ºQö¹ Q~ÆÏ}FóŸÏôÚUÍ6B_ô`²ÊÐXèÿŒÔëS&¨22JT?Êa0|ÜœRZ«Ôþ¦/g38:/•y[ÄèeÈUº:„ä¢6ò/¯fx b??Í–AÜÑ̃XhF ~fL4ý¦Ö -jƒE),ÍDŒ!†ãDép(Çw†Œ À%!L £‘ªOí2ë¸} YÒfKqCAÅÛe¤k -W™/H³87Áì$£€O'ÈÀ2°™îÅ,— ‰TŽ@Á¸¨Ú½€<Ù$ƒ$åêLyf óP‹àBÝÏH/u¥ß8˼¿Á‹­Rñ™~š&n]Q7`NN×È c6>‘óÓïºÚ÷\é‹j~ZwκXUg,|^™ò¸ò…ÇpÚ4c"=Š–S¶.ÞÌ!/Mi,"¿G3‹|K3B~K¯pÙî'˜‡ÛU˜d‹ç[š‰CÌG‘ÊL8`9nûébÜöÉ‚ø3Ðæ7ö¢FL·ÌÖ2o—·r•j,ãêB¡ÍOûu,ÔpÇzXÙBIü$—²½õ°ƒÓRÎ&c^+fIР+£bÐÂÜÍVµ\RØF˜…°ÑÉrAÖ£™‡‡ÐŒàqÌ¿4‡þK ½ƒL/ -ai&RŒâb¬’0ˆñ©”D±×wåRk™ äJ­~tð$<ÙQÁOÐõærÄÿ{‰°æM*æ€úžî@m!ç5œáõv€Ô]ÿ+àZbu åbMK=9Š"§ •!¸E/ŸŸªöJ²åJÞ¥R¼PW£Úów‚Æ$Š‚å’°G3 K3 ½ð—-ºÇe7M”© -ó%!,ÍDŠhB•AñÞㇲU!_î‚0î:¸ÈÂeŽ®ÄÁ%R?\ðÇGÎÒ¬À±\r+ËLHú÷ó^„©Í_ÄvÓdqaw؃˜Íw‘3‡@Å~<ˆ!׋¬Ç {‡\F0ªåŒ×ÔÌ[Æh•&ËÅVfBóûàûJ§a_ˆåŽ#„Ó«ÝÆå´,«ŽJzçq]]O¯œ ¢pQ7–fràµi ?ø¡b¿ÎK©V Ô#˜ã Ê8¢ ôk»Pò—Eã:ŠÙ¨Ë£¯ô1áéêvyæ’R8['åèQ. õ¸3ò–Ag*Í⫉M.&F8`Ãцº³ë†|-¹àÂIŒb‘¿•ˆÙk)º½;ß°-Õ>ÇG -W]$œuÈh*0ËUYfÖE,ÍÈENTF<u×€é$ZJ/Ëai&‚ŒnÕ™‚ØÙäGÌ8|Ã& ÁÏ‘?ì´÷NšÃXs7ø!Âhï;ÜÀª;°%uEF–ö’ÓðœÐßkäÉ —Â"TÝ ‰>‰`mÞ]Gb¬²(@ñÜÉí€ëŠpnVε—ƒñbg·G3Û^ ä«@ÚË‘´—OE›·ùáiNytQ„Žf¶¹ø¾J’Ä5—ÑíÉ4vQ-o{yŶ^lÁ~?à¶jc;ÿÕ†ú¥lÚ‘Ž‡Í3¹ŒRQ–K„8íFŸ$Z:ØIè¾Ót 0ùÆ-¶Î\ú¹”{Àµ.èíîyÅÒùnóÇbÚADvýµaHªk×+YÒồê0†8±hÑŽ„ ê¾ßúZ…¾±län™L…«öN³$ãã†aBÊè \iÃmÕUÈÍéYÝæ¶ï™K‹ÀÖ°ÛºÈÛÒ¶Ÿ,Ô-ECñmu¹·7+xúDýÔ ÿí>\7ö}׋ê>B%§Hìo^„3ÆÐPp¦Á²5:šsÑWí±p`gщ×-Ò;ûŠ!~€äŸfoïI¡/Í\=bŽC«mu’'øCÛF>f°Ç¢)q<·âÒ7·\úö‚Á=uQ`½d?ÊL¨é^´ëdÁF(®sÊ@ß–:ꃘÀ…K]SÆO\]Þk«ðÅ)ßíÝËÀË/mu˜á§«×£ Ù×,œ8þ¯ÏÝ8pãOÍL5P j+ ¾‹ññ¼ö³øDàÿbendstream +xÚÅXYÛF~ׯ°/`Ql6O¿M;™ 'ÞE6Z"%¦H-IY`üÖÕ%qâ5v‘`0PÕÕÕU_]TSþÔ4 ]O§Ó8Q®N’éz?ñ¦[Øùn¢„›®…¸õÍr²xFS幩—N—"Yf¿:¯¾¿ûiùú—Ù\kíøÊÍã8q>Ì”s?›+çá›û‡o_òîûÇ×8ðwoxáÛwoïîx|7óçyõîýÃòqöÛò‡Éëå@˜yà‘Fiþ5ùõ7ošÀ?LÊÑöÉ` .-F1?¤l±s +Ç?²|pŒ;¦ìøf9·!¿áqFA£^Åg:Šx¦±¹¿,vd¯íý&?_€¿kdÕkbx¾Ø\ñßÔ”j¤9õ–Ù +Žu°áΠȉ‘¤xlc/Bk¢ãÜêªÊ×l6Ù4„Ä[8ÿ˜%šu¥€ÁI]•2êƒ è¥ðK†JùŒGú^ìªÐ·uCÞ­U; Ö·®©<ízÖ7]ö Û~YÙa߶$U†1ø/\¾ºò_ÜHOòc"­y«9JÙ@ÉU†Í$uFNfò=¿w›ú¸Ýñ¼O…moÉN Àûù9["‹_¾z]Šk>…÷˜÷€O®9ðSI–¹p3+ØËÓ`šÖn¤#bÕÔu÷7È´ˆ¾ÿºî¢5û•Y´à™ë¼7Ü&Œ?q"uÑ!‘×Gìiï‰éž{–Ò”}ɳM}´EŸæà‚ž«ƒ³-ŒÂ@$ØRÆáÒpL9¨/+ȽàLŸg8j’k×PÖð™’Ìÿqö¬ÖƒÉPk¤÷Šµ0oÏÚM] +jz éî{©ë«ð˽„v°ÓX'!;})¡ÇJ‰1K='›¹Q"ÿ$¡\6#5t>êÂçïÈ-_N*‚-Žµ”4¦•–=H)òXÇP·AÍöUNqc^lÎj¼u†g÷]5âÉÿ›þškü/ºü»ß Nî†*YŒŸœ”;žö™'i8ƒãœƒÃHé(è*¯K4ä¦ÈöÐr…)û¤ŒÓcK‚`e’x\úãò–"ïñ bI£{Q@ÄîC=N>m!Å å6?H\¥ÕeILì÷Ðø>]6ÉœTÕƒ¥l‚û4¦§0‚[¢¯ÕSìÛ#˜ò˳@’nêQ°‹hÜ7»01›Î¦©¾G-:*6·cÞº‰°úäÁ€¸ÙKê  Œ*Ê\,˜¢>ä‚qg²útyâÖ5¶Ðø…H…Þ3l¯#”‚Ú&ñ/¤ã¢D¥ãMn\% + ©½`{ØÛDþÐ +Âaÿq }%ËÆÛÏ‹…±A¥ °?Qß_òä\ÔÂÄ»zEÃšÚ ’kÐFŠ >)À~Ñ·8Ã2êVl߇>´Ÿ ÊLJÛí˜>¥ -N/̲6\I‘”Zj5TùçN–Š=­} !wÅ-ÛHX¹÷¼Üä+Ûp’* 󊊹™æ…ýÃ-Ó2ŠöF¡ÇŸ”?h>`'“Ï-(jÝY™ÙâR½\I5Hü”\¸á_ËôÕ™@$!UðÜŸó7§§ÿ²vY´¡™eSl%#|âßó϶É_r…KÎË}»ªÎÚ‰ÂØÒø܇$àe +â#TK:ô 4ùÓª¥±›¡—:¦OôM°(Íjmmzîë8fSS-ÛTçà3ÄkQÚŠ!/Õ؆k´µÜvFÿ͹y +™. ¦sþ±÷ÌGvqºÿí»¶ÆØ;ð~ß‚nö¦øŒ\l+àÈâóæendstream endobj -6148 0 obj << +6481 0 obj << /Type /Page -/Contents 6149 0 R -/Resources 6147 0 R +/Contents 6482 0 R +/Resources 6480 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6125 0 R ->> endobj -6150 0 obj << -/D [6148 0 R /XYZ 85.039 781.388 null] ->> endobj -1930 0 obj << -/D [6148 0 R /XYZ 85.039 719.568 null] +/Parent 6485 0 R >> endobj -6151 0 obj << -/D [6148 0 R /XYZ 85.039 684.823 null] +6483 0 obj << +/D [6481 0 R /XYZ 85.039 781.388 null] >> endobj -1934 0 obj << -/D [6148 0 R /XYZ 85.039 260.296 null] +2042 0 obj << +/D [6481 0 R /XYZ 85.039 706.019 null] >> endobj -6152 0 obj << -/D [6148 0 R /XYZ 85.039 227.875 null] +6484 0 obj << +/D [6481 0 R /XYZ 85.039 671.875 null] >> endobj -6147 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> +6480 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6155 0 obj << -/Length 2060 +6488 0 obj << +/Length 2441 /Filter /FlateDecode >> stream -xÚ¥XYÛ6~÷¯0òRˆ¹¢nçm“&mÚôʺA¶\‹¶„èpu¬ë>ô·wR’¯m"‡èápøqf8óIrîÂ9OBáú«yœHá'É|SÎÜùf¾šI£±4*ˉÎëõìî]Í¥+Vîj¾ÞŽvB„þ|þê¼ùúþÇõÛ‹¥ïûŽçŠÅ2Žça!õ"ñû…—8oKé| ¢û×8úð–µ?½Ñ¿ûáËŸAŽ¿_3{» {ŠÂúcöëïî<…#|3s…¿Jæ»BÂt9\" |ó»˜=Ì~Lñ\0çU×¼`5–r%V^ø¼§")‚È<åÁl ü šz*tEèä)pNî ƒ•ó ÝðENYÃS:i_Àñ5δ<¡žTŽ2õXh”ÄŽÆŸ­> R¦}ËWf×gÑ:„^†Wâ,=¹çu–#¬8Ft€sÓåuÅ‚ ÊÊ«ƒ‡ P<‡€sZÑå0¬v,®·ü|Z„pΕêÞد;8?‘bðZ?y1ø ´‹ÁO ÕeªãQ†ÞB,OøŸf$´ŒhƒxO¢ºíHšòhØJk<Ê:ü¶”!ùaÓ7x\,ƒUì4šŽŠ'M5ŠW<Ûe¼ÅªÄÅŠ§Þ|zÀAät6ÛºaQ]ik]‘ùÚس -ªª­ié4<÷›ºV$vv+?tòŽ'1 ø¤YÕð۹ؘ(™ž?XÑùKŒòm»'Þá®æ§‰B~@¨­ÖtuʇŠ?È&ùCây$,‘ î0"ú·=§íT§KfDز\qÔCx½!´Œ’” nEN: }ÄIÉ`á¹ÅÅç<®OÂViËOUM„'[œm‡Û×}‘²ê 8Ÿ—{º3cfâC:½™''ƒ,‡ã]Fg?äfk2T:r‰q:¥ñã•Ê_ƒøÙÂ1ª UOŠÞŽ¡nD®Ñ 'UO:K_è:_*ô5åB}w«Þ[ÏBunÖ°0Š$,?üðê|; 5;ö£AöÉfg4>Nv¶Úˉ:míO·>·‰{g]·uww8ĦmE§ŽEÝôB§ýÝ߆y©›»£Z½mïò*ÕŠ}¶?RÈ$>|ÞÆŒÎÌ« -\‘„¡|}¼ðøXFrÐúÿíåDýrãs›¸ó[j®júÅ—¹¹€ù—Î<`uþÈ™%Â%xžwRhÞc] ì¤Ã dÃeÌÜ<¨B)Ë?¨‹«€:=¬:Nl=€³{ØÁH«€.'M¦=±¸UX¨šâhö¯Q½Ó\·G X7–¦cÀŽFû7Wc =š&XbðVÎûî?•Ð$L¾ëäuŽ¦TL ˜Û₺dÅDcòÛÈÉ€¤yXƒ¸ - €¨ ëÒZçYcĺ+b¡3‡ÇKYa§+Ýä\öÐøݧLaF, ´¨(¸å\9oŠÏ hú‰¡æ †çp=N¦EF¦™:$f~DPµ= ¿ÌP–μþøt|z2‡ùO6¦º¡—–„6t'®ñÅ{KÓ‚È¥ËƯ)e]Ï<Ç MÅ:eÉ8€0qvBÔseß#¤ój±Œ€¼S&Ôå´‚×r2£ßíôpÁЫfb¯º .Èô¨n0š[”x¡ó~ˈ(v]fß­PDªÅ(//ïyVó ÞRfP5š¸·jRfëH÷M}òf¾î‡Mˆ¬¸µ ¿­¹Ó -™Í‡CfBuÈ[:ì4|ÜR5yåŠÅOï®Wf¯›½ì:©ô Cñó/Æ›î˜M:Y‚ë‚û„¼v×ò³ôY£ÎMÖæ{‰L<ŸãµVï?òÚ‰úm^;Ý{Âkë½®TÕ夾кîÎAy ð,/<uæ«såª\)ü0"$-¾RÇðJ½|j)}ÖÓÐãZr…>“.Žõv 7uµÑCcÝž¡y!'6 ðë–Ù G/Qš\ar¸¹¡ÂP a<|þ -}¢'¹žä6ª[bd VI¯Ä—U{ —oc3웸üŠ -ÏÉgüé Oüyçcúº(An‚E-S¿Öø~šµ\ÓÈ4Ÿ Ï ëÌl'3íÇt§®ž\;kå>®oÊjrÿà@0h{ª¶5ò“¸röë)€¥hXŽ¥3ÅÆ|}ÊémÜʈY÷¦Ç‘Ëá2Ÿ:ló«LŸÊÛIÑTüµçìóˆÑ|´_`üñòëÉZûùfér…·ºvaà;à}jOà‹Ä_]¿t¡ #-t¸ï†çxC?aâ_þåêWdendstream +xÚ¥Y[oÛ8~ϯ0v1­‘¢nö!Ó¦Ýt7iv좴}-ÙV–¼º´“ùõs.¤,ÛJ›í´€%‘‡ä9ß¹3râÂ9‰|ázñ$Œ¤ð¢h²Ú]¸“ ̼¹†Âhá>Ný²¸¸|íéŠØ'‹5‘,ÒÎË^Ý/®Î<Ïs”ÓYF·©tn¦3éÜýrs÷êϾŸ_ã‹rÞ½æWïn¯nîøýjª"ç%.yùîýÝb>ý¼x{q½03ÓBró¿‹ŸÝI + ¿½p…G“¯ðî +Ç“Ý…ö=ákÏ|ó‹ÿô»ðœžðª™g–b&c+—âàÇ=2ÊAÀðàà ¨ø:vîP¼ùBçCså2/Sþ®J~^Ýüfe9ØÓBwö`éüÉõÝÅ·o[éd+ümq˜ŽÌs3ßÒ)xp]ÕüÒn‘”×òHÝ!a™ã·(#)‘kdQ…Âp‘“ÅVªX‚°%êw ¤$°Š]XŠ[ÿÆÈVšQ›r¥^%mŽ|"å +xœèºbJ,©X9›¬mømÙáæEËû% ²sùÚ¤@·!@Æ0ù²lšS;SQ$ èÅø®¹yB{Á¨±™™^YÞ˜²¾æd¢©˜á#®Ð:2”yÉ¢µ çÖˆ_²’áçkÞ®¦*t¶ Yš× ’tV3ÒÌÌó•ožI4ð˜¶l«µ®Ý5>]PzÆódGKø“©âzE»‚Ikí:;SÊA½Ýàç*)yñx +ûÑjŸg)O´Õ¨–àUÅFêË®©/AU—M¶êê¼})…‘<Ç­=')í.<}‹·„ÌÊ3#¤#¨2D>í¶ªÈ&¿àÉ Ÿ±Ã¦‰.ñ1'\ŠÔ8n˜"*äpI›±§IkˆÌ“`%?ëìúX°èÀgf¦?ÜPH6j²ƒ·IùGÂCEþ_Ã,º5ú€÷5žSNƒÙm^Œ€aÖØ-Jo#Bˆ"’Ñ‘ýìëjS#¾òðãLa—fë«="Ù­Oºv[•Å˜žg–b1d¡‘i…á*3oKŠ$iŠÐصIxu{ã9g~—;i#VëÍG2„Y[Åä'µ³°JÅøª•vvÃØ•ñXs‘324¢ýž´_ÕmÃ3y«0ÒWG0â¥Dû÷¥G¡¶+ÓaØ8/¿hHÑ8– õZÛFÊÞø€¬ä¡¦[‘!ggx°ÎŽ…‘®‹2Ç£Õ”tò‰¤FE„gƒØY²«0áý4‚lrËg€ÁYo=bD`0t Á‰U‘ë¼op5À±*rZ-cXˆÜ†¢šMjZ*§¨’4Aél@›´šcþÝok¹îÌJF –4+ÃÇ®†xqà#±«éÃøî¹”14ÔN9Ñô‚7ïYõÈÈéYTâ –Ø!+ƒ¶ç¡i³ æ¡VÎmU›iB+ËW_7àlÂfRu†'J8Añ•(ƒöD'LlQš …ä`k»v#çêþ_Bãàn8pkøXSÌÅ_VñùIzú_Y]Z]<| ß¿·F{&—±< –XCâWÙ—|e˜˜û$Ü£¹PÜÛ±ÉÃØ˪䴸G¹Í®Z,Àô·Óºc¦ ”h,<• %®â¹PfCÞwG;7;;“PFÁ#›Ò"£§vnžéÜÀ¿9UÔ¶ +§Ù-‘ +KD\t¬JH%aÄSÂUêÛ†6Ï89×IðD^°þÌXRÃÃIm«¼Øéƒ_–rͲƒz!Åé‘ +(‚.#Ì‘(H´)vt,|r[sØZ8ÀƒOS/·uUΤ™AiaJ(«sn6Cî?<ªK¥Aj‚‰A£aåjlxPСá0$äŽ$›]Õh&q¤âÐ Ea|Ž8Uy:°Í%þš-Wõ†àvı¡¥ Àƒøå›Aàú÷¾Ù›2ƒH OÏ xÆ'ÞùøÆÏ TÒðÇI£OVb ØÐL…B±±è(æØK‹AçÄí/ Ùù‰¹çsTÿeæ2$/×f³›¢BÝ'ÅgÓ·ñÖ\iž†]ƒÃ ¢¯ãó„&ùÁ;¹°òÎî°pqì©”ˆ#¨Bá‡GñîôùCê}q*X(¡ÍÖOÕo³CÍr„ìëíõÉ_‚‘k妞;ÀÛκý)Ò  8RÇLœ§ˆò~MPKén0£FI¹¨Yö¿c’aññwÓlg{ +^ubÊ,L«]b-'HÒ5PŽ&¶ŒÎ¬ÍcíF_??ƒéŸŸuï|AúìtbÔaÔ^)q;ÜBòEÀMö³§ +ÛÙôoXïòÔø꺮Lò–.ü3× Æ;Õaˆª`‹§†H¡`ÍãâØÖ'ÝAIK|ÃñGrÐÑ3>í%Ú‰˜S#”>eCŽ>åY¡Â^(üæ@)Âl]WÝžŽûžˆG*ÛüˆþPFdÂ^ôðHVv»þ 9Ü_UÆ#‘{9{ÐL¿™F‰°¨û?%ÂÓyßtY3Ò"=²œ]ÿÕoò/Gˆiy¹7Œº±ŽÌ×Þ—_ƒë:î.Í(–ƒ+t}^‚AºZ÷ùÉm×/öšÎ´«€4‡>ÃÀj˜½ì%û7q‡2}_Ð¥#‚³­v^]Ðáà%\¶—?½ºüéýüÇ»4Û eî°].“f{–ü|*¯gx1øýùDA¦“í/9°K‰H?rÄ¡ãù ,òB!º§Ç³§‚³Tœ§Ë?l“Sendstream endobj -6154 0 obj << +6487 0 obj << /Type /Page -/Contents 6155 0 R -/Resources 6153 0 R +/Contents 6488 0 R +/Resources 6486 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6125 0 R -/Annots [ 6159 0 R 6160 0 R 6162 0 R ] +/Parent 6485 0 R +/Annots [ 6491 0 R 6492 0 R 6493 0 R 6495 0 R ] >> endobj -6159 0 obj << +6491 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [113.74 564.53 442.184 576.523] -/Subtype/Link/A<> +/Rect [109.801 476.323 539.579 489.224] +/Subtype/Link/A<> >> endobj -6160 0 obj << +6492 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [101.164 537.735 164.157 549.303] -/Subtype/Link/A<> +/Rect [84.043 463.38 197.243 475.069] +/Subtype/Link/A<> >> endobj -6162 0 obj << +6493 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [113.74 325.034 281.822 337.027] -/Subtype/Link/A<> +/Rect [84.043 449.83 386.172 461.52] +/Subtype/Link/A<> >> endobj -6156 0 obj << -/D [6154 0 R /XYZ 85.039 781.388 null] +6495 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 345.619 150.733 358.52] +/Subtype /Link +/A << /S /GoTo /D (winbindcfg) >> >> endobj -1938 0 obj << -/D [6154 0 R /XYZ 85.039 761.463 null] +6489 0 obj << +/D [6487 0 R /XYZ 85.039 781.388 null] >> endobj -6157 0 obj << -/D [6154 0 R /XYZ 85.039 739.701 null] +2046 0 obj << +/D [6487 0 R /XYZ 85.039 761.463 null] >> endobj -1942 0 obj << -/D [6154 0 R /XYZ 85.039 627.47 null] +6490 0 obj << +/D [6487 0 R /XYZ 85.039 743.459 null] >> endobj -6158 0 obj << -/D [6154 0 R /XYZ 85.039 595.049 null] +2050 0 obj << +/D [6487 0 R /XYZ 85.039 435.562 null] >> endobj -1946 0 obj << -/D [6154 0 R /XYZ 85.039 387.974 null] +6494 0 obj << +/D [6487 0 R /XYZ 85.039 401.418 null] >> endobj -6161 0 obj << -/D [6154 0 R /XYZ 85.039 355.553 null] +6496 0 obj << +/D [6487 0 R /XYZ 85.039 331.87 null] >> endobj -6153 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +6497 0 obj << +/D [6487 0 R /XYZ 279.387 337.844 null] +>> endobj +6486 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F18 4228 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6165 0 obj << -/Length 2240 +6500 0 obj << +/Length 2286 +/Filter /FlateDecode +>> +stream +xÚ¥XYoÛH~ׯ f–¢6›Í3/ƒ$Îì:À8Ùµ‚`13´DYÌ’¢Â#žóã·®¦H™Ž½3ˆöQÝutÕWUÒŽÿ´“„Ê3©'Z™$q6ÕÂsî`ç -ž(/ +qëõzqñS9ÚS©—:둬·¿¸oþùêÃúí¿—+cŒëkµ\Åqâ~Zj÷j¹Òîõë«ëË—¼ûñæ-|÷ýO¼pùþçWW×<~µô÷ yóþãõúfùÛúÝâíz$Ì*PAdPš/‹_~óœ-üná)“&Î=Œ=¥ÓÔ©AhT™—‹›Å¿†[x/pøÔŒÎ+K±Ò©JýpÞ.+´C˜–ñ½Ë€1Bv0*«„Aê¾CõêÖ t»Ý>çÁMVÝf2Ì›¯y#ûõ݇Ë7<¸¬«¬8X#ÍHh¥A +¡g$|{Xú©Ûå(pô“”9ù©çî@ʺ,k|–ûâpÇÛÒ ª²ÃVèk&¯²ÿ"¥n¹[²jéÇ.ª‡Z¼T$ꆩ>#/Ðf*ÁXEuq¼euµûç©{¿‡1Ë£À9“‘‚©85¢¦¸‘Mì`RèX¨Š)À‚Hùàý ¥­N¸ùaäX£•,„n½Ãoà~Cê¾áÙ§,Z‘ùºej^„9éC¤hˇ*è$R¡ï‹p¯¶Uq(ڮɺº™Ñ$N•ö““&Ä+–õ‰Wß ³û}Í$¨_Ö²‚Š8pƒqÁoÅÖñ£P$Œ­slˆ¨(í“Üå-Ætà"WŒmk?\^R±fê˜+?V^Ê7uÝýí¢o›‹²ÞdåE‹Arq[.yå‡nsÜðà3ùŽV7ü¥P¡…ü}ʆ–yBÌ×ì† «WÑ9Åact:|R\ŒÝúÐæì•?.žêìñM]ñs£Î[^k÷u³rË·ÝòÝ€’\÷«6Á;‰|k/ÿƒñvü3‡1ÆSa’>éóàÝ¡õùøÎû}>FI˜>#ŠB/|:ŠNBØ*àÿUdS5ƒûZûÊ7ú(ö•Æñs¡8(¾é[¶4 Á¢*ÁÖËÔwóö´3 0`!xàVè.³¼ª32ûIl|åùæ hæ ;àÿ:KV–ß–I€€Ïˆ1aAe)#\Îø¯ @QèV5yw±ûÆ{ö\¸¬F~|¬í²ݺ?2E»aü€[Ž€c}¾Ù•– +J0¤JmóÞŠÖD7ñ&r_àÈќ‡LcÂÒüiQÒ«»S^`ú#ªÒt-Ï«ñKz&”“pJ9 ÚíëE$Dßñva¿­½-Y·t õ¶þ4ÌùVaŒF–ñ羕Ѽ>±Õn A aIµÀꯞðíÚœ:BðZpšq–Žèðíðû‰ ;61-Û” Ý¯Å†íïˆÇ5Â9œïj„ýò”ç¸î˜pR-àB&‰¡ •º—ßÉÉy`ƳÔA¨b?vV©QÓîA½§QBõ”„á3ªK…•ž­.AlÈÚ‘Ž½†yp „zzKõ¸CÕP- +­¡ä Çq]³SiNÎçÕ2š€j\ç‹£•¤Ty“1Éy:D W•v.kÈ9  Åã{*2§Ž@'3е²Uêf·œ"¿ÚyÛö\<µ’2÷+®©R„¬D;B&)Ò=nSxHä¢ –´¹6‡4üнü›±åÒ¹gIŠ«¶²'Æqº- 6›Ž Ø3\º&Ï1$šþ³L á´ (Jˆö0fy:U3WÈDŠ 6Œx´µc6Ø¿—£ 6½ÄO‡ØŸtYx·t"ÎJ ­˜&o¨HÍ‘ò!{þ´–‰“3¥cmÉÅH /Ùå¼Æ¨ƒ jÛZ Wvµ\4Ð|éO,4S,Hu£ R'Þô`Ïv¸‡-|o7¦¶IпÀƒó-ª ´kË>Û~]bÇ)õ*Üv'¬@μÁB\é‘dˆ'÷(°ÿïvH9q:ä †bì‘Ñëozîws¾uhØPÐæ´>zÀÁxö~„`Øûdÿß.I NQˆ{[®èe‚c"¢*TÆR°Ë©ÛAä”»ô­8äl52ÜêõLÛ¦C(°´` ¹+•vù´t¸^%·¤såÚJîú?‹6îÎ_§gñ¯þ^q¦É°Ö¤0çדÄÄ5>IY¶Ò´%')À2Á êÆ°\FE©Êf¸¡cŨ„¥GC¤áØ‘Õ9ðÓ¨ç·ÇVŒ~€ƒ?øs×äGåËïýnABóuþË®~y0´„Äý&g‚ºïŽ¶õ‚òd:ìôö… ¦ŒæÅŽé¤=Î÷¬<Æ6£”èèa'âÑ=¿/mÇ•olG…ë‡É,–ñ{‘‡ÞIÊvn¢fP±ÀŽå +8q˜“Öô*ª8"Œç‡üb?"&xžëy/éï9ï8ºèš[ªÒf¡o7g1ÚˆÿÉ2d9éÛ:*D|ý.·–Cíëjd&zŽY‡ƒ~ò³Þnë÷¾;ãmHl¥à›-Óì/¸b¸óŸH 9 ýxþGA¯¿öc¿‰•>Õìß-¶Œ?h"#>Ê=‘ðƒ»nendstream +endobj +6499 0 obj << +/Type /Page +/Contents 6500 0 R +/Resources 6498 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6485 0 R +>> endobj +6501 0 obj << +/D [6499 0 R /XYZ 85.039 781.388 null] +>> endobj +2054 0 obj << +/D [6499 0 R /XYZ 85.039 761.463 null] +>> endobj +6502 0 obj << +/D [6499 0 R /XYZ 85.039 743.459 null] +>> endobj +2058 0 obj << +/D [6499 0 R /XYZ 85.039 604.129 null] +>> endobj +6503 0 obj << +/D [6499 0 R /XYZ 85.039 569.986 null] +>> endobj +6498 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6506 0 obj << +/Length 1740 /Filter /FlateDecode >> stream -xÚ¥iÛ¸õ»…°Ÿd –I‰ºòm¶i³hig‚Ø] ²$ÛBtxuŒ7ÿ¾ï %ÙÖ8@‹Fäãã»/ZZþ¤ùŽðb+Œ¤ãE‘•V+aàä—•ÔÊ÷_)X/nÌé&p¡ÂEÍcÊØñ”DœŸ_VÛ®°\ág½ì A$œ(ò­—ì7Û•ÎzãûÂþº–vQïŠ:{¿Þ¨(²¿tùzã¡ÝìñØÖi7à%EÍGiÚ uß­ÿxùuõ÷—Qœ+F  kãzŽºwµ üÐñ¥7×F*Ð/˜kãð•FÒGÅöǵ'ì<é‡6G¹;Ö!©3–üç¼ÎRáÙÛòkÒwEœpHDé[R8±ˆg"úQäH7&ëµÙ}~h“¾hÐŽR°‰áûåéñß¼bAañ©ƒ§(fÛt;gèWð€´³iQ7)í§þöÇ5"ðÿpdP·¼T Ú¹¦^6#ÞJ4©Ýz„s²œ>N›º+²¼57´ºQbp²n?›¨| OÙ‡–B¥ü ·žM1_äC„û¼mà†fèøBÚT§¡§8<0®Àí×¢mPúÊ€"t!í›– ÊÆ\ï‹*wŒœnèˆ8"9_Ž9F…«¿àZš~°å£=ªA(P»¢GæßùìLà5½Ñvd—¹!èJv+®È­¸¸u+B¿"´žÜŠÕ£½Šÿšöã:˜Úæ€Ðˆ òî.d¹ŠÓžÉ %eƒow…g”F9IÏ><›RKØ=ã:©ŠjÎ=!¾"ƒœÏûc¢oÌm+ÍñÎ\¦åO•³ýŠØ®b({å=&í'°Ç. i“ê)XV¯É·ñÚ}ï8+œu9 'Ùðt§yàÆ`$D¢+:¼³5É©’ÂL$¬Ü*³qÁÊÍpbû¼ÎÛîXœø²9ýQçÏÚÄ=iI2þ%߀~Û~4+?—QæòÎxeJ Çó±²!yÕeO¸>Çh£= YÂ"0 -•-ÀAs†='bìôuÒ{ QóËK'ªRP+Í°kJ5¬¾Œƒë©zOgLɱ‘ènŒ… -BV)W'Ö†b`£ÕGÂŽˆøs¡¾"S\Wg`ÄK»dÚ$¦œ"©ßO(pj½!š –“žÏÿ…€Ï°ÿ“M“²ìÞá:²?—TÀSÐÂÃ0e•ÅžÉsÎöŸ*߉Ôïn«Å¡š™YÁµ§¤¢Uh?çík‘š D¢©it¥ax‚JŽ^&À“冒9[~ùGI‚ô†BŸOGÒ§Y]„'¼Qæ›’Ç5rÔ#é2ž]¨¤;OÊŽ!h>ÅÍ·j•hÅQ/cO¬ Œ¡•úzŠÊ“S?kH.ˉMÚº˜hü3g®â;m6º4U&åiŠQÔ%$Õ>Eí>_PtúÕ)Å$¨TŽ]‹JIÏßSËN -íW¤¨%}7õi:;_^*Æn]ë\<ÀŒ•½3¥mÍy‰Œÿç×ÏHØXâÆ&Æ’–PΔ½Ô¶qè˜ß3K*Py¦!ˆ¬–3&;ûD#éuŸ™©{ÿÆèÁÜ‹ûƒê ‡¦@˜À§ò*…t”ðFB¨ ˜.¼æ'EàDPÀï1487/ -º”®ãI÷‚ãÃÀeš­]¤¦^yº^-5ªtÖª%eílü*È]ÚÞ¿ _¼œ†¸ÿŒN|ø`ù–Y}åDBÝ7ë„sǬé‡f½Ãp2ëÇe³Î8>fÆ¢ó mMm K[³¡ô¨úôü Gh¤ÿ¼e%ˆÿP÷­4áܱ’Fú¡•î0œ¬tÅqÙJ3Žú½Â]kœ3ž’°Áë¢Rùõ¹{%}²KðŠlŽyÆ8¦dê®}¥Š§àsUþ\ýö‡°2Pé×t((gX GƱU­<Ç =½+WÏ«N*Z÷UöToìøBå5`±l;=îw,?5=ÔãXpÛÐàž¿ieÍøxEðDìDæ,K7v‚ªz8®äŽÉ¡\9ýÌSëá“Þ .—7ø"Œj¬[z§Ö0Ÿãè®”=²5Šðj§i©›Á‘iÐC—ôjç¶IÃÔLž’±ö ®õf—˜ß–¾-D(•P¶x‰Ù3\ÙV8©bøc˾ï>»:£ ™4ż‡¤ÃHx‘î¸Giƒ·T6`ðžA‡¯zæEva‡Z÷JRk~‰º¯PêYy¦¬DN¯Õبö6ø–0=çÄð+m +eG\2œ\¨÷Qàù®û ¤—Ð6®)üøà ê~†‡x+Á%êçCÓˆU +âÚ1›6¬@Š ä 飩j .Ê5dqr’Äj_¨iÔ6èâjC¾M»6¦ß·Ú˜l”()½Ï1>Œ,þÂêS›k/lÇí§@å·ÿ÷?$v«m ~ÊuŽžÚiùÂñÝcý¢»Š[endstream endobj -6164 0 obj << +6505 0 obj << /Type /Page -/Contents 6165 0 R -/Resources 6163 0 R +/Contents 6506 0 R +/Resources 6504 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6125 0 R +/Parent 6485 0 R >> endobj -6166 0 obj << -/D [6164 0 R /XYZ 85.039 781.388 null] +6507 0 obj << +/D [6505 0 R /XYZ 85.039 781.388 null] >> endobj -1950 0 obj << -/D [6164 0 R /XYZ 85.039 761.463 null] +2062 0 obj << +/D [6505 0 R /XYZ 85.039 165.342 null] >> endobj -4123 0 obj << -/D [6164 0 R /XYZ 85.039 657.513 null] +6508 0 obj << +/D [6505 0 R /XYZ 85.039 131.502 null] >> endobj -1954 0 obj << -/D [6164 0 R /XYZ 85.039 657.513 null] +6509 0 obj << +/D [6505 0 R /XYZ 85.039 131.502 null] >> endobj -6167 0 obj << -/D [6164 0 R /XYZ 85.039 615.228 null] +6510 0 obj << +/D [6505 0 R /XYZ 85.039 131.502 null] >> endobj -6163 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +6504 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F58 3380 0 R /F62 4159 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6170 0 obj << -/Length 2977 +6513 0 obj << +/Length 1034 /Filter /FlateDecode >> stream -xÚ¥]o£Hò=¿ÂÚ'¢s@†}›¯½ËJ“Ì]<ÊJ»ûÐ1ÄF1<Ùܯ¿úꦱqrÒi¹©®®®®ª®¯žpÀ¿p‘%~ òÅ* }•e‹M},¶0ó‹P0–‚²tp>¬/þþK’.ÂÀσ|±~é$~œ¨ÅºøÝûøÏ÷_ןÿ}¹TJyQè_.W«Ì»» ½«Ëeè]¸ºþô3Ï~»ýŒƒÈ»ù…Ÿn¾¼¿ºæñûË(ó>â’7ß®×·—®½ø¼¶ Ú­™¹û~ñûŸÁ¢€“üzø*ÏÏ0ü¦ë `ÏOb%ßû‹Û‹YR</xÕœ0 Æ2ÌýYA6®XwåKÈ­j̆½KÔÖFà8£ùgƒÛÑ¥.™®Uf˜ùô'Û?éžø"…µ]!ž u%/êÊ¢A1s®Ô’"{ß±i W3’ÙhMš‚@uÁ#2Uøí_ºÔ¸’¬¶©þ£Å³¤Àg×Þ“ÉÖFÖÛz;éGðô½ÔÈD‚êZvãæBü˜'ÉÅqé_ ƒ;5‡™B#à¢2çL–,4’‹[JÝIë:Fæz37‹8° …šï6s±ònšPl+>ªÞ Û¶B ¾’›¢ZF?ýCž+Ã; Ybö?ò$Š=É©\·’+*U~šnEŠžëªÒp”±q– Ã9ÖNhÙÊ"Wãvïðâf³:E< è<@„"8‰”ç[þµ:Dœñ̲[5W€¶®r{“ÖëÑ0þH3È jé\]_ÝþMòÕþ8¿•Ô##¹×±ÔX¶Í^Z3lè?*®ìjÇÍ:seÑš#7nQê| wýaÏ‘¡Ì[nùÃÙ>UÒàyÝؾT†€[q5O²ÿ;*¶V -P«é̦ÄReB(1 6 ÎÙ&Ág¦ÕDÝÈ…¸yÖ>’1Œ®ž:*/Þʯ1:þj¤önÒXRÞwì­”Ý c™ë9&HÒým÷,²Â ˆÄBx´Q=2é ȘJa,`›–uNV@¥ä¹š9F±pT‘âƤ@觉£ wÀE­"%¦²¤N¯ò>°CÔÜ®„}îÜPŒåHÕßeòr-–,6®í;¥úÙ¸Ãù(“B{0Ý{.m±ø8ô cn¸W?>»á IÝÙÍfå´THÈ+ÍB“dü]Ü‘(? -âH‚cã ¿‰´ÜÒFªƒ~dý½òø"PTsIøéæ |â 8,:jæä‘ŸfP¢:þaË(ÓîKêƒyǤÑ7íã/gwˆ¡òys%(&8S­xkÛ0ïy/óÛ”ò¸Â ŠÓ«Œ ÑaÓI(e긲¡rž¸á®ü, §>·Ê®æŠ±ñSðpºqè¦iϽ!ø´¦ ã9· ˜¦HWü ¡mög½@ê×Ñ´XTºÊÕMcdð¹êûv +; ${ØQO7R¯N$xA|l:á õ¨úeŽëqÏþ®+$=²p§>¨WâõÁèýñ¶ ;Êl2­Ðß-ñùâ`Áóò«‘Á—MVß擬9D±+^šd³ÊDêºú~3§&°JéôâC<¸Ž:"}<‹ÿ:z÷úÅoÛ:o“ô¾þ"@Ë Ðá#€ò§#ýœ—ê ô—@»Ä\ÒŸâ÷ðm'ºûÒ䈮Hö ÔÈÉŽ”•è¶ºÂÇË—øü„D¾aŒHOîdÜV‹ÉÔTâ6Ñ•¸é7‹q³j ¹Qóã>M3­#Xµ‹ºÜE‹D·ÿÿÓANt‡×ÈD+ —jÂ…"E±€±Ã>*êņʖÀEHm›!â4ÍM +öIaÕ೦Åp^¨'Kû¯ÌÙÎO4W¯ÏWkæÔÔX¡‹ ×e‘”ø2xzkÞ+Ÿ»/Ôñò;:wîrÌþN4<`õÂì%8<+¨ÐíV=—¹ö|0{¸2ÿ‰Ùcã?ˆbÓ +dýRñ@ DO»æ çDòͬæ]3Ð'õ~6nb†[‚[ú‚«º^ß3Çb•zX•V©‹ì¶^™ª›nlptsüiM—éb/÷æ-ò—>Uøݾ7{7­ò¦sâʈ0±sOP˜ÿš·Þ3ÇítÑnx9­–åsú&/Šy]MŒ ŸGÎÔ™øé3õyhî}{œÎd÷¿ &ƒÿ÷e.²Å¯~v ÝO‘ùDøð‰»•à¿Å-¿endstream endobj -6169 0 obj << +6512 0 obj << /Type /Page -/Contents 6170 0 R -/Resources 6168 0 R +/Contents 6513 0 R +/Resources 6511 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6174 0 R ->> endobj -6171 0 obj << -/D [6169 0 R /XYZ 85.039 781.388 null] ->> endobj -1958 0 obj << -/D [6169 0 R /XYZ 85.039 761.463 null] +/Parent 6485 0 R >> endobj -6172 0 obj << -/D [6169 0 R /XYZ 85.039 739.701 null] ->> endobj -1962 0 obj << -/D [6169 0 R /XYZ 85.039 382.411 null] ->> endobj -6173 0 obj << -/D [6169 0 R /XYZ 85.039 342.247 null] +6514 0 obj << +/D [6512 0 R /XYZ 85.039 781.388 null] >> endobj -6168 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> +6511 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6177 0 obj << -/Length 3038 +6517 0 obj << +/Length 1340 /Filter /FlateDecode >> stream -xÚ¥YKsÛH¾ûWø6TUÄð)’{sìd'³kÇ+•©šC[¢%V(RCRv<¿~ñh’zù²år©îF£@Ó¿ôèÏ¿Lc× ³Ë$õÝ0M/› ïrE#ÿ¼ð•cª,ÓχùÅûOñìÒ÷ÜÌË.çOÃ:±Åáå|ù‡sýëÕýüã×É4 C'ðÝÉ4IRçûÄw>O¦¾s÷áóÝÍ?dôÛÃG4çË'!Ü|¹½ú|'í«I:טrýåÛÝüaòçü·‹ó^À~k&ƒt]üñ§w¹¤“üvá¹a–^¾PÛs}Þ\xn…Ú//.þÓ/%cÑ¥Ì:¥Œ8LÝ8 µáÇ'´{nìE¬«å’N^tE]ѯ)Ë×I9ï&Ó(ñœïE…C>‚£Z- -œmC½z$Î3È˼=t 4Q Ùu4¶ÎyvW, /ÏlmÞ<‹Èa.ÓÉÈš×ÒŒú‡®)Ûwµô:pèÌ{j–»ÕÊ@¶2†«Ý—@™úPXÆ'´Ó ‹Cݺ*UHç½í÷^îxÁô™ó_/ö¨?Iiu0ÁÇPì´¯mÇ«n¤)±Ô¶©±Í3¶Yæ2f°hw¤°?FFXïæò‹[©7,&Vªt‘“×äÅ^eò=.<>}^™ÇÒ*WèÓŠÛ-iåðƒä³$sæPW ðÕ¸ÍcQ²¡è®mëòÝ\¹é„ÒÀ„¦öݹ~’ýÛ×jyë†w/þ.ª•ŒlM˲¼`¸n–"æ>òíä¼ý ¬/×+9æÓÅ`¤Ë7¸Ä0’Ó±aw ™‹ŸÞYš\Xd±ºé䢒_£\t=.f—bLýELɶÅ;„u|Ñ•  k½cao+˼å¹g0f–ùn:‹Þ„ÉC@£¾›Ai=0Ìf‰ëe „Œ¡K› ãØsæ“Œ{zN³¢k˜†³ÄùÖÒÕŸi¹Iò¶D=ËY¤š…‰è³@ F™óXÀfè‚Lì¿P¹R(ø­›•ã{°¼k÷zØSÙ„A àT<Â7ý³°®Á˜Å|x(~Mk S–õ†/ÅûœÀÈ|4w‹n§V„­Ä«ÞŽløe]ˆ‡/ù¤ØË«t^ŠÖ’ae»¶»Nßî>ÿ®LbÐ?ÚnäãAêMXEöFß´tÉQ0Û|U3o ‡Á4òœZ\P$è±ëÂ:ÇÙþ V6j™oKRg?äh±«³óÙ£´v@º[׌® K‘[eùWBel¦I|CP¹¸Zä³ûrTÂrŒs¬ƒÛ°.êÌ"/ûôjÑä«Í¡ÃÄ'-ÚÇ\5¹éJЧàQl¶eÁñÄ8Øø³^™hÀ¦®¢íH.4­µ‚©›/]&[‰YÊ[ü.í 1æó”×^74®º¦–êúGoõ²£¨œÆ‡hŒž‘ŽWô;xÃñÑ?›@³®\Ët„óªª-6â<Ó0Iì¶y“«/ZáÆB"ð½b€£ØÃëžUGv˜ÿÜ E/‹NˆßÅèÇùæÙKv:;«¦\E0­ôtõS -]¬¬“ß’õÜcÍA«KIElÐfM²eæ}Øöçª^Hò’ˆ=ë0ý8-IØø4}â*݊÷ ­Î–ƒræf¯eä¶O§šº­Ÿ”ÿ±÷+~eÍÐFp§g° ýh¤oØ›ÍôÐ#Œœ]«„ï=œ>rk)ã–Ï&­PŸÞ×´ 7›Rðkdätl¦­ØÍ5„Ó q©h䨱$GÛ½k¦±·ìOÑH«;;c/¦’aöfðñôá¢â% %í˜s^ä'ÀÞj²ŸzSŸ=~—yŸê­ª\™MÃñAæζ¹)FàQeðÅÉNeB£(‚ä7çy¼3ªyŲîA5¡`_1l ‰´÷þÓ,<òB—œT%_M(í£Ìf¹æ=-M-÷^Ô4ù†kªçP}h¨h1;f¤+(‚ÍSÐn5MÅL$¿æÁÕ‚‘šss¢=!u@£ÉÿÚõa¿Óý¸HÃ~M3SŒOI˜RúHí½l³N.…ÔûDüÌ«\b³æਠø‘RÛ|úî|Ðä¼RN[À1uQŠÉ6××T‡+‚¦/d³ÕÀH衤´¥ó~XKGFJÁ+AÇÚTU—õª·Ch?¶„šÀ ê ´!ߌvòËaÜR-ö†,¾°YB¡ÕÔA-Ósv\sj¤¼š÷Ã,ÂקLý-,ñœ-A()£¢`ŒYC "±¦3„\_É 8]#ĺoצ\‹|¹k,ÓØ5*>èôŒðºé›Â!F:.fú|7Ù«bôÆÔL¸"aYQ‡¡!çân^ ÇwÅ M^0„´ž…2Cô«r,ªE¹[ö±c¥@ÍÇ—º1•Y ƒâ.L:ö%{“@¥gÉ¢DqVÉز=ˆÙÜ]]Æ5Ls -¬X­£ª^ÖRMhÕ>SíE¡3ñÑúoA Í-û·ZH;®™ŽKÏ£ç¥ÈíÓ -ð)h.!‰v MRHoA¶¥Œ|‘ç W¿ÛŒ<`ùúþ'OG{[6º @‰æJ2Ùí!ÝîS?¸û•£ùÙò\ž4êfÓ¿V&¨¶Xiöi%LõAˆ“»‚“ ZâíÝXó—T¯"a‰·£÷åˆÐýËðf¤\j¥'Oήy5¡¨`CMH#v U)Äß½ñê -£ä#è³ãÐ÷Ïåö‡$‹¾¯Õ]0ds¦ZåBaÛÙwmÑ ‰ûáUw‡a5Zd”ê5DòM3z¾ ¤ž Øz‘Û3Ž«´÷7×ÒàÌ]OÔœòi†Wò~kaèEúŠÉéÆFó½3I:Gƒ)ëD«/xc}#"šYˆÛï&£ô5Žz<ÜHFë¡&©ËïÒi9÷ϱ=qÐÊlFp"ô£Ð ƒøÍDpÄs6‹õýØMƒl/‹ Îf±W‹®xÎ¥}ƒû§ÃâýUHüð2”gDÇ9½·¿ŒxÎæ°©ïÎRÉS†&iêHêVày>âe¥!TyyZs¼$–•|µ’ןD«³4áÏHcìÇ«á…-M÷^_%šaîKÑ­¥u+{Ê$È^?)T¥é¹ÄSIvO˜zðªôC`äDÓ‹_îÈ$m† Âí^èò_„,ß½:-ë²…–‚Сºu z‘ÿ¢IK½ã9’ÎWÄök´g΀Còé”äÆ«ßÌs¾µ’‚Ñ„ß@¾«{Y”]ä‘Cƒ(ÙÞ»ã¬W˜¥§>ãb¡›†Ùi7ŒƒÀ |+ .&ôÒCyíçþ#ÿë'áendstream +xÚ¥WmoÛ6þî_¡9E# 3EŠz- i“¾mM¶Ú]?$*Ûr,D–\QŠlýïãñ([²å®ÀP¤"y¼»çž;ifPù¡G(Œ d„‡¡1[ ¨q'%¯Lï †K¨ïèùd`¿ô|ƒQÑȘ,Ô–ÉüÆ|ñúü·Éå{kÄ97F¬Q„æG‹™o¬3¯ž¿¹ºx†ÒãK8æõK\¸¸~wþæ +Çç–š/@åÅõ‡«ÉØú4y;¸œ´ÀŒ\âúÐ|Ü|¢Æ\~; „G¡±‘cJX«ëqâ¹\ϳÁxðûÖ +Ê\µzb¹4 ã#NIºÛà¹×ü}še벘Y#ÏñÌ|5lÀÊÀO¤6½¿œüqþ«söäça2[íeO­þ"I;~LóišÏ‡ÇÔ”ÓQŽß'Ãñ²®ª4¿Ãù¼Ø4°†C‘”é,ÏpÚg¹Ò!‹÷‡u£]ã&4ù‚ªçqg“ó]»xÿ®Oøyú¿·Œ» +ÕÈ“É ÚÔ–+ma_û!.í¬˜ÝÛ¢žŠGa‹ÕT©¶4Hö1W&U]æÝÀ×#! ;{¿î—÷v“C]yn»6Uý9´§þÆE[œ™e*ö r‡8Q ‡=E†Š”mÖWÛ²ú,'2eúåYžã!ËøÀLà˜ +XrMŠ7–å=Ί¿cØ‘Åejm•¢ŸP$ÀP’ìcg‘Gü<.–wÞ¿úæq2«ÒÆ/ˆOœ}Û¾/{Z?-œø<ø/ZE©¹á("*9ˆÓLÌ6§!ñ©Ì¨*› (]$§E…dÞW ´µË‹4°Œaöÿ%¸2Ž5:™y\Isé1ËššÐˆ¡äóžT¹n O»ß¤J· ½ØjVµP½)Î0…6ÄГ?Yq! ´5}´ªe‚ƒ[ÊÜ,Ás7“líNó Šœ*–´Îd±ÂÒ†owh ƒˆî&äBµÔÇš™ÏzEL*O‡ËWONzš§\Äj¯T·éEuºp1Õ­\_:?è?× HâôEqhTR%¥Œz”š';%}©CsƒÁª¨ó*Á›„…N÷rø+­0=ÂEÚ»¹io¥cùÇÐÍßÖÈç; ° G*¡ +Q¼Jtl ž¡lA·NçgŸ&ìµhnQüþ£ÔœP¥¨­¶Õ¸+“µÖÙ莵ui¿šh€6žN…ý'RmþhÛ§B}F6Û¨¼öÛbøD5Ô)?ÛÞË}ω s4K_;IÂέÓ0†vb‹ªXwˆO4‘eò¥NË&XuE(-(æÝËkWÑ-³X$M@LÃÇS¾W.§ª¥n³¼w0z×”µËyZmK¨q–¥y¾ÒQ7û‹ºl¨¶ã­ªžV2wë¸Z ¦^ˆò¾¿+‹z­çËBT߃ÑÛ{R)†·¯×ñ»çÇjÙîéŠðjkJM¿uGbï-H¿mEZ ³"_tË£•©cX¯ú°zÇ¡æ‡P³.ÔÎÃpûžð˜Gä“Þj:°ÿ÷Ûˆþ-Iß|qNm>á¾Û}Yý Ø/~endstream endobj -6176 0 obj << +6516 0 obj << /Type /Page -/Contents 6177 0 R -/Resources 6175 0 R +/Contents 6517 0 R +/Resources 6515 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6174 0 R ->> endobj -6178 0 obj << -/D [6176 0 R /XYZ 85.039 781.388 null] ->> endobj -1966 0 obj << -/D [6176 0 R /XYZ 85.039 691.864 null] ->> endobj -6179 0 obj << -/D [6176 0 R /XYZ 85.039 657.724 null] ->> endobj -1970 0 obj << -/D [6176 0 R /XYZ 85.039 505.996 null] ->> endobj -6180 0 obj << -/D [6176 0 R /XYZ 85.039 465.833 null] +/Parent 6485 0 R +/Annots [ 6521 0 R ] >> endobj -1974 0 obj << -/D [6176 0 R /XYZ 85.039 367.151 null] +6521 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [322.946 542.433 391 554.122] +/Subtype /Link +/A << /S /GoTo /D (winbind-solaris9) >> >> endobj -6181 0 obj << -/D [6176 0 R /XYZ 85.039 334.73 null] +6518 0 obj << +/D [6516 0 R /XYZ 85.039 781.388 null] >> endobj -1978 0 obj << -/D [6176 0 R /XYZ 85.039 143.325 null] +6519 0 obj << +/D [6516 0 R /XYZ 85.039 572.649 null] >> endobj -6182 0 obj << -/D [6176 0 R /XYZ 85.039 106.459 null] +6520 0 obj << +/D [6516 0 R /XYZ 85.039 572.649 null] >> endobj -6175 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R >> +6515 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6185 0 obj << -/Length 3178 +6525 0 obj << +/Length 1853 /Filter /FlateDecode >> stream -xÚ¥ÙrÛ8òÝ_¡Ê]Ѽ¼y<“]OUœìØ©lÕì<@"%±B‘Ñz¿~ûHŠTòJEF£ÑwvWüsWIh;~ºŠ×ö“dµ=Þ8«=Ìüãƈµ€¬G0¿¼Üܽ£•ëØ©“®^vžÐBõ’ýi=üóþÓËoÜ®}ß·<×¾]Çqb}¹u­ÇÛµk=ýòøôë;žýüüv<ëã{øõã‡ûÇ'îßßz‰õ€K>~~zy¾ýëå÷›ß^ fk &Eêþ¾ùó/g•ÁI~¿ql?MVgè;¶ ÓÇ Ï_¾Ë›ç›T<¬xÕ3B?±ÃÄŸsà ¸:vèÄ ÕÂi’ÀRØøĆ¢ò¾ò׶,ò -Ùñ÷ûu_fõ†ÒÐRUÆsŒUÜmkƉ`uQÁïžNÐmjDò­ÀÉ|²÷'ú-þd¤n$ÿãF[dö”"…Ø…„ñ$'À)ú†°‚ã\ÐÊ 1CqïÖ.²6%^ÇSÉT¹Ö‘~e+×R]QWö5»©F?ÐÒ†äâÁ¬k§a8’K” |ÖRPÌÀ†}ÐÏ0t¬'…ùQl=çÍ·bK‘õŒTž‹n{¸B›Æù=ÚF0Wu&ŠÛ>½`w8ÎDaïYó­A¦y4Œ¤‘@A]¼Ô³ê'<ëéù™u?Š–¡îrÕõMÎÝAuS(R¢¼%AkU ùŠÛ£¢ÑWþúüôøo^WŸ ­¼YŠNâpûÚv,ñÖ^ЉGăž—%)£Ñ2ž/ªj{s$Má±Ö(3a•„#òQ±*ÅšÖ/b ¾(õŽ¨ÀŠ*kÉÚ¼8°úV¸Í›#¢ùþ]Íí†Î(-©¶.µu  ;CÐúˆÞ.±2ÜÃX3¡[DbÝ£\¶Œ”6cëý-˜Š¡hæ¿jdcoµaéØ UYWâ€eˆ=v@ÍW˜p>­ïG(`—ˆŠ’ Ç4» ìä\Znë1B:¿f¥áa×#┨…KSà8\︅ä/Ìg`Î+ mn-“e‚¿;hwèX’K,òcªdB•ƒÞÑÁó#:†Ä…0Dˆ*½IGZªù„—­–xÇ;±ã†-ŽÂ¾¹.àæY ÐŽgDBÈN4æ‘ÊáÜœ÷™šÐÎß—6ƒ„Ñ0[’öŽxcH,);ê“14ùH€o[Wm_jŠ¹yz|æÉLuj3Ï2M <›k8ôχ±Zæ”d -OÏÜEa>ÌN|B5óM\˸'/¶ÈŒ+Ò€*t`ÿ:È²Ø -m8Éqwߨ㱨ö<ÆñØøíÚ6ô=ˆƒžh.®¹ˆ ´Jœö‘c¦Ù¤c”;R‚KqÓÖ}£wšáDgbÜ ­‘\6xVâŠgÏñÇê!è ÉADœ ÌiÊœ,Ô4 - öMÝŸ´æS0­/| l&$Ý¡¸5 auƒ2U¤ÓùÛ#„ÑLÅÐÖ¸a§ -cëïH¼GþPÜ|AÂкÇ"„ñ§n/ÕÇú–µº`íóŸøk ÑÖs2Tsw!›Ãa!Ày^8¦–º—Ô©UÛ­‰#C\%È÷Zà¿ÅÖÌ|¦£:ïyEÛ):¼j0ZBÒI@v.å)g…ð!«(k'žRÂ#sæÁ® -J¥.‚]àB×£ÐLþK;bJèÄWñf”3f㺙| µc_ˆZHžêdÒÔö,øÍGFìyp`,*ÚwHåÝ{\ÑÍoG~̾4蜽ƒÄÆ ­]A©5vs*Õr^ï.­øÌSO4øæ ¬G]ü>eÉ=‘uƒÎ… k•qOqCêÏ•@Ö‹ fLIr½cüÒTÌ¥Ëû? ìÐñV¾—ØIêþøBη½xù:n­q­GÈæ7'àÈì8ÌŽºŽêA»­ù4dúú†õWm#±ò’±G¶*TŸž…´ÂŠÆŽAÒ£ìù’33®¸~h‡.pÅ mˆä?Åk=B6çŠë'vœ„fG$umps6—Žh iÄQ×] - ¡;Ñ%?tØðÑì(¡ 9yT Š«öˆñÊø!-˜š)æp¯ëM?ôL\‚ùŽî;*^«ä>qúvD§°¥T 3ÕùÕKÃ;ÌÉÅe-±ç ØdÛ@.#)þ”Dä{C’Ž]²98mW_#Bµv! )¤ŠyÒá-9 ùhˆÌçä`²“!ÃGÑ.¦r+0º™5îÑÄ5Ÿü%pè¬7 ¥ò’è5y×7bå&1”U‚žØ!–’B.0×Ò¢åâ£RèB¢‹·•·…NºXÊ1Ô¤ Êe©âFäýÊ8X ÛWž£äUß\á€Îô²ÖÄ1<¶[Ç”É$±Õ£ Ùð]6VJ÷a:X/…´ü(…oÅþ=UJ aˆ”$zŒdÄÄ*Q²º¢o-isÌta…EË Éiu/ø8MR¾™7wSÛs£•Äv˜F?çÍ×z„lÁ›{ž$‰Ù™sqlj%\á0Þ3i',|™ÄK˜VYÆðofèÞD,Wr1žÛHgìærdí¯¥ÊˆXKÏX1ŽXO¨*•¸8|*ßí’&x`ƒ Æ23©=I Ç™’J½/æʬšaáå5â÷.åFµ\­kø’ÌTJº…Ïñm×u¿ûB2‚¹úzãÆ1…ßñëM ¯7Ÿ¨ÞïÕ¦”Wœûž0ÈmQ,0ºˆt•ŠÞ}í’'ÌÛ+'pãÐ~p‚ÌÕ7ÒºP•ÅÃCm´Ë]íD9«æw¸“ܤ¥‡BЫR? ~­&S²J?D~Â7ƒûò˜ºN6…Áäí¿‡ŠÐlÚ®QÛnüì¨PHÑŒŠ%7gnKÏäìÔç¥tßXüoÔi>óª(¬ÕûÂÜi‚«/ ~Oíž%´\^Öm[rߎí´0Ú½2î K$x­Y¸ŽêÙö…5š ¾'WywÚPžÜcàôÕ!Ò—¶æ1•‡/®¦Y¬œâ uß1êƒâªE(Ù Nqf²­§‚,É;Ô6×û¬¯]BMƒ> -)…9$I˜ÛЪÒ8ó$UÉ»¾ä!­v´ˆ -ÍÑ›¤¾$Lؤ\Â5Àd³’•"Trž[¹Ñ"ìõ‚ -"Ù½õóÚü¬Ó„ú-:S~™Hã©õÀ·ÊŽÄéÂȬQI9Í‹}ÌJù@/NfLµ7ŽàSKMR A‹8M†+jœ»¸‡KõÛŸ<‹¥:q\&Æhnóf¯TÄ")XQ“Û7/Eœöm$· ª»*oÍÅ¡y×e¸Éí-'•WÞK©<—×*ýìÈÓ|Óýs§6ª -t& -Œ™^pÂ8º¿œeÃËo{×â™ïØ^º à?kÈOý-Š‰(,?](!$Kž«iA ùNzI¯þ›•ÁÿÒ¥Øendstream +xÚÅXKoÛF¾ëWí!T­¸¾’CáØIã±ÝXAP$9P"-±æC%)FÛÿÞ™Ù]Š’h'h…ÚÇìpföûffÍÇ.üñqè1WFã äL†áxYŒÜñ +v~q#áŽs}·^ÍG³7ž?æ.‹Üh<¿!‘yòÙ9}{r5ýa2•R:‚³É4BçÓ„;ç“)w.^_œ½Ð»¯_ã@8—oôÂÙåû“ó =>™ˆÐ9Å#§—/æד¯ów£×óž1SÅ”/Ñš?FŸ¿ºã ~7r™ŒÂñ=Œ]Æ£h\Œ”'™§¤™ç£ëѯ½§ÆúÔ€ÏSÅ#ÆÃñTº, Uç»ô|Ÿm›z–WË8Ÿ5q±ˆgw1ÎW“©'{ÝÆu›•F㧬\de¢'gqZT%é°*88ç [çf÷úxBg\-®"’ùòQcž5mµyöÅõøÑ·ÌáÛ,Ï7uµÔv•Åbï Þ€Ls 3¨èß™ûÓ ¥ÞA\øØÄ«ô…¹ ´]β2kY¢£Åš´¾Kk½û§1oBÿ²+ÕFþþá;lìm¥M¼ÄÍÙÞ‡U'ª$ó¥O¢'«8+LÏ‘%ÊÉ`x£ 󀄩¶zr?N¸“'z%GÑ[”IõѶÒõ¶Ô,¼Ž <µ¹x§½ÔR êŠs3¨!3+³Y€*Pœ€HŠëÏæt“ã©%®ApÉÃ=âtºÌWá÷!õÑ ítdÆ®v­-B_²¢F—6­ÞŽ`6„ ½¾ë"ƒÁIl×O½»•§Öìu˜Á¦R1é+Pp xÔO?”c„;c>¤€¼‰WZk&¤ƒÕg®ð`8ÑŒJ·Ke|(•#ª"·‡ª0‚ ÅOäãnà– z0¤ @¹ÊA¤,Ǹžh%ü¢SY·žP:kô$nõ7ZØ_gfqC «4HaÔí;“A¨Y[ù|Î"©öȧMC'B"7#¢‡ÎÒ>’Ò¸Õëz¿‡1¡œkDû‰@ ¡ Õ°`1†3Ò7æ«úç¬*b‚.l½O{qëŸùÝiz†X%Ùžï܇ å´N÷¾“W¤•¼!Jƒàvg&;ªÔÀHzíÁT(A‡ªAðB?à1ø„d4pÎiU~q¹ZmkJ`Œïïêšô‹\M"᜼hã‚?b–@ùm°+àh:œ¬é +aÁ^›¾SĉQ~Ð’-AG7q TÁ¾ªÛ²Âé½8SZñEÏ! ùž1 i9ù±¬çyŒû¡‘¥)Ä‚¸ëÅuªºԷı•±¢Z¥í:­±A.†€"…Rî1d‡(Eˆ +‘ÀH8½BL€ß˜©žê3Û»'¾A¬Q\î²Ä‰·–NÄéÈi³eÜfTg`ûOÔz\í$ÍJhÙRg*,DJueä7Z¶¶gãD ×™¯%W“P°Ôñ¥E,¬­qpU¸˜§®6¥ÕŸšòk«í.Û€Tœ·V°WsW:¤T¿Z’ÛAb +>è¹gYrTý…ÉÓÅ` +A½xÒZÄ·½Â·€R ²·èÚ¦ÑkÕA{ZŽº¹Šêê*+!L1%,°©¹ÚÄ‚µ# k +¨Oó3:íéºæ`€«ÖtA‰uÂgj»a뺿)w¡ÉGd÷šÃß&¡ÔQ ‚]ÙÏ1'£¥LéR`ë +šØ¦‡Ê 0ˆô-ÃÞ`n‹]®-r´(¦U¶´¦Bvê¡^®ïªº™¢L¡°;×ñ“î3Œ¡ñhAûé ª ¯,ï°¸ßGßl0/ðÍ}16kªm½LgeÓ€gËõÀ s×g°G HmêjU?XŽóú-¨ÍÂÕ-e’•é`)fzlì/tk1Ô¶Myý–k_ÚíºªÚ©y«Ã ‡u† Ÿù¡@ +ᵨ¾ýð”LA8ôìĠׂ ¾&MÿÈšj°í…bÌÅ>œo(¥Hø'. úVOÞýK*2Šyܾ*˜< y˜®<˜7àÁ™ˆì—BêÀtëÂÿPH=B‰ãÔƒ¡$¶a8«m®É+Ñ‘‰&ºM$úP¾"N .Ã@ǹÎVpVw`-F«êÁt‹¿&ÝÖ¦*{Ðìñõ üA§»KNØŒÓÎr‹÷)t=èÞSm›wiÄç¾si +OD-{wàCš¼M»OâP‰ +óÊÃv»5 97­™´ƒˆ"bl-ȳŬIÁ̬}¸“ „w‘ÿ-R„Ò‡OõctiÒ¶åU×YóÜæ3Sð®PÅLb£Nº©ÄíbÖ{ÞÚ´jj²´ï¡,Ù=3³rÀk\ Âpï¿DO{ð4”–£G 9€0Ç÷Y¤‚áÖ×Dâ¿ýLô߯®Ç»h)ùQÎôé…»÷ý$Ðï”endstream endobj -6184 0 obj << +6524 0 obj << /Type /Page -/Contents 6185 0 R -/Resources 6183 0 R +/Contents 6525 0 R +/Resources 6523 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6174 0 R +/Parent 6530 0 R >> endobj -6186 0 obj << -/D [6184 0 R /XYZ 85.039 781.388 null] +6526 0 obj << +/D [6524 0 R /XYZ 85.039 781.388 null] >> endobj -1982 0 obj << -/D [6184 0 R /XYZ 85.039 719.568 null] +6527 0 obj << +/D [6524 0 R /XYZ 85.039 349.884 null] >> endobj -6187 0 obj << -/D [6184 0 R /XYZ 85.039 687.147 null] +6528 0 obj << +/D [6524 0 R /XYZ 85.039 349.884 null] >> endobj -1986 0 obj << -/D [6184 0 R /XYZ 85.039 203.111 null] +2066 0 obj << +/D [6524 0 R /XYZ 85.039 291.85 null] >> endobj -6188 0 obj << -/D [6184 0 R /XYZ 85.039 168.365 null] +6529 0 obj << +/D [6524 0 R /XYZ 85.039 257.706 null] >> endobj -6183 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> +6523 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6191 0 obj << -/Length 3296 +6533 0 obj << +/Length 1910 /Filter /FlateDecode >> stream -xÚ¥ZÝsÛ6÷_á·P31M‚à‡îͱӞ{Ç+ãδ}€IZâ…U’Šëÿ¾ûÔ‡s77 ° ,‹Ýß®žð_xžÅ~ÍÏÓ,ô£,;Ï×gÁùf~> …âBH.F4g—?ÅÉyøó`~¾xÖ‰}Gç‹â7ïúŸW÷‹_fQy*ôgišy³Ð»]„Þ݇ۻ›ðìׇØQÞçŸxàæó§«Û;î_ÍTæ]#Ëõç¯w‹‡Ù‹_Î>.œ€nkfŽÒýyöÛÁy'ùå,ð£yvþýÀaz}âù±Žä»>{8û·[Šçô9sSFe~œE‡Úã#Úˆ?4iã±ÚÌÔÜ{‚&ôŠÙ…]ìºÕñW¿*±3÷ÌHàkƒï«ÜôU³ašµAv³$¾5ýËTÍ.`ÚŽN/>r”Ô(ÔfihºÐ^Ƹ¡!ä¯zó„Ç—5ïñ⪵i_™î¦Y:ô¯Þ Išº.[Ðdâ,V%-WŽOÓAA¤­½Üà2:buCÃ9®º"#\ò:4ܯ¬iT-Ž¨CÛä Å­#²Ôâw$/VYQF–<Ô›o#jÚõ÷ ŒÊܪFq¿ªµC ³Wo6,½D¸oñ2Öt¨¬×#Wï ®Ê)¶©å*øù–O¥~žùÜ‹SIL–Djð< ´^îZ«¹çÑl`ùW¦Ý¶lѨ8OQ‰ÞÇëÈ»DyhW­íš²' -­½&•$^çn‰*ï´!~á’úürkÖ>*ñ’©ŸQ–W)­áÓWó|¸vçÔò½ÊECµ‡ S±•äOÙU¢+x7x¸=G ¶¬Cxô8LÌƶ§^yW°ÍŸ»Ò¾1d©Ø0q¯µ)Jtw0^{ ”ÛúØ¢dLHc/üàmåð|`I\_‡Ý¶Vg:Ôþp¨®ð‰·ô¨u¨Ð×!gó­ãùÝvÄZÉàØøÅóøÈp t¸8\”}Ù®«Hó²ÂKÀÞZÄÜ9Ó– ,gݘBFØâ²…íF¤‰#®óØ%C¢<çBÙ‘àÏÅ)+ Ù©[“Á ð*äײˆ"_¤N"­Ê­Öä⧅ß9»!6Ea=øRF˜vS¾È÷[VuxZ1~z±vïˆ}B<òGñI± $g_¥!+}E‹zC)h¤®y%Ò&j 7¥xv°IÌqÚ!ÁGÑØ%¾(²o–0öáõïc0i@:óó$䪣°ÈWéq va׺-v±t”ú€ÁÜŽ¨Ü—©âÀïºèºØ·_9+Þvå§ZM®*o¶`­›8´—ü/9Læ6ö¶UONá’© SK°3 ,¥†79ç`AƒûÎÇžÑ(°Ó–uù}#„ .e9Zt¤ÄöØÊ~è à† FãC€©ú¯_#·ï•áΡša]½hlQ¤%~%œ9¢3ã‡xàÌwêÜ%Rѱ³nZY<’©êÎ?üãTù‰ž¿™»ŒhÈ”̆þ°C뱎ý0fK‚tEû XŒœø×ï…Þg* :?Ó[nPÓøy 47ܽÂA£ú~JRØ3;ŠV~¦Ò·2ÐœL<ûAÀ8ãÑ9P H)Gl,äå¯FÚ%C,INpfS"f²ðR˜9©a£DÖØÚ%ðÜ=wÑU9SàuÇ0g‘ìCl…àlnj^Âá¢Úϵ‘v*FÎ߈yhè¿qðåöÌLÕ<•@¨¼ÙøEQWÈ—o,+oMÛs [‰Fb ‡'G[ÀÔ'¦“c>Õm)ùt2ÊÍ8ûÔÚ™¤U ö)ãôÉ%íÐsLnm<Ýv Ãhç ÏÂËáüŽ‡é^-ä$3Çðx,¹×ì‚°^G+3xc‡‡·¾¯ÃtÐ5Ù -ž)Ë8Û¦¥„”œÓNÙܪz•Ì´œOP>8EÁDôesQtð¢Û®—ÑŠ½2ò5ð½µÙÂÈ¡U]/‘£#™ç†[#íí ·œX‘ Œw+(”™'Ӊܫ².öV¡‹§#6[n@~Ò½„rD¢RŒ"ëháNÖZÄéž3%è°J·¸s$6™´µ òDXµ–Ôžð²Ütÿ܈ûî*)YZ¨€É³Öm~xÿXÙ×Z1Ä9—¤LýÆ+…0»Ø$¾ó@#Tƒ»À¯jÏ(h¬c[|ÂüQÙ.©- c‡5iofÉÍôù<+Zhå ˜Mª¢ük[µãm(·sà0Ù¿•,=‘â05ãÍt¸‹á5w<“B"å;¦ƒÑgé€h€!oÖ.hí*?ueÉd±7¼É¡Þr-*å´H‘ë*y`ÿ-âØ ðL“›PÃuM˜§:Ué(,½cÚ¢ávC :`4îºß#mæÙJÍ¿)"iìÙYÞ‘ŸhÛP5»ã%ÚbdY+h›°ŽÅj‚’ívî·±^ªZŒd/ü5ed%£ŠÁ6sTøsæ3© Þ\ŸBF!´*ˆßD!#‡Œ´Éì…„qìgÚ!#*ùé¹w»ézþAÙúø„R`9|\7û+ÝX '¤#?ˆJ‹WøYð6È µòU¬Þya˜Òß/ G ½P@V'7=W,ÑUã)¬ü@lYñMÉš“P/‹|„’¦°…Ø·œÛâoâ9‹ìœë¯äá‹Æ^ªé W;*Ÿ#Õ¤0†;°=§€{îì'ŒHäìä¯`¸¥ªç†¡1:‚XüYòØ0Iý†RóTùY²²Ë¥Hõ’?—#…‰àáQ2c”؆øwýj¯¢æ~> “ï¸ý†Ÿjé'Òý c7ì“ÔôphšÝâH¿b<´\‰BI¾›cWÞMý˽ë½zÿ;wwTæªMûŽ'Žü^üž½D·s"̹lŽ]Ö›²åaÚ¥ÑÏèU·ï§,/®2cÓ}WšþÃÕ§W"‹ý½ÅE'¥À?ž&Áÿ¬™ÿëÏ•Ü Ô‘ŸE'r­Xß­,xµöåµÖt ðßC§endstream +xÚµXYÛ6~÷¯0ШiQÔ`r6[äjâ IQp%ÚfW–6¢¼Žÿ}g8”Wv¸IÓ ¬y ‡s~œŸ†ðǧyÂBQL³œ3‘çÓr; §kØùeÂE8Y˜&¸õh9YO/zUÃÈãÎsÃÁ㲩|/$ðå‘—ï~7_A¦ÝÇ×Yar´[ë¹È8KÓøŒ1Ý0×Ò/è§i¿ ä©KÙï¾c÷^róþ½[žÍr E€€AîCè]üµ¸kñæšn¬an웡ºú€l1¼q‡Èy¯áÝ°'dm3 +ž1{¥O/\²OrºÅ–PˆÙP·OÔ­®vŠ‘ž[ +v+§àÅ*ŠÂvßx4bP¯j·Ò¦Fy²¡eYwƒh¯9ÐòÍ(2lJT ħݩ@XkÍ:'¤ÇÄY«³ƒ +=—”°Sé£$%(ypôÊÒ <x– ›Ò£óZ5ª³o¤æ‰á¬•´áLFu>žÃg%lƒœ•s¨´[h\æ[¾Ò‘_Q´ÐŽ"¼A_ÖîJs|%-oݬiØ{«_Ct‡h˜íÕ}P,ŽÌ_×íÕð„£î=:й$?Éð"ÅJvTЂ­oÈȘu›v«Ð'žJN ’1QZ‚z™…Ð}£¨@}]ÔûÁ*‡–²ðTôÄ•5{‘«tZ=…i*<Š˜`ˆ¡Ìk‘dOÓóI-jà@Zï–®¢Ú]*ég+›f”Øxêèv¶%–Q÷-ÙŠ‡KòÌ_Þ ÇzR”LŽÛ‡/Âò£­¾oX æ™Ç²p½k;†?©vÈ ø.ÚjÙÒ×Ô[µ×Ãkx=ò aö~gðĤž.F¤Ù¸ÇˆÒóÆØöµ6ýJƒY†6CC_`Ö]GcÔE¥šÍ?q[@g‰2Œ"Ù\X«½\Þã‘°¤»0»²DP·ÞZ£;¡ÍnµÒ¥VØ(ñ$ó‰=êø=]Öèÿº¸á¿Qumî‘sèmÃùµN<Ìþ½2†Z¯ÿ¾fŒùÞoP¢~¥µíÝ> endobj -6192 0 obj << -/D [6190 0 R /XYZ 85.039 781.388 null] +/Parent 6530 0 R >> endobj -1990 0 obj << -/D [6190 0 R /XYZ 85.039 572.649 null] +6534 0 obj << +/D [6532 0 R /XYZ 85.039 781.388 null] >> endobj -6193 0 obj << -/D [6190 0 R /XYZ 85.039 535.782 null] +6535 0 obj << +/D [6532 0 R /XYZ 85.039 732.815 null] >> endobj -1994 0 obj << -/D [6190 0 R /XYZ 85.039 357.523 null] +6536 0 obj << +/D [6532 0 R /XYZ 85.039 732.815 null] >> endobj -6194 0 obj << -/D [6190 0 R /XYZ 85.039 323.384 null] +6531 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1998 0 obj << -/D [6190 0 R /XYZ 85.039 185.205 null] +6539 0 obj << +/Length 1491 +/Filter /FlateDecode +>> +stream +xÚµXmoÛ6þî_a4û -Šz0`nÚn.´k\lC[²DÛDeÉ¥zÞ¯ßIÙr­8m³"€MR§çîž{£C‡üÑaä‡ÅÃ0¢„EÑ0]œážü6 FÂzÄ ||ôt6¿ðƒ!uHìÄÃÙB‰Ì²wÖÕï“׳çoF6cÌr)ÙaYŽ¨5ÙÔºy:½yö³~úöö9.\ëÕ }ðìÕõdz£×“‘YWøÊÕ«·7³ÛчÙËÁóYÇÛ#^ÀКOƒwœa¿8„ÅÑp k‡Ð8®žÏˆï1³Ï·ƒ?ö(ú™7Ôoõøl·6sHy{ç™ßã|ÒÔ+0?}K6‹…H/jðÁ‡ƒq.æcÉÓ¦õn¼IÖw[QÌE‘Y¢sèE]ñw@½½™þ…8¶ïúV#ùÝBT²¾Û$RžÇ®ø§FT<Ùnàö!Ë:I?î¡%¯>‹”ÿ"w²æk[uðýo†/ʼ\ŠâÒ´lÐk—:Îã=Bû7*ïmYeÆÀ¢Cr)EYü7ü 妆M’ß«!- YæÜ>~A+Ãö X §….nÐJ-!qãY)y"ù¥ÞNµH’e ÃñY¦»D½âZÁ¥g»!q z©§<íd‹ï>œ,§v+XÍy.ŠÖiÌ3ÆÏ–È⋲j.µÀöMm„säÅt*ãYKÃÃŒ^¨ˆ¢¼®wç-7„ ¡UŽàã3¶T®U‹ÚØY—ú;2ÉóE¶ÚVô¨Tî•ÆUª#Ãg)ᔂü!¶\K¼Ö€hâ}„yày&ÈÞž˜ÓpÃI?5ІHûöpˆ›Büs¦-ž2§ÐÃã˜+CukÞ±› +%p;(Ohäš96‚ÔUy¦³9=UPX1óÒ‘æ6>K¥Ü©†§raø* +|ïD±4QÅ£fžð6*¬kÛÀª6±\àieDFTå7˜»E8hh’ôÌ_¸$hwlªÑè:=£ñ¶Ì“ú„´1…6  ŒJlÞ;Ôƒ.À 1 ™ànÙ(ªl=_j¦%Àºg^ÅÎ~NÓ¾9=ë-<×%mÜƼN1ƒسè‰W’(ŒpÁy†4RSM”YºêrŠ H\%ž¥Épja!°HÈ÷ˆÀ9öÑ}¸Ðo@©—f97=`Õ>Qûº…AW½0dÖvß +0ßršôZ?Ø÷ÑZsàŽ5Ã}Û5GåbÛ‹T-, VÅ ØŠ·6ƒ“øjR,¹1CUfR÷ŒN Ûƒ‰¦¹Ø÷°"ð|ëïQÅyÇâøÀʧ¬ËµøW±¥ú;7õ#ÂÜؤřôñá. +wI-‡a5ê9šMüÞ´)¤Z*Ý©bÄÀ™5p«¤Ö¼@ZBg÷hhÍQ²Ö`û|Älªƒ:lÚ#d]g„É)'">eG žðmF 14M ÉêSQœŽÓMd§“¥‰Qi¦’þÞâz–çfò(ø¤;pðˆ”S`»6µáŠcæPë¤B¦wF›é‚j@Jõ†˜·Öi½íÕe@úçRç–sqz¥ºÙ~L=ùõ½ã;ðA÷)¢Põ­Vq> endobj -6195 0 obj << -/D [6190 0 R /XYZ 85.039 142.252 null] +6540 0 obj << +/D [6538 0 R /XYZ 85.039 781.388 null] >> endobj -2002 0 obj << -/D [6190 0 R /XYZ 85.039 142.252 null] +6541 0 obj << +/D [6538 0 R /XYZ 85.039 412.52 null] >> endobj -6196 0 obj << -/D [6190 0 R /XYZ 85.039 110.499 null] +6542 0 obj << +/D [6538 0 R /XYZ 85.039 412.52 null] >> endobj -6189 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +6537 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F62 4159 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6199 0 obj << -/Length 3098 +6545 0 obj << +/Length 1026 /Filter /FlateDecode >> stream -xÚ¥ZKsã6¾ûWhO¡ª,$Á×îaËóÚ8Sc{Çšò!›-ÒË”èTÿûô (ÉÎakj†x4F?¾†&˜)ø̲ØWQ>K³À²l¶Úž©ÙfþsÅBH͇åÙÅ—8™ÊÏU>[>Ž|b_ÇÑlYþê}üùòvùùû|E‘þ|‘¦™w?¼«ù"ð®?\]ú'Ïþ¸ûŒÐ»ùŸn¾]^]sûrfÞG\òñæÇõònþÛò—³ÏK+ Ý„ÉQºßÏ~ýMÍJ8É/gÊòlömå0½=ñüXGÒoÎîÎþkYñœžñªSÊ0‹HùY¦ßWX¬üXi«08 - TàkÍ jì*HO¨ÄÏâlæ0;ÚÐÐícÎŽAèGA8Ùñ~ó -JŽS¯ß´û¦Äv†×ƒCCËÝaS÷ÿF±.¾±ÃOÍaê+PrZЧ©W4M‹WöB}\W^qûš—ß>\ -e¹­w0‚+oè Y mÇ“´=|»ªyåV»Ão +Y¿7¼o7so¨WØ.dÊä©·¥ùŠ´)Æí¶"žË‰Ç -àŽc:ÕõòâžD ¿U{·Ðþô‘ÛÐ&iC-2Á`±‡Qèíp?§X iù[âº- ZËÔ¶ÚÎÃÔ{˜ƒJù<¨ ’üFëàX’½!¨ºžGp¶åfƒÍݺêÜ#éœÎ´«ª’=‹Ti•X ¼à?2ïç‚oE‹)¸ÅÍù„=OБ¥¹l»»ü¸à’g{>oÓùoxr’ä~¨òw}Ë¡yÛ· ÑßùÖ{Zß:Üñ¤o¹;ÞoÄÈ·@â^ó˜Uín‡Ð†¢¬wëÑá¸U¶8µÚoQ©;r’÷<1w<1ÌcïçTôýò†»f¸¬ènëõÎ8O‰Ú{DkFŠþµhbËýÑQ‡=´G£Œ$?òâWÜ ƒt•ì¹}nª­ñP8rÁƒâä ÂOƒÚp~âнD"kD-¶“^¹ƒ°+%LìDK¼•A¶ òV¾pÕdëæneø9r_ÝPÙf[›»™†¶€Â -0ýSÿV‹3í«4}7Š94SB˜ ü“…Tqœù© -HM€¢bÍ î+Ž•÷½ú}bvdÛjáø iâć,÷¾4# I3‰1†O¨!7¦$Íx¾VéxiÌä(—h•ã…!á >Lºjwx«°`½ïÆœ”Æßµü€‰g¯”£ qÂó£wƒ`)†ÝW¦±ù’víû>GÒI´öÃ$½àÁÛ —~rpo&ÞÕ¿±÷ùÜþãD(NA…–õ -âd eÁÔþ_9¸ Xè@†êª¢|åΘé{‹º8HE£ïijr ì‡0È}ˆ´³ŸJbÆ8Ñ­…⻃$ õÂ!?†‡<9¦³û]¶Óî¬dƒñ#('2`Có¾dQ”ø‰N'’µ ¯s7‡gÍ"8yômyÕ´½„9Þ´(†‘mM¨¥xÆŸ¨l -jS€?ò…Y K6UÙþÀŒÊrzr@U¾àdÓBµI&k­©ù[JCÄH†V“H‡•Â GD80 L‡-Ô-ÔmWºáKKÕ¦ÑH)kâž5W›9h¼Ônøä…DîÚflT©vj¤¶†%o¤0´™¾—Á6nõÒHýI -ÌŒ£åÞ3•ÑР*ó¡£W¶šìE+?Ôee¡Pó}e‡†’;õê, ¼/h­ÌZ~+÷!†8}[ ¼Ÿ Ù¤g˜`²|µ©Ð°R¬>ƒsàw`RC*v«Šà±lñUžc ¤Ro„= å§R"¦C˜JÞbÃ^ØtœñQÍ@·ƒµLÒK|-êÁû}~$bžázRqÓ‹)`Ò4Ü‘ËJÆØÇ×Ý´Ï[çV–_@ZœP†"Ì~ôš\ïÆx .+aºÀ®Bõ‚°Z8]ˇIä‡Yün-ïмù²F)'>çe!’—…å<Å1jðÛd’âã"B7h'ø¬0¼%eC™û7RŽ4o¾8„*òÓ$á‚Ü‚˜–¢6FJþ30v:gEǘ†Ì¾Ï”g8*¾ò˜duë¥`×Uï Y5@§… q“-D¨:Ò¡ [t0zBÓ’©¤ÙšO$êÿíl2ÖÄF5ññ#K:|Hৼ¯”@Nq"/e;Jp9lêüÈÀÏzŠÞñN ›r—½CiNRºæ˜ž9óáÖÃÝ ·æµ ;öå.Ì#Ò•¨_fømyIŒÙlÀ†d:IãFEÇç¥æ¤žÔ›8 "ç0Ò™D¾½¼C„¹ÎŽEQ–ÄK+m ‡%‘’ÉÇÊ:§â®zÙÔü+Õ4Ï”ÎkÖét£ ûúy¢‚ÐÃ'" Ãt\g_»]`…_ §™rX _`z"+× éÖnÚ×:·f}RQûbßwåÜ`†ºÄ÷@šÞâë ö¦¿vttqHNù @*ü5< ¼{Á&¤[aö°'3HÓTsaG¤¦9ÇG¬éé1à$¦Ux2ç83樕y#ï™òdË­zg¡‹féG„SÇF^ε)ÙŽ˜‡ÓšX›:°±©Š’ΪœG0áf°ªJŒªtÀö8:ÁÁH¿ea㯕…¸™àbûëëéì)?<ùƒ!üå[ø¿þ#‚Í:ò³(? c€PK‹,xð(å£ Rlt,ð_ϲ"endstream +xÚ½XQs›8~÷¯`&÷€B îÍM“ž{S§W;wi; Øfj#W‚ñäߟa\’Øîd&‘öÛo?í"6Ø°Õ6E6 ŸaD3¢uÏ6jå]W;lÃE¶GaéÍ´7¸¥žmØ1—[¦ñóú¯áÇéͧ¾E1Œú–ï3ó¿>6G} ›ã7£ñÛ?õêýäŽyw«¼½û0õxØw˜y &×w÷ãé¤ÿmú¾w3­‘±\äzØüè}ùf±"ü¾g#0c«Æ6ÂA`¬{.%ˆº¤š¯z“Þ?{½æÚª%fk·Ã"6bÌÝOhKðq¾â‹4ë[Ô¡fXäK=É"I¬¢±©m +)«t6ITˆ4ü1š ›pýp?}F’#¬ sñø0O…Ì6¡” ÄQP:¼jy&äò8˜ý¿Xr™Ë°Ô4jð´Dçù2*ê×Èb>O£4Éòc.}›f³4‹r í +ø•ÄÏ!Ü•¶F/v¬Ã,\$k¬DËS¿–§TWˆàÖ,蔨ž\uìR%™æI÷ùòU"Ÿœìsà_vϼY.gS‹v€ŸI®—¬Q|çήz^@®_¿Z,ÚUÍ“DÊ”g/­æ§¤eèü'Lë¤?ª—Ö–‹ø•¬¯êy²i`ÕÅñN~S7ÁÏ¢Jœ7”>é.xQ¢› URÎyà߉˜%‚K=û—þ$¥$L£0ßýª®ö"‹øz½¿s®ÿ2i¢©½Ï-ù+ÑúIÁ7à9\uŠñ]Ìè‹.Æßä®:#_L— ¯õ3ãrîŽ_¯ðÙÎEÑEy:}Þ|œï4·¸ù™n¹yÄ+ ¨~Äu3\Iè2x5‹U§ÃK¦œiÊj ¾«ôaÕ¿ryؘr±gXÔwMiwB«µu'°â«Ñ¾áb-=Gñ! '@Ä!Úôï^—÷#J+ÿ.®¶¬Túc3E‰ÎÕ>%°)´ÆªaµÄh4UCv@*æ…tàÍÈùA›»¼:ÖE’ëB­¥ÕéòyuÊ`qh8Kã…Þ ©À‹™ú½*ù–Ã|n£H6É×Ñb“пº&Ä —ô²¥Hj} .TšK´+ÇW1jœqI`«®eæ”4K‘dÂä0l>–օг‰Ú®ûŽoÁP›•‘Äz¤f9ˆx–íà¢<ÍÕ:è.x±X6àûåÁÀƒpñ¬ö—ÜÞ(̵·…šØfT8újcwQì#¨è¤ ñ$iyÙ¨‚FŠ*è†ÓÙÂCvÔÀeÓ ýßÚiÿ >ÂlÏl—ü¸­ÝWç|È{ˆx®®šÁÿxЖendstream endobj -6198 0 obj << +6544 0 obj << /Type /Page -/Contents 6199 0 R -/Resources 6197 0 R +/Contents 6545 0 R +/Resources 6543 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6174 0 R -/Annots [ 6202 0 R ] +/Parent 6530 0 R >> endobj -6202 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [218.337 385.948 334.338 397.637] -/Subtype/Link/A<> +6546 0 obj << +/D [6544 0 R /XYZ 85.039 781.388 null] >> endobj -6200 0 obj << -/D [6198 0 R /XYZ 85.039 781.388 null] +6543 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F58 3380 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2006 0 obj << -/D [6198 0 R /XYZ 85.039 584.077 null] +6549 0 obj << +/Length 2594 +/Filter /FlateDecode +>> +stream +xÚÍÛnÛÆòÝ_!œ' +ˆ.wy+Ð×NZµ“;p€¶EKDH­ËKÿ}çÆ‹%º9@ÎCaÀ»Ü™Ùû¬Ôƒ?µˆ×ÓÉ"Š•«ãx‘UgÞbŸÏ”`x ãza€ ŸnÏ^¿ Â…òÜÄK·÷„r»ýݹøåüýí›Ë•ÖÚñ•»\EQìÜ-•³^®”sýÓúúò†~¼yƒßy÷–.ß]¯¯y~¾ôcçI.Þ}¼¾½YþyûëÙ›Û 3+ãšP#7ýþ§·Øÿžy®NâÅ#Ì=W%É¢:3v£å»<»9ûï° ÃÌ‚©fî¼ê1V*q?˜—Ë +å$ƒd|X6®6áT2 ŒÄ˜Ä¹°‡¬ìJaýÍf¶ÕˆW Ûª`Fà·û$–øÎ]q@™mp×Ã×”Ó<5(Â6¯^-WÆ‹œvàÚv»=#´=u×ÈÄÞóH˜´¦ë´’Ù /Â0ùRd“åG\.`ÒfK?r\}Ó²ÛíRä­’ónIÇÓ-Òe¸AÚŠHH¬ û€nye—+ØtÛ•= l®qRº«ʇºÛ²V¤-žc|çªÈjÛØû–?? 38×N––eÃËûÙø‚ÿ„`?eM9rN'$­å‘γxå/xðVè¢I«’¹"ÖQ›ïê“‹š„nJò ðÝ‹„ö'= d†ð€\ +õ,g?6¼|}Ëä[[¥pÍQÒDŸ×‚e ¢”??^¯?1*¡=õø`78 Õ‚ÙÒ©Î ŠÛ–-/²qÊŸ»:O…ϺW²Úetk&™»ý`u4»­ŠC1ð‚ÐFÆbi9dä`DÄîp ùÀ¿ìÆÀª·Ò¯ƒN!ðëã¤H¶å9ÉÈý5ÚÁ(lýÙ KAâú/„ ?qu¨¾&¢!LTêFΛº¶Kí9 Äï )gSô÷ r×´áyÊ™**¹BÛŠïÀuÎ’6¹p +®6@i÷© ?.™bØ>ôá'y#Œvôã:³¤í|ÆΈ?P/:T×â%k±©Ë2OÙišæ’vC?šÓ³ +AÉR5£ƒ?<o¸Â7·)‚¦{þzÕì˜0ÎÈ®øÄ@{À°* ƒÐI‹2ÝHÀ…+‘°lÍXƒ£Âúo|n÷CräQ6°eZ,œ¯?½’Í)Z‡¾³þ0x|‘.Qe`F½Ïöóh´š‹¡†dP_’ß Xó¾¯ÞÅm ɧ–©˜Òôx ásÁPvIk‰ó»Š.It<·iŠM™ƒ;ÂÛelX~¸w'Yr@6áñ$¨Eª¿)6CN|Å‘µOYˆXç¡uÄnàI‡ÉѶØPl­ŸÂÈU(²–´Þå}¸E´¡Á2 ­!i¥•õÓóTG A‘ñ’·Þä5åÖŒ ¨Hœ›Ç¢/4à;fËBÀIµa”w\md®ÿŠR(²µ¥Œ†É IÆÚ©‘$F>$AÉHˆ‚Î…[lØz‰=[õÒ@ŒÊÖs’ÈTY Cy!ø\£ëÜôYHRÐ{´›ó+þØ¥}èš(ÒÑÖv’ú$½ìËPÌPˆ 2¹ÝQ,Õº~¤+èü$øw:ªD|°™ +Š>ÔÇa×ðÚ®©ón(b.LŽéÇëKYAûÄ‘…„³TÈx°-ïJ’M·ìIË­ r”Š­3-%®X1罓>Œ‰”ÀÍ©«“Y¨H|C‰~·®à‹nÌt·=û†„XE;> lÆ£¶#dR +òÖÙAW€ö$Ëß`ÒäÂ*amP O<žn0ÈéÄY· dQM°ÅGxSF–f“Br&º£nÂpÌÉ™–éT‰øaÀrBÄŠ›€‚íÈôÍ ý–¢nQºä9sM~ÅfÅÈ8¿z Š8‡ ˜Ræ™åÐ’\x +%ÆÍ}!ÌèÞÖÕKµÑôu-%krðv¬S5+ ÆÁ˜š¶¶,dÉöe7#7‚Bó_åÆ]-…Õ$PÄ•OÏ ?:mjU4‰‡hgºQ\åĺx9k&¦ÓÏËÑ Ù‘PmV¬>Ël7”§€/‰™\fÌ´ˆJµ(ùågiBúæ•1zŸøuiw=îx%áÑBÝësèû&u¬Øð¨†jð, =+–ô›·üqOö“;öQ‡²!u6ë¸S­©†êÿB†%Õ°-¦[!äôC·±2îç²ÝûKé¹Á´ ,xˆÀc–¿l·Æw¡‹|©ŸŠ\“DÏú)å&(ìã~J9ø`¸¹¸ä~ê}m¡8Ã2|ó;«t©A‡¾E'>-üŸùg e7‚–ÔïÆ*™¢œ¼*)à<¦W%WsrýÆô‰ +ürî xŠØM½¸ y° ÏÛ?Ú%pu¼C7LÆæ¢Â©<ï– +Í[¤4+"=§-þ–eðù ÿ&sbv$¢…×ëJ/.-°µ9ÓÐOãS£vãIï¬â™€r‰ÆåKÂÆIwØŽV èmO ÊŠ:븴kST6— CëŽâ3ÛÔpŽ +c7ñ•œvh²-#=cÆÜ0Œ‡ÜÝGË‚ää¡B¦×z¼Ç}‘íçNV¾ÄýÉŲîvîô•ö"WE³ieú0²;q9èž]å¡ý7öÍwYÔ¾ò ø/’%ßgà+Îc,ð\/öÿ9§¬ïY(¡?•žï†3Z›Òûp ¯Ç¡º>NÈ +@oCAKÔ5ÀH +'XH¼þÓT÷•×šA»SÌ&û±÷&Œ|Z‰Ã +¢Pý…+"\ß`+p·¾¥7ð_x±ç‹1yf˜81îb¸4Jõ,TvüÈMR;µ<>eÉ3¼#º‘ŒBu#~ô)̶š*‰úH:”g-û{!œò0—TØ´˜(’ôP±'}ì²£wNªyDé ©úB‹ñ¹¦F’-w¶œ-IO³ÍgôÚ–Í܃Ýÿ-Åø’bî(yl¸`D³n8Ç\SX‚…9HŠÐ;^ùˆ?`}//haÿR9?C…‡EòCóB62/°ŽyèÞò‡Òæê‰ÝA?sã†&¬¦Ú¸ Äû·13ÔX#š¾Bò|GeœbA+jêŸT½âÕ[hЧ+æb@BÞòûG>TùžçaeäE½éžyÓõé1»Ùc Ž A˜›é\i8m…×Ñç={>j±Ëé1%,µïÑͨ rBM¢Û˜Ƈò7ƹÃW:yÍxRNã +×åZžû_HØŠ\ôOTpÒ¿“ˉ¢¯CîþgÆ–µvMô‚1‹¤¾ïÇ> Rˆ©ÿ£chs8í“zÿfÁëêendstream +endobj +6548 0 obj << +/Type /Page +/Contents 6549 0 R +/Resources 6547 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6530 0 R >> endobj -6201 0 obj << -/D [6198 0 R /XYZ 85.039 549.331 null] +6550 0 obj << +/D [6548 0 R /XYZ 85.039 781.388 null] >> endobj -2010 0 obj << -/D [6198 0 R /XYZ 85.039 263.285 null] +2070 0 obj << +/D [6548 0 R /XYZ 85.039 761.463 null] >> endobj -6203 0 obj << -/D [6198 0 R /XYZ 85.039 228.539 null] +6551 0 obj << +/D [6548 0 R /XYZ 85.039 739.701 null] >> endobj -6197 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F58 3360 0 R /F15 2972 0 R /F20 2961 0 R >> +2074 0 obj << +/D [6548 0 R /XYZ 85.039 653.403 null] +>> endobj +6552 0 obj << +/D [6548 0 R /XYZ 85.039 613.239 null] +>> endobj +2078 0 obj << +/D [6548 0 R /XYZ 85.039 351.118 null] +>> endobj +6553 0 obj << +/D [6548 0 R /XYZ 85.039 314.251 null] +>> endobj +2082 0 obj << +/D [6548 0 R /XYZ 85.039 125.405 null] +>> endobj +6554 0 obj << +/D [6548 0 R /XYZ 85.039 88.538 null] +>> endobj +6547 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R /F64 4225 0 R /F18 4228 0 R /F62 4159 0 R /F35 3036 0 R /F58 3380 0 R >> +/XObject << /Im3 4496 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6206 0 obj << -/Length 1889 +6557 0 obj << +/Length 853 /Filter /FlateDecode >> stream -xÚÅXYoÛF~ׯЇR@¹â.ï}p®ÖAã´µƒH‚‚)™0%º$GE|çZŠºì‡(‚X»;³³³³s|C=öàŸ'¡òüt'ZùI2ž¯FÞx ”ŸFZ8\aq<ÏoFÓ×a4ÖžJ½t|³ØÉ Uúã›ü£óâç‹_o^ý>q}ßwŒV7ŽçÃD;—W;WÏ/¯^>cêûëW80λ׼ðòÝÛ‹Ë+_LLâ¼À-/Þ½¿º¹ž|¾y3zuÓ+Ø ʤ¨Ý_£Ÿ½q7y3ò”Ÿ&ã{Jy5õTø2¯F×£ßzQL Ƽë”1,‡«S•šðqƒEZ‘ßÌx' z*ô2Ø(T`_¡±Â u^ÔëOž–›¯_€=¢ÈY㸾ö¡ìæ·j^¯LɈ”ó¤Ãñ­ìyÀI {ˆcF#â‹ -'³‰ï9MFq^´L¬×üû ¬•ëÍWževïu]a·­=÷6A®ã?n­YK‡'¬¥#åGd¬ºZhõo²U,Ø6DXOÈdð'/PßlR3©Ù°)hÍ -z(×èi3ºj>aCCž+S÷€ÖÔ›å-Ï×tq<··r7Ÿ˜Ø±ô¢°ÏÒ«Á1.&GÏëûòPG:¦°´,ÌÕè)™à¯\ß³ †ƒ¥ªi:Ϻ²îûimB¦¯ý¡eAd"SC"›ºî¾ß3¡3¿ç_¥¦m¶šeÓ¶Þ4óbºnÙï¦U9ƒñŸ`¶ØKtâÇu>GŸ:‡sÃ%k”U¤_ͳE½±~ 3²#ƒÝKÎù}Û¬Ù2S'[é²»‰˜ötñ~/ÐN˜È îRÌ{¶@Zácá{€¿Wåœ÷Täwð÷™5½‰•iíÄìh¬ƒhÍ2Ý–w“´ý3†NC°L4“D…&y:mùÊħ“–ke¹aÇ!•ŽÓþD¼Æ‘ËÓ+Ê0¬Î_À÷|•†ár+ëñ ø^¬Œ‰Ÿº9¦QCïæc”†²5|¾ â•°(åílÀáõçäO­Ìês\Ãf½×UÖ”í³G¢Ê?Œ*tüEG¡hÙ´ ùl4¥+}"%ü'ý?ǘGrç¦+Ž_|µjU¨Ä¡H9¯îxe‹lJ¨BAòÍy™R¬H2‡þiÑÍQ\Ç̆ÛwU5– $+Ø$I„W6- kªâ²¡Dv?8¼´ãEŠ§” D2瞂׿ Skóþ¬*†öÉ ºôJÝÀmm8H}ç¢Î:(a"7ç-¦Ð †ë#µ!§§ü~PÇ”%Ò~ &U±Wuê;™–»LŒqU¶’î­SƒW(QèòTé"×ì9Á}êåMδ(«BüN\鄳¶·Y^?ìo9æÂG»G8ªCïŒÜït÷Ôów¨$ð‡ó& ’ÒÖ®– =ÐÖ°ŒåÇ ç‹-]8·Áà Ed$c…Ð¥ôÜUÅ<½gá$Ûtõ -€Á<«*9ª`Ç,šB„¢¥äò¤ÉmÁÌàâÖÊ3)¯\åsA©§ldy‡¦žgìVè/ }™ÿŠ‘§+WD -ú˜æ`ÞvK!Ò¡_ã¼)Põ©`}‚ЙmMk)ÒÉ+F™H韼ÐÃUŠh`Ý¥ æßwJSžÁëH\“R„¶*ˆb ZËù æ²Â}2tC#ÊÉè¹6œ‰¶Oªã-«€õ‘‰}-Œ9fq¿°ôøgÉZßsCvèkJ*ÃsSq|äC(&hè< -Š=Â$ÆO”§ÓoCA"Ë;‚bTÓŸxDpªÂ•/ÀãYYeHª,°”G9Ù.àN+¢&ÜAì0˨¸ÜÙ#j`½aæ»}T+ž¡ÎtUÆx*ŠƒG»ªÏÙñc”Æ=¨‘ô -ßóúš‹Ùr…YiKí/.ÿ8£¤þ˜’ž³­Ÿ†f:”/ žàpãhCrò‚JT‡Ëµ€´Rè±ÕÖ¶ÍðÕ­m­a¥Ù ãš+o…›Qȇw ^pì?žO¡A™KŽ-%êZb–(IMOB†7ßTRÎAð’KsË3”¿)+Id° ¡ú® =‚êÀëÀk?ß¿ ª‹,w ìTªë¨?ñ‘^ô/Å =’µC<ÆyÙô­`WCÈ?„Ç{©!» b..&Hèa¹ÍÃï¼Bý,ÊBD¤CÉaH’§ªd/?Ùš%ö%µ§@ n?=ärjÍ¿ìbæÝ4ÜØ‚Œí$ °@™(Dé»ÝVgr" 1[QçŠ ‹QŠ2}G:."œDª¼ïvà rçˆÃ~9ëö éLQ"ûÍà»…4æÙª¯~°ãÃ%}×SöÓ‡gG×û›<†ˆûö°Yº½’3¹¡Jtrð¤^6¨&â¹Ú–ž¤ÛNEÊ™4æ{ʤ§’ü瓾éÃcŸ -áZ‰¦v…ÐÉmuÁ›ùÚêBa ÿXáN|I„endstream +xÚ¥U[oÓ0~ϯð€#׎[_Pwƒ!mƒ5B€ÀMÒ6 äÒ²í“víªI(R||ÎwîÇ65‰ü¨¸˜°ÐôŠY˜qas!%o Ú#ˆÉ1ñ\%:ŽŒÑ¹ë™”à„f4×(ùŒNÞNÞGg7–ÍCÅ–íûúhQtaÙ]_\ŽAz;=S„ƒ®Ïqz}9¹¸zb9:Q*'×·WÑÔú½3΢`lŽ¹ÇT4¿Ï_‰™È€ß³00×’&˜†¡YÜeØå¬ßçÆÔø°µ2n‚Ö@Îöas鎱mòÌH¾®ªö…e»Ž‹Ö³¬œW@ÛŠ^…L•±Pc//NÏ&7ÑÛW…¨ïª]€»/ÿ!⟳CD‘&Íc|HM»‘;>&ax0‡Å![§U!²·MZ7OO’"+ŸŒ~Ó¥Mû„TTpÇUWÞ+êlƒ‡Ù.Ò6-[ ‰¦Y'Ž~ügLä§Éüe¡F3Ñ,4¤H*Pù)j´ù=‚»z¦GDYq !úÏÆ—’Á^׫,ÏÓñhYéh“õ”´¯¹È›TÙÓý¹µ9Ãó´—/”ñã®…ó×.S æUžWê0®e(Z(.GqUêp +ÅKù£“t£¸½¹È$'׬1¸gÝìñG­ˆ—Õºo9œMŠoó,OÊ£ác}× +/û]V®Dž%°éä`þ£* +_ÛŠ–YÑÃÊQRË$²Õ}ö éÔS—–¢®mžYòŠàèãRôÙDz6š˜Y¶,__+kU¹xý|àìMåQ–0NÑ/ ›åi{ÑÀ +máÊ„!p åÁGºK+ |Q$¯^îyè“pTuµ‚hÏ]Ónìf½Ý<û©ó;Ø+÷rQöyëºyÎNÝaòFåýÕW6q2P\.iÀA¸Û”e±­¥d4:ðz¥ +ïðc[2Á¥â—pÙLÖÍsý½AHDZT%†NL—*#5“}C²~M`œË£íV¯*šª….ÕP\Q+ê­zßbYQ&+ +Üu–«‡ÍBy™À£v§œ@Ý¥d¯Ÿ{ªü¾e‰¥Úöø¥ó‰‡=xy?Ê}þÿ÷2Ó`[ËÍ#G‡9Ƽ‡!R3OMÂN€%Z endstream endobj -6205 0 obj << +6556 0 obj << /Type /Page -/Contents 6206 0 R -/Resources 6204 0 R +/Contents 6557 0 R +/Resources 6555 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6174 0 R ->> endobj -6207 0 obj << -/D [6205 0 R /XYZ 85.039 781.388 null] ->> endobj -2014 0 obj << -/D [6205 0 R /XYZ 85.039 761.463 null] ->> endobj -6208 0 obj << -/D [6205 0 R /XYZ 85.039 741.337 null] ->> endobj -2018 0 obj << -/D [6205 0 R /XYZ 85.039 220.674 null] +/Parent 6530 0 R >> endobj -6209 0 obj << -/D [6205 0 R /XYZ 85.039 188.652 null] +6558 0 obj << +/D [6556 0 R /XYZ 85.039 781.388 null] >> endobj -6204 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F62 4047 0 R >> +6555 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6212 0 obj << -/Length 2384 +6561 0 obj << +/Length 1879 /Filter /FlateDecode >> stream -xÚ¥Y[oã6~ϯ0R•1k™’¨Û}È$™nfw.['èÓyPlÙQW¶¼’4ÿ¾çFJ–ìL€¶À˜"Ïùx®Œ7Rð¿7JBWé(N<7H’Ñ|}¦F+XùåÌŠ‰L:4ïnϦïÃhä)7UéèvÙò ]£ÛÅWçòŸ_n¯O‚ p|ÏOâ8q~{ÎÍxâ9ŸÞÝ|ºzË«w³køÎç÷ÝÎÆßn?œ]ßZíÑ LŠÒýÿìë75Z€&Δ¤Éè ÆÊõ`y}⹡ä»<›ýDzâ5=â]ÇÀƒÄ “`ˆFvÐðå&a<ŠCå†JÕvWT›f< ýÐù™²ýî¡Ú”ϨÒô½×e1Ñ¡›x ünDÄbžm’ÄÙ=ä2ºO?R'[¸‹|!DÿN÷M=-‹{X›6c>Ç÷ð];÷—Ö´òÇØY4.Q-aiW§#åÜ>ÀGÑðYëŠN^ ›RÎUàë™?šý>¶Ä­ªw²­@sä¼û©³+~Wžžg ,ü 'ÜCH:ßã;à’† ¶Ù\óÀO#ç²1ò8f$òžŽ%RD -§šý|NMÃkì+#Rî›…Y™C…g³Ë6(}V/pB;O¸¹“*p´iÁ´¨z¶æ1+¨îËVp„¶ª™&#-ñVÓ®°€¸]@tJˆÜ5÷Ìo¤"[ˆº0Ú† ®ö¨`±YñbY‘ud÷|Yɉ#‰¶·€™ì‘߂2% 6dadlæ c‡ëìcc«°oÇgë-fvÂFq¨6²ÑÊEV(§Vž¢+±xnv9af…ÊùXÕ²L7´¬êµèŠ<2ö JÌì€ÝÅÍy€~Ú±[Ð ¡%¼Õ˜P'Â>rZAüúÂ!×y‹m|w¨ë’ÄÙ 1Åp:š8çÿÊë£ä¹køþs—oŽ-8•™}Wùc&ïÇÚ™Ý~k- ¾ÔÕªKõœµµz`rYmæâ€KÃL¬Å`sþ¶Šu⻉NFQè»QìqÅ…z%¿vb©¡žtÈ)–Â>OJ-É%±€”ñv–IÆn{»€þ¬?3Féƒù]·~,òã˜Ýµs¸oñÊÖkr*$½áíy½ÌæyŒÖ$£ u=ß?šN ͤC4„ !ÅéÐrBø–ƒH‹ ˆèY¾§uG'óK1ä/ÀGj¹oÍ•«TÔ¼Æäƒ@a4ÚgOu/LÝ üÐ cÿ;v`¨'ò!}ž(âù Sy=ùK~¬Ù9XÎ cùØT—KÑçãcWvJ÷îÛм¬jŸªêž({"•¸^½X¹uhè0_ +7(j\_±·@±ºGàCÁ‡0˜œ2a£ˆ"§Yß#Õ +…ã†P(©ï”–š!†N]±iÎrNöu†aPs”ÊÀ5s6…ºáé #?6yNuŽ ô­¬}ûÇ+ n›E—L‡Š—Â3þ¢ÎhWuUfBÑ©<¤2IœÇ‚¢&¬VÂó©àš24UmXcys_K ") isÆž™ó ƒí¼¦ËFx$ã‘ô íÙeEyHÄzÂâPƒßU¨øÇë°ËdÝÏ*—¬¬aãG,•bç]+P]2½`PšÃPg(>†p˜„[HÕCG,¸™àÂCs‰6/÷‹6ž‘èÐ˪,)Þû¬%@¤ÀA5Tì-‡¯«²B²òOtjl© Þžr ¹:‰‡=KœÆÒ³½ž%ô,ˆ4>Gãç+W+È°1Ä‘ƒÑÿµ.é+èàt ¡*ÜÔKû¤¡2Dx×ÚRbkË?mƒ‰7@Á uNŠ#4ߧÇé%Gá[¯yгb2¾¿ÝÄ4IÛA ‡RËÃcr¾Ð¾, -áÏ4#h‡¸®Y ÍÞuu?0â-Ü $îÄLÕ:3¶kÓÙÞdO.,ùòdƒín NÒÄOo~¢Î@§)Úz^cÇSд¿Ù7¶EÛ`DÊ9D¼&ߢ´æb~æŸ7§µle]¨µ”’d‰§WRx -þ¯•à·SÖ´Å‚ÔQ£¶¥t‡¸m‹e±8žžðY¯ÖcU,ŒTqžR"8®DGªí+jÛWÞªKøì)~G‘ m¢¬çS7†î×HÛc” Ø~€>³·2ŠZ¯ÕI¤K5§ðUŸÅž_×€÷ª¦Öm{Œñ3èöÇŽ7™³ -i{Îj á…:Ç2Ȧ[”2‹‰™¢_ù̦¢|¶´ùLV¸féH³ËKÛwJ)Í)¨rUÑPÖ?Ò²çm6@¤I¼Š eí®ÃkgÊËtÔ”2'âéWÓqöîµ5¹A@®aÊo4Óû¬y8‘’ý8u#ÁGréCþõþÞ# n›ã±1‡—*v»AéÚŠ]KÅþr¿NAµKÁƒÙ.a´~‡ƒ žmìÓÚc^ËŽª·óËÕ%Wþ b¾FDO )⽨fKs²îÇRCù —ühhÛþÀ“‚Ò6TrÝø#/s+^œ³Å­¥k–BÚG)ü²Ìf]|p¦6JˆTT“0¦ è½ñÂÍ•){ú¡Ïò 3éÝÆôô=4ò‚šS‚À²+¸­ˆ8ÎPªyâ7 Šì7)Ç™y³„ñEû6 ‰Ø‡&Ùœšõ7‡m¥/«SÅ”™Ù¹à—%æ[|ƒP¸¥Rû±°¯ «\Â\[r·¼EÔÖA>ôÌ)›IÍ/ÕNÂ+¿€ó$¿À•Ó&³-_6å8;ÝäÝê­¡ÅíX7‚%Ê„3›+F¢ÉüµÂjKÑ’³€9”òöA·uÅç¡ãáDÍaU^ë6 ÑiyîlqÀ¹öO t ûR¦¤Ý{ !ÑÎù‡ª°Ñ|qðâ©»5žd‹ºs^~jm67“#¦Úþñ¦;<°Ìþ_xÐO½o -*ûãáXü[á؆"¸Ip¢<}ßõ=# *xA_^ó—¡Àµ -|endstream +xÚÍXëoÛ6ÿž¿ÂØ—Ê@-‹¢žýR´hÒuh2 N×ë€2m ÑÔ¤Ù_¿{’l+)†})D$ïx¼ÇïîH‹™b–„®'ÓYœW&Él]žy³-PÞŸ Ã„Ò ƒÆÄ…¥."ßõ‚xŠÇ›-dâa„Ä·×gË ß›ùžErv½!¦ëì/Ç÷Ýù" =çMv¯ªµÎæ ÅΕîæÒsð_=—Âin™p9Žªæ ø¿…¡ÆQ‰ƒª›ÿ}ýÛÙùõXƒÀõDò„vAÚÉ^;΄ç¦^:Öîz—·ó…¥N‹é5þï฼®x=«á;D¸›£.ÈWÍýÄéÌÖ=|G7ùè;ݨ‚×ó¶µ»È ÃÞíTÇ#Õ0ÉÁ ^Û6Ú’ó’%×È֡󘵫™^YÁjó0'Ö[#:+s¤ç­µ¨Q]Ý´èCtŽÀø¦äƒ‡È“žD 1úMã•ÎPr²Íkj$ßã?´À©´=>fMoy½éÍ®ïpL4{Ôšg­q ®­k>yëâ%.¦FØ€NìjRCuFJGîæ1Ò9„ /pˆîsÒ¹*õ`V€6 +'ëMQÇÇy"€gøζô¶ò#yq! K 8sO5u cª‰Ð`m5ãé!n ‰>•ª4°óS+«­ ª!TØqVF$ôð…±ºAwb›– ¤õð(ëN†XT`·22.WLúBNÄ„¨Y[Ểòk Þv +•k_âvÏiÏÂÊ|T4q уÄY¡ +%zäf·ÅV7C­BýIöA!Ï3c=LÖw­)±è…è°ŒÏ)ê-ù †íÚJË÷ ¹QZµ,iÈgÊ/TþÀô,¯­ëQUÐÝ"ÍpѶñäÕ–yÔУïó.5W®Õã$N{Qoß¹-*“=H"ÃkeÕè"WèM[Ð';ì¬í@‘:C×ëÇ®—&ã«FA);µï iÃëïè‚Çœ‹:Òt@>‡·Ù/—™5nÜʆ¿€’ÖT_§z(+ÐÂ:×TKìò#oS6ŠjM„Œç£°™ÁKô@Ì-9Páºëµgm¸_79ÀÁÈí;Ý` + _Ñb˜Nj€VájøæD¡ßLµ^'^øDïõSWF⇽×7½÷“ÆåF»‚|£ûŒß¿JB.^àÅfºÿ×…¿BÝüÕÖt +×~`÷lM{¥É·Ïí8Ïø’ %«ya’Šî +P¤¿­lÍ°¬=Ÿ€.øú— d¯(‹Öä„”ŽÇ{³QÈÜS 2JœJÛ²‚3JKøÞÜQË 1^þñ{E˜ x2h…؈,5¢æ2#Éœ¾Õæ<*¸ò 6|nˆ@2–ñ„±ƒwu©(߈÷…Õ);-_¶z¡Ï§Üf›x¼ç9¯'œw™[¬6u[o°[%ž“å}¢JKêl¡ .ñÀxXßùÂI•:á'~‡2‹ ÀÍô‚€®SakU:ãûƒãÍ1ìâJ¿k]ý]OÝ4"7NbÃHÞÄ£ObòÃ)ªÔ3ß/Ä”1š¹MÀî?áAH¿//‡“ÌǶÓT©ŒÁA£n`íœ÷ ‚!`Ò"¯Öt+ȸ>¾š,ø„ö§Šè(#ó‚¦T ÄTªz">–ÂË4œ~z#i,s2ýŸGÛñi7?–véÏeÊQa:4„ÛÀœú29;Ûç-L~. Ï9TýÌø#×üüàfØ«/=׃$Â]ï8ª¢V™¹ÃŒ€­îó9Ë6ôÈî+êä^H ŸìAdš­áøôþK6˜ÄûWË%½÷n™¯¹h¹¶†ÕårUµÈñê´¼\}¼€ï$~<‡Ñjy…Ÿ??¯\úžŸth?NÝHFOý2åK7“1˜Ÿûy ^„5[TÖ7–—±Çà7@<›ÄjÍC!5¯Ôܵ›iÃá‘òÜbùß™Ÿ+èèö3ôQ`8h¸0ôZœáõëôª¤ø÷x`¨¼P7Å€‰ =}Jž\ÚÐœB u}!{™ÿ÷¹²²ÛK— ÅQ²<-ì$ô znìCtcÏõýƒª{Œ_$.¼™|Ržä³/7 ~ù´ßó&oendstream endobj -6211 0 obj << +6560 0 obj << /Type /Page -/Contents 6212 0 R -/Resources 6210 0 R +/Contents 6561 0 R +/Resources 6559 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6221 0 R -/Annots [ 6214 0 R 6215 0 R 6216 0 R ] +/Parent 6567 0 R +/Annots [ 6565 0 R 6566 0 R ] >> endobj -6214 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [481.851 649.553 539.579 661.243] -/Subtype/Link/A<> ->> endobj -6215 0 obj << +6565 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 636.004 353.452 647.694] -/Subtype/Link/A<> +/Rect [228.164 137.436 509.794 150.338] +/Subtype/Link/A<> >> endobj -6216 0 obj << +6566 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [158.952 622.455 458.051 634.144] -/Subtype/Link/A<> +/Rect [203.255 97.395 236.763 109.084] +/Subtype/Link/A<> >> endobj -6213 0 obj << -/D [6211 0 R /XYZ 85.039 781.388 null] +6562 0 obj << +/D [6560 0 R /XYZ 85.039 781.388 null] >> endobj -2022 0 obj << -/D [6211 0 R /XYZ 85.039 608.186 null] +2086 0 obj << +/D [6560 0 R /XYZ 85.039 761.463 null] >> endobj -6217 0 obj << -/D [6211 0 R /XYZ 85.039 574.042 null] +3186 0 obj << +/D [6560 0 R /XYZ 85.039 653.495 null] >> endobj -6218 0 obj << -/D [6211 0 R /XYZ 285.296 510.468 null] +2090 0 obj << +/D [6560 0 R /XYZ 85.039 586.876 null] >> endobj -6219 0 obj << -/D [6211 0 R /XYZ 85.039 279.605 null] +6563 0 obj << +/D [6560 0 R /XYZ 85.039 544.591 null] >> endobj -2026 0 obj << -/D [6211 0 R /XYZ 85.039 263.543 null] +2094 0 obj << +/D [6560 0 R /XYZ 85.039 404.088 null] >> endobj -6220 0 obj << -/D [6211 0 R /XYZ 85.039 232.126 null] +6564 0 obj << +/D [6560 0 R /XYZ 85.039 363.924 null] >> endobj -6210 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> +6559 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F35 3036 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6224 0 obj << -/Length 1771 +6570 0 obj << +/Length 3103 /Filter /FlateDecode >> stream -xÚ­XÛnÛF}×W¨èƒ)Ä¢I.)‘~)|Kê±ÓZAP¤yXI”Í„Ô*¼Ä5ÐïÜ–¢$:MÑ .wgggÎÌœYÊzðÇÆ‘ë©d8}WÅñpQ ¼á=¬¼ø"1‘qGæ|68yM†¾ç&^2œ­¶z"7ŒÔp¶üà\üzövvõûh¬”rߧÓØy?òëÑØwnίo.OyõÝÝçö%O\Þ¾9»¾áñÙ(ˆ Ürqûîfv7ú8{=¸šµ¶Gƒ1 Z÷eðá£7\‚'¯ž«’xøcÏõa¹€yn*yÏwƒßZU¼yWVbì'nDßlâ»áDµ€^`‘çF^H€F‘ ð(|Œ£0qîjt[”ï”0T“©ÓløY?¤@°jxXà3v–0“­žxƒU¨ñD…* œËD­K2dÓX”Ù†©ÚðS7µ)t-ÈfšÊÈòÉ|&ÏdËCj-¶1¡3i¡¼Ʊ)”0mœ¦‰óøʈc £’‡]¢m`¨Š=ǬxöæÎÞœŸñyQ³ «üõ¦æåÌ>+QIÈ™ª²ÖÎs9}ÇcçW+Ùj¬®OŸgmfYÜöÈáÙ’=nãÉSÇ”uFÎC‘ÿéù!Æ«ª!õÃ0tf£XaŒ• -9Z,'1Ãa/ȼT‘ÑåW4`ô:fU’ƒ„*2Ò0XÈ6L*Œ˜ï;÷¼aaŠ‚ŠçD½®x­4ìG}j} ¦®—°íâÏ,|ÒTåIΓd“ÎO*]à”>aNöÀÃC»ÊcRþ>£r˜“¥TôáD´®ùemPË#¾@ç•áQÙ`4ζÃ#TÓèœ÷bV¢.#ºl¥Gœ8rflJ£pº[¯8Qh[tJ½ò„ c'à%¬º’ÏX¤”TÀª=.íI"L™²›…*‚Ðas~Ñ늨ƒƒ ïµ2ýÒ¤•“š8+2 à%ɉÈYènHíº%‰ÛÀÑmª N2E’{->È^#:óLRPVºª9[Aå~¹ﶞàƒuˆLp8L%¶2„ uMð{Ûº„1'È)ôÜ”¬AO€¦|²s¤ìPW[°-ú ™Ì¡õö!ÊÙt‰ÎNçlùuMˆß}/6Ñ”gJhËZ&uÀˆ¸âöñ§­ØH©9À¤0Ô$,œdAiÑ÷9B%…F9-5,µ bƒÝÒó|»qÉŽEvj -J—_ÚxÉ–9‚`-¤â§"ÅNãžs^å„ò(h‡i±0¤¿ÐÄ 9e)yÚC&?©ˆÅÌCJ¼>*øªDnëä°ð)ò€.‰iMf¹Ör:nÉZbiF@ué{EU+ÖR¸m·°-³$n¡ÑÔž¶³ ²æ -w]÷;ÛT´ú7ÏÝ—©m\ßÃð3É{Å!èéBÕƒiòí릵 …þsßcè.To¹þ!š»P2ŸKÄè®öúãNú"z–*Á‰<9y©º×Að+TîDMÉ/å\nƒÈù**ð<ÇóNé/Ï8|%E~Ÿ"¾SÞpƒÃÀÐ…aeÚž¾ x™rýÁ¬ÜcŽå• NµYtŸÖ’@\:âw¶f†Ä õ]Ï9êM}x`Sµd.ðØ]r)#ß‚ÀåÅ,F¾ ¬ÄqÓS’SQD¹ƒÄ°ä×”'N̹K|æ7Í\š>'Q2GÃBKõi)úÉiè8 oï9ÝíÍ„!úûß^^¸¼þ?(àhý_ºØäÔ¥'~\â$Æó»¡zöÊ×2BµÛÊO{’ÛŸº~ì$æÅÕ틳e‘­³ª†ÖbÊÃN…"ó¦\¦`Á¡‘¸ú -o'Ϭ}ªÇzùÌÚçr^ß?·qV]¯¡•­Óú]Å·‰½ -ï¸Ã{;爽iªö³ ºæ\{Ðíç@K­° ЄŠ¶±—À÷T&Uqvð‘ô…½m³Æl¯»B”0üYD(ï°úÑ ÔÚÇÙ®lG›k™N 7˜ì7ˆYud3jÎ;DÒ^zôMç‹E*t‡L:WÏÐá{™!Nÿ•PKC\Ü)\±`Š˜#701 + À˜ø¹MÚ½ô¸”¸ $%põLu1“¾Gî_·ûrPž$}?8À?Vù¿~Öi¶Øb•ôÿjøÖjUpÃݳ7R±ÅêÐàs-»endstream +xÚ¥YYoÛH~÷¯Ðæe$ ¢I6ϼŽídœ™x³¶1 0™Z¤,"$[Ã#ï¯ßººIÙ4vY]]ÇW%o៷HBÇUé"Nß]Þ¬ÖJ©¥ï;«u'˳‹•Ÿ,[yž·<»>¿\yË $ –×Ø¿û‚Ëÿ¼ù…ç>­ê ç>\âàòúnõÇÝÇ“Ë» 3ëÀ "…Üüyòûî"†?ž¸ŽJ“Åú®ã¥é¢> Bå„’qur{ò/{ +¯ Þ5s絡X{©“úá¼\Ö(‡0µ’ña:pTM%ÂP Ž0H—7E­û.ÅË‹¢ûÞë=ð²Y“=Àš·¬aP4Øëgnï;qú7*t@Ж/œy§»]ÑÂW‚(Zf¶ÃMƒ‚VÈ€/ïWkøO µ¸.õ–[àu×áZ ô÷•ÔÊý¸RŽ·@ +¹&î¬éŽ5Îôµž÷uºz /uÓñL¿C‰Èr›50zƒ·ÐouÍKÛÖ|¦@YÑ›ÀÃ…tW:¤ÕÃÃ8NÕr£‰å¾‚éÇU¢–ð,•Ô¼Þèž;U!~—Io‚¡~{ñþ/èo®§ä [ Ñ|½¾¬ùö¼…X)¸_ †)"ë«G“,Pªºá‰rîÜ£;s„M$¤$‚¹#†ˆˆþìs¨–^º¼‚/©0 Ä•G}ÖÝkÔÒɽqýPV÷š‚ˆrõšÛ_&ÃœHÍî–—5­4“oi|dêáû +î̤EÑÜ=ìJ¢Ýñ¥!1a¢Ã(+ZÖ4§«a• »/sOÒ|œh@è"¸³ýΓ¬Á?JÒ±¦…vfL6LÀÅ/­:*ŽŽ\ˆN%|îB¼¥‡ºèGP=ë=¼M´üĦU4={0Œ5+#®^ëOÙfW6…sÎ*:çWÔ‹nNyNâ¥ÿÕ± „ÃåVW=ëP’åòõ·º­³¾ÔôòŠ4‘÷ȱ€€Ù:Šœ)XŸBxW9ÿ6«qÓ}ÆÃ:++|ƒF¾Bc`8‘õ|ÐÙ¾åŽây_½QêMèòèºà;Yq]åÌèÇú#7 U \t„ðô¬]òúƈ +™âng´ºW„thì¸Päeo˜lC÷2â/|sC÷@$;^ÍÒoÝò0/z¸¾°£ë²'±Çpß²Ù£06òå¶È:kuÔƒo¡~EaLo9ãKøŽ%^ k:²ˆB¬„,PáÑû–-ÈóÁX5=(MŒrÔ^‚«î¸Ç¼ÕŸ¸Ñõ4h˜ïÉÕäLF·†¡Ç¾Ÿ;nÊøæ©à +öº ÎlºE¹>A\`G¡äE»Eæ+^øµ´ññ¯Ó©º"¿¢åãZžk<¤±ªéz¬çð) 9 'ÌcMøhÌåŒçIÐóPœQ`ÎFh@yÅû˜d¨PÊ® fð}r92"ä ÏgÖ„m¥Üga[ù& ¶g÷%©q_Ówx²Ÿ‚¿.ÚŽ»zè»2/x°–à˜J?‡õ%Høg'=v½àZËÙ÷€Ñ˜©‹²å¹¼ ™<û™‹: ê²³ê¤[£ÀäEwF9 d·Èdkq«#mJFmBÓ }äŒÀTHï‡ ;6‰§D¢e}³aˆ€ò¬ÊngN@¹voWë^ïBˆ¯¸±Ê@Özæ#_È¥æK…•;dX`›Ç@t0«xýÖœÕAý‡›<ƒZÝÒq‰ˆÍJFLüØœ¹_Ê\ÙMÐ'øqy{4+²â ì4º‚{r n¿‘u¢ Š}wqþúóžãyo™æÌðD®tDÀð !NBß;žÙjaáÓíŒr=>jÖ×ϬI¤ßJÞ¡!錦£ƒdüÖ‹#5†Æ‘”âVNÝþñ¨ç£ûUÅdÜ°¨ÞÎið9ðdù1Ä´V[X“ùÈãÀòÎwK†‰À¹Cq4*ÉÇ„Š§çZSÄU‚#ŒÝ<†f†(¢a]}Ťގ2–7O¡‹J]IÔ"ß %5Â…öA(n>0lQs°e×÷û7§§‡Ã#Æz—@zšxGa +aF¯\Öä"Ø.ÆЇK ¸ÔJº5 ½²Óv$í–›±"® vR+…ý‰¤½Œ¿rCG÷Ë7€šùóÂƨ=­(»R6Ý +žkï1 |nD¿]ŸŸÞ¼‡¸ËyrkÜ;ê¸ÞŸÞ\|湓fzr0¯ÔÝK~F瘖›n?"F•®@M¶^2³ùGÁ4”Ó4#Ho Õ2gª¹;`e÷âÇ4 +Vgxø#v&e²ÀßY¡…GEÑÌaœé;*0¦¯ÜsðØ™cÞ€sMqàN&YU¡4½p”&ÌvfÝè‹GüzÊœ;bÍ¥Y·ü{Ž, +Ü0¸è¶:ÄêqÊŵ#Ι(Š ðƒªë½Å€Räö\à¬W^¼ÜLø$Pæ¡XOÔhôÄ„lpAîÀ1–¢…Tbˆ!²Œ¶Y'[Š†pVˆL3 +©3‘’̤Ÿ6u•6é32!xšcÇéÆñ‹ë™ÛB(nŠ ¦X3ãô.¦Ñë<ƒ™¾°YŒ(}/í;¦ñäõ „ f'è †{‚2Ì ˜ö¦CÎä<6± ž·3))ZÁúUŸÙ² (aº:AõòÁŒ÷T:Ë'YmÃKm<ô(c'Z”†¡%¡¬0Î<Ã/’yÀëMvoÝn./¾ÃÓ©‹!˜*%1ð]É”¨³¤í¸ƒ®í/—Ü! ¢¯ÿ9-!PÊ,Je Oœø,abàY:½æ˜—Y_° ¥T/ÂÃg­®Ü¬gäI¶„âz…‰E –ïWIÀÅ5ÄÛ¥Í K‘7£pzSØŽïo±Ìä¿ŠE÷Ä6iòJÖHÛ²Öâû¦%"(½Öžç;žëìq¦Í‚ò¯%{àæ ŒœóL²%¼Ñs™p+œSSë„)Ck±ä~¬*‘ëË#¾Zˆ=NÚ`xñocöJøÌЈ²Lr•Â„ìÌj9pÕ ›ØÏ ,ÈÑG!ÍðiÝš‰<°‘d +!{.ïk4" ¦š Šï”YWpž>q +3‚¶“Aß>¢rÍŬk Rq4'¹ŽW¤fЀQhÃmmâV¶ðÀIkÅ$¿ž]s”WvÅΘs eð,ž£“·_C³"ggCÎ+^‹—)²ZΊ~§m²/w¹â&«gD=t&œ¡šTºaÀeêI~fJ̀ѣ?S\Lõš)ÚgEx˜¤¤Ú)RÀc¿:’öõÜR~ª'¡ +W0Ì­É[³æ(ñÍËvô·sá©å_WÑU¿OSï#!J Ü”ŒtÙ"l1fH>VHb)H¹v”9_þ…8úÞ“ÛáÌâ#ìtl?9&¦Z"vÀ9û@8 ÝÁΔö}‚Ò¾PöB«¹5ª‹ýJôuÇ|ir[±ÏÃü(ŠÎ ³ô3nL¡è9ø mÑbš€Ÿý i~ÚgRvÁ„Ë÷'Jz[hÑB±=Ls^ž¢ @5[ë¢ÜPü |S"›Dœ,åxü9pà é8´ÆG!õ'ýoSͨ*9Ÿª¿/íìÁå!ºXÞe¡IÍ–½Õ,ë2ÅMöšmŸÑéÕ£I¦-t<*R +6¶XPª“Æ"ÿñ Rªm­ çj8g9ñ—…ü³Z;â2˜!ï‰tæבØø6öš£1<òª`ñTˆåÎj\•9ªöI¤µ5üxL*'LEŒvÂHŠá’|„¾l¥k˜ä€GɳI€•JœXýôý8I©õ9ªpö»ýÓú^ìD*€þÿ“ª›]ÓÐõq˜üÚ€u±†0*×H$’`5ck1(¤’²å–sCBk ++E3{ÍEx-Q²G|Û²²@–>­¥CØ;€Í¥â‚¹Äp{IИ–.蓸½$@ñ2övV"Aê$/ü*=ÖDþÆÏõ*%™ÖW^~,У§|z‘£¢'¯ýµñçendstream endobj -6223 0 obj << +6569 0 obj << /Type /Page -/Contents 6224 0 R -/Resources 6222 0 R +/Contents 6570 0 R +/Resources 6568 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6221 0 R ->> endobj -6225 0 obj << -/D [6223 0 R /XYZ 85.039 781.388 null] +/Parent 6567 0 R +/Annots [ 6574 0 R 6575 0 R 6576 0 R ] >> endobj -2030 0 obj << -/D [6223 0 R /XYZ 85.039 761.463 null] ->> endobj -6226 0 obj << -/D [6223 0 R /XYZ 85.039 741.337 null] +6574 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [474.587 429.038 539.579 441.031] +/Subtype/Link/A<> >> endobj -6222 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> -/ProcSet [ /PDF /Text ] +6575 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 417.004 166.217 427.482] +/Subtype/Link/A<> >> endobj -6229 0 obj << -/Length 1649 -/Filter /FlateDecode ->> -stream -xÚÍXYoÛF~ׯÜ ¦Ðˆâry)@P8>çÜHiP$y IÊ",’ -(BÓÿÞ9–©#MÓ—À0´»3;óͽ’èð'ºž­rØu=¡KÏëIÇèÞåYG(Ž¾bé7xžN;ƒ+Ûé -CÃît¶•cë–-»Óð½vþüìfzù¦×—Rj¦Ð{}×õ´w=¡]÷úB=½].VìŠ}qö<©Þ¾*ãæp+«!™ ¾ä…ÏèG^•s_­ -Ò}{ < âD|°ÆuVå¬eÀˆƒÁÒ/HãJéZÀµ¸PÑăB©ÝÔÃ\Pœ·=s¨­kJKˆÜ\zx^&¤¬bò^œÊyí´8g‡¥õÁŠ÷UÖ!Ä'w{'ä.Š™ -lÒ”˜*(Ž -‡TñD3sd¡"µq<][,júˆM9ƒ,­ðµ*çèñôŽ…m - -7›B>òPª6ä\eø&e™DþRéÚõí€ÍLIÿcyYk;2,ÏÑMèóßi j⦱?Ò,Gè¦ÃM ¦˜­ƒNhSP•Ðÿ´«ø  q\•?° Æ¥Ž1r­(ýž4´¼Äöˆô"Èc‚vÇÀÛC]Xö!ðà/iê†ù/–O…i~Û2Ń–½"ØÕ—]–NÉ'œ"´ô1WKº³¬²Ö_$Ø8Ë•êºÐHç.ÙÖB?¢<ÎÒ\É•¸œHÊåÄÕ×—®îš^kpN©kÂfÕ›*l¹8Ä™DÕƒÍt 0®¸„Z¬º2¸%Tìs&<‰ÐQñlÝ12²R¹hä;HNT^*m8äV«bÏÕÌ낽™àˆC°§Ù”J?ᦚ Ç2jM’†O|ÁFÝÞá.9f@ãÊ -6¤=áŒ!nìÖ4ó7<ÚŸ×Rê ²ÄR‰RŠ¤´?Š­ßtAê)I¾^¥Ýößਠ-C¾JJZ¸ØpîÛˉÿ™ü[;Ëñ¶AÇ &=`Mè<Š‰nΖäß(ç³"úTEiñ è{–«½^#ÉU…‚ÕʼnÎ. л,›l\O -ˆ»Y‘¶!¨N¼³Ç2ûPÁË¡Cã$Ç"ÀÍflÀzPù`û¸ÚÆmÀ2 ª½“o¦æúÀéb)p‡#E+cQËiÓàÓ-¤*­±Œiú1IÅbk;Kö^ Ê -7us‹xóÐÁA „y\<æ§rë›…Ñz$S 0lþ?²ÿ"}–­{¢Ýl^Â×­''“×OO„# -æß﫯N&(<Æçíñ>/áEô9"ÀGÛ“} ë|E² -œŠÆ+NEr*¹€èb|3½&€½¹œþqöêɃߎÞ?fCG?‡¡éÖÐÑwjþ€¥ïâ4…?ƒµ+†µOþ'ûÞ+Œ|W}â…¡ö~‹Éü..y˜ë#<|ÈŸ„´xvÃDz­¶2«‚¹rÅgŸ\q?(ªÛb]`v3åëWþTY,HÚayTVyÚ¶–7ë˜cð÷‘£4tsxø½¨ý¯_F¶K©{rxø‰gÃÏ5D+…½‹·þeð?,ù‰Lendstream -endobj -6228 0 obj << -/Type /Page -/Contents 6229 0 R -/Resources 6227 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6221 0 R +6576 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 76.759 303.67 88.752] +/Subtype/Link/A<> >> endobj -6230 0 obj << -/D [6228 0 R /XYZ 85.039 781.388 null] +6571 0 obj << +/D [6569 0 R /XYZ 85.039 781.388 null] >> endobj -2034 0 obj << -/D [6228 0 R /XYZ 85.039 486.243 null] +2098 0 obj << +/D [6569 0 R /XYZ 85.039 761.463 null] >> endobj -6231 0 obj << -/D [6228 0 R /XYZ 85.039 452.1 null] +6572 0 obj << +/D [6569 0 R /XYZ 85.039 736.911 null] >> endobj -6232 0 obj << -/D [6228 0 R /XYZ 85.039 452.1 null] +2102 0 obj << +/D [6569 0 R /XYZ 85.039 654.569 null] >> endobj -6233 0 obj << -/D [6228 0 R /XYZ 85.039 452.1 null] +6573 0 obj << +/D [6569 0 R /XYZ 85.039 619.823 null] >> endobj -6227 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> +6568 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6236 0 obj << -/Length 1272 +6579 0 obj << +/Length 2582 /Filter /FlateDecode >> -stream -xÚÅWßOÛH~Ï_aѪ8R³özmÇ©T€BÞz$½>Nlˆ…c§¶Cî¿ù±Nlbàª{¨*ÊîÎìÎ÷Í®g>¤aÃ?iž°ÕÈR¨ 0f‹žmÜ‚åcOjv4|'=ëÄó i‹‘=2&7Ûs<ázʘD—æѯ_&ÇýRÊt¤è†ÃÀüÖ—æi ͳÃÓ³ïØúu|ŒÇUŽŒö™ðÍ*ƒ ÝI…¯£¾ÄyXò äݳ¼(ârI7›ã–(Áÿouªè­T¬<è›…aÎÃrŽÆU¥_  ‡ëŽ”—ô`Š{DÂï¤Ôy§úóûÊï4´ý¤ñ¸¤ìº »•¬òpe{6üHÎóß”¾:¯?Õ¹þ•äýÞøóá^à†1žÍs}OúJ_ï竪J²[žGùº¶àI<,ãâ>™Å”¦]'ß%iº,ò™Þ°˜FNÇ“?~ÿú—§ 5–½›³ŸË&{Žóãt¾ñó3)5KN'-ÕMëR‡f'4þÎ[ÏÖ“óŸ¼T·×5ÿzó†_Iåª'†Î°™Úb¡O¸Ñµê>¤Zug•«iùPZð&ikcçNÒ÷º2WÄÕªÈÚÄ CÇ×÷Ï YúR ƒÑ³š¢áC]Ô±w»h탱Æyö” ¤|UÊ¡PPÀŸ [ûìÄm•néÂqýV`x¿}gí¶Q袜š ÕÄ2Û¯š=½¸ãY]¯86WÄMep¤».WÔ¸.µñcV€VøÃ&)¶·.ô´óóìˆä¾0dX…Ó„TH…K;h‚@ؾûlŽkŸPŒÀØ1æƒÍ!\Vq¡»_^l»eª -Q†¤Ô(¹” „|Ùêªçv×Ò{)¨áh¥ã£­C,¦s#ž¡àr½ÀdÁ´ÑIÉ wN4á%ÑÀb@3‹ÞDR ô´(Ôf¡Ð  µÁm/«°¨P§-õ|V»&Ë -Ä2|fæiŶU¹ -ñZR!ÏR´SléP€àúØ0£,ˆž¿mÓ8ΣæKÊœ"œŠÍÄcÎ*AšhHë¬T¢c²i°(EY´UiI€´”Ïúÿ†cn/üæaS¸Ñá¡f!Qé O’AÀ4£zÚQ¾´h#ê”VVo›“,–Ío·Ÿ ®lé¦zLÛòš÷v…ʼÂL«ÊS¾à·@Ú¦¡»H3·ÕOR˼.åINK‹¾zÕÁ¹¢"Ø á‹é®ÂÊNç‡ -?|àÿú‹iSÉr žøØ=ÇŽ¬± %ýÇx뿬vÿ #(@endstream -endobj -6235 0 obj << -/Type /Page -/Contents 6236 0 R -/Resources 6234 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6221 0 R -/Annots [ 6240 0 R ] ->> endobj -6240 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [335.674 158.672 389.06 170.361] -/Subtype /Link -/A << /S /GoTo /D (winbind-solaris9) >> +stream +xÚÝ]sÛÆñ]¿‚}*8!ø&™>¹¶¢:±)×¢w’<@ H¡qÌá‰3þñÙ¯;$w¦/rG3ÂÝîbooo? 'ü…“yêñb2›‡~<ŸOŠÝE0Ùæú"Š`’øA–"êï«‹o¿O³Iø‹`1YmˆdµþÙ{ùïVW輪q{QäO/g³¹÷âÕ4š{ÿš†aè½X¾¼š†Þ+$I¼%ŽW?!úæý {;Eª»¾ÂÉÕr5ýuõÃÅÕª'Ìeâ'YŒÒüvñó¯Ád ÿpøñb>y€qà‡‹Ådw‘¤±Ÿ&±Ìë‹Û‹:.ŒK&üÖÈž/-Åeøóyâ6¦#›ÿ©j@ÚµBÉÚéeèý¤áô2š‡^N(ßÁcæ•8‰¼À÷ç4á ªfË ‡ÊÜÓœ§¿aÓßq5áµÌðUSâú­%Mz—€G6v^Ê’Fñ³%hO–#2Uœv¢Eä¢@bEÒ"Æ0| óÜäßà¹áa…¨Æi‰Q‡íý7pÜAdµA|räCšÃ-ÒÞÒ‹ÄËu)"i«mC²#„ɵÝS^3üÃòõGFJ +ªá§¹/+-Ã’øÜ„®XÁ~£vy1Iù J¿P;æÌPˆ{œo÷Íü`Á{^Ý— õ8ʼ} § £”ÔÃ;ÛÒ0ŠJ"´¨KOU=‰ü€+•ºä׆'+±a:4G¬5$_~dd¾ßº®ŠÜTJ^àƒ×=£‚YË8}@ƒhH–­°h™eÎSZ»ü¡5ˆàj3b"¥­YÓ` I;ûç ¯3’ 4«v{\âØ™%6 ¡½Ã“¶‰ìü.Úàk²u¯Èëú8'c–ó¨ÙBí:¨=¥bæ.²ÒQµ8:M¬IŽË}ìsgºpÔÀ Æ-f3r]>+dͽ-‡ç#ewX C8vðXÉ3oT4ÃHIðt‡9˼»ƒ(–Õuiú!_¡ ÂóŽÔX2­]Ë.„°6߉;ãŒL(¬Sa¶AÕé­P<­L…ÞGpjK ”3Jº8ÂaË8Š€ž‰×•U8Y:«¬š†iœ¤#Ò|'³‡ªA÷çXŽHeIxÿžÎcq7Š2²„b@ÏÿØ‘2¶BmPµuÝÖÓ87²#gÈ|cJ-ÃÝ´÷Jγ¦"©!uvÁÀ¬V/€30½Ïå•Ê>[Fæ<Õ%–2%ÏÙ%ÚÒñÐòß¡ü6ò–VuQsHÃAïÈZ#8”‹ŽuË€Â8œFpf­ù3ñ^Ô5çBi7ÚÙSÖ}Y‘Œ¯‚®ÜN EþºwŒX5êQP¶¢Ãѽ: +cúïøyŸKð}ÿJ ía/Ý“ÈBÙ¸ªmÀnüSmàF³XÎrþ¼TM5F/Ñì¨A‘8BŽÉeÎÕ®58sOi4Ž¼—.Dèê‘‘Ÿ­‘Êõ2@®sŒmµøI%~Á:-õ†|t'iZ<Ÿê$Bœºƒx,%&:gîªYÉsO«~ñaåÔ6Ð}ÚëçaéðŸC+£^„o¹Túš,Ô©)šQ…É%žE.­ãÕO×öÍ¡í#\”§pA›Ê(zªÿv´ÄGl?AáÒ¯íšÔl}b ¤=-ÜЕðÉe{Ø;F"‘]ªÎH:#ù™6xT_Æ\¦2ƒÒ°PMSîÅ[Nú´ à²×¹jÅÑhቈÜRäXóbñ{³ïj¥†A·tAEbd.Ý#J—¶ç›×j!Ò•®,¾¬f«Uæ‡ë&ðMÛÚŒöò\é'a4¨’‹]£w…"ª¦V\%Û _™!E¿Àë +¹°BvØ‚à³á¨†ÃB±é`'5 sé6,1© 5Õ¿Çžˆn9ΆŠòó½â>¨ÑP”,*)ç0ïYr´Ø¥”g×€øðšÇx¥M\ÒùÒx§šòˆ±èiO?\<³Zj©ÞöÛ*jô¥{Š³ÈsÝí›Î·.àdÒ¢á@x±Ëµ\ýØÅ‘kÛLZ @ÜÜÞêÛïQgº”…¤6†-Û-ˆÊæý½”0“Ë»")ϯ#Rî¸]Ù-œ‚àüXÇ7©ž¢Îì$R"Aµ‘§a.»2§«#Šö\žâ%ßÒYæHØØÎoyú~xdº2 ê)3¹-‰xßDaF|à<ðÛœáº_°÷7x,«Ûwr»†è_]w'×˺ã—XßcNæ°*ä­rá@rVí®zLû…$‘ùÃ8ÿ¼ ù³´ûÀ8ñ¡ûì›{ù‰?O\xK +sfc§ !Gá?ES–yoÔÖ^‡ÝåÛž¾ó/Æ:%¶xB°8õÃ0úbª¡ÄÉ=98›ìN§ö®Ï þ°2.žµLA÷0I{ÃË*ðQ=­Å"9tùM1i÷™¡óI…J"ù Ó7ò„¸¨F¾jl:'P‰ˆbWý½¢½»BÝ ‹ ì“Qìgñ³‹ŸlÚÖ``ˆƒQÊ|]…ôíYˆEßdã’ÜßæõÓ»¹¦´_)ÊvXœRiD÷Ý7‹ÿ¦õxfÚ‡V”¤6ƒŠ×ÞGá%¶ä¦/)Ž:æ'´ÖË%G{_W`‹a¸Ýj%ÞÉ÷¾†–Vöúçë²PÒwÂߤ(ªÜætq—ÿµåhµïîäñƒ»âñ3]”#R¡L½ÍÁU:¼„-G1úé>H%òÉᮇñòjõææú KÐbÔÉi!×Îã_¡%> endobj -6237 0 obj << -/D [6235 0 R /XYZ 85.039 781.388 null] +6580 0 obj << +/D [6578 0 R /XYZ 85.039 781.388 null] >> endobj -6238 0 obj << -/D [6235 0 R /XYZ 85.039 188.887 null] +2106 0 obj << +/D [6578 0 R /XYZ 85.039 308.324 null] >> endobj -6239 0 obj << -/D [6235 0 R /XYZ 85.039 188.887 null] +6581 0 obj << +/D [6578 0 R /XYZ 85.039 265.976 null] >> endobj -6234 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R >> +6577 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F41 3054 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6244 0 obj << -/Length 931 +6584 0 obj << +/Length 1468 /Filter /FlateDecode >> stream -xÚ¥V[SÛ:~÷¯ð Æî`Y²âØi§@ ‡Îzaú@9S+Áƒ/©å4‡iûß«µ$§í0íj/úöâe‰‰Å1Ca:2ƒ †æ,3°¹’wQŽRq6t§†{âM‚ÑÌéüÁ>5§ñ•uô÷Á‡éñ¿¶C)µ<‚l'Bë£M¬SÛ!Öäðt2~-¥—Ç@xÖù‰¼ŸŸœN$}`{¡u&Gç—“é…}=}oO€ÍÓÌÐ}1®®±‹HÞÑQh®âÌð? ŠO ãŸÆ•” LiÕ• Ÿ†Èév6¨¿‘ ‚=äyÄ |Œ|<¨Ó±·À…Ç îá2™ÛŽïùÖ•<þ’‡ËÓ]ñÒ½IrÉ]k{"@úµyuË„`ckïÁFRyQI"+VyÅâÚœˆ„žô1ÕNØÿIUËœá<é@}—¤é²,fŸÄÃâGä3ßlgH€€’¤J…(ʘ - ÌçàñÚÇct2Âe¿ý¬óà.¹Jrø½¶òB4¤ÃìÆbQ²¥²YËóÙ´ÅÝf\ãÔ/õ¹ûŸÌ´õÊuû[BI }–Éì@¥ªÜ{!¢ê©Š¿Uw=]äúxùòqÁfg•~´Š$ïT.ª¨¬\^ËVâ™Êdɾ¬’RG;/Tïð(»‰Éʯ¬ìè‚YÄ™ˆ(ø¢W·‘ô9`è7Unç|¯ó®öv'UÓBú±4É5øªPWZï¾X•‰x5M£*)Ô÷½¶Œª[¾/ùuQÞ-ÊbµTümÁ«g`d³Ûb#ÅI¾PÜÙáxקV÷WZÌ¢Ô­3,{-»ÑÍ6V§Šï¡ƒí~ˉp€fE>o·ÇF¥vA<j¾ 5톺ËË×øE;ÎçDôëäLrSaG,+òg¸–öqG(oÞìDӇϫß9Å”±ž˜jB·_h+ñ§(ýÞW¿‚úÚÞ%쵪«fn’'Še¾ zöט¡z¼ª=x~ôžrf tOÈæ¿ÖFu@Å| jÕƒE$±öaaX‰ çrw¸‡Ý¡XIfm{0ÄJcy“‚êè0i -å*— ‡½#Ê@"È’\ž1xŠRň^ÕB 3áHØÄB…Áý¾ò«ù% :À×Q¶ˆÍ ‡Oë׎ˆbäºöñ“™þ£u©Y ÌŽš]¨U0ß»ÑX J‚ÇxõZµø'°¥|endstream +xÚ½X[s›F~ׯ Ž3…™°°\%gš©kËvRGr-œ<$~@°’h€UdY“ô¿w¯è†j^âi%´c‚„„àB¬ê™Myø’5‚(6î[]O²%ž®Ä“UÂ"“¡ê™Ñ^SßAîPæy WAWUç³ ½\9iqlBÛÐa£är;fõâ'kQkœ•Ö‘\Ag]â …M‘lœ†é;þ.¸=¥ƒ†7,_U áSÂÖ¬õ¥[6-Hì"b%glmV‰òJ±Å$_½«å •k7ÕaD .K”H ¢øl‹ËǬLñR†Kò •5Q×ÝLª^ä©X%¨$Îs”nhaZc@áLdm”íô^ÞÉì^^J”¥ôûòZ\ç1‰ TÓŒ%Ì·<¿Dnú:ÁXf3§Çá#;%Øæ—ýÒKPÛ˜(”j‰He·É£ê„Tq‘Ëh´U'˜æpÝ +löÙÜŸü(‰»ÆÓë~”=“5ý'û×zˆ‰EÙ±ª¸ÇV‰ÄYèçဎ 8BõNÀ›³Ÿe‹ÕY¶C5J×Y¹x”"ò  ®->Û¾½œe‰l&ÕµEœ•5ýGi;4Ú¶žÆY¾:xÀk±¬ËÛ²ª³z¡fË&Õ´Ec’ªDNk\d‰'œ|ÙäÃh(`D(©à`õ]ÉåÙæPoP™aÅOJ²‡r¯NÖÔ]©v’Ä^QC*‡àpE½6 . +•&©J;‹¥¢Å[ár ¶z"†ßcJðbnVs”dÅòf¬&‰VûݾæöOE Ú¢2ûô©Ha[$Zû%&_ÔáÄû¡Ú~èn9ifXœÜ{ÃÛ•ü¸BÉ«ã"+_ÓãœÐe¯è'¦‚Š©`É+þ™UiU³ŽØ:&ioÇ9BæP^áë–ˆÿ{@-Ï)ÂÝÍÍð6zfD̽"È„¿µüX:6ý"èµÿ®!mÿÝO .c¾Áñäï®gïB„pöUvà߯OˆNendstream endobj -6243 0 obj << +6583 0 obj << /Type /Page -/Contents 6244 0 R -/Resources 6242 0 R +/Contents 6584 0 R +/Resources 6582 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6221 0 R +/Parent 6567 0 R >> endobj -6245 0 obj << -/D [6243 0 R /XYZ 85.039 781.388 null] +6585 0 obj << +/D [6583 0 R /XYZ 85.039 781.388 null] >> endobj -6242 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R >> +6582 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6248 0 obj << -/Length 2246 +6588 0 obj << +/Length 1339 /Filter /FlateDecode >> stream -xÚ­YYoä6~ï_ÑÀ¾¨[usn$3ÉØA°H‚…,©mÅ:::Æñ¿O¤Žnµg, ["Y,ÖùUQ–[~ä6ò…£âmI¡¢h›Vg{+ÿÙHMak{Fóêf³ç[éˆØ‰·7‡‰/<_mo²_¬×ß¼üáæíÇ­”²\)vvFÖÏ;i]íli½uõþÍW¼úÓõ[|q­ïxâ͇ï_^½ç÷—;7²^ã–×~zs½ûíæÛÍÛ›QÀñh&FéþØüò›³Í@“o7ŽPq´}„wGHX®6 žð=¥ÇåæzóãȊ׼-ïZ3†¯"áGêÜÒ_±†ïßñÈEÍÚô÷`€ß=«KQ«¶€™cÏËÉíÎvC«ÙÁŸO¨xÎóH‰„ýýWh€ý;5?P†BFîÖö”T@ݗMš”û.©n“ýmQï‹Y¶³}×·ìWl€à±ï?32€ëœÀР<ó®Ov -ôí.õÝéùR ¼g04g,\ ½@Ä¡ZˆpucÆŽõ„†mD±Õæ(Ȇráê衦+tû${±³=dzjX^™Np>c`f<âfÀÚÓ|–äUSw£‡õûBO'ÈFÖA½æ>‰ DÝ=¼I«ÌÐ|`)bå¡a xcÒ”EÓa–Ü–SÌõ ?Ó¦®yVZ©>^Ã5šhE¥•è™¼5a žÔ1Ûé'“ ¾M…ë «A‹4‘Ïì–ëÝ¿]?çãYÅǓΔө£2 ¯• Y BÇCÇ„âRx»Žpdü|xO4ÃÛáé¹dq8_€dJ„€tàëuSÿêHïnhIu-¬Ÿ9qBÈè—v±k½üþ‚¸~ìŠØ•ÏŠ;£¹G~àˆpͤ‚'6ÆÁ=ù&Œ‹½ ²ª$Ëy¹èùÙߣ_;^>àž¢Ôwœ%·‡ºÁá£Ù”èí”±fÀÄÈp2`Sàê2äp&iµ$Mû ¡ƒÙ6w9„+¸ÚŽ<Ÿ+ËÒÂY$Ä,å=f”p~ñ æ`ï<*ò—I¬s8Ò Ï#Lµ¤á§"Ó! »’@:gîEšôEƒ))ëдüÒ ÄÌ¥CúS‘2½À$ó‘hêÈÛÚ<ÉH’;Œ°8°n(OQ0ڹΩ @”ÔÈE'Ë\'Ûy¶%„”½¡k á,¹Çˆ ˆèµÐÒ9=σ}çM‘eµ«Á·Zà YŒ[€k•<ÌÊám’âŽTí¨á§9 ärn”†Êí]Q°Øç=•á= -œL ímXm%­³2Wú˜ºAlÆ·l’²ÐPVÓHø(@yiäpCáÄ,ÇwèÙE‰ÒÄñ‰;`"a -ô0IÀ†+Ï q݃Ô#·ÁúÀŽÐ,¾PŠpžêLÉ“È®™¦Z–€™¶ŸÐ|d0¶ -¸8ð$„"ÐñæŠñOÊQV1"7£#׶2‘S”c˜­4NBì»fhGIöuG€R)j{¯S´S‰kÚ'Ø@ñ42("¸k8·t™œ¦Åª£æŽd$mÙMÿ¯ó@…ô:ÌDÙ Ò»`)#h@]èýÏw±J¸ázk^öŒÙyMpeLåx"ªr+¢k¸Å -º]ß]Dð¡Õ…^R· c\“æ<Ÿa¸´3Z!z¹‡Œ&;®˜$„Ä[Ï…+…ü3“h^öŒÙŠIB%”sCtÁ$:QYB‡I ZB­š¡Ì˜bBQXO›c‘ëÊ×@wz½äP¢˜6x ¤lsl¶Œ"¡µÄ·e↾†Ž0е&¥¼ì×Y Ë|5ií‡ÒúP3Âç'~ÿHløja‘ó“ý -!1 -fVqs¢cb…¡µGÛ·û‹‚á!E›“A¨`©™pçrݔԑÝ‹“fÖà;·±k'š6unŽyã(]‘åK€â 꽪‘øìHMµ‡Òˆ‰¤{¡ä"ÚÑ\ĸ¥B†oU(w‡?‡4+{âµ’B‘'B×3ç}&ƒÐh§£;.;d½Vn$"/x¶žÑ\lÞ Êøõ2ßûw;å\å¯Pšë7v‡Îp¬<-0ÕÁü -{Ó­Ã ›,Ü0è.ëDpå€1”|VrCs&ú¼JºBz ѹ”L¹É’³v­¾'«c@/Þ‚‚ã=RsÈ8î©3”÷0=/-Û2|É©g#O¼ñWŒHÕS­x>h÷Ðg÷¬}  R -_|óá¨ãiÝÓú=òx!îëúvHûaluÑÅ¡î `Y#ìL“nö1hº -ÑdPÚÒè sø\ñÿüžRNÊœ®èÚº)˜õÄDTtÐNKmëé*üô…M`8~äúRR}BSØæ ‰_ó£n> „!£¹Ô38Â]ýÜ¿lËôoƒ±ïY"¯×nßu¡%2² ¸PdOå5ÿ^8ø/ò¤(Žendstream +xÚÝWQoÛ6~÷¯Ð²‘šEÉ’2`ƒ—:YÒÄq¥ÐæA•h[,¹7X÷ßwGRŽf+Y¶u‡Çã‘÷Ýñîx¢†Ôð]b±Àð|J˜ïñ¢c3X9îP-a±..ývúGîÀ  ¬À§R$LÞ™‡?'áè²ÛcŒ™¶Mº=ÏóÍáË®í›oº”Rs8>u©ùEsŒtø—/._)Þy¥†È;ád4»7áig6Àôâ ¢ùÔywc >íX„¾±Ú"4ŒEÇqq¦çYçªózsŠZs µ«ÅæžCB}£Ç,âûÎÆvæ¶Ø¾,Ó\t{®íšgÇcEîG¡¢®¯FŠ¸:Pã{Êœæï»áåñ›wöM=¿ºžL..C$Kü—ï}~0zÔP6Œ?Ê“+àÛ#V xß*5‡EžóX#«æQÉ+E\Uš»ªx¢¨÷j&‹4O+QF"-r½WDÓi­§¡ûdªí±\KÙ@o‡ÒN¾ 6Øi›#'¥,˜WªkÀ’E„ó{õaóA&.W“(I°y–ä + (d±ˆ$ÀX’Pð¨Úë˜ «rSl`W]€¬bU>`u)ëÏ*ˆ@s&KÂl^Ïuuª‚QLy ÊãVü4 ãáöTI-WÐfÌn´Q«”ë…ì&¯OF¹(uïÖÿ±¥ôÖgäÙW\ciL +YB¥áè>é<®¼¯¿=³ñ>´m|'¤‡Ø˜§¾Á˞țÖë>ßÜSYTÅT»ý6G—" +™YW—|¼¾™¤°²Gº¼JK"¼‘Æ™žS? –KvàÊ }$s l6zžK|ð[kë2þϾ}™'¿lÎzÜEÌ¡;V4*_ ðwöçCendstream endobj -6247 0 obj << +6587 0 obj << /Type /Page -/Contents 6248 0 R -/Resources 6246 0 R +/Contents 6588 0 R +/Resources 6586 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6221 0 R ->> endobj -6249 0 obj << -/D [6247 0 R /XYZ 85.039 781.388 null] +/Parent 6567 0 R +/Annots [ 6590 0 R 6591 0 R 6593 0 R ] >> endobj -6250 0 obj << -/D [6247 0 R /XYZ 85.039 678.053 null] +6590 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 293.982 359.578 305.975] +/Subtype/Link/A<> >> endobj -6251 0 obj << -/D [6247 0 R /XYZ 85.039 678.053 null] +6591 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 266.884 239.307 278.877] +/Subtype/Link/A<> >> endobj -2038 0 obj << -/D [6247 0 R /XYZ 85.039 620.019 null] +6593 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [228.286 103.008 421.369 114.698] +/Subtype/Link/A<> >> endobj -6252 0 obj << -/D [6247 0 R /XYZ 85.039 585.876 null] +6589 0 obj << +/D [6587 0 R /XYZ 85.039 781.388 null] >> endobj -6253 0 obj << -/D [6247 0 R /XYZ 85.039 353.217 null] +2110 0 obj << +/D [6587 0 R /XYZ 85.039 252.615 null] >> endobj -6254 0 obj << -/D [6247 0 R /XYZ 85.039 353.217 null] +6592 0 obj << +/D [6587 0 R /XYZ 85.039 218.172 null] >> endobj -6246 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R >> +6586 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F41 3054 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6257 0 obj << -/Length 1447 +6596 0 obj << +/Length 2893 /Filter /FlateDecode >> stream -xÚÕXßoÛ6~÷_¡GˆeI”l©@ÒÙ\ É¶ºØC[´DÛDdÑ¥¸þïwÇ£d9vš®Ý†ER¼;Þ}w÷‰Tàøð/p’ØóYêL“ÀcIâd›ï¬`å—A`%FVdÔ“y>Œ¯ã‰ø^ê§Î|y°{QÌœyþÞ}ñëÕoóW GŒ17 ¼áh:MÜ?‡;Ž÷æùìæå3Z}÷öB÷öš¼¼}s5»¡ñÕ0LܨòâöÝÍüíðãüõàÕ¼s°ÛœIѻσ÷}'‡H^|¥‰³ƒ±ï°¼€{^1;/o¿w¦h-rHë1K¼8a§h°¸‡Fà‡^ΔM¼4Ž ¢ä‹B Gq»—ôg/43¾úÊ£`êIèŒ"æMØÔ(_“ÈULÝ%@Xoqf¯ A‡Œ›CŒ&±Ð£›¸óu&æ'®±Ê­ÖJˆ2 +‚ë®PöôˆŒÖí²\ÑA ¶ð@ÇVÝ’ÖVXejÁ­·mš ®[Ü@pÛÀNa@Ôs‰²^»N=?¥Õ¹q!òÝ1ù˜·|ãaÑ—¦¥`éƒD•<„“EÛ=´r”|ê–Ra WèùŽ¦]C™pÔ´Ôu4jefGa`ÕôLÚí9ýÙð²ì·ìIIØÈ‚WÇNœoÍ)œ(C.Z‹XQä¾A¬£) Õ¢4îÜ‘tŸƒ€D–vß?ŽÀ‹áÀ­/ˆ Ò‡þ¶ŸRNþ ¢'ûendstream +xÚ…YIs㺾ϯpr U5â×\R³§^žg¦b¥æÉi‰1=.ö(•ŸÞQýR®2±4€F/_wCê&€?u“Å~ ó›4S¾Î²›mó*¸ÙÁÌçWJ(¢XûqA{armg×IèQºDܬuæGq‚“ï6¯Þ| +ƒ›0ð“DßlˆhSüÓ µ¿ZÇqà݇•òÆrµV^³Zë$ñL[`#õÞn·ÝÔŽÜù¶ÒÊëê +¨·U9¬þµùåÕÇÍüÜÈTöOQçi³¯†Ü1ò¶«0óöæà8ëq\{ÃÔ4¦¯þCcB;ë`|‚~ßó òZÜj”壅²{à¡Ç¶C‚çº,v2UØ¥¸Gõ„ÓÔ-xÅnß5L{X­ÃÔ+û º¦LÍd‡ÞlÇj+{¢HA`( …*Ìé¸ÎOOçƒøxwhÝ™'ïq[I½ÆT5rÕ®†‘g† ɈmJºÖ2d E‘÷Ž.Üw}Ékœt'Z€·Ÿ€s¸ @‚‚/ß´£ƲàÁªåýC ”÷zá–åI„ýÏH¹ó#PºëGÙ›™e»l¹Û˜¢äÖØñ÷iƒ‰Ö2Jê¤É½4*äâÁqD{ïD‰-H" +sïû~®aZ˜{÷+Pp¸µˆK/.HcϨ3,ÜtÂÃÉɨøÔ…¥µñ¸nÚím59`'º¸…4Õ(ß¿‡žwF> »±©ÙüüŸŒs? ^rÊ0÷u¢æ@¡"_GÉP(„Š(÷>­tà•fœzëghñ®lKÐiDâða ŸRð|õûXpÒÚ¡J½[èßqó;Þ¾-œï <üeƒßÌ}ðÀ3ŠÊ à@_òd×™Øb4Ô—uiH¨enžƒMÕV6`Ž=±Õõ²`×-ù¢½™N"¹Ô@«Í®ü3d{Ÿ)Œ¢·j°„oÈ%{ëÀ«L/Ë ~4œã %%5 ýíI»?À– ÅÍžDäÉ­i¹qRÖ\(w°Fçà5)Ê ¸\F[Ïé†Ñ²¶˜ @ +3™ºÆÓ³˜/6É›d‰¤h‡êO‰ÐBM€M#Ó[Oæø”è58A^'›Ž½X¨†`+iÇhs¹,ƒ3ò☠¿—†„ëÁ~2õÛ­À•Ï}¨œü¶lDOí¹j§Zî<üõsjïßb/E_ÿü H¿ZGNƒ6®q²º>³1[4cJZ¶!‹\lH¡'q¨X-…l*|’˜a'P> ¸_‚ÜÚ»¾ÅÎ(Ò`}6EÁ;ŸÂÀüªºI\ZŒç*Ц$ò:´yø²²Xã,‰íö­©ÉP€dœi@†·ž/ƒŽ—ùãžåž…¦k‰œ¥ºÄÉNе/w¦/뀌¢ØkÈÝ[©âÄH¹ +o1Ϲ(…%š}Ùp«"¬ % {‡à4/pS†'²Û®mfî±ο G;FÄœÈ#ý¹m½Ú„…Ç%ä 8¨p»zj„h¨Ú­4HY‰”º†ùL(H@Ü[ôAbÉò„쮆ç  ä%Mƒ<ÜA§Ç¯düÒË[ðq½LÏj@§,Ü ‹VÒ2ì ÕX’¾1Õ…ÔKQœq.h#Æzs:|rÈGxç$JÆ»ŽÂÌoS)ÎF¢$s=å¤v#*™‰5AÝ@dÇ3²Åjø–?è\]µúƒw?N–·Ñe“h· LXU Áر¿’Ø¢„pWÛÂV×wµLž*`t²¡¶”‚ÅýHgü§-Gv âv…¤D³­«Òéè»þk{®AE×^ð¯Îi%nZs·-Ÿçãᵿáà…†¡ö~ó) gu‹ÒÚO³Pª—²ÀÂMðgÇägeN¤üP§B=J@ ){TCNsä1É5É°:›Q!`=A›«+!$¡ì¸—¹OªFâØÄVKUÝÅý Iq­ÒØT~ž¸ÔÂf«”‰ëéq=~9±êžLgþL!Z¯Ú…Ú¸pþáÞwæ~½Tö†Qâ§iòÒ™ò#ÐÕÿ«{C©{ß÷¥]νãjו½·¦5»ùÌÝëæìÑŒ¢4aÅÒ»Y–“¿Äjì+þ~­üvödE*ÄŒ¿I™,¡19D­ \ðd@̆äI@¶ÚNµé9 Òqß %7ºZrHR Ä©¦4›ÀÂÒ³­é97gùY˜F\?"ÑrJ©ÊlÉJíTîåñk æŠI' 2'Î0¸’óyÂI%¦ä€œ£°¢Òg¹Š<8¤…B=˜¢'.Ýi¿=´}覺à®sYâ§6[Wl¹×ÞÀ¦¾ÐþòqóëWL5¿~¹ŽeÞê‡H§\lê„ +mè~胞ƒCïÏA¹.{°â4Ž¼·ƒ¼pÈy¸pk“¾j–@ðTÝí9ŒÝ¬ãž«ï }ŽÑòŠ’ÌÜ©P`µ¬°càQ…\¡•Úѵlåô¸[Œ>P HÈűS°nw¥ÐãÁìÆœÞwX™€„ˆAãÀKÒ ¤þ3üL]¹ç!,wâľc™»:´užÁñŠoÜäIî9ù~m˜¿–É©Æ·õ9§ƒÄœÐåˆ-ÏgY¨€ÛÅH\ÅPÓ†\Ì\ÅqÜjgŸ¨Ü„ÍÎߣÈ8(C઼YŽÚŸVÒšœß t_ãÌå?ßÜ~dÄî)„@‡!Å@žzT‘LTtÀäÉS¡Ã©V]ŸêiŠÞz¼a¨Úðý¾kªÿíë¯ >Q~œeBÉ1ØÇØιçùñ)˜B[B -…p¸Ò€¦Äb@dƒ#fÀ0Ë´ +½-p_.±‡~œäÂË¡«1KñËŸåÛ¡Ÿç–ªk#§ÁpÐìç‹–G¨|SÖÎÔì äÈýT ¾ ¯XV¦·@gQÎ=&[4µ~¤õYÎMoáT¢œÁëy=äÌK‹n`láÆ4}¢ü»¼­N½}M’‰¿‘–²[§~”Çó”ñ2u UæÇ9ÿŒür樣ðrûPG~_üm¿ÿSÍšhendstream endobj -6256 0 obj << +6595 0 obj << /Type /Page -/Contents 6257 0 R -/Resources 6255 0 R +/Contents 6596 0 R +/Resources 6594 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6259 0 R +/Parent 6567 0 R >> endobj -6258 0 obj << -/D [6256 0 R /XYZ 85.039 781.388 null] +6597 0 obj << +/D [6595 0 R /XYZ 85.039 781.388 null] >> endobj -6255 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F62 4047 0 R >> -/ProcSet [ /PDF /Text ] +2114 0 obj << +/D [6595 0 R /XYZ 85.039 761.463 null] >> endobj -6262 0 obj << -/Length 1245 -/Filter /FlateDecode ->> -stream -xÚ½Xmoâ8þίˆ¶÷!‘6ÆŽ $÷éؾܱR_nau:í®ª4 `)$4N–ã~ýÍ؆¦%-}¡§ª0öŒŸ™yfÆ@˜EáYO(­AÀ+^t¨5Íïf,\câ6l>M:Ý3¿o1JBZ“éŽOz>·&É7ûøáÕäô‹ãrÎmÇ û/‡Ù#ÇeöŧÑÅɯZûu|Š‚g_žé“ËóáèBËCÇ ìcwN'Û·®!˜£»í|ûA­2ùÜ¡„‡µ™êEÂ#~›uÖwþÜBi]ÏÒ§ÚÈØX¸œ’ è=M˜O‰O{[Â<ÚB˜±AÂÆE9œÙ¥.°$—?³ÓXÀâ;e½ÖáÀŽ‹W³ºDN¢ -ÕEþÏÏó¬F;nlv"e~#R„qv/ÔÉ<…`úÌî¦D!Ä(t— E  Ä9E#jçišHm_úýÆq½­@<8 -žGù,M K|¯‚V  @gÊQ¢«9ì©O#°ÌLDí -¤ÃrT‹† ê…*tu6ª·Ç¨½@ÏkihŸ‹HäZ®¥rW: --ãȨ²bVQ'Q¢Ñ¨µ""Ê28k#ƒ±ÂtRÐÜíÂ{¥\e˜¤&“€4Ai®·ðè‹œˆw%ò™(Sƒ17ÂcR1AÛ)à]h»mãD¥é9åMt©;Tªâf3&pJ "Ø™VU( õ€•îoÎ?À õ8éó¾bꨥ©ŽD’æ"ó¾ýá·ïÔ§GðÂ–Ø ê*`°e3ÓªÅ0ìÒ°Ëú8ò¾=>}hƒÝ­Ó‘>p\,×¥˜Í+½D‡1:ÔK¸Üû.¼„ |ká\Äe!×ø“F7ÊcÒêZi‡8°(|AgÒÈ©LËŸx_í ù>ÖÕð\ Ȉ€+®o}w?;ía s–W"ÖGÕÞ"Ê£Lðÿ¼pàÃVµŠj¼À¦Lok˜²Ä(ºµ,»™¸éÊ4®KQ­»PËk¸}nDžY<Ž‹`­°Xö]Ø_Fã¡Â®sñSê\_OE)«ëe$åáÝ%"Ê®ñàK|¶T¦ÜЉþî‘õt*b¡¦ׯàóÕÈÛËy!+ÙÈò 'vÃËÖÖ‘IÕZÌ·pèß~Àáÿ›^)ço øE„o!ø!úÀÅZпûHûûîÎaõ&‘·ÝxM¤&Eœµ&ó¢k¯‰­h’¿áíÓ"KåNmýýè/,Âk†ñÐl=˜ÈCöL¯'íñ.½7€‡¦¬9„ïÀדðïÒaf¦Ç©”{¾Åìe\qÜÄy÷¨¯àêZeòҫȤÒì”å=¨f«xýgÞ×-ÏB8%^Øö“þulozL²}Â? ¶?6ð=xl &Î=ú0^ŸÄønÀÿ -· endstream -endobj -6261 0 obj << -/Type /Page -/Contents 6262 0 R -/Resources 6260 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6259 0 R +3187 0 obj << +/D [6595 0 R /XYZ 85.039 653.495 null] >> endobj -6263 0 obj << -/D [6261 0 R /XYZ 85.039 781.388 null] +2118 0 obj << +/D [6595 0 R /XYZ 85.039 571.206 null] >> endobj -6264 0 obj << -/D [6261 0 R /XYZ 85.039 761.463 null] +6598 0 obj << +/D [6595 0 R /XYZ 85.039 531.042 null] >> endobj -6265 0 obj << -/D [6261 0 R /XYZ 85.039 761.463 null] +2122 0 obj << +/D [6595 0 R /XYZ 85.039 257.168 null] >> endobj -6260 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +6599 0 obj << +/D [6595 0 R /XYZ 85.039 212.094 null] +>> endobj +6594 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6268 0 obj << -/Length 2413 +6602 0 obj << +/Length 3219 /Filter /FlateDecode >> stream -xÚÅYmoÛÈþî_! ý@MrI‘ºo>'i}­7vzÜš¤d"¤VY’qüï;oKR¯Ú\‹ áîÎìÌìÎÛ³Š?ñà?I"×S‹Iœø®J’IV_x“5Pþzá ÇLXf#ž..ßEó‰ï¹ o1yX r"7ŒÔä!ÿÕ¹þÛÕÝÃÛÓ™RÊ |w:‹ãÄùyê;7Ó™ï,¼Y¾ù©ïßâ pÞ¿ã…7ïo¯n–<¾š‰s[®ß\>ÜOøéâíCo`¯ŒY u_.~ýÝ›äp’Ÿ.ǪC3þ€øýÚíÏn'(ºnǯWolÇk÷ÌÊš„QiÞ9‚nù½F<Âož0˜NÐظ Ò‡ßÇF‘õŠ‹ÈGñŽä‘™ò=§KËM!W»j1èzŸdíRZæ#ñ¡#ܱkªVìv¬µ(s]´¼`*nÓ+ѱÁe¾”8^ó&­;TS¼²…±Ñõ¶åtžùp¦¹ŸìÄ-5 ìëÈœ’eÍó4ˆ.È×Æz»Ü,îY’òçé,HÙ -ÚÖ¦Øy‚Äw^®;ó{”\£L4.åmtŠœ0iéͦÈÚr³Â [?íÈÅE^H·hvÕ÷°~SÚ²»&ž“ѽ£b ±u×›.v+¬â°äBŽº`â -}xö„±ïFÁYà6°P¨@ ]ÎG¸- ×ØAÕæÖÀ_εÞdU×` Á)N [ÏZ0ðF»•ãA°Gìï åÐ9”Îc)Î ý9géKÓ5þ‹*î‡ÑùÄ|­ÒÙÔ–9Æ53LûµeZËè¾0_Ñ/ÙhÔ3ΑÐfY¸WtßU¤v>VÂ… v0Ú^ÇÌa)¿…,‘yWõ¡ ¢UBÐb.†6îŒÞb•i‹ Îm™0Ò«–§î€zcådi…%—ŸR´ã+þ#û€&)Åkœó §“-TàKú4ø+*ÎeC{Òºbke׶X›ƒ“r˜8‹˜ÁœbiSˆ%#†Ñ$²´O©0S-Ä`½µá”ò¾z¨^]\ãC•ìƒÁœìZê–½•UÁÍ»h~8á›@Z Ϻf`!Ï„þÎ#ÚwCOY1ÔâxæÍÐ%ç´Y–}u» ËhæcuûÀµa1Àï‡Á¼0Qo°’ËDŠo4wÒ²‚Á»Œ·‹h¹lqÀõ°Þît’Û®RÓ× Y¿ÂÊF*FÞ|°«CpMç©Áþ‰ë5tšC÷§™Ã8(SX<ôlyVóP[Ë)ð‘ù„^$”`‘—bxá ëwµPâå‘ 4´±dЉ?)A¾›&!Ý#ò5]†÷=²;adÙ›®™ôH¤cÁ¿‚È.¡—c{‡·•í‘a˜ Ñÿs¢$«Ãx@0¾æOE6š‘fÎtì±~%àãKK[*ðk& Î’mšEöjÛ»çP›ƒ$çfŒ@Õô@ þýsiá ÌÆH@`Quˆqî‡÷÷`ŽÅÄÈËë9µR쪸Î2xžºï< ûJh# fŠ1†®m»CŽZ›c~“zVk)^T¯¡d-1îmû“Þw‡AsuË“uj ^Ó!·ì«{(/=Wpоö ŠÒP÷OÉSÔ"7 Ï·ÐÏéÒh™^«çöÅq_ãÑê8ÖH˜)ˆáÆBÀ6¼€ÁÄP¼‚BCÐß7od¥ÕüåÅ}e.¤R¾(F·V[.zÓjM—]RÀ3úAØûÂRÈ×8ÈmÖŽrŒ ;ö«G<”´ÊGI,€KŸ88_Òm¬!éGÔ¹U¼UI4׃)ôˆ‰g,VLlb×#½ÃÅ€ƒ—>$àÒ›–éu:bî -ÊDæBfžÐîA‰ Ô› Yéñ3‚o#ª‚õÑÑ9a^',„‚Ê\6i&HÁŠ¥`0Ñ»xÍ8^YM¢_ÓögìÅ’›Ò…!™{pl;k)†a¥M}ê-V6~S'Ÿ´œVŽýù"~†0üÛ]L~*é“ÄõçêÀr:å…経?£­Oø=uGó}¤îš~¾0ñ¦ÄDçf0îŸÉ™4Êùy%WqÉ…I½ÓxoÎkEÃÓnE~ú¹»*‡Á?P¡0gš¯ò¢ äžÒB.|PÛÇM#ˆœ_Ã`áa$TzÍ €ÊZ¾ð–í@ø‚æ°y CÞÉN"—H¹$Ènþu,<,¨‡ÞkôHïQ’…ƒlo(ÑŽß ‡4g©Î| }$ÙGÏÓ»7×åtÍðeƒ°2F;ù<ôÜàhàÁ_¾Üÿê¿è†ß””›¨ÑøÖ<œ -ü}{íåüo 9Ëendstream +xÚ¥ÉnÛHöî¯æ24ТY,®—ÒŽãNO¼L¬ h¤s(K”D˜"=$ÇÀ|ü¼­Š”E»øÀZ^U½}“Õ,€?5Ëb?Ðù,Í”¯³l¶Ü³ ì\ž(f‘$1nýº89û'3øyÏkY¬¾y翽»]\|>k­½Pû§ó4ͼ»Såýq·¸¸âõw×ïepfÞùùÍ—ë.DÞ-Þ|úx~:WÞÇ ˜Ü~_ü~r±a1ü(шƿO¾}f+Àô÷“À×y6{‚qà«<ŸíN¢Xûq¤e^ÜüËÝÂ{ÑŒOM;·søY9ªU »<³$4Š®“9ª?è…åaK:ûŒ6…,Ž´wñÂy*ïÙ¾óÄ$Œë“Ê%8¶üí ÇÒº©šÍó¦­› …Œžtg#œ‰w¦qS!Q€v»¯¬ûïd뵫@¦Ñ"¡ƒP0>VÛkž"œtWìšVn]6„û#9‡Ÿ‚žÓLwçpòXúÈö4gˆnm̃˜M ´,ežÿo ÑiµD—_P ¦à†5›<ãŠß)äŒATyÉ´ BÃ×92œþþöÅ#ÏXG‰1¦]ÉË÷{Ön(w¢ p+Ñj8IAnìzLeÕoÆ9o5»â5mÀ‚‰átfÓZIÙ z»diúör”]ð+í0(@óyòç÷¦} ·ÁŒ<#B8mÓC$#†,Èô%ƒfl‘æTÈ&lµ êâ¬M t.Bi*'ï²ÀX¤£”@ÊŽ¿ˆQ¹ÙVÏråê.Ð…æ^â¡ÞLp±- Ê$•‰µ·r¹Ü³ÄÕ8ñ„¸Ñ8ñLY¹§pgÝ¢%àÈy«©pû×Ó,bŽ ŽÅŠ‰GJ{yßÉrŠ%bx‘œ‚Ãð“²G•@$Í9±Äv#Ÿ/ßH#?î«/j;"}KZ‹B­ +Á™]=Ýáig—·§GÒBö‘oˆ) ^À)‰ìa:‚_È‘^R7Wyæg:µoL¤ÍÚ2̬ÞÌ–_ˆHœ">*"ʬˆ†È„. v±-Z5nÀ'*Ónd…˜‡&¿C#w>ƒ¼$‚¢àw¤Q¸Ë'î[naD`&+­ý,IM~EÊ ˜HØORÖݲ㠹Zr4 Xg!˜À™žW‰XòºûjÅ7™Š9À#ß—Ze²V„Þ׫quÁn±¡Câȉ‰!úñÈkŸGÏ‚Ÿ]"É[§pˆ²¥g+o¾‘7Ûð=¡çëJŠsà% Õ?•Ž.ÛfÏ.W¬Ö.I]•÷·)7ù•2ÌW¸¯©ªƒ0d ¾†?÷miyƒIPÞ¤ìœÐ鎈[OÎò·|ºãZðl[T¡ÖûŠÁë¦gL½ (õb+€ÄÌuÓîÄ=!ð8öÀ#+ >téXtt>FŽbméTƒÎ²ô?Ì»gâÝ^b-é%^\+ÿت­Rg±¯t8]úƒ¿ñuš8ÃÆ‚Jù9b56Ôû¡Ï(àDcɃo‚Œ £A‰òŸgW8L@ÒTV‘BaWú¡Ÿ¿Ö‹€’ÌWqü¶§ùƒ2–=ªo6„<øÙ(É]!¬åà ú‰3§ŸÏ<¿`óoZ¹´á/ÛUÏ“½œ½¤ïnÂÙ¨p“´)jmšMUŽ¸Î¬åƒš|¤ä6†Z¯æs:LØù ÞmŠR!kmÉ……©xaL¨drܪàõ—|Äç¸G[ì–èÚÊæ%aÄÔ{8²ã2U§9ø‘pß@]~ÖÝCÙŸI$äý±3‚úÃ`öé6$¤…l®üD'£: ðcÝõ)Ž Øö\×ÅÑà2H½7¼hY‡ãwÎ>sæÖv°M äÀζbvŠ†Ãt5*zhOâ¼ QÔ<"`‰î Û†mꉎÇ\¨óä7ƒM4É÷––îa‚1±òÁùVø²6öÈ_:òZ©”«A22œ‰Ù¸òÌ˨¿+òµÔ/4 ü.GÞPz!¸løs”ŠÊ}ã6H 1˜ã„„:©ˆ™ÓmMž·èW’8çp z±ï\c†P™0ã#‹4¤ÔgÍ´Fû‘²ºw”Ä`-ïLsë¾û«® vƒb©£PÈl8_¢B›°!Æ%Kj=½å€Vð%âÊ$í¬”K Ãp^ÊãWLMøQj[“o÷• ¸ØΣ"7µôeÌ»ÀE˜„= .'——qf ¥Ke–ä÷aÌéo&‰ ,ˆ#kzžrzÈûÜ_wUªýDYÿóíúbñéæòæúûØÇ̲ÛB@Æ ‚áGyá(êu2®¤ðû² Cm³”ôBjÕluWq]5u Œ> endobj -6269 0 obj << -/D [6267 0 R /XYZ 85.039 781.388 null] +6604 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [413.664 584.796 539.579 596.486] +/Subtype/Link/A<> >> endobj -2042 0 obj << -/D [6267 0 R /XYZ 85.039 471.52 null] +6605 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 571.247 216.819 582.936] +/Subtype/Link/A<> >> endobj -6270 0 obj << -/D [6267 0 R /XYZ 85.039 431.356 null] +6603 0 obj << +/D [6601 0 R /XYZ 85.039 781.388 null] >> endobj -2046 0 obj << -/D [6267 0 R /XYZ 85.039 345.05 null] +2126 0 obj << +/D [6601 0 R /XYZ 85.039 489.232 null] >> endobj -6271 0 obj << -/D [6267 0 R /XYZ 85.039 304.886 null] +6606 0 obj << +/D [6601 0 R /XYZ 85.039 453.822 null] >> endobj -6266 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> +6600 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F59 3455 0 R /F20 3021 0 R /F38 3057 0 R /F35 3036 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6274 0 obj << -/Length 867 -/Filter /FlateDecode ->> -stream -xÚ¥U]oÚ0}ϯðc×ß±÷Ö–n£ÚB7RmÓÖ -”F‚¤ a]ÿý–nÒ*$°ï=¾>>÷ØpÂàÉՔIGRË©´–L–#sȼx‹HZHÒÁœäÑÑ;mgÔ1Gò›]M•–$ŸþˆO?_äg_z‰”2œö’4µñ×½„ÇÙÉ ë¿ ÙËÑD<|ýá§ãAÆÇ=aãS\r:¼ÌòQï*?Îò-ÁíÖ@Æ!»ûèÇ#S8ÉyĨt–<À˜Qéeô¨V²/¢Qôy[*ä «‰±A$ÜQ'ôß3œ*#·‚ Èrê´î -¦ÕLyÁ@£”‚<(•Ö,ÎF§}À¤ñE]]/fKœPP²xÜ“<®KT¥€%åü%U”¥p4XrÒ¯€&é0mË&ºž)·ûÀ…£&ÕÄh28Oµ_õ¡Mœ!ÛaŽ¯Kà?a¨‘ãì{ÀMŠz²^®0ÕŒ±ÉÌUÈÖ°lµÛÔåÆËÕd@{ä„¢ÎØS•¡žßá1ŒWaW´œÐi‹ÑñFoXLÂèæ(³ª-þP”×EyˆC"¹¤ÂžoTP¨Xá•W aP™¢œÓ§}UNS® éXåÿ}‡Öæ,% ó}zÕUØ31OõÎúùS© h><÷à&(dÄž…¨áÏÙ-&³lƒAñ”uÞÐÊ¿ç!„ýÃßæv—ÙàÛÑG€ÀÓºþbÐôÆûpùÞH4Øii—Ï~!~AHµÆmn `öuûçúCnxyËTØÚÚ—˜4‹G<ô@ÀÚw¤*2®ækŸB¡ã¢Á_®Z@x&Þ$Ì^ƒG=;ŒÞÁ|»ò>.®Þfš*Àë™ÏU‹Í¡09`µÄøØ?«!Š$> +stream +xÚµZYsÛÈ~ׯPå%`Ê„q̘¼9^yí][rVL9Îz ¤ÇÊú÷ék€! y·’J¹Êœé¹zzúøº¡ð2€áe¦ý 6—iúq–]®÷ÁåF¾¿eFp©ü Ñ8ô·ÕÅË7:¹ ßærµ¥)«ÍÏÞë·¯>®®~Z,ã8ö¢Ø_,Ó4ón¡÷ùvuõ鯮¿“Æ"ʼׯoþq½B‚ò>ÂÄ›÷ï^/–¡÷î +:·‹_V?\\­.–ÊWIŒlüzñó/Áå8ýá"ðc“]>B;ðCc.÷JǾV±ô«‹Û‹¿»ð˜ºäU3—]ÚËÐø&ÒóY¢´E9ŠvERˆ|¸ +ü·Ô:ð>•Ð©7Í"¼Çî¤Þ?ôÔoÜãÀSUàH^SÁ@¹~bÒ›²*º¹D~ü,£qègáÄh¨gÞnµÈb¯3‚È[#?-œZ`#ï &7-ÿuƒLõÈÈË7±»a.¥²kݯ›z[îüÜ‚æžÂÜHÉÜ'Ô‡fà3öغž{CG,Ä^/¼ÎáÖr‰ìþ†‹¤G³>Ò–,?$?1ukƒÑ7í f+‰¶¢@û©²w8À"¸|UÀØ£÷‹¯ÅÌ]´ñS0^óʼÇ{8X¸Çù V N:AsP½ Í,A T¬½²~ˆIdwؤ+ï±ìï¹u½R샿|ÖjBÒ܈L›?–UÅ­º±¤ðÁû¹××t{Q¶0ae³— iÓõ"2^OÏâNŒòÞŠxðvg¼¨8%Š»} B…:Ûß[î{ðmáØÇxd­ÅÇ­™Š óÃù«žxXø„wÃ&R#³óÚ^NÍ<ý‰]ùvJ”úDœò™cÀ‹Á<à¹ÕxEëIäxžs: +­Ã™ñÄ~X'¶nö{à(ßìçv°•E23¯çxŠ"?Ê,Oe]÷Ïì¥C‡ˆïYm$– ñÄ 3=vMêAD™Ú7,¢Ãè"vþÔ…Û™a5Làâ‰*y†Ï¥Š´³£$íÝüüŠŠÍ<—ö³Ô·þë—0V$ l”õv.ìÅ~˜YAŽ´-ÈLÀòŸP‡Pñ# +"TSf†]§ +=ˆ¯&Ö¤qGQ$oŸ¸+­Š¼9¾¦°Ã кŠ=ïHVÆ%ôMµá¸F$»vÞ8®ñ±ì +±g¥á1܇×t;‚~΄š< »è +Ù|b:J(Ñ%nŠÚÿÓŒ5­ðâQ–ZXž6%d…dtQ–Œ>¿´1ö‰éhY(l—ÿæ9§F¨SXˆ‘ Ómä@w‡„Þ²rì[˵ÉÕçô–¼"æŸ/Ðæ¨Såý¸B¦nñ^­ÜerUæ‚.¾?@+˜‰¨çkßæëžGFŸ©"R|è±g…þ`C4Ý7ƒ‘BÀ;ÆX÷Ó|[zçâ÷3}¨ó=쯃Ô{ùuÆ Â¶'Ĥ4ˆ¬yÿçnæHøQjÚu¯ºC’—>‰Îñùs H%³Êz¯¾†‹ +iA @N /†‡‹uæ%9‚yˆ¤~H™Ã™Ú ç¡7‡3Ã8ó“(ü/p¦rpf¢0,!"§C{ËTÞMŠì­K€ñvé×þ€ü2¸‡Ùc`åŽÐqZËdUĵ´å=ÅÆJ¶³À„]…É …Ô®«(Xé$kùÀþ†ô« +‘€J8N¹”a0ņ[bÀ]W2â BŽ'"“)  ª†8wÉ¥#Åm +º!€Š„Äó8Z‡x70š°Æ˜Tå˜yb‚»“ŠCÇ +ÃÞù|â^³å_~/ƒAèÚƒ~5 ½W €ïÏàø(ëŠH48RÉ›3º'ŠY|†vttìý«h&½ÚìÉäKèè¼]~“¾“«æÏ5¸Ï²T.ü8‰ }þäœÇ7"ú¶ŒŽ³?Œš¨¬ÀÛž2”™œ7†üQGÏd½'Üôü,ëÒómZï§bw'ÌLÆÇ“Uo¼ú|j8QPØ(1Vóûu=°×t¾ª'#߶²÷7¯_½?e¢p'¼ôÿzú.y¾}w}%bmEX׸,®OŽß<Ê|&Go>pR]b¦n¸‡ é’[Á‡Ã‘gL +Ão¨àn8à’‡šƒkÍÝ\†{²’^r +¶|Ù£8Nª™Lçf|¸C7rQ6Cç,¡‚söëPÔk„qÂF˜YÎÄ PÛ"Ç8¢ +."™Ñ? cÛ±ç̹ÖÉÇqÁzwt/Y‡¦Ø$H¡µ-¶CÅ[˜Â¹(¤Ù<ÂFƒY?…šæ²u‡¯ó]ñ­*Í9[F:y±˜átG¸Ç\B²PÎÂë¤hßšðAV™ôÕÀc©¸åR6VÇœBxâEAðõå?‘Rÿn›-䣶HˆÁb,Œ‡6Ÿ+Ÿ©‡›Ì<_µþ½xL˜šõÀ“T`±Ñ=± +!vÄþhËQ[œW„tœ"E—²±5‚Š•ˆÂÆ’.ŸÆx{æ÷9kc_´rRÇ`° šSÖrfÃÛbqÆ|@Û»–4ò0—=²ýƒu#.Á¸>Q0¦³¥=æêŒ[bîœD˜)ÎR> Èۤͅ 9Z9’äc&ãAÚ RB²[÷ÅèN FäÝN=·rÒ¹NÓ€˜êñô¨Ò‘[²9qí[èã5Ïô–±žä ëÊV¾d”´†‘ïqQûâQ\pÿdNà*\Áa8,Àä:ÐÄVy†®Å+ç“ÏÚ ;6|°b1±e÷†‡ ëš`|àÉFðjBy½`T;îUã%R±zð.N¡&Ìåà*#¯V] +»N˱ÚbM2Ÿ»’G?ÙªeǾaŠ<'´æฎŽ¬Þ´(Õ æbîÊf,¤T¶°kµj®t²è,±Ráã@8óEîù@ðé¨ ‡8@%?ß µä`GÑ„5€¢I>¥‚{ÉÖl:Wrý€ÏsÌŸ½™³ç;l][ä[›ËO0ecs¿3àÚKaµÚì8mr5Ï~ˆ FX»ÚO¾Œ E ÷ÁYXUiy§³bªlÔÛ¹ù}‡á qá€J=‰…=w~[Sùˆgð s;´îvq¬Ñ•H½s7´Tp…EQž¥¨·T¯“’ ÑÞ±j!°¦Â PI•ì i'`¥)oG±‡ô +ég™2'àøÙr²·œ*Ö©'»§‚ýTÀc¬Ëâùx`Nèñ;-Õ +nÝQL‡ÍƪY÷Ð7¨`•øÈe½æ“j0oe÷9©6á¢f;— Çô&ÖB>ÀcèH{ß5ëa_Ô}7ÿD%çI²ð«ˆ·³Ï'¬ˆñ[ËL[h䞥Òu¬å‰GæØ£’êÔ›CÇåN(©ýþ‚M†,R.!_JUÖŒ_ èc*0Ÿ¦'Ë[&UëÔ‰ ü‡3}ÞörÈäd¼!Õ 5VyGúNR +ØÊ圚À4¶EÞí´wÙMÕâ³ÊËYFb$±1˜‘<ŒIœÁº_:Öý(¶V2r ÓìYtUW[é° g?à±›ê)N"XˆáÚÉe(IE]þ¨%§M¥£ÓÆÌXÙpnz/ÁÊgJ¶Ï}»ýI‚Ýy9ŒÍ8U·÷$9)¿%É9ž á?oÈ÷™f¾jšÈ×Aö‡ËK©û=ÐÓIØ E?8ž!597†€;Ji¡K +ëÇñë«Õr.ãR™¡j>çÿo·§~8}°ýfú‰Ï)‹!8}8qüàÀ…endstream endobj -6273 0 obj << +6609 0 obj << /Type /Page -/Contents 6274 0 R -/Resources 6272 0 R +/Contents 6610 0 R +/Resources 6608 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6259 0 R +/Parent 6607 0 R >> endobj -6275 0 obj << -/D [6273 0 R /XYZ 85.039 781.388 null] +6611 0 obj << +/D [6609 0 R /XYZ 85.039 781.388 null] >> endobj -2050 0 obj << -/D [6273 0 R /XYZ 85.039 761.463 null] +2130 0 obj << +/D [6609 0 R /XYZ 85.039 761.463 null] >> endobj -6276 0 obj << -/D [6273 0 R /XYZ 85.039 741.134 null] +6612 0 obj << +/D [6609 0 R /XYZ 85.039 741.134 null] >> endobj -6272 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F62 4047 0 R >> -/XObject << /Im1 4096 0 R >> +2134 0 obj << +/D [6609 0 R /XYZ 85.039 484.308 null] +>> endobj +6613 0 obj << +/D [6609 0 R /XYZ 85.039 448.043 null] +>> endobj +2138 0 obj << +/D [6609 0 R /XYZ 85.039 340.055 null] +>> endobj +6614 0 obj << +/D [6609 0 R /XYZ 85.039 302.524 null] +>> endobj +6608 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F62 4159 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6279 0 obj << -/Length 1950 +6617 0 obj << +/Length 3251 /Filter /FlateDecode >> stream -xÚ•X[oÛ6~ï¯ð[d fDQ×¾ í–j·+°í±i[ˆ$’’6ÿ~çBʲ#gXytnüÎwÈÈYr–'"TÅ,Ë¥Py>[ׯÂÙV~}%Dœ(‘Ä1Œ'~u‘F"Œ³Igc‘ÉB¨X¢Ì»Õ«ë÷Q8‹B‘¦j¶ÚzGÒ<yžÌV›¿‚(óE’„ÁÛÍ£nÖf3_¨4 >š~®Âà;þع’A{Ï ·sèf¾€ß Žj4ýüŸÕ¯nVƒOÞZ–Š<}Ùë‘ y-“™ Ec¯U(b“׫}ÙÍQZ:`ÖøÛƒ¥mx~cá™´ð0GQ®™GyлOðÈÓ–Xß›VW<_vÿŠÂsâý^÷<Ò-/E$gËs»Öøå²fÍÅzL*‹ö–ׯ¸Go¾ÏIôÞ©ÞÔ%®—¨Õ½m;Ì-¤l! åàûô©L±Í¡ñ ~çÁ™ÖâÒ#þžlŒ7±—÷<ß2k1ôvMÂq ×kNCÇïk˦ð;[½†É\Ql*‹ýÐÛZ÷ÎN¿wƒ‡ŽT´,ÄÛðX¶C­i‰u’6ÐÒl&&JñVê{";eËêä@ÑYÎûÙ¾¯8í8KuWšV\m’ ³ôEÐŽd|©ÉŠ/6I¡Š¡Ô$[\ï±®0­G˜JS -›ŠìiÌß¡Œ Ý%ê]<Ê\¬«Df".¹øi‹u²ˆ%€vÏi‹el˜à—r›é`Œ›HuFb2¸£Ê;C¸qõGJ5 zèâw<7Mœ÷˜AdÚ¦6ñû³úÞT•³w8 Þ®K€ç†çmã\&÷AÍsЂéÐ\˜§â°ôê-ZÒKàÜŽ3ªP{ý>ÉG¹—Q,òl¡ -£ê{Tã@Gi@ï{\"ºÝu¬æd “\ÄÔ6¨>p«´s² -„à…S4æêhŸ"öCâÃóŒ£Ûí‰ð¨ì¨bKûÐUOó<ÎišoYŽ->Q2W"Jã“dHz˜dÄœq’ƻį§¸w2ž1sš1 -¯«³n@Oô âÂ_ë;L&PßCNÁµµíMåk‡ -ìuNÇí’—þÄ44âYò–Ò:°¨PAÂ#¬¨Ã@´˜ƒ0âýám?Sð*Ò­mk6BÂþi 'àÓÞÍnùyÌ/¥th8@­ÆËjožü¤‹ƇJ¯‡}£rÜí0w= -$Ð+Û.²=Ÿ¤& -Áù ;uèMËu 0,8uù¦@`v0¾}æαé\jáq‹pú¸=ôÇ‘ÌÅg‘E™oá‘k០R÷ë¥iMË㷔Śøö\âA i„pk› Îz#/9;’!gOŠ×£àL¥äìohI%|VIüŽ,Ø™žß¯¾tä5òšn€ãÚ+^àMF ðyIY&~aéœ/´ î#Ê৉þtZKªf:WìM‘Ñ¡Â6WÜp¢1 G_ÞÃñþkW1O`þ¹‰¼æ“ÊÞ³2Yp*œA¿8öC*\˜ôÊ· ŽßÖnÙtWΔëï§TwµvÌË„ëÛcSa L¡t)U­†§ç4B§k´LÿRð·gŒÈ _Ï!‡sr8ÈQ ÛvWì„¿#‘¾Ëì4¡ŸØ çuëâÔüÿ8ë²ZL”ÈpxŠÓ"ضèO ׄ[¿­üúXj'vàÉ-ñëgLps"¸7I‘ÅaÐI/Fâ<Óù¿0¸üüuõéÓ‡†iEªN -ü†92Ši¢"p=ËE˜œˆ\>„"*¦á -§3‘Â"‹ [*Rçn%* 8?è9·ø/Öó endstream +xÚ½ksã¶ñ»…>R3 ÁW3“Ç縗úÕX—6“äO¢,æ(R!©ó¹Óß}$%úÚiÒŽ?‹Ýža5óàOÍ’Ðõ‚t'Ê ’d¶Úy³'X¹>SáÍ´ëE!.}³<{ómÍ”ç¦^:[nd¹þɹüóÅÃòêûù"ÇÜù"Žçq®œ—W·<q÷Vs?q./ïßß-qB;xóîr¾Pλ+øxœÿ²üîìj9 b¡]HÆog?ýâÍÖ@éwgž¤ÉìÆž«Òt¶;Óaà†:ïòìñì¯ ¯éïš`va ç&‰¶\«p‚ë›ûë{ ö˜Ð¡Ón³&ça]á¯v:XÝÊÜÛz—2 ‚®©Ë@rä»A‹žá]0èß`rÖ5Â?·Œ +Ŧ͇6ox:g¤y#`™ üˆ'ÛÑøWbgŸµíóܺY£ÀQÊ +ùO‰½¬Z\9Œ ÌWøÓ1AGm™ø ŠBaà+:† jžyÆ]¬ð¼-ÏöûåP?‘àÛs‚!˜¬ëòîÞÏñlZe¬ð›}DŽ…(3¢1†(óÌ5$Á'Ù²è’;ez÷øïŠØn[‘˜Ö±¥Xû¡C'!ÙÁðS$—v™° ‹k§!¨lÍâC(¤xóm0T.& ´‹ŠÝ-AW6Å“ûpÃÀ#MŒ7 ìÏžÒeO߆8ÙõgÑàÍk‰š{Çt‰ÚâJ§DmQ8 ?LÜ”%²Vx™•­Xe]Qpuè³úæÍ'º”†çH‰p°c¡® $Ó(=J" ¬à¸ág%ïkò§‚wÈÏ }š‡ åáO¶¢K©rm®¨YgNióé–}ÅïO à´SµÈ-TüØõÀ‘ À±ú@ ïyŸq:×äád:kŽ7yÖƒxÑ }$Î}€Jœå6atG¸O©;žd±Ôvûš§…¿¸mtí´w›Ù} Ü~¬œð}ÔMÆwÒL™íD[Ô@Ë=v6Þ„»R"\ÝÓÕÖ%;‚]'΋J”9o(dc ¼åka×éõ>Ö/Ø!!¿ŸŒ#€é·E“¯`« /:ñ_†R¢Ð`ËyPw[v£²×ÉΑ&°ú[šÀ¾‰&?"Þás(Ò5¯üì…ž=@ì:9+4Vªˆx©I¹Éóå< Qš“­`üø#ÆÙÐá`4ºáÙ Iy7¨JÚU"©â +jP¹&v‘ ñçp&ÕälÅlÞ 2é(3òÐáô-€M½-Ûª×Q¼°0aïd l‘ä4u–&hä¼Q.¶uÛLFÄ”q=cS åÊl0h ûXuEO¨êbv­Á½Öœò΢ W¢WæN®÷°ç•‡ù©Òû}‘½òuhÒ˜ë‡KÔ†sžéõG‹¾Â@daÎÍäÃÖk©-Øäû%z@ ”cÁ)¿–OHÞ@Ý~@ºïoø›Ž„ß}ÅŸYË©=Æ×MJ½g‹%ã…§—ó$pú_’‰àn’ Ì<,Q8cœŠ&§u’$ÁE•…htK¹Ob,?´>iDÌ|R$> %—­%½ªdf-GÞ:«}yÕU)ÈH€%Ïlþ3ÈÌ2’Ö¦¾äN:ì)­òŽ$ÌÛÇù  îêö +ѯ)•¡-#ýÄ%xãbN€ƒNƒÀƒ!±ïlœUÝ_áøÌ€ÿäeº¸ûc¼äpN“-T5‚ͧñž]¦]ëø·¿Ù Y˜<Œ- ¼JŠ§à†ªƒ„T‹ÈÏ8üRCx-Š)ÿ@ÉËŠId¿œêºgÌŽhÊæ‹€è`|J`‘/Gý…oªÌ•˜«Oðê1Â×°/&$Ñòeçöž…‘ ññ>L8€a/rL§“Ôy‡¶(ç–*4NiΣ–-è›!3³H˜`m«d±SmòDŒîä:ÑNÓ€™—ka£äZœK‰¦rÞÔS ×H~œÂfÜ‹I”XX&¼Òà2Ÿ_!wà¼ü͈ ÙCã„l̘!Àª®V‡Æ†ÑMã‹`C¡î1ö(ùx£Dae«‹>CÀÕ‘‰xÖ‘–¿8†PÆ9r•‰Œ‚`šŒr¦4ÆàÞ§p©ñ–0 úeg”¨*Ú2źá]ä±h7i¢|±Vv¼ßxU©Ra†Î1¤°3L NšLgˆ˜™¦ÌRyPÒ(ˆ»šwµÆ_¤pùo‡B +ˆ>ÍÈÃÁŸ}(Hó;¹x\§Æ)˧Ÿ,º-OÜ-õ‰âCô+>À*ŠÖhxø±v_M7e¾vÓ8¶ +ß›hPøë»pFà*ªˆSì*€2íÈv€2{…Ù>²`ªoÊéỞª·ìˆãÇ›¿?0Ä®Jì,òvŠ 7öãWX”«UüåË»ªí8äÆRlĪwv¶´•è(j£0ôi“/ƧÖÔKËÑzÇk&¡ ‚ï+*"9§ˆûo/¥t‚¹¶"û]GY(×<½OSΟ&t5Ô®J'•h40ü¢®ª+N\„¼íeèêðßb¼®%[­GYk2wa¾·NøØõèÀš0ò +ü‹üòQ]6<§éÒ”J ~â¦Z¿ž@eøÄõ‡¦~j²];…‚Qÿ‡x.Ö;ðQhécŒ›ýDáË„”#ŒâÈÐN¨ºò"7µ J¾nR)k['n둶 K—ÛÛKÖ¨–EŠÂj™x˜ «nÙ2„1WÚoIâ/<õ¹à°_Ò|Kêâí'w'> ?f í¹‘þÚëÿáÚû˜Ûž1ÔÔ¦z…k-I"WèÚ¡‚~ŸÈ«ÿàÒ”ãRVòê¢c,èîß‹ñúLz!ß{`°ç¢Ý +@Í3;r9è÷¢¾¡D=3„jŠ§-õr)ŒC}AÉçÇÓ<‚ÐÁõ×’[‹6 Õ†Û‘ÜæBr]ß3>ð̆$`ögWcR9¿öŠsñl•Ôãm¯É²=ŸÐD?öÝD¥½‰îÉtò¦“°}%¸BYÜ/ë\òßë\ð‡ëÜM¾é}kžrÀ|ÓœÞx¯H"iÆï6tqÔÁI#Ls<“€¾LH+J\ßú5ŽÛçö½ANå[¢Ø'ôqÇaš>(ç.æ£ÄÎÀóa^i«R\Ïx£ywQ¢L½vsD =Б‹«è„azzÔé- s]~•AgÓ‚ÿnèÿ›n wB=”E抯Öì†N52îÔ:|¼6Æ*žÂä¹ "+ÓßÃå$¦Ë÷’·Øò?_›þ›Åe séáI¿Í<9b¿R:Wn?†£G‹ ¼Oߎ +J)­°@y¢´¾:À¥z/ŸXmbÒt`¼êû¹Ã|Ø÷ña…›¢O[FcÜ$në›rÄæ²2›Ø¡¬/d}y»â¬~_fݸ¾:Ê´¡0‡b7… +2œÑPåž›f¼@dÿº¦ +FÈüs—WmQWØ”I¹+ã{ôG÷íHBÔò/µòr¼„~6²¯QQxòœ¢X¢é© ¾!©9‰ûù«ÛÚ¶Vžèˆä¾;®#´g|¤$Þ¼£•çøµ0òìKŽ Ûæà"žû5ȹ:°µ ¡°ºË`†ÊYÖùÍ0`ß#öïÄF¸Tâcqs¨{ê¤Ù¸>XÛkÙOš6Äãq¦ì|½£':Ïä·¿Áá¬ítÖÒÙ~amm0I+¤*µ·¹äždU”> endobj -6283 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [268.952 172.675 539.579 184.667] -/Subtype/Link/A<> +6618 0 obj << +/D [6616 0 R /XYZ 85.039 781.388 null] >> endobj -6284 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 161.55 103.217 170.209] -/Subtype/Link/A<> +2142 0 obj << +/D [6616 0 R /XYZ 85.039 475.683 null] >> endobj -6285 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [251.226 118.478 539.579 130.471] -/Subtype/Link/A<> +6619 0 obj << +/D [6616 0 R /XYZ 85.039 440.933 null] >> endobj -6286 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 107.353 103.217 116.012] -/Subtype/Link/A<> +6620 0 obj << +/D [6616 0 R /XYZ 85.039 386.736 null] >> endobj -6280 0 obj << -/D [6278 0 R /XYZ 85.039 781.388 null] +6621 0 obj << +/D [6616 0 R /XYZ 85.039 346.695 null] >> endobj -2054 0 obj << -/D [6278 0 R /XYZ 85.039 761.463 null] +6622 0 obj << +/D [6616 0 R /XYZ 85.039 306.047 null] >> endobj -3123 0 obj << -/D [6278 0 R /XYZ 85.039 653.495 null] +6623 0 obj << +/D [6616 0 R /XYZ 85.039 265.4 null] >> endobj -2058 0 obj << -/D [6278 0 R /XYZ 85.039 586.876 null] +6615 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F62 4159 0 R /F38 3057 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6281 0 obj << -/D [6278 0 R /XYZ 85.039 544.591 null] +6626 0 obj << +/Length 3070 +/Filter /FlateDecode +>> +stream +xÚÕZKsÛȾëWð°Ê„ ž¹ie­â-)+9ÎÖf#$±-óߧ_3I(I•/»å==3==ýøºeæÁ?–F®§²Y’ú®JÓY¾½ðfk˜¹½ð…Û…®G8õÃÓÅåQ<ó=7ó²ÙÓŠXž–¿:×»zxºùy¾PJ9rç‹$IǹïüòøtóéWwoe0RçúúþãÝBçïß¿»ž/|çÝ |<Î{úéâæi$Å"tÃX¡_.~ýÍ›-AÒŸ. —hI´¹ÐŠˆ1!K7Ìrêºmpÿ›ÕÙ‘*<ñ!–ÉÎmA3ÈRÉöç¾bBc™Щbsg +ð™Cäaèå£håð”uIçô@ki“hâRÀ¹¢Á¬®*Œ¥ÃÎn®i¾É3—ÌΙ`»ÛKPåÐ0–I÷üñRš#žÍ[!Ùžw® îÍÍÀ•w&ò£Y⪄‘†|H +¢ïJÑê~´Ç ^Y\ &NLöµažè:Go˜"ɯú†ù×8nö;CQvõ”†hB·Ã½ê¦gb]ä,G1d9ÌSå¸F1ø=ˆ¨˜w`p!À=íÃRs[ÐMq¬ùç踠ßà£àèÅ$v|äµoCë÷h@ ¥hˆ›ÆCÑVHóȳ´©߯jô²XòÞ«W"Ï×9<´&_jcö4ó¶Ù¢?dÝÅÔó·ôÜÕظXÉA4JtAÀ” +÷•XhÕÛ‚Gœƒ‚ñƒÃq—?ªqXòcÃ*0ȱÀ +à Âb>Šaqê&A,¼.o~ÕñoÇæ)òöÅÉ€PaÛ².»L’¬lê.__çh`¡u7hg˜ÈH_‹ HÝ4JÇ1ƒQ¨Á +¨q½¥ˆÐÊl…cãQöu¼ÐÀäÑAÌ0JÁB‚Ô0m9Û£É,Kt™ƒ}\%úÆÁ'¢è(Tˆ²ÏÚb4Üì…îß~îzÊÑÉK”­ådßÿÏ0z ÙfQKû3Zè)Â3ø»gXRl’ãÅÇî V­xÎj¦!<qÑ©uŤ¦]À â(Ô–†ì”žRY訖Ç@1ÜöœWX´½1²›ãŒë_?G¤x[¯Í#œšÍ8®°-µl¯æ]q¼ï NÃáôÐq[–Ô}ŒaÉÍ’p\ÓÎ%C<‚ž°tHî° 0vÎ`¯°É‚$mM Ís–¸'Ë `#ôÁÅA§d™¾rÈOvô@[žé¹û®¨VÔK¤lêg›¼™´ºj’©gÙ)0ŸVTD¼zd¦Û‡{ñ/p5?åHìCr\)pŠÞ©“[=?éôˆÈ7úöÀx9ÊFx9ôÜ M/CÍÁ%yg½ž€×*s“4v¼ª¬³§ÒzhRnÓv’Œz”ÁSË¢ÕÏ•©ó°Q®L¤œ^£ÆTlº›&^JBÔ-^n®Á^ ýóbBÜN:)&µ‡LBnënºÌ<7õSÙ-r#[,5Ãlzã¦âÔŸ–ÉÖSô êyä”qÊ~¶Ä]— é–zƒñ¨f¶œsIg:Ëqh›\Å ‘ P\²•®&Å$X\‚|gvÇý㘫k:r‡±"§Ð¿–š\~uTwáV\Ã\òºQ½NÌ6Meï¼4ÞÝ5ÿ0¯GICI’#h„”T6ˆGöù;>K‹vqÙY`ÌËî¼£Ðw„0ña$ƒDžã[ìôÛ#HƒtN4_) 4õVòÎÄå÷5û Øä8“eR¬éPèQ–ƒ†m¨lÊl@çè? »ÔhÜ•Ë"Á4¸@¸^lÜ#¼ \> endobj -2062 0 obj << -/D [6278 0 R /XYZ 85.039 404.088 null] +6627 0 obj << +/D [6625 0 R /XYZ 85.039 781.388 null] >> endobj -6282 0 obj << -/D [6278 0 R /XYZ 85.039 363.924 null] +2146 0 obj << +/D [6625 0 R /XYZ 85.039 638.742 null] >> endobj -6277 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F35 2976 0 R >> +6628 0 obj << +/D [6625 0 R /XYZ 85.039 599.048 null] +>> endobj +6624 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F59 3455 0 R /F41 3054 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6289 0 obj << -/Length 2710 +6631 0 obj << +/Length 2810 /Filter /FlateDecode >> stream -xÚ¥]OãHò_Í“#ãïØ<܈f—ÝnŽ‰vv÷ÁØba»³¶CÝŸ¿újÛ ÎH§‚nwUW×wW5îÌw‡¶ã'³eìÚ~ϲêÌ™=ä§3W0‚²á|Z]|£™ë؉“ÌVëNh¡?[å¿[×?_}]Ý>̾ï[žgÏËel]Ý̽Øúmuu};w­D ¬{œ¯¾#ø_¿òÚ—9b]áÚO·øq{¿šÿ¹úåìvÕ3Ø Ì$ÈÝ_g¿ÿéÌrä—3Çö“x¶‡¹c»®Î€=; |ù.Ͼý»'Å°`Æ»¦”a0nb'^øc…E®D~¯0 íÑXa¡c‡N@ -ù ¥0H¬UéN¢¥u£Ú—NoùuÖé3À\«‚Uã¬;¥”`i/ÝàÇl8ĦNØÕõìÈa»®6ªãƒ(²Ò~ÂC†ÚÍ‘3oi=Íð—8mZzÍ#ˆºmVþS)„<Ys1D~ÜY‘ð®*:­ã}­.wàºny¥Û ªܤ5|= á5Ì]1hݘc*t³pÁÆ!ÉJD½{Þ€úãÐÊtËêv­òmûØ+rëF3¼ÖOJÅxôѳâÇÈîZ;¼¡zÇúÇõ‰žk}$ÍRvEÅJ0´Ó© +Œ•°ñP%ðÕ±Jp5-S! -ÅmºíƲ Ÿ '„`Gd8ɺâWè¬nhÝÕˆN@ycô,¥ÍêýÖI -ˆû¢,yV+¢˜óW§y/¾IqÇždwÃhZ ®%gºÎÊ]+‚~*£!¸ß è:冷ƒô8ë¤22Qr>+j\äâ¸P«ŽÙj]ë…×ó  WtÓF×&ƒÛ'B8 -;Œ’†ð§Ï4® ÷!y d<”i\ËE †¦t¸Ž£ Y_8ÐTÝqâ0Y°O"ô^I³MQ«É\Ãò æ½ÈŽ£ß+#œ“ù'L`K¬Ød¡µÖ%º»FUï -pÐ|­›*Eçǵ ‹_D”À<ìÞ*g va0ù–V¸é)åÏ*-Jt£ZN)%œ$BBŽp tµmxâóºç_úþeèð×O˜ÂWqßžp¶;L[N@^8!匆}S¼Å„ aÍ)pJì R -ÈXˆYŠ*/:“çdfAПð‡:{BÙ04ÝQÖÒ æªñ…]©m Ãómƒ¼¼ÎQ™œÜ(Îäð4ƒ³Ðñ"ˆ:´å{ñEÆEÆØIë–âIIŒQðúHzÛ`dæ; -qôàœÑF!=ø ƒ@Ô Ï˜·J1ÅLWã˜4çÍUš“kÒµÈ~Ÿý±×‚8oGþ’Äù™i’‡Múªx–ò°×u®šõ®äϲ¨w_´iõ$ðV5¯(9Λ]]耴¿åñëÍ5OÖº9  ¹h¯›—)žîõþ€¹½Þ•¹áãEøÄÀ ª¹€Ì%óÜT'ø‘¥Ûô ¢¤+”ðÖÊÞn“v§ÙØŒ²Aﺶȅx6bG?cÎóCJ‡¼µÖÄd-ž!´¢™`v'ãºáô5ÍÚ†|ƒ83Ê…K~c Ö]ófOëø]=a\¡íYkŽœ!};Rz>¹-‹vc¶íGžÞèÛÁ]šÒ*ê\ïÍQª©Š:-Ç>õñ´Ø'i¾àÎ]Ï;Ã~ÑMØûR´ÌUªz2JIJðÀ ¹†d[©ý4³Ÿn®Ï!D-W†§±vë7}ÙK{-_¾ñø}¬¯Ç¯‡òª:¥"õØÿÙ/O²¦^•ÈQ ‰vÝuFF=Fìt¬‰ÿ“w]a!ŽÒöBý½UM¡êL½‹ñ'£ží¶QY‘vÆÊ—˜£9±¹S‰-¢ó®(/ÇC‰¿„«ªá‰A®òKèú¼ÄºÞ(ª¾^IcŒRF°ÄÎARìž¿u_m -Ý¡f_JùÇlŠ~ã9£®õáþñ#µzmJ±;•ËãÈÚaìÏü ´Ý8â"ͳ`<Œ;?Á^ŒÐ©^9ÈüÇ4QM›®Û^^\ì÷{Î ?q¤‰ÌYƒ¡©¢²Á/.ŽYu£Ðö¼™ï»t«L•S‚²á¼/§ŽèàÁÂtÏn d¼¥í$£*ŒVTXpGS™:6¡ÛÁ)¯#O åî[tzI^èI Ó¬ÓL–0ÊhÜ°9@ݺ =ò@å–Š<Ã’œø~—, õ¢Ît#µ_µ!—ŒïCë·û닇ϟ°FsøBñ¡'orE¼`S¥·7_ òhÆGÇïι|¢L蘑‡v;T'\:R–‚^¨q B„úÖÌÔå€CõnÜÍO¤ ÕQ6A,î8k#÷e.^§d4(Šª‰¿ñ‘×=X߼Ќ -)¥j{¸ É—b"ÿ0²¤}ó#éHqJ­3‚Æ©¿SYOÑœ8ùF¹8ßo d”7žå”‚d¯h -ãç #Æûâ1ã2»ÅzŒš|Â)Z¡#¼±HÕi*Ý/.àæÅ“„<ßû²‚>ptþœ -©ÊXftó A¼´~×¥ü,t.n0—ò†R§ù¨CHŸ{ç’C³¾{2Ê@Nu}ξH­ÌTõÊøˆÄ±¸½Ã':nl‘&tu |ôµ÷*,†¼Ä5&¢ýzs‹ç&¹•®ÿÚäFAÄ¢×™C_„-òì‡é{”ý„¹¬Â´¨ª¾½Â¢„¢Öµðð¡Òt™¸Öâ¨!C>LÕâŸç *®\Ÿåá6#p=)V—Ý¡a¿äK ì8mb˜öÜ ŒL“"Cwî’Åܼ{ÍÑZžehR1V,;ð=Cì;9_Îa-Ëë»”RI!yñ¹.ðk5'Ïd"%N¸#_¿ÜÒSÊÄ}„þ—$~hÛRòšBLúunÜú =­,…Ù’VÆóèmä¤Â]Zs߸Îu=!›—Uü¨äÒBÚ$ÜöSÏ ÃS\d‘ï.éiæRH$Êc)¬ÓÕ WÔ¤AÓÊt}èSÓ×Ý=Üoþ2šºÑ[†ÈãD×™"×Ǻ¸æ±2©€Xö/|/”ŒòÏ«{ž€óÊ®áýuÉ=•o*l¤£)úǧ} §è>ì?ðêDºéÙRÝFr÷¼䎇tª‡Þµæò -–>¿´s ê£gí`ƒ‹®E]ƒo­è ü -²sÆxFMéù Æf\.ò£Íëwâã8§'5€Þ^Á pè8¼¡†Bô”×ò¢WWÖ½·¬á7Ŷ$¹åé÷T^©°vë_•aʇ€ï榢Õò¾<€ÕpêÝØwloòÕ~ÙBÿ׿Êúç[èc?™n7Bϳ=×ð‚ò½à˜ßйe:fø¿ôC¶endstream +xÚµYÝoÛHÏ_aÜ“ ÔSFŸ}ë%i¯‹&Í5.ö»û X²#¬,ù$¹nö¯?~i$Çràp(Rf(É!9?RzæÂ?=‹åšdÅZ™8ž­¶îl+/´P¸3_¹a€K_^¼ý„3íªÄMfË5‘,³ßœË¼¿[^/Œ1ŽgÔ|E±s?×οï—×7<ÿþöJs/v./¿|»]â„ïÜá—ÏŸ.ç í|º†‡ûùË_.®—#)¾òCƒbüçâ·?ÜY’þrá*“ijŒ]¥“d¶½ð£ßÈsyqñOË…×ü¿5¡ì¢§XWűoµÖÁ„Ö7÷ó…»Î¯ˆ\e5ªuhqN;·Kÿ ŒíÔUùÄt»´mQÅÖMƳù¾ßä¸$”…pYþZuE]Á(-y¶«á7r²ù<Ícã€Á}/tnê¶c’zÍŒºÇœ'xŸvئEEònxa¬M‡u)û¦Z]£=R·{”Ì„ÓÛG¡ƒ³$Éwü/çeVÚ„¾Cw{ zà‰¦ÞwȨÊ{V°-m‘V´¢ ’˜ù²”{°v˜w€Á²åª¦×w¸NïuyÆ\Ð^HK Ò÷"c{àtº²"¢…™—¥ÆíÔ„1®§›8UÝñeaõá$)Ú’$ EÑ Æt$8X§+|W»lÙT¥<‡Â¦MºU^$QÓjØ’Õú– yeßè0›{!¿äÁUžÀäßøeÙãw®Ò ì9Ò; µë†C˜Þ„_a to?˜qŒø¾Š£DåvyYWëb£î¾|fÚ£x +cy‘Ъ‰Ðh= Æ”Ä6R=˜ö•ñÃq¤BJò!FàðœRm›Wäs‘³œcŒ¢æäþ§›{*Š“3{›@iíý8¹âà‘é¨pZDmNc‰â³L^¥¨±ÉÙÈ{M;¹±òrWCvØöSÀa*h|OAò;4‘ò“è(h´JP°çA£‘¸Î}º}H9ç_gE×ä›É3t“¡d¼s­b¼J`Q̹ùÃAÒã*-1ãR‚ ½Ñû‰«‚(&9Ènl3‘ŽÀp‘ …#yïÑäž>eyÙ±wÔ»ñiЕ±#ÏY>öZñ`p^ÈÉégÃ[øË2ãȺ٦è‰éê~âåß]í—9¥1t5£ŒöÇ>÷»¸c3ål*716gíШ«÷Ë ‘ò"O(§Fù¹Éq”"œñ=W$¬­Ø¯ãý¿G~Žô B´i(©á¯nÒÎ&I5¡‚çyàF¯»v"°Žë[%ƬYA6‘E689Üxà³q¢|¸åÆé®M·}ÃKÃíWÝ^¬` ŠÓ– Î^ Ú…ÓÃלFXÕON¡}Äž¸9àÐ;1¡‚“¤u’Ü¢’T<Ù +­K5n:öàZ|u¸é‘ôEûLÂcP²¢ìÄü×q䙟ï)Ÿ`%ž$«ÂFå8F™¦fY€ã~(Ïà (ƒ^ëYp»ó,دßwˆ~xh-úeˬø,kþ£ãº%›m*i•k³“Ëx[ÅØg=Ò:qc£‰YÉ ðÒ5pmáµm‚^8L%Š•¶Èí%£x*H¢3FÁbûŒN SoÆT«t—>¸EWŒrÁ"€ô÷©c¢BXŽïF0°¸Ú—ïGæg•Å_b(¸Ký3%P 'œþÀ`©³Ô~&Žœ¶fÒL° ¹`ˆFg³töx +Í®‘-¡e±æß!á5`B›Pp ¾`òöÙ6[Á$MAõ ª· û)ˆ|çÃ<öÉ•JQid\ü‘ã9.Œ— Z 4¬*B¢šÉ˜Šj*„’¸ÛDI+M¯¥C5.;ZþmìÍË«íï\äðà1Y“ydû^*ò›Z*˜}+9…+I¬ÂØ;‡ æ}‚òAÙF@¥CËèé–0°ÿÖsÝ“)9×—AȤƒàçiIYÐN@/Nñuí†Ç…7NØbéžÁI_°e22Ö¾é÷§GÆævù.ÛSaÜŽ‹mY\7XÎ yŒ|åyÇ׸Cð½Xœº«f’©Oÿ&ô¥ôôó‡*åÐH¥ T£ê8ÔX?b mÆsëZW܃HI¼“@ØüÀÈrÄÆØCƒ|+¢T³ø ‡ë œ¾CÄÅÜ?cs .TÂSo&Š-f“¸Öj°ù×|à '›'&¸æ+Ÿ$‡G†€è-茧òôHøŽ!­oãkx øûü@p[ôè·ÿºÃóF„²é3~)7V"ê€<¤EůåªÞ}<7u[¯;ñññl‡ª‰–cn¨¶.s~@o°ÛqiÕ$‚!`”îøá¤Ì•¾¨ßVénQT½¼o`ð7Dˆ‘u"¤l¬é-HÇ›EÓ¿á¶Ú©~0u7Ò¡äþ$µ¤»eœSÙ½`æþ©e¿¢”,Yñ#)Ò»LØ>p´1• +#­‚ØÿY* ^— +Íi1yw…^ö»N%:_iÿ…fì¯tc=bÏÕÃÒ[¯° *ùòlßò¥ˣ¤Sæ=DEOu‡–™—˜1¢Wm&m™-E?.PO¦Ç¸rTÝ\«ÞŽœð:Èióq )ñYS sNYLµd ºÆAÉ åžôÝ0}€Ú}ÅÓnçÆsv)–ìí!›*,´ruÍßL1T‰îëjt+ÏÉè''g²}€Ó +;Œ_âÛCÅ*Ÿb¡#@“ñ+Y4(›˜gUr€˜“ÂE*BÛ\øIrÔ§2œc¶å.úÛ)§RXl)ÌÊŒO@eÆ ÝˆÃV¹ŒÉ_EA|þÃM7Ü­=Ž¹#GüÜB!¹Æ¥5žì°½'½=c{{¶+ù·y!ùÔDÉùÆ,\h/6fiÌÚ¬ è¾Kç†ÀÆüŽ'劌œÏ¨ô†<žîšZN×–ðÇu d—/ô !o¾ùáÿÐÝ%|EYà¤uIñÝ‘NüY¢“„A o>>¹Õþøž"›<úR$ªI¢¡¯;‰îËbªÝ”¬zùZ4/]Š’ŠÄMhߎ¹©ˆ:ÈœâJjsa3ä0•ˆluÕ7ˆ n8 ˜¶X‹KñZýöšJáïÒF–¨ù&µGH+¥øû)5*4ÑÔƒôÀ +†?=_}âö±òã€_{Î2€ÊúEŽ·ÏÐŒüðOVˆMEx´<ÁÍy‚q?|eWªûowÏý„€8®^¦\£ùYrô¸r?¸„F±’/‡¾"ÏËû{C#á;7”Ôº¢ÿÀ†œ¾UÅ”7pÿ¢á††”n·rFN"÷ïøÛ^Ñ—dw§ßéìY£0uóí®< wÚÇ·r8:SC‰ÐÿÛWe)=$ñ£çrêúôGõ_€Šœõendstream endobj -6288 0 obj << +6630 0 obj << /Type /Page -/Contents 6289 0 R -/Resources 6287 0 R +/Contents 6631 0 R +/Resources 6629 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6259 0 R -/Annots [ 6293 0 R 6294 0 R ] ->> endobj -6293 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [474.587 341.766 539.579 353.758] -/Subtype/Link/A<> ->> endobj -6294 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 329.732 166.217 340.209] -/Subtype/Link/A<> +/Parent 6607 0 R >> endobj -6290 0 obj << -/D [6288 0 R /XYZ 85.039 781.388 null] +6632 0 obj << +/D [6630 0 R /XYZ 85.039 781.388 null] >> endobj -2066 0 obj << -/D [6288 0 R /XYZ 85.039 761.463 null] +2150 0 obj << +/D [6630 0 R /XYZ 85.039 690.993 null] >> endobj -6291 0 obj << -/D [6288 0 R /XYZ 85.039 736.911 null] +6633 0 obj << +/D [6630 0 R /XYZ 85.039 648.343 null] >> endobj -2070 0 obj << -/D [6288 0 R /XYZ 85.039 654.569 null] +2154 0 obj << +/D [6630 0 R /XYZ 85.039 581.67 null] >> endobj -6292 0 obj << -/D [6288 0 R /XYZ 85.039 619.823 null] +6634 0 obj << +/D [6630 0 R /XYZ 85.039 544.803 null] >> endobj -6287 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> -/ProcSet [ /PDF /Text ] +2158 0 obj << +/D [6630 0 R /XYZ 85.039 421.348 null] >> endobj -6297 0 obj << -/Length 3138 -/Filter /FlateDecode ->> -stream -xÚ¥]“ÓFò}Å&/ÈUXè[2÷Ä!X8ÖI¸Jò d­­CÒ8’Œqò篿f4öÊÞª»JzÚ==ýÝ­õ¯=øÏ¿Îb× ×iæ»a–]Í•w½†WW¾`Ìenáüsyõä‡8¹ö=wá-®—w#Øâðz¹úÍyþã³Ë—gó0 pgó4Íœg/fAæü2ó}ßyvóüåÌw^ JäÜàzù+n¿ÿøÃÞÍëÂ^½Ä——7ËÙË7W/—†As40³@îþ¼úíïz7yså¹á"»ÞÃÚs}Øn®€=7ŽBy¯¯n¯þeHñ^tÍ¿šFfnœ…÷¥áÇÒˆ=7ö"’ÆëÙ<Ž|§üŠw)gsßi²V/zµká†+~Û²ÎùP!xàÀ¹ƒe§Æ6%/º²AŠ@ÉwJFüÄ;9ÒÙ -ºâg3 Rç€kÏ©g9þ¾fØg)<û[ÙãÆcØXNÞ -s šË:çÇÑU÷E˜Àæ>ÊsAø¾P[ºÎ#Äx´ÍûÄðýlÖÅð%oùyó‰Ÿ{¢º"–ö úÝ‹½nж­ðßµü’?½x‰ *Qöô¨TËÀJÈ¿ò~{Z>CPDøÔ"Bìwê/ú5*¤úM^Õgoš¯Ë9\Œ>Š"g¹a9–ì ëÝ¡gûλ™@#§ qt¨Ã¼jëã®àUUx=|ë)º6úÒíªõ†Øwš¡ u½ÅBÛ^˜dŽœå;SiÄ ÉæÂ$¥Û#âÀÜ ]ux–¶[ÜGµžàçtÝ`iÓÓÕ¿'é!oAg¸â;Â*þÊF rDÅ,»#VPqG7 wBsß £j&E’n‹{#¼[ Âlj¨ga“Ÿ‡~®qPÖ›aØ>}òd¿ß»­jòbSµ¥ Ì=¡ ʯ¥»ÝlOY ½ÀMÒ𘷓Уqî±tzN)!O.ÙÄ<ðS7 #1 Þzƒ.dDølohý{”a­ÐÍ>lÄRµ¯–ò¢î¡@…mȠײUÔ•x£Ð9 -=°'Ã1Æħ)ä}Å 8AF¬SUÇ”>–«óá1¾„Î-Þá³ÇcÞ}A¶¿­0’ (×fë_q£Ûž“0$Àô#^/Ä°K†î¶ 4»ˆˆîšqölñj#fhÃv½´÷ Ç›C4?ð[«wË(,"úÔ…Ü£èÐŒ°^$nbM”€pTp>ä'éXíÖc°ÈèÒ©„Œ|×—O¢­¾`Tû¾Z·È3í Ä@4%ÄXüLú›ìNp‡p Ñø3FÕÉ’΃òå8ľ…ö³!¡“‹1;{AüõÅú½#³_’¬Ã q¶5›HÌÑ (®Ë·pš%\&]Y<#˜ì"ÿ܈iÒ%ù€„³&›·ÄR@§X -›ù–2~Uäå)„õœ¬è o=ïuT,˜ÜG$z&™ókÁ)â¡dÚŽáà€÷UßJÌ6ù>òÂÑi@ &N”ÄA&ÆX5[J¡h ›Bw‡']1X™½Î¨JöMRCRÈ¢) -M‹iÔe¡ÃžCu²R±Ì¦.¼’*ÑwDT×iâc"ls“b@Óð{ª(D‘ªzÎ;”u¸NcŒã -!tÒ“”×*QY1‰˜<.0œ¥‰óy'ò„ã¶z‡éÌŽa -qõY&t¬Ï]ˆ`&îcÇ"bhï ¥Õj¨Ð£Ã0¥­ÉþÏ0Ñá‚å?Ú ãV?WU¿•º¶—–Ÿ†M e± ;{m-­DhW 'îW×yô?xÉë^1E¶mXLáwu݇ÝVha€Ÿ¨ïî[sP€åR!ˆbh70d¨©î,¶B‘ðºÔŒ˜F®Dá²ÔÅ¢T{våàž}¶ç°ÜIð%ÌdSñïF—Òa’PÙH!.1:‹.Ñ W ð–ÛPùf$ßy -€—á©÷1 -Eá1‘ˆ¨š­ñ¯“X°ÔaIôäÂB7AD™SÁ[…N†¨Ó)QЧueMð\ø=O瞫Ĥ™&†ç(MW°üð–á:Ñú¸B©Ç_ ;!FoR[WÈVÁñmUÊ9ÊÐEO`© -‡SÜÝoš+Æúc -ªZx£'EÃþn6ÏÒÀê<&Ò}Éï¦Ð—5Œ",tSÇ€N¡OI”!ï‰B]>‚”»³?ÂÃgO º‘tÈ¡6¹‰iLQÖB³ÒŸ$Vm¡Ú1¶V­‰Çª‰Sœ#¯WQÖ>ù ’þÌvLñº»*Zwe''»¥ôàÒä}ÒÞ9aä°5$‘×ש²´9ĹT‹N0³,t”&ÑK ÂïjäíÏñ4ª,$,?=ÓAwëß'A5 ‘o5 ¾ç»º !äöwÏOOÏó½ÄÍ A¹t Æ¹wâQËãû°éG'þ›ä³³zèöÑT -l[óUÛÀFÍÆð“‡rA‘ --°û‡hþ?)¢KìþøB€ýn»eo×9û”]Uš]²N('\Än&•cáœWŽFzH9—4Ê9=qR9ö‰Tèà]E8 õDRÎÓÇö2çŠÛø熓xà<ךºêoþ­ATj ònl$-çg=”Ý2Ê%o¤´CÅ"ážúÌq^¼ÿ.7õ=%™ë‡—Ç©Î= Òƒzºpਧ“§õdø?:ц;³/ÇÞ ú©ÄÎÿà “Òy¦?'ÏȧçEyŽ8ä)HÊó£_a9Ž‹¿ù1N¢biðˆ÷±Ž–¾üL!d O©r Iâè*Y|¶ºäÙ bH'cÕ´5Ï¢˜$³ë£RÝÔÑ©ò$Ñò²PlŒ4z‹¹(˜ÂxÍÌš(á ÿë&†+Îi¤­ò~σ·¥A‚¢ìV•¦€7%6_âF -Yl‡~~Ík?2¢× ×Ìgaݨ¶<œñž J\_ô ç¼÷h¤‡¼çÒÆ{NOœôûÄõÎnM©á uç8fB3Î9»|=v±nsGó¡)2¥ÓÒjl_†<óþö¶žü€Ù„Çðp0‚Ôž«gšŽ“¦ân¸[Îdž1ÏÎ}zS›‹JÏ»o¸'¾§0j{ÉIÔF„êNžSiÊœft°Ô“1”Pìæq¨&Žˆc°oÀÓs <0öæxÔ -hû®€ÕSbzÂâÁï&ŠaB÷“Î_ãì*rÞ¢^–·dŒ‰Ûô9ò´Û{uóž¾hKÞ±ˆÓDã¸ôå(Cß íüYW&‹õ–¿X¸‹ð¢Ç(dþlFn%Ög.?õ]?eë‡V+rñËï¹á/’³?‡4ø§ûƒŸ·j­Ç·}HÜšÑRâ¼(Îñ …h˜]îu,œ³áý0tƒ4’ŒG@¦Gë…ÌÚ!nZÕ¬ è¢®™€mü‚úTõŽ+*FíS2Å@îËÓÚѱ ò7Š -]MÓèX,žÞå”䤹™œVÍ <9þÔƒ¼oóA&a}Ò‹wìYüýÇL˸;œát@Ü[¸i?ð©TcÏ-ô‰zB“¾>ªÍÌø4LÜöPÊžò@´Ž³ø˜¯ÛÐ8—¹9¥d}&õd–}A_rA2Ãëèx4…sÜSc“O3úhF”ˆ !©×sýíšÏâ¡XjÑhpDzÚ1ð㸎ùr>}+TT á-Bê».'†ø""‡óÁ׊zÝã/£b<Íqq}v@á¹Ád×ÿ3±ÿëïsÆ Tèfç:¯bSàk^ù0ˆOùÕÇsáÿjäÑœendstream -endobj -6296 0 obj << -/Type /Page -/Contents 6297 0 R -/Resources 6295 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6302 0 R -/Annots [ 6299 0 R 6301 0 R ] +6635 0 obj << +/D [6630 0 R /XYZ 85.039 385.938 null] >> endobj -6299 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 679.338 303.67 691.33] -/Subtype/Link/A<> +2162 0 obj << +/D [6630 0 R /XYZ 85.039 290.245 null] >> endobj -6301 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.346 116.607 207.581 128.297] -/Subtype/Link/A<> +6636 0 obj << +/D [6630 0 R /XYZ 85.039 257.824 null] >> endobj -6298 0 obj << -/D [6296 0 R /XYZ 85.039 781.388 null] +2166 0 obj << +/D [6630 0 R /XYZ 85.039 185.067 null] >> endobj -2074 0 obj << -/D [6296 0 R /XYZ 85.039 199.93 null] +6637 0 obj << +/D [6630 0 R /XYZ 85.039 142.114 null] >> endobj -6300 0 obj << -/D [6296 0 R /XYZ 85.039 157.583 null] +6638 0 obj << +/D [6630 0 R /XYZ 85.039 99.146 null] >> endobj -6295 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F41 2994 0 R /F20 2961 0 R >> +6629 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6305 0 obj << -/Length 1634 +6641 0 obj << +/Length 2356 /Filter /FlateDecode >> stream -xÚ½XmsÚFþί Ž3™ ô‚ŒäL;uml'qÀ58ùøƒs¤#’0fšßÝ»=ñ&ì¤éd°îN{»Ï>ûrYuþYuÏ5Lǯw=Ëp<¯&5³~o.jI´H¤µ&óǨÖ>wê–iø¦_MVz\£ã:õQô¹qzyr=êÝ4[Žã4lÛh¶º]¯qrÖ´½ÆǦeY“þi¯i5ÎP¤Óèãxô _nÞ«µM”:Áµ‹NzýQónô®Ö•KÓÆGtßjŸïÌzž¼«™†ã{õŒMÂ×I ànÇ¡y\Öþ,U©wºÚUE†ëx†ë9»lXî¾e˜V·Þu-Ãïú’¾PD\‰{‘ªá0Ìø |*Ð#Pß²Àº+¥‡Ö“fËj @Ìs§üÙ`YÄOh”ò §A¡Þ3©Š³œ^  &=óœ¡Á ¤òuDåÀmN(Ä„6ªGˆ›€Õˆx°.àü9€N£Ø‹nÖlÙÝRð$.˜3ZôDQ¯\½ÏJÎHmQdˆi¡Ai?NàÈæ¡®'~Ý-äJž$ÀË2àÔØÏ¥C\ž®—õF5’©ÐüDØ"÷òxEÝ¥N'"ö6ºõŠNŠP$‰öSšÔ¡•wH1ÞR¤+°ù6Ü*xyœµò ùDÓ¼n«t"dÆ~;¯åþ§¬UYÅýÿÊ覥®Ð­2±_ˆì«îM2òª“ôÅV «Ö½S»nbÄs¾>LxúúÚyÃ(XÂ_ KÀÂB.,å_žGy ±Ñ%!·ƒkÒÓzSañÿ3¨ø3}0Â5œN“ƒß~{¢sTÁ–ì—zH "nKðm‰[-KŸŽÑ½ctT-¶Ôã¶L½Ã“›‹ŸÍ»òÄ¿×Í ‰uëî‹åtÒJXÐSrVÂz³?5†ò>¾~ÖÈ;_åmãý’Æv>…›aTÒ×Ö^ã øñ¿ERzø{ïôr æƒós\ɶßuk£\$*¿æùªZé~B}(&ÅB^hqv](³¤¬Ù*óɪGêÀPûF^ 磳ÞÇ5ýþ½*Ò¥p0"öp 3{‡ñ¿å’¾Ç>O`¿7¢ öÔàƒîéÀáúOÁ±ïô|8¸½9ímÓ]ñÁÆ1 Û¯úÈ?…ï?}Ë)¿[Á¥Ýsüê5®m¶¥± Ž}´WóÙüåãò²endstream +xÚÕY[oÛF~÷¯Ð#X,‡Ãk÷¡ðÚ®›Â±½µ +ï¢é-R27é’£8Þ_¿ç6%Si‘8@ +ÖsfæÌ9ß¹RM<øS“$t=NâD¹:I&‹õ‘7YÁÌÅ‘ +o¸^âÔ?çGßýF幩—NæK"™ç¿9§?ÜÌϙδ֎¯Ýé,ŽçvªœÿÜÎÏßòû“«3LýÄ9=½þõjŽ/ç¯/ßœNgÊys·Óßç?Ï\Ì7ˆ4²ñÇÑo¿{“8ýùÈsušLž`ì¹*M'ë£ Ônhy®ŽnþÕïÂsÁ„W\vf)fÚs“$£QÚžah%¢Â‰øîþ7HB^¶¿eèáŸîx÷‚)PD-å9' S~@qÊóL•m±@2Ó á3Lx©Svò[#5-i*^™Ô;YÍ$M›ï¤œ§§*;#DKþ½@’fóÈó7¼o¹S¯ï§³0tþk·Y˜Žù|ç…¼¼¸¹î`¨zAf¨k…ZHéÚyƒ{>Õž“åEÎÊj;x„‰ÇªÜrªÀ_„Î\$†cÎqÁ©2Üô™_€H€3|[m`”ËŠ {Lc2óý(=7 +’0ñR5Pj F”úÎSñþ¶ˆ†/ÊÉ#Š¤’Û™ÆÞÀJ9ÁýéΙAÈ45S¡ZIHÙb +x@±ÖEÇ+K!Êøç  {ž&óî3¬ÈAß´xÖ3_ð©71¹iG(!SÖ+ÁÂCÖ›ˆ”eTY½*ò¿(ΊGBAÆyÁ LM gp«Õ<3Œ$[ò¯±)§ã5¸alßY:k£‹ìU•†Ìï{0ÓœŠ 1«Ž‘Ž(µ\&ô, ¿é@æfWU³²KEÊ”Ñe5;©ÌìŒEû$—|¾äÂW—ܯ;¿h‹\ ¹Ì*AVÖnÓÓ0D ËLŸ˜¹¶SôµÕvë9*ÈyI˜Ö>É6xnåt½3“ I§œ†õ6RCžtEO_¹Ñë#îæ§Ñ¡ä§(dw ´Kþq·8Š·9¾.;~ÙÜ›ŒóœGðý/oÙ&Z4â·ùG–ö¼ôa½/pd·®)±Èd+a“vå8Kö ‚Õ†Â_ée&lÓ¯þÞ`Àš$ÜW9³ÔøÛÊ=ÞhÍ Ißµ ›fr +@ã·ÅS- ví±MmQ'›­!t6Hù!õÐnBüÈ1£\Xâ*k÷í§ä˜ýÃáŒ.ý¶¤zÉñ¾AŸrÏ9ü{¾TQC2—$ ¯ÆûiÑ0÷oŠXVÐÛ‚jÿ¤ÄžÄ¨lÈI¸ÏÛ˜ð¶7ÞU!ÁC„þ ù¨Gt­*¸¨o4—¾´Y¬yQL Å6,ØñŠ¨mqŒµg”ƺ²¢Zþ}dðS6bÔÛÊÛÊã‚ú=ÝXíôWî6÷>Â’·^‰¨dŸÚŠ±è{¥œW7ÂgvŠ4›iì‹¿rî!=,kV,›—iHƵni%²¤¬vm¡h‹ÛO#’ª{Q‹±SX»Fʶxy.C÷CŸf¶ƒŠŒk? ]DøõòÀäÕuqisÜÐV(?©.BI ¢×›ZzQ¡ç\‘ž˜ŠCPèÜQB&®Žúž÷Qöb¯Ü+ +½UT4ª¨cžê3qQÅ¢-FÎXoÛ_!SÜóe‰꭬ >>AY×'¢¾æ|~/ÚÆ]¾Þéj‚ÇX'0Pƒ)ç2Ì·ÅG[óÙ³;Ž$`ø½Çh)s¢‹Šg€Lå\Í*;Æ[5vÁAÁòR™Ú*sëÎúÒZ´Ë^fڿ殨i×ðO½ËMÆ{¸*?ïé«ãRa­RpBdÓ-?½‘l¸•^‡ï9äûa*/¶uuR#Ìn=?èÁxw«ñåcŸw¶o²Óãõö]’Ž‘5Ú#ãŸÛl ïå1—ã ×#@PRæbkdí¥Ô×^ìà÷ +åüpf·Áë!ðÐöÔ¶uŠPªiƒ„víž;ëo9ãÆ7NNëÉá5ãC7ŽÏ†Yï}üù°UÏŸlÿRû!#3ƒâþ0rƒÐÂtü”:®ŽT4^®¢&Ú…ª, uN›õÚvz¢Ø9o!ОÓvöô‘#t ÈUŸÆ²õL}^:k‹*#ƒEÚcÛp†¼!Q…–Õ<¸·>ü±¡®¢<å%p»¬JÊOôò¶H,³UÝtBO^)R +ÅuÓþµM®¿\R;ÑΠ|}©Ø%å » ý,Š Ѫìj=c_ã®›º3-È«ôNmB¦#ܺèë/†›;R’jÐŽá%tuíàE¹)6x÷ñ¢ô÷!Ø›©VV¹Ï œ3 ³Š’ EÎÝÑðÜ‘ã¿–º»#,ú®öq¨•›¨ôÓp{§tp‡A¿Íy>'¹èúvFæ"Ûq ô¥Í£Ï5ÀÒw?êáÖÊK +|ûÕµ©—åʽ¹¾dÒ."5°Möms 9É(í`ÐÚ7†Ç(<;¬÷øãòæ®íîWçÈø_^_\ÃÏÕ?±›x¡¬èÀù€â¢üµœHâé˜Áu–‹|ꆛó:ÜÔ±óiPL„“mQ/Ä_S~®Ùˆ¼³AÆÿ¾áß›V¨v6aW\ù6î?3)&1*g< %<¤ˆo˜†ã¤pR²Éˆn‰³Oäƒl|Ü6bs(è‹‹½'r¹Ešðïý†t6ÒóñÝHEãð~Ù·tð¸*éõñéÏA²Ï¡Š $»‰Éÿ³®ƒlendstream endobj -6304 0 obj << +6640 0 obj << /Type /Page -/Contents 6305 0 R -/Resources 6303 0 R +/Contents 6641 0 R +/Resources 6639 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6302 0 R +/Parent 6607 0 R >> endobj -6306 0 obj << -/D [6304 0 R /XYZ 85.039 781.388 null] +6642 0 obj << +/D [6640 0 R /XYZ 85.039 781.388 null] +>> endobj +6643 0 obj << +/D [6640 0 R /XYZ 85.039 761.463 null] +>> endobj +6644 0 obj << +/D [6640 0 R /XYZ 85.039 612.891 null] +>> endobj +6645 0 obj << +/D [6640 0 R /XYZ 85.039 585.186 null] +>> endobj +6646 0 obj << +/D [6640 0 R /XYZ 85.039 558.088 null] >> endobj -6303 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R >> -/ProcSet [ /PDF /Text ] +6647 0 obj << +/D [6640 0 R /XYZ 85.039 530.99 null] >> endobj -6309 0 obj << -/Length 1380 -/Filter /FlateDecode ->> -stream -xÚÝWmo›Hþî_ÁåN -–ê5Ë‚T§Ê×:¹¤©ã&´=©—Ö†…uÜèzÿýf_À»iZµ_N‘Ãîì¼<3;3 X3àk® âiŽ‹q]-\ö m''=¬8ŠeÐâùÃï 푆 äžæÏ7zldÙDó£÷úó?Ç3rÙBtÓDýã¸úøEßtõ·}Œ±>ž>Ÿô±þ‚³Xú”¯ýwüøâò¥¤½ês®1§Løf2õû×þYoâ7ÓÆãè>öÞ_Zžœõ D®ÞÌf—þÜ~þ,Ÿ’Ùè2WÒæèÃmk–'Ìý#hØAØ5·Š2ÉÒó‹“‹©R7ørõæj¢œ:R€1±Ú?‰Ç¼®÷ -5_–ü_vðTØì1¾} Þ·_C´}ãh™dIÅÊ€%yö…ø+Û§_¿€ñ‹W§ÓÇ…?à–^ðÏ|x'ôÆ÷}ùH£¯^ú§Ó“‡/ÜþZÙMóµ\„í‹Ÿq¬´¬ _a¸'ý*¼8È¢”v‚­s¹ÈKEˆKJ›d)Uò‘&ŒŽÝ)DQ2ŸÓ’f,½¢ÒŒ†ASû,¦*ë 7’J‹O!-x -VõAÀjàwŠ'¢Õ-Ë‹/Û/”ïÊ%•Îç3«{(ó©j;9Ø/7Þ*É… - -Ë;(Ïà:£lÛ?ÞéV -ðßÑíÁ¼Ûκ%rø!Y -IxýðÖܸºïïxR6å5Ø£âÙÌ7™òçgŸü¨:»ä‘vǽþ¦Bká¡iENsÚ¤äÿ&n» j\—Y”gôõ’Jóª[ûùŠ+…ž¤t_µ„9á¢À3<Æí±¥Ag4"Žóc!G¬¯(o¬Ç0†%Ù‚Ó Qáü¹ª™–y©V4 nú˜Ü 5b=`ŠÌ%—¹® àG7)üWÇi¾àms\.*3­„ý$òBrW÷× f¥H0_¥Qmäc -G¿•¤œK ÷¥ç<çxÒœ ®…EØ -‡a•˜ Žºã¨‡‘Í$ Ð#rˆäôr¡.[ã¤b´¸w§ÉŽF1f¬8×ë5 -Ë Y@¬Ã8¡(/Ã2BZá%"BÙGF0¹oÁë̸¦eˆ ¹ŽÉ#]0 dÀìü  Š§ãÂmò‰%ãè»pMHI´–ö¼Ø´aò÷¾¯1B–g?ŒWñ´ðª¡-“°Ì«|ÎP˜/‡«”¡ *žUaý~{ó”fð¶´FPO±ëÁ,ÑõÍ‚8»Ž­µìøFl¹d¾yˆ¿Ï° Õ;Ú8dÂ)Fo3Í÷Yˆ`YÙðB³ä1†IdžAgE²¬GŽ^ô ÖË&÷늎65Áâ|Å×LÒù ÅÅq' -$cœs7@ÑûŠcáØVϪõøžsdqÌJÑ¡xùÊa†I.¾¿—E,û•› ŠøP/–+îU¾­I—]*å á^*Š`¹*›RuËâÝAð‹Ó‚Iïp¥êb²eTÝž3£hY‹¸Þ«~ædc…E>â‘ìÚÛ›í¦=(W0«¦ÄlMu«鉘nßœN2VªQrøì W5½}¿¦Ð¾ÿ[»¹^ÀíoÿíÚ¤&®±p׈étñÖßä;€ÿÓŸÁendstream -endobj -6308 0 obj << -/Type /Page -/Contents 6309 0 R -/Resources 6307 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6302 0 R -/Annots [ 6311 0 R 6312 0 R 6313 0 R ] +6648 0 obj << +/D [6640 0 R /XYZ 85.039 382.554 null] >> endobj -6311 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [90.021 228.532 332.556 244.074] -/Subtype/Link/A<> +6649 0 obj << +/D [6640 0 R /XYZ 85.039 355.456 null] >> endobj -6312 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [90.021 214.983 218.012 230.525] -/Subtype/Link/A<> +6650 0 obj << +/D [6640 0 R /XYZ 85.039 301.259 null] >> endobj -6313 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [90.021 201.434 441.871 216.975] -/Subtype/Link/A<> +2170 0 obj << +/D [6640 0 R /XYZ 85.039 230.623 null] >> endobj -6310 0 obj << -/D [6308 0 R /XYZ 85.039 781.388 null] +6651 0 obj << +/D [6640 0 R /XYZ 85.039 190.459 null] >> endobj -2078 0 obj << -/D [6308 0 R /XYZ 85.039 187.165 null] +2174 0 obj << +/D [6640 0 R /XYZ 85.039 132.426 null] >> endobj -6314 0 obj << -/D [6308 0 R /XYZ 85.039 154.947 null] +6652 0 obj << +/D [6640 0 R /XYZ 85.039 97.68 null] >> endobj -6307 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> +6639 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F41 3054 0 R /F20 3021 0 R /F35 3036 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6317 0 obj << -/Length 791 +6655 0 obj << +/Length 654 /Filter /FlateDecode >> stream -xÚ¥UMs›0½ó+8Š*BÈ=ÕMÜtÒ‰Û&L{Hs €m¦€R“¿ß]IØÔ±séx<–vŸvß~šù|˜/xêÏ%£\J¿h½È߀æÊc:H8Á|̼wŸÄÌgM£ÔÏÖ;‚&‚ûYyO.>/¾eËÛ äœ“8¦A8ŸK²¸ bI~Œ1²X],F.’ž³Ÿ¨þzûÅÊnD-PvµÄËr•Ùµ·Ìö÷®LŠìþx÷‘_B$×^Dy*ý8G”ºõ€ w÷Æ»ó¾ïMY]âÛW§’!¸¤Bò×Ù`âD6DDE”˜lÜU• iØBî\ª Œç¤BFv nñPuîµê“º³I¶ÕqðqœÒXÆ{W†3*ôÆ!n'ìGt8¿fléßÔ@ÏðÔªWëÁúÝT!ÝT562FJ8lÌéNyo²!ç$C]4îÞ©÷A˜$ a2e‘8Ž/á3:çóã;ªÉˆy;ªcK=×KœÑzäÍq8`Œ³´ åÉlÚQlº}Á˜‘¤äBµ-&Ë:›“¥Ö*àÑý9:ÎÌ›t˜³ý8›%t&™¡“A/A?`s­‘‹n]áì)À:c]ŸëòPT‹‡»ƒ [¼ôxáÐÐÉØÛùÓPi Øæ½=<Â$•±cƒ}sqžP‹ŽvÅÁ#k­Ú‘"T?ÔØqçRíyXŽ(ë󉘾û`’<æTaëm0Ǻᨧ&m^7Ö0ØHg¤©ûJ•Àè­[*HÝ>5õ4 sÑÀÝX¶]>a SÚZÕãóBP[ue>€Ð¦ô©~EŒ;º* Ø‚ã\µuô´y©´{a|cÔ®qì -Õ…'b-wã ãRyÕÚJì@»S=BG{7YIjmÕyÅî@úg|g,õnÖMrP»¯ºBí0ùfL¦¡a6‰ÝŠØ¹Û*Ó•y†"DZ4»¹¹*œ›kÑ8=5Fðµ)ú¯¿ý0&œJžžžE‹ f#, å1ßñoæá¿"@Âendstream +xÚ¥TQo›0~çW =™›OS—¥]«&e S[u} ¤h t@Õæß×wç¤tŠö2E +¶ï»ó÷}w²t…ùI7¹P‰Å’«8v—[G¸k9s¤EWs1!ô%sF§áØ•‚'"q³B²âŽM¾¤Ùô‡ç+¥X ¸çGQÌžd·‹l:£ó“ùW»ð‚˜M&W?çh–àÕåùÄó%;ŸšÍ»Ï.œi6`ák®Ç +hüqîî…[¦Žà*‰Ý³\&‰»ut¨x¨•Ýoœ…óýP…bÚ¥¬#bý=ÂW‚DZ>¨–áÕEãùAÄJ Ý‘’Úoz’ùâ™`Óþ¦]^{AÂvÛ¬^—-Å:¨PAîVå ¿¤„g{Z·æ?/Ê‚â}C±k“ñì&¥/8Ú6¦ZkvRƒá;ŠkìAR°ÞX»ÜÑ~ +r«¾i?V^¶eÞÛª9}î#îÍ7‡~ ®Ñ©Ž©Š5ed‡užMšzU­yzuIà3íïÑèŒN0§³VÙ‰®:ûµÓÖ?ÚQE:Øñé,m +϶Hvp„‹Ž˜cf ú^Ãäí!¢vG{p/˜PÙI:L6?ò‚DàÔÇ_9+ûÿÞq,üçã¡tò7E9æjl^§!Á7†«K0endstream endobj -6316 0 obj << +6654 0 obj << /Type /Page -/Contents 6317 0 R -/Resources 6315 0 R +/Contents 6655 0 R +/Resources 6653 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6302 0 R -/Annots [ 6319 0 R ] ->> endobj -6319 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.286 747.387 437.733 759.076] -/Subtype/Link/A<> ->> endobj -6318 0 obj << -/D [6316 0 R /XYZ 85.039 781.388 null] ->> endobj -2082 0 obj << -/D [6316 0 R /XYZ 85.039 731.943 null] +/Parent 6657 0 R >> endobj -6320 0 obj << -/D [6316 0 R /XYZ 85.039 691.78 null] +6656 0 obj << +/D [6654 0 R /XYZ 85.039 781.388 null] >> endobj -6315 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +6653 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6323 0 obj << -/Length 2852 +6660 0 obj << +/Length 1965 /Filter /FlateDecode >> stream -xÚ…YÉ’ãÈ ½÷W”çb*¢ÅæNÊGé%ÜrôÁãCÉ’è¢H™¤ªZo<IR[OTD1d&Ëòï<úóï²ØõÂÕ]šùn˜ewùî…w·¡™/|¥ˆâУˆÚW&—vv™®¥WiôŒeê¯Ü0òAófýâÕ‡À» <7I»õƒe$É<7Ëâ»uño'ÝÅ2Ž=çÛ±_øÎP.–¾³[,Ã$qLS ‘:¯ó¼=4ƒt¾.Bßi늨óªìÿYÿúâýzäÄž‘&n–üœ× óêÇw¾ç®¼Õœ×Ðs#?b^×Ûª_42'_™³5û‘ãã©Ó£} ÑÝ-ÓQ³âÁRWÛR·8`²ãÕÍ"X9ƒŒ÷ƒ”¤}]›ç=×e±Ñ©¢ì €'Œó…>`Óv'DûÅÓ]ß6¦–ù=æMŽC•ëf3I‘„³ô¡éßö±ÁV‹ 3: ̧7;ÌßcO™Þ™ª®°p#ýºêi¢¹ïs‘‰æž8Lå]CÈRç wZ”rŽ6}ïZ¾VAÍC>Tm8Å*iïyÛ–ÊB€¼ÙV”3`D–ÓöË+2rh&HHßÐ!ß—¹VÕÑP¬;Â'h†V=-b2äºÂ”(“Û‰¥EçìŒÜ»í;Vø,Ê‚“¡ó}kÅÐMËùÌ¢Ò»°šéÔk›>CU¦¿r˨Y)r,UÇr Cb–U~Ølm_: £³ë‰2ˆ¦ôÛË÷ìB2hjVPëÞpá8õÝÀK~êÂ3 7~D”Ì\8Ž|7‹F¸ñagÑÊù°=§4ÃA|°?Ãœ7eSþáùÛÐ-”±[ÿ”ʼnæ&ÊÄ^è®"A™IÍ$Ì öOÔÿ&ÍïlÄ…ÀA±Àù¼&MÊô3ÆŽ“ Po8÷£Bè­‚Ívñ¦|–Á¡…ÇU¹ôN¶Ÿ¯5÷à«&­ÁQ÷nå[íöu¹³0†xø#óuØ_1ǯ S€Ç²Š±Ó÷Ø—‘·bTítŠÕ†©+Ø&='iè¬A8—)ÈLÝ*JaunÀ ZŸ¾Éüwö IИûÌ;Eº=ÐÈç"óUAתwŒD %Ñ\ÞÚ,kˆg•LN†Kƒ šå¢‚ÎB\2 -ç©Ð ÜÜd§/¥=t=„ú[3ü]¶xs—–AÆ1‡¡‘'Ý‹UyØáÿ½F™âØùE@R,¯=é°„~ò?¼ØWºzGáÂ<ŽA­§i.«XEµcõHde 7CÛ)Öœ@10J\È…û– -Q]ù¿C9‹4´-ë½R¶–¨oë)Ⱥ–— u½UÆÌ@lQ2I'"ì`4f>ÊÙ¤¤Ã6–Ä—6F+ÏódV Œ¯5ZÏÂ=(ßUœ>ÈdÛ…Ø‚<Ô•uiÄOŠ—4´ÊDt•uŸ³l.-ÓÞ,L"½TϫͦüA©OÎL4Áè¿œñ*Óérd IHçˆ%°U26l%oø mIJ[oYâG™ÌM#ÑYS40¦‚nöœÑB2ÊÊ·â˜Ó–µ«¹É‡ƒ©kœž®ôtj¨¤+1Lͱx&4{Nxú‡~žã¯Ùdh„…͵ÝO ­'ñQÛRˆX[‡ò$ÅJÕ -‘¾ -F†ïw°Ñ"B@÷.Ev÷: ÈÜ&y¡ÿ®²FÆ~z”Qæ+ír©çOÚWÊ/÷ÈïÿZå<&àú¿~±¶È®Î¨}Šôrr!‰ŸK&Îʶx *Á½Nï°—XBCó„»\@¬‚(¬Ìr.bfjÍÇ #F`ôzL‹¢™¢£ùÔQz„…”ì?UíA§ØyvÒ}-Jγkš=É®©_Ož,öÈJ/ pÂ3ª0õíqÑ¥žG1±çN È¡‘+™gÍñÝáPĮܘ®`#ÜÝǯÔûÒ[lV¶¿ÖB11!ð¾ÖÄúç åNè*…s#Ÿo–ˆMGÄAž*6Òæ$¹è¿Â投s@*f•¥-ADÛŒŸ”%&lÙTIµõa§D}ÕäÚÜU…Ђ—y3q€€Ã¸Ÿ<0´V€ËîjdŽÂ%;7dÌ{£ :Œ³P ‚¤ÉR>./1à4I ãT„KâÎ4šÙ¡×WƒN€™ŸiYJYœÊöCàÈÉ¿ “¯X”‚ v‡&‰Ë ­<0%ûÇ”ÎÚlx&`)Ü@e'3„º[}Ël]mu-îµ{Ùn8XÞ†j,à€)¶>Æòö¼® EøŠö¤ÐïÚZ'§rËB Î0O -÷#Ÿ±¿â9M9ˆë0· 2M^Wå¨O¢c·n»G¼1Tœ÷·Òš×@µ@²xÚ´–.vß™¿ LaPÄ ¥þ¥ƒ -*ÂwÌ•FiË3ÖŽ Z~Áñê„h?°ì¹Š»ÉÑëiÏ_¯Åþ®WG ¢èI:B¤¯>$Á¬zKB7 2ZueªW³PŸÔzT¢%Ôƒ¦@õi¡¬ªÎ;û4¢¶0wR|¢œ||tb£áÝ*ªƒ8þÓ7¼ÍÍ¢:b7É[TZT¿íJ3Ø -ˆŸRÕ±¦þd³™Ï|;ö#ùô®Ç`ÏPq«è‚ÀÍVr…‰æfÑíg©›ê3ä¿šbè2$Pø~¿Ìžhœ€¶f#Â#K(ÏbkªU~¨M‡é£Û&…æC[kò0Æ—ÔâsrÆÎÎcéÁé;ãæ¤fÒˆêÒHˆ®ç²œ úÁÅÛAè‡Î*–´ óüfCcê&hÚ>Ö´÷`3  ´èZþëK4ö-S÷#ûŠ‡>²??›ÝoËðíë#C{¨ éŽ/„ÌOmr›¼1Ë .èyE´?¿_ÿþ5É—Ï—Q®ßr5$ZØJU‚OÑR~ÕH;oÅ8k¨ë²¾óº—¥¢1jÌ! ëv£$í˜e´vÖÏÔ¾†ØLƒkTºÃLFèÚáIÜ…òo“qj+cÑpˆåðÚÛŸ”IT?ðÛ¤Ù§ífï.ždb‘§FŠñü Ê«£Ì22Ï©æ‚ÁÄõto4q4½ÑTz(®^kAM]c½¦™LÁ$\h|fñ"+m4GÃAçôyV.u£Ð•ç }:à7—nP¼µ±|´µðŠ0F”6t‘†¼gn3uùž+ßy)ýÙ»ÕÙi¶v´ÑKØÔcgÆì©jÊ›ñüJ~?£­ù‚Öž‡©H—¦W?^}RQ…ñr05×K¹Ò²žøÑ›Dªý™ZíW~  #߶šõÆåâïw!—ç¾MÎwÜŒayˆæ{z ª¼ã5 Ï¢.9Ù•ýy@³êsžçòÆ?ìaú*´ü ã>(ÅíÏ3úK×`™oëvÿâ=ó(ÃïùážsºNú˜?UâwËÓùRN5¤HFwª6qÎF«§ª°—#¸Â©Ô<{Š² .¥=«l¬'mî$*µoýDóöÝKiÜÛ ZÀ_o4ƒ.ÇÃFô&z³1¶N}æûl¥#‚“S%]¾üÁ'RÿˆÄ˜ñýÓ—±{ OŸªºž^†‘ãk×ï FN”'9 Ä•¤bGöÕîæyW/£SQO}ÀÇ¡çñÓW³w¢½ýV‡U®ƒd/¯¤²Vþ¦³ÀdQiØVÔœ%£³_åäeœëD<-nFSRlÁ˜¦sláé‰òŸ‚Ü-ÿšÏP÷7–û­ 6ôÜ`5Oþn&#åe -z¡›v3È* VçÆaæÆYxûÄÿnµ¶›endstream +xÚ¥XKÛ6¾ûWøVˆµ¢H½ŽMÒ¤ š Ín±‡4Ú–maõðJr7ù÷eÙÖ6‚Yjf8΋ßXÍø§æiä:›'©òušÎ×Õ,˜ï€óv¦DÂDÚŒõsé¸Ë8ô“LÉó¥N}ÅÈ|y7»yó0ðãXÏï¶$t·ùâ…Æ_,£(ð^çÝÃBy}sX,uœxŸÚæï@™2çÏÀ³µÝÁ§ò*øÈë~ñõîýì·»ñ‘ÆTúŒ9a臡zŽ™ø&6c[•ñµ‰/lUh­É¼7 x¹í-Ô¡‘1¸ak_æuŽÖ#¯ïœS.Jü,‡cU4WP²ñ±Ÿ[õ4G™w`·€ÊœN <Ûæ¼Øæ°Ü°Üj¦Þw^whFS‘¥/P4òö¶¿’DULÚæO/øFeƒÜð?Ú>¡½²5¥Æ{1öð,«} æ6‹%HmºÜñ¶M+æ5ªÎÑMè…¹•ÑÕín› ºB«ÖöMÛùNÂdé…›‚Ô; èÉS.FÀ±eIÖ„‰÷$”ÿ&pØS D XÔE×ÓaÌì®ìƒ8ƒ¶²w¢È³ªµ«ràПuSw ˆ 7ep¢»¼åÊö=pî£%bk¿ÏGâ#÷DtãŠnÁÁÁ¡ö¶-:WMó¢²kÛÓ¥„F·¿¶nú½3 …¤·1ʻۢ÷âÕ=™ 4v.]½8™/§¡üˆ²‘ˆtôÝÞV¶/ššÉ­Û»³¸ÜP¨wÌÛ“þ§ÁÜëÜ×b|wxU€6JÎQ÷ævtTéA±u‡€Èá2E¦òêo_P\M÷¶Õ ¾¤š;UǤ!…v{¼CÏÔ®9:ãà “¥2 uŠ8•PÎ2™¥¯Kbt +Üw–á>`·wp¯-E€J½­whàÊÝŠ#º*ÝŽjÂßhŠI¯Á2Üç-™ù’&Æ{W#/öȾXKÛ‚‘ +)H–¶†-K“£š•s/²ÖÜ ÐžcOi³cž Õ”¸U?ù –:#íç‰MbX¾Ò¹púnCë©evâúݱëmQc×4&…Jê9AÑ(<àékºSMµFkJw²˜4“½ ×lû¼æåŠ:cÞS}!A¼Å…½qBb7¬œò¥|–ÜZ×fbŸ?¤$ͤ¨ÙH¬M{ —M4Nj)pJk¨!Êú-Ý•bd)>TËZ: +H NÇ\:Ú,n-µ‡•ä7,õÜBš-uÝ䜵Æ{*(ᜪ¦“šî\™õGg +×ï$P€UbýF 3_Ç?|öCyö鑬<)ÝÄÁ¡ŸdS§*ùI˜ÀãùJ…c‘+ ¥ ¥´¨eŠ>ξ| æ}? €˜ÎŸ`ø*ËæÕÌ€ùÊ(ù.g·³?Ç&¥o®Mª¡M¨áI§Z"@Œó8ñÃ,ÜÀI)?Ãì9¹í~¡&|Í]w7…ÖØ fþ&gÊMÜñšŒ=m"ÂÍ»JÏ_7`Öüd™Îüà&¤q«¤J§!ÕðÖK3W˜ò§­;ÜzˆÙ3µî³ä5—,‚R¢oÆhñ;õî‹zÃ/šl̾Ý|ÈyImùRèº}¼37a|»Êqg¾ +8ŸŒV?Ý¥ðü·e?—pKÉ›jB¹&ûÊ}I]ƒA¡ž˜Ke¾>vÝÙã ܽëQOüÍ-v¸Òù‘ÜžàatÝ"ñMUÒNXžü==_[\–r#Z\v9£×±Q‚-# +éÈNA¡1„¨”ø…pð{ºí)m°é¹$ànHLY¸–[3ÜàC°cW‡2¯Æ,é¡f“Vº¥If N¢ KcÒ³KÀ׺,r>†Ø‘x0Œ–‰éˆþ/´oóþ£Bfñ(õˆO.xŸè½ðwŒuËÙžËñŒØó±½Ûqì,ð‹Ø?9$\=†Ãó*/9>:ö~o†÷?30‰%GÆ€:ùÒ>ê!‘˜»a½<ůF$¢c@¾v…ý$e´ÑWŽ4Ö+av{;äÎÉ0K˜ûmnkÙEñ´=ó®ò ¤Gâò™y6 +êM%Š5·À§¬¶•¶¡ø¬šŒâ©šLDã%¥šnAÙ¯þhvWdFò' ¾b¹6jŠ±h¦=#òvsÚð‘–0ŽÌ`¯vø´KÖLÔ +]‹»Òñl¢ÓÚ!¾ël¢vŽ2Âmà2‰¹q:.=Œ'à¢N|èçà"ÀŸä/^Æ‹ÊSòË Þ•åF^ 3ë’~ÊBŒá¦øƒR;ñÓtÀ¦ä9…4u=÷#œòS•ý÷Û+% +.bÉà2‚÷Ò¬ÖÇjÔã]¸÷nôh âû¶§øѽˆ1þÂwËË©—oír£8ÿ1XWÍòlÀmm¿x&Ô™ŸûíÒ¡Jý(cÌù¼ût\jµ´¸øùÔýý˜k.Oendstream endobj -6322 0 obj << +6659 0 obj << /Type /Page -/Contents 6323 0 R -/Resources 6321 0 R +/Contents 6660 0 R +/Resources 6658 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6302 0 R +/Parent 6657 0 R >> endobj -6324 0 obj << -/D [6322 0 R /XYZ 85.039 781.388 null] +6661 0 obj << +/D [6659 0 R /XYZ 85.039 781.388 null] >> endobj -2086 0 obj << -/D [6322 0 R /XYZ 85.039 761.463 null] +2178 0 obj << +/D [6659 0 R /XYZ 85.039 761.463 null] >> endobj -3124 0 obj << -/D [6322 0 R /XYZ 85.039 653.495 null] +3188 0 obj << +/D [6659 0 R /XYZ 85.039 654.646 null] >> endobj -2090 0 obj << -/D [6322 0 R /XYZ 85.039 571.206 null] +2182 0 obj << +/D [6659 0 R /XYZ 85.039 654.646 null] >> endobj -6325 0 obj << -/D [6322 0 R /XYZ 85.039 531.042 null] +6662 0 obj << +/D [6659 0 R /XYZ 85.039 616.379 null] >> endobj -2094 0 obj << -/D [6322 0 R /XYZ 85.039 255.047 null] +2186 0 obj << +/D [6659 0 R /XYZ 85.039 435.643 null] >> endobj -6326 0 obj << -/D [6322 0 R /XYZ 85.039 212.094 null] +6663 0 obj << +/D [6659 0 R /XYZ 85.039 392.69 null] >> endobj -6321 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> +2190 0 obj << +/D [6659 0 R /XYZ 85.039 109.735 null] +>> endobj +6664 0 obj << +/D [6659 0 R /XYZ 85.039 74.989 null] +>> endobj +6658 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im3 4496 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6329 0 obj << -/Length 3402 -/Filter /FlateDecode ->> -stream -xÚ¥]oÛFòÝ¿BèKh ¢Éåòëå€4qÚôj'»Š^(‘’S¤¤êèßß|íreÑIærvvvvv¾©pÀ_¸Èb?ˆòEš…~”e‹õþ"Xla構P0–‚²tp~¼¿¸z'‹0ðó _Üo&:±¯ãhq_þá½ýùͧûëÏ—Ë(Š<ù—Ë4ͼ»ËÐûýîþú†áonßÉàReÞÛ·»½G€ö>âÇ_?¼½\†Þ‡kx¹»üóþ—‹ë{˙ݸȑ­ÿ\üñg°(á¿\~”g‹'~Óû àËu$ïÍÅÝÅ¿,)žÓ ^5'…8Êü8‹ÎÅÆ3bˆ?4‰áæΓiïK ghKø×]ªÔ{{·÷š(˜ -ÛÃà/”†¼ÑêÇž.\`¸Æ¹Qhe‚40:”L gÆ]…RƒËÊ.UúAžÀÁÁ»ã0VûË¥bïS× ±õ‘_¯Ëzìz¦prÎ0Hü@åBáК²VqO{¢±èG~[2™Èe$S~ ‘Ìm£ü$ ቀÈ,–:R~ -¸ ñârBØöÅ$¢U4»Y”ø™J¾µ[RÉáM¹¯ñXõ@’†Q_Œµ¹Üãþ2‹äJºFöÝÓµˆu@ˆòj-ª~yïiAÏpT |~©NdÞ.J¤8(`ž0›b¬z†­›º¢MFÁwµŒþ„º!`9å~®ô‰˜ö¨~¨Cr22¿œ#%­Ó[MS•<æzo;”ÒÞúl˜>Ñ° ¤Æ”o+8Žï©w8eÐè(ó;«Æ¨r°áu~ÞÅÓð ^éå XAÀ£'¶;ÞÔ뾺Í8,Úb‹ªâavx -N7t,c}Ç“92»ÁÕäŠà.u†—ãè‡FK³ë„h™1"€AKâɈßÌ+ðŸÕ§Œ$D¤->écô YãË®h·dñ[6™ß@²,ÍE"I&tE+XK‘ãÜk.Ùà9æD°Ÿ^¤rÚŸm5²Ãö^ó*Pàkb¬yG}Æq±> nMkh (`y×ϼ`³²Ïr…ðy)<öü«5²‡÷ÖvM·=ºœðÙ†™£ò7»b5º(`³ eÜ5%£õ¸}S fû°¡ò KJ­ OnÀµ|ÕŒµïúŠ¡´¶Û?6Õ×i+ë–ˆ³,óøGºùÔSoæ>fͯ s,ìW¬*Jɶ}U"ÆÈ EÛ¶»×ðŽŒ ppÂŽËÎè¨%U<ŠÞ½B¬è B¤à„«G±²²9õ¥ì¹:LüÔ{Q ÅÚT2ÝÍbæXwmÑ8 -x~ùëŽ%6°o,ÄaüºíÍ]™ Ú°^Wì,\'™½i†9Gç¼~ ¬ -²œm;Š3òŠˆaô Ç|ÛÖ$41jÆöÏY{ŒEa8ÚÐ& Ð<_äëšÎœž\0΢SÃçaÛ]sdZEùWm"J±"õÆ»‘öU׊oTilt‚Ά'rýŒñÅiƉWÔÝ lz¼'Ýü×舧å=¾ƒdR­˜$Í×"•&ž½Ñ-]FIiÀöyò©C퇉^ÄYêç¡æœ'ú­`|v²Gƒ½tÐϳÇç4QVЬ]i;t Å}7…|1(˜Á[¦ü›ªØ5éO—ä¬aÓ=+0Œ@*£œÎ9‰Ìa€OíÏE¡Â2«h§Ú=›>œ¥ƒt.f0Œ-%äöÙ•ËA‘¹r`˜CÁtÑCàŠïwU/¸…ðŠ¦è·‘l-äÄh5ù¦žQÑ ðYZ‡=«¥F†èWXôaùYrš£eIÞ†5:‰ÙÑ%){N´.|éö×*IÀÒ+Á@€^¡ƒÉ?ºCS2¥¢a 0‚=.ƒ0Y?bÚÒ-8Ø°JTò9í„À ½þèl Nš«ŠÈ²9ÏNö|Ù g<ÂèVìE‡z”dT‚þðSß¡ÜùÕ(2{ªÐûaÎß~A)’lH²ÍI¶ðZžèÕ´,¤ƒ#dE^]\7AJ[¬;Ic‘gÀˆ7Hü`øνy„E¡Fò\=² Kt¿“U$è yñ=Çw¯Gòd&µ½Ô’w' 8 êµ3.™ÁGq¦6" Â’GôA"_?Ís怶*ý -t徊Ô7› ¹³!‡±SUëì j><Š|åö!ˆ*ŽS]w—Ri ˜½ºA>Ao?!œî”å’¢ù ¼&Øì·!΋ nj>âõwJ­˜8¹e"˜BŠJ(:NçÏLÊŽoVÙü~ÍŽMƒÈtüä -…yKa6ZÀŒÁ ¤ˆ -y|³25a8D™šÅ¨¥aâ}͸þhϵmrEPŸn:Þß{ šÎq•H²Ã²»µNò»Æ$0÷ö?§¶¾ÙœÙ,¼ê«á¡¯ìEi È_™TI ¯ÃŸqnÚ˜hØz¬ŸGó9 Æ…FT+O†õÉ•WŸ93ëÜZ‘šct±Òð /Y¬ë†ó4Êc9W•´ßî+Ý ¬A•Ðzøµ°Í4aý«Ÿ‹ç¿³^ïF¯„qô°«9çûª£R)jƒÄQj|¥¶¡âÈàkÊ»ð4Ô.Oð´Ern¡ZðãQ®Ð¦6Bu^Ü3#!çv~¤¢œ ¶1ÚÞ°ßH ê„ *²ˆ¨ƒ­Ôˆcl֯Ε–…á+à\¸92ìÝwóÄb ]SäÐ9ä>9%?½Fê1 &*¤j”ÜÒ¢ L¥ã…Ô‡è6o|Þ(2šúÈq€Ã¹¯ {VzòøB¡©X¯‰m.j–(Ó,œ©œîF†Ð½¨I¦ûãöúþ×?}ÈíŸ vEïx´4Œ½²rrLjÈ6 a+²Øzçø´—°ßy -|OÝÄð¹ÜRþ¡ò€•uû¢n_›"Ÿjô!8*ÔmrRç6¤u;ÙHÉ‹¬ãÁY'à+÷(ÉÄNoļLO-0­¸ü+êìÀúj[cd -l ú…sî nÀ‹=/œddä!‹Oà];çYÞcZzè'·&TNÞ 6¦lï]½uüi?i¯•­ÂÁŽ(8üÌCÞ«_;ÆóÏZ4ûû5ìóŽ€ÄR·pʲð¥ìøö9-ä1ùÙÛ‚VFû•×s9nzšÁ&Éðš½Á‰ïGâÕYg–È–œ¥»øœ L±±žLÊKZ ® *T´ ëšÃ1µß¨¬v~fÙ¦›q…@n*Ém—a´-ÁdŠs -[ÏÉ©¡”¯†‘»,ðRSý£Á¦¹àñ¶ÜÃÞó‹»9vXm–¦ø”u÷hB­Š¥ šLá“v7†¤%¸9r${r‹¡Joò\â‡$Í)œ"Ìx¯”øçªåîÞ~訮d'‚# )ë‚kÒNð Gžeµ£6V”›ê”e•c–.*¶¢MðUaSŠ<1-qZoÄ’K3ªæu›W®gä&÷pÞH{žV¥Î…¥)(¥¼QÏ&ˆ¾c•i\ç‘&S­ T¬«cú?™’¼SÂZÝ™7·‰f*º8¼_%DÉbºÿTÒ gÓŒÁ¨žK§nùÓ•O?”Å*’OWíf;÷u+ñ£Ä 8 âsbJùi–}Ÿ˜”¾² a=ÎÑK|ÇŸ¹¶:Í´Ï)jíg:ÿûÎ&êKe DN€ºjÒ±óP[²9jíä†d t‰¡¦<)Œ]½àô¥ŽgWè<¦†ÒaeóCù´¦Ê’ü´ m“u2Cü¢‰ž‡.‡~Ýn(Ê@QŒÚ†˜)T¾ï#rû7É™mxÛ¢6CFYÛ8÷HÙØ0ÆXïíщ˜8^á²|6 sÕ9 4n:ÆÀØFÒ@œÏs®ñsÆ”f±÷[Ëö:R!Wpt1)F§%Ñ?{œ¤<ÝñÓ~bÀ—²DúÞƒáO''ℶ¹eñËJaýbÝV†ª3€ˆ”²ùÿpÖùFEž0Í£o6*œ›*a |f'Mõ¦ -ÖÜV¹qêØÌtYŽ z_7/öZ gþ#L8/öZ’ÌW)7‹Í7y¬òÖ}% lê™2Òq `Û|öIÅ7·À8S^$ç_ÏxxV沘ðùò¯:œò÷y¹j[;¯Ù±%êäg ¡Ÿ&ÙäÙ äƒgƒrùñ«¯ÕŒ7L´¯dÅÓ®æÄA~  b?r'!•.¯n×Íz$%ä»~Oj€àoPW‡qæ7(a’øIftK)nx·¸e—æÞ—®¸( :§kg‰ø¡6Ñ7ÓÊ4þ5è«q0,˜Û¹žCB¿u± ‡„C3‚e‘9ï¼&G¯ò9="Öÿë×ISç1ò³(Ÿ7†¶ - /(Œ(:ûTc~ÅtÆð×Ò<endstream +6667 0 obj << +/Length 2561 +/Filter /FlateDecode +>> +stream +xÚÍ]oÛFòÝ¿B 8 +¨hîr—K¸‡äš´é%nÚ(ÈCšZ¢m©’Tÿû›¯¥H‹JÒæP Xû1;;;ß3T³þÔ,µag3—ª0NÓÙj{Í®açÇ3%ÑÌ„Qbqëéòìü¹Mf* +³(›-¯d¹~üû§'¯—Ï~›/â8´ ç çÒà‡gs¼ùü[Î*ø¯äõos¿<ñò/¼zrñ—~˜g¯ðÜÅrþaùóٳ倒… M#)œ½ÿÍÖ@íÏgQgéìÆQ¨²l¶=36­‰e¾9{sök…÷ÌŒOM|ÝOÜ×A {p]›o/söV8ž4ˆçó·+§@»AÅ\ƒØ…VÅ#GÌ;&Dk4¹xÌïžòö1ÜæuU„ö±7yŒHF —i¸òÊB 9›½A¡uõ6ïÊU¾!K—ä?xÌÁ ïojædû8¸5ñ¾r +“dÁ‹+¸§ˆ¹—k!iïƒoJa1g Òñ4¸Ì™y ÈFg#ÞõE…ÇœÁ¤½²áXÈMѳSæ’/úXoõ(Eõu|r›ßŠ9Å õéŒ +çò¼.—Sä{á—`8K!RW¥A³µÏ1,•hÇ+Чâä²á â>‹ï’ÓËÞ¯úyK6š„~åd™†ìß RÞæ/×O®êfÊV!@ºØ~93#б×í²âÛ›âˆW߆îÏøÄ +ÐË cV9 \¼Ç A²q­WÆvˆÊü2NrJYÇ´‚ ŸŒ•Œ=Σï8.æ‚Çw¨0$…¼#ñ–môO9ˆ÷ fÍ +&) m ËÔ0{>JÿøݔҨìWÊ„ +ÂÞT±ª’b w'ÑСÐðH ÇX,Ôf3‡Yœô©=d’¥3ÔÂCjQÏɬ$¯}Xx@í]Ȫ¦Ðr,€|ï 0ªH0’U ê•ö™1ÝÝå‹Áã|œc+Î,ê̈ÊÄgUCs%φ, *6ÐIà/ûb‚ÐüfŠ!Y…ŠƒÖ¥½*82nL¨"0n“†±3ßdiÂÄ¡3?ôí¿nü Ž$ÅâŠ}¢b×}9ÿ5m-m¨ÃÁ„b%1 +µ3 ²O篊aSABîý…å<Éô ¬µ{”úŽŒ nÄXaý…âqÁÓ ÃÕ¦”`ÓR¯`˜Ô`°Äɾ\¬÷08¡÷6_/´ Ê'Ê«Žc&ÄVùÁ[(†ÖÍ­x-†©GÑਆÁŠ¨CöÃuT²Àq™ö~ ä$HÈG©a;%ÑC9D.Ô½kñi—S'‘øiA0‡3ði6“‰9ü3h—N$¼îPrÅ.#ðT¤”_Ö½Ûr’ z·w¸9f}tNòR‡>ªíšrÕõÒuâ§ß¾ÃXY 5ïh²'š¼…Æp Ïë\Yni¡êPXªàŸ-/qE£5ʸ‘0GöyÆ‹Þ%µÁSßþëšâW^vÿàí%—߸S +f4ˆ4‚‚—óAИ[^9° &Ü©xÒ‹© [.cáGt‚žâ °OÈœëeœªÏ²d¢ 2ìò½¿Þpq"—†4Ф£ºo%™Á ”y¢‘áÇ6 ¹›ÓÿûŽ¢‚Ÿì(²´ÿoÚDßÞ¯ w£NÓƒ>‘¶¡àûDÞ¸øƒg(%òà#Ct‘,!&£¯¤Í<J¼pW’Ï„k²’ ½ý†[Á6ß·«ËFšã1ù–v>è_#ÊKòºëò‚•Þ3©Üá1‚zèÆŽ­à½Kk[ÅzJ_A¯úúñsl·ÀôTõ +k#(æ{“ÄÎh/-_yS"³×EÀJœ¹Š±cG ¯ Jn”uIœåÚŸû +à-.Ù?Óž™0rîÏÇÏ*zÿ0\šoZrã‰|hny]"þ*ç$öI,ð›3ÀU‘wûÆ{ò„% ëG_Pœ$@è!(¾è„)N‡ øŒA«¡)¶¤¥ÜŒ¡ð‹Gß<ÒÉ”ÂÀ*7[_\Òã±ú0d¯Š™'ò‰öaR&TO:î HÈqg=¦Êw‡O{ó‰ÎªG5QtÝä}Y 9&غÂL͈Qyç›ôÒW(eaSó‰Ûv܇g=DØjw"fj*MšŠŽ¨®ÔÃþéËÏõßKú>ÏØó&a’¹¯Î\-Ô?ɨú0±G{ŽN|Ý®~Û7ÕœnÚKè³UBlÕQ{{†{ žÀÿãÎPßendstream endobj -6328 0 obj << +6666 0 obj << /Type /Page -/Contents 6329 0 R -/Resources 6327 0 R +/Contents 6667 0 R +/Resources 6665 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6302 0 R -/Annots [ 6331 0 R 6332 0 R ] ->> endobj -6331 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [413.168 584.796 539.579 596.486] -/Subtype/Link/A<> ->> endobj -6332 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 571.247 216.819 582.936] -/Subtype/Link/A<> +/Parent 6657 0 R >> endobj -6330 0 obj << -/D [6328 0 R /XYZ 85.039 781.388 null] +6668 0 obj << +/D [6666 0 R /XYZ 85.039 781.388 null] >> endobj -2098 0 obj << -/D [6328 0 R /XYZ 85.039 489.232 null] +2194 0 obj << +/D [6666 0 R /XYZ 85.039 761.463 null] >> endobj -6333 0 obj << -/D [6328 0 R /XYZ 85.039 453.822 null] +6669 0 obj << +/D [6666 0 R /XYZ 85.039 740.731 null] >> endobj -2102 0 obj << -/D [6328 0 R /XYZ 85.039 127.793 null] +2198 0 obj << +/D [6666 0 R /XYZ 85.039 364.469 null] >> endobj -6334 0 obj << -/D [6328 0 R /XYZ 85.039 93.047 null] +6670 0 obj << +/D [6666 0 R /XYZ 85.039 331.969 null] >> endobj -6327 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F38 2997 0 R /F20 2961 0 R /F41 2994 0 R /F62 4047 0 R >> +6665 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F41 3054 0 R /F64 4225 0 R /F18 4228 0 R /F62 4159 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6337 0 obj << -/Length 3821 -/Filter /FlateDecode ->> -stream -xÚ­ZYsÛF~ׯЛÁ”ã>òæµÛ[òFÜÊf“<@$$b ZÖ¿ßþº{ 9©Ú-• -ƒ9{úøúýsþüó,v½0?O3ß ³ì|µ=óÎïiäÝ™¯3.tÊÅdÎß–g¯~ˆ“sßss/?_ÞûÄn‡çËõ¯Î›÷¯?//Z\„aè¡»¸HÓ̹YøÎ/7ËËOÒÿúê­6Aæ¼ysýÏ«%:"ç3M¼þøáÍâÂw>\ÒËÍâ÷åßÏ.—–2{&Q‘ƒ¬?Î~ýÝ;_Óþ~æ¹až?RÛs}Þž]n…ú^ŸÝœýÃn%cѹ¬šãBfnœ…§lðã6Äž{³áçE9m÷ÐÅPµÍâ"ÈbçvOÐNœÊ<©«G3uj¶ÚÝï«¡¸¥Žº”Ž»¶“MV`MG#%´;5›{p‰„“M¨ -|¢=Êé" èm»-*¢#ô‰Ém]­°®ìeÝÁmÒÌõ“X—‘ü"Ñ‹,t@}7lÊî%Q’ÇNQã:›v¿Ò†…ËüLͪYãJñ#ˆåÓÎimâ¦~t~á‡L ÎÉcZú$ÿ w@Þ“¼CÖÕÀ—=gU`ŸF^né‘òy!ÎFEE]ö¬ef«+ŠF&_-#éø÷"1k™ŸmóêÆlÑ}ýréØgy ²ËcEñ6 ‹ ¢¨…tÌœa#CÐpô¬êªl°åлÌï€ï•]¸™œläýRL† ¦ò›çG¬ ½¼ßaR»•:Æ°Nî#Ãr´:ˆ·‘ö¦ØÑË®Ÿ¤«ÆÓ ,ntµ:»hÌQ‘4”«à‚á*´¡mì…ƒÔõr¹ð/2&M`kx’þÒ€&\L/Ïñ2ÜÛ˜%õž YK?#5£ÜF:CÊ!ÔøR­´û3¤\¬@݃¬åñ›{l†x©d9 øêÕTœßö‡&ÈxNäz,/Äס+VƒŒXÅ -ü%nÐø¾çË«’'ÁTÉ£ÜÍã4ûR®Êr-wtÉ0pšb‹Í“ÌyõuÎN¼Œâ c–@í p*·Tb‡M1¼XèÕŽN×÷ÍÊ«!êwIQ¹Œ‡_¿udî¹i”é:ŽB?Vv_¬n”b ‘Gñ -‚š Sq7b:¬,Oœ¤ CRÔ%–næ©…cöϘ9Áå–\ä C)‚ -#;pp¾fž2–ÏÜ'!Ùfæ>¬Ba®è -*ŠÞ*r*7«FíZ aC¹Ý‘ΕòÆ0ËŽ’–C/¿›¸QGLë)˜²è&À¨Å Ü( ¸VŠÖ™s#B 8ÏW^×`d”ˆŸ¡îJ‡É[i©÷}u %E× C‡¶•­[&{z øÝÈʆ·)ùzpP t;ô±Æ`¯kMDUòT mÖ36x_ÂÔƃâ²v:Ÿä­½“§Œ¥ '¥Ð5Àu;âRÄÎëfŠÊãÚüa9›g× 3ѺÉ2ÆÞÄ`aœj|çße×ʤ×ë-#A%a -â[ ×1ú#«õôö±(¤D1!jU·ÊMÁZ «F¼¶Rãþƒí“5Lî"î3IOçì!¾•°Mæp¦x§™J®çù|ÊÑ— \Rˆrç§òžÂa.‘Æ¢"ð‡é’h9&¬$ᘣ0 üüvF9Ny6“ŠòÔÍâT2© -rÙš_1 EòÒs”õÄê@k=ð}eÃy¦ž¦BmŠÞ–è9D²‚ wöéͽD Ý!«8m{ݽÆqÔ~‹5Šlúèùå0ˆ§éeUÑÇH΀™g…ívÔaQçZ¢ïSãëŽ{¯ üÁÓæb¹Ïá‘:d˹ïe´%£Gž‘xoX¸ìÙsµ_4N.#£ˆ~Ðz< G× Ù<$ÄSñ½áP@tïJ¾/£h]²k§K‹Ý®¶¡ø$ hm*£’Èж°Ò®žΫä?.@óÚ¡¡pªT3Mnà…öîho°­:,מdÛ÷œË_Ž-+ -È»ÇÁy”âùJdÐé|ÁãÂìu1ÙìÔ -£€üoÛÁÞ×o^aa|阪h«˜]s¬%AHVÁïU-=åWv¦Õªʣ˪¦Õ½ˆ`R~D‘<Çß4Už$øæȯS¯ÀF)Y¬ck iyŸÐù .ŠwZq!ƒ¬ˆPe£XèTSgo¸×])¯íË?ö%ÛöQ\-^m-5ýЕ²hrQ’E›ª÷Ø°I='E@œi`ã¡E›A:où&º“„%%8ˆqA;ËG8À}-CŒ‘Xfl*Ô„._ÂUtµûá˜J~UWƒF%<ØΠƶhŠûr’ÑiÛ g_Úg’½Bˆ©Œ»§æs>;ò7%cú–KœÌ±>›r{HÆúÄ0K)Î|6`;Ž=çÓ œtB¾²!1¢ÕKGày_Å¿’Ç¿>˸ÛIÀQÂ×÷õµ,ú¼}“RVR"œ¹W˜En˜|óZã”g=}ÓU¼X==c¬è!笑Vê²Ð¹yê9žEçè»Aw‘·=pòñ&9KƒŠ„hüž¤ëO¾uÐ,ÁÚRS.GGä<Ô’¨ë­ÎÚoÍçBs†)eê'ߤ¢ XJ36FÌ4õH!ž{SO?5±gâf/&:Wvç |3ý €+yé´ö2­¢h­—Aý˜ãÅHâGïRtÒÉÖæÉ75Öojß Œ -ƒ¼I¾Àtîõv\¯@ÁPfk©A‹r K½6«{”÷»²XY•j¢Ô´ò¡¶IÄ~RÑùLþ`Òx%´2H7­¸êÊ%]àñ®è‹€\c.û9F0Ÿ|-ÒfÇá0°Ótbnœº´v̾ŸºôPs;ßye|Ð}Ç°ëç>Gý¤®iZð2Û}ÕM'¥¹0š/øê7ký`sšÎ |PYKójùFP…&÷3ðñ£ÎÿËzÒöR;Y‰ÆïÞ1ЃIЯu¬½Óñ«ËåÅŒl.¡’W2ÒoXÑ3Íäéî šÚPaÂÉþø—-èÜjb‚û0ó»ûSë·Ì/Fž‹iL@rß›}Dz+¨£&å¡TeÖÒs™+戌›Il¾§|Úƒ«“JB8ÁòûdUÉ ³£Ê -ýÕÑݘàþƨÓ_4¸'P4öt´ÍÀc)mOúë$þTÔñ ¤Ëå5è8„©#ÄW± »9m¶>2Òï‘ÀC4ƒ14E‹AÑ3ßã"oš¦cA¥ -ÐFRÖ£ ÒøkÁŽiÝo«®4¿†ÀÊA¡ÆPªuÙ­”F‹ß—)‘ðe²òÙ”ç³_Ãè_øô?ý>p¬Ï…n>S‘ŽƒÀ |C ä†þ1½æw„'ÿUa)üendstream +6673 0 obj << +/Length 2015 +/Filter /FlateDecode +>> +stream +xÚÍXmÛ6þî_a( #Š¤^ÛdÓ¦ÝMö²>¤‡¶[¶…È¢+ÉÙ] ?¾óBi%[›ë%_ ¬)r†ÎË33”óþä<1"Pén=€´;PiÚ-¯ñÔM›»aFò1±YèNS~¤Rï7©ô [L@¡—9X‰×ü“WÄÈz•ó÷±¡Açña¥%X]e%`ø:åôRþÿ9XEõHw& èðà5ªÍ@°E îÑãk0G—JOúMÇÆ"H™q¹ËëœyšÜ¸ÝÕŸ›¹CÉX Ïà…®P0ËŽ_n(gWC‹û†BÅOÀÏ=ewãbé³núÚE‡º(#;ìoöÄÊ‚¥ˆn´‰Naöç©„±•`J63mÚ#AçŠô¶‚œÉ +Éqzä:eÉV&•…&8Ix “f”H™àâ +)®øƒÓ(*¹K£)¥Qdº+p¡äƒ9gO&§íwm-Ó»PÈù;ãÜɹ2…BÉ\v+ÊI“ùÈ(*YžÀã'Ò.%IõßÓnøtÚ9Z¹0 +Ìø‹=íúvXÚ +A@@4ë¶hÚú'ÎœIBFŽôW8Ó÷¸sÆô± _XüÐà¥"ãPÙF6´WÍá:ùP¶%£ïÞÂË/lÕØÒíµåb0_-fB¿få´üKBÐ)-x\µ.Z$ÕC“? ‹ÛcN£Iøë*jò,:Ú04Æûå†IöÙjnK(Rå¼ÆžªkqÂVåOe<1é¬zTÏb¥%¼¢ù## C*b±uCZrë{ÞqjÆ=r'jMDÛb¤‡ TæÝ °)qvµÞ’ìP¹Á#Ë’?¸P!µ$uèk´ ú<.Íó Äö+Kèð+K)Cä…ÝŽ-öøucËbõ€é†D–1ÔOcãéÁO6ÅöXg˜[Çlã²ëb 9(?¹¢s™ïeÖæÍäy†ønš6ßN n–HxW@õÔ~”0ÞPRã«¿ä<ùœYÞ’³àè ÷Ž‡íœo>aÊñ–7uþ)¯ZþxG¹w;ÚÂin—U[7ÞÔvß“²-è¨ãAƒÓïÎÑÞæõ'éÔ¤ŠI?”‘ˆ“/‡µN.D-ÊâXÀ¡ûS ª\X.Rðn®ä\âë$™€; #£¯À;ê‚HO:qêÀAÓfP=Òp€bGžÁØ+¶;j&ýÇÜH òI´g«‰:@Æ©P²Ãytˆ«ãCмvÌ#ÓXè¾+øÖµ­e—ûÏOôUÊ ûЯÐ@µÀY·E׌Î2R˜|8——òäñáäè8ªÏÊmöa!Y€Ä![™“ íã±$ÇYñ©¡#p Iï¸@Ü9FË|+$ÙQÒÚ:® mµŸÒ¦L•èèQ›ƒ®äü6:*íµ–*ÙCW"QÍk'ŽKâÎÒW”©´Ÿx9@ï7vBœæw¬Ê‚n÷‘?'=25 ÑqNOFDiWÒ +FÅšÁH¯©@Iâ`½jŽ%ERÔEWL¹'\ù9¦2—ë¾ÆÁ¯-¦¬bíÌ +(Àu%/v&& Á tÝbu,iäÄ7GŽêÇ3?Q§V7]óIŽ óÃÃö¶žj„¨FÙØzŸq'HVp¯GGWa7³ëAÂeݾßéK:˜ä–±kxºÄÜ(ÎDƒ¥¾;ì;'ÅUË°a‚ê… +šœ¨\ˆ©/ÊÝ£ÐÉÓœdCñêna5–Br=œž= Jm8i"%Ñï‹N«_÷–«0™÷ú,ú+ž¥”H¨Ó +ú/ä+ƒíendstream endobj -6336 0 obj << +6672 0 obj << /Type /Page -/Contents 6337 0 R -/Resources 6335 0 R +/Contents 6673 0 R +/Resources 6671 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6341 0 R +/Parent 6657 0 R >> endobj -6338 0 obj << -/D [6336 0 R /XYZ 85.039 781.388 null] +6674 0 obj << +/D [6672 0 R /XYZ 85.039 781.388 null] >> endobj -2106 0 obj << -/D [6336 0 R /XYZ 85.039 559.099 null] +2202 0 obj << +/D [6672 0 R /XYZ 85.039 761.463 null] >> endobj -6339 0 obj << -/D [6336 0 R /XYZ 85.039 522.834 null] +6675 0 obj << +/D [6672 0 R /XYZ 85.039 740.731 null] >> endobj -2110 0 obj << -/D [6336 0 R /XYZ 85.039 412.725 null] +2206 0 obj << +/D [6672 0 R /XYZ 85.039 643.478 null] >> endobj -6340 0 obj << -/D [6336 0 R /XYZ 85.039 377.315 null] +6676 0 obj << +/D [6672 0 R /XYZ 85.039 612.19 null] >> endobj -6335 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F62 4047 0 R /F20 2961 0 R >> +6671 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F41 3054 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6344 0 obj << -/Length 3290 -/Filter /FlateDecode ->> -stream -xÚ¥ZY“Û6~Ÿ_¡GªÊâà½[e¯cϱ9^W’šâHŒ%R&©Œgýö•ÚTÊŽF£ÑøÐGMøOM²ØÂ|’fʳlRn.‚ÉfÞ^(¡˜ ÉÌ¡y5¿¸ü)N&*ðó ŸÌF>±Åád¾øÕ»ú×Ë»ù›ÓY†žýé,M3ï~ª¼/÷ó7×<þòæµ4¦:ó®®n?ÝÌq òî€ðöû«éLyïÞ@ç~úûüç‹7s+™Ý¤ÈQ¬ï¿þLp„Ÿ/?̳É#´_Áôæäòã(”þúâþâß–ÏE^uL q˜ùqªAÅGÔ~D¤†~h»jgÒ©W7ø›xwûUÑÁÁ*<â‚g~ â h¦ÒO=;¿…ƺ.‹A¨’*&úu×®w0¸ÁÙŠ‡Ëb½6;«©¿ÿ‚—ðËš·ÐøÀ£í·­:¸¨(ÒÞ|U÷2ãífäÐ¥™Œ„ꪞölPˆIÚï -7S¨×œÒÀl¦½—åP“È÷_×]U"Ð0|âÑE»)H_™òh¶å:’f]u=ç ->[ÒæÀaUH‹Ž¿ý¸…Õ8ðæ=ô¨¡,|&a轆©£BÖCO¼ÖGL'Ü‘àÚ“pÜ0‰½%j·åøA%Âu? sþÜ@)t@‡`y{w…@xÁ#Ec™W¼¯¨èîЖ…tŒx 8ÖÊv‚D‰®ÜÃÇtv‹=xÚ€·_P™·¸OÃï·¦Åádž»EÏßî íe×"ª·LzA ãmJžx|¨6Û5‰…=ÖʵâÁtêð°Q²ÏõëWò8ôÐØ(/âNi®©¦²º{œ‹XŸHddÀW`dÀñß­Yp¤¯e]W & «ÁFõƒ„³ªÄ 9)¿i›µ°/„_U”ønEü]PÀÖº] -…<“–ÇQîCd6Õ@šGVçoøèÃÄ»¾9( ´2-Ò<âÕ¨ÀÓAðƒ FˆÖ•L"hnƒKv¤•[šº²…Ûª„ÏŒÇÞ’µ·ŒÐÞÒà —¤«ž­Í‚—3ÞƒÌ+¶ÛñæǬ¢>Ž½r]¦ -ÔE•šy«º‘Ž­[z—@‹ÈÚ˜ @ËahUY# -J”‡'V¬YNÈ}eVÃø@¼c»Òñ ß.ŽËí²Rp€:4ÃÍ\- ´ûf8y¢ ¥‡òã µ¦ØA8ão§Úø­Bè¨Ä{× C@90„ ·Â>¡]¤=]ÇRZ±¤Í6γäéñ5 ÃcWIB“—ôCXˆRh¬p_ˆR¾²Bx¦ßA4üGU<‚¯  º YCíÝÿ/Ë…sûÀeÛ”»®o]nrý$ÜD¹eñU,‰Î‚½ˆÀ¡rÀnBœÝ× -Ϙè¹Ç¶‘ÞÚž}t4²çûòŒ½3¸´µyŠ^œ­vÏÓŒ?h ~ÐÅ×ýÐè+i*ŒWÓ­KŸòÀëz¨Œ<;Ð>F~ ¹ÉäÙq‡€ŒùÐI²Ä@! Sï¦åUýNPsxøêûC„¶­D(®4_|­É ró8K»ý@!z£l~4ÊVúS'‹?Lõù“4'ãðXG~y -žì]ÓäŒÃT±¼)û`º3²KdHc£5ø¢®iRt¦šò™§žýø†çî8çÛ„>&/‹šãÆжôR6m#ïŸøÈöãÄ40ì*`Átøˆ1&ïÚÍ(ðy‡0™”»¡ø*,ÃÜD±!âËŸí*Lû¨a\ˆÎNó†„f9ÑŠ=hÒ$–5&Ýså°›Äàv!ãÆ ½!LîYy™ßõöJÿ\|º–ȃDû2Q4Àaãæ"¨“™Š”Ÿ î3¿j›¾5¯Չ믯ÄWãmè±Ïêg±)§B£TÞ?N@8J?ó³vh!œgïÐòA±Õ%PAâgqvv7Cs~;¥´*½·ß[Â,ï ±¦ÛŸézV8&¾=£Ç ññã¯s+;†ÒžRiâGZ t?Ó0ðºaÆ”aæPêÌÏAsLùÏ#¬2?Ê (ïºvÙ›þ#ð}qúù¼\lÀô¡¥@—fŒúŸ¡FÞ|š³CóÖy+*ˆ}0CÌŽbVÔŠ¤ŽÆ–Ø0ÍýnÀ¬›]__1({Ž"Ð1Y Š:¢c…\í‘ÐÉWl™ÅÁ“ÒŸx螃ýp’š¤2õ®ý›íŽt€Ó' ¾Rê<ôGšÓÐòK§¡f·ú綳Ðwö»¯Ö’îcí$ÄMSLËÁ&©=ÖÅ9˜°uK²eõiZ|d±æÙFÂÍÎí'“„Nn'²ù;î<ÖýJhZþåÍ£‰¶7ά”’Rh¯«—+›ì„˜üPxüíHèC¼A­$(yn‚c œÈ|Ç#¤‘Ð=òÆ@:ñþ!ÿ²«òg;s(’uƒ@ÐtmSéÍ©`)ÌÿIt”ÍIPTYx”çv³ <»¥»ß [[8s”C@EA~3Ö-(®ýÆ£šE© ž›ƒn>0.ÿmG7Kyn¦M¬F%Ž§#æ,Iý<1öšÃ  E"²ísñjSØ Š¥ }SÉÙ€'f•àHæ””q€,T3 @†$³›©T®B7 -rAÔûcñöøÜ0l¯©Pi¢~›¯Aür\Qæg*9®‘æ4¸„%NƒëÌn#¸ÎmgÁåì7‚ 4$·“Á׆/ؘ¾¶cÀÒ~ªk}³ §yChäÖ!†˜­!WÆÅ•¦®šÚ&¥QÕV,€­~T Sv´¼žßâa™‘cV_P³hnÑð%BBëg¥Y€¤³µ%Úv')©v+] tdëZØ.M5»Ý‹÷µÆB4ƒ—+fc£.Xfó•J¶x8!Vac²¨a›×#«Áh„j§ûÉæ~&¹ŽÙ3J›¨ŒcdäÝt þñMe;6UìÕrþE™X‘¢©¯|šªœ9¥ñ×)Öæ\†TìðzÜQ³äy”Šs¥bë’‰ JÍ"*cÁØ+’‹ÊgÏ -Ûâ'W­­¯)Ÿ¸CÑ£ÔI& b#-E:lŒº o=¢Èžûؾ¹óŠÚq·­©’ïg×o³;¤.,Ø9Gêy˜ -4OEhh|¦|^ªs—*„õƒëTNYî¡°ÔŽÞ]ÑÕH«ã\9îJë›u@É”J`}§Ü€´žŽ]¢øqé¨dz$û“ÕBüæaraØ‹n!Ú²e -˜>RÆ©ÛTÿνwƒœëœRÝc§Ñ+6Û'› -¼ËÖº0-å ©=ÑQm5åBžTºÍç7›ul ®lù—ß}™¡`ÇVέjSÆHM-S"î¥Eõ&VÄ ”@süfE,Ó‘0Œk©ò!ÛîÄ0$p¹UGߘt"Ùd’3h\Ûo)Ù·èxì Á„ä#ËHß„º²âÁ÷µÔ©‹ «Å£Ko‹_ÀLpGÊêx¼Þ¾&Å)] -E_œ©yPÉ>h¥ü\ÿ•OÑ -¿ÇG?E£ -ƒødC‹`Ã-¡ÞçbÃHhü,“~%QJ4ív~¤€„iš›0@J|ÕóSê²uE…·É÷‰òƒ(ÏC&qÚ$üx&¸|·Q“×-ˆ9q$¶3‡/G,n¾®tî')ièg:¿$¯,Ïù«CNÿÀ¨á8µ€[­«x”²ü½-Õrßd:Š¾· -2·*ˆ]¶)ˆ©Ñ‹ÃðÒ¸d.‰/}³íŠlMÈâ×ý‰TÌÔ~?&óŽ_%pT¾-¸GÁünjxßâ^C“` Oqõ™W´ PwôYVEbx!Þð,øU;–þa@£JÑ›D XßN¥¾`Ib+j½2Ÿ•ñï°2 -ëñB¾ð´èû,·íÖ<·²ïûcÌR6óa¿næýÜYu.S«i,vCPt·®Š^´!ãƒiP’ŸóíQ³/ñdçbl/z ánsásG_E8kF9%s¶_å@æËbè…”#'Y¿_Ñ6V*ÊcÙÄ1 ÿ¿}A¦‚t2³2ó·L^¦|}¼ˆÿXÃë|œÂ“Ÿ…'j ±Ö ¤s¯ùFÃP?×¢ùC &rþ¸Ùæ#endstream +6679 0 obj << +/Length 3529 +/Filter /FlateDecode +>> +stream +xÚµZ[ÛÆ~ß_¡æ%°¢97^ +´…;©“ìÚÍnáN¸µbM‘2Iy½@|Ïe†iÖ1š¬á\ÎÌœëwάXDðO,RF*[$©Uš.Öû‹hq#ß];#Zè0Š ýõöâÙ·&^ˆ(Ì¢lq»¥)·›wÁ7{þæöåOË•R*:\®’$ ^¼\Šàæøïv¹Ákh¼á)o~ZÊ4xýí«_rÇÕóëçØõÌyy…ë®o—¿Þ~ñòvr’•u¬ð(.Þý-6pÚï/¢PeéâÚQ(²l±¿ÐF…F+û]]Ü\ü} ÂczÁ«<^ieÂ8††„9RÁvB‡B ïvphEa$³'éЪèp‹¦«2ijHã0M²A±^fÆL%qÝïzdwá៑¡Šc¤°ø°a¤³Lñè¤MçQdzW{±xÑÀ‰ã¡TJP™„pyw*‘zôãv·Ä­¤Jƒî¿iP¬ñå/‘ÐëŽGš-þ&Nn–2 ø»ox|ÝÔ‹¶çœÇ*š‹‰^ŸPŸÚ7¨ìÖL(qkÛ§ïé5´îy/Dº¸G+>½.a†‰ñp8ã„Ö¾¬ï‘ç$sT²Œî~r•i:þæø£‚Ê^ ¯ø»©í¼9­}t³_rÍûoÜ¡§$û[KÆkttA¼OÍCÈgÜçꆿߖõ†Yž"Ëiö?bGst»Ë,h ÏÛ#,®k> ˜¾v|ÓÔݱQ)!Y­(û–ë¶éšmo?ñBoAlæG?ÑmºæØ:&XZ?”–ÊÖÝ å¨@ ­å  :]I,€Q`Áä"†îlàqS¥É„(€“"ÍMXÖ¬¹<±¬ÇÝ÷N {Ø,<µAg¡ˆ’Å*Ë•êwù„•†³'àæV¸,û}~j%’0M9½DúÁJÊ0ÕÉ`ê2ò8 ðþ2„ëÃ+c"à*j0VEÌØ´ ª,êž?ßXë°“ú`Ï=ˆ¹ÙÚ c¯ê-#±¢ñâðDÁÏ}¸Ü·ù¾óÑ1a*Ò˜{äà©Ï Ê,4nÃë¢ß5Íæ©sÙY ­±ÖC\…@^GàzÑ2[Î=ò½-‹Ž‡rrÍØŽhhW”-A`FÑöÿtÜûPV·îœßÄ=«Þ}±a‰ Xf* ‡²ß¡£Žm<ç¾âñ¸#xöÑt<¿ë›¶ 6i­‡o˜PJ³þã/Bé4à‡›‡¶Ù–UAmÐã¶Î÷…‡¯"V ¨ØRá³…¡©Ý±|€æÑ2hv#št¾D¬ÐŒò÷ôÍXff€çìé]0Õ1³³AÓUÚVrã>з%,³çéE¾Æˆ¶Ã8FÁÏËTsˆ‡‰,0lÕN-ˆƒÐAð~Éœ‘Ê…Xa¦xO¸ŽÝw_5wyõ«‡güWâßPJÝ9I•†j°–C[€Úi0u>y¤ß„¶+þÄç&(StŒáÎ7/,;Ý®A¬‰}Ѷ°'D“ɶÑd[Mlw¶µ‰`cw?"M›tEÝ•}ùÑ{AêHÍwªY™pÖvêmÚÑkrO?ÎÛç¥U0§Ò®X燲'ãŠtPqtê'ž—&•5ë¦4èRâ™nÛÖǾcÌDtá7§­ùƒ(üz ê0 nŠ0ºú|³B‡Û ëˆßpvQøœ"åÁ}¢ù†/žßúÜ" 25~žÓÚh§Ý󜰂–˜Ò½z~ýT LÆ@Éú¶áÆf¼9HñÑîFákÏmÙ[•Ë9¿âˆØ '³ÊZ²b'ëièAm–N…·wa-'ÔOÃ6qF ^vJÒXŽ~–âk´AérCp.o§YÞH2Fµâè8L _®‹Kî¼ox¹“Õ ‹L‚K—® ÔÔ}Û ™À¼ˆýóº¨<²K$$6.v®¬Ìüãö틘BàwÝnÈIÂƇ¬ zj·ˆ5ØöT9ìÃW%Eñl yœN.ÿtÓ¢ÍR²HÌ,i€ü”éÌX:}~·´Î! nœâÕ‡µMuûI.ÝŽ%¹œ±áìvXÁè¨â©ä`”m>+{àðè°jkö oh ã|æœ2UÊ:½þÁ§Æ '¸;r‘ +·ÝØ€ͺ±p°¶ÀHZÂÀÙKïDuvh²–6Ì cQF’MfkW$à Hæ KŽÿ{3–ÿ3–Z°K-]66TË:î¶Ù&6ÏÌXÆ™1úÍ8C™%§f,!WeëzÂŒsÉì7Ì8ùœ ‡†MÒh6å(hßûÌp“þ¯öÔ%ðÂ[Þ—?®Ù®nÅj áIFrŠŸ:ø`9§ñÐ {ÿW¾O„Ij†L—ÑÿÚëkLqRŽ B›ÑáÓ‡P–iw€tJr†ƒÖeã5.¿åö‹På˜mä(L‡lËîØ­F¯¥#>R§–ÀŽuxy?ù°oЬË}Þ>Z@ +áÄÀnSOçægXo8¿¤÷•z4@%:*Mø1Óê\›ÊZc¸yïã»Ð)…éÅcõ[^UÅa¦Ô;U¸œE<3A¤ÒM–â …¨u¬«óD;´>wž™uX‹ÃXªpèq££ïÈ҄Cc=Í@4 Sð¡MJ. }.ùsš Ø\ ‚†]XÓeò &¨ØH·Å$?¸elèbý ½I@ƒW ©àø±£ª;‡Î‘ÞyÝ{¢|+™i§hØÄ–ÌL€•ƒo\ /GÚó0Cz^rM’±»²}ÖP(Ä‚~}EÖ"'˜Üîé:ð!>†ö(¤8¯Ù­]nPzîⶆ¢ ®v\_—Í+‚; +!)ÈÜHˆ©cY«$_sd.3¦â¡H±¹šƒ&ŽÒ# 7¦G0‹\ÁÈ*‡lt53™ãjò[¶|,¹ºˆKP4ç8ØX)Šà+ zg|F~e8QYebWN1fd%vŸò˘Qyq|¸ Í¥•cÅ &»˜NnÖÎû7åü… ’žE°ëóVûÁ3Ö „ˆƒí%\¿î ‹> NËòà¦.=÷¦}Àñ³~+›uq>\ìÿàI×Æ +0Šsªo®‚a_ýÐvXÚö»ÜZÅäÔž<%á':d6–…c‰Ìb”jYOõšvúÄ=C–?ÔB|f%âI]÷棗¶<„)GÓnìçc`í«z­‰ù”CÄ닸^”"ï»ÞW?6@$ùÌA|{gÀ„cPcÐ&<¯ZB-iGl7À¼»œGÇŠÇhÌ®þ+6¶èˆüirM[¿D&Bߧ)tÙâ]~´8›T‰8%gzÇLFh–ïëÙë¥í¥Ç^ø->qA¥çø"SÌ?z»ôò–»Ñ}iËÝ2±åîÜ.bü ½³‡ypUhÒiKŸxƒÓs +±;[›-×øäaGî™Gh§´‹àø1edí±@›¿Æg.n6ËSOªÂ0wï/m{ë!.¤B3¹D(mÝš1|ùõ€( 8îÀ*Ö´½=WÙƒø…ÝpÆF­YÙì#/t¸—lOfÝù1åÿ´ÛfyZ/Ì\"5>"k +ÇìQ°}ò:–‚Ü;nXaŽ/jiÐ×c±ˆËmG‚YLìãœm^!{7î…ËŒ±§x’8ìÎ>Aåqø5Ïã¸<'ÇN<ˆ}Æ×gMe.Ž˜çìqPÚS/…lc(´cI•\ +zn°Ai:6Ià+µQð÷®Ø6­·<žI /fEÌéÞSI-™žù´¾ˆý2¼»5¼Ñ#Fl<”ÝŽ[½êrWªï§×°êBô²:ß®òÑýÅ—ÞÂÌÄ9ÏϧL"4ÂÍüy™Q¡ÕÞC‘ă7f7'e™æ,VÎTUEÙ$ûÉÎËxQ6<5Cs]•ã;P”º2Iá¦#Vö¾‹^Þ¢Ô·³±‚Êž‚«8Ó?ÙÝŽPÅÿ( ªVå.ÐL²½O9»ÙárÅ9¾GôLË´Èœ +î8¼|ädg½1CaüØ­Fë<ªYyœ“šÅÑwa͹cFBLßÇÃÊàÆÆS³tü§\)L< ´'ƒ(¯í£#Lþzvoe Pn˜ +íÿËk¿ïOìh÷øâþÙ¢Üûô €‘T¬ç…²ÿäÈÂendstream endobj -6343 0 obj << +6678 0 obj << /Type /Page -/Contents 6344 0 R -/Resources 6342 0 R +/Contents 6679 0 R +/Resources 6677 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6341 0 R +/Parent 6657 0 R >> endobj -6345 0 obj << -/D [6343 0 R /XYZ 85.039 781.388 null] +6680 0 obj << +/D [6678 0 R /XYZ 85.039 781.388 null] >> endobj -2114 0 obj << -/D [6343 0 R /XYZ 85.039 584.077 null] +2210 0 obj << +/D [6678 0 R /XYZ 85.039 639.916 null] >> endobj -6346 0 obj << -/D [6343 0 R /XYZ 85.039 549.327 null] +6681 0 obj << +/D [6678 0 R /XYZ 85.039 607.699 null] >> endobj -6347 0 obj << -/D [6343 0 R /XYZ 85.039 495.13 null] +2214 0 obj << +/D [6678 0 R /XYZ 85.039 607.699 null] >> endobj -6348 0 obj << -/D [6343 0 R /XYZ 85.039 455.088 null] +6682 0 obj << +/D [6678 0 R /XYZ 85.039 573.152 null] >> endobj -6349 0 obj << -/D [6343 0 R /XYZ 85.039 414.441 null] +6683 0 obj << +/D [6678 0 R /XYZ 85.039 435.278 null] >> endobj -6350 0 obj << -/D [6343 0 R /XYZ 85.039 373.793 null] +6684 0 obj << +/D [6678 0 R /XYZ 85.039 381.081 null] >> endobj -6342 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R /F38 2997 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +6677 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F38 3057 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6353 0 obj << -/Length 3222 +6687 0 obj << +/Length 2919 /Filter /FlateDecode >> stream -xÚ¥ÙrÛ8òÝ_á·•ª"š Ákß¼Î1™JlïX©ìÔÌ<Ð"-sB‘IÙñßo_!‰RjkËeh4ÐèF£/Xûð£ÎÓÈóÃì}¼š/Ôìã;èÜÍÿZþzöniwfiÂ.2ÜÖ÷³?þòÏ `á×3ß ³ôüÚ¾§`xsûò"J¿>»;û·]ŠÇô9Ïš’‚ÁX¨ÌË‚è´¤båé8´’ -`T{¡Ž]IE¾ùš$ÂAñD:›}Λ|]5kAƒP€ùÕªÝ6ÃÅ—¾ìš€dB5kkIµªào‰Xý1éèØËTrz¿#íWE'«/öùdoñ¬Úi¯vUö°³$æ^Þ`'šfkúJC»))çOÿ4_ c¬*ÄYñÀvŽÜ´ìþ!ëöå0€P¤×vL`xd -„A `Œ˜Ì m…êºkqý'¶${<ˆDÍ–²rWÒ¢Ô²<Š$¸P I„y‘¬^aVžë’»«¶A™ 9-Ð3Ðî?B*ëŠè ëh‘h‚)À| Ž`4¯kn¸»ƒ*¢,›¦Ÿã -£Ó!µ›'DHüÝÞžò;/•!qoÎ -Á–Þ¡4tFâ°œÁ=FѤF]qÖ+_xGBjB×Z“q þî¢ËgQ¼2¹UŸìiÃ8ÁóÊü‘!ÛÞ²ú†ñ×Øn·OÚÙS¢¼ùjÚM¹âmLåuž†À“&H<¬ - -æãJ#”É–;+³1Þ5R Ò5G§ä‡p{RˆË'…`{R´Ävh7ùP­@WdZÑ"é—×kó¢,üеžó<‡#Îér¹QxÁ X@Gg÷¢Þ$Ѻ&=<Ô -Ët˜ù¬@tuÁ $•Óú(âLj”±©¥}½„û„€µ·7Ÿ<^à²çñžÅ$¡Ü08/6ÄŽsÑò¡íàðµ¯ÝÝñÆr<ã"ÐŒGÙBû4  ÚFº¼{Š‹CÑä#Mp&À\É©F¸sA°›7î4 àˆ_6-Í.*Ôþ×Éõ¿TνG˜ .Ò=²É¦£`ä’B÷­àìÛ†ï†m.Ý®¤ ûtÏzÅŠ‚—k;ãRÙlhù»åû\ðýÆGiL €#w¤¡ØASø³MNJ‡—4¯ezN*CÖÄŸý>O5Ÿ( ®I¥( ¡[‰éƒõŒXq ¬ŒîñÝйúÕ¬ -|²4ëÅ„Œ Â0ÕÚVOÖ•US60‰!ŠÆ-…ÑÕ% w¯=[ª ÷÷]´,‚qTQ d)QJ‘ŽÎÈ ŒÙîŒ<Š Ì-η¡1›3>!d§°º% Ϭ¶³f¿‘qdÐbVæ‚·"”=÷* #ãQtÛÕ 1nd¦w6A0k»ª5uÃ68n•B|‘s&Ò"RtƒŸ+´â[Ñ`˜Aw=¦8öÍÀ®7ã-|µw„î•OZŸ¯ÈFCî×D£ƒ`ŒìÕL_¾ÿÆ.þsËðýÓ N¦GYïÒ2ºõ -J0ÐÁË®ñ®ß-?Ý|ÀŒâš­ûÉ»ÒY„~vÄž'¥ëË;‡:Hq.¸Øªá¶‰ó:ÒºÚÚ²áIl®mÌ÷M̲Y œ‰‹u½¼b‡*èqbÄ#V•)}P_àÔ¶‘©åªÇËíjàÁªŸ`ð .˜è)ïlxYHÔHÈ„¡OÈL]Ï„ˆréxp?¼§ðÏAT˜¸ÇÅ9ûÑñAtÅ<|¾CKž ÇåCÚ¨x¬uÐYÁVù°h4cn(ô`Ý®¹áè|ÉÂ÷3å£ÔÜw¯¸Ôåj¨läý·®ól¡‡qÄÊ$]5‹N݉·š) ãµÁ@bÁ¦£ºßàýÐykŒ„¿oy ÐW·O# /t%ÏB „‰õ#Sù`Ó'ì'³’=Ü€ùdáoaT–ùÓ|˜óáö¦‡¦bÔ$M7›*&c'áÝ^vŒUtÀz¨u8ëA¦¥´%2Åæ¥+seÃ8L2ÞVÖû®`âë8oà㨨Vrˆƒßd:ÇfÚ±³Ž ’»80ª1~Ü6í쎿è.÷¼/qÃØ´®‘À ¼N…9ÅÞFÌ$%øMé '‚ Xåâ}”:Ù}z)d÷>- )yÚS‘ÇlÖŒ¾S о燑 —Àq8*ðR‹5=ïƸhíûhûÊq—ß›ì8CÝå¤Cräµ€2§óEà E/Ü*]9€ôQb /à/Ñ;‚³ÖÔd&¥Œüë¥fE@oýÊ+m4 æ²r'äÎæ‰õS&ê#Æ&1XË1+r®ZþÚ<•ÑVD†=zÏÇïNaƒ!fcFx•ˆ”5ÇÜ&Dk IcÇþ\åÜପ§t -—ÊÉÈ^ð<'&dka¦.óª2y{$x1è›óâìÆ ½4F†ÐyA£G6ô-Êc&ªfã4+‘.NÂxžùœüo»bÉ$HSö¾ˆ³;cƒºr#WÏáìKžÉʶÍF\Ëó[r”3Ž$Å<¢´Ñ‘l2d8“nt•‰ÛˆòD˜àÁz±–ŒJ;€Å#¦ÆböµíM+'±b rNN’€³Y©HÎS1…‰-ïéj”6N û#ºgk?W\tÙ´OL‘à`ÂúiªÈ”cõ§+¿oEðµs3w‚2ÃÄR½¥ƒ Ñ©ž†:ô’ôtµ×Á¡ê©VŽÁT¾ò´Ú…Ä—%ûô”{)XæS ÎÅ­Tà…*Ø¡ø©]±þB¼;V.UìÅéér±ƒs‚aAú)Ã'Ž ïQœfØ¡H‘IÎù˜drþ—ë±j9Áf^”f'ùwpŽóo~Æÿ)‚–ÿ}Š“ü»‰ÿ²ÛTÃ`ßчN"K¼8œºvx«ØZÂAŠŠˆmS¿“Zxú'B³('dÆ8?Ùqj£ÄvÉM l$wÉ~–êœáP„m¼»Ø‰h?qíÍ)vŒ%dÌ5ëö>¯)ž8"µ0òÂ,8-¶ç„Ü駂;Ap”ÜÅiÑ9¿ôn‰ü· -ràñ7©@¥žïǧqìšò2¬¥Ú7)•^:Ohj¦0ŽüÙ]¾¹Ï9í}Y$üv¶œgT‘ }Nú±z0½Q•ù^èŸ6ÿÎÑÇ3¥žNcV5Œ‡!R/_¸1´&¨¤.–êáÊRèn¤î{Q’šÐ‹xæÕ`2P¼$Œ»êyí1ôÀ^Q>Á„§¨†sœÏOnµá†0µòw=®™…_Þ3¶NT?q˜KýýÁ‡Jï%ƒ‘/r¢×©ë¥ÑAT·¸ÿK¬,%˜"÷]+’ Á<°q5Ô–-"M%~ÇÈ{\öˆ´û†E“!$*!0²W·¹A›Á“ ‹ÔyÜ}iˆ¢#5¨Þ>ŽhD†nkB™ak’{%—_O°âš‹gÄ£á.Иó–FÓ)«†ƒäãUþ¾ápIeÄa°‰¸{ää/Ö Xm”²EPÔoB³Ã$ô‚ ú_T;r5[)£’´ž,ò2ÀrÅwÛ¬jŒ×³xÌ#±cDd‰ð -˜Û@Q/¡µü-›ü¾gL3"Úcvg[qb§§Ÿ=&\YÄé â—?„.—7¹té„Ó¬¸ú+Î+.E0wåák”H£TŸ=üƒüš[lÖ7‡*˜È>ÝWy]õæ=‚­¾§‡/P˜ZØrDnS¯©„Mü÷8#o·6u²•`&=–cnVÙ'\qì;“v= %e½ÉùŒ3b‰ô£â„;ïûOµ)Åhí‹ìøÞïËs|/˜ !á—åñý?‘4××&ƒƒ(¼@™½ üaãûû¢úðpÃÿ"¸kendstream +xÚµÛrÓÈò=_áâ¹*V4Ýö-@X²›„È9œ-àAز­Š-I&äïO_f¤‘­,`‹*<—žžž¾w+bÀ?1IB?Pé$N„¯’d2ß“ìü~$ D0Ñ~…¸õìæèäeMDà§A:¹YÈÍâ½÷üÕéõÍÙ›éL)åIíOgqœx/ΦÂ{û'üw3 ï5 ®äúÍT&Þë—çg¼pyzuŠK¿ÌÙ%ž»º™~¼ùãèìÆ¡d¦})$åóÑûÁdÔþqø*M&÷0|‘¦“í‘•je曣·Gÿê°ðžžð©‘Ï,ÄL~’èîå*yù‹¼¹m«;¤õä¥p!tà©0`Ç 0@ùQ™ý·mV·ÓY(Cï2/w#èÂØ—±úNt×uµª³m3FVêëP¸¬\Œ`’—B«¼]WÕb “òc°eµ¡-òºAjo ³l*cï Š5g)šÎp’£6”¼4¯ó¬Í>âŸÌ¤}LRÄÀ¼„0߬ó Ž4^ó{Ü+`i³á¼$¶ÐsÜÍæHRD7/p+ñ6Q3Ï6›^©J>ÔÐÁ¦°gK|M{¡°\8dz–ïEF-íº¡YìygÎ0—»\ÂÒ®îÉ1à¸\mŒÄa^Õ.;tJühÖUÝÎw$-{¢´Ýq<*OÜ +Ì q´ejWùáù»º2ï߸Au$<Ùâ„aû‹ +o¸/7U¶pïÄ4"V®Š ÊùÇਖ=ØáËï“DÔ†tLyxQQçD*BU“‚K/Û ˜ k»´ª©Ø bc2Þg—ðÍ ³[¼«\í¡*í{cý -oiv2nx¹·%Éʲ&ÂQ¤¼¸¬«-rצG4ö[ßn‘+á­sTMwV“h`I¼Mâ·âR*é¬ 7—.ñV³O %„´&ë¼B,‡+[‹ìm¶Å{?eÂœ@½À-vrˆèBdà°ˆ? ÚùVÆèø =P¬±“IÅÀSÌ?ó5 ­~ÌIÈÐ13œ¤3¸ùD¯Øáà"7HjÈLV¸˜ C í•Ÿ©ÝðÂ9¨ êÜ84žÒ;q°ëÅÓ†oÙ7 [˜üÔ emÉéFIöˆ{‡Û©Z9».³xBb¢ ï“APöGZ\ +÷â?ì–ù×–·ÐÌ8‚IQÛÓù#'‡É,˜Œ’Á[N -ÊI0ÍOºHKø§••­O»'|J/«z"£¸5D³Zló'þHÙ"uä'±«6à8\C[eˆ±*C`M|„|lehü¿Åx^6-Ä'N«%ÿÙ¡A"ø+½]¹ps2åxc€zïˆé˜·ÑŸ³OmîQãȦfsQm3ºå£™\윬9á7Õ‹ òá>(:󈼙g Ú*ðò‘úD)_F¶>9` š<TÖôX6ò—ËæÍ®p™žI·ô’~Ûb¯ÎWù¢€„%ðuŒè¨ 8», ËÉ¥³øÉÀ«[žåo#ÅáL¶nöêϳ¿ö¹ áÒ4êÀ¾Y´+_«h´dÇØaÚh!~ñúùéÅ ©¯¤â£?s{ô­Û/OŸ¿:¿:C§Q»ºopø|W×yÙþ‚$Q\Â|Ylò‹‚ÈžœfaêÇ©°¶/Âe³½@Š°€ÒgZ6…ƒ ¡¸Â> @r'…ã­¡{…òzíDèk<µktõ`ìW˜T0ûD<^© ìp¶”&˜Å[Š¢ö)a@%Æm—ôR™P.xPùÚ(t¨š"ôƒÈ¶Hæ¿!¿ï{aÜ1ëi Á³.³í˜­ˆ”#²Ý¬†ÑLÂdP&„кɉ¡îÓ6ÛÇî0qq Wå4i k`î˜Í&~¬u×]©ùNST+0úÏ»‚|%'’Ô>QPºË %|ê¡óKbjêÍ8†?îüÔ/w~g_1uh´1¦ë¬Àr¨œ…]ðzSJÿ9ç®ùûÞæYÝ¡Lh¥Óu‚p†B{ÚðØÇ¶é» ºËš¦«««Ãò çs·X1,e—=N +æý=#m¿(öŒÙϘ~~Ù˜²`U$ð¦x‚›»Ò nG£±}‰Üh­Uj µEû¸LuàG:þq™†¿\¦ÕÊ$R¦‹§ãƒâÖl‡=б&Ë?§ÓÑ/ÿs§ØŒUÿt¨ÏºŽÖ00Ä&ØÄN* k”ý¹Õ¡]DIÐ,¸òÉG¬ R?M­ó6M lªß=âd!ET6E„R‰‹7”„),|kÆA§rë}n•š}ŠÃ±ÜSo"ÿQ{âϗ2=t×/No¾Õ¹ç&è~ùG‚0]ž^} ÓÀMØ|A©føÛ §}÷óHÓäÏŒ.owg2É%׬>ãNQ÷ÝPq˜ ‘‰ ›úˆ +cHÏUo×Ɉ]?Ë—¤ò(7%#¯«!ñ1aÆ63a¦ÞB¶ÛðŒÌ›¶Éý>a~`¨ „u26s êzVû&I_ËGS¨d˜Bi÷™\9hcb~Ûƒâps°§@ gp˜„â¼¥²(éz #ŸÞ„Ÿ„âÿI<ÉuR,¢ˆ¾Ù¯|pa +…ô­!Ä°Çڶߘ6´0üžª×¶‘sû]-öS=x-eÓ—.¶¦5I"iñdišÉ¦EÅ­äÆ$µßÏæÆLÍ;]Û‰Àèƒe×Î.Ì9–6c îÛ&<~ +Eï0Óaè½°ª—w(Fš0¤…öc)c³2F¡ÑÕèMIØEl"êwi[’DŽ¶m³Û®™EäáçSf»Ì·æ›!®†À¬|à…Š­ Hž"‰ r¸UQǾÜöØ:çÊÒ8ãi©'PiÌ_Xm·.ìJLQÏó‹©7ºÂÃD>¡ì÷%Z%rþóþ¥{¹{¶ÿäÊÐÈ%üJb³Xj4Sí‡× úÐ[ò´y`=Á pn;Ö& å hÜ «É0Ê:TO™ê=† eÜ}j“i4®G‰¦ÌËrŽ›xžú`9ògÎFëô&qî2 çè6:1’U?Aì’vJüaåÉlg¶Éƒuo§ GøÇ3s@9Ÿh"¹ŠRê^ ÓÒORýsqu¦á11„¼žK.ØÏÀº“„2êñ¿|1Œû¹¿7Q±ú6ëqýM5êƒD(2)Càÿû€Íendstream endobj -6352 0 obj << +6686 0 obj << /Type /Page -/Contents 6353 0 R -/Resources 6351 0 R +/Contents 6687 0 R +/Resources 6685 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6341 0 R +/Parent 6657 0 R >> endobj -6354 0 obj << -/D [6352 0 R /XYZ 85.039 781.388 null] +6688 0 obj << +/D [6686 0 R /XYZ 85.039 781.388 null] >> endobj -2118 0 obj << -/D [6352 0 R /XYZ 85.039 761.463 null] +6689 0 obj << +/D [6686 0 R /XYZ 85.039 530.728 null] >> endobj -6355 0 obj << -/D [6352 0 R /XYZ 85.039 736.114 null] +6690 0 obj << +/D [6686 0 R /XYZ 85.039 500.902 null] >> endobj -2122 0 obj << -/D [6352 0 R /XYZ 85.039 218.006 null] +6691 0 obj << +/D [6686 0 R /XYZ 85.039 395.236 null] >> endobj -6356 0 obj << -/D [6352 0 R /XYZ 85.039 183.26 null] +6692 0 obj << +/D [6686 0 R /XYZ 85.039 366.016 null] >> endobj -6351 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R /F62 4047 0 R >> +6693 0 obj << +/D [6686 0 R /XYZ 85.039 327.49 null] +>> endobj +6694 0 obj << +/D [6686 0 R /XYZ 85.039 297.664 null] +>> endobj +6685 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im3 4496 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6359 0 obj << -/Length 2735 +6697 0 obj << +/Length 2867 /Filter /FlateDecode >> stream -xÚ¥ZÛr£H}÷W(æ EX4P\ûÍ+{z{¢}™¶ž™y@Il#вÇûõ›·tOÄFG7P•UYu2ëdVªí‰ìIè™–Š&Ah›* 'Ëí…5YCÏ— [$f"2ëÉüãéâÓÏž?±-3²¢ÉÓª›Ç3]OMž’ßù?¯žn¾OgJ)ÃQæt¡ñ8µ=>ÝÜrûÕݵ¼LИÏïŸïž°Á5@ðþÛ×ùtf_oàãqúçÓ/7OíÊZ°Š—õŸ‹ßÿ´& lá— ËTQ8yƒwË´¡{{ë2=WÉw~ñxñk;÷¹u-1³#3r¼q¤|Ût}Õ"å@¯mFž×GʳLÏr )à± 0ò<ËxÉà£HÊ©²Œ·àða± ÷“cY á¦g°´N†–¯§F´}Sù´²§M -êmßhÊé Tæµ|oâ†ß¶1Zî?$%cöuŠkNðË£”˲øò]Øáz_Á¿)77~·Z·Ð¼;˜1ž¶\ñ&B‰¦*ó©tÆ -§,·‡sâû-y |É -øxaô›ŒKi®×Œ†3D€›Ùhôˆ ØÒX%z¨gÄUúy:sÝÐ ÛheÊc¹üòÌT<×ñ:­¸w…ʤ/)·1­«Æ—,Ðœ›OÐ{ÝÐÄ[nŠiC<ÑÚvîáeÇS2úÕ»Þ¹ù&†¬)«KþnÀܧ;¯ÒuV7Ž‰”!6åqÜô‡åY Ôö4Ê1éã/mS°Á¹}Ç3ži­Aä¶fל³HhõhmrèB§ÿôÛk#P2éÑOV¤ü±¯ É55›´Ó•-Ù M@—hƒæ̦o Ó˜7ÕÚ>"Û{ʘ—E]æ)àþooç¸InxË`‘ðæñnÓT%ý›ÅŒø©æ AÃnÖ™ý'´ƒÈ’A®=|¥IÖËXØ™úøœ” ;r“Å9žŠ÷þÎ<ÚXœ×%3,ÎEŠà]¼K®¥@GÂ/_hû= àPËwþ¾IзÀ#Ìrò]× ‚`”œz2ƒ¼éÿº–}À›Jxó1Þ.b¤Kßx¸Æ=̇#“Œ.¦“dJžŽÒb^È6`v7‚É<ªñv -†YP‹g\#7A#1< Í5¡ió<Õ -FöˆR–+Ò7~és1~¯ðâä<5ûmV¬¹é¥€+YÜ’A¹Ÿv|Fíhj"¾DÖ=ñòVP¹› Vh‡Ð¶Ì÷IKàŸqÔ§Ÿ}§‡˜mù¦kû0NRo§Ê1»¸F×KxÀÄC-;ùË33¦íéùÐ+#YЃŽÉé„®cúáß°HÏMaCð„üàïMQᢄo—@½ð€Ã ë;»¸À `IîìHðõ##N¶„zF$AŽ3ùBg½)÷¹ð|ViLhNfN˜–ë°ZPÜÖ[èüî:²«¹eÅ‘IGf$í€w¡©¥‰Çkö°­ XÅÛŒ‚O,s¹cl´’4“¾½fÃtˆK<¢ÑãÛ“i¹Ä5•ë÷/àï¨Ps‰‹¸»Sà–Ó®Ç&ž* -à°V"?häÍÂË7<²k>ñP•bqî„"RÒ=6½¦Õky`cV`B>1¾±Nf—ÜÀ1U?…s| ŠöÊ»àJ´æÎÉKˆ×ÔÜHvö)UB{/÷ÛTóu‹cà{YQHGi$lâÀÇ#ŽúX+‹BÏ;{¶n+‹’ø†ïWTzz!)ÓdiÝn4ç,"€HÌ™Ài€ÙÛhNmppÕ*嶔xªÝ['XÅåéÈT 7RRÊ~,^ÜËü Ž^bŸ ï:¡9[‰S£G¡©%sàÖ쓃ƒìB Ö£%ÆÙ6¸•íô4ÝM"Ê”^V?¶eŒ4ÕtÙ¬'ùFÁßS⟒2"ÊP¼Ãɾ’Þ9¦34ùa~âQˆmCæk¶”lS²ï8çüñQò²Ž¥ DwÊ› m˜‹Žç";—÷¿âÞÒŠ6çlλxÛf˜0›Dp–”ü«,t¢Dû¢ËEÒ­•úp‘Ðtûü —þØ O÷¸}›–§Fý¤'3è)Z†xoÐWÆ´µÞ2ªNûK_ß˦o0Lml˸Z6£Çß×ì*"èèÂâZE@zv€—9LÀË\' ˆ†"ÀHGšè»VhäS‹ÐŠŸ|iB~Ç~}[ZŠÖûdãßzš%º5®S øåá¾f ÊO’&¹lÄKq’&GÉuŒŽ¸#.kßÄ»¥üÝ…l^8àà­oÞÐ@þH€å{º`ñÌÚaušœâæ„Z#A -âZç«ZfÖ"s»vßÜŽª 7WýàD£²ØÁÆ4ŠÌ‰ÆCSþÁÚQãݸr…ª/„|;Fš!‘”ÚêY|/‘Ö6«RáûL„$p\£ƒ‚s¾êX¦²‚í„F¡ÓØz¤ñ< =‡€–ß+ ’·ö0 6ô(—€¼GÜnwìÈã]ª†¬Ód@'R¦c…ãö„†ÔB8ªQx¬ñ,€}×éŽËbtÚ,TàÓÑ¥°5Ø -®SÓ®‹<ž5'Òm¬ßǵ ©x‘åT!>Àš”ŠN=ç+¥r<ÈI›”^Ý®ì$]D¶ë¸ÈþË×;x÷ti.ÙÀiC*L¹w¸ð®ïþNN`’RýAŒÝ¹$)ãKKÙ«x)þ’õR®Šç‘8«™t/a9­nÄ|+)ýðÔ3åúÒ÷é<6M†®'z\ ÇÂtOf0LkDQ †é1mm˜Uמ·ž¾›¶t·ÜwŽÙ£È~’7;¨6*qÚ -‡Ñ]•P¹¡$(I‹£X¿K4Æ °å¾Ö×É.Ä%é*æ¼Ë‰çÑ·=ßE¿'3ˆ¾–A4ÜAôÇ´µèªÓè÷õ]ñ†ˆcߊÇ•N–]ŠÙðI'G>Q’£œÚéЂ¹Ü\%7U>»Ê›ÙušâئãÿÊГÆWdp¿Þ0¾#Ú:|ÇÔµøöô=ðβJ“®lª U—v½N=x\7nÚMØï¹½–[#­çš¼º*IÞËýó6CíýÊA7ÍZ[MAm½%ëê÷m¸møN]šÍuMÛ¿cöd†Í&2£?l¶mÙÆÔµfëé»*)6 ŽN¨(ÎIaLzWÜÑ[¿Ðï‰X![“àk¹À“Á1ð õÀ¹t‚:2]}h¸Aÿö$nSsk’ž±#v”?ßèW3\N&=ÞQ¶Ëd§QWg í}¦–Äb)e -ú5c0÷-Ëô”=žOõ„†ó)-ôQ>5ªQçSÇÏæS}_å4”„ÚÌ\~ :(³·7¦”‹ñl¥ê²-pˆûî˜Ö:žÉ½O.¢‡7ŠÞÓõy¤°¤‹›]ù<“2à€AeºÊ·G'3l‘ùÈcê´1ŽÔµEOÝ7©cŽ´àKÓÉ ‹x!ÅüýŒÏÉåQÔïçhuÿŽ±Tž™:4…Z“&ÇÃ7åW¹¶°–ºœ®j'wØ!{Ä4*¥ü@áÅ2³åføËÇóÿúß]‘O™¡ŠÎ£ï9ŽéØz-”*÷x½ž -M/T§ þ&ûÓgendstream +xÚÍZ[sÛ6~÷¯ÐÛR3 /Ý'oœ´éÖ®7ÖNv§í#Ñש’Tœüû=$E:Étә̘¸çòs È…€r‘h_¨t'ÒWI²Ø.Äb3ß_HC!¡/"S[_\¾ÖÑB +?ébý@$ëí/ÞË®îÖ¯Þ.WJ)/ýå*ŽïúÕRz÷‡?ëåJz?CãŽIîÞ.ƒÄûùõ›Ÿ^ñÀÍÕí}4¯npÝízùÛúÇ‹Wë'«Ð#…¬ü~ñËob±n¼¾J“Å´…/Ótq¸µòu¨L¿¼¸¿ø‡Û…篚¹ðÊR¬”ð“$t7—zææo–«P /+KlH//[¼lν¸IV”í èjíզɳ!Á=–Aì½Ïþí‡o»$ +齇ÆiÇg”õŽ•ù”ý¢®fº÷ËÎvHó„[çDYñ¬â=² +n¹-…á/ë†I›ÓÒ,zþ‘ß nú¸äC@K¨‰BKI&mUü*¤¢CÖ/.kê]W¥>‰w§­ö<ˆ‚Q*„M÷öú ­’''8éòu ´ £ÄOdjtQåÝ¡®|’îÇœÉGJ‹hICýÂZm¹‚¬Irõ#<Ô†û¼ilóëm¶#þZŸî¿ +”ôã¾±/ÒÔY†J”÷ åTŸ°zx± ¯lˆƒÙfC<óÎ<†º¤¹ŠwyW *¶5éÔÐÜ®ÃË@ˆÜc«jxão—F^/I³(&lØd¤×™•¹iœŽLÔÔÙ¡@SØñøWÔ¸´Ì[Ëšè%kåLÿ 0Õº2–‚òЈB8pfpZÏ×1×ÆñþJØ_‰PEx7Ù£‘’d|ÀÔ,i¶k² Ýí;J=2ìÐH䣹dÎ[XQa;‡¹c™ÏÜ툧$Þ£ó?]¬ø$”MlÅÅZ–^±Í·LóTt{n½£ƒÚŒGڌՌ6k«8›¡m±M†eyÙç¼%ŠxèŠÎÐïŒÅ!]Ö˜ÄáôÒV4䜸ðwD¥âÃRG|y…Lvì÷f €wü4O?Jä|ÐYAIãÄo fÀhX ð³nÉ®ê%à”5*EÞ-¶×!vbïÎ  Û#h—u˜§án†ú2üBx7t³P$d–ð9µ±‡„8Ø¢uŠ”g×r§0+ Äíp!T¡õ•˜Œ‡!:Õ»eBÐ(½Gs´t ì`ˆœ ˆ|É}‰ó°Ô1ºFÅ]á¨Ù¼0‡aÌêˆùðg d½7ÖѵÄ0Ń%Ãê†%Mv±ÉLcUlm«²xàBÄÑNƒÅf[à ÛמÄH²ÛÛ!ý:h*ЉŸZègtZé@ƒ?³ÅO#E"C~ÌŽÒè2a¾ +ó¥ýÄ +‚|I„$=üfüM²CÞ¹ (SòX¤e¨TB“s:1@?Ã6{ZQfï­Xa‡'a”ˆ´``íiîÊ ~7#h.3ζ)>ÌÆÑÐOReè}L BNñPöÞ­¨OåÖH,~ ÑéôD×:éh5<:Œàhðøn†9©ýH[Õ‘ˆJl‚B1uêA~ÁGÁEa¤Oª(zÆo“ó»ÐI²xÇ“¨õ0P,MÄÕÞ¦®þƒpYmŒù'¡U^ro¶¨ò§9Õ(yÅŒjöõaN3ôý3‘QÌš³_1ÊV؃uê4Ç(.;ƒó +[RvÈ ºà.dð͘f‹òhØ»º1“©wÜΘ~€ˆ4+-SË‹DN{å‘'H¬:>·v¤åKó‰º2‰˜S03¬l 0Ï©óÔSþ¶æÁÍ(¼VnyܨÙÊ!õü; º¾7’þØåU[PƪÙ{PÎû÷FEñ?ÿÞ¥0˜ÂÎ¥hÈWeh¨–8 3<#±qÚ‰Ü5E7›âô˜‹w" -mÇÄZ!â@ßÉåqx€ UЉ +$ ŸF# Fz¦øUhA®GÇì{*ܧ.·yÃS,Þs"'cœàD:—ùL.Böív©Mu6SÖÝ)€Þ“{;…I€X\Œo:¦Ÿ³` +w•3îø†²af!G)8Pr×ä$þ®f…Øñ_Æ“ W8·Å'j3DÄÝØD!°BwˆièØ ›³é<¥/oìB°ò(Œ¼7Oõrhg`~,ù«ã±,lú€èwuÙ ú¥Ú—+»e2F{£~ôð8*8ažFÕtɃÙ_RÀ©.×yûØÕÇNBªì+ÍéF‘¯Ulæo¡à­ëísÛ|å.÷]Öt,ž›¼:½˜‹Û@/¢€¦;BN#´¡¸ãŠ½cLCÝ 3Æi +óaù©’cPÙ¯ +ÐaZ'ò3Ôò·ímÚ%{8m‚*43þô(2£ª0ðeâd¼†,©ñ¯¯Ö3·Ñ1ÅLwÜú–í¦¨væDÄ­#ý¬1ŒR•¨A2ð÷%ø´ÆB|zX¼ÜQ<€ ëÐl 5xÁÒ”iê‡:‡(~´Pˆ&ñFÈoº-„1.‚Í©€Nå'¦8!R<šÜ»šKþMUƉSKJ߇©§»´ñMëSËÎ}àdðemÒŠºä…wØͪ¼äy$|7àM0ñi”:»úÁO38ÔPV^×(ö‰©+­y CN_T‹Ð%Ð?ØDc(ëˆå(ë <û+f’#Blb(˳ÒÂ2p¡cŸÐC¿~௭]|‡1zš‰¥­íV™<Þ?c±¢:êp²¨ì.K÷|ÀÚ¢ò“µ…Wh+6!aîåǼuQP“Œ 1à‚9L +#ÖÄJ¹›e|ØÍJ'!èlæf“pνuE“WøŒ³›ƒ2øJ}ÿGÂBëÿ³eÜQDgXrsuûŽÈ+)[œb9>„B®‹’ˆ^B†¢,Ì« +ËB±IÛü‚ßi3öù´ÊŸOìã¬ÍÁôØÖ"kOñŒSʼnËv¡Ù»Ê<'…X½#s˜¸ÆaÄÙjz :µOöY2C·(Ë#gô¥ŒNïR þ|!]ÍGÏe±)\à’zàGËŒ–ÈŸÆúÙH5sUä«s®æMá,¬LÀTúBÆßäL}î,B\þ îx0ë!o[Ʀ)oÔÏq¦¤ÊèóOb}Ì€Rf` У7hÛa£ˆÔ×ß™t8É…ÁRÖ;/… èÇR‘ä(¶õ!#dDâ¹SêjÊÎÍ=è\ö;€FMâ ³nì+ÝøN±K—¬›gšó¿Yf²‚c`h~V#rb‚‰&š—o©!çøâŽ?áRŒ=ã õopéÐK?Jc÷–±Ôø ­é ÓÀ©¡u;Ô—àÖU¨˜m×Tœ\A1ˆ•{®ûÃr ¾¹ßR½€ºÚ@ÿbŒäj $4Â$ñÝ|bß~YŽ§.of+_:¾±®'íoa J›OLÓ¡‚+0†c.Õù\• %Kò9+$ýã +Qß\!/I «!4jz³ ‚O_ ý³¥”2Š=|†hHÂMæd\AÙQ>øç™nøÍ%uß›ËÐR¹&×|0Òÿ +Ò|²nk^Wy}m~ àt–Ò¾§`²nÂ*ª„©+þÕ Ñ?Ïîôÿ‘ݽ_Tœ ‚í­—)Æ£Ùº]‡öà=f§]Gð)i?PÏüJgÒ¦ÿí?d¨êt—‚}ÞÓµ>çSB:…c™ÿ,Q +endstream endobj -6358 0 obj << +6696 0 obj << /Type /Page -/Contents 6359 0 R -/Resources 6357 0 R +/Contents 6697 0 R +/Resources 6695 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6341 0 R ->> endobj -6360 0 obj << -/D [6358 0 R /XYZ 85.039 781.388 null] ->> endobj -2126 0 obj << -/D [6358 0 R /XYZ 85.039 761.463 null] ->> endobj -6361 0 obj << -/D [6358 0 R /XYZ 85.039 740.47 null] +/Parent 6706 0 R >> endobj -2130 0 obj << -/D [6358 0 R /XYZ 85.039 644.777 null] +6698 0 obj << +/D [6696 0 R /XYZ 85.039 781.388 null] >> endobj -6362 0 obj << -/D [6358 0 R /XYZ 85.039 612.356 null] +2218 0 obj << +/D [6696 0 R /XYZ 85.039 651.823 null] >> endobj -2134 0 obj << -/D [6358 0 R /XYZ 85.039 539.599 null] +6699 0 obj << +/D [6696 0 R /XYZ 85.039 619.8 null] >> endobj -6363 0 obj << -/D [6358 0 R /XYZ 85.039 496.645 null] +2222 0 obj << +/D [6696 0 R /XYZ 85.039 263.684 null] >> endobj -6364 0 obj << -/D [6358 0 R /XYZ 85.039 453.677 null] +6700 0 obj << +/D [6696 0 R /XYZ 85.039 228.934 null] >> endobj -6365 0 obj << -/D [6358 0 R /XYZ 85.039 412.424 null] +6701 0 obj << +/D [6696 0 R /XYZ 85.039 191.013 null] >> endobj -6366 0 obj << -/D [6358 0 R /XYZ 85.039 250.439 null] +6702 0 obj << +/D [6696 0 R /XYZ 85.039 161.794 null] >> endobj -6367 0 obj << -/D [6358 0 R /XYZ 85.039 222.735 null] +6703 0 obj << +/D [6696 0 R /XYZ 85.039 134.695 null] >> endobj -6368 0 obj << -/D [6358 0 R /XYZ 85.039 195.636 null] +6704 0 obj << +/D [6696 0 R /XYZ 85.039 109.718 null] >> endobj -6369 0 obj << -/D [6358 0 R /XYZ 85.039 168.538 null] +6705 0 obj << +/D [6696 0 R /XYZ 85.039 79.893 null] >> endobj -6357 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F41 2994 0 R >> +6695 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F20 3021 0 R /F58 3380 0 R /F35 3036 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6372 0 obj << -/Length 1942 +6709 0 obj << +/Length 2530 /Filter /FlateDecode >> stream -xÚ¥X[s›F~ׯÐ[ÐLL€åÚ—Žk»ŽSGvkeÜL’™"d* *ú÷=·" å¡“qØËÙ=÷=¶àŸ==ÓRÑ8mS…áx±YãìÜŽl¡¸’‹Í/³Ñ›_=l[fdEãÙ²»Ç3]OgÉ'ãêíåãìæÉ…RÊp”9¹‚ÐxšØÆǧÙÍ{^¿œ^Ë`â„ÆÕÕÇé \ãîï®&¶qw“§É—Ù»Ñͬ•¬å RD(Ö?£O_¬q*¼Y¦ŠÂñÆ–iÃözr™ž«džžF¿·Wñž;æS§¬à:¾é0P–†îIÛvLe;`*Ï2=ËmMåÚ=SÙØÈRcM„¶úlÙÁ¡z6ròÂqï²cŽBsÄÑöú•Orõ9Þ—“ °ø"n²²`”Kþ6/`픽p¹h²Ñ52¿Î*Þ´ESV{>‘5°Xãbš/ô«®åÿÀrÑË Ñ-wŽck¹Ž§-×ãø6®Ù};åYÝ|oÅ[ -`!]LœÀ@ò¸X¥ ¤‚ëºÆ´dÊM…¾€ Hf¬³b%¦­ù[¤dôD[?‘máVÀz)0³—Ví!s {üH†ç3¿Gsl¢(4U Ú{ÐBÁ3ÛòÉÚç¸išóìt¤ôù}¨IÍŠÕÄp-sÐ9#‹fÚd⋸êÜo60ɳT̹Ľr­cOahŸOÐ5È£x´Ñ[?±g/i•óå\Ñ·¢è¹¤®î7”ž ƒ¾ó“œó®kI†=Ç$hÈpØqì:¿áÕº­cv_®y?4j²t…žÚ45®E­¹p\ma\ ‘eLÓ¯¢­K>ãÑÂù¯‹‹„}ôB²kôe•²_KdÞSÆk´5„Á‘@H.…Æ—br/Ì)kåêrÞÄYÑe'ØÌ0u%"}çqaæ*ˆÎ¿q ôU¹Ýð îɳÅ^¨€çwÑVóÆg˳^P㤅¹’^˜¤ßXQ´]£1‰ê=R1JP¼åVãw¾‡Üoc¹öc:sù¶šÃ2Oyʶ:VòГ‡ß¼¤Rmا‚bòÌÈ5loIŠÙ6)QˆÝ`>@YŽ:ŸÍpF * §Än]Nœc×&EhlGj„Ïî -Ô¼I«e¼@Ç2¨ ÁV’6-†¬5à„h°Û!i+Œ»úTTe`Ñ°b°L…cW@ЬCˆƒpº+øŽ˜?OñÎeš{pev*`0–s”ø«ä)”YN`ׂ9Ó‚–g\—kN1ŒO&\ÇmeÕɇËxi½'6éZ“{ƒjIü¸6 ÀǪ;Ý/ -x*nø[7qÕ\lqó5CQç#}{@ œI½9V7æj  •¨~1¥€sr ã¾ ª|÷lœ÷h(ðØuMåú½nÝSiI? Ž.9«r½&XiüÀ¸© ?Q–QÕCâÈ5gÅéhŽó@ˆÜ(2m‹‹ƒñÖQØh:Äf7Ú0ÙPhÏótMÑ O,P¨›Ð™k6ö*­Ü„q™Aóè·™7¼Ó”B‘Å+j«ØɼH‘‰ƒ^ñ.xe]V©>IooÔ•µZv}ƒMI+KjbrƼ6±WºÉƒ…2Ï»âÐöñmQX—EÝT`0b -ª\zv(GØázV×Ú¸Cçú¡iûÁYO÷hÚÀ³ÍÈóúžv3ˆì^àÙVϳÀóÊÖžßs^£ý¸5V¾oLIõ†÷ž‰ÿ«pùëä®eº¾^òŽf8F­ÐôÝ€$ÿë]ˆ (nîÑS:.pqQ¥qWz»`Ú, »tSCî8ø¦qóŽ°-ê°…à³mxŒ&ÒÃBßOó°';¼[MtE¡§7(Î ŽÞ?Ü>ÀgʾS\è‘œ¨_´À9¡ow´­Y¼uœ¤¼Z”ÅS‘Àù~0'·­1ӂ˘­»8¬>åVªÝs&5åÏGÞy¤F‰Çó¹ÌQä¾–<{I÷Lƒ=Ó–^d0I(î_ÉŒß -R³3PA}±4;Š‹QÂDâ¥BÎì2ðâ÷bF!oÍ©×:‘ÊI©{ÅöÒ±íP!äÊe ÀFp/KBâU*R7+4,¦½óÒa¡›=(ý¬!‚½g®“´F¦¥çšVž¤—…ô·¸ó’‘ ñüù•VË$¢!”v!')~©²b3Ž¨ˆƒéÃŒìUÏd{ÞY¨aÄÓøŠ#R°ôÔP ¾;a}c®oxú^îãÖß?ñwà8w¸0óŽeµ;­†{º™'u@‰¸YâÅÕZl¡ ·¦ížfèünk3·/<*jË7<Ó¦^ˆo(¡ðÓ»/l‡,À _mç…´Õ¼rú©2]18­™î{ÁWö~$â†ÅÕH¤‡á:Òú¿“,Jݪêb(ï^˯—È <Þ“ö[™¡G•r0ÿÄR ëƒÐ®DØ4sÜΖ6e™Ntª<ÀæýÀØe†*:]c<Ç1[Ë‚ŽPÊ;”×SΡ:ø?P¾ ´endstream +xÚÅYYoãF~÷¯ö‰F6û`3 œ±u’±½cÎ"“Z¢-©”5ú÷[ÕÕMR}`<ƒ…³Ïêêê:¾*±Ql¤¥ðxiæs­G³åQ0º‡™_Ž˜]Œ„(‰S?OÞŸI5bñhzg–Lçyþ}|5=ý4žpνPøãIiïät̼ëßàßtç@£• +“RQþþ´/´¤mû$¥/ä‹Ï W³ ¥HýýYôòС°«¯ÆVU(û%¬Ïš&Ã~yMIßum‰ìœ¦µD–ÆíxF^9†_€Æ;<_x³<›ás=;eËÖO:ô£P;MY$ÅýС„-ܪÛ5œÕ4eq AàÆ#n¾Áð¾îq¢oþ8úBQV(êé·R ZÜnþ_$ðJܬb/+†DÄü@ÆvCR¥I¡NžÕMMxd†1ÃKT‚Ä°·ÚÈYƒÍd™â,­¡wCì€á_z[ÜT®‰Îl÷Ž‹´JßQ3³ l²<·XÝIÍUF„~¬Bh€yIs‡õ +W†^BZU›cswþ¬Éœbíi!²*$ +:3=PDwEáÍËe’¹ñ’¾›]cÑé­i¬ªòsÀlÎíî%.[× õˆ;•ÌfÈfZãÿ:»µ»½=Íb\ùŠ+p-¯ÄŽÒxÆ´IPpðȱ|Ù×q­|­ô ¯©a\Øù¶åvÛ6e5:4†TvååpðyšKˆÅÀgoÒã šŠˆFܿͲP›@! C2’_†ô7CÓ±GH/Fnÿß)ÝquÂ<æ·›%«ä6ï|gy×÷¿F©Mô¸§á5yì¹[Çl©ÔA-i ͪћ§áÏŒ‹ÓGÃje7¦ÿz!þÇ_/øøûÆ÷>Œù,•;K½üm ȇ 6ÈsŠí³];±½&)Ðe¸.w¨­¬‡Ô+PUäë(~I0rûüX¼AªÆËlpç"V€düj;H`²¼±J ð¢‰xâ^Q.³ÂÌZ³±/A028P§ÕÆw†cðŽÀ@Æ;b0i^zCýE‚G=¶¦.U!¦Á•†ñöN‰µ¹YÒÓœvc:G\Õôm{M¡ ÌÅýlºN–È " „ä 8¯xXl-ïÕãǧ¤ËÁçêÞ ¡óñ´¸„Z4QÒWµ< ­@º»WB+èBèSÐ +ÞJ«W‡$\ A«,„«7B+MúfÐJ¡•`ZýÚ0Ç“Ú»idNF‹à'ˆ!•ÁtÿÌiM )z༉20°LP©çICÀbK£+BJVgv\_M+îhý¬?fO‰;͵§ºÃ>^ «Ó/Æ ˜„ +ÓTÈÅ”W[~7`H(i£+fÖ9MÌM"–Ð,]†&(þV*›2!½uC[J\`‰Ó,QºÙCƒè'I&Ö¨Á;HBÜgè†a£ƒ@jU“ÑÎ)q±D ¼ë :o¥ SwU¹ÜÉ€Œ˜Ð9$P´rFn‘«}(§é…öy$Þd7w‹5–{Δ' Ü‚Zàu¸b}b4'º8Í¿1zndæåð±*P? ؤ¤,z‘¶É4 )†I…„’hÜdÅœî® ãæÊ°çs ƒ²¢±¥‰HÛ.gR&¦å[õ¤ÿ¤wõÆàË΄VžaXàˆú˜¡žƒ%guƒ#)-š¦“ ªqÁõ¶nÒ%¶þ¨•«ª¼Ërš¸ÄIIË +L!±1íz æ]ii¬[jå¦H«z‘­l÷Ž¾ŸÊ„œLïD꜕9ž!ðxÙg‘C€éšt—L%³þ­v^¿\ç󽔧«L5méPÞ,½*çiAZ5Xæ â~¶ B€XÙ>ø#-5ÑL¸h&º¢Å†ú6_ª)¸ o”'ôQ™ÜÈ0’ØmÇTp@E{Û{ôU]š,Ñò¶nŸÑÁò~þ„ª,½s{p]¾£À <4Ô`8Ézšé„Œ4AdŠä:¹¯æ–ïØ +Θ¶¾_ô yVûŽrïý‘eô*œ"À¸0*‹íöH\ÕyìuçføH"Pž8»'}ˆ»,Á.ýƒe'ì´‚A‰+-â Š¿­JšAKÙqfÑrfnK‡å¤R³$Ïí!”>9qSI6%gº ²ÕÒõ0ïOMý +^Ú¡¡zO+"* +QæßЕÔàkÀÖØÀäP?dàôfç6¾àBó®Ð¸+óœ‚@[p€Q /þÏ>õÎív»×<òP´9£¡TQ£^ÛôŽ ÝÍô†ÔËU³¹­xU¶Ð<”øúYÚ £_©{i™ K‚´Šƒ‹:%#Dvð” eÀ~8HàÛX2åG:úúÂûæ…‘Ëaýyµ+Öº1ÑhÜV‰¨ +kƒ_áªÍ¢­/™¯‰\æ½(xõ*]‰‘ج\“B~¿_’Âÿ_%É®¿†œÐDÕ ;´/#Wì˜ØÈÕÏ帯¸« +ÿ8pƒÀº’Õ§õÐSßÇ»Qí»”ìøw¨•¢}®,"<¬\€ð˜]ÛXëlHÆÊòñüýQL¡þ‘Ý: ·ý´Í#ŸupúyYJu{(HöJuÿœlb¹endstream endobj -6371 0 obj << +6708 0 obj << /Type /Page -/Contents 6372 0 R -/Resources 6370 0 R +/Contents 6709 0 R +/Resources 6707 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6341 0 R +/Parent 6706 0 R >> endobj -6373 0 obj << -/D [6371 0 R /XYZ 85.039 781.388 null] +6710 0 obj << +/D [6708 0 R /XYZ 85.039 781.388 null] >> endobj -6374 0 obj << -/D [6371 0 R /XYZ 85.039 718.296 null] +6711 0 obj << +/D [6708 0 R /XYZ 85.039 761.463 null] >> endobj -6375 0 obj << -/D [6371 0 R /XYZ 85.039 691.197 null] +6712 0 obj << +/D [6708 0 R /XYZ 85.039 748.383 null] >> endobj -6376 0 obj << -/D [6371 0 R /XYZ 85.039 637 null] +6713 0 obj << +/D [6708 0 R /XYZ 85.039 595.365 null] >> endobj -2138 0 obj << -/D [6371 0 R /XYZ 85.039 566.364 null] +6714 0 obj << +/D [6708 0 R /XYZ 85.039 571.122 null] >> endobj -6377 0 obj << -/D [6371 0 R /XYZ 85.039 526.201 null] +6715 0 obj << +/D [6708 0 R /XYZ 85.039 546.145 null] >> endobj -2142 0 obj << -/D [6371 0 R /XYZ 85.039 468.167 null] +6716 0 obj << +/D [6708 0 R /XYZ 85.039 343.926 null] >> endobj -6378 0 obj << -/D [6371 0 R /XYZ 85.039 433.421 null] +6717 0 obj << +/D [6708 0 R /XYZ 85.039 343.926 null] >> endobj -6370 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +6718 0 obj << +/D [6708 0 R /XYZ 85.039 128.783 null] +>> endobj +6719 0 obj << +/D [6708 0 R /XYZ 85.039 102.291 null] +>> endobj +6720 0 obj << +/D [6708 0 R /XYZ 85.039 76.887 null] +>> endobj +6707 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F64 4225 0 R /F18 4228 0 R /F58 3380 0 R /F41 3054 0 R /F62 4159 0 R /F35 3036 0 R /F38 3057 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6381 0 obj << -/Length 2049 +6723 0 obj << +/Length 2491 /Filter /FlateDecode >> stream -xÚ¥X[Û¶~÷¯Ð[d Ö’"u{<é%MÑ9Íäm¸¶ÖbKŽ$w“ß¹‘’×vZ´X`Mr†Ã¹ó£t¤àOGe–(SEE©S–Ñú°PÑ(¯Z8lf’ÌZ_!®ó—èÌãàaº¤Ù½Œ£®­yppkdÛ¡B~ ÍÄ_×vãÎ+ÐêÅZßïÈ{±Æ#ªŒkGò:ù£™Ô—Ó”´HGcwýÁ 8‰–{¿wëp¸¡°l™¶#ùOAÝˤYw-~‹‡Q‘‹1æÄ3h7w%\Ÿª SÒ@•]K±hoC NU²W4S·rΨ’“mÝî$â¸Ê•‰ZRÕ((ºÆ'Ê£\ì9³pìx™B„Û¡¨Q–žW„p}aº/âÇK}íöBä#KJs×nŸ·ÈÍa|Ø{‡+NF-lQÄ -ØÕ=IR6~Ý"-¤ÂجO{׃š™Nçi>ˆ„Gæ&'uÞÃHZsg@}N#åÊ– T°u?ˆPô¨Q™X_ÜqHúy6ÄÅI;Ã=èb°†Æ$^„¹ËNÃèš;©Õm­¹iPn¿Îõ‘Y¦&ÐÖ4&{ºt·&ãnnuþ\smIȉ‘ª E‰û¸¼Eß—qLî -%´—ÕŸÙet6f®Í>T+Ä0¯”:kŽõꎤW%Ž=7Tªzê7PXTØâµ´L±—+r¸BPðü£Ðv5Þ;ê’úXÅØT æša„ÖLmã\^h:”ç@xjÆ‹üì;^ánŒbNÜ{¸^ñœýÐ%7îzkl¢Š¯CªÏM8b•M -{8’ -¡¦"™~ªna«tR¥ù 씩De„‹>-~ý]E`úi¡í Æ*ÑU°H¦2™ïïÿ‹)L’ö¦Ú¤@ ˆÛ<“œ“rªÉ9¹4˜€•õU*±ºŠŒ)€|Ôs—ZC ö-E ÜòÌ ²#­Ò¤ª J>•¶ÖË|LLvÑÂÝ냉¾ë@Õh¦­ˆ]Íä2l+g° °XšEF›‹€Û|ÎûË!ͱ(Ó*ž2ÑÜB'9¹—aõ#¯6ïÂ|n`á’GMôGææɇ¦­>óðŽÞÔ¼Ýßzµá«Sd¿½·w©RŸ/€t¢!WgúçQÇÄÒªˆV¼í_%â,…Š¤ò×°tj!6º ˜¼$3ÎÀâ/ Àþ"ZŸ†a-¤îfç#ãXNüd©Ÿ˜sc”òÅF¯ö¢Éñ8< A½¶­2ç~$¦ˆø ùÀäfF» zŠ,LpÇÓ7WA5Ýý&¥”ð­ûÉÃhŒoïqÂÙÁ+ë}#`Õ·wŸãÇ€uÎJŸz­=R¨ßöµà…+‹<8¥*´¶Ê°U†¬¢ßµ¿9¹/¡ÄFÙ2ÔleÎwG¿å úC¯êñuûØ1¿þ>¡rµàÚæ#Ãœ{v÷B9Ûz¾Yî7K”ûþš)g=ŒXcϨµ¿£ð¢€ƒ~”°!NM Zô„’/K ¡nX.]Ø0mû˜¶›¿üHsÒ‚šOÏœŽçlãàV–=g¹ÏK熤×û(ÞµÌ/×Цw$TÐiŠà‹—¨\åIÏ"²“'}/HH4á W»6¼¥œ<Á8õªÿß½‘£Ž·_‘½°œ¤¡× ½ì6"[^OÎ.¯æز‹îÿé¡wé|õ½&lÇÊÛ4AÞdÓóüïÂP'àÌJ}5^š”7ù™9™°ÌÙñÏÛz|ÿüôós·Å(ãÚ/ï¾åÁe‘aWÌ*€îÍ¥ïfw\ϳ^eI«_X‰L@è²õCf²)§³Ç¤1W^f0,^ç-s†â¾Lm 㳆Øè}Äl³ÇÏ éµÇó/;Ò¯à< 7\zý[`¸g<wh%L¥<”Î`§Žµ|ÐÀýàøû×·á ½¢Ï R±9"ƒYùÅZh³{Ý2M²¿°cb¹ý©L%EÎÕ ß$<¢?{^IIHxN‡ó[ììšÏsqÇ÷S¤éQRÆä§y6`Ê¿çáå f¯_ULºh2”‘öãòvRˆw5wåM—ÎKÈ-õÂУp‘=?0Dž•æö‰ɘg£endstream +xÚÝZ[oÛÈ~÷¯ú²°s.¼½ðÆvº;^KEZlö–(‰ˆDª$eÅÿ¾ç2CQµEs.gÎÌùÎuF‘þÉA_'ƒ(–BÇñ`º>ó ˜y&-…?0Âœúirv~„é‹ÄO“9‘Lfxïþvq7¹ºŽ´Öž2b8Š¢Ø»¼Joü+ü™ GÒû;&¹»ªØûpýóoWéƒW—þÂÚJ>­Êºœ7¶›`.é"C[Óßb¨¯aŒÞ•8]ãp¹Êx õ–0\nW3J7ÐÝ Gn–Vß@%ùÏQ ÿë6q¯@Ô¬Ç0”„ýK6bw´uhçÿÚ³TB*å´5›!Ìç÷¸Ûº|DìÃÈéf”}v)¥zéþ²³Œ¾PF¿¹ñG¯®æËr @>¬²¢:í*]÷+=Š„QÆ._‘l7¬…»¡FŽùô©¦Ð|Œx7ÄÿÞPä–= h%"õjöøÑ.ë^Ç ÑÛGääÿ4E"Ž’oFŽYj‰yô? ¶ +¼f‰±M…Þ'© 䛚 Ü—”QÊæ/Üß嘌f%b¶ã¡ìˆجÏ~â*˜Èn÷0Ó¾7MWð bÈlkÌY[tì&«xÛÿšcKŠ$‘/3jXà3à¶í‚O¾48¸ØV)mÕ„Þ8TƒÀYW7yÙ—”ÉËóÐ>¬­7UÚà¡°ãÒÑd˜`zrB pi“Õ}ÈiHOqøZÇ?Õ ìÛuµ:n›è{·ù{MZ¡/=N¨ªúÄ } þóÞh|šx£|uo|a‚¼,¦¢l¸1]fS\†Þ¼D¯²8n[DKL¢;*8³ª^ælD43çï}™¢iåÅÂê ÚƒÏ#×­¿Î¨t­út¢’D„aðæ!R½ºRÆÙ*›R€êÁ*Nª«"}°¸´ÁðØ/L¼ $ù> ô«cðJIò͵oÞ@r¬wÈ…8GBc·äìÍ)§J1FzÿÆà§[œ +0EÒ×z#42kÔkì4]äR÷ÿ´{9ÿ +™"kJ¼‹š?ùß,sÛ«œÕÍ]£â#ñ*Oy’A^+1ÃùœÚLB²×Ä 6²‚6ÝW”^–@ *5Ë´p-ˈð +!¬&'5“<¡„„t–‡BÃ*0±ˆî´i±Èf ¡|»à¼º¥Ü“¤,¹­™ž??@ñ“ÔékÈŸn;t3IõDg;eÄ:éi´½À÷Æ€§¶é‘v¯3k p@æ„A{‡²¬`Ê°*Áå_ÎoöÑ=-fܸ¥0s®|ÿËù?îÈ^Àçc¨F„]DçúH×2J6Ÿk`Óì ð•ž1»¶ m„4æšL¦b÷@à%/cB"óþܔؠùîAÚ~1i¸ åeö†|$,m¹kW8›m½ Äs¾¤ äû&Ž¢ÿ㲊ÓH¹v/ ºötö +f¼uÉg²|é*ßk ™ð\ AZ—…åPö¥ãÞ:ÿ‚çt‹3¹ý:8©³ë 1Z•‹…s6$@Vš›©%ɾSv:î‚Øñ B‡_„¿Çö ½Ñ1,,´ W˜÷Ø ×‡:·"ï@8;¸´G6`U‚3† %FCA2ÒžU÷®Bø›ŒÉè”sÚ˜E t-èØh²*)aÒtÉK]~Äv‘í:1„ÈN=‡Ç+ x1X5-ì|”SÑ¡ZA£‹ØáttƒHÆ#yÑ‚G2àØôܹ7f§}l ¿L-Ŷnzô:´pû[út‘æ¶i] ™¸Z ·Á$HÕq8p2ÑœŠ~jAÂQÙ‚š<(uJì4]!U¢8¤ ")ù[/1öÚU¶Ánº¦žñÆ”ô*»î†ÝžC€·iF lQÒ…„›ýˆ/#òð\»|µâÔŽ³£ƒà¦\gÑɧ9jõ©/-€½h¸ r¼_“aiÞ\¤L%k¼$VÜ`§ƒEGù1E`|“¥}Ô‡/ÓP”ÈÄæåzý À®æ=WÀAì. ›”jJÎF ¹nÝ•áiö…3­äù'; g3«õo"´Iòü:è>=ŒT`Dì«#·Yàª@¿@qÛ÷¦ `‘;1ÖD§œ•áÝ[k‡ã²\÷½˜‰aؽÁ‘  ’±<±XÅâ:GÅs”° Ó}:¶rgZz0‡ï´¬*w“¥´õ Z]œòf«ÃêÝØ勨+mö?¿@˜ˆ(p7øÌ ./&=›Š¾ðN}ôSN仧ÛÉW˜…R8ºãb Áàðsä⺠RêS^w¬ º+ÌQ–ÄÁFfbY‘Ê¢¯¬M€³ +Ÿ«ð±ïû*|c+üÓ——›|Q¹ Žo<;Ñͱñp¶Þ±Õÿ-¶'\ÄÛ³²êѽ5öiœ®Ò™”Hâä¹Jù +¾^©CÔ Ò&ñÙRÁò > endobj -6382 0 obj << -/D [6380 0 R /XYZ 85.039 781.388 null] +6724 0 obj << +/D [6722 0 R /XYZ 85.039 781.388 null] >> endobj -2146 0 obj << -/D [6380 0 R /XYZ 85.039 761.463 null] +6725 0 obj << +/D [6722 0 R /XYZ 85.039 761.463 null] >> endobj -3125 0 obj << -/D [6380 0 R /XYZ 85.039 653.495 null] +6726 0 obj << +/D [6722 0 R /XYZ 85.039 750.504 null] >> endobj -2150 0 obj << -/D [6380 0 R /XYZ 85.039 653.495 null] +6727 0 obj << +/D [6722 0 R /XYZ 85.039 721.284 null] >> endobj -6383 0 obj << -/D [6380 0 R /XYZ 85.039 615.228 null] +6728 0 obj << +/D [6722 0 R /XYZ 85.039 693.58 null] >> endobj -2154 0 obj << -/D [6380 0 R /XYZ 85.039 434.077 null] +6729 0 obj << +/D [6722 0 R /XYZ 85.039 667.088 null] >> endobj -6384 0 obj << -/D [6380 0 R /XYZ 85.039 391.123 null] +6730 0 obj << +/D [6722 0 R /XYZ 85.039 641.684 null] +>> endobj +6731 0 obj << +/D [6722 0 R /XYZ 85.039 615.012 null] >> endobj -2158 0 obj << -/D [6380 0 R /XYZ 85.039 110.288 null] +6732 0 obj << +/D [6722 0 R /XYZ 85.039 572.243 null] >> endobj -6385 0 obj << -/D [6380 0 R /XYZ 85.039 75.542 null] +6733 0 obj << +/D [6722 0 R /XYZ 85.039 545.145 null] >> endobj -6379 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im3 4353 0 R >> -/ProcSet [ /PDF /Text ] +6734 0 obj << +/D [6722 0 R /XYZ 85.039 520.168 null] >> endobj -6388 0 obj << -/Length 2559 -/Filter /FlateDecode ->> -stream -xÚÅÙrÛFò]_Á}p-XeŽ0®T탽±³N,ÙÓ•Ç J(‘€‘õ÷Û× ÙrìÊ–ÌÑÓÓÓw7õ$„?z’F*´Ù$Iµ²i:YlÎÂÉ5ìüt¦b& ³ÌóùÙùË(žèPea6™¯z<‘r‘Ì—‚ÿçÙÛù‹_§3km`œšÎ’$ ~|1ÕÁ»_à¿ùt¦ƒ70xË oš4xóòÕë¼pñìò.ý0/.ðÜå|úqþóÙ‹yG]w/P’!iœ}øN–ðŒŸÏBe³trãPiØÞœm*rVæë³wgÿíPñž›ð©1Nxˆ™ÎTf¢Ïs+ÖÊŶ㖠G¸…* -q dÍ‚’M‡‹º“ZâB6ÐV›¼-ù]*ž¿"ËãŽÞš8®X/šr—ŒÞ9»frŽW+¸GdÕž'yÍv‹Ø:»õ™0¯ÓT™#VwÚFƧÎ$L: Æ}vQ°xh)2MGéq±Ò&†¸*cô—s_Ëf6’ùÎ<®ÙÙi"h\FH=EK|fÇœö„ÈÄ*ç’ïC¤àú‘P „qtHd~+¦‹<î˜Í™ 1Mظ%òŸ3ˆ†Сˆ|$†µ>Ãäªîr]u~µfåÑX¤Î F£šD0;ò2_u±"!…HËÍ°°É·¼²Ë¯eiEK ëàS¤ØªéŠ÷J9V §ªýS[FS­üU©`m‰l°óäç¼Ï¶„4aS.šCTOp÷59nââåÓ‘:—€}×ùWJ™x1—`JøÞŸÆaáïHáã éÓ#jBUX4ªt@hŠIXò : ô‘êú:˦ÊÔ¾(g¨Áý¢:¬&Y¨œ²!9Ï sæ²âˆì?z¤‡Ö˜“R):ùcvˆŸ@c"¾-œ¿ÚèÉ9P*hg¼lcéЛLÅI4q %R/Þ'µë¾¾ès #.cáçæ^Y¬}µ§©Øõ¼åo[n| -…Ø-#h% ˲rn+eÃåüÕßz}]p"„[­`ÊGpâ%53qÖD†ÒREØéf±å]öâø0Œh#-ïQ2ßš‰¬6’ò/=a΢ŒE[ñ˜øôfΓ=’„B¬ÒÄ<¬›ÜÁ“6Ÿ éé·ùT ¬‘X91|]ÝòFŸwûÀÄ«à=i]ÐQ™4bŒÜž†"n úÝŽÐTu! ëÑ|“i›’šÏ6FllTšDŸíâXˆ4Ú¥G]#]¶«Aƒ¤2ˆã “†Î9.ÄëR‹ç¨¿Ó…ˆ‡ú;Ö&Ê}áȃ݈`*”VTßÞ‘2½ìŽÃFEZø.n—¤ýÓ`ž¦= ¦Ò]A›çHÁiÍ ÕB0*½ö´eú"é´MãÃ/Øï‘*×R ´EVi®ì88æ ˆ'siJmå §&sÕJ4zgÂ@ºŸ¼£Ñ7ïµ7äÄ`Ôù™߃óóÊé„ç#Nî¦Äh€¹mx%§¯>ŽÀIçÀùQ§!1yne]b’iÅ×e¯St¨ÚúL%Ò@h2Ãì*ð(ò-¡û4ÑŸùCvî(ŸÎÅ_¡t†e/Ã<Ç>I’ž¦Û¸Ø©A’Ñû #°’i€߇z™|¯wpˆÀÝXÓÖå¢+6p“0Dhö-ÖåVHù&¤ë ›1,^=ü‰ñÒN)´¶7c.+Â"dª^“"Mpc탖÷h¦èeÒ(x¾GÓIEwò!þ[1V}µàÊ -‡9¨¥ºe={`² ŒûFRYºí·$Nᛢ¼^T0^U¤¬½§@2ˆ‘p¢” Æ9rØìíº2Ö‡ÁÊ“a¼‡<ìþÂj×ÕÃÝGôÚÅð@¿-ÀÚ¿¿ßö]º)jT[¹bIœÊtzÐwó‚%³3qçÆkžwýMœQDÀï9ƒ\<D^¸+×kYµÂ×ù°¸ÛK÷ @{*J–ø(ÂRHÌyÚìÙ¡X¹Ù{@]:}ÒPN5tItȤ͋í ßÙU¸Ë¿,LÉX(ú1<]•ßvF™؆OP§o¹ìe ‰s¥—˜/[/ÙR÷Ù‰Í1<`¥v% µ¥ #B’½ãÆ9·PpÈòÁÝ|1Gªn§üƒ b¥_‚˜!ùA wÌaBÀŸU‘·d²²MÎÀ¡áã—ݯ1 o“»…ísþ\x—äRʼO…SBÀ}Ä‚Îq+ #kb_Ý× -,>#í¢ K`>VõCNŒ15 :лLÜ»=ãõF&^çú;(ò°ÆY‡ië-öU<íÝÍãMÉÕH‰#½úý€«£€Vm‘ÎA˜È[ÿCÆSȺâ·Íáo¬’}@¯»ñûÊH¿ÑƇÒoq—ú«zÏDo×w£—õždõP'Á†Êdc6ücÓÏ]žî¬Jm6ž§GÆ(£=-ø Èêélª¢Ôžü?w掆endstream -endobj -6387 0 obj << -/Type /Page -/Contents 6388 0 R -/Resources 6386 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6392 0 R +6735 0 obj << +/D [6722 0 R /XYZ 85.039 493.069 null] >> endobj -6389 0 obj << -/D [6387 0 R /XYZ 85.039 781.388 null] +6736 0 obj << +/D [6722 0 R /XYZ 85.039 449.694 null] >> endobj -2162 0 obj << -/D [6387 0 R /XYZ 85.039 761.463 null] +2226 0 obj << +/D [6722 0 R /XYZ 85.039 410.058 null] >> endobj -6390 0 obj << -/D [6387 0 R /XYZ 85.039 740.731 null] +6737 0 obj << +/D [6722 0 R /XYZ 85.039 361.568 null] >> endobj -2166 0 obj << -/D [6387 0 R /XYZ 85.039 362.875 null] +2230 0 obj << +/D [6722 0 R /XYZ 85.039 140.944 null] >> endobj -6391 0 obj << -/D [6387 0 R /XYZ 85.039 330.375 null] +6738 0 obj << +/D [6722 0 R /XYZ 85.039 105.534 null] >> endobj -6386 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R /F62 4047 0 R >> -/XObject << /Im1 4096 0 R >> +6721 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F38 3057 0 R /F35 3036 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6395 0 obj << -/Length 2001 +6741 0 obj << +/Length 2154 /Filter /FlateDecode >> stream -xÚ½XYoÛF~ׯÐKQ -¨hîrÉ% …“8iR;qcI‘(-Q -Iùø÷cW&-J P È¡=fvfçøf–bìÁ1Ž×ó㱎„ëGÑx^Œ¼ñ -v^„¡˜’i‡æÙltò2ÇÂsc/Ï–ç® -üñlñÙyþûÙÕìüýdêû¾#•;™j9/Î'¹þþ›M¦Âyƒ+&¹z?‘‘óîåë‹s^¸<{{†K¯€æüùÞÎ&_goFç³v;¹ IŒª}}þêp7#Ïõãh|cÏ°]Œ@77P¾™ç£ëÑŸ»£xO™kÈ–b*b7–Áqk…ÂU¡¿³–ô¬xnà)²HºpE°1X*P±s™Ý§ °D¨°‘•‹jâ{Î]ƒk¡£ùîy|Âd—)O“÷<ùȌ¹ÃEÃüÇ3u"=ïžy?4 #­yrUW_<¡(ÇåæÙ•vµÖÇ ñHC†Á€!Dèú!Ùá¯Iä;Õôˆ¤3Ç›à AU¶ Êf3™JíTu‹¾³5£,èšÚ+ÂΪšÙo€)rªvÍÓì•ñ'ž%åÂ.—cÄ?··ÏèÔr"c§5gß`X>tTKÛ–˜WvŸ”´òÚuÊëyµªÌÖ¨^A¼h\°ÙT`tÅdÖÉ—;H‡MBçù|é¤N -R¬Eá n p”RÎK2aÍ´é}Rlòô”„n¬£ñT†® êœßÕˆ~Ež“—Jt¦!;<Èb.—+øËT=·úÒÕRªŸ.Îvç B1¡ì!ÛáCD ÿý«¯û-¹µ…6Ø> ÝHD='tm·æ² °‡¡þÿí²©Ñkt#ÎÒ'çùÊíºëÇÌ<é¡ò](G3½CsòB)ÀPOOÄ{ÁÜl’›œrtÅxô¾J -‚ÀUŸrƒw×[dDh|$x8p€îÀ?^è:4+ˆ´¾Èd{(ïÛ´± ™aààbµlS3Lšo©Áf\Êþýû÷ -·îpæ;Ebà'¯™"-—ºznò׶MÊ4Õ’òŠpnžä<ßt‘Tûíg@ɸHra Ek-EÅ¿Fê"COqätÝ>h]õb‘Å*©]/fªÙ:­ ``ØÄ€Œ¬mJš•;´›¢á¼'&àåp0À¬EàÊHàéS¯kðdŒÁS£×L;4£×Òà=^—|MqƒQ<¯ÊåSéÂõQñ–fO~?IUäFu]ÎÀÒ>lÞZKÓQíËsª¡®-g–±i‚Þ\0ÁÙÅ/Îó ¢˜©àÁÎÍÌ<箨]qõÜF6©‚K¼‹e»éø5a - -V͘S»hÆ 2Ú Bù#5k? |8>4bQÍÁø°4(üòÚôndînïx†¡¾Êš¶~Ø YhL]pìQ,ÍžR½ ‘ž‚T÷´z°¢è¥Û¯àŒ—Ù¼®-3E«•É*esHðÖóªlªÜ°­6 ¼këu37gWü›•pÝ­…°–½KðjÐsÚ -©¶ˆPq@\ã0´M0ƒ%Ån}ºbê"™#˜ ”)ï™HÄ!& ªëÿOæí',t–Ø_A#=[gF./ðÎA_{vÁç);5´5±Êl6´5©Ð‰ZöГ,¥ž.@Ôä@^n;YøضU M¢U:Ħ@Öœrù÷{È¢]A~ …¦¿¨È ÀËÅfÛâ³gWUžÍ¾_‘ÚÄ*zÎëÓCŒ,³Õ¶NZ¨‡}6Ùc;[Y‰é”·)3ÏRè[“6mÙV×M›ÇúÐ씯«e–wŽ›†tc¡)N‘¿à‚wÊ,ïÊüGg¦w<ìXgÿðêyU§·iÙò+*¡sçc¹uR®ÌxY#Â’M²Yô:ý® íuZß‚NÃ('ô^:>Šršƒ(giÈáFQD5*ÏØaæ`w;mܘMbynÓÒÁz%¥<ªª¥ÙÓõ øÅ°ö”…‡‘rÈšJkz0hÚŸ“8,ã¶<à ÍVk‹z:4ÂŒP €æÓa†á®M>¥#®Þæ¤Ø=Ó˜6££*á_ÀwËsn«9¥iÏôÓXS›Þï·*´%>ÛÛÌvÿ=#±0½=ˆQ±ºBðBEFÙ—®fœ×Í(!»ð!ѽ‡b›Üð=U€ËSSvbI½š‚Ë”&½ãVom+æ›#Éšš™•áZÒQ…yßž멾ývéÇ 6šüuÁ¶¤S/Le0 -]ÄtI$öۀń] ¬ÍºYÒO‚}Ã…™+k/᧢º!/ÒjËf›£ý¢ÐØ/ÒÔuà‚é:¸Xjj.ý¸8zõÆé‰Ø‹Å mY¬þt~}¹8}?›k­]eÄl†‘{r:“îÕ[ø³˜Í¥û—¼åòýLEî»7g¿žò‡óׯñÓO°çôÏ],f/~9:] 8™a¬|:úóoÏY·¿yBÇ‘scOÈ8vŠ#ãkámçùÑÕÑo=^3Ÿšxð¼Û1—±ˆ•?-”9 +Á{±(oB, %à-FH‰ob÷÷¬\U3-Ý;”H÷Ç ƒ“$$Ý?TyÒä0Kyá<)“uZ¤eËóÅ,†M0öÜ*o&„¥„TòÒ=÷ÒŸàþCy·Wu»ƒŸ2iÓü~÷ål®å¶fMß}Ÿ6Ä1n¬—8¤ã¾ÍàKËãÌ’+’6«Jü¦Ý¬á5:¾…qˆ'¥»Ìðñ°}É´ïÛ_jÜ[´Ú]7=Áê†ÏÑòxø;ò€R‡íwö¾ 2HóJyÞgX(=R*j>¦×/6(wmÜeU×|+°Óò·þCSíjf“õkažµlÖø>ÚŸ~BÙduºâ…›ªæAš,gðê ϶°)OZ\•nD{ÖT(<0Xdíç´¶wuô>ΗÁüeM_Véö„"4Á”€€* Ÿ´)„‰|>ö¤/Œÿ,Åw¨Å(pïQW(Y˜… ,ÓªH2»å˜ ®œ©Ømë*ÏÓí2H5ÙzƒZ>¶ÌQ$Š§pØ~à±J"ÐÊòq~Ò“x ÜQlwmZó™×A$âзGìí‚Å1ŸdÙiÞ[rÐ[q<&×¼1§µÿìäI¸ÁŽìôC“Ö"G3Ŷß±} B´3j@AO&üzëPßÝ:®@ŒähÖ¹¬Ñï½Õ#è÷°öÄ;îp’”Ö@ð ¢ n+²5Z õªÒzëÀ‚pŠ`CÞݼQj´£Àºk<|ëAœ‘2¡¢†ØûÏG5" +¢É¨FÉL¥C§< Ã#Ú®ñ! pðšpÙãH ±Îêâ¢b`G"‹¯Ä5¤à|r¤ðLk^Œ‰Ïý!úðê¬ÎI9{¦t,Ü5ro!Ñ„…œ¡Û‚r™ÙŸ®y×^F!úGÝÑ¢ÓgVõéÓ³ºpWWí(tÄJ1ˆÐ0£ ]‹Šß5]’æ½Ñ¢Xª²Ùd[‹sYk³Š{L89ãœpbbÊd.OŽL)"íCšúUú›`eŽÐÁdŽ§âoC:HÏ…ôaýðÒýÝÔñ0L&ÿa0±FàGö$˜8÷£Ìþ0tÃÓýÞÕ®Q¡m[•];ÆmÚøÕR2ß]Jg6zöx ¢¢È¥ý3¯ŽÓ¡ÎU§²¢/˜äåuaÚNÉ4ŒVƒ ·««lïêÈK™Þ1›[˜ÍK›º‹µxÉõ¢TäLrùF—6-¶ø{SU×IýŸ)ËÿLúPFÃs»@q¼IÊu:e»žˆLgïÙØij)|Ù%©—¨Ò”RÛ‚Š«–Ê(Ö(ýb;¼2Š$ËÖ[8’#~~Þaâ¯×Að +}d R43ìŸ Êc¶æ>Þ½xùXV{¨@Û®.z÷vBÊ2ìk ¢³Øp˜Ó\ççM§qË5òI×o*vþÆ.ì8¼£Æ_ð™!:üwH~wÅ]pÏÁ¶¾À“>¡°)y’^,¤R½ÙâÒJMó|xûl“/tV2îIŒlçAY…Š©²ªL»ÞÆT9õ”ÇCržnT)Evø¥m6eÛlWÙÊbþÉL{®­/ª6í;eS]10vO*uŸ[ëítCî‡1Š"ÁŒ°MäÂÎä#÷êìÄn¸á•a˜±}\^qŸƒÒyãGã+É©Kzï+|²aŒª×«hÞÜY¾X1@ÆCm‹¢¬±µƒñC÷=W$«=ï‡eI‘XüÞ&ëTL€ĦŸTiô¥*ÕV¥Eu›Ì×"ýœ>§Âg›ÜÚ‹=ìÆ¢ÖúÖ †¼‹Z‚T¼lëê¦ïóa‹1ÉùØ£Ý?XûH­?8½Iló%PÃ>“Ʀ[—oÕ €üÿŒÞö0EQ jèø¨Æ"Ôÿ’$ÂE—4Ù$šÕ:µbhajus,½Õ°’aL_îjnðªÊ³M± +Q†lkÒ`.ÜÐBÁ,,i°ïå *ÈàkÂõÒ^6ªbh©ƒ9;'_£…å²oIw½ü¾²×Âc©•8¸†£]¶&6° ŒbjI÷UUOxÂWǨ²¯Ó1,\3Õâ}D«¢°noAfßZFÜÉ>ö0>†ú«„Á ™0éÇPtÑfÛ7râyªs‰žŒ»®µa;ŸÊ¦PH#“™Æ+Áoûp%( æ{ZOÔz~tЩ „Ì8ºÿ$2endstream endobj -6394 0 obj << +6740 0 obj << /Type /Page -/Contents 6395 0 R -/Resources 6393 0 R +/Contents 6741 0 R +/Resources 6739 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6392 0 R +/Parent 6706 0 R >> endobj -6396 0 obj << -/D [6394 0 R /XYZ 85.039 781.388 null] +6742 0 obj << +/D [6740 0 R /XYZ 85.039 781.388 null] >> endobj -2170 0 obj << -/D [6394 0 R /XYZ 85.039 761.463 null] +2234 0 obj << +/D [6740 0 R /XYZ 85.039 761.463 null] >> endobj -6397 0 obj << -/D [6394 0 R /XYZ 85.039 740.731 null] +6743 0 obj << +/D [6740 0 R /XYZ 85.039 741.337 null] >> endobj -2174 0 obj << -/D [6394 0 R /XYZ 85.039 643.781 null] +6744 0 obj << +/D [6740 0 R /XYZ 85.039 673.591 null] >> endobj -6398 0 obj << -/D [6394 0 R /XYZ 85.039 612.493 null] +6745 0 obj << +/D [6740 0 R /XYZ 85.039 635.065 null] >> endobj -6393 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F35 2976 0 R >> -/ProcSet [ /PDF /Text ] +6746 0 obj << +/D [6740 0 R /XYZ 85.039 473.591 null] >> endobj -6401 0 obj << -/Length 3444 -/Filter /FlateDecode ->> -stream -xÚ­ksÛÆñ»~ûÉÔŒ áp‡WgÒŽk9©“HVcuÜŽã R¨I@ÀÈú÷Ý׎(g’Œf„{ìíííîíë¨f!ü©Y¡Îgi¦e³åî,œm`æ»3% Yx0ÿ¸=»ø6Nf* ò0ŸÝ®BãÄ“$ -±ObfJy£xò00 -ØdÒ W†ÄsÝC{”AyÌTNòŽK¬˜ý2ì&Ï5ƒxm"~8 \¼Ý©ÙedÎ+ŠEñ ‚ }‰ì{ýŒNæ¢4v[·ÍŽýtY,Ñkݳ⥱™ÿ¯:}dUÁVmu‹$ p †Ápßj!¶?n¶ ±Ø~âEͺD^­E;ÜhV žç˜®“Þ7ü¡°¤$Î$à”ï›–âà‘?¹ŽA 1¶¾ÁÄöÊÆÑpe¡½,Ü}„^'ÖÐFWä’|䂲nø‹zëˆÖšKìõ2ËÀ@ˆÕ +aNf¥ê)4„.í{²W8fá;f5m¿Ü÷ÃìøÒ¤ O|¯)ôìÿð,XÉ•ÝÜ™øÀâŽÀiæ6ÖÇarÚJã¤ïáÃÔYª¢žâ`Av*Œ%¨=Dù¢ã¡‡¶\—mY/YpÆó·kžBX@ã,špŠq7 éºnÚ¥lWð‡ßs§Ì(—í§ÜÌÒµGžŽí³ç?1<¸Ä«L2Ä$XAù¤A#Ë<ÆBŠ-NÇ÷/«Ò0°o'¦¿%ƒ.ø -Î&ØÑt‡{±U7Ðá4/8x`h©Ÿ ;Ä8èȳ@§Zp ãÔh&Aùäé},Äs)x;½Ãh$ÓidÓéŽcx†ß þ\ 8_Þ%BßWµŸ)BŠµ!ï³Ïf/q,*H‰›€8·o›-§(7"u¹p.© -¬÷Yð´öSpp¡:‘ù¿Míª‚8³îðÃТëñKqy»ê&öÄÒIn±RÐ\cõÝÚÈ„8"Š>Þ7É óIÅ¿Á'²¤¡:¸8.â"Å(ß-ÓúâN¼W„‘ñ@Š‰ Ll÷†à´¦ÄL~ÝíÅñ=(zaz”Ix$wQŒ‚ƒ£„v•fMˆ”R= -šÕù´P ìY¥¯S¬4.È÷²E‚.‘ryBR»F9‡NÎRô:%k…í1ß$ñ×|•eK¾âª7…çua'´û{‰®‘G}µnxØÁåEÀë0 â$=àõ²!Â1ö¾/¬´™;Îå ) °±¦L½   Â,åH£ö2¸` º¡Ìܱ¿E#‡ß þ\ ñ¬9‚eMÑ–ÜX¹'‹šÎZ¬J 0Ö´x7G«èÒD:D…™¿%©ó¸Ka°sO/.E&”SU™„VA¡‰y¬Žâù‹×ÛÊUp€jØ-]Óa$4ÚÊh=Ê =íçîjÐÔûÕAt7VRhˆ V·ˆê–mõÀñ‚H‰ -&† ‹ÀêÅ8ÙG–{¡æÃŽó˜[.ò ƒÙÑ aì½S©bá¥É3Î&m€²É˜3íbÀ!= ÞKÛ0.°2ˆË@^ȤӵàÄã˜2`Y:-ïc6kÇCíó†­nÒ­ÚñÄþLJ/RÐß e¢ª–HjÁSî¨L!yå,r× ZËhC–Ï‘³5ŒqõÁLEÜ\ˆh¼,˜²l~ré'¸Àª¹ßJÌir¹ûËD•Â+s¥È*~74:£€öq{±q\ß*zÛ’º”÷ž…]Q -¹+Œ -DJgc8k¿/^¹«qe Yõ­àò“û2ÄB.IAæ†f*KR[±STóOã›R¹ªU_È©0“¢F>ÿmÕsç£WžxÉoh'“kõI -Ö:w D<¹2D@…)À.å›|Þ|1³¡›Ã#Œ^®×tr¶¦®(F8jWN\?‡qHÖ -&‡rL4¬qíª±Ê|®=Ë N6d7_bø©‚pÕ¹…Dÿ¾g(bY´Ü­É®"#‡è$®RŸªÃ—œqµ)º´bî{ßȢɮì;hÑ—²Ópíh'*Þ@KtA€ª¯“8×X™U“„ƒÑ0I„×5ÂýjÍrC’akÄÈíFzãŠ,ûfœÚ£j³"5m/U=\ÑNÑphŠU£d‚l8‚“_tS禪mÃ//¾™Èm–ä½7§‘• Oöîå6BV7˜[ªºÓt·_2¾>ë= ú‰'=ˆ‘P¢+”æK›˜ÉN“"•¬ ¾ü¹ð©” ÉdƒØÛïxÎ:¶1œúFiÂ?ø±?åHÓ£÷¿ÓŽX ‹}c(J9šÇ)OLŒ`µ"D˜¢ûÜñ¨ó½ˆâ²áio+º{nõ2Ýøgšñ©ïØâàøQaçïÁ+žÍ[´ -beó¢'ŒÍK/Æ>Œ !ëÍ3–s ,¡<É÷P§UOÞÐá:¡ƒè—~¤— -ÖfWzÊ—Ž¦+zîK=ýs ÃWNÑÎ!Jý—ö½©òbÀPÜmíþ–_ðç2åØ;¹($4SÏ—¡> endobj -6402 0 obj << -/D [6400 0 R /XYZ 85.039 781.388 null] +6748 0 obj << +/D [6740 0 R /XYZ 85.039 421.947 null] >> endobj -2178 0 obj << -/D [6400 0 R /XYZ 85.039 639.916 null] +6749 0 obj << +/D [6740 0 R /XYZ 85.039 395.151 null] >> endobj -6403 0 obj << -/D [6400 0 R /XYZ 85.039 607.699 null] +6750 0 obj << +/D [6740 0 R /XYZ 85.039 368.053 null] >> endobj -2182 0 obj << -/D [6400 0 R /XYZ 85.039 607.699 null] +2238 0 obj << +/D [6740 0 R /XYZ 85.039 298.591 null] >> endobj -6404 0 obj << -/D [6400 0 R /XYZ 85.039 573.152 null] +6751 0 obj << +/D [6740 0 R /XYZ 85.039 266.568 null] >> endobj -6405 0 obj << -/D [6400 0 R /XYZ 85.039 435.278 null] +2242 0 obj << +/D [6740 0 R /XYZ 85.039 208.535 null] >> endobj -6406 0 obj << -/D [6400 0 R /XYZ 85.039 381.081 null] +6752 0 obj << +/D [6740 0 R /XYZ 85.039 176.512 null] >> endobj -6399 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F38 2997 0 R >> -/XObject << /Im1 4096 0 R >> +6739 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F64 4225 0 R /F18 4228 0 R /F58 3380 0 R /F35 3036 0 R /F62 4159 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6409 0 obj << -/Length 3000 +6755 0 obj << +/Length 2951 /Filter /FlateDecode >> stream -xÚ­ÙrÛFò]_ÁÒK ªÆ¸òæØNâÄV´‰v³)Ç ‘(‘€ B–õ÷ék 2Úò–ÊÖ===}wCjÁšeq™|–f*4Y6[lÏ¢Ù -v~}øÍ–ðŒŸÏ¢ÐäÙìÆQ¨`{{´…±52ßœý~ö/Š÷ìŒOMq"6Ygæ*ž`E…qd‰¯Ë>ö®kîáßòó~ïŠfÎlð†%Õ:æ -!šU[lw VÔKÞ¹,»us1×i€ÿg,ß68±,[_츨ÏÈÉ’nèD)×Á’8nË¢+—!ò ¸Ã8¸^ó Ažoù#îU°´Ùð Q&Є»X k÷J$7Ï‚ ¿(6›'^ij>Ô ¨G°©Ê‚8dU ¹lÀ5ÞÓÍK|ˆÐ¶.kFÝ­ßÎ𴎆•<£ù+RÐFQðWG€­ºå'¼²ypœQ )11f]à3·þeió`[,ñ¦8áª`M—my X¼œ75½Ö"Ÿà Œ»uÿ@…(0›ëàÏ‹ÌàåõXaÄZ$…pÇ‹ŽïE^ݺu¡¹ÃBly‡eî.Žíð–ÚžÇåf#B‡yÓÙasâÇnÝ´Ý|ñÐíPƒÓ!YiÔ Æ,Täq¯ö&oL€“¥£qU:2@KjQbvã06¬%ÿÚñêÉFÝ{D¶nÍ’‘{­²hÁãžÆÔÜö`‡/¿'SõôXM7Wm¹èš–D |Ø üeBšn•Ü -ð¢”ì²áýŦ*½Êk‚®¸«ð-+>æ™ -ãº|ħ²±v|~d¬Ã.6PVøú9ƒÈX?ä¶m¶ SmwBÜ´ß]o½EnE™7šˆ;Êzwys‰Fí©}ÁË¢õRÖ¨7(X{b@âkäÌÄŒb‹7Þ²ÄzÅT´ÈWeFPé˜tQJ­ÊŽŒ„äÞîzª‘y‡¬òo‹MðjF-š™±"’ñé ÿ‚¿=¦ïÝ!„El$ùË:½7FÕ^¹!‹XÖÐîIuâ$(ä–ªãßE×¹7oï;Ùì>¼eg±’{úèß<Î Çêˆy´å¶éJt®ÙÈTÀÇ%I|_”*Ž™Å iuâ™J'q ‹ZÜ)N¼çhI8¸Ô–÷D6«½‹C¸sƒÞG’Þ ™G¤„0(%üý‚!EJ8ÜŠ± áuùí'Æäy‡œKNƒ_¾ý/¼ÆóôÞ…V~ ©Úíª¦Þ1@/‹dàøøÀŽèºçͶZ­½ƒƒ¬=ɈŒ=¯+Ϋ±‡AÕâc´²ç8Qí=À<¥;´Í”m²“±ms-:hN4BùÍ ñn+ÂÃEŸë8/ªãlõÞËñ:5ã Àh´¥¸Až’þàÀ§*øfÇ·l8eóþÁ–åŽCAÊêQÒš ië‘*Ö¬¼é•cØCÐå‘o#gW¡Ø•fC0㌥æI]~éx$IŒªšÜe6p—OŒrœ¨ä™‚œùàŠB·žxT´¥¿kå¤xdJ¼u~ÛŒèd±v×MùÝj[ž‡Gꛫ0Iãg -³ùx²pÀûÀeGñЩððˆÁÓ=<¾Ò2& -£$õåEbgJ…9¦œ·³< -­ÊS¨E4—à¨Ø}[“êÕþcåˆÉãòD;û/É•ÅRczBÿ4Zxñvkf¯ u6 WÐÎx¹ÊÕÒ9qØÆ:ÌMô~_Þ’r¢À-&Jå† ÈIÝRZC»“1ð'è¤p“°Á6öΈq>ñò¦ÚQ €c@;>såÇ+9ß²+=ŠÃª‘TÚUz~AÏ©¼èë3Ž´^¹ 鯋M®ˆ"l½6#ÔfÎaÿݧÿ¼{S,îîyLU.mErEs»_]˜›aâY1ÒëR²+_ÖEspâ½®Åâ(3–,Fk¤æ³$ÌRÄƆeºK@h•ˆ…4´å8ß|öácxv?iEaù sÉ]€™Or}µ¤ª©æéî‰/À¹ËˆøY@ _#^bù~ ÇtÄŠ¥ÕÀ6H¿t4¶N"ÏÖeŽ×Oˆ ã¯6œËW|Ä6ͦèô^Â×/G-©s ñÕ§Š{Ý¥ó©Lö|'Ñqææ¬áœ§…ëNÀø\Þ·ÂWP7 .õ-«eßj,ì `[2Ê&³AlüŠH‹á\ÁòÜ7û¾*üªTìžê< m~¤e{&53ƒ¼UPQfq6`:¸ÍÁœ¾N)¥G÷‘ňŽ"42+cÆ ÌÙ=šà¡æÆÏØÎ`ðaøJóžË»Ý#%ÐíR–©¶bEIÞGYÆI·ºÓaKÀÒÑ0`f*—Tî:´ˆ=ÒÞ›T'.öKuªB{ZŒâ¸ oÑÇExôž^€Ç/òâó7µ’"‹èùl’… ¢y$µøª\V]HæúeŠ[ 9,DƒÎ6¡E¾ -åLsÇÍf’áwÍ# Ò˜QÝöÓ/ØÄÿó€+65rßÚÐD꟭D™N÷ðç×|€l‚ƒ’gä !qï~}õòÝiYû"MpýiU'Ö I{OŸA^ýôöòÍDÚ›ÐfñAêËÿ S>‘XZ&yú|„¯¨Í2hãþÃTÙbSb* Öaœþ_ *ñw•yàáÒP±¥øÏ}}žYL%0žóOK_§Tºgfø=Ÿà«Î1,µ×¥•±Ó¹%O‰;RXPËÁec˜ÂÙKjé,öqLJf$ÑÙÀ#ÊUÇ“{OQóüNºœÊ.d‹'z&²Ü˜ªQ´íóEóx؛ЧhP8<é¨ó2U§XðÅÏGÇ¥ÊÖÕ(Üg¦¼.2TzvÂi› çé/\ ¾5 ’lØ¡.uËc¾-?=TmŸû²CÏ”$‰ ®è'¿TÝ^`e[U>R·®:2}š]uMûñX€S&þÎ;€9ä kŽ†¹S·ù@wò:ê†÷±ñ-wÂQá/sÿ È]j¼Á8¼Ânî;ž@6BüsÙÈ|1lÚ®hÐvÕYêšP£ &‹|äaª’¯²!ÂNY/ÿZ××yÌ}‚ïœø: †Ñ¸Š®ºcúIµNNjƒ‡8ª ÷Ø£špü¯'.rZÐß¹¡¤¨üɳ_î;ÉS§¯+°ÿBþÂ@ kòó…:š'&Y¨ ½:Å·ä(ãßå܉«<ëNÝåx7¸lú„Õ}dÂ//‡‘ !¨ý¦ÅWâÂø3¬[á–šæ8ÅmuÙ•¯T€R.ÚJâÔ’Š)C ¹èÆ~“MÙƒ{{t~Où¼Ò5IʘApß¿¼äE_–I Ø/÷ -wXòpYsç\ -Ä‹_$ØáÜÉ_,PQ%Å–Ÿ¸ÿ³<¦…P ë|J3à¿ö«þÆ«2䃙ɧÕ+†|A+G …íÓëþnæ€à¿>E¢Ìendstream +xÚ¥ÛrÛ¶òÝ_¡·J3Làí¼¹ñ%nbG'Všvš>Ð%q*‘ +IÅñùú³7ð"ÑIg2ž±€Åb±XìîÈ?wùÊÑñ(Œ\¥£h´Ø9£5¬Üœ¹‚ጌr—~Ÿ_ûÁÈuTìÄ£ùŠPæ˿Ưß\ÌæW&S­õØ3j2 Ãh|y5qÇoáß|2uÇïa0c”Ù‡‰ß_ß¾»bÀÝÅý‚nçê÷ÝÏ'Ï;»šw8™e¬|9ûëog´n;s”Ž£ÑŒåÆñhwf|­|£e¾={8ûoC…×̈w \xj1¦n¬bÏÊ…àÇXEH>i­žy¡øŒvÆ0¾½dø#¾€àª,‡¥5rw~x“ÝP«(åü›´~¸½Tt¯o)£÷ "åz±`¯J Zìøìzà âøSã|Y OÃ@ˆ—‡´üŠð´ä9($>Ðíªâ€TéîÄÀhêO9^¯„OÓÑo3¼·"­*W>ÑU‡ÏnΪê¢L+ËxÊÀm1™¢Ø“-Ï÷t½ÏŽk¶‚‘å+•»¤Î +û0xUy +K©L×Y…7@&KûÄ—½vW\«b “-³ŒÛˆæšÿ!a!ô ÿá7Ñ}å!Éøtý7o¯þ<¶5VcŸOýC‹ÓÊè`ÐÞpuÅ*±Râwï__¼;á!VÚÓ¼õgN~túÝÅë7·÷WŸ]mÞ_Ï?]| ñ]¶(‹ªXÕ8Y¨¾çƒr èõ¡,Ó¼þ=-+xZ„ÌÊb•mÓwYUÂÔU{=Õû˜7FŠ¯ìí+»áxÖQ'"JP~ÞçIdƯPBÔ¢R¶ ‹Ë¶àŽ)Ü€+xG^4òÆ·yeã2…/H]KÝ®ÛJöüªô?KP7´6]­üE´ Á¥ÇÆz4Zæ­Èaöƒï(»RŽ)´’¬.­¯Eè׉ïóÛ„¶,Ú¸dQøQWrQ¬"×ÆCñ·»dÎ÷©ìb¸q?Õ±“lœJâÄ/$+àJ?ê%+Fi%+Z²”»$_& jhÊgÎUfl>[«ÍÕ@væ©0z‰í+×õ¾ŸÊ\°Ãéö€´ŽgÎú– —:öè]`zjâ°Fú›ÔŒÁÞ¢é1Å|4à´âi^ê&iMëhsòHbµ— þ-º»ØQ=ÙAV§ ÝÀ…´ø@Û¤WG>¡±I?ê)3ò臢“Ueƒ~‘£rD»Är“& µ=M +Ùûhåhtø]àÖM’¯-¼ÃK¨ªj0:€ã”|Ó׌'ßÙd3¢,†øÒä ô„O`$›Æ“Ê&§ÒûtãÛˆˆNˆ¶ê’C„qbÍÕi¹GÁŠ’|—,SµÖíte“mQÕ +£©?¾]!(`Â’ F0\¦ÜK;µ¦; +ëÀ’í¶½9cmä°Î³ +nnß 'Ç;:4Q…žéeý1æôÍŒyñÍÀÙc6úÈfΨM 6¤ˆç( 1áádYäöL|F¢|Xo˜ˆhÝ6[<3kpMQ _WX,B xH›ý2Ø7RþŠ¨Å¡¸m+}–'îÑ5¾ +!NMÁ‹z¾ÛuN'uŸ yYDu$˜æ_T™.–gî`Þ‰Lz¾ +Ü—«UÚåYô>Êò8N¨{[çAõéwç}ÁF!ñúÈ5à~9Œ¾Œ\å˜8Ö¼Ú§í&œßîÜÑe,:Yu  ð‹„ƧG>ý#¥#¨ç^Eý{þ]dåâ°ãz'A .Þ*^­6Åa»Ä±”ZÜ£Ö–M@jwV¦´·&ß‹Ñ +W0/dSÉj!ÍÙd^CÞ^qÒÐF™qB¡;¡Âk@ßÊ4Ác§LGR>ãy´£â!˜ Z¶¬F}î'üžkK@ownˆ *§6w©,g[Œ%¡?!H²|í³çwbÜ8KØùÑ©œ@ž^p—ØòÑ81WãD"|öAœe‡°‚ò˜9I¦˜:f9ùb@uà7b¿ã^¤@=Ev\{±ù\q’¿Cgä…V–°¼H„nëzÚº˜TóÃÈs³å‡–Ô!pLOŒ™X[SsË‹bŸQ—àG½¬ÈsY‚¨J½,Ü’Imú¸A2ùýÜ]ÜÜ|ºz]W œ‡~(M¼¸oÚ3dø{ÜTÖž?Ž¿ßáŽWŒBþÊr·ÛÒç|™ÆoœR½,s+(ËNd.Ô9o‡öø³uÉÚ2PÏkoØ_ˆÀ~î+¹ä±Ó–ÖË®GûñIÛ¼n`ú¹ñÿkZ»Ïendstream endobj -6408 0 obj << +6754 0 obj << /Type /Page -/Contents 6409 0 R -/Resources 6407 0 R +/Contents 6755 0 R +/Resources 6753 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6392 0 R +/Parent 6706 0 R +/Annots [ 6759 0 R ] >> endobj -6410 0 obj << -/D [6408 0 R /XYZ 85.039 781.388 null] +6759 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [210.289 306.495 277.19 316.063] +/Subtype /Link +/A << /S /GoTo /D (fakeperms) >> >> endobj -6411 0 obj << -/D [6408 0 R /XYZ 85.039 321.225 null] +6756 0 obj << +/D [6754 0 R /XYZ 85.039 781.388 null] >> endobj -6412 0 obj << -/D [6408 0 R /XYZ 85.039 295.771 null] +2246 0 obj << +/D [6754 0 R /XYZ 85.039 761.463 null] >> endobj -6413 0 obj << -/D [6408 0 R /XYZ 85.039 160.279 null] +6757 0 obj << +/D [6754 0 R /XYZ 85.039 743.459 null] >> endobj -6414 0 obj << -/D [6408 0 R /XYZ 85.039 122.359 null] +2250 0 obj << +/D [6754 0 R /XYZ 85.039 575.554 null] >> endobj -6415 0 obj << -/D [6408 0 R /XYZ 85.039 92.533 null] +6758 0 obj << +/D [6754 0 R /XYZ 85.039 532.904 null] >> endobj -6407 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R /F20 2961 0 R /F62 4047 0 R >> -/XObject << /Im3 4353 0 R >> +2254 0 obj << +/D [6754 0 R /XYZ 85.039 161.494 null] +>> endobj +6760 0 obj << +/D [6754 0 R /XYZ 85.039 118.541 null] +>> endobj +6753 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R /F35 3036 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6418 0 obj << -/Length 2914 +6763 0 obj << +/Length 2942 /Filter /FlateDecode >> stream -xÚ­ZKsÛ8¾ûWø¶TÕˆøfn^'™d6v¼±¦2[3s %Zâš"5$Ûÿ~û2)îa·R‰@°nôãëF3ú\Á}ž„®òÓó8Ñ®Ÿ$çëý™:ß›ŸÏ´P,…d9 ùûêìâckå¦*=_=ôû„núç«ÍïÎÕ§ËÛÕ‡o‹¥ïûŽ¸‹e'Îû íÜýþY-–Úù -ƒ[&¹ý¶ðçëÇÏ_>ðÄõåÍ%Ný 4®qÝÍjñçê—³++å ’¤(Ú_g¿ÿ©Î7pŒ_Δë§Éù3Œ•«áõþ dsÃÀ—çòìîìŸv+~œóª)M„~↉?V…'T*7T©âóœ( ¬„C”<ÎËóÓCVà+šúi± ´rp¢Z7y6¤£q¶GµÜgkyr³ ÷Ú¹‡ÁÓ–'ËÚ ÌÛ¸ŠØâtWóïýbéÅLÐ!Á3QËŠ)|¾‚6<ÖJ„N^ðOÝàoà4OxYË?˜ÉÖ à÷H\:4'èv©Qõ)éªk²5Öˆ¼©· œ—‚»Ò;žDõ qÞírPVɳ l}ñ1ò–Ñ‘ïF*†È¨Ê»}]¹tÒ—œÉ y0ÒBý“p«6<@­‚áõ#Ï<ÐÁa7îs’¹Í¶¤ÑÖ¥/=/ßH`»*M­:t^Q3õ>Î.çb’@G ¾5IܶüŒfÄe`Zñ½¨6$™yòû›Upá)õÂOìR oÜ -}ðˆñ”Š©þP:@´Ýp•< =® ÙVaÝCDÃíÎL¶‚`<}È:! 4YA!IÎCé 1âÈÒ¤üŘˆ¤PW˜Œó†_’¶9Š•]Ñ'FŒ#TÁ¸+P²ì¾(gÃTdœ$WG|eàa`Å·½-óöˆN±Ø c¨)|0|€ßj‡ûˆL­œú©ÜLFo4°ÂS¥ìP5?½ã_®5bÌ~^ -©“'±àáPªXüAÅ;íŽ WÊã€u Š Ó«ˆbg×uõo0‹ƒâQ@" #v ®òg>ÇÀÒ˜OÏö›LÇö=öŽ´w÷ ðP\ñÊ3ƘAà± 8¤ÈœcØ€#Â…A_õ…á¸Á·›ÂÖ“krÇ$ ËCe=Qlà -‹_ø€¢°_È&-3Ú×08Ö¸%àÐGu4¤/üî‚®¥ô\†*v>w=÷NØŽ•}yÀä^¦Ô`÷÷YG® ©M?ø¢îo\M‹é)ôè:ð5t®‡O<›:ïóö±«D«ÎŽ»þ*Jÿn8p·»Ž’IÇ»\s¶x’=é:\nñŽmSN‹p¬0Œ'’Ó±1•Ï%;_‰mÅé_µ`\J BVñ0cªA5è+21¸Á D˜A5èòÊÖcl‘$γFXRWC «:#‡4”¯—Å;Žm"Í´Ž" Ø´“à: f4,Xm{7jB°~j÷)Œ·ò•)¨¬x”ª­šJüÿ¢j-*®aÑ,Tæülü -Çw¯m—ïy|…45ólê’w¹]3䥬eoÂ!å‹ú ¥Îd¼ÄÖÓ²f\Þ‡žáS­´w¼˜šU¿ì¯?ìå¸á¬öÊJN¿š°Â'Ê¡¾r›À Æ"—w˜KCšüçEܘ#Ùj~·ÎÙ½¹A඼-nØÿlù…´AphA×Ó^Í íò|ß6¢YB® E j¼—± ŽGÄÉÛ Xp¬îJ©í+iT©†€ - Ñr®¥¸ªO¤©R6Ôaœ•VEð4*Ih¶ãKŒš¼êÛB~˜ûžõUä1y€õJÒÉöcêk_ÞYe°]qé:V‚\.×ÒÌãxÜ3&gRa÷Ðv¡NßØXZ÷­Yx" %£ãÄÛÄ—2`GªØVYBÄ(õ¥ J´™s {K"`uOžd¥)KBÛ0S—ê²(ìo0™ñ¾”z­˜‚{F½Ò_é¯/oNõn°Ô zkƒ hNönH·sˆâÔý<î›`_³>jnê}VHv’ËTöún¢²³½éQ#‡>?Ôé%÷øÉUËÒÖlÚywÂR.›©ÍZj@3¶Tš¸>\ Š¦GŽ¬á¦˜„É,7C3ÏNkðXíñûB_pŽŽÔÐíäs²î?W$n”š_¾^!Z¢Š¾L|Ú´ å´Â7öÒ„(P´]#@p*˜µï»‰7ÿq@sZáBCÁ|Zá3Üz…ϱ³ -ðûF÷Û^CÏŸŽ¬ ÎMJ=†£ÄMÑêõ+ãÊU½?>§näëùoç–ä¤N…Y'U:ÃÊjtŽ—Qè€Ù]ïcC÷æ«Ì›*è¿N¢ÎŸº*¦û-ÅÕº®†ß.¹Îõ¦:4gd¦-QWüýÇô&ÔznèÏêINª_HP#áIõÏ°²êŸãeÔ?`6ãÎÒ„ë]×ñ·¤7ÞÆn¿ð© Œ¾Z¤˜h§5æ+w:,á/—wÿÓ¤°jZý¡zžëi# I0²°ù#ÿµ'2ìendstream +xÚÕZmoÛ8þž_aì—“ZEê…8à€l›n»›¤¹&½Þa»T[¶…ÊVVR6Éýú›7êÅVr‹Ýûr(S$5rfžy8ªšðOÍÒÈ´%©òušÎ–»“`¶‘N”ÌfÆ⇾¿=9}Å3ø6°³Û5M¹]ýì½~wv}{þq¾ÐZ{¡ñç‹$I½7çsåÝünç å}€Æ5O¹þ8SïÃÛ÷çÜqyvu†]?ÀœóK|ïêvþËí'ç·MÆ7±FU~=ùù—`¶m< |mÓÙ´_Y;Û˜Hû‘Ñò\žÜœü½“ÂcfÆoMlxáf,t৩év®¢‰·Õ|zW%ì#Ž½/A4yŽ‰—}…±Ä«æðç7Ü]Ãê &Æk·9¿rWÃn«/2¥ô¼ß4xnÅf3rl®p ò²%>,©«‘É(¥Ølq™¶a9ëªæF»e8ïš$6—ÁM]aß›šµÜêÍW"÷Š¿_iË¢ì¦à­áÌ=š í¤ð-P¶$esZiÂÀê^Ð7PF†‡â;©aâ–¥Þâé•xûü±åVÓ’wøÄgˆ½u]s»™;™ƒv©ÛlOçýಱ½÷{w5¼O ¨{|Œ—®šmº·Ñ•øäª=ŸYÆ?_”6¼A™K½³Ç=_³¦h^9CtVpÛÀî¢mòr-m±sJ˜·Ùç«ÑûÚÛWx íV7D+OZ:ZÊ´nµ+hˆiiMºw¤›rbÊoó(’¸n…&6þ·H”¥ÏB,˜$AìuaˆUžÂè¯AxÃ:ÂN¶)vú6µÏ( •¯¢èe<½§šÃÀ ì3ç;ø8‚@xóàÐ$cìÄon¸ ♦Ž[0 Çí#tŸ^ž¿âiOë÷<†¦£Þ¼1‚U;\ÚùIÉj*7àR)ÿÞ ûËg7árפC‰ëQ>±ëœ£À¢­äà~Z²ý&?`ÿ]ìnþ&²HT“x¼0•Oh†É»™ØGƒC샣…çƒ{JDt°vc=ƒl¸ -ƒ“Ž!7Z§”ÙýžNÃÁ›£œ †OÓmD•F¦ÎÞìÎ…ÇAg¹é/ÚÒLàHêY>Ü5śߌV4mäïa$JË´OÐCÖ®ýX'2þ·‰u@§ ²2áRbXŽÐÄ¡÷qlj4ó±Iè›À)ú +±KõeGuÞ²ätõ ¯°–ò%þJ¾<ÐÊ߆Nèú @zmb彆 E÷s Í-_„tJ#?Ò¡¼^,«=é°½Är`ó^•c +%">SÞ¥lOLÐE:já‡æ]h«ü$ùÃq7¡ŸŽáš¥ú3‹‚<‚/AËIo°~:+Ñíæ×½ï/N‡ã5³0I8²<’=à×¹­Iô00ñ±«T¥Þ#àz +Nþ‘¯\0 ²aÿ6tMtée —é˜ #ð_«Ñ9J€BN8j8G¾)iÚU0$× ©ã08`Jiú f¡Ã +-ßñ¬´GdZïãHV$©ŽÁ`šrÙ†-‡Ã ÷#• N¾*ç‚ÜÇ© ÀúI*ÓåjÒ;žmÁwDó”%*'6`œ®æ+èü»ŸÎÿu˜œC¶èçp³æwZ5Ü#ãÉ+Ž$\” L®§2ùŇ×gGJXðmí +|õø¿­~yöúÝû«s¬—]åíÐul^T#C©0ðÃÄÆH`‡ÉIÀf«•4øç ºög*tƒy(œÞð]ÒŸºägëH=?<è­[™¼•)T†Ø ÀT·+.ÜӃ،yÁ˜Ýà5Dyß‹°Ã­»LeºþštP¸e#!ß +—œò~PWÔ_]‚X=6)'¾,4Œ×ËvÉÏõŠP» ì« LÓJzö3fpc÷Cý?’ÿ»©ÖíCVçؾ,–uÕ@>ÐÝì¡ÁæëûºÎ÷í?òº)ª=ö€Û®‹2¿€t7Åg l¤ç€5Iø Üáµ÷y€Ói. 1MŠþkwûȤ¨I "ò~5ç[¯»pÈýZn(™Ä8ÂÓ˜!¤´>Õ•mDðBdÚƒÒ²5rÕ¶+`£n=)-X¹_XtQ¹ÿh/EÂ`F_(*˜ª`ê‡B9–©ÙE'r¢h2‹Çr!Ø*Qe)KrM~,b5qý`PŠÈXt ÏXf@ÏÌ°øŽ#G*X$I4íøz_ºÄ§ÌUÚIØÑ^јY; zäù‹ŒáKU—çŒ9¢qZ×@VÕ²=¶üTA¦áb ~Œ2¡ ¯Äp Xóå†U…Ž’‹Ql*ëÑ8‘WT lðm"—ᮌ%tT NÌç¾ã¡|¨:ƶØ”û\`Ð\gLXœö?¾ þî‚êdÇeÛƒ‚^rh6ܦ˜HÝg—Š²WªÆ@Ÿ­éƒÞÛçô‚r#̧Jmꊓ0>øPÁ#…,>¹ÂÔ +´öýáKŸúˆ†îë¯öýˇtø¿oB0•øÀß'3ªxПûß:ñUÚyã‹ÉYÇÁÑÇа×pp +þéÞendstream endobj -6417 0 obj << +6762 0 obj << /Type /Page -/Contents 6418 0 R -/Resources 6416 0 R +/Contents 6763 0 R +/Resources 6761 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6392 0 R ->> endobj -6419 0 obj << -/D [6417 0 R /XYZ 85.039 781.388 null] ->> endobj -2186 0 obj << -/D [6417 0 R /XYZ 85.039 651.823 null] ->> endobj -6420 0 obj << -/D [6417 0 R /XYZ 85.039 619.8 null] +/Parent 6706 0 R >> endobj -2190 0 obj << -/D [6417 0 R /XYZ 85.039 263.684 null] +6764 0 obj << +/D [6762 0 R /XYZ 85.039 781.388 null] >> endobj -6421 0 obj << -/D [6417 0 R /XYZ 85.039 228.934 null] +2258 0 obj << +/D [6762 0 R /XYZ 85.039 553.421 null] >> endobj -6422 0 obj << -/D [6417 0 R /XYZ 85.039 188.025 null] +6765 0 obj << +/D [6762 0 R /XYZ 85.039 518.11 null] >> endobj -6423 0 obj << -/D [6417 0 R /XYZ 85.039 158.805 null] +2262 0 obj << +/D [6762 0 R /XYZ 85.039 419.428 null] >> endobj -6424 0 obj << -/D [6417 0 R /XYZ 85.039 131.707 null] +6766 0 obj << +/D [6762 0 R /XYZ 85.039 384.019 null] >> endobj -6425 0 obj << -/D [6417 0 R /XYZ 85.039 106.729 null] +2266 0 obj << +/D [6762 0 R /XYZ 85.039 207.031 null] >> endobj -6426 0 obj << -/D [6417 0 R /XYZ 85.039 76.904 null] +6767 0 obj << +/D [6762 0 R /XYZ 85.039 172.281 null] >> endobj -6416 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F58 3360 0 R >> +6761 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F38 3057 0 R /F62 4159 0 R /F35 3036 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6429 0 obj << -/Length 2662 +6770 0 obj << +/Length 3220 /Filter /FlateDecode >> stream -xÚµZ_sÛ6÷§ÐÜK¨™!óÒqc§ç¦±}±:i§í-ÉÇ©ŠTTûÛÅ$(‘L¦½›NLX`‹ýóÛUƒ‰ÿ2_$“XL(5Yl/üÉf~¸ ÅÌÌšïçoÞ‡Ñ$ðYâ'“ùS»OÈd(&óåoÞ»_Þϯ?MgBK6űò®®§÷ðþ̧³À»ƒ—{"¹ÿ4åÊ»{óÓ5 |¼¼½Ä¡€æú#®»Oÿ˜ÿxq=o¤kø‚$ ŠöçÅoø“%ãÇ Ÿ‰DMŽð·  ¥0ßùÅÃÅš­hNNhUŸ&,ÅLøL)9®­Ðg¡/m¡£­D1‹‰¥AmEìôh1ª‰³Ó7K3Î.8ïð»)HÉõôºBÞoÞsßY$8“´¡©ï§¨öxc[ Ïêzµ„õQìÕ%=•Ù¤ÃY)æÇfÇéŒÇ^9…?Á¯‘¿ôy¶ÀK~&qÊF¬>™g1Wf¿w›´X÷1•p;ÒR=€W]—2.˜ô£ñËli†/ÓÐ Óxø2G¸µ—9Æ®¹L‡ß;W‰‘QbdïV¿¿ú . -HJC“ÁTñ/zO÷«ÔY‘Öô‘gU]Ùq³ÍM ÕÌ6YÑn_¤ÛN½¦ÏãfedxAÒò€¡·@’Y/Ð Œ(FÊÀÛÛýb-žãˆSøçæx;mIzIŠõÍpÍP+ã°C2î¥d`•¦Ë-EY;1HPR†¨ËŽ|®MZù¤·,·ifÇKz7t ›Ö„õËn_þîO`Vo‘ìPÕôõhƒéB+iUáß*{4«P¼S“2†E1SüzðJ0.xoð B d8¸^äÃ6ôf¨»»Ì¬L³PÅ,Š’Æ„# ò²¯M&<”@DÙⶤ7Á¨{PCî+–-áäÏIÀ|™$‚hœw-{,=ðæfL®JtÒ–ö9“¿)×߈%2žDàoõש’dÒÜ?±N(Vúº–ô¥mžy¹¦mLðÌžè‰V$8og:fIk:fú±Zß»^¿…¡(®#ck¬@¸(‹b¥Íª6L«·ç~su÷ñòæ–â© Üx -FE&žOkr;JŠ˜ˆ„!Ù—t‚º àW*mÔGðÏ~‰BKð‡œ04Ç)çÏŒ^&!Ø]4qìëï[«€|¢äs\–ü3‚3iŸa<žNÂ0ÃÇ–ªÓ‰³Óp:eg=Öå7Ÿ*ˆztqðŸñ:V¸&õ}…¶EºKó6P–On°Õ&¬óÆš†Uã-šؼÐ{ZÐKÑîgÂùja‚ç+‡_´x{C¼z5êCÀ4aò•»ii†ïÆР®’á»áÖÞÍ»æn~mª?‡G`z*NŒÞ}èFcŒ”<·wù`óãW%¥º ér áʪ?EY½ûP$ãÕ…CÓ£wΈ7–“ƒŠa×*~Œ_£x‡á­IÇÔ*[„J鮂EÂêþî¹ïf)'Á)híŒÅ^«9­[wYW¨ÆeÓÚš ¯(·Ú/ÓÚ8¤¹NPO˜ïºêñ)ãʺ¤I@“¢h7ƒIm.GúÞ¤ÈêKD$3”)Qð¼‰.?á´©c~ÍÂÕRCC7j(%R.Ö'èKϤq=¦¤øˆ»uN@›4ï¨ÑÀ°žúB˜ì‚ j«óé°ýK! =ªo(O,ÐÂÿ'B³þ& –å\ô´Äg2¹¹Ï8„Œ¯à3C-b 8!ùŸÁ3³íÌÙ·qFq8XiJõg4ƒ%V«"VÞ-Ê<‡¡7üŽ$Æ4àE'|ÑI -h·i±Ô>@ðã…fwSž˜DGP¼"ê'¢Z´cI »ú¶ÿø@Ïk\ð×¼íuåB1™è#TµvôŽt}’I¡ðhc/‰›'Äc6þcs6ȳ«hhI¢>×åÎÂ2<õÁNü¯ˆAã\(ìc¾DdŽAý}ëDüø›Ù˜Ã8¦0ËŽ©Ÿ6®ÁEIùŸ3°‚™Ž`é¦Í}ÿ‚ª8öÀ´„³l±¢‰{ü„ǽÅ3‘€‚àq0š šAbit&L„cÜšD8ÊÎ&B—ß|“¡BõÌkJ‹Ã^7‰,šƒ *ŒWMY­B(”Ž4§Óvi‹¨Nü0¦v.éݘJr“›ð¥a/99cVüÅæÎ~ÉRzI‰`­] 8HU] Pâ…¦uþ¢¹K*×pĦM¤¸Êö¶ƒ @AÒ5âi(‡4'Û -/ÓþûV¼Óf½ÝixV|~àweaòßú°×@QàyM0RáYMžÖ„¶x¹$x‘U5l›Ù3q¸§9–ÓÚn¶»Üb4¬s®Ôà<”ßÎöáņ¯zµíÙPH&|ñõý,ÉÏ•iTäÒ»wÐKŸ¸3ñíÒ^•´o¥3¾hwiÚcq¢Òžôý@R±¨s‹yPÄXOjÀÚ¾Ú IíÌä=?•éÖÅO8FgÃQVrHfïu÷#_¶[2Æ0 aÐÄ•YMÏjS¢åf¸)q}%+C¨!¦Å"¥v×ÓHq“Ž¸“_ñ½9Õñ¼™a*Âj(Ñ‘ñÙE…0”h=wq* ¦f]?âô™?jâ´Hór}°â}7…Ü÷n\ÖåkÊ%Î Ú­ä‘Ò!ŽÂg¤œ(‡2Ù¦ ~Pÿ]5=wi·m¹kÁj¦å~qZ›{}_ë¦}™UÌn•¥oê }ŒP:†‚»)^ˆ¶]œ¯VæeMûîè«NY3BS¬„'hu¶w®ƒ#9¬¥£§Ðm¥†¡£'˜ÑzB±¬åéA« î„MœÌÉúèh9ªì¥G»Ú°¸›Ô8+|Žmr]*EØ¢{"¢ö‰¢®õ®à–fXÆO-†U<­Õñ»FÉ¿¦#÷¶ÿWÔ€Û¶ÎCN…ïíë À%K,xݳQÄ¢È6>Š}&ø·×–dP›†YÉAeŽ°jt9Æ˪Òa6×®MNº²? h`¸8oÛnÏÛ’ ž× áàyGX5çãÕü\×2ûvË¡fn„ÏxÒ'ü£$õþŸˆF‹R0%’þ“…à <°²h”üTÞP(*q.ðboÍendstream +xÚÍkoÛ8ò{~E¾•XER~˵é¾Ú´×º(Ûý ÆJ"¬mù$yÓÞ¯¿y‘’,5émwC€ˆ’£™á¼iuÁŸ:Íléü4ÍT¨³ìôj{ÞÀÌ'JVD§&Œ‹SÿX›áÔ_ô&ÊÖ4²ˆgèïnIÏp$Ö‰ãƒ3€iÕ Û2àiY|IÁö4šL7¿ãIt`í@½Ð7CŠ6¡2Ĩ×èöã8@k}ÇÃtpâÛÑÓÇ"®Á@FËñ–­Ñ¡ Ãèø½×[|›Æ˜˜(NÖŸº¢w¼%b\“·Áiÿ ¯§ŽÑ'/ô mU˜Æ©°òèÝ—¶+·oëº{ôQi>íºÚ”-oq¿t;‡jyw[±¥¢&+òN;üð1=‰w¦´v§±ÙPä¨H£¢ˆ#bÙlxU‡ÊXìÚ ¹)‚Ô3\¤@…´KŸž"/¤x6¶p°§@ sHŒ,ZïwëAð@»[ŠhÂYÕ”Cºº!ŸŠv *”-ñHNÄÈ ¥ƒwÛ”…@œèN‘l–ÜU(š ¿|¤ ²Ø†ˆÈÇÈFÓðT ™W±gx:'< É›q¬Ÿ¯·Õ’ƒ¦ÀSA¥4Z#‹ÏfÐ%a»ùsä åÿ¾-›öl]IaâÔƒØ }*TÖ‘Ç1¹cQ1¤—,jKóø¡™ÏÄ1ÜéÒnq*’ÑÌ +ÌhN»Âs,Í|ÊP¤XV¯+:¬‘–€ïO8÷µÀÃnº ºp@ˆ×ÚuhY:H¸`»yr»%eÉ«¦ne«˜ÃGFσՒÖç Rú©  + ã#àÎËdNeâ0Šï—H÷áÌ[„K/€ðK7Ðk†»ì îC~ññÐvõ¶ú¥Ÿ$_ÃE{®#~;´n´.e†Ì_b2¡ªÅ»u¬' fík¡z‡gˆy²KïjžÞ=&cƒ´)ð¹,ÑaÙËZNìt”Œ!HzÚ¸Ra¼µ¼VD] &ÁHqžÈ—÷ w\RX…Á¤\ÒJ<~øuLjö£4WT‚nœ|ÂRÉŸŸÎäÊ‚ õ\þ ’P'èo\Ì6j&f é1Z ¾ÃòÆc¤V|ܽyy<ß÷}Þ$‡;9q9Ïáçñ`cˆYÎÿü_ñö|©0‹ÃârV¡1 +Íxµ>O4“l ›s¶Q¦Y&t\®Ð§„ÏÏWó±£wꃼI!-ÊyùüqJ݇(ËfÌH³Ácœ¬ko,0‹c§d€8<εvö“Î^ȦJžÍVÊd!ÃÀ×û°Ï™÷õˆàWºøúZ°°^È/v\MMK‰u½åLòìèt¨ØÛl˜…jw#gÍ&ºï•[ê +Å¢¬öÝŽµ”ý _h4eËû=/W¢Sµ41ö“V‰†œï†UìéW'ÂTÛYã”P?¨èjb—Yh²ï1þ¶wÆíc~/È:®°OöÁÀjÇ5öV²`„yÕ Øî°)˜;ÃÉaé(žCã¢ï“/ƒÞ:\,\® 8T +¾©©:S•K“[:<“»oæÉ°x¤Ì`oòíï]½gX_èHT@ï¸ÌuÌM×ÉgÚn,¨ög\\ìKçÞhpéq¯g#D׎øë8¦ …À‰%¶AL®Ñ°èyôaMΛôÏR×a¢#Ë9}ÀgÁ‹|¨ì¼ÕP§Ò’ÖI¢h¼€ â^YÞ—í,pùèqó³epÁ[ÆfFC6K5÷ÅxŽ{ªŽ‹ýRÙ[|4Âð…°ã ONl”Ž¬aY¯|íx\¸}L?BÜ «òÞgƒkÙZ;z28œ/‘³ˆªŠQ‰¼”âNæ†b˜TÏ8~ôþÝÅÛËóWæŠM£C•õµfª"pdéØW÷;‘cíÏ_é˜ãAçÆ-çAHÍÐØg­ÇW+`%ùÖòf©¡Lã䜷ôˆfjDfiþ¿7!Ôùyä$7vK÷¥XdÜÖùsQ"þË£5 ±äGÉÌL®òíCü˜xS¤âÓþ…vuŒ¾êͤŽvD…N’M¿áÚ€\Ë=ŒàqýxÓõ‚|œ•—‘M¼*U.xÙ2áÔü‚'W +k¾ BÍÂg÷µ2UišÔ> ]i–„&²÷•­H›÷uøÒ8Ë,¸r¼¯¡òrÏß9C}6H¿±ºÖ‰óVã¶ô×ÌÁšPANü§ÍAÿ-æçÒ‚ÇÁåÅêåë^_ò[{ËIgñ¥[>責8ðm‡’ +¦¯´st¡È0¬T$E,ßÚq/ §¯$÷礹•/òƒ³ÚzS]}q¨ÉNc%õ覧mÂØh_ë<«w×ÕMøæõ˹j'#·ëª«Ð¾L4™ZçbÙFyÊE.õ­£Ùí7raÉ…QtŸvBäJão­Î2ÇÛ°Q ø©Þg±ßS’?ýþlÿI«4T±:¹ø×±2B°yâ;'Þoƒ»ÐÉìí6ΤÝÕsºûìýÛ·Óûu•I*›ÿÖky& |Î}íéÔ +/_ùy·uÓ'Í—EffBjž…6¾·iñM.Äüå.d\Õ[Û{;jŒY_×¼¦Èˆ–”€¿¾žn> endobj -6430 0 obj << -/D [6428 0 R /XYZ 85.039 781.388 null] ->> endobj -6431 0 obj << -/D [6428 0 R /XYZ 85.039 761.463 null] ->> endobj -6432 0 obj << -/D [6428 0 R /XYZ 85.039 748.383 null] ->> endobj -6433 0 obj << -/D [6428 0 R /XYZ 85.039 581.816 null] +/Parent 6777 0 R >> endobj -6434 0 obj << -/D [6428 0 R /XYZ 85.039 557.573 null] +6771 0 obj << +/D [6769 0 R /XYZ 85.039 781.388 null] >> endobj -6435 0 obj << -/D [6428 0 R /XYZ 85.039 532.596 null] +2270 0 obj << +/D [6769 0 R /XYZ 85.039 651.823 null] >> endobj -6436 0 obj << -/D [6428 0 R /XYZ 85.039 325.369 null] +6772 0 obj << +/D [6769 0 R /XYZ 85.039 619.401 null] >> endobj -6437 0 obj << -/D [6428 0 R /XYZ 85.039 173.601 null] +6773 0 obj << +/D [6769 0 R /XYZ 85.039 367.417 null] >> endobj -6438 0 obj << -/D [6428 0 R /XYZ 85.039 147.109 null] +6774 0 obj << +/D [6769 0 R /XYZ 85.039 272.27 null] >> endobj -6439 0 obj << -/D [6428 0 R /XYZ 85.039 120.01 null] +6775 0 obj << +/D [6769 0 R /XYZ 85.039 218.376 null] >> endobj -6440 0 obj << -/D [6428 0 R /XYZ 85.039 92.912 null] +6776 0 obj << +/D [6769 0 R /XYZ 85.039 164.179 null] >> endobj -6427 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R /F62 4047 0 R >> -/XObject << /Im1 4096 0 R >> +6768 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R /F41 3054 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6443 0 obj << -/Length 2645 +6780 0 obj << +/Length 2310 /Filter /FlateDecode >> stream -xÚ­ZÛrã6}÷W¨ò²RÕ& ^óæØžÙIb×ÒÖìV’Z¢$–)Q!)kô÷Û„d’;[ÙJ‰K8Ýèn@qGüçŽâ@82E±+dÛ+g´†žOW®’˜*‘©%óÓüêúcŽ\G$N2š¯Úyár4_þ6¾ýûÍÓüþy2•RŽ=_L¦Qïî'îxö ü™O¦îø žXäéyâÅã/?ÿzÏ 77Øô dîpÜã|òÇüç«û¹YÁ…•$¸´?¯~ûÃ-a?_9B&ñèeG¸Ð½½‚µ‰À—ª^\Í®þa¦â>Ä£º˜ÐSéˆ8ö‡Ù -8¾aË ,¶’XÈHŽ´ ²ŠË­¹N(â Y3½CÓ2Ãp®ë ézgx7Šã|Q•u¹jT5ÝÍé:CÝléïnâ%cêöÇ·%v×Ø\¡ÚšËC±ä¦tÕýd -ºËÒJôéÌ“ÂwÂa[™~• î*êgq­eqΰháÝùMôõGĽþè9Öé ×C”ü˜@JÆbçóF"v%ö¡cžP„a¨úo–Käûú™&C%!óo¨‹0Ïvé~šï´ ÑXþ¬ÈÂêV]˜„B:Ñ ê,™^ÕiD‹{U7„fT7§UgãÝ• é¥È¦H#(j Ë¨[—a'_÷©¢pØ#ë!ø/éÀy€ñùâÔÇLà9É0c­L?cJ—‘ô36€Ö26g³ðþcß!õ¦Ã½D8qð&x‹¬–uÖǪ¨î0©F¤ƒSO$n¬gA<èëå´«¥tÌ0Ú¢}?¡_~écÀ…/Ì:HA+ÓÏ’!Ü~àZ†ð àçÇfÃ^ CÍkT iŸK -*eó8æ»%Ûã=q[ŽÖ–L/EZ†(òz)‚3 âiŠlÀûoR):/»¬Å‡¼ËX˯@¸¤EZL¦¾#!lc”Øä3«¸¼’KnïÔ+|áöûjv¬ã–‚@€C£!@…¿;®¿>¿LÄ‚ ¢Ës…7—l¬›åVù—¦JiOXÁˆ óI›Üî‹´ÉêN,`Õ°¦>DxÒ<Ò½€Äf§ºÉ¶³ÉP¸¡ûÞìŸ52ƒú ÌA " ¯ûÌׄ§I–L¿ù*2_Ùo¾p­ùáóµÿB°½+™²]Ùpa±É¯yW%†^ÅéÁ°[¢iwlíõ&gˤžŸËí5ß­{õÁMl_RºUõªÉƒ;E8|ƒ²dúÕ¤dHM~¿šàZ5 á5Y€³¬È¸Í¦3"" -´C¸ß¥/…NBûòD?‘ ‡³K¦—-C¤½¤ ÁRñ4)6àÿ!Jûa ’h8Q±dúyP2ÄCÿq®åaÏð`Þ˜ˆÑ¹k6ªpÜð=Š ˆ×Pk~à»ãOb 2vãeÉ_u„¡)³¡Z£º)ܧHõþ1Xú4†,‘5MŽqp]sãïNà4›\Õ*m“+]¨øÊJs•ïç${?¿×­@¹Ÿm ¦™Š`;†l'NŠJg/iGƒ×àãì"§9j9ቨlÎ7 £È7â,én-a‡nß-Ú÷!=9lZ­L¿i)2­þkô\kZCxÆ´,Àg¢æ…©R)^ß~a&'ö³– áã‰uE‚±Ü¼TÉØAÈ–íùÂÃ;³Dã œñ "U@`«(QqxÈ”9Á‚%Ú#ƈ#þɲK~M¾]?´Q$Ý-¹ðˆSÎýkÏq¾]ÿë‰i(ŬêµnLšDÆÒM‚Œ BFÃY¿%ó^ z?†ïÃ32·Š,,8ZÂw©RýÚ”I°k´~‹Ž Tú:@G4àL= Ñ€¯43¸ìU#Øä«:§\¡rõ}ü2çBÅ©Üê×(ŒÄKT”“Œï2:³¯Ð¨Œñí‰õ…"34^œè´¢£†'Œ¿-¦,Þ иßd»r ÿvF˜Ýö]0 =ò9eÅݘªâÅ61ï^ñ÷a†_ÉQ¤N» —½,Xoq -,]¶kYeis0®¯k¿ä“0[ö#g¼%‡sâ -Y8Öã.W²ƒÇB¬Hð%Ò6%DmçCyÜö ñϸx©xã}™é^»`PnxxÚ^pÍ/ʼn'Òn•vPêÖi‘gj‚÷Û®²´V®DÐí(V&mÛüö–ÝÔ,”«¯¡åŽúÉÓØ74ÒKÅzÍ)%Ôq*ɃS%rI!¶Yªq+þ’iÀ÷+å©ï­7Ca؉u‚Zu°*Q¡[¾€ÁM%×d'ákÁg4˜Ði“¬4ö&±´–ª“È"%ÍOät½ÐmÕå:%~3–5)ê¸á¾‡3ÈA2¾æ>pþŽœü– ô ë‡ì†£à|ÑǼ(¸dŒ-[v,–³6ê_äh§®‚Vƒ)Ðú·dP/ØÅêâìÙƒ:u„À2_,œEð~>D„¹f(NÆõÎP´ÙêJ%ZSŽŽ éŸç¦³GV®5Ú%ô«Ù½ƒ´j±Á>ùÉæbó{:õƒÏNýòÃÒœÔâžxYç6•›’ Ì6âËD8@ŸÏA¢s®Ô•Š‹²R9.b\<>ð…âlns–Ðp ò­Ã9ΟíÇFáâc‚¸Ãñ78áœ[SKþqŽíºÄ/’j££°ò;îæ,ðÝá"•ÁÆ%îA;m¹ï~ྈ“áTÑ’éÍ—]/¡ŸŽì|ÙWù²Î‹Û„÷!_W*Ð; 9<´2¬a²ÃO4šh´3cõcVV½éF=ÍÒíKÚ·S/7ü£”%Ó›'p/‰øaz¾¡DHBªIfè²ß(›¹@-¾5ç ŽmÔœm‡BZc‡bÒL'Q^óÄ•=_+ÕÜmÞq6mÂÙÓ«>*°2“|:mª„íEIض32¡)Vá!± ¹þ[»3Í‚„è0Zb b?z\ß³î¶>Jþ© x‰-pÍW¿ ƒc=qK››R%ã‚í¹åE{eß ‘í*SS¢á7U©q˜º…w¦b¤ZgYñ û4U×*n™Aýá§ÞGkRr…êq€¢YˆÕÈ^[Ô¤ÔZ›ÌÆÎsøÇõCûS:õFÍ”íÕ ûó’"9£ã|·¦Ü€†,ë>ß áu¾–Á?Þæ_ú*Úû¸±ìyq ®z×=½œþÒ]N}Ò5$é*¡<Eùõäç_dgÒ~"…{hKa‡ag~¢´+´rÍwz2<ù¡âÂ}ªÃT-î–]WŠ PÕÌ]Ý2óA–ÏÞÙ®ºÉ³»$WØ~v;ì®{Wýg8‡o/ì&¥­|áÚ¶¡O³Ó.Ì{I¶€iƒêt ­¨Å­<‹æ ‚§ü½Ì¡½“¶Jc†Ü')€RþˆÒUf£ÒçÐ(°VøY }N=—ÝÅŒIšP£yŒÒwº¥À]õ’Ø÷h¬èÔñ­Íi ¬ÿ°×(jJÜW+©š-´ï2’5CÚ{DJàs1eÚ<ž&,"ʾaàGD%~¶ã<ŽŠxÂÀȉÇ«G@ž³¶Ì§…ïdaø4£ËWýŸÞ¿~sÖ{ýþªwvùòº–þ4õ¯¨•Ý÷Qcû*çÙ +øñ6YL²{[;¼Agë<Åq¾«"„5iFE=jVc²H³)£|s§qÈäÓ³h<‹¿ùnrŸå“ç’ÿµ8® Wx®Gì^‚-•‹¶D=)7¿"¥Ä` åièˆNnç[c2tÊTô‘-Qw†¼“Z‚ì«ÏÖžp•qágÃͪˆçb%®pür%À`6 Wù4~| AQl%Ág[§eƒœeÍå̺¬l× …·ã¶Ól]Ð"C Ðã r×í¢bžƒ;…Úºâ¯g½%7°_ùšÁ×ÔjÖ†ÕßEk”ºàÞ­um(î2Ù5=ŸÓÏ‚ayL–ÊIN1‘ù4×Ĭ„}S¸J‰ÐsŒ¯6ì‡çÙx=\µ¨Ýw…T!˜›EL2| ™Í²Wv ä¶úòx‚ºàø1æõ§=«Èø7âŸE\ðúÆ.æ ¯–g„ òÁø¶ç¬0ànS=d?3èûñ£Eñ£È 7V׆†Äj;ÖhÆ6ÌÆ(I³˜’¦µßP†ÞV†ÜRCØ-uP†Ò@[ŸÐP·×+'ð¬ìŽ< 1¼­˜pÎ}7(m–&ã ÷ÑÙ’"ËAtOJHŸkeÜ71¿ì-Ü®åБ~EJr3:ü,*¸sC#­ùcÌÎn¼>* A‰Ã ðšát_°ô±k‰¦aR3Çߊ’7Ú‰NÈÝ¥2kA*£ Y’¾ÉÄɸ ù€`4Ì +aTÊbÜŒÒʨ‡"µ B?\é›l—¸8Ål=íHòâö¥àVÏ Ã \¦=ôÚM˜!'µx OGo4+χqi¡D ¹ cžGM榾]›UKuQO½wèÝëÔP’G²Mák™g†}ŠÉò{•ªÑ\,Ø,1qEÆf6V‰AŒÌ¬ˆ¹ˆ±.mç4€´òµÉ%®¶RXaÇ“ÂuZ–†–o¢i2Ã7À6l«xöEÁ5‡ œ•‰1ç‚€Ø d&k@DÓ¤œJY›`ßeòÉŒ_&àðG¥ühF‹UÙo¨*ç4™|JÐÍ_’ Ú1K'q¾jcŸ^KŠ¬ʤ²©Å)°¿v +üÚ*/[â^n”;6‰ ¤%diZÖb•c—Ö¬°’Øi ³-«B÷õHÕ•^{í†5ž +êºíìv0è_ÞcµA‚Û¾°gKúfw§*îj${©,úðÙ.÷0u…Øÿm™BMžïv…!3ûp§)7/ŒS쯕®-!ɇFQ~íÔ +W+{©½ta„£W%5@×>½ccïˆì¶2¬ø'…ÌË-ô;%¡$_Ù¢Óâó†A”%" WQDÎY'‚Ù2s%h³¦ÂïØx\Rúr)E¾å­¬ÙÕŒó‚q7.c›ÛI¥E`£ŠOHI»Jîʧn ^ðÆÏnÛøQNUò†]ö½öÞ !l3±Pnl4æ)vÉ»¡Ží¼ljݶ] á@)Þõ…ö½&Âî/ »yË©@q}HËê(p«¹ìÆ`6à¡!{¾+­ç +v"Ÿ9ÙÛ:}°*bÏƯ *xÒ­ŠÀƒºÆƒ¯WTß¡æÏ›Å7ôüH¶I×µŸìHê8ZìšeïÀµ•ð}P~èßáj¡À:~(uütÂuB¡=»õt¢¸±!" l¸e°·¹Àæ |ÏmêÓ‹VË_›Mþ–%,!ÏZ ù?/Ù/-«œ bi·ÞÎÑ°jµÿwH×E;Ø OÉ—Ýêó¶ÖµÓ[b¶?Šèõô—÷ø ÍíwC H,x؇Ç{f߯ìaèQäeêE[˜å¤¶¦ +{#>!£õÝ6ñ-ÏÐ_­gœó&÷#m‘–Þ;O÷ó‰àßå[MpG´QUîÑ™LRÄ«/ùÿÞñ¹Ê*\ ÄÅ%ŸÂ™³¸G>ŽÎø)«žnhåðöë23ÛǯÃE>êOÙ¦VX6Í£ùãO0â X·pÕŠ¶ç‡¹êã|ÊT|ëÎç©æ@èÑÇ ÃÓ}ÊQ¼c:M6weÝ%Îö)‰Î_iRzÊ$úÈúñŸ•|‘be‡•Â'Oþp½üIq]Ïa躟ÁWFZhy$$Œf橺Ûo^uT7q|ÇÖwr濸3·´ÛO D/ ˆEý*o²sy—À(Aõ@À<¯‹Ë„EB7èG¯iÏ«ðšvϪ`ŸÐ«ÐŽ[B(¼^j±öø|óðSMzÜ·'C(\ÇeÒ¿2ºwlôæ£Â7£·½Aÿ¡§„íOËkâÆsÂPøáöÅó±{â­ËÅ’^¹Â±Ãvç=‹?ïÉ­‹—Ú͸þð:p=gWN⧷sY÷;í dendstream endobj -6442 0 obj << +6779 0 obj << /Type /Page -/Contents 6443 0 R -/Resources 6441 0 R +/Contents 6780 0 R +/Resources 6778 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6459 0 R +/Parent 6777 0 R +/Annots [ 6782 0 R ] >> endobj -6444 0 obj << -/D [6442 0 R /XYZ 85.039 781.388 null] +6782 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [129.861 323.505 181.248 333.073] +/Subtype /Link +/A << /S /GoTo /D (ProfileLocs) >> >> endobj -6445 0 obj << -/D [6442 0 R /XYZ 85.039 761.463 null] +6781 0 obj << +/D [6779 0 R /XYZ 85.039 781.388 null] >> endobj -6446 0 obj << -/D [6442 0 R /XYZ 85.039 748.383 null] +6783 0 obj << +/D [6779 0 R /XYZ 85.039 312.546 null] >> endobj -6447 0 obj << -/D [6442 0 R /XYZ 85.039 720.678 null] +6784 0 obj << +/D [6779 0 R /XYZ 230.409 318.52 null] >> endobj -6448 0 obj << -/D [6442 0 R /XYZ 85.039 694.186 null] +6778 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F62 4159 0 R /F41 3054 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6449 0 obj << -/D [6442 0 R /XYZ 85.039 667.088 null] +6787 0 obj << +/Length 2846 +/Filter /FlateDecode +>> +stream +xÚíZ[sÛ6~÷¯ÐKf¥‹!^ûæ]7mc{míº3ih‰’¸¡D•¤êúß﹤$ú’MÚÍîv‰ŠÅ³5m)«ÌºpÁ“ÕK˜ñ¬ P'prWóI-D‰HmÃÇBZ± ‘ÉFV¸d;랃€]°ÄbÇ#1 ÖUZ±x‘í’–óœÝЖ ¡»’àÈ>¨Ü”µÅ¥¤.xÚ ^ˆ~Z¦Ì--OC‹¼À¢`’óë,ã¾\´lølCøêµ¾t=çM§RË䆯—e†¹XÚw!؆NU휬n_Iš1.ÊÑINÜ}y÷ϔ޹&gÀ¦|÷ü겂§:(MUðãÀUGŸôcŽzæåW÷·ÏX2cE:ÖÑÓãíÒz’‡eP|D­cÝã{¸ œØ,›ú#÷=VÜ*¸6]ð[²æç;,Úsó6c­wü»ù¢¿â—U2ű%áL +뛨1Wd²§0Žó6û5T¤Íª Ù°úŒUná‰Â9ÓXè‚šm¼÷曟A‘§Åt»J×h.¾Œ‚ãPƒËµ‹Šh°Ð‹ŒáļeO¤¨Aañš"8rž­þðÉU3–<ÈPû=Ýœs2h=,h3ˆ¢ÈÑÚ9y#Ùd½ ²·/ŠÄ)Pƒàèb¨L¹ "Ín¹¤<%ØIäÖ†AŽ‰Ö±Ù£uìn´Ž/÷¥°Â"Of¹¶a`K Ûã"5†ŒQbÑØi’E”=*Ÿ—rš@·ØíbC8¼¢ÜÆq…2¡º;—b­0b4x¯¨œZÔ ÃTÐœ$à˜€„ø+C=dßiA˜ø@4 Ù—ëôž3²"¾ûñ}Ãæm?¾Š9wàåËî‚ûê d¹%¦;1~¿i´€†™¨ÞïQ_ÊîcU“–»*Î.ÀÓš˜Aw%ˆuw)í( ղᎎÂ÷䘾^u{&6üð%r+%á´]qYls€À;®„ðÀÔ"ej3zVûŒ‡¥›M +*›µ‰b!äJHÉ!mÛ&Ý~ØÞ‹Ð^Ù{ÕÿØÙdå¸Á4ÉsËØìY ÞÙ«²˜c àPÊà±=ö[‘&!ó0JóYζ›E`>övηG¾hCÄpÌr™ŒÑ’c -WO›DÈ e/} „3™™ï–¼¡àÂ8æ¢Z½ã)%E>ýhŒCmh©dTŒàQì‰ i4éDÞ_ìD3€þÝhf7(eúKŠ >Öb‘Q ïŶ>¶Á-„ÌŒý.¿0q£ˆê#þB„úòLœ/·:aRú]C)Nˆ …”P‚nÓáÃ&FQ¬J+Ò"¢æ4+h— ­êÀ­Á°ìÿ½Ð¡lùðuÍÉjÏ•â¯\¶Çä¢nÂmW|Ò†®¿{=¸šÉ°d-¤•,ÔÔLñ(SžÍG,òlš¥Â±€Á^“:Á‚†1ºR=¥ªÔŒi(F¾“ªjĴòè6éDÙ‡7g®uÿ׎g>A¾ì׃wÏ™£„ ÌAx8&Øû¥Ý¿BÍ»endstream +endobj +6786 0 obj << +/Type /Page +/Contents 6787 0 R +/Resources 6785 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6777 0 R +/Annots [ 6789 0 R ] >> endobj -6450 0 obj << -/D [6442 0 R /XYZ 85.039 642.11 null] +6789 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [242.104 749.508 293.49 759.076] +/Subtype /Link +/A << /S /GoTo /D (regkeys) >> >> endobj -6451 0 obj << -/D [6442 0 R /XYZ 85.039 615.012 null] +6788 0 obj << +/D [6786 0 R /XYZ 85.039 781.388 null] >> endobj -6452 0 obj << -/D [6442 0 R /XYZ 85.039 572.243 null] +6790 0 obj << +/D [6786 0 R /XYZ 85.039 739.285 null] >> endobj -6453 0 obj << -/D [6442 0 R /XYZ 85.039 545.145 null] +6791 0 obj << +/D [6786 0 R /XYZ 243.758 745.259 null] >> endobj -6454 0 obj << -/D [6442 0 R /XYZ 85.039 520.168 null] +2274 0 obj << +/D [6786 0 R /XYZ 85.039 637.897 null] >> endobj -6455 0 obj << -/D [6442 0 R /XYZ 85.039 493.069 null] +6792 0 obj << +/D [6786 0 R /XYZ 85.039 600.366 null] >> endobj -6456 0 obj << -/D [6442 0 R /XYZ 85.039 449.694 null] +6785 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F41 3054 0 R /F20 3021 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R /F58 3380 0 R >> +/XObject << /Im1 4209 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2194 0 obj << -/D [6442 0 R /XYZ 85.039 410.058 null] +6795 0 obj << +/Length 2701 +/Filter /FlateDecode +>> +stream +xÚí\[oÛF~÷¯(–*†Crxé›7–“4±ãµ•^¶é#ÑŠTI:ªÿýž)J¤emÇ„ùñ̹|çÌhŽÕÀ‚jhÓrÂ(Ó ‚Átyd æÐòâHIkàš–§±é?“£g§Ú(Ë ­p0¹¦.“ÙoÆó—Ç“ñåpä8Ža»æpäûq2*ãê5ü7Ž”ñ +ÜåârhÆÛÓWoÆ\qv|~ŒU/ Ïø ÇO†¿O~<OZ”Œ\Óõ$å£ß~·3 öÇ#ËtÂ`°†²eª0,\í˜Úuä==º:úo3 ·¹Õ³àQÝcäXf¸ÍÊ•îYùìh-’ þŸÃRº¡Å6pX‰mqño.âü«"o)*R¡y¤)þÀß•ê"ÁïV2=È¢U!q¢ÊY”ÕG8®‘nŒc¢”Û—Ñ׈”%YÌuy–Þr ©Ìfõ2ŠzJY̺Šà ¾þìÔiËmúvPëãï•ãžäÓ›eœU°Tmk#‚y©pWU’ÍKìóÝ»«ñåùñÙø;žtKȶå™ÊeR“=r- íþ`dû¦òÚ'‹¼úÖ 1™—'ZÕ5w–Ì‘2óúv‹cŽ1‹¯IºiŃP¾/"4OI.ì˜F™ô—IË\>‚_-rœb¾hæf¡×¯E,„.‰Ãô]Mµ‚üÐcy¾eúŽî³噎öÔ؉«zì”ÌßV›®Ö¼&[x®Î[ºVðdµzä×}ê8ië¡k”‹¨Ø4GiÞÃuR-¶LÃ%m¡Å®û ÐÙòS÷¨Nð8UÇÕ>:uW{Æ Ò.Qð¥1œë¼˜"pã FrÍËâqÐñ´r1-îy‚pUÐŒÓ* \â7ðEÁÑUâ#ŠdB,¬lÉ£‹O[ðŨí¸6Ö ;ú¡jÏZKâ.+ðűâx˃…48ni€âz¥Ø&¨Î/ ?ñ%šZZÃ#´k*a¯sµÜBšß»ÎSÂÀ¢¬?Â_Ђ²Pµ¢åTÛ㪚ü&¢AWݤ2ú¦lÂx»Ë °A +ž;ì›rÆS‘¦58 $â²è’B¯$”ÎE.?'uœ•£k[K³mY>ûå‚m3Ù;Á–%ÁO@„½|=þµc‘Žéù#®is½?bwL×ñzãulñ[6æôÚØ»ËËqwÇpàû2ø³~ƒHŒ&¯òëj ‚ÂòY2-ò*ðåç$›åkŠ8Ÿß¥?2%y†5ã?Wi^Ä–ß•q!Qê"Æ@‹§y:±øÊ´Á9¶­&‘=ñ«µ¤¢Q[ÆW’äÄ€úÅ„€B6†…­SQ¹ˆT§”©ø‘‚mr 5ßµ L¸imQ¸jI1…óÚ¯aýƸ @ñkBÛNßcQú¤¶¦šŠ¢/j*!®…î묤ŽÛ‡=ÃH» xŠ8¸©˜¸pùb°O†ƒ¼?ŠæãšNGCP6·ßŒBmÚ +O)3Խѵš–mƒÜMí{í»O¢Ó³{é = 3­·Óº³2íÁþºÞîtvžc*4’6ws礑] =5œìxöw²)•“Wâa°é“i.7Žº¿Æ`~‡N[Û_¿Ë¦ @y€òÞ L ´ïéÌ~^9xX¢&! žzád£¢wMCƒ,˜†KÒ{{f@ð`fs<Ñ+ûóhïòÇTxÎQÿüdÌSvÁ¤€? CðéM‡8ÇR¦zÿu#'tÌ@‡ƒ —Üôþ ñx…qÙITEû¤§¿ 1xFÔ\¢ü.¨ŽC9<¿“s“­p:ôÌ@Õ8’õΛ¥¦à)ª¤Oú¾¥ú›ÕŒç›ã³øqê†ìÞ©Á=Š¡¥ýM½…•ƒC>¶ÃOÙ3µç›~ðЩÉuÇËÍ®;/(|¯òj:K|Žg7r(wŠQR—_L?ƒÇêqúõSÎ +>&]}^Ïó¥õsßJnLü>wq㯞6\í_ëÁ{“Nñ*j6ž9"kRíGŠ¯_5ºêƒ á%Øàáå“öŸ!ºq÷óïà“zÿØ·Z_¶pKw$ñͪàÁv¯8ÈŽ‘4¿aÝO}oU¯û¤uiË.?ôÁ–o›Qÿ•ÜÏ܃ëäÓä¸z)›^¹1ô¤áêÞåüñé‚~&,Ê<`Òñ`X:¸²®–|%yôR®¤Ý"_¿+{øº^fð|^DË'_UtMS~?‹åFiwVíÒ¯ÿÛŒíaßÁ_‡.ùRœàõÓÖ±ýk=¸&6Ę®Âѯ‚ùÓöF{—zp@÷àò·è‹äN¹Y”¿ ìLåêV×}SÝ-ˆƒgë^tÁ‹þÕS?9|ÈŠ«ŸÙ¡é¹{ï[tkY[÷€Âdcº|ˆ®ñã3J1MJ>ý­ [®’¼·´•z„Õ”MÙÜÛýOÓdZà •éK!%°È§> µ‡÷¬áÛ¾”‹¦B¾êÕí«Þøoòn·×÷ˆ‘&κ’¤©ž$Wù¦¯:¿èÜÌv´éÙöH¸ú_Ò‚Œ7@ö½ä–jËÔt!|s=JÓnºU^-8s«ZyVMjÖ=ÌQ6h˜{7o@CPSu/ZýS,ÿrq|~Ò1TmZúQHR”X» +¼­ü—Wr§yq¾Dɯ?ušè\îÞSêo“—TÄœ" ”"´ä8[‰M.``³œáIf—ÍR:bšs]‘GË楕ao+J£Ûõ­ +üå# áØ–viÙJ‚Â~ýYU^P:’­9ÛȦ,|Å´vƘªî´›&N‰l<²3C“%Hú½æË4¹­l®jÖ),üFY¯6 M"Ù_¶g,ã(+y˜¤rÙ’Ñ +5’5œ U’ˆ-Dp2_÷*#JE°)ûËu‘TñN^<Þœ¾©$Ñ8ÿXg9(ãjÂ=Û‰t­$ždx¼”ÊŒð…ÐáºN`«“Àd¸œ]ãß$ò_ÀtÞlÖTSVaÕÍ®T¸KÇŒËôü°ß-='öþmÇëjcÎÝÎñÜ]B)ÇÓÙÎûø?^u¹endstream +endobj +6794 0 obj << +/Type /Page +/Contents 6795 0 R +/Resources 6793 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6777 0 R +/Annots [ 6797 0 R ] >> endobj -6457 0 obj << -/D [6442 0 R /XYZ 85.039 372.527 null] +6797 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [129.861 458.997 181.248 468.565] +/Subtype /Link +/A << /S /GoTo /D (defregpthkeys) >> >> endobj -2198 0 obj << -/D [6442 0 R /XYZ 85.039 154.892 null] +6796 0 obj << +/D [6794 0 R /XYZ 85.039 781.388 null] >> endobj -6458 0 obj << -/D [6442 0 R /XYZ 85.039 119.482 null] +6798 0 obj << +/D [6794 0 R /XYZ 85.039 448.038 null] >> endobj -6441 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +6799 0 obj << +/D [6794 0 R /XYZ 217.197 454.012 null] +>> endobj +6793 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F41 3054 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6462 0 obj << -/Length 2269 +6802 0 obj << +/Length 2467 /Filter /FlateDecode >> stream -xÚ¥ÛrÛ¶òÝ_¡é‹©™!ð–·ÛiÝÔŽ+“éôô–h‰QTH*Žÿ¾{(È"™žÓÉ$ÅîbﻑþÈI -_¥“8‘B%ÉdQžù“œü|& Ä̘̀ÿÌÏ^¿ £‰ôE꧓ùãO(t¨&óåŸÞÅ/oïæW§3¥”h1Åqâ]^M¥wÿþ™OgÒû‹;¹û8 ïûëß®xãæíí[Üú`®nðÞí|ú×ü׳«yÇ]G8I‘µ¯gþåO–ðŒ_Ï|¡Òdòk_H8.Ï€7je¾7g÷g¿w¨øLOøVŸ$,ÄL¦" ÂqiERèHuÒ -üi…¾}MÒž¨…I…:õ>Ûe5UÒ{BA5 “(ònq=×øƒà¤WãFõ__ê |å|p“m³U^æÛ–¿çÓ€`í{Õ¦’¡N@¿jüUz• {^%#¡"zÔ§í#0UÕí~¶Y›ož§‰ö^MgAxíš9tè}ÌzÖ \ÒöÞ°Óòº0èʬ-ª-î)¯høŒ®ï`ãMé- -” €/˜@[1ܨö¾¡utÝt«G>¼A;åågä•àO†Þ-™¯~øþw8(TÕL¢‰¤ôúùÕ¡´·¨êš©;-ïuMµ¯™MVœ}ï¢e'À÷|þeSÔù’«šy¶˜Â«×üµ MÖâ©ôJDÚ±ÄÂËFÖ~ÉkCËâÏø:!„_xgE;ËüÍ€ÙD:ÑœÁ95›L*VdOŠ—Ĥ‰$LF©Y˜qrRBÉàˆÞÔ=x×3jõA_·èg¸ÏeUf…¹; ¶®6«Â :N½ºX­éAI¥Wž¸ ÷ám/BîŸú1¼Ù¹yÐT­r·oóš/½"JD¬¤Gò‰ß™6Ø*“jèc“#†©Õf¼³¡…qdwC«e›È•ˆTrd柚¼ŒGMï€# ïbȬ|H<ž‘˜a³20c‡Íj„ÚÁ¬ÆÈufåлϲGW2>¶g½Ô‡­8x£1D†xÂlk, w0˜!XY¬ÐÍ!°'Þšà°Ø Í%Ö‡1¶Q0iO%`ø£@¤*üq -…ð/ô¦PŒ¾/ü`8Ó-ððŠÀÕ 43ËÔL#W~Ô‰<ÒÀ°HÁzH䱈R`]§ -ùmÅé%yòR×i,´$'_'Rø:MÃ8kâÿð.Úx}]ÊÉeœNŽ˜e¼31ÛGâÚG‰TÇ“<= Øs®A+TË‘—û¦Ø®xi½™Öô Úý„jϺwþÄ»›Š¼¸¢DH‰VsÍ´J½?0é’5Ü"Cc1d¥šÈ³e‚6i˘£%^™‹5™-Î{ÒbHµ·ª«ýŽ—GÈ€—(py€…Eˆ,¥¡·*¾å¼¢0… ÇYàÂùÕ7ó)ÑGb´lóÎcpÛ$•EfD™F†§©Q}éœ/ˆ•#%üj×ToàªBá²{€Mè(˜ª=Jî% ªt½‰AXó8ªEùì[©ä›ÎØ°ª8ÃH.¹ðõÅΪ¢5Uëf?í(pÝŠõ-#½»¼8 E: …ÔÑÄqúÿ?„¨$‰‚Z¯¥ÿ.¬a嚢ß0ŽFs’Vÿ!3å$ ƒêRƒ9ÉÁ4œ“FÉÙ0êÒ»p3”à’uÞ“êu$¢È$àJR¨8t§‰*ªPÛÄþ€ÚoÛj;”ᵃ†Æû fXš‰êaiŽP;HsŒ\'M‡ÞµI¬]„‘¢{碿óéÿPaQ}Õ/ö;',c!G…VâT@Ð7(²%UN£mþÄÌî(x­_™Vbõ‚š6ù #×ÒB „ÙÂsû¸êa€ú?m@Ú¼äÎ춼:øç¨M†{Èê“R‰eñx/âÀ š”…Aªá IQëLj”œ5)—Þ åÒ-0 ‘Ì b3úUŸõp|2ֳζ«¼ÏM}‘hk űŸâTR„Ò:õÚcN5~IMjKí(¶ÿb¾>%™$¢ënØ*Ì]çܧË]a<Ø:0ú40H:Ö嵃.ÇÈuºtèýH—T½s¹*8Ç—3“à¼v›Ÿ›ülëû£Vï¸àïi.¡@•‰u´ïûü,îÚ1B7_s¡L[qÖXê†ÿs\àðá¨øäý-òÚ°ßi"ã ÚƒH„j¼ïs`†Õn`ðQñ°ÚG¨Ô>F®S»Cï–'Efø3¢h\¢4þ‡ŠÁJoù.Ì”hŠendstream +xÚÍYëoÛ¶ÿž¿ÂPLfE©×€û!7uÛlyÝØYW¬Ã XŠ-L–\I^šÿþž)S¶Ò ¸_n‹Zäáá!yÎï<ÈŠ‰Å$\O&“(®ŒãÉrsâMV0òþDho¢\/ pèß‹“³wA8ž›xÉdñD,‹ì7çâÃùÝbv:•R:¾rO§Q;og§Â™ÿ ?‹Ó©pn¡qÇ,w÷§~ìܾ»¼š1áúüæIïgvón§¿/~:™-¬L•«B‰[ùròÛïÞ$ƒÝþtâ¹2‰'ÏÐö\‘$“͉ +¤(©ûåÉüä?½Sž5rà©á˜JÏcÕŸ\#'_œÆÒ©ù-ž2ï¸Ó­‹V·hX9)w+à€“>Ÿú‘S7pÒ?™^ЗiWÔÕL{AÎzÇe½+=ãÞ®ÍYl·Î™òT—8^£à碂æŠ9ò¯éf[æí¨Ñ³wrxŽ©¹¨OóæêöýíÍ|vÿËìþÍg!Õ›èÜœ_Ϩ÷6Jw%0ðç]]fyÓ²L1&3a ‘"T$õ‘w°±2c +i¬#-äHѧÁ!8MÆdáàxËãp.îÖû9¤ +æú^³­ëD!E“/÷+½°„]eÉ'JÊŸ¬zCK˜¡Ù—iYæÙˆ•.@FãÁ¨øIzh*Q¬Ž×Õ¦<ЙÐrÀ…”RÎ'‚—²¾ï¤%©®î±0fÛ©–h[͈ÿ˜=ˆ-v!`³^žnÓyÞü•7#’CåƉ9ò+â7ò#͇ž¯SPë?¶G݈š¦B…nÆ!,d8Ïk4Þ¶f +>%g ½6ØÎÐTÆŽ9ˆkµ<ì Hp-"<’“j -À#ÏxÀìÀ^Bóz1è‘Æ«tC+d#*“p¢È{Õ5„± ¥Y_]ûZéÏ’Ð D2€£ ëá^ #øÉkö;ÜJ¢ ëOF§|Šyô‹ÆhV»R»uÚ1m³å6Ç3h°¦°U?™ šp=gÂG +sYM•æƒ3p°¬ñȆ`CëçSqÎ +FxžëGñ@1½*!€^Á2À’¿ž=Ü\þÊäÏžP ÍÕ¾´-±qIì0 Þ•FF?ˆªî¨iM`«®–z´ýH&!ªKL$h7yÚ!‘òÌÅO8‹6Žn1¬Õ¸i½äµQIÇäpákz˜/˜yS¬ÐŽi§'§Ìcâï÷¬yÙ"¯•eXÊýìÞÈ.1–Õv8ÔÛ²CqlÁTaçUéÝPßè"JF˜Zí!¢dìøž÷õì×;f°·ªÇi¡”B<ÆëÙM;h‚OÅÒDí«Óƒr€!~ÒrÄ[|ðÏ×êfL¦rƒžã¾™nŠj5–7 n Ÿ7"0É9¤©qWؘ…(ÏF6sƈRª„¨™êªm”±£øP'†*ز¯[ÊòE§#Ô8)“¬ÇÕv46Ô)l»HéĪh»FKú“Ю;\O)gɹ9íö›ÎXþà SçÅ Š?Ï>ýqu{q~õÇõùҲ¦›ù§ùbvM­ú©{OÀöu±lêØ@“Õ¬|nHºØ5M^u¿@2‡‚Í$A΢j !8gY¯˜ç»·y™wù=fu‘.×ùwÿÊžë&ûÑã?b4çE®ˆ}}–ˆ¤^VFµXáÝèóƒ® aÈhžì¤ƒFZj'ÓfÎ-Ÿ«·øHx`„c =B°Ó»/GפueJÙ•yì˜5¼ô}7ôǯS?qe(ú’Û÷Ф +í’î!À´ë\Ô›  +× #gÖ4õ©ô.¯pÝ‘%dDþ÷íªžªPˆc£55`&„Fâ´\ibò%½a”-z%« Òy^Ó‚aTœ€#Ö”:6ÚIHf•ñŒ/;vž® ÃéaNØ:ÊHÔ1 +ó # ì@“êŠÅ£3Çd(7ùQ_S6iQÚþYj”Á®ÚQ³‚eðšYWFáÀ¬ÂM Ø<2«pÚ6ðÀ¶ªÕ®Á°Gö½Gup„~èÜq:#"[f{PQ”?ï”?c'v0­äf·¹ß“­êݶ9¢‘zå„P.Ū¹#,”{mƒTßý +ˆ !öuGb Æ®‹eΓö×Aè¬)A …‚|)1—€‡&LKÍBÙ¾YoÍôÑ”0@nzíBç¨^àh#­ÉÍÛ-…„ºOŸ†~â\výVŽFÅ`ì¬JÂ>Å QYò¥ ;ú +Ý1ò @\pÙ+vèÓáKŽFü‰vÄþVƒOMóp<}¯FYFÿ@+Q"¨ÒnÍ­áõf‚l7æf]ŸS7ìXTŸdI«†ÕERùRk‚ïá¥.ŠcuÐ%ÖÎ –à-À`Ÿ2‰Ø›Rw¬‚^ˆÛ¨x¼"$ù94(ýƒ3'¾ÑºEßF’¨œ‡ÓG’PpÌĵ @^¿Ý¼êÙï¶7°\AàÃFOüí˜Rt¶êÖ<Õ‹`í-"›‹•á§[f|É5¥‹Ð6:Q’±88cŠUB§ØÊÓ¢Ö5Ý8•×ÏD‹ÑL$¾ƒë*PhÎ#'DâˆÿñìQ·ƒkNÓï/¨&Ø`¯W…4~‰-75 Uõ7ŽmJÅòÔ<ÝF–TUrp +°œ Ò+Ì>Ó(~âA¹ì j¬4„QºÂ`žöêj»Ó½c5 M8æ*ûøÎÍ¿Á£%;-ÔQ‰?%LRç |õ…í kiAóñå©ë +¦qL8®hý0tÍ›J»yt—uõ4v#HÜ°É¡ª·øúæk{ïüÖ:øÉÀ.1aoöÅYŠÐ•°’åe[S$²œéà—7ƒ—RæuxÛµv½aß¿ßÖí‰Òy0}ünL1!]Ù4¼\š÷˜ü\P´Fæ9?’ª³¾®ÓŒ7 u¦ÌbxQÄK?^:Gƒ«æãØóbŠj>Þèn¯vzÏ«tX„"gZ‘ä>ìuxuÃÑ-|õÌ:§·ÃÒ&ÝÕõôwÖ‹ÅÒìdÿª’SìóTc®WåH ¢±‚aâã”)ˆ”)ˆ`7Ñ¡Ü@¿AŽ èbå}»È:׺9:+]J‹/ð»3çµu2z² zTå¢åýHöÏ:ÿßh€ApOûçîW€®bƒ¬ÿ¿„ÝÀË'ÈTwæ’‰e)-Ž׻Ǹ¶> endobj -6463 0 obj << -/D [6461 0 R /XYZ 85.039 781.388 null] ->> endobj -2202 0 obj << -/D [6461 0 R /XYZ 85.039 761.463 null] ->> endobj -6464 0 obj << -/D [6461 0 R /XYZ 85.039 741.337 null] +/Parent 6777 0 R >> endobj -6465 0 obj << -/D [6461 0 R /XYZ 85.039 670.603 null] ->> endobj -6466 0 obj << -/D [6461 0 R /XYZ 85.039 632.076 null] +6803 0 obj << +/D [6801 0 R /XYZ 85.039 781.388 null] >> endobj -6467 0 obj << -/D [6461 0 R /XYZ 85.039 457.053 null] +2278 0 obj << +/D [6801 0 R /XYZ 85.039 427.884 null] >> endobj -6468 0 obj << -/D [6461 0 R /XYZ 85.039 432.81 null] +6804 0 obj << +/D [6801 0 R /XYZ 85.039 387.72 null] >> endobj -6469 0 obj << -/D [6461 0 R /XYZ 85.039 405.106 null] +2282 0 obj << +/D [6801 0 R /XYZ 85.039 329.686 null] >> endobj -6470 0 obj << -/D [6461 0 R /XYZ 85.039 378.613 null] +6805 0 obj << +/D [6801 0 R /XYZ 85.039 294.94 null] >> endobj -6471 0 obj << -/D [6461 0 R /XYZ 85.039 351.515 null] +6800 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F59 3455 0 R /F20 3021 0 R /F41 3054 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2206 0 obj << -/D [6461 0 R /XYZ 85.039 279.064 null] +6808 0 obj << +/Length 2606 +/Filter /FlateDecode +>> +stream +xÚ­YmÛ8þ>¿"¸/ç×ò»÷Û´7íÍn§ëä°ìî7ñ$Æ8VÖv:Íâ~ü‘|$¿$)ºhŒ%J¢(Š|H*jæÑŸš¥‘ëÙ,I•¤élµ»òfys¥Ì oº^ñÐËåÕ‹×Q>ÙWyΫ¼®5K'ο[˜Ût¾+Y ú÷ÐPU´LÊw?ú‚LrS•}ýBBåZÑvÃ=ÏiŠ?´ºb ÝÖúÎ#5uUi¶øç²Þü8'£ËœßTÞböZã‹óQã™çæ5ÿ79¥‘:{â8±å´f_Éï:…Ê)wûªØÉ4ÃÒX [i7ŒSç¶ß8‘3»1q$5²~;J&jØ”Ÿæ†?i¼×Ä n9صH²‚q29>µaš˜Wº.øžÃȹ¯zcn °ÛZ +í±ça³M"‘žÙìðít78Ë¡[c8Ï%ÝŒÑmż‰V4n  Þÿõ< ÝØYFÂ}N,ÎÑÉ¥²ÒXñ©4gʱEïNÛ1ûÒ¨œ(N6G1ºÜ&‹6ZüUoªa!é„YéC=ï)Ù=;¬y<¬XæŠxüP´û&Q4-[Bh[›‚þ‰í ÿ=Öî +÷oVäï^m,·]VÌs«ËUo›'ySüx†€ÁE–¸iüœd¬8sË·|LÏYõ6§Þ€BûïéÞßÿtæ‹R¾óTõÑÓøŠæéÛ›²íš£™+W.æ¡ „ - =—U…VnÁÂt^¬‹ªèJ]O7yËQöëøú-(4ônÔš5µÜØ"ÊèÁÄŠ+½ÁéCwè™ïR&ß øš|óÂ4]‘(l/­qȳ›ÊR7³øÒæÑWã¨è \Rñ¾©G§7ÃÀ§Ñë1œÚu1òtvÁ'vVß³ß +¸Ó1‚¸ ›s…|á¼KiäXé}Y˜‰H$÷—$® +ãÉýI¸ÐÍSÛå°?@(à¯`B³ãŽÏâ2­¶ô¨Ì´½ \†¡@yäÏ,Q¿ …ƒaòXvæLæË=t€-„)%ŽE“Le——FÐ^`Î=,·“#ïºD¸¡«à<„–…™s¨«gÉ#%'¦ì¡ß×z#O2ALÏ2½-! ð\PУÄÌÆs£ïiYÓÀn‚³›¡j¸/R>õ°ß\Ôj»¡Jg‹Ðsã0ýf¥ÞQ‰Mõµ¤¢Ç3ÅÚræˈExªbõYÏØ!ËР +=ï µ#¬r¶õ,â“PEO…}¨¡FŽ ƒïXºá'ÉR!Iíˆ:,¯­#Rgƒ²fèJ7§)jŸ*SH“˜žø£4Ž{6vãÞŠ‹Ñ©Ÿ®Mñë‡çŠb&—ÅKO|œI½cœQG&l¬ýú å8°lßHSç!ŒÔرÞרa/”ÛÁQòõ®ä­LªÕ˜W)™R#/¶óšàÈc|ä ‹ÓWÛõÇiê4k¸”{$öéÄÏç9¶Á´wËð…ïyŸ_üç„3Ý3±?‹ŸùäÃõ¹½.-Í@[þiP…©bW;tTàýüMIÅèkKpô*aˆ;ã; Ï}è†W ý„y\"?,Ñ>1Ñ]Erì\´¨R¨ÔÓ]Q£¹—]{:¾ˆp#ïf9´IKtÕ+ãR®ŠÄãSÙ@§J‚ÝøiJ¼ëx2>±WVvzÉ.Rs" =úYâøw4ð4ÉÌ39mÌ¥Êÿ5hÍaÄØò oó‘#ôXÂT/Rš.ÈÆ–²ÊkqÊáyv«·îÝÖ߃¼Ô–­Ø)ÌËz“©^ë^¡TÌÊ£R†G%F%™gbHu9胮‰›¾˜P^ÄEI½äYfVµOŠØÀd˜z·g#‘úOr-&Žò­s”Œ²%º|¨Øx +'ÀƒÌÁSw¢›šxڠƨ¶÷P¶#DI™i±—sÖ9*RægîƒÝ{[A•HdRྼŠLÐ9”yõ”±¤Ì>Ñc¯âgxé”›Z +õ¼^ ëß×âÓ·;¦y@úæ⓱gß.IXD?=¹úƒ¿¢ZÐÚ‹è_Ÿx?ÄÞÄ!Äŧ¦X E«N½Œi#´h§Âo§[[¾G³ÎàÚ¹…L~ÛÿTa‹™Üü–1‚­Õ¾µöBr¦Þ?0¬J1زî;yê(Ü%0¹ ’Ù! ýX»…}}m +›ŽZÔêL¸_7ªõ;Fþ¥[ +·AÃÂây”ÌÒP`L<´æ:÷øMŽÛMðÛÍ|Ê¥]gÊVn”¨Q ¢”xáaŠ8/í& Eý»ôo>ŸfÄúÁÞãiö-KY TjPk½žô1ºd[ÙêêÝÄ¢û׉Î>rô YŒ +ˆÉ…}(g’-#Ïïí¤*f<Æ„læõ…‡º±ŠùG/E…Å~~2çü¾_;ƒÄåÂeàõåâ€jº³Šcô;§ðe=8endstream +endobj +6807 0 obj << +/Type /Page +/Contents 6808 0 R +/Resources 6806 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6777 0 R >> endobj -6472 0 obj << -/D [6461 0 R /XYZ 85.039 247.042 null] +6809 0 obj << +/D [6807 0 R /XYZ 85.039 781.388 null] >> endobj -2210 0 obj << -/D [6461 0 R /XYZ 85.039 189.008 null] +2286 0 obj << +/D [6807 0 R /XYZ 85.039 732.512 null] >> endobj -6473 0 obj << -/D [6461 0 R /XYZ 85.039 156.985 null] +6810 0 obj << +/D [6807 0 R /XYZ 85.039 698.372 null] >> endobj -6460 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R >> -/XObject << /Im1 4096 0 R >> +6806 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6476 0 obj << -/Length 2931 +6813 0 obj << +/Length 2342 /Filter /FlateDecode >> stream -xÚ­ËrÛFò®¯`åb°*„0DnZK¶[²Ö¢7›Jr€HˆD™h´¬¿O¿IHVe·\fzzzzzúM5 -àŸMC?0É(ž*ßL§£ùæ$-aå퉌‰ Lz8ÿšœ¾ £‘ -ü$HF³ûŽNèÛÐŒf‹?¼×ïÎnfŸÆcŒ§­?žÄñÔ;¿+ïö=ü™'ÊûƒF¹ù4ÖSïã›Ë ¸:»>CÐ[À¹¸Â}׳ñ_³_O.f-wí¹ÀI‚¬}=ùã¯`´€küzø&™Ž`ø -–7'À›Z#óõÉíÉ¿[R¼fG¼kHc¢?ÑáóÒŠ”o#ÓJKÒ -? ,I ¤}¸¢õQR¡MàÚ Ÿ¬YD±w{ kçOÝ^è<ËO‡Cü¨p€ù&"v~OWîÆoŽœ¤OòEVà«49ptÿˆ@ë5+˜d8½[^ž3ü1gð)áÆbÉÀ·Ys{yîónå}Ï|_¤Ü0Á>ñß`˜ \EÒ¸©æ= ô½Íªo¸–U<·~ÀƒO_"#Õ\¾Gn% Àë£~Ë XZð9°Óš€Î°:aš8¨›²Êd±Ye \—@{êÍÓ5Ï·t›?eׂ‘÷ª6i“—…ÀP,ñÍ 4])ïìÓIàAMõËI^¡We]Þ7$­õø‹IZ‡ÖFÜó!¯úe¼Ay½Ck©HQÁÑ€‚ÿ}QVµ¾ æø˜Xû!<Þ‹ù¿éÙ䇼&‘ ‡|›hñlŸÉÝ?hr*êLNÅÇtʶö8žZïg4ÍMº’-ùzÍ„îÐ9JõîN¶Õ @§Š ÆÈáè#ÀÖ -ïݪ,µ>—ÄG‡¯JÆAéŽgg9àÖår‰'›hŠ2‡/ÙrÞyl؈8C)B:óÈžE?lìa2‚ß”q¶C8Í*mx¹UN€‚W ]°EfBêúãŒá«´³G©ÛŸÞ¡¬3ý’¿e#pôP‘¾Ó$oAñÎ)飘µÐì6ÅÔÖÔ”÷ªfkwÍýžj -E ¯oR—çüŽ¯Ç+[òð¥l½׆+MÉè­J‹¥[êq³à¤õ VnyK¿åU‰wbåg/6¦`cçøÓ^Z;ÂîŽÉ2øzÁ)y߀õcÔbÏÙãXBÀ&]ˆÃåè†xmtc?\7b—÷¼ž7òr՜¿ 5®?rňc`Äe¸{dïR¸ÂnYü=(Pß îQŸ#l•’v±Ȧ ~¡W@3ð -ıÀt/I™} ÈÅEnsW7<ëĪp -™`ò¿ªèa–+¦#zµÎçÎq6M^,kÔw‹Eì¥ðE|£Üi'gË•·!{ØñX./´/¨¯V™á`‚ ’„*]ÙèI2´)2<"ìð0MwŽÎ„‰o‚®™R~‚/u?Jß*à[CÊp’~]²=(Îuú·l†1•õ£¯#Ü!ÙÀŠ{½à}løä±áÙ÷2„.òVKæM›¶ ì‘0‰ÑË›Wrؼ,Qp/ÍÙ¢u®&ÄhJ¥ë€w©²u~B§.OEM»”’ΚÕ_hí V•íeélj™³d¼Ká$e)&»:½[gGJo“Ô´§aÿ\]Ñ"ToÛVúçÔÓý©Ÿ¨gc¼1kîd¼Á:„²Ê$ö®nñAGZÖp¸vM=9{ªƒà;¬žþ÷†ám N0Ó£îÅ\„³ó#Lð >§má¤UÜÑùë…Sö¶´Éy&ž@ÙÕ 9ªàPäªKñ‹m%bÄ„Jöà]òÀ^ÂÍé'¸\ö¼[žm÷k@˹J-÷6möó)Ú¸WGjo¶k¶1œ®[ÉÍ»kåôXÃë|îRÿY>ÃëÌxù˜­§óŽx}a.Åí;¼ õRW®€-¥ç.È•üeí+ÿêìz¿¥–(¢6¬ˆZuŒ¶^òqNU¸Ör(ìʳ½Œéè}¹ÀæþmÜÊP5úÝÓC!Ý)©î.Ì€Uº-,|–Të-¸.Ýb -‡çO²ïÅèö¨(Nì^?šµµ¾ÕúÙš ‡ódÅ¢|#å*ׄ~ ~¹é:‰§P'¤ËœJ1(^Þ‚ilyxãìSÅ‹†èlãç›Ô=œ'›Šc_…,Ç«’.2¡jI‚ÌkêÔ M©åBƒªÍîè%­‰Èp9D”6| ðÓªÙH:]KCÕ9“&ŽáJˆ(ó§Èç² ÚSd(áεvMÜ%€ÖL=ln¤sQ=d‰àÂÅ÷¡@¹«wmÕÛ”NwqvÐðÑäè›òçøš]£1¤=£ÖE²9]-`%:ˆ¬ƒ(K¥Bz+‡RDzTîßoíC\ -““VÀk)ãîÝæÞˆ·–‚‹ÚXWÄÊ’C±ìPŽ~ °Ú F7„» ›~eaµäÝ;ÁòœZm°å-™êNøºHÂÝïkñox³Ÿ—%\á7åÏQ¹­“„™Dío˜£Ù:]× wªÖÏIÔAÌ]-Eqÿ &Û8YbÈ¥¶ÝB™ä{D¬ßý³àâfýÁó–<ä¤ïÕ¿ø±\6ù²rý?Ëæ8Y®‚œñÛ Óƒ…yÄ5÷¨8>î_" !’u¾,ºö —ÎÙ8kÑ-D¦Žgâ1ÄKáÙ¸_£ÂJ/»pÌqû$ñŠLNmO_u,ž½ºq™ó}¥Üdç2gEtYty/Å‹ÿ¡>#sŒ×Êä;z|A#^…fÒFLxºýV…àÍ–†²,éšúܪ÷ª¢8ô£öçˆP‹t®&ÛU*I‹³_šü¶Ðý–pY[é‚!‹ °‚oê´WR^èžgûy¢Q¤€•ž–s¶9ÑP'ø³AïYP)s`qLÜy&žzŸ»fncë jÙ]¥ës» >?mÝS·›{úôïÁSÚ6Rh€]×i¯_XîÍcNå²õ½€jÆJë–в ,=³ÅÕ¢çdq¾‘¼?¹½¨¥þT^å‹N†’øÏ”þ§ûÛ”Ãj’áŒû¤Z9^scÃC~C3õé9føoQì™endstream +xÚÍkoÛÈñ»…Ðâ +ˆ6\îò•¢(ÒØÉùŽ{Ñ!h“| EJ"L‰ +IÇu}çµiѹC¯æîìp8;ïé™z–„Ê7é,N´2I2[íÎüÙNÞœiÁðgVùQˆG_ž=F3í«ÔOgË5¡,óÞ«ï_^//~™/Œ1^`Õ|ljw~1×Þ»áßr¾ÐÞ[X\3Êõ/ó ñÞ¾¾üé‚?¿¼z‰ 7€sñ3¾wµœZþpv±p²°ÊFYù|öá“?ËÛÎ|eÒdvk_é4íÎlhTh쫳wgÿè©ð™ñ[^8Œ…ñU’Ø))^*VOH壯ãÇ—• C~ñ1Q<ÒÔáÍË5,5^‘­æAìmy·s;í•û‚ae‹OëÝ°Eù9Ü  px;<Èö=Ä Ð›öÙ|aýÄën°½|ñïVø_¨êùv«¬â}^:2· h»ºÉ6XÛ;ºEî˜[¨nNˆ‚Qÿ5“’  b‚ˆmU´ê±˜A¬‚Ø€2}ÙäÛÒáÅ”\Ñ ÄÃлÇ]Ýܶ]Ö•õžNæ&Œ¼»¶hZÕ›–a%鬫ŽÈ™;édQ#ƽЊë/Š"øDÁŠfŒ•˜mn@ò±ûþ˜Ý¼*¦hÄ ‚Ôë U×Ô» ]9óD£ ó4–Y7æÑ)ò¨=ð@?‰‰ÆÛ=ã÷‚õÑ2>%Aìóg¼;Ú2ïë5?›:Û•û oF†Ätw…ÈB^ñ¤yÅFÅù¶Ìk¹ñôîÕ‘%ˆ™ñ­³$€á¢íš¬«E|«L¤LÆP³v›ºr¢9æl8·]}@@à‚|à Òlj$M±¥`;Ë?«„"X6+Oý´ÃÓ‡XþM ú×ÖÙáÚÙò>'ajŠ¦d\dYè+oÄYA/hôìw yÉ’8H.9,îV´l[¥ðuˆ°Rg½ ;ao‹,oCØßXмœðÿªvNÜ «ïOܾ±Ý—ÎâŠ\hcQ”b»¢±ðuqQ©hz5ÞIº_‘œŽ¡ŽŠ¦ë¨E*Gý5k•‚Tׄâ)Rð)5TúÞ«m¶ßPlÄ›F±8!,ΉÝuvWu ¸žStÁŒÄtZBÊá ­~]µ±ïGv‘A[oU•GÛÓÆ%,8© v½a}^ï²R½ǪhP§:†¬Æ¬×¬éëÞ;€R_<À:cü¡ʧ…t.N‘Ϊ:ËAìÖÄÞû-&¸ÓL–KÖº»@Së$¡QõåœÜq†,‰ŠŸRäQ=€ð·?¹Ïˆ×ág^—}HìP) +ÝÖIä½C¢;”ZeÆÀc(ú:…Ã:«e !ád(® éíÑP#¶2ž ¯ÞOЗc|w5ARî€Æ 7áÉv½.+WÄèÐUãßIç»_§Úí~ݘ۟ÙjÎqš€É­;©¸•­¦/Øqù¯)¡O4É8:ŨaùþÅ£þ‡ËaÝŸïhÚè&kÙÉKï¤^„¦ãWû¾ãÑ5Æ}y´v~ÔDa¤Q‘LS„ù?ö[¸€NzA|5XB‰vR½†uŽÁÿÈ“àendstream endobj -6475 0 obj << +6812 0 obj << /Type /Page -/Contents 6476 0 R -/Resources 6474 0 R +/Contents 6813 0 R +/Resources 6811 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6459 0 R ->> endobj -6477 0 obj << -/D [6475 0 R /XYZ 85.039 781.388 null] +/Parent 6816 0 R >> endobj -2214 0 obj << -/D [6475 0 R /XYZ 85.039 761.463 null] ->> endobj -6478 0 obj << -/D [6475 0 R /XYZ 85.039 743.459 null] ->> endobj -2218 0 obj << -/D [6475 0 R /XYZ 85.039 589.406 null] ->> endobj -6479 0 obj << -/D [6475 0 R /XYZ 85.039 546.453 null] +6814 0 obj << +/D [6812 0 R /XYZ 85.039 781.388 null] >> endobj -2222 0 obj << -/D [6475 0 R /XYZ 85.039 244.422 null] +2290 0 obj << +/D [6812 0 R /XYZ 85.039 564.55 null] >> endobj -6480 0 obj << -/D [6475 0 R /XYZ 85.039 200.671 null] +6815 0 obj << +/D [6812 0 R /XYZ 85.039 529.804 null] >> endobj -6474 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F64 4112 0 R /F18 4115 0 R /F58 3360 0 R >> -/XObject << /Im1 4096 0 R >> +6811 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6483 0 obj << -/Length 3274 -/Filter /FlateDecode ->> -stream -xÚ­Z[sÛ6~÷¯Ðô¥ÔŒEÞöawÜ8ݤoâlv§í#Ñ2'´èRtmÿû=7€¤(9žm'“¾sAÔ,‚?j–ÅadòYš©ÐdÙly{ÍÖ0òÏ#% !Y h~¸::ù1Nf* -ó(Ÿ]]÷|âÐÆfvµú%xõæôòêõ‡ùÂhÎišg¯ç*øø3üs5_¨à=4.™äòÃ\gÁûß¾{Í秧ØõO y}Žó.®æ¿]ýtôúÊKç×Irí÷£_~‹f+ØÆOGQhòlöí(T0|{²…±5ò]}<ú—gÅcvƳöiÂQ@#Ìtö‚å@Aqï].ÍB¿²¡I°á–P¹øÓIbмŠýé$v¦T˜Ç1žNÁhIëÐâyÁé\4 Ï ÜÕ©P'i&™BŽ³ßg*Œlž&´Iø~OÔqòöVÍÎs6TØ.|IR• ìHé=ô%Q&ÊÒñÚÅ€w±Íƒ3RÞuqO§$Á%!v×¢¼$ ®›¹Áƒ§ÏÕfßQð°å9ŸÀ8· Ï­û¬ü= _¹x -Ýq…©bè>ÿb -"‚,x²[싃ü‘ÇNðÇç%wDÉ}WöDGÑãÉ.™–-‡¼‘•ü]ðÏ -5$¦ŠßwxüµÅžë¦e^°Hó´Ë®2œ'm¸È·£UF\'w¶éo è÷ÔйÁë¶,VOüQ>VÛŽN8 -N[F†Áªî -"áDþùºa5Öåj]2{ºE0ôpã0­u‘2Á(é¦f´Æï;1 ЖPÁHÝ6-‹n(]eE†ƒM[ö»Gl,]b@¶ö«SnWtŒ ˆ:qG€¬mâ÷D<ÖØ—òþqCÕ±à†)Ûr kŸ˜æ+Î*Ÿ¶üUÀv â’Vã¼¾+:arMçw+BÞ Lý)L„…eÒÀ ¦{[—3$ Âïrp€¼]¹Â-[ØL'„‚ÛV `7¤¡mõÅu ÿÞ2ú#ÙªBË|’q‡šiàÎ%€ä¾ÆçlmPX7·ÖM!Si!û'Õ;‡eÃqÙ²®H£_Å}ozO=•!סŽ”p{‡° îcyâx1ð ÷Ä.SY2ˆ/µÌ®–ìzáHHµµ÷|½$S’4Ô^KŸÅÈ€@lcx¦ P¦¹ÝA¸˜åfx‰e*&dÄ*Q½Î¬I% {Æ LZ§çO| `©ËÖƒÓtĆ;Œ×Yººrº°ŠOŪ´‡•Nn)tq -D—éà>ÉmpÖð‹ú°}MÆÏž¨ã:!ÛR:ê\˜U™@p´˜h6NB%#KèBmÖœ¬=6±¶{ã‰XÇ~]l÷ÎXá±·#DC„Hõ!(~Bb§1dóáLâÚ.ÎÄ,‘-ÑÃsʬ³b¬4 É:÷Ýû8³4rL6EV+ìw (Er¤j¸¨¡3fÆ©7?£ÄÿÝõ×Ja’Î ü&ðûÍ<Ò„:Ý_:Z8^‹³©gWl\»#"dxÿêôÝD´$ -£4ùkD^ß-1ÏŽE;§êÛ«7o/^óaY5¾ù6³rX›ëõžóTI ˆ\”Å.·˜r´ ¨y9ÃwͺÙ`, -Áâ{EŒzsˆ$1ͨ(ƒßg8ö™Š‹θ‹jOÞ%ëØ s©éý  Ó0‰r%¢Æ7[F?ü¸IÛ‡µóènQ|HVucŽÑ¡È.L~6ÐøØ|7Ö 8d¹Ä}l®¤²ò†Ñºgv%ظò§­”ðƒæA -[SÔâ¹òÂð€³/`¬…4'üy^þãÐöÇ">¿ýžæ` Á $ŠS€ÏÃXKkM¶ ?ãtÔÍ 5Ú#ÔZÑqá·ÌØëã(•u`ø„¨¬¿är -Ž#)þ$Ž¹žâpç×ì—È'c”ƒ“v%ì(—÷ó˜'¨lÁÓ[¸\nóú¯Å€ÙTÛFªã‘º÷¢r%a ÁÎ_!šãõ¼hqÑØ‘h/@åøÛ êpöcsM‰£+Ým“ï‚sn_Î÷œCTĘfÛ\wû8Úq´>‚¥?{øAV§/ñÕ}ëƒ#®8üc-¬´öEðé2©ã4y¹ÜCWðB3N¤iùA<ò!•€.߶R‚ZôJ+)Ñ»·ê<•!}ñü -Õ\ZIh]5”]FÑyðoÿ6 -5yý·XŽŒ•8—x\p„ =0BÄ‘Py´&tUÇ¥bŸTû ð¢«è¥ƒÊ‹É´$ <|c‚'œ}.úšC\JÎd+ h þ®Ùûb}T0 -„a–åÌV{*g¶ãW’\žCrWeÈíпæv_z)‡N÷±É9­Ç‰'üs.\ ÷žD_‡öž÷2¶ñ´¿—þªŸÊÀ¨ÚÑйäÊ7"wÓ -ÓSmlï¸Ê¸têÀºÊ³ÕUBªVòÀF2 . _߀kzŸ5Ð8ÙŽé‹'¥Œùd(ãuD½²¾ -ø± -'37Õ§gÚ›µ(÷¹ÛB´.{§%)*ôï2¾gG)]§øv9Ó|a·Ü¦‹’¹½5TäÎÔ ˆjÀçJ2,WÚ†y›’šî$ГíeîÖÂøàŽG*Y,a…±³ow' Â×l¼Ï©àͦŸ<) - Q,:ú ’í{®Nê4 Vþº@S§I°i:nPçcŸwr/Å2©< -`Ãk©f®·ýí­6å±Äî¢5$˜Ä¸Ø¹Ã6uÒ÷)%ëi*‘TpiS7Ū·7òo`Ð@’pi¼Ýó€úi”윱ü\?  ë&̆ -±ƒœŸXÈ3ñ²¹“6 -ú·Îip«}5 -vÚ!í`ðµ³Øø7hÒ±Z#Ñ=½+Á—‹È¡YöÏiŽã膈ÏŸe‚³ÁKâ·……[zP‚–w{XîgDÎú€}Ðô ¢Áð¢õ®r©~½IÀW"h:ñÃ~ ÚiEº(Ó¨Œ)ñæKÉëi0gô^Å”×M½ê¡[º¤Áû„É*¬ÝJdB:é—<óèà÷Óñ(Ìr|²ÛSö³&ÊwËð¬Ç(w‘¶¬EùÐeF™˜«ìÁ¨È¦Ô~h«Î¿Fmx©Š˜ïòSÁ÷²ðèNDãÜ­IØ”£þá—‡A0è_ÚP.î"N?®q<ö¼;8åñFœùŽ®0Òkå>Oö> +stream +xÚ¥YYÛ8~ï_áGh±EŠºò–l6ƒ f²Ùí2ÀÌ<Ð’Ú"[ŽŽ>òë·R’muσ,E²X¬ã«j¹ +àO®ÒHa¶JR)Â4]åû«`µ…™Ÿ®¤¥ÐQ("­¡½0é»Y?V"ÐÉM°òÃTè(ÆÉwwW7T°RˆãpuwODwÅÄÚ¢Àû¼Î”÷öW-½wk_z¦ƒVY¬ý0N¼÷8RÁ@×·ÕfèÝøÛ¡Ç™]y諦Mï›ÃúÏ»Ÿ¯þ}·ÄXÈ‘1­d ² ›3v·«º5\4öòµJ¼î~ìËÇ"¯£cñœ¡.xhWÖGn=¯U +¼ºox°(uƒÏÜÿZ°·=ªC¿>n‰]C›—v[3ôxN‰c´¢Çëå$¢ÞÞ”â/,8Œ§Ä ÕTƒTÝöåÁà 5íV „P3£[ùôñ·›_˜µ(Ÿ@Ρæë>£ü±Ñ—{üÀÃiŸ_èCËÞoÖ>°äÎÐÙ³©‡ÂÁ0Œ¼/LÔ:¶)ð¬ùs<Öxâ™ p3“Ó`I¼vvì)ú rè+Ú-ˆ¼û¶Ùc+ž‹_oyú+?½ì£;æ?Ýá4·Ùô®¡/•‡OqË$_i¼à¥“« xâÙ·y_¹[ÓFÈp[Ë}ƒ¢y^Ð\IüÐ ÍN†¡vážÓT|Á’=jûÆøgûÂtÁW¡vI눧æ°çnOx{&ztÆX×<`ê\±éØç”Þ‘gG³Ái|é¾ ^ã@êí@Bà=¬n/p +†æÃ^¹±çîš®Ÿ_>â»/èIÞðMP¾MmIuе&µÌ:µGýV¦/çZŽBM¦[+]Ünf(³ëµt(ŸpüªDYJ Dák (ð‰+«£Zòðýv`e¢gßâ˜b'…§>ÎiÞDÂÁ] †/¬Yó²XìÚÉ«\óÀôt@þXÑ{k´gÓZ·å¡lÑZçëifoKh¶ìe¬j¡g¨)p“†_¬Únð qÚÇÐ`ŽíX áa¨ >ƒLA¬µâ<Ý ¾èŸ¨ž™®g5b=’ºúÆ ÜÞ|çQ# ¤HâÌÆŽ#¼³>.êÀz‡éÊÏ´H!rBìù~õûŸÁª€õóU BxäGhBfÙj +ƶW_Ý^ýwÚŠgÆð.…¯n¿9š®`pÄíIŒ‹‘DÊR:œj+J³xXGèöøy œ‡"Uñ©Ÿ„gçwõe’ˆ`)á\@ +ŽñŠdÑ_ËEK-¤–‹’ JcËäÅmhQÛpËRŸî&Z% å8eë•”"CÏ1ÉøSÂ"ÄQž‹ @Œ$EØjõ}%&eYȳ³6ñ9-¢›{¹zßG«Ù£gB–BFrI‘ ›³Jm¸Uiä5÷ø Ѿ7w˜ uŽø;4†ªESÂq²=²“ÖnÕï [vF ÆŽu%ìœ »%<ËÔäÙJÀ²>3ô0J”g\Ü»ÆR°ê›s1“.Œ4 žh·Všÿûé9ý‹.d1 %¯ÙVâ¹­D™H‚Ô.™¤÷fíÇ:õ¾àEJ\“ˆqò¡ ""Ÿ7.ê»sþ•Ò $É)Ê~™cð¶:¼{~> %6´º±Ãä-ážß„ŒX(OA±çrmË­!B ++‡-‡¦¯.z»+_ع ¡@ü!¸4ý#›ó5ð“èpåó²äÀÿˆ4…½”i¦_ÈN@ôQγØ2ÔñYv"1?Ñ™÷aì1ýЖ/ı8‰¼ƒøFñÔŸ¿óRR”À«ª×s·ð†‰æ˜;ì9c$"M… Ò´$"´Î#½cŠ?‚(`ûÛ +ב 7°%ãÊÛ¦&HSÑJ —±»K€J‰,sèÏêP°Ý¤ªíáí<ÖN`á#Ë3ݲ‚ƒU jF`7}*/’§ S–ŒQ\spÀ‡Æ¶AûUZ{GzÚmköDOù ’-h7Ò°J夂£U ý”ª?T9Ÿz&#J'[<¡ƒ ¯ë) -ÀÝù…†Úâ B-Ì<ºPS»{Ž9÷Ü.´äv¤œX&¸Nwš£ÁvÛ–ó^—†¼/k=sO[uo,> endobj -6484 0 obj << -/D [6482 0 R /XYZ 85.039 781.388 null] +/Parent 6816 0 R +/Annots [ 6821 0 R ] >> endobj -2226 0 obj << -/D [6482 0 R /XYZ 85.039 633.122 null] +6821 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [160.701 426.663 387.421 438.352] +/Subtype /Link +/A << /S /GoTo /D (winbind) >> >> endobj -6485 0 obj << -/D [6482 0 R /XYZ 85.039 597.811 null] +6820 0 obj << +/D [6818 0 R /XYZ 85.039 781.388 null] >> endobj -2230 0 obj << -/D [6482 0 R /XYZ 85.039 499.13 null] +2294 0 obj << +/D [6818 0 R /XYZ 85.039 761.463 null] >> endobj -6486 0 obj << -/D [6482 0 R /XYZ 85.039 463.72 null] +3189 0 obj << +/D [6818 0 R /XYZ 85.039 657.513 null] >> endobj -2234 0 obj << -/D [6482 0 R /XYZ 85.039 286.732 null] +2298 0 obj << +/D [6818 0 R /XYZ 85.039 372.663 null] >> endobj -6487 0 obj << -/D [6482 0 R /XYZ 85.039 251.982 null] +6822 0 obj << +/D [6818 0 R /XYZ 85.039 337.352 null] >> endobj -6481 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F15 2972 0 R /F38 2997 0 R /F62 4047 0 R /F41 2994 0 R >> -/XObject << /Im1 4096 0 R >> +6817 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F64 4225 0 R /F18 4228 0 R /F65 4251 0 R /F62 4159 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6490 0 obj << -/Length 3207 +6825 0 obj << +/Length 3063 /Filter /FlateDecode >> stream -xÚÍkoÛFò»…P  T —»|¸>ÛIÓú‘³•+Š¶(‰²‰È¢Ž¤ãøßß¼–ZŠ”ÒCŠCÔ$ggggfç¹+5 àŸš¤‘èl’¤Ê×i:™?“;y{¤c*(S石£Wo¢x¢? ²Él¹¥ù&Ò“ÙâWïô‡“÷³ó›ã©ÖÚ ¶9­A3TÞ²®v–XUðL½9«„@/nŸ›¶xÀy7¬E-|ßÃ0î72:)ëbNâW8ñ™Õ«¸IÞzI+;r~ФU‘ t GƒÉÔ¨1m¬6øì#ñL Õ…|ýD†?Š1em·m –Eóúö>òNu²¶^ÖeÓÖ9Kð=Ï<±‹} ¦Šº‘³]# vŸ¤&Àžd,ö ^Ç°¤ Þí–!‹’Ä°œ>#ÔxsPX¤x• > <2ZS´m¹¾kø«½Ï[~ËkY{^=°´80¯«FÈå$)RAŒçnÐqü¿&ƒNH ÓÙÝ3Œ(a˱Ъ¿Æ …%ˆîJyy-î ‡Wô(‘3¶rÆlThɼÉMþQâNÞX¢°&B:_‹bC!¨Xãë;¦ÎÚ‹(Ž 5°q‡Í‚U€[#´;`¡bm¶âáõ«y]PXP¤¦¾ ¥ìÞ÷ÖŠ‘ƒc<ºPûÄߎð…¬ Q5-¯*ââµ(½bBT2…ÉÚf -$æ*m´GËT!Ül8O Õ F)FŠûwÎ ò/xÒ’òËÃë=‰2JR?Ô‡«!‡e/ª’ ;B¨^à2Ù]O±ŸFéÁ-Î`Å~tU¡¯UØ[щ.½@ ÍÀhöè!R¾ÒÙa=lqèA¾ª‡ nõ°³â¸œÏœZà ¶ü#ü\b†‰œ+e,Uk4àmœVÞÚïÉ1d±™%,¶JéƒÒ¸`˜hxf~f#®¨#NgÑ6è0ó‘õ6xs¼ ñežõ6xx›ŽÅÛ`ð!çˆAyªàAÊyü¡lF0~> þÇ~ˆùªeáËs@µ*¬™ù#ZbÙ"'Ï#1nQ=äåÚª[\h£¢«ÕŠ%àxi÷¯µúÚlm<¯Çæá[8JI@Ï.J4NÜž·®Tƒ`#¤# -à+àh_@1à•J‡ÉÁšu–úlÄâ –”¿Ï‹­ÖyÑÁ嬹ëq‰‘e®6/”bœFmUl„ ${[Ræ`Þ¢uQzËp#Dežä*ž#ÛËP™Oæ¸à±.\³›2Jgðž`Is÷ÀÅ?o©:Dd,Ïî4&‹ÈLsÀ—Ç^XUÞKw¡ùÔV†m±*t20©™ÕM†­sªD˜+“‡"*ÎÞ o%LW–ù-UëôT}Œ)ö5º*=wVæ9er†U–Ȳ”j…µGy‘ºb¢í¼±‚Ö•P«Š¼î4FÞ»%·]P¬­ †¿¿”]1Ö08ç)ýj‰ZKl”kk¡8ûí¨$"X¢@á¦ÐŽdÒ|FAÀdñe[$!ÂŽ@‘…Èk;Mú¢»käÁ€ù¬¥´Q ÀíuÖW3@û!KF,§ žŽl{×õÅ:ô£$þ†¶x—^M¨ùóMè‹·xtƒÌ_`~;†ÇzëJ¨,$C¯C`ëæVÄÜ›AˆÏ¶±Hª-efçLÃb‹Ò¹ -?Î’žFmI 5Ä0p -·Õl‘Ó#‘´l¨ã»¢’àÏ©q|[hÉ1Oð÷$4èËýð+ç…ÎÞ„fqèloB;´Z—Ð.gš»Å• tvQSÊÐAJC §†Qsí„„äDœÜ„„Hèez.ϲ}É›‹tv3Mv¤©ÐÕ¶l;lŒ»f íû˜[Bdê°[nqö»¥à $z¿[Xmë–‡–ëÜÒYÝ2”ºŒ^®Îg×o¯¯ø«¹çºÒêºe ÀòG6>öÚ½ -µN3Y©Ÿ©¨†}žTŽ -PøÜõ 5ô…£õ#®ÈîªU9¶¤Éq†é×¼šVkÉwþûë ^|'?Q´ GßÔ‰t6Õçh)›UI¥RªúÛS®Ý}Û›Lœ8öDíŸ-Çqfi—Øl¨Ãq(ï-Юøéü—ÕÄÆÂd¢~ý®FS[qàц>¹Jºè€(®DðIŠb.dͺ˜RÉä4<‘îÈá8 dí7\VÚN‚à -|ŒDí'C“øIcdaZS‡ØXd‰ý,ͺ¿[Âè/áMHf #K†=Ö¶‘%ˆ<÷XÓ¹ô°—/FÛHø‘.¤$»{²ÇÕ‚‰p’åDqŠ/Å—²‘WêhÓÛ¿+dC’9÷JÊø¡r³ˆMï&æ3Lƒ‡”’+ïÐ.!WÊpËÏn“lKØ/2Hm0¤w”Âd=ÜHj²÷¹uu˜@Žc"1Uƒ!¢ø\Vræ…óvS7<.xœ›.߆FÜ´ã׊÷ÅjçÒ–Î6 -¿©1FüPHç¨ÒÍ¥t›¥ôwŸÖt&«?ÙKR)˜!";”„Ô¿r9Ü¢šqZ(ÆáçX­?Oó冀iõζù‡ ‘÷3;-˜'9”ËÂ+2@ÛNoïìŽÛ@:”›bÚ³Š ÿÌñO¾‘šH>2JüšìYÄMG2À2sHÐ(ß(Õ)e™‚*ñ}±sJG²îî8J+9†h;è44ÿŠt˜N¯5•Ö$Ò~÷¯Èw1Ö†EŸ€Ü«S>sé';ò•Š£Ä†$d9(FðH'ˆ^M€—ÓM%óY7¹X:±Ò%^¥~šd=uŽÝT4Ì‚ýMZ«˜,”irÅ!eM&-7N_¸sÓ!'Þ¶êkéâð?Q“òÜwó‘æ\yòûí*B”Álç!X²ÿqq}zrñÇåÉéï®ÎSÚÜþr;;¿¤·jÙ>AlÆ÷îV?èJx¡…è¹:}¬ëbÝþ»¨Ø$„ Û‹/ýî¬XmqS‘æóûâ»,žªzñ:àÿÔˆÁôù‡-\ŒMŒ{§Ær œsA÷=F_9ÞCìޙ׊aój#ágc·V -íì[öPîkçIÿ½Î1¤“íÏ\P¾®Eð‚öFŽ6 `OÒÑŸØàöQº÷4"ðÃÑ»Ü`"ä¾é÷zÛ›3 ½Ôžû`(… Â°¼Ðy†\?G:õ£Tþ/“âÂendstream +xÚÍZ[oÛF~÷¯Ð#DcÎ…C²oNœnÜlÜl¬ ´} $Ú憵$×@üžË EZ”$©±0 gÎÜÏ÷ )'!üÉI‰P§“8‘B'Éd¹> '7Ðòé$‰¡°éåüäôçÈNd(Ò0̯Id¾ú-xõæìýüõ‡éLk¨HLgqœ柳 ÎÞÍ^ž]½žÊà› üÈàb:“Áæ¨øòãüõ9÷>›ª$ø8óúr~ñ +ÛÎp”9‰ý +=.§Ì9y=ï-pf„±Wøß“ßþ'+ØÄ/'¡Ði2¹ƒr(dšNÖ'&Ò"2Ú=—'W'ÿêFá63á^#ç03Q"Rh›éP$‰“‰„‰`ˆî¬t4rV§y»<ÝfMs·Â­œþ¬Âž”Ø_÷§<òS“ʱIç·yÃÇ6ȸMþÏ:Ç“­³+#¼3¸ƒwü°Æ¦j:Sq°ÚÁÙ—$Ûð8ímÖ²X±ÁqڼΖ-·Ý¡\=Ú[/ Eã&n³ <®²zÅ|¼¼ø7Ëí^n~2‹b!8z‰w“ÒFV0© ²EÆ‚ iQlp{<ôºj°Ú-cIë_¯«Íƒ­SlÙoi¥Ÿø6w¦BЕ(q‡¸ÍÖ/EZPc»%>©ƒZmG5[⧔g·)þMÅKÜ´ E˜:©#[‰…Šâ㱑PÒòôß³û5;PG¶‰D&ß¾‡y†=lïV‹#[04&‹e›ÕÈ&f&L„M£Zìf¦VÅ?J·ž¾™&¯í+’°„È Šƒ¥F`#´Â­ k’¯a©éù¼ÍëTy8Ö6>¤Aœµò8F_A…cHW"ÖéqÝÂ…É3èÖçzÕ­Ð('¶FZNö´¬­v„V!ßy¢¶ +¸7ç‘+ +V×\‘qßóÃ[èìÈW Ý_ƒ–Õz["¡s—–»×æ5›‘¹în~‹r 3¸TV¤*èzËK¯Ðâè­ôÛQ/pÅ (‡¿±õ’m~w1ç‘U¿àÖ7¹7DkOó™›öíñ^ˆ[’Ù’é«Úœ7]d%žð½[Z´¥„í,h?[¶…3°xáà ΋Ú/|ÙVõ=û>¿‡QX\s9ßd ºÛÔÊCÈI +ÍdfcƒúVÌýó|Š‹Å•¼Ç[µ‡Çíû¼qÈEJ= +9Êg€\¹Ê¶G §E¢¢c39Ô€\Ü¡j7hÛ+47êLuðÇgïùé‹r¢µ{Öüë™-9?Å¢t#.ÐûsçÆ‘[å'•6hs®zxMdðªs’J\Sœ>@"Tô n=Í»Y *P9¤<Š$$àm–ånåuý'¤K~ü–Q·é_ E‰2?øØ +b3 ƒ«ÝfN¿^¾fÔàŒçî(²„GwÜ|4~‰·/¸ß%]!7•¥C €4_²; 'äA:Ü©ëÿ®XT×­ böØç˜×Q÷à!ͤC ¡Vúݾ¤‰ÚOìl +±ýƒ‰ä9ÙáᎦýko˜¾ÝYûÔùdûéÇŒ0«N£¿#“ñãAXhžÃ+»+6‹b³W{LúDöX&åA&Ã! S %@¸Âº6#â†êlG‰ê|1xï‰47LƒëÕŒd»Ø F¬ùHJÃ4õCdá(çÕšç p•x6ò“Ê’‚18¾à¢åv^þ¢q-™ô:k + +Ú ¾6#8h¥­cïo±·ßœe|¾áÇk +F±ï’äò†½Ï^uyDÎþŒàÁ¿zàW²àv‹WèIbÔý“ø^~wHôáìp“|¼:†°D¤æû :Æ…¡ 3üQþøVsËÀ2æ|>Ð鬫6纳/ç¼ qFÛØ°ÜÇ]&,¡¹.–9¦ŠÜ´C¥vGLêªÁ•ÒWׇd7³iÄ/ép&i{ïUŒ‡5c儙Ѡ«5é{Ñ´uñmÃbwz|Ø}“{Æ'Tl/]|@š‡ÄÉXàd¹ZKªÂ(‚—è$®)$÷ÝüyËdoe”ó Öté\2'O#ßqÒ¢i3òVñ¹åN°8²5ŒŽr»4˜K1aw±(¿Ä@4c9uIY»› F”HŒ!Õ a±¤2oM¦G‚§Õ 樽)jœ¸K +‚Ö¶\‘ñO—,_gõçidÑŠLÝ$Véw,ŒyVü…#ßïOʛةðù@”)ˆß”gÝã$²þØFwŒ…]ã&äT°*]‘¹o'2²:¾}…†ôP{ôQ»NMxjì¨BT“9Î/67e>ë>«à1Ø‘#ûÚ½ÎÃi³–Þ99ë~èi —PH¬Ða<þ¹œ²ÐvàŽ¡Áw뱑Š„"“™B˜âÝn`/%ÛÃó¢Y¢ËËÿ.é–32%¸4i¨wÏ:L+ã4­¢ýU7ÅͦÚŠCVßÒÑ:`9팋!¡ZH:†>?tˆx´áW1ŠØ ¥oêœÂV(v‹¡³PîU-4ö½uƒ° ÄÇÃ3ÅêAÖpì‹cb@´w¾NÙ²ûÊþùñGkëc¹J›ˆXŽ¼/¦`ê}¦eÔ5Úìsê‡_Ž n…Õ~+~•Æœ^ÕD·‰> áú-&Zí8K}í75~3ˆ‘TÒÿ>ç8ûh›~;<ù àüܾ#endstream endobj -6489 0 obj << +6824 0 obj << /Type /Page -/Contents 6490 0 R -/Resources 6488 0 R +/Contents 6825 0 R +/Resources 6823 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6459 0 R ->> endobj -6491 0 obj << -/D [6489 0 R /XYZ 85.039 781.388 null] ->> endobj -2238 0 obj << -/D [6489 0 R /XYZ 85.039 761.463 null] ->> endobj -6492 0 obj << -/D [6489 0 R /XYZ 85.039 743.459 null] +/Parent 6816 0 R >> endobj -6493 0 obj << -/D [6489 0 R /XYZ 85.039 503.109 null] ->> endobj -6494 0 obj << -/D [6489 0 R /XYZ 85.039 407.659 null] +6826 0 obj << +/D [6824 0 R /XYZ 85.039 781.388 null] >> endobj -6495 0 obj << -/D [6489 0 R /XYZ 85.039 354.068 null] +2302 0 obj << +/D [6824 0 R /XYZ 85.039 159.888 null] >> endobj -6496 0 obj << -/D [6489 0 R /XYZ 85.039 299.871 null] +6827 0 obj << +/D [6824 0 R /XYZ 85.039 119.725 null] >> endobj -6488 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F35 2976 0 R >> +6823 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6499 0 obj << -/Length 2975 -/Filter /FlateDecode ->> -stream -xÚå[YsÛ8~÷¯ÐKª¤ªBÜà¼y瘉¯­ÌQ3ó H´ÄŠ$z(*‰ÿývà!ñ°¼¡¶¼³å*‹FãCwhÒAt`$ x8ІnÌ`¶>  ¨y}F=ÅØ“Œ+4ÿœœ=%Õ€$ ÂÁä¶ä#‰|0™ÿ>|ñæüjrq=s·LÑXk3|y1¢Ã›Ÿàßd4¦ÃðpåH®®GÌ ?¼zûîÂ\ž¿?Ç¢×@sq‰íÞOFN~<»˜Òý‚$!Šö×Ùïƒ9 ãdz€ðÐ ¾Âs@(T¯Ï@6"÷﫳›³¬\¸VMšÜix]T6¨BDªâãfÒG8àÆ&Õðµà‰7ð2Op¨_·X¦a Â=ínáaº[e®Í*|6Íâ[ûf·‰g?KÖØh •ö=¶É.YN[WôG ƒUü{\k”éÞ=¾Dþz8Cú[nщ3ß×zŠo÷ŽÙ'+N„³ªSÔdh‡žFó¤¶ëYÍ]ƒ,q¿S÷³‰2;üt -c ÃÏ®|‹­–8ô4Ê{*{];-Ønï­žýÒ“ß&+(]9å"³*U-âm–znN÷¶K«¤l8YFöÕ3›¡xVšÍ"ª¨A;d‡¦”ç:ÀÔƒaÃ/1jÀp«å¢/xOnÝo¶ù2€ ÚºökW}…B'+Ô€¬{WŒ‹egðß"Jpº­Òáyî·þ·H”Fíâ´ìÔ -0Íå½ínç^fi4Í¢½ -ß™S÷f[U„´zÈ" ¥;œ×8àß²ê›\±…o <®áçšÜYMÛÉ‹×-”f®Z-¸Çéª@‚­YÆ[ÿä >YØÛ>”e“l¢œQœìËI^|KÜÓ9 -ž@…ïø+våWIy—óR<ǯeè½òX`úµKdZ)°@Æ0"ZÍe®næ,Ž×+‹ü¨‹²ûC-wÛÂZÁÛ]šxö«èPDiKœ.'Ø2^yÔ€Èø˜,Ô ö„S?ªX F ÿÔv Óݦќ,Š)Î8sŽÂª’Ãä[K¹—báÀ³_ÚŽÚu“yeøåî{bš`ü±§ N°`bx]X ÁøðMüÅ›L|ËͧіnÑÛI@«éê}Ko*–v*¿Ä * uU8£ø‹3’¬æQºuì*¼¹3ˆXzg­c¶ß4<Ì£Û)r_y˜Ú´¾0ï&v–W‘Ó“3¹ ½Yâ êli1§GÁ¡׫ƒ¥Äh-$4·‹êk~ꜟƒ‡8Ÿÿ¦âÍOhÏ~;ôý”j*=P<.e{N˜nöýãœ×¸Â¬îÚ)£„oωl˜óñúoŽO¨ÖDö#¡åô€|i`P•ïã Jv‚=%h…š…D…¸#ÙæváHö*Â÷$7É­]^¹£ž:ËRg,àI<Ì7'¹,¼Wšl“Û¬‰£ !èýh–Xk`È7ö»´ˆb6úìç8ºÈ™ÛØzŠ†n4#R«ãå¾øœîVIZ†‹ ²S@<žéÇmÉj0JcÔžU½)Œ¹]ánI¾÷ûSŠ‚K´.Ž -ˆÝs3ö4nQ‡¥}åŒ §ÎÚ¹Êm+–/ãêÛž¥Å‚Ü*Mã<F«èêlXP8B(°N’¡ƒË’5øÁDžÏzº™.lX -/¥ÉŸ.lRr/Ì›\%´ñaqçÕ[?®4ú¡e»"eHDHëö@&=àû^³h¾aÓÚ¶*FÃÀZh ¿ -Ááoż0b2cÀ / ŒbU\yªœÈNä(„8þÓª¼Ân6À@*"TŽ”šnWƒJç5 ±¾&Ýÿ*‡=à[ÿƒÑó2Z­ÜÛ+\¾{è¶ÅÅÂ+vœWv¸.š`D_F¸YíJŒOÀ†PKÓ4ÆÚX9,\ÀãMÃ.ZÜpË GøŃk“‡)­66¶QlÜ“§>ôS̸µ.`%”-@€É’)ð»v¶ÞO×QÍ}†è¬äõ’yfÝ’A4J”í²ì%FP«Üœn~…¸™ØÕä!Ì1ïI^®(XjÐdq"ñÝ“+ûšÛÀ€‹×-Qø •À$BÎï0N}9ͦ­S\²ìcŠ»dB‚]ÜðY'ñ@ -òèg >/JÍñ.Ø ûk0@h@Z!Ô‡>N¡Þ샨¬Àüà´pÐDH%ü´îü³ÝÌßµaHôf"Z…c --³Þî´ØézÑ«µ ŸT %lÛô@<0ÐW°³:³±«=Õ²1¤§ã,Ú¶§ì ðt‰Ë”$Ü°=qO  c•Q@©e]²€AÄ+ö<ÝÖî:Åç ©ÛLÐÓGù®õ¬—YêÓÁBì Ó $tÇï‡8˜ë,Ù÷e/iš\¢4ïÌMä xV½†å¢óæ˧Ù,§$õ»WžgDAí~r¢-²÷¯œï%åTóR°î0E ÝõÎyo[Gÿ§i"œÐ[Oi"fíi"9 -÷îËów5ÑT@XN½ˆæy= šâ„‹}Ñ.m–í‹7oß_4­xXPæÙ7Ö6M~QJ‡ç×M,AjØß.A$-3âþ§DÀG €Æ "MWèþÖ»X—&¦åæ¼1ȧŠÛò(˜‚ EÓºé+‚°äúQ‰FZÚ1“±Š–ûoO•µ'R°–D -ÝšG! Ñ” *ý×s)`, †û,ªIþx¡ì/ -Ñ_6Ý‘B\ÀAŸe/ßÇ:fÝ2ã) N]Uèg7˜Án¿ö§áYS«%yŒù½ªMævü19‰çyžPa›“ßÀMhÓÛe®4‚(ÙÓá µB¤ÅtÙÐacZp>m°“e#̯¬¡i9ýö/:èâÒ2L¦T{âö pÑ3ÀyÀû@wÇáyí¦æÈîˆScˆiÛ}…ö¦P2VM#¸1I1;âHËa³Ò[@ï”ÁW`—áÿÏmùqgn9ð{™«=ä‡O ù¶`¬-¥ ãè”  ñ»‚6äcpÙ¼T:éð]"³À}CQù1xWá߶Ÿ -ð«“Âb=ö¥¾=ØVÉ: é÷º%¯4íüЛbz,-ýƒZwzYž Rjì@P×°I•ÔÍñ«Y /ñÃfe?lž'#¸¯½ €Á·ç¿º æ =Å—˜nÑÌœæ-•˜²Ç¡â™-oIwÀÔnFÃò#T.L dþKqGTøßõìòvendstream +6830 0 obj << +/Length 2916 +/Filter /FlateDecode +>> +stream +xÚ¥koÛFò»…Ðûp`Ò|?rŸœÔi\ô’^¢~jŠ`-R2/©’T÷ão^»\JtrèÁ€µÜÎÌÎ{†Á‡¿`‘'ž‹,¼(Ïëý•¿ØÂÉOW@ø‹ØóÓ^®®n^'é"ð½Â/« ¬ÊßWon]ݽ_ºQ9aâ-Ý,Ë_—yìÜþÓ}yûán8?âq ?s¿tç,Vïiùò·ÕÝüöí2ÌßVoîÞ®î_áÙ-bYØ;xãíòÕÏWw+‹A7öâ4Bÿ¼úýQÂ%~¾ò½¨ÈO°ö½ (û«8‰¼$Žäywõáê_ ŸÅ ~kF®†pƒÂ+Âd^V.Ê&)Œ´BØ`'±¥ +=¸JrJäT„ '¸š9¯Úæ£ÄÛc§†ºmxóéÔ×™›‡^ô,+QàåÁÈJÌ(î ø¡3<ÖÀPþNµÆÿì2ô´ 3§b˜z‚9ò›æõá6lÝvÆD8úSƒ +ÆÛÐs»á_Õ”¼ØVMÕÕk9= ê®"B‡¥‹œ0ÞJ^|@¼'^Wx„ +gèêJóÕê»2– +åI:CÅ$ýŽÙ¢ Ÿ<.Œ÷H7º(/„†‡8… µŸ‘¾&†ã´pê3¤Épô.]‰µ ­h„#úª:ûÕW‚^iz›03àîÃ1ž;+MuOT‰{TÜQ®ˆè°TÃc=#Ç1>´L »9f>ð'zNcg­D¤ðô-ñpm½:ñŠîWÖú\ ¡ø%g;"ñw1 @‰ÕÞ¨p§äu§U +o'z½4éçîQVbiú:eÕ¬ ÷R`Ù Š´fæw\d6Ó^X*'-ž¡Ú÷¢´4JYi¥yqÉ«¦9~A¹ è‡'ÆLþSdã% +4²+»[Ï'èέ5Ú_àímÍÚiøq/¦r´x®{>++¼LC^ÄØÙ¢HH•Z#—Ô/B@×À3äéØ¡t=&Ì<¢° P Ä´Û²ãì‘C';nìȬ*‹`§dW_wõk²äý‡Q¯;’ <=¡]')¢ë¡Ò‹A!#ñÁFoYƺ&=ÃîÁU§ÖCÕ ‡Ž¼ˆ4Wjú"6Æ­U—`¼lÜ»íÔb~AÊz’Þ£ìõ§~ †ö|¦Ê= ¤îu(‡PÓv/Àñ£H‘ì- Æ©avÜñ +æš0‹øçcÅûA¶«¾¯cV2Ëœ&N§3ׄÜEC&¿£HPýƒÍEí´¿´×ÏÕT-Ÿu…7cÏ°{¥ýŽŒAà óN7†£§z3Vüƒ÷Eîo^Ç•S#H¸Q‘Hfmb’u/Nb9ÿq±±r°8Œ& +'Mõ¤Í³n*ö 8H=HIâ",µ{4…(MÖ²".) ¢¨£61%:ÞNOùAÐ|ôג墳É^öY?Àú¡#³9é—¬ æ‚H”‹¿!)ßKFŒ?Dm6Š²Õ ääM%uÁ\Ö²/ëF1D|9N˜ømÚNå#zÕx›Ìà.jz#·Œ“‘Ë8Õ9x e/…¬3ˆ5¥o\‘ã‘_jò;4Þ¯hÐq>*^¦‹£…÷éÅùZ=›Xd›XÆ°ÌÅÈnvõà [Ž>°%ÕWëcW§S(5¼dC‹ÄÑçË +ŠîâdÄw6Uuä´Ç¡¯ËÚ`¯}mh5gTJûãž$Ø£ çγ@ÓVý‹¹¹ra^etmò¨è¡Dïª?u‡(èñ¦Å$ñ 9¹9¨ý§~èT³­>íÛ|ÇëÛ¹R=‚^ Æ|±.)Ïî.Šõ±o Î*Ó[²rê{*žÄº Ž¼©†5r敼× ®Z«~¶‘ÈÂüùF"Òo7\µK¦ÔÚ«º¡x»eë®Nz{cÂ9»F +8¥¿_jÅ 1V5»šœÄ¥Kó³êÁsk-oftš¦^RDJýµžÌ´\¼X(lEλIwôÍäxBå*êhؤ.ͽ<}R̓Y(®¸Ë3W°­btËpP\·.ŒE\óÆ“uøTï$”¦ ¤[àýêI…?λº)Y­3‘ÌåÒœ<ÞÏæâ™.µç¢TÈy1YÿçœZî{ašÍ‡M$“XdžéqP‘8dSŠƒ\&QpÄŽFì0„ê{+aÖK™½Ð_x¢îû‘ŒñM1Z¨ŸÁÖqø뇜ú°lš8ØØ5Ú˜?ÃÇhsdR é;Ë¢Ddмí%£ÍèÑš1&Ì'ŠØBÁ6[íF2™ƒ 0HìjÓnävZÇèÇc'­®ÙóÒpÒ¦^g¢›Í mE„’½ôÓPûèªÔKuQÞíÚmÝÌaˆC0 ¦4Èû¹—B³j»þ8ƒ §×¦:„{|,HZ]±H{*Ðög%ÓhÞŒÒ2¹) +4‚—áê¬/ÚËô$ HaÒBnX)é$J[ÑFˆ§Óël“S ’¼à°©û½7S!Þœ²¨ç5Û<,È +IØIn ;,Ž[½¹{?£h#3e UÄÀË^É\Ñ›P‡—]¬ÈÄø6œÐœ!jllx½kÍЫê\FÖÊÙñ ;ךNSì@ÁÐ8@É|¾ëuäô¡ÆÓÛv¨Ð¬|ßÔê…Ejuð”È „©Mã™ã<žÐ£qàKd¸$R=9tœØñP²‹Ä‰ž"¿é„ßSTäe©vf"ékÝD%\×Û¦íFÈ$t’ +hú²Dé8úË hOAPj2[‚šq ‘èÄ鹌”eôë¯g¤w3E8mëc×MnwÒ3#,Žé‰óp4ÜOQM‡W2¯X!ÒÇ‘.àÇ lÙ81Ƙß/¨~¦rïM©>-R/ˆ2¨„ Ëg °z¿,AM¦‡þØFdçÈ- Oé;Õ81²½˜³Pà95%§i1ë\ø½çLb¸Ebo—öè=-ÎFæ°¡&Þ9O,àIÑ´‡’6¦\ª©“Ö!P4«Ž¾ž†hŠ•#ι*¥ûÙáfW÷ÔbD º·xê.b;oè”Ýý“Ô‡¸­á×Pàî5:9ëLzi¹àjú¡;ê´6˜¤”XeHBuÇnü†d}óˆ •CGÝ·.<†K{ ¼0ƒX^à‡ó“q`ð|82/ÈíáÃóAx1"Hi0±íÿrÈæendstream endobj -6498 0 obj << +6829 0 obj << /Type /Page -/Contents 6499 0 R -/Resources 6497 0 R +/Contents 6830 0 R +/Resources 6828 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6459 0 R +/Parent 6816 0 R +/Annots [ 6834 0 R ] >> endobj -6500 0 obj << -/D [6498 0 R /XYZ 85.039 781.388 null] +6834 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [324.074 403.41 499.4 415.1] +/Subtype/Link/A<> >> endobj -6501 0 obj << -/D [6498 0 R /XYZ 85.039 557.499 null] +6831 0 obj << +/D [6829 0 R /XYZ 85.039 781.388 null] >> endobj -6502 0 obj << -/D [6498 0 R /XYZ 236 563.472 null] +2306 0 obj << +/D [6829 0 R /XYZ 85.039 761.463 null] >> endobj -6503 0 obj << -/D [6498 0 R /XYZ 85.039 262.8 null] +6832 0 obj << +/D [6829 0 R /XYZ 85.039 741.134 null] >> endobj -6504 0 obj << -/D [6498 0 R /XYZ 248.712 268.773 null] +2310 0 obj << +/D [6829 0 R /XYZ 85.039 481.319 null] >> endobj -2242 0 obj << -/D [6498 0 R /XYZ 85.039 145.513 null] +6833 0 obj << +/D [6829 0 R /XYZ 85.039 444.448 null] >> endobj -6505 0 obj << -/D [6498 0 R /XYZ 85.039 107.982 null] +6828 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R /F35 3036 0 R /F62 4159 0 R /F58 3380 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6497 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F62 4047 0 R /F20 2961 0 R >> +6837 0 obj << +/Length 3702 +/Filter /FlateDecode +>> +stream +xÚÕÉnäÆõ®¯|¢7‡U¬ââœd{Oà8OûdûPêf·ˆt7e’=#ùø¼­Èâ¢A‚\lP×òjy¯Þþ¨nøS·…“´¼Í §Eq»;ß$·G˜ùëˆäÖÄIfqêëíÍ›ïlv«’¸LÊÛí@¶û_¢o¾¿¿}ûÓÝ&MÓHÛøn“çEôþ®0Ñýß7_ßx{§¢oqÚÀŠÞÝmTôÛŸ¨ùõÏÛ·ßòêû;]D?o¿ûãöÝ78w»l ì°âǻ߶»y» .¸1±ÉR¼áï7¿ü–ÜÝ$qZ·Ÿ Äª,oÏ7Ʀ±5©ôO7nþ9ìÂsæ–W­Ðacëi…¢ì +AúG¸jÁݯÐìðúU‹it€FÚŽž`ÈP÷éNç8­¢=Ï1¨ŽšþÑïp®Ô]xg:ðo½çƒUt¹ÓeÔ׿&Êì\_7 cË4úP킆ö'ø÷rK¿„J;¹ú¹¹ÛÀsàž×SÅ'ìähx¤½Bº•„ô±u|(jÝQÂ^‰gDî6Í„/žV ̯‰MjºTõDW—:§†$táH‚yó]¾‚ÖY¬á‰ø-ÞTýî ^æ©cØÉ‹eYlÊL@‘X'A0Ø×a;¼`WíyÆ1 2ëGüGw„û+¹_KôÙèRÇy1¡Rã ¬¢–Y¿­?Ö'?~¬:–…›²†n/s»–`çïíN ÊQÀ\Žr²U#´mûºêâ¹8m´¹ÝX"’¯‰ ’”ØñìoÔ +ûóùÆ66ÖòÂù¦8e‚=m±²§Ûíšë¥ÿjå ­ŽmnnûX …<÷âó÷¦¹‘xï@FL)Ї»Žï3™^¤hóà:¡=QÕÑ,ÞŽàåpwqÇêìÃògL½ë™;äÞ!wðÝA +qÉ rF½s'b{ØôœkhdžÁÛªëÛz׿üˆ»ÎµÜHGÒ× èÂÌñ(¨õNõ0h¤JŽÜ…)+G¸˵@øwïèö^© ³z1j7+Š£­˜Bˆ¦ÎQ)’XY9$þÉ=ˆhèÜFÝK×~g웨õ¯Õ5×Ö?¢ŠÀ¨Qü;»çšš@Ÿë,·,6×3žø rÁû"2x™@}w,à4Ûò¬—%ä÷Ôñ$Q§†ž#àž%òL´tÔ»ø(Oøò'xú‘¥Rÿú¢5~U©i™¤é¿àáSs¬/Ü$feÖIåõRÿzð$Í¥kNÕºÈò87ÙKtU× W€‰ • Üû–øÒµ5àF XÐdGÙ2i¾Ð 8æçÄ3Ä®v=r?N|ªá •EûÆ«T§g«/Ç.躞;Ïš~:ÜB8M´_>ä‰}#KMªwÁ¤Š_#/`ïa”z†–¥ä!ìÆáL®Ý  »M÷ÃMŽ5[8™ó«ˆ•iµ<-ÈŸ»îP¼ˆPhœÉ˜3itD…Ó•lüŠ0ø+é²DN>òÜ', 2‚—@;ÒÐÈß8;z6¬Ú ¿ϲdBÃÁ‹Ktànð&§†ø œôÇÓDs–Kîé¹wªgA¤ã~ÌEd4f2­XU¦ŒyNb~„¤X—–½7ÒþmÍJ]Öú÷Æ6ßÓ ÿŸGÌŸ\×}jÚýªœ±MôÔÐÐy®ë¹u¤§Utª1ƒEÎÆ!¿¾­~¿ÖƒAú;ò» €§aK7>ˆ1£Ò†¶C@`0y6qºi¯¾ù×à$^Dê•9ññú^÷hc…k°5ȇÉBÖA¿BÙh‹Ü÷‚קµŸÎÒ(t:‡üõÚÛsåˆc^á 8òðb®o4DÜw'Y¤Hõ©õf4ÐLÅæ2XÔ/VDdá]­’•xcÂ?*O^›3m‚®Yì%#¥e\”vé'θe)<6‹s :;Oâ<µÿ ¯ëd…×Á÷msÚ€Y‡,•eÑ¿ç‡å:.RóºDÙà”Õ`tKJϤƒnÄ@!<çj~|ÐÑãÙóš-CY-ìûHqÐ'XÔø O sÔÈ ®}á¡Oõé„- "èD«MND%çoßy’Ýmf©N¤Iʼnʦ~UËô<8 +¬®h±OþV–[c{Á0FÎsÆB‚ý@:Å£ E ”P ®ášF;7Û£hÙŽl-.õ¾v=‹« Ùyy~Cöãa ó3ZˆgïÎÒ›iAªž«Á=ïe ]H î{WF—é¨*Èzr–1qi˜ž- +œÀ²±-¾ã(hd½Žç÷•7h>p N qi«ˆ¿ÜK´ë3#Ö´½»ìÈOÄO¢jTZЛ¾ êO‚þ”„„,7üpûàfÀ©NøE¼yC·÷ 0”Èqí8J7ÉJ$ìí!òÇ$?ï8ñ +«3>í +æ”®þ´BÜ¥bÎÛOZÝ„ê{ç—Ï_ɬ(“Å6KÃÌÊ“;Ç Ç+Z6Ïc[¦ËÜ +,ÐBïSÐWnOl“‘à颈ÄÏ©ä½;uü3Pˆ,þ™5 +\{N9 y9£M¬¬h ( öšQOP§åUÂK£µж9s‹C)hüPoã±Ï›÷ö¢ÎK³B8Œ£[¼°/j€Ûúuàå„© L‰rJxìÙOî®âJd’ùÊBç½£Ýôò¡q°î^S®g™b> åÌFbl)òÊ&T ¯0‡*â$ÿxê5Þø ÜÝóè“žyâ£}átëÑVãE‡¯UšëiÏCê¸Á¨q×ã# xúŒ1q!g€`’ÓGz?]}¤b°# ²Äv Bü×?AøW={4èu•rS7$ç‚Jø¡ ¤ê {õ{Ž1½Ë* +†ÌQíóå $eÒ\ÎÁ)ëÆR%Eœ–æVa"UsYÆ©N'9u›®›ÿ¸B[Î1ã$) 0›/Ô&Žù¹!$_Œìׂ©ü|kw]»ªŠËÌ—7(——êÄ4u‡¬4\`’Âbó ¾0pÝ´D5FJ¹ž'ôÓ\ywZ¤÷ó¹¹Ø0ë\y­\1 «ñý¡xÅd `¨–È[š½@>‘Yõ*Ó¹6K0»(W-ƒ„øZ¶¸»¹ŒíRÖ.¨²­á´ÄÝ”›kÇã¯FvåÓ9{t´Ðz+I¡pjËá 3e©‹j³bÀÓÇ4€“°& ¬]#ø=M[­çE¼+,…J C²´$ÿ›ÈHµsQ—iYÊ'-¸[£Ì˜(xèFºŒ”†EŸs<à€%f°†2|ØBhפZ {7ý{¼;XÌ{ÞuRÿáÏ^ɈÖRŽ8už½%(ûé=ÏTô6–.‚ Ú|6œ>¸žrú…f1Ä’ +‹àðiAT¹°’2|úÃ9_Z*N³ß@/¾ÎÄX'ŸÕÂGbþK×Ki(dñZ’Açéí¦Ý’§ë ÿ¿ïoÓ> endobj +6838 0 obj << +/D [6836 0 R /XYZ 85.039 781.388 null] +>> endobj +6835 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F41 3054 0 R /F58 3380 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6508 0 obj << -/Length 3178 +6841 0 obj << +/Length 2918 /Filter /FlateDecode >> stream -xÚµÙrÛFò]_ÁWÀªÆÌàÌ›ÖRgcÊk1ëT%y€IˆÂ$Œ¢¿ß¾fp¢d·\6‡3=Ý=}wÓjÀ5K#?0Ù,I•oÒt¶Þ]³-œ¼¾P±Eæ«‹—ßFñL~d³Õ]‡'òÃÈÌV›Ÿ½Wß]¾[]¿Ÿ/Œ1žýù"IRïêz®¼ÛÂ?«ùBy7°xÇ ïÞÏuêÝ|ûæ‡kÞx{¹¼Ä­×sýï-Wó_Wß_\¯wŽ.p’!k¿]üük0ÛÀ3¾¿|“¥³X¾‚ãÝðæG¡‘ïÕÅíÅ¿*> g|kJb¡F‡_@Ñ$¹`¶P:ñó<º^Yð!§ŸØߧž8œ)ågQ„êÉ?T ¦0ñ3’z–5´Ec¡ -t -³1Î~›)?³Ì0HoMÌw¢—ovjvU—³£‚vÑÃKœª´gHJg~œD³Dk`>%VßÞÎ: ¼Èm¹¾75ÆÃ÷µ÷‘Δ÷]½ã'Ñ·ëMÙ–õžoÃ…NðHyG>?pSÜå€äTµüýÐ6|@{¤€® Tˆ Õ\ Ú¯$ó>žZ¾µÆ]ļç»È{Ý¢¼IÿhN=ñÏuæ5mI7J;ä-2‡øbø4ð€Eg·ŽôXºs‚í¦l‘¹Çyjv*Ý[}!µö(h…ÇM]î·ýEò µøŒå\kBœzE~"Bi1\}'ð÷õQ@ÑqëƒUò¾3d<'EV¥eoߎIæ-o¼º\ònÒ3ÁtÊJ·bô ­¬Îžê¨ª·èFe=›¦ÇÅ‘åL<^ŽvSÕøÀÙrúÃã ¬wÎAKºÛ6ÄsÍ؉Ú¯›"oí]>ÚVõG„¯økß';; ¡‹Ï™_Í)„ÅxGÃÛk¼hÀ¥Zþ¤4õi{Ïð`<¼ È€¤EØxMÒ9$W!¶º*× uóñ?VikRìýDÁëwsÌqà«òÇ‘6Ì"_…ñ¬‹Ý#`¶QA2[¸ ö׳S/«@6º ÖÑÓ¬¡Ÿ°›|¸wÆ‹RˆI·&ñöÅ/H°Uñ•Ùp  +GŽO$Dñã«3aÿkFI!uü›/zÇ°»|¶zOñ¦à=g°¿±Œ¢uäle€úÀ†¶.—ÈïáƒWéBÇ”ÕÝ‘ì8 ½B¨oêå·¡ê ÍÄ~ -Ê èÊþnË ¹ªØ7±+ñÉÓ®Øãƒ[‰ª9X>E®Û¢m!f'h)Àñç‰Y~®Àé0‘8€ÈV]jSí­î%bç›Ý„«7ƒqHà ÄK”ö#àƒ0|ä±®rÄ·¥z›Æ¾Š“aîôG1ªf‰t6gåƒúº³J/ÅDªa€Ëñ•ÆâD#Õ—`g;¤nÀ}´5gheUñj[å›JÞäNÖ°­!µ(Â(ŠØÊ~’6 y'¡˜"*¿¡˜°·ú@/Ø¡ìN~I1x»É÷Ûbד -ËùH*[[®(ò§<wærçwŽrôQX=¡Ô\e gmmª¥çü}30§¼ËÖM.]×üYX*Àú#gbòv8ú@„ÆŠx*ŽžVŒ·®ÊÂ=¾? j$ÿI‚ hß·˜ ¨Y:Å¢ÈÙ,ŸÄž(îQJÉ’Ž)ÃER\D,&ø”Lkv°õ©)¹~HÉ|éZŒ»ø£…jËĘ(¢»ãOç>Ï„êÖ'ÕÌHJ¢œJ¹LÄ Jš'û×6Ý{>ã4 Ð)+ç °âgåÍOï%y;,rþX|Å^ÀϦ8¤¹ÄNpõÃÍ뛥rÕQ# àúS%)KHkòi{*Æ SöBµ† -Jb[fƒÎ€ Šo€Hšyoö %¶Ë±m )6‡*ïüNî¿ 'Übsû~®”òþ{ÿb2e@Œ¦à sÆò„µÇr]úŠÿDêôD‘9Œ T-j Ý»¼ -`KÞ‰R( C!WüA%*éá}~TbÒŠ<6WZh¨3¸¼ç/\ í•íe\‘p§¨!…Ü涇£>Œ7Ü^Vt{M÷èš"#Ìh¸8î>úµ¨ï½Ÿ1a¢@­¼_ßñ>·Í&!ó'BõÊå5©žqH'I ÈÝקjÃÙOšp>X÷ -ÏKXy>– \zù¨ß×A6¹*’ÈvsÄFþÅëĸ~6Ýà ¬óª:×B\õR¸ÍŒàhïùZ„6ÕHöLû¯ûÉÿ¥‘Ä8Š½s¤QÚO’˜$ñ†Ì(¥ZôTy§W)÷+¯­Qptƒ]™¿ÑÒÐQ–¶ÌÀB–2êÉpܺ“Ò€SˆN½vP†-áÊt±JG]•ˆ%ÍSødÐ)è^b²<á<-ãæ~Y7U×ÞìÙ5¹ÅÞrõß땘º×!ë^«.Ì}ÅÀNÇOm}à½Qˆpw_ŠA÷\@'ž+¿ëFܶ¥@P:’ÿœ>ÂHHzSÚu)úïPÆZcIY°`šÛÒ9iC ÛSOäÇ·D›kPŠ'p:‰6V…m.TèØ Ši2Ì‘‹.½a3&4ûîÆQPº 0¾hÍgüR8ÙC7ÆNyÆ‘cc{(ÜìÍ;‹=ÅŶØм:¾HÈÀ61{´rÄ{èÓ¸{S¯ì*¸ O¢©xÁ¾EuF+W_@;sè ù9G†ÁÁ@.ëÛœÚ[IH¸Óól‚Ñ*[è© Š‡øúˆ£6j™’‘«Æ½™%Üë©æ+™VþQ;bÈp»K3¸Í-[+蟙Bv­KÒ÷eúÎó|n‘ìh‰Ke¤þÈ@½® šKj«ÎLštùZgiÔÔuFG[ÒKžÚk€Èóö'0Ÿ3¿3ÔœõÈM_œµ½ZRøˆ=ûs!®[û{/~q.zW7k,{Â(é†_îKC¦‚/]®m¥]Z‡FÈ«’ÿVYCðMCìèôëeñ¶DI‰Ž#ABªÃÍÍp6xnÊŒ1j?2T¢=-Ù »0õkð׎;b%%ò¡Cï}a3H¨÷]÷PøöÉE19îDŠ#`iŒŽFnK©7vBÈŽÛµëdmºòà¸TC"Q‡(ýýö5À€„œ‡¼¸\eÎÑÓÓÝÓ7ä.øç.’Ðvüt'®í'Éb{¸r;ØùíÊgØNâÖëõÕÏ¿†ÑÂuìÔIë{Yg_¬7ooþXß~\®|ß·¼Ð^®â8±þX&uóßÕë›O·K×ú·øq­wË•k}‚Áú# _^ßþ§o–^b}^¿½ý°~÷÷nËšÀ~‡–_×ï¯n׫À")üvõ嫳Ȁ‰÷WŽí§ÉâcÇvÓtq¸ +Bß_æåÕ§«ÿ Xx/Xð©9¬/²½¾c'I0ãú¶“âD +pg„õ—ãÆçL„v†|ð)nÎ0™ÁY»¢®Tù +ÿü«0aj§¡ÀÝ´ËUà:VÑÉ ‘ª +7‡'µZ÷»]Þv4¼†ex‘n_¤ÚâF]áKu°ÚÔå +˜ +ÕŽQ:ÕÀ΃èö9õr§2ØëKYS)uÇã €ÅV^T;dh±bV.>RJœl›¢+¶ªøijº}¸hÉœÀ˜99‘»Íñÿ¶å½ºás÷ª(¤‘3õ½à3ðô-m~À’:K˜„Y¡ @ú‚Q£¦ëóæ±Ðä`IêYïrGh+¾ð+DyMü:VÿS¨‘Χ•Ê'µŠ ­aÞx­í·KÝg‰¥xQËq Üq턇öúúŠá³¼Ë›CQˆx'·Üó½â,¶Ä±ÚNѽ {*Êr ‡Ù§k2“¿uæøˆ¤…±õ¶FžOˆ2Ä! i)éYEÅdž§rBKmø`¡ÚÊ=)À)â3O2Í6èmãªèrÞ™×-`B¨éEÓÑêÓN/;ŠN¹Ö#)Gßò:œ½|߶ߴù·>ƒZùq"ë,ÆbX¦i.Z‰Ÿºh¥-Ÿ?"\ã7ADøÊZœ„´5D0zfoèúF¦Èö›áú#]VWƒôg¸DõÒdx//MÁŽ`|,QèÅ`:@,@_å|Œ.zR‡c9GŠ¼4¶ªTè/·ŠiAÙÀÓhÓ>¯.)©»ÁFú²°ùt“ƒhª¹ç¬ÙŸ²ËFq­,D‹1j+> il‡~°XA8öÒðï#ši>žáŽgDIDÐQãÝo~ÿxKò&/ëz8…8'‰ fM¯ŠžÔòæ>ø1JEmøùÒÙýË Á·& [.µÏCQO| )0lÈåiW槎&@È¡·=r˜ Ý)Ä”·|^áåÃî +ö ‚ºÓ,© =VÚŽéGó¦ÍKOµkr…ö{`AŠlɳp'A1Õ%CÖÈßßðÊ^\GÞ‰÷ƒý$ 6ît{ñö:q¦d*a‰”væúÈ=†ƒIãÖpm«iÕ„ê._*v–—ÅeÆ}*º=Úo½ÒŠʽ!Aî 3 ÜPõY »E«!ˆPÀ¨1 £0LO (Í™¤B^Ú¾ã‹j?ª²Ïÿ­¶äP.s¢8°½0Ø®f2«VÒ'ß]ùAjCÖ ÉŽüˆN|!ô®àe½¯ôdÍã5Û¶¿Î\ï66±·9‡Šë9®;q“)wŸŸÚIT¡¥TO¢å:(¬Ý×h¼¥VFxÃ]‰w£×z\†Z¸ÏéEfÅ%vìz1aèÏÛö_,‹ú˜WwyÓÈ´}>lêÒ\Àdi›O@Ú.? ›þžg—Êy„´å.Ë«"ÏXõÝÞ8»mò쮨Úþþ¾ØyÕ`Eu_ßõ•z„x>‡RÀöªúTɱƒzêš"×ÌUùé1.Ý5ù·†í¶»ËŸŽE3Õ‚D@A^âƒÈH)Ÿ"᥷ª¾;ÔdÔw™ê”†©«Ç‹[Ø‘iJG #íÛú˜½Ü)ëíÃݦoŸç¨Ö@YѪ ¡vº ‚®y†¹*´ä i/®±oê¦;»i`õòárú Š¢Ñ —ÁA–ß«¾ììï`dÄ8ÈJN:ž‘ÑP†™YÍ™}&žíyÁPÙ…Ž\J1n¦‹ì8Òæ¼U_$ÕN"]ndrwÍ L€Öiz9Ò ·\T0Õu+(ј1!°çì¹7½*aU‚_5¹$~b§©gªN…%zx¥±B +ºò™w²Cñü³!Á©{1”ÈÉ õ‡çÚq艄´½dØi0$ä;£ q¢ø‡s„ºÈ,t9»\ZuùŽ²F ×ô‹òJ2cwÌup-Åub‘ÊõÃç ±íÕh£©ŸØCý ƒ ` XùR7 t^ w©iI¢Ë~4‰2`äé % ¨×Lhq %JË#ëµ$[Œõ„£ˆ*¥|˜€»žõþšÏÌšÚ£~6È¢(£vTË¿¢ð‰(ˆ“«Ác˜QbäR‚ ,‰uÚIl?ð&Ò¤ò'“¼ÊGŸµ§\ИÈF•?Ñj`½çŸ¡Lˆ¡Ø2k„&â Û¾iFHŇˆ&ÛŠýV¬ƒtð´Ôp¿1—Û‡‚J)B‘gøPK¾^’\€y™âZŠëËè0ÖEþË)²—ÒÇÉPR³2”õ‘×ÿhöò„Œž i”ïÇ;è2€Já„: ©Ø#/ɆÜ‘øÖÐD9 D|sõ¸Îè‘#TGŸÕx¬Ïc— +|Õí[žé\¤jZ¶ýXΆabý¹g)%MìXGE)tÌž©•$]I:*u…’WY¹ÐvQÁS­œiPnuø†ßBÔP¿µ/q Þ[lú¤ŒTèÀÆ˱}^ÇŽ•dºvèÄ?V·”=î\¯4HìÐÕ^óOÓQaWrâSpK jbòϨ¯Ô Ã%j ]´>ÇÞjjtG_’ðOÔ"uÇŽËÏéÒNu½4Q‡DÝuUëŽýž°6É5u X`߬'ç‡EBÍ‚Y,˜)„Å£X³@ê"‹¼ÙžªñšNCp¼TÈ¥VcGAòc© ÄÛW/DÇ@ëËš»oqp‘—ÁRQ‘;Ñ¥;†,8î)åâ`,¾°LŸêDÎçÚ}MÚ‘ñÃ5Pâ‡OµÛîJê?$Lݜi0;n!2Z‘Ù\Œ|Ý åžñGŸ%ßòä%G bôD`,]¦íø8¶}Ïé1zÏ´Uó¯4”1UˆRþä!ÐX2Nu6<׳”h ª;F[PqHÑ¥ÂÙ¶.¬é!ÍjÛ0‹Ó¾.Gs’2ch“ÌBØnúƒùNH7g ÓvKÞ~Ç-D²CÜ |‡?Ô€Ï{âÁà°È“"„îçûâN‹L/ÀÏŽ·‚Ü+:Ñ™†6h·|Æ`Ä‚õ\}‡›ÆD—¤ƒÈ†Á왺1|ˆ¡ yàžo†œ(ý¸Ü!•ªèÜw›Ýö¸¾x€èwæ¦'õÃœšxPt§ÞÄ_zøÝ"/KŽß·RGJR弯²Ém×è„Ô‘D·zÐhuC'äT—ü¡ ¦FÃiËN³ÌÑùÎ!@’6“ÞhA_|ØïÓ“» ?««¿˜ÀÀ §fuùsƒëjÁ!·Ú“|gJjž™É.¨ZK¹pÏ¿p :ª¨kŸétÄ÷\úÜGÔkªÁɦ‰2× èHsþRCVhôݼ5MÊçï¹Ðö}Œ¼€®(žr±{/}5ñ‚Ðv£Dš é?ýlâÿÝg“OŸß¼¹Å¿^øtÍt‰g9Œ”µ½Ô ËMS;v4a;ñÜù?¾ûgÛàǶ;¶¾ËT 焺‘íGÁÔü'Zs~endstream endobj -6507 0 obj << +6840 0 obj << /Type /Page -/Contents 6508 0 R -/Resources 6506 0 R +/Contents 6841 0 R +/Resources 6839 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6510 0 R +/Parent 6816 0 R >> endobj -6509 0 obj << -/D [6507 0 R /XYZ 85.039 781.388 null] +6842 0 obj << +/D [6840 0 R /XYZ 85.039 781.388 null] >> endobj -6506 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F41 2994 0 R >> -/XObject << /Im1 4096 0 R >> +6839 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F58 3380 0 R /F15 3032 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6513 0 obj << -/Length 3331 +6845 0 obj << +/Length 3041 /Filter /FlateDecode >> stream -xÚÕ\[sÛ¶~÷¯Ðt&Si¦Bˆæ-§v.mìøXNN{Ú>0–li¢‹+QIüïÏ.àE"i»¥ç¨ã“ÀÅb÷Ãî‚ÀŠ÷"øã=«Y$“ž±œIk{W‹£¨w5¯¸o1ôM†¥6ÿº<~{·r-ŸÑ$Ë\ÔsSfì#¨_º8v¬ßB?¦¿Z»ÀÞ{µ·EÄ›‡ËIbD´æ“M#˜»PKÌö°À¬m”j\-BÀcEO'@„–I•«Ï³}¡ø•hv€åV¬)a¹Xb°ÉÝÚÃ6 Øt"C¶t•Ø&ØP¥6 ÓqBÜræs† ”ÛFäd»@N“ÂÄÌ(]aòéœheød©š Ó…:1Çe{cè¥9Ìçøç´¶wËøâ–ÓîËÂ,k±>9ý. Ô¬0Š™˜W˜}Z?úPQäXê@Oà¼tWHR0ÌH4A ÂPàCkÎâØÐgXXì®`µÛ„œ‚^ÐiãNÈ^¶îžÎúÔÇ__ "ÍØ…H:~’’Åæ,²LJ†©ŠZUÜ¿°,õÐ*Ûø\0‹ñ^Áï?qaðWW®Hú ]/O˜‰LX9wŸ=4ø`Ó€ÖýÔÂµè£ ¸¶q,bÁ$„ýeŽÿ?F´M]â½o¤™ÑI˜ Ò‚÷fíΞú9jgvEß#y»n åŠ.ºÀRÃBó¿Âð_[J>Âü‰¯Üw 'üÞï¾eøm™Mý¦\,±÷W#ù­Û lo’?d¿­ºÍËüî¡ͬ¡èìl’½ñ+÷ÜÚå@Ûʧ[È -›Oþùã^9u"‡Cö¦Ê·—Ø!PÐ=e¡µHœèÎÝþÚz³Z‚iBOA´ ô´±(t¬™ -‹‡còj!Õ…pØ¥ªX²¤is˜c<­„Á‰¥çî Ií Iô>ëTtѾچ³(’†Ÿv9ñpqäˆêBíçLò¸)Jƒ ‡KÕSZ±HªB†«›uºh ËJ4»ÀP‡V¢ 8‘2‡O‹¡¥éÚŸ¨8%“´­! =èd”,ƒ³^°9»ìA»L }‰Æ}wË !D,²´«}áv쮼_hÄcAµ <¶ñ( hHÛ -“O‹ÇväÈéB‡ìÁREF6êÅ8FÄ`Íh?{4YŽÝÙg+Á4ᦠÚnÚXÆ2 j/óøÄv¬M9lºÀA»¿È2.#*ã /˜ÜcükñSï?m¬ŠØ’Ý)x}øÈŠ ç%räg)¶êB(‡ìÃd¢7¶ùÄ„x(3¡dTÛÆmïÉ€ÔÊ àÜ}ç*3ø ¨T}@µ{Æ\ÃúÛ<žÍmãÎ|'Z:`+mÄD£‹@9«˜Hôþ¹+ÞŸ§-›òí.ÞÂ(.:-BeFŸßC¡ÄÐ%‚†P‡Ëß!' Ô[ÇD& Éÿ^ÒWžÝ&cÍ”[Sº¤'‰e9+Jk—×tNùî$ , ûé’*&EâÖ•`š¦F`«ïŽË'æÑ©}G²©;OîÞw´ôô¿ B¯[Ï -å£dl0´‘¡ ;ŸgµãüØ~_3Þâ‘~ì$Ã/mw:Ãhé hÉw¹¥ÀÉë½ùá&ˆ ÖNZË¿—Ÿåi KÄê‚&Á+òíüï>Ýnî7Dzv‚I Ù´š‚ãJó̼ÓàÒ²î觯ºÀi»7fŒ¥«;s Õ>fa…Kj(ùä—s<óòìx—?)ü*ß{žT;w <÷­ªFÉRBaZ ªd.½õy‹”2>6ô˜ÒeJþ™÷o|2ÌÑú{Ä¥ûD»ž,¯|E¶ò× l¸ßÇp'y’¥õ Lp†°Ò¥·¹<§å U­Wé"؆”/÷„†•2Zæå$%èoæé¦!ñk‡Ÿk—ï9vinn뺙…gX\ -•J(ÕSY'xÌSmÆùæXø1µ™‡=aÀŠèšÐëÖ4Y|¥óZŸ©pC’¤ô°5fj%QaEÐÎ!ú$ž.ýcn¦ða–¥¯!yÏM<¨8{O)¿xÿÉ[÷° ã¸"ñ9ü9é’@Èc:ÍÂœüºže~.–gô{„G6a‹ÍÅÑ%Ý)¸ªœ·ÆÁWå<…”Ì #hä2ÙÖ¥¬\OÂïÌW73¤#uPÊ‹WŽ9V“…ë×®!© 9™Ki´Nôè´ç“EÝi»Ï¡›ªÞ¡èÎq¿¥‡«Õvî9Úg5Ù<¥êÍ)ÓUPÅä[º¸ÓѺdâgïÞ¿~6Âlí‹ç¼ÿÑE7u± xQkñð`¦*½<Å>êèZ<µöˆPý¸äQ¯œ&jR3a *E*ö#N|€ú±ðšp¤ÆTâ¦.Ý:ÑŠX–² ©‘B ¨Clƒ¹rßoè‹W _áÌåÉ^¹£mîUìrYâצtq–a=¡õ•wóXAÖ¢’p.bÞ?ÞIÝæ!YyÞ·O¿:y•ÀU >‡P¨Š¶5j«âôV¯:)`é"àQº@„~JGee}ɳYëò{ñØ©Ñ<×êL½Þ]Æ[6A’Å‘©@Ì3qJ¹Ü._Ç•ÑI“fîËq>{ØårÚx’ …]†—r׉r'U_Aeh,0ßлWxcäJëE5÷1­w‹!|–<Ÿ²äL]¾5EpPµ]R)=¥tÏòS?°4súÍèaŠ¶+zJK7*¼sñB¹êt„W±ÿ \…¼WìÜ—Pô0YRiþ žàþHßÍ–!ìùöüÃÙÛ_öýØænC D‹:ßrž&*-Âò!swúÄ!ãÝÊOX›û ,¦¨(œëöoÑ -L(ÚÀ‚”Þ¬IþÅÚ½ ÛnBPÊú£2Yí§ÅôÚØx1»Y»ÿœR›Š}O¶k*?´±=üé¨!C9xô|ßέ\¸¯ò²'†\yMº„µtR¿d½çƒßã–¬J2+ö'µ€•¼àॎöVÿþ÷LöþhZendstream +xÚíZYÛF~Ÿ_!,€,šÍn^ æÁIœÄF6ñÚ +òàG¤$n(RÃ#òûã·®&)‰žl6@``¬fÕÕU_UWUZxðO-âÀõt²ˆbåê8^l7Þb#ßÞ(™á-Œë…}¹¾yúM.”ç&^²XoiÊ:{ë|õݳWë篗+­µãîrE±ójçÙßW_>{ó|©œ¯qØÀr^,WÊyõkj~ùÓúù×¼úÙÒŸÖß=ÿaýâ+{†TÖ4íGXñÃòÝúåÍóõ„Á•qM¨‘Ãû›·ï¼E‡xyã¹:‰'h{®J’ÅáÆÚ Œ–ïòæÍÍ?*ê_yÊ™²TèF¾1ž†v:×tTuÇ;à-²Œ÷-±—áPìtµgÔnÓ ‘L¦[± ÀV¾¯\Ìi*· ÷æ+ß,VèFsð^‚–FÍÀòOE—„×/¼$ŠCfBóLÀ–fVWùç3ÒÕ˜‹Ìy~Z+äty…¢qßC™]+/LÜP%ê.r«ºSreb° "Û„dkSƇ8½ÆÎ|#{#ìhYÞŠ +0 “«ôíÇ•xˆrJ~4ìJܤYå7þ§šgÈN®8ˆ‘¬H.x¬±¿©,S8FÓÖ\Á™¦G=–8gƒkà uµD1㹡ùÄàÓämÞÍáÇ`˪ø«2O¹ŸD 4Kl‡‹ñP7üõ“€„¢¦.ŸŽ‡ƒv‘Þ¥v'ˬv± µK´e õÔY–viQñ(ƒq²!BC€èDUþ¡ce¶´Oû Ãȸ“6eltþì<@~â³1«h^À¸öD +Æ ùèîå}NøS7YûùŒ*°^£‚AG÷}ÑäÙËUàüÙ].ßm¿Ý›"¯º/æ,5NÜ$VBJläÒY+7kWìýˆ -Ï`"r#å˼'hup=¥“»”d£“ÈUÞ¹cM+–+²ÂO0H¨Ö!ÑŒÇÁ[v"5-öBˆ ¿hÙéæ-R;o]×}œáUùÀtÓK¾´áŠ^ï-m1÷´‘…©PÜÖ%òU#$N¬œ+C†°-ÑÁ§fÈ ’µàw«¶m&Ò,„{ôqW÷ÏÞ Üõ oÛ~³ÉÛö.Âa•Ÿ.å+åaýñàP»F‡³¡¡Œ<~ú´ïößTÓýÁî!þ öégƒ Š]U7ù-ÿpW–¯Äq dꉶi_v·wiönNu‰«ÂP6™¹UbMÔèf‰?A@¢›š;VàÆ¡ž"Ò÷E$ Ï#ÒwMü!D7ù?$Ï ún˜3Í ÌŠü¿eÈô>ETŽ—åÌÁ¢ÄÕ~<¥ŠMü.i|˜ +Òðp¸Sdb´þQljÄÑŸÁfôìOØ$YpÄ7TäŸG YÎdÈÎÁ0ŽÜØó? +C ·ýÃîG‚¬@¹ÚLAˆQI~Ž? ššÌG|cè*_ýA߈µ¦ÿ1ßøûHSZ»áÒU +œœ0f_ö\jQ”]«ˆF£Bg—O:SþÙÚH4/ÇŽº‘…6ý…ö‘Ò*jœ&%+"L©†`ÁT-4â!ƪÇŒ×5æ(j,zå<Ï.κ´ídoKÿd Jøñ@©KÏ í±‘QÔ|]‹âŒL‡ Õs:ăÀw~–ÞØù¾ &{ŒÒWȘ­[‚Ùj¬3EñXQ‹<óëºã¤ˆR¿›²Ü2~©Rµ[2/ÝÉpËdH”©|lLÍ$ãÛHe‰Räx½çB×ÅñÈBá µ×‡¼ÛÈáŽ{»=Uá uH9ñ£é ê”+™,¼+s^°­žòÐ\º0Œ(Ú®?©V7B‰RVÉC‰:Àj®   ŠD.Ê×gì[{&iØ€Ml7iÕNÁ>¬‰452 +½D·F„k8_u‰¾1÷Ãq2¤jëHÐ&¨Ëbâõž’¸òFŠ|qìá8:ä’‡¿gn ˆ¥O:êë”2iÃ÷ß!­$¬ v¾Í«¼±® = ÓU`+äôz)\3‡Ò½6LÈ-ù–@æü8À+¨P‚–¯byLÁè£8`ð%HÅxdþ˜Ø(~ž+ ÝÈà…èÅVø‹açÎã'£ážØª) “%w“­Ó¹-ŸÌ‘)IŒ(aÃi?žwäզû†@`ÄÙô<Ø?sÙc°R r‰iòÏ-ÿ6’ÕÓy‘¤ANMÑYz`$oÎgÞû뉳x°IhYïЛhtãÈ7˜^Ù0$㎢.J=¼«ìuê<Êóæ‡á–œÃ^<ŒùfuR¤à™›é)ƒ|Òx¥8ÿ˜`¢0ŠvÏ-ò(?ÔÒ¦ìíã2Ȩ=¦û— +†c:úMíﵓ#CKÎ÷춦 2›ôÒkpSãOEýƒ››!Ï 1`¸ÖW{ߧÍèÊï°=}…dMˆ ]~Îú½ƒÕ[þ!ÅkzîVÂ?ÈñÝ$ŒìNXLK0㛼 êðë˜ÞÚûÒmkîéÛ¼¹E}ÊÞß÷9¾îòDì¹=¤YÊuÌœ.»»ÍE–%µÎ·Dä¶ÍKzû·[¼¯(ÔÃÏmƒ¾‘*ÕØa•wïaÂo…¥×€­[_nHŠ*ôn?ëå¸U6a»n²ÛWÏÞ¼ùùÇ×_£Q|v$«8Ÿ)[Þžò»÷Ǧþððî*ÌŽëû1ÍCWi5ÿ'["‹?÷Q:rU<ÈõÑPZGú’QÂoÎÃó³£Jzendstream endobj -6512 0 obj << +6844 0 obj << /Type /Page -/Contents 6513 0 R -/Resources 6511 0 R +/Contents 6845 0 R +/Resources 6843 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6510 0 R ->> endobj -6514 0 obj << -/D [6512 0 R /XYZ 85.039 781.388 null] +/Parent 6847 0 R >> endobj -6515 0 obj << -/D [6512 0 R /XYZ 85.039 665.892 null] ->> endobj -6516 0 obj << -/D [6512 0 R /XYZ 224 671.866 null] +6846 0 obj << +/D [6844 0 R /XYZ 85.039 781.388 null] >> endobj -6511 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F62 4047 0 R >> +6843 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F41 3054 0 R /F20 3021 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6519 0 obj << -/Length 2503 +6850 0 obj << +/Length 1855 /Filter /FlateDecode >> stream -xÚ­YësÛ¸ÿî¿Bs_BÍT4Að™™NÇuœ‹ïbÇëšÞ\n®´DKl(B!©*þﻀ%JùÐ^æL<‹ÅoØ…Äăb’„®'ÓIœW&Éd±¹ð&+˜ùñBhŠ™&™Y4Ÿ_\¾ £‰ðÜÔK'óçžO衜̗¿;×ï®æ7§3)¥ãîtljóæf*œÇŸáÏ|:Îh<0ÉÃÇ©Ÿ8ÞÞ¾¿á»«û+úhnîpÝý|úÇü§‹›y']·/H’¢h_/~ÿÛ,á?]x®L“ÉÚž+`zs²¹a u¿¼x¼ø¥cÅsÁ„W!ÊÄ y …G =7ô‚âîq: dì|*àÕRá©ö Ž%Žïyß.ÿùÀÛÔgOe®ç7S†+^˜æi:ƒNŽH€kg‘Fn"Q\Üôý4^øg²’W dõhùzªÇxp -Cñ±c™mŠj5Â0n 9ª<Œ+>H­pœoÅ}û¬<²/ʲ?cìÐpê,²Åzk ÏŒ%î;„ñd&Po)íX*g‘•å Ñ'0…ÓðP»Î±8Ï(@Y²:Œh8Q›­VEÓÖšÓ$Ëu§h˜rQ]Öö ç5#m`¼ œÅdLr¾ûùæ·?߸¾zÿçÝÕõ»Ûû›ÏB¿=ÎožÛ}Vçؾ+µj`;Ÿ -04ÐÁpèzW×yÕþ#¯›BU8BøˆØ‰?@ÎXªÓüð&/ó6ÿHJY]g‹uþÃ_—{U/_{üŸQïÌp•žë%|–ÛŠ!Ù¯‹B´æî‚pi”¿à%Ž4kªR/ÑŠÎ-j«MŸ¶ ÁVg ÈkiÀÇ-™@i©ðÀ;ÔŽ{"tDR¸ÂgCŸECþî{è2ˆ,<áÆ‘ H ÚE`ü€»s­643'Š›ºVSé9usJÍæ¬8=ÍÉðFÒMBÖûü„Á¯¢¬Ö€““¨&n ø-,)ZÊkrÜš¨/q¾VOS6Íå×»[[ÐÁµ§òÁOˆÇšÚÈ£xºS(¨R«.#.ìvËSê ƒÐM¢ø,^M§>á¦ahãå ×KcK}¨ÃÐsó¶e´@ƒ»-)œapÑã[R+Ç3cxô(ržAå€Óý{Ç3€düyÎ÷zƒ&¯_é•l+<¾ªÕnû -þí"qãXžÇ¢§9i;A:|u}*ÐyÀ§ßwšlƒŠÚÎfx aòÝo>|†bèé áhñbJ >œ®D:¬ûJE¯Z@yÄ—ìjW÷g5‘V²aëÑ¡‹àì–‹s}æ]Ó!wD„tYp`ÅG}¯QEi$1u>'Ýt_÷®6eæHAÌ3:›Z4dœ°k~¨/OvŒU2>ÜOxÔÉÙ ÍÑŽwÂw¥ð;^iD¢’¾ø -w¦TQViеÍûPT³ñùW/‹æ Pšè»@Ù°ê`Çq ¬5PmÆgd&µ:mf莶)·¦êÞ <¹³ÆJµÆ[tFU«}ð¸çzqzÜžæ ¸šè»àžÙ°÷`Çqp­5¸T|aÓ1HIJ»õ»\gšµ¢´9òj±á|ue•ò×»ªÏ©b+•<¶ïÓ{ÌY°{š“U°Hc@`Xûº -¾&S€<÷žnç]µÊ |I¢®ëᇣZx\t.Ÿ¦ç‹V‹ædÑ*" !{¥…S†¼Œ:6ø}‚ߊBëR‹ŽžH^cÜNœ1[&âKŠÖj¿y!D0lw÷gxX’"³Vs²ŒҪͶRÉuÞkÞñ.…ÜžÚ8'”«¢«-EjdžG°Æ‰õ‚ÊýkGÂÒÄ –Rw×Õ‡NhzùCòu^n™ÕFÜj>nU«Ÿkiû¦åé½Io‰f]h1Íë“Þð-Ö_ø,ÀTZ@·ÍšÑ:ŠôŠþ…¨ V%¿®Ó1KZÁm -SÂIòu&öB²±b1¥ð=³nÅø©•]âò "ˆ©ÖED™ò®å6Ùܮ҄•–¬WÑóŽëVåCqíMVÁq.?¡?tÛjXï欇ôÐ-x5RYtï…üž«ŠEn=Ÿgu~”yÄ©&á$NÜ$ÀšbÖ“tAèøG$"¡ß0 O[c ÙòæH pˆàœ†äPáE¦d1–$·XœûÎă(*úi¾unÊ>ì}Ñ.'ȼž 'kyzð -ƒ³½PØü³]«föw¡*^lv¦Ÿ¸yðBDòU\±ëËÃKô0>gé¹þ(Žð?3úŸ~rë| ÝDžPF÷–/Œ,(¸<¾ÍOsGÿ3ì̲endstream +xÚ¥XmoÛ6þî_a´ 5-JÔ[ HÛlm±¾¬q±iQ(’ Õ‹+Jñòïw/”¬ÄrÖuX1SäÝñîøÜÃcä܆ÿä<ô„íFó ” ÃyRÎìù5¬ü>“Fž+aû.=[ÏV¿yþ\Ú"²£ùzC"ëôÒzþòìýúüÃb麮åxb± ‚Ðz¿•uöfùììâ|!­¸¬àGZ¯Ki]À`ý†Ï>®Ï_°öÙ ­ë—çoׯžãÚZY“Ø;Ðx»ø¼~=;_\*¡|=ü6»ülÏSâõÌnÎ÷0¶…Œ¢y9Sž+<åšïbv1ûs°ÂkjÎZyX*ÇN×a¨†„Ho"!mÁÕ }® ¬ ²:W×0 m«Åµ\ㇴ’ºÂ€oð Û¦¤õÖ#Ǻũºc# Œ+6“ƒP•]Ê;¡±OÒU—x9AÅmÜÀjLzmÖh£Yé<ÍzgÌ@“ H79nmö«”÷Î7,×;§€©—˜¶ˆbÞçz‹gèYm¿¾…Ƈðx2fôõó#žšò•¥ÈU ²·0ÏÞ¢§7ÝÆ-öyQ±Enòñþíö`/n®;ø*ÍIaöYq‡®4´ å™Ò +§£×Ûº+@4ew:c¸cœ(¾úMÉP¼FŒ–Šî ÉÊóÌúå#¨(¥”õªbëu;à«á™=9Ö¤ú)ÛrǶ–¾®¯Ã®ðÝ€m +ÿè„ø¼X:Ò¶­åòW°éžE«°2á™mìødçŒÒv Bß*;~p2d¼+ÆEšCF®r"p˜+5dØ‘3=9DÀö)W\Ìŀܵ£ìAÂœHøž;Fe‡s}—w8Û@›L*LÀ0f˜Ð›ú*¾Š]õ ¢€¬ã«Á7Ϻ¢É”'Ö,‚A£Ã7PLW×W³IÈPG¹Ì†Ð† v˵nÌÆ\|¸‡«g´_×Ç¿œ ©„Ë[÷f;L¬ßû1d_r‡AKÄÈðÛ“˜ã{c€¦O °´Îy«ž¡ð %Åî{C-ã“mpcƒ9€ÊIb³‰É6Ë’ ž±9­š„’¡²ïxÄ]&‡Ë±d +©1oíæFcŸÈl×Þ¡°‹ +v•È¨žª!ÃÀÔTÏý’—pÇÐZ/AÎWá¿w§®Pp¥Nõ¦feàwŠvûôJèz¢xÁ;’Fì˜>¥ïz0„F§éÓÔþÅÑc†žt\—àÆÕŽ®M·Ë¶@‰xNžja;îÃÍ¢ùË‹é±û~Ñ\gÃÓ”^' 0< °I*øž JÒµ[S×’vô,x•®ñïܺo”¸µé›…çãs%WE¿/½nþ¡³‰Ëaóψ|ô‡iM=q{ð„ÿO««¼Zš‘¸¬¯ˆ@óö¶ùè ‹0†²‡â# ÐÞ´»Ù¦üò2oõdÍ&»/Hg¤$m£ÔlkÝê‰Ý6fËã2‘X&î‰?È™úüïròáPë¢É ÔqÅÐ챃ÿoQ4endstream endobj -6518 0 obj << +6849 0 obj << /Type /Page -/Contents 6519 0 R -/Resources 6517 0 R +/Contents 6850 0 R +/Resources 6848 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6510 0 R +/Parent 6847 0 R >> endobj -6520 0 obj << -/D [6518 0 R /XYZ 85.039 781.388 null] +6851 0 obj << +/D [6849 0 R /XYZ 85.039 781.388 null] >> endobj -2246 0 obj << -/D [6518 0 R /XYZ 85.039 631.121 null] +2314 0 obj << +/D [6849 0 R /XYZ 85.039 591.042 null] >> endobj -6521 0 obj << -/D [6518 0 R /XYZ 85.039 590.958 null] +6852 0 obj << +/D [6849 0 R /XYZ 85.039 556.902 null] >> endobj -2250 0 obj << -/D [6518 0 R /XYZ 85.039 545.867 null] +2318 0 obj << +/D [6849 0 R /XYZ 85.039 473.792 null] >> endobj -6522 0 obj << -/D [6518 0 R /XYZ 85.039 511.727 null] +6853 0 obj << +/D [6849 0 R /XYZ 85.039 439.951 null] >> endobj -2254 0 obj << -/D [6518 0 R /XYZ 85.039 222.087 null] +2322 0 obj << +/D [6849 0 R /XYZ 85.039 196.471 null] >> endobj -6523 0 obj << -/D [6518 0 R /XYZ 85.039 187.947 null] +6854 0 obj << +/D [6849 0 R /XYZ 85.039 160.206 null] >> endobj -6517 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F58 3360 0 R /F35 2976 0 R /F20 2961 0 R /F41 2994 0 R >> +6848 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F41 3054 0 R /F35 3036 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6526 0 obj << -/Length 2864 +6857 0 obj << +/Length 2220 /Filter /FlateDecode >> stream -xÚ¥ZYoÛH~÷¯Ð[( bH6ϼ9YO6³qìI4È3,-Q2aIÔ’Tï¯ßººÙ)fE°êîê:¾ªjÅŸyðÇŸ¥‘ë©l–¤¾«Òt¶Ú_y³-Ì|¸ò…b!$ ‹æÝòêÍ/Q<ó=7ó²ÙrÓí¹a¤fËõÎû¿_ß/o¾ÌJ)'Ýù"IRço7sßùúøg9_øÎ4î™äþË~ºáÛëÏ×8ôhnnqÝçåü¯å¯W7KÃ98ɵ_ýñ—7[Ã5~½ò\•¥³gh{®Óû+àÍB%ýÝÕ׫ßÌV<ÎxÕ˜$Â(…SÒÙBynš†£4IæFißÈs#/4Ò -¼i JëK•ïK¸âa —ç8W¾S£ˆª?=?ÜÁTѼ=¿¾Ÿ€NT2³Np¤i,ù‘Å’ŸÄn’ù=ž®›ù" <'‡Ÿ9§¦@~jîíª­LWÔR V<Ð>"·Ü>-Î>σĩjêí¹Â ÞgóÝî…gœii »æá#ôëN$¼Y)œ¬ªcYa«™²Ç7[Ä¡&`Ê>j:£;>ãÑUýÔ´y[ÂMòi-~7x§z9ƱÎ%Ìx¾ã±#rÉL.ï9ËGdÊ,HUGL”°bWðÎÏ%ÞeÇ#m_ÔMÉàEz‘gD±ÏKaÔ0Ì—äÝÎn„7÷zw^£¡ÑîO°¯ËBÐîa§÷oóȧGžcÎÝ–M[¿0ùžB£/L%{âºÎ=æ‡-ê爽¼åÜvÇ{° ɬˆŠE-[ž2Wñ÷¥#ü樫=mƒg”Z+ Mak]ìŠV È’DD‚@ñ!Ò€-W´—Ëv$n(øf`/ŒfK¶!€½Ôòš pà ‚MÉ…çº2¶/É£Ô¹¯iTîB;ôüð"óRÙa…^‚ÎS•+Öò:¹QÁobp[ðÞ)DêH.’ +÷ˆ?EÍL ¡¡ù"0}Áž¾`#PyÚ#‹æœ½ÀÝÀŸbO(ÎÙë )ð37ŽC›?ÐYp¡%$ B›—ãÐp²´ ]ÏÔàÑš8SâvÎ ºt{9ísvR`@¤rÒ¦Òdqdìlk¶ThP€zbB I¼å°úHãî´"Рmù³/öhæ*ÂØ0–{ãLxʇwLR -iC£G -¬ŒÉrtÊ:ßL‹¿44Dù11 5`]í„ų|[DÁéÒ÷²æÔ…cäÞ‚rÉ_üˆòLR­®‹aøÌ8üX.‚-”Ò·ï¸Aî9w·¢IÒZŽ9Y[é @øTD,”²éIç LÊÈå3Œîòù a:§š+ºŠá°qGÄò 9 -ÙEA'ÒmÉöˆ·?îÈ_ ’Z†â¬ÎåÈû}äag—ƒâ`$a±“ñZGnÒMá Å`c,@€ÕD^âüÞNñ~m—X ÝV+®ÑXD¥\’r$+da%Þ"P´s®ëMˆ˜‚Ày¤¢­ªŠ¿”o¹-V)39?nõpb¤ S/rN^³ä´ã &ŽD¾AK=•m#gnx~SívŽ{†š*·”AÖùaU Á¥äKÚ>öå= *^cÏ€oNq4ö„ Îªž¶c ø%YÀ‚F _§«4I5:N×Táa„ÐLŒæ±o`WYþ•ê1 š>óý£m™ã: 3Cgéeܦ@‘×J%¥jî ÊÝV"!Í$Ìu"«ò¸#–ý÷á©ÎK0'Õ13·ó·]!i*E¡B§ Ú[\[ß|«[œæ´ªjªMûJžSR@ÜCÃW©±/¯Sø¥ Ð! Û¬©ƒÂ{¦-e/½¶_¿Ñ)ô*“vOLÒ¥§¦”ÓüÞâaܼùq–Kà>_ qáö‹È' Y0â¬í*ÔR,?™qB<ô¬XC”Ø:HÕ baÕ =µ„V´VŽ~Ÿ:Û§»÷ן†YŒX aW‘Þ^x|2å¦i0ùxnÑPªúvªîù.DQ³²L$ƒÂÀ‹Ý4J'Ô4ƒûŸÊz'~D¿ÌB¸©8õöÝ€A*“Èš™$an¤/z¡Iå³~^Ë# ÆƒP⪙¿>WõÞ¢á·ð‡2âCj}hZæ@¤ì¤ý݆v×Ïð/è8Rn Âiw4:¢ŸêxâÀNÇg'ŽëØ:ñF\ó…ça(„Á.#NíføÉ_2ï K§ õLûJZ ﲩ-ã×’yÓ›u÷ê4?±J)¥@³LPÍé;SaÂ"PêÌ$+¦LR¿VRÐôç..w ?]ÑUuaK`‡CÑú5÷zÉ¢’ÜñÍ< ªa‰ˆS˜"«}õ“óSÏMT6i•Íe«ÔD?³Ê©UžŸ8j•ö‰Ë¢ëߌÈ:ÐMÛÖVeÛUµòÒšqb‡ -ðlgOmEá;°ÞY¿ãž’@[/º}…å:‹8u¯I åcš§‹§á¢#™Ð ÓüT-—Oë´Ò?n\)Ýq¿7ÚÆ7ÚM¿îº(ð1{÷õôN„Âú=²æÞ¯SÚ‡ÓóGÔOj”|Ý\ÔK(LÇj‹fB3BôSÕLØéæìÄqåX'~£]¥…jÚØÁRZ\jcîeÒÅ#£n]Ú•ÜÊú‘e£'ž-³)œg—àeà÷Ñ´:óÂê»–…æ…5 ]1|¡»p´Â¢4òœ÷øÓcÉ" -&Öbp“ŸvRññ{l÷ÖÆÓ>ÓÝ‘ðHG†=7ðßNô›>Þ·#? "¥Ò?-þ 58ßȼÜѺ‡@å¬v¥q œã"¸áÉÞïó¼²àƺ’Ÿ’ßþ©ŠÔ¡|¥ÈJ–69šåµüþ"'èÄ)rþ *F¤k…ñßIàóú‚ðc4êÀ_Žòÿ×ý0 !¾¹¢ Ýi^P+* -ÎùTêF©2ü_¢‡X endstream +xÚÍYëoã6ÿž¿Â@q8XÓâC¢tß²Ýì5ÅíÞ^ãh‹B–”XX=\=âõ3CJ–ÙIÑ»ö  É!ù›7Ã.üðEà1W† p&ƒ`WîâFþ~Åí w¡˜ë{8ôvsµ~ïù î²Ð ›{š²I~t¾ýîúÓææ‡åJJé-WZΧe œë«·×w7Kî¼Ãa¸s»\qçˆÍD¾ý¼¹ygV_/Eà|Þ|wóqsû-Ž]£” Mû'¬ø¸üyóýÕÍftÀ•bÊ—xÂ_¯~üÙ]$p‰ï¯\&Ã`qÚe< Å•ò$ó”´ßùÕÝÕ¿)fL-̪VýŒ•tY¨éͲŠ_â:Š¿äÙ–5Þõ\â>ÔU·'–®aåYÓÞgyŠ\¸Þˆã^á ª¬òê!+$O{Ĭ«ª­¾Oú–×Fy~¼ý÷yiù8ž'‘Õ“†STmr^@%Y×ãª0뮩×yGùº‰Šm´Þ×ÙcÔ¦k«•YOáàÍzRó6ªÁë +WÀý äD´íÅíÜVê‘ðÀ„j.ˆÍsQ”qâõ´ K.ïÅá8Ð>‰Q8†ypPn2d®Ð@èÆä€q‡ö8ÛÈ|f_zý¶µ2  +Ä”6#©Ê=¥$Å#Å?´uËÀ”¸þGFòº¯fÙDZ¡àÉ°#åû” g"c(˜ +ôùDùèÍe¾Ònð +ÎfƒœAa†FȪÇ,!¯T¶ø}4ôÝ4À’GMk¬,¬N4XwÀ': , +ËPŸ¢ ,É#ã߸#öB:·­™G¥!¶ÆfðC;qUôåÔÓI?Ãœ éfßO‡P”Ýq"ŽÙÀ3ãÎ^CÍj…Ùa5§NW0Muƒ¹Õ¤Ï¹²à•ý«=†6À¾1÷¤m×»Li ®QÕ¥uéÃz_Œ³XÙ»¤òü§Aÿ¯ö°bdO!ë-?®ÊŸ\®ºúð4)òþ¸ ¥…÷Û· õ€sç=ö€d°{QaQˆx&‡ò³."ãÐÊóœþï|íÇ¡áž<ï’šé>€zÿóºï‚¡/÷Ŭ7BÐToÓ1¡T°¹/(OCõ#§i0©Èì Y”B^’–è­ÅNJáP.å9ì\ŸŠ{öª«ãt=WÝp_3îùÿ~ !‰öfHY¥N HèKNK*Ó.Ha3 0ž5ÀÄ Scë`aâ‚Þ½ÎpZG8b š© çŒjÒ@}ó—O×Vœ¹3mÛ7PŸ€WR…Ì4øÒ}ždµ†,|:°ºm¿ÎvVHBø˜ÅéìfϺPì4í“@þÚeTþ̶µ(º¬’4Ž3¢¡Í­º²µìïe[Óÿ†(*OL£Ãó Ï4ÅúÔ‹€›º"·M1¥¸”Cq´í§Ù'23Ú×ÃÜ1áÍÕꇑió1í€ÊF~d¾1éEu›Å]N”Ꭺœû¼z„°%\“¤÷ÅšÖ|ƒÍ‘¥·}þvŸ7™3YSBç#íŠ Ÿü~ÅÈü\ÿ™m¶ mXÙf8Ppßà÷_ª©Ïú¯÷Ü}{¿#ÿ¥·¬‘u÷IÃ{™vfúejæfCÓzuIÖ^ôï'Ž4»•‘òj?È×89½˜¾$h|Û"ñ^ôô[Ì•nЧ^¢ïÁãMq¬Ñé|0Ti}µÏZö9+}3îk`R’ÆYÓ¿ŸUVüζÑÒ O¥.ån`i“È#Û@᜶2]Ó3FUí¤@“.¾’è!‡.!bÐÃVþñF1©û*íÔ/Û}RSäÛ’€Öl+èo´7Ñ,ÌbóJ7îçà“B€bª“,Ž†¼ºR¡vîºñ+‚Gá—%&±gÆvpÀ„S +d‰š7öW pâÇÈÉ[%¿€¡ +¡œô‡ × z³à)Á1ÔÔB=Ôæ‘ö-“þ O0W‡¤Ì«\Gw ÚŒâyc*hdpOj·ÉA©5Ú»×)ÛŸ\lxE1/°°7™ìx˜V3T5¡%€ Ø'*±º†rá…ƒBßp*2/õ%†èßfŸåtÈ8¦š‘OÂ÷$1A÷E5¾(Æ…šÿ¯ØkkÛ‹ÿt’P(ã:™’ŸK^R{ÏúMŸA§f²^ÀÿµZendstream endobj -6525 0 obj << +6856 0 obj << /Type /Page -/Contents 6526 0 R -/Resources 6524 0 R +/Contents 6857 0 R +/Resources 6855 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6510 0 R ->> endobj -6527 0 obj << -/D [6525 0 R /XYZ 85.039 781.388 null] ->> endobj -2258 0 obj << -/D [6525 0 R /XYZ 85.039 109.735 null] +/Parent 6847 0 R >> endobj -6528 0 obj << -/D [6525 0 R /XYZ 85.039 74.989 null] +6858 0 obj << +/D [6856 0 R /XYZ 85.039 781.388 null] >> endobj -6524 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R >> +6855 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6531 0 obj << -/Length 1639 +6861 0 obj << +/Length 2878 /Filter /FlateDecode >> stream -xÚ¥WYoÛF~ׯ P%j½K.¯A‘&vâ4±ÝXEÐ&y EJ"L‘2IGp}çX²è"H‘c—»3³s|sHYþ(+ò…ôb+Œ”ð¢ÈZngÒZÃÍ›™2sC2Ñü¶˜œù¥¤ˆel-Vƒ_hß³égûÕÛ—W‹ÓÎÜó<ÛÕ™‡ad¿>u”}ý;ü·pæʾ„Í“\}tÜȾ<;Ê^^¼Ä£7@súù.Î×Å»Ùé¢×®4‰Qµ»Ùç¯ÒJÁŒw3)¼8²ö°—BÁõvº _{滘]ÏþèEñ¶˜kʾ ?òŽ]¡ü WøRøR“+ö›¬ÎÐ(m§`FÅÛs6swG-ïÛMÞð.ÍVÉ}ÑÝh{Ûºú"•†M‘¡ï~uæZkûgô (8wC!As|ð,¯¬Aª…<8‘gÿ’b|P›Èµ›d븡}' žž¬þ†ŽÏj>+3z/e‘È×V|sãÀ«°eUýÖ÷u–2EÒ˜•—´Ú&yÉ{ ÇWZTµ*Ø&ÜRü(²›|xp™”/’3Kóqã¸1jœ¡ ˜>ù¢!Ám‹ÒÊ5{—T€•¬Ý¢7®—ø Z){õœù"#ðl ”¯FÒ–÷uN±ÎÐ –xïô>«¢câ®&.2vpqÀë¹¼~‘¾¬jÞo«:ƒo5!¬÷%a«uU6ÿ°g ñÎ[ÂØ% †¥6Á ×½ÅCŸ|Ù†€‡ŸË¬-ð) þÊWÍ&©Sn2¾’–¯θîÑܪ.RRgIšÜ’!ÚÚsíóG /ëŠâ]‘&†9O3s‹0$bB:bômV‘¶dÒ²Îw±c?˜edïêlΡÜ“1ç\Î ¥\¢¤Ly“Ò%‡‘ÉÏ%»žksÙt~FJoX“¢óµy<áóU²Ì‹há!·6ŒT- òm¾LŠâ¹IÒCIwm¨X”(ç¼Éñf=ezW 3{ä¬0· ˆ!°Vam¾5„Ë‚ÃAOÝòí>Q°ƒÒ°IL1«V]QË H9&”xœíC™1°OPÓ -8ÌÙšŸêãÏòP¯.•)zX0+LñDƒð)‚PG‡PX¶ýɾ“ä=)†˜$ˆá¡>”Ò7T:iÝw‘@[J‰ËÖÊŠ¥Ð -ôÖ¡ð]î"·ŒØ#+ µŽ}(T!J´î,%¤ŽcIF{R~°‰NηÊz]šÖHS#v>’Ëý.õ;åÆàZßò]Wø÷Ÿ…i š–Ò¦ºû­º5™‚GÄó®«Š¬e°Å1CÖºJ,І‰‡²¨m`Ã)ŒÔlùƒ@‡›‚+•vVð1$’sÛÔû§—Ér“wgšwI ¨wµ´ÈÆw“5—i:¿Gx»Z±xò¦®Ðæ]ÑãENJ=ðÙiš·¬SmƒuٵŬ³ 5Â&è\Г•…iÙt s“²_q{^‹«Ë÷¥€3ØÕq§tL‚vìëj‡ÝµÎ“ÖÜee[ç9«œ‚*Ô4¾àõ Tüh| Lásu4j2pÑUx&ålpHÖ+Õ·ú‚ÖÓa!›0ª6íà QÀÚhv6MFGUƒ¯k”¢?žïXR” ­y?Yþx :(.hø_#(ôUÈLrÄ'JŸ”lÞ7ܨ ,؇ròH‰nÍ]3î³<´âE?áÇ6æ'cmø1‰s3 f^aÀ@§ø„®ç†³†ôØ™I$é[XÞ·S#5ô¸¸\0=ç©L=sÔÆ&ÑM.fNê;°7ÌÅŠ':ì(¼rKb*f<tyYíŒé”Ô ©^a¦n:Iä6 òEo8áYÓ3*¡¦ BÜvB»Æ·@cN’¦¦ ›ŸM?Þ ˜NžjGyGÛÑûÒŸœi5ÂVˆ@%‰±\­á/S ºÕ³‹ 9*nè r&„¨@xAGrhî±uñ‰ã8ñC0À°êêî:¾ªjé™ z–„ÊõÓYœhå'Él½¿rg[˜ùéJ …; ”…8õryuýcÍ´«R7-7D²Ìs^ý|ónùúý|áû¾ã…j¾ˆãÄy7OçæÍâå͇×síÜâtíÜÍÚùå{j¾¼_¾¾åÕ7s/qî—?¿~»¼{…s7ÈeIdƒoç,¹z½p¨ òñ„Ÿ¯~ûÃåp‰_®\å§ÉìmWé4í¯‚ÐWaàK¿¸úpõ÷ž Ï3^5!‡EG±ð]•$A/?œÈŸæ‹Ð åÎpãÝÍn¬«rc·Ç:kmUòÐÆBµ©jn´Ýº&Û¯2išúÁ® ^ï¬ñ4©lv9–Û4ŠC§6Ÿ¶6ù|áEÀçíÿÙìW‡¬iTS1ï²ÊM‘=Žù„Ìf½®Že KµëNq:œòUÏ&;æ¶}–£œ¬1MCwÿ&–ÏóÁ œªVêð¿»%‹s¿B]üpmÚõ5‰Yå×0¨pôÜÆtªØ‹a*7ÛÇ…h/V Ú ¸T~ƒUê@é@OZ%Þ]Ó{ž­r·:ò§|Bð¥ãÁ“£`¦µJQӃᾭÀÇZt63áh©¯\M¦?û<ÓÊ ÒÔçÙQ›N:,¢ë»½žÝVp¤Ùp*?UÀ Ë “þX:™ð'€„í€yiâdEQ!Pœî7xâ6‚5¶>Ùš[ž«6²æˆWÛ™²µD„Ôì…8»78¶Þáhi›=ö²0éŽe‚d–6Liq†…|b§jèv…S†gÚŠ—` LqÂŒ-X›vè2õ^PÁ÷ÛŠ®cK4i8óN;;šÒÒ`£\ÝãÖ‰“ Ãí®®PÛô+^Õ"/áPš/-·úårƒ /‚ Ê÷£ñæ‘Ó´ÙúJ/ÔλÂdÕfcjnòöáÀ ç×GVj°í‚àH2âÎãŽgn$`"í‹lDÛ<²u˜ý”ø÷‡Â²Á.d·ÀõQJŒL°Ÿ³ŒðH–TÃÜgË[å¤-÷2LEû³‘2=û;¸Ñš'×Ù½²E¯\Ûm&» #ß^Ä8ˆD%7IƒvʺLù`ë +EÙÝcsÁ·B)£qÿJŒŽ_°ç<ø¬¬tXÖ‹…O 2²{$>ÐÕ«+ÒÁYT'œã,.zI `ÀäÞŸc‹ïzÊÓél¦ñFM_~4‰™2óõøÌö ÷ £>ˆï¡ŠÀºÇrœ©ónš‘¯hD£Î\p’ð¡é£ NoÍZ¬ÔN|…#„4Œ-Ù5‰?g*+«2þ4 oE·LT[Ó¦L‚|XƒjÂ,–lœzò ÅÏë ‚+2F°eår¦ôÿRTèBÜèÎʘÑî*ò2[’’ f ·›Š={ H"¨ZBWØT]DA-šZV‘º’D@ +VÄÒÊtKá¢å¤>(i ’!œpœE¡y½}xaì  ýˆÝ=c'}ÎòÎuIå–‘¬ÆC -!ÂêŦ'‹I­CÛÆmš£‘i´"+ìÆp äuÜ¢”^ Ø<Ç<ŒêGžÎ­(_»´¢}öiÎÆKÇöS`Xg=R.*0BŸNüÏé9ˆ~#z'ˆÞ´dÏ7÷R¦ÙÎf˜tGYc¾d{K.EЂNúõÓ]¹¼È†˜Ö\ƒìLq@ î÷1ÃîNÌÙƒº€2Oà#‚äÊ ¾/q±ù*†šeÑ&ÿ{6¹Ð™&ÀËsU`;Yí-’`HÇ€W‚)ÉRþ1ºgÚQæý`É6#1ËÈãˆý#Ñ(mÆÑMG¾æô(õÔü"±x@ÊÈÚp‹Qæ¡jŠGn‘8°Ñíh·e%$&´úQ:kVì‘Òvä*ìêËšªáÊ©‰7€znR´È‡Å—Äç:‡EYÁÑ”‚ª <%rÝWA,õõîP°«…Á±¹©l'õsk Ø™ÐÊ—B36˜¦1¼iµ™@H n€Æâ0¦\×I¢º©©Ÿ)´ ¥“ŽÓXŠ„œf˜†*žT ÓGÜÍñ1è ZR!Šù<Ž Ò€ÎÓB˜h#ý’„ØòÒ§À‚«Ún·5ªƒQåÖ\×fTô *ËÎÞð&ÐN^+pb—•¶Ë÷<[AFQ\þ ™+cøp”ý¹\Ë Ö›„äo`öå@Èrk(E&CÆ}ºE:‡ì®'5£šþÛÞŸÿ2e>ÂûŽ°ªÄõK TÙ†=•&ú¹4(T.`ù7¥A¤AïÍ^ŒB0 r^Ýýø³ ª ôQ_¤ÄÎ}Ó½`ïdË•-ó97Õ3iRøiÒ ¦€IÕ‘2y0C¼ìL:óÙ°ƒ=ÉSßÇERäIÐ>Ô£s_Ò0•ÇÆß#£\ÍÈ]›¼3ö¬h˜‘à¦9´}\§½ªó=ÙD‹¬eøÚOÕ½÷oïþräŸ1Éb½í…=Ol“ÈUäÙ: äI1 >ýU¨gó`Bè£Ç#“˜pÜßÝbr ,dÓS_JQ"0š‘M¶üzw˜Ø$a“:ßç'ÞGñà_Ó¿ëž½ò×t[_"kEU$tzã¶å}Ìv¸*" Æ1Þ†î|”,nÑÕÒ8CbÍZ^)[˜†Ð£½sâÌÕIk/`Ÿ·%!Ñ›?ŸVcž{pZÊxsÐ…ž‡b¼Lê/¥úô€Ä™¸ˆ;ùÖø»ë3tÎÔxlŒw÷bhÑ:à ]Gû¤ÔƒxL‘ÀpÆÝ”ÔçOÞ–`øí’¿ƒ=ôÆS /mÖ4ïMþ„omÀMl·Gîn™Íæ}gž8qÚq¼gy"‰•SP"cɃ„‰ä —n78€HµÏè!u"@$CÚÉô±Ã #&VÉwlþ¾<ÃK²ÜûoÖšœžì]¨: „WBT‘íò}ëölÇ !ã0 +éƾýìiØ7*1íKcÜÔ~z? tÔÜûv#ÒæÔÙáÐÇ ’Ô·^ªP‚H Zk¸Åi)?»k0аR³g`å‹?©áæ5K5Ѐ!“¯Ì}AXv¯£C1üº8ÿ"gâ|*7V¶²Š.8 ž7ýcæy÷å?÷œ!§ü¾ß†ýR’þÆ_­~]üx JŒøoöÒº*endstream endobj -6530 0 obj << +6860 0 obj << /Type /Page -/Contents 6531 0 R -/Resources 6529 0 R +/Contents 6861 0 R +/Resources 6859 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6510 0 R +/Parent 6847 0 R >> endobj -6532 0 obj << -/D [6530 0 R /XYZ 85.039 781.388 null] +6862 0 obj << +/D [6860 0 R /XYZ 85.039 781.388 null] >> endobj -6529 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F41 2994 0 R >> -/XObject << /Im1 4096 0 R >> +2326 0 obj << +/D [6860 0 R /XYZ 85.039 427.797 null] +>> endobj +6863 0 obj << +/D [6860 0 R /XYZ 85.039 395.579 null] +>> endobj +2330 0 obj << +/D [6860 0 R /XYZ 85.039 217.825 null] +>> endobj +6864 0 obj << +/D [6860 0 R /XYZ 85.039 183.382 null] +>> endobj +6859 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6535 0 obj << -/Length 2763 -/Filter /FlateDecode ->> -stream -xÚ­ÙnÛHòÝ_ÁG -ˆhöÁ+o ²³È`“ͬ½È³ó@‹´D„’²ìùú­«IŠ¦`30`öQ]]U]·”ŸòÒ(Mæ%© -Lšz›ýUèmaçïWJ ld‚ÈZ/l®Ýî:ÖAh“E¹c¨,0V!ÌûÛ«ë_tèé0ˆcãÝÞ;Bâ4 Ò4òn‹ß}«u…þ—U¦ýwŸVkÇþ]Þ•ÿCÕõmuwêÝ»S¿+Wkåúj¥üMÞWÍaõÇí¯W»è™ÝôÅ¢XEž -ƒ,̦›0°ÊÅ·»ªJTâoV:õwù¨è‰¢×cÿ ×›OºŒ”_<Ý•õqªoø[”ǺÁ'žŸ«ÎîÓƒ ¸ƒqÞá}¥¬ä Xd© |³jƒÓœ„"@÷Í“;¾¬RÃ’‡IyÈM¸ -+Hk­P2bÿߟ?þçúL2ö¸Zë8ô»§Že°‡÷´:ô¿" —Äë(ƒç:ð;ø$H2NÑÀ‚¡P¸Ž'Ù6TÓú@a…`3ÿ—•„0ïOméw³›Çºà}y(Q;q¯ï^ðQõ«$Ž0/F§A–"ñh}qh:qúD¢ly­¿˜9óˆ¬æ½0b³br:ÃؾÅ$*õoNl‰x覩)©è4@+ÄàßÉ›#‚3ú÷’²­l\u•Ž1cn`ôAïó}U?É1ô]–‡Þ,˜êÁÅM,†(¡®(þ錖ÝõF¥àKÀM Üv›ßÕåÜ -3BÉÄ]⎵È'´‰Ou)EŠIœÊ€!ïó \ÝOŠ.¨Ÿó4NW‹‘”S€šAfµ€P°ÌrÎÔ6mõ§#4LDÃttq]CÝÆIö\ö%Á´mj^—’æa(Ù8/E_ -û¥¥ú­eXâ -¿;AZM²VÖÉ];~G!L')ÑŸlLu6UW¹îªIlYêfˆ©}?¤x.9]±bCÎ/ŒÈ¶¡p˜Épù˜w´p¦<¤-øT‘÷ù$ÕgPTƒë²'N¯'9Í™ëV6el§ZÐaDY·‚i êغTðA䀫 ¹ç°Û8cKPLmDÑ ß Ç9eÅÖ -îm›ï *K [PR„aÍØ& ÊðÝ ì‡jÃw£º¨ˆ¬ú´AG°ã‹s>!K@@ìN,lïTQYH 5µã‹èsĹ[®’IÉ0ó~&žî²>"¬¨L).^ˆˆŠ¬î-^I›žFîÄi‚¡ ¯¬›mÅuA^¸jÜ8¾Y@qœÈ>¨2w.ðõÙ"Ú¬ u†ò þŸ—¨‚Ø®"5 #Öé {g¸\‚1'²íE!8fc‰ZÒŽŠ W™ðá¢IúT‡!xìyw,oaR YÞaì-t¶r9˜ªYQ¾,~‰ºxÅD“9´ÍôÆ’7N®aÂÊŒzøD¹êVX8-•óF׬uÎ@ša­5&sD{ ò¿§Mü5š8ı,…¬e…ßÊf6-*Žb-éw-•ÿÛϨֆÔãôúòñÙ—Q^ÀC,8ô|7Ô¥ÈÛª“<µ¨‘fÃ{§YÒ4p²…en7U¬7'ì–àꄲ¡/Blq  »• ¹âȾ,bþ¢k¾†:8(–úÿ$¨IÀ˜dlõ<—F£kBœùÌBèbŸ•‘‡²”ËUe.iƇþ¢qk$i€CRç ¼NCׇÃ6× ö;‡ûqîŽ^”b|ÿ ­6I%œ.g“äÇjin‘ü6DÊÍÞ`‘>´a8¨»¶<¢Œ•OÐâ˜û¡d“G²UêUáNñD±z/mbʇžÊõ‚s4Z¨î¨?Õ -À~’kPbFWµ‹ù'ê#T5`ifÙ'¡Æ`ëŒAÊ·$â ›ä¸fìóÞ>wJž¥c+ÑÎUu;“÷ÉÒÑèسF™*+ä$¢à ‰KèÅfâ~H,uÕ9€À”A\ÎÓ–U´éËç¶<ä~T.,™ÊÄD&qó(½¯V óòA‹˜Xììwîdâí¼`‚‚1‚è™j(³ÅzI Ö#ÈPÑÍË%A†Ä3tjŸÝ©"8˜ê×.u ó[/b¬Š ô›dz-h%|iÄ2ÁÛ©ŸZÆ°8v˜á+Í”uqšºF„ìÉ/"˜dá€dÓóÞ¹E£½ž~.¢ëúœÜnN‰-lIA[Ãïù-¤:º0£‚œUŽýx WqªÙT¬2Bg×ólÓì÷³`®…aÜ€|´±¯cHÊ%ÐÌ•& tb½8 ¢øçú”‚i= ZhSÚXŒå6dôDYÊcàÜhƒ¦‰ÍÛç¤BeèÈü¤:L¯‘jÃ8ˆô©ú‡h…¬5N“¿‚VÁô*­IdQ6¡õH•zvO]_ÔÔFÒ7GAl“©cZ`Aت"0iõS,8LëÕ‚ ›²ßXn#qweëx©mÂ@_ø—›<rA)AbíáÕ&²ó #( -¢Ô¼|ãÿö|xendstream +6867 0 obj << +/Length 3297 +/Filter /FlateDecode +>> +stream +xÚ½ZëoÛ8ÿž¿ÂÀáX+¢¨?¦Mw›ÅµÛkì»ûA±[¨®$7Mÿú›i9VrŠ;¨)rH‡óøÍ0jÀ?µÈb?Ðf‘fÊ×Y¶X7gÁb#¿œ)¡‘$1½Z]ü' ø&0‹Õ=‘¬Š?½×o/?¬Þ|<_j­½0öÏ—išyγȻ|·|uyóæ\yW8Áò®Ï—Ê»Æê#5_Ý®Þ\ñìËó0ónWoß¼_]¿Æ±K\eEd¿ÁŒ÷ç¯~={³š0¸Œü(ÑÈáç³?ÿâ׳À×&[<@;ð•1‹æ,ŠµGZ¾ë³›³»Ux,Zð¬9,-ÅR~–EN *žÈå§Q±÷{Õâyî€ñª-°/òöCÙËpnû6}·ßõ'^ÞC»ä¶4a¬«¿àbeÁ“ïa ïY‰¢ì™®ÿ ;3Üzy«£=a‰ϼ¾²<õ¥4êº;_†©·ÆÙùøt_¸¾B±:52ÄxZ¦ÒÆëê¯@Eöõy =ê}‰tì­¶(&d#HÜo}][òG×òdÙ—íYjʹoÝáGSÒÙÕ, µËþ Lè»Ë‡j9y="'Ý~³•íêšå×j«vÃ_ö"1ê©<¬„(4Ú{À}+èÀå°ãÎÊ(4‘×ä»‰Ì +ì ½|àÁo"£óãÄ\VÌù‡.¨®¬„IåF’%ûû¥ÐÍ=(~u=ïËúHM»¤ñö¢6T–—uG«6(¹J°ëm9•GÌê1§PÆx·ï¯ÿ€iAÀJˆ kØæ«ëú©Á¬ªåßœŠ|ÌÑÌr¾]îÄÛ¯e¼ bÑÐE ÁMÞ­æüY£ +Ô×çÀó'٥ܗëOÂ1ª³°vtÑØqGë”3*Ò—,TÞšÉú²ð-i˜ú8$$E™.u<Œx˜Ñ~MÕŠå Ž9²ƒ sñ­¾Ìëê›Ì9øøÀ)[²7û‘T©êÎÞ/ª­g“µL&;ÙCš‡èÅÖŸÊvnû,ôƒ4v'\ÆøD܉|+ 3FDl™¯‹|7³CŒôñG†€EOŠfû=p³À$“0vL¾ŒØÛZ¯UZ¯†„ r">º‡0Ó KfêkÖOH«®­ŸmóMY ¯ pè=îv$òcϨ¼‹»•áìú‚—*ÈrˆäÃãƒñàè:o¹‘×価eý}Àú…í†ÞGKŒââ¶P9Ë ˆ08Ÿ:‘¿‚8(ýgŠbãý«bwýúúãÈÛ‘½oH6`?+"À. >CÖdØ"¸(—SYžæ¶°›Ãmh9(6ð²ˆW­²5ùò±Zïkjá=0K +ºñ_d¹¼XÎœñËyŒa–¶…ûCo…2îXŸIxP··ÑN¹´½NœƒÊƒÔï*R}¹âŽ.¸CÇ8ò„˵õ§•=v_UOÝ?öÞ¸Àò'¬]Òt;—WHÀ÷}¸uËMÔ ü½Ï{æ+,óó£Ø[¾ÇŠÀg:–F_”Œ´s2sjËò€WDÌâþ|oeMƉ&?Úcìs©ÉšAÛ¾ ÃÀ¢Ø À_NAô ˜V×2Ów˜è; »Š|©Y÷ò `çç3šÀ2ÜêãUbH€ðH’h¡”oÐ¥ÉïçJçé[R6À‚§ùH ¡-Ip™Åg`Ù¨³ü7i³‡IÔqqÝèÅUl-&áÍø!d] 1€Ë:²™·²ê)ïãõ7FÔ¯(”…-;Rä¨ì‚šdÃe#?^=,N« ¹Ð°Ám˜Jv†+LÒh‚“`„üÍS5oØ!|…¡õ²?¬*¨zÉþamñ£›Â`" € !gs|¥]äkÄË&‰w}Ï«[‰J¸½E–S™eM'-?çäÜkfµ§4ÏÆ…’Ö‰i] +o +3Ïìf´ä5lTø÷6¾ö3r€…"¥¿C ™ŸhK7ÊVE9:V~ë]Á§l«õ–éö6v—=w䌼©í®¾I:aº•N9É;ž“ ,‡@L”LÃ<ä×M}Øç½_±§š(:8Ë´'i/|™ þ)65¾ +@à Xøc~e ÷S°ù%N3?æê– +Üfk§M•™¯×€ßš9WpâÅÂØ}Öjâ8¨¡Ñ çÚ4ª.ü‡8G̺yl×Û¾k«oˆm8Ä’ €±ÛÍ”¿f€~ÊÆz¼—!¾ð1ñiäå3 ⸅-ä +À>ÃIœBÿCðŸ0~FˆZù™2/ç3§Å J¾ó°/å3éwæ33@RðÂcÙ£îçö#Vîd J,·’1U>ISòs.ß°yÌ—~ÈŽÃpÞfÃox§Ò\Hõ>\à¨WÏX™J"ßn^2²8öƒÄZ#ÖByƒ'ƒÊ X†@Œ>R½ç—Ÿ|FUTx†n§;§vŠšŠÌ8Éxù&§OW +Ù-Âc¤¡|»nÞAß+nŒ©ªÌ‹¡`xÏ«Mg5|hsù¬µ†Zöí´˜‰|p)¸Û _ ¿a&%î|e»&Õ +8Õ*ôf·„æå R%güÀY]Þ»*±¨¸ÕEË»ÃL'Î[ §’ Yš²ŒäÄ]Ó8[)JA\£³³ƒ€¢9œ8£…a–RÏÚ0 üRÇ¥‰(“ü_×-ÏÇÛ4´3Ñ°2—2.œÖ€©h1i¾ß(ÀZ Kƒ/yÝmZ”ê7aµvå!–¥}#¡7|ßT¨]Ò_NîoëªmrÍ\xxŠˆç¦‰cäÀ#ýFRÓ¿¼ðֵ¸E&oyp©žîÊôƒ)Üz~MßöBߤ3Upm8ÑÁDÿ 9tfo¼òkÞìjväFŠ#Ö®´¼‰ÉÈŒ4©f}Fû– ˜ÐqöB{óÕëZItP@9©¸Õáñ‡-1s±‘Æ¿Î šibëÆ帾iøÅÅèÒX—¦¢Ît™ºôïc(a‘DZQ‚ +{ÁÚ‡jØœxÈQ5ÀËmŽž»°û`B‹þ¦æ1òtø JÐssWçˆ@>Í`÷«…¼-šË€¬«ÃŽ’¦#W\éÿ +qýˆÈ{¦f¦2È3b@¬‘eÏ%#afe?'*rÈèæt‘Áœ.LÈætêINÇqÉy‹M’Ä{ݵxw›}T<-v…¾ +ÕsI$ìœ?¿ðTŽOûÀdÅÄ¡9$+1=ÂÙÊlñ3±ƒãã¿—q…jà2~\xyhçÂL–§ß—ÐÑÒ¬‰‡i81q5oâ”–Lòáºc¦›ü“T¡ñkØ3¼˜3Ù²[÷òÖW_@ý.äÁ*H!V%Gú"ÄKü4ˆ&©d”jϲ¡<1ìD·¥`Û˜ +aÏBÞö‚ÌO\'…¶§,Ì{¨sØæE÷@ Ê)_*Ê|í¤,c’0ð3ÄÞe–hï– A-ö5óx\µÆóVb5ˆ&ÁËDDå×]uôüŒ)ÃlÞ(¸¾Úl­SÒz’> endobj -6537 0 obj << +6870 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [141.709 431.843 237.338 443.533] +/Rect [317.619 257.815 369.006 269.504] /Subtype /Link -/A << /S /GoTo /D (winbind) >> +/A << /S /GoTo /D (smbpassoptions) >> >> endobj -6536 0 obj << -/D [6534 0 R /XYZ 85.039 781.388 null] +6868 0 obj << +/D [6866 0 R /XYZ 85.039 781.388 null] >> endobj -2262 0 obj << -/D [6534 0 R /XYZ 85.039 761.463 null] +2334 0 obj << +/D [6866 0 R /XYZ 85.039 439.867 null] >> endobj -3126 0 obj << -/D [6534 0 R /XYZ 85.039 657.513 null] +6869 0 obj << +/D [6866 0 R /XYZ 85.039 407.649 null] >> endobj -2266 0 obj << -/D [6534 0 R /XYZ 85.039 391.393 null] +2338 0 obj << +/D [6866 0 R /XYZ 85.039 189.349 null] >> endobj -6538 0 obj << -/D [6534 0 R /XYZ 85.039 356.082 null] +6871 0 obj << +/D [6866 0 R /XYZ 85.039 155.205 null] >> endobj -6533 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F62 4047 0 R >> -/XObject << /Im1 4096 0 R >> +6865 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F62 4159 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R >> +/XObject << /Im3 4496 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6541 0 obj << -/Length 3479 +6875 0 obj << +/Length 2421 /Filter /FlateDecode >> stream -xÚ­ZKsÛ8¾ûWè¶TUÄÁÇìɉ³;ž™<6Vj3s )ÚæF"µ$mÿýöA‰Rª2S©”A Ñh4ûë%ü‹L‡‘Êi&B•e‹rw-îaåßÂP¬ ÉÊ£y³¾xý/,DæQ¾Xß|tkµXo~ Þþxùiýîór¥” -¤—«4Í‚OË,.ßóì›Ë›wK\áS Dp½\‰àëÏ4|óeý/—2 ¾¬|÷a}ý×.‘ÕšÈ>ÂŽË?Ö?]¼[;ÉL eŽbÿïâ·?¢Å®øÓEª<[<Ã8 -,ï.@îPÇÊnQþ$Ší¶E zî™fx0 =Zyhï uƒ´/üÀú—)‰Ïj “'ÚÝ~ s5ïx3ížpªêÀø3-A™u„+Æa"R|1`W9]b`¡Û-š{%ü… kf¶á¤Ã¿^’L½!~½æÁÏK1J{KŒÑx^ñê´TÃÒ¨§Âûóé]Ec$Ø“2Ú¡â × Z 1" *J_Qµ*P1¸~Y5k…4MtpUwVðrh»Fþï‘Žê;WMq $Ûj³"<´G±$OB¥gQèÑœD¡¥AÙ~¹Z¢ø(Û§cŠ,L£äìÁ–æèä©}Ë8‰˜Í ÔI°ŸA`’‡ŽÇôûhx}CÂT‚“O'nɆöŒ@”ìª%;Ù<ÒûÂù4`S ¦ D ìå{CD ÔÚ!¬‚úááò?=i¨;¦~R¼d1‰ õí– -)o2Àã+[P5K4~d -‰õÄ{†Âa‰à-sߵͭ3Í -£¤ -ššC A09õÞ,"<6åöqc!ð© -n{cãóÎY aÄ…eþ$CÍ£àæ±™AÙÇïLxâ•Ñ!™`Ê:LjÜ[-œ_ñ¾ôyi»5ÀìV¤ûß°Åîô¦fÿûº·ÒÞ &².”£ó¼Äù“Há¶â<ÐÉiœ3 *ç;üŠ`/–àíP•¤Áz?ä/«îåؤ:irN Kr(ÑA|‹ÂD _$‚¿ÌÅü¥Ta¦cïØïF¿euV<)ÓPÈÔ¯)÷GRÅq˜jñ·HeX—*ÎÂHƾTÅ#Úáy$ÔÝÄ#§ sy葶>X š˜ncZAi&l„2{¬¯Â‡[2‡ãŽ¦£Ñç·¿Øï¥ÃTÈ >?T`~™ - - oÛÎŒ>Q\5ÙBÙøÝì®6v²SŸ„Q$Â8Qçq4Òœ’¡ÁkܼÃÈùDXêûgüÛ¦6ÇøI û‹ÔYI,Í‘(SA‹t6‘…2/H̲Y; Ǧ#”` èÆ‘pl9D>•ù2~¿]^çï"s41¹K¿Cc½¥Gîµ#7x®Ñ£ø.ßåÇGk¼ˆA ¯qû%˜5Ú4.›Æ–T;…ä\Á-|;ÝÃ;ÝÜûCi¼H7†WZ -ãì9¯U&L# ß?:—O;dP7vgŃ›‚ïy±e‡Ç݆eÛÜÙlQÄ”qœ²u ±>-Ÿ³u椭[š‰­ß@¬cM[x ÙÕÙÓ™âèð©uë8ÔZON§¡t4›æPÔÉɹߟ^ç%”`«I®&›=Ž^`Öyþ·gy}C8H¯ÓTN„óCjq.yUš ¦ž‡6@à¸EÇZß×-£€ÅûøçÁ¯4»q•'Ò7Öé ŒO,úº¯2îy·ÈÂse (Àc$ZàPlý™jÇèòŒ¼4lEì®sÆàØ{Uã!«Ý‘”ÏD70]KŽcS ÕÆâÞ¦‹jT -âÅe‘Ðssz=’´„לdça:Òœ†©¡A}ýêr8¢)Í>„ŒÌÃ4IÏJ`iŽD8è¨èP"ø<L1—ì¨D¡Ô¹ø_è¨0¯o ®]«©Ï5Ù:Ûš™°7/ ©CkÂÛK]È!ÃCÒ©×Æ™¡å -Î úyª O„$XÂîA×îÌ9dW/¼0ãvŠ¥0ÁI›7}¼(®Ú§¢ ò)>ˆ’)úXßÅPl]¼ÎÙž!þ/6’z³Rnd¼E_Sekáâ´(„UêÚàî£Ü Ñä–ÓØXÝóãV¸´·$ºŠƒþLaÇ­!5&£ø0鸤 L½GKÜZ•ŸFdœè0OÏ[ÍIDZùóåŠt Ç~¹™émŠPAv|îdKstô«6 ±£* ¦¬ÿüç¦ß¨3™+ñúË /`+êsÅŽl°E„† -vòfˆôª&H¬èz ³úbÊa¦¸q“+0*lkYæ||Oj¢ĵXOcz‹ýG•’q‚Ñ xĆÇöÖó”iŒê @Üïê¦î‡®à¢ž)žm÷sÍ8h*›¹AŽÊ‡Ù­)QÈ®‘¡µ|³;¡¬¯4S¥ñ*o¿³ÇÑ6Nß5G¹»¤žù›0N {)îÕìð2¼¨¹ËÒõ-ðyàMpmÒ*ëb;©œzlþÄ‘³¤ßOÊ0:qkâm’Œ¥Œ§¾Žt1_…ñ3ãL×>Î0úQú¸W¼žb{¦äëCc)E ü:eܲûx‡šLÝ[‘)xÎÈk2—W8‘“©N<9RïÉ/míŠÝž×|®s•T’…à' -ê©’¿–ø^+ÙLâ1BgÒ8_I=o¸aR !“fU<˜¹JEa¢ÿ–›Vç/G*Ì¥š\d&\›[LCµy9Ŷm*cJdôÁ -M$Ê9úllLB,ŠÅÚæ†Ì1ícì ¹éV‚uz¥üµ?ýt»Ýzo—nݼlvj÷us°µ6©7^&å_Ä|47xtVÿùÃr•Fæ‡õ胻ƒT½gµoýä/53`͵D_Í(âu5Ða¯M?uOÝTü“=HÛ´b_sûª| éPˆúš}ÝW@ŠH/¨¥S.‘LÏ‚Ú£qNG„9F%j¡³PêÌs:"h?:‚×@ž¤XôsþÒYkÁŽíK3žQC¹¨Î»Eæ¤ß¡¯ú‚­rM]ÌR¬Ó‰lìtßOY:lè/mSó -ôš+ïW!f»Ãi„‰Fç¾ÄþÅXåŸüLøˆL*„ƒûª©:¬?iuoÚ†uÇU-ÿèÃð­ÌFWÉDÒ%9¦J••«µw­ÌÏlŽ _‰C–Z8açœã$ -z“P–5Ò–<9´Ó/ AÁ@oe°实³Àe‡ ~¤ä -ù”Åø» ¸öUÓ×ö;µrmϘû¨„LøGýîZ×þõ²^úDžF^{¢¨ÄÖy5€šü¶û|äì Jo èâ…GÜõ6¤Š¿»=˜ t¦Óï¾¥aÂÕͶø\ÊÙ, þó‰éw”ÎgÆ*ÌÔ‰TMKIÝ\–o¨´>”W« Êyu,ðÿJÀendstream +xÚåZ[oÛF~÷¯¶(@å”Ù᥋>8i²MI³ h +ƒ’(™0Eª$U×û°¿}ÏeHQe»«Ä(ô á\Ïœ9—ïœ9òà'G‘žŠGa$…Š¢Ñluæ–Ðò¯3i{x#-¼À`Ó³ÉÙW/M0’žˆ½x4YP—Éügçùwço'/~»J)Ç7bì†aä¼GÚ9í>;÷b,o±Yßt^]鼃ÂäG*>»˜¼ø–GŸýȹ˜|÷âÍäÕsl;ÇY&ÔíñfüËäû³“®:PHá¯g?ÿâæ°‰ïÏ<¡âhteOÈ8­Î´QÂhe¿ó³wgÿéfá6=âQ|pÛ®ŒE웡>Ò‹„‰â‘ +ýûÿÄÊÀ`ådN2Íq¿)°$"†JÜõW/¥é0Сõõ>W%¤ + Ø#‚Ý™¢]ô‡5p¶ÉÊ¢æC¨R\~V.‹ þK´Ì¹iŠçsË䘨7—ô€/ÚN¸NVûI?tõî?(%4Ò>pL¶e+ÑÀnêÕtÔõ>ZŠ82»,98ee<¡a:WJ%”îêl„6zÇÂúädXbk|täÁ4\²½wg „©ÛU×Áãž§Ó œërŸCa$´ QŸì=)y¹d¹Z•(th Zê–YADR%•¥Ø'Ypª°Ô#ÐL.µ¹øtNTßÍÆd3þdÍ]'ªOCJž]£‰HùXñ0—_¶¦C:›†ËI^—|²9Ô–Ëš?6xÌ×E‰3ÜÜ…¡&TÉ*¥âÝr Qâ'¥Ù›:=°»FDAø0³ë‡êˆÙ¥–»×~ïI]µgu ‰à5R' cÈô+t•ò¤†mâír)Ê ÆA[•«µýlàó*å2žð¬â‹Òh'PƒÚPVóúŸ ð6i5Œ&ºRΊ+x¥ý ˜êõ>CüH‰8>ì8€Ñ}§‘5éªFR6áV8,Å Z­]¥8÷èýÃ5Œw‡cØ#Éö’Š@ÞcG›êö@‡4 ÏèÃuÈUÖ' cP•Cðhp´[žè,\ßøNSòÿ2eÎp%é±Q¤â ñ¬ Ag¡bΩ$ôJ¸b]µZð‚ìrSs³š¸Ó +ÛqÍЙor€Ižsi2CcpÍõ-}ëÖH‡¡}Ñ⽞G¢YëAη5Cwù×Gàûc-Z$>‘(|L›lÈkày7åõ>&†9ÂkÆíé(²Yàzßü½àà]L¡0¦aÎ|±HPËó/ø3[àĦ+Šô† G¶„€^™Sð±MÀLڌ˿™°+´lDjÙ0ñSôëNJF£ Ûâú~,”òwLLÏÐaŒ†.¿edϨÞFï=ã™BÙN‹y;ÄfhΪÞ(T´|¡sÝY`Ž0‰Þ9žJN“ÛlGYA vO*_”õùôìòøDhÏü@"Áû'È:Öh [Ç …hÉ(äÄJ+J{Ù°¸¯’m¬}LøÛȺ‹¢wyT&Ùžûz‚u vþml'ÉòdÚki,Y%˜²ê¨¢ýmó6÷êc»4Oº¼êGÎÈ Éº®Â¢Ck®ÿ'û6|F8µØÛnGV¨JJæøaºx•=ÎMÃL@s/p–9JO•žNpžV¢‡xG +–"Á 5=zXö“cënÁ–´‰Þšœs}h¯ÒùS3'ó¾ÀÞØÙoŸæIom f~÷ŽÜÕZ;uîuN…Ý»8ŽL«l¾X >cÇwÉ +{MþÜš#Œ +–dJؼܗ:þ´dì¤ §U¶&¥ÇDì¤a%@r8*D'pª”ÆHº‹,– ’=nÉÐ_€%¿—J[ó®i%Ô§!ú#L¤*¯MxÌy:”í5ûdäUÔœ\EùêC¬¹]$Ìff¬r“Áò½<‹áÈýˆªì]p´ÑNêlf´¾ô¨»­£í:RØ^f½(YÅ 38OËsÖ+4)ZûÚ¤n‰åã‚D…pUS¶v“D‡v¬ú«H£·—øõj*fe±x{ cºûÞf^òVŸ`ÊŒ~õâ*ODÑÖL©¡Ãø =†ÔúÔÙ­o‹Ù@’õ³:Ò_W¡”ûë&«3<._z>ž¸,ʼ\f…¨Ëc²7´B»áDÈêòâÍ«Ÿö†µKÎfå¦hì*hh»C8as„âY•Ì®ólŠWª´©n¿Qn¶–š©¾Jæå —WsÃ0Þ—È Ì„R¬v¹Èªº¹l#ö,»Ëûr¤[¸Ø¼þ£ë›·¨kŠhÀî½MR…Â÷Ž¼Çê¡’LßLß_€NÒŸ pÞŽÁãï¢ì˱T4'Ar^“ïçø+œçeÁÀ©²Ù˜Ìä!¡¾¾<¦@¾ð|u_²‘Ö#÷–¬Ö”T€ï6 J3&“|›ªuoÜÔ\%Mo´j[ÚìõIy[7ËßåbÀúFŠ0Ž?còƒXyÜgLÊÜýŒißú‚)¢önªä}®Z‡À(Ž¶Ø]ãÇmtÒ¦X·ŒkXÝ]°@âÛµžÂ¤Å¬º¥û£'i_O3ißïµØ±åøЋœ‹"Gúº èn³FØ{Åi>>CÊa]kÌNe5÷a„Sð»p;цÂÖEKEïùˆ¥ñæªä&\+Á-ØãÐd)7Ñ<¾ˆ+ŠÖÑÍ:¦ø‘Ço?jL,ÂtÕÉ­pB@Då¯a}¿/„1ŒÆ[aÇJy_wÁP͵|ª3+×Xss•Ú;['1Úyr¨€/q‡o¾-<7‰P›öBãÇ»ã-Úÿ¦ÎŠåÀ®ŠÀ”iÇ0Öt‹5°P`/Ò°—}4Ä`¼\·‰Ê4k³ŒI–ÙBŸ9ã›Ú^—rV_ è·k×pµl°{þüíùkW +oÐuïzøUg(ïqóæ/Oî縗ß_ºóK\‘ÙÿDÒ(íX~õrÛÝŠõ›>¤éœ³¯Âew ˆíÀrœHòžßÞ÷ ½ ò¡hd0õ8|èÈ0rÀŒ¿Œ<€•ŒØõŽ¢‘v÷ýh`n +š@ÿ ·¿'‚{Øl….¨ *Œ.¤T vß÷þÄ¢{endstream endobj -6540 0 obj << +6874 0 obj << /Type /Page -/Contents 6541 0 R -/Resources 6539 0 R +/Contents 6875 0 R +/Resources 6873 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6545 0 R +/Parent 6847 0 R >> endobj -6542 0 obj << -/D [6540 0 R /XYZ 85.039 781.388 null] +6876 0 obj << +/D [6874 0 R /XYZ 85.039 781.388 null] >> endobj -2270 0 obj << -/D [6540 0 R /XYZ 85.039 308.93 null] +6872 0 obj << +/D [6874 0 R /XYZ 85.039 761.463 null] >> endobj -6543 0 obj << -/D [6540 0 R /XYZ 85.039 268.766 null] +6877 0 obj << +/D [6874 0 R /XYZ 256.764 767.436 null] >> endobj -2274 0 obj << -/D [6540 0 R /XYZ 85.039 183.027 null] +2342 0 obj << +/D [6874 0 R /XYZ 85.039 365.986 null] >> endobj -6544 0 obj << -/D [6540 0 R /XYZ 85.039 148.888 null] +6878 0 obj << +/D [6874 0 R /XYZ 85.039 329.721 null] +>> endobj +6873 0 obj << +/Font << /F56 3312 0 R /F62 4159 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F20 3021 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6881 0 obj << +/Length 1499 +/Filter /FlateDecode +>> +stream +xÚ½XYoÛF~ׯ €j³'}°§9Ô @”HI„IQ%©¨ù÷ÙYê2é(I[ø«™cg曵røÃÐ0®¢a +¦Âp8+|¸Ê¯á8øP3î$]NO_(8‹x4œÌ-Ë$ùè]½¼¸™\¿•Rž4l4‚л…Ú»x;¾¼¸½ ï9’5|„÷j4Þ-,&ïíòòÃäú9I_Œdè}˜¼¼~7yu…´ ¸ü¾;…hzHRq·c±HšîX16&ÚEKòŽhA€$W S)£#ïmÜl*ô0… ø>DNq/®§Þâ²)áY†„®ÊÕŸ\èIÅM¬åª#4’ )zlU’q©v¶ +ÓaëèÚ«­šbÈFaÚÛ%ú é`€ðÈ,XT`ìXòÍ«hÓ§ ð©R4üé uh€äšù\93êbºŽëz›ç‘©F³(h3´ÁZÛÄhlNVuèð“;ë*û7éÓÇT ÎY‰VWí¼ÛXM_PòD +fÈL—ˆŽeà•ë ”ÒE +ïg‡:‰WöV#o‹¹á øAD­7xÁIZ_ÖO¼¢ßiUµFꜾÍ2¥ÅíÛKZ _x˜ÕSVN+ZR‚…VµU‡g£æ²qçãþßÙ.²´ÛêKœð© ¬‹¸™Àõ¥ ? +J³t¹=áûWÐj ›±Õ™ACÏ’®ËúWÌW=íÉO7Ðiãšž@‘Ic½ß‚×ã«-íd|¸oÀPð30^•þµÉê ïOB&ÀÅݪÌËE¶buy†l•BÈ¥om)îÐé9Cb³Y¹Y5NËy’m¦9!€¦ÇâYÏîólŠظTiS}ùE}ßi­)ö¤z'å–ÖEbh±©Ó; DSÞÓh»›gUÝÜÙ|sÆ8[àKÁ’íqspÎÒ6$(þmMuoÂÃ)¦xÛƒáªN½’B0Àò«bZùãRÜ4õ„¾»,ìÀ ­Yºˆ r1q®–‹ºrE¿¶Y³ìð/âÌ7¸'`Ñ"üü»¯¦¦Ã9 Îqéx µ”Þd‰`hoÚæ®Eº„QE>“¾>*¿©ED×ý!@(„C ©mÃ7¦Ï-„ fê~Þ<¿¢E³ÄÄÁ•ÅbÈm +•GâvÖH L)§¸rjæ|Ú{Cˆ³KËf‹(UK‰óâ10òûÁÈbÑ}2¯“ÙamŽßŒA'²xÇ_,×Ø=`žÚ÷ýÓ\dØÒo³ö¤~ úággþ÷ƒÙ>­6y~(ÿŠzþ +z!¬#²‡ &30_"’Iæû~_û®P!™fJû'HÖ¾a®Ê¢ WˆE ëª"¤ª[ý]*( ñ8ÂìßÒ§îbÇ^ø±o"ðqðbÇÍû<%š¬aAf?M[úÜŽÛ[󂞇 8égíPëzBMPKï%õ7Ö"~Zû|/§)o×ZÖ¸/qÎÛ³¶‡~Ö»¶æUYÐ +ûuvÒ"‹8Ëí[hA ÌÚMÓ;ë„]õ%^r`ŽAÀ+×> endobj +6882 0 obj << +/D [6880 0 R /XYZ 85.039 781.388 null] +>> endobj +2346 0 obj << +/D [6880 0 R /XYZ 85.039 761.463 null] +>> endobj +6883 0 obj << +/D [6880 0 R /XYZ 85.039 741.337 null] +>> endobj +2350 0 obj << +/D [6880 0 R /XYZ 85.039 494.868 null] +>> endobj +6884 0 obj << +/D [6880 0 R /XYZ 85.039 458.603 null] +>> endobj +2354 0 obj << +/D [6880 0 R /XYZ 85.039 210.96 null] +>> endobj +6885 0 obj << +/D [6880 0 R /XYZ 85.039 168.675 null] +>> endobj +2358 0 obj << +/D [6880 0 R /XYZ 85.039 110.641 null] +>> endobj +6886 0 obj << +/D [6880 0 R /XYZ 85.039 75.895 null] >> endobj -6539 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +6879 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6548 0 obj << -/Length 3061 +6890 0 obj << +/Length 1800 /Filter /FlateDecode >> stream -xÚ¥ZK“Û6¾Ï¯PÕ†ª²8ßôžÆÉxãÔ®µ•S’²1"¥á†…¤f¬¿ý IÔìaËe“F£_7­üQ‹4r½ [$©rƒ4]lêo±ƒ™Ü(¡X ÉÊ¢y·¾¹{Å å¹™—-ÖÛ‰Oä†Q°Xç¿9?ütÿËúáórãGîr•$©óË2 ûñè»û/Kåüˆ¿Bx(çÃr¥œ/ð²þL¯ï~]?üÈÄ÷K?u~]ÿôðqý᜻GVk"û+>.ÿXÿ|ó°%e)3û¯›ßþð9ñçÏ ²tñïž«`º¾¹Ý( äwuóåæß#+ž ¼jNKQºQ\ªIE3jŠ<7òBRÓ‡ŽùŽÎá y9À¿e+cC‹Oå OTeó¹ç‘¼èñצ+—+?qŠœÇåÎU°¤]¯—78#»Njó2 v_ªå~?qØ”ºâÑ ’=éNo†¢ö]‹£Ï%Àì¿ÅM;áýÄBQàlÚf…Z[)TjFZxFESÍ ÃÈi·üD…<ÉX¤ÃEÍ¿u^“BÊ~èôÐvo—«0ŽAH jëšdoóÐË‚N$÷}WaÁ2‡!è Hü®™èÛßnåw#DÄôû¥`öphž¡ÛB‰Ÿ¦Mšâû0sÜ¢ÉW-ªhE„škŠ¿³h¼/:gû†-¿Æ Y~€‰ª`ªÓëùÝSáFl8°B8öL[k¼×#O†3 ˆB燩—D§7Ío(úÝûPY&ø©›%pj˜âWQäü‡ms—ƒ÷É(ÑS¢ê$±PLݶ‘ÉèÌöpåH¦c/Îo5{ñ’Eä+7‹¾UïvBðÙº_!^YÔ—÷{Æqº_Á$8_l!Ív+#8ÍàͶµ,ÞëÝ…øay- Nå?³JCóºØb–aºiœ’Ø÷,ÄnD#ôÒ±oI Ù(­Ù AÈQn²À -a0vW˜Ë¦[¿£F×é[ZàSz4 ×j6£m‹A¿bJ»îx7°úµÆž×Ýs¹)V&H%‘Ã1k5÷f$º¶Zm+½;%ÚS¦ÝíúÀrºÝ;FÍj2ûYÀÞY ³!hÚãq4º¶ŸN*ùºÐ9 ΡZñYè þÉ¥<Å/ŒZñú ÞÈ$qF¢E‹ "ÑüÃx¾DË…<ò„ÎÛýYs²oÀ2–ÓGtrŽA,†‰D ƒ¨vŒ-©ä°—XadŠ¡€$ˆ<ÏH«yŒÓ( ÂQHÆ‚çf»‘,1hØ /ÇWÈlÀüGÜõ•ÆÎ'©Òñ¾ð¬ÅEÆ‡Õ ™sãbºö…N~âOšÓ8—@fW´ÿñ2ßðÀ‹5ùRVâŸ#HêIǤ؈><•ŒHº^28A6îy°I2¨C£E%&àö¹P#«‰äjÊÛ QKà‡oÏ÷U‘ïèe_¡8ß÷´tˆR€þ¡½1Çe•:ìþøF— R oeâ"¨?“ÇtÏuÔ¶Kê -‘A Òì­RǪ;ò#ð"B™§<ÄVÆÏŽÌp0‚²OwdøñïñTé@¡“¤þ‰ –ý™í‹‹›"i Cø¦Ø^) -³{<-Þ•Ï€€: ½_™‰³wJÙ;àì ‹¹²Õõ^À2geŽßÖ Nó[3ØQHß‘sä·²ÏX'ηþpK™}ÆßR At^¡°Ê¾µ´(”¹E5)¨=°ãäb»ÀsS(¶_ÛNHηÃUÓvAl‹mºog2°ß—–Þ˜(C/¼h±àØ™zqƒ…éçVŽ{Ú{Æ}Ñ „”ZOHq°Ûc”1þbÄ&Ž2‰;&ÿÓˆ£Ðy_vc+¦2É}Þ÷œr^$ø$kñ -½¨ªì »©ôÑ4Fò4•è /ã¶ôË`8 yj ©9Á‘6Bk™«zjjR§)WÙ,žè°a ØÌqG“ýM!gUšà>—akßQEËw@éÎû ¾±…ag(¾â‹æÇ^p¥¶ËyÔµœ`ð•Ã°–S oªŒ`¦ÌMZ•šƒ³+ú6 ­/ÅTäUX§ÅÙ$äY†¸(u65¾£ü$hi{Ɯʩ'—Ñõ&´”BƒáŒqP!ªÉgB³gð:µ__q“k×µ”S{¦ kŸ[©%è9ôýÔ̸üHíòã¼´“K5=šv2;!×,ŸËÊŒï -»†©vòY ”Þ(Îmº±˜´½Ðôvž.°Ù™6jÖ`†²§{5”*ƒý^¥Ñ+ÁTˆþg4}mÇ1œží8O­ùDèvšT3ÌÅÖ0t•ŠÏc+~=ºh_ãg+1B«¹Öó÷§†ü¾(]ƒ¦aà<êÉ~ð»Ö†]é°M•ÆkÝè]a÷Ñ÷’D kh:õ+‘þäË…„SþÐ-4ªŒÃ¸½ßÊZecêQ™ 5Ü™“ÖåÀDŒ"¢a„ñÃdd ù!A÷¤ôÂqëÔ¸-*çzIZ7È©¬å‚P催9;øó.1 ç‹ð¢Ù#¬¬ôce:D>GÎã·QÅ8<²í[ꮌßrL»§Öß!9`RVpÓ…†Gî§JºKÊŽÓ=£*\Ö -•Ñî“–˜Ã ©IÐËoT0ìÜ1Ò^F½§ê±ÜLüÞÊ…ôU‘ …­A>b!)ŸÎ¨?\O;Åv7 -ã¾åÕ½Òÿwõ³9O†¿,ìÿõßÆoaà¦A6…#ßw}edAåQ|.¯ùoÿ~ö$Äendstream +xÚµXYoÛ8~÷¯0º+£1M‘Ô Î&m] i7uÐÒ -:ÖF–\ñúßï GRìDq¯]H(r8÷|3ŒÝçðc÷}‡qô=ßfÒ÷ûóU÷oáäMÏ®)x_1î:xt2í^;nßæ,àAº0$ÓèÚúãíøÃôìr0”RZÂaƒ¡çùÖ‡¯¬ñùðdüñl`[§x¬àmMCÛú‹é¥Yž\MÏNéöx |ëjúöìb:ùÏÆÈejÈÞËÁÍô]ïlº£àP1åJÔðkïú†÷#0â]3øý ¬9³ƒ ¿ê)G2GÉú;é}ìýÙr¡3Õ§[~6Câ¤l"‡„U¹ áX¹þZŹŽèk”ijQ¡çU—ÛÑ:\}1º,·¬ÈÐ4´ÇFIÁ#FEµXÄóX§ås¬6q:‹Óè#ç‡ù\]LþB&æ¸*ô—Eœå—uX´—VI’ÝÔö›f—áü®Rèü>žëWŶ(õjhØü +÷4K²Û8}Æ¥óyV5Öÿ/zþˆ€CACo²<úU½¶÷óu¨$s¥kä}ZBi¬´‹ÑÅ:•Ò³²õ`(¼½“NÒ憾çYZd‰¦ Ä@aÃkXÏq³Ìa•Ü\‡ žÞ\¿¶o`q„T~#t¦¿—$ ‚I{È,­™ÇÄÕµVÐmKkÈVäŸÓ×g[ªµQ Ö/””ã4ÜÑÒ/Þ#ÞÔ +µbÃ!êˆk#RZÐH¦sÚ@If kn8 ÍËu\¶,_i˜£P8Á~(„Çx@²¡ÎŠÎ;¦æâÖL—À^)i­ATžÍеFà +·þ1¶úè$ÜHbM‹½áÆ©²*§¯8mâ…aªŠ8Ké [Ôúû;: a3îµRZøŠùÔöf‹àÛ€-hÝN¸ÆVmWò;@øg +ÂvP~ÄÁÄ ¡Ÿ3Ç–{É0]†ÊUÖgn+t¸rô xS§tb|N§–¡ÉÝ‚ÈB:O²²½f6Š²n’>ÊVÂ~a#ÂäZ'qŸ°¬åoL^×\ëhÒ•0×õ"Éu5Œ2ä[(Jo:ð¥…E°íHÿyfôXÕ0 (« ª(C…JZ—„"O3$˜òÝçie]þ¯&ˆû] Ò‘Fž Q4‰[+È@ŒqF0óÔHeÃ0âîŽOù ŸI×ohÒ¨«šlf+ÑÔ ¥ÇÞá +º &mãm–K +µ1‡ÚÇäÈï`‹|LZB½¥«zD5 0ÌV{‘€ËsóÎh¸7I—)Þh8Òå{‹Fß(C0ùÈ0îÖµ®+efhSRlLÅàªM}ühã§#ÚX`Šc6Kî[q}%¦”Îh·aÐyÏ(!óñÔ*ò• 8Š{¾‚¤+×À­^ÃÉ@I£-†EpklzdÝÖ ð ÖÁ^¨Ó#lÊÊÄW8ÁƒÉÂå݇vÂ$!ººoÝ·à¡ ¤°éHùÐÜèûyffÒ'ª¥îIƒVM ì@U-°†Ãú6A£Í̬0±†¦¢Ö&ƒô9=_Nß¾\…ù6;Dð7L³§¯²ö<\é¨è`À;Ä•mÎëAç ·48ÍV!DÅ^Á€[’»K<ŽVqúÝÔo*]”?aé˜æ–bÏÚà±µ·ºlÿa^¼]o/¤?þç˜ÃYŽè78j4 ‹®W8Á~p5j~=GÞmŠÉduÆÍoy|{¤í{è¢I¢GËl¥GÙ#ºd„-൧¼»½^Oª²)žeó‚X­æá+*Œ“âøEÌK_0ßwº¾¶ê×þK=Öö[ìÒçU´]˜{Må‚ÿšz+9endstream endobj -6547 0 obj << +6889 0 obj << /Type /Page -/Contents 6548 0 R -/Resources 6546 0 R +/Contents 6890 0 R +/Resources 6888 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6545 0 R -/Annots [ 6551 0 R ] +/Parent 6887 0 R >> endobj -6551 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [324.074 518.849 496.369 530.539] -/Subtype/Link/A<> ->> endobj -6549 0 obj << -/D [6547 0 R /XYZ 85.039 781.388 null] +6891 0 obj << +/D [6889 0 R /XYZ 85.039 781.388 null] >> endobj -2278 0 obj << -/D [6547 0 R /XYZ 85.039 596.758 null] +2362 0 obj << +/D [6889 0 R /XYZ 85.039 472.391 null] >> endobj -6550 0 obj << -/D [6547 0 R /XYZ 85.039 559.887 null] +6892 0 obj << +/D [6889 0 R /XYZ 85.039 437.948 null] >> endobj -6546 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F35 2976 0 R /F20 2961 0 R /F58 3360 0 R >> +6888 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F59 3455 0 R /F58 3380 0 R /F20 3021 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6554 0 obj << -/Length 3927 +6895 0 obj << +/Length 633 /Filter /FlateDecode >> stream -xÚ¥Z[oã¶~ϯÈ[m`­è~éyÚ¶Ûv‹s¶=Ýô©-PÅVam)•äÍæߟùf†eÉIƒ 0E9ÃáÜÉàÚ§¿à:O\}¼ú¯]JÆâk™µÄ¥8L½0£Fä{y/ÂAèEAH¬L|/ñcËÊ8pX¯b?º6@àå~o/¦$¿v›cT˜Fês0F)Óåb쫾¯‰«mþ~ ä7߉3+¼œ&ù þØl},»úðŒcyCgG«zêÁêØ®7t„»u*é3ce4½@lÑòr¨ÐÜÆ_=ÕôvmÝÐð^æ€mö½ù,kxv¥Ó‡VÆïG¶bü!--Vء숸F‡]ð¾îÛŽ3šý€Y°:õ¼j'_ºU7åýPi7¬îY:¶e3™€pµáŸ!× Û*fEÕ}®·)M’ä«`ÙvM 5€^ÖáæÚ§ Lj!íC»ß+ß°]²Ñö~M2œÐR÷`Iw,‡g>^¹µ8ªͺÙË(s†ÄÕ>š½a+ q³=´½B¦GßyéÝñA—òQ}ÑmR_³W9xÌT({ š³—„·rlO x:ˆXˆõØÕ9’íÐvuÕ¿«S [o¦Zª¨izY’¿¬ÌÐee6@¯)ó‹2Ÿc\Tfãã:ŠõO$ÍÔÚ-©sBÛ sUgèfL:”ý€V4Ó`Œ`õ3u<òX%f®eúߘSwPFŒ‹Iû$r#r ÂB½Fr±J‰É$gz¬[#› xûÉÑVc݉+Ý´w–a1/5Ù•š…ŠZ_Xø+ S-ô qÅêRùüˆ=l˃µqa‘ƒ®®’5°kÌg]ѵÎy†>³{Ì©J£Øøúk‹Ý< -Ã8VXnÝt%ìbBäW ú|Wöløˆ“åi4G£b°*—ƒ±ñüÃO|¦f Ç‘q8¡“%l#'¯Çî ïØ= Ÿ‹àݲmÈ -kB€èÚÃ†Ô )÷2ÌâB¿ªØŠ`±y´Ù ãáâÜgóЂkO`e…Æl€[ßAËîYºžjâ-·¬l–ÛA×iÍzJ6ó÷d¸µþ+­t€s¶ß—`èá¤kDZZ½8‰¤¾£ËÐJÆëA{ù}Í%ÆqŒýK÷ðÀñU±ú8ú]× ©ØxzŠD¤ ‘ë›ðÁ؇’åqT± BRh¥™lT½Ýóœ7VÃè€xõò¨_£$e úRm óí£­ÑoD± ì7FY£QßH½0àʦå¤ê Î -Ëg‹Ñ‹"ÙËøŽ7<†uÇÚÁâ¤GêÆçÛ®ª°ÝP6[Ì!¡À¯£ý™&lz"2=„Ý # Rlý³tŸé1 Ø Ñ/¶/ë–;3Ÿ`Aè°–ÝØË¥*ú¼v»«?ca6^åAÎu‚¥I1þˆ"Ñ 8ß©qìe𠾿¸º‘_‰Â¢duc‡©¸?JGoÛ6º:glÜŒóÕû¦ b–¼‘Õ zøC„Ê(ÖõSÊO:2:æá³éÛŠâ©™˜E&L¦Ûÿ²>ÈÇ%«® ‚%´dïÔøwÍB ž}Ù¹‹$ŸJýÕa´u$— îÖÌk»fí¹—yÜG -w¿Š.r#Ùž— ÎŒ:ëþ’Âs0®Á~mD -]íëjÇ*†û ö†µ›ÇòhΗ†q¾LÄ¿ð WÚjw‹1:^S&˜e¿’EÈÐð‰ŸDبlj饃ԛ{좱¤z ;~Û‹ä‰|GtTkÅ~â£SßϾ—úo¤m£-LݪI"{D½ ‚Y'÷ -Qª¿s êÝU`‡%O}¿æL(!Ë™Ð6¨ÈaÁ1Ð? æòË|aæùÅħ“¸×GcŠàú8„`Ë!ß²3Ü6IPÁSGTôKš…Æ`™ €˜Ar¦¦Ù«²ÇYª.ëYö×ídõ9g»dµÅüIÌAñô(‹Ô–(ELCWkL#ªQôKäomŽÒHßÔ¡×Nrø®'hQ÷ ¸hoA”Àkb1¤””Î*êa%˜PíÙ -øT«½¹íº•0‚RZKŽ“ÃŒNDÊ!•g“ì¤È¼ 4ËøDç£Iÿ5E‚˜,ÁÒ‰Mì÷Ê’d3®R l1¢?ÑÖRPQW ¬eÐecxM-ó¶Ž|Ú< -ãÌ#Ç«Dj`Å1W€fš&¸jn¤u¢íd˜Á%Bñmá+$Öù j $v±Î€z΄º×ÅcF*iÜ·œ>H„l+%p·¬šÅùõyš^’'×qH)T´\RRÃIhèÏËÌ"Æk†9ˆ/ôÓ—P£´˜Pk17NÈž¦Áœ¬i6žF”‡º³ñ´x˜™aœfãYÌt¹‡$ÁðP|±È–y)Y¤ó¬’-¦¤±¤„h¤õÉìðRÊŒ’Ô»¥cÿËy€ðµ—R—£è·”ŸþY+/GSØzPYGåHON…Ñr=ú{Ú›¶§ÃNºìÖ±À“µ†XuÿÀ ìgR‰‰¢™4(2j°Hõõ¾©×¢¯ÐæÛ|Ãcn§ëºYuõÅì„Iq‚ïRs$[ÕµÜòÇ^dÏf RËæCoLq}ЩROùÌΣmŽNdrчIáeñ+÷ÕÐel€^sÁ/b4.ø㢠v1N“¾Å ®ØËÓÔ ¥aï‹âb‚1ù’Ç„ÞÔ9sŒ`ÆvUu4ý aÄj½ë+]³•ßž<Óp¯î®P EÃû$¯”û-Ùˆ+’c²‰{Þ饇ÜGsŽ[µ^ÿƒèOJ1†Ú;®•áæYES›ƒB>²‡5Ÿ¯±Sõ¾™ÞŽGYd¢U¶ñκ\Ò¼†#ëŒ\QE&NU”ç—"'žDÉæéA^ˆµÔùð¡v")_T´•á£”sç…k‘`õ•=/æ…æ™›w`»¸Sœp›z‘P,–£Lô­ž;XQvê‰?õû‘ÈU ßvÈdìøêOwýÈ3Ë~ -ewXêâE "àL 1ªE´H4 -¥ü­@)ïOÓ}'öU‚>ñèåÁÆüI¸2cŒØ¼ê¼ä8> ÑÓŽåò¹pŸ`ó.¤× ±¿6ÏxØF0¡¦|{mÇKE<ž/H]LÏ6K…ò³Ô¾ìg55k -zÆ^ñ²=· —­¹€¼fË_Àe,ù×¢qµR•3/Yó§Ä+SA“Â$¶¶íÆ^A‡ƒ{ ûÁÞ¦…!'Nñº8¯:c±ñÒç“α9zÏãtšahµH"7b3‘,º·&“«ñÂá Ù“ìv",ì6|ã"üü—–c -v/]êÚœuœW5_éôsÇ 5ž*Ù°•t»R6õØWMÕ•ÉOJ7ØŸ¸™kûxuï“CݳæÛ±Ø/œ¨£¥üÌ<1õ=á·¬*½½•×%Xq°4DzX\¯·±,ÏÖê c‹Ê‰±ìÅ»PæR¸úñ¥lww0ã±ó8,-ïÆÒÞó«Á¯®ÏòaY 9hS -~Ijäúˆø r’Õ›1Eö¸65Ï`o{ꕘ¥Í³ÓùÛõ6ùʱnö¡6;,–½·ºœÜz·|á•M1žvÕXj?ÚÐ\!Ç·?…˜Á(J¨1`Xä(ë${ rÜ{ÛP‚»Ë/ Æò¡U--[Æü”µQ˜êKy|<Œs$ŒpŸUÒÇR7ÎIñ¦A<¢€"5u.h²Vðd‡ˆv¼ÞåÂË5ELåÒÉRÚk^ô™§˜æÖã““×í>s%ayyœ^ç‘—úÉëÏt#/Ì–énÌR›q-v:ÓÛ(ó‚ 7ø@ýû>üüë;S¨¤…a£´Ïw=…s×S˜7/欅AàT)¥“kCExf/Ÿ&:®o¬È\‡bâAç[à<ýÛ·ŸxP&(9/ÞëÑ|s ؽ智ô`¶TîÈ:ÚºÓ ôóÕ"/<«&ÿ.º~úÁø¿^\Ûgç1iT,Ÿe†^ZpLQ2‹U’(÷’<šü? _endstream -endobj -6553 0 obj << -/Type /Page -/Contents 6554 0 R -/Resources 6552 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6545 0 R ->> endobj -6555 0 obj << -/D [6553 0 R /XYZ 85.039 781.388 null] ->> endobj -6552 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F58 3360 0 R /F15 2972 0 R /F20 2961 0 R >> -/ProcSet [ /PDF /Text ] ->> endobj -6558 0 obj << -/Length 3900 -/Filter /FlateDecode ->> -stream -xÚÍ[KsÛF¾ëWèfªÊD0/<ìòÁqœMR•l6VjŽI(“„L€–õï·_ƒAp7âaËåâ`Ðèù¦§_3=R—!üS—‰ B“^Ɖ -L’\®6áå¼ùÇ…Š¥,{4ß__|÷£‹.U¤azy}Ûñquæò:ÿ¸x÷ÓÛ߯ßÿqµ4Æ,´ ®–qœ,~¿Jìâí¯ÜûýÛï¯Ôâ|²ð£?_-Õâ4®ÿ æ÷^¿ÿ‰ß^édñçõOï»þù¾{‹¬®‰ìŸðÅoWŸ®¹xÝ"o1Êa¹øø)¼ÌaŠ¿\„I“ËGh‡‚×› À8käy}ñáâ_-+~g/ù«))9“.1‡bR®'&¥t`”¾Œ]¸Ð’œîvEÖÀc½È‹l-³¨nñW-V8»j‹Sov0Éj͔ՕŽ_±»ØqÏ}…Oüy¤÷·÷Ю‘§,k~‘á›æ¾`îå*k -$Ë¡ËE°ø|Ïþ“[„°Ûô1j`½2ØÊcõ@ÿ -•ËîÚa‰@^K…âLiúy±.7eSä¼Ê%°£VýeŸí„3hÇ ¶³Îû3Í»©ùE¶¥Ou++™nY{ - -3aÌÂ(™7Q÷©¾^¹h‘­÷þõZ ~RakË#6Cá.÷Nò»MÝaÊÖ‘‰iÊ¿ûB½ÉVMYmÈZ»õiéÓÜÁ'榦¸EÄí§bG^Â7*9€ìmÂ+hÍò)¤}Ëïüb­ðzí• >„ŽíîŠfË°åG -‰Öй/dúË؆‹z¿"™qgýÀ9·¨®–(°íØV­qA©ËȦA”èÓÖjOÛêÒóZö˜š¢ƒMmGDQ»­Ÿ6¨i77F£ÃM]Gñyà -¯pÓ4¢¥•Æ•Y’…-M±N†öµ\ãy(£À_ëKÐ¥@ó¬yx^˳ h, ³íˆ½‰˜„ è©nŠÍÒ4 ´ŽÎƒTx@šš¤~é Øí¥àçç@éyÍ£Ô ì*ÑGPŠ¹íÄ©ÄÊž¨ð:ÂqšÄ y±m½0†BúÀ4Æll Σž×6ŒÏØóšìÀ_«xh—%½-{é%&¬ñнày»vÑ"/nI‡ÖM.^¥‹k,9h/ÖYÝ`+¡#f¤mîy#….ì>‡'Åý«lË VÖ‚™tŒœß6ÿrg#rŠ_Èy=î¦+áÈ¥ OZÕBÙjWƒ£ì„x|ˆ>U¸ ñ¨rƒEˆ^¥b[5\Ií]£Ÿ#0%¢Y?ñ›¼ø+TvÛ×ìÀ¡!‚¥< Ô‚ ¸*pŧùZäduDr¢Qqß:A¨fñõª#*ù৸“3cú¤ò¿¾:€ n¹¯ñ ¥’jøZj ÛúÕÕ22 -‰ºÀÀe¢ÏÒÀYVÛâõ„,o21nkS¢+ yÈYŽúBÖ# úÅnñ–»ù³ªa®íD¡{¥X?j›ˆb5í g7!¶ÜEöŸ³ƒ!™BÛ2×[0‡ æÓ³=-š.PÔ÷iVÎo»xCœªýŸ%p9 ÊdÜ.¢¶ ‘²É䦂ŽÑzR»±ÓŸ¬\ó†Ð9Š±’ˆ´:tW÷ó{= 3 T]6H¡£È²½!QÝø{/í`ÕÓK|ÚÔídpHíSYáö‡s:ôˆÁNöµä¥tÍåC.ß}&©­÷Ù}3|¼¯ÖÝÓÀŵ%¬ÃF`ù³¶Ô#:nKžè”-ÍŽèmi<â¤-õGÌËI­5l|­ØQñe_Êjt=LÙ¥QÒHûBêk¯ÞP”F"RÌPË\Z¸‡0äæW ÷Ъ q±ƒÄ)küÝ|׺Ahθ™¯7ÉN×ÂT.WAÃßÛc âi ²ØͦÝÊ”r“ µáI\ôx›…j~×wéF¦ˆ÷´Ö=wÂ¾æ¸ -…qFæ„ -uD3*$D'UhnÄV…F#N«PoÄêó”©í¡'Æ—ñZzº»•´ÇeÏ‹\qWŒ‹ƒuÝ쨂@v¬ˆ/UxæmÖŽ{ä.œããªóm¸ö÷«={ì¸ ßÈ™Ž.›‚•Gf4¸ˆƒÉ™vC{d•ˆY´šŸ`Àc?bÀ#é>‘{ï’{ÜÓžE%㜧ÿÍD΃Þ¤¼‹AʦÝ)î˜meè”-÷I9ï[AïQƒóÜLæúè¤1¡oj{ÞԚà ïFb›ElÁ-¯‹,—ï*îÉø±Ÿ~µÜuß„‡ @8Ô (nỗ>fµìñš8çKl;Óˆ²øðç»wïñÚŒ•sMcF®êEÝ›áÖ‡ó$€X%r?Õƒ„¦•ÏÑÈ¡X©t>rôˆŽGOt*rÌŽè#ÇxÄÉÈÑ1¯¶“Ù0Ô©™É>hÝ*þ­è„à 3^X Kò½½äCRWbrËLÆ È˜Ï8Á÷§-‘5?p]¦Í>dZÿÙ^!°ñ‰¶Gt\‡<Ñ)šÑëÐxÄIêȇ õŸ§··ØÇú„•KÖ§{„ Oã4ñ57Èq›j÷$†{Ëýíò'íR7Å1’x’å³nDC’v@úwâI°Æ‘Ÿä n4:£zM¢Rì0*÷þÆ @ Nû˜Q—ûß³SÚ.[ÓÐktÜÒ¾vÇ<ÈÇõ]Ž'èxŒÜªë¤-wEþs {`Äíß74½ -¾½å )W{–NÀð$D 3Ú@ÂàžoIÅmhDJ:„)ôüÈaü)¾=´“¨­?g‘å!“ž#Öã­¥äGú3ØoCô{â!³o|¶i!ê^ßRUÉvþ˜GXÝVëu{ϲ~ŭGÉ̬ w4Ç-XhNðÜpÞ~GÃ\«êÁ–‹Ž^U@K5ÿÖfQ LÎýéä_ËQ6?öï “ï[õ–ÿ†"𞸒Š·ilÒ—ä3®ï0«Y£ ‡t}Ìßz0ì:âô,…Õ<@p­xå`¸FèÍÞx1ŠôoÐ,°£à—]qô  |:¦¼. NDOq\q‰â”ÚÈ+í` I•mò -[·ÙFÁjø_)®æ¬åùZ›Òílû:ËŒf$`äÆd+ú‡A¤õ  £9h± ’Ôçoi*n‘èÓ‘¿Å¤ÔmJ‰à?Ggý™fû·ªfdÒc×t •Ç‚ó5.9¸!Îyø?knÙendstream +xÚ¥TÝOÛ0Ï_‘mØ1ql'/S2@c4hšM! 4Z>¶$mÕÿ~>_ÚÖ·)¾ó}ýîw¾p×7wµb¾ˆÝHs&´v³ÚñÝcùäðÑÃw%óC¦“Ä9:W¡Ë}û±›<[—$¿'§“›dzK=! £^irCµ$“ÏÞÉd6¥œœYšƒ“Kêq23BrkÅ“»dz†Ñhr—\L¯“ËS°M Kbݾ˜ˆkú˜\9Ód '™  üíÜ?únnš¸r|&bí®Œì3ÇníH%˜’bÔ+gæ|ÝfA›t1jÞÆÓ¦œ[B„ÚCH׶Ãê©@‘lÞ®ë´[·(¦?žËª€^ ©ciÝÑéÀŒZÙ,ÓªÌQYôEÑGçüu}O +ŠÈæzàB&ó²Gfñ”$ï å²lÌñ‚¦Ø-ÐÜÐ &‹¡GM§’|›§:eiƒÂõÌŒF÷dk›—_à "æFŽ­"M¿*ºã=Ð n­åÈßwªi&ugʨ€ôë~(eziL=ŠUùÞLQ­Q@ h®[´µÂ`§73 ">kú,ß(€gµt¹C2Ì)eê4i=J½¥¯[–Ùx‘ÁEš¬ù–gsŸ1Å6ÚÆl‰Œc»sð\ÏÊŒføëÜ‚aåо/à yüêÙä-ÎÜÚGÓ!VCÔvãËaœë†a{»*+ã[¡òàsÙä d õÛE‡–_vÖOUQ¿-ÐVKŠo‚[ÜlÏ–F~ÈBü“üû“[ù¿ãzKËfAù¾š¿…ÈC&ì¼wþ20Sendstream endobj -6557 0 obj << +6894 0 obj << /Type /Page -/Contents 6558 0 R -/Resources 6556 0 R +/Contents 6895 0 R +/Resources 6893 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6545 0 R +/Parent 6887 0 R >> endobj -6559 0 obj << -/D [6557 0 R /XYZ 85.039 781.388 null] +6896 0 obj << +/D [6894 0 R /XYZ 85.039 781.388 null] >> endobj -6556 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F41 2994 0 R /F58 3360 0 R >> +6893 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F59 3455 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6562 0 obj << -/Length 3140 +6899 0 obj << +/Length 2047 /Filter /FlateDecode >> stream -xÚ­ÙŽÛFò}¾B/ÁP€Å!ÙÍË‹Y`’8‰ƒ\+ðÃd`s$Jâ†"eëï·®n’’<ÆîqÌ>ª««ë®’ý™ÿù³$t=•ÎâÄwU’ÌVû+o¶…ï¯|XÈbóõòêæ»0šùž›zél¹ð„®Õl¹¾w¾ùáî·å«ßç ¥”„î|ljóÛ<ÑÎÝϼúõÝ›Wsßùg>¾óz¾ð70XþNïÿX¾ú–ïæAâü±üáÕ/Ë×ßàÞ¢Zدpâ—ùÃòÇ«WKK¹¥ ¨L‘ìW÷Þl OüñÊsUšÌž`ì¹>l﯀n7ÔJæåÕ›«YT¼§g|ê—t¹A å¹I¢/Âø~à*?V†žzÚ²Rû#VúÀ+í©™B^þéùñéó|¼)Lf#dç7 -ÌÙ~8¾QED×øƶ‡;£2·È+d}Çb(Z–Vþ¡¦çaädeŽ€–2˜vºšÁïÛ~EXò¶ÅÏíNÕUÎPLèèÓéë”N\Цñ랟ö_ÞÂàzž * \oÄOäBÖw@᎞_ÿuFc’ºQü=4 -®/Иn†›üòôv] 7‘±ë|“¡|Êî¶ØâzÝäg$ú -4.ú‚Î@Ïè¬}QgŸ»ÑêìÉ—uvtc}@iu••ÿ®"xHêJ¢® uBõŒ¦*íúq:~Óÿ®‚ëù·+ƒ—¾ý šƒ/Œ£¿‡FÁõãÄU:Ðh4Õðô³J:[QÎ;&wêAÐÁã?",Iä¦ý˜|Œö#g›3þlŒ¼òrX¨9¸ã]æ àYŒ{¿èPÈëÍ• 'Uþ„ƒÄiâ}'ûôÖTâì̵¹!±…².k;¹ÛàÂc™<àˆHëž'«¬â¹Mâ‡&Ñ(%¦<@ÜBE©SDQ6 ç­¬&ÎOÙ‚Ý&xṑ¢AN–*öHÏëlˆ‘"…ø]•£(óC pývQ\¶•í–Ñ+3™llMM¬Æ—ôlc8Š—;`Óùóˆw±f±×{4I£ÚòNgy“=îg‘édè²…rŽ¢¶xDµËÂj@Ùô„P×£ËQù‚¤1×e«9ÌwÈú*'öš%"1g0°M«Ì%<@Q1[\x´°?ôœ¾¥wâ°Û¡„Bx~“UÆFôàÖÖ›ºc>¯ê’W ßåÍ @ÄRË×Èd0ù¦µJüqlHHvÀkÊb•! >ÆÎ[|/éÜ€Yb2r -ÚK܆=óµCƒ€¸lö`ÌY‰¼Ïo³•0F{x€TG‡Úyà›&î'ˆï%rѪæW5Ä_1ïŽs# ²^F†º¢|M¦„ºë‡VmèˆUÚ Î 64QúNÃkÄf~$4r’$OÑb¤ÞöQŽõôPÛÈj‰5ò"âLHÏ _yÎ#É9kŽ<=4õ“E*ß8 -Øáë÷dÂE6äv²SS]5ºö‚ñ zç$Ïw¶ø‚ŒÓ¼ yôR¨ØdeÉ#ò°¬L Ÿ*¬ 1@3¤¬³X?E ÏmEâžèíÀ{/{ñ79OY^0¨ËõØK¿àÈ_šµm¶:ÎÅë(U4|+Ua†{aãÔ !Å í¦Ax1±Å†âfàRŸˆï®¬{’’¹8dÝîåYrú®¯£gi00gDL“«0r£ Kô>Z§äbàòE•íe…‚˜NØAár÷HºHî8Gê€0eánöXšÃèþæ¯:^Gà [ûì{Ñ€œL¬ßn3ëÁaÑHºç5v%Ú ’dL:vkÈà :p$¯1Àƽ¾¹¹1‰nZ—ž5à„¬3„úôø )´†Òb0JHaå=ìÞ\£†Š½Nà[¯9Û~o]B –ø#?“Œ?«zϱoìÆwŠž“aQ¾ÞpZÒí81IÍÅ8¬êŽlU<æHÕæ/˜eYß“øP1ÞS $s`H†R1+‚Ì«õÈiµ!QÎ[ŒÕY_vry2bÉùu¾óò‚¿¸)ɉßxóUßPÚ„ò=²½ÿé…Þàã Vp)•Ân(±8SâZW2–ÎÈÓá& ôÇ’b×K“‘U¡“i¶­Ñ’¦læ¥džœß¢÷Bñ©€²üó,@©evY7A¦€!Àò5Ï¥â±ÌòS²4ñ‰ö„.–€(¡ -¹‘³;zïˆ$Iíb­Ÿ)ác:HY˜CÊK øC*饬ú¸ÅŸ÷Ž¨=ëeÉë?1èÒ´Ýå¥ìH¼Ûg•¥Uä|ŸWyCŽ ¾w¥>,Ö†ߊŽc!RE¬ÅAMA–CÐr!BUˆnÉ$Ϋ$go97YÄï¬xŸgèÞ#O¶ÅÄØpi?–VŽ¹tš8¯E"àX)”–€)sá~ìAVOò“–áîLî[œ ™È¿”=dr~Zœ»|”H"¼ÆRzá;£ÌŒ(šÅÖÛ$!o(ÁÙòÙLÀ¹¼K<Ô©ä@‰èÊ`0`}ÁUk65Ä¥j_Lø¡D‘Ý|D É›F - œu—ŠµöØšøSoÑÑ(t‰Bç;ÔD“£dü)‹VzhÀ궖?ÌJ©$ä@uE]‰;y.%jÜrû4÷M¤•ØËZ|ÉSýžY˜Ç7\5Ú:UÅ qöQ;ž£¤°r¤r‘21XnÙÊúM£/qŽ£ž<隨«Ü=¹³5êS÷åz´„gY}%ë¹DƒÛØÀçËiôûzk°À¢GIqA»Ù_u’‚ìôTvÌÝŒlš¼ä -Es,¸W+¨ÁcÖ P7 5 B®iÄJ˜Ëú!Û¿ÛÛ¥ÛÖ¼Ò·ys‹®ýiýîCŸcæÏ€¸r»ÏÖ/üé+MoÕ¡›øÓœhýx›ï¡R­P"|O˜nÛ¼Ì13÷¼ã„§›Xe•wïàca0À«}Ïs‹ŽdN»Ü\9¡Ð¸îÌÞ™4óû²¡!`¢oÆE´¿z´ŽñÜ)›£ÖþGjÿ¬ÁY -sÆåkëq‹h°ºˆ’Q+á¿œkóxCy -wú:Û(X3j¾Ϋ:›áé(挣 #ÛæÕ¥œ¤†pñ£ éˆyÀR³j‹ô¬hh¥é(pØ8iwÃ_¶ý~H…ul²qî3“ ÓÆãgˆšÛ~Üô³¿]à™MFoõK`ïîÂCWuÓäãV"åÈìç0”5‰j¦:ÅZ )º.e6?ôI‚ašk-‹e/yL½5Õˆ>7xl°•tg%Ý"ƒUcÆTNR¥Ë¿ñ‚¸i<ûûõƶ]|ú5mh»ø` ~¿_¡`—1 µçà/ÕÕñ Ko ™£ -D„ÏŒ"盺’Ž^ÖMÃtì3D{1ýÐõ,ÑÌy›ÆüÀÑÇ”*ÄfWYòo6i‡¾f¨9 -`nŸ“›ÜÄÒÖH9\Ô‡%iØ$¾Ð¼4M·P 䚧¹¯Ï7¤EH9ü5ï³ìa`+ªK?Ø¥†‹ „|o¨öãœ'ÜG œÍä‘;GGÞ£~!i¹)…€Y+;ž·Iüˆ}¸´—H`NJ++1¡Kˆ«ÜáؘڊТÙòEÃoäd½ÜBýŒÖ(ÈVÒK:ÿ3›þ¯é`5¢C¢ÒËŠø†‹ -ÓSzC•¸!ØÒÁÿ»³[ßendstream +xÚ¥XKoÛ8¾ûWè(kE©×5i»p‘GqÐÚK±…Ø’+ÉIìßyQ’c'=¬ápH‡3ß ©~ÊIBÏש'ÊÓIâ,·ßYAÏß%&Ô^h Ð':g¶wžoâS2¾3Ó‰gÂ;Ï“³Oï¾EÚY<Ð"ÿæ‘7…¡ïΧʭºbÕLgÊͺ›«éLG±{uË߯À+«¼žjß}n‘¹×(^tÄšjåRgó(½Ïe·žþX|vŒï?vfñRøâÊ·Ùö>ÃÎÉÇÅXk9½¥æ‰û©ÐQ>H§ã-Ö%¬n`õ¶X¢v]YWÈÝ6PÐþ6@‰éHÝ×Ô×Ïon™QOƒÄ}¿¢aÎ%.¾œÍ¿p»‚y²mÁ3u5mg†ëå]´•›¢Åf½ÙOE9åÂ!$F¹óù‚kÖ{Yì6„í+8övùµÄa9iˆgaüÐ]nÊ¢BF'ŒLÖFÅëiã’YhÝï¾2«}¯bŽýš7rûV‹e@ì 6ÂòñÈ@0dÁÆIŒû3ºuQY +ýGT;<˜ +¶2ÃyÚuGû6)m<Ûí kó‚¦HSüÃ9oÛe›M6Ø7 ´ïïÅ郣÷‡_ox‹äÔï£`š,„D-3_à?¸³ºeÞÈ°GVKñ6Ööª[î §µq[[Š¢Z»Û á…ý<èà;æÉf¹AƒoÃ.i·ÆsWvtGnEãšÇ +`Ø®©ïÑüÅ–†{¯ãW™Ð‹ô8õb?Gñˆ© ö1ÁÔ èÏÉ·¾“ƒèç‰ÌÄyÚ÷Tš:Û‰QÆSFI{3¹ü3†…ÝIøæ<4ʇy˜²â‡ó„€Ç€) +àÙô0öRŒ¼f®kŒ^B¿ ¦ž14ƒóÓÙLšjîѤé0ˆgó­r>Ô ’3h¥S/ ×ÚK’`@¿äúõÚa”1DéF'R‹ `³Ûas1 "]ÕÝš0eÅmtüæòe˜DÊ.²‘ºbîÙ¾îüãݹlŽ‰›Ûž šID˜H»—ó«’€5Û Û»¬Y梮º¦Þpã»ú—Ø}”òXü¦âÎ-J^4¨ MA¤°[ã¥)Rv,QJ{]®Ö2ØD]ò§²ˆ< ü +mÈê¾bº7‰TÉD€¶·AÔ®kñ£¡‹33p°p¢*.ÉÓL(d½53;¦Ñ|«aò–g°z½*ISHÿŸØï5Bºø…²%Ï ÊÕRzjJf©Ûî—k¦2þìÈøð|Fœ6ÜË;ë…—5A >;žL[©r¢LÚ‰ÖG¹r[¶Ö¥výÚ$ ¹© =‚1¥žÂz%¡Þþ SfT‰vf8.ý3 ›)Íæ +”—0jž(“ † +ýd\ùÁ”ÚD¯*? 8t÷mEÖí%+pñ–¡u±î;/ª ²~kmuªàŒŽÔûåÙU‰5u%´®n9ò¤´œ*.)ž%)d)ʼn ÷Q"%·Öñª²íš¬#ÁÙ8çòT½GxbÕ( UüÚ³&)räø6.¦¾Œz¤3‡eÏÙ±öÉT V§!M™à‡¾-óËíncçÚJU&ël‰F²˜ýSQ‚Cî®çÿž]–$·ÿÅ"õŽ+ªfTÍ›ôâ•ÌŽÁ¶/ËG2Ò3GLA5\Ê–îÏÍ®ÇÓ¡—CÈ%—O—¨ †ë{G†‡G†‚SE:(àŠ)ˆu|PÈ¥ê†J¦ µ¨$nÊe¶,{ÿ|ÂA|½I¡¤&DéKj”„ ¾@óì>{;»jÔPYa¦Ê¨b£hˆJš™•j9ßP·FÊ4[ÉY¸AŠ•X¢¯‹†Ó¡( e–3ÜtäÂÐu¶ë°4Ð (Zñ!2Ú5í§ã,®ÓH‚Å\·´÷.KA®£Xf’NˆqüÈtð]O¥N~>X»¢Ë+Ì>HÊ;‡žá‚5T³lèD.¨ö”°‹è9ŸéQŒfyNVn­ ÀÖ¨W32qÆ–cN½ ÜÙfZì:f8_ОJJÕ8º½edšz ßàO|êÁÝá· ÈŸ‹öà™«¦Þ[pŸW|gßâátÖ×êêÔÕÜ‹“ô­Ç†ÐS*xûo)–‚Èì«RyI²Ó WõµL'ê×äàø 2ïû\ˆ¤…vǘі÷RS ÷¢=!ÑW|…“uò‘‡JžÑoݘ8òA‚Šh˜fß±~&([[B›ö™†G×Iä_'‘;\¼=žÂVÝ¿Cô AËãï>H­•ŽY@Bã(Œpáþ• ˆy$‘Ýqz±û5P”j$ö­E"Š2›SšÅ#ìR:宇ºaâàmÿüÒû6 m‹æ©\r“™ r¿Ž.â2Ù°™•òñÍ>Š¤ oc~z’2”Ý.g>Á%ȉ¯!ùÚ§Q }š)®Ê@lCñ:^÷àýGáŒNì ö׎yáyúWŒ8ì³IŽ›Æ„'y³’Plöm½:UñÑÁ®"äVô”0ZšäVHdlý>UÒÙÛÃÙã\töØ5¨ÃïFo¿K¤®Òêýw +«—DÑ{²J¼0å›ûÛ°9çµ>̆¯žwí÷\©=endstream endobj -6561 0 obj << +6898 0 obj << /Type /Page -/Contents 6562 0 R -/Resources 6560 0 R +/Contents 6899 0 R +/Resources 6897 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6545 0 R +/Parent 6887 0 R >> endobj -6563 0 obj << -/D [6561 0 R /XYZ 85.039 781.388 null] +6900 0 obj << +/D [6898 0 R /XYZ 85.039 781.388 null] >> endobj -2282 0 obj << -/D [6561 0 R /XYZ 85.039 134.952 null] +2366 0 obj << +/D [6898 0 R /XYZ 85.039 761.463 null] >> endobj -6564 0 obj << -/D [6561 0 R /XYZ 85.039 100.813 null] +3220 0 obj << +/D [6898 0 R /XYZ 85.039 632.606 null] >> endobj -6560 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F35 2976 0 R >> +2370 0 obj << +/D [6898 0 R /XYZ 85.039 387.934 null] +>> endobj +6901 0 obj << +/D [6898 0 R /XYZ 85.039 352.623 null] +>> endobj +2374 0 obj << +/D [6898 0 R /XYZ 85.039 225.669 null] +>> endobj +6902 0 obj << +/D [6898 0 R /XYZ 85.039 182.716 null] +>> endobj +6897 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6567 0 obj << -/Length 1924 +6905 0 obj << +/Length 2203 /Filter /FlateDecode >> stream -xÚ¥XmÛDþž_©  ;ûâ—‰W8 ˆ–BS Pql_²ª¯séý{ff×o‰ -UuÍzwçÙÙÙ™gf—ÏüãóUà1Ï£÷äj5OË›oaäû·3\;ÅÌy¾ž-¿ Â9g^Ìâùú¡Ç dèÅAðï® =M;‚Ûb¹°Ës<öB)»qC4À)C‹yºò®y+HF’ߎÄ~--Ø¥‹…±ïEq1>áÁ²Âãà``ˆÂX@ü€Y_~f C§ZHp%µUû¤0=º!|ãW„þñãþöŠÚa,h÷ÔÌ!µåDd„~ä10/ªýìó×w/]î± ïxû³Æ°ÀÆk¤l€žj{¬rdêzP…õPզѴra<í¿0:¯ÄÑÔr—}É<Ñõ#¬ó¿ªÎ!g ]ðÎÓc7ÍœõP8øÙ}EZIŽwnàd&2•ÇÃÇT4ž{P&ª˜¿­úåŒ=wIVL»Ì‚º¤iuÜ7‡`µjPqUæÓ–lE%Ø-.×¹ÖÊí}Ö:ŒE ‘ 3‰nà,o‚­OUÙÝNè‘ÖIú¾P½aÁ±ê§¯åf&ÂÿwBÁíûñfl÷S®2’ÏG⌑ÄUFóÏQcvÚoÍ×Éû@Ìý*Áñá†7@îérO±¨îI— áæ@iQS‚¼bM8.ÜføÁœ«E„„Bƒ‰­=ªª 'V”klfÔ\øY¸¢" ·Ë.`öã"à,26E».ž¡„bÃ|êdTñPדnl%@XjŸǬUó«ÖÑ$‡Øìø³å†ê e›ÿ—¸¦Ú,M­äKÕŒ©F@ü,ݘ/=?ômÔ”ï€H š)2ºXyhm¨ØxV¥jôt8s§‡wH$Å™•ªw•nôÄ€nj»æ4Ü(ð;©m]nw}ÑòŒÒ ¦¹IŠ½Ø1ªôÐêøD1V´o_½ømù“" ìþ0uoz"u›¼„Cý•½…3A<vQèù -óÿ´×—Êí±&B/Š½ÈÛõn„^À&ÈÓ·ƒÞØn«¦üô¨º¢4Ã1Ö½w!Ôàðó?òZ·FïÌ\z¸iÒ{Ã"¼é\›Œ™—ÐÆ ã3ÜôeBÂã©«ü™û¤wÏþB"½•Œ§íØouAsËëÛ¾^(ü`­êendstream +xÚÕËrã6òî¯Ð‘ªŠ`€_¾yìy(»Öx-Í:µI4E[¬¡HIÍŒþ>ý(Ê¢gS›K¶\eÝF¿ÑM5‘ð§&q ¤N&Q¬„ŽãI¶=““'À¼?S–BNŒa€¨7«³ówA8QR$2™¬‰dµþÕ»úpy»z{7i­=?ÓYÅÞ|±zû~ª¼»Ëi¬½Õ|ñž n–ü{?_\œú±wo‹·@½ºGÐÇ»ôT«¼Z^Þ¼¹œþ¾úùìíj ßÌjðËÙ¯¿ËÉtøùL +Ä“o°–B%Éd{f-£í¾<[žý«çÂ83áS#f˜ˆ0„…4¾ù×)#”Q£×ÐJ*áÿU>tJ^9òc>xmÇB&~ï ÐL”I ´¨Á²Ýt¦¼|Ä€/’ˆ,8ù2QBš$ÑŒ¬IÐÃ!œÏ·jr]ƒD“ƒP:>D‰ £T/–ŠGâæ~“£LÕtfdàí@Æ÷,ª'†Þ}Q­a[cP|CdËľ”’)Õ0´L»Ü.3$.‘ßѵ?Â×^ñÈ ‚woæ@òqÉ°ú+-‹`®nÏç·¼-Z¾°By:´#9#'!uÖE›î¡Ì×p—ö¥×mrPN«W¼ÈÊÂ*MAз¢,yµk-Õ§ë[^Ç@íH‹â12lЯø“!+›V¸.l”E‡áTPp¦§œG1XÒ…^4(¹åþȿ׋%ß_XnyËdÞÜi ïR†ÞMÝvöêÊñêÀ» +ËGQWyèÚt<ÕÝI+)Ö–TÇzÐĚ₵wµÅ¡¶Ì°¸× ìjŠn4BŠä{SM@æ7K>z™qB­[D_£H Ý‘uucO/s0¹ 1Æúå5"92‰tC“Ù;ÙŽè½G3¥[W®A$m@X’ V50¬BJu”¶ÏvÀÞå\„ЛÍ1‚v5^¿n†Ò.ï¦J)ïßÌòiîPvÞ§”…°8Ü:¯2¶ÆÖF%0pûOm«nVØ›4iÕ>æM{Zñæù/ïîz+Iï“ >ã+ +>^¸ºå €+kNɇÎaÕ¶ÛþXçkÆ¥–&å#dx4Þ“¡sóøÚmZXÝ(”éß“dƒØo¸|º1«-Am‹Ûi°"´O?(jø~ñ!Æ}›bŒã Ÿm&QdÖ£«¼ã÷¡§²lê + )Ê»#ñ0óÄHsù" +¢ñÖtæ'B‡‡&ðàüa}‚~Tcæ›Ä[PÂnÝ3FQXcâï:È$7`¨áeÊ?·»Æžú´˜ÿrþO¢Øá¹ï†VeªñÓ`¶r=¢ ˜=~M b+óãB»ÚX|&ÿìÙÀRe²2O7\Æú׊ +TkíÎOÿ¡ çöù*ª¯ KÝÚrÒ³K›übL5)äøü ÀúÐ’Ê^5xrNU)£—la åSD yê1sç]v¾Zß¾ä -€ð¡áÅ_™üÅn0.¿ +H’Çÿ?áÑæBôäo(zÕ¶P¿³ÍÅ!Ud^+I!¤y|T’NÆ1.IÊÃ'%äBŠ$N^+J¨ øoeƒ³ù¸su•?¥2Öºv–èZ×_@ÉSöýŽ-ûÔuÁ/uqXÖkj?ˆ¦ÍÝ8€× :¦¢jâ ˜´E¨C]a À<ò*€~¬¬³´ÜPûøƒ­ Õº¦çðô•S‰/T …ŒðàCñôP_vyµOEÝ< Áö®´,ÒÖàž¤TcRFƒºl`¸ âkGŒ¾E5Ô¢žªE8]«×…0‡û¡¥$gOìéÒ†«yAÝÃÐ&°Ïyc]cŸ;.èFÛÆ"Ã癚ݪh·Ìĉ´†´e6k ±C0¯sò÷š9vi`cacaƒ]E{Ïi†ûÏ}ÓQ'ŸôtšÔKÒíCOºoøŦa‚›K·>>6IÕM؇Swn׎/EÜÏèzÇóù ¥½­Oüàb/yäQ‡àXaìôâcÞ’ÄÅ–âÉÇÎ# Ï’È:¨µbl(’­d§îg¡X)ø·FûÀŒçJJ4®ìkPô@²nÜç Î΢&Ön‚|7…‘ÜÑûïéö¹tqô#¨âbåµ/Ýi +ü)uy«~b?ˆÁÂÄü‹ÓvÑYl//° ž4TÖ ­3r2ðhì<šx”¶ûçCªÑg€=#û øù|ÎÃŽ=rÒséµh¶.žŠŽÑ›ü;å ·ÑäßSw±³§”÷Ñ‘¿mˆj[Œóç”G¥ƒK5*œxG³@Y÷eç‚fäEœ_ÈôBùÚ\6Çf-?”"|­Ù°ÿµïì:*îµÿaߢcýRÄawèüŠhÍendstream endobj -6566 0 obj << +6904 0 obj << /Type /Page -/Contents 6567 0 R -/Resources 6565 0 R +/Contents 6905 0 R +/Resources 6903 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6545 0 R +/Parent 6887 0 R >> endobj -6568 0 obj << -/D [6566 0 R /XYZ 85.039 781.388 null] +6906 0 obj << +/D [6904 0 R /XYZ 85.039 781.388 null] >> endobj -2286 0 obj << -/D [6566 0 R /XYZ 85.039 719.731 null] +2378 0 obj << +/D [6904 0 R /XYZ 85.039 546.53 null] >> endobj -6569 0 obj << -/D [6566 0 R /XYZ 85.039 685.588 null] +6907 0 obj << +/D [6904 0 R /XYZ 85.039 502.779 null] >> endobj -2290 0 obj << -/D [6566 0 R /XYZ 85.039 442.27 null] +2382 0 obj << +/D [6904 0 R /XYZ 85.039 351.711 null] >> endobj -6570 0 obj << -/D [6566 0 R /XYZ 85.039 406.005 null] +6908 0 obj << +/D [6904 0 R /XYZ 85.039 315.089 null] >> endobj -6565 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> +6903 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F15 3032 0 R /F20 3021 0 R /F41 3054 0 R /F35 3036 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6573 0 obj << -/Length 1396 +6911 0 obj << +/Length 2922 /Filter /FlateDecode >> stream -xÚÕXÝÓFÏ_a Ul¤zo×ëχ>pP¡WÎ~3;FZþH+ô¸P‘„’«0´Òj&¬p~žI#a{"ó,ž]¼ô|K -‰ÈŠ—{=w=eÅÙGöüÕåu|õ~n+¥˜ãñ¹!»ž‡.»|KÔg—7WsÉ^àÎ…É^ÏmÉn`¿×Ëgâ«$|9wBö!~uõ.~ýy—¨*Öb¿Â‰wóOñ›ÙUÚVFhöçÙÇOÂÊÀÅ73ÁUZ;X .]ÍÀnî¹ÊìËÙÍì·Qñ\‹NŠ’§Bî…ê8LÒ;&OpO¸:L‹¹í,ŸÛ.¸—ÖÕ¶(Á™½ÊèƒpniÝ"};‘,-– }[lVÄïÖZSÀþÞÝX6,©îÆÇ îÈј{¤¸œmTÙ]ÇÎ;‘à.„hê}[ÍÁØ…6PûÖ’ù5Rº¢Þ˜ýn=eCŽ6=6›ÿ]‘Ì y‰úpõ´E‡/^úÎÄ…\@…¾=­7¿ é®úFk×â&Û®€ÄGeK@D6§hGƒWo;€µ®Ç^ÎCÅêf@P¬Bš”ÁcÚLÌTÝT 2;XƒwÈuý*Ö­÷'Τ ÌW(ŸGž÷¸”‘*{¢ë8eJHîCM BçR†^T5À2ÐJÖ—ù@„òluÎr’ÐàÄÊ´%¦²2ÉZ—DGÇnP0ä ì—>÷E™©û&ÕŠ.NÇOº„+pw…ÿ¨ºì‰²ãJ×å!P¡sÄ—Í€ò´«›[¢ÖKúЭòq²EB,­¤Æ0j÷Q"ðiz‡J‹Eo -ŠÌÕ̽ˆpWÜP ‘O~¸¾|kK.t¸ÅAœŸ@:Å:Ÿ°¸Æ†Ž (¨eå”t”> -‹ÒH-uyÀ¢ÎýYÖ«bó”6mÞ|)ÒüäuÇ´¤‡x@Ù Ášüs_49tKGÂv›T´Õb›´-okÒ½©³¼Ln§zÌIšÖý¦ƒ£>ˆ}Ÿ¦|yÛj¯¯ -Åvu3þ6]w(LV z:eN(™nFeY#ŒvúùpBÁŠ–¸Ý 6>×ÈÕÅ -JF]ñf2l$©nÀt#=¡½†{Ói_êQ) æ#Ö%YØÛ¶Ëu åÔëc\ôã™,_&xyÙÑP‡¥Ð¦¥¸‡ÄPMlO4'‚EZ³C¯ö÷7£Ëž(;Ñ”ÃÇoÔùÖYÈðÙ‚Œž¬P7à~èäò_©Ð6©É·U¨7)Påµ€¥øÝ‚·{ðöÄ¿L®“¬ÞÑ:é³¢;ÕÆ -¾S*'¯"-®ä‡¨|HKïa˜z[eÞ½µü,TyVq±œ4@i…Tå_“j[æ´XgyZèzç¢6ÊÖø"!w±2së’lPS¥oG½Æ­'í¾™c‘…5štÉ"å_Pn˜ê´zD:œ) û¨0¢ &cQ5ÚÆ ‡lºaÒµÐL|éè)±Oñ8Â3 µ†HhëÌHMÉGµ­23b%½²Ä£ƒGM\`eì×"c¨#¡‘€§wñ°6õª¡!E‹$ÐÃŽ!´C_Œ4`³4ý,)K=Há|<ðóÉD`Ò°3Æl(go’¾¡ÉÌ ¢3 º÷Â&E™u²YåÆŽ~.F át˵9qîÒ‰ÓØÞøϵ8ïžä\‹{øsÿ¿naçܤpV ÌÆOy—^è8ó숩g¾×•àNtêþ’aú”ÿ?`ªèô#í9|϶` ”/ïÚ;|òüˆXendstream +xÚÍ]oÛÈñÝ¿BèD4—KŠdîÉçør¾6Žë(HË=Ð-I…¤êèï|ír%Qiöá ÜoYMø§&iì:›$©òušN–ÕE0YÃÊû %Á$òƒyŒK?/..‰çøYMO„²Xýî]ÿzu¿¸y˜Î´Ö^8÷§³$I½Û»ÅÍû©ò®¦©ö·wïáÃ'þ~¹½{÷q¦ÞÜÝöâ ‚>>üÕb-~åѧ«?_MÿXüvq³pø›E~4×Èà·‹ßÿ&+¸Ão¯³tòãÀWY6©.¢Xûq¤e¾½øtñwK…×¢ ïÃÌ`Ìtà§idå¡âyÜüïP´¯ÓY˜h¯.zœ¿LÃÄkÚg–5Âú¢}‚KçËéLy®D^…x{€vì}“#:Óe´œ?®v-°Õ +öµíìà¢0ö®:š6ˆâÑAeÞOé8å­˜ü Øoêzœ:ï ³0!Þ^ðHÇM]àƒá+)”_FâiZxÐX{Uƒ´pt‹TîqR˜›ÄAä-6…ÙQvø¼zJ7Ãakî´E‰öeSw¼ÒŽw c ¼á)Š¢æ•\¾·÷2GV–\'GåõJ8d4+Z<Ý£¼Ÿ`mô¡íˆ ºýÙ ‰ÉâÆr]WD$óz:<ñr¾ø@­ìÛ{e Ktî­ÊŽØòÑ£š:o§5ë¼ß“ Q¸J{WÈJÏk DO®£‡¸‚‡çÑ–%£l £˜pÏ7xi@Únåœí‡MÏ®$bIJ!=ªq_ ezDb΋R`!–cp¶C¡ZÃAˆµºåš`LW»Æypd"e½†ë§éÜû„R­ÍÉBÑ>±ìIþDƒÿ +b'­ ¢S/0 +±G›zÊ9Yèå Ö5{iŒç&º‘›4970'F©0ïS8o€µ«£Ø†Ç=0C jÆžèT ÷ä,]ê0d‡" MÈà|¦´!_-9¿ìgM[ºå¾¼ì¯ +Ãö†O¸Z”y9êóàÞaíÕAùºEŸ…Ë÷'ïŽh_ƒ8øüî>JhøËiI=Á)bwö ÅTØ4Z¥2SИssJ¾Žß¬c ò%*u"@æm…Ù|Ëk#é6áñÅוM…x’1uCšSx€(9ÿ QéXxw?Ì÷œ7erå ùâ-pÌqŸ‰c E-QAóऩs†0”µXžœ|.ÑÚ¾þ„Š"VË;¢[ó„ƒ;?µ\aÄë͹Ž<©€¬1Gú$›Døaývä?ÄyË1GëN”„ØgO§LÝM„Ù?¹ý!áîþDr®„‹šœOEXm˜ +3#™Älˆƒ—ÍM¥…¢P€-úÃÞ͹èÙ¢À–ALÜÖAzjë }šžLJí¹­³µþ‘x@Qž†àPù þ›ø¡JÓ §aÂ0Là”´geâ3Â{É7“€»"lœ¾»ýÇåßø.¸ù;ƒ×ìÖ•G‰ ‚J[Aõìn8¤²–'Š…LÙ•ð¾Š6–6s­8KH•ŸÅ‡Ih%4¡M ¸$M‡Ð®Sí¸ªƒLÑø¡¡P>pg°ÇicÃ)x¸é‡ù"pjž±p$oÃQjt »Öæ϶É`ÌV­^_O-ùeSJR&ÐvÆâ`ðh0~®ßHT(N_y£mÜžt"ÊlM@VP­š€’J †»8«äñÆmŠíü""¿ZV¶¸ldÁñŽ}Ǩ¶…IÑxy‡ýâÓœÂYûX!Çí–RÔYŸÒl÷Ô”h¤ªãkKoƒP¾—N“Q‡BùÉ”ëÔ¥š ª¡BÑÌÁv/ “¶ê”dåÑ[—Í x8·j±YWnóG*Áü‘ƵŽc?™wÝA¬¾æEê3‡FËÝ>s8÷µäC,àÈ»P=!ŒñiäØÐÏÎõú!ªû*žÿ¸»½Ø”â`¢á¥­Rå$’·­Åv¤iSGBÀiI`Þ–ŒòvŒ÷ÌO€›æÈbŽ%‘á=R#¼ÇÉ1ÙØâ˜7Å%—æyÈմƨ’Áª1:)àëø +7òŽkk£oh[äº×­ÇÜ«`Ü +mãןONašXGŠyuÇY5‚©„¯µ]œ¬$#É’ÃëÜo¨'£nÓì·’òÁth¶¥Ÿ’?‘í}¹äÎ)ærœ¹ç­³ý1éǃ²³¿ö•âáZhøkÕYÚ‡gš»”9åÛ-Æ4¯0ap­Ãæ-¬‘8ã²=Îtã9§QàÏ£?£ +heTkn±%|=øº-ZøˆSeŒwÆ°ëÎÒýä¶Ì‡ÞnÛ1"+Ž*óëN†ž(I"~6(ÚÖð×mÐrà©Fžo9£HÓÌÆÔ¾Íënk~åGÈ©yÞSÀ>ÿ¾:ðã$û?DíFTJ)ü`PÙâÇðk±Sç PGÚ’Æ~œj§geÒ ÆÁHv†`N)òZÐM»ÇŽ—eJ¬Q6—ª¸ïí/F°^Öcù¾Ž|­ÜHœ=s‡ °NU,an"«bÜr[Ì“é”rå?}±ÂÞç–¼…4+5ý^ˆþÁ~»-9m6À3ÍHÍÍE± .!«[¯Çôç.Nmo•c+8Cã„\¤Y±I‘ilj9Ôb‘Í æ#yÁØoD"G4îÑqµPp[€n™€Lu?¢ƒɘV^b¿ìM»Y)»·#ïŽ_ ý06¿\¯°5‡1yïîÍc9Úý©ö[P)Âã‹™R‰¯Ïä`Bæû{øPsÎZç}²N£cÝaü7ºTH‘endstream endobj -6572 0 obj << +6910 0 obj << /Type /Page -/Contents 6573 0 R -/Resources 6571 0 R +/Contents 6911 0 R +/Resources 6909 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6575 0 R +/Parent 6887 0 R >> endobj -6574 0 obj << -/D [6572 0 R /XYZ 85.039 781.388 null] +6912 0 obj << +/D [6910 0 R /XYZ 85.039 781.388 null] >> endobj -6571 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F35 2976 0 R >> +2386 0 obj << +/D [6910 0 R /XYZ 85.039 394.744 null] +>> endobj +6913 0 obj << +/D [6910 0 R /XYZ 85.039 359.334 null] +>> endobj +2390 0 obj << +/D [6910 0 R /XYZ 85.039 207.19 null] +>> endobj +6914 0 obj << +/D [6910 0 R /XYZ 85.039 171.78 null] +>> endobj +6909 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6578 0 obj << -/Length 3316 +6917 0 obj << +/Length 2060 /Filter /FlateDecode >> stream -xÚ¥ÙrãÆñ]_Á·€U&˜ÁàHÊÚË–+Þ8+nmªl?@D"ÆA ´J~>}Í!;U[[*ÎÑÓÓÓw76\ð/\¥Æt¶JÒÐ×iºÚ5WÁj;ß]…±Í æõöêÕ{¯ÂÀÏ‚lµ½Ÿð?2zµ-~öÞ|ýÓöÝÇõFkí)ã¯7I’z?­ÓÈ»þ‘W__ß¾[‡Þ[œEðz7ëMèÝÂ`û‘†¯?mß½eàëµJ½OÛïß}ØÞ¼Á½kDµ%°À‰ë_·?\½Û:ÊM@e†dÿ~õó¯Áª€'þpø:KW0ü¶›+ Û7‘–y}u{õO‡Š÷¢ŸZâ’…Ø(€QÑÿq0Ïfñº`µ ‘Ûʼˆ‡N€‡Gü“I2?Ñ™“]­ÂÐÏŒAÙe…À§(ñ³0"Ù}耡#r¶|ÎUŽMä¾Õï«Ð¢,Ó 0íÓ›háÕM®Þv@äjF§ Ý8¬De˜Î4,T™'f•(„§D&(êEè>©,õòºîPKžø‚1€Ž~«Zîy¯»—3'|ê¡lÇŠ€z¬º–w›×v\m«¡ÁÙªBÞ0¬¢ 3:\Ó­oá'ñºÖª;Ü.ttp'ì›Iî¨F½®jï׈Ô79ÓE±×Ýy…ôm/>V㡲¸EÉdl¸ÚX²R8z§Z€ÆCלö†CÂx]itÕ—‘Árâç,Q€™|4Êâ-°1Œùî7`c¦Ø`¦0ëV:‚êËû²LÅ({Ó°;±„Z«¯“øJ˜x„&òžpÜ!Ý‚÷˜¯Uæõ"{zPN Ÿ¿ÊУ†'V§²A™*E@<=Ö–A/Ò¢’Л„Éóž"­Pmp¹/÷LAA2Þó*½ÑÞ]½ñKF¤£¼¿ËI¡î*$ª+ºAP“Ê'Á¹ÙÀ:ˆëR† NbEeûPõ]kŸ –B ¼Û®)äïU‹¼û"ÖÀlqrmàë/“â Å™¾·{¨„%¸F â(DŸe•Ýnsêi|÷$>O¡=àïkÃaOúmBUr*çŸý`m‰T{º—A Ï_ЭF›`I0aúx S¿F0×f†l!8$‘Ÿ&ÊÝx&"“UwtcYð™³7(½²L$#ø—PNèå«Áîk`•‰ ¼;9÷Ÿèhc«.¤áÒ½u!Q,49¯YY*e7/¬É’¼+v_èìI‘ÀˆS@u-ˆ1€Ìoe|h8•EžÖëê^\{ŒÊLÑ#ô¾a/[>!8Ü ?ZL¾‹É&~ ðòßÖ¬Ó,›B©fQnHF ›z€«t¨<kê sŸ#ƒ•'Þ}Äq.¾8¤åM…Ñ’n9È`îq¾kØ/MÃÉSVäÑ©·zÚåCYi«æùY ŸÿÂåe ,Q¼šås_‘b - z.­ýª”2_0Á?*!ŒIýXMÎU³4T€Œ6~’p -UƒòtÕ‚Bßùàç ’é%•)®&`ò™ØÚx¸?õNF UÑÚ¢ìÉ`Øå˜ËŠÇàq´xŽ®Ž#«Ü8ÌQ»cíuG— à”\r, -Ü è§wiˆâuMŽÞQI -ôÄKâÆß[åƾÚMQ=7¼ šœ5ßw³hc³a"G¨EEì;A=Âä ' -Ù%íRÚ‡z=)~'ÚΉŽº£ `JB’ön?¯C°ãk4¹íß,R•øAÆH?;ë¡”\Qu‡SÅE- ¸Ä2¢õ2ª,”¬[C¸Ë§d\OÉ)âl*x”ì½yã—À•oÉ¡$(ðþûh½ÙxØ@0 S€n¾²È,ïó¦­@|”¤Õ¼ÂG- ÿÜÕ Ü}<@ø¢|XÅÄÜH¯íF^˜q%ç•á@‰n]0d'©ÂïÊ‹ÿ2ð4'ÆíºS‹ù°àÌ[9ËI9‡έa‘=²:ߟe¿‚¢rÚ šù@nݪ&Ôqh1 -Ê{*ÊjÊ2o¦ÿ‡µ8õ‡ŠÕ+cÍÕ™dD™wJ°§NC -Š/໺Ìe8–_ä†ü4δ é—Z-@T6cµªŸäH[0f{oµoɲ$ð!Q€ütö̌ɔáâù®_`ÁÀ=ÅGÒjr}Ãj"ü~èP»Tj$»ÄÑ¥±Àb^SÂÂÑqà5!¿wõ¬MV‘gÒ„`_’œ®5k:U€*Á©Ùâw¨ß²Ý\æ»þé(Õu’H‰L„á2¸xó[ü‰9ø;åBýÜrÉ‹È.Äböp’Ü1*™•§8¹(•å“»¼%nÉÙe‡RµÁ¤îÀ©¾Ë!Xˆ¯&Î¥ÝäÀ—ŒXO^™%?« ´íUðU­Ë¯ÞmKñƒr[asñÒÖ×CÄ8’×dÚ,¢¼Èaÿ»¯'ÀsÁìÝÝIã!ÞHhòÏ|<÷qÞ:‹ÿ+v¢¹³Â;ìô³`gÑO1A¾•çv/~AífÂ? ü3˜ó­´¯“ø,O‰$OùX6¢ycïÍÍû[NS®©œcÂñ V‚°ulÍ3ÐwU[þ@Žå…ç¨Ðþì9Ì‹yŒJ3_iEϹ¦â’“Nš ˜IÍ’Û qmIœn±”ä"ä<® ¦ïØŸ—}Ï¿§ÁU‚×—…Uü¼Q¾ãúõ8ºˆNwuÏïdu­ó‘=Y³TØ~úpó/Ð@pKNÓ~GŬÈ¢Ô6 `@F"o ˜²•ànÎS÷šUŽzJRgÕlbrñéæ-¦¼Ó1.%dˆx˜]`¼=÷îŽÏ/ˆÒCäßÙöú[Ú4áre_:'ÍÑ~êÀ°IvX%ª,D 9Ö²Uq çìËžF -/GÛ @8;I8ÚØš™Ú=ÙG{«ÀwwTjUíÌi!ê{zu#Ðó>êó aI1øÂ*—–­àN´(/ʇË@ôªI½^¡?ºäÊ>‰ÄI;SIÀ˜÷=JIT9“ âñç3åÔÅY#–?lz²„W÷Œ7Ÿ'š®°o¹„p·ô%heQàJ%¨ˆ¤*XÿpíñÀ–DÐBÖ‰Ú dr«$K]D› )bYÇY£d: -1­m9Wâú–ÀjzQÖ[Ì=°µ“°>NºÁ¡˜²ÅÔ¯8ΫùÕ˜qq"+ô>;Æc#Gš°NÌ8°³M,µ&g‡«ü$E áBØæ6Љ>#p§ÔÎ'ÜØ;’_«.XIÃÇ¥‰E Þ£ &´¶4N­([/á!–ëÀ ”¯K‹ÅøE&ÎSáŒÕ–è°þgÔ L•üö¥õ…Ï=õ­ÍÔ« ô°è…÷¶L”DãßxãÝ`W¹Oª©\UlÊU+É‹Ä™þžŒÝ~œ¹4Êk"Dp@AQ9.P˜ée;Ÿ-[á<%—„0SÒÕ¬SrÀù$ÂÄk‹vK"ÏZ†«3†ó7†ÂRg­ÇRÆS[ê¹09RÈ/ªbF¬vÇ©´Ú¥‚ú|JTAºq -¶EåV³³&óƒØÀeÔ«¤_5~æ§Ñù‡ª—ÅÙõ:ô¡àFÔ,*P ? -‰¾ÒŸHáqmF_qÇK—é$¡ ¦F€K+7¦¸šT‘”‘öÝG$šrÏ@Û~ÛH_sëj84ÎO µO,åp¡löž^ª_-ö¼á¹øUÿMÆUœ‘öSýBãÜ(å«ÐÒ‚jï9½F§¾Iõ%ÁÿƒOàendstream +xÚ¥XI“Û¶¾ëW¨’ U±0n¾ýg²Œý<ªò!Î)‰/)“Çóï_/´qìT¥¦j„¥Ñè _wSNCø“Ó,¡Ê§i&…ʲéj7 §Øy;‘–"œj&1n½ZLn~Ž“© EæÓÅšHåŸÁë_nß/Þ|˜Í•RA”ˆÙÚ…û7@½øˆKï>üæ©¿ðèáöW·³¿¿NÞ,Nä›k¡…~žüùW8-A‡_'¡Py6}„q(džOw+keçÍäaò_Ï…÷ô”O˜aî(æ*Y¦½=d&…×}1˜½v¬´z*u0tüKŠdäÚ¯¼B´è€ÚJŒåÕòˆÕ¸Ñ0áI% di /Ü1–y‡‹P·<=‚ äÜ!Ãá¹Âß$ÙQLLsÏaþêî%âl†ö¼Ö%зÆø{‹ Qž·'XD¦!=%߬8"Ø£¢&ëCëÈE]Ñpa&ž‡ ‰e<œE m+QÄ,ñ¢yóá¢}fûÚZ‘àH§ú¤ˆßò±b¡Öwô¿F¾Ö +e´ïî:Ј©m ÒŒ‹p\ØÁÓãºgþµsKER ù'È‹µ¨Ä‹‘rUfÐ&Ie;àgK W¬Þ4õ’‹®C…¡u Ù.ãöõ»Ý®Z%£½®Ýñ=ŠëQ°Îö×)Wƒ$¹´d ªD\Œèj¬YŽ{h¨%A¤Â z&Ëž@æ‰û@Ù;NmÛ’ñ˜€ðu@ Ë#î¡ñ=à ªÛc@ÄlªÒnÌûø蘰‘œhï%#Yš²&(àˆîz‹¶øŒÛ39™OœðÉ2¡}÷ìj·Ë»r!CG³/z†R Fƒ<^äQ¼*^1ÔÑð˜Q$ú²àS4à ™ºq%éùÃw +•Å'©4•®xöå˜ì2¨MÚ#EÝráôŒ]¥Qèl6Þ]h.ÃD¤±%è…ìSP\Þ">wk=óe÷‘;Û%{Ñô6<:ZçxlðIeÙØJ*@¾wKÅÁ¹ Õ(¹ãóOˆÀ: +¯XG¼mÎ7Ä°âµ%óƒ1\oœA5.¸“”å+^Cø~>QÜŽ³¦³y÷Ý"yk2bDÈ´B©¶Î‘HTÛ›Oà’4±¾½€HW)aŸÆ©k ¶™b6$í±¼ŽN?y±¯ŒõHµ‹—ZSuä2ð±ª_ɸåñ Ás¬”C0ÚæêÓÒ\…Š ¤ÎEœŒÛ±öøwßU*dæmûÍÏD*‹/•‰P‰fìvþ6k:endstream endobj -6577 0 obj << +6916 0 obj << /Type /Page -/Contents 6578 0 R -/Resources 6576 0 R +/Contents 6917 0 R +/Resources 6915 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6575 0 R ->> endobj -6579 0 obj << -/D [6577 0 R /XYZ 85.039 781.388 null] ->> endobj -2294 0 obj << -/D [6577 0 R /XYZ 85.039 558.621 null] +/Parent 6920 0 R >> endobj -6580 0 obj << -/D [6577 0 R /XYZ 85.039 526.404 null] +6918 0 obj << +/D [6916 0 R /XYZ 85.039 781.388 null] >> endobj -2298 0 obj << -/D [6577 0 R /XYZ 85.039 348.751 null] +2394 0 obj << +/D [6916 0 R /XYZ 85.039 721.69 null] >> endobj -6581 0 obj << -/D [6577 0 R /XYZ 85.039 314.006 null] +6919 0 obj << +/D [6916 0 R /XYZ 85.039 684.159 null] >> endobj -6576 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> -/XObject << /Im1 4096 0 R >> +6915 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6584 0 obj << -/Length 3989 -/Filter /FlateDecode ->> -stream -xÚÍ[KsÛF¾ëW°r ” -'˜^IíAŽ½yì:ñÆre«’ ¤P&†-+‡ýíÛ`@”×âV¹T%˜žFOOwÏ×=9 áOÎÒH„:›%©:Mg·›‹p¶‚–ï.¤¥˜[’¹Góìúâ«¿GñL†" ³Ùõ²ç éÙõâ·àÛï¯^]¿øår®µT$.çI’¯.S\½ä§Ï®^¿¸”Ás¼3ð#ƒ.ç2x ׿Ðå³7×/ž3ñÕ¥Jƒ7×ß¿øéú‡o±í -Y]ÙÏÐã§Ë?®¼xqÝIÞÉRf(öŸ¿ýÎ0Ä/B¡³tvסм¹¹Ed´½__¼¾øWÇŠÛÌŒ{i)Ò©ˆR}¬&¨) -ERÓ&¯òU±øòrnt,` eƒCjwxy³‡ÿm±€V™û¦À&lùj›7Dwj©w–ûçm~“#¥‘iÐÞÑn½Åy…7q¯©ÍM7—s•¶¾”Ý‹oð%®ßšvS‰7¿‡QX¬°Ï×—óXÊàŸe…Õ{h”8; ª¹DMf4ô @þ$ÈqHøòÐ[¼®W»|Óðƒ¼B)BäÛ-4­ËÛ¼-몋Š#°€»’5pÙÁàd°"-m - å¶~èpC:ÁÆwøϽ—„hËÛýš®ÖL¼Í€†[–P>×õýî2ŠµÊ‚6çw7#£½­7Ø„CÈwDEÊ‚û&‰®Ú;’%æ‰6aÔKnyYB7înêeËO¯èI[öȃçåÎIzÛÖ»¦|]ìÞ•·–)ÎÐ\=MCÝÅ—MÍ¿KPuÎî×1ÆQïoq˜¤ôÆÑpïËEÁŽkG›ó]嘴vöÑzßZÊ=™«Ss†³A]Qùô6¤jwùï¡Œ©EL8}'"•æ¼^¢+F£^ã Cà7Ɇ:…À†¯,õK@#)IMb3“Rd¨¯å, …‘ wdDsýõRJt -ZV«Ã¡º.¡*KíìOG& F1üó®iýÀèÁW?lôìy ²Î@1*Ç«sæ4÷XË$ÃLD‰j¯»!Ò0’™+SQ£ÝvÐo6– `(Ãg]\†ÞáÓ¨aHÒ!Nä;@œØZW^—£Ñ²ÆˆƒðŽ»4MË@ÏÊÖÒÒå[Dã-âCË 2¦·l°GIƒlî9cˆ*iã/˜0)ÉY;¨ˆçž’(¢Ö¼ ©°}€Å•Nƶ<ˆ¯ýá•[²´[.•Ž‚c¨ä¸r L-"påÍ 5Fá+lݯV´¾®-ã+J(î,6îP%/©ÇöeM³´Ø¯»Àl1cœòz¿«ÁÙ¯^q‡ÏšýÖFð]ÛÃF"ÛÓŒëÞq²)¸Û›ŠP*¼Ö´(„ß½3 $Îíq2j€é¥#ûþÕ›[’ʾ†,Ø¿·$.:$g”hµK‰…«+ F=„˜)˜Û=_æ··ÐRyŒgT* ´ °ÃDÿ(zÔ'«JD˜9E«¹ ;·ÛÛÙÅgÇ/´òâ Û1çŸM­ùþØõïÜ2\ÓáÁÀ² ßÄ7Kn} 3ÝÃMˆˆéÏ=zg%$>´÷æA Kœƒ†5Òù10k)ý³qÀ„`}«œ«ií½MVŠMÝüèõK xÆ×} -í²&¾C ¥b»—Kþuƒ‘Áç;›>õ!é–•Rù9‡¶zßò}‡EáõÛát–Ålü„/éõT.úä«v©è± 3Üèس)º¤©‡Eô‚7³m±ùÒZ5ª¾¿´lvz³é¤^Rµwy;| c°Îj˜Å–è!Ha]Óð›‘ê'­yŽÕ¼çu¼èéT‹ð™¥áL•\å†à¾“µ(N\ÃóÚ¥"‚ÄÍwÉŸ·T7¨«Æ‚JN¾ëU…\þr«6¹: -«ÍÖzP9GÎŒhçhK´¬1 -¯ñÒ=Wt¤D`«:V§>(zéÑôWdÙ(Δa* âÙ DìSþö$Óžžk“˜õi°ò1‰%²4ñ.³\jíL)¥j"Õ“æ6Š…‰‹c·#Õ(hŽR5ë_$¢#9qð–>ãÀÞòˆŒã41ºC'ÀÜYŒÎðRûƒ€‡™‘†&ñˆ&4ª±Ò™aUA‰Dž¤Åʱ™%™PF>­ZÛ­š²q(Ûh «) -‚* #Ó*!. -ªÚÕkd” 4ížßÇ gyÎ@B‡ð…[×+6>‚µ]0º8±Wnqµ‡Ê‡aR‡ìLCIogJ~xjüøÌ›ìLS*¡åTú—¡ŠfS­ÄV´÷TÀo§¦¾çw†©?%œN 0D[—o-ÞÁÙw“m}\ûövÏ×…¯`+vå!Èþ¶â•§:\ßwU¾)š)9ǘ6’}R6¢ÒTè8Ÿ†L -D?£Í–¦ŽÒþD(XQÙÓæ5÷˜Ûn Ã|r×áÁ#!æ‡iz-¯GdÔ+2R&<î[Þ<<Ý·NNª±1¶ |àsëBœPvÛ=Nc.vgƒí0¥‚.ËÚ^ŒWšozyïÈTóÝXtˆØ¾¶7®p +XŠisò³èxžÅ3î"øÊ*!ÛhÜú ;_LÄŽ³Ìéÿa}9²P‰¡­–©Ð‘¦à¡ í”·ŠÛÝÃXÅ0•ª#{jÍyÍ=fËÞ`„Ü+‚ažEFËë5¤?€:}O…Ž~Î:NM* -”xÓåf•ÂÚ•œFÆxX°±Ãº½æ¢ïŠwe½ï3øÁÁ‹Ýù–ö¾´ìrJ3m¾’SaêíPÄÃçCFWí 0×@|›ðís(ýÆŽ*…I&¢bf€§™©KÍñ$.€ -W@Kö$DZ¼æ³1çÖTûöË÷d‡TM¬ßN¹P?Ú3¸Ð)ÕÉ8©Ž"±íH˜Ta(’XŸE“Ž×iMªÐ€ Å<&•¥ ¬8‡Œ–×#2*øF dÄ09’|è"/×_ØòØÒÕ°¬Î«âþ$ð€,DD<Î08Çëôàt -kÀPÿîÙ5ûK~g+ -_Õ­«Òؽ)ˆdU˸²÷Ž£ì›õƒWI-Z¬‚C;/eW{?®–v@¯imhíöK©$t¸ÕCázPì*»¦ÜÙª±{§ü”S/‹HM`€L3~ÂTÊ)pU·£!á©%{rˆ^sÙDˆMr5ÅnJë¤ç‘ÍòzD6HÌ7yÂÂM½þÏôOM&š4ÆoO°aÊEX$÷—#Wê =ÒWd³¾&_6ÉÛØf„.ûî2Š1bè¸q-ŒÀ/[ï<ÒÀ}™Ïøiç²çPé§ì²€Ìí†ÁX1Õ‰å‹ØH볌R‹µ=°4aŠ=ß3˜â)!µè3ä 94EÃ6¹·þûFzŒ`a‚&»[±\ìgØ+¦þbÓoA.\=Ïêç`Û/n÷ßvÛÎ:°+:m “öx½~Ê(]¦"žÚÁZnŽ(¥Dœñfaw¨y½žÃ=Ó3ã) ‚%ܸ„B»ÃþÆ""ŸÅ¤AœclŸr€‚§rÚ ’ÔBob ø˜ h{ÂzŽg°†Sâiªý¦Cñ>Â0®ÔÝnÀYÈ}3XA]U öÔó© ->`YW^ç|˳é&I+ -J«N¬•çPì'lŠ2ƒDSëéµR)Ê̈ÄDØ”+PZ1a‡»§ÛáiÙðä,LŒ/›ÍVaf­?Tb›T]ÊáV§0O ½qwÕÞI«:‡:ÎV•È"9vfOG·§ŸQ¸U~úL½Ô°à$}ÐÀyJa,:"[ðKFwl¢tæ1? r>Ø­lË/þy*‰ëêX¬ƒrSùb]Ñg;,Ù/)P­òêHTð1yZÔ¹£yDŠN(¸LT&V¸ƒ¸ ×Ø®2†mö{ 3ø°pŽ†Ü‡hì.hΧÝÇeô&I±œvDZ&=>£nŒ&¥GrR -R‰ñ…¡ãX€ç@úÞ/H4> +stream +xÚíksÜ6î»ÅN>io²²HQ¯›››qMÝKœœ½hûAÞUl]v%G’ãúß^¤¤]Åi/&sÌd)AAV³þ©YùA˜Í’TùašÎVÛƒ`v =Ï”`3ãq„]–‡?DñL~d³åBY®öÿxôjùôt¾ÃÐÓ±?_$IêŸ,Ÿ>›+ïôhž†Þòøä#¼8ãßóã“'/ç:õÎpò°—çzyú/‡µü‘[gG/Í]þtðt9àoa|‡ÈໃŸ fkXÃOféìÚ¯²l¶=0QèG&”ïÍÁÙÁ¿î335!†…ÅX¨ÌÏt4-ªŠ&Êœ°4€šx(, E&óNæ åå[XuKŒï´hë |ÞtØSB«®¸'oñ7ö^·Åš!·ewUV %‘ì‡T8v]ÏCåÝbSFžøÑ18 ¼ÿkÞ€²ºœ«ö“ìË #_)å–©¢ @–Œ–h‚5.e®ëÁ)0I‹F†`»oñ¿ºy["ø’1Ê– \7ź\宿ó‹ù±oæ8˜P»+¦F„ó­´Š|…3^ñ°-Éz…]•U_ +C—å{ì+*Ø›8‹½%â#]‹Ðˆ‹ö”"¢å¾­Ü +qO²È{?b/oJb´Ej›;îù%ˆ‚¼Zóñ²Âˆ¥mtE…Lu›;£xi0Ø]ÜøE…fUÓú®IwŠ†;^Nðâád]î”$¨¼‡"tMè÷îÔ@&#A š-v‡+‘ût0Ùœ<’ Ç!g€ùâ~'²Bõ5Bï-dÃèõ4ØZU(¯9¯G´ɵlqò…,]YCÔ[+}#c nÐ<¿Ù­*®»¶kõõXy¼»ò T#\9vÙ•?àOâ.ïøƒˆ#ß&ʼ|CÜÖÜ•ãÞ^£ +a_WÛÑŪ‰³€(¶ëµ²F½½lH¯¹eîXÑd¨¬!âK,ub¹KÖA=µ«ÏÄì¸7G­{Ìu½Íi3lCÄC"KôsÚù;îþ³«Nðù§-·×a‹¥‚­ñÎ"àªdX%ù¶Öq ç*&–Í.ö¤µ;„V%ú(ô êèM ³^÷ÑñË3 ŒÒRi +n8ËI:\íw©˜™å¼ÉW`å2¤¼)ªKZñ``s¬—£ñ°ŒÃÂx–øY‚Ž:LŸ$ñ,„#+¥eÁ`Bùs¥ý ÎÿEæ„ÃlðÆâAˆ‰Ÿ5ôMA¢*ö²(§\é1*¾Ž¬ÇÃæ #¢·×† mW“˜ ™óOíìkq4ïps|oÄÚr#îŠl (’Šñ‰"ªJô¿/W2fC0fxÓóY½Ai¶9ù¢ù†L Ù½šÒ—“¢{„¤H Â$*˜=l¡n…I»,ÛÞ¬¨±æÍÒÀ;b,¤ì¨Z½%& F Hps¢z÷æ> Ì+*azjš‚¹]ØsµaÑ"Ñ÷hE+»Tã:pÇ^H§Ê€ 4t–55 +ÿ}¹²8°áš,xÀjSÊqy8Ø͹N"ÈQʘLc(ÃÐærÆÓg÷7KŒhst뙢:µKßdNBP9E…~&Üõái0HØ¡©•¯•æŸÌ±þ£ÇãxŠã¶lòº´Gf¾‘ ß“øà ?Ü5FdWèÎ$ž€HO‰ZCghÙGP{{½P:ñuBÃøqN­P…±Ÿ©x¶Hüãc÷—ëI9C$•_l¬Â§¡S‘Epˆ3ö÷]~ãÐWVÜ£Y'ÅþºB9¿»)F2~ä„{"’mw§Q*¦µS«u² µöƒTÃ-N@߇ æ™Yøà ?íNÖ{“‘¡Aá–`©Ä~ËÃ;¬ùÈ}åìñÇ'OOŽ^<•ã2`¦¬@Œþ‰M}“FÒ¤ÅÿÜÛ °mâ}V˜ýò‹>³çq#Wløv+V&G3†\éZuÉ#è~Š—ú}ñ ×µYÇŸeqtWB–}[J}]% ?IÉ¢¯³ègEU4žŒckëú†·cèÝóaÉÐ-ø>ÕŠ>£j¥ŸEµ¢ïR³tð=hÖó¼z1ç ³õ^Cofo_Þ£}{j÷µŽMûZ‹?ÏNéãõ« ÝI"?sÚõ1íSSÚ§üHEßÐáù„ß+Ä­µU»G6x•O f¿£QÁ]ÿž'î0V“ás¬}môŸõŸŸÑnÝ\$XŽA‡µùH¬¬³ØO¢øÆÊáwÆ|£ÿ_‚è6&ýó¢™qäâK.øMÑ¿Y¤öÍ"ßÈm˜5m‹]œÖ W=$†Ï¸”ÿ"ñb͉;¡o–øÈ¥èÌÏÐ üu$}þ#i5­aþ.íüΤÇ5¿†‘sÛlÜ›Š(Øáè­ßJëËz/’jïU²ÿߛܗQ²õ{þø\öI‚IPÄ϶··_ÍOý¥Bž*>ÍO}%:f×T4ƒôð øBÿtÊAX½<áÏ'¢²oùÔ»/ÖÚO’ô#bêX­-F¨o6.œpÙãUuÇa†q‰cƒ 3HÁÇ8IDgA4Îø»1ˆ(@6kV2oÿh/”r—½Y¸›xO0.è Ÿ.G¼µþ|aLâ-¯Æ…Ãd«9Í©µÔUØÄ/Blõ„Îà°ËÛŽñ9szËǯ_1féç’IĽµr&¿(¯‡BÈ×”@†.MÙ<«–'‡»>úÛ28_o˪ +9]Á9C˜´ä‚†ý¥¯ °-¿“™˜$šÈNÈv>rÚO#ë ‹nuxU·];á2båF &%ôL4 />Áw¸3n¯‰çü"o¥ó– ð« +¬y‘Í6vŸÚA†Üfñ`V0q«/ÕÁ¯ãWœFVp…J³x$’|ŒH6¹u5 :ñƒŒ1^Ú’–TSºò¦¡¬?©bÊYGо’ÂŽµS)¿Øÿå/2+IñbßÐ¥n¨]¸||R~6¦Êˆý Ò \‘ý;wÈèX0‘™]–ò¸x( lyŠòžÐ6¥˜»ekÀ5¬m:> ýX§cÕ"ëHgl¤SéVs 4¦òvD`˜Ê¦ãD«œÌš'.'ŸzøŠ'ôÎ]±XêÊ×¥Ïî +`]ˆ©Ö<Ò‘­'LiccÔ@9#â¶c9µ T ™½ºŠ|cï6çd6}8]@œªpûaêÞ„Ú;ª¿ø-çJ•á|-9C ý½u^qIyâ¼kä¼d’\~_œMåœk!\´¦Ñœœq’Œ«‡rv®‚‚ž»Æ2…ŽœáRÈÃ8î^_£å¡c:ä°•¼bµåiœ(Ðüðweç‘Ê!E +Š ôñø;ö<¤»¿z¬‚é[Ë=ýtÔe!Âd!BË}%!bÓÝïaü`ƒPuÞÔèÅ¥Ì Pef’ 3¾•²,Kä}™°£éÄ9À/ˆ½|½‚“Oªa+Ô€6ïç-Î*°A[Z +Ýcáp¹Å¬áÃ|Mk•Ôé#Ê©?É8Œ&0,¡!Xj'ý|^Œ ÏÎß&âWF¾¦r‰ÏxU¿‡ªÂdw#ú› ^xÞQi‘ B°«t²)*ë:œe\ÈDV?¨¾dˆ=ît¬á¦wÏi·ë}xʸçªÃ=n*–¹+íz;§[Ô‹º)ÅtCDV…U§ÈÈÚrRÈéKb:·•tÅÈŽH{&JM‘4udµ•Ùšâš8`º§¢@[V2tp(踨Ó>áîšli“;} êö•2E;^~/´HåŽfP¬‚÷T9-ÁÕD…#ÀšªF£û +ÐШAŒÓ¬j:BoZçIØöåÂf w !b£©³QBã¥hQ±>,ÃÊK$Z¾Yìû…r•WT‘“É e +êgÐ+áa&]ºcuE±YÙYÏ ÈyÓûv!+ÖêIûzMÃÕïãê÷Q©9vO0c‘¤6¶‚Õà]t;¡w²¹4d§~ÕÍÆåm`L­­%Í¥$µ_²ö®›Òz`Š0ïl‰jGAª`ñú”­î†þ²mŒálÅïKzÝ«¶bÓfJ¤>dÆ’–:ÙÁU4‹‰¥wõBB¢‚ê;C¹¸<ô¼ÉS_Î?Ó©ñ +Ɔû‹ Œ»:`| O?¨‹·õkØoO8$6¸­ +„cámJÛÒXÒ­²ÛYý%¾ó·¸M*ñÚwCÁ¯IõÅ? _ÍM¹-ùV®(&% S[hß´Ò ¤qE3þ©÷£7“‹T¯Bƒ…·•[-θFW&y>ðÎYí=)/™˜]‰BªjªÞû˜B†”µ¸¦R?ˆ Û²»!-†È¾e\íè^!*´}â¿QèãŽ'Î4Ùa?dJlÐpÂá NrUsce_ºë „A¥Ð¿Yètê$¸çÞ–î/+HÒÌ«¯%êK¹kf÷,«š‘¦Õ:r¡z†æ¤ ¬³ÛŸfN™€’ÜZY Ê {Ì8Gä«ñìyÝ:Ã×óq13‚Î +`‰#X¾Å„iÊÈÿX{ž8 zó–ƒxÒ!ˆº³㎖¿š>Ž¢!“G4›È –óÏM;|oWS#Vµ¡³Óíè¤t[/Ó]K¿(ßzªJ8Ôʾ.ï?ä}äÉø÷ýýY˜ø*>?øM0Lã½ÜØãÄôÓÝêendstream endobj -6583 0 obj << +6922 0 obj << /Type /Page -/Contents 6584 0 R -/Resources 6582 0 R +/Contents 6923 0 R +/Resources 6921 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6575 0 R -/Annots [ 6589 0 R 6590 0 R ] +/Parent 6920 0 R +/Annots [ 6926 0 R 6927 0 R ] >> endobj -6589 0 obj << +6926 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 131.555 192.154 143.245] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 573.387 135.43 586.289] +/Subtype /Link +/A << /S /GoTo /D (uniqnetbiosnames) >> >> endobj -6590 0 obj << +6927 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 90.908 196.509 102.597] -/Subtype/Link/A<> +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [158.286 573.387 209.672 586.289] +/Subtype /Link +/A << /S /GoTo /D (netbiosnamesgrp) >> >> endobj -6585 0 obj << -/D [6583 0 R /XYZ 85.039 781.388 null] +6924 0 obj << +/D [6922 0 R /XYZ 85.039 781.388 null] >> endobj -2302 0 obj << -/D [6583 0 R /XYZ 85.039 546.666 null] +2398 0 obj << +/D [6922 0 R /XYZ 85.039 761.463 null] >> endobj -6586 0 obj << -/D [6583 0 R /XYZ 85.039 514.448 null] +6925 0 obj << +/D [6922 0 R /XYZ 85.039 736.911 null] >> endobj -6587 0 obj << -/D [6583 0 R /XYZ 85.039 350.866 null] +6928 0 obj << +/D [6922 0 R /XYZ 85.039 562.428 null] >> endobj -6588 0 obj << -/D [6583 0 R /XYZ 256.582 356.839 null] +6929 0 obj << +/D [6922 0 R /XYZ 285.091 568.402 null] >> endobj -6582 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R /F62 4047 0 R /F41 2994 0 R >> -/XObject << /Im3 4353 0 R >> +6930 0 obj << +/D [6922 0 R /XYZ 85.039 463.267 null] +>> endobj +6931 0 obj << +/D [6922 0 R /XYZ 310.417 469.24 null] +>> endobj +6921 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F36 4301 0 R /F62 4159 0 R /F38 3057 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6593 0 obj << -/Length 1887 +6934 0 obj << +/Length 2778 /Filter /FlateDecode >> stream -xÚµXmoÓHþž_ ΑðÆözý‚tJ)w à8š~T¹ŽÓøê—`;¤ý÷7/kÇIœ¶PNˆz½3ž}fvvžÙØc þÙã@ K†c?°… ‚qœ¬ñ5HþÙZÃÔ*fOçål4}­¼±m‰Ð -dzÅÖŽ®’ãÙü³qú×ÉÇÙÙ§‰)¥4%&¦ïÆÇIà'ïyöåÉùÙÄ6^á› Ûx31mã³O4|y1;{ÅÊ''0.f}˜½9EÙ šš‘ÚßðŇÉ×ÙÛÑÙ¬CÞa”!Âþ6úüÕÏÁÅ·#KÈ0o`l Äùp åJýžÎGÿt¦XæŽù«¡(µ¦´D¸÷GRYBYnI×îEÒ¶láZrÜ*a(¿X¶¿ïmy"PÁ¸glAÜ ÀÌ"œ¨®µäS•m;BÚÎ!,[õai­>¬wëÜ“öÇów îD -;q½Äé¦,0C -Ùžº³Ùê<bi{áœEY!ϸš˜+- NFCÂÓß¼6é÷ú¦ÔÏ¥žHçIô†¾2¢bÎs øŒAE6‰ÖKZ0Ž#´]§%.e¬wÍBþ;‰J¤Ñ¬;XsFã¸ÌM DÀö!$˜Z!ù¸ÊðCð Ìç"Bw}£\ëwöÎ:YÁºJÿ&d¹ù¦j–Ö450³ÖSäR¤ÍÀÖúF’¬ø-Gí„Ç””Õ (§Å5ÏËôLõ×/¾XÊf/_8¾„g(¤ È A‹dVȞͶ¯ƒœe%º¸á|ψ*-¦pÝF9z—ÑKÍ‚rÁšÝÆ@µY³¿ú}«ƒGù~zJ8RN(ÇT e— Iž  ³µeöŒ¦±´B¡ Ù[% Dc|¯"a¯E]2ü´ØwÑǬÏiÏzî½Ã õ-¿N)LM<]E¹Àœêq\¡o'Á Ô¸Y›•YÇ1ê¦Â@r -á¨J š».TiRvÝMZ/»ƒït®È”|•%y¹¯“¦É“´ÞêâQÉXF9…OÈ芇«Œ}®Ûõ2­^$ÝIBÃŒU¢yDç½]–Óé×ó;Zñq¡¿iÔ$ÙÒ‹8B*žô„•ßªÐ¾;Ö!]z¶-|éÒ°8Ô5.Àª”¦ìÇåD6]ŠÎïŠxYQ¹(°æÖQ“RÀ@v:áàÙ´›×ëŠeG<ô\ç~W¶:‡9¬•”ï Ïæ`žÀ>bÞ 8©:ŸGnéåqY0@Œ9`Ô°QÔ,1§ÉÈ’+AÍÚÔÇñºÖÌ{Ô=r¬])¬Àë>éXk[fÏØÀ±v=!›û19<ÖÚÓ’ŸTa£–P»ðñqc797¿O”Ã&™’<Ç®VQ 9BÙÏ'Ûƒ^ îg82×5Ú%4 ò$UWòšw0_Ä,Ø,“‚GÓ¤¡ -0í¹°™³ ª½ÕÉëe4§Ó‡ÛÆY\@æ[ 1ÆbQЧÖ6°¦@µºàr²@ϳ]@vLr»JudøȃŒƒ@Ü48áyªûf(Ý$ð˘w@ tî4ÏjŠãJ‘¥q{â`ý¯×l…¿Œú4[/1TK¦¯e?S¢ ,péöÛÇ“÷¦-¬øÏ (8ŠÍ -À Ú@m[7Kª -ömÖiƒe[˜Ë/‹2+¯ÓYæáo«Bãx„$¿\éíÞwŠ?‹ãr]4z•Ç}Ù¶8ÚCœ:‚8®¢ø&K¯ˆ1*UÒTwÈŸ³ÖB!K˜¼å†Çù\ñ -Í%¢)oxV»\¤UÝ\¢ýG.»€:§SÛ-\¬¡ç¹ùÙõꤦ¾ó1ñ ©|¡y/ ôtŽš„Û¸{„æ<†ÐÞ§×UÇažqÚrq\GGà;Þð·:G9Ì ¡n»-…I¨³{1èÝ`UÛ°cÝØa2òún¦12´¥14ÂM:̇á õnêhkª „Ë©Fø$ -Ӧ̭­SИÚ^?"C†€©ÃƒgÞ]ÿ Ú©õT9¿PÙŒ¸5m¸o:úªà -×ß½ñ$E\Ý­šÞEÉu˜ºZâ’ó…NwMCÅóˆ2Â߬À¸(2ÄØ’ ªëþµ¹A¥C_ØêçØéJnI‡¶É_øî¥ moå¢E±•TãòDtçBômôðl ‹À–*èšÚ d¡ou½Ø8¡Ë(v®ó+T¶îºY¿ÀÅ™Mð}ƒŠT®ÐÀÎNrUA³Ñ¶s¨Ù$ïh¬Ûœa¦ÆÑ®Ë8³hVl‰îx·¶¤Ôƒ®ì}¤¯…ŽÄKm€n¹tû]µ—ßÖÅ´Ò7×(ͶÚУüZλ²õ.&’x‹»µ;öà‰T?ã(Ë0õpüæõVk¿f·u'ɼ?Žì8Õo¿+W üå£#×}šãx ¥ùÑ–aŸ§„ä;ø¿¤e8ÆÿØ2<"–?Ù2¨û;†pQ®%œpˆpá?ûô¤\;Ú†ûV \³”ãÇn± SÒs÷ñ*PÛrø?‘Ò´Âendstream +xÚ¥YKsÛ8¾ûW¨’ U1|JäÜl“hÆV¼‘f=[“9À-qMŠíªýñÛ/P¢D'[;å*h4€~¡ûí<øóIìza:˜$¾&É ÛœyƒÌ|<ó…ÃD®7ŽqêbqöþC<øž›zé`ñ@,‹åÎå§óÛÅÕ—á( C'»ÃÑd’8ÓÙâêãÐw¾œ“ÐYLg™áfÎíÝtöóça8wB˜]÷âIŸ¿üÚr->qo~~sq>üsñËÙÕâ@¾QäFãüëì?½ÁtøåÌsÃ4G,´O8‰V(ÄDÍ84r^Ò®AG6;Ì‚†¯˜œ×“Ið(9¹'wâôìbÁóZ´°Ijñ®Ç"­,s‡Ù J÷Uj¦,ãòÖ¼Ÿb÷]áÚ}ƒ‰ë¥i[K#ÀwhŠn-`‰­24› ‘‚;Š›LcV~æT]+ ên±2·¤]R–, çÆ”â,¢ªÂæ· ýÂeKÒÈ™m”Íž$"Ž´×rI±QuQ¾°m2]e=X:—L}*ÌZlÇÑ;¾cÕ$²|›#6º²ÜF±"ÈmyK:·Ø§f܉#§É¡–Wµá¥Üæ:ŠÈQ¹“I‹˜ únŠÅd˜4F.ÁÈ$@ùxr\@~ÂÞ¥ÊÖ¹¦çØ0rýèHíœ2$£8|ÎÝ;râ’b– [膹lb^*µM8˜×*ni›9CpQ˜î1¸¾z~H±R·+ Mzï~"¾ðœÆèš‚Vìow”éa‡4FÁiÔq®‹‡Ò´ +Cg¹Ï"œg†’%¸O|Ï’ï•û0&Å!nCÒ*ó:'2­)¥Ç’–ôfƒ&@kUE¦NÁ$™/!] + ô$Þø CÆ„5M%|±ˆTP £{ÏrS8B3Ì ·žxusj”?¦ÜPæCºÏøæõ=î§È¹ŸÃZ2<ŽO «Øä8ÏÍ1œ&*‰´ªB¿<(0ä™ –Þ -y+›L7O0^ÙļëZ£•V’‘øµ†*Àþ«8ΣÕîàõó„'r¶—j›¨69KLOŽ¢ÙˆGNkÄô3‚â¦{Y™ö´Ö ÷©jcË(Ì‘¢ØX *BçíãªÍ=ÙAð +‰ã:‹ÓŽ _h|ËfÚ2a‘Uº¶`49¦=R¯!p¾LèPÂêÓTAyiüœ É51Z½YÛ©Š(ì‘¢0hCÇÆ(â%~ú÷Ë®ÒxRlì¢y“¼ 온˜‡õ✣ì<„óÆÿðȱž +ŒÆÞ§íÉÍî/³óï<3"¿–W³#½“ɶ’bP*<äÅT,ö𜚆Y:Ȼڊ` ¡½|hºDB3“:Þåô:œ*.¡©‘g á'¢8öš]Æ $_¾cìvoŸ|~"ñ 6ÛË"áæ§-ô³jYbmùPªô¾H¡RÓõñ÷h™{€ ›QžÚ5¦V†ŽY1§8?Ù¿óZöÚ‹›¶Iºªç5ÚU­2Ó¦‚¡OÁp “ ½ãÕ}ǵFï昄Î!DDüù*ˆ‚˜DWŽ¢¤º$ˆ—˜5=\‰²³ VPtØ,˜öE^cOÜv)Hë¤$ìÓ; ‹Æ’ù-Šý¯~Q¢‚Ô؇©2oÜžcFšóQÁ„Ö)&桮ŷ!~*% 926Ö +[H¬#mmè<9@€÷ÆÁFó“Ø &¡ µj3„œp_Êž~D¶¼²ƒîÆÐKbYØ‹W'©›NƯáÕØ yòÇ€58¬×ˆ$?¡”ŸçôÈÜú¡`eÿ^åÛ¥ÕT´]”†íw0èîšc™8.»O?P¸žR´|±{Ѹ~¶à6r=fÂ;ûsàyÏï¿í@! ‚.¹‘(Fà0¹/ì*{‡—?aÜÞMg³væÿš/®nÂû?™þóêË»W‹Ëž@ðljû6„¨èß"Âj`”¢ÂÛØ+¯igÈy¾\¶°¥ixÎ~=XÐf‘¹{O6 -P¦[T¹š¬È'¢B׈F£(¦X;µ>Áô×7Ÿ üæ=&‰BwŒ…‚è r½¬1_ëzÓØ×üỢÜ,4$,‹8pydC|¡o·œõ9ˌ҉ëÇ~À›.0in ÌZò(«í«µ ïòá‘Þ©í[ü§þ`•Çá˜z ·5ˆK½}©‹ÕÚð¿^eü¥ ‡~š&Ü»)²Z7úÁØeõ¶/U¾í¥Ñ¾°Ø³­â¦QøM‚ûÖ[4x(,y×àeÅÞý ·n=‚ÝQ“ˆ%p\ÂKÄýž…ò^M_?z[ªÌ†GQYñ¡¨cmRî6•õ#À§¾ z-<2]#ìÓ  ¢¶c#»GÒw¤¦tÛëpéë¶èӶɷ€ï̱èJ”,sÕ´Ž°K¶*“® _£î%~óöȶfY¿.˜ âU^å5g¨î5µñ¸Ì+üŸXWy¸Oµé†µjͲé\Ú&?^ '5€ˆß ëûœË_þOOe% úlõ÷þƒBVOZ±¾ bÂdr,¡?vÃqÝÿ Å`”.endstream endobj -6592 0 obj << +6933 0 obj << /Type /Page -/Contents 6593 0 R -/Resources 6591 0 R +/Contents 6934 0 R +/Resources 6932 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6575 0 R -/Annots [ 6595 0 R ] ->> endobj -6595 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 747.387 182.161 759.076] -/Subtype/Link/A<> +/Parent 6920 0 R >> endobj -6594 0 obj << -/D [6592 0 R /XYZ 85.039 781.388 null] +6935 0 obj << +/D [6933 0 R /XYZ 85.039 781.388 null] >> endobj -2306 0 obj << -/D [6592 0 R /XYZ 85.039 636.74 null] +2402 0 obj << +/D [6933 0 R /XYZ 85.039 597.02 null] >> endobj -6596 0 obj << -/D [6592 0 R /XYZ 85.039 602.596 null] +6936 0 obj << +/D [6933 0 R /XYZ 85.039 565.205 null] >> endobj -2310 0 obj << -/D [6592 0 R /XYZ 85.039 357.583 null] +2406 0 obj << +/D [6933 0 R /XYZ 85.039 358.13 null] >> endobj -6597 0 obj << -/D [6592 0 R /XYZ 85.039 321.318 null] +6937 0 obj << +/D [6933 0 R /XYZ 85.039 325.708 null] >> endobj -6591 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R >> +6932 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6600 0 obj << -/Length 1514 +6940 0 obj << +/Length 1626 /Filter /FlateDecode >> stream -xÚ­X[o›H~÷¯°T­Š¥2e˜ °Ò>8—nÓªÝlãJ+u«,¶±Æ\·ÿ~Ï™Ûà¦E sîsæûf‡ü𡯘#‚¡çs&|8KÎp 3x%aW"vKæb2xþBé!wXàÃÉboG1©Äp2ÿ`]¾ßN®ßl!„å*6²=Ï·nG¾´ÆoèëÅøîzÄ­+|“ðàÖÍÈæÖ &ïÌðâýäúŠ„Ç#×·ÞO^^¿Ü\âÜMMŒØ_ ñvôqòjp=i"ob‚( ûÓàÃGg8‡_ &¸ƒ±Ã8L§ˆ›))ª÷dp7ø»1EsrHZ]Uª%l°ÀUç+©9“Z4•tŽJ*‡)GšJBñ\*& ŠJÖ›°Üæ˜xµÑª*+,@¦Øá0 n9 \fë.—¤–1ˆf뾊IVZœÏa/cràª#®™Ð&…ñÈvmaºI"7€/3Š¢ÂM„L)k‘å4Iôi -ɃHa*Oi®HG®gM7¨Zà÷b7'qÌt]”a’ÔYC ¥p-”ÍãÏ#¥Á[ôÜh¥ØcVª¢¸ ‹ ˜Þ& üýŠ„ºØ?0™n@ȳ² †.#2À­gàU{V¸kR:Ö]E8æ˜}Ï£œfâ’žášžÆDŽUÉj‰=ËUDƒvðaÑDSè;ƒ˜À™‘ZÃûÓ’üF_â¢rV›žwË:`Ý4Î ¬öîO ðþíÍ?´c7MA'Ëç ¥Ÿ¿íV])˜žÑ}òÛíøÍ™Óa÷ ´¾«,“³± ò¨Sðô[¸-W¸<}ói1®ŒË ¦÷ë,É–ñšÙ#tóB›XÒûí:þr¤§Hm6˶ë²òò8ͺ‡ª¡zª'âYÎ’xŠL]ò¨Ì¿þ!~ÌZŠ±T¬Ây¶£q:W4ØÑ=¢Ìèx»_ÄyQÞ£ýGº=,@‘šnmŸøÀg}QQP|»Æ@'É|}žöZ2½` ›yÞVË -«_Gs§ÐB°—Í8+ØF¤AÜ®a²0íâé2Zæâ÷Kb-m—4ד¡VLËà|†{™^(—6©»Çr-sÏç°—´lA:Ì@zÃ8fª\…eed•!8ì -2`7=ÎÅ &€™ë ¾I傹^7‘Ûµ-»eì4ká¸Ls}ö)ÅP -Ф5Ih×*³¥yÈàrÓ„Ád,‚ êmN•JCk»¿$ÑÚÖùD¥ -˜_Ú‰> ÕLñÀ&]8ˆ­0èj}f¦{ µÍÍv´…'¡õõÁ®œ -ŒèTW•‡H“xÁt2û)j2˜ùÝÔt¤ûÃ2~K1Û ~„I‹Ž9¢ïà¸ÚRý¬Ô„ÿã÷ˆœÖp„kó̯"·ãÌÐA/³uT¶÷]ì^}ö÷" ¯I€FÝB}îLz~Mlõíã2KÓ -Í‘®óœˆ«è ¦6s.š–L/ qÉ™ªxvôj𨌃=òø´ïáñ¹:hs³Ï¿ÒGd&s”}Hji<˜ ß%^‹à@^Ƶ*ΗYå«û¦‚SK¼ÄxDö¬þ ,Z ¬—MÆ l.¨™Ð©»ÃÄRR(U‹hWù6 E€ZœîÆ…¹#¤j5áøaé(°žÄxÄ_’TR=Pë[IX-ùù•ÜË4ÅY€16+ W«V_q‹c”ÓE‹îÖ¯•AŠTݤXY²÷¦NCä@œ8lŸ‹×Óx]Ë6ÍÝ:›â‚GiO±|9_«½HoÓ+θëš0þ£å»¡åÂõ qY›.5«‘Ð"x3G«öü÷¥ó€ö;^í$\«»ss;O“ðKàõSÿgÙŸIóEÏ‘T¹.sy Fhu¯>S¾8 ø¤·£oendstream +xÚ¥XmoÚ:þί@ìéd áuš®D[Ú±ÛÒÞÂT]mÓ•I X3v'PvübHÚiZ'œÄöy|ÎsžcÛ«»üŸWö×ÕCÏñ‡Ãz°­¹õ5ÿr[óT·ÞuÜ~O|º\ÔÞßôúuÏuFXe]á×æÕ§ñãbòÔjû¾ßìôV{06§³Åä¶å5ŸÆ­¡ß\Lg·²Ãý\þ>Og׭ΰù¬^Ì&¼÷âY¼zxúËôZ|’­ùøþrÜú¾ø\›,Žðµ»N·ï €?k_¿»õ¯ásÍuüÑ°¾çm×ñF£ú¶ÖíùN¯ë«g\›×þ6³ÈoݺuÆ mÝ£í»ÎpØ5þð{güñN Ð<1h¤Þµ{^s±AL¶VCÙÒoº@‚–úý%ÙºGAL]%òñnÊ6Þn(KX9 CÙ$” ºZÁX½L6 +ÍŠbL÷ˆ¬å#|I aˆöáxò^•|¯ç6ß=>Mª>_?ÜøÒ-@äϪ~ÓÙÕÝ—ë‰DóQ,ƒ€-¬r9¹Îþßq®ÎÆ‹É9ܪçdv}¾Ÿ5å7Ïïº/„HßÜžK(iG1"‰ñT°1&–FÞ×;;qi¤nŠä "A’X5±ƒ†NÉd>`*Ô š†îŽ±êRËQ™ÙŽ`$Tþ.Õ§(†˜‚†¥î`‹ÐisÁ:²}©æ á +¤8¹È !ÃÙž c6)M,ûj†ešä£e3 ¬ì‚•‰ZxàQ`£!£8Mx(„™ó›q=ñç™Ø5 +y¢‚–€µ=À H`>¾HµEiJq8‚Z!í±¥¥á8¶ÖA.(A¢6tÿ0˘î™ö¾Q&L×ÚÕüãšK¸;XÌ‚c„d‡bJ¶|Lãv¼âBJm‡¶çD„Ž«¸‡’¢èÈ×À€:3Ý +ÕÌ ”虤†Èh‹a*xìlÂœlhºÞW“L$Zy •UÆ㮳ß@R-Eh;÷0üÅ´šg=˜¼j”UŒÅ[Ñ8€¾§›+Ù˜Áärú0Ïv¹(Õr¹p^·÷Fit„„?,VVÕ´bdbUŒPžB++F°B1 vÎÓ®_Cc€"ÊŸ/³«öÅã.4U +ZVî•@$Àè?=‰Þ©XuË®%‚¹ ÿŸ«u™P;åv§VþïžÇÿÌ+s1Šé…°`g ¢È,“Æ +¥–ž¼¼D0½­zƒîÉhÃÈÌl'¶fó‰ÖmS­X)³)«Fˆb.Ïh«üFÌŠP^ïrîn ÃQºÄ(h”lIà ØF:ºK®3{êž-ãð |ëcã"pJ)íø§a… +ÙÛÿ¢3ûV9ÞP£ É{ƒˆ(-zQzrÒd½7ÖŽ€Û% ÎdfsZqø5[ÏAcܬ¶Pñó}Š¶ö3¥<\‚íf Ñš[˜­2IóS$QóY–Û™BÚ@uâßœBKÀÀ«^ýÅ Õ¢ô&àHÐ9o¸ŽÇœ¿yœT?+ï^åçvx/gÄÿ­v§/”ƒ+Uí¼°e‡$ž–?2¼ž+N÷üÍ‘ÿPH¯¯Êמ[ä-nÆsÝfƒÓLÒ!›UÑëraòûn;‹Ðç°(*Ô÷·XêøÊRD£W¯7ÐËëÄúMÍ^õföjæl ÈâöÌÑÔ„§³Î¬Ó N•‚”S*î_ŠP‹[uáÙ¬")°¢-‹@ö6¿á².×éxÝóךÊèï]úÇšè;AïÜ ?Ú½¾ã÷»¼y𻓱endstream endobj -6599 0 obj << +6939 0 obj << /Type /Page -/Contents 6600 0 R -/Resources 6598 0 R +/Contents 6940 0 R +/Resources 6938 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6575 0 R ->> endobj -6601 0 obj << -/D [6599 0 R /XYZ 85.039 781.388 null] ->> endobj -2314 0 obj << -/D [6599 0 R /XYZ 85.039 761.463 null] ->> endobj -6602 0 obj << -/D [6599 0 R /XYZ 85.039 741.337 null] ->> endobj -2318 0 obj << -/D [6599 0 R /XYZ 85.039 494.868 null] ->> endobj -6603 0 obj << -/D [6599 0 R /XYZ 85.039 458.603 null] ->> endobj -2322 0 obj << -/D [6599 0 R /XYZ 85.039 210.96 null] ->> endobj -6604 0 obj << -/D [6599 0 R /XYZ 85.039 168.675 null] ->> endobj -2326 0 obj << -/D [6599 0 R /XYZ 85.039 110.641 null] +/Parent 6920 0 R >> endobj -6605 0 obj << -/D [6599 0 R /XYZ 85.039 75.895 null] +6941 0 obj << +/D [6939 0 R /XYZ 85.039 781.388 null] >> endobj -6598 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +6938 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6608 0 obj << -/Length 1755 +6944 0 obj << +/Length 2330 /Filter /FlateDecode >> stream -xÚµX[sÓ8~ϯȰ8ÃƱ-_;Ó‡@ËRf -,„á¡Ûa][IMm+øÒ¿ç"»Ië†v§ÓZ:::×OGGµÇüØãÐ3-ƒÐ6EŽ“bdW°òÇÈÖSÍ2Ýáy¾Í^zþضÌÈŠÆ‹åÏt=1^¤Æ‹Wów‹Ó÷“©Âp.^¾Yœ½Àµ9ŠZÛ[Øñfr¹x=:]ô–÷6•šýutqiSpñõÈ2EŽ70¶L–‹Ømz®Ðó|ôaôg/Š×Ü1'BÓ ÅÃ0 o LÂ7#Ï£0Åms=™zŽgTòk›U2åÙ,Ï®fµLÚ*k¶³u\|¦‰lš­Y+ôOm´+º'¨n—Ë,ÉdÙ<&j“•WY™Þäý°œ¶Ì¾¡Znkùy™Uuóy×5ÓÊ6ÏÕÍAk¿ëv'7½’ZV·Y"ëmÝÈbJb~Ez©rµÊÊGBš$ªí¼ÿ_ìü‡’†ߨ*ýM½´w¡ ê\aúÂ'}Ù m㜻kYòäŒ?j=™:ÑQcþ”À)ñ¨nxž¨²V¹äÉ&Ãt‰Ð2.äi€¹Ê//àçÍåÅKØ—¿K$ `Õ¢JÞ£õ&q‰¢ád•W3͵ÁleU¶Q ÷–Ç-Ðkdž¬’5™|uË ãìé-òË$6UÖY”r©ÒþÀh_0žÔä!ª„v ó^Â8¯¨u]×xÚésÓŠXßâvºŽeà¶J]åö‚ÉE¬=à .fšŸÍríCµÏ2L™…Üm©’Ô¾Qè*îW]DÁØó3tüï—Wa:Ápqv²¦;¨vîP8¡éûQ¯C@žØÌè£3:sÜÅžpƶmà]d dÜ°£Y¶«ÃˆBÔrJqŸ:ùýl#°ÝÀâ€)Æ\Œ(k\ Äãz®PáK¶4˜pP'˜·aÎZ@YƒIŠyXSîHMÜh㛌^ðN»K&PžV’÷Çy%ã´¦(Á+ð:ô|c1 …QMlÖ…'± àHv…y`®ZÔ á/Š†`a»!àÔ{Â2'ü%Xt²¦;ÂÂÂöà¾õƒ^ã,ØNŠc)ñJ²,c 3UñJÜê‚@ô<Õã„Ó‹ë]Y¹ÏSÊt,²e‚ªfòÍPíäB•\òÊ]ÛòÎTAó\P¥­‡4}ß„#°—’™lÈÌV‚˜²h"tf ûÿXÕ E·B„à «@ãxÝUC ¨2ß2Ó†à‰£dÄPÊ»jR@+Uð$ÓüGMíïF&ÌH@“àuÄ&Ó5Ì‹x”Ks†ó¼‘UIðÏtIÖ…k‹ÀÆK·)Âóv̆ %o‰ˆn 8 qžó’®Ñ·YW - è*RÌÜbÂqÐ_%äãR­xO!^I´óÓ6L¤ãCb8FW„NŒ%©Ö×'Ž“ C‘0{Ý´\7p[ô?‡ó‘¶Ù ÓúΓ`‡‡¦«6w¶}¯ëº)l>—XçMÐêà¥êYÆ' -65¼ÀÈ0è¾o”X:‘PIh€ç6+WL$Tš+* ¸m¬ëÇ|q]x¸‡}¹ãyXd:9l;ðúÈŒó-k¾€1Ÿ&ô6K¦öH†)Tbò¯UU’;®¦–šÕVw]Wž'¨Ï¶kºÞ;è#… 3†‹LYw–ñš‡mÆU ™™d;–e!fƒ®Ж u½s¤@;æVF€B’€²Ê$]©{ôݺ¦ƒo+ÚÀŽAyØh^lh˜•"-Æ£Eáe—a{ô‰›OÁÁ¾TW!ô9|x†`Ä6 $XæB%t À¦Nnu£5êT”r·»÷œƒ˜Ø&< w;ãJ©æ7n¬7àáR7ÙÓv –ŸœÎß/^=+âj«1|†ýêa&úõ¸i= À4ÍCbÑؽ3<èÃê¬UÄXÁ‘ó#ÒÇÍÝå§EVÖÿVò­¬›ŸðtÎ/­z ŸÞñv%›þµKOªt@&ò};²à‡†3þ š]ÅõÐ3–`ƒ ?8šucv…0‚bà´YôW­} wWžË£Ùµ*ä¬s{Æ›HÙžòÀÃ.èËþg¦mŸ"ji!QT1Š®5Â]_úw³Œ³¼#í¨b }œ •jøåhüÒ¿rî -¾0C ×{ÏqLÇîlÁ¸À…sßÞî_> þ¶>Þõendstream +xÚ½Y[oÛF~÷¯Ú +ˆhÞ/ú Øj¢ÖV¼–R·hŠÅHY\S$KRvüï÷ÜHJX`$œ9sfæ\¿sF±ü±‘oZn<#Ût£h°Ú]XƒGXùpa ‡5ðL+ðqéýââò?Ø–[ñ`±!–Åú/ãêãøn1¹Ž\×5œÀŽÂ02¦³ÅäÃÐ6îÇÃÈ5ÓÙf¸ó÷a:»þ4t"ãA³ p/ôéþ·–kñ‘Góñíûñðïů“Å|#Ïôüç⯿­ÁtøõÂ2Ý8¼ÀØ2í8ì.<ß5}Ï•yz1¿øW{ +¯yÞÕc†QÃ1r-3Š¼Ö®ßc‡#ßñ§³«›Ïמ}±]ÿ–Û$ËqPì—i²ÂQºÛæU]¡n¨WÅG'Mf×ÿ߀gãŤ—ï€ænfü­·šj™?ËPU»"ÕïÞpü Š"S;ýO+]>ë’Ç«<«U’Ur”0z•¨ô¼ø«­*ÕªnID¤¤–sð²!Š¼Ø§ª!T¶zš¯TZ•Ï=Òá9h¥>/OQê4Wk½~÷æðîvòÒ™+Dúê@ûM¢åˆ*o”Ý•h»”}û +XÏŠVËöTµæ:#±ùJgu©Òô•§;p +:¦‘¢‰(šl’´‘yóVÏΚgEª^«ZÞgêY%©Z¦Úì ½³‡ÍòZ72¨ú4/Û¼‘ô@f¹²PeÕ¨—d«t¿N²Ç&*w;°‡0æbp­V[±Fž?í‹wßPQ¬þ¤uÑžÚŠ•íwËÆù¦ïÊÆkâœ]’%»½˜ì%IS‘zW”mîºÜäåNe«c  ¶ØêRŸ>ªÆ&Y.µ~N*ôƱ<\Ù„ˆZ;60 ÝÚ°9­pV<Ý$NÞVrp°ÙƒÖvl›žå÷ך‘š^¶èêÙ6c «]¡Àx&T +êŒï[ÆÇOÑmÌX0‚Ðø%IaQ7W÷\âz¦í¹í%v„/H/vŒ/–í¡¼Ø58¹âá¾ÚCúÁü•ç8“AíZ¡8¾kÞh‡ß[`˜óðh¶±Î±Ò½Èy³¡Ü2S^žgv,ëëåwÇÔÀ¶A×0NJM¢ÔpŠ 9©WI{õ–"(ʳæΓ[×Áñõýô÷Éý‡“Åtd5;ˆLè Øt„¦Ž`±@¡—ØnŽrVá`zÇ\c”u]’Ï@ÚJøÚSê-/Ñä}HÎ+RFŒËȃæÀõ»ÖVC ouG"ëa4 +[VP‘ %’ÊóC†nÏŒ%ùU3•ð›FKÔî•YH-$¢ªŠîB©«<Ý×xCž1‰ì±A•+€ÃýªÞ‹uN¢A3þ²ƒˆbE&«ÑS •SÌ×m”hŨkŽcˆ º§ž›U—~°}£V¸‘gôÕß)FÛ&d*Wì17 p ‚ºXag㹞`ŽJMùc(䲯êBVCýg^2|7Äæ­Víµl/`)­Ü%óØx7 ²/eš‹/” „LIúžk-øÑh½VM*¹®CÄï¶Åž“`ô‚Óõûé§9Sg\špyÁéË(5TÔÞ;Ý`¹¤>‚VÁ/){èÒ†‡ð<Ï‹9é°î.?·z! ­‚‡Züa> endobj -6609 0 obj << -/D [6607 0 R /XYZ 85.039 781.388 null] +6945 0 obj << +/D [6943 0 R /XYZ 85.039 781.388 null] >> endobj -2330 0 obj << -/D [6607 0 R /XYZ 85.039 472.088 null] +2410 0 obj << +/D [6943 0 R /XYZ 85.039 559.099 null] >> endobj -6610 0 obj << -/D [6607 0 R /XYZ 85.039 437.948 null] +6946 0 obj << +/D [6943 0 R /XYZ 85.039 524.557 null] >> endobj -6606 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R >> -/ProcSet [ /PDF /Text ] +2414 0 obj << +/D [6943 0 R /XYZ 85.039 425.269 null] >> endobj -6613 0 obj << -/Length 633 -/Filter /FlateDecode ->> -stream -xÚ¥T[OÛ0~ϯȴli1ql'Î^¦e€´Â¨Ñ414Jh´\¶4mÕ¿sìºÑ=MUås?Ÿ¿ãî‡ðã¾V,©Ÿh΄Öþ¼òBÿ <=ÞG}H°sd¼ÃSû> endobj -6614 0 obj << -/D [6612 0 R /XYZ 85.039 781.388 null] +2418 0 obj << +/D [6943 0 R /XYZ 85.039 254.125 null] >> endobj -6611 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F62 4047 0 R >> +6948 0 obj << +/D [6943 0 R /XYZ 85.039 219.38 null] +>> endobj +6942 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6618 0 obj << -/Length 2072 +6951 0 obj << +/Length 1890 /Filter /FlateDecode >> stream -xÚ¥XYoÛH ~÷¯ÐÛÊÀZK×kz,\¤IqÑÚ>(¶b ±%¯4n’¿jƒßCçO–ö -÷É<¸sl$Y8ÓÐùW¼-TNžŽv–ü6¸ ªÌTê,Å4([cǺ›œ”/ö{ØÚ¾™IYPø:£¡¼@&"[[zðm1XÛd YûÿâûnÝAØKpÏkÝlYy×dáÁ*™KãØ£Ýæ¸~ wno0î´Ì{ñ'ŸŒ­ˆÊYh,º÷©IŽí©u¸+¦ -U£IÏÍ°ç5¯5MȆðeè¼f¸hè84ÈÛè\û؃Û·Í=¸ÜÑñèB¸ÇJE™¤Pþwòí‡Vö'"Òy<ÁXD2σÝÄ@„Ç"vóíänòwÏ õ–&’€m—øÐ)|xäÉùôcD%Z÷“8åhA€&Ar‘¾2 Ý4·üпèé¨M,"¥ˆcðo Ïó\3ÉhLÒZÑ›ùNï3IêØÎF| -³J"¦q`2ÐV0JôˆcÔªT‡ÍOŒV»·‘«átS°ã¸nÀÏðÝ×<· WîË ‰#оÇÑÌ#¿g¯Þ™ãDQä«Ôp8ÜÞñaÌC¬Âëf]-!na¢Ãkæ‘'o›Ú¶Ûù.bq {×oa$#^¼­ù»Cq³÷Ûšy׿º3Æ -õ#ÆrlÂÊ2‚+ønªõcç…·ÑR«ŸU×ãeL&:U‰Ñb™j÷fÁÐ),/"Ëí‘ ‚ü¦±{1/w ÓXz"ë'ÎZ 8@[¹„ Û[&êË'§Ä¾nó¤Nš×ß#°=ÎÂHçaù\1\–õÒ-ú“Föhð¶±ü4K~ÇÌY:gªÔe§Ý~[ZÇ° „ÇÄkѲpWu³ÓYì ìð¶rSÖ@ã 0™<Ž¤I‚ü¢ lI,ð\þÛ0§d”åæÕâHg T‚ãB$ƒ41ª “F™V¾Ä?` WöÐ)7#¯¸¢»*ëëzÕîž{Ö¯J8Ð\,ß´ÒQ®%‰ø© ºåKCU©I´¯J± ÀP}êx».} CJm!p*/ÊE”¥ªÎ¶…%wi”€™ÕQ:ÆK¤¬™ª|ÞÓbÉ~Å„\ø™s`A;Õ’W}­¨GiôŒ³öYÕ®Îcb¥sFøíx½‚°ð¼v£R¯G#¤E¬É5…ùr3ÿç ‚(О™¤ÙS–í¨€e’ÿ¥/€8¥ƒÓ$ öuõHFzâp/ÿÍDΖîßÍßÇìУN¡åšË(,™žÙáFOVS8~2dTÃPMÓ—&pÊ•ˆ4¾guÊš§§O…«\Õ¦TØm–Åâ]áN±¬Jw+Á·GÉ™º;U½Ix_ø¤pªô©·ö¯ Œ‰¬Ç¸sܱò“4WÜPT®‚'´w[Î&PȯäF¢BGhêq_*ŸtÕ"_…ÛÍÅŒ s¥ÒøŒ \F¸rJ_®Ûæà3Á¼~à~‡>h½§Á;ž—RæP<«×¥Ñ\L -2N YÐü–J¥ì28®s2”¥oÜÈ×”bWBúOÜ€áÒ×>›oqá $JÁˆºt‰Ûñh±Æ펓§á¯¯ñðô§áž#¼@ºs8°fr¬«©=×öú^PæPW®î2ñëêp št…atÒi"µƒ¬Ì ²óñã&•XŸ9šøŸ@|“Š„ LÇb}y÷™©8·v–‰¤Nyðд£;oÝeüKJßUÇcÏhaß‹›¡$4ñ¨ûîxÁ7ÓDé  ¦RçLÔµ‰ÏôéfàÌûky±ýYygc¬ÝÓ,üzܱ›³|›Ë[^›õ•œÐ[R…«Ê+[x?$;IqI_ªœàû«©“ã.Õ{8Ø–~ãîËmÅØdÝuoµgŽ?ºà¨·.NFÖEzcb^ò`±ÝòNÒ89tc¹Ï× äOô ÃèaJÎDíSíÒ%xô@9xç ¹O -B©“ê†K@«¡ÍÎÇv¹ºõ”§0¦…Ž噡2P+üza¬³(Îôåÿo}H4endstream +xÚÝXKoÛF¾ëW¨=‘@´Þåò ǯ8ml×êC’-Ñ6a>T’Šl ?¾óXR”L9A‹¹³3³³³ß<–j,áOCOHƒP †ãy>’ã{˜9)Ã!Ç®¾‡Sïf£ƒSÏ+)"gwÄ2[|²ŽÞ^ÍN®í‰ÖÚr|aO‚ ´Î/f'g¶²®íP[³ó‹3fø8åçÍùÅñ¥í„Ö!\œ÷ìI—׿v\³÷ü6=üøîÐþ2û0:™õ웸Âõ5øçèÓ9^À>Œ¤ÐQ8^û*ŠÆùÈõ´ð\mÆÙh:ú½ÓÂsÜ0i9&ZŠ0t;(oÀ3ÜpiOœHYó²ø,• ;»_Uð› Ù±¦ðç¶X·øƼ‘Y©¶'†¹›¾òùÅ”u‚ ¨ñ+:¬½ÁéÈjŒì]™5+‘iL) ‹{ž\âÚUœ“t“TµY¯2 ?‹d$i¥…±¦` 8ŽƒSÝw‚+8¾qEß +pÁ3nykÒrNú6"~ôUÖ®ú–¥¼°'å‰(Ç`©Ib`¶çxV½Z.˪áÁ/ü¸(Q¤·HO$©¾&Õ–ÄÓÓ“èýÞÚà ú¬ñ!©’kµ‚E[_|[s¤„«CÞֈ{·õ4½Ÿ_q,Ä .ª„PR3­¼ãgÃÌ`&ˆL#¥ä’‰r”'N dÄž9µC×*Á!:pà¨ï`•²Êã&- ¦Å·püU®3 ´1ET!mµÄ§²¦ðк(ÚhË uŽA(ëбªv»öZï}°]IEáÏsÕý˜_®Ï^‰Ð£‡±ß˜µÈ %ߘŒz¾$'±ØEÒ Àº¬A&ÒÖ»ÊöÀEëzÂ>ÕA ”n¡ ý²c>d%|?èøz)g¿Ñâ…›PK( 1¦oV¡}Õ%,È®ÐÊžf@²Y,±ŽÊ<ÇSÇóö뤪J[K RƒY|` €©Î7râÑաב›´ÒpV‚ö(Ì™|y9°j§"k‰ˆ(o³$o!ÌȉÊýo|šv~ã;˶wkü›Ám½»€`‘¢ ;é´¬v]Ó ötøÔÂí÷M +ßÝSf7yþÅ'jö?í÷‰Žä®ýj üüœ endstream endobj -6617 0 obj << +6950 0 obj << /Type /Page -/Contents 6618 0 R -/Resources 6616 0 R +/Contents 6951 0 R +/Resources 6949 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6615 0 R +/Parent 6920 0 R +/Annots [ 6953 0 R 6954 0 R ] >> endobj -6619 0 obj << -/D [6617 0 R /XYZ 85.039 781.388 null] +6953 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [400.207 642.974 539.579 654.663] +/Subtype /Link +/A << /S /GoTo /D (NetworkBrowsing) >> >> endobj -2334 0 obj << -/D [6617 0 R /XYZ 85.039 761.463 null] +6954 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 629.425 100.532 640.688] +/Subtype /Link +/A << /S /GoTo /D (NetworkBrowsing) >> >> endobj -3127 0 obj << -/D [6617 0 R /XYZ 85.039 632.606 null] +6952 0 obj << +/D [6950 0 R /XYZ 85.039 781.388 null] >> endobj -2338 0 obj << -/D [6617 0 R /XYZ 85.039 386.34 null] +2422 0 obj << +/D [6950 0 R /XYZ 85.039 613.982 null] >> endobj -6620 0 obj << -/D [6617 0 R /XYZ 85.039 351.029 null] +6955 0 obj << +/D [6950 0 R /XYZ 85.039 573.818 null] +>> endobj +2426 0 obj << +/D [6950 0 R /XYZ 85.039 502.235 null] +>> endobj +6956 0 obj << +/D [6950 0 R /XYZ 85.039 467.489 null] >> endobj -2342 0 obj << -/D [6617 0 R /XYZ 85.039 224.075 null] +2430 0 obj << +/D [6950 0 R /XYZ 85.039 316.329 null] >> endobj -6621 0 obj << -/D [6617 0 R /XYZ 85.039 181.122 null] +6957 0 obj << +/D [6950 0 R /XYZ 85.039 282.19 null] >> endobj -6616 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +6949 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F59 3455 0 R /F20 3021 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6624 0 obj << -/Length 2311 +6960 0 obj << +/Length 1645 /Filter /FlateDecode >> stream -xÚ¥YYsã6~÷¯à#UÑ^~ÓØs(»–½–&Nm’Z¢-ÖP¢†¤ìñ¿ß>’:'µ©©˜8èûC·"ÿ¤žð'Š¥çDZ3_]çv>_HC14$Ã͇ÙÅå§ t¤ð‘8³çîžÀÓï̸×_F÷³ƒ¡ïû® -½Á0Šbw<™}ü<îÃhûîl<ùÌ·Sþ>Ž'7w»faò¨g¸t÷ð¯–jö…GÓÑí‡Ñà¯Ù¯g­Ì­4 _‚¿øã/á,@¹_/„ç'±ócáIØ^]€Ä^ }3/.¦ÿi¯â=íð©cö±C4Jÿ v`¶@GÙ g(…ô”V'ï¡Sîá‘%ß½§õZ$^¬TëµP;RzI ×ái vÒ‘—HM^›”`îf0”n¶oUC&ÚK´ÄïŽô„NŸIzc’¾ÓŠ.Ç+éÜ” ¦Ó“Ô\;ìÝK’ʸ_R%^N¤”çŠD}\f(çAkw r×8Ïa°~ÁÅÀ}Ì× ˜–=o¸Y3±B0mU¼Z¤Mf†s$.àhnx£Ô¿à~äæÏL7Éhùì寮V¾ÒsÓ ¶®ï/Ç÷<Íkæ;¹›¡}Éá? ©´Èë蟊lŒ”p›e† -ÊG<˜;BáÒ[^<ÚÖ†êëÍ=6ƒ¡ŠŒž†\úþ˜ÐeM§¬OÒ•¹fšU¯ùœHŒD(`A–.û¤À·5Ûšd–nZó×È®z¡k^£Ãc3f ¯[!”;`8šýWëä9G)Q´nf!SPLþÂSvÑqßl‘ð`4¹9â‘Ù5ÇÓ¾>°$ÀÖï¡%Ÿm¨U¼™Î)802Ó‚—þRAC‚5h}CÇrëRØmP×èÃ9*ãíg£NOêÐé%ø?€ Ä$)"gØâÜÿa;Ø£9£ƒÃ#ôYNhëg ŸDº649.ãæWüC‰ -+3›[0ÎüÄw1Èr -Òô ã5[0IcX M‹™¹ü™¿7“)³ÏÍeYÍdkdÜäioY™p[Öἶw5)¢ I^®;qˆmÚÍx{Ò:jà¸òaŒ«w°8ŵ¨¯¼Á­Bï!Å·tÉHØ”æhƒÉßy™ /¿òÑePƒ¦²×âö ŠTySVæôn$ 1Æýè79J‰ˆC•}ßæ•=YÑÿæÍ”®zIík†äàæƒQH`„Ò¶™»cz³ÚÝ Y‰ì5¯¡´Ó‡„tÿ¯|@š”ç)e$ :®ãõœ­±2@É ·ý—\lØÍ°ž©ÒuýœUÇEÖãß?=´fîW}ZIŠ>\¼ùr}Ï#–GÆž‚"‰+£ÛjÕ¾ qÜK MÊGžÉ0ÀÏÉÒȹËv•æF9ŠeúóÂ$ó^ðWŒe¸?/Í~i€î0XqŸ.&äù¾ä¡ouÃ9Cëk2 ¿Ü-•¹†”_SÐIýBÚŒóNƒA{:Ζ¸=,»ÚƒèV•ˆT\,AUëƒ/ÁÅî„Rxeâ!¤¸, -¶ mRv¨@áaʟͶ2§¾Ò=ø"þ~ùï|½ýÁËoŸ_¸U±8¥  -¼À?_Ã÷hN"²N‘×ð³¥y«¾‘'ßfþö#(«ù,“÷;3^n:憺6ÀÓ^—VÙÕ •u(=éŸ÷i†T† -³WVÂk¨…ß^ĉ*£}~R„^ÄgZšŽ;F– -X©v8^f ÙèíPò3RŸRÙ×ðΫÜÑœQÙýTå3 ;•÷8W¹Ç±U¹{ÊâÕy>¥8ðJüä¼âÍÅ ÑO?ðS|ãqÅ{ùÚ³Åìiíýª<}VùŽä´î†ægªŸáÖj¾Çî¨â=v­Þm¥TÃû6GdGKx¦œ4dL¬Ïã[¦ð¶Ûµ÷ø‘'¢¸àÐ Š‚¤¼\BYw*ý|Œáø|öhN‚¬/„›æºì¿¼µmüLMÙØÒvŠ¼6¯'¬ð¥ú‘r±h+·ºÎl¿‹·Q…`ÞÖ”‹†«èHiòB{ùÉïË*0±½ÐIL©Ànð -%D[”ó´XR ÏJ7õh´(©¢8¬ƒd¢<ƞċðàSþòTþððLV¥+À7Ì$-ò´Ö8'9å19£þ›¥ §‚×ñÅt}µY§’GÄàl2®u8íñ+$©„Æï¦â‡+§ -‹iRÞêêÖŒ*‹cø Ú÷ «FzÐðš%ùû’ïšFš™š.&Ûž•ËM3ó- Å:#ŠÅ#³øPf,à -óì‰Ú×~9Öª×A1×¥ô׳·£÷ÎüÑûwT©¬°&‹bw“’ŠßÚ’L%=­`’&8î7U¼²×ÞÙÆ~³¨Ä}çyæT„_ü¹ «0M•¶8cºvêØa«0-Q¿2…e;ð -¬o×m“‘6†,Èᥑ”ÚôˆåɤBX“f-}!ݧ­iðJ¦e×S U’€ÏsúåJˆNq8u›Q—˜òl4Ÿ·^¹…´,U߼öÇbM·#ˆ „R¥àßVÈà'Ó‰S¾1*/l@Qш²²? )ò’ø/lˈ` @ ƒÀ%(¥ÇKËÒÎÅ5£c^¤þÁ:æïÆã¡èÄ‚«B³OŠ4Ymm˜˜¦–·îÛÞ7íÏtà1¾óf•m:¬1 ,€Y³—l~Ç„€pž²á%ox¶Ì~P²1Ì’Ó: ßCÂö‘äLÝDõ}ç£Ê‰»Óüe‹/ûžÑâ -¶b:%RœHuåë« Ô&–Uz¨žÛÒuè*ÍsÚ\T<]l”vükCï¶Äu Z#ñ}æqž=˜ÛïùÖ 4*öÕƒ½‘¨B9ç¤Å%´Œú|]Àöb¸­èñê°ÃžÕ~Í,GF½Nà†¥Üd: Ú·¯6Bj,_²¯-Â\º0èÀ<’ÅÎ9{‰ÞäwêŸ\ÂkYÁ›<±smODM^$›d†=M°íªX¥;r…Q’.wÜà̘.éÑ~ÍÅ`ü|Ç[¨y£“ïKÞ$C:Ôe$}½ÇþΟ_ŒfSj’íÀÂúMxd³tîûÉøÝû ܚ̲ÛmYe‡lÝ!`x~M5(™ “)5èn@úÿ/9ÇŠˆï0ÎΧÂ- ý¶„ËÙôý[ÝÙúÏðOpÅZ Gß(@ 'P_ »•f•Î¶íé(ìfÙ¾¨L´¥«Mö…ô‘“Ü/‡ ÆìuQ-†ë5eÒxùj{c¤~(³ÕÇÓ5°Ø?ôÓóåpr>¼xŸs•Œ]G‘#iî’«DGYƒ~š\„É æçü:jjSîùu.¬ ÖuÂù7Ýß5ï'´^„%TŸV/2]Ó‚èHêü¸¡•§¯}¶iÍ1Íô›Ñ÷(44] t-#Bg-Ã;ðÛj=s(2°¯. *®‹×AâªÈÚQ|oó[ž”›æÅÞªµoUpåÊøSò<þðms^ñ;EgTÐ8LAÑE4P»F_ ð8wIy7ð­ñÚ´­Ìó ¢ôsà¦@ã¡ËljŸæØŽzÅý.¾r¡Ë•‘Ö[®àÝ-ÍSóC"“†’iµY¤‘ÇEÀ1„6‚Dn}\Ù‰×Tv"m;4E¦À°Ÿ:û±Á?n¢~§5=r«)áÛ´‘UóÔÎM5Àåéƒði :[Aƾ%CïÉêð$fU´Ý¯× +þ¶a’Éendstream endobj -6623 0 obj << +6959 0 obj << /Type /Page -/Contents 6624 0 R -/Resources 6622 0 R +/Contents 6960 0 R +/Resources 6958 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6615 0 R ->> endobj -6625 0 obj << -/D [6623 0 R /XYZ 85.039 781.388 null] +/Parent 6963 0 R >> endobj -2346 0 obj << -/D [6623 0 R /XYZ 85.039 558.485 null] ->> endobj -6626 0 obj << -/D [6623 0 R /XYZ 85.039 514.734 null] +6961 0 obj << +/D [6959 0 R /XYZ 85.039 781.388 null] >> endobj -2350 0 obj << -/D [6623 0 R /XYZ 85.039 361.848 null] +2434 0 obj << +/D [6959 0 R /XYZ 85.039 761.463 null] >> endobj -6627 0 obj << -/D [6623 0 R /XYZ 85.039 327.044 null] +6962 0 obj << +/D [6959 0 R /XYZ 85.039 741.134 null] >> endobj -6622 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F35 2976 0 R >> -/XObject << /Im1 4096 0 R >> +6958 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R /F62 4159 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6630 0 obj << -/Length 2885 +6966 0 obj << +/Length 2522 /Filter /FlateDecode >> stream -xÚ¥]sÛ6òÝ¿BÓ—£fjŠH‰Ì=¹IÚºwq|Ž2¹™¶°DK‹¤BRuüïo¿’¥tæ&“X,°‹ýÆ*á$€?á$‰ý@§“Eú:I&«â*˜l`å—«P0®庇óÓòjös<Ÿ„ŸédùÔûQ¬'ËõïÞÛ_oî—ï¦×ZkOÍýéõb‘x·wË÷¿LCïáfšhoy{÷ #|øÄß/·wï>NUâ}ÀÝ{À^~AÐLJ9¬å¯<útó᧛éŸËß®Þ/ÏŽà/E†¿^ýþg0YÃå~» -|&“~ËÅpìÇ‘–ùîêÓÕÜQ¼Mxט|bøq¢OÆ#Š?"Ðû¿ðRYý:½ŽÔÜ+ážÙô:ôZ¿à?UýÌky‰Ó6«ŸÉ¬+ã•bªÞ¡iy¶5ˆÇç"dá™’W>ÀÆÄ}Ës³^¤Î<«Aå(íÝð¬š^ëܴٚ±_žÃ†v+ÛåÔ$õVHá‰ëÚ^£iÜn³:C ¸®C”fJ×/ ²—×aê=ÉîÓ*ð*kF(ª:ãÑí=‡7Èì=¢(ð–D’°ò†Ï¹ûÈsÇÞδx¡ªl¶ù×bgåüfÉ«¦¼D_`åZü±ò9½ýp÷€žžÙí`°Àa…·<3 aå”KAÊg{hd.KƒGÀÈÛÚà5_H„/Ò˲:ks²© EQòàí¡Î@˜q¼ðè --¯.yPT ›*ͪi¬¬¨¼•4›ã®/„˜e@×Õ‰Wöd^!ëÏO½UU°}#wùÊ × oiͳX9 °÷SÔªuD:4y¹á¡³TÄKáçxã šÎ<ð>‘$V#^Ø• ÕΑŒ˜ÐˆÂ7»ŠÄ´Û‰ÈH6ÿz°b²6@&뛬Ìê½Î -“—¢ñ?‚0ú– â“Õ°!«ü=©·ÍW‡©ûJ–@bV}ª¢X…¶vVˆá«”U¬¼êÉÑ8½º„Jæ'.¡’¸9+J¦ ›/ú+NŸPÛUÁßs)¦4Z,ľg¹× V¼îü—3Ô0Œ?P$AB¸¾E·Æª2ãÁ-⺠„4ÜH§J¢‹c¡ú-@Ñ!pÜâ,ìLNâr¤ÞGñГ°zÎIœS†áˆÛî´Œ:/Ø÷‘Z€'nÊÆƼ™)ìΧBvxè[§’!dCny/9»¾îq `G¾ÅËÔ%Y8 å%Ia‚{ópÏÀ:Ûï(ÚA=á[Âjá)þ²µ§¢¦ç ™Ù<íä…z@xUó‚áé¾®ˆ7(ΤLÒ¸Œ ¶âïIÄÊdKŽ™“¨—Uë8ÊD-Ø´%•ä‘8 uU­$åjÇ[rÊò²~J0×c²ÇhOi<ï@JÒ -£9éCY÷ÐǬ °4~è¥dÄÅktyVŽs¡S³IU;öŵPÇÝ<4Âu=£-ãå‚gx -Á€¸¬/™[¤ÙvñKª¬XPxv;ªp4z ĺW“4p°|{?CïˆtàörðÝj:ŸÛ_îŽæ#™”äê,ðç¥%€«’'#­¼YÖÒ9³žd›á(Lá€JPÔÈÝ{§†Ã%TçÉ -Š@ -æJÆ>XÆDp¼eíZJ¦ÆEßJHëì~PÇ"ÂÖ4< ÚqLd-ï*ò~$Å%à Œøµ2¬_C¸˜=`Ì8™iAw1:ÐäÑÍ×âYù“ÔTt‘/ˆ{áN¢3À(umj©BÛdÖy§[‰ Ö%CSÀxg˜k¬€¡Z*\ÀÚ°`•†ä˜¡ -­â@F{*†{2ÛN†üƒDê‘@@ ÈùàóXWd!œ ©þ(Uoy¯zèDjK×vËquÍ;º¼QPúüîž7þÄÁg«qé¡ÛojS0àÔϹç˶`e*[}¬Ç -rÄDn_QN™ mçl‰ƒ±'YÃÔ(Øâ§p™‘íÃ’÷™|ûMWÚ Ð± Ó}.Â͞Π-ÙÄ€îN‹ì_8倫éÀÂ%"àxO&ƒJ`Õ¢¯Íµ$CmÝ`Oê¦Ðy„Ðcˆî8Þ"s 8â³v¯ÿä"­K§yÍ;+:·ä §bÖ¨\a$²!xhq—GPêÑ1C ƒX«ßŒüƒ8o8YhëÅP>SäÇ}Ž:¥p +Tf†ž}Ý˦e¸«’‰‹’\Á ÎºGù! A…ç2B?7ûÒ‹”˜`Ks€í§wѳÅmë•š³~OÒ8À8TÁ “bÃUyçlo˜ÄâE Ûg,ªÕl[5ô$¥@YÏöT‘)¬mâ&WTsvmì_SÁàóÝígÿv¯¥Ã7Æ["™·÷žu… -õflá'ÈáBÓˆÕÓØÂøSØ÷r µ’)F-…rJt -,à,êÞ.º k2@cU%Göœ{fᦋéH½‰:ã£x¼»yb­û:·- ×¢°­e«Ôb'¾ø²Í][$Å|šáþ4v1 ÇÏ¥ó~Dêu®òÒîë°B¹-§¡×Õà»s@ZníÛÁØşݾC «‚¯8† ²$|(öÌ'gË%C™±÷¥i@×Q0Ò_hHÅ~Y¤ˆWÛÜÖ/+ ¬Œ èŒoòÂ#³A¨{—A!‚&UËi¦´…2f{~Õ<+$µ'¨öÒÐßæEˆqœ²¦0–¢©¹û<ß™Ça‰;ÒÿÓòÓùŦv‡B-[‹¡Ÿ¢½¹–­Žc?šsO[Í}íYE½±€ -ö\ -ž6}:ÇK¬üh]f¦Ã9Û@†w¯ÃT"`.ÕY#Db経rœÖ¢ zlŸÔ„„€Óü‘^7uÎ(oÎÜI¥¡¯´ºx§Ý) -{w -ƒÐí’ÇËâ˜^Ìý$N.´8'R CâSŠK›ÃèébÅCU;ö¬äÖUa\#¢âo?"u¸Ñ0Œd]§ý”Š—MsN¦óȵ¾,Óç‚Lé»2½@°“éÅq™ö(’L©™'¡Kø† rÓ+2Yt-Kœ¬¥Ê-P^”nGDjn«ÃNÊH˜º¥x§Ún{›¯¸sŠõ!ý¦v*qÈD~Ù<‡±¢¬_¹), Tüu#=ÅÓE=]ªÆÌ.G§´,,Múèj!¶¤HZ[y}\=bc&£´%—ã\ç‚ÉÒwMæÁÎdŽ(Ž›L"»ahMráÒ¡\tÅd#ëO&é· Æ;ë´€uçÎýÔõßB¯k× #J -ôwÔÃ…ëí3IRɳkh…l&øÝw©³æÜ9VÙuØ“±R¹­MÙ¸Ÿª$Bs’­žÑÎöç¬"LÖM—Œ¢C9›üÂùÂñ ùé~òCÃöWÂÖ -g¸ÁØðíáœM_à?cÝ2ŸR0ˆ‡ùƒ0/Ô4+>q½ÈL)¨6öË–Ëâ÷ B\Ç+µã¶ua"åî$vï‘^¼€"¥k >ñyîPœt± N2øj¤SV¶"} À»mÏ´°è ËŸ•µíœ¡«Rš‘›CÝY. š”ô3IØU»j÷Üùƒf§Ð—¦5dÏz=èqG®ÁŠã^ÚÄ)ç]Û œ–&ø’gÕY`Ø¢ïIêTB.ÉÓkçËo zÛÞä°Â_>å=Ú?³ŸußáèHûs½ £á®XÇ*¦0ßüø˜s'a¬ |•Žyüefÿ¯ÿ­à| ØKt:îJ±R¾ --/x½Žùµÿ«á„áÿt¼EÃendstream +xÚ•YmÛ¸þž_±åâ¬å‹$K(Š" .i¸¤¸lpôúkim!²´èx÷~}ç’lkÖÔpHçå™Fß(ø§oò4V¶¸Ùä:¶y~³=¼R7;˜yÿJ G’Ú8M/L®Ãì:3±J6K<êfmó8I3œ|s÷êöQ7FÅYfoîˆé®üOd6ñj¦*ú²ÒQ»Z먆Á¶[­­ŠJü®nßeC·²:ê‡Ê«ÿÞýòêç»ùii¬³ìIŒíƼ4™ÅVŸ‰©“Ø&Ù…˜MŠèÝ +$«œ?öÊ4€¤Y¹¶ÄÁ&zSµÕŸJ'87ɹ¤M\(3«Ó­€RÌýùÛÊäQÕ?¯ÖfSD5¢£ãà$`žÿú#Ì»¦‘é)ˆ}5àÜ!1Yô©,6¹Žºföû@SÑŽïæøm¡!d6QÛy¸–œV ¼#9dþž¬P:T™X'OÈÉì«ÜF?U2(ò=¸­ÒxÊÐñoC7ßÉÑ;¢æËÓÖ›()÷;t-“{ô²#Í=ÐJ„×õ¢VØÓwÓE6xêé(/׺ÖËFÕÓ¶9£#Y›\î‹v +žÄâ ¡0Ê0üŽÁ@¿(^½«Û8œ x¡ +>ù0%–Â’´mV&a+l×û0ådDöD¦‹0`ø‰³Û“»òÝ»µ‰Ÿ‹l[•<åÀ–¥`$Ô;o÷ë .ÆÎ+ /mê7òÊþ¨Òß·çЖ³X"È´G +Ë­CèG:Up6)í"0͈6è%ZEd¯ž|@!)W@âºaË":Î÷ëùÌSÍ°GãQøá{òzÚ·!¥mK9²ã_®Ô÷cø?’ÃQV-Å®Qµ© åõp‘ $Ä;Ê+F 0^‰OJ.†äÅ\dTpk&»ä¬wm¢d.Ê,ÈÀ?ÛQÞ¡º‘…ÕÍÀÂ{öÌ<šà•°˜ÛŒ¤&ÜŸ‘ü +gZ ØCBÃøßRúHlé%n…s·ªTáà¡^BŒ,N`ŒÚÁ¨®Y@ª Qz Å«æpú+¢,bGq£wU>ÐÙô1Õ, +©¶…)*ô†0>½»o$ Q*4 Sž€ßQ2æîäw†=£»á?Š:D6ihkÀ±Eô±“Ó©†¡[]Æäµo’„&Ïf}@ î bòtQgHGãOôÂæzY½Å[°Q¦œj¿g¦÷c•}@m#‰ïTqôFv‘F¿8j ÚjX–Å‘ÍðZ²À L#—§<¦èD÷Šîÿe8r'fs¶j¾‰¦Dسý¼Ð;Æ}§)&Ípw&¿G¼¯™Î̳€x•8 Ì ¾›Hž/H‚;³+Ð ¨”ûmü¨e?öFxÄì²mÕ“è 5ý,K;Uq÷ÜR„fæ¼Læ0º{o±7l/p4W{ÊÀ¡‹´Ëõ)²TgM#²ºp™Ø ÁÈøyFµÃQÎðûŽ¼z“F#FR¡„s¸Õ©ÞÙæ#H<ká Z«êk—.G cPQ­¤ˆêÆÔÀ·Î’•|ÇS}pŸÉËVÒ$ݾËÌ Qqžæ¡@L2ý ôôýþÎÒÔf ÀªUÃ…Bý¶àgS¹Ÿî€3¯t`$Ak‘žìÄoÔ(ù™¶´©ƒL™` ySRpÜSÁ¥’åÇ©tòUo»cSò +:¡n¿òõ¤„ˆ¤øg9¸븠%"W&Xøú«†g¸®`à%¡À$ƒu¤$wu„°^ìÏ8òãcCxi—BX¥²å’à^¹cß{­±¥Ø}-PC, –®/©]³Â…BC +‹C²0È-âb}õЧ7ÐXÈÀ:/â,/þßOÊEn_Ê«Òfq–mÎû¸—7Ã(„ÂK®_ÏP¶ü¶J3yò¡Æêã€û8Pm6&‡üûꑸ¾Ò Øb!0² +-ÏRGþèZhüh«±-ýïì¢!ó µIÈÚKJy¡ÆÄ` + Gq#ü˜žo„w{õ¢50'— +…<à€\Éd§®ñô)4G/¾÷L m™ !26‚Ø8pv\|º! €õwBÌ2< œ0f±njywG¤ùù…¥©¨ñœÁ€ÑK0€ÆF­;ˆY¸"Îçøœ&q¦BѺí %~¡N-”©ÈegAºÐ¯õ¶ï†îÁÓ›¢ŠþÕ‰±òù›r/+'e²y’U«DŸiªSe)9v<\LËVy‘ƒA[í:_;ðªñ HÙåÊZÉÛ­2SƒÄ 9KžåÇËð, Ÿ–7ÈrûöûÏ<ûH¯^^5º†`>˜§˜$Û¨bŠ%\BÖãç4:~Á;ÞeŠLcŒàǸc\4¡¶ƒû6Di¬Å„<. A1W röüNk]óuìññ—ê|ÔjÊÉ®D!oê)°Ð·±½L²ècE±ÌÍWræû×WÇòE‚†=KªwòÆg”z’áÿ¦OPäñe¼z–œ¦ÿP´^<žê¾Zx˜Ì ÈÓ9¾_>KÇiñ£;[˜Ë3ŒMâ"½ø?³ðû?€W´_endstream endobj -6629 0 obj << +6965 0 obj << /Type /Page -/Contents 6630 0 R -/Resources 6628 0 R +/Contents 6966 0 R +/Resources 6964 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6615 0 R +/Parent 6963 0 R +/Annots [ 6969 0 R 6971 0 R ] >> endobj -6631 0 obj << -/D [6629 0 R /XYZ 85.039 781.388 null] +6969 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [246.134 503.717 356.339 515.406] +/Subtype/Link/A<> >> endobj -2354 0 obj << -/D [6629 0 R /XYZ 85.039 382.96 null] +6971 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [260.876 187.558 299.535 199.247] +/Subtype/Link/A<> >> endobj -6632 0 obj << -/D [6629 0 R /XYZ 85.039 345.429 null] +6967 0 obj << +/D [6965 0 R /XYZ 85.039 781.388 null] >> endobj -2358 0 obj << -/D [6629 0 R /XYZ 85.039 192.55 null] +2438 0 obj << +/D [6965 0 R /XYZ 85.039 761.463 null] >> endobj -6633 0 obj << -/D [6629 0 R /XYZ 85.039 157.14 null] +3221 0 obj << +/D [6965 0 R /XYZ 85.039 652.347 null] >> endobj -6628 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F35 2976 0 R >> +2442 0 obj << +/D [6965 0 R /XYZ 85.039 652.347 null] +>> endobj +6968 0 obj << +/D [6965 0 R /XYZ 85.039 615.228 null] +>> endobj +2446 0 obj << +/D [6965 0 R /XYZ 85.039 447.626 null] +>> endobj +6970 0 obj << +/D [6965 0 R /XYZ 85.039 407.462 null] +>> endobj +6964 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F62 4159 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6636 0 obj << -/Length 2000 +6974 0 obj << +/Length 2503 /Filter /FlateDecode >> stream -xÚ¥XK“Û6¾Ï¯Py/T%¢H‚”(ßÆ^Ç™<Æ^ª|Hr€DjĘ"d²2ÿ~ûë!žCÊåÐèú ƃˆþŃ< #5Ló8Ty>Xnn¢Á#¼¿‰ÆÈ¡ŒŽpÞÌoÆ?e“A…³h6˜¯|²0ÍÔ`^ü¼ýùöãüݧáH)$“p8šNóàî~þîý0>ÝsÌïîß Âïòûùîþ¿†I|v€ûw„=ÿ ЇO¿z¬ùϲz¸ýýÍíð¯ù/7ïæ^g¯ é7ƒÂ_oþø+t¹_n¢PÍòÁžÖQÓñæ†4³T¹}}ópó?ÏJÎÒP]²O¦ò0ËÕ¹TvÁ@YfQÊÚìj[ GY’¦ÁÆ?ÅÇ$Ñ`”ªp¢&Œm×d‡r8Šƒ†nžÅÁb8J¦!8ouQB[v@é±ÃItk³££º8¦+å¬-í®mzÎà@~Jg³à#(¨;»*[áaû]»³vZmõ£­ˆƒqøkÓÙp nÂV]õÇ@ݵ–þ®IYwÉð_½(­®ê.¼âæÉ4# -ºïïû&¡Ó8œA€÷;ÉÄÚ¯*$}R2G–EÁ¸´ËqÓuÚã-,Ë5Ж¦Y]Ó.†Ùäû©u„ÃÚÅ"gOÂ4–Ôš¯+òmšgÁŸQœÂMX÷öMfmMí0ØEXh>·] ¨Ñ>œ nL½³¸qBÝ>––ÉŒSḺva"wa‚­EŽ>m R-u]? àëÎKak‚}6X+ˆfS÷Á¸´ç‘Ðm)x‰lÙû*ðF#z*Ó æUÊQV¦†03¤ßw¯%ËÔõ,ûäcïî}eÉÁ½w{]ҙýcú{6,Veû­Zöæ'k0­w­¶,ЪªËðüÒ^N2 #*B€m5)W¼&kL˜×f«íuunk[¶ Iúæ)ÛVp‹EbÁLM[ÈNï(tK¾úܺfÄìXN¯å‰Õ Ûsmiñƒ#)»Ê8§‹>ºÆfèKWlJKnÿÒõžó2N8·iI!Òv½ƒNèÎm[cÍ’J$Eä†)Úíòeî.X$Ó®Ýâ¥þúMIõUU²åbUþ85LªŸTDÖ‚e{rÔ•¹KÞ¦I¥òäÊ;Õ¨çóÁq‹;Ü ð¤…l“F:  œ±Ž A²þæ„k7µ7L'ZýtÂýe?¬ræ5ûºóÔv¼ñlÈT<Žê^V'¼N5œÈAÙ@€…ÓSêxo?Žï>~ON/›¶£È~˜ªÒ”ªH-}‰[é[ YŸ@x¯gÓW^ç?ij´ÙmÊ ”!ͲÚjÇ^ÂSù~©¿Tàó(d̳~”=yY5¥3\û4ÌÓwKÖ? Ruk=OÊdêlk±™4ö¶ãz@&a$ËNóõ º~<Àú·Š…Ëÿ#nÇyÀ—0íÐùmæ&GZ°CþÁeq|yZ%d™Vi!µ™ð)Q0ÄñÚÁÑ©%ßÏÝÊ÷^µº³í®§ã¹ª5=k:#¿\8Èiƒø~~A.ëÊEH'€}Å!’'G±I`½¨ÝŠ/CÇfACñP^y¢éîÔh` ±=°VòËÏ+úýÌ$…áv"ïKûÄwΫ*LÕÁþ2ôã›äQp{áÅ8'­çxÜA{Ôtk^Y[Á‚þÆÛN¼¥©˜ñ)؈•Ï”ó½é,=;J‡ïsã@ -Ä1§áBX‡n¼´¦}¨n -YH½ ¯pÇW²ÞjÐh‰ Ëb‚úæPÝqžª“4æ”ñM2Ì…è;ÄV¼’‰ðv)®9!¯R¥ÜNÇÒŸä¥zCò„ady1ÂSÔ¶nQ⬳P~WÒÆ•ÜJ^“«Ü¯”(¬üÝ ÍV¾GˆdöoíN,¿ÀRø@ ½fOl€Š•&U,N!_±Ò_¤6³K-„­I‚$kL¥ ò¥=%«Q - %îGôg%íÀ¸6>`Ý 6I™q†‹…½_©rÒ_ -Öìª$bWÕØ~–À;FÚÚ1tÿꮨDî¾þÙÏŽéi“%Èé­A!Q®Ž²ƒýW8Æ,/çë|D‘ÒYëÚ7…ÉìÒ7ú/>ÿW_éü—ès5»\¼²„&‘¸×†WÓøTßþkÞ™ÂÿÎH-endstream +xÚÕY[oÛF~÷¯ú²Ô"q8Cr ©ë46&+hmh‰¶XK¤JRV ôÇï¹ÌP”DÙmýÐ- ˜s9s;×ïÉQrd"¨t”)”1£Ùê,ÝÁÌwgÒR#-‚8©o¦g“·Q<’Hƒt4½%’éü'ïüݛӋOc_)å…‰ûIb¼Ïß_žøöb,½ À¬ô®¡s1½ÿ2½:»˜öñµÐ±ÂS~;ûé—`4‡‹\B¥f´…v dšŽVg:R"ÒÊö—g×gÿévá9=âUoñ…/S‘†Ñð{}|_”v/aX ¥ãþ‹á‘ +žéÔ»ÎV7<=N¼¬œsã|‘•ôê&o÷Ø“Tœ”ÝI2à훶ԡWÝâ—Y˜­ÆaâÝ`ËG¶ÂU¤¼B…÷éfyÉ i²’;?Qmé͹¿-–Ë1 K>¨Í°ϳ¤,hƒjìöóÜ^gïÿå5“¶ ;µ-jX”ã`‘ŽwY"aëFkÜ4[.ÇF{ý[ïÆ^ùI*|Çv÷~`$É„oÚPÕ´gÎÊw_€¤‡k”fžÁè ·^du6ké¶0ÔТ–>¯õÑ„Ž@M¢DH© ;³0¢Û”ÅБ0òfp8èžÃ +ÕÑ&ZÄ¡´ ~?¼ˆ‰íì¸Â öLñ„h¿,&…ZÜEÂÕ˜<¾aþÁÀÜ®é¥^Ë¢ƒÉ’DS(0ö‘ɱ]áꚪ5i ¯ËPúEyÇSÍcÃû­PC´†{Ž­ Coîôä/·YÚ{t/â ê?Õµ0AÈz¡Szöçé[ß0í[B#b[Þ€æé `;[nøÊ$Ì*cÀ&¤.í½ {[Õ<¿ªˆ?-÷¨ýè˜Öæ+úžÜÜÚÒÎzìaÀTGÐÉõÕqÝ’%Suäˬ¼C¦gwDÚCã †æd/¾}rŸ;óü6Ã%ÌYÅ{ÂwÝYÓ +«Ú4<~àQ`„©–NPYÃgó䉳!QIcDqÆz¶ëóËËç„$Žl3MD¦ öD$ú¯ç¼hÖËìñ9ûL%)× û”‚iõr­ÖÁ— 4ÞSæoËã€ÉSkg¿v¿Š¿ëz̶lÜF«œè§:5³ÒáHYÈêÎÛXúYUö5½CEŒ « ™>ŸÀ-mð~ˆîPæyIá¥{SVç6·i6ì ÑtU÷l³©;ô4³ãˆ«Â(´æ ÿè–ÇvGNnl»*{ç!Fü‰íÎqƒ™,ÇÎ}±Ÿ]ò‘CLÄ¥ ʹ;‰Y¾wApÇ“&°tÐ3kŽ9Òs~ƒF€I=P«SꯤÐ&|Vý#«þWô¼uV椠ò”dûIvß¼j¦§ÎŽ„”áÓÚßÏHÁ æÕ.›!¤dvÚŒø ^Õ÷ºUuÏZ‚6Î0Þaë*C  mrÞç0øvr³~=,ñX Â$ .1½`á˜F™n‹ð&zòùïØ(—è¹ä¿–‘:–#Éë^.1_A’µ¤ì1Ü*oÕ| (AˆÔÊ¥7_ó ‹¬YÅÐë0Qô †kU»ÂÔ¶’Óé´ÆèiÀ&†º+ Y¿Ìµ¥]! µ†âãšÜ슓RC€ƒäÝw ¥´%©~yª$ÓÒ&¼Ðp…0pZ+[p¢ð\Û’Iô·Í.·À"WgHTìºòå dþ«aX³{^ê=ôÞS争,¦ÈG€C >º-f臑Ž’®ê†^O[–L|ŽÄa.U!š6À•%.½)\˜ó!ñä5îyöVÖ™à&a5º¸Ã ç,î=~è"kz ¦r©%ÿtS ~¸˜ tó.ÄävŠ…©¾ã<öøfкø|î_}Äòž8©û§3ª´«ÎôöNƒL+{n‚dùŠÛ{1Ó_·c{lÿ¥!„0ãJƒO×Ìñ{¨bngžæÉÕåõ«Ýu 7 Ò%–üú³óÍ™q%“0U’vk@¢¡ˆ—»0j{¦Šq¯+#|ÍÛŸ[ûæhÂÄô öЯÜll¢tMÛ’¥ÒXg©Øëû,ø ÑÕïuSL•á`¯D™Ô±qºçÈ¡_N¹;ÀXEC›lXhÄÓ ˜ +ÿ Ó´åžþ\ÎB÷:D^@Ås–—ö ˜¡œbLŸâ‘þ±woòaxÛù1@"úÐù®–‹¨ÖW"°þýÀ¹;T ífƒaÁÂËz<ìþ¤ÁŸIþ¬à£dß~ž¾5þû7x9 +Ž“ó7h?“w?NÀéü[¸r¶ @wÈðE`Úá}eqJRÒ%±T¿bŒcŒK( ÃgU`Yã•Å`[OÁÀ^,³Â.v¦=‚¼2UäûÝuH`8QßYŠOß±œÔœm»~=™l·[‘µ«¬¾/Z1«Ä¯ëÉ-ÀÍÍ—I³ÎgE¶œØLJàÝÕA‰~TþdbÑ®–UL)"™tëzjuZ‡Š¡F²›×ɉÜjwÄ ~ÉU¨Qýëž¾¦JÕ‘Pzvç.ø?\éCendstream endobj -6635 0 obj << +6973 0 obj << /Type /Page -/Contents 6636 0 R -/Resources 6634 0 R +/Contents 6974 0 R +/Resources 6972 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6615 0 R +/Parent 6963 0 R +/Annots [ 6979 0 R 6980 0 R ] >> endobj -6637 0 obj << -/D [6635 0 R /XYZ 85.039 781.388 null] +6979 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [304.377 67.595 539.579 80.496] +/Subtype/Link/A<> >> endobj -2362 0 obj << -/D [6635 0 R /XYZ 85.039 678.053 null] +6980 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [84.043 55.864 194.853 66.341] +/Subtype/Link/A<> >> endobj -6638 0 obj << -/D [6635 0 R /XYZ 85.039 640.522 null] +6975 0 obj << +/D [6973 0 R /XYZ 85.039 781.388 null] >> endobj -6634 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R >> +2450 0 obj << +/D [6973 0 R /XYZ 85.039 761.463 null] +>> endobj +6976 0 obj << +/D [6973 0 R /XYZ 85.039 739.701 null] +>> endobj +2454 0 obj << +/D [6973 0 R /XYZ 85.039 474.266 null] +>> endobj +6977 0 obj << +/D [6973 0 R /XYZ 85.039 434.102 null] +>> endobj +2458 0 obj << +/D [6973 0 R /XYZ 85.039 363.466 null] +>> endobj +6978 0 obj << +/D [6973 0 R /XYZ 85.039 318.392 null] +>> endobj +6972 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F62 4159 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6641 0 obj << -/Length 3831 +6983 0 obj << +/Length 898 /Filter /FlateDecode >> stream -xÚÕ[ÝoÛ8Ï_aäI>l‰Ôçáp@ÚæÚìmÒ^㢻û ØJ¢[YJ%¹Ùü÷7_¤d[v·­ôP Éáp8üq8CNü‰ÿüIºžN'qâ»:I&óå‘7¹ƒ–×G¾PœÉÉ€æÅìèô_a4ñ=7õÒÉì¶çºA¨'³Å¯ÎË7gïfçï§'ZkGEîô$Žçâjvþzê;ïϦ‰vfW¯™àòš?^\½z;U‰óQ*®Îzö«Þ¾ÿ·¥š½á¯ë³ËgÓßg?ϬÌV/E?ýú»7YÀä~>ò\&“Gøö\š—G ±ZÊåÑõÑ,+n &ÜkL?†âÄOÝT…ûuùni«C­«ƒh¨ÃÐsC/ ‚ÚP\¤ÎÕôÄw²%(#‡™G±Óäm]®º¢®°9YËõ«6_pÍ#v) G‡÷øU1 i~?RÝ¢žjÏy”þUÞMµ¡Žš?ˆên—–ƒØý`ÿ¼{š·Ž`ÇWnä1vP¾Àù`à¢ZÀÿõTÅ$bà'0 ÒN `ñˆÿÕ %Vß1EÑ2ƒ‡&_ó¬C•`9»™ž õŠµ‚¤Ý=s#ÆÙR¾òlŽ#Þs·%)ŽÝUO_ˆ@wÅglË+X¬(œ)…o7C èÔsânBšî•!.P:Ÿ§!¬hS -r+Ÿ¸å7/ô²jÁ’eŽÍue óÑå -Õ•OÐÇç°»Ïùãx^Óä ×ªË®EfÕçÇ?¡Ü¾s<¦¢¥©!Ü»:ƒ¹)MûS_Ï[ëë;7Eâ&ëcè4~\| d—/°‹ÐL‡ëài笄º’i;ji ‚f"œy’Y%4‚d×ò†“Êso†¤ýæº7}sþ qþ4 “?ÐÝžw}‹ú‚9À†»),n¸\óHpêA1{” .à‚„Je[s·Îü¢ü¹00ÆV†Î4™ÕºC=Õ«nFuo2YÔˬÁ‘¡;2Å£Léjq65VÀõ‡cnÊP !“¡`Y¥±!¶šçŒÖù‰›ÿk÷L'ôüÓˇRbà×ú:bÅ}Á Ñ $`¼¥1 -h•ò‘ Óv÷@ž–ÆÝ9­S6Q„€Ê’á~e¡þ?.Þ^sý`õ Cœ2~äfóŽ–èüˆ+YÞ Õ‘Íyë7Ò‘–HK£*‚pw/¢XC%ìýÕ€ìL³F”õ£–1 Öä4á¼a;ˆ3aÿ]MY/Êó É\ËØLe­jYM¤Ëø§®úªdüÔI‰íc¹’"3ë¸ÀgïÄF—Ëè<8ˆhš¤·Õ _ØÜÖ´YG›´b™oyO¤´u¶p•wƒ%õ£ÁÐË -»ÈœSM~W´ ,&Ãlö“ô,DÎGH’ucw÷‡ 02½µj»`p€L¿6‘™ŸX3ƒû퉎éý²;<Ꭶ×ÔÒÄñ eÓ: s§©Q…gÁ4°ä©ódzæÜa^r®¶ÖªðÂQÉÚ!»¸l½‚η¸‚eIã=Õóf{ÂBÆÀa(ÅùÙ X?Ø §{4€Ì†ÓïW™¶* íßw¸U!¸Š‘ö·½×8Å{ÕÞ«Þò^q­ÀVcΙ¯c7cpÎÜ0Ž†›¿ÖSJ»žMNÂP¹ÞÀÔÀŸ3T†ˆV` -žBvSý$ø8÷ o0—7Ja<춥•@¯PMlK)4[R®³É ‡ûPáFú´Ê×VÿÅز·›’e÷5“lKB­|×S;hGí£Åx*˜hÏ ”þ¾H¦ß·»ØP'Øð—P¯s±.}¨ð#Wn -aT„*u}vèÏp7¼|squ~uvyÎ뮓a»*Ö²îÿFâI(íž7ÂA¾˜âŸ[Èð" P&+÷·+Á0Û¯¥S7N‚®ÍÙHô -åÂzŠl£ÄÇÏ=™ª’ð‹zP´‡ñò¶B×Ð+ !?Èl/r5Do'6þn†¡)‰÷ƒÐi£? õ·Ã°—ü0ܧ.¬ÞP¯ó*oð´"(­{µlúúàpˆ1'º½!„& -*wÁî³{ØÊøiìîºÎ0°ó|WyásÀN}»õë?êöiAù‰›Â7TÃ/Yu9åÕ¿¡14ijÄC(` ˜éÌD•ÚÌÈÃh ؘ–ÄÜ«âÏë÷Tøðn]qè¦_§3†Oß ôE|öò û´¡ÒÜTµ¦ŽWr©Áf±í 4_˜@C®!%ðØ…±CLâÐÖO¹i8`¨Üüï‡ó%9HÀ2êØû‘rU 8` ÿZÀÀÚ&¨Í°¯Â‹P¢Ý‹úê€E!Äà“Ûá€ÐlI¹6Î&':Çí5Úrû¹›è°øcBl«L¬Äÿslø©¥»ÝÂØO& ³Gêù¬à·8‡pX&;äÿ+(ÌökCy‰ qÊš:Ö¼Ã+ xåîoŒúg†&ï/lsa“•r‡Â˜\b?¾ÐÝ$2ÃÛgzÍ#㣠]˜Ê¼C …e+܇ÐP€qœü縺13A°r=——º‰|=‚ƒ¿zŽÏǬ=ýE÷òÁû´g7P­icxŒ¿¬ù¶°©éÀ^ -O×®z¤¾«·Ôv'1Ï5þXøn⩽‘ŽNCX€èýÉÅ×û“üÀá^mÐÁ ŸCuüR“ų÷ÉäSÊS -ù•|õý(¡ÏN˜d?°¹Ó1ìá0Økîtž¡Ÿ>£¹Ë¿ÙÜ ä?ÌöiC:­©ã‚M\Þ žÏ!Ú¹÷ìÖåà©d:â*ZÄbF‡FÆ0þóÅ0=!Òð}½7]EëÔÕš·ùEÇJnÍkj½*­Kdߧª;v•ûG)p7lÁÆËV!¿ H0xÚCB©ì3IpÌ>+B¸döéíÄÞ¾ôœˆâ†®‰ãÅBp;³ûõÇßá³·Òüج”¼Îš'x¬19**…“Œ ÓÓ0üÎ^¾;½xÇ”…MdéøUŸžÉ¸i/Ö¾cߌz¥k²=åC›@™'n%×LO½÷ºäêl±,ªÞ©å:zÅA N$Ùz÷^ä°ë–|mÊù8ð˜ôšÐ9Í;šú)¡‚Y·ÜD9,@»ÕçÕÕ5×,²VÂMJë#¾6V³{š¼OóÁÝΧOÁùOÔ»à4‡`à„¥ ¤7²´Ù_eåy¿{\}krbϹ]5”IA ŠRXÍ™gh¢˜Œhž—YSüæù¹ñËp%£-ÝÚNPÅÀ”Ñh;aFPœˆö 5~z_·¤f(#ûRÚlVI”öXÝPcc›yÝ,¤7§ž$-Õ8?qì­=/)eˆRà{ýÑ&ƒ™}#Ž uQÑ#u³Ì$µRÔ2îRX|¤m²°Þö$ –EŸè¡8Ù›O%çT/ŽrÈ€•¤f6å k€³y»™B5ò̵”VÂÈx›;7¤”LÒqa™I¨ˆ»¨X°GX¾à4’4qÎ*æÇ™UÙò¡ì%0cu÷d…Bɹ •ì¬¹çì(±²Í½¦ˆ*“_Ðñö‚o*\%Þ ':”Δ±‘’®æ¦Ò8‚h½±!ãz“EE46øÀÒZ>MƒöWEtÐ`#‚šä1Ø\C,X­Ó8yìEÇ´µø»¾¹¹èsÄ - „"âå›Ç5ƒ§·JƒÜ°–+yãâi©?O¹rxž£…¦.’c‡ßl(Øí CUñV•]5ûÞàëâû=.3ÂRû˜¡„â–‚ÞtpOô óJsã -`Sau“ qkìUjhhÛà!5È9åš >¤N¸hà î>ªÐ˜EtB¡Ê&ï蜪èTÄ2áÀjÇ KD¡+e—± è ƒÜPX6"<­–t”R*³É,$›5Üq4¹¤Ã±i;#:Ù¾¢¿ç·Íœé þgN™pâñ™‹âÍmj3¡z'Ю&½Ìõ‰VdXvxœfèÞ3Á®,Ï@ñÆ 63<ƒÑÄÎ@õ ¯:ðŽ5ÐÏk:5W­µPÙöÙÑBÖk§•Ù–‰Ý–L–󀼜6%-ÀÒ;dZÜžŒ¹Áó¬šçìP2RÍî,¥ [Ñ Õ8q’7ØöÚî‡9a´èŒ¹L1Q­·1l6æÝJ7´ÏY Øc€º6-Ò¦Òcóx²6f‚K=3¡“;2áã>]x-{w4““i3ÉÉíç«À‡*l’%ÎùÉäè"Ѫ*žœoüdE¨À2xq=ïÜÏyfÕrè ƒbKÃZ…§RÞŒ-tWŸˆ3‘K–ä"·¹÷wüG -£rNÆÆŸpÇ…¤ksš:~o¦tJJx$)ÀdÚÞäýßÈýæZú&ë¹»/"×Ìí`*¾†áªÅ¶y¹Ã—8òÐqÓŠÇ]Ñ&“´t¬4lù/OÄÍ“”Oü%¶´i×6ëúR@¿”'Œ´äÝiÌ馘߸âAR¬Ò]óÇ ‡Š·d28þÁÀ›³÷ç\Ât„·¯Î×[q3vvÑ} ,¥EVIâ,k{Æ™¿(¾ƒðU%)`¸"ÜihT‰…¬¶Qn r`—.a¯ÅÞ"R ”k.ÏáĹc\`›ÅÖE‡hÂbJ–ö9·þ‰¿ë‡©û;?·L-VVµô’€y‹PZyÂiåJ<}e6,¯@Ûï%€RlŽü‘€ž†Í—øÚD8PF½,±‘Eþ€ŠÄ Æ78ŸÂ£& üŸìÁ‹ÞFkò„?­ˆÖÌýò®?eÒÜšL…ÊÞøñ õ4PìªM nºr¿EdW×bš•›˜J`è¶Û¨s¼€' øÉ#㲂ÈF¦¼;ö쾈%wcÔœAÓà¶gQ¬È¾{(Ú§sŒâ)à¡bÏ^ Òï|FçÅÆÁ¬ú!w:åÄbª4"å ìW8ÛÙ¶+ú™ÌZÒԌܰì,&kŸí÷è‚S.’žÒD¤ƒÿÈå8–¥È=ɾñß '¡á¡úßñ¯h{¿ÛÞ^ºö;º +š81ô>žAãeàÛóâ`·¨Óäؾ?ÁRä£ÿð+?pÜ ¦ÖOäxê*KHV•…ÃÓw ŠÜ`˜3nuFÞøíû¦÷;{&â£YeƼ¹Ï¡§90ö“9]ÆvÂؽ7œ—ÝŒˆ­8„,·x0švàÜïJwY¸›á¬Ní¶u>̶ £‹ëU3m@‰ÙvN›*÷¦?mštÇ,œØM Ã~Y2yYN”r"ãDåK”ÙÊÛe6ÖÝ›àéŽ0&¨\ÔzÉöeƒ4¡Z3ò†öë ²Õzi䤸ÐeApÙ¢x‚±£.Åj‹oˆºl}¯&ä`³ø)ê¹–NáFêz[UEŽˆ'äfã½ÏUn°‘RYñ¦·²¶è‡F×8.®úö…–¤>‘uÇvùƒ‘œÎw÷ÔÖI^œcÃ=ÏÐ<ÉOgÞP-š$ó¯ÊãÿX‘PžžðüõFþŠk +ÂÀpð'|ýfendstream endobj -6640 0 obj << +6982 0 obj << /Type /Page -/Contents 6641 0 R -/Resources 6639 0 R +/Contents 6983 0 R +/Resources 6981 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6615 0 R +/Parent 6963 0 R >> endobj -6642 0 obj << -/D [6640 0 R /XYZ 85.039 781.388 null] ->> endobj -2366 0 obj << -/D [6640 0 R /XYZ 85.039 761.463 null] ->> endobj -6643 0 obj << -/D [6640 0 R /XYZ 85.039 736.911 null] +6984 0 obj << +/D [6982 0 R /XYZ 85.039 781.388 null] >> endobj -6644 0 obj << -/D [6640 0 R /XYZ 85.039 559.639 null] +2462 0 obj << +/D [6982 0 R /XYZ 85.039 761.463 null] >> endobj -6645 0 obj << -/D [6640 0 R /XYZ 286.152 565.612 null] +6985 0 obj << +/D [6982 0 R /XYZ 85.039 739.701 null] >> endobj -6646 0 obj << -/D [6640 0 R /XYZ 85.039 454.3 null] +2466 0 obj << +/D [6982 0 R /XYZ 85.039 739.701 null] >> endobj -6647 0 obj << -/D [6640 0 R /XYZ 310.417 460.274 null] +6986 0 obj << +/D [6982 0 R /XYZ 85.039 705.159 null] >> endobj -6639 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F38 2997 0 R >> +6981 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F59 3455 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6650 0 obj << -/Length 2805 +6989 0 obj << +/Length 736 /Filter /FlateDecode >> stream -xÚ¥YÝsÛ6÷_áI^¨™Š! R"û»n¢ž¿.RÏwÓö¦h‰gŠTI(ŽÿûÛ/”D9™¹ÉÄ‹Åbw±ûåŸ{ðÏ?#×SÉù4ö]ÇçéæÌ;_Á̧3_8ÆÂ2îñ\,Î>üMÎ}ÏM¼ä|ñÔɉÜ0Rç‹åÎåç÷‹«/£±RÊ &îh<ÆÎìvqõiä;_>Žbå,f·Ÿ˜áfÎíÃìö—»Q;B¸½îÅ’î¾ü£åZ|æÞüãÍÅÇÑ_‹ßή­Î­6 _‚ -ÿ}öÇ_Þù÷Û™çª$>¾çú0½9Ý(T2.ÎægÿlEñ\xΫ†ì©Øbul ?0P乑’èÈQä<äpÂr ªQ0u^$OœÙhì;Ïþ‚ªú9GòŠ9rá4ëQ8;m¡¦…ËN‚têMÞŠ]òî¦âv×d¼~ƒ“:ÅýÖ–›ôÑ›L¶xªj^¤‹‚;H©.˜CãBÙ¡ÎHde2ômì£M2ÂwšÂNhØ)ô•CûøN£WBØê¦ÉË„Ð$†`X³R4S£ÙŒì^H ø,´?ŽPtÃì)­BÑqøÎ<«¿ây³šWÜ*paχº>3ÓŸ^äÍAÒÍô|¦éR$š58çø´ä±©çä›mÁVÉJÜØdKžØ±®¾Óúˆfqç–½y1»ÃЙ$püÊPÜ°rhå‚YQ;˜¹=Ž ž¿Ð¼MÊÃY‰a³3<ºC5Ì–þ2eþÚV Žˆ¢„› $¡:½³FtÔBLá9 Ü”ý…ÇMõ¶Ù¡´i]àaô‚ƒyÁõõ%wð ×Õ -ýgG¼×yù̽K:2›þ*¬/<¾¡á9cnò’¼¬sŽt&§l•ŒGdwìÔhˆgŽ{‹Ê ØåÐÂÕ(ÈË^çß!ûa†û}Ælxf°«8l*ƒ5}‡®ùf²rÙ¿ÎÀö;‡~Í£™DWý¤ÓL<ª}Ï#y ;ºh*Þ¡õê]9pâ -¥óͱ›ÆâïÿÍü: z8Í L¨…ê”›¤‰Ç‚."TaË+÷Þzq$ OÁ\þSo¢ÈŽå$ÌU*p§Q¸‡sƒCœ{}ÔÏ„Ïæô¸‹µ³ <¡¢SÇŽç$Ô ’ØøâU -‹ àÍ3î3MuWqGÐß(8MùÆÖAzUТ’Û É`àB€ÌÛÏ…®Ç¼÷ØžçíKºü™ú½3Iàª$°að´p¸?qám+,³[ØóXJ@NøãræÿÁÈ_\ݨ`@Z4q#?ú¾4¿¿|™ýëêË|H’÷ã:]-.骎#OÛ'¨ì˜Ê3MîÀ+„]¶ƒ>aQ`üxˆEÁ_­”þ‚#”ØG4öøÉȇe#HiÉ“ˆEt^#¶C_.Яo>ß‘ç< Ydv•z<š7m¬ÒJ„8¡ò»ö9­ñðËš ÒY}ÔwË…j~›Ù0¹oó”¯ ’äšTÏí„<· nÕw.È•;Qü }y#ˆœËjûZ竵á!~dKùƒý$‰¹w“§uÕTOÆ.«·C‰üýqå”8`϶š›Fã7î“ŸÐI8xÊ-y× ƒ±÷øÊ-«½ )ˆôË"ÏÊÞ©èÙºÿi¹Õ™˜ª¯ø*&Ué3Hg…ÆèôYtªêv£eõÒ€y¾c„ýM:+t§ƒ„·§98ÙFo!4VBÆ"‡-ÆoIÁ”ÙU·˜Yæf»Ãg3ýÌrRžaºãÒ¸A>L:W:]3¬Y‹õ›uµ+¬GDÝçl+ÖF`A*J –Ê¿æË>vp\À­vß2Q6xÔÓ[o ÚÉË3>A:0Ö(ÅnSZG4z -«SœV5¨±8J@­ìh¿§5å¹=µúKOÛbè´M¶ÐiU×rÈ"ÓMë»d«SéÚø5úñPãwï߉nkFµõiÅl¯²2«9+í_Tˬğêöª6ûq­[³lö®m“.†ç„À×7âú1çò/'ÐŽçÉÖÿ,íÿú·ELpc• ¦(ÜÀ·º öjªõµ¿)ü?¸qÁ1endstream +xÚ¥U¹ŽÛ0íý*) æòÒÕ. 6EšH‘¤àÊôŠ°,9¢cÿ>3ia;6R,’ïqÎ7’LüdRf\è*)JÉuY&õa%’W@>­äÌ0™æ™1°¾®t+.Lq‹#’µ.¹Ér7«‡'%%xžëd³‹¤Íö;S%O×Y&ØW{H%{±éZç{´õ~:Òz“VŠ¹ºéü¯É…ôçæóêãæÜáB–wbPšëBÝ nrs 4\›ü*@‰!šŠ}I×’õ£[B¸•rÁ+¡Þ-Ê,‘Nªs‹›Æ‡tmDÎêT¬±GH|tmý–]ŠÎh}@ÏvŸª’9:ñ3â;<{Ú‡[ÑzÁ×:𦃠îìy$äŒtlam»ÎÍ^wèuX¬¹™‡Ó üµ>4 óÌ<±ú>3 "v ë!Q'UL{ 1Bº5Þ˜ÀVÌÉQøüFWUÅ«ò^[µä¦Tÿ윚;÷”jÁœ§Á¡×€ÂÊ!íí¬6×¹BÄÆðŸíý––K¢•dÃji%ØÎEÏÛ¨ñ“ÞÏÀ€?ÿK™=½íœ$Ñ;̇Ø%´÷(–WÂãØÈŠÅÖÀP«8UQ·†ßQGC€â#.>!ÔOí–l´~Ñ‚ã„„à!¹±™>¡iŒÒŽ7zúÝHdˆÖbÆhR›(\ôØbK´foäŸ6”)°&Ò«ŒÂí^ Å«ž•yÇ CíÖ¡ *Ý +KÐ,ôð%xx5ˆªŒÁ?w$lˆF_Oqf†p\æwgg¡·±¸[<ØpóF›0Õq\ø[Ž{ =Ž!>q$­o§¥l Ø0öƒwó½ ÇõÜ<0Þ[2Ì×N[ØÌædž bþñä½Ì MŒ|¨~$”e–£K¨óË¢_¤Ä÷ÚqpõÒ9;¾ÏÀ­7|/ò‹Éõ*Yò¬¢Òý ÔUvm^iëìês¶<ÿÆ‘¦Äendstream endobj -6649 0 obj << +6988 0 obj << /Type /Page -/Contents 6650 0 R -/Resources 6648 0 R +/Contents 6989 0 R +/Resources 6987 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6654 0 R +/Parent 6963 0 R >> endobj -6651 0 obj << -/D [6649 0 R /XYZ 85.039 781.388 null] +6990 0 obj << +/D [6988 0 R /XYZ 85.039 781.388 null] >> endobj -2370 0 obj << -/D [6649 0 R /XYZ 85.039 597.02 null] +2470 0 obj << +/D [6988 0 R /XYZ 85.039 761.463 null] >> endobj -6652 0 obj << -/D [6649 0 R /XYZ 85.039 565.205 null] +3222 0 obj << +/D [6988 0 R /XYZ 85.039 653.495 null] >> endobj -2374 0 obj << -/D [6649 0 R /XYZ 85.039 358.13 null] +2474 0 obj << +/D [6988 0 R /XYZ 85.039 653.495 null] >> endobj -6653 0 obj << -/D [6649 0 R /XYZ 85.039 325.708 null] +6991 0 obj << +/D [6988 0 R /XYZ 85.039 615.228 null] >> endobj -6648 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R /F41 2994 0 R /F35 2976 0 R >> +2478 0 obj << +/D [6988 0 R /XYZ 85.039 558.141 null] +>> endobj +6992 0 obj << +/D [6988 0 R /XYZ 85.039 515.856 null] +>> endobj +6987 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6657 0 obj << -/Length 1642 +6995 0 obj << +/Length 367 /Filter /FlateDecode >> stream -xÚ¥XmoÚ:þί@ìÃ¥RÉB -LÓ•hK;v[Ú[˜ª«mº2‰kÆÎâÊýõ׎_B I;M[…“Ø>ÏyÎsl{M—ÿóšƒÀqýa³?ð0h†›†Û\ñ/· Oõè¨.ƒ>—óÆû›à¢é¹ÎÐ6çËbžÀé~s}m_}=ÎÇOgß÷ÛÝ ç¬ÓïÚ“é||{浟Fg¿=ŸLoe‡û™ü}žL¯κƒö³z1óÞógñêáé/ÓkþI¶f£ûËÑÙ÷ùçÆxn04ßPþÙøúÝmF|qŸ®ãÍo»ŽÇ?o±ô|õŒ³Æßf*ù­×”£Nù'ðN0ðä'¸Nàör½°ùO˜ªw ´çkÄdk‰0”-ý&¤›¤h¡ßïPº–­{&”Ñe*ïFSõ°‚‰|è:/ÊÆÕãûÉ£lãÍš²”U0”}@"Ù Ë%LÔËt­Ð,)Æt‡ÈJ>—†(a'êà{Û~÷ø4®û|ýpÿácD7‘?ëúM¦Ww_®ÇÍG± 6°vÈåøv2ýwtÇÉ;Íǧp«žãéõé~Ö”ß<¿ç¾"Q|s—PÒ‰DRã©p ¦:L,‹cš¤¼¯wrâÊHÝ”È^E‚¤‰j"b “É|4ÀT¨["4-ÝcÕ d V£2³ÀH©ü]¨Oq1Œ4JÝÁ ¡ÓæÂ5tdûRÍÁ%Èpz^B†³ <Æ|RšZöÕ ‹,-FË a%XÙKµhÏ!¢ÐF›@Fq–ò4Pþ3ç7ãzäϱk•òD-+;z€1"Âb|%z‹Ò”âp C´DÚc 5JÃql­\PÂT=¬éî ` Ý1í}£L˜®´«ùÇ- -5p ¶°œ‡:É%”lø™†GKìxÅ…”Ú 0Žlω8Vq¥eÑ'¯;ufº©™A%ÑsI- 71"Є–ÃTðìÙÉ„8]Ólµ.¯  ™H´ê@*«ŒÇ]f·†¤^Êжî`ô‹i5Ë9º7yÕªªGŠ·¤I-|O7W²1…éåäaVþôr^©årá¼nïŒÒè1X6¬¬:¨iå$ÈŪ  <…–VŒ`>bìœ6¦]¿‚&E”?_¦W0Š)Ækª”´¬Ú+¡H -€Ñz½S±ê–]KsSþW¨u ™P˜8Õv'VþîžGÿÌjs1NèE°dgâØ,“Æ -¥–ž¼¼D0½­zƒîÉhÃÈÌl'¶fó‘Ö–m2­X³)]¨F„.Ïh ëüFÌŠPQï -î® Ã[q¶À(lUlIà ØÄ:º ®3;ê­âð |<;pFzíïÖ4ÃxÆÃÀaÏNfa£I¤G›P†q†j—†kÎ8fBñªØ…Íß‚ÈÖæÓŒgY(h¸ä ÷GÑý÷eþfD`¯$6¨ -¾h²=KáF´Â,IøCÊÓbÓü³ª©¢Ù"é(ž«mp=â ö‘¢ḙtvNŠš³Ç7¸âÑKô²gˆ3eo•Á2½N<þ%ÍHáò¤LîàõƒšNyj°4Ø:!èØì8•ØjjãΛ:T­)ßOä[•Ó¸JhkLé -Šõ)Ÿô±€q8¦”v|ˆ³¨F…ìíÙǹ}«œ o¨Ñ¥ä½AD”–s½‹¨<9é²ÞkGÀÍF犒2³9­9ü&š-Œçƒ Œ1nV[ªøÅ>E[û™Q.Áös3hÍ-ÍV›¤Å)’¨ù,ËíL©­¡:ñoΠ%`àU¯þâ†j^yp èœ7\ÇÎß" Žªƒµw¯òÆs»¼—3äÿûgî…P®pÜS½~©°å‡$Sž–?r¼ž+N÷üÍ‘ÿPH¯¯ª×^Xä-nÒsÝv‹ÓLÒ!ŸUÑëµä37“‡ èƒX— -ü[Lu}e*¦q†ì…杖ÎÅ@,ÑÌlVaf¯¯fÎ÷€,Ùòý~Pššð|Ö©u¼Ã©“ÊsJÍLjy¯.\›—$V´eÈßW\'® -}×éO]ïñ?iö·nÍ%jÏwþÐ\z‡W„A·ët=E,Óï÷l¼ú¶ñðÿû¾½+endstream +xÚuRÉnƒ0½ó>Ú\ï˱•ºÚ ·ªœ€š@H¥þ}=*„!áñÌó›7 G,~9M™ôÈ:N¥sh{ÌÚÇÈsÆ'„Ò’j¥¢}%˜ÏÑÜÊ”½†a(—Ž*m øPdwO‚!Á¨1»TTŸXxJr­~iö5É¥1øžäÿ” áøPnÆ~‘ ÿÄâÓÐtmO¾Š·ì±XæT”qwCTZq+h©2j)–+*•Y‰å Wyü"»!Ì®•o©g⟑kÄYôø%cQ7=É3xK„Åuy‚JÃ9ùª¦JFK Y²¹ü&Âá<ÍiZp]º 5tmd·ø¡ìáeˆÄà×!E Ó!ÚeÛ†)벞g¶0¢ó²‡Ò×3rAŸPÝN "Æ)A?8ìŒË®¢ÆXî^\"×XSHòé•©jm©‹ »ݺá‚;ª}Ú×Ûý–Þ¬é…TÔëÕ¦ÏçŒ;µ”endstream endobj -6656 0 obj << +6994 0 obj << /Type /Page -/Contents 6657 0 R -/Resources 6655 0 R +/Contents 6995 0 R +/Resources 6993 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6654 0 R +/Parent 6963 0 R >> endobj -6658 0 obj << -/D [6656 0 R /XYZ 85.039 781.388 null] +6996 0 obj << +/D [6994 0 R /XYZ 85.039 781.388 null] >> endobj -6655 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R >> +2482 0 obj << +/D [6994 0 R /XYZ 85.039 761.463 null] +>> endobj +3223 0 obj << +/D [6994 0 R /XYZ 85.039 653.495 null] +>> endobj +2486 0 obj << +/D [6994 0 R /XYZ 85.039 653.495 null] +>> endobj +6997 0 obj << +/D [6994 0 R /XYZ 85.039 615.228 null] +>> endobj +6993 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6661 0 obj << -/Length 2464 +7000 0 obj << +/Length 228 /Filter /FlateDecode >> stream -xÚ¥koÛFò»…Ð~¡€˜æS$ Ü'vµŽ’‹”óMqXI+‹ŠdHÊnþýÍkIÊ"}=‡ËÙ™ÙyÏ,åNøçNâÐvüdÅ®íÇñds¸p&°óöÂŒKA¹ìá¼^]\ýÎ&®c'N2Yí:>¡„þdµýÝzóîúãêöÓôÒ÷}Ë›ÙÓË(Š­ùbuûvêZŸ®§±o­æ‹·Œð~ÉÏûùâæÃÔ‹­{,n{u Ÿ~m±Vïxµ¼~ÿúzúÇê—‹ÛU+s+ È— Àß.~ÿÙlA¹_.ÛOâɬۅíÃHl‡/ïÙÅòâï-+Þ &L5dŸÐí0öÏ ä‡ -;t2ÐÓËÐ ­ç‹7wŸonùí‹ëøWíÓ¼ÀEy\géWÙa_ÔMÊÂÉ—. -–œpº]ÜüëúŒ¾¸^Ýâõ`aŸtžó³Ùk^¨uñ(Ký§:”™~õ ãU–¹:èøµÖÕ£®x½)òF¥y-¬¡Ô›TeãâoöªR›Æ0IE¤´>xØ™eQ3U‰*ß -<+6*««Çé­Òãò”•Î -µÕÛWϘw§“—FŽéëžö»T ‹º0ʉîJ´] ݱÔQÑ!ÏTk®Ó0›otÞT*˾ó뜂Ž1R˜ˆ¢—]š™wÏõì¬9*Rý½nôáTéc®Uš©u¦í¡Ðe¶(mdPÍ3ižö…‘´'³Yªª6ê¥ù&;nÓüÁDåáöÄB ®Õf/Ö(Š¯ÇòÕ *ŠÕ¿j]¶\[±òãamœQ솎4^çÒ<=ÅdOi–‰Ô‡²js¯ÔÕ®¨*ßœZðT°Õ^WðôiP›ä…Ôö1­Ñ§òÔp¤ µ}960 RÝÚа@+ŒŠ§Mâm`¥=ÆöHùÃÄv¸~6¥Õ\v];Ákknè»öÌñH"èC Ňv†ŽõîÃôÒµ–+ì+³Èúâ¸A¦Çä>/ÊÓá<î@’š$[hE–ð<ÏMk†ùÖ$­Q@\pãvF÷"kƒ;P¶B”óó=à.yy0×ÚØ<Ÿ„çbÅ{íð¢¨øé9ŽsÊéÍOh‰«Ÿ·§„—xÐ -=PåÏwŒs¢¨;³ýY (ÐÑáÌsF~|‚¿ÎgùÛ'Û÷¾7À-œÙ!ÐþWn¾ Ü|šÿãöÓrˆ“ó×eº]½¡°¿ ߎ`"ê•7j^h×z…‰µÕ%%IK8„ùÀlÌ‘{&äªÜ¸»zóñ -͉@¡5Óª@B•Yðšé`̹P3ùáH^Ü¢ƒ@ÒçU“æ¾jYæ¼­§l{ †Ýï }š‚f -wÀ¢#>b~ÃÃÒÇi8ƒ"Ñ)Ð0k,º¾ïšÀú¼˜ÿóê.%œãŸÌçŠÈÐ¥­Wh{E$DÁ8^®˜ƒc÷årÝÃ-× ¥ILiÊu åúfAå‹õ̺ƒ2胘_1lÊ1©€ä/KÕáŒmˆ1€„½¢ÐØVª5?ƒžËî ¼Àj·‹\Ìöp¬0i3ç'ù±Lø!³­A‡– U1^GÈù°\7Ñ FÌדUƒ‘VùNm:qãÀš+æ3AtÙ„CÎÁAŒspo3£Mªt¾ÂÁ-Í@LJ:C¬*Æ9P€éoG ã S‘åà¹+2ä\ ^OmJl™¬50/)Ï(hSÓ-[ ÎB~-D§'DAé¹ïšݫ΋ŠjëdUxî;Iû™½V7¯ç– ]d¥­7Ø^!Íwv5«ˆPÔ.B‡6#¥.#žé) ²—¢s-Bð´°íÇ·z!ÈT‡\ÇU>d2=Näp/&õ—T BÏÂT¨àÊdʈªó‹:Tz¹¼U ý|óq”(\Æâè C”H@•îøɉý.DjQFZ ‚Šú¸ÆÂbý[o«¦êü¾"íqг7ñÆ07‘œç0Áy;ðˆâ#E ¿Qþ¦$¾Û…îž -¶„Ĩx?¢8§§çÈåˆNBê4š–@Ž¼Y,_1â»4EÉ¡8Yœ;ùî}‡åG>Ý’aX2KL_{YI‚…³C -)cü‚w|šÐüÊÑß"ð±™ÇäŸ\ŽRæ'É€ÏyzdHAf2±3B¾ù8DE!v®=¥X˜ˆm')ƒ߸nsÄZ,ygÙ¥«kõ[9Ó }±ÆK8¯?2NÜ˶îjº—®wx*;1Œ›äµõ7IžB*ÌD8”žçúŸ‰âû–™^ÚiеÆÆoÙ³(|±áöpFÇ/ðl/9Bîçðò?Ü8’èåQ ‡3: -xNl»R®ÑV.ÞqðÊ;„÷4Ùö®]€1çÆ¡+ìØYÈÐJèJâ•«Âê.ŒÒ áy¦‚á²¾%ྡæí hºncECɺ˃G|w×qÜ+øÏ“#‘ä#7Ti/âóóPY¼Fµ'&µOÛ¡†¦žÊ©–àÉÙ,AûáÞI"!)úªk€T›†H™ÀÅÜ‘lÄE.=SàtkÂÍVÀSÉÕŠpê5éõ ¤«†ï0iÝ´N1ãßÚ æ³ˆÒ@pMÙr)ŠyÞ¨y{“¥­oð[âßø³¸»œÍÐPÂë^ Ÿ^i J {iWo¤ä”LË‹ÁE®ÎQ‹ Î7çmdÜ?½™¶S£ÙNó\ŒŸô!?l/½nÿ:„[p„œµVŒÙE{íDÙc qU—Ub`ÆA ;™Í 7F§*äk½­o@ú(FCGOÚá^õ^ۦ’vý›}R™„Pdb¶]ìå}.G¼öƒOɹXT oü¿¡•u-ßZF®;;qÞÙNï þ ðˆÖ mx¢Á%Õxߧϔò‹Ì’wF|лÃÀRUÝ„uP®•ÊÈ>0­¥M.ì<ù³êNvôÛ\À3Ã科nà;Ð^†zü1«ÿëw£Þ•×Žýd¸¡„ô8×È‚¢ûQø\^óûÒ™Àÿ¤S¸¯endstream +xÚmP»NÅ0 Ýû“!&ŽópV$@ !1ÄPÝŠŠ‚®îÿ §áò¨ª ¶rö1*'GpTTfbV‡÷Á©Y›¿!ĤßíµžJØu@fÈIÈÞß(—u¸¸öNÉOJ¤êëJ­Ó³~0„z4äôñd,¥¬o ê'cQƒy©w] sn2[8Y¤#­÷o¢˜M2žZÿ±t§q™zóø)õÔá¥1çf>\Õßh?kG©»ÁœŒ%ÑÿC·, ±ôû­¹1*tP\ù››JÞnà)@‰›ËŸë :\Æendstream endobj -6660 0 obj << +6999 0 obj << /Type /Page -/Contents 6661 0 R -/Resources 6659 0 R +/Contents 7000 0 R +/Resources 6998 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6654 0 R +/Parent 7002 0 R >> endobj -6662 0 obj << -/D [6660 0 R /XYZ 85.039 781.388 null] ->> endobj -2378 0 obj << -/D [6660 0 R /XYZ 85.039 559.099 null] ->> endobj -6663 0 obj << -/D [6660 0 R /XYZ 85.039 524.557 null] ->> endobj -2382 0 obj << -/D [6660 0 R /XYZ 85.039 438.819 null] ->> endobj -6664 0 obj << -/D [6660 0 R /XYZ 85.039 404.679 null] ->> endobj -2386 0 obj << -/D [6660 0 R /XYZ 85.039 267.675 null] +7001 0 obj << +/D [6999 0 R /XYZ 85.039 781.388 null] >> endobj -6665 0 obj << -/D [6660 0 R /XYZ 85.039 232.929 null] +2490 0 obj << +/D [6999 0 R /XYZ 85.039 542.44 null] >> endobj -6659 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> +6998 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6668 0 obj << -/Length 2190 +7005 0 obj << +/Length 2459 /Filter /FlateDecode >> stream -xÚ¥koã¸ñ»…ûédà¬EêU (rÙì^®½ìvc4®œb+Ž=\I®“ßÎP/KN‹Å"KŠÎûEZ,ø'–¡g;2Z¡°e.·ùÂYîaçóB0ÄšAÖ=˜Ÿ6‹Ÿ<);r¢åæ©ÃãÙÊ“ËÍî7ëú端››o«µ”Òr}{µ‚к½ÛÜ|^ ëÛÕ*”Öæöî3üzOãÃíÝÇ/+7´xáî 7¸ôåÛßZ¨ÍÏ4»¿úõ§«Õï›_7›–ç–à/B†ÿ½øíwg¹á~Y8¶ŒÂå æŽ-`;_Ƕ§$g‹ûÅ?ZT´§–tjJ?ž m/”ç -^OA‘°,OØQiÒ¢&!`Öä<Vk7°Êª¡¿°J”È­pãMNªÿ Š’jpðõõÕ~¼8è‘ní+ár ¶¡OHŸ“*Á£ÊÀÀ£4â”i7Ï ~û•âÀí*ø/A¶êš¶Ë'O;¸¦fsÖÖH`aÝÀv@éÈاUHP8áXiñXÊ*›´,`͉¬ø4Z%j±!0ÒKÓ¤¬íiíx ñ–â|º~Ä-ÆȬh?™?@>Ô𸭬J3 òŽœOFÒö£¥N(”‡Þ@;Õ~I“o=çaàuúÜwFQ­Ý-Šßñ¡IXEF-EÒàî 9/«Z|¬Jü>i±Öä Ò mßäaŠ”7’/ŠÀݽ¥Û‹üÉ`uf""†x =È>¡#½‹é©£i¹°«l©ü^zò]Pd 4-ðzrÈj]—yŽ…:óë¦ýHǪê9vÍEv:˜sÑÄ·ƒ€²åæúëC®c&zm¦Îv°·-‹9BíÑÏ+ãÿ"²råc–ä:ì!ÙŽ>r`kot¬˜££ãXãJaR¤uÔ(9J -¸–YÞÓ0€ ‹ åµRŽµ,ÑK`ì^Ûøˆ/] .Œ¡„¢¸®õ¨s ïÀ"Pyè~nÖ1TeN'^Z¹ÞèpW;ÚÊÓú9>¬ñŒ¡ë*ë©DmíIvÄtÌŠ~Æjë4?dÌ `jâŽRÍ qÁ”¶q•dŒ¢H4–Úžû §Âmy¬ _É´V”4–çÈ” pªQs -z#°a:C8Ê€ Ø)É€ôÚfã,!éþ4ãØž¶ûNЃiã jV¥Î±”!{q&,Áæ9ÖWíOû´ØS´0Ô ÞÀœ/(©ïƒôš˜¥’¤#ôÛœ ¨ê÷dè`fƒSA5|2Ù·hbL\Њ$p=K—‘7Ú¨‡EWÆÕÖzÎë[Ú­w½”¬=‹3€GJÞ;Fé#§p™ÄŒHó¸-)û<.8j&ÃÕˆO×laý0¨Ûth£ûÚ9ÍdX3¼è-†ÓY(f€¸¡Q'F°þÕ=¾âà¢=¹¶ðCr1—‘¤Põ‰.•æqýB»®çÙø[88¨îÀïJ*€Ü÷Í8¡Šìp$ ×zÎßA¥nd_áCÐr'OÈòÀ¢–'DyΛ¥°Ih¡¤C« |>ÓI¨ëy¬ÕðB #¡„ YûŽÏÌQã¡õœvénB¼SW&“¸»£T”­Lú§“qöš«[°Ç&a¨’SÚ+Ԉ‡ÒÖbØêÊÆÙÑžp¬G¶–r] (jHÓ…. íôÔ¥ó6Òzâtæ™°6¥+\?¡WÄ DJá+¤=–7êÙÐùà*¦yÒa—1²é0Ó®va6ÑÜw\ôL3äbEŽ:FFÐ4/à\¬Ù–å>ÝÆ™©Lv‡JöAù¤S¦<“WÌöm˜Å½(xF ®DOpá[9²E„’ƒCczÂñíÐ /40gªµ¥p¯³tà»)k”ÛhìU²ãË)w_G£²æ‚›.æíâThü;í†d+LE3J–xÎå‹Dæ‚’è]%_ Ø)yDqZÉ=Šß§ä*ÉËf¬ða…åî¸mˆ´“Sà4Ý{–# › =oRs«;· TæY«€ˆ"¼|ÛìÁ\° -½k• ;«Œ(N[¥Gñû¬·Ïq“Þn,bž[è)¨:¿µ˜ÍÙcÏÊ\fèkÚÇ0¸hŠ̼) Ð{¦¸D°5Řâ¤)úçLq÷eÓ¯Õ\¾ÜM£¬®* z±X¾ÅeÒ¯;4”Qõ™½TÛ\=gþÿÇj^`GïÍÌ«1лV»@°³Úˆâ´Õz?¥mgN]|– ÍÇa”AÛ>M`µÖ拲k´Aì1àðuÃ;§K­s¹÷`f[(Wr× -”ä -ZNÝnBGTƒã´¯9>Þ3×ú¡”oFµ}Ž‹=Ïú•¬|ÌŒšò9!@»Ñ{Bt0³]\ÉÚÀ?ô½FACWÄ9Ï°MÂÑx¶Âh\Èqw\¶q­í¨ñ£{OIw9Êóú·_>¶è%¸nâª1šØQÌ)Ïÿ9Ð7{-ßìqÎ/:·¾ócŽPàr|ëWº-<ñ„ãYOúq0§ü¥E¡'Ž^pïn£hò@ïí/&ç41S-TÔ&„MÍT!6Í1£«›cFé*_ºCfSŽ‡î¥yø#DZîVÿǃ2Ûu×ÉX÷‰~m„Œø¬µñ×æzzÇv'sü‘†¿ë£Ö£•´C9“o<×µ]axAQeàù5¿,1ü_‚@fxendstream +xÚ­Yëã¶ÿî¿Âe 扽 +Á×;\ÐMnó!Hó¶d[]Kr%ù¼ûßw¤$¯åݶ 8Säp83œÇo¸rÂ?¹L#êl™¤Rè4]n«E¸ÜÃʧ…t&Ò"2Æ3‹k¿ºŽ•M2G.×:&Šqñ»‡Å»*\ªPı^>ìˆè!ÿ-СX­£( ~YÉà´ZË`ßÚ¼„z¿Zë8 vmSñè‹­`~ƒDv #%žp!zœjV¿?|¿4¡0a²\+#2øÅ#`ÛÆ®5l¡‘jñ·‡©œŽv^‰&ƒ2Zʨ³©‡²AÒ0Ø®T쩇à +ª…ù$ ò M?ÁúÇ3Œ:¡Ê_q;Ÿyã¥ì<ê3È°üg(5ÒmQoi‡cÖQIPô+øÿBìhµf&hA˜Cs-hÒÖùËU%”H-ÞLªƒÏ=Yl!áÖ#RùDÇ4ez<;ÓAƒÊô<¾@4n›Ä5{\mm_6(L¦€Ück+°/ZÇå€Ó(¾·ñ`ÃÖû"ÿfµ†©.çUäÔ6HòµÌ½é;ˇ±+¤<:žû³'Ư]Ó2%z¢¯ÉH᪹Ikï—0Bk=ñ°oø—Ì+f|ÍKÞ )Lª¦#Ð&~0/ÆdÁO¨ÓgûÈðC¹, ó 4,æ^$Ù="!¥|Ýßo½ì7Ø}‡÷w>Ž®€. V;X¾ X`Së ;4D˜„ ߇ ,^Õ©Ej´FéÄÂ26"N3gç“íºNTÆÞ>¨´çêV —k`Â[(á¡MσáZ01«9/PŠuÒˆˆXë)ë,i<ë®ÚåÝŒ&2”Ž:º¸rZÏÄ&Z,‹TÇWæ„Yi&÷‰_“»¡owæMɧžy¤¸NhO¼H)õÖôJ!#㔀¬Ú>C'Ûã=\š6ïfT—¡Iœ¸må#~]AÚ,HzÌV(ÇòéÇ#ÎÓë®ù!“$"SòÊ>p $Ïœ+D¼?X–œÅnlG&lrG–a–r8cÎJ” òl•W AG.þÌ«ýÁöÎlÙÔû P¨Ø¹YEý+…„ ¯"Ü„xe‘¢Ë 1À!º¾yBW¬l_`<ã&ŠgÚÍwÄÏ`-ÇM|£ÁßÎØAeJd™—ê;ÒkÉà:IìŒIª¨iÄ»ô¦tÊÕj}ÔÞ÷Mƒì¸q¬ã€Våö6G_éÁ%T”ðøL@$90gÔ÷wçã!ØÞ´œKq~Gù…—¾¯KHòK]ztÁÇQç&³ŽaEYù™?Ú!>ÏÇž(ÊÉFÔQâÁû™:y­8(½VYƒ©$8s²$FÇ_®D8®4ÕÛGRªA +Rô¸™ÍìöÝMÉ*‹ƒ3¡„Â}Ýš&·}µÛsE=a š/œ€¥û­I;OvÛ£Ï"—yÔL\°¸Ä® %cu€¹æ˜»ÁàTX“´ ¼VïÚ7Œ¹œ%iÓ°çÒñDé~)Zy49,o*[ÖN˜?ÅàÎ 2(ëñDŒ“ϜМ¸tùËâ­”ÞÙgŠvįùŒ1ì¶m:Ì´ s­ ÝÈiŽcóBø”¡xççø€J\b€3æKºo ¢{îz’¤â­$¦,‹#èv‡“ÜHù÷¨Åûðñ'ë<Ê‘å0±Gr0£¯u–|ë†ûÁãD3 +tB„Ò QÌ:Õ( Ç]¶Ò¼CÇ=CX¯ìãGàÁù$­_‘4Œ(ÿ7  «±"{Êýö„qð†jCªA3è!£Œ ç¿¿ý.sÀ¥ß/B¡¡>]` €ü Zh¡í¾Ž‹/‹ŸF^¼ò:jÝ6dü“K~(]ÙM¬rsɶthÉù2¡Ì²ö»[®U&t¿,×wQS +õ&ºEM” ˜úã +Še²dŒc·Œ-zLèé=ÀæÑ´öÒ&ÏsRTMë8ú=GåÎéôyÌ öžº>^²n£í}ËŸƒsÕ!/~ÍõÖ©?‡ýœ{buüÛ—„ê›P‡…+Õi°Wåøâ2¯Zþaì Ós C3Í•_”ß Â¦I áÆi¨QÁo˜¬ì¯euU»ëÊÍÑ©á…®¨?› j¯:æC® !'À× C:ßl‰t,¼ÐÔžò@(൳çÒì<—ѯ!Œ'h +0žõ„š˜ à§ÈË~γդ‹AŸ1ºŠ›NT¾Jñ5)1¿±ðJ»_òàçO¯u¡ÅÖuº ¼”’ÀËbH1ñõÖ}~7Ý:€óTl ¿Q,ïtÌô±|³iW®iÿ‘é úÇ•v7fû3E5ÎúÖŒŸ¼èíʉ6×°C‹Ê·¨Ü]Ú[Gqð/߃ƒå8D`m·E¡Ññ¼m‹¿Ì¼!€Ja:ûh^ ûÞJÇòÆÞ`ì4špŒ„‰Þäø~;a›àCÙâzBÐÏ< ÈÚ=^µNx+:Á1µ§B6˜ð –ƒ:vá¿dMª¸L¿:xÿá YÌUôŒ1 DRþ©LÁFu,A-ïîn³Zí¨¢Ç;E{î'–R¦±”ˆ=Ðr;ŸJzg$›wœáÚ+a@Ãnè"¯‚`_âôÿ÷õ§ûýFºê΀y*ºi™Ü_p”šž2.<}Õúw)­Ͻr:g­I#@G´n4 síSÞfÑÖäDô襓i­““"‹¹LÔiÚüà¥ûçâ¡xã$¡âáqÆ8> endobj -6670 0 obj << +7009 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [392.693 682.027 539.579 693.717] +/Rect [436.429 286.231 504.483 297.921] /Subtype /Link -/A << /S /GoTo /D (NetworkBrowsing) >> +/A << /S /GoTo /D (pdbeditthing) >> >> endobj -6671 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [84.043 668.478 100.581 679.878] -/Subtype /Link -/A << /S /GoTo /D (NetworkBrowsing) >> +7006 0 obj << +/D [7004 0 R /XYZ 85.039 781.388 null] >> endobj -6669 0 obj << -/D [6667 0 R /XYZ 85.039 781.388 null] +7007 0 obj << +/D [7004 0 R /XYZ 85.039 761.463 null] >> endobj -2390 0 obj << -/D [6667 0 R /XYZ 85.039 653.035 null] +2494 0 obj << +/D [7004 0 R /XYZ 85.039 761.463 null] >> endobj -6672 0 obj << -/D [6667 0 R /XYZ 85.039 612.871 null] +3224 0 obj << +/D [7004 0 R /XYZ 85.039 632.606 null] >> endobj -2394 0 obj << -/D [6667 0 R /XYZ 85.039 541.288 null] +2498 0 obj << +/D [7004 0 R /XYZ 85.039 561.97 null] >> endobj -6673 0 obj << -/D [6667 0 R /XYZ 85.039 506.543 null] +7008 0 obj << +/D [7004 0 R /XYZ 85.039 516.895 null] >> endobj -2398 0 obj << -/D [6667 0 R /XYZ 85.039 355.383 null] +2502 0 obj << +/D [7004 0 R /XYZ 85.039 270.788 null] >> endobj -6674 0 obj << -/D [6667 0 R /XYZ 85.039 321.243 null] +7010 0 obj << +/D [7004 0 R /XYZ 85.039 230.624 null] >> endobj -2402 0 obj << -/D [6667 0 R /XYZ 85.039 140.602 null] +7011 0 obj << +/D [7004 0 R /XYZ 85.039 198.416 null] >> endobj -6675 0 obj << -/D [6667 0 R /XYZ 85.039 105.857 null] +7012 0 obj << +/D [7004 0 R /XYZ 85.039 157.162 null] >> endobj -6666 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> +7013 0 obj << +/D [7004 0 R /XYZ 85.039 117.121 null] +>> endobj +7003 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F59 3455 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6678 0 obj << -/Length 1472 +7016 0 obj << +/Length 2071 /Filter /FlateDecode >> stream -xÚ¥WKsÛ8 ¾ûWø(ÏT,zvvvÆiâÔmb·¶:9´=(¶Rkj[YIi6ÿ~‚”åXvÚn2‰HÀ Š>‡_Ñ|ÆUÜ#ÁTõ›ï‡•Ëž0®aq[Å–Î]¯JË“Ñž¯Üç -þ Ë€›¶ß+š¦¥a+ÓVYIôâ‘ý™@­PÜ›chJÎ<žŽ‘†À-Ì㪄|å"|®Oð€E~tR¡å9иº’)!÷4B€™ Ê 4“iBÐä[é µp`—±óPgÕ1¿“ò´[–^!žr\ÛÎ'ûêº]²Sg<ÂbHÁi5èžbšÖªÌf }÷÷6ÝÉ{Ž—em¨[â«­žIVŸáþñtþ\]¨ªh¬ÚÒ—ò¯ÍÆ›|‹×°@þGíp£!ñ@Àظcºó˜i‹òD…¾}ÈáÊÉÒ¶âŒG”¬IÅÀ•q€¾ð@F–Œ}çqyS/´Â¯"ŠÎ­8¸/³Ê„(ØUÓNDí1p<Ñ\õ™™\j€E3R +¤E»žÓ÷FÇöZÀ¡#KÈ6{ÕÆÈ×G/î1´Œn}´As•ªU¶^¿jU˜æFê²ñz¤Ú1<ÅPCðæ«PÞß×—pàÛ½A—\åZDB{†Ç”40b4HÈvU,Ò5 '/%éí:#Ê}lö“ç‰/Š‘ñ鞶pgš*Ú$BP*÷ÂÅýÍŸŽˆͦÐƸâÜù‹+8´€òì|žŒ?}¾øLfÙ÷¼ª³2[vž_C¡JfÃd --” à¿'Çï°ƒÿ¾óáì|:ÜÂÐoK¸œM?O -س@þ{Äèxœ^ôRÜ-4{èAÓê»Y¶)jnoÓÅ*;ƒ>f¹/ëy jÐÞ•±b¸\BÞ¨Œ—¯ò;#õK•-¾©ÿG1úbÄ^'çë‘A÷˜§D,™"&˜0wIzÜJkÙb®s‚èÊ ”qÇ[ G“KpœÞ%3[s®SÍ¿éæ~mó&"€MG>m¾ -*GA´'u¾ßue¯ë(nLeKfúÑÁ·šj]‹`¡³Áú/Õ"xy´¥8Öe§¤¾2vÖÔÐÂÓ¤Z‘”îqc U›Œ>f¹¸£]MñÚU¡ÕI×&­&5¦â§Ùâóœeì èΘ:Ô&ácYÏkÔøDüùöA(»bkCe*wìwWÉU²HWu„¿9'®=¢× -ì?,dú£/cÓ\ @r§®V…ñ¢&¯öÄ5ìÏJ0ßïÚ‘wXÚî`ÏiÛ0nWpá ›=o×<ú¯qlªQ©ì3±ySèí:15=« 7dM[ä9?°ì¶ .l·oNÝlC`Úw ‚­œìHÿ “Œ»Rø#Lþ×Ë»i¢!]D*îîj})™Öô -ZhûB?0ø?zÏúòendstream +xÚÕY[sÛ¶~ׯPÏ=S2AŠäy“ã$u§I|luÒ™¦”KlIQ¡¨ù÷Ý @Ñ6žq¬i;~°–‹Ýoo°˜†ð'¦Y„2Ÿ¦™d–MWÍ$œ®aåÍDØá4ÂY‚Kç‹É‹×Él* óéâ–¶,ÊŸ½—ßͯ¯®Ï|)¥'ÃàÌOÓÌûñêLxo®ç—ïÞðÒëë³(óÞ¿åÙÍü-l8?ó…7÷£à'¦.Þ÷«çs_ažý²ø~òj1Ƀx&Q¨ß'?ÿNKûûIÈ<›`"ϧÍ$NdÄÒÎëÉÍä=^‹§|jäê¾ÛáÕ²,Û#d %ðèõ#’ýÄÁý+dAœ%|ì>Ë$ˆ“¿äøNÎü(Ž½¡ˆkP£B5naP48R¸*=H^×ýð©îsgèD¶ŠEì-6êÈöÕj[4–ÔÛáiéux94¼aSt¼°„ŸÌSV EÞ +Çm³ëe4ªþÌ»µ:èÊø¨4©@eçt;£¶(°žo ðyàl”¦+ÖL, S,qÞÙ+ƒ)H-n>ð¼3­VïÜ„ ;˜ØÕK¯»Ê*¾™{Äͤ÷À‚~”Q*%a0‹³§ƒ#9 8dy…Œ·Êü‡g«¶9â¡Dç¹7Ç5¸êØá¬78Æt²8nG‹§lXµåµ¢,­q`¿siø@eõ ÃŽ™ÓÎÃíh÷tUSÕ…fv¦Ȇ?!#Á÷èBÁE>.8Ð+2 +½@ª¶å+ a.ô^õRx{‚B!ö¾Eœá›#;‚wayƒÄô-Mç`u±²Â¼´D~ÛrØ0¥½µ¿f£4óÁ=¦ª+ƒ²¯nDÃ$ìö=+‘;òÉÁQüå®÷’îà û‘Ð0fÃÚ‰Ÿgó>Tf×{%ý:Ð<î$I xöt'™=»“ܬ´H¹°‘RØ°sÒùº5aÓZ€Vß-pâwY|®SIm¦ °ÐXF¼°j)´”Êom€”êÜž>TZ“<ôˆ;B¼¢l»ªw+ò,1Œâ9”®qHÓç#zï &¡‹+­[Ív#§Û–59Ãút!.}vë³·ò™Þõg0bÇä( ÿxñÓNfÞN£ªØŸI =¢}·#¸·Úðm"ð£†ö%«‰×PÙ{L>uÕm†Üvš¶ÙtŴ¢’ÛÄŸ Ùæô™Ñ\X9k¢Å.$´²ð:qjÊN”š 8ÕmQ2ŒmÞ¾Æjñ¥MËÖ_PǵKÞ·µƒ`V.9ä- +€¿‘¦ö ›­piSë°•;eºÇÕ¿aþjÌO§ÆRݪÚØ’ˆ•_ŠbBk#ô¡¢bfIH-­Nº=ª’Ë‚“±šF7²Ú±%éÕåª$ÞÕŠðüí¥A–æuU Üg ZÏ㯠ý÷=\ǤºjM`1äòn‡n±æ• &r¤}`…rÑñ&\ƒÆ‰ –š}éXàoÁ«7\´ƒ,TËPÂå Å'Í$`a# ž¨¶6þ<õûNéoÙlkÝîÙØ8ëÝbø-ûÒÍåE÷”òÿYSœÞšx/²&çJš«Z…ºr‰ys åÒ3ºOØö´VuAYÒn¿}Ð)*W)Ý·?®¢ýqì„ k|$¾l{Ã鶮¡Û8çDÏ®ëË-•‰v`QšF¤S¬ŽÒŒà óZ*ʾ˽96´ã#yi8ŸÒ®+c“Ëiäµïú^fXtãïxb~Å ÊJ»Ï¬ S~¶R9GÉü˜Û€Xd´üûãåÅ‹7ŽÈÞB÷&×\ŸÐ[ä³[ð-X$I¼_]|ß÷ö+ïV¹ýõãc·ãA´*!„8¬\!ÕØ~îÉùš:qºˆŸ]e¯±éÛ×øèÝáxµ \ŸÀ`UWöî8ôŸî´Ò\Òi^G•¾=çqW­·Œ*žV.ûž^ô\Yµ}ýÚ&O®[þªW0ºS/ÀQ®›ý‡>p7¤A-‡ÕÒj¯@ª-Ç9¬²CM*à ÌRb{E•´åŠãÖØ 5ÀÀÊ5ÀØ^6TLSEÏk-¹ÓÄ7BiAÓ™Ž¿júQÈ™è-9d<Z—Ø’Å9Æm|[ï5¹ÿÔ³Ô»:“˜¸eèé¢Q\)ùå¦Ø®U7òzäq±d!¾ ÈņúÂ8²z_™ŠD‰ÝƒÍ°6°; þApèJÝò¬¶-&†ôt›‚˜Ñ£"xMUx,ísÌ‹×r(X$³@ÈÔŠ×5ËÖ[Þxçq}ÍÌîkw„—Ö‰XÙ;pG ~ü%¿¥ôˆEg£ˆÏr•rO€Œ», f™ÂY«[‡*Ôù3øNÒ_$6>¨À8qï#ôl8è<Öê^?2p¿Zå +s’hEYoGêËõþÁóŽá ý©tª|^}G)@T=ú8HÓ;˜AŽ*ºyá ~z×ÐH¤>‘ öÁ.Ž`·Ï (È¢ã@ÄòˈF¿G_/•vÅÖ¢ózGøs]HµÂG8²Œðþ;v{ 5ã­Ú ü}ëc1*ˆHï³Å$ñ5ÍZQ6®ú£ˆ·~J£ù÷I_»WwíÝñÍW7U×¹×CtäÓÍŽáM+£Ý‚Mg_¾Mþ»Í°ê ßÕeýá‹_Þ "nöHf²OR_÷/7™"럷¾x™ç +¹r€ó' ­endstream endobj -6677 0 obj << +7015 0 obj << /Type /Page -/Contents 6678 0 R -/Resources 6676 0 R +/Contents 7016 0 R +/Resources 7014 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6654 0 R +/Parent 7002 0 R >> endobj -6679 0 obj << -/D [6677 0 R /XYZ 85.039 781.388 null] +7017 0 obj << +/D [7015 0 R /XYZ 85.039 781.388 null] >> endobj -6676 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F35 2976 0 R >> -/ProcSet [ /PDF /Text ] +7018 0 obj << +/D [7015 0 R /XYZ 85.039 761.463 null] >> endobj -6682 0 obj << -/Length 2548 -/Filter /FlateDecode ->> -stream -xÚ…kã¶ñûý -‹\œu¢H½PE$iRô®h6H¦¸’ÖN– ‰>ßþû΋’lËp¦f†Ãἇ«6üS›< #]l²\…:Ï7åñ]´ÙæÇwJ(L¢ÃÄX¯ w»Kã02Ù*œ±ËTj£æÛ§w~ˆ£M…iª7O/^4Â)ßp$ƒžf“ â•wÞö– #§Åétb¬ȮŻ©žæm©t’‡K±š‘5Vùt3Ö×ÆG% XobÈÅʬFòåNèSè½84Bù-ñëœÎûÅ‘ðÙîâð+§ô©+FY®# ÔJYh¥&X ÓƒoƒcÏÛ"NϽ'Ø®¼¶¶pHùá‡$_ªU“¥ Ur¿m‚ÎÿUõ À­GÞu¥X“„ -úÞDÅ2 ~Áx6žÝ¡,ZJÝÈRTõ蚎å@Æ\îÑÿ¹Ur’ï%ûb¤HÝh+þ< êÚWÿE®D*ÝíÛžÎ;a/Ò΃ݰ’ªG¹ˆmè㌘â†Ù!€´µŽƒ÷>hj ¸?4-o65 š‡}—Qy§SÛKßõWžkt`T S,÷M#SqG–‚“á­§v-ð×GW£ß¼ÂLó°/ÓÐùê”cí»ël†Ò)=U5Ôý™…ã.ªf<Õ,žDÀÑÃþ0Œèk:~.d_·ÔoJfT˜Ô%|€FœsŠèñß’cåAæ’© 8EÒN€AŠxòRÅ]Þ§†)™œHRªòÕn%Á{Ç2Àº¥-P¸Vš§Á•<•€ËCì.(¥àÁêÒP}TSŒ0ØJãµÇèâ-½`ø§œJˆ³¨`„­*f`Æ?ñ§^zd±¨Fª©¤Ü¤¡)¦Tr€ÊŠ¤Äø¢€÷‹€Ÿý=J"$æ¥ZÉ6© M” _J}’Xð*d…±ÍØß2'Á«'î€&š]­ãÙИsç{yálùÇÙçVªíÔ““¬‘T¼Ÿ|Iî÷ö¾È½ýNîºtbULîrÕëúi%>©ÙBj¡p±Þ£¼EÂòâbê#`=Ú£ïðà«D!Ù4 @[¡‡zË # -·“PœŒ€âÒ¸“ü8uøG²@aÄûvØ šÎn|¿3?[šQ:)×°Óèåy–î‰ ãß$|ˆ+Ñ0ad:øu<£VTðÊ»í’É— ¼çÊ`©û'éÝ®»£/‡†µÆ¤Ü*ø¥a,!õY9gt½/5÷׶¾«¾¿(cD³Ó)³™ô8õWÙáoŽÍW'åô™çïk=ù“ØY{;cnyò௥g«ëd¦ð1žÑ€’v^ßÌ©&8öþ@ï{wöÜ3Þáý([ºzŠ@DÐXÔ”Ò'6æÁ©>÷Ü¢'_ŒÚ©¬`¾ÛQ×èñdËš2PZ›Æ$l½Vö”¹”¿+ã$˜ÆË;‰ÂDù,H¾htü‰ âôýþI“D§+©TEy¨õÔí-üØÝÏ…¾rç;vߺåan®Ó›.NÕ”PH¿qqBÂÅú+îy, bÉi‰¬?·ÜÄ!;w àùÌ_ý u¢àUö"IÿK@ªvÔCºæ*näŒ " Øw¦Ö‹‰øÞsf-¼.Ƹ¥“›kMÑ;Íjti¿hR]?̳ŸìYÏœïCËdNl©ÀÛ¡¢Œ.ƒT¼¡'Üxø ç‚x;o¦ - -¶‰Uf™þ£S¨w ò•‰ó†'^êLSeÉÓRu?ö9Œ-æZŒ›V×ÓüÁá7œd JUêûLO¼¦—´/Û$•·.Çi£àGETõ¾=/-c8ß´4_²ò×4?Õ¬"šb3Tqrï‹ôŽX(y;óGßImÀ9ÆÀüêÏøl„Éœê’Ð(‡¤ý´¥â•ÈqzŒ HŒgñTü˜_ª„¶\kN’b…¸dA^fÂéª3AôÅÏnŸ¶îâq*i% #ìë]SZÇ%ù:lxšÿÔÊ > ]Eo«qA°¶‘7f™yù&¹¼'ðkR[Ót v-Ø®´s¾’ÏÀ¤`{œŒç~SJõy¡G§ùßða¦´þ'Å‚×k¿x/”ýïýdŽEIDâ÷b®ùIÖ?QÇÞÍ¢eΠÁêÛ"øY]½ï]ã5Œ°bñŽ-«þœVbi§çAsú­Àµóš)¬‰Æ7ÜÈå4ôŽUÈÚléÉ8†ÂAQÇmF4Š¦ -ˆs6= Îx±®ÞÅï]o¤?˜è<[°Ì3qÀ<Ÿ/âËϪy¶ð|¤ÝÄÇ>\4·à.zZüÜL\z9Kð}[ÍF%È챘Á¢4øX³OÜáG–+áoôzRñSiÎÑ°ö׉OòXÿCÿùuZÒ®¶Ÿçþn‘¹¹UÕ=Ü?yN8ÔžetÆW){ø²1Q®<"F:LcÏ /¥³üöÀDç!LŸOü?tÎî$endstream -endobj -6681 0 obj << -/Type /Page -/Contents 6682 0 R -/Resources 6680 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6654 0 R -/Annots [ 6685 0 R 6687 0 R ] +7019 0 obj << +/D [7015 0 R /XYZ 85.039 734.834 null] >> endobj -6685 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [246.134 503.717 355.794 515.406] -/Subtype/Link/A<> +7020 0 obj << +/D [7015 0 R /XYZ 85.039 680.031 null] >> endobj -6687 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [260.501 214.656 299.16 226.345] -/Subtype/Link/A<> +7021 0 obj << +/D [7015 0 R /XYZ 85.039 639.989 null] >> endobj -6683 0 obj << -/D [6681 0 R /XYZ 85.039 781.388 null] +7022 0 obj << +/D [7015 0 R /XYZ 85.039 599.342 null] >> endobj -2406 0 obj << -/D [6681 0 R /XYZ 85.039 761.463 null] +7023 0 obj << +/D [7015 0 R /XYZ 85.039 572.243 null] >> endobj -3128 0 obj << -/D [6681 0 R /XYZ 85.039 652.347 null] +7024 0 obj << +/D [7015 0 R /XYZ 85.039 545.145 null] +>> endobj +7025 0 obj << +/D [7015 0 R /XYZ 85.039 504.497 null] +>> endobj +7026 0 obj << +/D [7015 0 R /XYZ 85.039 477.399 null] +>> endobj +7027 0 obj << +/D [7015 0 R /XYZ 85.039 436.145 null] +>> endobj +7028 0 obj << +/D [7015 0 R /XYZ 85.039 409.653 null] >> endobj -2410 0 obj << -/D [6681 0 R /XYZ 85.039 652.347 null] +2506 0 obj << +/D [7015 0 R /XYZ 85.039 322.479 null] >> endobj -6684 0 obj << -/D [6681 0 R /XYZ 85.039 615.228 null] +7029 0 obj << +/D [7015 0 R /XYZ 85.039 279.525 null] >> endobj -2414 0 obj << -/D [6681 0 R /XYZ 85.039 447.626 null] +2510 0 obj << +/D [7015 0 R /XYZ 85.039 223.675 null] >> endobj -6686 0 obj << -/D [6681 0 R /XYZ 85.039 407.462 null] +7030 0 obj << +/D [7015 0 R /XYZ 85.039 191.86 null] >> endobj -6680 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F62 4047 0 R >> +7014 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6690 0 obj << -/Length 2774 +7033 0 obj << +/Length 882 /Filter /FlateDecode >> stream -xÚ¥ZÝoÛF÷_!ô¥Ô!Zq¹ü p©ë\l ×\¬ whû@K´Åš"U’²bàþø›]r)QtCp¹;Ü™ß̬"g.ü‘³8®JfQ,…ŠãÙzwåΞ`åWRS,4É¢ùauµü„3éŠÄMf«Ç~Ÿ@øš­6¿:ן>|^Ý|™/”RŽ‰ù"Šbçë?o¯þñf.%Àªtîáåfu?ÿ}uwu³êw[“¹þyõëïîlÞ]¹B%ñìcWHXÞ][øJ¿W÷Wÿê¶â5Æ_ÒP,d"/˜VD(…ªN¬úBù¡­ˆÀë“"àì -Nø‰sŸîRÐH9i¹áÁz›Î•tê&k›K:лMJÕÓT21ôDè²y>4̾zäg“îæ^ä°x¡£„ûFQà4h#\Œ#û:-yð›¸0–Ž>Ë1/ -xƒiÉmZ<óèóe¾®æ Øh/ÎÇN…¿à?2ª™}»ÍÌŽuFÊ œÛ©Ú¬.SdR¼Îcå!µô0¯e|.içc£Ù<¢nAe –HíÈkb›±›>ç%Š†ß(ŸU³kÜh›Öé˜ó) ÷§V‹ÄÁ, c‘„á¨Õ4É¢é|éÔj†E>”ù7msK¦1Þs*†ôá{OÊahθßò#5dµÍáôžï:æIêÌx¼Fk€ÊX™¨*ž?4ÙFÖLÀšltð”\ç•WPå8V <`\j~«öäAY¶9zÞмŸ–EΜƗ -ÄÔm²Ç}°h‡R]}\ÄïÈ9*2”ì"~BÇIJÈcïô•‰¡qú‡—aúÏ4EÅOÎç<. 5ïñ1‹Ü¬ëÓQHR Ük­úã  -Ûl2AºT\)Q"ëûsThxA‡«]PhÕ®YÕŒµjûù”$*>’Ì5’݆|Tø -²YÛ¥± Hœ/‡r,£PøÊÓQÕfM»Ok€aŸ¿ðø¿üxªñè8úŽ¢G¸A:k¿‰\™° h&•–0£‚½Éo[í-‘+b/9+²Lš³r°M+ç†zè²g£Ó¦¸P€òº ¿X[4‹v?I„t=S´ûºh¿®Ê—¬nr’€ä‘|²Úñ[UèÚ·„@%œÒl>%¤Es±†÷¡ûð\F•ÈGÖéQCA9Eɇ&_rJ ÏŸ$2˜aåSqÀä&dzaY¡…0R+~¦¥.Èðe®p¾*O‹yíûÌås±jÃtÍUQÝðTðÀË«¢tASÖÀiß¡9˜Æ`á%!Œ5Qk-/Î#7|v…kø‰Ü0«ñ‡çÅùtQ=®JÃϼ¥ÞbÐ#Î  Ù™°e°m_Rl4S÷;†áË_¨ÆØÐÞÚ\Sœ58gH­)À¹]h„É…þ¨t=Mª;6 üÙÀ˜QBÃãc·moú*åé%/ò¶ó–Ð6ßæ46¼bPBƒî‚D¦ÁÅ…úIS|±ÂÄP/,òó89Ý“¡=sw*€’ð¼!ÿ“àÔ$ÓL•ŒEŦ­FFR·Ì ŽAÔ-O·U‘ñp“w1¼n«Z+±ikÔ-{/d¦­€LÐë)%"• "b“S3.i¿Îºª”›Úè<»aÏÀÅ‚¢¤Ø׉yùTô¯¦äHËÍ%TV‘/âdúÒ¢¹ˆÊ -ZÔ@)ƒÊFå; -§}Zf~îâCþ‘ÿ†L=ÍEV`æPq¦¸ï 4ß 1Ñ´®ï[\ˆ¸ž©êg&;Ç$Ýý)™ÉîRìýðºÕÀåsXjxògÖ‚†ÂÐw>uL߈wãÈá¨BéçñΧmkª,èÒ)÷áôÑôzñ…µD-íü¤ó¼ö¹ÃþýÃ@o ’xÚ0 Æ—v•âJỪÛEÏÎÊ|7qO244g‡u‘ôg¼Çÿà•0\¼l©”¡ú_»T‰—)„“­"Èv[Q£¦?ù;?¶i³½¤7èÇâ8œÖ[O3¡7Mô¦Þ&öz;á8®7‹ãj›Õ—çÆIqü2‡Æš&r.e|qäh¥»FWß7¨RRåžjmÖ*;xÚöµñ!ëÐ-¬/û~Æ\ýà$·2’oá IxÇŸ÷ÑŒódÚ?ÔðPËíÛý ]l‰‘XàÆ|í}¯ï$úãAf –ºp¾ 4 ×9eÝuZ0Õž¶Ô· ×HüÖåÑ•BÂÝÔCnrÒBŠXßsèã5æÚƒrnò¾æI¬&öd~êãÆú¢Æ*è+sÝ@÷Z$©Î=|)t›®l2WYlX²4o]¶ºùz½¸û<ý‹}‚„g'“ÁbÑ\CôV°L1ì‚å”ãh°Øÿ2ÈðÕÇh®à‹íïxªÓö=z]þxv]¢´žž´8ýûŒ^4þëÌÂì5­ -xB­`«âîö^ Œ?"Á›óË}¢ b$rÚþ=Í„ý5Ñ›öŸ`ØÛÿ„ã¸ý-Ž×‡ºûÝ‚Ó3Aþ–SšQ×ÆðO#æc2?,›Æ_[¨Y›d‰lúçž.êaµ1Oo>áJçðf#Þ~“•Ø?¢ËItn¬{Õs1¿Ètˆe!$Ý'ЗSŸ˜{ö^]0põ4 FtÔrƒ"®Þž­‰Œ´f߶ö͹õsÒ_þ‚ˈn{'ݸ§™pcMô¦O0ìÝø„ã¸[/¸1Æòðg %Ü3sPF@§ju{rÀ\¢‹ÚzÞAà¡Doþfš–‘k~˜×–ÿºú/~ú€D×Ë럗Ÿnþ½ÄvøÖüJý7ÝjE„evýS¥ËÏS|ç÷XÕ;.9`ŽËºoð¼Ó¢ž]è7)Ø@ß"bžÏ‹ôA_ÒJ{VA+7 -ÄI\ûÁ-´!^ôÔd-5@Ú᎔ÀÛvÿ~¹<"mwiýœ·b]‰?öËÇ"/ß–Í>[çi±Ôò (ØàoßjÉTlÛ]qæp‰g -g(8¹Pcj’EO3ânÃ}Frè:9 ãYöÿëôW{ ‘ºÙÏž4² ´*JNå d€X ü?zÕ’endstream +xÚÝXKs›0¾ó+8ÂUBŸx¾¯>Üߧº{2¿gϹ°8Ì4Ããò¬Ž2YêN +¼Êæx´¨ ÷¸/ÞqCâ†\þÓ~üÿ[^€êKŇÁ<ÖM†ÿ›·áć'› H ÚfƒrhèÁe%¶Ð+e¤.ª%ª/-S7OÊAYi!EúL¦0l‹ïh#A롵Ÿ\°Ö `Zò2«eºiCÕÛ ­™îlKÉCô>Q5ƒ…Z‡–öh±IcUèie3(2–ÈÅ\Ù È%ѤrìǤ« ‹s¿‡Hƒx&ÖÙh29¼†QuÅI‚& 2Tƒ²gÝ$Ͷ˜Êy©í"†Ñ$úÎÁ]åÝþMÌä=4$Slkª¢ƒ¬DÝ Ký{Û¬d§Ês´Æ*©êA‘ê~¡Ò4ƒ(u z ¡F úkDÇõ ƒ<†‰A½Ž<¨¢8!.Ô‡¾O­‹ì„¡uisj%6b'›LÏŸ{¤q0Ï{Ý-õ©’ÐVG*CC¦ß(Gƒ_ÉYHÚ@6ÉøœÉ°-s?Wç´˜edi»Ö<ªö³ÁbÞä¢Ùìõ—G£ø‹:MTñ"M~¬“Ê6¥‘vê—Õ®ù‡Åžd¦ò­ªéÔg+Û­m“>K™u†7áÀ²°z…8¼¯ÒŽ «Òxž@ÅiÊo¯ëâи-õäðHÍ\l»ñ¼—G¯\@ ìq"IÓg.ó‡4ˆ4H¢¢½|›Ð~,¹t°™5,†ï mŸÑµ{O.þK˜<>†ý÷õø/ßí8FC¸v{½Ï£/»gÝ*ø=fÐendstream endobj -6689 0 obj << +7032 0 obj << /Type /Page -/Contents 6690 0 R -/Resources 6688 0 R +/Contents 7033 0 R +/Resources 7031 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6698 0 R -/Annots [ 6694 0 R 6696 0 R 6697 0 R ] ->> endobj -6694 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [283.315 403.886 316.216 415.576] -/Subtype/Link/A<> ->> endobj -6696 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [304.377 87.121 539.579 100.023] -/Subtype/Link/A<> ->> endobj -6697 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 75.39 194.853 85.868] -/Subtype/Link/A<> ->> endobj -6691 0 obj << -/D [6689 0 R /XYZ 85.039 781.388 null] ->> endobj -2418 0 obj << -/D [6689 0 R /XYZ 85.039 761.463 null] ->> endobj -6692 0 obj << -/D [6689 0 R /XYZ 85.039 739.701 null] ->> endobj -2422 0 obj << -/D [6689 0 R /XYZ 85.039 528.463 null] +/Parent 7002 0 R >> endobj -6693 0 obj << -/D [6689 0 R /XYZ 85.039 488.299 null] +7034 0 obj << +/D [7032 0 R /XYZ 85.039 781.388 null] >> endobj -2426 0 obj << -/D [6689 0 R /XYZ 85.039 374.894 null] +2514 0 obj << +/D [7032 0 R /XYZ 85.039 326.642 null] >> endobj -6695 0 obj << -/D [6689 0 R /XYZ 85.039 331.941 null] +7035 0 obj << +/D [7032 0 R /XYZ 85.039 294.221 null] >> endobj -6688 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F41 2994 0 R /F35 2976 0 R >> +7031 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6701 0 obj << -/Length 847 +7038 0 obj << +/Length 790 /Filter /FlateDecode >> stream -xÚ¥UßoÓ0~Ï_‘·¹õìØNœG6 ¬< $²Öm£%Í–¤ ý÷ÜùÜ4ݺ½ J­ï÷wß] øÈØ.TgVrem<¯#¯Àò1’Ác\¦#Ÿw³èôƒIc)x.òx¶Üç1\Ï7ììÓÛ«Ùù÷ÉT)Å’ŒO¦YfÙ/g_ߟO$;°Jv ÂùìzòkvφÂCJ(’cÕ‡èæ—ˆ€ð2\å6þ gÁ%˜ëÊr£U«è:ú6¤"›Ž)êX“;©Ìyž˜×‰H%שˆHÀª¹Òé˜#¸Ú½§Ð½Ñ9;kêºm6ÀJš1׶H@3Q’µÝK„TG À+¸êu¼*ç™x%Ïã• OðJ&´ìì - (ºa§l^lNzêà~s$,›íûY¼ÔI(ò*ؽ+Íó-K3ËEê±þÆå)êI‚Pà„Û¦YÙÑÖÍ=»õ}U”`Ü”ø^‘KÈ!¨Ù‚ª* -ª1Z²nðÖvDÍË;þRW w¨;áØ4Nè°eþ -\A 8'† %)ë×ç…[X¿êÉgÑtt˜c?뢛/èz…Ö ›£›¼í¡7éKRàqÛ9 HšõM„=„Ð?øåÚˆ¢/èDnð»v;àÌB–Ðó=2¾rOJ$^¨ÜÓp‹‰´G<7Û–$LåÛúçUé<ž¾óÝv±<ˆ…lNöc[û¹aÔy›QÍÅ‘oŽ¤öëRàÝT QY,]’”+܇¦u”Êϱ ykG+ãÉìpòñ*haX·ö[W-H¤Et(¤¬Û"©÷žç'Ú暈ˆÄ°rx9HQÑtæEEr9Œ—Dð¬wS«|Ö:QôeƒÍíi*Øg$ô.I Z9 -ch]ìˆÌÞˆ€çù6´îQ—­Ã®LÊî ¿ïw8ƒj3毟§µ§œÓJÅ.P^¢³2épëËQ”7tj–mS›òtÎ} ,ˆ¶«÷L(`‹ F|V>08-qO¶›c7a˜ á‰T‚'ùñ§>¤ù¯?Âá™ÕŠ[•eMO°ÜaAØÊŠ§x²ÜXõð? âêendstream +xÚÕ˜Moœ0†ïü +ŽpÀµùX ·M›¤š&Tª”æàaQø +xåßÇãaÉvEšJ=t­Øxç™wü2ÀL*ÿ˜„z±FŒxQd¦µAÍBŽlœAMŸÐEC‰ñá(X˜Œ’˜Æfr§¦$ÙµõéËò"9¼´Ïó,Û ÃÈúqa3ëørùùëÙ1]ÚndŸâÙÕòTN8°f-—üÄ«Éù4z°t¨F^Ë´RoPq DêÔæªyÿü¾f¯XÒ9hªÕ–k!ÇWyeÊEÙ6ßLÈBzV¸ožƒ˜€ZÕ²Xµ¶ŒÙÊ­ŠµÏyUÏH©Ñ к@Yi[á>Wþ#EÛläwÄ ö 9­Ê±öP¿Š75oðX +»ÒJ¿]˜³ù Å£‹rq0\ͱÐYÀGWਠ”ž2¥J+#Å*  )›Bk…ÖÃøxWLðhò¢Õ«I)7†Æá¹]@S­ ¸Z¶z‰\6ÿU’Á§¹ø¿z!a‘é¼®õ6‹OÙnœÛ‰ÝøŠÎÆendstream endobj -6700 0 obj << +7037 0 obj << /Type /Page -/Contents 6701 0 R -/Resources 6699 0 R +/Contents 7038 0 R +/Resources 7036 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6698 0 R ->> endobj -6702 0 obj << -/D [6700 0 R /XYZ 85.039 781.388 null] ->> endobj -2430 0 obj << -/D [6700 0 R /XYZ 85.039 761.463 null] ->> endobj -6703 0 obj << -/D [6700 0 R /XYZ 85.039 739.701 null] ->> endobj -2434 0 obj << -/D [6700 0 R /XYZ 85.039 739.701 null] +/Parent 7002 0 R >> endobj -6704 0 obj << -/D [6700 0 R /XYZ 85.039 705.159 null] +7039 0 obj << +/D [7037 0 R /XYZ 85.039 781.388 null] >> endobj -6699 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +7036 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6707 0 obj << -/Length 777 +7042 0 obj << +/Length 815 /Filter /FlateDecode >> stream -xÚ}TM›0½çWp4RñúÌu¥nµ=ôÒH=´=°ÄYP¤|4ÚßgI7D‘ö¼™y3ó1øñÈhÊde†SiLT7,zË— ŸJKª•‚÷Æ$X“TP¦²›˜9G’ñœJÅó¸Ý<<  FÓTFÛ} ’FÑÑv÷“CãDkF¾ǘ“—"Ndš‘Ç¢_ö8B¹%zLËÕd=}ºÒ~­¡mê~û˜ÕákQªó0|1ÿ)–ŒØbœz‹dÔl -ÝØÍB¶­ýŸBÛ¸&Þú.Åw̪B($Ó™£ø#6 -»*'­Å†KÁÈÞ:–;·j%öí0zÚÑãO®ËÙáÜš9ιBw(úùgZ8jÔÛ«·»íå9qӅ݆Tn¹ÁäÞÿuRìh¤RìŠðMÝÔì|Œ¦²EãHp Åuh;ûÐg ,‹ñ†|†n?z0°-°b )•Ó>flp|R’7Ÿß|¥€š¼ä¹Ó~ûê­èŠÆEwº -ÔûÓ€}È<Ô{ ¡  =¸4e¹qäŸ[/-HÑu9¹µë?Áu¦H½G³^PlUà)dðÂÄÛ? SéVÉ¥«Éƒ?ã&ã·º¨›)´ Ä=Œ]_ÛÙï*q9 —‘ô³Û¹ÆVsø±ò±~wsi3hãƾ|ÿ¼PÂçÀ¥„>¿ý"Ä}O½-ÃäŠñ²kß É¨¸ZÇÕµ¼ ?.¥d’¦"CêÒðÿji¨6r=ã?LÉÉÇendstream +xÚÕXKSÛ0¾ûWøh,$?b»·@ SJ +É 3”ƒ+ÁÔ±ƒíø÷Ý•ä‚á=M¶,iµß¾¾˜IáÇÌ( Ô‹Í0bÄ‹"s¾2¨¹„™¡ÁÔ +jú„öœ:žGgAÏd”Ä46' ±d’ÞZ'_ûãÉé•íxžgy”ØNFÖtl3kxÕŒ¾åÔÙ•íFÖå…]÷/`Á±í0«ï¸äF~\ngûŽG(¡öÝäÜ8ìèäøÄïy¨Ô£q{GÍô>7(ñâÈ|‚wJX›+Ã<øžçƵñc+EÎù¦ÜÕÝiW8)Šü®5¬G¼ÈØÚÇgöùIY¸" ~ÈûBqjW& :dþBSòªà¹´×ÜvCë šKŽŸ|«€QÙd‹—ý³7$nè‰'íÿÿ€­@Î%¨uÅáÿùcñg°–Ú'sŒmåŸ ½qÏ«¬ÑË5bHA÷E-£j ïU‰Ñ÷ü¢•_jŽPéŽÇHŽDbš—+œƒÐ³¬NÚÔ*Û%<sžE:!ù½U•3Û ë‹jj> endobj -6708 0 obj << -/D [6706 0 R /XYZ 85.039 781.388 null] ->> endobj -2438 0 obj << -/D [6706 0 R /XYZ 85.039 761.463 null] ->> endobj -3129 0 obj << -/D [6706 0 R /XYZ 85.039 653.495 null] ->> endobj -2442 0 obj << -/D [6706 0 R /XYZ 85.039 653.495 null] ->> endobj -6709 0 obj << -/D [6706 0 R /XYZ 85.039 615.228 null] ->> endobj -2446 0 obj << -/D [6706 0 R /XYZ 85.039 558.141 null] +/Parent 7002 0 R >> endobj -6710 0 obj << -/D [6706 0 R /XYZ 85.039 515.856 null] +7043 0 obj << +/D [7041 0 R /XYZ 85.039 781.388 null] >> endobj -6705 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +7040 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6713 0 obj << -/Length 393 +7046 0 obj << +/Length 1393 /Filter /FlateDecode >> stream -xÚ}RËnƒ0¼ó>Ú\¿±­Ô硽p«z Á ¨ DTêß׋!Emˆð²;Þ™Ù…#Ž¬¦L:”YN¥µh½OÚ†ÊcÂG„Ò’j¥B|¡˜NÕÔÊTv3r¤wT*˜»<¹y F‘(ßLBŒeÔZòò GIª5ÃOõ¶"©4ß’”㯢&ïŠÕpÀ«'’áo€døíÐ×mÓ‘ü%¹ÏÏ*¦þ™¡Ö\ÔÉP*$•™¸jÂÃÊé¹ ®‚-37!L8ùd‚ƒ åð+ˆo{¿$m¼u•ý3°s8£Ž¹»¶–ráö¼ª;’*f𚈠WŦå1WÖe Âb¼•Å'û˜©ÇJÝ@²oãW_Áä‡î>ú/:¸éƒÙ°RüÜÇÊ tØ…¸h?²n€õ8uó#($O«a±]5!gí#ªÝÀ©AÄ°iX‡?1Ú.ƒÆ`w 7N¡×àÉGùtaü’Ñ0´Ùð—pFþ_d’15)ÒŠ¿„ZZª­\füyPË(endstream +xÚÝXKsÛ6¾ëWèÐÙ©‚_¹ÙNâ63N\[éLš,R§©òaEÿ>û)YC;‡\¬Žg,X»v¿Ý¥œzð'§q <•L£X +ÇÓÅfâMW°r=‘V›já….]Î'o>áTz"ñ’é|I"óô‹sõûÅíüý;SJ9Êî,Šbç¯[W:×wïþøtÍKî\?v>ßðÓýÅ \º3é\Ì|ñ7ÏÎ?«—3%<á¹_ç'ïçG:ʹСB¥þ›|ùêMSÐûãÄ*‰§;{B&Ét3ÑVö¹˜ÜOþvá5=å·FLŸõ30)Žõ˜Œ … +a-GðùÇ“Ñ©ÐAÀ/žnŠKÇ{Ê`dÏ"ðÌ–ÁÚ ˆfè®ó2œ×NÓÁÑá·Ó³g~$üHѯ7nü+1lkšmÛ¥üÜìËÅËÖ$¯Øš¶îà‰ jy&Oiâlï§k2´¦¶·sp·ƒ <^Ñ«×Y™Õ¦`᫪i ›­ºÚ´ð›WåÛg¡!†£àuA±­9Ô¤SÀ 2éQ4V.¨î¤]Ñ‹œ×-“iù£„ŽiI¼ö¼~ÖA + ÇSÈÌ„ŠÂáD¦¥H@Á£ÁO”€3àß,<çTž“æè%BFέ«Àù\˜¯Í¦G¶Íê—C@"ð®Ö¦\e Ëç Sòð’d×æç*ÚÄåÛ‘ìâ‹$Nž1EI!ƒWæ‡Y¹¨÷[ײŠvphˆfš ^Xáe¦ /"FYi`ªÈ¬Ç>`æØó8Í–iªhž³rÚ Ü|AW¾:ŠÄ¬]Û`äI áKË#³`Ñÿsм²<„‰tÇaL¦p­´{V¤tbúy]­ +ÎÏ ŠK2Äç’ «ñRlB='çª3[Ó€âùÂ’Á:´*)|6Uׂ/§É6[לjŠ®'õ³#®„]÷¬Á„‹œDë;¶Ö¤Í`vfÃz—©4mÝÊ)ccä•ÈùK…žƒ)ß éèæa¨‡ÆRO¿¶DÑ®@‡:;?ر{?=ÛÂe}èÌÚ|“܃z¶Gƒ…À4”ü!E6¯ñ,\œ5ÿ ˜Ðžü(Kþ@DŸ@PZ‰¼ä_r„—è³²|R-¹<Ý Í +FfzvQ6†ÔŠL9B*;ô"‹¡`g˜l ŒHÜh&Ûˆòg„íñ/¢%!ÃgkþXDAð¤æ×Béð¤æ×XîëÄùD)pǵú,ó;"EKõziŠ¼ÅÙýh½=W®œ±§žSQ‹È‹~Ø–hlK¤mKÞ™jg +P|èêÆZ-¤Ö/_î|C&Ð2²5ù¸5™çióhâ´&/­ô¥K–43K³¨sj Ÿ¶Ò••1¥e[|(m-cz­ÊixÆfèÚå>Dºž 0úðíœÔ {(¾ öÐ;Í {·0 Û"ãB:£oxø)-±Õ†ôÜ°Wãöx£Ÿ0Íù‰âÝ8•àÁ[^Ý“ãvV6û–7-e|ú: JyäpŒô’%žÜBšô]cH`1$0Ú4ÍAÕVõ~äŒ0^˜Ø-V?8âͯ-býÀ»[Ó—•= ïðâ  Mû.'[{ 0¼G`pF[C{|öÛ‹¶òƒ'°ïò¿¼HM4»]á©&Íx*%¯îÛêže@O¸Ú®³=ŒÕW«-uUCnHGÚ2oÉã’škÄÆÔ{ä”ßp tîl׊:Tý®Dó‰ë +^ZÖÕ†GJxV§Š}a{5ç½ÞåˆÛueÿíìgå«zH'[úµ#ü+¡9N"ö„Ÿû­"!ãAÛ C{êTÃãÔÔ+øªšE³endstream endobj -6712 0 obj << +7045 0 obj << /Type /Page -/Contents 6713 0 R -/Resources 6711 0 R +/Contents 7046 0 R +/Resources 7044 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6698 0 R +/Parent 7051 0 R >> endobj -6714 0 obj << -/D [6712 0 R /XYZ 85.039 781.388 null] +7047 0 obj << +/D [7045 0 R /XYZ 85.039 781.388 null] >> endobj -2450 0 obj << -/D [6712 0 R /XYZ 85.039 761.463 null] +2518 0 obj << +/D [7045 0 R /XYZ 85.039 564.55 null] >> endobj -3130 0 obj << -/D [6712 0 R /XYZ 85.039 653.495 null] +7048 0 obj << +/D [7045 0 R /XYZ 85.039 529.14 null] >> endobj -2454 0 obj << -/D [6712 0 R /XYZ 85.039 653.495 null] +2522 0 obj << +/D [7045 0 R /XYZ 85.039 214.88 null] >> endobj -6715 0 obj << -/D [6712 0 R /XYZ 85.039 615.228 null] +7049 0 obj << +/D [7045 0 R /XYZ 85.039 172.532 null] >> endobj -6711 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +2526 0 obj << +/D [7045 0 R /XYZ 85.039 172.532 null] +>> endobj +7050 0 obj << +/D [7045 0 R /XYZ 85.039 140.78 null] +>> endobj +7044 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6718 0 obj << -/Length 243 +7054 0 obj << +/Length 2855 /Filter /FlateDecode >> stream -xÚuAK1 …ïó+rlIÓvÒ« ¢ x½ˆ‡ÅÁÁƒ£,ûÿ1uÆ—‘x/ßKÂ@ö4#I…^E^?:‚É”›ŽWGÊ‚9%«wÄð«†(Š5íÂrŠh^³\ÝÅu$ˆ„¥ o{A…sUÆg÷à…ÝÁ ¹ãÉ)½»õìž|`‡þe¸[ {í TE-–’**ËâþÝ:¦ck9œZý9/¤Ã<.Åã—ýìÆEž›sjðîjØæ_ÇO%xwC²T‰˜ãõß;a¬Û8Vªm !Ábâbi;ˆÊù@ÙnU`ãœ'~¿Ãb’endstream +xÚíisÛ6ö»…¦_–Ú©‚ xì—‰×æX[žt§éÌÒ$-q#‘*IÙõ¿ßw€§(ÛmS­;›É$"€àáÝï þˆ‰¯LKϦôýI´>²& 9?š8¦å*:™½z£Ü‰°ÌÀ +&ó[™Ç?§ÿ8þ0}9I) i™Ó™çùÆõ‡©0Î/Ï.ÞóЛ˩íïßrëêø-œLgÂ8žÙæÜ;ߌžϤi™Öô§ùwG¯çœfŽé¸‘úùèÇŸ¬I xwd™2ð'÷ðm™"&ë#GIS9R·WGWGÿlVá1g³FŽ>«!fp$ßw5Bƒù2AÄ#ƒC%x¨{>HßðÇ'K80¶JJ =#®g”Q‘°íq3æy) gCW™ Hq_±˜ðÇåùchN}i„7„ï‡ÃÕˆ¢W¯É²Ms8}f eÂÚ“™f Ôu…#Lá“™g*ÏíB ic×=LàÂaVH,ÐøX„ÑTÚÆçíæïCt”mzÂþØyŽšÌ ør¤ç cF2,ßfS;0ª!‘¤gJÛf-{üLÒ´½ñáˆ^b?2Öù*vL(ø å1£œÃPåº$·Q°ÛèâFdŸ’ªJÑ2-ÊGý@?`<” ¹ó…e9×áfCB³ØaeÚöA…ämˆ¨lZ† ¢Ê„?o‹|Í_Ó ;Gu¼§xû‘˜Šö ïÕ|]œéerÖ‡ëw?´°¸Yù´ãæ÷ÿ7ÆH‘×k²q›ÇLï\e–ܳ,Õ²ÔÊ*g8|‹á,K¬c\]œ]i Ü0^_œ±Ìž£Ìâ×ÙXÒò52xaÖ;ƒäià}_Bt@9‰XÁÉpŽr¹¥¬Š#†.¾H+ñEš”_C†_'tà®­GÌê% =Fá™®xÒU«|±›!;´]q€˜a‹:];æXºf ×jOqrœö„Ù– î·økèà³ôŽ,XQ†+îmB.j­Iò׃?‚\¦8ºßTaÚÔcî¼_&ÏÍ7zFXQmB¨Ž ¢ ¹.2jg±» Îø>âÄù1Ú§ž%ü~ýh|鈅6 D™MÁy0Ogù¯þjV£ÉXíþ‡*C’íx îÛjCŽ‚›Mãø–ñï×1~æf”¯9$ÃÓÅá W=ô¢a•Ôëf<)ä榭¬º§C¯Òå”;Šê3(ÃMX¦åW]xÙºP$‹´¬Š‡!ø—,™¨‰³<[aA.°«pꀗ1h~Ù"MãC}&7²¢(ˆÏ´B- ++n “ѾKcº_ +t½\Ž.ú‹O~aÏ’t…Ñ)èÜM•k„º›|[v‹YBÒFQÕ)³&E„í}pY…«UØ\3’†Õ±V z¦Eì^Ñâ:HŠôFïf%ÝÞ>Ž‹E}ÓñUÿr³QùÄŠ›ÈjÛé6>éÇ2CàÚ¸B“¢‚DšæßNò¸Ç=ñVáyÿ}B‚Kð»a¿$kGgéþ‡Áa[+ endstream endobj -6717 0 obj << +7053 0 obj << /Type /Page -/Contents 6718 0 R -/Resources 6716 0 R +/Contents 7054 0 R +/Resources 7052 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6698 0 R +/Parent 7051 0 R +/Annots [ 7056 0 R 7063 0 R ] >> endobj -6719 0 obj << -/D [6717 0 R /XYZ 85.039 781.388 null] +7056 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [249.983 749.508 301.369 759.076] +/Subtype /Link +/A << /S /GoTo /D (tdbfiledesc) >> >> endobj -2458 0 obj << -/D [6717 0 R /XYZ 85.039 542.44 null] +7063 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [371.22 204.293 519.047 217.195] +/Subtype /Link +/A << /S /GoTo /D (unicode) >> >> endobj -6716 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> -/ProcSet [ /PDF /Text ] +7055 0 obj << +/D [7053 0 R /XYZ 85.039 781.388 null] >> endobj -6722 0 obj << -/Length 2227 -/Filter /FlateDecode ->> -stream -xÚ…YKs㸾ϯP퉮ZÑ ¾ró¬gS“ÊN¶bMmª²9@"-sCŠ.ŠâŸ~$d Lù ht7º¿~N6þ’M™ÅBV›¢LbY–›CÿIlŽ°òçO‰¥P™Œ3¥àûÆâÖ­nó4ª¸Icel‹¤Š¥JæóîÓýϩؤ"Îs¹Ù=;EòRÄe™mvõ?#)â»m–‰èû]½Þm“è8꺅Áéx·•y=CÏ_Oº‡ù=é-|¥ñq! N wÿÚýe£D¬D±Ù¦*®àEÀ¶½ÞJØ‹X Õ§/»Ys§S–ÅUqÓ8¸ÉXéêÁs™Æ¹Èýƒ' -L‘ûIœ¤Ê<Á£«*ú†ê7>äÏwtFs›‰gÉ ³è8sX«ª.4¤j’m檛'æ„äqx`p¢²p><´å81ÎSK± Ÿ}Ä]¿Þÿ›…íÉ8Äõhc€ªÒXÝÎW3l<š l - ÂfMÚ ›Uq6¾¼ï§Ùb9¡f{b֚ίœó`z@sÊ‚òz ™ge %€®ã‰Ó€Ë;hŽƒiÙÀôû·¯?ýíñ ¯ ”2Td^ìê¥ùìfXnٷ͈­»îwî±¹Â,x©gM`¬Ùç {A¨8àÇ OzŽ7¦±y¤EÏ£žÌxvV2ð¹Ä&—qfži·{”ùfìAP0ãUz‡‡ÁÉ^4X#çÃ,—ájÖÁ—%q¹žF’0ô˜„ò}yaQ ðVd͸[„}Ãj¢T²Áø‰AÂém2œ0„”™Ý‡‹ @t‡3â=ß -ø€!slaäØã8Ó2³ÉÈnen]?L†—Xí“h{x¯i©‚4Ø\ÆÖ˜YÐ^•iô ñ“ -2ñ3þf6`ÃR#öŽ´gâyM¨S®ÖÒ]¢‚sÿˆ‹U„yúlx‡3n:Qý†05/L±X•Ç:HÔMϸšÂrÞnœú0œ~‰:"ßq®aäBîs%W¡ëѱëhPïš´½«â|}y„ßT©OÞ-@:\Å´€8&Ov”LŽ¼ë -Ì*Á"Ü,üÈ‚'ÝÛ©^ŸüÝò -¼Hð‚ÈÅ…wÈMØœÙû÷ÈDjFæ-›aZf2zÀ(Xu7^Àr¡ÞSÀsîÇÁ vˆªHøØj`íÅÅ^¿riÆUîJ¨Ds-™XYÆ9¨\ªˆtòǧ­N(c0vÁuëxÌœ›ø L•ŒÕÿ¹Lx4a˜Z”œ…aº"m隸¦ž<‚©ÌÒè‡Sc~àOÈ_ ,kÄ_UE¸–Ø$áÓ»ÞÀßÃó„:¤õJgsâ5]×oøa…|5¼Áº?'fÎÍ:%aK3µ}Ûé‘Ù™Á÷"÷»snDÌÚ*—ûES*ãô{iO5·Et™°—Yôf–Çp;/mns]5°í´eF=p†QD±ÅÜRi^Ú#ŸÓÜeÀ åzü]ŠÓÈ3””Û®ÅBÑÚ¬ÿ¹¿‹LLç™cÉEK–¨Áäûª'²ê¥ê„©æò>”ŸéÌ^sÎ…eâ2l!›bM©;Ö¸DÁGoÝÆæâ¹áD+É8ñL`Ýè°œÀ¬¶úvß楩ޫÜŽn‡jZdq!’ÕPõh‚¡êhP™<ªkÒæP]çBÕ—ç÷ÔIézׂzW».-˜À•|·å$F½¦»›ÁÂdà®;É”·Í}Õn+5Ý°6GÌÍ}7«¬ ËR/tà–ÑiÑb5ãHýoâÚ•Ú•©W6îl»Á(á7[o <š°- J-ÂN\‘¶8qMÜìDOÞgï¡DýFö¨¹$bIe” -!îÿñ+ÌßçäI¬„£-²\ a7Ü¿æË:Ï;ò)ʹžË)¬½b -Ùwsí|¹Ztü©Kæ9m úµ¥4e‚9‡¸Nû p©!ác3_Šð©á¶g“JÅŠ_ž‚žõh‚žu4¨Uôìš´Ù³«âœg}y\IáØÝ ©çÙwÖGWþÄßýr‡>wͲG^ÄR¬wMØ–õ«ÂöX‘¶ØcMÜlOÞlš‹å¶Ö W — £yÏ`ï¿_xëÚw¶5Ë¿[_]Íý² k¯×ï5°‡+ÿ›ð€ý•ˆS8ÚªýšöOã*)g>ôÜ'ÂX·8`MÞìOàÓõcü‚3ž)ù›¼ÑéysŠ£ ÷jH[˜”qî}–Â¥o;^S±à êœzÙç±ýIùMWŸøæc[ío¡¾Ñ>§î1„Ô6!áŽö,ç©dwÇáÌ¢ŒäžU|A'~|úú -¿ªŠ³|½YXH‚η$äûð[ÙõkÂœç=iOÁBz‰‹Ú€[µ×ø1Ëv436}lq·Øe—½£a¨_Zc_ËÞ#W1¸FˆqâÚýüêÅI+Ý8t^ùnû©Hc•¯÷ IÐO–„ü~\]‘5ûiM˜ó“'í+½¬BÏÖ¡«ª›¹ç)Ï¥EIQãºÌˆ[÷g³\¢ˆâ7˜=yÓÎé‘ß[cK1=Ã4Ì _ºí»Œðê‚¿îÑ›ÔKëgÿ_@Z¹L‚šÃt0:!Ð,¬ûºŽº×÷ÇÖ'\ó_~!GKÈjWé1|ßv”= …ŒóÔ1£ÍR½˜É2ÎJ–ø?é]šûendstream -endobj -6721 0 obj << -/Type /Page -/Contents 6722 0 R -/Resources 6720 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6698 0 R +7057 0 obj << +/D [7053 0 R /XYZ 85.039 738.549 null] >> endobj -6723 0 obj << -/D [6721 0 R /XYZ 85.039 781.388 null] +7058 0 obj << +/D [7053 0 R /XYZ 289.364 744.522 null] >> endobj -6724 0 obj << -/D [6721 0 R /XYZ 85.039 761.463 null] +2530 0 obj << +/D [7053 0 R /XYZ 85.039 525.692 null] >> endobj -2462 0 obj << -/D [6721 0 R /XYZ 85.039 761.463 null] +7059 0 obj << +/D [7053 0 R /XYZ 85.039 488.825 null] >> endobj -3131 0 obj << -/D [6721 0 R /XYZ 85.039 632.606 null] +7060 0 obj << +/D [7053 0 R /XYZ 85.039 447.513 null] >> endobj -2466 0 obj << -/D [6721 0 R /XYZ 85.039 632.606 null] +7061 0 obj << +/D [7053 0 R /XYZ 85.039 366.218 null] >> endobj -6725 0 obj << -/D [6721 0 R /XYZ 85.039 590.321 null] +2534 0 obj << +/D [7053 0 R /XYZ 85.039 281.085 null] >> endobj -6726 0 obj << -/D [6721 0 R /XYZ 85.039 558.113 null] +7062 0 obj << +/D [7053 0 R /XYZ 85.039 248.664 null] >> endobj -6727 0 obj << -/D [6721 0 R /XYZ 85.039 516.859 null] +2538 0 obj << +/D [7053 0 R /XYZ 85.039 179.202 null] >> endobj -6728 0 obj << -/D [6721 0 R /XYZ 85.039 476.817 null] +7064 0 obj << +/D [7053 0 R /XYZ 85.039 144.66 null] >> endobj -6729 0 obj << -/D [6721 0 R /XYZ 85.039 422.621 null] +7065 0 obj << +/D [7053 0 R /XYZ 85.039 101.024 null] >> endobj -6730 0 obj << -/D [6721 0 R /XYZ 85.039 368.424 null] +7052 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F20 3021 0 R /F59 3455 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6731 0 obj << -/D [6721 0 R /XYZ 85.039 300.678 null] +7068 0 obj << +/Length 2572 +/Filter /FlateDecode +>> +stream +xÚ¥YYoÜ8~÷¯hû ÒŒ(R×`2@'d<›Ã{1 LæA–d·6:zu¤Çÿ~«X$%uË6°›iŠ,‹u|UÅð• ù*ò™+âUq&¢h•VîêV>\pMá®$s—ÞÜ\¼zï+î²ØW7wŠä&ûÃyûëöêæÝ×õFá—­7a9ÿ¼ZsçÃ×íîòóZzÿuíEΗOôu½ýoÖîl7ûÍÞ|±«o¶Á\æ®ÿ¼ùíâÝÍD¦d2(Ô.þøÓ]e ÷o.q´:ÂØe<ŽWÕ…ôó¥ÐßåÅõÅ?,Z“+Úµpõôæ…0€+E‘´:àþ‚’4Å›4Ü©ÆköëI§Z{¡3tú뜜>Ô†6Oú<£‰»¦¥Až¤¸mO_ȲCÚ¼} 3±t Ý7×woa~9ÎøÎ7.d^§íÌô¡‡¤SÛ(VÓfÄ©_Aݼ˜ +kŽ›È’Ì>þpç/d^ð¯ºBÑ—0|@3¡m8ê5VJÉòo.—5¬ª}šÖsŠI_½S=ú`WhevÕ-K›úŽèfú–>‹x¤éØ©k€¤`2¶sY Í +â fÚœÞëˆÉȧm§,}&ýg9^ÖiiU[45肃9îð7têüH—õ£ÉÞÈea¥äéÐýÂR|Îx$5Ýkâœd>âÐëãBò0œx±Ó+³Ü· VÒ[™ŽE¿×<ô¶­²s_üX“÷âÚ®hsš†Ý 8œšÍš*!û¢#pC˜N=bè +t‡{ôéÀ9Ê5pŒÓ‰á7ž+¿«-YƒSÇŽæþž·Ö/!ˆP½â~$uFƒ;Ü·½¢¯P¶Mߨ8L›²c$«ñu7 +•¨×I…;o“Xod:IÙ54*´-³¼Ã‰È^Ç%WC1W`xeÑ#«$”Í‘K§dï{ ¤úžæ†Ñèø•uGKf[‚'÷ûœP¦HµåpW¥P¢ß7J„LoD”Xp. w „oðk€;(U˜ù©Ù*d +üâl&„CÂóÐs(Þqœ¦Í`0Qx]åv÷hdO8¨'B½ïÊôµr_ØýˆôÜ™ú`„¸ Â÷|0Xú¶/ÈyÌ §²B¦’Òu®Ê¹ÅI—w§7ñ\ŸqÌöqÑ1J_H%CPOfŒÕ'Ei€-ì†Îï{¦TŠ4­A”Ã+å‰:x, tD¬“']•k°@ëÅ’Ìä“©“Z¡•?Š²%CÙ,ýXƒ’rÈ»—DWè…BãVYã—Mñ òö@Ç¢,GÀTå™ÞÑÐïPg£ßšh³‰<,k€+žâÍw$`BèŽOJ#U¥Øj'û¢&ˆUqå-}¡òºÚí-¸ê=‡ ˜'½_«&mZÈ5=È Êùx´‡‘#ÛËö˜} F×jS '"Žz~ñOÙë ßž1D•+<Äk¨YnaP—Ç%\ $ód¨éuniJcŸà=M:Ãsu ˜›È"e" ELjF©´qDTœÑ+³!/ëÇ¥{„µnð?Þcèg™ +Á—¤<*(ofû) ÎeˆXœ«á>ç§zœy6 M´GYÜx­0¾*œúÑG$²9±ÚÁ¬?9†DAåÅ€Æþ£WiÂw®mÀÍ’c¾èd¶´Ÿ0U¢C±\û´A.œÎr„¬n¡š5@!8Šå °•‰plÑ<˜†¤ŒÀ4â%ätÉàHîâû®óÆ»µpÌAî+sòw!—Ï4?7{B1¡û”iÔézÕ0ÔæþkGº(ÌiG4½„PP龜¼&ð†Q5Ä«yÁWPá‘ß·T'ñó¦a,dqü¨~%è—Ïô{¦Q¿XT@X8Ÿ•&ðnAè\§û¼JžÓ²xZË[ôd_+Ì ÂÇwþmô–öD ´_ª¼…dX@uôR=OUt¦lC´Ò›tqm@× +ÛÙ¶º¾RÛÖy:ýN¡Y’æÄÎú(v™áT¨‰Ø4¿øSƒ cm\Sõ + +GcdXªœ¤Îׄ6Tk›òMù¬U;¿Iß#eq;ØúHN· C››Wj‰©¸ ­ö÷¹–A·S rU ÁЛÅ;ÕTôÑPJj’ë]7í¤² ›n€N•„ä«/ü„ÊsL=mg®ªz®#5m UÒz +5øIuÐõœf#êÕœeo“øöìñƒ\ +™¢ÂðWéšÐ]añz3P’.–w—ï)„ñ ¡Ìçå„NÞóBè8Á Å€ S€²T3¼ûËzÀxןjzMH,Ρ-¢ÖðoÔi”Yrèò¤M÷ôÍà6ºyÑ ¯ys(ó—Yú–_Ðü/ô¡Àʬ¸[¸¾>4þƒ4­´Lµ6.ü¼Ãw4]_îNÙ©/À ËüQ6³;:¾LC3m³ ×K›^꩘´/;û´ +½Ü-°“Órà—vÜcÜ3¥Wjò¦}6S©äVyÓ7%¤€| q«*¿ZçˆsƒnbÎ"ÛG¢‰º±BQƒû¼/›:þ"õ½½üüyûéÝ’ÜÉzÓ÷“Š÷j÷V—8:!jPmú%gEãl¤xJ?$'<þˆº³P©tU%4]%æ5izÕQ O«fœ_3³:Ùd +âîÁ>_øѬœµëÐP°H˜ÚR’ˆE°€K¼9ôµPÙ=ûÀ+˜ÄžqáyWÂÉ›ÜL“QÓ¦:$ýò«†õzý¶ k_΄Ëg‘z›(¬ù>Éà–X3‚UmÐG»¦¡{@îŽþá>ž éÕÄ•úEË%Ûè7,ƒëIoã‰{DÈY¶qO›œ™<¢å5m­”ÈD¤¹)ÔuMÑÈÅ}Ón–º@ .¿3µšŠ|(Àä껚 R{be¤¾-Ðãº-PŸ½Iãª?†ìXé+¨b/;¡âºÜ6:5ð”Þîh®Îó,WV‹C +7œß=æ×$¦3¡Ð&ĺ@‹tºnp,ç[ódÔêE Ñ=éH§J4¤¬{à¤Êh±ÐìíÃ$^f^(o¹ ²š°sØ8·³²•¡X‚¬/ý~úz†•þIž>ÓNžjoÚØ7Ý‘u¡yh¥á´°Ý¿zÔÈòŸÎº+¹ ʸ~Èùrù¯ïüÿý_“Ÿõž¬ò¥ë/¼òa¶ž=ý/ê­žendstream +endobj +7067 0 obj << +/Type /Page +/Contents 7068 0 R +/Resources 7066 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 7051 0 R +/Annots [ 7071 0 R ] >> endobj -6732 0 obj << -/D [6721 0 R /XYZ 85.039 262.152 null] +7071 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [128.301 636.004 335.429 647.694] +/Subtype /Link +/A << /S /GoTo /D (passdb) >> >> endobj -6733 0 obj << -/D [6721 0 R /XYZ 85.039 219.383 null] +7069 0 obj << +/D [7067 0 R /XYZ 85.039 781.388 null] >> endobj -6734 0 obj << -/D [6721 0 R /XYZ 85.039 194.406 null] +7070 0 obj << +/D [7067 0 R /XYZ 85.039 736.955 null] >> endobj -6735 0 obj << -/D [6721 0 R /XYZ 85.039 164.58 null] +2542 0 obj << +/D [7067 0 R /XYZ 85.039 553.989 null] >> endobj -6736 0 obj << -/D [6721 0 R /XYZ 85.039 124.538 null] +7072 0 obj << +/D [7067 0 R /XYZ 85.039 521.568 null] >> endobj -6737 0 obj << -/D [6721 0 R /XYZ 85.039 97.44 null] +2546 0 obj << +/D [7067 0 R /XYZ 85.039 476.477 null] >> endobj -6720 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +7073 0 obj << +/D [7067 0 R /XYZ 85.039 445.061 null] +>> endobj +7066 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F59 3455 0 R /F62 4159 0 R /F20 3021 0 R /F38 3057 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6740 0 obj << -/Length 1556 +7076 0 obj << +/Length 2277 /Filter /FlateDecode >> stream -xÚY]“›6}÷¯ oð`UB}ÛÝ&i3“f»qg:“äŬM -ÆÅx3ù÷ÕHKÐ¥íd2Áè sÏÑÕÇUH€ÅdašiFͲ l788ˆ–7b[Ù:˜ÛÝæÇ×< F9΃ݓí‡#Æi°Û ï~¹¹ß½zˆ¶”ÒbmÓ4 ÿ¸Høæáæç_{£›^?Dq¾§}¸y'·Ñ–„7Ûý©ßîÞO­·7[Š0ÂÑçÝÛÍ«Ýçˆ)—Aþ½ùø{!èí#šgÁWñŒÍíFD‰8£æw³ù°ù}êJ·±@µäÉˆØ -]YÆ`ß8F³É7Âßòå$ FŒôP4×Fp‚2naKt#æ#$F”Ä/ßÑ–óðK×k“¯bÎÑV Ê^<C%ã¢Û†NþËÂá(š*ýüA¢Ú(NÃÇB£äwê¡”ßÊ[ùPäPÅPKÀÉtÙWŠA©¶qŠâ”*gq–ªï¿^4[£û&ᙨXØ=鮺áXu{îR„õ,Y«V±èô§$üÁ—E˜3x\-Fù‹V†(Kœù¤1by¢TA±˜œåá]wú„ ;\{„cG’†÷¯"ŠÃ¾h«Aé¯ïŽÅéP]<ñ&IŽR Çë`¾Ï‹±ÊÏuZ쎵´7¡Úªªj# ËÎ d}2ƒ°°ÐmâM_WOúWSV -{Я;Ó\ÊnŒ2ÕÉ GW>^tJ‰Hð™ºs$»êÞZ‹”¬4F/ê±×YJ¦*´ -9"=î§*ë°˜?rFçJy_=i¤óšÎéwQ}‹g.þ%Ð&¯e¤ÅÁ|ö4N®²S3A66Õ`Z÷•Š¥ì¥[gGž“Û§QÊWóÞtØvÓT­eRU{‡^¦2¿ê/È—;X&Öl0w,fÊu‚rÎÜái†âŒ:¹NB"íæ8|¨Z9°Ï*`’ÈDÇ2щMt)z9ȱs(HãMp±h#Bõ0˱ëúýè«ñ³ ÌùX< -[Ó°ê²hšor|òÅFR„c³#î¢,V†éÔ‘Ž¤¾m"œ¶9ãâ6à2û¶6©«Ö؃G.Ër”³”ë`ürGК\ˆp’;g\”ë2H¹Ó¸ÁÉuÖ#®r¡­/jJê•Ù—•,‰QÆàíßÁVЪ¡µbƸl…ÃXÊ%í¨×‹rp'ÃE¯>ù”£”Á»ŽƒäЪ|€ÐÊŸ1.Ëw˦6³DKÍvU­ÆõZ.æ#p†–ÂFX `„­Z#fŒËF8Œ¥=ÍgSûK_)o†Nî«ß%ëÊðô—Ì‚N.–_Ç Q€Æ–ŽúXÝ{¼µ"žÆïÍZó"œ¼™3.zã2ºûÅXè×óT>w½oçŒY"ÎÓð†á` hՀк0c\vÁaÔ'¦N×wF¿JSÈøÔ“LÔðm“ƒÔЪz€ÐªŸ1.«wÕC­3a¬÷ê¾pÐç¨e HNPŸœ,Äo€Á¬éØ&ù3ºEõÝ¿¯^˪T•»>/†ÒÞ/ à†­ÚZ?fŒË†8ŒÿÁ‘æåýØtäñ‡¦(IàÚ×ÁþЪ?¡õgƸìÃxŠáꫤˆø–'ð¶à`´ª ´gŒËÆ¡ŠÆÞ¿ôµ»O|é#ÿ GFKàÁBüú fM>À6©ŸÑ-Šwè®S*Èœ?v—Á{—“ šÀ«¿…·%³zYâg³w%/é–¯J,ÝsÄ“°hêýX/ªKÌþâ=¢x±:éX”üÿÿ­pJm”QO…ÃãÅdŒE]Ñe|/§âý>à༞rendstream +xÚÕËnÛÆvﯼ¹PHÎð¡Y8W©« Nsc-fA‰”Ć"e’ªc ß󘡆íÅ]¸ ` çœ9sÞ©7ráŸ7ŠáÊÙ(Š=!ãx´Ú]¸£ @®/<᎔pÃA¯ï.¦?áÈsÅÌîÖ„r—~rþûãÕû»7Æ)¥#]1žDQì||?öœëWóÅ»kýðaìÇÎÏ7üu{u¯ÇϹšøâWÞ½û¹ƒ¾¾šHá +wüùîíÅ›;‹§‰*”ÈÔýŧÏî(¾ß^¸BÎâѬ]áÍf£Ý… +¤”ÔßÅÅíÅÿ:* S#>5 úÄ`L@¤8VC8^(d4:ý(o@?¿¹^t*D TðÁS¢²izÁÍ&ÙýÈY&sPbµC-&y9žøqèü‰?‘“ZX–¼KËuUÃÃZX商à£Áí,eZmÅ€¤(~8+>—1äÃbÞð +©Ò¡C“!JÍÄèx©émê +ïØ›}ý[fD4£»'¨,4³‡˜iyëÇq,p.0½s·…¤r¶F‘–”ƒ®m4¤6(ij@):×ÌAEáïožTEšìù«9€¡Â¯—| +Ïä5³Õ’º•èÅmýȧ’C[í’6_†ôV¾Ö ’Oäi§ìý€hóéõbÎ~_Ã!ÏÙ ëR9[Ôn/Iñ QòV“µŒD'RÞlI/°èDÓöLv— Ø'Mêð*OVèK_P®¬Ô”¶çÛݱ³îvü*´~ŽúõÀB'®g…ÉÑ$P‡Ñ £k`|vCjÛçd L‰!%c²(~V ‘ p~7r¯Zޯͨٛµ¿ØÔÚ-ãÑV$j»…0l¶èÍ{†i½·HàÙ쀘a¤=!UMþõ¯G4¯é€³Á!Î/”(C ݇†·MtNoáïïš“E 1Çñ§‰ƒÜŽ;Ø縃Eaƒi×:áÒk+CÕÝÎ_t~cTâš"3TœKpÁ!…zM6ÚýÎ^"—&:ôÕàÓxuÉ!$é潤ž££…Ü»ÚoJÿ¥îýñÝâ×Úû=êƒóxU ë°sG:­w ù=e°)‘帑<ñp/ÇÑÎ1"¶•5x’5i‹J„á +’÷AMkŒj²Ì¾j+&xÅcÌ$§€ZV6ÌÓgz‰WÛ71éŽ1l¤ôHË—O\¹"T/Õà‹´çÏoXÿ˜–@ßÊ‹ÑêÊ;¦2“É Ö«^^nx/a|PâÞÞÖ•i Gu‡bçË}£¾-jè–z…U³Î\ ÜÎ=`-b:´ó¯®TI}tŒ!æZ:œNË´m/ž‰ÐWOÛzJr‘¡ÆSCž7c¼w%ž*Jóé¡82lÊsidÌÒl(?ùÀF¬GÐåGÃ]þÄWbES¾;ÀôÁJÀ]ð¡$€œwtë¦ãȹå€çu5–¨}†dÉXºN½Ú¢Ûœ·ó¾ð|ï Ƥ/\_>¯-êUì;k,hEQ‘3²‹Æà‹È!‚É…v\ŠUU®ŒîœÔÉŽTØfuÃÈÔ¡CÿA}ožtBx¼ß^âöÌÉõF®QÓ¼>z¬i,7¿ukuDþiŽ—_½ˆ†ûƒ!CÚU_ð•\o ¸ÄÃ0µÅ–ÒB0ÎDD »ÁƒÉ° üBí~¼âLðR¾ŸN…L¬g/ +EšÚÓíªÖýþ¨¾UÞ¢žmqГ"”áËJ±½Ø<ïRxÿOþÑ“PÊ:@ÇÀ€åMÊUÔyo™¼·î¬M™:¶øº%Ùã¥miµªœæ›§‹üºÃï Ñh_ò¦K*F©ª?¤R¯,c´¤ÅìµS9ß·*jö‚Å¥j…rlóòXþÊ*«lÞ ¼ÃÑ»îˆè~ëjžx ¤EêÄï±ïYÈßÇv¡_ChnÓ}ÉZÙg3ÙÔ4fxÛµ¾æ†®îÚ)<©S&ö¾už}‹>_²‹Z=÷Wž=)aù;Õ¥~¾ ªýDWk^gLgxlg9¾ƒÆ…] }—^i΋¤@±:‘P,‡Ía½Î¿ÔÁ0ú¾Æϱ +z®“fXâJ»Æ}‡h5[ÆxÈ‹‚¹Ð“·ùýwÊÞã`Rä"j¯àu¥eáçب³ŒN¦ÅÀ怮7¡V¡3ìŸu?Zc3)boÖk;ÔÔCÛ¢„ʃZ”pR±”ÕM#¨ªS̹´\›sl%)yíÐFÍõ5 Œ *É#¡ç¬5ŽÁÝéPƒÞ©›p 9 !_]¸CSá£ÆßÉJ3ˆº:7¼ e`[žÔaö{o’Oyƒœ‰x¦ŽA¦ê“Ì™kGn·:Çy‡¤M É˜0GbsÝùIr¡Ãe@¯:ðƒ‘St ­Ö$&¥øBø½5ôŸ†ù–½n.ðDšIr§›äsùÔLQÔµtÔ½nÐÇU‰O ¾·1miu(RÞ*«Ö‚¡\5çÊR#t³H6×ðâ!o· ¾?TÜ®'”Œú/]Vöu¾¨¿6ŸN¨Px¢B¹vùú–Iêi‘ÞðWäü4Æ5˜„ «×#ÓAhGž–ÐCþÿóQgõ‰ßð©û˜a¨öcåF>pâ/ze=ÄçïøišUÄîÖ:å#JgØeóÈŽí@)±ïÁĦO„îÐЇ«=LFtK¾q70uò@¾Î3 >ÉúÇÃ5ú'³GhÉRÓk¶ÍÖ)»|Œý&Iãp¥âû4^o¾«è­ Ow“š™$ÉÔªºœÅ»UcqzJý²:¼2|—š¬øêV~^£K,±¼¹PGm›k%‹TˆYSŠ\}ÚÕ2)>¤„>õnXììãhGynòüžþL§U … t3äXœ-‚:3ÛôPy¬¹Õ«{Ð×c‚«ªÞ д(ò>[Ê…ÿ&þµ§ç6ÏŸ; p/P"Rápˆë“Ó³ÿ·SF‹í竧³…róç/«4 þˆßgendstream endobj -6739 0 obj << +7075 0 obj << /Type /Page -/Contents 6740 0 R -/Resources 6738 0 R +/Contents 7076 0 R +/Resources 7074 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6745 0 R +/Parent 7051 0 R >> endobj -6741 0 obj << -/D [6739 0 R /XYZ 85.039 781.388 null] +7077 0 obj << +/D [7075 0 R /XYZ 85.039 781.388 null] >> endobj -6742 0 obj << -/D [6739 0 R /XYZ 85.039 761.463 null] +2550 0 obj << +/D [7075 0 R /XYZ 85.039 570.527 null] >> endobj -2470 0 obj << -/D [6739 0 R /XYZ 85.039 701.856 null] +7078 0 obj << +/D [7075 0 R /XYZ 85.039 536.384 null] >> endobj -6743 0 obj << -/D [6739 0 R /XYZ 85.039 658.903 null] +2554 0 obj << +/D [7075 0 R /XYZ 85.039 246.278 null] >> endobj -2474 0 obj << -/D [6739 0 R /XYZ 85.039 603.053 null] +7079 0 obj << +/D [7075 0 R /XYZ 85.039 210.013 null] >> endobj -6744 0 obj << -/D [6739 0 R /XYZ 85.039 571.237 null] +7074 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R /F58 3380 0 R /F35 3036 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -6738 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> +7082 0 obj << +/Length 495 +/Filter /FlateDecode +>> +stream +xÚ¥SM›0½ó+|4Ríµ±s$Í&ÍJûÑ„U+m÷@š HmÔßÛ‰VmÔK)xæ½y3ó0’øIbb.TFR#¹2†l ;@æô A4IŒÐ¤nfqB¤à™ÈHñÝRŠí ýø)*n—!SJQ%xÈÒÔÐç§PÒù2Ÿ.æš-ÃÈÐÇ{­ò{ LB&iÎ"þÕe‹Ç :ə₋𵸠n‹w31Íu¢p¨ÁË« [˜û.\e†œà,¸Ì2rt¬x¬•›`|¾¨8LWueuvf0XÉ}ñ@ÆW<(öõ²(Mé¦k¿ ©a·Ý[_Žð¬»ÖAeQÓ¡ 'ÜÛW|©!ÝbvmO[L'´n‡±lš³„';­„Â(¥o¨7ÖG|TP¸ê¢\Õû¢±óà¾ìk©†–Néy1½™/¦ŽaÇ@Y«¿Æ$Èà+@ß%:’Ù…‡c¹©°×xaQLǽ­0Ò ¡«·8»C@­rŒ:et´8Sw„^8r¹F~SXýËUûnmw> endobj +7083 0 obj << +/D [7081 0 R /XYZ 85.039 781.388 null] +>> endobj +7080 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6748 0 obj << -/Length 1358 +7086 0 obj << +/Length 1964 /Filter /FlateDecode >> stream -xÚ¥˜MsÛ6†ïú·ª¤ÕwŠc_ 4¾«V^^õ·Ú4]iýEÙºUêrŠ³ ‰4aÞFðÖ¢ oÀÐðž8ºy[ŽE©ñÈI}úå&ú!Æpµ4@úZL04éOÝé[Žcúý/6ò‰ïjÝ0eSê'åæ\ŸæÄ[ -IÆzˆ…¥ñ³D!áÈbêèda;Ž,.W¨k¦]lV!.\„Bà>mi.Zä.G7˱Øo›~2t»C½QeÑÞ|…àå!@s”¸)[€€ ††ÀÄÑMÀr,«}5¼¥Ýe ¯xËS´$ð"ÓÒ´(04&Žn–£ á¢Ö›¢KèIò|nfšœÔ<ú‘9ÂRŽ8_#–Æg…à@†#œ©£Žíx*Ú¶|V‚ª“¦ñßz)_à$.}’ %$… €@‹‚Cƒ`âèF`9¶zE­–Ø}ƒ8çïáªp.bV¹6ßé5H½)úÅ´ ÍD)Üg-à -„ G€SG'@Û±P)+`jÖíš~\ú¶Lt™"Bá-“¥R×¢`ꀡI}âèNÝr,ÊÖê§ÕYmÀξ¤Œ0…ª¥’Ö¢`Ò€¡IzâèNÚrn}Gi)JXà\s”ÇšJ<Õô»™CÍk;÷™¦±›fÝïÉÆ ©\;«mãÛœcć÷æ£Øš+Mpgîw3ók;÷¾ÜØ•õ°À.äjr¯sK¾“WëÆ÷DZΆ$þ˃ïÿy¾nv- eÌÓÔ8¥ˆ’!–þ8[Nã•'1ÁrWu`A”8l.Ãœ­>ÂÜv‡o±³=V¼–,#»Qµëð4U׳V¿Ó¨œHÀ«úÎ=ÔlEK~½'Ÿ‰þ4Øiðòžƒ[˜ÅIßÉ«†}>R§oQTí‰Ñ(C_¢Á >;âh-V9ç;(+åÜê=/ +ãóEÝ)Wgn–fÏ¡ÅwÃ4£Å]Æh!¼„™sWçMƒ¾!@üó¦àÁ2°ïIˆÃ-å¾'Ì8©/‹)ûÜäyó"×÷ƒ¯Cá-lf„Ãf¾óvÉs§y8}SçZ`ΠŽXB¡Þô¥¬–ó£ËÑ»O„ûó¼ºæÁ °ªÍÒûŽ×ÍG{”ÍZ9Ve[Š5«ù ¤ß¬óc'ªzÏ4ƒe ®IG³É#p„ÿ€»BT§.þ2†ô@p†©³Ö­®I£}ÂAHz˜ä$‚{Ì9¦Xú;<.Ž-:7¦ÎM»RÌ¡aLgL±&ƒÌ髵I²CŽ¨àe›bX¶æ# ì¯rbCAÅÓ†¡³4‰JÚ’ù6',þ̯[m™š<’}PËž\…ΩÂÕü2i0‹öšØFÝN£ÿN ¢Œ^ã¼²]ôäÚƒ‰4é›ÅúcN£›Î5‡ ×ËRa9b¥ $Wçt¨ŒB‰O¢ $‚¦èoZ! |ywÏŠé×H‡ãÔ±˜H å·†±8‰Qfø…"]ö )Gðuà.Åó†ŸPxAz×ø-IþX‘Ç€$‘¤ 8œÉGÉdœ)ÈJRŽ¼ [˜ Ê3§0¨x$­BÃ8¼÷yUp#•ý¨0«€ÅåĽ—õ/ÙDAQ5YrÙgSžxÀ0Е!‚Κ{í™]Y¨l +O º·l5¿ Wšb°„&É-9zíiž†ÎTeÈR7fòŸ Þ rUUßÍ0ý.+ƒï˜vâÃêsÙœlcŒ?–Ý$ë« z¾(¥~ö­=ìÎÉÍ­ÐçSIéJ©õ(ð@]d Ò“Ô…)â‘mÞT_8ÖÜL€X feKÒ8MÀÂò‡ÑÂ=[ãK*2—0( „@8t +ðl½îyþ#±OÁ"ÛcN^CÂ÷YÊáÄEæâÔ Nh¦/J]Â}gpH‰Å|'óƒœp*]Ò +±_º\•>4ÂåX¦¨’ØbƒhÛ唆¥IeFª†'´²˜Œ;dGž(?†zˆ¾«ì*ÏòºÍ€Qfa‚ º7|HÞG•ƒ0L õ©ÄÑêØÔ$®)1üøfúº1ƒ K×ZøËZiÚ#”î¥Â?öƒ%¶ $wô‚EYvh3p`’ÐÓìK¡Åkt@:¢ó‘À"KIˆUnA=Ç<™ÌØ Äh±ó.oL(@á´Ó<Ø‘clEX@Bçjz´*øGzGÙ‘€ÄZËB½p,±k¨<èmUv,¼Þ—´?*k-Õu`Ú¢v mŸ8²•òKYÙ–=M §šéœµèn´n5[Ž¹Û_6âìÆž›‘½Ôv]¥¦ËrÂÒœ& ñ燸­íª­¨RF¡*9÷¸²‰4Õ¼" Ú¥é` Tž¾/÷‡Þ63 Õhg¦˜³b©ƒÂ9£ÀÄÚЇ-Þ5…DMI=ÍÐ\?`“•˜Œ¶Ä«—¶:£â/ mgû UmôÁ9J·½µñ*ã·rõ‰± ]ð]G•@2î-÷4*m¡¤õŧTm¥R_>0¦”?î’ð˜¤H½.וª+ë'´ìåë(Õ¦ …ª¦b©P§êŠÞY |7ÉQ»0&¡–"o¶%ÛJm8>÷â4tcŸÅUMÅ„0ôÐõ•:KÝné”Õ +’tÒAßͧâA=n_=Îá‚jûÔó•Al–ùqáSœè±Æ€å/=ß.Rª+ðcWÅòa„š‚Пh +<É庑 áœþ¢‚¢ñšÓ×Ëý¡Õg\DZW“˜ã’È>_U5ÁI5U×&s(›ÔßÕ±?¬gæ3Ãè¢ +#-&\XeT{lžÚPb®±þRGPýoOdß—'þƇ²þJø Å +´©Rœ8ô½¦™U»¾³¬þà b¦a£ÃwGsïA +௶R®Loc.¬Æ_ãújn.†Âwõp¶Øäõyä¯m0°%þ µý²_)wtU .ºçáŸìª²éĵ1ÏCA ‚áo-g_~dH eŠZ÷ŸäB’¢””®º¶¨²LËõ<ž÷O¨Ü89» _)ðSêý7Îzéå +áæ|ñYß<ÿ±k¼ãendstream endobj -6747 0 obj << +7085 0 obj << /Type /Page -/Contents 6748 0 R -/Resources 6746 0 R +/Contents 7086 0 R +/Resources 7084 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6745 0 R +/Parent 7051 0 R >> endobj -6749 0 obj << -/D [6747 0 R /XYZ 85.039 781.388 null] +7087 0 obj << +/D [7085 0 R /XYZ 85.039 781.388 null] >> endobj -2478 0 obj << -/D [6747 0 R /XYZ 85.039 733.118 null] +2558 0 obj << +/D [7085 0 R /XYZ 85.039 761.463 null] >> endobj -6750 0 obj << -/D [6747 0 R /XYZ 85.039 700.697 null] +3225 0 obj << +/D [7085 0 R /XYZ 85.039 632.606 null] >> endobj -6746 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R >> +2562 0 obj << +/D [7085 0 R /XYZ 85.039 575.519 null] +>> endobj +7088 0 obj << +/D [7085 0 R /XYZ 85.039 530.445 null] +>> endobj +2566 0 obj << +/D [7085 0 R /XYZ 85.039 407.454 null] +>> endobj +7089 0 obj << +/D [7085 0 R /XYZ 85.039 372.708 null] +>> endobj +7084 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6753 0 obj << -/Length 1318 +7092 0 obj << +/Length 1953 /Filter /FlateDecode >> stream -xÚ¥˜KoÛ8…÷þZÊ ³|ˆ–´Ì{R M'q:](¶â¨µ-Ç–ÛÌ¿>$‘aÈK Aà(:ÖáùÄÇ%I‚ÅI -Ž0+“¼ ˆE²ÜNp²wn&¤WÌzÉÌÒœ/&®ùJßËý-“A1¹Š"ƒ¹qŒ8ÎFn±¸LP†Y2ˆ$¸¿1ÉÝtÏQÁ‹ÄzØ;ÃAóΑpÛ‘PÄ}㸓o Ûð[É9K«S÷L™hñŽl4@ä^ šÈŽ£?²å¸¯"nµk›•ŒLÓ£ìrõá—DQË¿ºË를: õ¡éäÝdæå1œƒd,M˜Ì Š‘ G2®£—ŒíxÔé5ˆÂrJóô¹Ú -»z0/Å% Àh½( -04G?Ëñ¸•auòýt&.ÚCw …Î("Î˽ûŠª³,›j£YˆFe›:4R8c('ðühi½(Ê04G?Ëñ ¹,¨Õó·XêêÑÂNàŠËÒ0zQ`h`8Ž~–ãs{ìä¬Qmõ  ’K­èEÚþ<íÅEB–—ˆS‘„ôšÀmàØyó[v?õ")—Ä~2ˤ*,Ö= I§íš§PÕqŠ2`4…^ÅŽ£„å(æ¿õ¦î×ÌC-;ÿk(1åˆQ'6 q/Š& MbÇÑŸØrܪŠq%^ïÓQ¿jÙխ쯡·-6ˆRx-°4áìƒ(–2³»ŽÞ춣®;ýº_Nª‹W²USÁVÕŠ¡%‘å -o", €¡E1†ƒãèÇ`9šÒIñP‰eÏŸ›P5IJ a -Oü–ˆÞ‹¢ÑCÝqôG·=©y]¥oE­ÌyúCï”t¥ì­¿È=W£w›¤µ@¢E‰ -WÕ–& iÅ A†#$×Ñ ÉvÜV¯zˆTÿ÷õjØ\ÈM¥æ¡ÿóC¥Ç0Á¯Ÿo/î.¯´X–œjïz!Ÿ®–CµììÝëÃPÑ÷/”q4gðŒdiÔ½(Š04¨G?jËqÕèþHÔM¥7êÖ¢¬öûz“ß…PàqÏJ–@Ñ‹¢(CƒÂqô£°Wíñ?'…h7ƒç$K>ˆbÁ!Ã1¸ëè n;žä”Ò,ué¹ -MÀ„gˆ1ø”ÂÒa{Q4,`hÂ:Žþ°–£ûêÖ‡aiÍ ·—ú;]«?O¬a>¬›~R’ç¯Õ~/ÇÓnš5ƈdp giˆ½( -04G?DËQEWõJµ×éez…S×öÁ]}ÎÎ"'¿£8Õšè!hØÍœ¾µó»÷Ù× T²aD½}XüÊÃðÿyæn*&–ÏÀ8à”"J†¶È¬x‡Œ31ì}ƒÿAP?xendstream +xÚÝÉrÚHôÎWpUAш¹LÙNìIj°3”§*É¡‘ôXHDvü÷ó¶––“TÍÅLqP/¯_÷Ûܾ?·ŽlÇŸö'¡kûaض=§¿†«ž+N?°ñ·Î½×—£qßuì©3í/V²ˆ?[œ}X¼ý8ú¾où®=N&¡5¸Ö»«gƒÐ·ïn®yûòãÀ›X7°7ã…ëÅ`èZO>Àú› Öâ†×æg³ó³¡Ï‹ðuñ¾÷vÑzå0°ƒ±ÏüÖûüÕéÇ@ÉûžcûÓ°ÿcÇv§Óþ¶Œ|{ø2O{óÞ_5Þ ú|ªƒC1ô; ƒš++3u7ðB+ ½ÑÄ*÷…Œ’{Yv­â‡yDÉæ]–ãÒC‰ÓЪ`g£*Þ›ÃDm‘}K ƒÏ[ä"ËåÄlŽß±u«q5>@}½@P;}ïØÊ¿8®ó¤(¥Êä›lÅTÀ(S•º@6(Y5%N”yº¯4Iò¬6xKÅòÔ%—€8{#AÍÝI†¨åÈ +¶Š|ˤ¿·°¨³i'"ñœ By `Ÿ°RE[ñýÈU|Z'²!T¾Ý©‚ELdt>’_ðØî þJi"ܳŠ„Ñ­Qº“! í(‰ÐZ*£ñÈg¡tîJÙ"~ꣴâªM «DU pBÅÁ3y™¯dºQ‚u‡$æ„;¯!S>äÅ`GDó,ÝÓ=. +¿?².” «+s‚’Ü`ñX3}×PEâü ¼kyÞç8 ÁR†ªÔ„…Ö˜YÌG¾8#çA“ì2/ø‹+ùÙ!dz¨ÖpbÉ]ëDTå…H¢¬-â^G4.á.·V ob;à\ámÛŒ‚±¸¤hnéæm‰TfNwd+r¯cƒè÷÷麼.¯çŽm ^±övÛáíÀ¤&ÇxGvšât!Å­6ÎNúk,Ÿ›µ‚a ûøÈuoâ ÷§/‹È+2‹ýÎ@ÔT´y±æÒò (óhdýÓ/Ú€ŠlüËh³ÌG–±×![*ke|ž?áËâÏ _hmtÖXˆp ]ÌO¹äZ§¥æk憾)Ý™ãD ŒÈÑßJÂÖi‰{ž¯ÈSÿÝvŒg;ôg©ŽT<•ñê57Äí +³.rŽéde©á`;cƒþR &Ç#˜½²÷®ÙÉŸNèµ tÕçPRB÷‚Ç&%¯W”½Q–ÕvÕ¸A sÉñI¾G뱡O4ȶJ¢?‚Ô'˜ + DÄ¡|Ç{iJæ³f{ÓVòÆ «äÅtqÈa“èá…RW]ùá&¦¥'¿=«rßžxÁK³¸ZÛ’‚ƒµ²j§W~+µÌê˜Ã‰7dé(´ÝiÙÚUšSÆŸŠ)Qž0ªÐRµÔˆª'™¦Ï4£°w¬ay!¼’¬ +F™do`WeU°þ™t»ªÄ«'ñi±ìÍcÆÕ’d¸ (6Ys,vÏe|œ Ñ!眑¤î°àXÅ^œtc}ˆp`岞gIƒrvþúáÞ]ÂdΠ%1r¯íš´WV>]¿ûûõŸšü Šì{ëð£ÑßáÓô¾Jèa?NÇ/LHEÒŠµõ¢ä¨¸¥š84„ëG¢Ú¨ëMì%¦D…ƈóKiÄÿ‚00@b=²¡¢®é49Á4êªh"²ñêDF¥–D”æ4cbQ’ôŠ!Š$Õf_Ü^³¹ãx]¬(•Þª,JŽ ƃBU¬Ó§xN-ñ&W·f&CÔÞ# •a°X‚!$EK&9•¦Ùiñá2M¾k$?MLS#WnêûC [J¯ÆØYRë56ÒʪK—–‘VuÝ‚Ð>³œ’nß„q¤Š—Æq«­¨g«Ý“Å-k¸,K€_¨_˜IŸ-)-9ÐÁ*篖l¥´e¾×-CŸ•Ô·V{¤?m9ÎJÒ„DUêu6¬ëŠBÊÎF*­^Ìiið1ã‚iHŒÃ/v…ti:)úKÜTû&L<ÕÛ7æ8`Q3Zì*Ù’úÀŒ7·:C¤¢{ÐòƒéTáDAããYÒ…TšÝuT"K.—EÝLNÀWÇ]E7âΉ>~*š8ÜÂùݺ V›)pCñ§ã1´Þô8!ŽÎ$Qƒõ[ªÙcSáQçÒ ¥Óé±4ðÛ*_1’(ÏJ( ¹>Eí âP92—Šza°¼RXö—]}èOҚīGpf““5Ä<­kHœH£ADÝn~ CSV|¤vY*ãæùÈk¥|Ž×Æzñ¢ïÙ*°<á  +§Ëœa¸z|/=hâÇñû•ìRE—J%ÜU¸R‚íM}Žà8¨ÿ=1S)Mû-Ar ÃͼvÀ7è‡ p¥‰°ôïœ{ Zº¸ˆ6k̽4Oâ6PÞÿ¥ñ]k!GÙŠâBÚÔ£¤^k¡¥0Põø—QÊ«L™ž¥Ù%>åÍ&I¥'™då¾Õ…‘ˆ_ÓÂæ³׺ÕÔø'ÿð|+ÀOmï™?åÿíï<b»aMÓ=dàLßÙv×æÿ¹i¿æendstream endobj -6752 0 obj << +7091 0 obj << /Type /Page -/Contents 6753 0 R -/Resources 6751 0 R +/Contents 7092 0 R +/Resources 7090 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6745 0 R +/Parent 7094 0 R >> endobj -6754 0 obj << -/D [6752 0 R /XYZ 85.039 781.388 null] +7093 0 obj << +/D [7091 0 R /XYZ 85.039 781.388 null] >> endobj -6751 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R >> +7090 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F41 3054 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6757 0 obj << -/Length 1479 +7097 0 obj << +/Length 3591 /Filter /FlateDecode >> stream -xÚ¥™K“£6…÷þìVô@<²ëyu’Êd:3NUª&³  mS±Mìéô¿ÏH¦Åe‘ê…18:Ò•äf…?d’P‘iƈȲ`{\Ñ`WîVÌ(ÖF²v4o6«>È$`”ä46ö9’ÄR›òkøö§ÛûÍûÏÑZ -J¢ušfá÷ ï>ß¾ûù·;}éÃçˆgá§úÛ—Û x­Yx»æäO}vói¼úæv-%4ú¶ùeõ~3¶sl´)Wügõõ JôËŠ‘gÁ3SÂàòq­$2æûaõeõûø(}-ô]>&ƒb ¹²,ƹIJ$Gn1s¸1ÊHLE0ˆ¸¿(K§éMH&³ÀyØ+ÃAóÊ‘Iבq"¿r¬K`~TÌ‹' º9Á™ÃËd. Õ ÛjØF´1´±'ŽþØŽãëØ8g¡Áš§„§¢ÿ¤ÐEÔ ¿¾S]õö~K’ä„ÓÅâhæ± ¢%,˜áˆeêèÅâ:–HYªs¥Žã°<Í9a Ï=JØZ³˜zÞ͆¾¶óg¶vW‘wm£úùÖ©þ¡¾C“uüïŸðX”‚Õ Œh‘bhALý$Ç+uy»‹0^f)É^Í|øA´3ÃO½á]Ç«ðº2lÕßתša°@")ŒPVƒ0¢Eˆ¡%1qô“p¯H<]? žKÓ^NÛ¹øB”¥x|«AâÑb|ÄÐÆŸ8úã;ŽWñÏ­ÿ=ó0.ú3À5aøbÊÑ ŒhbhLýÇ+—®RñÛWµ`2Oê[ïªSÕ-~Ûœ@ÃÃv—¶8«¶™›HbÉIÌñêhæÑ ¢%t˜áˆnêèEç:>µºZÀ -š¢t -J©°¼É\7Š¹$‚ œ…Õ ,Œh‘bhYLý,ÇžEý=’IXœûÀª_Õí\j -ÕXàõÃÑômàp•‘\Jg'"2Nd¢gwX¤s¦ö RÒð#¼AòVý²R/'IÃûH@wà|[‡ws®ÚN]Nœ¤Û}qÚ™wÖŸ¬AwÒ·?ÀÜ´/¾×zR 7°gBŠ4'2õö: -{ -F˜Ä'g$^ª ƒhé½;›ïSGï{w«Ó¶}yŠLÉŒCuXô5´{Ž`4ª_”¾¨èV§âAm:*3ZÔÄû2¬B Uƒg…uŽ*‡ *×ߎgD‹àC nâèç8¡“úžµsÊFuޛʡO*b¾`&©F£¼;÷E·ç7ŒC¿~T/cXØ¢PyÎñµ½£™‡:ˆ– b†#Ô©£ªë¨V0Ϻøô$ôªf£™ÔIJØÂ<ähÔF´˜1´©'ŽþÔŽã4µƒm³Sn&wL åø2ÞÑ ¹h17bhsOý¹Ƕ2‹5ˆ[oM*ÔVj8›KgÇQÝŸ­ÖJ)O›Õ:M3ïý*ðÞ}ÿéå*SÞÝ»¿póÛO«0õ>@Û{&ür·Z^Ä~óß#ïîÓn_¾õr­˜(~»ûñêÍÃå:ÚD‰B6¿úõ7ÿº€üxåoTž]?»¿ òüúxÅjGJ¾ë«Û«¿ÛY¸-ºæQ ÂX›ë ßäa¼,°5 +(έÈBAd %SàÑcG¹wƒbh@ÓU›MRïgüX)ß{Z)h; û7A<È +7~¨,#A¼ÀÈ­>®ÂÌ»×(á0 ¼-ò¡üð½{xd^)-móÙ¢ýØêÊ‚‰º—'?n`8¾‚> “^· ®0tm ĺÄöÞ^@sš˜÷¸×-ÚÆÃú|âÕa2’Ådè×ÖuÙ1ù³û'¢Ýkœ¢~2ÓÁä­Õ“ØH1¨½œ¶½Õ0l! +|ä=õ†MÈJ÷ÄÔí|]X1Ö£07oV¤¸µh.òsï}yÄ­ôo;nE™EÉ ?{:€È¯XëºmJž÷,­/ÈBÙ¥$)&¤¸§ù¼VÄu‹ýiÓ {nÊÛ§÷óf¤fãç•F]ž¸¡ù« a³Y¾¾ÜÖ†Ús]0É-Pý=Ê‚?y§ÒÄóžXPBt”·ÃY;™§:žêòHtfD#+UÛ€`"•ƒs@¥tCµ=פÃ!èa(y0ŒãaÙOY b"ßZ~ZFðãD§ºUÌ>5£ŽLÛç£$<ò€v'€x0£.ª#›\tiO0lÁú±'Z?{D´J¦iÙÃãŠÀ Õ®(b–v C÷äáÉ>!5¸´{éKéN|óºÇuÑßûùt2]M6¦Å”@ «CµEòÉ… ^F‘>xQ°‚åoï±äÚµ}»xÖ-˜&nÈÍ´û§åW$ÅêÒT¤’[t¨<Ç¡%õ·dÞ¥ÚòEÅ ügùù¹xù‘¿ôÙX†1YË¿¦W² î(ôFÇÝFŠÆUÊäÃAVëõÑY›Ö ïuoÙg~)kÑ* œ=àÁËÐÞåð§â•Ê/ÖŠÐtÍýŠ +UTvf_p¤=†L‹‘-‹¼w 7j~lÙ¶O6|åÛn¯”É®x@*å¼tÂøV7†a»;?-MLìkiA¥¤¨”Kt>Qv´ß 3ØLS4S„ ÕÀ>²Þq3¯/ãú*fÛegN'úå˦YðæD,Eʆ™g¹: ë¦lÏ=F\Û<®ò “JL¤ßàRß¼UÙ“€47~Î ÿ{LPK¶‰²XËÛØ9†0ÏFä²Jfsßð·–®g“£:d^£HPï~Ä §#£>O‚8OˆŸg¶œØ¬“ÙNsÕ!€R.á·¬ë)õráÌÄÐÙÂÓ¹eøiŒ˜ôÖ,©‰¥›hŽÊ:´hœµØ¥cÆ‘„dMðý@hn/gýXË_ˆAQh,;ÍÁ•V²çÚÕ'½­,àPʘ·C²A,¸‡a–ñÃc…no8lŒÍ’éd´Õ—è8A)š»¯¶è¸¢4{v^ìÍ‚Ý»ø‚8›`–b`˜x˜—w):áÅÒKg˜ñuô™]ã‡ÌÜŸ(ŽÐ¢@% •q•´ƒKwÙ™›q'àž I^d_Š(SΣ``^@i‡é†«`Òté¼Î¤&;Ô H¢']ÝndÒÁ`tZp`­9º;ÚæQBšDÏr)ºŽœ6¥&¶ƒÊ |Ÿ_ˆ·^²Y•)¶HHZô ã4w¼×¬0+Çïí¥]"×”¬ÀK¼Åç(–èR,Ñsba´Ï¹ñI÷£À.%`7SKd™qð;Õ,;›Ä½å“Û÷øLö›sãñt›¥âLnÒgŠ3®þË*Q(U¢[)Ô“Ô»8©È«²0“„4͈>nLTæ[(v’ ~ÂÓÿ§ºt'˜=Š0g#ÄÏå†Ô KG^'6“ÖZ2F…LC ›Õ?4.z$L†¨(gB©œ¬Öm…4Ÿ(¢¬k%ÿâöÇj8ð䱑 Fl€ŸèíÁïmðÈ™#¥™NÀ~§ÃR   #ëçºü–có-•Nu5#Üóó½‘~Î’4bpæz;Ößj7¢GéED'ˆf9¡gÖ'î~Ò0ÍeŒô™ÃGLî:ݤWVW qX>W@¶dD=t£÷eñX½Ÿ˜¼È­™‚O$G|“E"õïý ÆLUľ·ïÌ=pE*f—IhäX÷‰ÝRMÆ5â‚I ŠK <ŒaŒ'Æe<Ùól½ëNh_FVœò­lþ¸#Ü"ºÖ5iËž¼ôOfYÀ!,Ž†_6/.˜ÀR…—Fg VSH¹@>˜r"¥Æ`¦Bý1hËÅA¿þ »ÑÊØ |.ì[4ÎùÆ>mý A·2ׄQ3€ïz܃Y{!o%ØYR¡:2.|ämGÇ®¦óÁÙŒï¶Å©ØÙ/'²3{usì>¯ßȢ瓈ÎʱBèÞWN ¤ã¾¬xëL˜Èae°Øœûª\*xVT#KÀ•aÎ…±«¯„ëYð|°§½>bít½ ³(©Ž‚(øÞcá¶c|˜ÅpÀ(Ã6„Ù¥÷LZ~r!™þ–«Î¯ÜÎxo•ƒ¥0Ã|ÚäVü²‚“tUšÆI/£4q2Ú߈ÁT[ÓÇ„)îªyò¢êB!R:¹¸rÅd¹”ËÉÚ‘ x9±šWm?$²RyT’Ý~©øò§2–än©)L²Ñk†©ãöì5éø›â;¶óàl¤"èPoæ®´{ ×±×\ÇŽMiƒ’©†à…ÆÛª.y”Ua"a©C¼Ü==¿N%Ïgocãr–JòK¥¹<ŠÉ&>rhì+SbS*q“oÝ-Ja[»3ZÂç@EÁ¨L‚&ý$…ìjø‹Œ’Òöž«'¦n.qe ä¦:褱ª|î +Ò»ðœïmHÕ’”q„LÓc[Ùòy™2"#6>‡½[G(7Ц(ÝwdâGþ@œ­¥¼˜ +üˆ]ðëÜO‹åK¶þ®)¿Nj¯fó£ë,Ø¿?[ÑÄ‹2´6pËfJH[<<*$œ½‘~ ÆÓÀemÜcÇ;¼NîÁ—ßÏ”S…©6Så”9.$h*RãÙYÒ"šH˜QjÕ¥©õ…yè›jÒàÂÂ^hTûÎB·"žÔJ±—˺+¹¥(qaÚßPµÍä<§ˆOÜo x ûpë¯Còlãèkn˜q…Ë +k5¹ÃR‰q¥‰’€DÕ‡óqzC­cÔ3}*¤JBs³^JaW\›L3£üaz»S¨è…‡sa¼ôl)ØüO´=šZy7-CÁ´‹7A]iK&äÀéê*„¬uéJ/45&k]aj«—©ËÒûóÄ[!?š¬ ?8¢Ã eAcE¹—ÿNDÞ'š‡w9¹GyÁáòßí½¬iþ÷@–dª•¦`îoXÄ ×—`wsU†ÎÂtœ p—£©˜Úc¨'.¨uÛž(íÌýèñH`7¶J„IœÌÉ%4<Í5Ž›Û”Æóhã73ü¦|ÄæP\—Í,Ùƒ1ÞEùè®é¹#¯xV¶Ýðål8;¦Hxà +M¿áÿSüdý‰§˜Gb3û{ +9.j˜ŸÔ0tÔ§ÊK4ŸS^¢NÅbüz˜_¬º¹ºƒ—Ô,~l¢<†î·Ê‹Û°ÉܼìAÄ¡´WvãµY{?Lc¿˯ƴɉ\–øTŒE¾gþü'[ÿßþV§ÒMY1þi½0 +ü9‹A²QI¯ƒÿ”xendstream endobj -6756 0 obj << +7096 0 obj << /Type /Page -/Contents 6757 0 R -/Resources 6755 0 R +/Contents 7097 0 R +/Resources 7095 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6745 0 R +/Parent 7094 0 R +>> endobj +7098 0 obj << +/D [7096 0 R /XYZ 85.039 781.388 null] +>> endobj +2570 0 obj << +/D [7096 0 R /XYZ 85.039 761.463 null] >> endobj -6758 0 obj << -/D [6756 0 R /XYZ 85.039 781.388 null] +7099 0 obj << +/D [7096 0 R /XYZ 85.039 741.337 null] >> endobj -2482 0 obj << -/D [6756 0 R /XYZ 85.039 407.937 null] +2574 0 obj << +/D [7096 0 R /XYZ 85.039 443.66 null] >> endobj -6759 0 obj << -/D [6756 0 R /XYZ 85.039 372.527 null] +7100 0 obj << +/D [7096 0 R /XYZ 85.039 407.395 null] >> endobj -6755 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R >> +7095 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F38 3057 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6762 0 obj << -/Length 3429 +7103 0 obj << +/Length 2637 /Filter /FlateDecode >> stream -xÚÍ[YsÛF~ׯàÃV‰L…cÌk_¶d+ö:•ØYI®ìV’ˆ„(¬I‚A+ú÷ÛLJ·b¤Ê¥æü¦§»§»§%güÉYä Odz0’BGÑlµ»ðfhys!m¥í²tú¼¼»xñÚfÒ±Ïîšy|a|=»[ÿ2õÏ«Ÿî¾»Y,µÖsí‰Å2 £ù‡Ÿrþææêúí»7Üôúf¡¢ùûùëöêGèðr±”ó«¥ÿæÚ»÷uëË«¥žð¿Ý}ñÝ]³F˜bùûÅ/¿y³5lèû Oè8š=AÙšw€RøFÛïíÅíſ꩸ÍÌxTMªK‹Xùãt ¤0®é¦ Õm—n¾'|ÏÝ€Tˆå›xþÉ>ÁÞƒpþz¡åü„5ûU™‘ò}²ÍJ¬}"† E(M<°{"òô8vˆXÊv)bßw±K%T »œKÜ€ïͯ“2¹GÈÉjÓãN;Å(”¦A‘~—ý‚0^@Hî³#ÒÍ›S$Ë÷PáÇó~ÇŠçe’ím·ûfé­.ö;Roj;XªÛ¹íšÐLÏü±¯Æ=Ùy’j’û„QØ¡ÙY¾ÄYóÅŠëi¥tÍ ³=w½Åá»… -ç÷XâJ °ÒóŸ¶)Ç!iéT‘3c¢A‘îhÕ®vO ¥üÀd%®Kµ0é -§ÿˆÜúŒò“í›þ‘Ël¿á¯¿áB/^é_ˆ`q\ôÛ[ǃJÁØö-ïx…K|ä)×YQ‘mUæÅsÏ -HL`gØ ¬àÛöß”x|÷<¹Ý÷Cn×À]ŸPÞÉ´ÚXE’ű’)n¼¸ÓŒd_*£€ñâõŸ²íŽKš9Qvƒë'딫Ö$$K ¨õé [ËÇô™K‰E­9žNÈtªù ÙEêù¯žïe\Þ§«jRฤx†Fù-¶fÄRZ 9žÁÓ üsn¸é¡Èw\‚[L9ÿ*”oÅå¬Â½ïá¾ÎGhÿ >/JâpÐåG1 ¥„¯{4y‡V“ë3M®;šÁu ú4‹4RÈ5‹ðÃÀíqþ[ë"¥Ü0[ Œâ°Ñ‹rx±êUu"u´ˆP[Õ¥ŽèJ”}œÀm[Vþû9qTƒ ˜™ ‹Òöé l­s>¡¼~‰gcæ¯Q0¶)\3'­Š ņô(ì2‡p½È:áê!›B„ã}Yu¾P|ŠþVo¸shäÁ4\²½Û³Ô÷‘…Øè~ˆáÊjû1*^D´}—ìÒsšÉP‰(fÎ\X5Ù82Pa"ü.48àÝpxÌ:à3 !Œ -µ? Ðj²q ¡ „ÓÃú®*­àª:ü£ƒ0ˆD¤ô4ƒH‹0 ª-À¯‡íBThA¿LÇF€øÍ@UfP²bkçÄæN‡5̦M5â³ÕB…ýÛ\VS-›¹º¥A†F¡½¶ÙêyP<š=O!c F·ð›n…½µ¸TÁxYòõy”œ)öÐHÎØB­„lï º®ùÍBc¦ÇBã³ÐÄ_—Ðøà˜h€'=hŒAÑ@6ɾë&ݯØ,~VÚͤSpåDû"2mˆoÒ}Zd+fBr Ø5åàöfSxˆ+§ØCÕc{5°‡jïaŸªñ)€µÔøWƑƈÃ,ûIL$dà3;9{g笨À…¢ºïéo;×Ò™¬GXàÚèvÉá@L·•j·SÊ0å´‡à‚¸Ävp%‚=òʺ}€/öv@Ž~ÎökrÊÑ1ªv¨Ç8TîÌ tß^7“å\Ä#ÚgT#°át¾¾œ&à Ó¤¾ š|î6ørd­»`ÊŸHðÐíòÕwc`Îí£P2$beÈ;Ò¯‡Aþn&‚ÃÇ jåã¥î"ÜS„yR£@r¡D“NätbÉܾ½¾µþðî­ ¸žhÛÌît×ÃŒ<ÅæVÛ|ÍÌÎî?ÇÌS û Øy²‹Ü$å ikǽ@·+Ë,à†ÖÖB4fÞ4OÁÓc0u³ÂeïÀ$o™x²àèC¾=UÁ¶xkÇv´q1tsŠ,f×)öÕ°ëؾj“Ç!ÿ°Å3®¯Ùâñ”P~8`óØx‰­”Õjå6ßtCt@€:Àöý2Ÿ•çZ:“õ;­1lÌEGÁÍlS _ Ív§Ÿ1â)0{´ð½êˆ=W f'äŸHk$Zɶm²ØK¤ûtp|ÌøÛó{|t|Êš—z'Û~qä|¦BúGÝâÞIŸ~Àï­Y~:ºÁ³Ê—²obõRŸ²¤Bf…ê‰&„Íðç &»¼âC’6Åù4’6v>µ¤9ç3"iS›ÚU"öå@: ¨XN!ÌÁÀ»j-£ÆŒÑœ#c¸,Ú91ÊæļzLözñ›æÎ_¦É§,ÇdžbàAÜÈÄ+‡ÖôL’ј£¥m’ &D„1ÈÆvËq¯Ðòð†2N"8!^yu>–?âms¸w}Úb¯ŒÚj#ò1a±ÅÕ -å˜|%Þ*áOí¼· Û† ‚Õľ/mŸNÚF„‰2Pö¸CùˆºK;ÂðÜ“³üêImQœÈzZ­Kd™Ëd»Mê§ð–íI†’´‘"ŒÇžœ>=æ\ƒàÕT}»ì,&Á -ühtµªÏør$OKÕZïg×Ö7F·òS(Ù…“†° í}<üéMK¤!õ矾p,v[Û@¬AÇñ-T‡ÒeMl‚ÝŸ8i»æz -Ñ*{æêtªâ]èõpƉ²URkž®’²²É”Æ;‚'RZ͹—‹”Pæ¥ý¾~eûäö×ÒË—›‡:Jž3!Ö[ÑÓ-,yɵ˜äC­<ãtô½âýaqŸ—ª%Kö$ ‰•®¹‚d0©p´òÇì«CZXº“æa°xÎWÀý¨ÍBÓ“Ÿíœ4°ÿÿr´©ƒÊ½êƒTPƒÊ}lµZ¹.W)ww½–r×Æ~mßøèsç„›(Ž ˜¾ð›ðOWE@%S -«ÜI†Ýn);ª{T¼6qs8Ðå1šS“¢_6e—bU¨6±î —O,>Û}Ý£æ zlÎoûÍÒP¶%бñ?šÀE¹ Zh·Ñ«Ø´FïlØ€Õ±m/NÇ’‹uÎ΢štmº„Œ«MD2’T|ä…í'I¹£ô/ÉW#AQ] è_a ’å’û°YE½q}Þ|Õ—~н昫 -Ó -l( -’°f/ÆìØ4N…uÚøì_Ú]ŠàÿX£ç!«’·\A—cµZRÕÞ'6y€#0nzdæ?Ó– ñ*nå µòÆmD‡MHÕ¸‹äR²Ñ±_Åiko:¢{Äœ¯4 “d <9np:}{"ÐQ˱ÑcCþË1-‡ý«ác0œ>ƒ>ŒÄ,Yk‡þ¯`0A´²Í#gºÁgP»úµMš1¡±Âùý–M´#Êàp©t<0¯*Â096ð #Ä&ZIqtŸ-³,$æq)§¬š`8©Ö„³'&º~ÛÊ«mf/¹£• Ð_Èi›ëôlp{^>›1^˜ÜÄj›œ§M%€ØùÛáÁéï¸Ú qkbG'cÁ…„-±ÏL·ö™;%6d'pS±™qáÆýÛ{étï³yÚsRºÞ>«ÔžUƒ|D“žØÐL_IáE-˜N­úŒƒó•/|¥Zà0E–Ž1žÓ©u¼ë,ôm¥]GO¨¸?ò™@äÿiB ZD:Ú\ß²ÂBº Š;”Ô‘ða‹Àÿ„€ñ2endstream +xÚÍYKsÛ8¾ûWèHUY A€¯ÃüÈx=;ÞHS³S3s`(Zb %jI*Nþýö eÑÙ­šÝª­TE Ðh†Õ,€j–F~ ³Y’*_§é¬Ø]³ ŒÜ](‘fÆ⇮Wï~ˆâ™ +ü,Èf«gY­õnþzõ´zÿi¾ÐZ{ZùóE’¤ÞÃ\y÷wŸ®æ©öV÷yø‡Oó0ñ>ÂØw<®æ åþx‚þÛloõ‘û–W×W Í"ðûêÇ‹÷«Ñ.Æ7±Æmþóâ×߃ÙNòãEàë,½@;ðU–Ív&Ò~d´|×Ë‹¿;-îaìz¢ÒÚ˜¼Ãr pB@ätàF~¬# ó¶iz2ÃÂö­qh˵œÀ„‰ü8T¢ä@™ïèž!ò:b: 3:Üù>ÒÔƒX4<¾_}øx à|¥ðϤ"‡±_rp.¤¦(‰NbtÙàjÀÊ®êËŽ›SŽ†#ø;x)Ïȇap¦æÏîX _lù+ïx³q8Ú¬Jp7ûGõµëó¶Ÿ2_ì›,9» ®>ÿ\c`Ò~h-v ØVa#¡A‰Ú9’IädM$÷¥¢Ùï†CQB“fÞýžmjÈÝirö8÷z gÎf¹„Ï4€^4Ç‘ÇvùHðÅúŸÛ6t²wÞZ~sþ¹³njòx˜C$'*0õËt+n»NÓwÚ†bŒÂ®ì¤Puñ<”‡É4ŠÐ<—Öí«âXSër†sÇÚ#7wg÷Ru[nõs‚pl2HãëÑ™†uºŒ5ϬÐ;ª¢mºæ¹çÏ¿al7¸ê‹½xå1_ç(µG¡\<¬…s¯±O¥™ +¢ÑfrѾ¶‘×ÝÄù_ª~˱¼¥‚©_$¶%Æóõšxⶲ9¸ãNç=ÃvÏ1J,çæ}Á_öbUý‚a‘˜B:ð˜àìáОùf0òºBÜßàL*†° “7XShü,IþSÎf„³=µ æ`ruH¾hÈœ½µH³wƒà?|O’¹$Lß"s°–Š¿Oæ~rèBSbÇÆEÅñÀ_OôÅ›í°Kº:Ê8nC£Õ†p¿·@„Ç®BŠµaëñaÚà @ýër”ÎD·èAÚ‡¿tÑ(Û(T}=¢ ØuËúþ蛩Ü>> {ÑC¾Ï7¥ÃÇñqLüÎçáÆu:`_¨‘­!1ÀÖ`øØ €ÿ6n“H‰ÀBqæ•KN¡!j1D-b.gœ0 +üÀåÑ{¢Ž@áyîÑ™ +ž€ù@…@ʪîõZr¶ÚE¼•ØÊ–üû3Æ%T+ǹ%Å…Ò“+x\-8É‘ùðLš +®F¨z±.V›8ƒUx@BLd¿QãËûÛšŠ;ÑÓ¶T\À|æÆÐ tª%:ˆJ÷cδ G\¡ÍA—>)}bGà@Æ8³‚Üú·W« “Ç!°›î¼hÃ[²,‘ÉXúÔ cÛIjDŸÚ”ëSøupˆ^tËmJ)ˆ'ƒ.† +ÖÍ.'£Lá"-¥õ#E@¤–‘ÐwDÉ©yE¡^:ÑÍÿOJÜ{ôÀÕ2A„|LÓp~¨> ź#DÄ#¸Ã.Ò°Až[4GvPžÒ•}qÞ±Ès‹Tž„÷ü‹ÁcíýLV_sf—<® 7(¦G¸²¥©v7Ëœë”|¡ý ¸»v”— yß—¤Žr£ê¡‰´lŽ’YG¾+œ/Å6Jn亠™\§]õÝa„Ú¨g‰ªcËÕ'ÿøx÷ažïQ»¦úrTEnCCm«­‰£Ž,R6¬ó8ë0²:îu²y+²yŸÀ\ÃÇà~&žšg‰,^ŸNB¼>¾”YNDzØÆkÄ .®²Iv[,¾¢I·ø‚X˜ŽË…ÄòЃ=°EÉt4Œ$P Ã?±Vw¬ È°î þÓãý?Þ}`òuüÊE´­q;*Û#æßxì™ëáжð46§QHiyÔ¨v‹wçä² Úì%¾D„J”-Q¡Bž_ bëkÔ×—¯>”÷ˆsÀ÷ZœUës·R×â8DG›­¿¡cN¡`蕾‰‚‘Þz‚‚ÊÏ°¤:GÁ*À[ö%9$žD÷ˆ!ÒåöÂià ¬VÄ`åÐg€¨ß|q„ÅS•}W6Qäh›Ck3úW48»[/UØÔ‘ô ªÍâ•Ôç“Œ'W$ÜI¼jêt@µêÄùTìCM{<£&Ž‰7y­RxñÄ×Jqh¬sÒd¿àÓ5U†R1äòEl¹·Øæä}šŸH\†ÓónÔ[žÕHªÚbÚñ`G.­å)}ÕUQ•ÎîZò«»™ûpWcËVhoUÚ¥»õÙe ;íXòÿÕ•œ&ƒ –Ê )•rü’­~ZOº•JZîÕ¸'¬ãçÔ枟ÙòJ[OȹôÈ["ü6{Ÿ_(oèi•lŽ­Ug'ܘ˜×&Žn÷Ù·¼‘ûOxc³žÊ)1HDçœtür÷|,¤·8„%^#•8%†ÛqÂÊ/ýˉ×>eÀS´}0”„¸ˆB`yGõØþ ÿ<6ûUMÀ_[·p)dFx‘~ªC‡¦%)pJ g²´ž;*AÙ9>ŠWüüÎ0 £Pô…!uð£ÒœÄ[q~¢'¡.Œõï|V…Xê›ôÏDÁp&ÅxSS8:96Î +tòßY"Çr°ÝÐûzd)4ìÍÁ€´çS–£ƒ{½eÆðd-”ƒðybWÔíTÁâ.%‚_óF>î:ñÕ@­¾{F©×û#¤Ýà¿H© Hendstream endobj -6761 0 obj << +7102 0 obj << /Type /Page -/Contents 6762 0 R -/Resources 6760 0 R +/Contents 7103 0 R +/Resources 7101 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6745 0 R -/Annots [ 6772 0 R ] ->> endobj -6772 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [440.111 139.828 522.084 151.517] -/Subtype /Link -/A << /S /GoTo /D (unicode) >> ->> endobj -6763 0 obj << -/D [6761 0 R /XYZ 85.039 781.388 null] ->> endobj -2486 0 obj << -/D [6761 0 R /XYZ 85.039 761.463 null] ->> endobj -6764 0 obj << -/D [6761 0 R /XYZ 85.039 736.911 null] +/Parent 7094 0 R >> endobj -2490 0 obj << -/D [6761 0 R /XYZ 85.039 736.911 null] +7104 0 obj << +/D [7102 0 R /XYZ 85.039 781.388 null] >> endobj -6765 0 obj << -/D [6761 0 R /XYZ 85.039 705.159 null] +2578 0 obj << +/D [7102 0 R /XYZ 85.039 761.463 null] >> endobj -6766 0 obj << -/D [6761 0 R /XYZ 85.039 620.547 null] +7105 0 obj << +/D [7102 0 R /XYZ 85.039 741.337 null] >> endobj -6767 0 obj << -/D [6761 0 R /XYZ 289.364 626.52 null] +2582 0 obj << +/D [7102 0 R /XYZ 85.039 549.933 null] >> endobj -2494 0 obj << -/D [6761 0 R /XYZ 85.039 444.95 null] +7106 0 obj << +/D [7102 0 R /XYZ 85.039 515.183 null] >> endobj -6768 0 obj << -/D [6761 0 R /XYZ 85.039 410.204 null] +2586 0 obj << +/D [7102 0 R /XYZ 85.039 405.679 null] >> endobj -6769 0 obj << -/D [6761 0 R /XYZ 85.039 368.892 null] +7107 0 obj << +/D [7102 0 R /XYZ 85.039 371.536 null] >> endobj -6770 0 obj << -/D [6761 0 R /XYZ 85.039 301.146 null] +2590 0 obj << +/D [7102 0 R /XYZ 85.039 274.975 null] >> endobj -2498 0 obj << -/D [6761 0 R /XYZ 85.039 216.014 null] +7108 0 obj << +/D [7102 0 R /XYZ 85.039 240.23 null] >> endobj -6771 0 obj << -/D [6761 0 R /XYZ 85.039 183.593 null] +7109 0 obj << +/D [7102 0 R /XYZ 85.039 114.634 null] >> endobj -6760 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R /F62 4047 0 R >> +7101 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F62 4159 0 R /F35 3036 0 R /F59 3455 0 R /F41 3054 0 R /F64 4225 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6775 0 obj << -/Length 2641 +7112 0 obj << +/Length 1959 /Filter /FlateDecode >> stream -xÚ¥Yëܶÿ~Å"-¥EQUQ8ûlש;¾ Ò"É­–{«F+mõðùþû΋’öÙM,E‡Ãyüf†§g>ü«gËHù&%K­Ìr9Ëw7þìVÞÝh¡XÉbBóêáæÅÛ(ži_¥~:{ØŒ|"Ffö°þÍ{ý÷ÛOo>ÏÆÏøj¾H’¥÷˧¹öÞ}¾½{ÿÓ;^zûy,½?ò×ýí@ðj¾ÐÞí"PÿäÙ‡Ãê«Û…Q¾òç<üpóæasdJQÈÿÜüö‡?[Ã…~¸ñ•I—³'ûJÃòî¤TQh仼¹¿ùy`ÅkáŒwÓ‰£XèT¥At]o±Val½°ªUES½E¾Šüôª2 -t‚Æ¢È÷>Íö²¶…©õ -Ô'¬ž,ÿWlµnq6ö²jÍË·¸Üw[[uEžuE]]R–{Uü‘†Ä×ѳëX™˜¤ØÚÆÎÁÒx[8›‰÷ L“·ÂÏZ±â©Œ6ö‰÷U°ÖŸx!GĬz¤ù–ç»mÖñè>Ûá+á”­w2)Z¤îÜÚÕMËìÛmÝÃL¹J<9C6Ox^Ö°8[o˜ôi;Š­½ŽkÜð…N{D%ƒî}#%mtµøí( E8ð“ÄI ’àºI&4§&I—Ê$fàƒRè“ô«e´¼zš£¹~œÖ2:88ï ª#Gõ Ÿ÷3(úg’x{4Ù¦}BµÔ ¹0¬lÉÎ_ à…˜Ç)Þ$±'cà±*­°\á–g^_ÛMÖ—°ÞñZQñoÒ¬mÃ_d^…­mõÞ¹ žu‡23 w6OE·=cøºG¹Èƺ­Û¼`–5zÚ×ù"LïWtXˆ`ñ©'qt\"U–…ÛÌóy»y†W.9Üe$ 4Äd1fÆ[×ò¹#–Y…_ZB -Ó4nixêw?ò3øŸæÏŒ´èÚh ö‰""ÒC–“ðqNn£#¡oé+t Àì8´¿æ‰MÝðÀfôÕ·¶ù‡è@<…®XBüüÎVyó 'ïåœ=Â( {kåyÉUýèNý ÛQÌ„ÅŒXA_‘9Y†¤.:´ÁóXÛß}VÓ@0{&à¡òºB‡¹ˆ~¨Òäz¦žÐ\Æ¡Aá‚Ëøpå´®7àÃä¼÷U^ºEw]˜”Q§ðßDeó¾):ä0û’2gÃ4ôê}'Ìñ ðv<Œ19”—9ÉÌmÞ×»¢q›sH"r<Å)e€¬¨ÎØ»o%'€}Ã!ðqLÀÅN—N‚•_i˚ÿå¹ØfuˆJµ¬Dì:œôaðá÷Ý~â/„ئî8ÖóºlÉÄ3रþŠ ÉÖ˜ä¦|r²²­yT ½ÖN -Ov˜ q°§3jŽ,Ôíª ˆè0„ž™m±¸í:§œDEOØ3٘鋪îiú=Á¤©7”6´Ì0F$|çµì'ÐêÏbô™=‚n:@w 0 5VZdýºW;` œ’aY‚›V P’Q+qM\@)øàôJèçÄüp ÊÀ/±ôD·œ*åˆÆnµ¦ †SN1¡†`À˜„wñ§*Ø“èªLô£c0òãt™P!°¼Ô<Îxðy -B½˜Ÿƒ#žT$¹èˆôÄöejM’e0¦§æ@"ô¸jCæàëRxQ˜ÃêšÒy¶ÊZqᣫBÕ¬?š^õïÍõ šD«(0d0É×¶Ë -ŒEȜK¹¹\’àH÷Y“íl7„}+ñ»ŒU¸ Œ(~Õ»«SÕAb®d4„.&(¨j¡ÌŠ i $f­@6 @®BÖ‹–·—{gùÌó®î!º1ò{þx*Ê’G•µk!­™¥ÿAŒ¦í¶h»c2ç 8vÒY‘"Ë»>+/å×±ŒAôã¼`Š''‚)W‰Åã ³Fà÷™Ô24y¶&äŒ̸¶i& t—RNB€[?e _<:L‹0ŽÈ}•%[m!^<*ç$¬§…ó1e)€…ä5;PÉ;¤ù‹iœœ¤+"7ä[¢ÙqfZíJ;´<Ü3•¬Â®m""‚¹«²ÍDÊ3I’b´ty‡ˆ€ +ÛMn-N7jÕ´¶µ< ¹IO uÎîV(Vq̴æEƒÅs¨}r ëÂÊÊÖXQßÀ{R< Á=Ùï]šàî–Ðöˆ ¸:àÂùš/ —Ђ_e˜Ð\|e£¼2DòÊðZ/ƒ¡i»ö’²ýª#ÍÅ׳LU”jã_¨iD0¦ xÜRjÇOèó¾_õ¼åµ=•BÐÿí\Iû¹˜ÃQËE‰Í]M’•¼Àù…š{N#eÜnüœÔ0)ÍH½ÚŠªW½€ îL€ -|Q@FwïÏ8{^‚ø”°\kÇÆ{Í䢖³qè'^ÛïùîuƒÊð!ž1îq)G[òùG×K a -üôc´ƒ^è´ÏäÇ™ìà -¢ôQ—pŽ< µÒ~Ù-V~üRÀQ/&ä§ÞpÌ•ôK5ôRR’ Ò N`OTs$fh(kÄ<ñTGs]¸(ˆ Âa§$†>$asÔàa÷ù2!ÔßÁõîmBs1’N!ÌôA$ÇÉ`|77>?~º$‰p¸*ÉHs1˜!5«ÔÉoE;ih9úÆvË`¤wÔT¶u‘åÂkœÙ¸Ì:—‡|›Am&¬éÉäñìÛ‹±+J¤+ -†·ê)ç^2TÅ^”^Ǻ Í`¨õ„Œ -ë{pï'ºË¿ÚÞç[»Ë.É#|®Ê3Ò\6—Ÿ‚÷“8à&ˆDñÔ+ôïßc1ÃüúD9É0oN1ô~;)Ƚå¶há¦ãW»£±DK3ž0Ij-³jbç +úɬ±w®Œ±gôo´ï-RÍSK-æ§Å&Gãø”ô#•Åt“YB?mëëBu×)MäCífº±†ä]s`ƒX”q?1.š*µnZga ÉhßÔz\”™6+;q bÏ$‘F°9-•ã> ^ŸÜâ…!¾£$Èyj¥€pع®ÂJu¸[Ú®÷VgW“•GðZ4(݆»…³(F65q‘Q`솽ñ.ÔW1iÕ ˜Ïþ2sÇö¯ú·.»ÄØej:5’­a¶Tô¦‚Ø{²-o ™h̳ÁµÛ]†˜WÚÀ8C€ˆï¥}»j®ŽÙŠyð!;ØZ«*d¸ë½G()=¦bÌ+œÝVÛÌÐ@UPYøø·±¶Rï£bÎp B#ã›D&AÞÍÅNŸž/fèh iuI^5ÍR¤(¨WܶçŒ+|¥k|zA{0¿emþÝ– +Ò“¾w©\tP~ßm_(ìPÊC0”Z™¨ÃP_uÜGá1á5O2>¿ÕŸêàbv^ë·°ÄÖ›U/›ÍæÓ| 6ÅÎÜi`YQ1†#ˬ65Ñsr[:æ‰yUe·‡:`pÄÿ­àðïxƒád&—ìëÝ þ?#Õn,äzI^éü•„l0@!ôx2¶1C`df¿L4¸“Â<Ę* 䜛ê~ÕôþIýòÉê ò>"Ùf¥Ë9"d¸#¡|}WB¹-ŠV +i7|^àÂy|ºæi3ÔbÍw ˜]à«PàAxÙ·3MŸË6å Ù)Ä^{6'AšÒ×D#×fOÚ<®Bß $œãÒb8·§zž`X×3sØ +fž´í²U®£VÊà#‚®nJ)çG»Ò0ǯ Jê²ÎªÕ} KS¬ÿ±*ioXRí¿ðåÁ «`±ìé¸Å¢@u/Þ‘tï÷WL„{Ñz¿åô€·qGÚ7 è_ˆ?ë endstream endobj -6774 0 obj << +7111 0 obj << /Type /Page -/Contents 6775 0 R -/Resources 6773 0 R +/Contents 7112 0 R +/Resources 7110 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6745 0 R -/Annots [ 6780 0 R 6782 0 R ] ->> endobj -6780 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [131.073 531.126 368.701 542.815] -/Subtype /Link -/A << /S /GoTo /D (passdb) >> +/Parent 7094 0 R +/Annots [ 7123 0 R ] >> endobj -6782 0 obj << +7123 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [440.111 372.925 522.084 384.614] +/Rect [276.377 208.463 327.763 220.152] /Subtype /Link -/A << /S /GoTo /D (unicode) >> ->> endobj -6776 0 obj << -/D [6774 0 R /XYZ 85.039 781.388 null] ->> endobj -2502 0 obj << -/D [6774 0 R /XYZ 85.039 761.463 null] +/A << /S /GoTo /D (majtypes) >> >> endobj -6777 0 obj << -/D [6774 0 R /XYZ 85.039 743.459 null] ->> endobj -6778 0 obj << -/D [6774 0 R /XYZ 85.039 699.822 null] +7113 0 obj << +/D [7111 0 R /XYZ 85.039 781.388 null] >> endobj -6779 0 obj << -/D [6774 0 R /XYZ 85.039 632.076 null] +7114 0 obj << +/D [7111 0 R /XYZ 85.039 761.463 null] >> endobj -2506 0 obj << -/D [6774 0 R /XYZ 85.039 448.505 null] +7115 0 obj << +/D [7111 0 R /XYZ 85.039 747.777 null] >> endobj -6781 0 obj << -/D [6774 0 R /XYZ 85.039 416.69 null] +7116 0 obj << +/D [7111 0 R /XYZ 85.039 720.981 null] >> endobj -2510 0 obj << -/D [6774 0 R /XYZ 85.039 347.228 null] +7117 0 obj << +/D [7111 0 R /XYZ 85.039 693.883 null] >> endobj -6783 0 obj << -/D [6774 0 R /XYZ 85.039 312.685 null] +7118 0 obj << +/D [7111 0 R /XYZ 85.039 666.785 null] >> endobj -2514 0 obj << -/D [6774 0 R /XYZ 85.039 267.595 null] +7119 0 obj << +/D [7111 0 R /XYZ 85.039 639.383 null] >> endobj -6784 0 obj << -/D [6774 0 R /XYZ 85.039 236.178 null] +7120 0 obj << +/D [7111 0 R /XYZ 85.039 392.247 null] >> endobj -6773 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> -/ProcSet [ /PDF /Text ] +7121 0 obj << +/D [7111 0 R /XYZ 85.039 362.725 null] >> endobj -6787 0 obj << -/Length 2676 -/Filter /FlateDecode ->> -stream -xÚ¥koãÆñ»…/¢jÍÇò´|±ÏqÐó¹g ÍZ¤%6”¨#©Øþ÷ÇîrEQtÓàk³3³óÚ™áy3þy³$nÎâÄA’Ì–›3w¶‚›3OA,È‚ùðxvñ1Œfž+R7=>÷xB!Ã`ö˜ÿâüðãåýãõ—óENàŠóE'Î×ûsϹùryu{wÃ[¿œû‰óùÏ.?À‡ó…ç\.|ñ3¯>~6».p…{þëãOg׆OÃð”"“ßÎ~ùÕåp¡ŸÎ\¤ÉìÆ®ð`{s\ŠPj^=œýÓ â=9ãSc2 ƒD„Ip,/JèŠÐ•$”ÇuŒ_|  ÐZ´ýWÞ<Ä"dªý+“Œcçáöj -"_Áþ}—ˆ(À2Û"²Äy:_ø±Sð¤~ê²r :(P9“{B½ñ¸Ùãî¶Ä?+>37ðìxRÁr Èg‰ó ç-ŽÊ|L -¾òú’¹½»»üt=‚,áÑÿ(ŠzË|w¬žÙBúžˆ¢p¶ðÐRzÈ6(†§Œmñþêd-þJ§©IŽu'‡;ƒ™pÓÔ(~$©SW9ZD¢Í.—Ëd -¨;µ³Äu±AJ©ëÀ/‹Ÿ6YÌ Ãªâ£>„Ý·E®—­C;ÒBAj@Í=¿‘ŽW¼Ýi澫òl§•ü |L†‰ð½h»©HÀÿßõ²@øñ¸-4®……ìØ…däÒC‘ì¶Þ {ÈgÖ}njﲶe{õàâ¤Â Ž„ÕÙ*|Ê–(•ßð™( -!‡Ð$A?Ö(ö³÷;š¿Ï±nhT‡\’Lm ºÒɶ¨—mÄi9AIlkç"àÕÙ”ˆnß-ÓX“ÒWÜàŠÑ3ð±å£b™¶®V¿¤S¬Ë¶«›…¶IKå2CŠ|Ö7[G‡ ¢?àzýÌ¿ŒL²yj—'+…­»ž¬ßä1ûÅ–¥ÂdDérS°ôŒX"€áZÏu£gZ5(c&ðyz O¹ùv}×€. ÿhøe7"e¥ôÅŽ3d•5¤³’¤ëÈ{>ÿL›¬3…q[«#Âl»"ÍÁZ©ÐK›„§NÑPIH´#* VÁXøùÜ`Å»‘Ü Ïµ€”h6aŒQ[É¥°¤Ã:¶øÛV¸÷:„*4R°1Èöyñý‰ç;òà ðƒÉDÄ‚¡€!=;¬»0àÑ@xyK<¤ç¹”d’ †9¢xøÀfàùMl¿Bg"ÇGuᇱ³ÀŸ”"•ÞAOÀÕ„öµQæ†ö­v œ¡#dVU*ªP4A”h¦eÞò>)ze4j‹4‡¸VlÀÈ^E}D“)°-›BÁªÏš·óD:bÄmÈá|x| ’ÙaÌOárÊ{iœçV^áCØ&™ÀÁ9š>=4k÷ ±èuÎ3$7nÖ=9cÕ_QÅåë-ÞöµÆ¿®Ðn$=(ð³ÔÁ¼àèGâ†u­ÂXå„8°Tˆ9‹—gd$h~F“°8Œµ°tk‘þȫ4 @¬UÆà%l{~,3éÚÛâµÓéeÀaOd•=U–u0ËDo×ç´:?Ž½óþ†dQe>?a42òEšø“VcÁœ6 ôžÝL4†3¤8j96Ec:·¶œ<çZe¥`(XzÅDÏÎþ:^hûçÖÄ=3^øQîtçVi¢C]bU*ž¯bß‚iõh¤¾óõîOü̳=é ßb*Ïb+~GŽa(WIªä †ƒeSXU½š…ì·™}…Ò¶ü;+PËTÈ øS…¯Æµ°kŽC†"ÞÒ8-òLJåŽCŽ¶_©+ènÄ 2:aîä¬2ž6÷†ØôÝã—t¡ÔˆX\ ¯HøXÉÔ¹#6°Îˆbç_ž<×çW$¸Sdçë4Ëu vu‚aWŠTN7*-˜“=¹ gQÙ¥¯2ñg4wL«Ñ‚Kjn%`ãÈ9n“õq&–õö™·)qk² ?åØLµ]_œóâ ‚Çã‡91®`‚O;¥Z(h^6}õªÑršÞtº@à\!ñËûãøúmßW‚€¼/é¤ób*9•ÉÎ1 9h­°ïØi)—¾ó7Æ¡2yˆ@ß_\!8"K²H¥a/CW¸œ -©>–³½pN¿ôŸ -Èä'‚9´5Ð{A{Š  ÚCŠ£AÛ¦xàÞ¯0Ž_y}¡^»ÖŽeÔó¡Âƒ"}CM®õ YaÕƒ~YovûnÐÈ–üfS›†^ö”ø]âœ7-þfBü -è]ñOìÅ? 8.~‹âø•|•,Z³´¤%Ρ(˜®‚¶ÿŸ`ý~ÓédÄ‚9-X ôž`§Á)Ž -Ö¦xülqv­?3 ŒFEl¹¯ä+¹<™FÖ5F;ݺŒEšÊi¡÷0BW@ï -}‚`/ôÅq¡[„¾êëÉ÷B pû£ ¥öºõI ajWX%ë+~ÒS$.ìf¨^Öâ€@X‚ZÏÐ ø®HÒé6…3¡ô®N&ö:P׉Eñ@'ªít*¼ôͽìýÃVð-¢¹6Vݼvsû„¡å¯"~L™)„Gá& ±uK½tÉ}‘(´šq¸:b-\cdÙòo^àS½µßjüjuf$½ð«Hê†/³iðÊÖÎ…’|ôÑZñª>H„NSX=Tc`°aø~ZôòÂã|m¬£y‹Y”›rGo)=tÁñ®&QÖ*Y­ºÉ­çSº 1j0((ÃnTe IܪåY©¶ÆytŠ‰›ÌE¹QžÙkrì(öœËŠÚKü¥P!ÝUÜAä¦s£súÐw|ñ¾£¿'4mwúó^âðs›Ô•Ê1ƒóÙ t©ÊƒŸªÜ”]Öe‚% uƒ:æ-ï'ݹ˚–•vJ(ä°!²·Î¬©-U©*VùÛ nïnnûMs)`øên® -H˜¼”Ýši~Û׋ãlº³t“5¿éwçd®ê -4qtgJ ê¿.XU›H‚ÉgèûÂ÷4/T³¥Þ_ý_Žþ/<¡òTendstream -endobj -6786 0 obj << -/Type /Page -/Contents 6787 0 R -/Resources 6785 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6790 0 R +2594 0 obj << +/D [7111 0 R /XYZ 85.039 292.392 null] >> endobj -6788 0 obj << -/D [6786 0 R /XYZ 85.039 781.388 null] +7122 0 obj << +/D [7111 0 R /XYZ 85.039 249.438 null] >> endobj -2518 0 obj << -/D [6786 0 R /XYZ 85.039 432.047 null] +7124 0 obj << +/D [7111 0 R /XYZ 85.039 197.504 null] >> endobj -6789 0 obj << -/D [6786 0 R /XYZ 85.039 397.903 null] +7125 0 obj << +/D [7111 0 R /XYZ 274.682 203.477 null] >> endobj -6785 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F38 2997 0 R /F41 2994 0 R /F20 2961 0 R >> +7110 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F20 3021 0 R /F62 4159 0 R /F38 3057 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6793 0 obj << -/Length 949 +7128 0 obj << +/Length 2232 /Filter /FlateDecode >> stream -xÚ¥UÛnÛ8}×W}¢€ˆ¦H] äÁÙ6ÙM›MT @6²å:êʦV—õæïwfHÉq£6A"Šg.ggÄÀð¸iÄ…ÊÜ$ ¸JSw½s„»äÊ ¬…oMüg6¹³¸Œb7<™›=Ɖx)7/ïÙo¿/oò··ž¯”bJpÏO’”}¾ñvu»|óîã•.o=™²O×æíny ž°¥/ù³›šÐ‹¥¯¸àÂ{Èß;oó‰çÄ8eHòoçþA¸%ôÞ\e©{€µàÀ;Xò(Tö½vîœ?¦P ]ã5§ÉháÏdôsÝ ±št“bF·HðH„¤H¥8hãÃÂŒ½+¯‹ˆö€7žlyc6:ØP­-Ó¶ýÔ S8Cõs¾GâD3|`Ý»b‡ç·*ûÖì÷MÏ.ޜْ;Í„?g?~œõ¨´}Ç$’ù×è÷?ÝñvòóÈudïàÙuD‹‘¯¤£|iÚùh:úo· +ùc~k »a‹Ø‰=5 ˜©¸ƒÌƒn=ª ä9°K)×ú˜CC¯VÙj  B뺜HaUܘn’$­ëm{ŽMË··†‡F}ú‚ÌŠìoóÙëíʦo70ZÑG@OékRùyÎZ·Ì‚wî_]ÁÚú =Ÿ¾¥ý/y´å ‰ð9ÉŒ +òx“„Å÷¥Œg¤qe†F9k·úû4ªK–œ°¥øòŽµ£é3PçÆŠj«7źa[[_<;¶Áæƨ)zóM»[RÉ<·ËMÓWÒe¥‹Œ½\%d²|ÉkÜ‘\T·uæ“f.Z«BÖˆŒÁ=K=YïæÙªÀ¾x¨ZŽùáêÝ£j8ï¹M ¾ö?âÇõùÀJ'ác€æYÝÔ¼~sÃ[<ÝEsHUb)KjVZfüâj‡9ð€óï'ˆa߉ßUtF½êáŽþ.dú ï9Nvul÷57Y‡ 0Ø… #©([ø`aJè¨pgÆþ/!xƒŒÃ¨tž›(TF²ãÜTàø¡yëÀGÒ2Øåìq6^êfSmÙ×BÚgéùI,=ÇŽÝ(y0¸Ží)ñAÎ!}ÈÀ€~¦ûÑC“Yód'n,¾,ÚÆÉÇ–¡—\X†ŸÌìÝUÀ¼÷1…ô;íäõ4ãTt%Ø€Úß­òôÔô£ËAr¼g%窵˜é¬Ñ­R\ºzB)ß¾ÛøZüŵõƒ§dfa&B'þÃöøBß•®G1WÝh“^»`ì2M)3‚Ƈ)ÿÖìÈ\eIÙO¶~’ã×fC±l=ítb¼¥ý@ ßWQFdu–= ãmºŒÕšëtkøh2΀úp÷] +@ÆÍñdò?陵ÒÚ9*›Ï +ÂÛ”|\ÖiÏ매ëk+ï:8·I¢ÙÃPï\"{@iʾg“±gÞĆ@„šC…š‡¯+Ì,ñéræ‹©óPµ†„f:¡LTk®myTK¶Ä>îÏË5E¡&²_-¶%€.m®úÈŸg¥úlƒ°Þ˜ü1KÚPÏ °BKÌ$ùéý‚Œ€žëµ!k˜—F¶K@ŸàÔm1°„Nº &ÿO‰Çÿ‹ +]H?tg-¡I|ÛŒ¡6l£s*úÆì¢`^¹îc†\’©Lµ5>Î'ˆ…Ë#Áç7ñG[@¢PuI¤¥ìSo,+Ö}•Ús—4²©_Š·¡ÝÜ’ÍÖ) ¯Ð+½Lwè…þ­KJ¹ÅÐY+O½·ïZÅL‘­U3P–šP7ÜÔ¹,Sb LF§L©MÊp8ÊÁƒŒ”^†Úì×P7ug)öûéæe(Ã.7)P*<¡¶ÕÖÙªÌi€ÙB3Zý9¢M¹nƒÙW¿Ö½ôûÙ$ú:!]ôLaÂ/YUA{6RÕ›šÛY]æ æ lEGQŽp‚ÎV^Düv¡?c>Ü•½þn½¶Œ¹jëj¦V«ó¬áˆïEDrïm‡ÔBêKa]¦]Ê_cÄÚ%²â5׿TÜ[(â t6Ì1ÛŒìÄoó ÓÀ¬¹ÿabBZÓd¢(t€øÉ9‚”Óá-6±ÌØÎLqf²©ö…ãlâ)듦/m?ø=ŠÊ‡þàT’hv8\àñPxH€9jdŸß–û‰ôyXÿ]ñS'ëCšiVñÅÇã_d¹éÙô&ôàÁ¿2®ÃŒ!¶¶eP cl©‚ý@Sªˆ,3O6;0÷ ÃMÇzÝ__qÀC)Íñ”«€šÏÀ–ÝàB¸ +òáŧ ìEóÞô²í'ÿ„›;ļÞ@`¡»»º³Kmµy=i OeÕÙzÌP}<„Ž úä~Ñ*_[ÿÌ™#Wl¤#ïÈ §€Áê´û7ž¹3ÕÞ–ä7ï‹ U£‹tÕ]A÷¹9£Iÿ§»86×åm?r<ård‡4&ü6eüœí·‡ @×[.@RNÿêNnñò]®ÁѤ'ŠœHÈãLJêÑû(Ý­Ù;FÒæìc§ÚJ%þ%Ëñ¢Á~®ª7}«bC>3îm°À>Áp§ŽÝ:¼ ‚À‰cÕ?/<8ž’tBò Î]Ë(¼šg«íM4Œ Mwa +ÍóªE¨ÛóUíÍ9ÿ•çºŸ{W ÒÊxÃWT Rº¾öÈ©Ïi7éd舨‚t_V{§â-ÿœUòendstream endobj -6792 0 obj << +7127 0 obj << /Type /Page -/Contents 6793 0 R -/Resources 6791 0 R +/Contents 7128 0 R +/Resources 7126 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6790 0 R ->> endobj -6794 0 obj << -/D [6792 0 R /XYZ 85.039 781.388 null] ->> endobj -2522 0 obj << -/D [6792 0 R /XYZ 85.039 761.463 null] ->> endobj -6795 0 obj << -/D [6792 0 R /XYZ 85.039 741.337 null] ->> endobj -6791 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> -/ProcSet [ /PDF /Text ] +/Parent 7094 0 R +/Annots [ 7131 0 R ] >> endobj -6798 0 obj << -/Length 2079 -/Filter /FlateDecode ->> -stream -xÚ…XI³£8¾×¯ðmpD›Fìômzš™Zbž#úÐ=lc›.@ÀÏýþýä&!o¼ð¡Lg¦¾\…ZðS‹<ñƒ¨Xd¹ò£<_lÛÁâ”ß>(ሓÈOâÖˆ+C]¥¡ÄÙCѱÊTáG±Bž×¾ÿ5 aà§i´Xï!iøyž,Ö»?¼HùËU’Þ§¥òêC_Žµî–«(ͼ}¯[\¥ÞçåJy똷¿ãϸñGÍû/e»)W@Œ–ÿ[ÿk~d‹UûÖX–¤žy–øH¼^ŸG^Î5¼«˜N'A¾aÀó!‰#3G=çåŠ~D躃‘Óžò—}„–_>¯ñ1ËÝ鶬;^oqÞØëæN$€¼ s€f”ƒÅJAp°/7åPí€/Š&™°Þ¢¼œäùOðO2ÀM³ø;<&²T ±–:øC”Â33‘E±Þצì:„‹@‚X)»/~«à‘ˆ¸lž§a“©¯¢”ÌþfÄEÞ“*\+ïãš÷.Ë0ó4:²Ù]s™;Æõ~¬DZÉ¡DO¼Q°Ø¿—£ð4 /N°ÙëMcD·Ë-U·ÕgökÕWbÍf¹é?Ûò<«ÞÃ3/@ì -Ø5ñh6Ù ¡¸ ãŸP+x‹CÚǦJÄq¡ADýîdœ3@Á儃{Ì%;¶˜üG<.®:- :7.›´R,`4Ç)1÷Äž’3¥Þš|<•#¥@lbLÄ6|$»»Ïœ=9OÇÞÚä4qK•‡’bô;~=h fîIΉä²'bïRã~yh0“Z=Œ¼Žñ»°X.A¥³«ž #|2>§±ã¹¤œÒÝà›ã†™¦6r)SÓõp´©ìPxrñboOÎi™ø韹÷{ cqbs©"ý35 XØ:äj›£®dªo8%îFF1Õ2ÔÚ<ˆßŠè¯uÏ5ý$žÄràp&Ÿ%“qgG\ %gÏ·Åb%MòE¹©T„š ×ûÄûwçŒQÈH³pÅÙ>TÍZöý¯Iîô¥z$ö¢¡—#ò -ßUÿ -•Ÿ™°Ý“ÑÈQv‡Šm¥1Ÿ­ †Q2–E)â…®OÑU‚Üv5ž6dÂþº¼+ófÆ–‰Wp§ :)å4;¦ùqƒ)nM¥²9Óÿ‡'ÃAïÎ+ ±rÀUòã ²‚ðìTÙ­>WÌÜ7§ÐðÜi¼r§Ràv^iüØžz}UÑ„§IC@b×(7uCÁË¥ù1D -Ã,Ig!rxžCd˜ÞƒhN¡…èVãCˆ\_6É棈sU†‚&C.\™eÕ¸S>oí)õ·XÒJ¬Oõ> >> endobj -6799 0 obj << -/D [6797 0 R /XYZ 85.039 781.388 null] +7129 0 obj << +/D [7127 0 R /XYZ 85.039 781.388 null] >> endobj -2526 0 obj << -/D [6797 0 R /XYZ 85.039 761.463 null] +2598 0 obj << +/D [7127 0 R /XYZ 85.039 761.463 null] >> endobj -3132 0 obj << -/D [6797 0 R /XYZ 85.039 632.606 null] +7130 0 obj << +/D [7127 0 R /XYZ 85.039 741.134 null] >> endobj -2530 0 obj << -/D [6797 0 R /XYZ 85.039 575.519 null] +7132 0 obj << +/D [7127 0 R /XYZ 85.039 433.525 null] >> endobj -6800 0 obj << -/D [6797 0 R /XYZ 85.039 530.445 null] +7133 0 obj << +/D [7127 0 R /XYZ 263.137 439.498 null] >> endobj -2534 0 obj << -/D [6797 0 R /XYZ 85.039 407.454 null] +2602 0 obj << +/D [7127 0 R /XYZ 85.039 156.149 null] >> endobj -6801 0 obj << -/D [6797 0 R /XYZ 85.039 372.708 null] +7134 0 obj << +/D [7127 0 R /XYZ 85.039 121.404 null] >> endobj -6796 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F41 2994 0 R >> +7126 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R /F62 4159 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6804 0 obj << -/Length 2342 +7137 0 obj << +/Length 2171 /Filter /FlateDecode >> stream -xÚ¥Y[s›H~ׯÐ#ª1\ÌË–ã$Þ™Šãl¤©<ÌÌ’ÍPýû=·†6‚ÖÖn¹\êË¡O÷w®}Ú;ðçÎãÐvüdÅ®íÇñ|wœ9óG˜¹›¹B±’¥Fón3ûùc¸š»Ž8É|sè× í ôç›ýÖí?o¾l>|],}ß·|×^,£(¶î®õëÝ×›Eì[›_>óôǯ /²`îž>oK× -¸óÆßßb;°6<¶¾¹w³ôyPþÚü6û°évÞí v™à¶ÿžýñ—3ßÛ9¶ŸÄóWh;¶ ÓÇìÛ_úÅl=ûW·Ïsþj ¥Ðí0ö/arØBÇ€`ºOŸ^lep’$²šS g‘Nû”¶ØZá€k}'ºúŒ?UÙ“=—½6ïÖé'¶)áS9|$TŸ6Ü@¬™þ[^î¡Ç«!GE» @z+z Ó¸hdm±µD"Ÿ?®þt\ŸöYËgi‰x–.¢—ÐqÓ¢ÍjÜ|Úæßåà!+à\ÀÄ©Íát0¸‚£!Sä ÿnKà_ÁÑìñPÈÈê¬ÄEå“LÕÕ‘;rPl~ƒæÈYq -ÎÊ7¹WûàMÈ)™“|â2ßaˆ_x‰Õ¦¯wyøîŵ^ðT5Qß ¬×ƒ­¼¨€ú.ÍKª³óˆ;ÊïÐñP— ‹ÆÍt‡cÏ S‚çÌ T¥…2n²´U:È - §{œvTWMuhy­§ôÍC:ï .Äg®Ú Îê%Sƒ¿+!À ·Å8i\‘Ï¿Çü±NùØØí„Šû5ÿ‚ꢸ:CÀeI”ØhIÐÔdú`TÕqÏq¦TòÇQT9ÐT±¼ýˆdÿtBG„Ωªù—F€Ë©åþÍ®Wzô[ïóé][Õg¦jØŠP­ò˃¶^d;à…í·N0°Zª\‡º‘ñb—òôuÍAOúÆKÀì.-Å “€ÆKM@}GÉï³L8Ú•ŸØ®çƒˆFCÞ1p5ïè:®8~·ëFC~®³²ã062T4ßøc×õlßõÞpüï„´Vcµ¸å)P€ƒãùfPz(BtÔÇqP4ŽwdɧÑнää“°ðƒÿîá}Cë oæ{/Néû1û8²ÔúŒê>gvâ…F<5ši<Ñ5a§T.•Õi¡ò£Îh3¶Ö ¨|ÇŽ`Žºr¡ˆ¿íN”ý:Ç×8s‡“F¡§¼»tLæ\ʘ -²ÉG&Í9§ë"2£ÕÊž+^‡ó‚Sͽ&òË V%¬(ÑÙg”ñþ2¡Ÿ؃7“~j4Óú©ˆ®é§‰a§ŸCŽ£ú©süTuª™INt[5ìÇع$t¼–Q?‘•OAâ%ÀÊìÝ4$BtÃ’ÇqH4ŽwEEw§B,’´™®xø"ÝæW[•§k p¨à’hŠ¬ñøNÚ™ÊÛôEø/·*F›?IûH–>–áªÌ4ñtëJæÌ7éý^"‹?ÊÉÍ¢(ˆ°Î ;™£!÷ñ£ÐŽœÄ(fZ<ŠèšxL ;ñ 9ŽŠGçx[gZHRÊM *(¨ë(tas¡ZEŸÖ»:Ç×NåC~Û+×5ãÕÓð¢«xöx 8Žã¥qüßðú‚ ²ÉÝ™5ì#z•"›ÄÊsíÐ5ßS4VBt+ëÇq¬4ŽwuŸ_(«[·é–¯œjX?ñÔWŽúh•èxs•L±<ù“vÙÉê]MŽi¹'–*‘âúE^(6¼JdM%Ÿ^ØkîÍ4ÖŠèÖ&†ÖCŽ£Xëï)ï’r×b†’´T¡%†K–ûÄwA®ká*¥¤‘¨æ ­"Ø9ük4Єè*h†=hŽã i?Ù±*D8$WªÒóÖÈ·R¾S¦ž)K1v´ORí쮌šŸh»[8®€.¢¬Ø‡æ:'Œ{í~Ë…a š¢õÅ>}¹<²VËðßEO`ˆZ^àØž™×Ó'DWg`Ø nÀq\pÇ›-ågoœ.ð›weÝ";²œ¤ -Í)WâNt»Ðâ§gEF¢mòÇrÙÝÓj)ôRTU¼ á¦áºæÔ@£1€,DWA60ìApYã89Hb±^›7ªR“0iÂÉôÔGÁK›X—!†++¢¸mvÄ2~’XìÞe±mS''9%n¤þ'jÐðk¾ïiRˆÒüy™õrº?\·|iå%Tö¾ÏŽ©”—Ç.Ñïèx¼Sô¡£jãhÝxc Ò6˜(j/pC­Ÿ™ä ÊòHˆqÈ6Æ€¸‰ƒ)<ü¾­Ã*»ªlxSæ­7ºÍôÕ—kgÙQŠÅšÆ¾|Bø½éÞ”‚H¤Æ5õbÏCÝÕ>ˆ<+ÛŸz¹gB‘Ê“–á±ßyÄ´|Ìþ°WŸ3S¥ƒ‘LüBAg”àgülÅDýk®í'!b[&?ÊÐkŽØ\l?Ñ”W)¹€]ìª#=™DÝûŸ—DÚKÅŠï-·åÕBªY÷¬A¿Uçò[~%ZrH¢÷y,Q˜ “^ƒðA"ÏYfê‹ÆåKÒ$zÈò¸ôƒƒ‡ª(XÃ`9Ud¡=©‡ QƒZý¡ƒÁCƒé„VPá€ÆĸýuY]ÛÒÁ5Z -`Ôo'岪…DÓ© - Ø¥7êþàŸ÷ý½8÷÷mߎý zÄ'µÄÉO‚á~ÕËôņÿµR,endstream +xÚÝY[oÜ6~Ÿ_13@‡¡Dê–7×N²î:¶7£Ú>ÐyFˆ.S‰®m ?~Ï…ºx¬¤ÁœEàˆ<")ò\¾óŽ7—ðÏ›Ç*™G±'TÏÓr&ç[xóaæ¹r®… |õãzöæ}Î=)™Ì×·4d½ùuqü¯£Ëõ»OË•Rj¡<±\EQ¼ø¸ô§>-cµXŸ^œóë÷Ÿ–~´¸€wYp¾^®¼…æÎ%ÈOŽ±­ë –]}üñh¥Xèü¾þiön=ÚåJ *Üæ³_—ó œä§™*‰ç÷ЖÂK’y9ÓV®_Ì®fÿéWáwzγ&”±Ò~(üJŠ8ÖSc<%d‚NcÚ›ÐØoÒ‹<ñpQ|¥GkzÁÄšï@76Cm6ЪLÁúkYôçÒYòEõ +6,Áv‹ÒŒ}”Úœ§ðû“¼Éh–­qõG–ÖÍ„OêÒä•8<ßÊ×ðzâ×¥¸cS9´îð{8¡)¿*á¹Å¾îd +œdÚÅðÿwû)?ïê’Œ¶}äèLSó6­{š;[¯ÒÎÞ4ÁXg.^ϲÉáeCóŸ›$‘B{¾3KòºÌrÿ»1û°Ô"E;acì«Ø7ü(@/0!EÇ'1Ž³»¬Âelž›×´‚†ES~vÑC7oñ€qñh7¾ŽD¨B·§¶¼Ù›¶½ßü°\~°°››Ö”®SlÌžz° +z;O\yˆ* [ö±ý£hŸ{Ö*EäGðŒ„ߢ2_N¨ì(M³4£Âpq\W¶!¯)Xp¹TÐÉ+ëüu¸ ÏD¤¿l±à›-Æ>¸sD‹Jlä–mǃ’”´N»&káÚ8a¾ŸàÆé…‡ËÔܼé>ƒ;ûö™†=©DâûÝ2~etáÈî–=·;Ó¸`Î-{{qËý¿:¸ÊÑm·<þ +š0eXàõuŒÏÚTßјª:Íà™; °YÉâI­\ŸŸþ2x#&À2oibAûêèKîÀlåR$£ñ8 æÙ€«HBœBñçµÍÞØè`È/YenFç¸DÕmþÀoÙ^gnGùóÑÙŸÚm=mÜ@Cþ‰^—q×;Šë»íÎQ;γ¾fŒ¼~oSf¡iGfÖØµå‘ Ië’ &«6]:t†Ëd0­»)Æ­V˜Ör«Ï¡mÝXñE„ÖŠPýEhásrJÞƒHü› d‰¢m3$ñ0€Sxtj§MÖË«ìÞ ¨èÀ-L…5<>Ãu OÆ/e–l‡4G„õ}{… aÓg6ÉÙ–2,ÊîwÝ'0àPÊO¡(o²mÎ>íx%¯>+˜jË1沪¥ŠzO²*Ó6/Ä\φ”¹£„á^17 ”â.¦¡1$/Cîñ?vBZÒXÉ[2´ó`Di6ýØ‘wÃŒóµ^Ñ@‹K>B½Pc+ˆ8ˆœ¢Ï×ÿn󭸼8ãÁOìù‹¼!>uÑû,kGËXH?fí4,íÀ‡1Ž8ðzÝ%é¦4•#J]…pxÜç1уhKøº°æòÀ–Ïò¡¡Rgß՘䂜IHü`n»Šc ˆaõý$ÏŸ—1¤뢇+´»ôôâÝÓoe¹±]\8 D}ŒâôƒÁë6s¸Æ‘ 4Òž›—MMÞ}‘©BÔ$~üªz‰¡cìmÝ3ÓUË)‚ÂŽŸ»Ü %#È ø Ü€ÓI1Zecœ‘—j ¦jcˆ&¡1šÚM3¼ôÙ¨‚Á¾uŸ4ü<ÈéÞ8º?Õ¦ìÝ|OðÚH=4Ó¿¾¼}Râ+—F\¹ëT> +ÓìšôQãÊS÷ÇÙº•®NOÚŽªræü8±÷0‡ö'Gë ,¡êÙÉTøy:±Š¾Æq¾É Ïê-?p±+bKJ·`yD ®“&òi¬…V/©“þMäƒô¾«Ö9ó8æ›9HºÇ!uóy9YºBi…˜/BÿC‘øÑì÷ì_ #ÛÝA@ûú;§°³_ÞœåÕÝ׸‡ï ø{²®Ýý:4’ñ%Ñ:l ·Å­jíCÞ£Ónñmʱ„É»È1ð NO÷“ +ÎFùîÑ•ëR +-õbÁuSd%y·dFò4ƒÊŽBt\GuW +œr¨èȳ*í)ò \ªÚ*³Žs ¡aÂg–›M_0ãóÖ6†K·¢WµLd·”×LÂûÜîøƒÃeJW«ŒÎ &<£Ì·»D’î ÝÄÖ"ãJO™Ë»”@yî6Co¨åäˆÙímÖ´ÝbYð© áï]§ƒ1‘TùïÜbÁä‚.eX‰›‰N_÷pÝ ·μÑâÏ|”)ûúo\’öعeÎç¸ÅØ ±OŠ©RËŦ)r¦‚˜¦'XEç‚‘‘ +^[é–MÝŽùBûÚ ÄØTïñ6 T1Eaµð{º{kRöW§Rhiú'òU)Ú7¾n†8Fúý±¡Õ©Á`¥âÁ§¦UK$nJwÌ÷ùèc•£nݽ¼>pÓ'©‡t7$ØöÿI©˜þbsC þ„FN(?8P)3%ûæI)ÊŠˆTs¨~$Q[|ßô|9´ +Ö$AÓNl}\"ëD;À§{Ó×È:a‰Ï³Œ£Kîá]’¡í1°Ut+­‚‡)û¢ï±›äà;\¶9žcü AïÞ Ý6uºldsºb‡ã†"ÜÐsÌÝDjscºU:ÅžáGOðÇAl¼_bm?TtÉfè©PÕ]ñµq8Œ7ÁIÏE{Lb*ÐGd“+O†@£éŸ8Ý®_öã¡Â¸×ÀW½VCYqXÑ€ †œò¿^Ìþendstream endobj -6803 0 obj << +7136 0 obj << /Type /Page -/Contents 6804 0 R -/Resources 6802 0 R +/Contents 7137 0 R +/Resources 7135 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6790 0 R +/Parent 7094 0 R >> endobj -6805 0 obj << -/D [6803 0 R /XYZ 85.039 781.388 null] +7138 0 obj << +/D [7136 0 R /XYZ 85.039 781.388 null] >> endobj -6802 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R >> +7135 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F58 3380 0 R /F20 3021 0 R /F35 3036 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6808 0 obj << -/Length 3626 +7141 0 obj << +/Length 1410 /Filter /FlateDecode >> stream -xÚ¥ÉrÜ6ö®¯PåDU¥9Ü—¹Ù’8±c­™9$9@Mv7Fl²Ã%ŠæëçmÑlÊ—©”Óð¼}ƒÂëþ ¯‹Ôâò:/B?.Šëíñ*¸ÞÃÊW¡@ldãÀ¼}¸úÛû4»¿ Êë‡Ý|Nê'i|ýPýêÝþøæþáÝ—›MÇ^ú7›â–®iêþû3ÐGµEÝy‚Õ 8ÁljwV7Ĥá@ÛÃà$ƒBÏK¿ip¢KÕ#.¾,h½˜ -¼Ú„(í’¨ß*@ -ÈHâqŸë- ©…“*Õóy¸h¦£’Ѩ{¸9¢’,5,0O€\ÕG¤U0êeO×ËåÃŒD²ŠîÞ¨¦kk±þOäAÝ£If¡G¦v`nàÆçn „{&ÊWoë‘×™ |†…¹7¯¶S¯aŽ@^xÁJ5Ìf.€0Œ þym0uSSñ’\"áú¿DGÅC&S–øÜsH& îðÔ^ÎÑÇSSižQˆŠîZŸ¹u2Rý¨·êñ’ jkÞ ûàØ"óZCO]¡V¹7vü;› Nd°¦}ØjGø[¯!A ùD›Á‘7t;Ù“s0ÊBUÿÂcV&æ|qÎykS ‰&3÷w·¨’<§„†ç@H5vÑaIJ!ƒ,¼§é„\Ì.ôÝš©+_úöî–„Ž×¢V¦‰÷™u6gýR¢F8üjeí€r¾|r8…î¡* ~'®Í…»M ¿>ñnD¦ºÝÈGŒ¬¿xã¡%u{sõš°@,›¨ <½ãßN´¿?–a7ÔΆ$k\E‡ÅvÉcôQQzïpÛ›{©‰E,º¶U¬o¸h'ˆ2Ó¥-#B„Q'ü¦«Ô±f$*B]=ªÁâŠË‚‚µ:Âs‡}ÉGcäi,¤üiµUL¡º€L+ä7Ê‚Ý#kŽËCê‚ÌûÐòºâãY›Ðpÿâyò<{ÕêAX‚P@:9¬s,‚ÙøÌi #K×íYA¶Äv<¨Bæ LÖ÷+ă²®ÀŽ2õô8X+Ùñ”å)f4ÊŒˆÖt4J·×xÕ4’ßP´ ]ÿøÞ -%løŠËŠÏ8*{€ g°:XàÆaÂ7Y ª`3jôH`64dró}Ù"x â"àŒñ€ÚïRzÉ¥A;7©¶î¦¡yáTN0µWÁÔ*VèIƒñÍ=Qî%ßóþ¦H<2ð8$ÿ‡±™¸Þ·<%¢§ƒd@ØúŒe˜l„ *ï#•8ßaëèy -(†ëzá:JèbMn`ŒF’‰ï%tæ±ë²g/ÃÅC»‚L}ìFù^ÚmI|Ê_Ħ&ÈM‡Äç…;þmˆ˜ý -C”#×I©Q"J£ -/ þ zLãFŠ5Ê6ÅóNŽ%N9U¸•LÏKR ÌÇvr/G`ø&Pel<Š5xá&ïê\ Y™aŠâ)QW_zEKL#Áf2r0ÌÖËjÌ Ij»e¥8L.j ‰v‹b|½_“$±Ÿeßl×Ì ¯¶“’0óÓ,Z´“"i'}•ô€r”,÷¾6‘z£æYFâç¤wÆ2ĸŒà/Ò‰¢Í/Ø‹z½ •„‰Ÿ$á·éša^mCÅEä'!GòÉú¡hVü~Qõ”d·JJÖ~²èÀ°\t‹ÙQ¥(‰ Õ–¢X÷g0Ïî#eP Ö5…“÷ým7ò¬Ó€AßIÑÆãg=¢:ÕÖä<Ö®¹®4‹$Š¼c'eŒ°üŸóÚ®Ù~%K`$`j°´ÈøëY$t»6‹õ þÚÄŽ&[¾gQèÉ'mîµ&@ÅË«Q1‡ÿn‘ Ú+¨{Ò 9c_)Ë‘ÍIÀnw׫aì'“ŒøÕ %ô¦qìÔ½8˜‹Ú Î\$áìbñö—¶ÃgjT˜Ðr®VöímˆÏÙ3à³nš•Üá’d3¤£xr ¬^5«ƒ‰IÆû¼˜`6²S\Ï´5íÔ^’}[7ÈŽ”s‹¹;e*kµØÏæÚM’¶m“J¸§qÅ6KaŽ|êDùfÊuþL3a¤maN“¬Ä@Ì|CpÛP·€Š•êýyº;*=<ñ×`˜¥¶&m‡Ù³ünt çNe’̺³Ò(¦Ä\¥oº&Û“œ$Û+b̺“|rG=šÌ!7]‹“–X_¶ƒä6ê‹S®°ÓÀI›Ð É’9oñƒš6øÄÔ å:ä,×uö°:Ú¦ôš -Úµ’!¡LL•±Ð@b@oVF˜›d ‡”_—ñ*Ùe|ÖŒ¥¶nè}¨œH^pr¶{áÓž­¦Œ—ÇÒı®´r€q7+["biØ›dáÛÚúSð`òº,‹ÝÚ·9 Õ/׉kP§ÙSˆŠ¼Û»ÍÜûùCáSþb–E}®Yy„p¡:vSfdw›F·Æa)ÖõäÙ§‘'ÓÑçç‰ûÆdIàY_¥;J¾+Í@ã<þ2-;êV›nÇtDö`ÿKº uëÔ{$ëÈûXÛÊ„‘¨ÌI+ºñ`"ÃíØÌ4“å­@så‘}ïð¬©D¢„¼5 s[u«šF *¹†1àïfIGõÈx‡×Ä_šnµC?–!ܾ¥“ç†|Ì fiÿ9]ÃaÄò;HƒñÕìujs;/|ÊYZO{%ÍuÃïVüÃÍNéV’V•ô¶sé·±aHK¸j4>ø­Îáô7:ó½8Ƕ‘3¬5ƒþ9Ø· ¬˜Öܳ}ç·»é4WpÉ?Y4®W\ðI1ÞIÝ.Þ¼3× -TÉ/k\ºŸŸ÷º©/;ÄèÓòþåõ{´ü¾ú¾™š¨uñbZ1GÿÔô›:¬ÀiSŒ¹³=hãÛè¡×æéœÎÀ¼Û$Ã5ê\Ʀñ -ßÙ.·fÅ{a€G=~'[ZžÙs;âijkµ¦àO~ª—lŸÄ¥ë×;mçò£éÑF`%å ˜¸iLZEî´dKòîmÚØ¢!\, ns’F~þ°ÝßQã(WçKfª7ŒLÌ3M¿Þ$g-ÿÐÖÜf±¡|öˆx”¿Þ[Å79Ô3ôÈUSÎÖQÇAvÔjn„ìò4ò nŒìÙ?ÀçòÁMÿ1Õƒ,uü˪!g\°Ï´Æf«Y!½—Tâ%Mm"0FXÇ`ôÙÂÌZ¸HæÐEEÄÅJM¡¿˜gµ\⦜¼RÕx1Ñ7ê®=³äsåÃÍYUo6ò³]c̯:ÏÛÜ(Ê=õË^¯u±X7- ø¨ægæiÑT‚Õ9ôX÷=%‹Ì~ ).»ãFJÖM -JùãùcÑáÝ 8L•–>ß⪈ãå'"ŽŽ½»Ž·I@]I»ûÚvjÈuÓËY”C¸êÎØøã¼ÉÜŒv!$¿páš“`n:SÅN¦MšK*üñcâ‚Ç>Ëßg$Þþû.éÜç%T»"õþÓ=ÊæÏ+H“LÏ”$?1í«ÅÇ%­h7KQFÎßSD¹é‘3VK 0ÈÑôm­ª3g³M7Ìžfº…ûQ³I ke„D~Guê´š%·ªçQÆoêÕ¿XyÆåH\—mȲ£´7Bþ¨¾o‚GÈ–wâha¦8™Èšª È‹¶…ljXÆ`ܳø+r\´°´Ô(rÄÖFm*:ÏiSPµ¼žìãªïGV\ï‚ — *…æÍ; ŸžàZ‹ÅÓ泋—³©b¢ø²x39[ly9ÕŽºùÏäÓ—ÐËá&o&a ÒÄ»‡uÈ4õê‰6*0Z¹}5™OþÜXažöXëSm’ ÞT…A’èC2&ÐLl‹Â€]Íá6±ó5üJQ,ËÏ¡ÔK$Æb¾ì‘nºúãw]»ê²ºgfù ðÀê×¬Í›Ë¢È TÌYòÇ>H‘¶t±ðWn›-·¥9àöÙ%¢èàxÑ‚÷´Ï†²oWHŽEN<ÀžCQ#ÙŠ d=¯ñnƒ[£  ð-Ы2ë?Eÿ½i™Àâc“’CYiÈ3­B±@ËtóþG)Ó¹ÅpãÝF䶊ö+³Šf…Ç5ñQ°lV,’³We_¶M?ZÄk ¼¹'8F5wÔuÖa cþݸR|s7&½rt ¤Óœ»ÇzD¸A^ôåª)º#ˆµ1"k0èFbz€K¼¹¡ÍsR™Hôe^Lé8È7E‹%Æy››¡ê=iÑ95ô­uœ¬A{C¹,× ìœÏ1©oËzLÝ’‚PC¥áf4¼ãàu9ì\Îpx]<±Üÿ¢ÄÊ[Tºï™ÖmÑÅÿ›éYëºlÊ~èÈ5`R)›eu›¾¾Ø¯‹MŠÙ0°Êªp.LåVyhy <S»o|«®þ«S,¹YŽŽŸUÁÕWJbñs¬ë_øSÈ qÙ2‡;뜅*Œ„‚ $ÌF•.Íò»³†¹†¿ˆuV»$DÂçЄoKŠ8–æ7¦&ü³ôǪîz”L½\h^Ü®ù¨¡å}dôDÞ6<ŽŒ†ž±¶Ï>*QlÄE¶D¨n(i¹Ý@|´ Ål½¦ÖV`Wˆ5Ä¡zàƒº§m• Ó.H·F[×[½¢gI +ÆÛ™®3Æ›‹4YÍÇóv,ºG¥¶±ŽõS•5ÔcÎ5CQƒ_3“/–uÙr(8ÜOD+y^ÑÂb“Ççq´Å`e¶HR-VØOÚÛu­YeÇ`&u*#@Ô³Û†À§õ0Ž5š‘Mòƒˆ”QõÃåë»2¿(ÈtÉóoLÖŠW]‹bMIEccÍ<6æ4C$`D¤vdÝÈ€ ü}l> Àp›l@›]á}cØëJ ¾Ýí˜R:Èá Jc mµ|:“„߶Ǖѯ³åXBô¸Ð;Äqk\ü(¦ã ä²!ëÇlMÏL,܉(MÄñ˜Š+`ø>Î@(»8I7a=T…`ÍF~m “ø¨ˆÞŠ&QxÉ}ɱ‚9sáãtk˜mªþ³fj‚(‰~cÔÛ!âvÒòÌѵÕO ]}ÁçMÕØrÝS„TU8YWE4~?D)ø ã G÷ˆEgTº.â.ä›cÑJEquÒóñ¬å-͋æ½îDÂ*ø&Ñô±&Ïì›gü¼d/d¤Jƒx»7qsìøk…¡‚rÃDo|(òQ § +‘kÊ྿ǢqLTŽDî¾YrR×?#EVÑЭ0}^Xî©nÆÜjÕØØ©¸)IažS‰Q®ÃÞªŽWøùœ5ÙŠ‡|i^ JwøF†xCUqöñÃœ*àQ[Ad•‡_h•úð·¾Ì~ï+ZaãÙ yO"§¥ÙwTÆŠõn4þU»ÕXendstream endobj -6807 0 obj << +7140 0 obj << /Type /Page -/Contents 6808 0 R -/Resources 6806 0 R +/Contents 7141 0 R +/Resources 7139 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6790 0 R ->> endobj -6809 0 obj << -/D [6807 0 R /XYZ 85.039 781.388 null] +/Parent 7143 0 R >> endobj -2538 0 obj << -/D [6807 0 R /XYZ 85.039 761.463 null] ->> endobj -6810 0 obj << -/D [6807 0 R /XYZ 85.039 741.337 null] ->> endobj -2542 0 obj << -/D [6807 0 R /XYZ 85.039 443.66 null] ->> endobj -6811 0 obj << -/D [6807 0 R /XYZ 85.039 407.395 null] +7142 0 obj << +/D [7140 0 R /XYZ 85.039 781.388 null] >> endobj -6806 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +7139 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6814 0 obj << -/Length 2713 -/Filter /FlateDecode ->> -stream -xÚ¥ÙnÛHòÝ_¡·¡Ãfóh.°±x=;ÞX‹Á`f‰–ˆP¢–¤ìäï·®n¶¬c†Á>ª«ªë®–šDð§&& #]Lr£BmÌd¾¾ˆ&Kع½P1©s5»x÷1Í&* -‹¨˜ÌžGÌçŽ'à²@¶ÿ{ñÇ_ÑdWüå" -ua&¯0ŽBÛë à;L-óæâéâßï%>uLJbªŠ°ˆÓó’ÌT˜dÚI2ŽŽH2Â4JH’ <Ÿ -@þ Å4)‚Oí²ÝÀݳ´í8 -Ötl4sׯjÜT…Ó#J²v˜ ©7x™¶[—dš´Í®gK:Vžd‚RP“ÝîЮe¹#ÞÈþp^ò§7†á¾)Ó’CS£U-˜€UúO×ÒÛÁz ÕFõ A¶dx%Yj58§&Þ16¬*‰ÿfŸ>ßbBx`ˆ~^~ÌŸZº[éë¡êyxÌ6pÇ0%øŽâãå¸WhxÚïæ¨ËÏJ -¯ï>f±•Éô¦™oõ÷~(»áö"h’…I‘ œå‚Ýb(¿6(u h°“3?…oÀhµÖ*b×û÷ªî¥Æ‹·¶CX*‚ü&1Ep·!áMc„‘É÷”ÈþA/. ˜”V.8û;`â4Y—ÜkݯxDBƒïB¾%–-Ùk»lè-Yœc¾—ãlñ<sŒ ïܶ°=ð.©•54gÑõŒy_Lt¯­^›°mQ+ cçMÙý ¢‹”»âoãusÊY‚×µêÉÄ`³,{ÛûÏÙ€a@ÚÑY´ÏrÂ: -¬Ý;NèBžùžxøÛ†î Ä_›j±¬¾–½ …[ÔóF&¿^)S¨(µ¤K9¾°6_Š4æk=¬ŽøïªÅÛ¿ŠûI^.~½$÷§q}¶ûŽËffhû®~08ÙPÓðM9‰¥ØŸSîH±ãZo-jª_j,Ðâ,âÒ³á­SÂñr,F)XhGž·£&Ž°Û÷víú¡âG“Õ¼9è5^‰ˆLü@C; cÃâ>\< UX ·¹èC=©„/ cŒƒi< ™ ½;öe¯`äž\ -DÚxÄR:—9ȳΠÆ!œ™¿c|„9!ÄC9ÁcfsK‰Ò”f M¦æ`4ŒÅúÚ&RÔ‚+í÷jõ^^}œâ&'WÊs†d?É•bl§ô¥ -êüCµC×N”ß®GPÂGÚ!Â{CöÎßÒSQtà3-ÌÅ=A+‡ZÅ{G›¤®Ú¤àYÖWLÆ5µò—¶ð¦LîU'7zÍ®þq(z»!(ü‡ÔŸ±%NG¯—¹dÁ¦ž×ö¹éH÷ŠAxýB&Åcê· ©Æ~«pB›¹ -:_‡x0g´)@«Í3Gm¾¡x\›Åý 'Ì#ÐÇPÁcX%ÚÐëNé €}µn4¬xÁ½NS·#1"]•.[áËEáW¬÷Î{8F7ÇxTDÁ5=:ã©¥{}7¶²´øFá¼Ý< ½^½ë?ß=ïèiÇ5W.¬á“¾Ä’§W”ÿ®Cy.¨þO­‰MŸ´¸æ‡¨Á¾)üSžÛPÚ¢ÄÓ öoq®!Fô¼5ƳÜ@­ i}ŽuÚÀ ÷µDÞK¸À&=Ìrh†]èÿâ˜æüFéä„ ƒFæüï=Ì¡AAT€Äîð ß*<Ó8cey¡Z©ÈÞòKÏnF2ü?ê¹D–endstream +7146 0 obj << +/Length 2479 +/Filter /FlateDecode +>> +stream +xÚ¥YKã6¾÷¯ÐQÚQ¤^Ç$$ÀØm/æÍAm³mmëá‘èñtŸzQ–ÚîF€`€6EV‹Åª¯ª8*ˆáŸ +Š4Šuä…ŠtQÛö.ö°òÓ +“ê(5Æ7×~u%Qlò[4q°ÖEdÒ ?mî>|Nâ ‰£,ÓÁ扈6»ßBD«ušÆá×U™„ñÏfµÖYþÉ?›Ãj­B‹YøPµÏYi˜~件îê• +G7T®î»Õï›_G&΃ub¢~q¿ÍªTaLqØ7Ht÷ãf®³Þ>P +òòé<* T Ôåü<›ƒ@פˆÃÊZ<@Õ­’"|™¼„¾­ÒAñÚ"•L÷ǺùÿŽ(E…ƒÝWÃg»=Ëuðq=N#ñ?ÁÔ©A.ú…·b¹`d¥ÐÊ…7sþÚ‹–•sÄ40í¡G…ϼxÀ­YµÎ’mÁ +œ ¥S»¡ž¶Û‚‰Q·ž‡G´IˆêŸ¶VHÌÃ4 œ O^ÔÖábnñƒLñ¿X™ý åñ%ƒ‹•¡cÙ}s¿Z›Ø„µ° – ªu¢V%<ý#z]øK²…­„¿seØþ²}Õ0«hÎY0a¦Ò¥YçÖ1%™§rcàÚùgR? °Cåxá\72W57?.|AÉöqýˆJÐÞvÇ+Û¾C£Àüþ„FY‘ª´„ÇAY3(ê±ms°ÁϲÛA„ˆ¾Ê+ð]ôR­¶×õ\dšæxã¤x4›popØ?Iwž\('ѹ¿žê-îóܼ¬ +ÞãEÁe®øz€ë€Ê +;:ûÝ­ÙÝX»úNZ¡iIÒÉYà×V[T怺ø¬ç!¬.à6%Çö1‚ž˜p릌ŠÒÝ‘¢·"W³Î ½Ñ@è1Q +œs;ŠPø[½³x®, Ÿú*l{Â2×{^&÷„Õí ™ËFàµÑUξ"ë»îI-¢LâNJpI|õÎ +F&¢sü žÈªæáYôœÄ:vQôåáy}†“Üp‰=—Öàøùn!L›7„1Ëqr÷ñŒ<¤õŽ×<¨ÂŸ=ñ·ôŒÝ@ö"‹ô›Èž”vžª”‰´É^¥*…É +‚àó +ò‡­Üi˜0’“Ø.?ÙÎ’ƒã±F¯Ë­ ™ƒO©÷3Ê\Ö:Í OtZP8ÁçSµ­›ÚIâ A+†/RÕŒa8guLA^â)-¯ÎbU$§š@.Uî­Âu[ÕSÙïìd'Wa7öj_BÙª‘E¼CŠª,™‡_™E‰¾ó +®¸r7‚/)¢TgBÇO3´ÅšüÃò})PúgÂq¡Go1Ov—¬^†ug½WŠó=O tãi‘)HúwÅþH)#BÔLÉ´–ë˜Wž™š$FOƒ/ðÒ°xðŸŸÞóëc6…¯wȲ(ÎÔíJNGó]d\’ÃI¬b^mÆHN"Ø"ŠËò–×&-'ŸKïpÂÛy?`bM phÙ§+žâäß²¥¡ø`‘@™~¢0©²§9V4ÉJÆ¡j'½ù¶D^¡¯>zŸðÝTŠe˜¶P^d»ƒ—+¡ˆFâÑšj`Ÿ‡fÕƒ/H—ÈH1¨ÓE‚Ædüß®©Ÿ}2Ó™¯¥¨dyŠ€oÇcÜÜÐÎÞ(ÊPœ‚ti‡Žj˜¦L=ßüž©ÐSñîÔq€ªöû6„ÐÄ‹Ä7ªp\ +Ýq6B†ñÆÁŸ»)  ç&ÉE þ<Ò¹¹u¢CNÝtvÆ|Š®ø +"ô:Á"¿/÷;ÚkMð-™Ã_rª&€ï`©ŒH|Š†ÁTGÐ×Ûêõáo [õpÉÖ Ò•Îí ´TÐJåI!ÚVÝ-¨Ì#•–S²·,ÔçÉ‚k —ASR(+“GE‘/bYz(nUdüfæN žÄ~ Ãcôaö臑WÏ>•ôüýHÎm›Ú^¬®fI Hjÿ+"*¦Ù÷>t©»`’ ¦*žp²Íy¨É-aHj½øw¶YÞŽåMAÍ·Ô­o•º¾)5U“ó쨩1ïö-À„“ÍÔ6QóR^øñöÉß`̽^‹é2F ¹<œýþMÃÕt/‹x…1¸'£Ÿn*¶¦J”œzlu’ô*Ô€q7Á“C׶êzj± +1w/^dâxÖ–W£@ñ+Ø`BZËÜÔVãÇ”¸[Ap°#p@è¶hdè׆ʷΠ/2Íc Åt?d”Øî6"ÜDЫf!×gfTqT^w{:ø=:d9ÊZú‘4y}·IfØuG‹Å®™Þüþ¥ˆ²R ÝÌ I¸è¶«ÇgQÍBêRwJ#$²}pDjõ£<Ö ¬÷R¯æ E˜“¨4RF-¬ÇY«Hð ÃM–x†ñ¡óB??FOuj„ýÕm`M[”ˆl¼,uü©‘vÒd¯BE©I懿_ŒêSAÂy*<£_YZÆã'• ýtq]w‚›ZÊžno©<“ê Qæ(ÍàìîžIùòêÑ׬“„Ñ¿ÀªÏ8´*Qríi‰I£$ù[²)³kOãÌ uûG¼®]íø±‹{ÍÄQûR–o Z7(ùÕ²ä÷§ÕóÓr9ÛùGI\ºÍº›~ñF't’ |}˜œk`?ºê3×*×Q¢´8u©çE÷Õ3ª‚$[à3ªŠÖ‘ôëÝo¿ÇÁH¹‹a²Î0ŽAR´wšR þnîîþ=ï&Ëœìþ–bŠA „z)%t`д˜z‚ÌJE%úå¥'øµçH¹ÑÑàC)(¦_ŦKÐêlLz^˜hâÃÏ­ +~èA£à¢”†)Í‚xn¸U)n´*Ÿì}„F‡§‘^Kqø@h ª÷O!ßè†ú8ëEœ}b¬¤g¨vö:ã|ŸÎúÎO'f@.yÝÁÛϪo–GÇ5ÛúWPM¹„+TÊ#Lâ37Lu}·ÞÙ§Š¬ â¦|@©YOé G—êHr»0Û?‚-¨ùAV ØÅaûd%ÐéSKñîƒQÙÕ3‡6!¯þ?Éÿþ1ÎlØendstream endobj -6813 0 obj << +7145 0 obj << /Type /Page -/Contents 6814 0 R -/Resources 6812 0 R +/Contents 7146 0 R +/Resources 7144 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6790 0 R ->> endobj -6815 0 obj << -/D [6813 0 R /XYZ 85.039 781.388 null] ->> endobj -2546 0 obj << -/D [6813 0 R /XYZ 85.039 761.463 null] ->> endobj -6816 0 obj << -/D [6813 0 R /XYZ 85.039 741.337 null] ->> endobj -2550 0 obj << -/D [6813 0 R /XYZ 85.039 563.482 null] ->> endobj -6817 0 obj << -/D [6813 0 R /XYZ 85.039 528.732 null] +/Parent 7143 0 R +/Annots [ 7149 0 R ] >> endobj -2554 0 obj << -/D [6813 0 R /XYZ 85.039 419.229 null] +7149 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [333.286 435.272 401.339 446.962] +/Subtype /Link +/A << /S /GoTo /D (xinetd) >> >> endobj -6818 0 obj << -/D [6813 0 R /XYZ 85.039 385.085 null] +7147 0 obj << +/D [7145 0 R /XYZ 85.039 781.388 null] >> endobj -2558 0 obj << -/D [6813 0 R /XYZ 85.039 288.524 null] +2606 0 obj << +/D [7145 0 R /XYZ 85.039 761.463 null] >> endobj -6819 0 obj << -/D [6813 0 R /XYZ 85.039 253.779 null] +3226 0 obj << +/D [7145 0 R /XYZ 85.039 632.606 null] >> endobj -6820 0 obj << -/D [6813 0 R /XYZ 85.039 128.183 null] +2610 0 obj << +/D [7145 0 R /XYZ 85.039 519.201 null] >> endobj -6821 0 obj << -/D [6813 0 R /XYZ 85.039 98.963 null] +7148 0 obj << +/D [7145 0 R /XYZ 85.039 479.037 null] >> endobj -6812 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R /F58 3360 0 R /F41 2994 0 R /F64 4112 0 R >> +7144 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F62 4159 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6824 0 obj << -/Length 2269 +7153 0 obj << +/Length 2477 /Filter /FlateDecode >> stream -xÚÍYûoëÄþ½E!9ÙîË/t¨œåÒöpš -$à7vCÛ¡§ÿýÙÙµ‡]t›+]ŽDö1Þ™ýöÛÙ™©qø'F‘ϸŠGa$˜Š¢ÑluÆGs˜y&¬ÄÄŠL:2ßMÏÎßùÁHpóx4}h×ñ™öÕhšþê½þþâÃôíÇñD)å)ÁÆ“0Œ¼«±ð.ß¼GÊ›^Þ\Óô»cz70wE×ÓñDxš:`üÍklkozCc·Wß]L Zߧ?œ½6–76•1šý×Ù¯¿óQ -[üáŒ3G£Ghs&`zuv3_+Û_žÝžýÔ,EszD_CÉILgQ¤‡‘ô9ó¹n~É8b*T#'ƒHJ¶¿5ÁùѨ³Ò6'3¬NÉ”;úÖYM —›ñÎeF(ÿQä€óš¦&x>·î°t÷ˆ&ð«#ï ŒÝ\]_\½ÅqIŸÜÑ'é*_Ã|^á`]B3©‹òËMR™‘Ç´ï4¥bšÃø¶2ýøZܯêÇw@[‹ïºߎ¾|ÿû—¬pû„¦Ìž‡úŽ~“ѼªKÄz_ºuhÕ‹hLñpÑŽL/¢Nw¨{ÒÖ :¨Î!ÚÕG8¦÷æ'Ãý" yÝðÇ‹Ü:AÌ$[de&¡#IÁD š•Ð¢ä7î‹•è„!•Væ•*Ø1U^ufiAûNó”õаs[hFdeE#«|¤! á}ÛG-™Ã,iDúIB"h®ßÏ‘~U-Et5'Û*».Æ2òÐ1©Ð݈|n|Y@ûNf(± ‘â$[àBïîúòjÍËQÜTV¨ _|³h&‹íÆýõ^á!8‘í^Ö$½JPïucg[Ã`í’ìrªfŦù -FàFK€èÏñ¡Î>Ù @Ÿ› n5ÃuKôæ+aF’%Œ,íõ1.< -ã½Û03BP½Ïß©.ô`€ÚkùÅgç÷ùúü>©GìûþO|é{ÿβ µÌVL+q¿ôS-²åÒ6geŽvcû|5¶õ&¶Ël‚ØY2dm£‘æßåeU;-Dl?6þ\v0-VInÛóeqŸXäÀæêƹ7«ÄnlU¤ùõ׵™{õù›ÎâæE¬>§Îv"™u˜‰®&ÿEŠÞo³ª>¢¨¸/Ò§nè®s f‹£ýGs]<îl±µ$M³ô´‡Kîo C>3#ÛÕ HlàÿYI¤0éU¤!DSºÿ²áBX_l•ý÷–»Å†M×HÇðôum‡`p†î&o<ðÁ‚ñHÆÐPŒc ±©2¾øÐu|¢SC#ÚàIE;KÀb`Fà…$]²¹óý@lc/½Ï{½ÕuŠCß³|Ç" MµgùÏc fBžÞ¦ËƱ¯6˶ˆbÜ;>H±÷7J×PVôfÃ'y½  úú†¾0•¸¼Ÿ@§Øôâÿ/Ê\¯žè;f -OÂÏ8TŽ®v‡ðɾ´KŸ‚/C†ª@‚?V;†òeÙö!KêméÒê«nhàÂÓ#¡dnyE1ÊÊöL”4Y¦dhW4Õáeö)¯©ÔG©Sàò?ðI§zˆ48ì^¤™äprÐrIö7Ïy¤!Š5ºNÁ°]Ãw ŠÁ  Cê~Û‰Y…w~Ù¡€ifÄ=—1€Ï¹º»v\×,YZþ<6¾ÊTúº„,ÿ&¼OŽÇYZAN¢µï½.‹Ê–‹S'f\ZY¯lºe.€)"îŠÍòÖ/â'ea’¯] -ƒíýhg›¥‘16ø*ë¼jï]ž¢²ÁyÒܲ¤ê½'8ÄS_Ébÿh|‹Å1XM¼\pK b„TLFz'U…÷KXMj¼Œma€2Uáá_t}Ÿ{7Éz¯ç˜°†ÞC1VpÌÔ¹ÝÎfYÕ—¹B°å?óÇÒV¤7oGÚ÷Xu˜‡XN`r5G3âcrˆ¹Nšª&·E>s /Žcᓯ\j[·¾­`+'þgëûÚ$‰¸–LÚl iÒaì`:ŒÂ§&‹¦òG³|“]ý6IîäH«zKœÉø8ÑžyæÿÑšÓ‚Ä&R=³ò±$"œ-ÆÜ8Ü·×Wœ·:4ø?”©fendstream +xÚ¥YYÛF~Ÿ_!`_(Àä°yÓ/ÁxcÇ8q6Vb,¼~ ÄÖˆZ’Y‹`ûÖÕ)q £î®êîꪯ.Z-\ø§Iè¸~ºˆåøI²ØT7îâ(?Ü(ápãF!’^­nnß„ÑB¹NꦋՖXVù'ëïoï~Y½þuiû¾oùž³´ã8±>,•õq©”²î–‰o­˜üÿÀLYo_ó9ï~zu‡³÷X¯_ñøî{˜ütÿóý‡Õ¯|ÊýûŸG'¼òûwËÏ«o^¯FBÛD>Jýï›OŸÝEûñÆuü4Yaì:*MÕMúNø2/o>Üüc8…iÁ‚wÍèÆ6¶JÔ çõg£¾ÂtРËãÑXƒ 4T[¤Öø®CËuYÔºƒçF‘•Õ9bxwª,½ÙÕÅx²RV‹}7£ωÓgÄòCl3ˆ¥ÂîvEdžè4Šµé‹¦æ… %¬pQ8ú†5J˜x‰µYŸG¡ï4r7¶0xœßêžN ­5ì-½+𴜙v0l–°|äùÀ«ÊåÄ Y“ÚPr=•õˆ¬ Éñâ+»A¯dH°vHz9ŸT5­6OØåà°–^ó‚ɆøÖ®A…yb„èšòiy–ò¾ÆI¯[Ü—‘ÂÑÌÅ2£|ßêû=)¨i{^ÙãµÍº„º¼êð¯3 ¬ìGπ ?Ž&XU€Þð«ÊRØе~_ú.âPYEžõšñøáã2õÀ.€Õ¯ÜCÍxQVŸ•%¼ Zç08*ðÿ £p¥—±ÛΔõ/Wm×3©ëõžGýŽ´*Ë»ÍUæ¼e 1ft^=¡m ,Â’õ=ëzßããëfE»"yÓÔ(ăAmáB2Y¨ç=4>-eÐëŠùð:¢@œ{çWxl Úx•ŠëYäÀðKhƒß â{§éçQHF'ÄßO÷u‡ÆÒ9X;0a70ƒO“Ç7‰¯Q|$er~‹†~*(VÁ\ [0Чâu ÅÎã&ƒÃà㌓à(ºš,S<i'HI=ïø*4Äx…J­¼èXª5.¢¶:!4ü[7=(±U@ ¼vxpu-z cŒnQ¦CÙÃ{‚Àåµ',ä$å7‡‡Ýhª ÃI(“ç\Qâ=¯gõ¬|pÛºÔ3:XãÞ:kOCá³@ÂtÏÑW3GYçA¢€™¬•Ñ}„uÊÜ\Ò’‰Q“xOê^Ãà`œžxØÖy‘9Fb/v\ȶ(ñÇA胡AaÜÔŠ÷2)$‡£d].œÕ‡I±ybRÏÊÅ!Ž’ÈWô˜éTbý“òýA^“É;³îQÌ–:1” c«©¨¿vÜM ß Èzû›]õÙ…!Fíe@®1gŒ•¤N¨¢¿Øx˜¢“FìÑYç’§í©¿ŽÛïD>‡ämÛäÍËÿ‚n¼ÐúÿtG|0Žìï®+íߺ쎿àüôþü +Çq>Ó@_Æz´³rª6Fvv¿­ûb#Ÿï‚Èß3‘y/9p «ç\W Ϫ&×T,sË$÷Ž‚×[pfEs€-^>+áwƒ„;Ú¤C´kŽ¼ÞÓÿàh7Zé5r­(Û>ÁVaºø,¨¯O¼i Ζ‡ÂtqÔå'ìÐsâg>aËþ¿ÿùñcÈÒƒ2¾Z1ƒN.%T‘ãGˆÊ‘€ÿ¸QµÛendstream endobj -6823 0 obj << +7152 0 obj << /Type /Page -/Contents 6824 0 R -/Resources 6822 0 R +/Contents 7153 0 R +/Resources 7151 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6837 0 R ->> endobj -6825 0 obj << -/D [6823 0 R /XYZ 85.039 781.388 null] ->> endobj -6826 0 obj << -/D [6823 0 R /XYZ 85.039 761.463 null] ->> endobj -6827 0 obj << -/D [6823 0 R /XYZ 85.039 748.383 null] ->> endobj -6828 0 obj << -/D [6823 0 R /XYZ 85.039 721.284 null] +/Parent 7143 0 R >> endobj -6829 0 obj << -/D [6823 0 R /XYZ 85.039 694.186 null] ->> endobj -6830 0 obj << -/D [6823 0 R /XYZ 85.039 666.482 null] ->> endobj -6831 0 obj << -/D [6823 0 R /XYZ 85.039 421.205 null] ->> endobj -6832 0 obj << -/D [6823 0 R /XYZ 85.039 391.985 null] +7154 0 obj << +/D [7152 0 R /XYZ 85.039 781.388 null] >> endobj -2562 0 obj << -/D [6823 0 R /XYZ 85.039 322.225 null] +2614 0 obj << +/D [7152 0 R /XYZ 85.039 761.463 null] >> endobj -6833 0 obj << -/D [6823 0 R /XYZ 85.039 279.272 null] +7155 0 obj << +/D [7152 0 R /XYZ 85.039 736.911 null] >> endobj -6834 0 obj << -/D [6823 0 R /XYZ 85.039 226.407 null] +2618 0 obj << +/D [7152 0 R /XYZ 85.039 681.667 null] >> endobj -6835 0 obj << -/D [6823 0 R /XYZ 285.909 232.38 null] +7156 0 obj << +/D [7152 0 R /XYZ 85.039 649.246 null] >> endobj -2566 0 obj << -/D [6823 0 R /XYZ 85.039 123.284 null] +2622 0 obj << +/D [7152 0 R /XYZ 85.039 442.171 null] >> endobj -6836 0 obj << -/D [6823 0 R /XYZ 85.039 88.538 null] +7157 0 obj << +/D [7152 0 R /XYZ 85.039 408.027 null] >> endobj -6822 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R /F62 4047 0 R /F38 2997 0 R >> +7151 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6840 0 obj << -/Length 3110 +7160 0 obj << +/Length 1734 /Filter /FlateDecode >> stream -xÚÍ[YoÛH~÷¯Ð£Œ˜>yäÍq2Yb'+Øfæ–h›°$jH*ŽÿýVŸlÝZÌj €%‘EÖÑu|UÝÁ3ÿð,å¢Ù,IqDÓt¶Þ] Ù#Üùx5ÅR“,šw«‹7¿òx†Q”¡l¶zèÞÃ#Æélµù}~õË/«_KJéœâh±L’t~³Àóë_/)¯®?ߪۿ~]dþîݨ ·«ÅÏ™úñ®¿¿ßÙ|õY]»»¼yw¹¤ê¢&øsõÛŇ••ÜÊRfBì¿.~ÿÍ6 âo(¢Y:{ï(Âp{wrGœQý{{qwñOû*uÍÔSSV2KŠ¢4eaKrqĬ%v,‰Ž¢3C$LùÂÉP;Œâ(åéÌyÙˆ¡¡qÄÜåˆID1éq¼+Á¤;±ø²-”¯ªý‚¤óïâOQ7%ü”‹ñ⨭Ú|«~ÖÅa Oåkñ|!ßRÈ[ ľe"ôŽÃ†ëh†ÓD' `ØnÀqÚpÇo‡ÇZè¾)6Ê=› SˆÛø¢ÍG¤ù¤­ª£0¶~ð~±„˜Ð–¯ö…ºZ=¨ÏR´x¬óV¼Ï¶³8¢( ÚÖ¡ñÛÖ²mˆ¡µíã¤m]ŽW•ã‘­¶ÌWiÔ \“_šòÑqÊuµ;(RxH^Õ­}ñ¢nªíq`¾X=" •‘Œb,9߈pØ—»²Ñ\7•0ÿË~)W²…»µd’Xåê~«¼¿1+ -ϼ¾õ-#|"s84EÒD')À°[¤ÇéEr8®DfÏŸµ»K#AŠx]J)·Uöhm’)|6AY„ÒpRph6ÑD'm`ØÙdÀqÚ&ÇKýU¹1õŒdó|_®=Zs¨´Ù‰jìÐøµ6D§´1´Z9Njír”žPè‘Š_~ú¤¾äòjsܤTûÆg -ΠœfaSt4Sh¢“¦0ìL1à8m -‡ãØ2Õ›‚YmEvZÚК,R©j"ƒä›ùñ|m2ÚQd¾rÿ¨î½U‰GžmbRõAÞÞ¨Â\ ªW{:$= @“#>†OI–høDð‰ŽàÛ£SVŘEYL ÔF<éÞðÓ®A™|áª9í^Ó­ƒ¡2Dj²xžßK<“2J‰Ð{°‚<ŽXœ/ñÈ(]“˜F˜&3‡ùXBM3’°Çgø&Áî6oºšÈº¯Ë}û¤ -Ü -“PB‘â‚ ¯Êµ*‰C à•˜) FšPÆÀ@“˜D "!ZýÙŒC—Àøÿ·…¿ˆ»~Ô.BðõMS÷ßÒ%D¢˜z¼$bÏ8„vœì«`ÆvT•8#ंڼðï gÞ”.f½8é‰ç"Ì|IF#h²Î"ŸyWP¾ -?eqO¾¯Å2ðI0"€±a¢Å$P‚Ï"$FŒÂCöPiçgò:–¦QœOèc%8›± Š)x{ã &:?6ƒ°+€šëóúlÐ%À3ëŠ[«' ÎEþ?ÖEãsdGÆ3xrPc–a½]eY¬ó½éˆd×h€ýíŠÔQ©±Q×Ûj€æeÒs‹¬±ÒÄ<‘sƒØÐ $c" ³žAÞ²°—¶yë Ÿ³HÚŸô,ñÃÏ> ‹Ê|áÃ"ŒÁ™’€ˆÂXwG‰‹Ú9¹•ÙIÈQÛöZæàj îzF_”t‚#JBjÆðpÌÒžš7ùÑH.¼ØõhGÜäÛ²UXÐ,çP¨ –B)‚wpÖSèzcÝC·s+W¤ØèÕ{¨ê· ˆC&ŠÿG• À+­~)3óлu¾Íï…þ£›l~gréú(–ÜPóôå÷çy¹5ï—ÓW9õ†ã9løSã@ Ç<¨= Ë"BjÐíìEÝEã”Ì%.—“mÚeŠz¦âÁn¾ùb˜åÖ…@ÐjÉÍt4_·:übÞ]˜)¨ÄŽý ¬º@]EEO´íZˆ²NÇçÍ‹¸Ÿk¼S'÷¬m~è,uŽü²;gp“ãžáÇØ!“piŽØejóÇÁi«v.L¨!7;ÊûÜfc¿ƒBêU-Ç'ûS9æ F‰#’·ÿdEÈ5˜ùÃMoÃg äŒ7¼hšE1êvâÜÅ wNâPòn"¶9"X8ø³ä‰‘Æ=„¤ŠÈ8™_ïrܽ+ö­i¸áòÕS%²áºðmÎѸzvùÕfÀ–1IÉ$E’E<¯§@á=m†çŠ ,åŒ@ÍLW«9€DÎ"¼¹Ï×ÏêN±ßLläà©&6rÍHÊÁFN,½ÏÓuÙ'×éé8¨æ¹> -"Cò€IYùÌüêèæL½Ê‰©è«æ_"¸÷"LÍåî$É’ÅžÍM³tˆ&vV —;«†È»³*NDñ4ÌQÓŒ8öwVÅnƒ#»àø¯Ræ¹{¹+ºéò¹2¤(æïÙÙ‚]Þjs挽!ýГu¹:µÆ–žÁ'΢,æ'LÙL©‰Nš2ÄÑšrÀqÚ”Çsõ-á–R÷¸ÒУ/mmÖíOY«áv+÷§_‡¶wÎû½¯d5ò™Êe''ÌÝÌ­‰Nš;ÄÑš{ÀqÚÜÇ+› L|P i(E–É=@‡A¸ÀPy|iª¼,Í»ÂÒD¢„°ž´»ç§jgZ•ud–[OÌôrUµ\Ò›.ÚÔäñ)‘µêF·Ê J¢Ï[‘¿“<-²(E‘v©Ó7O–É2?[$$3ˆ7ab(E :áv‘ßí Ñ)· r4n7ä8év.ÇF¡òƒ—7/ƒžÅÒÞ7½Ó&[q-?ô/ÊÅymþÚ6cwÕeó0J¬ü·òYù×k9§§q,:ú¶–þ·U¾,¨8ò°o›ñf©Ü- -Ȥà -šÆ „ÁHÞÞêG±X5Gà©Õ%„œfihFÓÄDÊårü¼Ÿ½Ø“í™dƒ«¢g«[‚¥ÉCöÑxÜ>r)–ûêS㠘Ө؉ K Es2.ìlXôÙMGEÇnÊlbCÝ9û,Möj2O[è]ñí¾Ý^ÿÛäs¹¿QïJhê icNô°‚™ø6 Z0£R¥ša@é,;R‘<‘<®Š2ÕÞV­icmuù Kù½£Éy±)5ÐQ«+^ù©± CÑÈ·MåóŒ$ ³£ñ{†¦9å!vÆ3ì&=Ãa·z’'yO“ر1E燼ÎwE뎭ƒ0±4æp¼ÂN»]Wt̘RÓ?T÷}h»Ó’fc wÏ7Ôj‡FªÖ“ˆ9ŠæÁ<Ü‘xÓ°&Q‰VÊÖe¡Ó±€Ü;qé±îJ>ô]• ®Õ÷u]Øëê̆ Ø«íW}{ܤ%\Ÿ€ò©!îs_êÿ÷%#û™;£Q–¥®Ž“‰[c§€A É]ÏÉ(bR&‡Ý·.{|¬%ª>ؓ©±µŠ>Ó›²5àYš—Àç'ÙôØâÄàð¿[8ƒ|ÿæ ‡¢F°‘EÎ%²t4X£)ø$ üÁ”uÜendstream +xÚ­XmoÛ6þî_al_h ¢IQ¯:,i“6EštÛbèúA±i[«,y’7C±ß¾;%˶ÒØP´&yÇ»#ï¹ç¨Ê¡€?rù\¨xF’«(NW1\€äÅ@Z 1ô¸|Mã ?JÁc's£2™}dÏ^ž¾™œ¿9J)¦\>rÂ0b·#É>Œ¤”ìt)6!ñWú™d/Ïi‚š§¯ÏNqæáv~FãÓç0y}y}y;yKV.o®;n@|s5ú4y58Ÿt‚v<î +£þkðñ“Îà`¯‚«8na,¸ŒãájàùŠûž²ólp;ø­µB2oH»zîÆi4%xyí%)¿ï’ŠÕªÈGŽïú¬JVw ‹uyu‚gJÉ=ß:íÆf›3{BŠŽ3Ów›E¦ïuöôùùÙ»WçïϯŒP°[]“šQ¢¡Q5vžɪ59-òyº˜§™~úìæúâòÅÅåÕ¹5ù®Ò¤–dµ.ó¤NïííÚ” †NKh¢ëÊ'OYë)+Î]Ré8%Hh—} ¼.FnĶàËÅôêìW‹ M– ÎîñMŠsI–ÏH^/a;!ºñEàv¼H/â«Ëøª¶#(ÛFq/7â®V/­ÈKšwì[Ï^‡NÊ)F³¤µµq¿|bwÕöV­!›’êÁž² ³éŒÌÂAÐXæ$Ûâò²‘—;ÿ”Cü!¤g²b½*ÜEFè€3‡à  g€ÏóØË=»ÀsæÌð›ä°V€—’H®jÒ¿ÂÁºñš[ Údæj.;«D±;ã_ÓdVäú„Rp@SŽ§x Bó¼,fÅÉ?T8?ÓÏ¢ÒèÀ0Ø–yPˆ¸|BãMUŽ«»4ÝÎÚ2)õx•äø72RñÅß=¸h‚ +ŒñË9Ö”g“ €˜ðd!+öð ë+B‰¹?¹œõ æLÛ}ÌÎAüßãÄÔš'ËÒª¦Qµ¤K7¯%F#ÚÖ4L­<¡)tSC@%ä \Ã-™ÕÅNx B×õx¯2—¹!BÃqÔ +4CÏjòb2‡æ‹M6£¥}VNÍ;>Ì›Ô|Tà¤%yÄ_b﨡¿˜¶Š¢©z‹]_@-$«´Ôæ€`ö€‘šg¶b§´R¶ÿz–æ +ÓªùÎŽMS7¸­=¦a âû¯ ?—õ¯¿½zñû'Ðb¾¡K­{¾ýÐ7oÓÞïFkô¿ý׉ +¡½µ~óÔ“Ñaˆ2à*À7K'ÀסœËendstream endobj -6839 0 obj << -/Type /Page -/Contents 6840 0 R -/Resources 6838 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 6837 0 R ->> endobj -6841 0 obj << -/D [6839 0 R /XYZ 85.039 781.388 null] ->> endobj -6842 0 obj << -/D [6839 0 R /XYZ 85.039 535.112 null] +7159 0 obj << +/Type /Page +/Contents 7160 0 R +/Resources 7158 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 7143 0 R >> endobj -6843 0 obj << -/D [6839 0 R /XYZ 263.137 541.085 null] +7161 0 obj << +/D [7159 0 R /XYZ 85.039 781.388 null] >> endobj -2570 0 obj << -/D [6839 0 R /XYZ 85.039 389.607 null] +2626 0 obj << +/D [7159 0 R /XYZ 85.039 667.493 null] >> endobj -6844 0 obj << -/D [6839 0 R /XYZ 85.039 354.862 null] +7162 0 obj << +/D [7159 0 R /XYZ 85.039 631.228 null] >> endobj -6838 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R >> +7158 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6847 0 obj << -/Length 1970 +7165 0 obj << +/Length 1383 /Filter /FlateDecode >> stream -xÚÍYKsÛ6¾ëWèj&‚ ‚ÏÜ;I“ڱɓÎ$9Ð’"sB‘ªHÕI}÷P EQ‡^:™¦ °À.¾Ýýv¡È± ä8„«’qK¡âx¼ØŒÜñVÞ¤–˜j‘©%óz>ºx„céŠÄMÆóï‡sáj<_~q®~»¼Ÿ¿ù4™*¥%ÅdE±s;‘ÎûwŸ.'±ræïï>òòÛO/rî`í–'>Î'Séøüqó×W8öùÏÍ.o__NOjoó£7óÆòÆ&°2A³ÿ}ù掗pÅ#W¨$?ÃØ–7#°[¾Òßùh6ú£9Š×ü1ïêCÉ÷BáE0P®ˆc¿WFJO(é”+×o ô¥¥ôCWbùÕ•Q÷z5ñØ:ìX£–9Ò([£ -É.[㔑ý<‰}'­èž'F¾ÜÚ5¿—;ÌÑŸi]—“)H–¼yf+ôãjQw­ÄÁ8ò\6ì5^‹L-²Ýs{OË éÕ -­ -#'-–}â4¸+vžÒ×z÷wïJ½-å£ox÷"Íù»Ö*SD‚Ǖ‡„€(p¼Ä§2ÝdÅš}¾EC4˜ìð+PIK"yž¿‹Õ3KØ{*ž21“>q‹9À¬XëSfï¯õž¯nà~œ? 4p-×xefX”'Â-Œ=pL<n–ÌÉp32ˆÉM¹.ñÚaèÌÐœ"mº­«£“A(bˆŠ!cŒÌ‘5íÄ =á…²eÎïèõÁ{fÔžJ„FÔO«_áÒÞp9û¢,°Fàú~Gu3Ï`Ur!g#áB‡†V|¼›¿y…[\çó“ ë‚'6Ùz—ÖDkžawI熋Å=Ï>âùTm~¼äõ,ñ\J)_îáš$Š -Ó*#n³T ûÍVSPŽfiÎߨ?BýúBX_}¾Ð’,NSo­¡ƒ=Ð8£¶·0xÙ°¹.¸êÍZ Ee’¾ó2]ò3.`aÙ¶¬§( -ú VKædY02x㻳<öBèÂêƒh¾SOq„­ÛÅvPîJpò¦â‚n‚~ñ¾G>ŽW¨¬¬VËÕòUkC¿6t7, Á‰‚d†ññ½ÛÄK¨@Ûï-!*8gÌÔÈilß%»l—KŒ‹ëUÎyCý£ÊLÍd’ïá•f}ã%1X›¬®xÛœ®ŒWþáVºFÏõ…‚·¡Õåw]€0¶7M_È}Ìݘƒ(÷šKãn#¸«¨µ£š•¡ÕܶiÜ |{_º#º>ÁÆ~¢„&Ãll fc#tŽ56îjìec[cŸgcxl§Ì´Yar¿"{Î%V±-õš:`ôƒEþ‹Gü²b/7iVð{nƒ¸Z\σ@bÜɤãI²ì¬Жa3£7™~å˜ -¦õpµl;[†¼¨ Ê.]Ô+%§<x8ãñƒÐ€ÇµÐYil<ÞÑØïqKãÿ°µñåim,¡hµÐYh‡46Ðv4öCkiìI&ñk…îa(OG9®P ‹BQÄ/Š‰#q®Ë‘´_@°Z¤õ¾©ËÎàUž1 ÂôO§4¥ä£†f2í(PD)SMb€9F×qZUÛtÁdÀ®¦>L'VQ6¬*uk·2=YZYÌm2®âEÌ| )á7ð -W±/ÂhøqiÉœl#Œ ^ê!YSŸÍâD² ˜Oî?]§Ì{ãa$à¡5h“‘92ªJ‘Òm[u­Ù!º*¹ÕÚñ/Jÿˆ¡«Õ¬&ÌM0˜J§œûöO&Mów?ñ¸R¶ÈØ™zú’\;X{¸Q'åö!3£oAq˜Õ ÷e¸ -"DÑp†[B§3ÜËðA&û{3ÜÖ8ƒ&îù˜b…ò}§)¦yÞm©ô,ËC•dµL¥ !F|E˜>/MkÎÏ¢¨yA-›Î|K?Åé÷M®3ñâpG?:Ó XBˆk¡³ˆilïhìGÜÒø™Z%ÿÕ4›¾ÕÇ]—Äp©þˆjŽæŸ[â©tÍMG7~1zÿžðoÍ3²½åuØ£¼ùóaÖÇQ†[\áõ‚ÿ1•þ§PhþUÅW"V'€ <:}c ¨’¤ko b`Lulð¿;KÃHendstream +xÚ­WmoÛ6þî_a`_d`¢H‘zë‡aîš®)ú²5.: Ú’mµ’˜Ir\ûñ»#)Y™•.îŠÑ‘<÷H< ’·kj¯ÙÊ:óY.¥×ìeë²Ú ûè3CkÉ({Ÿä¹úÞ6+n‡›‚GîñöY±ReF¶mYœ}j^ÊMÖ|ã6o‹çnòõÈ~BÈùV«U±K³s£`·A4dšÕ¤R«¦y(g»ÕÖçêŸ ùèMB<ÂÀ· Ùoû®H¢ÕS$ÏÙ×Ay¥wM^mþÔ§±;çgFòûFðÌè¶Vª=7` ö§mûóºV©zâý„ËÞsv¿rº‚“‡Zùr uŸÆN»…šŸ¡œ8)0*2ìY¯2=J +09åú¸µQµf‹œù‘s7 BGæÌËe‘™•Üjìó¢0Òræ‚òÀˆ>deŠ½¬]yÈš”¬Tµ¡M?à·…Qï\§é" JR¤Ë j:‘ëL_£UõaÄ’ +‡¾\¹Aw®Ó2FbFA„ß.w½yÙe`!kË`&"0X'Gc.­"èAÈ%fñqê`ì®»ú.ŒiX¤]’7-ò÷ÐA ‹,qXæ›­6z¯K=‰‹ƒÚ>|üÕÑ ÃHyc¾d®ôM‹²¥æi™WyÓÖ6qn¡Ô؃ähÔ3YZë«[#Tj/ó–J͸Vʪ›WÐ2¯¼ ”Nsï],ÒçÎM4úT‰uO1Ùó–º#Peºnô(ô hˆÔ¾9é"çÛ±ºé[&žŒõbÎI,x*Ø@þ¿Ý£ÓƒòÕÎ.XòoY¨k4:ø=lNendstream endobj -6846 0 obj << +7164 0 obj << /Type /Page -/Contents 6847 0 R -/Resources 6845 0 R +/Contents 7165 0 R +/Resources 7163 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6837 0 R +/Parent 7143 0 R >> endobj -6848 0 obj << -/D [6846 0 R /XYZ 85.039 781.388 null] +7166 0 obj << +/D [7164 0 R /XYZ 85.039 781.388 null] >> endobj -6845 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R >> +2630 0 obj << +/D [7164 0 R /XYZ 85.039 325.774 null] +>> endobj +7150 0 obj << +/D [7164 0 R /XYZ 85.039 288.907 null] +>> endobj +7163 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6851 0 obj << -/Length 2375 +7169 0 obj << +/Length 2314 /Filter /FlateDecode >> stream -xÚ¥XYã¸~ï_¡G«EêÎÛ,v7˜E²@Ðl€É<Жl)££G’Çãýõ©‹´|õC‚ÚT±X,ëøŠÊ áOyy„Qáe¹ -¢<÷¶ÝSèíaæ¯OJ8â$ -’8†ñɵ]§:ãì.ì±ÎTD±BžŸ^ŸžÕ¡§Ã M#ïugIó0ÈóÄ{-?û‘Vë$ ý—?V…ö?â¿×Õ:J3Í?¯uŃÓm SÿUúÕ†éË®Y)¿o¦y4s3ô«/¯¿yqÄaæ­uð‹{½® -å°(ô‡™ž~yu'°º%IPdù»g\ðÐUâ©v)–g “ sÞ·®F<ƒÊ}3‚¦2îL¿Ò¹¯Ì7}Ƀï«$e¾•OäÔÞšiC?1ßH³{â,inÏs-€6!SµÃaÛóÞ@œ˜ayÅ0×vj<6“,v¼3ÜŒR -®&ñj”ðªßþíÌ(:ÓM‹ža¿5F]µ`½H'tÈH§þ¾²† Èà´R¶lÜóíÚ{+YÌ·C³Å;¶'4è¤f|Ë°š_ˆAÎÙJøa7¥¯ÞÞ$&•¹ù.æDi.JÐúo¼ˆÜ ~+³] iC؆|ÇÔ73š®šÃ|¸cÔXç)ˆº×ïMé—çÐí1vqÜ }C3Ú€TºLøÝ’ÆJL´i6¨ÂÛÐ÷çPb—È¿éy§ŽÜLª‹#ƒ/Ö‘‰xè¼Ptì«™cnüÊMYÝ9óß_À>Qi¬Þ—”`ŠŠ¢ØwªY‰9KÄ%h&CÖžd+Öç:òMŠGv®N.XC6€ -˜Õ»`Ác‹œŠ¡ì¥‹çEǶÆ)¬rqáÿJ…Ë̇ÑÞ'–3ÎýPÊ~ªúŠ<;=ÐP$¿§à™åaŠQ±,P: ”epy`ï€×C–åzDEwô§ÓØ?֜ƑyCù«j›Ê†R%¥š(”÷P8ÿì%UÓêRXËJfg~ÉýD(ùÀ 2lgˆ% ¢ ?X½%Ìú^Žær~sÎ¥­Ùê²¾P¢s ÞV´“Š9L9Ö‰ã\e;d¹ èÉ#=@‚ÌÞ2·¡@U9‰NÌ &åÃ?½ ‚Ù! -WN©€`nJr•ÌR‰ø~˜y0Á¥Þ‹U{ Ì{¥$Š´˜‚ƒ°éù×Pد ;Iá`eJJ8¹ƒ„ó‡\ÂÁ;å›Ò9ü’r’¨à¶"˜QæªI†/Üf\RŽÑ…©±zkÙóDìp/IL÷Ðã\DVjXˆCüú¡ÅOø~ûFp›‘ÅT•Ìj+ r¸ µ±½G´a’#hPIóÆ %Ò†ïLé WéÅ‚®«SÉ¢ ¨Ä Ü×3Sjó½âÑÒV%“féýÜ0ÊÓŒ \ÕB¬5ôkL£@⼈x†o‚Ò(S$ã¥Ë”Á0hžíÙQ‡pä FÄ‚çt]>I…fñ$æ,h•I/®H'p¨J­;ZŽ01^Üe¤‚4/„q³Fi,?Þ••‘ÆÅ㎷® b ³ŽbÀ °|aáÞ$aEœù=4£ôDÀŸœ¤â€%Jf‹‡4`¡×/à˜ˆ{ô ‡óŽkô+FÞ9éõ¿0Â2ÛÀ™†«§63³3á.g¯¡ï¦;²{-žÃ’Ô¶`{߯ Û3llh~¤§·<½Dìà“pñ³hý`FÉ›Šéyà"W¶‹Ž:ûŽ"¬çÖ!»Þò¹šiÑ3Àj.]?‘8=œ±®£Àåù’nçt[œðÏ?€á :_PZ<)ÑÕtMKM•CÆ7îÄ-![ÍÓ2­:“N®Å³ ùÜM- WÛß¡/äø®fy»f_Ë“ÖCÿåà…¬Q<æcÇy›£0 -Rm…á¡ã0¼Þ0ØLòèñŽÿíæ'ºendstream +xÚ­Ymoã¸þî_aà¾Èh¬ˆ"õ¶@?8ÝÜ&wÉf{ w‡…"˱YôIr¼FÛÿÞy¡dÙÖ&½½"€Er†3ÃáÌÃ!#†ü‰aèÙŽŒ†A(l†Ãd5p†O@ù0†Ã*Ûñ=$]Ìç?zþP8väDÃÙ‚Xfó_¬¿]M>Í.ïGc)¥%]{4‚КŽ„õ0BX“Q(­“ÿÍè ëê’;È9¹½˜`Oáëò‚Û“÷й½þx=ݳ”ë» w@¾»ý6ûip9ë=V¶ò%Zýûà—ßœáöÓÀ±e·ÐvlEÃÕ@yÒö”4ý|0ü½•Â45äY=¾7cê¤l$½'ý0{®gÍÓE¼ÉëwÜÓ‹ ”²VI™­ëL†}ú0™q+«ø[/SCŠW17ÒGnL櫬àæLëÜææçÊL©¶qÍ­_…T];¼ÆŒ@zŽUkæJt±Èž6¥™¾Ó›òDw•–/ii7Jù»i4¢ýgý*÷K' «Hc^cÀZ—f$r7¶Y½<6g¿è2«ÎmãÇRo+´íT+Z%]·œòü‹ÆD`‹Ð= °U®pë¯{ëN¼Yéä9­¿Ô»5èq}`3ÜU]¦ñªGã6ÎŽº‡MùîË¢Ô+æ1¬¹Nâ|©«¾¥À~”‡‚K­ëoøY…㵬盪<¯³âüØQ¼Î\?}ÑÅ—Eœå*4÷/fòçéåýõûMó¬Šóô` »´"ÎqÓÿƒ”óÅa¦•´}éÇ…ÆÈ!&~ç +Änhéü¼àGk­¯)°ÐZC+§±ÊÌ«*ìmV†¿^bq xS¶Éw;6¹.6]ƒÕvÈÅ^;2Þ íP†ï1qE\îØðel `»S²©`Z®i,‰kóhVì—Lº Ix®íúFW»Ÿ=F•#ì±³¿s´­LÔVk0ÔP¾GÖ5jõÁ}sbBàâL`é»›¨}º gHˆúÎ ±E}YŽ[Âó7#Ú—½<æ›g%ëVBæ±Edn›Yñ„5ë'W£þš‡¸o0£cŽ"VE¥Ø;­Wº( RnÓ=ñ…,õ¢îòDWð&Ë‘‡ ƒ?½˜Bù&Úˆ«À;´´Zj:`æÜÕ5a¶±¼Ù`.bç(ËÉnôœۉ^1Öæ,“pl(¿ ›G»Ì° ž¦&wéHuM6G^Px•oÎÙàé`¡J'É7ó`ûÒÞUP·ŠàO§½ïKCÿpswR&7}ùî¹oˆiqzEBî/GX/ô‡z8ºÂ>Ý_ƒ˜(Ÿ_ú%z^Ñ…¢”üO¶µ/³ØáoØéÿaÈ|KbC)_]kWÆwaÈñ3“ëÛ¡'ú_ÎÆ®gËÀoŸ…ÐKÌœý³„«˜ ¾–xœÂMyš&›2+¨¤ Ð04Ý7ã‘zYêÍÓÒ§}o_P»ê&IaÃMº±Hô=TÝÆoXa9¢[éæB,—Qãà ƒqõlz|u¾æAoj–·äò)¤º¦Ô\¶!‰Ó¼Þ¬yæqÑéóÚCDDÝ­Íüö\â."•£(š/ô ý2]éº1‘d•ãž2(«ê¶î’¦<ÃK,󡔉 씹ܕ{ÄË ÌÅÌ¿"z½lKTƒeT\Oêò¹:c"×€TúÕ©¹?¡±â'—Ï›=ªþ\¶eçS祫sÚÝjÚŽy†u%]mù²x€Íº±.5Ë=®Æ•qh½1÷Y|Õ(ÍÚ¹P—pèÔÊÕ»ž@õ;P~_¤Â€(h¾©â$%C[Ñ!Ú#Ò³•÷¦Ä뢪ãæ0ºëÄ>º‡cîD'º× dëæï^Žû_·´HKzÂIÒ²>Úw³Áqar1œ½Œ<ßj§qJï0 íž[)¢ eÇ>$þÐy(ÄwB½N‹ªÊÍKcú;7ÆEº5­¯ž™æ<Þ™—mé{ £ž§fpÌoÐGOÈ=€¹NÎ×qò Ålu^Õ›¢Hóæk'ÅâÕ÷è1-'­““éëÔ¼ºŽŸÓÝ۬ߊáâvöC¶1æÏý+C¢‡Ú…½3ÊuŽí¾-}u‡ÿE¥\Pendstream endobj -6850 0 obj << +7168 0 obj << /Type /Page -/Contents 6851 0 R -/Resources 6849 0 R +/Contents 7169 0 R +/Resources 7167 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6837 0 R ->> endobj -6852 0 obj << -/D [6850 0 R /XYZ 85.039 781.388 null] +/Parent 7143 0 R >> endobj -2574 0 obj << -/D [6850 0 R /XYZ 85.039 761.463 null] ->> endobj -3163 0 obj << -/D [6850 0 R /XYZ 85.039 632.606 null] +7170 0 obj << +/D [7168 0 R /XYZ 85.039 781.388 null] >> endobj -2578 0 obj << -/D [6850 0 R /XYZ 85.039 519.201 null] +2634 0 obj << +/D [7168 0 R /XYZ 85.039 310.104 null] >> endobj -6853 0 obj << -/D [6850 0 R /XYZ 85.039 479.037 null] +7171 0 obj << +/D [7168 0 R /XYZ 85.039 275.358 null] >> endobj -2582 0 obj << -/D [6850 0 R /XYZ 85.039 223.124 null] +7172 0 obj << +/D [7168 0 R /XYZ 85.039 207.815 null] >> endobj -6854 0 obj << -/D [6850 0 R /XYZ 85.039 190.906 null] +7173 0 obj << +/D [7168 0 R /XYZ 85.039 180.717 null] >> endobj -6849 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F62 4047 0 R >> -/XObject << /Im1 4096 0 R >> +7167 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F62 4159 0 R /F20 3021 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6857 0 obj << -/Length 2356 +7176 0 obj << +/Length 2284 /Filter /FlateDecode >> stream -xÚ¥Y[oãÆ~÷¯ЇRèŠæ ï äÁî:±S;ÞZJ 4 4EIÄR…¤¬Šþ÷žË EJ´v“b±æ\ÎœùæÜg$Fü£È·7…‘°Ý(¥ë g´„™.„¦˜h’I‡æzvqù½Œ„cÇN<š-||ÛóÝÑlþ‹õ÷Û«³›§ñÄu]Ë•öx†‘5 ëy,„°®Æ‘kÍxz‚ÏšÝÞp©®®¯xøùº×ܾúð»ñDX?Ý!Ùì ÛÀ –Óð# þ¤ù=>Þ›ýxq3kÏÓ"ì1æ÷‹_~sFs8øŽíÆÑhmÇ0½¾€Óؾçê~q1½øgˊ缯’ïF¶¹§ÂsýŽð„#m)Å(t;ö}’Þ_Æ_úV½Knå5›UÆi²~I¸ùœ½pãj¾Î˼nª¤ÉUÉc3¥ - šÓÎ@ž%kÍ=Ýp£T»$olÏq¸_)¥É/·uuY¿äåe‡¶`ËïE÷`Ú"’£‰çÚÒ¾W¬áUed5h 0Òø¯ŽðŠŒÛ Uq£YEÆ:-³ÝX†V¦§jäÓ ›=КèK^ò -˜›ãÔn‘hÎKAfÈÇß3ø¾VºØƒ®RæÙ"ÙÍ{î©Åb@¼-iVùµ¡É§ÏW³?ªÑƒ"mnþ\gÇöñ«p½.ŽÖŒB×w¬F1UªÊE¾ÜVzù^m«“½ë¬zÍ*ÛlÊß­Ùñ¿ÞòptÚö*³TÃ36ªÒ#±#¸±ËA¿GpÉ«ªòFï¹3Òx©Ô®Flö ¨ó4ëÛãÍhÌ(¶3Á¨¤p뻺MTú9k>5û l$ û®çC'òG'ê3.Õ_UûO‹Ji/Ô¤…J“b¥ê¡£€>ª>còÐa¹ ©pü–ôÈ…OjùI•ŸI^­Ðâ¿éÕ?Oožî>œžuž×ÉK‘õŽ°Ïj"œ ý¿_ìu× -íÃÚS\X û®B¿Å?zœœùK²ÞèX 0>ЂšºÿZÓ6+tÖ ²EBT†r—cƒQNF¶i²—v(“jÏœ1n%B „ªäéBÑ1(4%M6çѼ<:í%Â&ü)/©õ-C8ÇMIMV:aqK×±ƒXôäÝ(€i=;€Š«Ci%sZÏ ÐUéKû#CïK;t‡r9Pïò¢àÅ $L¸?Ï+•SÃÜS:VuÁ‚ «(c«á±=;;”lžb&X1›¼9Þ¾PÉüÔJóæ¯,M×­•ÁSlpÀçôc‰(`—óq¦eR1ÁÔ””“0§ ²ÆQîªD}iÍHÜ@77üðĘhxa)R„¶”é &‘”²¥p¶Ì ÷y¸ì< ]êàжÎË%7[î!¹ -Z ï²ªN¯-¨[!`MAA³ç±ÅeÝÙ´Ãóà14_Ú‡TùºÇi¿ÓÖ<ò#/@Åx~–¿i¸ÝêÚ  ^+´.ž9ÖÝ‚‡÷j¦ÁeKnkë|{óDãKJ.­¨S’¹N*¼ÒpZgSkšn»?uÃÍ¡øj"ç Í^ëQÆlö@K’¥éió†/AX¯¹ÑìŽRfÖ˜ä†Y½áœ6´\Bí†_§uYA`‰G2%4N'šœ!ux:°ã—Vó†õ.Ž¡ÐØ@"WÕ|Àæt$få’Ì>‚(Í‹\—¶:l‹Ø„ pš-®Q%9fLŽÇ) &µ #YkÃ@“}Ñ‘•6g‹ßÖéb(SP=]WØÖE³t:¹Ð }`~ D‰ST¢t}¶¹bÏ£›d©‡I¨K Ô»«y’m%Á•†>M6 •­ÁÐJ4|ü¶iYùÜãÈ~zH¶þùcRâ¹±8^/ -NÁ¢¼ †…¡Ú Ù»ðÛF+žÖ³‡P…ÃG¡ê°œŠǨòÀÈBý¨{0ê5ÆW}Œ.øg°²sáÒn̪¯Ídj‹×IR/MBÕCÀ(½E'Ĺ#•ìrnæ0ö¬×&ô5º‚›v¡îÄÌ#sLð@lN±Û‹ ØçWƺ4{„D¤&.È؈ HB§I‹m›5ë!—G R~“ËÛŽ#κ½”F3?Ü?^ÓÃÎý¿ûò+lŒÒ¦·Ää _‡#üFfŸîøm $~óôGƒWüGCÑ3rþ7cò,/G:ó¿=d~£™?)ÏžµËãOÅ—;éĶ„+â¹·Ê =·!(Áokí[¥ˆ\Ø“¯˜®´… ÀWJ®ºÓ,ÝV\K!ÂEè(Ô4«Jm—+==}ë‘QDrÅy¨‚Ú†áãÅv—S„z¯ -x!/^Xº¨Q›"ã JqÌe “ú³î kÎ Í-‚õWœf˜ž".|9’6Xmx¤wíÓa8Ô¯8ÈåA âWÄш)ayƒÔ\Í+µÊ(ª&(•zã|ÆQ¿-Õ d§ŠN¿ wŠs ”žgÝrZÐï‹TDb‚å.í™5+.ñçæé‘J*hQñ§ªÏõ»î &Án¸¦ß÷!<$XÙ~ÞÖÜýG•gˬ¸<ès,>a‰¾ßåThŒT£ž¬óð©o‘¬Ùn¸›T‡GÓDsY(ºS=sF(—ïßz$mG~åW–äÔzãȆ»ºá‚''N-œÀŽ AŸÙÊœÝKi»Bv7ËKs3is•<²%£/”h%oz¯CÆgO yóôšÉ7Of«öôçö2§ïl¶ÌÊ C@ÚÞ´²²´¡¢Dû ò×1>o˜ùCÔØ¿!'×±‡±ÃvÛÿëW–Vر"÷ øRÚPÙi,x~p»xͯ1'€ÿ`}{gendstream +xÚÍÛnÛFöÝ_!x(„#r†×¼9k§Q&][EP¤yK”Ì./*9ªãb?~Ïe†¦,ºiÑvaÀ<3K³P¨,›­ë³`¶ƒ7ßž…#˜E"Hb|õju¶x'³0yÏV[BYm>yÿxsñýêêzî+¥<%ÅÜOÓÌ»™‡ÞÇy†ÞÅ«Ï¢X‰8Rv]Ýœýs8…ßE3¦šÐï0|ˆ,‹¦pB%@ÃxBJ<!Q3ÙÓ#cÅ_=ñº@õÔí\fÞ¯ø¯`…ö÷s™zÚøô¾™ËÜ3ÝktÛ6Ûš?}Åç²)Ì€þ|™ +™*zÓêùc¢GÿuÑo 0¬;ƒç.^'r„Ì"Äx½94MQ1ÚÑI*yZ4ÁjŒà')@‰D¥„Öµ­ùÛÜe<L ÏÏEaÖ ûÆ=ž¨-Ö†Ÿy2ðS¨"üðLJú¨¢«åô)ß½8ôÝ¢j×Ôõ­^Ü–Í¢¿×ƲЩp~ ΞIË|B'^lQgäÝ=z‹îÐê/澌¯ÇýÖ5{*𠮳ƶ¦ Øð¾iùI”| ¾Qw‹÷Àð膳›%½+øí×'q-e dñpR²‹à›ngQ®¿eÏPSžqg̾¹XÔwmo^¢²Ÿ|! ” 9ßóžfõ£×${±7ODX) +Âä#m +2ª¯À‰LÙ¬1¦› Fždr AL‹7ï86O5Jƒ z[öLÝŸÆêð5ÈS9˜|2σ(B¥É[¶C‘#w£D%¤÷£ÖAô+dˆ$»­,ÑŠ*I½›ó\BÞÏCÊû°³DLCzêmʶÑDñ›6ÎH$>ì!hlÌá_Ç~ušâ¥P2zFŠ,Ì¿’'°8ÉQq’ÞZ7 Ü‚SΙr¤{´åîйX!ƒ…ä툇!SöCŒhôû~Ušžšû^ïHv×Pk³Æü|g¾³ôDe Š%j·Î_˜„+ÝìÐ ô®°~Ó6ÖwŸ|/;]§­Yrg> ï-HJ‡|œgK|kÕC•9½gÖ:ª~ÅÞÒ0Ñ}YUÊ´Hy{Ý“ŠŠ ¯Ytuj ðjëÝBC0ÄšÿîXÖÈ»svÑ›!›ñ ª*Æ:°ùôÍjõ=ãuDô P +âÒ‡oëâ¯G˶-£…c—à +j¡Í¡+^N8o ùLÇ•Œ‹\N8/5}z,VÇ¿R8—Mo4íXé{2÷žÍØMÔÕ,…)²ÇÔýn¢ì`v å#÷Qåld]o 뎻uœužv‹ÐD-ƒp\ÔÁi×ÅbßN°ÇTøqƒ~ßÙ\Ú¢€üEŠ1tç™·|…X—Ë믴Aùÿ—=o +s¤MWEº!­-BÕ’m¡“°jÿu'ž®–nÛZ«ÇÙXóQn[5Vh¿¯ô÷ë;ÝõÅTû®’rÜ[ýÙ¶ò¯ÏãìxKŽ‹[÷äÎE÷uitqLRC6æÌy3ÆŽsË 2ç ãfrEƒªÑµ…(…¥)÷`ýŽ7Gq¤Òœ\·g°·„¹§{ÆöcCö„½å%€yä`Ê[WÈà­qœ¤fŠ[xñ‹EÛ1:yÙ]ïG\ÍH’BCé9)KçW¤ ªìïÎ_°ê~¦ð'µr ÕÍ|ÈçoõžDâ¬]8¢­5ÑÅkLâC 4Ô¡QåµÃΓœ¿Dõç¡3=/6T lZÃ@…Fø—›¸  ê[”_·ö×_;f˜Ž‚˜u—‡ƒÁBÇ&ž¦GpÓN8q*¢(ÿZ.ÎqèÎÅðé­ãÁ‰Ë•Å{ÌÄn2ÖH`»Üf´èŠ¡é•L„¹<ª½BÖx0 ¨%8 ™á5Ô\qè0®%>U O"jBÑŽ¢› }y)À:ç¼ —†m¿VUv,"Ý…i$òìXwÜåÔmvTžÓQדq$›Žûòžq¹¨å¶OZ#‹w¼ƒ,×D²ëMwŽÝ\"GÑŒDÉhxÙ©m¢ ÃH$‚(±ú,˜vB0‘JÔã$¥¢Àõg'.-â<ýjw‘Ƨ&ÄCÙ™UæÊ ¤:hsJmµWq£S“Nã¿°£š‚³³ðHó?£«­¶A9¡ŽàèšØ/í¬Nõ¡Ëb«•9ŸèM¬a –õæV}JtR°ÆÃ= –’2>2h_10¯á»!Šq +t‰9‡ÉêÒJ Jr ŽŽëø¹æP'Ø’4N—÷Sf•™ˆRùûvD–¤S¡‰¸£îíG9è²b¶KÃÛÆÀCÏO§‰û‘<¯aãæõ +í¼qé+Æ ­|\§(¹á{j\iŠ/ÆÈ©«£QëfÔÞNUž÷-+ÕºHäZnù92\™Nã9Õ˜ ìy±¦#CùÜâ ™'ŽòéQ§'ƒ Æ•ôÏuz9@‰ËÁŽ üZkE¨™›¡ôŽöH´ŽW§ Ç7½5Lž 'Gqs<1c©JìÅL©‰«é(’,µÀÍïÕnŠÇÅ0Èâkî£{óx@a•¦F)¦Ðüآƻ8@jw'ËÅoÁZK„žÏ'³ +‘ÏðÎÞKŸ¬ü‰<—p,—ùDñ 4qayŸ{–q‚÷¥Áj‘„ÞtýþÈ|2¦*š5§Ò ë[BH2?R90Ž½Hèz£á=îžpº¤ëÄÞŒ$à ˆÝ,²O“­Êr‘)ç¨}}+Öm³ªù¹H' ùS¤r‘Ñ8Ð÷ÔwiÖŠÁ^÷¹ÁÔ$TüÌo)Ö íg •Â;÷÷/×åé çh|r þT,'¾endstream endobj -6856 0 obj << +7175 0 obj << /Type /Page -/Contents 6857 0 R -/Resources 6855 0 R +/Contents 7176 0 R +/Resources 7174 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6837 0 R +/Parent 7182 0 R +/Annots [ 7180 0 R ] >> endobj -6858 0 obj << -/D [6856 0 R /XYZ 85.039 781.388 null] +7180 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [331.58 619.163 436.662 631.156] +/Subtype/Link/A<> >> endobj -2586 0 obj << -/D [6856 0 R /XYZ 85.039 209.282 null] +7177 0 obj << +/D [7175 0 R /XYZ 85.039 781.388 null] >> endobj -6859 0 obj << -/D [6856 0 R /XYZ 85.039 174.536 null] +7178 0 obj << +/D [7175 0 R /XYZ 85.039 761.463 null] >> endobj -6860 0 obj << -/D [6856 0 R /XYZ 85.039 104.005 null] +7179 0 obj << +/D [7175 0 R /XYZ 85.039 747.777 null] >> endobj -6861 0 obj << -/D [6856 0 R /XYZ 85.039 76.906 null] +2638 0 obj << +/D [7175 0 R /XYZ 85.039 591.648 null] >> endobj -6855 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F58 3360 0 R >> +7181 0 obj << +/D [7175 0 R /XYZ 85.039 556.902 null] +>> endobj +7174 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F35 3036 0 R /F20 3021 0 R /F41 3054 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6864 0 obj << -/Length 2424 +7185 0 obj << +/Length 2590 /Filter /FlateDecode >> stream -xÚ¥YsÛ6óÝ¿‚Óï¡ÔL Á#oN“&é´q?[<$y $J愇BRvüï»@Rg2“Éd.{aOX:>ü“N¢…¯R'N¤PIâ,«+ßÙÀΛ+i0<ƒâMp^ί®ÿБ#}‘ú©3_t´µræ«îïooþ™¿¾›yJ)WbæÅqâÞϤûa&¥tof‰rç¼íáOèÎß¾æoĺùûå ƒ?¼†Ï—¼¾yõ7|¼›yÒ}ÿÑæw¸bpœÀ·|oèÝÞþ5û<ÿóêõ|ÐgdOQ™¯W?ûÎ -ÿóÊ*Mœ'XûBÂvuÚ*ó]^Ý_ý Å{¡Ã§NÙN«DèDOé‰ñ¤ „’«H¤Z“õÚ¦éÿ7ót Ýë]×^/ŠúºÙæuו mó¯¼ðêüɬ¾i?5ËUöÜñREÚ"6«Ü½eS¯‹ |’*D3922 O¢^)ÉAÌ»‡¬Í¯WÍòz›-¿d›¼»îú]]ç¥ýËz}@Ìg:¬Ž×ìz£MÞ/NoóÊÈõ%þ>êé+¢Hh?ºèĺ9½‡4*V”[‰CfÒD¢“‹Ü,ÎevöÚ§üÚ¼jfAì>΂ÄÍ9:ôê'd½‡ë¼Æ¾GfG_òm*ÆÿøísQ GÜ«sS©ýø²ÁFœó38¨@xÞ`¸»Än0Ø„_×gm?±S¿…ëAý¥97pÌP ¥åa 3ž¸ý!]ñoêË÷â7%¯œtÙ,3 ˜U‹Œ‚»{ÊŒÛÓŠÄÞÓÞÓ>GçDølÝ[M[ò¦],h TT¸³HùŒ Ð…°'ßÉ–=ãô otOèvYÏ_ D2GvLPºZvÃÀþ!çÅ¿wGV))™8®Ij!¸Ñn ÆÝäê-¶7A?N‘‡4Qù‡¾ßv/®¯«ç‡¦ë_àHªHràzçˆÿžñ)!ÿßÀ±ïfË%嶷¦á+Aë.ùjð’ŠO¾ —YŸ“wx*LEíûGV¯Ð“¶.Æ5¸û¿Ø½‰Kƒž]ç´îñB@»EÇ'ð¶¶âLÀk?az1ÞG2B›’‹ÒPäÃD )CÎXBžô´öÝ9IÅîý‡Y@YN%Õx€¼%ù+6þ™)éB19#l:¾,ìˆr|c–J˜ˆ”SË&” RÉØ€Àº/úÒH&E -6|´ Äc±²ÑÖñ1{÷݆E¿#A¤WX½AÝ"C¤i ÅÄ]î*B„@M!Pû¢©Á¸¡ŠA‘b•Q ãug%SÜ‘*M;­ÂÆÃòl‰& eHX†Áɪ-IÒ i”ea³žº³Bœ˜eò£rdâÁ22âqK¦5J©pßï­q¼··(á‡ù­÷{S–G¾ºŸ|íÃgÿ\Žu&³Æ¬š«š”P8)Yq+Γ)¼ L9ÝQ£pØ`þzG8Eir+",ØhÄ­ù¸¿üÛQ-Þé…«_„•7ˆ…=$Ê{³ªèHÑÙúÝf}Ó¢q -ò-ÚL¾ ›¢Ø›ÍÇ™ŽÀ=ÈmÉýTâ~ ÇZFë&"1dÌ5˜µ6;¢ ƒÃv•™ú€Í¢Ï -Úwìˆ0Þÿ®ämÒeÝ´Ÿ?¾Ÿ5:9 úˆÓ-e5 ñÈAxÆÃiלI]T³È65TƒbÉ ”¼/Ê‚ü… `0… -³AgÎAskåd´¢Ì6# ?vç)·“ l?4•ÙßšÔ¶ßge×>ùQM ¢£Ü¨S7x7ià“pbhJÆ¥ Ìzþ À‚ß÷·s^L“<_1˜®N&“h”,âoÈ&pd© ¶¨`Ø]I+òz™ŽíA¾Æe9œ:Õ•… ¾×Ø?Á¦ ÇÞâP~ƒÛió¬<êAƒD$0~íq?ìA ÎÓýô€r=Wn! ? `ÈúÚ×'‡LôtŸøü°J§| Ã+‹¾Og°©„®™ 6 '%>õE(S'œTñ>a[SÊ€ð@Y{:£8 ¬ó4Ieˆc3þ›¬I…Q5\¿«”óªY‰¸†¬7¡Ë·‘ìÝF*¢X;A¬ Ês™‡êáÈ7>g³ £¿9Qc‹–Hìˆ9ǵ6C¬‹:c@@øÎœ,jnÌ£=—Ðõ†>—›œRWc:ø©´ä£(6xõ*Çl˜âŽÁ†<í/E52nsS™MõZåFÊŒKž'“.]ïeÖC:ÔvWsªXš´•ƒ…ã©è›b6Öb©†xò¾Ï6\GxµÞQ©4ûX½Š®Çrñ˜ð‚ê$ˆz>#[êµ[½_œ( -7eIy<¡àZò-Rfª7¹Q¡Ó&U ¯ñ¹jkš›c7'5ëe6¸œÔy›™¬°†û†µ‘«ªÙL2î²Å’ÑE™o¸ 'Ô:7PºÙZÊá$ÓâlF³‚õÂŒoƒ›K<7fnøÀÝÖ5[ˆu8ìq…€Çth >®3Óˆ˜±Ocò'\;ˆp·®ýªáÃT¨z^éßjdÅ q‘Ó’™ÖÁz|½`¦]íf涡 ·ÊëÇ¢¥†Ä@”tÃT FÎ$¿ýD¶Ä”,ýØñð\úÓ)<€l¦/Î22†ì0?OM^ŠNâ'{“Wh&¯7e³ I ŠÜû¼ïljý\)–:!—§óR8gG, ÊEQ8ÎX!\âŒ*’ˆüAÜbôx¥˜ðž -ŒJ\å߶Ü4[G -É'éÐÐú…A2† ~é’³'Ó†¶Ï?ݺâv³Æ߈ƒÉl(ÑépŸÛœŒ½¬Ï[#{qªsí¸mÖ]‰ëšº»-ÑÚQ§Íí1„·Ù*í7?ø•f -A)Éí÷,CºäûÔIÃÕì/Î=~ÇfÈ˯ý -Ý{(§Ï—"ô•%ƒ¦[Ççþ.pÞýØéäÔóøÈîeÖA‡üFí@ NWæ -Þe,¼lÈL•M0C`üeò´b¶ÉsçßVD õwÞV,Êy›œïÙô·Á¦ìNÚtÂîfålõ˜QŸ·Ä|¦~<>| ‹Eš$?ff2+žÝ³"êðØSsCZµj¬ÛõmËü›‰3éà̆Óì´>ÐxßíÌAí“OKðŸãû§þ04>P)‘¨3T:ÀöVz;÷ƒCyíŽþ]~Äendstream +xÚÍYKsÛF¾ëW°ö²`•‰`xíM’½¶SN”XÜJmÅ9@$Hb +RqU~üök@€où²¥3===Ýýõc¤fü©YúIgq¢|“$³Õþ*˜maåí•Š`fý +qéfyõÝ?Ãh¦? ÒÙrC$Ëõ¯Þí»ëŸ–o>ÎÆÏh¾ˆãÄ»Ÿ+ï—¹RÊ»ž'Æ[òòŸü_Ê{÷†?òú‡›kü²¸Ç{sÃãë×ðñÃûßß/?2—÷w?8ÜÁò݇ùoËï¯Þ,B/¬o#ƒRÿ~õëoÁl ûþ*ðMšÌžaø*Mgû+?´F¾Ë«û«Ÿ{.¼fg¼kB7 G±P©ŸêpZ ÔW˜öÔ0m}c£¡AiÔÚ®÷:æͱȟá¦QìeÕš?ŠÕ##¸}ª¼úÐL\]ù¡²/Èb"0tÜˢ kÞ£Ñto4m”W€š[j/ßÀëjøM¼ºl™¢ÛIÖñÇ>«æ°ø™Iˆ2ç¥sR^¾0‚…U]} +”Ý"A#ÄèÙ~®cï!{S!\¹ámÿ¥C+ç1À«º¬¨x|:hƒÃ’)K¼IõØžï+öHø1Ðá©tµK*;‡¤œ&ßäM^­PÂ4ñhcÖåM‘•¢#˜¥sñÔʾÃI°¢,v;Ù 7¦Crþ‘åzÃäÝ®™–‹õýz0í¹=ã yYžŸQÃ! × ï]ö9 +&WiSîÈtÀa—áêq.“ãáC¶bSÒȦƛ’‹*ÇjÇÙ š m]ÁBÊÛž°^T,£ÆÛ,h;’VtbÇÓxõæ‘Œ·åå§7=”9™ õ§bä%TêÐ7qt†J8 ǨTžBh†·DÓ!")"0¸ä™w(E½b!ùi–mó ¹€«~ ÊOô—ñÉRB/€ŠS]Ñ•"ƒÍY„þ£!-‹5Ó°®a[¶Z‘ÍÚÁ‚ƒ~w'†%œwv"Ä£8£¼õÈÝÀDz®¨+P£51\àÄQBúJV2Ç'Y{›9~ìsyvBVêÝãù Ÿ«zçJàÅk…ø|F÷]ñMèÖè[àM¼¼ic綠X¾ˆ`f‚À˹ŒÖ#iÞÝá×/Ë»Å-¹ª°¤sW¨&ú„Á\ñaãÛ’Bcoå¢ +]O®;‚„H= vá˜r¸bXD$Á¬ù÷DS<Ÿ™€¡Î§ÕLûIû¯vˆÙÅqäÿ͉¬c?€L‰"_¯÷´¥hÄàzYW7(HzÏ;ô­dåõu2{œ‡¡Gñ´X“·áç†l©†'/DáɳL~‡NTñÒ>“¼„5îᄧZY%IvZ{rÛqØPð;ômR«vÉ â{ ( o¦UÙ“Rx.²mU·]±â)”»+Ê‚$Ï%ºA03ˆüVöep¼Á+‹2{pè×ΉÏN›(É`yWïeýIÖ…fe[SuÅVåB\ä­ ºc/;LõeÁÀh˜ZpMŠVu'¸2*_‹u*Ç¢M"cCF?tŽ.“Ñ}¢(l5¥ØýÐ4Ç¡ì·ŒÃtjýÄJœÆ©f+kßrtŽôDtÎ1õæà½Àð"€[ S¡%,ùIŒ«‰!M`gÙ!õƒð,uŒjR(L¨&…²Õ~E Ũ²j²F/@7ˆÓùЮøðÈ‘ŸóT›€ßê¤Ïm‘ȸèœPÆ4rýØ,aJò›Ùï uª,Öïø7“¸§M4ñÝû½™½®A®ÙI4Ш†žÆ€’S—£’éº0À±«CŽÈ%øI¥–ó-ÖŽF z6. Fpws¨xPTì,ÑÐYTûijäì5—9µxÕP<7PB·gü­sìÁ´A!º" ð`÷Kè# rr/0\ƒˆˆ~ègb_“ ‚ +êÁa9«¡²¯å,¬Ž+X›ÝŽŠCÙ‘Ñx'U¹^œ +q7;²›G–KYÒõÞ%ªÀ"“™â˜Ë1˜É1~r¬yü‰˜v]–\uÆÞ3¥ó”-F«Úæ2× Ôn†öI¬éXÔÞî|H;› óXp×Ä>®9:`¡©ð +¼m^åM&Å3,ÕO\Ó\ç.OúBV¬&5{;þ|Â3P5ű(óm~*“QŠTt¦¾*³¼<Ê*ba´‚×õ¹Í*¥a”aP>iŸØ=U>¡I•*?¶ZT´È&”¨B_A±Î§0Û +Çš[ꃲΟ@R¤ýÀ8ö¯eg «8 §+0¡ž‰ˆOüŸIïáT+h;H)‡kyu,‚½€ªEzOñl‡¾õ·ÅÖ……éÂÞ÷¥ßð +’G¼tà³`S“†]礥sz[ÖTßC^¾Ï»ÞµªmûBƒ~¡ARé_wHä(Û)Pj_§‰o?ÜÝ ×î'2uú¡r1õÂVGÖ +G˜…àšÿ!=7¼<™ñÏ©õÒæÔaUܧÀS/U¬°„Ïxª”pÚÛ–T·fåàœ&ãV«ËáèRÊÐ1XWþ"pU+!'}µ¨EÅ6ÒCpŠ]…tèôDÜÝðB)M ]ÃhŽy½ÚŽ/:”ѵþ1Õß?2Ñ”Ÿ¨È‡2žÓ>¹ øûØM@çñ%[@$xòd†KCžgÎåxÞd-dµ±6MàI(Dòz®Œ>œÂõW’’]PÁì ÙÎ-ÕOè]ð9~Á†LÇF³ôÿKQ×ëcFUÞÊu9ë) BìNÕ׫í+ÔĤ•;5_çòtUé¾vn)ÕÑS™ÿ18š4.‚<¿àIvSRê‚lsDÂ2¤æ.®…”íž/¬å‡ü•G;$á€QM1¥hóWÞ¦Àð®8É×ÜJâË2¿ÈÐPÎB;eãÀ[•Éõ(òLž¦ú2¢MÄW$’ıöþM +9ðIØ–ÇX,à6›,¨<]’BvÒ=âÇ Nº6©4d£aP;݃{v€ê,Ä´Ô¿ÖìÜJvdÓW=¥ƒßI1ç¬èÖS™"SäôKÏ‚{ª›£Ø»Û‚²°Ê«+‚^ëQòQRÆâË$é´‡5bÓ9 à»o"Ž™õ*À©Ó«|¢ñi:A9¨ÒÅ nÝõK BO’»ÜÝ­ôâ:E>ºGc`Ò¿€72qúÿ||¦÷Ü3%Ñ»¼Ó1Îò‘úeSÙ«‘ŽIEnqè·rÙÉLgû¾|˜íåI,öúƒÚ¥¿½¼¤ÞÅ:ÉÎ ˜éŠåW’ ؽþäùKR´Ò¸ØCâÔŒàÓ^ážôz±pº¬Ûq‘©TBaxØøË ‚º™E#|¡ô]~ÛÿÔL íPo—/VqVëÑ¥éÊ ø_\×üendstream endobj -6863 0 obj << +7184 0 obj << /Type /Page -/Contents 6864 0 R -/Resources 6862 0 R +/Contents 7185 0 R +/Resources 7183 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6837 0 R -/Annots [ 6868 0 R 6870 0 R ] ->> endobj -6868 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [330.822 535.736 435.904 547.728] -/Subtype/Link/A<> +/Parent 7182 0 R +/Annots [ 7189 0 R ] >> endobj -6870 0 obj << +7189 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 353.13 129.884 362.698] +/Rect [84.043 512.758 132.914 522.326] /Subtype/Link/A<> >> endobj -6865 0 obj << -/D [6863 0 R /XYZ 85.039 781.388 null] +7186 0 obj << +/D [7184 0 R /XYZ 85.039 781.388 null] >> endobj -6866 0 obj << -/D [6863 0 R /XYZ 85.039 693.604 null] +2642 0 obj << +/D [7184 0 R /XYZ 85.039 761.463 null] >> endobj -6867 0 obj << -/D [6863 0 R /XYZ 85.039 663.778 null] +7187 0 obj << +/D [7184 0 R /XYZ 85.039 738.187 null] >> endobj -2590 0 obj << -/D [6863 0 R /XYZ 85.039 508.49 null] +2646 0 obj << +/D [7184 0 R /XYZ 85.039 668.118 null] >> endobj -6869 0 obj << -/D [6863 0 R /XYZ 85.039 473.744 null] +7188 0 obj << +/D [7184 0 R /XYZ 85.039 633.372 null] >> endobj -2594 0 obj << -/D [6863 0 R /XYZ 85.039 177.656 null] +2650 0 obj << +/D [7184 0 R /XYZ 85.039 338.608 null] >> endobj -6871 0 obj << -/D [6863 0 R /XYZ 85.039 145.438 null] +7190 0 obj << +/D [7184 0 R /XYZ 85.039 306.391 null] >> endobj -6862 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R /F65 4136 0 R /F41 2994 0 R /F58 3360 0 R >> -/XObject << /Im3 4353 0 R >> +7183 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R /F64 4225 0 R /F18 4228 0 R /F65 4251 0 R /F35 3036 0 R /F41 3054 0 R >> +/XObject << /Im3 4496 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6874 0 obj << -/Length 2658 +7193 0 obj << +/Length 2557 /Filter /FlateDecode >> stream -xÚÕYK“Û6¾Ï¯à‘ªŠ`€_Çñ#k§Ö±7£ª©­lœgÄ2E*$meòë· J”¼»9m¹Æ$  »ÑÝ_7¤ ÿTÅBêý}õÛ槛w›QŸQR=Ge~¿ùõ7lAñŸn¤Ðyá] -ÃûÐFÄFÛïúæîæãR5º¶ 0…„ÜEgû4xN¡e†›T—š"''ãHÔä†Íq˜æôL§ˆf/À¿’}(š‰å€Ÿ]±§iCÙõ<vs _=ͲÃŽæ¾ ,Ê0¹7~ºõ—ÍhÀ iªÎÌH1î}ŸºlZùS»`m -ž—H8}LvåSÛ•LØ£–-å%gL$S’€gÑœ¤ ¤uŽP0XÊîXõ´¤0Nàà܂d¾z&“«=Û}‹ÎW ¥sÄkVÍ·CÝöƒ¸€¢qþ“þ'0ªEâE7Ls‘™èâ24IÂ2üf¹ç«Œ8+È:Q B@)‘c<¹FÜ™¤bý~n)k®mþóµtÜ:‘T¸bð{IØä¹fï„Ÿt"«{¼mAÌÀ“Ô.»öÖ%IÕr‘¤qÇdýˆD½»GèáZF #¤1'BF>Ö?¦÷eÓV|+ùsWÖ,Ʋ‘Ì’£µÙòªä[vö‘b©Ö#o´câ¡À¤àE3“++Óy~çÒçV}E‘qÜP<ñÐ~)ŒS# #ØØ{?ºïÁ†©oÁ()Ô«ÌZSð¹ÕÛYå`º|²AûtRTX«¢yž]™â@€2)ˆf!}ÊÁF² -Ï‚Æä±P& <ýßÝ#JÉ4Xã´¿‘©Ê¯¨&O„brW<—1°,“Iµˆ ‘¢É¡æW샷ű ïÀY5å,Nì_wl²¡jžû )Ƥp `´«’M<Hñykbt.T4¯à¢4 8YMbÐI–ÊDZ8í&Çò‘S&ð$gHgÓ+ÍïwS.ÿ ÌýþP¿Øå'ÃOt+|’ïáÒè__1#36EÓÑH´ÅÏ4”êBfì_z̃ʠC‚ý,6î0<Vì–½9ü¦ó”aW.—ªqîJºóŠ6 —Z‹H¶+@ÕL:‹N\ç|;(RµIÏYq}ŽUø__Ö´òã`¥¡‡d…§T2íFõ|âî,kËÏÖu „œ8—v±ÌËe h¢M63pC%5ïOç-” Á±'7SÙJ¥U‹=nl«ÊÆé“~ê¬W[0ü2'–ƒ¾éºå2±˜j.ÕÈBÜ|À<ž‹ÐªÁïe:CÖÄ"ë玎‹‹Xê§[ý4‚¯!V«H¤&¾.áÄsb#¼S‹’ù% $‹sˆ%*?<ˆµnˆ9Füª«Ü2‘EeýµGˆUvšPL6Ë—8Ú³Ìz1ŽÐŠÔ-ãªåñ;:üt~hïVŽ¶KU6ã¢çÎ%OºI›¹W¶ŽáÑ5ÃâEGšŠ,f*Õe_†òF« z}#Tv–ê{Œ1™Y0³ûãàzì©;GSv]L)D*¿WW\´T«X™Övî‡ÉÆ|YPº–ÞŠáC+gŽ·ÑéÌÆÔSÌàêÞq6¾÷cɹ¢ âyþÀuÈà¹|¾*¯ãæ«“˜\°;‹N¢eˆ5hK«ÍÖ–-ä{1*Ãi“^±®äª?éPÊÞÞÌxF8WdïH=¿ý8u!HŠW](W—R"t÷4¼¨*S;¾ühÊ#¿œE»†h· -ÃtÉf_wv @tv…¿tl½c  ãV§@ŠEÞç•-'¾s¤¨¨Ì.€*c5Yzu²½Ä(ïÖqúðjD¥ÿ¿ðzÅ“bòü課“ëØåñ\DW'"Kò¼¦^7;Wܯ º]A¹³aÊ}õçTln/Éh×¾*ãÄs_UñU.É j:¹/¡äˆÕ>m¢@®»ñ77º:Bž{tæ?©ˆíØÏ/npݿǼ[fKFáGò‡Ž×§ãÞ¦|iN¡\}.‹‡ÚŠÐxmiÛ}ab±¥kئêè©00–îŠÜ}ÍtÃåìÁøS`±ÇµŠé'{ço€m蚘¾îç×=¤"–)m7,]Ž³ €øxàÝ–ßéúç™rN¸öžwìŠzf,øA6…Sªùó Ñ LWòUÃxãŽÜ®dã=.þ  ,zâyh„ÚrT]ÔÖ5HÀßÑöUïn%pnl¯«Š~1‰@Áª÷-Ï^æ.‘MXÔ»[&PGwð€›.À5¹ŽèăE‰™ð8ôß’ ô‹ŽMùƒ~éd›Ø§Ìʱ­ðئësM¦8ÝŵXø>6dG‚èÁ’§/TÉЩ/Æ0ü±«þ¥“§Ë,ü%ðB"ˆ!DÊÉ‚'d¤>•¯•ãLŸ üo«”åendstream +xÚÕYÛoÛ6Ï_áGˆYñ¢Ûcº¦k†µÝyØö ØJ,T¶ÂôÇŸ§Ìºº˜žab\ÿyõÛád ‚ýt +¥“=´C!³l²¾2‘‘Ѷ_]Ý_ýêwá93áU#º™‰8††e¾á8i„4rô8`:ÉDjÔÙmhQÛpËRî!'q,âLy›Åf"¥È¢hh³5¨®Ccê‹D¢HèÉŸ)B“ešgmâ³_D¯îÖrò¦Ž&=S: +G‹´åØ’éˆ+Ý? •ÁÔ lÀVy‹(XÔ›®@†¿v³–ß´eW~)xzEsHµE4l»Ô<û{( Îo`~ÉCõ®ãÆ~•³.°C»`ó°Í§* Í×t23Òðli|ª‰êõ‰J”è?‰Õ–´n ;T/ìÚ‹ª\|æf½a—îVSkŽWoU8ÐNšAœZ ½ëådÊ=ªX$ÉLZ•(®=¤«Ý!TÅSÇCõÓѨö¼ƒåMÞ•ŽAäŸU:T… ı#é82L&3mDª¢ïrì™u&ª3\–}_¬Íd"ÒTSà&2O|3¥€Ôû+Zä$Œ Ûi²Ã¿Y…Á=ø’&Ï@KÎtCv#5uåæ¹ 5åRÇZ‚Þú€‰FfŽñ¦UI`4M§‘óv<šóg±kr/Š•z"Í ­],y°]åMq í,DïÝzbp[ô€ÏÜEÏÀ¯uÝ™JCò’]UñÄ:{>Óàê:·ø?ÌYǤð¯à?Øþ42 XR™ØÑ +l9ú S Ѭ‚°6‚†ŠGäŽH˜o@ÚÄÀ—Ä 3Â@(TšXò7>6),tªŽâô¸8Ú¸õ½^d@)  Á«Ú¢¢å†Õ$l%{™‚ëwöe»²¤5ë-'( œíZ:ÅàÌG.£1´a98šô*Qr­ÓÛ°+az;$ÐzLByH±Çà÷¬I³T$:9°h¥hÒ^ŸcºL$Áñ©.!8Ñ>V«¥¸r Ò‹îumÔ>Êá ÃÖGTÛ,>•JI+5gÅ vÆ'Á“ “B**Û (à¨D„YvL˜0’yNÉþ&L1/àì¦ØseuD ²QÌ}혪«™È)ÛçÅHRå6Ž+ë4#J0™Ð¡ ®š‚™¬¾hVHá± qÈàÆ=þÂÁäm4j¦ð n=ÿ˜àŠjéæûô e&Lhv“¯-öÈè|Âø˜Ãᚇ|#ð´bqÜ\{hµºp–ï£!øßJe{Ì‘ætœ\ôH.£¹EŒà„]œÊsPue …¿4d®1›Ö‚á0C`ó¿ÄD“‚»Ÿ`"ò‡†öëWÙ4sŒ‰8Há^Z„:oÉ”ó4¤M rþ#q|Ù-aÞ$Ž.-Í©{ݦ§ÞrX}ú$J™Êy²B AIÝŒ…ÔGpƒ‚`(Ï;'øZžIm—Ï-Ž=´Å ÁŒt˜  ýBÕcÈiSr=ãr²ú‚Š"4„•¥ÃÔ•¦æÝ­Ž©Â'®qbcÙ‚#C_†÷åä@Ç´]| ˜±ÃjTŽäCŽ08pìRˆ/”2âHAG긠i0QbƱn¹=6ÂéK›Â;«ç8Hqˆ°§w!ðøm›¢mû NÅ™)¸eßlL.;P&Ïe8¸QÓô0j-Ç€‡sþ0¢ûzsaϳ_;nuv·#Ô0Œq +…!tL/£#Ö‚ñIŽŽRé˜"¨B£qˆÄ²¤ôøxÌiçåð9 aˆTZÄZþÿBä÷hÒæ‘Eȹ ªû‡i¦‚›i&é™ FÊ¿ú{ÃÒ13‡xË5ÿ‚‡+º™¥Á–àŒ^ÝÚ;*N”OøM׸™²wôƒCÈU³dR|õÀ140~}’¬¶§{½/MÝÖOÝìó†ñ®*–ÏEþXY‚¯Â=ÌÕÍgžËÑIÖå¦l;¸½à}²ybqïäǾìn×Ê›§‘p€ò<ôwT_å–RˆgŠ—îÕ[baÍâVÔ§ºqpwxù‚D3gì•è8”VÀ´"Î/û’Ê"ˆ¼rx]ó.Í·°ÞðÍ]ç=âãàáÅÌDjI¯¥>ëÖë5ƒ÷ˆv Ä¿‡Ð$‹Àþön¸1³·,Ñsüµxô°¹YßÀc¦Ý³Þ§b߸µÝXÙo´a|Â(?‡()Œ²7Ɉ(Êç ¹WAwØê=äûÅ…è{•#ų÷S|N\åöõÍì—¶y·­VqÓA%ËiÞë|ÉwkìW(LeiÏgxÈ×q2°%†n\Fžª ÏùÎù—]ï¢Èue ³£ËøÞroêErç2ÆØSXÈùí’Ì<"¢R€/#" î±”ƒiÚôE3¶5*'ƒy- +[ÿR‰¢ÃˆdzL€HCE ¬‰‚ßCòŠ'íâÃ6=@I?à"·Dëý”^Êè 6†óæź¯Ê[žOüÇÕœq‰ÝA +Ëfw²`0•ŽŠ…hØq›±‡•·´AŽ pßI$¾ú„1¸ðÉbÚú•W” WR=L™^cHG ƒ_§1vOÜÉ+ çý]†¼–ýû˜{cÙدÜÊD/>oâ†|–9’–É0·*Q†jr{§O#wcFíîèƬ¡Ð ¸æ3÷«µ„ÆïF©>&V‰)[>wî¹ÕúKÚnl™%üëDÓ•‹rëïqÀþ~4²+3ËÁ£xJW»á-^†/§§JàÂHljþò ØjwÛ© F‚DÃJš×/LгÀ•®óN##®a +nûð¾æŸœz°s›äîÀýÂ?tHþÕ‡†é‡3WùÙ]1æQJf¾ã€Çήõ@%9Ÿ×kÿ€}$?å§ÆZ7^íX ­¢Xð/œ§¥¬Ýóû~³Õ‰©çïbUl”>æPÆBdžÉt þ/qÊendstream endobj -6873 0 obj << +7192 0 obj << /Type /Page -/Contents 6874 0 R -/Resources 6872 0 R +/Contents 7193 0 R +/Resources 7191 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6879 0 R +/Parent 7182 0 R >> endobj -6875 0 obj << -/D [6873 0 R /XYZ 85.039 781.388 null] +7194 0 obj << +/D [7192 0 R /XYZ 85.039 781.388 null] >> endobj -2598 0 obj << -/D [6873 0 R /XYZ 85.039 496.119 null] +2654 0 obj << +/D [7192 0 R /XYZ 85.039 660.104 null] >> endobj -6876 0 obj << -/D [6873 0 R /XYZ 85.039 463.901 null] +7195 0 obj << +/D [7192 0 R /XYZ 85.039 627.886 null] >> endobj -2602 0 obj << -/D [6873 0 R /XYZ 85.039 340.446 null] +2658 0 obj << +/D [7192 0 R /XYZ 85.039 504.431 null] >> endobj -6877 0 obj << -/D [6873 0 R /XYZ 85.039 305.7 null] +7196 0 obj << +/D [7192 0 R /XYZ 85.039 469.685 null] >> endobj -2606 0 obj << -/D [6873 0 R /XYZ 85.039 182.245 null] +2662 0 obj << +/D [7192 0 R /XYZ 85.039 346.23 null] >> endobj -6878 0 obj << -/D [6873 0 R /XYZ 85.039 149.824 null] +7197 0 obj << +/D [7192 0 R /XYZ 85.039 313.809 null] >> endobj -6872 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F58 3360 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +7191 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6882 0 obj << -/Length 2424 +7200 0 obj << +/Length 1852 /Filter /FlateDecode >> stream -xÚ¥YYsÛF~ׯà#XÂç¾É^{ãT|lÄZ=$y“‰2((Fÿ~ûën\$¥¤*¥’0GOOßÇÈ_xôã/ÒÈõL¶HRß5iºØn¼ÅŽvþsã+ÄJAV˜·ë›7¢xá{næe‹õÈ'rÃÈ,ÖÛ_w?Þ~]¿ÿe¹2Æ8&p—«$I»¥ïÜ/}ßwn—©qÖ²½Â'tÖ?¾—9 n?½½•åû÷4}+ãÛ¢ÉÇåÊw>ØúŒ çå/´øYñ}ùòóò÷õO7ï×?¥D{fþ¸ùõwo±%ƺñ\“¥‹=קíà qãF¡Ñyyswóß•ì… 9uMv‘IÝ(5—Âó£+‹<7òB^±«ˆºÉÁQKÜ„žc«e:Ï`-s6Ë qöP»)P·§ÛÉä`¥'öÇŸð'—íoË&|¼ ƒÝæ?`7pNû‚P•yWïêàE×#ñc×ÕŠ`cíŒè²”Á_#¸††H\+Ò̘}P–0™¤Eû›ç>²éø³%n*H\/“Sk¢‘Vß|¼‰tß ƒˆ@ò~ ¦:›)!ÜŒLZÀ¾ÅL¡ï<Š bºÅJ bÎe<ÐTtEµ“¿y‘×b=ïh<ÓŠ/ðõƒÀ°H±p`ˆ‚åjKÙÔÃóõ#È*êjJ…U AÙ€„Æ©„V’Ÿ¾µÍ3‹o†d•þLô¤vÁ @›þ¤ízeÈî Ú¬›ï›:­=€„B Ø\3WYÊ·}`d$Ïp`²¼Ðg[ƒá›,r¬ bÆHórëQEO[á(1ÀAbüí%¶ƒ#L£‡Ðþ©GÅfJ Ûžãê®”ŒÓ¾?б>öIå®ðŒ[G„R±(§<”¯}9›º"³!Ýc“ƒEŠ–uóƒÜyÚç–C‡]15gÌÐÆ£hŽ>÷?ßÉHü*ÌøŠÄälÓ›‚GfÛ«èÔ`Ê¢—«nDW7V÷ÎŒ!D,ƒSAêY™(p*Øad,¹ƒ&í´†´v”V"Ï8oŸ`Sh¾³'&Ú©Õ 0þva]¿õÌÆ|øÕռ̙¥N¦8¡$1Ž„´ŠNÏlFâsu'NùqÙû´À -%”æWlÃT£ÔÍ ÕÖ}!ŸÅt8ÈâW3ø†“¤OQ/š$¡ˆ¾‰ÆSJÚ¾K7§räq|]™8qî:¸Å}ØB;_—†,d—¿@e@7L¢Wi›À¼˜ £Èwc5¡…RK´¨p1}—Á§O8´nP"I1†8Çf®Uä -’!Å)è£í§ ›4a’T"a‘ºÆ]§É]¬¿Z\¨ëRÖ9dÐW²jO,E*‚–¶6?èq5¥EÓÜ™Å|g>Ÿ…D1Ëô8YÈ]Ã@U£1]=‚¼FÈE\3fââOcÃDŠ5«ã‹¬›ü_ :rZÍ H[ -t¯wT²§‚± •p‚Øn¯%¶Ðøì†Æb¬VLXÐjG&—Š)d±UTœËŸ ÝíQ«(àÜøÚVîµòéêi;;Fv|Dµk"çv«uA}žæ¢h ;Lî”Ô>•]jÁ) ˆ‚cW,gLÉ<æÙ:W¨&hòv/0Ý,uV;èÅÎm+Û(«ïäؽˆ`fÍ¡àªÚÕh)Ó,ŒËm0EB9Fw£=aZå'¥š5&Š†n¶—ù౑°K»}ñ ‚€8E2…àãdLuXÞ¨f…¾#Ë¡ÚGó©ÊÉ V)Ùåè´˜ÃQË•_½šÉóƒq+ Œèaà–ómÑõÚ£½‘(¿,ÇrÄʨsš Ôâoc%iéôªKÁk«ÝXu…àujc5’+õÅ¥-e'G5]7Ý5‡úÙN#\š e®I4èkÌO´<ØéÞÌÙLΆÝ1÷me—kL|Ë»¬†B#®Ç eÔCÝ›EÆu½ü­ºªòÖÍ8Î {u³å˜&T]Šýat*‘'¨(ó¶›}Lü“‘{M4jÁ Zâôö¥<úk‚×óøæÅæŒÅC>oƒD›þí [œÚgV¥ýÑCÝL›QD²¸‘ªú¸ìÓïµã~?¦hâ7" -v;. ‚xHÌ4äw†@~èÃýtµj”¿NÎJ ¶©Cº§Eéeè̼禩ÌsöhMB_0ß°<j&˜èœ@êr+X­DP} ÓÕžr–].72?—Jê+´Bœ‹á¬â_j‡*O ÝàeK ÇCƒ¶‡÷û¼àA²èUuMÈxó!JgoŸ¾ëS’ÇÏf!“àÏÕ‡RßM³DaëJÒÛ´› ÇÇ“Ô¥œ´}V³mò?ŽÅàÌãû.ž/]ÏÏfϼ_}ÀTçÁ+‹Ä,ƒ,{ÅJ'µFO³å,>¥Æ3+Ì\?Ìb±›†s*ŽY¹ Ñ ¬ï„¼¤}}7²¡Í î9rœ÷_—¦£®§]yûrÊtƒìZö¡_Aöþ2Ö¤ÆMMv=…EAà~O ˆ§çœÞþ_%ÿÍ©qendstream +xÚ­XKÛF ¾ûWø(±"i4–ÔÛ&Ý4 òjÖhiZ[ö +‘%G’c¤è/?’zx×i¤X`5Cr8|“ã`îÓ_0O¬ç›t'g’d¾ÞÏüùŽ0¿Í¥ðç‘ç/-POV³ÇÏìrø^ê§óÕ–IV›ÎÓçWïV×ïÝ…1Æ1¡ç.â8qnÜÀùàAà\¹‰qV‚þ[>´ œçײåÕë'WØE8ã\?‘õÕ¯´yýâÍ‹›Õ{áòâí› ‡·„~ûÊý´z9»^M„^D^´4úËìã'¾!Å^Î|ϤÉüDkß Òt¾ŸEÖx62º/g7³ß.‚‹ærê‚m=Å"H½4´—í·€½l:X0$p@;µ Íx¤Ë’lg­ï¬îrÒr;7]ÖAÑc‹ýÒyçšÀÉvù•‰Åwe0—£ ½àE½Ó8-Ý)÷…Îw 4‡ÍW7Lœ¼X&De±/º|£'Ž )rpDW·92¡ó¬´‹îS§èä@V–5˜ž”éDuPGgšººz+ß®—a“íÝ0vn±àKu_W­ÞÕÈ`ì ¸,e…?³*ß$ÒÎÏIˆuw0>Vë†QÊ倈è=— ¬f®¦b« ‡Â0a©žÒðÍëú(s',ØÑ7Á™åˆÌ[X±]ø}¢Ïгå©£$¿^6¹À¤Ñ¢.UæC&æ‰}ÇæšhÀFÌûëú``$%ð¤‹ÅC7¸b$(¬¯ÑªÕ›-@cš <¼¦"2t^ 1[X +)?£÷ù¤† ­q-TÇ¿îB /\*©¾Êê +å^ß•Cç…N½ÏOaíÙôõ)OÎ/‹a’BºJ<-BŒ> endobj -6883 0 obj << -/D [6881 0 R /XYZ 85.039 781.388 null] +7201 0 obj << +/D [7199 0 R /XYZ 85.039 781.388 null] >> endobj -2610 0 obj << -/D [6881 0 R /XYZ 85.039 613.296 null] +2666 0 obj << +/D [7199 0 R /XYZ 85.039 761.463 null] >> endobj -6884 0 obj << -/D [6881 0 R /XYZ 85.039 576.429 null] +7202 0 obj << +/D [7199 0 R /XYZ 85.039 741.134 null] >> endobj -2614 0 obj << -/D [6881 0 R /XYZ 85.039 412.326 null] +2670 0 obj << +/D [7199 0 R /XYZ 85.039 577.031 null] >> endobj -6885 0 obj << -/D [6881 0 R /XYZ 85.039 377.581 null] +7203 0 obj << +/D [7199 0 R /XYZ 85.039 542.285 null] >> endobj -2618 0 obj << -/D [6881 0 R /XYZ 85.039 308.322 null] +2674 0 obj << +/D [7199 0 R /XYZ 85.039 473.027 null] >> endobj -6886 0 obj << -/D [6881 0 R /XYZ 85.039 273.576 null] +7204 0 obj << +/D [7199 0 R /XYZ 85.039 438.281 null] >> endobj -6880 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F58 3360 0 R >> +7198 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6889 0 obj << -/Length 232 +7207 0 obj << +/Length 220 /Filter /FlateDecode >> stream -xÚu;O1 „ûý)“"Æ8ö$@¢¢ˆhÏé`¥ãøÿx¹e%N‹ÒDšñø“C{äªJs¥H­îñ}@·5år Ù‘T@S²ÿŠÕÈR¡¥Õ„8/‰šÌk–MÎ.#ä,®¿8.˜Ô)h«®?Ýúë äßB”\ü „»~uMPj™F£fQƒiPI~F{hä÷ã×Ãîù3 ‘ühèÇÃÛÇvJÎû‚8¦Ì–°Z-^”ÿ¨ÿVnKSëE Û„+(M> endobj -6890 0 obj << -/D [6888 0 R /XYZ 85.039 781.388 null] +7208 0 obj << +/D [7206 0 R /XYZ 85.039 781.388 null] >> endobj -2622 0 obj << -/D [6888 0 R /XYZ 85.039 542.44 null] +2678 0 obj << +/D [7206 0 R /XYZ 85.039 542.44 null] >> endobj -6887 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +7205 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6893 0 obj << -/Length 1996 +7211 0 obj << +/Length 2019 /Filter /FlateDecode >> stream -xÚ¥XÛŽãÆ}×W~1D½lvóf kg³ca;9±ÙJ¢VÄð"“ÔŽçïS·¦(‰ ;ìKuUuÕéÓÕÒ^ÿ´—F*0™—¤Z™4õ¶õ"ð>ÃÌû… Y í™É•›]Å¡ -l2+#6V‰Î”±e¾]/Þü= ¼0Pql¼õÞ9§JÓÈ[ï>úƨå*Š}(–+'þc^/µ¿Y®´ŸãHìoÅö©‚Á²‡?ÃòÓúûÅ»õhûJëŒw· -2Iøªëq”¨H›©ëÚÂfâ©ëa _í\×è¼Íü‡fèZpVû»Óv(Ûæž²üU7Î2䆎<¨,È&nDiªt˜‘ë„L'þm!@UÁÝ-†\ 3ÈËF„0¦:ö«²x ÝóÈP |?ˆÜË2LýöÄs¤*o¸s\®ÂÄ'éÌíÛ®æ%ôZn~YF±ŸWå†ò¡¸PÙ±Ì3ô79Oö£Â/8<ö ÂÖ@„ÅÛqÐÓÎÎFI¸’£ÓÑyÈ&_#~9Zχ5eÆpШÊ'²X½pŸ7{rvHÊr˜hÙr;¢ƒí¦*jîS"ð‹aañR¬íó²ê¹ q ÑEê´Íýš"‚3äŸͣó ‡Ö¸0di>ïy½¸“ChÜ–eK·xŠÒoH´á)Æ/Í°®Ýä„Ú Ï=/-Fã©làïg@6…rÃDüu™XóŽpçí Ó¸ÃÑÄß   ùöÃnpÚ°áþ $ü²aU£@Ûí\кk+˜gì5 ±8ˆü£C²…rÜ”#YìJ§p'¶Ä»mÞÑðæiœÀåB†YŠ`^BšÏ<&׳c¡ë¾E ÔÇÍžŽÔ Šºu_Q̸½ãsÂXÃØ~-´¶{újÔÌѺÞÕÀy”lç@µ§ÈVÇ‚#¾Rî 0w'òÇ™|$@;¼$ðä“ìhL8q͘ ‚Kâµ7¼sÖÔŸÐYã:ßÊ=f&6cجÄyBÕ¸“ÏMÛ;u§ ±Æª y½¤›ÈÜ­‹l`U¢cW…R½åƒÿOõë¢þžVY¿îÇYænaå¢J5—–ÀL®¿8tŸÙǦUt鲑Rúr“žjJ Lð–Íܸ„ç/ LÌW8$Ì%G%Å›€;ó¿}xÿcï~^j­ýÁ—7Ôȼ(þ d¾ãæ­¢ ô9,oÑøwpúþ°f°0Y¶Ä_ˆ¡f¼Úéì!”ºötäÑ5®|\¿ÿgüå§ejýKòI¥8-¦UŸñ î.ÇÞÆŽ˜í˺¬rÁ5Þ§­´Á³BšPÇ‘-p]+gc ·u?çב|4znæÕ¹ž4“Œ»Dh3-†ÿÔp‘ éãS=h‰|¼_´8¥”ÎÆ~bbúÌ7•Hö‡Ü½k.ìvÜë¹dÀ¢Y¬\J{W$§þËwwØÓR$ŒZ, øj¸ÁzQ\rÈ4܆Ú£hÛÚI9‡IÈ=ùN¨+—ÌÕÇ+>ÌVèñÓòLƒL¼q5³(¥Âe,4Ç íKf—HÐuƒö[AÙx8Õ–CøÍf -x¾Zbß?ÞêûE ’,ñž¡(7m½àW²‘~µx\üsúîÊÌ¿éЪ8BžS:½x^GF ƒLÅÀˆa(˯Ú[F!'ƒé}÷ûУ{(B0˜°µ¯ob¦™ŠLêM Ý:#2àÍ•&B'a‚ey7sUOÁÀG€Î'ÁŽ;+WÞZrfÂ9ooÓÙ׽δ -tâ…¡QIÄN³·Å– ËZ*|tstÿ*È+j&,z&å`+ߪè窺œÞ ,&JÞ¸cwsr»"—“6¾ÆuR%÷._¤*°æÞ/'€g} „Êð×Wð×sð7©2aò'Ô@𣠺§¶ž†CŠñ„Ä(tFgS'–"üCË•ê ðDÌYf -ï7cñēĤM®ŸwDojíý­'½‰Ÿ¢uuVËM'Õ!ò$B †6‘+÷âk.žö©¦Î‚»®`æKÑõøãtBߨ€tÕuÜ®pñ0–.8»ç/_‚Ðèù—;Ñìê7&KV€GUD[‹yw„°¾Aâ¿=ýaúr'„ÓUà*jWN“þßKW¸»Z†Ÿ¶¨Až·nfÜ{S)Û,Râ†Ëÿ=D·oÅËþßÓuME¯òœ» T˜Í“œ ŒŠa’E0Ì6ˆ¯£Ü­¢Ôx£žk‹ÿx1dendstream +xÚ¥XYÛF~ׯ ö‰¢v_¼ìCâ8Þ ‚lâQŽ85"†‡BRžÌ¿ß:º)RÇ» ãîêêªêꯎ¦ +$üSA i² I•0ilê… aåýB9Y ã+‹+¿ºŠµ6¹Æ#ƒ•I…b\üv½xó½––"ŽM°ÞÓzû14F,WQ$Ãõ¾X®Lœ„÷y½TáÃr¥Â)qøv_lž* –=ü–ŸÖ?,Þ­¯iÔF˜Dß2G ›ê©9Ê +cã3sd³ð®º Páö¸ʶyE¯ID&O¢U( ”l*z½óA\þ)•…ƒTO7xT¯³pÈËÆ1áÙUVe?0¡Ý1e(¿ßËR§a{ä5•7<9,W: ‰»u»¶«y˳–‡Ÿ—QæU¹R>3‘‹Áû€ùC΋ý(ð3’ÇxÍðš³6Çûêéd'¥Ä\¹£ÒÑxð,ºQ!ª2òÖó>GI™  ªò‰4V/<çýâ²ì&Ú¶i4°}¨Ššçtø‹naöÒiÛåeÕóü¨ÑDš´Í ùŠ<‚+dÅx̃· kÞÍYZÏ{ÞïÌÉÁ5þÈîH—Žxiè¿^C¼ H2þ¢8úöõ<Ï`í™Þ=• ™†pl +áuéDÈŒuý±LÖû}‹¾®¶<Ýzig7 øªpp¨ +¿b•Kå™@0ÞʶèœxdÝ“P0ñg‡UþŽ–¸}È”#“ ‡®ôžwŽ(¤ä]±#ãÉ°¸YBh°¶z¤÷bö„õîp„E÷Ú=ÈjÑX’“&a¾É9ÞCY¡‘CÉÞá5>DWº¤0ž@;ÁïeÎ9z®*Éu@S5kuø/çBžNÞ üÅÁF´¹xÜíÕåŽ2U‹Öu½[(:Š'§@|Å;cttðWgã­%ã­!ñᔢÅ:s8hkÇépÈ›w’ž÷žuLœ)]vI£#º¸yt¼%B¼Þ q6Æ(¹ŒËý ¨&isëö¶¼Ø·ÕÔøœNÉeB)9‚Â^ÊIš† çPôþ– œ]pàØGßK5KÀ°TC†Ã–]at¹§g"Õ`F4à }R9Ý\X1³±„…„VÆRží#RÚ´nÙ'‘ð4oÈOÙüŒûyˆJåÑ6KD.Úµx„ʃ|¿õ©­t'‚læS +/±ÓÉDBA±Å˜ë +—O–Àä”YŽ•“<ß0ÙFÐÒQ0IgŸz[ÊÝ\2="Yx'óä‹–?6mWl…ï&ý‚²RDÒÜhTt&L¬¾Ø¨hר|Ãwÿõ•þŠF-’4»ÕEB©/t/w(ëk”5ŒT ŒHµÑ¼6Ù„œ00ùXòžXÐõ˜ëìôÆ€ù ;¨–(’jSø’:—☶#éÞ`üíÝûûwÀþa© öüö×8½NÌÏoÝVŠŽÊughÝenûu½ýñ×QôOk¾rNf-fBB3/¹ˆ®=˜ºÆ÷ë÷põß¿þ¼Lmx­s[QÃ,+Üp ø?0òݾÖ!|……sj5¡ .3»Œ™W½KÓ«õ¡ƒés¼Zdzj&%^ûöMî“>Z¢¹# Ø©ÂÉÜåPFö¡wcÁàßiœÂ!Þ|o¦¨††T¤2qØîë±i›3Îào#‘ªÔñQ/¢Â;_[*ΪWÏîljÝO#bÍ°ÔïÉr“pÆèyèPXú²,J'–%J$±·l¨WŒW™I|2>Š#lé,ÇYb&Ϙä[Wp|Ea +Ö'¯êƒ×ÌåùÁ¨@=ù`Nì$¯'5®É&¶TÇyÊ¢—Ðn4¢“‘8©æŸg=«”H“$XÁ+Wgæ7^ê|xÿJÆ{÷7âªö½|ÅÍøj”z*`øhçÌx¦ViKþ”×Nxº:•Ô F¬HNuq Þ4VzY$6m] äÊHGá?ùg(êCÛåÝ OweU\ë9žh²ï ·3¾®€%†¶©^f;^Š‹`‰,I¿V$êÖ' ÞQ—(3ûeê eêe +Rf¢ú&bãWý¬ ¬¤øIÑ¥|Y-´Aʪ«jÁø$…GßC›$ˆá‘ãžK‰„Iƒ8±9µ_Sù cýtí?µÜÚ\Á˜ÄÏcàú¬ü(!m¡E«“1ÙyÚD„7wµ +¾kÁ¢àd”É„ŽbÀ®HO=Zzõ Óô“„ŽÕôŽS¨RDZ<ÁüsÑõøa &24B +Étʯ“ùýË䓸dáž&H+`Éj±\jILíTë†g5ö`X.‘}žá!¢©0øîÝ·î¤æïÒ? +|ÇUŒO÷NæoT´æŽÜ_¤ZgBIÄ-¤ZnÍÿgA‘0"Yqþ¿½Â^ ‰‘ÂÚ赈Ҹ¢Œ¡t;›ZŸ^ ¿‘ÿcž.¦endstream endobj -6892 0 obj << +7210 0 obj << /Type /Page -/Contents 6893 0 R -/Resources 6891 0 R +/Contents 7211 0 R +/Resources 7209 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6879 0 R +/Parent 7182 0 R +/Annots [ 7216 0 R 7217 0 R ] >> endobj -6894 0 obj << -/D [6892 0 R /XYZ 85.039 781.388 null] +7216 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [495.92 295.648 539.579 307.641] +/Subtype /Link +/A << /S /GoTo /D (tmpshare) >> >> endobj -6895 0 obj << -/D [6892 0 R /XYZ 85.039 761.463 null] +7217 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 284.523 105.43 293.546] +/Subtype /Link +/A << /S /GoTo /D (tmpshare) >> >> endobj -2626 0 obj << -/D [6892 0 R /XYZ 85.039 761.463 null] +7212 0 obj << +/D [7210 0 R /XYZ 85.039 781.388 null] >> endobj -3164 0 obj << -/D [6892 0 R /XYZ 85.039 657.513 null] +7213 0 obj << +/D [7210 0 R /XYZ 85.039 761.463 null] >> endobj -2630 0 obj << -/D [6892 0 R /XYZ 85.039 657.513 null] +2682 0 obj << +/D [7210 0 R /XYZ 85.039 761.463 null] >> endobj -6896 0 obj << -/D [6892 0 R /XYZ 85.039 615.228 null] +3227 0 obj << +/D [7210 0 R /XYZ 85.039 657.513 null] >> endobj -2634 0 obj << -/D [6892 0 R /XYZ 85.039 434.077 null] +2686 0 obj << +/D [7210 0 R /XYZ 85.039 657.513 null] >> endobj -6897 0 obj << -/D [6892 0 R /XYZ 85.039 391.123 null] +7214 0 obj << +/D [7210 0 R /XYZ 85.039 615.228 null] >> endobj -6898 0 obj << -/D [6892 0 R /XYZ 289.538 274.021 null] +2690 0 obj << +/D [7210 0 R /XYZ 85.039 447.626 null] >> endobj -6899 0 obj << -/D [6892 0 R /XYZ 85.039 178.043 null] +7215 0 obj << +/D [7210 0 R /XYZ 85.039 404.673 null] >> endobj -6891 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +7218 0 obj << +/D [7210 0 R /XYZ 85.039 270.775 null] +>> endobj +7219 0 obj << +/D [7210 0 R /XYZ 285.296 276.142 null] +>> endobj +7209 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6902 0 obj << -/Length 2762 +7222 0 obj << +/Length 3139 /Filter /FlateDecode >> stream -xÚ­Y[oÛF~÷¯úR -¨(‡×ûà¤Ië6Ífa±‹¶´DID(ŽCR±ýï÷܆Z´»Ø. ƒs9sΙ™3ß¹H-øS‹,ö/ÒLù:ËÛÓU°8ÀÌWJ(VB²rh^m®Öoãd¡?òÅf?ò‰ý(Ö‹Íî7ïõO×6o>.WZkOk¹JÓÌÛüô†G>-•wýë«kìE@üú¯—+åýòîç6Ë?6?_½Ù Š "@hŽZ|¹úí`±¾ -|g‹{h¾‚éÓ¨áÇ‘–~}õéê+ž‹¼jnÓ±Îü8Ó—»VñÌ®ãÀƒˆvý¡ÝKÜGÑÁGÇ©w#Å2̼Gì'^Ñ÷eƒý¾2 Å^oxª?òj\V¶-tLË3'âÙuÄùPv<ú¸ SÏœ™I[nq¶¬¾"óƒ‚Ïr1ŽÒ[C·AZoûúQ´¡³ëgàŒ—7E/:|Ï_‹Ït(löÝY¸bÇQÞǺì·ëA«¯ÈŽ®×à™í™·_—Ü– «ðɸ:æJ¦ó²UÊ—„_EèuL%¦ñ@Ššö í"/.ª®÷íŽÃÔrÞñuÝ™ïðX¯Bõ²Ð¹¹ xþ6¦çÆÑ> «…Î"ï‡÷ŸxvVIž*¶[ÇfylodO§`›æáÑnäb3M².‹n ŒÐ~2×~2í˜<Ì÷Ð> --«×ËæÐÍXkîµBžpèÖ‡ÕÓ+ ])©Æ]Ñžlžn4¤WâÖo“Ð"+?LA”½k4ɼ»Ö,uè=à=&¹÷7þ4†<Ų0Ñ€,7ð6GQÃy³ôÚ`è÷PàY=òÎÈÐB%Ïpx,Hö™gè4+»‹ÎòA XÒ,SÙ¥]W œètW¡NüXë)ÎœPØÓ“œ3ÏP;Ò‰ÅﱬïöøÖkî£öø=™†”ÁÛ£qÙI¤áÌK" ıa¡E4Z*»pÇnÅ`ûÜM¨á¬/¯U« ®%’ké‹ -Y¢Êyì­Þâ7Â.ìüðÔ_FIàgyºH¢ÐWêϦöS4ã.W–ÕjäEÎp¢j”D~’(+õ|zª¸ÔDeÿÅ„ÕËŠi¹Š^¾ˆRòá°árV¸Ì‚Í/Ò‘¯ƒtÆÍ‘o ¼nÏ)ÛSÕ5öÀ,MÓ™Z¦~âÍd@Ûöm½*ê~õVñŠþH~ÿ|8rÿmÂ_“ˆÀ#@¨î,T¸raw€+þr•Ïí¤r]~]JLž‚gj6¡'0FW8¼H„ÍO ÖRg€†0¼=iŽV½ãYÜ1!a˜†Þ®Ü¬8OVM׃“)ðÅ0w¨¦áïz8­v]³…Y>ö×1žkÞT‹èFÖ#…Yì€CÃAR܈Øy7êßšÓÌ9œ -Æ5ò¯~¹·ÅCÐA6vöà `o@Bëéa]eZŸÍQr¾% 3•0¶[âݦûe’Åj‚Î$x«`Ö4£wp/ã¢ùê s|5 vlÖÄ•Ž«Ä#»™ã#< b!Là0„‚‡iX#ˆý|8c¥Ì‚8*å(«±ÇˆJ…âÄ RÅÚ,.!ïä,åhžUHM1tï•mÌ°[%Ž­•'«F§¡!P­¾ìzŒŽT Pó-z^º§û á¯UÅ÷÷äç‚L«:ÞÓŽ°h¤Ñ,)dÚ&Š5@;/e~ ¡k³†Qâä@QžÃHLzŒbºjB·’ )Ip¶)nuϨdY½¤’CÀ]¦eQ¢ü(âdô‡ -B8çÆ xò¢ ^d¤l›ÐêŠ=*l–d!D§eûœžèþLÏ‘æ2}Ì3_§zàƒzª‹{RAâgqö¢4Kó²8¥Blq"ï!P§ƒÅ†¥rRÓ>2A²N8^£@N=š^$’°Ùšvd9b»OÎ4{œÄTÛ˜†žFXÃ’üJO'2uš‘wÂ~ø$2œ8›„8ˆâ<¡žjÈzöLkó'ö‘’qÞÌ ‚¹ÕðΧX'è‚p÷T …–l÷@ `!yÉ GEê_œÁq’.€\Ú‰Ü.X¯ŸÆú¿«2í‡:œ ¬à²Oö,ZnõExfuZ…hêÁô¹*?c¶ËÔOrÐ<‰ý$à÷úÞX”(/7*ä*÷³”x.¾,”&h¦qÚ¤ÿ¸-XßœÔâš.&Ê2ߕØQ6ɳ?R!,Õ )ûo¼²î<²ž›“À­ça2dë9Ø×É„ò¢e¦–âÉ/ýX%ƒ`Y¹®¬ñß[þV@uiâësáƒ!9á3“H‚¼ÄJÑc,Öuu{¬ç±¯éüßí¢p?ÓÑb…Ëò¿f¢@ðFß8}…Ãxkõ" -[<²ðYv8=Â/Š³o•÷ñŒ —80 ¹ûÖÐÍÎû¼³!ξºùñ–L?.„ -ÿÄ:+2 .D—Û‡×L ܸ*Y5î\£5RõõÝ r}¿áU6¾`GÀ\=ðj¶_Š.žâl<Ù1p³U¥æ[AÞ1Â0†?üÖ•Ä4ƒ[ê$pnÜ\ŠªWålйyýaM%?Dd³'åúE;ÁY[Ò’ãÖ·nÑOk.Zv¶üùK¹›Æª™ X_:^–Õ&'0Ô>êZÄ—aóvƲ$Jíôl¾Ùñ w|Iwý7µj¸`G»$ë]†ú2Œ¡EИÛsc+‰ds›Â{ “Èq÷‰ss8SðçI¹š;) †qZÒ9ëñp´÷äIÙ`#ÊXP'K§ª&wÏs|ñ®fäq€*ŠÃ:³'¿By½ÿ‘y4«£XwiÏ®—Ž¥J _¶hÌ”‹ckª½­ ÇA@e)œ²†Œ°º­…9ÿ6 ä~M1ÄO“ÜWt±æ,⹊ -¤ò;C[9<ì‡_Bç7[Ðêö—ÎDò‹ßG]ñÊùŽ è–jèܾ‘(ªëΧi[@@¬OªÁéX ¡s”†"ù%™öÒÎÛòTð‹ŠÈ@aöSJIÕð¹J8ÙÍ=€k¼bÌh(e@pà2=°4°Ñ±üÒhcçdß;$ŠRxÑ}AÀ2„4$ª=9XŽ¦ë§¤xTqh\YôÓHÉV^ óÉ L½¢3îU§Íh¾XqOϬž±€*4…,aÍÒžée>ðàX4g‚sM—…3†—×ðg ×=²˜£}¤¢ ˜ö3 -ÞÇB•x_Îc­&éç‡ÜsÊ!(ñXÜuLn‹¯Ø†3a€$(¢‘éÏ -3}ë[%-@ bC°>ªsÛ”½ åãÀﻊÌ ¬áUc"aÃ|v‰bˆ_+yáN¦AĈ{¾ÙÝI0»5‡vøéçJÚ|Ö -¹|˜ÏÅ/ðÏ{ýK?­:™/„zù| ‡¡*« žm¤Oõµ?Á^(üòáJendstream +xÚÍZ[oÛ8~ϯ0æIjEII\`ÒÛLfÚ¢Ûf³˜Îƒl˶PYòHrÒüû=’’c¥ÍNgEKâåððð\¾s1‹àOÌ2FÒÌÒL„2Ëf«ýE4ÛBÏÂŽˆf*Œ]Ïo.._ëd&¢ÐDfv³¡!7ëß‚?]½¿yõa¾RR†óEšfÁÍO¯¸åã\WoŸ_á—‚Á¯àûÅ|!‚_Þ\cßÍü÷›Ÿ/^ÝŒ]¨P%Wýãâ·ß£Ùûù" +¥Éfwð…˜ÙþBij%íwuññâž +÷©ÏšØÛÂXÈ(Ì2å7)ôÄ&ßWÀjlç<¤Nƒ´äó8 îñ; ò¾/jüî˦Æ&ô wõ;žÓŠ¶…¦åž=Ñì:¢¼-:n½ŸÇiЙH[¬°·(o‘xòÕ"®7vUXÒ8€6ÖÁžæÝs[æ Ò }Ç syïWÎpe´x.xÅdH +qÛ2#¸Pj‚Æ"¥, +–@6XÖ[îB2õi•E½†gu?Ïdð zMä—‚¡Y@Œ"#Í%½fŸ"¡p:õönwüý:á'¡xîѤJÕ—«Y'ër8€ÜÎøÖ!¿ –«âvnHFF­XcÏ=ÞÈCYÌ 9ÖæHOã"hXí½—ÅÀH§cEɆqvª:²=8 ÜûÀ²‹.F¢KŒó¬Ü³!W¯¹kW´¶$O‹–KFfÔ3-Ðeíue²Ù²d¦â˜Ræ<ã3†Tþ¬îˆÅùµsEÄ^ÍO¨Mw,b6‚ÀŸ8°At©Ò§¶Ä0—3êj­‰"¯ìo¦|!Õà™Ã¾„ „mÅO +ÊJOeᢄH²0‘§ðˆà¼4#P,3Æð#,i†€˜×œ,¨È";ó-öe¥ŸÄ¾É¦€¥îv¥s°à¶±"4­Zëgd棗 ·F\º Oh }„(œí‘ýå ­¥ì`¦±`,»í­ ³ Eñ0j¦³æsÍkû‚ª6îÆ ÀÀ ,„`˜r:) ¨‚ 14ƒCWÉ8,€Í`. |Y„‚HLÌúÎ->E?…Óèƒé‡—%€&0Ì• jkÓ›údÁG2QN]#g&¸-Ú‰„›4q2MÑÚÅÀÉôXœ‰N&Ó<í!Imí㫯kF™”œHiÓaÒ‹öžQxdrçàfi …Z½MáÐVÁ¯_à‘ c)¾m- ãØL;h¹–r-o”%ಜ]î÷¨–(p æNS(U‚qò_£Ô&‡ì”] ¸=—Þ »ãh~oó;*+Ø8úŒÛ š÷LÅÈ­<Õ{”閨B4Ç3·ËYÐÇ;±L{@¬g28ÓJ!v½*‚ÌéDáÏêC pªÑ<ÅBþ“%Ù$KQ£ÒGÉФÈðNPÑ¡ÌfIFYrâ ]=6žwÍœò+<¡‰êš†<ˆö>ûc&ÂH#¹wôN|“¨áòz/f/àh6ÂÈÀ)¬*‰oÓÙ„Mÿ{àçƒÃ’ß#Ñ);Õg£Ì)ðå…XéRH€SCÁžª!õ^¨^s7aŽ¿MiitR‚œ1I*?’€Jë O¡'86u,Ù¦ã<øú›&ÈY0;_ŽöaüL¿!®†¬æ&B~—¶!`S_Býóú:'4C&>ÐÄy ù@z„Y”4ßðÑ H¸=Ò‘ +žã¤ë?b…ûÃ\€ZüëÕ‡©¬!JÃ,sJìá¾r8Êòðþ?sNÎÙÈL('ظšK¼x“®_½»™ª‚Æ%éôò…4™°«N´òŸï®57©Í5Hñ¿`P‘\ŽÆ®¡¦‡ñºá§/èAJ´-znÌù›sǪDÓ4‰Ãx6A©;Je„É¢>Y¥å¯›ï/±Æ‹ï]³é9s€Ÿ©á"¶F¯uc×_5­ƒ\Õ<ÏWKŸ<ö” +W6… B¯N¥sh°’஬*~ó‰Z±æ‚èib±+½æüø$¤¢Ò'åt|©Ð6ûCÿƒ#J§?dC‰Í’F— +0 ue¼êÑŽ;¸Üqk¹&&'i”ݸ¦}ÓIAg$ÅpIÁ÷ÐÎ×äp)ÛÞò8ÜÌ®ézþ"Iã‹ÏFEð·PBO¢SîËŠªxÌqDÈŽNGŒ*ùðEµ_)4Ol6åø´S>mKýÜ KHºŒ1c÷Ž¬vö±pc©]HQîÖC åjÈH©†„Ÿ’jhíŠÞ_ üíà —³@–¾#ùD•NTňê)Yʹë®ìùæ¤çn–tØë(œZú´û"ŠpñyZQ?7Τ`ت´Ä)™3ÁòȈCª”% "Xß9o Gì}®’Q® 놟§œÎ†ji»-•ãZ´[J­ñ{[ìó²öÕ‡–i6ü|˜¦¦¾vÚ…Û¿B•FÚ-×%Ú"gE´u ›~Øû8pª‚³yä’d[)K±vE)5ðé7Ü4¾ÊŠk]£¡V/À¾Æk¡¶¶;ÁÊŸ¶™¡6±Ð:E&­Gèш·sIÔa)ÉWœøô„ªü ¶({-‚]„Ê1ÿá'øD©ço¾˜`šöXðØlÚσ'öiͪy±?Žþ$±Î†:Z‹MÈß.?Ø@|¸Š8ᇥ J-/’$$Á7ŸûË|¤ļº/kŽv Õ.‰gxSÒíñ ö;žR:ÖئºM]ðˆÛ2wCmK~à«ú-©\Œ³Ü})±=œ>Î@3 µ+j+[6ŽG©­'‚vpãAl< ·†©ð³ãëº{$…¬Åbåv*ãàçoÊ¥-ùõe‚ZêL{ø¯Å㞀L2Râé)žþî ŸJ?tÛÑÓ)ž1êÿ1ÅÓÚ|=Å{ËÉÖºh©.“² Òu8d®à°“æ.C‰ûK.ÜóÔ’ë+ ˆ`ºKP|%Ý áΆ‰t±Éé^­GWZyãìŠwfËÕƒUCŠ¿w•…%tÍÒ;¨½»wÿ'1*9Ü,ì¼æÖ;›r6ŸýÅ:ƒÆG³5fñ÷)ÎI¶fþªlM_ñtÔú‚ïû'™BšáýÊWó4§W|ÒÝÏ9ÿ®¾Yendstream endobj -6901 0 obj << +7221 0 obj << /Type /Page -/Contents 6902 0 R -/Resources 6900 0 R +/Contents 7222 0 R +/Resources 7220 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6879 0 R +/Parent 7227 0 R >> endobj -6903 0 obj << -/D [6901 0 R /XYZ 85.039 781.388 null] +7223 0 obj << +/D [7221 0 R /XYZ 85.039 781.388 null] >> endobj -2638 0 obj << -/D [6901 0 R /XYZ 85.039 530.827 null] +2694 0 obj << +/D [7221 0 R /XYZ 85.039 530.827 null] >> endobj -6904 0 obj << -/D [6901 0 R /XYZ 85.039 488.542 null] +7224 0 obj << +/D [7221 0 R /XYZ 85.039 488.542 null] >> endobj -6905 0 obj << -/D [6901 0 R /XYZ 85.039 461.443 null] +7225 0 obj << +/D [7221 0 R /XYZ 85.039 461.443 null] >> endobj -6906 0 obj << -/D [6901 0 R /XYZ 85.039 292.452 null] +7226 0 obj << +/D [7221 0 R /XYZ 85.039 307.213 null] >> endobj -6900 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +7220 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F62 4159 0 R /F20 3021 0 R /F64 4225 0 R /F18 4228 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6909 0 obj << -/Length 2880 +7230 0 obj << +/Length 2805 /Filter /FlateDecode >> stream -xÚ­ZÝÛ6ß¿ÂÈ“ ÄZQ¤¾¸‡$͵é¥Å]â;àÐökË»BdÉ‘äìîóE‰²½Û  ¬(j83ÎÇoè¨EÿÔ"OÂH‹,W¡ÎóÅf-náËWJ(VB²òh^¯¯®ÿ‘¤ …ET,Ö»‰OšD/ÖÛß‚7?½ú×úí‡åJkh.WY–ëŸÞòÌÇ¥ -^ýòú¾ ~ ïo–+üóý;ü¶^þ±þùêízTdB ÔâóÕoD‹-hüóUê"_ÜÃ8 -|Þ_ab´¼×W¯þ=²âofÁ«.mÚÄig0ˆ&6.Nç:Œu|Q\F„y“<ɆEÀ†GB=ç²R*µŠ«M Šñ$R³P*,’OB©,L‹x‘™ ˆ ů-t@ã–§VÉ£8TyŠ<Ÿ*ŒLQh¦ñƤÿ´-š¸~·W‹ZÐt1S–ù®<Ƥ¬Ê=·QI&[d* 3ÃÊþÒ.WqlË®ßHãà}Õ€úÇ|ÓÁÆU{:Þ‡ªE‚ž¿WM?غæ¥Õxmî,’6ýuupxS—B~³„ïºÜáÇc=€³&:Öw•Ç¸GÛáa*ôž‚”µìÌ›víÛ†ßȵkoê%š¿°›w0a&Â]àd»JY×~!jÜXÍfh?!+šÅ‡§çgŠ|%]x>ñ×=Lçq˜k³Xá²âÛœ~gAšžI–<›ZÒ$7H&I<)òPGƒV×gfPQæI¾ð8Is4Ï‹sQæËûpÄóÉ28¿àQx í~o›-éù”á¬nØåê -/X½ççk¤{÷#åGÈJ©à¿˜ù>ðWòx’Ÿ¨"8°©X 3o‘ñ:)Ðþo™ƒã=5pq{¬E³[rQÃò£ž‚Hï|çNÄ·AÊ—e’¶ª­óeôØQŠíJqâ»AòO¡ãÇ» £w; 1f¨û‘_&µ «eÄÍÑù»¶ã™=Mõ$Ðâm -ˆ6¶¬¥Ä@nùËh7Ëö€™OñâµÝ2ëƒe¶÷¤U‡ÑõbÎì~Añéwƒ»¿©yŽl±Œ30Eëy¢(+ðØ”‰ãÀ6ü¬šMÛuNÖfÀeÍcßùM˜Ä˜{‘Ç]Û ²É“ÀÖ¸rd©{^7óâju¦dÝË Œ³0Ï㉯«Â~ ¾ œ/qÖ°2—•pL笕 µN…âË25¢mµEæipDie×_fž&F–Ötn%Ú -Ó:ÛÌú }è÷hw<ŽübÏ—ðÁ$¢$µ(!¦þid¡ÒàöXºX0* 솣›OBç1`ðÙ´¯ƒØ “À­A0¦E¼¹+7¨Ï'&½gÇp¼Ó™`Í£;üþ+eûª¹åáPŽ~°Ý^ÖC>: 䡤ꄵ0³Xª›äºPr:þØr°s­Á€' çóó…Ò®SsÑy "T}‘ãS¾…q¢ŸñÍ4LÓtîóÈ÷§LòP¥ñŸ°Ìæ.YqM%ÖǾì¨Ò_Œ¤$ÕÏú»s8ŠŠtd¢‰0Ïy}¦ÂQ¹ÑéA›PJ|åç)UÅ^f‚J2¥TE^‡ìNȳ)iLh‰(ºrwdx·L>f£ž‘“CVœU`ž —DørZ·üwìZ“î­C]ðBá„”¼L¸uœßo!¸ŒÎÎ6}že«QÝâ²à±‘Õ Ïf|ÊV0†¶œ>èËl“81š_h¤öÆbÎÁ(¹ Uƒ/ßY‘û{¤ *dTÁ²ùl¨ÞÉÙ ÎXϱ[Š"Úñ™ü§6yÁhÙ²AX.³ðºµ%#Õ”Œ(oçjîh¬0r ºÂ³;’g!Jnn_"”H1qp\}%ϱfƒ‚M9Ü ³–¶·¢¿½èçÒ×L°Æ’]·yÁÐL®`ý*Èe°ƒ$¸Ñ÷'x¡bYé+{Ž5!H yª¾¹7,ô³lN»P?Õ‚Ižï ÉC@_ÙBš¸øþm¡Çøé¶*&Àn ?¶ˆ1“þ‡²Â¿\s‡ÏS&ûG>D.m½$à)“Q -Ž£™Ä(̳B’ðC~°•Lí+¦‡O0 ìCm]0‹†Œ¦OD@?‘¥ÓÚËb舔«}ð SŒô‰ù(‚êC ¨I+=s{ß&/(5qC¹9’Qʆa®&σÝR@@Çï”×q@hÆû³Îa(Hee‹I*ϦH‡®­yÖe=\÷3IKÊæ»™GïÁ"醊¤ã ÖVtÄàôw‰!]íu9nO*¶Õ;~Rªqm7œ²ºGMx㟄ë‘k_)R¶vìâÛæÉ\﯇ðwm¾½|©ç{]m¢0ŠÓ YèÄCr9ðÀò£÷Ú2ç -8?‡Ï3d‹ŸðÔ¡$ ¯sòÆ2…¾Á/ãíGÇdg ya•-y|ï~!’xÜ]%ZõŒDz~{áziw£E« ÉèœõhwΙlçvRˆ³„m2ÞK^~¤†¥«ÊfK`âOKQÖˆYzf-§Î}Ž{ìEžwjç])kä: îìŸê|¼Â:é $GXªÑ-Ú€˜–¦‡ŸÙ H=™Ž£€ÚzÅ@)«}UÛŽ_vá ¥ÅžÝžÁªûŠNšiw -¨è˜y}ŽU¾ðLKñò¤WDËm TÁ«ºo/lø2r1itÒ&…çr˜ëny’Òž´¯°è÷(‰<»¸V¦ÓïZáÖ?ÊåÆ¿ûw"=OÝ;7‚˜¡‰A"í@W2{ép0¥QÉn^©l—®6·•L ¥V¥+§>ïGãt'C–÷(W£Óýeyèåâsu{Ë3#f„±\|º6§Ð˜#Ð&4~¨F(<¿xâ-¬ïÊŽwŒ7U2À‡„ÀÑóRºœQŠ«™ß Ù¾mzž£ÊÕñøžî†ÅMhå…§Çf‡¸ú鋧Z¼-7es-™Ža0WjêÛ>Ë~Ú°wfë;9ˆ}Ëy×`\ïÅAçµ’æØÚaõœ2zxíß´ÍtÈ­ÔÅýؾ¸~™•¹][óe6eG?ý™Y¦îKCóì.—;TÏûþFÛNÂ"ÃŽ8 U¢f°h;•ºÂ É¿³n¯Þ¿¿`7o±éë­|xxÀK&x„ˆ4áñ@ÏëÇÇ ©iÄ¥+Rd£eg7~(‘qÝ}ŒH£JTr\®¼ÝæR¥ñ4£ÂeAˆvÎjí”î1å*€9­ÔµÃ]tãi›,½£ö^I¡úS{»uy_îOìFÛÂË ´¢ºéD„´}‘—Äè·äˆÔW!;TR³Þ—LÜÙ¸(©&·˜lºƒ—ÑÛ\#`à·,#õHæø1kkÞ‚»ù«üîX¶â´m& ùÄïý: -ùšàô÷¼h!ü¦ÿ -0þi )ÓÅå>)‰ã0VN<0å§ú&:“\Ÿ+üôÜöendstream +xÚÍZÝsÛ¸÷_¡iJÍX @˜7Çq.¾ø’ÔVú1—›-Q6k‰t(ÊŽ^ú·w?ÀItâ»ë´ÌX°X,»‹ß."GþÉ‘3¡PÉÈ:*çF³Õ‘ÝÀÈGÒSˆ‘ElpèÕôèŤ‘Œ¦ "™ÎNßž|œž]Ž'J©@©p<±ÖÓ·gÜs5–ÁÉO¯N°¥ø ڧ㉠Þ]œãØtüËôÇ£³ioщu¬pÕ/G?ÿ"FsìÇ#ªÄá[„2IF«#mTh´òíåÑÕÑŸ[.<¦Gé5ïV¾`eÁþûÙìhÜÚ0ržKY¡Õ¸ . ¦5®¿¤•Tí’³Û4/Ö<µ ­Œ<Ýä:]ÓþçÈÜvGâàH–¼ ?”Y%AZ±Ê𵌳6Ìãx@ÒH0ÈN,˜UÀ'.HÉz0¡‘:Á©´qÁÛ d¢’8ºþÁ 1*#ðü•cOá 3îZæë:/n¸±@û)WL•rßz»®i?+n×d°øu ÔéÚÜ—}­³ªÀ¥ï ºí ö˜Õ<)'sA3ͪE:˸÷³0"«o%üJæQ"sìR0‘<è¶o‚†6z•®ß5Ê.Z”"@™Êš»Ó …£Hî èldî‰pQáðTYÂvW0ˆ2’³åc~…Â~ÜHFSVwcÚô´[EF$BÖqëô$º)¥—á`ãÔ»¿Ùõ€K¦³:ïöø’I톱‰a¬-Ñ/ªr^¾ü×xb"ü‘ÀaÓk²xl¡eÒïáúOÑËxøüýÇOSþ$e•Ë|¶åöëËù+q:‰ùó>Ýeõú˜[2ú‰?®·ƒH!¸˜ mdwöwW¯{”üY§Õ ÚX#ã +»Ë{ÿ2ÒX¹i¨Öå¦B¤ÆKjó]Ž—Ü”-þŠ, Írµ"üxfþr¤&:t¢ÁÙë¢ÓkªK¨Z@±””h‡ïWç?\aw9–€8þ‚#Ü<„°p·ÌáÁ|+' )ƒOïÏÿÆ_œß”a¾"ÔTð÷±S”há”uÊÍrÎ]|Î87¥„ëŽ.ÒQ¨ÀÌwà~[æm2ÄåÁÅq>C¼|ÉKÆíºik9ï +9;džgÒ&†Ø¸ÉÚe aLd–Uæ3صb6Ä>½ñ‹ÍJÆŽè#®cw{¬”º(Ò4IÒm¹nÜÂtù8`L1l›Tp[söß<+¶Cì@*éòÌC~RCàj(Òe>g†ùUCIæDO*(ô´¼¤ÃÄÀgè +2n¯éj¨ƱiÝò:«X e´&tÒµÚÇœ-÷ÙSëfÓšmÍb¤3ÊKÊM›™yñšDÊEéûØ-ÈuæhõŸ¶Çí¹Ä1´|öuÉg¥PUÿ†¢\V»`Ó¸,©ñ†;›‚ÚhZ­¸“#]C°‚¤›ÌŸHr´`¥-Ü,«s«Æ†ýD*´ ˜hعÿ ‰Æ¡‹£g›¨IBÇÏd÷[ ô)Ó\[À(žÁÛá—ö3Z£çP'v¨~æ8†ã‡/Y­¸PÔ…EÃNP@AhÁå²l±ij8Þ˜° Ïþð‹Æx²c¶Ü:n³‚É}Ô:¼'‰P¹‹6úä|`û +HEs,YÅF†nà$•óp÷ÔhËŽ¯>¶EÑ68Z°½ƒòŒs¤<¤m•‡¼`¾\6›žûÞº.‘JBuçšÕó§â‹AÀõâK¢ðâ.ñW_œ[_žR"Œ’]fó¼ÎÈC㦾¤¹ Je*mÙÉ9FTm‘sVS§©æ ëBÇ= 1  ì­™-•¯ð—»çiF†FöqÜÔ»hk0ʵ—¶z»+lñ‰”ÚÙÐUËå&*î2WŠÍø+ÝÞÉøݺPŠÍK²ä ;GÁsï6U57)hâ¯Nùçgp©ýì=wqüä‚47kŸ£ìy‚:L§kÁLÏ\“tÈf"ˆGº­Xîá\©â0V1*ÂjõïAm^JZƒWB¨óý—å0ºÁ—8‹DÁ¨|’ MÀ†¿<õ.*‡QÎJÙâqج”a‚wV‡Çß—c‚~>¸ì¿l$Yiï£/# +Ð…!v¾IÎnu¼8_ÉÑë$uB?äÉŽ©{¥‘n M¸*WP£àÈÈûÅìæ+ö‚9o"°o¬¹ƒ,s$vnÈYlSšþJqÄ›Ce¥I5M°aŽ,–TFQÊÅ{£¹~`W³¦«ŽÇÖõɯÖZ#LñB¹W4_o»ç¥E0/)Ï6+ÉOèâÁê?Vu ATÜnVûêLí‘c†Ádþõ`ÖžºÉ(Ê%5# ®Eù_h‹‹rò÷)br6îóÙf™¶óÕî>!ºàuVtT^âˆÅëG£~Í›øÞõB ÊÅ—næ×›§ÍY¬Êâ (-CWDôPYý»s‚¾Iæ¤}éûí¡b"mè‰B¾o8Íÿö“`d{>-%HƒíÃLÏú'6~ßkp-v#ÒY7oe0)çŒÙvÈæË–Ç¡¤¬íµyœëUÜ!~ŸZl4ç¾þœÎJuµ¯(xŽš›.íµt#ZßÚƒZ¢IR}BO°nÄÚyœi†hõùH„Ï"øVZ5I°¡kÛGÑ.;ÀnÊ.è+ÏŠ9½b’^lsËãyý'Ïe?ÑÅÑçYJ@s/Ã×{¹0‰Ute„Ëï&³’ümÅhÀŠ^nh£€“™”í¥F Ý’•ñhԼϴ8ŸïY~ÃC’|•/ÓŠy/Òšž±l?•_¶O|Ðýˆy;Ñrt²^y73ᾯ3oî¹Íáz°0f0ÇÃÿ‡À[Æï{ÎWXém­ì›Ž©#w>âPÅz·Êöo‚Q äendstream endobj -6908 0 obj << +7229 0 obj << /Type /Page -/Contents 6909 0 R -/Resources 6907 0 R +/Contents 7230 0 R +/Resources 7228 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6879 0 R +/Parent 7227 0 R >> endobj -6910 0 obj << -/D [6908 0 R /XYZ 85.039 781.388 null] +7231 0 obj << +/D [7229 0 R /XYZ 85.039 781.388 null] >> endobj -6911 0 obj << -/D [6908 0 R /XYZ 85.039 675.066 null] +7232 0 obj << +/D [7229 0 R /XYZ 85.039 371.126 null] >> endobj -6907 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F62 4047 0 R /F20 2961 0 R /F58 3360 0 R >> -/XObject << /Im1 4096 0 R >> +7228 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F58 3380 0 R /F35 3036 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6914 0 obj << -/Length 3150 +7235 0 obj << +/Length 2997 /Filter /FlateDecode >> stream -xÚÍÉrÛFö®¯àœ N™VÈMR<‰2¶£‘˜©šJrh ‰0X,ûïçmÝH9ä2år±—×ý–~;äÎøçÎâÐvüdÅ®íÇñls¸qf;Øùáƈ…€,0÷«›Û„Ë™ë؉“ÌVÛþžÐB¶Jµ~¼{Z}xž/|ß·|ßž/¢(¶V?~à•—¹kÝ}º¿ÃYÀ`þ0_¸Ö??>âÞjþû꧛+CˆAH¤â›_wf)PüÓcûI<{ƒ±c»°}¸2ì0ðe^ܼÜüË\Å{ÁŒOM1ú±Æþ9×n8àÚu=Ûw½Y:vèÄv5ÈEU]›Wå|øŽUÕü»Õƒ¢š/¼ØÚ¨ç.ž«ºz“ñlCw”pG™Ñ¸Íç¸Ð ýÈúÍ ÏU›}7_,ýÄj÷rn Py™2Š¼œ†–2¼¢ÞÂHÑmH#‚WeñaªÆÝí¶YÒQ,\”TBœ¥ÙoŽlò¬ÜÀ!ßK¬·}Vg<Ì[ü­7¼i- -Þ@ª–Ǫ@©Ts/B8\ÙTe©éÛ´\«A•pˆîŠ¡ˆ=Ð"«:®Àö*÷¦›‚åè[Žx„€5Éx9€­¯YÊ› ¿á™º¶æÛ‹l'a¾ïÊ -i^áLÈÛø´4W]ƒ×G¡Umñׂ5Sz§“pŸâ'°ºª^Êåw¯îKŽDíx©©äeö(ÛRVUQk<$‚o¼\wS’*$Óê[GfµOìúÉ{Œ#«é6øL{¦^e‘õ -ç× -§KÒÂu0Ñ’Úó6!I&—…ÓBWÏÁÒÚ"%ÈîçFZ9¬ðëƒøF¼UÕüËÖv@Éy-­"EJ2¾ø{D¹Ë[U¼k&¸~BPo†*\Wõ+SíZhoNh=ì3’(\à9 h”bWóŒÊÚÔmÞò’èYfé¹ZÁø3Þoëoš\Ü]ÇaÓªºe æ€(ùlÊKø¥xšªì`<¼\xd‰¸GjªÊ ~Y½ˆ…»•ºîÝ!êžëXOE¦H.pDŒRƒˆÄ;Ú½jE™ör-è¤xViÚ• Õ[µ¸G¼ëi‚Õ;ᄨoøoY2÷ç¬ÃæÝ)ë$CÚzAã?}l}RÍ+Î%„oÁokáÐå›ÁyŪiöQï£pºWS&¿AËE…8NÐvÐÖL „Èñ4/Ͳ¶””ŽMwÐô‹Ì¾¾„Q`ûËàj¦5€9Ï9’ØGnîAf‚3d®³´ã0¾ŠMÃ\G§Sœ!¾ç¤áy" ÏëC"=. DãêT§zE82Àâžïñäã˜ñA®èº®õoÌŸO9òýÈÃ`ÈÑõüÏ·½h:ûóíÄ‹`ô®Xøk±û'ÂóƒÀŽD£ð^î>ÄöÝ“ Vÿ¿ð'Àcôg<&ž-G,‚ß -œØúÏ<†Ä£ãw&cBÇUuûW\Ýi_0Ò&ñG´¨Æ.-tɱÁ´Ç^Y–Dæ9…ª3”ÑCŵF“Õ_L ¨5§ÆáÇ)`L·?âíKÏÜN“”â»–g-E•'I,é$h‰žd3rò˜€H©SŽ–ÓdÚGæm̯¼a -2$…YÀ‹ÇYˆF;E9'bÓòñ-…³Ã„¯Dð콤µv‡ªÕ£¹8Ë€²’J&å´þyNŠ9‡Zr§yÃA|ÑVüÛ¥ì8p<Ê`iÅ×0‘•ü,±ÆK ³ß$yœŽ­#¥ë³'/æ”á(ÏG–p¼ -훀ˆxûÝx”ü¦GVÕ—1„Z•ï˜V<×*—IÑ4–ø´ Ó5‚ÜU•WžÇ°œ¢“#Z€SŽF H“a•NÑãÀDÿrtÃp«Lðãe|Mˆ²M§ä­(þ©ÊlQè$Éi |~lùÑÄQ‰¼ˆ¾S -jJÙ÷\Àž3}Z®Š– UªîH½’öÕÀŽª ´²é€ø±GÞÕ€=€¹°5 R^ Ø×°™€}ØC|ÆÞWKØèJÊ;}Ìæ*]bö‘w1`ã±;|jÔ||ÄHýyÅëïþþŽÁíûìiwäöÍ.kùD¯¸žõôÐðàñ‰¥¤7e´l¯ÅIë;Q Òngèí`’Rç„ü´cü´3Àïø¬ØÈv.^»¼ÕTÛ¾x§„W+} uxí‰[X8Ìmõ4# G¿Né%æ³&@¸DÿêÄì_,o´OÔäK„ ÷g"Dê\$½(ÀvU{’Ç–ê ^[GС'zàµ7mÇU¹»£D”ã#p£±ÃO@ -•9‚3R-T…Êxà >…âñ÷xÑ ËëÁˆ{.°mè…1iO”œf ´Ç½íb`aSäâ²ùP^jý…ŠS{jY }‡ì€M{Ƀ`èx×›«˜‹Dà ÎåEr ›ñ WÑi2Ä÷ÜéHë;hÇ؃øœùœ¤üX¸Kä^ˆcöøƹ&­¨¨÷“„0冒„ PÆl‡Õ÷RhE?ŒéaXÃñPsq¬³/9¥QzS^gÅubÅ×qæþ%—4ÁùgªM0Ä)ÓÑÊ ƒ4Û*Ä]´<_“õ©T"³¬ŽõC|ˆFH{¤ÚݸDíSÞXì=²>s ¼üù…7nùgõðtKöcòàŒ¸‘Ó¥&X{‹ä¤ß0ÇŽÊ™±4{S@µÓçͱoĦèÏ’ÈREË¡c‡mHðŽÃö#L9}’ì JropíFµ¦}Ôw¦ñ ¿âBÝq£{ã¸Eî` ¤×­¬åY̧^“²YêÕAØ×A¨õ§Ñ×½!±)ã¡¥XÑݲ¼Íô¹¾V‡Aƒâ.«¥‹!ê '{¾øäA”Eqí%‰“Îþ¥@ÔGø}oªÀ¥xË>± ¨%bü>!ÓAw†!„T¼Ø°ÅÓUóšð£­TdrÃÑèYaÕ æûG£s_FR©¦;žD^>k¿ûŽúWèÜpÐ#ÆÙd·Ðw—“‰Ž‹Dֽ껨g T×V¨16 wè{Ê~™ðê˜çcɧ¸WŠ#Ážññ>;€­±nž™nö•M%«MõÓÇOßµÞòv/ŸnŒSàTZŽ:‰àΣè`Ê¿”ùüÕŠ–LtE‹7W¼)µYG¨„ÆfU)}÷5‹qí¤àrŠ7]çû‰×œr¹¾Õ»¬eÔ\n螸!t–8h5ãrcÄ3nN@ͤêl”4â~©œ’ziéôŒ®Y;(øä:Ú?=ì¾åä"a¹Ì$­äû+ÞçlkÐJÇ1—pÉ‘^ïRTóuow”zL«¸ “€e}[_ÏM§¬Þtk.Ù§šœfPßÜÄ{ìŽ>_âö‘ˆ\«µèÑ n¦ojôÈÔï×Èy:ø€o¨iŸ…Î4Œ¿œ±Ï_ ´¯ó8Ðá€R;U áǹçl›ÕÃ^J`­>ð×ušø¦ïm°É˜¼7è£ùB:‘庎c»5ËÀ\Ìr5 ²]Ìr¯a3YîUt:Ëâã,w¹]FãÆ6îœ~åpàööþñ‡nas7ûùvõé‰ÛxЗÇ0Ál+5hKÞè?Z/cÑÁÑ?NÀ®þ:†cui$ ÓýÃÀ"^ž"fó^F½%Á¯Anù«u- dsH«.† Ë©3¾žaMÇ¥¤ÏMáv·3nör.¸+!bp5]™e°R~Ðx -@Ì/$Þ’ëõDÀ„Ä¢Ly !Å”Îä¸*±,––RÕò×Ø^«Î0Éù¡dŠRÆ)ãâsèD@ã@†Q0&gw¥Õç– é©/”Œp¬ºÔc5@ÈJ³Ýw8®k4»½]结ž¹kݶ]ÖáÒ/ÿE)í‰ð]¨†ÛK¦ìþ3§éO{=9;ö“iÛ=Ïö\M }Bs’SzõŸü?þîendstream +xÚÍZmoÜ6þî_±÷)ÚCW‘DŠ’ +Ü'MS·i/½G[Ú]ÁZÉ•´q Ü¿y£¤Ý•Ý\rÃßÉ’Ï33t¸à'\¤±¨l‘¤¡¯Òtq³; ¨y}J‹`¡ýÀÄXõâêìù÷±Y„ŸÙâjMM®òß¼—?œ¿½zõn¹RJyJùËU’¤ÞÕ¯¸ärzç?¿8Çœ†Æ¯ ÿr¹ +½ŸÞ\`ÝÕò÷«Ï^]M&]i_…³þqöÛïÁ"‡…ýxø*K÷ü0Ë»3+?ÖJòÕÙåÙ?†Q¸N/¸×Œl+?J ¡?Mõ dÏÙí–Qâ]/Wð71ÞyÕ5Ë•ï+· L‚Qî–k–Qê5{¨j¥iSÿ+õ†s˜„ºªÀl +Ù8@u<ÿ^M&‘ÄzXʵ£¬¹áÁjuì§a"í`°gY72y÷Pãzz˜ÒâJ?`±áU·-”6mÇ+¹/û-WöTÛõwì¸ÚÖÎyÐ~k{\Ëb…‰Ÿ¢FCÔ}F«èE-*L½÷Ë8öh˜²ÙwXÊ,ÛAo}Ó–EÇmï·E+Ýð”XÖ¿åN·(EAî Rº”½$ªfÃíls¢BÙ`óÒas°µ_¹Ù¥oñ¡ìzØ`­2ïj\ƒmG1,H•{ÒÉp4Š–4¨ YCxƒ ¶kêŽËhk0q¿-—¡;HTrpä¸hgqήXïYx^¹ÁòâKQ¶²–:+£RsúÛ•M}´²?öƒ:P qƒDr’6Ô±ç^7Ís;7J³ž +l? X0”¤·÷t/pïQÊ‚±¢©¥ »¦uUkþöÛbî†ÄÆ×iü7$óõp“&û“Ò2au™×Ë9„B+ßnÛà’ïk^Hq[p |@À•À7š ‡«ÚÍ‚ï^?0¯>ð)—#]ÉšO£ã™Œö `Z0EµÇö»Ã3ߨ¶IÃuÁÙ$KgÕΪœÅÝö³LÍA,,>ƒ«Ä“xÚàøûIjùöX°xÌèÕËKbt³omO $›»vǯA˜«8c«Š@Yo¸ÎX=‚WÉ—û·x3¨/÷†Úö¶”Iºý5äë¢?=HÚÓèPŽSöÂ;f`•ñÃpd¯8‘õ·MÕ\Ûªû]nÄa›)Vù¾ÏmâÇÛl›‘Á!/êNý?çoÞÌ à¤jñþ Ë‡üÉïó‡‡S)ë¾h×ö¦èºý6˜™îºDÜÇÇýšº:\ï¯Pó‘:9¸C±Ÿ%éb&”2ó–Ó*‚Û~ž%`¡(ÚãLEO[(x®‚Œø Ÿ©£A|%¸-¾Á +íÕ4¨˜¡þëm}#]·„zV#Ψ¹hgsG…¡·&›A†#è|àLǘOtÁ÷ +–ÖS~‘)È| ê{jŒ7®’±uÏ,c{æGLÒºf6¾oÉ0éùÙžˆ+"‹§acý@¢jX?w×öÅ¿åbÏÞÁ¹™äóV(“ËBؘÀ‡rØ4¢ÉÌØTñ±MÅJw³"ÀH÷»¶¹&0#ÉpWÌĆ´õfèT»Ÿ\ˆª¬§† B#*,ÛòƦ¬SÇYˆ7Ç'9°‰à@£Dpþþo¬¥fY+ùtÖ ++ ¿;•8Ø̱,ðÉßíQQ"~’3ဋq—Bï[0qì›.¯ Pï– +îRE½p¯¹Å£r‡w7õV/ð›x/.^_¾z· a‚Â÷HŠ Cm2^ìÓ&ˆò úÌ=ÀÆ™ÏBj•ˆíTvIÏGhp¢ø«àgk¥uäýJ.ìžw½Û}V9g7Ÿd^Fÿ¨(ÞÑ`¯°ÓæÇ(j÷³Øñu˹£€&öEѲGÝ"šýÓà‡p&o&à›&”ÉÉXsÃú0zŸsi)‹›bùä‘‚âØl5ôìqQ=Î=gÌ¿ÜûP’ü‰VG¢£²OÀYMŒk¹ÆÁͨ œ‰-UN£ý€ß5ÙÄ;Î £ch(ÛsT&Ø;d·áúæ¶ £„Fë¦3Œ¦d’¸÷!¶Q"åGà¢LµQ•]_Ôƒ‘h²”ð»Ï+0-Æ;åÒP·´JÁÿù»°6H(»ø·+ 6Ì4Æ‚õ´XãÂMšSjyMÁ\É6B.¹ÝôtòbÆÞÓ­kì=‰8 ·CÐÇx¸ª‡7CÑÛÚÑPf~RÌxƒ(,4¢/UÊ£†´ò.Ö“._Jäk\¨Ë8"/\¸ ¼•Ã»`bn~/ÛaMÒnõDŠO7n£Ê»ÞQªí‡P9éÑ–“ˆÃ '¤ÛrC¦¾ðý¡¢ŠÖ½ÆÈ»#éöáDÃѦ·&ÙÔSV:õÓ(Y¬24 ?ƒã/ÅÀ.REÃCÛ“ ÑÇ0pûå/8}Ž-_¾¹ÀGù_®¸ìßXÿ×gsn)àR¤3¡‹puÜW²E°pahå­{ý&Ǭ⋷<™oiå'e|ØÓæ0¼/D4>A <ù=™9Åÿ)Uñ‹i9¶ k?²O³&ræ¶Xürii,)‰A:Fb‹i¢Ž™š«­¤Ú¦b—Ä8§'$¦zÖÏ€y–ENýRÆï œ0d6(?&h‰:ˆh4O\ƒ<|ÐB„Àä}K°AuëtP·ðø€&ðøàÙÁþy3>tã\¼€h|gîÆè8–¿Gаœþî—˧ž‘åÂ8—%=â4'¥N#÷GÏÈc„sfÛ§ŽÁdìñQEœl7ÿðhþ˜­oàtóé@c¾ ÐDĉÀ0áÀ7B] ÀY¼ÓT} ÞÀ!YåüøólZí«Á®¶Ha¸Šp»“Š÷¢tLÓ¤V탋ı¹Ÿ÷K +ƒ`Ãå~Úãu†æôõû¿–ìendstream endobj -6913 0 obj << +7234 0 obj << /Type /Page -/Contents 6914 0 R -/Resources 6912 0 R +/Contents 7235 0 R +/Resources 7233 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6920 0 R +/Parent 7227 0 R +/Annots [ 7237 0 R 7240 0 R ] >> endobj -6915 0 obj << -/D [6913 0 R /XYZ 85.039 781.388 null] +7237 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [428.982 706.739 495.672 718.428] +/Subtype /Link +/A << /S /GoTo /D (modif1) >> >> endobj -6916 0 obj << -/D [6913 0 R /XYZ 85.039 599.342 null] +7240 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [195.437 494.402 262.127 506.091] +/Subtype /Link +/A << /S /GoTo /D (modif2) >> >> endobj -6917 0 obj << -/D [6913 0 R /XYZ 85.039 463.85 null] +7236 0 obj << +/D [7234 0 R /XYZ 85.039 781.388 null] >> endobj -6918 0 obj << -/D [6913 0 R /XYZ 85.039 371.126 null] +7238 0 obj << +/D [7234 0 R /XYZ 85.039 692.99 null] >> endobj -6919 0 obj << -/D [6913 0 R /XYZ 85.039 124.514 null] +7239 0 obj << +/D [7234 0 R /XYZ 190.402 698.964 null] >> endobj -6912 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R >> +7241 0 obj << +/D [7234 0 R /XYZ 85.039 480.653 null] +>> endobj +7242 0 obj << +/D [7234 0 R /XYZ 168.856 486.627 null] +>> endobj +7243 0 obj << +/D [7234 0 R /XYZ 85.039 242.111 null] +>> endobj +7244 0 obj << +/D [7234 0 R /XYZ 85.039 147.569 null] +>> endobj +7245 0 obj << +/D [7234 0 R /XYZ 85.039 81.944 null] +>> endobj +7233 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F18 4228 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6923 0 obj << -/Length 2630 +7248 0 obj << +/Length 3557 /Filter /FlateDecode >> stream -xÚ¥koãÆñ»q@ -¨h.—Ï|(pvœ‹Ó6¹Þ©Š$(‘²XS¤BRçó¿Ï¼–K¢€çƒÈÝÙ™ÙyÏPY.üSV8®N¬(VŽŽck³¿q­'Øùp£b) ËÌÝêæöû ´”ë$nb­¶žÀñm­²_ìûÞ\=|Z,µÖ¶ÖÎbE±½úáW>/”ýþŸwïñÍàx¿_,•ý÷<âÞjñÛêÇ›‡UÏHOˆ&ÈÅï7¿üæZpüãëè$¶^àÙulïo€ 'ðµ¼—7ŸoþÕ£â=ßâSç.í{¡ãEø8±_'§cíxÚ;KÎ!º\DC‡\@ÃO=ŲTÊs´ò¬e€”UÐk"ô-¥œ$PJEN˜xVäyŽÊUüTƒ@;nþVª<ŒB'Œâ´~·”ãúI¢fôLü×¢…Ûǽ²¾«SkÂ,ã]Ž³*™ -B'ñ#+L\'öCböõÂÈ.ZüíüDvݶȱ†›”9ït5CÒƒåø¸)¶¯¼Óír~8¤mû²@< /¶›ŒWSDVWOüöRt;9†Xv :¶yS!ðžeȇ…¿-¬×eIˆ_p¿ý…ŒZW`f]ª¥“kâqƒe‘W{Âííºx -_ˆùÐÝv{¹î/ÿý?$±«2ü1_ó/-߶ɻ·Zõ“,(´F–òÿÛŽ='Ö¾µÄcÉŸs…©»*ì"Û…@…^䀟¢®àö‘¿ÖÊ~E×G|qY ®tyÃK¤{DÝãö @Ýãöäxk^KÙ"”Ý\ GÐàå}û½›²1ÅÑMÛ¿1ÄôRžã&¾Pϵ¨è@xô}m?nÏ\.«ñîßt¼Õ‰aâ}i»d›¨Ÿù5%k°À6Á¢ˆ­Ðç@`ÎjíÙ½µ5uØ÷´ÄÂJŸrbÉïY*"ÏnSdïµå·äžØ_A`§%¨À.É'Ðí㬧{aÄZM/EØ™³/ˆjÓ-H8cqkOe‡"Íwä±ûùŒ²ß‘¾öœÄ€­pR‹L‰ ñØäôÜ•¯,EøŽŽÂ‰™Áî¸è]´¨øWÔÖð›1e;›ºÂ8á˜Èví‚ÛP¼Û - (Ü0)»åܸN3ÞACII;í TÙ3¢Ô#Qúež‘£nC{t·ôȸJ(¤Mþíib` üФ®“,Ù;óèŒ3ƒªT¨zLxéôW7P'$5dÐò,I¹BR‡æ‘äàRahïÈ‚¿,8–jL"»”ã+‡q-Ic8X%°Ü»ä5€Š@ê½ ©÷”ý‹Z3g_Û.§@@2¡õõQœ ž³ WßÈëfE)DÁüFÇXéñ ©³Ë¢LÕôö²gåÛ5ÖŠG²‹ÖàBB¹P3 Ö0³’bÐcBV׳Ö0G²·†Y’ÆF$§ž -Á+„àU þtlûø(NÂ1#ñ¯®òŸPCMÚµˆ¯ ‹>UÕMc¬aÓ]’©Å&±^–é輇EaÔc næd:KÒÈtž¤ÈtLrð° zëaA Õmù¢´¾’\2^ݤ­€I×°ŸVò0%‚¾5¦ƒIQR% Ê«”ëE9Ëii\òI* #,y©>žO},ÏJYñÈNñ´ãµ¼ªÑFÌëí%SБÞS€.»—B.³YS˜#Ù›Â,Ic -#’ã$tH;#”O%Ëh&ôpöѬ9Sr]qÆ(C³;Iyr¿ƒŒ *|žfQ.æ)Ò儾#7û‹¢‡ …к΋~šñBB9ä³¢Ÿ#Ù‹~–¤ýˆä¨tÔƒW»RFô.´1ÑïõСÖL˜ë3<3¼îS©†Žˆ ø*â¯G:NYÉé4ƶ¢ÊOÇJ -ëñ§ÕR»_S/ü^`/SþåmŸŸ)üÌyöXGŠc‚uÒ\@×< -ö•„&ŽgRFèvG®^ÊÞÚôh¸—®K> -:",5¯ÓåÍÚnBv¿‡h×òUBoÜcà ¤ï1²¢áSOPhÓÃáØ@è;‘'gòŽH€ÀÃȵWTišÎù”´4^bÈíòòÀÂó]hu’iM e vŒÓ§,@¯¶X‚x„‹ªíš£¼XÙ‚çÚÿ]Ä>É× &òÅ×|ÜðÓႬrqŸâA_†mPSϼCa ƒ6¿äüîë#÷Žü^o™ÁmŸ¼0+Lå,øÚCºÉY(|ÅI¶ãbÒ¦Ž€¢À؇ª¾tŸ¸.5O3ÊQЙ@ÈÙ–™2‚w.LÔ¼( ú|nø7‚9B ”‘îñ ­ø„˜rC -hsÔ Ì<9ÇôÀÁ™ôàLÊ·?âDñ¯fÝ“SiV?>ŒœŽ*£öŽß¿fá…e쫱SºžG±¹Ú>Áßùþ3ò"º{üðžŸJ)û?Ÿ¦V¯9ª(‡IHº,…¯¼@°W³Ú܇­“ã›Í»ÁÄ·fä !T`~¤Êßå ~ÞeuË›o‡ïÌ”LÆVëpà1¼£ÀÅ&<¼N#â›,‹V¶Ñ瘪æp–@W‡ð™34h½? -Ÿµ\Uy¦2sÔy3m½“¡õöÑßùp «)ÿŒ¬§X•>{© -š…ZÎo)hQÝ -h©ñ‚Õ¶ØeÚð"sؘ¾ ¶§Ó©ònM¡± -<=ñ#{F]‡$ 0¦ aèT:æ"¤Ó'ÔfäÙ«E)_Š/sô1-1¸¾òû&•¬1Üg?²—ò[èmÏËdf°^Ñuè1 MŠô ZOkù¦/üøÎRÞ®‘Æ<1W²šëêœaÔÛÓIɶ¦ 2LqY. ˆíþ$6ו™¨ôÖ‘gÓz§OB2kûÑ%^Sª,!þ–!Ög2* ¡Ò¼Ò…€.Ïd ÐÕ™Ì,IS«Î“”ZuL;é¯pçãáT#׊$½ÌLÛ¬ºîUg—Ä£' ¯4Ô# Ë]”º:¤˜%Ù‹g–¤ψdšaÅy½\¼È·?ò«²†‹!üi®\`ïî?À4Í0}7!¬çê -ÏÅl‰d*ˆù ¿àŠÎÏ¡vXà3ìß5:ÀW¦„!ÀP$ˆyóCé-—]áË=fï[ºÆG3Ïö†e[÷SPñµ÷Î%;IÇõ®4ÛÌå†O`®N]æ虥'&2¢‡ýé/|5” ò­4ðÒòÖ$UáÂ4}ˆGÁŽ õNÊßýô™ -Ùáš ýA–¬6}UòMŠçb¸€&ÉG6ÏkxúÁl¬ÙKÃH¬;ý+³ÈffÉ0WG%sôúAä=3‡葇ch»ÃëBU÷}0îJžK±Ð$•éÔ²4_$)Íð”£5Kù¥É.Uÿµ…¨0¾Ô ÀE¼³q þ³ãý©Oï}Gák'ÖbaàyŽ§ /('h”ßòèØ  >aø¨ˆþendstream +xÚµZ[Û6~Ÿ_aXTb(R•‡’lÚN»mg·ØEÛ-ÛêX’+É“Ì¿ßs£$Ûš$h 0æõ<<ç;JÍøS3ùNg‰U¾¶v¶*¯‚Ùz¾¾R2"˜?ˆ#ìz¹¼ºþ*Šg*ðÓ -74d¹þÅ{õÍ‹Ûåë7ó…ÖÚÓÚŸ/’ÄzËo^sËÛ¹ò^|ÿòÖ ~ õWó…ò¾û÷ ö-ç¿-¿½z½-º0¾‰5®úÇÕ/¿³5lìÛ«Àש½ƒrà«4•W&Ò~d´Ô÷Wo¯þÓSá>3ãYg[˜0öà +:ð­5ý!U4qÈ.oqÏÝ|aâØ»ƒ}©yY“sc×<tl¹ZHÿC‘qC6Ìmêl½ÊZ¡ÖÕò»ƒ."–xk.*o…ì¸bw8ZVØÕ ¦u“·´G¸kBïϨæ¡õŽ%þ¿›/àÞð¤zƒŒGn+äTJÇü!ï^"›ñj®—tQ·X¼¹… Œ´·«Û®Å¢ñꊛº]Î •Ût‡Ë½ÃusÏ}í®>B÷~Ísæ綔 !Øÿ3ì±^¶ïxèvÇCßf¼ûŒ •Ö‡ëŽË«¬[ÍÚnâ\Ù~ƒâO ¿Jö m¸ui¹Ê}EÅ¿îbt¬ñM'ÍÐZ”8^hÒ±/æD–É«î#ÒÊûßÜjFËS'R­Ä×”Ë*ãUÚlk!ñl—æ´äŠÌ@®d²±/"bÅGwK „g×Á\øBÎ,i³mÏhÝ4u)7K ñúM¶çF½l‰nu<æ]ÑáÖmâØ »³bGˆ«uèG‰ÀnQuy³ÉVyË#O°9Ö„í<²>” C:ü4¶'|)*&¢ÇD ?ˆS!Ò–wþª®6‹™ÔOÒØY4×2cxE}ÛóeæAÚ¯2[ìlr?¾wã¤Âo¶^ËT3C}f&prV­yü³eÖÞ¼Àå±± î–ðhê-Ù\bLú,ú‰¼á(MnD•qj€æ­báðSžOÈÊ\숛®rÒ¤89Ó$˜7HÌ}W0&Ãyò570{âkÛãkàôúì5Ø益˜ÅˉËSx8úBRNkÅrÉJN:A” ˆ’CèJ7ß›cókÄ6ÍÄ­àyÖq…l™h»}%3zP»Fâݦ¡·mÔ#7  ¡thjä}v·L‡±ä9j¢’r[!KŸJ.ëînOJ>æ=ûsk.O Ž8gø}™ "–«Z"Xæ4OjŒ‰‚7ù†„O û`ÆÆ·Kq1… +YŒÞ$áºìàÔx6gAP #5G¯èÌͨ÷OÃIAµ£¦|D`,Åú†Émëñ´s’‘o¢R|s$ œk«JÆsâþs–ñ8ÍMá8=@µå\‡èðÁÿ¸#ŒÃ:$60ÞõõË›¯ß‚Ó®€M?ã/8{ßßN©NbýH9Ýñq7c_*'ž:×úÀ¹Ü ‚Z’þш5kX˜D¾…åÆB·©A˜ìv@if[(Žåe&mGãfö, 8kŒ Xw›#ŠûËŽ@åÄ_â<ËV èHÊ™2lG~×N*;6³ä~Òüëè Û×Ûm.{+z‚õ¥—ÖcxÄ?ýpó_,%ÄÊ„ü=bƒŠÄ¹JFØÅx¤E%L * ›]£d Ps 32PÊÝàr|U™Ð³S×Tî7&u§Âðlb?pvñì:$¦Ù®BÛq)s ™3–‡j›$%¥–"Þr´cbO¼Cî‘€ +Ê|‰e™¹Aû¢·;1ÙÀûŠ©ánêxŸ•(w{ª<›Pº0I ö4Ÿ uÿõõ]±ms„ÂlΛë®d¿[ô€©Ï½øé÷zW¡·Œ&˜Þ«´×Ï3$R:öcÏä‡i4F¤‹€X)ë'""øUÑÇÃomcð%ìdø Âl¡ÝÄO’¡IáŽÎ¨ ÙžÅ±Ÿ¦C"63¥üõdÌê9 µíótBä'!%fÌ€}šjî•iŸÃ$j¸¾)Õì_5ìh6lJ§~«+ã«x”5°8~CX‘ŸƶÛ8˜¹ÑÂÔO9 +ÃØY/6Ü#€”n‘‚0n¶#±ºÚr›¦¹HS:‚üU8¸ìa1!`ÅNtêý¾æð±V,Mœœn,  ôŠd^‘Ì£ÈKãÄýäüÀ€Êû”QÄ:à“þ£Å¹«†¶Õ‰ ™‚Ÿ‡ŒBÒµQ¾ä(òVIî(Ú&™-úìџׄ…J| Î'úQØðÿX9o +oÆŽ\æ#,6èa•% +– Áj¦ötúÈPc‚ÒÎ%n‡‡ÙT‘Ñ?'À'œî¯„ìZM|:0h¡B{¶ÿ-ú‚´Õ³h!„q¸idÖ HFÜñÓÈ®·–7áå:HDÒÙwȶ9nKÇl8¡—’6hç–Z¦„‰—‚lßÃ<›…~E±æÑè)sŽ+ÁuØ;†9£ÔËh0ºùyÅ“Ø›ƒQm#?«§‚`÷áfy˜â= ðí°>¹×P¾ÈEp8¸×ÓPb”ŽûÒ”ú‚ß>b½Àå$²Ÿ9ƒs§’ÁD?Ÿ˜ËH$pÆ|pï‘ùÒH¨1 É71WkÇ\í²PØ÷äüS<ŽQÑ<Á>"ÉŸOØ +àŽJ“)ÏÝúÖ¤óÜ3 +7ÎȦ~œ&!¹Û!ay†Œ’d˜•¤8Ì76M€BË=d‘nµ–Ý"!>`.—Þ1 ÷QĪ¤ãÒ\—Çaë—«¾œ‹§‰¡^ Å^Vã|̹99ÄJ6"§Ê|É%_ŸP0?¡sŒ×AxS&ðcóÄ•†ø|ðaîßM]) ÓþîaàRÿWYdpèC¶GØA¿­÷d* ‚4Õ †Câ‰óµ0«h{扙!ìj"¦Ùv+«6qÐ}ì «iRõwhDh‚K e>°¯t ÷pR«$ndèih)x¾2Õ¼Ÿ50£Ü¢ãLƒËcw^eìÞ Š§,ÆF åHÛð¶÷ùC¾Ÿ¸mkü䉴g¢.Òž™KËðÝãÆ J C[^ O-’'øü,Ê´þ,Ê´œf-HÓs¶ÛMQë7¤EE¦R>°é“’żëÞ4#E„ÄQÊ‹’R` #ïÕ.§ÔÁý©Q”èaÏámÛ(“VrØúÔ5ÿ¼êšêSÕHõT†F­šGr#)æǦ»#Û,; #Õ2;ps%aj\†‹oÙ)C;‘ñ°ÁhZò•÷Æ%^«©ìšNbz ? ôNé¸ïä± gZszuÊg à7ÞdóTÞ£¿?{ h °êª<:A4rö±wHAL5ÎÊéq*”vÑ'Îä’—=‰ï‰y zßã§?z(MÙß—œáDˆÅÙyæ%˜áw„0‰GNn ÛÅžŒÊþ]v¿Í¹£õ©”ö‘±ÃÜvŸœÀÖ >+û¾à*Caìµî¬ä’ÆyÆ !Žõ‰dÞÝJ¶á'?x‘O(ê=¨üîÆ=ÁnùA2ŒÇ{çÏ5È&ô°Ð9šuløY¿·B}•['–Hì3GÒ—qÓõÝM‘çˆN©‘†C„Ú9ÕèuaʶhåëØŒó,°q’G^üì]´YqØëwÏÜS·ñ£3Óv‚¾+ù^ Šœo ¯G~s½q‘úж!ÞÒÊtà-ÄlÄÉu嘪ÍÙ·ý“ðȼI–°ÿN€(œo†¢¯Ò=?ò-8|«§¿„–üµuâ«!:û Ö\ÄI±Üðhƒÿ–÷âendstream endobj -6922 0 obj << +7247 0 obj << /Type /Page -/Contents 6923 0 R -/Resources 6921 0 R +/Contents 7248 0 R +/Resources 7246 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6920 0 R ->> endobj -6924 0 obj << -/D [6922 0 R /XYZ 85.039 781.388 null] ->> endobj -6925 0 obj << -/D [6922 0 R /XYZ 85.039 571.122 null] ->> endobj -6926 0 obj << -/D [6922 0 R /XYZ 85.039 530.475 null] +/Parent 7227 0 R >> endobj -6927 0 obj << -/D [6922 0 R /XYZ 85.039 502.77 null] +7249 0 obj << +/D [7247 0 R /XYZ 85.039 781.388 null] >> endobj -6928 0 obj << -/D [6922 0 R /XYZ 85.039 462.729 null] +7250 0 obj << +/D [7247 0 R /XYZ 85.039 625.834 null] >> endobj -6929 0 obj << -/D [6922 0 R /XYZ 85.039 435.024 null] +7251 0 obj << +/D [7247 0 R /XYZ 85.039 381.434 null] >> endobj -6930 0 obj << -/D [6922 0 R /XYZ 85.039 300.138 null] +7252 0 obj << +/D [7247 0 R /XYZ 85.039 340.786 null] >> endobj -6931 0 obj << -/D [6922 0 R /XYZ 85.039 191.139 null] +7253 0 obj << +/D [7247 0 R /XYZ 85.039 313.082 null] >> endobj -6932 0 obj << -/D [6922 0 R /XYZ 85.039 164.04 null] +7254 0 obj << +/D [7247 0 R /XYZ 85.039 273.04 null] >> endobj -6933 0 obj << -/D [6922 0 R /XYZ 85.039 123.999 null] +7255 0 obj << +/D [7247 0 R /XYZ 85.039 245.336 null] >> endobj -6934 0 obj << -/D [6922 0 R /XYZ 85.039 83.351 null] +7256 0 obj << +/D [7247 0 R /XYZ 85.039 151.097 null] >> endobj -6921 0 obj << -/Font << /F56 3226 0 R /F64 4112 0 R /F18 4115 0 R /F15 2972 0 R /F38 2997 0 R /F58 3360 0 R /F35 2976 0 R /F62 4047 0 R /F41 2994 0 R >> -/XObject << /Im1 4096 0 R >> +7246 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F62 4159 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R /F80 5161 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6937 0 obj << -/Length 3117 -/Filter /FlateDecode ->> -stream -xÚ­ZYÛ8~ï_aä%20­%RÇyH²ÉLf'A6il°ÈäAmËnmË’G’ÓÝÿ~ë"EÛêλ˜Ã<ŠUE²Ž¥V‹þQ‹Ü„QR,²\…Iž/V»‹h±…™_.”P\ -É¥Góêêâç·&]¨(,¢bqµ™ø˜P›dqµþ¼þõåÇ«7Ÿ–—I’I./³,®~}Ã#Ÿ—*xùþÕKìi ~ý×ËKüã÷w8wµüvõÛÅ›+§ˆB ÔâÏ‹¯ß¢Å4þí" -“"_ÜA; -Lï.@ÐèDúÍÅç‹:V<§¼jnÓ&ÉC“'ç»VÆÛµRq˜¨x‘™(4‘¦m¿Û,/ã" –qtîl+ÜÙÈò n—q|_” l¸^ót[¸ôngA×ÃÄ-Ó·Ð,wȧ☤×8±æ±=¶$îH^¸’È­·ËÆ›ªu-^=”;iý)}_ Ü)÷ȶyõeV=àÁ]*<Ï‚ö¿®„êX”…ñfIjëؤݕ»Fy°jjP#Ó^âüï²®äà°Wâ8<™ï¸¢B£Ryð®eÚ}?Ö«CC­Ÿ`XgÁ®¼%jOþOBìMáùÀ~~~›ÆÞ'‰¢;Žhw7Ý°$}òÑy†w¦[&1Ü­?²‘4 £ØÈò¦n§ƒ¨:¾Ë¤ÈÂ$ÉŽNqÕõ}µ’½£»ü™h¨äöÑcF`t#í]Ù2Õ¾ÜV*{1qF³|Ù H¢ã`Ýáo´ÝÈ€´‡­àµt·yîÚ“Ki¥ƒ¯ñbS·±@ 0EE ѧXñ~ŠÔ#ê†Lê0NÓà>°K8X™I'½ÐqBž›ÇåfeôMóü$K“Ö«éÓ°ö<®cœK­9°=†g“0Ï 1D;0’ÜV0ŠmyÐ_ÊsÓ0/µ^ âAàJâkÙOA҃Üš/E£=>GÞ€ºÜâÞq‚¯]N‚™ñ† µDØa!‡ˆQÎ"Àð\VXË=:c7#þg™CLé¹%àŠrÓIµÖ‡ñÉ™@:¿æ0+B¢º"_g*›Ïí™2T„Ș’_¤8 F6…ö„ƹLÊ©,Š$`ÂÜ´Ãt.QðâdP¹- -VŽÔ‘À¯ãnÿ‡Ù/ƒyàÕ¡ÊYa]£Û‘Kà¢;0±¹íâ‹dXK[SQçú”‡Ùºvmá-î,QHNŸ÷pdRì<dÌÇ×ÈâÐ-@ï°(ÔŠbå3›ÿïÅaÎ÷ÌÔíVœib Ž³+Iî´• <¼Gã1'¢ì£Ò?( M` Bå ¸°Yl+"ë¶0;0àɦ³ÁA¡]Q‚ÊŒjözFÿºB(sòÍTyé X¾û(ê­×„{†ÇBa·9TíØÍF‹I®{Ù’Û8 ú¯*AÐòê®ö«$™y¡ƒšvísqÄÌH¼my–c4*¿4rÌ´¤d®Š² ÌçF"¶©W´D°›fÁ<ò²™EÉ?»š^…‡Ñ–lŒTvä‰PÉ`-éÆ-ÊAðû— dâzÊm’fÊnÓ3Öè#Ø pÁô†F¹-ë7 Z‡1RžþÃX#Å¡MI¹Ù•¿nBüøÚLâ4tü& -³4ÖB ‡ÈÞê -\ªºn?Öt“÷§;6%ìÎƵá'?üúÀ8cƒ< -ÞOE6zE6íÃmÎäÒàÞ==6.õ^Ñ)ÑZÞÃtnš“ã@¹æJÇͪ=ÒÅ+ô¦\åÐÖ§¢¬«iŸ¼.ªFð‡u2xõãä[3(ÎÒ0Îã'3Góh²4”Ô£è)q.=)Ïf _à[tÍ3ŽNð‰×cwçžòxÅWajØG¨Ñ1¡gªƒ`4vßT }\-Ëʵr…᜺š8WYid>- t?xËXà×ÉJ¡D'}gK†×Tq˜^§1<*°@‡­Ž^¼êèmì2ñ -?¯ ÕLXæ ¬xI ×^ -Ñ*a0(òœ/ag¬¨HËôØâ-"˜}†`© ÞðNqEÔõ8ÏÍ œÚPéUZt¿&‚tKE:ŽÝÖôìçÔˆ£è`´H<¶?`‹ÎÐLèÇN*è,\r=ÒºTŒ’çyƒ¸qËØm±”LŒ_Þ -¼ãØC4Ó÷q®ˆŠ_¾òàÙÜ·O-o,¿ÿŒ‡§ÀÆsyµL2 ‡ß5‡1lŽOfRÖ½«‹/Ñi¬Çk¡O=ô.Ä¡/ÔùpÅ=wšøì<Ú.P[Ãé]„>¸<£¿2q~ÎÁa¸dªÇ|TiIH{SŠ¬Vxž¿tpÁÙ§¢]•{*××M=ÊÓ‘äÛí—£è—Êç÷ÛT“Žè¸X‘dC¹db;öð5~—Ê£Œ?âZÐ@ò°XKOBlUöiÉ•¦‰õx"‡ßA“œ2æ:xùáïܘ9“Ì.yñãOo§)Ƥašê…*tXäÙÿr! ãlþï.-¯KÙL*2EX$©“ˆ:~8û{ -‰*5ñÿG/áõ½2Ð+ÖGz½/ùK¨û0îŠÿ©C§ú AÑ ûP‚Ÿú‹ŒãCªýOþ©™PvüW9’žÞýÀõü²-x,W³0Uñ‘> +stream +xÚµZ[oÜ6~÷¯0òR QH‰Ôe.xÓ®»Mám¼-Š¶òŒÆÖF–¦’&Žÿýž)iF©“ Š Þyx.ß9”>WðOŸg6Tq~žf:Œ³ì|s¦Îo¡çÛ3-#Ô¹ Ub±ëÕõÙ‹olr®U˜«üüzGC®·¿ÿ|yuýúÇÕ:Žã ŽÃÕ:M³àúŸ¯¹åíJ/ß¼z‰5ƒ_CýbµÖÁ¿¾¿Ä¾ëÕï×ß½¾ž]›Ð$1Rýãì×ßÕù6öÝ™ +ã<;€² +užŸßŸ‡ÖÄR¯ÏÞžýÛ¯Â}æœg-œmm¢$ŒR(Ä*Ì2³4& 3“CÉ_Û…ó¿)«‘‡IžòÌãEmh¬yjÑoªÀ›Ãžy8ÜA¥d6÷«( nVkø»Å¦(¨š~(êº*Ö6áñfÖ‘ÿi¨–9‘…2ñÏ7t³tJ«ø Žùr Gˆ¬–X°Áåÿ[8˶+{•žÛÚÿ¾ºüö-ŠÑ+­uðÊ6­ü2·`¯/¾I¢ ÕHE¡Î¬Ð~¶Á„<†å‰»:è ð~-;ž>Ûtå¸Ó ]ÁŸ|€ª™‡rÂgx¿ÂÓ4PÚ ‰rËã®/®^ÀY +\MbÃöµÖ@Ážö3`šÈ@Û8Y(¹pu±|ÑF…‰Y¼è®Ä>u%›eqV¹þ‚{~ç/njã< ~®°iÛ¢0?ôÜÖ÷Ò+÷Þâ„ÃPÑÙs¼¯ +,Øà?¼åBÕð¯×Ù(ìÿµS$Ò)²2¨K(dx?í¡ã^Ç=ÎCn·ÄΡç®ß”6µ˜(Õȉª “,­3[„û¹DNG+6¸eÞr¥àDWÌA°ñ7˜ÊW^W[žÔ”IjhÛ½“F’/<ãÉmÇ͸ÈM!÷EO4h?´zëеݳç¨ü¹94²ÑýôÈ«{C¤°aÞý‚!ß>¸…ˆ—°üîÚNnãnÉœ¥¸J&÷ÚߣÝ»7uEäl.Æ™ Öß/X´T‡©Id…™;0É‚=L˼…?´ApîÆdÁeÃöEGŠD*…šPÝsÞû}ñNfa­w:iðrµd¥U¨2#»ºk{± ¶Tã*u‹§zX¶Ïy˼šì s41µÑ3ÆW¸jñÞÛNög¸´O±Ž—ÜÀÒ ºËYîƒ,ÒéP[‰=*xY³õBVD&@/ÐòÔ¦•ÕøŠäë–9þΑC“)Ãw…ÛÖpçÚ¦òG]Pç=ÆN|ß0 ó9\\ˆðÝà61Û¼‰C_5·nã–ÉÉ|TÓ*»6©ÎUÜUõhz°¯nooÑ_`¹%Ë‚›™ÃÓQ7¸0¾Z24¬¾8ð¾Ø ÙÁUM 2‘iúe•ÅžHS_„ P"WNmp¥þÐñéL*׋—=E³pÂbà Ã=òÖa°NƒòCEWltF¶Ùèdbر6¹DœÐ—ÝT6iˆ°O'"‚¼0É%MqŒ§[Z,Í–gV²& x[t8Ô1øô`·%^¼ÊÑÄ* ØŒózä °Íx¿'`ÆB[¡m%ßS6­²ÃPvÜH6¦¢à´B¢óBOѼ½giƒ 'ZCÎ{ZY²¯îÝ41†:fÁ‡Î=.ÞÞ€m…ÞG9 ±­,zzno"Ô<çP <ñ¿h4r: v¸“`›Óž|UÁêÔe‘÷¸É‚ËGyÒD+æ@V-VÁÅ]IrýŽÚödI\q'ý„è¡€|ì•}v$£ ©È-»¾8ZlªºbÏ8E²ë‘©àI²âξãß­è‡Rn¸¯d}èeŠ4{ÇO‰ÎM˜æSBxÕ.ú@2q$C ‰9Úì¾ÊD%r-u5oVTìBŸã&y—yX†ŽœÑ‘%bÐaEs@Úzôªµ×à¡¢4†Yijý@$,‹<…"óÄ›…&³_€K<4κ¬¼¥½—s¸¥œ¢œ€,c¾Á™Ì<øð7ž–©9L0©ƒMM³°°Ž€©Q° ´è'Ü ƒäÓeåÊ/»°jB¼çþë7W Âåa¤0…ÌŽÑo@¥¿#Û^‹I½qÆyŶeô¤ÞÃÀÀÝŠ ‹N¦B9œölв +pFMBç­Éá7<ÌûKS‘9:ÔfyôŽ•bI¿wÚÈ1.™.xm#‹•}]¥TûÃfSöýîPƒ¹g&Ä& “DO­Ì Î#bžù{l¸ºÀ_¸…vç‚ PIB´Ð*ƊͦíF?2©Ï(XÕÌ0L׸þ-w¶Ý)ÙSÖE ½™²ôß„€Óv ¬±¢#'KU?î‘öæÐû`¥ƒ7« ô CN;³ X•EéLnæ(ÞfÓÚPëlâñF?jH³0MœÍeÓnÁ–Ô!_¬`A4³·ÜèP¾ÄN–x¼ pp#MžæšÁ¼SR¾ZOzz£À5«Up9|Ed1òtWÛò"ì£ûÊg>¬À'±âq˜ØäÔå¢I/f(Fø" 6EóÕÀE‡ñ¹F"ãz8H€ÒÁmËÍ— ”dãŠK [MÕ*£L =âF^X6+®ŸV&èÛíRœžM P]Þ?_B²”¥0.%c’iŠF¶ÐÍ/ + ž;™ŠñÜ9ƒæèyä움{TŒž1 Ó–Œ ê©–t’–4/NÓ,ˆ“G‘ñXyœz Lœ±Q‡1“ œ‚jú-'z°KìƒÚo*ü€æ–%„F3ê÷‘_MÞH8'±'”#pÞÉ•1x%ñ½åæ–t…™úµI0#2¼º½shÐv­ ÒA‡wô±™„ùFä¢/Ý~ +™:AœPÛÔ•ƒšy ´èŽÈ1´ïúSü]6›îq†)b›-ÅsÈ×Dqâ•FåžÂ”»b’õ8•X2ñ ¦:°×@b@¤_*µWǯ™n#9›/{£Â,þ‡`ÃÌ»1´ú‘†@ˆNHq§Å¢êÅE&*ŒÌZ¹Dê³GP÷Ï$“/€ÝɦËïWýB>9亯Œ^‚Ùi˜¥O>VAËIJ€«ùbänÅVðpOÀv™»å†Ó–µóœæ¿øáËF&Xcû›YÉÀ k=f.‡Û®…I æ ý¤­ŒÂ,‹>w54–Æ&ã¹gnðaÁq†%¼‚g¥Ä‰#EyìÑj’üÓ3e†Ú[&ö€Rnв˜rã.¯ŠZ¾¸h͉yo•<+–u묕f”Ø’ÝMÇh3%ÇКFè‹”e{çŽTžš|í3pÏèïu0¾ö™ˆ_e°ÙaJ¹w¨Õ'¦ ÿ¦ã$\ +§š¶SøÍ 3q‘‘ß´ñ=>Wkv(8vÌbâ¶åßㆵ1©A³]•µ{Qj—rrŒsˆ­Ÿ Ù¸£,?XÅ]QÕå–eü¼ÂD7å‹ «àÎ(‘õ> %· bÝÆ54R&e~%$þ{è¥E.Ø{#\¡f‘@/˜Ø£8Ȧ’4ÁÝÜ4Ì b ýŽ_Ž¤vOÇÄž^2;ïOPTS†Å¸…,;ÚôMSãiÊŠ‘NðdŠÃÇ'Û:ð'„qíž.‡¥<:zX{攨»÷Bœ2|]r q¤Ã4³ŸèAÒ‰šóh I|˜•@dª¢¥0‹ý 3JûGý(PL­óYû®Ü•ðI@ :4,"ä< ub'NÔ=þS£Ç*Ÿ™æç)ºPÈ#õ¨î™Iaø]Iæ‡Ë´~(º¾¤ŠçËM˜ûÿ;>ý%Ž/Ζüû]Œ¾á@]îÐÆY>>Bõa]ÒP0`ê ³I¦ôˆ/mSΗæƒsVŒ@4Ée%˜kLÀdË81ÖQhòü3¢¼&:r2Ù‡÷˜¬ï)b=O«Œy=K_MH‰Þ‰¬·DianV“|²KÏc+½óXí£,Ë« ”˜Œo +Ø&±°Ï6qÁ8Öûv¬Ü_K ïÛÝÂþ¤…8uô³øÖƒe3úZZ}øØî°Åô [žŒ<UîlòUN 0bÌlâK¾‰ÒÉF”$ôhp×ÞðW+Ü€´òfÁÎéýLÄFX…m?\ËZFiøÁéô`¡}.Â͘½æwÁ™9pZ…Íÿœ\›û4¡„8 ,4²Þi‚-nȵW–ËV ´øûIÃÌÑÞ÷åhwPÁ• Þ–þÛÎ/÷l ¶¥äè“e§¹¥Ä‡¿Ï©ú;É*÷ÉÏ°” `mì4›làq9A¢Œ™xF¿ì43gí̳S&TÖyÆJrXöÅ:ÔñH‘1:¼1Ï!ú#÷fL[™£Ü>ý5eÌï ßRbOô”ƒýáäCN„©NxÞ_Jú w.›\p³£,õ̼oRŸ%"/¬ãÓg>z‰­æì=К|ö›p(i!~… Ø‹Åg¥:”eõMæeœ*`4د@„†™}kRŘŽ_®OÁ‚,òé@Ó.,ë}Ùǹ1 Í1Oò§—kb½ Xqr„Üþ`fËlendstream endobj -6936 0 obj << +7258 0 obj << /Type /Page -/Contents 6937 0 R -/Resources 6935 0 R +/Contents 7259 0 R +/Resources 7257 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6920 0 R +/Parent 7227 0 R >> endobj -6938 0 obj << -/D [6936 0 R /XYZ 85.039 781.388 null] +7260 0 obj << +/D [7258 0 R /XYZ 85.039 781.388 null] >> endobj -6939 0 obj << -/D [6936 0 R /XYZ 85.039 598.736 null] +7261 0 obj << +/D [7258 0 R /XYZ 85.039 761.463 null] >> endobj -6940 0 obj << -/D [6936 0 R /XYZ 85.039 423.202 null] +7262 0 obj << +/D [7258 0 R /XYZ 85.039 747.777 null] >> endobj -6941 0 obj << -/D [6936 0 R /XYZ 85.039 301.259 null] +7263 0 obj << +/D [7258 0 R /XYZ 85.039 707.735 null] >> endobj -6935 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R /F41 2994 0 R >> +7264 0 obj << +/D [7258 0 R /XYZ 85.039 667.088 null] +>> endobj +7265 0 obj << +/D [7258 0 R /XYZ 85.039 490.342 null] +>> endobj +7266 0 obj << +/D [7258 0 R /XYZ 85.039 341.907 null] +>> endobj +7267 0 obj << +/D [7258 0 R /XYZ 85.039 246.759 null] +>> endobj +7257 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F35 3036 0 R /F80 5161 0 R /F58 3380 0 R /F38 3057 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6944 0 obj << -/Length 2394 +7270 0 obj << +/Length 2608 /Filter /FlateDecode >> stream -xÚ…Xß㸠~ß¿b -¬L¼–m%Nßöº·Å{×âv€¢èõA“8wý#°•™´ýßˤÏ$™C€H¢(‰¢È¤ÍMB?sSØ8É67ëÂÄYQÜlÛwÉME3~g”#·Ylóœú&—av¹Jã$__äÑ3–k³‰³Ü€ç‡»w>§ÉMšÄ«Uvs·‚¬Š$. -{s·ûg”åñbim}ì\ó¼0ÑXwÕb™­V‘ëKíd0öÍ#Íêä:iàÚ{'£Ã"3Ñöþ¾¡™²ÿºûË»ï& ÃÙëU\¬Þ¾ÃŒ‡ï`ìIâM²™ß!ÃR¾ÃÝC9”„D’Nµ$}ZDÏ%$-D;’dÃÝrö~/mÝÑÔ¾Zç뾓5ëÖF®¦ÙÆÝ7åÄÍþA X9ß0‰Zœâêæ¤2Ú–Ä· ѯŸqÈŸÞ«8®ÛÉò]¿XÒÄö¸„I;KØðuÛ{ðõ<^wÄÞ}Go™Û BûdÅ´öÏ6$0ø½ ¶}[J辶 æ÷a!‹éZœÁoŒ½êÑÐÄ=ô¨z"ú¶Q\­„G ËáYF•ˆ ÿ¸^¶Žø߬ÕΩì*#iðüÊUÙ•ƒkÀ‘E_þA:¾?@~Q^Gãq‹Ó„Á)õ~ ¶OÌËÏ]ÅWLÔR›mÒ7MtÆÜÌääx«™‰Z»¢Ö73p´|}‚ÛU]?úš‡<Ì“ŠÈ‹z˜É5ﱄiþ;¢x®z5El2–ìï5ô…%R-õ¡]“DÐQ)¶ÅŠÃ#ßDu0_“Gµ—eõB€VÑóÑ -µPš,¢®\­Xîïí|Ù< ߯ §¹A¨O“­&µËÀëŽr¯àGiÙû¨u3ærðì¿Ðl -äÊm|ÁξÎLžüˆU#5{!Áh6¥Çzdenpì`LÂ-lGA)ÇF7U¬¡A ñúŽ!ÁªwM¬¼‹À»+ÃÖ†Óó"]Û˜³­«žcb^|RˆlhÔî”®RÝ;vœo”ÂüiMZguVBtXðá³-fFf“Ø’o$¼zìêß“•ƒ0¾°FÂð4/”Ø•S’}G± :ŒW•¦¡r27ò ÕàZŸ0Ž aVÙé,jŸÙ”9áËÇ_neo‚à¤`Þ±”ÎÎy'|2ßMO›˜ 4¸DˆÍEhÛ³8zh8¸<SìFÔ -¢f… ͶC)']ê|E*\Ù7aÆ3a•‰7k„œª(63¬2‘ÑÌàSI6IRTÕôðò5hPïë)ƒá,WÄÍÒØþž¸'ž«ø•'I¼ÎE±U ÊMÆ5¥ÝSäÑ3z™ÞMð;Åέ0ÃÖáNÍ(c8.¹ª¬*Ù7I Ð('0Qöz” Æ‘5Íá”Ú 4Ø‘»*LôE‘±çæF£R.pÏN蹓ö £ˆ³ã wäö=Þ -ÃQåq'$6Ì´XG`_Ô˜cu`Ù©å6¸ÿþY&žàjèM`ˆK+!6Lðiô8åçHü ª'aD9 ›t¢ªhâúsy/¾ßøÄQ bìF1Eçt'›‚eþˆT‚Œ&DƒÜbÐ`—ýQBYnSͦ¬tZ2óc“ì¹ÔâRhåu[ì]ÊA{•ƒty€>6‹ªíVˆì¹Ä°I )cåŸ%zSMŸÀþTKLž=˜ Ë*™ÎÜá]Öߥ’îµ¼bšå6È–­)-f¡'õSCËCàGªqöÑ* a¼¥ã´Ø:ù‘ÚÉVÆÉ)*ò±®ú£T­Ù¼IP£Ä¹¡þ@¾›b”£?8|Äè¿Òpx~w]2¶÷Û†ÎËpùEÚþÓ•þ¾Fq‚qçpkôÀðÂrx,‡ÿ]©± w…]½YcÍx®–„EgöeE˜jEx·=ð·ªÝ‘¤ËR)5ù%!Hn62 ÒPéܯ—¾gQõjÞ.•…¿ó‹ êí&Ä8“Òy’Ýœ6?ÓU`yS“eq‘s ØWÕ¦©–òišJ4BˆÇ€+›ú» .éÀŒ”Øijä“çÄŒkäŠýàÒ“uô“î]ëÉN†[‰ÄpZµ ŸÚêNå:zùHíõk9hRR§;e¸ÓN¿ZÜ^ys|ÎÙÌuyÕþ&ÎsfI¯Ò°JuïëmVĶȮŸø7?.endstream +xÚY[Û¸~ϯ˜‡•X#’ºö-i6‹Ùt±ãE[tû@[´­FC’gv¶íßs£,Oä¤`(’‡äá¹|çZÝEð§îò$ŒLq—å*4y~·k^Ew˜ùþ•Š81aÇð½0¹ö³ëT‡Qœ-ÑDwk“‡q’âäÛÍ«û÷:ºÓQ˜¦æn³'¢MùÏÀÄáj$Qð¦µõóJ¿­Ö*¨à£ÅÃjmÒ4°m‰YðÐÕ4y¾m¶–i~ì»-.©aÚ5Ãê_›¿¼ún3ç'#•ßà5NÂ"O&^Ur§¢°ˆŠ9¯›£ëÝj­“,°þ£±íJçÁ3÷†îÜÃñ;äà <Öí¹­Z˜Ùw8ßà¼ñ"]+â.«îZÕv 3µ›ÖA›ãQö¸¬o®wo`ŒW(ìSgÀsFø¢×0“éà§÷xÔŸ…;’,n_v8ͬŸ=®]£Q@ +5^F`½ÃÛ€êb$=¢ØAQ”È ì–ÏvsøE¢/7‘kÙ‘¿vS ¼ËS…œ=•ãP8nBJ‡nY cÛmñbKö’³Hê²ã™âÿhP‘èÄ_O(o‹¤tµaáÒ(hcLpp­ëm͇`É[üŽƒ±;U^÷ çrqdb+£¨Ü¾Ã‰'¢%á’Á&!œ¾l°ºMªæÎ¥âÐÄé çRè^q¼ónem7ŒÕn`¯Ù¬ +R–‰‚®^rfù-L*¥¿î4»¨±¸ÈKEA˃J¢@ÍôŸY¯‘$ª‘—U¢CXÕ¡õbM0™m究4¿ÊŽà„Æw*Ûõ<út$msGÌKhíÙ»ŒŒV·dÐÚ±ëÁÈVÂMœÐ¿»míšpÁˆæÖ›A5ù¦«÷ ê‡yœ?¾æYðt@¯XB$£ã[ˆ¤Âü€ôWž":tLáå2¶¥8È~7òtYj¢E°âæ‘x”ÐI”èw¼Ä;*¢ýn,¦s'ÌT0À7âÜ8X ¼ãBƒ>…² ™9J€(Ó$þ±ÊcrJ$`Ðj±£ˆ5¾9‡™ "Ž!iLgq¬K¶(?zóNQü+‡¨Ërg–ÈÕ‰]b™ñÎG\&C£„_”$.£(Ql‡-r;¸öÏB0»W’ϘREjã½¾cy':A?ºzá)„PåáÄŽ¼ýÓ±òA{ÎNnÝ¢ô!¼rgI>ÑIÔDih@òs‰žì½¿4ŽÙJõ\?°ÌËvhVàÒ[\”ˆ%Y´ó±…keà…JûKÐ*Tà«þŒmùÒ~a«$T¤s=ÐÝ’Œã«ÜNm H²wÛ—>95d ËÎsbsbñˆÝ±ÆÌ›eªòœò‘¹LQÓ²À­¦9I–6ùvIÛ÷nî(¦ø%J"8\º=eõ3BC1 Z1 ®QQă¢Yú&3¼àŒœì@W“Œ§ôWÅͧœAga:Äë½Á‡ Ç]}ò1ûœ¬ÇÎ{’6 —ÐÞ’6Î!ê`K8íŽ3Êd©1é‘(Ü!kÙcîW† +4‰w°Ãn‡ÜEÁš »T1`mB :±T¿R ~ÏçSU×Â9ŠtWŸK8¦£*Ìb3ŠÛˆ i+µ00¦)¹)(ÎЫ֢©Tè®8Æ° l]ûä×ù Ï›tÜÚU†)OF@Cdt{M6?;£fZÑÏ‚<ó4LÒd î¿ +k¿ø +úK¥Æor:ðf•. R¼Xü’¯B…:˼šËíÂñ5¢„dô›¶ ›åç…Zºã’Åè0Í=ñâmL$³Oš¥ +àüOnŸ(ÃÅÕŸ9À[Ô^Å)³¢d1ל|Hé°°‹¯&…®Ë ¨»ÒBc?Kö¬‹LÊü"W$‹à ( JÚÑÁˆ\n +ò kƾ^Ûz\—®v£ìHumɇn¢å*x~jy€0[±J\KDŒéôQ$>Ê#Ë¿òrNh_íƒÀRüÞUÎ'±8 iÇ… + v\rŒøD‘h‘A±Šñž˜ˆa¬™™ÜNƒ,þÝsF_xGèí`š1›æ:ç +~*»I”ú²]}ìwí¹Ùôçatå;ÚuX0F¥u¨ÒtVutM›³ûqêÌnÊØ•á“œº‹¯‰ypô,$ÀrÅyõ¡óˆ,ÛîtIbeDø©âÞ]¶ã÷Ÿ¬f¥¥ãMž*©ß°3eÅóc†ëô ·™;¡¯u&öãZBW‰A0Jf1 WO ô¦Âx>NU»Ö0⣼ ±')Ê.ÿ8ò'ϲÊrÓO5Uf<:Ƀ…ô:ƒ¥;â0 +¿¬wÐ$»óÈÑ’È;Ä m¸¼ÖJ<Æùwãô~³§‰–ä + ðŸa¤}€$WgþGjÅå— _Îmk*-c J$ñ,é •§yÚRIþt]ä.ä3¯¯é8óÙ×WãˆNò0M¿Hò¸˜%·t •è“kœ§S |&*½Êªø¹r§ËcÏþ,ïFÞ§ŒgÊ"»Æ§ø p)¯øý3Ëj²E)S¼4mïþ´—㛟 ã$#ÿÀåËè†ñdñÁ{ÿå¦éz÷¥{È +Èèw5`ïÈÝõGnïïÿÓºq[a‹ýÖ¢ ð SEZèúG×ÿo©è|2·ªnk\dÿßc€–Ç€Íî„Ñ5(ÏÍéF‘Ÿ|¥ÈWò&‰CýAæ~úþk¯÷¤@Ærš/ÎÆê+½ñ»‡ 3-S·Ï!? ·ÞX"™‰%‡À0†Ÿ?}ø;Ï_±hâÉ=‰ÀÀô`Š´çs¶†P“æÁÙ°’ã,ww²ôÅù6ÿ8 ÌœGþ±`”Ÿ.pŒ})fàä¼à5»O…Qž_¡G5þü-Lð}áQ|Á¿…3OҰR³³ÊÐÑüd·_((ÒÈÔ;‚êReƒANïS üb¯P+í3R ÓoŠƒÃòÎPêlŠñ/Œg’”2qvå./m ï’ß2&Èô^žõøÖ õíïéendstream endobj -6943 0 obj << +7269 0 obj << /Type /Page -/Contents 6944 0 R -/Resources 6942 0 R +/Contents 7270 0 R +/Resources 7268 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6920 0 R -/Annots [ 6949 0 R ] +/Parent 7227 0 R +/Annots [ 7275 0 R ] >> endobj -6949 0 obj << +7275 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 47.098 132.399 58.787] +/Rect [84.043 60.647 132.399 72.336] /Subtype/Link/A<> >> endobj -6945 0 obj << -/D [6943 0 R /XYZ 85.039 781.388 null] +7271 0 obj << +/D [7269 0 R /XYZ 85.039 781.388 null] >> endobj -2642 0 obj << -/D [6943 0 R /XYZ 85.039 761.463 null] +2698 0 obj << +/D [7269 0 R /XYZ 85.039 761.463 null] >> endobj -3165 0 obj << -/D [6943 0 R /XYZ 85.039 653.963 null] +3228 0 obj << +/D [7269 0 R /XYZ 85.039 653.963 null] >> endobj -2646 0 obj << -/D [6943 0 R /XYZ 85.039 585.392 null] +2702 0 obj << +/D [7269 0 R /XYZ 85.039 585.392 null] >> endobj -6946 0 obj << -/D [6943 0 R /XYZ 85.039 542.439 null] +7272 0 obj << +/D [7269 0 R /XYZ 85.039 542.439 null] >> endobj -2650 0 obj << -/D [6943 0 R /XYZ 85.039 460.265 null] +2706 0 obj << +/D [7269 0 R /XYZ 85.039 460.265 null] >> endobj -6947 0 obj << -/D [6943 0 R /XYZ 85.039 425.519 null] +7273 0 obj << +/D [7269 0 R /XYZ 85.039 425.519 null] >> endobj -2654 0 obj << -/D [6943 0 R /XYZ 85.039 111.856 null] +2710 0 obj << +/D [7269 0 R /XYZ 85.039 125.405 null] >> endobj -6948 0 obj << -/D [6943 0 R /XYZ 85.039 74.989 null] +7274 0 obj << +/D [7269 0 R /XYZ 85.039 88.538 null] >> endobj -6942 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F58 3360 0 R /F35 2976 0 R >> +7268 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F59 3455 0 R /F35 3036 0 R /F58 3380 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6952 0 obj << -/Length 2718 -/Filter /FlateDecode ->> -stream -xÚ¥ÙrÛ¶öÝ_¡—N¨N„×Gg½im'Ôv2mh‰²9–E•¤¯ã¿¿gII¤ì™;ž1œœ}¤'>üéI*ߦ“8ÑÊ&ÉdyæOnòéL ÆLPf=œ·‹³7Ãh¢}•úéd±îÎ UÚÉbõ—÷î?ç_¾MgÖZÏj:‹ãÄ;¿:¿˜&÷}þùêÃίÞó`þåbªµöþhAó©öÎ/ßžã,ð¾ÂìÛÔÄ޼δwñF—óé?‹_Î>,Zž[n€¿þ÷ì¯üÉ -„ûåÌW6M&0ö•ðýp¬ÂÀÊ|s6?û­=ŠaÁ„w é'´‰ -{¬ ((ôU褠¢yÜ×,Ûüò-‹\£\Øí¦3µ¬‚Y—÷9â<ÞfÙäµÀšÛ|ËkM -×üÍXåÙ†gÙv%ˆn]iÑZ¥õ3¾Ñáè Z¥aØÝUÜA+Ñ‚W„¡ï¡JXáDNàÄŸÌðL0q©ºØ·†£Ìšž¶•ÃA†?4Sf™@›ñç¦ÊvÈM±DcâJ½-`áo_[d/¯^Ãr>øϧaäeŲëMÎÖe…ã]ƒ%^IÒ1]o[ü`ðß~èjîࣅ…-€W ü³Ò^9…‘p1X¶&[ò•°Žî :›Ì‚$ @V)‰W? »ºÞáhRyõÄ+7%cÛ+rY´½‰•/ÊúˆÙÅCôUÞ€èeÀ_Îkí¼,Œ¤AŒ×¼ -ÃÕñ¨æ|³™=VEÓ¸mÛ¡¨ûi wŸÐl«|_ VÊEQ7Ý9©·FMW<^eMÆ£R ­þjžk#ˆQÒŽRJè§^„`± 2d1u#“‡ |´!#‚g›&¯ˆµ´½ƒ'Âlžà c^$﹃ði[#îá“ƉñcÓŸ3þÕVneËM~äMuáœaÄàû)7Ã.²k@Üˆí³ºõ9í0Ç:^röØ8J+âÍÇÈô€Iù1ˆ†"µÙ™1÷RE¨Ø8ıì ZU©MOfïÎhöQA`÷²w Ù{A~ŔʩՒp1ò®HÔ†—-¸ þ«îxYn‹†¶Tcá“t8£Ù4.ñ7"ÞñKõ ûù„½3Ã@-ܶ6LþÅÔQTyÍë¸û£ 4ÝvК ðiù BjCÉ,€°.ÉÝM¦Ï9¹1aq ~ì\½ŒÂi‚Ú §P)Y\ÿ(ߧKoB‘4)îpHó–1$;£@8Ý+1¸p‰“‘ºðÃNÄ$>)aý,ˆs`™HøA§wÇ"’ -Œ/õØàîªõ;XLÞ}ÌçRA`ËŽHq‚áД³ê[2áfÅG¶E`Å=táCܽÇe¯‡ç•~É á~râ-up…•b*1Þüh×ý€]1 Aߧ‰E#¨”DwOÉ<1.9SÃt’…ݬûjߤ¸gGnpÙ±4Þ:!Ð9£}î;¨ÜO`™J^"­³4ÔBÙ¯2|6 >»æ 'ïÞÝe?sâ* «)DâÕÞˆÊ`´ÍIW0¢Â17T¬Óè¸u:¸cx›++ž/ÈD|¤ç€4nŸ2~~#wm@hx‰ENœ™RÉ®ðíÔ.†­ -ˆïÈ ÛìX›|èG²±ñCFáÉlÜálèþû‘¯´BíARüâ£+?RI˜œ$èpŽ(î¿Xi£¬6{?•MÉ7Ö½ò>ÉOn¬ó&£JÖ \mM¢Â8ÄÙÀI±2±qåMÓ%ízè¦(ã?wœø»rÛT¥ô'_±„fÛ|èþeLòB&ÇnÁÌ†Ê„É ™Å´^,óA¡­ŠRýÂsÎW«Ôq¢‚(:é‘=œqtHÏyä)‚­GRôÈ>Åy¾É—l‚þÞ±VB_Yß>cµ½†Œr¶tkè3‹iJE ñ7õA3ë2Í×ë8TqäL/¯G†+þ†k?Ô€;y¸Ú0ie´s¹/¿ÒxæÁHÃÅ úìÓöîpNØ[žµ÷ ‚½(Û»Gñݦ õ`Jâô”–Œ¯"ëÆлñð»VÀ’‹gXøŠwaÌ £ -7âÓúnQN¨›qžÕö8µNÙûä†uÝ‘ƒ íAÚè= <ýúòû^ÿnÞï*Šý®BYo×ñ£*ïwp_æ¾»Lj{ÊOÜ«0ucBj"nñ 'òN-¯‚ $p|Õ{ 2& ;$=ýÊ~jKnéùûTc,3÷£èzÚXÈ?Í¿cç°@ýpù Yûòeñ»àž]-X#Ô.m×7CÁ¿®<µdó{kŽÄÊÒf‡œ¸åÛËo§Âøåý¬~û¤Š÷ÿYð…߯‚îçOî–Wp¿[âKNÏa¡h˜[(ÉæZžázð °p÷ØeUû3OUÈ£áNïk}Z TÅ©¨wqCòîô£ \—™áŸ yÜ^ºkôÈÖ#¼¿¸p¿ÃŒ ádôð¬ªûwR\vú̃‰îéSÌÆrô¬(?Œí=D¾>ø½b™íD¨òAmEI/¾Àü£Ï-¾2éð¯¹"ÎÿõÓ}›>¡JìÈëþt`´ã¹ ´=ä×ýÄÄðÿòAÒendstream +7278 0 obj << +/Length 2517 +/Filter /FlateDecode +>> +stream +xÚÕZYsÛF~ׯàÛ‚U&‚9på!Uò¥uÖ’“I6›ä&!%’ Њÿýö5„UÙ©Í–«„9zfúüºgh5‰àŸšdq™|’f*4Y6Yn뢃 Ì\œ)¡ˆ&6Œ’§ž.ξy'…y”O×D²Xý<ûçùÛÅ‹wÓ™1&06œÎÒ4 ίÎ_O3üòŸWÓ™ +®.xþüê97æS¼y=UJ?½r³óó˧çÜ|ûnª³àÍÓ×/.r>ý}ñýÙ‹Å€³™ mbµg¿þMVÀý÷gQhòlrí(Ty>ÙœÙØ„±5Ò_ŸÍÏ~ð»ðœðªÌÅLåa®ãq%ÍP)qîÕ¤aXÁHúáåSÔ\*ÊÀœhóœ¤l÷»³Ñtì˜$7|?î+Ô02mlpSUðßÕOÄ-Áz: #p.Üì%IëWe’·¼¼Þò Èê·ÜC“˜—~}[~ó2Ñk(ðK“[±IÙõÎtd6k dbº'|®Ü¹%7î¦ k¹^ÏëJaËëÍlŦԻ’}µböEü¡¿yåÆqku·ižJÜš£¸5'q‹!æ¹s^­ÎTzèÙ'q°¥ðÕpˆÒc¤îKp s/«›}CNK¸§F´žè0ÒZè¿=ÖI’…I–rzÀÍÑÝŠ¦#ç¾aŸ(XùËbס»4ãºÏA‡•kÄDI¨sô~TMzÒi°†ú2ÐHë ´‡ñåuÕv$ú`n‚kb'·`EWp§§-+“ÖäÐʨ•A+—1@imŒ¡ãA„ÂpùG±Ù­GË{ôz“ÇÃ+SÀÙuç(v3”ʤFl€²íMb8™Ä 9Ú!±žNÖæ2†ÎH#î¨bÍùŽö,|8Ž]¬ƒ{¹ŽÀêŽ0OA"âƃ‰ÃD|Oà +Aêøp˜L=:]g:N ‹©•úrP½uZ¯à>aR`3µ•ƒ]€Vú–‘]‡sUëbm4cáŒPÜù½Ñkdy±]&ÉŽÞ±V#°®s&Q*Òváz¦:ªåu½†Lfñÿvsÿ¯ »ú/†ÝËKq2ØÀI\ÃùJLèÃ2äÄ4ʘǠ2xvêQ9ùKQÂ;IÕ}G¤¡ÍÓÇ•¸VJÜác‚«´aÊŒâÒ$IpÅ:åaA š[ž¼¬·UGKšGÈ Gv(;4\AHœÝÈ0°”^[!€È€jÙÔm}Ýq +L´4[ÖÉäW‹'Là„¢y¬ I Œ‚… SÃ},e‹[Ù¢ì6º\y››rˆÃ¡8 Ï(âÊ™¸•¢s9.}Eî%Ð*xî<—ñp]söô'Â?fU ¿åñgÏ[ɇF»Ê†‹n£5èƒçæ>`ø89¡òðL¥Ízíà/#§Žú3æ—sÀϬe?;\Žj•É–‘f°”³ÑÆSXwÚÕNTAU\Ñ%$Bè6J4Àp/-ôùâ ôýfç] †vìp Ê[Ÿ$:Y÷¾W}ï1}NÆ“¶SŸ…ÏÞ*<°¬Écðˆ}‡t“*Ð˪Ð×æOX‰;òžÃ(PiQY°ukŽ]èÀzÐí«žkS¥'€oìšzSµ4ƒ…@½oyžýœ„_•èêhN“ lÁ W;Gá” ›ò÷[r7›—?cFœŸœ™O½…œ.‹8œ)®ÖNƒ¹Ö™ï}ï~6xZ +$’¶húºE÷À-rYl/£R1i¶EC–ÍèHr›¢cµÁJªÃ{m8òh”™0Rä¸(?|Æ9É#}ŽCw ¯¶­¸•Ïr7’Ú(‘Ú(I’Lð-äKöÅä)KðNêËNeÓ¡Ò÷‰f¸"z0E² k1åÆÇXtGÌ_,þ+ +Ä›#jÊûÊßH[¦,xŽKsô¥e.Üûš§|2(¢yœÏ ¿®Iß}þòì/Æ ÓvÍÞ%ÀÙ)2ÇÌ V‚àÕ‘*ô@Ðþ Š±ˆól.yØÀø©å?ð>Í¥ìïy¥t—¼@ܼæ«Ê5¿ rRE†IUõIµ<̦À“ðòÈ:ÀªÓ¬mgmüþÌ%SoX\@··¯Ë© 5’¢¥A ¶¸ìÕ:µÔû5ƒnÂ%kÛj÷©†gÈب‡U6¸|¬Èæü"v$ç‰DR‡X}° ßY°S_ àóu”¿ì{¦º«0`Ëc" Þ(­«Tp|P0Ú;Z±#27Þ&†)v«Ž)¡Ê¨÷ìùÑMsˆã`D#Ù§P Á}©q´Õụ;|¶²Ï ùŸ)æ÷Üõðu;ÛR.µÔÃ<†ßÓ Lãe2N Ëdì/H +NtkÞÊÚ˜%Æùó›Rªê’yñxQÒ’ºal6=‹qÀý©ªiŠxÿvt•¶anF¯Ä* ž¼£[5‚º³Ò“ÇÐ>¾Íã”ý³·ù‹Z¡æËñA&3ÐÊbÿ¨XPRêFnÑ:ƒËz"„3yÔʆ;…‰qóßœ¤8#ÉIe×õPÝŽ=eÀeÞ¿y|ñyÏêm×ÔkΡo1}Ûrì%Õ¡ÖÙ×:ö¾ë숸q¨ã/>W{õ6ŸªeÙŽ?ý'¹úZž¯Vc¾…ÚšûŸ¡ÒP§Æ¿Óý­‚e^®¥ú>@ÏS5ÄQ—Á?±³¯íÜÏ{Ão1ÍßÚÆäýƒQ& ÃhÏ‘‡Û4ÓÄņúå«Œ.Æåý#®jå¸~ó¯ÑÍg·üïe·gCáí¸ðàúу²ƒß&ÆÉ?vÉÁTYsÆaŒÁ_¬ñŽŽóÿåþÿ}õÑüh]ÙÂO])W ¨“…ü\?¬@‡5EuZž@™à :Q3›\ßîW$…ÈÜs«éø‚ÿ`ÒPeÃß6îW•5æäw`7Çà«T¶·endstream endobj -6951 0 obj << +7277 0 obj << /Type /Page -/Contents 6952 0 R -/Resources 6950 0 R +/Contents 7278 0 R +/Resources 7276 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6920 0 R -/Annots [ 6955 0 R ] +/Parent 7289 0 R +/Annots [ 7281 0 R 7284 0 R ] >> endobj -6955 0 obj << +7281 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 669.875 126.217 682.776] +/Rect [84.043 712.637 126.217 725.538] /Subtype/Link/A<> >> endobj -6953 0 obj << -/D [6951 0 R /XYZ 85.039 781.388 null] +7284 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [286.405 578.515 342.216 590.386] +/Subtype /Link +/A << /S /GoTo /D (ethereal1) >> >> endobj -2658 0 obj << -/D [6951 0 R /XYZ 85.039 733.118 null] +7279 0 obj << +/D [7277 0 R /XYZ 85.039 781.388 null] >> endobj -6954 0 obj << -/D [6951 0 R /XYZ 85.039 700.697 null] +2714 0 obj << +/D [7277 0 R /XYZ 85.039 761.463 null] >> endobj -2662 0 obj << -/D [6951 0 R /XYZ 85.039 549.94 null] +7280 0 obj << +/D [7277 0 R /XYZ 85.039 743.459 null] >> endobj -6956 0 obj << -/D [6951 0 R /XYZ 85.039 515.397 null] +7282 0 obj << +/D [7277 0 R /XYZ 85.039 658.847 null] >> endobj -2666 0 obj << -/D [6951 0 R /XYZ 85.039 391.739 null] +7283 0 obj << +/D [7277 0 R /XYZ 300.974 648.884 null] >> endobj -6957 0 obj << -/D [6951 0 R /XYZ 85.039 355.473 null] +7285 0 obj << +/D [7277 0 R /XYZ 85.039 540.092 null] >> endobj -6950 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F62 4047 0 R /F41 2994 0 R >> +7286 0 obj << +/D [7277 0 R /XYZ 279.474 530.129 null] +>> endobj +2718 0 obj << +/D [7277 0 R /XYZ 85.039 486.442 null] +>> endobj +7287 0 obj << +/D [7277 0 R /XYZ 85.039 451.899 null] +>> endobj +2722 0 obj << +/D [7277 0 R /XYZ 85.039 341.79 null] +>> endobj +7288 0 obj << +/D [7277 0 R /XYZ 85.039 305.525 null] +>> endobj +7276 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R /F35 3036 0 R /F41 3054 0 R /F38 3057 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6960 0 obj << -/Length 2875 +7292 0 obj << +/Length 2828 /Filter /FlateDecode >> stream -xÚ½ZYsÛ8~÷¯ÐK*ÔÔ -&žysœc3;ÙH³©ÔÌ<Ð%³"‰ -I“¿}¼DÑÎnÕ–«Lh ݯ»Aɉ rùÂÕñ$Œ¤ÐQ4Yî.ÜÉFÞ^HC13$³ÍËÅÅå?˜HWÄnMUè|€ÆËéL:ï_Cëf>ýkñëÅëE-s- È£Àß.þøˬ`s¿^¸BÇÑäÚ®0¼»‰…ïi󾽘_ü«^ŠÇ¼ ÏÒ¯#áGúTAÒPï -ßõHAïöÓ™çJ'/V°‹÷SpO•ó3Û—U²ÝšÎ{¦ò\åÜuµË÷Í9ùHJ&±C‰yÞ.¸ÿ3j?/¾ÂÊUDÒù ÈØù1ÅŽLýY¶ºÒ¢¢¬xþÞÊš®ÚÂ*'ƒ®¼)Ú”4“¨Ã˜6ýü6­ÑÚÄ`;ßÀÜ|ŸUya\b“zÎïk” ß±XE`»¿¢Îö¬$v_cÏ+èçüÅ D”F‰ ¦ƒ þŒ¿6!±‰•žpmÐ4±›m2²‡ûÔÐ ü;ɱ²Qt2SŒd3í -7 -ùàælº™V®³ÌøöÞ É`©¡Û¤Û´ä÷5‡÷6 í:fq‰´à~Ú/=Ca0Iü2_¼¾i§‡ÏØõ:ÖTq t`ÃÂ~½:ÄHâYˆÿQ§éN«%1bÈ'¬hcŸRÚvºöEX‡ž'ˆö‹øÅ(,gKx*žÒtëÙ5ƒIò'Tá‡aµÄíuÿ¯Zñž¤•ð'µâ)Éù/x ¹vœ„BÆt”'£_S»4D/H­Cp¾]FÓJNš1ËVÊIJs -H÷~G÷uB­}Ï©SütÇÉဲäô?Kð\iߧL—²` ± ppƒŽ2ããµ”ïÎÚ1Ð&cGªN†N¬ù®ÎÒ²²* ÉÇŠر¹'|-ya„ßJ¸Œ%ôÝ‘Vq¾³XàHqÜäýlàs0íë°NÂt‹†@³uì:€^È唜R€à~¢¾¼Q QÇ@l˜³ ªJ »°yi\:½\ƒçÜIÊ„#1Ïø;??ãìöà+¦89³wØèo|ï ÍÙÒÒ #¡¹ô^c 9ÂNY¦ý S:â;?aüú™Š§#8ùAÄ[ƒ±¾Íƒv¥ÅŠåµ‡ Ñð–š@óvu±/‰-öxBSëuVŠ@³X›@GñyŸºŠ«"bøüÓõÝ!dDEÿ²$«]¶Œ)ê‡?uÝr}P´XÇ?‹ž°Opx€¥ÐYܧEÊ»GÔÂgÂ"…}¤V1ÒÛšö–EZ­¸ç!åCK1„bW,ì>8¶*Ú@‚NOx(}OøA‰]¥ -ù–B…Ò°€2tdk~Ö Šƒd#ª=ãåÎd4ØgŸ÷ÖKp&ižì=Ü…®Å˜NZÃôÒ¦*õ¸‘Š5ed^nïø%á‡uo:îL!Ð͇ð°sr¶6';‡‡„òÆ1¢ESã£%ÐÂaQ&->Z`ü½L×Ç-ãÚïŸÞ—g¤°³¤€Í¡Óºã¥‚ñDÛÐ<–g7KO³{ì³ì»yŠ™‚:÷u.ï3_æxÉÍ›´ ‡§K.x/mTÝ!ý‘ i ^òå«k~¿£c–Þ'è0gìŽ|ñçù0·¿_BDµ¶÷‹ýÅÆ|jíÜî¼·"~…ùý‹Ëˇ‡>ÆA¿¢”s4"Ï \šH -CÇï—%)ázf&+ -°(ˆ;ŽoŽe•‹{,ÞøˆlOÌBù` AMž©_ ͬE4`èÞJcå9ŒSÚ:êà ͈¢G½x„aãÆ=ŽÃ~Üâøfñ‘‹6α¬ÓJ¼ÜØ®RÓœßðM:’­M²KW"勾Ø*Pí{£¥ß@MÜÀ3ó¸"Š]Ä.[y™¯+±Ìw—«´ 7Û¶¸D\/6—×ïÞÌ/ûR{!ÔéÇ”­c¢8([Ƶ0Ñ”äüÝïÝš‰:[Þ¬E˜ËÚ*¡7åöHjëÎu3‰`lö|ئIiæçwÍEu}»D;5Ó×9U;œ^Ûj )6¨ÒlUsÙ·*Eq&ÖIˆ½.àÀX¬kÑœÏÙ,Ñc9ÛÃ:gësÌÙÚ¯¶TBRYðk© vìRƒ”™ÙbAbÍŒÎË­”gÔ·Œ¬{ÌŽZ³¸(‘à…ù)´‰’n"Ž| “¦Y˜¢Nó³,ʼn™ ÿ\ç·If®O᥾J…6úÉ}úÃÌHíEþiA¼9’T‰¬…ìQàð])ø: -Å C“œ]TÙò¸M0°E¾³Në«Ç"e2:ðƒ³¨Å½U¶³­««½ý„Acö6Õð笅>dàºF·Ø~Þ2ZY n:-IÙæwõ7É}^Ý× Ÿ=¬yaMq¶€q!ë®Ï ×ÿéÇ0Í]ƒѹÆW -Òl+ îÒ“^_^û£™ÿ™&r¸endstream +xÚÕZ[sÛ6~÷¯ÐìLg¨NÞú°3ŽsiZÛÉFêfºmh‹’8¦H…¤âäßï¹eÓI»ÍCv2Àpp.ß9°œ„ðONÒH„:›$©:M'7Û“p²†‘—'ÒR„#Â8¡§‹“ÓQ<‘¡ÈÂl²XÉbù[pþãÙ›Åó·Ó™Ö:ÐFLgI’gWgÓÔ¿þçÕt&ƒ«—<~võŒó© ^_L¥”Á¿_¹ÑùÙåÓ3n¾y;UiðúéÅóK œOÿXütò|1àlf„‰5²öþä·?Âɸÿé$:K'wÐ…̲ÉöÄDZDFÛïêd~ò/¿ +™ ÏÀÌQÌt(ÒÔxIÈhDgÈr?™8 +úM |wø»éL%ASÖDð:3$”Á¦`‚«¢ß65Ïü=”†ªåÖq_‡í ô6ûj‰]& áÐUÒ Ý7­QX§/ôE¥!mýnþë|ñüòíë׋ï~—ÚÌ?u}±Õ +Û5±‚­ïÅ÷¼ÒÑaeª…J¤] ´ê,X wxº§€ÜT( ÊM¢ü2¢íö×$‡eÙ—ÄÿMß´ePfìDÊè ·£°zUõdät´£”±<íò¶+Ú0¿I…IbKz·)oë ïuƒû6¬¥œDi7ïQQب=ç¬â4Çó|b‚gvÎ +ÕÕr{7Eª®¬×¼‘_o7%¹É$É‘Ôv9qx‹ÿV.è Ë=¬¹Ý=᯼^ŽÈ%ÍÀ°Xnò]¿o‹ÇäIØ2òjen D€ÖD˜1?‹iªAË3ª ¬ÙÆ%s^UÜÝoXJ(eSÃ~Pu<Æý0Ñþ^-¸ÿGÓÞúÅó•ÑÔxØÌ€¨ÑÐö<é®tÛZÇi»ž¿ë‚äµdºþ/ñŒ;Å5¨Û[Gx¤—Ë*{T1!Ûº¨­ÿãçªm¶Ü"]kmFE"ÐÈU×3/0ãü™Á» <8ŠÆPJÆBǨf‡NFŽ ˆ'¹¿l$LñÄû‹âÐpÍQÄ{ÙØ36lQ*Sf©³¨yŸOu´ýˆé©TDÞ%gÖŽÓáJ"ÖnüŸ#;I%¤r4/úÅKþ»îÆ À&_k¿ó¦îÛU'Á›©F{.ª‘m •~­m¯,h^lCâ½;n$Tô·÷U^¼í‡ò¦•+,”ɯuÀ³årÌVéÂÔО¨„9¬ôÛr–yQ7·óP ä#¡þ‚žÁÜb!4s²÷IZ6C#š6Àe&Œ +6|[âÙ ‚Þ-÷6õs&qìœçõÏc$N=Ù·¥žóª´‘–ÐzüðZxÅŒžÌ3Öîüe}¤hZö8¶XAŸÛœcMcƒÀìA$ùÿ2òWuGÛNvî Aò‰Ç¿ë¬HL÷Ž2 Š·‡øìB¤ áƽXÉ¿w›ÂÒí òb¾ÕÛè/]6ãÅör¿jX3¥À š~a"§ Ž`fQ¹Ì¯ã>Lï(Æ3qÁ < ŽÎ5çƒÏÝZ¦*ÇRt™…VÀ.Eó¼X‰$uë‚òñ.CˆýŸ6€‰ÀºäQ6DJ‚²ud>Ùé|–“ 9O9ƒ6©¸è™š $/°­‹ßDÔÁüŽérû{Èa¥¥“u±µT»)g‡k•yoYZQª–¤~6Ã%Œte_@%¥að+¡]Ùæ–Ðò¹äÃD0_n)§,½Ñ¶pd§s4pbc½!ï<´û†s.‘È?>úÜŠ~Û=ÕvÔ¶AaK9èã‘@©™ñÊÊ‘%‰÷æ#œsÞ å¼°$L(“¡ƒóa}Ê¥&°±æXteúh ê‡Š¿ïÊzÙðö-¤Î>ž^#)0X·J9Ž–ÂÈäóàäkØcPðyì)’EC·|ÆÈ'Ú.ãEǼgX¬"§0ib8étðÓ<ôùHYqÄÉ<á{XIÀ犢–×®÷ÍÊÁiêøÐ@Qšv–L0%^3Dá>D©H#Àȼ- ô ÔnŸG ‰ "» 0PUNgF§ÁbS´ÄALŽ‚¿9ÿ´la‡@‹ŸŒ)T®Î³|A¸+AÔb'’öIj@Ù´Ö[[Ò¦ è¼'Šô®i‘:PnØQ®ø×Cúkbi©j.ÿ·ý°Ïýn|ÐI\M¬V#wm<š ðæ>2%ƒÈ”pÍ[–go)ø‘ó_Ê´·d¾kî»wé`­%r9˱[ÐÆêÑ(†4òsÞ˜ª#p1B›ø¸8Tù¥+V{ë2¿¼½èÜvc+'`kê[ËìñÏ$|EG¹ ~ÇÁü¦Áb›—EÛ¢›#2àwçbÜé÷%;þÎÏ{à’OŸó÷5ùB±ÉQ£J{»D”ýý©8aš¹#aW»¶co_~æ$¤zŒŸ?œžÞÝݱZ“¸Å]wÖ!¾ o÷ý©0´ÿxÚÑ¡®¡gfs/ËÐÐí¬ô€]³€m²zÌÂXHs˜:PÒãçxS)”üF“æ‹7×1á|ÀÝR²P- Ûœ#’?eR‰Íœ¨€ë~¸Ï˜„R2¤’ü/ÚÁ +Ñv&€|ô;±-oÚ¦kV½¸i¶§ËâÒV %[§„µëÓóW/æ§ÌTKh¦!ñA%€Í"z4¾«T$QôEDÑQ^r6ÒÓ•+EÙ¼¤—¿“à‚A–«øþ‘& Én<óȃºHH)¿xpô3 +¯©Aß5ÚþÞú é²åfÅ¿XJäÞŸò™K’Yúù0,rî<8+.Qù\ºïð}&Lè懸H8R¨ã СG¡` ¦Ë·×¹hÚõýu3 ¥ñ=/y\bøH‚7ò‡¢œdRóï0ƒ'|Ñ©Û‰†‘¬.@Ôî%A«8Ø–mK.m_‰¨CNÅi 6Åq—èÄj˜èD‰ÐÒ%:ó= "=pÙ~üÍA†î¯êiž-ƒ#·0Ð;º} +¸û»U0­‚ëmTd}AÅ bæ¬:À"(Ò EŒ¥qÀq"Õñk€Ñ™ˆCã!”‹Ë< Mqð~ï“(Êz8™J1ÅÃ4‚?ÒˆSè½gØܹ¸zù„ÉÖ–ì¡…Îdé…‚`9Lúuƒ²”¢0ûz-(O_Ÿ>'Ò0–ãˆfDœD_¼(éùxh|¹•“ ñÎQ +ÞÓ‡Â-–Öê#%R­Ž¢*YsÞsˆ8ÔÉøbÄ)&ö£n{=³£M›Î~¾ß¾µ…7LÈm]ºïÏ·÷Aiážq]Åê‹[0¿šrâþ-÷?°ì¬µt'\‚:x€zµâÕÏÖlvƒkÖœ û`·¶Œ9N›úpC׬Ž¸×à+]ß¹öp¯³yçæ\;ë)Úaå?¼ù[5”Oj5~ à5×ûÒ_c0tVòbúAë w(e¾©T欢Šƒ’ÔO˜ÉJ´t¬m1 rö6ÌH,±Ð\¹Uð / &æGD´°æ‡×‚ÛDI"Þsõ\­ÓšÑr€òŸx3ÄRygÀöŽž}—üႶùµþ“Q kÊ£úi½'¦rǾX¦lgYеô~Kˆ_ðXΤüTLž4Ê•AË4«"ï÷öÐHL~îæ&øòÝsøÀ‰T½Ù‰}¹Å®XÇÁYmkI×_YcÃõkc?PV×\-¬÷Ö£þqx†¦ËtãªNï€Ç³Ço­ øºzäÖêPü¿úÀ¿…H‡õÄãælø­üú¾åü/í±Féendstream endobj -6959 0 obj << +7291 0 obj << /Type /Page -/Contents 6960 0 R -/Resources 6958 0 R +/Contents 7292 0 R +/Resources 7290 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6920 0 R -/Annots [ 6964 0 R 6965 0 R 6966 0 R 6968 0 R 6969 0 R ] +/Parent 7289 0 R +/Annots [ 7296 0 R 7297 0 R 7298 0 R 7300 0 R 7301 0 R ] >> endobj -6964 0 obj << +7296 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [371.404 348.137 539.579 361.038] +/Rect [371.404 310.125 539.579 323.026] /Subtype/Link/A<> >> endobj -6965 0 obj << +7297 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 337.315 167.248 346.883] +/Rect [111.316 299.303 167.248 308.871] /Subtype/Link/A<> >> endobj -6966 0 obj << +7298 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [261.407 307.489 476.733 320.391] +/Rect [261.407 269.477 476.733 282.379] /Subtype/Link/A<> >> endobj -6968 0 obj << +7300 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [375.124 221.969 468.752 233.962] +/Rect [374.933 184.597 468.561 196.59] /Subtype/Link/A<> >> endobj -6969 0 obj << +7301 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [290.756 181.322 436.427 193.314] +/Rect [295.139 143.646 434.192 156.548] /Subtype/Link/A<> >> endobj -6961 0 obj << -/D [6959 0 R /XYZ 85.039 781.388 null] +7293 0 obj << +/D [7291 0 R /XYZ 85.039 781.388 null] >> endobj -2670 0 obj << -/D [6959 0 R /XYZ 85.039 539.573 null] +2726 0 obj << +/D [7291 0 R /XYZ 85.039 498.8 null] >> endobj -6962 0 obj << -/D [6959 0 R /XYZ 85.039 503.308 null] +7294 0 obj << +/D [7291 0 R /XYZ 85.039 464.05 null] >> endobj -2674 0 obj << -/D [6959 0 R /XYZ 85.039 421.243 null] +2730 0 obj << +/D [7291 0 R /XYZ 85.039 383.232 null] >> endobj -6963 0 obj << -/D [6959 0 R /XYZ 85.039 378.958 null] +7295 0 obj << +/D [7291 0 R /XYZ 85.039 340.947 null] >> endobj -2678 0 obj << -/D [6959 0 R /XYZ 85.039 292.046 null] +2734 0 obj << +/D [7291 0 R /XYZ 85.039 254.674 null] >> endobj -6967 0 obj << -/D [6959 0 R /XYZ 85.039 249.699 null] +7299 0 obj << +/D [7291 0 R /XYZ 85.039 212.326 null] >> endobj -6958 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F20 2961 0 R /F35 2976 0 R /F62 4047 0 R >> +7290 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F41 3054 0 R /F20 3021 0 R /F38 3057 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6972 0 obj << -/Length 2805 +7304 0 obj << +/Length 2762 /Filter /FlateDecode >> stream -xÚ¥ZK“Ûƾï¯`NSâïG.©ÕJ–å’dE»åTJÑK€$² @ ×̯O¿€ ÷ri1žéžžîoº›v6üç,â@Ù^²ˆbGyq¼XïoìÅf>Ü8B±’•AóöáæÍOA¸pl•ØÉâa3ì(?ðÙwëîçÛ¯ï¿-WžçYž¯–«(Š­Û/·Ÿ–±oýëþã—¯°Ûuµ\ùIb=£òw û´C -Ûúçsm`´ÅFO\o˜¦M÷xy¸ŒGN¸ª>r'Å•93<ö›TÐÚ -A•]à^–+عçŸvE%‹ÚSÛÑøžûE×¢>AK+ï-¡C7È°B^´ÐwC눽,oÐn]°×e쑨8×îj\PfÜ=45ê±<ñ@Yhù;èv96"«ÉËüeÂaH£<Ú’„kÒ/-ÄAT®%5šÏCj]WBfâ£@´ÏkóTÎùAË<Õr¡u;Ö9zW}èPìºj¹ª‡¯k}ß–õcZÂÔ½(•å)ðõDöÁEßÝq»= ‡Wòãµtê‚£†I¨<;ºê:Íe×ÑD/¹Î5†½ëL9κŽÉñc…gõ­4ËÐ’Ø]p «å‹f€ Ã]Z¾t¸47¥o˜ ÷ ìÔ]ŠWSåÜ<ÉØJûî·{&Û0´Ä2d‘+GÊ,í¤õ¼Ë«ÎeÚÎYѹË>öbë©?Qƶ‹Q³\¾ü Paxýî{’+WÏ4/ÞüenÃÅÙÍßûÀî¡¡×÷œˆA -{ÔEªÕâ9±áÈØûtrÌÙÙïx|ÍNœ6“ý›B+|Ãöâ¹àñu×ò:„ ü–dN[™_#}M&@6W—Ç.Ïf$ÐÈã9‰µÍ;¦È­:¹Tà -:ö〹(PÝ Ä9ù‰[©b)ö‡RŸ ËK¡iôPšñÀ_–«ôùŽzÕñ ã{ÝC* íȬIË%Ž¸–X»>4áN¦·Ï˜†èó–6J·xxßñÁ`µ»á­{ ÙÓŠ ÒýÖ³ŽQ—|Áàµ|7|¹Œö8ÀÛv º@$û„q.ú -{è]w–抷Ñ‹îr…áà/Žócpüˆ¶š„ƒ¢½$"K8V¾XÇêøé( @%`@#@žs“öøØ®›¢¿ßuù„ðÝóCƒ#;‚f—à•· 0œƒ'ù˜Ð g ¦é×|#lA"͆Ѿç´ìÛ¢,éMÞ!Ôˆ¬Zäk ÙÏÛ{~†Éˆ}Jo7#<53LK.ÊR¦´dlo²UKÒàÀ`™hêG>Ñß-ÚAK1âG²sÃ3 ÓuI0åi©×ÝNÜ­:RD5ÈÖòæ5ƒ™H#%¤§´É8Ù( Å…†ŸQIóˆçG‰ -Ü«€7\Æ;¡y î®pëÑnÂnì v}ŠéEV±å(‡"Š¨«uyä˜äzóp¶L\:È€›–‘]™‘Ž¸{¾ -=GHË-!â,²oZfúÜP*ÃÖ4„døåé>¾Â\ä(û`Š«Ýªä!¶TYK˜‰{Bž#¥»ñŒkƒK‘Gy¥Æ-»ÐÊq#åúñœì­¼Ób˜‡çS3š!÷eÀ’Çã¶äÙÛv7~¦·=º!‘™AÁ6GÍ9ÐFv!gM£Í{äµð½hä^¬âè+h®˜¹½hçW†>á8oé#Žý•<š¡M«'Î8˜ -$bJ<$¤ÐÙQD¦/ÉRþ¬%ù!êd®Ê9A ÜVwTZ h" -Âs›w ªLÖ“‡šjCHQo&”ȶ8hÄÄJùM¸lÊ’fðŸÏl¢uHÎTª0¦-ë6Uw·_yØp`œI¥’ó‘>1 A™m@´%Ògð½Àz06Wi™ÖØk‹X[’Æí¥’”"&˦•½Wœ5ëBÃïyÐúš}DnŽ ÎuÂ+‘€¥ÊÍWjx)ì>Iì²9³ |Ë"ªåP”¡‚Õʪ±[Ãu˪‘ÁñÕ›œ6éÈ8O¿äÑ«‚jk ù— ³¾òüÐøYÇs=åÚì^:ào9 Xëg®³xÄ­¼0âë‚/ Qc›!šŸ˜ tölê¨H'A»ÃTí¥ã@8™Äõã 4çp!D.|=ù¹ƒŠw5—Ø(S3ߣj‡ ;Sá½¥{x;XÓß×x?¼ŠŠk¡<'TÁãQ’%%Bt‰³"*ßÙì’Þ!Ç0ÐhG%÷ïŽ  ¬æbB_‚2÷“/^ØŒÓPI8„ðýV¨y–M!݇ˆtíFŽŠtœh¶BñÍw¡^ä3à>ÙEâ"Y‡þÛ›7f©F -VôÖn§bº~¢ìh,åÄ„äºh“}P²×‡Ð3Û—žXaZ“$`ѽʩÐÄÕœÞb[§m¤ïdŸuYHÕ]oO1~èš2º¾rÃD‚üûãá€6%¿ÄÌä~¤Â0rLš)ÊWI›)ÝH‚@’†+¹Û¹4¡¯b¿® D!?ˆ}®—t}\œŽåA!ÿX‰ƒÄ˜Û#4¶\38³/cÓpeå‚Ô‘‡—©ì$ž ÀËû+®®$}uEº3cXÂõ–Ĩ Ø“Ê@ÿÔÖ'ÛD/ëŒÒ†=ÔÀ÷µ‰> F¿æ9fM:–÷ùF.ZÔñ¦ù†CΡübÏ ©~ð{0“G(ËúZ‰)1p¦MKyõ§¿ š!­Ü0öO+ªŒœ­ÞçFä:”^•R:E¸ðBØÊMæÜþñ9ÿ¯ÿÀH±Tì%óظ®r- êÕw‚©¼$CAì ü?Jï×{endstream +xÚÕZ[“Ó:~Ÿ_‘ÝœSÄX¾{_¶885\–™:[,ð IœÄ‹cÛavþýöM²“x8[µ/PD–ÚRKêþúë6jÀ5Ë?ˆŠY–+?ÊóÙrwÌ60òâB‰D0‹ý MpèéÍÅ“ß’t¦¿ŠÙÍšDnV½g//ßÝüú~¾ˆ¢È‹b¾È²Ü»|sy5Ïcïÿ^ÍÊ{ó‚Ç/ß<çÆõ\yo¯æJ)ïWvôúòõÓKn¾{?sïíÓ«__ƒäõüóÍï¿ÞŒ4[Ä~œF¨Ú׋ŸƒÙ +´ÿý"ð£"ŸÝA;ðUQÌvqùIÉs}q}ñ7 Å3~kâVb~žÇS2*õ£æp§«‰Sú¨ìt‰' ¿x:)çTÉÄœ—õ’Æî»ù"N3oWâq7ó°ðúÊ4Ø™zw[ÝsëÊ–mç†Ìšñ>ônfÞ-¶x²{”6–Ð- ”‚ÜkíLuùmžàpÇ"ØÑȱã:¬`8ÐÕ~ò[4¾ž°Èý¬H䒺ݭ¿4Íšî1 ü0ɉk«ÎcX'L<-šÔ¥vÂJ:­E~DG‡fö=éE±‡ÛoxqXëhñ"“µ?njs«ëÏS:8ÄVG::T +'Ö qT.E/òÙçϸAÊâñìùþMÛû§Æý~˜îI ž™ýXžõ +¼0ÑÓ«ž{vô gDØfŸ"{$¿âë ":ú5Ë8OÂIÌ-^‘®šrÅ×GžGsVCûÙ×Yn‡‹”l£ƒJ#UVº—ÖݶlŽ—>÷¯ZwrsK\~[ÒÏÚΊ*0‡ïÜ`øiüƒÝàÍ<¼öÌ/ Ñ­ Â$òvú‹Ü>=™:¾BóP²·ñev<@†îT·ç3ãõµU¹PŠUæ]™^^EØ@ášæÛÀe†iá(àâd=¦FW,ü "›R\¥Ve]Ú×FœÐÜ2øâèÞ7-ÚF’:‹Q°}èH´ãàÒ•í犼’ÅH‘v ©ˆÿ2_$*ðžlLÏ ñ|‹[Øõòæõ·Êf ò°ñôpÜêH\oxß>Oàhžý°/cõDÕM3aä;]Õ6ö láV<[7B«jG3Ýsëhïø€îî'1ÄžL°' $¦ò€iJiˆ$µŒ4„a=1 îù¤¢øÕ£齺Zh… %æþu41ñŽœNuÓd YÈŒfÄmЗ ƒ‘û¢`whEѪŸbàcW7äàdj*a WÖT¡¡«îÝå83â‚Y‚âGŒ‚&l1¦Ktü¨ð.É—Í¢e+Gh˜NtÇ:ÈühzSó‹t[êšLÚUK0Ó#ÒŸy¼‹d°ÆÑ4†)atÛ`äâFfOþw(JWÉ‚eCQ ô{ØÚûýæÎzi/ä4ºæï*tœí à Ãê$Æ4e_}=XP‘€s«e1@ÈÊ´?—ç='¼~„]Þ²5ˆkØ<E4 éÿDë6íÄÂc‘¼x·­Fdž£•ÌcïÛ·¤e'/Y'¾ƒ×3^[䨆‰µcƒí³´K ÓÃjïG¨ëüE¶ð\–À~pªs?< !8rÏv†MÞéq“("lH/˜é ª`PBQÖ…Ȭw(‚—ø´¥|¢µF·%3ﵦœèž§™Š 4=ÓÙÊR:ìCŒÃ‘uSG]uÙ¡élû¶£7[<|¹‰c O …Çt1UÛꆇ“¡k§x„¶ŽMÙ³yuc"-i · ¹[bXNOž˜UºÐ+â‚ w˜ö!Ý+‰ÝxÒqä½];*3;æ%m4,,ê[Ñ /vkþ9SŽÆÈ +à ‰+_(ÉÙð`e(Fý3ö¨Z^°wCÃ#~Ô;[D0³³Td™ÐI¦¿º1‡’Ð*0F!î—<‡ç5iE”ë”d7ü»¦³ŽÆìôaüË•É…Ò(ªKˆ«6[*I`WÆ9é²>p"Ϲi1š§ýTÙät?Oo÷•®'òÓ(öÓH‰hm0$eéq2Ýñ¢wxâUß3õH9Å_vE M™Ë–ÔÜÕ¹(äi8‡¬Axt`: d³$ÉŽXëNÒx…w IöØMVTR)¬v|Åp’°a‹>9rÕ–×5Â{i[bhÿ>Œ ¾ß•m¶ãˆ{¼({B‚m¸ ö‡+–ÿ±ö»¶j ,D\þZ£žfúßÍ-óX‡Áˆ¼ÂÃV»lŽ€‘Ówà£Úí=ö2þ¦ìwäò r)ÝŸ‚$X·ó°c@nÅ5X¡±ˆ‡/чo'ää­r1Žæ0çs•mKx *D®0:ÞÑR˜ã†?`ˆ±÷‹Ïpôò¡+Ú «F嚨\]ÿ\U…wCÏ ¶É4%˜_°#‘csI2FÃCïÝóøiVnDæÓŠ4³>{ËøžæŸ•åM¼ºí¸,ÄBB®èµ†ËQ*P”ß“qd[•-‹ïu7”lqÆí¡iK*œÒ* ï +Ñü°;~âd˜  …HI0Îd3+> Š²X.)Ô gCséƒÒ¬À»±ÙŠH][6È«eV¼Óãä +{6V-ùÕÜMñê°‘Éi|ÖT¨ãªöy„?É­F“ØQÂu’Fr :t]ˆÏT\œK³ç,a"IÃGXû'¥è ñáÝ?/EÇ…˜?ÊUÍ©ŽÈH›Þ§d}p––E9{¾ÿûîø)üÉ/NpÜàÝÊùaݱÅéØ!êã‡&0Cï%ñPu%#_À¹HjneýÎi²¯9X!©9¡ƒ±Ñ.¬Å,¨ó¢ÕB²ód +ï¡e¤r'YõRjy!0prSJ~Rvº/ìo7"ðþÅw.iKªöè¹{òdŒ¾ËN}*©nÎâó óðJG±¶æÌ•jð´-bêø{u4%ÕÊ@«ž;vÎK9¦?濬+"£Ã|äúi8ÒDå±_ÄÖ÷¯˜èG!§xýTà‡3¿(Žéª¶¥¢žK{–"Ö®‚ñÅå8ç*䡇öƒâ8LtK_?b¶©šÀ¼çï%‘«ÊUDC6ÜI2”šŸë¬âÜÏíW,ŸYw)? +B¥¶3߱ؼ²…mKħjÛ.O¥;aVK•vñ#  Ô8.&L‰€=8F—Hy0‰‡t•êîåÎpñœñ/ÈG¹Vbsil™F(G4¦<¥7·Ux»ît´×6`;%$$¬VŽîtRdDK¥æZņ-ɾˆÌÑ›k†dû-„d©YÛj¢Ù ›´5b®8#‘à“aìÛ ‘ù…J¦±[¶ùÿýw‚(óÕàß q”œ!LjÖZÿ Ëïendstream endobj -6971 0 obj << +7303 0 obj << /Type /Page -/Contents 6972 0 R -/Resources 6970 0 R +/Contents 7304 0 R +/Resources 7302 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6976 0 R -/Annots [ 6975 0 R ] +/Parent 7289 0 R +/Annots [ 7307 0 R ] >> endobj -6975 0 obj << +7307 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [143.619 268.031 250.066 280.933] +/Rect [203.642 254.482 310.089 267.383] /Subtype/Link/A<> >> endobj -6973 0 obj << -/D [6971 0 R /XYZ 85.039 781.388 null] +7305 0 obj << +/D [7303 0 R /XYZ 85.039 781.388 null] >> endobj -2682 0 obj << -/D [6971 0 R /XYZ 85.039 352.566 null] +2738 0 obj << +/D [7303 0 R /XYZ 85.039 339.017 null] >> endobj -6974 0 obj << -/D [6971 0 R /XYZ 85.039 309.613 null] +7306 0 obj << +/D [7303 0 R /XYZ 85.039 296.063 null] >> endobj -6970 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F58 3360 0 R /F20 2961 0 R /F62 4047 0 R >> +7302 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F59 3455 0 R /F20 3021 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6979 0 obj << -/Length 2379 +7310 0 obj << +/Length 2354 /Filter /FlateDecode >> stream -xÚ…ËŽã¸ñ>_aì%2°Öˆ¢ž¹;˜d3AÁnÁb7Ú-[B˦¡Çôô~}êEJ²å4Ð"‹Åb±ÞE«MjS¤a¤ËM^¨PÅæpþmN°òó%IªÃ4I`¼²¸s«»,£$_Å‘3v¹*C(Äùôôáã?âhGa–éÍÓÑ1’QXéæéù÷@§áv—¦QðËVÕu»Ó*°[ø×mw*€^pt‚•, >4é·ÿ{úׇ¿?ùóå< ‹l•Ãh³‹u¨óø]ö3¸jR¦söUÊæìÇ|•c_á’2ør:Kü?‡¡±—G<ÊöwÙ˜pˆ •nT–Q9c#-ŠPÅ%±ñŸ¥‡¢1=|´N‚…í`i@˜ö#HŽFcß\N· ÆQæ:ó”‰C\èN‚ñËŒW‡½›¡ß3{K¹ÝÀÒéOdõ۶掓$ó膓Y9œïœC Ïñ¸ÍN¥9f”ò0*‹UA¦I0˜—-ÈÑÍjF qsv#ËßÎï~F€fô¦çÕ?"•à}eÓô“3úÀ¶øgG&Ðã2Êkn·N Z* 2JƒŸÚÞþˆëEpm+C”ªÕJÎkŽ tôkCî…£ÐñYh‡-0‹·1—S·‹ËÈÝ`À¥WÝ悼”ÀT;IRý¸©‘¸T² o Ê<™Ý\¶ >Ô•ÃfQà˜E‘ƒ(†9î™x˜QBË#1œÁ üííYEG€ŠC' ²“u‡Ë³À€¸yôŒÚ`Ïß3Þm<àÿ!©_™´ ÀQ¼ðÄ­@,d ¶G^ kƒo]µW Þ Ýî…!Ïw¿ -)’žÆ’BÉ£àWClí #5ŽW‚ø`H€tôóŠEìE_Zåd“ª › >˜ýÁ 2!œSG—¹òÌùˆ[Ù«Hɼâ®Z¤ó¯$‰v¤d€œ±uLÁ¹$œè ¨\V#:@ š~iÚ–5ŽÍExªÀ'5"²çA€t]ÿ݉c¨«H3UóÕ…¢ÓšŽÇgôÞ{([9qÏ:J4P#ß¡&Ó½õ288 xvß»x¹oßÜ-œ »Š"Ý9z‘Þda0©É˾ÎÕÑx;ñÆF5žêJn9sŸƒìf5ãÖ\úWÄr[PÒ÷r1œ…0 ~ã!!øN̤—pÂ&Di‹¿†sÜÞÞøB­½N1µcTÔR×TDmß~p‰#%JGÃÇ Æ!³2#ywzŒbL:YÜÂåÚ„­ƒ”3¬ÏÕšÐåìÀcFïGŒU8à–B¼t(üò ∈î‚DÆ:r|‰¸€@cÏ×ðŠ¢±¼ ¶% bP˜Ø£{¿öè¾W>œeyÇoJæ>è¸múaEû“dc°µ¸±/ ÐU”HcJN왉 -¾6Ù -Lú±Ÿ)ÿ ÔY„sd6 \QñvßVg9ÕOA˜á7—XÒîrù`/’ÚO#bªþøñÞ›Ïù‘8\âL qc`H¢Œ8Âï¬Pt,¢ÚðÛ£i/¶¹G7‰òàWd‹\ù7Œ°¢5£Ö „$1[$“ªºŠ‡Æ þˆÒÈÈ‘­éeDqÒN‘°¯¤QñÈ¢.1¨ÜËbì«NÜŠD¸æ‡³ø›U½,#ÈÏäp¯ÙSå…›,C¼à[ÉKSZóÙ߶hû#ÛÁò¬8uùFmã+ÆX²5BÙÏì ïj;žj7\—gXv ÃâÔÃÔ{Y1’•H,û³àµn|±A˜r«È—>€¦šÉé\Œ”²ñÀ íÝŠÂúÆKuR˜üÎèÈ©jϨWsªDÝf¸o’0MÓΡoMâïµ#‚½›¡S; —íÀ’&^¡†ë_?~ìÍyoBÛxôñ–(¸XrsÓ’Ê ‹Žä†ŽoHVZEÆa’ﶊ3œ‡+D¢0‰}ÇKÇú3ÛZÕ™–»ëær´Xï²2á<ìZ!ù„©bÛù´ì}`iÑîøW \(Æñm‹‹0_¢¸z¿ÀŠWı1|&…wEé[2+ ŒoŒë «Îv=È.‡îåß“7#¶¼SÜŸÓZ¡=kþ¨r˜wïU–jë¯HÕRÍSäÐÁpy.#$J¡”â_aÚ³–S†ÄU'à¿lÕT â YoÓ™¯áa§ëŽ†šn|b(—Ó0@ôñâ˜é‡«éÎ2³sWË‚Ipf\Le–랥¾²×Wð@%ÐuÞ|.2ß–Q[þ.+b,kÐŽs™D6ª8n»äSÝÅ-‡e¦®ÁÃcîÀK·x°ˆ[‚½›¡¯ÏÜ|znðÙ 6Ú%o…kê|6?óºáUäÆ1ßVò0ÁSˆSkÏhSwGovÞ{8Ô”Æ{´‚ŠÞ×üÈקྊNjöæË~%/æ ª+¼Óµ³tµ‚J§PÁOŒ[7'_Su rWãàL ÓÔˆè"â71¢îŸi|Ã&eE ãô;Å]7º_5ä±Â:_aä²2°V‹¢ž¹;™ìd‚=³ A&Ù–-¡eÓ‘¨îé|}êEJ¶ÕÓA-²X,ë]´ZEð§VEFº\å… +uQ¬v§Ñê+Ÿ?(ÁHR¦Iã…Å[Ýdq%ùN´Úè"LÒ ?>~xø5ŽVqf™^=éqÿ¯@§áz“¦Qðu­‚ú²Þh˜5üë×Ø ga%Ë‚#M†õ¿ÿöá/óÓ’0RÅœÄ:ÔyüÖb&Y2gS%¡N²62š”Á—³í ñ¹w¶5gÇË’ò°ŒbOZ¥+¤œ“þ{‡7ÇkU|’ˆóÀôQ°×tkZÅñ€øíyM‚AŒß«Ó:.‚mõÓlT–‡J+§JõGYûúùœ}ÿm»®º%zÍt¶l ¹L–Þ&|¨vm‡ªµm-—ªÎ{iY¶z‹ˆ$láq{r#×î½äö °hÚ'ß"•tµä D†·À…@ïÀ˜ÒzµQhÌ%qöŠg02§Á0nûD¢¶ ªøÃúÀq61áu††’GÁ/Ý`~œ" vH¶©á“OLï@‡àÖºfZíî8¼}5ðm&ÀùXï…¾–Eò/¸^×g^éën²)°a„‰¥‚Ì„On½¢HŠ®D3?ßYžÖ ˼æ1Êk$¸#iö¤è³€OÄ ¤B2-IàÄ«•eBƒ9 I!ÂF ]á ü6*Ë%Ò™ö(ß,æÃü„ì£ÚäW‹“Ú¸#:gž¸pJ–$žtà]xsÃÃÆß]xŸÅ[W^á†PKB×6Â'‹ MFÇÁ︉8EpÅíÀ[È+}Œ^Ҟɾuêà -(n_ï[º7n·´KeÁ±§[]xfüei×æ"Õ*[ÜæÏ$DY#uÝó +›BÛ3-öW é©’ ý 9éºñIÿ¡‚Ëjp Ä‘è2øǺH}M¨Ûg < ”ä8ø7-Š¼ðÀ©X6e[‚îÀ4³4Ø9 øóÀ±Ò½ò +ñM`·QQÀ›æ1/£Í¬*aÏAÀó쬊×(tìv{lH°0uyNêBFøãCÐ Þâù«Ã{¶%Ù€¡ñ»X×ášÙ{I±Ý;U“Ž»fÅÓoJ'ûúÙK-È!õŒr@Û‰¢¼þ὘Á0ÛT2êj+'3Ú߆­ ªa1D|2H9¡óåqE2F´SœóQqÁRAˆW!APe rcDtÈGŽõ`Uæt /F /¤B‰}˜¹'öHN/zè…y\7³m‹ܵƒ}ÓÖQ@Q>…þH\›]’}©G”žÉ³àËa“AGÛ—¯EX6ì£rÐÕ©²µç½—Þ?Õö£‚C` Wüñ¶áÆ×Ë;sF 8Rx®¨X4g^º ™-œðó‚@8¿F|nîËkÉ`ÀÙîV“ç ª¯D^¹ˆå‹/^:U­× +.w>ËYŠ¥¤a%³2U?‘´ñ²å0)¬’ëã×6ŽÙqðHè’“Õ’I¥Ã¼4F23å’‰Ö$6tömW‹C†L9Oòˆö‰ôÚ :ñŸk4d4ž8¹9+†HØQÔ„Q׺gÖAÙiÌïGñ7\—"8+1ìJD}•ªç¨* ep©*Î@$­Æ„)yC x +wçÖÉAΕ<wÌÑÞ̵rdm½PIcZ<¥{_ +â–Q/Õ±v‘ØÞÖè›$‹é0ÖÅJ½T¡7Ö^þøð0T§mšþÈ£‡»ÖB«0oZ·ëþðŽË¸Ôa™Ÿª è ßèÐÊ0J‹w;´X:´Ïlu_uÜ5~9 §„~áäƒÄ;=›úqó‘ôÕ‡AÛH@ófC§õÝ™¦´›è؇3Ïz<°:è“¥0õM"ͪO8 ¤R)Ṙ)¢¿2¤î{Ó»PÊ“(ømò&DVá«fA¡”ÇåxìçräE*FŸIÈœ¤¡cûÀ\éËP +}œÙ¡Tôq¤c€pò“/–N;Ü\ŸC­–|mƒmXò˜»R|Ïî ÁªO4Lû¶A›Xèy&©†TzM©Õ”à îˆm&¹èÎô”\OóÊ¢ú¾VÁR„üëu}¨ç$–?^iˆ°wñ‚j + †·¾‰Y²—UIo4¼€?lþÿÜT()+©…Óš’éïi9Û‘Ea¤e×#…¯4‡ð…þ´]§1¯´Šõ:…>ä‰óá]ÈRi–P­ýŸÁäO ß$…%»¢¼Ü·þn}M|ò¶õ*HÎO½VÜS…ò.PÄ 8}U=R”Eó’^Þ_vŽú¸€6ŒmÌòñ‚Æït®…ã¹íÀÖ—Ö6×g±øÓWC™ZxuÀÜ•aÕEO™/jûé ²zäæÌÕpe‹ŠøNLÔß+®éX€÷¦ÿâËó+c5F’áöfþjÀù.žòÝ®k§Äí_f Ñz½ Anj`àyt©—Η¦õŽÎÔ,•’I'R÷õBŽrö–aoç(Ü»9JKŽúDÙ²:óà7dê¹î–6ã0/ßzaMC¥ÞÉUhºq)eR\NW8n°ÅAuæb +OßQ”\áwÏý?Ù8ä¬î%Â\/6ÆæT&O¡TÔóEe!ϸsí9ö û¥Å W"°¯ã°Ä­¹¸Ò«²»,…^‹çÕ@YQݧïÄÓ»£Ž!’§ÆWžÊf«› +Òx@¹,'V3O„ÉÆVâ*÷E>\©`Ö‚ýiæÛSÛL`ÂŒYàtÞôPi,õ7è®Út¦sXpêít°{[”]ü¾X?…ø TÄð¡ág.~ñÄϯ»€¼˜ +›$Œ¢Ð)R×ÜBŒB×)Tð ã6íÑw =ƒn¯ ãTÞëZ3Ó õ½Ûk¡C ·›1ŒÓ3Ä]wD]&ÉËOÞrø‘%¨'žH³Loƒ(ÎpÁዼúê׊[ס\NË÷žÙ¡u¿¥ë$,Ó›ŸuÜ÷QG]endstream endobj -6978 0 obj << +7309 0 obj << /Type /Page -/Contents 6979 0 R -/Resources 6977 0 R +/Contents 7310 0 R +/Resources 7308 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6976 0 R -/Annots [ 6982 0 R 6983 0 R 6985 0 R ] +/Parent 7289 0 R +/Annots [ 7313 0 R 7314 0 R 7316 0 R ] >> endobj -6982 0 obj << +7313 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [204.74 585.012 243.702 596.701] +/Rect [251.174 585.012 291.803 596.701] /Subtype/Link/A<> >> endobj -6983 0 obj << +7314 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [243.558 367.922 377.277 379.914] +/Rect [246.286 381.471 380.004 393.463] /Subtype/Link/A<> >> endobj -6985 0 obj << +7316 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [211.983 228.205 257.127 239.895] +/Rect [207.407 241.754 368.399 253.444] /Subtype /Link /A << /S /GoTo /D (diagnosis) >> >> endobj -6980 0 obj << -/D [6978 0 R /XYZ 85.039 781.388 null] +7311 0 obj << +/D [7309 0 R /XYZ 85.039 781.388 null] >> endobj -2686 0 obj << -/D [6978 0 R /XYZ 85.039 761.463 null] +2742 0 obj << +/D [7309 0 R /XYZ 85.039 761.463 null] >> endobj -3166 0 obj << -/D [6978 0 R /XYZ 85.039 653.495 null] +3258 0 obj << +/D [7309 0 R /XYZ 85.039 653.495 null] >> endobj -2690 0 obj << -/D [6978 0 R /XYZ 85.039 653.495 null] +2746 0 obj << +/D [7309 0 R /XYZ 85.039 653.495 null] >> endobj -6981 0 obj << -/D [6978 0 R /XYZ 85.039 615.228 null] +7312 0 obj << +/D [7309 0 R /XYZ 85.039 615.228 null] >> endobj -2694 0 obj << -/D [6978 0 R /XYZ 85.039 352.478 null] +2750 0 obj << +/D [7309 0 R /XYZ 85.039 366.028 null] >> endobj -6984 0 obj << -/D [6978 0 R /XYZ 85.039 312.618 null] +7315 0 obj << +/D [7309 0 R /XYZ 85.039 326.167 null] >> endobj -2698 0 obj << -/D [6978 0 R /XYZ 85.039 172.114 null] +2754 0 obj << +/D [7309 0 R /XYZ 85.039 185.664 null] >> endobj -6986 0 obj << -/D [6978 0 R /XYZ 85.039 129.161 null] +7317 0 obj << +/D [7309 0 R /XYZ 85.039 142.71 null] >> endobj -6977 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +7308 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6989 0 obj << -/Length 2829 +7320 0 obj << +/Length 3000 /Filter /FlateDecode >> stream -xÚ­ÙnÜÈñ]_1Y,°(’Í3@ìÀv¼H¼Ž¤Xlö¡gÈá0â¡%9+éïSW“ÍG !³êê꺫ÆßxðÏߤ‘ë©l“¤¾«Òt³o®¼M ;Ÿ¯|¸k æÃýÕͧ(Þøž›yÙæþ0ã‰Ü0R›ûügçÏyÿíþãíöZ)å¨ÈÝ^'IêÜ~Üúηo·ièÜo¯}çË×Ï òáŸï¶¿Üÿpõñ~º|B exó¯W?ÿâmr ò‡+ÏUYºy‚±çú°Ý\ÁÕn*™×WwWŸPñ^¸áSkTêF©zýR?Zyi乑ÒKï·©r:|Eà ø¦bä'GxlÁã¼Ø`Vò¬æ ßùm¤NQó*0F6åpÝ•¼R|j^ªZþ¾àF‡(z‹”Wwî¾k°BÃÐù‰>1X£·A§i¢ë¡ã+ÿåù!œhs¹Æã9• -í£aÑ6Α¯}dFüâ×ÄÙ«×Àr¬*†==¯"íŒÿ=Ý?òB× -—³Ç×–¶à}Mo€Á]Fxq%•g<êàõ(8€¼A®5w-jð®¤Î±j ©ÀÛ(ògeL9’ÍÆcÅdãºÎó¶ÌÚÂÍuM‡áÖ'º£äš_6ðla‰ì{ž5šuB9Cƒv(ù=ÒH¬:ÌžÔðDOäfIº¹b×|KT¨çŠ§œ?ñÇ÷ì·DËcÖ%H¯¹9 ýM ´ƽ®o=Ñ©oêjwCo/Ýïš67è55jB^XÔ„€ÚhÊtq IíAÓ pÑ:ƒ\øï;¶¼ÿzæK’ Y€IÅ@P_…1/‰Õ²ú£lMýð‚§cÑ|õ%jà}r,8hu#[Ý¿Þ“Ý×UÑ":´9pÝÆÙÐä o«Ì뎼Hª ßÜ0 -Ÿr*ÑJ²ÄùÒ -ÔQ F‹[*œÇ“8ØÒt3z¨,5*í%˜Ty¡iÀâ‡U:á$"s|‡Ø±pØ+žuóÈ—‡¤¾+nkiAš’ï$Êp²#<9±DÇuªÑíÂ¥÷Gä?î‚›%RÍl¶uÈfºƒ4!Vâbñ n € -£DU#*È‚A\O¨&Ê+`©š` dÆ™8êý‰Ö;ˆ´—ÉɤL0,†="x7Šòvõïò‰X&Ç…=[k'jéÌiCìù’“•û‚Äõ2¾ïž¢d\övÑü|d0ä…WÙOE¯ã*졬ë ¢éX›î$ËÌhœü6¬B(ÑD@+„EþÿWn#€ÑQ öÝ,è¢å=Ѩ|Ý%‚8"§«ó¢Ça,yE?ÓìÚ7ÐÎñ{gO5>2çq% ¢ÐU[ò|R£QÏÉùj2$ì8T>˺ˆU¼Ÿ‚‰@Wr¼jÑ­s’óyË¡Ä µ$@È‚ 홑¬ygBÙVâæTOúX¿˜ ÍÞÄk=Láßq¦=(ôo9ÚRŽ½ŠÍ´âj@ÄUôNQæ|”œÜ¡ÇÖÍF™^BM{Ý#kI茞)ey0¥1fãÅá™”`o £HªùøPŒ#)BHRXqdpºå‰"òSç+s«G‰¼¬Ø:Yð¡¼aAømͪ®Ž”²OìÎqO9hª£ùœ¤»#¥e%¯¡D"/€ÌèæÛ`H§qå4„“Ï"ç]“åâX3Ì?±\ºÅ”ò'^¯u_<$MèêS#ø(‚êBôÊ5Ò¨Ý %V˜$nš†oV€ ÕE솮 -c«.‚纡ÇI}!Æû0ƒx?}K¢D?…é»­òpQ(LoR4Ã\¬ÔBÊ:¢çËó÷Y5aRR±ÍŸ/_¡hýúþ¯<ûx{‹À?ÞZ™A¦1èRê Tûv™ª†ÄÔ9);¬b˜ÁG&“‰S`t·å„0!ÿLdv†Ì–‘ŸÚâùzEÎVŠ°'Ã7TeK̇ñU#”îD‰ÓŸÐ[z%h~è|yÏT-†þŽ2ôy+ô™‚˜^Q6¬Ð¥±k¡]Tj}ªG9Ò -5º#wì§$ 0mp$¥Ð$4è•Ûuµ)|¬èÆeHäÑ#k§$–RädÈEKu˜¦wœ\ÀqPãd²Ÿk›Nª¯áeΛp}èt\b´øki jg@•"¦XËr|4~JYÜSz£CñG&ïAÁç’–GÕÈß)IG?ˆ§ÈýXE É? :@;b·U‘ ÙX[/I%qRYÉLáŒÐy®‡7jßÐçœQ›ðz™s÷·¸ƒ×X¦‡ S”dÂû~[8lo&ÇVfAQ+çð'!d‘[Îù𢊺%Ldåh}€n¾«g¥E°×íÆÈGìÐbÂ(îçéˆZ-Â8÷ÞÕ³fñ÷‘[Ï£}Ò¾>å³~VãÒDÎúEʲ£pf,»“®×Ò¬¹ERüÂz2rËŽXx|œjž!±ïX—O&G…ü?ÊxV_Né¬è°Ä=09œ–tÔ|ßÈ·)ç[='W‚­Ñ&ÐÓ=FÈ;g»lä<±à ÂO*ò·ù“eVŸ &Üg =bƒäÞ8åÜfä‰æϾ£º^€kkä€$_’CÀª£³ÓSÂâ²v¶ -’×±ë_€2Ê,›Òó'(2ËΨ»çI×ᵲξ\Áyç-³#%z0«„+ì(|&V#e˜úlÑl¯ žVÒgãôýé Ř-jsdë¬N$·poÅd©»7™ìâ.6#C%w_³‡h°Ír‹Lã[|üNjÐÝ|Rv‚CåÆ*!Œ€! ,ó†f—óˆô‡ŽûkÇcÎs±y_ )è#Û¹ŠÛ£°ü¨‰¤gdµð=‹At^ÔK:)Å ‡ˆVÚæ¬&\tceµÙd¨Š%‡³Ù“œê˜ïGÆ!<™9]Å -O4[Í»•PDÍ0prŠϦm®¸ÑÀ¹^À“ú™Õ½õ¦Z¿œAj$î- %ÂbÇŠ%–„‚(uAŸ@$ì‰Î­ŠRÅ.ÆG"ŠÊjb@@‘?W¹¯ò ”÷z/äåS®B<ß±ÛGíÔ ²Ð£äÍ%}¢ý©ïç†04Â. iå¢-šVîH}²•X%ê÷‚ÓœO)/°4&­u`aî-â„Ó‹bÎL2êñO6º-Oœ÷{äX8Ê;9¿&C?uƒÌÈ&¯= k^f‰@usƒp®ï)²Žü«ÌŸ^‰ÇSâ„`ð*:2BÇÜøøÁÂŒ7ËÔB˜˜5W”•r0b#Jj7ÅTªã§®vä!ûžÛ”âÜä¢ ¿žYÌîBq@Å HƒN£é0ñžEœì¡’çT¨1›jZY%:ѸãC”|wý¯v§‘ųæˆv©k`zê¾ü‡áí”D4¼Ìib0盘Ê2û®­€¢»ï϶ŽŽ*”|Î -q›ìT1{‰SÏù¸Hr[Æ…bÂï¤ìxš¢Hû=×›¸°Ð~"…Ó£bŠ¾P¤¡óî¿øÙeî- ö0‡.ã•QLeº/bÇÅdÀ¼`ºbœŽšZ'Õ—ÚÊc[kÀ¿åúyn<(7UÙzß! -7ð -È»ÐOÎé5?6¿"ø?gºsendstream +xÚ¥ZÝã¶ß¿Â(Z@Î:‰¤()@’b“^^Ò=÷¡Hò [²­ž,m%9›ýï;_¤d[¹\P°âÇçã7ã‹Wü‹WYF:_¥Yê,[íÏÑê3ß<ÄB­LÙ§¾Ú>¼ý:±«8 +ó(_mD²- þö÷/Ø>>­7Zë@'áz“¦Yðô¸Žƒ¾Zg&Ø®7qðîý7LòÕ¿¾ù°þyûíÃãvvÐÆ„Æj<é¿?þ­J`æÛ‡(Ôy¶zvÆy¾:?˜D‡‰ÑÒo><üÓïÂsfÅ«î³q…YfüÅâdábÛu¦ƒ˜ŽÓ`À+T#wÆSŲÚ]àšGìeAÍ +é~Y«,¨š70¬¢à2Túý«g^Âœ>¯ñÞ/4Ɖ±áæÜ +wO->ÏõâÀ£`A'íºR$cS¾x=¼!ÑDW2)JäR+Ñ?m‚®kš¹~©Û#X35ðÈØ1ý\Mhâ\í½ÂÄ© M’|†Æä@ç4 UÀÛÀ z¾QqæìPÙ0Nâ%u§æ_ùGs)$×䇺©®¨ß^†þmÓí‹æíPœwÅÛ¦ÞAÿþå¼ ÌºÝ7—ò3vp·—mn°IÂ<ÍøB™ågBe2Úû¾"U1:EåÁÏ$¢{¡g&ô¢ü4'K.$Áv­,½ý®–̆©qžæìfÉiÚTÿ±½êoè ×è,@5,ÎÒélí:S!{ÙÚ“<Ø“u×NZTY´ã$óêK—z8q‹´V–nÍÿˆvçÁ;Þ…)aâTÈnôr(Ú÷EÆ‹–Üý )¬Ûø³Ì"UN2ûŽÜÎõ‚-¼¾ +: <6Æ7ìˆÈ²{ž¦;ýZœŸ›ßˆ•«;úûa$ µIý+#¯|àn½ŽˆæÂLÃÉl6"Öí©žn#a€ZHÃÉ9 Û—ã÷r÷Z£wÝ Ûíës5nÚOå¡KìÀ³ib§¿"fIyÈ¿A’0…“¯ÃH§‰ŒëF0Ú3ú÷„Åû®a·yØ.\¼GJûvÜîÚ7®Áß)Ñ 8ï«àP…ÎG©4Œræf{ZòJ¼1Ÿç›•£Yõ¯ ꣲÐdÉg£àϘ™Õk ÏüÚv¤¿¯¤ë( N½Ôô|:raK¢iOž!&›¬8´.¸5 ÐÀ»"„[Çßâ˪0M•P’C!C‡ã¨-ÜìXÕĵˆCô•«+=ØBˆ b„ŠÝ5%ƒŒH´ ꮕkÚÝÑ}(Î8½+˜Öën5ð×›— ‚#÷ÕXL‘»äíXDäÓXa>¾àE_Îüew~.Põ®Fe”Vv‡%2Q +.Êþ¾må\œŒnÐ +îÅ€èµÄqâ–‹™Ÿßv[4 ²çÄ8­d¤zs«8žc ôhãs†|b_=½cÌ#ÇÄ¡ßõ(+Héº7$§+·$õÃ, öKÒ…"\ȹU +Õv9õTò¥È +F L;O‘Á å3€³Z°‹–Mr³GÎ3àO·ÖÒ çAššGêÓ9ù;¸‰’I‘MdA"#7ßUÜæè2ЃGü)ÖæÝûíãÓû/¿ãŸžp«ïŸþÄèïgôÜ#abƒA#¤gˆ­”åâ(Ë¿haÃEì| Œz·ã$’8îd– æ&7¹ø(0CGäçGÔeU0°›BQc— ! D´8ÒÓ&-h‹Pب8x7òœ8Meµž]¼5¯<]Èt©#ß!¸$o™àP ”M)íQy/Å‘&öÞ#a|_Š“ÔrÝ™¹ˆ×bÓwÅÉŸ¢$BÐNai¸Îyi-= .u…²´âÒU +vt=ZcóÞW?s*Ï|ÈÐFƼDíx®âëè˜MZlô”,³ ¯@@Î)”át¿Çl§ˆ±)2‹j™ +ff*¡ÑOâ€pyóŽ;Åžc# Š¶ž¡&Dˆ'tüáG$faÛÌ (JÄ5ÍpŸÊû¬Ï( +¥…Óm¢àÃ?¾Â\q¾9Hð®ê©Tòš‹gÐ^šø¥­7–w¼ ½´ÞÍu(ô±rI$ÌÜ&D~šå “}É’"G˜èFãåašI¥¦ÀÐ8\#–€Få‹õ4$1ÅÉ]¥gnI^?1tý¸¤¤Så/IøÂ'Ú°!ài9ÕóyOb塹}¢ŠlþÂýQh ÄõZâ^{w«$õÎÛ ;rJœ·QZ žëÀì°OìØZP 7JLuðƒ÷Å » W×£süÓCc×:k¸¾SU.aÜI@*š)èH>¬([5øZ%OLy R1 ÀÐꊸ‘nñœyÿ(¯X©z³ø[›·Q䮜Š+׆ʡգð™ñú‡À¾Q̸$Ø»²ÊMñ'uù:°£û¸/‡è4£ÑË!rŸÿï?( w å“• ½e1¶! hÎü]ZJõendstream endobj -6988 0 obj << +7319 0 obj << /Type /Page -/Contents 6989 0 R -/Resources 6987 0 R +/Contents 7320 0 R +/Resources 7318 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6976 0 R +/Parent 7289 0 R >> endobj -6990 0 obj << -/D [6988 0 R /XYZ 85.039 781.388 null] +7321 0 obj << +/D [7319 0 R /XYZ 85.039 781.388 null] >> endobj -2702 0 obj << -/D [6988 0 R /XYZ 85.039 477.884 null] +2758 0 obj << +/D [7319 0 R /XYZ 85.039 476.368 null] >> endobj -6991 0 obj << -/D [6988 0 R /XYZ 85.039 435.599 null] +7322 0 obj << +/D [7319 0 R /XYZ 85.039 436.205 null] >> endobj -6987 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F35 2976 0 R /F62 4047 0 R >> +7318 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F20 3021 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -6994 0 obj << -/Length 1187 +7325 0 obj << +/Length 1228 /Filter /FlateDecode >> stream -xÚ¥VKsÛ6¾ëW¨7p¦dà㘴ŽëÌ´Qå”æ@“´Ä1Eª$XÙÿ¾ûI¹‘uéxd-°öñaw!¹áO®S„*['© Tš®‹Ã*\ï@s»’á;ˆ†ù°]½ûhâµ ƒ,ÌÖÛÇÅŽ ´QëmùMüòÛûÍöæÞó•RB™Àó“$÷7ž›Ï÷^ªÅÖó¥¸ûã–!¾Þ~ñ¾o?­n¶³óÙ,8ÊÐóß«oßÃu Q~Z…ÊÒõ ä0 >¬Àu`´rëfõeõçlŠuzͧ.%:!|™Yd®“Ë@Çj&#­”ŽÏÉ0a`BMd@þȀљxï©PX›ûºÝAêq"lÇß9~Å¢‘˜¶­ªÅïñdX) -ÐU¨<ü¼Á›N‚Dêë™,ÊDš ×*£ ùZ¿¶à±ëíˆÑå¶j^  PAMw¨p¥ÅØ‚º~v!ÒÖ_¡ ]J¸<‚˜÷w -D¡½&ïY98CFôS¢ýo½(–AMM«ñ™xò¢”¡x¦­Š¼JÖ÷Õã8¸ðˆqø.9Ž Èy¢éœ_\êÆÉõ#r úªÅ%v?a°9y}b4*ò5…%bŸ#/;Š²tL!QåBÑiÏ” Ú‘qÀŃçÃ,!~ÌÖÙîðN¬#ˆs†jÓÊ@¥JLÉVèlÇgNµuö-lîkgj€«åm0Êî_(%[ñ‚Mš~Ï*.k{i<Ç€#‚ÿÐûÒu×2‚dšP!±ZãñH¬â$å×/M¹†ÂPtv?§šZΓPžó 5ÃØýçËôÆ¡Åaœfà–6pu,ν´Øý‘‰|—Ó0usŒ[¿¨k€Ú–—¸‹unŸ¨ Ö­Xà""ö -בsó6•óqp÷…òSÛ¡í¯ˆ›ç¼°ôë‚:;·×Cx5ˆËë-®Â Ê.5|˜šÿõ{snM­‚Te—;ÓDQÉ)¼ --ÓÿÆkTJ}ûCÀÿŸ}Ãêendstream +xÚ¥VmoœFþ~¿‚~)–ÝååcÒ:®£6u³T)É ÜÌq.,=ûßw^Ž«pZ©²dvgfwgžyfæ„ŸpR„2s’T2Mâ° =h®7ÂZ„Ž +ÂX£êývóöƒŽY˜9Û™lË/î?¿»Ý^Ýy¾”Ò•:ðü$IÝ»+O¸·¿Ýy©r·ž/Ü›O×lòþþú³÷mûqsµ]<ä«@Å_úsóå[è”àÌÇMÈ,uN°‘eÎa£´ ´’vßn>o~ŸoarøÔJ<þdá‹,È"½³1êlŽ:± +¤Š—QC ªV™ûΓ¡kL^ÔM·‡ãÄ5Gþæø‰Ý»±ëfÝmÊÐ-ªaXÁ! +’ì¿àM!Äì—Ð+Ù¸ïvü±7#|ºÜTí ¦àç+!Ý3qq¿†:l:^?Áñ¼7M1¶´béåù¾*èxçE©kØ⸠ÊÜñ™·¨ªú®j¸]°°§Sèç8Ø«0P•èöÕO(ˆ AÐG8`Qz ‡š‚ý +…îÁ%*n³Ã/䢶“,ªóE…%n!uûªdåØØpªo6#)}À@<þ[ãq&Aeï>îLÕa˜@ŒXÅÀûT¢ YWÚž-O©'_AÚØ Þ$fºÑºðB*SÞ,QPÁð‚¾GDJçx¾Õ–,1ý‹]ÈÚÍ‘¬x¦¾”“/¯û±C5;"¤DÏsÞ‡ã€ä¿Þ~KNFq$*µÌÜ—ŸŽ´;J¶ÖéÂ`ÓJ[ãÛ›ŸØä‚ä‘„Ne-NuÕ[_/âß“kfå$ +$ô»ÿúÀóp<Þ¾’Ð$³èöá€$yLNÅF‚̧qÈÏ¢‰õá«„ÉNOÆÑâIK=?Z¬8«$š€Á\©$‚‚àªkè3Ú"H$ðÖ%Qæñéùº“ÏÞVÖ¬®j⟽ŒËñ‰µ˜fKaPX^œk›s¼èÙEÍ…ë‹H´ø%„SUpÒzC}¦/l‹ÜLÕˆÛ™¤R¹; +¥5¬É;{š^Ë«33`31–=bÙŒ#ÆÝWe°Ò”:‰~eDúQÈø_§El§Å­'!†žD)ó Xëú !ú~×Ga¸hêP ga0,`ð +»‰Œ÷,매=ÑIk«¨%Ñ™ÎÞL¸çö&"g3PVÖ:çöågÿ!Ë̽±ïž³& ¥ v£½€ÆŽ™›4ÃKãP×VùÄ\4ŸKê¢ï(±œ*¦lv»©ˆY¾d ?®Uœ‚_S z ‘DÑ‹„æ ~m<=ïþâQGîa)q’Š”Q=΋‘,&;ïiF~`Mƒ¥…1Gp‰™aèO MK°XŠ+‘Z†MýÖ/ÔJŒJ©˜ÚpSA¢~Íy^[GK)²Eîl(G6šËlÎÜà üz¼ì™ù>'îð8³ukëœèTåoWáÄ’ÝM}ÀÖò0¼¾°}aîmeß8L¤õcwÄ»O¼#lŸó´/S›ÈÍ÷]¸è*ôFPìkC«(ˆ2¹Þ:,0ÿïG/ôÈ£¾ëõ6¡dúOE Í 9³pðotÞendstream endobj -6993 0 obj << +7324 0 obj << /Type /Page -/Contents 6994 0 R -/Resources 6992 0 R +/Contents 7325 0 R +/Resources 7323 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6976 0 R +/Parent 7289 0 R >> endobj -6995 0 obj << -/D [6993 0 R /XYZ 85.039 781.388 null] +7326 0 obj << +/D [7324 0 R /XYZ 85.039 781.388 null] >> endobj -2706 0 obj << -/D [6993 0 R /XYZ 85.039 761.463 null] +2762 0 obj << +/D [7324 0 R /XYZ 85.039 761.463 null] >> endobj -6996 0 obj << -/D [6993 0 R /XYZ 85.039 736.911 null] +7327 0 obj << +/D [7324 0 R /XYZ 85.039 736.911 null] >> endobj -2710 0 obj << -/D [6993 0 R /XYZ 85.039 639.845 null] +2766 0 obj << +/D [7324 0 R /XYZ 85.039 639.845 null] >> endobj -6997 0 obj << -/D [6993 0 R /XYZ 85.039 599.682 null] +7328 0 obj << +/D [7324 0 R /XYZ 85.039 599.682 null] >> endobj -6992 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> +7323 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7000 0 obj << -/Length 221 +7331 0 obj << +/Length 210 /Filter /FlateDecode >> stream -xÚu;KA Çûý)g‹‰yLæQž ¢•Å`#âbáq¨…߬·.x¬L3ðä—0?†jHÚ TF­žÞ‚W®žÉ-%ÿ¯ˆñW¢[ZmˆóhIнn9ïÃÙ¥aÎ -ý¤(V0a´V¡oïÃí¨G¥ðþ9FÍ%Ü]ãøÐoŽÉ„¥–)%£©8KÃÊú“Ýá°Ûo_¿vSj¸è Ñ ”²xb•™¼NMþ¨ÿn¦„Ò–ÅØ€ µ OI1»x´Lp‰Û)ùõ¬*,=§¿$X#endstream +xÚm=O1 †÷ûsÃĉ3R‰"˜"Ä€h‹¨*`èÏÇw¥|œNù}^ëµ) ? +¦€RC11 Ïo†W®;ú&’ +hJþ_‡³:°Ô´8Ì d‡ÁȪukÆàœ%´Ý„¶ÍC¼ë…âS/ß?ûAr‰÷7Ð?¶ÛŸ Xù3¨°'¨`$“÷òpp Åí~ózÜ~Œ®îªý†ý ¢^£¢Ïåêœb2ÐzºÈ´ i „Šõï&Iê<K‚ª³[žë†¿RTendstream endobj -6999 0 obj << +7330 0 obj << /Type /Page -/Contents 7000 0 R -/Resources 6998 0 R +/Contents 7331 0 R +/Resources 7329 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6976 0 R +/Parent 7333 0 R >> endobj -7001 0 obj << -/D [6999 0 R /XYZ 85.039 781.388 null] +7332 0 obj << +/D [7330 0 R /XYZ 85.039 781.388 null] >> endobj -2714 0 obj << -/D [6999 0 R /XYZ 85.039 542.44 null] +2770 0 obj << +/D [7330 0 R /XYZ 85.039 542.44 null] >> endobj -6998 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +7329 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7004 0 obj << -/Length 2085 +7336 0 obj << +/Length 1961 /Filter /FlateDecode >> stream -xÚ•XK“›F¾ûW¨| ªŠXæÁË7ÇyWNÞµ]©8„„Á ÝÚŸ~ ôp¥tÐ0Óôt÷tý jÀO-’ÐLºˆå›$Yä‡7Áb+¿½Q"aCã‡ÖÂøÂâÊ­®"í6¾(#{¬b•úÆ*”ùéáÍݯ:XèÀ"³xØ:C¢$ð“$\\3[4Þ´l”¹Š!6|Ƹ{Ìš„#k"¯Ä˜›ø,‹WYņ×\Îó1òœŠË'üsÙ’?Y¢PXM6 ½Ÿ§» ª‘Ê@õCvüüS8ö¾ak”Ö,ÌŒ"X;VXñëµà„ŸdzS—øÖŽµÝ¿ºµ•apR}A [*­×7üÿ6ÇöEŽe÷H -ßò -š—UÈ=ÖR«ü˜uÃëhýáPöoGåuñ²§!—(Õ!\˜ês(»—T®èèXìyF^Ö’ŸGÙl€ÐxkŒEV“ÝÒÐÿs×´Yó¹à8çüÀ ²ND§Þëw‡7äÜnº1îvlL0¦yRØ£uXLáò¦¬­Ü^¥˜E -JáÓÈžzçQë;—tì)»ô°'y)#îÃ+EËsn-㿃Cù5P–ö‡y‡ßh"M4[ü¨m²¢¹;4Dk›ZöØÒáÖ~3ëÏúYb¢’…µÀÔ|§ß:éÕDœÊßœt¶™NŒÈ¾ïŸÞÝÝuH]ü¦Ýñè.î|iJ€æøþ43öý¡š¬‚˜•ëÄÃË ¥µ¨ -}…7qÌÂv6Io"¬ÿ4Õ'«a9é %¼ÏÇ^Bµ‹Dú‰OÌ®ÅÓÙ]Á\ŒYôÞ6‘¹Š¹&„Þáá,¤<‰½C6¤aYÓ\Äiã`ND -Ä(•8"ÎÑØC†qÄú¯Ê¼z•%J·i•b¯+Ù”#r­+†ïfí›VTm›Öé$¥EÇ`AsMxq(d=éÍ:ë¶PÉ$ÚëÈ©¨¬âɧŒªù‘lÇ~üˆÜ)äî“WÇ …l'Jg$!;‚ýëÐd…j™ 3ŸÎóC&ŽZÉ@vÃ;|#ÒÙ­d}Üaž¥ -Îrœ‚e³Vô„ûÄßx…: óóxX†^¼Ž°GABL=9ÐÒ5†›9¿cXn%¤,Ð ˆÉpi¼}Óõ×8žJ6Ñm4‘Êsžò:˜I¢YyžR½|l@ì6‘8!±%ëËøQ±¾b¬Ûä–±™«õ©mâk«ç÷*ëîUáy ÀÜx¹ -OZ¶c-é¤móãàŒ…Û·¼Ñ6#Êäæð¢#ï|ùò…E¨u7˜%/Ý‹x7† ­MB˜BÕ Ÿª˜xLÌ/©™s¿.P qÒBÍç¹c Õêx“Õê{ÕÙs¹Áh`Uã¶Ðªiìá89ÕÝž€QÉ(„B¶IT®|y½áW«†ßzäGh§W´? epDå ,Nw»@†ª^ kÈ¢ØqGä*å*…‚&ç8Â2Á,ãCžcúCLJ³| ÁèC Xuå<Ä¥¬{ämð‚Nhòe3DfªØ.02ÀÃzäã#re tv¯üàdb·é„á8'ë‰XÕÌÞÝÁw—ا®pìOŸ>þÅôîŒQà%Ë,T÷ð4úáÕDúœÍ4^ä?ù®\A"DÞº¬‘½œCA4‹õ©esªý^4(ö#æ1WñIEnœñM0U&!}§`ªÿ˜‚7WPÔi¿iå(sEU 3Ig(jÕ$Ã-"]Ž¬>£*ÆâÉ”V_ÄT˜žb*<òåÕñ_M¥r úCégÑœW¥`Þ@ã`‚™°º+9í;~kÄJ‹ŽBÖÈBƒF()T$ˆ®.QžÞ ÷ ?pѤçp|Ž'!ÃïJKå><½ 4m?~­£Á¼ùÔ£18®¤'tgûñͼáù“«-ËôÎܦš|Oœ|@ì:YˆöË@Jú -õ’·(~¯îŽçýÄCg 7™Üíð'grÐè¼a 0û A„ òÚÔ¸; ¬»ÿÇ`ü4¸±ˆÝRI÷Øð&‡¢ßKòµø?£¸ÉUÑÐ…û<(Ì‘êÉ…×íÍùRM¿°´î¢-ç -ãºéyðmøfÒOôÉ¥Ž[ÝèéËÓ@Šö:ôõ zÝ „"yá“*ÀpQ†[Ì7 _ÂÄ\ßñ?6[­endstream +xÚ­XKÛ6¾çW½Tb®(R¯ÜÒm“¶è)»É"hzeÙVV– Iöbÿ}çEY~mZ$ðÁÔpÈyRO|øéI*ߤ“8ÑÊ$É$ß¼ò'+˜yÿJ ‡ +­…ñ…É™›Eòm|‰ÇŸÌL¢láä/÷¯nÞþ$ðU™Éý’˜î{&RÓYúÞïÍÔhïi:3QìõÓ™öGÞm³Ù–SíUÏÝeøš#G6ýçþÏW¿Ý…ZåëäŠB6…Ì 'ÚW©ŸŽú‹Øu«uK;ääLݶpƒlŸ¦‰åM¨hP$d,Maö?w}ÁøƒÅäUÑ?ô!´ð§At +ÈÚàâ}ÑÆæX5kç‘%>–¸ýO‹³ª“8Óà’§š÷ʺñ^ˆw›MÙÿä„%^íö~âïSRì,˜”7ä’@ÕÌž—óÏ"b? C/ÃÅe³¦,é1GzV›Ó]ðÆ#sŽƒE–缂ð \Ù—²\¤Þó†$ãŠ[‡&»Žüµbr/ÂqLtÚ°Gí0³!áô¢è¬œ¬RÔ¢ Ja¡x¬³mï,j•3 *ÎOÙ¤û5ñ?6–-ÓÜ\Æq6Ä_[’è1"3¡Yâ¿O§otj )µÈXÒiW/xeÖŸoiBu +¦t¿pÈ™K5½îûí›››.ÛÌ3Õ´+ÝäûN¹CDö|Ýoªs@Ž£éRs²O¨‚(ü èqÚؾÍÀÝ7Lë¼õA„Ü« íM LpM'£U¢ÓoœßÑØÛdC”5Ñ"°ÃNp²¤6°QÐ9ÒgSìm‘†UZ•yõ,S”ãzÂ\›W"”=|­Kj×f`í›V¶ZÒQM{2`t\ÖD#¯Á¡ä`Œè’Ëx€• (@ÉZ¶VºÍ*&nÙ-Ó¯XækœJÁMyµ[L¥Ð1€IÃQ#LmMŽ#Ÿ›²s•Âž‘)6)ã/„˜Qñ€_qaU<Ç’Zaúø †®-Xj&þÃqOLݯ¦ƒ³sÓ‰-ÃÏ," ÐÅŽŽ¥â¬’þ¶hÅ{Ò[ 0Æf¼uÓõo.5éVÙäjiY•ÆÇ¥u–ƇÒ:î‰òü³}çmÎÓÚbþ-ÆpM°˜mÔ+Àà4ý-â’¢8>¹ )—«¬^É)Œc×$ aIsÔzàL[ö²ê&XyË}rçŽY EÃgòfØTÌ#U5F{ôtÜ3ûqžçÕÁÆH âþEÚ˜Žg0ÑlrýÐ!´/hNà™TÂM}Ç{·G˜Q2X • *wP5²¼á¥û¸yäϬ¿¶û~¨ZéE‰\w,íBwÑPåA „u˜€ÄUÇ Àˆ“ð]ÃŽèɨ“°áCêbFÃúÛ>º…’&Ô¾„f•³§²î‘Å`jh"‘ÿ%lmD0«>懦¶ç4pjQË»gþp<±:jœ‘õ ‰8ÓÜþºÀu—:š]áÚ)|üð׈D)\åÃÉ,ŠUl£ïn&òU9ƒØFÞ¼¬o$á$ê8Q¾ ®¼ˆ–‚™ŽU”¤×¡-Ší…¶àÿBÛÂ4㣄ƒ¾ßœ!Ò8P08}ôðípK…ê+“Ýø¯¦VƒÏ­Š%r§syU.U²A:^˜Z•œ…o|x1€õt…ØM‡¶Xˆ3ªA—\pŠ^fªK½Â€´Œ¤° nOÔfc™§éH,\E^KÙèFV ýÍš ì3œV3BHWÔÝ™¼Ä4Ò¥—ö…xz§n#à‚|C›ã~èà +Ùý2´Ñ~…_ã“þø¼â§ÞûÀ™ërÌ䟂ø&º@¶qêBìŽÀÍdwährê¹ÿI`¼m‹eѺ/x~i">—tD'ô…Uã{žÑ>…C¦œOÏ-ÏZé~äe饄Ö]%x3»çÁ×áÁ©íg$a:> èfJO"ÃÁ\´êBÿ¥G sZòøz¦ßzͳÖ?»¦R¤áÉïûÿuzI¨endstream endobj -7003 0 obj << +7335 0 obj << /Type /Page -/Contents 7004 0 R -/Resources 7002 0 R +/Contents 7336 0 R +/Resources 7334 0 R /MediaBox [0 0 595.276 841.89] -/Parent 6976 0 R -/Annots [ 7007 0 R 7010 0 R 7011 0 R 7014 0 R ] +/Parent 7333 0 R +/Annots [ 7339 0 R 7342 0 R 7343 0 R 7346 0 R ] >> endobj -7007 0 obj << +7339 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [296.557 627.297 367.864 638.986] +/Rect [295.194 627.297 373.625 638.986] /Subtype/Link/A<> >> endobj -7010 0 obj << +7342 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [382.952 438.883 539.579 450.875] /Subtype/Link/A<> >> endobj -7011 0 obj << +7343 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [84.043 427.758 108.944 436.417] /Subtype/Link/A<> >> endobj -7014 0 obj << +7346 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [157.134 177.076 337.168 189.068] -/Subtype/Link/A<> +/Rect [153.498 177.076 333.532 189.068] +/Subtype/Link/A<> >> endobj -7005 0 obj << -/D [7003 0 R /XYZ 85.039 781.388 null] +7337 0 obj << +/D [7335 0 R /XYZ 85.039 781.388 null] >> endobj -7006 0 obj << -/D [7003 0 R /XYZ 85.039 761.463 null] +7338 0 obj << +/D [7335 0 R /XYZ 85.039 761.463 null] >> endobj -2718 0 obj << -/D [7003 0 R /XYZ 85.039 761.463 null] +2774 0 obj << +/D [7335 0 R /XYZ 85.039 761.463 null] >> endobj -3167 0 obj << -/D [7003 0 R /XYZ 85.039 653.495 null] +3259 0 obj << +/D [7335 0 R /XYZ 85.039 653.495 null] >> endobj -2722 0 obj << -/D [7003 0 R /XYZ 85.039 598.304 null] +2778 0 obj << +/D [7335 0 R /XYZ 85.039 598.304 null] >> endobj -7008 0 obj << -/D [7003 0 R /XYZ 85.039 558.141 null] +7340 0 obj << +/D [7335 0 R /XYZ 85.039 558.141 null] >> endobj -2726 0 obj << -/D [7003 0 R /XYZ 85.039 558.141 null] +2782 0 obj << +/D [7335 0 R /XYZ 85.039 558.141 null] >> endobj -7009 0 obj << -/D [7003 0 R /XYZ 85.039 523.598 null] +7341 0 obj << +/D [7335 0 R /XYZ 85.039 523.598 null] >> endobj -2730 0 obj << -/D [7003 0 R /XYZ 85.039 413.489 null] +2786 0 obj << +/D [7335 0 R /XYZ 85.039 413.489 null] >> endobj -7012 0 obj << -/D [7003 0 R /XYZ 85.039 376.622 null] +7344 0 obj << +/D [7335 0 R /XYZ 85.039 376.622 null] >> endobj -2734 0 obj << -/D [7003 0 R /XYZ 85.039 307.363 null] +2790 0 obj << +/D [7335 0 R /XYZ 85.039 307.363 null] >> endobj -7013 0 obj << -/D [7003 0 R /XYZ 85.039 275.341 null] +7345 0 obj << +/D [7335 0 R /XYZ 85.039 275.341 null] >> endobj -2738 0 obj << -/D [7003 0 R /XYZ 85.039 162.807 null] +2794 0 obj << +/D [7335 0 R /XYZ 85.039 162.807 null] >> endobj -7015 0 obj << -/D [7003 0 R /XYZ 85.039 131.088 null] +7347 0 obj << +/D [7335 0 R /XYZ 85.039 131.088 null] >> endobj -7002 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +7334 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7018 0 obj << -/Length 2660 -/Filter /FlateDecode ->> -stream -xÚÍ]sÛ6òÝ¿BÓ—R3'˜?DúéÜ4iÚI›\ì^Ú>À-ó"‘*IÙõ¿¿ý ’ûp7s7™Dàb±»Øo >ü i¬ü0[¬Ó@…iºØ®üÅf¾» -c%(+ç›û«ëwq²|•ùÙâþ±§«(÷Û_½7ïo?Ý¿ý¼\…aè…‰Z®ÖëÔ{ÿq©Sï†Þäß7ü´ ¼ï?¼åï»Û¿¹]þ~ÿÃÕÛûNŽ0ÍPŠ?®~ýÝ_lAâ®|féâƾ -`úpb¨8 -å{uwõŽÏE ^unÓq˜ª8 §»â3»Ž}ûíú~™†^ÛRo {ª–zí½”0ÚWfËð¾žrïM›7ËU@úÞ<7;ê³Ø+ÔºêÓDý=µíñæúúååEm^7ûb£P’Å*œ(Ž«M—î¦:\å üµÊ¢t±Ëâø¬q-ÎÊAšwL 9‚ÇAä™-' -ˆšýŸUÉ¿-Y7^{_¿¯Ð/üÕV<½Ë­Á‘ŽŸÁä_3p_ Ç|vopæŸwðCúâ‰Ä{ÃZY£!ò׶"ò‹ ƒ"ž÷X“-ž¾µÜ‡ôáßb@¿`šyª54•“*|V{ÛÕïãÆl‘CÞÚNÃ`RÖ‰¬aJAåMD™„ùá`hž(€F!B¼ìB¤ã×)´qyŒtá[û¸-¡+ id ;5ÅÞ<`–ÔGÊËh°k1ýŠOÌØzœØíÁ²(Z+²‹õZùpy2ÖÞΠMJþ0VsC‡…‘9ÔBE{{=T§†¡œ2apjr^ÓB{Õž’¯Ä!C^;žlÚüØë9óÞ-ÓÈ«jž$*…ÐÎÿGÄc§#;„ßÀ³8†H5'¶ø–'mLõ'ix,!ËfcˆÁÈÕ‘öË_ã4iM0âjÃP@˜ý%VrK‡ëGŽ[ÕÎV™œ`UnÒ» æ*G:]w¤¬kЕ£µW5E[Õ6"ZZ.…@š×¦%üÃ4šþu²Ôr7Ðœ:ŸjÉ©N”^ÀëºÒãMU×ùÆYvä¥ìŒ¾ÄÒÈ›¯ß%‘“î‡îù9oA~È+qh]s@ýâðÔŠÑ{¾S‰S( A4ÛT98Ó -”¥*\‡”+PÓ‚—¨4Ng¹YœyvA Uè¿ï˦5û=kÔð¨9·ÎŠ0N]ÖS‚žJ3Ï z\y·–NçøL èËš2ï"'ÔV`0óW,ºpG7x–U}d¤J¡¦~E¿W—L–ø* ây“õ8—M&8¨B}Ùd3Üz“ͱëLæðû|*Ϩ¥¢ìE¥ešŒ;¥­¶¼ôæØäõ°ß •¿7˜qÖ”îªêÝ ®§©+N-SÝW;Nð”[M‚ùǃsY邃; -/+}†[¯ô9vÒ~¿tiS”_,%ÿ6_D½ÇÇ–‚J¬ˆS*¨U½µ¦D¯çäê:zpÑ“£u¦b=«Óå¢Jw]Ôè «N¡s¼¬>fÿ>Œ5Ý%)¸¦ßsÃàgÞKAéΗÓ¤9ªZ0cøg[tUsÕòÕAÆŒ+S[j<®ßp#ÔJl\Üç|oO­÷†-O[ù…ȨQ`ºÒ(ð'ž -E]C˜\èß¿½ýVìev»|ë$lQ6ªŽ¢¦”ž<ðäÄ€¥AÔ†z&yjIݶ0PqoœÃvÈÔT›%„à÷y°uÎû -£ë0©\m_lR©3×›»¦î“¥§Î&CïxÊk¶nÐY"JÁÛTÀ¤Ý\Ö? ƒƒQgÌZ³Wc“³;K_Ö¬„!B‘â6ÿÍ"v‚ßÈ2#ßØö¨i·u ZÈb8pºM¨¶fh4gÛ "’ˆƒ$ѸEܺPJq'\¿ª¥ Sà«osöÔÉÔD_1åŵ’u4Ʊ‘ŃãÈÔ]¡;“¯± -(½k–1ì{Ú?NÝ1«å)rÖL<~+ô -DšîB¦÷;™õM$Ï^iI›Ftw=kîÕÛðÈl„í· éü ÓS)âKÓý÷Ž5n¢É`V®sg¦®³§Ô›ÿ]*^Iñ¼Ôs†a’)_§‹0HTþõa¨ôúü}áÊ’Zõ´¦u,\C³Ü¨ ™H´NUÈÿ ‰„Ô¼Di ’T»2IfÆÌùB§™JÃ`¶‡pp.6ÙÇ»ˆ9n]1ËÎö.?·/“ûa=9ŠèÑ!¶´pNªwR`(ÐqÚVœA”S½rOÈä´Hõ‰ré®»¬L¾³8†{‰¿>V‡±×5‘uu8ä/Q,ÊQqgK,“£Nd6¦O\·¶µ HtNm4þtÉ¥B_%:œw©‡l¬a6Ra”87îÚ”N¸W ¥ñâ1Ê0“c©‚¿yÓt9+‘â‰{†O¹`oN·‚†ÇuóZnxÈz†Ác{¼°¥¼}IÓD%>ÒC_\GA¦à¤æÆé8¯yVœëãéáúT‚~¾äÛ±Ð:Æ ”€'Bn Îv,ÎÊAšš[Ç™‚8é(¡,ÜÊém‰™C£CLï<Z“a^ÑÅ7‚7Qtù0N£¡Ì—Ÿl{"ýðÉfD¥§xU5*Ï6Bâ(hu Æét=}ÃI5Ô6P†vr>´,ÎÊA:SF”ä 'É|ï{8y±½Ì’Þ/GCDAd/øƒÓ ÍàzA|½[òf‰À2¸Ëó‰E4¸)Þ:º»lÁžßâ˜&=Hˆ”Q¸â?U‡ÜÞac;=L/«ój·8ó2Å:†“üPíŠ8#_Eø´ÚBU-•„ŠÝ£TÝJjnÁRϾ%Pv‡>y[4fËÏr6ÞÉ ´\tãàb.$¬®R}ÐòêFëé5KÇÎyïU˜sïŒÃ²¤æt¥b&g°ƒo«ƒié è.ºJ¯å”£ñîŒoÌþLïŽÒ¦ÜåRŸ÷…ݽ¬wO‡Xç—ö9ï= E÷ê¥Û*Ró†{¡Y4NT5ƒ;ß’ŸhYôÍVÀÜsÙÛ1Bm ³·ßtÍ|é2 :óGøËÚøþ;@#Bã˜]òiM%†e¡1LBHþÛÀDà *Õªendstream +7350 0 obj << +/Length 3058 +/Filter /FlateDecode +>> +stream +xÚµZ[wÛ6~÷¯ðéK©s*š À›ŸÖM§=ÉÖ›¸íCÛZ‚dn(Q%);þ÷;7@¤E%Û¦=9q €Á`æ›ÔyÿÔyž„‘.γ\…:ÏÏ›³è| =×gJ(¢sFi‚]ßÞž]¼JÒs…ETœß®ˆävùkðâõÕÍíËw³¹Ö:Ði8›gY¼þqçÁ/Üzû#_üøöf¦‚ïß¼äúû«·ß^Í~¿ýáìåí`Ò¹ MªqÖ?Î~ý=:_ÂÂ~8‹B]äçPŽBUç›3“è01ZêõÙû³ÿx.ÜgÎyÔÄÞæŽb®£0ÏߤJ&6y;ËuÐÌæqKØB3‹³àq ¥º)—ÜÞßCÕbZ¡XöPQA×s÷‹Ÿßs¡kö-t/°Ór•‰}°´ßÀfÛQµ©¶(Hä‘Á–q8º.mƒM1“ö²¾ (øéR¼a6—Ïe®“(4 H‹%…MíZúÞ]³\ô”\îû~wyqñøø.žuµ‘5ÈTÎ +¹ ÚE³¹x>ñ\Ç$žppR§Ot,‰LP¢üAø:ÑÎgò«Í¿1ˆÀrÃoJ›×|jÜÐ7ü]Û †ÎG_qk]m?@M&¢£Ãæªã蝹–Guͪ§ÀÿÊVfÛo—,z8 ÑBLp ÿþ‰É®oÞÈê¢$*;]Óv‡’£iu¼/78Í] ô +ÖfàÕ šao¯u‚“µÒXºBG«yÀñ¶-k&\·å•¤"t­¼]Bµ¬~›‚ôš+»–/Brž«0.’Ïç×tht:™]›{^‡´Íé$‘~¾’44Jœî_]ô|zâèÓŽÒ€{*Nb V&6_è’Ð,"65 $T|Š ºSJ2_ðÝØ–Ì骖†òè*ªxâÂ!›;J)¬Ù'#*Tƒ›$„½ã{œL8pßlÄmp´#Ôm³™°Iç\À1€f0p°mÐò¶LßÂ<Ì=Vñ·p¿[ÞÈùÍI|ªcÐl=JŸÇÉ&¹?ÚšM¨M:º*icÒÑhd1k¶ë¼II3Ù)\DÅfX§ãÊC%{‡rÛ=m\,Ù©¤ S<ÕÝDâ=KTœX>˜)¥âÃ[@>¡™b«Bo§¦œsd€‘ƒÀeÝN“ö£ ÓlØBŽp˜ˆ@Ggnö’%8ý1& =jB+ñðl™&ñÊŽm„਑2»ØÄù¦‘U¬ó?Ÿ$_QŽœ!…ð*ò‘Ð.vû»‹ývW.>0®ëšÉBê©Œ¹£-ÌÒÏYRŒ\ø0à!Û‹ç)Âu ¥ú„§²º#©!Süç…DŠ +bKCpØð‘€1Š äêÅtü²ëˆbJôÿ>,¤E| —Ô«d G*Cu-|»¨XqËMœ¶ÜrË9œà½µÏ×æ©þ¤à&×죕×sß0”%Ý_MW¤agÓNÈ„‰þœö¬šV¼¨ÉõH£7M+ ÂL«FSbªq•.#:™Ò&–vYu咳鮥‡pm, W,ì‘㮤h… …K™Å£°M$è<DO¯q2gždògõ¡¸m„¨Û£8%[ÛJ¯šª¾Ù”=åï¡«Œq* 6q0ÄÌ.MbTšµ•¼L]¹íPæPÂ5ök3çmçeyñ*G1¸°Þß12…ÇaA¶LÃbá„ÅÈOræ‹›f˜`æ;BãÁ ~ë ³GÚŒÓJ.E¤}UÖƒ:óÇ$«š@f^å2ðWžt·:UŸu·ZÜíÏ3ˆÿl[­ž“¤)ûׯ;®Ü\߈«EI¬)]öûÖ~™Î0ãó…<7ÆøÈØ· é& +°ã`™¼´—è±UK‡Ç¨BÄůž¥¼Ã7ø.yÃí bÖ[Ø!e#˜ÈñNÁ& Û=ð$æw).í„h(‘.×äø:T=šË\˜Xê¸8¨ÐЮ +¾n-7Ñ}Eš%£Ì-=Ò»¸€*©RògãvݶMËÃY>Ý„i"V"Òô) àâäˆå®Bb8LéôÝ=­´^ò‡Ä­c"ðîÁM—-ãaC'òMìGL™à-#{ÊÄIÙfW[¦î¯—.Å‚oÓ`ŽƒY/\ãË4Ñ.®GLÿÖi{î@èß]=xÌ%>±’˜. ½+0Süñ‡0uù¡£(»Ûßu}Ej窆fÃs> endobj -7020 0 obj << +7352 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [434.497 747.083 539.579 759.076] /Subtype/Link/A<> >> endobj -7021 0 obj << +7353 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [84.043 733.231 108.944 746.133] /Subtype/Link/A<> >> endobj -7028 0 obj << +7360 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [503.223 159.941 539.579 171.933] +/Rect [503.223 281.883 539.579 293.876] /Subtype/Link/A<> >> endobj -7029 0 obj << +7361 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 146.391 257.852 158.384] +/Rect [84.043 268.334 257.852 280.327] /Subtype/Link/A<> >> endobj -7030 0 obj << +7362 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [411.588 146.391 539.579 158.384] +/Rect [411.588 268.334 539.579 280.327] /Subtype/Link/A<> >> endobj -7031 0 obj << +7363 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 132.842 183.398 144.835] +/Rect [84.043 254.785 183.398 266.777] /Subtype/Link/A<> >> endobj -7032 0 obj << +7364 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [423.268 132.842 521.988 144.835] +/Rect [423.268 254.785 521.988 266.777] /Subtype/Link/A<> >> endobj -7019 0 obj << -/D [7017 0 R /XYZ 85.039 781.388 null] +7351 0 obj << +/D [7349 0 R /XYZ 85.039 781.388 null] >> endobj -7022 0 obj << -/D [7017 0 R /XYZ 85.039 615.012 null] +7354 0 obj << +/D [7349 0 R /XYZ 85.039 615.012 null] >> endobj -7023 0 obj << -/D [7017 0 R /XYZ 85.039 585.792 null] +7355 0 obj << +/D [7349 0 R /XYZ 85.039 585.792 null] >> endobj -7024 0 obj << -/D [7017 0 R /XYZ 85.039 530.99 null] +7356 0 obj << +/D [7349 0 R /XYZ 85.039 558.391 null] >> endobj -7025 0 obj << -/D [7017 0 R /XYZ 85.039 504.497 null] +7357 0 obj << +/D [7349 0 R /XYZ 85.039 531.596 null] >> endobj -7026 0 obj << -/D [7017 0 R /XYZ 85.039 314.202 null] +7358 0 obj << +/D [7349 0 R /XYZ 85.039 411.774 null] >> endobj -2742 0 obj << -/D [7017 0 R /XYZ 85.039 230.623 null] +2798 0 obj << +/D [7349 0 R /XYZ 85.039 352.263 null] >> endobj -7027 0 obj << -/D [7017 0 R /XYZ 85.039 187.67 null] +7359 0 obj << +/D [7349 0 R /XYZ 85.039 309.613 null] >> endobj -7016 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F64 4112 0 R /F20 2961 0 R >> +2802 0 obj << +/D [7349 0 R /XYZ 85.039 185.448 null] +>> endobj +7365 0 obj << +/D [7349 0 R /XYZ 85.039 142.495 null] +>> endobj +7348 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F64 4225 0 R /F20 3021 0 R /F58 3380 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7036 0 obj << -/Length 1698 +7368 0 obj << +/Length 1460 /Filter /FlateDecode >> stream -xÚ¥X[oÛ6~÷¯0²‘˜ÖÝr÷”´YšvE²Åhº>Ð- ÑÅÓ¥®ûëw.¤¬ÄvÐn(Z“<‡‡?ž›ê møã £@ØÞl8áEÑp™ìa’›£5ÆZeÜÓ¹š&¿áбÅÌž 竽@ø7œÇŸ­×o/ïç×ÆžçY^(Fãé4²ÞÞÜÈúÄ«ó;þ}}÷á~äX·\óüáòÃÕåèËüÝàzÞ鎀CgˆâŸÁç/ö0Äï¶ðfÑp c[8 ÎC¾§çÙàaðggŠeþw»´Ñ;31sƒ—‰ á‡^GŒ R_x~Ø'&°E`ûD pá?³>Ž<ÛRUºÚ¥EwCëAæ y^óäþæS«zÒ¤M[ÆŽ¥N‘ãOÅÔñ_†»×!¸NpäW„6¿ãm1ûŽk5kUóÙ0õ¬I|Ë]Í åŠõÒ¢V¨·¨º!QäY ÷\\q¬s½‰,6¨XI¶c •Zâr™çd¨i¬bƒB6<Ú¡á²åÉWœv•‚új×aæsнK\¬™HX©´t…çWÈ)P5và麺,<8ehÕe[-Ž§Ö߶ãÞLO£±;µÔª¬ëÌ2„BïŠK ¼9¸•u ‹{¸J+]±–¾Ô¹‡ÆñúeÃâ¸Dù¶ÈJ‰ü§Æ8^ *sÞ y-O«ŠïÅðñ4âžÎ½`]¢9Kñ¨¤Oƒ?#îo@pϱÉvP±G¢ƒËtǶYÌKšœøŒÍ<;zPKD©u+Ìê›0 Ü©°!DÄ'¿fEvƒÎ”D@ñ¯$%ÿʵ’Ú.Ãd94žETj›Lâ\•YƪSk«y!%|ùŒá‚œüîõã ûž½)Aþ¢Ü ¬m¢­›fój2ikGÔ碬’ &«fã±+\IÑÈJÈzyä9þ›ÙM»xT;còYÜÜ!0Ç°qg3ãçUÝà<Ò·çqZ³Ž¡ ÇÆQP~ÔQPIG)5km Òr½ ¬²ß_ÒÆ¥Î;{¿Ák8ö“³K3 }„/²Aû‹,]òóí!ß$;ö ¼QÉ0[aHû¾u›o`„·B·ÖÞ¤]ik-I§àŠIF¨Ö³í±SÒëv®d“ð`펄Ès”ðIù¤¤DͨgºŒªg%YUÁ9¦#ƒÍõ®ë&És f;¢´Ü3“5}²˜œŒÛ[ -É.©à@f,*ŒI×¼ÒÏy‡Æ™S×@}›ÖkA¬R¡ŸöhÁólaG\諲l~áúD¼JJü\¾Ö*Û¼P¢Ø2^õòæéô³ï«5ÛK5Ä -Ê UÝòû= -@¸”:-t_nr‘)Ý&õs¾þòqyüá²Ô}…ü(+¹|TÇ)èéoÓL_`É_,²ÙçÆ®¹YÐé’rèhàw…ñk­–6çúöu»\öÊù -¯eº¯Yr\`˜fJ§ôã|µõ©oz¸ƒ;;–Šà/ûÒÿú¿.¡»DÞìx> \艃éô]÷9ÞÀ‹D9üð¿ßCwHendstream +xÚ¥WÝSÛF÷_áiû Ï೤“d‰>A „´)´xÒʃlŸåôU}Ä¿¾ûqr1I&3ÎÝîj?»{8cþ9ãжŒÆóÐ2 Ç«ldà\Œ#a=a>²N£Ù{?;¶ˆìh¼ØÈb}k½ûpr½8ÿk2•RZ2“é|Z®&nhýÍÔÅÿÿîêÓõı.?çûÍɧӓÉÝâãè|10:õ„H´úïèöίÁ±#[È(ïàl 'ŠÆÙÈó¥ð=iîéèfôg¯…yÞ˜¿:Û´“˜z`NÊ>Héò—ÉÔw}k—¨†OÛ¦)g³¶vDgËXU2£ÓlÓ”|šºÂa,š¸q½Â@1:íFoP[¶Ë{õØ©œ½wö=žzR8Ò#‹­šLÝ(²þ±R_Õ ÞCº§ŠÏºf™f FþúÎ×̶ci¸'yÜ´¨Åmà\T,Ôl¶›8›¸sk ¼xð}A®ð¨†.ü +Ppì=ÛEw†~ÓH‰ú—©^ñõúâz˜oŸ²q˜T>jÈ5•nµžçY—Y Ÿ‡0¤d?(Ö¢E2‚3Ø!±niíºŒ5Ûc®‘|¹FI™ða:ÕYYT¯.yœ¯Ñ ×úBQÑ•Íã^<’sZ˘¯Ã*™ˆ©Zddn­ IçBjÌ’nPÉ[âþªKøzò y’¯/÷Î m_T¥1ʃ:~$u—€oC4ˆ–/•bÐê.ŸžO C^FÊ\'†—bîûäu F. +Fý®YE­“QÜ´•bʦ*2>í£uŸaÆÉ^CÉ_b½]äüÁçI(-EåÆîZÅO¬ß›Àxâ§ù|j:øB†‘§)PØ”‘ TšB¿ŽËãEˆW‰ÆŸÄÈÇKŽ¸5ý¢MÕ²¾žR©”5dtD—53)ù±qiIXT¬›WTjm¼91Rê!ÎÊÔH$† Í-eúù`è Î ¦Kºæ+izÖn:ƒîQ¦Iö4¸ç@ê7 ö@€>f Ÿžœ0kš¼¼2@ðtƒ(çã™®› +ðÀGÊglÝa)ˆçÛVúlùàð†³ðB·ßŽ.=!½`¸aë{P@’uŠyh1és‡ @„ñôÇËi7*òx"¡Ë4´Ñsß\1£—<ó…ã‚`´þ âÝð;#Šé™ñh.U‚¦xÙòð­ÃÒà}ïï•N›Éœéd;ÔL¿©v·B>¡_™ÊñI’BÜ.é@óùC‡ÁŒjZ•¯ñ&‹ïÕwmì4mnzU)îå®e½§çß’¬Ç4xAƼ€¯òát±.4E°c[â®Ì«gC#%5ÂÆ _Ê:Uë½a0 u—¾yÕ«s@'× ¾Rì ø£Öu^Øi,oûûRÎ…ó4=¿¹„<Ïý¿‹N d€°8øHeÒ.endstream endobj -7035 0 obj << +7367 0 obj << /Type /Page -/Contents 7036 0 R -/Resources 7034 0 R +/Contents 7368 0 R +/Resources 7366 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7033 0 R ->> endobj -7037 0 obj << -/D [7035 0 R /XYZ 85.039 781.388 null] ->> endobj -2746 0 obj << -/D [7035 0 R /XYZ 85.039 761.463 null] +/Parent 7333 0 R >> endobj -7038 0 obj << -/D [7035 0 R /XYZ 85.039 736.911 null] +7369 0 obj << +/D [7367 0 R /XYZ 85.039 781.388 null] >> endobj -2750 0 obj << -/D [7035 0 R /XYZ 85.039 283.183 null] +2806 0 obj << +/D [7367 0 R /XYZ 85.039 380.889 null] >> endobj -7039 0 obj << -/D [7035 0 R /XYZ 85.039 240.229 null] +7370 0 obj << +/D [7367 0 R /XYZ 85.039 335.815 null] >> endobj -7034 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R >> +7366 0 obj << +/Font << /F56 3312 0 R /F35 3036 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7042 0 obj << -/Length 1667 +7373 0 obj << +/Length 1646 /Filter /FlateDecode >> stream -xÚ¥X[oÛ6~÷¯ðÚ‡ÉÀ̈¢(Köà6é’.YºÆØ0´Å X²#X–\INìÏï\¨‹mÙ6HêçöG–CþäÐ×ÂVÁpâK¡|8_ìáÞü2FblDÆ™·³ÁÙ{í ¥-;Îí9Z¸Z gÑgëÝåôãìâÓh¬”²”'FãÉÄ·.oGŽoýÉ«³[~¾»½ù8’ÖÕõÏï¦7o§£¯³ƒ‹YcH£”hÅ·Áç¯ö0‹? l¡øc[Hx½€B»ÊÌÓÁÝà÷æ(~çyWŸÓZùBûêÐk¥{¼Ö¶Ð¶K^y^½µ£­u¸Šy”de¦)ztö^vO°‡ce ÛŸÐæ*ÿ·‘§Iõ¡‰q¬­{&YXà–¤U²L˜EOŠx™S¶U<›m° ª’bnñËê˜w˜ã—¼keÈ;Ùsµ(¸~¼€/Ô+缈jÐ&/9?çùºfð$9M¥)q¬G^—‘ºyËôüŽ„räß͆ -(/ªŸz‘ÕªãhW÷Cˆb5ï žƒ{£©CåX5hÌáÆ‘ò™åk%ë7Gâ«´+tàžŒoG†âëÊN|¥-…k«æ 0 }²¯OÚžðµRa-s q'£R:BAº»›»XòæjfÈt‡»‘ΰÎrÃìQK¸žæ˜mJ{œuy1p_Ð]Î\ ‹_lmÇ5›!™»gMÇÌ¿(GÄÜõã²4ošXà«H·—v¼{5¡î9bo5Ò°ºŒA=Tæ! Î b.ãdQßXHѬûb¯ÙA*Üa|Äd^ÕoLÅJC ( ÜÉiÔ´2'Pc„^DÍ …-jö4ö£¦£±A „ìvS_w|Y]Ÿcħ¹Ê¢¸mz‘BqFn؉3' ÎÎDÑÓ8UWpK¸R6œ@„ Úâ¾µÏCкÒ9D#.ÖýŽ+ài#vð4j'²±!œE$ñë4§¢˜‡]>¸ÐlF3Glh¯c æ|FEÍN^™ç™¹ï–Û¢·cÙT£º‚ÀýƒwÇxEEª>¿úÔ`›ÆêtQí‘õ¬foÒ¿¤¨šôÂ5ÞaÔr[´™7Ý$l$¢¥Nã¼â³ú(Ñ}b„— Tš,…U[^.šAè™x‘Š1‹›YkvIù¦¿7é´Á¯£x‘d¦'¹œþqñ÷¯ŸÞjžÊž`Ê_Ÿ#¬ù“Ý áÔ3DÇÈA—µÿ?šu9Q"\ÏæPæ(²“:$‰X†8W:-®·÷ÎVÖ–fɦи:AfÁ­œéüâû„?êz<ó'B¹ú¤c­ÈÑžNk¡‡üº5¥ZGæCü ãŠÛ¾Iuó×é¯ès?­ËÑ}.¦À•pØ·¿ðúðZ&\m´lá}Ã?CíýÓ6à -ºø ?nÚqà3 ¶ãæ:jßÞú›ƒÿ6©}6endstream +xÚÕXYoÛF~ׯP› +×\îò +Ð9vjç¨][hQ$AA‰”¼ÅU(*Žÿ}fv–‡lÊÚ—Ì=fw®oŽ{ðÇÇqÀ<‘Œ£˜3ÇãÅfäW°óëˆ[ +o,™¸u:¼ Â1÷Xâ%ãÙÒ̲Îë‹éõìüfâ +!²‰E±sq5ñcçOZ]Ñ÷õÕ‡ë w.ߟÓüvúát:ù<{;:Ÿõ˜º’ÉP ×/£Ÿ½q‚½yL$ñøÆãI2ÞŒd X …£ÛÑïí-´'Çtj@7·¡p…ÇâX¶Jò`@ÉZƒÄ‰tT¹«Ó¢ I}Êä8œ9 U™Vø%îìˆ&-3lÒ-²‚Ԟߦ+"›…~äü5‰…£÷¸)œîÀC¹3t[<[¥u^<4ÒL #î€P0,H–†wCríh eâΉ®¬d–øÏÑ,‰ÑÄ3B¹ 'Ãs…Ä'oÄ¡©Ð’žoNVZ×/&nà ø:§‘5Þ\•tü‘¥] œCâŒ"eÁ“òؤ?æñ›®ÑHaLŽLkœDŽZÒ÷Ýe¼“´Êi°G'¬ª4Sð-W´¸¬ôÆÒÑ…HTå_•¶fõ¯xŸñcÕÚº¤“Ú²½M7H8O¤Ø¨Õέ¤…ZÛ;qf +|Ö(˜ÆûCížú·0ò/¨ahå¬zîú†§x)Z²ÊFνjðæ·³j(G©Á^n9ß+¸ÚŒ îáû‰ É4^•ýL+æè·º Iªq!$­ÑÂ^ Ád¥‘`m1 [[¥ôsöض‚÷Ü +ë¹”q$$5£Å? L^Õ?„­Á'ðé“O—è÷Œ¦FpuL”>™Ú¥»ºEäO‰Øb‰p¸6¸~ÀDÔU–9K‚ Ÿ8¡ H·stMà9¯!R “x¨&~ó„÷1  ¦8[Ôˆ®¯?g .«œ6õDÀäÁÞ´ßna¨Ï!k>Ö‰ ?8¢‘à,†ìòl)¸´VÔUÖ ¢²V×ô]èM“®UaásKh÷)dRZ´€¾3=»¥³Ì/Ô¨uU¿ðwٰγCÞw)’5¹™<)æœ=Fð›Ë­"»¢Ï7¯ H00 ™¡ä¶ö“|À~Õèñ­“oèRÜêß9è“–;?ñ—3`qóî\#©M†EÖiئ¦JïèX–wi¥·›g(íâ …BVôr{ê“xyƒËú.¯hy <ãò#DpR7’:“XªE“I;Eü®ç‰ÊFô¶Ii¤ÐUbAØ=25€Šù‘€”â±PFÿA?"h¯0È7åû34þôÚf­6 Gè¡Æ;¸ß÷ŽQ¾Ó¸Ë¿—˜C¯) +aX tTs{„½£­îâ~­ƒ ê ` J»@ŸÒO×g™éÃ2{Ÿ6ú-Òšj„¹ô°©Ìí5UNØ£~À•¶¨NYw_×BVÔ¥­«}5½ÅŠŒŸV*!X"­C\s”»®æÁ/DÄ=ÒʃZڳ˛âÅæE ‰u÷9‹¤o<ãA{Ž[ÓeÝK§~ØKx~( +TÒø@»æÐKtYd›Ù&È‘ºÍ¨•]¨ïÒz@mÇ,K’ªrQì³üx-ÕŠÝ h–HðÆPª¦ËWy™c‹¾³¢š¨&|¦ªS¡0c¢ +L¦Q̶ƒW»Wb “±8è ^dùR•¶¸˜þqþ÷»›Ó€¦¼ïþàùû3Œ¯–üH·Á#eLÉŽ†aõÁi©±hÉ(lõç¦CY5n0gT†ƒ©i¥×ÄàzW“póìÜœâu-£Í+ó&RÄ91ÙòéÙ.ƒàÞ@ ã£5:RC¯­‚åp×Ò¢£Ð««…4ê= m£Öš3É>µíLwÿ`»´rÒ–i<õ†ª>žÒ}ÏgŸk×$ #yЮ=IÀ]»f6°è¥yPaõ²ðÅ×_ópíC tnò/û®3˨»ÆÖ,]¬Í‡ž’øZ¢Ž­×ÎåsEM2êظïëØ|ÈéþóUåÊvlg–O9ØQ凭”4ª´Ï}ÓTç4Xꢠ–} Ó¡÷¤ úk õ?é (( ÏÃÿÀÅ6èÈ ¡'Çh[aþÝ/7"b> endobj -7043 0 obj << -/D [7041 0 R /XYZ 85.039 781.388 null] +7374 0 obj << +/D [7372 0 R /XYZ 85.039 781.388 null] >> endobj -2754 0 obj << -/D [7041 0 R /XYZ 85.039 441.212 null] +2810 0 obj << +/D [7372 0 R /XYZ 85.039 471.768 null] >> endobj -7044 0 obj << -/D [7041 0 R /XYZ 85.039 406.466 null] +7375 0 obj << +/D [7372 0 R /XYZ 85.039 437.023 null] >> endobj -2758 0 obj << -/D [7041 0 R /XYZ 85.039 114.443 null] +2814 0 obj << +/D [7372 0 R /XYZ 85.039 139.053 null] >> endobj -7045 0 obj << -/D [7041 0 R /XYZ 85.039 80.299 null] +7376 0 obj << +/D [7372 0 R /XYZ 85.039 105.212 null] >> endobj -7040 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R >> +7371 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R /F41 3054 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7048 0 obj << -/Length 2085 +7379 0 obj << +/Length 2157 /Filter /FlateDecode >> stream -xÚ¥X[Û¶~÷¯PŸŽŒÖ\QÔµoi’žl‘69YEÑöA»’ׂmÉ‘älóï;7Ê´Wö=X`M‡3Ãs£´ÀŸö²X&÷ÒL+“eÞÃnx°òß™Ž…°,ž–³›ãÄÓʃÜ[®ŽrbÅÆ[–¿û¯ß½ú¸|ûi¾0Æø&QóEšfþ»ó0óeêòÿ¾þðóǹöoß¿åùÝ«Ÿx5ÿsùÓìír4dTJs´âóì÷?¯‹šÊä™÷ã@iXÞÍÀ GFæÛÙÝì£(^‹<Þ5uh˱0ʲè:0q â ‰´Œ´ŠãY&Dæ@§ç§ÓA¢²8óaÏZžguìjÔ¡2:<Ѹ­ïßM‡ÿãEY}¹nhÀÚäúqŽrÿ¶é‡b ¤m ÿ4èÜ2ø-ë~èèMxª‰¸¶IŸ’^øµb¿WûþYEy¬4t¼Îeÿ{ÏAçÔÐ,/ÆŽÿÞ™7„‡_zý»#e Ã{IûŒKù¼’_\™€0¶}Õ}©¸Ð`Ì›Äÿum·Ùï=I||™ÁýG”¯ÊS’6;™j“ß {y»b*?¯Öã;uôü[V(¹q2>R¹inDUITH§0¶xÛ”¬7s[éÛUOŸ–n~4.„ÁÉã²Ø}Ýö‹¾§Æö¼S_ÞÙ×;ëvкØôOÑ%½€6éÍQÜOÔs÷spê[™”yêv_ï!›ñSÀ÷+… -óéü+(þ__Ûï3£2“O;l† -’¦Ø‚¸A~nol2gæ¹Á+­Sendstream +xÚÍY[›F~÷¯pŸ +RLn}KÓm“6Q¶»–ª*í6xÖ€8Þý÷=·lãm¥¾D‘–¹œ™s?çGÍ]ø§æqà¸~2båøq<_—3wþ;¿Ì”P¸sí¸a€[?.g¯¹rÄMæË ‘,³ÏÖÛwon—7wöÂ÷}Ë{E±õî“íÅÖ¼ºüÄß·Ÿ>ÞÚÊzÿá†ç÷o>þøÆþ{ùëìf9bºÐŽ}äúeöùowž`¿Î\ÇOâùÆ®£’d^Îtà;öe¾›ÝÏ~ïoá==çSº- ÅÂw8ÖS4*tüîè  Õ„þrUt®Dàè àƒç—âÖøNLÜùØ€VÁâÐæöBYÍùý /r¼ÈŸ/Tàxì¡Kç!‘ËÚ'ÏàÓ0SŽ® tb½¯Ú.ÝÁÒ®€?ò…¡Õmq’óä.ÿrÀ)5y†‹‘ukûÊJ×ôyÈ[^ÝÔ8oxrghߥ>ºìi"¶5‰HºLIJߔå\®rÂH]CÚI¢è¿"_À=õâûnôÒžŸ&;¼éé_E“ƒÔ]{¥ƒ«—:¸ÿrµºG·‘8¾×7mÑYŽ*Žô§Ýn(àïò¢ÌR)k{ô¶dI²èB)Î2~¡ÌK‘Ç3/ôÕ' ªJ§÷©×;Ø×xðÈÓQÁhV(y±““+>mž/¤\LÄC* ¨ ÚúÓŽýk˜„‹_S`|>³=0È·FK©ŸwØ"ª“guÐt>Ì¥&mŠqÃu‚zâêÑÖ¨sä•qO_þpj +¹1NŸ9\[)}§E8>ƒ¿ÑÊ}Zât•òôîö£‰…˜/Çãû=W‚¦cªßòf$3¦uÝ›âäv—§¦à#y3‘ô‘ø6%}Ìù[ë³\&:<_ËÙQýC`ç*^úþ4î=H¿…R”<7·â˜Â +ÐK)\=ßÙÒÌ $bfðç†ç£Š„ô¤÷~ +iwkÜ÷¬u]ÉÂáI1º€ÚM¹Ö›“Ö î¶cýÌ ÔàGä’‚IGÚ¤¬D/®ö #º¢2í[ò.Á-c”)Û§Ë+êJkã4Ø£ßq€ÀôzI ‹)S„¬¡´þZ¶@!z_øLŸ +ºúPò➃U% ,A¯!=›‰ônÌÛ(T±KW„0(çÌy=ä<²¡žh ®2ë‹b‘µ¨C¿3B³£Üò§Tîo±@}6I]?=à(KR;Δ¼ìIâÄÁÕ'nZ48íø:k ++ˆ+iP•6!ÚšjoQr­»ŽRêåîÖWqíbóÃZDŽ®aÆ&=ô„=‚o®6¯ad£ÝÀjé®j †ãŠ“€n̘+y‹žnÛ¼‘-_–¥yYW2©e³Çõ8)ª¼ËÀ¾aY?Qº/âw 7ŸAÜ€áÙe >ë¶ß£‚غ)ºí8l#5ê¦>K*ì ¤‹K¥lä'. +yZ(9"5Ñøˆ7bA·kº\hk3ã®ÖæJ  +RȉFÞEÚQ⟈'*ë¤!:+{%õ -¤Ý‘…´+%¨â ÉÄÃS#iEžÆ ôô¸rà^>¼qsa²áÝ”3Õº¦ƒ%[v¨âU²k¤ãª}é? +70þxwë×ÍÚÙÕk€n—.‰´¼o‘˜A4j× Ô©©îs`ï% K‰ƒá%±µg…kô¾Çµ,ï  +Éj-„ÆT¸&oÜ/"Íθ„î¯÷Úäó;}”XA²=:,´6 d—Šì4S7Ýá=§š<ÍŒ\rÑŠ:ËT'1ïqÇ÷õ¿(ž#TßêcË@5Y·0Ï옸Âbš«€Ó÷‚óÐì–fY†öÕ„\{@À56&*†}ŽY÷%Y'LÈã»Ð c+͸×öåEü¼Äíq¥æ€7œUR\¢Çge÷.+.vFœ&ÇP^+^8Ê??ï¶õp}lá/“(òu1䶘ûXìvæÝ2‚su5 Z¦Ÿ·¶dšœ-kÓ©¿ NäßÍnÿäéQ>•‰Â¼·R±Þ'¿âà+Šê¦Z>€QHh=ÝTEßÿ÷ß~䨸·Ý‹ý‚ù\ÄñwFÀÈY ¬endstream endobj -7047 0 obj << +7378 0 obj << /Type /Page -/Contents 7048 0 R -/Resources 7046 0 R +/Contents 7379 0 R +/Resources 7377 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7033 0 R +/Parent 7333 0 R >> endobj -7049 0 obj << -/D [7047 0 R /XYZ 85.039 781.388 null] +7380 0 obj << +/D [7378 0 R /XYZ 85.039 781.388 null] >> endobj -2762 0 obj << -/D [7047 0 R /XYZ 85.039 708.141 null] +2818 0 obj << +/D [7378 0 R /XYZ 85.039 735.239 null] >> endobj -7050 0 obj << -/D [7047 0 R /XYZ 85.039 671.875 null] +7381 0 obj << +/D [7378 0 R /XYZ 85.039 698.974 null] >> endobj -2766 0 obj << -/D [7047 0 R /XYZ 85.039 486.868 null] +2822 0 obj << +/D [7378 0 R /XYZ 85.039 488.042 null] >> endobj -7051 0 obj << -/D [7047 0 R /XYZ 85.039 443.915 null] +7382 0 obj << +/D [7378 0 R /XYZ 85.039 453.899 null] >> endobj -2770 0 obj << -/D [7047 0 R /XYZ 85.039 307.375 null] +2826 0 obj << +/D [7378 0 R /XYZ 85.039 329.066 null] >> endobj -7052 0 obj << -/D [7047 0 R /XYZ 85.039 272.63 null] +7383 0 obj << +/D [7378 0 R /XYZ 85.039 286.112 null] >> endobj -7046 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F15 2972 0 R /F20 2961 0 R /F64 4112 0 R /F18 4115 0 R /F35 2976 0 R >> -/XObject << /Im1 4096 0 R >> +7377 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F15 3032 0 R /F20 3021 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7055 0 obj << -/Length 1823 +7386 0 obj << +/Length 1866 /Filter /FlateDecode >> stream -xÚÍXÝ“Ó6Ï_á™>Ô™ÁŠdIþè¥Pè@¡N§Cypbçνضwÿ}÷CvœKBo 戴Z­öCûÛ••'áŸò+¤N½8QB'‰·®fÒ»‚•ŸgÊqŽ%˜ðü¸œ-žÙÈSR¤2õ–›ƒ+ŒÕÞ2ï?yþøÍòéÛy µöu$æA'þó×ó0ñÿ`êò5ÿ>yýêÍ\ù/^>åù»Ç¯~|<ÿ°üeöt9*2‡¦¨ÅÇÙûÒËAã_fRè4ñ>ÃX -ËÕ ÔÖh7ßÎÞÍ~Eñšñx×9£­N„Mô©ÕÚž±ÚJa¥!«ë¢_•MÔÝ©DB[ðð–+EŸµÇï}BpAq%½¥r¶s ÿ7Â×ObQÔ.p“oQ.Ôσ-º8óýÇÂËØ£ï?ø}å;þ‚rSn·ÙvË“ÅÐh à™¯ÆÇĹ¯tðÇ—ø›>±Z$:=ïk†"Tƒ.h“ í}}‡†' -ÿ£÷Ñendstream +xÚÍXKsÛ6¾ëWðHM#ˆ $zé$iÚº“Än¬LÓi{ -ÊæD$]’rìß}€eÓ®gœÉttàbì »’A?¤FDÊI*…JÓ༜EÁÌü<“~EhYƒS¯V³åOÆ2.rÁjCKVë?Ã׿¼”b Õk…uñS«'bú¾†Øu®|*A0t¬Á?‘vNñìˆ&;÷›ˆ±<*eðc {£”1¦¶©•ƒY2HöÕå-Zhé õv[c¢)ª ä"µÝ2u6_ÄI¿x ‹‹¿"©rô©É«Žü&á-J©wÌܵ9ïqñl=}áG§0úŽ¤¹aú-°œƒ¾—@œ0¯«ù».Ú®)Î`b×Q4)±1û9Õ²M0fí9E¾Å2Õa™]µâî)(ë„Œ0µHcó¬¬+•H ’¸Í=/Q’>YP–‘§™8Ï·" ügðTê0ëðk†ÓÀ¨€ßËŸÔx³àŒc/a™wçË6o®‹sˆ->Д˜í@h°ˆYÔë*Zþ®9³dY¢8òõ¡QW”OuÓ1[*·ìί~`‘G¸sÃ3&fwIèsá•ÝëÉQHcÈ’Ë^qåõ¡%kÊÈ'tb9] ù1vo‹Š÷a†l‹Ï1?"‰EûýDèÙ1Š<+êvѶ :¶±éšˆ#ïÔ´ïÝ)û\ÝfÍö–¢’l˜–*YîÖWÀyÁŒ¡ÄpÐân´³ÞmÉ]â^f¸æzäKVñL^!³kn{ïaSï³ vU8Z¡Ú®ˆÞ¸‡üì#ô>¿é¼ù¤ˆ`¤;ðg*C ô8C/›;:SX`üò¬¢`Ä>*!ië›ò³<|˜ºœ>|H")Lb ÞcáôDHÀª<+™ÆT ¢ª¿dè7ÒM]{j¹k›å¶>϶Ë6+ϲåYQ-Ûòlí%!uîƇËÖM¯„ˆ'k«m•×v'¶ˆ +®¸±Ï«KÄ÷8â3½A0 Àí˜ÛÞr²e7<®7Á”‘*ó©gì"¡_}=76ÌšOPDz¿©ús²Ç¼º>¾?úDã{»È0h&šh^æÍî%Ö{TiXŠ—HE„IÌy'@ £SÂZ{pZ=Ì@t0ùªFæÆ×|_ð˜.¶‹u.ú£‡&(òåtZ—h ¤)ÒþZ,HbËs|ýqÃyŠa¨ØŽ.Ï<¯ÞŒæFfB¤´_ÆÒ6´lÛñ†Žrˆ›b¯¡Ì(B¸.Û² =¤áôÞw„pr´ÉÈöûYNAlÊÌ;wïu’ˆoÙIÂÓ#µOmp±qSd‹$rÿ¿F>Iüx#é3QÛð#Ø7ôyŸ†²ÐR é“*Ã;ê–7PópíwC#éë{$ÆÑ>#Ï0ëö®ÿ1jÕ{øØy*ðhú¡åg÷¶òýw_UwÞ@. 0‘«uÞ´œàÜÖÝ‘¼™QâîLj«‡˜1Õ“¥w{2µïÉÒ( +ÿ˜§špã{‹ÝPíÈŒÃ| wÂ} R%ô€¬ÿ©®ö´o½£Ø®èÑù´§‡Ðžªþ&€¦Ÿ°TÁ}%î .evئå%S ·-<°UÝPX!-¶éò[=«n[ýôyH2 ~Õ·0ÁãB'O E¿|Ã\,RgŸƒaä$ú+cX 7±ÖWõ1öƱâjA„ªn™A©tÛvTÀ%¶‰±µßû-Àñ[ªÜ÷·4—+~é&ÆÍ”øflˆt©pªo\‹ªË›M6]x6vèˆë+ºIÅ$ªh /¼¾¢ |¨ò*2ÂÂa«ŒŒ‡6©½¢·eN Và=~Ë„{*²„ø'ÌãGW“·ÿ‰G°ÈôÌˬýÌ<ì=ð;<`¤) ý{~“ßò’ߟ:ü°«üÚ 8F½„×è57¾Ã릋 ¾Õ¢ýyÆ–ß%5“ö˸àsÅ0ûËeæùä>²ÎÿjºÛγ¶c.~©ññÿpàxï% +<Ü> endobj -7056 0 obj << -/D [7054 0 R /XYZ 85.039 781.388 null] +7387 0 obj << +/D [7385 0 R /XYZ 85.039 781.388 null] >> endobj -7053 0 obj << -/Font << /F56 3226 0 R /F35 2976 0 R /F15 2972 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R >> -/XObject << /Im1 4096 0 R /Im3 4353 0 R >> +2830 0 obj << +/D [7385 0 R /XYZ 85.039 761.463 null] +>> endobj +7388 0 obj << +/D [7385 0 R /XYZ 85.039 741.134 null] +>> endobj +7384 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F64 4225 0 R /F18 4228 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7059 0 obj << -/Length 1068 +7392 0 obj << +/Length 1529 /Filter /FlateDecode >> stream -xÚ¥VÛnÛF}×W°È ‰–˽’ܾ9‰Ó8hê$Zi(™¶óâ”cÿ}gv–-ËAÑ@¸»svæÌÙÙ!EÀá'‚Ü0®lå‚©<Öõ‚×`ùm!<"öx†y¹\$oLÎ,·ÁòjïÇ0mT°¼ü¾z{òayú)Š•R¡JYgY¾=dþE«Ësz¾:ÿ!áÙï§4¿8yÿò$ú²|·8]ND¦Ô"‹¯‹Ï_xp Œß-8S6¾Á˜3æz4˜ÑÊÏ«ÅÅâãäŠl: ]Ç’±°ÌJó}aRÁtª&a$X³ÆÌ…1œ®0 …a®IŒááI5”]S Q,Â-¬ß•¿F±ÎmØÃÄ­‘a7l›kÐ'Íj aÑã3ˆ›^eÝ6ÏI§s&2ûýdö—Œ0GNY¤L¥.—e”«°ºŠ‡ýPt ‡ 0,ý2fPvwxîeGkÈÚ=é¬Ìc-mø€Øvç÷o`$Âê’lkve1”\¸(땹õ$úÖ9-‡ ®¢v¸ZáäÆ‘ÁA\·žPÛ”¿ÀÈèð6Še†ˆ†ˆâ¶GYA­X`mX—ÿº¨ªmf<¥Ãí@ì´èë\¬ÀÊpkòFÍÅTD„ -ÓŠ¥^Í?%«m“ô›y$ãLɮ…xI_Ô«‚€õ -T1Ò„ñë#äŽîiöq|„Öxš "eW£€óœË{‡Yï†s®¼ùÛvØP TÎ -Y&s ìtŒ” 75T<ŸÊuøó=>÷Z‚euŒñè ΋qK©ÿíêrGÄÖ…çý$‘æ»æ»oz6Å!²ß^7…ícÅð o»‘Ò]8rÚ¶©1ñ`ò)Æ,žÛ0A U±gÚ”¶’I.þC‹ØTÍÑ7^B§Ïºq›8¸¡‘C›/S[ÔB2nÌÔá†ì{¼åL àYÀ¸£ø£[wy˜äVŠ))Ñað5ŒkkAfcÇ}Ÿ’[HÎj¼ne0#êÝÆ3¿Ô¿óù“–¥™ ´Î˜ÎérŸ]a7˜õ\m.õmš?¸ÃŸŸ4mqˆÁU{åíÛëm2>ôCIÇ>ºi¦hEƒI]øc\{‹ÛÑúU*½ö†¦…‚¼žö½òž^š..¼|3‚”’þ®Ó1ñvA± »[_¡ônß!Xóã=xÜñPl¨dû‡ íáîEC{4Ýb˜Uÿ$Ç“Ò×Ö¸bÕÙÿ/Z¼‚gA<}ßüÐ=Røá—fÇ>àO²ÿÐçØþ–)–«g¾=Œ„®®8“tÌZ¦‡2h‹&W4#ü/âÙ€endstream +xÚµWKsÛ6¾ëW°“C©i /’èÍy5ÎÄI+M;i”DÛløPHʉÿ}w± EÉ´›©§£ìb±øöÛÅŠ{!ü¸—hJãÅ g2I¼u9 ½Kü:ãN#ô #¢ÇËÙ⹎<2oyaU–›þ“'o—ÏÞÍ)¥/#6â8ñ_¼™‹Äÿ@«Ë7ô}òæìíœû§¯žÑüüäìñÉüÓòåìÙrth ˜Š$žúeöñSèmÀ±—³I“x_a2nŒWΔ–L+éæÅì|öÛ`…dÊ£]w d³„Ç8`I¢Æ:·t¹]°TF‡g\1®ø¤gp¿$bî4c7…`†FNûЊ†˜y± ¢!<‘ò8gFëqx>Ì9ý´©æ÷óêr +nÍbaAò¾€Ë†+£±uv¿É.,NKé=­Á-oï™4LQDÈ"¹÷'Ô9K+ Ã͸MÀ‘lÆÞ t» [×Õ©\\ÇLÄÂÝ2EóÄ_¢9¸&µñÉU{¸]Iàö"öëNbÄ…<®wÅ•~ìHk×fd ÝâfBÊYXÍ@"ëÐÐWÅž‘U$í®2ÔÛ.¯LçŠC.áÎïñ=x/w%ÙëÚŸ)­kÙñÞ}˜´W0â>¸n§ä´ÄP’غÝä ‚A& …ÁŠ;:³£)9:íºÉ·nñ=ªK‚^„#è…lJzìm”&$ &r=è(Wdd¡d¨„ÉX=(`Æ\n3«)‡ú”€-H>-ù>ëôDÖ½£ëÒɼêó®CR¹(n‰6 Ò-ݶ„õß0Ùµn_KqwáÉݪ æ‹÷oç‰" Fs`‘¤-èSS×Ý#È¡ýÏyQ¤EA“ÍØѱ£â ¦ôôã@ÕV&Ð@>ܪðbi·˜Ž:ôO +(Ujk2ñ:ûr?1þ9ÐOrä5à„¨¥Œ )KÈ0bÂiŠPE‘ŦOS‹R‰¼¬&üLŠ»ü—^(s4—ó3è$ú˜*Î);ìZÖ\Iß]DYJ zjå¥-@%±îÂ6L]kfŸºh2µ§MÚe#ƒœˆY +Û_»*l«B‡ŠEþÙù†:]_ qRW™ó‰;ÿ{2bU:¬»kàŒ%ò%1èx›yðÒ)ݧ·E ƒGeàH/º0*G†Ùá˜Ã~X¬òjÑ^½ÓV´ØµÍ¢¨ÁÇE›–«”ËÕƱüéÄ…&÷TG{Žü¤bÚ€±[gi±……B‚Ãì[fÈqíÒUAÑDÉ×¼»"ë‘YçôÛ†Ö×D´C/âªD¤¨£°‰=VoÈÓ•ÍÖÍ­·“Û.ÞN!8ã1ÿþ~[=¸ßŽ 3滟k§=ÑoGx%ïï·_×”aˆè¿´Úœ…Êj¯Çã;Zm~W« —¹¼¿Õ>½€ ñd_ÔqB 7®—‚Áùïàý;Exç)- P;†Àj^Yî£ü¦íèÙ@ö qhܵÑФßú¾ØÛ#k·:ð­þL+©+QίÛÉ% DHôu(û––Û"k”7½pT}ÛëF¶"ì¶=t2 +Çð² =¥ ¦Ëºò ˜žÛ+—jøïc診qn¥ã†iíîöRjƉ%ÿ™¯ÿO{ɵfB¨évŽ]ûÛ.cèÒ‡wðÞÎG©èV‘‰ìóŽüñƒâ3endstream endobj -7058 0 obj << +7391 0 obj << /Type /Page -/Contents 7059 0 R -/Resources 7057 0 R +/Contents 7392 0 R +/Resources 7390 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7033 0 R +/Parent 7389 0 R >> endobj -7060 0 obj << -/D [7058 0 R /XYZ 85.039 781.388 null] +7393 0 obj << +/D [7391 0 R /XYZ 85.039 781.388 null] >> endobj -2774 0 obj << -/D [7058 0 R /XYZ 85.039 761.463 null] +2834 0 obj << +/D [7391 0 R /XYZ 85.039 550.113 null] >> endobj -7061 0 obj << -/D [7058 0 R /XYZ 85.039 741.134 null] +7394 0 obj << +/D [7391 0 R /XYZ 85.039 513.246 null] >> endobj -7057 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F62 4047 0 R /F64 4112 0 R /F18 4115 0 R >> -/XObject << /Im1 4096 0 R >> +7390 0 obj << +/Font << /F56 3312 0 R /F64 4225 0 R /F18 4228 0 R /F35 3036 0 R /F20 3021 0 R /F15 3032 0 R /F62 4159 0 R >> +/XObject << /Im3 4496 0 R /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7064 0 obj << -/Length 2265 -/Filter /FlateDecode ->> -stream -xÚ­XÝsÛ6÷_¡·P3Lüœ{êÙw‰;mâÖò\¦i(‘’8¦HIÅ£ÿ¾û’’%õ¥ÉŒ,‹Åîâ·»ÔþëI(×$“(ÖÊÄñd¹½q'kXùx£…ÃŒ -|ÆggvuzÊõ£³¡öO ÀË×K -ÈÆ« - <C<БòC -|zúÀn \ãÛ]™oÉì³½FF\BÉahùÝŽ"‚ìžËŽæÀLë¶ßµ<-hÓ-^ÕwòFU]ÍÚvo2fýÓ \ö8kµ™z …¢v†ø*8>`[É»šÞ €·M̓WB"vÃñM- @Æ?sÛö@WBÕ+lrõYçÀmÉŽãå±6¼øÆÆ"ò3¼òjVô©>tÌÂÑÓ l6vÍ•ƒZ—‘–`À"ÀŸ_ž„ïÑ; g 1­˜Ø[íÇ4Ⱥ@|¸åÁÛ†‘¶n˜ÂxG¹ZN¨÷OÈ;ÚžÑÛÆCnÇÙ7W)îLJSäöu¨¢ÐŸø~¢".™þóí»;ɾq«ãÉŒ]¥“d²½1Ê‹ŒÌÊ›ç›ßFå—Èš„½ÇxHîòQ"Zðן¾~Ÿú’ ðb›!S÷—:£àÆ*ìõOèoe]×?Оòtrª?ÅT./ã£èÀÄb´¦§ûÈÃnïVžPBþñpi“WÓXð3C90&<üý„éx†,/_“æh8>Óã2‹k–rO•Ÿ,Ì<ææœØñÑþ:â÷6Ðp€© wU5Ç6ÃE6èõòBŸÜÀ.mðˆ/6ì³ä‰\MnLoOÊJ)Щë¯ÏeG){ 5 %c¤¯¸+g–vß'O¼½[#$.<)÷§[Æma¥z'éHÆ*-¿×"©fziREŒ ¸$¾Ɔ¯ 5axÚnß2vÀPª^#N2Ì'=Š2Û[Ñmxá#P910¢íÁæl”U–u_Tä¸ÐÎ9B1Ý2g!ò%×ôÑ:®±¬ÔBÔï -öAÈmËwÚSLÁ“®së4 Þ?ìÈÖæ¶Ì!>?.OÌÏö‚`ÁiK,o2Ý?*ÁF—üBµ;ª.úxõMàPq³o;žõ#çùzIÝ@H™Õ'ƒK_4¼4Ò~úüŒ>âöÛµ=Ôa÷Åö|´{E¯8?ÙUµ2¾;Ž„ÅÚwQ¼ ÆOO3¼éØ­ãìµÅ ¶XeNKY[y™Vï3ÇŽ¸ý™Üßµ0ÆM”üµbÄs±…ñ¢:wc[OZ˜çû/‘óò5|U.õ2VÂ5MF<{Ï×*‰½½ÈÂʃâÂ".`•€´ºÌ˜ðcÊ¥4µ8žÔ>¸€ö¼Ç;|aúËçǯ¼½:sÌ6EãxRåϨìþuÞñÚ,.1 »TÚcZšß?Ý=>ñ>h¹¥N± óH}ù.ÜF_+ *Zóïq}Ù¦|HË®³C”Œ² ,rª°0 -„¼ZÖ{ûC†C ZEr–vVWJU»b¤Žôðþ¥¡9SýK¼§ç5çdK¸×õõž'IX®¬Sa•S{è¼|y0qÀ´{ùŠqÄɾCLá"!t> -IL{þå™±'ݱèTêÓÀáÜ—.JQ–_7É ÇûWOëÊX«ü®ãHE±|À…f-¿?Ü ÷lÄ~¦r<‘‰v\a*Ø©–cFõÕÄö]¡hˆCïX¡“wmy®«q* Õ¸•ò/pU ÍQdÅP„uu#IÍÿËó-OäsR9d?ãì‡â -üœª?ÞcîžSpFë%¢QôÉí ¦é~Ãä*¦x.¢«öBeä$ «t}@õ‡.œ.»®ž>ð\DÔ8V¾fh`Ô‹ñÛ^˃©ó½U·¼ÊÅŽ†B"·%L‘ E‰[{ökAÞåë= üØ70çã¹DëŠj (²†Ñ»ÎåÛ–ãx•8åÆ<>‚Ês}hcãŒ{…Ø8aýǪÆr B.IÑ}A±²¼~ÿý¹©íæý¼ÈÖGÒý ¡XTÚ8_Õ¶p£‚¹ð“CX— åê•r@8ߌq -=+ MýÙ{`ˆUIü≤¡Üendstream +7397 0 obj << +/Length 2580 +/Filter /FlateDecode +>> +stream +xÚ¥ÉnÛHöî¯Ð­)À*“¬*.˜SO2¸Ñ{Æ6&Óéh‘–K¤Â%†ÿ~ÞV$%1A€Ä€XË«Wo_*Á‡¿`‘Xåët'ÒI²Xï/üÅvÞ]a¬VÖÏl®Üî* +•oâ9±Ò‰26ÂÍÞ_\ýú‹ÐWQ¤÷OtŸòt¬–+k}ïv©¯ÆŸ¦[®/{,—·ÃŸn©}ïuùùþ÷‹ÝO/0Ê’o\n"¸\—vø*õÓéåwÙ~&Þc¶\™ õ^pR7Ï-Oë +¿‰7ìUHN^ðB“U0Ûà,ô½ú‰¡»¬{‚õºÙ žÇ¾ã­n+'Ë +oꊳ5"–l·ãA·]‹'(á²Ìš‘|-s„e¤N ´ºC™¡0TWJ}ö9$«ß/|¥Ódñc@š.öZÉlwqwñïï ©LÏ¥²?ýøyFaH#†ä2sì!áw3œÅ©²¡Ðó3,Å?ÀÒGògXÙ  ƒ#;B?ºÆúDƒ^9Bˆ[ÁJäÃ?.^Ö=ªº‘$¾{eÊøð}uÆ +eõðQñÒP»áéCãd¹Þõ¹· IçBcä«­ÕæÒ&˜ú¶‡?£ŽòŽï2eU?ÖùëŒX°ÜI¢ßAÚSÎÅÀÃXù ܺ~bW(€“ˆ‰®\©A©ÊÑ Ý <ƒýp}ü¸sÜî‘›HCÚ}^rÜE¨¶wÆN2Ïp|ÓdûÖ!§¸£lr„ª÷±%ÀÚ¹ý6O“*!)xÐôմ✉↑撗\’@Í”•S•ò<™Vu0z–nË ï¨Ú@T\Z·Ó¦—§ú†fDr³ËUb .ò(GüD{`{ry)7圢Hq\ÖŒi‘33½ ›ÖöÌaOõ%ÌQ;Ùf´b–T•Ozk WÞ%¯pt3êᄈCÖÈKŽ@°n8ž3ySq:f߃"Ÿrë`°&°\¼õmÇ€’’!Ó­×’ª%£^LãÚ¯°_¹æ‰ËªåPù¢ø±œNÑÓ‹±Hh +™µJÅpQ&ÄÈv!%ÄK 4œYáû[âkªÈÑúÌH"(LúeÆ¥…ØÎD®ë¬ªœÕ“öcÍ4´’°òŒ¯¬¯®I ¥I»{sƒQ!ö> I×p÷Ïvkº îCWÞÂÁŠ6¨,€µz—óàëà[Í´¤¯žÛ9-´ÂÂÇ뗼6¹Ä€“¸(°¢'¹ö!5ÙˆOÐbé|‘ËìºéF Âöý×Ä^]ßòy^'åÊ$‘À–©gf4ybÑ1÷8øå¯á¢ØÊ›1Waž¼ô:d½ÿ–ä'55-ˆ‡šˆèEQ(q: +lwƒ``¡¨Öu?Éx1\J!S0çYçhå0×>q¥O».ùçmìÀî|h¤Î&:–#¬Ø Ù0©FÝÁŒ¼=ܼՉåµ7C]ñ“J7 @¾ÅXP²e5rúî;Ž8¹îŽQgR£ZLgHÛãN(¥°Rï!œ£ðxZM¦´TÉ­jJžq£ÙÄÞ}Çsž0PTËv †D¿?½Çj¥ññ»ä·Ñ^J‰a!nÇq^RÈdñÕ$P”ÒwRü¿7ðZÏ­fPG¦þ:w='¼œöwÈX£þ:O%éhÆÏŸÁ`mænÁ½±D–âC¨)ØXq] ×2ÂpÈÁ gÃ-ôt _ä,ë†çk¯dLq> +ïK_NnÇè]VT!•"²syâÄ—²sÖîxHº*žé“Hºá1’#ÏŸH¸wvÒa…dL(cÜ$ Þµ&Ã.¾1ìðÌ›zýaÕÕ+ˆ€χ—í¯aq¢å9VÅãÉé0™Ä¸0+Sz<€ zÈrÒAMJ!‰[î»?ÊTd$ˆ‹žÂiÀEkÙny™rŽ{ò&IÖÔˆ£q°wÕ)YcCµ¢¼¨ÂõOÐKðKjë°×LÂü(jmâ KìÒM{÷¤xJHœ}I倉8HÄûNˆ°‰Åp["„ IýKzÜÀ‚ ¦¼ðƒ…~A)©ý˜¶ÜÐãƹõ(R80¤Õ¡¹1ô¶üÝüŽE÷Ð5ë‡L]Az5X3r 2T–ZŠåéS,Ê3rYHAOzÄÆ÷‘]ÇlŒôÔöêŠxgíÏõ Ì6Ç +×AÉMŠÐ773µç:l¬Lj§yç´J ƒDÙtòh0›“Œ‰Oo µQ©=ùß6÷ý?¥T¿bendstream endobj -7063 0 obj << +7396 0 obj << /Type /Page -/Contents 7064 0 R -/Resources 7062 0 R +/Contents 7397 0 R +/Resources 7395 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7070 0 R -/Annots [ 7068 0 R ] +/Parent 7389 0 R +/Annots [ 7401 0 R ] >> endobj -7068 0 obj << +7401 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [480.859 184.061 536.549 196.963] /Subtype/Link/A<> >> endobj -7065 0 obj << -/D [7063 0 R /XYZ 85.039 781.388 null] ->> endobj -2778 0 obj << -/D [7063 0 R /XYZ 85.039 761.463 null] ->> endobj -3168 0 obj << -/D [7063 0 R /XYZ 85.039 653.495 null] +7398 0 obj << +/D [7396 0 R /XYZ 85.039 781.388 null] >> endobj -2782 0 obj << -/D [7063 0 R /XYZ 85.039 584.755 null] +2838 0 obj << +/D [7396 0 R /XYZ 85.039 761.463 null] >> endobj -7066 0 obj << -/D [7063 0 R /XYZ 85.039 544.591 null] +3260 0 obj << +/D [7396 0 R /XYZ 85.039 653.495 null] >> endobj -2786 0 obj << -/D [7063 0 R /XYZ 85.039 309.244 null] +2842 0 obj << +/D [7396 0 R /XYZ 85.039 584.755 null] >> endobj -7067 0 obj << -/D [7063 0 R /XYZ 85.039 269.08 null] +7399 0 obj << +/D [7396 0 R /XYZ 85.039 544.591 null] >> endobj -2790 0 obj << -/D [7063 0 R /XYZ 85.039 155.069 null] +2846 0 obj << +/D [7396 0 R /XYZ 85.039 309.244 null] >> endobj -7069 0 obj << -/D [7063 0 R /XYZ 85.039 115.511 null] +7400 0 obj << +/D [7396 0 R /XYZ 85.039 269.08 null] >> endobj -7062 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +7395 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7073 0 obj << -/Length 1158 +7404 0 obj << +/Length 1262 /Filter /FlateDecode >> stream -xÚåWYÛ6~÷¯*CŠ¢%õ-›ì¶äjÖ ’ -ÙV—²IÎvÿ}g8¤l¯•èñT–†3Ã9¾‡ŸðRŸ̼$L¦©·¬'Ü[ƒä§‰°¡U t.瓧×jæ Î2žyóÕÁŽb±’Þ¼øè?ÿùÙ»ùÕû ”Rú2aA˜$©ÿ.þÛ÷A*ý9>ž]Þ¼º™>Ï_N®æƒÓÁ8ÈÐã—ÉÇÏÜ+ º—Îd–z÷@s&@\OÀ%S±´c=¹ü2˜"YìѬ±•L™Jåy†Bd¨8S<6^iì7-d(f~¿ÌªŽm™%üf‹cåß‚,¯ƒ(ñ9qA”úDå*߃†îivt‰Ó?q½-;ç£$¢Î—(oAØçÍÛÇJˆTÈÙñwQ”,JÆ1 ­ðÈØ9D Žù)FW7/(ÉÊB1äðâÍͯÄ2P•&£¾ -¨5+ÒDÞv©÷.Û0L× £YÊdâ…‹œó©Oý{¼Aî 'ósƒØ~ Ï‚tLÙJ’îŒt¡Ëšd&dxçôÒGþ«ÞER žPÍ”ºzŠqK¨±ð÷½µ´#m0+lŠ–x+ãº&êe®­ꤺtWþÚéúJk$›. -è :ücÓÞÑ‚l«õ˜ sÚQÂxfQÄ<°·iÚð"©zIìï`^Û`†ÚQ³w˜"€0/ý@“L{lË@´k]Ѳé¬IP_hëuιFëîMA°CÖÖq b¬L½©½p6ÛŽÌä®(±-QåPáMÙŽà˜8EF8³–1E/‡[=§—®­©ô›Öñѽ-ÇÁp£ÌZŒ7¤N+•šxv{ÛZÆŒi. LïJW0IEÔ–¦×›LצÛX÷#š~z-t¬X*R/Œ%›Á*Col­a…ÀD®¸ÿ[FÖUAkÑiaåŒqoD¡n¾–_ÀšJ”ÿ$N¦A”Àc$8÷ŸÀcšŸ(©sCbZˆ¿¶‚ø»<Å4ÓíÛ|ç|f#òÅrÙY¹¸‘ÿ^ãôY¤üeÙ¶MûMˆÄÅ98”ÒR·.ÜQXÚ¾£šlÂáIÑfÿF‹àìª`ð4Ü¿Ý)ûïuÊþ¿í”1KüQ«¨ÿw§ä«áh³ÛÔ²5£Ülf=n™|~aÏÃï+>JÚ·ìÍE›› Œ[¿öZœÞQŸ ;œ¶óݱL 0ö®ûìVÞ‚ü¤û.‚P¤xžàÛvëFÐQ];ÕGñ°LyOv›ÆÜá -Êlgïfv±wÇOy‚Þ9JnÑáBcÙž*ùÖÚ¤c‘v\#>? ¸mÑwv‡3G}Cos Æ0=E'|[ Ò¯n.QO¦×ÄѦ5¬ØÔÇβG6ÒtÛCŠ²XöUcCÄkÞ±{Tº=:ôˆóÉ;ÛbâàÛ"†C󃹳 Úí7>($gQ6öjˆô­1|+A“¤2¿%«(b‘p±`Ñâ(}¯û&9 øOÔB®endstream +xÚÕW[oÛ6~÷¯Ð<È@Ì’"©ËÞÒ\¶E›5~ØЃlÉ—U²RIn–¿s¡d9Q2`ņ 6yxx.¿sH+OŸòb+¤N¼(VBDZ·,'Ò[ÃÊÏå4¤g„ -.½™O^_ÙÐSR$2ñæ+R™gŸüó_Înæ—§3­µ¯#1EQìßL•ÿáã4Öþ?ÎÞ\¿»žÿ>ý2;¹œÌŒ0¡Fß&Ÿ¾H/ƒ ÞN¤ÐIìÝÃX +•$^91V k´›“Ûɯ½^3ïÉcÖiÌT"’ÀŽç:ÃÜlÒg€ØmÂa¶ †­Iü‹éLùï¯ë’±Ú‰T½EeGð»@³ ŽýMÚð ůĿ ëjŸEŽ¾J^½ß¶5$nA{l³ÏÒJøWÎÔ„™SG¥¼Í×%åC6FK¾éÌ Ut_Wh°Ýîúg²v +ýBžåÎÅ +DUÍãÛ´œ±¿HyÚV.üi¡Žò¿"r<œŽ%0–U]çKʪäÎ)SkAÑð¸Ýä<"k9F¤µñ‹.¢U§küj°¯Zõûy‘ÁGÑùÁÂvÑ¥µs±Â„pÐT¥ÛVç)Yí@—F Ä<®¦±! ´ +Ámx2Ø +sëߢ«³@ P²@Ôxœå«ã/ZÞu ~–ÊÀx—7œeJðaKÞx\vA¥ŸDPR„&þçêÓ"ˆÆkÏ­¼LñËë Ngë’î£uøƒˆÉÉG¿ð¡#M”í–žG F~„±ÐÓÈ$äq¾!¼-$†“øê¦)³z—á4p€üŽ[yÉsŠRžÛrÛæÙÀdʧäøi£?qw÷=¥ªÑÖ#ÓšÅ+*ìÎS–§…³‘vq1EJ\»¡"\» ©Z KÈå~¿- +&ìŽIÐӿÂg5F·Þ ¬=æ°Ã“C…’èözOd »ëz&*×®î Ê#>¡ú¨„ÃÆèÏÛw9)eΪsÄÅѸ~‡íÃÕ4zh7‡ñª¢ü+Ô¹Gm"Èš­´,ÅFÃD|p Ö°¥®EÒƾ î8.o±Ånòzì4ÃΗăئﻤ±&IpÎ_±¨Óš@"uN°UÐquv†E<2>[ô–Z¹¦»wߺÝ9²‚v.÷̨ޢËÁiºî×düúJ‹Þ +BÂ5É¥Ýð}"Ö<*«&ë15Ó‰QB#Ò"Ô!)ŠuuùÂåÿáìs¡+bï‹n¬{Ãuw>eõ=ÿÆldýW&:ÍäÈ!‚8 ””þ+ø8MŸQ:XR§™zÙÁ+¶¹ÃKö4UOoº¶Nï:ŸÉˆ©ÅrÙ¸uu2²þg‰ÛÃÀú˼®«ú)BNQ< ⨻pGq©Û±cíСE¤yst9SïÕ®‰®[M¼%U¢DÄNíÿ5§’HÀøeJíÇ(å²îžÂfÿKJÉ ”Ó}–SöH©³Uÿ°uï¯eM³å[jõCn¥ |_út!|Ç÷Vë{Ý,î1y¸‰Èİ飩†_#ü,sïo´uÔ‹Qsß` OY(øw?U¼ÛðûˆßðQíÛëð ×?zB£D>ó“Æþ±_Wð#fpÈ/>ôŒ‰ªB¡CÃ/Ä.À¿Éòtendstream endobj -7072 0 obj << +7403 0 obj << /Type /Page -/Contents 7073 0 R -/Resources 7071 0 R +/Contents 7404 0 R +/Resources 7402 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7070 0 R +/Parent 7389 0 R >> endobj -7074 0 obj << -/D [7072 0 R /XYZ 85.039 781.388 null] +7405 0 obj << +/D [7403 0 R /XYZ 85.039 781.388 null] >> endobj -7071 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R >> +2850 0 obj << +/D [7403 0 R /XYZ 85.039 761.463 null] +>> endobj +7406 0 obj << +/D [7403 0 R /XYZ 85.039 739.701 null] +>> endobj +7402 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7077 0 obj << -/Length 1727 +7409 0 obj << +/Length 1362 /Filter /FlateDecode >> stream -xÚ¥XÛŽÛ6}÷Wé‹ DZQu ЇÝdÓ:Ý&éÚ@¤AA[²-¬,9–'ß¹PïÊNÑ"@ÌË<3šþh·â9Ì«†T2rT$Ÿz(Ô€‡Êu”듇wÓ›Ùïì_žàXŠß:fyÎÃõ†G…U;è—Û‹¬òG*œ-·dTÃì†vZóNyí‡ ˜›­ë ŽÐš´«×²ÒÛ¾tôñ)OY?óO•Öé:Kœ²ëº®¼§Ú3¤=?â­•ƒ}-aåÉo÷M[¢_OIEîßxôS’®²"e¸oßý};}õCÄ+DQn›c»kzõvú[Uº¤ðg%÷¬r5±}!,ÂFs9:š¤y¯é e•Š%â‹™Ô³!žy0ë;ÒzHpš§õã¡IÛˆ7™«W-ŒÖÒÜb¢WqO¨öi-LeOzR¬Ù²Kåaé”æÜà¢tölÎʼt]'ôU#óÊÈü5K¡°>œ;߬8¹â:‘+/‚ó¢Ø‰}ïœpb¥zà¼ÀsüpˆP¹Ö,ýrH‹qbÜ4¦A€´ë„ß"raƒÝa¼¢ã]ÆØšœ}z¼Sú¹XbÔŸs’AbÆùûz­ÉDä5” -Ä/h]×)]ñÎTÒ`Ià‰$Ð1ç®»}µàšÕlß>Ð&´· -K:Ò !d.-TMÃÖÀÌJã פƒE‰ãÅÃ’o‚ö¿þ’ÓÊ.|E2Öåy 8 ¼$ß‹ãmþâóð?FutÆendstream +xÚ¥WYoÛ8~÷¯²/2°bD‘º +ìCÒ¤[IÛMüТ-Œ%[Bt¤:âæßw†C)¶£$…›Ãk¾¹¾¡¹å‡[‘Ï\[aÄ™ˆ"kUÎ\k+ÿθÙáZ’¹K§ËÙñ;?°¸Ëb7¶–k½e™|³ß¾?ù¼<¿š;B[„lî„adžsûÓÕ<ö¿NN‹å×ùå‡ÙùrG#™ jø9ûöõñaæ2GÖÆ.ãql•3é æKaäbv=ûo¼…Ö¤E§&ìp†ŽpYÉÑ îOÔe€]uh´Û¬îA,²ï®¡ž;^d'8¿š;ÜNi­ËR:óÝåϤ-Ú{üNìjáÒeÒ÷®6íÒ>OXM;÷ðø>ã7U•L\æqæqoç®Í3w9X$#„Ì/áe–VsGòØ~˜ƒA`¨#=×®æÚ$øJhµ«iA%°2Ìe`ÙŽKz MÓÄÅâôú’æŠÜ܈óyu°ñìãâ MÑ}Ú£]Žn6[ëµÑ‘=^s­J„|£hË¥ºEQ£½ÏИb‚ïk‹¿b.ê€63€‰g®aæ’fF´Ém^cp+³ÃÚõ­IºÔj5º¼Ú · €èpÞ¾™¦¿`48ã2ßóíèç1¢£Ø?ŠNQMDzÿÎÁ` ã —rÛXÖ rY#øûÑ9äöŽ{¸ý’E¡ÖþW’®ó*%¸?ý¾8{ñZWX9¨}Œ%Švù$µîa†Lš@ͦ8òjUôIÚ²lªÒBæ…C± ’ò€Þ4G:°(#o$¦% z‡T€%P£/cû +ëJ¡ý^“ .0Ý«ú5hŸÒ`ïeò:} 8ç•vgdô:xò¢ÖÙvª(”)·¿Mš ÷GV» £ký®‡x V'î#«`@Vam6/¶û_$ì¡Ç&ã ¦àö®1 ;M®OC)"hÛXxœv«ã¬n»v"’Ž†˜+½² Ò+Œ"SšÕzG'úš,P{{ùÉ‘@áÃ)«‹º¾»Q«[’ŽW¥Êôˆ%u©òJ S„¼wuhø8G§úÒ^©¾Õ>7òÝ¡ˆl+|CE@Üw$Ž90Ó-I5ù¶6G†JòóØÃ;öºÝc9K›µZi˜µ®mÆã%Ònˆÿ{¼¬£©}—é€Ëp¯QY^´£;mâ²¢äÓÇú*Z¬êPmRÝ4éª+HÜæ`Œ»ƒžE{ê¦0 3ªƸ3mÒuݘͥB]æ>ƒí;8 Ô˜þaR­2ÝÔ]>‚Ûfæ„öÞ´ùÔÆRi×)íoèQ˜·­!»"oMeu‘ ŒÛŒÕ3V©„AÞ>¥ÌWQImR¿ á[íe}»Ún'8Y!ï¾¾+“Ó"í[„i)˜Eè2SÛj=Âwš8%ÄâGÅDRëªýžE>B3Y£ilèÀcNñ9!aü Ÿ{1ƒà½Êç¾áó´wª¿¼ÀÝPù‘+žSÍ!÷rã›åP!·9jõá”þìÓªÓ|ŒîÒ9 +Ó]4¬ ʼn~Æ„'ŸïfÑ+Mæ,oÕM1xÛÜ Ñ1Ï +Îdã°oñ4ñ’uâ!ûHÁ}ÙõûÁiè×¢ûˆ…à8ÓâË»1¿)c[Ôéé×Q¨‰QÜé'•–|Ý”ªBºÃím¾©róŠt¨ƒx!ôÿx¿ƒ¬Ù \ÉÉWnø3~67ýÙMdDõb̤Œ!Â_Àߦ]€¿¸Þ_«endstream endobj -7076 0 obj << +7408 0 obj << /Type /Page -/Contents 7077 0 R -/Resources 7075 0 R +/Contents 7409 0 R +/Resources 7407 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7070 0 R ->> endobj -7078 0 obj << -/D [7076 0 R /XYZ 85.039 781.388 null] ->> endobj -2794 0 obj << -/D [7076 0 R /XYZ 85.039 559.519 null] ->> endobj -7079 0 obj << -/D [7076 0 R /XYZ 85.039 517.234 null] ->> endobj -2798 0 obj << -/D [7076 0 R /XYZ 85.039 330.106 null] +/Parent 7389 0 R >> endobj -7080 0 obj << -/D [7076 0 R /XYZ 85.039 289.942 null] +7410 0 obj << +/D [7408 0 R /XYZ 85.039 781.388 null] >> endobj -2802 0 obj << -/D [7076 0 R /XYZ 85.039 289.942 null] +2854 0 obj << +/D [7408 0 R /XYZ 85.039 518.872 null] >> endobj -7081 0 obj << -/D [7076 0 R /XYZ 85.039 253.075 null] +7411 0 obj << +/D [7408 0 R /XYZ 85.039 476.587 null] >> endobj -2806 0 obj << -/D [7076 0 R /XYZ 85.039 209.741 null] +2858 0 obj << +/D [7408 0 R /XYZ 85.039 275.909 null] >> endobj -7082 0 obj << -/D [7076 0 R /XYZ 85.039 169.577 null] +7412 0 obj << +/D [7408 0 R /XYZ 85.039 235.745 null] >> endobj -2810 0 obj << -/D [7076 0 R /XYZ 85.039 169.577 null] +2862 0 obj << +/D [7408 0 R /XYZ 85.039 235.745 null] >> endobj -7083 0 obj << -/D [7076 0 R /XYZ 85.039 132.71 null] +7413 0 obj << +/D [7408 0 R /XYZ 85.039 198.878 null] >> endobj -7075 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F35 2976 0 R /F20 2961 0 R >> +7407 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7086 0 obj << -/Length 1029 +7416 0 obj << +/Length 1493 /Filter /FlateDecode >> stream -xÚ¥VMsÛ6½ëWðÍ”(><:§›6iÄN¦“æ@I”Å1Eº$eÕÿ¾»X¢d:=t<2îâíîÛ·€d àOÖp¡Ó ±’kkƒÍa!‚{°ü´Þ#ô.áÄçM¶øñ‰)x*Ò Ûq Œ²íWööç›OÙíçe¨µf:áË0I,û´”ìãç¥Õ,Ã7oÞxŸý¹ü–Ý-n³1èRŒø÷âë7l!»»…à:µÁ ¾ .Á|X@Hn"í×Õbµø}„"[Ю¹¶ÜXý²Bif*4‚¹ -ŸÊ®\C=UEvÈërkXJÖõy_65Z"ÖìèÙïK°wä~Zª„5GØ’y½ •e-ròÚç5xl÷X]¢=¶ð²q{6²è\` -O.îM_äU‰(÷™WÕuZ¾‚·Øž?~ðn.0yœg?ÔVc¿€¼P"·©#£­ÏÔrW^Ñ´êÛcG™mý‹ tê’‹®?nÐü@®åŽžï®u£RÁ…J‚DÇ<5æ¿•£¹JæuXáì¥,Tª¹ã!«[(,ûðË—8¢,+jQóH­—Œ;úB%,W1FJ¸H‰ÅÊDIÁÚ ªÈݾbKÊû ò;’Ø‘i×´ôe…Ò¨ò¶ôÅchk¤Rfý3¯N¤,…ÑŒÃ2TÃwàÀ'˜à¸B@À%Lɲc¹…’izzï;èãÚ¢rË|ÂK=cä¢çƒÉ‘c)Û{9\à8¹z*–ýð)Ê€¯?Rie¨}£FG{íf²¡Lý`Žs1Ù’^m‘JiŠè¢ ªðf×Ù¶—³€;ËNPít:,Ýg 8X÷þkçé)ÜÑNGÐy¿Å[ßÿH㦩ÿ2Â3ã8Œ° ¡­Q¦eå×]~À<ð(Ìçûæ({ðùQ0Íîšéˆÿ:Vó¯ŸÊAƒ<·Å#ì‚s³íý‘6u˜4᱊¿{£M|Ü`+°Jšãñ¼7‰âŠî°˜CHóbŒ`_èz]:ZbH©¦'Œ 2±Ô0®q òx%M‚ÿn–£Ë«—Þ`RÄ.Ëß:§þSyžXúÜä›ÏK9ÙÂcì»»fÎ7Hì¥û·:žˆŒ'è4ií˜Ø’cÝùNkëÖöX <8}²ýÂÚyÓSó]¿c:kÐ ÕøOáC¬ÑçÙWtô¥•s·e€9=)¤ÔQ‡Âø‹ÍÝÈS‡¼›^ŽÚ 3oÏŠ)!0[=yÍê¦÷/êa^†4ýÕTUx|¤µ›_ú°41Ëï‰sþŠN´à*“ |¨Úÿõ#i[¤¹Õé¼ØŒ!Ê!d7Òâ:ßáÇÔ‹„ÿ(ÙfÐendstream +xÚ½W[oÛ6~÷¯ð#D*)’º<¶E»¥ëmµ‡`èú Ûr,T–ÚfÓÁÚŽM Mtj-‰Ö¤bQ—™§•h<_‰ìm{ó.¿Hý„à0LO+PÅ>¬„BéVŠ÷°®ÁéJ¬¿Ã²¨naÅâ6ûƒ§¥hê»|ŸW]{Áëa ŸtƒVA¢F7({!è‹zŸ£¼HlŽh`5†/ tÝ}·"'‚I­( Œ‰Eã”DÖøFÓbS´ŒHFbé¤@N‹ +(ÊÎ/ˆ;IeÊœo–5…nÂFaO:®Qý]FÚµäq¦Þ#Öò¦ª;^´dr†áÉVeîtùLñoÐ%u³ÏªµÓëÏëc¹a­6ùm“mr2VN¬ìâ±¼°Ëy͈« äb>¾¼Û Œ6’mË?·DëxSðË5êƒ7\®·N1„íC^ºu'Nå’tô0=•1‘âÐë‹ h¸î¦zys*„×ÙD¥!xW—œ7Å›Û V^qæt»ÜwÍ/²ÛŒLAB„宺d rw]¾ÇçÑ/s’ò„Ø8yÜò´0$Ü󽢸$ Q…+#Ú"V!æäZ›†1KºZ¨HΖÝG–5!Û@ÇößMÈ¡›ohBXäèw„<ø…„¡Ñ +GdŒ]é3£»6‚o‡gËËÇ–Ð Ãè€eY¢ŠÆ´wAW1(CĨkŒ Hø¥S¼2 Ö7Ôû(¤´Ú°À‹/¨-sü6ÜÆYÃè>Ê\—(œ4WvǶO! ôˆ¼„Kb‡Zõà¬sÕ‘˜«ÇÍ +Äc]PJ›8ò¥½r=‹49åÈÚi’}ÈšS¸…Rê«i5àITÓèF†Çײšº,}ÔóÀûCæÁГ àì;IÃDZŠ£Ë¨tõñ¿}»jU2ÔÚgAf¬> endobj -7087 0 obj << -/D [7085 0 R /XYZ 85.039 781.388 null] +7417 0 obj << +/D [7415 0 R /XYZ 85.039 781.388 null] >> endobj -2814 0 obj << -/D [7085 0 R /XYZ 85.039 597.626 null] +2866 0 obj << +/D [7415 0 R /XYZ 85.039 761.463 null] >> endobj -6241 0 obj << -/D [7085 0 R /XYZ 85.039 565.205 null] +7418 0 obj << +/D [7415 0 R /XYZ 85.039 739.701 null] >> endobj -7084 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +2870 0 obj << +/D [7415 0 R /XYZ 85.039 739.701 null] +>> endobj +7419 0 obj << +/D [7415 0 R /XYZ 85.039 702.834 null] +>> endobj +2874 0 obj << +/D [7415 0 R /XYZ 85.039 470.985 null] +>> endobj +6522 0 obj << +/D [7415 0 R /XYZ 85.039 438.564 null] +>> endobj +7414 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7090 0 obj << -/Length 2306 +7422 0 obj << +/Length 2439 /Filter /FlateDecode >> stream -xÚÙnãÈñ}¾B˜—¥€Q›}ðÚ—Àvƃ̵v½A6XP-1¦H-IÇŸ:º)R=0`5»ª»ªë®’þä$„¯“IK¡ãx²Ü¾ó'k€üã´&Ð"0Ög€3…Jø&:‹ciÌ"™m$âÜÌß]Ý)¢|†z2rŒ„±/â8˜ÌWÿñt,¦³ ð½‡t;•Þ"Îtyi¹âEÕn²š—·÷€p7Iï7BoYä°“•-î5ÓÿÎÿùîã¼céˆØÓ=bZé‹ÄOúLk_iˆéù&o€­½åTEÞ&Ým†lÔv¿*§*öÚ9, Ù ¿oÏÄÝMgp:[â:ÿ×p—Œš—°~ªêmÚæ®Å¥çI)âÀŒ?ï€ãt" h)ì=/ˆ•0‰v:‘¨“xŸÒ%½Yl«–VÆ‘ì¥÷· º‹Çìá\”? I þ{k/#žÈEúh€ªÃ'º¨×ã—{ÖC?eáøN¶Ô侞âó‘~¾žpc!õ™#!X”78”ˆÂhÀAY!É6¸Mj,åïÛû»»ê¬Ž¿¯ïÕÇ+½oØoZÙêø5,Ã$æeë°Ç_v|'¾ìïÈÎõTJéýöñ„‰ä5*QÆ'ë¬JFÙÏ7Ù+¼Þ÷Á•I¥-¡¡ÛeºNÉ3ûàGrü«0¼4¼pyÉOáŸçöJŒt*IøN‚ðtŠ‚{ÂC5¯—Õ–c µù/-ò–®c“îhöÎ5fTyítÛ°Öµìãº3Cƒèfã|B¨ž Ì«Î ±\ãs¤>Ò ãà»Èþü˜ã;IYÆ0’ ¢‹ô| -2F‡(x>+…/|Fi+·Å¨üµŸrÔŒ½ÉÁžËm¤ùm„^š)ʨ°wüƒ‚­3 [±•E•®ÎHâ ùGáke@ŽñœÒÞßQت›…Ó^º§/pCyMNœÂù?üÀGsrwôó©bÅ'HüǬ€·¢$¨0±ìrT/®Ùça± ‘dtCɬë,m ËPV¢ÞÓrI(:T¦ -lšt̲–¥´>g ýz†ü|Ïš^’¢ìUì‰ÇXÉ]ÒQ_ -‡—Në¸sb Hî•aÈþ~B.Jô3¬@ÈHxûf^@º*ïË[‹PÚkR´øUŽ¾ !%‰P:C…ý¯ª-¯µ³Á¿š×è“¸Ñ º ªLt™C[™ †#èm`ÊP/C”É,(ßîlàBÕ³KãÍ®lͺi?3*¨$bMŒùo<9;ÜY‡|š#‡÷!ÿŸ3`å˜r¡ÞØ£|”“Æ(½Á-HÆhgeƒ*ú ©ô½ÕáŽÑÞ‡´o¯¿ž5J„~<òL‡1Jjp ’l¥[Ö/ÖgX Dæ±”7+ðKÕÖÐøìQŽLìã|êh3D"¶KnÂÚ.ìR0‰oÇÁë™réš¼v‰<‡Ü0:mBƒDÃ;Œ§•…Süª¬C!b^>q”¢ëJ{Ëçà™D}¹¤v+¥·ó]ÿâ°³ÿΟ˜o` É ¼>ã›Æg‹´éÒ0ÔNÍ«­ô,[úÄ,gáYW? Ü4C§­¡¯ñý7]ÑbÏzèd5zàGw"Ë›¶Ýý|uõòò" Û7ÆU‘—ûïBòùó%/ŦÝÇÜHÌRCîŽ[~‹sÂÓ¹"Zv´T f¶èUÍ!|Aí@ t)ìa³ÉI£j6 Fý}JmSüÅÚ;ìÿ~ÐA^.‹ýêpKß@.uÍZ"ÒáhSÚùØ5k?I,]׬l×ü…†Š§·¶SfCºÀ½ç ?h¤¾ˆýñZ%¡Q<`VŠý»cV…±cÕcVzÒN_n«Sþz_çåš;ü/WŠWSHû^½³£ª¨(7eËÖNj«îÎ"ÐJশçò4Œº™æ[š)àçSÿƇt ]Ñyé©0á#†ÎE;VF“€n8äØ¿N!’|`k;TNðQf¶ †/¬¡9‡ã¤Ç5kTX”.|°q7?_z‡Í(üŽ¾ã€Cï0r0§Â€¥8$|¨5:‘„"âQ‚ç„âp.!•ÐR (r‘R¸£&Õ~tQäöuPžR ßÿtƒBûdÏ`Äá¶þ‰¼ÿ¼eì»äE!öp. Ñ!½%Ä1‚)žbŸâüöëÕý×¾0X<ÜFenþ€9h¿ëºbJµí¨x-”÷•Έx,Ò›â!xÏÅóâéQìlì=”¤7÷_lZ¨xp4̲²”Þ{>ƒÉ¢¶GÝ1àÝ|üõ¾µ°*ÒƒVö¾l .x&‚‡cÛÍëij3ܺ!ÐVúU=¸Q­3;ÔÖÔIž0mŽ.£²«Þ¨zs‚š»'´…5C]©‚½/a—|_Ê?‹‚ð¹Cæqõ–¡<ζþõÍ©àA—o§Õ@g&L˜]ùä±®Ùqc›r%–Ô uÞýŸ:A¦Q.Ò¢ÎÒÕ+£Í5p«7~-8¤ú0ð *Z¾¬ ÖøÑKñƒZ¯ÔEÜÁR°³à͹©H™õÔ‹Ïyv*129ã™°k÷©ëtš5ÒêO¼ï¦²ÝÓ–‡1¬ùñ97Äõgº¾²¶¼¼çƒÕ3½÷¿Ã½|Žyà!Ð8¶|ê!kéïÏ Æª‚'S«,_¨Ar¹\k9Ì3Ý’¯E¨ÜeH×è“àY[±¾Lñÿw 7endstream +xÚÍÉrãÆîî¯PÍåQUÅf7·ÜlÇN)‰—)ñ¼Êä@I´Å˜"’ŠÇUùø‡¤jœ©\R>¨  Ñk[ øSƒÐ³ ‚PÙ: ‹õ™3xÌwgJ(Œ§mÏX÷ G v件c‚>g0Ò¡m<‘—³³ñë \Çö}=˜=Ñlù«4Ñç9Ö4^•5‡#íVœ/yq_¯†#e%%^ÍäfÚ}di’×Õð·Ù÷g׳>!<Ç6j…PÞ@9väD»BÌVi,µ¶C7°Vñ8× \ +¼È‡nhÕq +˜œˆµÀà <ªv3Áîdëô“£ Ð.˜4ÍaýT”ë¸N \ÛÈ;¢ªÐfsõ¨áF¶öÕ®-•±µñl©Ðš&²nãIŠ¢ÔEË•Ø,C8Ø 1_²›ÀJïØíÃP[ é~¤«íÈÓÿ ¤|ÔOß}ñ.ТÛrˆâã9~¾rב€ãöz§k{aÀ¨ÓǬbàîjð4þ¹šàa7pêTí厧h1veý‰°Æ5pgY²<P‘ßù_¯ÿ·Èÿb¨”²~¹>²ªÖ¶¯ƒÓzûïé=[%o,wÍWóW*¿ñ³¸¸|?¦‰Ê*PªWö‚GÞ9,< ¿dr(pVHŽ€GCšðèÜ»ø_Xc×q>?>à—/a Œ~`@áTOxdÉëE±Þ@ÔÌ”f &¹mJIj›TèõfÃûâm7èÖt TiMy„‘Ås¨9ðòZk8!½tì߃Р(– qMº:¬¤‰HKvŽ’äÂ3!Ô)} +LcŒõ%qÕH˜2yJ$ÇÔç +‰Ø^Vìýÿ‘„ó8 •Ì™œ©EKÀ>Âh]”¢«dcJæ‘CŸãrÉêÊÙ«”wmJºñ½Ür?±}ÝÀv¢ô½Èê¤Äûæ]`T¨j`ýÅ?3­vC(AX²L˜¢fç‚ÜY0à©lÈ…"]s~…|Ÿð=J:®ÙÊsÄk5Æ·.6›¬á0Ããç‹0G3á¢"¼\Pð…L¶˜a`ý|7ùØsÝë˜ëíÁp‚„ >ñ€kïøÊõÀ +\ñëÖ2\:˜Ð€^Mn™ ÂЭ>-QÊ Ár»¨›Ã³Œ£½•ÎxÃË-s$`¹åâ€k)T™°®’òÏtÑÜ#`îèÎñL>’æpîÑF„9ÊöÆ8”o‘†Õf+òÀzÖ¶jMC`Ì9¾¶^ÓZra£–ÂEŽD,íAU7\š‹RdmýëĦ%äo‚c€àÆ&y¸p÷'%”¢wàpKh¶°õêÐ*°çÕh³ÒFì®Ð:6µ Sb¨T‚QØ!äûQdìÐx_[fî8#Î^Îùc»Æí¯0Úµz¯Âˆ»ìõÐfúÁ×׫‹Ìxǽ…gûŽJÆ rß“ñqE®ÉÆÅòŽå'àòƒa1¡Ùóän¹1@d_ED’mã¤ÿÏ¥úÐÑžÔm*¤`=kÃYäeÕ4~¦4P’¡m}C‰]@@kGõ. +¡]ÜVž<©C”3¿°Ë…Ëß8žâLGÁžeÔf7àõ#Çÿö3~r<§CÑ+ÿ8H0ŸŽæR—RÏÞ¤ùÖô LÕ¹Hì‚Ò¾­Ú²ô•.Fµ¶®1¿___9አq]Ù’¤Ç7Ô¬ða·§•¹ÒþqöëoÎ` b|æØdzE‘lEƒõ™¶Ý@ËWv6=ûïŽçºÁ»ž‹%ç0˜Á¢~¶~ïì×4·i’@“­³£°4ž­£…Ž>%@`›(ØK÷¡ÊR2€_9¶ÏÛ’»B¾§c—WC öjÇ*7Ýð]”y²¨V UÙîE¤hõˆ[cBË~ÓcT׎ÂèÔc‚çò¾ì6—œQRÉÞ°rHæèz øÈò$Ê:.xN™È•K K«79€}©ú¦G^ ‘ö¾~(*žÙ (£zä{‡l=Û€š½1„(ó7 >8¢h‹&m÷½ +ỉËó]—ÔLo|w'sBGa‡JIþ¼}˜Míë×L¸—b}˜8µ/tç,Â"KxÞ 9ïÃf«Ý-±ãɶûz«àŸ1íº6¼ ¥­AÛ r„iÏq¡¶U«/Ý‘j¶"^F*£ %v=£ï…{7Ò+#F“Ë[ `%]-6ƸÖÝõŒªÇdØ`*h iêÊOLL…iˆ¾Üc°jaШŸöʣŠ‡² ÉB™B°êái‰«€×ø&’ÿ ǵ¸Ž%üÑ»9ƒx”KÃÙ=0ÒÍnË’9Õ'Û å;¶¯Ônkpôüÿ>ŠÞëÌqOãj³ÁÁ¿úšßÿyŽÙendstream endobj -7089 0 obj << +7421 0 obj << /Type /Page -/Contents 7090 0 R -/Resources 7088 0 R +/Contents 7422 0 R +/Resources 7420 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7070 0 R -/Annots [ 7093 0 R 7094 0 R 7095 0 R 7096 0 R 7097 0 R ] +/Parent 7432 0 R +/Annots [ 7425 0 R 7426 0 R 7427 0 R 7428 0 R 7429 0 R ] >> endobj -7093 0 obj << +7425 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [108.346 540.868 150.127 553.77] +/Rect [107.996 540.868 149.777 553.77] /Subtype/Link/A<> >> endobj -7094 0 obj << +7426 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [337.498 540.868 370.096 553.77] +/Rect [300.847 540.868 336.476 553.77] /Subtype/Link/A<> >> endobj -7095 0 obj << +7427 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [248.84 405.982 292.045 417.672] +/Rect [249.184 446.63 295.419 458.319] /Subtype/Link/A<> >> endobj -7096 0 obj << +7428 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [318.127 405.982 343.604 417.672] +/Rect [318.624 446.63 346.223 458.319] /Subtype/Link/A<> >> endobj -7097 0 obj << +7429 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [208.892 378.278 428.518 391.179] +/Rect [211.922 418.925 417.588 431.827] /Subtype/Link/A<> >> endobj -7091 0 obj << -/D [7089 0 R /XYZ 85.039 781.388 null] +7423 0 obj << +/D [7421 0 R /XYZ 85.039 781.388 null] >> endobj -2818 0 obj << -/D [7089 0 R /XYZ 85.039 761.463 null] +2878 0 obj << +/D [7421 0 R /XYZ 85.039 761.463 null] >> endobj -3169 0 obj << -/D [7089 0 R /XYZ 85.039 657.513 null] +3261 0 obj << +/D [7421 0 R /XYZ 85.039 657.513 null] >> endobj -2822 0 obj << -/D [7089 0 R /XYZ 85.039 611.854 null] +2882 0 obj << +/D [7421 0 R /XYZ 85.039 611.854 null] >> endobj -7092 0 obj << -/D [7089 0 R /XYZ 85.039 571.69 null] +7424 0 obj << +/D [7421 0 R /XYZ 85.039 571.69 null] >> endobj -2826 0 obj << -/D [7089 0 R /XYZ 85.039 335.736 null] +2886 0 obj << +/D [7421 0 R /XYZ 85.039 376.384 null] >> endobj -7098 0 obj << -/D [7089 0 R /XYZ 85.039 296.178 null] +7430 0 obj << +/D [7421 0 R /XYZ 85.039 336.826 null] >> endobj -2830 0 obj << -/D [7089 0 R /XYZ 85.039 296.178 null] +2890 0 obj << +/D [7421 0 R /XYZ 85.039 336.826 null] >> endobj -7099 0 obj << -/D [7089 0 R /XYZ 85.039 258.647 null] +7431 0 obj << +/D [7421 0 R /XYZ 85.039 299.295 null] >> endobj -7088 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R /F35 2976 0 R /F41 2994 0 R >> +7420 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F41 3054 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7102 0 obj << -/Length 2860 +7435 0 obj << +/Length 2638 /Filter /FlateDecode >> stream -xÚ¥kOãHò;¿"â ŽD»Ûvì•F'`á†9XíÞin>˜Ø ¾qì¬m†áß_=ºÛí$0{:÷£ººªºÞñGüóGqèz2Íbß•qžÝ/.Æ)¥#cw<™Íbg>ö³Ïçg¸8g·¿òþÝâã%ì<ðòÅõÕœ×/n®/oóñ×ŧ£Ë…!Ê\$HÑŸG_¾z£ ¨ÿtä¹2‰G/0ö\¶7G@’RÍË£ùÑoï#>uH!Ær_~x@¡ç†^@8Ë2੨ÖÀËÌsº§œÇ·ã‰ïäÝùõÝœW걈ïø'Ç­†W÷ÓëûcždMÈö`Š¿¾SÁfÝño%˜vÉ@Äãx"f¼š©“•&‹Áñä÷Ój,ç9-y?­Ôÿ<`‹/<¦¾©„Á+ã¼ðZ º‰’MHú §®Ê¢ê§YM¤©xÑWÈh—vE  <ÀÌ;º±ãƒŸax¿˜»ð¹üçå).úβ,–cýÆS8Mß»Ô)Ÿc˜A„9¾¨«{~€ë禧ïæì~~Ì $ŠþD±Ï*â“R8ÇÈÇõùg¥à€p><¹E]_à¾R¿C|¿k{韶è¥`ñäŽ5ug ¬.ÛN8‹'Ò€+QSªœ'z´O¡Ùìh[Æ· Zºå‚¸oÔ؆lضœà…Pó*¤"ò¥3ÏË|©u$NàÚG‰G*RT9oIÕ²´ÓnS:+MÔ ù@Ý“L _'‡ìK9¡ÇÆDNôaëÊø2°AèleÞ›OÉ©ò~J2[žÊeεl$ÿI_ ªG”gºVëåÙ&z -èÙCíxW÷Ü%ò}ן…ï¦\ %v}7A½1 GßYÂÒƒDE`8„?“0ô´§7­Dé9w*¡ªÃŸt,á1H,¾#yUœ´­ãå‹1ÇQŒ)ËuŒjfáò]¡Ö|¼_!ªñ††ÇDׯì ðàÿË(Œ…ûy3% ÁX"ekÿB= å*b á˜ä&ç9;i!9päjò¹°#MMê•ÊI`ÿæì–cr’V 5 Ï…+– rQ:´Òž®K”V ÿfW0?s!1<‘hp£Y+ˆKHzbï‹i'Êi…¦°ýe:%Þ¶î¦X6u[¯:wYo¦ç:ŒÿhE¯íôBçEÎaÝ3LA*ŸÏnQîæbºËS'nZ>àiç¹5ÌûœìbBN8O"/p# œÍ5>}£ïI¢ÒN³eQYrî(½ÈÉ3ôExˆõ#I(ö— M¯ß"È <à}ÕjÍ0¢ýÈ•Q @îP˜‚Ò@Ä]Tú2æ<¢¥EUF£Ó.Ô¦WÞÀ º{Ü$¢ =– #~ÚPZGNŽED1 -ÎI ¾L\/ŽfùäŒ ãÛ_˜mi³-b{Hz<.¼mÞ=oÝüG¾&a·Ê»—om—ºíë¡‚!¾g™Þß‘ôäÀV]ĆHi£•á„XáÊ'ŧ.y™Ã –‡TsJH«ÏJv˜÷ú+(lœt|Ðv:Œ}F["L–g¼N•ƒð<§…ÉaQ˜„Ä”NrÒÝ; -uwÁë2™Q„{^Cj¹„{@° ôš¬TVüЦ§äÃpy>X¦ì¯09.éT|Lj™t=OŽ€8xžÙO|›†žXàûaç!߶̔¯¥h­Ä^nK‰ò´nÅÔ -xÁ¨n¾Áú´Ê --Ø=Ä3’³!';MüOxn é·´1O³·ò 9‹ádðnð´`ÞÌ/d(Ýxò ©ò‹{êIT§¼ KÑ ûß͸Æôâ…l̓GÜè35ñõäŽ" -åQ„U¢v"ÄßùÛ[܆žƒ7z—ÛæÍ\Aú‰;“>q{U4FÐTµB1Õpq©ò\ 怅C"ú‘²‘¦ð6Y"~Á"þáú–Êÿ_Æ>8…ß¿òùO®—Uá_JDë¦DCš k\\JË] fP­q6È”kxF…Ä -(º ᨪ¾|³H닳ï $8¤  LôÄûVSÉg›º<Û³vÈyŒ ªº~,~ÞÄ“.óÁÞDãšXÈøÐm¯¿êc÷„!N͆A«ËS¥`Whç`&p ‹\×räL;ìqH?tÚšAûX˜^t5W*D&L’÷Um Ï­-Y5®ééÖä|`?¡×C]¾½¶]¾1•Ònˤ‚pO’³^p Ú~w ‚!“MÛñdU7ÖaROÝÒ)ŽÓ¦¥¢P: £ä•Êû°=©nbªÉ ã‚Äwt M®¨£‘ƒPW‚rl¸u7§¼Ì%„`¶]6ìo“b¥úÎüì¬ÕƒAN “[<å^r°¯ø,çÃÓ8mY…M:´,€yãka¥QøæíêJC¬¹Ð‚ájú„–‚Ã=l(ú¨ppÏ;íƒNWñƒ¶ë!”Jí{²LÓ Ý!¯9ô›DÖ¨(ß©k¹ŸÞ Hú zæáÿÂ9PNÓÔÿnJP…ЂR»k—I•”5ØõñžanÒÖhþ§\»:Øoø«è¼9›_>|¢†µkåÿ)ï‘ÏÙ¿ÏTܶÔnà)µ»$ÔW¡ê«¤ªc[öuľhØSã‘t»þ¬Á.ŠÛÙ¦NN/w<5d»÷ JÐ©Ó “}£Xñ/¸É™p0³jª :ôC . DDé`Ó.U_„SµÐm–/–j¼\7«pW™"y=œ§]§Õe³Õ˜kEësEm¼·c|eǹ¾ -ôÆ• כϦ3Œ‹ä´BB“Ãìâ”Û—Tyt;&Fà„‹ > TÖ†¡a»\g^”–ßgIåñŠÅuw@*J]Á­¥E )—&GÅŒ»Š[e} þ”ë¯ZÿN!1ü¨PG]õS^,T›%K#Îø¾™€Äš¬xàŸ~ä -i[l¶å+7ÓŒ{–*;Ì(b¯5u9´b!™ÿ£CE¯ô3Z@¬:ó_tÌ¿Â=©°:k×ä>´  -ªa{×jÃÚšMyÄ@³ß,~S–BŽŒa€Sïfg“A8RR$2ÍD2˾z—/îgWçc­µ§cq>Ž¢Ø{^ÁÌ_^xäñË›ë«éìñüûìÓÙÕ¬ÃÀØjäà?g_¿ËQL~:“B'ñèÚR¨$­ÏL E`´í—ggÿjwá93âU÷;Š±–"ŽM{a_]¸Ú|“Ê,÷uº;+¯€ Ud}òAa$Œ²‹@,ÆøÞc^æs\+µy»Uj[e±}rœ{ƒ#±Gt% ós øÁtî¤kÊ…6Ž¿UºYÂF:”Þf›¬a“'€ýë>c_RÛÕé&ãƒðZ›yM¥MÎ<–ÛE—^ó äÏ®â9åîšžÃèOügWïV¸iƒ,ŒÆ~ +?У±BÙ'tø܉È@ºE…2D/q… ^/`G‰òí%ë[ºF9=a‹bYu\` “àÕŽÛpͽ qµ·”øp3÷ iÉÃÍþ©}°¾˜òÝB&`j»eµZ{Ÿ´,_x4Í2n\ßów“®sË¿ƒ%¶q\Ù5N"ÑU ?ñA"Ž+¤õ=,…ÆRWnU>¤V2*vz5µÌùÊ»ñ¡ŸêRˆ0ôí +‹”^Uó!tƒ-´# XÀ./<™òçËõô±C×̳Ýá› ä4߽éë;"TÈ‘-£¢ïõ»[{ ˆ•ÔO…JÄ&ìÉðᮽ®·³r¬×dšUY-_€To0ïÃy¬éj:ÐÞ—óØxi½Åž;$€YkGIqGA€Š¸&yáMZ}Ê3 ‹‚oV!Õó†T1µ“¤ZðE[Ù’~¢ž¤»œÙGÑVÖÚu÷…tb„ŠBûD$˜À¼û|L"ÂÈðC²3Fƒì¢žìžPÁŠÍ’ñœp¾dRðuZ‰¨OïºÄ½Ò]šß­dú´áÙ/(ä´æ+â„!p ÈÞYV]a¼ü‰G·éÒ¯ó îoMVfö¨'ÒȪ VtŽ\Q‹0VÃŽrìBƒT»žC‰$ºž¼£/àxU(O‚ #ï.Rsóó¹– È °ŒÒC²q"zD'þ¾Hâäµ*8xóÞ;;g+BF ›«/»8û&™`ZZÒgçá™i`ÞÀÎɈ–¼Å4">ycÍDhì-eð•t“òe*«~Í ”°”ÁoËCÞ}k—xÚ´j{23qøEèq >ÛÉkÕUß„8ÇeÞX¹ÄN·”G‘l[Ê3¡ GMtÐ0Ð0îh¼™šÉiÃoÞ“¯ŽÛ:eÀöéräãlC±Ÿî ½u;W–?WdÃhë4ànmPÉ´–‰uv ·œ²íÛJ/ö6§‘î~‚GDlðcÎvŽ8çcÚô;üÁIÉ´æ*,vüµJÿ¿•»qÖVbNsTohC *Ô›$½S‚ÆüP Êx^&_»ð‚Ê¥ZÙ*¢r‘¶ˆùú‡ÝÜU«lÞ¤¹Þô+·›6ÅzKµv£ŸZ·¯¬G<¤”EÕê²Ù¿…¨Žòp®ç"ÿ[ÞÚbPºØ94¦gYµ?é¬øW,í=Ø$¨_KuY,ÕÈ +NðÜSðd†"?N„1¯”2ÿÛ8ô·?¹éH¨¸Ó¾šà¤©BÊö{IÝ?9Ûendstream endobj -7101 0 obj << +7434 0 obj << /Type /Page -/Contents 7102 0 R -/Resources 7100 0 R +/Contents 7435 0 R +/Resources 7433 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7070 0 R -/Annots [ 7105 0 R 7106 0 R ] +/Parent 7432 0 R +/Annots [ 7438 0 R 7439 0 R ] >> endobj -7105 0 obj << +7438 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [416.285 547.932 690.672 560.833] +/Rect [84.043 547.932 358.43 560.833] /Subtype/Link/A<> >> endobj -7106 0 obj << +7439 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [272.007 392.913 488.424 405.815] +/Rect [272.007 406.462 488.424 419.364] /Subtype/Link/A<> >> endobj -7103 0 obj << -/D [7101 0 R /XYZ 85.039 781.388 null] +7436 0 obj << +/D [7434 0 R /XYZ 85.039 781.388 null] >> endobj -2834 0 obj << -/D [7101 0 R /XYZ 85.039 611.175 null] +2894 0 obj << +/D [7434 0 R /XYZ 85.039 651.823 null] >> endobj -7104 0 obj << -/D [7101 0 R /XYZ 85.039 575.765 null] +7437 0 obj << +/D [7434 0 R /XYZ 85.039 616.413 null] >> endobj -2838 0 obj << -/D [7101 0 R /XYZ 85.039 378.644 null] +2898 0 obj << +/D [7434 0 R /XYZ 85.039 392.194 null] >> endobj -7107 0 obj << -/D [7101 0 R /XYZ 85.039 343.84 null] +7440 0 obj << +/D [7434 0 R /XYZ 85.039 357.39 null] >> endobj -7100 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R /F41 2994 0 R /F35 2976 0 R >> +7433 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7110 0 obj << -/Length 2667 +7443 0 obj << +/Length 2801 /Filter /FlateDecode >> stream -xÚ¥ËnãFòî¯Ðm) j³ùæ{ðø‘8{¼cM É)‰;”¨TdÿýÖ«IJ¢ì>¨»ºX]U]oë‘ zùÊvãQiåFÑh¾¾°GK8ùñB ÆDP&=œOÓ‹Ë;?i[Åv<š.::¾ò|w4M·®ºzšÞ~O\×µÜH'aYÏcm]=|ºB°g]=Þðù—éO·pò•Á×÷wÏ ¿þ|û8}ÿ9ýùâvÚ2Õ^ ÄÈÑ_¿ÿiRàþç [¹q4ÚÃÚVŽ×À’ò=WöÅÅóÅ¿[R|æø«!Œ‰ŽUìøï+)ÐÊ ÜVIœzÊõ‚¾’|[ù¶GJ½¸ ß‹­Y¾I˱«­ýx¢­äkÛªpZ3<%” -Q¾ƒÂ–U¹Ãõ¶>§"/T¡ö†˜¶A"[E¶û¾Dn b­$Ò*öý¾DÚQÎDÚÒ(–o[Ÿa4ÈcVòaQ¦¸†ýÓåý‹Z7Éü»H]•kÆ{Èg^•u¹hÎIhÇÊÑ; µ–„ËŠ³qäZ°ƒ k@cP¨+|`'T6˜5 -55²dIU¼‰ ×OóÄxHfU3æ*Iù Å/–Âù Þµ$vï‹é>~:5«¦,ÄYs±˜.È´& e犿/TŒ´×R™ª­… `b=èóef0Ö&täËMÙ&p¹Õ{7 ÐËÜÈ‹ŸõؗꆲC0uçIQ -K‘E„ˆìTéwC{çl¶r=­‚£låJ¶º.7hBË]•“GPëÚCùgœž†sDä´ÀoÎðîBôïÎÙ¼äÚ!4¹ú „ëÇMŸT ?\S-ñ±’5ƒ¨JðÁ ŠIºÎ7óÅRszÍ$°·QS[@#!Ÿ¯æ>˜ؾÍÀï|U-´B ÎWÂîìnÌ긫´`¦ò¹'}XC‹ì²œ…â¸4~ÃÖî4ö*L1›1ÂíoT“ñøöWÿDÊ—wžîi[;ð°´9´-–Œsð":Pnà -ÊÕÍÃýãõÞø#sdžÙ@…q0rbšzçãɉ«œpxn21´&=b§&:P¾Û^Hƒ¡Aayõ¡¬ž @Í|ó%=PóC¥ý¿S;Õ«ô2Ó¶­ØÐãcèP¼}ß’0Š¬Äsô“%/ºj±©ÞLá)¾¹í’s5OúÓ×}/ö íͱmœ«µçƒ³¾?ZïáœuhíØÊö¢‡öÅ¡¿õü¹râìBf)ɲHvE#U#ý3¡äŽ -uqŽy •¼¿Ï|‡sÖ½á'– Hý4ñ &ª{:'ÇkNY'—/AþÚ™«¬3Ÿ²jLüÆ£¶ð u¯Ià¦×“!b;Ü8ú*bë·®žŽÉXÊ®€Q7QÝ„$Ñ©¤¨vÌ™Cƒaή cKšB„qÚ^Üdý>5`Ýͨ=”›üŒw¬Ž¤¦JöÔßÁ×]_˜yÄ\æj¡ùtûížl:Ýì×-[è¤Æ˜4W1ð»n[ßÀ¡A•%ßùh°G?|et«“WF竲¾´ÚŒz:0¾þV7{s-mîÈåß&Û*«wk(ÞzÍ Û¯y<ç8ëÙ®­œxøÿiòÆÿ×ÿ#[ó\¹güËwuŸð‚Zõ\÷˜_â…¹§ ÿrÆåendstream +xÚ½]sÛ¸ñÝ¿BÔLÀÎôÁ‘勯¶ãÆÊ93—{ %JfC‰ +IEñ¿ï~eÑ>O¯íxÆ‹Åb¿’þä 6ÂWÉ Š¥Pq<˜­NüÁV~9‘ÃhᇗÞOON/L8¾Hüd0]Êtþ»7þpv;|Ž”RžŠÅpE±w7”ÞÙõû3kïìæœ×?N?L`åƒÇ—w _]Nn¦wÃ?¦¿žL¦FZèP!ßO~ÿÃÌÉ_O|¡’x°ƒ±/d’ V'Ú(a´²óâäîäŸ-^ÓÞÕsÏ‘ÃÉD$é—Åïn’V€µP:ìJ @F'Þ}¾ž—C%½Ýp$½.†Þ ¾Wá$òîq•P*Dù’YVåÇ›ºGˆ’—y‹}õÂb EäGŒK¸Š9f\z¹7¾wã´AV²† s®ç þ> ƒØCEáö-3"IḠξ(+ƼÆÊ+‘ô7Ò3ªÄFV°íEè7©ð>O(<Ò1iB—ŸŽ­Àwj–0 ó¥jv.$–Î¥( E}(xÛ%m ‘ðÁ3pGe].PíñÓšñU ƒ5}漘®ù‹$Ö3F]ekG“¼¶Ý‘§óŒçM‰ß°U¢¤ÝÛ[¢ +F¹5DXúíç9ÃQâUþÉ*”¦Ö7}ÌíÐ:r4tÛ*+²”ä‡b5ßïAÇ{Ž*¯ ”[P0-•k†¢Ø³¼Úã4×ycw¢Ñjƒw«¼×ÀÄ Pzï9ÆK:|ÌÏy{¾FþO/T×”ñ…6ÚºÄé&«ÊMýTŸî0öìêSºòÈau-h³}(òÙi3Ûä›ÓÝbר@d?3>ãÀá$xc„ö ”p˜€„¾*({^ó— AKT6Ø–7O‡,šŸV‡€öÕ—f…ÝÝô‘lÓ†‰Í3’֬ʈjV; ‹ŠÒ­ÊKL¯îÐMYû#w™®(vCV³$óÖ†9ûé¸A ƒ[ǾïÝ`·Gj=¡fX¾žè×ó¬GYRÇ"ÖÆ +òþòæîãøâüêªGèóí]¡H$NÓÉÕÍd*&_&=DL$‚(øBÒñCܨ8ì#$AXæB±bg…¿Ý¼Ÿ¾@GËètîïÀÿÿS†@¾0RFÍOgãɧ—¤õªÈC†Næ ð»éÙÈPìM!fÓƒG±#øþMEO•2Á‹yß…oËûÍûç1ra>›¶|)8¯_ää^5¯Ÿ-šÌ–2·ˆ™ÖõË.iæ¼2~L×ˬ·P/–ZॱL^/ Ý¢§qºEÿƒ´Æ©j!ÙU®¤ÂØ@(ÊãM‘ÝBRüÀµÊmýÄ»ÿ…8<Þå@a÷cÿÇì_Í™&‡HA½÷˜­y˾û +ÅK*$M÷<ÍæÀVn0v0²¹œDs¸Íx«gOå’±¸Öã¨Ö›ÿ ÇEñ!ÿ)›ÿÆå-p¹­8øQ›NÒ¤Î}gSßµíÝ>{æÆ6û·J± îæE×1Ân7æ…)ýIRÿ…$ qtA†b¶aAÇËeò”tÕ ‹dzjW +e\”ÎWPé.–/t Q LäÊ8Žq®N‡SŠ6À4¼2Ïëo¼ôÕ7>Zm ˆ"‹:×.û‹{†(!åsJì —îÆWÐ`ch°M@‹Du£&Åæ)uÖ"kƒo´0FqGÓWÝG`ZÚ•j“/·ôæe C=ûÛW©ôÙùõåÍøâ(òž«Y& ?úÖ¥„VaïKW"$U‹Î$TŸIŒ‰h?Î?Þß=cmò–þ%=¥bGéÙpÛŒ€|æTNÕl÷.¢DDÏ9¤Ž÷V'Þm×2a~¢‚Ò¥Í^Ä$ºóžIˆ‡&l j5/„ "×8\óãÄ–­D'>\‹{ØØÛ<ãÜbŸv`¾nÈzÉ_®+øŃܫ`ø£«cpçý,ÝÛ…”¢4Dl™¤Ôk饶¯;EÛX[ÈyîPR× c½Åó{ƒô_€[OpT_ïS’«V8ÿÐûÊa"¡lÉy4H7q÷‰BÆB'ò:›Admžú{:‰Åû{‡8?EÿQàô< ,Aˆ^N~¤Þ–´M®›¢´8pûû††"ºm‘î²u7”ÛÀÈëéÿÐé(YßRÑ ŽRl×°ª™}¯³kûª&êÍÞ¡«Ž¥{]µ-2€™½½D6•‡¶ÜŒlˆ†Õž-hÑx ¢ý|s‰Ð/¼Ç>ê)¬CÈsb¼E˜DïæÊx#þ:Ú:#±õ[¹]>²—‡°2~ÌÜû/’Cv{:t {ÊÙc½z×}v ‘8p¯($Ù*mòÒ²[®{Ü"2"„‘¿wq’<&Œ"û‘=Å‚#·¥±¹Lk%bÈ­Þ°€fî=ua«·¿¦)ÕéJ«tæR%k«fŒ»”‹ä´X”… ME¯ÓNC÷Ûœ®n§)þ|c{ê+ñÀ»ul^+ñÌÛ¼ÛXïþÜñßö‰ª±Ô–mçdH‹t[4îqÖm%]Ó÷feñ?øEcJ%9ÚLÂâ^ØTÜ4SŠiß÷¾c—™m3žµN»%‹ïÊ2ì¤- …}WD„IÛßò´í»èÁ.ZÀÎË£±|ó!h @,!¹8`_2Nj™¡`ˆƒ–sÌž`\\[_£©Ž:]1NZ½¦ø«UdßWpé™EäûÖ!ÛŽ ΞYãÒ/ð­ùçK³~âb8[¹®8L¼KKk$>¹}ñخ҇â‰9Kyõè}.j›õ£W‹½¢ZQz@é +!—º½Îfeù×~3V‘q«—Wýè•ôªCÍ•¸cðß6„ãendstream endobj -7109 0 obj << +7442 0 obj << /Type /Page -/Contents 7110 0 R -/Resources 7108 0 R +/Contents 7443 0 R +/Resources 7441 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7118 0 R +/Parent 7432 0 R >> endobj -7111 0 obj << -/D [7109 0 R /XYZ 85.039 781.388 null] +7444 0 obj << +/D [7442 0 R /XYZ 85.039 781.388 null] >> endobj -2842 0 obj << -/D [7109 0 R /XYZ 85.039 761.463 null] +2902 0 obj << +/D [7442 0 R /XYZ 85.039 761.463 null] >> endobj -7112 0 obj << -/D [7109 0 R /XYZ 85.039 736.911 null] +7445 0 obj << +/D [7442 0 R /XYZ 85.039 736.911 null] >> endobj -2846 0 obj << -/D [7109 0 R /XYZ 85.039 736.911 null] +2906 0 obj << +/D [7442 0 R /XYZ 85.039 736.911 null] >> endobj -7113 0 obj << -/D [7109 0 R /XYZ 85.039 702.17 null] +7446 0 obj << +/D [7442 0 R /XYZ 85.039 702.17 null] >> endobj -2850 0 obj << -/D [7109 0 R /XYZ 85.039 552.28 null] +2910 0 obj << +/D [7442 0 R /XYZ 85.039 565.83 null] >> endobj -7114 0 obj << -/D [7109 0 R /XYZ 85.039 517.535 null] +7447 0 obj << +/D [7442 0 R /XYZ 85.039 531.084 null] >> endobj -2854 0 obj << -/D [7109 0 R /XYZ 85.039 366.981 null] +2914 0 obj << +/D [7442 0 R /XYZ 85.039 380.53 null] >> endobj -7115 0 obj << -/D [7109 0 R /XYZ 85.039 332.235 null] +7448 0 obj << +/D [7442 0 R /XYZ 85.039 345.784 null] >> endobj -2858 0 obj << -/D [7109 0 R /XYZ 85.039 249.428 null] +2918 0 obj << +/D [7442 0 R /XYZ 85.039 262.674 null] >> endobj -7116 0 obj << -/D [7109 0 R /XYZ 85.039 214.682 null] +7449 0 obj << +/D [7442 0 R /XYZ 85.039 228.231 null] >> endobj -2862 0 obj << -/D [7109 0 R /XYZ 85.039 145.423 null] +2922 0 obj << +/D [7442 0 R /XYZ 85.039 158.973 null] >> endobj -7117 0 obj << -/D [7109 0 R /XYZ 85.039 110.013 null] +7450 0 obj << +/D [7442 0 R /XYZ 85.039 123.563 null] >> endobj -7108 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F41 2994 0 R >> +7441 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7121 0 obj << -/Length 2803 +7453 0 obj << +/Length 2686 /Filter /FlateDecode >> stream -xÚ­YKsÛ8¾ûWø6TÕš!@‚"§jÛ™ÑLlk-e²SÙh‰’Y¦D IÙÉ¿ß~¤ž—ÝJÅÄ£hôó¤.ø§.ãaz9L”&Éålu\.aæ× %WBrÕ£ùezñᣉ/Uà§Az9]të?2áåtþÕ»ùíz<½{\…aè…‰?¸o2PÞõý/×8y×·<ÿ8ýífžxøfôqÂã7ŸFwÓÉàÛô÷‹»©Êm¤(Ñß_¿—sþ÷‹ÀÓäòÚ¯`zu"ù& -¥_^L.þå–â¹è’¹Ž)ÀR\©ÔOµ9¯¤XùQ:%i˜U~jL_I&ðM‘’@/¡A=ÆÞdçV^žÏá½æV› Õƒ+åUoù -Frl¯ÛSZ‰_ Óórv4$§2GŒ©b?ŒİªÍQ íµ/°ÖbGy É´’)]Y¶jT¥ŒǦÞ:ñrf]T[^Ϲ×[U{MÞ¶Åz ¡ñnóE†”eû4Õߠý¥XÃßy…˽3ŒÀ7€…dÓ¯@q?™ÞŒ¿‰¨$׬-ª5T ThåJ¡yS:'É‘³NþB_"ºæ½?z±Sþ'PÚ[%¯¹÷eñeÉ­¶Ç†š×[¢-­ -Hw8š1Ù3ÌK"›# *±¦Svl«|íü%Š"oÄ,s ¬Ö?µ¼Ø+Êä´Óï/Øù1H"Ï·§ÖC?‡ÇSßÿË¥©c»ð@þ½gÓEdσuÞ{z#†¾µÞöÍ”EÃßÎÞÐ1ï’Ön¹³BÙÒ>ÐÕŸájh[R7pŠtõ¢ª­Î²#ÂÁÈ w2^¨ÌjØ­g~Czx˜ØËÊ-rj f6ŠÃ$Â.(´æáE¯—N'@¦È÷îW3õ†e­6¥¬&QÐÙ2Ô!ñçlj&mSÆ6~:LÀر¯Œ"5ü‘×ÎræÏÏýÌé÷ ÿ‡OŸÇ·>â´ßÑç˜R‰@³Å÷Ÿ=a~EVhÝí²²w>oz;­ÉÞO¸Â Š÷„ö¤àüŒcgdLúa4>uš?GÈ~\"YàÉHQçRûD9åŸO·O¨ï½E¯zúNæ_—MõôOÈ^h°(ÌäòxõýÓ-MöЄÃh§¢I^KS}ÖK{4'ï1*}ALæÜ5FAÀa5Á¨gÀ:?ºlö*D'ä•}ΉۑœŒ)ˆ9?Ò” -&°W -l³·îB¥Œj ¤Åõºbé¤ÿŠÑ0+¿± á„‚Y9>ÌNÆt-FÞãºÛ˜ý!ÜõQ@ekŒ¸û¦s¬¶{îÜžjÿšv€–2¼ A‚–._nj>wÍcŒùY¤jäåà*$$ÈüØF(=t\r5ìts¢Ã×±±æöŒ±c÷t¥ƒ=e¥FÇÚyix|^­2:0½(„Ç®v³­}‰"™UØ{ëR»šá;"}¥Ë|r‘ìe@˜TlC¥åF¡zr!dS±÷¼•M\~Ýù ñÙe¿“ÈåOñsVñê\»?x† *Wë­Qˆ…leAìDí±;ÛaKB©ž÷2Ž =ñk˵ˆ©@'ë[¦†gšíLBƒØ0‡mKtäþŠûQ‚Œì!ز‚”§<éð P`P"(âƒôëSÖÚ‡9œÊ„3;v ¹µ·|3D«p“‡ƒP÷Þ>]XÀàáÍú‚v6+¹á¼pã^Ùx⟖‰oyÈ3ïP”¦•v2voÝve¤–‘w;RØwZ\ä¥êJ3Ýñ‚ÞÃz@Y¯ÊVçòÈ^è3ŠWÆûi{aÀàÑrÙÀ/™GGCy‰£c’uŒum¨»«µ÷}DCuaÁU&è Ø`)º\ÈJÇ)#\kV­6eFi‰2§[!uÒ Ø!Á>ÔüÄC£†¢•Ízøµá1w(q]œHŒã ú-þжµqê¶;‡uù¹¼bˆø£ŒŽ7cd@þ-ëRòÚ–„76¼Y GßðÀvÅIü˜#ð‹o87›¦Ç ”òöñþzô€8YÞÀjl„Ç¡N€O5BºLÎA ÑÚI@ræû¾}—×\r‹IÒh8%bFögÕzÁ£«L$FÝfK9;ÝàPlynê´2Ï[FVk»‡äF¤¨6-¿†ˆ@xÑf²5þ²v -ìûúè•þ³Nþ§>¶‰B? Oüh´öµ²²  ¢0Ú—× :ƒ[ÏÀÿÄ»:¬endstream +xÚÍËr£Hòî¯ÐE´h +(±ížÑLÛÖZê™èíFX"Œ@Èvÿýæ«I¸ç°— G˜ªÌʬ¬|WIMøS“HÛŽOÂHÙ^MÒÝ…3Ùæç %+œ‰o;FÔO«‹Ÿt0QŽ;ñdõDKVë¯ÖÕ/—‹ÕÍÃtæyžåEöt†‘µœ*ëòö§KûÖåÝ5ãïW¿ÜæÁWóOK†_}žßÜ­–Óo«_/nVf¾íJð×Å×oÎd BþzáØ^M^aìØ*Ž'» _{¶ö=™Ë‹u\çO˜jäœ3³b¦b;võ¸.fxvwÚp¬¢‡Úx6œ0=híXË=PYY¶†oZsÀíöSÕÓ™²ª—l Çe;r|×öÞ•ÇSv¤zy”±Î]Õs/ò­v %-N<«¡Íw‚Ý…¨ö°ª8QLõ2u#+cÒ§êP|ͳWßjˆEÛ(/7xð™h • "{Ž'²]gOÉ¡hÒ—?òr]½2ÁÑ1âЕ’õy9Ø3aï¹và²úëíruµø6ÂÔl˜e,sÚæ•p¯ž|½£ÌŽ¾ÓâáÎÞ¥Š`m$,—.W7·öün>²yÀ#^ùGùÛã›Õ œV¨û׆WY\ÛØüÿûfDŸ Êfñ)#RŸ"l~÷3’bâ8&eï|X\ 6î´&{? ‡+ïí¹ÂÑ„ý@h?Îïæ÷9’K$ ºÉëÌÔœSq‰œò÷‡ëÔ÷ ÓÙ@߬‘óeÑT˜[.; ­i4x+÷*L·‡¶¨8ï<ÒV¾ ל1rtŒä‘Ñëɼl(îH †ûÚÀ¶ögxÉ"9ï?߈’ä0'e$‚#ùÃ.ø² )xEm†¸žøðï¾£Ûˆ„PÓB'=A8ÛaìÙ@âU¯°Ë±9õÊïê7M$ûvõFð•ÐS^¾ö­…º2Ì$€j0¯ÄÌ„|ÝR3£¼¾'ÎÛá6÷h@6ülöò.Ïó)¸•#:dQµy*§IF“Ô¦dE½ ô/p[;jŸ$í bGz!×JˆAÊÙèÌßJhÁ±^“´õ³ ‹|³Å}ûvu+Ç•BÐ'°¬~É´ì•cm“ ÷-¾×7¹ÚöÂàoïé>Æšú?¹§_U¥jsÀ²åêˆ+Ns² m46Tˆ3É +Ç]‰ÛäM[g`“µ-5í̳⯹23iuÚÖ\Œ\Ž_Œ8JUŒw/äsh„EÂó=Õ¦NÆúâÒ(ø4µÝî’ÈœB9/èr›w…T]iwi5gÊm¸c?/PxwaIÝEgÓì´u€û.nÝCדŊ¯m?ˆÞ "P{ÅÐ?ºb¸ŽãpÐ,1z)!Ádë’ôYÉÆâ#‹ªLJ± TË®ë‡1çŒãÖ&ÁRåc-+Ηð/)‡YIùz ÏZÀÊ¡»\¸èò!dê²ß˜ êczÏÍCN«’¬„»ïûפ6{eUX¼¹"œu7xAÑîÑ}¦ühU÷·w€q?ëR⮸[g„¨,áGztâ®Úë¨Îîl€àö€\¸¸ ½Ðie¤Fw1ÏJÇ|]í:0º•£À¸£°„ë êh×[.ä„BÝH4TNh=NycR÷_™òCkP’#ØŠÚ¼ëw’˜ö£ð*?ðuá‘:)³À91$ìõðËáû~M™5÷?åHÒ= +7Æ’§ìê*ÙÉ=8ãÚ¡{üÎ}’(¤èkkÎéú‘¼6<1_2™‹ÔßÐQó¾… ];ÊŒÇgm „û rY¢Óà€&ï3'–mFñ+ òJ«Ý¾à€e€yk9ÈÒN:ÉäE8§ Ïyˆ‘ p%é mÖ"±#wx¢/ã`'=3¢®ûs˜0XËC°lˆ­¿h+­ùi©í7ã—í¢Åsîy³Ž¾Ï3‘¬â(%zÌ øÅ>âÖb3e=3¥¼¾¿½œßa',îRãØq fÎ[ åF¶ÇìyÝýo¿ÔA+ ¢Î?ì|퟊¨èfð +:ð¿®ðÆendstream endobj -7120 0 obj << +7452 0 obj << /Type /Page -/Contents 7121 0 R -/Resources 7119 0 R +/Contents 7453 0 R +/Resources 7451 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7118 0 R +/Parent 7432 0 R >> endobj -7122 0 obj << -/D [7120 0 R /XYZ 85.039 781.388 null] +7454 0 obj << +/D [7452 0 R /XYZ 85.039 781.388 null] >> endobj -2866 0 obj << -/D [7120 0 R /XYZ 85.039 761.463 null] +2926 0 obj << +/D [7452 0 R /XYZ 85.039 761.463 null] >> endobj -7123 0 obj << -/D [7120 0 R /XYZ 85.039 741.134 null] +7455 0 obj << +/D [7452 0 R /XYZ 85.039 741.134 null] >> endobj -2870 0 obj << -/D [7120 0 R /XYZ 85.039 616.695 null] +2930 0 obj << +/D [7452 0 R /XYZ 85.039 618.816 null] >> endobj -7124 0 obj << -/D [7120 0 R /XYZ 85.039 572.945 null] +7456 0 obj << +/D [7452 0 R /XYZ 85.039 572.945 null] >> endobj -2874 0 obj << -/D [7120 0 R /XYZ 85.039 330.859 null] +2934 0 obj << +/D [7452 0 R /XYZ 85.039 330.859 null] >> endobj -7125 0 obj << -/D [7120 0 R /XYZ 85.039 296.113 null] +7457 0 obj << +/D [7452 0 R /XYZ 85.039 296.113 null] >> endobj -2878 0 obj << -/D [7120 0 R /XYZ 85.039 227.992 null] +2938 0 obj << +/D [7452 0 R /XYZ 85.039 225.871 null] >> endobj -7126 0 obj << -/D [7120 0 R /XYZ 85.039 185.707 null] +7458 0 obj << +/D [7452 0 R /XYZ 85.039 185.707 null] >> endobj -7119 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R /F62 4047 0 R >> +7451 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R /F62 4159 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7129 0 obj << -/Length 1868 +7461 0 obj << +/Length 1980 /Filter /FlateDecode >> stream -xÚ­XK“Û6 ¾ûWhr©<sùõèL;³ÏfÓìæaÏäæ •e[ÙÚHr7é¯/@²lË;mÓñ‚|-<?áÅšq•xQ,˜Šc/[¸·„•ßFÂrL,ˤÇs1ÝèÐœ%<ñf‹Í­¼Ùü“ùêüÝìúÃx¢”òUÌÆ“(ŠýéXøçwçHüóû+Z;{u +ˆ|y{3%úå›ÛëûÙtüyözt=ë”êŽÔèëèÓgîÍAû×#ÎT{O0çLÀòz*1(û]Ž¦£÷(Z <Ú5ä ÊëX{@èhÎ4ŒÚ˜”¶`I¤ü櫜曱L|KO³'Òo¶ã‰Œüªn‰òˆÛët »„ßæ5QŸÆ2öÓ†v/ª˜ÖÈ–0+¿SJò¬Òò9iņFcVJ7I34vw]ÀBewµÓt=P4Þ8l"П‰q€døs 2b<¡…™ñÜô…–e…6=›%ÝzÑИÓ”~á¬4KhM]ýÁE€V[iÍ*­óŸOK˜,k<Š–(‰l´¨ƒhQGÑ‚öAÈ©¡@*d\b¦0é>ÇáØ…–”‚ñ0ö&!&ŽÐáå¸zðúúܸä±ç UßâÈ Šƒ<y½“ŽÔq<Ï«s( Õ¹ÃèØëîz0žÌõôïÆ„Ö^—Lë`H¯#ýïóú%à-T/H˜â¨÷i.]|ØÇÔ¤)Ùð g†û[—›g‡¡w,&«)ƒZ:ËÄ0¥Ô—=Ñ<ä|`ûYç™IT“àß­+ èDûè26˜M­M!/èÿ-êÝG§GàczUŠÔy:'ÆjS:5Žw $›ŽB$ÁP”!@f‰ƒí®,é(`‚«gAY(Gr‡<2ŠÐ¶¦ÚÐ|a¡MF!€6¢RÕ¶KšãXr»BH'V+룉~ù…ÈÓw’&™ÃÓ„ƒC}Ü‘UEÞ ´bp³-ÞxÑâ%~§…¹‹Ùƈ4ëm§t߀¨+48ßKÃãû}ZƒÀÉENjð18»º {po(¤rý'îËëŸvÛ°ÎßâÚL^sºÁh -¸¿©Z¢ô…Ï«ujª0Lo¯Qgn9+‹¼ l£l~úNÙ•Í8§ÁÕ€Õ ã©„ïzà9» D/pt•^ÂF“O‹%±ìÅ––0°,Û&7BÑH:§ ÆÊâ/WFqµhi¥°ßx³Ü"?v" 43ËiRQÍaMƒ”b¹qbOÆãÕÛ»óÛûY âg!ÜI ¸ÿ*wj˜p¤Èš¨ê^÷¨»@ Ì7äÆœCq!‹óÖµi–‘·úžç›¢gò®;0™ïw±9öÂà'ç6éCiâyIÄ.ä`ÞÅ$¦JÞÊØ7àÛý°zIä)Õá^Zñ©(KÛt¾š¡u‡Dí h ùV cJ&È;ß4VŒiŬÜãX¿uî3edJE‰µE˜«Ü‚ -:ú±5WÂÁÀ:µ |I¤l×e"A"|˜}V}–­ÛhÒ’Kk3Lö’O©ˆN^²Ä”hèa¤¤ÛÒ®žãöK¤¿!¢SÙEÇvuW Ù€_f+×cÎów×Xùol#ºÉJ´f–˜üÐq/?ö{ZH5ÄÔì&CI„,æáaÎíÉ@¥#ÿÅÍ -Ê–|¯é€|YmÚz¬±‡~AÂT_X"¼Y¬°_O”j‡,Rú”cO=XŽ9¾Žà0yRŒÙÄA Í,÷‰¢®xĽ+êà}7 -XÅ¡÷½#¸Î˜^Z÷]à@é¸á¦bx²‚Dï«b€]¼aéÍò;› áìv-¼« -ÔôzšZ±“ž\j?ö.S&,„§”4êÈFžA%Ìâx¯Å˜Wrr»dº«–æ´’ír—v<á÷Ê¥‰íeºä3=ɲÇiPð¡À"lºƒÆ¶tns:,u¸žUÛMk{×)Ù^%¶°÷wŸ«ª±ÝåÂ<ë,Æ_Q½N êiÛtÈd4fGoƒD3„^/þ{laø -z×ýh¸Ã›,~vQ,a†¢‹ «S`Ю5•¡`BSo -·J,`t”ˆ%èæªÂ æ3œG¾2¯¼)í„>«ÜŽçdß,¥bRÓêv'øÀº¸¥UŠ_Ôý!ÅïƒAݵSˆ¶W[#ßּ峴¥×>61]S[5½Mu…¡ …Ö~?íŠ6|4‘<§? ìêýŒFÅ„e7zÖ_\pµpbÕ•4(Þ×¾}§ÍOù‘',âÖH¯—–áÃGwܧ=jyºî¨°Î]‘ÕUS-lêüN+4pïO,ŠKÛ,]tÿÒ˜ÖÉ´*E¶c?°I†! ݾM‡GËó–ÈAKØ©Ò™L†ß€¶ÿ?oÀ@±X%Ãêj)™NÔ6PúP_÷ß‘Ââ×…endstream +xÚ¥koÛ6ð»…°/“š!Eê5`òêšmÍÚÆÀ>´ý È²-L–ðôåÍë;ž¿üíæúvy7ÿ¼üev½°0Â%øköñ³tV ä/3)t9K¡âØÙÍŒ¯…o´³»Ùûž ¯‡©&ô\t -E™^aåO(|õû[Tîf¾Pî­ðÐd× +)½Wó…ÑÊMÊJ¹ .V{nUÒ'é+0SI2g¼ÞniÌpöZ7­„Š<+B³»iU®q$¥Z*‹¶KJf»®É†öÐîUÍ »ª¶;¯:IÚ$°hz‚åÝä¾ÍI8 ÏÄÂÄž³PhƘö>/ÐÙ [VmÆP»MÚ:êéGñ£H‘oå/Û÷|7I šÃ~_Õí„ÚèÌAG·Oð,’¶ÍjÞóaîEnÒàÀw×¢FR ¾Œ”ðgST÷sZ¢á4üäoÝ™®è€„=¢±ÔˆÃ†d,jú#[µGÁì2Þ'<ôþ&bÂ7àå!z)OÖ‡?¿à·×_zЊŒƒBV=Ý#0"€ äT°hh»ôü^¤r…Êü¯²†w²jíò2ß¡eqÀˆŸ¤2,æpA÷Hj2≠p° …¹!Ñ97è'¹AŸä°¦q¬§4UF +/·…úCŒ§ß¯2úO !flõç9¿Å0}Á’Æm¶IÝ…Ùp%œa0Þè$'j +/Æœ¥Ž9q®0÷uµÎ‹ì3ù¸y÷>h§ðý‘?gÙŒâ3K3A’ÖY‚I±wIóçˆ\Ri|"Yåu–¶UýøU8¦²;=›b†´e5A "®x¹*‹Ç ü‘Ïú"#ð$%"¥¦kíÂÿTßVꋆr®_Ïå]Ä÷©+i0ÓkßPf$ Ý¢‡5ŒxxÃpnç(‰cF§À×?r,+Šÿ‹ìIù…ùÞ½ƒEgÓ"ÏJD³\ÒjŸw" w±Œ)7d)þ£ÚïÃزF8²‡Â~çØÜ\ ý9—Y£]ˆ ºê<Õ}ãwUÚ¢š¹÷ê|ô¸Ïé2VÃáDËhäcð]åÔ0)ÍF=ªŒBÓ¡íx0ÔŒz“ÌîMÇÑä›2[±ŠTmaeÔÇMèª=%¤ÿ‡¶f ­m‡ ûÒ‹†ÙéMV¦¤õ+NÖ|Ö@áþ°äqל  p¦LÜØBºÊÊ>JV¶¨öÔé‰îì½PHÈ(ÃÅcgÒ&¹'ã—›Îv“­H/½¯hÅáõtO;'Ô?ŠG!<à2µOp •Ý‰míÁþT¹âÞ"äÜÓ6·Ý(*ðô­Óe Û|±¥ÅD³‡6-b§il/®¡O&?ÁouÚ}ÈêǾiOÔÙqºÊˆ8­sL&œ~šô/‡iR¯8b(¿¦¨Èg<ŽáäÐËÑtØÝÓ®ÉÌi{P4æð? +ËgËüž[ekbZXÜs”÷ò·‰ô°î]¯KoàmÇÜØ÷·Œ1(LµÝ¢°á‹>»-æeZúûEóƒõµxT˜ØSãá ±oæÓÁi=ÍD#Ž™ÈÝOJ›×ó0 òžLÿ¸rY•pT0®Šïìýk ±'à¢lùýtÒQ_„^ˆþqðbc¥@Ó/›ÐîÅþÿ¨÷Ðç*Pþ™zF ™÷,"’À†!‹=æâCÇà>4…ªï UÐcþ:ö ·ñDS‰Wu4]°¿HûjZÀ$瑈&Învʹª@"ç(”Ž…‡ôQ,M¶3örêùSðF¾A8ÄC;³KáXm¦Ë)G†1¡?l³’¡C“—–43÷”,W<ÆHÃoÚÝù¹š¡a2f éšR:úXÙÚ½+âp0ãÄåEÈ€§a¸­šÖ–ê¡lP^U»n«Ü–‹ÁÓC3yYÒð”ÏÔ%¾oq|=!tž‹þ%åë=îÁ"‚>uU6ŠÍs-±õ§ïÁ´ÚÃÓ‡»T Œ‡gG®ÌMAéà%¡«ñ½¦¿îNl¨Cp.ïåîùf Ìb}'–¶ Ýv©éÃ.dô†Pd»N˜Lù ©úÐó4iÉ×IÒ;UÕ ˆjr%¨žvüã + N:mX½]òWýžÑIÎúÏÎIÚÄ>ß4¶#1nìÆ«‰¸¶žI'„SõÆ®½øÜпa=x›§uÕTkëÖ¿–ÝóÀÃèÝ‹ÄÆ–‹þ!…Z 4J›§#ôoW‘’ž¿¦^ùºUÈÒT=ísGm¿áÅÜHECË=o'(S'j§ÿfTãendstream endobj -7128 0 obj << +7460 0 obj << /Type /Page -/Contents 7129 0 R -/Resources 7127 0 R +/Contents 7461 0 R +/Resources 7459 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7118 0 R -/Annots [ 7134 0 R ] +/Parent 7432 0 R +/Annots [ 7463 0 R 7467 0 R ] >> endobj -7134 0 obj << +7463 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [84.043 693.19 150.733 704.879] +/Subtype /Link +/A << /S /GoTo /D (minimalprofile) >> +>> endobj +7467 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [84.043 206.584 267.036 218.274] +/Rect [84.043 195.625 270.066 207.315] /Subtype/Link/A<> >> endobj -7130 0 obj << -/D [7128 0 R /XYZ 85.039 781.388 null] +7462 0 obj << +/D [7460 0 R /XYZ 85.039 781.388 null] >> endobj -7131 0 obj << -/D [7128 0 R /XYZ 300.917 698.964 null] +7464 0 obj << +/D [7460 0 R /XYZ 85.039 679.441 null] >> endobj -7132 0 obj << -/D [7128 0 R /XYZ 85.039 576.494 null] +7465 0 obj << +/D [7460 0 R /XYZ 296.675 685.415 null] >> endobj -2882 0 obj << -/D [7128 0 R /XYZ 85.039 285.661 null] +2942 0 obj << +/D [7460 0 R /XYZ 85.039 274.702 null] >> endobj -7133 0 obj << -/D [7128 0 R /XYZ 85.039 250.349 null] +7466 0 obj << +/D [7460 0 R /XYZ 85.039 239.391 null] >> endobj -7127 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F41 2994 0 R /F58 3360 0 R /F38 2997 0 R /F64 4112 0 R /F18 4115 0 R /F20 2961 0 R >> -/XObject << /Im1 4096 0 R >> +7459 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R /F41 3054 0 R /F59 3455 0 R /F38 3057 0 R /F64 4225 0 R /F18 4228 0 R /F20 3021 0 R >> +/XObject << /Im1 4209 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7137 0 obj << -/Length 2311 +7470 0 obj << +/Length 2374 /Filter /FlateDecode >> stream -xڥɎã6ö^_ᣠĊ(j=äît•¤«3(A’Ë’m¥dÉ‘ä®ñßÏÛ(Ѷœ9 X\ß¾P-ø©EûÎi¦|e‹Íá!Xì`çト(Ö~E0žÙ\ÙÝUúA”ÎÂÈ«T徎¼[?|ûc,ÂÀO½Xo-!IøY/ÖÅïžÎýå*ŽïÙ–Ê{1Ë•NRï×¥V^Ù-WÊÛ¶8î¦Ù”¼¹^æ¡wjp³‚3Ínùçú§‡ë‘{OšøY2Ko°X…Ú×iøÌ$Àx”Ç.3*ö—™0¯²Ì(d'ʽ÷íáhˆðªo›þ…@DÈÒºOÄCD¨x¡?r‡ˆ8Ë|æDÄzbJ3ïdB SïG¼Ø—(¶îë2ÌH¾:M½/ö ±~ÿ+/­|Mýê®dÞ°„rËÖ0¯I³ so@!üzל1êjˈθޞxÝt¶¡;‹J/.dË<ÕÀKÇå -Ø,»m‹¸Ì ˆõ¬ÐxY4oÄ5\/WQ 'B¢ òú=Œ`¯à½®4u}æ1q‰*Z£ &:>‰tâ÷K]»ëÌ¡—½ ™—dÐ#NsÙ1·ˆ(Ú´5ˆ0‰áxá¡íå> ­¨Pèç. òôu ‡MU›—Z¤«íB. ¼` ½?!ë8  iúm)ûÌŽˆ„a;ÓÉÊräE‹Ø4­µ ¯'_L_<|þôŽ$•Ò¨où S?È™¿GT~œ9Fç¬ZÓàÿÀÛd;°3”„RVÍÎTM/“žµJ´•ìÔÕ«Ø -¢0¼ø´æ)ñß/hˆ_v®Òq,¼zä¼¹!9óÞ*´BíEeÓ–ø‰êA‰åœ¢é<›—›"Ž×x &mÃß²ºTB4Ѧ!ö²W±"ÅHx…ïeÜ㌠v±*ÐDäÞz+àžX,bôÌ“7 MåȾ:Y$c0ˆD ˆfàpÆa§lE6¬Ë®êoÅuíal´q`oÃk7HÕ^ŒWÜä©Þ}ø÷#€*kÕb¶›–‚ ú½‘HOë´:2 àbóª1{i]¡š/M=#’?–MÙ¡šáÏŸÄ 1Å X8'ndJÊ!·…s·É€ÂÕLؤ¾:@ìè¬|[Ë;£“Ã#‡HIœ¾1ÀeìÄ£–m0ŒÍ¸$¶=+Žâ¸DpŽ"j öÀ¢üûT Sp3üAö*‘õÖôƒÁ=ýˆÂøF4Y,ÄÝÞ‘ËYý¹Ÿ­RŽk)¬8d6°VŠVnµŠ£ q}¶¦7”‡9x.…ƒ KÇö–öˆ¡HÉnøˆtBDµ@l(o~Ù6@í::c›Ñ *6.öâ$ž‰06?š†â¿8!€ZB O¹¶…9Ö¶l(·î|Ó„µ8§xbÜs507y*œä“rVb$o^ÈF…¶ŠWê"¢ÂÆÚJd]Yüå0L}„²>Ô’é+‰ -„Þ‚„¶a:p`QX^6q¥œ3Ú[}¶dcQQ¢úfF|¶·¨'e‹Ïö,7ßj‰l§&§.çÒìš{2`w45G”Q Äo$sV.clÇ=†Ûòw1ŽŠô7m#»îTN”Õa~4»’G§¬MW9>!wR‰$•ι봚dq C½P@&[0讚rvk»ÒêmªcÌÄø½"uH¹;ÎëÌ:%ø9aba`Ü󜊓Ý^Ú\!ÇÅÁÁ¼Žu 9~^ªé¶±î·[ç$RZþ^_¸0Sù:ž…Lœ“ÒNBÐnbòÖ '™cîMCÝà— ñŠF)*zð¢ä~ÃÀŠEºÿ5:¤lR'ß«#}¢ÆGbGÒuSPƒ#l†Û[ÁÃþ àN… Ëw‹Ùrì Šü¾®To…R‹öM-åŽSf’Ô_ï¶(ü?r£M1ð^%5•g¾Æ¥?J)‡þýðûŸÁ¢€ôöÓCàk°à7¾‚ëÚ!µñ¬~x~ø×”þ,®•ƒì6†òcÈÖ9zúüàô—ï—™ö~cb©ŒlÙˆÌ44Ð\YaQž½ÆÆ,bŸÇ/›ì˜2\\\‚:’êÙpk¹‚ÞÈiÈJK|WEE¬”JH{®ù…HåøødQ¬±†buŠUó+Wx÷ÉÐ3 U\¶,¸Ð]ZYÛ R›ž ÕG TðÌl,Á 7Yô¼ô#±/!WVE -4¹Paèçaþ… Z9¸nmÚ° =^8k@nAžôR——ñù‡_ÝgÎâIŠ3,à™i‹.«•LÊ*€5<½-£a±ÀÓNžÀ “ÇSÉ¢«îŠ0èäXÓ­F\¶ùtªéôЋbâÉÖ–aJ—~a*ùŠ}Ðö\×ø©²Üvmßn‡ñµñÛGypì#Ä„ôè}mÓê\Ù_6Åø4ˆÕÆFž8¿Ç3ïâç‹ô8WW>›‡-«ï—×òÖt ý$´Èahá¯/ŒuFÖv÷Æÿ×ÊKendstream +xڥɎÛFö®¯Ð‘Z4«Šëa±'6:3n{Ѓ$‡EIœ¦H…¤Üé¿Ÿ·ImpATõêÕ«·/l5àOÍÓÈL6ORå›4ç‡Y0ßÁɧ™Œ02~†°¾q¸t§ËXûA˜Ü æK“úaãáûÕìÝGÌuàDZ™¯¶„´Úüâ™Ì_,£(ðžía¡¼µ],Mœx_FyE»X*oÛàº=Ø:/øpµÈ´wªñ°„;õnñÛê§Ù«éÛ¡¨ô_Úø&Ñ÷?ŒÃ)Ó*ôM_0­í0ó>4‡£%Ë®©»œh?Éî)(ò•ÒÃ[*š«ÀÏ‚lúÖjR'©÷ ¢‚Žtâ­qÅÀ®@-´ß:%u™$ñN ìcõá+ƒûF~mõ2…¤^¿‚òJŽW+Ø—D¤^èÌëQVÀ_íñ™“FÕo™Ð›Ãm;RëÛ7±ÐÙƒÌ`qE§ìt\€@žmƒ´, hu¦Ðó2RÍ+IM #Ç‹efÒ• <¯9Uµ…­ª7^ç ?¢B[ä'&àŒ˜…ýyhv­=t è÷VPHÓ ’EgN4¼ +7Û KySã “Âù¡!þú±M‰‚¼ÝÕ¢TßQìÙ²²ëJtl þ€Zƒ…ñ~ Tg• öˆhën[ȹ+pØ[Âê@jp©?2жuã|dÜ\®mWlxûüù=/HÂÂy¨ïDƒ0 2í­N g2´mïûñ1ÙÙ»jw¶¬Ê °®9ñX’ó”œúE\Æ„¨ +~êiÅ$üþL7 ¢¾vŒ‹ZÎi›—)þtìäÕ³P|à{àõ¹t7ܸ÷ɼ½X™yÔ 'džd´k1)[w§ž×«ˆ÷•7MÍ¿Eyf19Ê«…w{Þ7‚#Bâ·!ØpžšÀû2%ª@¶öIGƒ"¥ƒE‹¾ñf¹( ¿¹æ¨çÍÉÙ”Œ±»ìÄM/ñ R¸½a§DÂ3Ž“1Ù½ ¢À=…oæÈå^Ü\ê©èßãùpþïG¸¡\ˆ³Ÿ¥®'(ÙTøƒ¸áÅ +Òç°®Ê )v )Iú©¨‹ÖVœRã]«7½Lt¨d ÿzÃíx€¥®b­ÅíÑñÂF„ô™ЕH6¬Äpη˜ª‡¡ÜB#Ž;M6äI¬¡á©bƒ>áýØO &öŽH 7¸dUþ~‚Œ=dCË?¥èzk»~’òj^=}|æšA–¬ú}ƒæßížÛ“Ç)7ÈA#´œ%†dH²¼ i© G¸eÚçBò…­0¢'fsÄGÀž› ˆ@ô”¦– •lhC¦Þ‡ðõÈtÏ–qA‡9 1®Z +Z’×O͘ª + l¬IspS’@¬Ÿ)ÍOâ$8XùŒûȺ»ã®*fbX;i` {ë¤é1¤#Ô'eÎõ>[™p*×£¡!tJ´X¢!싶c<ôž½Ü!5mG-O"ÛHvHS/Î]ɹ|;šÝn,S ú`ÞSý€u)ïÖ”n¨dŸaà2oÛaãZʮΫ0âvo×ÇKäºçCêRp±§˜Þ°Tè‘Ø`w@ØàyéæóAüBÐû™,3HœÊÚ’ÂØñ;ðÔù7¤ý$ï eà×åØ$È(º7­“m ‰ãº!ÖWy‰ä\ zn¨T v‡ ¬Ó1„ȱú²/'ß"¿ü©ý¿ƒÍ«Fú=S¼h³ 5\Ž AêëðÞ¤ 3ßÄê»S‰–©ä{%(f/4Fõ<6}9öåÝ%ý‹3J+³™ø{TOì϶|Ðl¯“‚ŒväîLØm0¡!Çìw&N9R­œç”ÉÒçžÌ +;Tÿ!<ÊýyœÜ¨"nÀ ÷Ï]*Â÷·BQ†NéoÙè7òØå$e ûMsžÈnõÁ<¨øŽJà`PIÇûQ°¹ŽA+WØ>J&£¢ï‡~l¢†èÊ“¨d `-îఢȒÓóP «JûúND¾QFhyùÎwõ©ä¤ñác}œ:Ö¨Ç$ךvý—Ý¿V©eßs0Š/ßÐ&ô³èâŸGî÷ö)oÜendstream endobj -7136 0 obj << +7469 0 obj << /Type /Page -/Contents 7137 0 R -/Resources 7135 0 R +/Contents 7470 0 R +/Resources 7468 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7118 0 R +/Parent 7432 0 R >> endobj -7138 0 obj << -/D [7136 0 R /XYZ 85.039 781.388 null] +7471 0 obj << +/D [7469 0 R /XYZ 85.039 781.388 null] >> endobj -2886 0 obj << -/D [7136 0 R /XYZ 85.039 761.463 null] +2946 0 obj << +/D [7469 0 R /XYZ 85.039 761.463 null] >> endobj -3170 0 obj << -/D [7136 0 R /XYZ 85.039 653.495 null] +3262 0 obj << +/D [7469 0 R /XYZ 85.039 653.495 null] >> endobj -2890 0 obj << -/D [7136 0 R /XYZ 85.039 653.495 null] +2950 0 obj << +/D [7469 0 R /XYZ 85.039 653.495 null] >> endobj -7139 0 obj << -/D [7136 0 R /XYZ 85.039 612.438 null] +7472 0 obj << +/D [7469 0 R /XYZ 85.039 612.438 null] >> endobj -2894 0 obj << -/D [7136 0 R /XYZ 85.039 379.88 null] +2954 0 obj << +/D [7469 0 R /XYZ 85.039 379.88 null] >> endobj -7140 0 obj << -/D [7136 0 R /XYZ 85.039 336.927 null] +7473 0 obj << +/D [7469 0 R /XYZ 85.039 336.927 null] >> endobj -7135 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +7468 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R /F35 3036 0 R /F58 3380 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7143 0 obj << -/Length 2570 +7476 0 obj << +/Length 2788 /Filter /FlateDecode >> stream -xÚ¥Ërã6òî¯Ðm©”Å|‰<Ú©IvRëÙìØ[•T’,QË|($5²òõÛ/€E鲕 l4ýîFGÍøOͲÄ¢|¶Ì”eÙlUß³-ìüt§c!( çñåîû“t¦?òÙËf¤“øqÍ^Ö¿{?üóá——O_ç‹(Š¼(÷ç‹å2óžçÊ{xz|@pìý_Ÿ¾þ83ïß_ŸpëËóÀøÔË¿|þòÓüÏ—Ÿï>½XŽì]p{Žìüu÷ûŸÁl ¬ÿ|øQžÍŽ°|Ûõðã'q$ßÕÝóÝ,)Þ‹g|jJzƒ±P¹Ÿ‡Ém ¥ÊÓÈj(„ÝØâÔÕPøI“†@)¨%‰sïk¡× sºôúÔð7*¡¸&¸¸ÉʈC¬¨dÂX*ôÓ€õ²+æ‹x¹ôÚýP¶ ®S¯#¦Ú—Â}é?X =‚2o¦™DæµhÎoø§è*½gZí†Ï®±ìñ웹?4 üý±C”À=:–ÃŽWÍœ¸Pp!Ð?⟶{ã½ÎìCu -1Ðu7~Þ bA_ ¶MH~ Ïâp¼Fìö/°ð»ÖƒæÕë|B–ÈÔ–ÏÈ„núMÑuÅšÑʆ{âB£«sªiÏO¼Xu­›uÏ?‚$ (²ô™»ê$øôxÄ}Ñà½+gœ“ ÏeˆäªæW”$Æ×¼&Ðø¯x&MÃÝ -öò€¬‡¿•î¶EÇkRŸnä}Á`}›'©§«Cá Ò• ßDrãÙ«èD= C/½b[6B xëf{N.ÌyšæRf!ƒl©íHÕ¨—ÞN÷ èŠa•ÌÅš·Å4 „][7ɼ½^Íì¡ -¥M×Ö¼kÖMa¼â móvaŠtŒ=Ĺi¥{oðÅ>² 0 â¹å¹)ü–<µçÔëªsíÐÊ/ò€×B ‘¦4ŠgtU*|0hþ G*àËtŽS®X•¸Z—ý›o$ —~ç’³Èɲà"ã(oo‚·-ï$TÈ{º‰?‰ÀVi”Å÷¸N<Œ’ƒE'ï8ñhgPÆCDþ]DîÊZT¾ ¹â!ëºqdÈd2ÜF>ÛF(žLVÀ --W’¡èê²ïGm\šJ1ÚœœËE«Qj1¶Ž‡{åઅÄTc=¥:1Ú°ÓƒY‰ò$M8¸ê5L†P„)¸í{ÈÖ†¾¨f ‚¢ õ§ž=¢5U°Å'e³Ó<‹<(Óqš{—UÚµ9úÇ… „¤I¥¼4žÉVmK)–E/pªu%zBÅЕ>ôâÚdBèβ#$¸–R‘ƒ#˜lTpß`ôàCc“èJB_w%(*‹=ÿJw—Äð¨›ÝƒsµÑLT⧶ό¥Ï|ÒïÜf¾×Ô#\c‚ßäÁ¢\m0¡)ó—;óƒé¤$˜Awzö†J’n¬ª²hDãÝtÈô’Rð Õî¶J2âMŽ›w!°Ø,b nL‹X—†«òïÂSÊ¥Ig¸[ÙP¤®©B†s§A†¯v3ÎM¡»J|ý¢ ¦#‹ ݬ ß#¶IplXcH¿aT'ZÇkøƒ»„ q8âÖïg"#e–Wœ‡å̳¦ÌýªùSbVgªW‡ã£8SaÍÕÑZ“¯)ô5JM -_¨<Ψ*¥¾ÙĈ¿jLô(z”{_ZºW-MÚìê>ÂÌ/K ‘JQÍ€Ñ.tý†)Pûdøë`Výм”´¤r2Õ^²ÒB*Så÷ýôHvàͦ•…mZÓìš“âÖÈ:ÒÇ¿£ûÈ7šõ#m7aÙãLÄõC%‡¡÷‚‡ª†xî“:æ í8p²r/M_âfX×#©Ó¤²pÞ4°Ôåø”ÉØ‚xIjGK{èzC®”UU‚‡N5!Ÿ17@M[RWøX:[þ•‚SÝCN‡B0ð±Æé!V×4HXjÎ9´iÜ%–jN¿BOêW‘òÕÆ0Ï!†éâ…)g2Y@Ò”TO|šxcÓ±1ÐÕÇ9ìdæSÙþ±$ÿ×ÿ¯³9 ÒUåÓ)- C?T†Ô\-?ò›D™ŸdÑ%Ãÿê endstream +xÚ¥Y[Û6~Ÿ_áGˆUQ¢nû0S¤Ý)š´;3 tÑöc˶0º8’gúë÷ÜHɶr‚1EžûùÈQ‹þ©EûA”/ÒLùQ–-ÖõM°ØÁÊÏ7J(‚…öƒ$Æ¥»§›~Š“… +ü<ÈO["yÚüéýøïÛߟÞ>,WQyQî/WišyKåݾ»»Åiíý_o~Z†™÷ÛÃ;\zÿãrs¼ëé¿ïïßÿ¼üûé—›·O“ÓWÚ×I„Ǹùóï`± ¹ ü(Ï'¾ÊóE}£ãÈu$ßÕÍãÍ^Ó Þ5£äÊR¬Tîça™w0k4Ò ‘ +§m×Ö’¤+¯Ã ¢Ã?hGÎ䤵a«œg‘u•ÙKÞ¦0]%‘€ÑM¹‹¼¢0÷Ö€ë(ŒÈ<=ƽŽ¼ÿaPܹ0køƒ»þÀŒ8ya@ªc&¹p!g–G\aeÏ£¡šüløS2FSË—KØ°ýh!¸m•öèk‡œejÁ‡¾ø4ï‡8ðÓÄ:O +–Ø0#¤L¢éûq ¬ãêgÝ6ÛÆ]aì3zߢ:a¦Fkà9#(…¹‚8"Ù Æ…>Vó&3ü…í{ñ¸+>8hÛýÌÁHmÈeÏFî":ôƒ,>‹ ñN”:p°êGà@`pxýÒÊX:hÊõD§ˆ˜„F”MàÆíµü<q2»–Ègèñô…Ý" ÷²sa. õLœŠ;õ^ ˜=d,ÐÓ'(J]å_ìԯظ~zÍjO§íD=øQ9Ð@k»Üc-„ö8B—ž'À¯ô.M-¥¦k+~âÁ¿VŸ³&Q)Á‚I6Âô+ü¤%rC*Ÿ-‚†ìÂÉú¶¶× øb£á±ÖhP\zÞVKóžpçºÎð¿¾îäô4 ؽµÒöJ#¼Z«òê&¯ÆîR]Û`xžnè%b’¥ÞVÏîÕÞ] †ä Yö‡¥Š³Tf!žñ¨”µ0…Ëä<øå:íªe!òOïúsÑ} kÌsUÔö…B¨»@\·ý˜ó}áâO¢™ªZ +¶•ìŒF0Ù”]{ »rÛÌ‘0ñóX‰ˆüÚbßHï×âcQÍœúiþ™£¢ØWê+Èäï á°…Öô¯H¯/’(8°ÉÏΩx… Õòä †]O Ï´¿n* ýñX?>öûBxÙW£äLÈ4]jal¶TNpXðÌž¿Úi]¢*±ý4Ç›});®3umo©’JüñáXÚ+1¶ɦ/Geæ `Jçß—_ÉÕ[ñƒYÒ;ÅW~øõçâ¼ùI˜]½wæ4ïB'åàÝŒåërGÒ.½­ê»†^Ö`rà'º(Ò|ç¥_©`5a]~lÁæ—BunÝãת,Û¬_y F +ö^áÄj  ­p{Û§¿CÄr ]¥‰¯ FÖg|˜LséÍ’8!áDz`–Úæ€kCËhÐ8B—Gz—bâŽk:Aâ• s%ìÜåúümh¾Üâ! 3 +Èm¬wG +è&ÚÂÉ×þ&ñ·âûKxo*~‹†Þ¨ü4¼„»ƒ¼•ÃÕ3âô)Rjè}ss ó6¶>b±‚Î8Ì¢1z¾Ë¤Ð×ô¢–O[¬û¼Ä‰²¶‘à„¡u Žù=kÃíe¦I¤9ôºøÛ³HçÖŠh¯,7ûá8ž:¾#ÂM“óŠxò]áÞ13—ÓÛw”Íá6ªóÜ'¢Ð‡à›6Šcï:†ù=qŠ€žE®.•Ó—e¸Ø/µló’ ·‘7šÎ:Ä>ÛÓ¡ì]Ù½pû#å\2öÌ0ƒž íV®¸v†ôB€”ƒløegÆ« +QJøí©‘E¶6þ‹Y7¶D$’º × +‘á´çË#àspM†wð½yTŠ> endobj -7144 0 obj << -/D [7142 0 R /XYZ 85.039 781.388 null] +7477 0 obj << +/D [7475 0 R /XYZ 85.039 781.388 null] >> endobj -2898 0 obj << -/D [7142 0 R /XYZ 85.039 761.463 null] +2958 0 obj << +/D [7475 0 R /XYZ 85.039 761.463 null] >> endobj -7145 0 obj << -/D [7142 0 R /XYZ 85.039 739.701 null] +7478 0 obj << +/D [7475 0 R /XYZ 85.039 739.701 null] >> endobj -2902 0 obj << -/D [7142 0 R /XYZ 85.039 545.001 null] +2962 0 obj << +/D [7475 0 R /XYZ 85.039 545.001 null] >> endobj -7146 0 obj << -/D [7142 0 R /XYZ 85.039 504.837 null] +7479 0 obj << +/D [7475 0 R /XYZ 85.039 504.837 null] >> endobj -2906 0 obj << -/D [7142 0 R /XYZ 85.039 323.686 null] +2966 0 obj << +/D [7475 0 R /XYZ 85.039 350.785 null] >> endobj -7147 0 obj << -/D [7142 0 R /XYZ 85.039 280.733 null] +7480 0 obj << +/D [7475 0 R /XYZ 85.039 307.831 null] >> endobj -2910 0 obj << -/D [7142 0 R /XYZ 85.039 210.765 null] +2970 0 obj << +/D [7475 0 R /XYZ 85.039 237.864 null] >> endobj -7148 0 obj << -/D [7142 0 R /XYZ 85.039 170.601 null] +7481 0 obj << +/D [7475 0 R /XYZ 85.039 197.7 null] >> endobj -7141 0 obj << -/Font << /F56 3226 0 R /F20 2961 0 R /F15 2972 0 R >> +7474 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7151 0 obj << -/Length 2646 +7485 0 obj << +/Length 2553 /Filter /FlateDecode >> stream -xÚ¥YIsÛF¾ëWð¨b"@7ÖÃdÅv”²%Ä”Råø‘ ‰JÖüúy[7À5‡”JÅ^Þë~ýú{[ßxðçO’Ðõt:‰ßÕI2™WÞd3Ÿ.|¡˜ -ÉtDó~vñËÇ0šøž›zéd¶Ö Ý Ô“Ùâ›sýÛÕ×Ù‡ûË©ÖÚÑ©{9ãÄy¸ô«/ï¯p8p¾BïÃýÇK•8w÷_pêöúr -cÌ5ûãöæöÓå÷ÙïfV"»잢8ÿ½øöÝ›,@ôß/Ô‰&úðø~xäø¡ç†^@Çhà ~ê¼ááš-wªbµÆ~ÏÝN\<ã@ÊszaêÛ7n´@‘£F²Å0!Ç+sü‹‡knx$öPwÈšËâ¯käí¹CíÍærªb'¯;lê]™}ØŽ—Ï{Þ¨á®3<ç¦?~°FÈ–YÞá=‚R§>ê<%%µY3,%#¢iùêé@=ey¾ÎçHÕó¬(´rŠvI¢U¤.ä'Žœ$ œ»µýÆ+öF­]_Ô+^ežÕÜhó¬,߸Ýçeéž Ÿl‚óF3ÐjÌ®¢j¢$…_F ØI ƒ~œÇKí9-ê§GÝD1^^¾öA³ÇE2KiDsÈQ軾V$Òl Û ´W+ öZƒBì4r殳¾@, Á¢c’…Uy±ªóO"Þñ÷ Ø *H™ ', -ÛUÁøX¼ƒá01Øšâ`I{ѲöÂߘ0”¼§o$?.¬ï ‡ -BçêN;&~!@Ã5¨Ôs*RÀwæhk6B„&2¨Ô§ª ±Œ„ÝOµa*Ü]Æ‹þ6g½g:²'¢XÆ,èJ³ -7~"§ÀRFاt²%¡1‹¹7­ì¹Dyå4¨ÖŠ-^&ÆûÅY¹Š¦ÎÊ–üZôk6™BlôiÐ2âƘ™½¬ì©D0)kÛ'(]¶-{×ì¦b×KSq®ÚDÁ-°êi <1 ²¡È¢iH`0nº¯æê Èaьκ¯˜nYú5¹h‘gj+ÐVŠ™¾w´â¢„Ðè<³.V"LUƒØ°vÑ àèPçtY½÷ÙÓ^øRskîã#Œ7QÑY1¢9éÄB ‘? -Kĉ=€*É_‘ûܬ -ˆ5'$ÑÊâð¼$ÍIߤ±Fœƒ<”d’ äÀÓä0Xêfm.²jºÞ´ÉúÿožØVÈÉoá/Œ­el“ut«ÄÜ´èá<5ÜdŽsÏrpœ ƒ²¢P9×µ’õ…÷EŒ›œm‘:›÷ÅPyˆ”LB·\ibïRò諱ÕRŠjÓ’)¼˜Ebçš…ìXøã÷ h€\ð|,ÑœDV #°{m• -²®K”4¯{†V¿­Gžæ„DZ»ÚÓç%hN" rEÈ%9:Þ-­õ£É+ŽX«€½®Dš^ðôýN¾¯bº¹¤+4iã Îôp¥cNJU`A¡x’²ÈkJ¼(Íñ9ZÓºv†ûy¡g>öóYÅ"Â} Ï#]낽_Ç;Œy/ÌО§c±Í¯ZÊ7ìãc¬Š‡“Á :ͲÏk·!Ð Ý–÷‚§0ƒÓô½DiZc†íë¯Üá -I]öçGr¿8Œœë±ÆÎ3¯Ð¯E†NrKö”6õU 6†à0п6Ûî˜;¶ÿ ÚÜ¢¯}ð’ÁDÇ>aPÆSíjÂû& õtD~Êý5Éïa^8OÛqV“Ý+çN#IóõHÚ=)U¨Ü8ŠÇRØ‹¡9/ÛþJ(Û)¡ÃÀþÆ_ŒhNú 0וñ Œ„¢¬"}€³ì@.ÅÐZR€¢Ôº¢P:Ï æßÆR£ÈYlef¹ÀŠë†Ñüy[ç婃)(/uþ`ÍI·£àWÅt®ß -Ü[ídˆœFÔˆy“Î RhLé·%;C|‹àÊù$÷/)+ÓQ “•IC`¬³©ò˨¢#2F4ºL¹”«Ü$iîÙÄdGª®"+#EEÔi.‹=Ù=k“SwÆë£à*J%ù× -ý‡Ç6í‰ÇÿA5ƒr¡€§Þj¤S³©ïñr4¿åxå®ò¦SËgZÏ“`8 ”r®P-ÈÆu9§–(Ð ¯MoŠs{eÉ“LB#rpÔOçÞ’êÛ§ˆ »gœtgµM³A¨%s É'¦iG~€Ï9º)š¥LÏFkP&@ -¸ü^¢ 8^i ¸`rÊ°|&kañn¼4k¯Å圛¥ð ²O[p±àK}á ¸=T¡R…)‹È£ô­X ?Ɉ$jô”á§|5ž¹šx¸ô=•ÊË~¾ºåq[ŽÁàè…„èpMµÙÚ ¡åð‚œŽÇ˜âÑŸ™ó‘Ò‡•çyU [žóy—+4¯<¶:=R¾®!Ñ¥ ”: \»•ˆGèOÅίÅËŸØJ¸ˆæûyÇT;iôñ—þ:HÍd”e0vDŽÞÆäŠ^ð‚2nƒ‚]–཭›6A-gÍ47üCºÏºÃÜdÏ÷uЂÑÊSî:Þq¯\ZIrŽ³f?ê˜ -ÓÔ* œ§­Àækë Ci -ÛK‘ËË–ÓÄÿñ@$ N$“Dh6ëº7LßS&bòC¤¯*·‘LrR›0¼°¯¡ ?¢GÚùÈ`ÞýÄeY/y'ßAÔv²@vÉÃÌC% Ñ[GóTŽ¢o»Á5‡yp·mYºI¦ÇïP¿^xGÎΤã¶ÔèržCì­›®7² n5þÄÎì=w)ñ´/²>ãþèË÷ h„ž÷3·¶öë&ºÈþ F­»M8ðvL};ûåϯ߹̀ÆÕå‰ -™K9GI‘mð™¤(H*]1Á8»GsT¾d¶'*ÏUG-þYQÿè«Ýè±ÆMFfµƒÝPAâYðbÀŸíËk¾îüW?Ûáendstream +xÚµÛrÛ¸õÝ_¡ö¥ÔÔâxë›ã\êm⸶v²3Ih‰–8¦H/IYñ~}Ï eÑIÛmÇ3&€œûÒz’„¾2é$N´o’d²Øœ¨É + ïN´ìPë«(DЫùÉOoÃh¢•Ÿªt2¿£-óågïüïgWó7×Ó™1Æ3©?ÅqâÝLµwöáÕ.[ï +fo®ßNƒÄûxýA—çÓ¬ñ©ù/——ï¦_ç?Ÿ¼™nŸYßF¯ÿíäóW5Y…?Ÿ(ߤÉdcåë4lNlhüЙ—'7'ÿì±0ÌNøÔ“3·c¦S? ÂqAÌñ0íEÀ²õ†¢îcà?´©÷ij”×Àj—“Qì]g¸´s\Ž\ab­î¯Ðሴçë1€.’40¾ÒV¶ìšï ƒÐk²ï>ÀÆ~¹ÝõÃtÄ^Žêh€Ü¬+ê +(Nb¯hñ›xKX&x[¬*7^òž®æï­Ã‚2AP?t°½Øà~Åï8È—§Ó™UÊ+k´‡®Íʬ˫Åû¼”9wŽ.â ‘;‚¦T{ ñHÅÞr:™%ÊâôJ ‰Ã–y{ÄÛò[ím2œ=ñd1|kÀ¼ÀjoU^Uw¼±Ý>À®Þ…DÉzÑKA˜zka oÂKåNfÕ’ÞdÜfŽ˜{Ú×òµ/Ýr“cÕ›0ô#0ÌW÷xtÜëžôSWYyÊÒ³Zûq±ølÊ8‹nÍ~Ztü½Ý› ªµZñ2- F²Û2_º­,g÷vt‡{¶eçÓ¥`ùAì+ðN¼í¦Þ ¢CK¯˜¢7»ÖÁÞP‘½à†åˆxtøFëÿÀ5‚^˜­³P27¾«[“qƒ‡Wu³ÉJ^E¼ŽÂS\²H2ƒˆ~á„VY+>!úzËË,íœl[ÈÁŽL”ô¤ãÔã5õÂʪUÎa·£»[žÔhU½ËÇÚ$òŠ_ˆ~Aê›Hÿ0ú%ýn@rF#ùÞ׫¢jG® ü8I_¸Ñ„¾ÖÁ÷ƒáMI (LXe<šÓe4Íš\å¦n;7&ÿÌðØKØ*Kƹ•íèøô…µµ¬=d-é‚×ÍWƒ½ÐIõ „ÝèìŠ -c€ +ï:O¦¼ürï°"±€Ÿ®P“-ºbövlâêÀ ÎчV^æy9bçûc®xEQ–âà›‡†éH$v9Cb?oÇ Ç¾ÕæeÃQaòCÃIÅpÎK¼(¯:¶œù4­T(Ñÿ½õ|¼“ìŒA ¸ÓÀeŸ“,Óç:³l ¶mxßa™œ½¥x3¤u OR– l¯pªY”E^¡Œ! Î,ÄwL팷‡ðü‹ +ÒZ7<Ï¿e&Q{¥œùDvµä€Õò Ã3Ÿ¦ „€æ~æBîÀdV Ä @×ÂEh1ñž5k"¯¾ƒäÌë}ä·ÈÃSFzazîé:©)ÇÇçW<áÜ–7wœs9ÁoäJÍ—çXH†‘w>ô®Ø»g ÝZhhsÚ-q­åź:؃-‡!DJvÛvD{‘K´q>³8ùªC—«À´Ò¬&<¸~÷c;_g½¹5R,'§âÎéàD¤ ,w.ÛÜN!Q a† 8øœ5<<¬oáßÌ÷„òxÆD R?Иÿ~ó2ÕGîu ”6á%~Èá¿Op¡ä à3c¡\aâÓ¨©€ÞdÕ‚bPà]5Îõ`ò¹Û +„X­y r®VW$÷žÂíýÆ+ÿÈ›ŠtPþ"ʳ°m‡ZÞ55•®Æ°=¢u‘á—R^®~¢(±ßfÄ%Š’* ÙTm÷·‘ºé#&„° ÑÖ·U5Ý'\}'F.…..ä-ܸúÆmß<öÅlÃÛÙa€-²èñl¢p0ð?ÉP­ ìkvN¹´|âsBéA½"(ï÷—õ_É )¥[W9ªQ”M½aG2áq^ä& ,ªí7P°…q¶÷¨ëY£ÕHjÔ j—»z3 ç£{Ìšíêòzæv o ü Ö½gA~¶Þ×­À‰¢ÊÙ38¿à‰è !G"må’TsWEPÞSpݲ%yRñDP<Ú±"?H“¡ZQôø!«\»ê;þöÕ+Nvd¥%NR.Xê[îäT+¤!¬Uè}ÑÆ~8(5ð,ÙfšHÈ&.K¶/·õ¶é$Æþôg&2´ e)Ø/M×h\4\g¸KclhŽsÁÍk‰7ÿ0ä êHÄ÷¨7mH7X*V(RÇžVŠ[<^}v)`Žà!Ä,×YÔ YÔ}Nßvd縊©ÿ}AÒG~;ÀÏèßËÞpäT ”Â\.Ärad 13~Ô(§ÆõkiìOS¨”‹¦OÉ]Mo®5C°³$ã½FÐ㯼ŒMÕ+­k’”æH‡ÐaɃG‘ïç% îsœñ®‡’{&v}©°aøc‘ñäïóžW9øJ>Âün5Žë¸àw (Q0»a8]1Ü58æ¸ÂcŽaeJžçƒŠýÔÒ."§b|KÒ7²®´ÚRlÝv ¯\m¾cª6ì=E.TR,ä’õ÷œ—2`лú{ƒ<$À²ÛkRzw‡Þ‘kZt½¸é+ß½Eç}MÉÙå¼—R +`艄ñQ! GÙÞ±?á×*ЦBè=ošåTÊCCËyÃyÅØ3ÃÜ‘•U®ËÞ='Ëë°ko 0YÌA%Dµcùø=¦¡ÿÛP„ƒMQÌ\ö-y©gÆcíä3 K*ÕËüO‰r¨µYIH 87Z»?tyq.(Îðö‰‡«-ûcËÓ¢u·a¨¤÷q[q°RÒ•Bž8¢DŽ#Û:ÈAbÛéaÍ×iÀ—^¾JhtùÒB 8DÝ7Ú嘲wyìÀ²Ïʶæ„À>Ë»‹;—4¨O@3^¹«—|ÏÀ*‘Ù»'†SPÉ:FÙ?À˜œ-Ûp·O5kC)ât¬½€b¯h¥öÔY¼Xt+5_] ¤ë¸ç)¹¼<4Á”š¬þ­ÉPÓõåJüÀ¦°D×®3§†ä³}þ¼[Þòà-¥ÿü…GžïÖÔ?xðþˆFƒÉ(¶ï¦0½z  s‡/EÜF +lyÛí «¯öàšŸ[Üc&.“Þ›\ +)\™¿bTÿÄÆ[fB _¬M*õW^Úî >¢ky /ç?ýŠ?’|=öQy¸<€†¶ž$"°OÊ´%xLÖ¸X=ÒI„Ci"„ò6ˆb+eyÿèÅ`@'u1 è_w!,HˆãvÍåᥔпg框´;Þ~ ›4»òÈB`#vÜ¢ÄåþØF&öuÒ»ïwÓ†Ésu~e씼Œáendstream endobj -7150 0 obj << +7484 0 obj << /Type /Page -/Contents 7151 0 R -/Resources 7149 0 R +/Contents 7485 0 R +/Resources 7483 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7118 0 R -/Annots [ 7156 0 R ] +/Parent 7482 0 R +/Annots [ 7490 0 R ] >> endobj -7156 0 obj << +7490 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [130.467 370.097 253.763 379.665] +/Rect [130.467 429.446 341.677 441.136] /Subtype /Link /A << /S /GoTo /D (Other-Clients) >> >> endobj -7152 0 obj << -/D [7150 0 R /XYZ 85.039 781.388 null] +7486 0 obj << +/D [7484 0 R /XYZ 85.039 781.388 null] >> endobj -2914 0 obj << -/D [7150 0 R /XYZ 85.039 718.394 null] +2974 0 obj << +/D [7484 0 R /XYZ 85.039 761.463 null] >> endobj -7153 0 obj << -/D [7150 0 R /XYZ 85.039 678.231 null] +7487 0 obj << +/D [7484 0 R /XYZ 85.039 739.701 null] >> endobj -2918 0 obj << -/D [7150 0 R /XYZ 85.039 564.826 null] +2978 0 obj << +/D [7484 0 R /XYZ 85.039 626.296 null] >> endobj -7154 0 obj << -/D [7150 0 R /XYZ 85.039 521.872 null] +7488 0 obj << +/D [7484 0 R /XYZ 85.039 583.343 null] >> endobj -2922 0 obj << -/D [7150 0 R /XYZ 85.039 465.454 null] +2982 0 obj << +/D [7484 0 R /XYZ 85.039 526.621 null] >> endobj -7155 0 obj << -/D [7150 0 R /XYZ 85.039 422.5 null] +7489 0 obj << +/D [7484 0 R /XYZ 85.039 483.971 null] >> endobj -2926 0 obj << -/D [7150 0 R /XYZ 85.039 354.654 null] +2986 0 obj << +/D [7484 0 R /XYZ 85.039 414.003 null] >> endobj -7157 0 obj << -/D [7150 0 R /XYZ 85.039 309.579 null] +7491 0 obj << +/D [7484 0 R /XYZ 85.039 371.05 null] >> endobj -2930 0 obj << -/D [7150 0 R /XYZ 85.039 133.339 null] +2990 0 obj << +/D [7484 0 R /XYZ 85.039 138.492 null] >> endobj -7158 0 obj << -/D [7150 0 R /XYZ 85.039 88.265 null] +7492 0 obj << +/D [7484 0 R /XYZ 85.039 95.538 null] >> endobj -7149 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F20 2961 0 R >> +7483 0 obj << +/Font << /F56 3312 0 R /F20 3021 0 R /F15 3032 0 R /F58 3380 0 R /F59 3455 0 R /F35 3036 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7161 0 obj << -/Length 1035 +7495 0 obj << +/Length 1036 /Filter /FlateDecode >> stream -xÚ¥VÝoœH ß¿‚>uèugçXÐ=œ6UÒ¦º¦M²UujûÀû¡ÃÉ*ÿýÙãlútŠ"ŒÇöØ?ÿìEzþ¤‡\èÄ[Æ’ë8ö²j&¼œ¼ŸIg1w&ó›³õlqFž<‰·Þ>Å yjogï>¬¾¬Ïoü¹Öšé„ûóå2f·¾d«Og+Tì ¼ß\ø*fŸo>áÑÕ;:òZ½º¼zïÿ\œ¯ÇŒÆ»àöÓùwöý§ðrHýãLpÄÞdÁ%W3ȇ‡vïåìvv=†¢³À#¯©êCó0Ö/Ë—áDù¡à¡lùM å˜MYTPy(vvßCU*d½ñçPpžbÙ¤KË’„Ë߃kÚ(v¨ŽØm­¢öUÂzÒ"˜Æ£o’æÁÚµ.jW|?¢ŸÍ.í Æ¥²/ȯJµó©|µdHqÉrRÝ—7p¡»»klþÇ%Û‘EkxĦ‚s‰''ˆØÚ3ªÍ¦R`‰:bc^:ËEý>ÍI)#!þ ±½‡P5Þv¨w¤z–÷뎔?D(jÓV¯´XëèYp[ÃÃÁ S¡éÞ.1¡žemÚí —¡¦ ÿ¯W$Ÿƒ¬C!& -ÏÊû®··ÄëÞ"w lc¶Ú"¶§V)=JÓ“`¶ôì¬QÚfe?ÂãtIy‘rJV#Û £ÅE¤Nøª„E’c~m¦±f‹? - ð¢´ô`™¯%4µxÃ-ù†‚=#¿”’+˜ -æÊù6ÍÀo¬e—ÚD¹…g®aî´„¥¢–\$„ÒµDìÁ;JØeGO@ÇÅ´váð¥*ú½›"TÄ< ªŽ\Àq±HxñëöCÈ 8ëîÄAÀ³Þ4¤ÈLc¬þ`Ü‘iéd?Œ—oèY¤mùHvyA Íú)V˜ÖÒ¸±q%ûk°±˜ÄÖfå0Aÿñ¡E…’·¤¡)˜hoðH/]C ØM -­Tìî¾™h_{m`B†0?{GCU±Òäìžæiþ´ý_Vö½vi‹­i À*mûgA*tã:;ÒEª'Áò9]”ƒÖÎ7»0ÝbÂ!€«Ò²3ãî\2ƒX•9iʃ/Ç­†Æ½3­† íGS“þÐ9»Ó‹ÆåIk¬}@ÌÊd]ZcÒ=:«-*7uy™~ˆXY;Ü6ðÔåtŠèKv æؽÒ-]ŒyבÎ&3RŸ†Ë²ñíи“éÅÂò"u®Ð>ý, Z M<ôÃæi\WMO»j’âj’â¯hܦ#ÂŽ~[†{‡EÙÑskœâZ¾úÍGƒ\%S?ôðOàý¯ï‰ñc)Ð<ÖÉôÇB¨WrÈ1tòk¾ÃwÇ‹„ÿ!UIcendstream +xÚµVÛŽÛ6}÷W¨O¥ÚH&EêÖ—Â vÈ6Ù8(Š$\‰k +KŽ$¯±Ÿå•µ@Q,r.g8gf( ÃOxYr™{i&B™e^±_po š× á,¸§BžÄ¨z¹Y,¯ãÄ<Ìyîmî­É¦üÌ^½Y½ß\Ýú”’É<ôƒ4ÍØG_°Õ»—++övW·×~”±?nß¡êæ•€Œ¼6ŸnÖ7¯ý¯›·‹«Í$z B•H ÿmñù+÷J8áÛežy'XóPä¹·_¨X†±’n_/>.>œQH§<òšI2-ÉÃ,SçlE<“í°ƒÓ?P"e{LAW hP°{Ìò΢”•$~@‰AÝl‡‰-îµ–§VU³%]cNõ] X+Œõè-NOê¾%ûBZï´‹*Î¥e0Çæ"D¿GwÌŸý3äó¦EÊ®†UýtÊ„µÈZnIјàãJ§ ‹b(Âîb¶†|eš²áWÛ<9’à4ì .¨q>ÝÏ•Œ9wîõ±LG›ãÐÉ·ÈÆ_Ý#ņ‚YdM¸˜HëÎÒÞÓÓžÄè®@¼]…m_€*ËØš,JcÑ«òÇã¶HÃò:‰&=¢dæ‘tÒí-SÁ(¶|ôÅt·¬¡‚2‚àï¡_þD@il€‹&ÌE¨²ÄáCÂJ)öFxü'%½¥† É=Î'î󇚇<§“|8bfýPµÍo3¡Œq–ºˆë¹Á†ú™ÎÐN7~”Ûðg{K’jÛ’äÄx>s°çÜ’~+D€ƒ;Ò|áBaªd‘†ö@ [ kWVb¶‹ÙÑ“Cƒ…vkzœk;˜b š¹´§%ƒ6©ÇE;ör‡ìC9wdgcåG1kú“éæ¸Vª;®ÿò3Éhä_PTâÙ¶ E$Æû©¼»ÓÔNÇÃL.ûÑÖ€!LôŽð‡ +‹‡·µ¾œ!ÐõÀöa¼>PÐØ âùqÍ׸I-bµCîÝ 8çÛ2³u˜m[¡`‚Ä¿ë[¦yäòü;@ãìü`ѵ¶Ü¶´³7[‹uI’º[gGíÝ æ¹Õ@^õÎnGa¤»Ï@Ô›î±*ܦփiŠ§Qcç`ï|µ3iBíz‰ìFPݸ¥ü¦ úwœŸGK"8½Kù¡'YQ[ããÁn–˜­Îƒ V˜mi´ó±yCùfÇäÕàzÊ)Ö¹ìMíö͉»ñ¢íËËŒ]Ù?³ˆ{—Ä}ëö-k«öØ“àÛ‘m«¶ÍO3_&iÄÃH¨ù¯&W•ÿöݯ ‘+ü%*Î<¢HB™ÀWÏô€ßoTZendstream endobj -7160 0 obj << +7494 0 obj << /Type /Page -/Contents 7161 0 R -/Resources 7159 0 R +/Contents 7495 0 R +/Resources 7493 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7163 0 R +/Parent 7482 0 R >> endobj -7162 0 obj << -/D [7160 0 R /XYZ 85.039 781.388 null] +7496 0 obj << +/D [7494 0 R /XYZ 85.039 781.388 null] >> endobj -7159 0 obj << -/Font << /F56 3226 0 R /F15 2972 0 R /F62 4047 0 R >> +7493 0 obj << +/Font << /F56 3312 0 R /F15 3032 0 R /F62 4159 0 R /F59 3455 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7166 0 obj << -/Length 398 +7499 0 obj << +/Length 374 /Filter /FlateDecode >> stream -xÚ}RMSƒ0½ó+rLÄÍ'áj«Ug䦰¤…±…¥ÿß„@e´t˜ÍîÛ}ïeaÜÃQDŠè0m «¬"6 ¤TIéâ+Åx¬ÆšSÉUÌÀ',¥B2¹Ï¢»GˆÕZ l; -Ѩ1 -eÅ;–@I¬àåúÄB'8¯‹,ŸHÌðâÕŸ4^4õ0¹;·yW5u€¬ÎUaÉgö=d-#K¢©ÑWÕŠ¹ "á7­hg[¦jj…IgNO­pí¾l´Â¼™âµWÞt³Ò†®›ì¿˜ž)Ä€¦NØ•1”ñ´gÏÊêDb oOp™ ÃmC®¨ŠÔÄ ñÁ«Ì¿ 7؆L5TªÚ'»&œº²r]ýô·voó“ï´Î¬[,~îBe:î]œ×µX·žµ§Ùä’ç/÷ÚW§rDNÆT³õ_åEœüuúå1ÿ?Û…Óèìn|ÇÙÍê=Ù ŸÎ\¿ê.mrù³K¸ ÿ¯@€ šÃúýKøK¨„¡ÊˆyÆyÌoendstream +xÚuRMoƒ0 ½ó+rLdùN¸®ÝºíPM·mVÒ­…Šÿ¿„À„P+$âø=ÛÏŽ) þ£ÀHLx´¡˜—„€“Gv Br,…ðö 0ÑT1L„¾Å! å ©ø˜'ÏŒF°RäÇ‘”—ŸPŒR) Üî?PÊ•†E]Fcû‚R +7ïá¦à¦©¿§¡-z×Ô‘²\iÑwþ–<åËÊjî¨bsÍî %–’©À\¨•dD‹ îƒÂ¦ÿ—pkg„ýg¤Pâ=Ù2c^¹¥‚(x@Lê¸" +{ÛF_éÊhÔ(‹ö%T.~3ÐF›WgßÄ[_95f×°µg[t!ÒúüKÀ×>" Òõìí¢®íTõª¶s6;‘¼søñ¿³ëª™¹HYÍ1œ2ˆèˆÂ> endobj -7167 0 obj << -/D [7165 0 R /XYZ 85.039 781.388 null] +7500 0 obj << +/D [7498 0 R /XYZ 85.039 781.388 null] >> endobj -2934 0 obj << -/D [7165 0 R /XYZ 85.039 761.463 null] +2994 0 obj << +/D [7498 0 R /XYZ 85.039 761.463 null] >> endobj -3171 0 obj << -/D [7165 0 R /XYZ 85.039 653.495 null] +3263 0 obj << +/D [7498 0 R /XYZ 85.039 653.495 null] >> endobj -2938 0 obj << -/D [7165 0 R /XYZ 85.039 653.495 null] +2998 0 obj << +/D [7498 0 R /XYZ 85.039 653.495 null] >> endobj -7168 0 obj << -/D [7165 0 R /XYZ 85.039 615.228 null] +7501 0 obj << +/D [7498 0 R /XYZ 85.039 615.228 null] >> endobj -7164 0 obj << -/Font << /F20 2961 0 R /F15 2972 0 R >> +7497 0 obj << +/Font << /F20 3021 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7171 0 obj << -/Length 2178 +7504 0 obj << +/Length 1698 /Filter /FlateDecode >> stream -xÚµZ[oÛÆ~ϯòrHàhý“})š¸ÎíI`+Š¶”ÄXD$R‡¢âúüú3³»)jMª -6/£ÑÇùvf¾šÎ"ø¡³X’ˆ'3SÂãx¶Ú½ˆfpçí ê,„äD -Çž›óæî\1 íµqß1×4!\P´y½xñê–E3¥ølñµ¢âˆÄ±œ-Ö¿‚’p.e܆œǪç4ØdU8çJw! 2¼r€ƒòX­²CøçâËŸ§oîùô`‹fsÆ ×l¸’šHÊ»À©€GQ]àLÁ_Ú7ÐE| ydKĘ×Ï#tö#äš$Ñ0BÇ„²ä„¢L#øT‚iD‰ˆø¬1BˆDT÷ÁÐH‘XƳŽ³þJ"äi)à…êÁݹ렢”NÙ%,pÞ嬺°Þ¼‡@ÝÞÿË8xƒÌîveaOñ^aÏBÉ‚Õ±ÊáŠYxÑ5f·¡ÖAšoñL÷«êXçÅ>ì«[*;XÔ3€Œß¼ Y<Ág8^¾+—àp™×/û1âZÍøPŒæ,NˆŠ!'˜&Q§hÃüqÎh”¸ÖÙTâz°üÄu`Ý”yñ`ã_o2{pŸî–¡¤AjO¿ä ëòñàá… - ÅH{ˆ¹5M‹Užní•;S¾cz™£Ç ”˜h06À“$R%Ž°d˜0ÎIÂÙaÎh”°ÖÙTÂz°ü„u`½ßAÌöÛl—õ‰:L¸÷·÷N¨€ptIÉ›M…Á?`ðkÌ×½­ÐÈ ±ßfЬ6GÛ Ž8ƒpСpÌ,ŠŸôš¤Âðr1‘3å¨u6•£,?GXŽ‡Úå oƒ±K붺zwÿëë}ŒÅD2êaì._áÙ&­ÖöÂ=:O‘Ÿ}Å ºjŸ(”Z³¡P̉æü*~„NÀV óÓñÓq6‘Ÿ>,/?]X÷XÞ²â”?HS^¬KS‰=?Ϫ§+“S/к²gª^"¤‡°_±ê} 3pAÀ×Ä<0„A`D¶]_&@O€*ˆÍœaAŒäUEOHF×#„9£QÂZgS ëÁòÖ©bIy÷1d*ø²€~ôpMž'ÂCÅMŠ'ßs“9ÌQš¤Áß:¸`‚) B‘ =ôœ‚>…».u´*>"ô£Q&ZgS™èÁò3ÑL¼jºadùdõÚ¢Qw˜[¥ùUûÒ¶”ú8z¹ÍÖy¾/ă(Rx¬çž³ý^—j¬i3ÎfŒŠÖÕD&z˜¼Dt0¹pƒN6 ¼¬ å×¾†ówؼýSš´@¤’ &±ÒWå ×Ôäá0WÎh”¬ÖÙT¶z°ütu`øúŒQ+J€©VØREËå¹ðnŠ¯ÒQØ¿Ç\Ž•:ü’jÐ BP»£UuÁ˜$Qj(:Ðt’°+)‚°ÑôrF£”µÎ¦Rփ姬ë³Ýëd¸Øµá©X_î–þ“ÕF"”•éöö^ÈÞ‡a´¬6å©.®½{Z8”c9YîÃf’òwrRpEX‡‚ °)aR\W?©&TȆÑ(í³© ÷`ùîÀú|8ÑÙK½Ô‰ÀÔ&æ' ëÍ_Rœ)q?a+[WÙ£Õ~¯ÓªÞ6£¯º¾HB¦?Ñ€º Ê/¹. Y5s½ç)jŒÆ(ê8›HQ–—¢.¬O7·!VÛÔøÊL#4fÄ›Ž M¾Ù“Ž‘*“lÇ¥‰øaÓÈ7q2¤ƒcšá½Õ¦Èÿ{4“(gé¾Î*_šª˜$ºq|­Ì  >$š‚Cñª,° ø‚uŽÍ47È…kÑ`‡Û·t÷/3IÁ -k=Ï)f­ØZ LÍRWÀͪúÍ(×#|´²ß³ýj%-,`4[Ú–‚¦yaÿ2áÊDy¬öðHF{t²Üæ‡Í)$pgÖn³R:Ç7öq Ö!ÊþmoCÁ¢à†^ÔýŸÂšÑŠˆg)d‰õus&Ðô#¹1]È­³© ¹Ë¿;°î·æu³P¡¨ìÍ"ÍYQ§§¥YÚA©Oµ1’x‡k÷ŠØáÅ¥cß­ek—µvVP|ÓœHê¡ ™iNì^U‚D!‘6F£ÌµÎ¦2׃åg®ë}QWmïƬYÑeÔ€QEnÚ kÚ '‘w+¤Aû¥QßE¹<Ú4d¦ßB)ƒ•\jäåmB?Vy]gÅyòHQ2¤Ef>‘aÆ’‹”qÇŠñœÇ Øu³qšHÂ">L|c4F|ÇÙDâû°¼Äwa=/…VmÓÁfvTVßš ùõÒš4™ åU$â´„b ê0…â¾4¶& s;YD³KAH¨ß1®¤S“h’ÏVMæZ‘dZ‘UJé~oæ$YZeëófû®Ú´³„±=ØÒãpÁ¯ãYg­IÞlJŽ5.Òÿ™€ÁM._ -"Á‹)Q’?óR6žVW­TØúH9"d£Ñ•Ú:›ºR{°ü+µ«§^¡Žˆá_ö¬+ˆLËoÑIþ>MwòÎ7•&Zˆ ÉD~BîRtêÞê¼­2C\á#Žk9#CçW6BŽÈÛÆh”¸ÖÙTâz°üÄu`YêšÈo!ŽÌµ ›¿nb§:ýÖÒŸ’Qj†ÆQ§-Ä°ò¢°%…/‰±3qëljŒ{°ü1îÀê%ÇO!“Á±y½Á×h+s»Îl…6VoQUgé“gsþž¢©äÐCÙ±ëV·æЇãnMÆ¢~r41æ瀼o™÷_ý×æý‰“P«:? §²ÙÛÎõé4¶<[Üàڟͨ|2)Kà$˜Ÿy³4z€w8>R.^U sQ´?œîš5 JlŽ¥Q)ØÓ$ÉÒïð‹ª(ïníÚ¸Âm¾]Ä’F¹{ìà_tø¯ªû&€'üTÙWórYäWscýå Ú­-Ý÷PœpdMIƹ9ûÞA¾ÚÂ>w³5e{€ûjvÀ1ÓDB©ãùºFÀ¬EßØ9 +B<‰û}eÑÄn­-mz¸0Y‡€Ô©Vc±Þë}ÓzㄯqÃyûHžn_¿ø%sJ$£˜oŠ%>­ózå*nqðAÝÅààÀõ';£©&) +CŒBËôX@}³Cç7åÁRÛ¢\UÖO=¦/¿˜ú!F¿õÙ pB&då×È Ÿc 'T˜&å‘Eö)ÌfÕ3]ž~ƒœ }T6N£tH¾z3½ŸÃ¾ßÔþ3Àï"LJ/…µQæЫ¬yâ·ŽzðQ‘ù¡Bð×ߎÆH¾gƒZ.ÞÏ»(vƒV\Ù¯6d˜ ò(ÑcVE Ã÷‚?Ua‰1SDèt, z¬@$ÙˆRÕÃêÓ©³§âÿ[Öz0HIÂFü ¿Ã­–̪–È}¹Ûº;€cÉÕqBˆ($5)—ßbýj ŒiˆŠ¨Ú°WÝ'ÔŒC0+EX6[~甩A«jZ‹m¹êkÛßLkCVUÛèãê°Âà‘Ü­í)Tõº:°Ç*˜9@Q~Ëø«]Ü%‰ÿÅø90Ìi9TEõX¬ÿ]s8ƒϽ’ȼE,.ÎCûI¸ + ý)zU›{' ^äu»éRñ¶í“ +0~:hí ‹Ñß·3س† ÊÔ Z®MÒ4š,ìé['Þè¡rŽqm-z¿°5ë.2úäÙR×Õ`Ûr]îmR­ñ)ßµ¦ù‚JI¦»¬ïSmsvxIt^…Æɲ*‘šL°*04vÕÂè‡B;ßþh“K$ 7ò”â5NæØeŽÉ=³Y+ø`•Ï^­ïQTîù{.ÝbMQº_&¼;Vûºñ?‘ÉÇYlŠf}@ZVyëEª])È­ ·#ði!DDÙO®ˆÂ0´çÓœ•¨ÃV‚ž-S’êñØ "´²Üé\xgMÌ4åæêÜMHA0’o œØsó‡æO}ë@ÞZì·øÆÂåcuJs©M¢Ã +‚ž²±xûUÙÖñ-ty„¯p6ª=‘s–m™SSèÈI”Á¹†¸õueÅ[Y-öÎâíäŸc)£5Enƒ–ŠG÷¹¯‹¶5屫]çóÒØ7 úé9ˆdp^C×\Cê2žk‰a-"´Vô>ƒ GlZ]ÕŸ»Šâß«JhÖy0ÈÄá …b 0Ðe„â!—q]@°î¦»õµ €âR<þµ6Ø->-»>ƶ_e9iW•ïv65ymVÇfᢚZþÄîA›ûuÁ×þˆ|AÙ¦Ý톸Ëÿ²›]7éß&:óð+ ß)r¢øxàc5ÅHB`÷_ÝÓÓ€oãÙcÀ?ȱ»½åïà¥ÒD Ñ époõõ¹—µ±—}ÈAP±á\AT6šìÂÉ"OµbðSs ×úñ¦Ñ%Χ|²ºL=(C)žV£ÑÇFøÉV»ß¿ÊçDendstream endobj -7170 0 obj << +7503 0 obj << /Type /Page -/Contents 7171 0 R -/Resources 7169 0 R +/Contents 7504 0 R +/Resources 7502 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7163 0 R -/Annots [ 7174 0 R 7175 0 R 7176 0 R 7177 0 R 7178 0 R 7179 0 R 7180 0 R 7181 0 R 7182 0 R 7183 0 R 7184 0 R 7185 0 R 7186 0 R 7187 0 R 7188 0 R 7189 0 R 7190 0 R 7191 0 R 7192 0 R 7193 0 R 7194 0 R ] +/Parent 7482 0 R +/Annots [ 7507 0 R 7508 0 R 7509 0 R 7510 0 R 7511 0 R 7512 0 R 7513 0 R 7514 0 R 7515 0 R 7516 0 R 7517 0 R 7518 0 R 7519 0 R 7520 0 R 7521 0 R 7522 0 R 7523 0 R 7524 0 R 7525 0 R 7526 0 R 7527 0 R ] >> endobj -7174 0 obj << +7507 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [111.316 585.012 375.719 596.701] /Subtype/Link/A<> >> endobj -7175 0 obj << +7508 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 557.913 361.605 569.603] +/Rect [111.316 557.913 357.968 569.603] /Subtype/Link/A<> >> endobj -7176 0 obj << +7509 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 530.815 333.847 542.504] +/Rect [111.316 530.815 330.211 542.504] /Subtype/Link/A<> >> endobj -7177 0 obj << +7510 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 503.717 304.768 515.406] +/Rect [111.316 503.717 301.132 515.406] /Subtype/Link/A<> >> endobj -7178 0 obj << +7511 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 476.618 347.041 488.308] +/Rect [111.316 476.618 343.404 488.308] /Subtype/Link/A<> >> endobj -7179 0 obj << +7512 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 449.52 266.338 461.209] +/Rect [111.316 449.52 262.702 461.209] /Subtype/Link/A<> >> endobj -7180 0 obj << +7513 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 421.815 286.15 434.717] +/Rect [111.316 421.815 282.514 434.717] /Subtype/Link/A<> >> endobj -7181 0 obj << +7514 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 395.323 334.902 407.012] +/Rect [111.316 395.323 331.265 407.012] /Subtype/Link/A<> >> endobj -7182 0 obj << +7515 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 368.225 355.962 379.914] +/Rect [111.316 368.225 352.326 379.914] /Subtype/Link/A<> >> endobj -7183 0 obj << +7516 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 341.126 437.289 352.816] +/Rect [111.316 341.126 433.653 352.816] /Subtype/Link/A<> >> endobj -7184 0 obj << +7517 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 314.028 327.132 325.717] +/Rect [111.316 314.028 323.496 325.717] /Subtype/Link/A<> >> endobj -7185 0 obj << +7518 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [111.316 286.929 539.579 298.619] /Subtype/Link/A<> >> endobj -7186 0 obj << +7519 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [111.316 272.774 444.915 285.676] /Subtype/Link/A<> >> endobj -7187 0 obj << +7520 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 246.282 333.053 257.971] +/Rect [111.316 246.282 329.417 257.971] /Subtype/Link/A<> >> endobj -7188 0 obj << +7521 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 218.577 470.259 231.479] +/Rect [111.316 218.577 465.411 231.479] /Subtype/Link/A<> >> endobj -7189 0 obj << +7522 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [111.316 192.085 539.579 203.775] /Subtype/Link/A<> >> endobj -7190 0 obj << +7523 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 178.536 364.521 190.225] +/Rect [111.316 178.536 359.672 190.225] /Subtype/Link/A<> >> endobj -7191 0 obj << +7524 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 151.437 364.371 163.127] +/Rect [111.316 151.437 360.735 163.127] /Subtype/Link/A<> >> endobj -7192 0 obj << +7525 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 124.339 212.732 136.029] +/Rect [111.316 124.339 209.096 136.029] /Subtype/Link/A<> >> endobj -7193 0 obj << +7526 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 97.241 308.062 108.93] +/Rect [111.316 97.241 304.425 108.93] /Subtype/Link/A<> >> endobj -7194 0 obj << +7527 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 72.263 240.635 81.832] +/Rect [111.316 72.263 236.998 81.832] /Subtype/Link/A<> >> endobj -7172 0 obj << -/D [7170 0 R /XYZ 85.039 781.388 null] +7505 0 obj << +/D [7503 0 R /XYZ 85.039 781.388 null] >> endobj -2942 0 obj << -/D [7170 0 R /XYZ 85.039 761.463 null] +3002 0 obj << +/D [7503 0 R /XYZ 85.039 761.463 null] >> endobj -3179 0 obj << -/D [7170 0 R /XYZ 85.039 657.513 null] +3264 0 obj << +/D [7503 0 R /XYZ 85.039 657.513 null] >> endobj -2946 0 obj << -/D [7170 0 R /XYZ 85.039 657.513 null] +3006 0 obj << +/D [7503 0 R /XYZ 85.039 657.513 null] >> endobj -7173 0 obj << -/D [7170 0 R /XYZ 85.039 615.228 null] +7506 0 obj << +/D [7503 0 R /XYZ 85.039 615.228 null] >> endobj -7169 0 obj << -/Font << /F20 2961 0 R /F41 2994 0 R /F58 3360 0 R /F15 2972 0 R >> +7502 0 obj << +/Font << /F20 3021 0 R /F41 3054 0 R /F59 3455 0 R /F15 3032 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7197 0 obj << -/Length 977 +7530 0 obj << +/Length 732 /Filter /FlateDecode >> stream -xÚ¥VËnÛ:Ýë+´+µË·È»¹H»é#M;𢷠Ֆã:R*90ò÷e[U9€á…DÎhxxÎ<ÌC?ZM™tab9•Ö†óÇ€…+°| xã7.qËçÃ4x?Ö&äŒ:æÂéòGS¥e8]ü —W·ÓÑ]K)‰â4Š“Ä’qÄÉý]d%™^íðàd†É·Š„\Ž&ÑÏéç`4= 9œ§:„ñ;øñ“… €ü9`T:îàQæÇpP­d³Þ“àû!”·©ÐÕwë½G,µV 3£ÕL˜Q¼Å gœ*&ýRóãI÷vœjµ [Áº"·€Ù›p£\5–»*Ε\¼†Á[°¯6¬ÙCºE´%ë -Ÿ Â'Ôk‚úüû -°µ”%zpÌ™ŠL‹„2w"¿„¢Ì §“,ƒËbV?‹-X³ñì#öO ­É-r—VÕ®(#ÍÉw ¹‡tþ°ÎW~æáªØù—O[ÿ¼€[JŒ‘EZù_+úë.¾y¿kŒ˜×‡­²Ò;L2”ÃÙ1·T>,QÐy“¬ŠJeZóÂHE­LjÜ0" ­¹Ë6é6CÐ&!ÏOð„ÊìJÆe‰ùU<úÕõ® ë+ö!oû'‡¬e*éCÍ §5\M ^I;CÔÃ9·w:•s­`gæ\VoεaêFñæsL¸¬iL˜f£|^¾‰Oè°]×…o¹·.q]ú÷ë8‹bWù=§ýó^­Q‰]«‰} ïUSPòFè!6bá ËØ·Mm\QÃ5N'%:;W¢¬~‰Z°fëüÈë»=±c$}“5 ã!-"¬üÀ¾Ç÷§Zк^:øN¸¡‹Å”—7‘­ UHw‚ìÆé$ÙÇ`ç’ÝÕOv Ö_d/}†'dV”ÿ¯ê©]¥\“Âq«Îüï{P¦†m±ô×HÑBPÁ]ÿ~…çH)ѽ––0¬lœZ€ÿh- ;endstream +xÚÕU;sÛ0 Þõ+´•Äð)Š]z‰ÏΣM›ÚÎyH3èlYÖÕ‘RÉ9_þ}Qr\[žº¤§‚À‡÷|Ü5eÒú&æTƱ?ò˜ŸæÒã­óe‘FÕÅÔ;éÈçŒZfýé²1™.Èàêün:¡”’(NƒÐ˜˜ŒNîÇA,ÉôªSÂÂÉ“N+  'ÁãôÆN÷^ U‘ÄgÿxÌ_@d7£ÒÆþöŒrký'OiIµ’­¼ö&ÞϧS¾»Õ“\ØY„’Ñ8V}6<¢2;ïAàãæ0 M•Öîâ¡ST©N…UÖjÆ—-ζç•Ù*ÙŽ:&y+`w(OÕ/‡ïA¹0ý„ÖRH[Êú¡ùPif—åç Z“;L6©ëmYš“žFdÉ|•™““¢U\•[·¹Þ¸õ‚–è# ´ ó nkçúÛ9 +ßÝ-z,šÇ²´r“Ÿœ¿T Ë7¯˜úو뽘¥À(ÞFŽåBÛ|^•u¹lůÜ/‘ûÛuˆN€€í½#us9]d)v"Ií>€ZÊcÑÝé+³QM5BSèÜÞþ……Ró]¡+*U´_hjm­•%ãtlR@WF†¼<à +E€dd‘e…¡–ONºÍ!SÈÝ çÁq¯ jb{":©)çâ£StØe•s$HÚ;uXÌ«WÈü 6ySxØN»D¹rû*?‹r[»3«Ýz‡„o€­µ­ï0þˆ"42§ú^Ä–ZÝv¾ýðŸïX|êÀ!PëÔ “URí€ËÜT¼ÇýsS„†˜qòHÃ@ˆ[ÀOÿ?Ãq¢¥ã’!³²ú5ó±|AòÕ;°šf|™;»ï€jFÌX‚AwêSl‚ÿ&Òµ´0¾LãxRöÿåguÎWÉ_³w7¬"q\ò÷Šu¾*"ð +endstream endobj -7196 0 obj << +7529 0 obj << /Type /Page -/Contents 7197 0 R -/Resources 7195 0 R +/Contents 7530 0 R +/Resources 7528 0 R /MediaBox [0 0 595.276 841.89] -/Parent 7163 0 R -/Annots [ 7199 0 R 7200 0 R 7201 0 R 7202 0 R 7204 0 R 7205 0 R 7206 0 R ] +/Parent 7482 0 R +/Annots [ 7532 0 R 7533 0 R 7534 0 R 7536 0 R 7537 0 R 7538 0 R ] >> endobj -7199 0 obj << +7532 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 749.508 189.072 759.076] +/Rect [111.316 749.508 185.435 759.076] /Subtype/Link/A<> >> endobj -7200 0 obj << +7533 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] /Rect [111.316 720.288 539.579 731.978] /Subtype/Link/A<> >> endobj -7201 0 obj << +7534 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 706.739 164.127 718.428] +/Rect [111.316 706.739 160.49 718.428] /Subtype/Link/A<> >> endobj -7202 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 679.641 358.15 691.33] -/Subtype/Link/A<> ->> endobj -7204 0 obj << +7536 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 593.818 379.622 605.507] +/Rect [111.316 620.916 375.985 632.606] /Subtype/Link/A<> >> endobj -7205 0 obj << +7537 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 566.719 282.325 578.409] +/Rect [111.316 593.818 278.689 605.507] /Subtype/Link/A<> >> endobj -7206 0 obj << +7538 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 539.621 319.695 551.311] +/Rect [111.316 566.719 316.059 578.409] /Subtype/Link/A<> >> endobj -7198 0 obj << -/D [7196 0 R /XYZ 85.039 781.388 null] +7531 0 obj << +/D [7529 0 R /XYZ 85.039 781.388 null] >> endobj -2950 0 obj << -/D [7196 0 R /XYZ 85.039 664.197 null] +3010 0 obj << +/D [7529 0 R /XYZ 85.039 691.296 null] >> endobj -7203 0 obj << -/D [7196 0 R /XYZ 85.039 621.244 null] +7535 0 obj << +/D [7529 0 R /XYZ 85.039 648.343 null] >> endobj -7195 0 obj << -/Font << /F56 3226 0 R /F41 2994 0 R /F58 3360 0 R /F15 2972 0 R /F20 2961 0 R >> +7528 0 obj << +/Font << /F56 3312 0 R /F41 3054 0 R /F59 3455 0 R /F15 3032 0 R /F20 3021 0 R >> /ProcSet [ /PDF /Text ] >> endobj -7207 0 obj << +7539 0 obj << /Type /Encoding -/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/dieresis/visiblespace 129/.notdef 161/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/dieresis 197/.notdef] +/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/dieresis/visiblespace 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/dieresis 197/.notdef] >> endobj -5851 0 obj << -/Length1 1934 -/Length2 10773 +5936 0 obj << +/Length1 1009 +/Length2 3148 /Length3 532 -/Length 11863 -/Filter /FlateDecode ->> -stream -xÚí–UX\ÝÒ­qw‡ …àîwwwhÜÝ!8‡Cî ® îî<¸‡¿¿-Ùû¿<çê<§¹é·f­cÖœ«jre5FsGS ¤£ƒ#++@LA]LMŒ•ÀÊÄ‚DM-æ4q³vt7qòXyyY"î–V+ '+;5@ÌÑÉÛÅÚÒÊ ðNŒö¯$n€ˆ=ÐÅÚÌÄ `âf´×03±¨9šYݼ™"vvÕ¿žp¨].@s&$VV€¹µ™Àhií€Äü—' G÷?ÃæîNÿ^òº¸‚MÞMÒÀÍì¼æ@ $fEG°ìäÿ†©ÿ..éng§hbÿWùõée˜Ø[Ûyÿ+ÇÑÞÉÝ èPp4º8üwªðŸö€æÖîöÿ½*ãfbgm&â`i°ü3dí*ií4W¶v3³X˜Ø¹ÿ:˜ÿ· pëþaYIIR\\‹þïSýDz²‰µƒ›º·Óß…ÿÊÿ³¾2¸G.Ö^=&Vp"øïßß þKNÂÁÌÑÜÚÁÀÆÉ0qq1ñFß0q|YÖæ@/Ð ì™™ÉÁÑ üÜ€…£ Ò_‡ÊÎ`/Û™ØÿÿgˆÀììîè47µ{ r˜ÜíMÿ:|K‡×0€ÙÜÑÎÎÄå5Ä `vº˜Ü^c¼ÿ*ùÏKñï0XÉÌÑÞÞä5–±òv²¾Jppý£žµ£ùk,ájgâjõá0û]_`EGàßÌÉ`vó|]çd³• ð 6³…£ûëF8Á­±°öø#l×|,3ج+Ðã¯à#`þÇ9ÁV¬ÿ4Âóמíÿxˆ÷¯2öÖÿåÛ±ük_qE^ ,&úJ`!±W«ˆ¿XAâoâW–~%ð.e^ ¬ ÷J`ùW+(¼XAñ•À -J¸ÙʯÖS}%°žÚ+[ªþJ`uW«k¾X]ë•ÀêÚx02›º˜˜ÙÝ쀯Íç+›‚ÃÿyWxÙÿÎþÏëÈ –w¿0.®fŽ.¯'ÆËõ¯ËûŸµÁ~^ï-/Øé+»aö7±²€Ûaþ‚ÝÿÀ¿îÝvgù‚dõ‚-Zÿ`¶ ؅ݶñúZ³‚'³Ã¶áø‚m8ý`]—?ð¯«þ‚[âö‚m¸ÿ` ؆ç+²mxý`Þ Ç_GöOåÿ=WEE½|9Œlà±Å ¾¹\¼\þÿ™¥á`í씿ð,,óiÂoYg’£æUòëHJš’»CÑ‹ñÍÑ(gBÑ›3ŠD[å¦eãpXPÑŽ ö^´óéÜâÉ+-ˆ¦¢ÐC˜Ix’•/ÂF0pŸH -º†Pç8Ø ,†ºÔh– ä",š¼Ïø±-Zo¢"rú¥ð 7¨©ÞeÔÆ©ËœšÝ¨ñ¸^¢’NÛ.•Zw"ËZ¸rtÃRŸ·ê#!2é–uÎç)ÚX²ÉPuÍ%çpEbpÒÜT!½wðá /˜â+jȾª~')XÞÍ6Å®xAH™}K÷Á®¾ýü§Í ®@lÍFÂ6ÐP g‡'X!Ý‚Úù@§Î¾ôÏù/½²¡à\ë·‰t‡Lžm‘´1ë‹ý¨Ú!,(ôâÏOJ_áV+ózÞáO·Å¤dØ€€©‘AoÑA 9&„ «!í“øù6~å“ÖJúö_Zõrd"¼„ø–tÃðÞò{ÔIŽ2ÉÍ -ãSøú:-XxKÆÜŽ×äâ zwŒÍö†[SMÖBT¯¤ÜnôO’[ ›×{•~ür=–©ð²è‡ñNò{™JÂ1D¡X£ ~ž¸¼UMu¦öEÊÊâ]Îs:äbëÓ’` gù¯güfŒ³hašßF< EÃD!É°Ë M†_:ùtþ•ï°¡_(ŒÒzƒáúj~«GW4Ü¡†eÊ8u¾½G'8þFMܧ,jžó¶»SÒ©;åAØÙ}´Ó² ÆæÊÓhÅ^>?bµQæÌBÔ㓉@Xä®÷§ÁàÁúwúh¢v ãlõ-JÍÇYä¤l…/Šø´GÔ»'Ò3Ú0ÚÕË»]ƒ}ì|òBãBiÏ0çôÇÙŸ·Hå˜Ï_¦P1bùK­¼f!ÄF+÷{ÅT\®Þû·k®i³¯ü¦ŽHy¿EV„ª6Þ<m–-HüÉÕ/ªJ/\ÿ FO}rÏbeˆ'ö>¶´ßøaë~ø;B‘Ø4õíF9æùŽUæãr|[!myô;cÇ°ýfÌiU…@…è³fÑ`lDTY|õö±WʉPU‚/Ú1š†x --ñ„Ý-¿xÁã—N=ÎÉ - >Ï)>ªý€¶ÙüÅÃvÄ%©2WXÆD29„¡³iÛóµïh[d§ûc?ðƒ†°Tú%VcОX [h‚‘xdãqLm± -‡‚6|Ó=2äÏãwá<Äș̡Ÿš#ö@:ê<®ð÷‡oÉÇ ¾`Ùj~‹5Ç ¡õ=æikïUof¢ÿy-Ìè¦QÂ6oìóO2\<˜£>3uMZx›PIÄi»F¿E7OP—7ÖÔa]ð³)Å¢¬L¿E ^ÉŠƒ6%ü‹Á6¦•ƒr¡„oßÎvÉ7­ëˆzŒJÑ + <—ûQp›KZ2Ó¡ï Ãô%¶dª9Õ½ýúqsOy¤h)¥&$}åΉ šÉÁ-yÈó—+±¥›÷› š‘ß Ò=ZŽó-È[£˜Y=š(9HˆaÔ3èØý»ô?&µ¦S$4åäòÑ®’‹|*r‹G+"jÕ¹g5ý¯‘(äÞ[œ#¢ÇŸãEBÝã•6èidK&ªwêéœæŽO6<òÑßÅ!QÝ&€-o›tk…øX Óî’ xÚ ÙÆYMèy~®ÏÀ„¨æÙnã”ø”¾=#~¨`Ó ¿|Ù'YœËƒtÅ0ñ}R/JXwÝå¡Éºÿâ€ÐH’ÍÁÛ9 -EhS ‘ÕÛ6^ŒvJ3£u9ÇÄjMQéTPô™ò”½3¨—¢²\ Æÿàþ\¾¡ARÖþºN»rª;.ª“]ˆç…¬¸¢Ê)¾‘C’N=UÁÙ•ÃEÔþŠâÞGÓrK@Bªˆ;³FþS“¬"VøY‰"Êv&†é¾òðó.0£?aÙ‡·&\SåSkCn#öÞ¦äê÷Q‰ßÒ"¿µ2yûQõóCIüïâ@§áY°4Õ8ˆõ´6Š#v–‚-š -sìü¥ƒ|,Œ9&[Ò¶bô-b*Gû›ž«g1cxŒªªÓüð™JƒáTâH˜RlZ±ª^LqóºO“;!ÈÚ°U¾*$ õ?eý¬Â+ñÚûâØv–­{9‚Qò#ŒØÍyÊY¦»oCt>K±vÄ: oSC­ÊúÁ Æ̹è>õg_.7Aæ"îëñäÎc Ä‘ÏWA­¿ÔñLç,”•§Ìܯ¥7R«%¶JãÌÓ#¶÷˜“Û/dmSóæ|Ê bˆ¯C(÷òåV6Ì?„£ûÕ†Mè!Rýç>:ÿçôLCŠìY=§ÜçÏ3^²WNíäùHŠÆeÎÍÞÏÂ5«‘ªk9òXrúŒ'vùÙžÔäÇøýð)! -þ¨|3.~ìï/ÌæødvÔf‡p.4µä¿Œ a#W¨Ô­HÜ»¯)©‹?GY#-~ôüÎùédY(¥ŽANZÊÞœãB'²º¸ØP„Ÿ¸A–3þ3Wf•wÅ/¦˜sx,˜Èkü µÝDBœQDDË©2ÿ¹aá¾³ØgboIÌ'?­€ÜÞâ~¼L(ŸŒÎÍÅ£exP26Ö;Èö˯¸Eì}59hèyÛ4˜ƒ‹ŠWÏXÉzwÚ ìÆ]Ÿ˜2üÚ+¹lF)âÂc -*ŒN;C徆ÔñûJJ±œÎËÊ~ îK˜]„NzKžãÃ.þ8ñÝûCé…Ô•þ&¼˜pv˜3öfò#Œ4tCîã> -cª/{ÓøÍU´(¨7Nò9»ô$´W'¯#¶Á™«µ¶ò«èÅGhRïöæ›l혦…M¸¾¥ÀR#+‘÷•'é[†)?Z[¶ÒÌ›1iUÞ8#ºR§ón«’›p«åä!±[ "ÒqÑì3Ò¸*ü¤ƒ’Î od(¯š¼Ðò]¸èšdc <”;´h†']¦ÅcdÞ!oÜÈWžH„+OÌö´!N›ì½‘ ÝÅ3K?©•Z׋¡„$<:0ú±×s×·D•±žLûŒ²Âþ‹Ùr]¡©‚=óÐú“UEîçb®Œ_Å›¶pñŠ Od'ásL⬩δh¢wÞ¶mÊ0‡Ûˬf€·Zœ…¡Ó, PÅäôá.a=—ºlÚÈ -ëSè°R?(šãë. {K¢qO^ºô wÍ{³o®¨ .‘ß)­Y|‚'\z‚},Ù;í~ÈoÚ¥§BoÎÌÂ@žä>äÂËu¾Mu{9ìø¸×L™–ÝP¸uÌ@"çö`—‘؈™~`Å°±³Ê"1ü¨Ýe¥ÇÓ¬¢k¯->¢ókî“'(9"ÒÏ]Ø,ÕGõP²y‹¾^Èó.T— /„èªÐ­Gç”"b²žq‹ÆÃÂ7ˆv{«¥ü®ø:t¥½Z+ÐÚ[U>/y´±†0ô‚ä×"½™~—‡Ár5 -co¬ÖÓ o<Ëß^º÷ᦨX*%/keÂôç.À³I™NÖýÙ Hh:1Mdâø Á3mꊅ51Ê™ÓØ>Þm<Ž¹¹åß($;½‡”€´î”šê|Ì £x>„Œ£.…Ät|J_;ÃÒx­ ¹×§½¥ÃÕV-'Д·% )< 0Ò#Žã5>þÅkwË`t×<°Ükqs@7F3N‡êÇ7þÆ`°ÎøÑ´ó¹yÿ{™öôüèìºP¹Tܪ!GcB)-Ëûe›o rçDÞ×%p¦Ø©™'ÙÁc¾8Ga¥†£™˜„Ãü°Üs«:40A¡_Tã䜳>rMðûH1¿,uîÃ"8º -§ÐP‚Ôl™š'çKÜ»1œ a{<äsù—@8¹Ñ¯@´üš§PCU¹ š— /î-Bçˆe·–a¼@;}1„ä-û6›õ#VÁž¨iÒ€^’[M‹y^—pb‘´ü™À§ËµQ̈Ì7VÂøÁô‡œÈ 7N3Ìá¤ÓokEâ®xa²koâ Ï ›OdSòųU½Ò··Ý@俦o @°ênzˆbí'³uÃUÎUôX2ÍOááÞ –¹è›ZJNû‹ä%¢„t©rOãÃLÎ9Ÿå‹Kýb…QâÄÈ9n?««¿ ` q_úaÚòÄå&‰ -ý8jq1§š+ ›Úx‹s°dUº‚œiÐóÒ“?ö¦„ÆŸfä¯?8D¯ßËÆRsòüHþ£ø.B˜kË¢]ÒG¶e -këóýê6T‘]óW &‡’Q8¤øl:Åjã"ž~ÁŽ]K^ˆ°ÿçŠ!Ÿ ǹÂÒÑç @‹pŽ{2¥ü–úz Ìò…Λ»´~[Ê=ðydBbaÿ%+ÓcÝ _hâQ³†&¶¶ÈzãîJWX/µ5ñ€¥“L‹RÖ -¦Á55ÇÈå‹7üþ×{z_ì )/ºÎ"æ`é)wK°(F™(j÷6Ɔw·U²‰< çà\¢Uuý—°æ2Àií­5Ê’Å|7±òÓzÑ~jÛ©EÚªu©]Eu†Áÿ§R-[%Ö~HËÚ€*¸ßQ³}j+FóxóaÏyyÑWn•Õz­ç–„ùÁá&m -—fª §L•¼ÇÉ—ô¶NM -»!{æ)ò÷B232Ë[þ·ÄE"[óS/wŽ&Ö‰ì6}B{m‚^HtGlM{’kÑ·æç å¡ÍU-!¿“G®ÝMJ{ôåa¿Ðq£yöÁfdt[)/O=÷¶Naû¹ Þ3°bÓªå0Tëp$™C:©£BEÃÓÂn =l¨YqT€ê½§(ãÆÈDV³áub›ZYVlÞezÒcæjŠÀù¹Ûìþê‰ *†B™á`!iEóEª°¾¶ó~ô|ô÷]‹}+§<~9zàÌÄ[úˆUcï(Ì>ºzí 3VBrï ìØÚ{ Ýtf#îêÑœ-@Þêç'õÖwÄópŒNuÆÅ´ó[ÚU‡àÍIÅ…By'Šx1“ÈÞ ø åúvŒ·ûá×]wiI\hF\w(œÉ?éDˆòG9y°©åYz¥¯/§a"N²ñÙpÝ®s\„qŸ{ØA^³_zêC£ V\˜ÜÊ¢úlgú/Ê®XB[lwfiãwÈ •öù0ÿ†åÃlä¡/¡í}«8·Gˆg+lï£ÞÏÉ?Ù»t˜[ÁÄx^ß|=Ñ-m¡´»S9¬]˜Áœj{áâʤ Úýè,63ZY¨ÃCš¥>¤a‘¬a‹îPÓ@RH*Ÿ¿WÏ SK7d¥Ã v»k?Ï;s–œ§H¿~—ø¢A§{û¬ýæ#¯™–Þ.½âF5a×:ªsîÚJÁœ#Îo´~?âéÜÁê2_»ÉÎký½ÒlW¡ -bîÀÚš™y£0xÚ‡ÖQ“›…´£'Þ(8@Z"õ£íý.vb_ãU¥E)êr„Y”ºñêóYÅ—Éf·ØQ•÷Úh„ŠQ0§ žwÎP‡£¸$y!ÀŽU ¸ªûÊ›;×¼a>R˪7©Oï¸SA“ä{wHŠèXÎŽWù¦Ùd‹ð"Yp–’–3”¢_Ö÷•¡ NC¿?Py¯©Gú<Ôšüò‚(ynº„qv_ü«nùE¾ hà*Û–q­£“%½_&b T¤¨0í_ýrRb”udßÎ퇠ijÓ4üHVúüƈ`Rà¨Y)—7t=2ñÙgQ3<‰â·SOl¾uò¥Â.z—Ú·[†+¹‹ sgÛÃ$CùÏÙû_üSŽTFÏs›¢‚ÜÖ#Œæ¥ZÓûú?¾–¦Ýzwí NøªÜÍ.VÒ„IÅZš!>Ôê˜Æ:#>x‰ïoò—ÞÅWŒ>Q׬”°¼CC½¡øàH¶… -E¹'!ÓD׈w WÈ2(ãùü¬š"òa“ð îÕ„‹ÃP§ áš8¦ã -á~¾EÍo -iºhÐ% ˆï\“…Pzw³ŸTrȱMDban[9K—ÚŒïôêèIÈP¦¨±2[ÅéœG8¿ÒÉ¡Kï(@ô|áÿ‰ˆ³-£ÔebbŽAî-éË—A{{tzÑB[·k­œ¹X@•«¨ÝH­n»AìÉ;‡Œž†Ú9;þZôÁ¿ûâü7ÞSeÃZ½Κn1âšÞÁöÅØÁ•½Ö„‚ª ïÃ$¸,z<ÿB« ÅÒ¯H 6UÝ"lM}BÈ3iäíY“Ϋ–þtø8¿)¼’Ò¡Èetõ5Wo5Ýaœ„læR‘RNÇ ™ÚZ÷&ñ¨ÀÖý –·äÒLþ}‡Ô‘wÚ'ôxñ–úe7ŠkKFzÉ÷Xï‹p£~벯¥þê"£Às´ª¥5»….Ñq£õ0Xº,šâs¼Ñ³Ä/ä$‚Õ •fqÇ?(>ŸniÅ_ÅCUTC"ùÖ»RsŸ -!R>SÆtìÓK˜ÞÈ 1X£Ð©Äð $¹s_OeX$§¹‡—ÐÇ&+-;jÍö^ÛÜ^ìzø#¡g“çjÝÛð†e^q¯©á¢‚º“jõkl!«§o'Œ³œ…Éè é.$wéC5–—9z«Y-Ÿ±âës…£…Ó2±üý5¯¬é’¬ƒy }áÄ•½= æŽ?}ime´ùÜ#,þ¬bƒƒ’-nÅËÞ){qŒ3÷oÖ²$‡.ˆh¥c-I¸t”:¹Ó¡bô\·G7œòƒf`! kƒñ¶<'˜ò:ý¢Í^^z§xä–¥Tž`Égß¹c(fQëÚ´Î7â¢LÚ2DÑý£YeL2‹›UŽñ­t"ó Ùù]0ƒ ÅÖ,½ü<³OJ) ‘gnS׈¥¹³ámùÉÝo˵ä ís:£V¿5‡`pª.ý\•ƒÙÆp/P{ ø?œç-äm|ûU(ËFJô‹Œ±=a~°ƒ!Ù ´¿¥;‚ËÒ€©ÐK»ð<­rÐBmµ"Eýa^V`„cA™ÜJ‘$áÃø¾PW±ål -{SÁ ¿cµX„*¢÷„ò³íØCÄ$w˜é¹U±/§.Çÿ£DËCbïÅ×éìýØšq~÷Pû©o -BËïרe·ä?ÙmÎ^~Ð_YFâÐsæо+Ñ ÓŽo pìâr5NSæsŠ¶lßž}cêP…ô -8â‡z¸#Á½N+¡ç·6ÀP]bjlSG5«Nb#¿7ˆ˜àQÓ•?ÂMÔ€Úì昕ö‡¯‰Aò8ÂÅþÍ¡c©ÍORiº2ÌóËY™Ìúµ©¾àîNþ ñv‰–¬6j-b«?nj,sH‡sa~à´Ð `—2ëǦÐÉ¥O³[ÇÔ¯|ÜêËVU(+/½ÏÛ”m®»ª“æ3kâÒ ™ -¢ÎS¹Æö¢­;_g1ÕímM#âfçÑc÷·¾¡É‚˜0ô‡Yä cg"kúûýPpfÕºS‚jRš(Æ£’,û!j -Mxõy5]rèAñ–=ŒfEžKýiÆ1ýÏ­Û‹3êˆÎÎÿg&¹°ý`¿öÍ÷wVN»DØn›e~ÒpÕuÙå¿õÖ¹©Ɖ‡0Ì’¿ö4ýn¹÷–Sɸ‘æš „¥ø6¡É½ |‰Ú­´ö‘%vÉ'JÜ–™Âðw›–\¡åx¾ñ†Ê7×2^Z -Suܸ-Û)Aõp|Åð£ÐÌ¥Á-_`§=l¨}ˆµ :«c‡ fSšþœ{²ÛŽB!üÐŽË…æf¡04h_™çÐ-PÍz ÍþÞ9 í½Û“C}‘˜Yþ_]r$GîOzÍíˆJÓ½ÚŸœ¦x8•~W‹Î‘-iY=v—«üŠ‹‡@­+âR‘‹ëiPmîàVcý•¡¯û± õD‚PÛ›ê“hÓ“d©ö½‹rbÏ8Éa•^M¬Ùlq_r¡n™WÂ2ÆV¼™BÙ¤¹Žš\ÒòWeÔ¹î)6áYŸ:µ/ýäžËý¥yšß…Ï(ÒχU¬¬†b¤XT[VfÕÛ|Yû×Øñö«ôñ“ˆ8úiW»zÁ#ªð^_ðžK<‡`´HÖeφpOt‹=5˜»Yb»ïbtõO³-«ÃˆëÞ¬ ¡!Ús@Ær…ãôç}™…q“Q»g>Ul)·ú}àþìØK»cê)¢àBªv¹•TÓùì…+¼Œ®GÏ|F .Mu¹d¯hãW¨sqŠcã£,]œrpK~a‹îƒUا†#X+õ1IoØË뤪œ\]²C;Ǹ—V´ÅèÛ ¿ÄºdÙ z Hhºô0 àši¤°ŠÁ<øRZ8„Ùyà(áåeßJ.õ0xÊe›¹ù^·u<º_G7°îrxŠ *ŽÔl)fU@1¿nQ=zF\rÃÛß\\3ÏÚ¼%ÄßàQ…ún#†ÛCþ±uRšßkõt¦¦ÙÑ×oÇ{ª²·^“ïÈÆ+? ‡r® -•ÕñLŽ{ÜgÎq2©ëóH —ç%Ñ~_Ûé²Þm1Ÿw!¿¨DZæËóæ4ñ x@>i ‡ŸÈAS¹™Øõ$λÜòžZ<<_Ç]¦æeT}|fˆ ¤c™'[±}CnÜ$³.Æýà &¬«Çž}½Ø1õs´_ok99€e^óÈþnü] —+ -öøN’oÁꔂV;Cþþ¾æÍ¥½õáØg]5Aâ‡\_âB…¤jÄÉN vòØ/r=Ÿ=‰¾I‡Œ²Áö~³}›²…io­òB€:k»ñ¿;5‹d•¸ÑÂ;o èŸ[p«Í‹Ã9Í/¹h€„¨TòüAò¡“b•Å´qNC‡IÇ_¯?ªâ©H= Q:¶¸ÊŒó"ã“t ë7Ì áØ!Íò®g¹Æ%Õ9î&tâ³°õ¯i‹.¯ªæºH¬| îr>®ü¦’Ù“+Åñº%u cÊà…¢“3Ë—ÐÁ§”_3ú„]‡^¥ö)3_Öù¥OæÞžMålźÂT¯fçPp±ÜÓ°™EœZ¶EKPó¡C~g9@Ë*;e¦<^Z`˜•¦H¥m -oâÇ€Ì~XðR—œe†îÏ4Gj7Š#*ZåâXf¯³üóKwþAâJÑA íGXŠ;~Ý{œ!³, ó·äâ&Æj‚]JAcÒ|Ö(¬HoÇŽMú¤ˆ>ÅY°?˜.ö0áŠB‡èª]ÁHºÅÞd0N¹ÅÀó!ê€UÜæZß`UltDro$öPL¤Êù’×t$>×Ò7'&—EkÀôØ0oðRVö»+¤9ÉèûNŠŠeX†ÂëW@‘ ß7š[ 5(`DYûUO’šÝß‚ÜŸ“ Þ@GÉ”+F´ø°ŸäI÷ÐÙ˜º¾ªØ/»>˜º¤”•nNÊC9ƒ})‚Je½3m(¼rø^k"i¦_|w탓è¡ÿºO±©T¡ÖiÊ@ÏTl2[k´˜@ hp‚†¯ß0}cAéS=Í‘MóÌ´i¬Ž—¶·ôOwÏèGÀG•»,쯀Þñz€•îÓå3G ?©9ÛÌnÙ,Ú „ÊD+©ô¥³!›6ÎÖÔNl7Á ³#©Û/ÜØ(‚± -Ýæ¹’GúU;Ö/«€˜iMÇ#Æ,~•æ½èÓâL*™òOxÖ!~ñçÑï"ɨëÛP Ìé/H *bmÍbzí˜ßeæ/eØIétv·Ý~ǘ±F0«‹†#?4åŽ=ÂÑf´DU;aNýÇzòˆpÕ=1@aÕºû‰=ï?™AÆi‰6A¬pÉý¶=1W|‚ëÉ6'›ÄÞosSïWÈ1"ù¢ÖÃó}Tm¢«rúÉk€îGDŠ€*Ã6­„”¢tÊ—ÍçÜKɯãP>ÕÙÐá£9.ˆZÐÕ]gø»¤a;^÷Æ’-£û±sí OûršpV¡(ÑÚƒ6çŠÝßA°©pZ0AV/hZº*9e錖ò¨õHªúz‘~~·{q&¯RDô¶Y)Xh⇫ä¿2ôÔû[ʯfï Âgö]^é·EK=NÜ¿6°äWáæ›[ºÙ…”Z­»åUˆb}§ËƉyIK˼Û»:PP}¡ ƒjŒYÜõ¾î»÷·M/RéJfÍjŒhÈLœÀlú&Ûî°’Yvgë§ÂŽ>XÝO>èíQôRr¿IäÀ§è³<¡´*Kú¼œ;)5û°œA(¸>øÉ÷£i‹'GYD¼ÎÕ(Ї&†m®˜îr ø8jñ¥oW®jsÙ•¡§(ó»¦ZÀ,)uÉ1ú|c~Óò㽈ÓAw*0=‡êSdV"MÓBÛþñÞ<³†ÏP š©NJ)/Q˜…0œSSàžOk›ß`•´ÎK&¯—Ä/~5‡oç9LÿH©K=sq±¾ƒÀš˜·â­üŽ9[,®k§`”ù·®ï|,×'ÓxɽÊ;¢åæ âüaw²dˆßp9¼è‚xN,$›Jº#ê©ôµËÀœVÚŠûÑx˜&¬ÞŸn5à -y×nMC…Ffàôˆ)œ¸ñb*8CÝnÞåKoq%C ¥j±©BÉ¿D(§lÛTIáÐÖsÞ^8Ñ›¢¢Â •#¢Ÿ­0”ȱ2z ßø@‰L\‘bòÓsPw·š` `nzñ¢í.w.„—˜£ãÐ.Kù„d•=˜Î¹Y-ÇêÚt?ÌÖ˜ƒTÚqüÛžÓ;§ñWËÇ…Ø÷4)ÅÆzÚy½£Ta÷ã³ -¿7–f…H\ß’.pFC¦ý,Xç¤ØP—ÿÙÑ°“J?=]ôÎgÄÅJW ¡¼©Qa죦³Cªž¢ñ=ð'‘SêA%æe2c½ÆVœÒûÀ$¨@xÙ ÷^ÓôÂd$ú Ù9Œ„Ž©jˆvK—Ë%wM$y"z ´‡æf–{ ‰q¾&î®”3FaÖÊ•‹ -lœ…$ae«±nG%¾„|(ÔáÙ·9»Å{‹©óæÈw?ÛáqÙ°ŠvÝœnÌE÷ÔCä0H;^8ØXaövÞE -öy}¼E~ðŠ¡„|jCã±ó‹ƒP[±¯±%iA;O­qƒEEñ'ègåìn~Ò…î„ònó›äÏhÇ¿ßè)çƒp“!£‰Ž“—±»’9@CÕ­lðrÃ:º’¡‘ƒÔ—)$l×\kÓù°º¯5ãÔCÎG“ß¾Ã_òSëí!l³ÍÁJ1è;ÒíÕ7|ºkâ¨pÐPµžÑðxùæZ6” -—ð½sAÏSòGsª Ùᨮoì)yæ„š©Gé+GP½ØuD¡jà‡ÓÝIqWdÞ¨¶¦ -hBÐýt©þõÂ>ŽIt3eÁS ¨Pb2Ä>ñÂî‡Ñ%£I œŠ³Á.«ÐÓ_³<ÎRc{‘u³9tÓf3n'ì|É÷.¤ÒeXôL‰MR®Ç³˜6ᵪŽö -IzÎgçR+¹È3{ݦAX¥P†ínGáEz¿bõ¢ÔÎÜdÁf‘…l€fÕÝ„foY¦ë”OnÐTu®åoñË…GtN6Yˆ0ÇXIô‘H¬cgaõ7zØ^[ŒB<[¢ët‡|+-~QO†š-³Ðr ˆhcmZÇÈl,L{ÛL= -ÅIÿþVŸ–5h—ŒBó—^W¿„Ñ%q/ÂQ83!ýî𷇧ƒ¹Æ÷=‰]“äjÏÑÛD÷¡ËRÁ;¸’ÔHI{Ø8rtb¦Ô6 `ˆò¢Z'iö§Ö‚Êïð/Ž/ýÓŸ'[¥Y ”Šû>t¢Q?{©—*@¨Š@ÚËðÔ,w£âôØóÔ¬`dÚ»’Y8!>$vʘѶèàÛœiÒUªØךÉJ`¹UMùq4D•²¾ÈodЙ¨˜ÎSN–S«¤Šs™pV{â;|R 4ä8õ¨ªÖ™K¯ž*¤m†ºÜ'€ýž©Œd1Îzû^WUÌ;b5ªTÂIã5Ñ‚»¸¬¡lq„ }Kéô枺sñô'z•†¸ô—G˜Oj]Ë„ì)$cæ„3Ø@¬ù@ztS?ÓÛ®úzsåf–ÿÃÒÿ/ðÿD3; ‰‹›£½‰‹-ÒÿJÛ°Wendstream +/Length 3831 +/Filter /FlateDecode +>> +stream +xÚí“y<”{ûÇ)Â8¢´ uË>bf쌎}²}ßÇÌÍ c†1ƒAȾä$„ì[Š"ÄäØ+*GE’µ(e •]Ùz¦úsúçÏßï¯çõÜ÷?÷ûú^ßÏõù~¯ë1·’ÕÆ‘=@™D•EÈ!Ô]´µµ€ƒCÄÅu) †J “ô0TP@¨©!mš ÊêŠÊêòŠq@—ìG§¼ðT@JWú[’ + í RX @c¨xЗ©Å+2–Rér€6‘X~ÛX‚ %ÄÉAGÀRЋ@‚À¾2$y’•aÍïÏ¥@À4H1MJL‹82‰Hp 'fJfÖ™Nþ?LýSE#M1¾ßä¿]Ò¿-c| Dúÿ$}ýhT É8BúgªøÃÄh¾ÿ\5¤bˆ¬6É‹ð!BŠ âÌ T, Rhà÷0HÂýÓóÚ¾;€ék[[Z˜Èühç÷5s Dµ¦ûý%ú-ù;#þfæåPÁ€\G0™ïŸ_.ÿ¨¥OÂ’qs”” …‚¡C˜ƒÁ$% H80ƒ™~ar$2•¹`^É9À“L|릢ÃÓýð é[üGH€ù1»DÆýR`DLþ¯ˆ’*Ã’‰ä¿·©©1#‚éþ„ +Ìë'Td–ý ™jÄŸ)åû72‡Fþ å™þ~B¦å'd(à'd†ú2Bû ™…‚¾ã¿7PG‡*« ÈÊ+(JŠò€²šê¹ÿfC"øÓ@C=@ ‡«*üh –F¡€$ê÷ÿ…9²'9G  b!#ƒd,2Æ;‹W®_ÚWÉeÕñº“jz»ãy+wôð%VbùÆþÐñ:ûÍ9üû§Ù§Om $µ„Y0µF9³7ÉE§tÆfGQ cŸí0Ž˜å#ÛÉ—€Á„g~ŽºÉ‡Ö¦ÆoA³µ’‘8ž·Ptµ/ç‹‘pŇ.Õs­M™GœX´´×N¤H—«G³Œ(ˆöDõ)в5Íd*ÂÖ|ÑB 'Æ=§ :FîftË#2ù¶tçãäaÓÚ7 ‚x—´ká‡DlÏ×b芭ƒfÇq âÛ&¨#ìm¿½Ój‚¶KÍ1Ôr#æfI¿²Á=8%’ŠŒiþãsNWU]ºeBºª¤µµ¾Ï \¾èfb™É?xÌþ5‡'4V’¯z(,“,Û È=ëv Ÿ=Ìsgð$ÑÎF™YˆžŽtF— ¢>÷Š1gaã¿RškïCý=¨Î÷y‡qñüæN[bŽ¢Õ‹eJõØS¶~Õ¸ÆjÚËû>O‰µ<6›“çx’¢ªW„C]–Ãíïs×Äó ¹;Z°•$»x¹áwÅòßÞœ…Dß&^CØû\¦§˜ŒÙt5¶¤ò&V~*Xs×a†èŽ¾Ef>Â&‘ׂWg*£¡7дE1Ì{!_ñ¼hØvœjGÞx4NEô:Á÷ +]•ÑÁò«hå^ׯÿù%/†·Û»ç¾5âé-yth›hÂ!Âs܃ù–2“šCìÇØò69dN¦Íé[Y¿‘mضš3óR•9´Eõ8ú:ÿáþ&¸.<'£~™?òɯ†—dÌ{neÀÕW3/kç{9Óz§ê…Í\ÈÇ®Î-Ÿ S#ŽwF¤Æ¡ÃÕ0qÍw™¡ °„…Z‰I«I +K@ÆÇ€- åïdÃõtÓþ(ÿ0y‰_à=jœ½>ŠÒÞc{3Ùiî:bv¦ºn7Ñ!rˆ+Ú´ÃÉ)äLu€_‰£aŸ'o 4`›âv–ø4ÛöÓBÖUg\@.h{ÉÎH;â×Pð´¼Çö.÷†CÅ[©wo¶¡ó6›úU„p ¿hrN2sho,;i*x'ñ“²ÿƲàY±¬–nÚÅÝ-K!úÀû»ï÷~©Õ°3[â>o–\Œv0ž˜§f ŸÒzyã66-ïå3•2Y€– uàÜøGß­‰aõDúÜž÷÷Š4D{+ž>#è^ ñkÌ“3Ý9¦°ØXÒwÔSða)”‘;|ÍúÝA9ã ÄIYP­¯ƒÆ¡‰Lç; ¢fõ}6ª¸uZãíÎûÛE@Éð™Á=u¥×Ï[¦‚k[+t­Ûg_Ñb¿Æ¬Õ£T;²ð|F²7/™~ezêMˆzdû?Ô¿: ×[SöitoÉ6¸¾][ôŠZÙ-°í¸z¶~Ò¤g¹JŽž€Pq&©}y/,pû/uélùȇ˪ zæÝ;Æ»,çovp‡\qíÙa6tù65ðßã,µ…Z£qh³k¡ËJaî,ƒÇÄ~åê=¸kœÞ£ÎdzåqƒÉø‘YSíùñežÛÙõE{Ú|ð*!*±bþþ°hÝ¡žh¢ÁГ-UÜk‚¿];é¥Á@Þ'ÿÚÝ‚3ÜÄ:Ù/#[QË=¼úkΆÕqL²ŸG{Ñ×jÁåãn©¦Òõá‰ÝôêûÃÙ9vÅà-Å¿²½ßf8JÍ{·äÇ2:ÐHÉ*QÄ|1­º‡ØÅÛùDHˆ=Ì4j—b==•x¦3ã¢ln9ëjáêÊ'eó­/VìVÓãœcx¡Ù‹øãP>®-Ñ•[t 4äßä{pU)âIÒ#–÷"+»L¥\RŠGáCÉÓ®x¾™Í†"BW3…ýXoáGŠÊþóT¡=ÈFdBráÉaÖ¾„JtŽq(«ÄÒ\éñ¢ðÄ#Ýï|ošX¡P­ÄÛT‰¥w 6Nßà²trqJ*©á †SQu•Æ‡û0qóÍØÝ«´½‹%'ÝšˆË’:Áâù‰-9E¶†»ýxÙµˆkâÌѤ +jB) +lÄ‹»ßœ) …Bž u F'ê9@Ü®8ÕÁÏx߀j¼é?ZLï­qê«I=_5w»jc0m8a¤Ê¡µ_¾h&Ø‘»÷*aã¨vS¯ýzM›¾¦á1M× °ëmUpnŸ§]‹Nž¿^_§; ´5¾åÚç>®"¢JåqÄáMªÊg-m‹íýŸEßÆéç Gqöqu/²ø°Þ?zSnv븿“˜Ì#ø )óãóþü IçóO£žX KKºŸH VP¼¯¾(¦UV~öw/u®èùƒˆýÃÎù½5e}f¿ ÌDŒÜBòãi\ƒ<Õ-WÆó¬³ ´jgR®”³ò²/<Ó}nô&>£úû]¹¢;Ùwl\/‡³jFI_ßU>Œ3Ý 8XŠg Gt÷›¹»ôœÔLKý¡¤iBîqîÑb‰Š[;[kGø-Û¡;CUtÀ&]¿NüÛ0¶í9w¢ý–9/r¢C~-ÄN›Ë“§â³Ïã8oX£–‰§o‹DD}™]ˆ£F¹Önͪ4òH^ëÆVõæôë1½4FlÕŽ±¬Ù›ÂçŽ85>±Š/s½O9šo§g J˜ ’ן”µÜÝ)1 ±¨?è5[¿d¶´Ò°…É=u§™>õÞæi¿÷G!d^çµe‚óäeÒ—ºÆnŽ}__y—œ°Ú[0Þ^æíÊût_åéºâ&r)åÕÚZc+ö𶙑Í%Ça1üöùZ±BŒÝÈ=ëšÜ"ï 2E"G +÷Þ¸™ÃëØ8G/³™U»}óÆ¡©ÚéÓe䛣{]Y_Åó)óz£!Æ°µåcAûf +p„³ÕXNù‰]U™Ëk:ÞŽÍŒ¬åÄ%û5†xŠ’ƒ#£Ï<©g{²×Ÿ¬ßçf–o¦ùVC ­zÇùz§Å±>Ý}!ùY}é¦ä°“ü"±ú¹UÒ×&EPÜ /ÛyîàHÙ¼ß +¹ØÁº~§Óƒå64áñâ—u$ç&d•ƒÔ[çÊçSàoÖ•Y®èpŸ¥u¤L~É -I§ªCÇ6I˜(Å‘«¬á*á¬×кÒÂ;¥ +¢ÃVÞžíÖœ³¨ Wy?TEÊÛmÝsħDQ¶Ê ‡'Éññâv»åŸæ¬Ô+ºƒ.,ªªútØiÿI]"NÝ[T²ÁxÃs}ð¹Ë@l>‹@e.ò´æ3Cr® ãrßxæísaE—Ãã. ¯CŒwÛ½"Ê»®üÂúÞ2•‘æ}ä |Eéñ$›Û¾"Gyc„Df$ 2²âðÿãù¯À„–b(T²/†âù»endstream endobj -5852 0 obj << +5937 0 obj << /Type /Font /Subtype /Type1 -/Encoding 7207 0 R -/FirstChar 33 -/LastChar 124 -/Widths 7208 0 R -/BaseFont /OOFDDW+CMTCSC10 -/FontDescriptor 5850 0 R +/Encoding 7539 0 R +/FirstChar 45 +/LastChar 119 +/Widths 7540 0 R +/BaseFont /EATRQL+CMTT9 +/FontDescriptor 5935 0 R >> endobj -5850 0 obj << -/Ascent 472 +5935 0 obj << +/Ascent 611 /CapHeight 611 -/Descent 0 -/FontName /OOFDDW+CMTCSC10 +/Descent -222 +/FontName /EATRQL+CMTT9 /ItalicAngle 0 -/StemV 69 +/StemV 74 /XHeight 431 -/FontBBox [4 -233 973 696] +/FontBBox [-6 -233 542 698] /Flags 4 -/CharSet (/exclam/quotedbl/numbersign/dollar/percent/quoteright/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/greater/A/B/C/D/E/H/I/K/L/M/N/O/P/R/S/T/U/V/W/X/bracketleft/backslash/bracketright/underscore/quoteleft/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/r/s/t/u/v/w/x/y/bar) -/FontFile 5851 0 R +/CharSet (/hyphen/period/slash/colon/c/e/g/h/l/m/o/p/r/s/t/u/w) +/FontFile 5936 0 R >> endobj -7208 0 obj -[525 525 525 525 525 0 525 0 0 0 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 0 0 525 0 0 525 525 525 525 525 0 0 525 525 0 525 525 525 525 525 525 0 525 525 525 525 525 525 525 0 0 525 525 525 0 525 525 525 525 525 525 525 525 525 525 525 0 525 525 525 525 525 525 0 525 525 525 525 525 525 525 525 0 0 525 ] +7540 0 obj +[525 525 525 0 0 0 0 0 0 0 0 0 0 525 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 525 0 525 0 525 525 0 0 0 525 525 0 525 525 0 525 525 525 525 0 525 ] endobj -7209 0 obj << +7541 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/alpha/beta/gamma/delta/epsilon1/zeta/eta/theta/iota/kappa/lambda/mu/nu/xi/pi/rho/sigma/tau/upsilon/phi/chi/psi/omega/epsilon/theta1/pi1/rho1/sigma1/phi1/arrowlefttophalf/arrowleftbothalf/arrowrighttophalf/arrowrightbothalf/arrowhookleft/arrowhookright/triangleright/triangleleft/zerooldstyle/oneoldstyle/twooldstyle/threeoldstyle/fouroldstyle/fiveoldstyle/sixoldstyle/sevenoldstyle/eightoldstyle/nineoldstyle/period/comma/less/slash/greater/star/partialdiff/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/flat/natural/sharp/slurbelow/slurabove/lscript/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/dotlessi/dotlessj/weierstrass/vector/tie/psi 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/alpha/beta/gamma/delta/epsilon1/zeta/eta/theta/iota/kappa/lambda/mu/nu/xi/pi/rho/sigma/tau/upsilon/phi/chi/psi/tie 197/.notdef] >> endobj -5830 0 obj << +5559 0 obj << /Length1 794 /Length2 1135 /Length3 532 -/Length 1714 +/Length 1713 /Filter /FlateDecode >> stream -xÚíRkTT×Â# PALyÄ’£™2/CQžCx qx)Ãc˜{.ÌÜ;ܹà OYQC@!ЀBè¬X‹( -…R#…@x”ÒhA1½@]YÕŸí¯®Þóçî}öù¾}öùlv…ñ¼ ,æa(áÀ¢³¸À'$$À›Å$`2)66>8,$ õ0°ÜÜœA BØŽ€éÂå8q7DÀ“eàHR2¨>´ ‘ ð’Â8"¢ DH$ÃR²†H(|L„ÀDxI$àÀÆ 98Ëa<†è @ˆˆ‰p‚R¦P1\¶hH!{¹•ãrÒ nÚ¤Ò$„¡’ Áb -c?FvƒI/ÿ [¯ç)$’ýBéFù­¨^¥ˆ$ã_L*S0B0ÆÑW¥Qð–;oLòZŸB(AD^h’,':Ói‹Gä,½¹ö7ìSl¬¾ÏLPµlúbÌ¢ëÁHê_Œ*ݎׄhåKfKlž Êñú&§«ì‡‡ò.HUGée>µü¬î?*ßzl7P~âPË(|í¯4Û"Ž.—Õ% -™\ÕË¥\ji{——ª,­ú™²½ùý¨' ‹–G¿ozp‡£‰YiÞ cÂÀsg™a…í¶áË{o-ÅNï›å]i)?r"ªôÃ=žKÅ_ßìHG^ÔÚãO“ñ;£Š@óó‰Õž †å؃ÇDÿ#Ýè_Trg2 ×kôÓöÕ—œ”è…jðÇó)ûz«sç4n;C«é™Ö¸bp*é×¾ ñVˆ´QWÝ“,Ÿ=h†€NUsÇ»Ë}óÉ·ã¯îL)þâ¤ÎbÇêð7ßß+R^±K.̸»òæjýPhä©Ol÷£gLg\•q 4´?¶K0w±âb´nß܈®z×$ïÇ<Ó¦žÞ¶³1îoç(ýnµÅè—Û^Òn]¨?%ÓN³¬Þyº”f5ö­²Ý¶ÿ¶ ]çZ¿9íÅ°ØAwG`üZbItfhmŒYe®»µZ ¯w†ÛZ]«¶Wÿ¤|'oxåÒ˜Ö{ÉÝFÍ‚ê¸]Ú¨”ß:CT¢%š+KgÚl.ß6û¨O¨ºZÁB>Ã:ûëv‘UÛÈ⸆ìœ+ÔÏ•ìý1¯p~þª¦U çOA± ùÂÇ´vUHSDÔE­¹©.íÒsãgO\>½ÿè@² §^gP£™núÜ­]vÔýšSŠÑo¦>r¨ wú¨ -„F¯´Öž¾¾íðO™¡7²ÕÞZ»z¿p¼ÈØ·ý™–­FͶêG…~3‹µçʾ­+þ‡f•ß'ƒK )¬`t€î”â¸'2®Ÿ?µÊWèÿÜ0àáÊ?=ôÈ1ßp]2¨ÿÔ>Në‚zº²nx -»žëYó÷ë–~éWÂøõçã;Ä+ ا:µWá•ø扵l½Ó‚!=7ÿ,dy6sfRû½SƇ¶÷/ïNèé²îêxéÚƒçÖŸõÄ -~;]ø¡µ°Œ¤( 8–éùƒš˜àdÏ5IåYóCi:ý}Ñü{]Fù¬ï"šòŒ eÏ—¨¾‹ñ%»µ¦-ÃÔ'†<^S·ŽâAg8ã¤åeîH|‘º‰‘äÞÁý"&o¶5û¦Ž)­ÌŒÖ2z[­! <çR”ŸÛšO­|¼ó*¦çrénAÔ÷®]ëøɻ˿j¨k·ÛÝbèF]§ï ä ˜˜UíÐÿ€­Þctv¢:<º>õD»{£½ÞÌHнƒÑo| ‹q¢N™ƒÒ=-ôÞª}vÔ?ËŽ¼¶:ít.umNÜÈ7›e§0ÿÃòÿÿDXˆ˜Tˆ§Rþ psŽ endstream +xÚíR{8\gF]j°!Òº4«_¢Â°æƸŒ•¸ŽºÅ4#HŒË˜s†ÃÌ9ãÌ3®ñMˆ$R%¡R’• jGû4›%A%IÖ¦QJ]jm“ŠH÷`óôÙäÏÝ¿öÙóýsÞ÷{¿ßïýÞïg³ƒÇwô†°˜‹¡„#“ÆäßÐÐ@&€Á ØØøâ°@0ÔOHÀÀtwwA + `9†+‡íÌY_L–Ž#‰I°ó¥®‹\·Æ‘¡B" –’5DB àc"&ÒiÀ["ûÖOÈÁ>Xãi0D£0™BDH€”B_7ˆŠ1àºIC +Ù‹­4—“¦€Ý†M* MB*I,¦Ð÷bd7˜ôòß°õrq®B"Ù+”®—ߌêPŠHÒÿ%Á¤2ã ƒ`}Y oºóÁ$¯ô $„Dä&J`àÈt¦1œ7yDÎET0ÄCQ %rxƒ‡Qèed|.輟}a/žvc—'DP"<]Æoò Ìü “!ሠ+D3h “’ëÅ_ÌKÝüQ!h"`±]€Ç…érˆHÄ™L€ ¬°Š´L§¡Ad0Ù@Œá”õwuaº–Ë×ÙM‚è‰ë³G†·Î½z7L•éÈdG›lÅbºW6#ûß…ûQ$Uú6ÃÍÕɵÁŠ8£ÄÆP‘¹½Àb„Œ†U°ˆ2zyä'Ÿþâý†ÿOn]Ô¡Ê·WÔçßl/PWxÐæ¿óØzÿr0¶zhR`’Œ\2._n¢Cbö¸ÅÞY=™|zÁˆIÑ6ê¹J¾Þ¢h^«Õ[ÝݹEz¶ðÇÑ·}é°øWë¥ií:Ÿ…Ì2]Ï[,i7Ü»»ö('åPÿø¨ÁÈzªœSýç28bæAÉÕŸ°O°Ñº^3Aå’éóQ‹ÎûÃ)3ªp?Vªœ'už)¶y< ?Ê혪t Ì=/U¡•úÖð3»þ¢|ã‘}ÙñƒÍ#ðÕ勇…l]³S:±¢—C¹ØÜú7EYR>2ù+ekÓ{‘ã=,?zÏôÀ6'³’ÜëÆ„×öRÃrÛ-C—vß\Œ™Ú3ýÜ\vøxdÉ»¼‹¾º7О†<¯qÀŸ$á·GAæ窼ê; Ë°mÝN ‡Ó»ÐI¾¨øöD`!®×à¯í§!.>!QóËv!=È£ìé©Ê™Õ¸â­¤eXãŠÉÄ7ýêã¬iƒ®º;I66s(:È ª¦öw–úžæýoÅ]Ùž\ôù …ö•¡¯¿>¶[¤¼lŸT~gùõ•ºÁ°ˆë“Ûî2FO›N»)cã!¨?qoL§`öBù…(ÝÞÙa]õŽ îϹ¦Ý=­g¢<ÞÊVúßlÖ/;ÄÛZÜf]w°/9Ã^³´Îeª„j5ú­²Í¶ï–+MçjŸ9õùØQw[PÜjBqTFXM´YµeŽ‡µZ ¯u„ÛZ]­rPÿ¢|;whùâ¨Ö»I]FM‚e»1ûÔ)¿eš¨@‹5—O·Úœ?Š?i +ØW+Wu¶€ù<ºuÖWm"«Öá…1 ÙY7¨#ÙýsnÁÜÜM«jö7íÁ1ñyÂGÔ6UhãþÈ Z³“Ú%góÇÎœ4¸tjï‘þ$Av Ö Z3Í<ì™{›ìˆÇUçd£ßO~èXîüa%<\n©9umË¡_2®g©}´vôüiþX¡±_ÛS-[ê-ñv·øO{^(Òž-ý¶¶èš•þ,‚D^þH?Í9ÙiWD…U7wr…¯Ðÿµ¾ßÓjð¡Sžášd@ÿ‰C¬ÖyõTEíÐÄ»–ãUý÷k–þi—yüºsqíâåúû¬“ÚŒ-÷Nxýøj–¯Þ)Á ž{@&²4“1=¡ýîIãƒ[{C–vÆ÷âv²®ª8éêýgÖžvÇþ0Uðµ°”¬( <šáñ£šggÍ6Jå™sƒ©:}½Qü»žFyÌïö7æÊž-ÚùY,ÄîxØ”ºÛ=6är»t÷;Âé',/q†ã +ÕôD¶ýœÏ£sgZ²nè˜RKͨÍ#·ÔÊÓ1Eù™­ùäòGÛ¯`z®ïäGþàÖ¹†Ÿ¸³ô»úÚ6û͆ž<»5Úž n¿‰YåÎ~ý÷Yê]Fgƫ£êRŽ·y48èMß=õÚ§!°'j•Ù(ÍËBGR9¬ˆ{¼•)ç³)«4âzžÙ +™ñ~”ÿøŸ( ’ÀBœÀ¤B<…òOßþendstream endobj -5831 0 obj << +5560 0 obj << /Type /Font /Subtype /Type1 -/Encoding 7209 0 R +/Encoding 7541 0 R /FirstChar 60 /LastChar 62 -/Widths 7210 0 R -/BaseFont /OUAGMX+CMMIB10 -/FontDescriptor 5829 0 R +/Widths 7542 0 R +/BaseFont /PLBROG+CMMIB10 +/FontDescriptor 5558 0 R >> endobj -5829 0 obj << +5558 0 obj << /Ascent 694 /CapHeight 686 /Descent -194 -/FontName /OUAGMX+CMMIB10 +/FontName /PLBROG+CMMIB10 /ItalicAngle -14 /StemV 113 /XHeight 444 /FontBBox [-15 -250 1216 750] /Flags 4 /CharSet (/less/greater) -/FontFile 5830 0 R +/FontFile 5559 0 R >> endobj -7210 0 obj +7542 0 obj [894 0 894 ] endobj -7211 0 obj << +5322 0 obj << +/Length1 774 +/Length2 1145 +/Length3 532 +/Length 1721 +/Filter /FlateDecode +>> +stream +xÚí’}¿¯ùû>~4®E¶ãIƒé0¸ ü¼v3 ssw‘(Žm‘ÀNN0à*ÂUgsX0‡Å„Ì;©$ÐðXº[Í‹WŽ¨X„ˆŒ@äT±Hüp1ŠJ:àÊdÀw~GðE¢"‘Ð!TL‚P$Å Ûy&>†‡·i‰"ò])!¢((`IAZ +Q‚c2% a­7N…P$ÿ ¨ÅÍ·+d2o‘|¾ýO>ýJ!’£2åO\© p B`‹¥!oñˆUÈWù¤H†Š¹X¸ 4':‹ý6FmGc‰JŠ#I(…4‚IsPî-PØîðýyŸXÿçaÊ>"#w+#ÀøY¿Ã?Ç”Mt¦„Ôz÷´è8LŒKPŒš {6„H Q#BEö (&AbC!ÛÒ1œ¤¶Ê™†Ðü»2ÙÀV‚Ëd"b>ýú*<G£ÆŽfÇd6ìØNì„_êö`è§ +„¿ Ø3 GÆÛ‹‰`äÂQ.½‹ÃPÊV‰AÄЃ.\üa²4«æð…Eѱ<¯Óg<êr©±'í6<±<8ªçf”Dz ~ZF:²ÌšŸ¶¤ ®/~˜ØefÝ*2 Òµ¨}üÊñÉÞ˜Úy§{Þ¸~–rs_låòä ·/†}‡Ò«Ú_ˆ:­—Y¶¦AßÒcÓm4”~uÓŒ½]!ʃ’“˜yüwû¥ÓIç|¨ͱÞÇÚøCÓÎzk*ÆÝ«*Ú› º’˜½Ý¡yËN ¬ðH.Ä;Ëb·Vl»ÀšÓ9;Ld•û;[¸VÔdaYÎê=Q³+uê%7ÄôÞCÿ›'¡´Ë7²kOé.KZõeiƒÞZht˜¹¯úš¨.âÓ©àgÕç¤Ïãíéµz9·/þ"ÿÇRÍ¥®¡K¤;jß«ñ7°75ÊœÚÛWXP³Î¿wrIxiÑó;1Î!zº!²ï§Þòâ 2ÌÍ¿MNt3ãwnÊ¿¾ª¦¢Ñ½Wé;õd“Fúitá\¥E[â}ÏuaZçÇŒUcçª&Ø4GÃdßgm7殿üòZhú+£ðžýEã*¼É—&½¡~¦QwWc®¦·ç²C$ïwu·´ Ò. ÅC³«ß¨›ƒ…µ%îVÅí«SšŸ³z¢ô¸r»‡ÓUʶ½ßcZ +gn î—K;ŒÜÚÚëmÖ´xlðJٯ١šûâ†Òu‡Ec_µµÐä[øÎsåþÜõÂ;.²}[x=ë®Ä L¤R} 0XðD *sK-•{¾Ê˜ ŸnâÇÕ'jÆëdÿÕ®ýpÐÜè›ÄÉÁGCÕÿkæ›4‘cXFtˆ‡Í÷%ñÔ½Ž[þvßÏGË5£5Ë)ÃRÜ;k˜(Í<£}G˜{*U6Ó?sFY3£B9gí=;ÿùR_žóºÌ×6]vüÙûÂ8—å݉Ú[n qy’4ã°Ó¡ÐšÜz¯Díªj,ëÏLhSV456N–oVßÊÞ”°+ÏÍuâ6l·Ñ¶X­tmý9'Îàñ@ƒ´ð7ëMŒ¸Àçl33hÅËŠÙ+þw§%¨2±fÕÇÙŽ^s?d÷ÓïòŶVÙœ³8fÊٮѣöý.ÉXí g²–\•Ö” S¯ Ž,1LÕÍ,ÔEµŒç÷Ízí°çu9œþœ?nÜØZ9j¹ó±¥>Ïqoãëjÿbƒ,Ö NIu&„9¾Ð¤}“zi4]­Å$½;Ï^ÿ~ࡦC u’Ô­Ò)£ý‡"¿o ¿å=íNyxüƒërKŸݸå`Ê3¨¡vÒçhìƒóÝæ—]##6ó|G’ÒÌÛ²3€ÞÊÕäãÒ»#M#¦Ñ4³Ä*Ê 8)m Ög«úI¶ûpñW:Ö;µ¬n×Tþ±hòO+‡6ßÍž;2âß 5œûFÛ*Í«W[Äy± ;jèj‡_-ÆÖä+"š,/ÕVÇ<Æoü ÿ7øŸh –!"‚Äå"b?ôoÝŠ™aendstream +endobj +5323 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 7539 0 R +/FirstChar 36 +/LastChar 36 +/Widths 7543 0 R +/BaseFont /GMIXBZ+CMSLTT10 +/FontDescriptor 5321 0 R +>> endobj +5321 0 obj << +/Ascent 611 +/CapHeight 611 +/Descent -222 +/FontName /GMIXBZ+CMSLTT10 +/ItalicAngle -9 +/StemV 69 +/XHeight 431 +/FontBBox [-20 -233 617 696] +/Flags 4 +/CharSet (/dollar) +/FontFile 5322 0 R +>> endobj +7543 0 obj +[525 ] +endobj +7544 0 obj << /Type /Encoding /Differences [ 0 /minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/arrowright/arrowup/arrowdown/arrowboth/arrownortheast/arrowsoutheast/similarequal/arrowdblleft/arrowdblright/arrowdblup/arrowdbldown/arrowdblboth/arrownorthwest/arrowsouthwest/proportional/prime/infinity/element/owner/triangle/triangleinv/negationslash/mapsto/universal/existential/logicalnot/emptyset/Rfractur/Ifractur/latticetop/perpendicular/aleph/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/union/intersection/unionmulti/logicaland/logicalor/turnstileleft/turnstileright/floorleft/floorright/ceilingleft/ceilingright/braceleft/braceright/angbracketleft/angbracketright/bar/bardbl/arrowbothv/arrowdblbothv/backslash/wreathproduct/radical/coproduct/nabla/integral/unionsq/intersectionsq/subsetsqequal/supersetsqequal/section/dagger/daggerdbl/paragraph/club/diamond/heart/spade/arrowleft 129/.notdef 160/space/minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus 171/.notdef 173/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/spade 197/.notdef] >> endobj -4848 0 obj << -/Length1 826 -/Length2 1389 +5160 0 obj << +/Length1 779 +/Length2 1014 /Length3 532 -/Length 1989 +/Length 1584 /Filter /FlateDecode >> stream -xÚíRiTSבh#¥* E AQ™Ò2ÉŒa’¸ps’‹&HÀJZ®'f$8 HPAª.†‚àæ-AR5¡EµñÐv=ýùÞ¯·zîùq÷·¿³÷w¾}¬,CìܘœXÊAP;"Žèxø»‡D G `­¬ÈÛ2qX"`B ˆã ‹ŸÕä°8yf&s?¤ö€<¾F`=«r# ÑÈä °`‚,,~GÓ ÔHù_¨ú¸85†wÐÙ³åçú„@gC°ð=…Ãæ&£ ðç0Aò1u'8¯ÎÒÇ¥Ãà ‰ƒAÀŽè€#çŸ - @f „2âæƒs8ˆ0?¢±oN>8(Ì-"ØöÃdç²tAC…\ üMŸ‹‰Ç—xˆ"h\&jˆšïÃß®ºy! Bâ{G'€ÎãÑ…XÍÒDŽÀ>"!LP€d<á š#€ÆÀâð°³s%ì|,Îa…ÎæÞä÷ðü ÿÂ5×ÀÇÒ‰|˜ÎŸƒ?½¼»;G°ÏΞ ØQ4ZH${ÀÙÞQôŸÄ0JJ½=G@v²ŸCÉ<ˆ s¯Nc쇘i†‚½?Àal'»ø]Uš—¬ç¬®¶{\}ÞŽÚ澫K2îÒ†OÝòM²‘ÿL{}®ÐX_¡«X³÷­)?ûJjP'õù7IyÇûÕŠ=»…)—Li“…þÂQîÚé ¥Áå‹w¦TŽÚ½òÛU‡#*ÛKÆo(OZ{†þ¶hÈB«%jO]K‘؉L£Âa™ßþ¼ždlx<©*Ë!óá^ÃÃù vg¤%d.n°œà\I6z-[\.UGO¤½1Pú1C2Ô’ïJˆw=Ó)^¹+rQ#~ÅímýïÆ*ïmž¦a,îù4jgžê\³ÿÅÐò:ÿåÑ0ÏÈÞgÎ ZŽst©õ•ŒÐqáL„cØ‘ÛÞEIŠ4 ¥õ-<Þ,£ú O^ùºª–›Ôž;‹ÅȇúgÔg#Ûj¾Œ:©ZÂx†¾ØïýÈ!î®n®q…­¼fëÃ[õ'²‚â{£Œ ^iu¤^á¿3¢úÂXb±Ý¢ßà·¥Õ£ù«ªôÚ;×g|§¯Wû¶þqî)^ðuêåTãÉ3a÷%J²e±ž9°ÝŸ€Ýûl¦éѸ'£™´0=ýئðÆå¶êÑšÈÑkßf›Ê?M+"£›ìÃKÒǬŸ×5¿˜þ…}¾¥üËÛA;VÖ&ˆï R ÔQb3 -†¥ÞÐa4¼uí[ñ™8Ìú'õ´.ý^†™42b¶tCjÕV@"Zš·SÇš >‘í[q>ú‘þcõË¥6Ř£;…D©Òü8éi“e¡#íÕ .5õ17¼Â—Y-–#äzCÚ«K©«Šü”ÓWíØâ*~ôé[B$pkÉiLÆà—çrnqeë„Ì«z€`£)bÜZzð;÷bÓ¼ëGy%‰r¿îuMZ:yw?à_VUG­j)ÚÄÒ›èTéZ—Á5ãÀ‘XÑ0‹ÛxÆʽÈ7wTh½^ÓäÜ~M:£³P)‘|ã„¿ ëCÏYÕnéqÉ)ýq»ÉŒ¡Š©¢=·]\@jNLÎ÷®bGZ‘ǧèín _Eì··š¿å•rqø“hÅ¿jÓ²UX½.ÊæòμƶK¿6D­H¯ÇÖtÖG¤Äô¨ªÊÌ è[C‚œêLþõþòc7Úb÷'ø2V9 S;Jœ’mÓa¦}–Mì¼Þ6_¬ÝgÞ/U, ä†(õ¡¯½Ñè™L'©Æ¼]¼’¹Æ‚äøÚ.ϨôöäkÚÍU‚¬ÜÝOÌV>Þ;>b 'N67Ãÿ^ÕC¨|µT9†©þ¡.'±R³JU'ģM«GBפá¶ÔT´¤€=u°ÕV·k{z|>FIˆð#·oªÍWY2*ÂÍ&:ëRß)÷9¦ÅðuCÀà–ѶJâý¥’^rŸ¶~ñnÜ€ ,8§°7oÎMðé|cåâ/~xõ«®î˹ԔܕèjíÝ*óÂÖýØløÄèD¹è鯿 -ÄåÛ¨—º§ÙV¯ØüV;[«}ÐÁ­Ö«“/Š]½£ ^WCšœïß,‘˜ MXÉqëê‹Kžõnµ¤K3ú„m6SJ·iy/Ç›8= ¿â_šuhA=ÅÍçt,ÿ ¥ãT¶o­ ­«Ò¤*mðA€òóp©ì,Í°Ç-ç‡X˜.É÷¦JÖÞÀí?=Äž°\jö(åðäW—ûóþl ê.gõc2Çø„Á'–„êD߬‡õhêPîõy“Ï)ño%u»Je–þ Ý»ÊêÄÖ~èó¦—û\„Š8­{Ñû–«ºªsŒÛÇeŸv.pXut·gÐebt¹âpÿç™Eb+ʺ†\Ú÷Š¼< ltêŸr»|M©ÃéZ±“­©Â¹°ÿø¿(À€A:å°é¼Dì¿5Ü*³endstream +xÚí’iTWÇ¡JĸîXûP£B–•ÕYD¶2/a`2“AE‰ rTE¥‘E܈©r\ÊâŠiQ±Vb«VC¬ÇSüØ~êéÌ|x÷Þÿ»÷7ÿ÷ØA6®½œ²áÙòœ»Ÿ[Ðrðl¹\&›íNB1…¸‡˜‚΀'òOøv€Ïs¦?ž“ ܉‰Êb)`é>g@$®rH¢1üÄT,”Ó=$b R*[àŠa`éÀX +\ [&TB(Cq&g€É—@ð1$%|*­„¤‚†–”s͈8¦”29þ= Ò(ÿÕÐæ^Iæ/–´ÿhÔ±ÅTIyBIàG ćJ—ÁtnöÅoJŒ¡W\†A`ó·åÚ9|,  +/T ‘”’Ä©SÀÁ<Ä‘¡ ´}ƒœ`ÿ¥ž"ëO';X £8¬J€€ûY>ó>Ç´K$ª\Úe-¤ßO«¨!Ó?*ýîCìÈ5Q¢•öTØ»²½fcŸ=ýfÕ{sÅ–s)×½^®KÌÊkÕ?]¹âéÞÕgÌÃ^íõSu$LïIï49[ÕòZç`¸¤IÛXºsù¡ú}]W:Xzÿ2¢ÍÂ@±ò´&_í(óÚ‹…lÚpj–ÅRV^béfûMW±vfx3}MÜ&ãëÝĹ$ÓwÅÆûsô‘Ýkþ0Ñc¨¾6=£M“íÂu)¹žÓ39*|D-gRãÂÖþ‡îÎë cXØßõ©cn:rý›´7mãO§*Þæ†x„7M*9¡Ôà}„Sd¡Wo1·¡²dy'ƒÕ°½þ†01|jpXóð¼ºba€Õð¬Wä¢?¡¢ì“¡mkíÓ ÿ¾|kxÄaÝ(Déü&Í»Ý^vÇh»ÙAkmkß‚‡×ªlŽ ŒmŠ05Éͺ`¹iûÕý±33ô·Wû&¿*˜õø§B?·Éî~M»®¤Ù×6„¾ì}ÖVmœo ¼êms~WèÔ=»›º*Üß7§óN‰VçeŒ"~lJ“ÏÙ ñFA†¬ÚŸå#Ò*ŸGÄ×vÎe#¾W“ür»5þ%ßùŒI·–Lz4Ys/®½ÆéëÙÊI5ïʺÎKaù|P3ªßÞy-½å,rdGÍvþkàŒzÝø Mä°Æ{¬¨kcà rÝŽÎi‹//³ªº•Ù6mKs²ÖÞ·ûæÿ þ $“!“ñÌ?µç\¨endstream endobj -4849 0 obj << +5161 0 obj << /Type /Font /Subtype /Type1 -/Encoding 7211 0 R -/FirstChar 102 +/Encoding 7544 0 R +/FirstChar 110 /LastChar 110 -/Widths 7212 0 R -/BaseFont /RQUAYR+CMBSY10 -/FontDescriptor 4847 0 R +/Widths 7545 0 R +/BaseFont /TNRDEK+CMBSY10 +/FontDescriptor 5159 0 R >> endobj -4847 0 obj << +5159 0 obj << /Ascent 750 /CapHeight 686 /Descent -194 -/FontName /RQUAYR+CMBSY10 +/FontName /TNRDEK+CMBSY10 /ItalicAngle -14 /StemV 85 /XHeight 444 /FontBBox [-27 -940 1332 825] /Flags 4 -/CharSet (/braceleft/braceright/backslash) -/FontFile 4848 0 R +/CharSet (/backslash) +/FontFile 5160 0 R >> endobj -7212 0 obj -[575 575 0 0 0 0 0 0 575 ] +7545 0 obj +[575 ] endobj -7213 0 obj << +7546 0 obj << +/Type /Encoding +/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/sterling/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] +>> endobj +4310 0 obj << +/Length1 1128 +/Length2 6227 +/Length3 532 +/Length 6968 +/Filter /FlateDecode +>> +stream +xÚí–g8\mÛïÕ¢÷2zgÔÑEï½ b0Æ cDï%Q"J‚è’¨Q¢E ¢#:Iô5Ê뾟ý>wöó~ÜûÓ>öZ_Öï¼þ×ùÿ¯s]sÃÉjh"¨ä„t€ª#hA! Šž©–4PDàäTAA!h¡ +ACe€"ÒÒ"@% ˆPTD$%8*HOÌÅ äQáýK*y@Q0G¨A»B=n{8Bà@¤# Šö*Áá@ã¿vx¡ÞPÔc¨“@DèsD .0@ø¯@Zg$ü¯²“ç/=†¢¼oCynCòo#:!p Ô ¬¼õ‚Þ&ù¿ê?›«ûÀáú¿Úÿ5¤ÿ± ñ€Áýÿ—éá郆¢€zH'( +ñŸR 迲éA`>ÿ¹ª…†ÀaŽJ8((".ÿWæ­óƒ:ÂÐŽ®@gÜúwŠpúÏ$·Ãû;‡°¶ž¶±º2ÿ¿>êßk†mêï ‚þÿÍ"ÿðíˆP0?àC$r+¼½ÿûÉö?¼ÔŽH'Â(*! „ P趕¨„0PC8Aý€P¿ÛÀÂB$úv ðv0Á@g$ +ð×7•” ++ýUúI…•ÿ!) °ê¿ ,Öú‡À@a½èV©ÿo’ºUšüC·J‹ÓíA†üC·ûþ!i °ã¿I +;ý"@aè( +vþo=]þ@q °ëxû–°?ð6„ûxëëñŠÜú"þÀ[_äxÛõÞvöþoˆþo|þÀ[#ß¿ñžee¤_  ˜PPTô—, +þß…f˜—TK(¤DÁW}P((ý÷Ïôö,þ7;Ãn/êuÌN#e£ÜÒ?Ä”†¨½+Ãçõf|U5Ô]÷JVhkA–| +Õ0j +e>$‹&sƒ½#MÛÑ©vr–X¢û Ôh"ý•¬˜’· Ó„`ÏqËƧ?¯·ó¾GNìY–5Ïþ= ûñâã6ü*Ý ðkº8¼Ò™é«£÷Ðá¥Y¢ 'öõ4€m^‹îK¨ùÏŤÏÛÈ7ÈÙÂ~›ÌcŠëYºÎù ÷oį¤ãóôp¿¼’¿¼ âõs^ˆd¹³ÌZæJkÞÔ.Þ||»·~—Pm K—ø>qÚ9±•¦¯Q›ëB¾Kø†ËîÑ»æ!1pMJÕ<æW2ï”™KúÈ¢£×éB§Úß”Tæ¾”ƒO¹Ü?fVê*¥CgÓï;.êÚÑh±:}l]d³ÏD·Ÿ¼²/ÒÉ{‘wɆ¶Œö—„(}\¾ú=¤©vA×ò!Mº-jš‚nÞZ<4(Âe·eX ºSwÃø´KÍ·>)¸Qµ+£^Žµn{y§‰•ÎÌGAÕ:)·‡å<áì†çàû fp¹£¸iWÓµ.´¬çÃÁ\p/9]ã ¹uJÏcA/KÔ¹«)k2þ«DkÉçðlñ°ßé<´'“ª# Ž¿~ösý"_FῆpÆXS^z‚êüZâ{[¥M$ºš_0ŠG¸ü:œ¶­˜Ñ=8ÀK¤±•€ŽYóD3 ?Ú‚§™^c86±­oIúôÑV¨Ýg©²-¢Ÿà¨3íŽýL¿†7Ñ@€»üT±X¡MeŸ²ÅºÂŽGP“Km6’ØnР@í#KöÀ]ôGš•P‘Ä2¸x$ÀÄ÷]Íb!Ƥ­"ÕLé왩CëÚ$jòˆ}HwQˆ +‚‘úÿ8øÖ8M?K†=cѨL 6¶ÞýŒó¼và¤è{…°¨ÀUO‰ØwƵv¥+ñ+ˆ#~øÛ™i1\¨ô +åï”ýé¤ór˜zÃ&ß’ëíöÆíQ£œR1³q34zÞc&šêë©hð%òÞYJT³Ùg}éÖ úd+å¡áŒ£È¬.Áìc/€Þ]ø +åžGb€£ÕoÌáúAR¡_±_ 9‰ôÂóAÛï™(Žê9Î$â÷Ó=¤NZ ŸõÞø†’»îh;˜Eë…Ü?]Ehþ|pƒnKgàúŠø>?8RÁ@À“>Ýgfµdvn‘œ™JÉv7&ä8Ãh+¶JÃNRŒOP"#jbq÷Ag\l}Ü% ¤=Ï÷ÕOÃpí·4‚‰p‹‡ ÄÚ‹Id”wcŽ£J´«ÃC'64ÒI‚(3óí÷†•®vjbkž×ÕB8Þ/ù¦žßÕZ*îÊY(XB°“” ö„QÔúèð~0ÆgSã`h©v$`òy?woRN›µù{7 ÓöÓ4§‰ÜÖ³.Çü.œü1ùÐÔ#/ÁýÔOpÃÒÊÅs¹ž6 +†…×ÂÕ°Šp~¤òТŠô9Dâƒ4žaXCÔmXã6y’½ùJ-ŒHY›ÕTÎYßµ¢tôh%Ë»ssÁg]r^ È7e7F(ô=}X5:®c² ¥“é¾!õùtú£Gɇ¸ÏZ#¹—å„i‚)Y?F&:° `cÚG±H¬²%Ìuøøsö.GûGËÉÜŒù Ûü×eþŠ#NížÁ§cz;/iì8LËÅ.vÆz¯5eqqñ—¼¤¨Eé–ßš©²áߤ‹ŠÁµC|Ûw/¶i¿ÄͧgR£¾«ƒª®büÏNŠ6…ì "ë¡ RX²±Š¹X%!«äE‡c<çÚæV”øàŽÎGœkÞűb+rlUº“œΟa«õõVjˆš‚P¿;Ô `KfÍm0H˜ràòLGL½Ó©ž‰Æë6òúú¡ttPñ Bë'c¤ÇãHÔƒ9úáýS‚²×|ìÓ´EæRüyåÕñ gjìØpqëUÖvÔοڋ߱èòxCr#Ýê´ñ 0I¿ +>ßÒññúŒÀ;žZE]}©fwcs1öYK_R¬¨›©pÌ Î‘Ýö]MÜt Uµs ùÂI‚îѹ)JÚŠË;+ƒ“-àÌ7P¡¼„s_"j•&H#Ž›}«Ž² †Ø¦÷„-×X +®öãî†ÄÃ×é„V›MºG¬2ýÙdÕO do«’ºYq¿™æñ¯;óÔ¤¼ŠsoÒ.؉«`v(ÒÖyè91N‡çãÞ`@"óQ +Ÿ®}£ŽçÝ3^Õ§VÏ +Y¸ñóää(†Ú}ÒI[Œƒe!¥‹ÄCgnZ‰l¿8iÜUg~W¹æŽi“Oš/2Ä=‰´nï¶,ò—ÐÇfg[mI+:[Cœ}¬£Y¢§L%®¬ç–}]òéPE+µðãx¯½C/ûíúB1ñÂJ¬ÔÉ;ßwËut3^퀠QQ¦à¯:Ï=VCæ³ê8n\¬ UÓ„ìßœ‹¥›Ù÷üž/\n(÷9Tº~ FKåi«`½OÝØPÉñˆF§'_LêÀgúœó×Û¯ïÍ +vzÝ÷P÷ +ê”Ü ÿh³4‰OE5œÚÿC\C*’fXÚ«õã(¢2Ù×ú"8]ÎÃl~ ”b_-ñ§zžB1ÄêÔ÷ ÷¬/ãÅ*‚JTÄÑ©ª¼Á<=±¹½DPÉ_P¸º™rïõë|ñzñc +Æ׈6û†‰Ë‰öö…§9d…‘4Uí®s[ëv\#î‡>ô}Œ3íù\W?ËkY«µŽRÃt#WÞ¤c¯ûþBݨ¿d‹rÕ^¢q ;HoÝåÍùÙÉ#üôZ‘8þ‘ìà!w{»¥Ä š±Ûˆ?“êðó”ÿ™|C“¯ÊžáBBžáïø@¾9³÷ªlWÝ+^“¾‰Q]MO4Wa¢Õ=V÷b»NC:6ã–©{ßLѾE*ˣq0Ûxsà:léQvÂ^q3J9j`¾TÉÌn(æÈüËÕÚÖÿ†œÇ\šUTyô­QkL†ê!M±Ø(—x¨Ñ5Ã5wΈûÎ5ÅH2h0ÕWÏBÉAr¾§ZÿÇTêZÌáóš¢éºI+#ì¼ÅSÓ÷eX1o åvE™n))³ìc ÚëÜ“ðFKÒ°@¾Çg›X­“@îœBÞÇtg¬9c³ã`óñ“gÒO’ÂÞ*Û~xxX'¥²]8Q^F¬‰>ÐKìÕb¶Ì–ºh 3[65ž8ð ²]?¤*+m|fäÛG/eÎÖ-ÔI²ryró+K /IqûK!OFÚtá~)°5žEt\vÐÝ1W‰,bŸw©³'šÁû¡Ÿí –¶höû¨‚ã.¼þV·²´òQ­Ã„ÂöQÿÆ}Ÿ³3 nr©FYŽÜœW}xål­Ñ÷†s¸‰Ä—JCB(ƒFßš)ðïà¡Rv¡¹´¤ÁxÍÎ]"–o€¡Œ +¾ò]:ƒsuŠOŸŽk*Üÿj[ÃõÌmÀže7çÚÂ;U:z²§½4g4R4cWlý•Æ4ÙÅ~+˜»Là[µ¦EÌf™FþUH<ý#ÙË9Ð,m愼ߚì×\¡ÞþJDÃÊ¡åvoPêÒTáÞ¯ÞŸßå„©‹)ü>H%N!—²3Mè ªe/#j‰X’<˜?dMˆ¼‰Þ/÷ʬ +këöyWc2¸×I‘ãè¾bº'HÔûÀÏGÓ9…H§Ç4kè峸{Ø.kÈAxÕ/ô¡zLŸYt²þZˆaV°§£c1s®ß·N1WáQ"Î~€ÚVÏ`(#ŸÛ——…£ý £Ö†Ãf›7±©¢\ú¶¿-÷­JRílêe“UY9çØ@6´ùûH!6óÄ÷iIëLåå`r]¿?¯¤HŸºåë¥Ë…pcÚš‘SÍ) Y“f³†Ã&B™úÝ ªÅËF„Á¸jéâÝc?|:hÁ>¾ŒÁ;5˜¤OYUj€gä´ÓñyP0°Ý>:ÛÊ]Ö«ý(ÿˆ%ípŸ`àËÞ ½ð×C¦Þ³ä,Òßýc<éà§;õW³cJ¯KJÌ®‚F}ôgcu}+‰Ò‘€£æŒhFä,…Šw8y™‡}‹K‡ÍûwÇÑE¯>Íp¤´eðkÇLQ`åœgõ¥Á%bÈ×}+ÙkâCFÁ\Ûj¨J²è˜ÓØš¦p;xÏïŽ2”lL£œƒ—E(ÄÙC¯nXÌÊ–êT¶=ôH%ôOôú}¸ dWÜÝÖ7é_Þñò°Aó~?Ë4Óï:-ÊÈÇáy3pxãÇ1©>_¬Ã&} ÑRe.¨\]‡§Fÿ(YêÜÛxnA¢i'ù©jõTär[ˆqLý’9DÄJ m’$¯+ÂVDaÕºírM/Q!?þ*ñˆv“T€H$‹XP°›»8׉7–Ø{wáø‡ÿ·š¤% Jqâyª¨ÔYÉf¤ ”mØú ‹uŧ©U:)»pÓb°.¤h6gø4Gó^–wªÑ »&ÛoèØ÷]È´JD€ÑË`Ó‡ö~êóèîÈú­ÖA\:Þ–ûòý3âr¯x¦SfóQvžéÉê&WdÏ£*´Ž¯.Kæ±S‘ãïÐ{ç©Ïl5¤¾‘~1µRÄx|ƒ-WˆX°Ö±;QC·rÔ¾µ«ŸgD(Ýøw|oñ–ÏU· ܳúÈ!ùsþ'®Zµl+f¦\^ãïCHT=”Úe"›e9™&SZ²!®z^ó^ùPaJÏQ¡H^B(¥)x@™±»×•2pr”âîô[6ñrâùínúAçW½ïâ(—̱Q¿ÙÇ2äàÁ¡Ý/Nšjû<_7Õ† #Så$í öò»D£šnL¯Ùüv_»~•~±ù؉1îÌÃ,²Åä¹Ö¤yP¤³\n¸Þ ‘¢H +åž>÷Z‹X›°}Úغ;k~cêò,Qûœ Í'|Gq¯(ÚåÉE%f¶¤ àÓ24ðáN¦”ÒÖviMCfK&'WÓ=ÿ%yß¡ þ˜M)ªë²¾"(b³€¼)#‡B²3)I¶Y’ÿ´ÿ˜ñq™ ·?RUYó i±I[“u,3 +9êX‡ZmšªjzäzcLã¹÷ÀœûQôCï÷ôׄ5á%õÜ蛨üôx½ãWÐŽÕ¶©7Ý‘•|#/ºÞ4Nò[¼|çä3À9G^¨åíÖim7/„ý2Åwàë/îÓ Ùnˆ¶¹tö\™QÞ®}‰ä¹3Åù«\"H÷DŸ ßñÊ—™°tÐxP;Ãá?Uß½çÐbZÖ^·b¨–Ìt0»¶¢>MP©bƒO³¨8ƒ¢Ycfn`ÃÖâó^cÞsò{0òûj>K’I€"¦J§Þö'u 5µÝq–XíçþQÑÏ8;L< v2*BcààøÜF·~Þ%BfÜÈR–ªn0ô¬À@ÝÞÅ°þsDÄ'ï —!hÀëܦ¯«|ÓNúÃÚP]”b–Ö}òîJ®µ—lm¿cßÆXÎK…‰~Wa¶VÄ^|Z4"#M•¡ºä²Ì„§^[ôåÕ˜W¶ƒW¥Á‚oáV b‚±¿×/ Â̵ô¦íä~L_U~4ünݺޡ“»Œƒ;4™êä Ëþég”jøÜPÒTö{Tù¹Ui ¨#¿N¸WG÷]"î„ÄhÞ™<„,ìT8"Z‡küôŸÆ’zFýwBèÌi%úkfß[8Òâà—ÚQµŠ‡nþŸ6¿Ïl··{øÃÿFb·²¹ÒâÉÅrúúPåµA±’7åriuÙ%Ѥð¤ä ŽtÚË©\Z×"v–q~ÊüÐ䃈{_Ípg ‹ÈÎR¡åP8;Úgë¼BV+öGZr FÔܳ)^2ÆJúœ¡ ‚Kö¬œ¬í—'åö~SÜÐÝMÕ…gJ]dU=UóͤÁ‚­Jæñ]±§ã(¨«CîËthþ·_s<‹ŸhüÄš·Œì~®¤Ë5Õ eÉ|UšîŒ3²d|ÖÙj¬BNFï”4Ó;UÈ2‚þb%–×÷AÊå4ï‰\ JÉêÍ*å§o±¿ÆjÝ®sxïçl½ä}2œr¢_ÎÉpŸ_XýlæÏrTEÜû$qv?GÖ¦0ÉÄŸ»@¸ºœ©‹MuÍòÅÉé#Ç*Ý|AÛ,JÉCGËÛ<ª +}.Xm¼Ý2zžÙ †|â.’•Ü%É +œ(0¬JtoZ>6»Êe2 Ì^3?[ý©v/ÅL7†ø•Á‚xM†+?ÿ@(ÏûÚ§zÜ-.u—K¤rVñ› +E#ú€:)•ÒjVˆBì±ìуå»ØÇ9Ç{ +°3óèÓ~–‘­Õñ;UYƒœ±DÉUÙÇg¯W—Vž­lˆ_wdär˜ï2­8"©Z[‰—ŬĭŽ€Çý<|y‹ã} éÏÓñvÂouoëÞýP)Rv…íàVµ_5'½xo]mNÜ"_ê–Cr#æÎRÈ?z»øÁw檶q‡2S9‰Êƒ¤[šõ¥JvPk¦‚ì­¤ßj¥áš¤Ü`¯ñkÃnÜ£>+y#I;K™ò3Œ3À|¤ÉêÛ)óë xˆáqæ]~À&oM¤×~mDòÓ¬ÞÓ š¥!–jw|CÇãbª“®JðâžNÆ™9>3lùc»Qwm=Ç>CLït‰³@¢8öb ~ÍÔÉ»ÃLÉvdñJaO¯]V@F²r]ô×$ª£j3¦ž‚7ûRð!©9¤dJ´5jP{«Í´,ãqç\£sÝÍÝhÌÍ "§Ló{Že»ú-ÅÄhûª’'+»ˆÎØ@Ͷ 9Ž½#ÏS7é5ãyJø/t20cVKÝña«íôŸÏ’3“‰‘ɧüoð ql3xÅßצ3j{’lšØ&@!ã¸×7”‡?:àÞÙOgOÀ1v 9ìñ H~YQ‰³È”¸ql‹P¦5Ù³/o¶›ßÅ©jq2Ú´<¼# q@CÍÈÉ$cÓmÉ0é 'Hã¹p>ônž<åsœôƒüì©Lû±J{íÕ’É xš{¯™¨A!KI~ȶu‡žçÅ¥EçâxhÛÄHŽ²}>ø5zÀªSñ}áöuåL29ÆÞ·Àid{ª'VL-׆ÿ>:@kqùtß¼ÇK¨Eý“î QãºÏ Û¨'©):¬ Âÿ»Ü&3òÃÃ5d•¹Â£ú°x[ J±P±Óƒ"ؾ;µœ½¼d{ XãéïÜ„Âu)b¿Ëç˜9ñœóø+R_òe÷3SE÷ú¨²²÷\™²åR0ä½Ñ’±^a·ÑZRî˜óú¼øÂê.¡Ú%Ý„µ¨1CÒ]Á=´$©aóNoOÙÒW×wz‡áE`;—ã-m<ì¯ÕÕà5–‚âBM6ðTÑ‘•„2$¦äF§CŽxmŒ %h¯S׬e—H´C¯[Ì­¬¾%ì{qvO0Êg ‘ÚÄœÅÎÜû¥¿¿z‰Â)“XŸIËG¶ËLåÝ°ô=œ:jnÿQ?£žÈÎ÷§fóVL’Ñ÷cS±~bgÙ*óÜ1Âé!ž×측y~7Éç夣'Gia×]úÍ8}b…Ï6IÒPÑÜU±Ï/í¹×ÆI¬Ÿù _²†>ÿ}ð"˜Ú#8\­à²ÉÍç}›š[+ÿpM†™p£ñË{#÷5¹mC/â–I@¤T›qMNkÕux<éºÙ&ä{9lkí¤æ`kú|´.ñª>ñCV-âÅžOçžR@ô>{u#Ùûç¯ðîäûË;TmZ.:@…èzYöSgŽ&€þ/ÀÿoðÿDG8‚B#= (wÀ¢üendstream +endobj +4311 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 7546 0 R +/FirstChar 65 +/LastChar 119 +/Widths 7547 0 R +/BaseFont /JMJRFB+CMTI9 +/FontDescriptor 4309 0 R +>> endobj +4309 0 obj << +/Ascent 694 +/CapHeight 683 +/Descent -194 +/FontName /JMJRFB+CMTI9 +/ItalicAngle -14 +/StemV 70 +/XHeight 431 +/FontBBox [-35 -250 1148 750] +/Flags 4 +/CharSet (/A/B/D/I/M/N/S/W/a/b/c/d/e/f/g/h/i/k/m/n/o/r/s/t/u/w) +/FontFile 4310 0 R +>> endobj +7547 0 obj +[763 723 0 775 0 0 0 0 396 0 0 0 920 763 0 0 0 0 577 0 0 0 1025 0 0 0 0 0 0 0 0 0 525 472 472 525 472 315 472 525 315 0 472 0 840 577 525 0 0 433 420 341 551 0 682 ] +endobj +7548 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] >> endobj -4189 0 obj << -/Length1 1299 -/Length2 6824 +4306 0 obj << +/Length1 1035 +/Length2 3760 /Length3 532 -/Length 7625 -/Filter /FlateDecode ->> -stream -xÚí—eTÛë¶î¡h ŠS,h‹ww‡â)‚“àÅÝ­Å­P¼w—â^ܽÅJq¹YkŸ½Ú»ÏÇ{?q’/ùÍ9ßg>™ïügŒÐQ©i°ˆ›ÁL!20¨3 ;+»PRYÈÎʆAG'é1q¶‚A¥Lœ!@v~~v ¸‹ƒ ÈÎ#ÀÉ/ÀÍA”„Ù»;ZYX:_I2üUÄ ·ƒ8ZM @egKˆ\lb Ô€­ Îî¬@q[[ ú_'œ€ê'ˆ£+ÄŒƒhfvšB,¬  ¿üÈCÍa@Þ…Í\ìÿr…8:ÁM_ÁM2áÍ`P[w Ä¤ƒ÷‚Àüÿ0õŸâ2.¶¶*&vÉÃgôß²&vV¶îÿ•‡ÙÙ»8CÊ03ˆ#ô?Ku ÿ²¦ 1³r±ûϬ¼³‰­Xja ²ý+då$cå1S³r[ÍMl Ç!P³ÿ4Ûß@²º*J -ÒLßæß)5+¨³¦»ý?¢ÕþÍì¿>G+7 >+;¼þþ÷'Ãÿh% Ã̬ ðuàæš8:š¸cÀ÷NÜ@Ov Ô ℸÁý‚X¡0gø |$Þ@s˜#Æ_—ÉÅÙ›8B ¶sç¿RÿŠ²ÿWô_—÷O˜†_ÌìŸ7$þ›ø€ ©ßÄIÿC¼ðN2¿‰’ÿMpa¥ßÄ )ÿ&¸Šê?ÄWQûMpß?§ó›à^t\Eï‚ï!Èä7Á+M¼ü±Ã§‚ü@ù7`ñrA– |8V ¼«ÍokûÂûÚýFvø…þp°?nÃþ„÷uüá}þ@øtÿ@¸ —?nÃõ„Ûx÷9à}ÝÿÆÿ¾á07ON~ 7Û_³àòr³yÿß…ZP+ˆ¼›—Ÿãï(Øž\Îÿ¤ÀŸž³¹üYƒ@Ü `ŒùX0È:¹.ä‹tîX -#¢„Eý•ê¯“­€À¹XDÛ‚AEÆ•*Ý›â4¼g[([”ïîH"Z¼^Èû;|H™~Ør5ÞJóh$Õ=KSvß´§¾ ÜÇn®›:?àFTXú’ —דqÒ»Ÿ­öJJsm‰ -¡Cßµ¦#=ˆ‡WW&ÍV+4¸Šž“J'ÅáKWèò;œ„8äåÑ@ëPô¦ÅSX‹ îM.zVüƒÁ%ÁûçàJNõïŒøêÛ¢…y¡8Ø•Ýýåbé@ Gàʺú |`&^Hy†Ç é·ã'DߤÔ]™©îéx W -6Þr2½µÌS˜Ëg;‰Ë…•Ö¹ê6ÝOn’ßOâ7¾0Ö"˜e8vÓ¡Ü« s eðèãEj±›T?¡Žˆ"¤$b¡{=Bf1 ¥Z™æ@B†•_WâÆZÄ‘Ï1ë™]/¯®MXZº´¢½í'fÿ"~ö¬gä2ÆSV­Ovä‚ÏÒë‰8õÞ¬íÇ_‡ðz$¡N³kéF>}@!ŸVàhÑ*´\?O“´¿â`:KïüL3$Fp§ðcÇiùË(Vô-ä¤øð>ͬYTÙ‰‚•,(œúý¹8! †}ÿ€’ëÆjRƒºi»OŸ†_—Êðv8`Åï,?÷Tñ” Šo¤(`ƒ-ŠÌòUÊßV½@(aLýH%eøƒÈ—j®®¨šÏª?ÀD¤ ö@[ÖF›‹˜bèDðaQçÄ}ï› §*ŒOq5þ¬U9f”Š7R³°vñr(.`Ý:Ÿh]NòC<ív>RäÏfyQÁ0²Î·™ïq‡¾³§–f0‹èð¾´'ÍET·5ï2ñLÄŸ9¥| Oîp#ì×'½OO !åä'&(Å?ÚåN`<˜BP±9æý`~ïÌèf«¸·t6F¹Ú¶Æõ˜œÙ‹FàdÚÚx†À@}¥2íò¬êH$?å‹ ƒÊRœ\ -bü¿¢ï¯æf|³β悮¾¦½qÄ#i|¾˜•«‡ê$ÙåÙekTM£ñ’…:}Wð¼=͇"ˆ¹^ê}z'ÃMÒ`È–°G‚nN–fEKW­×sÙ鳄üìütÁîqŠ–†UŒ—ìè#5™X4Íñ,ß6C½ö°Rò9—¨‰s÷É»°ƒ€½íOõ¼H"["™ô4O§™-ÃwÖcC «ü^@ÇÐ9 Y‚\\j6¡4Æ 9Ö&ÒBÕVùy=`FÀI6ÄÍèÎèÒÛ½£,æ£cØÂœºÎ†§ÊŠY˜B4çéá¥`ÓIÌ}#ç’ÃÝ+Áv³õ“É£ *-ç4z7Ê0?F§Û¯\ÿ7æF¶¶Ãï#î˜Ö²î -‘[e³¦zP‰´£‚p¯QΓª‚¾Ú±&~ŠEA\@ƒ57·^o -Á4ôêShUÈ:ÖIF:ű²GoxvgcP,Tè ®?Ѽylʧ´ÈìYüƒ(èvh5] 8Á$žqpQ­m»Ã¤Erí7Øü#‘««=Lz᳇ý¯ß{0fõ¡Ý'ŒÍ¨W«¤‚ƒ”ë³âðö}™lo鲋o0²÷hÛ…Å穳d—•Íîoýh¿¸drfì] -s”›ùŒƒ†¯‚¢Cn#Ÿ+ðc(\¤ÙÄÉ™éÓîo]µCüÜØÍwÓ³Ü1åŸÓ~¬ÃˆÃ.¹áoÞÜ>“ÅèƒJJî+ åÝ|`Vy -ÑÀŽ½ETµÕ5ZN>²PÄ£àÞ I -Ø6†î#ATî W>˲Þé­'AÈùZ„BDÚ‰ß6Ìo1’åãþÛEßh>‘¿îVø¢ÛB2-¾Xlx­Ì»sx¨­…`vâVeí/ÛrçÔÆÕ3°ÙL oþŒ+f##ÿ~Úöé\g{x”:À“¸cè#?¦;a°ˆ|¥‹¥IŠ¶bR¨õz×Ä%ãap Ö'ÕŒw s#_nOÈ0b+²°.ƒÁ°jzÚ†z"-‘ÇSšmCÈ(é -Úùu¾{ßB)[à°Íœ–ý),”4«êòÉ[Ó»ésDÜc^˜üTíÌÀŽèƒÞùIû× ×üËÙ0qÍ™å¯÷H‹ä¬]ÙRÞL ¥Úƒ«iI/ç´ëŽS"“‹&`"´2ªk"Wésá9NN -±Îù˜7ýâÿz†úç©šå…±ñ6 IÁ©G¨f¯ÈÕ®¸¥ÝIRÿ5²?ÿa+ ^|Œ·ÞÑac._…3šµÖv~£`-c"¦5ôƒcOfØñò¸ a5 ÁS!ÇÕ;ñÝLŒþ.eñÁLò«ÊPÒ‡”èAïßãèúÞ¸ИÞÚµõì΄æ§a3X´Í%QÞYõšòO=ü¨M`È"ÏåjBòijЧzÝå~J½ Ï‹Êq®Ú¤& Ö03K<……ñj½5õ"ê¾æy”V ÝžÃä¼Óã­¢. æÌ -V®ÝÞOH¨cJ×{Ý™Nq¹Öê¼.rÛ€¢WnĦ>Y™Çd!9ß HphÇ0-¼ö0©~çÐêL˜.å'6¤U/‰ÝAT¼0F°P\8BÀØúMTòÎ1ûvßS¼àÌSx>ÜšçídeüÿæÑ@¦µ­A>ðƒý@}íÚ%E4¤Àz#êKwtL»DÇó3rm–ùÞyÃÚqÑEúÑ:®iéE"u$u(Ê!›8€X¹;9k,üÂ6•XÈ]YX »ì§×¦XQû:@¢êQ$ŸÈ\É)=9gq¾· àTíÄQä%ßePß÷Ð çb…º÷B“‹Yè‚õb4†‚œrÞª%ÄÔ$MÌŒº¼¾öW6K1”OÕY,$zø ­Ç&$‘aL&ä¿ØµhŠ³H:Y–”"ê°Q?à[êä¨1ú¡ú.("'§SÊx±?0Ä!ó®ý<ZÂÑ÷àÒÍ ¥ð(…S]£Þ—™h¼ýŠlrhrqÿœ³YúË °â]RwÍUo…œÿQD³±¿óÍUµXܤt¯øÏz…{Ñá‰Ô(¨Å\?êe+a^ÒoÑYÍWSl¥OíîD4ÒeÇÑ«<½ßjÍ?üÀãëè›a™§týštF»Â™}ºcâ÷ª]^rשòëò°0¹ÂVˆêê¹­ŧzt {Ÿ8iÙP{•Ø7ŠÏ‰)\1µ”f]^l„¬f!¨·{w,ŠÇÕ]6»¾+QëÓ=~ë‘Õ5Ì´^8«ë ýÔž"RÑ—xO. ãߺëjR76¯y¯ÜŒ«~ûñc>œ¢#c.ቸ點RÒF8úÅUö5¶êùåN°.Ϧ_´ÛçØê;¼23I@ö+¡Ý×îv9ºÍ²šwúˆÚ“Qºê€×Ýй:£3Žý‚ Ð.‡¿”6UPleî`ÈuEa~¯+ä,5è¼zè¶ôQ¬7> -ï±"ÏWŒ«!Ö¹ÚwáÕQ$ÒTѤ—}øˆG*0ùI·…Z±)꺤0ðC™}y`FÕî4ÖŸ0j(%.€9îå3j}ãñF¡®x#nôQýA‰*#¾k)ã¾_ç_”*Ôw¢eñÜüµ :³ïýd¹x—l,’8©ÅÇ>Óù -#ðm¿xcHØruþΠխ݆€ 3 :µþÅd– nÛ_“ÄJ AwHKÅ¥Á-uåEáSìó¶Ï·Xvº='úŒl s¯^tW*™KònH=\(º2%c‘ uŠ»zk^ÄksZ%¡VoFš¹ˆ‘g½;ˆëp÷$Gþ5rv¬?¦áòQVå@íàÓÛ’©ÑÞ7 ™ñ˜kká¤öFø¸Ÿíy¿‡ý­7¸xL}‹iUâáWÉópbd —sb]M5sþÔ5ĸնë¢âÁû¥½¿T»¿æóÓ“?mÜy…­¤ÒPÉzÀ~1š‚/Ä)½©¸bòêÞ¯?!L§w~tsˆ&|»E&UÐeî»ï)Bn_ÇF¼ãù„sÀ(¬®ÄOq¸ºùe²zÕ÷2zd¬ñi(›ø·‡ÍI—Ÿ.¾Øa·"˜çýÿ&Šçq -B‡ôå-Î·Ú G‰œæ^ù©A™ûùH–x®d-™ÕºÇá÷Æ¡Úôd;àœŒÛÓL美;D@¤$wsiªú¯ ÷øù¬!’UL6Z†Œ`üܧþá[ѶÍÙsèv~KÇ#.Ý/º™}:‚s©é{°Àé0©Ûl‹.J‘¦µLXäròãÙV7»añãæª]Ýåpø`Ö³ðmz}ˆSŸ*>×c YËIt†)®MÂ¥:¾è!Ôa²àáɸ9âNŒ²ŒV”Îc;=#ã”ÇŽ‘øh?*á®7ÖdÁÎhú$èÁÁP½œõå9§xõ¦D_í3­¬·>ù®øLH3N‹Ê½r=4מèrµ>ÊGnÜŒ)V‚R[לÓä2_N¨­"«zÆ (¸WlÝ®«ë]ÿë[w°‚㌦ãônŽ”ðÀÖB¾ÒuÂÎOÔ<P»ƒSÄŸ:…y~Á´ä=µ.Ð!ÉÛc°0Ƀ°‡‘èAA^Éq6–¤Ö"ø–ÁølþV¾)!ÖÞ·yoÜÆQª!üÒ5•}£yLÈÂgü4”s§eÆßU)ÔtdÈfžÆ¸êZ ŽçWãqƒ‰çï È°©“¡­„6ËA÷dJÃÄw-×ÙÇ êX ýgS7øÌhV9}¤»ÅÚ–œTKkÛeñUâqÛËÝ™eݳ¾±R® ¡Œµd|ƒ<Ü\s{Ó6”Hçmã.mÞbs†B÷»dÄæ;ÈŒO9eío‰X„ï ×ݯ¥ú¤M+BOKuÜø4é)Û0ñF!›)_FD,'y[øÙÑOôü:_•6dv'ûº–80Ë®ö˙ͫ¨žz”Å'ìå0°¼V}¶Ÿ~ì-—þ 6œÖÏ'*¼´Ðl³§fú]@é¡:È'ÜäP\7Å÷ªÕ)]­ý2T6›¦Ò€|1ʘñhßýƒy£ÔðºUÆ)„äÉô¡wåݧ‰ø/œsœo›‹³]¼‰X§9|ÑÏïqÕYpfÎâ× iræí/ sÉ3m/XøÃ65bˆéÆ?™&'óâ5ï3PèI%WwÂjmz†Ø$šÛ\Ü"I‰îtß<ù¨¤vm–hØhÌŸîÖ ø‡£}=ÂuöÈ0¾–~ag¨úÅÿ²I¨úê–у- ¹dŽÝaµWûI -7‰¼--Eƨ«ã…S­‘j±þ§n»œnÄ_Œ 'äøJH?£…­’#V½%¹ðå¹lñ"ìŸÒžç}ÖÇ©ú)ÑÈ1p®†¾N.«~½äïEÇJ/n½rŒ¬iÔÝ’a‰Âpì4Ñp°Î{œÿ¤ šÉ-2ÒõÒÀ ÿQPB·RñQ`ò–½,äkÿeå™Í%þQâ¹ÝĽÏz~èsº’.´õo8m­qs)… -U HÙȳÒWŒE¾kUvZT~盾Î&½Õ Üñû443`¯Þľí~9xMXêSuÓc•Ûð–À!‘\:Ë´îÅ’Ô!±ØB–ŽlP‹¡ §ý᣻O¬©Lœ_¤?š¼ÝZ¸¶Q0 ‡tDÅ3qÝ›3kÂs"³Î'Ù”Ž˜¼¤¦Jêg˜ÐÔ{Æ -?%ÒûsSÔ÷fí'lZç2¾×`þl%Sß—þ(;{­þ¯+e7šŽSâªjzTv-r±^áÚ“ÆÚƒ£.>DŽu˘UlÝÞà«&}ëÔˆ¿¼šäLK Ê죹?ñ]£„©i`ÙÐðàäîÏÚ‹B%²Obhåć¸Æl0c™Ã\sð$íŽÖ;|?ñ™~i£m\,ð Úß[qVï)˜ž¾ÒQ]jkS¡…‰‹¦Œü%'¬QåâìGH8ûÙ$W*îÓ$ãhXçà(¦ƒÁqzø³ƒ­äAL‰ê¡DÙó¢·R#˜EКy@>ÕõÒD@1ÜøÌj*5úýcð °b;dº~|ø ¾ÜS>TÚ¼ðPqCï=«JƒVõÞÎ'äÎdÉù±ëGhs¬®·`cºžÅ¢EK¾0(’MLèPVmvgy†F^dfP¹ÍásZi|NËÅÆÏÙ|“éËÞ(Í¡jºØY•O´˜tKuëNª0™‚Ë=,ZŠZˆÛŸù¸“ð˜í­ƒâºdµg*Ž’)»æÑ  Ñ_çŧ'[d‹kŠFô¿VGÊ\Q£š®|5;ñ_¶Äן½áXgñmxõFdˆ¢•jRªZ°Z£>~?V‹Ÿ*mtÀ _=G‹  #¾-LÑ}†^)Ûý†q*nÛïrµ!>Or2ö,ÖNJí—¶B³gŒ¿"4"9}ÐöY lŽçSPõú5ŒÚï*Ë݃oD°>øùú¹AZ$OHÏùRùEbÃ~Á^$¸¹[oF‘½[æ½v§ ;Ðî"¾²VV¨é±F”*SöF•ê ¨Ó ¯Ô³-?6J„œÑu£¿Ža«â¼(:IGäÀs}øÐ`‘„×1ºüØÜY•OçÚ\uv¾ 6†½Y„ôqÙU»‰×àsâ'Þâ ©fßï[Ìàó’ǼÒ.DæäÝã£QGÚá úsÞÖ1Äfý´¹Ë£××}ºMdÓ&3¼\ž†åEõVoDRÞ"¯Ì™s´rmœ`›å)éÈ.Pö‡“;ü@¼x1}&5•´€|Ú%ð\ŸÛHÛ*Y¢ƃKms†FP{ÿá[[mŽz!,|C¯Ûï¡È§Ãô$»’°u´\È'5»Òˆè©Cæ¦Â"Õò¤>?‘Tk˜ïèç…ǬÜ'ÈêdRÇU­êgÜíÄoÊǾt+R‡ž ËüHy,p¡_œ·c²´©d©6 -g”Å!wpq©%ŠÜÒUØ.V"”¯¹ðÚxÂd“ÌN•¢A[¡çhÞ -Ž|ê’Ó(Îýùˆ­`ã%ÝïQ%D\‡ú*å\þ³;Ðñ ünT"ûYÅåˆDi«~l¬ÊÃœÐÖgy ·Ië e ÄJÑÍÒî™ÞÜx;ݾ5yª«ÉÕ CwÈ‹ƒÿÕr£ Ž4¹Ga^1’Xì½^è}¬‘¤©²ôýáX(‡-w5&ú WOŠöpæÄL¢f`òŠ¡‚xÉ·iM ¯ ŠÊ×yu§öƒËüz¤kì|Qi×ÌbÃÅeó³?LòÖGã䈴@y!Þ¾Nì“(¢x?Š(:y0ûmÚP=¨|hˆÛgï£<»j,o^ç lÓ“‚ÏŒÒ/Ô_ Óùž-ÕâÖ£õQˆ "¬'Xåa鑸g}‡~AM7¥]$.•O£˜Ô˜gɲ¯^©¸ÈË,S’1ðŒ0žc2võQ¿Í®º¶²RdÂÏjä?0v:xJ©¡˜" $mT¯c~ÈQÆÔÆRÏ*ÌLºkq/•æ¥ÿ”M íù>¸›œýŽ73ë;«0ÅMmøÖI >>Ê·¦hs¬vr)ªè!Iís¦Q&Ò}Ro“Y÷+rùÖ†šO<¿ú¼cåMº¶{ 1¡)$&®—"7Ý[+7]œÀú¯ájÕ9nK}ûE…-âzÕß7):ß~_OŽé-‘2è\ROÍ[ç‹Ê¼Ä´˜×˜+‡UWÆ•#vÙ¦¯î>]­{ð“»%른&9ªJ(J?õNŒxnDzËfoG¨„§„)VT¸B!¯ž'Áj„+Ý-À¯õ’_ÄØ\D8Ïû!àpÛ^†Ê´åaOå0ÉñÌb¦ª¹e„{¾Tt>œBe7¯æÇyŽi6cP£%X¨“üÍÆÃ%¶ðœÖ=­‰áCöÏýoeùoÏ\ªƒ“ÊÍ+y`·u¬…^Î*>%ÊWÆãˆHÅ÷IBÈ(ýœ¡³G(Ü/ËPž”|ÇW:W)×Á';~â•ôqlØJ.é®ì$‰ß¹Ð†3±æg4¿Ó??¨Û\ïæ¹oa¨bȺ%y,0Ó“ôzîÄêh‹>2”žuŒ_‹¤Îc/zÔšãFO­m™ÖKÜ ðt—„”> +stream +xÚí“y<”m¸Ç­ !Y³õPÖ,3{É6È’5d3ƒÑ˜1cìRÙ·}§,¡ìKH"Ù›H²/Q–Pƒ„ÎÔ{Þ·Î{þ<ç¯ó9ÏóÏó½®ëþÝ¿ûº¯GXÐÄ\JuFB±‚X¬h™)`iƒ°° # °m©€••Á€†·+ À +*rÊ*ea@ ëéG¹º1-ñŸEŠ€†‚Ã0€Œà†ô kÀahÀ G! þÒ€ ˜ý\á˜!½x$Bš (8pFº¢0 2?ýèc\°€â_a„·çß)$Þ‹l +#›ÈX Ú@ ]dŒ±ä½d'ÿ¦þ-õF£a?åÉ=úoY˜ +íÿŸy¬‡§7‰Œ°$óïR+ä_ÖŒ”·Ç¿³ú×À¸¢‘è¯Ê ŠòC"LP¸àC{!Å‘Ä¿MÛöË‚Ì5 ]ëó¿nóWʆÂ,ü=ÿýYû‹Á¿™Ü<Ê°Iƒ@`r!ùýûËþ_[é`àX +CˆÃãaþ ä¹ ( é ýÈ~e¤1Xy @nÉ À‹gøy™òò€ ëáûþ+¢Èx’ï‹øRdxìï€2 ƒÅ ÿa!øþÎCȪ^äüÍ +Š€ŒÖ?¤$ȘÿCä™ù½;D–Bü`@ù’…Ýþ@²1ôo“×bþ@òZì(K>ØH–Âÿ²å?ÜÂ/üï7«©‰õ ”’S¤dɃäEèÆ-´Ä pÞH}mro@ EeÙ_Q¸7Ä~ýJä©ù›]PäC"ýp†‰Q,\5Ì=½1¢,X§p¨œV‚RÓõq¢q]û›§Œ¡ãw)Ñ%ý8‰ÙZëý‡YlÌK´Kg|ðzÅ´™¡¤Û¸ÄŒ·‡K>NKYͼÖ[YFþ‹žB»¡k,OG¶×!”W†gÊRlŠºr7º×i[,ÓM RtØúÔwd‡)(ZC³Ð–‘áµ"r‚f'3peQò‘3¾'S’hfCƒÝ#7ŸÚĶzŸÚ/<^|h·Ë‘À +o=#g¶ Án¶¬¾^Zy’¥æèEoÕ¥lÀÕ,ÑN7ë×Íc‹¨Ê àÑq|½ÁõJ'Êȇ$ÙÜj-x ¬`?[òÁQî¼£[ÑåñbÐFR!¶¢ÑкåàÍ"ÿÁöf'KŽ1ñÏÀ aÚããµ\[övêV7fB1qœg¸¤„M‰|®DF^ÁÙ·²Ô4تo5§îº&ñKÚ ¾Í̽vsó~JçØË .ÓØbî"&Ò0ÐK[æ{ð«2g?æ’³¹önÕ)ù[„b@Ú1ÆM‰{ ÂÄü‡´üo/˶-KÝfà¬YZž{²’ëQÙÏœ¸ÄñãrÊ×*û,›’dÙ ÓïȇŸ²OÔ¼¤ù²¸¢…¶58Ï2xv*÷ÝNó¡’¨ãµË±ÎúHo@˜V@;pLÉ+3¬ÆºaÉÍ% ì”zɘRyþ÷ZŠG™9‚Úöï¹n +Ž7–×)¡zC`KÖ¯ê^¿*Ï-0°¡z8eµá¿úJUî +VÉ`.׳ò©dü  b¬EiÃÔî@Rȼ{1×¼žVb²rÃr—-uì—'úêªQ—ùž;æ%4ŸXgVäJ^´Rõä-¤4C»tÂSÙG7Ï°&3ò§wøqöÚòd§«œæ•{©ªÌÍQÁ¾9ð’"±>Ba|¤˜èr€r{ïHÃý[Ÿ7Çù Ÿ&uÁ¶<ÕcNæ¡ÑëX™žŠè3}i3êÓ_šõÚ‡Uf2ÊÉ_¾¤Œûzç`o|ôfAÓVÁxØ^{Ö5<ÛéfÖ©‚BêH/­ÎÀN´CÝYsQ)ÌÛ%¬mà¬`0ÉÇV˜ ~R$T!h)àH˱×JÞË^™ºu©îÞ&Ý&KÄš¼‡ëtÅ~\±€Ni¼–1¿!Ó‘Xæ§[j; e2fïXŒ»Ã`3ä²ð\aUyVòY×KOéø¯:Ö¯¯œ2Ù}(:Ý+@käí ÒÃþ<±ïh¿lÝc«NEeb%ÞożUs!Ï¡tk^QrVh3€¸UØY5p¶ïΉ4Õkˆ0><ý„vÞ¯ œ«Éhxzlˆ+ù‡Ñ¶´Í'N8ž£Â~®¢ÉÁDÇdÍôü°‘C0Ó#šáßÞ¹1RA+dn¬ßŠ«ÙXç;ÑøL6º!r~Ší±í±ô–q³þP*ä{ζÝW÷vNWßͱ‰N#­Õx׃ãºÕ{r^]ùíÜtgTTª` ŒáÓ›•0' ÌŸéO.¦$¹ߟ_÷ÓË>T,Nîg~´9»éÍ1Z!Y‹óB9ÚÉ·}ºxÐýM´~ìÕBhêî,Z̽“s©öÜx±ÊËÚ>‡IJ]ïªñö¢üÑ|•òû!”ÞnV›¦sÆ›º—’¤þ9¿…gú™®†o,?®¾›F[¥Þþº*=kŸŠNoȪ}Oc¹~'n$uqkÏ…uø‰QP|ÏsúwDjQíØmâkû®·¾"ëýJ=m‘~˜ïü`/#û‚¸™Ñ½+Ô”†u` ~Ø;èX¶e’¨Ì.(5G%¤hk±r…ÛïÝKo- ½u—s®Js\Ñ8K~‘4O æLÔJ +hþéݪêEѸ¨âËkZPÿª#%ijæê æàõ¼»¬>H‡8¡¤Ú¼B«†Ä `ä͇)…ûÐëÐQé8›FÎ4Ðt½uüðBúàíÃŽ!'3íH:5šžJj]ƒÃ– Ϙ%d1¯6õ§b¥Îžf¦{¬ ðumÂàûóÞ#×ÍÏDgxBÈd÷œpÓ W,½a¬¶o5‡bûœ•ÒngR™)Œ­+µŠº¨Äñ”ñ¤ÃË3XnÃÒö×'\wõ.Æ¢s”oÝ>¹Ý»3"÷=j¬:wî„QÊÕ‘S[iø~VËY5ß²ØÀ÷³‰MÍk„ñ›ÈÈR>:•O)\û[ÇÔ‚õ¥Â’ʾÜO\Xk¶œPç¯oïŽ.“À3þ¸lw8Ç8b? 5õR©Îµã£n¥n÷¢«RdkŠ…¦8Ú÷c¾RL°úEüÍ‘sSﶚî=ùvüJ¡Ìú'¨Ë^­O~¤üiŠsKßõ(#•Üw}E;»e-’Ù&ªÉDã2«,71P“´{vp¥ó4Ë-ïNeƒ½±HVÁ—ìÆ“õ5fÊ‚&Þ„]5ÛQ¤/At†Ü1|Ñ,nÿ…A®ÞX…ÎífzZj·szÓמËÖœ¶#&NŠ6fñôÏœnÅôò>eÌ$‹Gú %'°Šdp©*™}«÷JÔi;zYš|•ç²è™œ`ƒíÝN‹å¼¡ÁÍ*µôYb+^gÐV;YYÁØd 0m÷ôyX¥^¶ Ñ}Ï·xJÈ4ñ~7{ ¢< +«Ý øRíŠè< eoêvŒ³e°g9°0³¯—^ÓÔj]²ƒ@¯ÀE|¡r¼q|ÖÒ±çùÃ7ó‡‘Å……})Ò n·ÞÅ9_¢rÚ×—™HfW/ªy¼Š-¸æ8‹ŽïK%&4,ƒŒ|qšQ;>Ú2a:N@lºÕ)9»Ô… +9­`EUùË.kqü%Éú@jôS¶¿'æÞìÆ%÷4Þ€´Å›Ry}œº´åõ8ÍtRšðwŽ~ Ð§ð h,þ¨ ×=wXÑ™ll^3 Ùö!Žˆ›~èö·B—T}Ê9L1HtÝ 'i×”gÆ/!Ãhkhï'÷ý¸¶«1èÖWï2¦÷Ï« †T&…Jù€t½ºBRÑL/h¥JÇaQ³`|×ûNÉã°Ò7ÝM‰ÑÊ4à‰RñHÊdÀ‘ø‡Fäð Ö"g‘€Æ¹m­p×ð{&M +$H=f¤NêítdrêĄ̃ía _rØGòÚ©a›ÝÉ»)"óþ‰¦^¦éœ\É””Úâ¡e/p¶ãÎ`xØÍóÁ®øG컉$!ñî=Îը݋µÞ$˜FS"_ù×´?8—¦0kècMY«wV¤&ê:ôÛ¯\Òð, å$žìÅ?ò›ªÚ½ÀÒùxµÿœ˜c1˜ƒžÅduYæ®›µöÖ’pª¦ëÙܱgž·c:§À[‡ý-¬ï'½Ú¸`¢S ò¼.Ã3\^PʶàWpç±Óü‚Î&·sÙå3Øåc.[&ŠÓ(÷[3MžnÚOOxRÍ]=cµ˜ºCSkD@å#!ÒØ„š…dšê[á…U¬_hLÂõ°¥ÆõièpÏŽ\c¾ ˜Þ‚½àb°…™†·|L]k›êÝɺTΰLôî"ó¡ßÇJ»÷׉“纲׆«¥E!^IÊ=ÍŒ‰]R°ak +ê7¡ò&Ù+»³zˆ<Ö%Ûw9Ü:8Á2ž%ýþvÛW&ì­Júv‹gBJº`·ì ýÛ’aÎÕöúù´jÆhµ®ØŒ±’ŽVG} ý)=vÚ.+i“èNh›×b3ßÈë¨ÈÊ jijGu¾9R3_¬d!Ú¨3ly;C”ÝÍ¥ª"ÝÂ$k'¾¹ÙÏ}Ê:D)p°fgi;óÑ•…*d¬÷uM5§ÈLÍkÍߦY2‰®HáÕ½µa''3|+§FÀ·Kñ3]Sˡ̸1—oQ>Ÿ +’AµI:<Ýáî‚rX­6Ö+×±ZŠLîw¹Ë}é«´a³;$>uù0eÏ[à–-DŶ 㠩™mŽžÎ&ŒËi»’’Á¢ßVü¯ÜYÑs}ÑŽ³wZ¶š;bš(Oß=&3x{W­íËÚ+ +.úG6ZTÔ]VÓ½­$xšÞЯ.ÙO0i¨U€}ÔMÍå­ôAÿÇáÿþOÀÑHž€õ€á¯3üõŒàendstream endobj -4190 0 obj << +4307 0 obj << /Type /Font /Subtype /Type1 -/Encoding 7213 0 R -/FirstChar 40 -/LastChar 121 -/Widths 7214 0 R -/BaseFont /GXNLJE+CMR9 -/FontDescriptor 4188 0 R +/Encoding 7548 0 R +/FirstChar 44 +/LastChar 116 +/Widths 7549 0 R +/BaseFont /ZEAAGX+CMR9 +/FontDescriptor 4305 0 R >> endobj -4188 0 obj << +4305 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /GXNLJE+CMR9 +/FontName /ZEAAGX+CMR9 /ItalicAngle 0 /StemV 74 /XHeight 431 /FontBBox [-39 -250 1036 750] /Flags 4 -/CharSet (/parenleft/parenright/period/A/D/E/F/I/L/M/O/P/S/W/X/Y/a/b/c/e/f/g/h/i/k/l/m/n/o/p/r/s/t/u/v/w/y) -/FontFile 4189 0 R +/CharSet (/comma/period/zero/one/two/six/C/S/a/d/e/h/l/n/o/p/r/s/t) +/FontFile 4306 0 R >> endobj -7214 0 obj -[400 400 0 0 0 0 286 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 771 0 0 785 699 671 0 0 371 0 0 642 942 0 799 699 0 0 571 0 0 0 1056 771 771 0 0 0 0 0 0 0 514 571 457 0 457 314 514 571 286 0 542 286 857 571 514 571 0 402 405 400 571 542 742 0 542 ] +7549 0 obj +[286 0 286 0 514 514 514 0 0 0 514 0 0 0 0 0 0 0 0 0 0 0 0 742 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 571 0 0 0 0 0 0 0 0 0 0 0 0 0 514 0 0 571 457 0 0 571 0 0 0 286 0 571 514 571 0 402 405 400 ] endobj -4186 0 obj << -/Length1 773 -/Length2 1212 +4303 0 obj << +/Length1 791 +/Length2 1408 /Length3 532 -/Length 1785 +/Length 1987 /Filter /FlateDecode >> stream -xÚíR{<”é_›9iägí)ÔYÌ`Æ­Û¸mŽ0Ä¢´3ï̼̼ï\ÞaÆ-‹®²å¶ÄøH.…nk[JŠ’´‰¬[«-b[ìŠÌûÒéìgíŸçüµŸ}Þžïï÷}¾Ï÷ý>?ãô=4¹£fA¶$;/?* [’ˆÆÆ."ˆÁ(âÊÀ G@vp š„¬I€Lu´qp$Y *‰`¦.f‹$;@ãC"˜É@€ãB|\ƒÉà=(†0™% ñxÀoñ„øAbH ±,‰d2`ÁL „A!Z-úñ@Ø(°{[fIïZ‘HŒ›¦¸I3€[d¡OX›håâwA¸“ÿ‡©åâîÏ›Á_”Ç3úC—Á‡y²ÿôQ¾@‚A"à…² ²œ½µæ±` y×cð`& áð @z[‚Åî°bÑaŒÉlO -Õ!„µÜÛ’«]»ÝÝÌ—^s©EgÀæ/üWt‘»„É¿a<,ûH–$'âß»ÝþeW¹!L”#ø8P¨€!1dD|.pD1d#,H - )î×ÊA1üÀ#‰lTD\|L[`…"Ðbq SHÀ -‹B—ðÿÉÙ•ÆXàƒgaÉd`G!Åýž€ÀB äáŠk‘HvöKU¦D$‚liˆð¼Þa6Œ§ ARˆIìéF™NÉáÙU‡ËâÝŠÚÊ [Tœ9Õ§¼¿ªï¸©žô]š -¯ô§pKoe²"WçïC„¡ Qszâãµ±¾-î㟠OåtÍE†åF_× ú9×KöƒÀp&iLóFUçÔŸöÞæ²ÌàâÆü‰{c…tSWÿá•Ï6¾w{_äÕÛyÉT» ÷\^À‘C•&6ý´r„eGm(¢´2ÓU’âè]3:‰ÖJ´•Ejg2æC¦^´ïܧ+ï¢îGZ»s»ù<.#åÄ.sÛ 'Š>Ï»^3§¼(·ÚÑfSer*éÜ&Ï`PÝ®¥w=è_{5?Þ2ñYç¡æ¸u ³œ7=Šo}RW}¿)ÖðŒ¾-]Úžº½ùµjËyº±Rƒð°q¼þîëøæ—:Š¾“¶ÏU§„÷–.6⑼ZápÝÑ‚° ÙŽñ½ß(ìÒ'¬£©»i»\fÊÉ®:m†—¬íÅêÎÄøüÕ¯Ú|èÿðmù±Ÿ8Óï3â£ýË\q\OËÖèÑÔ|UâŒtôW½ÔÚMþ~ïs‹•[™ö5¼ÉÝÛk~¥˜!ƒßu{„Eõ,„FγîŸo œÃ>ÞÆ4Ü¡¤5_ -•oËŽÈ軺2÷Y¬÷„xŬ½š¢lÚwZïáLV!×µùrò¹5üµ­ãAFþwñ°»gçŽÒ׶•d—L'TýíùxæÅ×ui%«ÂøUÞß°©eIÙí[° ËjÛp¹ç§/ö4oM(gzΙ–gœx>I½û-Å÷á¼ùæä[)¯ÜÞ+»Ü™'3Š‘B&ÐkI/´R® $ûˇŽŽœ)ÿò ˜¯E}AO^uóŒÒѬhøh—XHoem|³ßYÓçà×WžÖ¬í¶ç òÉà bãñ¯Ïx«™Kú‰ä&}MåéêìVÿ¼7£Ô6¥"ât»ÍØÔb¢gýÙ§m'¾WsP-íáv]rú6¸M¯oÊBw^}ɇ÷"\²ABÂÇ)wøßk®PZ…!Úÿ¬|,‹4Hψڣ×u’¼ýææA§ñüFzS⺔Z§‚¾cùñåê™NÙ—GWŒ}úø\§aE®fzñÕ€6ÊÙäG¯W³¿GAÏÔ˜é>¡Î_zÝé}¾J^ù¯ÏƤ3 í‘é)E&›Js[¯EE»kçTªtx~qüþlnçÀq´&ËŠo¶÷üêú¼Õo"Fv -œVÆ÷8œû„t§©%¯4é¥[œ­¡\`~à|°£ïÈ ÝÓ:‡àíku7L^¼=¯Þv\niH '´Fì0§~Tu\7qýúJű,C9 ¾úÜÄīȪC#ñ˜ ¿€0|pƒ~G]{g÷ýª7ßdÅ<½ÕèÔ¤þÅTKÔ°íO«§wç¦1Bª\КCCé6©®£rû4ìd%ôFB=Ÿ- ëÔ·0JÞNÜ"ž±ðô;<Øs8«ÒÅUÜìt¯Ãû Žf3 ©Ý£ÿ昴¾àšÁk0³âdEYi°(¿â_)d{h€ê]”ÏÎ ÷­ÊöRjÆ™¦¿ -´IP,¬ŸmxR€Ý¼u£¯D¸wÀš5Ë©•ÒZƒ~øi3+ XÚ£:=Ò;ý’}Wš|²aoÎæ £±#!‡Mn‡-˜qá^Òÿ¸ˆ ü)˜<ˆ!ÂP>CAü¤¤Ð;endstream +xÚíR{8Tû&ãtÜ +¡,‰h23Ëe\Óf°yÜ)JmÓÌb3k1³“Ë–‘»1vTrH%É¥è®Ú‰&¡´©¦‹ò QS¶­³ètösÚžó×yÎZÿ¬÷ûÞïý½ëý}&Fô ºò@Ì$Í7 +€$ +ÁĄƃŒ"n r@{{pD–¤:XÙ;P, & òàH6˜ÑÌH¶€ âÁLø206ÄÅ5˜ „2a’\˜àâÅA,ÌÄ€ÝP$ŒÈ ~¼°ýRf b¾¶â 7˜á&ÍÜ" E8B€EÈ~(~„;ùo˜úVÜCÀáø1¸ òxFê2¸0GøÏ>Ê`ðEYù–º úbÍbÁî·]/ŒÁ™.H$(_J0ßN€Xtc²‡-Ö!„õ­ <¶E äàí!t×ââm.¶è Á¶cþ%ºÀ]Äàφ';($ +ĉøûõkç7G¹#L”#ø:ØPÇð½À‘ 0‚(÷K&!(†x$É@Ê#,\¦µ=@Fh¡¸ˆm(‹GÿÀ ŽÙ<è ãÏéêŠ&$Zà«ha‰‚ ½`kCIþwb0Ç + /7\B±µ³_¬2<„`‹k…'øGÀxÞ”1 ƒ(Ó1=ª¤ù@mŠûqqÒy×È–|¿óWv¨î{\ Ï9y×;vÃÓÆÙSeZQ1ŒŸÓçgµ't{H÷Ææ—öÏÄ…”íiÓyWæ+|³V¶o\íRsßÌ[yÿÞ§]µÅ¡':+&oWÑÍܶ¼Y6d$wmG\ÓµòtªmˆG'8c£©•Q zilm¦uÆp¼zq¡âðý})QÊ­Ä_§ÐvæìqåÊ¢ù°™ÑÞïvh‹ú©;‘žþGì.‡ÍÈ>äI´6úÁuÝý”žWaWZîÜNZ[i`MOèÍqîú¨Ø}}žn2»\é^§ôêÍ)]ZÃÏò¬_)ÎÄÞ&ѬVóÿ^ÞûæJæÑÝEÂÍÒí¿ ÛNZ¾ÜCõ‰)ð¤Éê@7-ñÚ3–v|UWBJÅ_Þ‹_øÓW|ê~+!È$þSaþšÓs'’»öŒå¬ O6Ö2P™P÷Q¶.aŸ˜ubÚ]äLùlzyñݘ9òòñ€×îxÉêÏáqó¬;»ár´û~síæY—®3á¢M%ÑEÏš–• %ùMò>Ù)×~ø OöS°R™[×Ùô n©²“4Äxù–Óžìæ±ms1÷ ÒV‰«Kª?¤6/}%->ýñJAµJT*·Ùï—jí¾’Þ X©Å:Jä½k4¨Ë)µŽé=gVWt(ÆûIÎÍ6÷æ‰ëÓ/g¿w_2^{¶¯\hœ(Ú +*ÑÛ)£êÙ H½`gÔ‰‘Lé‹Êºs?órݪŸõEÍ•³æÇ5ø™ÍìˆmUô–Ñï;]Õü¼Ðð¤ê⪻HD4ZÏ7‘ê´Éü”‰R„Þ–7P›=ÒRÒ³¥<ÌÝ8G<;}¤×ª6³˜\sìWñ¡çÊöŠ'Ùýg„ŠõŸÍXhkè_­Ö¹M+R‡ýËÞü¦Ñ`Ó¦©ÛøH·:'¥büE|~èܱþ¥£´¢“~;M/»Ýñ賃)uªÅ^Ž%gÇ:Æw=ª9¾Æãؽ¹ ëÁ’ƒdÓÖ—hz ñRØ©=Ù%)5†*V¾ÆvåÛÕ«Ô50ÝLcòðRŽÑ®­‰ÏÓ¦0RÙ‚ÂóDÂg59¢.ßüˆ|g|WWÇ·p+5Ïi G_6šÿº±÷*y¥êÑV›5‡}ì$¡Ó§Åò`Ôj'qt&»æHÕ…G f¢$šÅ!aÎÙéy.“¹FÁp¿BV‘oü Oì¼îë¬ÈÁJÓ}V½ÓÍ[²"·BRäÉ4±¦ñÛµœ7ÅO`Ÿ¨q“óbcMnžS],“v]¶Ê‚~^ñ|ïIVƒÛÆúÊÓ†¬3K“±“çË^«­¨¹?ûþӄƘ>yÜû©+zðJg›&c/Íè®î’,¶Ü#ݦÏÞªÕ»ÞhéD`7ÞjŒ|ÔuÎ=öhªaà5}Z{‡ªé÷u’“þŽöêù´D•=w5×EiZø\n¹žfП†À?g Ÿ4Ô¡ÍóDë§sûÚd‡ëüúÉ +·ï¾òwß×€Ô&4†jvOݺf»óiÓr¹Üe©Me¯·e.MÞO”ŒÎ—hh=t¸–d +f-£Q%z‰éó[EY;£Ôt,É’„ª_`—²¼¢ÕKÏ\N™ÛH6•ãO¬:dù`rÿi¹&•hnù”pÁÜT[ZÑ6mNþnå.ñ‹ ­ôP-uÒå±³œß:Œ›äÎIY³\×X …ŒÖßñ²À¦>¦éjT©¤“eþó>—ŽxkÏȨ5´Ô¼ø0­óqÆCÍÎo×úd©u¼»2ôpîùO×;ŠçÄìPw´‡ò>„ÿ üO09ƒ‡¡\/šðay'Ìendstream endobj -4187 0 obj << +4304 0 obj << /Type /Font /Subtype /Type1 -/Encoding 7213 0 R +/Encoding 7548 0 R /FirstChar 49 -/LastChar 50 -/Widths 7215 0 R -/BaseFont /HLWFFU+CMR6 -/FontDescriptor 4185 0 R +/LastChar 51 +/Widths 7550 0 R +/BaseFont /UZXPBQ+CMR6 +/FontDescriptor 4302 0 R >> endobj -4185 0 obj << +4302 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /HLWFFU+CMR6 +/FontName /UZXPBQ+CMR6 /ItalicAngle 0 /StemV 83 /XHeight 431 /FontBBox [-20 -250 1193 750] /Flags 4 -/CharSet (/one/two) -/FontFile 4186 0 R +/CharSet (/one/two/three) +/FontFile 4303 0 R >> endobj -7215 0 obj -[611 611 ] +7550 0 obj +[611 611 611 ] endobj -4183 0 obj << -/Length1 773 -/Length2 1206 +4300 0 obj << +/Length1 821 +/Length2 1653 /Length3 532 -/Length 1774 +/Length 2240 /Filter /FlateDecode >> stream -xÚíRm<”k&DÓŠ£#/'¹Ç‰­0f¼ÌxYi˜Ä)/1%1fžáaæyÆ3/ÞíÉ(/Ç‘ƒQ)¤_+ÇñžŠt’H”ˆÝ -»„ -:8Ù‡¶Ýß:w?íoŸûËsýÿ×}Ý×}ÝC"ÓË”ÎEƒ g›RH[àäæi ($2ÁÐÐ ƒØbEl1d (66@—s2 Pm-ll-qpB…Q";œv®h€.€0˜ÃF€[ p ›¼P ‰£H€ÎçÏ•"à ‰ L -qI -paŽAÁ0B0[ñãŠðP@ûXæJ„ŸZRá¦ÀÜäN€[ä¢? -p!ÁÌÅÏ‚p'ÿ SkÅ%|¾;[°"gô›.[ó£þÑGB‰€Ê…0d-ÕúhÍ âÂÁÚ®«˜Í‡9t$˜òÇ,r†#!.sBÍA«uá®5ǶjÁl¿³'ÓÑÝxõ5W[L6Œˆ½£„ÿ]á®bÊ¿0ž G?2‰L¦àD|}úó_sÔ^„ƒra+*`c;Š€ÏŽ¬@ ÀŠP$î׌„ b| À#‰<#¬<¦¥ 0Ch¥¸Š­ÈÀL®âßÞÉÑŒ1µ SsœH!ÓÈ€fEŽûwâ!—@® \‹L¦Ù|¼G‚a"^"<¯O˜ãéBP$Ä!ÿPÒ‰j# ¢§z^xy²eÒp„zv¦âp·,>4I¥Îxè Ú$ÑX(Q9ŸõáèüDï¿-gû©þÈýþÇ!üö7i.Æ–úi%éõ K UgÍz,j2ò>û³YlêÞº/3ûï>Ó­)Œ'%<í;ÑYa2jШ‡Éª‚ý —‹“rð%Ù”^Åný¢û’“º iý¾c+v—Ç7<ÌÑyp½û+WšDŸž$ømZ¼nû´…¤ðØ''zKíæ!µ¶€ïK(¤ß9_øU‘W¹!–µ<Ó¶^¾Îæ˜g„?aéñPê5- Šº×¶£ŒÒÎýGº|uus6jŽ2³SM~>l¡6 2¡¡t]ý;ª]Öæ½üÏìu“ï¤!VdÁ[Pßc¿½1Ws—kã¯G{Y?õ"öøFšfQ¶È6–œYw­}vvXÞÉNUx¦5®ùyHÏò´ÜÔcïRýšU4œ$è(™óÔ49Ó³û—€ÔzuWz Z£7Û ÕÒ±,ÿ?€’¼¹™™[š9¡bëW3Ž&w% )è¿ÜñƒñtÞþ…*ê«B þF©'f”þ'×ð[pŽ«/¿§’?oñ°TDí¥ÆÂ…ï¶uÔÁJol?z¹Nô6A¦™”UwogØ·Ïžvk0õíܤp4~ÐN.s:[•vÞ;‹Ô>q©´2ŽTœÐôÆÈö{ÆÕøÖÉŒ­ÊÑJç„çÈN‰]f•VåG;õM:Fi7ÓJ!Êæ°À[ûbyæ-¬sHÓù}(YÇèæ•YIU¤aR¶ºÖ<±ºd£¨‡jÉj¯”¶½½ÆŒšWp •/œJ'š»ég/­“«Ì?Ϫ¸ÿ¤¬¹#=¸Õñ¤pOûÄ» :tj0…Qaªu”ùà˜Ó_ªÿQ'¨Òäç »ªÅÃ^²ÊË ƒ÷öYæq>ríÐè9Ò”bÙLCa`@³Ýá®o_È]¸K˘¨éN俽’U›4÷p’¾õ²šB[ôŸ eÉëö£–L®IC¯+Ÿ.š¿ý³½ëf¿BgêùÍÞ¬pòƒˆD‰ª¼—}ìƒRMö%ƒÓ^±ó‘%Çï†;—5 éXz¤z0“uTB8å‚úßËœÎòa©ý­'†T|Ø?†'™4ŒRm×ñŠÎ¼Òí)brøËáØØËE½Öt©†CÿØ#UéP´ÿPéœ!±Ô›×'¾˜-Þ^Üõ®à–APJ¸ÜÕ–qíòëc5 4÷5ÆåZ†:,Ô—†$$RŽ«®ßÓ3÷:.½é”îiãů ÞPd|FØö—&Qæ½ç Û;6…`—~Òû›¡ÊwKíV¢ö!åªL&m LµTR\wöß>©5î&ÿ‡áÿÿ>ÄÆĨ€…þ¼v¯Jendstream +xÚíRk8”ëvˆjK9'ß(S9Œ‡ƒ”sÎLl)Ã|Ã0§Ægœg¥!*•œC%#BÔR9Çf¥"9µHZ9%ɲØC»Ýµ[?÷þµ¯ý½¾ûyî÷~îë~^5¸ó-SôbÐ!-4m˜;à 4SS3gDˆÂ [!Ð@ãphÀ4ØÐAhŒ¡.ÎPOÌÌ0ÅÏö™ï_'aSÈ¢øé€òi| _"8Âð¥€P0¥Rüú ,6HBÂÐh€Dñ…ÐB‡i¯û±¡“ök™ÌüÖbƒ¬ ¾)`ßä~€o‘Ä SÃH†i;2ø³@¾“ÿ†©Å­‚©TG"m]žŸÑ_ºD…öÏ>ƒÆ †@àÀ ,úTwð«5D ¦ýصˆTŠ¯)Ý +¨¯%J%$9S _€L¤uNúÑ?¶ ÚVNn–ö‡56¶¹Ñr&Rèkó_¢ëÜ ŒþŽùÙ°(¡€' +‰B¡ùDþùöçõÃ(Kº/ƒD¡óŸƒ> ²XÄ0ÿ]ð‘>(t +€¡|¿ÚH:â_ø‘Dd ¶¾L= Í ƒëÅ ¬´¡ÆwŒæcøFéÚþß!ÃglÀ¿f`fÆÐÒÅZ:|a4 +‹°ú¨¨'ºÑ)'ƒA þl +‹ûƒo0‹Ò¡GÇÏ÷&SøÛÁPÐöúÃ×(& ½òL!Ç’×Q$¢.hæw?Ññ^ýË1nïeAjþ»“êCe„åâÌíc"c*!+JAçª#]žYÍDŸLÌè^c{e†?P"Ìg:„½cª~æNJ>ªìZ˜Òtêj+L9š×|uöï“7œ÷Y¸¾ß<hðd—7dÅ`°«Lª[\lBŽ—Ê8Y¯7"•’´i°Ë ˆÛR¥Ñ?Ǩ–^æmÉI^=¶0ÞyÈS6»ãEÞÝãÿŠFõ'žO8¬¡§’À»˜õàáÊrI¶öÁÝJDb½ë@v2cYµ;©ûÉ°bdùUòô@WlÛÍQÕGÊ,n‰Ÿ'x¸`B€r‹;¥\d¢ríyð™Wí0é„n÷–w=E&…œ‡/Ó^ÔµÛÒHì8Ó0O‰?êô"j‘Â=K —­ÜÞ/Ùt"—‡FŠ[Ýüs¹xk$amºIT° +wâ[éé?wON-ud×1‹¼6;gÞib2£Î)çŽOìÔ•œ’Àþ‹Š*­Ûžxëì¤þd´I1¾õ$„úÃ,ÈËR‡ìy”.£nSeÖpj´“ðk×%x‡{¨V¢Z–+Æ»"t¯y~~PÐÜhóJ}T͈ÇÚJuÇÃe³„Ÿ^¿Z ï#^FóÊÃ4“/'νP®ºûÒ“mlöè½ViÊJö2x§§˸¤@3§Í4iŽ"ºl ûvK…Ƈ »åÌÌU:/Ò1jjë›î¢ÖÉZî=È“Z[ vÔâi„-AÍyÌåË»Zª("s†«n“BAŸNseâ’«žî¼0<Ð.íü§{›„ð1NŸ‘@Ò‡”mØ×dd³ãÖ1+yÅQȧ«ç†¹w9õ‰;7‡‹\g^G™Ç´(81ïݧTÎì…3x»[sgªÌ!û*-vS£Ñ›t`$Ñ;ÿrµzéã¼%\sÂ|'2±h*„­Ymó$ThÍ’§0®[ȽðY¥Ïûõ® +UïTxŽ&3aÐ/%2Ì%cúvìO.6¤+»·µªù)jGå\ßsKvZì·ûÓ­¿¯…T'H>±‡7tUò¢Gé¶üBï(7—»Ö]³f8qã5•·–NNÃ/ŠµÞ•€Š­K_[{ É ¥X$ä¼IŒñyk„M¯W´jLÔjwcD«P·3›]¤UM ë«V’¶¿ð»+ìiîÙÝ›e—u^„•Öž·IˆEÙ7Ã'Mf}”=ZÉFoœ´ èÁOò§B.YÿœoX¦‚­\°¯Fv—Ë’mw½ÛRg?+Ó”klr³_­L>Ó%YX»Ð«ŽGT2÷G&[¼üÆ…lsÖê¹ÒI‘JWh±«¥¶akº‡ðpDZ£ªcuùfŠ³·Z}Q ïŠ,ÇÌ¥–r`ã>å®ôþ=µs™&¢ÕZ,²fVP\À;þÒ“x9ïËòkõð*Ä™dfNÁƒL"#KSÝUùsÒ‡ÕØnlj +™Ö†Ow‹©»«´w³æÏP_„Ê¥ª™&£ÔU´¦° .ewr<À}*ŠÛwPËÚG”ùC2Þ)4ÒÑxl(Ãoš,^6¨‰|LJǾ (£‡¬œÍ½4tškg¥¤O§K¥Å×±"Jà-6\m|Ÿ·g¹øÂà|eÕ‰˜4¹Š/ySOîo[6TÂCO> endobj -4182 0 obj << +4299 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /KFRPBN+CMR8 +/FontName /FOUELH+CMR8 /ItalicAngle 0 /StemV 76 /XHeight 431 /FontBBox [-36 -250 1070 750] /Flags 4 -/CharSet (/one/two) -/FontFile 4183 0 R +/CharSet (/one/two/three/h/t) +/FontFile 4300 0 R >> endobj -7216 0 obj -[531 531 ] +7551 0 obj +[531 531 531 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 590 0 0 0 0 0 0 0 0 0 0 0 413 ] endobj -4135 0 obj << -/Length1 1352 -/Length2 5101 +4250 0 obj << +/Length1 1364 +/Length2 5434 /Length3 532 -/Length 5935 -/Filter /FlateDecode ->> -stream -xÚí”i<”mßǹKö=Æ–ÝÛX“ì²el³ØÆ cÆZH!$”%²…lY²ï[%$ûY';!Hœ7ÉP”dR H²ˆÀbÐþ@™`IZH’“ÿ Sÿ\\—€F›À<þ\þ_1ý·˜‡+Úÿß-XO‰cH柭בÿrgŒD¸<þ9j€‡¡]ášg4(–ýWÑÕ[×Õ‰0sÅÃ]€(Úù³ŽÄ þiƒ”ÝO K c‰¿¾êÏQ3˜+oáï‰ÊüjÿÉà_LÊçê´•‘–‘“I¿¿Þìÿ¡¦ƒc®Ò±PPÂp8˜?€t>H¤ ]1¤éG² ’Æ`ñ¤)@R.·(,ðçG%í„rý³öå” /–ÜÏ|þ*ËËAp¬‡ìWErñ÷tAb~• OÒD,âW y£aÞ.WI­_¤iÿ"’¸Îß‘‚tÒûE¤NÓ¿I‰Ôiö‹ä€ èßDº3 ' îŽÄ£‘¨_;R–û»þŸ[%UЯm*“ :ý"’,üoËt¿!I -ùþ™ìoHtþ I‰ºü†¤8]CR”n¿!Éú7$Ùðø…¤“Âü†$ØßdÃó7$éâ~C’®÷oHÒÅÿ†¤,¿!ɆÏoH²áû eIºþ?ñ¿_‡+W°~R¤h¥dH§SB”oÿg£%ÆÕ‹€4Ð*ÈÈÈ(ýû¾À 8ƒÿù'Dºj1Ê•t5‘H?$0ú W½ç–ü:¼0H'çCÑ91ož”ü{} a•)ªÒ«SªLC¸ê÷HÞ-Æ0F7× IÄ«% Ja†óµæ­Î@((ì3c'‹Ø³TèëðU;‡³]™-ç=Ò#Gùæ=«%ÖÇw§}Ε-ƒ!ÙœÄ(ŠÂ‘OÇÛAîÁý3£4O‚ IûÌ:£D¤ÕÒt\ïáš6;ú¼‹Ý.u—ùd”³eò£û]Šrt¦1ùpŠújð„K!S ½ Ú²)\¥{×l<Ý€¸>{êD|{ ct‰¯3Ô^‘vž3ô¡¹§Õ,´è‡ïD·SµßÌ5A‚˜¢_x¥?4ZèfeBˆïksÉïE’;>Ò8àHŠýæäß>äž±ºÎÝ KSîó8É¡K˜òcýIL[AvZ¿oóòŽ;”wr/”\¿Ÿ`ì½{Ênyˆ°‡”q™ÅZÝlª”ó¦ñ¦€TZ õž™ª©­™zZÝDêl$yêæÙ~\—zóqümH}í®Ð¦Y€°Øf‚á Ð'2‘õv|@³u€µöÒÆ zÁpÚaíš(Ò÷ÖX¯`z^˦´Z#h ^pJ7£Ô¢3–‘ Uöó3*žˆôäYyúm}1ŠnJð)Rû®ò¦{†„ÃßWõý­niæ}êËvC¶cÎÎ gûcLÁ[!ÂÜÁjOö•´õ]ˆ€ŽxŒ"íb3ͽ×䧬{µâþE˜ ÁyWovÖÝäe[ÇÛ.JX·õ³=òøo!b ¨js[ G¡Îg¾Ô`ƒVØnoéö´öE`|Ó÷ä×z.JF«’òÜ1ï‹G „ï…Ž†èyã@¡¼®Ú9K.EoeßÑÖ ‡ÛGÙv+Obî€wQE ÊS+ÉkƒüZöýÕê9Š*/ÉB÷fÙß#8æŸZÔµëä4…Ss¯¤»i«Ø5LÅ÷\ΚR=ú(É'™IY[Á} Ð’¸Òs)(ñÖŒÁ”òÑo¾·ÙLÛéß'StÍÒ‚×1·¹èÈ´-ÍÙ(…ã-¥5»Û·&éɾéykÈè–­Ç™!ä¼´.nÅc>k­ B¦¦¬E´_¸»‹î U>BMÍuuõ»?¹Œ:KlœVÿ`Ëðîz§ß‡s4lcètâ7š›`çL:'ªññÐðšި‘,c?mKAyõ™y’½1ÑPÕw§Ù/Ÿwӈ䓩¼wôÝÌ{ó‰>6ü‘W'7–'tøCš-®s|Q„²d¿%Ös; -³.cp/›rȦ²’â§c}Ÿ¹OM– -&ÏB(ZoÒ2Ïe”pøþ0zL¿Ñ|ŸÇxÐÁ4諉°|„ù`äXÂiÞhÖÄ“¸'4 ç|™U"¿`®§F'ÝùÔê8¬:µùµ\$Ñ’Ù„Æ»û &ÅK õw…ëÖþ’aߤ®šñDžÜ>’¼Úš²÷V×þH<ò÷ö±Ê•ÌçW3ØÙ¬©¶çb{ƒ=B·ÆOâ^|¨Œ“täŠ\ᄒݞϺ:þjið«iê¥ —rçhÆÉ’jè°âùÛøu}J&¹~Œÿ1öÝHñm¯Š©ó³CèÉ!y M㿪c‘Ò/BΊPOÅ|IÜÁ«òÙ×ñ&9ª•%bÕc¾7o¿–1·í©s¿Ý…«CFCUk#×ËfzW5¹B^‹®xöiÈÁËQmÜÄõ2Õ-ESv•¸@oàè¨-—1))Ùz§bŒ©Z5`•€Œ9¨›GWçR;£ûŒtÔEé’ÉU½fß/²LÈãfèŒê¶äÑ2 Q¶2w|–ydU¥?┋Y'ÖU2Y´nÖ—Ì3ž"“(˜R¯0ÛÐÎ|Æv]ü~œ4:—»¢s(KÝGdÏ)øð»óz> ¾l[g1ë.[<Ývq²Ñ]ƒêÂôDQ–™6Z VçÁ4ÃR­«e´É…³y¦Ô\NlRìù\òýšÙÇ«.2#wiX›cý¶Fù2ê2d‰#'YáÎq™¯Ï”°~Nb„Ý7i¾Õ¾]æûZ~]ûyôÅÇ1øÕfëÃH®xxgèžÇZ÷ @S¹jΊƒÖÁ§U{á¬öÝ„m®è–‡\òV“^K º.†câŠd(ŠST<Ö*«ÐPm’p"t¯¼q?hG;<íÅüHf5¿å1¢õHƒUg‚Z>îC'Õlnþêtqƒ9$«€ýº2Zq–þón“íFãáéì6&‹òqoILšR~JX†‘ »Ú¿6["!sÏi³÷Íþ mË,õà˜d²!“ZôC£EݨTûäL# €ZQåMP&ýf€|SÞ1Ç@>æÆ0ª·9ênòq’vUÄÒ²Üe9}ˆ nQ…ˆñ¼îσ7!¯É²5úêjÌ&w×~b˜;:ß`5Åb±(¡PѼÐ\Þj?•}¦‡u¢ÙuýÞÀ¾Loù]}òJXî ³y¸L¿ô --ÿ]¹¯B¤è Þ—Ìc[,Ë¡Ô«ý?ª¢br§û»\š‚byÌSÇúO‹/˜¯K÷N‡w6ÏÔ¾s›ÕvnkžÙàŒ)¤û"¶t6Qàk· Ôãv=¹Xt:x‰?à I9*Ï°r°d@!d Õþ¼3 (ˆã9vL¢«Tq&Ž—W슾ˆ -ëËÏ×iƒ¿Ý)–Êÿòí«¢ø5Ni!*û¦·²)ɃйáÊõ~¾<Àp@\Uª[ZàשOF2Óª`†õ—/d÷<öøvÆë-iKfºh@³]ÙkKM³¸æâ9™sˆt»Ôà.Þ0ƒÑh‘–Œ…굚^†ÅRúGü)MÕC„Wµ—Ÿ ˜Åá÷­©PYM.©SÌß$šf FL´y\òbµQAC•LÈ‹_2}-$­*×Eβsbv**`$æ^´Æó0§» -›Þ¾ô˜/=¶H@acò){™ÛŽí¥±8'¯-‘šÆu2§CËÅm (¾puå}ãèG{ÈÁáUýœWìü÷+Ùì´ã¾±P±ÐåßÏïœ<ËÒvÓ;dB•"â@­lЈ’À2:$†2ù‹˜[£|]¥7Ÿâgj}2‘Ík*ôC¤ÿ†^úÍkRå¡æ|ÇÞ½¼÷<ìær*®Smõ†°^ÙUš6œ–zÑÓAD¥0’YÇútuÕŸ¼à6Ø<ø~ žñÌR3IsÎeœBŸ|·Ã|öQ²z&ñ“‹T¯@‹þÝGN2VÜ3;s½ôNû&.ì5MÃ߸ÔJ ñ•ÚÃ\Ú c¿ìU®Y!¾¿ÿ4}_„èö2˜ÿñÐÂ}vì];±®u(Æo\ÆÛvv»ZzѱÖb;(âÉ$Q­(ôl¿!(Sº€x›ñ/TEÛåÏüú×SÜÝÆ&ä'sï\ÚšKº1ÉkÕî¶Ô/cÎû~k˜XÁ«&¿ë{7e†1£›]5µØzÚÝþÚ¦…å@é«Ã9H@‹Í΋.õ¯S³Q ×”/xOm‰·iù¼¹ty½K :gúöÏ¥YŠG»rúCn^©[³ŽÍœ–Ù•(8[3láuô”ÍÓ-`¯8ä³ñ‰š¶œÔQ<—©–ïv&]+×u9«¨¨ã!d‡bbë‚[¢Ä‚]ÃŒnŸd•*]Iã“ÊÚ#Ö) APÜ?x4õÕrBM”™ÿKìeµW÷×ÖA¨îî+¾b®k÷?¼Í¸Dè^¨¾kJ”zt6Ô!dÒåÛ¯[j_D}*2Îà”îgòF46ÇUžÓœê´ÇP¡æ¹3뎚®Û®Q¼-_v>‹×VÏŽ/@ƒ÷ìvÍnSûHCètuw~àˆ¨ËÜ´~ 3_º‰ùþëãá©’D€ðGLŸ_ìYê¾õ²wBL÷˜šÁ5am<÷¤T¡×É^‹*©K63B7ŒWŽš]ýš²¯ë’NÉdÒDŠ¦´Ø«‘SŠì”÷©Ò—ô’€JÝ„ûš½ÒŒÏÖ_É€¦ƒŒA\»†¡NªEëåÞ ŸGöRñØóõ³|O˜f”·ÃRõê@WØ»-?¯=4eímÑÂæêb!óè%{V“Ä/K®‚ÁcÍ“ÜJ÷ENß÷ÞŠÀÄ[<ßoÒ…«]Ûz5:8EënœFÓÿDcfô ºœEY‰.}lË4g͆;{ÝÌ6/âa]Þ±¬˜ºy>éãÖ“_.y<Á½×à¤5ùõXXû(3“3• kº¨:‡¼¾µy±Â-㤋µª0݇—û4ÉÊúÁ¼&Æ×æ@ºJ †8‰Qq›©—'Ú òQF²®Hs¤ºBåÉÙ{ô®R¾ÌÎ=ÊóqØã>o’°Å¯ýy©„»Rc2+´] PS{äý¸"1½—ûec­\PÓIz¾Ä’“Wë¾Û{Î8QR“` Þ8H,´ vÏ ÐSˆ†iê Ú9 (Ït°®øf8 >ôƒr¾Ë<¾7\/©ðµ(›e£0±Ò­Š|9„HÜ£áÚnb\£Ú*Ÿ>WíïÜCöú  T_é„Üì§ ‡½Ÿ‰+«ãšC€çõ={úùll KGÑUôS~)Z}W­õµ«ª'PµÔCò ðfþ›‡x}=J¿êÆå,­ŸåÔ!ýcॹåžD½h3µÛuO•›ƒ ‹Q#™Åi/ÐÂõ95Ï>ýbqÙ:ËÔ˜Sµ”òÊg€Ãô4¿¦§£ås>¥±ú­ä>?@^0!û\œ–Lóq¡ò)ª(è“î §j»rFÆ}ËÓ+Ôv>²Ð -Û%*–|•5 xê1Vì=Ž3ýÐ`Úg´•¶UöeˆÞ¯q {ÈâT{wÑŒ£u–ˆÜÊN&¤}rßç;Yï‰VíUãU7g?ƒ~mŒR ì§äÔš*y>î%(hõ• á9¾nn©œûTÀ´nêwöÑ· -Ž»˜î™©ÉÓ_9ú,…(ƒÎW¨‡Üá|¸ÍªßSCùéë,(ÅØÃGfJMÕD,l¤Š[FŠêl°'ÅÆU;Ñx·{LK£ÏSðâ?ŽÏìs¼K²EäæV,×°™ æñwÁ\qêÜYöH­(³7å”ÑÀáq3ÄɮգKy5 qèƒëŽJ™Æ5&&Ï–Sß7%Íg¾}W¤ÅCîÜ¡«]_[|¬ÝŒêÕŠ¨z?7_LÈíÍU²“cß²cØF„¹p§m~µÉãeâöÕ…Íê¼Tºœˆ„IZÐò÷·;11­¼ßlUÞ™ÜɤŽ’Ë4Ë[ [ûb €íÕñ£¶h§^xã4§>ÍŽÊB:'˜ùF¼µa£:7çná:DÔ§_mEµ«žkËÖI®L jR»ò9‘ü:\÷~ÐÎðbÞ£¬ÃŒîVïÜÒÚ:J -ààëÏ>,÷Þ'Ös:£nÇð<‹Î—bŒÊM\:[‘Á32èΪJ»”@èW²´}ÖÕ6ñmF`àcþp B}¿°±¤jÔ6L+åÛçmí\mñ‘8îk{þÕ]/~ÆBrMô¤™"~ŽIdOT ö /™7`Öi}u1¨çóµÞ5{þ¼è(ÿòæÁË€<{Ÿ…ìRP¸.ßà½ä½hJyChË7Ñ#*©ùké‚õglËKµ?RûèaïeîZ„¦—©–q“e…J<áLεîÓÛÁª¯·™žÞ଻|á.^çÅ|þ]™W»YúÀÍKe¸Céj½ñÁׇöÊÓõˆ”of—ô$PÛÔÃi—á|¬üðÓ96Ix«~Y­LVÓôúRKrßX²4òÍà¼Ðæ:?UéQê™:Áðhcݘ‡+€(­ÂíÏ;{þ*l—7‹Þ/„^U¬–x8|s5tÏ*iÆ.†(|ûZDm˜w<¼Š*©Ðø&î¢*HVªÀ+ *,Ï!Ž¬üñ%ã渟-îS^ÌnEø×ÍP¶öû!œç]þÈz›:a—Rw˱ LÌÆ= Äòñðã¥Ã“VY¼BºÎ*nʱøgß÷˜Vags±>­4 ðQGv–óÞæƒó{+ÛËžj -åÄqðNº$ì_XË Iü\ëÄð kz—Ù6U¶x‡ËK:äÅÔñ(¾*koãZ -y5iV·It#Y¢N¨ñ(]U4ÖAcÄn ë²Òp!¸ ‚öxå$ËC{^üÁÃüçßH]y~®ñœúwóÜaÈ«’ÛLK÷(Ù-3¥Ë3b7mÃΚ Q;^ßDP½[²UT_õ¬!롽E—®$jR³!M#ø|}¶¡_: Ä°]gŸ¥ò:­«tÞ¹4î¨Õv¤YI>ZM–PœÜÙº¿Ü±`7¿0§ÝØ©¯@î‘'w ¦Dì½”gÀKŸ•t¥Ô¢y•> +stream +xÚí•WXSÛ¶€é +(H¥.JDj½ˆˆt¤W BBo¢REÞ”^ ¤ÒBGD¤W•ÞoöÞçl¼û<Þût¿›¼äsÌ1þ5Ë +ˆC×@P†´‚« hAˆDPÔ20P‡!a +H‡¢í‘%(.@¤¥!€ÆÁKʈŠÉˆJR€E¤‹ÊÞÖ ÜTäý#IPp†£ì­¡@ Š¶ƒ;ãkXC¤µ=í%(89úÌpôánp”;&D0{k4`·µGP€ÿPRGØ É¿Â0ŒË¿‡Üá(7¼p/É àaH„“ƒÛP€µ‘ø^p¼Éÿ†Ô?‹«`œœ´¡Î”ÿk™þ#êlïäõ¯¤³  GZH…øgª ü/;-8ÌãüÏQu4ÔÉÞZaë!"íÝTì=á0]{´µ`urƒÿ‡#`ÿÔÀ¯ÝŸàj÷tïÞçÿ÷®þ9ª µG  ½\à€ðyúŸ 9gü¡ì=Sa!aa>ÿý÷/ótSFX#aöü±— (Ô‹>ð$ø@{ î À=ñÊ`!Ÿà×Å°A¢(þØTüÓmìÿˆý‰bâØÎËÅŽ8I`üÞ!aç!Iìæu³û;".€­‘NÈóiøJ +ç„Ÿ¡xNøl¥s’ÀÊ“¤0V9'V='Q¬~NøšZ焯©ý7Iá«èž~žÁ9‰`ÃsÂ{¾¦Éß„?¶`è9á;XÞÚúo‚ãÂ~C¼7ü7üc•C¼íoˆ²û ñFö¿!^Âñ7Ä[8ý†x çsÄŸ20â7Äk C¼†Ëoˆï‹ú ñ}Ý~Cü¾£C¼æ7Äk¸ÿ†x sÁ÷õúÿójܽ‹ôôÄ/­ ˆ¸ð' HŠKûý÷D#„½+®®ˆ KýëîXcP(8ýç íþÍ6öøk +‡{­)ÆFÖ²O«ƒ ý•³‹HyÝX’óŸö6=«L–Z›’¥FÕ ÂÙ~Ñ<£q°s%aý^ f#>s½ZÁ·ÓÇüì MçezÞ̃ ›Ökfˆpé¨_…-±/¸ÔðoŽsíL»7‘¾Õ\Hf]_')9Ùòw 蛣L‚q-&P˜§×kÆÿMG÷~WEf#ÇrqŒf);t§c×?L9N\N–ŽH×"þœ,wL™°+¤õ1צ0è +ü ªR!@F·hM7ÁLfϬÖn#4o¯¿Tn¯H;ÎlénÕ *:ö˜è²ªñœÑãÂðJxyDp[TÆzT;“&Ä„[ÆÈ\KˆÚpó÷jv|½¶ÉܤBYæ›ð"jV~ý)¹llÃÃïªNû2°?)‘¬¢›ðéc§,-Z?8~eOGc¯ëâžÅRæ|xáv¡’®Œñý»ýÊM”ü>cÑ¥½àÞ’˜0e¦$Ód4–·Áóþ¬•’>1§šŒÙÓò“É>å›á`Žtlšß–Ó•œû?K?=¼Äuåæ Y€ð~”AŠÐnè¨ÿ¡S±|223_8¶¼$㶠‡¢t•–Œšó:<^ÄF¡M§ç·å6 +<"÷PxÓöGULW¬²b.ª¼wùmã&òÙR8²öð xˆñ„¤w¬ ²îAݤϫ¨Wö¹ÚF+f“Õ/ÛøŒ€LÊC˜TØ2q“ w¶ï"vw«·"x'‚¹XÖ#;D ³ü6öVQ֪ʻGj1£ýš±ó-ò½ÈÓ [u¶¤øû¯ŽúÞ_`±½âýœ†çóú ­žŠþ¨œÑ}Ÿ•©ãH‹ÃˆÉé0>‰ä}P!îÂȶô-—iýzÜEÁ&ºÅÄÄ_ N"²Õ„nb!5_<Ÿ+kp:™§BiÙTÙÞÖ󜭨 L³1Ó[T¯‡fÇmQìŽyN¾hwŠ²Q;8è±êŹW™kOò%ßR¯V2UÝøŒ¼–ëÿ$&@-ƒ¹éÛÖ±2M0à"¹Ë-ªèR¾@{©~“-aU볜‘5|¡¾]ñ„^Þ¥é^aŽ'PgÂÕì¾"^½übÁ³³Y ¸£³=HßQ»¼ +¯e׶© ½¶ï`‰³ˆ¸Z`8]„Ê}†«áv'I~È!̭̤>òzàBYè.ƒŸ•‰'9‡•¤qá½ÀB’¡ÿŒ7Bm¼Åu´ %Ôzi-!ÚS­œÊ{ª[{;Ýíb%ö]¯‰ßtÚèYPÞ¾2$äÈmìyà8Õ[«kZXõ͈&‡#Óñz‘_}L¯k*Ó‡Ú8}¬Ñ”][xôô=.Š¿¶LГ v’Óc×—8K¡0Ê^ãéQýk£7Ø-S¯¥‡l{|âÅpÝæ$ÁÎœâG¤ö‘­"Èö«4õ(uýÑw†{­k©ïŘtž]¤bù"žJF¿•€ ¼•G·_CŸk…¹“L‚Ø®?«Þ.Ö¾Þ¢¨U.Ÿþè|cÉ!qcŽ)Dê–¥ ‹5ß‹œZdºpœ§ë«n3“Åþ‘ï»)Z*þK'‰à=·¤ö›¯}t¶´FŒƒ––µÇ¨ûÉGßkñspï7;~[^o5ûâ?‘C‘]°Ü.—u½‡ö7ßkN +à³M/ˆû9§¼åk@š†y,úˆiö:.ómÍRè×ÖŽÓr¨;„l{·«t@­Å…TA& eš¿†’xŽ×¨#Å\›½Ða[`CXŒí--Î+~)Î#Ék¥ÞlƒØ¸¯jVwÍbœ`ÔPj5•dc§QÇÌ Y‹UÉO¯È‹Óé  bd‰nÛ«÷¹Çyˆ‘i˾…2Õi¬«oŒ-sR§I¨¨==¨Peñs©í"V6ƒ„}ílÍLI™oJwú¢ÄžOPjCç—ã¯%¢6œÌ]Tí®Ÿ®•«ê+Èd”füÒîe$5ô-çž2×謹²±Î•Þ?Ò{š­/¤ê27ó2ËfºÁŸÄh3rª±×ëGJwõg"\RLºTÛ4nàòQžeK±DŽ7ïŠÙуWݧ#ejDÒs2O‚ãÎx#^µî{=á›Ùûõ1T×¼Ue#ßãKÿUQuð‚à¦HlÞŸÿdsñŽ¢M“¢§Ì.ùañM†;5%%òiƒSå)¯—E®‡D$Fi4ݽD„É >¹¶*UéÒc½`zÉ8WëJ%IÆѳÍïMwÕiÛ[ PŽË–-–to·$65¢öáÕtü¤²·¶6ÇüŠÄ;%ÜtÝÞ æ2ù4Û¼Û,–fõ3è€ÞüÕª“ËñfG0’¨y‰*þZËت¼&ú0õ“k  q §Y\ß ›‚bKÚj÷Ó¤¢E¨cß“¶xÒ(®¡ÕNã½/LUÆ3Î`u©­#j/šÐÙ1©Ð =÷o›‡€n3äûŒjô­Äa‚é“Ð÷±fÄÇ,½¶5†Û*ûʳª·—ân€E$9ì¹6ŽÞ\ÇÜ/IürÓ5íˆcÁZÎÚÑÆìu•ÒK„±ÊE@õðUßóH‚E¢ìARÎFë³Y§Î%Ø2¦à ÅîöfÇ~)§fû]³¨ÐSüÍ„ùÖ‰ë-TpÏ¢"vyl¿Œ3جϧDX=–‚Ð4æ°’9W‹ê *‰‰æØŸ&CXY3^ä=³¤Jï÷z$'mâ]â+•¼¼º*µ´h–襖+j\ÌÁò(î^rk†^~oögBò"­›#¯fŽ@$\è–ºÖÕQ¢žµ‹¾œ§ÜÝPËÕцÉÈqÇd-ïªx'.Ï{f}¾{—w“ð¿#£ý:éeÈû]Z‹@×|I*qµo7Mqwë:⌜R'µ`ý>9g<Û¢ºLê:ú#5üdÇ‚Ïo5ìV%9CÜ cï)ª …îÄGìüY¬BúÕïÝeƒ-5?Þ–¹~\ÌQÇÓ6àõSîòxôà ;‚î‚SN«“NºrÊ€M›)LEÒL?} +kP"$A8-lŽjŸüàGØØêœ]Ý·®þ™ˆAÛSâÒMA0»ï°ñ6oš/hFðÃ’L(cÍ·'|WÃv›0ž]9Ò"Ñ^J3C1ßÕd«Žfs• ã…ºv¶¬Æ …¦›+9 ¡Ó M±ÕN5;?¾ X.öªi¾>¹¤ˆ½?¦Y¸oó‹m³µµÞ‚=0öyµO«³gÏQܳ³8S/ûB2î£"ÍÈpîˆ,_Œ<;9ǧIip¤„^ò®OlrÌ3&ÃÃ5Þ—tô[Á½kžš> •‚® eöº¿%"² +=]¢ça¹£2¦—,PΟÈY®ö•>tŒä^®\5O¿³;[&–ž1´##K¤$V5Ïh=ÁùëZ«({Œ?yeKÞØ™ìü¦^o#ÐIVe^TÅ×{ÜÒÓÃ8ñÔ²©[ˆû%­ÂÅKNÓü#7OìVªeþΡ‰,ÊhÝ`ò”æ*ûüUºX¦Ô{›íûwÆ2äëÔ©(¸RíSéñ÷¦~âÉâãfÔÖf&KÎçfœ¿4¿Žœ‹Ô::u;µ=KÈy€‘udPþt§½µ@A¾fØ•ƒ*"·î–•å&Ž\ðé¦üDœL´°$ÿšYª5+2ÃΕ+飼ܳ×CH¹…^Þ¼@œ‹4å ¼ùÚ€;fÇ–FñËÐ +óntíèÅh‚ß‚„ï¡W„Ÿ\N¬Sø&D…Íïœâyn^Vcu£¹:SÚùü‘m•zËÝ( +÷¾ÑtèûÏP¦ÈþK ì°ýx%Ž‘§ßµYž3™.½a¢ùR}R·ê.Çw+Ú¾l‚SV~6PIâêÊ13Ÿ<ö¸øÊžòYMÔ™1Å2Ä–}ûíIPâÍ+¡Ž¶ï…ñ³Ò8J%.L¾†m…¸cØ;hÑLYøxG.»v %Z Ë·‘«#kÓWk¼ñ• ‹õÅÍ™÷¯Û…Z4yŽ»žÒéåU•4̈c_xËWR±."ÈièÀÜâÔ\øˆÏ°?±‘#öÝpßc0†í§vꙢX¨ooF]~< »M5Ô>V ëSVË&8lý4`ÛRy†³CÓ°èDŽ=. õ9R6 ]êI¾:ˆk˜¢õÏ‹h¬ê Ë/2%ˤÒÆzdþ"·þö¥„5aÿÆ.-UÀ¯òºÜäHR¶çþ'ÜŸS +‰‰«6ϥÄS¶NU ‹ E/.½ÕUÝš3¶\› <¬£f wã§Ý|$RUÙŽÚfú(ïÿn|ƒ1ɱ¤NºuœÝ‘ªóµÂ½$“Â6xo­T—§áÆ`Á}¸xŠžº¿À†T8¹M×ȼ„ÔCUô+YÏ.L\].ˆ¡—Ø~âF½Eµ…‰¶ñT9ŽP³·É B=˜c]U¿úÞ;yäP›™t­=gÃÜ"øxÜ‚uñ©(ÏkêY¾]RÌL%_f,éу2[é®:zæöw+f‡=9 PZ©°g&!Sï/Ãà¾.µ*‚÷ ïBò‰%É…¤ËÑD¤J.)ÛkœˆøwõP›ß]s–اù=k>[WÔnYQ}±ÈöçÛ¼WÜKŠ%ÛŒÍò×['ûÊ¡<‹Á_÷3OsÁhœÚ¸cPb£È(±±5Ü—Ôwº“á-óè,I€Å#fK´Ùöt”æ¢ B+μ‚Qi!¿U ËdËå«iRŠ›‘ËèBÊ£›fÛ,´V[µö]Çï»Iž±“^ɸ‰žøæÈ ÚHë—,„¨þ\|®‰%â¬àŸŒÍ›>a™O¡—1º(åïÁúª>©I)ÇwoBŒJtS~7¡OUœ¹ì*SÛk›·vŠ±ºnI®®Khô›æ‰ºÕvðÄ]Íï +iY——ý:´üº·$šzk‡y#ÀÉ'Ê:¢"éA±ÊáMåëé¾UI&:\ϧöö\%‹ÄÁMwëz•¯8…$ ~lËûvJ¡•þ–tèUtK`ZÞ”ÿóàÒË1v åVœ{ýî/¹å/´º@Þ2T0\S׺í&çºK¯ËwSz‘dî—yàèìØ ÁÓETeL~Ÿu_|ZYUÛéØ®Ò6{]Á¢¦%ªIK€™ÔÍ̪uƒ“þš21ùvi(³‘?“áÏ=Séíl»P.Ûp:›\½á¾šý°¼E)E*dxA\?»º.•6 +A™tî;‰c•þ-î¢áq`£†û[y·FJž +·Ð¦çÕèˆÖªQÛ=ñ•Ú}kSµG5~‡ó.©°ttWºÆð)<ùm|©ÿ’ûŽ#ïí}&ÃrÉ•æ/sÁŸUîL3ϦD—_íK–§«¿–ñ¢_WUU~Ð>6Qì‹}óǤ~,·­ai"ççåºä~Ino³‡> endobj -4134 0 obj << +4249 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 -/FontName /TUTTIM+CMSSI10 +/FontName /YHKPBX+CMSSI10 /ItalicAngle -12 /StemV 80 /XHeight 444 /FontBBox [-97 -250 1077 759] /Flags 4 -/CharSet (/fi/quoteright/comma/hyphen/period/slash/C/D/E/F/G/O/P/S/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/l/m/n/o/p/r/s/t/u/v/w/y) -/FontFile 4135 0 R +/CharSet (/fi/hyphen/period/slash/colon/A/C/D/E/F/G/I/M/N/P/S/T/U/W/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/r/s/t/u/v/w/y) +/FontFile 4250 0 R >> endobj -7217 0 obj -[536 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 0 0 0 278 333 278 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 639 722 597 569 667 0 0 0 0 0 0 0 736 639 0 0 556 0 0 0 0 0 0 0 289 0 289 0 0 0 481 517 444 517 444 306 500 517 239 267 0 239 794 517 500 517 0 342 383 361 517 461 683 0 461 ] +7552 0 obj +[536 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 278 500 0 0 0 0 0 0 0 0 0 0 278 0 0 0 0 0 0 667 0 639 722 597 569 667 0 278 0 0 0 875 708 0 639 0 0 556 681 688 0 944 0 0 0 0 0 0 0 0 0 481 517 444 517 444 306 500 517 239 0 489 239 794 517 500 517 0 342 383 361 517 461 683 0 461 ] endobj -4114 0 obj << -/Length1 2134 -/Length2 10127 +4227 0 obj << +/Length1 2120 +/Length2 10022 /Length3 532 -/Length 11276 -/Filter /FlateDecode ->> -stream -xÚí•e\”Ñö¨i)‘”Jº»¤‘A:```è’FJRJ¤[º»;$$¤SJºãŽçœÿÁsîÇ{?Ýß•/>k¯w¯ç]{¿kh)UÕYÄÍ & ¨­ +‡ @RI]ƒÀÁÊŽNK+é:¡¶R@' €C@€ îlà„­ó rq rq£Ó$¡vî` K'½$ß$>€¸ Èl -´(,A6°=L€:Ô rrgˆC µ?O8Ô@Ž +:À lê0Y€mÑÙþÉÙšC|ÿ ›9ÛýÏ’ ÈÁ& ‡I2`ŠfP[ˆ;À dŽÎ¦ …ÕÁLþoHý÷æ2Έ2ÐæÏöÿèÒÿ¶´CÜÿ•µ±sv9” f ÛÿNÕýSN dv¶ùïU9' l*nkØÿ;Ê€Ý@fª`'SK€9âúGdköß°ÆýCMG[A]B‘é_'úEU ØÖ齻ݿ·ý“ýæxbXÀn=vVvvX"ìïþgð_ŤmM¡f`[Ø•àá€îè°»#ÀØÖ ä¹ÁŒÙXm¡N°G°¦xÌ¡èvælæÿˆý9a~B.BžûOòÓ2l¶7hó‚¥Ø;C@f&žþ¿WxlfPèðâ°ÙLA¶¥ ükƒÿ|š›– -tÙB@æE9þý¯dØ[ÿláhý„ÉÚAœŸ0US¨ ð)Â`³t·³Ù>…xÿ¡†š=…`ÖŽ £åS„Àær€>`/µý›y`öN®Oë<0o'KÐ_u~ê ÏŸÖƒ]þÊ€é:Â.Å¿&ërùËvØ@ÿјª-øoþ?ï þõÀŸmlÀÿå… ‚ìOgÏËõç\@Ž†ÑSæ þD°úO«-ùD°ÂRO+*ýoâƒuGæ‰`¥ß>¬/²O“{"Xu…'‚UW|"Xu¥'‚UW~"Xu•?¬ºêÁª¿{"Xuµ'‚UW"Øy¼"˜‹ÆÁ\4Ÿæ¢õD0í'‚¹èü›`ÓÍÄhj rú{.ÀõïøÞtÞ}-ÿ™+øt«`MžVÐôé‹f‡½½Ù_øçÜÿÂ?·ò/„iXü…°Xþ…°ü5:ØajV!ÌÉú/„Iý5XØaVOC„6,ÙlÿB˜ô/„YÙý…næ_³rø ÿ|&!ÌÊé/„Y9ÿ…0+—¿fåú×l„Y¹ý…0+÷¿fåñþ™¶fÿ3&þ÷_ ¨Û؇Æ °sáãðúÏ< [0웓“‚ vv~XûÿDM`Ïé¿É° -ÿÃæ`ØOä2EŸ›š -}´úRTè-=^„Ä/aQ­\Õ>Ùò<`ö3<$oPÁžq©Rû¦8ù%ÖÒ…ë‰ã§fÏw#2¿ý죧¶\Œ·’=H´O’•Ü7í¨.ö°›j§ÎöyàU¾/ Æéäô¤õî}U¥—z¿ò“®CÏ¥º#å#/Ÿ¶L2D#8°ò5¥N¢}awð¢+N\ ââX€·U0j=ÓÂ1´Ù÷&53öAÿ?ê…iËènHJµÀÂÔNõÀDb;¿SÍÖÕíY TÈÔµeƒ´¤þ…´BBg'FŠ^{&uõÒV)ÜgšSùÀËIþ¾‚3ü³Fý)0PŸš+¨,{\¢~65+™ksYHú¡¾³?ç@qþQãÎæÍúÉh[G‰ ­yÌU“ßKPãŽ*A©É]ù{ TfVÝIY© ÉT& èMÏÌ%ÙWÜÛIï„ÙñvbÉ -õ2S¸óWŸ&Q¨ŽYš¿÷V7wF —ÿ,·¸¯†ÕøÒÚmÕ®’€ží˜ê7æÛ:t†wJËžˆ<Ôáx-ç6Y’/|Z/¢¾ìÅ븢˜öº{7’ÈìWÌ·|µ¯"QÅ60ºÝ¸êÚ²â–ðV¤áõ»n›#Q9# …¼Ùeã@ê$ -ö‚`X»ðßð*Á!’–¥ iºÐ[¥O ÈüÌËʳ;Dã½}‹ -œ.¡%–øE³ó<ؼ:¨¼c,’žvå A:š2H¥A•søšóQÄótHqÔ4-ÝÈ0þÝ×/Ûf}Ê©Xº—™ÓäTˆ -E-Û´Ìð` -r6ü@"·T;£Æº>ÆUþºŸ3’Ÿ1êÓü4ü’,,|’ÌKV1M_1>xÄaGJ,[\®(ÔˆZM¬c~ÝïcscâÛvjë”LÇŸ$'ãPöi¡·Ç‘~E‰ëׄ<3a™…GÔ{›¼¿dºæ0ž¢1+ãÛ:8’uPp.‰¦â³cîQÇõ3owÞ×ý³Ú8Ü1€FáˆHœ– ÅèÎu[!v²zHäºA°Íˆå¼öÚ§Ý|%g–+"Hå|B!¬S3]Q[ÔB‚ÊzøáÉ&‰!*¬%’.B}š‰ …íàäðÕ]L~ÑÏ’;bæTQú€Ã·8r‚Þ¯ži…ækvcéGýÆ׆Ôž­èw5Z•!NÈï½YkË‘G{Œ´ÄQw)®Ñè~yƒØ ,oݼò©-…?¬4.³¥–ÄåÛBø^¢† «½Ozð¸nÆ2g±, -ZtØuˆ÷úÐ~=¼šÝ¸>ÖÇÂ,;ý}-ãUäE1eÈXo“])@+h×6-Mh¡L£à¢–‹=ผ%ÛÞä§ÐàÌ͹ág+­ëžÙÊ€9p±z´H=¢«Lí6D$Ô¿¾4÷û­¥ær¸ÀF=(ÞÓ¢; ˆš÷[ôÓ³ñ«~Ù½:-±SfEXÇN.bÛuûðû­8T¹çŸ¹q‘"g@·Q9ƒª&[ù«<ï@ue­b“*cvš2¢t—Úƒ¡’f~8Qv×BÆ 9uïÀfÚ“0”Bõ1RÆÆyö a­$=óîÕ²gvSWn׼ꖷYÙ^õMPhIÜ-Ï›MüüÐåX‚ûøÁå„T©¥ä룭æ}Q bÙñR‡½ק¢VØVi#»ç‡žèR]hls¯Ëœ©±Èä‰Ç†ü©ùtY'È*EÖGÑ7Ë.r2ÖÆæT¿g)‚täd·ômÚb™‘Ø'ê(cé1fFLØûÄhÚ®Óµs‹s´]ìæßv2ÌÖsm‚Êà -YÄÀz;žcCõò:¹8º‚ø¾SV ©¤Õ C)‰¬)&ñCÆ)”WŽŸ}‹iuºÆ²÷’ÔL½ÎýÆ»†±eÞã÷lÚÓcb«]—1ÏYB–¤D·,ÇfX6þ-dár -®¼ÚŒÝ^kÙк\b¥ê˜où±VÈÔ»^Ægˆ®x|ßâÖ¿Ç£¥˜ð¨¸ ®¶÷P¡ÊdݧxmÍ÷ŠØ–Ï5s“íçÑ·X‰íŸ’`d¼7&‹‡†²FiögÙèv½'Íc î$ŒÏøµ’I ¦cÀ)Ö+Ô˜Iê¿èåÒB~|’K:¦rß«äþŽ¾â©²xƒíöõ‡ -ürƒF!Â{Rmåš7ƒê¬ÕTaG Ÿ=о/–²§ž*¥¬°}À‰ç©Š¹¬•$þ„X -¿”Í4éeÝÒ~ùšõ÷4¯g{üD8õÿl{× :Pò”KeV8ç>$OK…\[o¹ ½°?3ÞäÓršai¹Ãj ÇÇQõ×5=B.Õ[ìA)£I?ð>º¹Ñe¥õ_M‘׉%DYžô¾M$„3jWš&XŸ"ãt%ö•¬'^„"úöv£ˆv¡e#°þô± ¬ÏG/Ë ¸¥ ‹]‡‹Ïô*n«eèÚvã&x¥¸-!kßaöù6Ê5uTç};Ç‹¸øµíе/çèÜGßCõ¶Œ\ Š,ÿÕ¯õ ï8+Ÿ” /œ¾E¨ŠÑ`†Ïã,ÿ¼5ñŒHihv¾ØÊñ6ÜEš¸‰ïi¥1†ÖJ’Ï]º)–ÁW¶ÙriÅÒ7±õbŠA7ÇJþOÆÌ¢9‰Ï c¾þ0¾ ÈÒR |¦‚»Ð˜¥ ¾À{+ëæZ~µ9+;("ÔqÖmALûz¡ %¢E -ó'ÀkMÀè“ÇEª®n§OGk«¿GZ“cóšxWÅÌïA,ÌŒ•e†šõªO¡HØM©( 8µË©vªÀäÓ£GmZiÒÈ•ÛAÏI îR¿œ=Ä»Vy·x”ÞÎöF -—ä'\K²¿Iã$ÌTXø{ÑžYŒš~ÁÙgWbëÈHˆ†`ð«,"^ü]˜pmHùLÑÕö¡i!'Ü&Žµþb“ì ð‘-¥ƒDu°þ&< -=ÀUZ(o¥nzÃÓ×1*ìíºøã€ÒØžsÕm\|Ço¯Ü-Ú| Åý!±tÐ0å-ÞýÒ–¤Ê"Ð]‡’¸±RKö0–¿J1r+qc2ÎwL¡w–ié튤Ï\u«qc˜) þšsÌh¯½øGÔïMÓ–3ŸQ‘:–,Óf£ÂRÛNKŠR« Á«é7!þ„ ŸâÌ´è‹”=6€¥„wÃ-à³–Éaªx¹¿x%)fäχo.êu¶­Äãhýêå Î_i[4uÄ?ǽS^@ T¶–,€Ã ®)ò±ÓtŽ=í£Ï=q8ñ¢¢T44ÕËMˆj$«ónMüB5ºCf=²•ö aÄ¡³ ïÈaÇXx¾Bù X$FfÐNœÖ3ÌàZ©†Ä"F+Ë™•pk À]I5Ò^¥P#|Dö¨=Rð˜†{‹¬±®pÅ+®a¿k¦öK5ÙžDƒÎúŠÆàïii­ðáÑ9wLØÄßÙ. Õɬ¡¤ÙÛ9u&Èc¹Ê©Ë¨ø¡*†;k8ÝÌ«0ï3¡St•sòÓšFÊÝʈÐé&~kªÒÄ-–ðž'Û²·QŸ0×ò³hèUßÃêðÊõÉ0¸ÃH±g¸ª¯6ÖXc½ ôN¿[üXÊòC §Øý’§B*Ä;ÔÆVD™~ã:”ýYåâ™p”Q&ì²ãw&H˜TmÏݾüúœéGG E5RÙ)ÚÕÄ  lkßwçjCîó(2¿WÊ5ï!ñ˹‡è­î&‘.ß ªê];Gz«ÛûGv'‰ú 1Xr –óÛ©'P¶·håÂS„wIä³ç‡É1î^OðBzÛα|ß”P*)Ú&Q"ŽÏ}À¬âRT±—ŠîO}•ª³‹x,Ò^3Ò¶ÄPNÄþvåì /êøiL~úseµì2ßgf ‹ùFGI_Û  +o`üˆîÉK1×ÂðÆí)1J~U}ã唸;¼ôðzÎY "3 !Ñ#ðÛ£znúî„{h_©PÚ¦BÈÛ æÌxª®•và-dHý­×nÙËb3©30ûô‡'°ëòÈj%­HÙf¶/]Vl¯µF>Çd»îóüÃáŠÚâiŒ­ÄNôº©òõäwZLcsÙÙ9$UÈèØ}®X÷¥­+ 7\Ä"ã}_/Y­©í‚²{¤Å÷nGekÔ·Ö{Oà˜xì/îJUñ’biJiÛ{ÄM"o8%Ì¥¬ß¾V¤B}Ÿ¥Ö¥ó¨Êh•%?Þú°qÒù årù£ª3EàhW+1…/’7.ç€Sj®¸¥è~GA‹Ñ2so)òbuîþR<Ötðœ“uÖ1Á¯&HIà²[_b{î ‹ƒÐî¥Nº€‡Ø‡ŸCý5$Éøét‚æ%fÜÂÍÉfÛZí$ÜÛÕå·â§ëz?ï •ô×eésj·hp—Œ„u­òè ßsÝq,¿¨™ÿÆŸ,Ñ#šÏ8->öòïÊlö{³Q°Ü6ßTRÇ1¯Ïëº~!gÎr’‚ìسF<ãûžI#Ý×Ê‚ˆŠ<=l‰àÓêN5å ?úð°ä¨ž‚ŽK§ý=# ·ÉuÌè’S./™f¿zDuÖ/Ö&ˆÆæyÚ¢–å³ø H*FfÿªDTd¶~¹ÕCÑAÝÌ’'ö"¬¹GƨíĆ¥]j^û¼$½UT]yXþìzZÄ­N.S‡¹«ýµQívU!ÜGÝ6J›Ý×2íHSG’þqÀÑ(]²©ÖÓ¢ø Eª^ÉÍ‹Ö}„£ üª/näéIy2¬Ù¶r>…¥‘+ ቼÝاo1!l'óuùhõã›ó†‡ÊÊbœ1¸ Ø€}®!£¨é½'±Yav¾+ƒwŽù§;„ÀÛI’íìL>©íëÌå£"ìB³½Æn}J‰¯×åD%žÛhîÝȬÀrÙ!Îå ƒ5ñªU{Í*$…ï4 ^óéá—#©°~¥à£,%=É›"[âw[¶`2é­ -Éö²Ó¤W²º êgÝM¶©,ë2š’/-Í,ßGjç ý΃bÙÃŒ0§´ðáVâǾ¨%ë"szs'GDn1¹ÕµÏdî²OŸW…›óX0CZ¶ö+{ïôà‹ŒÖ{´ÝâH2Ó¤üLhv%7¿œW¯ñçÛ$2Û¸-;™Ö¦þÆ´¸²<ÞçãY‹¸âphì뀨­õ«*!¾áaÌ] Ñ­¸½˜°~½Dƒæ=p|{#83‰á ߬Ý#Kªšá¼­ý)³Tk‹è)kà[¾*šÝ)VWA´ œ£™R}sú›†ÏNy\²LòZ–ûNs㎃ûÙ0ÜR¬Ó·Y†ÙÈìó •g9CV+QØS8´¾åw¤¬ôí8Ȳ—ߞɩš¼ùᙆ8۶߆–CpNª®po¢)]{ý0ØAüu7Ù­‚w-ÿV0/¤ë¶„ 'ð]¥¥%¢bÉý˺gêp!ÍëFµ²eŠìE…Õâ~æ?±J‘¬ITß¿M\`XÉ“Ú·]pèU^wÍ›ÒpF5}›çL’BÔ\ƒ{eKvÊ5kœlq#OÃJ?:.¥¬ò*€Û‘S˧dt¸DÓ3 J£Ï\ƒ]ª$´ï°`.Oz¬Øí°ñ‚}#äê—`ËÎtÀòU¬ÈÈ¡'¶ˆYh>Ö¬ØôˆS·YßÑi°a,Ÿ;—lîØÐ$@=É„*#öÖþÔ«\…h6äJÌùÜ»º#ß6üÓnèusŠø—Ž¼ANùÏYLßG·»iT‘Ü‹Ö0²nöû¦ ®pmMèóÐÚÜÕçRÕÿ*ý€¼Î'ñ»lp^ïø}W¾ò.]ɼVò·wu*¡^ÂùèÃÆÁÛBë•­üYÜÞsõHrbð|áî‘…)‰‡\¿ÀÁÜÎΦ„¯¯Œ^ixÍvrN—4CÑPnzFNê²ç1”Í]¶•nùºÃòcIª­?ûyp|þÈG¤iÆÃB»)Œ&w“¯«”Hö¾m{»k\wG8%n€( ·½·#î€ì¢å{Œ’l‡Zv‹üiÃM•d” ¹Ëá¬D&¦ sþ9m€.§lÖd`—röM\‘‡<¼÷Ò!ü7o‹X…*ö^É«98CÔ dû´¶Ù… E7àwöó­‹×qSB<îR|ÚÏô'Ëïzò¼NéõÏqï ?¡>„5t;œqJêµH¨ëÝÄÇÛäÈx -ÂL4E.lo~#µ•?iiìyr¼Žô8ùýš×óÎ1(NÅ8#}^Í8|®=¨:ÝLÈ­-ÿs%O­ãÈÚ×УPÀ·–GÕ†VÔ]Á%³—n ž¨¼Ö zc$‘ÃMÇ'ßiÊå—9ÊGlÔ£„fŒIn}@ž÷úcöjHtŽ6ØÛod¯™ÍoÞHÑFâóÔÏüîDOÏéùTöðô3ÊLÓã •öÉ›‹YÛ¸œÊcÑ–íð/ô’ÄqF³Ž´W)ór½¹±çL‚ 3PœÔû ³$æ|Ó~]¤ÒÌdWc¸0í†Wðmœ -—°¯vž’|ÿ”º¦ôNtÉ,=o¯ŒUyª×f?eVrÔ]e5¼22›×Åœ¥u(m³gÖlI%ÜN&…ÁãºG‹LWGðå÷Xg²¿¯vm)R`›”4=ãqÕ™õ¹â¼LÖE-ó±z•º½ªêÎÀ¯sUÛ/ðý ܱjx´ÑC*FškuC܈oÝþkx¤\ Z^!ðìJ…¸ -Ǧµ /âñj zRÖ­(K{Ä£¥×ŠTh3½%¦¤Âs1…g:ñØÁR/ß}$ž$Ð;ù© o.AÄ#×Qå·=×Ûì»0ˆE•Ù¥‡ø¼úÄOܽEl–ù¾×¹ì¾šDŠº@5ýöv,0ÍŠC:!Ó©lòzÖOA?ÊEãªàÔ¼ ­¿l‰[’w¤ØæG þêôåÚ©Ÿ] àÊe t~™õ³Ø7…ˆ×ˆ&IœªÙ?—Ô †Á¦¾¯h©òž›{Ú›Íç’‹Ih -0Ÿ×9%t­„-·eyýÒ“v·tïÈå¯CSã|¬ÒgÆos Z?]Òõ’Wøt!ÿ[þv[Œ  Z]ÀXøö³Ï™¨â÷ämB¬ï+{š{f¨?ò72r^h~ÛùI±«TÍ™q¾Çtñê»ÄL§B¶tæAÙÄ—˜¾èš9-ÖÂLŸ®Ñg—•±¡%E ¸s/®‚ß_•ç;Ôᲈá§-ý‚—Šú-뺳­úýQÑãÈ…íÇô¦(·˜Ly2®!Óat¯Ý ­K²ÁLÕh#/õJ*·´†'VÎQ³Ëhr.â–•f«ïm.öžùy—¾ÎþêT0Çx;<È£móTÓ§˜áø°Ö'*@6„¸¿ª›P…µs.Mûë<ÑÃ\¨ØêzD£œ¯„[¯Ç@‰â.þf jر4Æ•q\ã à$G¶-És{^c^CO5<©¥&q†ÚÁðéÌäµÍ×{ýl -Ü+g—Á_EÛðÚ)¦.¿ˆŽÐ”¾£wCp¹TWra±°P"Z—Ïy87WÛÄäúô˜Õµ¯'$nkyN`w® - ë3> „š#“™B;lfÔ?ÄB­*%ÅAWãÒ~€ú’$ÅÏõ5j+wVì -,NoïZ™2FTgB5Zßç -«Ô¿¢(† ÚŽ`GìÏ&Î{+c% ¬Ò맅‹îÏ}Ôà/4Ù&ÃÒx¯}Ç‘¤Ö{ÑsJ•Y:E:cÕx¶±«|«ÏúƒÀBÝf­ÃÌÇüì‰w©mƒ™Í©~P—Ù[{Ùv½ìöUì¾ÞGe“úÙpù¼sV‚®f'·FÑ2ž™ÒÁˆ_n8¥VàrÔsB~®5ñ–EB-~Ë?có¼ò—ÅdWU3úI'ž‘f€‡bRMGÆã ‚È/å(³»1‚çÏñ%k¿E t4u®¶Jy9VÒ´t†Nö{ÕäÄ;”tÒ•Åî…`vú…Ñ5/Nniu빬/ÈØB.DáÒŠ¾´5KèbpúħêbçÀÔô ÒH:l\M¬ÐG*ÔÂ1ñ¯ËùŽuˆ#Ã$FÅÛvTMR?ð€a€ô•¼ÛÔèkæzª±64ïV…‚!¬ü·'Ÿê˜ó5¾%~FÜ'¤%`ø`•²áz9³%ãà«èýº"B:ŽÊÈ1»ðÂNqXŒÉ“ŽOâõ¸Øº^ëŸ6k½ÀC˜XÝ{Ë -^¯ÛÓìw]©Gþ6¿)ª\*®³ÊϤ«yx-pt¦Ä¯ ·Âð®æšÎ¯xuZaÑB¨…í- ¡fˆGè¯À{% -ÎØ”| -{ä\§ß'¯ž»ìô¢—–î òjUÑ¿¦ãŽÃêÐ ±Üèúï«ãf*2Î?ö3·ã L“XÍ­å¤6 -ÇÞ®|ö4MonL0à3/"ôw“È#-‚4L»Ä¬¶¥™¤ñ]z½òÞ{Iý{§õŒZ\‚B±Ü᯾>¢ÅÆ*ÖµûÌ9µÄ,f‡FP¡\ÞÁ  ýb[ŽzÏÄÕ¡Q–ôѾýÂ.º@îÐ>ÙÿšÊ¯±·c*kJ%Ô¬¬ÂõX5¯¡ÃÇ¡rßb`>,³ùêó‡zLõ¦¢í†]0êö ©¦|!´yPô-æ~¼G/,ô°ÀÌdZvZ_GƯ¸W•p×Òrˆb·Û«1ÈcQd DW@`He˜%ßfäO*§QÓ1®bEüS~1ÒÒƒ¶ß…/'3ZéT$ô -Rùî²ÒP\—ѶW˜¸U@p -›óQ~oßÀÊï瘲“©>¡qfåï´uüaO[3KŠa,”H\Ü䧉ßòÖVïIô•ðñ½~ Òú&ïÛ¥/ÁÄòÇðgÞv×bh_:¤x53?S]Bûwh^6íT®>»¡mX‰jfæï¦Û}Qlò'J"nƒØŠa¼Û™ØEÕ)ž¸ßÍËê/餘ø ³RnZ§Q²@S†ÄGaXtÔŠq"Xá9dÏáÕÂ}ÜÍå®J~KuÅ’ù@N ßÝ»À½$'.¬Ì#Wó³óG©éÏG ×Ì -ÉãHsÊñ«I¤Ó¢ê[-FÔ’|½êѧ´9¶Z¶E¹! s+)y)¡ï+î¬bMŸxÆ_Ä·U3£¸,΃KtRCíe½B1μw]r -œªÅkÛ°LïYªn©³!?¸'>?~ÞÑvÐÐÖ¦WGIl1•IU CÜÄW3ç/:óe?c^ŠñÓ±¤‡JýøÌhýMŒÿ¼õ·|ß?_B7N6y¡9ÖGGèÝ·ðnÝïU_Ôì4)(ÃêÔuÝ‚¢92}M²*ÒÜm÷X_Ì æÑ_ÏuúžÌMZ%gËë¸f¡§`'Ë£7-‰@MϽS.›^—¾ÄmfnøäÉe}tVvrºÜoÉD˜’yÛçkÞ<\j6Ò7¹4“ á–006Å¿Ll,p*šLð´[ïûß%øuUŽlq>VdÞoÍPÌ^w`ï3è&ýá¾x¸à’›»h¬*~6Û<•‹ÒÝ”Y¼læiBëŽðš"œ‡GcÎEo[Ò™×ÔÐ'ë9ãN§"ožÞ’‚»5ѧgô‹ÏààWý -qæºÀÊ}˜@6¶(4ñë)‡AŸ¦Y}ìµ4iK‹Ç«gà4:¥˜¢¯–¤*Ø õÞȳò"YÒHkªHâ¼®?¼Á‘Âùé4àôcfp‰y›¼NMå%¦Ù ÉyK²ËŽ¯2}N¬¦ø.{‹|e„{m|ò«["èNŠævúPnþ’¢m¡‰=ñêôÆÛQÀí6­Õn²v¼HD~£³?R-:ÁÛ‘× ¤© -| ©±‹žÁ&Ö3[«È»BÖ>r!­Mƒ´ 0t I½ š¢”XÍf¢›~¢Y…ŠŸWÎ?5ùö*óòÆn‚d—‰xàÕ桬ÀÝD»ØmJ²‹<ö7ãâý^g´@\{êüMT‹×ÙýõxAš:>ž½ÞV+I¡¥ˆ€—¿y“R7­J_|‹;ÿ0L¼1°0#Sm*—Öô©AÏl³_÷ù7z…j‘rÊÍ÷”¯Õ¿æ—O|fäË•h7øBiRB±ê]L!‰˜º }zþDü2Rœ7È%ãA-ŠØÐÁfê’AeYY÷Ñ+ºÚ - 1ã×Ô3üQïºs·&HË¢kĪB˜æßÙäÕVvµƒ×”§Ð{̶Ê)&}£Ñ¿š¹†r íøõâŠHÿCYÖ4}pÀ‰ü—Ê™|µª“I6ÓLožÐtŽüÛ»Óq–×ÂÑ'J#§Ê2UCqÒ½véÛȉu»~EÍŸ„ošˆY.ö^¹«9M:Ú¨ˆV~J¸¯ÈŠ(½òOú)lø í):ú,û0”"Aòº}ü˜!¤ÚÙÂVsHœUä|¿hŽ¤þòesi¾DÝïïB¤Þ_›Úvçâé0!гŽÔ˜­MfÔ8>TÈLnb—ºÄ#¯#ÂOâ˜>'(Ç°¨NÐ!îìúkQ¢QòSÊ2xBöàÁËPÛÅ&/ -Ndä¡}IùH‰K‰ògh¦™éSÊzŸÝ†jµßQ8"úVû§¤ec³¬z]x¡6DÍÝ\D335ò| QfÉ0í{¤œ-¾°{QUvlŽÎ$M­=¾(yùÆ8Ϥϰ<^X‘¸(4ª¶‡CãlÂ)Ób f»ê‹Í£ÀBÇ©mßw©ühJ}¨ÑƱݦÐåO±¡ºUòdg<«Sq–¶ìŸŸÏ2‹!óíY æî¿[Sø^îÙ󩜩|(f!À¹ê"£Ð26´½¼Â:7iÀœÚÍîKG—”óE#Ö sužBÁϧxF÷ÛA6˜èK„e*û¦«-ÂÈ -ÁÓ{¾ÙGqðíwš=YZ“»ÚgZ–1x Èt/•?ÄâJX¥+\Ê™F„ÏèâË åŒ½ˆ:]Ólì$­³Å¯iŸû 1ÝÇå^Œ~³ºŸJ[wå`5úý¼nQ>ibˆåi‡s\³ä+N‡"DäŸG£þc‚±íûªüJ„ÜÀÐJÖݳ+6>ã2&¹Ñ^á|¢Ð—•'gÇØ §ÖÏ°#ÚrT_ÿ²§É±^+O”3E9JR %Õ÷µ^»[µPrƒË§|t~îŸQˆ¿}YžZø{3… %È£ÒO+nådHeŒ°3\È»wj¨¸õ¬q†B­øõ¦È¾þî/_»Áݳ¨û.¯‡Ú¢ÛÖ€„Šeß4çjôoI°”&J=)ಇR$7¿ù”õî‰ósZfŒs§Y3¹Î`%Éé.Œ·öT—3÷v6˜z¶ƒ¼ø®-2Õ›ÜÔØfãHvƒ÷£¦WËOJž³ÿþCÿÿü?±)tp‚Ú¬ÑÿåºñHendstream +/Length 11159 +/Filter /FlateDecode +>> +stream +xÚí—UX›QÖ¨khq§Ð’`ÅÝÝ‹»{€4ÁŠCâîVÜÝŠ§¥¸CñÒâvÒ™ù‡ÎœËs®ÎsÈ ïÚëÛëÍÚò=¡*«1ŠšÁLÀR0¨#++@\AM•ÀÊÄ‚JE%î9Y  '0€•—— ê °ÁǹùØÙùØ9P©â0;wKˆ…€FœöO7@Ôì`i +‚@N`[ø¦ €ÌÔìä屨þy  +v;¸€Í˜PYYf–¦N0ÄŠÊüÇHjpÿ3læl÷?C.`G¸€.I €+šÁ 6î3°9*³" ^ 7ù¿!õß“K9ÛØ(‚lÿLÿ.ýoã [K÷eÀlíœÀ˜Øúß©ZàÊ)€Í,mÿ{TÆ dci* +…Ø€,ÿ Y:JYºÍ”-L-æ Gð?â`¨ÙKÀ÷fq)5µwôÿZÑ *ƒ,¡NêîvÿžöOö?˜õ‘áýq°tè±0±°°ÂáŸÿùÏà¿ŠIBMaf–Pø–àä€@î¨ð½'N€'+Àjv€ÝàÆÌLP˜ü¼)Þs˜êŸ…¯9³ù?bÿD68Z>";m‘ãOòã0;|>· Èö1O±w†9ÍLlþ¹úÿá0CmMþlô1Ì `¶;˜‚¡¥òþk’ÿœƒž +rCmÀæEYÿý¯d¸›³ãcnf +³µ=FàFîvàG®ØXÂÌCpAG£Åc„Àìv€=à¾0(øßÌ ur}ç„+:Y8€ÿÊøÓg˜³ÃcàO§-]þÊ€ë:Â÷À¿.ëvù˾ÞÌàÿøÎœpU¨åß"<¾³ 쯇xÿLckùŸQ.¸ ØÞô¸Ô\ì–ìøçîy ÂD ^_ì‘àµÅ ^Xâ‘àE%ÿMÜðîH=¼ô»G‚÷Eú‘à2¯.÷Hðêò¯®ðHðꊯ®ôoâWW~$xu•G‚WW}$xuµG‚¯‡ú#Á]4 î¢ùHp­G‚»h?ÜEçß¿Ì™M@¦Ö`§ÿØÒ¼l‡è?ØÿýÀîvøåÊü¸±yá5M ^Óôñ ³À`öþYú¿ðÏÆü á!!¼ !¼ ],ð6Xý…p'ë¿.õ×U·z¼6Xá×#3ô/„[ÁþB¸•Ý_øgsþ…p+‡¿ðÏIù áVN!ÜÊù/„[¹ü…p+׿nC¸•Û_·rÿ áV!\lkö?7ÅÿþNƒ¹y2ÂÏ#ü†à…¯ 7'¯÷æi@-áÇNF~‡°°ðÀÛÿ'jêì¿ßœþñ†¿nþ‡Í-á/'0Ø lŠúý+Ì”?Ð*©!¸ØG2o¢î©¤1Z±¶kºýeÀ\ÌS›‚a9{ºåíëÒT\Œm„m2×[Ç°6/•/RÇ~öÑɳ÷Û.ÆÛ©Í$Ú§© +î[väû˜­ 3¿8Ÿ*M-Çëä÷gœ ìç(ÓH¨ï -Ÿtë¹Ôu§rqkK¥Úh„ÕP³U±’í‹C9B–\±âc_,øX… 7Ñ/ü„µ9ã\ç!gÇÝë_àGa›¶í…~Dªã]˜Ù­šLîâqªß¾¼ù Ó÷nÛ",«%‘V‹IbíÆJÐhM_»€*Ú„|6ͯ¹çb{£^Í£Ñth + +ÒÅ'¤`®È›kšKÀHeßZá—‚y6õ æÊÏ?hÜÚ +m£žŽuv—ñAÍc/[ý.ƒ[v• ÊMn«Ô!È LºÓÒ“âéô:çÑ[^ÙËÒ¯<8vRX«UäYðAv"©rMR38“ó—aÓHä?ÛrFêÚz>"VMÅÈ,¨¢EµàZû¯¯¹c>©! aþI~Œþ®•„VEaÅëç!E^û™m®8öûŽ Þ¨¤ýW¤CÓwŸ©=âÒêùöûZ‚/ʘf#7›W#½ÛVbÞ +hâo±hâü®:¿“(ý~Ã÷ÁFh™¡‡(ÄÛÍÚ…ÛøšKá ¢!iEƈ¦Ë!UæÄäÔbAnÝ +×Í;ÄQ“uŽñ£iÙü¾4Ù!¿P¢ ÍZ,~Ívâp@DI³aÚ£vݪ}®ö,Il$òJ3ý_6DR"$£#·W5 ¹ö\Û#LÓùÜ&åiNdd±hDÇÃBß–j"_ÁæRÂŒDnïù²?[Ún®M~ìúº+Ïê|ËóÐG—ŽÖŠ[Œœ‘ܹõ\)T“­y¹æŽ<ê|äå‡*ÉÒgÏÐü7ÎìmD@¬AY:^ë&iý@¶ß¼äÍëá¯XÊBPL%A5Œ¸}×÷¨8}’Ä–äÖäOxÊ?Χ *2”«-ì5$og‘¢P¬Û‹Æ Ù!­ÃIìcåák2" +ewpÅ +Û`~½žLÔ¯®µ®Xo dŽ?¬ñ"bÇY%1½üÑòT‡^‘’#)Ç Šv7GÚ+*Œcm?߀µ¯SW +õÁï*¨ ÝÄ 7²mX±ÚUCîØE¢ÔŒ&J(ßö*·*_OíWŸÅ·œÃC…¨ô>ULBN¼]ÑÓ×sT (*/^l¢îy{Í›WìÅWÂJ.XE}.­b’Ÿï­ÝŠøÇ£$œ¤ßš¸;|½¡Êêξ: gJ¥Bù…"«hpÖ®ä•*ŸsÝÊ4ú?#©åieä´Û¦Xã&ÙGÉžÉFÆ>²ìT„lªEqm5PCð ÜR,O‚P‰{ +ž}'¬Ä]/Fû’ˆ.mäžàcGƒÜ¢Z;ÒVçƒ$pî%¾Ûô{q ȦDBT„æ|ÜsŒ¹C–ïa$GoèSª¨¨0ïjqï mS­´z¿lOÇ,ìNÖÙrÖC0Ð_Pa&ÿHNd5žŸ§•nŸÈ_‰.% zo×UŽCÖØaFÂ[’k•ÙÊT›’ÄѺµ‡zueZYqjݲ¹Ê?*º"a¬åTI´…÷l¨$«õ¥i‹•ÕkÝÓg »ô›ªÐ»U]Á;â´æ¼?fRk†%JÍŽ%Ú/•™xØƤZéY¼Ü*—Îïd®/OÞªlüš£‘ŽNR5öô—;!/õµþÀ­M:§ho4œç㎄¼¹Ÿó`’K­½`ðBpA[Ò2mc¥ÁÓ?Ïk‘CØ/Bw­þÛZ*?7캅P±;¼ÎatûŸm"‰ž[©—ÈÞ ÒÒãî>š’rñ»<©cb£ðhH©¦ª7í&¿jÑóW;X/¼°F±p8ThšÍðI]J#l¤ba®¢?Ù Ð×~±µô^¼(÷à °–ðsIÝØd?þ‰È7bûN©}8ŒŒn wc¢ñ+™&RóÛ¦ýT·µìÎP‘ y›~œühï™}ì·ø§Ä‘Š9›ºVžÏÑ5!C)d´WøøB÷ˆ^œ¯‹öÏÏ—† =-å&ƒ:ÆÌ>ÒK²­Öç—V†¨–÷íµž¼ÜJ&جÑ"v›©°&ÒK•c°nml²f“üJT»”wógz¢~âLšŽg¶#VÏY¤Õú:p+ã›?9–F¯WA~êªWëÔe…ÌÌÂJI¥™{îVÝ홡®„?¦„NJ¤™­†$i_î|ÝèèèL¥z)5óª?Òìæ QÝj’8_ZÜîFèžA~ð{Öµ°Ù w‡`Iœ·¶ÿ–õs¡«qCê}AÒÍø…ꯦ…] bÛSbàêy[Å3e¤{#ñb­j:ÐKÈÓеÂË¿w[²%áê÷ª£ïjýµ(0¯Ü+G©.ŽÞýÍÿdû¦!Õ hüì!é^¶5„ªUí›’ ÕN°æ% •Î ×Á¢\I×ùÆŽ®+Ì`;©{ù¯f«¹@Ûkœˆq%ƱEYDVcž6+ä/ÊÅ"JTÅ*Gš€É˜ÌPÌNŒïêM!2sßâ3}ùf•ÛEC¬¿àñ<ל*9dæÏ&îo/aŠ‰©fä|y³èB°Yë…û +U@I§UåÓ»<‹7¿ßß‚[¿¡'jqe¿»(<{(c„~lÈ|·Î$yç^R|)÷RZ¶ñS³„ ÐþFB>ú7Ò÷—²•·ã²Š˜¬_œ¾û“/ÃfÝ?K™K±õ½FøüùZW•À„™¡¯ÉýÍ,rÊìkãËOdb¿7é¹Ä¬ãŽ×°ð“yº”Y…Åͦa'|§óد¶æyë­ÚÚ¢UÛMGT´î+تéDU!õ1ÁéÃP¬uÄçÍ×ý­=UãÄÉkŸó;#&7Tô³TÏ5¼ã×q×9Åf6„m4Ÿøzns•I}¬á«ÙØa¼ÌîQÒà¶ô?膡‡šÞο ’W)” >`× 4T¿*²ü™W›Ú›ã»j•~û·ëÓsU/ O­âd'F”iãÊÙ‹øš%ÇdMóLàtŒÜS]|3µf 6‰Ì$ ×d†Ÿ~P¨•ÜÀ»E×X©ÚWH@hI€(á·k*»‰“ë[²:ó ¸.š÷·2«¤$ÏèåkhÜÑ“4ñʽ +bˆxéb{‚º¡‡Ô6áûŸæ‰–™É;$VËj¾ÿŒ þþB"…gÝûmðoµøQ/Uì®ùóTÇÖ›3Ž)Xê3 $‘‚Á(M›Ú3A|ÈõÊG¢¾Åº%â \YEº/çHx§:´ÝaÖ0\õ4©^xH]IÒ+CX‘Þœ’ JP”†ãlâ˜2ÎÊ.¬íùÕÓ½F~‡áêK°˜Ïk{ +¶à yÍofþ¢×Oaé=]ö• -¢Œt4’©U½—¿>¯¥Ö®šPÁ€VSŠxöDÁîCîvm_3ÐHZ ¼%Â@ybv’2´áŒ÷?LoÜêd¶ãÍZ¾¡/y|‘X1}ÎÙüÒΉ·u÷• á.¤r¥–2¼ìɘŸT@øñv˜¸Ù&ÆÉÊ Š¶¾3ù«½íçU”:|¿_‡ŒØ¦Ts©Ðb‰_„FÏ â]Œ3XHÑ2Š¼È㪙! 4ç~06‰rëÍÀ²Ø¥ÉóÝà'Ô¦ ¯%#ǦðÃ}·â«¬Ôj›­ÅÝâ8 ³ +ú€x¨k‹FÕ¶|€ô–ŠãÜȪn•ý¹p1Å“˜î§‹M®Qgžž•Ÿ¯)ò•Þäº1}¬Pÿˆœ½VlÅõÍ=$g ágΫ`ïyÚV︱¨|Ÿ£ö‚è½µÌ#)¦4òßB2@Òwo(vgˆÖKu5Qð'“Ž$j/+EÉ‹¦ý_osó]•Õ}°;ã{ð‡@–;0ò×]—|ö€¬dêt¿Î[ÃKVC´í,CJi›-žpãÝûh b•&AeÍ”Äø¿ÎYXtjËFZo.ºït‰ÊM´®§øñ`s÷­"?0ØOJfìš7Ù*â5½?_?óŸû½R•Øëµ/OB7þŒÔ¿@6hÙ¬*l¾¸ Ry%ÒÒã²òJä[Å´Ô”)HoéDºQ7qÝ5>³ßnœPpF¶P晞W³^]‡Ó"W!™7âÒ(Žžz£éïó#~û€xŽû)?±ÙÏHÙ¹•mhRùgÃS×÷Ž<“åäb5FsßKõ9`*|~Æ/$™÷¾ÈÈë*ع¸¦íX_‡ò¤5OÉê82=N—åãXå ~||êné*\ý¥ \íùþføL-‡³p²cßUK‘äF=Zª_‘)«ëû4ì8#ÇÓ³ÕöÒb—˜ú’&$` ™6}õnÑY--Y—;Äéâ4Ó$ø x$õµÙð‡ +ŠÊÙÓd÷!ÓþW5õîAcC´|X êì=X³4ùräjðwMÃ÷ZZŒ´°]Õ¨à6Vyȼ´þ ,Ÿ¡4l4ºŽÍuÿ–äÆù·ÈÙê‰å§M¼é;ö”‡/7ó;â–@ú`:–³—FG&Jãñݽ$µlÒRSnü=‘LoêAŸ +C +ñ;<øåTP#óÖå5H¼`Š<þ6cüÊ$º‡z9mvw®ˆAˆ£ç…­7R[Xèá«4WIŒfŒ(=K9[V´,âÂœþ&Üv/b=?²ë}:MBP5H'{2¨¾ÆÄpÿÈ7—k½wŒÝxûk%tÒŒÁÃõ=ûÉ‘ÍÕ©7šßzžÆY +t!o÷üüÛ× ŽOã—F¨!ªÖW[voŘoÙyßàyeyä‰wŠîÚR¡´K—2­JÇ•™Vδ´ U˜+دsãW3Âå;ŠÝD +ªÇWÑÅËguG¸Sêí JjŠ¨7âL•~$\ÐA—å\è»~~Ž»nói@e,`ÿêGZi$’¹ûN´¹g³A'é3W;V3ü÷£Ú²¶ób´X-ý¢¸ŠO»‘òy÷ÏÁ.:3d0ë^#¤g}ŽžúIµ²xc`c½àuÒ²Ô“C|%ìÈdl¬:µ®‹'ƒEV,ýiÌåùñJŒœtî" ® !H9ùö9÷¡nXU_¹Ì‘8¹«îôœknžbVVMbÍtY0ü¨³MeS€ƒ'R¤b!TôK€XH)Et’‚¬ùŽáõмê¥;õËx¤ãƸ‰õÐí†ó4Òš°Tç—èh¾*hvØ» Ÿ:^–¯J!%‘¬d ^PÔ`dßšŽ§ÄßHv-ÕÏ®îl‘iž¼ø%©¾»¤UÒ\H7Ï,98‡Ž°z´\#s—Nƒ$2{œûœÆjÏßT»y,”xpÙÜ]ûšGq÷‹7@:ÔêÈÓ¾ ž +s¡O+¿z +Œí:‚ÒM(nr8Ê›kL_>KÁe·¨Ú._è s]Pã +ªM‚½ýYö“àQœ¹Ó¼–Y–Ï&Ñc÷=lÕOé8ª 9ΰŽ}›÷aX|ù › ÔI?„ärSM“+P,Ôò#ºS§²­ â§XÀˆÄM‚‚+ñ—Ïg|'¡Ó›ŸÊOûUýx«¨fËÚõx•zØ}0û ÊÔb¢$šj ÞöÉL°Ï¾µ±I¬¬!Þɽ’(}âÿ‹¾ôÄ—>Ã4*ù<ó¨„Æ•hG— kU3ƒ)s÷ØœkyA$pòüökÝ'‹(ll[‹ö)Ë3pÓSž”îæ=Æ…ëiõ&ëD`Õ‹íf…—YÏ%~A|&`m×CK÷l(y¶ìÙàɨ¢›2¹€¢±ÅA[ÜÕOq1DîêÚçVg®”_| mY×”8Ÿ¢CCä…2œÙÚbMr =ü‡f#ÜñX_Ü^/kÐ +©ß—ÊâÎHót®3)ç·TÖ_™‹Êm@,ï&¢@ ’“”X’hä–UÊ¿ ¬s7‹ïãž÷ÕO\Ñ©$ŠSéÉ -Š†¤|D +hàð¿7Éo µÂöê#e= ¦bí³}šú²dzk&Âù¬ Aåh¦ïDfX ºtC3òªqvšÒõßÝŒ¦8‰µ±5XŒ¾Ê¥¬~ÂcM}–ƱÚúR±š?Hê”Ï|eó’jl +¿r¬ø®×l—¨ùP†*í —›­€rkóÌU›Ô{@Øë7”HJDÑ­÷‡€í Oë~Y\ô^Ó=Äsrdo†a~ )%¤WЂm¶7–­ÿ®1H Êq‰g ªdè&W$3@ïÈ&õÅ”i ×ÀÂúXëéoM÷7¯|úBž­|Bs#AÍ 76)*}—Ò¿æ9~ûÛe|îÃŒú1¦Jܳìê'†çÛñÉ'f/×Ùóƒä°ú¾0Ý0æ'%Ú"Œ‘¼Îe1Vö+=÷”; * Í(G^]àyÀçiåðGBo6JL%ûdtkåÿWÔ­~j"cÃϲé½ÜPTÚU°éWƒAîpGÂeŠ>!FÂeEÈLd4¸aø0[ó}ÈMÚ0×Êeý=—ô÷¥5«|ÑpaöYô&¿b]}P¢ïúÉü\H²oÏ¿à7Ÿ fä”ÍdIWfè÷×MÍ@å5Äó—ë¯{¨ê$ÝÔëŠM˜,_c-ÄÎÖ’ŽOŽøEß„ìºé›ÌNnçÐ_÷°Xyj´ˆSmrÞïð[x1Ï]©³™:ùÜ•Ò{êå¸!ƒž¿œÚi¦Ø(T;´¨®±¶T& &ðjêo ²eÂRsGUp²!ŸÑgëÆx¡‰{9rŸtx°a°}5ë³ßþÑŠb¨‚'pù«žñh/þyt¥ð§àRYÔõq+´¾>Ó£"aTNš­¾¡YÍêÖ+1Ä÷~‚-‡@Vaœœúrr4Ú|Åð%Ý*ÅrófÂpWf3óʾJ¤œÇ)ÔnŽ‰ØÒÔeWoºš€„-cåÂðÊ)sÕh1Œlá²½æyÓov¯†µtŒÚð|öTÍ[+F)¨_ˆÌmñ48[‚D6ûZ¶¹ÝÁŸTmïæ„ ^·¸·!JôT4gÕÄ›º½Eî4!I“è\¿˜Þf‘Ävjå§ra[v…©ÚÙ„c¥ßo:;,f•hÏŠ¼ \KKÜZº²¤ÙÈ“Lž9ŠûåÙÊ‘†F¢®ˆaNsüzÚ°?&x8åÕ¼E‚7éëÈ P‰”Át7ÐN• vc³Š{î{’Æq]©?‰@Îô]A7Ò”ïDè(£o ÿuî©ôñé7¬•ýYK‡Å]»’蟙1\â&¿Øѧ«ét‘z©6üf|ÉR:Fre)×ãŒ/R‡O„èFAÏÕw ¶Fç]ñyPýÈó +~)¬¸rH¯Ò“g7ßÄ_q0ë]^S1°2 Jj ›ïk…h¼æãN]¼=5“Ä„õÈr#‘ºeSS×˳Eœj$¯ŽÑ ’ÊýLn”ûðƒ–¯u¬­ŸèIɘØ\+ÂlvjcâUkîÊ€ÇÈk·Y¢DGX¼\[ú¦Ò4k2òœËâ!Úª+`¢QMÓxÃP2=¢Â˜Á[¿À?…³¼ZŠ”¬ñz>m/¥éCA ƒ`…ÑÏ( í2ŠÑ8”/Š¦¢I‹ù¡‚#Ä4ñÎYÏ­&KƒãصÚ€Ef¨Ìì|ƒ`ñÑÚ",Þ‹·ôÞ*1ïÄüzä¯ñ-ú„“‚š–®ù•ž—S¨¢ÕÏØ÷¾Æ¥0äŸù„ “ªß¶ÊW–ëù#Sb¦"u¦ßìûï ½Õ=ÊÉy1Ûä>yfFŽkA`;–ô2RV•Y›Â½ñk.K\°­Û† ²ÏIK{]"BWßmÛ±V­. ƒ:*ÊöEõ¬]©üóÎÁµ½àU0ë q푼ôû¿ zÐÛÛ–A ¡? NY-öÎØ6 #q*?¿X÷MSb|ÝJLë!@ìØ8§²Ä öÊñk>¥Ö\|åô5p7”×”¼L``KÁbE¥™–|«î­Ô*úékûlš‹¥€Õà˜§}Ê­*$1\ØqÏ°óš•šxwmÝ44ìÓéê~)¸È·áͯ7ÚtúŠå¤‚t&1€Ÿ-üí68Œ=ãÅŠ€°ÑžžSÀŽTÑÜWê@«ùÏbP5¢ÃÖq©F/pX"¨'ñê,KC´ªœË¡`>‘¤%> {u¦™ì. + ŠjGµB×±p ¾;[«äëákšñÞòâ;4]ûf’zì¢sVì#ÌïÓæØÊsmúAxœí¹'U x\øÞÌí®’ÓÑvëYdb{ÓmÖõ³BvŽhÊF­íÕC‚'(a%s³|ûmOÊóªß¨Ð xǽppOš‚",K^£ËI[Öê;X@Þ ëVëyÿ ˆ|ÝR_iiø€vªg«®3]ú”µø½ªBÒk—ÜHÆpî'³×–uD0˜³½(â«LïÊc†X©‡âbðè¹s„«– œYôò.c‡NÃðv½7 ÂyFE®¿¬pf{™7fÍ0õò8g’øú§:=Xð ½(.q+¥Oý +†’3~•6u•8zîçÚVQîHµ”Ø-… ‹zt¿ý6<ú‰n,§¤Õ.ÉQDöÖ€®Æí9M9Ýø©¬¼?¶'{ï¢goÀ@`ËqªíÇTîSEä–‘ü{»Ìº5Æ`'ooÛg+¶uvqLô±,Y¾a¢¾’ó Õ€ßj»Ð²ëÌ3 :QãËýS«Þýd)!EÆ·HqõÖiì]®Ž…‰‡CìªËä-ýR”»,øwI¸Ã»µ F蓪=AVõä7¬yÈ2D}V>¶h Ú¯ù3} ©pÛ&Š;1Ýgþd—"—ßý`ûÃÿ6ÀlÉ?k’ÄmqïÝ€#ÓýÊë#«>ðÕg÷‚ zÇ„…pr>úôvq£9ÊÝ-õI\+ñm&ÞnÏV¨ Bà-3RˆêwåÀÌn®5þ2í‹’A­éw¯âïm>=7[ºo#UŸjKw…ŒMßÅ$sßÇû®>@Y7emO[¶±1xsüc¤¶»â÷V#ʼn_%¯®´à;!ŸyÛpgzJö\fžÊeE]÷`R¬Ø¡Á »$öŽÚ_ãcÒ¶ì_@WlÍž_l>Ë-à"]c£ÚÝ莩Pœ&…LvÜ0ûZŒk25Hk 4@t*UÂY%TÐWB¥ÌJÇäëÔ:*Fùâ]4P5Ò<_ñ—±ñü¢~d‘dNV?Íá@uß›,½ÍIäL.­ïÙ‰£ã ÷ õB+zo)ô©j“<’(^#Åú›ÑvrïoM7«,=ñ>–o¸y9h3ö&1‹—Jøì+%ÎÃÕõZl‹¶§ºªÅ’†–Ãö©Ö>(¡AhŠvÎÖE’K9µg¦‰#îØ@ÙçóÆ·ªw±®|Û;0!™^U;¹ZÜ≸Kò•“(´ß²ÒQò¥~ÛÅá±¼Ä ¦©B«Þ@r©çÏ÷ŸÆDb/ë@ž}®ƒfµ™',|¢À[¨UΈyKiC¢'¯ƒnÏ0c¨ÈÔúUÈÿ®#´ó:FÁe[9ƒ‚’Ê…³Õ#ç¦Èÿeßj— L¢%Eâ®+W’\ oHч‹GÆ—ùGµùv½ZK¦Saœð NÁ³4m– ­EÛ‚-4ى˦¢î&m]Ê#ð´»Dðó/‚»¤‚ à)„V'¹C7ÌE¨ðm~<Û©`¬¥ì91üÂÊ$ÔƒõtÛ߯#´ýkS«Ïͧ°†g5ì¸Ï0Ex÷9hBF•ÊÓ@¯åW¹„Õwkío¼ŽG(G^::Þ™+‹C¾iõFm¯Rn %WSõE9ù{¸hYôæî¸#Óªý2ÊŸ`wäƸ%ôæm<Œ2¶ +çà7u9ãþñŸ:T`{¦²_§Ò‰h¬v¹Ðhž+AêÏ}Ú:i±’²‘"«Á!†ÁÍzv’Ü<.{#&Ø]ýœ}ý¿­Öjý·ë.2î^cÜŸ»sm:"Ã^·£ãOÅ0çÉmbŠÎF6Br³Ù«ÌýW6Ñ+2EÞésytþàLÛw»)-M¥ôTi*’¦½’\–¼ÑÐÿãsìUõHaëŠé[šÄ~Èó¿.jäØ~Ì+l,´‹.¼°¿Ÿpƒoû|kFs‰}€ï9OcŸ@`ºøÓMAMk¨¾Kfë[³GøYá‹’&„îÓÛ>Š½85W²nß(—éžY„yð7±ÎÛuwIƹõ}•.ßég÷WÂ$?Åƽø¦û¦á?z6µ*«/6‘¶r_> endobj -4113 0 obj << +4226 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 -/FontName /YXKSBL+CMSS10 +/FontName /YCFSSG+CMSS10 /ItalicAngle 0 /StemV 78 /XHeight 444 /FontBBox [-61 -250 999 759] /Flags 4 -/CharSet (/ff/fi/fl/ffi/exclam/quotedblright/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash) -/FontFile 4114 0 R +/CharSet (/ff/fi/fl/ffi/exclam/quotedblright/numbersign/percent/quoteright/parenleft/parenright/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/bracketleft/quotedblleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash) +/FontFile 4227 0 R >> endobj -7218 0 obj -[583 536 536 814 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 319 500 0 500 833 0 278 389 389 500 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 0 667 667 639 722 597 569 667 708 278 0 694 542 875 708 736 639 736 646 556 681 688 667 944 667 667 0 289 0 289 0 0 278 481 517 444 517 444 306 500 517 239 267 489 239 794 517 500 517 517 342 383 361 517 461 683 461 461 435 500 ] +7553 0 obj +[583 536 536 814 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 319 500 833 0 833 0 278 389 389 0 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 0 667 667 639 722 597 569 667 708 278 0 694 542 875 708 736 639 736 646 556 681 688 667 944 667 667 0 289 500 289 0 0 0 481 517 444 517 444 306 500 517 239 267 489 239 794 517 500 517 517 342 383 361 517 461 683 461 461 435 0 1000 ] endobj -7219 0 obj << +7554 0 obj << /Type /Encoding /Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] >> endobj -4111 0 obj << -/Length1 1841 -/Length2 11323 +4224 0 obj << +/Length1 1350 +/Length2 7545 /Length3 532 -/Length 12353 -/Filter /FlateDecode ->> -stream -xÚí•U\]Ëö¥q·àÎÆ]Á]‚»û6îîÜÝÝ‚ÁÝÝ‚'X€à¬÷9÷Oro?v?õ¯á…oÔ\sŒY«VAM®¬Æ,jæ`’r°wefgaçˆ+ˆ«‰³³ØYب©ÅA@W+{  +ˆÀÎËËu³°óعù8ßñqò"QĽœ­,,]tâôqDí@ÎV¦@{€ÐÕdîa -´¨9˜Z\½X¢¶¶Õ¿žp¨‚\@Îî 3$vv€™•©+ÀdaeÄúW${s÷¿d37Ç/¹ƒœ]À¡tàôpD3{[/€È‰UÑì'ù¿ê¿›K¹ÙÚ*íþjÿ¯múß -€vV¶^ÿSâ`çèæ -r(8˜œíÿ»T ô¯t - 3+7»ÿ^•qÚZ™ŠÚ[Ø‚lÿ’¬\¤¬à$Ìà<;7€›‹Íï?ë4ì­œÜ@2ào– \Áñ·jêæ ¾-\ÿþo¾UÿÍæVà;ò™"­.9˜ò°No«ð—,ž©„¥w!Î,ÿ0ñ%ôs&?ËM~Ìç–iuéå›Ð7ÖVUi§r5¬fæ\ÛÍ¢¾Ã>j¬¡+o†Q±é ³ÔàšþÐ7„ÉêC·ËœòkhIZêÃ`÷qxç„ÇÒ,Ž*´aê„hÜB¶¥T4O¡bÄ~O¼qºUi]'¡N\u~’‰-r<‰Öj? u--&~.Ó*‹fä69[dMlé77êñ¸ªJ9ÏBÝcNGíÈ*¾×ÖT~=ÎàEL‘¶búðü\¨èóŽ•/¡'›iÓXÅË<ÄÄ'<Õº†ª$Ÿõkhê"“òµF'ú䶆¢“Þ`hT•^Ú1ù:&88õ¥z@.éH•¡°‰ìSµLÖÀ„×òA>ž#ªšÃ'*'¹8€ 5SÇ]qdÆÓœÁ^euŸBV­ZOÄØ£â™ë¸Ú/Aö0Âè÷Ä:¥O»3¶5xÞ…å  îß’˜|…+Õ7EÕ¡kº¸ ˆ·Ã[,Iñ F7| :|Ž*Ï>J& »ÌX¥Ö´[ ¿-X#"îïù<§h-‚î>*íIT˜€P©>uy:OA±›©z, ­Ìì:3½‚Ú3<駢‚/HêÔtü’A'ñPFtE¶¯úª¨HckÆ–µ­(ñÇN"cÓý«è0¶ý(iGUÚa„ÆÒÌÇÀÑãUí¹)`'Vè´15øÂÉÅiÌ+WÏ™b]Z²Ç+r cÐxÄô²½t\Òé<ÉÉÕEØ‚˜®S¢÷õm• ÆûõÍq~Iß -/»æƒèq Z½‰ÎºJ;™û¾‡ç!9¦ò,~_q;&‚ÉÁpåpÍô>DÛÞö0 õh÷²Wn©ÇÚ†¢:}œ_úPˆÔüý@´Áj~mèùè=K•… ¢0måVöð¶ÿa7áQPÏHôÈ2yÁu›ˆ#|^ƒzOW sÃw›Okü`êIr~h> -PÙғˆ˜Dø>‹µ²DjKvl¯!€òƒ“bü&ìmPè%mÉÙŒ# §bs kè§.û¨úÎÄÜ ÙÒjHá%Áª’Ÿ)×94r!Ô¦&í°øj ¶q¿4õÕ¾†Ç©¾Âû;ƒ¹$f÷f×Gï3ëV½¹«>\þ„Ž&rLÅ<œw }ëë9Ay›¼`™Ð¼¾¸Üæ œ…òÐ|ðÖnõ’¼YѬÜfv4hïc›Õö­cSÖyù8$‹Þ!¾ó!Jõ§C.&¯NÕŸ:/¾‡_Ñ…S`RÄy=¿|LÅ4zÞN Ý?1ýx½¯@Š:ïг–‚ÔÞ„¼ÜJ»»LÛÔ¤±òÁþï!^t€ ²Ö¶% mV±«ó¼Áqõš‰qÂÖ@«‘Ë\ãŠîîD(ÕA[¼Aô\(Ÿ¸¼VZ«Ü¯­\È à)eÖV…µ5‘ûÃû‡Š.±á*™§#qÞsN…ýÚçF¿7-l„™Mÿñ!±BÅaSƒ^È[’ÚÇÕÉûxŸ¢Š1›ÝX²”Ç2FÒ噪+™ÖC}T@Ñß|fXç'ƒ¸b¨8—áž—yá WhlSÌ¡!lV yº·Ã‰¨>îâ'¶Åî8gÿv;a3­œîƒ>aaBÀQüGõpœ¬T‰ÊvèÖ STÊ U…²k2Ž˜]\jh3ñ´З@TƒŸú†ÍB#ëºÊ”EïKQ`mŸ9dðÊ4Ø/ ŽÐz{äž·ÜÏ6gòË špʳ×ÅìË`øñAEY˜;·è&é¥;ÆÎ}>džn ²×c,òõr+Ï{È~¿öûA -õ| Cû"{,î_#¾î†p0C(Uñ¥iªâΔ¼^ЬÓSÆ1++¢ºbÔgv¶M<¸Äz¤ööéI Eßð"µß%øw‡õáüäqë]ˆaª©Aš/Þx£až.AO É -P‡èï´ Ö×ÀïQ„Œ\N9ívN¾MÔ­]¨ÊÍNmD T 9aìŠrYVŠ,"Ê’iŽÖ«zÔ~Ck¤Ÿ¾QÄ}[¼ù¸I.NÌt¦@Ñc<.DGà-‘æ{ŒNãÇ]¼¼ìƒT,pkãêÏX€ñ¹£¥â‚Z3`ƒÏ™›ËÆ¢8oöÓÛ½i½zù&›ø6ž_Ò~~@ׇÁ¥|cô¨v°&-´»‰5ì~YÅß°Cž"Š´¼‰éq¼hE=Æ)…èù|+™…émåMˆmÁ"«ÓÛ1 ’Ýœ™T qÎ扸´Ì ƒÛâÛéU6æ?-['¼¨òŒÁ¡‘@æ[˜Ñ†î¢m­úÛb›‘¹ZØ„¾ô†W ÚtÕÅÌ£~Kµýa Ãcÿ†ÞlH|CMK6£§CJA>ÉÎΈ¹11„ÆcR¡·kÊ Ç¨{: áQÉ)4  H,Î ÉJ“T!BŽ54‡yÝ7}÷ûzéƒÕ&gì€È}+Ϊ˜OèK¥èóá{‡îúòõ§ÙV>¶IôÛ+¨ëÕww&ºæ¶t°óê¤#[ph"íHx/'VÞ1ß¾ÄfÊúÙó¼p1Ð¥‘¦{¢ý‰œàÿ!²¹JTËl}žÈCäŒaÌ}Ä,·*9’|b ¾ö,¡Äàéú ž;Ïõœ²-Æ(âeÃÍk\oœCñ ¼WœüÌZ1W=º gdt¼ºl§?fiè<£ï¹íœ~QWi |áúV®«ßØŠñ ŒL¦½n!mÈÙVbw%F”áÚ,”^´?Ü’Ì2¢ ֽꜾê(:×ÈM¨\÷5ˆ ’/ßí{ýx{9 îUGÉ, ÙgÓÎß_ü`?¢ßên€Ì=r½%\ \ûIõ'o‡‰ÕT¥*Ô­ž„‰ïŽ7…/ÃiÆ©Ê,ôÅí}VÏ î>á9ÓS(† éÙjƒƒÖbÜÈË -âTËž™Žv 8ÂwoÔ·Yû¾­—/§OϤéWœÚÁÅÎjõ¨é\)î‹~.dÌZTa^~um‹/Œ¦· K«ø7$„;Ž;=œCáïbüœY†p([[);&!U_D1ú¹¤rƒÒ{þlt}¹%£|‘.€öfç4öä­öö;nª«†(jÿYJRà.wÇ–î.þö–Xÿ‡öâ•wɈJ_*„ƒé»fOͱæWì(œßµáÊ?¾ïA&NŒ‚v…¡÷¶&’åô7óÔ ÖÖ_{6P/¿%ôûÓ ÖhraJÀ71ØܯmK¥åRç&-Ô‹¢}©Žôòàu®ÐÙcZÀÃÌ.˱µÎ‚Ú뇜µ÷ ôˆ&ñ)?or¦>~V ±OVMA•ÔÈG"žñM_9’„ßZˆñÀb(rÁ³Fµô ¦¡‰ÜÀµ¯vä}Þ<-Y€º¿B²Õ`\¡'ÞYHîù"M -Ýô4²Òµ5õå³–)€ñƒâ¼MÈPhit‰Uñ”!kâúù½ãvAœ„dðì@†òÂ6^YÄh»!‘5EÝOÌ¡þ”§6QæʇTb«²á&9rÂ"ëƒþséXŠ6»–-X#B~q¯c•Ce~bCzñ2Œ……¸|Íeuî7…ù9ÂWo—!?Þ=‡¼éCÈlx 8kQ·ýó.ÈÙüHá ^ÜGì]““ka‰/i£;!BòÚÖÊ ”8šò¿ÚtW_SðgÉÖG€â}×­CÆ\§-S·&ù;rH$Ãp¤*TUS?Éd à_Íœ¬–Z bÔÏg÷®Ó8îSªp,“Œ°"ÀR%ð²–€h§‰Þ ˵¯×,yyRäu& -—»‹õ/›ÉÌGv¤ŽçaÛµ¼‰ÿµGQ¯bQò -_[£t2pß\¥« -äFŒÒù‚=!Æ)¬–\Ê%ØÎĽÅÍùV»†G¡‡ãÇáO~Ëj,cê 5±ü. ídÅG³&‹ý¥7óVý¿èŽúŒ[ÈÖ ®á¿æ,HÀ„"ßòE (9OjñZõ¹h:ô秇E|õ>Kçù6Œ¸ xœ“Ššh!é²È®;ºQÒøý‡=â{N‘ T†ôVBvßZTDÜ!!Ãk)]-ÅÄ6jÄ- lë°áÀøÒÜYÆmñGC‡O‡mჶ+`„<‹m@+v+wéÂl;6 hÌpƒYÕ{'¬¨æ¶\ž±zq÷(¦ˆ=™º¯p“w¹F&’ô Ô¤ÖHs4ferñ3½k'nZ‘ 5Þ±ÔEp1ÄN‹Äë¤ÀªŽÏÓåöRR–S±Ì…žèfîFd:T¢›ôNyïCÀ‹zí’c1Œ?q ‘Ñ «à€VY9ß½cºÁk$¹DAz£ïÏÓï?Êbâ€"f¼êS+”éEd©7$—û#軂鲣ü¡ù'$?6IJBˆËHB wØÆŠ®WÞÚ_«‡PÑ^êZjÆaxPZ&=û¢®X~dc¼Ë¦mœ:†ðïÀB·‰žø;ÎrÃÂKÆe®º=¯FÄgë½ Ë|o„•¶0ï'VÕò¾zMëiÍ«X³ÓÛ‘ŠÔÖ& e8í˜BµÇª5X×KÍœ/ö±¹ž6¸ó_ïçòPf†I£VS¯4&e7²+óåìvdèzóx©î{8¸˜·2_èÙÚ š~¨(õ‚cÜÓ¶´CeN°(ö,±U½‡Mæ9Ò¢³=±­T!r˜ü¦¿“×óy›¡Õʤ÷Òfúñ2Hؼ‚šÓ0ÓYà½Oà„è´§~ušGò4£ýÒ<…©Ìü’ç"¨ZJ„ŸNF'jEÀUŒhÂ)’ΦWÚðY2å±ît$*¯õïó’Ðó†¸#C6C^¢:.²^þÈS®%X7_&,#ïL¶«›'vò›ô×ÒwQ¹‰äñSq0Ók,=?Óc{Ó Þ˜Ý©ºðB,ŠÏN”È­Å -„M<Žmg/–ó(X&¬> 3zvcZg«Ø°]bO—9ýx¾;<þ˜ÜŠÔ“r~{Òƒ‹ü’e]ÓŽÖŒE¡’#{?°wµÂ Q}aã\­<Ù*8(7âqn†t"“4³2ÕÉkîð(1? ï}{åS;¸^ Yj:+[O…~ÆN/?µ€‘Äp çJùYFI£Ø"0έzÆ€&&]w39›‰CÊÙ±q…Uš Å>^ýe@bH~8S;`£ê?mÝñäs¨Ÿ/„yfPî!NëšQ¨2‹u<ØI‹Ð) of¤ª¬O3‡ÓÂÐ3!Ë¢Òñ4êõ•E"hk6³u®ró² 3Þ}õ˜‚Q"ÑÕãzƒÞòn„b° -å†l8"ÇÁÏæE‰Á^tÝ3`îóÃvÞÆB›¯¦œ¬T?²KOÇæ„pdö‰5Ùm×TßøÓl N‰Ï´”ÎdÅ+éÎÄ–ê\¹ÍRÙŒâÁ¼T"×¢‚F©Þ}êî”z®+à…,¡Ãhß™¡§Òª•J!H{OQ -’L‚èÊEÁbùtühoE…ˆ¬ E£1à‰°óÇaâK£Ñiõf~VÓ  f, R˵ߓ ‡JΧR&Ok6€w›eS2;½a£õ¡ñ,ìFY]©pȵ°˜ZÔc†–d­õŽõòçV€z¨`àb×$|çβ.¨03:Eªòe_@mYâ/%{Ú‚•W÷€´“Ïtè4Õð_pà`Ý…ú°u¹ÛÙNË!®hv¾ø9¯Så­ÐÙ ´Ê'#§%’0šÑæ¬,UbÈ^ÑO„¬ð´\Cd;߲ln#§º?p bùZ¿Ue½‡غDæIÔàz_S3X •yˆ&')LJúݳ7›´7ÚØõÃBjF¨_fX®nE:ãäR'Ã׃\§ 3Æ•Q3– ÈÇ !=ЧùkŠZ.é:'ÿÒàÕµÀüäÄíŸ%M[åÿ^º,Êòµly6ZgCœ?àŒÁ} Kst¿Æ5 d#‡dL×i*$]¾7ç«Ê‹g¿ˆÓq&¶Ñƒ£wLIŽöv“ex_šëô9X¯áb'»Ö{ òN¦ï.ÅÕòB< eºæªmAr*Û­ ³ýÚi!ú†8ÿHU^âFq÷+öGF¬8AJ¼Þ*[xºE"¿’wÌxVGñè5"‡ß+á{íŠ&‚UM\# å€Rþñdð³Ü¥Ýµ’68í!®2ö½ÞúÔocŠÉ“"îwÉa8’,ÆŒK -Þ†¬ ßÑ,|O0ÿ¦ãSWô]™`ìTºñ­”_¬Ã; è|ï¼l’U÷ù«ÊUª¬Ëƒèh=Ý+  *l{ï)ÜÕ|V©0gÉûÕ¸n;9Ãöà ò½@.Ù–T ©± ›Á3&Î\«¸%^‘K^ZÈböW¹%þ>Ów4¨Ì.î\—ˆ1†Ì‰ Y¿‡B}ƒk$êN-£ÆÔˆŽøzò]ݳíVyxí÷ÞÄ|ͽ§ºrî;º¹J&3ʶg ™”j£‚ñ®f€!Ñk])ÜZG)’²ñ á V"Až¡€Æ'åKC‰z錯+G -{9—ùH¬ÛÛ({¹ƒ|^?¸§ËfÖìÞßçcãœØ¹]êÄø+3¹‰Sµ¹:újæZjÖþ¢¦D–‘Õ5ÃWœJ#Ý-ôÝW"9­DÄ¥é|²êÕƱdž“IõØõ¸†üÁ5Ÿ$ö> ÁªÄŒžh‚‚ØM_©û5s£ÌêY@x.†¥¹Óß‘;Œj?ú—JC4|x—ˆ\Nà,M2o(€1Ø@ óôÑâî v1÷ -AóëÎþ€‡CÍžçJ—Kxe˜ÑÐÈ‚žCnrä›â!U±Ìî¯Yp"õ¤§Ø% Tclâc¹âÁŽ×Bäsr¶à:ÛÉöýšwæ¥×€vcu쳄óÅ°ôD¥÷Nä—ôà -án&ýg;TÿÝÆ¥C®M<ý%¹(còb E;ôØBäج§|öÔº‡;KJÙœ©ü‚ûîxíÞÇOÚÛÆB#rýÆ?áÖ¹+˜5ÏQDÚ™¨"Ì[´:ûÆS<$‚&ØIXX³éíéǼê7bi³qwjFÒçïëXŸ$$£ËœD{â a`~–|»)}«™B­8ä²eˆW®;‰»û¾ñ ß…¨œ›âÇC|›ÖÅ[>„wîm³‹IÍug LpP«3¬çV£É\ÿ¿ÛÃ,+l„²S†~˜&”j‘ÅÓt,‹²Èoì–ÇÕ÷›¢.waß„ ÐË`ù÷ã3'}+¨¡1N*U­]:^Ånð6ò¿“Ì›áJP³AI©ÀÕ‚Ï8|+¨ŽlàsŸªPÉq£½1,ã£úk¬1‹T‚ƒuš&ò‰8RQ»2ѳ>Åp"ÌAÒ‘bò¡ïéàÛß_½ø#ÿ(5¼æž0±¬ÄBŽdÃçèÕfá„Ö?..øø´Á7:Y˜#J¦Ÿò2çÁïH¨™pÞ,H Ÿ)j^>³·ýyÛM\q&ù l¶ûÝv¡C¸œš»…(+÷ŠDûלä\ìC.’Ø<šAÁÌ”§w?yñ©|]3‡_]&á2?*.QÞ¼úlí^:Pa¹PæÙP).»=ÔõUY)Ú9bݪÐs=à¾2G:Ý­§ñˆ"7Y -Î,榪—’¬—lÎ?ê½½âêÛ(«W¡Wãl]$Öñ øñn8ÛdÆìó'g†AÃuørCö7QU–ESz—Ç÷->ìÎx[(áá!­ÐGžºóþ‹táƒ}Ç¢…Ú·Mź›õÈÂv„/3DbJÔ«…jx¾¿¥žOÏ›æ¾Èc•¡ðDô°¤Çêà%%w'‚BÌšž”Tî¸Ý?h3pž%VWÔ/®Ø}3Q>=óèa¨ÚÏæ"«¼?;\gõÿ4Fpg°jß ›)ë‰?´CH`ÓGJ/ò|>L° ;ÙyÈ;ú,7 -µŒDÀŸ[QÏS«+ã”=SY4ûùW—å 7äí¢ZmÝ£.â%eSøw‘ÄŠ5Ɔ•[‰®B‡èþ¹ù»ÙÖQ*T¼¯¥ø­ð;(ZÞ\•Î;9éÓ†lµ"‚¬4£éµ£¤¡ÆW…Ýͨ¤,_¶Ñ0RŇ+»ÛH܃ŸIPàŸWŸÂŨêníy:¦7Ÿn›IÇ©pùS^Û\CkE¾œ”œ -l’‰Fa^X`3Sø/æ~G…Óýz6›¾FçÔsKH(—B ó?X°Kntúd5– NQø,,,ssB²ˆžÓáó‘6¼fáÃúÐ(´”l6þb¨ÜÝØ3ÑÏ÷‘u‡÷FÌËÕÒ6„±Ä‰9K›û• -MŸD )’Ó -B¾x§ŸYÚ|ß«.˜ -OÕY–Þ#œ0=âÂùU¡¿ñ®3¬ ôLë -…eñ¡…»á:Ã÷Ø&•r®H÷É覨FÁÁDZ§™¥ c‡¦@¤+ˆ¹éÓÅÈÅ÷½| ê !øÂE¯#º†Ëž9˳¨i³ê–Ê]RbóyGíõ^ÿµJ¤Õ…³“èöp¨¸ÓRON© ëZ¦k»žG,"Ù‹þõå7I[Ëìµ ªr:‘þç-öñbc·nÐÔÜIöàPD2n]*Ÿ´ý)Æ­Ç4° -E TÍåÞGÂSÝy&IœAÞ£Ê6_T\~¦ýü–_ó}rѯŸb½ã¬ƒþÊ'LRC–”£¾Ñ ˜ÕwYGú;éd±—µ†öÇIÔÝ帙#Ž@‚d^'³ÜR43bÛEļ‡CWb*^š¬hüþ—á–N¢~öï(*a REâ0Ëæí½3~ -~wwBÁ͆@˜ÉšÝØil·ƒ§¡ÚÌ»9‘¨ÎÚŸ½·°av’‹}¨B¶×‹òÏ‹qRÈu^Cüƒw^“ÅmŽ?ÐÔæI¿UÐõ`–ϵ™õfÁû8~'‡áÑÜ!ð‡ý ‰lµ-à,€g¶Y–à -äøÌ߀ðŠ^Âa:¬gÍÒ´íÞ§û~Ø1bni1†ð4(d“X¼1„·Uèâ[ÝéW=‰0Vo“>ÿnnvÎ?dL˜7óž,~}7Ó[¹8|ÏïSŽ‹¢¯ƒQdýÇÆ ÛŠFnå_3Z]Á4 4d'ˆYAŒËèôÍJ“”ƒ ½ße»_ -¾-q"¢â__²– -*¹–Á-"3”9Æ51‡@†7|KÖoæJ\\-·ùôæÆÞ*_j›0'Ó(í¼_ÿ¾{ŒDëbþMã3¢[ -eÅèù«=cù™Dü3Ú¯ïEø'Ôš×ÅZ2º"½z×…¢Z%0úé#Þ¹Ð3³+ñýO Þ\ûô /ìm”0ï#X2è]ëY¡Ð[*)ÑÅØ-ÞFó\²l“¨.Ë÷·Z|–-JûÞjÊéÚÏÞ £§v„’Ð÷±»×à*´!Éwö'û6uÄ "3qÍä¹ctŸ¢¥Ñ¡ -O“z}I|ÄI§ÙýÓ«5^ü]Úp._kE«t¬Òfí»ó¯* Qkþ -?òg(4k‰ùŸ¾Fõ˜U¯w¨åÃÏŸ98H=%óºã~Ë ÓtA(²‚]göBOí3V´g6ã·Wo”΄5#ˆbQ³±ÐêjdYše³÷{\–]¿ísÉ}&C$Ó…FýÈG¢¸ƒxZ¯üŸ²ôfý˜¤ÔÄeÂœ~¨FeàŠ†ÜÇu˜"ÁC/'Øè¦TÕšÀCÅú÷n®Gë.†Ò\šï£ï?ùGò®žê6)z¹ÀÊq9¤¥0¯ˆY¤õ×ôÁJ#]w9;² 8-a©¦ÉÐ=‰Sã Ÿ|Œ3¦ê¼as¤-Û+œðP¦«ž Ζ*t¶ÙQq€½÷v±HCt]ô/Dô£O,/š æ+@üÚœ=‘Fd€#íj5é¼ßg5Ñç/‚Làí)ñnášR¤0•õ™&ïh-ìZü‡eì#²kÜ¡”½ÄÞùÜ&Kû‚èNm|ç™°Âúµ¦®§q5{M"Š–|aõÚÁÛ BçÙÌ£ â;ú²œC*Åùñ0C臺=œDÝá1ô›“½ b©v½%Ÿߦ“c ÜDdf•C>7B†hSœ®1Ü"îÈ¿âL’;3Ž³H•ßaðŠ›íûê•`*ÉûÏ ú:¬½°dl²(ÜL¹}ÒëÇŽNHK‘¢l½ë§kص“š -}—é+ÓÖZt~©æ™)Ûq‹Õ»ìñæU`žÃSæ“"¹L»¦ÜGø‡Âµ›ý¸q/›„~§¤×‹Û'OÚí®«æºR6H‘uªíM3µõÐr˜F¬G6~EUoöéÂÔ&¿ª™×¨âÎ?e\g®ó¦KMŸ‡ý#,[O‹†ä3Ù£x~®r}_kRa¼ lV6Ub!eIm³Ñ7ÛbóvÚÃË{ÿÇúd’}*ÍçÏ~[»/Uô¹‘e¹¾dm–(JC¨ñT‘þp¶ù¥=Jä$È]Õç°YDŸ&uʃäëÍIdŠéýÄ{m„‰ÑÐ|ÏóŽtö«3¬8ˆÛA°®kqì¬öBx/Ü>òŸß×è™a%µ@mS2æÔÓ;VÒ×,ŠØ:¶J[ò£fx‡ëØËú+-„¹wÙÂ\Ð'§Pisâ¹±óD~4í4ç $ Ä½„Æ0)e \Éð -~ Jµ/­ -®§áŒL™šuL”I‰h.ÿ®yðšZ-=æÔÃî¬n/q ¾=}…Õ!ê0:æ`æ°{b`›Õ¡’>²ž®ÑO^ÿREêf¼â¾*ö’ŽÌRʉã,KE1'–ËFòͧl ¼îß 9Öï8¿`>½`ÀúìrJ:»¬ôH¯™<ØeCO›sŽó+„þ“ÔÖK '$O[q\ª¯?qêSI¶W´ƒRYÔ°ªæw{ÓRÌÐ=9¦skŸŸbW>!ì *!§ýòè„ub9Y<Ýâ¼hˆ-ž}ä\/ ¬k&ˆ‡ÚS±nçH·Ê{æsä+7¨Uòqm‹õüEèÌÌ1'kÜèH}ùŽb -s)PÄ~Â5IpBN;u­ƒ*6ÞëaÁ>„ž_Tâ§Þõb¶rÇj`è"¼ -Ê"]V8œ‡ võŒ5ʾP«ÜZfð¬dÚæÓ¢r@;aîÔÊÂì j1‡ö{O¿Kím„Ìòê½jݶ@4mÀ!×{ü#§"¬>»ÔÏ.åï@×|H\,I@»ñ©è®+—$›ìì™Ð¬­$ªÐžq2ƒ¨œ„ˆõás¨}G†<úÙV†GíG”ÅuÏ|»Cã6$5jI+v -©¾@¼Ÿeádºû¹öm"9!óòÊÌ·ÔàW9;¥7—òîÖãÛœ³õ+™9Å>2áv|6®\†ÕÌQe©$#Šª«Ú³PäòMÑÞ\ÖpÚAäþšWVWПXjƒf'¤Bâ4¿ÌIì4Ê'tw_íE’BímD%m¡ƒqMŸJÍsbvBàõ8Ù'> +stream +xÚí—eT[í¶¨¡@iq(Òàîîî\ …‚C @q)^¬@qJñâîîZ PÜÝZZ ÀÉ÷}wïöîóóÞ_gœäOžùÎ5ç³æzß5Fè¨@ÚlR–P ˆ<ÔÉ‹K(£&£-ÃÅ äbçÄ £“q…˜»ÛBdÍÝ!Â@.!!. ”‡5KÈ% ÌË/Ì+„A”:Ã\m­mÜŒ2L% ¥!®¶`s' š¹» ÄQlîÔ†‚m!î0v ”ƒPë¯+Ü€Z7ˆ«'Ä’ƒ‹ hi vZ@¬m08þRRr²‚þ [z8ÿkÉâê†2"$™€EK¨“ h ±ÂàP‡"zA&ÿ?¤þ³¸¼‡ƒƒº¹ã_åÿÓK0w´u€ýŸ¨£³‡;Ĩµ„¸:ýgª>ä;5ˆ¥­‡ã®*¹›;Ø‚¥œ¬ @ÎB¶nò¶ÞK­;Øheîàù;q²üO ÄäþVà‘RÓP4bù×3ý{dnëä®sþwÝ¿Òÿf®ßŒ˜«­7И“““ ‘ˆøþë×Ëÿè&ç†ZÚ:Y¹ùøæ®®æ0 ÄîAЗ hëd ñB¼ÊìNPwÄ%@ÄTü€VPWŒ¿)7à +êáúWôŸ€  u@<ÞEøù€R¿Iq_¿ ‘-û›„€rÿ&N ‡üoâr(ý&^ ‡òoBÔTûMˆšê¿ QSãß$ˆ¨ úMy­ß„è ý›t~?Cï7!úéÿ›[“Ãü7!º[ü&Dw𿉋ÑÞòär@þÀ¿fù"|¬ÿ@„͈˜ªíˆ°ÿ BÃñ7"ö‡ÓˆÐ€þ ç?¡áò"4\ÿ@„†Ûˆ˜“ûˆ°òøVž ÂÊë7r#4`ã?ÒÒPo_Dk6n>οnV(ÀÇé÷çé:Ùºx@”d|œœˆ î¿£`WWˆ“û߯ ÄQû[Ù"&â cÀç `‘»Ôú°b¹üÉ4&7ò÷E!£í¡µïEØWDf]&t ø¡øv¶¥x)Ç*å–V|k/ê¥^øjs„.à`2å¦k£Ÿ‚ML f÷wã:~ˆÜ…Sn97°œ.Ò|_õlG«TÝçÈ{q…Z9Û—¬ÙoÜ?n´ ðÅ3T§g¬tS-õÕqb,¶¢¢-€Öþ ‚Ð×mZ¢L2GÅIÃãV~;®ÒSJWäÙS“BZJ£Îî‹u{R¤Öv ËÃçÍØ$Pb3z^†Ê•ÀWf Áð¹ÄL¥ø‘wpbÝÉîaùÅŸì4&@Ï:cpîO'TB™ €_!/ŽOæ7ÕPÚy ãy7ŽC}<˧üÖ6©ä 92uî¤ìYm€-@+&ŒåDcYHN'MïÿD }YßQvpP +`Q/}Çÿe)U’Ÿy±¬—–5 s…E?ÎcšŒ—9?ˆF¶âv)t¢òÈ ¡9WŽ®¦ÐzÛn>~7R@›ÍòÁK¯”˜ÕÈ.Úy?÷™êÁb¥HŒ ƒ:tpØS:}ò×៺uŠ0™ºs5 Ì0ÚæC³¯ š¥¬»‰.zøóÄmv½™„bïÏÇ™ áÁ´_¿ðp†¾šólc{ʱöJG #ýÒó#ÓBãÿ´ÁÔXEfy=°²ÈˆQÿ©ðtƒ˜2*ûDÍârN_´š‹[¯Ïœ*P²ûtËWé+kœPódZ* ‰§3yGjõáMƒ6IÔU%ç‘^)ç Ï®žñRµ%Î`Põi„jüZ;ý~"!þnùHˆ‘w Å·HB>®^ÌQêé"®¶®y#âx±ö!Åæݵžf-°•4&24ÆúµZ`^âý©u{~ïp:…"ý(‰Žß}ä'3Ç;ò ±}-¤Áà‹ü1dEÒ­jˆì`!³ÖV_†ÏT/L§~²­·1ȉ$Ö)KyH·Mª™~þ†øe#Û­¹HurÓZƒ¤>ï_³”fi©ù¸„ÃXÒ²áþ&!d ½W­e¨¥tšÍLP7Œž3L¯ -i~7‡²}Smeš.žZ‰“£¾^pðÞ1=oS€¢·Ì®¿@ºù­Êó{²ÎÛ€¬øð@ë¦;Ë}®ò|%6ýÊ­„á¦ésÑ.`¨ÅCoÒm/Óù¤˜nœéôC$F(݆ÍO-={Ö×tâ +³_{o ߟ_ªÎu»T@òèŒîv1ˆ®³K4É'¦\oyS‡ï¹UNO›¶¨sŠ¢'YíÎÝðð¼ô.pP›ûyE¿'ô¹c`†èÚÿ´ém&ï}WJ®yõ&vZžg¦e?Á’DÏÁ8MÊY\>kÍæS÷1ŽSZ1š½§¢Û‡×±}9¢š¸VIÕ¾ÏÎ͇¤Âæؽò¬*‹²#ÁïÃÑÁ.ç ”!—%æ[bi½v¢ç¸‹ àYñKU^¥{®1Ňìǵñ^l+G…¢£$éç­Ü>qº)q +ÿ䈰~¢öðÖ9?St6✀¡:Ãw %ú:ÄÞ”1 öeäc©[¯tû]m½ÞèóuAfýFÜF\¬Y,‡TñpêNú6ˆ/øM%ÝÆQ¼Æýµ÷6U_^FFD¨T½üWØå!*ž{éqÊ…Zoº‹,[rI)3РPÏB!Zsæ>én‡ÖÏ=Š)y_iJ†2ü5:Q‘[U2ý3‡t6+¢ì¥\,Èñi Æ?†{4¬¢W˜‘RMGä—fÒ¹ÓºY©o‰{ì5…ô6¥zÙPÜêeäNþæQÅ1ÛÏsHü*±‰bó]«—dßÛhý<Œ.¨­*䤱æ3% ò.Hº;¢½¢FUx†Û^ÅD:,ò9-‘žäIJ»È¸VÀ´Ò‹ê¬U$|®[訌ê±hѱD,1°ï ú{çmÏÇI £Ãx sQ8£&—~²²šýö3ܺòâeE¿X­@öË!4V;çÚ[’ó#|™ŸóTÚ;„!˜yþ °øö«M[;ãoÔ1¬ S(öÜ2y݃ák©k±tÌ¥‹9ë´ÀÍbº–t¸Ö«aæ0ÌÓ¦ÿRBX TѵŠé³Ì¶‚t!EE “)HñÀ\|ù9DDŽìÄÔ¢I¹˜§þéµ(úÅ&š¤=Hßÿ«olIdäSYÜâû>Ïuᘀ–BKŠð>ƒjÆ'K’¬°?îÙ FÒµX»1Š3ÆÄ–/ 6 5E6®4eÊ1ƒL |¯êýøÉ:6ª‘ïù£Ô‡¦G¸b¥f6-°Nh)”åé /­Ÿ²DÇF X¿v™7]©Ê¬]ò)ÁÖuÚÍú8¥Y)V$Ž’ÇuÕyññDQ7ZÎÇj+$O¹oÍ•Î×á™sõVËÑV‚Ol—‚RE1.i6ï2…ž¢¿ºOÓóD“ë»jÙ «d:!«í»ÓÊ<RïîKzò\%–‘{)ÕÃ5NOÊ`~‡wg<ÌÖÙâmV Üö(ŒµYq@õäŒ+`1{`Ù'UüM!ûËG‘"DË4W;¦‘—Ôl¯Ÿâ2"ì 1]kXZÈÝ”¹H¿Ó6 5µÌ&„g[==kA¬Vv…j/~Ï4”Ô¨0¬ #'ø·½.±h¢y÷£k0á Å{ ¿÷eùñ½õ•!¶Xí×¦Ê +”7O‹;kÙ¸ýU.–6ÌÄ8ò%¾Ð üÐÝ'Û²»—Dõá]Û¨9žcgDç¦ +$Zë©=ŒËU–57Uëi§¼¹A½òlš!B_mõFQŒŠ@ï}±^û™p5 ’­ÌæµÅÔˆI^¶¨ÙLyÌþÆÑðÈb"h1})–…—zëKñ™¸°W˜½ž¿°4{ó¦º`Jñ0|öD™™¨0{pZ›cZ/<…–ͳ‡‚ìGãói.”êFmêfÏ6ÔÒ$6ïuE* Ã옄] +päm¹IÊè˜B~Åisy0å ýšùÅlwuŸ\ÑŒ!­Kki7؈½ά«—÷©°/É««'”>˜Ú?æ™L*QÕx^å(¿C& +Ø«+Þx(Ôü"V·KJÀª2€Æù)¥l M’Ñ2;ÉæG^ýÓ™j@‘ã{ü›ªÜÜøwܺ`%kƒ¨q¸ÀúV7“Ô†m¤9MŒ65Y6¦NÓ<íÅ-*WQÑÂË™Žÿ¹ SMÓ¹‹Û{ófö; ù‰œ|ŒÍ&Xjêæ:MGÖ%mX,mØ;+¦?Àm³ÆBýÍ@ êi–ûܪ´«W6Þ§lpCÅNÆbTÌš*r§ÞóáMì.K…÷·Ñ±²Œá3:Ø»o Ì麦ŢEOIî!ô{¿öI‘€vn”šsϳO¾rÎ¥Sd"ãt"kâ ¼ÿX™ëÝÅñäJMY{æ5,s¶œ:\énŒÞ³4.…êcPóP~! óêó™þÛBe½”«†ý“ÅiÒpÂWtg´y¹² +·©Ó@`Ðnþ`ûs­ãEÅgk©þWòÏ*ó&á嶟0-Xøôö’­pŽfvøM’-ÞÖ¾³f'uJ½›VcUì:êÞý…ø¯pÙäd(²se¿®8Ì_¼qlu³ÿÆSbvî±*‹Gr +i!c˜xí^ЊÉB u§nsEõðÉ”oõl«Ì±aKŸ 0˜ Z.j’Ê Á½ØË5³ù²¡´7LqbrMË쵊–!ÀH XÁm0ä “ß·‹}€Wá…¯ì%sd¼í-Ô#ÃZë™]áO•Kõ\9»{IÇ´’¥ fåÌÉP蟌ì|h6Û3'°R4f¶Ÿý™õð%k?®ïkÆÆô‚…8ÅÞÇ>ÔÆ+ fL©Ÿ»´0'Àã|`OJ“?ÐõPòf™ÄvwvñÈ©áÀö•Iê›Ñ¦4e›œO›ç¬rºm¸¼q!7yv’‚L–˜|ü›\)4ŸÁ€eL(¹ÖH&t·ÙSë@––\äÙ÷˜÷„iÓE™u1»(á$ÉoIzÚGP‡´àWû”³Ù”‚AéÄ Ûáî7"š1ÄËëÕnÃVz.®¥ø¬0¬¶¶¹x%§ &å´CwrÌ ·ÒÓ†ŒOÔòÖ;X©ì§LØÖöÈ£y}¹i]==‘0lp¼p@ퟄqöŽ~ù|ïÐW^Âjh^úé}q0+2î}I¸†ÅC¦Ê¦X]¤'ë75Pd4ée‚ŸÚ£q­5ÉÓQºu÷Y*ìó)äÌÚcüQñ\&¨ª´šs7"´xå•5AEUc¬×BšémORþX§TSÞµ¿&èë^ÉD|!ì—ÜL>Ëà60G6;.oÑKú¦%ÑOç“*öWȨ3|®^v¸6Á”°1?,Ü¥ñ3>jþ|Ý0÷ ÎË多•†‡ëS¦uäL_d=øDT7lƒs&°÷G WÚ…Íe•Çú‡0Ë<`^‘ `ÍØïÕ¬5ÂçÒÉã髹՟ŸÌ¤Þð•NvÙÕ÷ÅÑŸÀ +,á $ˆÕ™'vê¥#YzVçˆpJ}Ñà?v.¢ÒŽ3ã3ÞÕà–NvÖßz-Jžƒk…š±†9:„W¯ZÄØsTP ‰U¸ßv—X®ËÇZŠâ߸á,U>‡%k=N–6 µÚ¤ûi‹©ä(Ä&2§4^[¢€‘bx}©y`ŽšÛàdh,wØ–‘Ò^†\¦Ü +bŸµr:í—MÅôÍ•£4HiÅßw`E7qŽ`S×yàƒ¶Žö<Øy¼]A§kºçùzu²´ça¸”Š”u=ñõ 9ö…~¢\²Éâ¼ê¼d ¯2¼„ç_Ĩïš_0lÞ`*ú­â÷g¥p%E£¯>ÒüZ8 +b +hÈÅhÓ!×Òd¨2-³{2bÙ¶ÂIÉ –ýá|ÏuúêGw['q6ó6`£U¨ûÒn7ŸÙ¢Ôv#ŠbÆyi-N.kß,eF«I¼g´‰³$K0Ø®Ä}j¡(ËhÓO5uk³Ž4°þÁ¸4ß2þ3 •¯^³¥¡>yß4`Ô¹øüÂt˜î8 ÇÂ…ä«ÌÊ3Xƒà> ý®µ)âø,,m+«­î&ÿ»¢pmañ³P ¬Q`Ïï½¾¯V¹äêI {†›û´.qï§kØÝP˜FC¢†|î=WÇä`íÒª3ÉœùEžeoÞx‡Ih_ ÝÃwµ<ÇœéÑ<`ÊZU:–þ°TÄjÌ>0çøð­E%ª¬b*6ámê)iÚùc ?ïîeáý¢Ït?Š.Ƙ¦„”G¯åúI‘GF•©yeü}.µ×+áêçö}/ä«‹Î=7®öîfħ(Ÿ‘ÂÀ•WHŠ“12pûOÌÑ•Þ-ää'áÀ—’‡ÉT°ûËÍ_T˜fï]Ýê3ÝЃȪüòŽ%þt¤7¥h{ú´€<_¯`#óQòÆÁ[±+ø¨¾{ î·H#q¨…&¸èd‰Ëã†í™Lã‰p[õiûBŠõEwR—Ž½®BfESô…E†]V>•¤y£gf•à…‚oMêÅF\|má¾M:¿È%‹~[™ "ÆmfÞ£10óe•§Âv¬ x‘·ŒÊ2˜ûÎÎ?1ÃÄ}ùºw­lW$LýŒA_ç²5aZð;ö:RkÍTá÷¶?‡ö8 KÐ&}¿ÓFò‡SzEÑ?cÆ-âà™ªæ+A@ ÖúãFüäÌE6ôõ½+þÜ) +1ÕN¢ÃœoƒÉd&&¯Ñúüö`·Ï6.œqÛg#´3r¿÷Š¼Œ½~Åf^¢væâ{ÚCv *>LB,èÍÛϡƈÎV|N +*ã~¡é+Ȉ¾YÍL8ìaÛyøÎsÔ!‡eŽ™6w’3¶YÓ«ó$wüÇ•²¦­DiìK¡!ÛùÀÜœèÙ>äzÚîŽÜ9ûîžrÙ³Öº”ÑùâÒg,Z§p‡*ãÝdžò>n&Öò¯÷Ílæ!Ò³iéœÛdI÷XD™ò¿²’“ϯ)Ê䟳:Þ«vÙ†uf¨|nòØSJqMØEÿ¾M,4ÔÏÊÝØÎSB‹ßPáò0²ÀW1Tðl2HØĽ«Ñ˜ÙÅ …p¥0G Pþ4a„®S{Y6Æ[úbJÞ‚mBy^8Cu1#«zlÓZk^PéHƒ¡7)dBÉîi¿o.€Ûö>Húy† H>ƒµû¸®‚%†ó§C"tÒ0 t€ŽÝy¹¨lLAÖ½f [e,Púê‘f¶^F+nK]`/ŘK±)»k{1Hȹ“í ¡TRÒ¥ÏYz©<‰ëó$!“¹/ú˜“àiëLâÁ˜ÊVSì_›ÚÉN[ïú‰€ý»“/ùS¤æãºd‹×Y}ær šS?1m¡.ÿeûGO²ŽµæqµP½¥§ hš“÷eœ`ú”»œÿŒÿ-ð?¢Øbîêu4wµÇø/9 ¥endstream endobj -4112 0 obj << +4225 0 obj << /Type /Font /Subtype /Type1 -/Encoding 7219 0 R -/FirstChar 33 +/Encoding 7554 0 R +/FirstChar 52 /LastChar 121 -/Widths 7220 0 R -/BaseFont /OSUBKO+CMCSC10 -/FontDescriptor 4110 0 R +/Widths 7555 0 R +/BaseFont /CAMOHZ+CMCSC10 +/FontDescriptor 4223 0 R >> endobj -4110 0 obj << +4223 0 obj << /Ascent 514 /CapHeight 683 /Descent 0 -/FontName /OSUBKO+CMCSC10 +/FontName /CAMOHZ+CMCSC10 /ItalicAngle 0 /StemV 72 /XHeight 431 /FontBBox [14 -250 1077 750] /Flags 4 -/CharSet (/exclam/quotedblright/quoteright/parenleft/parenright/comma/hyphen/period/slash/one/two/three/four/five/six/eight/colon/semicolon/equal/A/B/C/D/E/F/H/I/J/L/M/N/O/P/R/S/T/U/V/W/X/Y/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y) -/FontFile 4111 0 R +/CharSet (/four/colon/A/C/D/E/F/I/J/M/N/O/P/R/S/T/V/W/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/y) +/FontFile 4224 0 R >> endobj -7220 0 obj -[319 553 0 0 0 0 319 436 436 0 0 319 378 319 553 0 553 553 553 553 553 553 0 553 0 319 319 0 844 0 0 0 814 771 786 829 742 713 0 814 406 567 0 683 989 814 844 742 0 800 611 786 814 814 1106 814 814 0 319 0 319 0 0 0 613 580 591 624 558 536 641 613 302 424 636 513 747 613 636 558 636 602 458 591 613 613 836 613 613 ] +7555 0 obj +[553 0 0 0 0 0 319 0 0 0 0 0 0 814 0 786 829 742 713 0 0 406 567 0 0 989 814 844 742 0 800 611 786 0 814 1106 0 0 0 0 0 0 0 0 0 613 580 591 624 558 536 641 613 302 0 636 513 747 613 636 558 636 602 458 591 613 613 836 0 613 ] endobj -4046 0 obj << -/Length1 2055 -/Length2 14045 +4158 0 obj << +/Length1 2106 +/Length2 14801 /Length3 532 -/Length 15183 -/Filter /FlateDecode ->> -stream -xÚí·UX\ݺ­‹Ü%háîîîîîP¸»»»Cp w—à‚w 4 »þ¹ÖšÉ\ûòœ«óà¢Þ6¾Ñ[ë_—z "SÕ`³t2J;9º3±1³ñ$”ÄuÙXl̬¬âˆTT®@3w“£¤™;ÀÆÇÇšƒ?€ÿø¹8ùY¹©NÎ>® kw­Ý?E<1 +ÈÂÌ dæntaafÐp²Ý}˜bööõÞp¨Ý€®ž@KfD66€%ÈÂ`´9"²ü“IÎÑÊ Àó_²¥‡óÿ<òººChÿ“iéähï°Z!²(;Ý€à,ÿoÄú߃K{ØÛ+›9ü3ü¿:õ=7sÙûüw…“ƒ³‡;Рäd tuüߥ:Àÿ -'îdÿÙȹ›Ùƒ,Ä­íÖÿ’@nÒ o ¥*ÈÝÂ`efïü—t´üßÀûW]EUE9†ÿ^Ó=T59ºkú8ÿ{تÿÅlÜW7À€Ü^6p!ø÷>ý/3)G 'K£5€‹`æêjæƒÞ=`âø±@Ž–@oÐœ˜…ÙÑÉü -Ü’€•“+â? ÊÆ`±ý£ý 98,àj{3‡?'€ÅÅÃÉhinÿ_«ùï'ÜK'{{3×?€Åèjtü«Œï¿øÏ·9YÁ¥f®@G{ Õ_*Û«ÿ«ÓÌíŸ!Üìþˆà°ÎönpT '³? -€ÅÆÇÙèøGâþWD“å œÚÍÞÌÍæ `ñº:ýÀ“prþ›¹Àéݽþ<ççv·qþUñOg<þô†‹ãŸV{þUŽë^æ38¬Ðó¯¬à%eþG#¸ÀQAáýgÎöN½Ä÷Ï0 ÿT¹Á.àÓöo…ãŸuºýs½üÁÄþØ_ü½%þØXòM¥þM<àîHÿ!p'dÿØVîýþØOñý”þØOùýTþM¼`?Õ?öSÿC`??î¹æ»ký!°»ö»ëü!°»î¿‰ÜLsW3 ; ûì^>Žëÿ¹ù¸ÿû üg9ØâÏ^å[˜ÿ!ð-þMl¬àZþ…ÿ¬æ_øÏ^û Á1¬ÿBðœmþBð¤A!8ší_Îd÷‚CÙÿ…àT®6ð¥Æâø‚S9ý…àTÎá?ûí/§rý ÿÙü!8•û_Nåñ‚Syþ…àT^œÊû/§òù ÿ¹â-ÿ>ílìà,@‡kÿ÷u..îäíÇÄn;;øèƒãqø8¹þ³RË>Pr’àÛ••|@þQ-<\Á×™û¿¾BÁ¾ÿÃV ð7 è ´@ü¶ìd!n›Õù1Pªt¾–Rܺ=Y¹yàk/RØj -¤}Ť‚ ýV“îSM.êì©×3¡[l¿ÚŒôUˆKröÒ둧éQ®o'¡îM®’Ï¡3ùÏ°ïhÝm‹wç\* [SÓõÊF>üý^¬J+©y ¿A1hàÙ2˜ÎÍ£+k¯ÑDÍA¦Žžíò1š3jÓ ==fs.,Ð6ê]ÃúµSæS黢´WˆG ¸¸87‚èw$”µ B‘ЀÎí&>®¡Èý‚ãO…m[g•Xêõwž¥%¼½: )ö»ZHžö%7'j§ÌB“W…Æ´—ú^§ð™ös²n,ßõÂ;ËQÓ'ÆÂs›N°s¥¸ŸfRÞÔåk]Í¡ÕFP»æ“Zf´öA'ÜãŒz¸p»‡c"["¥“ ®£þöýmNÖõ—Å©Ñâ ð¯w„Õ6¾µëì.Ê>ùOr«ÅÅ´·Ìq´°”=Áb×Gʳ¢Ã…ˆç \æÂŒP‡æ Ž¤ˆ` ˆDŽØ˜d@&™çœU3ÿŒCÊx|ÔVƒàÑô¶J›Zjäw„k2/!¯mˆˆí&Pé€o…Ìû^4ÔÛ¡¶¸âHÄfeڮѦu"‰CÿÄvªB³øÀÏ^èÑoHæN½X) c ;ÉU³áóµJ•õêè ¸Û8 Kòïï$„•¯ÆŒE²Y¿¿3tꣶú¤ÏÏtC G?W8©­Í‡ˆæ/ŸsÎ#ºê6wÅL'9‰%Vª§4bPê'Åž9¯HF•|éû ƒŽß£¡cpCÃvüÓŇ³ÖEÿ³€·O{ø„¨ôÑŒ â*ê—mêFeŽ¹5ǦP£aÉ's3ƒ·7|ØÞçIŒ{»Å°—H¾Ç“yJi!`Ñ5#õxÕ%º‡gæçk6ÉÕ3m¹ÛZ³rŸ+)jZ#r`Ón¹fìÑŠj#ÔfHÍR•>ÛJË£7*r<ý†‰dfµ'Ñ:ÀˆGÑsD/Øk¬nñùùTªîSÛbSAÙG½DÓ±c­—HçŸTÖóI ÄßÐ׆ì„Õ³7BegVnQbÍÇ>£ËñTjÔD¿…‰NÁµ´á&¿ÿÉøÒJw%õ»9 ñï2±{á·d²o‹Ã)7v'÷Šf¸†µ^ñ' ÃËzçý&dËÅ¡fùw -:Î]MUípá—è|%Â(çÝWiøÉZeGvzp9N]¾,°L’Ïj.l'§Ýi£ªž„°ÏMKÄؽ ‚"#Íæ‰ý„µG1ϸ¾_·œ*3Ç~éᔳ˺†×9ž) _‰«ãæpHKê=ž®èæìÕ4K0V´v˜]·L3Þ5É’ˆYaÏ9ˆ¿kÏΉÙ8<0’}Ï‹±üĉ%Ód4žî~®/S>\äwö²õi2ÇUe”ªŽŒÃ=½Âúƒ^¦ƒÃ$>¾€ÁsóÁz*ýÙ+1”Ÿ‡¨þÞ–À¡ú|qv÷Ôº˜‚’fˆÆVæûäFGµ'M>jãŒUh^jg6ɯ|•öó† ýÚK«+£—“éÏÆý¸ÌçÑŽ—ß/Œ7ŶÉm2£«æ ¢8ÍßR†bî(p+Ž~d‘h6î'/µÝ©$5¼¶Åìz›Æ(ä} ‰åáwƒ ‘¦ÌuaxeLíf!÷¿)ý¢é`-¼­>ÚQbjZ:¹&——®?=+ô)iŽó{—ÖQ°Ý¿ÚlKŸ×õ›ƒ¶ªc°/·µ/7ð°±|ÏhAÓP}–ÊÛ× Ã"AÇT;üÁ¬Gë’"#¤ág‚Çzƒ*¦Ÿ2;F&ä>7M'\g|jðå¡æœ‰‘±g·„(ìUÜx©Ý~J¿r¾±’¹ÛÿuQ}Îo˜ëýJk?*ÒÆx‰iì¯]›U-/Ž;Çèk¸h†“Ì’·Øèy6”}ÍŠi ¦o{¶XHÍ¢mL¦Êl£qs¼pî<Á‰Y"™_Ë´Ò‘¢½Q»û¥÷M¯[ú#.äo…? -T*%q6–YÜÞT¡ßÝÑ{ù14Œ†=ÜЈڰãã¨_Þ{1ôSPŒ©ŽºãÈú™ºcýö1†‡ï¦íÌdlÄOù¬½ ÚàˆžHÆ©ôòŽdôÄ•ôa–LJ{v2¶Ûè¡*¶“¸¬C„‰×Ož¹T.®!ÊÒ1g -õ­Œ‡N&6a•E‰v"i–ï&ê©QVíxHËIY}„ë`ðªôíR:h»M/‰àÝ©cË4U—‡”/¯DÿRo˜q`ÏŪÊ” anª÷ÞH|½p0»˜À(cA½Ž/µm©Br–§¤ µ9¸Ö+*èº`¬r}Bÿ›)ÎeÊVkaÝæÇ)Ìn“¾ÅýªÃ˜ÏðªôV7bl‰d+͘Ë3;Bë;³‰¾E{dûÝ…'KªâJ5Á˘>åRÑz “”¬tÏ{sPj—$#/æ8yÚd_ñÆ= Ò[áâ$YÊ¡¨Ã’ÿüܸ´6§<š–Ñø¤Èb®ÔØFÙLùôj·®¬Í_äü• !èGß—©v-O|ý=òUÉ/.uf|¦™]|™Uu[¼Àù¢˜.;W¾ÚôIt#=S$rXF´ …+)–¥ÒáR²6EWÃcíô»›kü0¼C‡æZž7"$?\/ßÓØÔþw¥?¨Kú«~"^;űN_ÄlÓát8£EãòG÷Ü;µ Èj‰½Ó·ìàù©[œjßØÿl7"Û'9d´pU?4Êç) «õ©%A;·2™ôcìJ·`ÿcþa¬J<½F¡·Õ sÐb®3Õ`šI‘sm-AòÁÌ”zÆhQïèíè!—î2ù¢'{Hñz½ú§ñ-Ätµ{vÓø’ŠVnâÐ\»]ô†Õñ¦MÆ‚T¾43îtAÌÍçj‡¡äß…kS¥'Eûˆ¼Ó˜±o\#og%¶X¡$#™SHš:e#!áƒØ“çÐã惺;‚³Fæa¡°b¸¨?%ÉwPk$”œ/„KLó±øç‡ò¨T Î"îpßa $* ¼àxµ–5Ù¹¥6¬M£5°œ -ŒVÿ è„Д‹æìý‘ŸE†Ç…Y`NJ‚ÁO×áBeÍ“üˆÑëà½ç1CàŽ/eLÚŽÇ%_kº¨šfGQz/OAQ7õ¥Ï¤î¤›Ô¯¶Þýô~°½¶Òø@ÿ¶BèøZS2ƒ”³ñå 7‚íhQîÂÀ@w:˜¦^˜šh§[,-¦î(úÅý¤c|—¯@öÇc½¯9Hü^þƒ¡Äåt—u@•¸„»íË8s h†_ÙUqnöíÃÚ‡¾ôóòéÁ!=¶Žs -kþʘæéÁÕ³%$}/Zã.'wááÍüÈ1\"óŠìºŠ©™ ü9=Í_î¿_Š÷°û鯢KN” -U<q»PCMp7*†®®É¥ç¾ý@Ú|pütçP¤zŠéQÔ Øã*Þ w&)"“ð¢ù‰|c׸W´›™´Á÷ƘœÐ¾Ž`v5ëBÄÊxh÷[);™&×]{z®n¬¥;Ú\ÀÄ š”äݹäà‡û‘d~}ãç'¨‰½!•£µ¸än>3…&˜äŸÅÓê]ÐDN™.A—½äWðo(ÒÅn¯H©‚_Kú${#?õé°aêRÝ[ó¢tÜY8j/¯]vŸg»+$øz„¿%Z4˜Ì¥‰jºÅv}ÑÇØþZs âìQ vZ£RýoF']%™uñªL2S4Ë÷AP%ÄtL ½ÿÜxÝëáéQ -ãGÖúSC;KxœåuYîc-ïþ3RP•¨Æ¡¦nµ [r‰+ƒ>@ç”M>éúMÒqŠÚÀ!ëZPy”$+p¦ ûÌ7y“Dê7Me3Z^õÀƤá—P~Ão®I¯„Øo‹(0|QF› +ù!R5áaìr¤5ŸNB{t–`Ê…\Á)–Bªp™—Ìë^mØO ;ü-dôF›|› -5ü°ÄÞëç*ˆ±Ž\Xl6 -G-KÉêglôlvöÜ)ÐRØIÛÞNød‰ÀD !vn—nK1Lì¼EŽØTÅYœ‹uœ.¸SÌdô»Ã©(…va4}” üyƒÎoŠ›Ø²Dt¡taŠvÈiSOd«Ô -c88­"P7ÐY1˜ë׎ý8zzû}eQž8(G 2fÈÐy"Ê$væðARkI›ú—˜ý«É¤àÞäÇpZ±Ÿ¿¼>4ËÃ-ÁrXݪ1Æ%b€KŒo|#t,5CjMñažÖ̽vÚgãÀ/¦´eh1LÊØÖñW‰ötï ´™e/1_+hṂȹ6;´°äq›Ï ÿ"“³‚ä™ü8Î鍬rÙ}yé‚õ§yÎ`8}:²=‚a:‰§Kö‰Æñ)>ç>ãNœ™KsM'Ïlì,´?ÙâͳÖ QÜÃéÜ'Ž¸ò˜@éoº]5*Qáé†eU -lÜ{b^«š"òÛó¸E m[§eUsœ`…î °Kcpz}‚“#µBwçž•âqŠ;O²;Šq,Ð_æýsR³Êû÷‡+ 3Ï=öë?º!0‰a`˜"ݹ ü‡óGãw‚íÊ zè0û/@›-%þª£Ü#Ôªû Å ‚áq1‡ŒºC|[ï¿_#2A­ÄÕÍ}ù‰”O,(Ý„WÓq¡"ø¹Gd©z”8´‹,¿H·ùË•üdZ´v!{e«êT ì‚.ƒ=xÓá9 œýÜïJ¬[”WßÞ_¤S²òè<#”ñR€–Ò Z‡ÄyÛÒ (¼ê7¼5â­– +s,QÐ#H`“•ñü”_*·ñ& ;4…cu“væU:…®˜Þo%÷F_Û#á´5¯kKŽ©Ê‹÷}Z¬Î‚Ý1Pf‹ìŽ¦Îš|ö~¥º`ê0a ÕÝÁÞ×#ì‚ApOÛ&Ôøí·"2îpóî£2Ò{;ÐöƒL;Ô‰Ïádù™”:9L•jÍ{±Ë« -S{u_¼ uí#©·§ñŽ©„/,†ÙÛý4¹VeÉ)YLöQ8b¯öŽXD(bz¢ÛX(lEy“«ð[(»³Ý0b_Æ—0|c_‹n$‹¢zäF¦%¡•åìÖáu‘wzé“AÆ-uÑ\Áï{ÀôÕân½ÿt›?úS/y« 04&{²é§M6×$ï@-ðè.Êê5`Öˆ]××£Ž³ùÔ²»ÀÛÒå/iIÙ},gßF!LK ãæ… -¾»“$ÒvÀA㉸׵žÂ5@=[Ú]»ÎfĚƙ O¾CŠ”üŽó˜À`ç¤2F‡ÿë[Ñ»%¬³àÀqkjOŽÛŒ!è‚À…Üø¶övTG û./ê&gðŒI‘|äó96jfj…û°‘6>©VŸ£i¥Æz·¥AtAPy *+¥Õ÷/Ÿðd^´…Ž×P{:dxI]‘l¼¢†r’5èê‹hñ;íf¤«Ú,ÑŸ­ž]áÈÁ¤Qì+›ÐÛrÇRlûþfXçÜ#9È+|a¥£V»|>Tº/J"ûʵ²÷BÑ¥>î¶,Ì!ed¨X¤â'ÐsªØ³{U.ÑIׯ¶¼=¾]^ÖÈùFZä$)z}UªÌÄy9Ÿ„¡T¸Æ€$Ó^1j÷dº™“ñ1ñã7W˜ëfˆ¾ìAìßÈ–øø2ÈR¶¼ãöÁ©ˆóL!Š7ý6Ä{:G­âxî5BüòÝ]uíZÑ7܈[óø​ -ˆX™ó•±Þö¼p<ÙDüsü,_¾^0ÚYG¡wøS0êWMÍ‹« å'WÕŠm“ÌþÐêÑ{ú¸ú‡ug/ÅšYø©¥›=Ø, xÌ9)_\˜d±îXË#4®÷ÎnÇÕ4†£_S‚c÷ ?&&„]7·ŒÃì¬îJx$àµhä$óFg0Ë D Hýž}Íð*õ¶èœütBµÀÛm¿þCeð¹f^:ˆÂR8Û/:ÏgÉÇ"“>£Íl ƒˆ4tG ¼" 7¯Ú ôK|ª~´c–1ÄÈ#›š@—xj.Õÿ1¤ áÆçk3vL’»|äB¹™­6€€F¸‹3Ö ¼Jža?œ{À\ˆœÄ2PNõzñ¸Zæd䜜Uù *Ñižjð·-å"qÙˆ™R"c'ò«[HBüpwÚÍ,°öA»_MÙ›Éáà«^§Œ³ÙÚ_‹+=ÝEÄ¢÷‘{ÜœS ôËðDt ¥nÏÅ^šx—žð‹Û'‘år&Ž…x üWd”(|íd{šûAÖny$/ºõ¯¾T{º.ôFѼ§hªzí8ÞE{*52‚Ò¥ù¶´âlɇÁ.~›&£ ç*^B8a³…ž4œÃ¹J’ bÍ—näê=ÞŸ¼æé^_dÎ"K¿õv¸‘‹2+yÏã»–á OuÎ<Ï™0U£2y-n%îÛ¤]i$7SÂe:'[t¦>‹Fi•¼ÿ]mÍÅXm•vüø=*ý‡TƈqR;<•t>’ï ÀÅÙûGAå“X•'ôE-ÚÚW•9§"S3Ýz/ ÀÍø“%fú‡òéß¼DÂ(ÐLp.óÏwv§üpŒ:uÙ©„½-Ψñš*I 7Ú?)Æ%WÒÇ9vÚÀ.§ÕÕ'ªìó9YEÍQÕ‡bÊñm§§@ßÓªb/´-v¦Ç¤ Z:::ÍÞâ¼Y‹žœ1ž³#M§¿ä8u‘ "¶áîÍQ•úUvþQIGì£&o¢?ãD=~qWòÛÆCÄ(M8)y)}ÖxY~Mè××ÙÝMßœiauf¡‡o S)PMô®¿÷2ý¬FZ•µ>t¡™†¥è9­E¤Ð±‡ž®ído½+žX­„;­!8t î1¢ÅM [¸ã™Š= #TТ|\KŽu|¢&õ—&etO¿¤ñ£²9EÃ0k ¦½i„­3øªª=Ãlá~½ØpÝ–&ëzlBºd|f°Z²C5P¥ (S#0•ih$QÜbÙèBÓúÏf…œ”dryÒ íuµyyiØÛöÈM”í]Ï „¸kÙïŸÏÝzYG,\ã1óƒm°¿½`äShže¨Þ -¶ÚÌâÎåHû’]wkW=.08Ò„Dº3_)Ú;™1ÒUÝàbSú¹n{F–­3æÁ|MpæÏŽ+€ÂUlIJáʆD’ÈÂs”Yàõr# ¿bÄV;Jy€Èòv8ñóy£ùŒVâ eub§ -ñs¢,XçaâæeÎuÒ)ÑËÛîÄ"#yû´zÂÏÌ:‚{ Þ­t+IA¡?fxñr/\`íMKÉRO½FôvC·?é#ß;Ÿ<ñ‘°Ô8¦Y¾ùÙRµc‰o I~a<üÚ÷øRZ§ÙÅ<}ˆ¡'Íô4Êú¡nFgÓÑã.ÜpWÛ¶¤¶kªdÔˆLŸŠò‚òøîRæ.R%eÔt˺1ÖÂÛ¨ˆ~ÁËä|2¦ìÐéï†àg=Ô|gyzçììwúm]–ó -¤³` ßtJµ–PK†üðIíÈ–ú½ŸÓq#ÉÑh¦p´Nö$ê«JÆ^_ ¦ö¼Ö~4R^ ë³G§Séï:ÁIy7ÑŽ–ªì„#¨{³k[Ub$:ÚÒ"§è¦àƒM];òÒÚçà‘ÍTZ¥$wÓ¯¿à  -´ÛMÈ’A|Õ[Ô JÈ"ZÖOS¯ÙÏ -J“ ¢-¡ -RÈ‘Wê:ÕÕ‘…µ›ÁÏ9¸¼¹á8´Ùè¨&Ûè&¹‘c'§õ¥rÎ’®ÌºT*®—ùÒ¯/çø4ø˵„/®Àa&èNv‰ü¯¡C–A3ܽIq1Yg:=Ö:/YÆë¡Çé ¸N´ ¾±‘œàlE¾'•!¼‰Ðט  <-êtxÜË"½±sƒÿ«ë˜o%ÑCðqU†é[MWË͉íOMfþ…¹‚ÙÖPÜvp¢o£C¸P,} Êðj›jE%xkYa9¶ñÍ!£ÊçãªÛŠðˆvµ :Î&TãØX)˜ãÇ+ÛõäpÉä­9¦âú€x)9Û‚|s÷Q±öµ`E™ì\¥‘æ~põŠ•€.F0Š4e¨Í½.Ûb#¿„T=âãxÑÕ-ÛQ¬ÝP#¨ºŒ‘•eZHe$M -šP"…C@Ýü@ÿ ³û>ådªŸÚu5ª:|ëùœ²•iw—¥‘ñ„±-™¡ŸéˆJ[WͶ3¾û™àÈþG# €–'ËÒQÏbúåDj" Ùi>Ÿå³$k›hÅF!6³e+>¢E-FʱºãÓ¯eZå†xS È=rP 7‘^xŒöî!îX„`´ &ðÚ<»ät[!;{›db³‹Û‰Dœš³!÷@¯ŠþîÀ{7Å}sw# Õ_œû6K{¹#-Û”(Ç»¤”¯~¾AÌÈÔ˜ ÷áö …8—“ºCeX¡!ìËá)Žš¯÷±‡A°°Û·!DâLâMˆxÌÕqO’ª›o±{wþžÊG¾äP„ï\j¿4Hsª~kõýÚ`¦îW¾Û­©ŠxL›bßkpE©?ø¥)!dÓ•”2V|_’;/4îû6–™'ŸéÉ"ò‘z¥Æ!è+Ö˜Z|mÀ]™»rSmGá±0ŃhÄ8‚ÞçOOÝ.p,ÃßµíñZ§¸O*ö,»T (H›(4Ô‚V¦uU˜Ph_íHNmX}ÃÃ]dŒ*É=Ãd©#ì‡ä´‡Æ*zYºþ Ï;ÂKªÑÝ„âð2tû'{\}Õ«€ƒþðý¬/’çÈŠ·Š$IÏ«ïñ\?¹¼½†¾¸…÷Æá¬1¤Ê}””º¡ÍÅâĆ€ðñã¼Ë»$„žë¯ -ô<†ôHʨÃû¡lîaýnÒ/÷jÇÄ*M³D"7å÷~|gq -:ù5ÌôR\¢qj‹zâp«-5:’ 5ºÙ+ßîùÞ™1EO!fù=?¨©×"GÛAñí ‹ ÊßÚµpÙÖù>¨¥Ä*õq…‹1ò•ˆå.#¡˜†Ó%¬T} Ïøy«HsíµžêÚòV‡{ÓÃ8pqwÎ!-lc[9àvï¯Î°¼åZKèÕ~ÈÙ#öÕ0“/zžBtÉ^3ع>´ÇX³ÐäæËÀ“”¢ª”ZEë'lü±ôX¥Ë”ûÒ}MÒ5AؽóEÙsŠ e^ |Ú'\ûöʦ%ÁHLNTÞPÖ"jT|1«×t;\—0m9ÓVHmZÐhiUQ>ií©é6ª )~™~/h è5é:u]M"ÛÔšwÅ¿tÌf˜ql²DÑÎ\,}7LJ( €/ÖæÍ”cFDÁ–NOf!P‡ ñ>ÜZ«é'xËìòœë“K3w>ÏÜy@ºÐ¤|Œ]ÍÊÓK¥J󙡪;¼ÝòÝ»™êßE¦Öq%diòtªGÛÅ  zoëL¨(«nƒƒá'Œ$“ Ò27&Ø—;³BÖzmR‚î¿õB^éÅOY#¿î¿zðõ•ÔY(wUÜ»žÆé‹ñ šßäú°û²õ„U¥ åë•ãc‘Ë,Ù©®[×ÇYs÷õêô‹0©Ê14´o*™jQ ÷Еy1ÒçäØç´HÈ$Y‘?žîK4;³ž6~©KFz¶˜•}b^ù8 ±ÒYÔïÜÅ·ªønP$ÁÁš.µû, }£jú8?oÆ~¨\%±›C—#£[SBpÅŽˆ…Zr—¹Sjï!£XóRäõ>ÑGØ-ztÏG h¤m˜ÿ´ì}=*¯†‚òdndŠK_úÚÃ'ÎgTY³?ÜæÖAóx.RÖ·Žñ¡´L„ú[¾©­£Ö€°«a…Ž2è'«¢§ñYœË¶ôÖ*¸ºI›¤èä'¢ÎðEí½3 â™WAʇ:vD`nÃì»>cÿ~•ßWÁoZ’Þñ_tpÔœÚlyp•­}íק)sk4ÖHÜvHQRÛÿäNš³>H–ƒÅ+ÿŒÈ‘¬^{e„P¶/rκ¼7+ËøáÕhºÞBrÇW Õ⛸MžV9ߣÇo`'ÅtVY1’@ ‘¤vucõé'¤¶õ¥!Ç–F¹^Mß›±`ÿRˆ$3…óâØ2B³ÈÊ6”ZêTÙºÊ*Ί_m}ÜØâÊßp6vOöÙ¾ý4ÿª&´1nV#Ð3^dÈ÷I~¬m9&àçZUMѺ?L–HÅlué¡> ú£02ñ6HìøW·ø%s`dtv¸’T†#l‰çÀo]PÝ"Ÿ-±ÉHøA«iYað«ÃmEÓ¼8¾ü#_ÉlH¬ÑÛW¼.¬Z‡“ߌÝPOä ¿ÝHØyp¦+Ì¢®4Dó𨌠‹óI»¬‡uÙé˜pû1ß'ZQÈ}?}³Ï3OØ”ÊÀó A“žÚ‹—Û{ä,·E{¥ŸAtÀM$X½~–| KvcТhgO÷[žÖ}&y7ÎÂÕ˜/?7Iù¼Â=‹ÄäÉ—1TQlÖ,83~”ëøjðø ¹Ï‚ AÔ½G–Ì™ÉTï“k{9ÇnŽGg!H¦@k˸$«ì|t»f9(x‡Ÿ<î;²*»wT5;†´óT8àSYÿ#çkÄ´Y€Bb9²R±eÇ4z¯úF;]}9—KjþEÀÙ@‘-_úðmИ>Ñ=Ń ÁPÄËPZô¾úû«x‘~yXMƒ×ÃUM×Îã °ÎââÁ%;˜ó#œÜÊ©dBDRÝm[Ê 4’þ{~s }…£kg„ìi>œ•jx /„|g"VÄ‹“ìsÚ=X*d=Ê7ªgP7Â|MP]¯!ÌБï¤SïÐM$)â{‘ˆN§fóËðÇÌ;ϧ…G¥L^Ç,S&và"óùRtd‹ã…–·/Ñç‰'3v ¾g"f%ÿˆWœ‹ËÚÁ¼'¾…lÙþ®©ò&l´›2‰&Ä…Luˆ¤_äþpÙ8ÊôÎøqÿø”ÜK±EJ;W£ç{5‹Èæ]Ú ñžDž£Šë{žROv7u3¾v1nç~Ï~뱄EF ù<5àî¤)*hlå£ÿ¨ú’ ð´Ýu^kÛæ?Ð/$ÌÉ@ìGnÅ ŒRÏ|ØD'UЩìЈGoná"âé Snr»6Åîl½ÍáÐÓáÀB¯ÂW“‘B`ÿ¬¶‡c0ê KÏ–~þ¦ÀqÎ.ÓßQ¾«šODCÃÑd¯]©v¿UWC™¥T^zàbgcÕ¤ÇIy„fYL£ã¦å±20O”¿T"³F AfžqDi£39‘Jª‘#ü­ØAkÒEÛä-šÅV²Î‡ónÇÕš0ÆèCáVžo3w‰ÞîÕÞüv˜´jr‚Ö²Ëêý©ñ0©U„_UsnÈ{*¯ +Ñ4² (èi¿¤ç³Ó ™mÚGa£ {~ª Õ€Š†cÚI‰Àèêu¥©žæ@½²ùë4å",Ø5;ÜÎߎ¦ã6^ê’[pïiv%ŽoÒÆjàÚ£æ"Ǫfq_¶3•óõ8Û%-R…Mü•Æ…ÎDJ]õZB/dã’)…û&¿ßúU -~m©ú-Ÿ™ˆ¥Õ€±†<*¶Ñ艩V“±têÿ«Ó5döõü³ ÁÌÔJæí‰nÚtÝ›©.~Gr˨ܯéÖ;™oè¦n0AˆÖK7p8˜6ºb£üTP´ä}{‚æ–3+&Æ.níÓ·e,`ƒ¿.&†ÌK)ÕøJ¾³b.®w˜ -|{E}ÒjoY^sªˆÞÖ©¡Ä­²ê5ÕtN¬™Ÿ#I­¯œOUü¾Å¨šbek$ ÿ<Ñ>>aÐã\1À¿Åiþ)ÄÞåÅç ç‘ŠIÒ%•f‡ä˜n]ÔP”0Ó°…•  >ñNb[(¼_’àž,’fx|‘Jù¢T0â>"/ƒDwÙìG2‰Û¦Ç)‰§ÜF fžö´³Ý:ÛÜKÌt¤S̉õœ I×7¼QÅ¡ê· °°¥Pðrúù°é¡)G$ÞÅ‘3ìf6ÞIJPŽ3CÁ…ë°&Œ³aj-]ö”ŠŸ$?`/1ó—XŸUh _*A.=2î>ssà-2õóK˜Žþþ±“óm:ÌÇAæå™ '³FSMYÇñê·¡eþ•Ÿð=ÔxC&•U'¿;Ëþò²ÁÖÂŒ3ô7¡G‹å™[4úîÍ2ÚeCûÃìâ~Ä$ßl9Bó¯ãÁA(KS_bi˜±½‚tÌk! ÷Ž7“Š ½Tà4¾PØŽH¸*$K¨`ζʺ°–ú¶1s˜-4d_J5æÕà7é}ço;¦z/Ÿé­s‹®ýZz_»Ø¹C>á8V5 "ÇZ¦Ä)|ànµùv@6ƒ¤ÝKÕªÀ­ÚÇ ?À%s ‘ÌÖPOÔ*]g^°NxÇ ‡ç¤24åíÈ’£¶Ú.q¹ñ1mjýk÷/˜KóÅ%èMsc‹ðÎÚÅ,>ã[É|˜Í᜘¾uòiø=še&Ј-ž§¿ç¡Ááìèû¬uÖi-oµ‹’Cð‚ eû]žñòýŸGf˜E.#ò N´  înéÞ GQC£.žtJº…‹×8ãYÏþûE€õ.á/Z6.;,¾YAàQœA¯—ÄFÁÎ ÚœÑk³U?[T>òˆÖ…ÐÔÈ)y€ŠThßï‰~'÷¸ F-³$•ý9œT–Wˆ´‹jq4ÐãÝÉ;RH[óúä–„ç«zÖç/Qûcì«=#£V’4õV9ÅüqŠªtû¼/_¹´Z¥néJguB@)¡6ù3Ûýä7á‘æB'Mò`Ù¯ý‚hÜÝLæÆ~G½Ûvsd Q\vB:5µ,2ÞIæ^Wz~‡Àä½ÉN¹ª³ÇËð|¨' 瀙Â/û¡üÐ~a¾Z¼Lµº®V²‡Ÿü‡LM/±òåÊV…ê*ËW;/ÛËpÊR\ÓMä;ªü=VRL±Ýð󊙃Vó¯hNÊc:ÍéÌѺÚØyÞÔß™J¦¦ºƒ+“\EÃ×/zOC'.]<>°˜-;·¥~ÿ)Á9îó:z¶ãºÂ|o_f tøõ:åx3ß»Âü¸òö:÷€ûŒS¤Á¯Rª¸CÌŒ=c9"iŠ3Ö2â°É.¸=Uº)ï/àœ³Tu)Äó™ðPß܈#§IV"jù ý j¶ãLCÛŠM\íýÑëâ -%ånáŽu÷‘¥`ÕuOMUõ꟮r"ŸVéïý#ròu¾d†MãhÈ œ¬Z7µs„L–í9È2AÖlõËN’ž+!ŒYJÝØviõ¨Ì÷ú4Fú¢£$®ÿ‡õHë¬Ô3_½TBt†—’ÊýýÄù•H06#ãb-±ßÕÙ°öé¼¢£TÓšg¶í¥3V½`¸µ#úÉ#`ôÈè‰c×P¶Ý7PÒÔÑÏLô~——'\8t‰©âMÃMñ¢×ý’:´UÔö‡ ‚ú/(Â|u8æŒËÇD’RÑ= îÀ²’°Ž c˜,ã0ÿwÌ­4Ô*Ä®8ne‹æÀË£±õpÖ¬†Ãùþ>1”èVÙ’+óOJG­ë’;!"K§ÆÎÙh@Íãm-®…™$Ï9gÊN/ñh:ÅÔïïkŽÙ/ éÌG”X*¸ã? xÇ]s­r˜XàbFmgrÑß3ø×#æÎ4º.½f¯Ê¾O{‘ÊïiXÞv´ßý*6x™6ô°ÚÒ{Pl‘ûÒ+,Ú'¹›ƒ“J¯?‚Qø…þZ ΑøÂ_×Cyd‘Ñø‰Ó],ÓUµ4lÝá Òes8&„r)\‚î¶ùÑTéënúòR$Š>¹â÷‰9œqÁ¦ñ'Ū…`VäQw|¦«|˜ôuõ]ôi]íÀO}ƒxÐ=d¹kC¶¥Ÿx1ZL6é -s_hKŠ^KÄ–2Iy¾³—²£ ¤»Þ¥àö¹}6+‚¦„zI Çß?jÊËôÍ ¢’j®©ÌÇÈ7·c©iëAß6¨´nÄp pÖŽ]tîÓä°3h ™/ÇqÝÃÑÊò+ÐTñ¢Òæ*’}óR¿#;™h€Lœ@ÕpÅž0Ê1ÁÎ/Gä‘æ ë®ìRÌFð¡VÜtjÏ)Súz…Á‘9 ¬ß<÷»¸G‚ÕgØ1¶WC+œ¦ã’ uñä¹ËÎc¬­±k§’­üZÑne˜S! ÝÕ…hh4Š¢ºÒs¨=®¹¼eÚÚWq4¸ŸS³Ïåïòª9òv‰,Õhñÿèzg9û:ØXø ÍQ–߇íý¯–ucÝÛ—V觪ÍK$K£”j(kgWw_ô7ü.¶>—žîvz.å#r1õ­Ê®K=›èP³¢Ë˜ÌþE½4 /õçô -’Ï[ Ùu¬—<~0-ÅÊ8«òuóÈ4Àü&ü¡÷×gLVŠ ³óÐ`<Þ.-¼ Š)Žx£¬‚‚ !ž6Å -çüĪãôR4íJÚe<¬G6"©bNˆ¬4@òo~sn4Ôõóú|®5ñŠÔ’Ï‹È®‡ž‹ZD|YÑ*Q„ ñZ>øÞ_$I² -™—âîùÔ4åñ;³WT—Ÿ9¼ï;€AÏi§Šr³(om›¼êÑ9^Ãîþ¼½Ÿ£ÓI£x^¹mVg_·b³ ñ.H{œ®¿ÏÍŒ(Úù,a|Mæɽ·÷T%aýøƒøÿðÿ‰,ìf®îNf®vˆÿêpK†endstream +/Length 15956 +/Filter /FlateDecode +>> +stream +xÚí·UX\Ͷ°‹» Ú¸»{p'¸C°Æ¡q—àîîî!8$8‚îîînkï½’µÿËs®Îs€‹~dzÆ[£jÖl¨È”Õ˜DÍ@&@)½ 3?@\QL›ÀÆÌÊ*†DE%î4v±ÙK»ùl||ì)  øøŸ‹“Ÿ•‰ + rðt²²°tЊÓý“ĵ:Y™Û],và1Lmj S+ ‹'3@ÔÖ úÏÎU 3ÐÉ hÆŒÄÆ0³2u˜-¬ì‘Xþq’µ7xþ+læêð?—Ü€NÎ`)í¿4é`I3½­'À hŽÄ¢W‚]þßÐú߃K¹ÚÚ*Ûý3ü¿:õ]7¶³²õüï ƒ« Ð  2:ÙÿïT-àɉlÿ¯2².ƶV¦¢ö¶@ë…¬œ¥¬<€fÊV.¦–sc[gà¿â@{³ÿ­nÜ¿XÔ%4Uþ{MÿuQÙØÊÞEÝÓáßÃþ“ý/fûÃàî8YyôXÁíe'‚ÿç“Áÿ*&io +2³²·°sqŒœŒ=‘À»L\o6€•½Ðô³0Ûƒ\À·À-ñ˜ƒœþYP6v‹¹Õ?±!'€ÅÑä43±ý¯¥û÷n‹ÈÖÖØéOˆÀât2Úÿ•Æ `1¶GÁ}ùw”ￇýÏ19YÁ;ímæEÙþ;ú¿’Á¦ÆÎÿ áló'ÈεuuþOÀdggü'Â`±ôt°Úÿ qÿKÜ +ôÇ<g[cgË?ðL¼€N ?ð$@öÀ3ØÞÅýÏu.°·‹¥ð¯Œš rýÓ1.ŽºíöWX×¼Òÿf°¬3Ðí/Wðª²ÿ£\`U{«¿Exÿ™³-诛øþÆÎê?£Ü`A £+øûw„ãŸu:ÿsÂü ‚Dÿ¸¾Ø×ÿCàÂ\TòßÄîŽÔ—–þCà¾Èü!°„ìwDî]äÿØEá]ÿØEé]>þ›xÁ.Ê\]õ««ý!puõ?®®ñ‡ÀÕ5ÿ¸ºÖW×þ7ñgkâdljtù >¼ÿýtýçŽß🛞û¿ïøÏtpí?œ\ÛägnúobcOÝì/üg ü…ÿlп¬añ‚›aù‚»aõ‚Õ¬ÿB°“Í_–²ý ÁVv|²Øÿ…`+Ð_¶rø ÿÙ¤!ØÊé/üç‰ù ÁV.!ØÊõ/[¹ý…`+÷?ȶòø ÁVž!ØÊë/[þÿ91þï7€˜ÈÛ‰Üq&vðQ6ãðqrûþg¦†½ø”•Ÿ&¬¬<à꟨©«øøsù×[\ãØÜ +ü2=€¦H ³ S`ë´æÐ +?ɢߕ°ôb-ñJ ÝSÈAó ¶¥ÃòŽô«õÚU™Xh»°»¤îτΑí>*£RgŽñé3¯»nF»™^ß µ/3=wÈï‚ŽÐÛš§¯¹ ?N®ŽT$ë÷çœÿ<*P¦•P߃_&ƒèÑskìÉ +ææÑ–Ê´Õ ©§æ SÅHw¬ç [qÇHN„Yò³CøÆ°tjw}÷X„Ÿôú âÁ.*Ê™ |Îuñ„P$Ð÷ûZ#×Эܽ/yÍMcŠ,_ »wtמ¥Ä=Ü¿ßêSlµ6’Ìt¾Žà3Õne¤]šM#tÀƒ€%h~ÉCƒ1Á™õØñ"Ü/£ oªrÕN&uÐ*ýh­¿ãG5&·¬n÷¹upá6vDVEŠ†'~úØv‰7ƒ¶¿YøÖœ$†‹ÅÀ¿Ö]CVZzUÛ-m³;*yf?ÊÎÐ^1GÑÂR¶½ØUû Ö—‡tl•éú‚9/%ЮáVœ#.ä3&D,GdD< •Ìmܼ”™ÿ Æ.a0:lµVp÷×ÚÇf• t´Ð Ä 2w!K÷5ˆµz«¢n¯Rs˜÷èhWýB…lQ¡H J´­?÷™–ˆÄwüCk‰îˆqÌbÝwÐ?MrÜY)õbc# ¿“+§Ãgkù)é|¥ÏånæÌ+ìΪ»¹V:0Ig=B0ôuR›Ñå‹fº¤…£ÏÖÔäC ò‘Ë8æù0ï<~ÆL%1Œ%•T¨£øÛŠA±‹·oô¸4±Mâ¥ó¿]MKï’†mïÎÑ“³ÚQ·WÀ€Û³%xèƒÔî¨ Ò<ÚÄ­&uÇø¢}} AŸÄ£ ¢±^w€ó>lÇó°<æ ªÍtÐK(ßÃþoJ=)!`þ#õ`ù)†«[jï›Äü¡¦l€uµq…loEUSHlÒ%רz~uˆÊØ6©q¢b¯µ”FAÇãL(3ëO[Â~M ü‚@4ªŽ=Fîf]e£çÝc‘ªgu£e)e'õ M×Íɺ…N,a”~\qû²Š|mg[ +1­‘g³Ÿ0ÌƸĴЂýŒ6Çc‘A=ýê; +®™eg¹­/†§æÚs‰G&X$ÄOÅ¢7Âoñd Ó} —6û7 +ƸúÕîÑûVú§5[õ(fÓ?ääµZëË[àrƒO1ø +·…QÛÎ’ðã5Šswmtà2@­^,°L‡Uv'ÖÃ#Ó.´aÛåBØÇF…¢ìîPþ¡¡Æ¿‰½…5¾;ä:ºh8P¦Üëà”°Ë8W9‚ž)õ_‰z*£ÆqH k\ÏèÆm5%˜á·—;·›Þ÷ôþ¢@®å-´{èÚóûñ¤•´¥ëïRâ#Ž¡*Àú«T²óÂ7ùpXد{a¬i;ºØo•gð‚uzpÕå‹ÂÒ)¼~]cms†Þæ&°ÿr¨–Ï_¤yâoÃ/Ú{q¸š ó9ÆAðà |ýîÌêë¾&b®lð àŠLjæsâÏÍ=…‘é?¹ËÐT_;0ÞØ]z€|Éì1QÛXFHåØGU‹,Ïü|âƒùíò£ äh’Ã@ÕGI^λç.¦T\x»¾# ?­©r†|¾û.Y®#‘O1Ì›šnT›Úñp%W™8¾vˆéƒÏ¨6÷Bƒ‘2vFµÍnŸÚ¿«1ÔÍ*Ü«õÊù*³¹vø‘á?wâbÀ•­4 ÞUcx(-3~¸A/$UÐî„ÊËþ–-³ß >=b4> Þ’,ÅʼnÎcÜZ©ˆ&=ôå3zz×ÞC|+ª4_ñï¾ñåx–Òãâvö,ϳd Kpƒß6ôÞV&^˺röÛyòHî“£—Æ¥z™Ž ¾M¶ÍˆXª|öÅSB”ü  ÌPZ2››É])èT©ÙŸÞ»°¡”S¡iü¸‚ü²$®Y긬T»P GèI7,wØý!ãÚØ£W·YËíx³ø¼BX«fòúUÜËéÞàè±ú m¶÷'‡å‘¹š¯ûŠV˜ŸV÷e÷±‰tQ§>Õ ç\%OfŸsvij¶É¬,˜8aŸ"°}ÔËŠ„Í\¿k~© àÒ&œíЪÒãŸÅz5BË`^gãv¶éé•râÿ‰É£¢æNæ© kvû•‰GÁ¼ˆÇ=3è[4̽îÓGEå‘þÓ`§{õü°Íé(G[Þº(ŽlåüwXºÄqÅ& Nžñ¬bÕÑÌA]ù:Ã|/b¥„Þv^M¶Ö½(®†º#¶ôµÔ~Cfׇ +œdDËZ¹_‚k0Ö^v²2¬‹ýÑ)‚Já£4^@³N’eÑÌB-˜h^ðŽf®Fè†ÍA{²X?ºñqçëZ œ-m`*­E:ËL¡¿AÖh&Ldî¥RzÙ +`²ÓÇ…uya† ³ôÐJ)t‡27ÙY’Ÿ·¾)¾ìŽœ³oiõ3ªŽ¾5<\ûšŒL•Åo´|—ŠÕë°ø¼·èûûwäf”Û"Ö‘¡Ü{Neäß$«¢ª7³C?^ÝæZnÈû»Râ+¥'qÊMçƒ}Ç7´ÆðžÈ{ 7Ÿ|%¼ü’¬ÆQ /c>3_§ÎhôêÒËÓoömS~È Ý2ßø=òõ‹Ç'#g]EÂù±…Ûéåq÷\Hfg·s}¡yz¹½6óÿäqÄ¹Ä 0 ¡U`b™ÇØ%™Z;·}ñF•NƖ׸†Ua.®iVW²¼{¸ÛMªÿ%õµt‡W^›€ˆîJ0}X4¨tâ1`î3ðÜöºÚÐÖÎüÈyÚ…´o7å[øÔQίݼ¿æU[xà链ê{ÙÿHlg53Á +»ÁI5M]LÛžìXÖ‚âãàp}˜°:@ÁºãsÛÅKîלþ3ܹvKð©,9zR«H¼Þ©>¢ˆ +ÍAò-$sª +Ì ÕJÿOÕtY ì¼(¾´?û ÉÀGRžö«5(¿ Òm$:7ÔÔ2An\Q«Æëµi6£R¢ÿkgžÐWR ï5œ°‘GÅ•Œù–zsVÙmïØßÄتVÞûžÐŸ%ª?7¬,–¤†¾;'çSs8Õéáê‘ûÑ9AÀü„æD/úJ¥(‰Á.þpØTO­ +Kâ]cšR\ ¾ • _îácr>ÚœjLeT¼&J¢šÏŠtµ¸+´”hhy`bËaN™c†ÝÕÅpøÆ¢ºH„ - «ßȵÞ+âá žo|8ÖW,þ©PùåÒ“)'Q»€íbxImŒK©“æ?­³´ûpß{ ›²lŒÀŠÐ!¬€; å„ǮA )tlør7Èë©•-|¬&ÍvĨ†>‹I}>£€Úz<äye…ƒbWa$KVBíô£)ÿ¸Å]w~¦ýYn牅¾D:©Ç´²"»Úbc¤MŒ.<×ï‹bƒé­ë&n¸â@ž½ÝŸ,©RYãƒÅÍ·×kZÑHÈé½N$þ>^•‰¾ »Äµ]Ú«ÖîˆÓì}Q\"Å<áf&ë÷‚•û¸=¡¨üW öÊÞ§›æ”NgVô“ürIH>û¶ÕhæY“Ø!ù^KŠô„({ñ'€ç[¿>ÙG÷kÛíÌÔ8+É£Óшô0>Ù[Ââ•4ÆÄ$©X¼ýWRv\A“ng\²@õï¸÷(«ý‡u¨Èã´úõò(ü$•¢Ž +ª[B³¬âS¦hð ÊpѨ!¯ÊÈØR G؃“~2UzÅÃÑa#=6tlßC:ê~WÙè†웩Œåî}Ü9›t+bz2l¾Áê²£ .ò©ˆº·|¦ËÒ%÷DQ²ou¤8Oo 9æ mV·¿“/"óxñ™jo ‰iO[#!n¬4Zã y湆À4ðÌjuyR¿¸e°³²qhmpªxˆÃ¢yÿmô“Ün+ûË…¢t', ôUÖs†F`gÜž€†‰EÀù7B”ªA@5£ ivæ{W”Y)—XyÂ$mN 7yj \æ¦G,@ØÛçš,Â@B·~Íi“·îy_zuˆ“ŽSʈÐ2Þ4ªÌ’Ó4fžù13Z%r *-N.]†‡,p,ûrbÔ¯^·ßÊJZÂFÜY”¡`ÞCú ŽQŸ%*Dw›Ç[Qótd£–~‡„…"Ž2r ™f6YõÀNÀrf~Â|m2­cl阰ËAF©h%{þU¡tmñ’–Bît,C9«{D‡²præ®!çT”‘Ì(‘½«pcë "ÞÁO÷A‡´YSñ HN̯¬ã¯KšCE8έ@†×ÏT±lIV¨kû‡r'Nè¿ÇjšsÓLÉ´µWÇNˆ õvË¿¥˜Ñß|¸iéžÉ£G¤ÛàÞfUä“AºvÀ×|0‹ âGpi"åà‘ Ÿtªß|ÔsÕIBêÆa“ª‘«\ÏvÓuÜ «7>\¨.gß YAý†À?§`â´ÝäÃÂqÍõ¿;^µu1ƒÊ}$™^4RäÏèÂ}sêíBöúʱïÏ”. +j±ƒŒi釀dì´C[Ûœ}þ”½Ùô¢ÄÍ»_¨5Þ§ÂpÉaåAÏ],БµB…í1ZÛœÛúà+])C^øÅÒ¡FÞ΀Ù—•™Õ69iIWHW‚ÆØ©€h{$UÂ_™ùZÈ{1‘BªQJãŸbqÄ#ô¥ÁvŸ”±Ýv–—Àºf+X‘>– %Þ–Ë3WË>dêT†¡¼½傈‘üWîÔ&LI6fØëߢI¿sáήΫ÷î_@c½6U¬G¯·Û‘T–ôqcïx)$0Qºb®Z áàšeñëÐx“Ëèª+ ÒDÄ IŸr¦Š¿CÖ'üê¹O÷&­w?ÞË•ÀèÌ^‡Ó…ñÜÔÛSˆ-5¨H„dïãýC¦ªwï'Úy‘djvÎ 3d¢Ò¤gaÎúœ‹uz—¦ÎBÑT/>—,¥/«Êþ&ý=h•ª<ÁTyKz¬r À™Ý°Œ¤€î)0Oœ }Ö…(ƒýòIÕìc´>LÕ¸”ÁÎû²nÿ ¸]2®Õ„yBC œpBDN©{®DŸï¶Ì8Wh_¥pcÊjMÖ‡yðdú3¯ß\–‹WwY…Òt˜Ìm^„Û½7œ±Ñ: Þõjñœà…Æ¢ÚMTŠ›¤Ÿ¶uíÎw_êh’çGÓ̸Û÷]»˜ØŠk" +×­dðiŽ¼H÷ÄB®£‰Fb´©z"ÁøÛ}¥Q1Ðkê\3h4ˆi]“BbKwÙ~Û€×ÍΡQB®lù9é YQd£Û¡ÒG¼žã¬YKÂQ î’ŒäVƒ4®döøÛ‰ÜÒ¯mÝðQá£_4^©qU$Ýy¡ªÊ8šl+±x ©9þ*«#øêݧÚøÞÝüª©¹º´.>[ÂÀ’a¤§1Ú9RÎc>ö-”(…ƼI¨`„}J‡6wËR +[’03ÝiÍ/3).&ÒWD‹f F§Ù‡‡B$b9Õªmm·‰ŠN,9¬?Ñì½|<;ÔŸÆá¼eC©?!.¬èÊÒã^&þó•²×$ÆWQt—±ÕÚÙÛ7Q‹wžŸ­Ï«ð©QÞ×lQ]–í'MÃýż“vM”_àŠBà"–_§½\¤U+¶W¡¨á~¨a·d)!m­c™&¹N˜iÛå¡Yï㞇2G㶑}ÁŠ¥¥ÀéÞ/ÿÜÂç1…@Mi‰aSzÞ¬L4"8¼D8|ï„© õQ~FÕìâ 0üÎÁø‘òLþ»m!éèN¦ª ”ê°{5ôÀåÖBÍ,O½ÛàÓÔ[;bz] !Z^aù>Þõ4LE|¥#ÑG*v*ÛuØôòöÅä¹Í +Ÿ“ÎÍדœ JRò!$¥à¦Äí÷iQr¬q¶ðX⬜ø >lµ{…U`’_û›æX§MK­| i"â¹'\!:ÞŒb\9}¡lÌn‚ùZ/ “e¬·¹%#2FæEBš’@3rÏ +»›.à ڋ•b~ÄxÛaZÅX¶âgS£A½Ûü~ç9•™‡›ê­I·>tÈœž‡é¤)‘Ƽ”9dÂ’­ª?yä@ñR|g­\À„¤n§]ƒdŒ½W„¥]¾SJÌ\WMk¨åZÑG•r×ë +’Ϙ…ÔF+¶Jg/'ó˜J|*“…c"K,æöñÆAª‹™kL*s+£ÁÑqi2ÃpsðÝG–«á,fo:?îëJÐÇ(±ðÂ$¦ñ?³x‘×t³Z¹/¥b©à\‡éÃç#ÏetJ­„)Âg +šŠ6«Ë$>À£„6~hF™]é‘‚aß}ýä_2F%ÚŒÒlþ>FI­$¡uPW]Uƒ0 ooüΑÆYÏŒ‚IZþwíO8B>‹§Ñ6A©>æ3iÙê!ýª%…Ý_Évç²ýÑ1(u/ò. x¢‡Œçä»,Ú,*Æ•±NNKb+û[dý®‘ +5Hý£¬gÌ#™ãßW•±½ã» +R“ˆ`ùu%÷††ÒIùhî!‚Ðoçžå"l+Gíþa«*‚šÝìx +_Û`ýáGéÔßÐÀÍSådCtØ6iøD€û2v6ƒÞð±µ’å³Å\(ªÆ9ª4Ðy+eMçíöGâU€uKŽhÿÎï¢hzRÕ'<ª“±âèúØŒU›!$ÛÂJ‹$¹~9‹ ÏEÝ•ggVJŸŒf”ï^,ù¸ñn»u†Ðî£_oeœ°s.Òì}]á!ÌÊ ¦!FN÷ÈÀÉT<[Dãm™È‡ËõFç 6ÓôÇ ±Û4ÕvWãy¶¸Ÿ£eý>Ö¡;)’C5¡ñ¬>Ç,É7…ÉÝŒd †g¯O¿ˆTÉÙÕšæzÝvÛÔ»R&÷\ˆ~t%]Ú ×ŠJž=&hÿxÏÿª6QIS]¥˜¦ Ÿ_/¦~Yäa&¦áI©å +7àÔ„´cwCpQî;û¸Í;×BEÀøs;âíÛKºƒ?zMÆ»B8ÚâKé ¶pTÚ»¯ß7¼b$éˆõ÷´Ð.¾¼?7zFÍ=¢´Ñ,±Ù;|µ 2$Æ% q„ Þ Oœq Äå{KÈö«^»£îp½Ê¨\o鵬tŠæ¦ðš§(ûàc}˜sìŸçáë̱T^šEõÒ¬ž?µ/|‡êÆ1Q0„“zÖtÂ}Ç÷eäË3gV½®L#ÿ]#ésksK–ÀO·W¬ã~Gl7<“àÂMÕ„0sd.^þà.1ØàvJ>‹a7¨m䘪YˆRJ½øÎq—ˆ¬¢tŒ©Ö|…`sY8)ös÷³ÒæóPÐãlšîÙþRK¹|Mæ;9ÛñJ?<)ŒðËßx†3p…KKÂëêÕy-jRù„íRÂ_å‰jÆr9¾ö^”1| ?zêd‘úFGìzEúeŸ]ÓÀy‡#Øѹ,¿kRŽ—îW ëéÁóhâöè~ˆe…­½UÈ…wºxòžl¸´ÎÜ-ýfaEïò>W¡JÝl;ܾÞÓ!ƒbÛ_ã Q$sYª$]¼èÞä!ÄGÓ2 ÿúD×pQð½ ~ÀVvßøê÷/±û‘Jè½¹…“‘žž½¤,û±ßâ5b£ôˆž[{uMHWÍ +FdÃeë0„Á_oÒÚrÖ·02b§Þ”S×D]âKFÊ!ÈÚü¶r^‰md€7€Úû•ï›ØL¤Ô¼v‚ `¢@Ì•“Žä¥s£@λfókìt¯P™°c¸7+`8SÅ£=_îñ/pYlŠµÉJ/Žï•ß±2x¯-öôÇL}††ž\¡ïª´éç‹Mz-†¾+;³–ùøµ÷o´áO­uö7h\O€±• (ÈÛ_!¨ÓŠ̺ÃÄ[©A#££]³Ø~ +ØŠ_ˆ+Q®Rpb™~¸?Òw¼Xpt‚U]‘¾òù}´» ã2c“Hß¾Ëp¥aôbœõµ{F‡¸C3Ô©†•êX5"Ø~iu 2\z8ý˜KoyŠæŠî% Œ*&ÏVH5²Â-ó駺$„MÕd Zˆlas“œY’àsé »ü\kÞ1ÃÛ¢J1?ʦ·r¶Ÿ•£ Ï’ŸOlÕ³3’˜?Š$uJ«tøwâ•"ãÆ@ÿZÜNËÆà9€ó«q?±:•¼Yjñ»\U¢)[îZmq3ü$ "V-mÞûJÇÏ íRÔ. ÞÏŸg-÷¥2óè +—„Ãß‹WÅ»n^¢K˜E[W¯dæ(ð³ä¶E’8á缡–A¬¸¯˜WÕçº œ VõÃ#ý¹Q>%ô¥Ž‘u\m6OñÌîÈÍññxâNÂ"é{Z1!JšÇãNùÎ>—ùÏv0¶ŸF.Hcî«ú­c[«QÝ«Ô'g“iGò +Ia¥÷a¡Ÿ;³²*[m¶÷´cÎ×Ö9´\DÒ¥öîýyø÷È»V+SYé>A9b´ýè+ÕÖ¾w^‘—òošûZæèJJÛbæÃUœ5PœD÷E†WÌ Ÿ”yÒü±Þš…¹Ú$èY½×u"\¬lˆ%hJh…¤Ö#²­ó®mŠ}€R Æ0I?'0ö´m:J7–]нþŽüêC»T€KG^ü;ׂ&OÞœx§ÒøZ’ÝÖ¢Å&K.ºïF±«ÀÞÊ,Eþ6ÇêûEBá¼K· +¯>³å±»º#ÏXŸ” +ÁQçé}³²Ga·×¥0?øIŽÇ–ï:_<˜ SH?q¬kfV÷D¯½ÚSñžˆòeoœAVÊ¿ û0 jìͲ_Ô̽WÕGàéÉ,i„WyÔÀKzF+qñâ  +Ä}öC…¢®·ŒÛUnÉ*ÙZXß4¬Á9Xú•óÝ"gaC,à·çºÊ•ëËÏRÊzcVÀ˜F_WKB)Lèáo”–Ö28åÐ%ÚzÌÀ>ªñ?z +ñkœ¦j¥æÙr67Þh8›•DÄý^ìÅ„e/7P†5õÂö#«©>ìJ:A‚ËE|û›Æ(¥êÛP’™wYœ%§¼Â›2UÂ$µTLþì’¶œUC°Ûp¡T·Ò½…èu‡6¦ú,zùC89EÑñXÖf%Ó· ß9òãÓ4°¾î³Tè=œžàL¼æá³ÜiSeœòÅýø +8íëaÕ5B @(÷œh^D#é¢^†b²t$«¡X¡zj¿­„y½¡—åï#J£ +U‚FµJRÛcø¤±~Ñ zõs—¿®s“ƒs*’‡=ƒkvÛ„"«Òf&sîôø¤¡"»Íα¾>Ï¥‰å3Â`;œ9ê!ýÝDtjîiœÃÖ +Ô ƒ^“’ÐèûKøŒÀå"Ræ}öù\w®FôÅC@bæ!—Òù/¬Ã.*Rºz³lk…ÐÏÅn´¿H«ÂäŸò‘ùfÉÅ—Œ¼ºÉ®Òíw/bµÉ4VÏœLF=ò½iÎDªÏ$!§ ’oRsü•Ú{*k%êO°ªG‚³zѧ)F¬ä=ÜgVLÒ¡jâñ’¥Ú‘Zï‰t»«¢èŒ*ÆÈã>áqB°ù¾öçç­JÖ@ôQ³yÔû•Ÿ~#§`2 *г;Dë¾s2±µ×ÿ n½Óv þ*;ÞÒ(‡Ò+j,óNmÛ%ùÞÞÒ¶­™óVÓ‹4‰ZÏXM¤tWv|º£›Ü 3Æœé1ë Ú0Ú5@ÓBò†6ãßÌâRIš#·Ùû\þη•œ±Éè~ZËt ãc¶ê£ÊJ¬äµ¬;Ù»¬³×ržÐv¦é qq9çÂè[;ƒ¸¥KôfŒ¼±©ôƒ?™ßìKYWû4²šÔÌ&«$},Ìê?ÖR42–’·ÅO0ÀØæ¼C&‹$Þ¨Áw5QUùn [Ûhú›ªŽ•]ÛžËøím»d0{Î|øl{Ö– ïðô3B@<'~—$$»:0Pþæ|ã”È;àr‡BÜOQÆõ©Àõ1§ÆU‚ÿ‘t–‡•}KŠyuÌÔ`ÕôJ‡rßšììDú´qørÝ{Ÿý–*¬™gëpv¿Ñ©…¡Qër®të>ù|rŸÝס',üëd+÷g#O‚ììÕtd¶Ž•@È©ê¥2¯,äž—¸@áG„F¹o‹Ô_?×Z-0`èj1È¥ÙÞšn¥j|r%.c‚ŸÉ¹Ž d/¹È$iG·¥TÑúfÛœWdçÙ¡ц¥ú˜Î“ëtR ŽªiB»ôF…W÷jÒ­&~rŒ­0ˆkìM¼ÑQ†¦¾Øà ˜bø¼QÎ0ƒ4­‘Ü ü‰ã(#UCd4*ˆhd.‹Ó…{…ZíÅ7+æŠ7a>„ýÃGÒ² +&2¤åå3Õ•B«L°­µcÖÙ&Q+Ï +O!±iÏÊPsÝæþÖ9ço+çOëóÆD=ƒWÔ¬VêíBÁ#XºeV(5ìä"Ò%­¨´ºZÆÜKqK…³ëwÖ" P:¸T"½³œCµ¬RžvunHíùíè6çmFjFajÑžëvü/Ú')|‹¸éW '?Mé³U]ñæ¸\è¼å™UÇ5TQîó<²2²Q¬ŸNƒ­Ud%¶¿Äºâ™#ƒ”Òøi\ž“ P«>ÌX6ØÙ™}8àn|o¹Ixå:­®éoÀJ+¨/±).¹ø+A>°Qù3s¡h¨àS™vÈ/¶½OØ>=›$2íîo +4¶ÖZ*B½%Ôé<[ 3#†æsooÕ_ô¬êú…ñÇH dÙüñR$x%ŒÊ+ÕhtØf/ôü¼Wámt5Ÿ,DëbÀ%+´EÜe)äH/IÞfbΔ¶Õ!z]¢s½Ãä[¡Ô¬?÷æ.±ñ^HÀ¥æœ)$‚½Rž2ìþ)·\ËÝÂÍŸ‘öÆiq=»J¥a?Õg;À;¢Ø¨õ"ˆ4Ë"1xÐ]<…voBîÔÍ%KIôø­ÿ&Ý¥ñ‹qV-ˆ/ÉáX4¡”±H?ª×ãůdN®7„ö™t­ÙæR‰†Tö£½‡è&ÒÀ#ht©<„éí$¸àœQ7ºxác•ž±~ã½}TÖÏY&ªÇºü>k<—}CûÀ—-š•öá]Zž!Ü@h¦#B8‚³ +Ù³±óÒýÀTù‡†JBüºèi³‚Ù JQ7òéà!7·—ÖÕeÃHñ‚ácëW•ŠÐÜvÔÄ ;.d»ÏëÒý>ô»Íg­_Ð>“É÷Þ¶‰eDô2[ÍáSÚB£ÁIq?ƒð·ŒàùÞáðÎ`KQɱvÜ5ööV&bÀ¦© ÿrˆU Il"Ÿø»Z–‡x¢Hbp­Óæ ÝVp“Â?6çþMi³@üœ³fy4ÅË©T è a=A•^‰u›)°£çþQ„G®l÷d\CÈÊ˼Æ(¢Ú: Š˜¯Õ'ÑÈ¢UQ©-à)ƒ]öG…Ø´wóÍíï¯-ãm€-‹0¯†¢†U“螨t˜©®>q Lü`L À1ϪxÏrüí¨ +¹) +½„Ä<€¸¢Q”ý½Ÿ²2Æ$ÈýcDÓNæ&"ã…°½Å¬tgª å‚\K9£GÁFú„6gÐèãý‰˜µ‡‰ŸürAPÚ@g&›¿1ó5{±ÿ*÷hÚ ïîó Þú¢fR>Òe$ÕïC®wIËKÜ ô²ŸÎÔÝW©ªWšÓb9êNS»ÑÏÍ«îO)õ‡q¢Ôù ³Éå6…<3Åêuß­ù7M`æ% œ ¬N‚¤¿1©}Rµ«vÜÑËêוÉ5qê‘$DëªÉ/\û ·©§¯(åºA +ðóÕU‡;ìÜÝòÔ gÊq†\öPOÜûÖ}êNJ†vKÒ¬yhhþ¸DÊ>×”B„(.ƒªü×N5–~b(7„1›Nmõ@D–æ +À'³‹ÐÈzÕ(tÊrI¡~÷¹é&;ßèþÌزº'<8Ö4¬NC>´Õªê|¡•”dö¨ 9ÊÑaúKÝu‡—d1ÇGÀ€ i`šbžCí­$¼Cу#di 3[ S"6ê¿Ú)×K]ÒÌòçF ZÊ¢8âôTs‚iäȯ¢Š±(Ê uc;Š›g£ÐV›·û²Ÿ™ Š‚÷T~öúŸPæz{z{|ô”w7έ.”žogf7Z›wÀ†ª4øÚñÅôõ¹¨XRéüþìb9Õ"Ï9Ddß½Sõc›¦_S(fy.¹È <é>‰˜‚%óÕÓ’ªKŠÍÀ×Õe—W“QÙiûmîËÍ'Žm3‡OÙߤ†.ß²ˆ¤îž}ï ;Úߟ +Ê¡(ÒzŽ–®©~•›•¥&Ü.a[—Wîi¶6ödòµú ½í8-¥ÿòX¨Rmdƒ¶Õ±ã y´W+÷yPÒÒI…¤uͳwcû†¬‹#ŸÔEk× ’N‡]¥äk§&<Ÿ·O(FÆ}_1éºÙtI-Û‰l%ºÓÌ0D®LŒÉœ-â½Ð +ái¸DBÅÚhzäiТ6K°m†Ão.”¤piif]›+%RÉÏûiËF#ðˆ{ï®Vè]Œ¥ùû„˜u’¸ ‰äMÝcø஌'lñ'Ɖ5«¿fëŒë¹ƒ×QT„D<¡·lÍpÝ*ÈoÄä¿á@wG5µ¾™œ)5€&kÞ»¤œõ5x€¨²qIØy°,¸ ¦ýPT/A¾GœÁóõyŠ‹I‘´`†CŒ× ¥@k{h²¥÷ô(«x¹~v@âçJxøF“POûVg‹U×ë`_±ú°½:¦`€¯æÀzÒ€ËÒÓªñàwôz#™VñåʸMÓÞŠû]"DÛÐqçVkà +ôÎÆìÁOV +´ÖˆBQÕH ´D=(Œ¦aÑö3†µ'{Ò×#ÅŽ°ÇÅ‚v[Å|9œ_é¸Aªw3êïǹUQu1ŽšM:Ć @\eó‹ëŸ%~ÞCÄòèä·ÍÛǽ…ŸÄ¥÷qç[{éS|)3ç3c>H§åÉ\ŸL ‰‚œ?ilÄÌžõ%ç°ô(:©”‘ú®Z³Ëˆ?èq qFT¿Ê+aømn©î½ˆ@L"lV³ëmׄApM’@}À¾r”^z¹?&?ÕPG<¤¯KK¢FëùšèÇÐו(êD<â±î½ï·+BÝrêmŠb_¢8˜úÓzò†w|oßÆt¾KÀÿ:Ï_—^ûiª‡ Iu˜B0©EÅø©ksÊø½ánà1ñT7u$"ìÑÉ>;?¤«[?Ú¼ÊÛbl y®›Ï¯išÓï£u¶ës˜‡hõ*Šüz¿4%–\ûÛ|€¶∮Σ›];DÁQwE|âçÁ#Ç”¶ð?œª¿TŸÎa“ªóU?P«lºÑÔx¾NOF·³ÿ0Ê÷¹Kz®Û¦6±Iì>ªÏY;t«g#gï•|‘û9ƒN2>¬r‘g“Pæš)+0ü˜TÖüÜeÆ\a]§ùtâ8Ë%Œ&÷´‚§÷ Ò;ïGi¢’c•2\™™>‹ô>ÛYÍìù¦åEö@Ýõ‰ÓM4\r3Ý3ÎÆÕïˆÊ*¾ÌÄ;!j‹¿,1biFèô{hOW(wki¥./ïlr? a¥%ë|–³ú­ÛÙ6“mÖÐu‘;%rj¨yïn+^Ía1<©põÍ)ù!°b¯cŒ’ÂQ‚é7á{ Ãø…´-²¦rE¼j¿!Ñòý̓³o"’ÏöàZ¿ç ÍžCоÍøø¡BqR='ÿëôRš:ó¾hTÕT±}úa{¥•ËôöqG&.”–-|ñêù9ö2B¥œO“Ü•|¨È™‹~ +òÞQ¤û8D×â/¤Ÿ)ê!Êïo¼±­´â§ 8MFß8Þî®Þ­x«ˆäsEBóÅcPcÆ/ˆ‘Wm«â|*qDÙ®ö6Œå1îK,É”-Ÿ½Düá¹­Jø… _× ÒwGsÊ»dÜ;7®jñ>oŽt·Ö.‚߶Ëu˹¢å]O€¾K˜Fal9:\dÈ!Ç> endobj -4045 0 obj << +4157 0 obj << /Ascent 694 /CapHeight 686 /Descent -194 -/FontName /XLGPLI+CMBX10 +/FontName /LTDLVR+CMBX10 /ItalicAngle 0 /StemV 114 /XHeight 444 /FontBBox [-301 -250 1164 946] /Flags 4 -/CharSet (/fi/exclam/quotedblright/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/H/I/K/L/M/N/O/P/R/S/T/U/V/W/X/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/endash/emdash) -/FontFile 4046 0 R +/CharSet (/fi/quotedblright/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/R/S/T/U/V/W/X/bracketleft/quotedblleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash) +/FontFile 4158 0 R >> endobj -7221 0 obj -[639 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 350 603 0 575 958 0 319 447 447 575 894 319 383 319 575 575 575 575 575 575 575 575 575 575 575 319 319 0 894 0 543 0 869 818 831 882 756 724 0 900 436 0 901 692 1092 900 864 786 0 863 639 800 885 869 1189 869 0 0 319 0 319 0 0 319 559 639 511 639 527 351 575 639 319 351 607 319 958 639 575 639 607 474 454 447 639 607 831 607 607 0 575 1150 ] +7556 0 obj +[639 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 603 0 575 958 894 319 447 447 575 894 319 383 319 575 575 575 575 575 575 575 575 575 575 575 319 319 0 894 0 543 0 869 818 831 882 756 724 904 900 436 594 901 692 1092 900 864 786 0 863 639 800 885 869 1189 869 0 0 319 603 319 0 0 319 559 639 511 639 527 351 575 639 319 351 607 319 958 639 575 639 607 474 454 447 639 607 831 607 607 511 575 ] endobj -7222 0 obj << -/Type /Encoding -/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/sterling/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] ->> endobj -3359 0 obj << -/Length1 2084 -/Length2 17900 +3454 0 obj << +/Length1 2065 +/Length2 17689 /Length3 532 -/Length 19094 -/Filter /FlateDecode ->> -stream -xÚ¬µc|]ݺ¸ÛIc¬°íƶF+¶m6ilÛ¶ÑÆil£±ÑXïzö9g·{ÿ¿¾¿µ>ÌëcŽû÷À¤$UT¡2±3ŠÛÙ:Ó330óDäT¥˜™Ì LL””"Ž@Cg ;[QCg €™›› 4=€þ<ì<Ì”;{G 3sgÀ'ê:q„l€ŽƆ¶9Cgs  h cCk€Š±ÐÙƒ dm Pþç '€2Ð èè -4a@`f˜X;Œ€f¶Œÿ8IÙšÚ8ÿ'lâbÿM®@G'àÓ¿4© I;[k€ ÐQÞ” rùÿCë¿w±¶–7´ùgøUêÿi7´±°öøßv6ö.Î@G€œ ÐÑö¿»jÿGNhbábóß­RΆÖÆB¶fÖ@=3ÛÿÄ-œÄ-Ü&ŠÎÆæSCk'à¿â@[“ÿ6Õï_ŒZ*2’â’´ÿ»´ÿjT4´°uVõ°˜þôþ3ÿaP‘-Ü:L *3ƒ:‚~ÿ÷¤÷_ÉÄlíL,lÍ,ìCGGCÐ&;À‹`aktÝAÆŒ ¶vΠW ÊøLíþYWÐÒ3šþ+ö?ÈB‹?ÈöOëfe0‚³6´ùuqp±sšYÿÏšÿ»…Àht4Úþã0Ú€¢N† ²ý;Êý¿cüçlL  ¶Ö@Ó¿¢Ìÿý¯Î sC§†p²úÉÛÙØþ‰°Í=ìͶBÿò´°û#ÄRw²6t2ÿ‰{íþ@Îv¶À3;HÖÙíO;;HÓÙÜøWjkçâø'ÀúO±]ÿêÒu­û¿düY²ƒÄl-þNËõÏ ­íþL‡$æ´±øÏ(Hèà:sÿŽ°þSt Ó?—ÌŸ ¨ÿÙSÍÖtΤDAW ׿¢Æ.Ž +Ìù_ßWÐäÿØÔôÑÝÆË vƼÁ–)Í¡e¾bSåÐÔN„i%Á?»CÓxN6x1æ[&UÄ×è!è–hÉg2UŒ&¦ì[xÍBÞC^*Œ!KèCÈXÔyé*°Æ'ºúÃ9ƒßQm²"–Iví[h/VÈo7]»¡kd˜9óñξB•-.¼ÞøZùo-#¦šï%#èåtÈ&Õ7cÇžN%ì -ì–‹†qtÓo1ß–ñ¾¯ÏX­!§qGæÈAΧñ½À3Q»›n#0gX‘,kfsK¾×6 ’2Œ¸.(¦-É#s–”8ü@#²œ±„ÆäŒ!=åÍ>Ý©PmtcÐ œš«úÍؘPUÐ#M°sºʬ×ù:† y8{Èôqœç)qδôpÅÁdR­åiŽ-ÐùÛ\Þ˜€à‰¾m vîÒÓã¥Î%ömÓOLØäsÕ$aÆvµî£žå,(q¹TÏþÎïpO¡ˆè j^œ2ßø~á¨-×\eK!E‹´êãœú•¶a…aSÌ(pþÈxL¡wÞ?•vôìEÌ”æ™]!$ë²0ôEX¹U%»¦Õ——{|™+2my6%‚f“C^@ðär{8u³¸¡!ðëëulßqKœ;BcÿDƒÁn«¹\±„ÐÏF£´«YB¯ü[•°ÃD¹!{^ŽÕ/>:sº‚ª*èÍ0¤ˆžoÂ… Í«×!ï-IÚt=B©z„…øK‡¾g<Õ?=zä%u#9TÌÛ¾²Výä•B®·¨cNm[Ï–ÙŸ™HyR±¶ÇÁÏä&/ᬓÁ«ºIêH .êgÚàVDÓü‚>¡<=­Ò&ÉùÏz½$]¹¥f{+„zÝoÎtvÔI,ªOª+Õû(sna>x3ÑéM®µÇp¯`ˆ‹¼Ÿ5îU;aOFz\|hYIJҸ [úk—£„iл'îíä_PFÏ#ù­ÏT~™}sb5¦¿4¯¾|óyÖàæ])ä..ü‘ü`ÀRæ¼MáåsÈË»ks’ú®o]œÄüQ„&ÙWaŽpÝ`a:]óIÍö†)νÉ»Äxr¤ûô£…h×1¥FÄ…<.†é¼ò¡)=úQæí¨ø~3#n7xò/;T‹þWa«‹ I×&^08!Á{Òª*¾”œDe'³ºsÙ„oú@ácëýF“RhFˆÒÍé2ËL-ίYPƒ ~pAéPÔJÄn‰ùãÙnžw4®Ž˜œ‹’˜ä²˜+ýcµR_¹aœxâ“­Ñw Š”ÅÕËŠ¿ÀL{À³ûäôæ/ýVŒß5dÞ2ˆ¿àÖž¾7™bêÒ¬.ˆž´s3¤‰†·ÀÜjíUGcznQü6ÑßÁr§j¿Ò@±ÂoGó£p[ÅÊõhÌÇâS·aD]My—/Èã8f7Qz=ÂÍû"Ū=³"ûÈ-¹:bÊKM"EbB/ÈZ~}i’g¾Æ,Dül#--uÍæ’®£zlŽvB&Vγ[u—Ø{&6å_ ,HͶ=*Íô‚¡€öú 0bwrå)½èûõ¦¿§ìL^G$7´o±×QÍ2 -Lfç r Bè}Âç{[åÇ0#xev–š›éGUŠK†Û«#˜ˆ?¥1¶û|“ò‘ägýLZU´JL J*]ÞÖÛA1í1¾bŦ)JŒÝaÎfÛ\U}¿ûŒ€¹öË¢øûWœ)…ï5a^ϸ>_Jxálʼà]`Ö,šY|ïŸr6åÍ~(Õ_¶¢¯6 ^3bü°:¸œÝ‘<Ä O›úØ…åjjF´[«ˆçÈy PSîQ¹ïQÕ ¿|8Zò~¾é}&ƒC¸x5Þlµ€%KA²îýJ+Ÿx>ó)UVË Ÿ9WÕÈ-©Oùb9ûØëÛ$š•¢†ç^_3z3KXïà,E¢¼c2W82t–ñÖ•­¶u‚$ౌZrÀÉ“x|RŽƒ -Ñ#v¸†4Ï6 ¯^;Ž–Õbב[SßóúýpÒªœÛmõí«ÕŒüÒå?¼cù@_‚.qß¼…,ú•¶P?I -¤azÜ6«B…¿C]£]†è/Þ¨´žÅ!úYu¬0u‡{ȇ#"ú¾„v/C¬í½WuLqìh3vmó\­\$Ôñ2`ÛµtÙ„¦Åê*•îs ÑÿŠn_Þj,§~J”×\Ob#{ðKK<ðÁÎ ¶_g´Ø9ùùý,%(šîÖ‡cÏJ²ò ¬ôR6¨kit£ 7@ŸÅ|ÅnÚ å„™úíª8­¼>}ŸÃsÀh…Ìšé•Rª®623ÃC‹;Cü\b§´|ò©÷kå;Ô2Cúæß·/:êNzÙ÷E$oã_ƒÑîer ´ô…>øö„Æo¨pïRx!¼au,€õõþ›ˆÿB ÎB&×®ªŽ/D?–5€ýq×ÏAdzI®¯f·^²Òßó-›áit–Ö2‰ëT®tïxüD±|¿ž¦…—…û!…¿ÒŽÜIówíóÉ¥A¬Ú˘yØ`L«b„¯ïòè/‹S4ðVèRãÚÜOšLZ¾øO¶ Mõ?Á¢·p•«Ý;,w · ‹U\„¹ÙQ¯r›á!1Þ²I¬ÌÀiźûõMÎ1Œ¦O‘ÃIÁm‰J“¤Ölq!Vn"ò›¿T {F5[Õ: #dt•Üt~*ÿ‰ •;öجóÉâ-Õ©Æü.bl)«¢»x.ÌcHaŽžÆÓ'b¶ÛUÑ=6zbáÓ9ºSJ¿Ð/ÚD/«A½EÑ4¤šÈ•Ð׋߳¶i=z (¾Ûæ&ËÖ”?ûèbþmÖñ|tÐvR¦ïÇ¢èû‡Uù>Ei¯ðS]1ÙôÚ–¯z¬9yã5€x–ò(š÷t­Ž€¶6_NiX¡*ñžDðG›©0_0… 0/ß*ôGuÌŽ¬ot:šAýìœëêëBym!Ìsè/©¸ƒ²ó%âg} Ó²;2Á‡=˜y9ÔØl}¬Iü­à 7áf¶R]qªu H±¥îø»È§“m´á¶eŒ“jˆÀE& Yj||=ŒO3i;«g3õðJ¸z$­§­$`M씆º† ”U¡ñ3‚ÇG8m¦ø­ ?B0~+Pøé,©E@| d¨@•ahíÃW€¢rþ»0#ƒ °$‹vÿb˜¶~0H˜/#ï4›¾¥~ü^Hä¾T¼•ÿ›¨+›‹wÕ6èíäÊŠáB¥ù„ŸþçÄBó@G líÇú½At‚¶ÜÞ5¸ áQ6/{|¼·óÕg!4q¸D—cáz(© 9Þö/òþ©ZË£„¬;« 0­–fnÖm1ßkOñ2ËÓ„HxÍ䡹•xÛ|Úø±—1Ä$Õ»¬ÓÄ|Ò«Å ¨pÒѼ¨i°çŠ6l¥~%y¶ØøBˆÕÞô<+EÈÚ,’E^¤‹ê½+7¤>‰ôy‹ÜÌI*w~a¯Þ…AøÆŠÃÅô•dµJ6Xù çàðt¦Y]Ï2“äuwr?fcÛ¨sïb¶`z9æ¢ì&4ÀŒïäJG¯ôäF)~¨?—ÿ·uøTth`Ï$F§#/êˆg˸ë-N -aÚôûlA#BóøŒßÀVZ“è¹°ìáÚX“«¶y¹”…I +$»ßA0GÚCƒÙd VojÇXŸÐu’ó0÷ª -;¸]áF²™îûw¾ÄpÉÃuˆ{F³¬×.ÅÑÀ5ÖÇQbm»ªèðoÌ©+îCµÎÇR=$’¹Šèú%Oyü=ŒKÈ0I,1ÂË_¤%Æa*ñBùn>tõ7÷÷½!ÍS(&^S~¸¾ŒcëÓØt~wì°ô«ã#)‘ ;}혡,?çiþ5s`2Òih:Ùëq9¥µ?âRˆ€^eЃDîo¬á Ú¢o‡2ªqF ÞYìÊœð“!ö6½ãŠàêgÆn“ª}1,çàÀÓÛ8=,’Òbãææs;v—ÜÈ>,-s¸ §"²¯Ì1 ÔÏ'V -óWoz'ªç {ØÚòQÕœ7_)ÀgCû8뉡¨Ý=Þ±ëè¡Û`ç£Þeqô7yÍ·ÜnݸRJØL† ].£›Në>¯Í,”¢'µüÌU´÷ÕPcü_}cÊŠèü˜]ƒmÖ‘QxËä˜SçÈ,š_9+í!}ã ¸â–Ë‚”{»}Wûêþ™oÓY4e¹Ö£ ™ÕÂ=üzL”hjýÉÚ<.âçÞVLçµã䜼áçTˆÖû“þÐkëÖµ™÷+?¬ -÷ZëúAúO}^ª2¥Q÷Df2¦hŒB†<7b§¡´TrR|ŒêË=˜ná¨]/wƒI€ßÙ'‡èJfê v„¤v£'òWùäŽ?nxJò5Wüd¼sÉ[+£ÂVZ„D²(]ò®?ÐróH9¬[ÒÂh-} ­^…|V˜ðQTâþj¸ýh>IùÆŒ\[S¡©8d™ÅÅ‚éèÊÈs¨[<W†Ÿiÿ·€ØrŒWGµÒé‘ÜA#ô]áš':÷<¼Ý°üÃD|MC»Äï4Îå^æ´“Öߨ— ‘çüTKøplÆaë»ûÜ¿µÖ¨³ Y?ý3ÂHlèC¯£àOoÒ=†¯bWMŃÃþÌÉ6ï次a€káä@ 0§Ã„g²P@Øgÿ[Çr¬#R'x¡éu²¼ñ¢‘Ìónž¦“cè+Ç䬼æbF®™:å%Áüѵ2š]’¸$NÊN]#¸MÙM©n,ªë¦ßE£Í<ºÏ–´õ^^lw­²º@†aü |ÖÖ ™ç7³´(Òi¹Ñ½¸^ÙÝà‰(4 IË[s³çò׎ëŽð«5»ÈÖŒ³¶ÃMƇ–Ñb=gjÃ[ï/û»ÃØò#U£çÌqaFJ‡)(ŸÁ‡ß3~FñÑËÐÕží“ÙR[2_þÞV餉‘6M™UÆñ)ÐÆu0ˆF*|ŽjÏûÈ6¤ißýv¤yïgÆi÷o¤áú‚%|¢Es¦fˆéþn Öý0j¤‚Hu¼«W×賆Åêåᶣ˜;Ú`V–›l Ù›ÄYôY䣠6ÿ]ÙOóŸÌ1^ÅÉPÅ\õ‰ÌéL |žõ™mêò|%ö:BSfFb2y€1{h°|4‰ço|6®BlÖçröŸtãgÔt¢Zøȼâ8—ža‘yH<ðÄü\<ß#J{nXŸ[²Ì&Ç*bÖXÞ¶ø×BßT¨ùè°wBFÆ÷0€ÏÚêV5$`‰½ïTǯsDvÕµÓ7Üî+J1œñÃø›'‡É²Óûè:¾Ï!@œãÐ;ÚÈÊŠ-r‹ws@ÆÊÝ&ÒÅƥȘð]ï[cŒÔ=I6> Ù\eÑé ²©®Å‘èFK„w&¸Ï1¾ÔgïlŸ¹f}X;•äÕ(Çq¯#¤üDráV¥uÛ(ÿáYWkÀ¦Ö"nHÌåÂ’ù̢ͷt<1yÌÙ˜!Þš’ynZ¯íF¼Y›¯È¤7 ›bÈÕÏh>8$½–[u 6×k‘C‘ð÷ô橯D b ?•‚Ô$™«Æ§ -{'Ù¾œIšK ÉŽ]qR°¾l'¾ÞæÅžèý’ä}¢ðÖs½b†}®—€åV‚9ö¹ú˜»™}MLr{žõXˆ“Èw¬˜—7[¡Ë¥¥-©íòNýôºôâÕÕ`à±u_Ý>ð‘‰WÄJÝþšµóÐ¥øîÛËe¨÷ªçÑâ È:ö”#?ÇšóË%^Ëá.µBn…ȧ4‘£ÄFÔב?œ¿ Ž1¢;Á `ȱ£'ñ8ßœ5²çÏíôëŠÊ…#PCÿŒð+j1AC–h'‹XÅŽ χ‘2Œr:ûX2YŒiDeÀkW}3/w™ªÿ%Nü{¾¶h÷2+Ä_ɼÕÅ8qq‚HßIR»ÚVLmŽ ó¶cÇø˜èÀ‡{ÃÓ ÍÔ&ƒ5éúÓ¨/_Ýk¢ÂÊf}U/±œï´¥âÓï(sS4S“K’û;Â’0>+;i0p¯=‹6[òëŸ3±É^&Áëhþ” 5;ñ;T)ƒð<íÍ\Ýf«üT†Ý÷¨ß ©´šPœú¥{ug6·‚NO^Ó2ï a¾mh~ßÉyü´ú^Oçl(\ìøɧ¢ †H×å -×ìÉûãŒB‡Í,óÓ׸8$;Qz†):¢–M*mb¸ý‡Ž?¸(§œŸ‚Uà -=ÌÕÈs]2ˆQ"ØéHá$„.Sæ"þƇLõBRÚdq½ÕM«ÕJkõF€5Ÿû¾ýڧΓ„·ÛøP7ayÜ¿Éqq„ùLp6ßy@þãAâÕzP³„…x}ïÎäj'Î^ßb›Ó…­žß]”Ø(Ä7„„ ÐQh -{@†J©»—áûdV÷ò§ìò»ðð‘KúÝ×;0»‹Ôíwcg¤ð4ö,PÛ^á~=š9TåÐ_”4›y]ñ6° -R= •JWc|èàpÛ(káaÕn°Bœ¦Í½‚Kù²Éø«äaH¢–ñ;W E2 -Zü¶ßËjt%qü­ÏPM„É'¾9ôÒ ?´é’˜½åp¼ŽÁºÑÝ¥$måñ|L–ŒdÖ¹«gm:IÎé(Ålã8ÆQ\S˯ÌÃ&¤ã®½,Îë©m»édÁ)àyïd}Y=8½ñܱ•Bè8@íα–ƒ{ô¶72`Þ;ë@m%zû]°Q68 ‰h\VØþ11UñvCÖ­*U NÊ©E‚"¬§ç‰+¹’=I™¼QÒ.‡pì“á¬y¿Q(7”¸UôÀx\Qñ*8ÿGËù… æba“ß 4â«þß±èO#3°Ð…xÌ^Éñ[±$#&n•#3ªihŒ)† -= ­rC„B窷ÈôÀþö øè]\¶Ž±mEè¨Ë§Ö…ífd€Ûõü)«Òÿå=>´ìç)ôloÙ¥’YU{'‘ ˜]eev­ Õ§ Í v¥0”ØÒxäTqŽÜØðÆþ˲I×]îð -cQµ¸ïÑ®~OKXª6«Õ+µ×pF¢QÇ}€C†…Æ £ŒK¿gk k6û÷læl÷²žp'? -³gÐFßï±ÔÄ°ñ¬}MÝ+ÁëY§nWŸÌ,Ä“øNºÉÖµA€#Ú±š°[š1þð^Äþ1ø¢ÓX¿ç,.:ÇûX¸Pñò(Û+æòD¯LNKûé>26Béªdñ«†„Oø1Y£Ñ:Ü©Ñzfañ¨ÒñJô¡ž›Ú²âW£ ïÒ‘TÜ'Ý•+xzU`µ"3uèÌ[¸ŸðÃug†4ƒ)Ü,U..X¬aR^ á®Ë/ -c¤ôƒ ‡ž;ùR ß·1Õcae ì°uÈ[¦ù4e9óÏNÓPûFä5‘|ÙÛö!{}$!#⻓Ú"ëŠÅ¿/¾ãq‡ä³ý¹§¡'…¢ˆyò;*R£§C¹#\Æ;MM#8ŸãÝÕ~Z«À=ó»4eBçR¸ˆï(ˆXÆÚìÀÁD¶=Ga{‡½Ž×o~G6°aÞRïysÉèûñejÓ -¶BÁŸ~å+ìªiè§ w€5 ¥®iÒké䥨!VíJȆ惡Edûê¾üñ‚gÖ±»„¿s6+MGtáJÒ$õswî–×°ÜÕ¢x‚ȹÖ:MÍ냞ïhù8Åú-–Û·ËHé‘&\¥½1é÷ó¡¤>1˜ÅÙxÃ1·ÃÇ'³pK–º«ÞÓ¼‘ê«þÉ(u¦Ùò<ù»$»FMÝîÆ-ìpW’½G!ÊñßÎò8Í儈–¾¤UìUæÕÆ•³x¦§_³ñú™çvºÁÆ‘óeK.”ç̲Ö×eb/¨tëlrBáýÅ»G3‘(€D£Ýó+ëÊP>‚ÒÄyb¦³ËÜ‚[2›²¢¤áæFta/G¼+¨xºJNTÔL¬ôoËü'áXð#ùÃÔ­O¯œ7±eR—Ë¡b’ÅÄoÀÖÁ„ù‰ŽÎ:+Î]3úõÌa­Ñ’¸_î÷qws¤Ë*0c핸&§ƒ}K xëÆ[ƒû?qæÆ_hL|¢Kr ãÒàf^Úvègõ/Ô†Ó| ¬Ÿñ0ŽýÅ ÓoOà5|}3ðôÙtÏȶƒË`+ú}Ïýµz½ïs,4t{˜‘¼;*¶±aQ,Q†|4úõPi›°©2uâÁ'~.657Zö‰w×”6ôæñ¸èÌó£ôƒIaéç?”þÀ!cŒ'´Ê€6b»U™L›âçøf`]Œò -OÚ‹çñšïJa‚(I0td‹%D'ÿ÷FUí„`¢§á'qŽò!D6¤qO¼˜åÐÑt­èäïñ倖õÎ…0Ó¬ˆ@•§§^ÿùæ`¿H•µl÷/ìLÂùAP·S&Õ J=}¿–ÑFï•Rú!P4À0˹ÅÅCÉilô -ªs‹(ÜeÞE3çÞkŠ<Mç«v‚ôÄÊ+y5¶Ÿ( OµC8;LžSÄò$œ>&ÐWŒØÓB -–5Œ]rF·Œà„Og/œef~ieå£u¡‹£SF̨[ÂákŽ±‡Õ dÚ„–'ȧ)³ÿ±S’89®nŠ ®\êbV˜“—n‹–Ô}'ØÖ¾ÑoÁ{jB> ÓßÇÁÂOs©U¿ò{´¤t‚’Eóȸ•¨ -lÍõëüBE¨Y‹g¸r 3‰Ñ ŒCñØQ'”áÝš?dg þÊÊìüŽoÃe) ^$!ÉVS^š81Ù§0.[ÎsÅs¡EçõJÇŠï;NÁ”òWÚÇï}÷G‹DÆj`ô*˜à­gîŒÁZÆ€P‘åï¶~bKIxî\ öÞ¦ÁDUfÛ”äz~]&킆Ó: ÆÔů¹ÏDro_,¯õü•Ûý6ý-\ËiNÓ}¦Gû§‚:8ÏÊ£Z†¯ñPh¨ÎíRÞúÁ€D/w¥÷ï_BüuRp–háZµ9ÍÃùÊôKaAF¯…·[][àûʨӒڹQiG°w<§ŽFH‚¸lrW¬žÛhmºŽJB_aR-H2Dy©óªO‚f—"¥³ -»¡l[Íð¤e4ãÑe¾kÒ¾ë! {âÆËË°EJ¿~~êÕ k´W }5@ýö°ZÖbý ]úÓù;x‹|GÁpãmio,BI· ™¬´¯­M¸W¸U~¶€Ïù–›ÑY“E +Ž[þçìuözì®l%öWiÙxým÷uONµ*U} éØ-š_E2wÄþúXA¾Ñ°VÒvŒ-Éevš.ÔóD%V~xs»D_9ôºáØÔ:œû“š¿¥'û¹ÍíÀ7ÝÙí3±ãÂtâšœ¥–C™cyLÇŸn`8˜ 'o òÊcûœ%)ZãËô¹ öÑ¥hýÑu(ôUÒ4y©’Ù"bÓx«k8¶ƒ‘æË{×ZLƒêŸÛœ‚« -YõIS-]ýj^xã³a£P_ExÔB͵¹˜x/[¤@Ò7 áj¨ï•ñëãT ¶Êpú×Ác,KBèk:‘ðŠÆ$Fú̲ÖEØp´~„WÛ^FB $Žçê0³ ;çÒ¸€“t&¶|çIzÜ×^= -¹PTª„(D8a 9˜2u×ɹ»<‡H¨ —¹¸e`Eï4K¿ÓËa9íà ¯—‘Òô&DS|VÇþ"HÔV?” N)_jAÆwEKÊeØ°:Ç ÜT1^ºw£ÐLUuºM›ôš=¸ñp¾î/HŒfa|ív-tD‡S¤‘#´øs™ùx­]pÐoª³¢ÑŽ]äó­áo³H{I²¨Ž—øêÊaÞgÔÐÆb‚Äl^ fÆås 3’#÷«Ÿ>À54¿„v<–³wèzôfÝÃèh­ü$·ä6µ Ñ,§/kƘÓÛÛrËJ8Ô0úKSÕú‰™3<;#ó;¾—†—"õÅö¹jÖì'$m“™0a^ »Î/„;¯ ªà¸>>Ð|Û'ÉZ£¬ªŒ 4¢õù’“Rÿ[$ø=@ó,k 7¬%jÇíT§¹ƒøνZCê!ý Îôn”vµ2H œ£ÂÁ*Ę‚šr»ýâŒQ <È^U£? ètsßÚS‡SÑÝ©8¦ŒcS(f¿€ -…/"Íà ¨ÈŠ ær€%¥ÿ¨DÂ/Ýã¡L›Ö’³"3å——`Ϫ­)Ðw#ÿù¬-")²qK™¬7Ý~àÔB[³Aê¹o[+¼Õ²j­Â žH&>kóG_¦ùövn&˜«öyúõQxcÚåÑSO¾ú*‘0wo”4áÌÇÛfº¹¯"]‘ÉõšªwQd6ŠØ=¡Ž}R;1}Í°cbˆ½c{ ‘~sÇ­(+ ú ½¼é䊭id­SEÀ‹X]Ü· FszRš¼ÂúãÐC[m» »À¹YKŸ*§HÀ”|QÖDDŽLð§Ì»¡Ž´VWué~7I~H‹:˜í€ËJSÜ5"\#Úa×— ö¼E‚ -J7¸ïj›DZâ{P¢½ÒÁÓÐPHŒxˆßÝÞáZýc?& 7i6 °ÿD¶"èœ -¸Óäu¼ƒ¾î‰³“i~Žú¸t×ÏV‘ý(­Àöz{¦q\!êUûümŠyXXY\<Úíhmü¢kÈ“¿žò§›é<"An;V`Q=[z‚+ù¤ÿ§üw{uÛap1´ R` —Â/òRcKÚvF\4túž‡áÇér­Á5ÛƒnîXªVbà·ê¥…Ïv@ö–ÂÌí4¸k@->/ CQeLKéz÷CØÚ”›2þ‘BѦÄäÏX4!9Ÿ!£è”ͳ&¦×á-@‰ÜYÅ)wrÖpÚg†ÓÕV„}ÑKŒ1òpcÀ×;WúFͲÑ’â²t/‘Ÿê^ÀÇ(=¶?8¨³lg{ÂÌ»Zþº¡ÅëPÏÆ|}žp G+!zý–^ÕëDñ1}ìKœPlìNOøç.9ßfßBYi…¦G7xé/—GˆpµDç/Ò›áOF“!ÔåeßO¼ª9|N‹7ºœ ÑCªJÙDTõt‹çºT¯i¶X˜.(j”]üö8?Þ¹2nÛywÇä#²g#®ªÇkÞM Q°ö8€@ÃN­{­E˜w†¾ú½~ØÌž‡bÝí‘9þyùʡ 5nèUâÞxœÉ×´Ì eê­— Ø Buþýtη8HŽ<6Ê-QS>C_·$Hð¤":@åg‘iË‘$wªGºÕÊ(^­ÐH\gìٷݘ ¯´Jf~tq%x9yƒãm¨å©|¡üb:Ɔ˜ñÜòTBØÀ$\|“½¤žw:ç’？ò+_˜0õ²pRñá4³g¬³»!œN £$û^ž^ã)^UçjáX;y©6[0ç_Ûä,;v›GÊ…}ÐYTu'v›¾·µ+œŽ‰¢LC!ƒ?ÿ(ƒoê#ŽâÃ,Ê^8†£a°?cG}±›C¢Dq…v>ÿ ô´µT,*髆0ž-?X<˜`‰j#j¼{|xã!ƒÙWÁqik£×¦l¤9Sò=Q÷ -~)êyUCI?%>ϿJü²É‘\‘’°QÄõy'ðõ*éC5ý§ÌS»5†§²É± —kåKñé~¼„k }SøÊMgòÂo4Z»¤*1Æ™U«;h¼iÚc¡œû4?­‰(¹"áóhôï|½èŲY!ŸÙ³Qæ!/ÓF>«èò·Ý ?¯[ ð ð²Ì¯YJðôQî7瑯N2{§¯ ½yôý ùíÃö¸^ØÂìîYÂk•Îg)Q¹ï•§ Émh\ŠþmËfLzr5°…Œ"·³º’ õ]¥zYѣƄØó¸!ÉîH…X]?ØZ¼j&üT„ôT°smL‚E7‹S¼¢9ÖqnÂ"ؼiù_÷mx9·J”¨¢±/·‘œÀnñ£`ÜŽs¬w½о#b¸D!i(݉·få‘GæØ -Nj}‹àšïß°DÆ¡ŒÓ™¹ d-ôЋTóSçà6&ÉóÿEZº´rˆÑ°×Û£m˺ÈåP1ø ->!Ž•«7²°+„q0­U¸ÜkßL -ÎæJÿm’i…L_çÇÇ\û¨­HqÌò+*½û°IÛ²¶ß¸Úa&ƒrÊ^wÎj!>x*Öf’˜×ËõdàdwòáL¼Å7•Œv°$Ñž.…|tUÕ[ǯW8Τ¢®`NðúEÍýBìÝøo1Æ<÷üßhÓ&ÚEÊ+V¸Ÿ)Ã/ñöÕÞ3z‘ÍζOq²ÔÖŸ]ê) bg*>b{`ñ4Tëyyêºãx|öi´Y}w”N?ù c{ŽBWØ -|Vþ.ÎUÇÈQ 5qývwJ6ÀÂDͤÒýݘ†‹¦)Sb%hh·N«ê“rÓ:XYqc§¦¯ U÷–™ðtmh(É+Še}_Çiƒž 7¿ºN}úÕt‰‘Ò¾OR"혲âçƒ -(‰æ'ÞÅc"}-äÈȧϲÓ×™¡qVº²J„?fÎôä”#ñ™Ý´Ç[X882'ñÆvæꡦ¶I ÏTŠ²^YyZÉöWù gëå\Ž• HfR`{{2éùP~Ÿõ =¸aúë¹Í £qL\Õí`ØÌR¦,PnËÓgŒLÏ·ÛDuË)d(YoÖ ÈUu¤«å½÷ŒÞö9ë:©$OËÚÆ93mÄç„°Ô#9ìQÁ™¾¼Òg¿ o}¦“¾ ©×Ñ×õ¸zÈ8©Œ$KŸc¿4`Oiï`N¹îtiºç}‡AÑgÐÖ>Õ!ù(ÒáVÄ"ÎØFš%>†ÙEazLàÈM¸—³zG^C«ºƒ“¤ý”z³æ£V?ÔDé ®3 mlSèÿ¹¶@£Wˆ¿‰fÝê¾D\sÝ÷Óۉɖm Æ³‰Ý‰Z^æ†ß[½“ü!‚“|b¸ÈÖ 93pÈ ›T eüé ä¢De²­Û’ˆ¶çtß(‹öÝwî|å[QÁ5÷°Ç‹ò¡¡É›/PÈU±äGLJŠÅõ2CÒm$ŒLM£,í’ÍJ+Õ_…bP¾Ë['mÆŸxÇ5‡0_Rše}™—¿ºÚý/l&JÞH °OíÒ9xžï¡ð, Jv—™,uš§Å•É³gÃÓƒ’øÑ5FÒK©Üj;£´‡ÈŽÔð†œ3•z¤óÚî•#M,ª$¢->æ° )ÿMuŒZC5hùSÚEͯÞöås}ÙÃðõ¯< MfªÌ#ô_%˜Uº0ŸbWý+øãr† ³±ùU_6R²¥“‹÷0FÓö¸}G%QÑGk ¤£zVqV÷§}„ŸXkÓÄEáÐ:»ºN6V]z£ÑtÝƲ­Ì×48ÓÌB[ÏÍw]€µê£í!ÞÛÖ€—þ½Jž÷¹Ÿ|¢$ý6P%cÅ”"îAb’µ©wÓ¨o(Ú+P+õ£U­‰~™‹%k§M^Ef‰=Ç\vÉ1›èÅÕ‡4ε'=¿Óó~ówSÅù)ÄTÎ/ŽM‚ÞE8áAÖ2 8¶âãT¨Ñ=|±ò;ˆÙ¿Rg¨dÃMMöÍHQùä -Ÿë(Ž¾ÓzGÛ8@æ¹ð8rÚäîu’äÐìIågCVÛ Ã=Íña³û‘9ä54\4 V­d¡ ¥sÙœÐñÄ{G£+5»ò ÏݨzƱÒwǸ!O·BZÏRÕ_Ç¡­ ð¸¤cZõZ :Òd° |gº-KÐé_÷úU÷#Y£\Ö=²_T„_ -Á’íI±(‡‰rlf¿?ÂæãV!j._‰VðrÏŠê›/£ôÉïÇ…S–¯Hì%õH\{ˆ÷öÇZ—ôÚÀ‚JÙ-÷•[šÕìï>íyËÕ÷Ô¿ì\'}eùÇúÒòq±ï~òÓúÇôÅ~àÂ=šiܯËS'°§ª9Þô#•†]Xiù ±ÿŽStÚQÇgw"MÇN~]æÆXá%¹j¼¤Â= -ï}ìñùÑÑúSþ^.óÛï%~7Ö$©AbÝý5 ëó¾É4Äôš@ø3Äg­@M9B(²ãI¾1A2º6Ëý¥ØñÙeÞ½+9× ÕÆÔæxÅñ(W Œƒ~k7<ž0±-»0'Ø>%s!É€o—ì8ìëxsÁ V—rM! Ö¤uÕ*ÌnN¸%…ò!1bGÉ—ØSž‚£á;dU ¼˜D›æTLjXæɹsŠSÑ— ?F’îÜ|fxy½_À>Þ*Äx4 -dÝL¿£À®³µB_Õ˜É …qƒqZ'ßõuÀÍÐÉC®9UÖ©‹,šÛVÁ ªjÃÄðÎee­ -/.ÓG‘M«ìx“^TO|?"'=„!a=Tt<™ÚòÔë-ש{;Š}÷8wÇøZc‹4 wON ¡lÈ™&ÛE>?ÖjÒªjÚ^ÐÁèÇÌÇ ûv(°”²GÑ犨¼ƒOYnøûÃibr%ÜÉî4Átcº)¯~ÑÛ­^ƒË¼oã$Øøê×/M|â©éY5\ŸaTûÇŸrVôn—ŸÙ'ôyÚá*×àÀå… ÂS>7NõoÜI•­z@iG¶ªý(è“Óÿ•§âSki>ŽÓ½ˆ€DD‰UIÌÀCðeò‹t”÷£ƒ¤LºÏƒ ÌLä)îâº*û!êèÀÞUùèspÔ I \xA-Ǧ¼~Æ>[Ô—YÿÚƒÌîc'êøŸ"Óºýw§“ÐÜÖˆ¡®{̵v,@v©cO70±6suöñ[œêÂã˜üCnùxù¤pv ­/2É÷¨i%`¾?X$g© ‘K“µß-ü(‰Muf‰ h¹оë>qØÁø·%–þ -]함( õê ‘Qy~˜AòH\38í0úöùØP<¼EãÃJ'îJJYyŸ²‰së$Àn~\¿뇡.֭ϱl–¸Ø\§Ðâfdœ5¸¸¿‡I8kEÓJ%ïƒâê·ÌëY¬b> ÍEbª‚7U‘Dt½ÈÇ^W£+Rœešœ Û$v,žÛ]0èÖÅÓY”lÖÛ“ß ÀIî9‰âVSðG©ŠÛÃ.ð”`Ó‰QR´øˆ¢6àD|Y\€»Iߒʲðiõ±î=Æ^ÕMizüœv ?À?,f@e´Pùî5›®8FŠ”QÇyãóKy‚šÊŽÇ'›RH«²Xé;íÞЭ·0ûWÈQ»}z,í$¿£Ói²§Øá¡ ø$2:-NèÍß -,ÕøP¼ÚCV°ühÄvÍÄ“2aØÕìæÞR[5ÜUœ—3±OÞÞw‹æ±YH"n#«^œf2—›IÝzÓ³r*ÃÂè駾–«I]P¥¹XP÷g£üâFyrì× ŽôÓœ`žøÔmÔŸ€‡QÈ’¡G ø$£Yîè ÷kC‰ñPÝh„f±îùç¾ûX{5á¶ètåÐ&h¥ nFùÑ5ÀRÒnç “raÒg ¨ 2ÐW¡CÀ 4¾:~hªõcÃRΗ#ôz™r¤‡yõõò{ \ßuƒÝSCC¿µÌ¨B)7 Äp[‰ÙàÕìBG¦9‰JÅ×®FÑpþÒþ{lój3iX|dºõ-fGŒg£âF$„ÚâN^ʾ9·¹ãV»Kš!INõx -!CÚx¦ò”ú=nmn~ÁÃâÈ’9^Š‹‹k_Òã›ôø ”™ï‡JãTå‚AFã„‹}5¸Ú;àK¼[Âõ¬Þ5² ݼ*ñ’®AëØé2 Ä’tŸ¿ñoáò~ï)Æ“zhjð6=K¼19*OûÃ]ïë1œoúdJYƒ]!ðkôº­¿Å[–ÒŸË'_ŸåN®ªÜrbúÉh5ÒòòÃÒòDMˬ¬§3=Ôê>M‚…'cŽ²VB[»:?û9‰uÏgúûr•þZCÿÁÌõ ý„&´ÒûMõ»Æ¹{—˜bˆá}4ÉÀ—·rÖ=ï‹>Ãî3³ølh94‡'Z9ÕØ¥b%9ƶøo©Æ㎳5ãiÍ«ã\±¥s"±ÍÕxúû¡q¾Aaûi+þÍá6 *þ²ÏG©i®þûO“oÞ(,ÙL奷D…¼õRCÒhŸ–7ä|Æ0Ä‚‡ÞMVöCóMÃQ½yÑO¨ÙñÂÇk« {·8ó¤Ï`0ÚB2~´î&?…¶ )ÛóD{†í1fòíw¨ïƒ¯Ü¿ôI%ƒÁæ×ûµŽ–c\!·‡+Æð ì Ëd¥eŒ•ES\³Ô±Éý©®¢5¨\gŠYˆÝé׹׊fôì\/ QE’¿áyBiò^þÎ^µ];(ÝË;ß·‹F,æ½€ ¦õm¥%ÇÎàÂkbƒxnê/”•ÀøC—°»¾qºâ¼íLǪ-\V[4¸¾ }ˆÏgë‰H«:¯}â"nolÞ׳Šî+Œ¶LÓè5ÊøñÕôª O8n<óN…=³Ñ¾,4†s¢IßÊŠ¢DãÍÔçíÈœ0q_Lû«ýŒ=æ-n\‰®5V}å [¡HåÑ”dåÖGÿê›®•æë(ˆâÒÄ -rÝ0ÈBn”ŒÛ==bÔÑQú¾„Š„'ü4ª/?>Ž]Õº > ¤B+EI4•\ae‹/D™£ Ï»bŒ1vU¦±?—Ä(Ô¨[ƒM/φ×VÙÊ|Òs^còÐvÚ-˜^ ]äc‰ÆBˆ7©°ÑD9Óì%©é_î@Íô=«lŽ}¿¬} öF¨_{“šnU–ßÓL‘U¶FÓk¸¨ ɸ–$½M °¦[·^TªÔºÈ[h„“ËÜ#dËïê&©­Îã±èUví¬k™‚ù½Õ!ÑU­qÃÍ‹9_fkM½Á‡ýîÐ<JjrZ”ï(ckéøßa“ŒÚ^ qé+¯XH´Ñ yËÑH?TRµ×Ûj«Íè,JÉg˜ ñˆ†°èj{š›A›Sµp×ÙßðäR ]HkäÚ,{³·]¤9 "ò»iÉY=—®Kùü’vs³Ë"*ÏfKì”KoEÚYÙÌ!à»Üò ¼*Ú¦Ãü)8ùŒ‘ß ²BºMS…XN~ê·ÀÒ6XÉ9“DҶ຺_ü’žÚcÂK”i“ב;€Éf»î9}ˆð×O÷zÚDª·Yeì¹ï£úÍʆ´Uää¸ý SätœŒ¼¼9úö…‘ #”Ïçècéø]ýWµ¼zƒäÓbG¼ncGS˜mÒfäéÐä%ž|úBKHœodlKCKœçwš\ÆÊÌ?JÖ5¾‡YÇ™‘0/¾CéH3:±:}Ú ä–Ýuc„Ô.z*h=9-ä—ЈTܨïYoIXºz ö‘ë^UêþÿÚ™ó&Àjsí»j9se‘™sË5ä9+Ö˜ˆeÒ(¹åNîû>çÊ抜9’D1’Š¼ä&4™ß?âýíý¼ÏðÈY8h¾”þdÂBÝŠ„&Íå·Lìež ߧzÝ…:ÓZÚ¯¿IŽg"{äO¬©.E«Vû™#V #˽ʅµÿh¸~ª&¢©~03øŽ×G¼ù»…Nz̶vìÆôñ¬‘I¥´U†¡1=0âSЦ>|ú³iM ™®õŸ K9áX»Äþš•(ùFwž8åq§Íðº„Ó.¹¼ ÐR1…>‹Oëô…½†I=%DöSê‘Öûoëæ•óo5”þôÕg¥V>²1o¿‡vÃ#Ç'Ÿü©Òµ—½ÔŸn³§”ÛÇ^K,ˆZ(±9„ÁSáÁÊæ:/¢µçÔÔ/·cD•¿;?>íŸX²å´F eŸèošÏuR'ßïÓiÝÅñù,ß EŠø•Ç­º¹oÇØ]ëëj U»ª³Zieº˜¨MÌ;›M/×~oïÈTò]î$xÊ.·aRF×µÌ'C1J¼Xç˜Ñr8OªE¤ŽœK™ øNnBéÍvاS[âÙ¦U¢«A2 -4ù ÙD®>/wúA„¦Zí÷¹æóÀ–›ÝcO€jê2W6þÜv‰54SR¯Þ}`E”ò^Q…ŸÖ|ÓöÄa§öyÿšpb6äï;ö²–ÌD“Š¨”;Õb3û HÎÛ±ð«4¸ÚøyÓÝH°ÝŸ½ƒù ør‹œT~EÉåê^qz ðZíJ²hzñŒÆñ«à&†uâF\ÈÑE†4êLü7þŘ,v6~÷ïñŸÂû!(V\»–”Œ®pá½µóšˆ(±ÙñÖ -è´TïæüÐ{ÚºÚÔªÖÀ1Li˜)dÎö -•úÌ¡)Šz•O‰õ9ºo@ûÁ…*êŪ‘·üFS—>ï5Е”4µ‘ÐÓuu ±ôW¡õj -Ã󈌯Z0íëBì7ügi!wÖ¹jŸmv =Ĝե»D ±íÓ¸ðë…ðuŽ"‘u6Òs#)tPæÖÓöO但h¶Š9‰‡/ÒîùäëI -Ï=Èw?KNI+,òÈúðÐÒ¤\sÀ"%!§ˆ]8f¾yD^žú]‘ði˜.º;ÃÌ¡¢I‡.Ä´W°ãVes¿®µoËŠ²š§q|TKñ57K:hÐÆ™'^ª8„8A€_WŽž™Ò õ¨¾õ>³ Q&ªGtZcÃz,âkèEÞ2Åy±Ä“Ñ„¶Há†<.¬lZ«‡¬„_Ãz;~³@'Õá1¼‰¹åÑ’"#k¿”¬Ë‰³¯ùÓ!gRàüÒe{}q±ö:,>‰Kå6Tø’âØUõôÁ ö†rË…«ýTìÅߘ;Só]ÆŸPF80¢zÞèò®¶·aÌ…Ž8£èIrÞ É@½øä‘ -;I“¶~ãËÃN…°ÍÐg|íâ fór1]x -¸rC½î]¡É,³âe÷Š6FŸÁ|#ÿ-Yþ¾Õés„ »êêÛ i(ý2‡ Þb¬†áËÊx‡9æRŠ9ÓØ|mŠ±W(3Ä…–å%B¹¸ÄE^qD­dV:m#Øœfä¶M¤·ž¿éÒ`Š[¨¥ª«=PUíï?åòl¼}’c©¨´·Æ£9ÐJ@‚"ª¢mö]…uQ›"»#5ÓaÕŸȺ9]U†Ú{Tƒ+ùy†™Ínt>a¸´þ¢ÿÆ Ë5cÍ3¯9„lçìæõ#.ˆ¬ü_ö{ÀëiÒGÜV aï™­j¼¤Ž,ûyŽ1ɃÁ>Ùùšöã{iÏ1RÙîxÀ³ë-‘=Sß1+\šÆíåöÊÃÚˆ|M³LJm Ø).í\ ê/§ôÖÓµZzœ<Ø`€ûYÉ -©øÜv_ã/òÎï Uƒ‰Uø´æ¦5`“ß•rQ×:™ÝèÔUÿÚXœ ;:Lêmò0Cm•£—í þPxõ·à»úæÎÃÇáµ€÷Åå>Ž£ âà 8âl7ýãó¡fžaAÚŽBÒ¢ˆó“5#ÈàzvNo=nšå-2ÃŒVªTšªU) õ1Ø\ ~/©äRv¶l B´î@Ó)·œÈ§¹‘Sœ³õð`ñ©¨¢åç¬õšuxè÷˾MR·í¹j;ÉFI§€Ÿ¼Æ¹²A\y~‡Ö—‡òx”†ZÃã®l}ŒŒjdº“9m…º¼‚jçR8Ó,ù -Ø<ŸïH²ä[¹`›ý Þ–"-ª4„ÎvR|e‡xåB¹ógÈD£e¦e*‰÷‰ -)îÛßôß_µÍÑÖâƪ×ÍÅÛí”AÃn&^Èѵ9¡þ„'—ðé[“yÞÔð·Ú±h™b-l¤ÊEoiM?<°PÉ)›†ljÐ¥38ÅQš?ôÓeF±‘4ßžµD“kòJoâ'ì“¥vœ¶÷.k°\â‚*Þ;l ã ½‚Aåv&{í©0fcc ßˬÁ/sèmuÝmÛ²7Y¿íEÁóƒZþV÷³Q¥836š!c—w@³ð¶û—Ýi>÷x~A~Ïü¶ó‰–.ÉaógÖ}²àWçû!ðcÒÕvŠhWº§í1;Š°>·¤²@åï{Éæ?„f•ùl­õ½²$]ùz£f}\˜ëÃæôY©â6âá$w®q%xÿšÅ̦øvÔJÅ]üXîôoì¿‘æΤJ -3~À/šlÄr¬v$P‰V_;oRP­k>—„Œd°3¿ -‘9äþK ÿÿÁÍÙÑÓû±»£' ô/ Xœendstream +/Length 18869 +/Filter /FlateDecode +>> +stream +xÚ¬¶cx¥Í¶p»“tì¬Ø6:fǶmÛèØéØN:¶mÛ¶Õ±¿<ûœ³»÷~ÿ~WòcYó®5jVÕ¼ ¬ ¿¡¾‘ˆµ# -'@PJQœÀ@KO/CB"ho¤çhfc-¤çhÄ `àà`ˆé~øüçdaåd`…!Úغٛ™˜:È)þIbð[Ù›èY¤ôM¬>ç0г(ؘ9ºÑø--òÿ<á7r0²w62¤…a`š8ôL̬aèþq·6¶°ýOØÐÉöÿ†œì>¥äÿÒ¤|JÚX[º Œaè¤m>¿ÍèÓåÿ­ÿž\ÄÉÒRZÏêŸéÿU©ÿg\ÏÊÌÒí3l¬lìR6†FöÖÿªbô?rRF†fNVÿ=*î¨gifÀombi a`¦¥gþŸ¸™ƒˆ™«‘¡¬™£)ÀXÏÒÁè_q#kÃÿ6ù¬ß¿<è%”¿ËˆRýïÖþkPVÏÌÚQÑÍÖ@ÿ'û_Ìð‡?‹doæ +Рÿ¬2Ãgâçßÿ}Òú¯/¶6°14³60²°ôìíõÜ`>Ñ'±<fÖ†F®#×Oc:ZkÇÏGŸ•ñÛØÃü³¯Ÿ[Ogü¯Øÿ ã'šýAæFÿ0€îs2K=«?¡Ï;'G#C}ËÿÙó°èlì Œ¬ÿŠqüoö¦2Ó¦êÙY[ÿeøßè%:ê9ü3…ƒÅŸà§†••ÞŸ €ÎÔÍÖÔÈúOˆõ_Ff6†BŸ’–z¦"ì:w#{›?Ogk£3˧¬£ËŸq–OMGS{£¿2þ©¢“ýŸÓ?euþ+ãS×ás‡ÿÍŸ²Fι~î&Ѭ›åSÕÚìoöÖlióç!V¦ÊkäðOãøüœ›ÿ}Î+ð‡>çüCŸ +ý¡Ïu ÿ›Ø>W-ò‡>×,ú‡>×+ö‡>%ÄÿÐçJ¿ÿ¡O‰?ôé"ù‡>]¤þЧ‹ôút‘ù7±ºÈþ¡O¹?ôé"ÿ‡>]þЧ‹âútQúCŸ.ÊèÓEå}º¨þ¡Oµǧ‹úútÑ·×3°0rü£üÙ½ÿ}Kþs€éßüç)ÿì™t3ǧþú40øsIé? ÿÂO£¿ðŸÃø~~¡É_øYÓ¿ð³&]úÏ¢˜ÿ…ŸN᧔å_øiõ§/0|6<:ë¿ðÓÊæ/ü´²ý ÿ9¸᧕ý_øÏíø ?­ÿÂO+§¿ðÓÊù/ü´rù«¿}Z¹þ…ŸVn᧕û¿ðÿíè6®4 ŸWŒ†ñ³|:²8X9¼þ3SÉÚìóŠ }v zzvFöE œì?»˜ã¿^¦Ÿ¯‹ÿcc³Ï7Œ‘‘«‘Ìò‚W yRCP‰·pÞÔ/p +œ”¢À±Žu)\´§\Hsö“ŠFx¿¿þøjnVŠ˜x.QNgh̲…ÙÀï9è¡@÷céëàŠœTÈKƒSMm¡¬«ŒÐÃeü=ÛFªË¢»MçðJÉc¶\Ìó0°’Å…·o Ÿñ­eØdC¢ýD­¬VÉ#å£Í˜Ñç3Q›<›å‚!tÍÔ;ä÷eÌžõ‹µ/)áYR ó)ß^¡é)\·ÇaÒ,ð—U39Ä>ªêh‡dS–¤¿°Ùõ"âšÏ˜ƒ#³Eœ± +Bfžm —*Ö¹ÐjøOÍ• ÞÒÕÅÿËëüŽ½q¶Ä Õ‘þ6Š +z4{DO6Îù ;g\|4og8©TËø<Çìï9—3ÊË7Š¯m‚Iå–½ôNÿt¥q…vW?† #™x¡˜ @×¢Ôqܹœ&"•ìÞ7ÃÖõû•ViƒÍ?O¢‡öÛ.ºÒråu¦8\”`“6úÙ‘Oq3Ê4â¶Þ´§$ǃ3Ñ@{÷.Øô+8„ífzÞ0+wŠ„¿)G´¥Æ¥ž^§ƒ Œ_ŒqÁé…¥¾, ôø³; Œ>ž¹˜ÝPâóútwÙ·l »üœ;†b!§Da±VO_.]‚éc¦”ØS-"“¿UÄi5”¯Íœ—b²‚ÅŒ‹JŸ.%-8dÒÊ~Í5dGçÒjö#¨ÿ=L¢xŒ»«AÓ9žì›5ü‹°‘ù%HØÓ¶¬Jùô Xª« uNi[ËšÁ—W~R¶ªÓ ÆÇð&Çæ¼Ö£¢^üW*•-e`+´~~AGš†Jnÿ™h¬F+ASj錭#Lf¤#µ E£â³âJÅüœK°fÛLTj½sÕ ”ŸÝ¬î"·Êƒbäép§¶£pF +»^c_Õr„å׎‰éWø‘‹P{Ës…]“H&š+ÓŠ«w¯®•|ŽÂüÞÄG]Æ_è“mb¯#.®=«ß¡?’?´- È)½eæpÖuöÁSUŸ•¬oèc]ë=ÑŠ &‡;ÎÈÌ„ÚOHTB/¥1‘ŒçåŒip¿§ßˆ4Ðat'îÚ ˜õ½¹ X\L:×sAñc +)dš=½n÷t6šüö}¿æ‰4[~ä„v§R”;{-:ÈLdf½®'­ÏŸäœñ.éîVŸiAm„lÊgÃ@#7Åý‡2çÎʆV;™ÆKx5_cd#¾|ã­ÖáNEDiDxÔÀ=N‚'ÿ¦èOúõwZÀ8ß{Z0wÉzÛ Ì6#¶ð°™v²ôDö®ÏìwU˜_jŒáh7[92@e@ØA¦3ØZ¾‡R­M‚¼Zˆ`û¯ë¶æ#ˆœ|€Z0@WÁ]¨ ¨~Ë3“†…œ¿Ÿî6‡°5osØ],8;_—ÓBàðƒÉ"¢©®¶RÒaÔâãXú£+Õ[ç¬ÛäÅ×½ëñT¾¬à|ã]œZŒà¾5ÃùÅוã7H­¥ùÕéúSTÕÀ^xãËàfpI‘'7†ðf10þÜ_Px{ú^SIF*¸~(’=F_rÊ/ îØ™úèìW”»´*;¼Œ6kˆ˜ïÒ+ÊgÈp¥×õ!=ûy8Šý¢ *Í\Ö+Æ_Û%·+uJSÑÌÛq‘éT·‹P}›Dgl|ßÓ´4´úÐã«¢©ñƒóc괢Į¥{«&»Ç_-ï~È‹ÊŸª†oÐ0/ûÿì>GØñ–ª-²╘¸F‚º¾c¥/Fùþ .ý³TI<¢}YQS¡ÞØ£Ui/ýwb¾h­@A ²÷*•!Ë}5-ée,è »&[© +™Gy€eWsô”ÓtÙx¨´%—[Ù*Öy‹VXÅÊÇ€3âqÔV%z èå¶F¼ÆŠsåw†Ç³ ’' Fh³HZ~¦vÊNÈ„˜ƒ”ÃÌ…s¶wz‹ëj,8<pÜT'Ûì¹c¼ÆÙø EÔ×›gÒ¶sœ z›Ì1‚`êÆBBÕòÇ’Öëç}Ü$¯•ÔðrÖ¤¨±NA\³º¹hæúþ˜_ҔʭúHs~ª +ðOp— ˆª»Å>é«Õ_‡G< ín9~r‰ð5øCçB×4õjt +•ò`VZRG[Ú¦3¶ÁCã@˜ÕÆzõã2¥àË=M4XÊmWKkäáP{ÞTúP.ã”g[ @‡êZ ²™ïBßxªéã¾€&±·.=÷€2š±dŠjóY/þœ1çj{Ö{ö.nÆy!S·¹Q*ç1&½õñ‡% +LÊw,·(Émc®úýÒgÈßZv;éÍþò»`^Øœo« ¸yýôµ¡M‰¼²dÆøm>îùá ´/èÒN¥‡XÕ3Ö6»ËaW™`u¼Þ½™GAØ'·_èXi„^Ð 4úmêz/Cø +äZrz»™lÄ\!¿ÁO7u›hiE+MàKf“œò|öwâèiKžÜJåÓÊf›šƒ§(›Pa1žþ {Ž«+R7´Rë5Gß0a½æØ›¼Áí1ÿûs 7ÓÏ—¥“ºõ´€g'”¼>_¶/”2H!‚Km/~G/¥Bh¢I>UÇô¼æâcmÓßH+»†Ôõaç‹È›©òíWn«Š%<:¢+„‰÷Ö2xªQ}TVå†ßƒ¿àÚo ^rÁØ0 µÀcë!Þq§md`C0ªí£<p ¡ü€×¨¾Õüã±%nBçРM9ËM@uøræ¾k¹8þ Ôøbó4Y$bOW+ø8|MN|£Ât*²8»ÞyþÏ ˆáF‹©ÌÂjk¯¥.\ËHꓸfµE°žbXõhš4››§Ê™ÈïO¿8Àë³·„5Èžî¾¹9”å¹Fç"N$'(<(¦7_&ÖÂï:{¾yô=;‡û8)gWX»‘åÈE)3&.;BØÔpÚñ >ïƒÌ KÑ3¤ÑÜÍó­çÎô‘Ùûvc(÷,ì§ iòÅ˃>ð•]‘¹VElÊy¥¯f™]Þ%¤£LñÖÖ‚»K°5?£¶Vjˆ0¹3iÛØÈ¿…úr¸–öîø—ZI§cfuèF|ÂILãDUØž³ðb+%’òOì­!­Fë@<7Áéèç<ß.tý-e9Ÿ°óX’ŽãóêÛ‰„Jõ¶LÃl*EVùyªi £Ô³Ÿ¿Ì¼STaœä/ö¾a=Gu¤Xô_v”÷ÑöŽ6Õ·1{Td_{¿XõtÌaÕJTW¡­œ©B+tN¦Îˆ6qcéÁæH` `ðí{ž%l…µˆNÞ ËO l™HAXø"ÙeÙz¡ŸÆÊÁÐH»¥Ož ¼64rø¸µÆþl1fHÛ·ÆÇ|Ñmˆ]õF~_¿ +ŒÜ{q.FBw¦—í;C¯;{:šØNò?“ÏP÷Ržµ¶ˆü|t~kè£æ'yƒ¨ßå26ˆç‚°Ô d„E/À™'ÂÇ,¯?“àF(ÆQÛ¸_÷9Ÿ9± ×>§‚ggŒFã@8øëçÓ)FÄ.º¬K$ž¥‚ô6 +ÊÞí¡’oî›ií¾å°y=†Å¿ƒo;BéA¯&z·;½PŽ%dù>Üd¥Ÿ\8 ó ¬CÝÆ m˜Öl’n&:„xédñd|An‡Xq*74KEÌ(×# ²âÖOqmã,œÇÛÞº,†ÞÚe:xT¸¢•Üé 7Kç­h:þ8Ë‘0Û ÚLC}&7µŒÔ{3¦Qå™`ˆ#ú<±bYQ'Ê%æ+ᵂ®ËË+S ÐYéã(uœà®j€æ=áÆŽ†•ký²FÏùˆ›æ“6Ü×PålY£='~IU¶’/‡dÎDü_@üåͽš!ÙavêiC C•¢~ã>ÒoààE`Bò šaã'› 5'.mœ£–7®îBÚ`{õ=ÜõSEŠLg\›%æùÕÍ;E»®™ë†q˜+Þ>›Çjý;}³òR²&ÎV;xÃHa¨”uŒõ=a_é(±¹H›¾PõØÙ9ηd£¿‡ZUâ²G°Nˆ# £¾²~fÁf둳Ÿc09Oº5˜Eÿ&ÑáZ¨Ä(ñLg—Þzˆ¶Úð=ÔÉsí8*¥çaù:g4…fjÓ•\õY^Uºw•.—¤k»F‡ÞDz ±²øk1»u¸Ÿ~d?”ÿttöê"k3æš¼PÛ“æ;1‰ÕÍÏ+ä<ÿ“ðúK¸»|,Þ lM~°ºLÒe¦£˜Ç‡ÂPìë®Û}-\—…à†|/•ïšO¥É$`z’³CGãd¦êgËܵùŒÒŒÖk)D‚Ùl P÷ñ'q­7?e½¿©êÀ5VF7~8*UQ¬äᩗɡ$¼”oà}§Êš,ú4õÚMËPŽ%FÖïëógœ•Úò6~ŸÏäÛ@-C!ˑ؆˔pTF6d‘å´‚h²SP7!?dd$˜ùR-K: #D‡%‘ µ¯püŠFƒ†)™fò¨`nl&‹`BSÅðÄ’M¶cç@g &*ØaÇp˜j–>haªz¾¾«GIØÐAKN%¦ Onpq¹ÊÌ4.«è9CÚŸ§S‰äñÍ>}`IÝÔÐéTïâÞrl’Ü„^ÏA×N0dNÁÝ*Hb_‚D¥XØ当 +…~$>`Gl¡ž$ £•ØÂãRæA'{·[pQ#v4ô½Å˜µé¾‹µûJó(ñvyNcmj$âÌÎ! 7ÑÁ JÏâmüsÔò 8ðVµ#º˜o îôº;åú<ƒÀþÀ!)˜8@4!\¾'P^‡"†Ôš9ÃH˜†½I L9e¸qžqSR)ÔP‡a)Õ¨ú‘'¼ŠüGnªªž'¬‚/çhçMhî6GñÑRr‡5¶â¿³‡qíGVò={i—s‚÷Ð׳ñÞ‚T›‹¨=¨Ú¦Iô³¾Ú³ì™5fJ¿DóæºA„hðýíÉk©6DØ‘Ý‚Ñöìu UÚϬØsݨ_#,Á‡í&éžÔ•CÓè±=Aaò(ŽÛ5óOD×£×y]?"ɹNKê:ošë] Èp2âànëVQ"èF ЈìÓâI¹VÊIºå×O¥nUaǨŠEk§–ŠPµq3F²íh?$i6ul®…àt€<\kÒ¼3£?Z_HïkÀͨ¥öžÛs°×ÍÕJƒ#X_Èq„øÓÜD¡ ßc‘EIk=¼y[W,8éd¥SÉÉöÏö=ÊO\A€ðÅcC»²ÉŒÀü=KKÁdÁ O[ÎcåŽÏ(“- IÏ=æT‡gB S×µU–‘Y7Õé& a:Gtß®s¥ì•ßê .NPbÝÊʼn‡Ã¶£>þ]ªS^å×~×ÉiÝG£Ñ¤LIµs…ÝvT2–‹­úiíÊ\<¹JÖ÷Ú¥ìÝÌvMßf%sõ#Ú¼÷d™jÕŸnÆ5N@·f²m¿}½1cµ +x²Rƒm$ö¸ÕÜŽÉ,4SEÆTТHWS»ï=žPÖáPíÏÉGÏTíŒëª=YõÎiÎAÐbT©P•M»59µš×{¨”¢t +©Ä¾òGÿZm¢ÐÕ/@Ž†Ç™®³9îŠÛ·–¯ +äÒÁÄÙ‡}«.@Äê”Ò‹¥½eç”>¡¢ºÎùI»„2¾Y=~‡f6ûúe;ti) P&¼ðm€XS®y±äKA2Ô#¼{uIdÏ1´°hW~$4eôÞCý&3ÇoTDuÀ‹ø8ŽG#s‡õ½$X’<¬ß.òcÞmTpŒczš„¦¶£<"'Àgø$ÜÌ#\%;c¯ tTMÿ5§^°òH¶Û0i¨Äˆ9¡×Õ+„Œ^KWop:{L«K nB$FÖaÏy\2Jèrgqƒ÷Åè8‚mÅìòóÒ!]6–u–Ço˜‰<Å+Lä|,µÔÔÔiU¾¶k/‰æ«ÏÍ +Ž¨æ¬±Ýí¥•)ºhc ¥Èh¨ ©l'Š5LËBÓµÖZ•Š£ãÖÒ™ˆµäþXƨ¶ÜO +ø¹uÔÏÀÒiŽµÓ±6¨–+ƒú Î‘¨f…oå·ÈbØþ]œÞ:Æ #ý$¡Ÿô¼y`3y¨ ‚¾­ +:7óƒªxåÒ Ôå>&7öW~x LFÏ£Ò9^†ï~‰³ØT­:~¬ja2WJ:‘°éTUålÐPc\v›+ +{¼ioI­tã¯7r„ÌXš”ż¨ YQQZ÷"é=Ò¢÷,¬&^{¯Þ9,"?‰‡S³ ÁÞýý\ð²Ø-Áý°Ò¼¢D7+ qݦýßzs†9`Ž;pËç™uE2*Áe@&×yiØ%+Ó˜”ÊZãÛúá\(ÈÂGÕ3Sw÷“‹!Xoã¸Bú‡¿@ÝB ú1´u‹ß’:ÆBúú&?À¢3îs¹(e,²¬y¼Ù,ëì½ÉcÜ A‚—ß#° ³ñÚ4iw¤¨àY«Ë"A;(Â"Yl×»ýz[UŒtù¾‰£V'æO’|Eayö3¹4Ç6N RGj&ågEÏ ùZm}|B¦¸=}º(„¿Â²»Ôøî v¥‘Þ¹“Äá×®=oe඾dº#âì†ékS_?>?ypóñ¬]94‘ ¶b#C†úRM®‘‚þ¸&Ï`çÐk¼µ}m›6LÊ&žca¦[}yìI¯ŒSIGà¬zb»ïJÍ641•Ì1ú5x~é.ˆîMßt†£šË–4´®‚}$þ'—vq }+©ÀÅáJÏÜ&Ï÷E¥î/ch†Ívë#_¶Põ)Ùì*Ä£ €ÖV"Âœ.b›"¡"–Æ~cÖÝK9©}p`Fz1L¦=aâq!˜Ç$립$FìÁhþ:\Âœœ|•é.HìxN×ã}<¶uAâ½;‚‘ÏÜ` ¤ü`s!^×|J°Û“…uÝ`Dùû¯¹= ÖžzðëÚ¹óÎôM'LÆÈaÈSM¢¼»æ/·´ÃqË&!¿Xd0mZ`Ѩúì¼Ü]{}¤\>¸=Rå×£]BǨLŽ÷è‡$3ãˆ8òdÅEhE:C¹îÇÛuhÖoŠUè´×[E赈qQ +tP!Èx‘Q ¨ó¤ß]¥‰ +×qãç…®©€Ò¦~K"éA4‰¼p~ÓSð;G +Bž‡×Q /dH‹±IPT°<)¤8u¬41m(§Ëv¼Ò_Ddó›åS¹6~ÁÞ5‡2_Hr„4õKdíGL,‡Ù=ñêÁ° ­Ó›¯ýžä÷ÂuµažÉBVω™(¨"#Ü.þ$Ò‚ïO-kN, ÝT¢‘­fvwð,ÈÀóÝŽŠ½…ñ( +KËâs±¹cÁú=ÞÒÀ¬\1-!1qø嶒ÚDÍ>Lï5KôÄÐÜE% éíÛ]ì4ëãÍô}_‚Ž¸ìÇ;|‘Ey?ùÌQ:d2ÿ†µUdÆ·ÀÙÉÖÝÒ¬ßjºòª3›täûj’Ÿ=öž¿T¬ãø"°dåÖ&XŽ«zÅFš|8ÈÚç–OE÷[Î99˜'ºð8…ñ3ÙŠxN¢ë¸dàèJ¥Ç½îÆ®¸;£ñ™è…b@/é bí׋pgvVY¾û–.ßhL¡'°2‹°ãug2Ó¿¸R¢½ðŽþPBŒ1kÓhªz‡òײtŠ2=‹{ÊT†ÿ±‚ò…Û¥› EªÿN„Þ*¬xŸVi7VÜ‹érb¸ +% +Äã#1^]Ú*ª1 #ªFÈEN±¶ÏY¦%šËyuýÛM'b~ŒõÝS§ 9O›š »ö½‹­?äoy;ïE¶ãlêê_‡Öª2Ý?IR2²¸gÒú[~#ea¸ÀòNGïLñ6«)ÆšÅAŽ5©öÓw›„Ê{•œS2À¢éKv ¶ËeKâ2@Óìg¦|Œ¤ÞT‡íÐ?9ØC¾í|K/›Öééuý*§†´ DÛyyÁÄyË› ÷¼0‚K$;l*wЗR¡ú‘bÏk_å,NlØ|©…ÄeÖ‚«Ï˜âè±…j©v_¯¨+dYðh.µþ㘀dZ_¦·´‡=ìéý³1KÊ!¸.1&)¡ªÍUuv÷©:JÞ¢,pÚûÀÑo±Ë‘™7?y¥!‚‡<”^òüF†´ mÈø'ÛÝw™&9°æMÆAÂL:)É᱕nIQa°A¸>Ñ7Ã;í(P‘ž÷xj,DV ìáVا}\_ÍDXõl ¾"÷ÜIŠ©=gü©î>¦M»u© +e,W÷|•¥{ÐðJ0Ѻ£œ7HÕ8º€@ƒ&Ë2¤Xâ÷(WÙŒìØ툣yC˧ÆjE?ïb™@‘Å~MwÃw£d<~^â«Æ‹(Ãådð”ÈÄ.Imõ„Óu¥e*^ä¼éj@B̦5ðØ/KÇï8c\˜Üm°1ml¾}Dsûš,O ž•Ú +zxgÝZjHfµgTXét"éN;wº¶á7KK¾ sþ¥5… ÍM†6 ŒÈ-¶›6Ür6´®v,£á§¹nÌ£Pø–£]Ta’¡#Üç Ô!:Ô¨‡œžžâ¤›Ídñí!\8=’[Âèa4hW:×Y¹ÜäsÐ7×ñ…¢Ê·:£¼`BeÃñD=N] )ü–¤N3V`ßÏ K¦º~±Ffæ-ÝŒ¼Ä/þ‚]B­ `Þ+g~ÑöH¹ŠG/0ŒmR\Ó›™õ”ð­æ«|Ë<« Xù*HCdaž¬.çåÒ &vq‘&á„M3jÞÓ¥¡Ð¡ÖS!„9läi¯§wUUÆ"ÕÌm[r‚í(«bªîÖRiòúçDº}IØÁX&øÞ 9eO,¸°‡€KŠ9Rþ7•>µf|L›l–Å ¦+¯…–]aá‹Ð¶GhHÇjÁúý;w`ÏGtYáOÁB±Y*1Е"2¦ØɈô +:}¥…†Í¾¢¶@xömõËoâÄ}‘ d¡!S÷ݵFÓÚ3è¹ Ît:ìSSËcþ»#ºL.çNìi¾’x÷š™h;ЬÎuj­¡Ñ ;Õz„ø¶h D—h…þíÈ® G2Öëù7?=+¥z™ƒåUìU°£¨¨g«ÏkLÕóŠx¬BY2°›A4PÙ=$_ÊA'ÿ–B¯]ÐL9nߢ‘7.8ø­æ@÷‹¦îÉ´„©SõŽÞj[ñÁÄ»fÞ ±"ðe Å%êÕõwVDl:?ø~ëÇŠ—¾ #´´R·Àý}Éž«•2j¤U”ß¹ù¦:Ãàh‹ÎXR#x.¦‚ ƒÆ."By•B÷>q×,9¬ÑM®ÓÁÎS— ¸ÉbèD +Fm|ž²ýX¯Ã@Ž¼¦óÖŒ+ò¯Øä?Ú'WK}ɵj=)È4ƒù¤æúÝgOIíX~Áÿˆ°ÉTËãÄ8•˜¤ÅcBîb­r‡üé¦A@é¿‘Ï÷®PS™ +¿Š:}Ss†@8YG(çõƒ8(ô†1}«÷w«T&GaGåÚ¨Û¾±{Ï/Û€ˆÖC–¯DÖñPýÌ“5y–Ù»tú«R$K®‹ž‡„1ò[‡º¤eM,=R¢%Æ}¦‡‹ÕduSè‰O‡Îž6e=ø­œ‡/vZ½KŒs^þ2ò4H›õþ™Ü;®«¤âÑå¿k™)¸,/"¯OŠ:"{ùúJ¤ólŨŠ§ ¿¦GUºcIJ–¦¼¥£.{Oã_=Oeaœ…øJÏã›u5$ÉË•š†e<•Ì§÷ä{Ô‰»ÒÒÛæA²@k:\ PyçŶxevR¯÷N¡DEjc¿°áK¼ÐIÚ«VJ …°îƒ™Î”ñL–èý.¼`…9ª¦Ø]W·ïLŸçüŽ?’—íÌW§ÖöŠÝ¼À¨ÀbÈÞ[a¢§Oê T—MqÄãÅD@1ƒiyUN m]J°uîe­êµîÚíÓµI­ò|@UqŽ‘Æ>Ì2 ¸’ʪC$ÒðVÉA •ˆ™µbÖ'»|»´Ï¬X‡œè_0œ0s»Æ€M÷|+¾ÙPÍHÊc÷²ÂÀÊéõ&´ +F~0O=@}™Ûé¯ÓN‹DÛäÛ´WhÄ1Ï{ýÊ0{6'ѺÏÀ|½œ…Ü ¾4"SÖ³´¹¢æ†AvŒ«/}tïùë{Q·9Pÿ·¥ú‡gÁ ÍÓÖq-úY« Ž F±Ç4Tæ}ƒ Y¢gª²¬dYoÈ@oPTà9!´2Š£ØExáejôH¼Ê^XzÉ< Ë4 +0<#j+Þ;Ûå2Na%ºŸ6+õ[Ô`Ò›„\eÔÇ·ZÓ//éÑ.%‰N(FúP¿³)Aç=ôé¯[AvíXÞ#ƒÖ3<~ËòšXó>›ÞÑSyÛΖOQ]±vgæqOŸ%:%tq-ÈÎ-¿6Üudg ¦®TÔGÉ.T,ÓÚ±ÿœ©Õþ€£ + çB{Êf´ H´n£ö¯î}ØÒ·Æ­|ú®Nn„Õ³Óø.hZ—ÄÖÆ}šÃÂG>z¯ÛJª´­q)ª¦âæY‹¤L•ÝKè çk|‚%üÝŽíòTÃÞ¿¥çò0ÍáË`WF¹êkNµ×¬û­¤Ó£=JÔB)âžpë&¦wþ"fñ6ávû¶{€ÿ ?7/ +íJEêàŒK_?½ØwjútŽ× ®¨‰­L”P­}Î%׶h0bZè&Ëfç‡4÷_ýßÀ±Ä“oÌí;Ú«‘“h)Æ$U§ƒ~«šê‡„)±–“9‘ÀA{(7“Ù>W]4¡¹³öçáóUßòƒT¨HS»\*»ðߣg²I}•3*4v/Ò–Æ>c¬%ÍñÁê—bÂy¬Á¿ÄÉDqÜ‹†Rkç…rÿ}Ô ÇãËåƒ`Ù‘!BÌh®E(²çt¢¸Ä<>eçðkX2ânË»ú™í¦bC꽄úvê^UXŽ]/@g“q²}Õ¸édf‹¬ÂÈûÑ}…Ö5Ymé½Ý’&$1:lQìΕ²»°R4 =¯0dã†^ôp•§Ô~JGŠœˆü:$Î m4¼Z^r¦]Ç ®àŽ¦Ë!•`]稟<äQ¤rEY§Å4¦ª–Û‘å'~ƒ#ûr'¶‚lÖY^GËY:\½¯õa¤–õ\9T šg€Áém^2Š¯ ÞtÇ7PÏÆVñQ*¶Z%'† L×ðo¼G/ov%®ˆHñ¼Åª…‰‹Ê;WœHó4d·ã™š ÝŒ›@süõ ¡É/=æXÞ®¼ô¥/£©lV½'èB š¡«) ·†œÁ=¯á…©÷jÉ݆È6~M‹¤{Àªœ_í0ä#ãÉE1\‡¥hÎ +îÒ¤øq©¥ÅI#C‚³'í_ˆö£?(a‚pJO+Žz wÌJž_ÃÌ’)Ìs<ó Ï!F=^škƒFé#M)Ĥҫ—Í¿–>‚iU/+*"cµ|¹Lè°•Æ®²´w6@`W­È9̨:TDRô·.ç’št +gLC!4p‹èb¼³KmózYš_G*ÙâÁìhî™5Täbühî‚ocœaêï0õþÈ6?K¬Ï.›ê»ŠÀ;…΄0Ñë”Ø«eϵw²Ð=/05óKô)Šb†éèÕ¤çaM²8,¼H‹z€~ÑÇu*+†Üg“ |µÉ¢­JWDiµ¨ƒoÁ›¹8q›tnÑnN½K@‰W—¢`;Ùݶî­h6¼pœ('~WNV¹JZÜÆìÂ/ç(QÇ·jPÄ84ŒÉЃ?ÜØŽ"Å-Âîf”T‘€3­‹ý¦¾ÙÃFî˜È)'lú~ð%ºr3 +ãðW?Ý ¥næÍÄ‹ÓÈ +ÚÁˆ¥¯ƒd覹üžÀÔ±ø>ðˆ=}Ê íõí©Î2¡¹™¤¤Gô‘û lΈ6¹ç¡öJÓkâkø-”Âæ°íª£e|;VÐÓ­&ÖPzS`.K^OÞ +P‰àôãîøÍ7ïØ>£˜Ë®°Þ:OŒ¥o]÷p\¥E9›YßQBR‡Xß'[¹*}þ8õ¬žP^—y‰oÃK!­§á•½Í8Qž×üì^EÔ +¬Qv÷ˆ»Û.£˜D!Ž5¾ºR^Úv¬"nX·4i3©°è‹¦äÆþ²˜:ù‹G#Ó=x¸†ÂR¦tѳHÐÄf{³ŠL:­£ùFÛ¶E¤µA¢ Ö/ÑîtK6êY¯ÉÌH[)*?jI_I¦™Ïán¥„6mÝ!Û +Iå Ñ&Öh@§¤¤L4ë|?T;9 +uhštmùµpÐ-ag} Ž“jûÃÅ„À½ô4ð€à“Ãzá¹Én5%… £¬«G c-GtÄVyXa¸³ ÞíE$Ò”¿ð‰–šö{—`}íö$­ÒTäO:ÆëÆŒ–š#LB´xZRG/bme˜j°o3`UˆÖiÉB£ÂŽ'éÂE%ún¬ë¨nmÆw8ä½Ç„¾®XbæŸçÝgöÍ‚è¡K£²a7—º6—}s61¶lï‹î÷tຑ)2Ð`r¶§ï Dä/Z††4ù(8®e(%#”Æ°[‹”¹Í$$6À¹.r!'†àWdŽßíÚÚ94à—¨™¯²ùJR)ˆÊT…Sü*Æ,yûB?(jèšlÊÛIÕ~gÀR²¢áQì:Úà¥C¢ wg¨-«ömJ²߆j´ÈÏŒAÕ HóRdØî{n.ÝÝï°ÆR»&7Ȯҩ²T&Ž&‚eþD Ý[¸ÐxqÉóëúµò¶‡ŠuDSô;äbbJúÍŽÂYÚ‘)Eâ¤Xð]¬ûL—‚çÕoâÛÍý÷sßðá]^0ÞòÅ.d +ùïš´µP(”r_†2Xë4eÚKþXö‡¾QU[¨k)¤hÎhHãÒÌßß­Ö²~¾6&n ùSпݥ„¦ô23‚eœË9½zLãw«+ô¦eôÆŠŒÅsºƒ²„Ö_Eð}™œ1“2Ô¦ìF”¬^f6fùÑQžîå£oÈÆÀ£ZfÊ-ëâpYutD–a«|—"¦ßs½¸I%—חЃ¼Å·(Îd +^+;z$K ÀÍÐMWÎe ™‚“ÛT–êª[N ÎŽÓû÷\¬ÓøSÂ`*9r…€Üñ•2X”˜Š¾K¨)y®IÊH¨Ç;¯ïÃóëïãs†µ}Ê*oP9 Æ5eÂÊjÍqzqÛé †p»1­–Lo¡Ê·Ó”%Äðá«Ó˜+ñÃæàÇ;ÕAÁ-»¥«0Öb0Èt•{ì£f‚”ÆúmUŽ„&!–çºÔBž’bÚ ’rÑI_¹…òÍñþʱn{æußJà …ò+¯=ʲڒ³âNl­[O~h- )N‚þ#a¹Œ¨or<¬r8½dCq3u­ãV×ÒÀú•cŵ\à¤cÆJî¨eÉ +¥8¬Ôĉz¹2TÓöÁ@Õ-¸ècÿ\ç?G‘‚SØ©î½”æø5cM Üv^¶füIÐFQÔ¹äv,ôÁ´QîªÑZ4¨°ííD?ŒéL|Š1}/¹J‰Š85cësø(#îå:Æ3mòÂæÛî°)Ö¼=펡âÞgTÅ(°›ÜÈ-©~ütd¥ã]ãcaá„J†ƒÍx˜#›½do÷ͱÌ8ܦkåÒÑiÝþKË©¶¶¬¥œ•ÐWËk8¦´çh ]lLÄ2™’ºg”go}Y»¤úÊš/gǾüh]ȳÑÂu_™GýËâ`ÉGä)eâN¨šV(ÏÆ^Ÿìx ·&vIN-šýÁ=ÒåÔV·`1ciÒŽêæXUõª”³KL$èêÏ貈ô]Ö­DÕ ½¿|ë-|+Þ¹¡$éºB°DvÔ2l(ùakj2‚ÓI™¯ãÆHIš'Rw.„´ OÏ rÛk¯4 ?,|K·PÚÃõ{Ç~\Ö»H8¦m¯ø©tÍœö ôùr›ê,"îiáûùäc˜ä¡N{Qoä}}nÓ c:2~Äðoþwp)Ë/¢^³‰þÂsT³Ð¦1» +¢üŸÞlžóß¼ÒµøRÏ@EúX±›}JéHjcë¿ëÄ/LjÖöi› ½uåv¹Š¦ƒä5óï‘õ AÕö‘#EÆݹó/‹>d÷pª,ô2l…^f›*­i¯–æ¸ap\¼ .ëSUý ™ª˜ç¨Ê¤çä-õrS¬(†)»J;TX— ¿*\}N0ÅrØ…æÚUóÄÀ,â¥Ù]wZ˜ºÞ!0t%™(·ÕÅ%­=;ÁNΓ2M„è‘ßà…js6¡ÖPè£C±Ö1R,U>_5­ø6U øÝj30o× Höõ`(qÚô¼ºAŒù£{uFÛ[ Åó`à†"F–Œ àMÞö9 EÚá-$¥¡övP-^Ò2®ïn½ƒ¥O_ÏÒü »dwµ£Ã !/ÐʼnD2 ½½xø‰ç[¼ +;x2xxaU‘³*jÕ¡©Ê Û0$Œ¢"eêxd@âø-Îv—51ÿ];”x(e½Þ ø( ™Û²OL93•­ºzö¨ãDð mÞ켩LœøE`JQd¬¿Ã\ï¢ÉÛuw¸šØæá›F!"cú@à‹CN[|I¼Î4ô÷cVÚƒx<¿àGö‘QggÛ+ó ÙyÒ]¨Ue¶ù@ÊaÖI´ŸÔR|€®z"<ùâ³lÍ/ó>|ò¾óCø3q©L“+bž‘:ªÝ÷º³ÂA*%½’é>axøÜÎø*¢g;ËLÉ9~õ̦Ꞙ¦Á0[@ÄÜ*sݘ‹<4 N^Q†§%+ªTG¦ªà%_^™Á·“Ó©Ç ¿C¡ýMH6pC»œ–ô !&P)B8P“p‚kàºg»Æ/3äKŽì3eVU¹äÏÌÀç´©ºŸØ_ªw·š9|‘È€9¶/ÄÁð·bð¾EB\È-îDÈÂ+µ4'Ô6rÙb +4ŸXP’Œ’åj õå¸;Ò"ÎmDœ]O„ùìh5vLl\ ² -ºå9"¨A Ѳã TÙÕ$Ì0…E…öJ¾O¨õ÷RÀr[­L¸kzk T»“Œ$fa¦Eû~íËô¯Šó奬ˆYûஇ,á=sý1;Y'¨Çä)‹>¯ ð*{´ !¤ô5¸bøk;>]'MU÷¶—ýxvF¢<ûc`â((_¡ªˆÐAHÏrY‰í“^ЪÇ`‰|1ÚòN+Œ\»ÈœÉ£Ô1j%deûˆL +TÎöoø´„äl»ð»ñÀìéæènbÁÙaý½ìë ë1m,¨}«qŸBÌÓªw”„Nê7q=M›¬27©štg\ŒÐLQìvHì1 4‘s7ÙºËKÊJ¬ð:?½÷>r*[¦Nƺ®Å¥päc½i@1GåÁ>î/Ó¢àýTTfÞÚ’^©»’³ÜZ¦¾Ý-Ó 2¥Ê#¬ŸDÔOc ùÃ\sF£NÁéy!øx¿Þg²£Ö ¥úÑMîÁlŸϩŒ#³~“•ñªð½-¨ ·ç ±Û"LÊ=©*Z_;PÇù 7æ9$iÅ’"ŒŸ_7žÓ*Òÿp7áÕ3(œÛ7 ¥±qõò€¤^É©Zfê\*µb0kµ²”È7žX>{ÐF˜7ŘtÙÒÛ„nsë ÑÜÌ*ž²v'Ðõ”ø<=X[Ô|ùÜ“[ ûÈéùx…»ÿ_;sþÏ„ÃXÊÑ”c™ŒbîÌ54·Œ9"ä¦åÈæ>-9Ã\!ÓÌ‘_,aΑ4ä–ûÈ™›,úºß?âýíý¼ÏððàÓ6íŸE[nü`vˆ …2Œ·+UT®ðomƒ"&›±WYj–- +oáÉç¼ù;@ ûñ­ P°ù’ä\ôÛY8U¨M…„²E”ß»?*võRýã 8±Eþ<¬»îÅü ÃJÎÁ•´Ü‹'gÒUH´V ~®Ÿ)s&B"ÔJY-ýÀP{§Ù–Ï= üžT4+ÎË&@aºé(ÿžH} íÇ}rº¢¹¢Àæ@ÿÈDíÀ•êíí¹7Ûߘ=Ûâ™uô´æÙÕzjk¶?¦¼gK^3û î,ÁÒ–Y JA-p•"|Å+>X,zÇäâ² bÕjUTmßz­%⫺ÑY°%7#”L;f®9,—‰ù;íÛt'9‚60U•ìK£â×üKy:3@¼iÐÌ5º"šPTY«z/BrÐ[`8IÛ^ŸÌ^Æ{9’ËÓHÃ9Z•3@¥A–÷”9ÎÏ‹Œñ'Tf´GRFº²¶Üµº‚Úεa5Oˆ³ÃäÞš7zg­ZÌ;RÚ°ÓU½®Â5uÑÓÒŠ‹;åë¶à¿Â‚ÙË0‹<Ѭ3ù³N×8ejn¢ÈÒß"â‘3‡æSSCq$½Ë~¿ƒy‡»/Þg{ÕǨ´‡;•uòøz#­Qµ<Ê”Ÿ6ùPTÔŸ~·ÂÌ`Ñ‹óœ¥ß:ÐÄ 1[bŸù'MˆäBôÊ6Øø©]WðÞæ£áRLè,BBù0<“ZkŸ§Gß\¬ggúM BzΑÆ`4aÊ»^žV0î}ÝźÞ#u†¨·¼7—¾aŒB7õ'‹hô¯·°u ¡öH$Aju+z¬ñ)ÞÒ"õË{ÑX+þsÞt+ÙÔ†­šß˜›3ýÓ¼û!Ð(Ò¯( ðÙ8"AÙlö1œÓ£ÓU‘ + ÿ¯Œ«fŠe°IŸj +þ0î4ˆZ™áÀ¾Fõ»öEe†õu_Þˆ'ë_ Kîç®ÇÞY˜—±´6öÏË8—Â$œÎèE|šÄú$} D…Eeøè”üºD¾ëQ&FMËú6…ë|–!–(4j.[ÙÛru>w2œ»Óv'Là dOYQGúí-æ)ó“s÷šÖ&.äºÍi¹UfTFZ¾,°àò|…'˜¨%4Ô™bU"a£k¼×Q Í à^U*àw~ Ìq$›ïݱjÌï^BæÒìz†…VÜvÅ„\J½~(&<’S5`¹òù_Ï’LسÁ³¼v•¡¯µ/Šz·²ÔËG-E”~–!_R4…ƒî¶‹3¯%„Ë”+ëVðt´9ÅgµVOÿõ*$|Ðõk”^(t›»ª«{{RÄ +Âb¤øtÝ“¬’&íß~Z÷#Ž}5Ëm òuÈiÞ$áÚžWC RÇœB]4 „M¿ÚÑfÕÙ|ˆî>2´¦íÄŸnKø0º½à¿WEˆ;KʪIŸd8®`œ?¬±¯³šŠòÕÓh=…ê ‘æ‰ûkì7¢“ý‹@úSá±/eÆ]EïÕ­+LÒÙTäΈû¿>Îîm€ž}Ïè}P*7z>Ù7`eQBˢUÚ÷(ž¾äº„ÿ4á«nIz8ã™Õ-8º-öpêu(?éšaÃîÆ§Ò q™o"L­•‹§O?ÜUOýêõÅRB™Ü9{{¦ÊËÕºš¼¿«×”ðÿ@Ñßßyh+§"Ø¢9b¦É„`BW  +o/ôéMP 6¢Ò¯tî ³ISgtî‰þò‘}ª=º) ñ®-pn&LWéýê½ =Û•ÞR ÂÞåüê¯PX÷h1³8!>éá¶ë/XÄê.]qݬ|HòàˆÓ Ëð²y¢=?²pV¯s%¾üRå•bw{Œ+M¹XK“w=ê|X0igþ§ùûÐfJšàu„ç‹Ûç|Þ–½ÑØi¨HNvÚzJßqf¦¬ƒuß5‹©\J¬%ŒQ¸Q/k"$ø°ØÆW­½½Û °§ü¼5íª»*TüÙ¦ udeÄ$ýt R“Љ ¾ù+䙿1;L×qWñ¤ÂÊ îÍAjØZàQ^¾g™BQáÁqŸ"Ò &—~:Y.|ceǹ¬ÉÓß|kÄ$Vˆ5ÅÃa} ®eƒŒ¯~µµDù¥ÊÕ[È2an97S¾¦¿Š£ê ‚?2r¡&_î€ì÷A€J28Z›”öÌ¥ÜÎ4Dj¿³y— +Ë&ÄLm¼*åŠgèM¤œ•tò!ñ¸°›€)ý¾ß²îØpßù6pØêÝ0®0¦û’‡_aˆ¸O9\Îó Põ pÍWÅJ¹L²Ý.ûWµWAóÖb†ðyÈ­Ž­±Ñj+à©0·¬Ÿu=ÍxW×”Þ;ÛNß³à„é•ÇÈ2WpÒ‘ŽJàà›»Ó2䫃UaíÓÇ64_“u㳜*§˜YER{ üg|ÝowÞx{¨¥7 v±d·`$ã >¶àŽq»ñÑîMº `Æ]q(×ñ§^CoÝBj'^Hã¸ÚR¥$³Ñƒ÷©9õ_$×éÌNŸÇúf€î@I0~"Ð5ri¶ÝQâ û/þüOÎ^®ŽA¾ÞŽhÀ¥½@rendstream endobj -3360 0 obj << +3455 0 obj << /Type /Font /Subtype /Type1 -/Encoding 7222 0 R +/Encoding 7546 0 R /FirstChar 11 /LastChar 122 -/Widths 7223 0 R -/BaseFont /YSKHFH+CMTI10 -/FontDescriptor 3358 0 R +/Widths 7557 0 R +/BaseFont /TKVJOG+CMTI10 +/FontDescriptor 3453 0 R >> endobj -3358 0 obj << +3453 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /YSKHFH+CMTI10 +/FontName /TKVJOG+CMTI10 /ItalicAngle -14 /StemV 68 /XHeight 431 /FontBBox [-163 -250 1146 969] /Flags 4 -/CharSet (/ff/fi/ffi/exclam/quotedblright/percent/ampersand/quoteright/parenleft/parenright/asterisk/comma/hyphen/period/slash/zero/one/two/three/four/five/six/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) -/FontFile 3359 0 R +/CharSet (/ff/fi/ffi/exclam/quotedblright/percent/quoteright/parenleft/parenright/asterisk/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/question/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) +/FontFile 3454 0 R >> endobj -7223 0 obj -[613 562 0 882 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 307 514 0 0 818 767 307 409 409 511 0 307 358 307 511 511 511 511 511 511 511 511 0 511 511 307 307 0 767 0 511 0 743 704 716 755 678 653 774 743 386 525 769 627 897 743 767 678 767 729 562 716 743 743 999 743 743 613 307 0 307 0 0 0 511 460 460 511 460 307 460 511 307 307 460 256 818 562 511 511 460 422 409 332 537 460 664 464 486 409 ] +7557 0 obj +[613 562 0 882 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 307 514 0 0 818 0 307 409 409 511 0 307 358 307 511 511 511 511 511 511 511 511 511 511 511 307 0 0 0 0 511 0 743 704 716 755 678 653 774 743 386 525 769 627 897 743 767 678 767 729 562 716 743 743 999 743 743 613 307 514 307 0 0 0 511 460 460 511 460 307 460 511 307 307 460 256 818 562 511 511 460 422 409 332 537 460 664 464 486 409 ] endobj -3225 0 obj << -/Length1 1429 -/Length2 8725 +7558 0 obj << +/Type /Encoding +/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/exclam/quotedbl/numbersign/sterling/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/dieresis/visiblespace 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/dieresis 197/.notdef] +>> endobj +3379 0 obj << +/Length1 2074 +/Length2 13723 /Length3 532 -/Length 9604 -/Filter /FlateDecode ->> -stream -xÚí”U\Ú²æ‘<$4îÒ8A‚»kÐiO°àîNpww îÜÝ!¸ÃôÞçÞÞsgžæ7Ý/ý¯ªUß·j­Õ”¤Š*ŒBF`8ØÚžÈü‘S‘²€L,È””"¾½ØZTßôäá„L¬Ð<çGv–¬Ð"€ØÆbfbj ¡ý«ˆ d‚˜ê[äôíMAVІú–°¡ÈÞ… di Pþk…@d‚8‚Œ˜@€‘™¡=ÀdbfÌü—#)kc0€ë_a#›ÿN9‚ vPS¨IZÔ¢ØÚÒ`2Ff–Cµ@P'ÿ7LýgsqKKy}«¿Úÿ=¥ÿ‘×·2³tù¯ -°•ƒ= ÖÿYªú—99‘™ƒÕf¥ìõ-Í …¬M,AF&vÎ…ÍìÄÍœAFŠfö†¦c}K;ÐßqµÑïo̪Ò*b2¢ôÿuª'õͬíU]l@–—ê¿øÂÐAÌœÚ,L,,@h!ôûß¿tÿCLÌÚldf ½œ}Dßz? Äø˜Yœ g¨cf&k°=t :7€1‚üס²q˜À––ú¿â‡ØÙ̆`++ý—€ÙÔÅÆdý‚®³ž(Øè%Ä`¶³Ô·3}‰p˜¿ à—€l ú7s°˜í^ò@(›B@ÿ¨`0ƒ^Üq°AfŽÿ¨€Úµƒëß 5krü‡Wè`˜ÿuàÿŽ@­Z›ýÓ÷_{¶¿,ℶz!h á‚.y!èZÑ‚nQìßÄÝ ø A·'ñBЭI¾t_R/U—y!¨ºì AÕå^ª.ÿBPu…7T]ñ… zÊ/ÕSy!èU_ª®öBPuõ‚ªk¼Týó AÕ5ÿM@è…e~1ú˜­ÿÐ,øø×±ý¡¢ÿ:¯ÿù¶„…ÁÎß9YŒ¬Ð ²²AçÅâö¿ªY›Ù:€¤D¡wŒ……‹‡û﨡²¶ÿû/ únÿ›Í /r"ÏMƒ y}Ìãký -ÜÅ²Æ -híˆó|†Z}«y™–y±~CêFUAÎ0}1ÍÍŠ0âŽdJ˜Œ9Vß× -¹ö~WaöÅìEáÍHRA<1<ÐуëKëé@·J Ü™#Ù´©£?™'¿\qlE(“Ýre¾? -zU03ýxîná1¼:‡’`D¾‡¬›Ö$ Rß]‰¼;”gçrúðt’.±ŸæÞw,MX,¢%ò§ÉÁO%ò?¼a¡u6^F&[Ì}Ž¡møý†b!šrî÷¼èùm|Aªe»‰ ÇÁ°©Vq¤0ÒüSop5Á3i"F˱ üLm¼ãns;»+‹3ŸrY.z«‡Ý†ê¨Íg's²^ÇÞôš"µ[¡“Ž¹NHL›à7ŒM{ÞaœO -nOÛ"¼-Á gÒÍ£È+Á90¨?àJCäÏ~-Ÿ~ìv8­jª¿áçuVŪ§7yN÷/ÓÀ§'c¹=öõøœ7WÙGöüªÕrŒX¤rÀæsoƒÊÕ\ÍôÞ‡ÁBeLÍò­ŸÞ %qÓ}}\òWÊã¨è;¢þÐI º2F±<”ë×8ë6:ÛÈWx:Æ«´…‡•ã[[-ú\Sz¶?ô¸+˜@ÔŸæ^ËLnÖØVL¸fo¦{znÏ×1o\}Ó -8*b)J½ + ï¼ã[žEY©ŸVÜ*Ý:uï‰ôDtÓõ“tÊzy3Wô]µU,zß}óAFemÑÈÛNrCû‘Ô >gŽR´9§õn‚±çÚPDL\ÑCž´E–…ùó&T{/©áWG—èc¬òØbzB ï©ã%æÈÝÉÝ‘«DMÉh¨Ìå·/ãÕ±_ã’/»¸¤¸^¦K8^K-ÍÔ¼¶ŸcU¶”9Y7jÝùñ¶ŸË§®ÀƒödŽRbí#ƒ³RæΛû©zgEiÑ?áê9 «‰ûîÐT#Óµ"ßÐNeÁ 4`o1öt·}-{ë8} ݇3/ðšŽzi°ƒ•ú ëõŠ Kªä6GRy—iÂp&þ¦Ås0Ì¥|q3]‡AQ`ˆp*Ær~>©•këì§2jcçZÖ#Õ‡,L ›k^ñW ª‰EÄSbA#vråw6¦×ªë°‰³L]$7¢ÁlÚߊ`Ïè¬t€àᮤha×°w6±`þxývÚéO_­o“µ–£Ó|>s"<üæô-TÒ%äœÏ´QÁ²3uÎ#Y!°nm2?ú!%k×9õ(«.Ëö;%R [î'ÆAA°Âã>£hì0â–)ƒŸæ©GB¦ÊU†Yk/ žã€  æýj36Ö%¸ëÞšñÎJ\ž(Ã./'4ÆÙ¼»F &äÑpú -™¹¢uÇ6„©½¥ñ¡ƒSg°Û¶ÎP…é—/\ƧúHßùdµp×÷ “Ø#ôý÷˜ú½õËîúiɹCÙGåûZ¼(cH`æòL”†"pæËG%ÀHØ„rä#¼bÍ -aÅ})ec²¥rð²v£UƒÚÐU¡v“Íš|)( £™‘£ÒÌìÕóbk‘.ßÔ›B?-žîˆ#‡üÕ„úC§±.ã Ì£v¬¼7Xwnª‡ÃÄ÷$ ™æU”á¬ZîÀ!ïBª²Ý3¿Ç´Pæêx…ÙÄófóñuÜS<ƒÒç+Rå¤zíM—Ã? }á|‘ìÊóp÷„þPXr-©ywUÈx Ôµ†EN@9û•«Ém¹ x~*Ê "Á5£ûfžƒSîu5mð€QúìÞºY‡åófüù>=úRû;ûFGà{A$µV•“l—æéŽøÂP2„‚ñJI×·±Ñ†$ýÕÖ—¼M‰}B*»±,¨‰…˜ãWýÕ0¸“UA $-G VÞåèµ0Ê¡ -`¯³€³çCPã¤{>€×2Ñ$c!„âd.ýõHa¹8¹&u&a½Ÿö!öâ. Ûºû;e벺aدD¦fŸa÷ã4Czx5*‰Zol]ÏÖÃ汤õéõÀÄ|aµ -êú’&ζ®ß#ä]ÂRatírQìù©àiýh)Ã>ýA ®ø™æÆê‚í`øÁrÉ*÷C÷ž®‡ÙDÔf'’(öG ™Å÷^¹Q‘&o8 ˜2×hc1j«·£'áºSA­²ÅB…µ÷ÉgtÍHÝ´™i(˜žƒµ+zn„‹çÛLRÏž˜Ù„Í Äƒ†ëÓì-²ôü>†?̳œÓó±ãŽ'NiWJ¨ÓŠ]±Þô¢]Q•÷Ý Ú Gµµ]”ö…Lô$˜~]âö0¾Ìc,g6?µÏØæˆ8VŽ &Pˆ÷ÜœPŠþ6£#è)6-ço¿Væ W7)‚ņ-Z#%ƒcVÚr 7=³é.Œ„56`)…da×-¶ngg;GL›l-n•þ÷ïývé¸ÎzôiRþå¸ZBJ?0ÖJ’ÑÈ`Í÷mÍÀÁ:ƒ#šŒéŽ@užQ¯÷¼âìÀ%µE£&DbxbfØó´)£ðu.KÎx»^`ÚýÝ^oÄáåŸàת™b}ßoÎ88õƈ -¾‹…CžoÃ+h$š¢wí§·qÈÉàchSjÖ9÷êÑüÏ·L±î¯ð}ŠŠF ó³® z‰àQ“[°çkO:Y–¦$¾ ×ÀãÕšÛ´™€µ‹7Q®ø‡Ë'ô;¦7¦½$ð˜ -+Y‹4¶Ò–<øçÒ½>ÏrË i‘o®¶,ù¿+ÔslF¯HXÈëÇrÎäK$!ÀÜÚuÜBB–’ñõ·A>û!¨¦&m µˆ» Kœê“™o:Ö· {³ž¢#Rè-÷¹fª¢¶ÂÚocÜ®[¯S²Z(Í_B•Ó~ñjµ;ùÑG5íÛµË/ˆô6¯C­ç¦vS•×úšz@÷Ïáè>Ƙ®1å·íÝ™£  J ÝRM7ŒÖMÏ„ÓŽ«*çý’Ì,‹J·nAk0ð»ß|ßPnÝcX¨¸U®'«6Ñd8.¾¯è1¥9ZɪÜÕ4æŠÐšá¦£lM}·Ï$ûL]$‘|I_@Ã}X9¦€ŠUšõ¹*­ÐŒä'̘…ågT2º°÷®wê -ÞõíËn2Ù]±Éú ’JÌu“)$ïŸ<ÄÄ·ëÎÖNí".Ë ÃD·ÂytW©h[-©6p"î”­±D@¬[]‚ˆ›V«Q½¹º‚dÀB!ŒSÁ [²ðÓ)Ýî]ôAmÍ'\Úìnó<£<‹i˜Ù!Çß{Ý7€³”þù#áHy\`ä†ÓåñÍQñ©Úû³r)˜Ë]Ñ Ö#u²mÕ}D±õœ|÷ÚUTfÁ(I„\­Çšü Iè -p„D;âêôëøck¶‘ л-…bé92<Ãstñ_© Òˆ˜×¼!0QãOþÌj_pÀõ©¾üýÆ.ñ¶•äß[u‡­ÍJ?ÆcÅ•Ì2“u>µÁ‹)Ÿ}IPõðð%)Ü«¿ -xÄõ‰=Ÿ%ëÂQø$cµÃ—ý¸„nAëæ®OH4¡6öûÕʲ*DÒzŸD‹hkûšŽû5Щ¨òŽµÆƒª°åUÂÅ Ëâ’P–ŒFC`\Êt¸@QoYŽ–‹Ô«œîñ$ÛwÕ+$Æ3²Ê°ÈçgT»&5pì{C -ouüéÜ° æÒ+EBwÓ£ÏéJî2ÀWy£H–i¸pWc…w$BÕ}çû÷ãÓMþʘs5x ˜#šÈ­]}¢¥0‘rvIo6Û˱Ñ)ùm•éúè›N‡P³ý‚>,ÎîØÄè™ÑõW¾r˜ºwu$ÚC’+]ùNŒŠ>9s'røõy+5ÚŒªÖÍKeíLåF:ÍŒ)!°+l÷zXs“Üy[7~QluGÔeXS«ÕýõHP˜N¼l“©R4´¦1oH"{ý{eÇv†‡­¦HÞÍÃwþ„¶~øÕO54Jf`jÔ`x•|zXප̡=cžõªÞ`ÙÎoG0#ìóä:ÙÖ¤²•íl{q3ÒHtc‚³‰ccéÔÍ¥§;3#NX¿¿6ݤ¬žá,¤7€#úD÷ÚC^‹Þ¯eVIȧ‰!ƤäIrɆNŠ7Dè1ô‡÷l´RšŒ4MlóB#¾}µ×ú„V ê„Qùî ëÖ’já+æ¦bl„7+û¦)8éoîtY*Š9”¾âߌæÐ%^û·ÔkO“¢*)ß ’…:õ-ª¬2Î×­j¦Ÿ4SÍr-lû‘°Î˜Æöꎔ.)-ùƒ€·öåC%ãzÅFs>BóêMè­‚áÞž~ôû"¬åyð\­³Š8ÖD r«Z[ÔT?L -éKj<„¢fË`æ!^Ιž³™ïNUÖ0Btj9»4[hæ&9Ä3ãXàè#ùO¸Kc:ÄÉ&ýÂèßîŽ83aëÏ·åSàǾs,–YJe MF4ÂMe7ïW9áÿñöKʺ€Sÿú}(ö7ý…x¬‘Á åŒÞeÌÂ{YßÎX”Û÷þ=Ö0¨ë¿1·›yÈšÎRÞ¼ÍTE×Ð: -6éc“DØiáaôÞ™=¸ûñ-WÉ.\Ó³6RàRªXŽKj4¦"h=_ïPAmàáÔkÓ5pUÕßvBûÀJ°z(t–—¶ô{ʉ/¡3·ÄÏ=æPµÁªïx»[œB§#œö¼hØ… Ÿžeóc†Ÿ$ÌRß'&nYQ‰¤ød-}åùtÅaN ¾ -–ŒÜàõôr:Ìزñí<ùçI­lx¯ûUÑÀžZH7»íÃÃãÌ Æòñ@ýãB?ᶋxEê1ƒÁk÷qâ1¸ »ÊK…˜ÉÞ:µ„AMð—?ï–Õý)}#r“žƒÍPÕ$’Uع¢ÚïÅl‰÷¼µæSŠ©Î`ÑOçEr~œ¡M$ЬÆtl Ya³ÌÉS0ð>­™ØÖÙÍ ”/eîð6&”)IåÇIâì€U­Rei ÓtGúiÄòäó[Z:"öO -…Êâ±ÑÙ'ǃŽò=š1N/96÷÷;ƃ¶™fÙOdÀ&Ó½ÆEÉ ÄÕpÕˆŽ‰ˆNIåûr›hUù$w~n3G†^É>©Ú–²qeùaOôPvæ#‚!*½+²‡¥.ÑbtË”¦möÙm£Cξ¯¶¯;y‰B“ªj/Ͼ´êðE71± T~Hw¯dðrãNKÌeôÍ,‘6jï—†z$¸ûÄì~REÔÈõ°Ø*—c¦†{â¯>‘/~aŽVÓÁmxÈ¢:é?ÍðI£™bG¥«Ù ôîG(Í_ÜöPD·d)ß–ØEN(Z¥²dÎ[õYç:‹NÖÏÞÀie£™H*@ÕgˆÍÚfîªÒ[gÕÖ§iä`ÆZlÓo§¼c“š²ü¾SÍãåGôý‘r^ÇÇÍ/VìgœyÍWàAlúŸÖÂ(I9E4NŠÔr‘b¤`â·~Tp`SD€°àà˜Y@?q²^Â.PNÙñ+€Ë„“}×o<>ä㶠-ü¢e•t¤ -ÏÈŒ‚ -R(šÊ÷:íOp£žä»õh¸ßpØ#ÈôrOÛ§åÞ€¼ÀR¥ÇÚD©•Éö@m³* ÷d›·OÄ¢€ãÝûþ™tî™vÄš1^öMÍò‰ ø@ª™¬W'nÍöó9FÓùw®~{£ëiz©C¹£¯7ž:û˜Åxg®&áfC¢ËÞMÁ‘yìFG}[Š &GÅ{SZ%H³¤E¨Y æÝx—²Å=;Õ5j™a7L›N‰7KèGø~Nj R Ž_Ï!glaeÇæ‹·> -RõR×ï&tiž[:åYVŽ6É?¥ÊJÁÀLz¤%?Ø-N”£\“ºõ}žK¢VB‡o+ÂÐoëõ‹rÐU£ñtÓ àÎQMÚÞRÏ„R7HìJ¿“´ýœ.†qŒa’ïý{yT|Îo>ï¡HIiL>}œÇwåuË}Á® {Eå¬~ø–HÜ`™ÿ>7d×3žnÃæ㽺¯Ál5éŦñ¼‚m“ÙtáÌ3û\åǺb"ÃVž3Dì|‰a‡½¯»Ð%ñÝøº=@æRö‡¡‚ºbö—lz»ñt €w_D•n‰ß\>ùüÓ½ÏÝwõÈBDƒÉÅVÁ Ìï4MÜt®VQ†\ÐÛ±c3Dêå;xÄ,v“¼ôÏAÜgušw6é&†E‘”Ne‰Næsˆõðt;™‘ØÂQ1ÃÏؤu˜ªbðWb¯³M×ø?½âûæýÊð$›æÞAî)欳[ð¶ÿ ¸î «¹½ÓÉz͵¸i´EuŸð-™‚¡$) iÖ€Ò=9c#Á=›ÿ›&È6¹VïÉqÜmH"³ï2 99vVaïQiȯ“+çCa¢ètøºÇ¬ïìYH“æà’ù6ÚžwŒºa}•Th`²ë-,9'{ô°3­…Ñ -ï_œíiÚÇ5•š-ZŸ£„ŸèéŽÒÜ>d` -F<ÒgÜžhtGïæ‡ÎÙÁáYÓœb³Á!ÑûFV#†j(9Æ[zîuSsF·åV'ë¼ý>¾ëÒ]j'S½ÀÝþ"×rë-ª‰ÔŒg£ êJÑêSÖ°—k(äÍ@Å4KŒêº -†¨‘®VQmw4ö3c8Ö/ÆŠàºøV»òß–êF…$ôP {á¶U¼|Ûlñn´þôçðäíáំGyœMåa[%#¤ŠR2¿nŠwÊ6ÚÖ÷i¾Ê¢}‹LPhUÆqÑ˼Д‰n=Ûÿ5à@¤Ác½+ùªS–cSW7§kU?±TžjͶÊ[éµ}ºˆöȱ@/©å=_’dÅ±Ä úàáòg‚áÌÚ\€‹ýû¾Ç‘¬ón™$ü¸Sã‚t¸`cce+}zW7Û¤S30šä€Ì°lZÚW\׆ÒÔv‹I ƒÇOä÷%ó=nݤòsï\V5¹”Ëh´sr•yÇá>m=5*¾¢lÉ¡d¡#Äk¿ÈébœÉ-¾¨_Ò·Ïs4 8½‘ÎܲcA¶ŸŠïŸ…Ø$ –ÜèºI¦óþµZ|ò<=aõ'Šÿz•ÁÃ@ÚAG…Eâ0¥Užc*ø-ÂÚ8Ùòõz—ÈŒöÉYMt}¹ÊÀÜ8ÈM” h§ -Sc›)(ÔÁ?á˜øµÂœ…¶£,™² EEMñµs#0,©¹¾L:Ý4½2ñ“émA¹¾„fŒÎµ«†O>ªQh)A„“ÿØ·ËÏY¿žÓQnóÇÏië¶dM‡ê"A#‰!FÀ¨Ë÷ÏRé²3kçRJÖo¦ë··–LO‚pø}¢l£Æ6'ÓZ‰¥õÔT†¨ûj‡ Þ÷ÏÁ>Iý©bÙ‘¯DE7;ÐQæJ¿ôý=§1§¿Ò£Ñ>ùM£ÊÛXï•×ì<Æyþ9Gie?L‘çœø¾!=1AéºI„ê³€5A•¶QÒ¯Ô¥/ÌYeúJx)Œ¦Ø`â§WFM‘ŠõÉÛÜî¿0û™¶WyªZ2juÚù7Ê0•½ˆ~}=}lá:¹ ô㳎¢Ò¼Ã¹ªXõé V øŽ(ºËÀ<°°"»öˆaÿ§Õªè »þPÁ‹d6°^é^&¡êYj!Ì)Š4:ìü™;<ÍëãÜñ5cS‘ûj8Ê6L…³Ó6ÈSPZ>ÖYïRþ£žë¾¿ú1QJ†Úë4 qžõü•ï"Í$moýk¬7l÷4F6=ÃêÞ1æUmâΧqÚ6ð' e4Æ1ž‚ÂkÎõ{7´Ž§±í¬©ú”™3:klà©'âžnž_~n›ºˆÐMöú˜mJÈ-Úm§ÙS£µM^¥bÝ®ê( ßÛΣô¦nÈÀÊ,ì‰ÎàœjH¨’õkœ–m/?Ø ý´4¡ò4òÑŽµîuÒˆÂ7a˜Ia/!N¹ö*Jvå5o€o®?î4Î_%á;NŸžÿ’™+ö% “• ûä¾Þp¥òùC%ÛÃ~¿ûÂ×0©JØiåõ³n¿‰p -=­?JdQGº?Ñ:ûõkÿT®ÜœQ䢄YœÒ„ «¢Í¼g‘ð 𭋃Xî“(fĬ°c$ÖŸ!de_‘iiSEššöK?W3~Rö¬zrkžgAQp4Ìtv¢Õ~ Þñ|Ù–БúÙ™©º¹ø:/á÷ÕŠp/ŸKuDlvOö5Ðjä}[ÏU«ÝP¨ø#iílÏBõrÝ|4^ÃÕVÌùÉeI£ÁjOo#nî9 ¼Ñ¦ìz¹†9ºM‰§îºë[~Ü"£<°(“_5®ÈSXËŸ¥"š˜}îׇKÛ‰ôV»ÎoLº¾á—<3Id|´°#9s°‰ mZUš¸'¶Bmù|õæ½uO´Óôaø:a­^™‚Ì9B°éƒú-W£W ¥Lûø‰è>$‰eÚ«¼ŠÉšM¼_Nóž•çÇ{ôy¨ÀŒ®wQ`ÙYÉÂým4ð4YÒ,Æ'ä-Ì»ÓÏ3,D‡r~ûç½¢Qo,ÉGbÕõàF¸ìYWHÖA± -±mQG‚20¿Ä« [•±o3PÊQ¤äDT>Õøño󜸇£&Y‡áïp :ÎÄÀslÅâ5fÎØÝôª0RìâÔZÖc°ó{KÌœa èÃÔ –GSÏÚGoz”'S!:2ÎÊÚ÷›ÓQú¶™t©p½9#‘÷è(6ªøÊàe>ºÂÞð[ÀÞ–„aP¬6Ržtk¾Ïšqˆ‘!Ìá\lBâ¹±é1ž„üØz½0Gj4ÊÍÓýi™ßòikë„1¥Ë¦C¥·ð¢Dâ -?™-i:Ï ’gꊋ¿e~5Š½þeJÞš˜z*ä|sâsâ^‹¶~VõVÔ¿rQÃ6ó7|ȼPí ¥62¢GÇLE3A0wÌ£”?¦ê3bMõâĤ•Ô‰ïü^k›!Ó5†ìwèh©¶: -œw"‰t;œ kLqŠ:Sð‡ƒql]W§ã¯‚QDã““íܬÙŸ±dhœnÞ|'ÝnPûE_õÕN“.kŠ;“Øm5æýyÉϲçÄ^¯ãFßÆq³Óë÷‹kçùêéî!!#Ä.ÜUX'ÁôŽ™;“iÁFÕÕe‘®Ä2sm Íiã],u"\£Ý±ÒÐÈíÚÿh;GDkùF¤DùV‘9Í¢Ä÷Áÿ½TM—öU¥ª?×Ǹ~Àô§·ÜªÖÏŸ³XöœÃ~ŒÒXä,Š)ýäþ~r¯5=xñ–0)6à|òc^!‰îœþ‘¦-ÎíŒç”ìŒáÀVZ6Z~b¿.~BÜk9á?*â¶0Ò=8m ã³éæŒÒ›Ùp3#ĪR iµ˜r¿f1Æ1`4îÁ1ò°ùüÜN’Ã4U6ÕCvaÌ8Ýr÷”]ž áþñ<(BîÇöša§^SøþNÜ¿„_˜h±îAnÔˆ%•PËúš1cþÁnG¢š³'²‹šìXs×,õ >A4|‹Ô[¦;Nâ«Â<øÙ€…Ø|¶Á‘–n`±j¥ú oüËõÎÍCTtu<Ê0 q^1VtŸK´Ã÷‚vÂLŠs¬1ò„a½»â>=Rm9ü‰Ô²/óŸ¾ø¤N¤9Ç8ˆh¼‘¬SžD|WÁ?å ¢ZΧÍXÓáxíXYDžËÖJpóÿ—'è¡ ÑòB*â™kMÂS*hVwÄ{婲Çqu­Ž&'«„ˆ+^i$7ÐJ1á)—cí4#Ra˜ú¾YœO*ÄTþ»Ñ¬®Æ>ã—Ô<>IÚw¸MQ˪‰?+gg!Ÿ3ç5ïXþ?Èÿ¿Áÿ -Aú{°•>Äù=ì`qendstream +/Length 14869 +/Filter /FlateDecode +>> +stream +xÚí¶UXœÝ²p‹$Ü¡qwh‚w‡§Æ¥ñà .Á‚{ð ÁÝÝÜÝüý­µ÷Jöþ/Ϲ:ÏF½õVYsölh)U5XÅÍLAÒöVN6NA€¤’œ¦&'€“•–VÒd;ØK™@@‚NN€¸«%€“ÀÉ'ÈÃ/È MH:8z:ƒ-­ IÆ’øâv g°™‰=@Éb²ƒÖ03±h8˜AO6€¸­-@ýŸ7\ê ³Èœ •“`6ƒLA–`{Tö”äì-|ÿ›»:þ÷#7³ T +À•d@Íìm=æ Tveh/Ôäÿ ©ÿ]\ÚÕÖVÙÄîŸòÿÓÿ•`b¶õü¯;GWÈ ä`r¶ÿß©: Û)ÌÁ®vÿû©ÄÄl&noi °rò°qðü;v‘{€ÌUÁ3+ÄÙô¯0ÈÞü‹@§÷/ v)=]æÿÞ×=U5ÛC4=AŽ?éÿbÎ? ’3Ø𞃃ƒšýýï¿ þW·wöfæ`{K/`âìl≠+=APâxsÀöæ ÈjÌÎfï¾€NÆ`áàŒú϶rsØ¡mMìþ‰ÿ;Ä`wru€€ÌMmÿyìö®v¦ÿl¿¥ýŸ0€Ýäl²‡ü‰ñØMì Qèlþø¯ªÿ>ÿæá€0qÙÛ‚,þŠrþWô%sA+»üSÂÅæOºG[W—?¨¿™ƒÉŸTÞÊÓÑ +ôGœø/q°ÃCèZ\lM\¬þD +ñ9;ü @á`úóBí!îžóB½!VΠ¿2 Ê®ÎP] °Û_P]èfÿ‡¡². ·¿\¡Ëúƒà…ªÚƒÿáÿgͶ½$ðO;ðÿŒ¡‚ 'W“? „¶7ùSí.þ‡ %þ´«ä‚¶”úCÐvïþC|йHÿ!hS™?ˆì‚ŽCîAeäÿÔEáA]ÿÔEéA]”ÿÔEå?ÄuQýCÐîêÚ]ãA»kþ!hw­?í®ý‡ Ýuþ´»î‚v×ûAomvSg3äœpîÿÄÿçþ×çä¦Cþ9ÏІ¦ÚÐì?ÄÉ]¯ù_øÏŽÿ…ÿœÇ¿ªaùB'`õBGþ ¡jÖ!ÔÉæ/„JÙþ…P«?w +'ôúc·ÿ ¡V!ÔÊñ/„Z9ý…P+ç¿ðŸÈ_µ‚ü…P+׿jåöB­Üÿ ÔÊã/„Zyþ…P+¯áÿ}ÁKH8xxCWÁʽAÐÓúüÏ4-{°“+HN +zKppðAå?Q3Wgèµù××*ô«ã¿Ù ý²<@f¨‹sfBÁÖ)õ¡%¾ïò&J]HS‹‚GÚB¾§ +±® aÏ87Œk‚È/°B°¬Áeo’ÊÙÍ-x7ˆêÅ?ö{k°‡,`õ¿ÆeÌIÓ@>5;ü`7Õ×…i—±»Hñ˱ùt‰úzÝ­ ±RqŸ“/—è8¡d~îéÒ×Æotcí‹9õv2ªAÖÅ$öÞzìðÑŒCžÃbÁÁ‡´kœçE¢®Õ)›•×©QYJ0JÆ`Â|´ÏÞ$.›„(ñù›í©̘R™_<_4p30£¶.„¸™;ø„C}ñö^ð+'žç@³)) 6Ùj_%+QR˜(ãp¿n0¯ÿ©i6(äʦXíy—T•½¿ýÑÁü JÏrÿ²î&ciž¯i:o#If4lRv™q½€Dð‹ dÆ7Tw**Üpw4Jì˜8þÒöu¨—¢pÄZ¦¨^ —­rý¨–Éø~ªlˆ$êæˆM$’oó^ŽÞˆrúrê‡Oã›lúŠ#ä6ÑN®–èZ™ÄªÜ¼ŒYGû…üêUÑ—“…l=v»~G”YõŒÝ±Ç7I¦$þ~+Ï8zlCŸêÎÛ"Hs&#öi>ºf`ckŽŸK赚ND4dã(úy%ëi¯Ü›ÖµáÊççîÔö4™¸§UöÀ[YÄ°\Ðe)I‚ïøÎaAM]+‚”-æB^F!â|¬´åžbè{Ó.§¹£Ïüi”“æƒ^òU87âôñùÀäÎYõn\TëºuAÞ:wsÌ u"»ØæzR¹U{ÁW®÷“Õ'crà™ˆ’½µó²ZNÙ§VÛ2Ù¸æjªvêù0¬­Œ×<Ì.¼Ý˜¯«ŠÅ@ŽeXÚSwO“zK]3Œk-½eöNñŽ "e‡8Ž_Ôq=}›øï(üÂ#Õ ´Ž‹ˆ¬“v”¡«ë“2ÕlØ‚YÉ ì%oŠ?Ú€Ž—#jÇo C1Ð…§±¿ãæRH¤ŠË"$I10GK'{…ãI‹‹(T¦¼Ÿ„Øi¾ëÇ~ÁYyÑP²YÄ0ëtE&÷ZÈÝ×û)KeY5íŒ9v€¥;‹LýJ. Rzð€=™½HüýÇû•zú¶)«B_Z EÒi»ÕþXÙN—BÂg)¬(9þoÊ+:(—?î ´!+ˆ³ôò®©bŸ}b»7ü6d60PÇEì6gðÊca;ŠÑ#x<ÖyV=±{±ËUþ‡ç%SBÖ™g†jUO¨o¤}ŒPê&9aå4¦Ã«×ì²-ÓÍ[¸\Í¢èA´/W¦ŸC «à5o¿­Aü>§iqÞ…ÔžÛÛ YQÄ×Ö÷u;Q¬ + +8SöRät‰!\¸àÅ‹‚Š«Ë-†¢~Gµe–'€ ^а8-%ÜPˆMû¿í Ÿ$!ÃäcîÊ<‘~ÃKß±ž¢äõ.·£·„Tw‘LóL#!îfCªTRš¹v\Yv!fSÔÃsRBµ ÕÒ/P 5zṖJwÏ$¾)û€™Gv“ceÓÒâW¤tG¦©Z¦VŸLn–9[ù§I<®Æ{M5ï£+¿¼Ë6’m[Æê8ªtŠÊ&]ÿXfé2£–³g ëu7Hx„µn–Ÿ‡fC¯ñ!LºØ«PÇU÷c ò„aè7z8L ":›vCLØöÞÏU4Píf]ûuñE¬X$Ëï£Sqe‹¿±²¥É„Ø7ï²<×L„bÜC v½èóe.ê2žxÃsEÑÖ‘t—c•w\ZŠT¢1 +õÛn¤_ìÇjáa×Ö8qÑ«¢-²ñ6Äo¯7i‡j•³»ŸM­ÓwQ 6?wÑñ’Š)/Ÿ#ÐƯž¦Øüu»^;³eë»ÑÓ_&i–ÊÅw²¿ùÊ–/}¼.H0«ú¡¢þ|“ÚÍý2Ÿî5híK–HÞé•N/IÌœ8‰Ê÷iÔÈ©ŽaNB´M .½ëYâ=Õ4.4Z"YAðùèR›#ñÑöM2eãV§Ñ.B~Èñê'±®™1m×NîÙ÷ëåvÚ“køžâŸ<º}±ô×»ëÊñjdŽèG‹#rF|n=;JÍH-òwMi¿­naR÷u2h§ôòÙJ_|#ª³X¯?î_?rã`îöVgnøÜýt— ËìW$£åÑ€uTŠœ5´8À{Uÿ¬m|]Uô{‹²‚ctŸ‚XãítŸCç›–…ò +6á0oOËI¾.E´ÒÄI`ïáÒC=˜a/}Í÷µiEXÜÚd‹Û,ÜÊ×%ì&• F!ÐkÌ’ -m >PzÂñ’Mñv¿÷|ýÖ+€éNæ#kÑ·¤Øª@×FßÓ)ÃMêô"Y«ïe­¦’µ»•ó+ÁZ.Ý’¹e™ñ7AfQÈ$Hí¨žD¼øùïÚ¯XyÃFy˜¬ÖåƒÃ]{uipa—Ù\dœ-WÜc%¦-£@$¼yjH,AtÛËUä[iêN¸GºÂ@|æSo¬ +ãƒVÂù$X•–Ïô*ÍS¨öC£VM¿+È +¾"Œ .7Ñÿ¬TϪø™K# ÏÝkÛ©¡Óã ‚ÕCVOp”ö×&¼Á!¿*/L£ŠÀ¡S²Ø¥îN½BÓ«®üØ@qÑw™÷›Ý×U"3Œwg]_HŽœ¶üËŽ5„Fià3õ5ÑÔµWFx{YïÈy§f#®÷Ùϕů¥åŠ>2{#Íçï79¬ÉgÁ¦Ta|˜Hß‹A²·p*¤û +uOCŽè&¡Óߣ.,œøÑî±²7àc³JüoãÆ ‡k>FÌ(rüÔT„É YÂÁáséòëX{‚]èÑo¾žï>5`ó$ÛÄ;ÅñÒŠ¥~úè–dÝP‘gOW†{˜Š‰Œ—ËÒ¤@ö% öDØot‡ûÎ탣‹0Þ’HâÑ|DµÌçÄÚæ³o¶–“23`µ +ïAOÍ駶ζ×t„ôØn²÷‚9™sG·–Þ^Ö ;½A„܈0t¬˜òµË¼Ì‰kV‡”þ7a·œeúíÕØHõ+³ê6<Ô¶Ÿ°ˆ•Ç;÷Ò+rÌ+‘œý"já˜>Sÿ|Ó°ý ­ ‹ª!Äâæ´¡|uzhEÓyÕÇ×½\;åìs;:%sñÓп Vþ†×¡Lèý÷"T ~hGÚÈLJãïÁ³¬RÉΓ”ý³ô~#$¿ŠÀGÇYb¡Hüèk¬f]xêÚÂáÍ6´…1ùÚðLtù=ÉL\m°žÏ‚ì;R€wYmˆH4A'${!­¼“jÈË<³XòÓ ê̦NÛ"=¼óÀFÊ iouÐ9¿Ýéôl+Go,¢2ÙÌâG 6oà<óaè[ 9/ûž³€²Ì:^’ §äáç(—k+0jRB8Û@Xö«Ë{›“håw£´äÌ |ùŽã;ºßæxÒvõylXIò”wÓÏź:ížΙ}¢4hxÉLiŸíÌœb*˜1öŒy•W4?ôlÁ¤«‰Ê”9÷Ž¾ªYÓðï†9%+­€ñæE(1ÚG]Q¸ÈÞ*÷ø+§_qºp†÷1>À '¶")û5î²”FxÛË–õq(”25+€ô>ÿž³7°°ÔQÃìOÈ>Ž=“eRO3¼G•óþ¢etò“§`‹\ïKDFKWY¬£t–l—ðýeçA†"d¦\*è]}u"lŸÃF>ègí + ä^«®¢% p +. j2cè[à Ä"òæ¤øVÉO. fC‰¤ÁYŒ‘¶EñïtÓ†A0C¤¤g{+SátÙ!‘¿…I÷.HŽÚ:²Ùš»?:™Š².f”¾éÎÛ77Tj26,Š¶óéUçkøŽË™s¨$áchñj˜T4³f#–Í­&P<â·FL Æ>~jľÿ‰)w…!\eŠ2un¡&*1‡¨óë·´É»»”3õÑŒUßXcñ>K©ÙÅ¡ÏG¯a¶Ç³‡:¦eö#¸ñOŽL-¥œÇ7QC’Þ;ìNûÓ f_ &V¤K ‘íOmƒRŸ)À m°Þ« Kâ6o¾îéÎÒ®hñ{z”åŠ, W%¬Êˆ“UCs‡Ú»¤¡|=€´ZZôÑô +OÁVsǶ˜V‹o±];{Iv‚ÝFwŸÅj?š ~#t“ÌæJj¼~ÆùFæ<6Ü3£ îÊ’—ENRËðù‡0Ëk“ÜîUËzž±ë11/NE`:ÝxEÓüÖözæ±äÐ i!Û©Rsp+WÔm§u%#Cƒc_*\Dß2Ügiu6};¥ð¤Ú\õt?GDç\Óņ#hò7 ?Ÿ¼êíݬ‡ƼýÔ»sM¤¾¹ÐÛFsñ9¡ +/æX(¹ÁÌ:•õÑúÔ”þÚÍ?5êG7Áˆ ¡Q›àWŒ¯ê´Ê´`¸—Å®Üé{o}Ý“ñÁpU‰üãRlR¢½u#ˆsÚ‰Ëﾞ¢¯þ¬×ÂâÞªa6øÇaŠF Ã)µd§~¿>¾Ì )( ŒPÕ¢o7Öƒ{<ÊœáÇg  %ßÜÞ”7ˆ² Ödï"zš¿.öEÂÔ)¿‚GèRÎËZ +‡äkIs³‡Hßz>@Ô¸›Ç‹y§ý{FFµ.ûDš`ºøæ{T±¤úñêQØ_¢ ×eb +zEnî;óº._cßZY +¶§ß‡MHx2`œ>Š}UÅÐ,èù%c¿ðuµ‘o!H:™…ãc¶1-–êöD^y%|ÞУϙ‹Îd„ÁKœWܱ±&EÀ>1pÆ÷)éáBZ¼½X¯Ïjîìm|m3îÈLusèQ{²K6O‘Fo{íKo¯3KlDjÌŸ˜`\èRp'Í°×Öb­°ÄDªö ¥'Øúfõ“`&oºÆs‹wVÜì²µý=ƒpº<Çœ†ù$¥x>Jû#Aá­ly©{ο2ê_÷`LpGI›ŠZ¤4ê:Ž~›(ôŒ¼ S¿c«òßbèÇ?Æ’2žñJ¤uaJ©ÑŸTÉ HÍ¿cs*;9)ÅE~·û¶I.;1À’×y»Á'©ìÆù5<ÃOÛ1;]³·¹5’r{HhÚ#Ûa6WkÖ?(X;º3)‚̵œÅc^7–,ô½éäû­jædͲZ¦XVBeý´äêóêʼ«·pA}"Ž}[’Œ©2ß=^¡c¶¬ j `Ë9¡…¥$„Ìî +Ì°CÈ3wÿžë¹ Åy¾ò…†}&Vð¨4»_ ®Ô´Ó”L|Jó=›¨Û^Ó«³øË +#šPT{¼ÚñÛ¨YR„”÷Ðb‹—"wGüYø íà|Ö!ߢÛ7•Íæö°-Wl3懱¦ÆÀM|⻌ï)Ì>ç„ï0èÚ…¤út¹… סãV½gœèÂ, +Ô™9êÓÖÏ\2°C眬ŠWÁ(¾Aè”jhïTáꨉð¤n“5â±"®Ú«K^2I”B9÷OO¸ñ™i»“õÍ-’ñœÃô’e¸'¼³£²DV+ÄgfnçV–ƒ:.‰5¬0Æ"iûäÇýùžlêÏIyF?÷DZ.aiœÞwÁ¾å%KÇ°‘Šp¤õ‰å}¹¬ÅÒRv°‡;[WVPÈÀ +Gu²ßþ=øި̠u€¯…q<×QªU÷‰'Hs1º…ƒÄp¹uÉ“;ÏóƒéøüE]zùã7™ëx6¾ƒ …Ñyµ¸©¸_ÄI|‚ô­TÁÃÒ6ð¶-5ÞM‘ºêÀâÙ{%™U7ÌF,œùô0É/áÆ‚©øÄÅÍÈ^Žy`0±v²m5·»ek#}óGbjÊöÝßàµD<£ ¯% ê”}ˆ9žívÄâ4Ä×[s¸¬ÓÊM%Éb%¨vꥨI Kòj ϵ*}÷ÝšÄú=lÎå’€g£¤«Õ ™I­ƒE;κ$ÝSR>éÁÂ×”Ÿ½oª–ħ¯ŽoŸð¶¹þûʶ©&7£6eÒE‰0ŸÉHjJl’ê&-ºû³âiTìŽ?j\vyª?²Èrä¥%1î ÁqÙϦNÖä‹úží|z”Ò-¼oO-Œ4™{&i«Ð¬\‡hè"^ÌÖ­ !Åe8Å·c¿PjEµVªöçü“Åë«Qºõ6üY[uÆå{'$‡?î\ÝLÃÇ|‹¶rå~›¹”Té?Oï˜+Qk•ðŠhñN¬Æ5XLöûweÅ»–âõà_ÚÍÑsâçÎñH`‡zEd"_rÐåÚJ&õ6çh?e5yÌifýPašÔ”wÏ–Dè¬Xj-ø1Ë_âN¨94qð/J:»]DAœTá÷Ž%¥¤‡Ì®½{ö«aÙÎõÞ2ààZÂBTé…ƒCœ”z­¨C¢Ê+KBïHuo圿jmÆ°Dz.“½‘>…& ûÔ¶u9xΖ6´my—µ1L©U¶¼ÒöÒô¤"1ÞG4ƒÔsÇr¶(Øhçß‘Ž…ׯfÚ‡Û•§cbà_ u®íq݇p!niiå•Ï4Ú†)Lö¼ïÐâ:õ§ˆ³uì— !²$þ™Ëlè?çó†AóÃ0­ÔlžtQA‰`%MÌy_ +ÊÒ¥Úõ¼»£>'•rÃŽÂ Î_pñ<ô¡£L p¥ºá{Í“z­ö€˜Èû¿ dÄnf I—ÇôW<‹šû˜–!üóÄû%·úßRΨ©ODáTGŒ¹5ŽÙ¬"}óÃt™ÁŸ¢"±äSFÞ§"ã®Eù½¦ƒ(çÍéÇ|ŽißžFÉ@0Éìwçœh¶¿ŒlðM¡’®ìZ&\\J%'“sñâü¨¤غR%çMÒ9]®wr¦tAå•è¿Ë3Rü]ð#uQ~{Óƒâê¨upžL%ˆñÁNã‡tJµôq–°7-*ö´RYv¸­×ÚemŽñ€Ÿ@[ÂGIe4ÃÒY·áì¬kH.3Æðx)ÿƒvÃÍo»±{5|Äå·MSÛ´þ4GðôˆÇ(Ô qØW£ F¡·9Ô4¦2ߺPÖ¬›å¬±—†³±U°ÒkF#¸çäÞuMö°SÉ'ßšÄì­ x%§tTä9TØ÷Sf9†×lEp»=¸Ö‰á»üh—À7ëø`ÆSPo¦ÑÔ.fþ,o¨*Óá-PãÑ^ÉCdXê?,`ßVÀªre9l; Ÿ/È<`,þ?.’†8ÙÔåöœ‘¦ [õ Æ4.À•VP˜'ÃæZ¼ÄD+ÛXÁœ˜d&—3®Jöû½:ר?·dêø¢šcì…Šž‘µŠ¨N?Ã/†±˜Zå]³’v…Y¯‰½·O•Þ·šqÅdi…‰D‚Ž­¶±ÉA9šð0ÏóMô‚aê£ÒŸ_¶WyÛ)þ¥MÜ”À­="] _õa‚ƒ³Ž¯´†~©=r…|A­BÛֻɾq>à&ëfÄ«Ã0ĵ¨Ù±œj.Ú îƒdwÈ)ƒ#‹ 0Ev)• a¸¦EH½ßíÇV½c0Â`w7ùZþ{·­±M/_ èäÍ–¡ô³&“·që[ß6 +zƒŠ]ù ­æ§i»³òFI±[ü^÷gV+[ypïÂm“PÕâ)øqJï5wxØÕüÌÈÈ1Õô¡¹wšõK{QVóðkÚÅ`šg¹/½v¹Ïæ’­' wwsBuKã—¾ëÈ’†ØX’ö%ÎI‡7çs©ë ¤Î5NÜ<ðWé¹­£˜Ý’›”º2`Uj"&Ux±“á£k«€Ú„IO%OŸ]FÝ[¼—´/Ú €­Ì€¹õô5o}:9ë~¬²t36îAl'‡¨` ªUNEÄRa6–ìbèÕD9êÂFå&q[wöò°écäh¤é•M +èwN*i'ûĽìsá­T)Ë kê@wH î*÷tyû $®4ž•¸JÝÇð EåÕïÇ‘²§úTc/_Í œOö46!¸ì¢ /RÂImzªA|½žoä*)›YrðIÉ{zÓÙOÄÞµ¿øÇáIæ‘s¯Ì)úQmŠr¤¶Ì© +¼.ªÜƒ'u; 0&m)³uõĺi¡ZØÈ(}‡\­-­ÑP³nµö‘´³ÀrÝÉ(ÝC5xnƒµ.ºåÙJGÑ™yBz4ŽI_”žÙQ‘Lu¤yöýt…¯3°§ s-ñ'^ÜŽÎYt÷¡ò:Ve¶Œô·CNã#ü2^•úâ^ÿÍ™§/·Ôº°Zñ)íÁÃÇþ'Oú»ÔB"à6µnœÀ=Óû pÁ³9ª’ˆ‰­¬?Ÿ92¬ŸE^r´ùþp³üz +ò$σ— uÃNŽ( l³¶t|Ã=hª¹RR«7Åí »<éœÇeËCS6zt þ ’ø¯ Y*÷Ò~åÝÝü¯½uº§Œ)÷yÏNr¹ŒCEŸ¶˜¨öT2ýa@‰@.+š+q÷Êbï FÛB´ùdv|ßÅ·}¯Žþ”Ô¦°ù@ ZSQY—å~`J½ˆ«dY%¾.õ! k,Ñ•e¹…ÎùàߦÙnç!é!b6Ùâ°vˆ\̇1üzGÄu.ðKhVWÆf¥‹æxAx>üK:î7ðøuÌapÙØy­è¬‹{º6ÁÞ­íw’w†S²'Í+'„)C ›òž3ÚÈ°Q0›¹'(ƒùùç1(¾M?Œú^|FÞCÒքɨG¢,»+þž“ÿ])6˜c’ìFF~ú¼×ϦÊÏ;ì/ü¼NZ0à $MV©|­ªµøVûâjOèƒÄEòòÏüs<"ŠŒ·¹£ƒ8î>‡é+@vSe½{…¾2±BH +èje[ žõ÷%·ƒ°Éº;Ê1ìaö¶³Z~WâŠÞ„æš<Œ8fÉP6zLGEÒ|µQs:†KMô"Ήe…ùA=g¹,uíU¹[;Ì,çÈìþþ˜r¥5ì.Ìôp ?NŠ×Ó¶äeHǬæ¼;oïé¸ñ‰ß¶ŠÙ‹—HñZg]m•\ÓG@;/)*VF[ÊrSoý´J,qFŒ¯±¦¹Ðµ[ÿcŸì¡^ÈV¡¹o§ò~ÚÞ÷U&²éwLʽFª9Óþn—Ÿ¿£VˆŠÏê™ G¼ŠìPõ¼¹žUõ ü¿ÖÉ6r£ûK ,Ãò<@>%¤"¨$?ÖÛ*°;aN:§"–ì•C³ÄླྀR1°ô$öâ,÷¡š}J°DƒJÒµÇ%þ’wø%à'ìaLýæ~“¡882¼ëmðv[…¤7’SEÝHONÖ‰¢WÜr0™© nû yþ -óéÂ'7rMq+ÏGÏã‚ÕF‚I;'!ØûM¨œêø•üíô¨wʬXõ·.¡‹-­4m {|B~¢ÑSDáù–É‘5fr¹Õ+ÞÏòüiñá毥Ù}Ôƒ½-¹!Éô逤û™!uºÈÃtu¬ÎîAÕ(k'W9Éj{ï]¯^•_VqAqµ.üº]¾Iã·jJ2CGî‚S¶€eûÑS»}ýXs*èÕ$rN­ôøx>¢û—zTKM–Xp¦4Ì¢±jÂK¾é³é¶ƒêƒ¤zçIZ#L×?á}^yÑÆßü¢+l¬éyÔi¯{Ðè^M0Û»€†ñ•û0³Sò#ää5üUµÆï$%Ö_7÷hùðn÷2ßv1g´â…y1hû->àçø%]ËMW±ël¸b¬V”jÔ3Š$”­O¤¦#…BOæS¬,ÆçE½´ °Ã»Âîůb³€Ø`^ª³ç´32 ‘½Ì"55jÑ”R…Í´w.Gk²akb¯=àÙº*aŠ_æ;j,ÊFTH :C"£«RÒÚ±YZ®~ckƒn¬˜™ÐþzCTc¿Ó™—Þ6´Ú÷Çjêu“;p¶5¡&x1ÔY/´ ‹Ù“Èj¢ç“ZE.Θ/¾õ7hJô+Å;ø¬`WÅÐ,ï±~Ì4ßÄi[ν~äôvwxãŒès B£Åͦ~n¨cžyßaÀš^£Pd¯ÜÙ¶ÝV-A»¡©áyÝåS »žµu£gdÚ:§´5²õêtÎÄʪ‘3ƒ–fvœ¿±„üæ.zì÷ÅžÜyñsÂ[&½¼ dr„ëÙ`dÞ5ž7¾mw*äß«™ÉxDò66´˜ë¿Ðïä÷7&•¤‘–¬1Zƒ§…?/8yD¯ „ð÷äme›m>ª†×zU¿­¡‘éíz´ñßzY ú:“d” ¹Ý~B=\´ãÙ‸KÝôÄGvW å|è‚™ýÁ"MlH×oMà PÒ=-îlÃäT!Bþò<¿yC.áY6õj ú ?î!qˆJ=!vh9Ûf1Q¦ÐY©ÆcX GéŽP^µ>š[ }¨ƒ@žÓúÔ.ð.¶ŽÐ¦|¨Zæs#øk½sÌûca2Ój˜ã“ · +ÒªÈ4Q”(ú I¸˜C'Gãïc0«¿`~®Þ£D%üi;‚žlFíÄU?&mJœþú´¿yy1}ä^TOœÉÕFž÷y[“!ˆrýg:3ÑnE}Œ¨Ç¸ùo?1C2Dçø×ò’Ú‚N6 ¸¨Q‰$ëM”ýx~ÂÂí +'¨‹h£Ó&…«I1Þ|ñe#;¡2M\ÝL:#~R.F’·ú²·óC”¤ßj¯váŽG=IË1â?eH5ð/=)RN1ѹ'¡ –Zëÿ¶•ÃÆÜ€|˜]ÔN–c¦þ©äE/ÿóFïÑ/›ý žÏ=™i¹Ѥ¥Dû«ÌÖåsqˆk™SQ(Ó{G)üW©žØø%TBý9øÉ”zÛmÁ£1¾ã¶¯çî•›…z* ÜNKiïÜ8SS#>À¾ÂIxˆÖ‘³³Ü•lð§¢ðíWçœøØ`Ó_b{Ü{E˜¯øiz©ÐœÙ§–éãùËÚ>~Æ´…ÔYtuw´{DSÄ Ó„ ™«ª×VEo|pŒ‰ëÇòÁ¾Ž›{w%— Jgøù'6$Åqs»ñ™˜1uËU'M‹Ž$&0ÁdŒ%ž6åøéÖê\f×AýXWÐôüùÛo¸2Ý}Lù8•r,B̯)zfì¨ WêG°¶“<üo¿ËPÅgå2¼™ž9Ü°u;ú4Ê“mýA?´‰Òn3Ë×ìÝÚÔ[! v²W­îò’‹ýMU™éâIïY¦‚‰u²º6âvö?ÈøaŒÜ¤¼'|ân’ùšºk²“Ÿ/hHÛ 9vb°¸²¶ hZ´üDÞfìnXÐïa‹[q¥:´kÃ’­Þ½Ç'«ÈñЇm/ý?Û}_W²¥J¥BQ.åºîkªä¢þÕ—dbÇ$?H»ò‰9±Å¨µß‰µ*ï„«n+o 9#Êß_Çד“äÆI8]!¾.b´pȺ‡Ìø©(¡ÃÎW3szOÑð¶%_Cwû{9Ê>»åÕ€Ä@ö+[Œ9°ÍË‚â·Lî/Ø5HxAR½"φ¶7ê#}B«…’„Žél™…7û؇†¯#–2⿶™WG!g7€ý¦%ö–'¦ßÂZ—vRÌçzu^§ôôyŠ2¹ŽºKhú¤Ì*R±yÉ6~ÄqÖjD!Ì8(nô&Œˆ­ŒÔÊ,SÁj¯Ã’¦…·Ëa2Aæbï›é5W¦‚mœjÛœÒd“LP3 wü~© +—GG:†Ž—§Ànó}Œ +ß?óÁP:#²­Ëíè†Ó®/Ô`ÑÝuëU ð`4Æ­è ÿ¸Îó1ÆéiÆdf²m5üÒ»¨S¥òeÙ3£P_ƘžI)à§AãÚ±#âìÕˆ•ïDËnp°VÀæœkøÑeôx]4¿V~`!®¦,VJ#X®fk‚™Yø“kæTŠÛ•ƒÃ9/§iÁ–œØg»½lÕW¯¿P‰Â·šÐÅöz˜!Û"ÝNgX2 ƒá¨ýÒhØ’^ÛqÂ**÷ƒåXˆê#‚«¿¦x˜P@' œ 0öxÈ({j M&cä¶f‚2£˜E¹Øö¾PeÄîš _^!‹€è„â¸ÀÚœA¿±>´ª*®`=¡÷S{Ý\&´¸²ùñ¦?E–ï3cèÛ_ë! ¤ªt?˜Ìc’—4÷½<¿+l½­t8ª‰Aœƒx ®^þÈQ}ª¤þTžzv Üóq³Y÷{ÖÈ~:Kü’´“•µ2Þ )Êéï3¬â5ÂÁhx ©3^j ÀoÁÚ€&8Y‹|?ØŽ¢X±úáÔÁº™hY»šì ¥^Å®0é;Ú{P.CÉl§cÂÕ%e{+ýóQÁÒñ[´š`4\]A6úGÊû¥Œ—÷,¢ÛyÆ ž¨ïób³b•ú©CÈåP@ŒìJ{øÞ¬2z‹•ô5š»u¼ºçÈVŸ$¤n„0+ouŠ>Ó©¶Îm˜LÏôÁžÔvÐôpxÙ¡44” w…Ü”æ>ROߢ٠ˆxkb¯XÅJpXà£] |n(q*Áñ5¾ zÉ°æãð&÷[!af¢ŽˆSDzúéF,Ÿ¦*5"EÈ$ÁY·wNâý6³€N“o؋ÝÌ‹ø‰Ão¤¼º&ee,ï8öáˆúd$_ìª+(×(k5"Ÿ:„aý‰q‹ùôW“Ùù¹dy½{Ãdh‚.3—M(®ù#·ÜÇ7=—¢¤8½‰·—7jøõÖêß(r[´™ùH%É{•¬­…2ù;É…GR¦Æ^z:ópIHÄæqq(ôøõà:'DÉà |öõŸüG÷N’LÀVÃmq–ZÞö¾·K"?n®û±£`6˜DÚjïíMUù>8Ëyh´ÆMwn&]ÎÛc‘4zÃ_ÁånîNx†Dá…8ô°_eV²9Ô½4ÞîÉ´ôY“y?ôMí6\34¿–„*˜[–‚zq0 %ßJk¼JV¨¯»|éB2=ïâlì`T€?¾¤–‹çÎ\`ŤÖÉWe ³H ²ñDÍÚßr̲n&‘µ‡|¢kkç”5¬cÒÇŸuišjY*‘j1åR§:¹–áÆj轋î> Øyc[–¯§Q•ºŸG*½ضaºêÎJK?¿ NÒaÂýMÅÝWÚªˆ¸£õiUJFu¼šIk#>{ØRßÃZQ"û¼ÏÓ˜”þˆÇ ú‹|“W5NÝطܱWJôËAâ\ŽÃ©ATR§ Ó{ ÀUyK àæ7¤Æ•$¬Á†Áa,`uçVXÚ»ÐJÍžæ¹{])HªR…GWº…Œ„ +ê{ÌÁåwwƒ_Qëv jŪ×6rÞx×ø4y‹,énqD×(»ÉÅRåƱk¦o‰Â 7Ü(tªD¸ñT8qdB¿XSšµÆ}Þðµç8ÆxÚ+Ðëò·ÀM¤ÃáÞ|‡#&MïÊ©<-4+Aüpèæ[¶–+@"ƒäö bmU þ©»3Ýn?ᙦ:ßrVmÌXV,¢E›cU,ðððÂ{ýòG—.Ùg4œ:±t‘tW²¥ +'þ6Â`¹(wÏR›1¢·q2襦ƒÏ´©·î¶¯Ébó.ŽÁÛ†þ@“Ïàèã+^áXáóóºïùäË«i§E^ã‡z0Œ"Ãg ém„; +­¼Jš¾ŸT;à3TB¤Cúö0¾¾ôŠfƒçZÄ]An_¨ð[‰e ÝvË +¨_ñ“é½iË^•b^ÆÕqP-w´Q·–ÌnJ”ò".hù %j g從Ie'Rª©k§©¦YùîaëËÆIbó£ã§ÎzE™ÐŒ·ì ö¯¡i ýZuRYos£×»™éi}‚k@ržø‚aÁ&ñ+ ®O݃2¼= yÒÌV6Œ!«Ð:dCn„«¤’F½ìhǾڼ3/ƒ½NóŒÑ8 +à¼8ƒ€€€¼"@úœ®Ö Å[š‚Wù„MkRp†­NüøØÁk* +°ÃDÎÃ?Êöò™ 3:‘ƒªqàÄÁ=UÌÈïÍäד(Å!’ûQÞ°ôÑÉAHu}öÔë¸püÄÞ5>÷\›íÚ–@”³Ê±ùxg¼~ðVï-Zsœ¶™µk~jÁñi%m˜K㫺ÝF¥‘8ãʹÈûT þå0À\šÊNr–¶þ':wݫ׿_s9x\ý”®rÝü@â=Ô¿I€Ch:[,,ºFš~ ¨ûùPÍ©o*+èò¯“ gkõœw‰›gÓxV/„h˜ æ,_º—Ø‘Ý2ò#Yß‹±~ŒÑŒZV…#tiò¬àῲf(7$ZlŠ»BW–|­qž^@%ÞÎj¬äˆÌÞ$^€Ti:uE£;ƯÐÒ/qìM< Ë,»)çŽN¼ínŒ.ñ0`Ãow}x+Ú[,æ¿AôF.ߊàl·%Ù}—ÔOª6wÖ1Î[´H9ï­©ÓPÅyHE[ØâŠÌÇÌ£¬R •R»i|Ô!òNBƒUGëYÅ~zSBEù’Ï&øÃã. J½«ÎcýqW…ÞMr×h»Â­ +2a' {7,o¯w@1ÙeÉ\Qþ[òY "¿ÆíJÔo +ßÊü€É [äTäTÚhÑ€U!O5G÷ÊCc+î¢ì½¥¹ïg³ê°ÔWæ7ü> +qýí}R&ÌcFÛ…Þb7lt>vÇàxOKÆCMåœ^MŽÿ‡?¨ÿÿO0³™8CìLœmPÿÀL­ endstream endobj -3226 0 obj << +3380 0 obj << /Type /Font /Subtype /Type1 -/Encoding 7213 0 R -/FirstChar 36 -/LastChar 116 -/Widths 7224 0 R -/BaseFont /TJSEKD+CMSL10 -/FontDescriptor 3224 0 R +/Encoding 7558 0 R +/FirstChar 33 +/LastChar 122 +/Widths 7559 0 R +/BaseFont /DYXWOG+CMITT10 +/FontDescriptor 3378 0 R >> endobj -3224 0 obj << +3378 0 obj << +/Ascent 611 +/CapHeight 611 +/Descent -222 +/FontName /DYXWOG+CMITT10 +/ItalicAngle -14 +/StemV 69 +/XHeight 431 +/FontBBox [11 -233 669 696] +/Flags 4 +/CharSet (/exclam/quotedbl/numbersign/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/R/S/T/U/V/W/X/Y/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) +/FontFile 3379 0 R +>> endobj +7559 0 obj +[525 525 525 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 0 525 0 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 0 525 525 525 525 525 525 525 525 0 525 0 525 0 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 ] +endobj +3311 0 obj << +/Length1 1444 +/Length2 8646 +/Length3 532 +/Length 9527 +/Filter /FlateDecode +>> +stream +xÚí—eTœÛ¶¦q <  xîînÁ +-((܃'h‚C Xp'¸w—`Á=8$8]{Ÿ{7§ÏýÙý«GWý©gιæû®¹Ö÷QtÔjš¬â–Ps° ÔÑ•ÄH*k*€‹ŽN6sµ…:J™¹‚ ~~@ÜÍÀÏóp8àEI¨“ÌÖÚÆðF’ñ¯"^€¸fkaæP6sµ;À{X˜AšP [°«@hüµÂ vÃÜÁ–lX ÀÒÖÂ`¶¶uÄbÿË‘¼£Àû¯°¥›Ó§ÜÁ0¸)À¸IFÜ¢%Ôâ°[a±«@áZ`¸“ÿ¦þ³¹Œ¢bæðWû¿§ô?òf¶¯ÿª€:8¹¹‚ae¨%æøŸ¥:à™S[Úº9ügVÞÕ bk!îh XùÙ¸xþ¶u‘±õ[ªÙºZØ¬Ì .à¿ã`GËÿ4Þß6ØÕÕåtä%™ÿëTÿNª™Ù:ºjy9À§ê¿ôÄðÁl=@6 /„ÿû—шI;Z@-máׂ›`ƒ™yaÁ> €­£%Øö„;fgs„ºÂ—àƒñXAaX*€Ýêà`öWø_n»—“ Øñ)Ä`w‚Ôò)Ä `w˜¹Ø`duþYŠ%íV–Qf³R"X{wåãÐÍ/Yh.t>¯ŸÔ0íòùßíñc®ãjÛƒf­á…0|øÃÄ)<»<ô¢“ƒá më™°[n›;­²Û&e¤‚€lÓþ1áR¥´…©Ó¼äC”D#6þÏ8!²eÞú»ÜÄ¡â ¿ŠðägQ‰éÖö¢šÞ{ÉÂTùÎÕ#öjÒAÉIüBþÏhaY¨ÚžbÝѵ“vÃoWæu¬\H(¹äïç,ó­ÐÑçÍiV21ÅÊçoÊš‰fÉÚA*Sd¹Ä»ÊKõSåĆÐoPÏJ*ClIéɹq’ñ‹4š£¯GÇÝ!ÇþŸ5+Z|ÿô¹‚ü)|r +¸A-•Ž¦RGN×»³:^LþbÔÁ.FóÙœz‰(§ ™ÈäÑìKCW¦TÆ€)“ý™ýñEÓ=3¦¡¨¥vwÔLŒ¦®™‹È°ÑéÞÒBG;Ÿ«³Ž¨à²Ü©ˆSåŸ=‹ƒBÃN³_jÿ¬1×Òt\b’5&=‰Q.¤Ù¥L/wGÔ©”žKå’Á]ño• ¸å´Ö>¿±#Xß¹NŸ[°rÒ¤×6>_ân®0.¿Óm”Ò ø¢A>úáZ3ä’½%ÜÈFÎňTz$´V—ÕX] +›8È•Óíì[“ê$èÚŸmy·BšdZ'ârå¡ü’!G*@®‰)¾†Î€\ÙØs@¹zÃo?ů’w¶©Åx-;øº‘3›ÃÖ±:õêò&wŠÛÉ2§K0£Om”;"Ö²ðK#ˆe¸ +•Ÿ…µ0VtQä K Ï€HéØHqu…Iý`ÇÒš…"m?@‚Ì +…lŸö.è¹Ý˜ÝÛË)R÷1ÿÆŽÜ­äLeYÂåIa!‘¬zé”$ ,.{Ó«ü岞½•Ê/[mø÷ Š!…PFpG 1ß>2Å\,:«i&ÇÞ¾üAmeXàâ–ÇÞǪ{eJ9®áÈ¡¹ÃŠiŠ²Õ¯“ýòÖ¬ÙáyæéÈ–O‡XwAXÁ(_¾NÊòD˜°ÕâùÄ^ªîuÎÎf¶+¸¢˜WÄ+.jt´™žþÌôkýòæö!Èâ‚´E¬}ûX€uZXMi»Â¥9å–s—ôŽÅn¦Ö¯g_ÄŽ™îøÒÓB,¹³3m6žƒ¤ZŒ«´Ovæ—½Q(av- _J˜Zûr‡þÊf\ïºm“9…n¸ŠŽ†o`îùŸÏ¦~ïîeº °ŸFÁúïm¨ÜïcÚ ÑïÑwcúи$Tõâ1²[Hÿ=Ó•ñ‡û÷Ð÷jYyèƒaxŒ—>9}”EýÙûl?b¿[ponëÅq–Òt +Ðww*aÀ+Çj&›‰E?S0 =~Ø ¦ÇÒïb}T2k׶ùÁàÀWý ìÔGàóêîèÐ|H +IÚõû]óo¾& Ñì“d¢Q߸–H‡b„TKcÇœÜ9yiùYi†›¬“¤o{ˆšý>7P±²+ 2û¬± y)ŸçzŠÇL•ƒ«c Kž{Ÿâ¿kÓ5‹êqMÎú•m©ZDOp¨9™5æÄ­J_&K¹öZ¥&)÷²d¡wú£“‰ˆ Èg„Bm*ˆøpØ–¨¿kJ˜g¾þI‰ËîAÏ#?÷§œÔ¡ÃqM¤+#«Žð:!´BdÇ>ŠšÏÓkÄ;L_K¦étÛwêGNw ºMêÒä_ߟ,Nvs®ÂÄœ%Û{æDäÃ_>ÿ«£úd7x`ìøý/»…Œ_žÙWÔ•¨ÒéóMQz5]ß ªCš¢]Ýn÷ÚŠÜšrvº¡ +Ú „´šï¦Î‹¸5i­KøWã$.Î)åû½U‡ ¹>X{6'I;>Ã4æß «ü¹/¶$öÑå”K¯ZäÀÎ$~ßlˆÞÑT”<÷U:~i4Df¼Zm2ÃÊ$)$`ó ïÚoYE»ÈŒÇ²<…¢”‡Ö抗zd‰î¾†zòV£hq™ òL¨´DõÔ÷SBÞi¨ÀÙ!.5À6ã‚wg_Ùüà 7Iƒ~¦ ý£Ý¢È˜Ê»ðcÒùs +¢‰¦•d¬©WäH„Z_òl¸u%:+žÓÿæÃý&†ú<4Öê& ±{[é|˜©,›¢ì)MŒ™ˆéÁ—=ÍöÆŠeò¥wØ…ýg)Çö]K,„´|¿_¨én’}éU­‘É-¨“*d\Œ2îäý0!•N]J1“ã­H‚x«º›iŽ }|-Íâ‹ûV¿n´®®I÷ÏpBN)™w÷œ…¢É(Ážãq>bÙÒÑý'ž%m“Œ™üÍBk,ÝÃ?”‚¿A×Ò§ž©Í€ü¶•ö'+TîïÌÔCõ‚°ƒäÃâ¸1óƒ&å ê¿æI Ä%â2Z§6ZU·=ÐÌßð& 䨤{¶$ÓÚ=ïÐSûvýºCÈ®{(Õ—ŽCÈD +Éá´™Ûaw}Ömsë˲!U2㤕çf/òz9þ0¤=1æƬpUÄK×d@ÄÐz±ºŠ4_ц< ÌOhv\äV%–˜ËK– BÞ¿¶•âFŸ‚i%¶YìùœÉ6µ%;iEƒká5`ŸJû—¼Ð€óXÎA8iG”Î Ò5›ìê+éþQ‡Däžn¦zÄSh’g¯p qÅqI„1Ièþ ôüM|}F nAË»‡×Ù”;±Ê#úOùœù(t†ºÇ]ÏñnYÅ)ÙôÂBÕ|¿Ýÿ†ZÌ´\“f¥²ì¥ùLt•[iik“J~7™ëB Ó+S]5 +TH¿ˆqê=âjÆ ¹¡/Sóãn8ÃJ(Ƥzšè;P•“n/²O^&CO¤ðÈHGJDö‹ƒ,ÌVÁ.ž*š-¾ú²,&uÚ¬#û| ÇDs¡¥áæT‹oÖŽýõM™[Û¼ øÇY\ôn0ÞÍ)wÊ Ïä[ÅX±ëy¡jwƒÈL¦|BŒ ×LÂàˆ_Deô +±j—v±Þºç•ò±¿Mö ý(øx.¸R• ÆLL8~ü®žà0`R Š."ªHDÚÉQ“ªi3ˆ8cŽªS å'w“%^Í ^5ë–Ç'~f'ÞŽË +è +l0̹“ÕWõ",T”ÅÚ\~æñ¹¡N‘ï±vÝåk¾ŽA‰ŠA®¯Á?õ`â¯a4Vm +Q ”¬ eqíÄ,Ï¢^/Ëì'TF^?Æ{Ö®pˆ­Öøq6 ­›zeòÒ|r}÷-ÇI8H»8z—9¯$úAJÆ’Ë»·Å"ânCÂ2˜y†Å0J±4-‰+ùæó©@¨ß½éû­©æùØ—Y¯zX0¹>}í:í5Š&y‡Ž/!†ðRÀ¶„fyéWÈhÇ¡Z_Ân_ÕvvÃP¤Ä&$ç³nÆ¡”Š³ðcÌW… ùE%>ùµ2 OBû–³†Y ûc$ù;}Ìs܃µ-‰5 +n&6†6‘ë³’ýÑä²þžßœ”›gƒ)dz˜'3Ȟ٬è³È‡Ÿm²?<^$¸ ÍRpÄüùr!ØùÌT¤¹öúÁb–Ýúí£0±ô;W£ ÿ†‚ºXÆ8£ Y ¸ m¯©–¹ÊiŒQ¤«ßÒEr eu‹#K„Y]ÉÅeú³Á›¼BdÞÉ ÆRèµz? TÄ̢̲Z—Õ¥—£ŸÚ bÂ'w.¾ºI›sµ¼ùÊu£ApdóKù˜Ìž%AgŸ”ô„AsÈDLÀg½³~— qÁÏ–\hÇÚ”ÿú[çµÏí‹h{¥ú¤·'cë’²Cõõ:Š³é¦l€¸ñÀ:kßm>5*£­áeÒeÕùªV÷Š×ñ†˜¹¶#¯þDÈÂÿÄuÅø² ê)åèô‹Þcê4àcB ¿øO/¸»£óhk!ö°q~nJ²··m +'hÚ^Ue4¸«Ôÿþ¦ñ uxÍTp”ƒ´pî¾GkqÁFƒÕ¥3åC|ÿªœ†U"¤¿«úeÂ!wcþK„Nîº÷B5 K,MÒr¦‚]oÓ»Klõ*tbTÔœÁŽ½ÛàM­“Kýñ >‡†/‚&åò£l’/Næ|Të™… †¯0h#\+CvÖsY£¤…*0GqöøŠ¯ÍÕ$Cï^}cY +”Ô:éJ\˜l?¯{á|{¨<&ª:zn­O°›cc‡qdü¢Æ +a®‚:N5zš^¹Ò…—âuRzz‚ájØÜK[ž÷db= EBÞ¨:Hö¢½ †dÙVfƒ±2Á‰v¾ó¡¿»©-HŸuð.ЋóX +oâkótNÁ!˜¶,$¿6Û»ûi¦Å˜ŒÏV¿wsÝ€0¦?MîäO¯Ì°RøžPUXìll™n°~ÿ®Judz¿P§Tuvé…mj€Çíܳ´Dnœ*¨ÜpQ ¨D¥oâôøi‚i¼ž8±3~mži”Ù>¾‰ÄÈ‹ZøjE™åÍ!—´ÅoNÊÀEiaí0çÑë:ín]·¿0LŸ­9¨³ÇV<8õÈ«Ø“RÿS€i:î#žáó36þöÈ°~Mpg”pÙâJG åèBüµ¥ÅËÌö¿f逸f_Uë¹{âà±ä€ñ†#}ÖŽ~ˆ&¥$„´«ÃŒZL~YícÑiàYr¥®ï£†¶B¥ÎweðìHß¿ÅZ"$kÀï1o¹U•r=(U`NÚà{±ž²ÅÝ.âö~R¿¸úGªò }¬¦°†ô’R@Ò§ +vU¤WiV”\Ï®{1Ló‚ Ÿ ³R–¤ª€[N§Øó<(e¨“Bàp‡-uÝg½ÊÌ kôò‰É]Ý~±ëÔ*(ÿ»™ØyÝÜ1Ëí†S=èsÎ Y/ÌB²~?O,ÜZ›®hx×{x6ñhÉ¿YU4*¹Ü¸Á©‡=˜IÝõø®JÖ  ¯ ÛØ!Å.*:—]¶D¾ pët '3)ÏõZþzm<"• 1œsmÁ«TÅ0‰ñíÙ{ݬ9Ø´½Áõz‹vŠ¹w[ÔèÅTz$µù}.ö­.Ä% D™ï糚@¤Ïn5¥­c5»ÉØ×oZE³Öëp4ÒúPÌŸ¼žLWGýµ¯g÷ÒŠ‚æŸäöIÖ­K.U­ƒç% µÐn4× `,Y™Ž$¶*Ö“‹ÊHˆ´ymÖK%õ²?0¾òGyŸü‚ó¤j%,{R™‡cÀùÊŠQ‰lwqIßðÑ㑆éÔDŒQˆÇIØòÑ÷+é©%¶Í(NøïÓ¶ª}ÀT±’ý(۔߈ÉL@Ê ë¤ÅhcŸ±¾úÄïÖAëDW£®ꆹîÔeëy?^vI] +[wº‘»2è¥à¯ŸFê©#–Ʊ@;NðkæI½êµÏR}Ž>Ô‹êb¨ŒvxÂÐhöã÷ü6ˆºaR’=ôù+¶§­©›ÄÍ/¬vK±šÏÜu€<äÛÔ ¥êD"žÙiÝ¡^ƒ‚ â]Qdn†è¶ô·¹ +”Z¤cU½B“s×5N|_$¨Š“L)6ý¢*¤X1WöÌòV´®„xâtƒhM¶Å›¹ù‹”>8OdsÆ¢\È_^¹tÉ "æø }í6—5©•cí@£(åŒÄÐþ¡Ø¢­eŶý¹¸:›-¡Çƒý¡4}‚CFyà‡Í}ûPÑ rð×ιd +>—6áÞ7†+†æ`õíLƸsœ–ß_ »¢*Ò'®Y~”/+‰@;¯Ï_šó*[rb>ÑÞŒŸ—š –è…ÞwŸ"‚YøÖ´£âŠhdgsH¢ë¤­iPûic¬5QÉuÉûi&€êg4M“?²WS„#µßõx‘y£\oq¢Ä¦j¶P÷W_ç–ŽY¥Q0 l8¢ÉÍ!c°µ€K2ÚÜTýfR™³Ï´cwË»vG§$ÙOî9ΟQ`$· -¨G² ߨ±ÑPì¢Ò2ÓRpXßÚÝ⪼ +6R~i’7¸P)½±f¶ –“'X½3›?Ë *2ÿªÑùhÈ—†¾I!Þ¶¡s2UI;fùÝ™<Òa+ñäyj¼X°ômÙŸð}p7V¡ÞgvŽ¹ß>It·S÷¼«ÏøsüZö0J! {µrËåÍ‚o Åhš"xnL$$ŽVª)C« ^ÎÇÑ» qìk +m ;P÷-Ñ¡·o~Ê~qÆÒ\vÄø=‘5L&Üøås·zZ9¡ëè…磸ԭlKá¯n‹*›Ì»›]ƒ²ƒZÎÎ,p.²6‚½í©É×Þ;t¯Gávr·Í¸g·°ßÙ4pË šVDkºìDVaN'äzNë zFMi{c˜Œq˜Ö— Œ[2Ó͘q~ÅXÚ}ï>*ON£d z»WÛˆY…j$º*ˆØ[G¬G|Tð¥§_Õ/ÜVõ8~\š"G D½[aÆÀ$Àl+©‘ ¯¡Æ`ú4KÛYÖdi&Êœ ù\†€Ò¿Ð-™ÑEh‚ä¶ii:ÀZÌDg&Ø@ð æé®YD÷ör߉U£êÍÈ‹Q§pC1ù–WiIå&»9oùÜ)5é°Ñµ'‚¥NS ç¹A‹VÃ2]#ÁR¿çlÈå$U¬U¨ÁºŸFó÷× µÔc ¤û/·w\ +«{þ˜0æŽkq{)ZuÓCTVdí|ÒPVz„çÇ"2VÆzŒn†>°ç­)Ptˆ ÚmÌ7é©ZŸZænºÇ+!̆SË™\4ƺë‹/M*ÒK%Àº³î3⓬k2Îe{ V™IÌç|–l(©“¹pÉø' +{ùjV¥çÊóbêûŠŒž¯"Y¼Mqdj)²‹ß¦b5!v¦¶ìÔ|ð{”ó—¸ÙØ·Í3AcOe4.0·\Pk÷ΚÄÈà1¾Û󈓸údjÇûÅuiˆSñZž•™d˜¦âþÏþ²Ûì.~²ÆÇP¤;šúaB„Íö߆ÅS? P«Ã§ÀXE®äÐ|P¼ÕÁ·ñ¥æ¼…SáÙt¸-ŽVѳdï10ªDVYÍ6•5F>®3s`[mù~ž! 0ê§k½4FFò²üáàö^ïêníÛhIÔ•4ïúåz³XÄŸ?\ü +ì@ _FHÒ=fÂÈß•®»±±¥ªÒš,¤W¸õ*$÷·š}À t.tÄÃÓ}Ñ·Èœñ¶òq¶›ºbŠî +f!39ûˆYî +48ýJd¯©.“eŽ³‹éùåm³ãSÁÄZFBÙtè]]v1ŸRîÛO3FyGQQà¿C÷Œè1g?5*Å< yæèE@"óˆo‡X~É"¿]ú–ZýâtæDLéû»†5`×­Éøž+Oü‹íÊko #„ew2?Á‰÷©¯ëz+y¸“Ã^ah°Éé~k_Q«.”¹YçzÍïSbø‘DHZ˲6!÷±)Ds¦—VŸxÎÆBmþl­\ðù½¼@8œx§$B.ô,Ý3fK'}¡1“•×'z”\¼IOZpy<îLF·OØ ÃA]·.®q Ò\. ]yûŠÓ4é63g²?ò½JžþrâR×±Àa yÿ@CÆ©dhýÙ«à©Ä¥~äî‡G“|Ë[A­Þ¬Àfú{Àš¿ü÷×O‹d%üîÌ>T8X :Ï8»)ç0Ü`Š÷Œë02mÞrÛ¤ó&9¾µ¯ÁŽ¾±r•¡ ògì; Ô‘osfj3]®©=¾®EKê¬-[@[÷× >fÎP›¶ö§y!$?c”ÔÅöÈ]’¶2ÿ~|;ˆ¢?Ó}²Ç;Œâ"“‚BJ ¸Ð ®ý¡MN=ßZº4ÑR¼þGŸÁøÑy•Iò¾§8­Q–åsåª)ñ99™ Ÿti½·íM·ÁÝ–˜¢Xü¯eTüþ’+Ö©ˆSµé¼à|Cùçóz¡ï¹ø­äÓR®6Q橇E1×ÊiZ±T:µ’§Ä@%«ü´ã.c`¹éWÔ'¡L§­ÎñG ÀaõÛù îëc]¬£ïiÁl¾úÐ;a˜oi=ÿ=Ù/²,ã©”u7ç:g‚¶,…óWËË·}Ʋðù—­K‰B +Á™½´óeÌÀ›Õêšþ%¼WZâ„V^'“Y3ï±5&Nv˜)ÜøCߢóÏ'{·úÖœU{¬iß¡·è4ôVdCDåÖÍ4ûƒ‹B÷"¼ÎJ­°±Ÿlµá. ©ß`Åß1äiCòŒ1Ùß!vÆCj4$J÷“1gØDÈEßá«”}q5Q.ŠÂ`ì¯ô±r +­g˜8Á˜OdŒg½UÄRÒî“î ä¥ ó?$q:XgHa{Á,Mès‡LŽ‰ +V•g¼¾ ²—¾qÔñ*2(ô«’ûÀ$ÃYõz0L9¢Qý2¬ýýY’GýûýviFÞa+D­YnÉë:&¥É‚^ «b0šãwF'À° Uèä#Óòžÿ¯\Í  ¬g:qƉi’úR%ÊÈ‚ +R +"«(`%®«`m_°&> m \“çεRkL@yWú»ÀÍÖ]‹ƒ?z‡æZøwÆ~ê>ÍZÓHb=•ýŽéªŠÈæŽÏü7ÁZF[f¢c¥§¯›nJIFÝcã×ì„O¦ÔO@Ò©ô:86þ2¶¼)zÚA·iÉẦ> endobj +3310 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /TJSEKD+CMSL10 +/FontName /QQHWIC+CMSL10 /ItalicAngle -9 /StemV 79 /XHeight 431 /FontBBox [-62 -250 1123 750] /Flags 4 -/CharSet (/dollar/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/R/S/T/U/V/W/X/Y/e/n/o/s/t) -/FontFile 3225 0 R +/CharSet (/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/R/S/T/U/V/W/X/Y/Z/e/n/o/s/t/emdash) +/FontFile 3311 0 R >> endobj -7224 0 obj -[500 0 0 0 0 0 0 0 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 0 0 0 0 0 0 750 708 722 764 681 653 785 750 361 0 778 625 917 750 778 681 0 736 556 722 750 750 1028 750 750 0 0 0 0 0 0 0 0 0 0 0 444 0 0 0 0 0 0 0 0 556 500 0 0 0 394 389 ] +7560 0 obj +[278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 0 0 0 0 0 0 750 708 722 764 681 653 785 750 361 0 778 625 917 750 778 681 0 736 556 722 750 750 1028 750 750 611 0 0 0 0 0 0 0 0 0 0 444 0 0 0 0 0 0 0 0 556 500 0 0 0 394 389 0 0 0 0 0 0 0 1000 ] endobj -2996 0 obj << +3056 0 obj << /Length1 793 /Length2 1151 /Length3 532 -/Length 1727 +/Length 1728 /Filter /FlateDecode >> stream -xÚíRkPSבª¡Ly©¤jÝ F‰4O !¡€DŒEÃSsNÈ)É9x8¤D|PIUÆ"6:ò¥ÂT¨”ZbZÀi¡ÀX‹T­Š€¯°N§ô罿îܽÿìõ­o¯õío/š[„Œ!‚°õp† “#AR©„Ãä™Í¦ÐhA8,' –°po°B«\/Àæ y^BŸBAXšGRTð¢Oø@¤qD!GTN¨` YC!W¦@`BÏ"µ¬™¸‘ÖÀé0žCL -‡ DA€õp -‚RXš$¨ü70¤M{›Ê€ñtRð˜”I¤HCÕzÁJ -kFvƒI-ÿ YS‹‡hÕêUrÍDùI§þ•—kµþ/¦IÓ0¤ãèTj üFœ†­fjVBÈÕˆB„¦¨aÀà,c²—½Á‘ôDC¡P¥\Oâ0 -MUBú7©ƒ*Š‹õüëk'“r%"õi0`ÿÍžŒ9ǤI8¢ñl&›Í!‰ä~{JœÒLŒ*0AS—ç ä8.×SÈ!"#0p‚B°À:R1‹‰byÎd%†S&þÕ› Xj8=}}p+eböH÷&°?-0Ó^\ÀàòÈVìe>€Ïcgÿ“…"´°$ðØ>|/Þ$ªÐâ8Œ“CEÚö6V"¤Ó0¬ƒË Lá»å“½§¶Uçˆ+;ŽÚÒÓç›oi;·õ¤É—9Ôãët oø1þàÇ­ŽŸ ÇŠ‡Ã¿bAJ^/õ”(Ël±¶v;ší]èåûd3(†’¦]*mmyOs`û]Ë´Ï?¹?½“qζvå=¿‚:\0½úæ—sR7¶÷Z쾄Ü‹)‰¥§WSxeü~(V‰Yª.ÍMØ÷Ôù•…Úr»+õ–½I`,•Ú\7ù½˜Å¦ë”}íÎþÔ…–ØÁ -™pæ|ïkÑe&`õ¾Ÿ›)Ö¿©1\úûÌþNº ßÍôn—$/»8,F52ïh¹“¢zžÚ/´Šj ×µ¬mÖø£òêVç9¥ÖupýŠ8i {hk’Ç^ÒþX´cú“ÄçÏ{ž½6R›( nV®Ç§ÅxúìÈð𢷱©¶W?3»ÅÉU_Ü%Da=vË­šú²šF¥ Vp=×åÆ‘ÏÜ-\Ê=á˜foÙ‡Òµž_7šw'ˆuV‚¸‹èG}»ØlÜÏM - ŠïI>yÓóRMýùÊ`çšüé‰æÆÊE3±îþÀ¹nþÎó}g;ˆ"j§åB—®ð¾êl–o|lÁ1¡÷®¾ƒ?G™†{/ȱÜ5'ÌßÏY²ŠÌb¬Þ›z¬:¼z›FÿH0kÏQAÝCŽMYÖÙ'¢Æx!¨õßøt)½•¶îrÍ#¡0âyE2 8ÓÜ‚âèÀñ1C÷ÌÇëx¾ )¯ºü¯9XeصñÁ£›Ël_GÚõu÷ ¨iâO‹s^oéÕÚ9ŠÛâ-èÝ£¦Ûß÷"‚þÍg:jÝýb¿ZìßL­=ÿËèòÕ ®£2ÒÀVÇyX÷Ó ¦ -M r¸(Oñ°¸š¥ÎßJž¸¢æ¦4㶂vèå‰ÊâhVÎ@÷ò“ÞnÄÊÑ -!*[,9¥^j5íöôÑÇÅ®OñM®†ñëËvB·Ê#ÖŽ”ûÝé×æ:_.hÿù´—T)}/Û“ö ½æÚˆã#z§éB·®ð¾úl–b|Ñ1‘Çî^C?GG{,ʱÚ¼ e'ë~äòLÏß-Î…Ô&é;=kO¿Ÿ·l/™å¾7åXMHÍ6þ‘pΞ£Âú‡\‹ò¬³OÄMߩʈBPç²ñérfcÝåÚG¤MaØóÊ$ë{¦¥#°Áãã™é¼3¯ã{Å'¿êö9¼æ`uæ®Ý\±hû:šÈª¿g@HO•|ZœózËhOÖÊVÒÔgÂî-¹ý}"Ø|ö ­ÖÙ;æ«¥>-ôºó¿Œ­ wãÙª"39h¬kyÿj®ÔÔ:0 ‡ÁK~Šd“£Qfÿ­ô‰#flN5l $‡^ž¨*–³s{Vžôp"CÇ*EXÄRé)t¹ÙŒÛ3Ç;>%6¸,h(ß ùÞª[;Z1á}§kB›ky¤ ãçÓî2•ìu\Äž¤ùª ½®s^FSWé›r¿›Ë–Óg~Îû┡q“ÙÑVµo7*—íÓ6‹X,´˜uïƒ+±Ÿ~“T-;/iI¸ÚóùhøÁ S›™Pè¦ Wvóç™Ö?É;”WE¯íçü‡‹öÿÿ”(¬ H\£ Rh˜ò’Èendstream endobj -2997 0 obj << +3057 0 obj << /Type /Font /Subtype /Type1 -/Encoding 7209 0 R +/Encoding 7541 0 R /FirstChar 60 /LastChar 62 -/Widths 7225 0 R -/BaseFont /XCGAYX+CMMI10 -/FontDescriptor 2995 0 R +/Widths 7561 0 R +/BaseFont /LQLAVX+CMMI10 +/FontDescriptor 3055 0 R >> endobj -2995 0 obj << +3055 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /XCGAYX+CMMI10 +/FontName /LQLAVX+CMMI10 /ItalicAngle -14 /StemV 72 /XHeight 431 /FontBBox [-32 -250 1048 750] /Flags 4 /CharSet (/less/greater) -/FontFile 2996 0 R +/FontFile 3056 0 R >> endobj -7225 0 obj +7561 0 obj [778 0 778 ] endobj -7226 0 obj << +7562 0 obj << /Type /Encoding /Differences [ 0 /minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/arrowright/arrowup/arrowdown/arrowboth/arrownortheast/arrowsoutheast/similarequal/arrowdblleft/arrowdblright/arrowdblup/arrowdbldown/arrowdblboth/arrownorthwest/arrowsouthwest/proportional/prime/infinity/element/owner/triangle/triangleinv/negationslash/mapsto/universal/existential/logicalnot/emptyset/Rfractur/Ifractur/latticetop/perpendicular/aleph/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/union/intersection/unionmulti/logicaland/logicalor/turnstileleft/turnstileright/floorleft/floorright/ceilingleft/ceilingright/braceleft/braceright/angbracketleft/angbracketright/bar/bardbl/arrowbothv/arrowdblbothv/backslash/wreathproduct/radical/coproduct/nabla/integral/unionsq/intersectionsq/subsetsqequal/supersetsqequal/section/dagger/daggerdbl/paragraph/club/diamond/heart/spade/arrowleft 129/.notdef 161/minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus 171/.notdef 173/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/spade 197/.notdef] >> endobj -2993 0 obj << -/Length1 842 -/Length2 1048 +3053 0 obj << +/Length1 859 +/Length2 1118 /Length3 532 -/Length 1655 +/Length 1731 /Filter /FlateDecode >> stream -xÚíRkXgµ¶Š„,tÍj„ÊúQÌ" d *U#·@LYK‡d’œL ©%ÀS‚JzAà‘zA³€‚¸T.¥h¼ËEZ¶++Xb«ˆP¬ìºÝ¥?wíÓ™?óž÷|ç;sÞ—å –¸ùÈñXDˆc¤ÇãÁ’(8îÅL¢8擈àxzr€V 8<ñ½¸Ocž¨'Pe Ö œgI|à£FTc &ã5¥!ƒU@‚ËP„Ô»• -„ϞЀpDƒIˆÜÆá9*#A,¢D1{Ö‘Sà€?˵‰/[I¡¡Lu”Ig@Y”ã˜J䈂ÆÁ©»ÊÉÿÂÔBq¡V¥ -Õ³òs)ýª«Q•þW'jI„Á¸!°…ÔdÞ\0"Gµê…] «P™¦T!À³ÑÚÀ›o !ªCäb””Å¬Ò s8‚ÉZ¡â›3–„K¶ v¸¾˜ë\S £¹CŸˆèö\Íù¥¦R"Pˆ†Ü!ˆC©÷å×®—ùc2\ŽbJÀåy˜ `=Ú ªâ=€brDå˜íŽá$uPѤNÐfÇJ­;–Š!gñyâRË¢øwxà x~¶ÿ©?cDz -ÖÄÍÁ¿ŽÃ××íqãz7Oʇãø|^Ê¥º[‹ˆü‚ MÜù|dZ‚@0rn©¨_Ö -”‚è­§—½•_P—yÒàâVù¶å”¹òAEsd½¡•§HxG”¤i¸¸¿6§•™Ð¾j»ì­ƒ â¬mvÈwÇ3*j³Ž•D~œÆkrÿFÂÔ˜•ÿ»ç®NâÖÝï~nì뉸wh¿ãúžqÇT3ýˆ|Èwç‰Æ§½ÝVË]Â?uyÓŽßSfqç••LýûkÕ§\ò–]ÿ[HÌÔ³œÚo[ÅŽÃßÑv)’ÚÛ]Ã}Zº†ú“WÉŸ½z )Z7j¿ïͽ¬¿’”èždÞØóõ•D fǾ‘ìâ'„ZÒšì}ÛîÜj͸ÔÏÎM h´Zm¾·!nÚÎì’ÿ%Ô»aqõ`½íÕøï¤gNsöÎ YØýÅ0Y'|~.ÏÞoôýÝ¥ ÞO¥Ìì÷ÀºÂ¨‡¦†V«î†Æ–®AîÔQËkK³¸ÁÚÚ‰üú¸œ6sàû׺o˜î¥©Ñm¶ë-;>_šÝ2ÐûQ["T1ð>s¹èûê°c£•:–WÃbï3©Ò7ÒÂþhHZK_S£êÚümÒêVÖ“Ûû­œ·‰º?žâýé¡ Ë÷|m•Ø˜1ÌWtÆDg‡}9z~ºÃKZú׫†’ÎE…ÒEÆ„tÿžžsjðÙ·×¼ÙiZ+|$‘n²H`Ocš"KfÚF­ƒ¾´hn‹É±àYñÿ^Ö’ ¸Å—{ït‹Òó­ßXxyÔ%½e|¦ðpÇ=íËŽàü¢‚Ž“y6§ Õ™wQÍ“=Ê@šs Gç1ñÓÞoÌÖöŽË–OÔoÚÃÌËí8úƒ¸¿¼md 'þçezI;°~%£8‚)žºé»ÂöègéÞéÑ»Vëûìl®Ö9]@'«o/ŽMNnX’s¥¹(þÚOWÐó¹éqUµÅ%#Œ¡ŒšmÓÕS#«l0§Û©ÆWwÓïòOlŸ<VF˜Yý¦³¥hB乓ûšß â6’KÑ éŸwœ>ÓÉV÷-fàæ×û×Þ0­M¾T>íiÍ ¯^yøúÆ5Z\°^«Ùn,?.»Û1Ø÷)ýÂaüÂi²Ææó¬ã©ÍéÎZ^”ï©ØnrçfúÇ'vúa¿Êø”×\=`M¿ñÛÌϪ–;MfÕÒºBÌÔ‡Ò²–¼Úhû˜§ =•÷qÿJçZ| çok6u¯Ij2*§ÂGJj´†5¦É¶ÛÝn™Ï?_ìßònÓOyýYVeÔÑ't³‡¿8¶t¶m/H–,02Ï?Ä¿AÉ€=_½›Qÿð~zƒÜáÎisìÀA÷ ­¦Ì8øgó¯>‰.¡Wœ»“ÿ›II>½òD.˘·DýâVrnÞ"l­û‚˜M!~éšõ4½Œñ⽞';¶§~àÈ©NË*ê8m=‘ºJÌ |±^˜ñt?½^¯4I·u/J.ìõOÑäŸéêð‹no´Z¸£µ±¯¥Êºyâ`ñ®um%Íòþ²e£…+´‡&R‚hºÔIöᩯ÷ÁÔnؼëðnö5…̽O/ÙÆ}QÞÒýü ¡³qñù3çÊôÖ^Šö^¨±Î:2ËKÝr–Ã7úö¼¢è÷ˆ-·ù>=‡õrÊ$}?Åøf8ÓJ¬k©JRÁÇM¯ú[¶Ó‡JNõúÔÄÛñ×­ªx/ø3õ¯ú"1°¹ûRNÓ©Ö«µú7¬õÍ™2üNj]åñàÊ™gq¥²ÂLóâÒcïlúÉgŒ~6éUè{K›¢ï7û88?¦áh;^Ž¶#•ÜC{ô'Ó§˜€YhùøId“å¼Ê“XÓö™É—AÕ½ÓéÚ‘Ú{NS"“Q á7c—o,øjmŽ«÷¤C»Q3,T©›´; ÊœÔNd°ô&d¬ç»wpL£‰?‘3rrâ¥çÝsõWÚ·»|w²°ÜÓ#"½}óªÞø„Š„G§=v¾ø¼~0]O´¸4”_ëòÊÅø7‘#‘.ÙܻɎ=ýÕÆ’÷ïÆ=L.ûK"^TwúÓ¥M÷./=Ô{B¾|¨ ëëPj»ca|y|pèh7ç£Õ¦5š”çÞbôV¨wâr§œÂfߨì—ǶF;ïX6éÑ÷$umƒM9µÀ«Žjê2µGrë½>%"Ðgêr‘qË•oS9ÃmK÷íjŽ4>tN7^T7`}¡—¯x^˜¿m_HU%­yeoßž°à”Ey¶cqV³Nßè§Ùfÿ`‹ ¶&¶)ù0S³"f0:—MíKZæ¶5ETU¾e‰~|´WºÎnaÃxãÁmÿ¸f¢«Þ‡¬»G¥¶Ò/~<ý©ã?|(ÿoð?Ñ£0NÈ$0Cù'ø¾¬endstream endobj -2994 0 obj << +3054 0 obj << /Type /Font /Subtype /Type1 -/Encoding 7226 0 R +/Encoding 7562 0 R /FirstChar 15 /LastChar 110 -/Widths 7227 0 R -/BaseFont /SRSJCT+CMSY10 -/FontDescriptor 2992 0 R +/Widths 7563 0 R +/BaseFont /NTYIVH+CMSY10 +/FontDescriptor 3052 0 R >> endobj -2992 0 obj << +3052 0 obj << /Ascent 750 /CapHeight 683 /Descent -194 -/FontName /SRSJCT+CMSY10 +/FontName /NTYIVH+CMSY10 /ItalicAngle -14 /StemV 85 /XHeight 431 /FontBBox [-29 -960 1116 775] /Flags 4 -/CharSet (/bullet/braceleft/braceright/backslash) -/FontFile 2993 0 R +/CharSet (/bullet/braceleft/braceright/bar/backslash) +/FontFile 3053 0 R >> endobj -7227 0 obj -[500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 500 0 0 0 0 0 0 500 ] +7563 0 obj +[500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 500 0 0 278 0 0 0 500 ] endobj -7228 0 obj << -/Type /Encoding -/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/dieresis/visiblespace 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/dieresis 197/.notdef] ->> endobj -2975 0 obj << +3035 0 obj << /Length1 2332 /Length2 15237 /Length3 532 @@ -34920,968 +37087,1131 @@ endobj /Filter /FlateDecode >> stream -xÚí·S|o·°ÛhϤ±m46Û3¶m7llÛÆnÒضÝè›ÿw­õ¶ïú÷>Ú¿ä`^ãÏý\ãæ 9‰¢2½‰PÜÎÖ™ž™™ "§¢ÂÌ`f`bF 'q:[ØÙŠ:yÌÜÜ,!{G €™‰‡ô‡@±³÷p´03wP‰Pÿ“Ä ²:ZÚä Í6 >Œ ­ÊvÆ@g€µ5@éŸ'œJ@' £+Є™`baì 0šYØ"0þã$ekjàü¯°‰‹ýÿ4¹@RªiR@’&v¶Ö )£¼èm@ËÿZÿ»sqkkyC›ºÿ×Hý_í†6Öÿagcïâ tÈÙ™mÿwª:ð¿ää€&.6ÿ»UÊÙÐÚÂXÈÖÌ`ú¯…“¸…;ÐDÑÂÙØàìèüWhkò¿@#÷/FIQeqÚÿžÔ5*ZØ:«xØÿ»×²ÿÅÌ4<Žîm&Ðø2ƒA¿ÿóI÷½LÌÖØÎÄÂÖ ÀÂÎ0tt4ô@-±¼˜¶&@wÐ$ÌÈ`kç z€©#Â?3ÊÊ -`5[Úüÿ¯€ÑÁÅÎhbdý'È`´u±1úgæÍlÿ„9Œ&vÖÖ†ŽBœF{ £1ÐÖùOŒ ÀhhŠ:‚FëßQîÿ~Ñ­’ÿ ³1:0tÚZMÿŠ2ÿwô%³€zvú§ '«?APQöÖ.N ’Œíll ÿD@õ˜{Ø›ÿÔÂÆñ/q »?†l Zœ¬ ÌÿD@•xíþ@EØÙÿÍì {g·?íì ogsGà_ eS;—?#ÆÒ5µpý+¤ëšÿ3HÖ èú—+h®ÿ1ì U[‹¿E¸þ©ÙÚ¸ÿéÆÆâ?£ ak ÓŸÁâ\ ÿL>ÈØ쟓øGšƒõŸÉ:ýs:ý ‚Ä ÿ8q€¼…þÈYø|EþHVôDÅþMœ Añ?²“øC 3É?r’úC é?r‘ùC Ù?r‘ûC ù?rQø7q\ÿÈå˹(ý!‹ò¹¨ü!‹ê¹¨ý!‹ú¹hü!‹æ¿‰ä¢õ‡@.FŽ†ÆV@çÿØ7 ƒÑþÏeÌÍúïìÿÜOÜÿÌ “±……±…£±ËŸC¤ì:LŒíÿ,2nŽÿÞÂÿùNP ¶7¨£?ªÁøßÄÌ*Âä/ügíý…ÿl•¿dmö‚\ÍÿB¢Å_R³ü ANV!HÊú/Yý)–tX3Úþ… +»¿deÿþ³þB•ã_øÏÞý AVÎ!ÈÊå/Y¹þ… +·?Ȳrÿ AV!ÈÊó/üïþÏ™afaûg9üåÇÂþßyÿ¹˜A_1þk!8[X›ü×”üß·œ°°»=€žt?p²2ƒö“Ϧ©ÚZ€Ž )QÐÁÈÄÄÅÊò¯¨±‹#è$wþ×÷ -Ðýù?ljºl@w 1ÂÒ¼1o°eJSh™¯XÁt94 ¸°Ysœ|}Ïl'bÐb<¸uñ¨ŒÍúwßé˜(ûÐûÄn/øN‘Þ_&Ä/âRçÞö] öÓ=[ñ5®Óå<öìI‚NPÛ›~Ýž²ƒ+̬•%jd]žä)R‰ªÀ®’€õj»6ôfspjˆ§[«†…|§`%QBKu( g [sCKüµ6äk×B»re×á‚ñ».7áMìÉæk ‹pöbó”%X:=.ךŽ¨ÙÓZ”.¬¾¸›‘Ü(£º7­úë¯6Û¥ö‡åîé-嶺^°_/ÛðF4¸C²T°ÓÜNêg°âÈJP'ï…‡â㙘ÿP9ò .®3qÑ›]T·9Â8¥˜L7\ʨL\fP‘©cR˜Ò™ŒžÇV¨«¶^èeöï×ë;ßa-7¥°z€Åº¼œ:ÆÁ4«$žr¾=m‰ - ‰dÓÕbë ¯jrY-ëÁi¢4—kЬI¤ô•AAíð gF!'íöÁ±Ty›KõùÀÚÖb·¹$? %†E+¡Êx@²? C…ã9‚+âð²£ ôÅ.ÀX[ÛQÒ…Nà[ç¦ x? RT¤åd×åˆ(rÛòRoÎwŸú´Îêm€²&!KÃÛ5 -ß Ñ‡ˆ”ž>ò¦X‚¯¿gþÇæŠLÔITÆÏ IKÅå<Ä!£P¬Oª;ׄ3*ÛÞ`ýÂŽ‘ˆÕ#³WžG“,È_”ŽNõ¸œ¯;ÎÊBHf§~ ÊX,ÏTuùï%ËOW\X;5-Ï¢Ð)î8ûíqlýŒ›¦ºÆD¸‡»[{ZÛ r[ æ<­?M¨g‡Þ—[ù¹jÕõ9u*?ýþ7ÏŽ¨2B…r} òÂiXA Á—º’‚ô-I-8¿Ÿ.ô÷±ª´r%’¨4%{öõsÖòU^NÏ=%ìFÊŸ˜`p¾¦[õÆ´`7¦FØíÿ~õìㆥE‡)¸ƒç«>È`$Qíwôú™61Ü0­{Ûfø…¦Ó…{;:Á 5ìÝ£àQ–úôI¤tµ¥óñ8ÛÅ{±)*¹þ0b(eúê]RÜŠ?OèÀn°Ë½øI 6‹×F.çp®XSª/Ûí§ ‡K#¨‹ìÙß²ô„,?uj`}lx«M:1~¸Tª/ñô›·ý>@ûËza…)¾°9ÒÀ£ŽNŸ¬ù+ -hí`‰L8àƒ¿÷F0þhg7úàë°Ñ¢dÛ´SáKãùÈ»JcEÌ'Ùq>gîAšiÌ üð”Šn’'°“‘èŽG²FW[[Ǿ“FMåíš¾WÖÜÁË×w8Ûœ…ä2òäê7RvSWò‡l[Y(d¿—YV¯„ ë¦7"ÌdXÜïøs¸Ê™cȳÌÙˆ°°B>|á¯À/ƒoAvQÛ°/¦ }¡c.ª n oÛ0‰_£DrNõäDzÑWyd;\ÑwàâváŒ=Áóу…žÄ=SÛið!Ûucø›þÔùb~ÚltéE¡à{ÇÃØiГwÛC© ûALŒeò"ªN*±Rtíðcÿ6ÿ»v°!Õ}Þ©Ÿ•ù̾0ôX|ãÉYØcåVÓ™ü-˜Ê8Ê}M²±8t„˜3°Ÿ¾GôŽ».ZwíèÀη?а8»¥p<Z{'Ђ0Gèõ¥ /*I{ÓÖå»B³Ÿ"aç*™Œ³¸Á‘7•MÆYñ‰Q|Og+|9¯@®z8vá$ÏK¦E¦Ê°‰i*ãH7r³Óv½ô5´Ñ¢ ]MÅ‚·Më¨Ôl‚ñ _¾7”¤ £ª Ïc½xæÇ5ÿb¼þ¦YOÿ-ÈNÆa§—‰ Ñ81ÕeF˜•ûõ«îêm Zªãk Í+ýÝ‘´Ìçð’]ˆìëV¯åBAd*¤‰âØv§;ÒÏ -ÆÂ{l¼ŒÅ’KÝ$_kò0õÍÁ$¢ð³ûÙ{~Òë# -¸­•B•è•u®¶Šh_YÒ&N¹ï;¥m8pŒ>`Ãг•lIzg ÚtÑpP0¿~í¹½ù™ÄªøA*}*AÕUØtª×­%®Í¤#¦¼q{Ú ®Gù–h¬Ä:ÞŸÀƒòÁ‡øv¬³…ÝéøŠ¿Q#ãSÓãEWÇ(â,1“ȶ­&‰")LkÖÕ›Ò ݲtÙÅÏï3Vnz›³êvüÈ$à¿úùPͺ?¤ÊÔ¤^Ù¹*uR°$}˜âöPÎŒcÔnàýH¸ÿiÛ:W ÿð>.†,EäçÃþ'ÅTÛ[.=_C/¢Tg¸±¹ì4™(¨?à5:ÙIpÔZýñJ­Eü‰×„»¤®l$¥>ïݽ¹½SKŽKÉóÓLˆ¥ùpÁŸF6ÙUƬmÀ§k{ŒI‚ÿË -V…‘=?õ6ïgê*u~Á1õ¡Ô´õÅ'.%ÿÜzJÂU(Õ¥š=‚|‰'xˆyFà£tã½ö×aH׋ÜåOëûxçÉê®ÔË\ì×sH?°ö&ËHRoÏ:¤qÒô:J‹ë‡mßm»òÒyxû.Xƒ˜!o&ÊhG±Sd¥ê¯æB6ÕL-éZ9›’óÒ”EbYeÁFJíž’úU.ò§‹š BŠfï'»ÕŠÒû×ËlhÇUš]‚7¿ÚÕ,ðkWã=“¢<|yÊAY8$~ê™ó"nÅã[×ÆŽmZŽ¬/éT¤¿Æ/W´Õ¦x”BáÒÊ€µ_[à>Ú„ëb°jo€%õ»Š“¦ÌVònÃÕ‚«L‘²J¶xÝHÐä'[¢½Æir½0*DÃÉÖÓÌＬ“\ܺº}W_ÀÏ‘)àAÐ’ûrŠ»l“Ž^U³í§™;«×q_§ ¤t¼—v%ED”9xáíʶ®‰£Ü‘¤pÖå‡2Ÿ´„'è±wæð;['Œ2Ùƒâœ#Ó“´6N¾]\øµÄ¹}ù-º ¡PF` #£g“A™¬ qEÿtvh[ñ4º®sƒÃvt_{ršG¿øñ3“²‡ÄAzA–¯§Õ,¡dó$¡ÉÓFØì]ðôfgÌ ªyb2 ÕyZ~®Îl øXEáF"ù¼9ôA2‚|¼#ï‹.hߪ}4cÒ-$X„1AŒïÁÀ öÊþw:º²LQ1’á*$p™.ª@Oà,¨/1Ý"jë°Šö#aÛ\nI¥*†YŒ9‘v—FñËo½/o}—ÌKÓíE Faý£öá¬ôÚãÝ3ˆž°«¦¸…U\‰ƒiµøPºþ‚;†&Ñ?y­&’‚åqˆEüG#Jž$Ô˜Š?­éã å”ÿ WÓÉŸ2Ô4j¬k„¥f–3`.R)õ.Lôbf´ …L Åp‹RoKÅwº(„k²ž‡åöñ*>·$ôGY(Ãú„™+í圞ªÑ9!i—»Bâñ¤`¤¿í¹'dTô\¿ÒDÃÉx/ßÈjÆbú—©Ð¦ýöñŒ¯%:i}ª áΪA)#Ÿ~0Wòae` ŽŠËà˜‘õÈ!ÁU•v^í|"µ4± rÀž¾õØ#ðUÌhA{cäŸv%J²ª6ìØËAB%»…„il*eK0Ó§a½ÖhêöólÆyv,³FV\¶²•ØHü`úùÀ›£#œB"âwr¶R¥‡¤ JdÚb--JxŠ-dÒ\¿ž3– -ºÿš¦Û\´ÇŸ÷[l$`lê´¬÷¯Y´I óôñŸÆ®°Š¶Þuø˜‘Z%Z±³Á¶õı&Iјì. -mF*ç$¢ ,±_MÍgÙâ1ƒ)\·óôXMžo\ð¬F1É“Û!VÇ>Š ¢Rõæn­}j¯ š.à gç¡ìü>»á§âÉð™pŽCÈÏYçŠJ«ò×’©0¼­õ€á˜÷â·—,5gØ(acª„$- '±ÍÏ…kà7Áªn½µ>‚Î3âêG׳‰^B ‘Iëñó‚8/Û€¶Ž8þb*XŸ ¼«(jê2F7‰yB¤M3Å'ÊcÎrîÞ÷\ßåNf ÒèÄȨËnDW·®8Blùö®éGô‚6eIæ=Û^­ ¯»¹ b¯4ÏñŠUÍÕG0Õ‡²Ê.×:¤h³wŽ©]ø–;\ëßSâ$’r˹ƒ°x­‡ïŠ‘CöJùÂrà#˜©Ð}w Ý…ô¼¬ì¬´œ©ü$¼v>ëÅ$¡e¼ñ„ã¨ûÂI®¡)|›žóÇ’IåUº:‹îUnv­)z«¾; òuÌœç±0¼½'½„þ^瘖Ì%(×…VK©-u­¬—,Ï*­ÇÏ:os‹˜’Ñ–Tä0Ð2Ý´ªhQ¹óï‰u@Ôø4X"<|^F¢Ýeb·•ûrª,Vö¾¾îuinÛg³ÌBÚ1šËL<‚ª'óêå¿Ì±t§Íye~¼ñ -‹$ÂPŠ{ë§oïñ5£GSÒŽëá‡HJÉP¸>º— yS¢4í²—èTH×áÊ ¦¢—4, (œk㧥¬û9×/j‹j!â²ûJûV§ühQƒgÕÆ*byfTJÿl2ü²ŸðÛvÎŒ¥éÁ†ù±ør-ùçdkß7 s¤N|Ì+OvÖ ]yÁ 5»¹¯\D.Sª¢y;‰HKrÄê>ÄXaìA®ýœ3nzj,_ùùju[†œJ©Ú;ÁObjÉàÕPicwZ.YðæÔe& 8-‚¦=A8(UJRŸaŒßæ f'Myðez濪HÓ J_öï!ˆCNˆ°Rßx´äïÒpÆ//÷–œö݃5­8–²²Þ“H`Ç)FÐÙ¼%?ÚÔ¸G#î"¡#Ýç B!|…jöc‚™|ëNP'cþ¸ÔDÄ𣰺óëùº\7_£ºÌS•i®¡¦a.²ýé¾7ŽuBŸdyíì“Bç0ëönÑÐ¥5Æ[Gkf´¤4R}‡Ë¥Å`e(Îøáñ>ÂÜ®:¿\ßË^¢›=Íq’ rƒCßçdü«ÏŒ–«†?šéܱ´õOR•%uBû©º(®_òàO íܨdµÚ’ØsVÄ`—Häjä×ñа=yRÒ¶ü”Ý®ÝÀν¿+W}çÄ' •xE_åº}YZÐOžoT sêv¨²Ê’ -Ì2wœ tÈó¶NKÄNUTÊÒŠdX~ÛŸ«>ëŠOÚXÓ›öA_UÁÄ÷%MŠÐœ`ߣ~ZIòf®.¼Ö@Úl­{Y¨Æo‘Ðîn‹Ý!Í£ïÏ‘%ÉG€qceZÝ2’bšãMp††‘p™™ -€4y³ã@Öz÷ö^pºdâ+|y…k%Ÿœwƒ ûÍ/¿Ìàì<÷¥;Ù:çó­½oB&©[ÆúŠâQÛ¨ÿfKFÅfyû„æ!Òžñ£‚Ô3ÙÜã“ò4•š¸¦SUIgb€ô=üÛa‘¸Uk`žšhâÙt4;±)^…Íî+%v‚–wö >¬à;Öð~û›õ¡¼½tô퉴Ó@åãÌœQXw`aläô·V¾Þ/$*ÓÒE$=V V‘*JÂ17Ê#´Cô2½¶»iÕ"s ›Ç¾¹ó°ªQv·Dä¡I®¸GîÐÅT¹lQC#t]ö(—pE¡MN–”Ú'P̯.r©¦™U)9«Ù½lNlöê|tC7vøÒeF÷VqÜŽ gÑ^ÜèÂU µð•k/ 2XÞßò`:Î_½¡ßºJûÞ¸ÓòÛ½[×.á{B…ëëh(•ï;__yQC%À“EŽPÊò&çºZkH~½H…Ëâžz‘\Qtí ¼KíW<°e9î#¢1>c”]êž•þä„/3I1«É=)2^ôœ33‰ÿ½­‘o/®ñ /˜©-‡ó˜·š)BK}±+’ÿ˜¿lGç9‡}HüMIدS†²q˜XÁ&uÜË—êóë±Æ>u!Ö€±¶EóS'{Òfâos»ø^¼þ Îû/ï†íYp¾Â%§ßaù ·aªÐ’ ¥‚gýÏ9 ŒÕ’V¼ÈFæQ˜÷ƒCýj‡jt%ü’ûä8=ìËjEpü/W‰§>Š·Ó¥%ZS-j…LÁ"ÎÖéÐûÈêÛ5ØgùÉW×£²§¸^4f¤OtLmUS÷ïÏ„ÍÛ+sÒÈ[õêËÖ« êú ´GDh×»Yr )˜L0°±ŽSÜwäª(žQ2¼èÀô›šPDÝéÚÓ˧åiüZ[s!¿õw©”½ârŠâ®«½s¹ãéçU‡¬~³"Îùã·ÊPY<Ý‚!ΟæÅr‹N¥- ë&õEOÓÇ  Ÿ!×@éXå+†Æø;ûƒ œ›.:|Üw[¡j½“¾@×ï½êÜúþ€ Ž±³Ÿ~x-7ÓÀijç—90lüÆén™¯¦MÜe‡iú )Zð½“ú©C’÷)á#W§=qì‘ì—‚¾#»+iH¯3kzá%8ú‹T=nUŸtÝ"ûÍàIp|Áä&FV6…Æõ-É[óܲҀŽË¤Â/–OTq!$ÞäjFþ‘'hˆôüPÉÔƒáÜtÃÅ´Ήáøú&Ä–T¨¡«TQ_4)½:>º|ðy]ùË;Ï-±?bž²ö®VŒâìy—¾…”fÁ|&±©æ‰Zw’IãÃ5æ‚#½¤NHð›á9s‹¯„?çj\ÜpS^Ãl*ƃѲÏþ’«yí9^õÊsÕ÷ùlN¨Àö×IH¬4ðM·*u,/¢lmË°Än†½™çÝc?N•¯i©[èÍu‡›ð½4œ]3Ö¢M -sŸÀ¬Ïô¼ÆÔßZûI0C©÷k€°š ùflÑS¢‚„?Àî¾ê¶óEùê+~™÷¸¹6z»ßE«Ðç—m'n©JBò®¦ý™½EfQq– °¸-4*Ô¾>Àr’¯‚³ZTUö&m¡ -NOæ™ó/×b4Š3ÚÑÊtTâû5íѧ'†A¦N¶_/(Ÿ¢õJ†¦«ØÂ;k±Ck’è -(“‹)­hÞX,(jç%xôÛiüÖ$Ndk«§¶O4ÐÅ ¼> l (÷=Yˆ!ÿ’id«ýùøà{­B§~Sü{÷}u©©Ââƒkþª¦±ƒÇ_FÃc -5žÂœ v=sšàN[Ó°ZîIÎÞ’Š¦Ï1ùg•øEÝ4ÔCbÞ§§6±É}h^ z\Iß—£éÊ»ØVscI"üð}d¡ˆc¬æ‚aw{òwã#[ 3«#H¦H龋ólypìw¬a?ñÄÔmäP˜ÔuÀt]ÌIdzIîg¬v$g¸*·˜ÏÉD°ÕnÛ±·}ÖÄ™Ýî!5}üfاfd8µáµ»ûÊô¸¯0˜d q/Tè¾úˆ‘ß@›_@1 pT“P18MKKW‹Â—%ÏæõüÐ,¦p‡w{:Í(Z;8{Çc§ßcéV¹ÆòCÌMhnø-Ràvi¥"… -oI`„Iæi‡äóªw›ˆ0†môÍoèTÿ¥Ö“›¯Û® ±ÛIŒ×¥¢*§kõƒ|[:ZÔ(Õ5nŸd¤J{íeH0®²¿Æz›5éN³»5ÛìE½=ðŒ)]kÿñ—z+P«£[º©Í*ï$©fgB¬Þk´*ÒA‹> k‚kŠÁͧÃÁx ßQBèšWŽ—»o¶k‚wæso6F†õ3žåø|3ò]‘ÁÂ(E…å5&šÓD.¥¾Ïúâ½n¥´œ¤]âs9–dn—“]./"gR}C…ŸvÊ9òæ(tU„•ÄÁ>&‰Êžñ:„¬K%Üá"¬ñW‡3ß¾¡EÃiH ÎÁšÔ‚3øÏmÞšÕªbc¸sy¼£ð&™*<ˆ›úÝ -›HVN ïÑ놥.s‰ú·ìô®•]ÉúòÏ?p²=à€oêºõ6U‘ºk¯‡;iPÙŠQL˜z;©T8«í£Ý;*×ø>ßAhÊÐ*âŠÂ<2“½a[ÃðŠ}ýuËà“KÅúi - ºK„Óæôg̃’áSÒ[¼4¯I71ËOB1VÍ=O¿“ü#E³:?-`Þd>ÓK§·&¯Ú,ã)OÅê:hnòŽ gšG’¦ S¿bÇDþDæ®âg°ŒÏøîÙòDý=’Mó[lûô>¹C"ÂŽè•7˜,8gµ%ci`7RÊ\R;Òk )«“\Fò¡âóÜÍ nE›!·Ùá >Ö›Z‡ïdû!½Ò$cû^€7¿ÁTÂèÙS¸)ËwŸ?oë-z´+Æ–ìøÂUD!¼³,¶F¯ÚŠzó¹Ó²q‘¼âg±Ë¾G¼…ïõó#’Wà´?üJwxP6\=­¤#­XœÁ®™c¹X2ÊÁ‰,ÑCge¼¯Õ’Á¶`²äøpξÈ l2 dgÿ>xá[9Dô)¿]jT¢Ê¼‹ùÑt>ÈÎÅ¢˜î¤À>»ìÇÁÍí7¥RžI!àyád–jF÷êHá`ÁҦÜL9T×U¶ U¥-ÑÏà©üyãqÃ.ˆú‹k»§8«nTŸ²Ñlî‹(®g0*âT˜å#Ë” Ã÷Ð]õÄÊë0Œá ö¿E•«¿@‹<3¶Hó.lß…ã»~÷bèÃjÃ"gmP•8IÄÎø½nôYñTÇañ”;¬ì~4qfmÞÚ\'¶+ôC’Ü&*Ž§‘Ûs]#M³ÊwÀ׆mýÔ˜®VCÊmE»ÿ‹Š÷Gðéër¯×ç!C…öÀÌMf¼ùOÒ@™Îê«pÒÏлûü‘ì~!• Ä~ù±ƒºƒúW`šÅ÷Ò0GJsþ\Úôåq–«\ŸÉt<Ë1zõc°:§S -Ûôi÷î{íeÉíÖÝÖM^ÈkUÀ OvfÍCJ»0“á•|_#CÃ÷spåŽ[ yRõõ‰ço‰-Î/³*îžs¬Cž¯è¿u]”ާʚ—‡ÔdÓ0o! #v‡nW¶µ†ï| Ü”ºpHk¶eI–=Slk¾}Å¢g@P_½´uöPnZïLB8qôÁB–êÌÌÄUöÏJäêïí´‡…g87oŽ“ãi|Jû~)Ÿ'p38‰>ÿ¾.á@»?,Ju°¤G±Ž?ˆEåúÕ‚ºôчmÛîãº`‰XÌþH-þ›Iñ‚¶³ÆúnÉÕžÖV(}`áÑ<þŠ²ß‚e#÷8ÿ -¼²BQÑ£vÞJŸ“ DvûoŸ-@mXþ‰Ë Íý‡  }„ÔËø´l£m$˜Q̽ótt$”·v6÷íðUÉQ$Ì/Ë)Ï®ø‹pÆa6c´$ÁLÃÑ -«ÈÛþQK8 ýl˜c¦ùZŸf[&5 - B‹oÙ¹µ¶hâÎΞ"¦œÓØl¥þ©í@¾ô£ÃNÃœßaúë±’Q ©«+HÆÊôÈxÞæ'L¿7ø ÎuÀqcF7.Í͹û~)œªçwe‡³„:lšuÑHÍvè ¸'lÑ@±+c?#ŠŸ@ò?G¡­;3ö@bŠ0}s½wÏ!ÛÊ÷œûºbšÍÈä¡'>x¶˜ü`4r³/Ñþe—Ç«¡LêŽP5­O·ÅñA×ñ¨=ÏÐê8ÂÀâ’‚Êüwù‡¹Wp;ÿâuÑÂâ ­âŠ((²¾Ú– -~ÎXZÛ¹ã'Í„†ßáŸvéyNLX`®ÙP,M”SÐP÷0_Û$¢t÷Frƒ2tgD`É•Ò¸°"Úâ]ÒŒô>·2Ig?ó™ƒi¸‚£f–­8_i*R!1ÈTt""cçÀk¹ã}À ‰Üì<í7q²I¦$w¬®êúº›o &‰ê[XÓ–r,~±SDpÀ›Jô½ylôWDI4O¡mRßsûõþhª“Å¥}O+@Ø(æň|ˆQ(AÑ_oqž¹÷9¨§#²]±øº.d§¥£S¹D“#€ÒƒI+$[™g—¾ø‡2zÄ„úJˆµ¿¯2ò&IÅCñ{ùgB.“âe6™å"öì3§ òÉÞÂá9äxb‰$ªR×äkÄ€+ŠÌ“—ð±’©Ûfž^ô·Œ/xa(¤d0‹vBiæ؆¡†ßsLyZÝRêÚÀ— Ä÷j]Mi– g:bó:óQ1ŸÆ´ìÅÕÌêÏiˆ÷VZº…ª -›gS'q#¨+`cعñ{~3Žär;å~²u üuÁ2KÂ{ -½Ðí -k6®h‚?$Õ©Ú—Núy0ÍÄ¿„0~ظ‹À¯>?wYoŠc"TeÕŒ|¹º°$„è'á*跧̓·ÎÝe$ÔãE{2iŒô Šˆp®¼;BýfÑ¢I¸œÀÊùðQß¾: d…Öž”íJªMnAÍ ÚŠ( -,'++dñýD–MO$ŠÍŸÇÈK>/×±-eE惺NøB­z%dßKoŸ©šD§‘€„¹Tï×ük¸öu´± ö½{Â_¿.«'‹îäj•/Bö5a$cD¬O5þGH2 íI,Õz†ü¶èGÆeØ’â©÷µØÚXÏÅ{Ó½ÀÛ(M;>^ž{ÇÄŸý:zzÖ´^÷Þ‘»ŽAšáå­ˆï\Ûl'ÄRûŽ`^…Hohâü·‚úu‚xÞ]ˈb[6܇&Uf᫾aäh ¼ãŒ;ÅͬÌÃ^êAMÌ’à±0É^º^Ÿó´Á®¸/õ -jÏ6„J£±1Ö±îÕ¡4W ªâ»=ƒdãêy±ó¸æSÎŒÇ2bCÊîË<,ÉTŸ=†¨Pq+›lÈ–£¾±WûN¶)ûÁ—iܽ÷ïäöçˆ>Ž!FÓølKIaF9°ËYN´f- "}­¦†0'‘îÉýñàÒñmM™"lJRø¬áô“õêîã£hHró^ƘÞû˜OT\_Q›bNïk™Í ½C§D(í|Ö’:ñšÓ\S17½Ñ)˜Cô­\,O®‚Vj!!Ëg܆a§oxeöµÑæ‘߯4÷(O¼%›dEÊéçÖ«°«À M}(y_5Û0jàoù˶öêÇß|ëcáÖÖ Æ‘ò‹‘Îjíç¤_cc.ÅQ‚Ò©¡J×?L:ݳðµ¥׆6.mõgj‹™éÁTâ[|W–/Å^ ÕHtt f>âÜ»4¾I¤²ÜIÆØ«ÏÊÆà >Ħ‹,d%8 úÈíá”z¥&TȤ<¿`3³>ñMyÍþ -?ŽAÆSG[œF” ÞûÉB_7(5Óój#01oóxZŠHÐ/qÒöþ¦=jdt­4ZȸäLn¢§nì©°·®³!,²‹Î‘¿b{‘s€Íû-›‰Ü£¿–, ªº‰4ÏpÅË?!Ňw63ÕÞ—¸oº¹-•+„yq½Ôo¶t`h-l—Ð[ÅÏp 9¯Ñ'‚<„>îåb}£{^”¤¿3hòxOb rW+hÇ_œ\\sŒ`Û± ³wd_ZŒº&|ÒÕvíRñ—ì®^ÈÃùãnkÏd\ç¡Á¾ô;~¯Ñ;æ¾ÊF©fúQ~rÍ bQÙáu#gÁ#Rÿ)µTO4à ä¿fÞ’åµ]ýV5š“y‘¥ßñ徑båCŒãÝxº=[Ö²ø2“²9IáR¸d”cyzL˜Ò†þtåÊ·Ïz,äˆs ȸP C×™1R‘Pqé‡9òüè¼í~Æ¡s ·‹é- ª×ØEÖU…Iâ(öм—àe‹Ù'h9k¢«R‹²—929ÄI¡À¶wƒ¶¡U„v¨ßœ °Œ|´º,È d¬‹ÅD ëlbˆ© õdÊu¾k&¿…ßA83 -oÂù¢û¥0¥X©óÅø“àÖÃä–hw?ê[z=e«14am€si‡Þ_;ܨ¾iϱ‰Úɨ°ÿ -Z”Pœ$ŸUïñ3ˆà/ACÙ8°¶3Ýð×0Ò®ðààWÆ°R{Ãq ]«B#/ÏEØP!œçd˜Î,úÛÒÍ2F‰(á;©Ô”Ì[®™™‰% ÞFF;Ρ3ð–eL¿?/²£¢¹¡ïLFþük -Zÿ†_‡Ü€ŽÞàsgM×Ïo†q…Ìd·Ñlí*¹–fd«+t Øi Ë ¹aÏ™~qgª]†°‘ºTèžõêÔ!JY}#m"BÏ}Ȳbö¨Œ0Bšmpx‚@¹#¾™b“ª„Aú|‘ep‹^åÇKvvøÌ cÍ,‘1yÜž -¶ìƒ‚!àNrëE«½³~¿+#mÃÅ‹±þ;t‚Rtœ‡E‘ª Û7{ÍB ù¾¨V8Á»Œ¶Ê”9˜y -ĉ¹T®RëUl-74üçc…Œ/­¹i7ÌjéGä"¤gÅC†tâÇ?Ô1w=ÂêF‡ö´jë¼u.®Ñ*˜²ØG,µ3py¬ÈŠÚ85Õìw¡É½6QâW,qW`.Æ’™YÆÖ +~«SR[Úæäcý›ÒôVyTY¸1t!„Òé1bnq¡ô«Ù=?éïÀ]óo2½1‡gÖ0ànBÛ j_ðÜž$q¯èÝçâ¹óÖQéŸyüÞú_¸`œUÁ¸Í‹üœê­±)‚Á´u‚ùÅO“,‹ÝJW`µ ÷$ÖhcHX°ÈušôÖ͆¹u%Ü#Þ.Ñ…ŒEeÏ —øž#Èwß*|r‚>UßCaLÕnD«ó$—|Þ¢@ ø#½h1ÅpBj;@'‰,¦HÇ#³Ýp‘SéÓÂq9,’‚fvפ¼4D -T4ý‰Yþ õ¼ª=¹ùnVõ.‘+pwÒ 89»ëíCO†æ¤b#õ.c7Ž(@ßD¡%«:ç¶Ê¯_BvÊZupHóíÞ%Ù¢Î*Ç–b°|]Y`¡{{ùR±·'žæ§ †‰ñÇr0òŸƒSûƒ8\£9Ÿ¬l,Á$ÚmnHo¢‘ ò7}¯¶5Id.KÎ}†gðµºõñºpìßÛ•šNÇ 0šº·r—9×û{t -µ uò|Ë2&M¨|µ*bi‹¹¯£”&àÀ:Ø"â¦w‚h!!óçG²" Dày„éMÌS/Bªš$TdèvøWM\`Æã*k î™æPeÚFBÈT,{Â$;ßò½s¡³|ð± -¡„ xÒÖd+N`›_Åðç’ÝÈ]„‹Nae\ÉeÐ=z2ÂŒçîЇ|&ŒIø=³ -·/vë -)…Û÷Ñ‚;‚La¥æµáŠc9Kd8Nçq­ö r#KMflÇßé@8\±èè2ïùÜÇ•…W‘—,!OÑ.“‹MY *K}6ûæ…ÓuSAz=ÔsQœiÅ1±Lö#2X¯-;]À@©Qöc4¥ÈVXÓŠ­…WWüœ‘Oý zOe*GìïtªhEmò4qŠ_(²è¦Ç)Ê $-44-½ú²GK úþZŠø!×ÕgF–Sý:Ê 74©‡æŒ)£^yÁ†ù…öÿ%ÇýõM´Tõ;Bõ¨f¹Ýê´Ó—éBõ=Œ Åk{êÀsi`òJ»RÈ몌1U›™XZLõ-ÊÎ ÏE¤æ¡O Ïð|S®g]xãGÕ°ÄœW;×Îø’¼~³/ÌWáµÉo¦mŸ*úêe(Eüðƒtiˆs¾N‚Ä‘OÓï,¤ B­U|Fñ¿ºøÁH1ƒ¦DHiÿ¦ûm¬)±äÁ7þæw‚kðFýÞÜí[…¾ö†š»{åW…Ôç·ØŸ6°E1¤è-A¿uöÙÒ~WIÍ—ñ²MóáuEcÿ2XÌÙaÇ‹(&Úc Þ -{ݽh‰>©ÌÏçvîM<.÷_eë9¶=)J„+bå±;íSdEÏüóãWd^º)dŠQÆ[°ëj—þtµAÜ/šÞö×ËRw£n»¾ËÅ9iÍ‚ú®èRŸƒc'¡Á´åéâÑø›Û¼&=\ôDÈz¦™ô¶!©e‡É¾\pú£ª[[M;&z}ó -͉LQŠwº¦g:™%ñL5´å !¯Œœ¨õK@Wlä‚6cC2-Ãmoý dÓÛCð ¹¾dEÍúJÞÛÉ)Ý´¡¦@®*ì\0ƒ‘ù°¯Æ¨¶³ðI&Ô ˆcC\ôc'ÜΊw_~i Òq„ ô™±Y¡¯5ÒŠ·¾$•àÔZT éæ§~I‚•i!ño¸55÷è)Wùóuž[ýæd×¾)Qê³Wx•lõÆGo"/0ó™–ùÐX×xoZnv2¡Áí^õø¾¾â(D:öŠ©R”ÙÇ~á›êgÌlÂFpþn1èá`ÓËÙæ¹'M‚ XøMÂc‡xH/õðÉ5Nˆg6àn¦ Ýlš²?Xõ6ÆÁglkúŒ“ßhË¿aË*Þ@¯Ý5&…Œ®t%•¦§oõUFï0©s8ãŠ;ц¯A߬˜6°«OùÀ¼n%ã0쾂?ÿY‡ðÃ"Ñ·{õY”P¥k›„º!\«foäξÕÖC'aGl_™YZõß3¤îˆ©ËžãÛj·Ê‡%\¾úÍx]c“ðû³:Þ«sŠ§°¥AôæÌ-WÖvê;N<ü‘PjM²æ–ìo3]#eyK©ÎºóvK*åý1㨻æãÒç§6¶@H÷=5ܸ ΰŒ/>EsŠËÝ$6”‰ø+TvI7+âN]E˜ÃÕ±åî•÷™B)ÏIyº'¡{Ø*8#s]0ˆ<ŸÂFÈ« Í­ÌãCœ^1·=à?š{ýZæÃ(Û¼³Ìï`Miµ?„äÚcE5à -d,*¦ÒY¿tÊîªkÅm;7ݪ”|ä=ýõ›®àjî<&—¾ðÛ—x\¼$Áý(Lîz3¬¿-ëj¼Áv8{„BˆZkfä‘XÓLõFjr¦çèkàJ\zhË´«øWéïÒ©çÂ× Dž&pAOóIJCGRfÈ•Ÿ_:MîË·7Ú½ˆ,®¥­¢Cáðiá)‘ÕðÇ¿æë~!ú±ò \}?Â^6ƒoÃÎÓ„ýW토ÀÕý3^Jõkrg­›ÏÀB²<¯âíäý…ÈÍ×£K<ó&Ô¶þ®Íl\or•~ÌZȳèHxí³1j¼qÔú겶,‹W~T]4ý¤Íc°^IþFÎÎéb!«§LŒ4wéBŽ/ÊaÏó”ùM{:Vp¶aõÔ$ÎBW(Rkh ‹ Õso²Z=9†^ç Jè³o‹*KBÒ«–¹J©Ækq¯’ôWƒl‹<xu±äž\éG«NØäDfɵ·Øi?ß-{öñ»gŠW›·í“¼*]‚»ËŠ· ž©Q¿ ¤Íœˆ qÎôË5«6X BÊ`¸R5¨¤ç_E/TOõŸ{ñœòOç\?lŠu\¹½ŸZ²´tJœ=‘íýÞTø}§ L]¾¡(©c¤€è„['1ú=­øÅwb%U·r¯N0¶ô€*y´e–ÊB(ò-íû¹ýÝÔ>—P¢Šmrø>3%Ìèë-#µC1?KõAKJö“ÅéTÓB5³,ß½¤æòrZŠÏ£€—se¥ÒŒ¶ín~†uÕûë¤hÏT€- QíKtÖPár€ ï$N¬µZ7©ãJÂÝéÇ#BË6ÝÅð­£çŠ/”vîaº=û'š¯ßJ–mÔ[tyÇ$\ÑÖ»9í.—kÀ }‘ÆÁ”FøØÏ*3f¬‘u\ìT\'ð4°Íî´ì ØižIm†àü²´ÉåÅ„(– 0†Nçá,"Ø“Fïy¿Ö÷®¦ÿðxm~Ê!׉ìK/g¡ƒƒÀþ–œþaµÍBs •­ò3œègd[¶_Ä«áfûeLÿþÿþ?ѱ5ÐÐÑÙÎÆÐÑ -áÿÎÑ4endstream -endobj -2976 0 obj << +xÚí·S|o·°ÛhϤ±m46Û3¶m7llÛÆnÒضÝè›ÿw­õ¶ïú÷>Ú¿ä`^ãÏý\ãæ 9‰¢2½‰PÜÎÖ™ž™™ "§¢ÂÌ`f`bF 'q:[ØÙŠ:yÌÜÜ,!{G €™‰‡ô‡@±³÷p´03wP‰Pÿ“Ä ²:ZÚä Í6 >Œ ­ÊvÆ@g€µ5@éŸ'œJ@' £+Є™`baì 0šYØ"0þã$ekjàü¯°‰‹ýÿ4¹@RªiR@’&v¶Ö )£¼èm@ËÿZÿ»sqkkyC›ºÿ×Hý_í†6Öÿagcïâ tÈÙ™mÿwª:ð¿ää€&.6ÿ»UÊÙÐÚÂXÈÖÌ`ú¯…“¸…;ÐDÑÂÙØàìèüWhkò¿@#÷/F)!aYå/´ÿ=©ÿjT4´°uVñ°ÿw¯ÿdÿ‹™ÿ0hx-ÜÚL ñe%‚~ÿç“îÿz™˜­±‰…­€…`èèhèZ> bx1,lM€î ;H˜‘ÁÖÎô4&>S;G„f”•Àj¶6´ù'þ_!6£ƒ‹3ÐÄÈúOÀhëbcôÏÌ›Ùþ sM쬭 ÿ„8Œö@Gc ­óŸ€ÑÐu2Ö¿£Üÿý¢ÿZ%ÿfcu`è´µšþeþïèÿJfõìôONV‚ ¢ì­]œþ@%ÛÙØþ‰€ê1÷°7þ©…ã_âv Ù@µ8Y:™ÿ‰€*ñ:Úý €Š°³þ›ÙAöÎnÚÙAÞÎæŽÀ¿2@ʦv.FŒ¤kjáúWH× 4ÿÿf¬Ðõ/WÐ\3ÿc ØAª¶‹pýS³µÝ_qÿÓÅF9@ÂÖ@§?ƒÅ2:¸þ™|±Ù?'ð4ë?“túçtú‰þqây ý!³ðùŠü!¬è‰Šý›8A‚âd'ñ‡@f’ä$õ‡@2Òä"ó‡@.²ä"÷‡@.òä¢ðoâ¹(þ!Ë—?rQúC å?rQùC Õ?rQûC õ?rÑøC Í7ÈEë\Œ ­€Îÿ±o@7£(üŸË˜›õßÙÿ¹Ÿ¸ÿ™A'c c Gc—?‡7HÙt˜8:Û9þYdÜÿ½…ÿó þl5nP FTƒñ¿‰™ T„É_øÏÚû ÿÙ*!ÈÚì/¹šÿ… E‹¿¤fù‚œ¬þB”õ_²úS,3è°f´ý AVv!ÈÊþ/üg'ü… +Ç¿ðŸ½û‚¬œÿB•Ë_²rý AVndåþ‚¬<þB•ç_øß3üŸ3ÃÌÂöÏrøË…ý¿óþs0ƒ¾bü×Bp¶°6ù¯)ù¿o9aa;w/z6= è~àdeí&ŸÿLSµµR¢ ƒ‘‰‰‹•å_QcGÐIîü¯ï ûóØÔtÙî@c„¥y;cÞ`Ë”¦Ð2_±‚érhpa³æ8ùúžÙNÄ ÅxpëâQšõï¿+Ò1Qö¡÷‰Ý^ð";¼¿Lˆ_8ĥνí»ì§{¶âk\§ËyìÙ“> ¶7ýº=eW˜Y+KÔ,Ⱥ<ÉS¤U9€]%ëÕvmèÍæàÔO·V ùNÁJ¢„–êPζ憖ø jm*È×2 ®…våÊ®Ããw\n›>Ø“1Ì×@áìÅæ)Kþ°tz\®5Q³§µ(]<X}q7#¹QFuoZõ×_m¶KíËÝÓ[Êmu½`¿^¶áh&p†d©`§¹ÔÏ`+Ä‘• NxÄš+åЬœ «‚$C˜XJÄnq3΀´AZ…)”¥ èžï„2“ADhM!8ÉÓ]ͦ€1¾Í>ºÊ5±„kÑ^ùS-oéþOß À;„Õß0jXo»ãáÞѧR°äæOíóû{wo¨òNÈwÙÉŸ‰>ôøR³gÝ [ù["¯S*'A–Ám Ósåü¤!9´HóÈö#+K”`ÈC©vƒ7ƒïBF/Ÿ‘fZ²Å."tDxæE›Ù¬ŒîÍÈ:ê-ì”Ù¥¹wàrÚ³-ñÃ!‰ÄïyüPxzùä1†žC¤ÝU†·ÊÆgè"¢6¶‚zG~J ÿŠVB•ñ€d† +Ç-rWÄáeGè‹]€±¶¶¢¤  œÀ·ÎMð~:¥¨H. ÊÉ®ËQä¶å¥Þœï>õiÕÛeMB —†·k¾¢)=}äM±_ÏüÍ)˜¨“¨ŒŸ’–ŠËyˆC>F¡XŸTw® gT¶½Áú…#«Gf¯<&Y9¾( ëq9_wœ•…ÌNý@”±Xž©êòßK–Ÿ®¸°vjZžE¡S4ÜqöÛãØ*ú7Mu‰pw·ö´¶Aä¶ÌyZšPϽ!.·òsÕªësêT~úýožQd„ +åú@ä…Ó&°‚0‚/5t%é[’Zp~?]èïcUiåJ$!QiJöìëç¬å«8¼2œž{JØ”?1Áà|M·ê hÁnL<°ÛÿýêÙÇ K‹SpÏ…W}ÁH¢2Úïèõ3mb¸aZ÷¶ Ì"ð M§ ÷vt‚jØ»GÁ£,õé“HéjKçãq¶'Š÷ XóWÑÚ%$À™pÀï=Œ`üÑÎnôÁ×a£Eɶi§Â—Æó‘w•ÆŠ˜O²ã|Î܃4Ò˜øá)Ý$O`&#Ð//Žd Œ®¶¶Ž}'šÊÛ5};¯¬¹ƒ—¯ïp¶9 ÉdäÉÕ!-n¤ì,¦®ä;3ض²PÈ~/³¬^ 0ÖMoD˜É°¸'Þ ðçþ:p•3=Æg™;²aa…|øÂ_#€_ß‚좶a^LúBÇ\T 4Ü߶a¿F‰äœêÉe£¯òÈv¸¢ïÀÅíÂ{‚ç£ 5<‰{¦¶ÓàC¶3êÆð7ÿü©ó1:;Ä ü´ÙèÒ‹BÁ÷Ž‡±Ó 'ﶇRöƒ˜9ÊäET6Tþb¥èÚáÇþmþwí`;!:Bªú¼S?+ó™}`è±"øÆ#’³°Çʬ¦3ù[0•qþ”ûšdbqè1/f`?}èw3\6´îÚÑo aqvKáx>´öN a64ŽÐ=êK^&T’ö¦­Ëw…f?EÂ4ÎU2gqƒ#1n&*›Œ³â£øžÎVør^\õpìÂIž—L‹L•aÓ6TÆ‘n +äf§í zékh£DA»šŠ%n›ÖQ©Ùã(¾(|o(%H=FUŸÇzñÌkþÅx)üM³žþ[ŒÃN/¢qbªËŒ0+÷ë VÝÕÛ@´TÇ×@›W$ú»#i™Ïá%»Ù×­^)Ê…‚ÈTH ı9ìNw¤ŸŒ…1öØ.x‹%—ºI¾ÖäaꛃID;àg ö³÷ü¤ ÖGp[+…*Ñ+ë +\mѾ²¤Mœr ÞwþJÛX‰u¼?åƒñíXg »Óñ£F0Ƨ¦Ç‹(®ŽQÄYþb(&‘l[MER˜Ö¬«7¥º…e;貋Ÿßg¬Ü"ô6gÕíø‘IÀõó¡šuH•©I½²sUê¤`Iú0Åí¡œǨÝÀû‘pÿÓ¶u®þá}\ YŠÈχýOŠ©¶·\z¾†^D¨ÎpcsÙi2PPÀkt³“ਵ8úã•Z3Šø¯ wI]Ù,HJ}Þ»{s{§–—’çÿ¦™K1òá‚->l²«ŒYÛ€O×0ö“ÿ—xªÒÅtáÅ'#eëœcg×oF³}'»{}¬ +#{~êmÞÏÔUêü‚cêB©ië‹ N\Jþ¹õ.”„#ªPªK5{8ùOðóŒÀG9èÆ{í¯Ã®¹ËŸÖ÷ñΓÕ]©—¹Ø¯ç8~,`íM–‘¤ÞžuH â¤éu”×Û¾Ûvå¥òðö]°1CÞM”ÑŽb§ÈJÕ_Ì…lª™ZÒµr67$9æ1¤)‹Ä²Ê8:‚,”Ú=%õ«\äO5A „ÍÞNv«¥÷¯—!Ø*ÐŽ«4»o~µ«%Xà×®Æ{&Eyø4ò”ƒ³pHüÔ=2çEÜŠÇ·® Ú´Y_&Ò©H_®$h«Mñ(…'Â¥”k¿¶À}´ ×Å`ÕÞKêw'M™­ä݆«W™"e•lñº‘ ÉO¶D{Óäz`Tˆ†“-¬§™ÞyY'¹¸uuû®¾€Ÿ#SÁƒ %÷ äwØ&½ªfÛO3v(V/®ã¾NHéx/í:KŠˆ(sðÂÛ•m]G¹#Iá¬Ëe>i OÐcïÌáw¶N)d²Å9G¦'i5lœ|»¸ðk‰sûò[tB¡ŒÀFFÏ&ƒ2YâŠþèìжâit]1æ‡íé¾öä4!~ñãg&e‰ƒô‚,_O«YBÉæI:B!’§°!Ø»àéÍΘAU)òÄdªó´ü\Ùð±ŠÂ:DòyrèƒdùxG:ß]þоUûhƤ[H°c‚߃A:ì•ýïtt+d™¢b$ÃUHà2]2Tž:Á X,P_b8.ºEÔÖaìG 0¶¹Ü:’JU ³9r";í.â—ßz&^Þú.!™—¦Û‹ŒÂúGíÃYéµÇ;»g=aWMq «¸Ójñ¡týv M¢òZM$Ëã‹øF<”ý`¯äÃÊ(À—Á1#9ê‘C‚«*í¼86ÚùDÈ&´ÅZZ”ð[Ȥ¹~=!f, t=þ5L·¸4h?ï·ØHÀØÔiYï_³h“æé1â3>=Œ]am½ëð1#µJ´b8fƒm30ê‰cM’£1Ù]ÚŒTÎ;HDAXb¿ššÏ²Å1bS¸nçé°š<߸àYb’'·C¬"Ž}D¥êÍÝZûÔ^!A4]†ÎÎCÙù}vÃOÅ“á3ᇟ³Î•Vå¯%Sax[ë Ã1ï'Äo/YjΰQÂÆT IZ@N*bšŸ ×Ào‚UÝzk}œgÄ'Ô:¯g%¼„ +"“Ö/âçq^¶mqüÅT°>AyWQÔ8ÔeŒn.ó„H›fŠO”Ç +œåܽﹾË̤ш‘Q—݈®n]q„Øòí]/ÒèmÊ’Ì{¶½ZA_wsÄ^ižã«š«`ªe•]®uHÑfï +S»ð-w&¸Ö¿§ÄI$- ä—sañZß#‡ì•ò…7äÀG0S¡ûî:/º éyYÙYi9SùIxí|Ö‹IBËxã ÇQ÷…“\CSø +6=ç%“Ê«tuÝ«ÜìZSôV}wäë˜9Ïcax{Oz ý½Î1-™KP® ­8–2R[êZY/YžUZŸuÞæ1%£-©Èa !eºi/TÑ¢rçß;ꀨñi°Dxø¼ŒD1ÞE»ËÄn+÷åTY¬ì}}ÝëÒܶÏf™…´c4—™xUOæÕË™c7èN›òÊüxãI„¡÷ÖOß<ÞãkG¦¤×Ñ”’ p}u/Aò¦DiÚe/.Ñ©>®Ã•LE/i XP*8×ÆO=JY÷s®_ÔÔ6BÄe÷•ö ¬NùÑ¢Ϫ/TÄǫ̀<”þÙd8*øe?á·í +œKÓƒ ócñ;åZòÏÉÖ¾oæH<œø˜Wžì¬ºò‚Aj)vs_¹>ˆ\¦TEóv) ‘–äˆ+Ô}ˆ±Â؃\?ú9gÜôÔX:¿òóÕê¶ 97”R´w‚ŸÄÔ’Á«¡Ò.Æî4´\²àÍ©ËLpZM{‚pPª”¤>à ¾ÍÌNšòàËôÌU‘¦”¾ì-ÞC‡œa¥¾ñh5Èߤá"Œ_^î-9í»k6Zq0,ee½'‘ÀŽSŒ ³yK~´©=p2FÜE2BGºÿÎA…Bø +ÕìÇ)2ùÖ NÆüq©‰6ˆáFauç×óu¹n¾6Fu™§*Ó>\CMÃ\dûÓ}oë„>ÉòÚÙ' „ÎaÖ9íÝ¢¡KkŒ#¶ŽÖÌhIi¤ú—7J;ŠÁÊP<œñÃã}„¹]u~¹¾—½D7{šã$+䇾ÏÉøWŸ-W ,4Ó¹ci럤*Kê„2öSuQ\¿äÁŸÚ¹QÉjµ%±ç¬ˆÁ.‘$ÈÕȯã¡9<`{ò¤¤mù)»]»{W®úΉO*ñŠ¾Êuû²´ 5ž<ߨæÔíPe•%˜eî8èçm7œ–ˆª¨”¥É°ü:·>W}Öž´±¦7탾ª‚‰ïKš¡9Á¾Gý´’äÍ\]x­>´ÙZ5ö²Pß":¡Ý!Ý»C:šGߟ#K “ã ÆÊþ´ºe$Å4Ç›à #á23i:ófǬõîí½àtÉÄWø8ò +×J$$&>99îö›_~™Á'ØyîJw²uÎç[{ß„LR·Œ!õÅ£¶QÿÍ*–ŒŠÍòö ÍC¤;=ãG©g²¹Ç'åi*5ÿ pM§ª’ÎÄé{ø·Ã"q«ÖÀ<5ÑijéhvbS¼ +›ÝWJì-'îì|X!Àw¬áýö56ëCy{éèÛi§ÊÇ-˜9£°îÀÂÙÈéo­&|½_HT¦¥‹Hz¬¬"U”„cn”Gh?†èezmwÒªEæ6Ž|sçaU¢ìn‰È! B’0\qÜ¡‹©rÙ¢†FèºìQ.áŠB›,)µO ˜_]äRM33?ªRrV³{ÙœØìÕùè†nìð¥Ë&Œî­â¸Î,¢½¸Ñ…«6@ká+!Ö^@d°¼¿åÁtœ¿zC¿u•ö½q§ ä·{·®]Â÷„ +××ÑP*=Þw¾¾>ò¢†Jþ€'‹¡” ä;MÎuµÖüz‘ +—Å=õ"¹¢èÚAx—Ú¯x`ËrÜGDc|Æ(»Ô=+ýÉ _f’bV’{Rd¼è9gfÿ!z[#ß^ +\ã^0S[ç1o5S„–úbW$ÿ1ÙŽÏs6ûø›’°_§ eã0±‚M긗/Õ7æ×c}êþB¬cm‹æ3¦Nö :¤ÍÅßævñ½xýœ÷_Þ Û³à|…KN+¾Ãò' AnÃT  %@KÏúŸs@«%­x‘!Ì£0ï‡úÕÕèJø%÷ÉqzØ—ÕŠàø_¯O} ;o§KK´¦Z<Ô +™‚Eœ­Ó¡÷‘Õ·j°Ïò“¯®GeOq½hÌH9ž8è˜Úª¦îߟ ›·Wæ¤-·êÔ— ¬WÔ ôAhˆЮw5²äR0™``c§¸ïÈUQ <¢dxÑé75¡ˆºÓµ§—O/ÊÓøµ¶æB~?êïR){ÅåÅ]W{çr ÆÓÏ%ªYýfEœóÇo•¡²xº'Bœ%>Í‹åC&®Ò±ÊW ñw÷87]tø¸ï¶BÕz'}®ß{Õ¹ÝO[õýcg?ýðZ>n¦€‰?fÏ/s`ØøÓÝ2_M›¸ËÓôAR´à{'õS‡$ïSÂG®N{âØ#+Ø/}G,vWÒ^gÖôÂK0pô©zܪ>é>ºEö›Á“àø‚ÉMŒ¬l +ë7Z’·æ=¸e¥=—I…_,Ÿ¨âBH¼ÉÕŒü#OÐéù¡’©ù醋i;œÃñõMˆ-©PCW©¢¿ hRzu|tùà!óºò!–wž[bÄæ_ ÎÕ¸¸á¦¼†ÙTŒ£eŸý%WóÚs¼ê•7æªïóÙœPyÎ¢é ‰BsìPô«yaK@¼èR~Ô²ýFpD­a²Cy1·òªTØ~ùÔ¨òè™tÜÍZا¬Ç_sv—’E¢ñ#•“ž¡ïsGd 4ëÙég´;QæD†©¡v fCFWÐASŸ„mLÞs´§ù8D¿fà5?>Fw4;,Ÿed}€í¯“Xià›nUêX:^&>DÙÚ–!`‰Ý z3λÇ>~œ*_ÓR·Ð›ë75à{i8»f¬E›þæ>>YŸéy©¿µþö“`†Rï×a5òÍØ¢§*D €Ý}Õmç‹òÕWü2ïqsmôv!¿‹V¡Ï/ÛNÜR• „ä]Mû3{‹Ì¢â,A#`q[hT¨}}€å$_gµ¨ª<ìMÚBœžÌ2ç_®Åhg´£•é¨Ä÷kÚ ¢OO ƒLl¿^P>E&ë• MW±1†vÖb‡Ö$ÑP&SZѼ±X PÔÎKðè·Óø­IœÈÖVOmŸh ‹x}Ø@Qî{²Cþ%ÓÈVûóñÁ÷Z…Ný¦ø÷îûêRS…Å×üT%Lb¿Œ"†Ç&j<…9?@ízæ:5À¶¦aµÜ“œ½%M-žcòÏ*ñ‹(ºi8¨‡Ä¼OOmb!’ûм*ô¸’¾/G!Òÿ”w±­æÇ’DøáûÈBÇ1XÍ#?Âîöä5îÆG¶fVGL.Ò}çÙòàØïXÃ~â ˆ©ÛÈ¡0©ë€éº˜“Žg“ÜÏXíHÎpUn1Ÿ“ ˆ`«Ý¶coû¬‰3»ÝCjúøÍ°OÍÈpjÃkw÷•éq/^a0Éâ^¨Ð}õ "¿6¿€b@á4¨&!¡bpš––®…/KžÍëù¡YLá:ïö*tšQ´vpöŽÇN¿ÆÓ;4¬rå†*˜›ÐÜðZ¤ÀíÒJ!D +Þ’À“ÌÓÉçUï6a Ûè›ßЩþK­'7_·]Ab·“¯KEUN×êù¶ÉH•ö ÚË`\eõ6kÒ1œfwk¶Ù;‹z{àSºÖþã/õV VG·tS›UÞIRÍ΄X½×hU¤ƒ5}:×+Öƒ›O‡‚ñ¾£„Ð5¯/wßl×4ïÌçÞlŒ ë;g<Ëñùfä»"ƒ…QŠ +Ëk L4§‰\:7J}ŸõÅz3&ÜJi9H»Äçr,ÉÜ.'º<\^DΤú† + >í”säÍQèª+‰‚}Lx„†Ú»ßï•’%w }•=ãuY—J6¸ÂEXã¯g¾}C‹†Óœƒ5©gðŸÛ ¼5?ª3T/ÄÆ pçòxGáM2Ux7õ»6+¬œÞ£× K]æ'ôo-Øé!\+»’õåŸàd{ÀßÔuëmª"… t×^7vÒ †3£™0õvR©pVÛ)F»wT®ñ!|¾ƒÐ”¡UÄ…yd&'zö†áûúë–Á'—ŠõÓt—§ÍéϘ%Ãy²H›³»;Ë×á !ÄM>Ùö¨5~dƒ +Zz­Èåß=iÁN¢%=hö18Vúï—ŽšÕxÀwÒ0+<Ü,²ÐÙvÓõ`Ó-¨-a™?0™äcë"[°ßÀCè*6%ÑSå¼æ^,磱Fã,>„^ÓO‰Z-­Ê采%8¯E‰ëo!èímUp ùŸ wOsoŽc+\ÃÙ¸+=96×ÕE?ÖñUצ=‹ÛœIeÄ€'2ÐÛ9B*‘vÄí·oÙþz¦ïz1™àijÛKY@°5Æ]¾®‰ƒ‘ñ$C°B—âÞç ^ã×l ã?ú€:ô&Ѫj +™¯* ˆLP‹€Ÿy‹_q®*Ö)å;|íŽéÖð7²Í%üÝw­U†¸üdOL*äšqlZÿîam-øÛ€'Ñ+GÄ!:‚£-­â{ Š óWe]\9WY„¡ÒÆ5d1À“G\T» FÉwßI,3"7Gí˜AÜÁ˜F »ñ¬) Ü æLJ'!턺Úæ CLßþ<wÍ€°€1Â[Õ*™·Ýô¸ÇœÝÓ'×4¦À}ã3hV°Èl1þ²ZÏïW—u“¶¶„òÓ …bú@®·àŒ£²Q«k’µ;Þ…£BEœ%ÜB«oa„„©ö|¦¤·xi^“ +nb–Ÿ„b¬š{ž~'ùFŠfu~ZÀ¼É|¦—6NoM„_µY6ÆSžŠÕ7tÐÜäÎ4$MA§~ÅŽ‰ü‰Ì]ÅÏ`)žñݳå‰ú{$›æ·Øöé|r‡ D„Ñ+)n0/2:XpÎjKÆÒÀn¤”¹þ¤v¤×@SV'¹ŒäCÅ繛܊6Cn7²Ã|¬7µ&ßÉöCz¤IÆö½o~ƒ©„ѳ§pS–ï>~ÞxÂñ„÷E3ˆŸ1S™H8ôh‹=(MkUˆYŒJùäCy‘lªŸøRv¹&Êx?\.pphX}Ö;[ôhWŒ-Ùð…«ˆBx)fYl^µõæs§eã"yÅÏb—|x ßëçG$'®Àiø•îð l2¸zZIGZ±8ƒ]3Ç>r±d”ƒY¢‡ÎÊx_«%ƒmÁd+Èñáœ}‘5Ød@ÈÎþ}ð·rˆè!S~»Ô¨D•yó£é|‹E0ÝI}(vÙÿ‚›Û1nJ¥<“BÀóÂÉ,ÕŒîÕ‘ÃÁ‚‹M¹™r¨®«lªJ[¢ŸÁ+Rù)òÆã†]õ× v#NqVݨ>e£ÙÜQ\Ï`TÄ©0ËG–)A#"†ï¡»ê‰•×`à ì‹*Wyf0m‘æ]ؾ Ç4vüîÅÐ‡Õ +†E6ÎÚ *p’ˆñ{Ýè!³â©ŽÃâ)wXØý“éx–cô$êÇ`uN§¶éÓîÝ÷ÚË’Û­»­›:¼×ª€žìÌš‡”va&Ã*!ù¾F††;ïçàÊ%¶ +ò¤êëÏß[œ_(fUÜ=æX#†<_Ðëº(½ N•5/©É:§aÞB@FìÝ®*l ,j ßù@¹-(uáÖ2l7Ê’,{¦ØÖ|ûŠEÏ€ ¿z% +hëì¡Ü´Þ™„pâ胅,Õ™™‰«"쟕ÈÕßÛi ÏpnÞ'ÇÓøþ”öýR>Oàfp}þ}]ÂvX”ê`Ib‹Ê5ô«ué£?†Û¶3ÜÇuÁ±˜ý&Zü7“âmg;†uÝ’«=­­PúÀ£yüe¿ËFîq þxe…&>¢¢Gí¼ ”>'ˆìöß> Z€Ú° †}—šû#.AAû©—ñiÙFÛH0£˜+z+æéèH(oílîÛá«’£H˜_–Sž]ñá,ŒÃlÆhI‚™†£V‘·ý¢>–púÙ0ÇLóµ>ͶLj„ß²skmÑÄ=EL9§±ÙJýRÛ|éG‡†9¿Ãô×c%£RWWŒ•é‘ñ¼‡MO˜~o:4ðAœë€ãÆŒn\š›s÷ýR8 TÏïÊg)uØ4뢑šíÐAqOØ¢bWÆ~F?äŽB#Z vþfìÄaúæzïžC2¶”ï?8ÿöuÅ4›‘ÉCO|ðl1ùÁhäf_¢ýË.WC™Ô¡jZŸn‹ãƒ®ãQ{ž¡Õq6„Å%•ùïò r¯àvþÅ뢅ÅZÅQPd} ´-6üœ±´¶sÇOš 7 ¿Â?íÒóœ˜ +°À\³¡:Y š(§ ¡îa¾¶IDéîäeèΈÀ’+¥q7`E´Å»¤é}ne’Î~æ3ÓpGÍ,ÿZq¾ÓT¤Bb©èDDÆÎ×rÇû€ÿ¸ÙyÚoâd“LIîX]Õõu7ß*@LÕ·°¦-åXüþb§ˆà€7•è{óØ诈<’hžBÛ¤¾ç(öëüÑT'!‹Kû4žW€°QÍŠ>ø£P‚¢¿ÞâiÙ‹«™Õ3žÓï­´t U6Ϧ Oâ:*FPWÀÆ°sã/.öüfÉävÊýdëøë‚e–„÷z¡ÛÖl\ÐHªSµ/ôó`š%ˆ aü°q_}~î²ÞÇD>¨ÊªùruaIÑOÂUÐoO™ &o»ËH¨Ç‹ödÒéA;)à\yw„ûÍ¢E“p9•óá!¢¾}u@É +­=)Û•T›Ü‚šAµQX(NV.VÈâû ˆ,›žHš?;‘—|^ ®c[ÊŠÌuð…Zõ&JȾ—Þ>S5?ˆN# s©Þ¯ù×píëhcì{÷„¿~1\VOÝÉÕ*_„ìkÂHƈXŸjüdÚ)’Xªõ ùmÑŒË8°%ÅSïk±µ±ž‹!ö¦{·Qšv|¼<÷Ž‰?ûuôô¬i½î½#w=‚4ÃË[ß¹¶ÙNˆ¥öÁ¼ +‘ÞÐÄùo/ôëñ¼»–?Ķl¸%LªÌÂW}ÃÈ;ÑxÇ3vŠ›Y™‡½Ôƒš4˜%!Àca’#¼t½8>çiƒ]q_êÔxÖæÄû¶rÖz¬£ºãB¥Z‰AžÏ¦Ë›Íy èX. ®ãü“ÔÊämÐEѪfëä! Þ±Xé—ÒïXû§Áv}/%"e¢¡q)þÃ9F0Øï9"M.ÁŸ\и«ò5ÑËÄ_Q’)®¼Àq>¡d<ôÅ +?ŽC:.ðû,çÊ#q4·@GP~uíÖqÒÒø;YŸ ž„µµÕÑ2Ç»l›ª}û6j*EßU}UôhB­,cv¹Y†ú|ÉikDDàÇ\àZïªM¥í+[Ê×2Ž†Œ@-¸mÓÃÝÖÃæîó·úNH#…†ßŠ93H´  gu7šJª+WË‘»o `/Eû•:þD °“Ú6È‹õþˆaP y?Þðú Ÿ%Jk4ÝÖ×;i‰«ÕÝ!…GšêöM?å£DÂ6(¡mxæQ7ðˆ³è}žm•Fcc¬6bÝ«Ci®TÅw{ÉÆÕóbçqͧœeĆ4&”Ý—yX’!©:?{ Q¡âV +6Ù-G}c¯ölSöƒ/Ó¸{5îßÉíÏ}CŒ¦ñÙ–’ÂŒr„a—³:œhÍ(ZDúZM aN"Ý“ûãÁ¥ãÛš2EØ”¤ðYÂé'ëÕÝÇGÑä潌1½÷1Ÿ¨¸ ¿¢6 Äœ†_×2›z‡&N‰PÚù¬%uâ5§¹¦bnz£S0‡è[¹Xž\­ÔBB–ϸ Ã4NßðÊìk£Í"¿_iîQžxK6ÉŠ”ÓÏ­!WaWšúPò¾j¶a.Ô,Àßò—míÕ7Ž¿ùÖÇ­­AŒ#å#ÕÚÏI¿ÆÆ\ Š£¥SC•®˜tºgákK® m\ÚêÏÔ:3Óƒ?.¨Ä·ø®,_Š½ª=è6èÌ|Ĺw1h|“He¹“Œ±#VŸ•‡|ˆMYÈJpô‘ÛÃ)õJM¨6Iy~Áff}â›òšý~ƒŒ§Ž¶9(A½÷’…¾nPj¦çÕF`bÞæñµ‘ _â¤íýM{ÔÈèZi´q%.È™ÜDOÝØSao]gCX0d#Åö"ç68$›÷[6¹%F-Y@U)*"t ižáŠ—BŠ5îlfª½/qßts!Z4*Wóâz©ßléÀÐZØ.¡·<ŠŸyÆŠ«¿îL˜ÅW2à'çC&lÞa˜B+q” ®Øk䯮´«@ŒÃ•¤.aÀž»ë² ®â§ôH?ë0ˆG˜.¿ŽŽÌïµV="ò䑨«]ûÐ,ùN'~Câ—6_ènzÐ f.FÖ Sº’®‰¾+E˜Š±ç?ÛþÒ ÁÕ^^öiU +LêÀ¦r‚qðCÊïÉW€&»?S¯-‰åæWåø©ØÆ¡©¹˜Œ=j +L]±>yn#¤L“ü«¬çO¢ k™‡3·ˆ¼j€ÝßE¥†È ´ClÄó|¾œ*R!²¥˜âv¶Þ[]™û=¬N­¬ÙÄ´÷ô.¬GÛǹßö²½àw+3kºÉf +KC@Øʲ‰¹¿sùsã}à@r^£Oy}ÜËÅúF÷¼(I~gÐä?ðžÄä #®VÐŽ¿8¹¸:æÁ¶cfïȾ´uMø¤«=,ìÚ¥â/Ù]½‡%òÇÝÖ>4 žÉ¸ÎC#‚|évü^'¢wÌ}•¤&"¡â8ÒsäùÑ!x;Úý4ŒCçnÓ[@T¯±‹¬« +“0ÄQ"ì¡y/ÁʳOÐrÖDW¥e/sdrˆ“BmïmC«íP?¾9`ùhuYAÉX‹‰A×ØÄ.SAëÉ”ë|×L~ ¿ƒpfÞ"„ó3D÷Ka2J±Rç‹ñ'Á­‡É-Ñî~Ô·ôzÊVchÂÚçÒ½¿v¸Q}':Ó +žcµ ’Qaÿ´ +(¡>$8I>«ÞãgÁ_‚†²q amgºá¯a¤]áÁÁ¯Œa¥ö†ã@ºV…F^ž‹±¡B8ÏÉ0Yô·¥›eŒ„Q8ÂwþR©)™·\335J¼Œ +vœCg*à-?ʘ~^dGEsCß™Œüù×´þ ¿¹½ÁçΚ®Ÿß â +™Én£ÙÚUr-ÍÈV;Wè°Ó –A7rÞ3ýâ4Î>T?º a#u©Ð=ëÔ©C”²úFÚD„žûeÅìQa„4ÛàðrG|52Å&U1‚ôù"Ëà½Ê—ììð™AÆšY")bò¸=4lÙ#BÀäÖ‹V{3fý~WFÚ†‹…cýwè¥è8‹"U¶oöš…@ò}Q­p‚wm”)s0ó‰s©\¥Ö«ØZnhøÏÇ +_ +ZsÓn˜%ÔÒÈEHÏ$Š‡ éÄ~¨cîz„Õíi#>ÔÖyë\\£U0e±XjgàòX‘µqjªÙïB“{m¢Ä¯Xâ® À\ +Œ%3³Œ­VüV§¤¶´ÍÉÇú7¥é­ò8¨²pcèB=¤ÓbÄÜâBéW³{~Òß»æ%Þdzc(άaÀÝ„¶Ô¾à¹=Iâ^Ñ»Ï Äsç­£Ò?óø½õ¿pÁ8«‚q›ù9Õ[cSƒ?hëó‹Ÿ&Y»•®ÀjîI¬ÿÐ2Æ°`‘ë4é­› sëJ¸G¼]¢ ‹Êž.ñ=Gï¾)Tøä}ª¾‡Â ˜ªÝˆVçI.ù¼E@ñGzÑbŠá„Ôv"€NYL‘ŽGf»á"=¦Ò§…ãrX$Íì>®Iyiˆ¨hú³üêyU{róݬ ê#\"Wàî¤Aqrw×Û‡ž ÍIÅFê]ÆnQ¾‰BKVuÎm•_¿„:씵ê*àæÛ)¼K²EUŽ+,Å:`ù º"²ÀB÷öò¥boO<ÍOA ãå`ä…?§ö7p¸Fs>YÙX‚/H´ÛÜÞD#äoú"^mk’È + +\–œû ÏàkuëãuáØ¿·+5ŽA`4uoå.;s®-ö÷èjêäù–eLšPùkUÄÒs_G)MÀu°EÄMïÑBBæ;ÎdEˆÀóÓ›˜§^„T5I¨ÈÐíð7®š:¸ÀŒÇUÖÜ…3Í¡Ê>´þþ„)¨Xö„!5Hv¾å{çBgùàcB ð¤%¬É$VœÀ6¿ŠáÏ%»‘»Âʸ“Ë {ôd„/4 ÎÝ¡ùL“ð{fn_ìÖR +·ï£w™ÂJÍkà Çr–ÈpþœÎãZíAåF–šÌØŽ¿Óp¸%bÑÑeÞÿò¹+ ¯"/YBž¢]&›²„AU–úlöÍ §ë¦‚ôz¨ç¢8Ó>Šcb™ìGd°^[vº€R£ìÇhJ‘ ¬°¦ [# ¯®ø9#ŸúõžÊTŽØ=ÞéTÑŠÚäiâ¿QdÑMS”IZhhZzõe–ôýµ,ñC®«ÏŒ,§úu”nhRÍSF½ò‚ ó í+þ)JŽûë›h©êw„ê;PÍr»Õi§/Ó…(ê{A‹×öÔ€çÒÀä•v¥×Ucª63±´˜ê[”œAž‹HÍCŸžáø¦\Ϻðƪa‰9¯v¯ñ $yýf_˜¯Âk“ßLÛ>UôÕËx¬RsÃróŒäÛ¹Ì(Õ·Ïo6¥ÛlØèo4«¢|P'Š*øáéÒç:}‰#Ÿ¦ßYH„Z«øxŽÎrå~ÖÌà‰+W[F XÃ~€½2‘1rB.Ö}Œâ3~uÿðƒ‘b/L‰ÒþM÷ÛXSbɃoüÍï:9)Öà8ú½¹Û· +}í 5w÷ʯ +©Ïo±?m`‹bHÑ[<‚~!ëì³¥ü®’š/3âe›æÃë ‹Æþe°˜³ÃŽQ6 L´Ç¼öº{Ñþ4}R™ŸÏíÜ1šx\î¿ÊÖsl{R”W,Ä ËcwڧȊžùçǯȼtSÈ£Œ ¶`×Õ.ýéjƒ¸3^x²Š\\¶5Ê5²C*ÞI)qX5S(üÔ’uw×U?†´E–ë¤T²®p¼uñSštx{»n\}svQœInÀÅBâ>áYš×6·×ýñv‰‰ÍJцœÕQ½‰6ºÛÏŒi·ô9bÁäó'R^{©_?QS^U¦ùšëب™ º[”æ÷J©o^$UHo±]$¤¨¶Ú×a¡„ôAÿü'Ý?#ˆ§ÖA'KçpJ_¢§Ð›µoÖO´O/ÅG¢ S(;Z£ó{kÒ$ë­!¨)Â9õ‹¡ŒÏ.Hé¥m­\£crÁ]>Ÿîß„§B„n;ªñÁ‡ø`/ÀFj3=¸õæ{<|c¦\׸ѭä°^sŽ›ôÒ*ø +‹<ÚnFÅBXÓJ\|4½í¯—¥îF?Üv}—‹sÒš=õ]Ñ¥>Ç(NBƒiËÓÅ£ñ7·yMz¸è‰õL3émCRË“}¹àôG3T·¶švLõúæš™¢:ïtMÏt2Kâ™jhËB^9Që—€®ÙÈmƆdZ†ÛÞúAȦ·†àA4r}ÉŠšõ•¼¶“Sº!iCM\Uع`#óa_Qmgá“L¨Adž¸èÇN¸ï¾üÒ¤ãè3c³B^k¤o}I:+Á©µ¨@ÓÍOý$’+ÓBâßpkjîÑS®òçëxâJ,¯žÉKN+E¼íè¥èØZÙ“µåc) ú}ýÌWE'Lºðà ƒs“DÜÞoY¥¸W,¸´´ñ?©Xî9t_x±x×·œ ç8êøI&V©õšpjçÔ«À¼‚yJäšSàÓ>÷#îÒŠÁ”nÛÈjEÿš§Îu#ýÇc¹†“ KŒWšFJ%àä_ƒH¡¶|O­xxâmn»ÚÖ´gý%ŠðD¢úëDÃdæhºKW©‰G#í¹ƒK«2šFìÚY½ÏH±jón7®ß)ã"¦©æ¼ôæ"zg¢ls †I0¥I1Ù¶j& c­ªÛ™Ç©Þ‰ÜuË’Ì+ã2àñ׎ÕæwšõE`wÊ"z»¬¿©Xß}<·úÍÉ®}S¢Ôg ®ð*ÙëÞD^(`æ3-ó¡±®ñÞ´ÜìdBƒ?Ú½êñyÒ4“símŒÑÄYïõas_TÈ‘éX‡SŒasSò½ƒWP€ÅÜC’oŸ—‘§›‹Ó"“ÝV)M g¦£êu|§˜Ò*t­x&\›Õ‚ŇÍpSŠ×zyÁ +ŠS‰¾M·©©°ñ°†(ýײD¹G]¥R¬èGÙÏ­/ Ÿ ‹=.ºs8eÎaöYiÑ?¥ýüNÚ‡ÏKXP*à ÁÏ­EŒ”2U«”ºï³a{¿mh6gÿepù”›ìàèl$|||1ÄQˆtìS¥(³ýÂ7ÕϘلàüÝ4bÐÃ/À0¦—³Ís"Nš°ð›„Çñ^êá“kœÏlÀÝLA»Ù4e°êmŒƒÏØÖô'¿Ñ–7–U¼^»kL +]éJ*MOßê«ŒÞaRçp<Æ5w¢ _ ‚¾Y1m`WŸò;yÝJÆaØ7>|þ³á1 8†E¢o÷ê³(¡JÖ6 uC¸VÍÞÈ}«­‡NŽؾ2³´ê¿gHÝ7S—=Ç·Õ(n•K¸|ô›ñºÆ&á÷gu¼WçO-`KƒèÍ™[®¬íÔwœxø!"¡ÔšdÍ-Ù/ÞfºFÊò–Ruç!í–TÊûcÆ$PwÍÇ¥ÏOmlî{j¸qœa_|Šæ—»Il()ñW¨ì’nVĺŠ0‡«cË;Ý+ï+,>2…Rž“òtO B÷°UpFæº`,y>…WA›[™Ç‡8½bn{À4÷úµÌ‡Q¶y#8f™ß%ÀšÒjɵÇ‹jÀZÈXTL¥³~é”ÝU׊)ÚvnºU)ùÈ{úë7]ÁÕÜyL.}á·/ñ¸xI‚ûQ˜Ü1ôþfX=~[ÖÕ8xƒípö…µÖÌÈ#9°¦™êÔäLÏÑ×À•¸ôЖiWñ¯Òߥ RÏ…¯3ˆ ¾tšÜ—oo´{Y\K[#D‡ÂáÓÂS"«áŽÍ×ýBôcåA¸ú~„½l߆ ¦ û2®Ú; A«#úg¼”ê×ä0ÎZ7Ÿ…dy^ÅÛÉû ‘›¯G—xæM¨mý]›Ù¸Þä*ý˜µgÑ‘ðÚgcÔxã¨õÕ=d mY¯ü¨ºhúI›Ç`½’üŒ4œÓ9ÄBVO™iîÒ…6_”Þç (ó›öt¬àlÃê©I:…®P¤ÖЪçÞdµzr ½2ΔÐgßU–„¤W3,s•R×â^% é¯Ùy(ðêbÉ=¹Ò4V°É‰Ì ’ko±+Ò~¾7Zöìãw!Ï ®6oÛ'yUºw—o> endobj -2974 0 obj << +3034 0 obj << /Ascent 611 /CapHeight 611 /Descent -222 -/FontName /HDSCFK+CMTT10 +/FontName /IABLSQ+CMTT10 /ItalicAngle 0 /StemV 69 /XHeight 431 /FontBBox [-4 -235 731 800] /Flags 4 /CharSet (/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde) -/FontFile 2975 0 R +/FontFile 3035 0 R >> endobj -7229 0 obj +7564 0 obj [525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 ] endobj -2971 0 obj << -/Length1 2307 -/Length2 17225 +3031 0 obj << +/Length1 2348 +/Length2 17718 /Length3 532 -/Length 18527 -/Filter /FlateDecode ->> -stream -xÚ¬·eT]M¶p»k‚»»»»»;ÜÝ%¸w îî înÁÝ]¿ótßÛIß÷ï7`0Î\U»ö¬Uk¯} 'VR¥6s0H8Ø»Ò330ó‰Ê«031301‰À‘“‹:Œ]­ìÅŒ]@~·ãS=-…\<³\hû-÷¾²Â,ß^x?1µÚåÞ™È{>]OU£0Îè‹ó¾è'K+Ž¼G…‘<ŸË‚–AX%Y„.§Wu2ˆÓHíö¾…ªÝ1ð[шØ1iÚóo?h#÷ f‰ü‹¢j²¯©,·cÉ㣋שøm4Y®Ä±$W/4©eµª¤ud;]Ö2MÌB¡A÷ K-“›ÄÍ+FÙ7òÌöÑb'3ËÏélØ° 5Ð)•æ\t:b÷a±E:OZƒ¹H6 $ì ß;+ÙÅâæ+µºd5›8¢}ÕÞCYd @ -¥¨_ˆ¾®o$µ‡}£ÁWô§,’º5\J4¼°|Q;cz6û.xÙãk°*bHEq`_³W¡S`?0­Z¥m˜rí]o9>lø5ÑÒäÐ0bM”%âÔ9s6A÷ -y໕ž´¿3üû`>¼Û‡AŸõF™ú·9ùù($uÎ@¸ò!·ÃgÌ6S˜X¦¾šÊ*+ò½OÐKè¯Ô†‘Õ„¢…4žÑZ’AôâA`©‹îÌ«vß©½­ ¿#©^xB@<Ƨ|ífÂ×ølåʲŒJFNÉWìÙ.ÁDµ­ näà p0æä±;=óþL›¾£¤Â"‚÷SB'K ¥FŽjÖÊq«ƒþý:éèHEÁ®Î¬ÐŒ¨IÑx°mâFUúëH’‹(Må>¦š«¼HQÞèºÝÉá -$ûîݼÓlüA;ôÕÌךæoÅÄ tf’‹tÄlSÔ¬n»ƒ½x¼ikF¶å­dK?~ ‘ -ø¶ßˆ–¿‚®tÔ:ewƒ&NyÔú‘ A¬/ á3C[ÂÔ_Ÿ»4æ%í»Í«­f‚@ö k­$,0Å Ú]¾ ÍUÿþq#ŽM ò½¨œ×&3Öm"ýº¤-ÜŽm'= †Öž ‹€»t˳rQlÚ,…Ï.ÃÄ÷õë¯|V‰H†1G"ÔOy§ªd8ük)àé"^Ó!ø šÁøÛR“­ø>Nf™Ñ¼{›©o"óˆk üàpD5âvÛ“4¥6 0^Ðå"äD$£üοÖÜ-Ö@cî\¶ª ¾Ðhf.:1v/CáUC‡ÛÔKí-‚;\ÖšÛðU\VSQ›§“5+KU§âv–bWEKu¤Ú͛֊'QÃr`¦#tsV±¬‘°Í›Õ“æ ×Â÷kПĽ„P#ÇãÕPñUû‡ `ËŹ ‹US0  -cDZV¬àÇ´Ç\³i™Ñ°jŽ_IÉgŒŒQÛòu7„(ˆ©Ïxz1¾œE‘ÛE«í˜SœI㻾Û„Yež9‰ÿ¶é™÷ë{úÍ´¢û3ö“߉™þë³äÜâìÙ+½Á6e­ÄãŠÉUaÖQÞSš Œé ØâîÈ@‚)²SÈ9o‘çªÃø÷•ˆ°ÈíÃ’(ƒ«TúÓ¸–Ÿ÷™TsHšâµ‹ÄhY¯«ßøDVÏèæ²qý©ÉY,±?¿0‡ÒÚÑ¢Z€¹5G–¸òØ.û‘@Ž¬p5¿ðu;è|×Sraõ(Qœê ¡¨fgɧ©YÞ‰RíD¥ñß~l00[DÙÐ^‹ó1_Ýtûáa“„àûž~ûp i>À“ükÙvöUrpj¯rã+ø¤ se³8Z -«Œ²rÞ˜?¿>65Â<ü -{)=T^9AÔâÌ8$ŒÉj³I=MçtRoå³õçþúß~?À6¹ï<ù¿$ËB(î$×½£ÛýtpÖœelÝû0ÕŸè§ó½‰€##ý<²Bµ-Š·aÃIIÈ#bÞ²}Tñþ“0šÁjøR_ƒ"d…Óȯ‘Æ™ö0/¡Ÿ:샺¬‰ç³îàÌ©ãQÖiѳÿ‰|}ĉéÁ© ±äCZHUô-t]Nét©.âïñ’@¿ÂM0Ó÷¨N!†y¹–¤‰ÛøA¢bÖ/F;EâmPדµt…µU©Žw{“37rÇqϱ°ž‚×?ð ¢XB‰9bk¸ÉIýd":nçÞ8Þvq!> )àj¬sNÀDÂð†kÔËþ‚®D“»g gïeGµ£;>JÑTiGqÛ.¾¡…TO·™AIúâaT3·úHú Yæ>u‰|„ËL„«IjšbÇ.q¿Ó­zÀ¿'-÷쉡ȃ´À&B%Ì0ázdÁ¬ˆÊ²ée2㯩Πý¸•aQ ï5/4lH`]n+ÌÙRélZ¸b>0¡å ºüŸ_ôb<ëÈz4Iý^× Š¿QSòÛYíoƱ“‘S"ã;}¨ˆ•¼æŸ&ùÖ|÷”:igžwg3$!iîþ+(¯¼¬NG—<Îꄸ[ -I˜›^Øû"¨Pã -r@JCÞ&>¢ EÛÚ!a3OÝþíGVi+ëYÿ|HB×wWv…kÅx­s T ëîS0Äzɇ˜ $Zm2¶4…JFé®ý|;/–hG ñÈà²êe‚ÍÚÆôëd¨õzA¡MÄâ1RCÜqbBÖã÷ZišB[mˆM‘Œ˜œu¥«wº…]Ú­íX§±'¢JŠŽXŠpæ,B*ìâ‘ŸÓ³áØ2>©Í£H=hØ{š* Œt†ì¸d[" @+ž7ïI–– -œ”ÃuSCºLÇ2C°h·È¤?Y/sypü(HJ#g£´Š/áS4‘ï¦ö¯é: €Ù‰©7ç[¹Ä,3—Ìñ9Ç4ÄžÑóôH¹p8xÃéÚíX›“%¹'>ÿ<\:´rÑï^¹™;¿¯kzëòÌå^õ3Œið§çD\qJ@—_IÑד„+³?†}ö¹f"^ðã¬t3‘G¸ý( -ËÔŸ9Ç…?çWÚÍ_u­=¶©|œ†›D“ ¿ì¾'w«J¯ã‹~èÊÙfÊìRÁ,x4;TŽ¦.~úbDåa [ hã*§×b wÌ'v“ÝÒúi{UNzÊd-+ÍÕ¥ú¹×ö(¢Ö£á“%Ý ©o¯!Ò̬<ûƒ÷¡±°RÇmÏïšbýyn-mVõŸãávKÁÉí!Kc4T¿LÆ[ŒNŠ¼±;ˆ™¡ÂG¨É¾¶*ôë}(¼ µ4 +˜r'f1¨”?AÉÐc+ @Ì=~hSŒÌ#òÕ;0p#¼OG¬½ÒŠ²0Iú±¯±þRu¬ùæ[ƒIc~BPFß@/ÿÉ$µœ½þHzátÖ[ª~U—ÒõMEÇÅ¿±aÅÎüæq€ ÆB£@±5ÿ¼t1 -Ñᱞ§K„óAp²¢Bǯ¬oµöÜ»[œ»jÀèGOaóáj¸@D»H‡ãKXœ2dú…¹ZD[Ni[iLU¢(B(´…j[ÆQ›ì27>V€[í4Ų<º -ž_E3ÿv Z³wêXXŽ)yö4§½í|:ÛØ­\Œ}£ÉÅ}b\P[(ÈcM÷¸¼ç÷ˆÌýÄ)ý—_Æ5K)E¡4ËYãüö².ó5uËCyØöú|±¯{I'?®ÔEi_Ö_NH­-·íšI³OŽ•'P“0²yÿ½š4RhØ3‚wBŠpÃ'zñ𭺡:Ùp‹¹«ýù¼—Õ~Ô¹Îqh"»aÿþÁ‡A 9Ç ÊàÓA2¬ñ¡ŸT£ðŠß÷%(÷¸w°/-‚AºŸò§“ͤc çr·:xljÒv¾£ÁmÑÅh–ÄE~á°òóøúÂVY­N†Þþ®œž™¬v߈p þ!GÙ'–º¹ÂFgË<ócœ¥âÛâ—ÞN|£Û°È -@©F§*©7Dø˜mÈÉå‹ôÖ !C*ˆ¯¯B.F´ÏÛEl×wsl”•5s°WçÊ›¶å²UdŸ`ùìRŠìÖ–µC-‡V1œfœ±ßÙ«Ÿ<ˆî¼H—°`jg<æ ž×¤?ÿ qd‰†³­ô£¤!XÿæEkˆúGÇ $ŠÔ;EŠ‡ãÏ”9ÿVÊ%ÙµH¦ëªiìI¼jŒœÝSœ~ïréuC¶é8²Ð˜Ú¯ÙÞÁBIGÇbã)D ö`+?üšØ¾k‰}i¹º×­æùü§Hp»¼ðº£®†Nî €†òŒ„£”æ¼éŽ`™e£ ŒwyœxúhÀÇô5íD²Ê]—º(›“˜Ìè‹7÷V‡·v^ª íH¢ÈVUÈŠm#L›üÍÓVš9X$*eð½0Ÿ3é)”’RÆ7òó^öëÑÂÑ®ß{ÞÖ+2^_ »5¸ƒ f´V8|"?Þ‘E”7W´ÒÙ0Œ=b$rOø¯&1,‘Î×ØØSÜ êriA®ô—׬阕ȕõgÚçwl]¡ ú_ºé/~L/€B>²û¶‰.%ƬÐ,^:ªœY]ß]å•T]"‹4pæ«RWÃóÿpCÅçœQ÷cd„5©ì7ñä×3ºA4 -tŸ:`{‹áÕ‚uÿ -íqü#8©&<îFÞ·ÂÞ‚ÑŠvýܳ G‚ 3Q4r8#8vØ2,§D‘÷väT1éÒîy5Σ­AWÙªò«ö»ß<&t¢«%•~a9´€£®N ChñÛ:Ãýçó “µTŒ­Yd?gÿÂì#–Ü°Ûõ"PfšÑŸ&·Ióe¿‚­[n äBW¡ƒ"¶‘¬ziç{@‚™‰½¦¯F¢©x‰PÕ#¡F•ß*¨¢×ôÁ*ì~ç¦u›ö(‡®§ÎlÄtM}˜²¿0êÛ\’Ê•ØY[M׸s’s>ûaMÓ¹¼} ª+dñjo‚ˆÌEh†¶Ù4Ú&Ðq¹VZo\ æy2Öž£›¯ð¯+2¤ŸöÜœˆ±MÙØ^Æo`Ù©@ -è/ÆüP]õóc”Û«·3G¬+{tôefúäÔ»Qj@…¦~šç·Àá{sn/vÜMÛ “mƒÝ´‰Üµ2DýHð5,Z¢ú4þÅõy«û|(ÙÛXm"l£MÆ(‡Iœ†w'pܬ³WM%ê ×Üì'"øÙƵ‡P¼ºTCîõr]槊ó÷ŒX/Âþ¶å'â5@ówº¤‰oxe-ãt^ˆò*ïz‡×¼å6Bdê1÷³„-õT–•G?â!áH¿àÿ$+ö¼nã¬d¶ ÉK}çgG;BE\ÇùÆ:hÆGæáÆÖv>»Ù¤Ý‡Æ\E¦&raìø<¿]˜›pˆÐ¶Èélûî¿ÍyÜrU= ¼ð/Óí<76³iÂL7^è©vì¨ UŽËûJÇ\‡ü¸/I«‰4!l(¿4OE+RpŠ«7·LŸˆZæ{ëÏ÷ÞnŸ:Aøj››ùë5ÜM¯ô'FEÂ.ÙâÁÁñ}†T9þ9ñ©×—`kG†ni42†¤©oojàðTQ4š»xïå»as òÁl*/Üí\]O=g­Ùøxb®â`û.£þ„Z( -£`õ't†á¤ -ž­¤ç+‰?‹½’›¨íNƒ ÅzöÅ­B?›™!–<ŽÈ0O<_6¹í •w”8-Û´„Š’NƒëÎrÓzã- z×ëã|@G%l}%€„B·ç6Ýb³.’Ö*I4”Ð>xïäɆ ?¸ëeŒ¥¿LjŒ\M¡òUy"+R<É'ààuðÜaêïãËwŸ7JôÀÚ…¸Ö|’¦Qæè‘ÊQå%l}ÞðÔí|©d·›¨PŽ±f¢ŽÓTé%^ƒø‚‡2x'Øžb€ÑÀÔòPký0%’—ÓÌI‘5I)ΉÖe׆ô,ùlÖIººŸi€<6ÿñåË!$y/Vo˜,åûˆQ"f*é]^DI5½$Ž2#Õ}Ú«»UÝçÅ¢=hÿväŸF˜¢”×0 a³bá¤2NÏ’ãû -Jó±`MsD`ðx4ïo<f·Çy‰›¹ÙFœp(ô[Tä D®ƒï˜©©¬>Ìä -¬(ŸÃ ž°<¨Ví© êQ‡¸ø¿AÙØü(ot´e -Ë•fì¦ý,m·µŠ@-Ó ê|—`ÒÊ<Éœì?5J2À½{š×‘j„¤øD5 ¡Õø«¹,<:Þ¢J([á Ÿº%Hè½â±¤rUã•Pö±s†v-õâ•G ãc¿á8MñN³¹Â®*Kç§ÎwLUeI(N]5š<Ý5¡ÂuJ‚<)™ÊÔ¯“×Î]'* 9R´¼œó|NcÖŠÇ‚3–ÝÒ×›*†|DtG<),›K÷±ª{b¼s‰DÎùôŽïüü£´’*8!XhEw!ü’S2Ä޸Ѕ”ÓÞl9Ê·ÓÈÛelìž -S±[eò÷|aÂ\ Õ¦áÕ4}ØOO*=>*óÞJ•)&%W´ß`ä¦k <„Ñ4 ´ wèM}êð‚Çœ7…¹³Øî³>fO}û`Ñ#„$bÙv¡ÂßäG|ãÈe:rœxDã·Éb]P |{ÓCrþôÆÐ4è¥Eµ4|j¿GâL¥…Tx‹;Õ²Ú‹%ÅÔ*‡ƒúÓ9055ý`1|Ö¡ë4e_ª Êg䳑P:·u°q-4Á¬v ó#¡kàeÑHKOnûÀ·ßT»y˜ÕœGë" RdSo^¦‚ ß©åyÎ+SÚíìwÏñ?Aô\©›µjSŸÆ …!¸í>x”}Ú%'#Úå$±µ=r¨pTƒH{éy[~­mÌCW¼–œ W†6<ït?†™ê{ZY}r$z8ƒ5¤¡Ý\’ûòôd õpˆ¥Vì áqLìú\vÏ(S Žÿ˜¢@M×Sä6í¢áQ3?eát}‡ÀšŒvè»j=p@°xýXpë0Ôõ\êhÛ¿ZÓðÐ3²öÛŽ§øʃ´‘YêTÁløaºfÿ äò“c!‡v±“¯»wûî÷Òï~4¸¼”%Æ—þBRÊü~•ðÎ{*æx$r«¨:°ŠùBþ8¶p¸£‹2m®Và8[,©ÅÅ>*J.i¥p -*ˆôÍÂè±]¨¹ÝÇÛÕ1ÛžIê;Œ6õÚ#ÑP Œ3_cL¿5ÎeìYõ+h"ëæ? õ³QfÄœšÄqŠ«ÚQ -¼žÙäÓº¢ù˜G«²KÃy²×VÐB½^àŸ9+Q²ßÀ¤wMïrî¦ÒðïgùUÍ­•ÄÎɶƒÖlËA&ýaX\Œ?¨’WŒ­æyHÆ·0A³Ž›j8i`ΟþA*eÕµ"V6H±vNqÓ9ÄJ:äXÕ5"~«¶éuýƒÕÏvo5¹…§“«}³C•w1£ûˆBLÚÙf6n>¼"ÂØ,ÞmiÅaÎS-ýÛ·æ†Mâ*5SKSuq5)&«kŽŒ“RÛ.*ïR©îìÞçî5Á8âøÜõuðŸ3Ö¸X­*´Í:²åtM8[€†¼ÐîðX¨ïµœãU$+HI¨Ô:1eÿRÖElÖuüOŸËC’8¦†éßWú§(ņ-“r›£h lOÎ(gó,"cU)ë ›TœbépÙ`OÙ–ʸGtõc7LijÈ>m`ðÑYŸkLm)#A8Òg£Å)‡ÑÛ¢8MœrÈ-BçÖ”áÑ“ÿxzΙ³Å—ŸXqõ¢ \Ò®ƒdœâ8j:<OUry‚ÅzH¾ŠÿhDgÜ^X“߯°L®1g%‘OA,lU®Ùˆ1xP‘½ ¨‡2¤D]ŒUò­c\Ì--@Œo“Sh°òC}›á ÃÇÎðrä›DJ¯‘Œ{WzN ŸL‰^`ù†c^úó´åsHub£.lÇÆbÿvmêð“2ãjÌga®Öû”i=®Â Û&°BˆÍhdK…y {#ŽÚÛŒ2 `ñ,;T›!/¥á©ÁjQZØIþú*¤ÂÏ®åä榫v³ zAQ(ܶé8õ¯6ý!;%×{ <ûÄh -¾— -vmõÛ…GúO^h³r;!½[ß Ðo®/â=}ƒÙ~¶Ë‹‰´Ô>8°8ø€æ›L›­-ÔmA+ò¾#¤‹!óoÎü‚l³¯¯éÚ¹Ó@à8‰• ØŸ‚\ãT£ŸžN™å¯xgäå3ŵ›–Ü%BTã“7f´†‡Qû ;‹¼ð®ûÃEä„î½D[EñäöBd÷äá0ßcº5çù6fhÇ~ÎCUË‹æSÅï ì{•jô¦jž’2.ì˜lDvñ.  6L/‰öðÒ -NöÙãº)AÉà)ϵpxªp:zWS³" Xwìï{$ý MI,ÛÜ(GRÇâSÏ3媬®0~„£Š³…7§\¨Ð Øö f%²“Ogþ+e®öóenüïö±zÜu­íë/{ûqÕ§”ͧóŸ’NÓ «ÚÑkàAφû†á÷âÊÑ[Ö`g÷>¯M_LLð`x ½çxD.×oH¯¹t§•è¥²PÃG½X·žpÜ”^†Q_…u8ú*ýšŒ™¿Œ¦+ÊSúì¾ÅóÄX¥}¿i­Dižý û¢Ü–λ‘ªÙ’ô™syp Dn¡Ÿ;¿š?¦¤GÝOHÄàÓŽëV(‘|í8(Êi1 ÿÒw,f7·ÀRÄTîbS·„8Ò­>yµÀzL| -!#þ}Kµ%e3¼”UT9^ɴˬ˹ ÈÄê²&ßÂB/ÙäfZêïöœòœ×ÅžztA*Ž1ûôé}ô2ðÕó£9¿«J*>¬g¨$Éì#ø@8£Ë®ÜÛ"Z—/¿‚}ƧsËÀâI˜TÛ`,{ëÃØy ¨áeX¼rØ^¨žA·RÓà½g-A}W¬ArÆ’ .ë„X -Pý«ËÅÕWEïîhÆ 4®Ž`…ëã´9î~e}ASÖ¾øL1@ZaC(mZoŒ£=Á Î÷V Ï}èÂWn²øu«oU‰½ ui€ö˶vÞ•5 òYTS±®¬òXéPSgU5ú §¬GÖ§æ°{—ÏUaæCÆü\¾×)w4½~ɬ!óŸ}—^.à~D˜ÿÜBú-ØÌË~k¶Nª[WÉ>4!“0­]¦å—*Ñ©ð¼Âñ·Œ‡øGß°æxi»¦n±~1¹ö”¢ðö÷;- IuZ’ÞDëp(.q$JW›¯ÇfP¸¦‰E*ÖõC·f·<ŠŽ":μ&›‡Òµ‘HHi:³¾(5».‡T›TXì…bQhaªW^Äã-ËA¨ãÐ5'‹wðA—,‘¸s2O“èXrÑiŽ{“?×Y¸ýõˆ@Ó2Wæ×gÊwð ¯ù -ùeÎÈh6¬q›R77¹)ÆÏiu¦CAØ[9·Uaû8ôáM*“Åãú°IY6ŠDg9F¬8ìóSƒÁó\`÷÷ ´Yü _ìÒp¡9h†WOöz¨ÿ7HIßØ_>S½×ú9- -1·ô;aO³! }CDÙ˜x0Ý陬 ¢)ßzA‚¿¬1^iÊ•téE'Â=ºë -Æ™~µt…V?¿÷Б‰ JŒC±¹1|a¡¹v·Ôåt!£s¢Œ=­*¿gðº“pˆ}Éi·¾x«²aKñ%qÏ\iž…Á_àôl‘µÃi‡Ü3 -6T¶V“”pâx×2 \@§‹èæ_ ’j1ÌØk—b9‡ºýŽð w­3†:xDBV@GŠb=ë7&©Ðóï•‹êì_¿Êb°“‡’›•¿[E¼sã]hÉÏ1È•˜Å¡¹\v²ÄO1†„šÆúz…±s3R· V¥/Uò•ôº›¶¸d¯]ví`ÅøÖvâ‘~àÂ2ñæ0t"ž¯Æp-¿©«ªHû³#t“ªãy ÒV”œY¤/¥{c³:¡Ú~W6û\¹ôÎÔ5·Þ‡wɶ8s»;ú‰3+‡T($Y]mòÜäCÈ<8í(ûi!.Ù6Fï¥]‘¯æÀ«&OO´¨³Ë¯Æ®l7ùÑ„G§Ñ•þ½…ö’ƒ^™Ö;çTl¥Tƒ[Ž3áÍúŸQ4.UL3&"y"yâç‡EÚ'B0ðª7@8*§…Þ·3Ï_¿Bu7DÇ müºî±5òßÆß¹ÇݦƑ:VÑÝÕÂ$¼¤×™¿[zÓ%Œ~·Ñ7¦€$2Ô\LpíÄÓ33g¸å7õ0LÌì”t}ªÍ×ë'\‡{yÒ°ìxÃßáXÝ&åu»½ Ÿ-·I-—&¼E¶}2ìËê^¹ý¶¹8‚c5ÔŸoßXðÀ;Ú^^õni<~}¸£kþfe«ó"š”2âÝu)âÜ+'9Þ.›?#ÅÂYO¾¿×«Ý"ø}‚mb‰BDè£ -åóD(‘Æ{H•‘‡_Ú°¼$3‰_ü&ê´Z¸*EÃÃ+gâ=ÕHÒž ¬ùÙQ‡Éx¾vÔ~ºZ?j…Áⲑ5¨u^4r¹(}g÷:>LC.Û7âµH81·~¡™Ã -‡Œ7 ³î¼Ä6Ó)ù° Ì ˜ÜÏ·c7Y½ìéHfÎw]ð -º½2.oÚ/S<§Å4qd–øçY¿ -öG\|מ¨‰ ~«fs0M¨ß<ñeŸ‚£ó-çá€S3ÉÀ±ÏÌÁ4ƒÇ›XûKÏ–™iÉur·à1ˆïL#Ñ4˜uÃÆ·ˆƒhf×$Eî²îÅÜy^Á¸®¹ ˆ$Lq ÚT®Ÿ¨í¶±iTÙkFjDâR”(¶1jáŒ-<æè] ÂVs³Õ’wÕ j"î)ò5Ò‹“1rnGÙ¸öÁÒ«“º*ó»qLöHDîn„~™-Á ;à3—ê¢zÏô5—|­/+õ¾«íã{!L™Î„jä,jÐöRQšj¢ŠSeÊ"IQ{hé;ÛáH;‰ù±gpâä zB>ÖÕÍ AÌOk¹!‡Rkb¥憳‘aŸªIzÊbò3D5Ò¯•Ò¬ó—± ´1Ûq##‰ûíò졹#›}d³ÿnÆäŒ ±ÇRaÁ^5&Ki¾¦&šBûH'¾¿”ïM¢"ÜQ´l²QÀÝ5i,ﺸòó1Õ¸ë{à -û·J¥q¯0ã—z¿P£Û–䤨 L—$õØ -®Z¥3Hý4rª7¼é#S§ èßôÜ"fÚ…Â…þ¤ÜЧťòœ_b70*í*À{ a4#s+®Î¾Ê>°RÏÊ¡³C´ÙÐÚ6 }¨6¸mŽ›ÛÈþÕ2Ž0Ñþ2EE°ù=¼mmrà -´å©>ùžÚò®ä0ÙWI釫þˆf¬ÚezÓ#æ¾ÊãÓmÎñˆ;^§¨ï棈vw¿‘êÚó®C^žQN¹ÑX>&¿±ä¤w³Œ¬Ê†~’ Ø䥅K^ÚÐTAÇÙÆ4Þ•êŒF#ìE¤þ‰b\lìWêDºéhð‚û–(ÆÄ0ù§™17,š†º/vR”=_ó%×w ¥y¬6`´}Á²vêW…qÞ¥²x78}«È”».S–_¥¢‚'ž…³»¶ÄSB)¥þ\åjÆIÑݽ̶Äý,õ›ß¬Pî8 *ó'êË´€3ùÕFì ±¢ÀÍ)Ê’Ô¸[2å -k¦ÖˆFäÑW›ô*„@ª¢©+]Ö{Š=h×¼{œ;– JsS£Ë=ŸXÉe( ¥Þ4@%l™ì—Çs²šÚôÅK8ˆKÊ%aqÒ¯ùßAR™R펓•ÙÊ Œà‚ì²Ýƒã¼MVqõçÈýq̸ôSPIÖÇo— -ûØ`Mxàñ³Õó‘Uš÷–TÕÅ_ç+â{]¯NµÖËÅr ò'$ÝU-z¶ájËk‰iÝza»á©±8bnz|½¾á Mx>}Í@ƒéù´÷À%ø-ܥ̿ê“ÖpyŸµ¾1ùï†ÃÂAXŠ õW ÛPP“üVpAÙäTÖ&‘¯h­ÝÙ«aâu2HÝZúæP`JïƯp-ƒú² YH>z×(gúK¸Ë’ð“|ŠâðÍ7*Ñщ¾!¼ˆb5›¹ãe0’–ú°„¶fxÅÄ$¦¸»´IQÊó¥ï­" MõfSZ®(¯PIFG[ÌÙ#¥4K·\÷,îÏß&^Üñ¾Eû¢¨R½zC‚§y„zFÃ|èh¿q*ÍØ⚊bT;îÉÖŽàmàE—kM|IbÖY–±=h(tçnV«(„ÞþAb¾&Ì#†Ô‰ó†*Òs“Ž¨;h@dðc fÄ4CÀDÛ*ÉSˆõ{Ñ¢:t¤¿;é5¿Q„ ²Ï-Jôâ;ŠŨ;Š—O4ûêWþÈ‚ Ôn Ýú`¿ÆÙUsúe%¼ÍÕa£i1Ç¢« v’Ì ™B#ö´ùÈ].T„ÃIz žF°&´ï¨y×úà7Ô«k5'ÅI?Õ¦ü(*æš¼M¡­KÈãBÒZÞü¯lzø†žÛÞ†ù/°¤.×´2¦’¾nÆw^âê›_ê«”ªFs‹ñ‚2_ãD65æAò^r_Þ«J²"jž#Q 5'A"„ÎD˦Ï-Ÿ>‚ø~™ïÄrÊ«/  p©×:JÕ©—½fÖêí穱~Ø„Ú°;šlÜü9ÉÔyL3e<µÐc€ÿùT;îyoêøV*ïü$#$WhšÚ4€È1&ÏÆÞ8}éQãŒâ£ú*˜´â*dc.Pû눘£¸ ,ÊêÙY{Æ´ÖËÑRòyh«¸PS0íF¿Ž/êˆ )6Q,Ÿµo¶¶ÐUOZ±ìJ³ì£Yîίoç¬ð̤Ñ5b©òàÓ(éóñªï³ý7u?”%9$:DK¹D/`&)-Àzú®¿7› &:–ÒiÇR1½XJ$yä˜Ð&¢xÓÕÍhíÇ°˜9NWðqÕ|o@Œá»DÀ¸ l‰Ày˜šàòõÁ÷oË`w}‰Bö1Â`——>Øåâ*icÛêQV亭‰×V*´ÝŒ¶¥å9'ŠUô…uí4žýÙÊåõ3P‘&À<@%éI -¢¹ƒŠ.:šøp\î\ò§bòÆ.ÑŒ‘-½W½äåªl؃Eä`Î'aç“wÊQÏHY¹5~tÝ—«Ððo7·+5ñúäÐ’ým¢!ƒàüL€{Ø_#Ÿ×–šqI–o>T K¿ÖËoýtü F²¹j1)›éx}ÛqÀIJ2¡ò—l,¹Û$⧳2g_[1ê¡^eŸi´”Ï’`ÑB(‹Dû^8‘„² ëÁ‡î´Ø­0žLÛO¬µÄçg¾°NP_ß¾ËǬ£³™ÜÁ››±A›²‹aémÿ¾ 1`I?Âï,ii² ¢ÜŽEœ´I0ø€â@~áA8£eÉÔËò&²Ëb–ulì´XM÷íÙÄœøû!ÎÊ‚Ó•‡XlƲhNíÛ-ìæÒwœHf«2Å‘ß‘+_Ê®©¥:Ä´}ª·u4³.@ý,3Ÿãš1kÍ16Ãƃ–äê|·±rŸ¢`Lté{Ö¼Š²©Ë ÍÙA¯´#z¿îÓ•w;ïigqz¬ùËŒRòÈ{âìzÔ{J›!§‰EPr WÁœ£[ߟ“ç$"¦qÑqIAÞSy¬‡BÃHD’þw§ž¦hñÝWwŒ·èh<‚¬n·#[bË…KÛgWc,:O{ -Œ± fÛâç±›U²]?0“¢¢[Õd ¤Êðmó“Q”øD©R¹Ýë@縚G&‡ÓüI0ÄddlÊõ1.ÞêžF·9ß Øò -ç’è­#Ã[\‰²È@ (´øL5\·‰ï¦ñ’ùš¬-qàVõ‚„ÆCUXŸIJc~êÖZgq²PCCb éO»ÚýŠàY{pÌ¿áä~eÃOKÎÿÉž êz~¾¬ÆV—%Gá¬9#ú6($bdM¶î ‘(L'¯öÖ¯¯¹„_øÜyÌÀRz2ðÇVl(ÄlÛ¾^¥éSysv[2Ë’$QE'D Iy˜&k±½ù¢®‹.ÿíÌù? -p×s ÉÙÃc9Š ͹æxÉ=b…9¶Ì6rL®FØK¤'räH¢ô$ç0çc–ˆÐC¹¯eÈ‘Ü|&¼?âýö>ïû|õJ.?M·ÙÝLýµ í#˜Ñ¢†é&eðLÙ‰N¹ÛŠ9Iž··¯ š+üøŽûL£m…7bU]j)MLÅ7q6?a¼H8¯{«é|A³ÀCšä¾÷ì$§<\†²1Xa/©m¼Ý×)”ƒ„ÝZ×_QÏBKÓûóîô­Lë¿eàaðÛ¯;2ÎA*0>G)îαñªæÆ€]‡ #áƒþ\'þ½«Òpž±|-÷è;^V`5¿ l¢Di}–Þ}ž'|7ºéE0H7}Fðp'±€ùnM)ý6?0Kï‰I¥œ¾JÉiN{ïËÀáµÉr¿u¸%-fЄôD¾³’å;ÅãÖ³m‚È”J&Mi5ž]å,Õ°5j­6¸Ì\è8I°ÐîŸjé»B‚iˆÇ© µ"¶Ì~éˆ=†7]P>ó—>¤î‚sõH§!m°¨Dûä»ÆèM² sSa»»Mh©™žl\¨“yÓï´›F‚÷Ý>k¢ñÆã¦Fö€O+?ù€Þ+ˆ¢ÔÙë ³ÙKQ ]æ-]#XÝß n÷²j|5ø#Ÿ<‚d¸“°ÉîFBF1d#~žÓ;µžpÓÂïñ§mXüˆ> Ú…£¼¡„976d¨ÏÝðÏ{"©zè¿Ù§éÝž,¢ùÄqåñŽšHeÊÐú^GõA”fŸ•âOòRᵨyù % ´iÄ;gˆBŸBZyúï“ÆHï³·×ßÝ`#%ü¸lZ¢Vœ^§LŒ¯i¾@¹7ZV`ýÃퟙݕ«¹çÖ¸pœ¹Ú‚Þ‡¹. 3èúμ-Ÿú˜Ó9öĽ)“ÿ zN‡R7íªµáþ>–¥áÚ_i^†HQùóóq’Qº,çÝÀ¤iµ ržeϾ¹¨1…Y.¹'æè·]êá§Iv¨œŠdâP5/ûD…¡D÷5Þä_1Q¶• ݶr¹­£ß20‘"®@šûvñ¡¿Ïu½Ó}SĤ”ïZNŒ‹Å½©g~$1 o•ªÌÕœ–SY¶€Â‚6 Ô»e²Æ€&ˆÐkAÔ©6“OúPŽKàD ™˜øéKoj¹ÓA†õøØKù -ëR-+[~±[Ù—Õ]`Ê£™Fƒßê>ã<ãÝk­¾e•Ç‘ ®2ùÓ\'ú¬Þ©•qÿn”Pxtÿ¸áÕÑCüì"À°#×{ù¯w_Ö"3{Ÿk'&I£v¦ëA„%”uÑöùZ[oÁ.Û®MôÓw(õù·ž6ÙŽË¢ÀäP-Ïrx‹rX¡pL%żTmä·©Axz$9£«ò<Ñš‰©E]†Ð5ò9ñ;¯çöŸä» |TÒÜ…³æ^p.ä3>Ê»ßÒƒówCª„¶.¦MÉI]¸í¶ñQêRK+õÍþã+uõ‘u'„b-8ý -7b!]w©º ôô “ˆ`–ðLß­Jœ¥“—ôºcÉ6?@¯BËÅ”x²úcˆ!¬§gY8ž?“Úˆ å.0’f»(%£ #.(8š¦Š[¶©°Y‡cç†M:Ú ? ƒG4®SuôZÛÔª!?@ùk}ï¸w0̲£>Nü‰]| ³Ø3”¾r•x÷µòïæöªg/Ble§O˜k\g,U†iúõQŠÙXÎBb‹GH!AÈä­}©‰zÐ|טd©]æµô”NÕÕ¬ÝÄq·zÍ¢W ->X`ÐÇ N„[5|ÙÃ1^Ë¿|ÒÇ â¾½×—PפV;_k,ö wÈ“OOy˜ä•U´+â#S½€Û²ô'½Ú»Ô:¿ý\Ãv§@u¾FúSË26uø`ü}ÎÛD$*Ã{6ý•ƒrÂO¯dðÇe“½•ƒRו´‡µlòàEUmäó¢2égüu5]¢´L¦Ê1ÇÅ»:/’b­÷J”¤$z›¬=kY>L¨ôi»ž6èŸ[‘³Gzm}ýö¾È½Vwÿg²IÈÛ$ÍMb¸øHYTd+^½D¤XúúÒQ¨†_–óù”–ÙWuÀÄöâvý4&"BÒ¨o ®\2ø²ëé!a ³¸_f}Ð8èc«‚Š«µ,-ÂXØ&†Ä—&¦ë´"àâC£”Á¿UqÔãÆúV±ê{˜Òø1'…!rUÈw3І`6X] ™È2çÒÉ-íÒù—ÿÿ‰À7ˆàìødl…£endstream -endobj -2972 0 obj << +/Length 19033 +/Filter /FlateDecode +>> +stream +xÚ¬—eT\Ͷhqî´ÑàÜÝ` 4îîÁÝ݃»»$xw sν_rÎýû FÏUµ«f­ªZͦ"STa2±5ŠÛÚ81²2±òDä”YY¬L,,ˆTT"@C'­¨¡ÀÊÃÃ?€y9Øy9Ø©"¶vî 3s'íïN\!k ÈØÐ gèd´alhP±5Ü™BVVåßO8”Ž@  "++Àdì0šl™+IÙ˜Ú¸þ6q¶ûß& ƒ#X +@ó/MZXÒÄÖÆÊ`4Ed–·Ï»üÿÐúïÁÅ­¬ä ­ÿ;Qÿ§ÙÐdåþ?l­íœ€9[ ƒÍwÕþÛMhr¶þïV)'C+±™ÀòïÈQä4Q9›L ­ÿŠmLþ[œ¹)0« ‹)JÒÿ{OÿÕ¦h²qRu·ûgÔßÿŬœ@‡œ^VpGðÏÿ~Òû¯¹ÄlŒmM@6f6N€¡ƒƒ¡;"øô€‰àÉ +Ù˜Ý@7°03“­ø8'ÞS[Äß +ÞsfÓÅþl`ýÁ÷`´úƒì¿;ÿÕÌñ›ÿ´³ÛÁÙ´²2ü'ö<x~+Cë?!p7{g[' ‰‘Õ¿ÏÇ?-àmœ­~/3›?aN³‰-xT‡?!.³ÐÁhó×ÓÜfCkpÔѼ%ÿDyþg¶ÿœŠ<€¡ÐÆ +húW”õ¢ÿÕœCÇßC8Zþ ‚Wfgåìø'ð{ù¶ÖÖÏ^¹»9ðÏZØ9ÿ%²ýcÈ^‹£•¡£ùŸx%@Û?ð"lm€ÿ0ØÞÉõO;ØÛÉÜøWß;iëü'c¿÷äòW°®#ø”ýÃ`YG Ë_®àÅ üDp€Um@‹pÿ^³•í_ñüÆôŸQN° ÐÞÙðÏaá|ÿ{_€Ž¿«ÛŸ ØÉðÏtœ`%¡?ÖþC`‘?öýC`±ˆ œ,ñ?6‘øCà4Iþ!°“ÔËHÿ!°‹Ì»Èþ!°‹Ü»Èÿ!°‹Â?Ä vQüC`¥?vQþC`•?vQýC`µ?vQÿC`?vÑüC`­ˆì¢ý‡À.F†Æ–@§ÿ¸àoœnë6¼ÿçÿ¼-<¿ïÈÁØÙÚÔ +øç|ñpþÏ@ÿ9 +X÷Ï…áëý!°®ñŸjÃö5ù ©¿ð÷ÿ Ávf!ØÉü/'ð¯:ÆV³ø ÁN–!Xê¯"ȶúSÌXÁ…Ùæ/[Ùþ…`+»¿ð÷¡ÿ ÁVáïø‚­œþB°•ó_¶rù ÁV®Õq°•Û_¶rÿ ÁVáïmcòwbý]ËÖÿû-²2ùwÖÿïwž°°­›'#¸ÿ°üÞ0ð®óxÿgO5øÞK‰‚‹ øýŽ;;€«®Ó¿þÑ«ü/›‚À_¿@ Ðq᧭1_EJSH™XÁT9,¤°Ys¬|}ÏN¤Àù8H«â{ºÕ:͇/éX¨»°»¤®O„Ž^Jãâ§þö±©³/».»é­„šérî;vä·‡híM3WG +Ó«£e‰Z…ƒYgC‡yŠ4¢ª¿à—É zu\z3‚8¹4ÅÓ­ÔBƒë¨ß“)£§Ú—…±‡®¸¢'ÆìLúX„"´Ð/Ûv8c> ä&¼èÞâÄ`w¾WÞ¤ÃVþ%pTZŠŽVû:ðµZ0`¦âØ…]DP‘ +ÌÆ +©Îò ûôý oB,LÎ唡µC“왊SoµxûÓ{úOæ…ÒóE,gñ¶Qïî<^Éw<ù2 ¾”ë~§^h NyQ꺴ڰd(­xÚƒéSج¨W™jB>ˆäv‰¯žÎ‚ézBÞÅŽˆ -ô aÚ'#$´!~Åýl¼ìFY™e<f’hÁó áhw¦êu]mÅ‘ÊrOÓrªP^ÝT˜+¶0Æ«‚Ê%•*MBù>þÛþ‰nA¦„R8yÙˆt!Èž†j!ö,v«àJQåÅPñà\\vÛèÒ)+:>ÖŒxzð½”*óŒ=Z«êÔu dë㦘ÀÉJT³š9C <ÕÈ0‡hZæ­B + qàŒævZᬎ1ï%v£dæ#c™ƒŒ²Ï+‘MO<†H(zj\­;£KTÏR + [ªÌ1ÐR¹’wüÏá°¥”ÖtœaØòYž µ¹¥Ð}饀Ë%H{ºÃϲoYºJRl;È¥‹~x„­AEÐùFŠp_ëû ‡øG{³le_1[Wº»—Ëù!>æÏi/hŽm¢õ“8ÅX$Ãyãn>6JOìœ3,dEM7çQo‡C,+ávÖ`ا‡àŸ¾ÎÌÇ2m#ºàõWUŒzM@°fÁ¹–[7¯S!)ÅÆ$ƒ\;#£àŸ;¯¦4Eå½½ãÜ¢Ò¼º`Åb™ÌÞÊxŒ#]©>#¥>Z6ROO“vZ»m$Ø2aò£Ù\äS[]*}ì–šY`@N@ä‚D” ­ŸV#9,°ùÕK^+BgYVZì4ÂøéÃFU?Gxž€uWu5¨Y¥¥L¯òѾÿ+wÜ‹eq:KÉOÎÞ§¥[Ë{Á¾ {¹§æ-¦”™²¼7¢¤ÜY•pÞ3ã>2õ‘IÂD[û¢ªC—mÏ„3 Ô×¹¹¶_ªz¢yJ)JFKïù@f¸w)Ñ6IᥖÒðI7Ëhõs§î:/<’Á»[xü!ºåw¹WG¦Hpëòð¸!+ÈQGÙkÓGwb>HíjqÕ”¥Çïq'‰üìöÎ~tK“)gè çJUTêxÙ¤!ÄR¢»&̵…èfZœÌ¥æR’3 +±NQÕ³‘0¥µëˆ›~Ô‡ƒ@} ¦äxY=zÚ_UÀ! +‹^ j¼yø…ý³œçmMK@âø jCRÜJ唂Ž~¡òd‡)åLœ)¹,­‘Þ͹Ùó§m¸h ›¤æ¤’ÙÈ1.li;oè%@jï1®R²®e•›Û'}•¹z%Å·³49Èé²}àËŠ2›à«‚ͬ‹#ÔŽŠ §^?Ù[³“ÍïŠM¹Á1©j‘³4˜Ÿ&´«^ݛϰl´Þ3öµ2E 0ä´æ¢ 8å}†+AÄ †K¦ v4BÖÆ2«'éñå)Ö¸Hz÷?Ž ›ÂÆ]Má,Éõ ˜ãç³°¦ÖãCæûmç‘K*â#$¦Ò¸Ô—jŠ%À£ÝbÛs]dÁ¨jP}>ÿ<ÆCðVÚõM'ê[s¼’(éoüøVz†¡¤i(Gô\̪úe<"lƒ[Sv,bE†¾ +ÆÚôOƒù'*ÝÛ’í–ºrÉÚs…åbjÕqL¤,(™G½gIj#ØiFÒË  m§9OV TöÓUG‹w@™¾ã7¢SdžøÌEòÜ&ý&¥+vá%ÞbŸÂ7¸M•q=7u»“$¤ñË•FŸ„ˆöJpj6 Y;²hå¾|=ëk(Wç¦YLÝ:m½ëTúZ¶º¡ei ›s;*j, +oÇ–©í2k¢2ÂW ˜ºøûÀ6´Áàô²£Q±žy€qOI7É&Yåf@ÊO$0Ýd؉9z (ò¢Ï­õæ©ùÀˆý&¹æ#¶0ü²@KîbDq74G­XNèèlõØš†ÛwZ¤¸¥Ë˜‰Ø7%ô6=$žÚ„äß +ÑÏ’t”ªnÆÇ}=,Ò¿^ñ³òc®Býœö¯Tä»?ppœØkeü97Ùe¸+õ‹ò.•øþqáuÜ4Î_b/ðüíƒ$Ö%õ/§êÑNr¯Z…¾yÈIPµ À~'}•?“àN„ÇÅÂÞO€°ö­Íõ—»@rˆ{ c|\9N/¸ñAÑa~Eé]λôµ¾ty«\a‰_úô|±˜µeàŽaÄf̨‹g”¢!èK/_©Å÷¥HPNyÕaé=—éÌÇí ³@ç(Cróf¹®Iˆá^¹(tŒÅcƒò®$ ‹²šå-Ö·jkùîÖ½òÌ¬È å2ÁN’<2!ߺ…¨ ѺI ™¹Ä_G’¾ž¥jÝ9ëØm­d3Æ+©5ΓBÃiÑMuZ:ÜÊð€é¬s½Oàð­ 3x¼Ûìy忤¨†½Î1†ÛÖS²yL½î`:À:' }¬*ÆÕ’ªí¶â º/ì€`Ê`êÄÍVç\FИ5õßðóYý9‚sT<Åðe#S }{T'#Ÿˆ–&èÈfü†` Kä•|PjiËÉÒH­˜ïÚb#ÿÂÔ²iÕ`L‘‚pö‹ÒõQ)2ÈaåU£ÄÇ™L_6Ù8ÂÄrlÿ}å8Še(õNþWØ›¢|GhÓNâµ7«¹Q}1%ÓÏ/Ñ铵·FuÓ²v]Új:±9a?ƒÙörÄ,*ÄÓ²7Ù{´‡Îy6/P¹1i&¦ÄŽn^YxêÐe¬­îH1D¨éÙ1Œ$9`¿pP„:Ç–™U×âf!•t:î"‡|áÈtŽ†e,˜k’@=›í¸Ê÷ì%Ö•Ö·T©ÈÏ+÷$ä!—h­Ó†àÀ£®/©O¶¾R~ü1 HçéõÁ£º‰T”Ç{\èÃtøýd—íÅ0yGÈÜÍ "zrj,Ó{è,šwGÀŽý‘ÙB©“P‘ßGE×k×Rüc90_Ûù9=AåH4Û¢ +%* »÷ûDv©oØt³HYlÅévÄï‡ixeü"nD†sW8¸¢üo'«-;x Dj¾² 4P89LñF¡ žÌp_üHÝ6G¯?ÄwJR^IHRWÝÈï„â—ï™PÇ ”ã½ÄÆfÉ÷f²åoTÅ×´~q#ÿ‰m B°­Ý_&s\F.:€× ð¾sI¼h¿„Ó/!¤[MOÓì 0ˆ’XÝÅ/#Ú¨=ËF‘Ÿeq:#cäÓãÛýa[ û.-‰€M¤F‡¥½—«ìj¤c±¼çýà>Wé£nÁªƒSL?rëûæ+wФS`êNÄሱ¯Íñé#"Ò¨I‚OG5#Žj<›æ'¾Fy¹Ma߯®—¤^M)!ä¬D7•} ЯÔÑ úå“ëTW¹Èòªã®Ýêa‹‚0Vf-ßs#þ±€L?ˆèXü.¯ &®'RQÙX–’ÊàMüúA’&Ÿt!®“í “’CÀ‹GË’2„J(Ъ÷Ô¯às7«^ÞP$càÇF³ž»¼H&E»£“ßpöw³8Ú؃’îˆ?ŠkÓôRë \RÆvŠy͹ň”ÙÈböýFC(«å}¿PsjR9GtFŠ8“wÃZS£zjÚBdK‡ÃËÇPŽ¥æÛŸžìb½J‘*Ø‚aO?)rG›Ï(Y.X/ièÀ¿*N„\óŠø‘8gòs†~•¿6F©¨1Í&zw`Wd%5ÅÒá@T ÏUHgƒQ¼ô¸=Á¬·.ø}‹ ²«4ˆ†ãë[ÿ^¸Ûè  Ý +‚êü>àû\¼Ï]ýñææÖ8ö¤eDØF3 íP:Ô>Ç›¦ê‚µfm{È”,}jE¨¡âmêÆi³uÄ&_O†o»é±=&7]Òí]6 Eì/?¼ˆô¥rÕ ½ ˺ –ÃW: =8’jóúêWã±\˜9}Pc¸¢M)m¡ã#Í +µ]Ö}-IàKH­ÐY‹,mÄɱä…C*Ì•‡+ÙÔ(‚¼®1‚z=‘¬Œš%—‡­”ß%nÑ{^Rƒÿfõ"WzŸ­ +5–A“šÁ¬2«ÌCv…'ž(ŽËM¡5cÛH0´‰L{À8Ä,¨ƒÀsTàˆg×ÔÍ”bÛtƒ³v¢ƒÛ‹­:ä!b6ûå™:ìi';e‡Ÿ²£«”H½sPˆ<ÈvC{ÔsZ°Mf@Ú)Y n e®r^öZÖækùeÉ*{kþ5TIáÄV/K¶üšXXg©qY£áíØ£ ;øÍ3Τ-u»<ôwê(® n¢Ø…'³­£é´0|… £ÉäœF Ê"½[F•#4›^ÆšBio5Ÿ­¬h#± Ïº^°r*Ûýh³Ê_Æ^pË—3B„v²ø˜'‰ž_× vvw*DøšÕÇŠïB­Öº¼ÒÛt4iÔ¶JQ®!355«·@³‘âa¾¾« d&¼Í™eÉÒ±cÁþž©eæΨr|“(;¥ÆG[ÛÚ‹÷Ý…Wñð–vÉÄû˜ +î}ôt^˜Pm}OÃuœšž9¹ã/à€Œóh8Vךէ"ÂÉÐæÃú‘Q3¥Aµëe¸HW"½åËy6i)æÜZ§¦O¸,†Ÿ&8“Mž‹úו€Åƒ˜éPÞƒ›ZX6n™ì¯øͱZƒ.B'Ÿ`œÌ9ŒMÅ+ëº[\ŒC/Ÿ<Ôª–-á|c%qš{)´¶ªÐ¿¬4TFpêˆáJ¿øYœ6ÅôÒ9b;ùÃòq?ön;zðËåbª»ýçÊú×Ê#˜ôŸÁz» G‹ b×ò m”Ï;›Ÿ +à— #íD±AÎxÔFãäß[_‚…U§PTGÕ6ç‘#G¾6Fïê®'¡!³™÷^,2ƒŠGùo¸3sÒ^E”‹°;K +źœa÷TZtSÜä °Ê&^1‰¼Ôìõ±¯×ÍZ6õ†°úôœæ6ðj½DÓ‚˜ÛQ8eIöVÔÓc³Lh²9&¢Œ'R#‰¡³qr^GÕâOõ¦«pú+ÄI®n (pPPa£"q8( |osÀTq·oývY]ŠÜ—q¼hoÎ훼ÒXÝ‘âv¿Û{9Ä?œ‘é×-G€ç‹uÅð59™¦±Ë°¹É."…uT¡'óìÔŒ«¥Ø%zÌAÜ¢ÔÅHuÏP¢Y2‹7u*bûósIÖs¢*¬I0ï ¼lΈY5óçñ)E¾|7Z!¼Bž˜UnüÉ{¸ÕÆø¿>x!aðŒ* LLÅ!ëø<Æ^gP;n¦vös úðIe¢ ø†X-…Ró¤qóæß;.k 0RÐB¡:.'ÉûŽ† +¶í0}% +í3ÜÅLÙ)ýv ;¹I!Š—©—äSx¦åÍ–^u—i@µ¡QBÀô&)@QäLóðÊøº¯"Bk‡Æ[¸#-4?JÃXPm‹Ã8í‘_P7ö=é‘ÍΘÖC|‚ë&Ž‘œ?H Õ±ê;;@ÆÜ¿Ùä³è“ãpùÏ'q‡T¹…Zo«£ {þ&nþ‡{ênŸþƒ¼³Z—LòL†.DZºPð¬HQŽ)ð™¶en<D¨Î?+ÞÇ:jCÁ8° +>ôÜTwR ð°E¶w&T“ƬHI!I™‹OBÄÂ÷ÎR“ø”¬Äû>.!,ÕÖÚª«ÈK¥Erß‘‡ýhÑÒ%Ì¡/P-Pxì9ŠÜdÌŸ/8鉲(«33Vmž¶âÀFDÌ7À‚k7Hµ ²lº„ýñ†·R2á|Kú3ÜK©ÆL™Öé•co³µ~:N¤îÆ·Q‹o&t|cÝlÜ®× ˆçDÏÄ# w á{Jõ5 ‚|´’»)¡Îk{F ²Û³«óšßíg/ûÕº°Ýí¤šÊÕ‡&KÒÜ{¹tÚ +#¤îg<S:³zë«Š©ðÚ¼µl«ùr+z©¾$% ˜¥ͤ6ò2ƒà"¤f‚9ý¥ÜèÓ3øÏPawÃd£:ÜYv– ò_„Å2ç»iEŸ ¾˜à¹ßLEö̆™äË×ø#¿õèÆÆ¥óë +#‡±ƒû&®‘'à¡àJí–¶æ]à‰ÅÐyN3Vsí½_Ì£º›œÞyN\Uqç€*…¬eÁx#±zŠØ7$SfbBÜøæ˜(„8™žFôgpSÍX²rê­>éwÙ’½H-ݺ²·¯rSôa– |K>ÜÄÄ2Œ(Y†["KÞMSE,ß¹Ú +e…Å©r¿Cc¬å0ð¾K|°k)±|¦â*¶KÖ]Ÿ¡SõSˆå¨ªäû™­·WYÞiˆ¡H–rfÎþ@­ßÖ-¦ ·a’" ΆG­ãoÆÚtž¬rØIñXÅQWü~©²âú>͸‹G”ã—QF÷)8=éîØ ŒÅˆí¾™lgZ+KÒ—e߶}¦¸ÎÖÑû–!]>ÜLñ¥e¹ø6‚ºCdmv~ +2,ëÙ³XM +õmý’×8Opnjè¾fs4Ôí€ÑaÃlËfÒåB÷f¦þ‡†`6‹ºžŽïi£?…‡V¾®¤kÞw.Dáž ¨6"‚ñu^†*Œ$_DáÏŸ<17 àoÃSMf‘‡Ð Hlˆ¦ Î+ùS÷_í¼ÔðĽ × }8Èða{`nEæ•kl½FÚH ÔW>LrNµkB»Í ~âþ1£gRg§ð Uƒ†¥6;IIQ˜²;^Ý']e8í÷QQ™ßÄãƶóÎ4ûóžŠþú>ÊF˜ÓýmFIǤV + Q:€Ï¼º£üf^/YSŽòðUVAžú0–ªfeVwXPÔž%¼esÙŽÜ!Jî5UÍ)•ý£Y9u_||ºi.;±ÁUüìÐ pgwîuë“hDB%ªS§{%Æ£aûºá€ä9J÷Ô–ñýÂDÉòŽqFºAÌ»}É!ªÍAÎi{Ÿœ‰–§Ûµ^¶ÇEYT +…A­ÊIÌ þMê„Çkà:E +Su¦·¢ôWA¢sƒÖy|(^Ê__bŠ'xMF±Ž˜£f{0O‰d^ºš—÷ï+°ìZçå'BM£%6•Ϊ.KáåÈI.%Äï{™(·;öÇ-"Í€÷,ºò)âäs>>ÕIÛA-¯+‰†¿ãžR•áED|:U¯ é º¨:±a‘bM÷—S¹’àòœŽ×z­†å~!ÿ"š×ã.Úa8”Ä’W;Ã$,ë.>Æ<yÙ³ÒåCÊ…ôwÉyÛbgHߟ÷žhzS{˜‘n·¿Æ³mâhÙw@E"2((Ãð†+Âhn—ã ÛD*0þÉØ6ŒŠh‚û€ûã^my2ÓÔƒÌß™˜3Ou¨W²}9o†¡<‹£v_7/$àée‹"Ǿ¤XZš|P‰t q`r×V¤¼¥¬¿<èOÂCÁ[Õ-ßú#ºß™»‡ÕÞ&¤+‚6ü1ëÜ&®½±ûþõªB•ºÍ—”:·ÊÖÐV :üÆ\G¡%²ïü *E²8˵úîìÑÙ¹£;UiÝ>®ÿð¤^¥DY&XtÈ‚IþkÎ8cáes1Yd öø{·ŠV}ÏP åÆä˜8í;ÔZMë„ZXJÓ¸„C¶y/:чÊ_yûgú7¢Ü_:DBYvâN9rÄp>@/Ü·¢£sIe'²<|}“´ßc×ÜC]\º2mŸt>bVV]ŒulH¡RÒ%ÛkÊREyöìþµŽmK{÷'ô¸Cœå³²{ߣ˜Ùš¯ >I,Ý7oURùüŽDŸlžxÅ´‘ãöïœEkÚ´JæW  …‰QÃùÍm<¸i +U_y¿›ÿH³k¢`ï¯Çoï™é»Íxq:!1"ÉS‰q:a9m“2ȉ5ÐJ<ùì KºwßÃÎæùž2ª¾_¿ E j +NZe¦Ë’LÙåf~”¥b•6„ž.⊡òºü•jÏS,ÒOâcè‚l{ߨžMFG·ìõ¯› 3X4t "Ï(ØA‹ŸVQ¡‰v"ÉR£Ø íÑøl¼q(Ó»þvß;V#Uüî)¯“ZëSò|~’Š„és}8šœŒN˜Žx*Yå£Y¤U¼Ÿfß„ôÞö4híä±dÂüe]!ØÈÀÁwyëR"õ• A¤|dóf ÇŠ$‚eèbÕ9‘²›õìJøÙïç® %iOøÛæ8ôžÛë•B‹1£^{ Æpñô›w)ª„\ºØ(Pn¡÷-aÚ6ËQr¾ijêsÃ4ælÚÀ¦¾(éóù.4ÿÄ=!U´KRqbÔÊ}µ¾Î^_úyW•é,‰F¦c2H²íïá¹ {mÝgVpÜ–x.j™Ÿ¦úG”l9­,Ü#¬ðqFÇÔë1"O°bPÒ”6"¤ÄŽüúrÏL¡Æ¾3Qsß,Îtü$ ¥¾ó¸£n?´ÍŸÄ‹‘è&ºhÅK[ yið{Ûyrr°Lf+ΣØ)Ÿ.A·a·xT­…Z°urL²†¬mE?—Œ{ñl+§^IˆÇ« +ª«îffù±%{}­HrÅ+˜åÈäçᎠL.¦‰~SÒ§£“0R»\ˆõQÜ[_'»xímãòQå1¾©Û×€OxúªÂS¼ÂJ4ýù‹vŠoÙJ-ékNàX‡ÝyjAä}ͨLÁ—KdíZ·«dß àðs7²s_Ôç[éÊCtÐXùü2 +–¶ÛxÜ{ý‰2¢Ñk9Öû_!¿qÝJŽ5îlQ}bû2­f]Xù£íV€ºÆihIç ¿Œê ‘8¯¡ž¶òáaóÃ|(.„oÅkZ2Ú¹¹1¾-µÒËÜÑûªµù6>sùgDxéQûý§Ÿ·¿””ìédmc(sq­ˆ²e(ìE)í­”¬!ìKt¿¶ØsçFý !Ñh{íK 4ÔÔ¢Ÿ–¤pÞ2fhû˜h4~'ßÈéKg[‹Éy}í€<’Bež±> ø*"ûàí!5|„fÅÕ]{wÖÓèçoîá=(™ÛM¹ØJmž6ÆY8…‹Õg ™n$-Þ‹ z7™Îà°åÔqÖ`'9âÑmä ëZ¶© ½ÖàE^¤)âqV‚D„ÔҦǓwÑB#÷dç,gøH±gÍð‹é½ä›ÛM +Æ}îÙ¶¢èà‘I€:ýwum­¹J:”Ì2Y >¬Vç óSDû©oê„Ž¾¢Ãa.>=¦ã9¤Õ}Âq–;š=M"µ¾«! +ÉJzê¹™•¯¸ÌÔqRŒÔóo-É ?ÂhÞ¦tw EçÒõœ!P¦üüÕÇÍdØ1›u˜³‰r¶­CRfûÖAŠRo?áÔé`2!8>äý\žž¡F¾1UÅHy—ÒHl©÷yÏu“ÐÜ<ÐçV h3§L@.†þK„wüÖîýù r6¯Åϧ‘ëí d>ož1T©K“&…hhÚñ°áè; ¡5’kKÕ~»¡Âqš^ ²†z²b¡ƒ¿ôü»#ŒÓþš[†ëŽÏóÀ0”Å™â äíÇzZz;§Ge.,‡Í¶”G#G\:F@•ÿ̽tK¹À²¾kóÑÇÒ1Æøííu…¡gIÈ/¦/ja³³ž°©íf‚Üó$§ïq¼(Pk\" ãq¤ªý>žÃì™`Ȉ['Å/Òjdߘ}‚uš>Öï|õ%æ#R&P*ê—Uá?‚µupOôÇð‚³ŽlËs›/Ò”wšÆ^Ž¼÷ +ÿüÁ7Yr„{’¡®FÅíe#é¿H56X˜Ñ윿÷t…u}]F¦¸¹ëÔï¾´ó=‘ì]¦z®èµÄ›m¹pýFòTv¸¿èë@„Tý§»<*†V8‚š÷ÑÝg‹öcòHoU’žmç– k®ÉÀt§&MƼq×Ã%žB!½U ÿ<7è±íã2«—[ÖÄ6Rúå}#pï]Ðwâ„P+[Á(¢N&ÞˆhO{÷mg]®È©° ëÊì/³”ÎŒ“ÂðQùŽJî¦ÛxÄÃÊÛq?Ödó¥l>î»Øowèu "¤ô’\Vî¿ø)΋ìžEFeHÀÍ>/£çˆFÚ1FßeJFyǯHÙlÌD0vÅj¬'©=É"1į{BÂ56¢ÿ,ÏD¹›®¬`=k}ßšArµ8”£Â!ÿ¨¯­(Luƒ<ø2„HËÍ0£×Y? +UoÐÝtj·GjN¬»Žv˜‹‡wúO9ƒMz›¨ÒLFeHmíYq’4\íü³R¹“©¸÷=éÃÊÙ;O>Õú›wÔ䜤â1çKµ¾lDíãÅfçúĪ’]·ÊfóI?rïÇi›^zLF®S7 +‹"dF1È¡]1 pøq£Õ9_Ç°ðŒÔ£c˼åßæËŸ³TѦѸw¸ ÚïF¹'I«|ÄÒ.Þeo¯0M#&Ķ0 +PœšbUÄ ]åwØ£3Õï¼°;KõÏøa¯š¸Å]VÃ;¤Ê¨+z/„ßçßÍñî~ˆß6Û4"Rÿ +ï—ì¤úòpçAÏ0WÂy£LÁ&õÇÂâÀï’^®.T¨-22yxÔÚúðçoÝOäR@/-Õ–Qbëç¨\LЈSUð/ŸîscC¨åÊ|Œé€=¸–ös¼‡`Ô”ô6—×µ7°8®µr6( ¬9$æ)¾h©¹’ª–•ŸïÌôŸ…/se‚¦—ä°UÌ›Ïx¤<½I D8[*¶”æ ïM“ã„%NQ¹f+|ÚªByA’>E›6›5Ï~[]ÉËû…#îÝho.dú—«fÌù3O u˜.“ÜçëûøsÀtg]½-<Õ·©NmLi–¾‚"+n8„óÇ!G¸XdÓð륫;ÒWI÷BíQ®‘îšcÖˆè#ù}-óPø‡”°n#àÌrAsUµúèõaÏ¿Ô”ÿú'j‚»œ"‘†I;ç· *'õmE +ªñöJÝ<ÃΣ¤²/T5q&MÎù~‘¿ @C*Þ8™8ãØš°m|%‰„9ûŽ’$–]gM½:·ìî°ø˜Îx·‰!ÎÇý¢ºk=Zxû–¼IÕËkc{‘f•cº³`c¾šö‘h¹õ®ígÈ/°‰½×Ð=[¶ ‚þ¹¯þãcÿ#1 +;¼² ¸*Û÷þ×PÄת1»@Èùk Þ8®ºVç'7‡PÚa}p0A“Xí«åì_§«1Œñ*‹u• Å±6%"uháÂÆGÌŠöBñáW—Pä]÷+/+ð;¾Pù…Ù*o6Àð2ïp]uId–WÁùS»3’¿Ž?c- þc…¯üÊk}ôSÕŒìD^‚“Iª°Õ{"yLx“V1d†Jì¨`š¢µ ¥‰Tí>¦À´¼*oï¹öyxDD%žp…î²ú"¥ô§Ç^>v#FåE¦Æ6ßdgRƒ>žgŸ=K<ÿ<ýÎÜdÆ\ˆMÔMØ…Ð}dߘfb œ÷­³ˆ ®ÜéQQb ˜Cõhˆ›g´0]f†mè«uQÍÛ,,%ZpZô1ÏLål:æÂi,³–YÕ)c# ¹~Z‡óLg€ØâÖ¤5¬æMvüƒxý8âÕw³ÆÝ# 32mò’NŽ­Œ=؃ôOs.1÷¯“9Xr¯‹‘ìÝöIè.ú®¶îÐzÔEMj—†¾çeä9iP9PY~Ÿtž Êý±Ü+ë;™Ë€%h•ÒS¼Sb¯§‹%³HxT¸Ö>™?"ç•Q¤ÚpP PÐ|Ȭ1¶.·J¿Èº®~8Í=YÖÅB²Å<ä3³xC…úkE~j/±^Ø\ß"¶ßˆé{ýªƒÀÂ8Q„6´‹QV»±(II³µXMS2l'Ž $:ã—ÿ Þƒª“ó´Ïß÷" LŠÉ©~eg辤ÿ“ìÄS¸—;=¸òEo¬/ŸÝþªg}3¥ ™ï×ð®g}Ú#J÷B×y>?Eüq ÂÞ\î]"¢s5ÏÚ…¤J«(7ÓR‡o\àŠ$©÷ŽZ›¿[rù ÷žgKtû>ëzn Îci±³±,öOþ¾3Ö“ªiãQÚ#þ„”.@©ùAFç?Ç„ÐÄ.¡úùMÖÜ:¾ß¿‰;מ|{ « ñÖ¤oÑßKL_’k׆zðÁ3³?,èÇüñþ@6>§Ö µô2Ã4CR;f¯ëÖZšå‡¯pB­:PÜÊïªXôr‚od©_ˆ4>M¤›7Wó´‹ðIU¸(¾5²œ¦Y÷JøÀ-„˜g,ý ™àæi…Žæ«ünÙñts3å²TG]cYSƒ¬ƒ P1umNC8+‹¶I=’¬X¼ZÑíXÇÊ«¡ŸH*²¡žü&2Û:Jb`Þï¦J<£º¯XíûUÄÖþc!ÈÏÈ?³ŸÑ +jK;³RÙ-ìj¯ˆÎüGbf¹™ ÉåºÐ8øõžµ˜Ibë90Ò"åYä·óyfL{· ™µË·Ïa:²'V†“ŸûsÐ>ÈY廽Ң´ä¢ŸÐxw¼%]Ó<Þo­>þºpX¦'ïû¦ïOçï[ z‡´?–Ö·xi.Þ²q€÷…AéèéPšOM”ûò–ö%Ñ×8@®Y–SäcF!Ñò3ÿ^PóW ² »yYåëE‚P†èÁi;µ‹¼pê¿Yê’uÄq·`~`–m†t†y `"#â&åúJù¨6~9Hµ·Z¶ê=(N¨§’'_`¶ŠéãöMì.:æRÇ>]*y‹·ÿs~¼Ne<ÂñÖ«uã€Rß\…h¦²7#¾Ý*b[Öb•*þ;QÝ_iT%x.ÑòÃj…k‰ô0E2ÇÓÅú½õ¥3ŽãE”H÷ª¥ÒίA³ z£³b›\ç†~cïóÒ]:EÅúá +“­Sà›‘p »{÷¹Î1ÀCŒØ´dG+»bc£Ì¹PY„¾UG!}a> ¹ýxL.ÀBÑcª*)Û…›cÁ—KÏ3û)–Î0ªè0œŒ&åÍ€§*oчŸë‘;F'–[+×5ßÔ…ûüµýmÕO<âyüW–¼ˆŒ GZ¥±ôæJYPeÏUïÃ0öØl.èë `õÞydÛ©º5 rÙåÖÄ çdú…µ˜_c¬UÉŠÓnáûê¬Þªaç»Bb \Ycµ}G»&W‡‰Ñ‡Ñ¼v\A?¥=$Wn^$ù…·oF w‚»!ª{'î÷¼R•“·A!~/‰—­,ê ÷2Ø1]h]‹4¸ýªÝÝ+ȹåôYËûZæ»â’6ÝXFcí´ï¡ 0\ßȾH×oš}yÁ”a%D~þ¸‡( 0üÝÉGË0|Ö¯(ùŠî=ãíREsñiÜ{b؃ÏâoÅÑvÔŠ2!ô+ú8!ßµ aáé'“·NÅ‘QÙr‘@ˆ¢éìFY L1|!–S”*W~ÎÉ:ü€)j{ÚÐQFܤÂŒíôŒkm¡¢V[æí>~‚8q$y–/)SýjÃLœçžA`¬T¨N•©Nƒþ$îJå!?£þÐÖ0 + °d®&Ñ,ñ@ŽVCÐʆ\¸³ÍbR¯“çøbØTL)ll%¿P¥G™SÈ;ËAò;£“SAψ»l_2¤Kš&–Y¥d¶\A‡>¹&´D08Eß}5±|ÇoÎ×ØSmÕ:ˉ:¹<³~}‰ï/›x Ï!ÛÈ µ¹`.Õœ­}½@3ex0¼r #YRΡԼ»tŽqш&ož<„û(<Ã9Bdó.”~ŠFŸäíÁMfuó`˜Jîu“§kεƩ(W`öt=€?lkzfK,}{38¦³ò2%’6€.IìOº.óc*¨•ÐÛ=»nçë:÷J˜‰‚ä;ÕœÚú› + TˆçÚqŸP´ïå’ÐF™{‡°˜®¤5¥0AH^ xÉm¿¦Þ¸ŸÎg¢Ú…ì}'ÿŹf%Ô½8úaon5E2= +Ux[uz¦Óš$WŠÇ„ºœŸ´Órüƒxé—iM‰¥šcÓ{fyZ‹æÄ€ÏV[z`ˆø•YxÈ­Þ,’­û²ž«b(µ—:€–lJ§™†_j(ìQ‡«ñ¤õ#;‘e ®žQ¥ŸÆÖ’¥ýÍ©Hû°¿Ì ³‘Á¤ÖW?Lr)±Æܺ̃IG%ÆrƱt†3íöVÝRiDü'bõ•w«YÈ*…’I/Ð%ý"¬†¨Öz¶ b!N4RæÐ:ÂRC8nöpIy¿öÆ/™Ïå:õ åMÔ·þà‚¤¦uÌk†ùb'çâW“Ÿl¤eøV$?ŒvýZ–Ɇ+û™ˆ˜:.<èr¢°·â|lLýiŠÅ×—TÐ{ŽNFl¿S×'K8´ÄM¬óšÛ`3ßkrnÌâU³µ3„étEöKYÿ⨼ªóR6Maîd©øSG&¬,_Q²TÖw¿`ªºôuÕŠ÷«ƒWu['×ã³SG•´Þ*Œ×mIðÂÌÖ¬ÔÃ-µB9Ì&shú=æ[Êuç tˆ¯M”ÞW(èì>Yá›Õ&um {ôoø;Šc(Ÿ;*ƬµPöÖ“kNB)ÐY8ŒRàåæ¯c¹å­o²ø˜í¶É%°¦XcƒåOòýGÚضC‘è]E¿¿Îëð +1’êag݆ +j Yウ˜lR\gÀXO?C€ A§~¾ŸglÍF ?WŸ5Êê»i*òÀþÀßr—­Øs MQxra0 +ÀkžÂ—˜ß1ÛíPÚœtàïþ6ߊßmhWmxOöN¡j¬d#Jˆˆ…Ê¿£ßjëÛ·S5†W=6-´•ÒÄkeI…„%µãæ"„–ªm# +¬l»yñ7ŸŒïF¢5Èf½:;*ìƒm> k®>5®x¼µžz2àI·rV +dòí•@z°|0ƒ*Ñð[‹`ÇÑs´3Sî„t–˜¥r6à…»Ù7÷ê×öE‹SbC.ªV‹–MÍñ²{¬to/±u>=Å°fë¹¾‡N!6P'øáÝ[ÍVZ§N.(èB,ã;ˆ½˜¦ï +û°9p]ö‘eoG®²>Îùs}ktt·Gi6Ü +4Å¥|ɼxb½Gæï›Êx ®À¦4‹T!ø±æ*¬ímÎü¸ERã1ráé ÄtÒÙ3ȤMC®æ¯E^07B±{Swü¨"ŸO?'J‹‡YGПp +kµk®˜ÖWÎ*ËÐ.ÁÀÏn¢8»½Õ»%| ¾ža7åa}6±Œ¾ËܹجÀl¾±ƒBXbŸ««–jÄ*„h6‚Špg‘QË×ÓKP^‘2¢ÈºÔkl¿±ZÚf뚎Íé&bq”å… U\â„5&_-6÷Àül¯«LÑUó +Âð›:¬–‡B6u¸ìœ“KˆÓs¯ˆ´ÿnÕ¹·ÔÜ“ÃÿêSÁÑVL§hã§/ó‰[:fò, èC9¾ÐMK¡™ò¬Eè‚ç™úÙ™Ëãu”C%dá±Gó‰'a»¦<•äZå#V— ¹IÄ»ó)»ÌÀÉüäóîõDPSÎ"3@÷†óEÄ@AÆÒái€dã]OseE§~/Êy¿"Ëë¥ë~‰;Uìþà”’Ÿ¨ÑáF‡ƒü–‡½”ÚMãI—³#^³†SrTHŒÔU¹Ä$€x` +=%ïËtÜTH@ q­j˜l{ÙÖ6ѧY/.fäœxΤZ~¶æ0jÝaØEƒ[ÜG,ØàÌK¾´Û–u ˆDü³ƒäÂúÖtÕkÉù&¶hN¥÷ Ä5WÝ©¾XlG:A†¨R¦mf‚ÅÑÎÉ2zt%œ Ñ°/ÔŒŠÚBoçôƒÂNK™ìÒ¼XN˜Ê“O¸ðÀ”¯ï ¬û€FFá¬Èýu­ð Ö@ÝMTo}A +ÓR2GãJI=UýC “ìŸ+a“® …òkvªÛv帲쮳Õ>õ/ øÏNóƒô +iü…ýOŠØaŽxñ ÃÙ·v›/wµmuRÝ^»RY5âuŠw·[±`üAÈÑZ> ±ÂȆ†Ê¿¼˜y9†ñÝd?‡bÙÂ×W¨ñXŽjÒÁï-‚šåèü´J?ñ&žh£J7ÐUVúAÍéi"ħ<‡`-Õj•X"”§U²t©º…ûaVZ*çžµ÷Y.\î¿:ªÉ¤i×õÇLÝ{¿pÿ\Ñu]\a•ä©†Ê1‘y |3ôAH…Ü3Æ¡›êû*©$Œˆí^b£2m ç÷;l•ãBR^ó¤íÏš;¼Öœ%èl“‘qIt¨+Ô-ýÛ.ÀáXʇ%¤MøËþt¸ —%–å¤Ì´})òåP˜^,IÍW¨ 9nwÝéYp•Í8Ã!'u®7w‹X];Zøf>eP· +Dí÷ÞãÈÅ׳>y¢¯ øíy*,´’êBÖ”&§…£MóÃ÷wM¶Jò «1òuš¼úT¦°¯¤4ã1Ü#l0øÝ ´Xi5¯qPŠPŽ2ÓN„–Æ%‹æýà–;@˜ŠðÍv^krÅ„Ö{âHèVÉuÆD‡œÑS¿\3¶¸øWžúœ ¿.ô”Y%¶hœ™ö ;èRÔ‰¶cÏ«ðk‘@yž"¤…daÙ(MºAr‚2Ñ\ª½Ÿæg½HjvýY]¤ý«m Ïð‡±C'£#„XÿÃóÛóz>ÀûÇñi¡£¤X;dC·V9èc‰ù,]ÝœâÍÜzË“©ÃÁí6§Çxa™ý½&áœ0™Ó#ËXš¾¸"j’ÝN™º=1SåMf"ÙŠ—•®™å[¿ëÀ‘Žy¦Â¸_²Ve½Þ(æßáBåÄWøççŠGþQ}¿Ef8ƒpWõ1MȧXœ*‚ó ¨.àÉ·ç»výÔ_ Ì%!"Ø2…¦0c3ô€U½ +,y˯ìgqÔ6dš±ÁßÏÆô"9Þ®™ó¼…CÙ÷(GlÒ¡Ž;7x$œÅÂQ´ŠÄVõxLû÷ß@ŠždäÈú»jX¼ýù†$þÓë[Õ=6¶ëñ'Ê|¼7KV1UÏ—ËÏ{{ædRÆ#šáxŒdBwÖ˜–¬ö;^ÈÛÈÎ=ÙäJcÞu’ê5~CìJvÿÊÿ㌠Äת>©I{»)°\î6"ûäŒ~Ö¨SS‹jÕÞ‡–Õ\ЃcmA”ŸX±úÐŒWä€ D*™müðm +Üý>çbmm!ot…çßOE¾}LÚê[á‡~ø)@üSWÊZZË(HB‚{~¬éõ‡ÖSK}®iGAÏ­(¥ Q/%ü˜ËûæË‘5 £Üyå`f¦™¾ +Û•Êó +Š>B…fµ<ÙªwdÔ?‘ó!tÁ@ƒ:Ý{¿ ¨j’c¢ß˜‡• ÇæÚ¢B¿ý8KîNHOû÷¸6-LÂÀ¨åbËp?èæÂòHåNc—aæû8tuPD廄îü\»xÒèðU¥r‚ceK‹„C1±&ÂCvN¯zB\~R¹ä›Áå:ej6· èê<j’¥‰+…#ÃŽ±’„´ûÔMìè;6èÉÖñ”W-Ź?¡…õç. n@H‡7— ¸àYaê¥*M%©ÁmñJÜ强šEY½†s¯êÔ#Nj䂤½ÿDâ@'Ɖ‘þ.|Žˆ#¬Þ— }%Jܘ®ž>¢•Îçš³Pë)™¶¡$0y ^Šò¾K5Ô¾^¼‹[‚yÙhÛÍÝžÚ½x¨ŽiáA<°Wxv!ÿ¯vO‡PC*âqsšÚ5S%ßxŠ]†ÍK+§|»[!1:î‡vÞ¸8ït!–µ7®Ô'²\:¥eŸœ^›×ð-‡ÙììÖ\å_ìõoPîÎSmìLr*ˆúºbÅ’Ÿ@[Öàg°v’ój‡qHdL.yÈ‚7\e¯’7|É0mé™ê½¨±9x{¢·sÃ僢îó$çõÊ^ª™ñØ–Õ{êºÓ•ïº2>ñÙb9‘ÙØc™º´ûÝÔŽ÷Ûo=à7µkð +øÍÉþ^ìxšçy³vÝð}ËÈÀy–ÿíxÿé•×Á×PqÊzÉç‘ôÞ'—G¡FŽn-µÇ5îàá3mÛÎœǬ´ƒìv’X +ˆ“Ü^ÕU_É)|'Qªï®QUÃp vƒ!ÈÄYü÷ŸÚí—÷¤¦Æ—íÍéRŒöçøãlÆÀÚµ ŒµËÊÉ‚qÒ ø„ gÂÕE’`REí{15=óéžrh>ÆnAЮé(KŒÌ™‡þRWØF@.\:þñÙÔRˆOJûÙêccÖ{¢Ý±ßŠß²¬Ý]t³¢‹ØˆÍ¥z\ÈÆN}`aëÐÜó]Ð4I² é÷ y£ÞÚO‘-^p²Ô–š‘¥fDõÐq)ŽBuñÀÿÒ¦K¹Ãîê›-nÒ/Ò׃Èm6Ü7J¯¶š^—dÖ'¾¬N§g&ÍCo–MZ-**¿hM³Ý5£Èkþà`ÙÕZ›öíÛËÂ4»÷€ àtÍ‹G'“÷b¢c•’¦·FÏ)gw6<9“ñåЊ †ËæZ•u^gÄäu‘|'p=‚¼øƒÒl[½ZmªdáQ›>² ¹ÄÐ8Ý]]ô«0¢·kÚSø¨Æä?¾ù‚üŽòZ³ƒ a XÓ²Z¡“WÛ¥5O¸RžMØŸÂqÒ0Iû»y—¦Ãf›‚ÛÑ$ÍÀ#— +3„`©¡£@…V¢Q9,Áz?CzU%WT”ÔåPuw¶GžHQö›;ùS„Ÿ¦2‚rhær£2ࣩb`Ï3°Ký=3€ó/ÖWÒ]ÎÀÓ Zqjî±ý†OÓëg3%œs‹/°AÃMs¦×”er~í¡“Ð7 :ÅZ4kc`Ãõp· /±–¬NQçm•úöáN—2½®Wyh5uÓ˜àì~»Â›ÐÖÍQ%Ììåg2nÓÑÛ;po”ÛË`¹4?‹¿¢íÑN• è=[DZÎnÃtï P­ÿ2ÿÿ&ÀË#äv Þ#Ä_à_1;ªendstream +endobj +3032 0 obj << /Type /Font /Subtype /Type1 -/Encoding 7213 0 R +/Encoding 7548 0 R /FirstChar 11 /LastChar 126 -/Widths 7230 0 R -/BaseFont /UWJHFE+CMR10 -/FontDescriptor 2970 0 R +/Widths 7565 0 R +/BaseFont /SBBEPH+CMR10 +/FontDescriptor 3030 0 R >> endobj -2970 0 obj << +3030 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /UWJHFE+CMR10 +/FontName /SBBEPH+CMR10 /ItalicAngle 0 /StemV 69 /XHeight 431 /FontBBox [-251 -250 1009 969] /Flags 4 -/CharSet (/ff/fi/fl/ffi/cedilla/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/circumflex/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/tilde) -/FontFile 2971 0 R +/CharSet (/ff/fi/fl/ffi/ffl/cedilla/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/tilde) +/FontFile 3031 0 R >> endobj -7230 0 obj -[583 556 556 833 0 0 0 0 0 0 0 0 0 444 0 0 0 0 0 0 0 0 278 500 833 500 833 778 278 389 389 500 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 778 750 708 722 764 681 653 785 750 361 514 778 625 917 750 778 681 778 736 556 722 750 750 1028 750 750 611 278 0 278 500 0 278 500 556 444 556 444 306 500 556 278 306 528 278 833 556 500 556 528 392 394 389 556 528 722 528 528 444 500 1000 0 500 ] +7565 0 obj +[583 556 556 833 833 0 0 0 0 0 0 0 0 444 0 0 0 0 0 0 0 0 278 500 833 500 833 778 278 389 389 500 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 778 750 708 722 764 681 653 785 750 361 514 778 625 917 750 778 681 778 736 556 722 750 750 1028 750 750 611 278 500 278 500 0 278 500 556 444 556 444 306 500 556 278 306 528 278 833 556 500 556 528 392 394 389 556 528 722 528 528 444 500 1000 0 500 ] endobj -2963 0 obj << -/Length1 900 -/Length2 2720 +3023 0 obj << +/Length1 912 +/Length2 2778 /Length3 532 -/Length 3359 -/Filter /FlateDecode ->> -stream -xÚíSy<”ë߶fË’=¢ÇšuÌØ—$c Ù%[bÌŒ1Œ™1cìTöd)™Ä}9-HÙÉrÊ’,)*¿©óžß9o¿?ß÷¯÷ó>Ï?Ïu}¯ûº¯çû½o [eCÎ iŠÃ•! ˆ.`deQ 0»ŒŒ #¢qXc© @tt €a -PM]5m]°» `„ÇÐ(" g$ÿC¤ú# h8 XÁˆ>Hš†pp4’ - 1ÀþÇŠ@Àˆ$# v@ áDÀ ‰BcÙU~2Çzã­?iDþ¯R0’H ÈÑBÊ´ˆ - Þì*Ö8Ú^HZ’ÿP¿š›a0Ö0ÿö?šôe˜?ú_œ?>ˆˆ$V8’€ýUê„ü3›òÿµjN„aÐpC, -ƒÀRè@S4 ‰°Eá>€7 ˆüÉ#±ˆ_CÐúö3‚Š¥™Ó9Å?çù³f Cc‰Bñÿvý!þ‰!cZwhàÁšöþõåþË^&X8ÆÒ„†&#`¡ì´“AC@8@cH€$Ñ«€°8"m @ëI$à#°ÿ§º6 †$à~°? 0 B ù†Ð°‰ü›ÑT°hìß„¦ bøo«*¨@u@Åço¡‰ÿ5iöÿ€4ï Ÿð?; -…âHáÊjꀲ*-”Ž¶6 ¥Žüï:G,: inLû 0XKGý' "XâÏ#LÖ_ØM-IBÂÙ'Çpp½8ß›Í ”(ò« -fz(ê·të†GÃ9®NdÐcî÷žP˜­wÞ¯ÌçãZb^:òU40¥=Âî…釘€ô¼ÑïKÁžKùaTQç­|«ÐE¼äÞÕ5î¶æ‘u z›¡Ù>J¶Ë½ž¢Í'kwmåŒ/,³LKÐuº7vÄij9›æcãëeÕ$ìyò(Iê‰3!<Ù™L3/¯Fù&²¶(N}ĵñî“Y‹³¾_Úy7tÖM°pTÓ;0:î3æñ¥¦™)ªŸL#_/ ¶~ݯ*T1x¥Ö,›ž‡Ñ/Ì‚iš´HeŽö¾‰h,ŠÅNÄ÷[†¨‚ê—ÊŠ§[»t%¯Û -ö@J[g°MÖë­Î1ô•“jM+äâA?9»qs›@6ÿ]½iï¶Ï¹M‰äA"=`G'Yoä™óâ¤fÞ€÷êCfn1_J=VX]xK ¥û­í‹¯JÞï3×ûÙ*XÒÞz»«æ:¬úšb;ĘS¦m©vHX%‹¸%cá&Ý|ª¢VP:7cj#¨Vò‡l‘.‡·`ƒ9³ù‰H¬xfN©¿D¢›aÞ0Á»ÎxÛÇOE­Û´¶Çêµr·. ö¸ïÞæŽ'yì¤ûdö‡n}®vÝ+ ö¼¼üÞ=ωšYûâeàè˜Çžë~›wàYáÖ9„ xvg00T6Ø"‹á©qK^(-ñÆËFÉLÝñꤞ¨—Î,ð³«çˆMkø”[>— -(KfáÑQÇÛ~»¿¾—n€â;qÎ"Ý![˜´t­ÚšX¦™°ZKŸ•üÙJ ­;O< ü>T¬–³c·ý)°3üX­Ò¼ÚVK2âòekÓŠÃJ8Ä©‰¹-žQëíèl“ÕrïÇ×þpÙ}?L벨Q¹H*¶‹m¼'ÅË G­¦r R38¾¦D3Ú»—?•=[Uu÷⧗7@Í0D Ù¾åÆhêÎûà$?ƒæÐÃÙ¦‚æ×=Öð{©A* ĺ‚~¨HîïÌë_6^ìÔØò.­— Ý?æ 0Ðâ;Ö™$ÓêÙûø ŒŒ0‚Ü…Ìt‹Í¯SkPcT9— -ÉõƒûîÃ?v@í|Îàd_7=ýß>töíDI$¶-“Áî’6j¶¹HíÒÅ®M¿dÿ-cAa+KÑ Nü2írQµ¼"ø]R&µ&“ê4ŽHù¸\z0a_ÿh˜ëìǵ®áJa!lÑBüec•'Xñm‰:ÑÐrðb™¼¢kU}2·P¤W Bu;h]¡¥uvòiê@¬Z GÙabÊ%¸U~;INáÒRA<º‹ùUº™ê¹á­¶Eqõs†±: IƒUä›9‹ý¬'|~²‘å8á‡y¼Zø<‹â)™æ­ãĸ¨’òqæ:éçóÁå7–çMÙwÙ…˜ö™Â2–ãîL»ž{0(ë¤Êøm;ã5ê\¯®‹‹²\†`ŒOž$eG+QiF¹z(¿4?źµ:¶´7“Í,†ã UsRž»¡Ãï8Ëù[Õ¥GCOuÏ’Ï›¹WüÞæÍÍ9»ì0_Rè5:—Fi=a•|#ª—žÕ(ñxë_Ò ±Ðg£g–úθ~iF7nOêªPªj÷Sf*NÜ2-€øpâË=õ#›!›'ä0 -oèämb(·ï¨|z= +¼éþ»³fvôÚüÆ4={ IRTmÙx9.$~åª|Ê”õâ`ðÇû«{zš/à|ŠÆ'4ß9õìíÕw‰žLèNF·FÆ1Dy¨QÎ 8¹I ’ƒ|æwÉÂq⌅(ʵCÝ`°/Šaâs¹øþÈni»ƒž\èyi{ÑtÄÍ[OΛ㣵àÎv ÷/µ”}:VŒ`uÿlU>½C)c -ÆÇff‰l=‰4´‚ûÍŸ´t#ß<•3š¿/ÎȘßOÀ ÷j~Ä<Pî©#Â>u3::¦ù–t(Ž{‰fc§˜³sN3i|å¾$Nñb»‘ë¥gy‹{i¤?]`¡ Tnõˆ!oúÕ½”ÇwoÄkë¨#~vÄIMÐÍûxX@½¹<¦›øLÐ.WÍœ×o¿Á‚9£2•ç$W é ´zB9–ÔŸÚÿ¢ÿRv–DWO5l)ªòö<© ô¥0KÊsëd)bÙ:ÚÜ}Ûg) -È%%O©# åœyß:Þ^Ì] 6}R¡?PüüÉÏN:ãwbàã‘šEŒ¨Ô§}Բτq‘¹tûˆYYÚ˜©†NïÔæŨ+éI¬×Ä[z Ïæ­âø]Ã#ô5FŽ-*¾k“¡= ò+ la -Ïò(´£Û òëzi›°XIþaó@ƒSÝ2YH`§±ÆJúy€]s¦|»ÃNŒ²™‘µ™™í å©ÓÎPÌ|~Š¥[æ’žœü±”AúaWãÜ‹6‚¹Ö§#kÝ0&&¸I‹hQs!Çì/Í9¦Yë±íå¾9R’Ád]'¦Ý×e`"©ØPÔÛ”n× ÙÉ0MXÞå S­q¾Žr£ç<æ²ôõÃãÓßIø™,%ö²Ø¹±tÁ©Mï|ÉàÓpÁמ°Å©+£ª×6Å4ÒèdæU[º àÎõêó.Ðmä=ñ¢X®q–!)·ßñ+‘ a·°¶aòÙ²öé6< Çw2šI ù·^ÕíµÍݤ¹7£±¾Á:mÛ_VX‡³Ì}·÷úGaÔ…ÓôUæ·/Xëž‹={z?í`zÉ‘AèÀNâµ~åô±ÝúFÏ®îû3œ§b ‰•rŽMGH ÓS"…¤.^ݺMõ”–Vò½'›¨·œÏu8‹s'Ë(N‰ÉßÉÌ_/¶Ápy܈•­ÁÖö“LúÂ}•—K{bªãqõJ¥ŠjºÅgïN×^ޡ✔v=Cš+N7ëž*¥û~ßu˜üÇ©S=®´ð¼&5ý³™§¹ÚO-À•LªŽ;ã(2…W]Û…®hä%=úöÉØh> œH; vØŽ_¸æ‘µ=Á>¶áÍFc·ëLÎ5çõ;Ý«œ æ§ô0oŸ”m΃†j(ø¤ïq]Flv{ET]·áÏœî\:QÒI§•¯ã¬ …å.€ƒC³ôk~ -Åêñë…è©YgkQÖëÍòL¦Î²0šÓ7¿Ü¼{Gt6÷w“[瘝Ý{~ïˆsHÊ›#&_Æ®»Å‚ÿ‡ûÿüŸ0€c0ç#ø±ÿ ߘÍàendstream -endobj -2964 0 obj << +/Length 3415 +/Filter /FlateDecode +>> +stream +xÚí–W\SéºÆ¥IQ)"*}q¤“¡‰R#¢”ÒQd")„Š€€‚´AzÁ2Ô E†"Ò«¥‰ô& ]=³ÝîË}®ÎïdÝäÿ–ç{Öû~KB a)¯‹"¸€ x² ‘D7HÑMJt‹(KP šCÑ”@? ¤;ùß0õ³øEo,Ö‰û&ÿmHÿ‘Fâ0XÊ? 8Oo2HL(ˆÿ¹ÔüÓ› ˆÂxã~Α‘XŒ«.Þ ?CÒEŒˆB`È®î‰%ßã õ³ úܾ[P´2„èšÉþ¹Ïï9ƒ'_¥xþ­ú­ø;CÿÅôé1~€DÒ éÏ_ÿ®ýtïJ@aðô SD"’ÂA¿t‚7¡ýÐnXQO Ó[úL4Èñm*ꀢ?H$|‹~À €"Ù÷†ÒÙ‚GÔ•EË¿Iƒ.àò7A!ôvÔHï@ @÷/¤ÏDÑóT‰? *ýäïøŸÓÕÓ#øÝ”WVä•è5ÔÕ5$ðßë¬ð/oÐÈ€þJˆš†Ê÷¨«7‘âÉ߯3}q1C_3ú®´7×sa7~¥†ÁózŠYdôÜ~3-¯ïq$tè>öaÛ/™Ñ2ÛÝÇ©¼œÓ,Ó¢¾{‚¤¨çæ?{Å¥ ~öqžNõ¯´]K5¡LyþÏVèW-u`}Æ`Ö7Ú^”h—ßœ±Ò²ƒ2¸:Ã:,v¨ÁÁ§¢!-LUÍöb*Ö*âv™¤²˜wŠWQ¤JĈ/wb<óHwhж*Ù÷«„çÞÇwóز¾:®Ïõé8œLT½†ï|ëþ‡uGFÇ\’UÉ»—V]³·û4]Q»G™*—‚8Ÿž€T…W‰Ç¶}¨ÈR¸Ýžm쫤P6]˜Aæ7µkrßÕ¦m)È­Yà+MklƒÓ”+fó²{=¤Ìß™‘Øqç†ÑµÛÉ•cÉúÐ@'äQ[lŠÑq‚øÈ8d«Ìwä‹c4Oú³ô|QM{rè¥ø…Šv™bÖ˜.†9ÊöýJïŠ}LI…êÆÊÄù<‡;>xW'xS½ûÓ Y7X¦à’€jéö@»ƒÈÞ¤¢K‡ !"ñI8±Ý”Xÿ“9¶žˆÆW‚¦úVµjkVoÊÔº’×®ºmqådrÝösZsOLï ¬m?³ÜJ«nî¾¾t-Ŧ:90-¹³›4øÆiË~·MÒ9]3²#­Y½$Š¤ÏåÆ¿ŠNéS1±o¸Y—sGJùŸE6uºâ5y‚C%IxæþÈøµ¸WáFnMOÄþÃÅ­8m·>^ᣆ—ã,Ãñé‘Ó×1J5…ªáó% w¶MøRØ›RDü!K‰ +e<%Ç^n<¬Oø4*§A©óµ%~úœ7ØkÕ!ÈÜ#"ÕÉUÎA‹Ï1‰ðùGèÆ{ŒcvKý~MVåjN?X}ñgÙl3>ôÐI‘Gé½&ï“´£ïÙ‹ºÅ„6®oïIê<}šc½Ù«@ErÍF\–lŸéä3ÀT¯/ùDzhS)£•iÔfû-¶›ùÑÞËŠåäÒ´=ä |_Y‹w–;×˼Üy·!¦-Oo—ÇRÒ««6ÉhÍk|5å6G3„ô‹.‘¦Ý- +ŠíÂ!ÍoWì… +pÍ÷¼¬¶ž\«¹8ú&Ó-Óïvè];Ë'/Ç>'꧅?{Z¥)”jn+rü9­ë<êð6|¨Ò¨ñ× åïpnÓ•r¾ Œì82©5a1ú\Þýý³sY¹¡ZÑN–©ý4î=ÿ|ú@/¢|ï®tt›V¬qÛ¨yÏØŒ¯µõ ê>µÁ…Í"u¢4(‚óXÌB›"wòÑ +çdL ¢R¤„.\±Ó:o¶òì¾Þh.v©p5ƒ| ålžz°ÁºÐ6È-=Ff:2t²¾£1j,€³õ‚†­6k¿·À°@O¶Ià'ÿlxÉ׆ÖÇ®¼°_ôÍ­5,-íy/—5•R¶á›õ2±ÛóZa(¯©f!xω3_qÌGÚáB–»îy;p“ûå^uYèãû®ß2fšÈ3‰»ñlP]üøÒ†OÙn3Vš³°ØÈÐ9Y7þßSž&!v¾^Ñ(cÔ.¬iª¶RPì.¾"u.ª×ÔQ‹¢y*¥ž·UæÝñážEëÃäh¡HãÒ<úœµ rßv2÷2Ë œÌ–ôdT}ŠØ]LY1›¯Žå϶l2²Eg +Žû¿2Œ7¬Š[ÎÀïh ,ðÎÕç +·€—-ù©à¸Œ M̶îƤÙÀ1f›1ûH?õÑí©>†io³oÃzL?£E9 PS·>\[ŒÑ*Oß^aØ ytªä®èeyª#æø>é.?i>À &i¨=ú±qÖù­±oä!×ÅpÛ×X,DéžÛonùgƒ%¸³Z« +4Oÿ¹àW±Ÿ.¹‘sTòï»3&½AÞ½o²’Ã;;£”3_hŠ@ y\ÕÉÕ1J#{™š?dß{~­ûÉo|Ë^Cèжd%¬Ú@x‘$j,É)ÑP¢M‡:Fl>—HŒ‡½ž{!Í#M ›uÏ3­Ù)|Õß~ʪԹ,JÀ“|âcñ3“G+ƒ=H »óû—>|A™2FQ1L™Œòi•Ç +)£øfx§OÚi‚ú¤oâ¶ã™Çwÿ°7§Éhf'–ŠrX©áx>›jÙëÖ-Š„˜?ypõ¢ãbL×[&IêGV¥nyö7óW—é,È5HßX&8+‰|eŸ9ùÔ@3¯†QÈëØòTàÖáPžàyü]GÌj 5ËÌô¨zQˆ|ÔìØW‰-ÃŦ™E›Þzr¦ºøìG%î}§äã |ºÖ0_ªïí÷b–o_I?¿"ù?_ž <üT'y¯‹¶Á£Öo¯.ÜÆq3¦SîkgS…•DáºÄä3lü£UžMûÌâ3¦&Ÿe³Z;˜E_7«p§9Þ];üÒ¦ŸÂ:¬­J0bÓª±Þ¦~I^„GßÉ=l%m4ÌÕé{‰à9ÚšwêuÈx_ Ãs¹îx™_…X•>I#~yºÞˆ‹N-Ænù‹Eî;›=¹0YôXUD—^­#)/ÎrfrB‚A°[Ë“»žc“Ëoí"8»D›lïPFyðgL…_P,?¾)¿iÀy³mi§ß½>.&55¼+*Y¨  _’Do>Yv©Ó÷8v»Óã¨Prj.[rºøÞ%J¦Pa j@ÿédöÇëUÑõs£+™ÑÁ~ ¡ÝJ·äÏã•›ÌG«· [z þ5Ö ll,6½÷‹ ù«Äõ/Ü¡}é[ùE‘§4 o7GéŒ=1ž^–lkTlS}‘ëY<\(•-—¹åy¸:QŒ<Ⱥš¥:èešÔ½õ±:.Ó窸ŽîÈ?¢¹2Š§TrG÷r…¦øN=P[5`½»´p:¼\âJ«1RÆeòFB𻇒Îœ^gõ/Æaz‹5|v›*8Oµ ¡>÷º]ŽÞ,uZ¶»‘ o|x+[¸`6ò$·GÝÊïîc{é_ÃœTîµpRÝŽ0 h¾¶w8F›H‹k#5¸Ž}áÒ²Ê +è[1KñZ¡U­³¾fe +¸U¹¦EmíYoÍ Ø©Hd')»+¾>çŸu¸+;Êþdkl²U£ìt™øët™–Ýêía‡.šÒ›)¾SÊfSypJ¨÷‡tèd›2Ÿk¨­nb{VX¦=òyh½Q‘ÿÅ©E–¸ŠÁ¨ÊÆ8Æâ&©¤UH‰~æM–›e†±*{îg+©13vZŒ=E a—¨„ù“¢91wëü‘0å³%5Š½Ž$IˆZYIÙ\UĄ＜æ¼°ÚÚÒÍ”(Ã’Ñ›§¥õ›ñù®?˜&ï·ë,¥ßœ#MÅÈ“¿ ‰³1:¢ÏÉçÅ;‰ÊøÂAÙ´:ç'í]û¯¾8{¯²~íÛ-ã|"Ÿ1úVjÿèn7o'D +Có/,Ë¿”ÂIPC‘I|A0j¡\¢ú„ÏãyÑ{Ÿ®‡Ouè /\G8’©, ]Káï®úuÖaÝgV_¸ßq +‡E~ÂËÚê¸Í ™ ¼Æ·¡dÛ +{Üc¸I» rKîÊ Öí¾ôßäa—š§FÞC‡ úv_LDÀràÃYŽãÅY¼`‰ú;†{Ìåµ?3) ªáúèEOlj S9½ñ`9¸Êò_þ8þ_àÿ„€+DÉ’èÁñ¥ö=endstream +endobj +3024 0 obj << /Type /Font /Subtype /Type1 -/Encoding 7213 0 R +/Encoding 7548 0 R /FirstChar 48 -/LastChar 117 -/Widths 7231 0 R -/BaseFont /QQLHWG+CMR12 -/FontDescriptor 2962 0 R +/LastChar 116 +/Widths 7566 0 R +/BaseFont /UGEDAO+CMR12 +/FontDescriptor 3022 0 R >> endobj -2962 0 obj << +3022 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 -/FontName /QQLHWG+CMR12 +/FontName /UGEDAO+CMR12 /ItalicAngle 0 /StemV 65 /XHeight 431 /FontBBox [-34 -251 988 750] /Flags 4 -/CharSet (/zero/two/three/nine/A/g/h/s/t/u) -/FontFile 2963 0 R +/CharSet (/zero/two/three/S/b/d/e/m/p/r/t) +/FontFile 3023 0 R >> endobj -7231 0 obj -[490 0 490 490 0 0 0 0 0 490 0 0 0 0 0 0 0 734 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 490 544 0 0 0 0 0 0 0 0 0 0 386 381 544 ] +7566 0 obj +[490 0 490 490 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 544 0 0 0 0 0 0 0 0 0 0 0 0 0 0 544 0 544 435 0 0 0 0 0 0 0 816 0 0 544 0 381 0 381 ] endobj -2960 0 obj << -/Length1 2140 -/Length2 13309 +3020 0 obj << +/Length1 2186 +/Length2 13576 /Length3 532 -/Length 14465 -/Filter /FlateDecode ->> -stream -xÚí·UXœÍ¶p‹»Kðи»C‚»;Aƒ5Ú¸k ¸»»{ wMpîÜÝõïoí½Yû¿<çê<n³fWšUï|*2e5&S;c ¤­33?@LAMMô+€™‰ŠJÌhälig+nä ä°ññ±D\Ììàqn~N~Vn$*€˜½‡£¥¹…3€VŒîŸ$€ˆ ÐÑÒÄÈ `äl´Ïab¨Ù™X=˜" @õŸO8TN@GW )3ÀÔÒÄ` 4·´EbùÇIÆÖÌÀó_aSûÿr::¥´`I:XÑÔÎä0š!±(ÚׂMþßúß“Kº€@ŠF6ÿLÿßuú¿2Œl,Aÿcgcïâ t(Ø™mÿwªð¿ôDí@ÿ×B2ÎF K[sÀú_!K'IKw ©²¥³‰ÀÌäüWhkú¿À…û—‹Œ´‚‚¶ÿÏô_ÃÊF–¶ÎêöÿžøŸü1Ûƒ+ähéÐeefee'‚ÿç/ýÿµœ„­‰©¥-øRpqŒ<À·L\/6€¥­)Ðt;³0ÛÚ9ƒ?Å`fçˆôÏ‘‚OÅì_±ÿBv0Z¾!AoÈùOòÛ0x<7ÈÈæ-Nqp±sšƒþëüÿ= `1µŒßB|ÿüŸ™œ¬{#G -höW”í¿£ÿ+lläôÏNÖoA°˜=ÈÅé-Ö2±³±1z‹pX,<ì-€¶o!°¡=x";Ó·€Å dädñá°xíÞàMØÙÿÍ\`{g··q.°·³…#𯌊lçòV®ÊléúWX× |þÍ`Y' ë_®àÃfþG!¸Àª¶–‹ðþ³gÝ_âûgËÿŒrƒ.FoçÌÍñϹþi=oA°“ÑÛrÜ`%‘7눾XEìÀâovø7ñ€‹%ùF`©7—IúÀN2o–‘}#°‹Ü]äßì¢ðF`Å7»(ý›xÁ.ÊovQy#°‹ê]ÔÞì¢þF`7»h¾ØEëÀ.ŸÞì¢ýoâ»è¼ØÅØÑÈÄèüÇ¿ãÿùP€»-ËÛUç/düFà…LÞiVðJ¦á?—á/üçªþ…àÍÿBðÎ-þBðÖÿê¬à½[ý…`'ë¿,õWga[½u6p·d±ý ÁVv!ØÊþ/üçºþ…`+Ç¿ðŸgç/[9ÿ…`+—¿låú‚­ÜþjŽ`+÷¿låñ‚­<ÿš£­éÿôŽÿû%!*jçîžóLìàž®øz²úüg¢†­%øI”·VV^pIÿ‰š¸8‚û ó¿ÞËà%þ‡Í,Á¯+ Ðh‚´0kg"h•Ò\æ+Q0QKçDœV8ÒT—&À|¸*€5íØ8®|„ieY‘|,WÅbjƵNÐ âýËK%hó*]^ºü©É¡žÔ@ÎÏt›¬°ÝÒ-ûF†ÓEŠë5×Øjù}6ž|‚ãp˜²¹ÙçK_ë/£ë È©¦ÛÉHú9­òI@ͽµØá‡#)»»…¢<½ôkì—‚ž•IëeÔ4¾ˆè™´OˆlËeX^úŠÈh]”^›ûšuÙŠÕ¶e98a•Ä«ùYñ‹˜?g±{È׿f’‚º¿INP{Ïe¯ÒW‡ÜR•r…qÄýijýbS`wnÑ[NcJ1C_â3žÞ° R®Æ\þâš.â«Ë|åê]ˆKkb[œí÷#oŠÕ°ùŒ -!ù”’íJ žf¸uØDå§dŠ¹ö6sM6°¥$϶Á=«š©=¶8Yß:¢±Ùq÷`ðÁ]çŽBì·õˆ:KÚd$riLˆÞ>2ÆïÒ‡ Ü]Â$Ëb™-½CÅ@Y>âî·š-bþU|-hœwªñ¢^´L™dsÀÒŸ_1¨£ gaNjwhÏÑæüLæs¯…ˆ?%ÏœÃ%`šÚ‚ämU‘Ê˲,bÙû?ðž°ì§}®ù -ßr'„>vï¤ H¤­znq¡Þ wdµ´TO9m’Ê#«çÜgsñLÈú« 阽óñ œŠ¢¸Üw„˼±ÉÖ§ÚÄ/e!a8L l°59”Á›WJ¼û÷„ÂêÒ¤U†¼„ý,;Îc=7¡=⇦eNî)h> Ï!:-yYS¯õ“ßvEòÝêq¼ý¡‰¾{,8SŸº„,ûYsgöøUßóžîAÞâÀ³â»'¨Ã:#÷FH—”ŠóÄYk ÁeN$¢ª¯<]´V[¿ó?ß’Öèÿx¼jDÈÈÚ:CÑÍÝñ½û™Ï4ArsÀv»;ØQ¿ð#‹‰¸ÐÖÿ¶o§»B—ÐhnÂYú }ÒWœO™TòC®÷¹Ò xvT:ñ¤N¦r`@ÁhÍã8m\=±sóc dõ™•…=m8á7“q™óÙÓüöuRY$’•eÑ´RÛA/£§”E_“\¨ó6r,ä5Óòª5ú×MiD6ˆÔ\)ˆZ‰ÃÛ¸Ã'ß•m>ᶘ"?`¼ÌMTCÐKã»]ûöî®îÃU®5G˜l{ bÚP¯ŽaÂÈùàÞ$[BPÚ|¶r"¢²Pü‚27û«µÞ˧Y¯˜t~¬/cæœæL.-÷2µ½b•þú©<;êᡱCœ- W—Î-„D ·¢kHßS¹‰Ð‹d[{‚;â@0ºó,%”Æ‹7ƒ-îS!³¢ð|³©l"Ceôbg߬ÆjíÄ—©2JŠW±âùüîPAwÞß1tdŒ…AžÀ3k‹)¹RÒ E‡Ÿè¥H°¸+µÜVn™HÌ(m¡“¡›ŽôWòò¸‹§HûÉõZ>ãŽßÌc~SfO›×9ÙÁ[I‹ñãýý‡,ê{2j¾~5 ÈÕÄ8'ʤLÆ?u÷Xª4MR„±eÒYG;á3ËAeüô 7ÁËeãm£è5 ‰+1ó€ªèla®vë;´G2’GxÚ¹àU£\ ¼dqLë¯g¨¶JëÕ tÜ0Šj¤¤þ§‡–£5‘Õ¶Å#N\ÍïáV3|#Ê•ªâ6tnhïa–ß-_.¾Þ?¾£¼JM¿Øÿ¹·ýÉM}*#Ɔl2ºægV_dé¤ZDâ¦/ƒýš¸fÆÙá(2€ß'*yQBñ`ôy~Þà8Óg¯_Y×þô<˜6Ÿ«ý‰ 5JP˜×b{o„ù»²f²NUÙ¬ˆ/2”•F6ˆtåÄ3gOcÉ#iåÑ@Ø—¥é‚øÐPŽÁCË!û¾¶Q»€ž,Ý5K’"°ª·a.W–ÐiŠÀ\Fšn÷²ùý)EåóC&vzÍCÖ÷PþìG9-8ï˜1‚-.—Ì‘<—B&óáú‚·êÓyœ–“ŸCcÛyíÅ\fR8'ñæ€ ˜èʹ!Ûi­@ ž^ rBnDì°×N†ßOv þÞ`̵»·ý“VøÂÕ?,6­;ñÉ’ Ù>D|{ÃNC]½ýIsþ¼ùäí.FW´®’C>ß/Ô‡]Ëš¼Ù†~‹¥ó$šª\e/Ö½¹ßi@±‡Ï´³Ó¬1‚Ú2P¾)‘-blT¡ê]kœp|Q{ilOOI: -Cbë¤ÐÌmÏ’>»+¬¯tl•õѾߗ¸?XV.Ô•1Äí¦s(ñ±²ì€•Z’0LU§áj·À{“6¨g¿B[[esî\y¼çŠ8s_/y$ -…ÞS²n|?fùЛ³f$¦;SÈœáÏÇâ+ s?'²½±Â±ßáN‘ᵬáEòÞ×o«XÜhvtiØÑx¯sâ†ÇSQ­Và ò‰ÈJT¡¢Èª®Ö´™Í ä7ý]{!x ŸóPiš%*ÅzÁØ÷5ú†AŸ»œÍ»]ÝœŸUk—Xãó8›kGŠô¥ùLÛ2=c¦œñ•À3hðÊ -ÞÕú+Ç»¤¡SâÛRƤvq ñ(õJl±_O›ÖBé6tñ$áð¸è<Çnâ Hˆ:ÍØËÒ2û À¢à®¬ãŒôrû‡¢¯g¸–i&…š@×½ç-ÞãÙè¦=6åMØcãRM¬frã­¿â8FìÕ»ÈÉó˜äxbÛ4>P¢+Œ‰Û­-Î×ÑÉ¢H:ëK‹qñ8‡“x¥åz‰¸ü‡åHÁ¦ü® -ó(u¨ˆˆü˜FH& }Ü(§ ÿŽBÏùK·º+ÙöÚCyTÂM>ä‹f¢Ÿã¢»‹É‡E|+wãTóSök¤m<±£5ú,%$9–BvÆ~ªœš I~õ“FQeLµËzNS´ß|k^Þ醼DçåÌ…û•ã—ë÷—OGßÓàgdC;ü¸˜4µP,•yN!õà…ð²ô¦òâÜ©ï‘5¹ò˜p7#b8yµßÿ‰äqÛ“NÈ]LÖ›ß Ô!sz¾ hd‘GÜÚánÛ¶c|®tÜpFê¥&f/Žé]uÉ'ÊcþSºcs.@¤=†ŸÚmù‚,B"#¥Š¡•â#IKCoæ–,â7‘"ùɆ&(,â‘R±–Cí0¼Õ&)w ž Áä»(Þ«Tqp>ß¡"nô‘àBi‚—Ø®N¬/8Þˆ,ˆ=ÔÈÔ ÇH{ÈvE”—g ËXÊ‘Æüb ñ(¤E7ì¹FÈ"@G°l•­ÑÁþ…F_;Îaëü}Î ê^O!ÆñžºrÚ1W¾ÜFüäŸG‰mIòÐC)öý³¬ÞCëêr7ÇíçìWº®]rÛxiÌ\ªŸ=¼Êƃ|,úuøΖn´§jÕ*Ð?"¿µJ/f7}¢7·\ùPì¡!Ò=¦#¼'£€TFyõ/v«¢i›”kÅû†e„6íŽ ¢2¡I0ë‰Ö(e›Ço‡ÂwŒg35ä‡ð(£( ¼LÝaiUõäÐ"&UÅMÞ®úÎú‹N³ñæƒð‡kÑ>o§›ÛÄ89jo&èWZªÐƒƒÇ§~Fd:h ñp—½‘™óéu|´zÅ=Ý.V‹qEWÈã‘BÈ4þ¶É-‰æ#²+y]Ç©[f¹4ž§‰}ÁðÅ*¸ð86|úõ!lãÜ~Û D¦ÌÆu2íØ\ÆŸ¢Ó™KïhøRú\9kîšç1w£¹mʾ֌abÏR3U„ RÈ1ÓÞº,j'\);ÒxnCªWº¥ÉDÆe 0,I{B°š¥RcOÉÞüNªùÈZˆ]7Løai:~Bü)\üüõOß%¨,¦«xPÇ4eäÝNé -Ý“¬ ÷#\f{¦Ñ{JÝžÀ†ÒæTsZÿbWÖšæÍSl¶»Ä…£ 1WÙÂ¥ ùìàKxO §Ö’@wšCª¢+|$[ò½Û)ÇÄfríЗYÒÚ-î§2XwC²ŽLlëˆWæ[JÎ4{„ ÓÈ÷Rˆ©<ªÆÖØÞÈm¦lÙÁú3UŽÀ÷w¯1Öïæ ¹s òγžœa€Äl÷Ηó÷Åi»«œ¸±ÐŸ˜­‘QUj{€_–Ô ˜¼R|B„~ô˜ M>!u*qgBÊWrg.¹ë¤žÒÅ+*³X±>¿sx¯x—‹òåHv+H2ÎËÓ6G/‡ŒÝËgÁ¨ÆÐÿú”ÙS‚‡‹‘òp‹JF`ÜÄT×´öhú -ðã~ÝÂôÒÒ(œÀ»ÂöšèÌô•ÐëSµ?ÐK’ùäÈkÉÆØ7u‚ -½0´Õ½{ŸÔm]–™Î,%¨(™³Yçuù+•Å׊N ÷¦=m -R0¿þzfwz]×}Y®c¥á6Mgú´·6#}j½'ÝœnkzP!~N?i¯ú„ü‚‰5„ Œ4žAé@bÑ}ɹ¦ó±Crê5*z_#ñ^–¹ârœÚ”Y0œêAÒic,S¥ÃE¢ðNÝ™QCq-:wù¤ÅL¿*“ÿ¼ÄzÛʺï×ÁéNÞžða²øî&öõØ4¡Æ WªI#讀Ÿ ·Ђïqw«u+ü »©[™UO?5oPÞà¥yñU¢'KÔõi -üp´dkœ  œÞ ¾(—ýü@l<ÎR'rlE"6:D§Uû‚.SM "ý3Jò;)·ÿ1¸Ñv•LÖÙ9b–ÐDú Ý”÷–‚üª¡h;RŽ–òN¸Tï7‡¹Û"7¯ì;ÐûfÏ!á?ж„ôRÛŸ!ÜÆÃc•)ÈMÇ  Ì €È+Ð9dk}¦íº¡œxÃÞÞS…iÌ„3@Ô ÙÖÒPµŠ¸¯<)}PêXȪ¤Tí¬Ã‚™A?—Ç‚¢2¥“_ä¤d˜U§®Î(Ë' §þ8‚J°NJk±ZÜjC7z1¦8âf¯Çž¿I”“Ú¥{ŒÑ3¤[\fW“êÁ>‡j ÿNY|12ß…ÝöVÌLN1g³¸Í$ÿð¼žîÝ·aDˆ„§ „obõ=„¨„¼`i¿ÌÐdl?_(p[(ì©öĉu²c`…¬…á’@ݾƒÑX£ç,5íÂ0+½a ús-MHÛСëKp}Œõ1—@ªz'W®¬|Ê¥'<±Nß^ai`§;oÀÅ“‹WHשÁм;Ý3é(þy+µ"@kdöݳÊÐð^æÆ>1IïC‹¿€ˆí13FK,áŠFN 8/?u'°ã œ"µ,WBÔ<úS¤Z‡,Gyà>Tný‰@¦ožÁß„'ÅûÂá0›¹…ébãùÁiÁ1§6ŽhU¦ËW«¿y·™÷\˜\£uQ¥ù«¬’€”—µ¶Z‚J3Cúçpú§ð›óÙi$ñÎVMqJ¨×Sžë0¹a‰“gr{ hÈ÷ê³ßêÇïðD3œ~ú³«+²žMt˲Ð[P¥\Wåðˆ+Ò‹ÍèL¹áȉ¯•wÏÑ6ìŸaó‰òQ~aPS‡Ïü ݧ°›öíÎÄ9·7H; …] óñ½òˆïº¬ïÈ*¿£Å£NÍêP{ô­ÑâpÖmz²ÌÞf’9-(ZúÏ ÉîQ¶3eËE‡}šôk¼‚BdÕ3ÞeGàfxq÷–AÊ÷ ¢kU‰S©sÿ1£N”_$&%7@h 'ÖZ$ïó /Nhzjk׳ƒÕ÷ÑH‚0|¯’wÒ\Îeúñ3kä˜_Áïu&áÍ£»å“f¥I~Ž¼µ“?8Rì æ¯7ŸÔ°c»×ÅyaÃ?³¡ú¡¹¢™f³ó^y—H¤Å›7oŠ|Áì-^½ú´áÓË!h& q– -ÿe3ʃ7‘Å$³·€T7ò´ªTšá”VïªnYçc j^wÖ© nëélAÍaÐÏ -‹o|ÇR)–—” -„:“;¥ß¤»6y…*¸ÐÙ'CFg×~3³ßœ3™Pe¾“bÅÌFØ p{÷?_g0«Ü‹ -¯ç/,g§ºEãå‘O -¨UÍ°bÆ©Ó°ãûÌÝ/"ØP(J.{”è0!>n!z}ÁèÓó¿†1aȶ0Kz~¤£3nˆT&.®<6ŒL¸Õ±Í}‚&Á’m‡GÌr|’p9¥Ç;&Oø!*ÔñcI¾¿A‚çûˆ® U"vßL']cbP*'fCàU•HÜ=5}ÿ¹õk™Hå‡&6mxúŸõÙÚM'ÈTµj3ˆ4z¦Ì"™s†Ð -Ò<å76+…‰OÛEŠ{S#Z³ b4åßðûBôF>L\“èâËŽÍ®CWqoj˜ºƒÌ‘Ÿ¹R µXÈ—ozæ1ªhjþòoÁ |ª -íͺÃü@*lôŠu‹co6௥‹ý€YÞYgzMÀ1lÇkÔ`…pïÛŒƒÄ,X´ ÚYS—Šs*ÂŽMm½CX"^aE2¨d?î_UéŽ'mQ¾÷«Z>± «“Ý«Äoq22`pr…Ì9#yÒ ÿùc³^þ¢´)õçú[Þ¥Q¥¾wgŸkù»ð”·uH¡<­d]¸Äœ¨J]Ù ‹”‘úú„ë8p@ KÛSI»ˆ+ÞåTVä#ìråíÓãVbÛÓßœ{¢¯†á*”qIÏ„Íãqļ†‘U½£j§÷_Y¦#'UšÄš™qýêLme{|N×B§Ím}îDý6ï¡P«S¥Wk/›»² lã’£Ú”Ô#téàäû5Æû¤c“ô'i·LFç,Ó S¥K¾¬ˆ-ß°0e*¡i3?Wßl^&É6Ç/c„) ½7ìüª‹ö¬_&Ó·ª>:Vt–Kø8¯Uìã(çJ¡CíÃì#¤C_Gˆ.~‡rˆ=}3¡×m«c•7< TöiR¬¡j•Ü/‹¼ÎK€/®’ZerMR‡L€G·„JÝ ý!žP$Æ_Fj¯çiyü½ÚZà¨%ùk§4«ºŽJûsôEï'Âaõë €S€Êç] æ×ç;äÑMhrÓ@5wŠ•ðëw¦¥Ez“['·R= /C{6Äy7›Å–ÂúV‡Á­™Ã Ž‚½Iò~N¢¹ÐØýÒÚëÑ”û¦kºv)I‹-v—X3ßov2ö@‹ÉÅïØ=o S÷M=9egèͽ $ÃéÏN‹ñ« ‰¨qRÃÞYECPY¸z4ÈIQ?=üÞ:ƒ9Ó¾ã‹S:†”é4áÚ_NÈg¬¢çŒp­“U„ç&,{¶ÞzÜ×'ÑrÔǶµEûqÞVÆî­bþ9N£uŸýb^9bO“Uì6žù,:/±øB¤¹¼ùûMãðnÚ(K'<­?½µÒ ‚iUÈH¢´¨“-aĪ¦žµÌ‰œ) nÔ)/´3¦‘µÓ@ˆ'«60UŒ\ôÅ -‹ûO;W̧„m›*ñ2FP¿äÂb»×°è¢´ÈžÐÀ;èqñÈïBŸÑÐ’rä+÷ Ωã½3[ -Ìù¶µjÅ™ ÅZÜÞX0¹ðh«9“²¶Û';n]=ŒÜ€´&æ:DäÈ’„]@¾‡ƒà8Æ'T5+ÉëÇõ±v'üpO´V¹A°®uÀö„&eân'1NÆç鼃d*å¢ë%ͼßiÉ :wWÃÜr¼cí}=Ô~ˆÎQŠ²8fÇ)­\ïWr»ÒuDÕ©3p¯‘õ²¡ß̅У+!g 5ªï–Dz},´¥ ÷Ï?›‡EF'›Në&¸|Ÿ% tRV-BÀѽ»¨]ÔM-R1óÊ?À°Ù˜=™F""!ÜÈ"—{f1®‰ua[Í[  RúÎ$ðá†äï}o*×£ãtôgkºîbvöäÊ?{4—8ó×v*nÿ–©'ÌJ궿o¯¾»ÕwÐl.@®kŸÙ%–ÌŽ«qD§›ãRf–jHÀl öÙ„œ1¸WVÛ…„#;ãN„s^òuÝwëÆòtT…½Ÿ÷ - AF`ëçdZä\µ:Öíß0D0'âÓ*ù‰2*zÄ…|Õñ™!L;÷å<ËóÈÏnhü/yc ÊvÅzÕ¸u95•çì$š w!,¨ª8 ç±”† ›ó ¡ãøú ê'3žhî—ýy¢nkrhM‰ßôÆ0”B÷Où†&UµQÙdHA…gß°ÝkÌÓuï×Ù2¨šæÚò¥æÑðÄa6£w£à#1 €ŒÄÑqß2™É3…J¼æüt‘pοø\çÈòËÄ{ã,CÖÅ—*ýê-þØi¿‰Cáñ=Úu[È´çbÔëê¾U†•‹Å`%Ã,ƒ§ç‚ñ“ŒYC¥§²"—¡Ö(ž½¾_ÅËÏ°‘#×È C„uWý[¢ÍecœØb(uí:¼GB{«¥U?¾ª˜-Ž­&«1ìñªÓ÷K=ÖêãµW™_&0ë–·òóŸ¡2H0ws}+LjÁšoÛí?Ö;Dò€ýÜ´”†V ”+*‡°¥¸„á!¡„@`FZ% -;a|WNÎsº@{,Ä5ê¦"·^~¼ÔD¾e‰¯ÉµÿâšâKNJŠƒøXc*’4¿È§uÝACŸmÅ¢Ö¦½D,Wšß–%¬Ùz7e-™'±ÿ„*¨lrJ\k`­ùiZú2ØWÉüó;â’?3I*«3îÛ³_^lg -pÄê¢SœjÝ+Xy?˜Àe,»È ¡Z«»‹‰>rHÎeîó?“À®}5žNÖ|ÏÐ7%ÛŠ{rø¬Á¢£ ãà Ä:½›F¨r;wŠ9ýXÝ‘dï3Yq"©ÖŽÑ(s¥OgM¨ƒ° º…ÜqDÉí®›àø‘E) -e@¿:°¹ÅËß¾ÝkÂHkyê‰|Y+ö+¦—Ë 8ü¬^¾ÍD·Ëú¼Ç„ó‘¦÷îÏBØn_§„k¤º”ä÷ƒx̦ye¦íâ³ç¶ßB¡â¾>GY³‹iÄ× Mê¯-ŠcCEi‚·ý_ÖMLÑVŠ¬fp>lƒ -ç9lÍ>ŽŸduÊ Ýô¹6Ô†Q6"kVãmÍ¢“²Zèƒ(?z@?R Z­Ô?pM|¯;¤çs^—û1lù¿}Î/ºâðÏŸ‚ÕŽš<ÒÝÄ­«ÉO£1#zûP¤¡öxË›û§Â>s$ÜAá<Ô“·,.b.qVÜ…:šßÎ~11h'Ì|<ñ“ì†?:þ!ÿ=·$z@!Ö¨ø%?h”÷EêéII•"¦XðÍĚܛ|iÓ‚,`¼KSïõªâY/\Ø’Hr«Ö:J˜c|…ô;N2ëÜ}ß*I#pc æì[l[áK/ý÷¬”ê8â³<£«¹³RÊŸ¹íc} «"r[rüxIþ”ãÅnŽ÷£†¥‡G&99Ý&ÙMôu¢*Õº†qRD^ÒµYeGV$Ä[h(ŠShª J¦¤þY:ÐU/G_{Ô›™-ôƒæùÚÏܳ×â®øšÝï·ï<—]ÙÅ3Û“C%®"!kÿhªk/UEáô<áþúÕ»Ö˜GÅɶÏJTÄ×Ìy ê]a¯²,.cÔ•t0ø=šàÞx=zøNò€JúcnÏë’Y±—È6Û>T}d\Ø;„ÆqaVͧs®‘écìMãËŠÚ@·6ƒgÕyûàS·Éœ,ü–¦¸š´éF´gòo2Lðb¿á™rö›ÿ¨8€rÍœqF¸¯0x>8¯Éßf”W–꨿f tœC -³!ÈÌu=wÁ°l¹“0ÐeÞ-þ^a]Ê„_îïn ù¾ñEåVù†˸Uã#}A|¦Gþ[,>7ÂX Í' -ø®“Oâ6PbM8Ôª+Æ‹óìÊV}1(Fó¡j¸t™½˜¾ÍÇ(ë »‹¦R•gÐ}‘g£;±€´â∔úG/ís¯ÊðŒÐ`.>‹×>ûc2@¥f”@!.ê ¹[ÉêJUêδo vÉNý‰ðt‰£ÚGX¾Ž”ñ«¤¨K+qK™Äù>nŸš!’9ça¦ìÜëcn½ ÿD|Ýi¨”‰µdurÖ(íYŒG|©Ÿ@¼ìò‘-ØVÑÓãÁ&Ï(¾wô4Ñš|‰bp&ûJC± -s¨­MBœi6P55øòÃdân 9‰8ØqàùJ¾–;ä:z^Ü°¸˜=)¡_Up`]һܫ ·³æ]N´ZôùKcZN²Í/»Û…9‰RGq÷øÎN|«çÄ¡uü|5…ï×HLEhÕZáéÁzŸ.y>p†fÔ-MS1A¯PsŒÏ¾85X1zÕðŒ üL, fg—â7•A¬fšǪWꀕ>ÓYM½’¿)ÑÆa‚®k‰„ûª³òþyØ zﺬ!Zög øðï×ú긞”;¾S]ß¡CmkפP‹äŠÑ)mÄÝ×)!‡AËËVèñ£<š™Bݧ±óBWΩ8„Y%×çÇ©ùªÓ†ÃcSuºéÒ85^“I´ÉèZc¼_¾‰k‡—êc/øC¬þ˜:)'ÓÉÚÜN1Ë=8î0vìaµ'Å ÝL®¹ŽAtB±ïzªl̾`WœT]è]:)4Û£•6b|¿ƒ´ce}0Vx–ãä2ddßm·Lk$—z€_pÉa?O^~Êpr†V¸È¶¬*´ù…ïìÏØ’Ûé–úJ3yã•ÚÍç癉ýøx*üo,0téÎ7ƒkKNr/¹ç¢§_üˆä5äí8ƒõ‡˜†ž5¹ž°k¯j±GZèú7ZZ…¦;ƒ-Z~!³Þø îz(—*µ*©OšL,<-6©j²âÖZ™NÍ%?+O«hQu<+•¢êÃR<çÄËàÞ¤å\t¡3Vßp;šs ‹¼6¹mèñã*iì‘¥bŠØÏMÓÿ2Šh†¢MÁ¯™"nŸ:]ªVž,ì÷á =³Ä˜TFÿºnVþqÄP¹©ÚDùñ_(PùôdZ¸œ*‰L‚€^º=4úeþÝõ]Åa…Cb™÷ƒâ©ŸäLsÖÞÀ©°@ó•u9ZâçðMïÇí¤~àÛÊ{[³Ñ¸b…güh`A†A#¨gLíi†ì . ëD̬á`Qק§/ÉÝL|ÎÓa®Êå>ï:ÍRS^à‹Ï°‰yø9Á'ûÊ(£fÔ|”¤# ‡K¬kýÀòtß.<î`üèK%ßjÐ~ÎÔUXÌ=ó©øù[*A=Y#*iŠfS´À±2svþ§iíÀb½±ÉdîïAµùý;ïNiÒl~?óŒˆÞ%ÇâàHri‹×su|ï=€žøçü½ik?y¶ÍA]8É|Ìï¬d1”ðÇ)ž?ªr80 -j{±s¬ÂÊx²5L^š‡þ§æ¥ÚÍŸ°”ȨÏ1Œ™M4Ð2% Ôkv$œ³Vô'×6¸N'u-üÃ~[Ö®ø ZÙ° è‘3µj"J™zÝìCNK‰ F²}míbŸ‰$i9¨*rŸ¥ïæK“ž8ïÕùBÛže%¾*‡*‰p¯•°š™ý^Ìþþž®Óð̇ԃúbTãDÄ=þRƒÞ८?gƒœÁ™%ª¢ýJ-¨;“Î’ÍÙl¦aóùÉŃQേöýÆ‹5h¦Ô;¢.œêz‚€ayGÌKŽ3”®mt)O­¾ð9»e¹ÏBšÝ4½3é<_é³£Rõøk¥ y`S¾L—#ckXry¤ï{bïMôÄGAuÔZ‡ÞÿšF¡ì]Ðf×½ç7³Ö8»ýéà¼ë¼+ÅÞŒ`³>‰x’©Ÿ¡‰ ðþ -áWgî­×ËŒ/ïŒ-&g„àm¾é¦ ÒooÀŽµ¨[—.#ˆ'MæÄç€]Zl²Kª"h#кþtLçz!”NëÛ˜^­gýJý(².÷ÌÛœˆ†qñ®«¬•Ï5†ZÄäο¿"»ŽÒ½¨-Çâ‚9·…OP.zP·t:Š,M°_ØzÇ4ˆª¼{ªÜ‘À.9•ªºä¾·¡‰Æ9í•"ªÙÕ -":„í°?Zäu•Òø¢Å¨»4ÇŠ.¼ÙgøXwØOzµ¡§:†¡¥{r‚SËØ“ JzG|Çzñ©¶/ª~?"À€Ç_ìH¦ºáPQœZ¢èþ+$P‚G2~Ï´Æ2‚àL‰ÑWuk¯ªÉh¬†… Iû¼—B«²žòQ±E½lÚ¬žr’³õ}Å6þ ¹Œ6‡jðî=âœw(=¦ágê=dþÌ*¡þnw²@âIn·XÎ`oeÎ3ÂøñîÞzêZã|‹á?,²È¥ÏO¬Gš¼7PÞL ³O=š„,å!ÐdsˆÈW¯Ûn££Sî>D—a%æL<ïM­ ßÛQ+Š‰Šò2z ÉüøXú³ÎCáƒM-NÀÍA].×’cRšé”õ#E$w¿ƒ-S.¡†|ýkÌìƒn=åRiÈ| 4Óó^hjUÜL9¡‰œQ×;.e¤]^©ØRªlqê…5ÜFè?g­SïÔ•müž¤xM·n©N*J?Jö’#ræ qTiëGëg¬ÓäÕ>¹–k²”ÁáÉ´jÿ¢ÐU»¸c±ÌYåûo7áÕ8Õ9‡³=Co¶H”!çe$™ëÙ—iÝ £Œ7K£I,ˆ‚°µiD•‡Ñó›Àˆ¤—‹ˆ™Šx?3fí¼>L{ê8-O8ŒbÃ1=oÓ(ž6_ÜìÐ×¢Y‚­m}Õ¯ß×5˜¢ï;Py)w6üÇö’A¸(¼Ö^0?X扮Ye{–ˆÙÐÔµ1$Ý»üºR; Ó»eIs‹Ém r¾M щýéš¾§ìö’гÁÇvªeÿT–¼@„{Žœô¡ Áïåž’]G™Ý?b]¦+×Ó¢×]R¿_Ï?Wi¤Ö3Ƶß&ù³ëÝErKy“aùùê–¸f_`¬ì±í ÊdÞø9Qu+ou‹41¿gy›0#‰óq½[Àœ¯êÀ°õÇO-o‹¦,Í|‹hÀÇÜßñGþ÷»ãhPÍh'#´Tl”eM ¨D…0Ç5¶mJúÆ'$»±—rHö-4Ê)ajWæré•%]¿–¶‹„!{YÜo¶ó V!vWÒòÊŒ);7¾šÔ™“R-Z]Ÿðfˆ_Œ ½63¾Sï%5]ýúü5dðâ:÷‚>ÔñayYð9P›bÄíÀcíüIÿQóŽýë:^v:cna™?—/*FûÔG¾±b–ÜÅ”uò†m*Å€ea—œ¦ï-ñѶ´‰áš!k/}ˆ£äÉø° -ªÑ œD@¢ý†ª÷¸X%60ú¡¿§5ª«éÞÅßà^Ÿ¥áH–ÖVò:FëY5¾ TÊç0~½ÀÁÜÍHåï¾ý™r`Ü]–õµ¦TŽ‘¢¼·ê6â6÷ýj%¯Û`¹ØŒ%bû+gM×Þ.ÎÚ†Öð#`ABTbÛ?EÂÓ"/õž_ãû{¡öÄ%&˜4%1÷Îy«>¸OÇÊ=–R²|zͬö’O¾¦ÃBü–'"~Ž1$~ŠÑù¦KŽm”s¥.¹(¤Àß•=ÙDc\ÕÒ"3ŸRË®‰âÙ‚Ç -Aö9úsg[;hF°ÆϦ‚²7ܸIlI'™PÎ1`1`ülAžæûñ5˜ãC^jÁú­¿Õ¯¼ËPjØžÏÉ‹,»þõ{pÄäÖvõ–1›×g-Ú¾HòɆ"\ÔÑÆh[wÌCÖÂÛ[“¶™ºÖöµ¿JóƒQ®¢.×°Âp#YË'‡àMöÎ`«Ð…í«^¾7q;f§Âˆ®Á?mqQ÷¤Iká±qzÕ_ƒì𜭾—­”/kg¿N³¹kò)uײ\¸nŸ| Á”1¯GìQ#ÞÄÐÎ¥ -ÄPŸ“‹›W‡k§2¾+ÅzQ1tÞçz]4fºVÌÿ:¯è¢kìÆŸ‘ð%3ìð7Ú’ÓïÂ1w=¿D&BN½hT…3A\á_ïˆ?Õ|üI - /É4¨3ÎÃHî1FC•‘²\f“Gµh‹éå¿}‰ô¡}ØtÅ>­Ðû˜ÂeV9†]Í€’|<çÏšU]ËY2çù,óu£ê›df‰1µä^ùì˜æ§lî‘óWlÜÖØîq) csgêÛ‘( ÜÏòߘlò[t9¤2n8ŒÉØ–È.Â+ñP-y²ˆµš3æCܵZØ¢šI†rñÙ%]-躼x þé -]>S‹6ePâé1Ü™m·ä•õs¾œ,…ždRë ÈöJNX‘êÂÇïÙ³ƒp1÷¾c¹FXÿ¾2ašm®š­>2t¶Ï;ö&òúü©tÒÃåý!ÀùsFÓ/ˆóoÒ¯ÝÞJsÎqwÝt[;ÊD2|ž¤*ÚN;¬ôHVúFª[=gêí^§{þLÓô‹ëvÝK-ÓwSU–èªïìh ¼X󯳮]þÌT ˆèz¢ù*‰/»ôÍå”êGè~Æ}š’²¶&“ÁŽ¿ûðdÚöâ>\‘Õ9!È7ÍWrÁZ°N*äPšÒìô«úóÉm™‹ºÑ~"(Âýëî¢PlŸ„±yüÙçq²\Å®4˜=‘žÄÏk¶ýò¢]šÛù¸u:µ ÷OhÞµI06>cšQ žŠªœY2ã[, \¦”ƒ Ïæ†Û>7ç™2´dQp"°‚;ögüúˆúÁ:däKI«O­üNðs{²Úôå^TáåîKMûsX­LÔ¨·ãŠýî‰0Ûc| -¦ÓüéC3U\QŸø!q1"VK¹¼ûbGʉèʸG+e_K­—Z³®ÏÙ¨x'õW C´ )¬þ/˜¨*Ü|"£Ü ¤|ä _æ>”btÔ¨dS—&Œ®Uò9O–ÓO[†¸Ég}4ÄŸ¦¿„2b#Á×õËyÜ÷Ù4kòÍž·'”ÎÃI~ECŽ“Òª -ØÌdQV’Š}Qî·„ú‰à  ºÈÏŦur¼ù¼>¥,Ùn"1ögfË“Hž#¹P/¼AÐp´F3 è£^÷`çQHÏ`ó¸!úÝò1ç‘W/†|¬ó„„õø·6¶âi±6lzÖ¤C¥=–/zîù9¾ægEµ'úÞˆŠ^c/üNüC¸^& ñ),$Ìx9¯u4û*Vù/p™‹cnª&#'Ù²Òí*…Žn§‚¶¥:°Vµ=ñ³V’H—øŽvt†9 œ½TÙ÷Ç®2=TÇ ¸urݵi:ãªüUyÅ;Hš‰ÚŸÌo€þÞÔzéábù&vÇ3>„RáS¾R¿ãÎX)>c›tžT$4ïc63½DÕ‰éTãÆig¤¤žXj7ÆmžâGcÙš‡Ž½ØWTš³ü}©#¸áâ,½á”#€:EUÖgÊÐ~˜†Õ A/äFȲNÀ-¦1îU½¢ìöÔôœ½hø$;–Ǭ¶2׎Y_ùÊnÂ;ž´*Y¥Ÿo}þAÝÏúÿðéÿŸàÿ˜€€FŽÎv6FŽÖHÿ¼á?endstream -endobj -2961 0 obj << +/Length 14737 +/Filter /FlateDecode +>> +stream +xÚí·UX̶h‹»;iÜÝÝÝÝ Ö¸»»ÁÝÝ@°à<¸‡àüô¿öÞ‹¬}ï}ºßm^zÌšU5z–}P’ª¨3Šš;š¥ÜY™XùâŠêêb:¬,V&JJq ‰›µ£ƒ„‰ÀÊËË +u·°Ú¹ø8ØùX¸(âŽNÞ.Ö–VnqÚ’¸¢ö@k3€¢‰›Ð4†™‰@ÝÑÌèæ͵³¨ýÓàtºxÍ™XYæÖfnS ¥µó?N²Žîÿ +›»;ýO“ÐÅ$ IÒ@ŠæŽvÞs ³’#h. Èäÿ ©ÿ=¸”»’‰ý?Ãÿwþ¯ {k;ïÿÎq´wrwºÍ.ÿ;Uø_zbŽvÿ×D²n&vÖf¢–v@Ë…¬]¥¬½€æ*ÖnfV ;Wà¿â@óÿ­*Ü¿˜%4Duuéÿ½¦ÿjV1±vpÓðvú÷Àÿäÿ‹YßT!k/€>  +(ô÷?ß ÿ×t’fŽæÖ MÁÉ0qq1ñFíq|YÖæ@/Ð äÌÌäàèêÅ`áè‚ðÏ’‚VÙâ_±ÿB6Z¿#;íÞ‘ãŸä÷fv;»;ºÍMíþk±ÿÝÂ`6w´³3qyq˜€.f@‡¿Òxÿ{€ÿìÍÁJ5q:Ø-þŠ²þwô%ƒ”M\ÿÂÕö=w²sw}€TÍííMÞ#œf+o'+ Ã{ˆë_ŠÖŽæï!µ«‰«Õ{„Àìtq|€~„£ðßÌ ²wó|oçy»Y¹ÿÊø§ÊŽîïµáü§ÎÖe€t]A;àß ’uzüå +Zmfà‚¤ê`ý·Ï?¿ÙÎñ½Hèìnò¾¤\ìÿ¬ÐõŸ[æ=šÝä}`.Ðä¢ïšXì@“Š¿hF‰wFòßÄ *‹Ô;L¤ß T™w9ɾHFî@.òïrQx'‹â;\”Þ ä¢üo⹨¼ÈEõ@.jïrQ'‹Æ;\4ß ä¢õN íw¹è¼ÈE÷ßÄ rÑ{'‹©‹‰™-Ðí?6?/ÛûQûÏöwøÏsÁËõß=þ3äõ~xA^¦ïò2{?ì, 1ó¿ðŸ½óþ³‡ÿB†å_*”Õ_ªÔ_· + HÍæ/9Ùþ… ©¿î•ý;‚îQf‡¿dåø‚¬œþÂv÷_²rù ÿ9T!ÈÊí/Y¹ÿ… +¿dåù×µ ²òú AVÞ!ÈÊç/YÞ¿/V6Ðþß±ÿûIsôòeF6Ъ +/h‡³øÿg¢¦ƒ5è0ËJ€î P™ÿ‰š¹»€.M·½â iÿ‡-¬Aè4CX^t4ã³Ik¨,š®„¦u%Ì( ›è oÎàg:Ùàǘwiû¡$¾BG·±®BK=“¯a6·àÜÂoõöUg_BFÆ¢-ÈT‡=7;10‚ÉêGµÏ‰>X&ùåÔF¾B~»éÑ]§pÄÊ]ˆUñsñå:À6prk1Ýœ|/Á0¯Ká Pëp3qüñTÚ±Èq¹d× óóu¿}Öv 9ƒ÷Sž"äB†à3<ëšU†¯¡"J/…ïVs®RCE@D5åfiQâ*aû"ññvxáKx_­Ô4e©ßBIîø]]ä=eEg4{Bø®C }€Í­Ó`-ƒ1Íu•×t>bÇŠR¥}c|<У0FÔ3QŸéÆï›ÆÌ¡47¨©`ŽÅ¸ã‚.õœ‚õF–z¼kÜÌiH*ÍRw©>؆ŽTVàÐj„šÓMÉØXšªˆgû©¾Ãe[0úhYPh›5êL—©÷‡\|ÆvBƒ9e6±£›;Ø)8¨!TV8çX%²}àùÍZt”ñ±>¶ó0êÔŸ:&4…¦†8ÆêJ£ÕàÔfuµ…bÞìs·œÛ ýÕ Ëp+þ—3¶oO0ªJò p×=¸wâ³]Ï)‘ÑXŒ`­¬ÐõYy»7Ê3)Œ‰ ÕŸtdãþ•¿7U¬iÈ(!~ª¬”o‘2¬Z2Ðß=‰öŸ^ãRI4RŸÏR’Õ–Ò¡7¶9Y¦ ó^6/¥×K¢5~*•=ê58¸WDÁfA„À|¤!‘o¦<,­;‹|ð±Çñfæ¹kµ_Ô¿ä3”\qïü#â–Í’ÆÉ®§~ôÖy•m¯£DЛßÊ‚ÂŽYw¿ÙÇk¿à;¦¦™Bx0 hè}87äH©edeö:wWür™Û5ÖßY÷}\ȸ½mÆ儹C Uz¦4ZÙ:>³Äí “-1MÃxhÎɪC¬ð-›ÄäÜ ¬`m¯+9ˆåal\DôÀÈ +GËܯª¿i¸À­á†“3±äñfcÒ„Ø—ºlH8ç“R„¯à“ƒIBjVeMŒNq”añQÐ…SþEÄ“o{½ˆdÉ Ü íP'šríoÈä/Nïˆ 7ĹÕEÂ^’uÍL{XTWQe­ÝÓ Å·Lƒe”? ÄU½™:ãdvû…^}sŒP{ˆGi&L*¯##BZ’=õYæn#š,¢±yÖÊ6OË$¸1ÖƧ.…:'|L_¸¦ÆÔÈ +Ð%¹—¾ìY ¢Æ^ïA;Í4–ÄȽ^ẖˉ©èµÉ׈ÇüÒÁ&¹ÀÛàó¬L¸nãÁç)Ô®˜Ò æ¼ºa ¶x°£(JF‡QÙmÏ^È´{ÁÎƉLZè¿^F’OÂñĨx¨0iŠ]ŽUaÈ.‘N .xåqêØž¥¯urZ­ÍEO‹]óNòù°‰%ûìIŸôôBùg·ö9­™…¡xÔ6rŽ÷BlÌ$Nç™IeToAÙÞG 6hMCe‘„ŒѳyT¼2·êï~]{3êíËäBj!‘A7iP]boŽµÕ³·(‘-‘5º kžËã#ÍÐ\o6aµ*'×ñ蔎d*jg¢œz]fx©˜ièEãÜhsÁ@’4]Ü"N¥ú_t9ôªî}Ú!6È?®7„+øQBò×üÕQ‘…ž°ò‚fM +o÷ +È~ÁÕ-•ÞŠÕkýáÈé2v;‘Æ;H‘3¢Ñðßaðˆ ípÿÒa²ÏV@̓G—I¸°„‚d —qUƒ+·|û6w§‚­€vÍ-÷â?œ[µ8[*x÷¨Üÿ‹;m­eÍÏ*o<Ã\Mƒtôãš›iÍ—ŒÂ!xŸ-©^:VÁú—SQSçH«o+&^­-’ü!iÛŠ%; .AþÀEfC"ÌÉüv +“oÕ­¼5»ê!˜.¨NËô=Ú;ª9¥a8ªnòÌ/ÕXšØ•(q'cÄõ念Ÿ£ëOŠä4"áü"àS…¸ï;}´pɇÊüϪ& ùáÜ›ùÊÃmi¹ªå²j‡INÏø‰šÛ|ÝO­µ÷¼ñ5kN¤ÉXtãâµsH}‹R-´F¶ÿ£û{û¼ó@LÆoót&‡¸ £% +e2¯lrmò¢$ãÇŽs%JžïɹËG¤7,YœÂc·øY7ãOhÈí :G<õIÈ.o؈à g0òN¹YPü4@ô`üµÅ—ô¸db#\ƒÝvJ²n¹gøU²Õq67"èÆŽ%á¥}NŠ°å½z>µãèOZox(yÒ±ä:2ÈУ‰þÙϸPùŠ<Ñc¤Å†©ë¯©`/NnN‰\"müä{t1ú)b!U§é3%Ü“ºÑǺxb¨­˜Y¸GJ=Æ…GUm°Kÿì‘ž)o‘¥´Ïò$ŽÅÖ—0]£ù‚O—^½ËcÄžþÃìåk޸Ʀ¨¦X>„8›®.yΔߔÊ*Ž<%+Â. /õÝáé•Ÿúl´R~ôý¾±תêÄ ^öCÁ›«ãæþ3Àᵄw¤ +žÆ#Ì’*,$Å0ÁW"MýÅ×™—%Î/@Û2Õ®bŸ4†w¼øÆ3ðBè¦-yîÇè,ñà»<@Bwèld_uâüëzÌÁÇu–µ—ÛÓé,Á9(AER°™kÏ—{«LTì¤í˜4P«š¡”Às3§»”˜büð§Ó'–!{Òû½0’Üuš0šgñJbý)Z\Ñï\Rý¥yâg]¡‹LvFf‡›æ“»Æ‹Š³'Š‹é’F† ˜ïÿŒ4!Ÿ¯ïmv¼(’Ú-SuÓ†BAXH–ð‘F¥WÊâÿ9.§5Ë ¼Klo1‡äF%±ÕZ‰ÿh¿g'56`¥ö¸ /zà{ G6òÂc;Ï,Ïê(­®ñ“9ö¦Öf¬ÎVzA¶†Bý–½¼ÇÂlÚ Hjö3<%æõ„›ifxʯ}sË ÜŠà“Ó!ñÏöø×-è‘óöuß«Ÿj‡×Åî“V×¢Õ¢¾ÿ¬MEØx§³Ýs ÊË .8^xþPt †Ë ­…È?ɽž¶iË:Í–³Í¢ê“ã(̉<{(9}Ž*$”{5””·Y¢é¼žFšuÝw½¿| „™ŒDô°³´gr’ž³jÖ½ô*¦œdÖ­ûp÷^ƒø^‘o†biœSZшõ˼î(ÆÓ+K¯=o|ýÒÔupÅ„ÀPœüç!Ì}Æí~ûWò‚A§–«&=âäÃzy¤æ©c=Á©z3¼¥Pó·ºèéŸ?¦«†5©-£š ?^Z,\€ß!#EûW@ŸT’*²"Ý:ópJî1Ñy]h×pY^åHR‰>øFæT]¯ÿ¸:“ëÕÝIûY<¯,h4ôB +I7Ã?[|£C“>/ ýœÁ‰)`ê†9J\¡ãA´'¥Ý¡éßçp›¿ž=÷4ÉxÙŽß—Gsžèîr°Ý,UO‰oKà22ÈPÈDJ©\2ÐO3ôàoâœ'ýú]î§UP4ƒ7_?=Ç·fñÃùu§€ñÓžY B抣nV) (%öç¤1gÎôK v ŠõX”üF8æ\››Ã_ŽÈrErDžmåÆÄKÖ¿\Z`Š´ ê{ôÿÆ`é_ŠP0CKù™¢¬Ø¡ +RÉœNO‡~ž’\‰‘Ðå6 "U×­L¨4ù8yÄG¶˜»Aƒb¹±uBe6ð[¼Zjÿs§þi"C\Þg¾°" 0[–äf€Ÿ`ØÓ+Wåó Ó„ã3å´Ë¹‡ìW­9âò#q|cf©PÄxé»] <åc­ö‹‘•ËÚ%Gx™4_W¹]ÜðîH¤'Z2‡/¢%.)9Bë +Íúwë„nÕ¹J ãƇmfJõªçqþ›·=v: åàöHN•H  §op{óˆ¨ö}’hú£“zÈð±¥H1£¬±þÔ1\;ׇßî©ó+iqoqY|ð¤yÛøLo§/ò¹rj +º³îj_L›ÉYHQj‚áxF/xï`üù;ÄzË*5x fÒ§a`Ü5ûd2U¬ .ÖÂÇ…‰ßNPtD*rLæ®ííGé/|S2ÓÝÜ"÷IáËÝ„P;FàN”Q±žÚ<¤Í(ÖLãí¾òÐ{užìò<›µrån·N%Ûö®‘º„ª(¾™ÐùÍYd{Ö ]®TKÒ$g'Z‘ÙÔ¤ý|]ªOíž¹šÂõúç~ÄÊôZ.¬þáÄÜ„ë“òóÍ“¾î9s§mAöV¹s‡^#“#UÏ^˘„y“4TãŒÄ—Æ O©ª†HJwÆDð «~W(”›ƒ4ArÀ93D߬Ñ[=õ(€ «ª¬Íèë‘Yàê‘!–hÙÆ^ðcž|óý²QBôÁÓ¡Q-¢äYH‰‚ŒåžÕN}²CÔsL %Ä„Š#~<ðý©«n¢]ãøªÒ×8©›ŸeTåH' CLæòõâZ—]ž Š‘u푨,?2Yºõ›YøÉé¥87 °ZÂö²àf½up[i”߇s€®>HÄh[Æ7¹?{í\õáÈð Ñc‘Ci¼3Ô¾G7²QÙw§a{48Iõ°^Hé!ƒ8þä8ØRÈ·,··‰öÖåÈx·Umqbá.‘à3*‘ô˜‹É6x|Õ¥Ô™ ž±˜ÜÛJQG=Þåò>fØ+‰X½ ¸¿ç^;ý¥$'…ð}ÃW„$å»à̃>äå%Ôã^âä '½”]ì0ÄßÛ’I~8ˆPju£¶0•vâ=Îú‡?:;/Úz$Īþ¨ÜÉ=¦?{ï¹l° Ђ¿Ôßl‰z jš-t - :N\pŠuÍ|œ& g#£È=el+- tÝ£íà×z0ÿ­¿Îgª %yÇÀî\#+]ûý xL·‡o­‡Ý…Œ¾þû `z s0[N¥º²±^‘^Þ¦Y®ŽûÏÇb”璘/±üÙ‰Ÿp_S¼_Râ…7H¬½mßú#§ÓƦ½ÀÎb@AÔ˜³èñö²dñm! ÃDʈA”¦Åó¥·upYK+8ôÊX=[F¡'hí 9¥>†jj±E¡°,ÎA€z®1-_qnלî@¹{Ê.ÁŠ±ŸGC<—¼QC;šŽ›ëS¤ˆØžÙ±³;ÒbnHÞY}Ål^ƒ‡Ãú¿=¨hád¦J*É•ùå¦cq>eB!*èœsûŒIì5ë@á¦ÚÆÎÂG´f]2ˆk`ÃC”ä¾ýÖ ²¶R 5:ùGŸ ÿ"=“Íçoñꑪ_*ÒcÒÖ_¤Ç}¾ÉÕo¨5פi3ᮕmYál_« ûe‚„̬ tšÜÏy—O2Þÿªáúbm9pa79;×%+:jÑB°ì—@Ùø^hD·(sÁOíòM›z×bðÏzbk¿×в³îpà,ôk‰/Áœ³ú »>a?Yå,%Lx`¾ú¶Yí;ÓùZP¬ø™ó—’¿üàd–Šä”ù•QlƒvÌÒÔÇQ¨ŒW=¹ÝñXgŠË6q^ˆnG¹KCžfò{C›u?²¬ƒ^ô„SûW‘T‹á­Q„Í +ñΘ¼<Ö|SU´ÌÎ.ĉ&Ùœ +ÉÇÜèö±•rσ޸_ž…¼ +ó0ÒH:&Y4áíKª+X•¹6M ‰ª°z;Ù0ŒÖ!OŽo5J„Ì3•P6ŸxU4Âq&·Oi÷U€.ôÞÏT%Ž ®ƒˆ1½Ú«> ‹e÷¢äåb´¯ôÈíþœpYij‹¢G¯IE{ +eüX·Ù­Ñž +}[Æ’'`!ˆ>2M–´Ÿ‹\“6.¯hcý¬¸Ç½ ŸÏCj ;á!‰DhSŒóéÐl܇óÒ¶Ø<éšðÏf"ß»;ë%)v«dÂ7‡åqiNÈEÁûÒ òe;ÒÔ=iŽžzø+`¨î»"ÄE¼1h3dUoÙ·ç؈ÄÐ27¦ÕJÿ¸‰ÿ„ö-­fÎFˆÇŽ¿ù¼mù¬]³>ÔRA")‡p–߆ ÛÀŸÊTV™°“x°Þ(XßN¼Ù%ÁßÎMïÌ‘d0h¾œd'ÖBdYz€#§ ƒ}’;'\DÅbzjœrŠÞû64H|NäD´U™KFÿ°i9u{ÂþC·J~ŒþŠ*¢‰ø­@賋 Æa…½pkÖ“0c¬ÇD>#ÏÓ#†d~îžò-ûíKC™J²f¶O³›-³|ZdEhvVõ‰ÅåZ¾ýæD—¤÷^ ýü'†ù*KZÙ'âÏ‚/Éã¨êôçv)D{BiÃäi?Øߺ÷àÎÎ1gÜ_¯´Ê$ËÚHœ~OÔƒÙ)?!W#I™H»¬ÝY;ÜêN£÷c§´æø|ÉßXÀ?ð†ú[J(ꄦnù|Fd0(Iƒž4çâ.êec¶‘×g,CÕPÇn.O˜Š‘yä÷~U.'NÀ™8ÿ^0 Úÿú¼°5= ËÁó~Og‰«±>²¥E@ +$¶È&)âýù­S·ª[º=ºÈÐS‡q yE3Ös>£•T{ +ç+i}nêðt¨¼:°'5z\ÄCˆ½ìf·i_²¸3k)RT†;·áž­Ö·‚³Qd:3†eþèþÚù‰Ü]Ë“Ù^eQ¿h#"œ\ËŠ}ð#Ÿ§gäBús€×Ç%þ¤{’ÞÑý×î&aÕÆšÉCãm…$Rnk¯„VŸÒGƒÓ^Ì*GŸÃpÂÕ4¨Š>¢Ôû¿ÁÙut +–¼éú¬_íTmì¹ Ë€pònÁ÷ÞvDÃT¶»^Q ›µ&òøÀR¹Û4ŸV¼ÚA†`Ž +ž^Š,ã}ëLáF¼¶ŸøM"ËÇž¾ü´Î”õ$@±{a$62×LäN]ÇHtdìáIp.èó̹=X \WRñN¥EÕÇiXŠñÔÉ-¶þLöå €Ò=·_ˆoŒ¼”ñF-Yß_̹ÃÖ- »×©Éë#b²o5iôÞ·SÅåbÌ-—¬[Ò‰Uº·¡x">*v0árlw‚ùŠIrê’ñPù]ÇŸ²”òécŒvßlÌËò']™¹…ò¯ßÛ8cŸˆÔoƒˆÊê?iªO7¶­LëáCÂr éVe¡ë¯ä)ÛµÌ. Â`6»‰Îp·8žý” U^Üü¡ÂÊMÌaFþØboã²Ù¦lüë¥~´±w½O8›M†6ÞSQl!M8ÞEÖÔBמ^!¯¬nHá\Y·Áó*®/faJèT"X/†Y’Á8‰)r)ÁW;hd×ýÙ{ÃkR÷!Œjr*XÞ²2ZΣHþIÄÝ^ |NËI0Âþ2‡î>²ŒpˆPÑV½NßßöAU&Ù:Åú(Ñû\Òf0÷ݸ .îÄâ3bArg8šNTZ¿K‘˜C®‘?5.†¦‰v±¿0RÚ¶ô´‚¢hf3NVÃÊÂ1|qÆzÁ¦ÌY}–nÑíø`à8ñ3âí“X>cÚœaù•Y­÷¬‰½¹ºRäìk…ÊÖ‘P&X<\.7w¨ruJQ—^^jÜvÞú+‚¯.ñ*ë7>¢7Œ’ýW‰#´—-§&ìqùèíiqÓO ö4è üa¼ÇFjåo›¤ô•æ…ÖÕ¡"ÖÂp_zü’£„ÎOHvúÂ’³pbî)Є'¦27-SË·?µ±9f¼~ÔõKmyØ›f.ÖFœ–«n: ^N chuŽ±ñoæh˜ÿ&SÐ]ó\D`ŽåH$»­…Ân°”AøÜ®öC”¾Ö‡}Oó®Ý¾[xù‚e~!*—m}wóÀÖU“sN¬û˜÷ fým8|Ã:F—r>¦Ïrš ~©ÄëO‡lPoÓDºœñÆ-¢rÏW‹lÔ†ù® ð«2I¿b’ˆ¥“¡ +[îUÆÁy„ æÿ$  ©ÕØKöÖßífócù¨MBÌü¬ +ëoaŸ÷g½4fÑ „,’ÓHÔ<í¡•nJ¦<èãù ‹6—!°Í2|¯ù.¡è餃ù–Ž8;ÿá Î;¸s}{í¨RÅÀHè‹Á/4„À„»¢öÜÀ %Ô½¶*|.åãÜ ÁyCºr9Õ,Œ²¦Á +ÿé¨N—³`ü#öŨtoCY£õß³dÄû×ÓQ®pXŠ‹Ex-¡EŽý5>ˆ+ß'£ î +³„o=Y’l¶y`é1ÎÃa67_öscŽäaâ§ü#ýGp‰9$lý”¥#å1Q 5qNÀNgÜ4 i9‚ +k=k¸“Íš_o$=ŠULl/a+»·¶ésw±j V¼­zÓÆ¥Z)ìÀÒJƒ0õ•áܼ¶ýž­Dª •NæÏw¸lCáôf|Uûy=2 ÎºØ¨î°³<û¨&+öE“Î’ÜÒoÇvw•‹"“!‰çOŽ®ÂŸZ'ZN/´ýœk5 >¸¶†Å7‹É}ººäWîö .Ü^à %íÍôÂ<”H2­éúðž¤UÒ¹>MO°è±ù*ßFtw"ñä¯ ¦øÉ–í0¶O¥­»Áðæé” .Æ©qFBp™ïɨöòäÂæ•å”ý€Ò¹zCr_övdJúUòìŠW)]M”è7hÒF[Ê”Z:¦-õÄ7üËõ7R1³€šöI9$5rÖá9©@Ò«!*ºùјÅGG{þ>+ˆØ¹ðîßYÈ‘{• 0ÂCÔ3‹-Õ~Zc—1OØn<4ž³£ÖÇãn'œ‰ãˆ”Ü1ç +Ç4Ù +ºÖKwbÊý¦Â¨4Ž® +DŒÊ9»û}82Ž \(¯»úTóKõ®*é‡û_FŽ³q=R¥†º‰ jE«„t.óU3öðpK}<¬WbÍJÚ?»pÊ<¯Yßç7Œl×$|Çøz³ùI(Qçlé9ë !O,±Éùp¸@š?¼="u’¬ã©®½,¦ñÀm ß;ÁÍ/ü4Ÿûøˆó#lBò„$7ùëâÃTÖxû Äèö#¤Á I'6GªÊËø:‚;æÓrÇ@žÖòš) ³}–UgLæЋRa&Á…6X¼?E±bÓÙù"ÂöBD¦/;þ‚VLI½ÂI¿†z˜÷–e¿ˆäKÊò©Ïð÷8šr0Å" + }' ⚶Rõá*q=#Õ)IŒ yzÊ ´@a/Ƶ3q ‚¥œV5q7¼Â;›JàF¦[+?æ"î‡ÐÓñJ*wÌ/´‰ÿÜoõºô¯÷TòÉŠf+‡«®ÆÃû‰n@¤f>©hÓJú0<¥4ˆÃ(˜å¥Õg® J¹rPUÖÇ%Íå\ìfMÍû‰Ü«DòÁqÁ*%¯d©U‹Ôëi›vÐë•ŸS®»-i‘„k?ÛÆ¡Âd%¢Û ¡‘ñ­ÄuÓ #ŠJ¬½&ÕŠüx<yV+¡üü0†åÏaõ +]£Çƒ}HJã&(7~:ot:wÕ€±œ__ö~©‘hq¬& ·á¨ EõTžíþÆwów 4dR=<çž¾Ôé´Ãd .ÏG¹¤°ŠJd‘3‹AáœÜŠu<›1 Ë.ÉŠp~ëÌ*2-¯”ë+Ieçò +qò’-ꢜ)k÷ |LovÞ9ŒŽ¾Äb…ë.LÎ[5,tÛÓ Ï,«moŒöV@õ­!ç=º ,î§~~jGã¢,][y̨zãd}|•> ×EÒ€ÒW¨×ú½¶pñxšúò¼¨O¦!…¹.ë … wB¾¾Y8UD$Éeá„i<˜þ×ELÎÀbŠ»1ÝVSvÙÒomõ¦¦Š)ü´ûS^Xï[‚W*Áv†znS•ƒñjL< +‰…*„b+…Ô4n¬õ5r¼Ãt™ÕŠšòëþ³)f‘ø}ž®?ô·Lý +Í—¨ áïštœBãÿà÷ø³"ÔH"LàHοOµeÝnªã ž¯íÓj[‡²ä +’þÅÕ9ÅIÓ¥ðò‡ÔoO¸EAà+24Ÿ4<­‘0–3ìtžrVC1¥ÏlÇ P†×+c%¹&åó7HÅf„…KëkrSíØj„BbHÉÔdÉÐA­Ut^cž¥$psÉ û¡~¬N'vGQæ–xïêY‡\‰‘‹^·‰áSéñטÐð–+ K }©@/VuF‘« }ÞwS¾(E›8(ýðf^|ÓREQ¸¦ßéSqŸª÷3b@0Á†éG [Oóö.-Fã=¦R¾Ÿ‰²j8ï5G{Û¤3LiMТ0Ò®câ+Mšè2ðÛHsíaÿÅrw‹ÍßâßØxà ¦”ˆç6íÒ뜭­OiF= +†Ý„ŽGì[ +@0²¤¿Âœ†«[2®*Ô£ÚíX±±w‰%~ÈNp}ÅÝ€ ‚…_y¾`Kœ9ñ?;oÛñ¦rÙT+EÃdµ¬2»&}­¥-$ö•¯ÖWðhêî©Pã× Nù¦>YÚÅb¹iVäµz…]Ý© D=WVíJ"ý$½D˜ ÷k‡ÚÂG¡K¥ó㸆2jùÀÊ[T¨â¥N ½ÃðK8Š¯_Г±`ÜO°¬¿öäßâÞö`0~3¦ÕpªÿÎJy%3Á¾±Hð+vmƒÚ“=-wHAÜgF`“–Žß&NšB—RÍ!R0 Á…ÛQnö–Eؾ"X®¾¡"£ph_9rFE v/€hZºüR•Ô`\<òE§`+è[íIö„•À©Pèñ燣D’“Kq†{(¿ íØe%ð +€ìU.TÌ€¼ãœq²¥#j0¥)<4Âzdf,Œt'&¼±¼,(ú“oæŸÞƒç~½úšÔ´;çq"ü, ;Ê;Æy?‘•Üs²Ú-_«À°B¸òlÿlÚ¯;ò` ù `bL+ #,Í| ¬Í7|âSðG±ŠjŒ¬z“–†$Ž\Ña<–oÿvŠ»M'ò!…UÅ+Èù.å߶‚<ÁÛ]Èò+¬xê}ßÿ€0ﳺb.±ÝÏÅìbf"‰0üÂô\È?k£cI€ŒAbï”»ÙÚ¾ì×îÇ ÁŸü±k"E² +AÛ­Á$ÒÚ*µóUÒEò:dPAn+qíàfÆ¥¶6ju_@օ⯪¤¦a²6qGñ.çL‘QB Ò~i¦]iî¦M“L©'¢¡{½ vãî+¿œp/;vËB†QD£Æâþí²åxøñxÅÙží~æ´eÜF¿y#ëëü•EæçÙHk_”ðHƒTk”þ«ãŠÐÐ]ÆóYŠ…$§ØýmCuçÏLˤt*XâÓYšKEp +l"ôùÆF›.NOšÝ¬ª_hЦ‰ÅyôÖL?¬t]iƳ¦cŠÐ^h†e•=î"È{ðAÙýX¤ÃUDõP°»µQÓb<Ý,•áÛΣ "°<+\:Ñ ’pEö^óFºb†îƒ &±àQ[Ã0¯$Š<õ©OU´ŠÕ¯ëÓ+]ÛÖf„¶,*Ç‹[·žÒ߈òT—Îm°NmžQ·nï»ã‰þô¤¬%º¶NëÚVÓIÀæMWﺱÏý£AµŸn'9”¤ü˜ö‚?¨qs¥0ÖVÒ£ÌÈŒòR£üLýxÒ윤G’¾}ÅÕQ‰²çW„Z?Ö° Ëùýáîü3lMíØëæ,ŽõäRÞ&K·È¶>rk>¹™ŒZÒ<9rkæϘ¥s‰„ÂÃŒ#<û€êJY¿dbÙÏzTR³Šµ¯Réº`§Z2%’ê…=KâŸ9Y^¡Ãª¾Ñh{†€­§²éÒIŸñ J3 +Ý@˜3ͱ+Ãw脈N`9tL¦{¸:YE¯ÁªÏnkK!Ë_Œ«Æ¼Y(êÛ³KP= SB— Þ¸ú¯° ]Ö^¦íÚ /øk…Þ¬§™=bLÛeÆÆýúëa‰>Ïàó/e’Á¯É#%:N|¦ý–xì :¿ÉùeU„Aoxºi8‡yúÌ®º~7¤ß¯&E¹>%‰Ö戸'W?s©O‚Ø(¼ïò¸³Yê}QãU½®k±©ëËÍg'DìnÇ;ù™ó9+3®­]p«¾ú»í¹}!d5k CÅYæO CЛë•×ÚÊFªÍUKùâÅ·óxs4u«h/µT®æ)?V'YðfÃÏ3ܳ8šù†-¶‚4ƒ}7´Œè\{”8íó·®g‘æf&dó6]ŸÜLw´°…¨Æ3s5àb>U &b3ØP`|kAœ¢êœæ,>˜)o‹:6íY·bI> endobj -2959 0 obj << +3019 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 -/FontName /IHMMYU+CMSSBX10 +/FontName /ELTAYY+CMSSBX10 /ItalicAngle 0 /StemV 136 /XHeight 458 /FontBBox [-71 -250 1099 780] /Flags 4 -/CharSet (/ff/fi/fl/ffi/exclam/quotedblright/dollar/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash) -/FontFile 2960 0 R +/CharSet (/ff/fi/fl/ffi/quotedblright/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash) +/FontFile 3020 0 R +>> endobj +7567 0 obj +[642 586 586 892 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 558 0 550 1029 0 306 428 428 550 856 306 367 306 550 550 550 550 550 550 550 550 550 550 550 306 0 0 856 0 519 733 733 733 703 794 642 611 733 794 331 519 764 581 978 794 794 703 794 703 611 733 764 733 1039 733 733 672 343 558 343 0 0 306 525 561 489 561 511 336 550 561 256 286 531 256 867 561 550 561 561 372 422 404 561 500 744 500 500 476 550 1100 ] +endobj +3025 0 obj << +/Type /Pages +/Count 6 +/Parent 7568 0 R +/Kids [3014 0 R 3027 0 R 3041 0 R 3047 0 R 3085 0 R 3120 0 R] +>> endobj +3183 0 obj << +/Type /Pages +/Count 6 +/Parent 7568 0 R +/Kids [3157 0 R 3191 0 R 3230 0 R 3266 0 R 3307 0 R 3363 0 R] +>> endobj +3474 0 obj << +/Type /Pages +/Count 6 +/Parent 7568 0 R +/Kids [3418 0 R 3476 0 R 3529 0 R 3584 0 R 3639 0 R 3694 0 R] >> endobj -7232 0 obj -[642 586 586 892 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 367 558 0 550 0 0 306 428 428 550 856 306 367 306 550 550 550 550 550 550 550 550 550 550 550 306 306 0 856 0 519 733 733 733 703 794 642 611 733 794 331 519 764 581 978 794 794 703 794 703 611 733 764 733 1039 733 733 672 343 0 343 0 0 0 525 561 489 561 511 336 550 561 256 286 531 256 867 561 550 561 561 372 422 404 561 500 744 500 500 476 550 ] -endobj -2965 0 obj << +3803 0 obj << /Type /Pages /Count 6 -/Parent 7233 0 R -/Kids [2954 0 R 2967 0 R 2981 0 R 2987 0 R 3025 0 R 3060 0 R] +/Parent 7568 0 R +/Kids [3750 0 R 3805 0 R 3858 0 R 3912 0 R 3962 0 R 4013 0 R] >> endobj -3122 0 obj << +4092 0 obj << /Type /Pages /Count 6 -/Parent 7233 0 R -/Kids [3096 0 R 3134 0 R 3173 0 R 3181 0 R 3221 0 R 3274 0 R] +/Parent 7568 0 R +/Kids [4064 0 R 4094 0 R 4098 0 R 4104 0 R 4109 0 R 4117 0 R] >> endobj -3382 0 obj << +4136 0 obj << /Type /Pages /Count 6 -/Parent 7233 0 R -/Kids [3326 0 R 3384 0 R 3433 0 R 3488 0 R 3543 0 R 3596 0 R] +/Parent 7568 0 R +/Kids [4125 0 R 4140 0 R 4149 0 R 4162 0 R 4172 0 R 4179 0 R] >> endobj -3701 0 obj << +4187 0 obj << /Type /Pages /Count 6 -/Parent 7233 0 R -/Kids [3650 0 R 3703 0 R 3754 0 R 3809 0 R 3856 0 R 3905 0 R] +/Parent 7569 0 R +/Kids [4184 0 R 4189 0 R 4195 0 R 4201 0 R 4211 0 R 4220 0 R] >> endobj -3990 0 obj << +4243 0 obj << /Type /Pages /Count 6 -/Parent 7233 0 R -/Kids [3953 0 R 3992 0 R 3996 0 R 4002 0 R 4007 0 R 4015 0 R] +/Parent 7569 0 R +/Kids [4237 0 R 4246 0 R 4255 0 R 4260 0 R 4270 0 R 4277 0 R] >> endobj -4034 0 obj << +4287 0 obj << /Type /Pages /Count 6 -/Parent 7233 0 R -/Kids [4023 0 R 4036 0 R 4049 0 R 4059 0 R 4066 0 R 4071 0 R] +/Parent 7569 0 R +/Kids [4282 0 R 4289 0 R 4314 0 R 4318 0 R 4326 0 R 4333 0 R] >> endobj -4080 0 obj << +4347 0 obj << /Type /Pages /Count 6 -/Parent 7234 0 R -/Kids [4075 0 R 4082 0 R 4088 0 R 4098 0 R 4107 0 R 4125 0 R] +/Parent 7569 0 R +/Kids [4343 0 R 4349 0 R 4359 0 R 4365 0 R 4378 0 R 4387 0 R] >> endobj -4139 0 obj << +4399 0 obj << /Type /Pages /Count 6 -/Parent 7234 0 R -/Kids [4131 0 R 4141 0 R 4146 0 R 4156 0 R 4160 0 R 4167 0 R] +/Parent 7569 0 R +/Kids [4393 0 R 4401 0 R 4406 0 R 4416 0 R 4423 0 R 4427 0 R] >> endobj -4192 0 obj << +4446 0 obj << /Type /Pages /Count 6 -/Parent 7234 0 R -/Kids [4179 0 R 4194 0 R 4201 0 R 4210 0 R 4221 0 R 4226 0 R] +/Parent 7569 0 R +/Kids [4437 0 R 4449 0 R 4460 0 R 4468 0 R 4476 0 R 4482 0 R] >> endobj -4241 0 obj << +4490 0 obj << /Type /Pages /Count 6 -/Parent 7234 0 R -/Kids [4233 0 R 4243 0 R 4254 0 R 4261 0 R 4269 0 R 4276 0 R] +/Parent 7570 0 R +/Kids [4487 0 R 4492 0 R 4498 0 R 4510 0 R 4518 0 R 4530 0 R] >> endobj -4287 0 obj << +4539 0 obj << /Type /Pages /Count 6 -/Parent 7234 0 R -/Kids [4281 0 R 4289 0 R 4297 0 R 4303 0 R 4307 0 R 4318 0 R] +/Parent 7570 0 R +/Kids [4535 0 R 4541 0 R 4550 0 R 4555 0 R 4565 0 R 4569 0 R] >> endobj -4332 0 obj << +4581 0 obj << /Type /Pages /Count 6 -/Parent 7234 0 R -/Kids [4326 0 R 4334 0 R 4340 0 R 4345 0 R 4349 0 R 4355 0 R] +/Parent 7570 0 R +/Kids [4575 0 R 4583 0 R 4589 0 R 4595 0 R 4607 0 R 4620 0 R] >> endobj -4377 0 obj << +4630 0 obj << /Type /Pages /Count 6 -/Parent 7235 0 R -/Kids [4370 0 R 4379 0 R 4390 0 R 4394 0 R 4402 0 R 4409 0 R] +/Parent 7570 0 R +/Kids [4626 0 R 4632 0 R 4636 0 R 4642 0 R 4647 0 R 4653 0 R] >> endobj -4426 0 obj << +4667 0 obj << /Type /Pages /Count 6 -/Parent 7235 0 R -/Kids [4420 0 R 4428 0 R 4433 0 R 4439 0 R 4448 0 R 4458 0 R] +/Parent 7570 0 R +/Kids [4663 0 R 4669 0 R 4678 0 R 4692 0 R 4699 0 R 4709 0 R] >> endobj -4468 0 obj << +4721 0 obj << /Type /Pages /Count 6 -/Parent 7235 0 R -/Kids [4464 0 R 4470 0 R 4474 0 R 4480 0 R 4485 0 R 4491 0 R] +/Parent 7570 0 R +/Kids [4717 0 R 4723 0 R 4728 0 R 4735 0 R 4741 0 R 4747 0 R] >> endobj -4507 0 obj << +4761 0 obj << /Type /Pages /Count 6 -/Parent 7235 0 R -/Kids [4503 0 R 4509 0 R 4515 0 R 4526 0 R 4534 0 R 4544 0 R] +/Parent 7571 0 R +/Kids [4753 0 R 4763 0 R 4773 0 R 4784 0 R 4795 0 R 4801 0 R] >> endobj -4556 0 obj << +4812 0 obj << /Type /Pages /Count 6 -/Parent 7235 0 R -/Kids [4552 0 R 4558 0 R 4563 0 R 4570 0 R 4576 0 R 4582 0 R] +/Parent 7571 0 R +/Kids [4806 0 R 4817 0 R 4825 0 R 4831 0 R 4836 0 R 4843 0 R] >> endobj -4594 0 obj << +4858 0 obj << /Type /Pages /Count 6 -/Parent 7235 0 R -/Kids [4588 0 R 4597 0 R 4605 0 R 4615 0 R 4626 0 R 4630 0 R] +/Parent 7571 0 R +/Kids [4855 0 R 4860 0 R 4868 0 R 4877 0 R 4888 0 R 4898 0 R] >> endobj -4640 0 obj << +4907 0 obj << /Type /Pages /Count 6 -/Parent 7236 0 R -/Kids [4636 0 R 4643 0 R 4649 0 R 4656 0 R 4663 0 R 4672 0 R] +/Parent 7571 0 R +/Kids [4903 0 R 4909 0 R 4913 0 R 4922 0 R 4928 0 R 4940 0 R] >> endobj -4683 0 obj << +4956 0 obj << /Type /Pages /Count 6 -/Parent 7236 0 R -/Kids [4677 0 R 4686 0 R 4694 0 R 4704 0 R 4715 0 R 4720 0 R] +/Parent 7571 0 R +/Kids [4948 0 R 4961 0 R 4968 0 R 4977 0 R 4982 0 R 4989 0 R] >> endobj -4730 0 obj << +5004 0 obj << /Type /Pages /Count 6 -/Parent 7236 0 R -/Kids [4725 0 R 4732 0 R 4739 0 R 4746 0 R 4753 0 R 4759 0 R] +/Parent 7571 0 R +/Kids [4997 0 R 5009 0 R 5015 0 R 5024 0 R 5032 0 R 5044 0 R] >> endobj -4773 0 obj << +5067 0 obj << /Type /Pages /Count 6 -/Parent 7236 0 R -/Kids [4767 0 R 4775 0 R 4784 0 R 4790 0 R 4795 0 R 4805 0 R] +/Parent 7572 0 R +/Kids [5055 0 R 5069 0 R 5076 0 R 5081 0 R 5087 0 R 5091 0 R] >> endobj -4819 0 obj << +5108 0 obj << /Type /Pages /Count 6 -/Parent 7236 0 R -/Kids [4811 0 R 4821 0 R 4829 0 R 4833 0 R 4838 0 R 4844 0 R] +/Parent 7572 0 R +/Kids [5100 0 R 5110 0 R 5121 0 R 5130 0 R 5137 0 R 5145 0 R] >> endobj -4860 0 obj << +5162 0 obj << /Type /Pages /Count 6 -/Parent 7236 0 R -/Kids [4852 0 R 4863 0 R 4871 0 R 4881 0 R 4890 0 R 4902 0 R] +/Parent 7572 0 R +/Kids [5154 0 R 5164 0 R 5171 0 R 5177 0 R 5181 0 R 5190 0 R] >> endobj -4914 0 obj << +5203 0 obj << /Type /Pages /Count 6 -/Parent 7237 0 R -/Kids [4909 0 R 4916 0 R 4923 0 R 4928 0 R 4933 0 R 4942 0 R] +/Parent 7572 0 R +/Kids [5197 0 R 5205 0 R 5209 0 R 5215 0 R 5220 0 R 5224 0 R] >> endobj -4954 0 obj << +5237 0 obj << /Type /Pages /Count 6 -/Parent 7237 0 R -/Kids [4949 0 R 4956 0 R 4962 0 R 4967 0 R 4971 0 R 4978 0 R] +/Parent 7572 0 R +/Kids [5230 0 R 5239 0 R 5246 0 R 5251 0 R 5258 0 R 5269 0 R] >> endobj -4991 0 obj << +5276 0 obj << /Type /Pages /Count 6 -/Parent 7237 0 R -/Kids [4986 0 R 4993 0 R 4998 0 R 5005 0 R 5014 0 R 5018 0 R] +/Parent 7572 0 R +/Kids [5273 0 R 5278 0 R 5284 0 R 5291 0 R 5308 0 R 5316 0 R] >> endobj -5028 0 obj << +5334 0 obj << /Type /Pages /Count 6 -/Parent 7237 0 R -/Kids [5023 0 R 5030 0 R 5036 0 R 5055 0 R 5062 0 R 5069 0 R] +/Parent 7573 0 R +/Kids [5328 0 R 5336 0 R 5342 0 R 5351 0 R 5356 0 R 5363 0 R] >> endobj -5083 0 obj << +5376 0 obj << /Type /Pages /Count 6 -/Parent 7237 0 R -/Kids [5075 0 R 5085 0 R 5090 0 R 5096 0 R 5104 0 R 5112 0 R] +/Parent 7573 0 R +/Kids [5371 0 R 5378 0 R 5384 0 R 5391 0 R 5396 0 R 5406 0 R] >> endobj -5124 0 obj << +5415 0 obj << /Type /Pages /Count 6 -/Parent 7237 0 R -/Kids [5118 0 R 5126 0 R 5131 0 R 5139 0 R 5144 0 R 5150 0 R] +/Parent 7573 0 R +/Kids [5412 0 R 5417 0 R 5424 0 R 5436 0 R 5445 0 R 5451 0 R] >> endobj -5170 0 obj << +5459 0 obj << /Type /Pages /Count 6 -/Parent 7238 0 R -/Kids [5163 0 R 5172 0 R 5177 0 R 5182 0 R 5186 0 R 5196 0 R] +/Parent 7573 0 R +/Kids [5456 0 R 5461 0 R 5472 0 R 5477 0 R 5482 0 R 5486 0 R] >> endobj -5204 0 obj << +5503 0 obj << /Type /Pages /Count 6 -/Parent 7238 0 R -/Kids [5201 0 R 5206 0 R 5211 0 R 5217 0 R 5223 0 R 5228 0 R] +/Parent 7573 0 R +/Kids [5493 0 R 5505 0 R 5510 0 R 5517 0 R 5523 0 R 5532 0 R] >> endobj -5240 0 obj << +5541 0 obj << /Type /Pages /Count 6 -/Parent 7238 0 R -/Kids [5236 0 R 5242 0 R 5250 0 R 5255 0 R 5260 0 R 5269 0 R] +/Parent 7573 0 R +/Kids [5537 0 R 5543 0 R 5550 0 R 5562 0 R 5566 0 R 5572 0 R] >> endobj -5279 0 obj << +5581 0 obj << /Type /Pages /Count 6 -/Parent 7238 0 R -/Kids [5275 0 R 5281 0 R 5286 0 R 5291 0 R 5296 0 R 5301 0 R] +/Parent 7574 0 R +/Kids [5577 0 R 5583 0 R 5588 0 R 5593 0 R 5598 0 R 5604 0 R] >> endobj -5311 0 obj << +5628 0 obj << /Type /Pages /Count 6 -/Parent 7238 0 R -/Kids [5306 0 R 5313 0 R 5319 0 R 5324 0 R 5328 0 R 5334 0 R] +/Parent 7574 0 R +/Kids [5615 0 R 5630 0 R 5636 0 R 5648 0 R 5662 0 R 5670 0 R] >> endobj -5359 0 obj << +5678 0 obj << /Type /Pages /Count 6 -/Parent 7238 0 R -/Kids [5350 0 R 5364 0 R 5369 0 R 5374 0 R 5379 0 R 5384 0 R] +/Parent 7574 0 R +/Kids [5674 0 R 5680 0 R 5686 0 R 5690 0 R 5694 0 R 5703 0 R] >> endobj -5391 0 obj << +5720 0 obj << /Type /Pages /Count 6 -/Parent 7239 0 R -/Kids [5388 0 R 5393 0 R 5403 0 R 5412 0 R 5420 0 R 5424 0 R] +/Parent 7574 0 R +/Kids [5711 0 R 5722 0 R 5726 0 R 5732 0 R 5742 0 R 5752 0 R] >> endobj -5438 0 obj << +5767 0 obj << /Type /Pages /Count 6 -/Parent 7239 0 R -/Kids [5431 0 R 5440 0 R 5450 0 R 5456 0 R 5464 0 R 5472 0 R] +/Parent 7574 0 R +/Kids [5758 0 R 5770 0 R 5777 0 R 5783 0 R 5788 0 R 5796 0 R] >> endobj -5483 0 obj << +5811 0 obj << /Type /Pages /Count 6 -/Parent 7239 0 R -/Kids [5479 0 R 5485 0 R 5492 0 R 5503 0 R 5509 0 R 5522 0 R] +/Parent 7574 0 R +/Kids [5805 0 R 5815 0 R 5823 0 R 5831 0 R 5837 0 R 5844 0 R] >> endobj -5534 0 obj << +5855 0 obj << /Type /Pages /Count 6 -/Parent 7239 0 R -/Kids [5527 0 R 5536 0 R 5544 0 R 5549 0 R 5556 0 R 5572 0 R] +/Parent 7575 0 R +/Kids [5849 0 R 5860 0 R 5873 0 R 5885 0 R 5896 0 R 5903 0 R] >> endobj -5592 0 obj << +5913 0 obj << /Type /Pages /Count 6 -/Parent 7239 0 R -/Kids [5583 0 R 5595 0 R 5603 0 R 5611 0 R 5617 0 R 5624 0 R] +/Parent 7575 0 R +/Kids [5908 0 R 5915 0 R 5921 0 R 5929 0 R 5939 0 R 5950 0 R] >> endobj -5635 0 obj << +5973 0 obj << /Type /Pages /Count 6 -/Parent 7239 0 R -/Kids [5628 0 R 5638 0 R 5648 0 R 5658 0 R 5671 0 R 5683 0 R] +/Parent 7575 0 R +/Kids [5961 0 R 5977 0 R 5991 0 R 5999 0 R 6009 0 R 6016 0 R] >> endobj -5701 0 obj << +6033 0 obj << /Type /Pages /Count 6 -/Parent 7240 0 R -/Kids [5693 0 R 5705 0 R 5715 0 R 5722 0 R 5731 0 R 5738 0 R] +/Parent 7575 0 R +/Kids [6024 0 R 6036 0 R 6041 0 R 6046 0 R 6053 0 R 6058 0 R] >> endobj -5750 0 obj << +6069 0 obj << /Type /Pages /Count 6 -/Parent 7240 0 R -/Kids [5746 0 R 5752 0 R 5757 0 R 5764 0 R 5774 0 R 5780 0 R] +/Parent 7575 0 R +/Kids [6064 0 R 6071 0 R 6075 0 R 6085 0 R 6095 0 R 6105 0 R] >> endobj -5793 0 obj << +6119 0 obj << /Type /Pages /Count 6 -/Parent 7240 0 R -/Kids [5784 0 R 5796 0 R 5806 0 R 5815 0 R 5820 0 R 5833 0 R] +/Parent 7575 0 R +/Kids [6110 0 R 6121 0 R 6127 0 R 6132 0 R 6139 0 R 6145 0 R] >> endobj -5843 0 obj << +6158 0 obj << /Type /Pages /Count 6 -/Parent 7240 0 R -/Kids [5839 0 R 5845 0 R 5856 0 R 5863 0 R 5870 0 R 5876 0 R] +/Parent 7576 0 R +/Kids [6152 0 R 6160 0 R 6166 0 R 6174 0 R 6181 0 R 6188 0 R] >> endobj -5889 0 obj << +6208 0 obj << /Type /Pages /Count 6 -/Parent 7240 0 R -/Kids [5885 0 R 5891 0 R 5899 0 R 5906 0 R 5919 0 R 5936 0 R] +/Parent 7576 0 R +/Kids [6200 0 R 6210 0 R 6230 0 R 6243 0 R 6256 0 R 6270 0 R] >> endobj -5960 0 obj << +6282 0 obj << /Type /Pages /Count 6 -/Parent 7240 0 R -/Kids [5948 0 R 5962 0 R 5987 0 R 5995 0 R 6002 0 R 6009 0 R] +/Parent 7576 0 R +/Kids [6275 0 R 6284 0 R 6290 0 R 6296 0 R 6302 0 R 6308 0 R] >> endobj -6020 0 obj << +6322 0 obj << /Type /Pages /Count 6 -/Parent 7241 0 R -/Kids [6015 0 R 6022 0 R 6028 0 R 6035 0 R 6042 0 R 6047 0 R] +/Parent 7576 0 R +/Kids [6315 0 R 6324 0 R 6332 0 R 6341 0 R 6355 0 R 6373 0 R] >> endobj -6065 0 obj << +6388 0 obj << /Type /Pages /Count 6 -/Parent 7241 0 R -/Kids [6057 0 R 6067 0 R 6077 0 R 6098 0 R 6107 0 R 6112 0 R] +/Parent 7576 0 R +/Kids [6383 0 R 6390 0 R 6396 0 R 6407 0 R 6419 0 R 6424 0 R] >> endobj -6125 0 obj << +6439 0 obj << /Type /Pages /Count 6 -/Parent 7241 0 R -/Kids [6119 0 R 6128 0 R 6136 0 R 6148 0 R 6154 0 R 6164 0 R] +/Parent 7576 0 R +/Kids [6435 0 R 6441 0 R 6447 0 R 6455 0 R 6461 0 R 6469 0 R] >> endobj -6174 0 obj << +6485 0 obj << /Type /Pages /Count 6 -/Parent 7241 0 R -/Kids [6169 0 R 6176 0 R 6184 0 R 6190 0 R 6198 0 R 6205 0 R] +/Parent 7577 0 R +/Kids [6481 0 R 6487 0 R 6499 0 R 6505 0 R 6512 0 R 6516 0 R] >> endobj -6221 0 obj << +6530 0 obj << /Type /Pages /Count 6 -/Parent 7241 0 R -/Kids [6211 0 R 6223 0 R 6228 0 R 6235 0 R 6243 0 R 6247 0 R] +/Parent 7577 0 R +/Kids [6524 0 R 6532 0 R 6538 0 R 6544 0 R 6548 0 R 6556 0 R] >> endobj -6259 0 obj << +6567 0 obj << /Type /Pages /Count 6 -/Parent 7241 0 R -/Kids [6256 0 R 6261 0 R 6267 0 R 6273 0 R 6278 0 R 6288 0 R] +/Parent 7577 0 R +/Kids [6560 0 R 6569 0 R 6578 0 R 6583 0 R 6587 0 R 6595 0 R] >> endobj -6302 0 obj << +6607 0 obj << /Type /Pages /Count 6 -/Parent 7242 0 R -/Kids [6296 0 R 6304 0 R 6308 0 R 6316 0 R 6322 0 R 6328 0 R] +/Parent 7577 0 R +/Kids [6601 0 R 6609 0 R 6616 0 R 6625 0 R 6630 0 R 6640 0 R] >> endobj -6341 0 obj << +6657 0 obj << /Type /Pages /Count 6 -/Parent 7242 0 R -/Kids [6336 0 R 6343 0 R 6352 0 R 6358 0 R 6371 0 R 6380 0 R] +/Parent 7577 0 R +/Kids [6654 0 R 6659 0 R 6666 0 R 6672 0 R 6678 0 R 6686 0 R] >> endobj -6392 0 obj << +6706 0 obj << /Type /Pages /Count 6 -/Parent 7242 0 R -/Kids [6387 0 R 6394 0 R 6400 0 R 6408 0 R 6417 0 R 6428 0 R] +/Parent 7577 0 R +/Kids [6696 0 R 6708 0 R 6722 0 R 6740 0 R 6754 0 R 6762 0 R] >> endobj -6459 0 obj << +6777 0 obj << /Type /Pages /Count 6 -/Parent 7242 0 R -/Kids [6442 0 R 6461 0 R 6475 0 R 6482 0 R 6489 0 R 6498 0 R] +/Parent 7578 0 R +/Kids [6769 0 R 6779 0 R 6786 0 R 6794 0 R 6801 0 R 6807 0 R] >> endobj -6510 0 obj << +6816 0 obj << /Type /Pages /Count 6 -/Parent 7242 0 R -/Kids [6507 0 R 6512 0 R 6518 0 R 6525 0 R 6530 0 R 6534 0 R] +/Parent 7578 0 R +/Kids [6812 0 R 6818 0 R 6824 0 R 6829 0 R 6836 0 R 6840 0 R] >> endobj -6545 0 obj << +6847 0 obj << /Type /Pages /Count 6 -/Parent 7242 0 R -/Kids [6540 0 R 6547 0 R 6553 0 R 6557 0 R 6561 0 R 6566 0 R] +/Parent 7578 0 R +/Kids [6844 0 R 6849 0 R 6856 0 R 6860 0 R 6866 0 R 6874 0 R] >> endobj -6575 0 obj << +6887 0 obj << /Type /Pages /Count 6 -/Parent 7243 0 R -/Kids [6572 0 R 6577 0 R 6583 0 R 6592 0 R 6599 0 R 6607 0 R] +/Parent 7578 0 R +/Kids [6880 0 R 6889 0 R 6894 0 R 6898 0 R 6904 0 R 6910 0 R] >> endobj -6615 0 obj << +6920 0 obj << /Type /Pages /Count 6 -/Parent 7243 0 R -/Kids [6612 0 R 6617 0 R 6623 0 R 6629 0 R 6635 0 R 6640 0 R] +/Parent 7578 0 R +/Kids [6916 0 R 6922 0 R 6933 0 R 6939 0 R 6943 0 R 6950 0 R] >> endobj -6654 0 obj << +6963 0 obj << /Type /Pages /Count 6 -/Parent 7243 0 R -/Kids [6649 0 R 6656 0 R 6660 0 R 6667 0 R 6677 0 R 6681 0 R] +/Parent 7578 0 R +/Kids [6959 0 R 6965 0 R 6973 0 R 6982 0 R 6988 0 R 6994 0 R] >> endobj -6698 0 obj << +7002 0 obj << /Type /Pages /Count 6 -/Parent 7243 0 R -/Kids [6689 0 R 6700 0 R 6706 0 R 6712 0 R 6717 0 R 6721 0 R] +/Parent 7579 0 R +/Kids [6999 0 R 7004 0 R 7015 0 R 7032 0 R 7037 0 R 7041 0 R] >> endobj -6745 0 obj << +7051 0 obj << /Type /Pages /Count 6 -/Parent 7243 0 R -/Kids [6739 0 R 6747 0 R 6752 0 R 6756 0 R 6761 0 R 6774 0 R] +/Parent 7579 0 R +/Kids [7045 0 R 7053 0 R 7067 0 R 7075 0 R 7081 0 R 7085 0 R] >> endobj -6790 0 obj << +7094 0 obj << /Type /Pages /Count 6 -/Parent 7243 0 R -/Kids [6786 0 R 6792 0 R 6797 0 R 6803 0 R 6807 0 R 6813 0 R] +/Parent 7579 0 R +/Kids [7091 0 R 7096 0 R 7102 0 R 7111 0 R 7127 0 R 7136 0 R] >> endobj -6837 0 obj << +7143 0 obj << /Type /Pages /Count 6 -/Parent 7244 0 R -/Kids [6823 0 R 6839 0 R 6846 0 R 6850 0 R 6856 0 R 6863 0 R] +/Parent 7579 0 R +/Kids [7140 0 R 7145 0 R 7152 0 R 7159 0 R 7164 0 R 7168 0 R] >> endobj -6879 0 obj << +7182 0 obj << /Type /Pages /Count 6 -/Parent 7244 0 R -/Kids [6873 0 R 6881 0 R 6888 0 R 6892 0 R 6901 0 R 6908 0 R] +/Parent 7579 0 R +/Kids [7175 0 R 7184 0 R 7192 0 R 7199 0 R 7206 0 R 7210 0 R] >> endobj -6920 0 obj << +7227 0 obj << /Type /Pages /Count 6 -/Parent 7244 0 R -/Kids [6913 0 R 6922 0 R 6936 0 R 6943 0 R 6951 0 R 6959 0 R] +/Parent 7579 0 R +/Kids [7221 0 R 7229 0 R 7234 0 R 7247 0 R 7258 0 R 7269 0 R] >> endobj -6976 0 obj << +7289 0 obj << /Type /Pages /Count 6 -/Parent 7244 0 R -/Kids [6971 0 R 6978 0 R 6988 0 R 6993 0 R 6999 0 R 7003 0 R] +/Parent 7580 0 R +/Kids [7277 0 R 7291 0 R 7303 0 R 7309 0 R 7319 0 R 7324 0 R] >> endobj -7033 0 obj << +7333 0 obj << /Type /Pages /Count 6 -/Parent 7244 0 R -/Kids [7017 0 R 7035 0 R 7041 0 R 7047 0 R 7054 0 R 7058 0 R] +/Parent 7580 0 R +/Kids [7330 0 R 7335 0 R 7349 0 R 7367 0 R 7372 0 R 7378 0 R] >> endobj -7070 0 obj << +7389 0 obj << /Type /Pages /Count 6 -/Parent 7244 0 R -/Kids [7063 0 R 7072 0 R 7076 0 R 7085 0 R 7089 0 R 7101 0 R] +/Parent 7580 0 R +/Kids [7385 0 R 7391 0 R 7396 0 R 7403 0 R 7408 0 R 7415 0 R] >> endobj -7118 0 obj << +7432 0 obj << /Type /Pages /Count 6 -/Parent 7245 0 R -/Kids [7109 0 R 7120 0 R 7128 0 R 7136 0 R 7142 0 R 7150 0 R] +/Parent 7580 0 R +/Kids [7421 0 R 7434 0 R 7442 0 R 7452 0 R 7460 0 R 7469 0 R] >> endobj -7163 0 obj << +7482 0 obj << /Type /Pages -/Count 4 -/Parent 7245 0 R -/Kids [7160 0 R 7165 0 R 7170 0 R 7196 0 R] +/Count 6 +/Parent 7580 0 R +/Kids [7475 0 R 7484 0 R 7494 0 R 7498 0 R 7503 0 R 7529 0 R] >> endobj -7233 0 obj << +7568 0 obj << /Type /Pages /Count 36 -/Parent 7246 0 R -/Kids [2965 0 R 3122 0 R 3382 0 R 3701 0 R 3990 0 R 4034 0 R] +/Parent 7581 0 R +/Kids [3025 0 R 3183 0 R 3474 0 R 3803 0 R 4092 0 R 4136 0 R] >> endobj -7234 0 obj << +7569 0 obj << /Type /Pages /Count 36 -/Parent 7246 0 R -/Kids [4080 0 R 4139 0 R 4192 0 R 4241 0 R 4287 0 R 4332 0 R] +/Parent 7581 0 R +/Kids [4187 0 R 4243 0 R 4287 0 R 4347 0 R 4399 0 R 4446 0 R] >> endobj -7235 0 obj << +7570 0 obj << /Type /Pages /Count 36 -/Parent 7246 0 R -/Kids [4377 0 R 4426 0 R 4468 0 R 4507 0 R 4556 0 R 4594 0 R] +/Parent 7581 0 R +/Kids [4490 0 R 4539 0 R 4581 0 R 4630 0 R 4667 0 R 4721 0 R] >> endobj -7236 0 obj << +7571 0 obj << /Type /Pages /Count 36 -/Parent 7246 0 R -/Kids [4640 0 R 4683 0 R 4730 0 R 4773 0 R 4819 0 R 4860 0 R] +/Parent 7581 0 R +/Kids [4761 0 R 4812 0 R 4858 0 R 4907 0 R 4956 0 R 5004 0 R] >> endobj -7237 0 obj << +7572 0 obj << /Type /Pages /Count 36 -/Parent 7246 0 R -/Kids [4914 0 R 4954 0 R 4991 0 R 5028 0 R 5083 0 R 5124 0 R] +/Parent 7581 0 R +/Kids [5067 0 R 5108 0 R 5162 0 R 5203 0 R 5237 0 R 5276 0 R] >> endobj -7238 0 obj << +7573 0 obj << /Type /Pages /Count 36 -/Parent 7246 0 R -/Kids [5170 0 R 5204 0 R 5240 0 R 5279 0 R 5311 0 R 5359 0 R] +/Parent 7581 0 R +/Kids [5334 0 R 5376 0 R 5415 0 R 5459 0 R 5503 0 R 5541 0 R] >> endobj -7239 0 obj << +7574 0 obj << /Type /Pages /Count 36 -/Parent 7247 0 R -/Kids [5391 0 R 5438 0 R 5483 0 R 5534 0 R 5592 0 R 5635 0 R] +/Parent 7582 0 R +/Kids [5581 0 R 5628 0 R 5678 0 R 5720 0 R 5767 0 R 5811 0 R] >> endobj -7240 0 obj << +7575 0 obj << /Type /Pages /Count 36 -/Parent 7247 0 R -/Kids [5701 0 R 5750 0 R 5793 0 R 5843 0 R 5889 0 R 5960 0 R] +/Parent 7582 0 R +/Kids [5855 0 R 5913 0 R 5973 0 R 6033 0 R 6069 0 R 6119 0 R] >> endobj -7241 0 obj << +7576 0 obj << /Type /Pages /Count 36 -/Parent 7247 0 R -/Kids [6020 0 R 6065 0 R 6125 0 R 6174 0 R 6221 0 R 6259 0 R] +/Parent 7582 0 R +/Kids [6158 0 R 6208 0 R 6282 0 R 6322 0 R 6388 0 R 6439 0 R] >> endobj -7242 0 obj << +7577 0 obj << /Type /Pages /Count 36 -/Parent 7247 0 R -/Kids [6302 0 R 6341 0 R 6392 0 R 6459 0 R 6510 0 R 6545 0 R] +/Parent 7582 0 R +/Kids [6485 0 R 6530 0 R 6567 0 R 6607 0 R 6657 0 R 6706 0 R] >> endobj -7243 0 obj << +7578 0 obj << /Type /Pages /Count 36 -/Parent 7247 0 R -/Kids [6575 0 R 6615 0 R 6654 0 R 6698 0 R 6745 0 R 6790 0 R] +/Parent 7582 0 R +/Kids [6777 0 R 6816 0 R 6847 0 R 6887 0 R 6920 0 R 6963 0 R] >> endobj -7244 0 obj << +7579 0 obj << /Type /Pages /Count 36 -/Parent 7247 0 R -/Kids [6837 0 R 6879 0 R 6920 0 R 6976 0 R 7033 0 R 7070 0 R] +/Parent 7582 0 R +/Kids [7002 0 R 7051 0 R 7094 0 R 7143 0 R 7182 0 R 7227 0 R] >> endobj -7245 0 obj << +7580 0 obj << /Type /Pages -/Count 10 -/Parent 7248 0 R -/Kids [7118 0 R 7163 0 R] +/Count 30 +/Parent 7583 0 R +/Kids [7289 0 R 7333 0 R 7389 0 R 7432 0 R 7482 0 R] >> endobj -7246 0 obj << +7581 0 obj << /Type /Pages /Count 216 -/Parent 7249 0 R -/Kids [7233 0 R 7234 0 R 7235 0 R 7236 0 R 7237 0 R 7238 0 R] +/Parent 7584 0 R +/Kids [7568 0 R 7569 0 R 7570 0 R 7571 0 R 7572 0 R 7573 0 R] >> endobj -7247 0 obj << +7582 0 obj << /Type /Pages /Count 216 -/Parent 7249 0 R -/Kids [7239 0 R 7240 0 R 7241 0 R 7242 0 R 7243 0 R 7244 0 R] +/Parent 7584 0 R +/Kids [7574 0 R 7575 0 R 7576 0 R 7577 0 R 7578 0 R 7579 0 R] >> endobj -7248 0 obj << +7583 0 obj << /Type /Pages -/Count 10 -/Parent 7249 0 R -/Kids [7245 0 R] +/Count 30 +/Parent 7584 0 R +/Kids [7580 0 R] >> endobj -7249 0 obj << +7584 0 obj << /Type /Pages -/Count 442 -/Kids [7246 0 R 7247 0 R 7248 0 R] +/Count 462 +/Kids [7581 0 R 7582 0 R 7583 0 R] >> endobj -7250 0 obj << +7585 0 obj << /Type /Outlines /First 7 0 R -/Last 2715 0 R +/Last 2771 0 R /Count 6 >> endobj +3011 0 obj << +/Title 3012 0 R +/A 3009 0 R +/Parent 3003 0 R +/Prev 3007 0 R +>> endobj +3007 0 obj << +/Title 3008 0 R +/A 3005 0 R +/Parent 3003 0 R +/Next 3011 0 R +>> endobj +3003 0 obj << +/Title 3004 0 R +/A 3001 0 R +/Parent 2771 0 R +/Prev 2995 0 R +/First 3007 0 R +/Last 3011 0 R +/Count -2 +>> endobj +2999 0 obj << +/Title 3000 0 R +/A 2997 0 R +/Parent 2995 0 R +>> endobj +2995 0 obj << +/Title 2996 0 R +/A 2993 0 R +/Parent 2771 0 R +/Prev 2947 0 R +/Next 3003 0 R +/First 2999 0 R +/Last 2999 0 R +/Count -1 +>> endobj +2991 0 obj << +/Title 2992 0 R +/A 2989 0 R +/Parent 2947 0 R +/Prev 2987 0 R +>> endobj +2987 0 obj << +/Title 2988 0 R +/A 2985 0 R +/Parent 2947 0 R +/Prev 2983 0 R +/Next 2991 0 R +>> endobj +2983 0 obj << +/Title 2984 0 R +/A 2981 0 R +/Parent 2947 0 R +/Prev 2979 0 R +/Next 2987 0 R +>> endobj +2979 0 obj << +/Title 2980 0 R +/A 2977 0 R +/Parent 2947 0 R +/Prev 2975 0 R +/Next 2983 0 R +>> endobj +2975 0 obj << +/Title 2976 0 R +/A 2973 0 R +/Parent 2947 0 R +/Prev 2971 0 R +/Next 2979 0 R +>> endobj +2971 0 obj << +/Title 2972 0 R +/A 2969 0 R +/Parent 2947 0 R +/Prev 2967 0 R +/Next 2975 0 R +>> endobj +2967 0 obj << +/Title 2968 0 R +/A 2965 0 R +/Parent 2947 0 R +/Prev 2963 0 R +/Next 2971 0 R +>> endobj +2963 0 obj << +/Title 2964 0 R +/A 2961 0 R +/Parent 2947 0 R +/Prev 2959 0 R +/Next 2967 0 R +>> endobj +2959 0 obj << +/Title 2960 0 R +/A 2957 0 R +/Parent 2947 0 R +/Prev 2955 0 R +/Next 2963 0 R +>> endobj +2955 0 obj << +/Title 2956 0 R +/A 2953 0 R +/Parent 2947 0 R +/Prev 2951 0 R +/Next 2959 0 R +>> endobj 2951 0 obj << /Title 2952 0 R /A 2949 0 R -/Parent 2943 0 R -/Prev 2947 0 R +/Parent 2947 0 R +/Next 2955 0 R >> endobj 2947 0 obj << /Title 2948 0 R /A 2945 0 R -/Parent 2943 0 R -/Next 2951 0 R +/Parent 2771 0 R +/Prev 2879 0 R +/Next 2995 0 R +/First 2951 0 R +/Last 2991 0 R +/Count -11 >> endobj 2943 0 obj << /Title 2944 0 R /A 2941 0 R -/Parent 2715 0 R -/Prev 2935 0 R -/First 2947 0 R -/Last 2951 0 R -/Count -2 +/Parent 2879 0 R +/Prev 2939 0 R >> endobj 2939 0 obj << /Title 2940 0 R /A 2937 0 R -/Parent 2935 0 R +/Parent 2879 0 R +/Prev 2931 0 R +/Next 2943 0 R >> endobj 2935 0 obj << /Title 2936 0 R /A 2933 0 R -/Parent 2715 0 R -/Prev 2887 0 R -/Next 2943 0 R -/First 2939 0 R -/Last 2939 0 R -/Count -1 +/Parent 2931 0 R >> endobj 2931 0 obj << /Title 2932 0 R /A 2929 0 R -/Parent 2887 0 R -/Prev 2927 0 R +/Parent 2879 0 R +/Prev 2903 0 R +/Next 2939 0 R +/First 2935 0 R +/Last 2935 0 R +/Count -1 >> endobj 2927 0 obj << /Title 2928 0 R /A 2925 0 R -/Parent 2887 0 R +/Parent 2903 0 R /Prev 2923 0 R -/Next 2931 0 R >> endobj 2923 0 obj << /Title 2924 0 R /A 2921 0 R -/Parent 2887 0 R +/Parent 2903 0 R /Prev 2919 0 R /Next 2927 0 R >> endobj 2919 0 obj << /Title 2920 0 R /A 2917 0 R -/Parent 2887 0 R +/Parent 2903 0 R /Prev 2915 0 R /Next 2923 0 R >> endobj 2915 0 obj << /Title 2916 0 R /A 2913 0 R -/Parent 2887 0 R +/Parent 2903 0 R /Prev 2911 0 R /Next 2919 0 R >> endobj 2911 0 obj << /Title 2912 0 R /A 2909 0 R -/Parent 2887 0 R +/Parent 2903 0 R /Prev 2907 0 R /Next 2915 0 R >> endobj 2907 0 obj << /Title 2908 0 R /A 2905 0 R -/Parent 2887 0 R -/Prev 2903 0 R +/Parent 2903 0 R /Next 2911 0 R >> endobj 2903 0 obj << /Title 2904 0 R /A 2901 0 R -/Parent 2887 0 R -/Prev 2899 0 R -/Next 2907 0 R +/Parent 2879 0 R +/Prev 2887 0 R +/Next 2931 0 R +/First 2907 0 R +/Last 2927 0 R +/Count -6 >> endobj 2899 0 obj << /Title 2900 0 R /A 2897 0 R /Parent 2887 0 R /Prev 2895 0 R -/Next 2903 0 R >> endobj 2895 0 obj << /Title 2896 0 R @@ -35899,103 +38229,107 @@ endobj 2887 0 obj << /Title 2888 0 R /A 2885 0 R -/Parent 2715 0 R -/Prev 2819 0 R -/Next 2935 0 R +/Parent 2879 0 R +/Prev 2883 0 R +/Next 2903 0 R /First 2891 0 R -/Last 2931 0 R -/Count -11 +/Last 2899 0 R +/Count -3 >> endobj 2883 0 obj << /Title 2884 0 R /A 2881 0 R -/Parent 2819 0 R -/Prev 2879 0 R +/Parent 2879 0 R +/Next 2887 0 R >> endobj 2879 0 obj << /Title 2880 0 R /A 2877 0 R -/Parent 2819 0 R -/Prev 2871 0 R -/Next 2883 0 R +/Parent 2771 0 R +/Prev 2839 0 R +/Next 2947 0 R +/First 2883 0 R +/Last 2943 0 R +/Count -6 >> endobj 2875 0 obj << /Title 2876 0 R /A 2873 0 R -/Parent 2871 0 R +/Parent 2867 0 R +/Prev 2871 0 R >> endobj 2871 0 obj << /Title 2872 0 R /A 2869 0 R -/Parent 2819 0 R -/Prev 2843 0 R -/Next 2879 0 R -/First 2875 0 R -/Last 2875 0 R -/Count -1 +/Parent 2867 0 R +/Next 2875 0 R >> endobj 2867 0 obj << /Title 2868 0 R /A 2865 0 R -/Parent 2843 0 R -/Prev 2863 0 R +/Parent 2839 0 R +/Prev 2859 0 R +/First 2871 0 R +/Last 2875 0 R +/Count -2 >> endobj 2863 0 obj << /Title 2864 0 R /A 2861 0 R -/Parent 2843 0 R -/Prev 2859 0 R -/Next 2867 0 R +/Parent 2859 0 R >> endobj 2859 0 obj << /Title 2860 0 R /A 2857 0 R -/Parent 2843 0 R +/Parent 2839 0 R /Prev 2855 0 R -/Next 2863 0 R +/Next 2867 0 R +/First 2863 0 R +/Last 2863 0 R +/Count -1 >> endobj 2855 0 obj << /Title 2856 0 R /A 2853 0 R -/Parent 2843 0 R +/Parent 2839 0 R /Prev 2851 0 R /Next 2859 0 R >> endobj 2851 0 obj << /Title 2852 0 R /A 2849 0 R -/Parent 2843 0 R +/Parent 2839 0 R /Prev 2847 0 R /Next 2855 0 R >> endobj 2847 0 obj << /Title 2848 0 R /A 2845 0 R -/Parent 2843 0 R +/Parent 2839 0 R +/Prev 2843 0 R /Next 2851 0 R >> endobj 2843 0 obj << /Title 2844 0 R /A 2841 0 R -/Parent 2819 0 R -/Prev 2827 0 R -/Next 2871 0 R -/First 2847 0 R -/Last 2867 0 R -/Count -6 +/Parent 2839 0 R +/Next 2847 0 R >> endobj 2839 0 obj << /Title 2840 0 R /A 2837 0 R -/Parent 2827 0 R -/Prev 2835 0 R +/Parent 2771 0 R +/Prev 2775 0 R +/Next 2879 0 R +/First 2843 0 R +/Last 2867 0 R +/Count -6 >> endobj 2835 0 obj << /Title 2836 0 R /A 2833 0 R /Parent 2827 0 R /Prev 2831 0 R -/Next 2839 0 R >> endobj 2831 0 obj << /Title 2832 0 R @@ -36006,77 +38340,73 @@ endobj 2827 0 obj << /Title 2828 0 R /A 2825 0 R -/Parent 2819 0 R -/Prev 2823 0 R -/Next 2843 0 R +/Parent 2775 0 R +/Prev 2807 0 R /First 2831 0 R -/Last 2839 0 R -/Count -3 +/Last 2835 0 R +/Count -2 >> endobj 2823 0 obj << /Title 2824 0 R /A 2821 0 R -/Parent 2819 0 R -/Next 2827 0 R +/Parent 2811 0 R +/Prev 2819 0 R >> endobj 2819 0 obj << /Title 2820 0 R /A 2817 0 R -/Parent 2715 0 R -/Prev 2779 0 R -/Next 2887 0 R -/First 2823 0 R -/Last 2883 0 R -/Count -6 +/Parent 2811 0 R +/Prev 2815 0 R +/Next 2823 0 R >> endobj 2815 0 obj << /Title 2816 0 R /A 2813 0 R -/Parent 2807 0 R -/Prev 2811 0 R +/Parent 2811 0 R +/Next 2819 0 R >> endobj 2811 0 obj << /Title 2812 0 R /A 2809 0 R /Parent 2807 0 R -/Next 2815 0 R +/First 2815 0 R +/Last 2823 0 R +/Count -3 >> endobj 2807 0 obj << /Title 2808 0 R /A 2805 0 R -/Parent 2779 0 R -/Prev 2799 0 R +/Parent 2775 0 R +/Prev 2803 0 R +/Next 2827 0 R /First 2811 0 R -/Last 2815 0 R -/Count -2 +/Last 2811 0 R +/Count -1 >> endobj 2803 0 obj << /Title 2804 0 R /A 2801 0 R -/Parent 2799 0 R +/Parent 2775 0 R +/Prev 2799 0 R +/Next 2807 0 R >> endobj 2799 0 obj << /Title 2800 0 R /A 2797 0 R -/Parent 2779 0 R -/Prev 2795 0 R -/Next 2807 0 R -/First 2803 0 R -/Last 2803 0 R -/Count -1 +/Parent 2775 0 R +/Prev 2779 0 R +/Next 2803 0 R >> endobj 2795 0 obj << /Title 2796 0 R /A 2793 0 R -/Parent 2779 0 R +/Parent 2787 0 R /Prev 2791 0 R -/Next 2799 0 R >> endobj 2791 0 obj << /Title 2792 0 R /A 2789 0 R -/Parent 2779 0 R -/Prev 2787 0 R +/Parent 2787 0 R /Next 2795 0 R >> endobj 2787 0 obj << @@ -36084,7 +38414,9 @@ endobj /A 2785 0 R /Parent 2779 0 R /Prev 2783 0 R -/Next 2791 0 R +/First 2791 0 R +/Last 2795 0 R +/Count -2 >> endobj 2783 0 obj << /Title 2784 0 R @@ -36095,555 +38427,558 @@ endobj 2779 0 obj << /Title 2780 0 R /A 2777 0 R -/Parent 2715 0 R -/Prev 2719 0 R -/Next 2819 0 R +/Parent 2775 0 R +/Next 2799 0 R /First 2783 0 R -/Last 2807 0 R -/Count -6 +/Last 2787 0 R +/Count -2 >> endobj 2775 0 obj << /Title 2776 0 R /A 2773 0 R -/Parent 2767 0 R -/Prev 2771 0 R +/Parent 2771 0 R +/Next 2839 0 R +/First 2779 0 R +/Last 2827 0 R +/Count -5 >> endobj 2771 0 obj << /Title 2772 0 R /A 2769 0 R -/Parent 2767 0 R -/Next 2775 0 R +/Parent 7585 0 R +/Prev 2679 0 R +/First 2775 0 R +/Last 3003 0 R +/Count -6 >> endobj 2767 0 obj << /Title 2768 0 R /A 2765 0 R -/Parent 2719 0 R -/Prev 2751 0 R -/First 2771 0 R -/Last 2775 0 R -/Count -2 +/Parent 2743 0 R +/Prev 2763 0 R >> endobj 2763 0 obj << /Title 2764 0 R /A 2761 0 R -/Parent 2755 0 R +/Parent 2743 0 R /Prev 2759 0 R +/Next 2767 0 R >> endobj 2759 0 obj << /Title 2760 0 R /A 2757 0 R -/Parent 2755 0 R +/Parent 2743 0 R +/Prev 2755 0 R /Next 2763 0 R >> endobj 2755 0 obj << /Title 2756 0 R /A 2753 0 R -/Parent 2751 0 R -/First 2759 0 R -/Last 2763 0 R -/Count -2 +/Parent 2743 0 R +/Prev 2751 0 R +/Next 2759 0 R >> endobj 2751 0 obj << /Title 2752 0 R /A 2749 0 R -/Parent 2719 0 R +/Parent 2743 0 R /Prev 2747 0 R -/Next 2767 0 R -/First 2755 0 R -/Last 2755 0 R -/Count -1 +/Next 2755 0 R >> endobj 2747 0 obj << /Title 2748 0 R /A 2745 0 R -/Parent 2719 0 R -/Prev 2743 0 R +/Parent 2743 0 R /Next 2751 0 R >> endobj 2743 0 obj << /Title 2744 0 R /A 2741 0 R -/Parent 2719 0 R -/Prev 2723 0 R -/Next 2747 0 R +/Parent 2679 0 R +/Prev 2699 0 R +/First 2747 0 R +/Last 2767 0 R +/Count -6 >> endobj 2739 0 obj << /Title 2740 0 R /A 2737 0 R -/Parent 2731 0 R +/Parent 2699 0 R /Prev 2735 0 R >> endobj 2735 0 obj << /Title 2736 0 R /A 2733 0 R -/Parent 2731 0 R +/Parent 2699 0 R +/Prev 2731 0 R /Next 2739 0 R >> endobj 2731 0 obj << /Title 2732 0 R /A 2729 0 R -/Parent 2723 0 R -/Prev 2727 0 R -/First 2735 0 R -/Last 2739 0 R -/Count -2 +/Parent 2699 0 R +/Prev 2703 0 R +/Next 2735 0 R >> endobj 2727 0 obj << /Title 2728 0 R /A 2725 0 R -/Parent 2723 0 R -/Next 2731 0 R +/Parent 2719 0 R +/Prev 2723 0 R >> endobj 2723 0 obj << /Title 2724 0 R /A 2721 0 R /Parent 2719 0 R -/Next 2743 0 R -/First 2727 0 R -/Last 2731 0 R -/Count -2 +/Next 2727 0 R >> endobj 2719 0 obj << /Title 2720 0 R /A 2717 0 R -/Parent 2715 0 R -/Next 2779 0 R +/Parent 2703 0 R +/Prev 2715 0 R /First 2723 0 R -/Last 2767 0 R -/Count -5 +/Last 2727 0 R +/Count -2 >> endobj 2715 0 obj << /Title 2716 0 R /A 2713 0 R -/Parent 7250 0 R -/Prev 2623 0 R -/First 2719 0 R -/Last 2943 0 R -/Count -6 +/Parent 2703 0 R +/Prev 2711 0 R +/Next 2719 0 R >> endobj 2711 0 obj << /Title 2712 0 R /A 2709 0 R -/Parent 2687 0 R +/Parent 2703 0 R /Prev 2707 0 R +/Next 2715 0 R >> endobj 2707 0 obj << /Title 2708 0 R /A 2705 0 R -/Parent 2687 0 R -/Prev 2703 0 R +/Parent 2703 0 R /Next 2711 0 R >> endobj 2703 0 obj << /Title 2704 0 R /A 2701 0 R -/Parent 2687 0 R -/Prev 2699 0 R -/Next 2707 0 R +/Parent 2699 0 R +/Next 2731 0 R +/First 2707 0 R +/Last 2719 0 R +/Count -4 >> endobj 2699 0 obj << /Title 2700 0 R /A 2697 0 R -/Parent 2687 0 R -/Prev 2695 0 R -/Next 2703 0 R +/Parent 2679 0 R +/Prev 2683 0 R +/Next 2743 0 R +/First 2703 0 R +/Last 2739 0 R +/Count -4 >> endobj 2695 0 obj << /Title 2696 0 R /A 2693 0 R -/Parent 2687 0 R +/Parent 2683 0 R /Prev 2691 0 R -/Next 2699 0 R >> endobj 2691 0 obj << /Title 2692 0 R /A 2689 0 R -/Parent 2687 0 R +/Parent 2683 0 R +/Prev 2687 0 R /Next 2695 0 R >> endobj 2687 0 obj << /Title 2688 0 R /A 2685 0 R -/Parent 2623 0 R -/Prev 2643 0 R -/First 2691 0 R -/Last 2711 0 R -/Count -6 +/Parent 2683 0 R +/Next 2691 0 R >> endobj 2683 0 obj << /Title 2684 0 R /A 2681 0 R -/Parent 2643 0 R -/Prev 2679 0 R +/Parent 2679 0 R +/Next 2699 0 R +/First 2687 0 R +/Last 2695 0 R +/Count -3 >> endobj 2679 0 obj << /Title 2680 0 R /A 2677 0 R -/Parent 2643 0 R -/Prev 2675 0 R -/Next 2683 0 R +/Parent 7585 0 R +/Prev 2491 0 R +/Next 2771 0 R +/First 2683 0 R +/Last 2743 0 R +/Count -3 >> endobj 2675 0 obj << /Title 2676 0 R /A 2673 0 R /Parent 2643 0 R -/Prev 2647 0 R -/Next 2679 0 R +/Prev 2671 0 R >> endobj 2671 0 obj << /Title 2672 0 R /A 2669 0 R -/Parent 2663 0 R +/Parent 2643 0 R /Prev 2667 0 R +/Next 2675 0 R >> endobj 2667 0 obj << /Title 2668 0 R /A 2665 0 R -/Parent 2663 0 R +/Parent 2643 0 R +/Prev 2663 0 R /Next 2671 0 R >> endobj 2663 0 obj << /Title 2664 0 R /A 2661 0 R -/Parent 2647 0 R +/Parent 2643 0 R /Prev 2659 0 R -/First 2667 0 R -/Last 2671 0 R -/Count -2 +/Next 2667 0 R >> endobj 2659 0 obj << /Title 2660 0 R /A 2657 0 R -/Parent 2647 0 R +/Parent 2643 0 R /Prev 2655 0 R /Next 2663 0 R >> endobj 2655 0 obj << /Title 2656 0 R /A 2653 0 R -/Parent 2647 0 R +/Parent 2643 0 R /Prev 2651 0 R /Next 2659 0 R >> endobj 2651 0 obj << /Title 2652 0 R /A 2649 0 R -/Parent 2647 0 R +/Parent 2643 0 R +/Prev 2647 0 R /Next 2655 0 R >> endobj 2647 0 obj << /Title 2648 0 R /A 2645 0 R /Parent 2643 0 R -/Next 2675 0 R -/First 2651 0 R -/Last 2663 0 R -/Count -4 +/Next 2651 0 R >> endobj 2643 0 obj << /Title 2644 0 R /A 2641 0 R -/Parent 2623 0 R -/Prev 2627 0 R -/Next 2687 0 R +/Parent 2607 0 R +/Prev 2615 0 R /First 2647 0 R -/Last 2683 0 R -/Count -4 +/Last 2675 0 R +/Count -8 >> endobj 2639 0 obj << /Title 2640 0 R /A 2637 0 R -/Parent 2627 0 R +/Parent 2615 0 R /Prev 2635 0 R >> endobj 2635 0 obj << /Title 2636 0 R /A 2633 0 R -/Parent 2627 0 R +/Parent 2615 0 R /Prev 2631 0 R /Next 2639 0 R >> endobj 2631 0 obj << /Title 2632 0 R /A 2629 0 R -/Parent 2627 0 R +/Parent 2615 0 R +/Prev 2619 0 R /Next 2635 0 R >> endobj 2627 0 obj << /Title 2628 0 R /A 2625 0 R -/Parent 2623 0 R -/Next 2643 0 R -/First 2631 0 R -/Last 2639 0 R -/Count -3 +/Parent 2619 0 R +/Prev 2623 0 R >> endobj 2623 0 obj << /Title 2624 0 R /A 2621 0 R -/Parent 7250 0 R -/Prev 2459 0 R -/Next 2715 0 R -/First 2627 0 R -/Last 2687 0 R -/Count -3 +/Parent 2619 0 R +/Next 2627 0 R >> endobj 2619 0 obj << /Title 2620 0 R /A 2617 0 R -/Parent 2579 0 R -/Prev 2615 0 R +/Parent 2615 0 R +/Next 2631 0 R +/First 2623 0 R +/Last 2627 0 R +/Count -2 >> endobj 2615 0 obj << /Title 2616 0 R /A 2613 0 R -/Parent 2579 0 R +/Parent 2607 0 R /Prev 2611 0 R -/Next 2619 0 R +/Next 2643 0 R +/First 2619 0 R +/Last 2639 0 R +/Count -4 >> endobj 2611 0 obj << /Title 2612 0 R /A 2609 0 R -/Parent 2579 0 R -/Prev 2607 0 R +/Parent 2607 0 R /Next 2615 0 R >> endobj 2607 0 obj << /Title 2608 0 R /A 2605 0 R -/Parent 2579 0 R -/Prev 2603 0 R -/Next 2611 0 R +/Parent 2491 0 R +/Prev 2559 0 R +/First 2611 0 R +/Last 2643 0 R +/Count -3 >> endobj 2603 0 obj << /Title 2604 0 R /A 2601 0 R -/Parent 2579 0 R +/Parent 2595 0 R /Prev 2599 0 R -/Next 2607 0 R >> endobj 2599 0 obj << /Title 2600 0 R /A 2597 0 R -/Parent 2579 0 R -/Prev 2595 0 R +/Parent 2595 0 R /Next 2603 0 R >> endobj 2595 0 obj << /Title 2596 0 R /A 2593 0 R -/Parent 2579 0 R -/Prev 2591 0 R -/Next 2599 0 R +/Parent 2559 0 R +/Prev 2563 0 R +/First 2599 0 R +/Last 2603 0 R +/Count -2 >> endobj 2591 0 obj << /Title 2592 0 R /A 2589 0 R -/Parent 2579 0 R -/Prev 2587 0 R -/Next 2595 0 R +/Parent 2563 0 R +/Prev 2567 0 R >> endobj 2587 0 obj << /Title 2588 0 R /A 2585 0 R -/Parent 2579 0 R +/Parent 2567 0 R /Prev 2583 0 R -/Next 2591 0 R >> endobj 2583 0 obj << /Title 2584 0 R /A 2581 0 R -/Parent 2579 0 R +/Parent 2567 0 R +/Prev 2579 0 R /Next 2587 0 R >> endobj 2579 0 obj << /Title 2580 0 R /A 2577 0 R -/Parent 2575 0 R -/First 2583 0 R -/Last 2619 0 R -/Count -10 +/Parent 2567 0 R +/Prev 2575 0 R +/Next 2583 0 R >> endobj 2575 0 obj << /Title 2576 0 R /A 2573 0 R -/Parent 2459 0 R -/Prev 2527 0 R -/First 2579 0 R -/Last 2579 0 R -/Count -1 +/Parent 2567 0 R +/Prev 2571 0 R +/Next 2579 0 R >> endobj 2571 0 obj << /Title 2572 0 R /A 2569 0 R -/Parent 2563 0 R -/Prev 2567 0 R +/Parent 2567 0 R +/Next 2575 0 R >> endobj 2567 0 obj << /Title 2568 0 R /A 2565 0 R /Parent 2563 0 R -/Next 2571 0 R +/Next 2591 0 R +/First 2571 0 R +/Last 2587 0 R +/Count -5 >> endobj 2563 0 obj << /Title 2564 0 R /A 2561 0 R -/Parent 2527 0 R -/Prev 2531 0 R +/Parent 2559 0 R +/Next 2595 0 R /First 2567 0 R -/Last 2571 0 R +/Last 2591 0 R /Count -2 >> endobj 2559 0 obj << /Title 2560 0 R /A 2557 0 R -/Parent 2531 0 R -/Prev 2535 0 R +/Parent 2491 0 R +/Prev 2495 0 R +/Next 2607 0 R +/First 2563 0 R +/Last 2595 0 R +/Count -2 >> endobj 2555 0 obj << /Title 2556 0 R /A 2553 0 R -/Parent 2535 0 R +/Parent 2543 0 R /Prev 2551 0 R >> endobj 2551 0 obj << /Title 2552 0 R /A 2549 0 R -/Parent 2535 0 R +/Parent 2543 0 R /Prev 2547 0 R /Next 2555 0 R >> endobj 2547 0 obj << /Title 2548 0 R /A 2545 0 R -/Parent 2535 0 R -/Prev 2543 0 R +/Parent 2543 0 R /Next 2551 0 R >> endobj 2543 0 obj << /Title 2544 0 R /A 2541 0 R -/Parent 2535 0 R +/Parent 2523 0 R /Prev 2539 0 R -/Next 2547 0 R +/First 2547 0 R +/Last 2555 0 R +/Count -3 >> endobj 2539 0 obj << /Title 2540 0 R /A 2537 0 R -/Parent 2535 0 R +/Parent 2523 0 R +/Prev 2535 0 R /Next 2543 0 R >> endobj 2535 0 obj << /Title 2536 0 R /A 2533 0 R -/Parent 2531 0 R -/Next 2559 0 R -/First 2539 0 R -/Last 2555 0 R -/Count -5 +/Parent 2523 0 R +/Prev 2531 0 R +/Next 2539 0 R >> endobj 2531 0 obj << /Title 2532 0 R /A 2529 0 R -/Parent 2527 0 R -/Next 2563 0 R -/First 2535 0 R -/Last 2559 0 R -/Count -2 +/Parent 2523 0 R +/Prev 2527 0 R +/Next 2535 0 R >> endobj 2527 0 obj << /Title 2528 0 R /A 2525 0 R -/Parent 2459 0 R -/Prev 2463 0 R -/Next 2575 0 R -/First 2531 0 R -/Last 2563 0 R -/Count -2 +/Parent 2523 0 R +/Next 2531 0 R >> endobj 2523 0 obj << /Title 2524 0 R /A 2521 0 R -/Parent 2511 0 R -/Prev 2519 0 R +/Parent 2495 0 R +/Prev 2507 0 R +/First 2527 0 R +/Last 2543 0 R +/Count -5 >> endobj 2519 0 obj << /Title 2520 0 R /A 2517 0 R -/Parent 2511 0 R +/Parent 2507 0 R /Prev 2515 0 R -/Next 2523 0 R >> endobj 2515 0 obj << /Title 2516 0 R /A 2513 0 R -/Parent 2511 0 R +/Parent 2507 0 R +/Prev 2511 0 R /Next 2519 0 R >> endobj 2511 0 obj << /Title 2512 0 R /A 2509 0 R -/Parent 2487 0 R -/Prev 2507 0 R -/First 2515 0 R -/Last 2523 0 R -/Count -3 +/Parent 2507 0 R +/Next 2515 0 R >> endobj 2507 0 obj << /Title 2508 0 R /A 2505 0 R -/Parent 2487 0 R +/Parent 2495 0 R /Prev 2503 0 R -/Next 2511 0 R +/Next 2523 0 R +/First 2511 0 R +/Last 2519 0 R +/Count -3 >> endobj 2503 0 obj << /Title 2504 0 R /A 2501 0 R -/Parent 2487 0 R +/Parent 2495 0 R /Prev 2499 0 R /Next 2507 0 R >> endobj 2499 0 obj << /Title 2500 0 R /A 2497 0 R -/Parent 2487 0 R -/Prev 2495 0 R +/Parent 2495 0 R /Next 2503 0 R >> endobj 2495 0 obj << /Title 2496 0 R /A 2493 0 R -/Parent 2487 0 R -/Prev 2491 0 R -/Next 2499 0 R +/Parent 2491 0 R +/Next 2559 0 R +/First 2499 0 R +/Last 2523 0 R +/Count -4 >> endobj 2491 0 obj << /Title 2492 0 R /A 2489 0 R -/Parent 2487 0 R -/Next 2495 0 R +/Parent 7585 0 R +/Prev 487 0 R +/Next 2679 0 R +/First 2495 0 R +/Last 2607 0 R +/Count -3 >> endobj 2487 0 obj << /Title 2488 0 R /A 2485 0 R -/Parent 2463 0 R -/Prev 2471 0 R -/First 2491 0 R -/Last 2511 0 R -/Count -6 +/Parent 2483 0 R >> endobj 2483 0 obj << /Title 2484 0 R /A 2481 0 R -/Parent 2471 0 R -/Prev 2479 0 R +/Parent 487 0 R +/Prev 2471 0 R +/First 2487 0 R +/Last 2487 0 R +/Count -1 >> endobj 2479 0 obj << /Title 2480 0 R /A 2477 0 R /Parent 2471 0 R /Prev 2475 0 R -/Next 2483 0 R >> endobj 2475 0 obj << /Title 2476 0 R @@ -36654,57 +38989,54 @@ endobj 2471 0 obj << /Title 2472 0 R /A 2469 0 R -/Parent 2463 0 R -/Prev 2467 0 R -/Next 2487 0 R +/Parent 487 0 R +/Prev 2439 0 R +/Next 2483 0 R /First 2475 0 R -/Last 2483 0 R -/Count -3 +/Last 2479 0 R +/Count -2 >> endobj 2467 0 obj << /Title 2468 0 R /A 2465 0 R /Parent 2463 0 R -/Next 2471 0 R >> endobj 2463 0 obj << /Title 2464 0 R /A 2461 0 R -/Parent 2459 0 R -/Next 2527 0 R +/Parent 2439 0 R +/Prev 2459 0 R /First 2467 0 R -/Last 2487 0 R -/Count -3 +/Last 2467 0 R +/Count -1 >> endobj 2459 0 obj << /Title 2460 0 R /A 2457 0 R -/Parent 7250 0 R -/Prev 463 0 R -/Next 2623 0 R -/First 2463 0 R -/Last 2575 0 R -/Count -3 +/Parent 2439 0 R +/Prev 2455 0 R +/Next 2463 0 R >> endobj 2455 0 obj << /Title 2456 0 R /A 2453 0 R -/Parent 2451 0 R +/Parent 2439 0 R +/Prev 2451 0 R +/Next 2459 0 R >> endobj 2451 0 obj << /Title 2452 0 R /A 2449 0 R -/Parent 463 0 R -/Prev 2439 0 R -/First 2455 0 R -/Last 2455 0 R -/Count -1 +/Parent 2439 0 R +/Prev 2447 0 R +/Next 2455 0 R >> endobj 2447 0 obj << /Title 2448 0 R /A 2445 0 R /Parent 2439 0 R /Prev 2443 0 R +/Next 2451 0 R >> endobj 2443 0 obj << /Title 2444 0 R @@ -36715,110 +39047,108 @@ endobj 2439 0 obj << /Title 2440 0 R /A 2437 0 R -/Parent 463 0 R -/Prev 2407 0 R -/Next 2451 0 R +/Parent 487 0 R +/Prev 2367 0 R +/Next 2471 0 R /First 2443 0 R -/Last 2447 0 R -/Count -2 +/Last 2463 0 R +/Count -6 >> endobj 2435 0 obj << /Title 2436 0 R /A 2433 0 R -/Parent 2431 0 R +/Parent 2423 0 R +/Prev 2431 0 R >> endobj 2431 0 obj << /Title 2432 0 R /A 2429 0 R -/Parent 2407 0 R +/Parent 2423 0 R /Prev 2427 0 R -/First 2435 0 R -/Last 2435 0 R -/Count -1 +/Next 2435 0 R >> endobj 2427 0 obj << /Title 2428 0 R /A 2425 0 R -/Parent 2407 0 R -/Prev 2423 0 R +/Parent 2423 0 R /Next 2431 0 R >> endobj 2423 0 obj << /Title 2424 0 R /A 2421 0 R -/Parent 2407 0 R -/Prev 2419 0 R -/Next 2427 0 R +/Parent 2367 0 R +/Prev 2399 0 R +/First 2427 0 R +/Last 2435 0 R +/Count -3 >> endobj 2419 0 obj << /Title 2420 0 R /A 2417 0 R -/Parent 2407 0 R +/Parent 2399 0 R /Prev 2415 0 R -/Next 2423 0 R >> endobj 2415 0 obj << /Title 2416 0 R /A 2413 0 R -/Parent 2407 0 R +/Parent 2399 0 R /Prev 2411 0 R /Next 2419 0 R >> endobj 2411 0 obj << /Title 2412 0 R /A 2409 0 R -/Parent 2407 0 R +/Parent 2399 0 R +/Prev 2407 0 R /Next 2415 0 R >> endobj 2407 0 obj << /Title 2408 0 R /A 2405 0 R -/Parent 463 0 R -/Prev 2335 0 R -/Next 2439 0 R -/First 2411 0 R -/Last 2431 0 R -/Count -6 +/Parent 2399 0 R +/Prev 2403 0 R +/Next 2411 0 R >> endobj 2403 0 obj << /Title 2404 0 R /A 2401 0 R -/Parent 2391 0 R -/Prev 2399 0 R +/Parent 2399 0 R +/Next 2407 0 R >> endobj 2399 0 obj << /Title 2400 0 R /A 2397 0 R -/Parent 2391 0 R -/Prev 2395 0 R -/Next 2403 0 R +/Parent 2367 0 R +/Prev 2379 0 R +/Next 2423 0 R +/First 2403 0 R +/Last 2419 0 R +/Count -5 >> endobj 2395 0 obj << /Title 2396 0 R /A 2393 0 R -/Parent 2391 0 R -/Next 2399 0 R +/Parent 2379 0 R +/Prev 2391 0 R >> endobj 2391 0 obj << /Title 2392 0 R /A 2389 0 R -/Parent 2335 0 R -/Prev 2367 0 R -/First 2395 0 R -/Last 2403 0 R -/Count -3 +/Parent 2379 0 R +/Prev 2387 0 R +/Next 2395 0 R >> endobj 2387 0 obj << /Title 2388 0 R /A 2385 0 R -/Parent 2367 0 R +/Parent 2379 0 R /Prev 2383 0 R +/Next 2391 0 R >> endobj 2383 0 obj << /Title 2384 0 R /A 2381 0 R -/Parent 2367 0 R -/Prev 2379 0 R +/Parent 2379 0 R /Next 2387 0 R >> endobj 2379 0 obj << @@ -36826,7 +39156,10 @@ endobj /A 2377 0 R /Parent 2367 0 R /Prev 2375 0 R -/Next 2383 0 R +/Next 2399 0 R +/First 2383 0 R +/Last 2395 0 R +/Count -4 >> endobj 2375 0 obj << /Title 2376 0 R @@ -36844,48 +39177,46 @@ endobj 2367 0 obj << /Title 2368 0 R /A 2365 0 R -/Parent 2335 0 R -/Prev 2347 0 R -/Next 2391 0 R +/Parent 487 0 R +/Prev 2295 0 R +/Next 2439 0 R /First 2371 0 R -/Last 2387 0 R +/Last 2423 0 R /Count -5 >> endobj 2363 0 obj << /Title 2364 0 R /A 2361 0 R -/Parent 2347 0 R +/Parent 2355 0 R /Prev 2359 0 R >> endobj 2359 0 obj << /Title 2360 0 R /A 2357 0 R -/Parent 2347 0 R -/Prev 2355 0 R +/Parent 2355 0 R /Next 2363 0 R >> endobj 2355 0 obj << /Title 2356 0 R /A 2353 0 R -/Parent 2347 0 R -/Prev 2351 0 R -/Next 2359 0 R +/Parent 2295 0 R +/Prev 2303 0 R +/First 2359 0 R +/Last 2363 0 R +/Count -2 >> endobj 2351 0 obj << /Title 2352 0 R /A 2349 0 R -/Parent 2347 0 R -/Next 2355 0 R +/Parent 2335 0 R +/Prev 2347 0 R >> endobj 2347 0 obj << /Title 2348 0 R /A 2345 0 R /Parent 2335 0 R /Prev 2343 0 R -/Next 2367 0 R -/First 2351 0 R -/Last 2363 0 R -/Count -4 +/Next 2351 0 R >> endobj 2343 0 obj << /Title 2344 0 R @@ -36903,278 +39234,282 @@ endobj 2335 0 obj << /Title 2336 0 R /A 2333 0 R -/Parent 463 0 R -/Prev 2263 0 R -/Next 2407 0 R +/Parent 2303 0 R +/Prev 2331 0 R /First 2339 0 R -/Last 2391 0 R -/Count -5 +/Last 2351 0 R +/Count -4 >> endobj 2331 0 obj << /Title 2332 0 R /A 2329 0 R -/Parent 2323 0 R +/Parent 2303 0 R /Prev 2327 0 R +/Next 2335 0 R >> endobj 2327 0 obj << /Title 2328 0 R /A 2325 0 R -/Parent 2323 0 R +/Parent 2303 0 R +/Prev 2315 0 R /Next 2331 0 R >> endobj 2323 0 obj << /Title 2324 0 R /A 2321 0 R -/Parent 2263 0 R -/Prev 2271 0 R -/First 2327 0 R -/Last 2331 0 R -/Count -2 +/Parent 2315 0 R +/Prev 2319 0 R >> endobj 2319 0 obj << /Title 2320 0 R /A 2317 0 R -/Parent 2303 0 R -/Prev 2315 0 R +/Parent 2315 0 R +/Next 2323 0 R >> endobj 2315 0 obj << /Title 2316 0 R /A 2313 0 R /Parent 2303 0 R -/Prev 2311 0 R -/Next 2319 0 R +/Prev 2307 0 R +/Next 2327 0 R +/First 2319 0 R +/Last 2323 0 R +/Count -2 >> endobj 2311 0 obj << /Title 2312 0 R /A 2309 0 R -/Parent 2303 0 R -/Prev 2307 0 R -/Next 2315 0 R +/Parent 2307 0 R >> endobj 2307 0 obj << /Title 2308 0 R /A 2305 0 R /Parent 2303 0 R -/Next 2311 0 R +/Next 2315 0 R +/First 2311 0 R +/Last 2311 0 R +/Count -1 >> endobj 2303 0 obj << /Title 2304 0 R /A 2301 0 R -/Parent 2271 0 R +/Parent 2295 0 R /Prev 2299 0 R +/Next 2355 0 R /First 2307 0 R -/Last 2319 0 R -/Count -4 +/Last 2335 0 R +/Count -5 >> endobj 2299 0 obj << /Title 2300 0 R /A 2297 0 R -/Parent 2271 0 R -/Prev 2295 0 R +/Parent 2295 0 R /Next 2303 0 R >> endobj 2295 0 obj << /Title 2296 0 R /A 2293 0 R -/Parent 2271 0 R -/Prev 2283 0 R -/Next 2299 0 R +/Parent 487 0 R +/Prev 2179 0 R +/Next 2367 0 R +/First 2299 0 R +/Last 2355 0 R +/Count -3 >> endobj 2291 0 obj << /Title 2292 0 R /A 2289 0 R -/Parent 2283 0 R +/Parent 2279 0 R /Prev 2287 0 R >> endobj 2287 0 obj << /Title 2288 0 R /A 2285 0 R -/Parent 2283 0 R +/Parent 2279 0 R +/Prev 2283 0 R /Next 2291 0 R >> endobj 2283 0 obj << /Title 2284 0 R /A 2281 0 R -/Parent 2271 0 R -/Prev 2275 0 R -/Next 2295 0 R -/First 2287 0 R -/Last 2291 0 R -/Count -2 +/Parent 2279 0 R +/Next 2287 0 R >> endobj 2279 0 obj << /Title 2280 0 R /A 2277 0 R -/Parent 2275 0 R +/Parent 2179 0 R +/Prev 2259 0 R +/First 2283 0 R +/Last 2291 0 R +/Count -3 >> endobj 2275 0 obj << /Title 2276 0 R /A 2273 0 R -/Parent 2271 0 R -/Next 2283 0 R -/First 2279 0 R -/Last 2279 0 R -/Count -1 +/Parent 2259 0 R +/Prev 2271 0 R >> endobj 2271 0 obj << /Title 2272 0 R /A 2269 0 R -/Parent 2263 0 R -/Prev 2267 0 R -/Next 2323 0 R -/First 2275 0 R -/Last 2303 0 R -/Count -5 +/Parent 2259 0 R +/Prev 2263 0 R +/Next 2275 0 R >> endobj 2267 0 obj << /Title 2268 0 R /A 2265 0 R /Parent 2263 0 R -/Next 2271 0 R >> endobj 2263 0 obj << /Title 2264 0 R /A 2261 0 R -/Parent 463 0 R -/Prev 2147 0 R -/Next 2335 0 R +/Parent 2259 0 R +/Next 2271 0 R /First 2267 0 R -/Last 2323 0 R -/Count -3 +/Last 2267 0 R +/Count -1 >> endobj 2259 0 obj << /Title 2260 0 R /A 2257 0 R -/Parent 2247 0 R +/Parent 2179 0 R /Prev 2255 0 R +/Next 2279 0 R +/First 2263 0 R +/Last 2275 0 R +/Count -3 >> endobj 2255 0 obj << /Title 2256 0 R /A 2253 0 R -/Parent 2247 0 R +/Parent 2179 0 R /Prev 2251 0 R /Next 2259 0 R >> endobj 2251 0 obj << /Title 2252 0 R /A 2249 0 R -/Parent 2247 0 R +/Parent 2179 0 R +/Prev 2187 0 R /Next 2255 0 R >> endobj 2247 0 obj << /Title 2248 0 R /A 2245 0 R -/Parent 2147 0 R -/Prev 2227 0 R -/First 2251 0 R -/Last 2259 0 R -/Count -3 +/Parent 2231 0 R +/Prev 2243 0 R >> endobj 2243 0 obj << /Title 2244 0 R /A 2241 0 R -/Parent 2227 0 R +/Parent 2231 0 R /Prev 2239 0 R +/Next 2247 0 R >> endobj 2239 0 obj << /Title 2240 0 R /A 2237 0 R -/Parent 2227 0 R -/Prev 2231 0 R +/Parent 2231 0 R +/Prev 2235 0 R /Next 2243 0 R >> endobj 2235 0 obj << /Title 2236 0 R /A 2233 0 R /Parent 2231 0 R +/Next 2239 0 R >> endobj 2231 0 obj << /Title 2232 0 R /A 2229 0 R -/Parent 2227 0 R -/Next 2239 0 R +/Parent 2187 0 R +/Prev 2227 0 R /First 2235 0 R -/Last 2235 0 R -/Count -1 +/Last 2247 0 R +/Count -4 >> endobj 2227 0 obj << /Title 2228 0 R /A 2225 0 R -/Parent 2147 0 R -/Prev 2223 0 R -/Next 2247 0 R -/First 2231 0 R -/Last 2243 0 R -/Count -3 +/Parent 2187 0 R +/Prev 2211 0 R +/Next 2231 0 R >> endobj 2223 0 obj << /Title 2224 0 R /A 2221 0 R -/Parent 2147 0 R +/Parent 2211 0 R /Prev 2219 0 R -/Next 2227 0 R >> endobj 2219 0 obj << /Title 2220 0 R /A 2217 0 R -/Parent 2147 0 R -/Prev 2155 0 R +/Parent 2211 0 R +/Prev 2215 0 R /Next 2223 0 R >> endobj 2215 0 obj << /Title 2216 0 R /A 2213 0 R -/Parent 2199 0 R -/Prev 2211 0 R +/Parent 2211 0 R +/Next 2219 0 R >> endobj 2211 0 obj << /Title 2212 0 R /A 2209 0 R -/Parent 2199 0 R -/Prev 2207 0 R -/Next 2215 0 R +/Parent 2187 0 R +/Prev 2191 0 R +/Next 2227 0 R +/First 2215 0 R +/Last 2223 0 R +/Count -3 >> endobj 2207 0 obj << /Title 2208 0 R /A 2205 0 R -/Parent 2199 0 R +/Parent 2191 0 R /Prev 2203 0 R -/Next 2211 0 R >> endobj 2203 0 obj << /Title 2204 0 R /A 2201 0 R -/Parent 2199 0 R +/Parent 2191 0 R +/Prev 2199 0 R /Next 2207 0 R >> endobj 2199 0 obj << /Title 2200 0 R /A 2197 0 R -/Parent 2155 0 R +/Parent 2191 0 R /Prev 2195 0 R -/First 2203 0 R -/Last 2215 0 R -/Count -4 +/Next 2203 0 R >> endobj 2195 0 obj << /Title 2196 0 R /A 2193 0 R -/Parent 2155 0 R -/Prev 2179 0 R +/Parent 2191 0 R /Next 2199 0 R >> endobj 2191 0 obj << /Title 2192 0 R /A 2189 0 R -/Parent 2179 0 R -/Prev 2187 0 R +/Parent 2187 0 R +/Next 2211 0 R +/First 2195 0 R +/Last 2207 0 R +/Count -4 >> endobj 2187 0 obj << /Title 2188 0 R /A 2185 0 R /Parent 2179 0 R /Prev 2183 0 R -/Next 2191 0 R +/Next 2251 0 R +/First 2191 0 R +/Last 2231 0 R +/Count -4 >> endobj 2183 0 obj << /Title 2184 0 R @@ -37185,73 +39520,69 @@ endobj 2179 0 obj << /Title 2180 0 R /A 2177 0 R -/Parent 2155 0 R -/Prev 2159 0 R -/Next 2195 0 R +/Parent 487 0 R +/Prev 2115 0 R +/Next 2295 0 R /First 2183 0 R -/Last 2191 0 R -/Count -3 +/Last 2279 0 R +/Count -6 >> endobj 2175 0 obj << /Title 2176 0 R /A 2173 0 R -/Parent 2159 0 R -/Prev 2171 0 R +/Parent 2171 0 R >> endobj 2171 0 obj << /Title 2172 0 R /A 2169 0 R -/Parent 2159 0 R +/Parent 2115 0 R /Prev 2167 0 R -/Next 2175 0 R +/First 2175 0 R +/Last 2175 0 R +/Count -1 >> endobj 2167 0 obj << /Title 2168 0 R /A 2165 0 R -/Parent 2159 0 R -/Prev 2163 0 R +/Parent 2115 0 R +/Prev 2151 0 R /Next 2171 0 R >> endobj 2163 0 obj << /Title 2164 0 R /A 2161 0 R -/Parent 2159 0 R -/Next 2167 0 R +/Parent 2151 0 R +/Prev 2159 0 R >> endobj 2159 0 obj << /Title 2160 0 R /A 2157 0 R -/Parent 2155 0 R -/Next 2179 0 R -/First 2163 0 R -/Last 2175 0 R -/Count -4 +/Parent 2151 0 R +/Prev 2155 0 R +/Next 2163 0 R >> endobj 2155 0 obj << /Title 2156 0 R /A 2153 0 R -/Parent 2147 0 R -/Prev 2151 0 R -/Next 2219 0 R -/First 2159 0 R -/Last 2199 0 R -/Count -4 +/Parent 2151 0 R +/Next 2159 0 R >> endobj 2151 0 obj << /Title 2152 0 R /A 2149 0 R -/Parent 2147 0 R -/Next 2155 0 R +/Parent 2115 0 R +/Prev 2147 0 R +/Next 2167 0 R +/First 2155 0 R +/Last 2163 0 R +/Count -3 >> endobj 2147 0 obj << /Title 2148 0 R /A 2145 0 R -/Parent 463 0 R -/Prev 2087 0 R -/Next 2263 0 R -/First 2151 0 R -/Last 2247 0 R -/Count -6 +/Parent 2115 0 R +/Prev 2123 0 R +/Next 2151 0 R >> endobj 2143 0 obj << /Title 2144 0 R @@ -37261,8 +39592,8 @@ endobj 2139 0 obj << /Title 2140 0 R /A 2137 0 R -/Parent 2087 0 R -/Prev 2135 0 R +/Parent 2123 0 R +/Prev 2131 0 R /First 2143 0 R /Last 2143 0 R /Count -1 @@ -37270,83 +39601,85 @@ endobj 2135 0 obj << /Title 2136 0 R /A 2133 0 R -/Parent 2087 0 R -/Prev 2119 0 R -/Next 2139 0 R +/Parent 2131 0 R >> endobj 2131 0 obj << /Title 2132 0 R /A 2129 0 R -/Parent 2119 0 R +/Parent 2123 0 R /Prev 2127 0 R +/Next 2139 0 R +/First 2135 0 R +/Last 2135 0 R +/Count -1 >> endobj 2127 0 obj << /Title 2128 0 R /A 2125 0 R -/Parent 2119 0 R -/Prev 2123 0 R +/Parent 2123 0 R /Next 2131 0 R >> endobj 2123 0 obj << /Title 2124 0 R /A 2121 0 R -/Parent 2119 0 R -/Next 2127 0 R +/Parent 2115 0 R +/Prev 2119 0 R +/Next 2147 0 R +/First 2127 0 R +/Last 2139 0 R +/Count -3 >> endobj 2119 0 obj << /Title 2120 0 R /A 2117 0 R -/Parent 2087 0 R -/Prev 2095 0 R -/Next 2135 0 R -/First 2123 0 R -/Last 2131 0 R -/Count -3 +/Parent 2115 0 R +/Next 2123 0 R >> endobj 2115 0 obj << /Title 2116 0 R /A 2113 0 R -/Parent 2111 0 R +/Parent 487 0 R +/Prev 2087 0 R +/Next 2179 0 R +/First 2119 0 R +/Last 2171 0 R +/Count -6 >> endobj 2111 0 obj << /Title 2112 0 R /A 2109 0 R -/Parent 2095 0 R -/Prev 2103 0 R -/First 2115 0 R -/Last 2115 0 R -/Count -1 +/Parent 2107 0 R >> endobj 2107 0 obj << /Title 2108 0 R /A 2105 0 R -/Parent 2103 0 R +/Parent 2087 0 R +/Prev 2099 0 R +/First 2111 0 R +/Last 2111 0 R +/Count -1 >> endobj 2103 0 obj << /Title 2104 0 R /A 2101 0 R -/Parent 2095 0 R -/Prev 2099 0 R -/Next 2111 0 R -/First 2107 0 R -/Last 2107 0 R -/Count -1 +/Parent 2099 0 R >> endobj 2099 0 obj << /Title 2100 0 R /A 2097 0 R -/Parent 2095 0 R -/Next 2103 0 R +/Parent 2087 0 R +/Prev 2095 0 R +/Next 2107 0 R +/First 2103 0 R +/Last 2103 0 R +/Count -1 >> endobj 2095 0 obj << /Title 2096 0 R /A 2093 0 R /Parent 2087 0 R /Prev 2091 0 R -/Next 2119 0 R -/First 2099 0 R -/Last 2111 0 R -/Count -3 +/Next 2099 0 R >> endobj 2091 0 obj << /Title 2092 0 R @@ -37357,138 +39690,138 @@ endobj 2087 0 obj << /Title 2088 0 R /A 2085 0 R -/Parent 463 0 R -/Prev 2055 0 R -/Next 2147 0 R +/Parent 487 0 R +/Prev 1979 0 R +/Next 2115 0 R /First 2091 0 R -/Last 2139 0 R -/Count -5 +/Last 2107 0 R +/Count -4 >> endobj 2083 0 obj << /Title 2084 0 R /A 2081 0 R -/Parent 2055 0 R -/Prev 2075 0 R +/Parent 2075 0 R +/Prev 2079 0 R >> endobj 2079 0 obj << /Title 2080 0 R /A 2077 0 R /Parent 2075 0 R +/Next 2083 0 R >> endobj 2075 0 obj << /Title 2076 0 R /A 2073 0 R -/Parent 2055 0 R -/Prev 2067 0 R -/Next 2083 0 R +/Parent 1979 0 R +/Prev 2071 0 R /First 2079 0 R -/Last 2079 0 R -/Count -1 +/Last 2083 0 R +/Count -2 >> endobj 2071 0 obj << /Title 2072 0 R /A 2069 0 R -/Parent 2067 0 R +/Parent 1979 0 R +/Prev 2027 0 R +/Next 2075 0 R >> endobj 2067 0 obj << /Title 2068 0 R /A 2065 0 R -/Parent 2055 0 R +/Parent 2039 0 R /Prev 2063 0 R -/Next 2075 0 R -/First 2071 0 R -/Last 2071 0 R -/Count -1 >> endobj 2063 0 obj << /Title 2064 0 R /A 2061 0 R -/Parent 2055 0 R +/Parent 2039 0 R /Prev 2059 0 R /Next 2067 0 R >> endobj 2059 0 obj << /Title 2060 0 R /A 2057 0 R -/Parent 2055 0 R +/Parent 2039 0 R +/Prev 2055 0 R /Next 2063 0 R >> endobj 2055 0 obj << /Title 2056 0 R /A 2053 0 R -/Parent 463 0 R -/Prev 1951 0 R -/Next 2087 0 R -/First 2059 0 R -/Last 2083 0 R -/Count -5 +/Parent 2039 0 R +/Prev 2051 0 R +/Next 2059 0 R >> endobj 2051 0 obj << /Title 2052 0 R /A 2049 0 R -/Parent 2047 0 R +/Parent 2039 0 R +/Prev 2047 0 R +/Next 2055 0 R >> endobj 2047 0 obj << /Title 2048 0 R /A 2045 0 R -/Parent 1951 0 R +/Parent 2039 0 R /Prev 2043 0 R -/First 2051 0 R -/Last 2051 0 R -/Count -1 +/Next 2051 0 R >> endobj 2043 0 obj << /Title 2044 0 R /A 2041 0 R -/Parent 1951 0 R -/Prev 1999 0 R +/Parent 2039 0 R /Next 2047 0 R >> endobj 2039 0 obj << /Title 2040 0 R /A 2037 0 R -/Parent 2011 0 R +/Parent 2027 0 R /Prev 2035 0 R +/First 2043 0 R +/Last 2067 0 R +/Count -7 >> endobj 2035 0 obj << /Title 2036 0 R /A 2033 0 R -/Parent 2011 0 R +/Parent 2027 0 R /Prev 2031 0 R /Next 2039 0 R >> endobj 2031 0 obj << /Title 2032 0 R /A 2029 0 R -/Parent 2011 0 R -/Prev 2027 0 R +/Parent 2027 0 R /Next 2035 0 R >> endobj 2027 0 obj << /Title 2028 0 R /A 2025 0 R -/Parent 2011 0 R -/Prev 2023 0 R -/Next 2031 0 R +/Parent 1979 0 R +/Prev 1999 0 R +/Next 2071 0 R +/First 2031 0 R +/Last 2039 0 R +/Count -3 >> endobj 2023 0 obj << /Title 2024 0 R /A 2021 0 R -/Parent 2011 0 R +/Parent 1999 0 R /Prev 2019 0 R -/Next 2027 0 R >> endobj 2019 0 obj << /Title 2020 0 R /A 2017 0 R -/Parent 2011 0 R +/Parent 1999 0 R /Prev 2015 0 R /Next 2023 0 R >> endobj 2015 0 obj << /Title 2016 0 R /A 2013 0 R -/Parent 2011 0 R +/Parent 1999 0 R +/Prev 2011 0 R /Next 2019 0 R >> endobj 2011 0 obj << @@ -37496,9 +39829,7 @@ endobj /A 2009 0 R /Parent 1999 0 R /Prev 2007 0 R -/First 2015 0 R -/Last 2039 0 R -/Count -7 +/Next 2015 0 R >> endobj 2007 0 obj << /Title 2008 0 R @@ -37516,354 +39847,353 @@ endobj 1999 0 obj << /Title 2000 0 R /A 1997 0 R -/Parent 1951 0 R -/Prev 1971 0 R -/Next 2043 0 R +/Parent 1979 0 R +/Prev 1991 0 R +/Next 2027 0 R /First 2003 0 R -/Last 2011 0 R -/Count -3 +/Last 2023 0 R +/Count -6 >> endobj 1995 0 obj << /Title 1996 0 R /A 1993 0 R -/Parent 1971 0 R -/Prev 1991 0 R +/Parent 1991 0 R >> endobj 1991 0 obj << /Title 1992 0 R /A 1989 0 R -/Parent 1971 0 R +/Parent 1979 0 R /Prev 1987 0 R -/Next 1995 0 R +/Next 1999 0 R +/First 1995 0 R +/Last 1995 0 R +/Count -1 >> endobj 1987 0 obj << /Title 1988 0 R /A 1985 0 R -/Parent 1971 0 R +/Parent 1979 0 R /Prev 1983 0 R /Next 1991 0 R >> endobj 1983 0 obj << /Title 1984 0 R /A 1981 0 R -/Parent 1971 0 R -/Prev 1979 0 R +/Parent 1979 0 R /Next 1987 0 R >> endobj 1979 0 obj << /Title 1980 0 R /A 1977 0 R -/Parent 1971 0 R -/Prev 1975 0 R -/Next 1983 0 R +/Parent 487 0 R +/Prev 1931 0 R +/Next 2087 0 R +/First 1983 0 R +/Last 2075 0 R +/Count -7 >> endobj 1975 0 obj << /Title 1976 0 R /A 1973 0 R -/Parent 1971 0 R -/Next 1979 0 R +/Parent 1967 0 R +/Prev 1971 0 R >> endobj 1971 0 obj << /Title 1972 0 R /A 1969 0 R -/Parent 1951 0 R -/Prev 1963 0 R -/Next 1999 0 R -/First 1975 0 R -/Last 1995 0 R -/Count -6 +/Parent 1967 0 R +/Next 1975 0 R >> endobj 1967 0 obj << /Title 1968 0 R /A 1965 0 R -/Parent 1963 0 R +/Parent 1931 0 R +/Prev 1943 0 R +/First 1971 0 R +/Last 1975 0 R +/Count -2 >> endobj 1963 0 obj << /Title 1964 0 R /A 1961 0 R -/Parent 1951 0 R +/Parent 1943 0 R /Prev 1959 0 R -/Next 1971 0 R -/First 1967 0 R -/Last 1967 0 R -/Count -1 >> endobj 1959 0 obj << /Title 1960 0 R /A 1957 0 R -/Parent 1951 0 R +/Parent 1943 0 R /Prev 1955 0 R /Next 1963 0 R >> endobj 1955 0 obj << /Title 1956 0 R /A 1953 0 R -/Parent 1951 0 R +/Parent 1943 0 R +/Prev 1951 0 R /Next 1959 0 R >> endobj 1951 0 obj << /Title 1952 0 R /A 1949 0 R -/Parent 463 0 R -/Prev 1903 0 R -/Next 2055 0 R -/First 1955 0 R -/Last 2047 0 R -/Count -7 +/Parent 1943 0 R +/Prev 1947 0 R +/Next 1955 0 R >> endobj 1947 0 obj << /Title 1948 0 R /A 1945 0 R -/Parent 1939 0 R -/Prev 1943 0 R +/Parent 1943 0 R +/Next 1951 0 R >> endobj 1943 0 obj << /Title 1944 0 R /A 1941 0 R -/Parent 1939 0 R -/Next 1947 0 R +/Parent 1931 0 R +/Prev 1939 0 R +/Next 1967 0 R +/First 1947 0 R +/Last 1963 0 R +/Count -5 >> endobj 1939 0 obj << /Title 1940 0 R /A 1937 0 R -/Parent 1903 0 R -/Prev 1915 0 R -/First 1943 0 R -/Last 1947 0 R -/Count -2 +/Parent 1931 0 R +/Prev 1935 0 R +/Next 1943 0 R >> endobj 1935 0 obj << /Title 1936 0 R /A 1933 0 R -/Parent 1915 0 R -/Prev 1931 0 R +/Parent 1931 0 R +/Next 1939 0 R >> endobj 1931 0 obj << /Title 1932 0 R /A 1929 0 R -/Parent 1915 0 R -/Prev 1927 0 R -/Next 1935 0 R +/Parent 487 0 R +/Prev 1395 0 R +/Next 1979 0 R +/First 1935 0 R +/Last 1967 0 R +/Count -4 >> endobj 1927 0 obj << /Title 1928 0 R /A 1925 0 R -/Parent 1915 0 R -/Prev 1923 0 R -/Next 1931 0 R +/Parent 1395 0 R +/Prev 1847 0 R >> endobj 1923 0 obj << /Title 1924 0 R /A 1921 0 R -/Parent 1915 0 R +/Parent 1847 0 R /Prev 1919 0 R -/Next 1927 0 R >> endobj 1919 0 obj << /Title 1920 0 R /A 1917 0 R -/Parent 1915 0 R +/Parent 1847 0 R +/Prev 1915 0 R /Next 1923 0 R >> endobj 1915 0 obj << /Title 1916 0 R /A 1913 0 R -/Parent 1903 0 R +/Parent 1847 0 R /Prev 1911 0 R -/Next 1939 0 R -/First 1919 0 R -/Last 1935 0 R -/Count -5 +/Next 1919 0 R >> endobj 1911 0 obj << /Title 1912 0 R /A 1909 0 R -/Parent 1903 0 R +/Parent 1847 0 R /Prev 1907 0 R /Next 1915 0 R >> endobj 1907 0 obj << /Title 1908 0 R /A 1905 0 R -/Parent 1903 0 R +/Parent 1847 0 R +/Prev 1903 0 R /Next 1911 0 R >> endobj 1903 0 obj << /Title 1904 0 R /A 1901 0 R -/Parent 463 0 R -/Prev 1363 0 R -/Next 1951 0 R -/First 1907 0 R -/Last 1939 0 R -/Count -4 +/Parent 1847 0 R +/Prev 1899 0 R +/Next 1907 0 R >> endobj 1899 0 obj << /Title 1900 0 R /A 1897 0 R -/Parent 1363 0 R -/Prev 1819 0 R +/Parent 1847 0 R +/Prev 1895 0 R +/Next 1903 0 R >> endobj 1895 0 obj << /Title 1896 0 R /A 1893 0 R -/Parent 1819 0 R +/Parent 1847 0 R /Prev 1891 0 R +/Next 1899 0 R >> endobj 1891 0 obj << /Title 1892 0 R /A 1889 0 R -/Parent 1819 0 R +/Parent 1847 0 R /Prev 1887 0 R /Next 1895 0 R >> endobj 1887 0 obj << /Title 1888 0 R /A 1885 0 R -/Parent 1819 0 R +/Parent 1847 0 R /Prev 1883 0 R /Next 1891 0 R >> endobj 1883 0 obj << /Title 1884 0 R /A 1881 0 R -/Parent 1819 0 R +/Parent 1847 0 R /Prev 1879 0 R /Next 1887 0 R >> endobj 1879 0 obj << /Title 1880 0 R /A 1877 0 R -/Parent 1819 0 R +/Parent 1847 0 R /Prev 1875 0 R /Next 1883 0 R >> endobj 1875 0 obj << /Title 1876 0 R /A 1873 0 R -/Parent 1819 0 R +/Parent 1847 0 R /Prev 1871 0 R /Next 1879 0 R >> endobj 1871 0 obj << /Title 1872 0 R /A 1869 0 R -/Parent 1819 0 R +/Parent 1847 0 R /Prev 1867 0 R /Next 1875 0 R >> endobj 1867 0 obj << /Title 1868 0 R /A 1865 0 R -/Parent 1819 0 R +/Parent 1847 0 R /Prev 1863 0 R /Next 1871 0 R >> endobj 1863 0 obj << /Title 1864 0 R /A 1861 0 R -/Parent 1819 0 R +/Parent 1847 0 R /Prev 1859 0 R /Next 1867 0 R >> endobj 1859 0 obj << /Title 1860 0 R /A 1857 0 R -/Parent 1819 0 R +/Parent 1847 0 R /Prev 1855 0 R /Next 1863 0 R >> endobj 1855 0 obj << /Title 1856 0 R /A 1853 0 R -/Parent 1819 0 R +/Parent 1847 0 R /Prev 1851 0 R /Next 1859 0 R >> endobj 1851 0 obj << /Title 1852 0 R /A 1849 0 R -/Parent 1819 0 R -/Prev 1847 0 R +/Parent 1847 0 R /Next 1855 0 R >> endobj 1847 0 obj << /Title 1848 0 R /A 1845 0 R -/Parent 1819 0 R +/Parent 1395 0 R /Prev 1843 0 R -/Next 1851 0 R +/Next 1927 0 R +/First 1851 0 R +/Last 1923 0 R +/Count -19 >> endobj 1843 0 obj << /Title 1844 0 R /A 1841 0 R -/Parent 1819 0 R +/Parent 1395 0 R /Prev 1839 0 R /Next 1847 0 R >> endobj 1839 0 obj << /Title 1840 0 R /A 1837 0 R -/Parent 1819 0 R -/Prev 1835 0 R +/Parent 1395 0 R +/Prev 1823 0 R /Next 1843 0 R >> endobj 1835 0 obj << /Title 1836 0 R /A 1833 0 R -/Parent 1819 0 R +/Parent 1823 0 R /Prev 1831 0 R -/Next 1839 0 R >> endobj 1831 0 obj << /Title 1832 0 R /A 1829 0 R -/Parent 1819 0 R +/Parent 1823 0 R /Prev 1827 0 R /Next 1835 0 R >> endobj 1827 0 obj << /Title 1828 0 R /A 1825 0 R -/Parent 1819 0 R -/Prev 1823 0 R +/Parent 1823 0 R /Next 1831 0 R >> endobj 1823 0 obj << /Title 1824 0 R /A 1821 0 R -/Parent 1819 0 R -/Next 1827 0 R +/Parent 1395 0 R +/Prev 1819 0 R +/Next 1839 0 R +/First 1827 0 R +/Last 1835 0 R +/Count -3 >> endobj 1819 0 obj << /Title 1820 0 R /A 1817 0 R -/Parent 1363 0 R -/Prev 1815 0 R -/Next 1899 0 R -/First 1823 0 R -/Last 1895 0 R -/Count -19 +/Parent 1395 0 R +/Prev 1791 0 R +/Next 1823 0 R >> endobj 1815 0 obj << /Title 1816 0 R /A 1813 0 R -/Parent 1363 0 R +/Parent 1791 0 R /Prev 1811 0 R -/Next 1819 0 R >> endobj 1811 0 obj << /Title 1812 0 R /A 1809 0 R -/Parent 1363 0 R +/Parent 1791 0 R /Prev 1807 0 R /Next 1815 0 R >> endobj 1807 0 obj << /Title 1808 0 R /A 1805 0 R -/Parent 1363 0 R -/Prev 1791 0 R +/Parent 1791 0 R +/Prev 1803 0 R /Next 1811 0 R >> endobj 1803 0 obj << @@ -37871,6 +40201,7 @@ endobj /A 1801 0 R /Parent 1791 0 R /Prev 1799 0 R +/Next 1807 0 R >> endobj 1799 0 obj << /Title 1800 0 R @@ -37888,826 +40219,826 @@ endobj 1791 0 obj << /Title 1792 0 R /A 1789 0 R -/Parent 1363 0 R -/Prev 1787 0 R -/Next 1807 0 R +/Parent 1395 0 R +/Prev 1747 0 R +/Next 1819 0 R /First 1795 0 R -/Last 1803 0 R -/Count -3 +/Last 1815 0 R +/Count -6 >> endobj 1787 0 obj << /Title 1788 0 R /A 1785 0 R -/Parent 1363 0 R -/Prev 1755 0 R -/Next 1791 0 R +/Parent 1747 0 R +/Prev 1751 0 R >> endobj 1783 0 obj << /Title 1784 0 R /A 1781 0 R -/Parent 1755 0 R +/Parent 1751 0 R /Prev 1779 0 R >> endobj 1779 0 obj << /Title 1780 0 R /A 1777 0 R -/Parent 1755 0 R +/Parent 1751 0 R /Prev 1775 0 R /Next 1783 0 R >> endobj 1775 0 obj << /Title 1776 0 R /A 1773 0 R -/Parent 1755 0 R +/Parent 1751 0 R /Prev 1771 0 R /Next 1779 0 R >> endobj 1771 0 obj << /Title 1772 0 R /A 1769 0 R -/Parent 1755 0 R +/Parent 1751 0 R /Prev 1767 0 R /Next 1775 0 R >> endobj 1767 0 obj << /Title 1768 0 R /A 1765 0 R -/Parent 1755 0 R +/Parent 1751 0 R /Prev 1763 0 R /Next 1771 0 R >> endobj 1763 0 obj << /Title 1764 0 R /A 1761 0 R -/Parent 1755 0 R +/Parent 1751 0 R /Prev 1759 0 R /Next 1767 0 R >> endobj 1759 0 obj << /Title 1760 0 R /A 1757 0 R -/Parent 1755 0 R +/Parent 1751 0 R +/Prev 1755 0 R /Next 1763 0 R >> endobj 1755 0 obj << /Title 1756 0 R /A 1753 0 R -/Parent 1363 0 R -/Prev 1711 0 R -/Next 1787 0 R -/First 1759 0 R -/Last 1783 0 R -/Count -7 +/Parent 1751 0 R +/Next 1759 0 R >> endobj 1751 0 obj << /Title 1752 0 R /A 1749 0 R -/Parent 1711 0 R -/Prev 1715 0 R +/Parent 1747 0 R +/Next 1787 0 R +/First 1755 0 R +/Last 1783 0 R +/Count -8 >> endobj 1747 0 obj << /Title 1748 0 R /A 1745 0 R -/Parent 1715 0 R -/Prev 1743 0 R +/Parent 1395 0 R +/Prev 1727 0 R +/Next 1791 0 R +/First 1751 0 R +/Last 1787 0 R +/Count -2 >> endobj 1743 0 obj << /Title 1744 0 R /A 1741 0 R -/Parent 1715 0 R +/Parent 1727 0 R /Prev 1739 0 R -/Next 1747 0 R >> endobj 1739 0 obj << /Title 1740 0 R /A 1737 0 R -/Parent 1715 0 R +/Parent 1727 0 R /Prev 1735 0 R /Next 1743 0 R >> endobj 1735 0 obj << /Title 1736 0 R /A 1733 0 R -/Parent 1715 0 R +/Parent 1727 0 R /Prev 1731 0 R /Next 1739 0 R >> endobj 1731 0 obj << /Title 1732 0 R /A 1729 0 R -/Parent 1715 0 R -/Prev 1727 0 R +/Parent 1727 0 R /Next 1735 0 R >> endobj 1727 0 obj << /Title 1728 0 R /A 1725 0 R -/Parent 1715 0 R -/Prev 1723 0 R -/Next 1731 0 R +/Parent 1395 0 R +/Prev 1699 0 R +/Next 1747 0 R +/First 1731 0 R +/Last 1743 0 R +/Count -4 >> endobj 1723 0 obj << /Title 1724 0 R /A 1721 0 R -/Parent 1715 0 R +/Parent 1699 0 R /Prev 1719 0 R -/Next 1727 0 R >> endobj 1719 0 obj << /Title 1720 0 R /A 1717 0 R -/Parent 1715 0 R +/Parent 1699 0 R +/Prev 1715 0 R /Next 1723 0 R >> endobj 1715 0 obj << /Title 1716 0 R /A 1713 0 R -/Parent 1711 0 R -/Next 1751 0 R -/First 1719 0 R -/Last 1747 0 R -/Count -8 +/Parent 1699 0 R +/Prev 1711 0 R +/Next 1719 0 R >> endobj 1711 0 obj << /Title 1712 0 R /A 1709 0 R -/Parent 1363 0 R -/Prev 1691 0 R -/Next 1755 0 R -/First 1715 0 R -/Last 1751 0 R -/Count -2 +/Parent 1699 0 R +/Prev 1707 0 R +/Next 1715 0 R >> endobj 1707 0 obj << /Title 1708 0 R /A 1705 0 R -/Parent 1691 0 R +/Parent 1699 0 R /Prev 1703 0 R +/Next 1711 0 R >> endobj 1703 0 obj << /Title 1704 0 R /A 1701 0 R -/Parent 1691 0 R -/Prev 1699 0 R +/Parent 1699 0 R /Next 1707 0 R >> endobj 1699 0 obj << /Title 1700 0 R /A 1697 0 R -/Parent 1691 0 R -/Prev 1695 0 R -/Next 1703 0 R +/Parent 1395 0 R +/Prev 1631 0 R +/Next 1727 0 R +/First 1703 0 R +/Last 1723 0 R +/Count -6 >> endobj 1695 0 obj << /Title 1696 0 R /A 1693 0 R -/Parent 1691 0 R -/Next 1699 0 R +/Parent 1631 0 R +/Prev 1691 0 R >> endobj 1691 0 obj << /Title 1692 0 R /A 1689 0 R -/Parent 1363 0 R -/Prev 1663 0 R -/Next 1711 0 R -/First 1695 0 R -/Last 1707 0 R -/Count -4 +/Parent 1631 0 R +/Prev 1687 0 R +/Next 1695 0 R >> endobj 1687 0 obj << /Title 1688 0 R /A 1685 0 R -/Parent 1663 0 R +/Parent 1631 0 R /Prev 1683 0 R +/Next 1691 0 R >> endobj 1683 0 obj << /Title 1684 0 R /A 1681 0 R -/Parent 1663 0 R +/Parent 1631 0 R /Prev 1679 0 R /Next 1687 0 R >> endobj 1679 0 obj << /Title 1680 0 R /A 1677 0 R -/Parent 1663 0 R +/Parent 1631 0 R /Prev 1675 0 R /Next 1683 0 R >> endobj 1675 0 obj << /Title 1676 0 R /A 1673 0 R -/Parent 1663 0 R +/Parent 1631 0 R /Prev 1671 0 R /Next 1679 0 R >> endobj 1671 0 obj << /Title 1672 0 R /A 1669 0 R -/Parent 1663 0 R +/Parent 1631 0 R /Prev 1667 0 R /Next 1675 0 R >> endobj 1667 0 obj << /Title 1668 0 R /A 1665 0 R -/Parent 1663 0 R +/Parent 1631 0 R +/Prev 1663 0 R /Next 1671 0 R >> endobj 1663 0 obj << /Title 1664 0 R /A 1661 0 R -/Parent 1363 0 R -/Prev 1595 0 R -/Next 1691 0 R -/First 1667 0 R -/Last 1687 0 R -/Count -6 +/Parent 1631 0 R +/Prev 1659 0 R +/Next 1667 0 R >> endobj 1659 0 obj << /Title 1660 0 R /A 1657 0 R -/Parent 1595 0 R +/Parent 1631 0 R /Prev 1655 0 R +/Next 1663 0 R >> endobj 1655 0 obj << /Title 1656 0 R /A 1653 0 R -/Parent 1595 0 R +/Parent 1631 0 R /Prev 1651 0 R /Next 1659 0 R >> endobj 1651 0 obj << /Title 1652 0 R /A 1649 0 R -/Parent 1595 0 R +/Parent 1631 0 R /Prev 1647 0 R /Next 1655 0 R >> endobj 1647 0 obj << /Title 1648 0 R /A 1645 0 R -/Parent 1595 0 R +/Parent 1631 0 R /Prev 1643 0 R /Next 1651 0 R >> endobj 1643 0 obj << /Title 1644 0 R /A 1641 0 R -/Parent 1595 0 R +/Parent 1631 0 R /Prev 1639 0 R /Next 1647 0 R >> endobj 1639 0 obj << /Title 1640 0 R /A 1637 0 R -/Parent 1595 0 R +/Parent 1631 0 R /Prev 1635 0 R /Next 1643 0 R >> endobj 1635 0 obj << /Title 1636 0 R /A 1633 0 R -/Parent 1595 0 R -/Prev 1631 0 R +/Parent 1631 0 R /Next 1639 0 R >> endobj 1631 0 obj << /Title 1632 0 R /A 1629 0 R -/Parent 1595 0 R -/Prev 1627 0 R -/Next 1635 0 R +/Parent 1395 0 R +/Prev 1611 0 R +/Next 1699 0 R +/First 1635 0 R +/Last 1695 0 R +/Count -16 >> endobj 1627 0 obj << /Title 1628 0 R /A 1625 0 R -/Parent 1595 0 R +/Parent 1611 0 R /Prev 1623 0 R -/Next 1631 0 R >> endobj 1623 0 obj << /Title 1624 0 R /A 1621 0 R -/Parent 1595 0 R +/Parent 1611 0 R /Prev 1619 0 R /Next 1627 0 R >> endobj 1619 0 obj << /Title 1620 0 R /A 1617 0 R -/Parent 1595 0 R +/Parent 1611 0 R /Prev 1615 0 R /Next 1623 0 R >> endobj 1615 0 obj << /Title 1616 0 R /A 1613 0 R -/Parent 1595 0 R -/Prev 1611 0 R +/Parent 1611 0 R /Next 1619 0 R >> endobj 1611 0 obj << /Title 1612 0 R /A 1609 0 R -/Parent 1595 0 R -/Prev 1607 0 R -/Next 1615 0 R +/Parent 1395 0 R +/Prev 1599 0 R +/Next 1631 0 R +/First 1615 0 R +/Last 1627 0 R +/Count -4 >> endobj 1607 0 obj << /Title 1608 0 R /A 1605 0 R -/Parent 1595 0 R +/Parent 1599 0 R /Prev 1603 0 R -/Next 1611 0 R >> endobj 1603 0 obj << /Title 1604 0 R /A 1601 0 R -/Parent 1595 0 R -/Prev 1599 0 R +/Parent 1599 0 R /Next 1607 0 R >> endobj 1599 0 obj << /Title 1600 0 R /A 1597 0 R -/Parent 1595 0 R -/Next 1603 0 R +/Parent 1395 0 R +/Prev 1587 0 R +/Next 1611 0 R +/First 1603 0 R +/Last 1607 0 R +/Count -2 >> endobj 1595 0 obj << /Title 1596 0 R /A 1593 0 R -/Parent 1363 0 R -/Prev 1575 0 R -/Next 1663 0 R -/First 1599 0 R -/Last 1659 0 R -/Count -16 +/Parent 1587 0 R +/Prev 1591 0 R >> endobj 1591 0 obj << /Title 1592 0 R /A 1589 0 R -/Parent 1575 0 R -/Prev 1587 0 R +/Parent 1587 0 R +/Next 1595 0 R >> endobj 1587 0 obj << /Title 1588 0 R /A 1585 0 R -/Parent 1575 0 R -/Prev 1583 0 R -/Next 1591 0 R +/Parent 1395 0 R +/Prev 1571 0 R +/Next 1599 0 R +/First 1591 0 R +/Last 1595 0 R +/Count -2 >> endobj 1583 0 obj << /Title 1584 0 R /A 1581 0 R -/Parent 1575 0 R +/Parent 1571 0 R /Prev 1579 0 R -/Next 1587 0 R >> endobj 1579 0 obj << /Title 1580 0 R /A 1577 0 R -/Parent 1575 0 R +/Parent 1571 0 R +/Prev 1575 0 R /Next 1583 0 R >> endobj 1575 0 obj << /Title 1576 0 R /A 1573 0 R -/Parent 1363 0 R -/Prev 1563 0 R -/Next 1595 0 R -/First 1579 0 R -/Last 1591 0 R -/Count -4 +/Parent 1571 0 R +/Next 1579 0 R >> endobj 1571 0 obj << /Title 1572 0 R /A 1569 0 R -/Parent 1563 0 R -/Prev 1567 0 R +/Parent 1395 0 R +/Prev 1487 0 R +/Next 1587 0 R +/First 1575 0 R +/Last 1583 0 R +/Count -3 >> endobj 1567 0 obj << /Title 1568 0 R /A 1565 0 R -/Parent 1563 0 R -/Next 1571 0 R +/Parent 1487 0 R +/Prev 1563 0 R >> endobj 1563 0 obj << /Title 1564 0 R /A 1561 0 R -/Parent 1363 0 R -/Prev 1551 0 R -/Next 1575 0 R -/First 1567 0 R -/Last 1571 0 R -/Count -2 +/Parent 1487 0 R +/Prev 1559 0 R +/Next 1567 0 R >> endobj 1559 0 obj << /Title 1560 0 R /A 1557 0 R -/Parent 1551 0 R +/Parent 1487 0 R /Prev 1555 0 R +/Next 1563 0 R >> endobj 1555 0 obj << /Title 1556 0 R /A 1553 0 R -/Parent 1551 0 R +/Parent 1487 0 R +/Prev 1551 0 R /Next 1559 0 R >> endobj 1551 0 obj << /Title 1552 0 R /A 1549 0 R -/Parent 1363 0 R -/Prev 1535 0 R -/Next 1563 0 R -/First 1555 0 R -/Last 1559 0 R -/Count -2 +/Parent 1487 0 R +/Prev 1547 0 R +/Next 1555 0 R >> endobj 1547 0 obj << /Title 1548 0 R /A 1545 0 R -/Parent 1535 0 R +/Parent 1487 0 R /Prev 1543 0 R +/Next 1551 0 R >> endobj 1543 0 obj << /Title 1544 0 R /A 1541 0 R -/Parent 1535 0 R +/Parent 1487 0 R /Prev 1539 0 R /Next 1547 0 R >> endobj 1539 0 obj << /Title 1540 0 R /A 1537 0 R -/Parent 1535 0 R +/Parent 1487 0 R +/Prev 1535 0 R /Next 1543 0 R >> endobj 1535 0 obj << /Title 1536 0 R /A 1533 0 R -/Parent 1363 0 R -/Prev 1455 0 R -/Next 1551 0 R -/First 1539 0 R -/Last 1547 0 R -/Count -3 +/Parent 1487 0 R +/Prev 1531 0 R +/Next 1539 0 R >> endobj 1531 0 obj << /Title 1532 0 R /A 1529 0 R -/Parent 1455 0 R +/Parent 1487 0 R /Prev 1527 0 R +/Next 1535 0 R >> endobj 1527 0 obj << /Title 1528 0 R /A 1525 0 R -/Parent 1455 0 R +/Parent 1487 0 R /Prev 1523 0 R /Next 1531 0 R >> endobj 1523 0 obj << /Title 1524 0 R /A 1521 0 R -/Parent 1455 0 R +/Parent 1487 0 R /Prev 1519 0 R /Next 1527 0 R >> endobj 1519 0 obj << /Title 1520 0 R /A 1517 0 R -/Parent 1455 0 R +/Parent 1487 0 R /Prev 1515 0 R /Next 1523 0 R >> endobj 1515 0 obj << /Title 1516 0 R /A 1513 0 R -/Parent 1455 0 R +/Parent 1487 0 R /Prev 1511 0 R /Next 1519 0 R >> endobj 1511 0 obj << /Title 1512 0 R /A 1509 0 R -/Parent 1455 0 R +/Parent 1487 0 R /Prev 1507 0 R /Next 1515 0 R >> endobj 1507 0 obj << /Title 1508 0 R /A 1505 0 R -/Parent 1455 0 R -/Prev 1503 0 R +/Parent 1487 0 R +/Prev 1499 0 R /Next 1511 0 R >> endobj 1503 0 obj << /Title 1504 0 R /A 1501 0 R -/Parent 1455 0 R -/Prev 1499 0 R -/Next 1507 0 R +/Parent 1499 0 R >> endobj 1499 0 obj << /Title 1500 0 R /A 1497 0 R -/Parent 1455 0 R +/Parent 1487 0 R /Prev 1495 0 R -/Next 1503 0 R +/Next 1507 0 R +/First 1503 0 R +/Last 1503 0 R +/Count -1 >> endobj 1495 0 obj << /Title 1496 0 R /A 1493 0 R -/Parent 1455 0 R +/Parent 1487 0 R /Prev 1491 0 R /Next 1499 0 R >> endobj 1491 0 obj << /Title 1492 0 R /A 1489 0 R -/Parent 1455 0 R -/Prev 1487 0 R +/Parent 1487 0 R /Next 1495 0 R >> endobj 1487 0 obj << /Title 1488 0 R /A 1485 0 R -/Parent 1455 0 R -/Prev 1483 0 R -/Next 1491 0 R +/Parent 1395 0 R +/Prev 1451 0 R +/Next 1571 0 R +/First 1491 0 R +/Last 1567 0 R +/Count -19 >> endobj 1483 0 obj << /Title 1484 0 R /A 1481 0 R -/Parent 1455 0 R +/Parent 1451 0 R /Prev 1479 0 R -/Next 1487 0 R >> endobj 1479 0 obj << /Title 1480 0 R /A 1477 0 R -/Parent 1455 0 R +/Parent 1451 0 R /Prev 1475 0 R /Next 1483 0 R >> endobj 1475 0 obj << /Title 1476 0 R /A 1473 0 R -/Parent 1455 0 R +/Parent 1451 0 R /Prev 1471 0 R /Next 1479 0 R >> endobj 1471 0 obj << /Title 1472 0 R /A 1469 0 R -/Parent 1455 0 R +/Parent 1451 0 R /Prev 1467 0 R /Next 1475 0 R >> endobj 1467 0 obj << /Title 1468 0 R /A 1465 0 R -/Parent 1455 0 R +/Parent 1451 0 R /Prev 1463 0 R /Next 1471 0 R >> endobj 1463 0 obj << /Title 1464 0 R /A 1461 0 R -/Parent 1455 0 R +/Parent 1451 0 R /Prev 1459 0 R /Next 1467 0 R >> endobj 1459 0 obj << /Title 1460 0 R /A 1457 0 R -/Parent 1455 0 R +/Parent 1451 0 R +/Prev 1455 0 R /Next 1463 0 R >> endobj 1455 0 obj << /Title 1456 0 R /A 1453 0 R -/Parent 1363 0 R -/Prev 1419 0 R -/Next 1535 0 R -/First 1459 0 R -/Last 1531 0 R -/Count -19 +/Parent 1451 0 R +/Next 1459 0 R >> endobj 1451 0 obj << /Title 1452 0 R /A 1449 0 R -/Parent 1419 0 R -/Prev 1447 0 R +/Parent 1395 0 R +/Prev 1427 0 R +/Next 1487 0 R +/First 1455 0 R +/Last 1483 0 R +/Count -8 >> endobj 1447 0 obj << /Title 1448 0 R /A 1445 0 R -/Parent 1419 0 R +/Parent 1427 0 R /Prev 1443 0 R -/Next 1451 0 R >> endobj 1443 0 obj << /Title 1444 0 R /A 1441 0 R -/Parent 1419 0 R +/Parent 1427 0 R /Prev 1439 0 R /Next 1447 0 R >> endobj 1439 0 obj << /Title 1440 0 R /A 1437 0 R -/Parent 1419 0 R +/Parent 1427 0 R /Prev 1435 0 R /Next 1443 0 R >> endobj 1435 0 obj << /Title 1436 0 R /A 1433 0 R -/Parent 1419 0 R +/Parent 1427 0 R /Prev 1431 0 R /Next 1439 0 R >> endobj 1431 0 obj << /Title 1432 0 R /A 1429 0 R -/Parent 1419 0 R -/Prev 1427 0 R +/Parent 1427 0 R /Next 1435 0 R >> endobj 1427 0 obj << /Title 1428 0 R /A 1425 0 R -/Parent 1419 0 R -/Prev 1423 0 R -/Next 1431 0 R +/Parent 1395 0 R +/Prev 1411 0 R +/Next 1451 0 R +/First 1431 0 R +/Last 1447 0 R +/Count -5 >> endobj 1423 0 obj << /Title 1424 0 R /A 1421 0 R -/Parent 1419 0 R -/Next 1427 0 R +/Parent 1411 0 R +/Prev 1419 0 R >> endobj 1419 0 obj << /Title 1420 0 R /A 1417 0 R -/Parent 1363 0 R -/Prev 1395 0 R -/Next 1455 0 R -/First 1423 0 R -/Last 1451 0 R -/Count -8 +/Parent 1411 0 R +/Prev 1415 0 R +/Next 1423 0 R >> endobj 1415 0 obj << /Title 1416 0 R /A 1413 0 R -/Parent 1395 0 R -/Prev 1411 0 R +/Parent 1411 0 R +/Next 1419 0 R >> endobj 1411 0 obj << /Title 1412 0 R /A 1409 0 R /Parent 1395 0 R -/Prev 1407 0 R -/Next 1415 0 R +/Prev 1399 0 R +/Next 1427 0 R +/First 1415 0 R +/Last 1423 0 R +/Count -3 >> endobj 1407 0 obj << /Title 1408 0 R /A 1405 0 R -/Parent 1395 0 R +/Parent 1399 0 R /Prev 1403 0 R -/Next 1411 0 R >> endobj 1403 0 obj << /Title 1404 0 R /A 1401 0 R -/Parent 1395 0 R -/Prev 1399 0 R +/Parent 1399 0 R /Next 1407 0 R >> endobj 1399 0 obj << /Title 1400 0 R /A 1397 0 R /Parent 1395 0 R -/Next 1403 0 R +/Next 1411 0 R +/First 1403 0 R +/Last 1407 0 R +/Count -2 >> endobj 1395 0 obj << /Title 1396 0 R /A 1393 0 R -/Parent 1363 0 R -/Prev 1379 0 R -/Next 1419 0 R +/Parent 487 0 R +/Prev 1159 0 R +/Next 1931 0 R /First 1399 0 R -/Last 1415 0 R -/Count -5 +/Last 1927 0 R +/Count -20 >> endobj 1391 0 obj << /Title 1392 0 R /A 1389 0 R -/Parent 1379 0 R +/Parent 1383 0 R /Prev 1387 0 R >> endobj 1387 0 obj << /Title 1388 0 R /A 1385 0 R -/Parent 1379 0 R -/Prev 1383 0 R +/Parent 1383 0 R /Next 1391 0 R >> endobj 1383 0 obj << /Title 1384 0 R /A 1381 0 R -/Parent 1379 0 R -/Next 1387 0 R +/Parent 1159 0 R +/Prev 1379 0 R +/First 1387 0 R +/Last 1391 0 R +/Count -2 >> endobj 1379 0 obj << /Title 1380 0 R /A 1377 0 R -/Parent 1363 0 R -/Prev 1367 0 R -/Next 1395 0 R -/First 1383 0 R -/Last 1391 0 R -/Count -3 +/Parent 1159 0 R +/Prev 1375 0 R +/Next 1383 0 R >> endobj 1375 0 obj << /Title 1376 0 R /A 1373 0 R -/Parent 1367 0 R +/Parent 1159 0 R /Prev 1371 0 R +/Next 1379 0 R >> endobj 1371 0 obj << /Title 1372 0 R /A 1369 0 R -/Parent 1367 0 R +/Parent 1159 0 R +/Prev 1367 0 R /Next 1375 0 R >> endobj 1367 0 obj << /Title 1368 0 R /A 1365 0 R -/Parent 1363 0 R -/Next 1379 0 R -/First 1371 0 R -/Last 1375 0 R -/Count -2 +/Parent 1159 0 R +/Prev 1347 0 R +/Next 1371 0 R >> endobj 1363 0 obj << /Title 1364 0 R /A 1361 0 R -/Parent 463 0 R -/Prev 1123 0 R -/Next 1903 0 R -/First 1367 0 R -/Last 1899 0 R -/Count -21 +/Parent 1347 0 R +/Prev 1359 0 R >> endobj 1359 0 obj << /Title 1360 0 R /A 1357 0 R -/Parent 1351 0 R +/Parent 1347 0 R /Prev 1355 0 R +/Next 1363 0 R >> endobj 1355 0 obj << /Title 1356 0 R /A 1353 0 R -/Parent 1351 0 R +/Parent 1347 0 R +/Prev 1351 0 R /Next 1359 0 R >> endobj 1351 0 obj << /Title 1352 0 R /A 1349 0 R -/Parent 1123 0 R -/Prev 1347 0 R -/First 1355 0 R -/Last 1359 0 R -/Count -2 +/Parent 1347 0 R +/Next 1355 0 R >> endobj 1347 0 obj << /Title 1348 0 R /A 1345 0 R -/Parent 1123 0 R -/Prev 1343 0 R -/Next 1351 0 R +/Parent 1159 0 R +/Prev 1315 0 R +/Next 1367 0 R +/First 1351 0 R +/Last 1363 0 R +/Count -4 >> endobj 1343 0 obj << /Title 1344 0 R /A 1341 0 R -/Parent 1123 0 R +/Parent 1315 0 R /Prev 1339 0 R -/Next 1347 0 R >> endobj 1339 0 obj << /Title 1340 0 R /A 1337 0 R -/Parent 1123 0 R +/Parent 1315 0 R /Prev 1335 0 R /Next 1343 0 R >> endobj 1335 0 obj << /Title 1336 0 R /A 1333 0 R -/Parent 1123 0 R -/Prev 1315 0 R +/Parent 1315 0 R +/Prev 1331 0 R /Next 1339 0 R >> endobj 1331 0 obj << @@ -38715,6 +41046,7 @@ endobj /A 1329 0 R /Parent 1315 0 R /Prev 1327 0 R +/Next 1335 0 R >> endobj 1327 0 obj << /Title 1328 0 R @@ -38739,139 +41071,140 @@ endobj 1315 0 obj << /Title 1316 0 R /A 1313 0 R -/Parent 1123 0 R -/Prev 1283 0 R -/Next 1335 0 R +/Parent 1159 0 R +/Prev 1295 0 R +/Next 1347 0 R /First 1319 0 R -/Last 1331 0 R -/Count -4 +/Last 1343 0 R +/Count -7 >> endobj 1311 0 obj << /Title 1312 0 R /A 1309 0 R -/Parent 1283 0 R +/Parent 1295 0 R /Prev 1307 0 R >> endobj 1307 0 obj << /Title 1308 0 R /A 1305 0 R -/Parent 1283 0 R +/Parent 1295 0 R /Prev 1303 0 R /Next 1311 0 R >> endobj 1303 0 obj << /Title 1304 0 R /A 1301 0 R -/Parent 1283 0 R +/Parent 1295 0 R /Prev 1299 0 R /Next 1307 0 R >> endobj 1299 0 obj << /Title 1300 0 R /A 1297 0 R -/Parent 1283 0 R -/Prev 1295 0 R +/Parent 1295 0 R /Next 1303 0 R >> endobj 1295 0 obj << /Title 1296 0 R /A 1293 0 R -/Parent 1283 0 R -/Prev 1291 0 R -/Next 1299 0 R +/Parent 1159 0 R +/Prev 1247 0 R +/Next 1315 0 R +/First 1299 0 R +/Last 1311 0 R +/Count -4 >> endobj 1291 0 obj << /Title 1292 0 R /A 1289 0 R -/Parent 1283 0 R +/Parent 1255 0 R /Prev 1287 0 R -/Next 1295 0 R >> endobj 1287 0 obj << /Title 1288 0 R /A 1285 0 R -/Parent 1283 0 R +/Parent 1255 0 R +/Prev 1283 0 R /Next 1291 0 R >> endobj 1283 0 obj << /Title 1284 0 R /A 1281 0 R -/Parent 1123 0 R -/Prev 1263 0 R -/Next 1315 0 R -/First 1287 0 R -/Last 1311 0 R -/Count -7 +/Parent 1255 0 R +/Prev 1279 0 R +/Next 1287 0 R >> endobj 1279 0 obj << /Title 1280 0 R /A 1277 0 R -/Parent 1263 0 R +/Parent 1255 0 R /Prev 1275 0 R +/Next 1283 0 R >> endobj 1275 0 obj << /Title 1276 0 R /A 1273 0 R -/Parent 1263 0 R +/Parent 1255 0 R /Prev 1271 0 R /Next 1279 0 R >> endobj 1271 0 obj << /Title 1272 0 R /A 1269 0 R -/Parent 1263 0 R +/Parent 1255 0 R /Prev 1267 0 R /Next 1275 0 R >> endobj 1267 0 obj << /Title 1268 0 R /A 1265 0 R -/Parent 1263 0 R +/Parent 1255 0 R +/Prev 1263 0 R /Next 1271 0 R >> endobj 1263 0 obj << /Title 1264 0 R /A 1261 0 R -/Parent 1123 0 R -/Prev 1215 0 R -/Next 1283 0 R -/First 1267 0 R -/Last 1279 0 R -/Count -4 +/Parent 1255 0 R +/Prev 1259 0 R +/Next 1267 0 R >> endobj 1259 0 obj << /Title 1260 0 R /A 1257 0 R -/Parent 1223 0 R -/Prev 1255 0 R +/Parent 1255 0 R +/Next 1263 0 R >> endobj 1255 0 obj << /Title 1256 0 R /A 1253 0 R -/Parent 1223 0 R +/Parent 1247 0 R /Prev 1251 0 R -/Next 1259 0 R +/First 1259 0 R +/Last 1291 0 R +/Count -9 >> endobj 1251 0 obj << /Title 1252 0 R /A 1249 0 R -/Parent 1223 0 R -/Prev 1247 0 R +/Parent 1247 0 R /Next 1255 0 R >> endobj 1247 0 obj << /Title 1248 0 R /A 1245 0 R -/Parent 1223 0 R -/Prev 1243 0 R -/Next 1251 0 R +/Parent 1159 0 R +/Prev 1223 0 R +/Next 1295 0 R +/First 1251 0 R +/Last 1255 0 R +/Count -2 >> endobj 1243 0 obj << /Title 1244 0 R /A 1241 0 R /Parent 1223 0 R /Prev 1239 0 R -/Next 1247 0 R >> endobj 1239 0 obj << /Title 1240 0 R @@ -38903,167 +41236,172 @@ endobj 1223 0 obj << /Title 1224 0 R /A 1221 0 R -/Parent 1215 0 R -/Prev 1219 0 R +/Parent 1159 0 R +/Prev 1191 0 R +/Next 1247 0 R /First 1227 0 R -/Last 1259 0 R -/Count -9 +/Last 1243 0 R +/Count -5 >> endobj 1219 0 obj << /Title 1220 0 R /A 1217 0 R -/Parent 1215 0 R -/Next 1223 0 R +/Parent 1195 0 R +/Prev 1215 0 R >> endobj 1215 0 obj << /Title 1216 0 R /A 1213 0 R -/Parent 1123 0 R -/Prev 1191 0 R -/Next 1263 0 R -/First 1219 0 R -/Last 1223 0 R -/Count -2 +/Parent 1195 0 R +/Prev 1211 0 R +/Next 1219 0 R >> endobj 1211 0 obj << /Title 1212 0 R /A 1209 0 R -/Parent 1191 0 R +/Parent 1195 0 R /Prev 1207 0 R +/Next 1215 0 R >> endobj 1207 0 obj << /Title 1208 0 R /A 1205 0 R -/Parent 1191 0 R +/Parent 1195 0 R /Prev 1203 0 R /Next 1211 0 R >> endobj 1203 0 obj << /Title 1204 0 R /A 1201 0 R -/Parent 1191 0 R +/Parent 1195 0 R /Prev 1199 0 R /Next 1207 0 R >> endobj 1199 0 obj << /Title 1200 0 R /A 1197 0 R -/Parent 1191 0 R -/Prev 1195 0 R +/Parent 1195 0 R /Next 1203 0 R >> endobj 1195 0 obj << /Title 1196 0 R /A 1193 0 R /Parent 1191 0 R -/Next 1199 0 R +/First 1199 0 R +/Last 1219 0 R +/Count -6 >> endobj 1191 0 obj << /Title 1192 0 R /A 1189 0 R -/Parent 1123 0 R -/Prev 1163 0 R -/Next 1215 0 R +/Parent 1159 0 R +/Prev 1179 0 R +/Next 1223 0 R /First 1195 0 R -/Last 1211 0 R -/Count -5 +/Last 1195 0 R +/Count -1 >> endobj 1187 0 obj << /Title 1188 0 R /A 1185 0 R -/Parent 1163 0 R +/Parent 1179 0 R /Prev 1183 0 R >> endobj 1183 0 obj << /Title 1184 0 R /A 1181 0 R -/Parent 1163 0 R -/Prev 1179 0 R +/Parent 1179 0 R /Next 1187 0 R >> endobj 1179 0 obj << /Title 1180 0 R /A 1177 0 R -/Parent 1163 0 R -/Prev 1175 0 R -/Next 1183 0 R +/Parent 1159 0 R +/Prev 1167 0 R +/Next 1191 0 R +/First 1183 0 R +/Last 1187 0 R +/Count -2 >> endobj 1175 0 obj << /Title 1176 0 R /A 1173 0 R -/Parent 1163 0 R +/Parent 1167 0 R /Prev 1171 0 R -/Next 1179 0 R >> endobj 1171 0 obj << /Title 1172 0 R /A 1169 0 R -/Parent 1163 0 R -/Prev 1167 0 R +/Parent 1167 0 R /Next 1175 0 R >> endobj 1167 0 obj << /Title 1168 0 R /A 1165 0 R -/Parent 1163 0 R -/Next 1171 0 R +/Parent 1159 0 R +/Prev 1163 0 R +/Next 1179 0 R +/First 1171 0 R +/Last 1175 0 R +/Count -2 >> endobj 1163 0 obj << /Title 1164 0 R /A 1161 0 R -/Parent 1123 0 R -/Prev 1159 0 R -/Next 1191 0 R -/First 1167 0 R -/Last 1187 0 R -/Count -6 +/Parent 1159 0 R +/Next 1167 0 R >> endobj 1159 0 obj << /Title 1160 0 R /A 1157 0 R -/Parent 1123 0 R -/Prev 1147 0 R -/Next 1163 0 R +/Parent 487 0 R +/Prev 1143 0 R +/Next 1395 0 R +/First 1163 0 R +/Last 1383 0 R +/Count -14 >> endobj 1155 0 obj << /Title 1156 0 R /A 1153 0 R -/Parent 1147 0 R -/Prev 1151 0 R +/Parent 1151 0 R >> endobj 1151 0 obj << /Title 1152 0 R /A 1149 0 R -/Parent 1147 0 R -/Next 1155 0 R +/Parent 1143 0 R +/Prev 1147 0 R +/First 1155 0 R +/Last 1155 0 R +/Count -1 >> endobj 1147 0 obj << /Title 1148 0 R /A 1145 0 R -/Parent 1123 0 R -/Prev 1131 0 R -/Next 1159 0 R -/First 1151 0 R -/Last 1155 0 R -/Count -2 +/Parent 1143 0 R +/Next 1151 0 R >> endobj 1143 0 obj << /Title 1144 0 R /A 1141 0 R -/Parent 1131 0 R -/Prev 1139 0 R +/Parent 487 0 R +/Prev 1095 0 R +/Next 1159 0 R +/First 1147 0 R +/Last 1151 0 R +/Count -2 >> endobj 1139 0 obj << /Title 1140 0 R /A 1137 0 R -/Parent 1131 0 R +/Parent 1095 0 R /Prev 1135 0 R -/Next 1143 0 R >> endobj 1135 0 obj << /Title 1136 0 R /A 1133 0 R -/Parent 1131 0 R +/Parent 1095 0 R +/Prev 1123 0 R /Next 1139 0 R >> endobj 1131 0 obj << @@ -39071,10 +41409,6 @@ endobj /A 1129 0 R /Parent 1123 0 R /Prev 1127 0 R -/Next 1147 0 R -/First 1135 0 R -/Last 1143 0 R -/Count -3 >> endobj 1127 0 obj << /Title 1128 0 R @@ -39085,127 +41419,126 @@ endobj 1123 0 obj << /Title 1124 0 R /A 1121 0 R -/Parent 463 0 R -/Prev 1111 0 R -/Next 1363 0 R +/Parent 1095 0 R +/Prev 1107 0 R +/Next 1135 0 R /First 1127 0 R -/Last 1351 0 R -/Count -15 +/Last 1131 0 R +/Count -2 >> endobj 1119 0 obj << /Title 1120 0 R /A 1117 0 R -/Parent 1111 0 R +/Parent 1107 0 R /Prev 1115 0 R >> endobj 1115 0 obj << /Title 1116 0 R /A 1113 0 R -/Parent 1111 0 R +/Parent 1107 0 R +/Prev 1111 0 R /Next 1119 0 R >> endobj 1111 0 obj << /Title 1112 0 R /A 1109 0 R -/Parent 463 0 R -/Prev 1063 0 R -/Next 1123 0 R -/First 1115 0 R -/Last 1119 0 R -/Count -2 +/Parent 1107 0 R +/Next 1115 0 R >> endobj 1107 0 obj << /Title 1108 0 R /A 1105 0 R -/Parent 1063 0 R +/Parent 1095 0 R /Prev 1103 0 R +/Next 1123 0 R +/First 1111 0 R +/Last 1119 0 R +/Count -3 >> endobj 1103 0 obj << /Title 1104 0 R /A 1101 0 R -/Parent 1063 0 R -/Prev 1091 0 R +/Parent 1095 0 R +/Prev 1099 0 R /Next 1107 0 R >> endobj 1099 0 obj << /Title 1100 0 R /A 1097 0 R -/Parent 1091 0 R -/Prev 1095 0 R +/Parent 1095 0 R +/Next 1103 0 R >> endobj 1095 0 obj << /Title 1096 0 R /A 1093 0 R -/Parent 1091 0 R -/Next 1099 0 R +/Parent 487 0 R +/Prev 1039 0 R +/Next 1143 0 R +/First 1099 0 R +/Last 1139 0 R +/Count -6 >> endobj 1091 0 obj << /Title 1092 0 R /A 1089 0 R -/Parent 1063 0 R -/Prev 1075 0 R -/Next 1103 0 R -/First 1095 0 R -/Last 1099 0 R -/Count -2 +/Parent 1083 0 R +/Prev 1087 0 R >> endobj 1087 0 obj << /Title 1088 0 R /A 1085 0 R -/Parent 1075 0 R -/Prev 1083 0 R +/Parent 1083 0 R +/Next 1091 0 R >> endobj 1083 0 obj << /Title 1084 0 R /A 1081 0 R -/Parent 1075 0 R +/Parent 1039 0 R /Prev 1079 0 R -/Next 1087 0 R +/First 1087 0 R +/Last 1091 0 R +/Count -2 >> endobj 1079 0 obj << /Title 1080 0 R /A 1077 0 R -/Parent 1075 0 R +/Parent 1039 0 R +/Prev 1051 0 R /Next 1083 0 R >> endobj 1075 0 obj << /Title 1076 0 R /A 1073 0 R -/Parent 1063 0 R -/Prev 1071 0 R -/Next 1091 0 R -/First 1079 0 R -/Last 1087 0 R -/Count -3 +/Parent 1051 0 R +/Prev 1071 0 R >> endobj 1071 0 obj << /Title 1072 0 R /A 1069 0 R -/Parent 1063 0 R +/Parent 1051 0 R /Prev 1067 0 R /Next 1075 0 R >> endobj 1067 0 obj << /Title 1068 0 R /A 1065 0 R -/Parent 1063 0 R +/Parent 1051 0 R +/Prev 1063 0 R /Next 1071 0 R >> endobj 1063 0 obj << /Title 1064 0 R /A 1061 0 R -/Parent 463 0 R -/Prev 1007 0 R -/Next 1111 0 R -/First 1067 0 R -/Last 1107 0 R -/Count -6 +/Parent 1051 0 R +/Prev 1059 0 R +/Next 1067 0 R >> endobj 1059 0 obj << /Title 1060 0 R /A 1057 0 R /Parent 1051 0 R /Prev 1055 0 R +/Next 1063 0 R >> endobj 1055 0 obj << /Title 1056 0 R @@ -39216,45 +41549,47 @@ endobj 1051 0 obj << /Title 1052 0 R /A 1049 0 R -/Parent 1007 0 R +/Parent 1039 0 R /Prev 1047 0 R +/Next 1079 0 R /First 1055 0 R -/Last 1059 0 R -/Count -2 +/Last 1075 0 R +/Count -6 >> endobj 1047 0 obj << /Title 1048 0 R /A 1045 0 R -/Parent 1007 0 R -/Prev 1019 0 R +/Parent 1039 0 R +/Prev 1043 0 R /Next 1051 0 R >> endobj 1043 0 obj << /Title 1044 0 R /A 1041 0 R -/Parent 1019 0 R -/Prev 1039 0 R +/Parent 1039 0 R +/Next 1047 0 R >> endobj 1039 0 obj << /Title 1040 0 R /A 1037 0 R -/Parent 1019 0 R -/Prev 1035 0 R -/Next 1043 0 R +/Parent 487 0 R +/Prev 935 0 R +/Next 1095 0 R +/First 1043 0 R +/Last 1083 0 R +/Count -5 >> endobj 1035 0 obj << /Title 1036 0 R /A 1033 0 R -/Parent 1019 0 R -/Prev 1031 0 R -/Next 1039 0 R +/Parent 935 0 R +/Prev 1019 0 R >> endobj 1031 0 obj << /Title 1032 0 R /A 1029 0 R /Parent 1019 0 R /Prev 1027 0 R -/Next 1035 0 R >> endobj 1027 0 obj << /Title 1028 0 R @@ -39272,301 +41607,302 @@ endobj 1019 0 obj << /Title 1020 0 R /A 1017 0 R -/Parent 1007 0 R +/Parent 935 0 R /Prev 1015 0 R -/Next 1047 0 R +/Next 1035 0 R /First 1023 0 R -/Last 1043 0 R -/Count -6 +/Last 1031 0 R +/Count -3 >> endobj 1015 0 obj << /Title 1016 0 R /A 1013 0 R -/Parent 1007 0 R -/Prev 1011 0 R +/Parent 935 0 R +/Prev 1003 0 R /Next 1019 0 R >> endobj 1011 0 obj << /Title 1012 0 R /A 1009 0 R -/Parent 1007 0 R -/Next 1015 0 R +/Parent 1003 0 R +/Prev 1007 0 R >> endobj 1007 0 obj << /Title 1008 0 R /A 1005 0 R -/Parent 463 0 R -/Prev 903 0 R -/Next 1063 0 R -/First 1011 0 R -/Last 1051 0 R -/Count -5 +/Parent 1003 0 R +/Next 1011 0 R >> endobj 1003 0 obj << /Title 1004 0 R /A 1001 0 R -/Parent 903 0 R +/Parent 935 0 R /Prev 987 0 R +/Next 1015 0 R +/First 1007 0 R +/Last 1011 0 R +/Count -2 >> endobj 999 0 obj << /Title 1000 0 R /A 997 0 R -/Parent 987 0 R +/Parent 991 0 R /Prev 995 0 R >> endobj 995 0 obj << /Title 996 0 R /A 993 0 R -/Parent 987 0 R -/Prev 991 0 R +/Parent 991 0 R /Next 999 0 R >> endobj 991 0 obj << /Title 992 0 R /A 989 0 R /Parent 987 0 R -/Next 995 0 R +/First 995 0 R +/Last 999 0 R +/Count -2 >> endobj 987 0 obj << /Title 988 0 R /A 985 0 R -/Parent 903 0 R -/Prev 983 0 R +/Parent 935 0 R +/Prev 943 0 R /Next 1003 0 R /First 991 0 R -/Last 999 0 R -/Count -3 +/Last 991 0 R +/Count -1 >> endobj 983 0 obj << /Title 984 0 R /A 981 0 R -/Parent 903 0 R -/Prev 971 0 R -/Next 987 0 R +/Parent 947 0 R +/Prev 979 0 R >> endobj 979 0 obj << /Title 980 0 R /A 977 0 R -/Parent 971 0 R +/Parent 947 0 R /Prev 975 0 R +/Next 983 0 R >> endobj 975 0 obj << /Title 976 0 R /A 973 0 R -/Parent 971 0 R +/Parent 947 0 R +/Prev 971 0 R /Next 979 0 R >> endobj 971 0 obj << /Title 972 0 R /A 969 0 R -/Parent 903 0 R -/Prev 955 0 R -/Next 983 0 R -/First 975 0 R -/Last 979 0 R -/Count -2 +/Parent 947 0 R +/Prev 967 0 R +/Next 975 0 R >> endobj 967 0 obj << /Title 968 0 R /A 965 0 R -/Parent 959 0 R +/Parent 947 0 R /Prev 963 0 R +/Next 971 0 R >> endobj 963 0 obj << /Title 964 0 R /A 961 0 R -/Parent 959 0 R +/Parent 947 0 R +/Prev 959 0 R /Next 967 0 R >> endobj 959 0 obj << /Title 960 0 R /A 957 0 R -/Parent 955 0 R -/First 963 0 R -/Last 967 0 R -/Count -2 +/Parent 947 0 R +/Prev 955 0 R +/Next 963 0 R >> endobj 955 0 obj << /Title 956 0 R /A 953 0 R -/Parent 903 0 R -/Prev 911 0 R -/Next 971 0 R -/First 959 0 R -/Last 959 0 R -/Count -1 +/Parent 947 0 R +/Prev 951 0 R +/Next 959 0 R >> endobj 951 0 obj << /Title 952 0 R /A 949 0 R -/Parent 915 0 R -/Prev 947 0 R +/Parent 947 0 R +/Next 955 0 R >> endobj 947 0 obj << /Title 948 0 R /A 945 0 R -/Parent 915 0 R -/Prev 943 0 R -/Next 951 0 R +/Parent 943 0 R +/First 951 0 R +/Last 983 0 R +/Count -9 >> endobj 943 0 obj << /Title 944 0 R /A 941 0 R -/Parent 915 0 R +/Parent 935 0 R /Prev 939 0 R -/Next 947 0 R +/Next 987 0 R +/First 947 0 R +/Last 947 0 R +/Count -1 >> endobj 939 0 obj << /Title 940 0 R /A 937 0 R -/Parent 915 0 R -/Prev 935 0 R +/Parent 935 0 R /Next 943 0 R >> endobj 935 0 obj << /Title 936 0 R /A 933 0 R -/Parent 915 0 R -/Prev 931 0 R -/Next 939 0 R +/Parent 487 0 R +/Prev 823 0 R +/Next 1039 0 R +/First 939 0 R +/Last 1035 0 R +/Count -7 >> endobj 931 0 obj << /Title 932 0 R /A 929 0 R -/Parent 915 0 R +/Parent 919 0 R /Prev 927 0 R -/Next 935 0 R >> endobj 927 0 obj << /Title 928 0 R /A 925 0 R -/Parent 915 0 R +/Parent 919 0 R /Prev 923 0 R /Next 931 0 R >> endobj 923 0 obj << /Title 924 0 R /A 921 0 R -/Parent 915 0 R -/Prev 919 0 R +/Parent 919 0 R /Next 927 0 R >> endobj 919 0 obj << /Title 920 0 R /A 917 0 R -/Parent 915 0 R -/Next 923 0 R +/Parent 823 0 R +/Prev 879 0 R +/First 923 0 R +/Last 931 0 R +/Count -3 >> endobj 915 0 obj << /Title 916 0 R /A 913 0 R -/Parent 911 0 R -/First 919 0 R -/Last 951 0 R -/Count -9 +/Parent 879 0 R +/Prev 911 0 R >> endobj 911 0 obj << /Title 912 0 R /A 909 0 R -/Parent 903 0 R +/Parent 879 0 R /Prev 907 0 R -/Next 955 0 R -/First 915 0 R -/Last 915 0 R -/Count -1 +/Next 915 0 R >> endobj 907 0 obj << /Title 908 0 R /A 905 0 R -/Parent 903 0 R +/Parent 879 0 R +/Prev 895 0 R /Next 911 0 R >> endobj 903 0 obj << /Title 904 0 R /A 901 0 R -/Parent 463 0 R -/Prev 791 0 R -/Next 1007 0 R -/First 907 0 R -/Last 1003 0 R -/Count -7 +/Parent 895 0 R +/Prev 899 0 R >> endobj 899 0 obj << /Title 900 0 R /A 897 0 R -/Parent 887 0 R -/Prev 895 0 R +/Parent 895 0 R +/Next 903 0 R >> endobj 895 0 obj << /Title 896 0 R /A 893 0 R -/Parent 887 0 R +/Parent 879 0 R /Prev 891 0 R -/Next 899 0 R +/Next 907 0 R +/First 899 0 R +/Last 903 0 R +/Count -2 >> endobj 891 0 obj << /Title 892 0 R /A 889 0 R -/Parent 887 0 R +/Parent 879 0 R +/Prev 887 0 R /Next 895 0 R >> endobj 887 0 obj << /Title 888 0 R /A 885 0 R -/Parent 791 0 R -/Prev 847 0 R -/First 891 0 R -/Last 899 0 R -/Count -3 +/Parent 879 0 R +/Prev 883 0 R +/Next 891 0 R >> endobj 883 0 obj << /Title 884 0 R /A 881 0 R -/Parent 847 0 R -/Prev 879 0 R +/Parent 879 0 R +/Next 887 0 R >> endobj 879 0 obj << /Title 880 0 R /A 877 0 R -/Parent 847 0 R -/Prev 875 0 R -/Next 883 0 R +/Parent 823 0 R +/Prev 863 0 R +/Next 919 0 R +/First 883 0 R +/Last 915 0 R +/Count -7 >> endobj 875 0 obj << /Title 876 0 R /A 873 0 R -/Parent 847 0 R -/Prev 863 0 R -/Next 879 0 R +/Parent 867 0 R +/Prev 871 0 R >> endobj 871 0 obj << /Title 872 0 R /A 869 0 R -/Parent 863 0 R -/Prev 867 0 R +/Parent 867 0 R +/Next 875 0 R >> endobj 867 0 obj << /Title 868 0 R /A 865 0 R /Parent 863 0 R -/Next 871 0 R +/First 871 0 R +/Last 875 0 R +/Count -2 >> endobj 863 0 obj << /Title 864 0 R /A 861 0 R -/Parent 847 0 R -/Prev 859 0 R -/Next 875 0 R +/Parent 823 0 R +/Prev 847 0 R +/Next 879 0 R /First 867 0 R -/Last 871 0 R -/Count -2 +/Last 867 0 R +/Count -1 >> endobj 859 0 obj << /Title 860 0 R /A 857 0 R /Parent 847 0 R /Prev 855 0 R -/Next 863 0 R >> endobj 855 0 obj << /Title 856 0 R @@ -39584,129 +41920,129 @@ endobj 847 0 obj << /Title 848 0 R /A 845 0 R -/Parent 791 0 R +/Parent 823 0 R /Prev 831 0 R -/Next 887 0 R +/Next 863 0 R /First 851 0 R -/Last 883 0 R -/Count -7 +/Last 859 0 R +/Count -3 >> endobj 843 0 obj << /Title 844 0 R /A 841 0 R -/Parent 835 0 R +/Parent 831 0 R /Prev 839 0 R >> endobj 839 0 obj << /Title 840 0 R /A 837 0 R -/Parent 835 0 R +/Parent 831 0 R +/Prev 835 0 R /Next 843 0 R >> endobj 835 0 obj << /Title 836 0 R /A 833 0 R /Parent 831 0 R -/First 839 0 R -/Last 843 0 R -/Count -2 +/Next 839 0 R >> endobj 831 0 obj << /Title 832 0 R /A 829 0 R -/Parent 791 0 R -/Prev 815 0 R +/Parent 823 0 R +/Prev 827 0 R /Next 847 0 R /First 835 0 R -/Last 835 0 R -/Count -1 +/Last 843 0 R +/Count -3 >> endobj 827 0 obj << /Title 828 0 R /A 825 0 R -/Parent 815 0 R -/Prev 823 0 R +/Parent 823 0 R +/Next 831 0 R >> endobj 823 0 obj << /Title 824 0 R /A 821 0 R -/Parent 815 0 R -/Prev 819 0 R -/Next 827 0 R +/Parent 487 0 R +/Prev 775 0 R +/Next 935 0 R +/First 827 0 R +/Last 919 0 R +/Count -6 >> endobj 819 0 obj << /Title 820 0 R /A 817 0 R -/Parent 815 0 R -/Next 823 0 R +/Parent 807 0 R +/Prev 815 0 R >> endobj 815 0 obj << /Title 816 0 R /A 813 0 R -/Parent 791 0 R -/Prev 799 0 R -/Next 831 0 R -/First 819 0 R -/Last 827 0 R -/Count -3 +/Parent 807 0 R +/Prev 811 0 R +/Next 819 0 R >> endobj 811 0 obj << /Title 812 0 R /A 809 0 R -/Parent 799 0 R -/Prev 807 0 R +/Parent 807 0 R +/Next 815 0 R >> endobj 807 0 obj << /Title 808 0 R /A 805 0 R -/Parent 799 0 R -/Prev 803 0 R -/Next 811 0 R +/Parent 775 0 R +/Prev 795 0 R +/First 811 0 R +/Last 819 0 R +/Count -3 >> endobj 803 0 obj << /Title 804 0 R /A 801 0 R -/Parent 799 0 R -/Next 807 0 R +/Parent 795 0 R +/Prev 799 0 R >> endobj 799 0 obj << /Title 800 0 R /A 797 0 R -/Parent 791 0 R -/Prev 795 0 R -/Next 815 0 R -/First 803 0 R -/Last 811 0 R -/Count -3 +/Parent 795 0 R +/Next 803 0 R >> endobj 795 0 obj << /Title 796 0 R /A 793 0 R -/Parent 791 0 R -/Next 799 0 R +/Parent 775 0 R +/Prev 783 0 R +/Next 807 0 R +/First 799 0 R +/Last 803 0 R +/Count -2 >> endobj 791 0 obj << /Title 792 0 R /A 789 0 R -/Parent 463 0 R -/Prev 747 0 R -/Next 903 0 R -/First 795 0 R -/Last 887 0 R -/Count -6 +/Parent 783 0 R +/Prev 787 0 R >> endobj 787 0 obj << /Title 788 0 R /A 785 0 R -/Parent 775 0 R -/Prev 783 0 R +/Parent 783 0 R +/Next 791 0 R >> endobj 783 0 obj << /Title 784 0 R /A 781 0 R /Parent 775 0 R /Prev 779 0 R -/Next 787 0 R +/Next 795 0 R +/First 787 0 R +/Last 791 0 R +/Count -2 >> endobj 779 0 obj << /Title 780 0 R @@ -39717,196 +42053,196 @@ endobj 775 0 obj << /Title 776 0 R /A 773 0 R -/Parent 747 0 R -/Prev 763 0 R +/Parent 487 0 R +/Prev 623 0 R +/Next 823 0 R /First 779 0 R -/Last 787 0 R -/Count -3 +/Last 807 0 R +/Count -4 >> endobj 771 0 obj << /Title 772 0 R /A 769 0 R -/Parent 763 0 R +/Parent 759 0 R /Prev 767 0 R >> endobj 767 0 obj << /Title 768 0 R /A 765 0 R -/Parent 763 0 R +/Parent 759 0 R +/Prev 763 0 R /Next 771 0 R >> endobj 763 0 obj << /Title 764 0 R /A 761 0 R -/Parent 747 0 R -/Prev 755 0 R -/Next 775 0 R -/First 767 0 R -/Last 771 0 R -/Count -2 +/Parent 759 0 R +/Next 767 0 R >> endobj 759 0 obj << /Title 760 0 R /A 757 0 R -/Parent 755 0 R +/Parent 623 0 R +/Prev 675 0 R +/First 763 0 R +/Last 771 0 R +/Count -3 >> endobj 755 0 obj << /Title 756 0 R /A 753 0 R -/Parent 747 0 R -/Prev 751 0 R -/Next 763 0 R -/First 759 0 R -/Last 759 0 R -/Count -1 +/Parent 675 0 R +/Prev 735 0 R >> endobj 751 0 obj << /Title 752 0 R /A 749 0 R -/Parent 747 0 R -/Next 755 0 R +/Parent 735 0 R +/Prev 747 0 R >> endobj 747 0 obj << /Title 748 0 R /A 745 0 R -/Parent 463 0 R -/Prev 595 0 R -/Next 791 0 R -/First 751 0 R -/Last 775 0 R -/Count -4 +/Parent 735 0 R +/Prev 743 0 R +/Next 751 0 R >> endobj 743 0 obj << /Title 744 0 R /A 741 0 R -/Parent 731 0 R +/Parent 735 0 R /Prev 739 0 R +/Next 747 0 R >> endobj 739 0 obj << /Title 740 0 R /A 737 0 R -/Parent 731 0 R -/Prev 735 0 R +/Parent 735 0 R /Next 743 0 R >> endobj 735 0 obj << /Title 736 0 R /A 733 0 R -/Parent 731 0 R -/Next 739 0 R +/Parent 675 0 R +/Prev 691 0 R +/Next 755 0 R +/First 739 0 R +/Last 751 0 R +/Count -4 >> endobj 731 0 obj << /Title 732 0 R /A 729 0 R -/Parent 595 0 R -/Prev 647 0 R -/First 735 0 R -/Last 743 0 R -/Count -3 +/Parent 691 0 R +/Prev 727 0 R >> endobj 727 0 obj << /Title 728 0 R /A 725 0 R -/Parent 647 0 R -/Prev 707 0 R +/Parent 691 0 R +/Prev 723 0 R +/Next 731 0 R >> endobj 723 0 obj << /Title 724 0 R /A 721 0 R -/Parent 707 0 R +/Parent 691 0 R /Prev 719 0 R +/Next 727 0 R >> endobj 719 0 obj << /Title 720 0 R /A 717 0 R -/Parent 707 0 R +/Parent 691 0 R /Prev 715 0 R /Next 723 0 R >> endobj 715 0 obj << /Title 716 0 R /A 713 0 R -/Parent 707 0 R +/Parent 691 0 R /Prev 711 0 R /Next 719 0 R >> endobj 711 0 obj << /Title 712 0 R /A 709 0 R -/Parent 707 0 R +/Parent 691 0 R +/Prev 707 0 R /Next 715 0 R >> endobj 707 0 obj << /Title 708 0 R /A 705 0 R -/Parent 647 0 R -/Prev 663 0 R -/Next 727 0 R -/First 711 0 R -/Last 723 0 R -/Count -4 +/Parent 691 0 R +/Prev 703 0 R +/Next 711 0 R >> endobj 703 0 obj << /Title 704 0 R /A 701 0 R -/Parent 663 0 R +/Parent 691 0 R /Prev 699 0 R +/Next 707 0 R >> endobj 699 0 obj << /Title 700 0 R /A 697 0 R -/Parent 663 0 R +/Parent 691 0 R /Prev 695 0 R /Next 703 0 R >> endobj 695 0 obj << /Title 696 0 R /A 693 0 R -/Parent 663 0 R -/Prev 691 0 R +/Parent 691 0 R /Next 699 0 R >> endobj 691 0 obj << /Title 692 0 R /A 689 0 R -/Parent 663 0 R +/Parent 675 0 R /Prev 687 0 R -/Next 695 0 R +/Next 735 0 R +/First 695 0 R +/Last 731 0 R +/Count -10 >> endobj 687 0 obj << /Title 688 0 R /A 685 0 R -/Parent 663 0 R +/Parent 675 0 R /Prev 683 0 R /Next 691 0 R >> endobj 683 0 obj << /Title 684 0 R /A 681 0 R -/Parent 663 0 R +/Parent 675 0 R /Prev 679 0 R /Next 687 0 R >> endobj 679 0 obj << /Title 680 0 R /A 677 0 R -/Parent 663 0 R -/Prev 675 0 R +/Parent 675 0 R /Next 683 0 R >> endobj 675 0 obj << /Title 676 0 R /A 673 0 R -/Parent 663 0 R -/Prev 671 0 R -/Next 679 0 R +/Parent 623 0 R +/Prev 663 0 R +/Next 759 0 R +/First 679 0 R +/Last 755 0 R +/Count -6 >> endobj 671 0 obj << /Title 672 0 R /A 669 0 R /Parent 663 0 R /Prev 667 0 R -/Next 675 0 R >> endobj 667 0 obj << /Title 668 0 R @@ -39917,530 +42253,528 @@ endobj 663 0 obj << /Title 664 0 R /A 661 0 R -/Parent 647 0 R -/Prev 659 0 R -/Next 707 0 R +/Parent 623 0 R +/Prev 639 0 R +/Next 675 0 R /First 667 0 R -/Last 703 0 R -/Count -10 +/Last 671 0 R +/Count -2 >> endobj 659 0 obj << /Title 660 0 R /A 657 0 R -/Parent 647 0 R +/Parent 639 0 R /Prev 655 0 R -/Next 663 0 R >> endobj 655 0 obj << /Title 656 0 R /A 653 0 R -/Parent 647 0 R -/Prev 651 0 R +/Parent 639 0 R +/Prev 643 0 R /Next 659 0 R >> endobj 651 0 obj << /Title 652 0 R /A 649 0 R -/Parent 647 0 R -/Next 655 0 R +/Parent 643 0 R +/Prev 647 0 R >> endobj 647 0 obj << /Title 648 0 R /A 645 0 R -/Parent 595 0 R -/Prev 635 0 R -/Next 731 0 R -/First 651 0 R -/Last 727 0 R -/Count -6 +/Parent 643 0 R +/Next 651 0 R >> endobj 643 0 obj << /Title 644 0 R /A 641 0 R -/Parent 635 0 R -/Prev 639 0 R +/Parent 639 0 R +/Next 655 0 R +/First 647 0 R +/Last 651 0 R +/Count -2 >> endobj 639 0 obj << /Title 640 0 R /A 637 0 R -/Parent 635 0 R -/Next 643 0 R +/Parent 623 0 R +/Prev 627 0 R +/Next 663 0 R +/First 643 0 R +/Last 659 0 R +/Count -3 >> endobj 635 0 obj << /Title 636 0 R /A 633 0 R -/Parent 595 0 R -/Prev 611 0 R -/Next 647 0 R -/First 639 0 R -/Last 643 0 R -/Count -2 +/Parent 627 0 R +/Prev 631 0 R >> endobj 631 0 obj << /Title 632 0 R /A 629 0 R -/Parent 611 0 R -/Prev 627 0 R +/Parent 627 0 R +/Next 635 0 R >> endobj 627 0 obj << /Title 628 0 R /A 625 0 R -/Parent 611 0 R -/Prev 615 0 R -/Next 631 0 R +/Parent 623 0 R +/Next 639 0 R +/First 631 0 R +/Last 635 0 R +/Count -2 >> endobj 623 0 obj << /Title 624 0 R /A 621 0 R -/Parent 615 0 R -/Prev 619 0 R +/Parent 487 0 R +/Prev 491 0 R +/Next 775 0 R +/First 627 0 R +/Last 759 0 R +/Count -5 >> endobj 619 0 obj << /Title 620 0 R /A 617 0 R -/Parent 615 0 R -/Next 623 0 R +/Parent 603 0 R +/Prev 615 0 R >> endobj 615 0 obj << /Title 616 0 R /A 613 0 R -/Parent 611 0 R -/Next 627 0 R -/First 619 0 R -/Last 623 0 R -/Count -2 +/Parent 603 0 R +/Prev 611 0 R +/Next 619 0 R >> endobj 611 0 obj << /Title 612 0 R /A 609 0 R -/Parent 595 0 R -/Prev 599 0 R -/Next 635 0 R -/First 615 0 R -/Last 631 0 R -/Count -3 +/Parent 603 0 R +/Prev 607 0 R +/Next 615 0 R >> endobj 607 0 obj << /Title 608 0 R /A 605 0 R -/Parent 599 0 R -/Prev 603 0 R +/Parent 603 0 R +/Next 611 0 R >> endobj 603 0 obj << /Title 604 0 R /A 601 0 R -/Parent 599 0 R -/Next 607 0 R +/Parent 491 0 R +/Prev 583 0 R +/First 607 0 R +/Last 619 0 R +/Count -4 >> endobj 599 0 obj << /Title 600 0 R /A 597 0 R /Parent 595 0 R -/Next 611 0 R -/First 603 0 R -/Last 607 0 R -/Count -2 >> endobj 595 0 obj << /Title 596 0 R /A 593 0 R -/Parent 463 0 R -/Prev 467 0 R -/Next 747 0 R +/Parent 583 0 R +/Prev 591 0 R /First 599 0 R -/Last 731 0 R -/Count -5 +/Last 599 0 R +/Count -1 >> endobj 591 0 obj << /Title 592 0 R /A 589 0 R -/Parent 579 0 R +/Parent 583 0 R /Prev 587 0 R +/Next 595 0 R >> endobj 587 0 obj << /Title 588 0 R /A 585 0 R -/Parent 579 0 R -/Prev 583 0 R +/Parent 583 0 R /Next 591 0 R >> endobj 583 0 obj << /Title 584 0 R /A 581 0 R -/Parent 579 0 R -/Next 587 0 R +/Parent 491 0 R +/Prev 571 0 R +/Next 603 0 R +/First 587 0 R +/Last 595 0 R +/Count -3 >> endobj 579 0 obj << /Title 580 0 R /A 577 0 R -/Parent 467 0 R -/Prev 559 0 R -/First 583 0 R -/Last 591 0 R -/Count -3 +/Parent 571 0 R +/Prev 575 0 R >> endobj 575 0 obj << /Title 576 0 R /A 573 0 R /Parent 571 0 R +/Next 579 0 R >> endobj 571 0 obj << /Title 572 0 R /A 569 0 R -/Parent 559 0 R -/Prev 567 0 R +/Parent 491 0 R +/Prev 555 0 R +/Next 583 0 R /First 575 0 R -/Last 575 0 R -/Count -1 +/Last 579 0 R +/Count -2 >> endobj 567 0 obj << /Title 568 0 R /A 565 0 R -/Parent 559 0 R +/Parent 555 0 R /Prev 563 0 R -/Next 571 0 R >> endobj 563 0 obj << /Title 564 0 R /A 561 0 R -/Parent 559 0 R +/Parent 555 0 R +/Prev 559 0 R /Next 567 0 R >> endobj 559 0 obj << /Title 560 0 R /A 557 0 R -/Parent 467 0 R -/Prev 547 0 R -/Next 579 0 R -/First 563 0 R -/Last 571 0 R -/Count -3 +/Parent 555 0 R +/Next 563 0 R >> endobj 555 0 obj << /Title 556 0 R /A 553 0 R -/Parent 547 0 R -/Prev 551 0 R +/Parent 491 0 R +/Prev 519 0 R +/Next 571 0 R +/First 559 0 R +/Last 567 0 R +/Count -3 >> endobj 551 0 obj << /Title 552 0 R /A 549 0 R -/Parent 547 0 R -/Next 555 0 R +/Parent 519 0 R +/Prev 547 0 R >> endobj 547 0 obj << /Title 548 0 R /A 545 0 R -/Parent 467 0 R -/Prev 531 0 R -/Next 559 0 R -/First 551 0 R -/Last 555 0 R -/Count -2 +/Parent 519 0 R +/Prev 543 0 R +/Next 551 0 R >> endobj 543 0 obj << /Title 544 0 R /A 541 0 R -/Parent 531 0 R +/Parent 519 0 R /Prev 539 0 R +/Next 547 0 R >> endobj 539 0 obj << /Title 540 0 R /A 537 0 R -/Parent 531 0 R +/Parent 519 0 R /Prev 535 0 R /Next 543 0 R >> endobj 535 0 obj << /Title 536 0 R /A 533 0 R -/Parent 531 0 R +/Parent 519 0 R +/Prev 531 0 R /Next 539 0 R >> endobj 531 0 obj << /Title 532 0 R /A 529 0 R -/Parent 467 0 R -/Prev 495 0 R -/Next 547 0 R -/First 535 0 R -/Last 543 0 R -/Count -3 +/Parent 519 0 R +/Prev 527 0 R +/Next 535 0 R >> endobj 527 0 obj << /Title 528 0 R /A 525 0 R -/Parent 495 0 R +/Parent 519 0 R /Prev 523 0 R +/Next 531 0 R >> endobj 523 0 obj << /Title 524 0 R /A 521 0 R -/Parent 495 0 R -/Prev 519 0 R +/Parent 519 0 R /Next 527 0 R >> endobj 519 0 obj << /Title 520 0 R /A 517 0 R -/Parent 495 0 R -/Prev 515 0 R -/Next 523 0 R +/Parent 491 0 R +/Prev 503 0 R +/Next 555 0 R +/First 523 0 R +/Last 551 0 R +/Count -8 >> endobj 515 0 obj << /Title 516 0 R /A 513 0 R -/Parent 495 0 R +/Parent 503 0 R /Prev 511 0 R -/Next 519 0 R >> endobj 511 0 obj << /Title 512 0 R /A 509 0 R -/Parent 495 0 R +/Parent 503 0 R /Prev 507 0 R /Next 515 0 R >> endobj 507 0 obj << /Title 508 0 R /A 505 0 R -/Parent 495 0 R -/Prev 503 0 R +/Parent 503 0 R /Next 511 0 R >> endobj 503 0 obj << /Title 504 0 R /A 501 0 R -/Parent 495 0 R +/Parent 491 0 R /Prev 499 0 R -/Next 507 0 R +/Next 519 0 R +/First 507 0 R +/Last 515 0 R +/Count -3 >> endobj 499 0 obj << /Title 500 0 R /A 497 0 R -/Parent 495 0 R +/Parent 491 0 R +/Prev 495 0 R /Next 503 0 R >> endobj 495 0 obj << /Title 496 0 R /A 493 0 R -/Parent 467 0 R -/Prev 479 0 R -/Next 531 0 R -/First 499 0 R -/Last 527 0 R -/Count -8 +/Parent 491 0 R +/Next 499 0 R >> endobj 491 0 obj << /Title 492 0 R /A 489 0 R -/Parent 479 0 R -/Prev 487 0 R +/Parent 487 0 R +/Next 623 0 R +/First 495 0 R +/Last 603 0 R +/Count -8 >> endobj 487 0 obj << /Title 488 0 R /A 485 0 R -/Parent 479 0 R -/Prev 483 0 R -/Next 491 0 R +/Parent 7585 0 R +/Prev 107 0 R +/Next 2491 0 R +/First 491 0 R +/Last 2483 0 R +/Count -20 >> endobj 483 0 obj << /Title 484 0 R /A 481 0 R /Parent 479 0 R -/Next 487 0 R >> endobj 479 0 obj << /Title 480 0 R /A 477 0 R -/Parent 467 0 R -/Prev 475 0 R -/Next 495 0 R +/Parent 107 0 R +/Prev 451 0 R /First 483 0 R -/Last 491 0 R -/Count -3 +/Last 483 0 R +/Count -1 >> endobj 475 0 obj << /Title 476 0 R /A 473 0 R -/Parent 467 0 R -/Prev 471 0 R -/Next 479 0 R +/Parent 451 0 R +/Prev 463 0 R >> endobj 471 0 obj << /Title 472 0 R /A 469 0 R -/Parent 467 0 R -/Next 475 0 R +/Parent 463 0 R +/Prev 467 0 R >> endobj 467 0 obj << /Title 468 0 R /A 465 0 R /Parent 463 0 R -/Next 595 0 R -/First 471 0 R -/Last 579 0 R -/Count -8 +/Next 471 0 R >> endobj 463 0 obj << /Title 464 0 R /A 461 0 R -/Parent 7250 0 R -/Prev 103 0 R -/Next 2459 0 R +/Parent 451 0 R +/Prev 459 0 R +/Next 475 0 R /First 467 0 R -/Last 2451 0 R -/Count -20 +/Last 471 0 R +/Count -2 >> endobj 459 0 obj << /Title 460 0 R /A 457 0 R -/Parent 455 0 R +/Parent 451 0 R +/Prev 455 0 R +/Next 463 0 R >> endobj 455 0 obj << /Title 456 0 R /A 453 0 R -/Parent 103 0 R -/Prev 427 0 R -/First 459 0 R -/Last 459 0 R -/Count -1 +/Parent 451 0 R +/Next 459 0 R >> endobj 451 0 obj << /Title 452 0 R /A 449 0 R -/Parent 427 0 R -/Prev 439 0 R +/Parent 107 0 R +/Prev 347 0 R +/Next 479 0 R +/First 455 0 R +/Last 475 0 R +/Count -4 >> endobj 447 0 obj << /Title 448 0 R /A 445 0 R -/Parent 439 0 R +/Parent 435 0 R /Prev 443 0 R >> endobj 443 0 obj << /Title 444 0 R /A 441 0 R -/Parent 439 0 R +/Parent 435 0 R +/Prev 439 0 R /Next 447 0 R >> endobj 439 0 obj << /Title 440 0 R /A 437 0 R -/Parent 427 0 R -/Prev 435 0 R -/Next 451 0 R -/First 443 0 R -/Last 447 0 R -/Count -2 +/Parent 435 0 R +/Next 443 0 R >> endobj 435 0 obj << /Title 436 0 R /A 433 0 R -/Parent 427 0 R +/Parent 347 0 R /Prev 431 0 R -/Next 439 0 R +/First 439 0 R +/Last 447 0 R +/Count -3 >> endobj 431 0 obj << /Title 432 0 R /A 429 0 R -/Parent 427 0 R +/Parent 347 0 R +/Prev 399 0 R /Next 435 0 R >> endobj 427 0 obj << /Title 428 0 R /A 425 0 R -/Parent 103 0 R -/Prev 331 0 R -/Next 455 0 R -/First 431 0 R -/Last 451 0 R -/Count -4 +/Parent 399 0 R +/Prev 423 0 R >> endobj 423 0 obj << /Title 424 0 R /A 421 0 R -/Parent 415 0 R +/Parent 399 0 R /Prev 419 0 R +/Next 427 0 R >> endobj 419 0 obj << /Title 420 0 R /A 417 0 R -/Parent 415 0 R +/Parent 399 0 R +/Prev 411 0 R /Next 423 0 R >> endobj 415 0 obj << /Title 416 0 R /A 413 0 R -/Parent 331 0 R -/Prev 383 0 R -/First 419 0 R -/Last 423 0 R -/Count -2 +/Parent 411 0 R >> endobj 411 0 obj << /Title 412 0 R /A 409 0 R -/Parent 383 0 R +/Parent 399 0 R /Prev 407 0 R +/Next 419 0 R +/First 415 0 R +/Last 415 0 R +/Count -1 >> endobj 407 0 obj << /Title 408 0 R /A 405 0 R -/Parent 383 0 R +/Parent 399 0 R /Prev 403 0 R /Next 411 0 R >> endobj 403 0 obj << /Title 404 0 R /A 401 0 R -/Parent 383 0 R -/Prev 395 0 R +/Parent 399 0 R /Next 407 0 R >> endobj 399 0 obj << /Title 400 0 R /A 397 0 R -/Parent 395 0 R +/Parent 347 0 R +/Prev 387 0 R +/Next 431 0 R +/First 403 0 R +/Last 427 0 R +/Count -6 >> endobj 395 0 obj << /Title 396 0 R /A 393 0 R -/Parent 383 0 R +/Parent 387 0 R /Prev 391 0 R -/Next 403 0 R -/First 399 0 R -/Last 399 0 R -/Count -1 >> endobj 391 0 obj << /Title 392 0 R /A 389 0 R -/Parent 383 0 R -/Prev 387 0 R +/Parent 387 0 R /Next 395 0 R >> endobj 387 0 obj << /Title 388 0 R /A 385 0 R -/Parent 383 0 R -/Next 391 0 R +/Parent 347 0 R +/Prev 355 0 R +/Next 399 0 R +/First 391 0 R +/Last 395 0 R +/Count -2 >> endobj 383 0 obj << /Title 384 0 R /A 381 0 R -/Parent 331 0 R -/Prev 371 0 R -/Next 415 0 R -/First 387 0 R -/Last 411 0 R -/Count -6 +/Parent 371 0 R +/Prev 379 0 R >> endobj 379 0 obj << /Title 380 0 R /A 377 0 R /Parent 371 0 R /Prev 375 0 R +/Next 383 0 R >> endobj 375 0 obj << /Title 376 0 R @@ -40451,18 +42785,18 @@ endobj 371 0 obj << /Title 372 0 R /A 369 0 R -/Parent 331 0 R -/Prev 339 0 R -/Next 383 0 R +/Parent 355 0 R +/Prev 367 0 R /First 375 0 R -/Last 379 0 R -/Count -2 +/Last 383 0 R +/Count -3 >> endobj 367 0 obj << /Title 368 0 R /A 365 0 R /Parent 355 0 R /Prev 363 0 R +/Next 371 0 R >> endobj 363 0 obj << /Title 364 0 R @@ -40480,518 +42814,518 @@ endobj 355 0 obj << /Title 356 0 R /A 353 0 R -/Parent 339 0 R +/Parent 347 0 R /Prev 351 0 R +/Next 387 0 R /First 359 0 R -/Last 367 0 R -/Count -3 +/Last 371 0 R +/Count -4 >> endobj 351 0 obj << /Title 352 0 R /A 349 0 R -/Parent 339 0 R -/Prev 347 0 R +/Parent 347 0 R /Next 355 0 R >> endobj 347 0 obj << /Title 348 0 R /A 345 0 R -/Parent 339 0 R -/Prev 343 0 R -/Next 351 0 R +/Parent 107 0 R +/Prev 275 0 R +/Next 451 0 R +/First 351 0 R +/Last 435 0 R +/Count -6 >> endobj 343 0 obj << /Title 344 0 R /A 341 0 R -/Parent 339 0 R -/Next 347 0 R +/Parent 327 0 R +/Prev 339 0 R >> endobj 339 0 obj << /Title 340 0 R /A 337 0 R -/Parent 331 0 R +/Parent 327 0 R /Prev 335 0 R -/Next 371 0 R -/First 343 0 R -/Last 355 0 R -/Count -4 +/Next 343 0 R >> endobj 335 0 obj << /Title 336 0 R /A 333 0 R -/Parent 331 0 R +/Parent 327 0 R +/Prev 331 0 R /Next 339 0 R >> endobj 331 0 obj << /Title 332 0 R /A 329 0 R -/Parent 103 0 R -/Prev 271 0 R -/Next 427 0 R -/First 335 0 R -/Last 415 0 R -/Count -5 +/Parent 327 0 R +/Next 335 0 R >> endobj 327 0 obj << /Title 328 0 R /A 325 0 R -/Parent 311 0 R -/Prev 323 0 R +/Parent 275 0 R +/Prev 319 0 R +/First 331 0 R +/Last 343 0 R +/Count -4 >> endobj 323 0 obj << /Title 324 0 R /A 321 0 R -/Parent 311 0 R -/Prev 319 0 R -/Next 327 0 R +/Parent 319 0 R >> endobj 319 0 obj << /Title 320 0 R /A 317 0 R -/Parent 311 0 R -/Prev 315 0 R -/Next 323 0 R +/Parent 275 0 R +/Prev 283 0 R +/Next 327 0 R +/First 323 0 R +/Last 323 0 R +/Count -1 >> endobj 315 0 obj << /Title 316 0 R /A 313 0 R -/Parent 311 0 R -/Next 319 0 R +/Parent 307 0 R +/Prev 311 0 R >> endobj 311 0 obj << /Title 312 0 R /A 309 0 R -/Parent 271 0 R -/Prev 303 0 R -/First 315 0 R -/Last 327 0 R -/Count -4 +/Parent 307 0 R +/Next 315 0 R >> endobj 307 0 obj << /Title 308 0 R /A 305 0 R -/Parent 303 0 R +/Parent 283 0 R +/Prev 303 0 R +/First 311 0 R +/Last 315 0 R +/Count -2 >> endobj 303 0 obj << /Title 304 0 R /A 301 0 R -/Parent 271 0 R -/Prev 279 0 R -/Next 311 0 R -/First 307 0 R -/Last 307 0 R -/Count -1 +/Parent 283 0 R +/Prev 299 0 R +/Next 307 0 R >> endobj 299 0 obj << /Title 300 0 R /A 297 0 R -/Parent 279 0 R +/Parent 283 0 R /Prev 295 0 R +/Next 303 0 R >> endobj 295 0 obj << /Title 296 0 R /A 293 0 R -/Parent 279 0 R -/Prev 291 0 R +/Parent 283 0 R +/Prev 287 0 R /Next 299 0 R >> endobj 291 0 obj << /Title 292 0 R /A 289 0 R -/Parent 279 0 R -/Prev 283 0 R -/Next 295 0 R +/Parent 287 0 R >> endobj 287 0 obj << /Title 288 0 R /A 285 0 R /Parent 283 0 R +/Next 295 0 R +/First 291 0 R +/Last 291 0 R +/Count -1 >> endobj 283 0 obj << /Title 284 0 R /A 281 0 R -/Parent 279 0 R -/Next 291 0 R +/Parent 275 0 R +/Prev 279 0 R +/Next 319 0 R /First 287 0 R -/Last 287 0 R -/Count -1 +/Last 307 0 R +/Count -5 >> endobj 279 0 obj << /Title 280 0 R /A 277 0 R -/Parent 271 0 R -/Prev 275 0 R -/Next 303 0 R -/First 283 0 R -/Last 299 0 R -/Count -4 +/Parent 275 0 R +/Next 283 0 R >> endobj 275 0 obj << /Title 276 0 R /A 273 0 R -/Parent 271 0 R -/Next 279 0 R +/Parent 107 0 R +/Prev 191 0 R +/Next 347 0 R +/First 279 0 R +/Last 327 0 R +/Count -4 >> endobj 271 0 obj << /Title 272 0 R /A 269 0 R -/Parent 103 0 R -/Prev 187 0 R -/Next 331 0 R -/First 275 0 R -/Last 311 0 R -/Count -4 +/Parent 243 0 R +/Prev 267 0 R >> endobj 267 0 obj << /Title 268 0 R /A 265 0 R -/Parent 239 0 R +/Parent 243 0 R /Prev 263 0 R +/Next 271 0 R >> endobj 263 0 obj << /Title 264 0 R /A 261 0 R -/Parent 239 0 R +/Parent 243 0 R /Prev 259 0 R /Next 267 0 R >> endobj 259 0 obj << /Title 260 0 R /A 257 0 R -/Parent 239 0 R +/Parent 243 0 R /Prev 255 0 R /Next 263 0 R >> endobj 255 0 obj << /Title 256 0 R /A 253 0 R -/Parent 239 0 R +/Parent 243 0 R /Prev 251 0 R /Next 259 0 R >> endobj 251 0 obj << /Title 252 0 R /A 249 0 R -/Parent 239 0 R +/Parent 243 0 R /Prev 247 0 R /Next 255 0 R >> endobj 247 0 obj << /Title 248 0 R /A 245 0 R -/Parent 239 0 R -/Prev 243 0 R +/Parent 243 0 R /Next 251 0 R >> endobj 243 0 obj << /Title 244 0 R /A 241 0 R -/Parent 239 0 R -/Next 247 0 R +/Parent 191 0 R +/Prev 219 0 R +/First 247 0 R +/Last 271 0 R +/Count -7 >> endobj 239 0 obj << /Title 240 0 R /A 237 0 R -/Parent 187 0 R -/Prev 215 0 R -/First 243 0 R -/Last 267 0 R -/Count -7 +/Parent 219 0 R +/Prev 223 0 R >> endobj 235 0 obj << /Title 236 0 R /A 233 0 R -/Parent 215 0 R -/Prev 219 0 R +/Parent 223 0 R +/Prev 231 0 R >> endobj 231 0 obj << /Title 232 0 R /A 229 0 R -/Parent 219 0 R +/Parent 223 0 R /Prev 227 0 R +/Next 235 0 R >> endobj 227 0 obj << /Title 228 0 R /A 225 0 R -/Parent 219 0 R -/Prev 223 0 R +/Parent 223 0 R /Next 231 0 R >> endobj 223 0 obj << /Title 224 0 R /A 221 0 R /Parent 219 0 R -/Next 227 0 R +/Next 239 0 R +/First 227 0 R +/Last 235 0 R +/Count -3 >> endobj 219 0 obj << /Title 220 0 R /A 217 0 R -/Parent 215 0 R -/Next 235 0 R +/Parent 191 0 R +/Prev 215 0 R +/Next 243 0 R /First 223 0 R -/Last 231 0 R -/Count -3 +/Last 239 0 R +/Count -2 >> endobj 215 0 obj << /Title 216 0 R /A 213 0 R -/Parent 187 0 R +/Parent 191 0 R /Prev 211 0 R -/Next 239 0 R -/First 219 0 R -/Last 235 0 R -/Count -2 +/Next 219 0 R >> endobj 211 0 obj << /Title 212 0 R /A 209 0 R -/Parent 187 0 R -/Prev 207 0 R +/Parent 191 0 R +/Prev 199 0 R /Next 215 0 R >> endobj 207 0 obj << /Title 208 0 R /A 205 0 R -/Parent 187 0 R -/Prev 195 0 R -/Next 211 0 R +/Parent 199 0 R +/Prev 203 0 R >> endobj 203 0 obj << /Title 204 0 R /A 201 0 R -/Parent 195 0 R -/Prev 199 0 R +/Parent 199 0 R +/Next 207 0 R >> endobj 199 0 obj << /Title 200 0 R /A 197 0 R -/Parent 195 0 R -/Next 203 0 R +/Parent 191 0 R +/Prev 195 0 R +/Next 211 0 R +/First 203 0 R +/Last 207 0 R +/Count -2 >> endobj 195 0 obj << /Title 196 0 R /A 193 0 R -/Parent 187 0 R -/Prev 191 0 R -/Next 207 0 R -/First 199 0 R -/Last 203 0 R -/Count -2 +/Parent 191 0 R +/Next 199 0 R >> endobj 191 0 obj << /Title 192 0 R /A 189 0 R -/Parent 187 0 R -/Next 195 0 R +/Parent 107 0 R +/Prev 111 0 R +/Next 275 0 R +/First 195 0 R +/Last 243 0 R +/Count -6 >> endobj 187 0 obj << /Title 188 0 R /A 185 0 R -/Parent 103 0 R -/Prev 107 0 R -/Next 271 0 R -/First 191 0 R -/Last 239 0 R -/Count -6 +/Parent 171 0 R +/Prev 183 0 R >> endobj 183 0 obj << /Title 184 0 R /A 181 0 R -/Parent 167 0 R +/Parent 171 0 R /Prev 179 0 R +/Next 187 0 R >> endobj 179 0 obj << /Title 180 0 R /A 177 0 R -/Parent 167 0 R +/Parent 171 0 R /Prev 175 0 R /Next 183 0 R >> endobj 175 0 obj << /Title 176 0 R /A 173 0 R -/Parent 167 0 R -/Prev 171 0 R +/Parent 171 0 R /Next 179 0 R >> endobj 171 0 obj << /Title 172 0 R /A 169 0 R -/Parent 167 0 R -/Next 175 0 R +/Parent 111 0 R +/Prev 167 0 R +/First 175 0 R +/Last 187 0 R +/Count -4 >> endobj 167 0 obj << /Title 168 0 R /A 165 0 R -/Parent 107 0 R -/Prev 163 0 R -/First 171 0 R -/Last 183 0 R -/Count -4 +/Parent 111 0 R +/Prev 123 0 R +/Next 171 0 R >> endobj 163 0 obj << /Title 164 0 R /A 161 0 R -/Parent 107 0 R -/Prev 119 0 R -/Next 167 0 R +/Parent 159 0 R >> endobj 159 0 obj << /Title 160 0 R /A 157 0 R -/Parent 155 0 R +/Parent 123 0 R +/Prev 151 0 R +/First 163 0 R +/Last 163 0 R +/Count -1 >> endobj 155 0 obj << /Title 156 0 R /A 153 0 R -/Parent 119 0 R -/Prev 147 0 R -/First 159 0 R -/Last 159 0 R -/Count -1 +/Parent 151 0 R >> endobj 151 0 obj << /Title 152 0 R /A 149 0 R -/Parent 147 0 R +/Parent 123 0 R +/Prev 143 0 R +/Next 159 0 R +/First 155 0 R +/Last 155 0 R +/Count -1 >> endobj 147 0 obj << /Title 148 0 R /A 145 0 R -/Parent 119 0 R -/Prev 139 0 R -/Next 155 0 R -/First 151 0 R -/Last 151 0 R -/Count -1 +/Parent 143 0 R >> endobj 143 0 obj << /Title 144 0 R /A 141 0 R -/Parent 139 0 R +/Parent 123 0 R +/Prev 135 0 R +/Next 151 0 R +/First 147 0 R +/Last 147 0 R +/Count -1 >> endobj 139 0 obj << /Title 140 0 R /A 137 0 R -/Parent 119 0 R -/Prev 131 0 R -/Next 147 0 R -/First 143 0 R -/Last 143 0 R -/Count -1 +/Parent 135 0 R >> endobj 135 0 obj << /Title 136 0 R /A 133 0 R -/Parent 131 0 R +/Parent 123 0 R +/Prev 127 0 R +/Next 143 0 R +/First 139 0 R +/Last 139 0 R +/Count -1 >> endobj 131 0 obj << /Title 132 0 R /A 129 0 R -/Parent 119 0 R -/Prev 123 0 R -/Next 139 0 R -/First 135 0 R -/Last 135 0 R -/Count -1 +/Parent 127 0 R >> endobj 127 0 obj << /Title 128 0 R /A 125 0 R /Parent 123 0 R +/Next 135 0 R +/First 131 0 R +/Last 131 0 R +/Count -1 >> endobj 123 0 obj << /Title 124 0 R /A 121 0 R -/Parent 119 0 R -/Next 131 0 R +/Parent 111 0 R +/Prev 119 0 R +/Next 167 0 R /First 127 0 R -/Last 127 0 R -/Count -1 +/Last 159 0 R +/Count -5 >> endobj 119 0 obj << /Title 120 0 R /A 117 0 R -/Parent 107 0 R +/Parent 111 0 R /Prev 115 0 R -/Next 163 0 R -/First 123 0 R -/Last 155 0 R -/Count -5 +/Next 123 0 R >> endobj 115 0 obj << /Title 116 0 R /A 113 0 R -/Parent 107 0 R -/Prev 111 0 R +/Parent 111 0 R /Next 119 0 R >> endobj 111 0 obj << /Title 112 0 R /A 109 0 R /Parent 107 0 R -/Next 115 0 R +/Next 191 0 R +/First 115 0 R +/Last 171 0 R +/Count -5 >> endobj 107 0 obj << /Title 108 0 R /A 105 0 R -/Parent 103 0 R -/Next 187 0 R +/Parent 7585 0 R +/Prev 7 0 R +/Next 487 0 R /First 111 0 R -/Last 167 0 R -/Count -5 +/Last 479 0 R +/Count -6 >> endobj 103 0 obj << /Title 104 0 R /A 101 0 R -/Parent 7250 0 R -/Prev 7 0 R -/Next 463 0 R -/First 107 0 R -/Last 455 0 R -/Count -6 +/Parent 99 0 R >> endobj 99 0 obj << /Title 100 0 R /A 97 0 R -/Parent 95 0 R +/Parent 7 0 R +/Prev 39 0 R +/First 103 0 R +/Last 103 0 R +/Count -1 >> endobj 95 0 obj << /Title 96 0 R /A 93 0 R -/Parent 7 0 R -/Prev 39 0 R -/First 99 0 R -/Last 99 0 R -/Count -1 +/Parent 83 0 R +/Prev 91 0 R >> endobj 91 0 obj << /Title 92 0 R /A 89 0 R -/Parent 79 0 R +/Parent 83 0 R /Prev 87 0 R +/Next 95 0 R >> endobj 87 0 obj << /Title 88 0 R /A 85 0 R -/Parent 79 0 R -/Prev 83 0 R +/Parent 83 0 R /Next 91 0 R >> endobj 83 0 obj << /Title 84 0 R /A 81 0 R -/Parent 79 0 R -/Next 87 0 R +/Parent 39 0 R +/Prev 79 0 R +/First 87 0 R +/Last 95 0 R +/Count -3 >> endobj 79 0 obj << /Title 80 0 R /A 77 0 R /Parent 39 0 R /Prev 75 0 R -/First 83 0 R -/Last 91 0 R -/Count -3 +/Next 83 0 R >> endobj 75 0 obj << /Title 76 0 R @@ -41011,45 +43345,45 @@ endobj /Title 68 0 R /A 65 0 R /Parent 39 0 R -/Prev 63 0 R +/Prev 47 0 R /Next 71 0 R >> endobj 63 0 obj << /Title 64 0 R /A 61 0 R -/Parent 39 0 R -/Prev 47 0 R -/Next 67 0 R +/Parent 47 0 R +/Prev 55 0 R >> endobj 59 0 obj << /Title 60 0 R /A 57 0 R -/Parent 47 0 R -/Prev 51 0 R +/Parent 55 0 R >> endobj 55 0 obj << /Title 56 0 R /A 53 0 R -/Parent 51 0 R +/Parent 47 0 R +/Prev 51 0 R +/Next 63 0 R +/First 59 0 R +/Last 59 0 R +/Count -1 >> endobj 51 0 obj << /Title 52 0 R /A 49 0 R /Parent 47 0 R -/Next 59 0 R -/First 55 0 R -/Last 55 0 R -/Count -1 +/Next 55 0 R >> endobj 47 0 obj << /Title 48 0 R /A 45 0 R /Parent 39 0 R /Prev 43 0 R -/Next 63 0 R +/Next 67 0 R /First 51 0 R -/Last 59 0 R -/Count -2 +/Last 63 0 R +/Count -3 >> endobj 43 0 obj << /Title 44 0 R @@ -41062,9 +43396,9 @@ endobj /A 37 0 R /Parent 7 0 R /Prev 11 0 R -/Next 95 0 R +/Next 99 0 R /First 43 0 R -/Last 79 0 R +/Last 83 0 R /Count -7 >> endobj 35 0 obj << @@ -41119,7299 +43453,7636 @@ endobj 7 0 obj << /Title 8 0 R /A 5 0 R -/Parent 7250 0 R -/Next 103 0 R +/Parent 7585 0 R +/Next 107 0 R /First 11 0 R -/Last 95 0 R +/Last 99 0 R /Count -3 >> endobj -7251 0 obj << -/Names [(AccessControls) 3058 0 R (AdvancedNetworkManagement) 3123 0 R (Appendixes) 7006 0 R (Backup) 3129 0 R (CUPS-printing) 3093 0 R (ClientConfig) 3054 0 R (DMB) 4259 0 R (DNSDHCP) 3171 0 R (Doc-Start) 2958 0 R (FastStart) 3019 0 R (Further-Resources) 3179 0 R (InterdomainTrusts) 3090 0 R (IntroSMB) 3017 0 R (Item.1) 4092 0 R (Item.10) 4251 0 R (Item.100) 5859 0 R (Item.101) 5860 0 R (Item.102) 5861 0 R (Item.103) 5866 0 R (Item.104) 5867 0 R (Item.105) 5868 0 R (Item.106) 5873 0 R (Item.107) 5874 0 R (Item.108) 5879 0 R (Item.109) 5880 0 R (Item.11) 4252 0 R (Item.110) 5881 0 R (Item.111) 5882 0 R (Item.112) 6081 0 R (Item.113) 6082 0 R (Item.114) 6083 0 R (Item.115) 6084 0 R (Item.116) 6085 0 R (Item.117) 6086 0 R (Item.118) 6087 0 R (Item.119) 6088 0 R (Item.12) 4363 0 R (Item.120) 6089 0 R (Item.121) 6090 0 R (Item.122) 6091 0 R (Item.123) 6092 0 R (Item.124) 6093 0 R (Item.125) 6094 0 R (Item.126) 6095 0 R (Item.127) 6347 0 R (Item.128) 6348 0 R (Item.129) 6349 0 R (Item.13) 4364 0 R (Item.130) 6350 0 R (Item.131) 6364 0 R (Item.132) 6365 0 R (Item.133) 6366 0 R (Item.134) 6367 0 R (Item.135) 6368 0 R (Item.136) 6369 0 R (Item.137) 6374 0 R (Item.138) 6375 0 R (Item.139) 6376 0 R (Item.14) 4365 0 R (Item.140) 6405 0 R (Item.141) 6406 0 R (Item.142) 6411 0 R (Item.143) 6412 0 R (Item.144) 6413 0 R (Item.145) 6414 0 R (Item.146) 6415 0 R (Item.147) 6422 0 R (Item.148) 6423 0 R (Item.149) 6424 0 R (Item.15) 4366 0 R (Item.150) 6425 0 R (Item.151) 6426 0 R (Item.152) 6431 0 R (Item.153) 6432 0 R (Item.154) 6433 0 R (Item.155) 6434 0 R (Item.156) 6435 0 R (Item.157) 6436 0 R (Item.158) 6437 0 R (Item.159) 6438 0 R (Item.16) 4367 0 R (Item.160) 6439 0 R (Item.161) 6440 0 R (Item.162) 6445 0 R (Item.163) 6446 0 R (Item.164) 6447 0 R (Item.165) 6448 0 R (Item.166) 6449 0 R (Item.167) 6450 0 R (Item.168) 6451 0 R (Item.169) 6452 0 R (Item.17) 4368 0 R (Item.170) 6453 0 R (Item.171) 6454 0 R (Item.172) 6455 0 R (Item.173) 6456 0 R (Item.174) 6465 0 R (Item.175) 6466 0 R (Item.176) 6467 0 R (Item.177) 6468 0 R (Item.178) 6469 0 R (Item.179) 6470 0 R (Item.18) 4451 0 R (Item.180) 6471 0 R (Item.181) 6493 0 R (Item.182) 6494 0 R (Item.183) 6495 0 R (Item.184) 6496 0 R (Item.185) 6726 0 R (Item.186) 6727 0 R (Item.187) 6728 0 R (Item.188) 6729 0 R (Item.189) 6730 0 R (Item.19) 4452 0 R (Item.190) 6731 0 R (Item.191) 6732 0 R (Item.192) 6733 0 R (Item.193) 6734 0 R (Item.194) 6735 0 R (Item.195) 6736 0 R (Item.196) 6737 0 R (Item.197) 6742 0 R (Item.198) 6769 0 R (Item.199) 6770 0 R (Item.2) 4093 0 R (Item.20) 4454 0 R (Item.200) 6778 0 R (Item.201) 6779 0 R (Item.202) 6820 0 R (Item.203) 6821 0 R (Item.204) 6826 0 R (Item.205) 6827 0 R (Item.206) 6828 0 R (Item.207) 6829 0 R (Item.208) 6830 0 R (Item.209) 6831 0 R (Item.21) 4455 0 R (Item.210) 6832 0 R (Item.211) 6860 0 R (Item.212) 6861 0 R (Item.213) 6866 0 R (Item.214) 6867 0 R (Item.215) 6905 0 R (Item.216) 6906 0 R (Item.217) 6911 0 R (Item.218) 6916 0 R (Item.219) 6917 0 R (Item.22) 4495 0 R (Item.220) 6918 0 R (Item.221) 6919 0 R (Item.222) 6925 0 R (Item.223) 6926 0 R (Item.224) 6927 0 R (Item.225) 6928 0 R (Item.226) 6929 0 R (Item.227) 6930 0 R (Item.228) 6931 0 R (Item.229) 6932 0 R (Item.23) 4496 0 R (Item.230) 6933 0 R (Item.231) 6934 0 R (Item.232) 6939 0 R (Item.233) 6940 0 R (Item.234) 6941 0 R (Item.235) 7022 0 R (Item.236) 7023 0 R (Item.237) 7024 0 R (Item.238) 7025 0 R (Item.239) 7026 0 R (Item.24) 4497 0 R (Item.25) 4498 0 R (Item.26) 4499 0 R (Item.27) 4500 0 R (Item.28) 4538 0 R (Item.29) 4539 0 R (Item.3) 4104 0 R (Item.30) 4540 0 R (Item.31) 4541 0 R (Item.32) 4618 0 R (Item.33) 4619 0 R (Item.34) 4620 0 R (Item.35) 4681 0 R (Item.36) 4682 0 R (Item.37) 4689 0 R (Item.38) 4802 0 R (Item.39) 4803 0 R (Item.4) 4105 0 R (Item.40) 4808 0 R (Item.41) 4895 0 R (Item.42) 4896 0 R (Item.43) 4898 0 R (Item.44) 4899 0 R (Item.45) 4900 0 R (Item.46) 4938 0 R (Item.47) 4939 0 R (Item.48) 4940 0 R (Item.49) 4945 0 R (Item.5) 4246 0 R (Item.50) 4946 0 R (Item.51) 4947 0 R (Item.52) 5154 0 R (Item.53) 5155 0 R (Item.54) 5156 0 R (Item.55) 5157 0 R (Item.56) 5158 0 R (Item.57) 5159 0 R (Item.58) 5160 0 R (Item.59) 5265 0 R (Item.6) 4247 0 R (Item.60) 5266 0 R (Item.61) 5267 0 R (Item.62) 5272 0 R (Item.63) 5339 0 R (Item.64) 5340 0 R (Item.65) 5341 0 R (Item.66) 5342 0 R (Item.67) 5343 0 R (Item.68) 5344 0 R (Item.69) 5345 0 R (Item.7) 4248 0 R (Item.70) 5346 0 R (Item.71) 5347 0 R (Item.72) 5353 0 R (Item.73) 5354 0 R (Item.74) 5355 0 R (Item.75) 5356 0 R (Item.76) 5357 0 R (Item.77) 5358 0 R (Item.78) 5409 0 R (Item.79) 5410 0 R (Item.8) 4249 0 R (Item.80) 5415 0 R (Item.81) 5767 0 R (Item.82) 5768 0 R (Item.83) 5769 0 R (Item.84) 5770 0 R (Item.85) 5788 0 R (Item.86) 5789 0 R (Item.87) 5790 0 R (Item.88) 5791 0 R (Item.89) 5792 0 R (Item.9) 4250 0 R (Item.90) 5800 0 R (Item.91) 5801 0 R (Item.92) 5802 0 R (Item.93) 5824 0 R (Item.94) 5825 0 R (Item.95) 5826 0 R (Item.96) 5827 0 R (Item.97) 5849 0 R (Item.98) 5853 0 R (Item.99) 5854 0 R (NT4Migration) 3132 0 R (NetworkBrowsing) 3055 0 R (Other-Clients) 3169 0 R (PolicyMgmt) 3124 0 R (Portability) 3168 0 R (ProfileMgmt) 3125 0 R (RefDocServer) 4443 0 R (SWAT) 3163 0 R (SambaHA) 3130 0 R (ServerType) 3020 0 R (SimplePrintServer) 4446 0 R (StandAloneServer) 3053 0 R (VFS) 3094 0 R (XMLpassdb) 4684 0 R (a_small) 6122 0 R (access1) 4861 0 R (acctmgmttools) 4669 0 R (ads-create-machine-account) 4415 0 R (ads-member) 4405 0 R (ads-test-server) 4418 0 R (ads-test-smbclient) 4417 0 R (browse-force-master) 4524 0 R (browsing1) 4595 0 R (bugreport) 3166 0 R (chapter*.1) 2984 0 R (chapter*.2) 2990 0 R (chapter*.3) 3184 0 R (chapter.1) 10 0 R (chapter.10) 466 0 R (chapter.11) 594 0 R (chapter.12) 746 0 R (chapter.13) 790 0 R (chapter.14) 902 0 R (chapter.15) 1006 0 R (chapter.16) 1062 0 R (chapter.17) 1110 0 R (chapter.18) 1122 0 R (chapter.19) 1362 0 R (chapter.2) 38 0 R (chapter.20) 1902 0 R (chapter.21) 1950 0 R (chapter.22) 2054 0 R (chapter.23) 2086 0 R (chapter.24) 2146 0 R (chapter.25) 2262 0 R (chapter.26) 2334 0 R (chapter.27) 2406 0 R (chapter.28) 2438 0 R (chapter.29) 2450 0 R (chapter.3) 94 0 R (chapter.30) 2462 0 R (chapter.31) 2526 0 R (chapter.32) 2574 0 R (chapter.33) 2626 0 R (chapter.34) 2642 0 R (chapter.35) 2686 0 R (chapter.36) 2718 0 R (chapter.37) 2778 0 R (chapter.38) 2818 0 R (chapter.39) 2886 0 R (chapter.4) 106 0 R (chapter.40) 2934 0 R (chapter.41) 2942 0 R (chapter.5) 186 0 R (chapter.6) 270 0 R (chapter.7) 330 0 R (chapter.8) 426 0 R (chapter.9) 454 0 R (compiling) 3167 0 R (cups1) 6050 0 R (cups2) 6115 0 R (diagnosis) 3164 0 R (domain-example) 4284 0 R (domain-member) 3023 0 R (domain-member-server) 4384 0 R (example.10.4.1) 4512 0 R (example.10.4.2) 4518 0 R (example.10.4.3) 4520 0 R (example.10.4.4) 4529 0 R (example.10.4.5) 4531 0 R (example.11.2.1) 4667 0 R (example.11.4.1) 4735 0 R (example.12.3.1) 4816 0 R (example.13.2.1) 4868 0 R (example.14.3.1) 5008 0 R (example.14.3.2) 5010 0 R (example.17.1.1) 5136 0 R (example.18.3.1) 5168 0 R (example.18.4.1) 5199 0 R (example.18.6.1) 5246 0 R (example.19.10.1) 5741 0 R (example.19.2.1) 5460 0 R (example.19.2.2) 5467 0 R (example.2.2.1) 4032 0 R (example.20.2.1) 6133 0 R (example.20.2.2) 6139 0 R (example.21.5.1) 6218 0 R (example.33.2.1) 6898 0 R (example.38.5.1) 7131 0 R (example.5.3.1) 4224 0 R (example.5.5.1) 4236 0 R (example.6.2.1) 4311 0 R (example.6.3.1) 4323 0 R (example.8.3.1) 4444 0 R (example.8.3.2) 4461 0 R (extbsdpr) 5193 0 R (figure.10.1) 4601 0 R (figure.11.1) 4654 0 R (figure.12.1) 4800 0 R (figure.13.1) 4867 0 R (figure.16.1) 5110 0 R (figure.19.1) 5498 0 R (figure.19.10) 5643 0 R (figure.19.11) 5655 0 R (figure.19.12) 5664 0 R (figure.19.13) 5689 0 R (figure.19.14) 5698 0 R (figure.19.15) 5710 0 R (figure.19.16) 5811 0 R (figure.19.17) 6052 0 R (figure.19.18) 6117 0 R (figure.19.19) 6124 0 R (figure.19.2) 5514 0 R (figure.19.3) 5518 0 R (figure.19.4) 5562 0 R (figure.19.5) 5566 0 R (figure.19.6) 5578 0 R (figure.19.7) 5588 0 R (figure.19.8) 5600 0 R (figure.19.9) 5608 0 R (figure.5.1) 4286 0 R (gdipost) 5489 0 R (groupmapping) 3057 0 R (id2724395) 4000 0 R (id2724477) 4005 0 R (id2777458) 4101 0 R (id2777506) 4102 0 R (id2777537) 4103 0 R (id2777763) 4118 0 R (id2777793) 4119 0 R (id2777864) 4129 0 R (id2783355) 4011 0 R (id2783424) 4013 0 R (id2783512) 4019 0 R (id2783585) 4021 0 R (id2783727) 4026 0 R (id2783771) 4030 0 R (id2783808) 4031 0 R (id2783832) 4033 0 R (id2783945) 4041 0 R (id2783998) 4042 0 R (id2784044) 4044 0 R (id2784101) 4052 0 R (id2784218) 4053 0 R (id2784301) 4054 0 R (id2784334) 4057 0 R (id2784346) 4062 0 R (id2784445) 4063 0 R (id2784464) 4064 0 R (id2792785) 4069 0 R (id2792965) 4079 0 R (id2793060) 4085 0 R (id2793146) 4086 0 R (id2793264) 4091 0 R (id2793356) 4094 0 R (id2793402) 4095 0 R (id2793803) 4213 0 R (id2794289) 4229 0 R (id2794328) 4230 0 R (id2794343) 4231 0 R (id2794392) 4238 0 R (id2794399) 4237 0 R (id2794483) 4239 0 R (id2794521) 4240 0 R (id2794702) 4137 0 R (id2794793) 4138 0 R (id2794985) 4144 0 R (id2795013) 4149 0 R (id2795053) 4150 0 R (id2795089) 4151 0 R (id2795128) 4153 0 R (id2795460) 4163 0 R (id2795674) 4175 0 R (id2795689) 4176 0 R (id2795934) 4197 0 R (id2795985) 6974 0 R (id2796112) 6981 0 R (id2796175) 6984 0 R (id2796212) 6986 0 R (id2796421) 6991 0 R (id2796554) 6996 0 R (id2796601) 6997 0 R (id2796760) 7008 0 R (id2796776) 7009 0 R (id2796806) 7012 0 R (id2796822) 7013 0 R (id2796864) 7015 0 R (id2797054) 7027 0 R (id2797119) 7038 0 R (id2797268) 7039 0 R (id2797446) 7044 0 R (id2797528) 7045 0 R (id2797560) 7050 0 R (id2797613) 7051 0 R (id2797721) 7052 0 R (id2797967) 7061 0 R (id2798131) 7066 0 R (id2798218) 7067 0 R (id2798248) 7069 0 R (id2798511) 4257 0 R (id2798657) 4264 0 R (id2798664) 4265 0 R (id2798723) 4266 0 R (id2798778) 4267 0 R (id2798862) 4272 0 R (id2798935) 4273 0 R (id2798967) 4274 0 R (id2798989) 4279 0 R (id2799149) 4294 0 R (id2799339) 4300 0 R (id2799368) 4301 0 R (id2799511) 4310 0 R (id2799542) 4312 0 R (id2799611) 4314 0 R (id2799632) 4315 0 R (id2799658) 4316 0 R (id2799672) 4321 0 R (id2799806) 4322 0 R (id2799821) 4324 0 R (id2799962) 4329 0 R (id2799976) 4330 0 R (id2800007) 4331 0 R (id2800033) 4337 0 R (id2800078) 4338 0 R (id2800285) 4343 0 R (id2800606) 4352 0 R (id2800898) 4358 0 R (id2801113) 4373 0 R (id2801184) 4374 0 R (id2801197) 4375 0 R (id2801273) 4376 0 R (id2801314) 4382 0 R (id2801395) 4386 0 R (id2801406) 4387 0 R (id2801832) 4397 0 R (id2802016) 4406 0 R (id2802145) 4407 0 R (id2802362) 4416 0 R (id2802519) 4423 0 R (id2802541) 4424 0 R (id2802568) 4425 0 R (id2802600) 4431 0 R (id2802802) 4436 0 R (id2802840) 4437 0 R (id2802923) 4442 0 R (id2802969) 4445 0 R (id2803287) 4462 0 R (id2803444) 4456 0 R (id2803508) 4467 0 R (id2803661) 4478 0 R (id2803750) 4483 0 R (id2804062) 4488 0 R (id2804078) 4489 0 R (id2804314) 4494 0 R (id2804479) 4501 0 R (id2804626) 4506 0 R (id2804876) 4513 0 R (id2804966) 4519 0 R (id2805104) 4521 0 R (id2805161) 4522 0 R (id2805210) 4530 0 R (id2805327) 4532 0 R (id2805559) 4537 0 R (id2805737) 4542 0 R (id2805754) 4547 0 R (id2805790) 4548 0 R (id2805949) 4549 0 R (id2806026) 4555 0 R (id2806214) 4561 0 R (id2806470) 4566 0 R (id2806496) 4567 0 R (id2806580) 4568 0 R (id2806594) 4573 0 R (id2806659) 4574 0 R (id2806823) 4579 0 R (id2806883) 4580 0 R (id2807004) 4585 0 R (id2807091) 4591 0 R (id2807140) 4592 0 R (id2807282) 4602 0 R (id2807395) 4608 0 R (id2807508) 4610 0 R (id2807625) 4612 0 R (id2807781) 4621 0 R (id2807796) 4622 0 R (id2807839) 4623 0 R (id2807881) 4624 0 R (id2808162) 4633 0 R (id2808176) 4634 0 R (id2808278) 4639 0 R (id2808451) 4646 0 R (id2808577) 4647 0 R (id2808754) 4659 0 R (id2808808) 4660 0 R (id2808844) 4661 0 R (id2809030) 4670 0 R (id2809301) 4675 0 R (id2809539) 4690 0 R (id2809580) 4691 0 R (id2809621) 4692 0 R (id2809734) 4697 0 R (id2809762) 4698 0 R (id2809914) 4710 0 R (id2809940) 4712 0 R (id2810050) 4718 0 R (id2810245) 4723 0 R (id2810372) 4728 0 R (id2810548) 4736 0 R (id2810769) 4729 0 R (id2810806) 4737 0 R (id2810965) 4743 0 R (id2810982) 4749 0 R (id2811406) 4751 0 R (id2811472) 4756 0 R (id2811589) 4757 0 R (id2811610) 4762 0 R (id2811679) 4763 0 R (id2811777) 4764 0 R (id2811908) 4770 0 R (id2812298) 4772 0 R (id2812328) 4778 0 R (id2812437) 4779 0 R (id2812444) 4780 0 R (id2812489) 4782 0 R (id2812600) 4787 0 R (id2812829) 4793 0 R (id2813064) 4801 0 R (id2813290) 4809 0 R (id2813357) 4814 0 R (id2813371) 4815 0 R (id2813394) 4817 0 R (id2813450) 4818 0 R (id2813526) 4824 0 R (id2813542) 4825 0 R (id2813610) 4826 0 R (id2813636) 4827 0 R (id2813893) 4836 0 R (id2814031) 4841 0 R (id2814066) 4842 0 R (id2814365) 4855 0 R (id2814385) 4856 0 R (id2814460) 4858 0 R (id2814610) 4869 0 R (id2814687) 4874 0 R (id2814715) 4875 0 R (id2814802) 4876 0 R (id2815136) 4878 0 R (id2815157) 4884 0 R (id2815515) 4879 0 R (id2815537) 4886 0 R (id2815896) 4888 0 R (id2815968) 4893 0 R (id2815981) 4894 0 R (id2816064) 4897 0 R (id2816267) 4905 0 R (id2816275) 4906 0 R (id2816320) 4907 0 R (id2816399) 4912 0 R (id2816530) 4913 0 R (id2816629) 4919 0 R (id2816721) 4920 0 R (id2816765) 4921 0 R (id2816925) 4926 0 R (id2817321) 4931 0 R (id2817402) 4936 0 R (id2817416) 4937 0 R (id2817845) 4952 0 R (id2817897) 4953 0 R (id2818145) 4959 0 R (id2818202) 4960 0 R (id2818344) 4965 0 R (id2818646) 4974 0 R (id2818677) 4975 0 R (id2818706) 4976 0 R (id2818732) 4981 0 R (id2818765) 4982 0 R (id2818786) 4983 0 R (id2818813) 4984 0 R (id2818905) 4989 0 R (id2818962) 4990 0 R (id2819020) 4996 0 R (id2819129) 5001 0 R (id2819142) 5002 0 R (id2819239) 5003 0 R (id2819332) 5009 0 R (id2819473) 5011 0 R (id2819526) 5012 0 R (id2819752) 5021 0 R (id2819779) 5026 0 R (id2819858) 5027 0 R (id2819888) 5033 0 R (id2819961) 5034 0 R (id2820000) 5039 0 R (id2820022) 5042 0 R (id2820054) 5045 0 R (id2820220) 5058 0 R (id2820252) 5059 0 R (id2820326) 5060 0 R (id2820345) 5065 0 R (id2820445) 5066 0 R (id2820504) 5067 0 R (id2820572) 5072 0 R (id2820629) 5073 0 R (id2820717) 5078 0 R (id2820775) 5079 0 R (id2820799) 5081 0 R (id2820818) 5082 0 R (id2820843) 5088 0 R (id2821133) 5093 0 R (id2821162) 5094 0 R (id2821250) 5099 0 R (id2821277) 5100 0 R (id2821349) 5101 0 R (id2821396) 5107 0 R (id2821575) 5115 0 R (id2821759) 5121 0 R (id2821897) 5122 0 R (id2822003) 5129 0 R (id2822073) 5134 0 R (id2822184) 5137 0 R (id2822348) 5142 0 R (id2822468) 5147 0 R (id2822534) 5148 0 R (id2822572) 5153 0 R (id2822644) 5161 0 R (id2822729) 5166 0 R (id2823195) 5167 0 R (id2823223) 5169 0 R (id2823359) 5175 0 R (id2823447) 5180 0 R (id2823780) 5189 0 R (id2824111) 5191 0 R (id2824124) 5192 0 R (id2824616) 5209 0 R (id2825059) 5214 0 R (id2825374) 5215 0 R (id2825432) 5220 0 R (id2825495) 5221 0 R (id2826100) 5226 0 R (id2826430) 5231 0 R (id2826579) 5234 0 R (id2826731) 5239 0 R (id2826844) 5245 0 R (id2826886) 5247 0 R (id2827028) 5248 0 R (id2827315) 5253 0 R (id2827482) 5258 0 R (id2827576) 5263 0 R (id2827774) 5264 0 R (id2827882) 5273 0 R (id2828207) 5278 0 R (id2828357) 5284 0 R (id2828548) 5289 0 R (id2828708) 5294 0 R (id2828808) 5299 0 R (id2828932) 5304 0 R (id2829135) 5309 0 R (id2829246) 5310 0 R (id2829397) 5316 0 R (id2829415) 5317 0 R (id2829611) 5322 0 R (id2829918) 5331 0 R (id2830012) 5332 0 R (id2830180) 5337 0 R (id2830212) 5338 0 R (id2830661) 5367 0 R (id2830963) 5372 0 R (id2831257) 5377 0 R (id2831355) 5382 0 R (id2831642) 5396 0 R (id2831719) 5397 0 R (id2831740) 5398 0 R (id2831785) 5401 0 R (id2831826) 5406 0 R (id2831846) 5407 0 R (id2831870) 5408 0 R (id2832023) 5416 0 R (id2832342) 5427 0 R (id2832388) 5428 0 R (id2832555) 5434 0 R (id2832569) 5435 0 R (id2832576) 5436 0 R (id2832610) 5437 0 R (id2832745) 5443 0 R (id2832752) 5444 0 R (id2832795) 5446 0 R (id2832849) 5448 0 R (id2832942) 5454 0 R (id2833183) 5459 0 R (id2833211) 5461 0 R (id2833358) 5462 0 R (id2833390) 5468 0 R (id2833704) 5469 0 R (id2833724) 5470 0 R (id2833773) 5475 0 R (id2833827) 5476 0 R (id2833894) 5477 0 R (id2834081) 5482 0 R (id2834208) 5488 0 R (id2834376) 5495 0 R (id2834518) 5499 0 R (id2834783) 5515 0 R (id2834909) 5525 0 R (id2834996) 5530 0 R (id2835102) 5533 0 R (id2835124) 5539 0 R (id2835301) 5542 0 R (id2835507) 5547 0 R (id2835657) 5552 0 R (id2835835) 5559 0 R (id2835937) 5563 0 R (id2836046) 5575 0 R (id2836217) 5589 0 R (id2836280) 5590 0 R (id2836432) 5591 0 R (id2836754) 5614 0 R (id2836904) 5615 0 R (id2836918) 5620 0 R (id2836972) 5621 0 R (id2837039) 5622 0 R (id2837271) 5631 0 R (id2837350) 5632 0 R (id2837534) 5634 0 R (id2837752) 5651 0 R (id2838073) 5665 0 R (id2838214) 5676 0 R (id2838291) 5678 0 R (id2838307) 5679 0 R (id2838362) 5686 0 R (id2838432) 5690 0 R (id2838543) 5699 0 R (id2838563) 5700 0 R (id2838773) 5711 0 R (id2838855) 5712 0 R (id2838936) 5719 0 R (id2838985) 5720 0 R (id2839058) 5725 0 R (id2839076) 5726 0 R (id2839110) 5727 0 R (id2839131) 5728 0 R (id2839175) 5729 0 R (id2839236) 5734 0 R (id2839255) 5735 0 R (id2839356) 5736 0 R (id2839383) 5742 0 R (id2839575) 5743 0 R (id2839858) 5749 0 R (id2839998) 5755 0 R (id2840031) 5760 0 R (id2840091) 5762 0 R (id2840358) 5772 0 R (id2840565) 5777 0 R (id2840686) 5778 0 R (id2840908) 5787 0 R (id2841056) 5799 0 R (id2841140) 5803 0 R (id2841219) 5804 0 R (id2841288) 5812 0 R (id2841439) 5818 0 R (id2841571) 5823 0 R (id2841765) 5828 0 R (id2841878) 5836 0 R (id2841986) 5837 0 R (id2842132) 5842 0 R (id2842342) 5848 0 R (id2843363) 5883 0 R (id2843515) 5888 0 R (id2843760) 5894 0 R (id2843839) 5895 0 R (id2843901) 5896 0 R (id2843959) 5897 0 R (id2844095) 5902 0 R (id2844232) 5910 0 R (id2844305) 5914 0 R (id2844328) 5915 0 R (id2844374) 5922 0 R (id2844450) 5923 0 R (id2844614) 5939 0 R (id2844708) 5943 0 R (id2844790) 5951 0 R (id2844861) 5956 0 R (id2844925) 5959 0 R (id2845397) 5998 0 R (id2845440) 5999 0 R (id2845504) 6000 0 R (id2845544) 6006 0 R (id2845624) 6007 0 R (id2845734) 6012 0 R (id2845805) 6013 0 R (id2845852) 6018 0 R (id2845867) 6019 0 R (id2846076) 6025 0 R (id2846134) 6026 0 R (id2846216) 6031 0 R (id2846372) 6032 0 R (id2846429) 6033 0 R (id2846496) 6038 0 R (id2846776) 6045 0 R (id2846877) 6053 0 R (id2846884) 6054 0 R (id2846900) 6055 0 R (id2846946) 6060 0 R (id2847002) 6061 0 R (id2847030) 6062 0 R (id2847256) 6063 0 R (id2847308) 6064 0 R (id2847323) 6070 0 R (id2847352) 6071 0 R (id2847369) 6072 0 R (id2847384) 6073 0 R (id2847407) 6074 0 R (id2847426) 6075 0 R (id2847468) 6080 0 R (id2847742) 6101 0 R (id2847787) 6102 0 R (id2847848) 6103 0 R (id2847957) 6104 0 R (id2847988) 6105 0 R (id2848043) 6110 0 R (id2848213) 6131 0 R (id2848231) 6132 0 R (id2848268) 6134 0 R (id2848367) 6140 0 R (id2848459) 6141 0 R (id2848466) 6142 0 R (id2848508) 6143 0 R (id2848556) 6144 0 R (id2848638) 6146 0 R (id2848657) 6151 0 R (id2848827) 6152 0 R (id2848872) 6157 0 R (id2848894) 6158 0 R (id2848948) 6161 0 R (id2849177) 6167 0 R (id2849272) 6172 0 R (id2849358) 6173 0 R (id2849418) 6179 0 R (id2849449) 6180 0 R (id2849478) 6181 0 R (id2849511) 6182 0 R (id2849534) 6187 0 R (id2849662) 6188 0 R (id2849744) 6193 0 R (id2849777) 6194 0 R (id2849805) 6195 0 R (id2849812) 6196 0 R (id2849880) 6201 0 R (id2849974) 6203 0 R (id2850036) 6208 0 R (id2850244) 6209 0 R (id2850316) 6217 0 R (id2850362) 6219 0 R (id2850473) 6220 0 R (id2850530) 6226 0 R (id2850778) 6231 0 R (id2850785) 6233 0 R (id2850948) 6239 0 R (id2851058) 6251 0 R (id2851095) 6252 0 R (id2851200) 6254 0 R (id2851432) 6265 0 R (id2851540) 6270 0 R (id2851559) 6271 0 R (id2851612) 6276 0 R (id2851721) 6281 0 R (id2851752) 6282 0 R (id2851850) 6291 0 R (id2851868) 6292 0 R (id2852080) 6300 0 R (id2852352) 6314 0 R (id2852385) 6320 0 R (id2852465) 6325 0 R (id2852519) 6326 0 R (id2852630) 6333 0 R (id2852726) 6334 0 R (id2852835) 6339 0 R (id2852858) 6340 0 R (id2852970) 6346 0 R (id2853122) 6355 0 R (id2853228) 6356 0 R (id2853267) 6361 0 R (id2853287) 6362 0 R (id2853331) 6363 0 R (id2853482) 6377 0 R (id2853496) 6378 0 R (id2853596) 6383 0 R (id2853631) 6384 0 R (id2853672) 6385 0 R (id2853684) 6390 0 R (id2853792) 6391 0 R (id2853924) 6397 0 R (id2853991) 6398 0 R (id2854162) 6403 0 R (id2854170) 6404 0 R (id2854706) 6420 0 R (id2854891) 6421 0 R (id2855402) 6457 0 R (id2855486) 6458 0 R (id2855503) 6464 0 R (id2855668) 6472 0 R (id2855682) 6473 0 R (id2855698) 6478 0 R (id2855739) 6479 0 R (id2855797) 6480 0 R (id2855842) 6485 0 R (id2855862) 6486 0 R (id2855961) 6487 0 R (id2856010) 6492 0 R (id2856361) 6501 0 R (id2856505) 6503 0 R (id2856564) 6505 0 R (id2856760) 6515 0 R (id2857072) 6521 0 R (id2857085) 6522 0 R (id2857154) 6523 0 R (id2857368) 6528 0 R (id2857648) 6538 0 R (id2857896) 6543 0 R (id2857914) 6544 0 R (id2857971) 6550 0 R (id2858577) 6564 0 R (id2858608) 6569 0 R (id2858635) 6570 0 R (id2858881) 6580 0 R (id2858959) 6581 0 R (id2859048) 6586 0 R (id2859080) 6587 0 R (id2859293) 6596 0 R (id2859327) 6597 0 R (id2859363) 6602 0 R (id2859395) 6603 0 R (id2859436) 6604 0 R (id2859450) 6605 0 R (id2859536) 6610 0 R (id2859774) 6620 0 R (id2859799) 6621 0 R (id2859863) 6626 0 R (id2859919) 6627 0 R (id2860060) 6632 0 R (id2860104) 6633 0 R (id2860155) 6638 0 R (id2860260) 6643 0 R (id2860292) 6644 0 R (id2860362) 6646 0 R (id2860527) 6652 0 R (id2860590) 6653 0 R (id2860838) 6663 0 R (id2860870) 6664 0 R (id2860902) 6665 0 R (id2861020) 6672 0 R (id2861036) 6673 0 R (id2861071) 6674 0 R (id2861122) 6675 0 R (id2861325) 6684 0 R (id2861369) 6686 0 R (id2861439) 6692 0 R (id2861566) 6693 0 R (id2861596) 6695 0 R (id2861734) 6703 0 R (id2861740) 6704 0 R (id2861854) 6709 0 R (id2861868) 6710 0 R (id2861938) 6715 0 R (id2862077) 6725 0 R (id2862207) 6743 0 R (id2862222) 6744 0 R (id2862348) 6750 0 R (id2862744) 6759 0 R (id2862818) 6764 0 R (id2862825) 6765 0 R (id2862844) 6766 0 R (id2863060) 6768 0 R (id2863109) 6771 0 R (id2863133) 6777 0 R (id2863251) 6781 0 R (id2863275) 6783 0 R (id2863287) 6784 0 R (id2863399) 6789 0 R (id2863466) 6795 0 R (id2863607) 6800 0 R (id2863632) 6801 0 R (id2863843) 6810 0 R (id2863893) 6811 0 R (id2863953) 6816 0 R (id2864016) 6817 0 R (id2864046) 6818 0 R (id2864070) 6819 0 R (id2864282) 6833 0 R (id2864297) 6834 0 R (id2864373) 6836 0 R (id2864444) 6842 0 R (id2864629) 6844 0 R (id2864989) 6853 0 R (id2865028) 6854 0 R (id2865266) 6859 0 R (id2865377) 6869 0 R (id2865439) 6871 0 R (id2865546) 6876 0 R (id2865610) 6877 0 R (id2865674) 6878 0 R (id2865722) 6884 0 R (id2865774) 6885 0 R (id2865797) 6886 0 R (id2865927) 6896 0 R (id2865961) 6897 0 R (id2866010) 6899 0 R (id2866188) 6904 0 R (id2867662) 6946 0 R (id2867683) 6947 0 R (id2867796) 6948 0 R (id2867818) 6954 0 R (id2867870) 6956 0 R (id2867891) 6957 0 R (id2868160) 6962 0 R (id2868187) 6963 0 R (id2868228) 6967 0 R (id2868354) 7079 0 R (id2868398) 7080 0 R (id2868405) 7081 0 R (id2868431) 7082 0 R (id2868438) 7083 0 R (id2868591) 7092 0 R (id2868669) 7098 0 R (id2868676) 7099 0 R (id2868745) 7104 0 R (id2868797) 7107 0 R (id2868897) 7112 0 R (id2868905) 7113 0 R (id2868996) 7114 0 R (id2869025) 7115 0 R (id2869078) 7116 0 R (id2869116) 7117 0 R (id2869133) 7123 0 R (id2869179) 7124 0 R (id2869253) 7125 0 R (id2869277) 7126 0 R (id2869349) 7132 0 R (id2869464) 7133 0 R (id2869596) 7139 0 R (id2869641) 7140 0 R (id2869730) 7145 0 R (id2869780) 7146 0 R (id2869840) 7147 0 R (id2869870) 7148 0 R (id2869954) 7153 0 R (id2870017) 7154 0 R (id2870046) 7155 0 R (id2870071) 7157 0 R (id2870116) 7158 0 R (id2870219) 7168 0 R (id2870286) 7173 0 R (id2870694) 7203 0 R (idmap-diag) 4652 0 R (idmap-group-diag) 4798 0 R (idmapbackend) 4666 0 R (idmapbackendexample) 4668 0 R (install) 3018 0 R (integrate-ms-networks) 3127 0 R (introduction) 3999 0 R (locking) 3088 0 R (machine-trust-accounts) 4177 0 R (migration) 6724 0 R (msdfs) 3091 0 R (optional) 4477 0 R (page.1) 2957 0 R (page.10) 3183 0 R (page.100) 4572 0 R (page.101) 4578 0 R (page.102) 4584 0 R (page.103) 4590 0 R (page.104) 4599 0 R (page.105) 4607 0 R (page.106) 4617 0 R (page.107) 4628 0 R (page.108) 4632 0 R (page.109) 4638 0 R (page.11) 3223 0 R (page.110) 4645 0 R (page.111) 4651 0 R (page.112) 4658 0 R (page.113) 4665 0 R (page.114) 4674 0 R (page.115) 4679 0 R (page.116) 4688 0 R (page.117) 4696 0 R (page.118) 4706 0 R (page.119) 4717 0 R (page.12) 3276 0 R (page.120) 4722 0 R (page.121) 4727 0 R (page.122) 4734 0 R (page.123) 4741 0 R (page.124) 4748 0 R (page.125) 4755 0 R (page.126) 4761 0 R (page.127) 4769 0 R (page.128) 4777 0 R (page.129) 4786 0 R (page.13) 3328 0 R (page.130) 4792 0 R (page.131) 4797 0 R (page.132) 4807 0 R (page.133) 4813 0 R (page.134) 4823 0 R (page.135) 4831 0 R (page.136) 4835 0 R (page.137) 4840 0 R (page.138) 4846 0 R (page.139) 4854 0 R (page.14) 3386 0 R (page.140) 4865 0 R (page.141) 4873 0 R (page.142) 4883 0 R (page.143) 4892 0 R (page.144) 4904 0 R (page.145) 4911 0 R (page.146) 4918 0 R (page.147) 4925 0 R (page.148) 4930 0 R (page.149) 4935 0 R (page.15) 3435 0 R (page.150) 4944 0 R (page.151) 4951 0 R (page.152) 4958 0 R (page.153) 4964 0 R (page.154) 4969 0 R (page.155) 4973 0 R (page.156) 4980 0 R (page.157) 4988 0 R (page.158) 4995 0 R (page.159) 5000 0 R (page.16) 3490 0 R (page.160) 5007 0 R (page.161) 5016 0 R (page.162) 5020 0 R (page.163) 5025 0 R (page.164) 5032 0 R (page.165) 5038 0 R (page.166) 5057 0 R (page.167) 5064 0 R (page.168) 5071 0 R (page.169) 5077 0 R (page.17) 3545 0 R (page.170) 5087 0 R (page.171) 5092 0 R (page.172) 5098 0 R (page.173) 5106 0 R (page.174) 5114 0 R (page.175) 5120 0 R (page.176) 5128 0 R (page.177) 5133 0 R (page.178) 5141 0 R (page.179) 5146 0 R (page.18) 3598 0 R (page.180) 5152 0 R (page.181) 5165 0 R (page.182) 5174 0 R (page.183) 5179 0 R (page.184) 5184 0 R (page.185) 5188 0 R (page.186) 5198 0 R (page.187) 5203 0 R (page.188) 5208 0 R (page.189) 5213 0 R (page.19) 3652 0 R (page.190) 5219 0 R (page.191) 5225 0 R (page.192) 5230 0 R (page.193) 5238 0 R (page.194) 5244 0 R (page.195) 5252 0 R (page.196) 5257 0 R (page.197) 5262 0 R (page.198) 5271 0 R (page.199) 5277 0 R (page.2) 2969 0 R (page.20) 3705 0 R (page.200) 5283 0 R (page.201) 5288 0 R (page.202) 5293 0 R (page.203) 5298 0 R (page.204) 5303 0 R (page.205) 5308 0 R (page.206) 5315 0 R (page.207) 5321 0 R (page.208) 5326 0 R (page.209) 5330 0 R (page.21) 3756 0 R (page.210) 5336 0 R (page.211) 5352 0 R (page.212) 5366 0 R (page.213) 5371 0 R (page.214) 5376 0 R (page.215) 5381 0 R (page.216) 5386 0 R (page.217) 5390 0 R (page.218) 5395 0 R (page.219) 5405 0 R (page.22) 3811 0 R (page.220) 5414 0 R (page.221) 5422 0 R (page.222) 5426 0 R (page.223) 5433 0 R (page.224) 5442 0 R (page.225) 5452 0 R (page.226) 5458 0 R (page.227) 5466 0 R (page.228) 5474 0 R (page.229) 5481 0 R (page.23) 3858 0 R (page.230) 5487 0 R (page.231) 5494 0 R (page.232) 5505 0 R (page.233) 5511 0 R (page.234) 5524 0 R (page.235) 5529 0 R (page.236) 5538 0 R (page.237) 5546 0 R (page.238) 5551 0 R (page.239) 5558 0 R (page.24) 3907 0 R (page.240) 5574 0 R (page.241) 5585 0 R (page.242) 5597 0 R (page.243) 5605 0 R (page.244) 5613 0 R (page.245) 5619 0 R (page.246) 5626 0 R (page.247) 5630 0 R (page.248) 5640 0 R (page.249) 5650 0 R (page.25) 3955 0 R (page.250) 5660 0 R (page.251) 5673 0 R (page.252) 5685 0 R (page.253) 5695 0 R (page.254) 5707 0 R (page.255) 5717 0 R (page.256) 5724 0 R (page.257) 5733 0 R (page.258) 5740 0 R (page.259) 5748 0 R (page.26) 3994 0 R (page.260) 5754 0 R (page.261) 5759 0 R (page.262) 5766 0 R (page.263) 5776 0 R (page.264) 5782 0 R (page.265) 5786 0 R (page.266) 5798 0 R (page.267) 5808 0 R (page.268) 5817 0 R (page.269) 5822 0 R (page.27) 3998 0 R (page.270) 5835 0 R (page.271) 5841 0 R (page.272) 5847 0 R (page.273) 5858 0 R (page.274) 5865 0 R (page.275) 5872 0 R (page.276) 5878 0 R (page.277) 5887 0 R (page.278) 5893 0 R (page.279) 5901 0 R (page.28) 4004 0 R (page.280) 5908 0 R (page.281) 5921 0 R (page.282) 5938 0 R (page.283) 5950 0 R (page.284) 5964 0 R (page.285) 5989 0 R (page.286) 5997 0 R (page.287) 6004 0 R (page.288) 6011 0 R (page.289) 6017 0 R (page.29) 4009 0 R (page.290) 6024 0 R (page.291) 6030 0 R (page.292) 6037 0 R (page.293) 6044 0 R (page.294) 6049 0 R (page.295) 6059 0 R (page.296) 6069 0 R (page.297) 6079 0 R (page.298) 6100 0 R (page.299) 6109 0 R (page.3) 2983 0 R (page.30) 4017 0 R (page.300) 6114 0 R (page.301) 6121 0 R (page.302) 6130 0 R (page.303) 6138 0 R (page.304) 6150 0 R (page.305) 6156 0 R (page.306) 6166 0 R (page.307) 6171 0 R (page.308) 6178 0 R (page.309) 6186 0 R (page.31) 4025 0 R (page.310) 6192 0 R (page.311) 6200 0 R (page.312) 6207 0 R (page.313) 6213 0 R (page.314) 6225 0 R (page.315) 6230 0 R (page.316) 6237 0 R (page.317) 6245 0 R (page.318) 6249 0 R (page.319) 6258 0 R (page.32) 4038 0 R (page.320) 6263 0 R (page.321) 6269 0 R (page.322) 6275 0 R (page.323) 6280 0 R (page.324) 6290 0 R (page.325) 6298 0 R (page.326) 6306 0 R (page.327) 6310 0 R (page.328) 6318 0 R (page.329) 6324 0 R (page.33) 4051 0 R (page.330) 6330 0 R (page.331) 6338 0 R (page.332) 6345 0 R (page.333) 6354 0 R (page.334) 6360 0 R (page.335) 6373 0 R (page.336) 6382 0 R (page.337) 6389 0 R (page.338) 6396 0 R (page.339) 6402 0 R (page.34) 4061 0 R (page.340) 6410 0 R (page.341) 6419 0 R (page.342) 6430 0 R (page.343) 6444 0 R (page.344) 6463 0 R (page.345) 6477 0 R (page.346) 6484 0 R (page.347) 6491 0 R (page.348) 6500 0 R (page.349) 6509 0 R (page.35) 4068 0 R (page.350) 6514 0 R (page.351) 6520 0 R (page.352) 6527 0 R (page.353) 6532 0 R (page.354) 6536 0 R (page.355) 6542 0 R (page.356) 6549 0 R (page.357) 6555 0 R (page.358) 6559 0 R (page.359) 6563 0 R (page.36) 4073 0 R (page.360) 6568 0 R (page.361) 6574 0 R (page.362) 6579 0 R (page.363) 6585 0 R (page.364) 6594 0 R (page.365) 6601 0 R (page.366) 6609 0 R (page.367) 6614 0 R (page.368) 6619 0 R (page.369) 6625 0 R (page.37) 4077 0 R (page.370) 6631 0 R (page.371) 6637 0 R (page.372) 6642 0 R (page.373) 6651 0 R (page.374) 6658 0 R (page.375) 6662 0 R (page.376) 6669 0 R (page.377) 6679 0 R (page.378) 6683 0 R (page.379) 6691 0 R (page.38) 4084 0 R (page.380) 6702 0 R (page.381) 6708 0 R (page.382) 6714 0 R (page.383) 6719 0 R (page.384) 6723 0 R (page.385) 6741 0 R (page.386) 6749 0 R (page.387) 6754 0 R (page.388) 6758 0 R (page.389) 6763 0 R (page.39) 4090 0 R (page.390) 6776 0 R (page.391) 6788 0 R (page.392) 6794 0 R (page.393) 6799 0 R (page.394) 6805 0 R (page.395) 6809 0 R (page.396) 6815 0 R (page.397) 6825 0 R (page.398) 6841 0 R (page.399) 6848 0 R (page.4) 2989 0 R (page.40) 4100 0 R (page.400) 6852 0 R (page.401) 6858 0 R (page.402) 6865 0 R (page.403) 6875 0 R (page.404) 6883 0 R (page.405) 6890 0 R (page.406) 6894 0 R (page.407) 6903 0 R (page.408) 6910 0 R (page.409) 6915 0 R (page.41) 4109 0 R (page.410) 6924 0 R (page.411) 6938 0 R (page.412) 6945 0 R (page.413) 6953 0 R (page.414) 6961 0 R (page.415) 6973 0 R (page.416) 6980 0 R (page.417) 6990 0 R (page.418) 6995 0 R (page.419) 7001 0 R (page.42) 4127 0 R (page.420) 7005 0 R (page.421) 7019 0 R (page.422) 7037 0 R (page.423) 7043 0 R (page.424) 7049 0 R (page.425) 7056 0 R (page.426) 7060 0 R (page.427) 7065 0 R (page.428) 7074 0 R (page.429) 7078 0 R (page.43) 4133 0 R (page.430) 7087 0 R (page.431) 7091 0 R (page.432) 7103 0 R (page.433) 7111 0 R (page.434) 7122 0 R (page.435) 7130 0 R (page.436) 7138 0 R (page.437) 7144 0 R (page.438) 7152 0 R (page.439) 7162 0 R (page.44) 4143 0 R (page.440) 7167 0 R (page.441) 7172 0 R (page.442) 7198 0 R (page.45) 4148 0 R (page.46) 4158 0 R (page.47) 4162 0 R (page.48) 4169 0 R (page.49) 4181 0 R (page.5) 3027 0 R (page.50) 4196 0 R (page.51) 4203 0 R (page.52) 4212 0 R (page.53) 4223 0 R (page.54) 4228 0 R (page.55) 4235 0 R (page.56) 4245 0 R (page.57) 4256 0 R (page.58) 4263 0 R (page.59) 4271 0 R (page.6) 3062 0 R (page.60) 4278 0 R (page.61) 4283 0 R (page.62) 4291 0 R (page.63) 4299 0 R (page.64) 4305 0 R (page.65) 4309 0 R (page.66) 4320 0 R (page.67) 4328 0 R (page.68) 4336 0 R (page.69) 4342 0 R (page.7) 3098 0 R (page.70) 4347 0 R (page.71) 4351 0 R (page.72) 4357 0 R (page.73) 4372 0 R (page.74) 4381 0 R (page.75) 4392 0 R (page.76) 4396 0 R (page.77) 4404 0 R (page.78) 4411 0 R (page.79) 4422 0 R (page.8) 3136 0 R (page.80) 4430 0 R (page.81) 4435 0 R (page.82) 4441 0 R (page.83) 4450 0 R (page.84) 4460 0 R (page.85) 4466 0 R (page.86) 4472 0 R (page.87) 4476 0 R (page.88) 4482 0 R (page.89) 4487 0 R (page.9) 3175 0 R (page.90) 4493 0 R (page.91) 4505 0 R (page.92) 4511 0 R (page.93) 4517 0 R (page.94) 4528 0 R (page.95) 4536 0 R (page.96) 4546 0 R (page.97) 4554 0 R (page.98) 4560 0 R (page.99) 4565 0 R (pam) 3126 0 R (part.1) 6 0 R (part.2) 102 0 R (part.3) 462 0 R (part.4) 2458 0 R (part.5) 2622 0 R (part.6) 2714 0 R (passdb) 3056 0 R (pdc-example) 4219 0 R (pdftoepsonusb) 5662 0 R (pdftosocket) 5653 0 R (post-and-ghost) 5506 0 R (printing) 3092 0 R (problems) 3165 0 R (samba-bdc) 3022 0 R (samba-pdc) 3021 0 R (samba-trusted-domain) 5116 0 R (section*.4) 6232 0 R (section*.5) 6238 0 R (section*.6) 6250 0 R (section*.7) 6253 0 R (section*.8) 6264 0 R (section.1.1) 14 0 R (section.1.2) 18 0 R (section.1.3) 22 0 R (section.1.4) 26 0 R (section.1.5) 30 0 R (section.1.6) 34 0 R (section.10.1) 470 0 R (section.10.2) 474 0 R (section.10.3) 478 0 R (section.10.4) 494 0 R (section.10.5) 530 0 R (section.10.6) 546 0 R (section.10.7) 558 0 R (section.10.8) 578 0 R (section.11.1) 598 0 R (section.11.2) 610 0 R (section.11.3) 634 0 R (section.11.4) 646 0 R (section.11.5) 730 0 R (section.12.1) 750 0 R (section.12.2) 754 0 R (section.12.3) 762 0 R (section.12.4) 774 0 R (section.13.1) 794 0 R (section.13.2) 798 0 R (section.13.3) 814 0 R (section.13.4) 830 0 R (section.13.5) 846 0 R (section.13.6) 886 0 R (section.14.1) 906 0 R (section.14.2) 910 0 R (section.14.3) 954 0 R (section.14.4) 970 0 R (section.14.5) 982 0 R (section.14.6) 986 0 R (section.14.7) 1002 0 R (section.15.1) 1010 0 R (section.15.2) 1014 0 R (section.15.3) 1018 0 R (section.15.4) 1046 0 R (section.15.5) 1050 0 R (section.16.1) 1066 0 R (section.16.2) 1070 0 R (section.16.3) 1074 0 R (section.16.4) 1090 0 R (section.16.5) 1102 0 R (section.16.6) 1106 0 R (section.17.1) 1114 0 R (section.17.2) 1118 0 R (section.18.1) 1126 0 R (section.18.10) 1314 0 R (section.18.11) 1334 0 R (section.18.12) 1338 0 R (section.18.13) 1342 0 R (section.18.14) 1346 0 R (section.18.15) 1350 0 R (section.18.2) 1130 0 R (section.18.3) 1146 0 R (section.18.4) 1158 0 R (section.18.5) 1162 0 R (section.18.6) 1190 0 R (section.18.7) 1214 0 R (section.18.8) 1262 0 R (section.18.9) 1282 0 R (section.19.1) 1366 0 R (section.19.10) 1594 0 R (section.19.11) 1662 0 R (section.19.12) 1690 0 R (section.19.13) 1710 0 R (section.19.14) 1754 0 R (section.19.15) 1786 0 R (section.19.16) 1790 0 R (section.19.17) 1806 0 R (section.19.18) 1810 0 R (section.19.19) 1814 0 R (section.19.2) 1378 0 R (section.19.20) 1818 0 R (section.19.21) 1898 0 R (section.19.3) 1394 0 R (section.19.4) 1418 0 R (section.19.5) 1454 0 R (section.19.6) 1534 0 R (section.19.7) 1550 0 R (section.19.8) 1562 0 R (section.19.9) 1574 0 R (section.2.1) 42 0 R (section.2.2) 46 0 R (section.2.3) 62 0 R (section.2.4) 66 0 R (section.2.5) 70 0 R (section.2.6) 74 0 R (section.2.7) 78 0 R (section.20.1) 1906 0 R (section.20.2) 1910 0 R (section.20.3) 1914 0 R (section.20.4) 1938 0 R (section.21.1) 1954 0 R (section.21.2) 1958 0 R (section.21.3) 1962 0 R (section.21.4) 1970 0 R (section.21.5) 1998 0 R (section.21.6) 2042 0 R (section.21.7) 2046 0 R (section.22.1) 2058 0 R (section.22.2) 2062 0 R (section.22.3) 2066 0 R (section.22.4) 2074 0 R (section.22.5) 2082 0 R (section.23.1) 2090 0 R (section.23.2) 2094 0 R (section.23.3) 2118 0 R (section.23.4) 2134 0 R (section.23.5) 2138 0 R (section.24.1) 2150 0 R (section.24.2) 2154 0 R (section.24.3) 2218 0 R (section.24.4) 2222 0 R (section.24.5) 2226 0 R (section.24.6) 2246 0 R (section.25.1) 2266 0 R (section.25.2) 2270 0 R (section.25.3) 2322 0 R (section.26.1) 2338 0 R (section.26.2) 2342 0 R (section.26.3) 2346 0 R (section.26.4) 2366 0 R (section.26.5) 2390 0 R (section.27.1) 2410 0 R (section.27.2) 2414 0 R (section.27.3) 2418 0 R (section.27.4) 2422 0 R (section.27.5) 2426 0 R (section.27.6) 2430 0 R (section.28.1) 2442 0 R (section.28.2) 2446 0 R (section.29.1) 2454 0 R (section.3.1) 98 0 R (section.30.1) 2466 0 R (section.30.2) 2470 0 R (section.30.3) 2486 0 R (section.31.1) 2530 0 R (section.31.2) 2562 0 R (section.32.1) 2578 0 R (section.33.1) 2630 0 R (section.33.2) 2634 0 R (section.33.3) 2638 0 R (section.34.1) 2646 0 R (section.34.2) 2674 0 R (section.34.3) 2678 0 R (section.34.4) 2682 0 R (section.35.1) 2690 0 R (section.35.2) 2694 0 R (section.35.3) 2698 0 R (section.35.4) 2702 0 R (section.35.5) 2706 0 R (section.35.6) 2710 0 R (section.36.1) 2722 0 R (section.36.2) 2742 0 R (section.36.3) 2746 0 R (section.36.4) 2750 0 R (section.36.5) 2766 0 R (section.37.1) 2782 0 R (section.37.2) 2786 0 R (section.37.3) 2790 0 R (section.37.4) 2794 0 R (section.37.5) 2798 0 R (section.37.6) 2806 0 R (section.38.1) 2822 0 R (section.38.2) 2826 0 R (section.38.3) 2842 0 R (section.38.4) 2870 0 R (section.38.5) 2878 0 R (section.38.6) 2882 0 R (section.39.1) 2890 0 R (section.39.10) 2926 0 R (section.39.11) 2930 0 R (section.39.2) 2894 0 R (section.39.3) 2898 0 R (section.39.4) 2902 0 R (section.39.5) 2906 0 R (section.39.6) 2910 0 R (section.39.7) 2914 0 R (section.39.8) 2918 0 R (section.39.9) 2922 0 R (section.4.1) 110 0 R (section.4.2) 114 0 R (section.4.3) 118 0 R (section.4.4) 162 0 R (section.4.5) 166 0 R (section.40.1) 2938 0 R (section.41.1) 2946 0 R (section.41.2) 2950 0 R (section.5.1) 190 0 R (section.5.2) 194 0 R (section.5.3) 206 0 R (section.5.4) 210 0 R (section.5.5) 214 0 R (section.5.6) 238 0 R (section.6.1) 274 0 R (section.6.2) 278 0 R (section.6.3) 302 0 R (section.6.4) 310 0 R (section.7.1) 334 0 R (section.7.2) 338 0 R (section.7.3) 370 0 R (section.7.4) 382 0 R (section.7.5) 414 0 R (section.8.1) 430 0 R (section.8.2) 434 0 R (section.8.3) 438 0 R (section.8.4) 450 0 R (section.9.1) 458 0 R (securing-samba) 3089 0 R (small1) 5496 0 R (small10) 5641 0 R (small11) 5687 0 R (small12) 5696 0 R (small13) 5708 0 R (small14) 5809 0 R (small2) 5512 0 R (small3) 5516 0 R (small4) 5560 0 R (small5) 5564 0 R (small6) 5576 0 R (small7) 5586 0 R (small8) 5598 0 R (small9) 5606 0 R (speed) 3170 0 R (subfigure.10.1.1) 4600 0 R (subfigure.11.1.1) 4653 0 R (subfigure.12.1.1) 4799 0 R (subfigure.13.1.1) 4866 0 R (subfigure.16.1.1) 5109 0 R (subfigure.19.1.1) 5497 0 R (subfigure.19.10.1) 5642 0 R (subfigure.19.11.1) 5654 0 R (subfigure.19.12.1) 5663 0 R (subfigure.19.13.1) 5688 0 R (subfigure.19.14.1) 5697 0 R (subfigure.19.15.1) 5709 0 R (subfigure.19.16.1) 5810 0 R (subfigure.19.17.1) 6051 0 R (subfigure.19.18.1) 6116 0 R (subfigure.19.19.1) 6123 0 R (subfigure.19.2.1) 5513 0 R (subfigure.19.3.1) 5517 0 R (subfigure.19.4.1) 5561 0 R (subfigure.19.5.1) 5565 0 R (subfigure.19.6.1) 5577 0 R (subfigure.19.7.1) 5587 0 R (subfigure.19.8.1) 5599 0 R (subfigure.19.9.1) 5607 0 R (subfigure.5.1.1) 4285 0 R (subsection.10.3.1) 482 0 R (subsection.10.3.2) 486 0 R (subsection.10.3.3) 490 0 R (subsection.10.4.1) 498 0 R (subsection.10.4.2) 502 0 R (subsection.10.4.3) 506 0 R (subsection.10.4.4) 510 0 R (subsection.10.4.5) 514 0 R (subsection.10.4.6) 518 0 R (subsection.10.4.7) 522 0 R (subsection.10.4.8) 526 0 R (subsection.10.5.1) 534 0 R (subsection.10.5.2) 538 0 R (subsection.10.5.3) 542 0 R (subsection.10.6.1) 550 0 R (subsection.10.6.2) 554 0 R (subsection.10.7.1) 562 0 R (subsection.10.7.2) 566 0 R (subsection.10.7.3) 570 0 R (subsection.10.8.1) 582 0 R (subsection.10.8.2) 586 0 R (subsection.10.8.3) 590 0 R (subsection.11.1.1) 602 0 R (subsection.11.1.2) 606 0 R (subsection.11.2.1) 614 0 R (subsection.11.2.2) 626 0 R (subsection.11.2.3) 630 0 R (subsection.11.3.1) 638 0 R (subsection.11.3.2) 642 0 R (subsection.11.4.1) 650 0 R (subsection.11.4.2) 654 0 R (subsection.11.4.3) 658 0 R (subsection.11.4.4) 662 0 R (subsection.11.4.5) 706 0 R (subsection.11.4.6) 726 0 R (subsection.11.5.1) 734 0 R (subsection.11.5.2) 738 0 R (subsection.11.5.3) 742 0 R (subsection.12.2.1) 758 0 R (subsection.12.3.1) 766 0 R (subsection.12.3.2) 770 0 R (subsection.12.4.1) 778 0 R (subsection.12.4.2) 782 0 R (subsection.12.4.3) 786 0 R (subsection.13.2.1) 802 0 R (subsection.13.2.2) 806 0 R (subsection.13.2.3) 810 0 R (subsection.13.3.1) 818 0 R (subsection.13.3.2) 822 0 R (subsection.13.3.3) 826 0 R (subsection.13.4.1) 834 0 R (subsection.13.5.1) 850 0 R (subsection.13.5.2) 854 0 R (subsection.13.5.3) 858 0 R (subsection.13.5.4) 862 0 R (subsection.13.5.5) 874 0 R (subsection.13.5.6) 878 0 R (subsection.13.5.7) 882 0 R (subsection.13.6.1) 890 0 R (subsection.13.6.2) 894 0 R (subsection.13.6.3) 898 0 R (subsection.14.2.1) 914 0 R (subsection.14.3.1) 958 0 R (subsection.14.4.1) 974 0 R (subsection.14.4.2) 978 0 R (subsection.14.6.1) 990 0 R (subsection.14.6.2) 994 0 R (subsection.14.6.3) 998 0 R (subsection.15.3.1) 1022 0 R (subsection.15.3.2) 1026 0 R (subsection.15.3.3) 1030 0 R (subsection.15.3.4) 1034 0 R (subsection.15.3.5) 1038 0 R (subsection.15.3.6) 1042 0 R (subsection.15.5.1) 1054 0 R (subsection.15.5.2) 1058 0 R (subsection.16.3.1) 1078 0 R (subsection.16.3.2) 1082 0 R (subsection.16.3.3) 1086 0 R (subsection.16.4.1) 1094 0 R (subsection.16.4.2) 1098 0 R (subsection.18.10.1) 1318 0 R (subsection.18.10.2) 1322 0 R (subsection.18.10.3) 1326 0 R (subsection.18.10.4) 1330 0 R (subsection.18.15.1) 1354 0 R (subsection.18.15.2) 1358 0 R (subsection.18.2.1) 1134 0 R (subsection.18.2.2) 1138 0 R (subsection.18.2.3) 1142 0 R (subsection.18.3.1) 1150 0 R (subsection.18.3.2) 1154 0 R (subsection.18.5.1) 1166 0 R (subsection.18.5.2) 1170 0 R (subsection.18.5.3) 1174 0 R (subsection.18.5.4) 1178 0 R (subsection.18.5.5) 1182 0 R (subsection.18.5.6) 1186 0 R (subsection.18.6.1) 1194 0 R (subsection.18.6.2) 1198 0 R (subsection.18.6.3) 1202 0 R (subsection.18.6.4) 1206 0 R (subsection.18.6.5) 1210 0 R (subsection.18.7.1) 1218 0 R (subsection.18.7.2) 1222 0 R (subsection.18.8.1) 1266 0 R (subsection.18.8.2) 1270 0 R (subsection.18.8.3) 1274 0 R (subsection.18.8.4) 1278 0 R (subsection.18.9.1) 1286 0 R (subsection.18.9.2) 1290 0 R (subsection.18.9.3) 1294 0 R (subsection.18.9.4) 1298 0 R (subsection.18.9.5) 1302 0 R (subsection.18.9.6) 1306 0 R (subsection.18.9.7) 1310 0 R (subsection.19.1.1) 1370 0 R (subsection.19.1.2) 1374 0 R (subsection.19.10.1) 1598 0 R (subsection.19.10.10) 1634 0 R (subsection.19.10.11) 1638 0 R (subsection.19.10.12) 1642 0 R (subsection.19.10.13) 1646 0 R (subsection.19.10.14) 1650 0 R (subsection.19.10.15) 1654 0 R (subsection.19.10.16) 1658 0 R (subsection.19.10.2) 1602 0 R (subsection.19.10.3) 1606 0 R (subsection.19.10.4) 1610 0 R (subsection.19.10.5) 1614 0 R (subsection.19.10.6) 1618 0 R (subsection.19.10.7) 1622 0 R (subsection.19.10.8) 1626 0 R (subsection.19.10.9) 1630 0 R (subsection.19.11.1) 1666 0 R (subsection.19.11.2) 1670 0 R (subsection.19.11.3) 1674 0 R (subsection.19.11.4) 1678 0 R (subsection.19.11.5) 1682 0 R (subsection.19.11.6) 1686 0 R (subsection.19.12.1) 1694 0 R (subsection.19.12.2) 1698 0 R (subsection.19.12.3) 1702 0 R (subsection.19.12.4) 1706 0 R (subsection.19.13.1) 1714 0 R (subsection.19.13.2) 1750 0 R (subsection.19.14.1) 1758 0 R (subsection.19.14.2) 1762 0 R (subsection.19.14.3) 1766 0 R (subsection.19.14.4) 1770 0 R (subsection.19.14.5) 1774 0 R (subsection.19.14.6) 1778 0 R (subsection.19.14.7) 1782 0 R (subsection.19.16.1) 1794 0 R (subsection.19.16.2) 1798 0 R (subsection.19.16.3) 1802 0 R (subsection.19.2.1) 1382 0 R (subsection.19.2.2) 1386 0 R (subsection.19.2.3) 1390 0 R (subsection.19.20.1) 1822 0 R (subsection.19.20.10) 1858 0 R (subsection.19.20.11) 1862 0 R (subsection.19.20.12) 1866 0 R (subsection.19.20.13) 1870 0 R (subsection.19.20.14) 1874 0 R (subsection.19.20.15) 1878 0 R (subsection.19.20.16) 1882 0 R (subsection.19.20.17) 1886 0 R (subsection.19.20.18) 1890 0 R (subsection.19.20.19) 1894 0 R (subsection.19.20.2) 1826 0 R (subsection.19.20.3) 1830 0 R (subsection.19.20.4) 1834 0 R (subsection.19.20.5) 1838 0 R (subsection.19.20.6) 1842 0 R (subsection.19.20.7) 1846 0 R (subsection.19.20.8) 1850 0 R (subsection.19.20.9) 1854 0 R (subsection.19.3.1) 1398 0 R (subsection.19.3.2) 1402 0 R (subsection.19.3.3) 1406 0 R (subsection.19.3.4) 1410 0 R (subsection.19.3.5) 1414 0 R (subsection.19.4.1) 1422 0 R (subsection.19.4.2) 1426 0 R (subsection.19.4.3) 1430 0 R (subsection.19.4.4) 1434 0 R (subsection.19.4.5) 1438 0 R (subsection.19.4.6) 1442 0 R (subsection.19.4.7) 1446 0 R (subsection.19.4.8) 1450 0 R (subsection.19.5.1) 1458 0 R (subsection.19.5.10) 1494 0 R (subsection.19.5.11) 1498 0 R (subsection.19.5.12) 1502 0 R (subsection.19.5.13) 1506 0 R (subsection.19.5.14) 1510 0 R (subsection.19.5.15) 1514 0 R (subsection.19.5.16) 1518 0 R (subsection.19.5.17) 1522 0 R (subsection.19.5.18) 1526 0 R (subsection.19.5.19) 1530 0 R (subsection.19.5.2) 1462 0 R (subsection.19.5.3) 1466 0 R (subsection.19.5.4) 1470 0 R (subsection.19.5.5) 1474 0 R (subsection.19.5.6) 1478 0 R (subsection.19.5.7) 1482 0 R (subsection.19.5.8) 1486 0 R (subsection.19.5.9) 1490 0 R (subsection.19.6.1) 1538 0 R (subsection.19.6.2) 1542 0 R (subsection.19.6.3) 1546 0 R (subsection.19.7.1) 1554 0 R (subsection.19.7.2) 1558 0 R (subsection.19.8.1) 1566 0 R (subsection.19.8.2) 1570 0 R (subsection.19.9.1) 1578 0 R (subsection.19.9.2) 1582 0 R (subsection.19.9.3) 1586 0 R (subsection.19.9.4) 1590 0 R (subsection.2.2.1) 50 0 R (subsection.2.2.2) 58 0 R (subsection.2.7.1) 82 0 R (subsection.2.7.2) 86 0 R (subsection.2.7.3) 90 0 R (subsection.20.3.1) 1918 0 R (subsection.20.3.2) 1922 0 R (subsection.20.3.3) 1926 0 R (subsection.20.3.4) 1930 0 R (subsection.20.3.5) 1934 0 R (subsection.20.4.1) 1942 0 R (subsection.20.4.2) 1946 0 R (subsection.21.3.1) 1966 0 R (subsection.21.4.1) 1974 0 R (subsection.21.4.2) 1978 0 R (subsection.21.4.3) 1982 0 R (subsection.21.4.4) 1986 0 R (subsection.21.4.5) 1990 0 R (subsection.21.4.6) 1994 0 R (subsection.21.5.1) 2002 0 R (subsection.21.5.2) 2006 0 R (subsection.21.5.3) 2010 0 R (subsection.21.7.1) 2050 0 R (subsection.22.3.1) 2070 0 R (subsection.22.4.1) 2078 0 R (subsection.23.2.1) 2098 0 R (subsection.23.2.2) 2102 0 R (subsection.23.2.3) 2110 0 R (subsection.23.3.1) 2122 0 R (subsection.23.3.2) 2126 0 R (subsection.23.3.3) 2130 0 R (subsection.23.5.1) 2142 0 R (subsection.24.2.1) 2158 0 R (subsection.24.2.2) 2178 0 R (subsection.24.2.3) 2194 0 R (subsection.24.2.4) 2198 0 R (subsection.24.5.1) 2230 0 R (subsection.24.5.2) 2238 0 R (subsection.24.5.3) 2242 0 R (subsection.24.6.1) 2250 0 R (subsection.24.6.2) 2254 0 R (subsection.24.6.3) 2258 0 R (subsection.25.2.1) 2274 0 R (subsection.25.2.2) 2282 0 R (subsection.25.2.3) 2294 0 R (subsection.25.2.4) 2298 0 R (subsection.25.2.5) 2302 0 R (subsection.25.3.1) 2326 0 R (subsection.25.3.2) 2330 0 R (subsection.26.3.1) 2350 0 R (subsection.26.3.2) 2354 0 R (subsection.26.3.3) 2358 0 R (subsection.26.3.4) 2362 0 R (subsection.26.4.1) 2370 0 R (subsection.26.4.2) 2374 0 R (subsection.26.4.3) 2378 0 R (subsection.26.4.4) 2382 0 R (subsection.26.4.5) 2386 0 R (subsection.26.5.1) 2394 0 R (subsection.26.5.2) 2398 0 R (subsection.26.5.3) 2402 0 R (subsection.27.6.1) 2434 0 R (subsection.30.2.1) 2474 0 R (subsection.30.2.2) 2478 0 R (subsection.30.2.3) 2482 0 R (subsection.30.3.1) 2490 0 R (subsection.30.3.2) 2494 0 R (subsection.30.3.3) 2498 0 R (subsection.30.3.4) 2502 0 R (subsection.30.3.5) 2506 0 R (subsection.30.3.6) 2510 0 R (subsection.31.1.1) 2534 0 R (subsection.31.1.2) 2558 0 R (subsection.31.2.1) 2566 0 R (subsection.31.2.2) 2570 0 R (subsection.32.1.1) 2582 0 R (subsection.32.1.10) 2618 0 R (subsection.32.1.2) 2586 0 R (subsection.32.1.3) 2590 0 R (subsection.32.1.4) 2594 0 R (subsection.32.1.5) 2598 0 R (subsection.32.1.6) 2602 0 R (subsection.32.1.7) 2606 0 R (subsection.32.1.8) 2610 0 R (subsection.32.1.9) 2614 0 R (subsection.34.1.1) 2650 0 R (subsection.34.1.2) 2654 0 R (subsection.34.1.3) 2658 0 R (subsection.34.1.4) 2662 0 R (subsection.36.1.1) 2726 0 R (subsection.36.1.2) 2730 0 R (subsection.36.4.1) 2754 0 R (subsection.36.5.1) 2770 0 R (subsection.36.5.2) 2774 0 R (subsection.37.5.1) 2802 0 R (subsection.37.6.1) 2810 0 R (subsection.37.6.2) 2814 0 R (subsection.38.2.1) 2830 0 R (subsection.38.2.2) 2834 0 R (subsection.38.2.3) 2838 0 R (subsection.38.3.1) 2846 0 R (subsection.38.3.2) 2850 0 R (subsection.38.3.3) 2854 0 R (subsection.38.3.4) 2858 0 R (subsection.38.3.5) 2862 0 R (subsection.38.3.6) 2866 0 R (subsection.38.4.1) 2874 0 R (subsection.4.3.1) 122 0 R (subsection.4.3.2) 130 0 R (subsection.4.3.3) 138 0 R (subsection.4.3.4) 146 0 R (subsection.4.3.5) 154 0 R (subsection.4.5.1) 170 0 R (subsection.4.5.2) 174 0 R (subsection.4.5.3) 178 0 R (subsection.4.5.4) 182 0 R (subsection.5.2.1) 198 0 R (subsection.5.2.2) 202 0 R (subsection.5.5.1) 218 0 R (subsection.5.5.2) 234 0 R (subsection.5.6.1) 242 0 R (subsection.5.6.2) 246 0 R (subsection.5.6.3) 250 0 R (subsection.5.6.4) 254 0 R (subsection.5.6.5) 258 0 R (subsection.5.6.6) 262 0 R (subsection.5.6.7) 266 0 R (subsection.6.2.1) 282 0 R (subsection.6.2.2) 290 0 R (subsection.6.2.3) 294 0 R (subsection.6.2.4) 298 0 R (subsection.6.3.1) 306 0 R (subsection.6.4.1) 314 0 R (subsection.6.4.2) 318 0 R (subsection.6.4.3) 322 0 R (subsection.6.4.4) 326 0 R (subsection.7.2.1) 342 0 R (subsection.7.2.2) 346 0 R (subsection.7.2.3) 350 0 R (subsection.7.2.4) 354 0 R (subsection.7.3.1) 374 0 R (subsection.7.3.2) 378 0 R (subsection.7.4.1) 386 0 R (subsection.7.4.2) 390 0 R (subsection.7.4.3) 394 0 R (subsection.7.4.4) 402 0 R (subsection.7.4.5) 406 0 R (subsection.7.4.6) 410 0 R (subsection.7.5.1) 418 0 R (subsection.7.5.2) 422 0 R (subsection.8.3.1) 442 0 R (subsection.8.3.2) 446 0 R (subsubsection.10.7.3.1) 574 0 R (subsubsection.11.2.1.1) 618 0 R (subsubsection.11.2.1.2) 622 0 R (subsubsection.11.4.4.1) 666 0 R (subsubsection.11.4.4.10) 702 0 R (subsubsection.11.4.4.2) 670 0 R (subsubsection.11.4.4.3) 674 0 R (subsubsection.11.4.4.4) 678 0 R (subsubsection.11.4.4.5) 682 0 R (subsubsection.11.4.4.6) 686 0 R (subsubsection.11.4.4.7) 690 0 R (subsubsection.11.4.4.8) 694 0 R (subsubsection.11.4.4.9) 698 0 R (subsubsection.11.4.5.1) 710 0 R (subsubsection.11.4.5.2) 714 0 R (subsubsection.11.4.5.3) 718 0 R (subsubsection.11.4.5.4) 722 0 R (subsubsection.13.4.1.1) 838 0 R (subsubsection.13.4.1.2) 842 0 R (subsubsection.13.5.4.1) 866 0 R (subsubsection.13.5.4.2) 870 0 R (subsubsection.14.2.1.1) 918 0 R (subsubsection.14.2.1.2) 922 0 R (subsubsection.14.2.1.3) 926 0 R (subsubsection.14.2.1.4) 930 0 R (subsubsection.14.2.1.5) 934 0 R (subsubsection.14.2.1.6) 938 0 R (subsubsection.14.2.1.7) 942 0 R (subsubsection.14.2.1.8) 946 0 R (subsubsection.14.2.1.9) 950 0 R (subsubsection.14.3.1.1) 962 0 R (subsubsection.14.3.1.2) 966 0 R (subsubsection.18.7.2.1) 1226 0 R (subsubsection.18.7.2.2) 1230 0 R (subsubsection.18.7.2.3) 1234 0 R (subsubsection.18.7.2.4) 1238 0 R (subsubsection.18.7.2.5) 1242 0 R (subsubsection.18.7.2.6) 1246 0 R (subsubsection.18.7.2.7) 1250 0 R (subsubsection.18.7.2.8) 1254 0 R (subsubsection.18.7.2.9) 1258 0 R (subsubsection.19.13.1.1) 1718 0 R (subsubsection.19.13.1.2) 1722 0 R (subsubsection.19.13.1.3) 1726 0 R (subsubsection.19.13.1.4) 1730 0 R (subsubsection.19.13.1.5) 1734 0 R (subsubsection.19.13.1.6) 1738 0 R (subsubsection.19.13.1.7) 1742 0 R (subsubsection.19.13.1.8) 1746 0 R (subsubsection.2.2.1.1) 54 0 R (subsubsection.21.5.3.1) 2014 0 R (subsubsection.21.5.3.2) 2018 0 R (subsubsection.21.5.3.3) 2022 0 R (subsubsection.21.5.3.4) 2026 0 R (subsubsection.21.5.3.5) 2030 0 R (subsubsection.21.5.3.6) 2034 0 R (subsubsection.21.5.3.7) 2038 0 R (subsubsection.23.2.2.1) 2106 0 R (subsubsection.23.2.3.1) 2114 0 R (subsubsection.24.2.1.1) 2162 0 R (subsubsection.24.2.1.2) 2166 0 R (subsubsection.24.2.1.3) 2170 0 R (subsubsection.24.2.1.4) 2174 0 R (subsubsection.24.2.2.1) 2182 0 R (subsubsection.24.2.2.2) 2186 0 R (subsubsection.24.2.2.3) 2190 0 R (subsubsection.24.2.4.1) 2202 0 R (subsubsection.24.2.4.2) 2206 0 R (subsubsection.24.2.4.3) 2210 0 R (subsubsection.24.2.4.4) 2214 0 R (subsubsection.24.5.1.1) 2234 0 R (subsubsection.25.2.1.1) 2278 0 R (subsubsection.25.2.2.1) 2286 0 R (subsubsection.25.2.2.2) 2290 0 R (subsubsection.25.2.5.1) 2306 0 R (subsubsection.25.2.5.2) 2310 0 R (subsubsection.25.2.5.3) 2314 0 R (subsubsection.25.2.5.4) 2318 0 R (subsubsection.30.3.6.1) 2514 0 R (subsubsection.30.3.6.2) 2518 0 R (subsubsection.30.3.6.3) 2522 0 R (subsubsection.31.1.1.1) 2538 0 R (subsubsection.31.1.1.2) 2542 0 R (subsubsection.31.1.1.3) 2546 0 R (subsubsection.31.1.1.4) 2550 0 R (subsubsection.31.1.1.5) 2554 0 R (subsubsection.34.1.4.1) 2666 0 R (subsubsection.34.1.4.2) 2670 0 R (subsubsection.36.1.2.1) 2734 0 R (subsubsection.36.1.2.2) 2738 0 R (subsubsection.36.4.1.1) 2758 0 R (subsubsection.36.4.1.2) 2762 0 R (subsubsection.4.3.1.1) 126 0 R (subsubsection.4.3.2.1) 134 0 R (subsubsection.4.3.3.1) 142 0 R (subsubsection.4.3.4.1) 150 0 R (subsubsection.4.3.5.1) 158 0 R (subsubsection.5.5.1.1) 222 0 R (subsubsection.5.5.1.2) 226 0 R (subsubsection.5.5.1.3) 230 0 R (subsubsection.6.2.1.1) 286 0 R (subsubsection.7.2.4.1) 358 0 R (subsubsection.7.2.4.2) 362 0 R (subsubsection.7.2.4.3) 366 0 R (subsubsection.7.4.3.1) 398 0 R (table.10.1) 4603 0 R (table.10.2) 4609 0 R (table.10.3) 4611 0 R (table.10.4) 4613 0 R (table.11.1) 4750 0 R (table.11.2) 4765 0 R (table.11.3) 4771 0 R (table.13.1) 4857 0 R (table.13.2) 4877 0 R (table.13.3) 4885 0 R (table.13.4) 4887 0 R (table.19.1) 5633 0 R (table.20.1) 6145 0 R (table.24.1) 6502 0 R (table.24.2) 6504 0 R (table.24.3) 6516 0 R (table.25.1) 6588 0 R (table.26.1) 6645 0 R (table.26.2) 6647 0 R (table.30.1) 6767 0 R (table.31.1) 6835 0 R (table.31.2) 6843 0 R (table.7.1) 4388 0 R (troubleshooting) 6895 0 R (trusts1) 5108 0 R (type) 4078 0 R (unicode) 3128 0 R (upgrading-to-3.0) 3131 0 R (winbind) 4123 0 R (winbind-solaris9) 6241 0 R] -/Limits [(AccessControls) (winbind-solaris9)] +7586 0 obj << +/Names [(13small) 6002 0 R (1small) 5799 0 R (2small) 5809 0 R (3small) 5819 0 R (4small) 5863 0 R (5small) 5866 0 R (6small) 5876 0 R (7small) 5878 0 R (AccessControls) 3149 0 R (AdvancedNetworkManagement) 3186 0 R (AnonPtrSvr) 4617 0 R (Appendixes) 7338 0 R (Backup) 3222 0 R (CUPS-printing) 3155 0 R (ClientConfig) 3115 0 R (DMB) 4385 0 R (DNSDHCP) 3263 0 R (Doc-Start) 3018 0 R (FastStart) 3080 0 R (Further-Resources) 3264 0 R (InterdomainTrusts) 3152 0 R (IntroSMB) 3078 0 R (Item.1) 4205 0 R (Item.10) 4373 0 R (Item.100) 5659 0 R (Item.101) 5660 0 R (Item.102) 5714 0 R (Item.103) 5715 0 R (Item.104) 5716 0 R (Item.105) 6079 0 R (Item.106) 6080 0 R (Item.107) 6081 0 R (Item.108) 6082 0 R (Item.109) 6083 0 R (Item.11) 4374 0 R (Item.110) 6089 0 R (Item.111) 6090 0 R (Item.112) 6091 0 R (Item.113) 6114 0 R (Item.114) 6115 0 R (Item.115) 6116 0 R (Item.116) 6117 0 R (Item.117) 6136 0 R (Item.118) 6137 0 R (Item.119) 6142 0 R (Item.12) 4504 0 R (Item.120) 6143 0 R (Item.121) 6148 0 R (Item.122) 6149 0 R (Item.123) 6150 0 R (Item.124) 6155 0 R (Item.125) 6156 0 R (Item.126) 6157 0 R (Item.127) 6163 0 R (Item.128) 6164 0 R (Item.129) 6169 0 R (Item.13) 4505 0 R (Item.130) 6170 0 R (Item.131) 6171 0 R (Item.132) 6349 0 R (Item.133) 6350 0 R (Item.134) 6351 0 R (Item.135) 6352 0 R (Item.136) 6353 0 R (Item.137) 6358 0 R (Item.138) 6359 0 R (Item.139) 6360 0 R (Item.14) 4506 0 R (Item.140) 6361 0 R (Item.141) 6362 0 R (Item.142) 6363 0 R (Item.143) 6364 0 R (Item.144) 6365 0 R (Item.145) 6366 0 R (Item.146) 6367 0 R (Item.147) 6368 0 R (Item.148) 6620 0 R (Item.149) 6621 0 R (Item.15) 4507 0 R (Item.150) 6622 0 R (Item.151) 6623 0 R (Item.152) 6638 0 R (Item.153) 6643 0 R (Item.154) 6644 0 R (Item.155) 6645 0 R (Item.156) 6646 0 R (Item.157) 6647 0 R (Item.158) 6648 0 R (Item.159) 6649 0 R (Item.16) 4508 0 R (Item.160) 6650 0 R (Item.161) 6683 0 R (Item.162) 6684 0 R (Item.163) 6689 0 R (Item.164) 6690 0 R (Item.165) 6691 0 R (Item.166) 6692 0 R (Item.167) 6693 0 R (Item.168) 6694 0 R (Item.169) 6701 0 R (Item.17) 4513 0 R (Item.170) 6702 0 R (Item.171) 6703 0 R (Item.172) 6704 0 R (Item.173) 6705 0 R (Item.174) 6711 0 R (Item.175) 6712 0 R (Item.176) 6713 0 R (Item.177) 6714 0 R (Item.178) 6715 0 R (Item.179) 6718 0 R (Item.18) 4610 0 R (Item.180) 6719 0 R (Item.181) 6720 0 R (Item.182) 6725 0 R (Item.183) 6726 0 R (Item.184) 6727 0 R (Item.185) 6728 0 R (Item.186) 6729 0 R (Item.187) 6730 0 R (Item.188) 6731 0 R (Item.189) 6732 0 R (Item.19) 4611 0 R (Item.190) 6733 0 R (Item.191) 6734 0 R (Item.192) 6735 0 R (Item.193) 6736 0 R (Item.194) 6744 0 R (Item.195) 6745 0 R (Item.196) 6746 0 R (Item.197) 6747 0 R (Item.198) 6748 0 R (Item.199) 6749 0 R (Item.2) 4206 0 R (Item.20) 4613 0 R (Item.200) 6750 0 R (Item.201) 6773 0 R (Item.202) 6774 0 R (Item.203) 6775 0 R (Item.204) 6776 0 R (Item.205) 7011 0 R (Item.206) 7012 0 R (Item.207) 7013 0 R (Item.208) 7018 0 R (Item.209) 7019 0 R (Item.21) 4614 0 R (Item.210) 7020 0 R (Item.211) 7021 0 R (Item.212) 7022 0 R (Item.213) 7023 0 R (Item.214) 7024 0 R (Item.215) 7025 0 R (Item.216) 7026 0 R (Item.217) 7027 0 R (Item.218) 7028 0 R (Item.219) 7060 0 R (Item.22) 4656 0 R (Item.220) 7061 0 R (Item.221) 7065 0 R (Item.222) 7070 0 R (Item.223) 7109 0 R (Item.224) 7114 0 R (Item.225) 7115 0 R (Item.226) 7116 0 R (Item.227) 7117 0 R (Item.228) 7118 0 R (Item.229) 7119 0 R (Item.23) 4657 0 R (Item.230) 7120 0 R (Item.231) 7121 0 R (Item.232) 7172 0 R (Item.233) 7173 0 R (Item.234) 7178 0 R (Item.235) 7179 0 R (Item.236) 7225 0 R (Item.237) 7226 0 R (Item.238) 7232 0 R (Item.239) 7243 0 R (Item.24) 4658 0 R (Item.240) 7244 0 R (Item.241) 7245 0 R (Item.242) 7250 0 R (Item.243) 7251 0 R (Item.244) 7252 0 R (Item.245) 7253 0 R (Item.246) 7254 0 R (Item.247) 7255 0 R (Item.248) 7256 0 R (Item.249) 7261 0 R (Item.25) 4659 0 R (Item.250) 7262 0 R (Item.251) 7263 0 R (Item.252) 7264 0 R (Item.253) 7265 0 R (Item.254) 7266 0 R (Item.255) 7267 0 R (Item.256) 7354 0 R (Item.257) 7355 0 R (Item.258) 7356 0 R (Item.259) 7357 0 R (Item.26) 4660 0 R (Item.260) 7358 0 R (Item.27) 4661 0 R (Item.28) 4703 0 R (Item.29) 4704 0 R (Item.3) 4217 0 R (Item.30) 4705 0 R (Item.31) 4706 0 R (Item.32) 4787 0 R (Item.33) 4788 0 R (Item.34) 4789 0 R (Item.35) 4865 0 R (Item.36) 4871 0 R (Item.37) 4872 0 R (Item.38) 5020 0 R (Item.39) 5021 0 R (Item.4) 4218 0 R (Item.40) 5022 0 R (Item.41) 5061 0 R (Item.42) 5062 0 R (Item.43) 5063 0 R (Item.44) 5064 0 R (Item.45) 5065 0 R (Item.46) 5066 0 R (Item.47) 5072 0 R (Item.48) 5073 0 R (Item.49) 5074 0 R (Item.5) 4368 0 R (Item.50) 5141 0 R (Item.51) 5142 0 R (Item.52) 5148 0 R (Item.53) 5149 0 R (Item.54) 5150 0 R (Item.55) 5187 0 R (Item.56) 5188 0 R (Item.57) 5193 0 R (Item.58) 5194 0 R (Item.59) 5195 0 R (Item.6) 4369 0 R (Item.60) 5200 0 R (Item.61) 5428 0 R (Item.62) 5429 0 R (Item.63) 5430 0 R (Item.64) 5431 0 R (Item.65) 5432 0 R (Item.66) 5433 0 R (Item.67) 5434 0 R (Item.68) 5553 0 R (Item.69) 5554 0 R (Item.7) 4370 0 R (Item.70) 5555 0 R (Item.71) 5556 0 R (Item.72) 5608 0 R (Item.73) 5609 0 R (Item.74) 5610 0 R (Item.75) 5611 0 R (Item.76) 5612 0 R (Item.77) 5618 0 R (Item.78) 5619 0 R (Item.79) 5620 0 R (Item.8) 4371 0 R (Item.80) 5621 0 R (Item.81) 5622 0 R (Item.82) 5623 0 R (Item.83) 5624 0 R (Item.84) 5625 0 R (Item.85) 5626 0 R (Item.86) 5627 0 R (Item.87) 5641 0 R (Item.88) 5642 0 R (Item.89) 5643 0 R (Item.9) 4372 0 R (Item.90) 5644 0 R (Item.91) 5645 0 R (Item.92) 5651 0 R (Item.93) 5652 0 R (Item.94) 5653 0 R (Item.95) 5654 0 R (Item.96) 5655 0 R (Item.97) 5656 0 R (Item.98) 5657 0 R (Item.99) 5658 0 R (NT4Migration) 3225 0 R (NetworkBrowsing) 3116 0 R (Other-Clients) 3261 0 R (PDC-config) 4356 0 R (PolicyMgmt) 3187 0 R (Portability) 3260 0 R (ProfileLocs) 6783 0 R (ProfileMgmt) 3188 0 R (RefDocServer) 4600 0 R (SWAT) 3226 0 R (SambaHA) 3223 0 R (ServerType) 3081 0 R (SimplePrintServer) 4605 0 R (StandAloneServer) 3114 0 R (VFS) 3184 0 R (WKURIDS) 5030 0 R (XMLpassdb) 4866 0 R (a_small) 6381 0 R (access1) 5104 0 R (acctmgmttools) 4852 0 R (ads-create-machine-account) 4561 0 R (ads-member) 4244 0 R (ads-test-server) 4563 0 R (ads-test-smbclient) 4562 0 R (adsdnstech) 4458 0 R (assumptions) 4528 0 R (attribobjclPartA) 4937 0 R (attribobjclPartB) 4938 0 R (browse-force-master) 4690 0 R (browsing1) 4759 0 R (browsubnet) 4767 0 R (brsbex) 4771 0 R (brsex2) 4778 0 R (brsex3) 4781 0 R (bugreport) 3258 0 R (chapter*.1) 3044 0 R (chapter*.2) 3050 0 R (chapter*.3) 3269 0 R (chapter.1) 10 0 R (chapter.10) 490 0 R (chapter.11) 622 0 R (chapter.12) 774 0 R (chapter.13) 822 0 R (chapter.14) 934 0 R (chapter.15) 1038 0 R (chapter.16) 1094 0 R (chapter.17) 1142 0 R (chapter.18) 1158 0 R (chapter.19) 1394 0 R (chapter.2) 38 0 R (chapter.20) 1930 0 R (chapter.21) 1978 0 R (chapter.22) 2086 0 R (chapter.23) 2114 0 R (chapter.24) 2178 0 R (chapter.25) 2294 0 R (chapter.26) 2366 0 R (chapter.27) 2438 0 R (chapter.28) 2470 0 R (chapter.29) 2482 0 R (chapter.3) 98 0 R (chapter.30) 2494 0 R (chapter.31) 2558 0 R (chapter.32) 2606 0 R (chapter.33) 2682 0 R (chapter.34) 2698 0 R (chapter.35) 2742 0 R (chapter.36) 2774 0 R (chapter.37) 2838 0 R (chapter.38) 2878 0 R (chapter.39) 2946 0 R (chapter.4) 110 0 R (chapter.40) 2994 0 R (chapter.41) 3002 0 R (chapter.5) 190 0 R (chapter.6) 274 0 R (chapter.7) 346 0 R (chapter.8) 450 0 R (chapter.9) 478 0 R (compiling) 3259 0 R (confldapex) 4920 0 R (cups-exam-simple) 5763 0 R (cups-ppds) 5926 0 R (cups-raw) 4618 0 R (cups1) 6327 0 R (cups2) 6386 0 R (cupsadd-ex) 6034 0 R (cupsomatic-dia) 5942 0 R (defregpthkeys) 6798 0 R (dfscfg) 5403 0 R (diagnosis) 3227 0 R (dmbexample) 4673 0 R (domain-example) 4274 0 R (domain-member) 3113 0 R (domain-member-server) 4524 0 R (ethereal1) 7282 0 R (ethereal2) 7285 0 R (example.10.1) 4674 0 R (example.10.2) 4681 0 R (example.10.3) 4684 0 R (example.10.4) 4688 0 R (example.10.5) 4697 0 R (example.11.1) 4849 0 R (example.11.2) 4925 0 R (example.11.3) 4964 0 R (example.12.1) 5047 0 R (example.12.2) 5048 0 R (example.12.3) 5058 0 R (example.13.1) 5107 0 R (example.14.1) 5263 0 R (example.14.2) 5266 0 R (example.17.1) 5404 0 R (example.18.1) 5443 0 R (example.18.2) 5475 0 R (example.18.3) 5529 0 R (example.19.1) 5764 0 R (example.19.2) 5773 0 R (example.19.3) 6039 0 R (example.2.1) 4143 0 R (example.2.2) 4144 0 R (example.20.1) 6403 0 R (example.20.2) 6410 0 R (example.21.1) 6497 0 R (example.33.1) 7219 0 R (example.33.2) 7239 0 R (example.33.3) 7242 0 R (example.38.1) 7465 0 R (example.5.1) 4339 0 R (example.5.2) 4357 0 R (example.6.1) 4433 0 R (example.6.2) 4442 0 R (example.6.3) 4466 0 R (example.8.1) 4603 0 R (example.8.2) 4623 0 R (extbsdpr) 5469 0 R (fakeperms) 6417 0 R (far1) 5262 0 R (far3) 5265 0 R (fdpbc) 5119 0 R (figure.10.1) 4760 0 R (figure.11.1) 4828 0 R (figure.11.2) 4834 0 R (figure.12.1) 5012 0 R (figure.12.2) 5013 0 R (figure.12.3) 5018 0 R (figure.13.1) 5105 0 R (figure.16.1) 5375 0 R (figure.19.1) 5800 0 R (figure.19.10) 5943 0 R (figure.19.11) 5955 0 R (figure.19.12) 5958 0 R (figure.19.13) 5985 0 R (figure.19.14) 5994 0 R (figure.19.15) 6003 0 R (figure.19.16) 6101 0 R (figure.19.17) 6328 0 R (figure.19.18) 6387 0 R (figure.19.19) 6393 0 R (figure.19.2) 5810 0 R (figure.19.3) 5820 0 R (figure.19.4) 5864 0 R (figure.19.5) 5867 0 R (figure.19.6) 5877 0 R (figure.19.7) 5879 0 R (figure.19.8) 5891 0 R (figure.19.9) 5900 0 R (figure.34.1) 7283 0 R (figure.34.2) 7286 0 R (figure.5.1) 4275 0 R (gdipost) 5792 0 R (groupmapping) 3118 0 R (id2738032) 4102 0 R (id2738089) 4107 0 R (id2738226) 4113 0 R (id2805987) 4115 0 R (id2806076) 4121 0 R (id2806162) 4123 0 R (id2806351) 4128 0 R (id2806386) 4131 0 R (id2806424) 4132 0 R (id2806584) 4134 0 R (id2806740) 4147 0 R (id2806809) 4152 0 R (id2806875) 4156 0 R (id2806941) 4160 0 R (id2807059) 4165 0 R (id2807152) 4166 0 R (id2807183) 4170 0 R (id2807195) 4175 0 R (id2807305) 4176 0 R (id2807342) 4177 0 R (id2807441) 4182 0 R (id2807626) 4193 0 R (id2807724) 4198 0 R (id2807811) 4199 0 R (id2807917) 4204 0 R (id2807997) 4207 0 R (id2808040) 4208 0 R (id2808108) 4214 0 R (id2808152) 4215 0 R (id2808192) 4216 0 R (id2808448) 4231 0 R (id2808478) 4232 0 R (id2808555) 4242 0 R (id2808741) 4252 0 R (id2808831) 4253 0 R (id2809027) 4258 0 R (id2809056) 4263 0 R (id2809095) 4264 0 R (id2809132) 4265 0 R (id2809169) 4267 0 R (id2809543) 4280 0 R (id2809825) 4297 0 R (id2809840) 4298 0 R (id2810103) 4321 0 R (id2810488) 4336 0 R (id2810983) 4352 0 R (id2811021) 4353 0 R (id2811036) 4354 0 R (id2811085) 4355 0 R (id2811181) 4362 0 R (id2811218) 4363 0 R (id2811471) 4381 0 R (id2811602) 4383 0 R (id2811609) 4384 0 R (id2811693) 4390 0 R (id2811754) 4391 0 R (id2811846) 4396 0 R (id2811923) 4397 0 R (id2811956) 4398 0 R (id2811979) 4404 0 R (id2812187) 4410 0 R (id2812578) 4420 0 R (id2812606) 4421 0 R (id2812782) 4430 0 R (id2812900) 4435 0 R (id2813109) 4443 0 R (id2813130) 4444 0 R (id2813172) 4452 0 R (id2813205) 4454 0 R (id2813217) 4455 0 R (id2813285) 4457 0 R (id2813555) 4463 0 R (id2813785) 4471 0 R (id2813807) 4473 0 R (id2813847) 4474 0 R (id2813882) 4479 0 R (id2813951) 4480 0 R (id2814194) 4485 0 R (id2814544) 4495 0 R (id2814867) 4501 0 R (id2815134) 4514 0 R (id2815213) 4515 0 R (id2815226) 4516 0 R (id2815309) 4521 0 R (id2815350) 4522 0 R (id2815439) 4526 0 R (id2815946) 4538 0 R (id2816152) 4548 0 R (id2816289) 4553 0 R (id2816673) 4572 0 R (id2816862) 4573 0 R (id2816898) 4578 0 R (id2817030) 4579 0 R (id2817060) 4580 0 R (id2817094) 4586 0 R (id2817259) 4587 0 R (id2817345) 4592 0 R (id2817384) 4593 0 R (id2817457) 4598 0 R (id2818092) 4624 0 R (id2818155) 4629 0 R (id2818308) 4640 0 R (id2818401) 4645 0 R (id2818725) 4650 0 R (id2818995) 4651 0 R (id2819348) 4666 0 R (id2819917) 4685 0 R (id2820332) 4702 0 R (id2820509) 4707 0 R (id2820526) 4712 0 R (id2820563) 4713 0 R (id2820722) 4714 0 R (id2820799) 4720 0 R (id2820982) 4726 0 R (id2821255) 4731 0 R (id2821291) 4732 0 R (id2821377) 4733 0 R (id2821390) 4738 0 R (id2821458) 4739 0 R (id2821635) 4744 0 R (id2821688) 4745 0 R (id2821820) 4750 0 R (id2821950) 4756 0 R (id2822012) 4757 0 R (id2822722) 4790 0 R (id2822738) 4791 0 R (id2822796) 4792 0 R (id2822852) 4793 0 R (id2822911) 4798 0 R (id2823337) 4804 0 R (id2823385) 4809 0 R (id2823545) 4811 0 R (id2823938) 4829 0 R (id2824084) 4839 0 R (id2824139) 4840 0 R (id2824175) 4841 0 R (id2824492) 4853 0 R (id2825080) 4873 0 R (id2825131) 4874 0 R (id2825171) 4875 0 R (id2825298) 4880 0 R (id2825352) 4881 0 R (id2825500) 4893 0 R (id2825524) 4895 0 R (id2825637) 4901 0 R (id2825846) 4906 0 R (id2825987) 4916 0 R (id2826416) 4918 0 R (id2826493) 4919 0 R (id2826653) 4931 0 R (id2827196) 4936 0 R (id2827262) 4943 0 R (id2827436) 4945 0 R (id2827468) 4951 0 R (id2827535) 4952 0 R (id2828350) 4965 0 R (id2828389) 4966 0 R (id2828520) 4971 0 R (id2828526) 4972 0 R (id2828570) 4974 0 R (id2828662) 4975 0 R (id2828920) 5000 0 R (id2829292) 5019 0 R (id2829594) 5027 0 R (id2830229) 5029 0 R (id2830309) 5036 0 R (id2830322) 5037 0 R (id2830458) 5040 0 R (id2830566) 5051 0 R (id2830580) 5052 0 R (id2830649) 5059 0 R (id2830675) 5060 0 R (id2831083) 5079 0 R (id2831258) 5084 0 R (id2831276) 5085 0 R (id2831688) 5094 0 R (id2831708) 5095 0 R (id2831782) 5097 0 R (id2831934) 5106 0 R (id2832020) 5113 0 R (id2832061) 5114 0 R (id2832502) 5116 0 R (id2832902) 5125 0 R (id2833298) 5127 0 R (id2833383) 5134 0 R (id2833396) 5135 0 R (id2833484) 5143 0 R (id2833691) 5151 0 R (id2833699) 5152 0 R (id2833754) 5157 0 R (id2833837) 5158 0 R (id2833977) 5167 0 R (id2834076) 5168 0 R (id2834184) 5169 0 R (id2834227) 5174 0 R (id2834411) 5175 0 R (id2834820) 5184 0 R (id2834908) 5185 0 R (id2834921) 5186 0 R (id2835348) 5201 0 R (id2835404) 5202 0 R (id2835658) 5212 0 R (id2835715) 5213 0 R (id2835862) 5218 0 R (id2836187) 5227 0 R (id2836212) 5228 0 R (id2836249) 5233 0 R (id2836275) 5234 0 R (id2836308) 5235 0 R (id2836333) 5236 0 R (id2836359) 5242 0 R (id2836452) 5243 0 R (id2836513) 5244 0 R (id2836578) 5249 0 R (id2836700) 5254 0 R (id2836713) 5255 0 R (id2836810) 5256 0 R (id2837129) 5267 0 R (id2837359) 5281 0 R (id2837388) 5282 0 R (id2837468) 5287 0 R (id2837496) 5288 0 R (id2837578) 5294 0 R (id2837612) 5295 0 R (id2837633) 5298 0 R (id2837662) 5301 0 R (id2837843) 5319 0 R (id2837888) 5320 0 R (id2837972) 5326 0 R (id2837990) 5331 0 R (id2838093) 5332 0 R (id2838153) 5333 0 R (id2838236) 5339 0 R (id2838292) 5340 0 R (id2838376) 5345 0 R (id2838436) 5346 0 R (id2838460) 5348 0 R (id2838479) 5349 0 R (id2838503) 5354 0 R (id2838856) 5359 0 R (id2838885) 5360 0 R (id2838968) 5366 0 R (id2838996) 5367 0 R (id2839068) 5368 0 R (id2839128) 5369 0 R (id2839325) 5381 0 R (id2839536) 5387 0 R (id2839678) 5388 0 R (id2839784) 5394 0 R (id2839885) 5399 0 R (id2840174) 5409 0 R (id2840215) 5410 0 R (id2840392) 5420 0 R (id2840481) 5422 0 R (id2840545) 5427 0 R (id2840617) 5439 0 R (id2840714) 5440 0 R (id2840927) 5448 0 R (id2841043) 5454 0 R (id2841383) 5464 0 R (id2841736) 5467 0 R (id2841749) 5468 0 R (id2842741) 5489 0 R (id2843087) 5496 0 R (id2843145) 5497 0 R (id2843780) 5508 0 R (id2844125) 5513 0 R (id2844278) 5520 0 R (id2844421) 5521 0 R (id2844521) 5526 0 R (id2844733) 5530 0 R (id2845066) 5535 0 R (id2845237) 5540 0 R (id2845346) 5546 0 R (id2845660) 5557 0 R (id2846012) 5569 0 R (id2846169) 5570 0 R (id2846400) 5575 0 R (id2846521) 5580 0 R (id2846621) 5586 0 R (id2846788) 5591 0 R (id2846987) 5596 0 R (id2847090) 5601 0 R (id2847244) 5602 0 R (id2847262) 5607 0 R (id2847494) 5613 0 R (id2847828) 5633 0 R (id2847936) 5634 0 R (id2848121) 5639 0 R (id2848145) 5640 0 R (id2848570) 5665 0 R (id2848868) 5677 0 R (id2849175) 5683 0 R (id2849281) 5684 0 R (id2849584) 5697 0 R (id2849670) 5698 0 R (id2849695) 5699 0 R (id2849733) 5706 0 R (id2849775) 5707 0 R (id2849794) 5708 0 R (id2849815) 5709 0 R (id2849976) 5717 0 R (id2850301) 5729 0 R (id2850348) 5730 0 R (id2850535) 5736 0 R (id2850558) 5738 0 R (id2850565) 5739 0 R (id2850616) 5740 0 R (id2850745) 5745 0 R (id2850752) 5746 0 R (id2850804) 5748 0 R (id2850856) 5750 0 R (id2850949) 5756 0 R (id2851200) 5761 0 R (id2851394) 5765 0 R (id2851760) 5774 0 R (id2851779) 5775 0 R (id2851833) 5780 0 R (id2851894) 5781 0 R (id2852217) 5786 0 R (id2852364) 5791 0 R (id2852541) 5793 0 R (id2852714) 5801 0 R (id2853012) 5818 0 R (id2853154) 5826 0 R (id2853230) 5827 0 R (id2853336) 5834 0 R (id2853358) 5835 0 R (id2853545) 5842 0 R (id2853775) 5847 0 R (id2853932) 5852 0 R (id2853980) 5853 0 R (id2854126) 5854 0 R (id2854236) 5865 0 R (id2854361) 5868 0 R (id2854557) 5888 0 R (id2854635) 5892 0 R (id2854787) 5893 0 R (id2855152) 5906 0 R (id2855311) 5911 0 R (id2855325) 5912 0 R (id2855391) 5918 0 R (id2855499) 5919 0 R (id2855762) 5924 0 R (id2856058) 5933 0 R (id2856370) 5945 0 R (id2856752) 5959 0 R (id2856888) 5970 0 R (id2856969) 5972 0 R (id2856989) 5980 0 R (id2857060) 5983 0 R (id2857133) 5986 0 R (id2857244) 5995 0 R (id2857266) 5996 0 R (id2857461) 6004 0 R (id2857550) 6005 0 R (id2857652) 6012 0 R (id2857705) 6013 0 R (id2857787) 6014 0 R (id2857804) 6019 0 R (id2857848) 6020 0 R (id2857870) 6021 0 R (id2857921) 6022 0 R (id2857986) 6027 0 R (id2858005) 6028 0 R (id2858122) 6029 0 R (id2858364) 6031 0 R (id2858660) 6044 0 R (id2858790) 6049 0 R (id2858821) 6050 0 R (id2858890) 6056 0 R (id2859188) 6062 0 R (id2859417) 6067 0 R (id2859562) 6068 0 R (id2859792) 6078 0 R (id2859969) 6088 0 R (id2860066) 6092 0 R (id2860155) 6098 0 R (id2860238) 6102 0 R (id2860418) 6108 0 R (id2860493) 6113 0 R (id2860701) 6118 0 R (id2860847) 6124 0 R (id2860976) 6125 0 R (id2861138) 6130 0 R (id2861386) 6135 0 R (id2862516) 6172 0 R (id2862684) 6177 0 R (id2862928) 6178 0 R (id2863007) 6179 0 R (id2863077) 6184 0 R (id2863135) 6185 0 R (id2863280) 6186 0 R (id2863468) 6195 0 R (id2863509) 6204 0 R (id2863544) 6203 0 R (id2863619) 6207 0 R (id2863708) 6213 0 R (id2863890) 6225 0 R (id2863990) 6233 0 R (id2864080) 6237 0 R (id2864154) 6246 0 R (id2864230) 6249 0 R (id2864781) 6273 0 R (id2864823) 6278 0 R (id2864892) 6279 0 R (id2864940) 6281 0 R (id2865070) 6287 0 R (id2865240) 6288 0 R (id2865319) 6293 0 R (id2865374) 6294 0 R (id2865594) 6299 0 R (id2865658) 6300 0 R (id2865761) 6305 0 R (id2865931) 6306 0 R (id2865989) 6311 0 R (id2866284) 6318 0 R (id2866378) 6319 0 R (id2866384) 6320 0 R (id2866402) 6321 0 R (id2866452) 6329 0 R (id2866536) 6330 0 R (id2866564) 6335 0 R (id2866670) 6336 0 R (id2866722) 6337 0 R (id2866764) 6338 0 R (id2866803) 6339 0 R (id2866841) 6344 0 R (id2866857) 6345 0 R (id2866886) 6346 0 R (id2866914) 6347 0 R (id2866966) 6348 0 R (id2867280) 6369 0 R (id2867343) 6370 0 R (id2867399) 6376 0 R (id2867515) 6377 0 R (id2867572) 6378 0 R (id2867629) 6379 0 R (id2867831) 6399 0 R (id2867849) 6400 0 R (id2868104) 6411 0 R (id2868111) 6412 0 R (id2868147) 6413 0 R (id2868321) 6422 0 R (id2868551) 6427 0 R (id2868595) 6428 0 R (id2868617) 6429 0 R (id2868679) 6432 0 R (id2868917) 6438 0 R (id2869041) 6444 0 R (id2869123) 6445 0 R (id2869198) 6450 0 R (id2869236) 6451 0 R (id2869265) 6452 0 R (id2869299) 6453 0 R (id2869325) 6458 0 R (id2869460) 6459 0 R (id2869538) 6466 0 R (id2869571) 6467 0 R (id2869608) 6472 0 R (id2869615) 6473 0 R (id2869681) 6474 0 R (id2869764) 6479 0 R (id2869825) 6484 0 R (id2870065) 6490 0 R (id2870155) 6494 0 R (id2870321) 6502 0 R (id2870380) 6503 0 R (id2870676) 6508 0 R (id2870684) 6510 0 R (id2870860) 6520 0 R (id2870976) 6528 0 R (id2871012) 6529 0 R (id2871125) 6536 0 R (id2871363) 6542 0 R (id2871478) 6551 0 R (id2871497) 6552 0 R (id2871550) 6553 0 R (id2871597) 6554 0 R (id2871806) 6563 0 R (id2871838) 6564 0 R (id2871979) 6572 0 R (id2871997) 6573 0 R (id2872229) 6581 0 R (id2872481) 6592 0 R (id2872595) 6598 0 R (id2872689) 6599 0 R (id2872823) 6606 0 R (id2872935) 6612 0 R (id2873046) 6613 0 R (id2873077) 6614 0 R (id2873195) 6619 0 R (id2873366) 6628 0 R (id2873526) 6633 0 R (id2873541) 6634 0 R (id2873638) 6635 0 R (id2873661) 6636 0 R (id2873706) 6637 0 R (id2873851) 6651 0 R (id2873865) 6652 0 R (id2873966) 6662 0 R (id2874000) 6663 0 R (id2874040) 6664 0 R (id2874054) 6669 0 R (id2874193) 6670 0 R (id2874324) 6675 0 R (id2874391) 6676 0 R (id2874599) 6681 0 R (id2874607) 6682 0 R (id2875220) 6699 0 R (id2875405) 6700 0 R (id2875621) 6717 0 R (id2875946) 6737 0 R (id2876034) 6738 0 R (id2876051) 6743 0 R (id2876231) 6751 0 R (id2876254) 6752 0 R (id2876295) 6757 0 R (id2876364) 6758 0 R (id2876459) 6760 0 R (id2876512) 6765 0 R (id2876541) 6766 0 R (id2876643) 6767 0 R (id2876692) 6772 0 R (id2877314) 6792 0 R (id2877880) 6804 0 R (id2877893) 6805 0 R (id2877959) 6810 0 R (id2878167) 6815 0 R (id2878453) 6822 0 R (id2878778) 6827 0 R (id2878809) 6832 0 R (id2878875) 6833 0 R (id2879795) 6852 0 R (id2879826) 6853 0 R (id2879857) 6854 0 R (id2880144) 6863 0 R (id2880234) 6864 0 R (id2880357) 6869 0 R (id2880615) 6871 0 R (id2880669) 6878 0 R (id2880725) 6883 0 R (id2880770) 6884 0 R (id2880816) 6885 0 R (id2880829) 6886 0 R (id2880940) 6892 0 R (id2881191) 6901 0 R (id2881216) 6902 0 R (id2881281) 6907 0 R (id2881338) 6908 0 R (id2881490) 6913 0 R (id2881533) 6914 0 R (id2881598) 6919 0 R (id2881713) 6925 0 R (id2882065) 6936 0 R (id2882132) 6937 0 R (id2882346) 6946 0 R (id2882379) 6947 0 R (id2882412) 6948 0 R (id2882528) 6955 0 R (id2882544) 6956 0 R (id2882584) 6957 0 R (id2882636) 6962 0 R (id2882877) 6968 0 R (id2882922) 6970 0 R (id2883002) 6976 0 R (id2883130) 6977 0 R (id2883146) 6978 0 R (id2883284) 6985 0 R (id2883291) 6986 0 R (id2883406) 6991 0 R (id2883421) 6992 0 R (id2883490) 6997 0 R (id2883638) 7008 0 R (id2883761) 7010 0 R (id2883913) 7029 0 R (id2883936) 7030 0 R (id2884067) 7035 0 R (id2884487) 7048 0 R (id2884568) 7049 0 R (id2884575) 7050 0 R (id2884827) 7059 0 R (id2884899) 7062 0 R (id2884921) 7064 0 R (id2885081) 7072 0 R (id2885093) 7073 0 R (id2885271) 7078 0 R (id2885380) 7079 0 R (id2885519) 7088 0 R (id2885544) 7089 0 R (id2885756) 7099 0 R (id2885825) 7100 0 R (id2885888) 7105 0 R (id2885951) 7106 0 R (id2885996) 7107 0 R (id2886021) 7108 0 R (id2886276) 7122 0 R (id2886381) 7130 0 R (id2886664) 7134 0 R (id2887144) 7148 0 R (id2887238) 7155 0 R (id2887252) 7156 0 R (id2887302) 7157 0 R (id2887431) 7162 0 R (id2887849) 7171 0 R (id2887979) 7181 0 R (id2888149) 7187 0 R (id2888164) 7188 0 R (id2888237) 7190 0 R (id2888359) 7195 0 R (id2888423) 7196 0 R (id2888488) 7197 0 R (id2888561) 7202 0 R (id2888613) 7203 0 R (id2888636) 7204 0 R (id2888793) 7214 0 R (id2888831) 7215 0 R (id2889067) 7224 0 R (id2890757) 7272 0 R (id2890779) 7273 0 R (id2890943) 7274 0 R (id2890979) 7280 0 R (id2891124) 7287 0 R (id2891144) 7288 0 R (id2891413) 7294 0 R (id2891440) 7295 0 R (id2891481) 7299 0 R (id2891657) 7306 0 R (id2891812) 7312 0 R (id2891874) 7315 0 R (id2891910) 7317 0 R (id2892119) 7322 0 R (id2892254) 7327 0 R (id2892300) 7328 0 R (id2892496) 7340 0 R (id2892504) 7341 0 R (id2892550) 7344 0 R (id2892566) 7345 0 R (id2892608) 7347 0 R (id2892813) 7359 0 R (id2892890) 7365 0 R (id2893055) 7370 0 R (id2893270) 7375 0 R (id2893351) 7376 0 R (id2893380) 7381 0 R (id2893430) 7382 0 R (id2893460) 7383 0 R (id2893568) 7388 0 R (id2893814) 7394 0 R (id2894016) 7399 0 R (id2894103) 7400 0 R (id2894147) 7406 0 R (id2894318) 7411 0 R (id2894361) 7412 0 R (id2894369) 7413 0 R (id2894394) 7418 0 R (id2894401) 7419 0 R (id2894612) 7424 0 R (id2894689) 7430 0 R (id2894694) 7431 0 R (id2894831) 7437 0 R (id2894894) 7440 0 R (id2895000) 7445 0 R (id2895007) 7446 0 R (id2895094) 7447 0 R (id2895124) 7448 0 R (id2895184) 7449 0 R (id2895222) 7450 0 R (id2895240) 7455 0 R (id2895286) 7456 0 R (id2895360) 7457 0 R (id2895384) 7458 0 R (id2895586) 7466 0 R (id2895716) 7472 0 R (id2895762) 7473 0 R (id2895854) 7478 0 R (id2895904) 7479 0 R (id2895959) 7480 0 R (id2895990) 7481 0 R (id2896074) 7487 0 R (id2896137) 7488 0 R (id2896166) 7489 0 R (id2896189) 7491 0 R (id2896249) 7492 0 R (id2896369) 7501 0 R (id2896435) 7506 0 R (id2896832) 7535 0 R (idmap-gid2sid) 5006 0 R (idmap-sid2gid) 5005 0 R (idmap-sid2uid) 4822 0 R (idmap-store-gid2sid) 5007 0 R (idmap-uid2sid) 4823 0 R (idmapbackend) 4846 0 R (idmapbackendexample) 4848 0 R (inst-rpc) 5548 0 R (install) 3079 0 R (integrate-ms-networks) 3220 0 R (introduction) 4101 0 R (ldappwsync) 4946 0 R (lmbexample) 4676 0 R (locking) 3150 0 R (machine-trust-accounts) 4312 0 R (majtypes) 7124 0 R (mcoc) 5128 0 R (migration) 7007 0 R (minim-bdc) 4465 0 R (minimalPDC) 4432 0 R (minimalprofile) 7464 0 R (modif1) 7238 0 R (modif2) 7241 0 R (moremysqlpdbe) 4958 0 R (msdfs) 3153 0 R (mulitldapcfg) 4441 0 R (multimodule) 6405 0 R (mysqlpbe) 4957 0 R (mysqlsam) 4959 0 R (natconchoices) 7132 0 R (netbiosnamesgrp) 6930 0 R (netdiscuss) 4447 0 R (nombexample) 4683 0 R (optional) 4639 0 R (overridesettings) 5768 0 R (page.1) 3017 0 R (page.10) 3268 0 R (page.100) 4694 0 R (page.101) 4701 0 R (page.102) 4711 0 R (page.103) 4719 0 R (page.104) 4725 0 R (page.105) 4730 0 R (page.106) 4737 0 R (page.107) 4743 0 R (page.108) 4749 0 R (page.109) 4755 0 R (page.11) 3309 0 R (page.110) 4765 0 R (page.111) 4775 0 R (page.112) 4786 0 R (page.113) 4797 0 R (page.114) 4803 0 R (page.115) 4808 0 R (page.116) 4819 0 R (page.117) 4827 0 R (page.118) 4833 0 R (page.119) 4838 0 R (page.12) 3365 0 R (page.120) 4845 0 R (page.121) 4857 0 R (page.122) 4862 0 R (page.123) 4870 0 R (page.124) 4879 0 R (page.125) 4890 0 R (page.126) 4900 0 R (page.127) 4905 0 R (page.128) 4911 0 R (page.129) 4915 0 R (page.13) 3420 0 R (page.130) 4924 0 R (page.131) 4930 0 R (page.132) 4942 0 R (page.133) 4950 0 R (page.134) 4963 0 R (page.135) 4970 0 R (page.136) 4979 0 R (page.137) 4984 0 R (page.138) 4991 0 R (page.139) 4999 0 R (page.14) 3478 0 R (page.140) 5011 0 R (page.141) 5017 0 R (page.142) 5026 0 R (page.143) 5034 0 R (page.144) 5046 0 R (page.145) 5057 0 R (page.146) 5071 0 R (page.147) 5078 0 R (page.148) 5083 0 R (page.149) 5089 0 R (page.15) 3531 0 R (page.150) 5093 0 R (page.151) 5102 0 R (page.152) 5112 0 R (page.153) 5123 0 R (page.154) 5132 0 R (page.155) 5139 0 R (page.156) 5147 0 R (page.157) 5156 0 R (page.158) 5166 0 R (page.159) 5173 0 R (page.16) 3586 0 R (page.160) 5179 0 R (page.161) 5183 0 R (page.162) 5192 0 R (page.163) 5199 0 R (page.164) 5207 0 R (page.165) 5211 0 R (page.166) 5217 0 R (page.167) 5222 0 R (page.168) 5226 0 R (page.169) 5232 0 R (page.17) 3641 0 R (page.170) 5241 0 R (page.171) 5248 0 R (page.172) 5253 0 R (page.173) 5260 0 R (page.174) 5271 0 R (page.175) 5275 0 R (page.176) 5280 0 R (page.177) 5286 0 R (page.178) 5293 0 R (page.179) 5311 0 R (page.18) 3696 0 R (page.180) 5318 0 R (page.181) 5330 0 R (page.182) 5338 0 R (page.183) 5344 0 R (page.184) 5353 0 R (page.185) 5358 0 R (page.186) 5365 0 R (page.187) 5373 0 R (page.188) 5380 0 R (page.189) 5386 0 R (page.19) 3752 0 R (page.190) 5393 0 R (page.191) 5398 0 R (page.192) 5408 0 R (page.193) 5414 0 R (page.194) 5419 0 R (page.195) 5426 0 R (page.196) 5438 0 R (page.197) 5447 0 R (page.198) 5453 0 R (page.199) 5458 0 R (page.2) 3029 0 R (page.20) 3807 0 R (page.200) 5463 0 R (page.201) 5474 0 R (page.202) 5479 0 R (page.203) 5484 0 R (page.204) 5488 0 R (page.205) 5495 0 R (page.206) 5507 0 R (page.207) 5512 0 R (page.208) 5519 0 R (page.209) 5525 0 R (page.21) 3860 0 R (page.210) 5534 0 R (page.211) 5539 0 R (page.212) 5545 0 R (page.213) 5552 0 R (page.214) 5564 0 R (page.215) 5568 0 R (page.216) 5574 0 R (page.217) 5579 0 R (page.218) 5585 0 R (page.219) 5590 0 R (page.22) 3914 0 R (page.220) 5595 0 R (page.221) 5600 0 R (page.222) 5606 0 R (page.223) 5617 0 R (page.224) 5632 0 R (page.225) 5638 0 R (page.226) 5650 0 R (page.227) 5664 0 R (page.228) 5672 0 R (page.229) 5676 0 R (page.23) 3964 0 R (page.230) 5682 0 R (page.231) 5688 0 R (page.232) 5692 0 R (page.233) 5696 0 R (page.234) 5705 0 R (page.235) 5713 0 R (page.236) 5724 0 R (page.237) 5728 0 R (page.238) 5734 0 R (page.239) 5744 0 R (page.24) 4015 0 R (page.240) 5754 0 R (page.241) 5760 0 R (page.242) 5772 0 R (page.243) 5779 0 R (page.244) 5785 0 R (page.245) 5790 0 R (page.246) 5798 0 R (page.247) 5807 0 R (page.248) 5817 0 R (page.249) 5825 0 R (page.25) 4066 0 R (page.250) 5833 0 R (page.251) 5839 0 R (page.252) 5846 0 R (page.253) 5851 0 R (page.254) 5862 0 R (page.255) 5875 0 R (page.256) 5887 0 R (page.257) 5898 0 R (page.258) 5905 0 R (page.259) 5910 0 R (page.26) 4096 0 R (page.260) 5917 0 R (page.261) 5923 0 R (page.262) 5931 0 R (page.263) 5941 0 R (page.264) 5952 0 R (page.265) 5963 0 R (page.266) 5979 0 R (page.267) 5993 0 R (page.268) 6001 0 R (page.269) 6011 0 R (page.27) 4100 0 R (page.270) 6018 0 R (page.271) 6026 0 R (page.272) 6038 0 R (page.273) 6043 0 R (page.274) 6048 0 R (page.275) 6055 0 R (page.276) 6060 0 R (page.277) 6066 0 R (page.278) 6073 0 R (page.279) 6077 0 R (page.28) 4106 0 R (page.280) 6087 0 R (page.281) 6097 0 R (page.282) 6107 0 R (page.283) 6112 0 R (page.284) 6123 0 R (page.285) 6129 0 R (page.286) 6134 0 R (page.287) 6141 0 R (page.288) 6147 0 R (page.289) 6154 0 R (page.29) 4111 0 R (page.290) 6162 0 R (page.291) 6168 0 R (page.292) 6176 0 R (page.293) 6183 0 R (page.294) 6190 0 R (page.295) 6202 0 R (page.296) 6212 0 R (page.297) 6232 0 R (page.298) 6245 0 R (page.299) 6258 0 R (page.3) 3043 0 R (page.30) 4119 0 R (page.300) 6272 0 R (page.301) 6277 0 R (page.302) 6286 0 R (page.303) 6292 0 R (page.304) 6298 0 R (page.305) 6304 0 R (page.306) 6310 0 R (page.307) 6317 0 R (page.308) 6326 0 R (page.309) 6334 0 R (page.31) 4127 0 R (page.310) 6343 0 R (page.311) 6357 0 R (page.312) 6375 0 R (page.313) 6385 0 R (page.314) 6392 0 R (page.315) 6398 0 R (page.316) 6409 0 R (page.317) 6421 0 R (page.318) 6426 0 R (page.319) 6437 0 R (page.32) 4142 0 R (page.320) 6443 0 R (page.321) 6449 0 R (page.322) 6457 0 R (page.323) 6463 0 R (page.324) 6471 0 R (page.325) 6483 0 R (page.326) 6489 0 R (page.327) 6501 0 R (page.328) 6507 0 R (page.329) 6514 0 R (page.33) 4151 0 R (page.330) 6518 0 R (page.331) 6526 0 R (page.332) 6534 0 R (page.333) 6540 0 R (page.334) 6546 0 R (page.335) 6550 0 R (page.336) 6558 0 R (page.337) 6562 0 R (page.338) 6571 0 R (page.339) 6580 0 R (page.34) 4164 0 R (page.340) 6585 0 R (page.341) 6589 0 R (page.342) 6597 0 R (page.343) 6603 0 R (page.344) 6611 0 R (page.345) 6618 0 R (page.346) 6627 0 R (page.347) 6632 0 R (page.348) 6642 0 R (page.349) 6656 0 R (page.35) 4174 0 R (page.350) 6661 0 R (page.351) 6668 0 R (page.352) 6674 0 R (page.353) 6680 0 R (page.354) 6688 0 R (page.355) 6698 0 R (page.356) 6710 0 R (page.357) 6724 0 R (page.358) 6742 0 R (page.359) 6756 0 R (page.36) 4181 0 R (page.360) 6764 0 R (page.361) 6771 0 R (page.362) 6781 0 R (page.363) 6788 0 R (page.364) 6796 0 R (page.365) 6803 0 R (page.366) 6809 0 R (page.367) 6814 0 R (page.368) 6820 0 R (page.369) 6826 0 R (page.37) 4186 0 R (page.370) 6831 0 R (page.371) 6838 0 R (page.372) 6842 0 R (page.373) 6846 0 R (page.374) 6851 0 R (page.375) 6858 0 R (page.376) 6862 0 R (page.377) 6868 0 R (page.378) 6876 0 R (page.379) 6882 0 R (page.38) 4191 0 R (page.380) 6891 0 R (page.381) 6896 0 R (page.382) 6900 0 R (page.383) 6906 0 R (page.384) 6912 0 R (page.385) 6918 0 R (page.386) 6924 0 R (page.387) 6935 0 R (page.388) 6941 0 R (page.389) 6945 0 R (page.39) 4197 0 R (page.390) 6952 0 R (page.391) 6961 0 R (page.392) 6967 0 R (page.393) 6975 0 R (page.394) 6984 0 R (page.395) 6990 0 R (page.396) 6996 0 R (page.397) 7001 0 R (page.398) 7006 0 R (page.399) 7017 0 R (page.4) 3049 0 R (page.40) 4203 0 R (page.400) 7034 0 R (page.401) 7039 0 R (page.402) 7043 0 R (page.403) 7047 0 R (page.404) 7055 0 R (page.405) 7069 0 R (page.406) 7077 0 R (page.407) 7083 0 R (page.408) 7087 0 R (page.409) 7093 0 R (page.41) 4213 0 R (page.410) 7098 0 R (page.411) 7104 0 R (page.412) 7113 0 R (page.413) 7129 0 R (page.414) 7138 0 R (page.415) 7142 0 R (page.416) 7147 0 R (page.417) 7154 0 R (page.418) 7161 0 R (page.419) 7166 0 R (page.42) 4222 0 R (page.420) 7170 0 R (page.421) 7177 0 R (page.422) 7186 0 R (page.423) 7194 0 R (page.424) 7201 0 R (page.425) 7208 0 R (page.426) 7212 0 R (page.427) 7223 0 R (page.428) 7231 0 R (page.429) 7236 0 R (page.43) 4239 0 R (page.430) 7249 0 R (page.431) 7260 0 R (page.432) 7271 0 R (page.433) 7279 0 R (page.434) 7293 0 R (page.435) 7305 0 R (page.436) 7311 0 R (page.437) 7321 0 R (page.438) 7326 0 R (page.439) 7332 0 R (page.44) 4248 0 R (page.440) 7337 0 R (page.441) 7351 0 R (page.442) 7369 0 R (page.443) 7374 0 R (page.444) 7380 0 R (page.445) 7387 0 R (page.446) 7393 0 R (page.447) 7398 0 R (page.448) 7405 0 R (page.449) 7410 0 R (page.45) 4257 0 R (page.450) 7417 0 R (page.451) 7423 0 R (page.452) 7436 0 R (page.453) 7444 0 R (page.454) 7454 0 R (page.455) 7462 0 R (page.456) 7471 0 R (page.457) 7477 0 R (page.458) 7486 0 R (page.459) 7496 0 R (page.46) 4262 0 R (page.460) 7500 0 R (page.461) 7505 0 R (page.462) 7531 0 R (page.47) 4272 0 R (page.48) 4279 0 R (page.49) 4284 0 R (page.5) 3087 0 R (page.50) 4291 0 R (page.51) 4316 0 R (page.52) 4320 0 R (page.53) 4328 0 R (page.54) 4335 0 R (page.55) 4345 0 R (page.56) 4351 0 R (page.57) 4361 0 R (page.58) 4367 0 R (page.59) 4380 0 R (page.6) 3122 0 R (page.60) 4389 0 R (page.61) 4395 0 R (page.62) 4403 0 R (page.63) 4408 0 R (page.64) 4418 0 R (page.65) 4425 0 R (page.66) 4429 0 R (page.67) 4439 0 R (page.68) 4451 0 R (page.69) 4462 0 R (page.7) 3159 0 R (page.70) 4470 0 R (page.71) 4478 0 R (page.72) 4484 0 R (page.73) 4489 0 R (page.74) 4494 0 R (page.75) 4500 0 R (page.76) 4512 0 R (page.77) 4520 0 R (page.78) 4532 0 R (page.79) 4537 0 R (page.8) 3193 0 R (page.80) 4543 0 R (page.81) 4552 0 R (page.82) 4557 0 R (page.83) 4567 0 R (page.84) 4571 0 R (page.85) 4577 0 R (page.86) 4585 0 R (page.87) 4591 0 R (page.88) 4597 0 R (page.89) 4609 0 R (page.9) 3232 0 R (page.90) 4622 0 R (page.91) 4628 0 R (page.92) 4634 0 R (page.93) 4638 0 R (page.94) 4644 0 R (page.95) 4649 0 R (page.96) 4655 0 R (page.97) 4665 0 R (page.98) 4671 0 R (page.99) 4680 0 R (pam) 3189 0 R (part.1) 6 0 R (part.2) 106 0 R (part.3) 486 0 R (part.4) 2490 0 R (part.5) 2678 0 R (part.6) 2770 0 R (passdb) 3117 0 R (passdbtech) 4813 0 R (pdbeditthing) 4863 0 R (pdc-bdc-table) 4414 0 R (pdc-example) 4338 0 R (pdftoepsonusb) 5957 0 R (pdftosocket) 5954 0 R (post-and-ghost) 5808 0 R (printOptions) 5501 0 R (printing) 3154 0 R (problems) 3228 0 R (prtdollar) 5528 0 R (ptrsect) 5480 0 R (regkeys) 6790 0 R (remsmb) 4687 0 R (samba-bdc) 3083 0 R (samba-pdc) 3082 0 R (samba-trusted-domain) 5382 0 R (section*.4) 6509 0 R (section*.5) 6519 0 R (section*.6) 6527 0 R (section*.7) 6535 0 R (section*.8) 6541 0 R (section*.9) 6716 0 R (section.1.1) 14 0 R (section.1.2) 18 0 R (section.1.3) 22 0 R (section.1.4) 26 0 R (section.1.5) 30 0 R (section.1.6) 34 0 R (section.10.1) 494 0 R (section.10.2) 498 0 R (section.10.3) 502 0 R (section.10.4) 518 0 R (section.10.5) 554 0 R (section.10.6) 570 0 R (section.10.7) 582 0 R (section.10.8) 602 0 R (section.11.1) 626 0 R (section.11.2) 638 0 R (section.11.3) 662 0 R (section.11.4) 674 0 R (section.11.5) 758 0 R (section.12.1) 778 0 R (section.12.2) 782 0 R (section.12.3) 794 0 R (section.12.4) 806 0 R (section.13.1) 826 0 R (section.13.2) 830 0 R (section.13.3) 846 0 R (section.13.4) 862 0 R (section.13.5) 878 0 R (section.13.6) 918 0 R (section.14.1) 938 0 R (section.14.2) 942 0 R (section.14.3) 986 0 R (section.14.4) 1002 0 R (section.14.5) 1014 0 R (section.14.6) 1018 0 R (section.14.7) 1034 0 R (section.15.1) 1042 0 R (section.15.2) 1046 0 R (section.15.3) 1050 0 R (section.15.4) 1078 0 R (section.15.5) 1082 0 R (section.16.1) 1098 0 R (section.16.2) 1102 0 R (section.16.3) 1106 0 R (section.16.4) 1122 0 R (section.16.5) 1134 0 R (section.16.6) 1138 0 R (section.17.1) 1146 0 R (section.17.2) 1150 0 R (section.18.1) 1162 0 R (section.18.10) 1366 0 R (section.18.11) 1370 0 R (section.18.12) 1374 0 R (section.18.13) 1378 0 R (section.18.14) 1382 0 R (section.18.2) 1166 0 R (section.18.3) 1178 0 R (section.18.4) 1190 0 R (section.18.5) 1222 0 R (section.18.6) 1246 0 R (section.18.7) 1294 0 R (section.18.8) 1314 0 R (section.18.9) 1346 0 R (section.19.1) 1398 0 R (section.19.10) 1630 0 R (section.19.11) 1698 0 R (section.19.12) 1726 0 R (section.19.13) 1746 0 R (section.19.14) 1790 0 R (section.19.15) 1818 0 R (section.19.16) 1822 0 R (section.19.17) 1838 0 R (section.19.18) 1842 0 R (section.19.19) 1846 0 R (section.19.2) 1410 0 R (section.19.20) 1926 0 R (section.19.3) 1426 0 R (section.19.4) 1450 0 R (section.19.5) 1486 0 R (section.19.6) 1570 0 R (section.19.7) 1586 0 R (section.19.8) 1598 0 R (section.19.9) 1610 0 R (section.2.1) 42 0 R (section.2.2) 46 0 R (section.2.3) 66 0 R (section.2.4) 70 0 R (section.2.5) 74 0 R (section.2.6) 78 0 R (section.2.7) 82 0 R (section.20.1) 1934 0 R (section.20.2) 1938 0 R (section.20.3) 1942 0 R (section.20.4) 1966 0 R (section.21.1) 1982 0 R (section.21.2) 1986 0 R (section.21.3) 1990 0 R (section.21.4) 1998 0 R (section.21.5) 2026 0 R (section.21.6) 2070 0 R (section.21.7) 2074 0 R (section.22.1) 2090 0 R (section.22.2) 2094 0 R (section.22.3) 2098 0 R (section.22.4) 2106 0 R (section.23.1) 2118 0 R (section.23.2) 2122 0 R (section.23.3) 2146 0 R (section.23.4) 2150 0 R (section.23.5) 2166 0 R (section.23.6) 2170 0 R (section.24.1) 2182 0 R (section.24.2) 2186 0 R (section.24.3) 2250 0 R (section.24.4) 2254 0 R (section.24.5) 2258 0 R (section.24.6) 2278 0 R (section.25.1) 2298 0 R (section.25.2) 2302 0 R (section.25.3) 2354 0 R (section.26.1) 2370 0 R (section.26.2) 2374 0 R (section.26.3) 2378 0 R (section.26.4) 2398 0 R (section.26.5) 2422 0 R (section.27.1) 2442 0 R (section.27.2) 2446 0 R (section.27.3) 2450 0 R (section.27.4) 2454 0 R (section.27.5) 2458 0 R (section.27.6) 2462 0 R (section.28.1) 2474 0 R (section.28.2) 2478 0 R (section.29.1) 2486 0 R (section.3.1) 102 0 R (section.30.1) 2498 0 R (section.30.2) 2502 0 R (section.30.3) 2506 0 R (section.30.4) 2522 0 R (section.31.1) 2562 0 R (section.31.2) 2594 0 R (section.32.1) 2610 0 R (section.32.2) 2614 0 R (section.32.3) 2642 0 R (section.33.1) 2686 0 R (section.33.2) 2690 0 R (section.33.3) 2694 0 R (section.34.1) 2702 0 R (section.34.2) 2730 0 R (section.34.3) 2734 0 R (section.34.4) 2738 0 R (section.35.1) 2746 0 R (section.35.2) 2750 0 R (section.35.3) 2754 0 R (section.35.4) 2758 0 R (section.35.5) 2762 0 R (section.35.6) 2766 0 R (section.36.1) 2778 0 R (section.36.2) 2798 0 R (section.36.3) 2802 0 R (section.36.4) 2806 0 R (section.36.5) 2826 0 R (section.37.1) 2842 0 R (section.37.2) 2846 0 R (section.37.3) 2850 0 R (section.37.4) 2854 0 R (section.37.5) 2858 0 R (section.37.6) 2866 0 R (section.38.1) 2882 0 R (section.38.2) 2886 0 R (section.38.3) 2902 0 R (section.38.4) 2930 0 R (section.38.5) 2938 0 R (section.38.6) 2942 0 R (section.39.1) 2950 0 R (section.39.10) 2986 0 R (section.39.11) 2990 0 R (section.39.2) 2954 0 R (section.39.3) 2958 0 R (section.39.4) 2962 0 R (section.39.5) 2966 0 R (section.39.6) 2970 0 R (section.39.7) 2974 0 R (section.39.8) 2978 0 R (section.39.9) 2982 0 R (section.4.1) 114 0 R (section.4.2) 118 0 R (section.4.3) 122 0 R (section.4.4) 166 0 R (section.4.5) 170 0 R (section.40.1) 2998 0 R (section.41.1) 3006 0 R (section.41.2) 3010 0 R (section.5.1) 194 0 R (section.5.2) 198 0 R (section.5.3) 210 0 R (section.5.4) 214 0 R (section.5.5) 218 0 R (section.5.6) 242 0 R (section.6.1) 278 0 R (section.6.2) 282 0 R (section.6.3) 318 0 R (section.6.4) 326 0 R (section.7.1) 350 0 R (section.7.2) 354 0 R (section.7.3) 386 0 R (section.7.4) 398 0 R (section.7.5) 430 0 R (section.7.6) 434 0 R (section.8.1) 454 0 R (section.8.2) 458 0 R (section.8.3) 462 0 R (section.8.4) 474 0 R (section.9.1) 482 0 R (securing-samba) 3151 0 R (set-group-map) 5053 0 R (simple-example) 4138 0 R (simpleprc) 5442 0 R (simplynice) 4602 0 R (small11) 5984 0 R (small12) 5988 0 R (small14) 6100 0 R (small8) 5890 0 R (small9) 5899 0 R (smbconfminimal) 4137 0 R (smbgrpadd) 5042 0 R (smbgrpadd.sh) 5041 0 R (smbpassoptions) 6872 0 R (speed) 3262 0 R (subsection.10.3.1) 506 0 R (subsection.10.3.2) 510 0 R (subsection.10.3.3) 514 0 R (subsection.10.4.1) 522 0 R (subsection.10.4.2) 526 0 R (subsection.10.4.3) 530 0 R (subsection.10.4.4) 534 0 R (subsection.10.4.5) 538 0 R (subsection.10.4.6) 542 0 R (subsection.10.4.7) 546 0 R (subsection.10.4.8) 550 0 R (subsection.10.5.1) 558 0 R (subsection.10.5.2) 562 0 R (subsection.10.5.3) 566 0 R (subsection.10.6.1) 574 0 R (subsection.10.6.2) 578 0 R (subsection.10.7.1) 586 0 R (subsection.10.7.2) 590 0 R (subsection.10.7.3) 594 0 R (subsection.10.8.1) 606 0 R (subsection.10.8.2) 610 0 R (subsection.10.8.3) 614 0 R (subsection.10.8.4) 618 0 R (subsection.11.1.1) 630 0 R (subsection.11.1.2) 634 0 R (subsection.11.2.1) 642 0 R (subsection.11.2.2) 654 0 R (subsection.11.2.3) 658 0 R (subsection.11.3.1) 666 0 R (subsection.11.3.2) 670 0 R (subsection.11.4.1) 678 0 R (subsection.11.4.2) 682 0 R (subsection.11.4.3) 686 0 R (subsection.11.4.4) 690 0 R (subsection.11.4.5) 734 0 R (subsection.11.4.6) 754 0 R (subsection.11.5.1) 762 0 R (subsection.11.5.2) 766 0 R (subsection.11.5.3) 770 0 R (subsection.12.2.1) 786 0 R (subsection.12.2.2) 790 0 R (subsection.12.3.1) 798 0 R (subsection.12.3.2) 802 0 R (subsection.12.4.1) 810 0 R (subsection.12.4.2) 814 0 R (subsection.12.4.3) 818 0 R (subsection.13.2.1) 834 0 R (subsection.13.2.2) 838 0 R (subsection.13.2.3) 842 0 R (subsection.13.3.1) 850 0 R (subsection.13.3.2) 854 0 R (subsection.13.3.3) 858 0 R (subsection.13.4.1) 866 0 R (subsection.13.5.1) 882 0 R (subsection.13.5.2) 886 0 R (subsection.13.5.3) 890 0 R (subsection.13.5.4) 894 0 R (subsection.13.5.5) 906 0 R (subsection.13.5.6) 910 0 R (subsection.13.5.7) 914 0 R (subsection.13.6.1) 922 0 R (subsection.13.6.2) 926 0 R (subsection.13.6.3) 930 0 R (subsection.14.2.1) 946 0 R (subsection.14.3.1) 990 0 R (subsection.14.4.1) 1006 0 R (subsection.14.4.2) 1010 0 R (subsection.14.6.1) 1022 0 R (subsection.14.6.2) 1026 0 R (subsection.14.6.3) 1030 0 R (subsection.15.3.1) 1054 0 R (subsection.15.3.2) 1058 0 R (subsection.15.3.3) 1062 0 R (subsection.15.3.4) 1066 0 R (subsection.15.3.5) 1070 0 R (subsection.15.3.6) 1074 0 R (subsection.15.5.1) 1086 0 R (subsection.15.5.2) 1090 0 R (subsection.16.3.1) 1110 0 R (subsection.16.3.2) 1114 0 R (subsection.16.3.3) 1118 0 R (subsection.16.4.1) 1126 0 R (subsection.16.4.2) 1130 0 R (subsection.17.2.1) 1154 0 R (subsection.18.14.1) 1386 0 R (subsection.18.14.2) 1390 0 R (subsection.18.2.1) 1170 0 R (subsection.18.2.2) 1174 0 R (subsection.18.3.1) 1182 0 R (subsection.18.3.2) 1186 0 R (subsection.18.4.1) 1194 0 R (subsection.18.5.1) 1226 0 R (subsection.18.5.2) 1230 0 R (subsection.18.5.3) 1234 0 R (subsection.18.5.4) 1238 0 R (subsection.18.5.5) 1242 0 R (subsection.18.6.1) 1250 0 R (subsection.18.6.2) 1254 0 R (subsection.18.7.1) 1298 0 R (subsection.18.7.2) 1302 0 R (subsection.18.7.3) 1306 0 R (subsection.18.7.4) 1310 0 R (subsection.18.8.1) 1318 0 R (subsection.18.8.2) 1322 0 R (subsection.18.8.3) 1326 0 R (subsection.18.8.4) 1330 0 R (subsection.18.8.5) 1334 0 R (subsection.18.8.6) 1338 0 R (subsection.18.8.7) 1342 0 R (subsection.18.9.1) 1350 0 R (subsection.18.9.2) 1354 0 R (subsection.18.9.3) 1358 0 R (subsection.18.9.4) 1362 0 R (subsection.19.1.1) 1402 0 R (subsection.19.1.2) 1406 0 R (subsection.19.10.1) 1634 0 R (subsection.19.10.10) 1670 0 R (subsection.19.10.11) 1674 0 R (subsection.19.10.12) 1678 0 R (subsection.19.10.13) 1682 0 R (subsection.19.10.14) 1686 0 R (subsection.19.10.15) 1690 0 R (subsection.19.10.16) 1694 0 R (subsection.19.10.2) 1638 0 R (subsection.19.10.3) 1642 0 R (subsection.19.10.4) 1646 0 R (subsection.19.10.5) 1650 0 R (subsection.19.10.6) 1654 0 R (subsection.19.10.7) 1658 0 R (subsection.19.10.8) 1662 0 R (subsection.19.10.9) 1666 0 R (subsection.19.11.1) 1702 0 R (subsection.19.11.2) 1706 0 R (subsection.19.11.3) 1710 0 R (subsection.19.11.4) 1714 0 R (subsection.19.11.5) 1718 0 R (subsection.19.11.6) 1722 0 R (subsection.19.12.1) 1730 0 R (subsection.19.12.2) 1734 0 R (subsection.19.12.3) 1738 0 R (subsection.19.12.4) 1742 0 R (subsection.19.13.1) 1750 0 R (subsection.19.13.2) 1786 0 R (subsection.19.14.1) 1794 0 R (subsection.19.14.2) 1798 0 R (subsection.19.14.3) 1802 0 R (subsection.19.14.4) 1806 0 R (subsection.19.14.5) 1810 0 R (subsection.19.14.6) 1814 0 R (subsection.19.16.1) 1826 0 R (subsection.19.16.2) 1830 0 R (subsection.19.16.3) 1834 0 R (subsection.19.19.1) 1850 0 R (subsection.19.19.10) 1886 0 R (subsection.19.19.11) 1890 0 R (subsection.19.19.12) 1894 0 R (subsection.19.19.13) 1898 0 R (subsection.19.19.14) 1902 0 R (subsection.19.19.15) 1906 0 R (subsection.19.19.16) 1910 0 R (subsection.19.19.17) 1914 0 R (subsection.19.19.18) 1918 0 R (subsection.19.19.19) 1922 0 R (subsection.19.19.2) 1854 0 R (subsection.19.19.3) 1858 0 R (subsection.19.19.4) 1862 0 R (subsection.19.19.5) 1866 0 R (subsection.19.19.6) 1870 0 R (subsection.19.19.7) 1874 0 R (subsection.19.19.8) 1878 0 R (subsection.19.19.9) 1882 0 R (subsection.19.2.1) 1414 0 R (subsection.19.2.2) 1418 0 R (subsection.19.2.3) 1422 0 R (subsection.19.3.1) 1430 0 R (subsection.19.3.2) 1434 0 R (subsection.19.3.3) 1438 0 R (subsection.19.3.4) 1442 0 R (subsection.19.3.5) 1446 0 R (subsection.19.4.1) 1454 0 R (subsection.19.4.2) 1458 0 R (subsection.19.4.3) 1462 0 R (subsection.19.4.4) 1466 0 R (subsection.19.4.5) 1470 0 R (subsection.19.4.6) 1474 0 R (subsection.19.4.7) 1478 0 R (subsection.19.4.8) 1482 0 R (subsection.19.5.1) 1490 0 R (subsection.19.5.10) 1530 0 R (subsection.19.5.11) 1534 0 R (subsection.19.5.12) 1538 0 R (subsection.19.5.13) 1542 0 R (subsection.19.5.14) 1546 0 R (subsection.19.5.15) 1550 0 R (subsection.19.5.16) 1554 0 R (subsection.19.5.17) 1558 0 R (subsection.19.5.18) 1562 0 R (subsection.19.5.19) 1566 0 R (subsection.19.5.2) 1494 0 R (subsection.19.5.3) 1498 0 R (subsection.19.5.4) 1506 0 R (subsection.19.5.5) 1510 0 R (subsection.19.5.6) 1514 0 R (subsection.19.5.7) 1518 0 R (subsection.19.5.8) 1522 0 R (subsection.19.5.9) 1526 0 R (subsection.19.6.1) 1574 0 R (subsection.19.6.2) 1578 0 R (subsection.19.6.3) 1582 0 R (subsection.19.7.1) 1590 0 R (subsection.19.7.2) 1594 0 R (subsection.19.8.1) 1602 0 R (subsection.19.8.2) 1606 0 R (subsection.19.9.1) 1614 0 R (subsection.19.9.2) 1618 0 R (subsection.19.9.3) 1622 0 R (subsection.19.9.4) 1626 0 R (subsection.2.2.1) 50 0 R (subsection.2.2.2) 54 0 R (subsection.2.2.3) 62 0 R (subsection.2.7.1) 86 0 R (subsection.2.7.2) 90 0 R (subsection.2.7.3) 94 0 R (subsection.20.3.1) 1946 0 R (subsection.20.3.2) 1950 0 R (subsection.20.3.3) 1954 0 R (subsection.20.3.4) 1958 0 R (subsection.20.3.5) 1962 0 R (subsection.20.4.1) 1970 0 R (subsection.20.4.2) 1974 0 R (subsection.21.3.1) 1994 0 R (subsection.21.4.1) 2002 0 R (subsection.21.4.2) 2006 0 R (subsection.21.4.3) 2010 0 R (subsection.21.4.4) 2014 0 R (subsection.21.4.5) 2018 0 R (subsection.21.4.6) 2022 0 R (subsection.21.5.1) 2030 0 R (subsection.21.5.2) 2034 0 R (subsection.21.5.3) 2038 0 R (subsection.21.7.1) 2078 0 R (subsection.21.7.2) 2082 0 R (subsection.22.3.1) 2102 0 R (subsection.22.4.1) 2110 0 R (subsection.23.2.1) 2126 0 R (subsection.23.2.2) 2130 0 R (subsection.23.2.3) 2138 0 R (subsection.23.4.1) 2154 0 R (subsection.23.4.2) 2158 0 R (subsection.23.4.3) 2162 0 R (subsection.23.6.1) 2174 0 R (subsection.24.2.1) 2190 0 R (subsection.24.2.2) 2210 0 R (subsection.24.2.3) 2226 0 R (subsection.24.2.4) 2230 0 R (subsection.24.5.1) 2262 0 R (subsection.24.5.2) 2270 0 R (subsection.24.5.3) 2274 0 R (subsection.24.6.1) 2282 0 R (subsection.24.6.2) 2286 0 R (subsection.24.6.3) 2290 0 R (subsection.25.2.1) 2306 0 R (subsection.25.2.2) 2314 0 R (subsection.25.2.3) 2326 0 R (subsection.25.2.4) 2330 0 R (subsection.25.2.5) 2334 0 R (subsection.25.3.1) 2358 0 R (subsection.25.3.2) 2362 0 R (subsection.26.3.1) 2382 0 R (subsection.26.3.2) 2386 0 R (subsection.26.3.3) 2390 0 R (subsection.26.3.4) 2394 0 R (subsection.26.4.1) 2402 0 R (subsection.26.4.2) 2406 0 R (subsection.26.4.3) 2410 0 R (subsection.26.4.4) 2414 0 R (subsection.26.4.5) 2418 0 R (subsection.26.5.1) 2426 0 R (subsection.26.5.2) 2430 0 R (subsection.26.5.3) 2434 0 R (subsection.27.6.1) 2466 0 R (subsection.30.3.1) 2510 0 R (subsection.30.3.2) 2514 0 R (subsection.30.3.3) 2518 0 R (subsection.30.4.1) 2526 0 R (subsection.30.4.2) 2530 0 R (subsection.30.4.3) 2534 0 R (subsection.30.4.4) 2538 0 R (subsection.30.4.5) 2542 0 R (subsection.31.1.1) 2566 0 R (subsection.31.1.2) 2590 0 R (subsection.31.2.1) 2598 0 R (subsection.31.2.2) 2602 0 R (subsection.32.2.1) 2618 0 R (subsection.32.2.2) 2630 0 R (subsection.32.2.3) 2634 0 R (subsection.32.2.4) 2638 0 R (subsection.32.3.1) 2646 0 R (subsection.32.3.2) 2650 0 R (subsection.32.3.3) 2654 0 R (subsection.32.3.4) 2658 0 R (subsection.32.3.5) 2662 0 R (subsection.32.3.6) 2666 0 R (subsection.32.3.7) 2670 0 R (subsection.32.3.8) 2674 0 R (subsection.34.1.1) 2706 0 R (subsection.34.1.2) 2710 0 R (subsection.34.1.3) 2714 0 R (subsection.34.1.4) 2718 0 R (subsection.36.1.1) 2782 0 R (subsection.36.1.2) 2786 0 R (subsection.36.4.1) 2810 0 R (subsection.36.5.1) 2830 0 R (subsection.36.5.2) 2834 0 R (subsection.37.5.1) 2862 0 R (subsection.37.6.1) 2870 0 R (subsection.37.6.2) 2874 0 R (subsection.38.2.1) 2890 0 R (subsection.38.2.2) 2894 0 R (subsection.38.2.3) 2898 0 R (subsection.38.3.1) 2906 0 R (subsection.38.3.2) 2910 0 R (subsection.38.3.3) 2914 0 R (subsection.38.3.4) 2918 0 R (subsection.38.3.5) 2922 0 R (subsection.38.3.6) 2926 0 R (subsection.38.4.1) 2934 0 R (subsection.4.3.1) 126 0 R (subsection.4.3.2) 134 0 R (subsection.4.3.3) 142 0 R (subsection.4.3.4) 150 0 R (subsection.4.3.5) 158 0 R (subsection.4.5.1) 174 0 R (subsection.4.5.2) 178 0 R (subsection.4.5.3) 182 0 R (subsection.4.5.4) 186 0 R (subsection.5.2.1) 202 0 R (subsection.5.2.2) 206 0 R (subsection.5.5.1) 222 0 R (subsection.5.5.2) 238 0 R (subsection.5.6.1) 246 0 R (subsection.5.6.2) 250 0 R (subsection.5.6.3) 254 0 R (subsection.5.6.4) 258 0 R (subsection.5.6.5) 262 0 R (subsection.5.6.6) 266 0 R (subsection.5.6.7) 270 0 R (subsection.6.2.1) 286 0 R (subsection.6.2.2) 294 0 R (subsection.6.2.3) 298 0 R (subsection.6.2.4) 302 0 R (subsection.6.2.5) 306 0 R (subsection.6.3.1) 322 0 R (subsection.6.4.1) 330 0 R (subsection.6.4.2) 334 0 R (subsection.6.4.3) 338 0 R (subsection.6.4.4) 342 0 R (subsection.7.2.1) 358 0 R (subsection.7.2.2) 362 0 R (subsection.7.2.3) 366 0 R (subsection.7.2.4) 370 0 R (subsection.7.3.1) 390 0 R (subsection.7.3.2) 394 0 R (subsection.7.4.1) 402 0 R (subsection.7.4.2) 406 0 R (subsection.7.4.3) 410 0 R (subsection.7.4.4) 418 0 R (subsection.7.4.5) 422 0 R (subsection.7.4.6) 426 0 R (subsection.7.6.1) 438 0 R (subsection.7.6.2) 442 0 R (subsection.7.6.3) 446 0 R (subsection.8.3.1) 466 0 R (subsection.8.3.2) 470 0 R (subsubsection.10.7.3.1) 598 0 R (subsubsection.11.2.1.1) 646 0 R (subsubsection.11.2.1.2) 650 0 R (subsubsection.11.4.4.1) 694 0 R (subsubsection.11.4.4.10) 730 0 R (subsubsection.11.4.4.2) 698 0 R (subsubsection.11.4.4.3) 702 0 R (subsubsection.11.4.4.4) 706 0 R (subsubsection.11.4.4.5) 710 0 R (subsubsection.11.4.4.6) 714 0 R (subsubsection.11.4.4.7) 718 0 R (subsubsection.11.4.4.8) 722 0 R (subsubsection.11.4.4.9) 726 0 R (subsubsection.11.4.5.1) 738 0 R (subsubsection.11.4.5.2) 742 0 R (subsubsection.11.4.5.3) 746 0 R (subsubsection.11.4.5.4) 750 0 R (subsubsection.13.4.1.1) 870 0 R (subsubsection.13.4.1.2) 874 0 R (subsubsection.13.5.4.1) 898 0 R (subsubsection.13.5.4.2) 902 0 R (subsubsection.14.2.1.1) 950 0 R (subsubsection.14.2.1.2) 954 0 R (subsubsection.14.2.1.3) 958 0 R (subsubsection.14.2.1.4) 962 0 R (subsubsection.14.2.1.5) 966 0 R (subsubsection.14.2.1.6) 970 0 R (subsubsection.14.2.1.7) 974 0 R (subsubsection.14.2.1.8) 978 0 R (subsubsection.14.2.1.9) 982 0 R (subsubsection.14.3.1.1) 994 0 R (subsubsection.14.3.1.2) 998 0 R (subsubsection.18.4.1.1) 1198 0 R (subsubsection.18.4.1.2) 1202 0 R (subsubsection.18.4.1.3) 1206 0 R (subsubsection.18.4.1.4) 1210 0 R (subsubsection.18.4.1.5) 1214 0 R (subsubsection.18.4.1.6) 1218 0 R (subsubsection.18.6.2.1) 1258 0 R (subsubsection.18.6.2.2) 1262 0 R (subsubsection.18.6.2.3) 1266 0 R (subsubsection.18.6.2.4) 1270 0 R (subsubsection.18.6.2.5) 1274 0 R (subsubsection.18.6.2.6) 1278 0 R (subsubsection.18.6.2.7) 1282 0 R (subsubsection.18.6.2.8) 1286 0 R (subsubsection.18.6.2.9) 1290 0 R (subsubsection.19.13.1.1) 1754 0 R (subsubsection.19.13.1.2) 1758 0 R (subsubsection.19.13.1.3) 1762 0 R (subsubsection.19.13.1.4) 1766 0 R (subsubsection.19.13.1.5) 1770 0 R (subsubsection.19.13.1.6) 1774 0 R (subsubsection.19.13.1.7) 1778 0 R (subsubsection.19.13.1.8) 1782 0 R (subsubsection.19.5.3.1) 1502 0 R (subsubsection.2.2.2.1) 58 0 R (subsubsection.21.5.3.1) 2042 0 R (subsubsection.21.5.3.2) 2046 0 R (subsubsection.21.5.3.3) 2050 0 R (subsubsection.21.5.3.4) 2054 0 R (subsubsection.21.5.3.5) 2058 0 R (subsubsection.21.5.3.6) 2062 0 R (subsubsection.21.5.3.7) 2066 0 R (subsubsection.23.2.2.1) 2134 0 R (subsubsection.23.2.3.1) 2142 0 R (subsubsection.24.2.1.1) 2194 0 R (subsubsection.24.2.1.2) 2198 0 R (subsubsection.24.2.1.3) 2202 0 R (subsubsection.24.2.1.4) 2206 0 R (subsubsection.24.2.2.1) 2214 0 R (subsubsection.24.2.2.2) 2218 0 R (subsubsection.24.2.2.3) 2222 0 R (subsubsection.24.2.4.1) 2234 0 R (subsubsection.24.2.4.2) 2238 0 R (subsubsection.24.2.4.3) 2242 0 R (subsubsection.24.2.4.4) 2246 0 R (subsubsection.24.5.1.1) 2266 0 R (subsubsection.25.2.1.1) 2310 0 R (subsubsection.25.2.2.1) 2318 0 R (subsubsection.25.2.2.2) 2322 0 R (subsubsection.25.2.5.1) 2338 0 R (subsubsection.25.2.5.2) 2342 0 R (subsubsection.25.2.5.3) 2346 0 R (subsubsection.25.2.5.4) 2350 0 R (subsubsection.30.4.5.1) 2546 0 R (subsubsection.30.4.5.2) 2550 0 R (subsubsection.30.4.5.3) 2554 0 R (subsubsection.31.1.1.1) 2570 0 R (subsubsection.31.1.1.2) 2574 0 R (subsubsection.31.1.1.3) 2578 0 R (subsubsection.31.1.1.4) 2582 0 R (subsubsection.31.1.1.5) 2586 0 R (subsubsection.32.2.1.1) 2622 0 R (subsubsection.32.2.1.2) 2626 0 R (subsubsection.34.1.4.1) 2722 0 R (subsubsection.34.1.4.2) 2726 0 R (subsubsection.36.1.2.1) 2790 0 R (subsubsection.36.1.2.2) 2794 0 R (subsubsection.36.4.1.1) 2814 0 R (subsubsection.36.4.1.2) 2818 0 R (subsubsection.36.4.1.3) 2822 0 R (subsubsection.4.3.1.1) 130 0 R (subsubsection.4.3.2.1) 138 0 R (subsubsection.4.3.3.1) 146 0 R (subsubsection.4.3.4.1) 154 0 R (subsubsection.4.3.5.1) 162 0 R (subsubsection.5.5.1.1) 226 0 R (subsubsection.5.5.1.2) 230 0 R (subsubsection.5.5.1.3) 234 0 R (subsubsection.6.2.1.1) 290 0 R (subsubsection.6.2.5.1) 310 0 R (subsubsection.6.2.5.2) 314 0 R (subsubsection.7.2.4.1) 374 0 R (subsubsection.7.2.4.2) 378 0 R (subsubsection.7.2.4.3) 382 0 R (subsubsection.7.4.3.1) 414 0 R (table.10.1) 4768 0 R (table.10.2) 4776 0 R (table.10.3) 4779 0 R (table.10.4) 4782 0 R (table.11.1) 4980 0 R (table.11.2) 4985 0 R (table.11.3) 4986 0 R (table.11.4) 4987 0 R (table.11.5) 4992 0 R (table.12.1) 5035 0 R (table.13.1) 5096 0 R (table.13.2) 5124 0 R (table.13.3) 5133 0 R (table.13.4) 5140 0 R (table.18.1) 5502 0 R (table.19.1) 5932 0 R (table.20.1) 6416 0 R (table.24.1) 6784 0 R (table.24.2) 6791 0 R (table.24.3) 6799 0 R (table.25.1) 6877 0 R (table.26.1) 6929 0 R (table.26.2) 6931 0 R (table.30.1) 7058 0 R (table.31.1) 7125 0 R (table.31.2) 7133 0 R (table.6.1) 4419 0 R (table.7.1) 4533 0 R (tdbfiledesc) 7057 0 R (tmpshare) 7218 0 R (troubleshooting) 7213 0 R (trusts1) 5374 0 R (type) 4192 0 R (ugbc) 5118 0 R (unicode) 3221 0 R (uniqnetbiosnames) 6928 0 R (upgrading-to-3.0) 3224 0 R (vfsrecyc) 6402 0 R (winbind) 3185 0 R (winbind-solaris9) 6522 0 R (winbindcfg) 6496 0 R (xinetd) 7150 0 R (xremmb) 4696 0 R (xtdaudit) 6415 0 R] +/Limits [(13small) (xtdaudit)] >> endobj -7252 0 obj << -/Kids [7251 0 R] +7587 0 obj << +/Kids [7586 0 R] >> endobj -7253 0 obj << -/Dests 7252 0 R +7588 0 obj << +/Dests 7587 0 R >> endobj -7254 0 obj << +7589 0 obj << /Type /Catalog -/Pages 7249 0 R -/Outlines 7250 0 R -/Names 7253 0 R +/Pages 7584 0 R +/Outlines 7585 0 R +/Names 7588 0 R /PageMode /UseOutlines /URI<> /ViewerPreferences<<>> -/OpenAction 2953 0 R -/PTEX.Fullbanner (This is pdfTeX, Version 3.14159-1.10b) +/OpenAction 3013 0 R +/PTEX.Fullbanner (This is pdfTeX, Version 3.14159-1.10a) >> endobj -7255 0 obj << -/Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfTeX-1.10b)/Keywords() -/CreationDate (D:20030829000400) +7590 0 obj << +/Producer (pdfTeX-1.10a) +/Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfTeX-1.10a)/Keywords() +/Creator (TeX) +/CreationDate (D:20030923173300) >> endobj xref -0 7256 +0 7591 0000000001 65535 f 0000000002 00000 f 0000000003 00000 f 0000000004 00000 f 0000000000 00000 f 0000000009 00000 n -0000304322 00000 n -0002541236 00000 n +0000290029 00000 n +0002649002 00000 n 0000000051 00000 n 0000000091 00000 n -0000307620 00000 n -0002541127 00000 n +0000293296 00000 n +0002648893 00000 n 0000000136 00000 n 0000000178 00000 n -0000307744 00000 n -0002541053 00000 n +0000293420 00000 n +0002648819 00000 n 0000000226 00000 n 0000000259 00000 n -0000311647 00000 n -0002540966 00000 n +0000297081 00000 n +0002648732 00000 n 0000000307 00000 n 0000000341 00000 n -0000315702 00000 n -0002540879 00000 n +0000300957 00000 n +0002648645 00000 n 0000000389 00000 n 0000000428 00000 n -0000315826 00000 n -0002540792 00000 n +0000301081 00000 n +0002648558 00000 n 0000000476 00000 n 0000000514 00000 n -0000319923 00000 n -0002540705 00000 n +0000305058 00000 n +0002648471 00000 n 0000000562 00000 n 0000000593 00000 n -0000320047 00000 n -0002540631 00000 n +0000305182 00000 n +0002648397 00000 n 0000000641 00000 n 0000000677 00000 n -0000323197 00000 n -0002540508 00000 n +0000308734 00000 n +0002648274 00000 n 0000000723 00000 n 0000000773 00000 n -0000323321 00000 n -0002540434 00000 n +0000308858 00000 n +0002648200 00000 n 0000000821 00000 n 0000000874 00000 n -0000323445 00000 n -0002540310 00000 n +0000308982 00000 n +0002648076 00000 n 0000000922 00000 n 0000000975 00000 n -0000323569 00000 n -0002540199 00000 n +0000309106 00000 n +0002648002 00000 n 0000001028 00000 n -0000001074 00000 n -0000327143 00000 n -0002540138 00000 n -0000001132 00000 n -0000001194 00000 n -0000327266 00000 n -0002540064 00000 n -0000001247 00000 n -0000001276 00000 n -0000327389 00000 n -0002539977 00000 n -0000001324 00000 n -0000001394 00000 n -0000329813 00000 n -0002539890 00000 n -0000001442 00000 n -0000001500 00000 n -0000329937 00000 n -0002539803 00000 n -0000001548 00000 n -0000001609 00000 n -0000330061 00000 n -0002539716 00000 n -0000001657 00000 n -0000001706 00000 n -0000330185 00000 n -0002539605 00000 n -0000001754 00000 n -0000001790 00000 n -0000332816 00000 n -0002539531 00000 n -0000001843 00000 n -0000001898 00000 n -0000332940 00000 n -0002539444 00000 n -0000001951 00000 n -0000002086 00000 n -0000333064 00000 n -0002539370 00000 n -0000002139 00000 n -0000002198 00000 n -0000333967 00000 n -0002539260 00000 n -0000002244 00000 n -0000002293 00000 n -0000334091 00000 n -0002539198 00000 n -0000002341 00000 n -0000002369 00000 n -0000334822 00000 n -0002539067 00000 n -0000002413 00000 n -0000002463 00000 n -0000338004 00000 n -0002538949 00000 n -0000002510 00000 n -0000002563 00000 n -0000338129 00000 n -0002538870 00000 n -0000002612 00000 n -0000002657 00000 n -0000341503 00000 n -0002538777 00000 n -0000002706 00000 n -0000002742 00000 n -0000341627 00000 n -0002538645 00000 n -0000002791 00000 n -0000002835 00000 n -0000345239 00000 n -0002538527 00000 n -0000002889 00000 n -0000002934 00000 n -0000345490 00000 n -0002538462 00000 n -0000002993 00000 n -0000003042 00000 n -0000345614 00000 n -0002538330 00000 n -0000003096 00000 n -0000003142 00000 n -0000348328 00000 n -0002538265 00000 n -0000003201 00000 n -0000003250 00000 n -0000348453 00000 n -0002538133 00000 n -0000003304 00000 n -0000003374 00000 n -0000348578 00000 n -0002538068 00000 n -0000003433 00000 n -0000003482 00000 n -0000353645 00000 n -0002537936 00000 n -0000003536 00000 n -0000003603 00000 n -0000353770 00000 n -0002537871 00000 n -0000003662 00000 n -0000003711 00000 n -0000357202 00000 n -0002537753 00000 n -0000003765 00000 n -0000003830 00000 n -0000360724 00000 n -0002537688 00000 n -0000003889 00000 n -0000003938 00000 n -0000360849 00000 n -0002537595 00000 n -0000003987 00000 n -0000004028 00000 n -0000364625 00000 n -0002537477 00000 n -0000004077 00000 n -0000004114 00000 n -0000367577 00000 n -0002537398 00000 n -0000004168 00000 n -0000004220 00000 n -0000367702 00000 n -0002537305 00000 n -0000004274 00000 n -0000004337 00000 n -0000367826 00000 n -0002537212 00000 n -0000004391 00000 n -0000004450 00000 n -0000367951 00000 n -0002537133 00000 n -0000004504 00000 n -0000004578 00000 n -0000371005 00000 n -0002537001 00000 n -0000004625 00000 n -0000004661 00000 n -0000375124 00000 n -0002536922 00000 n -0000004710 00000 n -0000004755 00000 n -0000379691 00000 n -0002536790 00000 n -0000004804 00000 n -0000004852 00000 n -0000379816 00000 n -0002536711 00000 n -0000004906 00000 n -0000004955 00000 n -0000388002 00000 n -0002536632 00000 n -0000005009 00000 n -0000005063 00000 n -0000396679 00000 n -0002536539 00000 n -0000005112 00000 n -0000005174 00000 n -0000402641 00000 n -0002536446 00000 n -0000005223 00000 n -0000005271 00000 n -0000402766 00000 n -0002536314 00000 n -0000005320 00000 n -0000005382 00000 n -0000402891 00000 n -0002536196 00000 n -0000005436 00000 n -0000005490 00000 n -0000406131 00000 n -0002536117 00000 n -0000005549 00000 n -0000005598 00000 n -0000406256 00000 n -0002536024 00000 n -0000005657 00000 n -0000005731 00000 n -0000406381 00000 n -0002535945 00000 n -0000005790 00000 n -0000005853 00000 n -0000414489 00000 n -0002535866 00000 n -0000005907 00000 n -0000005966 00000 n -0000417645 00000 n -0002535748 00000 n -0000006015 00000 n -0000006052 00000 n -0000417770 00000 n -0002535669 00000 n -0000006106 00000 n -0000006173 00000 n -0000417895 00000 n -0002535576 00000 n -0000006227 00000 n -0000006309 00000 n -0000418020 00000 n -0002535483 00000 n -0000006363 00000 n -0000006435 00000 n -0000420996 00000 n -0002535390 00000 n -0000006489 00000 n -0000006555 00000 n -0000421121 00000 n -0002535297 00000 n -0000006609 00000 n -0000006651 00000 n -0000421245 00000 n -0002535204 00000 n -0000006705 00000 n -0000006760 00000 n -0000423266 00000 n -0002535125 00000 n -0000006814 00000 n -0000006903 00000 n -0000454152 00000 n -0002534993 00000 n -0000006950 00000 n -0000006993 00000 n -0000454277 00000 n -0002534914 00000 n -0000007042 00000 n -0000007087 00000 n -0000457515 00000 n -0002534782 00000 n -0000007136 00000 n -0000007192 00000 n -0000457640 00000 n -0002534664 00000 n -0000007246 00000 n -0000007307 00000 n -0000465175 00000 n -0002534599 00000 n -0000007366 00000 n -0000007419 00000 n -0000465427 00000 n -0002534506 00000 n -0000007473 00000 n -0000007530 00000 n -0000465552 00000 n -0002534413 00000 n -0000007584 00000 n -0000007660 00000 n -0000465677 00000 n -0002534334 00000 n -0000007714 00000 n -0000007790 00000 n -0000469153 00000 n -0002534202 00000 n -0000007839 00000 n -0000007901 00000 n -0000469278 00000 n -0002534137 00000 n -0000007955 00000 n -0000008002 00000 n -0000472808 00000 n -0002534019 00000 n -0000008051 00000 n -0000008088 00000 n -0000472932 00000 n -0002533940 00000 n -0000008142 00000 n -0000008214 00000 n -0000473056 00000 n -0002533847 00000 n -0000008268 00000 n -0000008348 00000 n -0000475266 00000 n -0002533754 00000 n -0000008402 00000 n -0000008466 00000 n -0000475391 00000 n -0002533675 00000 n -0000008520 00000 n -0000008574 00000 n -0000478301 00000 n -0002533543 00000 n -0000008621 00000 n -0000008660 00000 n -0000478426 00000 n -0002533464 00000 n -0000008709 00000 n -0000008754 00000 n -0000482028 00000 n -0002533332 00000 n -0000008803 00000 n -0000008879 00000 n -0000484781 00000 n -0002533253 00000 n -0000008933 00000 n -0000009000 00000 n -0000489994 00000 n -0002533160 00000 n -0000009054 00000 n -0000009142 00000 n -0000493562 00000 n -0002533067 00000 n -0000009196 00000 n -0000009269 00000 n -0000493687 00000 n -0002532949 00000 n -0000009323 00000 n -0000009407 00000 n -0000493812 00000 n -0002532870 00000 n -0000009466 00000 n -0000009522 00000 n -0000493937 00000 n -0002532777 00000 n -0000009581 00000 n -0000009620 00000 n -0000497623 00000 n -0002532698 00000 n -0000009679 00000 n -0000009712 00000 n -0000497748 00000 n -0002532566 00000 n -0000009761 00000 n -0000009805 00000 n -0000497873 00000 n -0002532487 00000 n -0000009859 00000 n -0000009924 00000 n -0000504650 00000 n -0002532408 00000 n -0000009978 00000 n -0000010046 00000 n -0000506917 00000 n -0002532276 00000 n -0000010095 00000 n -0000010146 00000 n -0000507042 00000 n -0002532197 00000 n -0000010200 00000 n -0000010245 00000 n -0000507166 00000 n -0002532104 00000 n -0000010299 00000 n -0000010350 00000 n -0000510719 00000 n -0002531972 00000 n -0000010404 00000 n -0000010457 00000 n -0000510844 00000 n -0002531907 00000 n -0000010516 00000 n -0000010559 00000 n -0000514186 00000 n -0002531814 00000 n -0000010613 00000 n -0000010661 00000 n -0000514311 00000 n -0002531721 00000 n -0000010715 00000 n -0000010763 00000 n -0000514436 00000 n -0002531642 00000 n -0000010817 00000 n -0000010848 00000 n -0000514561 00000 n -0002531524 00000 n +0000001078 00000 n +0000309229 00000 n +0002647878 00000 n +0000001131 00000 n +0000001177 00000 n +0000312157 00000 n +0002647817 00000 n +0000001235 00000 n +0000001297 00000 n +0000315592 00000 n +0002647743 00000 n +0000001350 00000 n +0000001379 00000 n +0000315716 00000 n +0002647656 00000 n +0000001427 00000 n +0000001485 00000 n +0000315839 00000 n +0002647569 00000 n +0000001533 00000 n +0000001582 00000 n +0000318603 00000 n +0002647482 00000 n +0000001630 00000 n +0000001685 00000 n +0000318727 00000 n +0002647395 00000 n +0000001733 00000 n +0000001782 00000 n +0000318851 00000 n +0002647284 00000 n +0000001830 00000 n +0000001866 00000 n +0000321600 00000 n +0002647210 00000 n +0000001919 00000 n +0000001974 00000 n +0000321724 00000 n +0002647123 00000 n +0000002027 00000 n +0000002088 00000 n +0000321848 00000 n +0002647049 00000 n +0000002141 00000 n +0000002202 00000 n +0000322753 00000 n +0002646936 00000 n +0000002248 00000 n +0000002298 00000 n +0000322877 00000 n +0002646872 00000 n +0000002347 00000 n +0000002375 00000 n +0000323595 00000 n +0002646741 00000 n +0000002419 00000 n +0000002469 00000 n +0000326679 00000 n +0002646623 00000 n +0000002516 00000 n +0000002569 00000 n +0000326804 00000 n +0002646544 00000 n +0000002618 00000 n +0000002663 00000 n +0000329803 00000 n +0002646451 00000 n +0000002712 00000 n +0000002748 00000 n +0000329928 00000 n +0002646319 00000 n +0000002797 00000 n +0000002841 00000 n +0000333360 00000 n +0002646201 00000 n +0000002895 00000 n +0000002940 00000 n +0000333611 00000 n +0002646136 00000 n +0000002999 00000 n +0000003048 00000 n +0000333735 00000 n +0002646004 00000 n +0000003102 00000 n +0000003148 00000 n +0000336395 00000 n +0002645939 00000 n +0000003207 00000 n +0000003256 00000 n +0000336520 00000 n +0002645807 00000 n +0000003310 00000 n +0000003380 00000 n +0000336645 00000 n +0002645742 00000 n +0000003439 00000 n +0000003488 00000 n +0000341717 00000 n +0002645610 00000 n +0000003542 00000 n +0000003609 00000 n +0000341842 00000 n +0002645545 00000 n +0000003668 00000 n +0000003717 00000 n +0000345468 00000 n +0002645427 00000 n +0000003771 00000 n +0000003836 00000 n +0000348889 00000 n +0002645362 00000 n +0000003895 00000 n +0000003944 00000 n +0000349014 00000 n +0002645269 00000 n +0000003993 00000 n +0000004034 00000 n +0000352840 00000 n +0002645151 00000 n +0000004083 00000 n +0000004120 00000 n +0000355724 00000 n +0002645072 00000 n +0000004174 00000 n +0000004226 00000 n +0000355849 00000 n +0002644979 00000 n +0000004280 00000 n +0000004343 00000 n +0000355973 00000 n +0002644886 00000 n +0000004397 00000 n +0000004456 00000 n +0000356098 00000 n +0002644807 00000 n +0000004510 00000 n +0000004584 00000 n +0000384128 00000 n +0002644675 00000 n +0000004631 00000 n +0000004667 00000 n +0000387638 00000 n +0002644596 00000 n +0000004716 00000 n +0000004761 00000 n +0000396240 00000 n +0002644464 00000 n +0000004810 00000 n +0000004858 00000 n +0000396365 00000 n +0002644385 00000 n +0000004912 00000 n +0000004961 00000 n +0000403550 00000 n +0002644306 00000 n +0000005015 00000 n +0000005069 00000 n +0000410540 00000 n +0002644213 00000 n +0000005118 00000 n +0000005182 00000 n +0000417206 00000 n +0002644120 00000 n +0000005231 00000 n +0000005279 00000 n +0000417331 00000 n +0002643988 00000 n +0000005328 00000 n +0000005390 00000 n +0000417456 00000 n +0002643870 00000 n +0000005444 00000 n +0000005498 00000 n +0000417581 00000 n +0002643791 00000 n +0000005557 00000 n +0000005606 00000 n +0000421224 00000 n +0002643698 00000 n +0000005665 00000 n +0000005739 00000 n +0000421349 00000 n +0002643619 00000 n +0000005798 00000 n +0000005859 00000 n +0000429295 00000 n +0002643540 00000 n +0000005913 00000 n +0000005972 00000 n +0000429420 00000 n +0002643422 00000 n +0000006021 00000 n +0000006058 00000 n +0000429545 00000 n +0002643343 00000 n +0000006112 00000 n +0000006181 00000 n +0000432454 00000 n +0002643250 00000 n +0000006235 00000 n +0000006317 00000 n +0000432579 00000 n +0002643157 00000 n +0000006371 00000 n +0000006438 00000 n +0000435504 00000 n +0002643064 00000 n +0000006492 00000 n +0000006561 00000 n +0000435629 00000 n +0002642971 00000 n +0000006615 00000 n +0000006657 00000 n +0000435754 00000 n +0002642878 00000 n +0000006711 00000 n +0000006766 00000 n +0000437645 00000 n +0002642799 00000 n +0000006820 00000 n +0000006908 00000 n +0000441658 00000 n +0002642667 00000 n +0000006955 00000 n +0000006998 00000 n +0000441783 00000 n +0002642588 00000 n +0000007047 00000 n +0000007092 00000 n +0000445581 00000 n +0002642456 00000 n +0000007141 00000 n +0000007197 00000 n +0000445706 00000 n +0002642338 00000 n +0000007251 00000 n +0000007312 00000 n +0000454114 00000 n +0002642273 00000 n +0000007371 00000 n +0000007424 00000 n +0000454365 00000 n +0002642180 00000 n +0000007478 00000 n +0000007528 00000 n +0000457873 00000 n +0002642087 00000 n +0000007582 00000 n +0000007639 00000 n +0000457998 00000 n +0002641994 00000 n +0000007693 00000 n +0000007769 00000 n +0000461771 00000 n +0002641876 00000 n +0000007823 00000 n +0000007899 00000 n +0000461896 00000 n +0002641797 00000 n +0000007958 00000 n +0000008013 00000 n +0000462021 00000 n +0002641718 00000 n +0000008072 00000 n +0000008128 00000 n +0000462145 00000 n +0002641586 00000 n +0000008177 00000 n +0000008239 00000 n +0000465868 00000 n +0002641521 00000 n +0000008293 00000 n +0000008340 00000 n +0000469766 00000 n +0002641403 00000 n +0000008389 00000 n +0000008426 00000 n +0000469891 00000 n +0002641324 00000 n +0000008480 00000 n +0000008536 00000 n +0000470015 00000 n +0002641231 00000 n +0000008590 00000 n +0000008670 00000 n +0000472207 00000 n +0002641138 00000 n +0000008724 00000 n +0000008788 00000 n +0000472332 00000 n +0002641059 00000 n +0000008842 00000 n +0000008896 00000 n +0000475334 00000 n +0002640927 00000 n +0000008943 00000 n +0000008982 00000 n +0000475459 00000 n +0002640848 00000 n +0000009031 00000 n +0000009076 00000 n +0000479285 00000 n +0002640716 00000 n +0000009125 00000 n +0000009201 00000 n +0000481963 00000 n +0002640637 00000 n +0000009255 00000 n +0000009322 00000 n +0000486589 00000 n +0002640544 00000 n +0000009376 00000 n +0000009459 00000 n +0000490181 00000 n +0002640451 00000 n +0000009513 00000 n +0000009584 00000 n +0000490306 00000 n +0002640333 00000 n +0000009638 00000 n +0000009722 00000 n +0000490431 00000 n +0002640254 00000 n +0000009781 00000 n +0000009844 00000 n +0000494217 00000 n +0002640161 00000 n +0000009903 00000 n +0000009949 00000 n +0000494342 00000 n +0002640082 00000 n +0000010008 00000 n +0000010048 00000 n +0000494466 00000 n +0002639950 00000 n +0000010097 00000 n +0000010141 00000 n +0000494591 00000 n +0002639871 00000 n +0000010195 00000 n +0000010260 00000 n +0000500238 00000 n +0002639792 00000 n +0000010314 00000 n +0000010386 00000 n +0000504442 00000 n +0002639660 00000 n +0000010435 00000 n +0000010486 00000 n +0000504567 00000 n +0002639581 00000 n +0000010540 00000 n +0000010584 00000 n +0000507123 00000 n +0002639488 00000 n +0000010638 00000 n +0000010688 00000 n +0000510814 00000 n +0002639356 00000 n +0000010742 00000 n +0000010795 00000 n +0000514824 00000 n +0002639291 00000 n +0000010854 00000 n 0000010897 00000 n -0000010934 00000 n -0000514686 00000 n -0002531445 00000 n -0000010988 00000 n -0000011048 00000 n -0000516986 00000 n -0002531366 00000 n -0000011102 00000 n -0000011158 00000 n -0000520124 00000 n -0002531234 00000 n -0000011205 00000 n -0000011246 00000 n -0000520249 00000 n -0002531155 00000 n -0000011295 00000 n -0000011340 00000 n -0000520374 00000 n -0002531062 00000 n -0000011389 00000 n -0000011423 00000 n -0000523328 00000 n -0002530930 00000 n -0000011472 00000 n -0000011517 00000 n -0000523453 00000 n -0002530851 00000 n -0000011571 00000 n -0000011627 00000 n -0000523705 00000 n -0002530772 00000 n -0000011681 00000 n -0000011728 00000 n -0000526762 00000 n -0002530693 00000 n +0000514949 00000 n +0002639198 00000 n +0000010951 00000 n +0000010997 00000 n +0000515074 00000 n +0002639105 00000 n +0000011051 00000 n +0000011099 00000 n +0000515199 00000 n +0002639026 00000 n +0000011153 00000 n +0000011184 00000 n +0000518233 00000 n +0002638933 00000 n +0000011233 00000 n +0000011310 00000 n +0000518358 00000 n +0002638815 00000 n +0000011359 00000 n +0000011396 00000 n +0000518483 00000 n +0002638736 00000 n +0000011450 00000 n +0000011509 00000 n +0000521173 00000 n +0002638643 00000 n +0000011563 00000 n +0000011619 00000 n +0000521298 00000 n +0002638564 00000 n +0000011673 00000 n +0000011730 00000 n +0000524372 00000 n +0002638432 00000 n 0000011777 00000 n -0000011814 00000 n -0000528999 00000 n -0002530575 00000 n -0000011861 00000 n -0000011921 00000 n -0000529124 00000 n -0002530510 00000 n -0000011970 00000 n -0000011998 00000 n -0000529853 00000 n -0002530374 00000 n -0000012042 00000 n -0000012088 00000 n -0000533099 00000 n -0002530256 00000 n -0000012136 00000 n -0000012200 00000 n -0000533224 00000 n -0002530177 00000 n -0000012250 00000 n -0000012296 00000 n -0000536318 00000 n -0002530084 00000 n -0000012346 00000 n -0000012388 00000 n -0000539821 00000 n -0002529952 00000 n -0000012438 00000 n -0000012473 00000 n -0000539946 00000 n -0002529873 00000 n -0000012528 00000 n -0000012574 00000 n -0000543393 00000 n -0002529780 00000 n -0000012629 00000 n -0000012680 00000 n -0000543896 00000 n -0002529701 00000 n -0000012735 00000 n -0000012786 00000 n -0000547504 00000 n -0002529569 00000 n -0000012836 00000 n -0000012883 00000 n -0000551008 00000 n -0002529490 00000 n -0000012938 00000 n -0000012994 00000 n -0000554593 00000 n -0002529397 00000 n -0000013049 00000 n -0000013102 00000 n -0000557862 00000 n -0002529304 00000 n -0000013157 00000 n -0000013214 00000 n -0000561204 00000 n -0002529211 00000 n -0000013269 00000 n -0000013326 00000 n -0000561580 00000 n -0002529118 00000 n +0000011818 00000 n +0000524497 00000 n +0002638353 00000 n +0000011867 00000 n +0000011912 00000 n +0000524622 00000 n +0002638260 00000 n +0000011961 00000 n +0000011995 00000 n +0000528210 00000 n +0002638128 00000 n +0000012044 00000 n +0000012089 00000 n +0000528335 00000 n +0002638049 00000 n +0000012143 00000 n +0000012199 00000 n +0000528587 00000 n +0002637970 00000 n +0000012253 00000 n +0000012300 00000 n +0000533887 00000 n +0002637891 00000 n +0000012349 00000 n +0000012386 00000 n +0000534804 00000 n +0002637773 00000 n +0000012433 00000 n +0000012493 00000 n +0000534929 00000 n +0002637708 00000 n +0000012542 00000 n +0000012570 00000 n +0000535644 00000 n +0002637572 00000 n +0000012614 00000 n +0000012660 00000 n +0000538913 00000 n +0002637454 00000 n +0000012708 00000 n +0000012747 00000 n +0000539038 00000 n +0002637375 00000 n +0000012797 00000 n +0000012843 00000 n +0000541984 00000 n +0002637282 00000 n +0000012893 00000 n +0000012935 00000 n +0000545769 00000 n +0002637150 00000 n +0000012985 00000 n +0000013020 00000 n +0000545894 00000 n +0002637071 00000 n +0000013075 00000 n +0000013121 00000 n +0000546019 00000 n +0002636978 00000 n +0000013176 00000 n +0000013225 00000 n +0000549435 00000 n +0002636899 00000 n +0000013280 00000 n +0000013331 00000 n +0000552953 00000 n +0002636767 00000 n 0000013381 00000 n -0000013438 00000 n -0000564294 00000 n -0002529025 00000 n -0000013493 00000 n -0000013539 00000 n -0000564419 00000 n -0002528932 00000 n -0000013594 00000 n -0000013657 00000 n -0000564544 00000 n -0002528853 00000 n -0000013712 00000 n -0000013778 00000 n -0000569178 00000 n -0002528721 00000 n -0000013828 00000 n -0000013899 00000 n -0000572670 00000 n -0002528642 00000 n -0000013954 00000 n -0000014005 00000 n -0000574932 00000 n -0002528549 00000 n -0000014060 00000 n -0000014103 00000 n -0000575057 00000 n -0002528470 00000 n -0000014158 00000 n -0000014204 00000 n -0000575181 00000 n -0002528338 00000 n -0000014254 00000 n -0000014292 00000 n -0000578461 00000 n -0002528259 00000 n -0000014347 00000 n -0000014402 00000 n -0000578586 00000 n -0002528180 00000 n -0000014457 00000 n +0000013428 00000 n +0000556973 00000 n +0002636688 00000 n +0000013483 00000 n +0000013540 00000 n +0000560635 00000 n +0002636595 00000 n +0000013595 00000 n +0000013651 00000 n +0000564488 00000 n +0002636502 00000 n +0000013706 00000 n +0000013763 00000 n +0000567733 00000 n +0002636409 00000 n +0000013818 00000 n +0000013875 00000 n +0000568109 00000 n +0002636316 00000 n +0000013930 00000 n +0000013987 00000 n +0000570834 00000 n +0002636223 00000 n +0000014042 00000 n +0000014088 00000 n +0000570959 00000 n +0002636130 00000 n +0000014143 00000 n +0000014206 00000 n +0000571084 00000 n +0002636051 00000 n +0000014261 00000 n +0000014327 00000 n +0000575687 00000 n +0002635919 00000 n +0000014377 00000 n +0000014450 00000 n +0000579301 00000 n +0002635840 00000 n 0000014505 00000 n -0000581973 00000 n -0002528048 00000 n -0000014555 00000 n -0000014610 00000 n -0000582098 00000 n -0002527969 00000 n -0000014665 00000 n -0000014717 00000 n -0000585624 00000 n -0002527876 00000 n -0000014772 00000 n -0000014817 00000 n -0000590115 00000 n -0002527758 00000 n -0000014872 00000 n -0000014922 00000 n -0000590240 00000 n -0002527693 00000 n -0000014982 00000 n -0000015048 00000 n -0000618911 00000 n -0002527575 00000 n -0000015098 00000 n -0000015136 00000 n -0000619036 00000 n -0002527496 00000 n -0000015191 00000 n -0000015290 00000 n -0000619160 00000 n -0002527403 00000 n -0000015345 00000 n -0000015446 00000 n -0000619285 00000 n -0002527324 00000 n -0000015501 00000 n -0000015571 00000 n -0000623475 00000 n -0002527192 00000 n -0000015619 00000 n -0000015671 00000 n -0000623600 00000 n -0002527074 00000 n -0000015721 00000 n -0000015767 00000 n -0000623725 00000 n -0002526995 00000 n -0000015822 00000 n -0000015881 00000 n -0000627542 00000 n -0002526916 00000 n -0000015936 00000 n -0000015975 00000 n -0000631323 00000 n -0002526784 00000 n -0000016025 00000 n -0000016071 00000 n -0000631448 00000 n -0002526666 00000 n -0000016126 00000 n -0000016183 00000 n -0000643403 00000 n -0002526587 00000 n -0000016243 00000 n -0000016305 00000 n -0000643528 00000 n -0002526508 00000 n -0000016365 00000 n -0000016431 00000 n -0000643653 00000 n -0002526415 00000 n -0000016486 00000 n -0000016565 00000 n -0000647136 00000 n -0002526336 00000 n -0000016620 00000 n -0000016695 00000 n -0000647388 00000 n -0002526204 00000 n -0000016745 00000 n -0000016794 00000 n -0000647512 00000 n -0002526125 00000 n -0000016849 00000 n -0000016897 00000 n -0000650006 00000 n -0002526046 00000 n -0000016952 00000 n -0000016998 00000 n -0000656202 00000 n -0002525914 00000 n -0000017048 00000 n -0000017090 00000 n -0000656327 00000 n -0002525835 00000 n -0000017145 00000 n -0000017182 00000 n -0000656452 00000 n -0002525742 00000 n -0000017237 00000 n -0000017303 00000 n -0000660661 00000 n -0002525649 00000 n -0000017358 00000 n -0000017391 00000 n -0000660786 00000 n -0002525516 00000 n -0000017446 00000 n -0000017480 00000 n -0000665319 00000 n -0002525437 00000 n -0000017540 00000 n -0000017591 00000 n -0000665444 00000 n -0002525344 00000 n -0000017651 00000 n -0000017732 00000 n -0000667679 00000 n -0002525251 00000 n -0000017792 00000 n -0000017843 00000 n -0000669333 00000 n -0002525158 00000 n -0000017903 00000 n -0000017960 00000 n -0000671821 00000 n -0002525065 00000 n -0000018020 00000 n -0000018066 00000 n -0000671946 00000 n -0002524972 00000 n -0000018126 00000 n -0000018185 00000 n -0000675000 00000 n -0002524879 00000 n -0000018245 00000 n -0000018302 00000 n -0000678781 00000 n -0002524786 00000 n -0000018362 00000 n -0000018435 00000 n -0000683211 00000 n -0002524693 00000 n -0000018495 00000 n -0000018566 00000 n -0000685814 00000 n -0002524614 00000 n -0000018627 00000 n -0000018681 00000 n -0000685939 00000 n -0002524482 00000 n -0000018736 00000 n -0000018768 00000 n -0000689278 00000 n -0002524403 00000 n -0000018828 00000 n -0000018878 00000 n -0000689402 00000 n -0002524310 00000 n -0000018938 00000 n -0000018978 00000 n -0000693831 00000 n -0002524217 00000 n -0000019038 00000 n -0000019114 00000 n -0000696585 00000 n -0002524138 00000 n -0000019174 00000 n -0000019241 00000 n -0000696710 00000 n -0002524059 00000 n -0000019296 00000 n -0000019326 00000 n -0000696835 00000 n -0002523941 00000 n -0000019376 00000 n -0000019414 00000 n -0000696960 00000 n -0002523862 00000 n -0000019469 00000 n +0000014557 00000 n +0000581617 00000 n +0002635747 00000 n +0000014612 00000 n +0000014655 00000 n +0000581742 00000 n +0002635668 00000 n +0000014710 00000 n +0000014756 00000 n +0000581866 00000 n +0002635536 00000 n +0000014806 00000 n +0000014844 00000 n +0000584936 00000 n +0002635457 00000 n +0000014899 00000 n +0000014954 00000 n +0000585061 00000 n +0002635378 00000 n +0000015009 00000 n +0000015057 00000 n +0000588294 00000 n +0002635246 00000 n +0000015107 00000 n +0000015162 00000 n +0000588419 00000 n +0002635167 00000 n +0000015217 00000 n +0000015269 00000 n +0000592112 00000 n +0002635074 00000 n +0000015324 00000 n +0000015369 00000 n +0000611629 00000 n +0002634956 00000 n +0000015424 00000 n +0000015472 00000 n +0000611754 00000 n +0002634891 00000 n +0000015532 00000 n +0000015594 00000 n +0000623864 00000 n +0002634773 00000 n +0000015644 00000 n +0000015682 00000 n +0000623989 00000 n +0002634694 00000 n +0000015737 00000 n +0000015836 00000 n +0000624114 00000 n +0002634601 00000 n +0000015891 00000 n +0000015952 00000 n +0000624239 00000 n +0002634508 00000 n +0000016007 00000 n +0000016079 00000 n +0000627885 00000 n +0002634429 00000 n +0000016134 00000 n +0000016208 00000 n +0000630417 00000 n +0002634297 00000 n +0000016256 00000 n +0000016308 00000 n +0000630542 00000 n +0002634179 00000 n +0000016358 00000 n +0000016404 00000 n +0000634293 00000 n +0002634100 00000 n +0000016459 00000 n +0000016517 00000 n +0000634418 00000 n +0002634021 00000 n +0000016572 00000 n +0000016611 00000 n +0000638433 00000 n +0002633889 00000 n +0000016661 00000 n +0000016707 00000 n +0000662344 00000 n +0002633771 00000 n +0000016762 00000 n +0000016819 00000 n +0000685441 00000 n +0002633692 00000 n +0000016879 00000 n +0000016941 00000 n +0000685566 00000 n +0002633613 00000 n +0000017001 00000 n +0000017067 00000 n +0000685690 00000 n +0002633520 00000 n +0000017122 00000 n +0000017201 00000 n +0000689912 00000 n +0002633441 00000 n +0000017256 00000 n +0000017331 00000 n +0000690164 00000 n +0002633309 00000 n +0000017381 00000 n +0000017430 00000 n +0000690287 00000 n +0002633230 00000 n +0000017485 00000 n +0000017533 00000 n +0000695413 00000 n +0002633151 00000 n +0000017588 00000 n +0000017634 00000 n +0000698953 00000 n +0002633019 00000 n +0000017684 00000 n +0000017726 00000 n +0000699078 00000 n +0002632940 00000 n +0000017781 00000 n +0000017817 00000 n +0000699202 00000 n +0002632847 00000 n +0000017872 00000 n +0000017940 00000 n +0000703584 00000 n +0002632754 00000 n +0000017995 00000 n +0000018028 00000 n +0000703709 00000 n +0002632621 00000 n +0000018083 00000 n +0000018117 00000 n +0000708086 00000 n +0002632542 00000 n +0000018177 00000 n +0000018228 00000 n +0000708211 00000 n +0002632449 00000 n +0000018288 00000 n +0000018369 00000 n +0000710446 00000 n +0002632356 00000 n +0000018429 00000 n +0000018480 00000 n +0000712064 00000 n +0002632263 00000 n +0000018540 00000 n +0000018597 00000 n +0000716766 00000 n +0002632170 00000 n +0000018657 00000 n +0000018703 00000 n +0000716891 00000 n +0002632077 00000 n +0000018763 00000 n +0000018822 00000 n +0000717016 00000 n +0002631984 00000 n +0000018882 00000 n +0000018939 00000 n +0000724160 00000 n +0002631891 00000 n +0000018999 00000 n +0000019072 00000 n +0000724285 00000 n +0002631798 00000 n +0000019132 00000 n +0000019203 00000 n +0000726606 00000 n +0002631719 00000 n +0000019264 00000 n +0000019318 00000 n +0000726731 00000 n +0002631587 00000 n +0000019373 00000 n +0000019405 00000 n +0000730441 00000 n +0002631508 00000 n +0000019465 00000 n 0000019515 00000 n -0000697085 00000 n -0002523769 00000 n -0000019570 00000 n -0000019640 00000 n -0000698378 00000 n -0002523690 00000 n -0000019695 00000 n -0000019748 00000 n -0000701691 00000 n -0002523558 00000 n -0000019796 00000 n -0000019853 00000 n -0000701816 00000 n -0002523479 00000 n -0000019903 00000 n -0000019949 00000 n -0000711551 00000 n -0002523347 00000 n -0000019999 00000 n -0000020034 00000 n -0000714258 00000 n -0002523282 00000 n -0000020089 00000 n -0000020137 00000 n -0000716460 00000 n -0002523150 00000 n -0000020187 00000 n -0000020233 00000 n -0000716585 00000 n -0002523071 00000 n -0000020288 00000 n -0000020347 00000 n -0000716837 00000 n -0002522992 00000 n -0000020402 00000 n -0000020462 00000 n -0000719464 00000 n -0002522874 00000 n -0000020512 00000 n -0000020550 00000 n -0000719589 00000 n -0002522795 00000 n -0000020605 00000 n -0000020651 00000 n -0000719714 00000 n -0002522702 00000 n -0000020706 00000 n -0000020784 00000 n -0000719838 00000 n -0002522623 00000 n -0000020839 00000 n -0000020910 00000 n -0000724798 00000 n -0002522491 00000 n -0000020958 00000 n -0000021022 00000 n -0000724923 00000 n -0002522412 00000 n -0000021072 00000 n -0000021118 00000 n -0000728641 00000 n -0002522280 00000 n -0000021168 00000 n -0000021220 00000 n -0000728766 00000 n -0002522201 00000 n -0000021275 00000 n -0000021351 00000 n -0000736139 00000 n -0002522108 00000 n -0000021406 00000 n -0000021453 00000 n -0000736391 00000 n -0002522029 00000 n -0000021508 00000 n -0000021568 00000 n -0000751879 00000 n -0002521897 00000 n -0000021618 00000 n -0000021675 00000 n -0000752004 00000 n -0002521818 00000 n -0000021730 00000 n -0000021786 00000 n -0000752255 00000 n -0002521725 00000 n -0000021841 00000 n -0000021913 00000 n -0000752380 00000 n -0002521646 00000 n -0000021968 00000 n -0000022017 00000 n -0000757850 00000 n -0002521514 00000 n -0000022067 00000 n -0000022117 00000 n -0000761483 00000 n -0002521410 00000 n -0000022172 00000 n -0000022227 00000 n -0000761608 00000 n -0002521331 00000 n -0000022287 00000 n +0000730565 00000 n +0002631415 00000 n +0000019575 00000 n +0000019615 00000 n +0000733221 00000 n +0002631322 00000 n +0000019675 00000 n +0000019751 00000 n +0000733346 00000 n +0002631243 00000 n +0000019811 00000 n +0000019878 00000 n +0000733471 00000 n +0002631164 00000 n +0000019933 00000 n +0000019963 00000 n +0000735939 00000 n +0002631046 00000 n +0000020013 00000 n +0000020051 00000 n +0000736064 00000 n +0002630967 00000 n +0000020106 00000 n +0000020151 00000 n +0000736189 00000 n +0002630874 00000 n +0000020206 00000 n +0000020280 00000 n +0000736314 00000 n +0002630795 00000 n +0000020335 00000 n +0000020395 00000 n +0000749469 00000 n +0002630663 00000 n +0000020443 00000 n +0000020503 00000 n +0000749594 00000 n +0002630584 00000 n +0000020553 00000 n +0000020599 00000 n +0000792078 00000 n +0002630452 00000 n +0000020649 00000 n +0000020684 00000 n +0000795546 00000 n +0002630373 00000 n +0000020739 00000 n +0000020812 00000 n +0000795671 00000 n +0002630294 00000 n +0000020867 00000 n +0000020915 00000 n +0000798981 00000 n +0002630162 00000 n +0000020965 00000 n +0000021011 00000 n +0000799105 00000 n +0002630083 00000 n +0000021066 00000 n +0000021125 00000 n +0000799230 00000 n +0002630004 00000 n +0000021180 00000 n +0000021240 00000 n +0000802307 00000 n +0002629886 00000 n +0000021290 00000 n +0000021328 00000 n +0000802431 00000 n +0002629807 00000 n +0000021383 00000 n +0000021429 00000 n +0000805154 00000 n +0002629714 00000 n +0000021484 00000 n +0000021562 00000 n +0000805279 00000 n +0002629635 00000 n +0000021617 00000 n +0000021688 00000 n +0000810277 00000 n +0002629503 00000 n +0000021736 00000 n +0000021800 00000 n +0000810402 00000 n +0002629424 00000 n +0000021850 00000 n +0000021896 00000 n +0000813973 00000 n +0002629292 00000 n +0000021946 00000 n +0000021998 00000 n +0000814098 00000 n +0002629213 00000 n +0000022053 00000 n +0000022129 00000 n +0000820598 00000 n +0002629120 00000 n +0000022184 00000 n +0000022231 00000 n +0000820850 00000 n +0002629041 00000 n +0000022286 00000 n 0000022346 00000 n -0000761858 00000 n -0002521252 00000 n -0000022406 00000 n -0000022450 00000 n -0000765516 00000 n -0002521120 00000 n -0000022500 00000 n -0000022582 00000 n -0000765641 00000 n -0002521041 00000 n -0000022637 00000 n -0000022715 00000 n -0000765766 00000 n -0002520948 00000 n -0000022770 00000 n -0000022835 00000 n -0000768805 00000 n -0002520855 00000 n -0000022890 00000 n -0000022939 00000 n -0000768930 00000 n -0002520723 00000 n -0000022994 00000 n -0000023058 00000 n -0000772701 00000 n -0002520644 00000 n -0000023118 00000 n -0000023163 00000 n -0000772826 00000 n -0002520565 00000 n -0000023223 00000 n -0000023273 00000 n -0000772950 00000 n -0002520472 00000 n -0000023328 00000 n -0000023394 00000 n -0000776449 00000 n -0002520379 00000 n -0000023449 00000 n -0000023534 00000 n -0000779752 00000 n -0002520300 00000 n -0000023589 00000 n -0000023674 00000 n -0000782131 00000 n -0002520182 00000 n -0000023724 00000 n -0000023762 00000 n -0000782256 00000 n -0002520103 00000 n -0000023817 00000 n -0000023881 00000 n -0000787243 00000 n -0002520010 00000 n -0000023936 00000 n -0000024047 00000 n -0000787368 00000 n -0002519931 00000 n -0000024102 00000 n -0000024169 00000 n -0000790253 00000 n -0002519797 00000 n -0000024217 00000 n -0000024263 00000 n -0000790378 00000 n -0002519718 00000 n -0000024313 00000 n -0000024359 00000 n -0000790503 00000 n -0002519586 00000 n -0000024409 00000 n -0000024444 00000 n -0000794744 00000 n -0002519482 00000 n -0000024499 00000 n -0000024556 00000 n -0000802635 00000 n -0002519403 00000 n -0000024616 00000 n -0000024672 00000 n -0000802760 00000 n -0002519310 00000 n -0000024732 00000 n -0000024794 00000 n -0000802885 00000 n -0002519217 00000 n -0000024854 00000 n -0000024916 00000 n -0000806553 00000 n -0002519124 00000 n -0000024976 00000 n -0000025036 00000 n -0000806678 00000 n -0002519031 00000 n -0000025096 00000 n -0000025145 00000 n -0000806803 00000 n -0002518938 00000 n -0000025205 00000 n -0000025249 00000 n -0000806928 00000 n -0002518845 00000 n -0000025309 00000 n -0000025358 00000 n -0000810485 00000 n -0002518752 00000 n -0000025418 00000 n -0000025494 00000 n -0000810609 00000 n -0002518673 00000 n -0000025554 00000 n -0000025617 00000 n -0000814510 00000 n -0002518541 00000 n -0000025667 00000 n -0000025727 00000 n -0000817569 00000 n -0002518437 00000 n -0000025782 00000 n -0000025830 00000 n -0000817694 00000 n -0002518358 00000 n +0000835723 00000 n +0002628909 00000 n +0000022396 00000 n +0000022453 00000 n +0000835847 00000 n +0002628830 00000 n +0000022508 00000 n +0000022564 00000 n +0000835972 00000 n +0002628737 00000 n +0000022619 00000 n +0000022691 00000 n +0000840269 00000 n +0002628658 00000 n +0000022746 00000 n +0000022795 00000 n +0000840394 00000 n +0002628526 00000 n +0000022845 00000 n +0000022895 00000 n +0000843411 00000 n +0002628422 00000 n +0000022950 00000 n +0000023005 00000 n +0000843536 00000 n +0002628343 00000 n +0000023065 00000 n +0000023124 00000 n +0000847403 00000 n +0002628264 00000 n +0000023184 00000 n +0000023228 00000 n +0000851054 00000 n +0002628132 00000 n +0000023278 00000 n +0000023360 00000 n +0000851179 00000 n +0002628053 00000 n +0000023415 00000 n +0000023493 00000 n +0000855170 00000 n +0002627960 00000 n +0000023548 00000 n +0000023613 00000 n +0000855295 00000 n +0002627867 00000 n +0000023668 00000 n +0000023717 00000 n +0000859089 00000 n +0002627735 00000 n +0000023772 00000 n +0000023836 00000 n +0000859214 00000 n +0002627656 00000 n +0000023896 00000 n +0000023941 00000 n +0000859339 00000 n +0002627577 00000 n +0000024001 00000 n +0000024051 00000 n +0000862885 00000 n +0002627484 00000 n +0000024106 00000 n +0000024172 00000 n +0000863010 00000 n +0002627391 00000 n +0000024227 00000 n +0000024316 00000 n +0000869131 00000 n +0002627312 00000 n +0000024371 00000 n +0000024456 00000 n +0000869256 00000 n +0002627194 00000 n +0000024506 00000 n +0000024544 00000 n +0000869381 00000 n +0002627115 00000 n +0000024599 00000 n +0000024662 00000 n +0000874521 00000 n +0002627022 00000 n +0000024717 00000 n +0000024792 00000 n +0000874646 00000 n +0002626943 00000 n +0000024847 00000 n +0000024914 00000 n +0000878284 00000 n +0002626809 00000 n +0000024962 00000 n +0000025008 00000 n +0000878409 00000 n +0002626730 00000 n +0000025058 00000 n +0000025104 00000 n +0000878534 00000 n +0002626598 00000 n +0000025154 00000 n +0000025189 00000 n +0000882382 00000 n +0002626494 00000 n +0000025244 00000 n +0000025301 00000 n +0000890052 00000 n +0002626415 00000 n +0000025361 00000 n +0000025417 00000 n +0000890176 00000 n +0002626322 00000 n +0000025477 00000 n +0000025539 00000 n +0000893711 00000 n +0002626229 00000 n +0000025599 00000 n +0000025661 00000 n +0000893836 00000 n +0002626136 00000 n +0000025721 00000 n +0000025781 00000 n +0000893961 00000 n +0002626043 00000 n +0000025841 00000 n 0000025890 00000 n -0000025936 00000 n -0000817819 00000 n -0002518279 00000 n -0000025996 00000 n -0000026049 00000 n -0000821384 00000 n -0002518147 00000 n -0000026099 00000 n -0000026177 00000 n -0000826363 00000 n -0002518068 00000 n -0000026232 00000 n -0000026286 00000 n -0000828673 00000 n -0002517989 00000 n -0000026341 00000 n -0000026390 00000 n -0000828798 00000 n -0002517896 00000 n -0000026440 00000 n -0000026491 00000 n -0000832475 00000 n -0002517763 00000 n -0000026541 00000 n -0000026579 00000 n -0000832600 00000 n -0002517684 00000 n -0000026634 00000 n -0000026687 00000 n -0000837993 00000 n -0002517591 00000 n -0000026742 00000 n -0000026817 00000 n -0000838118 00000 n -0002517511 00000 n -0000026872 00000 n -0000026951 00000 n -0000838242 00000 n -0002517429 00000 n -0000027002 00000 n -0000027046 00000 n -0000841336 00000 n -0002517291 00000 n -0000027095 00000 n -0000027133 00000 n -0000841462 00000 n -0002517207 00000 n -0000027184 00000 n -0000027222 00000 n -0000841588 00000 n -0002517108 00000 n -0000027273 00000 n -0000027320 00000 n -0000841714 00000 n -0002516968 00000 n -0000027371 00000 n -0000027451 00000 n -0000844650 00000 n -0002516884 00000 n -0000027507 00000 n -0000027562 00000 n -0000844776 00000 n -0002516785 00000 n -0000027618 00000 n -0000027667 00000 n -0000844902 00000 n -0002516686 00000 n -0000027723 00000 n -0000027777 00000 n -0000847804 00000 n -0002516587 00000 n -0000027833 00000 n -0000027877 00000 n -0000847930 00000 n -0002516488 00000 n -0000027933 00000 n -0000027987 00000 n -0000850875 00000 n -0002516404 00000 n -0000028043 00000 n -0000028086 00000 n -0000851001 00000 n -0002516305 00000 n -0000028137 00000 n -0000028178 00000 n -0000851127 00000 n -0002516180 00000 n -0000028229 00000 n +0000894085 00000 n +0002625950 00000 n +0000025950 00000 n +0000025994 00000 n +0000897641 00000 n +0002625857 00000 n +0000026054 00000 n +0000026103 00000 n +0000897766 00000 n +0002625764 00000 n +0000026163 00000 n +0000026239 00000 n +0000897890 00000 n +0002625685 00000 n +0000026299 00000 n +0000026362 00000 n +0000901894 00000 n +0002625552 00000 n +0000026412 00000 n +0000026472 00000 n +0000904785 00000 n +0002625448 00000 n +0000026527 00000 n +0000026575 00000 n +0000904910 00000 n +0002625369 00000 n +0000026635 00000 n +0000026681 00000 n +0000905035 00000 n +0002625289 00000 n +0000026741 00000 n +0000026795 00000 n +0000909095 00000 n +0002625151 00000 n +0000026846 00000 n +0000026925 00000 n +0000915822 00000 n +0002625067 00000 n +0000026981 00000 n +0000027036 00000 n +0000915948 00000 n +0002624983 00000 n +0000027092 00000 n +0000027142 00000 n +0000919894 00000 n +0002624885 00000 n +0000027193 00000 n +0000027245 00000 n +0000920020 00000 n +0002624746 00000 n +0000027296 00000 n +0000027335 00000 n +0000924608 00000 n +0002624662 00000 n +0000027391 00000 n +0000027445 00000 n +0000924734 00000 n +0002624563 00000 n +0000027501 00000 n +0000027577 00000 n +0000924860 00000 n +0002624479 00000 n +0000027633 00000 n +0000027712 00000 n +0000924986 00000 n +0002624396 00000 n +0000027763 00000 n +0000027807 00000 n +0000930323 00000 n +0002624258 00000 n +0000027856 00000 n +0000027894 00000 n +0000930449 00000 n +0002624174 00000 n +0000027945 00000 n +0000027983 00000 n +0000930575 00000 n +0002624075 00000 n +0000028034 00000 n +0000028081 00000 n +0000930701 00000 n +0002623935 00000 n +0000028132 00000 n +0000028212 00000 n +0000933671 00000 n +0002623851 00000 n 0000028268 00000 n -0000851252 00000 n -0002516096 00000 n -0000028324 00000 n -0000028405 00000 n -0000853584 00000 n -0002516012 00000 n -0000028461 00000 n -0000028542 00000 n -0000856939 00000 n -0002515873 00000 n -0000028591 00000 n -0000028646 00000 n -0000857065 00000 n -0002515789 00000 n -0000028697 00000 n -0000028744 00000 n -0000857191 00000 n -0002515690 00000 n -0000028795 00000 n -0000028850 00000 n -0000860544 00000 n -0002515550 00000 n -0000028901 00000 n -0000028969 00000 n -0000860670 00000 n -0002515466 00000 n -0000029025 00000 n -0000029081 00000 n -0000860796 00000 n -0002515367 00000 n -0000029137 00000 n -0000029195 00000 n -0000871731 00000 n -0002515283 00000 n -0000029251 00000 n -0000029308 00000 n -0000875409 00000 n -0002515143 00000 n +0000028323 00000 n +0000933797 00000 n +0002623752 00000 n +0000028379 00000 n +0000028428 00000 n +0000933923 00000 n +0002623653 00000 n +0000028484 00000 n +0000028538 00000 n +0000936862 00000 n +0002623554 00000 n +0000028594 00000 n +0000028638 00000 n +0000936988 00000 n +0002623455 00000 n +0000028694 00000 n +0000028755 00000 n +0000939950 00000 n +0002623371 00000 n +0000028811 00000 n +0000028854 00000 n +0000940076 00000 n +0002623272 00000 n +0000028905 00000 n +0000028946 00000 n +0000940202 00000 n +0002623147 00000 n +0000028997 00000 n +0000029036 00000 n +0000940328 00000 n +0002623063 00000 n +0000029092 00000 n +0000029173 00000 n +0000942714 00000 n +0002622979 00000 n +0000029229 00000 n +0000029310 00000 n +0000946126 00000 n +0002622840 00000 n 0000029359 00000 n -0000029425 00000 n -0000875535 00000 n -0002515059 00000 n -0000029481 00000 n -0000029536 00000 n -0000879277 00000 n -0002514975 00000 n -0000029592 00000 n -0000029648 00000 n -0000879403 00000 n -0002514876 00000 n -0000029699 00000 n -0000029766 00000 n -0000881519 00000 n -0002514792 00000 n -0000029817 00000 n -0000029856 00000 n -0000884434 00000 n -0002514653 00000 n +0000029414 00000 n +0000946252 00000 n +0002622756 00000 n +0000029465 00000 n +0000029512 00000 n +0000946378 00000 n +0002622657 00000 n +0000029563 00000 n +0000029618 00000 n +0000949844 00000 n +0002622517 00000 n +0000029669 00000 n +0000029737 00000 n +0000949970 00000 n +0002622433 00000 n +0000029793 00000 n +0000029849 00000 n +0000950096 00000 n +0002622334 00000 n 0000029905 00000 n -0000029986 00000 n -0000884560 00000 n -0002514569 00000 n -0000030037 00000 n -0000030084 00000 n -0000886935 00000 n -0002514485 00000 n -0000030135 00000 n -0000030174 00000 n -0000890260 00000 n -0002514345 00000 n -0000030223 00000 n -0000030273 00000 n -0000890386 00000 n -0002514261 00000 n -0000030324 00000 n -0000030371 00000 n -0000890512 00000 n -0002514121 00000 n -0000030422 00000 n -0000030470 00000 n -0000893988 00000 n -0002514037 00000 n -0000030526 00000 n -0000030598 00000 n -0000894554 00000 n -0002513938 00000 n -0000030654 00000 n -0000030723 00000 n -0000897972 00000 n -0002513854 00000 n -0000030779 00000 n -0000030837 00000 n -0000898098 00000 n -0002513714 00000 n -0000030888 00000 n -0000030945 00000 n -0000900446 00000 n -0002513630 00000 n -0000031001 00000 n -0000031076 00000 n -0000902923 00000 n -0002513546 00000 n -0000031132 00000 n -0000031191 00000 n -0000909178 00000 n -0002513447 00000 n -0000031242 00000 n +0000029963 00000 n +0000950222 00000 n +0002622250 00000 n +0000030019 00000 n +0000030076 00000 n +0000964118 00000 n +0002622110 00000 n +0000030127 00000 n +0000030193 00000 n +0000964244 00000 n +0002622026 00000 n +0000030249 00000 n +0000030304 00000 n +0000968235 00000 n +0002621942 00000 n +0000030360 00000 n +0000030416 00000 n +0000968361 00000 n +0002621843 00000 n +0000030467 00000 n +0000030534 00000 n +0000969976 00000 n +0002621759 00000 n +0000030585 00000 n +0000030624 00000 n +0000973388 00000 n +0002621620 00000 n +0000030673 00000 n +0000030754 00000 n +0000973514 00000 n +0002621536 00000 n +0000030805 00000 n +0000030852 00000 n +0000976420 00000 n +0002621411 00000 n +0000030903 00000 n +0000030942 00000 n +0000976546 00000 n +0002621342 00000 n +0000030998 00000 n +0000031058 00000 n +0000981004 00000 n +0002621202 00000 n +0000031107 00000 n +0000031157 00000 n +0000981130 00000 n +0002621118 00000 n +0000031208 00000 n +0000031255 00000 n +0000981256 00000 n +0002620978 00000 n 0000031306 00000 n -0000909304 00000 n -0002513307 00000 n -0000031357 00000 n -0000031429 00000 n -0000909430 00000 n -0002513223 00000 n -0000031485 00000 n -0000031533 00000 n -0000921531 00000 n -0002513124 00000 n -0000031589 00000 n -0000031639 00000 n -0000925568 00000 n -0002513025 00000 n -0000031695 00000 n +0000031354 00000 n +0000984288 00000 n +0002620894 00000 n +0000031410 00000 n +0000031474 00000 n +0000988420 00000 n +0002620810 00000 n +0000031530 00000 n +0000031599 00000 n +0000988546 00000 n +0002620670 00000 n +0000031650 00000 n +0000031702 00000 n +0000991097 00000 n +0002620586 00000 n 0000031758 00000 n -0000925693 00000 n -0002512926 00000 n -0000031814 00000 n -0000031856 00000 n -0000930128 00000 n -0002512827 00000 n -0000031912 00000 n -0000031996 00000 n -0000934067 00000 n -0002512743 00000 n -0000032052 00000 n -0000032114 00000 n -0000938519 00000 n -0002512603 00000 n -0000032165 00000 n -0000032230 00000 n -0000938645 00000 n -0002512519 00000 n -0000032286 00000 n -0000032362 00000 n -0000942698 00000 n -0002512420 00000 n -0000032418 00000 n -0000032495 00000 n -0000945896 00000 n -0002512321 00000 n -0000032551 00000 n -0000032609 00000 n -0000946148 00000 n -0002512222 00000 n -0000032665 00000 n -0000032730 00000 n -0000949947 00000 n -0002512138 00000 n -0000032786 00000 n -0000032851 00000 n -0000953260 00000 n -0002511998 00000 n -0000032902 00000 n -0000032963 00000 n -0000957385 00000 n -0002511914 00000 n -0000033019 00000 n -0000033102 00000 n -0000957511 00000 n -0002511789 00000 n -0000033158 00000 n -0000033238 00000 n -0000961850 00000 n -0002511705 00000 n -0000033299 00000 n -0000033357 00000 n -0000965046 00000 n -0002511606 00000 n -0000033418 00000 n -0000033515 00000 n -0000968328 00000 n -0002511507 00000 n -0000033576 00000 n -0000033650 00000 n -0000970810 00000 n -0002511408 00000 n -0000033711 00000 n -0000033795 00000 n -0000973433 00000 n -0002511309 00000 n -0000033856 00000 n -0000033918 00000 n -0000976182 00000 n -0002511210 00000 n -0000033979 00000 n -0000034072 00000 n -0000979722 00000 n -0002511111 00000 n -0000034133 00000 n -0000034205 00000 n -0000982861 00000 n -0002511012 00000 n -0000034266 00000 n -0000034351 00000 n -0000982987 00000 n -0002510928 00000 n -0000034412 00000 n -0000034474 00000 n -0000986132 00000 n -0002510788 00000 n -0000034525 00000 n -0000034582 00000 n -0000986258 00000 n -0002510704 00000 n -0000034638 00000 n -0000034702 00000 n -0000990230 00000 n -0002510605 00000 n -0000034758 00000 n -0000034833 00000 n -0000997470 00000 n -0002510506 00000 n -0000034889 00000 n -0000034957 00000 n -0000997596 00000 n -0002510422 00000 n -0000035013 00000 n -0000035103 00000 n -0001001330 00000 n -0002510282 00000 n -0000035154 00000 n -0000035193 00000 n -0001001455 00000 n -0002510198 00000 n -0000035249 00000 n -0000035329 00000 n -0001011724 00000 n -0002510099 00000 n -0000035385 00000 n -0000035449 00000 n -0001013902 00000 n -0002510000 00000 n -0000035505 00000 n -0000035576 00000 n -0001017659 00000 n -0002509901 00000 n -0000035632 00000 n -0000035717 00000 n -0001021447 00000 n -0002509802 00000 n -0000035773 00000 n -0000035840 00000 n -0001028451 00000 n -0002509703 00000 n -0000035896 00000 n -0000035947 00000 n -0001028577 00000 n -0002509619 00000 n -0000036003 00000 n -0000036094 00000 n -0001028703 00000 n -0002509479 00000 n -0000036146 00000 n -0000036193 00000 n -0001028829 00000 n -0002509395 00000 n -0000036250 00000 n -0000036296 00000 n -0001031902 00000 n -0002509296 00000 n -0000036353 00000 n -0000036414 00000 n -0001032028 00000 n -0002509197 00000 n -0000036471 00000 n -0000036519 00000 n -0001032154 00000 n -0002509113 00000 n -0000036576 00000 n -0000036628 00000 n -0001036426 00000 n -0002509014 00000 n -0000036680 00000 n -0000036761 00000 n -0001044138 00000 n -0002508915 00000 n -0000036813 00000 n -0000036862 00000 n -0001044264 00000 n -0002508816 00000 n -0000036914 00000 n -0000036983 00000 n -0001046226 00000 n -0002508717 00000 n -0000037035 00000 n -0000037120 00000 n -0001046352 00000 n -0002508592 00000 n +0000031822 00000 n +0000993628 00000 n +0002620502 00000 n +0000031878 00000 n +0000031936 00000 n +0001000028 00000 n +0002620362 00000 n +0000031987 00000 n +0000032044 00000 n +0001000153 00000 n +0002620252 00000 n +0000032100 00000 n +0000032157 00000 n +0001000279 00000 n +0002620168 00000 n +0000032218 00000 n +0000032268 00000 n +0001008086 00000 n +0002620069 00000 n +0000032329 00000 n +0000032381 00000 n +0001015663 00000 n +0002619970 00000 n +0000032442 00000 n +0000032507 00000 n +0001020229 00000 n +0002619871 00000 n +0000032568 00000 n +0000032612 00000 n +0001020355 00000 n +0002619772 00000 n +0000032673 00000 n +0000032740 00000 n +0001024476 00000 n +0002619688 00000 n +0000032801 00000 n +0000032852 00000 n +0001028569 00000 n +0002619548 00000 n +0000032903 00000 n +0000032966 00000 n +0001032709 00000 n +0002619464 00000 n +0000033022 00000 n +0000033095 00000 n +0001032835 00000 n +0002619365 00000 n +0000033151 00000 n +0000033214 00000 n +0001035996 00000 n +0002619266 00000 n +0000033270 00000 n +0000033328 00000 n +0001036246 00000 n +0002619167 00000 n +0000033384 00000 n +0000033442 00000 n +0001040527 00000 n +0002619083 00000 n +0000033498 00000 n +0000033557 00000 n +0001044037 00000 n +0002618943 00000 n +0000033608 00000 n +0000033669 00000 n +0001048180 00000 n +0002618859 00000 n +0000033725 00000 n +0000033791 00000 n +0001048306 00000 n +0002618734 00000 n +0000033847 00000 n +0000033915 00000 n +0001052757 00000 n +0002618650 00000 n +0000033976 00000 n +0000034030 00000 n +0001059032 00000 n +0002618551 00000 n +0000034091 00000 n +0000034182 00000 n +0001059158 00000 n +0002618452 00000 n +0000034243 00000 n +0000034313 00000 n +0001061697 00000 n +0002618353 00000 n +0000034374 00000 n +0000034444 00000 n +0001064432 00000 n +0002618254 00000 n +0000034505 00000 n +0000034567 00000 n +0001067031 00000 n +0002618155 00000 n +0000034628 00000 n +0000034687 00000 n +0001070422 00000 n +0002618056 00000 n +0000034748 00000 n +0000034812 00000 n +0001073358 00000 n +0002617957 00000 n +0000034873 00000 n +0000034935 00000 n +0001075716 00000 n +0002617873 00000 n +0000034996 00000 n +0000035062 00000 n +0001075842 00000 n +0002617733 00000 n +0000035113 00000 n +0000035175 00000 n +0001079663 00000 n +0002617649 00000 n +0000035231 00000 n +0000035291 00000 n +0001080104 00000 n +0002617550 00000 n +0000035347 00000 n +0000035411 00000 n +0001088293 00000 n +0002617451 00000 n +0000035467 00000 n +0000035532 00000 n +0001088419 00000 n +0002617367 00000 n +0000035588 00000 n +0000035680 00000 n +0001091979 00000 n +0002617227 00000 n +0000035731 00000 n +0000035770 00000 n +0001092105 00000 n +0002617143 00000 n +0000035826 00000 n +0000035902 00000 n +0001102250 00000 n +0002617044 00000 n +0000035958 00000 n +0000036022 00000 n +0001107097 00000 n +0002616945 00000 n +0000036078 00000 n +0000036149 00000 n +0001111465 00000 n +0002616846 00000 n +0000036205 00000 n +0000036289 00000 n +0001111591 00000 n +0002616747 00000 n +0000036345 00000 n +0000036411 00000 n +0001118473 00000 n +0002616648 00000 n +0000036467 00000 n +0000036518 00000 n +0001118599 00000 n +0002616564 00000 n +0000036574 00000 n +0000036648 00000 n +0001118725 00000 n +0002616424 00000 n +0000036699 00000 n +0000036745 00000 n +0001121576 00000 n +0002616340 00000 n +0000036801 00000 n +0000036846 00000 n +0001121702 00000 n +0002616241 00000 n +0000036902 00000 n +0000036962 00000 n +0001121828 00000 n +0002616142 00000 n +0000037018 00000 n +0000037065 00000 n +0001121954 00000 n +0002616058 00000 n +0000037121 00000 n 0000037172 00000 n -0000037212 00000 n -0001046478 00000 n -0002508508 00000 n -0000037269 00000 n -0000037344 00000 n -0001046604 00000 n -0002508424 00000 n -0000037401 00000 n -0000037501 00000 n -0001050411 00000 n -0002508284 00000 n -0000037550 00000 n -0000037608 00000 n -0001050537 00000 n -0002508159 00000 n -0000037659 00000 n -0000037697 00000 n -0001050663 00000 n -0002508075 00000 n -0000037753 00000 n -0000037802 00000 n -0001050789 00000 n -0002507991 00000 n -0000037858 00000 n -0000037894 00000 n -0001050915 00000 n -0002507851 00000 n -0000037945 00000 n -0000038006 00000 n -0001054550 00000 n -0002507767 00000 n -0000038062 00000 n -0000038121 00000 n -0001057748 00000 n -0002507668 00000 n -0000038177 00000 n -0000038238 00000 n -0001058001 00000 n -0002507584 00000 n -0000038294 00000 n -0000038361 00000 n -0001060998 00000 n -0002507444 00000 n -0000038412 00000 n -0000038460 00000 n -0001061124 00000 n -0002507360 00000 n -0000038516 00000 n -0000038588 00000 n -0001064569 00000 n -0002507261 00000 n -0000038644 00000 n -0000038771 00000 n -0001064695 00000 n -0002507162 00000 n -0000038827 00000 n -0000038901 00000 n -0001064821 00000 n -0002507063 00000 n -0000038957 00000 n -0000039047 00000 n -0001068298 00000 n -0002506979 00000 n -0000039103 00000 n -0000039186 00000 n -0001072066 00000 n -0002506839 00000 n -0000039237 00000 n -0000039354 00000 n -0001072192 00000 n -0002506755 00000 n -0000039410 00000 n -0000039474 00000 n -0001091522 00000 n -0002506656 00000 n -0000039530 00000 n -0000039586 00000 n -0001091838 00000 n -0002506557 00000 n -0000039642 00000 n -0000039710 00000 n -0001096236 00000 n -0002506458 00000 n -0000039766 00000 n -0000039820 00000 n -0001121749 00000 n -0002506359 00000 n +0001126167 00000 n +0002615959 00000 n +0000037224 00000 n +0000037299 00000 n +0001133276 00000 n +0002615860 00000 n +0000037351 00000 n +0000037400 00000 n +0001133402 00000 n +0002615761 00000 n +0000037452 00000 n +0000037519 00000 n +0001136253 00000 n +0002615662 00000 n +0000037571 00000 n +0000037656 00000 n +0001136379 00000 n +0002615537 00000 n +0000037708 00000 n +0000037748 00000 n +0001136505 00000 n +0002615453 00000 n +0000037805 00000 n +0000037881 00000 n +0001136631 00000 n +0002615369 00000 n +0000037938 00000 n +0000038039 00000 n +0001140259 00000 n +0002615229 00000 n +0000038088 00000 n +0000038133 00000 n +0001140385 00000 n +0002615104 00000 n +0000038184 00000 n +0000038222 00000 n +0001140511 00000 n +0002615020 00000 n +0000038278 00000 n +0000038327 00000 n +0001140637 00000 n +0002614936 00000 n +0000038383 00000 n +0000038419 00000 n +0001140763 00000 n +0002614796 00000 n +0000038470 00000 n +0000038528 00000 n +0001144551 00000 n +0002614712 00000 n +0000038584 00000 n +0000038640 00000 n +0001148153 00000 n +0002614613 00000 n +0000038696 00000 n +0000038757 00000 n +0001148406 00000 n +0002614529 00000 n +0000038813 00000 n +0000038876 00000 n +0001151243 00000 n +0002614389 00000 n +0000038927 00000 n +0000038975 00000 n +0001151369 00000 n +0002614305 00000 n +0000039031 00000 n +0000039105 00000 n +0001154716 00000 n +0002614206 00000 n +0000039161 00000 n +0000039244 00000 n +0001154842 00000 n +0002614107 00000 n +0000039300 00000 n +0000039366 00000 n +0001154968 00000 n +0002614008 00000 n +0000039422 00000 n +0000039513 00000 n +0001158550 00000 n +0002613924 00000 n +0000039569 00000 n +0000039618 00000 n +0001162190 00000 n +0002613784 00000 n +0000039669 00000 n +0000039756 00000 n +0001162316 00000 n +0002613700 00000 n +0000039812 00000 n 0000039876 00000 n -0000039963 00000 n -0001125971 00000 n -0002506260 00000 n -0000040019 00000 n -0000040099 00000 n -0001129754 00000 n -0002506161 00000 n -0000040155 00000 n -0000040229 00000 n -0001129880 00000 n -0002506077 00000 n -0000040285 00000 n -0000040360 00000 n -0001134579 00000 n -0002505936 00000 n -0000040411 00000 n -0000040468 00000 n -0001134705 00000 n -0002505852 00000 n -0000040524 00000 n -0000040579 00000 n -0001137960 00000 n -0002505753 00000 n -0000040635 00000 n -0000040689 00000 n -0001141032 00000 n -0002505654 00000 n -0000040745 00000 n -0000040792 00000 n -0001183442 00000 n -0002505555 00000 n -0000040848 00000 n -0000040886 00000 n -0001183757 00000 n -0002505456 00000 n -0000040942 00000 n -0000040976 00000 n -0001214077 00000 n -0002505357 00000 n -0000041032 00000 n -0000041070 00000 n -0001241812 00000 n -0002505258 00000 n -0000041126 00000 n -0000041181 00000 n -0001241938 00000 n -0002505159 00000 n -0000041237 00000 n +0001162442 00000 n +0002613601 00000 n +0000039932 00000 n +0000039988 00000 n +0001181960 00000 n +0002613502 00000 n +0000040044 00000 n +0000040112 00000 n +0001196914 00000 n +0002613403 00000 n +0000040168 00000 n +0000040222 00000 n +0001212210 00000 n +0002613304 00000 n +0000040278 00000 n +0000040366 00000 n +0001216534 00000 n +0002613205 00000 n +0000040422 00000 n +0000040502 00000 n +0001216659 00000 n +0002613106 00000 n +0000040558 00000 n +0000040621 00000 n +0001220328 00000 n +0002613022 00000 n +0000040677 00000 n +0000040752 00000 n +0001220453 00000 n +0002612881 00000 n +0000040803 00000 n +0000040860 00000 n +0001224322 00000 n +0002612797 00000 n +0000040916 00000 n +0000040971 00000 n +0001227585 00000 n +0002612698 00000 n +0000041027 00000 n +0000041081 00000 n +0001230705 00000 n +0002612558 00000 n +0000041137 00000 n +0000041183 00000 n +0001230831 00000 n +0002612489 00000 n +0000041244 00000 n 0000041293 00000 n -0001242064 00000 n -0002505060 00000 n +0001230957 00000 n +0002612390 00000 n 0000041349 00000 n -0000041390 00000 n -0001313330 00000 n -0002504961 00000 n -0000041447 00000 n -0000041532 00000 n -0001313455 00000 n -0002504862 00000 n -0000041589 00000 n -0000041638 00000 n -0001317026 00000 n -0002504763 00000 n -0000041695 00000 n -0000041734 00000 n -0001317152 00000 n -0002504664 00000 n -0000041791 00000 n -0000041834 00000 n -0001317278 00000 n -0002504565 00000 n +0000041387 00000 n +0001273270 00000 n +0002612291 00000 n +0000041443 00000 n +0000041477 00000 n +0001273520 00000 n +0002612192 00000 n +0000041533 00000 n +0000041571 00000 n +0001366931 00000 n +0002612093 00000 n +0000041627 00000 n +0000041682 00000 n +0001367184 00000 n +0002611994 00000 n +0000041738 00000 n +0000041794 00000 n +0001367310 00000 n +0002611895 00000 n +0000041850 00000 n 0000041891 00000 n -0000041955 00000 n -0001324074 00000 n -0002504466 00000 n +0001398922 00000 n +0002611796 00000 n +0000041948 00000 n 0000042012 00000 n -0000042101 00000 n -0001324325 00000 n -0002504367 00000 n -0000042158 00000 n -0000042254 00000 n -0001371462 00000 n -0002504268 00000 n -0000042311 00000 n -0000042369 00000 n -0001379799 00000 n -0002504169 00000 n -0000042426 00000 n -0000042485 00000 n -0001383840 00000 n -0002504085 00000 n -0000042542 00000 n -0000042602 00000 n -0001383966 00000 n -0002503945 00000 n -0000042653 00000 n -0000042714 00000 n -0001384091 00000 n -0002503861 00000 n -0000042770 00000 n -0000042840 00000 n -0001409283 00000 n -0002503762 00000 n -0000042896 00000 n -0000042954 00000 n -0001409598 00000 n -0002503678 00000 n -0000043010 00000 n -0000043068 00000 n -0001436578 00000 n -0002503538 00000 n -0000043119 00000 n -0000043209 00000 n -0001436704 00000 n -0002503454 00000 n -0000043265 00000 n -0000043342 00000 n -0001464099 00000 n -0002503370 00000 n -0000043398 00000 n -0000043475 00000 n -0001464225 00000 n -0002503230 00000 n -0000043526 00000 n -0000043646 00000 n -0001468166 00000 n -0002503146 00000 n -0000043702 00000 n -0000043762 00000 n -0001468292 00000 n -0002503062 00000 n -0000043818 00000 n -0000043881 00000 n -0001472187 00000 n -0002502922 00000 n -0000043932 00000 n -0000044006 00000 n -0001472313 00000 n -0002502838 00000 n -0000044062 00000 n -0000044150 00000 n -0001472439 00000 n -0002502739 00000 n -0000044206 00000 n -0000044270 00000 n -0001472565 00000 n -0002502640 00000 n -0000044326 00000 n -0000044378 00000 n -0001472691 00000 n -0002502556 00000 n -0000044434 00000 n -0000044526 00000 n -0001476214 00000 n -0002502415 00000 n -0000044578 00000 n -0000044640 00000 n -0001476340 00000 n -0002502331 00000 n -0000044697 00000 n -0000044757 00000 n -0001476466 00000 n -0002502232 00000 n -0000044814 00000 n -0000044879 00000 n -0001479098 00000 n -0002502133 00000 n -0000044936 00000 n -0000045016 00000 n -0001481650 00000 n -0002502034 00000 n -0000045073 00000 n -0000045138 00000 n -0001484452 00000 n -0002501935 00000 n -0000045195 00000 n -0000045256 00000 n -0001487710 00000 n -0002501836 00000 n -0000045313 00000 n -0000045402 00000 n -0001487835 00000 n -0002501737 00000 n -0000045459 00000 n -0000045512 00000 n -0001492674 00000 n -0002501638 00000 n -0000045569 00000 n -0000045685 00000 n -0001496719 00000 n -0002501539 00000 n -0000045742 00000 n -0000045802 00000 n -0001496845 00000 n -0002501440 00000 n -0000045860 00000 n -0000045926 00000 n -0001501607 00000 n -0002501341 00000 n -0000045984 00000 n -0000046038 00000 n -0001504880 00000 n -0002501242 00000 n -0000046096 00000 n -0000046179 00000 n -0001505193 00000 n -0002501143 00000 n -0000046237 00000 n -0000046294 00000 n -0001505319 00000 n -0002501044 00000 n -0000046352 00000 n -0000046402 00000 n -0001552574 00000 n -0002500945 00000 n -0000046460 00000 n -0000046534 00000 n -0001556214 00000 n -0002500861 00000 n -0000046592 00000 n -0000046680 00000 n -0001559535 00000 n -0002500721 00000 n -0000046732 00000 n -0000046822 00000 n -0001559913 00000 n -0002500637 00000 n -0000046879 00000 n -0000046941 00000 n -0001563571 00000 n -0002500538 00000 n -0000046998 00000 n -0000047063 00000 n -0001563697 00000 n -0002500439 00000 n -0000047120 00000 n -0000047195 00000 n -0001566779 00000 n -0002500340 00000 n -0000047252 00000 n -0000047336 00000 n -0001570157 00000 n -0002500241 00000 n -0000047393 00000 n -0000047460 00000 n -0001580682 00000 n -0002500157 00000 n -0000047517 00000 n -0000047571 00000 n -0001583066 00000 n -0002500017 00000 n -0000047623 00000 n +0001402770 00000 n +0002611697 00000 n +0000042069 00000 n +0000042118 00000 n +0001402896 00000 n +0002611598 00000 n +0000042175 00000 n +0000042214 00000 n +0001406220 00000 n +0002611499 00000 n +0000042271 00000 n +0000042316 00000 n +0001406346 00000 n +0002611400 00000 n +0000042373 00000 n +0000042435 00000 n +0001410322 00000 n +0002611301 00000 n +0000042492 00000 n +0000042581 00000 n +0001414532 00000 n +0002611202 00000 n +0000042638 00000 n +0000042718 00000 n +0001456107 00000 n +0002611103 00000 n +0000042775 00000 n +0000042833 00000 n +0001464813 00000 n +0002611004 00000 n +0000042890 00000 n +0000042947 00000 n +0001470071 00000 n +0002610920 00000 n +0000043004 00000 n +0000043064 00000 n +0001470197 00000 n +0002610780 00000 n +0000043115 00000 n +0000043176 00000 n +0001495678 00000 n +0002610696 00000 n +0000043232 00000 n +0000043302 00000 n +0001495804 00000 n +0002610597 00000 n +0000043358 00000 n +0000043416 00000 n +0001496056 00000 n +0002610513 00000 n +0000043472 00000 n +0000043530 00000 n +0001523118 00000 n +0002610373 00000 n +0000043581 00000 n +0000043672 00000 n +0001523244 00000 n +0002610289 00000 n +0000043728 00000 n +0000043805 00000 n +0001551041 00000 n +0002610205 00000 n +0000043861 00000 n +0000043938 00000 n +0001551167 00000 n +0002610065 00000 n +0000043989 00000 n +0000044037 00000 n +0001554706 00000 n +0002609981 00000 n +0000044093 00000 n +0000044153 00000 n +0001554831 00000 n +0002609897 00000 n +0000044209 00000 n +0000044272 00000 n +0001554957 00000 n +0002609757 00000 n +0000044323 00000 n +0000044397 00000 n +0001558933 00000 n +0002609673 00000 n +0000044453 00000 n +0000044543 00000 n +0001559059 00000 n +0002609574 00000 n +0000044599 00000 n +0000044663 00000 n +0001559185 00000 n +0002609475 00000 n +0000044719 00000 n +0000044773 00000 n +0001559311 00000 n +0002609391 00000 n +0000044829 00000 n +0000044922 00000 n +0001563135 00000 n +0002609250 00000 n +0000044974 00000 n +0000045037 00000 n +0001563261 00000 n +0002609166 00000 n +0000045094 00000 n +0000045154 00000 n +0001563387 00000 n +0002609067 00000 n +0000045211 00000 n +0000045276 00000 n +0001563512 00000 n +0002608968 00000 n +0000045333 00000 n +0000045411 00000 n +0001568011 00000 n +0002608869 00000 n +0000045468 00000 n +0000045531 00000 n +0001571137 00000 n +0002608770 00000 n +0000045588 00000 n +0000045649 00000 n +0001571263 00000 n +0002608671 00000 n +0000045706 00000 n +0000045789 00000 n +0001574350 00000 n +0002608572 00000 n +0000045846 00000 n +0000045899 00000 n +0001578719 00000 n +0002608473 00000 n +0000045956 00000 n +0000046035 00000 n +0001582502 00000 n +0002608374 00000 n +0000046092 00000 n +0000046150 00000 n +0001582628 00000 n +0002608275 00000 n +0000046208 00000 n +0000046272 00000 n +0001586982 00000 n +0002608176 00000 n +0000046330 00000 n +0000046384 00000 n +0001590392 00000 n +0002608077 00000 n +0000046442 00000 n +0000046525 00000 n +0001590707 00000 n +0002607978 00000 n +0000046583 00000 n +0000046640 00000 n +0001637513 00000 n +0002607879 00000 n +0000046698 00000 n +0000046748 00000 n +0001637766 00000 n +0002607780 00000 n +0000046806 00000 n +0000046880 00000 n +0001641499 00000 n +0002607696 00000 n +0000046938 00000 n +0000047026 00000 n +0001644632 00000 n +0002607556 00000 n +0000047078 00000 n +0000047164 00000 n +0001645010 00000 n +0002607472 00000 n +0000047221 00000 n +0000047283 00000 n +0001648619 00000 n +0002607373 00000 n +0000047340 00000 n +0000047405 00000 n +0001648745 00000 n +0002607274 00000 n +0000047462 00000 n +0000047537 00000 n +0001651775 00000 n +0002607175 00000 n +0000047594 00000 n 0000047674 00000 n -0001586398 00000 n -0002499933 00000 n +0001654673 00000 n +0002607076 00000 n 0000047731 00000 n -0000047782 00000 n -0001586524 00000 n -0002499834 00000 n -0000047839 00000 n -0000047881 00000 n -0001586650 00000 n -0002499735 00000 n -0000047938 00000 n -0000047985 00000 n -0001586776 00000 n -0002499651 00000 n -0000048042 00000 n -0000048086 00000 n -0001589529 00000 n -0002499511 00000 n -0000048138 00000 n -0000048206 00000 n -0001595068 00000 n -0002499386 00000 n -0000048263 00000 n -0000048327 00000 n -0001595193 00000 n -0002499302 00000 n -0000048389 00000 n -0000048442 00000 n -0001595319 00000 n -0002499203 00000 n -0000048504 00000 n -0000048574 00000 n -0001602312 00000 n -0002499104 00000 n -0000048636 00000 n -0000048690 00000 n -0001602438 00000 n -0002499005 00000 n -0000048752 00000 n -0000048829 00000 n -0001608179 00000 n -0002498906 00000 n -0000048891 00000 n -0000048955 00000 n -0001608305 00000 n -0002498807 00000 n -0000049017 00000 n -0000049074 00000 n -0001613844 00000 n -0002498708 00000 n -0000049136 00000 n -0000049244 00000 n -0001613970 00000 n -0002498624 00000 n -0000049306 00000 n -0000049369 00000 n -0001614096 00000 n -0002498540 00000 n -0000049426 00000 n -0000049510 00000 n -0001630538 00000 n -0002498400 00000 n -0000049562 00000 n -0000049614 00000 n -0001630664 00000 n -0002498316 00000 n -0000049671 00000 n -0000049717 00000 n -0001630789 00000 n -0002498217 00000 n -0000049774 00000 n -0000049835 00000 n -0001634224 00000 n -0002498118 00000 n -0000049892 00000 n -0000049974 00000 n -0001634350 00000 n -0002498019 00000 n -0000050031 00000 n -0000050087 00000 n -0001637517 00000 n -0002497920 00000 n -0000050144 00000 n -0000050194 00000 n -0001637643 00000 n -0002497821 00000 n -0000050251 00000 n -0000050299 00000 n -0001641035 00000 n -0002497737 00000 n -0000050356 00000 n -0000050407 00000 n -0001641161 00000 n -0002497638 00000 n -0000050459 00000 n -0000050505 00000 n -0001644801 00000 n -0002497498 00000 n -0000050557 00000 n -0000050633 00000 n -0001644927 00000 n -0002497414 00000 n -0000050690 00000 n -0000050756 00000 n -0001647578 00000 n -0002497315 00000 n -0000050813 00000 n -0000050856 00000 n -0001647703 00000 n -0002497231 00000 n -0000050913 00000 n -0000050962 00000 n -0001647829 00000 n -0002497132 00000 n -0000051014 00000 n -0000051064 00000 n -0001650903 00000 n -0002497033 00000 n -0000051116 00000 n +0000047798 00000 n +0001667911 00000 n +0002606992 00000 n +0000047855 00000 n +0000047909 00000 n +0001671085 00000 n +0002606852 00000 n +0000047961 00000 n +0000048012 00000 n +0001671211 00000 n +0002606768 00000 n +0000048069 00000 n +0000048120 00000 n +0001671337 00000 n +0002606669 00000 n +0000048177 00000 n +0000048219 00000 n +0001673707 00000 n +0002606570 00000 n +0000048276 00000 n +0000048323 00000 n +0001673833 00000 n +0002606486 00000 n +0000048380 00000 n +0000048424 00000 n +0001673959 00000 n +0002606346 00000 n +0000048476 00000 n +0000048544 00000 n +0001679276 00000 n +0002606221 00000 n +0000048601 00000 n +0000048665 00000 n +0001683580 00000 n +0002606137 00000 n +0000048727 00000 n +0000048782 00000 n +0001683706 00000 n +0002606038 00000 n +0000048844 00000 n +0000048912 00000 n +0001683832 00000 n +0002605939 00000 n +0000048974 00000 n +0000049028 00000 n +0001691471 00000 n +0002605840 00000 n +0000049090 00000 n +0000049167 00000 n +0001691597 00000 n +0002605741 00000 n +0000049229 00000 n +0000049290 00000 n +0001696718 00000 n +0002605642 00000 n +0000049352 00000 n +0000049409 00000 n +0001696844 00000 n +0002605543 00000 n +0000049471 00000 n +0000049580 00000 n +0001702150 00000 n +0002605459 00000 n +0000049642 00000 n +0000049705 00000 n +0001702276 00000 n +0002605375 00000 n +0000049762 00000 n +0000049846 00000 n +0001711346 00000 n +0002605235 00000 n +0000049898 00000 n +0000049950 00000 n +0001714872 00000 n +0002605151 00000 n +0000050007 00000 n +0000050053 00000 n +0001714998 00000 n +0002605052 00000 n +0000050110 00000 n +0000050171 00000 n +0001715124 00000 n +0002604953 00000 n +0000050228 00000 n +0000050310 00000 n +0001717728 00000 n +0002604854 00000 n +0000050367 00000 n +0000050423 00000 n +0001717854 00000 n +0002604755 00000 n +0000050480 00000 n +0000050530 00000 n +0001721365 00000 n +0002604671 00000 n +0000050587 00000 n +0000050635 00000 n +0001721491 00000 n +0002604572 00000 n +0000050687 00000 n +0000050733 00000 n +0001725393 00000 n +0002604432 00000 n +0000050785 00000 n +0000050861 00000 n +0001725519 00000 n +0002604348 00000 n +0000050918 00000 n +0000050984 00000 n +0001728566 00000 n +0002604249 00000 n +0000051041 00000 n +0000051084 00000 n +0001728692 00000 n +0002604165 00000 n +0000051141 00000 n 0000051190 00000 n -0001653812 00000 n -0002496934 00000 n +0001731864 00000 n +0002604066 00000 n 0000051242 00000 n -0000051295 00000 n -0001686131 00000 n -0002496793 00000 n -0000051347 00000 n -0000051387 00000 n -0001686257 00000 n -0002496709 00000 n -0000051444 00000 n -0000051506 00000 n -0001686383 00000 n -0002496610 00000 n -0000051563 00000 n -0000051655 00000 n -0001690266 00000 n -0002496511 00000 n -0000051712 00000 n -0000051822 00000 n -0001690392 00000 n -0002496412 00000 n -0000051879 00000 n -0000051945 00000 n -0001690517 00000 n -0002496313 00000 n -0000052002 00000 n -0000052087 00000 n -0001690643 00000 n -0002496214 00000 n -0000052144 00000 n -0000052234 00000 n -0001690769 00000 n -0002496115 00000 n -0000052291 00000 n -0000052399 00000 n -0001694287 00000 n -0002496016 00000 n -0000052456 00000 n -0000052538 00000 n -0001694413 00000 n -0002495917 00000 n -0000052595 00000 n -0000052667 00000 n -0001694538 00000 n -0002495818 00000 n -0000052725 00000 n -0000052789 00000 n -0001694664 00000 n -0002495719 00000 n -0000052847 00000 n -0000052952 00000 n -0001694790 00000 n -0002495620 00000 n -0000053010 00000 n -0000053085 00000 n -0001694916 00000 n -0002495521 00000 n -0000053143 00000 n -0000053182 00000 n -0001698316 00000 n -0002495422 00000 n -0000053240 00000 n -0000053322 00000 n -0001703399 00000 n -0002495323 00000 n -0000053380 00000 n -0000053468 00000 n -0001703525 00000 n -0002495224 00000 n -0000053526 00000 n -0000053609 00000 n -0001703651 00000 n -0002495125 00000 n -0000053667 00000 n -0000053757 00000 n -0001703777 00000 n -0002495026 00000 n -0000053815 00000 n -0000053932 00000 n -0001703903 00000 n -0002494942 00000 n -0000053990 00000 n -0000054088 00000 n -0001704801 00000 n -0002494858 00000 n -0000054140 00000 n -0000054209 00000 n -0001837099 00000 n -0002494719 00000 n -0000054258 00000 n -0000054303 00000 n -0001837225 00000 n -0002494635 00000 n -0000054354 00000 n -0000054401 00000 n -0001837351 00000 n -0002494536 00000 n -0000054452 00000 n -0000054488 00000 n -0001840392 00000 n -0002494396 00000 n -0000054539 00000 n -0000054581 00000 n -0001840518 00000 n -0002494312 00000 n -0000054637 00000 n -0000054670 00000 n -0001840644 00000 n -0002494213 00000 n -0000054726 00000 n -0000054767 00000 n -0001840897 00000 n -0002494114 00000 n -0000054823 00000 n -0000054864 00000 n -0001843956 00000 n -0002494015 00000 n -0000054920 00000 n -0000054955 00000 n -0001844082 00000 n -0002493931 00000 n -0000055011 00000 n -0000055047 00000 n -0001847251 00000 n -0002493806 00000 n -0000055098 00000 n -0000055155 00000 n -0001847377 00000 n -0002493722 00000 n -0000055211 00000 n -0000055249 00000 n -0001847502 00000 n -0002493638 00000 n -0000055305 00000 n -0000055338 00000 n -0001850251 00000 n -0002493499 00000 n -0000055387 00000 n -0000055442 00000 n -0001850377 00000 n -0002493415 00000 n -0000055493 00000 n -0000055540 00000 n -0001853920 00000 n -0002493316 00000 n -0000055591 00000 n -0000055629 00000 n -0001854046 00000 n -0002493176 00000 n -0000055680 00000 n -0000055727 00000 n -0001857593 00000 n -0002493107 00000 n -0000055783 00000 n -0000055822 00000 n -0001857719 00000 n -0002492967 00000 n -0000055873 00000 n -0000055916 00000 n -0001857845 00000 n -0002492883 00000 n -0000055972 00000 n -0000056032 00000 n -0001857970 00000 n -0002492784 00000 n -0000056088 00000 n -0000056151 00000 n -0001861657 00000 n -0002492685 00000 n -0000056207 00000 n -0000056254 00000 n -0001861783 00000 n -0002492586 00000 n -0000056310 00000 n -0000056370 00000 n -0001865588 00000 n -0002492487 00000 n -0000056426 00000 n -0000056482 00000 n -0001865714 00000 n -0002492403 00000 n -0000056538 00000 n -0000056580 00000 n -0001865840 00000 n -0002492263 00000 n -0000056631 00000 n -0000056687 00000 n -0001865966 00000 n -0002492179 00000 n -0000056743 00000 n -0000056783 00000 n -0001869746 00000 n -0002492080 00000 n -0000056839 00000 n -0000056879 00000 n -0001869872 00000 n -0002491955 00000 n -0000056935 00000 n -0000056981 00000 n -0001872284 00000 n -0002491871 00000 n -0000057042 00000 n -0000057142 00000 n -0001872410 00000 n -0002491772 00000 n -0000057203 00000 n -0000057251 00000 n -0001876069 00000 n -0002491673 00000 n -0000057312 00000 n -0000057360 00000 n -0001876322 00000 n -0002491574 00000 n -0000057421 00000 n -0000057490 00000 n -0001878602 00000 n -0002491475 00000 n -0000057551 00000 n -0000057622 00000 n -0001880760 00000 n -0002491376 00000 n -0000057683 00000 n -0000057743 00000 n -0001887022 00000 n -0002491292 00000 n -0000057804 00000 n -0000057859 00000 n -0001893654 00000 n -0002491193 00000 n -0000057910 00000 n -0000057946 00000 n -0001893779 00000 n -0002491068 00000 n -0000057997 00000 n -0000058036 00000 n -0001895168 00000 n -0002490999 00000 n -0000058092 00000 n -0000058140 00000 n -0001898531 00000 n -0002490860 00000 n -0000058189 00000 n -0000058240 00000 n -0001898657 00000 n -0002490776 00000 n -0000058291 00000 n -0000058338 00000 n -0001898783 00000 n -0002490677 00000 n -0000058389 00000 n -0000058443 00000 n -0001902379 00000 n -0002490537 00000 n -0000058494 00000 n -0000058545 00000 n -0001902505 00000 n -0002490468 00000 n -0000058601 00000 n -0000058666 00000 n -0001906535 00000 n -0002490328 00000 n -0000058717 00000 n -0000058769 00000 n -0001911048 00000 n -0002490259 00000 n -0000058825 00000 n -0000058894 00000 n -0001912579 00000 n -0002490175 00000 n -0000058945 00000 n -0000058984 00000 n -0001915925 00000 n -0002490036 00000 n -0000059033 00000 n -0000059084 00000 n -0001916051 00000 n -0002489952 00000 n -0000059135 00000 n -0000059182 00000 n -0001916177 00000 n -0002489812 00000 n -0000059233 00000 n -0000059296 00000 n -0001920567 00000 n -0002489728 00000 n -0000059352 00000 n -0000059402 00000 n -0001920693 00000 n -0002489588 00000 n -0000059458 00000 n -0000059516 00000 n -0001925064 00000 n -0002489519 00000 n -0000059577 00000 n -0000059624 00000 n -0001925190 00000 n -0002489394 00000 n -0000059680 00000 n -0000059750 00000 n -0001929017 00000 n -0002489325 00000 n -0000059811 00000 n -0000059878 00000 n -0001933070 00000 n -0002489185 00000 n -0000059929 00000 n -0000059985 00000 n -0001933196 00000 n -0002489101 00000 n -0000060041 00000 n -0000060090 00000 n -0001936467 00000 n -0002489002 00000 n -0000060146 00000 n -0000060190 00000 n -0001936592 00000 n -0002488918 00000 n -0000060246 00000 n -0000060283 00000 n -0001936718 00000 n -0002488819 00000 n -0000060334 00000 n -0000060404 00000 n -0001939746 00000 n -0002488694 00000 n -0000060455 00000 n -0000060494 00000 n -0001939872 00000 n -0002488625 00000 n -0000060550 00000 n -0000060598 00000 n -0001942444 00000 n -0002488486 00000 n -0000060647 00000 n -0000060697 00000 n -0001942570 00000 n -0002488402 00000 n -0000060748 00000 n -0000060795 00000 n -0001942696 00000 n -0002488262 00000 n -0000060846 00000 n -0000060888 00000 n -0001942822 00000 n -0002488137 00000 n -0000060944 00000 n -0000061012 00000 n -0001945918 00000 n -0002488053 00000 n -0000061073 00000 n -0000061125 00000 n -0001946044 00000 n -0002487954 00000 n -0000061186 00000 n +0000051316 00000 n +0001734947 00000 n +0002603967 00000 n +0000051368 00000 n +0000051421 00000 n +0001735073 00000 n +0002603826 00000 n +0000051473 00000 n +0000051513 00000 n +0001735199 00000 n +0002603742 00000 n +0000051570 00000 n +0000051640 00000 n +0001735325 00000 n +0002603643 00000 n +0000051697 00000 n +0000051792 00000 n +0001767627 00000 n +0002603544 00000 n +0000051849 00000 n +0000051899 00000 n +0001767753 00000 n +0002603445 00000 n +0000051956 00000 n +0000052022 00000 n +0001771783 00000 n +0002603346 00000 n +0000052079 00000 n +0000052162 00000 n +0001771908 00000 n +0002603247 00000 n +0000052219 00000 n +0000052307 00000 n +0001772034 00000 n +0002603148 00000 n +0000052364 00000 n +0000052437 00000 n +0001772160 00000 n +0002603049 00000 n +0000052494 00000 n +0000052578 00000 n +0001772286 00000 n +0002602950 00000 n +0000052635 00000 n +0000052714 00000 n +0001775682 00000 n +0002602851 00000 n +0000052772 00000 n +0000052843 00000 n +0001775807 00000 n +0002602752 00000 n +0000052901 00000 n +0000052988 00000 n +0001775933 00000 n +0002602653 00000 n +0000053046 00000 n +0000053119 00000 n +0001776059 00000 n +0002602554 00000 n +0000053177 00000 n +0000053216 00000 n +0001776185 00000 n +0002602455 00000 n +0000053274 00000 n +0000053363 00000 n +0001780800 00000 n +0002602356 00000 n +0000053421 00000 n +0000053509 00000 n +0001780926 00000 n +0002602257 00000 n +0000053567 00000 n +0000053650 00000 n +0001784285 00000 n +0002602158 00000 n +0000053708 00000 n +0000053798 00000 n +0001784410 00000 n +0002602059 00000 n +0000053856 00000 n +0000053934 00000 n +0001784536 00000 n +0002601975 00000 n +0000053992 00000 n +0000054082 00000 n +0001784662 00000 n +0002601891 00000 n +0000054134 00000 n +0000054200 00000 n +0001917071 00000 n +0002601752 00000 n +0000054249 00000 n +0000054294 00000 n +0001917197 00000 n +0002601668 00000 n +0000054345 00000 n +0000054392 00000 n +0001917323 00000 n +0002601569 00000 n +0000054443 00000 n +0000054479 00000 n +0001920254 00000 n +0002601429 00000 n +0000054530 00000 n +0000054572 00000 n +0001920380 00000 n +0002601345 00000 n +0000054628 00000 n +0000054661 00000 n +0001920506 00000 n +0002601246 00000 n +0000054717 00000 n +0000054758 00000 n +0001920759 00000 n +0002601147 00000 n +0000054814 00000 n +0000054855 00000 n +0001923762 00000 n +0002601048 00000 n +0000054911 00000 n +0000054946 00000 n +0001927228 00000 n +0002600964 00000 n +0000055002 00000 n +0000055038 00000 n +0001927354 00000 n +0002600839 00000 n +0000055089 00000 n +0000055146 00000 n +0001927480 00000 n +0002600755 00000 n +0000055202 00000 n +0000055240 00000 n +0001927605 00000 n +0002600671 00000 n +0000055296 00000 n +0000055329 00000 n +0001930364 00000 n +0002600532 00000 n +0000055378 00000 n +0000055433 00000 n +0001930490 00000 n +0002600448 00000 n +0000055484 00000 n +0000055531 00000 n +0001933984 00000 n +0002600349 00000 n +0000055582 00000 n +0000055620 00000 n +0001934110 00000 n +0002600209 00000 n +0000055671 00000 n +0000055718 00000 n +0001937593 00000 n +0002600140 00000 n +0000055774 00000 n +0000055813 00000 n +0001937719 00000 n +0002600000 00000 n +0000055864 00000 n +0000055907 00000 n +0001937845 00000 n +0002599916 00000 n +0000055963 00000 n +0000056023 00000 n +0001937970 00000 n +0002599817 00000 n +0000056079 00000 n +0000056142 00000 n +0001941686 00000 n +0002599718 00000 n +0000056198 00000 n +0000056245 00000 n +0001941812 00000 n +0002599619 00000 n +0000056301 00000 n +0000056361 00000 n +0001945707 00000 n +0002599520 00000 n +0000056417 00000 n +0000056473 00000 n +0001945833 00000 n +0002599436 00000 n +0000056529 00000 n +0000056571 00000 n +0001950077 00000 n +0002599296 00000 n +0000056622 00000 n +0000056678 00000 n +0001950203 00000 n +0002599212 00000 n +0000056734 00000 n +0000056774 00000 n +0001950329 00000 n +0002599113 00000 n +0000056830 00000 n +0000056870 00000 n +0001950455 00000 n +0002598988 00000 n +0000056926 00000 n +0000056972 00000 n +0001953089 00000 n +0002598904 00000 n +0000057033 00000 n +0000057133 00000 n +0001956962 00000 n +0002598805 00000 n +0000057194 00000 n +0000057242 00000 n +0001957088 00000 n +0002598706 00000 n +0000057303 00000 n +0000057351 00000 n +0001960037 00000 n +0002598607 00000 n +0000057412 00000 n +0000057481 00000 n +0001960163 00000 n +0002598508 00000 n +0000057542 00000 n +0000057612 00000 n +0001962483 00000 n +0002598409 00000 n +0000057673 00000 n +0000057733 00000 n +0001968568 00000 n +0002598325 00000 n +0000057794 00000 n +0000057849 00000 n +0001977538 00000 n +0002598226 00000 n +0000057900 00000 n +0000057936 00000 n +0001977664 00000 n +0002598101 00000 n +0000057987 00000 n +0000058026 00000 n +0001977790 00000 n +0002598017 00000 n +0000058082 00000 n +0000058130 00000 n +0001977916 00000 n +0002597933 00000 n +0000058186 00000 n +0000058255 00000 n +0001982068 00000 n +0002597794 00000 n +0000058304 00000 n +0000058355 00000 n +0001982194 00000 n +0002597710 00000 n +0000058406 00000 n +0000058453 00000 n +0001982320 00000 n +0002597611 00000 n +0000058504 00000 n +0000058558 00000 n +0001986515 00000 n +0002597471 00000 n +0000058609 00000 n +0000058660 00000 n +0001986641 00000 n +0002597402 00000 n +0000058716 00000 n +0000058780 00000 n +0001989732 00000 n +0002597277 00000 n +0000058831 00000 n +0000058883 00000 n +0001994029 00000 n +0002597208 00000 n +0000058939 00000 n +0000059008 00000 n +0001997445 00000 n +0002597069 00000 n +0000059057 00000 n +0000059108 00000 n +0001997571 00000 n +0002596985 00000 n +0000059159 00000 n +0000059206 00000 n +0001997697 00000 n +0002596845 00000 n +0000059257 00000 n +0000059320 00000 n +0002001918 00000 n +0002596761 00000 n +0000059376 00000 n +0000059426 00000 n +0002006000 00000 n +0002596621 00000 n +0000059482 00000 n +0000059540 00000 n +0002006126 00000 n +0002596552 00000 n +0000059601 00000 n +0000059648 00000 n +0002006252 00000 n +0002596427 00000 n +0000059704 00000 n +0000059772 00000 n +0002010040 00000 n +0002596358 00000 n +0000059833 00000 n +0000059905 00000 n +0002013897 00000 n +0002596259 00000 n +0000059956 00000 n +0000060012 00000 n +0002017301 00000 n +0002596119 00000 n +0000060063 00000 n +0000060105 00000 n +0002017427 00000 n +0002596035 00000 n +0000060161 00000 n +0000060210 00000 n +0002017552 00000 n +0002595936 00000 n +0000060266 00000 n +0000060310 00000 n +0002017678 00000 n +0002595852 00000 n +0000060366 00000 n +0000060403 00000 n +0002017804 00000 n +0002595753 00000 n +0000060454 00000 n +0000060524 00000 n +0002021248 00000 n +0002595628 00000 n +0000060575 00000 n +0000060614 00000 n +0002021374 00000 n +0002595559 00000 n +0000060670 00000 n +0000060718 00000 n +0002024897 00000 n +0002595420 00000 n +0000060767 00000 n +0000060817 00000 n +0002025023 00000 n +0002595336 00000 n +0000060868 00000 n +0000060915 00000 n +0002025149 00000 n +0002595196 00000 n +0000060966 00000 n +0000061008 00000 n +0002025274 00000 n +0002595071 00000 n +0000061064 00000 n +0000061132 00000 n +0002028372 00000 n +0002594987 00000 n +0000061193 00000 n 0000061245 00000 n -0001948625 00000 n -0002487855 00000 n +0002028498 00000 n +0002594888 00000 n 0000061306 00000 n -0000061392 00000 n -0001948751 00000 n -0002487771 00000 n -0000061453 00000 n -0000061516 00000 n -0001952718 00000 n -0002487631 00000 n -0000061572 00000 n -0000061648 00000 n -0001952844 00000 n -0002487547 00000 n -0000061709 00000 n -0000061768 00000 n -0001960232 00000 n -0002487448 00000 n -0000061829 00000 n +0000061363 00000 n +0002031121 00000 n +0002594789 00000 n +0000061424 00000 n +0000061508 00000 n +0002031247 00000 n +0002594705 00000 n +0000061569 00000 n +0000061632 00000 n +0002035312 00000 n +0002594565 00000 n +0000061688 00000 n +0000061764 00000 n +0002035438 00000 n +0002594481 00000 n +0000061825 00000 n 0000061882 00000 n -0001960356 00000 n -0002487364 00000 n +0002042789 00000 n +0002594382 00000 n 0000061943 00000 n -0000062001 00000 n -0001968337 00000 n -0002487265 00000 n +0000061996 00000 n +0002042913 00000 n +0002594298 00000 n 0000062057 00000 n -0000062145 00000 n -0001968463 00000 n -0002487140 00000 n -0000062201 00000 n -0000062284 00000 n -0001971227 00000 n -0002487056 00000 n -0000062345 00000 n -0000062411 00000 n -0001971793 00000 n -0002486957 00000 n -0000062472 00000 n -0000062516 00000 n -0001971919 00000 n -0002486858 00000 n -0000062577 00000 n -0000062619 00000 n -0001975416 00000 n -0002486774 00000 n -0000062680 00000 n -0000062717 00000 n -0001975542 00000 n -0002486675 00000 n -0000062768 00000 n -0000062812 00000 n -0001975668 00000 n -0002486576 00000 n -0000062863 00000 n -0000062921 00000 n -0001979522 00000 n -0002486436 00000 n -0000062972 00000 n -0000063031 00000 n -0001979648 00000 n -0002486311 00000 n -0000063087 00000 n -0000063131 00000 n -0001979772 00000 n -0002486242 00000 n -0000063192 00000 n -0000063271 00000 n -0001983573 00000 n -0002486143 00000 n -0000063327 00000 n -0000063381 00000 n -0001987585 00000 n -0002486059 00000 n -0000063437 00000 n -0000063483 00000 n -0001998052 00000 n -0002485934 00000 n -0000063534 00000 n -0000063573 00000 n -0001998178 00000 n -0002485850 00000 n -0000063629 00000 n -0000063718 00000 n -0001998304 00000 n -0002485751 00000 n -0000063774 00000 n -0000063830 00000 n -0002001705 00000 n -0002485667 00000 n -0000063886 00000 n -0000063942 00000 n -0002007227 00000 n -0002485528 00000 n -0000063991 00000 n -0000064051 00000 n -0002007353 00000 n -0002485444 00000 n -0000064102 00000 n -0000064149 00000 n -0002011384 00000 n -0002485304 00000 n -0000064200 00000 n -0000064246 00000 n -0002011509 00000 n -0002485179 00000 n -0000064302 00000 n -0000064354 00000 n -0002015276 00000 n -0002485110 00000 n -0000064415 00000 n -0000064474 00000 n -0002027574 00000 n -0002484970 00000 n -0000064530 00000 n -0000064587 00000 n -0002030035 00000 n -0002484886 00000 n -0000064648 00000 n -0000064704 00000 n -0002030161 00000 n -0002484802 00000 n -0000064765 00000 n -0000064826 00000 n -0002035764 00000 n -0002484703 00000 n -0000064882 00000 n -0000064936 00000 n -0002035890 00000 n -0002484604 00000 n -0000064992 00000 n -0000065064 00000 n -0002040823 00000 n -0002484479 00000 n -0000065120 00000 n -0000065196 00000 n -0002043614 00000 n -0002484395 00000 n -0000065257 00000 n -0000065325 00000 n -0002043739 00000 n -0002484296 00000 n -0000065386 00000 n -0000065448 00000 n -0002045776 00000 n -0002484197 00000 n -0000065509 00000 n -0000065568 00000 n -0002045902 00000 n -0002484113 00000 n -0000065629 00000 n -0000065702 00000 n -0002046028 00000 n -0002483988 00000 n -0000065753 00000 n -0000065792 00000 n -0002046153 00000 n -0002483904 00000 n -0000065848 00000 n -0000065898 00000 n -0002048416 00000 n -0002483820 00000 n -0000065954 00000 n -0000066023 00000 n -0002052027 00000 n -0002483681 00000 n -0000066072 00000 n -0000066138 00000 n -0002052153 00000 n -0002483597 00000 n -0000066189 00000 n -0000066236 00000 n -0002052278 00000 n -0002483498 00000 n -0000066287 00000 n -0000066335 00000 n -0002055127 00000 n -0002483358 00000 n -0000066386 00000 n -0000066454 00000 n -0002055253 00000 n -0002483274 00000 n -0000066510 00000 n -0000066548 00000 n -0002058718 00000 n -0002483175 00000 n -0000066604 00000 n -0000066648 00000 n -0002058843 00000 n -0002483076 00000 n -0000066704 00000 n -0000066746 00000 n -0002061364 00000 n -0002482992 00000 n -0000066802 00000 n -0000066848 00000 n -0002065704 00000 n -0002482852 00000 n -0000066899 00000 n -0000066977 00000 n -0002069284 00000 n -0002482768 00000 n -0000067033 00000 n -0000067083 00000 n -0002069409 00000 n -0002482669 00000 n -0000067139 00000 n -0000067183 00000 n -0002074420 00000 n -0002482570 00000 n -0000067239 00000 n -0000067277 00000 n -0002074546 00000 n -0002482471 00000 n -0000067333 00000 n -0000067371 00000 n -0002074672 00000 n -0002482387 00000 n -0000067427 00000 n -0000067466 00000 n -0002077732 00000 n -0002482262 00000 n -0000067517 00000 n -0000067556 00000 n -0002077858 00000 n -0002482178 00000 n -0000067612 00000 n -0000067669 00000 n -0002077984 00000 n -0002482079 00000 n -0000067725 00000 n -0000067782 00000 n -0002078110 00000 n -0002481995 00000 n -0000067838 00000 n -0000067898 00000 n -0002083396 00000 n -0002481856 00000 n -0000067947 00000 n -0000067987 00000 n -0002083522 00000 n -0002481772 00000 n -0000068038 00000 n -0000068085 00000 n -0002083648 00000 n -0002481673 00000 n -0000068136 00000 n -0000068192 00000 n -0002087559 00000 n -0002481574 00000 n -0000068243 00000 n -0000068287 00000 n -0002087685 00000 n -0002481475 00000 n -0000068338 00000 n -0000068389 00000 n -0002087811 00000 n -0002481376 00000 n -0000068440 00000 n -0000068483 00000 n -0002089195 00000 n -0002481251 00000 n -0000068534 00000 n -0000068573 00000 n -0002089321 00000 n -0002481182 00000 n -0000068629 00000 n -0000068680 00000 n -0002090593 00000 n -0002481043 00000 n -0000068729 00000 n -0000068776 00000 n -0002090719 00000 n -0002480959 00000 n -0000068827 00000 n -0000068857 00000 n -0002090845 00000 n -0002480875 00000 n -0000068908 00000 n -0000068955 00000 n -0002091719 00000 n -0002480751 00000 n -0000069004 00000 n -0000069053 00000 n -0002091845 00000 n -0002480682 00000 n -0000069104 00000 n -0000069134 00000 n -0002092569 00000 n -0002480543 00000 n -0000069179 00000 n -0000069225 00000 n -0002095276 00000 n -0002480418 00000 n -0000069274 00000 n -0000069337 00000 n -0002095402 00000 n -0002480334 00000 n -0000069388 00000 n -0000069437 00000 n -0002098255 00000 n -0002480194 00000 n -0000069488 00000 n -0000069545 00000 n -0002098381 00000 n -0002480110 00000 n -0000069601 00000 n -0000069647 00000 n -0002100248 00000 n -0002480011 00000 n -0000069703 00000 n -0000069745 00000 n -0002103923 00000 n -0002479927 00000 n -0000069801 00000 n -0000069873 00000 n -0002108033 00000 n -0002479802 00000 n -0000069924 00000 n -0000069967 00000 n -0002108159 00000 n -0002479718 00000 n -0000070023 00000 n -0000070060 00000 n -0002108411 00000 n -0002479619 00000 n -0000070116 00000 n -0000070163 00000 n -0002108662 00000 n -0002479520 00000 n -0000070219 00000 n -0000070255 00000 n -0002112157 00000 n -0002479421 00000 n -0000070311 00000 n -0000070373 00000 n -0002112409 00000 n -0002479322 00000 n -0000070429 00000 n -0000070465 00000 n -0002112534 00000 n -0002479197 00000 n -0000070521 00000 n -0000070553 00000 n -0002112660 00000 n -0002479113 00000 n -0000070614 00000 n -0000070654 00000 n -0002115845 00000 n -0002479014 00000 n -0000070715 00000 n -0000070769 00000 n -0002117317 00000 n -0002478930 00000 n -0000070830 00000 n -0000070878 00000 n -0002119891 00000 n -0002478790 00000 n -0000070927 00000 n -0000070988 00000 n -0002120017 00000 n -0002478665 00000 n -0000071039 00000 n -0000071093 00000 n -0002120143 00000 n -0002478540 00000 n -0000071149 00000 n -0000071187 00000 n -0002126989 00000 n -0002478456 00000 n -0000071248 00000 n -0000071291 00000 n -0002127115 00000 n -0002478357 00000 n -0000071352 00000 n -0000071415 00000 n -0002130322 00000 n -0002478258 00000 n -0000071476 00000 n -0000071519 00000 n -0002130448 00000 n -0002478159 00000 n -0000071580 00000 n -0000071636 00000 n -0002130574 00000 n -0002478075 00000 n -0000071697 00000 n -0000071750 00000 n -0002130700 00000 n -0002477991 00000 n -0000071806 00000 n -0000071860 00000 n -0002134086 00000 n -0002477866 00000 n -0000071911 00000 n -0000071954 00000 n -0002134338 00000 n -0002477782 00000 n -0000072010 00000 n -0000072058 00000 n -0002138111 00000 n -0002477698 00000 n -0000072114 00000 n -0000072172 00000 n -0002143362 00000 n -0002477573 00000 n +0000062115 00000 n +0002050679 00000 n +0002594199 00000 n +0000062171 00000 n +0000062259 00000 n +0002050805 00000 n +0002594074 00000 n +0000062315 00000 n +0000062398 00000 n +0002053496 00000 n +0002593990 00000 n +0000062459 00000 n +0000062525 00000 n +0002054063 00000 n +0002593891 00000 n +0000062586 00000 n +0000062630 00000 n +0002054189 00000 n +0002593792 00000 n +0000062691 00000 n +0000062733 00000 n +0002057907 00000 n +0002593708 00000 n +0000062794 00000 n +0000062831 00000 n +0002058033 00000 n +0002593609 00000 n +0000062882 00000 n +0000062926 00000 n +0002058159 00000 n +0002593510 00000 n +0000062977 00000 n +0000063039 00000 n +0002061695 00000 n +0002593370 00000 n +0000063090 00000 n +0000063149 00000 n +0002061820 00000 n +0002593245 00000 n +0000063205 00000 n +0000063249 00000 n +0002061946 00000 n +0002593176 00000 n +0000063310 00000 n +0000063380 00000 n +0002065760 00000 n +0002593077 00000 n +0000063436 00000 n +0000063490 00000 n +0002072701 00000 n +0002592993 00000 n +0000063546 00000 n +0000063592 00000 n +0002079179 00000 n +0002592868 00000 n +0000063643 00000 n +0000063682 00000 n +0002079304 00000 n +0002592784 00000 n +0000063738 00000 n +0000063820 00000 n +0002082460 00000 n +0002592685 00000 n +0000063876 00000 n +0000063931 00000 n +0002085311 00000 n +0002592601 00000 n +0000063987 00000 n +0000064043 00000 n +0002088664 00000 n +0002592462 00000 n +0000064092 00000 n +0000064152 00000 n +0002088790 00000 n +0002592378 00000 n +0000064203 00000 n +0000064250 00000 n +0002092433 00000 n +0002592238 00000 n +0000064301 00000 n +0000064347 00000 n +0002096064 00000 n +0002592113 00000 n +0000064403 00000 n +0000064455 00000 n +0002096190 00000 n +0002592044 00000 n +0000064516 00000 n +0000064575 00000 n +0002109476 00000 n +0002591904 00000 n +0000064631 00000 n +0000064688 00000 n +0002109602 00000 n +0002591820 00000 n +0000064749 00000 n +0000064805 00000 n +0002109728 00000 n +0002591736 00000 n +0000064866 00000 n +0000064927 00000 n +0002115732 00000 n +0002591637 00000 n +0000064983 00000 n +0000065037 00000 n +0002115858 00000 n +0002591538 00000 n +0000065093 00000 n +0000065165 00000 n +0002119914 00000 n +0002591413 00000 n +0000065221 00000 n +0000065297 00000 n +0002120040 00000 n +0002591329 00000 n +0000065358 00000 n +0000065426 00000 n +0002123182 00000 n +0002591230 00000 n +0000065487 00000 n +0000065549 00000 n +0002125218 00000 n +0002591131 00000 n +0000065610 00000 n +0000065669 00000 n +0002125344 00000 n +0002591047 00000 n +0000065730 00000 n +0000065803 00000 n +0002125470 00000 n +0002590922 00000 n +0000065854 00000 n +0000065893 00000 n +0002125595 00000 n +0002590838 00000 n +0000065949 00000 n +0000065999 00000 n +0002127917 00000 n +0002590754 00000 n +0000066055 00000 n +0000066124 00000 n +0002131545 00000 n +0002590615 00000 n +0000066173 00000 n +0000066239 00000 n +0002131671 00000 n +0002590531 00000 n +0000066290 00000 n +0000066337 00000 n +0002131797 00000 n +0002590432 00000 n +0000066388 00000 n +0000066436 00000 n +0002134538 00000 n +0002590292 00000 n +0000066487 00000 n +0000066555 00000 n +0002134663 00000 n +0002590208 00000 n +0000066611 00000 n +0000066649 00000 n +0002138165 00000 n +0002590109 00000 n +0000066705 00000 n +0000066749 00000 n +0002138291 00000 n +0002590010 00000 n +0000066805 00000 n +0000066847 00000 n +0002140872 00000 n +0002589926 00000 n +0000066903 00000 n +0000066949 00000 n +0002145342 00000 n +0002589786 00000 n +0000067000 00000 n +0000067078 00000 n +0002148924 00000 n +0002589702 00000 n +0000067134 00000 n +0000067184 00000 n +0002149049 00000 n +0002589603 00000 n +0000067240 00000 n +0000067284 00000 n +0002153896 00000 n +0002589504 00000 n +0000067340 00000 n +0000067378 00000 n +0002154022 00000 n +0002589405 00000 n +0000067434 00000 n +0000067472 00000 n +0002154147 00000 n +0002589321 00000 n +0000067528 00000 n +0000067567 00000 n +0002156906 00000 n +0002589196 00000 n +0000067618 00000 n +0000067657 00000 n +0002157032 00000 n +0002589112 00000 n +0000067713 00000 n +0000067770 00000 n +0002157158 00000 n +0002589013 00000 n +0000067826 00000 n +0000067883 00000 n +0002159353 00000 n +0002588929 00000 n +0000067939 00000 n +0000067999 00000 n +0002162787 00000 n +0002588790 00000 n +0000068048 00000 n +0000068088 00000 n +0002162913 00000 n +0002588706 00000 n +0000068139 00000 n +0000068186 00000 n +0002163039 00000 n +0002588607 00000 n +0000068237 00000 n +0000068293 00000 n +0002166508 00000 n +0002588508 00000 n +0000068344 00000 n +0000068388 00000 n +0002166634 00000 n +0002588409 00000 n +0000068439 00000 n +0000068490 00000 n +0002166760 00000 n +0002588310 00000 n +0000068541 00000 n +0000068584 00000 n +0002168209 00000 n +0002588185 00000 n +0000068635 00000 n +0000068674 00000 n +0002168335 00000 n +0002588116 00000 n +0000068730 00000 n +0000068781 00000 n +0002169608 00000 n +0002587977 00000 n +0000068830 00000 n +0000068877 00000 n +0002169734 00000 n +0002587893 00000 n +0000068928 00000 n +0000068958 00000 n +0002169860 00000 n +0002587809 00000 n +0000069009 00000 n +0000069056 00000 n +0002170708 00000 n +0002587685 00000 n +0000069105 00000 n +0000069154 00000 n +0002170834 00000 n +0002587616 00000 n +0000069205 00000 n +0000069235 00000 n +0002171543 00000 n +0002587477 00000 n +0000069280 00000 n +0000069326 00000 n +0002174659 00000 n +0002587352 00000 n +0000069375 00000 n +0000069438 00000 n +0002174785 00000 n +0002587268 00000 n +0000069489 00000 n +0000069536 00000 n +0002174910 00000 n +0002587169 00000 n +0000069587 00000 n +0000069636 00000 n +0002178400 00000 n +0002587029 00000 n +0000069687 00000 n +0000069744 00000 n +0002178526 00000 n +0002586945 00000 n +0000069800 00000 n +0000069846 00000 n +0002179930 00000 n +0002586846 00000 n +0000069902 00000 n +0000069944 00000 n +0002184175 00000 n +0002586762 00000 n +0000070000 00000 n +0000070072 00000 n +0002184299 00000 n +0002586637 00000 n +0000070123 00000 n +0000070166 00000 n +0002184424 00000 n +0002586553 00000 n +0000070222 00000 n +0000070259 00000 n +0002188249 00000 n +0002586454 00000 n +0000070315 00000 n +0000070362 00000 n +0002188501 00000 n +0002586355 00000 n +0000070418 00000 n +0000070454 00000 n +0002188627 00000 n +0002586256 00000 n +0000070510 00000 n +0000070572 00000 n +0002192018 00000 n +0002586131 00000 n +0000070628 00000 n +0000070660 00000 n +0002192144 00000 n +0002586047 00000 n +0000070721 00000 n +0000070761 00000 n +0002194986 00000 n +0002585948 00000 n +0000070822 00000 n +0000070876 00000 n +0002195112 00000 n +0002585864 00000 n +0000070937 00000 n +0000070985 00000 n +0002198463 00000 n +0002585724 00000 n +0000071034 00000 n +0000071095 00000 n +0002198589 00000 n +0002585599 00000 n +0000071146 00000 n +0000071200 00000 n +0002198715 00000 n +0002585474 00000 n +0000071256 00000 n +0000071294 00000 n +0002205137 00000 n +0002585390 00000 n +0000071355 00000 n +0000071398 00000 n +0002205263 00000 n +0002585291 00000 n +0000071459 00000 n +0000071522 00000 n +0002208408 00000 n +0002585192 00000 n +0000071583 00000 n +0000071626 00000 n +0002208534 00000 n +0002585093 00000 n +0000071687 00000 n +0000071743 00000 n +0002208660 00000 n +0002585009 00000 n +0000071804 00000 n +0000071857 00000 n +0002208786 00000 n +0002584925 00000 n +0000071913 00000 n +0000071967 00000 n +0002212063 00000 n +0002584800 00000 n +0000072018 00000 n +0000072061 00000 n +0002215149 00000 n +0002584716 00000 n +0000072117 00000 n +0000072165 00000 n +0002215402 00000 n +0002584632 00000 n 0000072221 00000 n -0000072285 00000 n -0002143488 00000 n -0002477462 00000 n -0000072336 00000 n -0000072383 00000 n -0002143614 00000 n -0002477378 00000 n -0000072439 00000 n -0000072488 00000 n -0002146522 00000 n -0002477279 00000 n -0000072544 00000 n -0000072597 00000 n -0002150102 00000 n -0002477180 00000 n -0000072653 00000 n -0000072699 00000 n -0002150227 00000 n -0002477081 00000 n -0000072755 00000 n -0000072798 00000 n -0002153507 00000 n -0002476982 00000 n -0000072854 00000 n -0000072896 00000 n -0002153633 00000 n -0002476883 00000 n -0000072952 00000 n -0000072997 00000 n -0002153757 00000 n -0002476784 00000 n -0000073053 00000 n -0000073096 00000 n -0002156761 00000 n -0002476685 00000 n -0000073152 00000 n -0000073195 00000 n -0002156887 00000 n -0002476586 00000 n -0000073251 00000 n -0000073292 00000 n -0002157013 00000 n -0002476502 00000 n -0000073349 00000 n -0000073402 00000 n -0002157754 00000 n -0002476362 00000 n -0000073447 00000 n +0000072279 00000 n +0002222992 00000 n +0002584507 00000 n +0000072328 00000 n +0000072394 00000 n +0002223118 00000 n +0002584423 00000 n +0000072445 00000 n +0000072492 00000 n +0002226161 00000 n +0002584283 00000 n +0000072543 00000 n +0000072598 00000 n +0002226287 00000 n +0002584158 00000 n +0000072654 00000 n +0000072708 00000 n +0002226413 00000 n +0002584074 00000 n +0000072769 00000 n +0000072821 00000 n +0002228670 00000 n +0002583990 00000 n +0000072882 00000 n +0000072943 00000 n +0002230576 00000 n +0002583891 00000 n +0000072999 00000 n +0000073048 00000 n +0002233413 00000 n +0002583792 00000 n +0000073104 00000 n +0000073157 00000 n +0002236673 00000 n +0002583708 00000 n +0000073213 00000 n +0000073283 00000 n +0002240007 00000 n +0002583583 00000 n +0000073334 00000 n +0000073383 00000 n +0002240133 00000 n +0002583499 00000 n +0000073439 00000 n 0000073485 00000 n -0002160230 00000 n -0002476237 00000 n -0000073534 00000 n -0000073577 00000 n -0002160356 00000 n -0002476153 00000 n -0000073628 00000 n -0000073666 00000 n -0002160482 00000 n -0002476054 00000 n -0000073717 00000 n -0000073754 00000 n -0002163909 00000 n -0002475970 00000 n -0000073805 00000 n -0000073840 00000 n -0002181766 00000 n -0002475830 00000 n -0000073889 00000 n -0000073949 00000 n -0002181892 00000 n -0002475705 00000 n -0000074000 00000 n -0000074043 00000 n -0002182018 00000 n -0002475621 00000 n -0000074099 00000 n -0000074154 00000 n -0002182144 00000 n -0002475522 00000 n -0000074210 00000 n -0000074245 00000 n -0002185563 00000 n -0002475423 00000 n -0000074301 00000 n -0000074337 00000 n -0002185689 00000 n -0002475298 00000 n -0000074393 00000 n -0000074448 00000 n -0002185814 00000 n -0002475214 00000 n -0000074509 00000 n -0000074588 00000 n -0002190181 00000 n -0002475130 00000 n -0000074649 00000 n -0000074728 00000 n -0002190307 00000 n -0002475031 00000 n -0000074779 00000 n -0000074816 00000 n -0002190433 00000 n -0002474932 00000 n -0000074867 00000 n -0000074928 00000 n -0002193968 00000 n -0002474848 00000 n -0000074979 00000 n -0000075037 00000 n -0002197423 00000 n -0002474723 00000 n -0000075086 00000 n -0000075124 00000 n -0002197549 00000 n -0002474639 00000 n -0000075175 00000 n -0000075213 00000 n -0002197675 00000 n -0002474540 00000 n -0000075264 00000 n -0000075302 00000 n -0002197801 00000 n -0002474441 00000 n -0000075353 00000 n -0000075391 00000 n -0002201125 00000 n -0002474342 00000 n -0000075442 00000 n -0000075483 00000 n -0002202835 00000 n -0002474243 00000 n -0000075534 00000 n -0000075590 00000 n -0002202961 00000 n -0002474159 00000 n -0000075641 00000 n -0000075674 00000 n -0002203691 00000 n -0002474034 00000 n -0000075719 00000 n -0000075753 00000 n -0002207009 00000 n -0002473909 00000 n -0000075802 00000 n -0000075846 00000 n -0002207135 00000 n -0002473784 00000 n -0000075897 00000 n -0000075955 00000 n -0002207261 00000 n -0002473700 00000 n -0000076011 00000 n -0000076051 00000 n -0002207387 00000 n -0002473575 00000 n -0000076107 00000 n -0000076158 00000 n -0002207513 00000 n -0002473491 00000 n -0000076219 00000 n -0000076266 00000 n -0002207639 00000 n -0002473407 00000 n -0000076327 00000 n -0000076371 00000 n -0002212440 00000 n -0002473308 00000 n -0000076422 00000 n -0000076493 00000 n -0002214660 00000 n -0002473209 00000 n -0000076544 00000 n -0000076601 00000 n -0002214786 00000 n -0002473069 00000 n -0000076652 00000 n -0000076699 00000 n -0002216962 00000 n -0002472959 00000 n -0000076755 00000 n -0000076828 00000 n -0002217088 00000 n -0002472875 00000 n -0000076889 00000 n -0000076962 00000 n -0002219695 00000 n -0002472791 00000 n -0000077023 00000 n -0000077096 00000 n -0002219821 00000 n -0002472666 00000 n -0000077147 00000 n -0000077199 00000 n -0002219947 00000 n -0002472582 00000 n -0000077255 00000 n -0000077307 00000 n -0002223871 00000 n -0002472498 00000 n -0000077363 00000 n -0000077427 00000 n -0002226904 00000 n -0002472358 00000 n -0000077476 00000 n -0000077511 00000 n -0002227030 00000 n -0002472274 00000 n -0000077562 00000 n -0000077592 00000 n -0002227156 00000 n -0002472175 00000 n -0000077643 00000 n -0000077677 00000 n -0002227281 00000 n -0002472076 00000 n -0000077728 00000 n -0000077758 00000 n -0002231016 00000 n -0002471977 00000 n -0000077809 00000 n -0000077860 00000 n -0002231142 00000 n -0002471837 00000 n -0000077911 00000 n -0000077940 00000 n -0002231268 00000 n -0002471768 00000 n -0000077996 00000 n -0000078045 00000 n -0002231394 00000 n -0002471643 00000 n -0000078096 00000 n -0000078129 00000 n -0002231520 00000 n -0002471559 00000 n -0000078185 00000 n -0000078233 00000 n -0002233057 00000 n -0002471475 00000 n -0000078289 00000 n -0000078337 00000 n -0002236838 00000 n -0002471335 00000 n -0000078386 00000 n -0000078438 00000 n -0002236964 00000 n -0002471251 00000 n -0000078489 00000 n -0000078533 00000 n -0002237089 00000 n -0002471111 00000 n -0000078584 00000 n -0000078620 00000 n -0002237215 00000 n -0002471027 00000 n -0000078676 00000 n -0000078770 00000 n -0002241003 00000 n -0002470928 00000 n -0000078826 00000 n -0000078925 00000 n -0002241129 00000 n -0002470844 00000 n -0000078981 00000 n -0000079054 00000 n -0002244318 00000 n -0002470704 00000 n -0000079105 00000 n -0000079153 00000 n -0002244444 00000 n -0002470620 00000 n -0000079209 00000 n -0000079271 00000 n -0002244569 00000 n -0002470521 00000 n -0000079327 00000 n -0000079394 00000 n -0002244694 00000 n -0002470422 00000 n -0000079450 00000 n +0002240259 00000 n +0002583400 00000 n +0000073541 00000 n +0000073584 00000 n +0002243424 00000 n +0002583301 00000 n +0000073640 00000 n +0000073682 00000 n +0002243550 00000 n +0002583202 00000 n +0000073738 00000 n +0000073783 00000 n +0002243676 00000 n +0002583103 00000 n +0000073839 00000 n +0000073882 00000 n +0002246093 00000 n +0002583004 00000 n +0000073938 00000 n +0000073981 00000 n +0002246219 00000 n +0002582905 00000 n +0000074037 00000 n +0000074078 00000 n +0002246345 00000 n +0002582821 00000 n +0000074134 00000 n +0000074186 00000 n +0002247088 00000 n +0002582681 00000 n +0000074231 00000 n +0000074269 00000 n +0002249918 00000 n +0002582556 00000 n +0000074318 00000 n +0000074361 00000 n +0002250044 00000 n +0002582472 00000 n +0000074412 00000 n +0000074450 00000 n +0002250170 00000 n +0002582373 00000 n +0000074501 00000 n +0000074538 00000 n +0002254002 00000 n +0002582289 00000 n +0000074589 00000 n +0000074624 00000 n +0002274135 00000 n +0002582149 00000 n +0000074673 00000 n +0000074733 00000 n +0002274261 00000 n +0002582024 00000 n +0000074784 00000 n +0000074827 00000 n +0002274387 00000 n +0002581940 00000 n +0000074883 00000 n +0000074938 00000 n +0002274513 00000 n +0002581841 00000 n +0000074994 00000 n +0000075029 00000 n +0002277921 00000 n +0002581742 00000 n +0000075085 00000 n +0000075121 00000 n +0002278301 00000 n +0002581617 00000 n +0000075177 00000 n +0000075232 00000 n +0002278427 00000 n +0002581533 00000 n +0000075293 00000 n +0000075370 00000 n +0002282773 00000 n +0002581449 00000 n +0000075431 00000 n +0000075504 00000 n +0002282896 00000 n +0002581350 00000 n +0000075555 00000 n +0000075592 00000 n +0002283022 00000 n +0002581251 00000 n +0000075643 00000 n +0000075694 00000 n +0002286528 00000 n +0002581167 00000 n +0000075745 00000 n +0000075803 00000 n +0002289987 00000 n +0002581042 00000 n +0000075852 00000 n +0000075890 00000 n +0002290113 00000 n +0002580958 00000 n +0000075941 00000 n +0000075979 00000 n +0002290239 00000 n +0002580859 00000 n +0000076030 00000 n +0000076075 00000 n +0002290365 00000 n +0002580760 00000 n +0000076126 00000 n +0000076164 00000 n +0002293873 00000 n +0002580661 00000 n +0000076215 00000 n +0000076256 00000 n +0002295638 00000 n +0002580562 00000 n +0000076307 00000 n +0000076363 00000 n +0002295764 00000 n +0002580478 00000 n +0000076414 00000 n +0000076447 00000 n +0002296511 00000 n +0002580353 00000 n +0000076492 00000 n +0000076526 00000 n +0002299705 00000 n +0002580228 00000 n +0000076575 00000 n +0000076619 00000 n +0002299831 00000 n +0002580103 00000 n +0000076670 00000 n +0000076728 00000 n +0002299957 00000 n +0002580019 00000 n +0000076784 00000 n +0000076824 00000 n +0002300083 00000 n +0002579894 00000 n +0000076880 00000 n +0000076931 00000 n +0002300209 00000 n +0002579810 00000 n +0000076992 00000 n +0000077039 00000 n +0002300335 00000 n +0002579726 00000 n +0000077100 00000 n +0000077144 00000 n +0002305549 00000 n +0002579627 00000 n +0000077195 00000 n +0000077266 00000 n +0002305675 00000 n +0002579528 00000 n +0000077317 00000 n +0000077374 00000 n +0002307686 00000 n +0002579388 00000 n +0000077425 00000 n +0000077472 00000 n +0002309841 00000 n +0002579278 00000 n +0000077528 00000 n +0000077601 00000 n +0002309967 00000 n +0002579194 00000 n +0000077662 00000 n +0000077735 00000 n +0002312661 00000 n +0002579095 00000 n +0000077796 00000 n +0000077876 00000 n +0002312787 00000 n +0002579011 00000 n +0000077937 00000 n +0000077998 00000 n +0002312913 00000 n +0002578886 00000 n +0000078049 00000 n +0000078101 00000 n +0002315302 00000 n +0002578802 00000 n +0000078157 00000 n +0000078209 00000 n +0002317411 00000 n +0002578718 00000 n +0000078265 00000 n +0000078331 00000 n +0002320773 00000 n +0002578578 00000 n +0000078380 00000 n +0000078415 00000 n +0002320899 00000 n +0002578494 00000 n +0000078466 00000 n +0000078496 00000 n +0002321025 00000 n +0002578395 00000 n +0000078547 00000 n +0000078581 00000 n +0002322781 00000 n +0002578296 00000 n +0000078632 00000 n +0000078662 00000 n +0002324652 00000 n +0002578197 00000 n +0000078713 00000 n +0000078752 00000 n +0002324778 00000 n +0002578057 00000 n +0000078803 00000 n +0000078832 00000 n +0002324904 00000 n +0002577988 00000 n +0000078888 00000 n +0000078937 00000 n +0002326906 00000 n +0002577863 00000 n +0000078988 00000 n +0000079021 00000 n +0002327032 00000 n +0002577779 00000 n +0000079077 00000 n +0000079125 00000 n +0002327158 00000 n +0002577695 00000 n +0000079181 00000 n +0000079229 00000 n +0002331071 00000 n +0002577555 00000 n +0000079278 00000 n +0000079330 00000 n +0002331197 00000 n +0002577471 00000 n +0000079381 00000 n +0000079424 00000 n +0002331322 00000 n +0002577331 00000 n +0000079475 00000 n 0000079511 00000 n -0002244820 00000 n -0002470323 00000 n +0002331448 00000 n +0002577247 00000 n 0000079567 00000 n -0000079621 00000 n -0002244946 00000 n -0002470224 00000 n -0000079677 00000 n -0000079735 00000 n -0002248258 00000 n -0002470140 00000 n -0000079791 00000 n -0000079836 00000 n -0002248384 00000 n -0002470000 00000 n -0000079887 00000 n -0000079928 00000 n -0002248510 00000 n -0002469931 00000 n -0000079984 00000 n -0000080029 00000 n -0002248636 00000 n -0002469832 00000 n -0000080080 00000 n -0000080133 00000 n -0002251366 00000 n -0002469748 00000 n -0000080184 00000 n -0000080224 00000 n -0002254271 00000 n -0002469607 00000 n -0000080273 00000 n -0000080321 00000 n -0002254397 00000 n -0002469523 00000 n -0000080372 00000 n -0000080409 00000 n -0002254523 00000 n -0002469424 00000 n -0000080460 00000 n -0000080500 00000 n -0002257573 00000 n -0002469325 00000 n -0000080551 00000 n -0000080586 00000 n -0002257699 00000 n -0002469226 00000 n -0000080637 00000 n -0000080671 00000 n -0002257825 00000 n -0002469127 00000 n -0000080722 00000 n -0000080757 00000 n -0002257951 00000 n -0002469028 00000 n -0000080808 00000 n -0000080842 00000 n -0002261270 00000 n -0002468929 00000 n -0000080893 00000 n -0000080928 00000 n -0002261396 00000 n -0002468830 00000 n -0000080979 00000 n -0000081016 00000 n -0002261522 00000 n -0002468731 00000 n +0000079639 00000 n +0002335012 00000 n +0002577148 00000 n +0000079695 00000 n +0000079757 00000 n +0002335138 00000 n +0002577064 00000 n +0000079813 00000 n +0000079881 00000 n +0002338461 00000 n +0002576924 00000 n +0000079932 00000 n +0000079980 00000 n +0002338587 00000 n +0002576840 00000 n +0000080036 00000 n +0000080098 00000 n +0002338712 00000 n +0002576741 00000 n +0000080154 00000 n +0000080221 00000 n +0002338837 00000 n +0002576642 00000 n +0000080277 00000 n +0000080357 00000 n +0002338962 00000 n +0002576543 00000 n +0000080413 00000 n +0000080466 00000 n +0002339088 00000 n +0002576444 00000 n +0000080522 00000 n +0000080580 00000 n +0002342297 00000 n +0002576360 00000 n +0000080636 00000 n +0000080681 00000 n +0002342423 00000 n +0002576220 00000 n +0000080732 00000 n +0000080771 00000 n +0002342549 00000 n +0002576151 00000 n +0000080827 00000 n +0000080872 00000 n +0002342675 00000 n +0002576052 00000 n +0000080923 00000 n +0000080976 00000 n +0002345710 00000 n +0002575968 00000 n +0000081027 00000 n 0000081067 00000 n -0000081106 00000 n -0002261646 00000 n -0002468632 00000 n -0000081158 00000 n -0000081230 00000 n -0002261772 00000 n -0002468548 00000 n -0000081282 00000 n -0000081326 00000 n -0002264068 00000 n -0002468408 00000 n -0000081375 00000 n -0000081431 00000 n -0002264194 00000 n -0002468339 00000 n -0000081482 00000 n -0000081512 00000 n -0002271108 00000 n -0002468214 00000 n -0000081561 00000 n -0000081602 00000 n -0002271234 00000 n -0002468130 00000 n -0000081653 00000 n -0000081687 00000 n -0002274202 00000 n -0002468046 00000 n -0000081738 00000 n -0000081794 00000 n -0000082165 00000 n -0000082414 00000 n -0000081848 00000 n -0000082288 00000 n -0000082351 00000 n -0002455763 00000 n -0002441007 00000 n -0002455595 00000 n -0002440598 00000 n -0002436953 00000 n -0002440433 00000 n -0002456717 00000 n -0000084948 00000 n -0000084034 00000 n -0000082502 00000 n -0000084885 00000 n -0002435908 00000 n -0002417093 00000 n -0002435743 00000 n -0000084205 00000 n -0002416071 00000 n -0002399278 00000 n -0002415905 00000 n -0000084374 00000 n -0000084546 00000 n -0000084714 00000 n -0000086093 00000 n -0000085640 00000 n -0000085036 00000 n -0000085967 00000 n -0000086030 00000 n -0000085784 00000 n -0000091728 00000 n -0000088002 00000 n -0000086195 00000 n -0000091602 00000 n -0000091665 00000 n -0000088317 00000 n -0002397800 00000 n -0002395858 00000 n -0002397634 00000 n -0002393956 00000 n -0002391943 00000 n -0002393791 00000 n -0000088467 00000 n -0000088639 00000 n -0000088789 00000 n -0000088961 00000 n -0000089133 00000 n -0000089302 00000 n -0000089453 00000 n -0000089622 00000 n -0000089775 00000 n -0000089947 00000 n -0000090119 00000 n -0000090288 00000 n -0000090439 00000 n -0000090607 00000 n -0000090778 00000 n -0000090951 00000 n -0000091102 00000 n -0000091271 00000 n -0000091450 00000 n -0000307681 00000 n -0000323258 00000 n -0000334028 00000 n -0000338066 00000 n -0000371067 00000 n -0000454214 00000 n -0000478363 00000 n -0000098563 00000 n -0000093980 00000 n -0000091844 00000 n -0000098500 00000 n -0000094340 00000 n -0000094508 00000 n -0000094677 00000 n -0000094848 00000 n -0000095020 00000 n -0000095192 00000 n -0000095351 00000 n -0000095520 00000 n -0000095674 00000 n -0000095843 00000 n -0000096000 00000 n -0000096169 00000 n -0000096341 00000 n -0000096489 00000 n -0000096660 00000 n -0000096831 00000 n -0000097000 00000 n -0000097169 00000 n -0000097340 00000 n -0000097495 00000 n -0000097666 00000 n -0000097835 00000 n -0000097992 00000 n -0000098161 00000 n -0000098330 00000 n -0000520186 00000 n -0000529061 00000 n -0000533161 00000 n -0000623537 00000 n -0000701753 00000 n -0000724860 00000 n -0000105554 00000 n -0000100986 00000 n -0000098665 00000 n -0000105491 00000 n -0000101346 00000 n -0000101494 00000 n -0000101663 00000 n -0000101835 00000 n -0000102004 00000 n -0000102178 00000 n -0000102335 00000 n -0000102507 00000 n -0000102675 00000 n -0000102835 00000 n -0000103004 00000 n -0000103175 00000 n -0000103347 00000 n -0000103524 00000 n -0000103671 00000 n -0000103840 00000 n -0000103990 00000 n -0000104162 00000 n -0000104333 00000 n -0000104489 00000 n -0000104659 00000 n -0000104832 00000 n -0000105004 00000 n -0000105150 00000 n -0000105322 00000 n -0000790315 00000 n -0000841399 00000 n -0000857002 00000 n -0000884497 00000 n -0000890323 00000 n -0001050474 00000 n -0001837162 00000 n -0000112031 00000 n -0000107865 00000 n -0000105656 00000 n -0000111968 00000 n -0000108207 00000 n -0000108375 00000 n -0000108544 00000 n -0000108697 00000 n -0000108866 00000 n -0000109019 00000 n -0000109188 00000 n -0000109334 00000 n -0000109503 00000 n -0000109680 00000 n -0000109844 00000 n -0000110012 00000 n -0000110162 00000 n -0000110334 00000 n -0000110510 00000 n -0000110659 00000 n -0000110828 00000 n -0000110976 00000 n -0000111145 00000 n -0000111304 00000 n -0000111476 00000 n -0000111645 00000 n -0000111816 00000 n -0002456842 00000 n -0001898594 00000 n -0001915988 00000 n -0001942507 00000 n -0002007290 00000 n -0002052090 00000 n -0002083459 00000 n -0002090656 00000 n -0002091782 00000 n -0002095339 00000 n -0002119954 00000 n -0000118954 00000 n -0000114250 00000 n -0000112133 00000 n -0000118891 00000 n -0000114619 00000 n -0000114787 00000 n -0000114934 00000 n -0000115103 00000 n -0000115255 00000 n -0000115427 00000 n -0000115599 00000 n -0000115750 00000 n -0000115921 00000 n -0000116093 00000 n -0000116266 00000 n -0000116418 00000 n -0000116590 00000 n -0000116762 00000 n -0000116913 00000 n -0000117085 00000 n -0000117257 00000 n -0000117410 00000 n -0000117582 00000 n -0000117737 00000 n -0000117907 00000 n -0000118078 00000 n -0000118226 00000 n -0000118403 00000 n -0000118575 00000 n -0000118744 00000 n -0002143425 00000 n -0002160293 00000 n -0002181829 00000 n -0002197486 00000 n -0002207072 00000 n -0002226967 00000 n -0002236901 00000 n -0002254334 00000 n -0002264131 00000 n -0000120364 00000 n -0000119639 00000 n -0000119056 00000 n -0000120301 00000 n -0000119801 00000 n -0000119969 00000 n -0000120129 00000 n -0002271171 00000 n -0000129281 00000 n -0000123232 00000 n -0000120466 00000 n -0000129155 00000 n -0000129218 00000 n -0000123682 00000 n -0000123832 00000 n -0000123985 00000 n -0000124139 00000 n -0000124294 00000 n -0000124449 00000 n -0000124603 00000 n -0000124757 00000 n -0000124912 00000 n -0000125065 00000 n -0000125220 00000 n -0000125375 00000 n -0000125535 00000 n -0000125700 00000 n +0002348706 00000 n +0002575827 00000 n +0000081116 00000 n +0000081164 00000 n +0002348832 00000 n +0002575743 00000 n +0000081215 00000 n +0000081252 00000 n +0002348958 00000 n +0002575644 00000 n +0000081303 00000 n +0000081343 00000 n +0002352254 00000 n +0002575545 00000 n +0000081394 00000 n +0000081429 00000 n +0002352380 00000 n +0002575446 00000 n +0000081480 00000 n +0000081514 00000 n +0002352506 00000 n +0002575347 00000 n +0000081565 00000 n +0000081600 00000 n +0002352632 00000 n +0002575248 00000 n +0000081651 00000 n +0000081685 00000 n +0002355884 00000 n +0002575149 00000 n +0000081736 00000 n +0000081771 00000 n +0002356010 00000 n +0002575050 00000 n +0000081822 00000 n +0000081859 00000 n +0002356136 00000 n +0002574951 00000 n +0000081910 00000 n +0000081949 00000 n +0002356262 00000 n +0002574852 00000 n +0000082001 00000 n +0000082082 00000 n +0002356387 00000 n +0002574768 00000 n +0000082134 00000 n +0000082178 00000 n +0002358716 00000 n +0002574628 00000 n +0000082227 00000 n +0000082283 00000 n +0002358842 00000 n +0002574559 00000 n +0000082334 00000 n +0000082364 00000 n +0002365277 00000 n +0002574434 00000 n +0000082413 00000 n +0000082454 00000 n +0002365403 00000 n +0002574350 00000 n +0000082505 00000 n +0000082539 00000 n +0002367936 00000 n +0002574266 00000 n +0000082590 00000 n +0000082646 00000 n +0000083015 00000 n +0000083264 00000 n +0000082700 00000 n +0000083138 00000 n +0000083201 00000 n +0002561534 00000 n +0002546506 00000 n +0002561366 00000 n +0002546098 00000 n +0002542397 00000 n +0002545933 00000 n +0002562517 00000 n +0000085720 00000 n +0000084806 00000 n +0000083352 00000 n +0000085657 00000 n +0002541331 00000 n +0002522010 00000 n +0002541166 00000 n +0000084977 00000 n +0002520988 00000 n +0002504195 00000 n +0002520822 00000 n +0000085146 00000 n +0000085318 00000 n +0000085486 00000 n +0000086832 00000 n +0000086379 00000 n +0000085808 00000 n +0000086706 00000 n +0000086769 00000 n +0000086523 00000 n +0000092033 00000 n +0000088126 00000 n +0000086934 00000 n +0000091907 00000 n +0000091970 00000 n +0000088450 00000 n +0002503730 00000 n +0002501712 00000 n +0002503564 00000 n +0002499810 00000 n +0002497796 00000 n +0002499645 00000 n +0000088600 00000 n +0000088772 00000 n +0000088922 00000 n +0000089094 00000 n +0000089266 00000 n +0000089435 00000 n +0000089609 00000 n +0000089776 00000 n +0000089928 00000 n +0000090097 00000 n +0000090250 00000 n +0000090422 00000 n +0000090594 00000 n +0000090763 00000 n +0000090914 00000 n +0000091083 00000 n +0000091253 00000 n +0000091426 00000 n +0000091592 00000 n +0000091742 00000 n +0000293357 00000 n +0000308795 00000 n +0000322814 00000 n +0000326741 00000 n +0000384190 00000 n +0000441720 00000 n +0000098010 00000 n +0000093426 00000 n +0000092149 00000 n +0000097947 00000 n +0000093786 00000 n +0000093966 00000 n +0000094132 00000 n +0000094288 00000 n +0000094457 00000 n +0000094626 00000 n +0000094797 00000 n +0000094969 00000 n +0000095140 00000 n +0000095306 00000 n +0000095465 00000 n +0000095634 00000 n +0000095789 00000 n +0000095958 00000 n +0000096115 00000 n +0000096284 00000 n +0000096456 00000 n +0000096605 00000 n +0000096777 00000 n +0000096946 00000 n +0000097117 00000 n +0000097286 00000 n +0000097452 00000 n +0000097623 00000 n +0000097778 00000 n +0000475396 00000 n +0000524434 00000 n +0000534866 00000 n +0000538975 00000 n +0000630479 00000 n +0000749531 00000 n +0000104267 00000 n +0000099521 00000 n +0000098112 00000 n +0000104204 00000 n +0000099890 00000 n +0000100061 00000 n +0000100218 00000 n +0000100387 00000 n +0000100556 00000 n +0000100727 00000 n +0000100876 00000 n +0000101045 00000 n +0000101216 00000 n +0000101385 00000 n +0000101559 00000 n +0000101716 00000 n +0000101888 00000 n +0000102057 00000 n +0000102216 00000 n +0000102385 00000 n +0000102556 00000 n +0000102728 00000 n +0000102905 00000 n +0000103053 00000 n +0000103220 00000 n +0000103389 00000 n +0000103539 00000 n +0000103711 00000 n +0000103882 00000 n +0000104051 00000 n +0000810339 00000 n +0000878346 00000 n +0000930386 00000 n +0000946189 00000 n +0000973451 00000 n +0000981067 00000 n +0001140322 00000 n +0000110136 00000 n +0000105893 00000 n +0000104369 00000 n +0000110073 00000 n +0000106235 00000 n +0000106406 00000 n +0000106579 00000 n +0000106751 00000 n +0000106897 00000 n +0000107069 00000 n +0000107238 00000 n +0000107408 00000 n +0000107558 00000 n +0000107735 00000 n +0000107907 00000 n +0000108084 00000 n +0000108263 00000 n +0000108435 00000 n +0000108604 00000 n +0000108772 00000 n +0000108941 00000 n +0000109092 00000 n +0000109261 00000 n +0000109415 00000 n +0000109584 00000 n +0000109730 00000 n +0000109899 00000 n +0002562642 00000 n +0001917134 00000 n +0001930427 00000 n +0001982131 00000 n +0001997508 00000 n +0002024960 00000 n +0002088727 00000 n +0000116219 00000 n +0000111516 00000 n +0000110238 00000 n +0000116156 00000 n +0000111885 00000 n +0000112048 00000 n +0000112217 00000 n +0000112367 00000 n +0000112539 00000 n +0000112708 00000 n +0000112884 00000 n +0000113033 00000 n +0000113201 00000 n +0000113351 00000 n +0000113520 00000 n +0000113679 00000 n +0000113851 00000 n +0000114020 00000 n +0000114191 00000 n +0000114346 00000 n +0000114515 00000 n +0000114662 00000 n +0000114831 00000 n +0000114982 00000 n +0000115152 00000 n +0000115324 00000 n +0000115492 00000 n +0000115643 00000 n +0000115814 00000 n +0000115986 00000 n +0002131608 00000 n +0002162850 00000 n +0002169671 00000 n +0002170771 00000 n +0002174722 00000 n +0002198526 00000 n +0002223055 00000 n +0002249981 00000 n +0002274198 00000 n +0000121950 00000 n +0000117392 00000 n +0000116321 00000 n +0000121887 00000 n +0000117752 00000 n +0000117919 00000 n +0000118067 00000 n +0000118236 00000 n +0000118408 00000 n +0000118580 00000 n +0000118732 00000 n +0000118904 00000 n +0000119072 00000 n +0000119244 00000 n +0000119397 00000 n +0000119569 00000 n +0000119738 00000 n +0000119893 00000 n +0000120064 00000 n +0000120233 00000 n +0000120401 00000 n +0000120572 00000 n +0000120720 00000 n +0000120897 00000 n +0000121067 00000 n +0000121236 00000 n +0000121386 00000 n +0000121555 00000 n +0000121715 00000 n +0002290050 00000 n +0002299768 00000 n +0002320836 00000 n +0002331134 00000 n +0002348769 00000 n +0002358779 00000 n +0002365340 00000 n +0000130080 00000 n +0000123862 00000 n +0000122052 00000 n +0000129954 00000 n +0000130017 00000 n +0000124321 00000 n +0000124471 00000 n +0000124624 00000 n +0000124778 00000 n +0000124933 00000 n +0000125088 00000 n +0000125242 00000 n +0000125396 00000 n +0000125551 00000 n +0000125704 00000 n 0000125859 00000 n 0000126014 00000 n -0000126169 00000 n -0000126324 00000 n -0000126478 00000 n -0000126633 00000 n -0000126793 00000 n -0000126953 00000 n -0000127113 00000 n -0000127266 00000 n -0000127421 00000 n -0000127571 00000 n -0000127724 00000 n -0000127879 00000 n -0000128033 00000 n -0000128187 00000 n -0000128347 00000 n -0000128512 00000 n -0000128671 00000 n -0000128834 00000 n -0000128992 00000 n -0000140516 00000 n -0000132595 00000 n -0000129369 00000 n -0000140453 00000 n -0002391327 00000 n -0002381435 00000 n -0002391161 00000 n -0000133144 00000 n -0000133304 00000 n -0000133469 00000 n -0000133629 00000 n -0000133794 00000 n -0000133949 00000 n -0000134104 00000 n -0000134264 00000 n -0000134424 00000 n -0000134583 00000 n -0000134743 00000 n -0000134895 00000 n -0000135050 00000 n -0000135205 00000 n -0000135365 00000 n -0000135525 00000 n -0000135680 00000 n -0000135835 00000 n -0000135990 00000 n -0000136150 00000 n -0000136314 00000 n -0000136479 00000 n -0000136644 00000 n -0000136803 00000 n -0000136957 00000 n -0000137117 00000 n -0000137277 00000 n -0000137437 00000 n -0000137597 00000 n -0000137757 00000 n -0000137917 00000 n -0000138077 00000 n -0000138230 00000 n -0000138385 00000 n -0000138540 00000 n -0000138699 00000 n -0000138864 00000 n -0000139024 00000 n -0000139184 00000 n -0000139344 00000 n -0000139499 00000 n -0000139659 00000 n -0000139814 00000 n -0000139974 00000 n -0000140133 00000 n -0000140293 00000 n -0000152201 00000 n -0000143977 00000 n -0000140618 00000 n -0000152138 00000 n -0000144544 00000 n -0000144697 00000 n -0000144852 00000 n -0000145007 00000 n -0000145167 00000 n -0000145327 00000 n -0000145487 00000 n -0000145647 00000 n -0000145812 00000 n -0000145976 00000 n -0000146141 00000 n -0000146296 00000 n -0000146455 00000 n -0000146615 00000 n -0000146770 00000 n -0000146930 00000 n -0000147090 00000 n -0000147250 00000 n -0000147415 00000 n -0000147575 00000 n -0000147735 00000 n -0000147894 00000 n -0000148049 00000 n -0000148209 00000 n -0000148369 00000 n -0000148522 00000 n -0000148677 00000 n -0000148832 00000 n -0000148987 00000 n -0000149147 00000 n -0000149307 00000 n -0000149462 00000 n -0000149615 00000 n -0000149770 00000 n -0000149919 00000 n -0000150073 00000 n -0000150229 00000 n -0000150385 00000 n -0000150541 00000 n -0000150701 00000 n -0000150862 00000 n -0000151023 00000 n -0000151179 00000 n -0000151340 00000 n -0000151501 00000 n -0000151662 00000 n -0000151821 00000 n -0000151980 00000 n -0000164652 00000 n -0000155936 00000 n -0000152303 00000 n -0000164589 00000 n -0000156521 00000 n -0000156682 00000 n -0000156843 00000 n -0000156999 00000 n -0000157160 00000 n -0000157321 00000 n -0000157482 00000 n -0000157638 00000 n -0000157799 00000 n -0000157959 00000 n -0000158115 00000 n -0000158276 00000 n -0000158436 00000 n -0000158597 00000 n -0000158763 00000 n -0000158919 00000 n -0000159080 00000 n -0000159241 00000 n -0000159402 00000 n -0000159556 00000 n -0000159712 00000 n -0000159873 00000 n -0000160033 00000 n -0000160188 00000 n -0000160349 00000 n -0000160515 00000 n -0000160681 00000 n -0000160842 00000 n -0000161003 00000 n -0002380505 00000 n -0002361122 00000 n -0002380339 00000 n -0000161159 00000 n -0000161320 00000 n -0000161480 00000 n -0000161635 00000 n -0000161796 00000 n -0000161957 00000 n -0000162117 00000 n -0000162278 00000 n -0000162444 00000 n -0000162610 00000 n -0000162776 00000 n -0000162942 00000 n -0000163108 00000 n -0000163274 00000 n -0000163440 00000 n -0000163604 00000 n -0000163770 00000 n -0000163937 00000 n -0000164097 00000 n -0000164261 00000 n -0000164425 00000 n -0002456967 00000 n -0000175923 00000 n -0000168128 00000 n -0000164768 00000 n -0000175860 00000 n -0000168668 00000 n -0000168834 00000 n -0000168995 00000 n -0000169151 00000 n -0000169312 00000 n -0000169473 00000 n -0000169634 00000 n -0000169788 00000 n -0000169943 00000 n -0000170099 00000 n -0000170260 00000 n -0000170415 00000 n -0000170576 00000 n -0000170737 00000 n -0000170893 00000 n -0000171054 00000 n -0000171215 00000 n -0000171376 00000 n -0000171530 00000 n -0000171685 00000 n -0000171841 00000 n -0000172002 00000 n -0000172161 00000 n -0000172321 00000 n -0000172477 00000 n -0000172638 00000 n -0000172799 00000 n -0000172960 00000 n -0000173116 00000 n -0000173277 00000 n -0000173443 00000 n -0000173608 00000 n -0000173763 00000 n -0000173924 00000 n -0000174085 00000 n -0000174245 00000 n -0000174406 00000 n -0000174572 00000 n -0000174738 00000 n -0000174899 00000 n -0000175060 00000 n -0000175221 00000 n -0000175377 00000 n -0000175538 00000 n -0000175699 00000 n -0000188415 00000 n -0000179615 00000 n -0000176039 00000 n -0000188352 00000 n -0000180209 00000 n -0000180363 00000 n -0000180519 00000 n -0000180675 00000 n -0000180836 00000 n -0000181002 00000 n -0000181168 00000 n -0000181334 00000 n -0000181500 00000 n -0000181665 00000 n -0000181831 00000 n -0000181997 00000 n -0000182162 00000 n -0000182328 00000 n -0000182484 00000 n -0000182645 00000 n -0000182811 00000 n -0000182977 00000 n -0000183133 00000 n -0000183294 00000 n -0000183455 00000 n -0000183610 00000 n -0000183766 00000 n -0000183927 00000 n -0000184088 00000 n -0000184248 00000 n -0000184404 00000 n -0000184558 00000 n -0000184714 00000 n -0000184870 00000 n -0000185026 00000 n -0000185187 00000 n -0000185347 00000 n -0000185507 00000 n -0000185668 00000 n -0000185829 00000 n -0000185989 00000 n -0000186145 00000 n -0000186301 00000 n -0000186462 00000 n -0000186623 00000 n -0000186777 00000 n -0000186933 00000 n -0000187089 00000 n -0000187244 00000 n -0000187405 00000 n -0000187566 00000 n -0000187726 00000 n -0000187880 00000 n -0000188039 00000 n -0000188198 00000 n -0000201270 00000 n -0000192451 00000 n -0000188517 00000 n -0000201207 00000 n -0000193045 00000 n -0000193201 00000 n -0000193355 00000 n -0000193511 00000 n -0000193667 00000 n -0000193821 00000 n -0000193976 00000 n -0000194131 00000 n -0000194292 00000 n -0000194453 00000 n -0000194613 00000 n -0000194769 00000 n -0000194930 00000 n -0000195091 00000 n -0000195247 00000 n -0000195403 00000 n -0000195564 00000 n -0000195725 00000 n -0000195886 00000 n -0000196046 00000 n -0000196207 00000 n -0000196368 00000 n -0000196522 00000 n -0000196682 00000 n -0000196843 00000 n -0000197004 00000 n -0000197165 00000 n -0000197326 00000 n -0000197482 00000 n -0000197643 00000 n -0000197804 00000 n -0000197969 00000 n -0000198134 00000 n -0000198300 00000 n -0000198466 00000 n -0000198631 00000 n -0000198797 00000 n -0000198963 00000 n -0000199129 00000 n -0000199295 00000 n -0000199451 00000 n -0000199612 00000 n -0000199773 00000 n -0000199934 00000 n -0000200094 00000 n -0000200250 00000 n -0000200411 00000 n -0000200571 00000 n -0000200730 00000 n -0000200889 00000 n -0000201048 00000 n -0000213766 00000 n -0000205301 00000 n -0000201386 00000 n -0000213703 00000 n -0000205877 00000 n -0000206038 00000 n -0000206195 00000 n -0000206357 00000 n -0000206519 00000 n -0000206681 00000 n -0000206843 00000 n -0000207000 00000 n -0000207157 00000 n -0000207313 00000 n -0000207470 00000 n -0000207627 00000 n -0000207788 00000 n -0000207950 00000 n -0000208104 00000 n -0000208260 00000 n -0000208421 00000 n -0000208582 00000 n -0000208738 00000 n -0000208899 00000 n -0000209059 00000 n -0000209220 00000 n -0000209376 00000 n -0000209536 00000 n -0000209697 00000 n -0000209858 00000 n -0000210019 00000 n -0000210180 00000 n -0000210336 00000 n -0000210497 00000 n -0000210657 00000 n -0000210817 00000 n -0000210978 00000 n -0000211139 00000 n -0000211299 00000 n -0000211460 00000 n -0000211621 00000 n -0000211777 00000 n -0000211938 00000 n -0000212099 00000 n -0000212260 00000 n -0000212421 00000 n -0000212582 00000 n -0000212741 00000 n -0000212902 00000 n -0000213063 00000 n -0000213223 00000 n -0000213383 00000 n -0000213543 00000 n -0000226559 00000 n -0000217869 00000 n -0000213882 00000 n -0000226496 00000 n -0000218454 00000 n -0000218616 00000 n -0000218778 00000 n -0000218940 00000 n -0000219102 00000 n -0000219264 00000 n -0000219426 00000 n -0000219588 00000 n -0000219744 00000 n -0000219904 00000 n -0000220065 00000 n -0000220226 00000 n -0000220381 00000 n -0000220542 00000 n -0000220703 00000 n -0000220859 00000 n -0000221020 00000 n -0000221181 00000 n -0000221337 00000 n -0000221498 00000 n -0000221658 00000 n -0000221819 00000 n -0000221980 00000 n -0000222137 00000 n -0000222298 00000 n -0000222460 00000 n -0000222622 00000 n -0000222784 00000 n -0000222946 00000 n -0000223108 00000 n -0000223270 00000 n -0000223432 00000 n -0000223593 00000 n -0000223756 00000 n -0000223919 00000 n -0000224081 00000 n -0000224244 00000 n -0000224407 00000 n -0000224570 00000 n -0000224733 00000 n -0000224890 00000 n -0000225052 00000 n -0000225214 00000 n -0000225376 00000 n -0000225537 00000 n -0000225699 00000 n -0000225861 00000 n -0000226017 00000 n -0000226176 00000 n -0000226336 00000 n -0000239184 00000 n -0000230780 00000 n -0000226661 00000 n -0000239121 00000 n -0000231347 00000 n -0000231509 00000 n -0000231666 00000 n -0000231828 00000 n -0000231995 00000 n -0000232162 00000 n -0000232329 00000 n -0000232496 00000 n -0000232663 00000 n -0000232829 00000 n -0000232996 00000 n -0000233162 00000 n -0000233324 00000 n -0000233481 00000 n -0000233643 00000 n -0000233805 00000 n -0000233967 00000 n -0000234129 00000 n -0000234291 00000 n -0000234453 00000 n -0000234614 00000 n -0000234771 00000 n -0000234928 00000 n -0000235090 00000 n -0000235251 00000 n -0000235413 00000 n -0000235570 00000 n -0000235727 00000 n -0000235884 00000 n -0000236041 00000 n -0000236203 00000 n -0000236365 00000 n -0000236526 00000 n -0000236688 00000 n -0000236850 00000 n -0000237011 00000 n -0000237173 00000 n -0000237335 00000 n -0000237497 00000 n -0000237660 00000 n -0000237823 00000 n -0000237986 00000 n -0000238149 00000 n -0000238311 00000 n -0000238474 00000 n -0000238637 00000 n -0000238799 00000 n -0000238960 00000 n -0002457092 00000 n -0000250686 00000 n -0000242582 00000 n -0000239286 00000 n -0000250623 00000 n -0000243140 00000 n -0000243297 00000 n -0000243451 00000 n -0000243607 00000 n -0000243763 00000 n -0000243919 00000 n -0000244080 00000 n -0000244241 00000 n -0000244401 00000 n -0000244562 00000 n -0000244723 00000 n -0000244878 00000 n -0000245039 00000 n -0000245200 00000 n -0000245354 00000 n -0000245510 00000 n -0000245666 00000 n -0000245822 00000 n -0000245983 00000 n -0000246138 00000 n -0000246299 00000 n -0000246460 00000 n -0000246619 00000 n -0000246779 00000 n -0000246940 00000 n -0000247101 00000 n -0000247257 00000 n -0000247418 00000 n -0000247579 00000 n -0000247740 00000 n -0000247905 00000 n -0000248070 00000 n -0000248236 00000 n -0000248402 00000 n -0000248567 00000 n -0000248733 00000 n -0000248899 00000 n -0000249055 00000 n -0000249211 00000 n -0000249372 00000 n -0000249526 00000 n -0000249682 00000 n -0000249837 00000 n -0000249993 00000 n -0000250154 00000 n -0000250309 00000 n -0000250469 00000 n -0000263047 00000 n -0000254202 00000 n -0000250788 00000 n -0000262984 00000 n -0000254796 00000 n -0000254950 00000 n -0000255106 00000 n -0000255262 00000 n -0000255423 00000 n -0000255584 00000 n -0000255750 00000 n -0000255911 00000 n -0000256077 00000 n -0000256232 00000 n -0000256393 00000 n -0000256554 00000 n -0000256714 00000 n -0000256870 00000 n -0000257026 00000 n -0000257187 00000 n -0000257341 00000 n -0000257497 00000 n -0000257653 00000 n -0000257814 00000 n -0000257979 00000 n -0000258145 00000 n -0000258311 00000 n -0000258476 00000 n -0000258636 00000 n -0000258802 00000 n -0000258968 00000 n -0000259134 00000 n -0000259295 00000 n -0000259456 00000 n -0000259622 00000 n -0000259788 00000 n -0000259953 00000 n -0000260118 00000 n -0000260274 00000 n -0000260430 00000 n -0000260585 00000 n -0000260746 00000 n -0000260912 00000 n -0000261073 00000 n -0000261234 00000 n -0000261390 00000 n -0000261551 00000 n -0000261712 00000 n -0000261873 00000 n +0000126174 00000 n +0000126334 00000 n +0000126498 00000 n +0000126658 00000 n +0000126813 00000 n +0000126968 00000 n +0000127122 00000 n +0000127277 00000 n +0000127432 00000 n +0000127592 00000 n +0000127752 00000 n +0000127912 00000 n +0000128065 00000 n +0000128220 00000 n +0000128370 00000 n +0000128523 00000 n +0000128678 00000 n +0000128832 00000 n +0000128986 00000 n +0000129146 00000 n +0000129311 00000 n +0000129470 00000 n +0000129633 00000 n +0000129791 00000 n +0000140786 00000 n +0000132353 00000 n +0000130168 00000 n +0000140723 00000 n +0002497175 00000 n +0002487360 00000 n +0002497009 00000 n +0000132929 00000 n +0000133089 00000 n +0000133254 00000 n +0000133414 00000 n +0000133579 00000 n +0000133734 00000 n +0000133889 00000 n +0000134049 00000 n +0000134209 00000 n +0000134368 00000 n +0000134528 00000 n +0000134680 00000 n +0000134835 00000 n +0000134990 00000 n +0000135150 00000 n +0000135310 00000 n +0000135465 00000 n +0000135620 00000 n +0000135775 00000 n +0000135935 00000 n +0000136099 00000 n +0000136264 00000 n +0000136429 00000 n +0000136588 00000 n +0000136742 00000 n +0000136902 00000 n +0000137062 00000 n +0000137222 00000 n +0000137382 00000 n +0000137542 00000 n +0000137702 00000 n +0000137862 00000 n +0000138015 00000 n +0000138170 00000 n +0000138325 00000 n +0000138484 00000 n +0000138649 00000 n +0000138809 00000 n +0000138969 00000 n +0000139129 00000 n +0000139289 00000 n +0000139454 00000 n +0000139619 00000 n +0000139774 00000 n +0000139933 00000 n +0000140088 00000 n +0000140248 00000 n +0000140407 00000 n +0000140565 00000 n +0000151317 00000 n +0000143103 00000 n +0000140888 00000 n +0000151254 00000 n +0000143670 00000 n +0000143823 00000 n +0000143978 00000 n +0000144133 00000 n +0000144293 00000 n +0000144453 00000 n +0000144613 00000 n +0000144773 00000 n +0000144938 00000 n +0000145102 00000 n +0000145267 00000 n +0000145422 00000 n +0002486471 00000 n +0002471312 00000 n +0002486304 00000 n +0000145581 00000 n +0000145741 00000 n +0000145896 00000 n +0000146056 00000 n +0000146216 00000 n +0000146376 00000 n +0000146541 00000 n +0000146701 00000 n +0000146861 00000 n +0000147020 00000 n +0000147175 00000 n +0000147330 00000 n +0000147490 00000 n +0000147649 00000 n +0000147809 00000 n +0000147962 00000 n +0000148117 00000 n +0000148272 00000 n +0000148427 00000 n +0000148587 00000 n +0000148746 00000 n +0000148900 00000 n +0000149053 00000 n +0000149207 00000 n +0000149357 00000 n +0000149511 00000 n +0000149667 00000 n +0000149822 00000 n +0000149978 00000 n +0000150139 00000 n +0000150300 00000 n +0000150461 00000 n +0000150617 00000 n +0000150778 00000 n +0000150937 00000 n +0000151096 00000 n +0000162588 00000 n +0000153888 00000 n +0000151433 00000 n +0000162525 00000 n +0000154473 00000 n +0000154634 00000 n +0000154795 00000 n +0000154956 00000 n +0000155117 00000 n +0000155273 00000 n +0000155434 00000 n +0000155595 00000 n +0000155756 00000 n +0000155911 00000 n +0000156072 00000 n +0000156233 00000 n +0000156388 00000 n +0000156549 00000 n +0000156710 00000 n +0000156871 00000 n +0000157037 00000 n +0000157193 00000 n +0000157354 00000 n +0000157515 00000 n +0000157675 00000 n +0000157836 00000 n +0000157989 00000 n +0000158144 00000 n +0000158305 00000 n +0000158466 00000 n +0000158622 00000 n +0000158783 00000 n +0000158949 00000 n +0000159115 00000 n +0000159276 00000 n +0000159436 00000 n +0002469370 00000 n +0002450212 00000 n +0002469204 00000 n +0000159591 00000 n +0000159752 00000 n +0000159913 00000 n +0000160068 00000 n +0000160229 00000 n +0000160390 00000 n +0000160551 00000 n +0000160712 00000 n +0000160878 00000 n +0000161044 00000 n +0000161210 00000 n +0000161376 00000 n +0000161540 00000 n +0000161706 00000 n +0000161872 00000 n +0000162037 00000 n +0000162201 00000 n +0000162366 00000 n +0002562767 00000 n +0000173605 00000 n +0000165121 00000 n +0000162704 00000 n +0000173542 00000 n +0000165697 00000 n +0000165863 00000 n +0000166029 00000 n +0000166195 00000 n +0000166361 00000 n +0000166522 00000 n +0000166678 00000 n +0000166839 00000 n +0000167000 00000 n +0000167160 00000 n +0000167314 00000 n +0000167469 00000 n +0000167625 00000 n +0000167786 00000 n +0000167947 00000 n +0000168103 00000 n +0000168264 00000 n +0000168425 00000 n +0000168581 00000 n +0000168742 00000 n +0000168902 00000 n +0000169063 00000 n +0000169215 00000 n +0000169370 00000 n +0000169526 00000 n +0000169687 00000 n +0000169848 00000 n +0000170009 00000 n +0000170165 00000 n +0000170326 00000 n +0000170487 00000 n +0000170647 00000 n +0000170802 00000 n +0000170963 00000 n +0000171129 00000 n +0000171294 00000 n +0000171450 00000 n +0000171611 00000 n +0000171772 00000 n +0000171933 00000 n +0000172094 00000 n +0000172260 00000 n +0000172426 00000 n +0000172587 00000 n +0000172747 00000 n +0000172908 00000 n +0000173064 00000 n +0000173224 00000 n +0000173383 00000 n +0000184838 00000 n +0000176038 00000 n +0000173735 00000 n +0000184775 00000 n +0000176632 00000 n +0000176786 00000 n +0000176942 00000 n +0000177098 00000 n +0000177259 00000 n +0000177425 00000 n +0000177591 00000 n +0000177757 00000 n +0000177923 00000 n +0000178088 00000 n +0000178254 00000 n +0000178420 00000 n +0000178585 00000 n +0000178751 00000 n +0000178907 00000 n +0000179068 00000 n +0000179234 00000 n +0000179400 00000 n +0000179556 00000 n +0000179717 00000 n +0000179878 00000 n +0000180033 00000 n +0000180189 00000 n +0000180350 00000 n +0000180511 00000 n +0000180671 00000 n +0000180827 00000 n +0000180981 00000 n +0000181137 00000 n +0000181293 00000 n +0000181449 00000 n +0000181610 00000 n +0000181770 00000 n +0000181930 00000 n +0000182091 00000 n +0000182252 00000 n +0000182412 00000 n +0000182568 00000 n +0000182724 00000 n +0000182885 00000 n +0000183046 00000 n +0000183200 00000 n +0000183356 00000 n +0000183512 00000 n +0000183667 00000 n +0000183828 00000 n +0000183989 00000 n +0000184149 00000 n +0000184303 00000 n +0000184462 00000 n +0000184621 00000 n +0000196277 00000 n +0000187422 00000 n +0000184940 00000 n +0000196214 00000 n +0000188016 00000 n +0000188172 00000 n +0000188326 00000 n +0000188482 00000 n +0000188638 00000 n +0000188799 00000 n +0000188953 00000 n +0000189108 00000 n +0000189264 00000 n +0000189425 00000 n +0000189585 00000 n +0000189741 00000 n +0000189902 00000 n +0000190063 00000 n +0000190219 00000 n +0000190380 00000 n +0000190546 00000 n +0000190712 00000 n +0000190878 00000 n +0000191043 00000 n +0000191209 00000 n +0000191375 00000 n +0000191529 00000 n +0000191689 00000 n +0000191850 00000 n +0000192011 00000 n +0000192172 00000 n +0000192333 00000 n +0000192489 00000 n +0000192650 00000 n +0000192811 00000 n +0000192976 00000 n +0000193141 00000 n +0000193307 00000 n +0000193473 00000 n +0000193638 00000 n +0000193804 00000 n +0000193970 00000 n +0000194136 00000 n +0000194302 00000 n +0000194458 00000 n +0000194619 00000 n +0000194780 00000 n +0000194941 00000 n +0000195101 00000 n +0000195257 00000 n +0000195418 00000 n +0000195578 00000 n +0000195737 00000 n +0000195896 00000 n +0000196055 00000 n +0000207734 00000 n +0000198929 00000 n +0000196379 00000 n +0000207671 00000 n +0000199523 00000 n +0000199684 00000 n +0000199840 00000 n +0000200001 00000 n +0000200162 00000 n +0000200323 00000 n +0000200484 00000 n +0000200641 00000 n +0000200798 00000 n +0000200954 00000 n +0000201111 00000 n +0000201268 00000 n +0000201429 00000 n +0000201591 00000 n +0000201745 00000 n +0000201901 00000 n +0000202062 00000 n +0000202223 00000 n +0000202379 00000 n +0000202540 00000 n +0000202700 00000 n +0000202861 00000 n +0000203017 00000 n +0000203177 00000 n +0000203337 00000 n +0000203498 00000 n +0000203659 00000 n +0000203820 00000 n +0000203976 00000 n +0000204137 00000 n +0000204298 00000 n +0000204459 00000 n +0000204619 00000 n +0000204779 00000 n +0000204940 00000 n +0000205101 00000 n +0000205261 00000 n +0000205417 00000 n +0000205578 00000 n +0000205739 00000 n +0000205900 00000 n +0000206066 00000 n +0000206227 00000 n +0000206388 00000 n +0000206549 00000 n +0000206708 00000 n +0000206869 00000 n +0000207030 00000 n +0000207191 00000 n +0000207351 00000 n +0000207511 00000 n +0000219554 00000 n +0000210527 00000 n +0000207864 00000 n +0000219491 00000 n +0000211130 00000 n +0000211292 00000 n +0000211454 00000 n +0000211616 00000 n +0000211778 00000 n +0000211940 00000 n +0000212102 00000 n +0000212258 00000 n +0000212419 00000 n +0000212579 00000 n +0000212740 00000 n +0000212896 00000 n +0000213056 00000 n +0000213217 00000 n +0000213373 00000 n +0000213534 00000 n +0000213695 00000 n +0000213851 00000 n +0000214012 00000 n +0000214173 00000 n +0000214334 00000 n +0000214494 00000 n +0000214651 00000 n +0000214813 00000 n +0000214975 00000 n +0000215136 00000 n +0000215298 00000 n +0000215460 00000 n +0000215622 00000 n +0000215784 00000 n +0000215946 00000 n +0000216108 00000 n +0000216271 00000 n +0000216434 00000 n +0000216596 00000 n +0000216759 00000 n +0000216922 00000 n +0000217084 00000 n +0000217247 00000 n +0000217404 00000 n +0000217566 00000 n +0000217728 00000 n +0000217890 00000 n +0000218052 00000 n +0000218214 00000 n +0000218376 00000 n +0000218532 00000 n +0000218694 00000 n +0000218856 00000 n +0000219017 00000 n +0000219176 00000 n +0000219331 00000 n +0000231154 00000 n +0000222432 00000 n +0000219656 00000 n +0000231091 00000 n +0000223017 00000 n +0000223184 00000 n +0000223351 00000 n +0000223518 00000 n +0000223685 00000 n +0000223852 00000 n +0000224019 00000 n +0000224186 00000 n +0000224352 00000 n +0000224514 00000 n +0000224671 00000 n +0000224832 00000 n +0000224994 00000 n +0000225156 00000 n +0000225318 00000 n +0000225480 00000 n +0000225642 00000 n +0000225799 00000 n +0000225956 00000 n +0000226118 00000 n +0000226279 00000 n +0000226441 00000 n +0000226598 00000 n +0000226755 00000 n +0000226911 00000 n +0000227073 00000 n +0000227235 00000 n +0000227397 00000 n +0000227559 00000 n +0000227721 00000 n +0000227883 00000 n +0000228045 00000 n +0000228207 00000 n +0000228368 00000 n +0000228531 00000 n +0000228694 00000 n +0000228856 00000 n +0000229019 00000 n +0000229182 00000 n +0000229345 00000 n +0000229508 00000 n +0000229671 00000 n +0000229834 00000 n +0000229997 00000 n +0000230154 00000 n +0000230308 00000 n +0000230464 00000 n +0000230619 00000 n +0000230773 00000 n +0000230932 00000 n +0002562892 00000 n +0000242019 00000 n +0000233558 00000 n +0000231270 00000 n +0000241956 00000 n +0000234134 00000 n +0000234295 00000 n +0000234456 00000 n +0000234617 00000 n +0000234773 00000 n +0000234934 00000 n +0000235095 00000 n +0000235249 00000 n +0000235404 00000 n +0000235560 00000 n +0000235716 00000 n +0000235876 00000 n +0000236032 00000 n +0000236193 00000 n +0000236354 00000 n +0000236515 00000 n +0000236676 00000 n +0000236837 00000 n +0000236998 00000 n +0000237154 00000 n +0000237314 00000 n +0000237475 00000 n +0000237636 00000 n +0000237801 00000 n +0000237967 00000 n +0000238133 00000 n +0000238299 00000 n +0000238465 00000 n +0000238631 00000 n +0000238797 00000 n +0000238953 00000 n +0000239108 00000 n +0000239268 00000 n +0000239429 00000 n +0000239582 00000 n +0000239738 00000 n +0000239894 00000 n +0000240050 00000 n +0000240211 00000 n +0000240367 00000 n +0000240528 00000 n +0000240682 00000 n +0000240837 00000 n +0000240993 00000 n +0000241154 00000 n +0000241314 00000 n +0000241479 00000 n +0000241638 00000 n +0000241802 00000 n +0000253066 00000 n +0000244359 00000 n +0000242121 00000 n +0000253003 00000 n +0000244944 00000 n +0000245100 00000 n +0000245261 00000 n +0000245422 00000 n +0000245583 00000 n +0000245739 00000 n +0000245895 00000 n +0000246056 00000 n +0000246210 00000 n +0000246366 00000 n +0000246522 00000 n +0000246682 00000 n +0000246848 00000 n +0000247014 00000 n +0000247180 00000 n +0000247346 00000 n +0000247507 00000 n +0000247673 00000 n +0000247839 00000 n +0000248005 00000 n +0000248166 00000 n +0000248332 00000 n +0000248497 00000 n +0000248662 00000 n +0000248828 00000 n +0000248984 00000 n +0000249140 00000 n +0000249296 00000 n +0000249457 00000 n +0000249623 00000 n +0000249784 00000 n +0000249944 00000 n +0000250099 00000 n +0000250260 00000 n +0000250421 00000 n +0000250581 00000 n +0000250734 00000 n +0000250890 00000 n +0000251046 00000 n +0000251207 00000 n +0000251373 00000 n +0000251534 00000 n +0000251700 00000 n +0000251865 00000 n +0000252026 00000 n +0000252187 00000 n +0000252347 00000 n +0000252511 00000 n +0000252675 00000 n +0000252839 00000 n +0000263044 00000 n +0000255183 00000 n +0000253168 00000 n +0000262981 00000 n +0000255732 00000 n +0000255888 00000 n +0000256049 00000 n +0000256210 00000 n +0000256364 00000 n +0000256520 00000 n +0000256676 00000 n +0000256832 00000 n +0000256992 00000 n +0000257153 00000 n +0000257314 00000 n +0000257474 00000 n +0000257630 00000 n +0000257791 00000 n +0000257952 00000 n +0000258113 00000 n +0000258274 00000 n +0000258435 00000 n +0000258591 00000 n +0000258752 00000 n +0000258912 00000 n +0000259073 00000 n +0000259225 00000 n +0000259380 00000 n +0000259536 00000 n +0000259692 00000 n +0000259848 00000 n +0000260004 00000 n +0000260160 00000 n +0000260321 00000 n +0000260475 00000 n +0000260631 00000 n +0000260787 00000 n +0000260940 00000 n +0000261096 00000 n +0000261245 00000 n +0000261399 00000 n +0000261554 00000 n +0000261710 00000 n +0000261866 00000 n 0000262027 00000 n -0000262183 00000 n -0000262338 00000 n -0000262497 00000 n -0000262661 00000 n -0000262820 00000 n -0000273618 00000 n -0000266208 00000 n -0000263149 00000 n -0000273555 00000 n -0000266730 00000 n -0000266896 00000 n -0000267057 00000 n -0000267218 00000 n -0000267379 00000 n -0000267545 00000 n -0000267711 00000 n -0000267877 00000 n -0000268043 00000 n -0000268198 00000 n -0000268359 00000 n -0000268520 00000 n -0000268674 00000 n -0000268830 00000 n -0000268986 00000 n -0000269142 00000 n -0000269303 00000 n -0000269464 00000 n -0000269625 00000 n -0000269786 00000 n -0000269941 00000 n -0000270102 00000 n -0000270263 00000 n -0000270423 00000 n -0000270583 00000 n -0000270744 00000 n -0000270900 00000 n -0000271061 00000 n -0000271222 00000 n -0000271383 00000 n -0000271537 00000 n -0000271692 00000 n -0000271847 00000 n -0000272003 00000 n -0000272159 00000 n -0000272314 00000 n -0000272470 00000 n -0000272631 00000 n -0000272785 00000 n -0000272941 00000 n -0000273097 00000 n -0000273251 00000 n -0000273406 00000 n -0000284586 00000 n -0000276790 00000 n -0000273720 00000 n -0000284523 00000 n -0000277330 00000 n -0000277484 00000 n -0000277640 00000 n -0000277796 00000 n -0000277957 00000 n -0000278118 00000 n -0000278279 00000 n -0000278435 00000 n -0000278596 00000 n -0000278756 00000 n -0000278917 00000 n -0000279078 00000 n -0000279238 00000 n -0000279399 00000 n -0000279565 00000 n -0000279731 00000 n -0000279897 00000 n -0000280051 00000 n -0000280207 00000 n -0000280368 00000 n -0000280533 00000 n -0000280699 00000 n -0000280865 00000 n -0000281030 00000 n -0000281195 00000 n -0000281356 00000 n -0000281512 00000 n -0000281673 00000 n -0000281834 00000 n -0000281988 00000 n -0000282144 00000 n -0000282304 00000 n -0000282464 00000 n -0000282625 00000 n -0000282786 00000 n -0000282946 00000 n -0000283107 00000 n -0000283268 00000 n -0000283429 00000 n -0000283590 00000 n -0000283752 00000 n -0000283901 00000 n -0000284055 00000 n -0000284211 00000 n -0000284367 00000 n -0000295326 00000 n -0000287768 00000 n -0000284688 00000 n -0000295263 00000 n -0000288299 00000 n -0000288453 00000 n -0000288609 00000 n -0000288770 00000 n -0000288931 00000 n -0000289092 00000 n -0000289253 00000 n -0000289419 00000 n -0000289585 00000 n -0000289740 00000 n -0000289896 00000 n -0000290052 00000 n -0000290206 00000 n -0000290362 00000 n -0000290518 00000 n -0000290674 00000 n -0000290830 00000 n -0000290986 00000 n -0000291142 00000 n -0000291291 00000 n -0000291445 00000 n -0000291601 00000 n -0000291762 00000 n -0000291923 00000 n -0000292088 00000 n -0000292254 00000 n -0000292410 00000 n -0000292565 00000 n -0000292720 00000 n -0000292881 00000 n +0000262188 00000 n +0000262349 00000 n +0000262505 00000 n +0000262665 00000 n +0000262823 00000 n +0000273403 00000 n +0000265262 00000 n +0000263146 00000 n +0000273340 00000 n +0000265820 00000 n +0000265981 00000 n +0000266142 00000 n +0000266308 00000 n +0000266474 00000 n +0000266640 00000 n +0000266794 00000 n +0000266950 00000 n +0000267110 00000 n +0000267276 00000 n +0000267442 00000 n +0000267607 00000 n +0000267773 00000 n +0000267939 00000 n +0000268100 00000 n +0000268256 00000 n +0000268417 00000 n +0000268578 00000 n +0000268732 00000 n +0000268887 00000 n +0000269043 00000 n +0000269204 00000 n +0000269368 00000 n +0000269533 00000 n +0000269694 00000 n +0000269855 00000 n +0000270016 00000 n +0000270172 00000 n +0000270333 00000 n +0000270494 00000 n +0000270655 00000 n +0000270815 00000 n +0000270975 00000 n +0000271136 00000 n +0000271297 00000 n +0000271457 00000 n +0000271606 00000 n +0000271760 00000 n +0000271916 00000 n +0000272071 00000 n +0000272227 00000 n +0000272381 00000 n +0000272537 00000 n +0000272698 00000 n +0000272859 00000 n +0000273018 00000 n +0000273177 00000 n +0000283720 00000 n +0000275673 00000 n +0000273505 00000 n +0000283657 00000 n +0000276231 00000 n +0000276397 00000 n +0000276553 00000 n +0000276709 00000 n +0000276865 00000 n +0000277019 00000 n +0000277175 00000 n +0000277331 00000 n +0000277486 00000 n +0000277642 00000 n +0000277798 00000 n +0000277953 00000 n +0000278102 00000 n +0000278256 00000 n +0000278412 00000 n +0000278571 00000 n +0000278732 00000 n +0000278898 00000 n +0000279064 00000 n +0000279220 00000 n +0000279376 00000 n +0000279532 00000 n +0000279693 00000 n +0000279859 00000 n +0000280024 00000 n +0000280190 00000 n +0000280346 00000 n +0000280506 00000 n +0000280666 00000 n +0000280819 00000 n +0000280975 00000 n +0000281131 00000 n +0000281287 00000 n +0000281443 00000 n +0000281599 00000 n +0000281759 00000 n +0000281915 00000 n +0000282076 00000 n +0000282237 00000 n +0000282391 00000 n +0000282547 00000 n +0000282703 00000 n +0000282864 00000 n +0000283025 00000 n +0000283186 00000 n +0000283340 00000 n +0000283499 00000 n +0000289434 00000 n +0000285095 00000 n +0000283822 00000 n +0000289371 00000 n +0000285455 00000 n +0000285616 00000 n +0000285777 00000 n +0000285938 00000 n +0000286099 00000 n +0000286255 00000 n +0000286416 00000 n +0000286572 00000 n +0000286728 00000 n +0000286882 00000 n +0000287038 00000 n +0000287193 00000 n +0000287349 00000 n +0000287505 00000 n +0000287661 00000 n +0000287817 00000 n +0000287973 00000 n +0000288129 00000 n +0000288285 00000 n +0000288442 00000 n +0000288598 00000 n +0000288752 00000 n +0000288906 00000 n +0000289059 00000 n +0000289215 00000 n +0002563017 00000 n +0000290089 00000 n +0000289843 00000 n +0000289536 00000 n +0000289966 00000 n +0000293544 00000 n 0000293047 00000 n -0000293213 00000 n -0000293369 00000 n -0000293530 00000 n -0000293691 00000 n -0000293845 00000 n -0000294001 00000 n -0000294157 00000 n -0000294313 00000 n -0000294468 00000 n -0000294624 00000 n -0000294785 00000 n -0000294941 00000 n -0000295102 00000 n -0000303712 00000 n -0000297868 00000 n -0000295428 00000 n -0000303649 00000 n -0000298309 00000 n -0000298463 00000 n -0000298619 00000 n -0000298775 00000 n -0000298936 00000 n -0000299097 00000 n -0000299258 00000 n -0000299414 00000 n -0000299575 00000 n -0000299735 00000 n -0000299896 00000 n -0000300057 00000 n -0000300217 00000 n -0000300378 00000 n -0000300534 00000 n -0000300695 00000 n -0000300851 00000 n -0000301007 00000 n -0000301161 00000 n -0000301317 00000 n -0000301472 00000 n -0000301628 00000 n -0000301784 00000 n -0000301939 00000 n -0000302094 00000 n -0000302250 00000 n -0000302406 00000 n -0000302562 00000 n -0000302719 00000 n -0000302876 00000 n -0000303030 00000 n -0000303185 00000 n -0000303339 00000 n -0000303495 00000 n -0002457217 00000 n -0000304382 00000 n -0000304136 00000 n -0000303814 00000 n -0000304259 00000 n +0000290177 00000 n +0000293170 00000 n +0000293233 00000 n +0000293481 00000 n +0000297205 00000 n +0000296895 00000 n +0000293646 00000 n +0000297018 00000 n +0000297142 00000 n +0000301205 00000 n +0000300400 00000 n +0000297321 00000 n +0000300894 00000 n +0000300553 00000 n +0000301018 00000 n +0000300722 00000 n +0000301142 00000 n +0000305305 00000 n +0000304448 00000 n +0000301321 00000 n +0000304995 00000 n +0000304601 00000 n +0000305119 00000 n +0000304809 00000 n +0000305242 00000 n +0000309352 00000 n 0000307868 00000 n -0000307371 00000 n -0000304470 00000 n -0000307494 00000 n -0000307557 00000 n -0000307805 00000 n -0000311771 00000 n -0000311461 00000 n -0000307970 00000 n -0000311584 00000 n -0000311708 00000 n -0000315950 00000 n -0000315145 00000 n -0000311887 00000 n -0000315639 00000 n -0000315298 00000 n -0000315763 00000 n -0000315467 00000 n -0000315887 00000 n -0000320170 00000 n -0000319313 00000 n -0000316066 00000 n -0000319860 00000 n -0000319466 00000 n -0000319984 00000 n -0000319674 00000 n -0000320107 00000 n -0000323819 00000 n -0000322501 00000 n -0000320286 00000 n -0000323134 00000 n -0000323382 00000 n -0000322663 00000 n -0000322829 00000 n -0000322982 00000 n -0000323506 00000 n -0000323630 00000 n -0000323693 00000 n -0000323757 00000 n -0002457342 00000 n -0000327513 00000 n -0000326433 00000 n -0000323907 00000 n -0000327080 00000 n -0000326595 00000 n -0000326753 00000 n -0000327204 00000 n -0000327326 00000 n -0000326910 00000 n -0000327450 00000 n -0002359232 00000 n -0002343760 00000 n -0002359066 00000 n -0000330309 00000 n -0000329295 00000 n -0000327643 00000 n -0000329750 00000 n -0000329874 00000 n -0000329998 00000 n -0000330122 00000 n -0000329448 00000 n -0000329599 00000 n -0000330246 00000 n -0000333188 00000 n -0000332630 00000 n -0000330425 00000 n -0000332753 00000 n -0000332877 00000 n -0000333001 00000 n -0000333125 00000 n -0000334215 00000 n -0000333781 00000 n -0000333304 00000 n -0000333904 00000 n -0000334152 00000 n -0000334884 00000 n -0000334636 00000 n -0000334303 00000 n -0000334759 00000 n -0000338254 00000 n -0000337755 00000 n -0000334972 00000 n -0000337878 00000 n -0000337941 00000 n -0000338191 00000 n -0002457467 00000 n -0000341751 00000 n -0000341317 00000 n -0000338356 00000 n -0000341440 00000 n -0000341564 00000 n -0000341689 00000 n -0000345739 00000 n -0000345053 00000 n -0000341895 00000 n -0000345176 00000 n -0000345301 00000 n -0000345364 00000 n -0000345427 00000 n -0000345552 00000 n -0000345676 00000 n -0000351745 00000 n -0000348828 00000 n -0000348142 00000 n -0000345855 00000 n -0000348265 00000 n -0000348390 00000 n -0000348515 00000 n -0000348639 00000 n -0000348702 00000 n -0000348765 00000 n -0000353895 00000 n -0000351592 00000 n -0000348958 00000 n -0000353582 00000 n -0002342975 00000 n -0002330332 00000 n -0002342808 00000 n -0002328364 00000 n -0002316799 00000 n -0002328198 00000 n -0000353275 00000 n -0000353425 00000 n -0000353707 00000 n -0000353832 00000 n -0000353104 00000 n -0000353162 00000 n -0000353252 00000 n -0001850314 00000 n -0000357327 00000 n -0000356838 00000 n -0000354068 00000 n -0000357139 00000 n -0000356982 00000 n -0000357264 00000 n -0000360974 00000 n -0000360538 00000 n -0000357457 00000 n -0000360661 00000 n -0002316156 00000 n -0002309932 00000 n -0002315989 00000 n -0000360786 00000 n -0000360911 00000 n -0002457592 00000 n -0000364749 00000 n -0000364439 00000 n -0000361175 00000 n -0000364562 00000 n -0000364686 00000 n -0000368076 00000 n -0000367213 00000 n -0000364865 00000 n -0000367514 00000 n -0000367639 00000 n -0000367763 00000 n -0000367888 00000 n -0000367357 00000 n -0000368013 00000 n -0000424193 00000 n -0000371130 00000 n -0000370819 00000 n -0000368192 00000 n -0000370942 00000 n -0000375249 00000 n -0000374595 00000 n -0000371260 00000 n -0000375061 00000 n -0000375186 00000 n -0000374748 00000 n -0000374904 00000 n -0000379940 00000 n -0000378665 00000 n -0000375436 00000 n -0000379628 00000 n -0000378845 00000 n -0000378999 00000 n -0000379165 00000 n -0000379330 00000 n -0000379480 00000 n -0000379753 00000 n -0000379877 00000 n -0000482090 00000 n -0000384083 00000 n -0000383729 00000 n -0000380070 00000 n -0000384020 00000 n -0002309699 00000 n -0002307641 00000 n -0002309536 00000 n -0002307408 00000 n -0002305339 00000 n -0002307245 00000 n -0002304787 00000 n -0002296876 00000 n -0002304623 00000 n -0000383873 00000 n -0002457717 00000 n -0000388127 00000 n -0000387472 00000 n -0000384241 00000 n -0000387939 00000 n -0000388064 00000 n -0000387625 00000 n -0000387782 00000 n -0000391919 00000 n -0000390889 00000 n -0000388314 00000 n -0000391856 00000 n -0000391069 00000 n -0000391228 00000 n -0000391393 00000 n -0000391548 00000 n -0000391702 00000 n -0000396804 00000 n -0000395672 00000 n -0000392078 00000 n -0000396616 00000 n -0000396741 00000 n -0000395852 00000 n -0000396007 00000 n -0000396161 00000 n -0000396311 00000 n -0000396460 00000 n -0000399623 00000 n -0000399686 00000 n -0000399374 00000 n -0000396976 00000 n -0000399497 00000 n -0000399560 00000 n -0000403016 00000 n -0000402455 00000 n -0000399816 00000 n -0000402578 00000 n -0000402703 00000 n -0000402828 00000 n -0000402953 00000 n -0000406506 00000 n -0000405819 00000 n -0000403189 00000 n -0000405942 00000 n -0000406005 00000 n -0000406068 00000 n -0000406193 00000 n -0000406318 00000 n -0000406443 00000 n -0002457842 00000 n -0000410747 00000 n -0000410121 00000 n -0000406665 00000 n -0000410244 00000 n -0000410307 00000 n -0000410370 00000 n -0000410432 00000 n -0000410495 00000 n -0000410558 00000 n -0000410621 00000 n -0000410684 00000 n -0000414614 00000 n -0000414135 00000 n -0000410877 00000 n -0000414426 00000 n -0000414551 00000 n -0000414279 00000 n -0000551070 00000 n -0000418145 00000 n -0000417459 00000 n -0000414801 00000 n -0000417582 00000 n -0000417707 00000 n -0000417832 00000 n -0000417957 00000 n -0000418082 00000 n -0000421369 00000 n -0000420810 00000 n -0000418332 00000 n -0000420933 00000 n -0000421058 00000 n -0000421183 00000 n -0000421307 00000 n -0000423391 00000 n -0000423080 00000 n -0000421485 00000 n -0000423203 00000 n -0000423328 00000 n -0000450322 00000 n -0000424070 00000 n -0000423521 00000 n -0000450070 00000 n -0000450133 00000 n -0000450196 00000 n -0000450259 00000 n -0002457967 00000 n -0000454401 00000 n -0000453456 00000 n -0000450475 00000 n -0000454089 00000 n -0000453618 00000 n -0000453769 00000 n -0000454338 00000 n -0000453920 00000 n -0000457764 00000 n -0000457329 00000 n -0000454517 00000 n -0000457452 00000 n -0000457577 00000 n -0000457702 00000 n -0000461672 00000 n -0000461486 00000 n -0000457894 00000 n -0000461609 00000 n -0000465802 00000 n -0000464815 00000 n -0000461788 00000 n -0000465112 00000 n -0000465237 00000 n -0000465300 00000 n -0000465364 00000 n -0000464959 00000 n -0000465489 00000 n -0000465614 00000 n -0000465739 00000 n -0000469530 00000 n -0000468967 00000 n -0000465918 00000 n -0000469090 00000 n -0000469215 00000 n -0000469340 00000 n -0000469403 00000 n -0000469467 00000 n -0000473181 00000 n -0000472622 00000 n -0000469674 00000 n -0000472745 00000 n -0000472870 00000 n -0000472994 00000 n -0000473118 00000 n -0002458092 00000 n -0000475516 00000 n -0000475080 00000 n -0000473354 00000 n -0000475203 00000 n -0000475328 00000 n -0000475453 00000 n -0000478551 00000 n -0000478115 00000 n -0000475632 00000 n -0000478238 00000 n -0000478488 00000 n -0000482153 00000 n -0000481842 00000 n -0000478667 00000 n -0000481965 00000 n -0000484906 00000 n -0000484595 00000 n -0000482283 00000 n -0000484718 00000 n -0000484843 00000 n -0000488277 00000 n -0000490495 00000 n -0000488106 00000 n -0000485050 00000 n -0000489931 00000 n +0000305421 00000 n +0000308671 00000 n +0000308919 00000 n +0000308039 00000 n +0000308205 00000 n +0000309043 00000 n +0000309166 00000 n +0000308358 00000 n +0000309289 00000 n +0000308515 00000 n +0002563142 00000 n +0000311904 00000 n +0000312030 00000 n +0000312281 00000 n +0000311373 00000 n +0000309468 00000 n +0000311841 00000 n +0000311967 00000 n +0000312093 00000 n +0000311526 00000 n +0000311684 00000 n +0000312218 00000 n +0000315963 00000 n +0000314902 00000 n +0000312425 00000 n +0000315529 00000 n +0000315653 00000 n +0000315064 00000 n +0000315234 00000 n +0000315382 00000 n +0000315777 00000 n +0002449253 00000 n +0002433008 00000 n +0002449087 00000 n +0000315900 00000 n +0000318975 00000 n +0000317922 00000 n +0000316121 00000 n +0000318540 00000 n +0000318664 00000 n +0000318788 00000 n +0000318084 00000 n +0000318237 00000 n +0000318389 00000 n +0000318912 00000 n +0000321972 00000 n +0000321414 00000 n +0000319119 00000 n +0000321537 00000 n +0000321661 00000 n +0000321785 00000 n +0000321909 00000 n +0000323002 00000 n +0000322567 00000 n +0000322116 00000 n +0000322690 00000 n +0000322939 00000 n +0000323657 00000 n +0000323409 00000 n +0000323090 00000 n +0000323532 00000 n +0002563267 00000 n +0000326929 00000 n +0000326430 00000 n +0000323745 00000 n +0000326553 00000 n +0000326616 00000 n +0000326866 00000 n +0000330053 00000 n +0000329617 00000 n +0000327031 00000 n +0000329740 00000 n +0000329865 00000 n +0000329990 00000 n +0000333860 00000 n +0000333174 00000 n +0000330197 00000 n +0000333297 00000 n +0000333422 00000 n +0000333485 00000 n +0000333548 00000 n +0000333673 00000 n +0000333797 00000 n +0000339817 00000 n +0000336896 00000 n +0000336209 00000 n +0000334004 00000 n +0000336332 00000 n +0000336457 00000 n +0000336582 00000 n +0000336707 00000 n +0000336770 00000 n +0000336833 00000 n +0000341966 00000 n +0000339664 00000 n +0000337040 00000 n +0000341654 00000 n +0002432480 00000 n +0002423829 00000 n +0002432313 00000 n +0002421862 00000 n +0002410414 00000 n +0002421696 00000 n +0000341347 00000 n +0000341497 00000 n +0000341779 00000 n +0000341903 00000 n +0000341176 00000 n +0000341234 00000 n +0000341324 00000 n +0000345593 00000 n +0000344942 00000 n +0000342167 00000 n +0000345405 00000 n +0000345095 00000 n +0000345252 00000 n +0000345530 00000 n +0002563392 00000 n +0000504504 00000 n +0000349139 00000 n +0000348703 00000 n +0000345737 00000 n +0000348826 00000 n +0002409789 00000 n +0002403247 00000 n +0002409622 00000 n +0000348951 00000 n +0000349076 00000 n +0000352964 00000 n +0000352654 00000 n +0000349368 00000 n +0000352777 00000 n +0000352901 00000 n +0000356223 00000 n +0000355360 00000 n +0000353094 00000 n +0000355661 00000 n +0000355786 00000 n +0000355910 00000 n +0000356035 00000 n +0000355504 00000 n +0000356160 00000 n +0000358030 00000 n +0000384380 00000 n +0000357886 00000 n +0000356367 00000 n +0000384065 00000 n +0000383907 00000 n +0000384253 00000 n +0000384316 00000 n +0000387762 00000 n +0000387452 00000 n +0000384519 00000 n +0000387575 00000 n +0000387699 00000 n +0000391616 00000 n +0000391088 00000 n +0000387892 00000 n +0000391553 00000 n +0000391241 00000 n +0000391397 00000 n +0002563517 00000 n +0000396489 00000 n +0000395050 00000 n +0000391803 00000 n +0000396177 00000 n +0000395239 00000 n +0000395395 00000 n +0000395550 00000 n +0000395716 00000 n +0000395880 00000 n +0000396302 00000 n +0000396427 00000 n +0002402866 00000 n +0002400341 00000 n +0002402702 00000 n +0002400098 00000 n +0002397827 00000 n +0002399935 00000 n +0002397370 00000 n +0002392623 00000 n +0002397206 00000 n +0000396030 00000 n +0002391241 00000 n +0002383986 00000 n +0002391076 00000 n +0000479347 00000 n +0000399697 00000 n +0000399511 00000 n +0000396675 00000 n +0000399634 00000 n +0000403675 00000 n +0000402848 00000 n +0000399813 00000 n +0000403487 00000 n +0000403612 00000 n +0000403010 00000 n +0000403167 00000 n +0000403324 00000 n +0000407246 00000 n +0000406562 00000 n +0000403946 00000 n +0000407183 00000 n +0000406724 00000 n +0000406878 00000 n +0000407031 00000 n +0000410792 00000 n +0000409848 00000 n +0000407447 00000 n +0000410477 00000 n +0000410602 00000 n +0000410010 00000 n +0000410665 00000 n +0000410728 00000 n +0000410165 00000 n +0000410320 00000 n +0000414483 00000 n +0000414126 00000 n +0000411006 00000 n +0000414420 00000 n +0000414270 00000 n +0002563642 00000 n +0000417831 00000 n +0000417020 00000 n +0000414684 00000 n +0000417143 00000 n +0000417268 00000 n +0000417393 00000 n +0000417518 00000 n +0000417643 00000 n +0000417704 00000 n +0000417767 00000 n +0000421474 00000 n +0000421038 00000 n +0000417961 00000 n +0000421161 00000 n +0000421286 00000 n +0000421411 00000 n +0000425433 00000 n +0000424468 00000 n +0000421633 00000 n +0000424929 00000 n +0000424992 00000 n +0000425055 00000 n +0000425118 00000 n +0000425181 00000 n +0000425244 00000 n +0000425307 00000 n +0000425370 00000 n +0000424621 00000 n +0000424775 00000 n +0000429670 00000 n +0000428941 00000 n +0000425577 00000 n +0000429232 00000 n +0000429357 00000 n +0000429085 00000 n +0000429482 00000 n +0000429607 00000 n +0000557035 00000 n +0000432703 00000 n +0000432268 00000 n +0000429885 00000 n +0000432391 00000 n +0000432516 00000 n +0000432641 00000 n +0000435879 00000 n +0000435318 00000 n +0000432876 00000 n +0000435441 00000 n +0000435566 00000 n +0000435691 00000 n +0000435816 00000 n +0002563767 00000 n +0000437770 00000 n +0000437459 00000 n +0000436009 00000 n +0000437582 00000 n +0000437707 00000 n +0000441908 00000 n +0000440791 00000 n +0000437900 00000 n +0000441595 00000 n +0000440962 00000 n +0000441845 00000 n +0000441114 00000 n +0000441283 00000 n +0000441440 00000 n +0000445455 00000 n +0000445831 00000 n +0000445269 00000 n +0000442010 00000 n +0000445392 00000 n +0000445518 00000 n +0000445643 00000 n +0000445768 00000 n +0000449912 00000 n +0000449726 00000 n +0000445947 00000 n +0000449849 00000 n +0000454490 00000 n +0000453591 00000 n +0000450042 00000 n +0000454051 00000 n +0000454176 00000 n +0000453744 00000 n +0000454238 00000 n +0000454301 00000 n +0000453898 00000 n +0000454427 00000 n +0000458123 00000 n +0000457224 00000 n +0000454634 00000 n +0000457683 00000 n +0000457377 00000 n +0000457746 00000 n +0000457809 00000 n +0000457935 00000 n +0000458060 00000 n +0000457532 00000 n +0002563892 00000 n +0000545831 00000 n +0000462270 00000 n +0000461249 00000 n +0000458295 00000 n +0000461708 00000 n +0000461833 00000 n +0000461402 00000 n +0000461958 00000 n +0000462083 00000 n +0000461554 00000 n +0000462207 00000 n +0000549497 00000 n +0000466120 00000 n +0000465509 00000 n +0000462414 00000 n +0000465805 00000 n +0000465930 00000 n +0000465653 00000 n +0000465993 00000 n +0000466056 00000 n +0000470140 00000 n +0000469394 00000 n +0000466292 00000 n +0000469703 00000 n +0000469828 00000 n +0000469538 00000 n +0000469953 00000 n +0000470077 00000 n +0000472457 00000 n +0000472021 00000 n +0000470327 00000 n +0000472144 00000 n +0000472269 00000 n +0000472394 00000 n +0000475584 00000 n +0000475148 00000 n +0000472587 00000 n +0000475271 00000 n +0000475521 00000 n +0000479410 00000 n +0000479099 00000 n +0000475714 00000 n +0000479222 00000 n +0002564017 00000 n +0000482087 00000 n +0000481777 00000 n +0000479554 00000 n +0000481900 00000 n +0000482025 00000 n +0000485293 00000 n +0000487028 00000 n +0000485140 00000 n +0000482231 00000 n +0000486526 00000 n +0000486651 00000 n +0000486106 00000 n +0000486316 00000 n +0000486714 00000 n +0000486777 00000 n +0000486840 00000 n +0000486903 00000 n +0000486966 00000 n +0000490556 00000 n +0000489932 00000 n +0000487229 00000 n 0000490055 00000 n -0000489090 00000 n -0000489301 00000 n -0000489510 00000 n -0000489721 00000 n 0000490118 00000 n -0000490181 00000 n -0000490244 00000 n -0000490307 00000 n -0000490370 00000 n -0000490433 00000 n -0000494062 00000 n -0000493376 00000 n -0000490682 00000 n -0000493499 00000 n -0000493624 00000 n -0000493749 00000 n -0000493874 00000 n -0000493999 00000 n -0002458217 00000 n -0000498125 00000 n -0000497092 00000 n -0000494192 00000 n -0000497560 00000 n -0000497685 00000 n -0000497245 00000 n -0000497810 00000 n -0000497409 00000 n -0000497935 00000 n -0000497998 00000 n -0000498061 00000 n -0000501048 00000 n -0000500862 00000 n -0000498255 00000 n -0000500985 00000 n -0000504775 00000 n -0000503889 00000 n -0000501164 00000 n -0000504587 00000 n -0000504712 00000 n -0000504051 00000 n -0000504201 00000 n -0000504374 00000 n -0000507291 00000 n -0000506731 00000 n -0000504962 00000 n -0000506854 00000 n -0000506979 00000 n -0000507103 00000 n -0000507228 00000 n -0000510969 00000 n -0000510003 00000 n -0000507478 00000 n -0000510656 00000 n -0000510165 00000 n -0000510327 00000 n -0000510497 00000 n -0000510781 00000 n -0000510906 00000 n -0000514373 00000 n -0000514248 00000 n -0000514811 00000 n -0000514000 00000 n -0000511142 00000 n -0000514123 00000 n -0000514498 00000 n -0000514623 00000 n -0000514748 00000 n -0002458342 00000 n -0000517111 00000 n -0000516800 00000 n -0000514927 00000 n -0000516923 00000 n -0000517048 00000 n -0000520499 00000 n -0000519938 00000 n -0000517255 00000 n -0000520061 00000 n -0000520311 00000 n -0000520436 00000 n -0000523830 00000 n -0000523142 00000 n -0000520601 00000 n -0000523265 00000 n -0000523390 00000 n -0000523515 00000 n -0000523578 00000 n -0000523642 00000 n -0000523767 00000 n -0000526886 00000 n -0000526146 00000 n -0000523946 00000 n -0000526447 00000 n -0000526510 00000 n -0000526573 00000 n -0000526290 00000 n -0000526636 00000 n -0000526699 00000 n -0000526823 00000 n -0000528219 00000 n -0000527909 00000 n -0000527044 00000 n -0000528032 00000 n -0000528095 00000 n -0000528157 00000 n -0000529249 00000 n -0000528813 00000 n -0000528307 00000 n -0000528936 00000 n -0000529186 00000 n -0002458467 00000 n -0000529915 00000 n -0000529667 00000 n -0000529337 00000 n -0000529790 00000 n -0000533349 00000 n -0000532850 00000 n -0000530003 00000 n -0000532973 00000 n -0000533036 00000 n -0000533286 00000 n -0000536443 00000 n -0000536132 00000 n -0000533508 00000 n -0000536255 00000 n -0000536380 00000 n -0000540071 00000 n -0000539635 00000 n -0000536559 00000 n -0000539758 00000 n -0000539883 00000 n -0000540008 00000 n -0000544021 00000 n -0000543207 00000 n -0000540173 00000 n -0000543330 00000 n -0000543455 00000 n -0000543518 00000 n -0000543581 00000 n -0000543644 00000 n -0000543707 00000 n -0000543770 00000 n -0000543833 00000 n -0000543958 00000 n -0000547628 00000 n -0000547318 00000 n -0000544165 00000 n -0000547441 00000 n -0000547565 00000 n -0002458592 00000 n -0000551260 00000 n -0000550822 00000 n -0000547758 00000 n -0000550945 00000 n -0000551133 00000 n -0000551197 00000 n -0000554718 00000 n -0000553973 00000 n -0000551362 00000 n -0000554278 00000 n -0000554341 00000 n -0000554403 00000 n -0000554466 00000 n -0000554530 00000 n -0000554655 00000 n -0000554117 00000 n -0000557924 00000 n -0000557986 00000 n -0000557423 00000 n -0000554834 00000 n -0000557546 00000 n -0000557609 00000 n -0000557672 00000 n -0000557735 00000 n -0000557799 00000 n -0000561705 00000 n -0000561018 00000 n -0000558102 00000 n -0000561141 00000 n -0000561266 00000 n -0000561329 00000 n -0000561392 00000 n -0000561455 00000 n -0000561518 00000 n -0000561642 00000 n -0000564669 00000 n -0000564108 00000 n -0000561821 00000 n -0000564231 00000 n -0000564356 00000 n -0000564481 00000 n -0000564606 00000 n -0000568300 00000 n -0000569303 00000 n -0000568177 00000 n -0000564785 00000 n -0000569115 00000 n -0000569240 00000 n -0002458717 00000 n -0000572795 00000 n -0000572484 00000 n -0000569476 00000 n -0000572607 00000 n -0000572732 00000 n -0000575306 00000 n -0000574746 00000 n -0000572911 00000 n -0000574869 00000 n -0000574994 00000 n -0000575118 00000 n -0000575243 00000 n -0000578711 00000 n -0000578275 00000 n -0000575422 00000 n -0000578398 00000 n -0000578523 00000 n -0000578648 00000 n -0000582223 00000 n -0000581787 00000 n -0000578898 00000 n -0000581910 00000 n -0000582035 00000 n -0000582160 00000 n -0000585749 00000 n -0000585438 00000 n -0000582353 00000 n -0000585561 00000 n -0000585686 00000 n -0000593207 00000 n -0000590365 00000 n -0000589755 00000 n -0000585936 00000 n -0000590052 00000 n -0000590177 00000 n -0000590302 00000 n -0000589899 00000 n -0002458842 00000 n -0000609663 00000 n -0000609980 00000 n -0000593084 00000 n -0000590467 00000 n -0000609600 00000 n -0000609726 00000 n -0000609789 00000 n -0000609853 00000 n -0000609916 00000 n -0000615608 00000 n -0000615041 00000 n -0000610147 00000 n -0000615164 00000 n -0000615227 00000 n -0000615290 00000 n -0000615354 00000 n -0000615417 00000 n -0000615481 00000 n -0000615544 00000 n -0000619410 00000 n -0000618537 00000 n -0000615710 00000 n -0000618660 00000 n -0000618723 00000 n -0000618786 00000 n -0000618848 00000 n -0000618973 00000 n -0000619098 00000 n -0000619222 00000 n -0000619347 00000 n -0000620376 00000 n -0000620190 00000 n -0000619526 00000 n -0000620313 00000 n -0000623850 00000 n -0000623289 00000 n -0000620478 00000 n -0000623412 00000 n -0000623662 00000 n -0000623787 00000 n -0000627667 00000 n -0000627356 00000 n -0000624009 00000 n -0000627479 00000 n -0000627604 00000 n -0002458967 00000 n -0000633262 00000 n -0000631573 00000 n -0000631137 00000 n -0000627783 00000 n -0000631260 00000 n -0000631385 00000 n -0000631510 00000 n -0000640036 00000 n -0000633139 00000 n -0000631689 00000 n -0000639785 00000 n -0000639848 00000 n -0000639911 00000 n -0000639974 00000 n -0000643778 00000 n -0000643217 00000 n -0000640245 00000 n -0000643340 00000 n -0000643465 00000 n -0000643590 00000 n -0000643715 00000 n -0000647637 00000 n -0000646950 00000 n -0000643908 00000 n -0000647073 00000 n -0000647198 00000 n -0000647261 00000 n -0000647325 00000 n -0000647450 00000 n -0000647574 00000 n -0000650130 00000 n -0000649820 00000 n -0000647767 00000 n -0000649943 00000 n -0000650068 00000 n -0000652726 00000 n -0000652240 00000 n -0000650288 00000 n -0000652537 00000 n -0000652384 00000 n -0000652600 00000 n -0000652663 00000 n -0002459092 00000 n -0000696772 00000 n -0000656577 00000 n -0000655953 00000 n -0000652856 00000 n -0000656076 00000 n -0000656139 00000 n -0000656264 00000 n -0000656389 00000 n -0000656514 00000 n -0000660911 00000 n -0000659699 00000 n -0000656707 00000 n -0000660598 00000 n -0000660723 00000 n -0000660848 00000 n -0000659870 00000 n -0000660038 00000 n -0000660233 00000 n -0000660427 00000 n -0000665568 00000 n -0000664193 00000 n -0000661098 00000 n -0000665256 00000 n -0000664373 00000 n -0000664559 00000 n -0000664759 00000 n -0000665381 00000 n -0000664932 00000 n -0000665506 00000 n -0000665085 00000 n -0000667804 00000 n -0000667493 00000 n -0000665698 00000 n -0000667616 00000 n -0000667741 00000 n -0000669458 00000 n -0000669147 00000 n -0000667920 00000 n -0000669270 00000 n -0000669395 00000 n -0000672069 00000 n -0000671635 00000 n -0000669574 00000 n -0000671758 00000 n -0000671883 00000 n -0000672007 00000 n -0002459217 00000 n -0000675125 00000 n -0000674689 00000 n -0000672256 00000 n -0000674812 00000 n -0000674875 00000 n -0000674938 00000 n -0000675062 00000 n -0000678906 00000 n -0000678264 00000 n -0000675227 00000 n -0000678718 00000 n -0000678417 00000 n -0000678843 00000 n -0000678565 00000 n -0000683336 00000 n -0000682898 00000 n -0000679050 00000 n -0000683021 00000 n -0000683084 00000 n -0000683147 00000 n -0000683273 00000 n -0000686064 00000 n +0000490243 00000 n +0000490368 00000 n +0000490493 00000 n +0000494715 00000 n +0000493526 00000 n +0000490714 00000 n +0000494154 00000 n +0000494279 00000 n +0000494404 00000 n +0000493688 00000 n +0000494528 00000 n +0000493852 00000 n +0000494653 00000 n +0000494002 00000 n +0000497545 00000 n +0000497671 00000 n +0000497359 00000 n +0000494888 00000 n +0000497482 00000 n +0000497608 00000 n +0000500363 00000 n +0000500052 00000 n +0000497801 00000 n +0000500175 00000 n +0000500300 00000 n +0002564142 00000 n +0000504692 00000 n +0000503460 00000 n +0000500521 00000 n +0000504379 00000 n +0000503631 00000 n +0000503782 00000 n +0000503955 00000 n +0000504167 00000 n +0000504629 00000 n +0000507248 00000 n +0000506937 00000 n +0000504907 00000 n +0000507060 00000 n +0000507185 00000 n +0000510939 00000 n +0000510100 00000 n +0000507449 00000 n +0000510751 00000 n +0000510262 00000 n +0000510423 00000 n +0000510592 00000 n +0000510876 00000 n +0000515136 00000 n +0000515011 00000 n +0000511992 00000 n +0000511806 00000 n +0000511112 00000 n +0000511929 00000 n +0000515324 00000 n +0000514638 00000 n +0000512108 00000 n +0000514761 00000 n +0000514886 00000 n +0000515261 00000 n +0000518608 00000 n +0000518047 00000 n +0000515511 00000 n +0000518170 00000 n +0000518295 00000 n +0000518420 00000 n +0000518545 00000 n +0002564267 00000 n +0000521422 00000 n +0000520987 00000 n +0000518766 00000 n +0000521110 00000 n +0000521235 00000 n +0000521359 00000 n +0000524747 00000 n +0000524186 00000 n +0000521594 00000 n +0000524309 00000 n +0000524559 00000 n +0000524684 00000 n +0000528711 00000 n +0000527525 00000 n +0000524849 00000 n +0000528147 00000 n +0000528272 00000 n +0000527687 00000 n +0000528397 00000 n +0000527841 00000 n +0000528460 00000 n +0000528523 00000 n +0000527994 00000 n +0000528649 00000 n +0000532407 00000 n +0000531469 00000 n +0000528869 00000 n +0000532092 00000 n +0000532155 00000 n +0000532218 00000 n +0000531631 00000 n +0000532281 00000 n +0000532344 00000 n +0000531788 00000 n +0000531942 00000 n +0000533761 00000 n +0001155031 00000 n +0000534012 00000 n +0000533575 00000 n +0000532608 00000 n +0000533698 00000 n +0000533824 00000 n +0000533949 00000 n +0000535054 00000 n +0000534618 00000 n +0000534142 00000 n +0000534741 00000 n +0000534991 00000 n +0002564392 00000 n +0000535706 00000 n +0000535458 00000 n +0000535142 00000 n +0000535581 00000 n +0000539163 00000 n +0000538664 00000 n +0000535794 00000 n +0000538787 00000 n +0000538850 00000 n +0000539100 00000 n +0000542108 00000 n +0000541798 00000 n +0000539322 00000 n +0000541921 00000 n +0000542046 00000 n +0000546144 00000 n +0000545583 00000 n +0000542252 00000 n +0000545706 00000 n +0000545956 00000 n +0000546081 00000 n +0000549560 00000 n +0000548872 00000 n +0000546274 00000 n +0000548995 00000 n +0000549058 00000 n +0000549121 00000 n +0000549183 00000 n +0000549246 00000 n +0000549309 00000 n +0000549372 00000 n +0000553078 00000 n +0000552767 00000 n +0000549690 00000 n +0000552890 00000 n +0000553015 00000 n +0002564517 00000 n +0000557224 00000 n +0000556451 00000 n +0000553194 00000 n +0000556910 00000 n +0000556604 00000 n +0000557098 00000 n +0000557161 00000 n +0000556758 00000 n +0000560384 00000 n +0000560887 00000 n +0000559695 00000 n +0000557354 00000 n +0000560321 00000 n +0000560447 00000 n +0000559857 00000 n +0000560510 00000 n +0000560573 00000 n +0000560697 00000 n +0000560012 00000 n +0000560760 00000 n +0000560823 00000 n +0000560161 00000 n +0000564550 00000 n +0000564613 00000 n +0000564004 00000 n +0000561045 00000 n +0000564298 00000 n +0000564148 00000 n +0000564361 00000 n +0000564424 00000 n +0000568234 00000 n +0000567547 00000 n +0000564757 00000 n +0000567670 00000 n +0000567795 00000 n +0000567858 00000 n +0000567920 00000 n +0000567983 00000 n +0000568046 00000 n +0000568171 00000 n +0000571209 00000 n +0000570648 00000 n +0000568364 00000 n +0000570771 00000 n +0000570896 00000 n +0000571021 00000 n +0000571146 00000 n +0000574809 00000 n +0000575812 00000 n +0000574686 00000 n +0000571353 00000 n +0000575624 00000 n +0000575749 00000 n +0002564642 00000 n +0000579426 00000 n +0000579115 00000 n +0000575999 00000 n +0000579238 00000 n +0000579363 00000 n +0000581991 00000 n +0000581431 00000 n +0000579584 00000 n +0000581554 00000 n +0000581679 00000 n +0000581803 00000 n +0000581928 00000 n +0000585186 00000 n +0000584750 00000 n +0000582107 00000 n +0000584873 00000 n +0000584998 00000 n +0000585123 00000 n +0000588543 00000 n +0000588108 00000 n +0000585373 00000 n +0000588231 00000 n +0000588356 00000 n +0000588481 00000 n +0000592237 00000 n +0000591926 00000 n +0000588701 00000 n +0000592049 00000 n +0000592174 00000 n +0000595020 00000 n +0000612003 00000 n +0000594876 00000 n +0000592438 00000 n +0000611566 00000 n +0000611691 00000 n +0000611816 00000 n +0000611413 00000 n +0000611879 00000 n +0000611940 00000 n +0002564767 00000 n +0000616913 00000 n +0000616111 00000 n +0000612170 00000 n +0000616723 00000 n +0000616273 00000 n +0000616786 00000 n +0000616849 00000 n +0000616427 00000 n +0000616576 00000 n +0000620261 00000 n +0000620641 00000 n +0000619751 00000 n +0000617043 00000 n +0000620198 00000 n +0000620324 00000 n +0000619904 00000 n +0000620387 00000 n +0000620450 00000 n +0000620051 00000 n +0000620514 00000 n +0000620577 00000 n +0000624363 00000 n +0000623489 00000 n +0000620743 00000 n +0000623612 00000 n +0000623675 00000 n +0000623738 00000 n +0000623801 00000 n +0000623926 00000 n +0000624051 00000 n +0000624176 00000 n +0000624301 00000 n +0000628009 00000 n +0000627524 00000 n +0000624507 00000 n +0000627822 00000 n +0000627947 00000 n +0000627668 00000 n +0000630667 00000 n +0000630231 00000 n +0000628139 00000 n +0000630354 00000 n +0000630604 00000 n +0000634542 00000 n +0000633935 00000 n +0000630840 00000 n +0000634230 00000 n +0000634355 00000 n +0000634079 00000 n +0000634479 00000 n +0002564892 00000 n +0000638495 00000 n +0000641251 00000 n +0000664489 00000 n +0000638558 00000 n +0000637909 00000 n +0000634672 00000 n +0000638370 00000 n +0000638062 00000 n +0000638215 00000 n +0000662217 00000 n +0000682466 00000 n +0000662469 00000 n +0000641128 00000 n +0000638702 00000 n +0000662154 00000 n +0000662280 00000 n +0000662406 00000 n +0000682593 00000 n +0000664366 00000 n +0000662636 00000 n +0000682403 00000 n +0000682529 00000 n +0000685815 00000 n +0000685255 00000 n +0000682788 00000 n +0000685378 00000 n +0000685503 00000 n 0000685628 00000 n -0000683480 00000 n -0000685751 00000 n -0000685876 00000 n -0000686001 00000 n -0000689654 00000 n -0000689092 00000 n -0000686222 00000 n -0000689215 00000 n -0000689340 00000 n -0000689464 00000 n -0000689527 00000 n -0000689590 00000 n -0000693956 00000 n -0000693518 00000 n -0000689841 00000 n -0000693641 00000 n -0000693704 00000 n -0000693767 00000 n -0000693893 00000 n -0002459342 00000 n -0000697209 00000 n -0000696223 00000 n -0000694072 00000 n -0000696522 00000 n -0000696647 00000 n -0000696897 00000 n -0000697022 00000 n -0000696367 00000 n -0000697146 00000 n -0000698503 00000 n -0000698192 00000 n -0000697339 00000 n -0000698315 00000 n -0000698440 00000 n -0000704099 00000 n -0000701941 00000 n -0000701505 00000 n -0000698619 00000 n -0000701628 00000 n -0000701878 00000 n -0000711801 00000 n -0000703976 00000 n -0000702114 00000 n -0000711298 00000 n -0000711361 00000 n -0000711424 00000 n -0000711487 00000 n -0000711613 00000 n -0000711676 00000 n -0000711739 00000 n -0000714383 00000 n -0000714009 00000 n -0000711968 00000 n -0000714132 00000 n -0000714195 00000 n -0000714320 00000 n -0000716962 00000 n -0000716274 00000 n -0000714513 00000 n -0000716397 00000 n -0000716522 00000 n -0000716647 00000 n -0000716710 00000 n -0000716774 00000 n -0000716899 00000 n -0002459467 00000 n -0000719961 00000 n -0000719278 00000 n -0000717092 00000 n -0000719401 00000 n -0000719526 00000 n -0000719651 00000 n -0000719776 00000 n -0000719899 00000 n -0000721644 00000 n -0000721458 00000 n -0000720091 00000 n -0000721581 00000 n -0000725048 00000 n -0000724612 00000 n -0000721760 00000 n -0000724735 00000 n -0000724985 00000 n -0000728891 00000 n -0000728455 00000 n -0000725178 00000 n -0000728578 00000 n -0000728703 00000 n -0000728828 00000 n -0000733051 00000 n -0000732865 00000 n -0000729035 00000 n -0000732988 00000 n -0002295652 00000 n -0002293374 00000 n -0002295484 00000 n -0000739085 00000 n -0000736516 00000 n -0000735781 00000 n -0000733195 00000 n -0000736076 00000 n -0000736201 00000 n -0000736264 00000 n -0000736327 00000 n -0000736453 00000 n -0000735925 00000 n -0002459592 00000 n -0000747233 00000 n -0000747550 00000 n -0000738962 00000 n -0000736646 00000 n -0000747170 00000 n -0000747296 00000 n -0000747359 00000 n -0000747423 00000 n -0000747487 00000 n -0000752505 00000 n -0000751693 00000 n -0000747717 00000 n -0000751816 00000 n -0000751941 00000 n -0000752065 00000 n -0000752128 00000 n -0000752191 00000 n -0000752317 00000 n -0000752442 00000 n -0000757975 00000 n -0000757411 00000 n -0000752621 00000 n -0000757534 00000 n -0000757597 00000 n -0000757660 00000 n -0000757723 00000 n -0000757786 00000 n -0000757912 00000 n -0000762170 00000 n -0000761297 00000 n -0000758091 00000 n -0000761420 00000 n -0000761545 00000 n -0000761670 00000 n -0000761733 00000 n -0000761795 00000 n -0000761920 00000 n -0000761982 00000 n -0000762045 00000 n -0000762107 00000 n -0000765890 00000 n -0000765330 00000 n -0000762314 00000 n -0000765453 00000 n -0000765578 00000 n -0000765703 00000 n -0000765827 00000 n -0000769055 00000 n -0000768619 00000 n -0000766077 00000 n -0000768742 00000 n -0000768867 00000 n -0000768992 00000 n -0002459717 00000 n -0000773075 00000 n -0000772515 00000 n -0000769199 00000 n -0000772638 00000 n -0000772763 00000 n -0000772887 00000 n -0000773012 00000 n -0000776574 00000 n -0000776263 00000 n -0000773191 00000 n -0000776386 00000 n -0000776511 00000 n -0000779877 00000 n -0000779566 00000 n -0000776718 00000 n -0000779689 00000 n -0000779814 00000 n -0000782569 00000 n -0000781945 00000 n -0000780036 00000 n -0000782068 00000 n -0000782193 00000 n -0000782317 00000 n -0000782380 00000 n -0000782443 00000 n -0000782506 00000 n -0000784222 00000 n -0000783847 00000 n -0000782742 00000 n -0000783970 00000 n -0000784033 00000 n -0000784096 00000 n -0000784159 00000 n -0000787493 00000 n -0000787057 00000 n -0000784381 00000 n -0000787180 00000 n -0000787305 00000 n -0000787430 00000 n -0002459842 00000 n -0000790627 00000 n -0000790067 00000 n -0000787694 00000 n -0000790190 00000 n -0000790440 00000 n -0000790565 00000 n -0000794868 00000 n -0000794558 00000 n -0000790786 00000 n -0000794681 00000 n -0000794805 00000 n -0000799161 00000 n -0000798975 00000 n -0000795012 00000 n -0000799098 00000 n -0000803008 00000 n -0000802449 00000 n -0000799277 00000 n -0000802572 00000 n -0000802697 00000 n -0000802822 00000 n -0000802947 00000 n -0000807053 00000 n -0000806367 00000 n -0000803110 00000 n -0000806490 00000 n -0000806615 00000 n -0000806740 00000 n -0000806865 00000 n -0000806990 00000 n -0000810734 00000 n -0000810299 00000 n -0000807155 00000 n -0000810422 00000 n -0000810546 00000 n -0000810671 00000 n -0002459967 00000 n -0000814635 00000 n -0000814324 00000 n -0000810850 00000 n -0000814447 00000 n -0000814572 00000 n -0000817944 00000 n -0000817383 00000 n -0000814751 00000 n -0000817506 00000 n -0000817631 00000 n -0000817756 00000 n -0000817881 00000 n -0000821509 00000 n -0000820946 00000 n -0000818046 00000 n -0000821069 00000 n -0000821132 00000 n -0000821195 00000 n -0000821258 00000 n -0000821322 00000 n -0000821446 00000 n -0000823730 00000 n -0000823544 00000 n -0000821625 00000 n -0000823667 00000 n -0000826488 00000 n -0000826177 00000 n -0000823889 00000 n -0000826300 00000 n -0000826425 00000 n -0000828923 00000 n -0000828487 00000 n -0000826675 00000 n -0000828610 00000 n -0000828735 00000 n -0000828860 00000 n -0002460092 00000 n -0000832725 00000 n -0000832289 00000 n -0000829039 00000 n -0000832412 00000 n -0000832537 00000 n -0000832662 00000 n -0000838367 00000 n -0000835247 00000 n -0000832855 00000 n -0000837930 00000 n -0000838055 00000 n -0000835490 00000 n -0000835678 00000 n -0000838180 00000 n -0000835865 00000 n -0000836053 00000 n -0000838304 00000 n -0000836240 00000 n -0000836452 00000 n -0000836663 00000 n -0000836875 00000 n -0000837085 00000 n -0000837297 00000 n -0000837508 00000 n -0000837719 00000 n -0000841840 00000 n -0000841150 00000 n -0000838497 00000 n -0000841273 00000 n -0000841525 00000 n -0000841651 00000 n -0000841777 00000 n -0000845028 00000 n -0000844464 00000 n -0000841942 00000 n -0000844587 00000 n -0000844713 00000 n -0000844839 00000 n -0000844965 00000 n -0000848056 00000 n -0000847618 00000 n -0000845144 00000 n -0000847741 00000 n -0000847867 00000 n -0000847993 00000 n -0000851378 00000 n -0000850498 00000 n -0000848158 00000 n -0000850812 00000 n -0000850938 00000 n -0000851064 00000 n -0000850642 00000 n -0000851189 00000 n -0000851315 00000 n -0002460217 00000 n -0000853710 00000 n -0000853398 00000 n -0000851494 00000 n -0000853521 00000 n -0000853647 00000 n -0000857317 00000 n -0000856753 00000 n -0000853812 00000 n -0000856876 00000 n -0000857128 00000 n -0000857254 00000 n -0000860922 00000 n -0000860358 00000 n -0000857419 00000 n -0000860481 00000 n -0000860607 00000 n -0000860733 00000 n -0000860859 00000 n -0000863152 00000 n -0000872046 00000 n -0000863029 00000 n -0000861024 00000 n -0000871668 00000 n -0000871794 00000 n -0000871857 00000 n -0000871920 00000 n -0000871983 00000 n -0000875661 00000 n -0000875223 00000 n -0000872227 00000 n -0000875346 00000 n -0000875472 00000 n -0000875598 00000 n -0000879529 00000 n -0000878908 00000 n -0000875791 00000 n -0000879214 00000 n -0000879340 00000 n -0000879466 00000 n -0000879052 00000 n -0002460342 00000 n -0000881644 00000 n -0000881333 00000 n -0000879688 00000 n -0000881456 00000 n -0000881582 00000 n -0000884813 00000 n -0000883992 00000 n -0000881746 00000 n -0000884371 00000 n -0000884623 00000 n -0000884136 00000 n -0000884686 00000 n -0000884750 00000 n -0000887061 00000 n -0000886749 00000 n -0000884943 00000 n -0000886872 00000 n -0000886998 00000 n -0000890638 00000 n -0000890074 00000 n -0000887191 00000 n -0000890197 00000 n -0000890449 00000 n -0000890575 00000 n -0000894680 00000 n -0000893802 00000 n -0000890783 00000 n -0000893925 00000 n -0000894050 00000 n -0000894113 00000 n -0000894176 00000 n -0000894239 00000 n -0000894302 00000 n -0000894365 00000 n -0000894428 00000 n -0000894491 00000 n -0000894617 00000 n -0000898350 00000 n -0000897786 00000 n -0000894853 00000 n -0000897909 00000 n -0000898035 00000 n -0000898161 00000 n -0000898224 00000 n -0000898287 00000 n -0002460467 00000 n -0000900572 00000 n -0000900260 00000 n -0000898466 00000 n -0000900383 00000 n -0000900509 00000 n -0000903048 00000 n -0000902737 00000 n -0000900688 00000 n -0000902860 00000 n -0000902985 00000 n -0000905377 00000 n -0000905191 00000 n -0000903235 00000 n -0000905314 00000 n -0000909556 00000 n -0000908820 00000 n -0000905521 00000 n -0000909115 00000 n -0000909241 00000 n -0000908964 00000 n -0000909367 00000 n -0000909493 00000 n -0000911888 00000 n -0000916257 00000 n -0000911951 00000 n -0000911638 00000 n -0000909700 00000 n -0000911761 00000 n -0000911824 00000 n -0000917133 00000 n -0000916134 00000 n -0000912053 00000 n -0000917070 00000 n -0002460592 00000 n -0000921656 00000 n -0000921345 00000 n -0000917321 00000 n -0000921468 00000 n -0000921594 00000 n -0000925819 00000 n -0000925382 00000 n -0000921786 00000 n -0000925505 00000 n -0000925631 00000 n -0000925756 00000 n -0000930317 00000 n -0000929942 00000 n -0000925921 00000 n -0000930065 00000 n -0000930191 00000 n -0000930254 00000 n +0000685752 00000 n +0000690412 00000 n +0000689156 00000 n +0000685973 00000 n +0000689849 00000 n +0000689974 00000 n +0000689318 00000 n +0000690037 00000 n +0000690100 00000 n +0000689481 00000 n +0000689649 00000 n +0000690224 00000 n +0000690349 00000 n +0000692860 00000 n +0000692674 00000 n +0000690584 00000 n +0000692797 00000 n +0002565017 00000 n +0000695600 00000 n +0000695053 00000 n +0000693018 00000 n +0000695350 00000 n +0000695475 00000 n +0000695197 00000 n +0000695538 00000 n +0000733533 00000 n +0000699327 00000 n +0000698642 00000 n +0000695758 00000 n +0000698765 00000 n +0000698828 00000 n +0000698891 00000 n +0000699015 00000 n +0000699139 00000 n +0000699264 00000 n +0000703834 00000 n +0000702431 00000 n +0000699485 00000 n +0000703521 00000 n +0000703646 00000 n +0000703771 00000 n +0000702611 00000 n +0000702780 00000 n +0000702975 00000 n +0000703169 00000 n +0000703337 00000 n +0000708336 00000 n +0000707156 00000 n +0000703964 00000 n +0000708023 00000 n +0000707327 00000 n +0000707527 00000 n +0000708148 00000 n +0000707700 00000 n +0000708273 00000 n +0000707853 00000 n +0000710571 00000 n +0000710260 00000 n +0000708480 00000 n +0000710383 00000 n +0000710508 00000 n +0000712189 00000 n +0000711878 00000 n +0000710701 00000 n +0000712001 00000 n +0000712126 00000 n +0002565142 00000 n +0000713515 00000 n +0000713329 00000 n +0000712305 00000 n +0000713452 00000 n +0000717141 00000 n +0000716407 00000 n +0000713631 00000 n +0000716703 00000 n +0000716828 00000 n +0000716551 00000 n +0000716953 00000 n +0000717078 00000 n +0000720602 00000 n +0000720728 00000 n +0000720245 00000 n +0000717356 00000 n +0000720539 00000 n +0000720665 00000 n +0000720389 00000 n +0000724410 00000 n +0000723295 00000 n +0000720886 00000 n +0000724097 00000 n +0000724222 00000 n +0000723466 00000 n +0000723626 00000 n +0000723786 00000 n +0000723944 00000 n +0000724347 00000 n +0000740128 00000 n +0000742854 00000 n +0000726855 00000 n +0000726245 00000 n +0000724568 00000 n +0000726543 00000 n +0000726668 00000 n +0000726389 00000 n +0000726793 00000 n +0000742981 00000 n +0000730690 00000 n +0000729759 00000 n +0000726985 00000 n +0000730378 00000 n +0000730503 00000 n +0000730627 00000 n +0000729921 00000 n +0000730071 00000 n +0000730228 00000 n +0002565267 00000 n +0000743108 00000 n +0000745572 00000 n +0000733095 00000 n +0000733594 00000 n +0000732909 00000 n +0000730877 00000 n +0000733032 00000 n +0000733158 00000 n +0000733283 00000 n +0000733408 00000 n +0000736439 00000 n +0000735577 00000 n +0000733752 00000 n +0000735876 00000 n +0000736001 00000 n +0000736126 00000 n +0000735721 00000 n +0000736251 00000 n +0000736376 00000 n +0000740255 00000 n +0000739942 00000 n +0000736583 00000 n +0000740065 00000 n +0000740191 00000 n +0000743234 00000 n +0000742668 00000 n +0000740385 00000 n +0000742791 00000 n +0000742917 00000 n +0000743044 00000 n +0000743171 00000 n +0000745699 00000 n +0000745386 00000 n +0000743364 00000 n +0000745509 00000 n +0000745635 00000 n +0000751449 00000 n +0000767613 00000 n +0000787151 00000 n +0000749719 00000 n +0000748769 00000 n +0000745801 00000 n +0000749406 00000 n +0000749656 00000 n +0000748931 00000 n +0000749088 00000 n +0000749243 00000 n +0002565392 00000 n +0000784011 00000 n +0000784138 00000 n +0000791951 00000 n +0000784265 00000 n +0000751326 00000 n +0000749906 00000 n +0000783948 00000 n +0000784074 00000 n +0000784201 00000 n +0000792391 00000 n +0000787028 00000 n +0000784432 00000 n +0000791888 00000 n +0000792014 00000 n +0000792140 00000 n +0000792202 00000 n +0000792265 00000 n +0000792328 00000 n +0000795796 00000 n +0000795188 00000 n +0000792559 00000 n +0000795483 00000 n +0000795608 00000 n +0000795332 00000 n +0000795733 00000 n +0000798855 00000 n +0000799354 00000 n +0000798331 00000 n +0000795997 00000 n +0000798792 00000 n +0000798918 00000 n +0000799042 00000 n +0000799167 00000 n +0000798484 00000 n +0000798639 00000 n +0000799292 00000 n +0000802055 00000 n +0000802181 00000 n +0000802556 00000 n +0000801528 00000 n +0000799498 00000 n +0000801992 00000 n +0000802118 00000 n +0000802244 00000 n +0000801681 00000 n +0000801837 00000 n +0000802369 00000 n +0000802493 00000 n +0000805028 00000 n +0000805780 00000 n +0000804842 00000 n +0000802714 00000 n +0000804965 00000 n +0000805091 00000 n +0000805216 00000 n +0000805341 00000 n +0000805404 00000 n +0000805467 00000 n +0000805530 00000 n +0000805593 00000 n +0000805656 00000 n +0000805719 00000 n +0002565517 00000 n +0000807152 00000 n +0000806777 00000 n +0000805938 00000 n +0000806900 00000 n +0000806963 00000 n +0000807026 00000 n +0000807089 00000 n +0000810527 00000 n +0000810091 00000 n +0000807282 00000 n +0000810214 00000 n +0000810464 00000 n +0000814223 00000 n +0000813787 00000 n +0000810657 00000 n +0000813910 00000 n +0000814035 00000 n +0000814160 00000 n +0000817484 00000 n +0000817298 00000 n +0000814367 00000 n +0000817421 00000 n +0000820975 00000 n +0000820412 00000 n +0000817628 00000 n +0000820535 00000 n +0000820660 00000 n +0000820723 00000 n +0000820786 00000 n +0000820912 00000 n +0000823473 00000 n +0000832025 00000 n +0000823329 00000 n +0000821105 00000 n +0000831709 00000 n +0000831558 00000 n +0000831772 00000 n +0000831835 00000 n +0000831899 00000 n +0000831961 00000 n +0002565642 00000 n +0000836097 00000 n +0000835213 00000 n +0000832179 00000 n +0000835660 00000 n +0000835785 00000 n +0000835909 00000 n +0000835366 00000 n +0000836034 00000 n +0000835511 00000 n +0000840143 00000 n +0000843285 00000 n +0000840518 00000 n +0000839790 00000 n +0000836227 00000 n +0000840080 00000 n +0000840206 00000 n +0000840331 00000 n +0000839934 00000 n +0000840456 00000 n +0000847151 00000 n +0000843661 00000 n +0000843099 00000 n +0000840662 00000 n +0000843222 00000 n +0000843348 00000 n +0000843473 00000 n +0000843598 00000 n +0000847528 00000 n +0000846965 00000 n +0000843805 00000 n +0000847088 00000 n +0000847214 00000 n +0000847277 00000 n +0000847340 00000 n +0000847465 00000 n +0000851304 00000 n +0000850684 00000 n +0000847672 00000 n +0000850807 00000 n +0000850870 00000 n +0000850929 00000 n +0000850992 00000 n +0000851116 00000 n +0000851241 00000 n +0000855420 00000 n +0000854984 00000 n +0000851505 00000 n +0000855107 00000 n +0000855232 00000 n +0000855357 00000 n +0002382801 00000 n +0002380928 00000 n +0002382633 00000 n +0002565767 00000 n +0000859464 00000 n +0000858903 00000 n +0000855649 00000 n +0000859026 00000 n +0000859151 00000 n +0000859276 00000 n +0000859401 00000 n +0000863135 00000 n +0000862699 00000 n +0000859622 00000 n +0000862822 00000 n +0000862947 00000 n +0000863072 00000 n +0000866142 00000 n +0000865956 00000 n +0000863293 00000 n +0000866079 00000 n +0000869631 00000 n +0000868945 00000 n +0000866286 00000 n +0000869068 00000 n +0000869193 00000 n +0000869318 00000 n +0000869443 00000 n +0000869506 00000 n +0000869569 00000 n +0000871469 00000 n +0000871095 00000 n +0000869804 00000 n +0000871218 00000 n +0000871281 00000 n +0000871344 00000 n +0000871407 00000 n +0000874771 00000 n +0000874273 00000 n +0000871642 00000 n +0000874396 00000 n +0000874459 00000 n +0000874583 00000 n +0000874708 00000 n +0002565892 00000 n +0000875698 00000 n +0000875512 00000 n +0000874986 00000 n +0000875635 00000 n +0000878659 00000 n +0000878098 00000 n +0000875786 00000 n +0000878221 00000 n +0000878471 00000 n +0000878596 00000 n +0000882507 00000 n +0000882196 00000 n +0000878818 00000 n +0000882319 00000 n +0000882444 00000 n +0000886500 00000 n +0000886314 00000 n +0000882679 00000 n +0000886437 00000 n +0000890301 00000 n +0000889866 00000 n +0000886616 00000 n +0000889989 00000 n +0000890114 00000 n +0000890238 00000 n +0000894210 00000 n +0000893525 00000 n +0000890403 00000 n +0000893648 00000 n +0000893773 00000 n +0000893898 00000 n +0000894022 00000 n +0000894147 00000 n +0002566017 00000 n +0000898015 00000 n +0000897455 00000 n +0000894312 00000 n +0000897578 00000 n +0000897703 00000 n +0000897827 00000 n +0000897952 00000 n +0000902019 00000 n +0000901708 00000 n +0000898159 00000 n +0000901831 00000 n +0000901956 00000 n +0000905159 00000 n +0000904599 00000 n +0000902135 00000 n +0000904722 00000 n +0000904847 00000 n +0000904972 00000 n +0000905097 00000 n +0000909221 00000 n +0000908331 00000 n +0000905289 00000 n +0000908779 00000 n +0000908484 00000 n +0000908842 00000 n +0000908905 00000 n +0000908632 00000 n +0000908968 00000 n +0000909031 00000 n +0000909158 00000 n +0000911753 00000 n +0000911567 00000 n +0000909365 00000 n +0000911690 00000 n +0000913999 00000 n +0000913813 00000 n +0000911912 00000 n +0000913936 00000 n +0002566142 00000 n +0000916074 00000 n +0000915636 00000 n +0000914172 00000 n +0000915759 00000 n +0000915885 00000 n +0000916011 00000 n +0000920146 00000 n +0000919513 00000 n +0000916190 00000 n +0000919831 00000 n +0000919957 00000 n +0000920083 00000 n +0000919657 00000 n +0000925111 00000 n +0000922530 00000 n +0000920262 00000 n +0000924545 00000 n +0000924671 00000 n +0000924797 00000 n +0000922746 00000 n +0000922934 00000 n +0000924923 00000 n +0000923120 00000 n +0000923308 00000 n +0000925049 00000 n +0000923495 00000 n +0000923706 00000 n +0000923916 00000 n +0000924126 00000 n +0000924336 00000 n +0000926963 00000 n +0000925887 00000 n +0000925241 00000 n +0000926058 00000 n +0000926900 00000 n +0000926269 00000 n +0000926479 00000 n +0000926690 00000 n +0000930827 00000 n +0000929792 00000 n +0000927065 00000 n +0000930260 00000 n +0000930512 00000 n +0000930638 00000 n +0002379032 00000 n +0002377023 00000 n +0002378865 00000 n +0000929945 00000 n +0000930103 00000 n +0000930764 00000 n +0000934049 00000 n +0000933485 00000 n +0000930957 00000 n +0000933608 00000 n +0000933734 00000 n +0000933860 00000 n +0000933986 00000 n +0002566267 00000 n +0000937114 00000 n +0000936676 00000 n 0000934193 00000 n -0000933881 00000 n -0000930447 00000 n -0000934004 00000 n -0000934130 00000 n -0000938771 00000 n -0000937948 00000 n -0000934337 00000 n -0000938456 00000 n -0000938582 00000 n -0000938101 00000 n -0000938282 00000 n -0000938708 00000 n -0000942824 00000 n -0000942512 00000 n -0000938901 00000 n -0000942635 00000 n -0000942761 00000 n -0002460717 00000 n -0000946274 00000 n -0000945710 00000 n -0000942968 00000 n -0000945833 00000 n -0000945959 00000 n -0000946021 00000 n -0000946085 00000 n -0000946211 00000 n -0000950072 00000 n -0000949761 00000 n -0000946404 00000 n -0000949884 00000 n -0000950009 00000 n -0000953385 00000 n -0000953074 00000 n -0000950245 00000 n -0000953197 00000 n -0000953322 00000 n -0000957825 00000 n -0000957199 00000 n -0000953614 00000 n -0000957322 00000 n -0000957448 00000 n -0000957574 00000 n -0000957637 00000 n -0000957700 00000 n -0000957763 00000 n -0000961976 00000 n -0000961601 00000 n -0000957969 00000 n -0000961724 00000 n -0000961787 00000 n -0000961913 00000 n -0000965172 00000 n -0000964860 00000 n -0000962134 00000 n -0000964983 00000 n -0000965109 00000 n -0002460842 00000 n -0000968453 00000 n -0000968142 00000 n -0000965373 00000 n -0000968265 00000 n -0000968390 00000 n -0000970936 00000 n -0000970624 00000 n -0000968611 00000 n -0000970747 00000 n -0000970873 00000 n -0000973559 00000 n -0000973247 00000 n -0000971080 00000 n -0000973370 00000 n -0000973496 00000 n -0000976308 00000 n -0000975996 00000 n +0000936799 00000 n +0000936925 00000 n +0000937051 00000 n +0000940454 00000 n +0000939573 00000 n +0000937258 00000 n +0000939887 00000 n +0000940013 00000 n +0000940139 00000 n +0000939717 00000 n +0000940265 00000 n +0000940391 00000 n +0000942840 00000 n +0000942528 00000 n +0000940570 00000 n +0000942651 00000 n +0000942777 00000 n +0000946503 00000 n +0000945940 00000 n +0000942984 00000 n +0000946063 00000 n +0000946315 00000 n +0000946441 00000 n +0000952050 00000 n +0000950348 00000 n +0000949658 00000 n +0000946605 00000 n +0000949781 00000 n +0000949907 00000 n +0000950033 00000 n +0000950159 00000 n +0000950285 00000 n +0000960756 00000 n +0000951927 00000 n +0000950450 00000 n +0000960566 00000 n +0000960629 00000 n +0000960692 00000 n +0002566392 00000 n +0000964370 00000 n +0000963932 00000 n +0000960924 00000 n +0000964055 00000 n +0000964181 00000 n +0000964307 00000 n +0000968487 00000 n +0000967864 00000 n +0000964500 00000 n +0000968172 00000 n +0000968298 00000 n +0000968424 00000 n +0000968008 00000 n +0000970101 00000 n +0000969790 00000 n +0000968660 00000 n +0000969913 00000 n +0000970038 00000 n +0000973767 00000 n +0000972632 00000 n +0000970217 00000 n +0000973325 00000 n +0000973577 00000 n +0000972794 00000 n +0000973028 00000 n +0000973177 00000 n +0000973640 00000 n 0000973703 00000 n -0000976119 00000 n -0000976245 00000 n -0000979846 00000 n -0000979536 00000 n -0000976438 00000 n -0000979659 00000 n -0000979785 00000 n -0000983113 00000 n -0000982675 00000 n -0000979990 00000 n -0000982798 00000 n -0000982924 00000 n -0000983050 00000 n -0002460967 00000 n -0000986383 00000 n -0000985946 00000 n -0000983257 00000 n -0000986069 00000 n -0000986195 00000 n -0000986321 00000 n -0000990356 00000 n -0000990044 00000 n -0000986584 00000 n -0000990167 00000 n -0000990293 00000 n -0000994074 00000 n -0000993888 00000 n -0000990500 00000 n -0000994011 00000 n -0000997722 00000 n -0000997284 00000 n -0000994204 00000 n -0000997407 00000 n -0000997533 00000 n -0000997659 00000 n -0001002146 00000 n -0001001144 00000 n -0000997866 00000 n -0001001267 00000 n -0001001392 00000 n -0001001518 00000 n -0001001581 00000 n -0001001643 00000 n -0001001706 00000 n -0001001769 00000 n -0001001832 00000 n -0001001895 00000 n -0001001958 00000 n -0001002021 00000 n -0001002084 00000 n -0001005694 00000 n -0001009549 00000 n -0001005571 00000 n -0001002276 00000 n -0001009108 00000 n -0001009171 00000 n -0001009234 00000 n -0001009297 00000 n -0001009360 00000 n -0001009423 00000 n -0001009486 00000 n -0002461092 00000 n -0001008937 00000 n -0001008995 00000 n -0001009085 00000 n -0001011850 00000 n -0001011538 00000 n -0001009737 00000 n -0001011661 00000 n -0001011787 00000 n -0001014028 00000 n -0001013716 00000 n -0001011980 00000 n -0001013839 00000 n -0001013965 00000 n -0001017785 00000 n -0001017473 00000 n -0001014186 00000 n -0001017596 00000 n -0001017722 00000 n -0001021573 00000 n -0001021261 00000 n -0001017987 00000 n -0001021384 00000 n -0001021510 00000 n -0001022946 00000 n -0001022760 00000 n -0001021731 00000 n -0001022883 00000 n -0001024619 00000 n -0001024433 00000 n -0001023048 00000 n -0001024556 00000 n -0002461217 00000 n -0001028955 00000 n -0001027874 00000 n -0001024721 00000 n -0001028388 00000 n -0001028514 00000 n -0001028640 00000 n -0001028766 00000 n -0001028027 00000 n -0001028208 00000 n -0001028892 00000 n -0001032404 00000 n -0001031716 00000 n -0001029085 00000 n -0001031839 00000 n -0001031965 00000 n -0001032091 00000 n -0001032216 00000 n -0001032279 00000 n -0001032342 00000 n -0001036552 00000 n -0001035727 00000 n -0001032534 00000 n -0001036300 00000 n -0001036363 00000 n -0001036489 00000 n -0001035880 00000 n -0001036091 00000 n -0001040178 00000 n -0001039992 00000 n -0001036696 00000 n -0001040115 00000 n -0001044390 00000 n -0001043751 00000 n -0001040322 00000 n -0001044075 00000 n -0001044201 00000 n -0001044327 00000 n -0001043895 00000 n -0001046730 00000 n -0001046040 00000 n -0001044548 00000 n -0001046163 00000 n -0001046289 00000 n -0001046415 00000 n -0001046541 00000 n -0001046667 00000 n -0002461342 00000 n -0001051040 00000 n -0001049854 00000 n -0001046860 00000 n -0001050348 00000 n -0001050600 00000 n -0001050726 00000 n -0001050007 00000 n -0001050852 00000 n -0001050176 00000 n -0001050978 00000 n -0001054676 00000 n -0001054155 00000 n -0001051142 00000 n -0001054487 00000 n -0001054299 00000 n -0001054613 00000 n -0001058127 00000 n -0001057562 00000 n -0001054892 00000 n -0001057685 00000 n -0001057811 00000 n -0001057874 00000 n -0001057938 00000 n -0001058064 00000 n -0001061250 00000 n -0001060685 00000 n -0001058229 00000 n -0001060808 00000 n -0001060871 00000 n -0001060935 00000 n -0001061061 00000 n -0001061187 00000 n -0001064947 00000 n -0001064383 00000 n -0001061394 00000 n -0001064506 00000 n -0001064632 00000 n -0001064758 00000 n -0001064884 00000 n -0001068424 00000 n -0001068112 00000 n -0001065091 00000 n -0001068235 00000 n -0001068361 00000 n -0002461467 00000 n -0001072318 00000 n -0001071880 00000 n -0001068653 00000 n -0001072003 00000 n -0001072129 00000 n -0001072255 00000 n -0001075420 00000 n -0001091964 00000 n -0001075297 00000 n -0001072448 00000 n -0001091459 00000 n -0001091585 00000 n -0001091648 00000 n -0001091711 00000 n -0001091774 00000 n -0001091901 00000 n -0001091271 00000 n -0001098001 00000 n -0001096362 00000 n -0001096050 00000 n -0001092210 00000 n -0001096173 00000 n -0001096299 00000 n -0001109376 00000 n -0001122064 00000 n -0001097878 00000 n -0001096549 00000 n -0001121497 00000 n -0001121560 00000 n -0001121623 00000 n -0001121686 00000 n -0001121812 00000 n -0001121875 00000 n -0001121938 00000 n -0001122001 00000 n -0001109191 00000 n -0001121311 00000 n -0001126097 00000 n -0001125785 00000 n -0001122269 00000 n -0001125908 00000 n -0001126034 00000 n -0001130006 00000 n -0001129178 00000 n -0001126285 00000 n -0001129691 00000 n -0001129817 00000 n -0001129331 00000 n -0001129511 00000 n -0001129943 00000 n -0002461592 00000 n -0001134831 00000 n -0001134001 00000 n -0001130236 00000 n -0001134516 00000 n -0001134642 00000 n -0001134154 00000 n -0001134338 00000 n -0001134768 00000 n -0001138086 00000 n -0001137774 00000 n -0001134989 00000 n -0001137897 00000 n -0001138023 00000 n -0001141158 00000 n -0001140846 00000 n -0001138315 00000 n -0001140969 00000 n -0001141095 00000 n -0001143622 00000 n -0001161155 00000 n -0001184073 00000 n -0001143499 00000 n -0001141360 00000 n -0001183379 00000 n -0001183505 00000 n -0001183568 00000 n -0001183631 00000 n -0001183694 00000 n -0001183820 00000 n -0001183883 00000 n -0001183946 00000 n -0001184009 00000 n -0001160969 00000 n -0001183191 00000 n -0001187392 00000 n -0001217217 00000 n -0001214393 00000 n -0001187269 00000 n -0001184278 00000 n -0001214014 00000 n -0001214140 00000 n -0001214203 00000 n -0001214266 00000 n -0001214329 00000 n -0001213826 00000 n -0001244582 00000 n -0001284340 00000 n -0001242190 00000 n -0001217094 00000 n -0001214597 00000 n -0001241560 00000 n -0001241623 00000 n -0001241686 00000 n -0001241749 00000 n -0001241875 00000 n -0001242001 00000 n -0001242127 00000 n -0002461717 00000 n -0001241372 00000 n -0001281474 00000 n -0001244459 00000 n -0001242366 00000 n -0001281222 00000 n -0001281285 00000 n -0001281348 00000 n -0001281411 00000 n -0001281034 00000 n -0001309883 00000 n -0001284217 00000 n -0001281650 00000 n -0001309631 00000 n -0001309694 00000 n -0001309757 00000 n -0001309820 00000 n -0001309443 00000 n -0001313581 00000 n -0001313144 00000 n -0001310087 00000 n -0001313267 00000 n -0001313393 00000 n -0001313518 00000 n -0001317404 00000 n -0001316840 00000 n -0001313711 00000 n -0001316963 00000 n -0001317089 00000 n -0001317215 00000 n -0001317341 00000 n -0001320280 00000 n -0001320094 00000 n -0001317606 00000 n -0001320217 00000 n -0001324451 00000 n -0001323888 00000 n -0001320495 00000 n -0001324011 00000 n -0001324137 00000 n -0001324199 00000 n -0001324261 00000 n -0001324388 00000 n -0002461842 00000 n -0001327231 00000 n -0001366234 00000 n -0001327087 00000 n -0001324581 00000 n -0001365981 00000 n -0001366044 00000 n -0001366107 00000 n -0001366170 00000 n -0001365799 00000 n -0001365611 00000 n -0001369464 00000 n -0001371778 00000 n -0001369320 00000 n -0001366438 00000 n -0001371399 00000 n -0001371525 00000 n -0001371245 00000 n -0001371588 00000 n -0001371651 00000 n -0001371714 00000 n -0001375331 00000 n -0001379925 00000 n -0001375151 00000 n -0001371974 00000 n -0001379546 00000 n -0001378640 00000 n -0001379609 00000 n -0001379672 00000 n -0001379735 00000 n -0001379862 00000 n -0001378797 00000 n -0001378978 00000 n -0001379161 00000 n -0001379336 00000 n -0001384214 00000 n -0001383045 00000 n -0001380121 00000 n -0001383777 00000 n -0001383207 00000 n -0001383387 00000 n -0001383903 00000 n -0001383565 00000 n -0001384028 00000 n -0001384152 00000 n -0001386723 00000 n -0001412331 00000 n -0001409723 00000 n -0001386600 00000 n -0001384415 00000 n -0001409220 00000 n -0001409346 00000 n -0001409409 00000 n -0001409472 00000 n -0001409535 00000 n -0001409661 00000 n -0001409034 00000 n -0001436828 00000 n -0001412208 00000 n -0001409913 00000 n -0001436326 00000 n -0001436389 00000 n -0001436452 00000 n -0001436515 00000 n -0001436641 00000 n -0001436766 00000 n -0002461967 00000 n -0001436138 00000 n -0001439586 00000 n -0001464351 00000 n -0001439463 00000 n -0001437032 00000 n -0001463846 00000 n -0001463909 00000 n -0001463972 00000 n -0001464035 00000 n -0001464162 00000 n -0001464288 00000 n -0001463658 00000 n -0001468418 00000 n -0001467780 00000 n -0001464541 00000 n -0001468103 00000 n -0001467924 00000 n -0001468229 00000 n -0001468355 00000 n -0001472817 00000 n -0001472001 00000 n -0001468576 00000 n -0001472124 00000 n -0001472250 00000 n -0001472376 00000 n -0001472502 00000 n -0001472628 00000 n -0001472754 00000 n -0001476592 00000 n -0001476028 00000 n -0001472919 00000 n -0001476151 00000 n -0001476277 00000 n -0001476403 00000 n -0001476529 00000 n -0001479224 00000 n -0001478582 00000 n -0001476722 00000 n -0001478908 00000 n -0001478971 00000 n -0001479035 00000 n -0001479161 00000 n -0001478726 00000 n -0001481776 00000 n -0001481464 00000 n -0001479354 00000 n -0001481587 00000 n -0001481713 00000 n -0002462092 00000 n -0001484578 00000 n -0001484266 00000 n -0001481977 00000 n -0001484389 00000 n -0001484515 00000 n -0001487961 00000 n -0001487320 00000 n -0001484751 00000 n -0001487647 00000 n -0001487773 00000 n -0001487464 00000 n -0001487898 00000 n -0001492799 00000 n -0001492059 00000 n -0001488177 00000 n -0001492355 00000 n -0001492418 00000 n -0001492482 00000 n -0001492546 00000 n -0001492610 00000 n -0001492203 00000 n -0001492736 00000 n -0001496971 00000 n -0001496533 00000 n -0001493014 00000 n -0001496656 00000 n -0001496782 00000 n -0001496908 00000 n -0001498731 00000 n -0001498545 00000 n -0001497115 00000 n -0001498668 00000 n -0001502046 00000 n -0001501421 00000 n -0001498890 00000 n -0001501544 00000 n -0001501669 00000 n -0001501731 00000 n -0001501794 00000 n -0001501857 00000 n -0001501920 00000 n -0001501983 00000 n -0002462217 00000 n -0001507687 00000 n -0001505445 00000 n -0001504694 00000 n -0001502162 00000 n -0001504817 00000 n -0001504943 00000 n -0001505006 00000 n -0001505069 00000 n -0001505132 00000 n -0001505256 00000 n -0001505382 00000 n -0001552700 00000 n -0001507564 00000 n -0001505632 00000 n -0001552322 00000 n -0001552385 00000 n -0001552448 00000 n -0001552511 00000 n -0001552637 00000 n -0001552134 00000 n -0001556340 00000 n -0001556028 00000 n -0001552904 00000 n -0001556151 00000 n -0001556277 00000 n -0001560039 00000 n -0001559349 00000 n -0001556541 00000 n -0001559472 00000 n -0001559598 00000 n -0001559661 00000 n -0001559724 00000 n -0001559787 00000 n -0001559850 00000 n -0001559976 00000 n -0002291464 00000 n -0002289463 00000 n -0002291298 00000 n -0001563822 00000 n -0001563385 00000 n -0001560183 00000 n -0001563508 00000 n -0001563634 00000 n -0001563759 00000 n -0001566905 00000 n -0001566593 00000 n -0001564008 00000 n -0001566716 00000 n -0001566842 00000 n -0002462342 00000 n -0001570472 00000 n -0001569971 00000 n -0001567077 00000 n -0001570094 00000 n -0001570220 00000 n -0001570283 00000 n -0002287625 00000 n -0002275471 00000 n -0002287457 00000 n -0001570346 00000 n -0001570409 00000 n -0001573052 00000 n -0001572678 00000 n -0001570644 00000 n -0001572801 00000 n -0001572864 00000 n -0001572927 00000 n -0001572990 00000 n -0001575553 00000 n -0001575178 00000 n -0001573196 00000 n -0001575301 00000 n -0001575364 00000 n -0001575427 00000 n -0001575490 00000 n -0001577610 00000 n -0001577299 00000 n -0001575669 00000 n -0001577422 00000 n -0001577485 00000 n -0001577548 00000 n -0001580808 00000 n -0001580245 00000 n -0001577740 00000 n -0001580368 00000 n -0001580431 00000 n -0001580494 00000 n -0001580557 00000 n -0001580620 00000 n -0001580745 00000 n -0001583192 00000 n -0001582880 00000 n -0001580952 00000 n -0001583003 00000 n -0001583129 00000 n -0002462467 00000 n -0001586902 00000 n -0001586212 00000 n -0001583336 00000 n -0001586335 00000 n -0001586461 00000 n -0001586587 00000 n -0001586713 00000 n -0001586839 00000 n -0001589655 00000 n -0001588927 00000 n -0001587046 00000 n -0001589466 00000 n -0001589592 00000 n -0001589080 00000 n -0001589273 00000 n -0001595445 00000 n -0001593652 00000 n -0001589771 00000 n -0001595005 00000 n -0001593841 00000 n -0001595131 00000 n -0001594034 00000 n -0001594240 00000 n -0001594431 00000 n -0001595256 00000 n -0001595382 00000 n -0001594624 00000 n -0001594809 00000 n -0001602564 00000 n -0001599910 00000 n -0001595632 00000 n -0001602249 00000 n -0001602375 00000 n -0001602501 00000 n -0001600144 00000 n -0001600361 00000 n -0001600576 00000 n -0001600791 00000 n -0001600974 00000 n -0001601151 00000 n -0001601320 00000 n -0001601501 00000 n -0001601677 00000 n -0001601861 00000 n -0001602030 00000 n -0001608431 00000 n -0001606639 00000 n -0001602694 00000 n -0001608116 00000 n -0001608242 00000 n -0001606828 00000 n -0001607058 00000 n -0001607290 00000 n -0001608368 00000 n -0001607559 00000 n -0001607770 00000 n -0001607942 00000 n -0001614222 00000 n -0001612396 00000 n -0001608547 00000 n -0001613781 00000 n -0001613907 00000 n -0001612585 00000 n -0001612800 00000 n -0001612989 00000 n -0001613174 00000 n -0001614033 00000 n -0001613408 00000 n -0001613603 00000 n -0001614159 00000 n -0002462592 00000 n -0001622586 00000 n -0001617852 00000 n -0001614395 00000 n -0001622523 00000 n -0001618176 00000 n -0001618368 00000 n -0001618574 00000 n -0001618777 00000 n -0001618997 00000 n -0001619217 00000 n -0001619423 00000 n -0001619628 00000 n -0001619818 00000 n -0001620009 00000 n -0001620199 00000 n -0001620389 00000 n -0001620579 00000 n -0001620769 00000 n -0001620959 00000 n -0001621151 00000 n -0001621391 00000 n -0001621631 00000 n -0001621871 00000 n -0001622111 00000 n -0001622317 00000 n -0001627429 00000 n -0001626274 00000 n -0001622716 00000 n -0001627366 00000 n -0001626445 00000 n -0001626675 00000 n -0001626904 00000 n -0001627135 00000 n -0001630915 00000 n -0001630352 00000 n -0001627573 00000 n -0001630475 00000 n -0001630601 00000 n -0001630726 00000 n -0001630852 00000 n -0001634476 00000 n -0001633824 00000 n -0001631059 00000 n -0001634161 00000 n -0001633968 00000 n -0001634287 00000 n -0001634413 00000 n -0001637768 00000 n -0001637331 00000 n -0001634606 00000 n -0001637454 00000 n -0001637580 00000 n -0001637705 00000 n -0001641287 00000 n -0001640849 00000 n -0001637912 00000 n -0001640972 00000 n -0001641098 00000 n -0001641224 00000 n -0002462717 00000 n -0001645053 00000 n -0001644615 00000 n -0001641431 00000 n -0001644738 00000 n -0001644864 00000 n -0001644990 00000 n -0001647955 00000 n -0001647392 00000 n -0001645183 00000 n -0001647515 00000 n -0001647641 00000 n -0001647766 00000 n -0001647892 00000 n -0001651029 00000 n -0001650717 00000 n -0001648142 00000 n -0001650840 00000 n -0001650966 00000 n -0001655751 00000 n -0001705744 00000 n -0001653938 00000 n -0001653626 00000 n -0001651159 00000 n -0001653749 00000 n -0001653875 00000 n -0001686509 00000 n -0001655628 00000 n -0001654153 00000 n -0001685878 00000 n -0001685941 00000 n -0001686004 00000 n -0001686067 00000 n -0001686194 00000 n -0001686320 00000 n -0001686446 00000 n -0001690895 00000 n -0001690080 00000 n -0001686677 00000 n -0001690203 00000 n -0001690329 00000 n -0001690454 00000 n -0001690580 00000 n -0001690706 00000 n -0001690832 00000 n -0002462842 00000 n -0001695042 00000 n -0001694101 00000 n -0001691053 00000 n -0001694224 00000 n -0001694350 00000 n -0001694476 00000 n -0001694601 00000 n -0001694727 00000 n -0001694853 00000 n -0001694979 00000 n -0001699386 00000 n -0001698130 00000 n -0001695186 00000 n -0001698253 00000 n -0001698379 00000 n -0001698441 00000 n -0001698504 00000 n -0001698567 00000 n -0001698630 00000 n -0001698693 00000 n -0001698756 00000 n -0001698819 00000 n -0001698882 00000 n -0001698945 00000 n -0001699008 00000 n -0001699071 00000 n -0001699134 00000 n -0001699197 00000 n -0001699260 00000 n -0001699323 00000 n -0001738856 00000 n -0001704029 00000 n -0001703213 00000 n -0001699502 00000 n -0001703336 00000 n -0001703462 00000 n -0001703588 00000 n -0001703714 00000 n -0001703840 00000 n -0001703966 00000 n -0001704927 00000 n -0001704615 00000 n -0001704187 00000 n -0001704738 00000 n -0001704864 00000 n -0001737999 00000 n -0001705621 00000 n -0001705029 00000 n -0001737747 00000 n -0001737810 00000 n -0001737873 00000 n -0001737936 00000 n -0001834836 00000 n -0001738733 00000 n -0001738153 00000 n -0001834583 00000 n -0001834646 00000 n -0001834709 00000 n -0001834772 00000 n -0002462967 00000 n -0001834395 00000 n -0001837603 00000 n -0001836913 00000 n -0001834998 00000 n -0001837036 00000 n -0001837288 00000 n -0001837414 00000 n -0001837477 00000 n -0001837540 00000 n -0001841021 00000 n -0001840079 00000 n -0001837705 00000 n -0001840202 00000 n -0001840265 00000 n -0001840329 00000 n -0001840455 00000 n -0001840581 00000 n -0001840707 00000 n -0001840770 00000 n -0001840833 00000 n -0001840960 00000 n -0001844208 00000 n -0001843770 00000 n -0001841165 00000 n -0001843893 00000 n -0001844019 00000 n -0001844145 00000 n -0001847628 00000 n -0001846465 00000 n -0001844324 00000 n -0001847188 00000 n -0001847314 00000 n -0001847439 00000 n -0001846627 00000 n -0001846831 00000 n -0001847565 00000 n -0001847011 00000 n -0001850503 00000 n -0001850065 00000 n -0001847744 00000 n -0001850188 00000 n -0001850440 00000 n -0001854172 00000 n -0001853734 00000 n -0001850676 00000 n -0001853857 00000 n -0001853983 00000 n -0001854109 00000 n -0002463092 00000 n -0001858096 00000 n -0001857407 00000 n -0001854288 00000 n -0001857530 00000 n -0001857656 00000 n -0001857782 00000 n -0001857908 00000 n -0001858033 00000 n -0001861909 00000 n -0001861471 00000 n -0001858212 00000 n -0001861594 00000 n -0001861720 00000 n -0001861846 00000 n -0001866092 00000 n -0001865402 00000 n -0001862025 00000 n -0001865525 00000 n -0001865651 00000 n -0001865777 00000 n -0001865903 00000 n -0001866029 00000 n -0001869998 00000 n -0001869373 00000 n -0001866194 00000 n -0001869683 00000 n -0001869809 00000 n -0001869517 00000 n -0001869935 00000 n -0001872536 00000 n -0001872098 00000 n -0001870128 00000 n -0001872221 00000 n -0001872347 00000 n -0001872473 00000 n -0001876448 00000 n -0001875131 00000 n -0001872666 00000 n -0001876006 00000 n -0001875293 00000 n -0001875532 00000 n -0001875770 00000 n -0001876132 00000 n -0001876195 00000 n -0001876259 00000 n -0001876385 00000 n -0002463217 00000 n -0001878728 00000 n -0001878416 00000 n -0001876564 00000 n -0001878539 00000 n -0001878665 00000 n -0001881006 00000 n -0001880574 00000 n -0001878844 00000 n -0001880697 00000 n -0001880823 00000 n -0001880884 00000 n -0001880945 00000 n -0001882967 00000 n -0001882475 00000 n -0001881122 00000 n -0001882778 00000 n -0001882841 00000 n -0001882904 00000 n -0001882619 00000 n -0002233120 00000 n -0001884281 00000 n -0001884095 00000 n -0001883083 00000 n -0001884218 00000 n -0001887274 00000 n -0001886710 00000 n -0001884383 00000 n -0001886833 00000 n -0001886896 00000 n -0001886959 00000 n -0001887085 00000 n -0001887148 00000 n -0001887211 00000 n -0001889104 00000 n -0001888918 00000 n -0001887390 00000 n -0001889041 00000 n -0002463342 00000 n -0001890858 00000 n -0001890546 00000 n -0001889220 00000 n -0001890669 00000 n -0001890732 00000 n -0001890795 00000 n -0001893904 00000 n -0001893468 00000 n -0001890974 00000 n -0001893591 00000 n -0001893716 00000 n -0001893841 00000 n -0001895294 00000 n -0001894982 00000 n -0001894034 00000 n -0001895105 00000 n -0001895231 00000 n -0001898909 00000 n -0001897498 00000 n -0001895467 00000 n -0001898468 00000 n -0001898720 00000 n -0001898846 00000 n -0001897669 00000 n -0001897868 00000 n -0001898065 00000 n -0001898267 00000 n -0001902631 00000 n -0001901816 00000 n -0001899025 00000 n -0001902316 00000 n -0001902442 00000 n -0001902568 00000 n -0001901969 00000 n -0001902143 00000 n -0001906660 00000 n -0001905966 00000 n -0001902747 00000 n -0001906472 00000 n -0001906119 00000 n -0001906597 00000 n -0001906303 00000 n -0002463467 00000 n -0001908691 00000 n -0001908505 00000 n -0001906790 00000 n -0001908628 00000 n -0001911174 00000 n -0001910254 00000 n -0001908793 00000 n -0001910985 00000 n -0001910416 00000 n -0001910606 00000 n -0001910776 00000 n -0001911111 00000 n -0001912704 00000 n -0001912162 00000 n -0001911290 00000 n -0001912516 00000 n -0001912306 00000 n -0001912642 00000 n -0001916303 00000 n -0001915739 00000 n -0001912806 00000 n -0001915862 00000 n -0001916114 00000 n -0001916240 00000 n -0001920818 00000 n -0001919888 00000 n -0001916405 00000 n -0001920504 00000 n -0001920041 00000 n -0001920273 00000 n -0001920630 00000 n -0001920756 00000 n -0001925316 00000 n -0001924878 00000 n -0001920976 00000 n -0001925001 00000 n -0001925127 00000 n -0001925253 00000 n -0002463592 00000 n -0001929394 00000 n -0001928831 00000 n -0001925460 00000 n -0001928954 00000 n -0001929080 00000 n -0001929143 00000 n -0001929205 00000 n -0001929268 00000 n -0001929331 00000 n -0001933321 00000 n -0001932884 00000 n -0001929581 00000 n -0001933007 00000 n -0001933133 00000 n -0001933259 00000 n -0001937222 00000 n -0001936281 00000 n -0001933465 00000 n -0001936404 00000 n -0001936530 00000 n -0001936655 00000 n -0001936781 00000 n -0001936844 00000 n -0001936907 00000 n -0001936970 00000 n -0001937033 00000 n -0001937096 00000 n -0001937159 00000 n -0001939998 00000 n -0001939375 00000 n -0001937352 00000 n -0001939498 00000 n -0001939561 00000 n -0001939624 00000 n -0001939687 00000 n -0001939809 00000 n -0001939935 00000 n -0001942947 00000 n -0001942258 00000 n -0001940128 00000 n -0001942381 00000 n -0001942633 00000 n -0001942759 00000 n -0001942885 00000 n -0001946170 00000 n -0001945732 00000 n -0001943092 00000 n -0001945855 00000 n -0001945981 00000 n -0001946107 00000 n -0002463717 00000 n -0001948877 00000 n -0001948439 00000 n -0001946357 00000 n -0001948562 00000 n -0001948688 00000 n -0001948814 00000 n -0001953096 00000 n -0001952532 00000 n -0001949007 00000 n -0001952655 00000 n -0001952781 00000 n -0001952907 00000 n -0001952970 00000 n -0001953033 00000 n -0001956864 00000 n -0001956364 00000 n -0001953283 00000 n -0001956487 00000 n -0001956550 00000 n -0001956613 00000 n -0001956676 00000 n -0001956739 00000 n -0001956802 00000 n -0001960796 00000 n -0001960046 00000 n -0001957051 00000 n -0001960169 00000 n -0001960295 00000 n -0001960419 00000 n -0001960482 00000 n -0001960545 00000 n -0001960608 00000 n -0001960671 00000 n -0001960734 00000 n -0001964483 00000 n -0001963669 00000 n -0001960926 00000 n -0001963792 00000 n -0001963855 00000 n -0001963918 00000 n -0001963981 00000 n -0001964044 00000 n -0001964107 00000 n -0001964170 00000 n -0001964233 00000 n +0000976670 00000 n +0000976234 00000 n +0000973897 00000 n +0000976357 00000 n +0000976483 00000 n +0000976607 00000 n +0000977607 00000 n +0000977421 00000 n +0000976800 00000 n +0000977544 00000 n +0002566517 00000 n +0000981381 00000 n +0000980640 00000 n +0000977709 00000 n +0000980941 00000 n +0000981193 00000 n +0000980784 00000 n +0000981319 00000 n +0000984853 00000 n +0000984102 00000 n +0000981540 00000 n +0000984225 00000 n +0000984350 00000 n +0000984413 00000 n +0000984476 00000 n +0000984539 00000 n +0000984602 00000 n +0000984665 00000 n +0000984728 00000 n +0000984790 00000 n +0000988799 00000 n +0000988062 00000 n +0000985026 00000 n +0000988357 00000 n +0000988483 00000 n +0000988609 00000 n +0000988206 00000 n +0000988672 00000 n +0000988735 00000 n +0000991223 00000 n +0000990737 00000 n +0000988957 00000 n +0000991034 00000 n +0000991160 00000 n +0000990881 00000 n +0000993753 00000 n +0000993442 00000 n +0000991367 00000 n +0000993565 00000 n +0000993690 00000 n +0000995940 00000 n +0000995754 00000 n +0000993968 00000 n +0000995877 00000 n +0002566642 00000 n +0001000405 00000 n +0000999509 00000 n +0000996098 00000 n +0000999965 00000 n +0001000091 00000 n +0000999662 00000 n +0000999813 00000 n +0001000216 00000 n +0001000342 00000 n +0001003695 00000 n +0001002819 00000 n +0001003822 00000 n +0001002696 00000 n +0001000577 00000 n +0001003632 00000 n +0001003758 00000 n +0001008212 00000 n +0001007900 00000 n +0001003996 00000 n +0001008023 00000 n +0001008149 00000 n +0001012275 00000 n +0001012089 00000 n +0001008384 00000 n +0001012212 00000 n +0001015789 00000 n +0001015146 00000 n +0001012433 00000 n +0001015600 00000 n +0001015726 00000 n +0001015299 00000 n +0001015449 00000 n +0001020607 00000 n +0001019535 00000 n +0001015919 00000 n +0001020166 00000 n +0001020292 00000 n +0001020418 00000 n +0001019697 00000 n +0001019853 00000 n +0001020010 00000 n +0001020481 00000 n +0001020543 00000 n +0002566767 00000 n +0001024602 00000 n +0001024290 00000 n +0001020779 00000 n +0001024413 00000 n +0001024539 00000 n +0001028695 00000 n +0001027997 00000 n +0001024788 00000 n +0001028506 00000 n +0001028632 00000 n +0001028150 00000 n +0001028331 00000 n +0001032959 00000 n +0001032523 00000 n +0001028867 00000 n +0001032646 00000 n +0001032772 00000 n +0001032897 00000 n +0001036372 00000 n +0001035638 00000 n +0001033117 00000 n +0001035933 00000 n +0001036059 00000 n +0001035782 00000 n +0001036122 00000 n +0001036185 00000 n +0001036309 00000 n +0001040653 00000 n +0001040341 00000 n +0001036544 00000 n +0001040464 00000 n +0001040590 00000 n +0001044163 00000 n +0001043851 00000 n +0001040896 00000 n +0001043974 00000 n +0001044100 00000 n +0002566892 00000 n +0001048432 00000 n +0001047821 00000 n +0001044406 00000 n +0001048117 00000 n +0001048243 00000 n +0001047965 00000 n +0001048369 00000 n +0001052883 00000 n +0001052319 00000 n +0001048604 00000 n +0001052442 00000 n +0001052505 00000 n +0001052568 00000 n +0001052631 00000 n +0001052694 00000 n +0001052820 00000 n +0002376777 00000 n +0002374777 00000 n +0002376611 00000 n +0001055639 00000 n +0001055453 00000 n +0001053069 00000 n +0001055576 00000 n +0001059283 00000 n +0001058846 00000 n +0001055840 00000 n +0001058969 00000 n +0001059095 00000 n +0001059221 00000 n +0001061822 00000 n +0001061511 00000 n +0001059469 00000 n +0001061634 00000 n +0001061760 00000 n +0001064558 00000 n +0001064246 00000 n +0001061994 00000 n +0001064369 00000 n +0001064495 00000 n +0002567017 00000 n +0001067157 00000 n +0001066845 00000 n +0001064730 00000 n +0001066968 00000 n +0001067094 00000 n +0001070548 00000 n +0001070236 00000 n +0001067287 00000 n +0001070359 00000 n +0001070485 00000 n +0001073484 00000 n +0001073172 00000 n +0001070692 00000 n +0001073295 00000 n +0001073421 00000 n +0001075968 00000 n +0001075530 00000 n +0001073656 00000 n +0001075653 00000 n +0001075779 00000 n +0001075905 00000 n +0001080230 00000 n +0001079477 00000 n +0001076155 00000 n +0001079600 00000 n +0001079726 00000 n +0001079789 00000 n +0001079852 00000 n +0001079915 00000 n +0001079978 00000 n +0001080041 00000 n +0001080167 00000 n +0001084655 00000 n +0001083839 00000 n +0001080402 00000 n +0001083962 00000 n +0001084025 00000 n +0001084088 00000 n +0001084151 00000 n +0001084214 00000 n +0001084277 00000 n +0001084340 00000 n +0001084403 00000 n +0001084466 00000 n +0001084529 00000 n +0001084592 00000 n +0002567142 00000 n +0001088545 00000 n +0001088107 00000 n +0001084799 00000 n +0001088230 00000 n +0001088356 00000 n +0001088482 00000 n +0001092545 00000 n +0001091793 00000 n +0001088717 00000 n +0001091916 00000 n +0001092042 00000 n +0001092168 00000 n +0001092231 00000 n +0001092294 00000 n +0001092357 00000 n +0001092420 00000 n +0001092483 00000 n +0001098773 00000 n +0001096131 00000 n +0001095316 00000 n +0001092689 00000 n +0001095439 00000 n +0001095502 00000 n +0001095565 00000 n +0001095628 00000 n +0001095691 00000 n +0001095754 00000 n +0001095817 00000 n +0001095880 00000 n +0001095943 00000 n +0001096006 00000 n +0001096069 00000 n +0001102376 00000 n +0001098650 00000 n +0001096275 00000 n +0001102187 00000 n +0001102313 00000 n +0001102016 00000 n +0001102074 00000 n +0001102164 00000 n +0001103747 00000 n +0001103561 00000 n +0001102606 00000 n +0001103684 00000 n +0001107223 00000 n +0001106911 00000 n +0001103863 00000 n +0001107034 00000 n +0001107160 00000 n +0002567267 00000 n +0001111717 00000 n +0001111279 00000 n +0001107467 00000 n +0001111402 00000 n +0001111528 00000 n +0001111654 00000 n +0001112933 00000 n +0001112747 00000 n +0001111889 00000 n +0001112870 00000 n +0001114462 00000 n +0001114276 00000 n +0001113035 00000 n +0001114399 00000 n +0001118851 00000 n +0001117896 00000 n +0001114564 00000 n +0001118410 00000 n +0001118536 00000 n +0001118662 00000 n +0001118788 00000 n +0001118049 00000 n +0001118230 00000 n +0001122080 00000 n +0001121390 00000 n +0001118981 00000 n +0001121513 00000 n +0001121639 00000 n +0001121765 00000 n +0001121891 00000 n +0001122017 00000 n +0001126293 00000 n +0001125345 00000 n +0001122210 00000 n +0001125915 00000 n +0001125978 00000 n +0001126041 00000 n +0001126104 00000 n +0001126230 00000 n +0001125498 00000 n +0001125707 00000 n +0002567392 00000 n +0001129380 00000 n +0001129194 00000 n +0001126451 00000 n +0001129317 00000 n +0001133528 00000 n +0001133090 00000 n +0001129566 00000 n +0001133213 00000 n +0001133339 00000 n +0001133465 00000 n +0001136757 00000 n +0001135687 00000 n +0001133714 00000 n +0001136190 00000 n +0001135840 00000 n +0001136316 00000 n +0001136021 00000 n +0001136442 00000 n +0001136568 00000 n +0001136694 00000 n +0001140888 00000 n +0001139702 00000 n +0001136887 00000 n +0001140196 00000 n +0001140448 00000 n +0001140574 00000 n +0001139855 00000 n +0001140700 00000 n +0001140024 00000 n +0001140826 00000 n +0001144677 00000 n +0001144156 00000 n +0001141004 00000 n +0001144488 00000 n +0001144300 00000 n +0001144614 00000 n +0001148532 00000 n +0001147618 00000 n +0001144907 00000 n +0001148090 00000 n +0001148216 00000 n +0001147771 00000 n +0001148279 00000 n +0001148342 00000 n +0001148469 00000 n +0001147931 00000 n +0002567517 00000 n +0001151116 00000 n +0001151495 00000 n +0001150930 00000 n +0001148662 00000 n +0001151053 00000 n +0001151179 00000 n +0001151306 00000 n +0001151432 00000 n +0001155093 00000 n +0001154530 00000 n +0001151653 00000 n +0001154653 00000 n +0001154779 00000 n +0001154905 00000 n +0001158676 00000 n +0001158364 00000 n +0001155237 00000 n +0001158487 00000 n +0001158613 00000 n +0001162567 00000 n +0001162004 00000 n +0001158933 00000 n +0001162127 00000 n +0001162253 00000 n +0001162379 00000 n +0001162504 00000 n +0001165732 00000 n +0001182086 00000 n +0001165609 00000 n +0001162683 00000 n +0001181771 00000 n +0001181834 00000 n +0001181897 00000 n +0001182023 00000 n +0001181583 00000 n +0001185476 00000 n +0001197166 00000 n +0001185353 00000 n +0001182318 00000 n +0001196851 00000 n +0001196977 00000 n +0001197040 00000 n +0001197102 00000 n +0002567642 00000 n +0001196666 00000 n +0001200026 00000 n +0001212463 00000 n +0001199903 00000 n +0001197370 00000 n +0001212147 00000 n +0001212273 00000 n +0001212336 00000 n +0001212399 00000 n +0001211961 00000 n +0001216785 00000 n +0001215959 00000 n +0001212696 00000 n +0001216471 00000 n +0001216597 00000 n +0001216722 00000 n +0001216112 00000 n +0001216292 00000 n +0001220579 00000 n +0001220142 00000 n +0001216987 00000 n +0001220265 00000 n +0001220391 00000 n +0001220516 00000 n +0001224448 00000 n +0001223744 00000 n +0001220809 00000 n +0001224259 00000 n +0001223897 00000 n +0001224081 00000 n +0001224385 00000 n +0001227711 00000 n +0001227399 00000 n +0001224663 00000 n +0001227522 00000 n +0001227648 00000 n +0001231082 00000 n +0001230519 00000 n +0001227898 00000 n +0001230642 00000 n +0001230768 00000 n +0001230894 00000 n +0001231020 00000 n +0002567767 00000 n +0001233323 00000 n +0001250856 00000 n +0001276322 00000 n +0001273646 00000 n +0001233200 00000 n +0001231226 00000 n +0001273080 00000 n +0001273143 00000 n +0001273206 00000 n +0001273333 00000 n +0001273396 00000 n +0001273457 00000 n +0001273583 00000 n +0001250670 00000 n +0001272892 00000 n +0001302944 00000 n +0001327602 00000 n +0001276199 00000 n +0001273879 00000 n +0001327287 00000 n +0001327350 00000 n +0001327413 00000 n +0001327477 00000 n +0001327539 00000 n +0001302756 00000 n +0001327099 00000 n +0001330078 00000 n +0001369867 00000 n +0001367436 00000 n +0001329934 00000 n +0001327821 00000 n +0001366868 00000 n +0001366994 00000 n +0001366718 00000 n +0001367057 00000 n +0001367120 00000 n +0001367247 00000 n +0001367373 00000 n +0001366530 00000 n +0001395348 00000 n +0001369744 00000 n +0001367612 00000 n +0001395158 00000 n +0001395221 00000 n +0001395284 00000 n +0001394970 00000 n +0001399048 00000 n +0001398736 00000 n +0001395524 00000 n +0001398859 00000 n +0001398985 00000 n +0001403022 00000 n +0001402584 00000 n +0001399206 00000 n +0001402707 00000 n +0001402833 00000 n +0001402959 00000 n +0002567892 00000 n +0001406472 00000 n +0001406034 00000 n +0001403210 00000 n +0001406157 00000 n +0001406283 00000 n +0001406409 00000 n +0001410448 00000 n +0001409963 00000 n +0001406644 00000 n +0001410259 00000 n +0001410385 00000 n +0001410107 00000 n +0001414406 00000 n +0001417191 00000 n +0001414658 00000 n +0001414018 00000 n +0001410663 00000 n +0001414343 00000 n +0001414469 00000 n +0001414595 00000 n +0001414162 00000 n +0002373329 00000 n +0002369211 00000 n +0002373164 00000 n +0001456233 00000 n +0001417047 00000 n +0001414872 00000 n +0001455917 00000 n +0001455980 00000 n +0001456043 00000 n +0001455759 00000 n +0001456170 00000 n +0001455571 00000 n +0001459096 00000 n +0001460877 00000 n +0001464938 00000 n +0001458943 00000 n +0001456423 00000 n +0001464498 00000 n +0001464186 00000 n +0001464561 00000 n +0001464624 00000 n +0001464341 00000 n +0001464688 00000 n +0001464751 00000 n +0001464876 00000 n +0001470321 00000 n +0001468493 00000 n +0001465149 00000 n +0001470008 00000 n +0001468691 00000 n +0001468871 00000 n +0001469054 00000 n +0001469228 00000 n +0001469439 00000 n +0001469620 00000 n +0001470134 00000 n +0001469798 00000 n +0001470260 00000 n +0002568017 00000 n +0001472818 00000 n +0001498933 00000 n +0001496182 00000 n +0001472665 00000 n +0001470465 00000 n +0001495615 00000 n +0001495741 00000 n +0001495315 00000 n +0001495465 00000 n +0001495867 00000 n +0001495929 00000 n +0001495992 00000 n +0001496119 00000 n +0001495129 00000 n +0001522991 00000 n +0001526414 00000 n +0001523370 00000 n +0001498810 00000 n +0001496358 00000 n +0001522928 00000 n +0001523054 00000 n +0001523181 00000 n +0001523307 00000 n +0001522740 00000 n +0001551293 00000 n +0001526270 00000 n +0001523588 00000 n +0001550851 00000 n +0001550914 00000 n +0001550977 00000 n +0001551104 00000 n +0001551230 00000 n +0001550674 00000 n +0001550486 00000 n +0001555083 00000 n +0001554520 00000 n +0001551497 00000 n +0001554643 00000 n +0001554768 00000 n +0001554894 00000 n +0001555020 00000 n +0001559436 00000 n +0001558747 00000 n +0001555255 00000 n +0001558870 00000 n +0001558996 00000 n +0001559122 00000 n +0001559248 00000 n +0001559373 00000 n +0001563638 00000 n +0001562586 00000 n +0001559538 00000 n +0001563072 00000 n +0001563198 00000 n +0001563324 00000 n +0001563450 00000 n +0001562739 00000 n +0001563575 00000 n +0001562892 00000 n +0002568142 00000 n +0001565387 00000 n +0001565514 00000 n +0001565201 00000 n +0001563824 00000 n +0001565324 00000 n +0001565450 00000 n +0001568137 00000 n +0001567825 00000 n +0001565658 00000 n +0001567948 00000 n +0001568074 00000 n +0001571389 00000 n +0001570750 00000 n +0001568324 00000 n +0001571074 00000 n +0001571200 00000 n +0001571326 00000 n +0001570894 00000 n +0001574476 00000 n +0001574164 00000 n +0001571604 00000 n +0001574287 00000 n +0001574413 00000 n +0001578841 00000 n +0001578360 00000 n +0001574734 00000 n +0001578656 00000 n +0001578504 00000 n +0001578782 00000 n +0001582754 00000 n +0001582316 00000 n +0001579070 00000 n +0001582439 00000 n +0001582565 00000 n +0001582691 00000 n +0002568267 00000 n +0001584529 00000 n +0001584343 00000 n +0001582940 00000 n +0001584466 00000 n +0001587422 00000 n +0001586796 00000 n +0001584688 00000 n +0001586919 00000 n +0001587045 00000 n +0001587108 00000 n +0001587171 00000 n +0001587233 00000 n +0001587296 00000 n +0001587359 00000 n +0001590833 00000 n +0001590206 00000 n +0001587580 00000 n +0001590329 00000 n +0001590455 00000 n +0001590518 00000 n +0001590581 00000 n +0001590644 00000 n +0001590770 00000 n +0001592665 00000 n +0001637892 00000 n +0001592521 00000 n +0001591034 00000 n +0001637450 00000 n +0001637576 00000 n +0001637300 00000 n +0001637639 00000 n +0001637702 00000 n +0001637829 00000 n +0001637112 00000 n +0001641625 00000 n +0001641313 00000 n +0001638082 00000 n +0001641436 00000 n +0001641562 00000 n +0001645135 00000 n +0001644446 00000 n +0001641783 00000 n +0001644569 00000 n +0001644695 00000 n +0001644758 00000 n +0001644821 00000 n +0001644884 00000 n +0001644947 00000 n +0001645072 00000 n +0002568392 00000 n +0001648870 00000 n +0001648433 00000 n +0001645321 00000 n +0001648556 00000 n +0001648682 00000 n +0001648807 00000 n +0001651901 00000 n +0001651589 00000 n +0001649070 00000 n +0001651712 00000 n +0001651838 00000 n +0001654923 00000 n +0001654487 00000 n +0001652101 00000 n +0001654610 00000 n +0001654736 00000 n +0001654799 00000 n +0001654861 00000 n +0001657783 00000 n +0001657471 00000 n +0001655109 00000 n +0001657594 00000 n +0001657657 00000 n +0001657720 00000 n +0001660039 00000 n +0001659664 00000 n +0001657955 00000 n +0001659787 00000 n +0001659850 00000 n +0001659913 00000 n +0001659976 00000 n +0001662249 00000 n +0001661875 00000 n +0001660183 00000 n +0001661998 00000 n +0001662061 00000 n +0001662124 00000 n +0001662186 00000 n +0002568517 00000 n +0001665154 00000 n +0001664843 00000 n +0001662365 00000 n +0001664966 00000 n +0001665029 00000 n +0001665092 00000 n +0001668037 00000 n +0001667536 00000 n +0001665298 00000 n +0001667659 00000 n +0001667722 00000 n +0001667785 00000 n +0001667848 00000 n +0001667974 00000 n +0001671463 00000 n +0001670899 00000 n +0001668195 00000 n +0001671022 00000 n +0001671148 00000 n +0001671274 00000 n +0001671400 00000 n +0001674084 00000 n +0001673521 00000 n +0001671607 00000 n +0001673644 00000 n +0001673770 00000 n +0001673896 00000 n +0001674022 00000 n +0001679402 00000 n +0001677653 00000 n +0001674228 00000 n +0001679213 00000 n +0001677851 00000 n +0001678045 00000 n +0001678238 00000 n +0001678431 00000 n +0001679339 00000 n +0001678624 00000 n +0001678830 00000 n +0001679021 00000 n +0001683958 00000 n +0001682986 00000 n +0001679589 00000 n +0001683517 00000 n +0001683643 00000 n +0001683769 00000 n +0001683139 00000 n +0001683322 00000 n +0001683895 00000 n +0002568642 00000 n +0001691723 00000 n +0001688311 00000 n +0001684102 00000 n +0001691408 00000 n +0001691534 00000 n +0001688572 00000 n +0001688790 00000 n +0001689007 00000 n +0001689224 00000 n +0001689407 00000 n +0001689584 00000 n +0001689753 00000 n +0001689934 00000 n +0001690108 00000 n +0001690290 00000 n +0001690457 00000 n +0001691660 00000 n +0001690676 00000 n +0001690908 00000 n +0001691139 00000 n +0001696970 00000 n +0001695082 00000 n +0001691825 00000 n +0001696655 00000 n +0001696781 00000 n +0001695280 00000 n +0001695491 00000 n +0001695660 00000 n +0001696907 00000 n +0001695834 00000 n +0001696048 00000 n +0001696236 00000 n +0001696421 00000 n +0001702402 00000 n +0001700471 00000 n +0001697143 00000 n +0001702087 00000 n +0001702213 00000 n +0001700669 00000 n +0001700865 00000 n +0001702339 00000 n +0001701043 00000 n +0001701237 00000 n +0001701441 00000 n +0001701661 00000 n +0001701881 00000 n +0001708405 00000 n +0001706005 00000 n +0001702560 00000 n +0001708342 00000 n +0001706230 00000 n +0001706421 00000 n +0001706611 00000 n +0001706801 00000 n +0001706991 00000 n +0001707184 00000 n +0001707424 00000 n +0001707664 00000 n +0001707906 00000 n +0001708110 00000 n +0001711472 00000 n +0001711160 00000 n +0001708535 00000 n +0001711283 00000 n +0001711409 00000 n +0001715250 00000 n +0001714471 00000 n +0001711644 00000 n +0001714809 00000 n +0001714935 00000 n +0001715061 00000 n +0001714615 00000 n +0001715187 00000 n +0002568767 00000 n +0001717979 00000 n +0001717542 00000 n +0001715408 00000 n +0001717665 00000 n +0001717791 00000 n +0001717916 00000 n +0001721617 00000 n +0001721179 00000 n +0001718151 00000 n +0001721302 00000 n +0001721428 00000 n +0001721554 00000 n +0001725645 00000 n +0001725207 00000 n +0001721775 00000 n +0001725330 00000 n +0001725456 00000 n +0001725582 00000 n +0001728818 00000 n +0001728380 00000 n +0001725803 00000 n +0001728503 00000 n +0001728629 00000 n +0001728755 00000 n +0001731990 00000 n +0001731678 00000 n +0001729019 00000 n +0001731801 00000 n +0001731927 00000 n +0001737310 00000 n +0001785590 00000 n +0001735451 00000 n +0001734761 00000 n +0001732162 00000 n +0001734884 00000 n +0001735010 00000 n +0001735136 00000 n +0001735262 00000 n +0001735388 00000 n +0002568892 00000 n +0001767879 00000 n +0001737187 00000 n +0001735609 00000 n +0001767437 00000 n +0001767500 00000 n +0001767563 00000 n +0001767690 00000 n +0001767816 00000 n +0001772412 00000 n +0001771597 00000 n +0001768103 00000 n +0001771720 00000 n +0001771846 00000 n +0001771971 00000 n +0001772097 00000 n +0001772223 00000 n +0001772349 00000 n +0001776624 00000 n +0001775496 00000 n +0001772584 00000 n +0001775619 00000 n +0001775745 00000 n +0001775870 00000 n +0001775996 00000 n +0001776122 00000 n +0001776248 00000 n +0001776311 00000 n +0001776374 00000 n +0001776436 00000 n +0001776499 00000 n +0001776562 00000 n +0001781052 00000 n +0001779922 00000 n +0001776796 00000 n +0001780045 00000 n +0001780108 00000 n +0001780171 00000 n +0001780234 00000 n +0001780297 00000 n +0001780360 00000 n +0001780423 00000 n +0001780486 00000 n +0001780549 00000 n +0001780612 00000 n +0001780674 00000 n +0001780737 00000 n +0001780863 00000 n +0001780989 00000 n +0001818543 00000 n +0001784786 00000 n +0001783927 00000 n +0001781210 00000 n +0001784222 00000 n +0001784348 00000 n +0001784473 00000 n +0001784599 00000 n +0001784725 00000 n +0001784071 00000 n +0001914333 00000 n +0001817782 00000 n +0001785467 00000 n +0001784958 00000 n +0001817593 00000 n +0001817656 00000 n +0001817718 00000 n +0002569017 00000 n +0001914460 00000 n +0001818420 00000 n +0001817922 00000 n +0001914270 00000 n +0001914396 00000 n +0001914082 00000 n +0001917576 00000 n +0001916550 00000 n +0001914608 00000 n +0001917008 00000 n +0001917260 00000 n +0001917386 00000 n +0001916703 00000 n +0001917449 00000 n +0001917512 00000 n +0001916855 00000 n +0001920127 00000 n +0001920885 00000 n +0001919768 00000 n +0001917692 00000 n +0001920064 00000 n +0001920190 00000 n +0001920317 00000 n +0001920443 00000 n +0001920569 00000 n +0001919912 00000 n +0001920632 00000 n +0001920695 00000 n +0001920822 00000 n +0001923888 00000 n +0001923576 00000 n +0001921043 00000 n +0001923699 00000 n +0001923825 00000 n +0001927731 00000 n +0001926441 00000 n +0001924032 00000 n +0001927165 00000 n +0001927291 00000 n +0001927417 00000 n +0001927543 00000 n +0001926603 00000 n +0001926808 00000 n +0001927668 00000 n +0001926988 00000 n +0001930616 00000 n +0001930178 00000 n +0001927861 00000 n +0001930301 00000 n +0001930553 00000 n +0002569142 00000 n +0001934236 00000 n +0001933798 00000 n +0001930817 00000 n +0001933921 00000 n +0001934047 00000 n +0001934173 00000 n +0001938096 00000 n +0001937407 00000 n +0001934366 00000 n +0001937530 00000 n +0001937656 00000 n +0001937782 00000 n +0001937908 00000 n +0001938033 00000 n +0001941938 00000 n +0001941500 00000 n +0001938212 00000 n +0001941623 00000 n +0001941749 00000 n +0001941875 00000 n +0001945959 00000 n +0001945198 00000 n +0001942054 00000 n +0001945644 00000 n +0001945351 00000 n +0001945498 00000 n +0001945770 00000 n +0001945896 00000 n +0001950581 00000 n +0001949135 00000 n +0001946089 00000 n +0001950014 00000 n +0001950140 00000 n +0001950266 00000 n +0001950392 00000 n +0001949306 00000 n +0001949471 00000 n +0001949636 00000 n +0001949826 00000 n +0001950518 00000 n +0001953215 00000 n +0001952903 00000 n +0001950739 00000 n +0001953026 00000 n +0001953152 00000 n +0002569267 00000 n +0001957340 00000 n +0001955867 00000 n +0001953345 00000 n +0001956899 00000 n +0001957025 00000 n +0001956038 00000 n +0001956277 00000 n +0001956514 00000 n +0001957151 00000 n +0001956747 00000 n +0001957214 00000 n +0001957276 00000 n +0001960289 00000 n +0001959851 00000 n +0001957484 00000 n +0001959974 00000 n +0001960100 00000 n +0001960226 00000 n +0001962735 00000 n +0001962297 00000 n +0001960476 00000 n +0001962420 00000 n +0001962546 00000 n +0001962609 00000 n +0001962672 00000 n +0001964180 00000 n +0001963994 00000 n +0001962879 00000 n +0001964117 00000 n +0001966206 00000 n +0001965717 00000 n 0001964296 00000 n -0001964359 00000 n -0001964421 00000 n -0001968589 00000 n -0001967396 00000 n -0001964670 00000 n -0001967519 00000 n -0001967582 00000 n -0001967645 00000 n -0001967708 00000 n -0001967771 00000 n -0001967834 00000 n -0001967897 00000 n -0001967959 00000 n -0001968022 00000 n -0001968085 00000 n -0001968148 00000 n -0001968211 00000 n -0001968274 00000 n -0001968400 00000 n -0001968526 00000 n -0002463842 00000 n -0001972045 00000 n -0001971041 00000 n -0001968691 00000 n -0001971164 00000 n -0001971290 00000 n -0001971353 00000 n -0001971416 00000 n -0001971479 00000 n -0001971542 00000 n -0001971604 00000 n -0001971667 00000 n -0001971730 00000 n -0001971856 00000 n -0001971982 00000 n -0001975794 00000 n -0001975230 00000 n -0001972218 00000 n -0001975353 00000 n -0001975479 00000 n -0001975605 00000 n -0001975731 00000 n -0001979898 00000 n -0001979336 00000 n -0001975981 00000 n -0001979459 00000 n -0001979585 00000 n -0001979710 00000 n -0001979835 00000 n -0001983951 00000 n -0001983387 00000 n -0001980099 00000 n -0001983510 00000 n -0001983636 00000 n -0001983699 00000 n -0001983762 00000 n -0001983825 00000 n -0001983888 00000 n -0001987711 00000 n -0001987151 00000 n -0001984095 00000 n -0001987274 00000 n -0001987337 00000 n -0001987400 00000 n -0001987460 00000 n -0001987521 00000 n -0001987648 00000 n -0001991286 00000 n -0001991100 00000 n -0001987841 00000 n -0001991223 00000 n -0002463967 00000 n -0001995166 00000 n -0001994857 00000 n -0001991445 00000 n -0001994980 00000 n -0001995043 00000 n -0001995106 00000 n -0001998430 00000 n -0001997866 00000 n -0001995282 00000 n -0001997989 00000 n -0001998115 00000 n -0001998241 00000 n -0001998367 00000 n -0002001830 00000 n -0002001519 00000 n -0001998574 00000 n -0002001642 00000 n -0002001768 00000 n -0002003866 00000 n -0002003680 00000 n -0002001960 00000 n -0002003803 00000 n -0002007479 00000 n -0002006869 00000 n -0002004025 00000 n -0002007164 00000 n -0002007013 00000 n -0002007416 00000 n -0002011635 00000 n -0002011198 00000 n -0002007638 00000 n -0002011321 00000 n -0002011446 00000 n -0002011572 00000 n -0002464092 00000 n -0002015402 00000 n -0002014879 00000 n -0002011737 00000 n -0002015213 00000 n -0002015339 00000 n -0002015023 00000 n -0002019740 00000 n -0002019554 00000 n -0002015546 00000 n -0002019677 00000 n -0002024037 00000 n -0002023851 00000 n -0002019870 00000 n -0002023974 00000 n -0002027700 00000 n -0002027388 00000 n -0002024167 00000 n -0002027511 00000 n -0002027637 00000 n -0002030286 00000 n -0002029849 00000 n -0002027844 00000 n -0002029972 00000 n -0002030098 00000 n -0002030223 00000 n -0002032065 00000 n -0002031879 00000 n -0002030402 00000 n -0002032002 00000 n -0002464217 00000 n -0002036016 00000 n -0002035578 00000 n -0002032181 00000 n -0002035701 00000 n -0002035827 00000 n -0002035953 00000 n -0002041076 00000 n -0002040259 00000 n -0002036189 00000 n -0002040760 00000 n -0002040886 00000 n -0002040949 00000 n -0002041012 00000 n -0002040412 00000 n -0002040588 00000 n -0002043865 00000 n -0002043231 00000 n -0002041263 00000 n -0002043551 00000 n -0002043375 00000 n -0002043676 00000 n -0002043802 00000 n -0002046278 00000 n -0002045590 00000 n -0002043995 00000 n -0002045713 00000 n -0002045839 00000 n -0002045965 00000 n -0002046090 00000 n -0002046216 00000 n -0002048542 00000 n -0002048230 00000 n -0002046394 00000 n -0002048353 00000 n -0002048479 00000 n -0002049572 00000 n -0002049386 00000 n -0002048672 00000 n -0002049509 00000 n -0002464342 00000 n -0002052404 00000 n -0002051841 00000 n -0002049688 00000 n -0002051964 00000 n -0002052215 00000 n -0002052341 00000 n -0002055379 00000 n -0002054941 00000 n -0002052549 00000 n -0002055064 00000 n -0002055190 00000 n -0002055316 00000 n -0002058967 00000 n -0002058532 00000 n -0002055566 00000 n -0002058655 00000 n -0002058780 00000 n -0002058905 00000 n -0002061490 00000 n -0002061178 00000 n -0002059097 00000 n -0002061301 00000 n -0002061427 00000 n -0002066082 00000 n -0002065518 00000 n -0002061606 00000 n -0002065641 00000 n -0002065767 00000 n -0002065830 00000 n -0002065893 00000 n -0002065957 00000 n -0002066018 00000 n -0002069534 00000 n -0002069098 00000 n -0002066212 00000 n -0002069221 00000 n -0002069346 00000 n -0002069471 00000 n -0002464467 00000 n -0002071587 00000 n -0002071401 00000 n -0002069678 00000 n -0002071524 00000 n -0002074798 00000 n -0002074234 00000 n -0002071689 00000 n -0002074357 00000 n -0002074483 00000 n -0002074609 00000 n -0002074735 00000 n -0002078236 00000 n -0002077199 00000 n -0002074928 00000 n -0002077669 00000 n -0002077352 00000 n -0002077511 00000 n -0002077795 00000 n -0002077921 00000 n -0002078047 00000 n -0002078173 00000 n -0002080091 00000 n -0002079905 00000 n -0002078352 00000 n -0002080028 00000 n -0002083774 00000 n -0002082836 00000 n -0002080207 00000 n -0002083333 00000 n -0002083585 00000 n -0002082989 00000 n -0002083711 00000 n -0002083162 00000 n -0002087937 00000 n -0002086745 00000 n -0002083890 00000 n -0002087496 00000 n -0002087622 00000 n -0002087748 00000 n -0002086907 00000 n -0002087874 00000 n -0002087083 00000 n -0002087291 00000 n -0002464592 00000 n -0002089447 00000 n -0002089009 00000 n -0002088081 00000 n -0002089132 00000 n -0002089258 00000 n -0002089384 00000 n -0002090971 00000 n -0002090407 00000 n -0002089549 00000 n -0002090530 00000 n -0002090782 00000 n -0002090908 00000 n -0002091971 00000 n -0002091533 00000 n -0002091059 00000 n -0002091656 00000 n -0002091908 00000 n -0002092631 00000 n -0002092383 00000 n -0002092059 00000 n -0002092506 00000 n -0002096281 00000 n -0002095027 00000 n -0002092719 00000 n -0002095150 00000 n -0002095213 00000 n -0002095465 00000 n -0002095528 00000 n -0002095591 00000 n -0002095654 00000 n -0002095717 00000 n -0002095780 00000 n -0002095843 00000 n -0002095906 00000 n -0002095969 00000 n -0002096032 00000 n -0002096095 00000 n -0002096157 00000 n -0002096220 00000 n -0002098507 00000 n -0002098006 00000 n -0002096369 00000 n -0002098129 00000 n -0002098192 00000 n -0002098318 00000 n -0002098444 00000 n -0002464717 00000 n -0002100374 00000 n -0002100062 00000 n -0002098623 00000 n -0002100185 00000 n -0002100311 00000 n -0002102075 00000 n -0002101889 00000 n -0002100490 00000 n -0002102012 00000 n -0002104049 00000 n -0002103737 00000 n -0002102177 00000 n -0002103860 00000 n -0002103986 00000 n -0002108788 00000 n -0002107675 00000 n -0002104165 00000 n -0002107970 00000 n -0002108096 00000 n -0002108222 00000 n -0002108285 00000 n -0002108348 00000 n -0002108473 00000 n -0002108536 00000 n -0002108599 00000 n -0002108725 00000 n -0002107819 00000 n -0002112786 00000 n -0002111640 00000 n -0002108918 00000 n -0002112094 00000 n -0002112220 00000 n -0002112283 00000 n -0002112346 00000 n -0002111793 00000 n -0002112472 00000 n -0002111943 00000 n -0002112597 00000 n -0002112723 00000 n -0002115971 00000 n -0002115659 00000 n -0002112902 00000 n -0002115782 00000 n -0002115908 00000 n -0002464842 00000 n -0002117443 00000 n -0002117131 00000 n -0002116101 00000 n -0002117254 00000 n -0002117380 00000 n -0002120269 00000 n -0002119705 00000 n -0002117545 00000 n -0002119828 00000 n -0002120080 00000 n -0002120206 00000 n -0002122994 00000 n -0002122808 00000 n -0002120385 00000 n -0002122931 00000 n -0002127240 00000 n -0002126803 00000 n -0002123096 00000 n -0002126926 00000 n -0002127052 00000 n -0002127177 00000 n -0002130951 00000 n -0002130136 00000 n -0002127342 00000 n -0002130259 00000 n -0002130385 00000 n -0002130511 00000 n -0002130637 00000 n -0002130763 00000 n -0002130826 00000 n -0002130889 00000 n -0002134463 00000 n -0002133459 00000 n -0002131109 00000 n -0002133582 00000 n -0002133645 00000 n -0002133708 00000 n -0002133771 00000 n -0002133834 00000 n -0002133897 00000 n -0002133960 00000 n -0002134023 00000 n -0002134149 00000 n -0002134212 00000 n -0002134275 00000 n -0002134401 00000 n -0002464967 00000 n -0002138237 00000 n -0002137798 00000 n -0002134607 00000 n -0002137921 00000 n -0002137984 00000 n -0002138047 00000 n -0002138174 00000 n -0002140604 00000 n -0002140418 00000 n -0002138367 00000 n -0002140541 00000 n -0002143740 00000 n -0002143176 00000 n -0002140720 00000 n -0002143299 00000 n -0002143551 00000 n -0002143677 00000 n -0002146773 00000 n -0002146336 00000 n -0002143899 00000 n -0002146459 00000 n -0002146585 00000 n -0002146648 00000 n -0002146711 00000 n -0002150353 00000 n -0002149422 00000 n -0002146917 00000 n -0002149913 00000 n -0002149976 00000 n -0002150039 00000 n -0002149575 00000 n -0002150164 00000 n -0002149742 00000 n -0002150290 00000 n -0002153883 00000 n -0002153321 00000 n -0002150582 00000 n -0002153444 00000 n -0002153570 00000 n -0002153696 00000 n -0002153820 00000 n -0002465092 00000 n -0002157139 00000 n -0002156575 00000 n -0002154070 00000 n -0002156698 00000 n -0002156824 00000 n -0002156950 00000 n -0002157076 00000 n -0002157816 00000 n -0002157568 00000 n -0002157255 00000 n -0002157691 00000 n -0002160735 00000 n -0002159981 00000 n -0002157904 00000 n -0002160104 00000 n -0002160167 00000 n -0002160419 00000 n -0002160545 00000 n -0002160608 00000 n -0002160672 00000 n -0002164161 00000 n -0002163723 00000 n -0002160880 00000 n -0002163846 00000 n -0002163972 00000 n -0002164035 00000 n -0002164098 00000 n -0002167544 00000 n -0002167295 00000 n -0002164334 00000 n -0002167418 00000 n -0002167481 00000 n -0002171399 00000 n -0002170962 00000 n -0002167731 00000 n -0002171085 00000 n -0002171148 00000 n -0002171211 00000 n -0002171273 00000 n -0002171336 00000 n -0002465217 00000 n -0002175011 00000 n -0002174198 00000 n -0002171487 00000 n -0002174321 00000 n -0002174384 00000 n -0002174447 00000 n -0002174510 00000 n -0002174572 00000 n -0002174635 00000 n -0002174698 00000 n -0002174761 00000 n -0002174824 00000 n -0002174886 00000 n -0002174949 00000 n -0002178799 00000 n -0002178424 00000 n -0002175226 00000 n -0002178547 00000 n -0002178610 00000 n -0002178673 00000 n -0002178736 00000 n -0002182269 00000 n -0002181390 00000 n -0002178915 00000 n -0002181703 00000 n -0002181955 00000 n -0002182081 00000 n -0002182207 00000 n -0002181534 00000 n -0002185940 00000 n -0002185184 00000 n -0002182385 00000 n -0002185500 00000 n -0002185626 00000 n -0002185328 00000 n -0002185751 00000 n -0002185877 00000 n -0002190559 00000 n -0002189026 00000 n -0002186070 00000 n -0002190118 00000 n -0002190244 00000 n -0002190370 00000 n -0002189206 00000 n -0002189397 00000 n -0002189588 00000 n -0002190496 00000 n -0002189779 00000 n -0002189944 00000 n -0002194094 00000 n -0002193589 00000 n -0002190703 00000 n -0002193905 00000 n -0002194031 00000 n -0002193733 00000 n -0002465342 00000 n -0002197927 00000 n -0002196698 00000 n -0002194238 00000 n -0002197360 00000 n -0002197612 00000 n -0002196860 00000 n -0002197035 00000 n -0002197738 00000 n -0002197207 00000 n -0002197864 00000 n -0002201251 00000 n -0002200939 00000 n -0002198029 00000 n -0002201062 00000 n -0002201188 00000 n -0002203087 00000 n -0002202649 00000 n -0002201381 00000 n -0002202772 00000 n -0002202898 00000 n -0002203024 00000 n -0002203753 00000 n -0002203505 00000 n -0002203203 00000 n -0002203628 00000 n -0002207765 00000 n -0002206007 00000 n -0002203841 00000 n -0002206883 00000 n -0002206946 00000 n -0002206178 00000 n -0002207198 00000 n -0002207324 00000 n -0002206344 00000 n -0002206524 00000 n -0002207450 00000 n -0002207576 00000 n -0002206703 00000 n -0002207702 00000 n -0002212565 00000 n -0002210608 00000 n -0002207867 00000 n -0002212063 00000 n -0002210806 00000 n -0002210977 00000 n +0001966017 00000 n +0001966080 00000 n +0001966143 00000 n +0001965861 00000 n +0002327221 00000 n +0001968693 00000 n +0001968256 00000 n +0001966322 00000 n +0001968379 00000 n +0001968442 00000 n +0001968505 00000 n +0001968630 00000 n +0002569392 00000 n +0001971126 00000 n +0001970814 00000 n +0001968823 00000 n +0001970937 00000 n +0001971000 00000 n +0001971063 00000 n +0001973138 00000 n +0001972828 00000 n +0001971256 00000 n +0001972951 00000 n +0001973014 00000 n +0001973076 00000 n +0001974561 00000 n +0001974375 00000 n +0001973268 00000 n +0001974498 00000 n +0001978041 00000 n +0001977352 00000 n +0001974677 00000 n +0001977475 00000 n +0001977601 00000 n +0001977727 00000 n +0001977853 00000 n +0001977979 00000 n +0001979376 00000 n +0001979190 00000 n +0001978256 00000 n +0001979313 00000 n +0001982446 00000 n +0001981452 00000 n +0001979492 00000 n +0001982005 00000 n +0001982257 00000 n +0001982383 00000 n +0001981605 00000 n +0001981804 00000 n +0002569517 00000 n +0001986767 00000 n +0001985760 00000 n +0001982576 00000 n +0001986452 00000 n +0001986578 00000 n +0001986704 00000 n +0001985922 00000 n +0001986096 00000 n +0001986269 00000 n +0001989858 00000 n +0001989546 00000 n +0001986883 00000 n +0001989669 00000 n +0001989795 00000 n +0001991709 00000 n +0001991523 00000 n +0001989974 00000 n +0001991646 00000 n +0001994155 00000 n +0001993231 00000 n +0001991811 00000 n +0001993966 00000 n +0001993393 00000 n +0001993585 00000 n +0001994092 00000 n +0001993756 00000 n +0001997823 00000 n +0001997259 00000 n +0001994285 00000 n +0001997382 00000 n +0001997634 00000 n +0001997760 00000 n +0002002044 00000 n +0002001239 00000 n +0001997939 00000 n +0002001855 00000 n +0002001392 00000 n +0002001624 00000 n +0002001981 00000 n +0002569642 00000 n +0002006378 00000 n +0002005814 00000 n +0002002202 00000 n +0002005937 00000 n +0002006063 00000 n +0002006189 00000 n +0002006315 00000 n +0002010416 00000 n +0002009854 00000 n +0002006522 00000 n +0002009977 00000 n +0002010103 00000 n +0002010166 00000 n +0002010229 00000 n +0002010292 00000 n +0002010355 00000 n +0002014023 00000 n +0002013711 00000 n +0002010560 00000 n +0002013834 00000 n +0002013960 00000 n +0002017992 00000 n +0002017115 00000 n +0002014224 00000 n +0002017238 00000 n +0002017364 00000 n +0002017489 00000 n +0002017615 00000 n +0002017741 00000 n +0002017867 00000 n +0002017930 00000 n +0002021498 00000 n +0002020559 00000 n +0002018122 00000 n +0002020682 00000 n +0002020745 00000 n +0002020808 00000 n +0002020871 00000 n +0002020934 00000 n +0002020997 00000 n +0002021059 00000 n +0002021122 00000 n +0002021185 00000 n +0002021311 00000 n +0002021437 00000 n +0002022563 00000 n +0002022377 00000 n +0002021642 00000 n +0002022500 00000 n +0002569767 00000 n +0002025399 00000 n +0002024711 00000 n +0002022665 00000 n +0002024834 00000 n +0002025086 00000 n +0002025212 00000 n +0002025337 00000 n +0002028624 00000 n +0002028186 00000 n +0002025544 00000 n +0002028309 00000 n +0002028435 00000 n +0002028561 00000 n +0002031372 00000 n +0002030935 00000 n +0002028839 00000 n +0002031058 00000 n +0002031184 00000 n +0002031310 00000 n +0002035690 00000 n +0002035126 00000 n +0002031516 00000 n +0002035249 00000 n +0002035375 00000 n +0002035501 00000 n +0002035564 00000 n +0002035627 00000 n +0002039454 00000 n +0002038891 00000 n +0002035891 00000 n +0002039014 00000 n +0002039077 00000 n +0002039140 00000 n +0002039203 00000 n +0002039266 00000 n +0002039329 00000 n +0002039391 00000 n +0002043353 00000 n +0002042603 00000 n +0002039655 00000 n +0002042726 00000 n +0002042852 00000 n +0002042976 00000 n +0002043039 00000 n +0002043102 00000 n +0002043165 00000 n +0002043228 00000 n +0002043291 00000 n +0002569892 00000 n +0002046937 00000 n +0002046122 00000 n +0002043511 00000 n +0002046245 00000 n +0002046308 00000 n +0002046371 00000 n +0002046434 00000 n +0002046497 00000 n +0002046560 00000 n +0002046623 00000 n +0002046686 00000 n +0002046749 00000 n +0002046812 00000 n +0002046875 00000 n +0002050931 00000 n +0002049738 00000 n +0002047166 00000 n +0002049861 00000 n +0002049924 00000 n +0002049987 00000 n +0002050050 00000 n +0002050113 00000 n +0002050175 00000 n +0002050238 00000 n +0002050301 00000 n +0002050364 00000 n +0002050427 00000 n +0002050490 00000 n +0002050553 00000 n +0002050616 00000 n +0002050742 00000 n +0002050868 00000 n +0002054315 00000 n +0002053310 00000 n +0002051075 00000 n +0002053433 00000 n +0002053559 00000 n +0002053622 00000 n +0002053685 00000 n +0002053748 00000 n +0002053811 00000 n +0002053874 00000 n +0002053937 00000 n +0002054000 00000 n +0002054126 00000 n +0002054252 00000 n +0002058285 00000 n +0002057548 00000 n +0002054516 00000 n +0002057844 00000 n +0002057970 00000 n +0002058096 00000 n +0002057692 00000 n +0002058222 00000 n +0002062072 00000 n +0002061509 00000 n +0002058486 00000 n +0002061632 00000 n +0002061758 00000 n +0002061883 00000 n +0002062009 00000 n +0002066137 00000 n +0002065574 00000 n +0002062273 00000 n +0002065697 00000 n +0002065823 00000 n +0002065886 00000 n +0002065949 00000 n +0002066011 00000 n +0002066074 00000 n +0002570017 00000 n +0002069160 00000 n +0002068672 00000 n +0002066281 00000 n +0002068971 00000 n +0002068816 00000 n +0002069034 00000 n +0002069097 00000 n +0002072827 00000 n +0002072217 00000 n +0002069290 00000 n +0002072511 00000 n +0002072361 00000 n +0002072574 00000 n +0002072637 00000 n +0002072764 00000 n +0002076315 00000 n +0002075824 00000 n +0002073042 00000 n +0002076125 00000 n +0002075968 00000 n +0002076188 00000 n +0002076251 00000 n +0002079429 00000 n +0002078993 00000 n +0002076445 00000 n +0002079116 00000 n +0002079242 00000 n +0002079367 00000 n +0002082586 00000 n +0002082274 00000 n +0002079587 00000 n +0002082397 00000 n +0002082523 00000 n +0002085436 00000 n +0002085125 00000 n +0002082702 00000 n +0002085248 00000 n +0002085373 00000 n +0002570142 00000 n +0002088916 00000 n +0002088306 00000 n +0002085637 00000 n +0002088601 00000 n +0002088450 00000 n +0002088853 00000 n +0002092559 00000 n +0002092247 00000 n +0002089103 00000 n +0002092370 00000 n +0002092496 00000 n +0002096316 00000 n +0002095672 00000 n +0002092675 00000 n +0002096001 00000 n +0002096127 00000 n +0002096253 00000 n +0002095816 00000 n +0002100443 00000 n +0002100257 00000 n +0002096474 00000 n +0002100380 00000 n +0002103772 00000 n +0002103586 00000 n +0002100587 00000 n +0002103709 00000 n +0002107210 00000 n +0002107024 00000 n +0002103902 00000 n +0002107147 00000 n +0002570267 00000 n +0002109854 00000 n +0002109290 00000 n +0002107354 00000 n +0002109413 00000 n +0002109539 00000 n +0002109665 00000 n +0002109791 00000 n +0002112471 00000 n +0002112285 00000 n +0002109984 00000 n +0002112408 00000 n +0002115984 00000 n +0002115546 00000 n +0002112587 00000 n +0002115669 00000 n +0002115795 00000 n +0002115921 00000 n +0002120166 00000 n +0002119549 00000 n +0002116171 00000 n +0002119851 00000 n +0002119977 00000 n +0002119693 00000 n +0002120103 00000 n +0002123055 00000 n +0002123308 00000 n +0002122869 00000 n +0002120367 00000 n +0002122992 00000 n +0002123118 00000 n +0002123245 00000 n +0002125720 00000 n +0002125032 00000 n +0002123452 00000 n +0002125155 00000 n +0002125281 00000 n +0002125407 00000 n +0002125532 00000 n +0002125658 00000 n +0002570392 00000 n +0002128043 00000 n +0002127731 00000 n +0002125850 00000 n +0002127854 00000 n +0002127980 00000 n +0002129101 00000 n +0002128915 00000 n +0002128201 00000 n +0002129038 00000 n +0002131923 00000 n +0002131359 00000 n +0002129231 00000 n +0002131482 00000 n +0002131734 00000 n +0002131860 00000 n +0002134789 00000 n +0002134352 00000 n +0002132068 00000 n +0002134475 00000 n +0002134600 00000 n +0002134726 00000 n +0002138415 00000 n +0002137979 00000 n +0002134976 00000 n +0002138102 00000 n +0002138228 00000 n +0002138353 00000 n +0002140997 00000 n +0002140686 00000 n +0002138545 00000 n +0002140809 00000 n +0002140934 00000 n +0002570517 00000 n +0002145721 00000 n +0002144809 00000 n +0002141127 00000 n +0002145279 00000 n +0002145405 00000 n +0002144962 00000 n +0002145120 00000 n +0002145468 00000 n +0002145531 00000 n +0002145595 00000 n +0002145658 00000 n +0002149174 00000 n +0002148738 00000 n +0002145879 00000 n +0002148861 00000 n +0002148986 00000 n +0002149111 00000 n +0002151197 00000 n +0002151011 00000 n +0002149304 00000 n +0002151134 00000 n +0002154272 00000 n +0002153710 00000 n +0002151299 00000 n +0002153833 00000 n +0002153959 00000 n +0002154085 00000 n +0002154210 00000 n +0002157283 00000 n +0002156373 00000 n +0002154402 00000 n +0002156843 00000 n +0002156526 00000 n +0002156685 00000 n +0002156969 00000 n +0002157095 00000 n +0002157221 00000 n +0002159479 00000 n +0002159167 00000 n +0002157441 00000 n +0002159290 00000 n +0002159416 00000 n +0002570642 00000 n +0002163165 00000 n +0002162226 00000 n +0002159623 00000 n +0002162724 00000 n +0002162976 00000 n +0002162379 00000 n +0002163102 00000 n +0002162552 00000 n +0002166886 00000 n +0002165879 00000 n +0002163295 00000 n +0002166445 00000 n +0002166571 00000 n +0002166697 00000 n +0002166823 00000 n +0002166032 00000 n +0002166239 00000 n +0002168461 00000 n +0002168023 00000 n +0002167044 00000 n +0002168146 00000 n +0002168272 00000 n +0002168398 00000 n +0002169986 00000 n +0002169422 00000 n +0002168605 00000 n +0002169545 00000 n +0002169797 00000 n +0002169923 00000 n +0002170960 00000 n +0002170522 00000 n +0002170074 00000 n +0002170645 00000 n +0002170897 00000 n +0002171605 00000 n +0002171357 00000 n +0002171048 00000 n +0002171480 00000 n +0002570767 00000 n +0002175225 00000 n +0002174233 00000 n +0002171693 00000 n +0002174533 00000 n +0002174596 00000 n +0002174847 00000 n +0002174377 00000 n +0002174973 00000 n +0002175036 00000 n +0002175099 00000 n +0002175162 00000 n +0002178651 00000 n +0002177521 00000 n +0002175369 00000 n +0002177644 00000 n +0002177707 00000 n +0002177770 00000 n +0002177833 00000 n +0002177896 00000 n +0002177959 00000 n +0002178022 00000 n +0002178085 00000 n +0002178148 00000 n +0002178211 00000 n +0002178274 00000 n +0002178337 00000 n +0002178463 00000 n +0002178589 00000 n +0002180056 00000 n +0002179744 00000 n +0002178781 00000 n +0002179867 00000 n +0002179993 00000 n +0002181229 00000 n +0002181043 00000 n +0002180172 00000 n +0002181166 00000 n +0002182413 00000 n +0002182227 00000 n +0002181331 00000 n +0002182350 00000 n +0002184549 00000 n +0002183989 00000 n +0002182515 00000 n +0002184112 00000 n +0002184237 00000 n +0002184361 00000 n +0002184487 00000 n +0002570892 00000 n +0002188815 00000 n +0002187601 00000 n +0002184665 00000 n +0002188059 00000 n +0002187754 00000 n +0002188122 00000 n +0002188185 00000 n +0002188312 00000 n +0002188375 00000 n +0002188438 00000 n +0002188564 00000 n +0002187909 00000 n +0002188690 00000 n +0002188752 00000 n +0002192270 00000 n +0002191598 00000 n +0002188945 00000 n +0002191892 00000 n +0002191955 00000 n +0002191742 00000 n +0002192081 00000 n +0002192207 00000 n +0002195238 00000 n +0002194800 00000 n +0002192442 00000 n +0002194923 00000 n +0002195049 00000 n +0002195175 00000 n +0002196144 00000 n +0002195958 00000 n +0002195382 00000 n +0002196081 00000 n +0002198841 00000 n +0002198277 00000 n +0002196232 00000 n +0002198400 00000 n +0002198652 00000 n +0002198778 00000 n +0002201177 00000 n +0002200991 00000 n +0002198957 00000 n +0002201114 00000 n +0002571017 00000 n +0002205388 00000 n +0002204951 00000 n +0002201279 00000 n +0002205074 00000 n +0002205200 00000 n +0002205325 00000 n +0002208974 00000 n +0002208222 00000 n +0002205504 00000 n +0002208345 00000 n +0002208471 00000 n +0002208597 00000 n +0002208723 00000 n +0002208849 00000 n +0002208911 00000 n +0002212316 00000 n +0002211200 00000 n +0002209160 00000 n +0002211496 00000 n +0002211559 00000 n +0002211622 00000 n +0002211685 00000 n +0002211748 00000 n +0002211811 00000 n +0002211874 00000 n +0002211937 00000 n +0002212000 00000 n 0002212126 00000 n +0002211344 00000 n 0002212189 00000 n 0002212252 00000 n -0002212314 00000 n -0002212377 00000 n -0002212503 00000 n -0002211147 00000 n -0002211332 00000 n -0002211516 00000 n -0002211704 00000 n -0002211891 00000 n -0002465467 00000 n -0002214912 00000 n -0002214474 00000 n -0002212695 00000 n -0002214597 00000 n -0002214723 00000 n -0002214849 00000 n -0002217213 00000 n -0002216776 00000 n -0002215028 00000 n -0002216899 00000 n -0002217025 00000 n -0002217151 00000 n -0002220072 00000 n -0002219509 00000 n -0002217343 00000 n -0002219632 00000 n -0002219758 00000 n -0002219884 00000 n -0002220010 00000 n -0002222349 00000 n -0002222163 00000 n -0002220259 00000 n -0002222286 00000 n -0002223997 00000 n -0002223685 00000 n -0002222536 00000 n -0002223808 00000 n -0002223934 00000 n -0002227407 00000 n -0002226530 00000 n -0002224184 00000 n -0002226841 00000 n -0002227093 00000 n -0002227219 00000 n -0002226674 00000 n -0002227344 00000 n -0002465592 00000 n -0002228920 00000 n -0002228734 00000 n -0002227495 00000 n -0002228857 00000 n -0002231645 00000 n -0002230830 00000 n -0002229022 00000 n -0002230953 00000 n -0002231079 00000 n -0002231205 00000 n -0002231331 00000 n -0002231457 00000 n -0002231583 00000 n -0002233183 00000 n -0002232871 00000 n -0002231761 00000 n -0002232994 00000 n -0002237341 00000 n -0002235672 00000 n -0002233285 00000 n -0002236775 00000 n -0002237027 00000 n -0002235852 00000 n -0002236023 00000 n -0002236212 00000 n -0002236396 00000 n -0002236588 00000 n -0002237152 00000 n -0002237278 00000 n -0002241254 00000 n -0002240398 00000 n -0002237457 00000 n -0002240940 00000 n -0002241066 00000 n -0002240551 00000 n -0002240750 00000 n -0002241192 00000 n -0002245072 00000 n -0002244132 00000 n -0002241384 00000 n -0002244255 00000 n -0002244381 00000 n -0002244507 00000 n -0002244631 00000 n -0002244757 00000 n -0002244883 00000 n -0002245009 00000 n -0002465717 00000 n -0002248762 00000 n -0002248072 00000 n -0002245188 00000 n -0002248195 00000 n -0002248321 00000 n -0002248447 00000 n -0002248573 00000 n -0002248699 00000 n -0002251492 00000 n -0002250827 00000 n -0002248878 00000 n -0002251176 00000 n -0002251239 00000 n -0002251303 00000 n -0002251429 00000 n -0002250971 00000 n -0002254648 00000 n -0002254085 00000 n -0002251693 00000 n -0002254208 00000 n -0002254460 00000 n -0002254585 00000 n -0002258077 00000 n -0002257387 00000 n -0002254736 00000 n -0002257510 00000 n -0002257636 00000 n -0002257762 00000 n -0002257888 00000 n -0002258014 00000 n -0002261897 00000 n -0002260906 00000 n -0002258179 00000 n -0002261207 00000 n -0002261333 00000 n -0002261459 00000 n -0002261585 00000 n -0002261050 00000 n -0002261709 00000 n -0002261835 00000 n -0002263301 00000 n -0002263115 00000 n -0002261999 00000 n -0002263238 00000 n -0002465842 00000 n -0002264320 00000 n -0002263882 00000 n -0002263403 00000 n -0002264005 00000 n -0002264257 00000 n -0002271360 00000 n -0002266667 00000 n -0002264408 00000 n -0002271045 00000 n -0002271297 00000 n -0002266991 00000 n -0002267178 00000 n -0002267372 00000 n -0002267543 00000 n -0002267742 00000 n -0002267937 00000 n -0002268125 00000 n -0002268317 00000 n -0002268512 00000 n -0002268697 00000 n -0002268890 00000 n -0002269085 00000 n -0002269284 00000 n -0002269483 00000 n -0002269669 00000 n -0002269878 00000 n -0002270071 00000 n -0002270264 00000 n -0002270459 00000 n -0002270648 00000 n -0002270855 00000 n -0002274328 00000 n -0002272534 00000 n -0002271476 00000 n -0002274139 00000 n -0002272732 00000 n -0002272907 00000 n -0002273117 00000 n -0002273327 00000 n -0002274265 00000 n -0002273507 00000 n -0002273717 00000 n -0002273928 00000 n -0002274458 00000 n -0002288118 00000 n -0002288467 00000 n -0002291679 00000 n -0002291710 00000 n -0002295884 00000 n -0002295929 00000 n -0002305079 00000 n -0002307612 00000 n -0002309903 00000 n -0002316482 00000 n -0002328905 00000 n -0002329322 00000 n -0002343424 00000 n -0002359765 00000 n -0002360173 00000 n -0002381026 00000 n -0002391671 00000 n -0002394169 00000 n -0002394200 00000 n -0002398038 00000 n -0002398259 00000 n -0002416696 00000 n -0002436510 00000 n -0002440826 00000 n -0002456297 00000 n -0002465949 00000 n -0002466075 00000 n -0002466201 00000 n -0002466327 00000 n -0002466453 00000 n -0002466579 00000 n -0002466705 00000 n -0002466831 00000 n -0002466957 00000 n -0002467083 00000 n -0002467209 00000 n -0002467335 00000 n -0002467461 00000 n -0002467551 00000 n -0002467678 00000 n -0002467805 00000 n -0002467886 00000 n -0002467969 00000 n -0002541347 00000 n -0002595197 00000 n -0002595238 00000 n -0002595278 00000 n -0002595510 00000 n +0002215528 00000 n +0002214787 00000 n +0002212474 00000 n +0002215086 00000 n +0002215212 00000 n +0002214931 00000 n +0002215275 00000 n +0002215338 00000 n +0002215465 00000 n +0002218110 00000 n +0002217924 00000 n +0002215672 00000 n +0002218047 00000 n +0002219945 00000 n +0002219759 00000 n +0002218268 00000 n +0002219882 00000 n +0002571142 00000 n +0002223244 00000 n +0002222635 00000 n +0002220075 00000 n +0002222929 00000 n +0002223181 00000 n +0002222779 00000 n +0002230639 00000 n +0002226539 00000 n +0002225975 00000 n +0002223417 00000 n +0002226098 00000 n +0002226224 00000 n +0002226350 00000 n +0002226476 00000 n +0002228796 00000 n +0002228484 00000 n +0002226669 00000 n +0002228607 00000 n +0002228733 00000 n +0002230702 00000 n +0002230390 00000 n +0002228926 00000 n +0002230513 00000 n +0002233665 00000 n +0002233227 00000 n +0002230832 00000 n +0002233350 00000 n +0002233476 00000 n +0002233539 00000 n +0002233602 00000 n +0002236799 00000 n +0002236174 00000 n +0002233809 00000 n +0002236484 00000 n +0002236547 00000 n +0002236610 00000 n +0002236318 00000 n +0002236736 00000 n +0002571267 00000 n +0002240385 00000 n +0002239628 00000 n +0002236957 00000 n +0002239944 00000 n +0002240070 00000 n +0002240196 00000 n +0002239772 00000 n +0002240322 00000 n +0002243801 00000 n +0002243238 00000 n +0002240600 00000 n +0002243361 00000 n +0002243487 00000 n +0002243613 00000 n +0002243738 00000 n +0002246471 00000 n +0002245907 00000 n +0002243974 00000 n +0002246030 00000 n +0002246156 00000 n +0002246282 00000 n +0002246408 00000 n +0002247150 00000 n +0002246902 00000 n +0002246601 00000 n +0002247025 00000 n +0002250423 00000 n +0002249338 00000 n +0002247238 00000 n +0002249792 00000 n +0002249855 00000 n +0002250107 00000 n +0002250233 00000 n +0002249491 00000 n +0002249642 00000 n +0002250296 00000 n +0002250359 00000 n +0002254254 00000 n +0002253816 00000 n +0002250596 00000 n +0002253939 00000 n +0002254065 00000 n +0002254128 00000 n +0002254191 00000 n +0002571392 00000 n +0002257576 00000 n +0002257327 00000 n +0002254441 00000 n +0002257450 00000 n +0002257513 00000 n +0002261812 00000 n +0002260855 00000 n +0002257777 00000 n +0002261308 00000 n +0002261008 00000 n +0002261371 00000 n +0002261433 00000 n +0002261158 00000 n +0002261497 00000 n +0002261560 00000 n +0002261624 00000 n +0002261687 00000 n +0002261750 00000 n +0002266220 00000 n +0002265594 00000 n +0002261956 00000 n +0002265717 00000 n +0002265780 00000 n +0002265843 00000 n +0002265906 00000 n +0002265969 00000 n +0002266032 00000 n +0002266094 00000 n +0002266157 00000 n +0002270912 00000 n +0002270285 00000 n +0002266435 00000 n +0002270408 00000 n +0002270471 00000 n +0002270534 00000 n +0002270597 00000 n +0002270660 00000 n +0002270723 00000 n +0002270786 00000 n +0002270849 00000 n +0002274638 00000 n +0002273759 00000 n +0002271070 00000 n +0002274072 00000 n +0002274324 00000 n +0002274450 00000 n +0002274576 00000 n +0002273903 00000 n +0002278552 00000 n +0002277380 00000 n +0002274782 00000 n +0002277858 00000 n +0002277984 00000 n +0002277533 00000 n +0002278047 00000 n +0002278110 00000 n +0002277705 00000 n +0002278174 00000 n +0002278237 00000 n +0002278364 00000 n +0002278489 00000 n +0002571517 00000 n +0002283148 00000 n +0002281619 00000 n +0002278710 00000 n +0002282710 00000 n +0002282834 00000 n +0002282959 00000 n +0002281799 00000 n +0002281990 00000 n +0002282181 00000 n +0002283085 00000 n +0002282372 00000 n +0002282536 00000 n +0002286654 00000 n +0002286149 00000 n +0002283306 00000 n +0002286465 00000 n +0002286591 00000 n +0002286293 00000 n +0002290490 00000 n +0002289261 00000 n +0002286826 00000 n +0002289924 00000 n +0002290176 00000 n +0002289423 00000 n +0002289599 00000 n +0002290302 00000 n +0002289771 00000 n +0002290428 00000 n +0002293999 00000 n +0002293687 00000 n +0002290606 00000 n +0002293810 00000 n +0002293936 00000 n +0002295890 00000 n +0002295452 00000 n +0002294143 00000 n +0002295575 00000 n +0002295701 00000 n +0002295827 00000 n +0002296573 00000 n +0002296325 00000 n +0002296034 00000 n +0002296448 00000 n +0002571642 00000 n +0002300461 00000 n +0002298703 00000 n +0002296661 00000 n +0002299579 00000 n +0002299642 00000 n +0002298874 00000 n +0002299894 00000 n +0002300020 00000 n +0002299040 00000 n +0002299220 00000 n +0002300146 00000 n +0002300272 00000 n +0002299399 00000 n +0002300398 00000 n +0002305801 00000 n +0002303716 00000 n +0002300577 00000 n +0002305171 00000 n +0002303914 00000 n +0002304085 00000 n +0002305234 00000 n +0002305297 00000 n +0002305360 00000 n +0002305423 00000 n +0002305486 00000 n +0002305612 00000 n +0002304255 00000 n +0002304440 00000 n +0002304624 00000 n +0002304812 00000 n +0002304999 00000 n +0002305738 00000 n +0002307812 00000 n +0002307500 00000 n +0002305959 00000 n +0002307623 00000 n +0002307749 00000 n +0002310093 00000 n +0002309655 00000 n +0002307928 00000 n +0002309778 00000 n +0002309904 00000 n +0002310030 00000 n +0002313039 00000 n +0002312475 00000 n +0002310237 00000 n +0002312598 00000 n +0002312724 00000 n +0002312850 00000 n +0002312976 00000 n +0002315428 00000 n +0002315116 00000 n +0002313169 00000 n +0002315239 00000 n +0002315365 00000 n +0002571767 00000 n +0002317537 00000 n +0002317225 00000 n +0002315615 00000 n +0002317348 00000 n +0002317474 00000 n +0002321150 00000 n +0002320399 00000 n +0002317738 00000 n +0002320710 00000 n +0002320962 00000 n +0002321088 00000 n +0002320543 00000 n +0002322907 00000 n +0002322595 00000 n +0002321252 00000 n +0002322718 00000 n +0002322844 00000 n +0002325030 00000 n +0002324466 00000 n +0002323023 00000 n +0002324589 00000 n +0002324715 00000 n +0002324841 00000 n +0002324967 00000 n +0002327284 00000 n +0002326720 00000 n +0002325146 00000 n +0002326843 00000 n +0002326969 00000 n +0002327095 00000 n +0002331574 00000 n +0002329906 00000 n +0002327386 00000 n +0002331008 00000 n +0002331260 00000 n +0002330086 00000 n +0002330257 00000 n +0002330446 00000 n +0002330630 00000 n +0002330821 00000 n +0002331385 00000 n +0002331511 00000 n +0002571892 00000 n +0002335263 00000 n +0002334409 00000 n +0002331690 00000 n +0002334949 00000 n +0002335075 00000 n +0002334562 00000 n +0002334759 00000 n +0002335201 00000 n +0002339214 00000 n +0002338275 00000 n +0002335393 00000 n +0002338398 00000 n +0002338524 00000 n +0002338650 00000 n +0002338774 00000 n +0002338899 00000 n +0002339025 00000 n +0002339151 00000 n +0002342801 00000 n +0002342111 00000 n +0002339344 00000 n +0002342234 00000 n +0002342360 00000 n +0002342486 00000 n +0002342612 00000 n +0002342738 00000 n +0002345836 00000 n +0002345006 00000 n +0002342945 00000 n +0002345520 00000 n +0002345159 00000 n +0002345583 00000 n +0002345646 00000 n +0002345773 00000 n +0002345315 00000 n +0002349083 00000 n +0002348520 00000 n +0002346065 00000 n +0002348643 00000 n +0002348895 00000 n +0002349020 00000 n +0002352756 00000 n +0002352068 00000 n +0002349199 00000 n +0002352191 00000 n +0002352317 00000 n +0002352443 00000 n +0002352569 00000 n +0002352695 00000 n +0002572017 00000 n +0002356512 00000 n +0002355520 00000 n +0002352886 00000 n +0002355821 00000 n +0002355947 00000 n +0002356073 00000 n +0002356199 00000 n +0002355664 00000 n +0002356325 00000 n +0002356450 00000 n +0002357959 00000 n +0002357773 00000 n +0002356656 00000 n +0002357896 00000 n +0002358968 00000 n +0002358530 00000 n +0002358075 00000 n +0002358653 00000 n +0002358905 00000 n +0002365529 00000 n +0002360835 00000 n +0002359056 00000 n +0002365214 00000 n +0002365466 00000 n +0002361159 00000 n +0002361346 00000 n +0002361540 00000 n +0002361711 00000 n +0002361910 00000 n +0002362105 00000 n +0002362293 00000 n +0002362486 00000 n +0002362681 00000 n +0002362866 00000 n +0002363059 00000 n +0002363254 00000 n +0002363453 00000 n +0002363652 00000 n +0002363838 00000 n +0002364047 00000 n +0002364240 00000 n +0002364433 00000 n +0002364628 00000 n +0002364817 00000 n +0002365024 00000 n +0002368062 00000 n +0002366458 00000 n +0002365645 00000 n +0002367873 00000 n +0002366647 00000 n +0002366822 00000 n +0002367032 00000 n +0002367999 00000 n +0002367241 00000 n +0002367451 00000 n +0002367662 00000 n +0002368192 00000 n +0002373576 00000 n +0002373781 00000 n +0002376992 00000 n +0002379239 00000 n +0002379264 00000 n +0002383012 00000 n +0002383037 00000 n +0002391492 00000 n +0002391676 00000 n +0002397622 00000 n +0002400308 00000 n +0002403080 00000 n +0002410091 00000 n +0002422401 00000 n +0002422819 00000 n +0002432764 00000 n +0002449801 00000 n +0002469884 00000 n +0002470291 00000 n +0002486997 00000 n +0002497521 00000 n +0002500023 00000 n +0002500054 00000 n +0002503972 00000 n +0002521613 00000 n +0002541950 00000 n +0002546325 00000 n +0002562089 00000 n +0002572142 00000 n +0002572268 00000 n +0002572394 00000 n +0002572520 00000 n +0002572646 00000 n +0002572772 00000 n +0002572898 00000 n +0002573024 00000 n +0002573150 00000 n +0002573276 00000 n +0002573402 00000 n +0002573528 00000 n +0002573654 00000 n +0002573771 00000 n +0002573898 00000 n +0002574025 00000 n +0002574106 00000 n +0002574189 00000 n +0002649113 00000 n +0002704630 00000 n +0002704671 00000 n +0002704711 00000 n +0002704943 00000 n trailer << -/Size 7256 -/Root 7254 0 R -/Info 7255 0 R +/Size 7591 +/Root 7589 0 R +/Info 7590 0 R >> startxref -2595666 +2705139 %%EOF diff --git a/docs/docbook/configure b/docs/docbook/configure index d51cdfc48c..7b159a1912 100755 --- a/docs/docbook/configure +++ b/docs/docbook/configure @@ -1,32 +1,287 @@ #! /bin/sh - # Guess values for system-dependent variables and create Makefiles. -# Generated automatically using autoconf version 2.13 -# Copyright (C) 1992, 93, 94, 95, 96 Free Software Foundation, Inc. +# Generated by GNU Autoconf 2.57. # +# Copyright 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, 2002 +# Free Software Foundation, Inc. # This configure script is free software; the Free Software Foundation # gives unlimited permission to copy, distribute and modify it. +## --------------------- ## +## M4sh Initialization. ## +## --------------------- ## + +# Be Bourne compatible +if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then + emulate sh + NULLCMD=: + # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which + # is contrary to our usage. Disable this feature. + alias -g '${1+"$@"}'='"$@"' +elif test -n "${BASH_VERSION+set}" && (set -o posix) >/dev/null 2>&1; then + set -o posix +fi + +# Support unset when possible. +if (FOO=FOO; unset FOO) >/dev/null 2>&1; then + as_unset=unset +else + as_unset=false +fi + + +# Work around bugs in pre-3.0 UWIN ksh. +$as_unset ENV MAIL MAILPATH +PS1='$ ' +PS2='> ' +PS4='+ ' + +# NLS nuisances. +for as_var in \ + LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \ + LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \ + LC_TELEPHONE LC_TIME +do + if (set +x; test -n "`(eval $as_var=C; export $as_var) 2>&1`"); then + eval $as_var=C; export $as_var + else + $as_unset $as_var + fi +done + +# Required to use basename. +if expr a : '\(a\)' >/dev/null 2>&1; then + as_expr=expr +else + as_expr=false +fi + +if (basename /) >/dev/null 2>&1 && test "X`basename / 2>&1`" = "X/"; then + as_basename=basename +else + as_basename=false +fi + + +# Name of the executable. +as_me=`$as_basename "$0" || +$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ + X"$0" : 'X\(//\)$' \| \ + X"$0" : 'X\(/\)$' \| \ + . : '\(.\)' 2>/dev/null || +echo X/"$0" | + sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/; q; } + /^X\/\(\/\/\)$/{ s//\1/; q; } + /^X\/\(\/\).*/{ s//\1/; q; } + s/.*/./; q'` + + +# PATH needs CR, and LINENO needs CR and PATH. +# Avoid depending upon Character Ranges. +as_cr_letters='abcdefghijklmnopqrstuvwxyz' +as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' +as_cr_Letters=$as_cr_letters$as_cr_LETTERS +as_cr_digits='0123456789' +as_cr_alnum=$as_cr_Letters$as_cr_digits + +# The user is always right. +if test "${PATH_SEPARATOR+set}" != set; then + echo "#! /bin/sh" >conf$$.sh + echo "exit 0" >>conf$$.sh + chmod +x conf$$.sh + if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then + PATH_SEPARATOR=';' + else + PATH_SEPARATOR=: + fi + rm -f conf$$.sh +fi + + + as_lineno_1=$LINENO + as_lineno_2=$LINENO + as_lineno_3=`(expr $as_lineno_1 + 1) 2>/dev/null` + test "x$as_lineno_1" != "x$as_lineno_2" && + test "x$as_lineno_3" = "x$as_lineno_2" || { + # Find who we are. Look in the path if we contain no path at all + # relative or not. + case $0 in + *[\\/]* ) as_myself=$0 ;; + *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break +done + + ;; + esac + # We did not find ourselves, most probably we were run as `sh COMMAND' + # in which case we are not to be found in the path. + if test "x$as_myself" = x; then + as_myself=$0 + fi + if test ! -f "$as_myself"; then + { echo "$as_me: error: cannot find myself; rerun with an absolute path" >&2 + { (exit 1); exit 1; }; } + fi + case $CONFIG_SHELL in + '') + as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for as_base in sh bash ksh sh5; do + case $as_dir in + /*) + if ("$as_dir/$as_base" -c ' + as_lineno_1=$LINENO + as_lineno_2=$LINENO + as_lineno_3=`(expr $as_lineno_1 + 1) 2>/dev/null` + test "x$as_lineno_1" != "x$as_lineno_2" && + test "x$as_lineno_3" = "x$as_lineno_2" ') 2>/dev/null; then + $as_unset BASH_ENV || test "${BASH_ENV+set}" != set || { BASH_ENV=; export BASH_ENV; } + $as_unset ENV || test "${ENV+set}" != set || { ENV=; export ENV; } + CONFIG_SHELL=$as_dir/$as_base + export CONFIG_SHELL + exec "$CONFIG_SHELL" "$0" ${1+"$@"} + fi;; + esac + done +done +;; + esac + + # Create $as_me.lineno as a copy of $as_myself, but with $LINENO + # uniformly replaced by the line number. The first 'sed' inserts a + # line-number line before each line; the second 'sed' does the real + # work. The second script uses 'N' to pair each line-number line + # with the numbered line, and appends trailing '-' during + # substitution so that $LINENO is not a special case at line end. + # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the + # second 'sed' script. Blame Lee E. McMahon for sed's syntax. :-) + sed '=' <$as_myself | + sed ' + N + s,$,-, + : loop + s,^\(['$as_cr_digits']*\)\(.*\)[$]LINENO\([^'$as_cr_alnum'_]\),\1\2\1\3, + t loop + s,-$,, + s,^['$as_cr_digits']*\n,, + ' >$as_me.lineno && + chmod +x $as_me.lineno || + { echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2 + { (exit 1); exit 1; }; } + + # Don't try to exec as it changes $[0], causing all sort of problems + # (the dirname of $[0] is not the place where we might find the + # original and so on. Autoconf is especially sensible to this). + . ./$as_me.lineno + # Exit status is that of the last command. + exit +} + + +case `echo "testing\c"; echo 1,2,3`,`echo -n testing; echo 1,2,3` in + *c*,-n*) ECHO_N= ECHO_C=' +' ECHO_T=' ' ;; + *c*,* ) ECHO_N=-n ECHO_C= ECHO_T= ;; + *) ECHO_N= ECHO_C='\c' ECHO_T= ;; +esac + +if expr a : '\(a\)' >/dev/null 2>&1; then + as_expr=expr +else + as_expr=false +fi + +rm -f conf$$ conf$$.exe conf$$.file +echo >conf$$.file +if ln -s conf$$.file conf$$ 2>/dev/null; then + # We could just check for DJGPP; but this test a) works b) is more generic + # and c) will remain valid once DJGPP supports symlinks (DJGPP 2.04). + if test -f conf$$.exe; then + # Don't use ln at all; we don't have any links + as_ln_s='cp -p' + else + as_ln_s='ln -s' + fi +elif ln conf$$.file conf$$ 2>/dev/null; then + as_ln_s=ln +else + as_ln_s='cp -p' +fi +rm -f conf$$ conf$$.exe conf$$.file + +if mkdir -p . 2>/dev/null; then + as_mkdir_p=: +else + as_mkdir_p=false +fi + +as_executable_p="test -f" + +# Sed expression to map a string onto a valid CPP name. +as_tr_cpp="sed y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g" + +# Sed expression to map a string onto a valid variable name. +as_tr_sh="sed y%*+%pp%;s%[^_$as_cr_alnum]%_%g" + + +# IFS +# We need space, tab and new line, in precisely that order. +as_nl=' +' +IFS=" $as_nl" + +# CDPATH. +$as_unset CDPATH + + +# Name of the host. +# hostname on some systems (SVR3.2, Linux) returns a bogus exit status, +# so uname gets run too. +ac_hostname=`(hostname || uname -n) 2>/dev/null | sed 1q` -# Defaults: -ac_help= +exec 6>&1 + +# +# Initializations. +# ac_default_prefix=/usr/local -# Any additions from configure.in: -ac_help="$ac_help - --enable-crop Whether to use a crop template" -ac_help="$ac_help - --with-papersize Specify papersize (a4paper,letter) " -ac_help="$ac_help - --with-fontsize Specify the fontsize in points (default: 10.5) " +ac_config_libobj_dir=. +cross_compiling=no +subdirs= +MFLAGS= +MAKEFLAGS= +SHELL=${CONFIG_SHELL-/bin/sh} + +# Maximum number of lines to put in a shell here document. +# This variable seems obsolete. It should probably be removed, and +# only ac_max_sed_lines should be used. +: ${ac_max_here_lines=38} + +# Identity of this package. +PACKAGE_NAME= +PACKAGE_TARNAME= +PACKAGE_VERSION= +PACKAGE_STRING= +PACKAGE_BUGREPORT= + +ac_unique_file="global.ent" +ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS XSLTPROC PDFLATEX MAKEINDEX LATEX DVIPS PNGTOPNM PNMTOPS PERL XMLTO DOC_BUILD_DATE TEXSTYLESHEET PAPERSIZE DUPLICATE_ULINKS FONTSIZE CROP LIBOBJS LTLIBOBJS' +ac_subst_files='' # Initialize some variables set by options. +ac_init_help= +ac_init_version=false # The variables have the same names as the options, with # dashes changed to underlines. -build=NONE -cache_file=./config.cache +cache_file=/dev/null exec_prefix=NONE -host=NONE no_create= -nonopt=NONE no_recursion= prefix=NONE program_prefix=NONE @@ -35,10 +290,15 @@ program_transform_name=s,x,x, silent= site= srcdir= -target=NONE verbose= x_includes=NONE x_libraries=NONE + +# Installation directory options. +# These are left unexpanded so users can "make install exec_prefix=/foo" +# and all the variables that are supposed to be based on exec_prefix +# by default will actually change. +# Use braces instead of parens because sh, perl, etc. also accept them. bindir='${exec_prefix}/bin' sbindir='${exec_prefix}/sbin' libexecdir='${exec_prefix}/libexec' @@ -52,17 +312,9 @@ oldincludedir='/usr/include' infodir='${prefix}/info' mandir='${prefix}/man' -# Initialize some other variables. -subdirs= -MFLAGS= MAKEFLAGS= -SHELL=${CONFIG_SHELL-/bin/sh} -# Maximum number of lines to put in a shell here document. -ac_max_here_lines=12 - ac_prev= for ac_option do - # If the previous option needs an argument, assign it. if test -n "$ac_prev"; then eval "$ac_prev=\$ac_option" @@ -70,59 +322,59 @@ do continue fi - case "$ac_option" in - -*=*) ac_optarg=`echo "$ac_option" | sed 's/[-_a-zA-Z0-9]*=//'` ;; - *) ac_optarg= ;; - esac + ac_optarg=`expr "x$ac_option" : 'x[^=]*=\(.*\)'` # Accept the important Cygnus configure options, so we can diagnose typos. - case "$ac_option" in + case $ac_option in -bindir | --bindir | --bindi | --bind | --bin | --bi) ac_prev=bindir ;; -bindir=* | --bindir=* | --bindi=* | --bind=* | --bin=* | --bi=*) - bindir="$ac_optarg" ;; + bindir=$ac_optarg ;; -build | --build | --buil | --bui | --bu) - ac_prev=build ;; + ac_prev=build_alias ;; -build=* | --build=* | --buil=* | --bui=* | --bu=*) - build="$ac_optarg" ;; + build_alias=$ac_optarg ;; -cache-file | --cache-file | --cache-fil | --cache-fi \ | --cache-f | --cache- | --cache | --cach | --cac | --ca | --c) ac_prev=cache_file ;; -cache-file=* | --cache-file=* | --cache-fil=* | --cache-fi=* \ | --cache-f=* | --cache-=* | --cache=* | --cach=* | --cac=* | --ca=* | --c=*) - cache_file="$ac_optarg" ;; + cache_file=$ac_optarg ;; + + --config-cache | -C) + cache_file=config.cache ;; -datadir | --datadir | --datadi | --datad | --data | --dat | --da) ac_prev=datadir ;; -datadir=* | --datadir=* | --datadi=* | --datad=* | --data=* | --dat=* \ | --da=*) - datadir="$ac_optarg" ;; + datadir=$ac_optarg ;; -disable-* | --disable-*) - ac_feature=`echo $ac_option|sed -e 's/-*disable-//'` + ac_feature=`expr "x$ac_option" : 'x-*disable-\(.*\)'` # Reject names that are not valid shell variable names. - if test -n "`echo $ac_feature| sed 's/[-a-zA-Z0-9_]//g'`"; then - { echo "configure: error: $ac_feature: invalid feature name" 1>&2; exit 1; } - fi - ac_feature=`echo $ac_feature| sed 's/-/_/g'` - eval "enable_${ac_feature}=no" ;; + expr "x$ac_feature" : ".*[^-_$as_cr_alnum]" >/dev/null && + { echo "$as_me: error: invalid feature name: $ac_feature" >&2 + { (exit 1); exit 1; }; } + ac_feature=`echo $ac_feature | sed 's/-/_/g'` + eval "enable_$ac_feature=no" ;; -enable-* | --enable-*) - ac_feature=`echo $ac_option|sed -e 's/-*enable-//' -e 's/=.*//'` + ac_feature=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'` # Reject names that are not valid shell variable names. - if test -n "`echo $ac_feature| sed 's/[-_a-zA-Z0-9]//g'`"; then - { echo "configure: error: $ac_feature: invalid feature name" 1>&2; exit 1; } - fi - ac_feature=`echo $ac_feature| sed 's/-/_/g'` - case "$ac_option" in - *=*) ;; + expr "x$ac_feature" : ".*[^-_$as_cr_alnum]" >/dev/null && + { echo "$as_me: error: invalid feature name: $ac_feature" >&2 + { (exit 1); exit 1; }; } + ac_feature=`echo $ac_feature | sed 's/-/_/g'` + case $ac_option in + *=*) ac_optarg=`echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"`;; *) ac_optarg=yes ;; esac - eval "enable_${ac_feature}='$ac_optarg'" ;; + eval "enable_$ac_feature='$ac_optarg'" ;; -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \ | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \ @@ -131,95 +383,47 @@ do -exec-prefix=* | --exec_prefix=* | --exec-prefix=* | --exec-prefi=* \ | --exec-pref=* | --exec-pre=* | --exec-pr=* | --exec-p=* | --exec-=* \ | --exec=* | --exe=* | --ex=*) - exec_prefix="$ac_optarg" ;; + exec_prefix=$ac_optarg ;; -gas | --gas | --ga | --g) # Obsolete; use --with-gas. with_gas=yes ;; - -help | --help | --hel | --he) - # Omit some internal or obsolete options to make the list less imposing. - # This message is too long to be a string in the A/UX 3.1 sh. - cat << EOF -Usage: configure [options] [host] -Options: [defaults in brackets after descriptions] -Configuration: - --cache-file=FILE cache test results in FILE - --help print this message - --no-create do not create output files - --quiet, --silent do not print \`checking...' messages - --version print the version of autoconf that created configure -Directory and file names: - --prefix=PREFIX install architecture-independent files in PREFIX - [$ac_default_prefix] - --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX - [same as prefix] - --bindir=DIR user executables in DIR [EPREFIX/bin] - --sbindir=DIR system admin executables in DIR [EPREFIX/sbin] - --libexecdir=DIR program executables in DIR [EPREFIX/libexec] - --datadir=DIR read-only architecture-independent data in DIR - [PREFIX/share] - --sysconfdir=DIR read-only single-machine data in DIR [PREFIX/etc] - --sharedstatedir=DIR modifiable architecture-independent data in DIR - [PREFIX/com] - --localstatedir=DIR modifiable single-machine data in DIR [PREFIX/var] - --libdir=DIR object code libraries in DIR [EPREFIX/lib] - --includedir=DIR C header files in DIR [PREFIX/include] - --oldincludedir=DIR C header files for non-gcc in DIR [/usr/include] - --infodir=DIR info documentation in DIR [PREFIX/info] - --mandir=DIR man documentation in DIR [PREFIX/man] - --srcdir=DIR find the sources in DIR [configure dir or ..] - --program-prefix=PREFIX prepend PREFIX to installed program names - --program-suffix=SUFFIX append SUFFIX to installed program names - --program-transform-name=PROGRAM - run sed PROGRAM on installed program names -EOF - cat << EOF -Host type: - --build=BUILD configure for building on BUILD [BUILD=HOST] - --host=HOST configure for HOST [guessed] - --target=TARGET configure for TARGET [TARGET=HOST] -Features and packages: - --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) - --enable-FEATURE[=ARG] include FEATURE [ARG=yes] - --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] - --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) - --x-includes=DIR X include files are in DIR - --x-libraries=DIR X library files are in DIR -EOF - if test -n "$ac_help"; then - echo "--enable and --with options recognized:$ac_help" - fi - exit 0 ;; + -help | --help | --hel | --he | -h) + ac_init_help=long ;; + -help=r* | --help=r* | --hel=r* | --he=r* | -hr*) + ac_init_help=recursive ;; + -help=s* | --help=s* | --hel=s* | --he=s* | -hs*) + ac_init_help=short ;; -host | --host | --hos | --ho) - ac_prev=host ;; + ac_prev=host_alias ;; -host=* | --host=* | --hos=* | --ho=*) - host="$ac_optarg" ;; + host_alias=$ac_optarg ;; -includedir | --includedir | --includedi | --included | --include \ | --includ | --inclu | --incl | --inc) ac_prev=includedir ;; -includedir=* | --includedir=* | --includedi=* | --included=* | --include=* \ | --includ=* | --inclu=* | --incl=* | --inc=*) - includedir="$ac_optarg" ;; + includedir=$ac_optarg ;; -infodir | --infodir | --infodi | --infod | --info | --inf) ac_prev=infodir ;; -infodir=* | --infodir=* | --infodi=* | --infod=* | --info=* | --inf=*) - infodir="$ac_optarg" ;; + infodir=$ac_optarg ;; -libdir | --libdir | --libdi | --libd) ac_prev=libdir ;; -libdir=* | --libdir=* | --libdi=* | --libd=*) - libdir="$ac_optarg" ;; + libdir=$ac_optarg ;; -libexecdir | --libexecdir | --libexecdi | --libexecd | --libexec \ | --libexe | --libex | --libe) ac_prev=libexecdir ;; -libexecdir=* | --libexecdir=* | --libexecdi=* | --libexecd=* | --libexec=* \ | --libexe=* | --libex=* | --libe=*) - libexecdir="$ac_optarg" ;; + libexecdir=$ac_optarg ;; -localstatedir | --localstatedir | --localstatedi | --localstated \ | --localstate | --localstat | --localsta | --localst \ @@ -228,19 +432,19 @@ EOF -localstatedir=* | --localstatedir=* | --localstatedi=* | --localstated=* \ | --localstate=* | --localstat=* | --localsta=* | --localst=* \ | --locals=* | --local=* | --loca=* | --loc=* | --lo=*) - localstatedir="$ac_optarg" ;; + localstatedir=$ac_optarg ;; -mandir | --mandir | --mandi | --mand | --man | --ma | --m) ac_prev=mandir ;; -mandir=* | --mandir=* | --mandi=* | --mand=* | --man=* | --ma=* | --m=*) - mandir="$ac_optarg" ;; + mandir=$ac_optarg ;; -nfp | --nfp | --nf) # Obsolete; use --without-fp. with_fp=no ;; -no-create | --no-create | --no-creat | --no-crea | --no-cre \ - | --no-cr | --no-c) + | --no-cr | --no-c | -n) no_create=yes ;; -no-recursion | --no-recursion | --no-recursio | --no-recursi \ @@ -254,26 +458,26 @@ EOF -oldincludedir=* | --oldincludedir=* | --oldincludedi=* | --oldincluded=* \ | --oldinclude=* | --oldinclud=* | --oldinclu=* | --oldincl=* | --oldinc=* \ | --oldin=* | --oldi=* | --old=* | --ol=* | --o=*) - oldincludedir="$ac_optarg" ;; + oldincludedir=$ac_optarg ;; -prefix | --prefix | --prefi | --pref | --pre | --pr | --p) ac_prev=prefix ;; -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*) - prefix="$ac_optarg" ;; + prefix=$ac_optarg ;; -program-prefix | --program-prefix | --program-prefi | --program-pref \ | --program-pre | --program-pr | --program-p) ac_prev=program_prefix ;; -program-prefix=* | --program-prefix=* | --program-prefi=* \ | --program-pref=* | --program-pre=* | --program-pr=* | --program-p=*) - program_prefix="$ac_optarg" ;; + program_prefix=$ac_optarg ;; -program-suffix | --program-suffix | --program-suffi | --program-suff \ | --program-suf | --program-su | --program-s) ac_prev=program_suffix ;; -program-suffix=* | --program-suffix=* | --program-suffi=* \ | --program-suff=* | --program-suf=* | --program-su=* | --program-s=*) - program_suffix="$ac_optarg" ;; + program_suffix=$ac_optarg ;; -program-transform-name | --program-transform-name \ | --program-transform-nam | --program-transform-na \ @@ -290,7 +494,7 @@ EOF | --program-transfo=* | --program-transf=* \ | --program-trans=* | --program-tran=* \ | --progr-tra=* | --program-tr=* | --program-t=*) - program_transform_name="$ac_optarg" ;; + program_transform_name=$ac_optarg ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) @@ -300,7 +504,7 @@ EOF ac_prev=sbindir ;; -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ | --sbi=* | --sb=*) - sbindir="$ac_optarg" ;; + sbindir=$ac_optarg ;; -sharedstatedir | --sharedstatedir | --sharedstatedi \ | --sharedstated | --sharedstate | --sharedstat | --sharedsta \ @@ -311,58 +515,57 @@ EOF | --sharedstated=* | --sharedstate=* | --sharedstat=* | --sharedsta=* \ | --sharedst=* | --shareds=* | --shared=* | --share=* | --shar=* \ | --sha=* | --sh=*) - sharedstatedir="$ac_optarg" ;; + sharedstatedir=$ac_optarg ;; -site | --site | --sit) ac_prev=site ;; -site=* | --site=* | --sit=*) - site="$ac_optarg" ;; + site=$ac_optarg ;; -srcdir | --srcdir | --srcdi | --srcd | --src | --sr) ac_prev=srcdir ;; -srcdir=* | --srcdir=* | --srcdi=* | --srcd=* | --src=* | --sr=*) - srcdir="$ac_optarg" ;; + srcdir=$ac_optarg ;; -sysconfdir | --sysconfdir | --sysconfdi | --sysconfd | --sysconf \ | --syscon | --sysco | --sysc | --sys | --sy) ac_prev=sysconfdir ;; -sysconfdir=* | --sysconfdir=* | --sysconfdi=* | --sysconfd=* | --sysconf=* \ | --syscon=* | --sysco=* | --sysc=* | --sys=* | --sy=*) - sysconfdir="$ac_optarg" ;; + sysconfdir=$ac_optarg ;; -target | --target | --targe | --targ | --tar | --ta | --t) - ac_prev=target ;; + ac_prev=target_alias ;; -target=* | --target=* | --targe=* | --targ=* | --tar=* | --ta=* | --t=*) - target="$ac_optarg" ;; + target_alias=$ac_optarg ;; -v | -verbose | --verbose | --verbos | --verbo | --verb) verbose=yes ;; - -version | --version | --versio | --versi | --vers) - echo "configure generated by autoconf version 2.13" - exit 0 ;; + -version | --version | --versio | --versi | --vers | -V) + ac_init_version=: ;; -with-* | --with-*) - ac_package=`echo $ac_option|sed -e 's/-*with-//' -e 's/=.*//'` + ac_package=`expr "x$ac_option" : 'x-*with-\([^=]*\)'` # Reject names that are not valid shell variable names. - if test -n "`echo $ac_package| sed 's/[-_a-zA-Z0-9]//g'`"; then - { echo "configure: error: $ac_package: invalid package name" 1>&2; exit 1; } - fi + expr "x$ac_package" : ".*[^-_$as_cr_alnum]" >/dev/null && + { echo "$as_me: error: invalid package name: $ac_package" >&2 + { (exit 1); exit 1; }; } ac_package=`echo $ac_package| sed 's/-/_/g'` - case "$ac_option" in - *=*) ;; + case $ac_option in + *=*) ac_optarg=`echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"`;; *) ac_optarg=yes ;; esac - eval "with_${ac_package}='$ac_optarg'" ;; + eval "with_$ac_package='$ac_optarg'" ;; -without-* | --without-*) - ac_package=`echo $ac_option|sed -e 's/-*without-//'` + ac_package=`expr "x$ac_option" : 'x-*without-\(.*\)'` # Reject names that are not valid shell variable names. - if test -n "`echo $ac_package| sed 's/[-a-zA-Z0-9_]//g'`"; then - { echo "configure: error: $ac_package: invalid package name" 1>&2; exit 1; } - fi - ac_package=`echo $ac_package| sed 's/-/_/g'` - eval "with_${ac_package}=no" ;; + expr "x$ac_package" : ".*[^-_$as_cr_alnum]" >/dev/null && + { echo "$as_me: error: invalid package name: $ac_package" >&2 + { (exit 1); exit 1; }; } + ac_package=`echo $ac_package | sed 's/-/_/g'` + eval "with_$ac_package=no" ;; --x) # Obsolete; use --with-x. @@ -373,99 +576,110 @@ EOF ac_prev=x_includes ;; -x-includes=* | --x-includes=* | --x-include=* | --x-includ=* | --x-inclu=* \ | --x-incl=* | --x-inc=* | --x-in=* | --x-i=*) - x_includes="$ac_optarg" ;; + x_includes=$ac_optarg ;; -x-libraries | --x-libraries | --x-librarie | --x-librari \ | --x-librar | --x-libra | --x-libr | --x-lib | --x-li | --x-l) ac_prev=x_libraries ;; -x-libraries=* | --x-libraries=* | --x-librarie=* | --x-librari=* \ | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*) - x_libraries="$ac_optarg" ;; + x_libraries=$ac_optarg ;; - -*) { echo "configure: error: $ac_option: invalid option; use --help to show usage" 1>&2; exit 1; } + -*) { echo "$as_me: error: unrecognized option: $ac_option +Try \`$0 --help' for more information." >&2 + { (exit 1); exit 1; }; } ;; + *=*) + ac_envvar=`expr "x$ac_option" : 'x\([^=]*\)='` + # Reject names that are not valid shell variable names. + expr "x$ac_envvar" : ".*[^_$as_cr_alnum]" >/dev/null && + { echo "$as_me: error: invalid variable name: $ac_envvar" >&2 + { (exit 1); exit 1; }; } + ac_optarg=`echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` + eval "$ac_envvar='$ac_optarg'" + export $ac_envvar ;; + *) - if test -n "`echo $ac_option| sed 's/[-a-z0-9.]//g'`"; then - echo "configure: warning: $ac_option: invalid host type" 1>&2 - fi - if test "x$nonopt" != xNONE; then - { echo "configure: error: can only configure for one host and one target at a time" 1>&2; exit 1; } - fi - nonopt="$ac_option" + # FIXME: should be removed in autoconf 3.0. + echo "$as_me: WARNING: you should use --build, --host, --target" >&2 + expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null && + echo "$as_me: WARNING: invalid host type: $ac_option" >&2 + : ${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option} ;; esac done if test -n "$ac_prev"; then - { echo "configure: error: missing argument to --`echo $ac_prev | sed 's/_/-/g'`" 1>&2; exit 1; } + ac_option=--`echo $ac_prev | sed 's/_/-/g'` + { echo "$as_me: error: missing argument to $ac_option" >&2 + { (exit 1); exit 1; }; } fi -trap 'rm -fr conftest* confdefs* core core.* *.core $ac_clean_files; exit 1' 1 2 15 - -# File descriptor usage: -# 0 standard input -# 1 file creation -# 2 errors and warnings -# 3 some systems may open it to /dev/tty -# 4 used on the Kubota Titan -# 6 checking for... messages and results -# 5 compiler messages saved in config.log -if test "$silent" = yes; then - exec 6>/dev/null -else - exec 6>&1 -fi -exec 5>./config.log - -echo "\ -This file contains any messages produced by compilers while -running configure, to aid debugging if configure makes a mistake. -" 1>&5 +# Be sure to have absolute paths. +for ac_var in exec_prefix prefix +do + eval ac_val=$`echo $ac_var` + case $ac_val in + [\\/$]* | ?:[\\/]* | NONE | '' ) ;; + *) { echo "$as_me: error: expected an absolute directory name for --$ac_var: $ac_val" >&2 + { (exit 1); exit 1; }; };; + esac +done -# Strip out --no-create and --no-recursion so they do not pile up. -# Also quote any args containing shell metacharacters. -ac_configure_args= -for ac_arg +# Be sure to have absolute paths. +for ac_var in bindir sbindir libexecdir datadir sysconfdir sharedstatedir \ + localstatedir libdir includedir oldincludedir infodir mandir do - case "$ac_arg" in - -no-create | --no-create | --no-creat | --no-crea | --no-cre \ - | --no-cr | --no-c) ;; - -no-recursion | --no-recursion | --no-recursio | --no-recursi \ - | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r) ;; - *" "*|*" "*|*[\[\]\~\#\$\^\&\*\(\)\{\}\\\|\;\<\>\?]*) - ac_configure_args="$ac_configure_args '$ac_arg'" ;; - *) ac_configure_args="$ac_configure_args $ac_arg" ;; + eval ac_val=$`echo $ac_var` + case $ac_val in + [\\/$]* | ?:[\\/]* ) ;; + *) { echo "$as_me: error: expected an absolute directory name for --$ac_var: $ac_val" >&2 + { (exit 1); exit 1; }; };; esac done -# NLS nuisances. -# Only set these to C if already set. These must not be set unconditionally -# because not all systems understand e.g. LANG=C (notably SCO). -# Fixing LC_MESSAGES prevents Solaris sh from translating var values in `set'! -# Non-C LC_CTYPE values break the ctype check. -if test "${LANG+set}" = set; then LANG=C; export LANG; fi -if test "${LC_ALL+set}" = set; then LC_ALL=C; export LC_ALL; fi -if test "${LC_MESSAGES+set}" = set; then LC_MESSAGES=C; export LC_MESSAGES; fi -if test "${LC_CTYPE+set}" = set; then LC_CTYPE=C; export LC_CTYPE; fi +# There might be people who depend on the old broken behavior: `$host' +# used to hold the argument of --host etc. +# FIXME: To remove some day. +build=$build_alias +host=$host_alias +target=$target_alias + +# FIXME: To remove some day. +if test "x$host_alias" != x; then + if test "x$build_alias" = x; then + cross_compiling=maybe + echo "$as_me: WARNING: If you wanted to set the --build type, don't use --host. + If a cross compiler is detected then cross compile mode will be used." >&2 + elif test "x$build_alias" != "x$host_alias"; then + cross_compiling=yes + fi +fi -# confdefs.h avoids OS command line length limits that DEFS can exceed. -rm -rf conftest* confdefs.h -# AIX cpp loses on an empty file, so make sure it contains at least a newline. -echo > confdefs.h +ac_tool_prefix= +test -n "$host_alias" && ac_tool_prefix=$host_alias- + +test "$silent" = yes && exec 6>/dev/null -# A filename unique to this package, relative to the directory that -# configure is in, which we can look for to find out if srcdir is correct. -ac_unique_file=global.ent # Find the source files, if location was not specified. if test -z "$srcdir"; then ac_srcdir_defaulted=yes # Try the directory containing this script, then its parent. - ac_prog=$0 - ac_confdir=`echo $ac_prog|sed 's%/[^/][^/]*$%%'` - test "x$ac_confdir" = "x$ac_prog" && ac_confdir=. + ac_confdir=`(dirname "$0") 2>/dev/null || +$as_expr X"$0" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ + X"$0" : 'X\(//\)[^/]' \| \ + X"$0" : 'X\(//\)$' \| \ + X"$0" : 'X\(/\)' \| \ + . : '\(.\)' 2>/dev/null || +echo X"$0" | + sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/; q; } + /^X\(\/\/\)[^/].*/{ s//\1/; q; } + /^X\(\/\/\)$/{ s//\1/; q; } + /^X\(\/\).*/{ s//\1/; q; } + s/.*/./; q'` srcdir=$ac_confdir if test ! -r $srcdir/$ac_unique_file; then srcdir=.. @@ -475,13 +689,401 @@ else fi if test ! -r $srcdir/$ac_unique_file; then if test "$ac_srcdir_defaulted" = yes; then - { echo "configure: error: can not find sources in $ac_confdir or .." 1>&2; exit 1; } + { echo "$as_me: error: cannot find sources ($ac_unique_file) in $ac_confdir or .." >&2 + { (exit 1); exit 1; }; } else - { echo "configure: error: can not find sources in $srcdir" 1>&2; exit 1; } + { echo "$as_me: error: cannot find sources ($ac_unique_file) in $srcdir" >&2 + { (exit 1); exit 1; }; } fi fi -srcdir=`echo "${srcdir}" | sed 's%\([^/]\)/*$%\1%'` +(cd $srcdir && test -r ./$ac_unique_file) 2>/dev/null || + { echo "$as_me: error: sources are in $srcdir, but \`cd $srcdir' does not work" >&2 + { (exit 1); exit 1; }; } +srcdir=`echo "$srcdir" | sed 's%\([^\\/]\)[\\/]*$%\1%'` +ac_env_build_alias_set=${build_alias+set} +ac_env_build_alias_value=$build_alias +ac_cv_env_build_alias_set=${build_alias+set} +ac_cv_env_build_alias_value=$build_alias +ac_env_host_alias_set=${host_alias+set} +ac_env_host_alias_value=$host_alias +ac_cv_env_host_alias_set=${host_alias+set} +ac_cv_env_host_alias_value=$host_alias +ac_env_target_alias_set=${target_alias+set} +ac_env_target_alias_value=$target_alias +ac_cv_env_target_alias_set=${target_alias+set} +ac_cv_env_target_alias_value=$target_alias + +# +# Report the --help message. +# +if test "$ac_init_help" = "long"; then + # Omit some internal or obsolete options to make the list less imposing. + # This message is too long to be a string in the A/UX 3.1 sh. + cat <<_ACEOF +\`configure' configures this package to adapt to many kinds of systems. + +Usage: $0 [OPTION]... [VAR=VALUE]... + +To assign environment variables (e.g., CC, CFLAGS...), specify them as +VAR=VALUE. See below for descriptions of some of the useful variables. + +Defaults for the options are specified in brackets. + +Configuration: + -h, --help display this help and exit + --help=short display options specific to this package + --help=recursive display the short help of all the included packages + -V, --version display version information and exit + -q, --quiet, --silent do not print \`checking...' messages + --cache-file=FILE cache test results in FILE [disabled] + -C, --config-cache alias for \`--cache-file=config.cache' + -n, --no-create do not create output files + --srcdir=DIR find the sources in DIR [configure dir or \`..'] + +_ACEOF + + cat <<_ACEOF +Installation directories: + --prefix=PREFIX install architecture-independent files in PREFIX + [$ac_default_prefix] + --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX + [PREFIX] + +By default, \`make install' will install all the files in +\`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify +an installation prefix other than \`$ac_default_prefix' using \`--prefix', +for instance \`--prefix=\$HOME'. + +For better control, use the options below. + +Fine tuning of the installation directories: + --bindir=DIR user executables [EPREFIX/bin] + --sbindir=DIR system admin executables [EPREFIX/sbin] + --libexecdir=DIR program executables [EPREFIX/libexec] + --datadir=DIR read-only architecture-independent data [PREFIX/share] + --sysconfdir=DIR read-only single-machine data [PREFIX/etc] + --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] + --localstatedir=DIR modifiable single-machine data [PREFIX/var] + --libdir=DIR object code libraries [EPREFIX/lib] + --includedir=DIR C header files [PREFIX/include] + --oldincludedir=DIR C header files for non-gcc [/usr/include] + --infodir=DIR info documentation [PREFIX/info] + --mandir=DIR man documentation [PREFIX/man] +_ACEOF + + cat <<\_ACEOF +_ACEOF +fi + +if test -n "$ac_init_help"; then + + cat <<\_ACEOF + +Optional Features: + --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) + --enable-FEATURE[=ARG] include FEATURE [ARG=yes] + --enable-crop Whether to use a crop template + +Optional Packages: + --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] + --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) + --with-papersize Specify papersize (a4paper,letter) + --with-fontsize Specify the fontsize in points (default: 10.5) + +_ACEOF +fi + +if test "$ac_init_help" = "recursive"; then + # If there are subdirs, report their specific --help. + ac_popdir=`pwd` + for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue + test -d $ac_dir || continue + ac_builddir=. + +if test "$ac_dir" != .; then + ac_dir_suffix=/`echo "$ac_dir" | sed 's,^\.[\\/],,'` + # A "../" for each directory in $ac_dir_suffix. + ac_top_builddir=`echo "$ac_dir_suffix" | sed 's,/[^\\/]*,../,g'` +else + ac_dir_suffix= ac_top_builddir= +fi + +case $srcdir in + .) # No --srcdir option. We are building in place. + ac_srcdir=. + if test -z "$ac_top_builddir"; then + ac_top_srcdir=. + else + ac_top_srcdir=`echo $ac_top_builddir | sed 's,/$,,'` + fi ;; + [\\/]* | ?:[\\/]* ) # Absolute path. + ac_srcdir=$srcdir$ac_dir_suffix; + ac_top_srcdir=$srcdir ;; + *) # Relative path. + ac_srcdir=$ac_top_builddir$srcdir$ac_dir_suffix + ac_top_srcdir=$ac_top_builddir$srcdir ;; +esac +# Don't blindly perform a `cd "$ac_dir"/$ac_foo && pwd` since $ac_foo can be +# absolute. +ac_abs_builddir=`cd "$ac_dir" && cd $ac_builddir && pwd` +ac_abs_top_builddir=`cd "$ac_dir" && cd ${ac_top_builddir}. && pwd` +ac_abs_srcdir=`cd "$ac_dir" && cd $ac_srcdir && pwd` +ac_abs_top_srcdir=`cd "$ac_dir" && cd $ac_top_srcdir && pwd` + + cd $ac_dir + # Check for guested configure; otherwise get Cygnus style configure. + if test -f $ac_srcdir/configure.gnu; then + echo + $SHELL $ac_srcdir/configure.gnu --help=recursive + elif test -f $ac_srcdir/configure; then + echo + $SHELL $ac_srcdir/configure --help=recursive + elif test -f $ac_srcdir/configure.ac || + test -f $ac_srcdir/configure.in; then + echo + $ac_configure --help + else + echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2 + fi + cd $ac_popdir + done +fi + +test -n "$ac_init_help" && exit 0 +if $ac_init_version; then + cat <<\_ACEOF + +Copyright 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, 2002 +Free Software Foundation, Inc. +This configure script is free software; the Free Software Foundation +gives unlimited permission to copy, distribute and modify it. +_ACEOF + exit 0 +fi +exec 5>config.log +cat >&5 <<_ACEOF +This file contains any messages produced by compilers while +running configure, to aid debugging if configure makes a mistake. + +It was created by $as_me, which was +generated by GNU Autoconf 2.57. Invocation command line was + + $ $0 $@ + +_ACEOF +{ +cat <<_ASUNAME +## --------- ## +## Platform. ## +## --------- ## + +hostname = `(hostname || uname -n) 2>/dev/null | sed 1q` +uname -m = `(uname -m) 2>/dev/null || echo unknown` +uname -r = `(uname -r) 2>/dev/null || echo unknown` +uname -s = `(uname -s) 2>/dev/null || echo unknown` +uname -v = `(uname -v) 2>/dev/null || echo unknown` + +/usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null || echo unknown` +/bin/uname -X = `(/bin/uname -X) 2>/dev/null || echo unknown` + +/bin/arch = `(/bin/arch) 2>/dev/null || echo unknown` +/usr/bin/arch -k = `(/usr/bin/arch -k) 2>/dev/null || echo unknown` +/usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null || echo unknown` +hostinfo = `(hostinfo) 2>/dev/null || echo unknown` +/bin/machine = `(/bin/machine) 2>/dev/null || echo unknown` +/usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null || echo unknown` +/bin/universe = `(/bin/universe) 2>/dev/null || echo unknown` + +_ASUNAME + +as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + echo "PATH: $as_dir" +done + +} >&5 + +cat >&5 <<_ACEOF + + +## ----------- ## +## Core tests. ## +## ----------- ## + +_ACEOF + + +# Keep a trace of the command line. +# Strip out --no-create and --no-recursion so they do not pile up. +# Strip out --silent because we don't want to record it for future runs. +# Also quote any args containing shell meta-characters. +# Make two passes to allow for proper duplicate-argument suppression. +ac_configure_args= +ac_configure_args0= +ac_configure_args1= +ac_sep= +ac_must_keep_next=false +for ac_pass in 1 2 +do + for ac_arg + do + case $ac_arg in + -no-create | --no-c* | -n | -no-recursion | --no-r*) continue ;; + -q | -quiet | --quiet | --quie | --qui | --qu | --q \ + | -silent | --silent | --silen | --sile | --sil) + continue ;; + *" "*|*" "*|*[\[\]\~\#\$\^\&\*\(\)\{\}\\\|\;\<\>\?\"\']*) + ac_arg=`echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; + esac + case $ac_pass in + 1) ac_configure_args0="$ac_configure_args0 '$ac_arg'" ;; + 2) + ac_configure_args1="$ac_configure_args1 '$ac_arg'" + if test $ac_must_keep_next = true; then + ac_must_keep_next=false # Got value, back to normal. + else + case $ac_arg in + *=* | --config-cache | -C | -disable-* | --disable-* \ + | -enable-* | --enable-* | -gas | --g* | -nfp | --nf* \ + | -q | -quiet | --q* | -silent | --sil* | -v | -verb* \ + | -with-* | --with-* | -without-* | --without-* | --x) + case "$ac_configure_args0 " in + "$ac_configure_args1"*" '$ac_arg' "* ) continue ;; + esac + ;; + -* ) ac_must_keep_next=true ;; + esac + fi + ac_configure_args="$ac_configure_args$ac_sep'$ac_arg'" + # Get rid of the leading space. + ac_sep=" " + ;; + esac + done +done +$as_unset ac_configure_args0 || test "${ac_configure_args0+set}" != set || { ac_configure_args0=; export ac_configure_args0; } +$as_unset ac_configure_args1 || test "${ac_configure_args1+set}" != set || { ac_configure_args1=; export ac_configure_args1; } + +# When interrupted or exit'd, cleanup temporary files, and complete +# config.log. We remove comments because anyway the quotes in there +# would cause problems or look ugly. +# WARNING: Be sure not to use single quotes in there, as some shells, +# such as our DU 5.0 friend, will then `close' the trap. +trap 'exit_status=$? + # Save into config.log some information that might help in debugging. + { + echo + + cat <<\_ASBOX +## ---------------- ## +## Cache variables. ## +## ---------------- ## +_ASBOX + echo + # The following way of writing the cache mishandles newlines in values, +{ + (set) 2>&1 | + case `(ac_space='"'"' '"'"'; set | grep ac_space) 2>&1` in + *ac_space=\ *) + sed -n \ + "s/'"'"'/'"'"'\\\\'"'"''"'"'/g; + s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='"'"'\\2'"'"'/p" + ;; + *) + sed -n \ + "s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1=\\2/p" + ;; + esac; +} + echo + + cat <<\_ASBOX +## ----------------- ## +## Output variables. ## +## ----------------- ## +_ASBOX + echo + for ac_var in $ac_subst_vars + do + eval ac_val=$`echo $ac_var` + echo "$ac_var='"'"'$ac_val'"'"'" + done | sort + echo + + if test -n "$ac_subst_files"; then + cat <<\_ASBOX +## ------------- ## +## Output files. ## +## ------------- ## +_ASBOX + echo + for ac_var in $ac_subst_files + do + eval ac_val=$`echo $ac_var` + echo "$ac_var='"'"'$ac_val'"'"'" + done | sort + echo + fi + + if test -s confdefs.h; then + cat <<\_ASBOX +## ----------- ## +## confdefs.h. ## +## ----------- ## +_ASBOX + echo + sed "/^$/d" confdefs.h | sort + echo + fi + test "$ac_signal" != 0 && + echo "$as_me: caught signal $ac_signal" + echo "$as_me: exit $exit_status" + } >&5 + rm -f core core.* *.core && + rm -rf conftest* confdefs* conf$$* $ac_clean_files && + exit $exit_status + ' 0 +for ac_signal in 1 2 13 15; do + trap 'ac_signal='$ac_signal'; { (exit 1); exit 1; }' $ac_signal +done +ac_signal=0 + +# confdefs.h avoids OS command line length limits that DEFS can exceed. +rm -rf conftest* confdefs.h +# AIX cpp loses on an empty file, so make sure it contains at least a newline. +echo >confdefs.h + +# Predefined preprocessor variables. +cat >>confdefs.h <<_ACEOF +#define PACKAGE_NAME "$PACKAGE_NAME" +_ACEOF + + +cat >>confdefs.h <<_ACEOF +#define PACKAGE_TARNAME "$PACKAGE_TARNAME" +_ACEOF + + +cat >>confdefs.h <<_ACEOF +#define PACKAGE_VERSION "$PACKAGE_VERSION" +_ACEOF + + +cat >>confdefs.h <<_ACEOF +#define PACKAGE_STRING "$PACKAGE_STRING" +_ACEOF + + +cat >>confdefs.h <<_ACEOF +#define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT" +_ACEOF + + +# Let the site file select an alternate cache file if it wants to. # Prefer explicitly selected file to automatically selected ones. if test -z "$CONFIG_SITE"; then if test "x$prefix" != xNONE; then @@ -492,155 +1094,237 @@ if test -z "$CONFIG_SITE"; then fi for ac_site_file in $CONFIG_SITE; do if test -r "$ac_site_file"; then - echo "loading site script $ac_site_file" + { echo "$as_me:$LINENO: loading site script $ac_site_file" >&5 +echo "$as_me: loading site script $ac_site_file" >&6;} + sed 's/^/| /' "$ac_site_file" >&5 . "$ac_site_file" fi done if test -r "$cache_file"; then - echo "loading cache $cache_file" - . $cache_file + # Some versions of bash will fail to source /dev/null (special + # files actually), so we avoid doing that. + if test -f "$cache_file"; then + { echo "$as_me:$LINENO: loading cache $cache_file" >&5 +echo "$as_me: loading cache $cache_file" >&6;} + case $cache_file in + [\\/]* | ?:[\\/]* ) . $cache_file;; + *) . ./$cache_file;; + esac + fi else - echo "creating cache $cache_file" - > $cache_file + { echo "$as_me:$LINENO: creating cache $cache_file" >&5 +echo "$as_me: creating cache $cache_file" >&6;} + >$cache_file fi -ac_ext=c -# CFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options. -ac_cpp='$CPP $CPPFLAGS' -ac_compile='${CC-cc} -c $CFLAGS $CPPFLAGS conftest.$ac_ext 1>&5' -ac_link='${CC-cc} -o conftest${ac_exeext} $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS 1>&5' -cross_compiling=$ac_cv_prog_cc_cross - -ac_exeext= -ac_objext=o -if (echo "testing\c"; echo 1,2,3) | grep c >/dev/null; then - # Stardent Vistra SVR4 grep lacks -e, says ghazi@caip.rutgers.edu. - if (echo -n testing; echo 1,2,3) | sed s/-n/xn/ | grep xn >/dev/null; then - ac_n= ac_c=' -' ac_t=' ' - else - ac_n=-n ac_c= ac_t= +# Check that the precious variables saved in the cache have kept the same +# value. +ac_cache_corrupted=false +for ac_var in `(set) 2>&1 | + sed -n 's/^ac_env_\([a-zA-Z_0-9]*\)_set=.*/\1/p'`; do + eval ac_old_set=\$ac_cv_env_${ac_var}_set + eval ac_new_set=\$ac_env_${ac_var}_set + eval ac_old_val="\$ac_cv_env_${ac_var}_value" + eval ac_new_val="\$ac_env_${ac_var}_value" + case $ac_old_set,$ac_new_set in + set,) + { echo "$as_me:$LINENO: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5 +echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;} + ac_cache_corrupted=: ;; + ,set) + { echo "$as_me:$LINENO: error: \`$ac_var' was not set in the previous run" >&5 +echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;} + ac_cache_corrupted=: ;; + ,);; + *) + if test "x$ac_old_val" != "x$ac_new_val"; then + { echo "$as_me:$LINENO: error: \`$ac_var' has changed since the previous run:" >&5 +echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;} + { echo "$as_me:$LINENO: former value: $ac_old_val" >&5 +echo "$as_me: former value: $ac_old_val" >&2;} + { echo "$as_me:$LINENO: current value: $ac_new_val" >&5 +echo "$as_me: current value: $ac_new_val" >&2;} + ac_cache_corrupted=: + fi;; + esac + # Pass precious variables to config.status. + if test "$ac_new_set" = set; then + case $ac_new_val in + *" "*|*" "*|*[\[\]\~\#\$\^\&\*\(\)\{\}\\\|\;\<\>\?\"\']*) + ac_arg=$ac_var=`echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;; + *) ac_arg=$ac_var=$ac_new_val ;; + esac + case " $ac_configure_args " in + *" '$ac_arg' "*) ;; # Avoid dups. Use of quotes ensures accuracy. + *) ac_configure_args="$ac_configure_args '$ac_arg'" ;; + esac fi -else - ac_n= ac_c='\c' ac_t= +done +if $ac_cache_corrupted; then + { echo "$as_me:$LINENO: error: changes in the environment can compromise the build" >&5 +echo "$as_me: error: changes in the environment can compromise the build" >&2;} + { { echo "$as_me:$LINENO: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&5 +echo "$as_me: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&2;} + { (exit 1); exit 1; }; } fi +ac_ext=c +ac_cpp='$CPP $CPPFLAGS' +ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' +ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' +ac_compiler_gnu=$ac_cv_c_compiler_gnu + + + + + + + + + + + + + + + + + + # Extract the first word of "xsltproc", so it can be a program name with args. set dummy xsltproc; ac_word=$2 -echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:535: checking for $ac_word" >&5 -if eval "test \"`echo '$''{'ac_cv_path_XSLTPROC'+set}'`\" = set"; then - echo $ac_n "(cached) $ac_c" 1>&6 +echo "$as_me:$LINENO: checking for $ac_word" >&5 +echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6 +if test "${ac_cv_path_XSLTPROC+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 else - case "$XSLTPROC" in - /*) + case $XSLTPROC in + [\\/]* | ?:[\\/]*) ac_cv_path_XSLTPROC="$XSLTPROC" # Let the user override the test with a path. ;; - ?:/*) - ac_cv_path_XSLTPROC="$XSLTPROC" # Let the user override the test with a dos path. - ;; *) - IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" - ac_dummy="$PATH" - for ac_dir in $ac_dummy; do - test -z "$ac_dir" && ac_dir=. - if test -f $ac_dir/$ac_word; then - ac_cv_path_XSLTPROC="$ac_dir/$ac_word" - break - fi - done - IFS="$ac_save_ifs" + as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for ac_exec_ext in '' $ac_executable_extensions; do + if $as_executable_p "$as_dir/$ac_word$ac_exec_ext"; then + ac_cv_path_XSLTPROC="$as_dir/$ac_word$ac_exec_ext" + echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi +done +done + ;; esac fi -XSLTPROC="$ac_cv_path_XSLTPROC" +XSLTPROC=$ac_cv_path_XSLTPROC + if test -n "$XSLTPROC"; then - echo "$ac_t""$XSLTPROC" 1>&6 + echo "$as_me:$LINENO: result: $XSLTPROC" >&5 +echo "${ECHO_T}$XSLTPROC" >&6 else - echo "$ac_t""no" 1>&6 + echo "$as_me:$LINENO: result: no" >&5 +echo "${ECHO_T}no" >&6 fi if test "x$XSLTPROC" = x; then - { echo "configure: error: "xsltproc is required"" 1>&2; exit 1; } + { { echo "$as_me:$LINENO: error: \"xsltproc is required\"" >&5 +echo "$as_me: error: \"xsltproc is required\"" >&2;} + { (exit 1); exit 1; }; } fi # Extract the first word of "pdflatex", so it can be a program name with args. set dummy pdflatex; ac_word=$2 -echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:573: checking for $ac_word" >&5 -if eval "test \"`echo '$''{'ac_cv_path_PDFLATEX'+set}'`\" = set"; then - echo $ac_n "(cached) $ac_c" 1>&6 +echo "$as_me:$LINENO: checking for $ac_word" >&5 +echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6 +if test "${ac_cv_path_PDFLATEX+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 else - case "$PDFLATEX" in - /*) + case $PDFLATEX in + [\\/]* | ?:[\\/]*) ac_cv_path_PDFLATEX="$PDFLATEX" # Let the user override the test with a path. ;; - ?:/*) - ac_cv_path_PDFLATEX="$PDFLATEX" # Let the user override the test with a dos path. - ;; *) - IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" - ac_dummy="$PATH" - for ac_dir in $ac_dummy; do - test -z "$ac_dir" && ac_dir=. - if test -f $ac_dir/$ac_word; then - ac_cv_path_PDFLATEX="$ac_dir/$ac_word" - break - fi - done - IFS="$ac_save_ifs" + as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for ac_exec_ext in '' $ac_executable_extensions; do + if $as_executable_p "$as_dir/$ac_word$ac_exec_ext"; then + ac_cv_path_PDFLATEX="$as_dir/$ac_word$ac_exec_ext" + echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi +done +done + ;; esac fi -PDFLATEX="$ac_cv_path_PDFLATEX" +PDFLATEX=$ac_cv_path_PDFLATEX + if test -n "$PDFLATEX"; then - echo "$ac_t""$PDFLATEX" 1>&6 + echo "$as_me:$LINENO: result: $PDFLATEX" >&5 +echo "${ECHO_T}$PDFLATEX" >&6 else - echo "$ac_t""no" 1>&6 + echo "$as_me:$LINENO: result: no" >&5 +echo "${ECHO_T}no" >&6 fi if test "x$PDFLATEX" = x; then - { echo "configure: error: "pdflatex is required"" 1>&2; exit 1; } + { { echo "$as_me:$LINENO: error: \"pdflatex is required\"" >&5 +echo "$as_me: error: \"pdflatex is required\"" >&2;} + { (exit 1); exit 1; }; } fi # Extract the first word of "makeindex", so it can be a program name with args. set dummy makeindex; ac_word=$2 -echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:611: checking for $ac_word" >&5 -if eval "test \"`echo '$''{'ac_cv_path_MAKEINDEX'+set}'`\" = set"; then - echo $ac_n "(cached) $ac_c" 1>&6 +echo "$as_me:$LINENO: checking for $ac_word" >&5 +echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6 +if test "${ac_cv_path_MAKEINDEX+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 else - case "$MAKEINDEX" in - /*) + case $MAKEINDEX in + [\\/]* | ?:[\\/]*) ac_cv_path_MAKEINDEX="$MAKEINDEX" # Let the user override the test with a path. ;; - ?:/*) - ac_cv_path_MAKEINDEX="$MAKEINDEX" # Let the user override the test with a dos path. - ;; *) - IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" - ac_dummy="$PATH" - for ac_dir in $ac_dummy; do - test -z "$ac_dir" && ac_dir=. - if test -f $ac_dir/$ac_word; then - ac_cv_path_MAKEINDEX="$ac_dir/$ac_word" - break - fi - done - IFS="$ac_save_ifs" + as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for ac_exec_ext in '' $ac_executable_extensions; do + if $as_executable_p "$as_dir/$ac_word$ac_exec_ext"; then + ac_cv_path_MAKEINDEX="$as_dir/$ac_word$ac_exec_ext" + echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi +done +done + ;; esac fi -MAKEINDEX="$ac_cv_path_MAKEINDEX" +MAKEINDEX=$ac_cv_path_MAKEINDEX + if test -n "$MAKEINDEX"; then - echo "$ac_t""$MAKEINDEX" 1>&6 + echo "$as_me:$LINENO: result: $MAKEINDEX" >&5 +echo "${ECHO_T}$MAKEINDEX" >&6 else - echo "$ac_t""no" 1>&6 + echo "$as_me:$LINENO: result: no" >&5 +echo "${ECHO_T}no" >&6 fi if test "x$MAKEINDEX" = x; then - { echo "configure: error: "makeindex is required"" 1>&2; exit 1; } + { { echo "$as_me:$LINENO: error: \"makeindex is required\"" >&5 +echo "$as_me: error: \"makeindex is required\"" >&2;} + { (exit 1); exit 1; }; } fi PAPERSIZE="" @@ -652,236 +1336,259 @@ CROP="--stringparam docrop 0" # Check whether --enable-crop or --disable-crop was given. if test "${enable_crop+set}" = set; then enableval="$enable_crop" - test "$withval" && CROP="--stringparam docrop 1" -fi - + test "$withval" && CROP="--stringparam docrop 1" +fi; PAPERSIZE="--stringparam papersize a4paper" + # Check whether --with-papersize or --without-papersize was given. if test "${with_papersize+set}" = set; then withval="$with_papersize" - test "$withval" && PAPERSIZE="--stringparam papersize $withval" -fi - + test "$withval" && PAPERSIZE="--stringparam papersize $withval" +fi; FONTSIZE="--stringparam fontsize 10.5" + # Check whether --with-fontsize or --without-fontsize was given. if test "${with_fontsize+set}" = set; then withval="$with_fontsize" - test "$withval" && FONTSIZE="--stringparam fontsize $withval" -fi - + test "$withval" && FONTSIZE="--stringparam fontsize $withval" +fi; # Extract the first word of "latex", so it can be a program name with args. set dummy latex; ac_word=$2 -echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:681: checking for $ac_word" >&5 -if eval "test \"`echo '$''{'ac_cv_path_LATEX'+set}'`\" = set"; then - echo $ac_n "(cached) $ac_c" 1>&6 +echo "$as_me:$LINENO: checking for $ac_word" >&5 +echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6 +if test "${ac_cv_path_LATEX+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 else - case "$LATEX" in - /*) + case $LATEX in + [\\/]* | ?:[\\/]*) ac_cv_path_LATEX="$LATEX" # Let the user override the test with a path. ;; - ?:/*) - ac_cv_path_LATEX="$LATEX" # Let the user override the test with a dos path. - ;; *) - IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" - ac_dummy="$PATH" - for ac_dir in $ac_dummy; do - test -z "$ac_dir" && ac_dir=. - if test -f $ac_dir/$ac_word; then - ac_cv_path_LATEX="$ac_dir/$ac_word" - break - fi - done - IFS="$ac_save_ifs" + as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for ac_exec_ext in '' $ac_executable_extensions; do + if $as_executable_p "$as_dir/$ac_word$ac_exec_ext"; then + ac_cv_path_LATEX="$as_dir/$ac_word$ac_exec_ext" + echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi +done +done + ;; esac fi -LATEX="$ac_cv_path_LATEX" +LATEX=$ac_cv_path_LATEX + if test -n "$LATEX"; then - echo "$ac_t""$LATEX" 1>&6 + echo "$as_me:$LINENO: result: $LATEX" >&5 +echo "${ECHO_T}$LATEX" >&6 else - echo "$ac_t""no" 1>&6 + echo "$as_me:$LINENO: result: no" >&5 +echo "${ECHO_T}no" >&6 fi # Extract the first word of "dvips", so it can be a program name with args. set dummy dvips; ac_word=$2 -echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:716: checking for $ac_word" >&5 -if eval "test \"`echo '$''{'ac_cv_path_DVIPS'+set}'`\" = set"; then - echo $ac_n "(cached) $ac_c" 1>&6 +echo "$as_me:$LINENO: checking for $ac_word" >&5 +echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6 +if test "${ac_cv_path_DVIPS+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 else - case "$DVIPS" in - /*) + case $DVIPS in + [\\/]* | ?:[\\/]*) ac_cv_path_DVIPS="$DVIPS" # Let the user override the test with a path. ;; - ?:/*) - ac_cv_path_DVIPS="$DVIPS" # Let the user override the test with a dos path. - ;; *) - IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" - ac_dummy="$PATH" - for ac_dir in $ac_dummy; do - test -z "$ac_dir" && ac_dir=. - if test -f $ac_dir/$ac_word; then - ac_cv_path_DVIPS="$ac_dir/$ac_word" - break - fi - done - IFS="$ac_save_ifs" + as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for ac_exec_ext in '' $ac_executable_extensions; do + if $as_executable_p "$as_dir/$ac_word$ac_exec_ext"; then + ac_cv_path_DVIPS="$as_dir/$ac_word$ac_exec_ext" + echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi +done +done + ;; esac fi -DVIPS="$ac_cv_path_DVIPS" +DVIPS=$ac_cv_path_DVIPS + if test -n "$DVIPS"; then - echo "$ac_t""$DVIPS" 1>&6 + echo "$as_me:$LINENO: result: $DVIPS" >&5 +echo "${ECHO_T}$DVIPS" >&6 else - echo "$ac_t""no" 1>&6 + echo "$as_me:$LINENO: result: no" >&5 +echo "${ECHO_T}no" >&6 fi # Extract the first word of "pngtopnm", so it can be a program name with args. set dummy pngtopnm; ac_word=$2 -echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:751: checking for $ac_word" >&5 -if eval "test \"`echo '$''{'ac_cv_path_PNGTOPNM'+set}'`\" = set"; then - echo $ac_n "(cached) $ac_c" 1>&6 +echo "$as_me:$LINENO: checking for $ac_word" >&5 +echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6 +if test "${ac_cv_path_PNGTOPNM+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 else - case "$PNGTOPNM" in - /*) + case $PNGTOPNM in + [\\/]* | ?:[\\/]*) ac_cv_path_PNGTOPNM="$PNGTOPNM" # Let the user override the test with a path. ;; - ?:/*) - ac_cv_path_PNGTOPNM="$PNGTOPNM" # Let the user override the test with a dos path. - ;; *) - IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" - ac_dummy="$PATH" - for ac_dir in $ac_dummy; do - test -z "$ac_dir" && ac_dir=. - if test -f $ac_dir/$ac_word; then - ac_cv_path_PNGTOPNM="$ac_dir/$ac_word" - break - fi - done - IFS="$ac_save_ifs" + as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for ac_exec_ext in '' $ac_executable_extensions; do + if $as_executable_p "$as_dir/$ac_word$ac_exec_ext"; then + ac_cv_path_PNGTOPNM="$as_dir/$ac_word$ac_exec_ext" + echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi +done +done + ;; esac fi -PNGTOPNM="$ac_cv_path_PNGTOPNM" +PNGTOPNM=$ac_cv_path_PNGTOPNM + if test -n "$PNGTOPNM"; then - echo "$ac_t""$PNGTOPNM" 1>&6 + echo "$as_me:$LINENO: result: $PNGTOPNM" >&5 +echo "${ECHO_T}$PNGTOPNM" >&6 else - echo "$ac_t""no" 1>&6 + echo "$as_me:$LINENO: result: no" >&5 +echo "${ECHO_T}no" >&6 fi # Extract the first word of "pnmtops", so it can be a program name with args. set dummy pnmtops; ac_word=$2 -echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:786: checking for $ac_word" >&5 -if eval "test \"`echo '$''{'ac_cv_path_PNMTOPS'+set}'`\" = set"; then - echo $ac_n "(cached) $ac_c" 1>&6 +echo "$as_me:$LINENO: checking for $ac_word" >&5 +echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6 +if test "${ac_cv_path_PNMTOPS+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 else - case "$PNMTOPS" in - /*) + case $PNMTOPS in + [\\/]* | ?:[\\/]*) ac_cv_path_PNMTOPS="$PNMTOPS" # Let the user override the test with a path. ;; - ?:/*) - ac_cv_path_PNMTOPS="$PNMTOPS" # Let the user override the test with a dos path. - ;; *) - IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" - ac_dummy="$PATH" - for ac_dir in $ac_dummy; do - test -z "$ac_dir" && ac_dir=. - if test -f $ac_dir/$ac_word; then - ac_cv_path_PNMTOPS="$ac_dir/$ac_word" - break - fi - done - IFS="$ac_save_ifs" + as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for ac_exec_ext in '' $ac_executable_extensions; do + if $as_executable_p "$as_dir/$ac_word$ac_exec_ext"; then + ac_cv_path_PNMTOPS="$as_dir/$ac_word$ac_exec_ext" + echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi +done +done + ;; esac fi -PNMTOPS="$ac_cv_path_PNMTOPS" +PNMTOPS=$ac_cv_path_PNMTOPS + if test -n "$PNMTOPS"; then - echo "$ac_t""$PNMTOPS" 1>&6 + echo "$as_me:$LINENO: result: $PNMTOPS" >&5 +echo "${ECHO_T}$PNMTOPS" >&6 else - echo "$ac_t""no" 1>&6 + echo "$as_me:$LINENO: result: no" >&5 +echo "${ECHO_T}no" >&6 fi # Extract the first word of "perl", so it can be a program name with args. set dummy perl; ac_word=$2 -echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:821: checking for $ac_word" >&5 -if eval "test \"`echo '$''{'ac_cv_path_PERL'+set}'`\" = set"; then - echo $ac_n "(cached) $ac_c" 1>&6 +echo "$as_me:$LINENO: checking for $ac_word" >&5 +echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6 +if test "${ac_cv_path_PERL+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 else - case "$PERL" in - /*) + case $PERL in + [\\/]* | ?:[\\/]*) ac_cv_path_PERL="$PERL" # Let the user override the test with a path. ;; - ?:/*) - ac_cv_path_PERL="$PERL" # Let the user override the test with a dos path. - ;; *) - IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" - ac_dummy="$PATH" - for ac_dir in $ac_dummy; do - test -z "$ac_dir" && ac_dir=. - if test -f $ac_dir/$ac_word; then - ac_cv_path_PERL="$ac_dir/$ac_word" - break - fi - done - IFS="$ac_save_ifs" + as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for ac_exec_ext in '' $ac_executable_extensions; do + if $as_executable_p "$as_dir/$ac_word$ac_exec_ext"; then + ac_cv_path_PERL="$as_dir/$ac_word$ac_exec_ext" + echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi +done +done + ;; esac fi -PERL="$ac_cv_path_PERL" +PERL=$ac_cv_path_PERL + if test -n "$PERL"; then - echo "$ac_t""$PERL" 1>&6 + echo "$as_me:$LINENO: result: $PERL" >&5 +echo "${ECHO_T}$PERL" >&6 else - echo "$ac_t""no" 1>&6 + echo "$as_me:$LINENO: result: no" >&5 +echo "${ECHO_T}no" >&6 fi # Extract the first word of "xmlto", so it can be a program name with args. set dummy xmlto; ac_word=$2 -echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 -echo "configure:856: checking for $ac_word" >&5 -if eval "test \"`echo '$''{'ac_cv_path_XMLTO'+set}'`\" = set"; then - echo $ac_n "(cached) $ac_c" 1>&6 +echo "$as_me:$LINENO: checking for $ac_word" >&5 +echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6 +if test "${ac_cv_path_XMLTO+set}" = set; then + echo $ECHO_N "(cached) $ECHO_C" >&6 else - case "$XMLTO" in - /*) + case $XMLTO in + [\\/]* | ?:[\\/]*) ac_cv_path_XMLTO="$XMLTO" # Let the user override the test with a path. ;; - ?:/*) - ac_cv_path_XMLTO="$XMLTO" # Let the user override the test with a dos path. - ;; *) - IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" - ac_dummy="$PATH" - for ac_dir in $ac_dummy; do - test -z "$ac_dir" && ac_dir=. - if test -f $ac_dir/$ac_word; then - ac_cv_path_XMLTO="$ac_dir/$ac_word" - break - fi - done - IFS="$ac_save_ifs" + as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for ac_exec_ext in '' $ac_executable_extensions; do + if $as_executable_p "$as_dir/$ac_word$ac_exec_ext"; then + ac_cv_path_XMLTO="$as_dir/$ac_word$ac_exec_ext" + echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 + break 2 + fi +done +done + ;; esac fi -XMLTO="$ac_cv_path_XMLTO" +XMLTO=$ac_cv_path_XMLTO + if test -n "$XMLTO"; then - echo "$ac_t""$XMLTO" 1>&6 + echo "$as_me:$LINENO: result: $XMLTO" >&5 +echo "${ECHO_T}$XMLTO" >&6 else - echo "$ac_t""no" 1>&6 + echo "$as_me:$LINENO: result: no" >&5 +echo "${ECHO_T}no" >&6 fi @@ -893,269 +1600,884 @@ DOC_BUILD_DATE=`date '+%d-%m-%Y'` -trap '' 1 2 15 -cat > confcache <<\EOF + ac_config_files="$ac_config_files Makefile" +cat >confcache <<\_ACEOF # This file is a shell script that caches the results of configure # tests run on this system so they can be shared between configure -# scripts and configure runs. It is not useful on other systems. -# If it contains results you don't want to keep, you may remove or edit it. +# scripts and configure runs, see configure's option --config-cache. +# It is not useful on other systems. If it contains results you don't +# want to keep, you may remove or edit it. # -# By default, configure uses ./config.cache as the cache file, -# creating it if it does not exist already. You can give configure -# the --cache-file=FILE option to use a different cache file; that is -# what configure does when it calls configure scripts in -# subdirectories, so they share the cache. -# Giving --cache-file=/dev/null disables caching, for debugging configure. -# config.status only pays attention to the cache file if you give it the -# --recheck option to rerun configure. +# config.status only pays attention to the cache file if you give it +# the --recheck option to rerun configure. # -EOF +# `ac_cv_env_foo' variables (set or unset) will be overridden when +# loading this file, other *unset* `ac_cv_foo' will be assigned the +# following values. + +_ACEOF + # The following way of writing the cache mishandles newlines in values, # but we know of no workaround that is simple, portable, and efficient. # So, don't put newlines in cache variables' values. # Ultrix sh set writes to stderr and can't be redirected directly, # and sets the high bit in the cache file unless we assign to the vars. -(set) 2>&1 | - case `(ac_space=' '; set | grep ac_space) 2>&1` in - *ac_space=\ *) - # `set' does not quote correctly, so add quotes (double-quote substitution - # turns \\\\ into \\, and sed turns \\ into \). - sed -n \ - -e "s/'/'\\\\''/g" \ - -e "s/^\\([a-zA-Z0-9_]*_cv_[a-zA-Z0-9_]*\\)=\\(.*\\)/\\1=\${\\1='\\2'}/p" - ;; - *) - # `set' quotes correctly as required by POSIX, so do not add quotes. - sed -n -e 's/^\([a-zA-Z0-9_]*_cv_[a-zA-Z0-9_]*\)=\(.*\)/\1=${\1=\2}/p' - ;; - esac >> confcache -if cmp -s $cache_file confcache; then - : -else +{ + (set) 2>&1 | + case `(ac_space=' '; set | grep ac_space) 2>&1` in + *ac_space=\ *) + # `set' does not quote correctly, so add quotes (double-quote + # substitution turns \\\\ into \\, and sed turns \\ into \). + sed -n \ + "s/'/'\\\\''/g; + s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p" + ;; + *) + # `set' quotes correctly as required by POSIX, so do not add quotes. + sed -n \ + "s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1=\\2/p" + ;; + esac; +} | + sed ' + t clear + : clear + s/^\([^=]*\)=\(.*[{}].*\)$/test "${\1+set}" = set || &/ + t end + /^ac_cv_env/!s/^\([^=]*\)=\(.*\)$/\1=${\1=\2}/ + : end' >>confcache +if diff $cache_file confcache >/dev/null 2>&1; then :; else if test -w $cache_file; then - echo "updating cache $cache_file" - cat confcache > $cache_file + test "x$cache_file" != "x/dev/null" && echo "updating cache $cache_file" + cat confcache >$cache_file else echo "not updating unwritable cache $cache_file" fi fi rm -f confcache -trap 'rm -fr conftest* confdefs* core core.* *.core $ac_clean_files; exit 1' 1 2 15 - test "x$prefix" = xNONE && prefix=$ac_default_prefix # Let make expand exec_prefix. test "x$exec_prefix" = xNONE && exec_prefix='${prefix}' -# Any assignment to VPATH causes Sun make to only execute -# the first set of double-colon rules, so remove it if not needed. -# If there is a colon in the path, we need to keep it. +# VPATH may cause trouble with some makes, so we remove $(srcdir), +# ${srcdir} and @srcdir@ from VPATH if srcdir is ".", strip leading and +# trailing colons and then remove the whole line if VPATH becomes empty +# (actually we leave an empty line to preserve line numbers). if test "x$srcdir" = x.; then - ac_vpsub='/^[ ]*VPATH[ ]*=[^:]*$/d' + ac_vpsub='/^[ ]*VPATH[ ]*=/{ +s/:*\$(srcdir):*/:/; +s/:*\${srcdir}:*/:/; +s/:*@srcdir@:*/:/; +s/^\([^=]*=[ ]*\):*/\1/; +s/:*$//; +s/^[^=]*=[ ]*$//; +}' fi -trap 'rm -f $CONFIG_STATUS conftest*; exit 1' 1 2 15 - # Transform confdefs.h into DEFS. # Protect against shell expansion while executing Makefile rules. # Protect against Makefile macro expansion. -cat > conftest.defs <<\EOF -s%#define \([A-Za-z_][A-Za-z0-9_]*\) *\(.*\)%-D\1=\2%g -s%[ `~#$^&*(){}\\|;'"<>?]%\\&%g -s%\[%\\&%g -s%\]%\\&%g -s%\$%$$%g -EOF -DEFS=`sed -f conftest.defs confdefs.h | tr '\012' ' '` -rm -f conftest.defs - - -# Without the "./", some shells look in PATH for config.status. -: ${CONFIG_STATUS=./config.status} +# +# If the first sed substitution is executed (which looks for macros that +# take arguments), then we branch to the quote section. Otherwise, +# look for a macro that doesn't take arguments. +cat >confdef2opt.sed <<\_ACEOF +t clear +: clear +s,^[ ]*#[ ]*define[ ][ ]*\([^ (][^ (]*([^)]*)\)[ ]*\(.*\),-D\1=\2,g +t quote +s,^[ ]*#[ ]*define[ ][ ]*\([^ ][^ ]*\)[ ]*\(.*\),-D\1=\2,g +t quote +d +: quote +s,[ `~#$^&*(){}\\|;'"<>?],\\&,g +s,\[,\\&,g +s,\],\\&,g +s,\$,$$,g +p +_ACEOF +# We use echo to avoid assuming a particular line-breaking character. +# The extra dot is to prevent the shell from consuming trailing +# line-breaks from the sub-command output. A line-break within +# single-quotes doesn't work because, if this script is created in a +# platform that uses two characters for line-breaks (e.g., DOS), tr +# would break. +ac_LF_and_DOT=`echo; echo .` +DEFS=`sed -n -f confdef2opt.sed confdefs.h | tr "$ac_LF_and_DOT" ' .'` +rm -f confdef2opt.sed + + +ac_libobjs= +ac_ltlibobjs= +for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue + # 1. Remove the extension, and $U if already installed. + ac_i=`echo "$ac_i" | + sed 's/\$U\././;s/\.o$//;s/\.obj$//'` + # 2. Add them. + ac_libobjs="$ac_libobjs $ac_i\$U.$ac_objext" + ac_ltlibobjs="$ac_ltlibobjs $ac_i"'$U.lo' +done +LIBOBJS=$ac_libobjs -echo creating $CONFIG_STATUS -rm -f $CONFIG_STATUS -cat > $CONFIG_STATUS <&5 +echo "$as_me: creating $CONFIG_STATUS" >&6;} +cat >$CONFIG_STATUS <<_ACEOF +#! $SHELL +# Generated by $as_me. # Run this file to recreate the current configuration. -# This directory was configured as follows, -# on host `(hostname || uname -n) 2>/dev/null | sed 1q`: -# -# $0 $ac_configure_args -# # Compiler output produced by configure, useful for debugging -# configure, is in ./config.log if it exists. +# configure, is in config.log if it exists. + +debug=false +ac_cs_recheck=false +ac_cs_silent=false +SHELL=\${CONFIG_SHELL-$SHELL} +_ACEOF + +cat >>$CONFIG_STATUS <<\_ACEOF +## --------------------- ## +## M4sh Initialization. ## +## --------------------- ## + +# Be Bourne compatible +if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then + emulate sh + NULLCMD=: + # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which + # is contrary to our usage. Disable this feature. + alias -g '${1+"$@"}'='"$@"' +elif test -n "${BASH_VERSION+set}" && (set -o posix) >/dev/null 2>&1; then + set -o posix +fi -ac_cs_usage="Usage: $CONFIG_STATUS [--recheck] [--version] [--help]" -for ac_option +# Support unset when possible. +if (FOO=FOO; unset FOO) >/dev/null 2>&1; then + as_unset=unset +else + as_unset=false +fi + + +# Work around bugs in pre-3.0 UWIN ksh. +$as_unset ENV MAIL MAILPATH +PS1='$ ' +PS2='> ' +PS4='+ ' + +# NLS nuisances. +for as_var in \ + LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \ + LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \ + LC_TELEPHONE LC_TIME do - case "\$ac_option" in - -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) - echo "running \${CONFIG_SHELL-/bin/sh} $0 $ac_configure_args --no-create --no-recursion" - exec \${CONFIG_SHELL-/bin/sh} $0 $ac_configure_args --no-create --no-recursion ;; - -version | --version | --versio | --versi | --vers | --ver | --ve | --v) - echo "$CONFIG_STATUS generated by autoconf version 2.13" - exit 0 ;; - -help | --help | --hel | --he | --h) - echo "\$ac_cs_usage"; exit 0 ;; - *) echo "\$ac_cs_usage"; exit 1 ;; - esac + if (set +x; test -n "`(eval $as_var=C; export $as_var) 2>&1`"); then + eval $as_var=C; export $as_var + else + $as_unset $as_var + fi done -ac_given_srcdir=$srcdir +# Required to use basename. +if expr a : '\(a\)' >/dev/null 2>&1; then + as_expr=expr +else + as_expr=false +fi -trap 'rm -fr `echo "Makefile " | sed "s/:[^ ]*//g"` conftest*; exit 1' 1 2 15 -EOF -cat >> $CONFIG_STATUS </dev/null 2>&1 && test "X`basename / 2>&1`" = "X/"; then + as_basename=basename +else + as_basename=false +fi -# Protect against being on the right side of a sed subst in config.status. -sed 's/%@/@@/; s/@%/@@/; s/%g\$/@g/; /@g\$/s/[\\\\&%]/\\\\&/g; - s/@@/%@/; s/@@/@%/; s/@g\$/%g/' > conftest.subs <<\\CEOF -$ac_vpsub -$extrasub -s%@SHELL@%$SHELL%g -s%@CFLAGS@%$CFLAGS%g -s%@CPPFLAGS@%$CPPFLAGS%g -s%@CXXFLAGS@%$CXXFLAGS%g -s%@FFLAGS@%$FFLAGS%g -s%@DEFS@%$DEFS%g -s%@LDFLAGS@%$LDFLAGS%g -s%@LIBS@%$LIBS%g -s%@exec_prefix@%$exec_prefix%g -s%@prefix@%$prefix%g -s%@program_transform_name@%$program_transform_name%g -s%@bindir@%$bindir%g -s%@sbindir@%$sbindir%g -s%@libexecdir@%$libexecdir%g -s%@datadir@%$datadir%g -s%@sysconfdir@%$sysconfdir%g -s%@sharedstatedir@%$sharedstatedir%g -s%@localstatedir@%$localstatedir%g -s%@libdir@%$libdir%g -s%@includedir@%$includedir%g -s%@oldincludedir@%$oldincludedir%g -s%@infodir@%$infodir%g -s%@mandir@%$mandir%g -s%@XSLTPROC@%$XSLTPROC%g -s%@PDFLATEX@%$PDFLATEX%g -s%@MAKEINDEX@%$MAKEINDEX%g -s%@LATEX@%$LATEX%g -s%@DVIPS@%$DVIPS%g -s%@PNGTOPNM@%$PNGTOPNM%g -s%@PNMTOPS@%$PNMTOPS%g -s%@PERL@%$PERL%g -s%@XMLTO@%$XMLTO%g -s%@DOC_BUILD_DATE@%$DOC_BUILD_DATE%g -s%@TEXSTYLESHEET@%$TEXSTYLESHEET%g -s%@PAPERSIZE@%$PAPERSIZE%g -s%@DUPLICATE_ULINKS@%$DUPLICATE_ULINKS%g -s%@FONTSIZE@%$FONTSIZE%g -s%@CROP@%$CROP%g -CEOF -EOF - -cat >> $CONFIG_STATUS <<\EOF - -# Split the substitutions into bite-sized pieces for seds with -# small command number limits, like on Digital OSF/1 and HP-UX. -ac_max_sed_cmds=90 # Maximum number of lines to put in a sed script. -ac_file=1 # Number of current file. -ac_beg=1 # First line for current file. -ac_end=$ac_max_sed_cmds # Line after last line for current file. -ac_more_lines=: -ac_sed_cmds="" -while $ac_more_lines; do - if test $ac_beg -gt 1; then - sed "1,${ac_beg}d; ${ac_end}q" conftest.subs > conftest.s$ac_file +# Name of the executable. +as_me=`$as_basename "$0" || +$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ + X"$0" : 'X\(//\)$' \| \ + X"$0" : 'X\(/\)$' \| \ + . : '\(.\)' 2>/dev/null || +echo X/"$0" | + sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/; q; } + /^X\/\(\/\/\)$/{ s//\1/; q; } + /^X\/\(\/\).*/{ s//\1/; q; } + s/.*/./; q'` + + +# PATH needs CR, and LINENO needs CR and PATH. +# Avoid depending upon Character Ranges. +as_cr_letters='abcdefghijklmnopqrstuvwxyz' +as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' +as_cr_Letters=$as_cr_letters$as_cr_LETTERS +as_cr_digits='0123456789' +as_cr_alnum=$as_cr_Letters$as_cr_digits + +# The user is always right. +if test "${PATH_SEPARATOR+set}" != set; then + echo "#! /bin/sh" >conf$$.sh + echo "exit 0" >>conf$$.sh + chmod +x conf$$.sh + if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then + PATH_SEPARATOR=';' else - sed "${ac_end}q" conftest.subs > conftest.s$ac_file + PATH_SEPARATOR=: + fi + rm -f conf$$.sh +fi + + + as_lineno_1=$LINENO + as_lineno_2=$LINENO + as_lineno_3=`(expr $as_lineno_1 + 1) 2>/dev/null` + test "x$as_lineno_1" != "x$as_lineno_2" && + test "x$as_lineno_3" = "x$as_lineno_2" || { + # Find who we are. Look in the path if we contain no path at all + # relative or not. + case $0 in + *[\\/]* ) as_myself=$0 ;; + *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in $PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break +done + + ;; + esac + # We did not find ourselves, most probably we were run as `sh COMMAND' + # in which case we are not to be found in the path. + if test "x$as_myself" = x; then + as_myself=$0 + fi + if test ! -f "$as_myself"; then + { { echo "$as_me:$LINENO: error: cannot find myself; rerun with an absolute path" >&5 +echo "$as_me: error: cannot find myself; rerun with an absolute path" >&2;} + { (exit 1); exit 1; }; } fi - if test ! -s conftest.s$ac_file; then - ac_more_lines=false - rm -f conftest.s$ac_file + case $CONFIG_SHELL in + '') + as_save_IFS=$IFS; IFS=$PATH_SEPARATOR +for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH +do + IFS=$as_save_IFS + test -z "$as_dir" && as_dir=. + for as_base in sh bash ksh sh5; do + case $as_dir in + /*) + if ("$as_dir/$as_base" -c ' + as_lineno_1=$LINENO + as_lineno_2=$LINENO + as_lineno_3=`(expr $as_lineno_1 + 1) 2>/dev/null` + test "x$as_lineno_1" != "x$as_lineno_2" && + test "x$as_lineno_3" = "x$as_lineno_2" ') 2>/dev/null; then + $as_unset BASH_ENV || test "${BASH_ENV+set}" != set || { BASH_ENV=; export BASH_ENV; } + $as_unset ENV || test "${ENV+set}" != set || { ENV=; export ENV; } + CONFIG_SHELL=$as_dir/$as_base + export CONFIG_SHELL + exec "$CONFIG_SHELL" "$0" ${1+"$@"} + fi;; + esac + done +done +;; + esac + + # Create $as_me.lineno as a copy of $as_myself, but with $LINENO + # uniformly replaced by the line number. The first 'sed' inserts a + # line-number line before each line; the second 'sed' does the real + # work. The second script uses 'N' to pair each line-number line + # with the numbered line, and appends trailing '-' during + # substitution so that $LINENO is not a special case at line end. + # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the + # second 'sed' script. Blame Lee E. McMahon for sed's syntax. :-) + sed '=' <$as_myself | + sed ' + N + s,$,-, + : loop + s,^\(['$as_cr_digits']*\)\(.*\)[$]LINENO\([^'$as_cr_alnum'_]\),\1\2\1\3, + t loop + s,-$,, + s,^['$as_cr_digits']*\n,, + ' >$as_me.lineno && + chmod +x $as_me.lineno || + { { echo "$as_me:$LINENO: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&5 +echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2;} + { (exit 1); exit 1; }; } + + # Don't try to exec as it changes $[0], causing all sort of problems + # (the dirname of $[0] is not the place where we might find the + # original and so on. Autoconf is especially sensible to this). + . ./$as_me.lineno + # Exit status is that of the last command. + exit +} + + +case `echo "testing\c"; echo 1,2,3`,`echo -n testing; echo 1,2,3` in + *c*,-n*) ECHO_N= ECHO_C=' +' ECHO_T=' ' ;; + *c*,* ) ECHO_N=-n ECHO_C= ECHO_T= ;; + *) ECHO_N= ECHO_C='\c' ECHO_T= ;; +esac + +if expr a : '\(a\)' >/dev/null 2>&1; then + as_expr=expr +else + as_expr=false +fi + +rm -f conf$$ conf$$.exe conf$$.file +echo >conf$$.file +if ln -s conf$$.file conf$$ 2>/dev/null; then + # We could just check for DJGPP; but this test a) works b) is more generic + # and c) will remain valid once DJGPP supports symlinks (DJGPP 2.04). + if test -f conf$$.exe; then + # Don't use ln at all; we don't have any links + as_ln_s='cp -p' else - if test -z "$ac_sed_cmds"; then - ac_sed_cmds="sed -f conftest.s$ac_file" - else - ac_sed_cmds="$ac_sed_cmds | sed -f conftest.s$ac_file" - fi - ac_file=`expr $ac_file + 1` - ac_beg=$ac_end - ac_end=`expr $ac_end + $ac_max_sed_cmds` + as_ln_s='ln -s' fi +elif ln conf$$.file conf$$ 2>/dev/null; then + as_ln_s=ln +else + as_ln_s='cp -p' +fi +rm -f conf$$ conf$$.exe conf$$.file + +if mkdir -p . 2>/dev/null; then + as_mkdir_p=: +else + as_mkdir_p=false +fi + +as_executable_p="test -f" + +# Sed expression to map a string onto a valid CPP name. +as_tr_cpp="sed y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g" + +# Sed expression to map a string onto a valid variable name. +as_tr_sh="sed y%*+%pp%;s%[^_$as_cr_alnum]%_%g" + + +# IFS +# We need space, tab and new line, in precisely that order. +as_nl=' +' +IFS=" $as_nl" + +# CDPATH. +$as_unset CDPATH + +exec 6>&1 + +# Open the log real soon, to keep \$[0] and so on meaningful, and to +# report actual input values of CONFIG_FILES etc. instead of their +# values after options handling. Logging --version etc. is OK. +exec 5>>config.log +{ + echo + sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX +## Running $as_me. ## +_ASBOX +} >&5 +cat >&5 <<_CSEOF + +This file was extended by $as_me, which was +generated by GNU Autoconf 2.57. Invocation command line was + + CONFIG_FILES = $CONFIG_FILES + CONFIG_HEADERS = $CONFIG_HEADERS + CONFIG_LINKS = $CONFIG_LINKS + CONFIG_COMMANDS = $CONFIG_COMMANDS + $ $0 $@ + +_CSEOF +echo "on `(hostname || uname -n) 2>/dev/null | sed 1q`" >&5 +echo >&5 +_ACEOF + +# Files that config.status was made for. +if test -n "$ac_config_files"; then + echo "config_files=\"$ac_config_files\"" >>$CONFIG_STATUS +fi + +if test -n "$ac_config_headers"; then + echo "config_headers=\"$ac_config_headers\"" >>$CONFIG_STATUS +fi + +if test -n "$ac_config_links"; then + echo "config_links=\"$ac_config_links\"" >>$CONFIG_STATUS +fi + +if test -n "$ac_config_commands"; then + echo "config_commands=\"$ac_config_commands\"" >>$CONFIG_STATUS +fi + +cat >>$CONFIG_STATUS <<\_ACEOF + +ac_cs_usage="\ +\`$as_me' instantiates files from templates according to the +current configuration. + +Usage: $0 [OPTIONS] [FILE]... + + -h, --help print this help, then exit + -V, --version print version number, then exit + -q, --quiet do not print progress messages + -d, --debug don't remove temporary files + --recheck update $as_me by reconfiguring in the same conditions + --file=FILE[:TEMPLATE] + instantiate the configuration file FILE + +Configuration files: +$config_files + +Report bugs to ." +_ACEOF + +cat >>$CONFIG_STATUS <<_ACEOF +ac_cs_version="\\ +config.status +configured by $0, generated by GNU Autoconf 2.57, + with options \\"`echo "$ac_configure_args" | sed 's/[\\""\`\$]/\\\\&/g'`\\" + +Copyright 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001 +Free Software Foundation, Inc. +This config.status script is free software; the Free Software Foundation +gives unlimited permission to copy, distribute and modify it." +srcdir=$srcdir +_ACEOF + +cat >>$CONFIG_STATUS <<\_ACEOF +# If no file are specified by the user, then we need to provide default +# value. By we need to know if files were specified by the user. +ac_need_defaults=: +while test $# != 0 +do + case $1 in + --*=*) + ac_option=`expr "x$1" : 'x\([^=]*\)='` + ac_optarg=`expr "x$1" : 'x[^=]*=\(.*\)'` + ac_shift=: + ;; + -*) + ac_option=$1 + ac_optarg=$2 + ac_shift=shift + ;; + *) # This is not an option, so the user has probably given explicit + # arguments. + ac_option=$1 + ac_need_defaults=false;; + esac + + case $ac_option in + # Handling of the options. +_ACEOF +cat >>$CONFIG_STATUS <<\_ACEOF + -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) + ac_cs_recheck=: ;; + --version | --vers* | -V ) + echo "$ac_cs_version"; exit 0 ;; + --he | --h) + # Conflict between --help and --header + { { echo "$as_me:$LINENO: error: ambiguous option: $1 +Try \`$0 --help' for more information." >&5 +echo "$as_me: error: ambiguous option: $1 +Try \`$0 --help' for more information." >&2;} + { (exit 1); exit 1; }; };; + --help | --hel | -h ) + echo "$ac_cs_usage"; exit 0 ;; + --debug | --d* | -d ) + debug=: ;; + --file | --fil | --fi | --f ) + $ac_shift + CONFIG_FILES="$CONFIG_FILES $ac_optarg" + ac_need_defaults=false;; + --header | --heade | --head | --hea ) + $ac_shift + CONFIG_HEADERS="$CONFIG_HEADERS $ac_optarg" + ac_need_defaults=false;; + -q | -quiet | --quiet | --quie | --qui | --qu | --q \ + | -silent | --silent | --silen | --sile | --sil | --si | --s) + ac_cs_silent=: ;; + + # This is an error. + -*) { { echo "$as_me:$LINENO: error: unrecognized option: $1 +Try \`$0 --help' for more information." >&5 +echo "$as_me: error: unrecognized option: $1 +Try \`$0 --help' for more information." >&2;} + { (exit 1); exit 1; }; } ;; + + *) ac_config_targets="$ac_config_targets $1" ;; + + esac + shift done -if test -z "$ac_sed_cmds"; then - ac_sed_cmds=cat + +ac_configure_extra_args= + +if $ac_cs_silent; then + exec 6>/dev/null + ac_configure_extra_args="$ac_configure_extra_args --silent" fi -EOF -cat >> $CONFIG_STATUS <>$CONFIG_STATUS <<_ACEOF +if \$ac_cs_recheck; then + echo "running $SHELL $0 " $ac_configure_args \$ac_configure_extra_args " --no-create --no-recursion" >&6 + exec $SHELL $0 $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion +fi -CONFIG_FILES=\${CONFIG_FILES-"Makefile "} -EOF -cat >> $CONFIG_STATUS <<\EOF -for ac_file in .. $CONFIG_FILES; do if test "x$ac_file" != x..; then - # Support "outfile[:infile[:infile...]]", defaulting infile="outfile.in". - case "$ac_file" in - *:*) ac_file_in=`echo "$ac_file"|sed 's%[^:]*:%%'` - ac_file=`echo "$ac_file"|sed 's%:.*%%'` ;; - *) ac_file_in="${ac_file}.in" ;; +_ACEOF + + + + + +cat >>$CONFIG_STATUS <<\_ACEOF +for ac_config_target in $ac_config_targets +do + case "$ac_config_target" in + # Handling of arguments. + "Makefile" ) CONFIG_FILES="$CONFIG_FILES Makefile" ;; + *) { { echo "$as_me:$LINENO: error: invalid argument: $ac_config_target" >&5 +echo "$as_me: error: invalid argument: $ac_config_target" >&2;} + { (exit 1); exit 1; }; };; esac +done - # Adjust a relative srcdir, top_srcdir, and INSTALL for subdirectories. +# If the user did not use the arguments to specify the items to instantiate, +# then the envvar interface is used. Set only those that are not. +# We use the long form for the default assignment because of an extremely +# bizarre bug on SunOS 4.1.3. +if $ac_need_defaults; then + test "${CONFIG_FILES+set}" = set || CONFIG_FILES=$config_files +fi - # Remove last slash and all that follows it. Not all systems have dirname. - ac_dir=`echo $ac_file|sed 's%/[^/][^/]*$%%'` - if test "$ac_dir" != "$ac_file" && test "$ac_dir" != .; then - # The file is in a subdirectory. - test ! -d "$ac_dir" && mkdir "$ac_dir" - ac_dir_suffix="/`echo $ac_dir|sed 's%^\./%%'`" - # A "../" for each directory in $ac_dir_suffix. - ac_dots=`echo $ac_dir_suffix|sed 's%/[^/]*%../%g'` - else - ac_dir_suffix= ac_dots= +# Have a temporary directory for convenience. Make it in the build tree +# simply because there is no reason to put it here, and in addition, +# creating and moving files from /tmp can sometimes cause problems. +# Create a temporary directory, and hook for its removal unless debugging. +$debug || +{ + trap 'exit_status=$?; rm -rf $tmp && exit $exit_status' 0 + trap '{ (exit 1); exit 1; }' 1 2 13 15 +} + +# Create a (secure) tmp directory for tmp files. + +{ + tmp=`(umask 077 && mktemp -d -q "./confstatXXXXXX") 2>/dev/null` && + test -n "$tmp" && test -d "$tmp" +} || +{ + tmp=./confstat$$-$RANDOM + (umask 077 && mkdir $tmp) +} || +{ + echo "$me: cannot create a temporary directory in ." >&2 + { (exit 1); exit 1; } +} + +_ACEOF + +cat >>$CONFIG_STATUS <<_ACEOF + +# +# CONFIG_FILES section. +# + +# No need to generate the scripts if there are no CONFIG_FILES. +# This happens for instance when ./config.status config.h +if test -n "\$CONFIG_FILES"; then + # Protect against being on the right side of a sed subst in config.status. + sed 's/,@/@@/; s/@,/@@/; s/,;t t\$/@;t t/; /@;t t\$/s/[\\\\&,]/\\\\&/g; + s/@@/,@/; s/@@/@,/; s/@;t t\$/,;t t/' >\$tmp/subs.sed <<\\CEOF +s,@SHELL@,$SHELL,;t t +s,@PATH_SEPARATOR@,$PATH_SEPARATOR,;t t +s,@PACKAGE_NAME@,$PACKAGE_NAME,;t t +s,@PACKAGE_TARNAME@,$PACKAGE_TARNAME,;t t +s,@PACKAGE_VERSION@,$PACKAGE_VERSION,;t t +s,@PACKAGE_STRING@,$PACKAGE_STRING,;t t +s,@PACKAGE_BUGREPORT@,$PACKAGE_BUGREPORT,;t t +s,@exec_prefix@,$exec_prefix,;t t +s,@prefix@,$prefix,;t t +s,@program_transform_name@,$program_transform_name,;t t +s,@bindir@,$bindir,;t t +s,@sbindir@,$sbindir,;t t +s,@libexecdir@,$libexecdir,;t t +s,@datadir@,$datadir,;t t +s,@sysconfdir@,$sysconfdir,;t t +s,@sharedstatedir@,$sharedstatedir,;t t +s,@localstatedir@,$localstatedir,;t t +s,@libdir@,$libdir,;t t +s,@includedir@,$includedir,;t t +s,@oldincludedir@,$oldincludedir,;t t +s,@infodir@,$infodir,;t t +s,@mandir@,$mandir,;t t +s,@build_alias@,$build_alias,;t t +s,@host_alias@,$host_alias,;t t +s,@target_alias@,$target_alias,;t t +s,@DEFS@,$DEFS,;t t +s,@ECHO_C@,$ECHO_C,;t t +s,@ECHO_N@,$ECHO_N,;t t +s,@ECHO_T@,$ECHO_T,;t t +s,@LIBS@,$LIBS,;t t +s,@XSLTPROC@,$XSLTPROC,;t t +s,@PDFLATEX@,$PDFLATEX,;t t +s,@MAKEINDEX@,$MAKEINDEX,;t t +s,@LATEX@,$LATEX,;t t +s,@DVIPS@,$DVIPS,;t t +s,@PNGTOPNM@,$PNGTOPNM,;t t +s,@PNMTOPS@,$PNMTOPS,;t t +s,@PERL@,$PERL,;t t +s,@XMLTO@,$XMLTO,;t t +s,@DOC_BUILD_DATE@,$DOC_BUILD_DATE,;t t +s,@TEXSTYLESHEET@,$TEXSTYLESHEET,;t t +s,@PAPERSIZE@,$PAPERSIZE,;t t +s,@DUPLICATE_ULINKS@,$DUPLICATE_ULINKS,;t t +s,@FONTSIZE@,$FONTSIZE,;t t +s,@CROP@,$CROP,;t t +s,@LIBOBJS@,$LIBOBJS,;t t +s,@LTLIBOBJS@,$LTLIBOBJS,;t t +CEOF + +_ACEOF + + cat >>$CONFIG_STATUS <<\_ACEOF + # Split the substitutions into bite-sized pieces for seds with + # small command number limits, like on Digital OSF/1 and HP-UX. + ac_max_sed_lines=48 + ac_sed_frag=1 # Number of current file. + ac_beg=1 # First line for current file. + ac_end=$ac_max_sed_lines # Line after last line for current file. + ac_more_lines=: + ac_sed_cmds= + while $ac_more_lines; do + if test $ac_beg -gt 1; then + sed "1,${ac_beg}d; ${ac_end}q" $tmp/subs.sed >$tmp/subs.frag + else + sed "${ac_end}q" $tmp/subs.sed >$tmp/subs.frag + fi + if test ! -s $tmp/subs.frag; then + ac_more_lines=false + else + # The purpose of the label and of the branching condition is to + # speed up the sed processing (if there are no `@' at all, there + # is no need to browse any of the substitutions). + # These are the two extra sed commands mentioned above. + (echo ':t + /@[a-zA-Z_][a-zA-Z_0-9]*@/!b' && cat $tmp/subs.frag) >$tmp/subs-$ac_sed_frag.sed + if test -z "$ac_sed_cmds"; then + ac_sed_cmds="sed -f $tmp/subs-$ac_sed_frag.sed" + else + ac_sed_cmds="$ac_sed_cmds | sed -f $tmp/subs-$ac_sed_frag.sed" + fi + ac_sed_frag=`expr $ac_sed_frag + 1` + ac_beg=$ac_end + ac_end=`expr $ac_end + $ac_max_sed_lines` + fi + done + if test -z "$ac_sed_cmds"; then + ac_sed_cmds=cat fi +fi # test -n "$CONFIG_FILES" - case "$ac_given_srcdir" in - .) srcdir=. - if test -z "$ac_dots"; then top_srcdir=. - else top_srcdir=`echo $ac_dots|sed 's%/$%%'`; fi ;; - /*) srcdir="$ac_given_srcdir$ac_dir_suffix"; top_srcdir="$ac_given_srcdir" ;; - *) # Relative path. - srcdir="$ac_dots$ac_given_srcdir$ac_dir_suffix" - top_srcdir="$ac_dots$ac_given_srcdir" ;; +_ACEOF +cat >>$CONFIG_STATUS <<\_ACEOF +for ac_file in : $CONFIG_FILES; do test "x$ac_file" = x: && continue + # Support "outfile[:infile[:infile...]]", defaulting infile="outfile.in". + case $ac_file in + - | *:- | *:-:* ) # input from stdin + cat >$tmp/stdin + ac_file_in=`echo "$ac_file" | sed 's,[^:]*:,,'` + ac_file=`echo "$ac_file" | sed 's,:.*,,'` ;; + *:* ) ac_file_in=`echo "$ac_file" | sed 's,[^:]*:,,'` + ac_file=`echo "$ac_file" | sed 's,:.*,,'` ;; + * ) ac_file_in=$ac_file.in ;; esac + # Compute @srcdir@, @top_srcdir@, and @INSTALL@ for subdirectories. + ac_dir=`(dirname "$ac_file") 2>/dev/null || +$as_expr X"$ac_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ + X"$ac_file" : 'X\(//\)[^/]' \| \ + X"$ac_file" : 'X\(//\)$' \| \ + X"$ac_file" : 'X\(/\)' \| \ + . : '\(.\)' 2>/dev/null || +echo X"$ac_file" | + sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/; q; } + /^X\(\/\/\)[^/].*/{ s//\1/; q; } + /^X\(\/\/\)$/{ s//\1/; q; } + /^X\(\/\).*/{ s//\1/; q; } + s/.*/./; q'` + { if $as_mkdir_p; then + mkdir -p "$ac_dir" + else + as_dir="$ac_dir" + as_dirs= + while test ! -d "$as_dir"; do + as_dirs="$as_dir $as_dirs" + as_dir=`(dirname "$as_dir") 2>/dev/null || +$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ + X"$as_dir" : 'X\(//\)[^/]' \| \ + X"$as_dir" : 'X\(//\)$' \| \ + X"$as_dir" : 'X\(/\)' \| \ + . : '\(.\)' 2>/dev/null || +echo X"$as_dir" | + sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/; q; } + /^X\(\/\/\)[^/].*/{ s//\1/; q; } + /^X\(\/\/\)$/{ s//\1/; q; } + /^X\(\/\).*/{ s//\1/; q; } + s/.*/./; q'` + done + test ! -n "$as_dirs" || mkdir $as_dirs + fi || { { echo "$as_me:$LINENO: error: cannot create directory \"$ac_dir\"" >&5 +echo "$as_me: error: cannot create directory \"$ac_dir\"" >&2;} + { (exit 1); exit 1; }; }; } + + ac_builddir=. + +if test "$ac_dir" != .; then + ac_dir_suffix=/`echo "$ac_dir" | sed 's,^\.[\\/],,'` + # A "../" for each directory in $ac_dir_suffix. + ac_top_builddir=`echo "$ac_dir_suffix" | sed 's,/[^\\/]*,../,g'` +else + ac_dir_suffix= ac_top_builddir= +fi - echo creating "$ac_file" - rm -f "$ac_file" - configure_input="Generated automatically from `echo $ac_file_in|sed 's%.*/%%'` by configure." - case "$ac_file" in - *Makefile*) ac_comsub="1i\\ -# $configure_input" ;; - *) ac_comsub= ;; - esac +case $srcdir in + .) # No --srcdir option. We are building in place. + ac_srcdir=. + if test -z "$ac_top_builddir"; then + ac_top_srcdir=. + else + ac_top_srcdir=`echo $ac_top_builddir | sed 's,/$,,'` + fi ;; + [\\/]* | ?:[\\/]* ) # Absolute path. + ac_srcdir=$srcdir$ac_dir_suffix; + ac_top_srcdir=$srcdir ;; + *) # Relative path. + ac_srcdir=$ac_top_builddir$srcdir$ac_dir_suffix + ac_top_srcdir=$ac_top_builddir$srcdir ;; +esac +# Don't blindly perform a `cd "$ac_dir"/$ac_foo && pwd` since $ac_foo can be +# absolute. +ac_abs_builddir=`cd "$ac_dir" && cd $ac_builddir && pwd` +ac_abs_top_builddir=`cd "$ac_dir" && cd ${ac_top_builddir}. && pwd` +ac_abs_srcdir=`cd "$ac_dir" && cd $ac_srcdir && pwd` +ac_abs_top_srcdir=`cd "$ac_dir" && cd $ac_top_srcdir && pwd` - ac_file_inputs=`echo $ac_file_in|sed -e "s%^%$ac_given_srcdir/%" -e "s%:% $ac_given_srcdir/%g"` - sed -e "$ac_comsub -s%@configure_input@%$configure_input%g -s%@srcdir@%$srcdir%g -s%@top_srcdir@%$top_srcdir%g -" $ac_file_inputs | (eval "$ac_sed_cmds") > $ac_file -fi; done -rm -f conftest.s* -EOF -cat >> $CONFIG_STATUS <> $CONFIG_STATUS <<\EOF + if test x"$ac_file" != x-; then + { echo "$as_me:$LINENO: creating $ac_file" >&5 +echo "$as_me: creating $ac_file" >&6;} + rm -f "$ac_file" + fi + # Let's still pretend it is `configure' which instantiates (i.e., don't + # use $as_me), people would be surprised to read: + # /* config.h. Generated by config.status. */ + if test x"$ac_file" = x-; then + configure_input= + else + configure_input="$ac_file. " + fi + configure_input=$configure_input"Generated from `echo $ac_file_in | + sed 's,.*/,,'` by configure." + + # First look for the input files in the build tree, otherwise in the + # src tree. + ac_file_inputs=`IFS=: + for f in $ac_file_in; do + case $f in + -) echo $tmp/stdin ;; + [\\/$]*) + # Absolute (can't be DOS-style, as IFS=:) + test -f "$f" || { { echo "$as_me:$LINENO: error: cannot find input file: $f" >&5 +echo "$as_me: error: cannot find input file: $f" >&2;} + { (exit 1); exit 1; }; } + echo $f;; + *) # Relative + if test -f "$f"; then + # Build tree + echo $f + elif test -f "$srcdir/$f"; then + # Source tree + echo $srcdir/$f + else + # /dev/null tree + { { echo "$as_me:$LINENO: error: cannot find input file: $f" >&5 +echo "$as_me: error: cannot find input file: $f" >&2;} + { (exit 1); exit 1; }; } + fi;; + esac + done` || { (exit 1); exit 1; } +_ACEOF +cat >>$CONFIG_STATUS <<_ACEOF + sed "$ac_vpsub +$extrasub +_ACEOF +cat >>$CONFIG_STATUS <<\_ACEOF +:t +/@[a-zA-Z_][a-zA-Z_0-9]*@/!b +s,@configure_input@,$configure_input,;t t +s,@srcdir@,$ac_srcdir,;t t +s,@abs_srcdir@,$ac_abs_srcdir,;t t +s,@top_srcdir@,$ac_top_srcdir,;t t +s,@abs_top_srcdir@,$ac_abs_top_srcdir,;t t +s,@builddir@,$ac_builddir,;t t +s,@abs_builddir@,$ac_abs_builddir,;t t +s,@top_builddir@,$ac_top_builddir,;t t +s,@abs_top_builddir@,$ac_abs_top_builddir,;t t +" $ac_file_inputs | (eval "$ac_sed_cmds") >$tmp/out + rm -f $tmp/stdin + if test x"$ac_file" != x-; then + mv $tmp/out $ac_file + else + cat $tmp/out + rm -f $tmp/out + fi + +done +_ACEOF + +cat >>$CONFIG_STATUS <<\_ACEOF -exit 0 -EOF +{ (exit 0); exit 0; } +_ACEOF chmod +x $CONFIG_STATUS -rm -fr confdefs* $ac_clean_files -test "$no_create" = yes || ${CONFIG_SHELL-/bin/sh} $CONFIG_STATUS || exit 1 +ac_clean_files=$ac_clean_files_save + + +# configure is writing to config.log, and then calls config.status. +# config.status does its own redirection, appending to config.log. +# Unfortunately, on DOS this fails, as config.log is still kept open +# by configure, so config.status won't be able to write to it; its +# output is simply discarded. So we exec the FD to /dev/null, +# effectively closing config.log, so it can be properly (re)opened and +# appended to by config.status. When coming back to configure, we +# need to make the FD available again. +if test "$no_create" != yes; then + ac_cs_success=: + ac_config_status_args= + test "$silent" = yes && + ac_config_status_args="$ac_config_status_args --quiet" + exec 5>/dev/null + $SHELL $CONFIG_STATUS $ac_config_status_args || ac_cs_success=false + exec 5>>config.log + # Use ||, not &&, to avoid exiting from the if with $? = 1, which + # would make configure fail if this is the last instruction. + $ac_cs_success || { (exit 1); exit 1; } +fi diff --git a/docs/docbook/global.ent b/docs/docbook/global.ent index 297d1bc883..75d6d7605f 100644 --- a/docs/docbook/global.ent +++ b/docs/docbook/global.ent @@ -48,6 +48,46 @@ &person.jht;'> +GuentherDeschner + + SuSE +

    gd@suse.de
    + +'> + +&person.gd;'> + +KarlAuer + + Samba Team +
    kauer@biplane.com.au
    +     +'> + +&person.kauer;'> + +DanShearer + + Samba Team +
    dan@samba.org
    +     +'> + +&person.danshearer;'> + +TimPotter + + Samba Team +
    tpot@samba.org
    +     +'> + +&person.tpot;'> + AndrewTridgell @@ -148,7 +188,7 @@ not specified is zero. logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out. Levels above 1 will generate considerable @@ -451,6 +491,8 @@ an Active Directory environment. + + @@ -525,3 +567,5 @@ an Active Directory environment. + +"> diff --git a/docs/docbook/projdoc/AccessControls.xml b/docs/docbook/projdoc/AccessControls.xml index 344e51e5c0..72348d44cd 100644 --- a/docs/docbook/projdoc/AccessControls.xml +++ b/docs/docbook/projdoc/AccessControls.xml @@ -7,12 +7,12 @@ File, Directory and Share Access Controls -ACLs +ACLs Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of resources shared via Samba do not behave in the manner they might expect. MS Windows network administrators are often confused regarding network access controls and how to -provide users with the access they need while protecting resources from unauthorised access. +provide users with the access they need while protecting resources from unauthorized access. @@ -23,17 +23,19 @@ and directory access permissions. The problem lies in the differences in how file and directory permissions and controls work -between the two environments. This difference is one that Samba can not completely hide, even +between the two environments. This difference is one that Samba cannot completely hide, even though it does try to bridge the chasm to a degree. -Extended Attributes +Extended Attributes +ACLsPOSIX + POSIX Access Control List technology has been available (along with Extended Attributes) for UNIX for many years, yet there is little evidence today of any significant use. This explains to some extent the slow adoption of ACLs into commercial Linux products. MS Windows -administrators are astounded at this given that ACLs were a foundational capability of the now -decade old MS Windows NT operating system. +administrators are astounded at this, given that ACLs were a foundational capability of the now +decade-old MS Windows NT operating system. @@ -44,9 +46,9 @@ for delivering the best environment for MS Windows desktop users. This is an opportune point to mention that Samba was created to provide a means of interoperability -and interchange of data between differing operating environments. Samba has no intent change +and interchange of data between differing operating environments. Samba has no intent to change UNIX/Linux into a platform like MS Windows. Instead the purpose was and is to provide a sufficient -level of exchange of data between the two environments. What is available today extends well +level of exchange of data between the two environments. What is available today extends well beyond early plans and expectations, yet the gap continues to shrink. @@ -61,11 +63,12 @@ beyond early plans and expectations, yet the gap continues to shrink. Samba Access Control Facilities + permissionsUNIX file and directory UNIX File and Directory Permissions - Samba honours and implements UNIX file system access controls. Users + Samba honors and implements UNIX file system access controls. Users who access a Samba server will do so as a particular MS Windows user. This information is passed to the Samba server as part of the logon or connection setup process. Samba uses this user identity to validate @@ -80,10 +83,10 @@ beyond early plans and expectations, yet the gap continues to shrink. - In configuring share settings and controls in the &smb.conf; file - the network administrator can exercise over-rides to native file - system permissions and behaviours. This can be handy and convenient - to affect behaviour that is more like what MS Windows NT users expect + In configuring share settings and controls in the &smb.conf; file, + the network administrator can exercise overrides to native file + system permissions and behaviors. This can be handy and convenient + to effect behavior that is more like what MS Windows NT users expect but it is seldom the best way to achieve this. The basic options and techniques are described herein. @@ -91,27 +94,30 @@ beyond early plans and expectations, yet the gap continues to shrink. Samba Share ACLs + ACLsshare Just like it is possible in MS Windows NT to set ACLs on shares themselves, so it is possible to do this in Samba. - Very few people make use of this facility, yet it remains on of the + Few people make use of this facility, yet it remains on of the easiest ways to affect access controls (restrictions) and can often do so with minimum invasiveness compared with other methods. + ACLsPOSIX + ACLsWindows MS Windows ACLs through UNIX POSIX ACLs - The use of POSIX ACLs on UNIX/Linux is possible ONLY if the underlying + The use of POSIX ACLs on UNIX/Linux is possible only if the underlying operating system supports them. If not, then this option will not be available to you. Current UNIX technology platforms have native support - for POSIX ACLs. There are patches for the Linux kernel that provide - this also. Sadly, few Linux platforms ship today with native ACLs and + for POSIX ACLs. There are patches for the Linux kernel that also provide + this. Sadly, few Linux platforms ship today with native ACLs and Extended Attributes enabled. This chapter has pertinent information for users of platforms that support them. @@ -124,43 +130,50 @@ beyond early plans and expectations, yet the gap continues to shrink. File System Access Controls -Perhaps the most important recognition to be made is the simple fact that MS Windows NT4 / 200x / XP +Perhaps the most important recognition to be made is the simple fact that MS Windows NT4/200x/XP implement a totally divergent file system technology from what is provided in the UNIX operating system -environment. Firstly we should consider what the most significant differences are, then we shall look +environment. First we consider what the most significant differences are, then we look at how Samba helps to bridge the differences. -NTFS -File System MS Windows NTFS Comparison with UNIX File Systems +NTFS +File System +File SystemUNIX +File SystemWindows + Samba operates on top of the UNIX file system. This means it is subject to UNIX file system conventions and permissions. It also means that if the MS Windows networking environment requires file system - behaviour that differs from unix file system behaviour then somehow Samba is responsible for emulating + behavior that differs from UNIX file system behavior then somehow Samba is responsible for emulating that in a transparent and consistent manner. - It is good news that Samba does this to a very large extent and on top of that provides a high degree - of optional configuration to over-ride the default behaviour. We will look at some of these over-rides, - but for the greater part we will stay within the bounds of default behaviour. Those wishing to explore - to depths of control ability should review the &smb.conf; man page. + It is good news that Samba does this to a large extent and on top of that provides a high degree + of optional configuration to override the default behavior. We look at some of these over-rides, + but for the greater part we will stay within the bounds of default behavior. Those wishing to explore + the depths of control ability should review the &smb.conf; man page. + + + The following compares file system features for UNIX with those of Microsoft Windows NT/200x: + File Systemfeature comparison + - File System Feature Comparison Name Space - MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, UNIX file names - may be 1023 characters long. In MS Windows file extensions indicate particular file types, + MS Windows NT4/200x/XP files names may be up to 254 characters long, and UNIX file names + may be 1023 characters long. In MS Windows, file extensions indicate particular file types, in UNIX this is not so rigorously observed as all names are considered arbitrary. - What MS Windows calls a Folder, UNIX calls a directory. + What MS Windows calls a folder, UNIX calls a directory. @@ -169,28 +182,35 @@ at how Samba helps to bridge the differences. Case Sensitivity - 8.3file names - MS Windows file names are generally upper case if made up of 8.3 (ie: 8 character file name - and 3 character extension. If longer than 8.3 file names are Case Preserving, and Case - Insensitive. + 8.3 file names + File Systemcase sensitivity + MS Windows file names are generally upper case if made up of 8.3 (8 character file name + and 3 character extension. File names that are longer than 8.3 are case preserving and case + insensitive. + UNIX file and directory names are case sensitive and case preserving. Samba implements the - MS Windows file name behaviour, but it does so as a user application. The UNIX file system + MS Windows file name behavior, but it does so as a user application. The UNIX file system provides no mechanism to perform case insensitive file name lookups. MS Windows does this by default. This means that Samba has to carry the processing overhead to provide features - that are NOT native to the UNIX operating system environment. + that are not native to the UNIX operating system environment. - Consider the following, all are unique UNIX names but one single MS Windows file name: - + Consider the following. All are unique UNIX names but one single MS Windows file name: + MYFILE.TXT MyFile.txt myfile.txt - - So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in UNIX - they can. So what should Samba do if all three are present? Answer, the one that is lexically - first will be accessible to MS Windows users, the others are invisible and unaccessible - any + + + + So clearly, in an MS Windows file name space these three files cannot co-exist, but in UNIX + they can. + + + So what should Samba do if all three are present? That which is lexically first will be + accessible to MS Windows users, the others are invisible and unaccessible &smbmdash; any other solution would be suicidal. @@ -199,9 +219,11 @@ at how Samba helps to bridge the differences. Directory Separators + - MS Windows and DOS uses the back-slash '\' as a directory delimiter, UNIX uses the forward-slash '/' - as it's directory delimiter. This is transparently handled by Samba. + Directory Separators + MS Windows and DOS uses the backslash \ as a directory delimiter, and UNIX uses + the forward-slash / as its directory delimiter. This is handled transparently by Samba. @@ -210,11 +232,12 @@ at how Samba helps to bridge the differences. Drive Identification + Drive Identification MS Windows products support a notion of drive letters, like C: to represent - disk partitions. UNIX has NO concept if separate identifiers for file partitions since each - such file system is mounted to become part of the over-all directory tree. - The UNIX directory tree begins at '/', just like the root of a DOS drive is specified like - C:\. + disk partitions. UNIX has no concept of separate identifiers for file partitions, each + such file system is mounted to become part of the overall directory tree. + The UNIX directory tree begins at / just like the root of a DOS drive is specified as + C:\. @@ -223,9 +246,10 @@ at how Samba helps to bridge the differences. File Naming Conventions - MS Windows generally never experiences file names that begin with a '.', while in UNIX these - are commonly found in a user's home directory. Files that begin with a '.' are typically - either start up files for various UNIX applications, or they may be files that contain + File Naming Conventions + MS Windows generally never experiences file names that begin with a dot (.) while in UNIX these + are commonly found in a user's home directory. Files that begin with a dot (.) are typically + either start-up files for various UNIX applications, or they may be files that contain start-up configuration data. @@ -238,15 +262,14 @@ at how Samba helps to bridge the differences. Linkshard Linkssoft Short-Cuts - - MS Windows make use of "links and Short-Cuts" that are actually special types of files that will + MS Windows make use of links and short-cuts that are actually special types of files that will redirect an attempt to execute the file to the real location of the file. UNIX knows of file and directory links, but they are entirely different from what MS Windows users are used to. - Symbolic links are files in UNIX that contain the actual location of the data (file OR directory). An + Symbolic links are files in UNIX that contain the actual location of the data (file or directory). An operation (like read or write) will operate directly on the file referenced. Symbolic links are also - referred to as 'soft links'. A hard link is something that MS Windows is NOT familiar with. It allows + referred to as soft links. A hard link is something that MS Windows is not familiar with. It allows one physical file to be known simultaneously by more than one file name. @@ -256,7 +279,7 @@ at how Samba helps to bridge the differences. There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort in the process of becoming familiar with UNIX/Linux. These are best left for a text that is dedicated to the - purpose of UNIX/Linux training/education. + purpose of UNIX/Linux training and education. @@ -265,9 +288,9 @@ at how Samba helps to bridge the differences. Managing Directories - There are three basic operations for managing directories, create, delete, rename. + There are three basic operations for managing directories: create, delete, rename.
    • %s%s
    %s%s
    %s%s Not Used  Server for client use  Client of another WINS server 
    Remote WINS Server 
    Remote WINS Server 
    Error: WINS Server Mode and WINS Support both set in smb.conf
    Please Select desired WINS mode above.
    - Managing directories with unix and windows + Managing Directories with UNIX and Windows ActionMS Windows CommandUNIX Command @@ -287,7 +310,9 @@ at how Samba helps to bridge the differences. File and Directory Access Control + + ACLsFile System The network administrator is strongly advised to read foundational training manuals and reference materials regarding file and directory permissions maintenance. Much can be achieved with the basic UNIX permissions without having to resort to more complex facilities like POSIX Access Control Lists (ACLs) or Extended @@ -295,9 +320,8 @@ at how Samba helps to bridge the differences. - UNIX/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. - A UNIX file listing looks as follows:- - + UNIX/Linux file and directory access permissions involves setting three primary sets of data and one control set. + A UNIX file listing looks as follows: &prompt;ls -la total 632 @@ -322,20 +346,20 @@ drwsrwsrwx 2 maryo gnomes 48 2003-05-12 22:29 muchado08 - An overview of the permissions field can be found in the image below. + An overview of the permissions field can be found in . - Overview of unix permissions fieldaccess1 + Overview of UNIX permissions field.access1 - Any bit flag may be unset. An unset bit flag is the equivalent of 'Can NOT' and is represented as a '-' character. + Any bit flag may be unset. An unset bit flag is the equivalent of cannot and is represented as a - character. Example File -rwxr-x--- Means: The owner (user) can read, write, execute the group can read and execute - everyone else can NOT do anything with it + everyone else cannot do anything with it. @@ -346,7 +370,7 @@ drwsrwsrwx 2 maryo gnomes 48 2003-05-12 22:29 muchado08 - The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x), + The letters rwxXst set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x), execute only if the file is a directory or already has execute permission for some user (X), set user or group ID on execution (s), sticky (t). @@ -354,20 +378,20 @@ drwsrwsrwx 2 maryo gnomes 48 2003-05-12 22:29 muchado08 When the sticky bit is set on a directory, files in that directory may be unlinked (deleted) or renamed only by root or their owner. Without the sticky bit, anyone able to write to the directory can delete or rename files. The sticky bit is commonly found on - directories, such as /tmp, that are world-writable. + directories, such as /tmp, that are world-writable. When the set user or group ID bit (s) is set on a directory, then all files created within it will be owned by the user and/or - group whose 'set user or group' bit is set. This can be very helpful in setting up directories that for which it is desired that + group whose `set user or group' bit is set. This can be helpful in setting up directories for which it is desired that all users who are in a group should be able to write to and read from a file, particularly when it is undesirable for that file - to be exclusively owned by a user who's primary group is not the group that all such users belong to. + to be exclusively owned by a user whose primary group is not the group that all such users belong to. When a directory is set drw-r----- this means that the owner can read and create (write) files in it, but because - the (x) execute flags are not set files can not be listed (seen) in the directory by anyone. The group can read files in the - directory but can NOT create new files. NOTE: If files in the directory are set to be readable and writable for the group, then + the (x) execute flags are not set, files cannot be listed (seen) in the directory by anyone. The group can read files in the + directory but cannot create new files. If files in the directory are set to be readable and writable for the group, then group members will be able to write to (or delete) them. @@ -378,34 +402,40 @@ drwsrwsrwx 2 maryo gnomes 48 2003-05-12 22:29 muchado08 Share Definition Access Controls + -The following parameters in the &smb.conf; file sections that define a share control or affect access controls. -Before using any of the following options please refer to the man page for &smb.conf;. +permissionsshare +The following parameters in the &smb.conf; file sections define a share control or effect access controls. +Before using any of the following options, please refer to the man page for &smb.conf;. - User and Group Based Controls + User and Group-Based Controls - User and group based controls can prove very useful. In some situations it is distinctly desirable to affect all - file system operations as if a single user is doing this, the use of the force user and - force group behaviour will achieve this. In other situations it may be necessary to affect a - paranoia level of control to ensure that only particular authorised persons will be able to access a share or - it's contents, here the use of the valid users or the invalid users may - be most useful. + User and group-based controls can prove quite useful. In some situations it is distinctly desirable to affect all + file system operations as if a single user were doing so. The use of the force user and + force group behavior will achieve this. In other situations it may be necessary to effect a + paranoia level of control to ensure that only particular authorized persons will be able to access a share or + its contents. Here the use of the valid users or the + invalid users may be most useful. As always, it is highly advisable to use the least difficult to maintain and the least ambiguous method for - controlling access. Remember, that when you leave the scene someone else will need to provide assistance and - if that person finds too great a mess, or if they do not understand what you have done then there is risk of + controlling access. Remember, when you leave the scene someone else will need to provide assistance and + if he finds too great a mess or does not understand what you have done, there is risk of Samba being removed and an alternative solution being adopted. -
    User and Group Based Controls + + enumerates these controls. + + +
    User and Group Based Controls - + Control Parameter @@ -417,7 +447,7 @@ Before using any of the following options please refer to the man page for &smb. admin users List of users who will be granted administrative privileges on the share. - They will do all file operations as the super-user (root). + They will do all file operations as the super-user (root). Any user in this list will be able to do anything they like on the share, irrespective of file permissions. @@ -465,7 +495,7 @@ Before using any of the following options please refer to the man page for &smb. username - Refer to the &smb.conf; man page for more information - this is a complex and potentially misused parameter. + Refer to the &smb.conf; man page for more information -- this is a complex and potentially misused parameter. @@ -487,19 +517,24 @@ Before using any of the following options please refer to the man page for &smb. - File and Directory Permissions Based Controls + File and Directory Permissions-Based Controls - The following file and directory permission based controls, if misused, can result in considerable difficulty to - diagnose the cause of mis-configuration. Use them sparingly and carefully. By gradually introducing each one by one - undesirable side-effects may be detected. In the event of a problem, always comment all of them out and then gradually - re-introduce them in a controlled fashion. + The following file and directory permission-based controls, if misused, can result in considerable difficulty to + diagnose causes of misconfiguration. Use them sparingly and carefully. By gradually introducing each one by one, + undesirable side effects may be detected. In the event of a problem, always comment all of them out and then gradually + reintroduce them in a controlled way. -
    File and Directory Permission Based Controls + + Refer to for information regarding the parameters that may be used to affect file and + directory permission-based access controls. + + +
    File and Directory Permission Based Controls - + Control Parameter @@ -540,7 +575,7 @@ Before using any of the following options please refer to the man page for &smb. force directory security mode - Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory + Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory. @@ -584,13 +619,13 @@ Before using any of the following options please refer to the man page for &smb. The following are documented because of the prevalence of administrators creating inadvertent barriers to file - access by not understanding the full implications of &smb.conf; file settings. + access by not understanding the full implications of &smb.conf; file settings. See . -
    Other Controls +
    Other Controls - - + + Control Parameter @@ -602,7 +637,7 @@ Before using any of the following options please refer to the man page for &smb. case sensitive, default case, short preserve case This means that all file name lookup will be done in a case sensitive manner. - Files will be created with the precise filename Samba received from the MS Windows client. + Files will be created with the precise file name Samba received from the MS Windows client. @@ -614,7 +649,7 @@ Before using any of the following options please refer to the man page for &smb. dont descend - Allows to specify a comma-delimited list of directories that the server should always show as empty. + Allows specifying a comma-delimited list of directories that the server should always show as empty. @@ -626,15 +661,15 @@ Before using any of the following options please refer to the man page for &smb. dos filetimes - DOS and Windows allows users to change file time stamps if they can write to the file. POSIX semantics prevent this. - This options allows DOS and Windows behaviour. + DOS and Windows allow users to change file time stamps if they can write to the file. POSIX semantics prevent this. + This option allows DOS and Windows behavior. fake oplocks Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an - oplock then the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. + oplock, the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. @@ -666,16 +701,18 @@ Before using any of the following options please refer to the man page for &smb. Access Controls on Shares + +permissionsshare ACLs This section deals with how to configure Samba per share access control restrictions. By default, Samba sets no restrictions on the share itself. Restrictions on the share itself - can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can + can be set on MS Windows NT4/200x/XP shares. This can be an effective way to limit who can connect to a share. In the absence of specific restrictions the default setting is to allow - the global user Everyone Full Control (ie: Full control, Change and Read). + the global user Everyone - Full Control (full control, change and read). - At this time Samba does NOT provide a tool for configuring access control setting on the Share + At this time Samba does not provide a tool for configuring access control setting on the share itself. Samba does have the capacity to store and act on access control settings, but the only way to create those settings is to use either the NT4 Server Manager or the Windows 200x MMC for Computer Management. @@ -683,10 +720,10 @@ Before using any of the following options please refer to the man page for &smb. Samba stores the per share access control settings in a file called share_info.tdb. - The location of this file on your system will depend on how samba was compiled. The default location + The location of this file on your system will depend on how Samba was compiled. The default location for Samba's tdb files is under /usr/local/samba/var. If the tdbdump utility has been compiled and installed on your system, then you can examine the contents of this file - by: tdbdump share_info.tdb. + by executing: tdbdump share_info.tdb in the directory containing the tdb files. @@ -701,18 +738,20 @@ Before using any of the following options please refer to the man page for &smb. The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. - You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below. + You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft &smbmdash; see details below. + + Instructions - Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu - select Computer, then click on the Shared Directories entry. + Launch the NT4 Server Manager, click on the Samba server you want to administer. From the menu + select Computer, then click on Shared Directories. - Now click on the share that you wish to manage, then click on the Properties tab, next click on + Click on the share that you wish to manage, then click the Properties tab. then click the Permissions tab. Now you can add or change access control settings as you wish. @@ -724,47 +763,47 @@ Before using any of the following options please refer to the man page for &smb. On MS Windows NT4/200x/XP system access control lists on the share itself are set using native - tools, usually from file manager. For example, in Windows 200x: right click on the shared folder, + tools, usually from File Manager. For example, in Windows 200x, right click on the shared folder, then select Sharing, then click on Permissions. The default - Windows NT4/200x permission allows Everyone Full Control on the Share. + Windows NT4/200x permission allows Everyone full control on the share. - MS Windows 200x and later all comes with a tool called the Computer Management snap-in for the - Microsoft Management Console (MMC). This tool is located by clicking on Control Panel -> - Administrative Tools -> Computer Management. + MS Windows 200x and later versions come with a tool called the Computer Management snap-in for the + Microsoft Management Console (MMC). This tool is located by clicking on Control Panel -> + Administrative Tools -> Computer Management. Instructions - After launching the MMC with the Computer Management snap-in, click on the menu item Action, - select Connect to another computer. If you are not logged onto a domain you will be prompted - to enter a domain login user identifier and a password. This will authenticate you to the domain. - If you where already logged in with administrative privilege this step is not offered. + After launching the MMC with the Computer Management snap-in, click the menu item Action, + and select Connect to another computer. If you are not logged onto a domain you will be prompted + to enter a domain login user identifier and a password. This will authenticate you to the domain. + If you are already logged in with administrative privilege, this step is not offered. - If the Samba server is not shown in the Select Computer box, then type in the name of the target - Samba server in the field Name:. Now click on the [+] next to + If the Samba server is not shown in the Select Computer box, type in the name of the target + Samba server in the field Name:. Now click the on [+] next to System Tools, then on the [+] next to Shared Folders in the left panel. - Now in the right panel, double-click on the share you wish to set access control permissions on. - Then click on the tab Share Permissions. It is now possible to add access control entities - to the shared folder. Do NOT forget to set what type of access (full control, change, read) you + In the right panel, double-click on the share on which you wish to set access control permissions. + Then click the tab Share Permissions. It is now possible to add access control entities + to the shared folder. Remember to set what type of access (full control, change, read) you wish to assign for each entry. - Be careful. If you take away all permissions from the Everyone user without removing this user - then effectively no user will be able to access the share. This is a result of what is known as - ACL precedence. ie: Everyone with no access means that MaryK who is part of the group - Everyone will have no access even if this user is given explicit full control access. + Be careful. If you take away all permissions from the Everyone user without removing this user, + effectively no user will be able to access the share. This is a result of what is known as + ACL precedence. Everyone with no access means that MaryK who is part of the group + Everyone will have no access even if she is given explicit full control access. @@ -777,27 +816,29 @@ Before using any of the following options please refer to the man page for &smb. MS Windows Access Control Lists and UNIX Interoperability - Managing UNIX permissions Using NT Security Dialogs + Managing UNIX Permissions Using NT Security Dialogs + +permissionsfile/directory ACLs Windows NT clients can use their native security settings dialog box to view and modify the underlying UNIX permissions. - Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and + This ability is careful not to compromise the security of the UNIX host on which Samba is running, and still obeys all the file permission rules that a Samba administrator can set. - Samba does not attempt to go beyond POSIX ACLs, so that the various finer-grained access control - options provided in Windows are actually ignore. + Samba does not attempt to go beyond POSIX ACLs, so the various finer-grained access control + options provided in Windows are actually ignored. All access to UNIX/Linux system files via Samba is controlled by the operating system file access controls. - When trying to figure out file access problems it is vitally important to find the identity of the Windows + When trying to figure out file access problems, it is vitally important to find the identity of the Windows user as it is presented by Samba at the point of file access. This can best be determined from the Samba log files. @@ -808,57 +849,57 @@ Before using any of the following options please refer to the man page for &smb. Viewing File Security on a Samba Share - From an NT4/2000/XP client, single-click with the right mouse button on any file or directory in a Samba - mounted drive letter or UNC path. When the menu pops-up, click on the Properties - entry at the bottom of the menu. This brings up the file properties dialog box. Click on the tab - Security and you will see three buttons, Permissions, + From an NT4/2000/XP client, right click on any file or directory in a Samba-mounted drive letter + or UNC path. When the menu pops up, click on the Properties entry at the bottom + of the menu. This brings up the file Properties dialog box. Click on the + Security tab and you will see three buttons: Permissions, Auditing, and Ownership. The Auditing - button will cause either an error message A requested privilege is not held by the client + button will cause either an error message `A requested privilege is not held by the client' to appear if the user is not the NT Administrator, or a dialog which is intended to allow an Administrator to add auditing requirements to a file if the user is logged on as the NT Administrator. This dialog is non-functional with a Samba share at this time, as the only useful button, the Add - button will not currently allow a list of users to be seen. + button, will not currently allow a list of users to be seen. - Viewing file ownership + Viewing File Ownership Clicking on the Ownership button brings up a dialog box telling you who owns - the given file. The owner name will be of the form: + the given file. The owner name will be displayed like this: - "SERVER\user (Long name)" + SERVER\user (Long name) - Where SERVER is the NetBIOS name of the Samba server, user + SERVER is the NetBIOS name of the Samba server, user is the user name of the UNIX user who owns the file, and (Long name) is the descriptive string identifying the user (normally found in the GECOS field of the UNIX password database). Click on the Close button to remove this dialog. - If the parameter nt acl support is set to false - then the file owner will be shown as the NT user "Everyone". + If the parameter nt acl support is set to false, + the file owner will be shown as the NT user Everyone. The Take Ownership button will not allow you to change the ownership of this file to - yourself (clicking on it will display a dialog box complaining that the user you are currently logged onto + yourself (clicking it will display a dialog box complaining that the user you are currently logged onto the NT client cannot be found). The reason for this is that changing the ownership of a file is a privileged operation in UNIX, available only to the root user. As clicking on this button causes - NT to attempt to change the ownership of a file to the current user logged into the NT client this will + NT to attempt to change the ownership of a file to the current user logged into the NT clienti, this will not work with Samba at this time. - There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected + There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected to a Samba server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS or Samba drive. This is available as part of the Seclib NT security library written - by Jeremy Allison of the Samba-Team, available from the main Samba FTP site. + by Jeremy Allison of the Samba Team, and is available from the main Samba FTP site. @@ -867,12 +908,12 @@ Before using any of the following options please refer to the man page for &smb. The third button is the Permissions button. Clicking on this brings up a dialog box - that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed in the form: + that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed like this: - "SERVER\ + SERVER\ user - (Long name)" + (Long name) Where SERVER is the NetBIOS name of the Samba server, user is the user name of the UNIX user who owns the file, and @@ -880,9 +921,9 @@ Before using any of the following options please refer to the man page for &smb. GECOS field of the UNIX password database). - If the parameter nt acl support is set to false - then the file owner will be shown as the NT user "Everyone" and the permissions will be - shown as NT "Full Control". + If the parameter nt acl support is set to false, + the file owner will be shown as the NT user Everyone and the permissions will be + shown as NT Full Control. @@ -894,76 +935,59 @@ Before using any of the following options please refer to the man page for &smb. File Permissions - The standard UNIX user/group/world triplet and - the corresponding "read", "write", "execute" permissions - triplets are mapped by Samba into a three element NT ACL - with the 'r', 'w', and 'x' bits mapped into the corresponding - NT permissions. The UNIX world permissions are mapped into - the global NT group Everyone, followed - by the list of permissions allowed for UNIX world. The UNIX - owner and group permissions are displayed as an NT - user icon and an NT local - group icon respectively followed by the list + The standard UNIX user/group/world triplet and the corresponding read, write, execute permissions + triplets are mapped by Samba into a three element NT ACL with the r, w and x bits mapped into the corresponding + NT permissions. The UNIX world permissions are mapped into the global NT group Everyone, followed + by the list of permissions allowed for UNIX world. The UNIX owner and group permissions are displayed as an NT + user icon and an NT local group icon, respectively, followed by the list of permissions allowed for the UNIX user and group. - As many UNIX permission sets don't map into common - NT names such as read, - "change" or full control then - usually the permissions will be prefixed by the words - "Special Access" in the NT display list. - - But what happens if the file has no permissions allowed - for a particular UNIX user group or world component? In order - to allow "no permissions" to be seen and modified then Samba - overloads the NT "Take Ownership" ACL attribute - (which has no meaning in UNIX) and reports a component with - no permissions as having the NT "O" bit set. - This was chosen of course to make it look like a zero, meaning - zero permissions. More details on the decision behind this will - be given below. + Because many UNIX permission sets do not map into common NT names such as read, + change or full control, usually the permissions will be prefixed + by the words Special Access in the NT display list. + + But what happens if the file has no permissions allowed for a particular UNIX user group or world component? In order + to allow no permissions to be seen and modified Samba then overloads the NT Take Ownership ACL attribute + (which has no meaning in UNIX) and reports a component with no permissions as having the NT O bit set. + This was chosen, of course, to make it look like a zero, meaning zero permissions. More details on the decision behind this is + given below. Directory Permissions - Directories on an NT NTFS file system have two - different sets of permissions. The first set of permissions - is the ACL set on the directory itself, this is usually displayed - in the first set of parentheses in the normal "RW" - NT style. This first set of permissions is created by Samba in - exactly the same way as normal file permissions are, described + Directories on an NT NTFS file system have two different sets of permissions. The first set is the ACL set on the + directory itself, which is usually displayed in the first set of parentheses in the normal RW + NT style. This first set of permissions is created by Samba in exactly the same way as normal file permissions are, described above, and is displayed in the same way. - The second set of directory permissions has no real meaning - in the UNIX permissions world and represents the - inherited permissions that any file created within - this directory would inherit. + The second set of directory permissions has no real meaning in the UNIX permissions world and represents the + inherited permissions that any file created within this directory would inherit. - Samba synthesises these inherited permissions for NT by - returning as an NT ACL the UNIX permission mode that a new file + Samba synthesises these inherited permissions for NT by returning as an NT ACL the UNIX permission mode that a new file created by Samba on this share would receive. - Modifying file or directory permissions + Modifying File or Directory Permissions Modifying file and directory permissions is as simple as changing the displayed permissions in the dialog box, and - clicking the OK button. However, there are + clicking on OK. However, there are limitations that a user needs to be aware of, and also interactions with the standard Samba permission masks and mapping of DOS attributes that need to also be taken into account. If the parameter nt acl support - is set to false then any attempt to set - security permissions will fail with an "Access Denied" + is set to false, any attempt to set + security permissions will fail with an `Access Denied' message. - The first thing to note is that the "Add" + The first thing to note is that the Add button will not return a list of users in Samba (it will give - an error message of The remote procedure call failed - and did not execute). This means that you can only + an error message saying `The remote procedure call failed + and did not execute'). This means that you can only manipulate the current user/group/world permissions listed in the dialog box. This actually works quite well as these are the only permissions that UNIX actually has. @@ -971,88 +995,82 @@ Before using any of the following options please refer to the man page for &smb. If a permission triplet (either user, group, or world) is removed from the list of permissions in the NT dialog box, then when the OK button is pressed it will - be applied as "no permissions" on the UNIX side. If you then - view the permissions again the "no permissions" entry will appear - as the NT "O" flag, as described above. This + be applied as no permissions on the UNIX side. If you then + view the permissions again, the no permissions entry will appear + as the NT O flag, as described above. This allows you to add permissions back to a file or directory once you have removed them from a triplet component. - As UNIX supports only the "r", "w" and "x" bits of - an NT ACL then if other NT security attributes such as "Delete - access" are selected then they will be ignored when applied on - the Samba server. + As UNIX supports only the r, w and x bits of + an NT ACL, if other NT security attributes such as Delete Access are + selected they will be ignored when applied on the Samba server. - When setting permissions on a directory the second + When setting permissions on a directory, the second set of permissions (in the second set of parentheses) is by default applied to all files within that directory. If this - is not what you want you must uncheck the Replace + is not what you want, you must uncheck the Replace permissions on existing files checkbox in the NT - dialog before clicking OK. + dialog before clicking on OK. If you wish to remove all permissions from a - user/group/world component then you may either highlight the - component and click the Remove button, + user/group/world component, you may either highlight the + component and click on the Remove button, or set the component to only have the special Take - Ownership permission (displayed as "O" + Ownership permission (displayed as O ) highlighted. - Interaction with the standard Samba create mask - parameters + Interaction with the Standard Samba <quote>create mask</quote> Parameters - There are four parameters - to control interaction with the standard Samba create mask parameters. - These are : + There are four parameters that control interaction with the standard Samba create mask parameters. + These are: - security mask - force security mode - directory security mask - force directory security mode - + security mask + force security mode + directory security mask + force directory security mode + - Once a user clicks OK to apply the - permissions Samba maps the given permissions into a user/group/world - r/w/x triplet set, and then will check the changed permissions for a + Once a user clicks on OK to apply the + permissions, Samba maps the given permissions into a user/group/world + r/w/x triplet set, and then checks the changed permissions for a file against the bits set in the security mask parameter. Any bits that - were changed that are not set to '1' in this parameter are left alone + were changed that are not set to 1 in this parameter are left alone in the file permissions. Essentially, zero bits in the security mask - mask may be treated as a set of bits the user is not + may be treated as a set of bits the user is not allowed to change, and one bits are those the user is allowed to change. - If not set explicitly this parameter is set to the same value as - the create mask parameter. To allow a user to modify all the - user/group/world permissions on a file, set this parameter - to 0777. + If not explicitly set, this parameter defaults to the same value as + the create mask parameter. To allow a user to modify all the + user/group/world permissions on a file, set this parameter to 0777. + - Next Samba checks the changed permissions for a file against - the bits set in the + Next Samba checks the changed permissions for a file against the bits set in the force security mode parameter. Any bits - that were changed that correspond to bits set to '1' in this parameter + that were changed that correspond to bits set to 1 in this parameter are forced to be set. - Essentially, bits set in the force security mode - parameter may be treated as a set of bits that, when - modifying security on a file, the user has always set to be 'on'. + Essentially, bits set in the force security mode parameter + may be treated as a set of bits that, when modifying security on a file, the user has always set to be on. - If not set explicitly this parameter is set to the same value - as the force create mode parameter. + If not explicitly set, this parameter defaults to the same value + as the force create mode parameter. To allow a user to modify all the user/group/world permissions on a file - with no restrictions set this parameter to 000. - - The security mask and force + with no restrictions set this parameter to 000. The + security mask and force security mode parameters are applied to the change request in that order. - For a directory Samba will perform the same operations as - described above for a file except using the parameter + For a directory, Samba will perform the same operations as + described above for a file except it uses the parameter directory security mask instead of security mask, and force directory security mode parameter instead of force security mode @@ -1062,16 +1080,15 @@ Before using any of the following options please refer to the man page for &smb. by default is set to the same value as the directory mask parameter and the force directory security mode parameter by default is set to the same value as - the force directory mode parameter. - - In this way Samba enforces the permission restrictions that - an administrator can set on a Samba share, whilst still allowing users + the force directory mode parameter. + In this way Samba enforces the permission restrictions that + an administrator can set on a Samba share, while still allowing users to modify the permission bits within that restriction. If you want to set up a share that allows users full control in modifying the permission bits on their files and directories and - doesn't force any particular bits to be set 'on', then set the following - parameters in the &smb.conf; file in that share specific section : + does not force any particular bits to be set on, then set the following + parameters in the &smb.conf; file in that share-specific section: @@ -1083,29 +1100,29 @@ Before using any of the following options please refer to the man page for &smb. - Interaction with the standard Samba file attribute mapping + Interaction with the Standard Samba File Attribute Mapping - Samba maps some of the DOS attribute bits (such as "read - only") into the UNIX permissions of a file. This means there can + Samba maps some of the DOS attribute bits (such as read + only) into the UNIX permissions of a file. This means there can be a conflict between the permission bits set via the security dialog and the permission bits set by the file attribute mapping. - One way this can show up is if a file has no UNIX read access - for the owner it will show up as "read only" in the standard - file attributes tabbed dialog. Unfortunately this dialog is - the same one that contains the security info in another tab. + If a file has no UNIX read access for the owner, it will show up + as read only in the standard file attributes tabbed dialog. + Unfortunately, this dialog is the same one that contains the security information + in another tab. What this can mean is that if the owner changes the permissions - to allow themselves read access using the security dialog, clicks + to allow himself read access using the security dialog, clicks on OK to get back to the standard attributes tab - dialog, and then clicks OK on that dialog, then + dialog, and clicks on OK on that dialog, then NT will set the file permissions back to read-only (as that is what the attributes still say in the dialog). This means that after setting - permissions and clicking OK to get back to the - attributes dialog you should always hit Cancel + permissions and clicking on OK to get back to the + attributes dialog, you should always press Cancel rather than OK to ensure that your changes are not overridden. @@ -1115,31 +1132,31 @@ Before using any of the following options please refer to the man page for &smb. Common Errors -File, Directory and Share access problems are very common on the mailing list. The following +File, directory and share access problems are common on the mailing list. The following are examples taken from the mailing list in recent times. - Users can not write to a public share + Users Cannot Write to a Public Share - We are facing some troubles with file / directory permissions. I can log on the domain as admin user(root), - and there's a public share, on which everyone needs to have permission to create / modify files, but only - root can change the file, no one else can. We need to constantly go to server to + We are facing some troubles with file/directory permissions. I can log on the domain as admin user(root), + and there's a public share on which everyone needs to have permission to create/modify files, but only + root can change the file, no one else can. We need to constantly go to the server to chgrp -R users * and chown -R nobody * to allow others users to change the file. - There are many ways to solve this problem, here are a few hints: + There are many ways to solve this problem and here are a few hints: - Go to the top of the directory that is shared + Go to the top of the directory that is shared. @@ -1155,7 +1172,7 @@ are examples taken from the mailing list in recent times. - The above will set the 'sticky bit' on all directories. Read your + The above will set the sticky bit on all directories. Read your UNIX/Linux man page on what that does. It causes the OS to assign to all files created in the directories the ownership of the directory. @@ -1170,16 +1187,16 @@ are examples taken from the mailing list in recent times. - + This is the same as doing: &prompt;chown jack /foodbar &prompt;chgrp engr /foodbar - + - Now do: + Now type: &prompt;chmod 6775 /foodbar @@ -1196,7 +1213,7 @@ drwsrwsr-x 2 jack engr 48 2003-02-04 09:55 foodbar - Now do: + Now type: &prompt;su - jill &prompt;cd /foodbar @@ -1224,8 +1241,8 @@ drwsrwsr-x 2 jack engr 48 2003-02-04 09:55 foodbar - The above are only needed if your users are not members of the group - you have used. ie: Within the OS do not have write permission on the directory. + These procedures are needed only if your users are not members of the group + you have used. That is if within the OS do not have write permission on the directory. @@ -1242,34 +1259,35 @@ drwsrwsr-x 2 jack engr 48 2003-02-04 09:55 foodbar - I have set force user but Samba still makes <emphasis>root</emphasis> the owner of all the files I touch! + File Operations Done as <emphasis>root</emphasis> with <emphasis>force user</emphasis> Set + - When you have a user in admin users, samba will always do file operations for - this user as root, even if force user has been set. + When you have a user in admin users, Samba will always do file operations for + this user as root, even if force user has been set. - MS Word with Samba changes owner of file + MS Word with Samba Changes Owner of File - Question: When userB saves a word document that is owned by userA the updated file is now owned by userB. + Question: When user B saves a word document that is owned by user A the updated file is now owned by user B. Why is Samba doing this? How do I fix this? - Answer: Word does the following when you modify/change a Word document: Word Creates a NEW document with + Answer: Word does the following when you modify/change a Word document: MS Word creates a NEW document with a temporary name, Word then closes the old document and deletes it, Word then renames the new document to the original document name. - There is NO mechanism by which Samba CAN IN ANY WAY know that the new document really should be owned by the owners - of the original file. Samba has no way of knowing that the file will be renamed by MS Word. As far as Samba is able + There is no mechanism by which Samba can in any way know that the new document really should be owned by the owners + of the original file. Samba has no way of knowing that the file will be renamed by MS Word. As far as Samba is able to tell, the file that gets created is a NEW file, not one that the application (Word) is updating. There is a work-around to solve the permissions problem. That work-around involves understanding how you can manage file - system behaviour from within the &smb.conf; file, as well as understanding how Unix file systems work. Set on the directory - in which you are changing word documents: chmod g+s 'directory_name' This ensures that all files will - be created with the group that owns the directory. In smb.conf share declaration section set: + system behavior from within the &smb.conf; file, as well as understanding how UNIX file systems work. Set on the directory + in which you are changing Word documents: chmod g+s `directory_name' This ensures that all files will + be created with the group that owns the directory. In &smb.conf; share declaration section set: diff --git a/docs/docbook/projdoc/AdvancedNetworkAdmin.xml b/docs/docbook/projdoc/AdvancedNetworkAdmin.xml index ee1f351e41..65d50b496e 100644 --- a/docs/docbook/projdoc/AdvancedNetworkAdmin.xml +++ b/docs/docbook/projdoc/AdvancedNetworkAdmin.xml @@ -9,7 +9,7 @@ This section documents peripheral issues that are of great importance to network administrators who want to improve network resource access control, to automate the user -environment, and to make their lives a little easier. +environment and to make their lives a little easier. @@ -17,15 +17,16 @@ environment, and to make their lives a little easier. Often the difference between a working network environment and a well appreciated one can -best be measured by the little things that makes everything work more -harmoniously. A key part of every network environment solution is the ability to remotely -manage MS Windows workstations, to remotely access the Samba server, to provide customised -logon scripts, as well as other house keeping activities that help to sustain more reliable +best be measured by the little things that make everything work more +harmoniously. A key part of every network environment solution is the +ability to remotely +manage MS Windows workstations, remotely access the Samba server, provide customized +logon scripts, as well as other housekeeping activities that help to sustain more reliable network operations. -This chapter presents information on each of these area. They are placed here, and not in +This chapter presents information on each of these areas. They are placed here, and not in other chapters, for ease of reference. @@ -34,35 +35,37 @@ other chapters, for ease of reference. Remote Server Administration - -How do I get 'User Manager' and 'Server Manager'? - + +How do I get `User Manager' and `Server Manager'? - Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains', -the 'Server Manager'? +User Manager +Server Manager +Event Viewer +Since I do not need to buy an NT4 Server, how do I get the `User Manager for Domains' +and the `Server Manager'? -Microsoft distributes a version of these tools called nexus for installation -on Windows 9x / Me systems. The tools set includes: +Nexus.exe +Microsoft distributes a version of these tools called Nexus.exe for installation +on Windows 9x/Me systems. The tools set includes: - - Server Manager - User Manager for Domains - Event Viewer - + + Server Manager + User Manager for Domains + Event Viewer + -Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE +Download the archived file at ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE. -The Windows NT 4.0 version of the 'User Manager for -Domains' and 'Server Manager' are available from Microsoft via ftp -from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE +SRVTOOLS.EXE +The Windows NT 4.0 version of the `User Manager for +Domains' and `Server Manager' are available from Microsoft via ftp. @@ -72,87 +75,83 @@ from ftp://ft There are a number of possible remote desktop management solutions that range from free -through costly. Do not let that put you off. Sometimes the most costly solutions is the +through costly. Do not let that put you off. Sometimes the most costly solution is the most cost effective. In any case, you will need to draw your own conclusions as to which is the best tool in your network environment. - Remote Management from NoMachines.Com + Remote Management from NoMachine.Com + NoMachine.Com The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003. It is presented in slightly edited form (with author details omitted for privacy reasons). The entire answer is reproduced below with some comments removed. - - -> I have a wonderful linux/samba server running as PDC for a network. -> Now I would like to add remote desktop capabilities so that -> users outside could login to the system and get their desktop up from -> home or another country.. -> -> Is there a way to accomplish this? Do I need a windows terminal server? -> Do I need to configure it so that it is a member of the domain or a -> BDC,PDC? Are there any hacks for MS Windows XP to enable remote login -> even if the computer is in a domain? -> -> Any ideas/experience would be appreciated :) - - + + I have a wonderful Linux/Samba server running as pdc for a network. Now I would like to add remote + desktop capabilities so users outside could login to the system and get their desktop up from home or + another country. + - - Answer provided: Check out the new offer from NoMachine, "NX" software: - http://www.nomachine.com/. - + + Is there a way to accomplish this? Do I need a Windows Terminal Server? Do I need to configure it so + it is a member of the domain or a BDC,PDC? Are there any hacks for MS Windows XP to enable remote login + even if the computer is in a domain? + + + + Answer provided: Check out the new offer from NoMachine, NX software: + http://www.nomachine.com/. + - It implements a very easy-to-use interface to the remote X protocol as + It implements an easy-to-use interface to the Remote X protocol as well as incorporating VNC/RFB and rdesktop/RDP into it, but at a speed - performance much better than anything you may have ever seen... + performance much better than anything you may have ever seen. - Remote X is not new at all -- but what they did achieve successfully is - a new way of compression and caching technologies which makes the thing + Remote X is not new at all, but what they did achieve successfully is + a new way of compression and caching technologies that makes the thing fast enough to run even over slow modem/ISDN connections. - I could test drive their (public) RedHat machine in Italy, over a loaded - internet connection, with enabled thumbnail previews in KDE konqueror - which popped up immediately on "mouse-over". From inside that (remote X) + I could test drive their (public) Red Hat machine in Italy, over a loaded + Internet connection, with enabled thumbnail previews in KDE konqueror + which popped up immediately on mouse-over. From inside that (remote X) session I started a rdesktop session on another, a Windows XP machine. - To test the performance, I played Pinball. I am proud to announce here - that my score was 631750 points at first try... + To test the performance, I played Pinball. I am proud to announce + that my score was 631750 points at first try. - NX performs better on my local LAN than any of the other "pure" + NX performs better on my local LAN than any of the other pure connection methods I am using from time to time: TightVNC, rdesktop or - remote X. It is even faster than a direct crosslink connection between + Remote X. It is even faster than a direct crosslink connection between two nodes. - I even got sound playing from the remote X app to my local boxes, and - had a working "copy'n'paste" from an NX window (running a KDE session - in Italy) to my Mozilla mailing agent... These guys are certainly doing + I even got sound playing from the Remote X app to my local boxes, and + had a working copy'n'paste from an NX window (running a KDE session + in Italy) to my Mozilla mailing agent. These guys are certainly doing something right! - I recommend to test drive NX to anybody with a only a remote interest - in remote computing - http://www.nomachine.com/testdrive.php. + I recommend to test drive NX to anybody with a only a passing interest in remote computing + http://www.nomachine.com/testdrive.php. - Just download the free of charge client software (available for RedHat, - SuSE, Debian and Windows) and be up and running within 5 minutes (they + Just download the free of charge client software (available for Red Hat, + SuSE, Debian and Windows) and be up and running within five minutes (they need to send you your account data, though, because you are assigned - a real Unix account on their testdrive.nomachine.com box... + a real UNIX account on their testdrive.nomachine.com box. @@ -160,17 +159,17 @@ is the best tool in your network environment. running as a cluster of nodes, and users simply start an NX session locally, and can select applications to run transparently (apps may even run on another NX node, but pretend to be on the same as used for initial login, - because it displays in the same window.... well, you also can run it + because it displays in the same window. You also can run it fullscreen, and after a short time you forget that it is a remote session at all). - Now the best thing at the end: all the core compression and caching + Now the best thing for last: All the core compression and caching technologies are released under the GPL and available as source code to anybody who wants to build on it! These technologies are working, albeit started from the command line only (and very inconvenient to - use in order to get a fully running remote X session up and running....) + use in order to get a fully running remote X session up and running.) @@ -179,32 +178,32 @@ is the best tool in your network environment. - You don't need to install a terminal server; XP has RDP support built in. + You do not need to install a terminal server; XP has RDP support built in. - NX is much cheaper than Citrix -- and comparable in performance, probably faster + NX is much cheaper than Citrix &smbmdash; and comparable in performance, probably faster. - You don't need to hack XP -- it just works + You do not need to hack XP &smbmdash; it just works. You log into the XP box from remote transparently (and I think there is no - need to change anything to get a connection, even if authentication is against a domain) + need to change anything to get a connection, even if authentication is against a domain). - The NX core technologies are all Open Source and released under the GPL -- - you can today use a (very inconvenient) commandline to use it at no cost, - but you can buy a comfortable (proprietary) NX GUI frontend for money + The NX core technologies are all Open Source and released under the GPL &smbmdash; + you can now use a (very inconvenient) commandline at no cost, + but you can buy a comfortable (proprietary) NX GUI frontend for money. NoMachine are encouraging and offering help to OSS/Free Software implementations for such a frontend too, even if it means competition to them (they have written - to this effect even to the LTSP, KDE and GNOME developer mailing lists) + to this effect even to the LTSP, KDE and GNOME developer mailing lists). @@ -215,23 +214,18 @@ is the best tool in your network environment. Network Logon Script Magic - -This section needs work. Volunteer contributions most welcome. Please send your patches or updates -to John Terpstra. - - There are several opportunities for creating a custom network startup configuration environment. - - No Logon Script - Simple universal Logon Script that applies to all users - Use of a conditional Logon Script that applies per user or per group attributes - Use of Samba's Preexec and Postexec functions on access to the NETLOGON share to create - a custom Logon Script and then execute it. - User of a tool such as KixStart - + + No Logon Script. + Simple universal Logon Script that applies to all users. + Use of a conditional Logon Script that applies per user or per group attributes. + Use of Samba's preexec and postexec functions on access to the NETLOGON share to create + a custom logon script and then execute it. + User of a tool such as KixStart. + The Samba source code tree includes two logon script generation/execution tools. @@ -243,7 +237,9 @@ See examples directory genlogon and The following listings are from the genlogon directory. + +genlogon.pl This is the genlogon.pl file: @@ -252,8 +248,8 @@ This is the genlogon.pl file: # genlogon.pl # # Perl script to generate user logon scripts on the fly, when users - # connect from a Windows client. This script should be called from smb.conf - # with the %U, %G and %L parameters. I.e: + # connect from a Windows client. This script should be called from + # smb.conf with the %U, %G and %L parameters. I.e: # # root preexec = genlogon.pl %U %G %L # @@ -274,7 +270,8 @@ This is the genlogon.pl file: #($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time); ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time); open LOG, ">>/var/log/samba/netlogon.log"; - print LOG "$mon/$mday/$year $hour:$min:$sec - User $ARGV[0] logged into $ARGV[1]\n"; + print LOG "$mon/$mday/$year $hour:$min:$sec"; + print LOG " - User $ARGV[0] logged into $ARGV[1]\n"; close LOG; # Start generating logon script @@ -300,7 +297,7 @@ This is the genlogon.pl file: print LOGON "NET USE K: \\\\$ARGV[2]\\MKTING\r\n"; } - # Now connect Printers. We handle just two or three users a little + # Now connect Printers. We handle just two or three users a little # differently, because they are the exceptions that have desktop # printers on LPT1: - all other user's go to the LaserJet on the # server. @@ -322,40 +319,30 @@ This is the genlogon.pl file: -Those wishing to use more elaborate or capable logon processing system should check out the following sites: +Those wishing to use more elaborate or capable logon processing system should check out these sites: - - http://www.craigelachie.org/rhacer/ntlogon - http://www.kixtart.org - http://support.microsoft.com/default.asp?scid=kb;en-us;189105 - + + http://www.craigelachi.e.org/rhacer/ntlogon + http://www.kixtart.org + -Adding printers without user intervention +Adding Printers without User Intervention + +rundll32 Printers may be added automatically during logon script processing through the use of: - - rundll32 printui.dll,PrintUIEntry /? - + +&dosprompt;rundll32 printui.dll,PrintUIEntry /? + -See the documentation in the Microsoft knowledgebase article no: 189105. +See the documentation in the Microsoft knowledgebase article 189105. - -Common Errors - - -The information provided in this chapter has been reproduced from postings on the samba@samba.org -mailing list. No implied endorsement or recommendation is offered. Administrators should conduct -their own evaluation of alternatives and are encouraged to draw their own conclusions. - - - - diff --git a/docs/docbook/projdoc/Bugs.xml b/docs/docbook/projdoc/Bugs.xml index 0688e23cf3..15bd14ac1a 100644 --- a/docs/docbook/projdoc/Bugs.xml +++ b/docs/docbook/projdoc/Bugs.xml @@ -1,8 +1,9 @@ + &author.jht; &author.jelmer; - &author.tridge; + &author.tridge; 27 June 1997 @@ -11,79 +12,76 @@ Introduction -Please report bugs using - bugzilla. - - -Please take the time to read this file before you submit a bug -report. Also, please see if it has changed between releases, as we -may be changing the bug reporting mechanism at some time. +Please report bugs using Samba's +Bugzilla facilities and +take the time to read this file before you submit a bug +report. Also, check to see if it has changed between releases, as we +may be changing the bug reporting mechanism at some point. -Please also do as much as you can yourself to help track down the +Please do as much as you can yourself to help track down the bug. Samba is maintained by a dedicated group of people who volunteer -their time, skills and efforts. We receive far more mail about it than -we can possibly answer, so you have a much higher chance of an answer -and a fix if you send us a "developer friendly" bug report that lets +their time, skills and efforts. We receive far more mail than +we can possibly answer, so you have a much higher chance of a response +and a fix if you send us a developer friendly bug report that lets us fix it fast. Do not assume that if you post the bug to the comp.protocols.smb newsgroup or the mailing list that we will read it. If you suspect that your -problem is not a bug but a configuration problem then it is better to send -it to the Samba mailing list, as there are (at last count) 5000 other users on -that list that may be able to help you. +problem is not a bug but a configuration problem, it is better to send +it to the Samba mailing list, as there are thousands of other users on +that list who may be able to help you. You may also like to look though the recent mailing list archives, -which are conveniently accessible on the Samba web pages +which are conveniently accessible on the Samba Web pages at http://samba.org/samba/. -General info +General Information -Before submitting a bug report check your config for silly -errors. Look in your log files for obvious messages that tell you that -you've misconfigured something and run testparm to test your config +Before submitting a bug report, check your config for silly +errors. Look in your log files for obvious messages that tell +you've misconfigured something. Run testparm to check your config file for correct syntax. -Have you run through the diagnosis? -This is very important. +Have you looked through ? This is extremely important. -If you include part of a log file with your bug report then be sure to +If you include part of a log file with your bug report, then be sure to annotate it with exactly what you were doing on the client at the -time, and exactly what the results were. +time and exactly what the results were. -Debug levels +Debug Levels If the bug has anything to do with Samba behaving incorrectly as a -server (like refusing to open a file) then the log files will probably -be very useful. Depending on the problem a log level of between 3 and +server (like refusing to open a file), then the log files will probably +be quite useful. Depending on the problem, a log level of between 3 and 10 showing the problem may be appropriate. A higher level gives more detail, but may use too much disk space. -To set the debug level use the log level in your +To set the debug level, use the log level in your &smb.conf;. You may also find it useful to set the log level higher for just one machine and keep separate logs for each machine. -To do this add the following lines to your main &smb.conf; file: +To do this, add the following lines to your main &smb.conf; file: @@ -93,47 +91,46 @@ To do this add the following lines to your main &smb.conf; file: -then create a file -/usr/local/samba/lib/smb.conf.machine where +and create a file /usr/local/samba/lib/smb.conf.machine where machine is the name of the client you wish to debug. In that file put any &smb.conf; commands you want, for example log level may be useful. This also allows you to -experiment with different security systems, protocol levels etc on just +experiment with different security systems, protocol levels and so on, on just one machine. The &smb.conf; entry log level is synonymous with the parameter debuglevel that has -been used in older versions of Samba and is being retained for backwards +been used in older versions of Samba and is being retained for backward compatibility of &smb.conf; files. -As the log level value is increased you will record -a significantly increasing level of debugging information. For most -debugging operations you may not need a setting higher than +As the log level value is increased, you will record +a significantly greater level of debugging information. For most +debugging operations, you may not need a setting higher than 3. Nearly all bugs can be tracked at a setting of 10, but be -prepared for a VERY large volume of log data. +prepared for a large volume of log data. -Internal errors +Internal Errors -If you get a INTERNAL ERROR message in your log files +If you get the message INTERNAL ERROR in your log files, it means that Samba got an unexpected signal while running. It is probably a segmentation fault and almost certainly means a bug in Samba (unless you have faulty hardware or system software). -If the message came from smbd then it will probably be accompanied by -a message which details the last SMB message received by smbd. This -info is often very useful in tracking down the problem so please +If the message came from smbd, it will probably be accompanied by +a message that details the last SMB message received by smbd. This +information is often useful in tracking down the problem so please include it in your bug report. @@ -142,17 +139,17 @@ You should also detail how to reproduce the problem, if possible. Please make this reasonably detailed. -core files +core files You may also find that a core file appeared in a corefiles -subdirectory of the directory where you keep your samba log +subdirectory of the directory where you keep your Samba log files. This file is the most useful tool for tracking down the bug. To -use it you do this: - - +use it, you do this: gdb debug + + &prompt;gdb smbd core @@ -160,29 +157,28 @@ use it you do this: adding appropriate paths to smbd and core so gdb can find them. If you -don't have gdb then try dbx. Then within the debugger +do not have gdb, try dbx. Then within the debugger, use the command where to give a stack trace of where the problem occurred. Include this in your report. -If you know any assembly language then do a -disass of the routine -where the problem occurred (if its in a library routine then +If you know any assembly language, do a disass of the routine +where the problem occurred (if its in a library routine, then disassemble the routine that called it) and try to work out exactly where the problem is by looking at the surrounding code. Even if you -don't know assembly, including this info in the bug report can be +do not know assembly, including this information in the bug report can be useful. -Attaching to a running process +Attaching to a Running Process -Unfortunately some unixes (in particular some recent linux kernels) +Unfortunately, some UNIXes (in particular some recent Linux kernels) refuse to dump a core file if the task has changed uid (which smbd -does often). To debug with this sort of system you could try to attach +does often). To debug with this sort of system, you could try to attach to the running process using gdb smbd PID where you get PID from smbstatus. @@ -196,12 +192,12 @@ where it occurred. Patches -diff -patch +diff +patch The best sort of bug report is one that includes a fix! If you send us -patches please use diff -u format if your version of +patches, please use diff -u format if your version of diff supports it, otherwise use diff -c4. Make sure you do the diff against a clean version of the source and let me know exactly what version you used. diff --git a/docs/docbook/projdoc/CUPS-printing.xml b/docs/docbook/projdoc/CUPS-printing.xml index 945092d413..5a8e9f5846 100644 --- a/docs/docbook/projdoc/CUPS-printing.xml +++ b/docs/docbook/projdoc/CUPS-printing.xml @@ -22,7 +22,7 @@ (3 June 2003) -CUPS Printing Support in Samba 3.0 +CUPS Printing Support @@ -32,26 +32,25 @@ Features and Benefits - The Common UNIX Print System (CUPS) has become very popular. All - major Linux distributions now ship it as their default printing - system. To many it is still a very mystical tool. Mostly, it - "just works" (TM). People tend to regard it as a "black box" - which they don't want to look into, as long as it works. But once - there is a little problem, they are in trouble to find out where to - start debugging it. Refer to the "Classical Printing" chapter also, it - contains a lot of information that is relevant for CUPS. + The Common UNIX Print System (CUPS) + has become quite popular. All major Linux distributions now ship it as their default printing + system. To many, it is still a mystical tool. Mostly, it just works. + People tend to regard it as a black box + that they do not want to look into as long as it works. But once + there is a little problem, they are in trouble to find out where to + start debugging it. Refer to the chapter Classical Printing that + contains a lot of information that is relevant for CUPS. - CUPS sports quite a few unique and powerful features. While their - basic functions may be grasped quite easily, they are also - new. Because they are different from other, more traditional printing - systems, it is best to try and not apply any prior knowledge about - printing upon this new system. Rather, try to understand CUPS - from the beginning. This documentation will lead you to a - complete understanding of CUPS. Let's start with the most basic - things first. + CUPS sports quite a few unique and powerful features. While their + basic functions may be grasped quite easily, they are also + new. Because they are different from other, more traditional printing + systems, it is best not to try and apply any prior knowledge about + printing to this new system. Rather, try to understand CUPS + from the beginning. This documentation will lead you to a + complete understanding of CUPS. Let's start with the most basic + things first. @@ -60,65 +59,64 @@ Overview - CUPS is more than just a print spooling system. It is a complete - printer management system that complies with the new IPP - (Internet Printing Protocol). IPP is an industry - and IETF (Internet Engineering Task Force) - standard for network printing. Many of its functions can be managed - remotely (or locally) via a web browser (giving you a - platform-independent access to the CUPS print server). Additionally, it - has the traditional command line and several more modern GUI interfaces - (GUI interfaces developed by 3rd parties, like KDE's - overwhelming KDEPrint). + CUPS is more than just a print spooling system. It is a complete + printer management system that complies with the new + Internet Printing Protocol (IPP). IPP is an industry + and Internet Engineering Task Force (IETF) + standard for network printing. Many of its functions can be managed + remotely (or locally) via a Web browser (giving you a + platform-independent access to the CUPS print server). Additionally, it + has the traditional command line and several more modern GUI interfaces + (GUI interfaces developed by third parties, like KDE's + overwhelming KDEPrint). - CUPS allows creation of "raw" printers (ie: NO print file - format translation) as well as "smart" printers (i.e. CUPS does - file format conversion as required for the printer). In many ways - this gives CUPS similar capabilities to the MS Windows print - monitoring system. Of course, if you are a CUPS advocate, you would - argue that CUPS is better! In any case, let us now move on to - explore how one may configure CUPS for interfacing with MS Windows - print clients via Samba. + CUPS allows creation of raw printers (i.e., no print file + format translation) as well as smart printers (i.e., CUPS does + file format conversion as required for the printer). In many ways + this gives CUPS similar capabilities to the MS Windows print + monitoring system. Of course, if you are a CUPS advocate, you would + argue that CUPS is better! In any case, let us now move on to + explore how one may configure CUPS for interfacing with MS Windows + print clients via Samba. - Basic Configuration of CUPS support + Basic CUPS Support Configuration - Printing with CUPS in the most basic &smb.conf; setup in Samba 3.0 (as was true for 2.2.x) only needs two - settings: printingcups and - printcapcups. CUPS does not need a printcap file. - However, the cupsd.conf configuration file knows of two related directives that control - how such a file will be automatically created and maintained by CUPS for the convenience of third party - applications (example: Printcap /etc/printcap and PrintcapFormat BSD). - Legacy programs often require the existence of a printcap file containing printer names or they will refuse to - print. Make sure CUPS is set to generate and maintain a printcap file! For details see - man cupsd.conf and other CUPS-related documentation, like the wealth of documents on your CUPS server - itself: http://localhost:631/documentation.html. + Printing with CUPS in the most basic &smb.conf; setup in Samba-3.0 (as was true for 2.2.x) only needs two + settings: printingcups and + printcapcups. CUPS does not need a printcap file. + However, the cupsd.conf configuration file knows of two related directives that control + how such a file will be automatically created and maintained by CUPS for the convenience of third-party + applications (example: Printcap /etc/printcap and PrintcapFormat BSD). + Legacy programs often require the existence of a printcap file containing printer names or they will refuse to + print. Make sure CUPS is set to generate and maintain a printcap file. For details, see + man cupsd.conf and other CUPS-related documentation, like the wealth of documents on your CUPS server + itself: http://localhost:631/documentation.html. - Linking of smbd with libcups.so + Linking smbd with libcups.so - Samba has a very special relationship to CUPS. Samba can be compiled with CUPS library support. - Most recent installations have this support enabled. Per default CUPS linking is compiled - into smbd and other Samba binaries. Of course, you can use CUPS even - if Samba is not linked against libcups.so -- but - there are some differences in required or supported configuration - then. + Samba has a special relationship to CUPS. Samba can be compiled with CUPS library support. + Most recent installations have this support enabled. Per default, CUPS linking is compiled + into smbd and other Samba binaries. Of course, you can use CUPS even + if Samba is not linked against libcups.so &smbmdash; but + there are some differences in required or supported configuration. - When Samba is compiled against libcups, printcapcups - uses the CUPS API to list printers, submit jobs, query queues, etc. Otherwise it maps to the System V - commands with an additional -oraw option for printing. On a Linux - system, you can use the ldd utility to find out details (ldd may not be present on - other OS platforms, or its function may be embodied by a different command): + When Samba is compiled against libcups, printcapcups + uses the CUPS API to list printers, submit jobs, query queues, and so on. Otherwise it maps to the System V + commands with an additional -oraw option for printing. On a Linux + system, you can use the ldd utility to find out details (ldd may not be present on + other OS platforms, or its function may be embodied by a different command): @@ -130,32 +128,33 @@ libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) - The line libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) shows - there is CUPS support compiled into this version of Samba. If this is the case, and printing = cups - is set, then any otherwise manually set print command in &smb.conf; is ignored. - This is an important point to remember! + The line libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) shows + there is CUPS support compiled into this version of Samba. If this is the case, and printing = cups + is set, then any otherwise manually set print command in &smb.conf; is ignored. + This is an important point to remember! Should it be necessary, for any reason, to set your own print commands, you can do this by setting printingsysv. However, you will loose all the benefits of tight CUPS/Samba integration. When you do this you must manually configure the printing system commands - (most important: print command; other commands are - lppause command, - lpresume command, - lpq command, - lprm command, - queuepause command and - queue resume command). + (most important: + print command; other commands are + lppause command, + lpresume command, + lpq command, + lprm command, + queuepause command and + queue resume command). Simple &smb.conf; Settings for CUPS - To summarize, here is the simplest printing-related setup for &smb.conf; to enable basic CUPS support: + To summarize, shows simplest printing-related setup for &smb.conf; to enable basic CUPS support: - + Simplest printing-related smb.conf [global] load printersyes @@ -175,673 +174,673 @@ libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) - This is all you need for basic printing setup for CUPS. It will print - all Graphic, Text, PDF and PostScript file submitted from Windows - clients. However, most of your Windows users would not know how to - send these kind of files to print without opening a GUI - application. Windows clients tend to have local printer drivers - installed. And the GUI application's print buttons start a printer - driver. Your users also very rarely send files from the command - line. Unlike UNIX clients, they hardly submit graphic, text or PDF - formatted files directly to the spooler. They nearly exclusively print - from GUI applications, with a "printer driver" hooked in between the - applications native format and the print data stream. If the backend - printer is not a PostScript device, the print data stream is "binary", - sensible only for the target printer. Read on to learn which problem - this may cause and how to avoid it. + This is all you need for basic printing setup for CUPS. It will print + all graphic, text, PDF, and PostScript files submitted from Windows + clients. However, most of your Windows users would not know how to + send these kinds of files to print without opening a GUI + application. Windows clients tend to have local printer drivers + installed, and the GUI application's print buttons start a printer + driver. Your users also rarely send files from the command + line. Unlike UNIX clients, they hardly submit graphic, text or PDF + formatted files directly to the spooler. They nearly exclusively print + from GUI applications with a printer driver hooked in between the + application's native format and the print-data-stream. If the backend + printer is not a PostScript device, the print data stream is binary, + sensible only for the target printer. Read on to learn which problem + this may cause and how to avoid it. - -More complex &smb.conf; Settings for -CUPS + + More Complex CUPS &smb.conf; Settings - -Here is a slightly more complex printing-related setup -for &smb.conf;. It enables general CUPS printing -support for all printers, but defines one printer share which is set -up differently. - + + is a slightly more complex printing-related setup + for &smb.conf;. It enables general CUPS printing + support for all printers, but defines one printer share, which is set + up differently. + - -Overriding global CUPS settings for one printer -[global] -printingcups -printcap namecups -load printersyes + + Overriding global CUPS settings for one printer + [global] + printingcups + printcap namecups + load printersyes + + [printers] + commentAll Printers + path/var/spool/samba + publicyes + guest okyes + writableno + printableyes + printer adminroot, @ntadmins + + [special_printer] + commentA special printer with his own settings + path/var/spool/samba-special + printingsysv + printcaplpstat + print commandecho "NEW: `date`: printfile %f" >> /tmp/smbprn.log ; \ + echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; \ + echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log : rm %f + publicno + guest okno + writeableno + printableyes + printer adminkurt + hosts deny0.0.0.0 + hosts allowturbo_xp, 10.160.50.23, 10.160.51.60 + -[printers] -commentAll Printers -path/var/spool/samba -publicyes -guest okyes -writableno -printableyes -printer adminroot, @ntadmins - -[special_printer] -commentA special printer with his own settings -path/var/spool/samba-special -printingsysv -printcaplpstat -print commandecho "NEW: `date`: printfile %f" >> /tmp/smbprn.log ; \ -echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; \ -echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log : rm %f -publicno -guest okno -writeableno -printableyes -printer adminkurt -hosts deny0.0.0.0 -hosts allowturbo_xp, 10.160.50.23, 10.160.51.60 - - - -This special share is only there for testing purposes. It does not write the print job to a file. It just logs the job parameters -known to Samba into the /tmp/smbprn.log file and deletes the jobfile. Moreover, the -printer admin of this share is "kurt" (not the "@ntadmins" group); -guest access is not allowed; the share isn not published to the Network Neighbourhood (so you need to know it is there), and it only -allows access from only three hosts. To prevent CUPS kicking in and taking over the print jobs for that share, we need to set -printingsysv and -printcaplpstat. - - + + This special share is only there for testing purposes. It does not write the print job to a file. It just logs the job parameters + known to Samba into the /tmp/smbprn.log file and deletes the jobfile. Moreover, the + printer admin of this share is kurt (not the @ntadmins group), + guest access is not allowed, the share isn't published to the Network Neighborhood (so you need to know it is there), and it only + allows access from only three hosts. To prevent CUPS kicking in and taking over the print jobs for that share, we need to set + printingsysv and + printcaplpstat. + + -Advanced Configuration + Advanced Configuration - -Before we delve into all the configuration options, let us clarify a few -points. Network printing needs to be organized and setup -correctly. Often this is not done correctly. Legacy systems -or small business LAN environments often lack design and good housekeeping. - + + Before we delve into all the configuration options, let us clarify a few + points. Network printing needs to be organized and setup + correctly. This frequently doesn't happen. Legacy systems + or small business LAN environments often lack design and good housekeeping. + - -Central spooling vs. "Peer-to-Peer" printing + + Central Spooling vs. <quote>Peer-to-Peer</quote> Printing + + spoolingcentral spoolingpeer-to-peer + Many small office or home networks, as well as badly organized larger + environments, allow each client a direct access to available network + printers. This is generally a bad idea. It often blocks one client's + access to the printer when another client's job is printing. It might + freeze the first client's application while it is waiting to get + rid of the job. Also, there are frequent complaints about various jobs + being printed with their pages mixed with each other. A better concept + is the usage of a print server: it routes all jobs through one + central system, which responds immediately, takes jobs from multiple + concurrent clients at the same time, and in turn transfers them to the + printer(s) in the correct order. + + - -Many small office or home networks, as well as badly organized larger -environments, allow each client a direct access to available network -printers. This is generally a bad idea. It often blocks one client's -access to the printer when another client's job is printing. It also -might freeze the first client's application while it is waiting to get -rid of the job. Also, there are frequent complaints about various jobs -being printed with their pages mixed with each other. A better concept -is the usage of a "print server": it routes all jobs through one -central system, which responds immediately, takes jobs from multiple -concurrent clients at the same time and in turn transfers them to the -printer(s) in the correct order. - - + + Raw Print Serving &smbmdash; Vendor Drivers on Windows Clients - -CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients -spooling-only -"raw" printing + + spooling-only + "raw" printing + Most traditionally configured UNIX print servers acting on behalf of + Samba's Windows clients represented a really simple setup. Their only + task was to manage the raw spooling of all jobs handed to them by + Samba. This approach meant that the Windows clients were expected to + prepare the print job file that its ready to be sent to the printing + device. Here is a native (vendor-supplied) Windows printer + driver for the target device needed to be installed on each and every + client. + - -Most traditionally configured UNIX print servers acting on behalf of -Samba's Windows clients represented a really simple setup. Their only -task was to manage the "raw" spooling of all jobs handed to them by -Samba. This approach meant that the Windows clients were expected to -prepare the print job file that it s ready to be sent to the printing -device. Here a native (vendor-supplied) Windows printer -driver for the target device needed to be installed on each and every -client. - + + It is possible to configure CUPS, Samba and your Windows clients in the + same traditional and simple way. When CUPS printers are configured + for RAW print-through mode operation, it is the responsibility of the + Samba client to fully render the print job (file). The file must be + sent in a format that is suitable for direct delivery to the + printer. Clients need to run the vendor-provided drivers to do + this. In this case, CUPS will not do any print file format conversion + work. + + - -It is possible to configure CUPS, Samba and your Windows clients in the -same, traditional and simple way. When CUPS printers are configured -for RAW print-through mode operation it is the responsibility of the -Samba client to fully render the print job (file). The file must be -sent in a format that is suitable for direct delivery to the -printer. Clients need to run the vendor-provided drivers to do -this. In this case CUPS will NOT do any print file format conversion -work. - - + + Installation of Windows Client Drivers - -Driver Installation Methods on Windows Clients + + The printer drivers on the Windows clients may be installed + in two functionally different ways: + - -The printer drivers on the Windows clients may be installed -in two functionally different ways: - + + Manually install the drivers locally on each client, + one by one; this yields the old LanMan style + printing and uses a \\sambaserver\printershare + type of connection. - -manually install the drivers locally on each client, -one by one; this yields the old LanMan style -printing; it uses a \\sambaserver\printershare -type of connection. + + point 'n' print + Deposit and prepare the drivers (for later download) on + the print server (Samba); this enables the clients to use + Point'n'Print to get drivers semi-automatically installed the + first time they access the printer; with this method NT/200x/XP + clients use the SPOOLSS/MS-RPC + type printing calls. + - -point and print - deposit and prepare the drivers (for later download) on -the print server (Samba); this enables the clients to use -"Point and Print" to get drivers semi-automatically installed the -first time they access the printer; with this method NT/2K/XP -clients use the SPOOLSS/MS-RPC -type printing calls. - + + The second method is recommended for use over the first. + + - -The second method is recommended for use over the first. - - + + Explicitly Enable <quote>raw</quote> Printing for <emphasis>application/octet-stream</emphasis> - -Explicitly enable "raw" printing for -<emphasis>application/octet-stream</emphasis>! -application/octet-stream + + application/octet-stream + raw printing + MIMEraw + If you use the first option (drivers are installed on the client + side), there is one setting to take care of: CUPS needs to be told + that it should allow raw printing of deliberate (binary) file + formats. The CUPS files that need to be correctly set for RAW mode + printers to work are: + - -If you use the first option (drivers are installed on the client -side), there is one setting to take care of: CUPS needs to be told -that it should allow "raw" printing of deliberate (binary) file -formats. The CUPS files that need to be correctly set for RAW mode -printers to work are: - + + /etc/cups/mime.types + /etc/cups/mime.convs + - -/etc/cups/mime.types - + + Both contain entries (at the end of the respective files) which must + be uncommented to allow RAW mode operation. + In /etc/cups/mime.types, make sure this line is + present: -/etc/cups/mime.convs - + + application/octet-stream + - -Both contain entries (at the end of the respective files) which must -be uncommented to allow RAW mode operation. -In/etc/cups/mime.types make sure this line is -present: - + /etc/cups/mime.convs + /etc/cups/mime.types - - application/octet-stream - + In /etc/cups/mime.convs, + have this line: - -In /etc/cups/mime.convs, -have this line: - + application/vnd.cups-raw -application/vnd.cups-raw + + application/octet-stream application/vnd.cups-raw 0 - + - - application/octet-stream application/vnd.cups-raw 0 - - + If these two files are not set up correctly for raw Windows client + printing, you may encounter the dreaded Unable to + convert file 0 in your CUPS error_log file. + - -If these two files are not set up correctly for raw Windows client -printing, you may encounter the dreaded Unable to -convert file 0 in your CUPS error_log file. - + Editing the mime.convs and the + mime.types file does not + enforce raw printing, it only + allows it. + -editing the mime.convs and the -mime.types file does not -enforce "raw" printing, it only -allows it. - + Background -Background -application/octet-stream + + application/octet-stream + CUPS being a more security-aware printing system than traditional ones + does not by default allow a user to send deliberate (possibly binary) + data to printing devices. This could be easily abused to launch a + Denial of Service attack on your printer(s), causing at least + the loss of a lot of paper and ink. Unknown data are tagged by CUPS + as MIME type: application/octet-stream and not + allowed to go to the printer. By default, you can only send other + (known) MIME types raw. Sending data raw means that CUPS does not + try to convert them and passes them to the printer untouched (see the next + chapter for even more background explanations). + + - -CUPS being a more security-aware printing system than traditional ones -does not by default allow a user to send deliberate (possibly binary) -data to printing devices. This could be easily abused to launch a -"Denial of Service" attack on your printer(s), causing at the least -the loss of a lot of paper and ink. "Unknown" data are tagged by CUPS -as MIME type: application/octet-stream and not -allowed to go to the printer. By default, you can only send other -(known) MIME types "raw". Sending data "raw" means that CUPS does not -try to convert them and passes them to the printer untouched (see next -chapter for even more background explanations). - - + + This is all you need to know to get the CUPS/Samba combo printing + raw files prepared by Windows clients, which have vendor drivers + locally installed. If you are not interested in background information about + more advanced CUPS/Samba printing, simply skip the remaining sections + of this chapter. + + - -This is all you need to know to get the CUPS/Samba combo printing -"raw" files prepared by Windows clients, which have vendor drivers -locally installed. If you are not interested in background information about -more advanced CUPS/Samba printing, simply skip the remaining sections -of this chapter. - - + + Driver Upload Methods - -Three familiar Methods for driver upload plus a new one + + This section describes three familiar methods, plus one new one, by which + printer drivers may be uploaded. + -point and print + + point 'n' print + If you want to use the MS-RPC type printing, you must upload the + drivers onto the Samba server first ([print$] + share). For a discussion on how to deposit printer drivers on the + Samba host (so the Windows clients can download and use them via + Point'n'Print), please refer to the previous chapter of this + HOWTO Collection. There you will find a description or reference to + three methods of preparing the client drivers on the Samba server: + + + + add printer wizard + The GUI, Add Printer Wizard + upload-from-a-Windows-client + method. - -If you want to use the MS-RPC type printing, you must upload the -drivers onto the Samba server first ([print$] -share). For a discussion on how to deposit printer drivers on the -Samba host (so that the Windows clients can download and use them via -"Point'n'Print") please also refer to the previous chapter of this -HOWTO Collection. There you will find a description or reference to -three methods of preparing the client drivers on the Samba server: - + The command line, smbclient/rpcclient + upload-from-a-UNIX-workstation method. -add printer wizard - -the GUI, "Add Printer Wizard" -upload-from-a-Windows-client -method; + + imprints + The Imprints Toolset + method. + -the commandline, "smbclient/rpcclient" -upload-from-a-UNIX-workstation -method; + + These three methods apply to CUPS all the same. A new and more + convenient way to load the Windows drivers into Samba is provided + if you use CUPS: + - -imprints - the Imprints Toolset -method. - + + + cupsaddsmb + the cupsaddsmb + utility. + - -These 3 methods apply to CUPS all the same. A new and more -convenient way to load the Windows drivers into Samba is provided -if you use CUPS: - + + cupsaddsmb is discussed in much detail further below. But we first + explore the CUPS filtering system and compare the Windows and UNIX printing architectures. + + + -cupsaddsmb + + Advanced Intelligent Printing with PostScript Driver Download - -the cupsaddsmb -utility. - - -cupsaddsmb is discussed in much detail further below. But we will -first explore the CUPS filtering system and compare the Windows and -UNIX printing architectures. - - - + + PostScriptGhostscript + We now know + how to set up a dump printserver, that is, a server which is spooling + printjobs raw, leaving the print data untouched. + - -Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download + + Possibly you need to setup CUPS in a smarter way. The reasons could + be manifold: + -PostScriptGhostscript + + Maybe your boss wants to get monthly statistics: Which + printer did how many pages? What was the average data size of a job? + What was the average print run per day? What are the typical hourly + peaks in printing? Which department prints how much? - -Are you still following this? Good. Let's go into more detail then. We now know -how to set up a "dump" printserver, that is, a server which is spooling -printjobs "raw", leaving the print data untouched. - + Maybe you are asked to setup a print quota system: + Users should not be able to print more jobs, once they have surpassed + a given limit per period. - -Possibly you need to setup CUPS in a more smart way. The reasons could -be manifold: - + Maybe your previous network printing setup is a mess + and must be re-organized from a clean beginning. - -Maybe your boss wants to get monthly statistics: Which -printer did how many pages? What was the average data size of a job? -What was the average print run per day? What are the typical hourly -peaks in printing? Which departments prints how -much? - -Maybe you are asked to setup a print quota system: -users should not be able to print more jobs, once they have surpassed -a given limit per period? - -Maybe your previous network printing setup is a mess -and shall be re-organized from a clean beginning? - -Maybe you have experiencing too many "Blue Screens", -originating from poorly debugged printer drivers running in NT "kernel -mode"? - + Maybe you have experiencing too many blue screens + originating from poorly debugged printer drivers running in NT kernel mode? + - -These goals cannot be achieved by a raw print server. To build a -server meeting these requirements, you'll first need to learn about -how CUPS works and how you can enable its features. - + + These goals cannot be achieved by a raw print server. To build a + server meeting these requirements, you'll first need to learn about + how CUPS works and how you can enable its features. + - -What follows is the comparison of some fundamental concepts for -Windows and UNIX printing; then is the time for a description of the -CUPS filtering system, how it works and how you can tweak it. - + + What follows is the comparison of some fundamental concepts for + Windows and UNIX printing; then follows a description of the + CUPS filtering system, how it works and how you can tweak it. + - -GDI on Windows -- PostScript on UNIX + + GDI on Windows -- PostScript on UNIX -GDI -PostScript - -Network printing is one of the most complicated and error-prone -day-to-day tasks any user or an administrator may encounter. This is -true for all OS platforms. And there are reasons for this. - + + GDI + PostScript + Network printing is one of the most complicated and error-prone + day-to-day tasks any user or administrator may encounter. This is + true for all OS platforms. And there are reasons for this. + -PCL -PDL - -You can't expect for most file formats to just throw them towards -printers and they get printed. There needs to be a file format -conversion in between. The problem is: there is no common standard for -print file formats across all manufacturers and printer types. While -PostScript (trademark held by Adobe), and, to an -extent, PCL (trademark held by HP), have developed -into semi-official "standards", by being the most widely used PDLs -(Page Description Languages), there are still -many manufacturers who "roll their own" (their reasons may be -unacceptable license fees for using printer-embedded PostScript -interpreters, etc.). - - + + PCL + PDL + You can't expect most file formats to just throw them toward + printers and they get printed. There needs to be a file format + conversion in between. The problem is that there is no common standard for + print file formats across all manufacturers and printer types. While + PostScript (trademark held by Adobe) and, to an + extent, PCL (trademark held by HP) have developed + into semi-official standards by being the most widely used PDLs + Page Description Languages (PDLs), there are still + many manufacturers who roll their own (their reasons may be + unacceptable license fees for using printer-embedded PostScript + interpreters, and so on). + + - -Windows Drivers, GDI and EMF + + Windows Drivers, GDI and EMF -GDI -EMF -WYSIWYG - - -In Windows OS, the format conversion job is done by the printer -drivers. On MS Windows OS platforms all application programmers have -at their disposal a built-in API, the GDI (Graphical Device -Interface), as part and parcel of the OS itself, to base -themselves on. This GDI core is used as one common unified ground, for -all Windows programs, to draw pictures, fonts and documents -on screen as well as on -paper (=print). Therefore printer driver developers can -standardize on a well-defined GDI output for their own driver -input. Achieving WYSIWYG ("What You See Is What You Get") is -relatively easy, because the on-screen graphic primitives, as well as -the on-paper drawn objects, come from one common source. This source, -the GDI, produces often a file format called EMF (Enhanced -MetaFile). The EMF is processed by the printer driver and -converted to the printer-specific file format. - - -PDF -To the GDI foundation in MS Windows, Apple has chosen to -put paper and screen output on a common foundation for their -(BSD-UNIX-based, did you know??) Mac OS X and Darwin Operating -Systems. Their Core Graphic Engine uses a -PDF derivative for all display work. - + + GDI + EMF + WYSIWYG + In Windows OS, the format conversion job is done by the printer + drivers. On MS Windows OS platforms all application programmers have + at their disposal a built-in API, the Graphical Device + Interface (GDI), as part and parcel of the OS itself to base + themselves on. This GDI core is used as one common unified ground for + all Windows programs to draw pictures, fonts and documents + on screen as well as on + paper (print). Therefore, printer driver developers can + standardize on a well-defined GDI output for their own driver + input. Achieving WYSIWYG (What You See Is What You Get) is + relatively easy, because the on-screen graphic primitives, as well as + the on-paper drawn objects, come from one common source. This source, + the GDI, often produces a file format called Enhanced + MetaFile (EMF). The EMF is processed by the printer driver and + converted to the printer-specific file format. + - + + PDF + To the GDI foundation in MS Windows, Apple has chosen to + put paper and screen output on a common foundation for their + (BSD-UNIX-based, did you know?) Mac OS X and Darwin Operating + X Window System + PostScript + PCL + Xprint + Systems. Their Core Graphic Engine uses a + PDF derivative for all display work. + -Windows Printing to a local Printer1small - - + - -UNIX Printfile Conversion and GUI Basics + Windows printing to a local printer.1small + + -X Window System -PostScript -PCL -Xprint - - -In UNIX and Linux, there is no comparable layer built into the OS -kernel(s) or the X (screen display) server. Every application is -responsible for itself to create its print output. Fortunately, most -use PostScript. That gives at least some common ground. Unfortunately, -there are many different levels of quality for this PostScript. And -worse: there is a huge difference (and no common root) in the way how -the same document is displayed on screen and how it is presented on -paper. WYSIWYG is more difficult to achieve. This goes back to the -time decades ago, when the predecessors of X.org, -designing the UNIX foundations and protocols for Graphical User -Interfaces refused to take over responsibility for "paper output" -also, as some had demanded at the time, and restricted itself to -"on-screen only". (For some years now, the "Xprint" project has been -under development, attempting to build printing support into the X -framework, including a PostScript and a PCL driver, but it is not yet -ready for prime time.) You can see this unfavorable inheritance up to -the present day by looking into the various "font" directories on your -system; there are separate ones for fonts used for X display and fonts -to be used on paper. - + + UNIX Printfile Conversion and GUI Basics - -Background -PostScript + + X Window System + PostScript + PCL + Xprint + In UNIX and Linux, there is no comparable layer built into the OS + kernel(s) or the X (screen display) server. Every application is + responsible for itself to create its print output. Fortunately, most + use PostScript and that at least gives some common ground. Unfortunately, + there are many different levels of quality for this PostScript. And + worse, there is a huge difference (and no common root) in the way + the same document is displayed on screen and how it is presented on + paper. WYSIWYG is more difficult to achieve. This goes back to the + time, decades ago, when the predecessors of X.org, + designing the UNIX foundations and protocols for Graphical User + Interfaces, refused to take responsibility for paper output + also, as some had demanded at the time, and restricted itself to + on-screen only. (For some years now, the Xprint project has been + under development, attempting to build printing support into the X + framework, including a PostScript and a PCL driver, but it is not yet + ready for prime time.) You can see this unfavorable inheritance up to + the present day by looking into the various font directories on your + system; there are separate ones for fonts used for X display and fonts + to be used on paper. + - -The PostScript programming language is an "invention" by Adobe Inc., -but its specifications have been published to the full. Its strength -lies in its powerful abilities to describe graphical objects (fonts, -shapes, patterns, lines, curves, dots...), their attributes (color, -linewidth...) and the way to manipulate (scale, distort, rotate, -shift...) them. Because of its open specification, anybody with the -skill can start writing his own implementation of a PostScript -interpreter and use it to display PostScript files on screen or on -paper. Most graphical output devices are based on the concept of -"raster images" or "pixels" (one notable exception are pen -plotters). Of course, you can look at a PostScript file in its textual -form and you will be reading its PostScript code, the language -instructions which need to be interpreted by a rasterizer. Rasterizers -produce pixel images, which may be displayed on screen by a viewer -program or on paper by a printer. - - - + + Background - -PostScript and Ghostscript -PostScript -GhostScriptPostScript -PostScriptRIP + + PostScript + The PostScript programming language is an invention by Adobe Inc., + but its specifications have been published to the full. Its strength + lies in its powerful abilities to describe graphical objects (fonts, + shapes, patterns, lines, curves, and dots), their attributes (color, + linewidth) and the way to manipulate (scale, distort, rotate, + shift) them. Because of its open specification, anybody with the + skill can start writing his own implementation of a PostScript + interpreter and use it to display PostScript files on screen or on + paper. Most graphical output devices are based on the concept of + raster images or pixels (one notable exception is pen + plotters). Of course, you can look at a PostScript file in its textual + form and you will be reading its PostScript code, the language + instructions which need to be interpreted by a rasterizer. Rasterizers + produce pixel images, which may be displayed on screen by a viewer + program or on paper by a printer. + + + - -So, UNIX is lacking a common ground for printing on paper and -displaying on screen. Despite this unfavorable legacy for UNIX, basic -printing is fairly easy: if you have PostScript printers at your -disposal! The reason is: these devices have a built-in PostScript -language "interpreter", also called a Raster Image -Processor (RIP), (which makes them more expensive than -other types of printers); throw PostScript towards them, and they will -spit out your printed pages. Their RIP is doing all the hard work of -converting the PostScript drawing commands into a bitmap picture as -you see it on paper, in a resolution as done by your printer. This is -no different to PostScript printing of a file from a Windows origin. - + + PostScript and Ghostscript - -PPD -Traditional UNIX programs and printing systems -- while -using PostScript -- are largely not PPD-aware. PPDs are "PostScript -Printer Description" files. They enable you to specify and control all -options a printer supports: duplexing, stapling, punching... Therefore -UNIX users for a long time couldn't choose many of the supported -device and job options, unlike Windows or Apple users. But now there -is CUPS.... - - - - Printing to a Postscript Printer - 2small - + + PostScript + GhostScriptPostScript + PostScriptRIP + So, UNIX is lacking a common ground for printing on paper and + displaying on screen. Despite this unfavorable legacy for UNIX, basic + printing is fairly easy if you have PostScript printers at your + disposal. The reason is these devices have a built-in PostScript + language interpreter, also called a Raster Image + Processor (RIP) (which makes them more expensive than + other types of printers); throw PostScript toward them, and they will + spit out your printed pages. Their RIP is doing all the hard work of + converting the PostScript drawing commands into a bitmap picture as + you see it on paper, in a resolution as done by your printer. This is + no different to PostScript printing a file from a Windows origin. + -PDL + + PPD + Traditional UNIX programs and printing systems &smbmdash; while + using PostScript &smbmdash; are largely not PPD-aware. PPDs are PostScript + Printer Description files. They enable you to specify and control all + options a printer supports: duplexing, stapling and punching. Therefore, + UNIX users for a long time couldn't choose many of the supported + device and job options, unlike Windows or Apple users. But now there + is CUPS. + + - -However, there are other types of printers out there. These don't know -how to print PostScript. They use their own Page Description -Language (PDL, often proprietary). To print to them is much -more demanding. Since your UNIX applications mostly produce -PostScript, and since these devices don't understand PostScript, you -need to convert the printfiles to a format suitable for your printer -on the host, before you can send it away. - - + + Printing to a PostScript printer. + 2small + - -Ghostscript -- the Software RIP for non-PostScript Printers -GhostScript + + PDL + However, there are other types of printers out there. These do not know + how to print PostScript. They use their own Page Description + Language (PDL, often proprietary). To print to them is much + more demanding. Since your UNIX applications mostly produce + PostScript, and since these devices do not understand PostScript, you + need to convert the printfiles to a format suitable for your printer + on the host before you can send it away. + + - -Here is where Ghostscript kicks in. Ghostscript is -the traditional (and quite powerful) PostScript interpreter used on -UNIX platforms. It is a RIP in software, capable to do a -lot of file format conversions, for a very broad -spectrum of hardware devices as well as software file formats. -Ghostscript technology and drivers is what enables PostScript printing -to non-PostScript hardware. - + + Ghostscript &smbmdash; the Software RIP for Non-PostScript Printers - - Ghostscript as a RIP for non-postscript printers - 3small - - - -Use the "gs -h" command to check for all built-in "devices" of your -Ghostscript version. If you specify e.g. a parameter of --sDEVICE=png256 on your Ghostscript command -line, you are asking Ghostscript to convert the input into a PNG -file. Naming a "device" on the commandline is the most important -single parameter to tell Ghostscript how exactly it should render the -input. New Ghostscript versions are released at fairly regular -intervals, now by artofcode LLC. They are initially put under the -"AFPL" license, but re-released under the GNU GPL as soon as the next -AFPL version appears. GNU Ghostscript is probably the version -installed on most Samba systems. But it has got some -deficiencies. GhostscriptESPESP GhostScriptTherefore ESP Ghostscript was developed as an -enhancement over GNU Ghostscript, with lots of bug-fixes, additional -devices and improvements. It is jointly maintained by developers from -CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat and Debian. It includes -the "cups" device (essential to print to non-PS printers from CUPS). - - + + GhostScript + Here is where Ghostscript kicks in. Ghostscript is + the traditional (and quite powerful) PostScript interpreter used on + UNIX platforms. It is a RIP in software, capable of doing a + lot of file format conversions for a very broad + spectrum of hardware devices as well as software file formats. + Ghostscript technology and drivers are what enable PostScript printing + to non-PostScript hardware. + - -PostScript Printer Description (PPD) Specification + + Ghostscript as a RIP for non-postscript printers. + 3small + + -PPD + + Use the gs -h command to check for all built-in devices + of your Ghostscript version. If you specify a parameter of + -sDEVICE=png256 on your Ghostscript command + line, you are asking Ghostscript to convert the input into a PNG + file. Naming a device on the command line is the most important + single parameter to tell Ghostscript exactly how it should render the + input. New Ghostscript versions are released at fairly regular + intervals, now by artofcode LLC. They are initially put under the + AFPL license, but re-released under the GNU GPL as soon as the next + AFPL version appears. GNU Ghostscript is probably the version + installed on most Samba systems. But it has some deficiencies. + GhostscriptESPESP GhostScript + Therefore, ESP Ghostscript was developed as an + enhancement over GNU Ghostscript, with lots of bug-fixes, additional + devices and improvements. It is jointly maintained by developers from + CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat, and Debian. It includes + the cups device (essential to print to non-PS printers from CUPS). + + - -While PostScript in essence is a Page Description -Language (PDL) to represent the page layout in a -device independent way, real world print jobs are -always ending up to be output on a hardware with device-specific -features. To take care of all the differences in hardware, and to -allow for innovations, Adobe has specified a syntax and file format -for PostScript Printer Description (PPD) -files. Every PostScript printer ships with one of these files. - + + PostScript Printer Description (PPD) Specification - -PPDs contain all information about general and special features of the -given printer model: Which different resolutions can it handle? Does -it have a Duplexing Unit? How many paper trays are there? What media -types and sizes does it take? For each item it also names the special -command string to be sent to the printer (mostly inside the PostScript -file) in order to enable it. - - -Information from these PPDs is meant to be taken into account by the -printer drivers. Therefore, installed as part of the Windows -PostScript driver for a given printer is the printer's PPD. Where it -makes sense, the PPD features are presented in the drivers' UI dialogs -to display to the user as choice of print options. In the end, the -user selections are somehow written (in the form of special -PostScript, PJL, JCL or vendor-dependent commands) into the PostScript -file created by the driver. - + + PPD + While PostScript in essence is a Page Description + Language (PDL) to represent the page layout in a + device-independent way, real-world print jobs are + always ending up being output on hardware with device-specific + features. To take care of all the differences in hardware and to + allow for innovations, Adobe has specified a syntax and file format + for PostScript Printer Description (PPD) + files. Every PostScript printer ships with one of these files. + - -PDF -A PostScript file that was created to contain device-specific commands -for achieving a certain print job output (e.g. duplexed, stapled and -punched) on a specific target machine, may not print as expected, or -may not be printable at all on other models; it also may not be fit -for further processing by software (e.g. by a PDF distilling program). - - + + PPDs contain all the information about general and special features of the + given printer model: Which different resolutions can it handle? Does + it have a Duplexing Unit? How many paper trays are there? What media + types and sizes does it take? For each item, it also names the special + command string to be sent to the printer (mostly inside the PostScript + file) in order to enable it. + - -CUPS can use all Windows-formatted Vendor PPDs + + Information from these PPDs is meant to be taken into account by the + printer drivers. Therefore, installed as part of the Windows + PostScript driver for a given printer is the printer's PPD. Where it + makes sense, the PPD features are presented in the drivers' UI dialogs + to display to the user a choice of print options. In the end, the + user selections are somehow written (in the form of special + PostScript, PJL, JCL or vendor-dependent commands) into the PostScript + file created by the driver. + - -CUPS can handle all spec-compliant PPDs as supplied by the -manufacturers for their PostScript models. Even if a -UNIX/Linux-illiterate vendor might not have mentioned our favorite -OS in his manuals and brochures -- you can safely trust this: -if you get hold of the Windows NT version of the PPD, you -can use it unchanged in CUPS and thus access the full -power of your printer just like a Windows NT user could! - + + PDF + A PostScript file that was created to contain device-specific commands + for achieving a certain print job output (e.g., duplexed, stapled and + punched) on a specific target machine, may not print as expected, or + may not be printable at all on other models; it also may not be fit + for further processing by software (e.g., by a PDF distilling program). + + - -To check the spec compliance of any PPD online, go to http://www.cups.org/testppd.php -and upload your PPD. You will see the results displayed -immediately. CUPS in all versions after 1.1.19 has a much more strict -internal PPD parsing and checking code enabled; in case of printing -trouble this online resource should be one of your first pitstops. - + + Using Windows-Formatted Vendor PPDs - -foomatic -cupsomatic -For real PostScript printers don't use the -Foomatic or cupsomatic -PPDs from Linuxprinting.org. With these devices the original -vendor-provided PPDs are always the first choice! - + + CUPS can handle all spec-compliant PPDs as supplied by the + manufacturers for their PostScript models. Even if a + vendor might not have mentioned our favorite + OS in his manuals and brochures, you can safely trust this: + If you get the Windows NT version of the PPD, you + can use it unchanged in CUPS and thus access the full + power of your printer just like a Windows NT user could! + - -If you are looking for an original vendor-provided PPD of a specific -device, and you know that an NT4 box (or any other Windows box) on -your LAN has the PostScript driver installed, just use -smbclient //NT4-box/print\$ -U username to -access the Windows directory where all printer driver files are -stored. First look in the W32X86/2 subdir for -the PPD you are seeking. - - + + To check the spec compliance of any PPD online, go to http://www.cups.org/testppd.php + and upload your PPD. You will see the results displayed + immediately. CUPS in all versions after 1.1.19 has a much more strict + internal PPD parsing and checking code enabled; in case of printing + trouble, this online resource should be one of your first pitstops. + - -CUPS also uses PPDs for non-PostScript Printers + + foomatic + cupsomatic + For real PostScript printers, do not use the + Foomatic or cupsomatic + PPDs from Linuxprinting.org. With these devices, the original + vendor-provided PPDs are always the first choice! + + + + If you are looking for an original vendor-provided PPD of a specific + device, and you know that an NT4 box (or any other Windows box) on + your LAN has the PostScript driver installed, just use + smbclient //NT4-box/print\$ -U username to + access the Windows directory where all printer driver files are + stored. First look in the W32X86/2 subdir for + the PPD you are seeking. + + - -CUPS also uses specially crafted PPDs to handle non-PostScript -printers. These PPDs are usually not available from the vendors (and -no, you can't just take the PPD of a Postscript printer with the same -model name and hope it works for the non-PostScript version too). To -understand how these PPDs work for non-PS printers we first need to -dive deeply into the CUPS filtering and file format conversion -architecture. Stay tuned. - - + + CUPS Also Uses PPDs for Non-PostScript Printers + + + CUPS also uses specially crafted PPDs to handle non-PostScript + printers. These PPDs are usually not available from the vendors (and + no, you can't just take the PPD of a PostScript printer with the same + model name and hope it works for the non-PostScript version too). To + understand how these PPDs work for non-PS printers, we first need to + dive deeply into the CUPS filtering and file format conversion + architecture. Stay tuned. + + @@ -849,12 +848,12 @@ architecture. Stay tuned. The core of the CUPS filtering system is based on -Ghostscript. In addition to Ghostscript, CUPS +Ghostscript. In addition to Ghostscript, CUPS uses some other filters of its own. You (or your OS vendor) may have plugged in even more filters. CUPS handles all data file formats under -the label of various MIME types. Every incoming +the label of various MIME types. Every incoming printfile is subjected to an initial -auto-typing. The auto-typing determines its given +auto-typing. The auto-typing determines its given MIME type. A given MIME type implies zero or more possible filtering chains relevant to the selected target printer. This section discusses how MIME types recognition and conversion rules interact. They are @@ -863,44 +862,44 @@ given input data format. -If CUPS rasterizes a PostScript file natively to -a bitmap, this is done in 2 stages: +If CUPS rasterizes a PostScript file natively to +a bitmap, this is done in two stages: -the first stage uses a Ghostscript device named "cups" + The first stage uses a Ghostscript device named cups (this is since version 1.1.15) and produces a generic raster format -called "CUPS raster". +called CUPS raster. -the second stage uses a "raster driver" which converts -the generic CUPS raster to a device specific raster. +The second stage uses a raster driver that converts + the generic CUPS raster to a device-specific raster. -Make sure your Ghostscript version has the "cups" device compiled in -(check with gs -h | grep cups). Otherwise you +Make sure your Ghostscript version has the cups device compiled in +(check with gs -h | grep cups). Otherwise you may encounter the dreaded Unable to convert file -0 in your CUPS error_log file. To have "cups" as a -device in your Ghostscript, you either need to patch GNU -Ghostscript and re-compile or use ESPGhostscript in your CUPS error_log file. To have cups as a +device in your Ghostscript, you either need to patch GNU +Ghostscript and re-compile, or use ESPGhostscriptESP Ghostscript. The -superior alternative is ESP Ghostscript: it supports not just CUPS, +superior alternative is ESP Ghostscript. It supports not just CUPS, but 300 other devices too (while GNU Ghostscript supports only about 180). Because of this broad output device support, ESP Ghostscript is -the first choice for non-CUPS spoolers too. It is now recommended by +the first choice for non-CUPS spoolers, too. It is now recommended by Linuxprinting.org for all spoolers. cupsomatic foomatic -CUPS printers may be setup to use external -rendering paths. One of the most common ones is provided by the -Foomatic/cupsomatic concept, from Linuxprinting.org. This +CUPS printers may be setup to use external +rendering paths. One of the most common is provided by the +Foomatic/cupsomatic concept from Linuxprinting.org. This uses the classical Ghostscript approach, doing everything in one -step. It doesn't use the "cups" device, but one of the many +step. It does not use the cups device, but one of the many others. However, even for Foomatic/cupsomatic usage, best results and ESPGhostscript broadest printer model support is provided by ESP Ghostscript (more @@ -909,230 +908,222 @@ about cupsomatic/Foomatic, particularly the new version called now -MIME types and CUPS Filters +MIME Types and CUPS Filters + +MIMEfilters MIME CUPS reads the file /etc/cups/mime.types (and all other files carrying a *.types suffix in the same directory) upon startup. These files contain the MIME -type recognition rules which are applied when CUPS runs its +type recognition rules that are applied when CUPS runs its auto-typing routines. The rule syntax is explained in the man page for mime.types and in the comments section of the mime.types file itself. A simple rule reads like this: - - application/pdf - + application/pdf pdf string(0,%PDF) - + - -This means: if a filename has either a -.pdf suffix, or if the magic +This means if a filename has either a +.pdf suffix or if the magic string %PDF is right at the beginning of the file itself (offset 0 from the start), then it is -a PDF file (application/pdf). +a PDF file (application/pdf). Another rule is this: - - + application/postscript ai eps ps string(0,%!) string(0,<04>%!) - + - -Its meaning: if the filename has one of the suffixes +If the filename has one of the suffixes .ai, .eps, .ps or if the file itself starts with one of the strings %! or %!]]>, it is a generic PostScript file -(application/postscript). +(application/postscript). + +Don't confuse the other mime.types files your system might be using +with the one in the /etc/cups/ directory. + + -There is a very important difference between two similar MIME type in -CUPS: one is application/postscript, the other is -application/vnd.cups-postscript. While -application/postscript is meant to be device +There is an important difference between two similar MIME types in +CUPS: one is application/postscript, the other is +application/vnd.cups-postscript. While +application/postscript is meant to be device independent (job options for the file are still outside the PS file -content, embedded in commandline or environment variables by CUPS), -application/vnd.cups-postscript may have the job -options inserted into the PostScript data itself (were +content, embedded in command line or environment variables by CUPS), +application/vnd.cups-postscript may have the job +options inserted into the PostScript data itself (where applicable). The transformation of the generic PostScript -(application/postscript) to the device-specific version -(application/vnd.cups-postscript) is the responsibility of the -CUPS pstops filter. pstops uses information +(application/postscript) to the device-specific version +(application/vnd.cups-postscript) is the responsibility of the +CUPS pstops filter. pstops uses information contained in the PPD to do the transformation. - -Don't confuse the other mime.types file your system might be using -with the one in the /etc/cups/ directory. - - -CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI and a -lot of image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster, -PNM, PBM, SGI-RGB and some more) and their associated MIME types +CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI, and +many image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster, +PNM, PBM, SGI-RGB, and more) and their associated MIME types with its filters. -MIME type Conversion Rules +MIME Type Conversion Rules -MIME +MIME +application/pdf CUPS reads the file /etc/cups/mime.convs (and all other files named with a *.convs suffix in the same directory) upon startup. These files contain lines naming an input MIME type, an output MIME type, a format -conversion filter which can produce the output from the input type +conversion filter that can produce the output from the input type and virtual costs associated with this conversion. One example line reads like this: - - + application/pdf application/postscript 33 pdftops - + - -This means that the pdftops filter will take -application/pdf as input and produce -application/postscript as output, the virtual +This means that the pdftops filter will take +application/pdf as input and produce +application/postscript as output; the virtual cost of this operation is 33 CUPS-$. The next filter is more expensive, costing 66 CUPS-$: - pdf - + application/vnd.hp-HPGL application/postscript 66 hpgltops - + - -This is the hpgltops, which processes HP-GL +This is the hpgltops, which processes HP-GL plotter files to PostScript. - application/octet-stream - + application/octet-stream - + - Here are two more examples: - text/plain - + application/x-shell application/postscript 33 texttops text/plain application/postscript 33 texttops - + - -The last two examples name the texttops filter -to work on "text/plain" as well as on "application/x-shell". (Hint: -this differentiation is needed for the syntax highlighting feature of -"texttops"). +The last two examples name the texttops filter +to work on text/plain as well as on application/x-shell. (Hint: +This differentiation is needed for the syntax highlighting feature of +texttops). -Filter Requirements +Filtering Overview -MIME -There are many more combinations named in mime.convs. However, you +MIME +There are many more combinations named in mime.convs. However, you are not limited to use the ones pre-defined there. You can plug in any filter you like into the CUPS framework. It must meet, or must be made -to meet some minimal requirements. If you find (or write) a cool +to meet, some minimal requirements. If you find (or write) a cool conversion filter of some kind, make sure it complies to what CUPS -needs, and put in the right lines in mime.types +needs and put in the right lines in mime.types and mime.convs, then it will work seamlessly -inside CUPS! +inside CUPS. - -The mentioned "CUPS requirements" for filters are simple. Take + +Filter requirements + +The mentioned CUPS requirements for filters are simple. Take filenames or stdin as input and write to stdout. They should take these 5 or 6 arguments: printer job user title copies options [filename] -Printer +Printer The name of the printer queue (normally this is the -name of the filter being run) +name of the filter being run). -job +job The numeric job ID for the job being -printed +printed. -user +user The string from the originating-user-name -attribute +attribute. -title -The string from the job-name attribute +title +The string from the job-name attribute. -copies +copies The numeric value from the number-copies -attribute +attribute. -options -The job options +options +The job options. -filename +filename (Optionally) The print request file (if missing, filters expected data fed through stdin). In most -cases it is very easy to write a simple wrapper script around existing +cases, it is easy to write a simple wrapper script around existing filters to make them work with CUPS. - + Prefilters -PostScript -As was said, PostScript is the central file format to any UNIX based +PostScript +As previously stated, PostScript is the central file format to any UNIX-based printing system. From PostScript, CUPS generates raster data to feed non-PostScript printers. -But what is happening if you send one of the supported non-PS formats -to print? Then CUPS runs "pre-filters" on these input formats to +But what happens if you send one of the supported non-PS formats +to print? Then CUPS runs pre-filters on these input formats to generate PostScript first. There are pre-filters to create PS from -ASCII text, PDF, DVI or HP-GL. The outcome of these filters is always -of MIME type application/postscript (meaning that +ASCII text, PDF, DVI, or HP-GL. The outcome of these filters is always +of MIME type application/postscript (meaning that any device-specific print options are not yet embedded into the PostScript by CUPS, and that the next filter to be called is pstops). Another pre-filter is running on all supported image formats, -the imagetops filter. Its outcome is always of -MIME type application/vnd.cups-postscript -(not application/postscript), meaning it has the +the imagetops filter. Its outcome is always of +MIME type application/vnd.cups-postscript +(not application/postscript), meaning it has the print options already embedded into the file. - Prefiltering in CUPS to form Postscript + Pre-filtering in CUPS to form PostScript. 4small @@ -1142,38 +1133,38 @@ print options already embedded into the file. pstops -pstopsis the filter to convert -application/postscript to -application/vnd.cups-postscript. It was said +pstops is the filter to convert +application/postscript to +application/vnd.cups-postscript. It was said above that this filter inserts all device-specific print options (commands to the printer to ask for the duplexing of output, or -stapling an punching it, etc.) into the PostScript file. +stapling and punching it, and so on) into the PostScript file. - Adding Device-specific Print Options + Adding device-specific print options. 5small -This is not all: other tasks performed by it are: +This is not all. Other tasks performed by it are: -selecting the range of pages to be printed (if you choose to -print only pages "3, 6, 8-11, 16, 19-21", or only the odd numbered -ones) +Selecting the range of pages to be printed (if you choose to +print only pages 3, 6, 8-11, 16, 19-21, or only the odd numbered +ones). -putting 2 or more logical pages on one sheet of paper (the -so-called "number-up" function) +Putting 2 or more logical pages on one sheet of paper (the +so-called number-up function). -counting the pages of the job to insert the accounting -information into the /var/log/cups/page_log +Counting the pages of the job to insert the accounting +information into the /var/log/cups/page_log. @@ -1182,53 +1173,53 @@ information into the /var/log/cups/page_log pstoraster -pstoraster is at the core of the CUPS filtering +pstoraster is at the core of the CUPS filtering system. It is responsible for the first stage of the rasterization process. Its input is of MIME type application/vnd.cups-postscript; its output is application/vnd.cups-raster. This output format is not yet meant to be printable. Its aim is to serve as a general purpose -input format for more specialized raster drivers, +input format for more specialized raster drivers that are able to generate device-specific printer data. - Postscript to intermediate Raster format6small + PostScript to intermediate raster format.6small CUPS raster is a generic raster format with powerful features. It is -able to include per-page information, color profiles and more to be +able to include per-page information, color profiles, and more, to be used by the following downstream raster drivers. Its MIME type is -registered with IANA and its specification is of course completely -open. It is designed to make it very easy and inexpensive for +registered with IANA and its specification is, of course, completely +open. It is designed to make it quite easy and inexpensive for manufacturers to develop Linux and UNIX raster drivers for their printer models, should they choose to do so. CUPS always takes care -for the first stage of rasterization so these vendors don't need to care +for the first stage of rasterization so these vendors do not need to care about Ghostscript complications (in fact, there is currently more than one vendor financing the development of CUPS raster drivers). - CUPS-raster production using Ghostscript + CUPS-raster production using Ghostscript. 7small CUPS versions before version 1.1.15 were shipping a binary (or source -code) standalone filter, named "pstoraster". pstoraster was derived +code) standalone filter, named pstoraster. pstoraster was derived from GNU Ghostscript 5.50, and could be installed besides and in addition to any GNU or AFPL Ghostscript package without conflicting. -From version 1.1.15, this has changed. The functions for this has been +>From version 1.1.15, this has changed. The functions for this have been integrated back into Ghostscript (now based on GNU Ghostscript version -7.05). The "pstoraster" filter is now a simple shell script calling +7.05). The pstoraster filter is now a simple shell script calling gs with the -sDEVICE=cups -parameter. If your Ghostscript doesn't show a success on asking for +parameter. If your Ghostscript does not show a success on asking for gs -h |grep cups, you might not be able to -print. Update your Ghostscript then! +print. Update your Ghostscript. @@ -1236,16 +1227,16 @@ print. Update your Ghostscript then! imagetops and imagetoraster -Above in the section about prefilters, we mentioned the prefilter -that generates PostScript from image formats. The imagetoraster +In the section about pre-filters, we mentioned the pre-filter +that generates PostScript from image formats. The imagetoraster filter is used to convert directly from image to raster, without the intermediate PostScript stage. It is used more often than the above -mentioned prefilters. Here is a summarizing flowchart of image file -filtering: +mentioned pre-filters. A summarizing flowchart of image file +filtering is shown in . - Image format to CUPS-raster format conversion + Image format to CUPS-raster format conversion. 8small @@ -1256,21 +1247,21 @@ filtering: rasterto [printers specific] -CUPS ships with quite some different raster drivers processing CUPS +CUPS ships with quite different raster drivers processing CUPS raster. On my system I find in /usr/lib/cups/filter/ these: rastertoalps, rastertobj, rastertoepson, rastertoescp, rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo, -rastertoescp, rastertohp and +rastertoescp, rastertohp, and rastertoprinter. Don't worry if you have less than this; some of these are installed by commercial add-ons to CUPS (like rastertoturboprint), others (like -rastertoprinter) by 3rd party driver +rastertoprinter) by third-party driver development projects (such as Gimp-Print) wanting to cooperate as closely as possible with CUPS. - Raster to Printer Specific formats + Raster to printer-specific formats. 9small @@ -1280,11 +1271,11 @@ closely as possible with CUPS. CUPS Backends -The last part of any CUPS filtering chain is a "backend". Backends +The last part of any CUPS filtering chain is a backend. Backends are special programs that send the print-ready file to the final device. There is a separate backend program for any transfer -"protocol" of sending printjobs over the network, or for every local -interface. Every CUPS printqueue needs to have a CUPS "device-URI" +protocol of sending printjobs over the network, or for every local +interface. Every CUPS print queue needs to have a CUPS device-URI associated with it. The device URI is the way to encode the backend used to send the job to its destination. Network device-URIs are using two slashes in their syntax, local device URIs only one, as you can @@ -1293,100 +1284,105 @@ may vary much from my examples, if your OS is not Linux: -usb - -This backend sends printfiles to USB-connected printers. An -example for the CUPS device-URI to use is: -usb:/dev/usb/lp0 - + usb + + This backend sends printfiles to USB-connected printers. An + example for the CUPS device-URI to use is: + usb:/dev/usb/lp0. + -serial - -This backend sends printfiles to serially connected printers. -An example for the CUPS device-URI to use is: -serial:/dev/ttyS0?baud=11500 - + serial + + This backend sends printfiles to serially connected printers. + An example for the CUPS device-URI to use is: + serial:/dev/ttyS0?baud=11500. + -parallel - -This backend sends printfiles to printers connected to the -parallel port. An example for the CUPS device-URI to use is: -parallel:/dev/lp0 - + parallel + + This backend sends printfiles to printers connected to the + parallel port. An example for the CUPS device-URI to use is: + parallel:/dev/lp0. + -scsi - -This backend sends printfiles to printers attached to the -SCSI interface. An example for the CUPS device-URI to use is: -scsi:/dev/sr1 - + scsi + + This backend sends printfiles to printers attached to the + SCSI interface. An example for the CUPS device-URI to use is: + scsi:/dev/sr1. + -lpd - -This backend sends printfiles to LPR/LPD connected network -printers. An example for the CUPS device-URI to use is: -lpd://remote_host_name/remote_queue_name - + lpd + + This backend sends printfiles to LPR/LPD connected network + printers. An example for the CUPS device-URI to use is: + lpd://remote_host_name/remote_queue_name. + -AppSocket/HP JetDirect - -This backend sends printfiles to AppSocket (a.k.a. "HP -JetDirect") connected network printers. An example for the CUPS -device-URI to use is: -socket://10.11.12.13:9100 - + AppSocket/HP JetDirect + + This backend sends printfiles to AppSocket (a.k.a. "HP + JetDirect") connected network printers. An example for the CUPS + device-URI to use is: + socket://10.11.12.13:9100. + -ipp - -This backend sends printfiles to IPP connected network -printers (or to other CUPS servers). Examples for CUPS device-URIs -to use are: -ipp:://192.193.194.195/ipp -(for many HP printers) or -ipp://remote_cups_server/printers/remote_printer_name - + ipp + + This backend sends printfiles to IPP connected network + printers (or to other CUPS servers). Examples for CUPS device-URIs + to use are: + ipp:://192.193.194.195/ipp + (for many HP printers) or + ipp://remote_cups_server/printers/remote_printer_name. + + + http + + This backend sends printfiles to HTTP connected printers. + (The http:// CUPS backend is only a symlink to the ipp:// backend.) + Examples for the CUPS device-URIs to use are: + http:://192.193.194.195:631/ipp + (for many HP printers) or + http://remote_cups_server:631/printers/remote_printer_name. + + + smb + + This backend sends printfiles to printers shared by a Windows + host. An example for CUPS device-URIs that may be used includes: + -http - -This backend sends printfiles to HTTP connected printers. -(The http:// CUPS backend is only a symlink to the ipp:// backend.) -Examples for the CUPS device-URIs to use are: -http:://192.193.194.195:631/ipp -(for many HP printers) or -http://remote_cups_server:631/printers/remote_printer_name - + + + smb://workgroup/server/printersharename + smb://server/printersharename + smb://username:password@workgroup/server/printersharename + smb://username:password@server/printersharename + + -smb - -This backend sends printfiles to printers shared by a Windows -host. An example for CUPS device-URIs to use are: -smb://workgroup/server/printersharename -Or -smb://server/printersharename -or -smb://username:password@workgroup/server/printersharename -or -smb://username:password@server/printersharename. -The smb:// backend is a symlink to the Samba utility -smbspool (doesn't ship with CUPS). If the -symlink is not present in your CUPS backend directory, have your -root user create it: ln -s `which smbspool` -/usr/lib/cups/backend/smb. - + + The smb:// backend is a symlink to the Samba utility + smbspool (does not ship with CUPS). If the + symlink is not present in your CUPS backend directory, have your + root user create it: ln -s `which smbspool' + /usr/lib/cups/backend/smb. + -It is easy to write your own backends as Shell or Perl scripts, if you +It is easy to write your own backends as shell or Perl scripts, if you need any modification or extension to the CUPS print system. One -reason could be that you want to create "special" printers which send -the printjobs as email (through a "mailto:/" backend), convert them to -PDF (through a "pdfgen:/" backend) or dump them to "/dev/null" (In +reason could be that you want to create special printers that send +the printjobs as email (through a mailto:/ backend), convert them to +PDF (through a pdfgen:/ backend) or dump them to /dev/null. (In fact I have the system-wide default printer set up to be connected to -a "devnull:/" backend: there are just too many people sending jobs -without specifying a printer, or scripts and programs which don't name +a devnull:/ backend: there are just too many people sending jobs +without specifying a printer, or scripts and programs which do not name a printer. The system-wide default deletes the job and sends a polite -mail back to the $USER asking him to always specify a correct -printername). +email back to the $USER asking him to always specify the correct +printer name.) @@ -1403,73 +1399,64 @@ all available backends: -cupsomatic/Foomatic -- how do they fit into the Picture? +The Role of <parameter>cupsomatic/foomatic</parameter> + cupsomatic foomatic - - -"cupsomatic" filters may be the most widely used on CUPS +cupsomatic filters may be the most widely used on CUPS installations. You must be clear about the fact that these were not -developed by the CUPS people. They are a "Third Party" add-on to +developed by the CUPS people. They are a third party add-on to CUPS. They utilize the traditional Ghostscript devices to render jobs for CUPS. When troubleshooting, you should know about the difference. Here the whole rendering process is done in one stage, -inside Ghostscript, using an appropriate "device" for the target -printer. cupsomatic uses PPDs which are generated from the "Foomatic" +inside Ghostscript, using an appropriate device for the target +printer. cupsomatic uses PPDs that are generated from the Foomatic Printer & Driver Database at Linuxprinting.org. You can recognize these PPDs from the line calling the -cupsomatic filter: - +cupsomatic filter: - + *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic" - + - -This line you may find amongst the first 40 or so lines of the PPD +You may find this line among the first 40 or so lines of the PPD file. If you have such a PPD installed, the printer shows up in the -CUPS web interface with a foomatic namepart for -the driver description. cupsomatic is a Perl script that runs -Ghostscript, with all the complicated commandline options -auto-constructed from the selected PPD and commandline options give to +CUPS Web interface with a foomatic namepart for +the driver description. cupsomatic is a Perl script that runs +Ghostscript with all the complicated command line options +auto-constructed from the selected PPD and command line options give to the printjob. -point and print - -However, cupsomatic is now deprecated. Its PPDs (especially the first +point 'n' print + However, cupsomatic is now deprecated. Its PPDs (especially the first generation of them, still in heavy use out there) are not meeting the Adobe specifications. You might also suffer difficulties when you try -to download them with "Point'n'Print" to Windows clients. A better, -and more powerful successor is now in a very stable Beta-version -available: it is called foomatic-rip. To use -foomatic-rip as a filter with CUPS, you need the new-type PPDs. These -have a similar, but different line: - - - +to download them with Point'n'Print to Windows clients. A better +and more powerful successor is now in a stable beta-version: it is called foomatic-rip. To use +foomatic-rip as a filter with CUPS, you need the new-type PPDs. These +have a similar but different line: + *cupsFilter: "application/vnd.cups-postscript 0 foomatic-rip" + - - - The PPD generating engine at Linuxprinting.org has been revamped. The new PPDs comply to the Adobe spec. On top, they also provide a new way to specify different quality levels (hi-res photo, normal -color, grayscale, draft...) with a single click (whereas before you -could have required 5 or more different selections (media type, -resolution, inktype, dithering algorithm...). There is support for +color, grayscale, and draft) with a single click, whereas before you +could have required five or more different selections (media type, +resolution, inktype and dithering algorithm). There is support for custom-size media built in. There is support to switch -print-options from page to page, in the middle of a job. And the -best thing is: the new foomatic-rip now works seamlessly with all -legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR etc.), providing -for them access to use PPDs for their printing! +print-options from page to page in the middle of a job. And the +best thing is the new foomatic-rip now works seamlessly with all +legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR and so on), providing +for them access to use PPDs for their printing. @@ -1477,7 +1464,7 @@ for them access to use PPDs for their printing! The Complete Picture -If you want to see an overview over all the filters and how they +If you want to see an overview of all the filters and how they relate to each other, the complete picture of the puzzle is at the end of this document. @@ -1489,34 +1476,34 @@ of this document. CUPS auto-constructs all possible filtering chain paths for any given MIME type, and every printer installed. But how does it decide in -favor or against a specific alternative? (There may often be cases, +favor or against a specific alternative? (There may often be cases where there is a choice of two or more possible filtering chains for -the same target printer). Simple: you may have noticed the figures in -the 3rd column of the mime.convs file. They represent virtual costs +the same target printer.) Simple. You may have noticed the figures in +the third column of the mime.convs file. They represent virtual costs assigned to this filter. Every possible filtering chain will sum up to -a total "filter cost". CUPS decides for the most "inexpensive" route. +a total filter cost. CUPS decides for the most inexpensive route. The setting of FilterLimit 1000 in cupsd.conf will not allow more filters to run concurrently than will consume a total of 1000 virtual filter -cost. This is a very efficient way to limit the load of any CUPS -server by setting an appropriate "FilterLimit" value. A FilterLimit of -200 allows roughly 1 job at a time, while a FilterLimit of 1000 allows -approximately 5 jobs maximum at a time. +cost. This is an efficient way to limit the load of any CUPS +server by setting an appropriate FilterLimit value. A FilterLimit of +200 allows roughly one job at a time, while a FilterLimit of 1000 allows +approximately five jobs maximum at a time. -"Raw" printing + <quote>Raw</quote> Printing -You can tell CUPS to print (nearly) any file "raw". "Raw" means it -will not be filtered. CUPS will send the file to the printer "as is" + You can tell CUPS to print (nearly) any file raw. Raw means it + will not be filtered. CUPS will send the file to the printer as is without bothering if the printer is able to digest it. Users need to take care themselves that they send sensible data formats only. Raw -printing can happen on any queue if the "-o raw" option is specified +printing can happen on any queue if the -o raw option is specified on the command line. You can also set up raw-only queues by simply not associating any PPD with it. This command: @@ -1526,40 +1513,40 @@ associating any PPD with it. This command: -sets up a queue named "rawprinter", connected via the "socket" -protocol (a.k.a. "HP JetDirect") to the device at IP address + sets up a queue named rawprinter, connected via the socket + protocol (a.k.a. HP JetDirect) to the device at IP address 11.12.1.3.14, using port 9100. (If you had added a PPD with -P /path/to/PPD to this command line, you would -have installed a "normal" printqueue. +have installed a normal print queue. -CUPS will automatically treat each job sent to a queue as a "raw" one, -if it can't find a PPD associated with the queue. However, CUPS will +CUPS will automatically treat each job sent to a queue as a raw one, +if it can't find a PPD associated with the queue. However, CUPS will only send known MIME types (as defined in its own mime.types file) and refuse others. -"application/octet-stream" printing +application/octet-stream Printing Any MIME type with no rule in the /etc/cups/mime.types file is regarded as unknown -or application/octet-stream and will not be +or application/octet-stream and will not be sent. Because CUPS refuses to print unknown MIME types per default, -you will probably have experienced the fact that printjobs originating +you will probably have experienced the fact that print jobs originating from Windows clients were not printed. You may have found an error message in your CUPS logs like: - + Unable to convert file 0 to printable format for job - + -To enable the printing of "application/octet-stream" files, edit +To enable the printing of application/octet-stream files, edit these two files: @@ -1572,41 +1559,37 @@ these two files: Both contain entries (at the end of the respective files) which must be uncommented to allow RAW mode operation for -application/octet-stream. In /etc/cups/mime.types +application/octet-stream. In /etc/cups/mime.types make sure this line is present: - application/octet-stream - - application/octet-stream - + +application/octet-stream + - This line (with no specific auto-typing rule set) makes all files -not otherwise auto-typed a member of application/octet-stream. In +not otherwise auto-typed a member of application/octet-stream. In /etc/cups/mime.convs, have this line: - - - - application/octet-stream application/vnd.cups-raw 0 - - + + +application/octet-stream application/vnd.cups-raw 0 - + MIME - This line tells CUPS to use the Null Filter -(denoted as "-", doing... nothing at all) on -application/octet-stream, and tag the result as -application/vnd.cups-raw. This last one is +(denoted as -, doing nothing at all) on +application/octet-stream, and tag the result as +application/vnd.cups-raw. This last one is always a green light to the CUPS scheduler to now hand the file over -to the "backend" connecting to the printer and sending it over. +to the backend connecting to the printer and sending it over. - Editing the mime.convs and the +Editing the mime.convs and the mime.types file does not -enforce "raw" printing, it only +enforce raw printing, it only allows it. @@ -1616,14 +1599,14 @@ to the "backend" connecting to the printer and sending it over. CUPS being a more security-aware printing system than traditional ones does not by default allow one to send deliberate (possibly binary) -data to printing devices. (This could be easily abused to launch a +data to printing devices. (This could be easily abused to launch a Denial of Service attack on your printer(s), causing at least the loss -of a lot of paper and ink...) "Unknown" data are regarded by CUPS +of a lot of paper and ink...) Unknown data are regarded by CUPS as MIME type application/octet-stream. While you -can send data "raw", the MIME type for these must +can send data raw, the MIME type for these must be one that is known to CUPS and an allowed one. The file -/etc/cups/mime.types defines the "rules" how CUPS +/etc/cups/mime.types defines the rules of how CUPS recognizes MIME types. The file /etc/cups/mime.convs decides which file conversion filter(s) may be applied to which MIME types. @@ -1632,18 +1615,18 @@ conversion filter(s) may be applied to which MIME types. -PostScript Printer Descriptions (PPDs) for non-PS Printers +PostScript Printer Descriptions (PPDs) for Non-PS Printers -PPD +PPD Originally PPDs were meant to be used for PostScript printers only. Here, they help to send device-specific commands and settings to the RIP which processes the jobfile. CUPS has extended this scope for PPDs to cover non-PostScript printers too. This was not -very difficult, because it is a standardized file format. In a way +difficult, because it is a standardized file format. In a way it was logical too: CUPS handles PostScript and uses a PostScript -RIP (=Ghostscript) to process the jobfiles. The only difference is: +RIP (Ghostscript) to process the jobfiles. The only difference is: a PostScript printer has the RIP built-in, for other types of printers the Ghostscript RIP runs on the host computer. @@ -1651,22 +1634,20 @@ printers the Ghostscript RIP runs on the host computer. PPDs for a non-PS printer have a few lines that are unique to CUPS. The most important one looks similar to this: - application/vnd.cups-raster - + *cupsFilter: application/vnd.cups-raster 66 rastertoprinter - + - It is the last piece in the CUPS filtering puzzle. This line tells the -CUPS daemon to use as a last filter "rastertoprinter". This filter -should be served as input an "application/vnd.cups-raster" MIME type -file. Therefore CUPS should auto-construct a filtering chain, which +CUPS daemon to use as a last filter rastertoprinter. This filter +should be served as input an application/vnd.cups-raster MIME type +file. Therefore, CUPS should auto-construct a filtering chain, which delivers as its last output the specified MIME type. This is then -taken as input to the specified "rastertoprinter" filter. After this -the last filter has done its work ("rastertoprinter" is a Gimp-Print +taken as input to the specified rastertoprinter filter. After this +the last filter has done its work (rastertoprinter is a Gimp-Print filter), the file should go to the backend, which sends it to the output device. @@ -1675,17 +1656,17 @@ output device. CUPS by default ships only a few generic PPDs, but they are good for several hundred printer models. You may not be able to control different paper trays, or you may get larger margins than your -specific model supports): +specific model supports. See for summary information. -
    - PPD's shipped with CUPS +
    + PPDs shipped with CUPS - + PPD filePrinter type - deskjet.ppdolder HP inkjet printers and compatible + deskjet.ppdolder HP inkjet printers and compatible deskjet2.ppd newer HP inkjet printers and compatible @@ -1707,7 +1688,8 @@ specific model supports): stphoto2.ppd newer Epson Stylus Photo printers - laserjet.ppd all PCL printers. Further below is a discussion of several other driver/PPD-packages suitable for use with CUPS. + laserjet.ppd all PCL printers. Further below is a discussion + of several other driver/PPD-packages suitable for use with CUPS. @@ -1716,28 +1698,27 @@ specific model supports): -Difference between <emphasis>cupsomatic/foomatic-rip</emphasis> and -<emphasis>native CUPS</emphasis> printing +<emphasis>cupsomatic/foomatic-rip</emphasis> Versus <emphasis>native CUPS</emphasis> Printing -cupsomatic -foomatic-rip -Native CUPS rasterization works in two steps. +cupsomatic +foomatic-rip +Native CUPS rasterization works in two steps: -First is the "pstoraster" step. It uses the special "cups" +First is the pstoraster step. It uses the special CUPS ESPGhostscript -device from ESP Ghostscript 7.05.x as its tool +device from ESP Ghostscript 7.05.x as its tool. -Second comes the "rasterdriver" step. It uses various +Second comes the rasterdriver step. It uses various device-specific filters; there are several vendors who provide good -quality filters for this step, some are Free Software, some are -Shareware/Non-Free, some are proprietary. +quality filters for this step. Some are free software, some are +shareware/non-free and some are proprietary. @@ -1746,33 +1727,33 @@ advantages) than other methods. - cupsomatic/foomatic processing versus Native CUPS + cupsomatic/foomatic Processing versus Native CUPS. 10small -One other method is the cupsomatic/foomatic-rip -way. Note that cupsomatic is not made by the CUPS +One other method is the cupsomatic/foomatic-rip +way. Note that cupsomatic is not made by the CUPS developers. It is an independent contribution to printing development, -made by people from Linuxprinting.org (see also http://www.cups.org/cups-help.html). -cupsomatic is no longer developed and maintained and is no longer +made by people from Linuxprinting.org see also http://www.cups.org/cups-help.html. +cupsomatic is no longer developed and maintained and is no longer supported. It has now been replaced by -foomatic-rip. foomatic-rip is a complete re-write -of the old cupsomatic idea, but very much improved and generalized to +foomatic-rip. foomatic-rip is a complete re-write +of the old cupsomatic idea, but very much improved and generalized to other (non-CUPS) spoolers. An upgrade to foomatic-rip is strongly -advised, especially if you are upgrading to a recent version of CUPS +advised, especially if you are upgrading to a recent version of CUPS, too. cupsomatic foomatic -Both the cupsomatic (old) and the foomatic-rip (new) methods from +Both the cupsomatic (old) and the foomatic-rip (new) methods from Linuxprinting.org use the traditional Ghostscript print file processing, doing everything in a single step. It therefore relies on -all the other devices built-in into Ghostscript. The quality is as +all the other devices built into Ghostscript. The quality is as good (or bad) as Ghostscript rendering is in other spoolers. The advantage is that this method supports many printer models not supported (yet) by the more modern CUPS method. @@ -1780,25 +1761,25 @@ supported (yet) by the more modern CUPS method. Of course, you can use both methods side by side on one system (and -even for one printer, if you set up different queues), and find out +even for one printer, if you set up different queues) and find out which works best for you. -cupsomatic "kidnaps" the printfile after the -application/vnd.cups-postscript stage and -deviates it through the CUPS-external, system wide Ghostscript -installation: Therefore the printfile bypasses the "pstoraster" filter -(and thus also bypasses the CUPS-raster-drivers -"rastertosomething"). After Ghostscript finished its rasterization, -cupsomatic hands the rendered file directly to the CUPS backend. The -flowchart above illustrates the difference between native CUPS -rendering and the Foomatic/cupsomatic method. +cupsomatic kidnaps the printfile after the +application/vnd.cups-postscript stage and +deviates it through the CUPS-external, system-wide Ghostscript +installation. Therefore the printfile bypasses the pstoraster filter +(and also bypasses the CUPS-raster-drivers +rastertosomething). After Ghostscript finished its rasterization, +cupsomatic hands the rendered file directly to the CUPS backend. The +flowchart in illustrates the difference between native CUPS +rendering and the Foomatic/cupsomatic method. -Examples for filtering Chains +Examples for Filtering Chains Here are a few examples of commonly occurring filtering chains to @@ -1806,96 +1787,98 @@ illustrate the workings of CUPS. -Assume you want to print a PDF file to a HP JetDirect-connected +Assume you want to print a PDF file to an HP JetDirect-connected PostScript printer, but you want to print the pages 3-5, 7, 11-13 -only, and you want to print them "2-up" and "duplex": +only, and you want to print them two-up and duplex: -your print options (page selection as required, 2-up, -duplex) are passed to CUPS on the commandline; - -the (complete) PDF file is sent to CUPS and autotyped as -application/pdf; - -the file therefore first must pass the -pdftops pre-filter, which produces PostScript -MIME type application/postscript (a preview here -would still show all pages of the original PDF); - -the file then passes the pstops -filter which applies the commandline options: it selects the pages -2-5, 7 and 11-13, creates and imposed layout "2 pages on 1 sheet" and -inserts the correct "duplex" command (as is defined in the printer's -PPD) into the new PostScript file; the file now is of PostScript MIME +Your print options (page selection as required, two-up, +duplex) are passed to CUPS on the command line. + +The (complete) PDF file is sent to CUPS and autotyped as +application/pdf. + +The file therefore must first pass the +pdftops pre-filter, which produces PostScript +MIME type application/postscript (a preview here +would still show all pages of the original PDF). + +The file then passes the pstops +filter that applies the command line options: it selects the pages +2-5, 7 and 11-13, creates an imposed layout 2 pages on 1 sheet and +inserts the correct duplex command (as defined in the printer's +PPD) into the new PostScript file; the file is now of PostScript MIME type -application/vnd.cups-postscript; +application/vnd.cups-postscript. -the file goes to the socket +The file goes to the socket backend, which transfers the job to the printers. - The resulting filter chain therefore is as drawn in the image below. + The resulting filter chain, therefore, is as drawn in . -pdftosocketPDF to socket chain +pdftosocketPDF to socket chain. Assume your want to print the same filter to an USB-connected -Epson Stylus Photo printer, installed with the CUPS +Epson Stylus Photo printer installed with the CUPS stphoto2.ppd. The first few filtering stages are nearly the same: -your print options (page selection as required, 2-up, -duplex) are passed to CUPS on the commandline; +Your print options (page selection as required, two-up, +duplex) are passed to CUPS on the commandline. -the (complete) PDF file is sent to CUPS and autotyped as -application/pdf; +The (complete) PDF file is sent to CUPS and autotyped as +application/pdf. -the file therefore first must pass the -pdftops pre-filter, which produces PostScript -MIME type application/postscript (a preview here -would still show all pages of the original PDF); +The file must first pass the +pdftops pre-filter, which produces PostScript +MIME type application/postscript (a preview here +would still show all pages of the original PDF). -the file then passes the "pstops" filter which applies +The file then passes the pstops filter that applies the commandline options: it selects the pages 2-5, 7 and 11-13, -creates and imposed layout "2 pages on 1 sheet" and inserts the -correct "duplex" command... (OOoops -- this printer and his PPD -don't support duplex printing at all -- this option will be ignored -then) into the new PostScript file; the file now is of PostScript +creates an imposed layout two pages on one sheet and inserts the +correct duplex command... (Oops &smbmdash; this printer and PPD +do not support duplex printing at all &smbmdash; so this option will +be ignored) into the new PostScript file; the file is now of PostScript MIME type -application/vnd.cups-postscript; +application/vnd.cups-postscript. -the file then passes the -pstoraster stage and becomes MIME type -application/cups-raster; +The file then passes the + +pstoraster stage and becomes MIME type +application/ +cups-raster. -finally, the rastertoepson filter -does its work (as is indicated in the printer's PPD), creating the -printer-specific raster data and embedding any user-selected -print-options into the print data stream; +Finally, the rastertoepson filter +does its work (as indicated in the printer's PPD), creating the +rinter-specific raster data and embedding any user-selected +print-options into the print data stream. -the file goes to the usb backend, +The file goes to the usb backend, which transfers the job to the printers. - The resulting filter chain therefore is as drawn in the image below. +The resulting filter chain therefore is as drawn in . -pdftoepsonusbPDF to USB chain +pdftoepsonusbPDF to USB chain. -Sources of CUPS drivers / PPDs +Sources of CUPS Drivers/PPDs -On the internet you can find now many thousand CUPS-PPD files -(with their companion filters), in many national languages, -supporting more than 1000 non-PostScript models. +On the Internet you can now find many thousands of CUPS-PPD files +(with their companion filters), in many national languages +supporting more than thousand non-PostScript models. @@ -1903,61 +1886,56 @@ supporting more than 1000 non-PostScript models. PrintProESP Print Pro ESP PrintPro (commercial, -non-Free) is packaged with more than 3000 PPDs, ready for -successful use "out of the box" on Linux, Mac OS X, IBM-AIX, -HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital UNIX and some +non-free) is packaged with more than three thousand PPDs, ready for +successful use out of the box on Linux, Mac OS X, IBM-AIX, +HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital UNIX, and some more commercial Unices (it is written by the CUPS developers themselves and its sales help finance the further development of CUPS, as they feed their creators). -the The Gimp-Print-Project - (GPL, Free Software) + (GPL, free software) provides around 140 PPDs (supporting nearly 400 printers, many driven to photo quality output), to be used alongside the Gimp-Print CUPS -filters; +filters. TurboPrint - (Shareware, non-Free) supports + (shareware, non-free) supports roughly the same amount of printers in excellent -quality; +quality. OMNI -(LPGL, Free) is a package made by IBM, now containing support for more +(LPGL, free) is a package made by IBM, now containing support for more than 400 printers, stemming from the inheritance of IBM OS/2 Know-How -ported over to Linux (CUPS support is in a Beta-stage at -present); +ported over to Linux (CUPS support is in a beta-stage at +present). HPIJS - (BSD-style licenses, Free) + (BSD-style licenses, free) supports around 150 of HP's own printers and is also providing excellent print quality now (currently available only via the Foomatic -path); +path). Foomatic/cupsomatic - (LPGL, Free) from + (LPGL, free) from Linuxprinting.org are providing PPDs for practically every Ghostscript filter known to the world (including Omni, Gimp-Print and HPIJS). - -The cupsomatic/Foomatic trick from Linuxprinting.org works -differently from the other drivers. This is explained elsewhere in this -document. - Printing with Interface Scripts -CUPS also supports the usage of "interface scripts" as known from +CUPS also supports the usage of interface scripts as known from System V AT&T printing systems. These are often used for PCL -printers, from applications that generate PCL print jobs. Interface +printers, from applications that generate PCL print jobs. Interface scripts are specific to printer models. They have a similar role as PPDs for PostScript printers. Interface scripts may inject the Escape sequences as required into the print data stream, if the user has @@ -1974,8 +1952,8 @@ the -i option: -Interface scripts might be the "unknown animal" to many. However, -with CUPS they provide the most easy way to plug in your own +Interface scripts might be the unknown animal to many. However, +with CUPS they provide the easiest way to plug in your own custom-written filtering script or program into one specific print queue (some information about the traditional usage of interface scripts is to be found at -Network printing (purely Windows) + Network Printing (Purely Windows) Network printing covers a lot of ground. To understand what exactly goes on with Samba when it is printing on behalf of its Windows -clients, let's first look at a "purely Windows" setup: Windows clients +clients, let's first look at a purely Windows setup: Windows clients with a Windows NT print server. @@ -1999,24 +1977,24 @@ with a Windows NT print server. Windows clients printing to an NT-based print server have two -options. They may - - +options. They may: GDI EMF + + -execute the driver locally and render the GDI output -(EMF) into the printer specific format on their own, -or + Execute the driver locally and render the GDI output + (EMF) into the printer-specific format on their own. + -send the GDI output (EMF) to the server, where the + Send the GDI output (EMF) to the server, where the driver is executed to render the printer specific output. -Both print paths are shown in the flowcharts below. +Both print paths are shown in the flowcharts in and . @@ -2024,19 +2002,19 @@ Both print paths are shown in the flowcharts below. Driver Execution on the Client -In the first case the print server must spool the file as "raw", +In the first case the print server must spool the file as raw, meaning it shouldn't touch the jobfile and try to convert it in any -way. This is what traditional UNIX-based print server can do too; and -at a better performance and more reliably than NT print server. This +way. This is what a traditional UNIX-based print server can do too, and +at a better performance and more reliably than an NT print server. This is what most Samba administrators probably are familiar with. One -advantage of this setup is that this "spooling-only" print server may +advantage of this setup is that this spooling-only print server may be used even if no driver(s) for UNIX are available it is sufficient -to have the Windows client drivers available and installed on the +to have the Windows client drivers available; and installed on the clients. - Print Driver execution on the Client + Print driver execution on the client. 11small @@ -2045,51 +2023,51 @@ clients. Driver Execution on the Server + + PostScript PCL ESC/P EMF GDI - - -The other path executes the printer driver on the server. The clients +The other path executes the printer driver on the server. The client transfers print files in EMF format to the server. The server uses the PostScript, PCL, ESC/P or other driver to convert the EMF file into the printer-specific language. It is not possible for UNIX to do the -same. Currently there is no program or method to convert a Windows +same. Currently, there is no program or method to convert a Windows client's GDI output on a UNIX server into something a printer could understand. - Print Driver execution on the Server + Print driver execution on the server. 12small -However, there is something similar possible with CUPS. Read on... +However, there is something similar possible with CUPS. Read on. -Network Printing (Windows clients -- UNIX/Samba Print +<title>Network Printing (Windows Clients &smbmdash; UNIX/Samba Print Servers) Since UNIX print servers cannot execute the Win32 program code on their platform, the picture is somewhat -different. However, this doesn't limit your options all that -much. In the contrary, you may have a way here to implement printing -features which are not possible otherwise. +different. However, this does not limit your options all that +much. On the contrary, you may have a way here to implement printing +features that are not possible otherwise. From Windows Clients to a CUPS/Samba Print Server -Here is a simple recipe showing how you can take advantage of CUPS +Here is a simple recipe showing how you can take advantage of CUPS' powerful features for the benefit of your Windows network printing clients: @@ -2099,35 +2077,33 @@ clients: Let the Windows clients send PostScript to the CUPS server. -Let the CUPS server render the PostScript into device -specific raster format. +Let the CUPS server render the PostScript into device-specific raster format. This requires the clients to use a PostScript driver (even if the printer is a non-PostScript model. It also requires that you have a -"driver" on the CUPS server. +driver on the CUPS server. -Firstly, to enable CUPS based printing through Samba the +First, to enable CUPS-based rinting through Samba the following options should be set in your &smb.conf; file [global] section: - -printingcups - -printcapcups - + +printingcups +printcapcups + When these parameters are specified, all manually set print directives (like print command, or lppause command) in &smb.conf; (as well as -in samba itself) will be ignored. Instead, Samba will directly -interface with CUPS through it's application program interface (API) - +in Samba itself) will be ignored. Instead, Samba will directly +interface with CUPS through its application program interface (API), as long as Samba has been compiled with CUPS library (libcups) -support. If Samba has NOT been compiled with CUPS support, and if no +support. If Samba has not been compiled with CUPS support, and if no other print commands are set up, then printing will use the System V AT&T command set, with the -oraw option automatically passing through (if you want your own defined @@ -2136,14 +2112,14 @@ simply use printingsysv -Printing via CUPS/samba server +Printing via CUPS/Samba server. 13small -Samba receiving Jobfiles and passing them to CUPS +Samba Receiving Jobfiles and Passing Them to CUPS Samba must use its own spool directory (it is set @@ -2154,62 +2130,66 @@ in the [printers] or spool space and passes it into the spool directory of CUPS (the CUPS spooling directory is set by the RequestRoot directive, in a line that defaults to RequestRoot -/var/spool/cups). CUPS checks the access rights of its -spool dir and resets it to healthy values with every re-start. We have -seen quite some people who had used a common spooling space for Samba -and CUPS, and were struggling for weeks with this "problem". +/var/spool/cups). CUPS checks the access rights of its +spool dir and resets it to healthy values with every restart. We have +seen quite a few people who had used a common spooling space for Samba +and CUPS, and were struggling for weeks with this problem. A Windows user authenticates only to Samba (by whatever means is configured). If Samba runs on the same host as CUPS, you only need to -allow "localhost" to print. If they run on different machines, you +allow localhost to print. If they run on different machines, you need to make sure the Samba host gets access to printing on CUPS. -Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs +Network PostScript RIP + + +This section discusses the use of CUPS filters on the server &smbmdash; configuration where +clients make use of a PostScript driver with CUPS-PPDs. + + + PostScript PCL PJL - - PPDs can control all print device options. They are usually provided -by the manufacturer; if you own a PostScript printer, that is. PPD +by the manufacturer, if you own a PostScript printer, that is. PPD files (PostScript Printer Descriptions) are always a component of PostScript printer drivers on MS Windows or Apple Mac OS systems. They are ASCII files containing user-selectable print options, mapped to appropriate PostScript, PCL or PJL commands for the target printer. Printer driver GUI dialogs translate these options -"on-the-fly" into buttons and drop-down lists for the user to select. +on-the-fly into buttons and drop-down lists for the user to select. CUPS can load, without any conversions, the PPD file from any Windows (NT is recommended) PostScript driver and handle the options. There is -a web browser interface to the print options (select http://localhost:631/printers/ -and click on one Configure Printer button to see -it), or a commandline interface (see man lpoptions -or see if you have lphelp on your system). There are also some +and click on one Configure Printer button to see +it), or a command line interface (see man lpoptions +or see if you have lphelp on your system). There are also some different GUI frontends on Linux/UNIX, which can present PPD options to users. PPD options are normally meant to be evaluated by the PostScript RIP on the real PostScript printer. -PPDs for non-PS Printers on UNIX +PPDs for Non-PS Printers on UNIX -PPD -CUPS doesn't limit itself to "real" PostScript printers in its usage +PPD +CUPS does not limit itself to real PostScript printers in its usage of PPDs. The CUPS developers have extended the scope of the PPD -concept, to also describe available device and driver options for +concept to also describe available device and driver options for non-PostScript printers through CUPS-PPDs. @@ -2219,7 +2199,7 @@ interpreter (RIP). This RIP is based on Ghostscript. It can process all received PostScript (and additionally many other file formats) from clients. All CUPS-PPDs geared to non-PostScript printers contain an additional line, starting with the keyword -*cupsFilter . This line tells the CUPS print +*cupsFilter. This line tells the CUPS print system which printer-specific filter to use for the interpretation of the supplied PostScript. Thus CUPS lets all its printers appear as PostScript devices to its clients, because it can act as a PostScript @@ -2229,36 +2209,36 @@ proper raster print format. -PPDs for non-PS Printers on Windows +PPDs for Non-PS Printers on Windows -PPD +PPD CUPS-PPDs can also be used on Windows-Clients, on top of a -"core" PostScript driver (now recommended is the "CUPS PostScript -Driver for WindowsNT/2K/XP"; you can also use the Adobe one, with +core PostScript driver (now recommended is the "CUPS PostScript +Driver for WindowsNT/200x/XP"; you can also use the Adobe one, with limitations). This feature enables CUPS to do a few tricks no other spooler can do: -act as a networked PostScript RIP (Raster Image +Act as a networked PostScript RIP (Raster Image Processor), handling printfiles from all client platforms in a uniform -way; +way. -act as a central accounting and billing server, since -all files are passed through the pstops filter and are therefore +Act as a central accounting and billing server, since +all files are passed through the pstops filter and are, therefore, logged in the CUPS page_log file. -NOTE: this can not happen with "raw" print jobs, -which always remain unfiltered per definition; +Note: this cannot happen with raw print jobs, +which always remain unfiltered per definition. -enable clients to consolidate on a single PostScript +Enable clients to consolidate on a single PostScript driver, even for many different target printers. Using CUPS PPDs on Windows clients enables these to control -all print job settings just as a UNIX client can do too. +all print job settings just as a UNIX client can do. @@ -2268,123 +2248,123 @@ all print job settings just as a UNIX client can do too. This setup may be of special interest to people experiencing major -problems in WTS environments. WTS need often a multitude of +problems in WTS environments. WTS often need a multitude of non-PostScript drivers installed to run their clients' variety of different printer models. This often imposes the price of much increased instability. -Printer Drivers running in "Kernel Mode" cause many +<title>Printer Drivers Running in <quote>Kernel Mode</quote> Cause Many Problems -The reason is that in Win NT printer drivers run in "Kernel -Mode", this introduces a high risk for the stability of the system + In Windows NT printer drivers which run in Kernel +Mode, introduces a high risk for the stability of the system if the driver is not really stable and well-tested. And there are a lot of bad drivers out there! Especially notorious is the example of the PCL printer driver that had an additional sound module running, to notify users via soundcard of their finished jobs. Do I -need to say that this one was also reliably causing "Blue Screens -of Death" on a regular basis? +need to say that this one was also reliably causing blue screens +of death on a regular basis? -PostScript drivers generally are very well tested. They are not known -to cause any problems, even though they run in Kernel Mode too. This -might be because there have so far only been 2 different PostScript +PostScript drivers are generally well tested. They are not known +to cause any problems, even though they also run in kernel mode. This +might be because there have been so far only two different PostScript drivers: the ones from Adobe and the one from Microsoft. Both are -very well tested and are as stable as you ever can imagine on +well tested and are as stable as you can imagine on Windows. The CUPS driver is derived from the Microsoft one. -Workarounds impose Heavy Limitations +Workarounds Impose Heavy Limitations In many cases, in an attempt to work around this problem, site -administrators have resorted to restrict the allowed drivers installed -on their WTS to one generic PCL- and one PostScript driver. This -however restricts the clients in the amount of printer options -available for them; often they can't get out more than simplex +administrators have resorted to restricting the allowed drivers installed +on their WTS to one generic PCL and one PostScript driver. This, +however, restricts the clients in the number of printer options +available for them. Often they can't get out more than simplex prints from one standard paper tray, while their devices could do much -better, if driven by a different driver! ) +better, if driven by a different driver! -CUPS: a "Magical Stone"? +CUPS: A <quote>Magical Stone</quote>? -PPD -PostScript +PPD +PostScript Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very elegant way to overcome all these shortcomings. There are, depending -on the version of Windows OS you use, up to 3 different PostScript +on the version of Windows OS you use, up to three different PostScript drivers available: Adobe, Microsoft and CUPS PostScript drivers. None of them is known to cause major stability problems on WTS (even if used with many different PPDs). The clients will be able to (again) chose paper trays, duplex printing and other settings. However, there is a certain price for this too: a CUPS server acting as a PostScript RIP for its clients requires more CPU and RAM than when just acting as -a "raw spooling" device. Plus, this setup is not yet widely tested, +a raw spooling device. Plus, this setup is not yet widely tested, although the first feedbacks look very promising. -PostScript Drivers with no major problems -- even in Kernel +<title>PostScript Drivers with No Major Problems &smbmdash; Even in Kernel Mode -DDK -More recent printer drivers on W2K and XP don't run in Kernel mode -(unlike Win NT) any more. However, both operating systems can still -use the NT drivers, running in Kernel mode (you can roughly tell which -is which as the drivers in subdirectory "2" of "W32X86" are "old" -ones). As was said before, the Adobe as well as the Microsoft +DDK +More recent printer drivers on W200x and XP no longer run in kernel mode +(unlike Windows NT). However, both operating systems can still +use the NT drivers, running in kernel mode (you can roughly tell which +is which as the drivers in subdirectory 2 of W32X86 are old +ones). As was said before, the Adobe as well as the Microsoft PostScript drivers are not known to cause any stability problems. The CUPS driver is derived from the Microsoft one. There is a simple -reason for this: The MS DDK (Device Development Kit) for Win NT (which +reason for this: The MS DDK (Device Development Kit) for Windows NT (which used to be available at no cost to licensees of Visual Studio) includes the source code of the Microsoft driver, and licensees of Visual Studio are allowed to use and modify it for their own driver development efforts. This is what the CUPS people have done. The -license doesn't allow them to publish the whole of the source code. -However, they have released the "diff" under the GPL, and if you are -owner of an "MS DDK for Win NT", you can check the driver yourself. +license does not allow them to publish the whole of the source code. +However, they have released the diff under the GPL, and if you are +the owner of an MS DDK for Windows NT, you can check the driver yourself. -Setting up CUPS for driver Download +Configuring CUPS for Driver Download -As we have said before: all previously known methods to prepare client -printer drivers on the Samba server for download and "Point'n'Print" -convenience of Windows workstations are working with CUPS too. These +As we have said before, all previously known methods to prepare client +printer drivers on the Samba server for download and Point'n'Print +convenience of Windows workstations are working with CUPS, too. These methods were described in the previous chapter. In reality, this is a -pure Samba business, and only relates to the Samba/Win client +pure Samba business and only relates to the Samba/Windows client relationship. -<emphasis>cupsaddsmb</emphasis>: the unknown Utility +<emphasis>cupsaddsmb</emphasis>: The Unknown Utility -cupsaddsmb -The cupsaddsmb utility (shipped with all current CUPS versions) is an -alternative method to transfer printer drivers into the Samba +cupsaddsmb +The cupsaddsmb utility (shipped with all current CUPS versions) is an +alternate method to transfer printer drivers into the Samba [print$] share. Remember, this share is where clients expect drivers deposited and setup for download and -installation. It makes the sharing of any (or all) installed CUPS -printers very easy. cupsaddsmb can use the Adobe PostScript driver as -well as the newly developed CUPS PostScript Driver for -WinNT/2K/XP. Note, that cupsaddsmb does +installation. It makes the sharing of any (or all) installed CUPS +printers quite easy. cupsaddsmb can use the Adobe PostScript driver as +well as the newly developed CUPS PostScript Driver for +Windows NT/200x/XP. cupsaddsmb does not work with arbitrary vendor printer drivers, but only with the exact driver files that are named in its man page. @@ -2398,34 +2378,34 @@ advantages: -it supports a much more accurate page -accounting; +It supports a much more accurate page +accounting. -it supports banner pages, and page labels on all -printers; +It supports banner pages, and page labels on all +printers. -it supports the setting of a number of job IPP +It supports the setting of a number of job IPP attributes (such as job-priority, page-label and -job-billing) +job-billing). -However, currently only Windows NT, 2000, and XP are supported by the -CUPS drivers. You will need to get the respective part of Adobe driver -too if you need to support Windows 95, 98, and ME clients. +However, currently only Windows NT, 2000 and XP are supported by the +CUPS drivers. You will also need to get the respective part of Adobe driver +if you need to support Windows 95, 98 and ME clients. -Prepare your &smb.conf; for cupsaddsmb + Prepare Your &smb.conf; for <command>cupsaddsmb</command> -Prior to running cupsaddsmb, you need the following settings in -&smb.conf;: +Prior to running cupsaddsmb, you need the settings in +&smb.conf; as shown in : - - smb.conf for cupsaddsmb usage + +smb.conf for cupsaddsmb usage [global] load printersyes printingcups @@ -2452,16 +2432,16 @@ Prior to running cupsaddsmb, you need the following settings in -CUPS Package of "PostScript Driver for WinNT/2k/XP" -PostScript +CUPS <quote>PostScript Driver for Windows NT/200x/XP</quote> -CUPS users may get the exactly same packages from PostScript +CUPS users may get the exact same packages from http://www.cups.org/software.html. It is a separate package from the CUPS base software files, tagged as -CUPS 1.1.x Windows NT/2k/XP Printer Driver for Samba -(tar.gz, 192k). The filename to download is -cups-samba-1.1.x.tar.gz. Upon untar-/unzip-ing, +CUPS 1.1.x Windows NT/200x/XP Printer Driver for Samba +(tar.gz, 192k). The filename to download is +cups-samba-1.1.x.tar.gz. Upon untar and unzipping, it will reveal these files: @@ -2478,12 +2458,12 @@ cups-samba.ss ESPmeta packager EPMESP meta packager These have been packaged with the ESP meta packager software -"EPM". The *.install and +EPM. The *.install and *.remove files are simple shell scripts, which untars the *.ss (the *.ss is -nothing else but a tar-archive, which can be untar-ed by "tar" +nothing else but a tar-archive, which can be untarred by tar too). Then it puts the content into -/usr/share/cups/drivers/. This content includes 3 +/usr/share/cups/drivers/. This content includes three files: @@ -2495,7 +2475,7 @@ cups.hlp -The cups-samba.install shell scripts is easy to +The cups-samba.install shell scripts are easy to handle: @@ -2505,7 +2485,7 @@ handle: Installing software... Updating file permissions... Running post-install commands... -Installation is complete. +Installation is complete. @@ -2520,81 +2500,81 @@ into/usr/share/drivers/ instead of /usr/share/cups/drivers/. To work around this, copy/move the file (after running the ./cups-samba.install script) manually to the -right place. +correct place. &rootprompt;cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/ -DDK +DDK This new CUPS PostScript driver is currently binary-only, but free of -charge. No complete source code is provided (yet). The reason is this: -it has been developed with the help of the Microsoft Driver -Developer Kit (DDK) and compiled with Microsoft Visual +charge. No complete source code is provided (yet). The reason is that +it has been developed with the help of the Microsoft Driver +Developer Kit (DDK) and compiled with Microsoft Visual Studio 6. Driver developers are not allowed to distribute the whole of -the source code as Free Software. However, CUPS developers released -the "diff" in source code under the GPL, so anybody with a license of +the source code as free software. However, CUPS developers released +the diff in source code under the GPL, so anybody with a license of Visual Studio and a DDK will be able to compile for him/herself. -Recognize the different Driver Files +Recognizing Different Driver Files -The CUPS drivers don't support the "older" Windows 95/98/ME, but only -the Windows NT/2000/XP client: +The CUPS drivers do not support the older Windows 95/98/Me, but only +the Windows NT/2000/XP client. -Windows NT, 2000, and XP are supported by: +Windows NT, 2000 and XP are supported by: - cups.hlp - cupsdrvr.dll - cupsui.dll + cups.hlp + cupsdrvr.dll + cupsui.dll -Adobe drivers are available for the older Windows 95/98/ME as well as -the Windows NT/2000/XP clients. The set of files is different for the +Adobe drivers are available for the older Windows 95/98/Me as well as +the Windows NT/2000/XP clients. The set of files is different from the different platforms. -Windows 95, 98, and Me are supported by: +Windows 95, 98 and ME are supported by: - ADFONTS.MFM - ADOBEPS4.DRV - ADOBEPS4.HLP - DEFPRTR2.PPD - ICONLIB.DLL - PSMON.DLL + ADFONTS.MFM + ADOBEPS4.DRV + ADOBEPS4.HLP + DEFPRTR2.PPD + ICONLIB.DLL + PSMON.DLL -Windows NT, 2000, and XP are supported by: +Windows NT, 2000 and XP are supported by: - ADOBEPS5.DLL - ADOBEPSU.DLL - ADOBEPSU.HLP + ADOBEPS5.DLL + ADOBEPSU.DLL + ADOBEPSU.HLP -If both, the Adobe driver files and the CUPS driver files for the -support of WinNT/2k/XP are present in , the Adobe ones will be ignored -and the CUPS ones will be used. If you prefer -- for whatever reason --- to use Adobe-only drivers, move away the 3 CUPS driver files. The -Win95/98/ME clients use the Adobe drivers in any case. +If both the Adobe driver files and the CUPS driver files for the +support of Windows NT/200x/XP are present in FIXME, the Adobe ones will be ignored +and the CUPS ones will be used. If you prefer &smbmdash; for whatever reason +&smbmdash; to use Adobe-only drivers, move away the three CUPS driver files. The +Windows 9x/Me clients use the Adobe drivers in any case. @@ -2603,60 +2583,57 @@ Win95/98/ME clients use the Adobe drivers in any case. Acquiring the Adobe driver files seems to be unexpectedly difficult -for many users. They are not available on the Adobe website as single -files and the self-extracting and/or self-installing Windows-exe is +for many users. They are not available on the Adobe Web site as single +files and the self-extracting and/or self-installing Windows-.exe is not easy to locate either. Probably you need to use the included native installer and run the installation process on one client once. This will install the drivers (and one Generic PostScript -printer) locally on the client. When they are installed, share the -Generic PostScript printer. After this, the client's +printer) locally on the client. When they are installed, share the +Generic PostScript printer. After this, the client's [print$] share holds the Adobe files, from -where you can get them with smbclient from the CUPS host. A more -detailed description about this is in the next (the CUPS printing) -chapter. +where you can get them with smbclient from the CUPS host. -ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP" +ESP Print Pro PostScript Driver for Windows NT/200x/XP -ESPPrint Pro -Users of the ESP Print Pro software are able to install their "Samba -Drivers" package for this purpose with no problem. Retrieve the driver +ESPPrint Pro +Users of the ESP Print Pro software are able to install their Samba +drivers package for this purpose with no problem. Retrieve the driver files from the normal download area of the ESP Print Pro software at http://www.easysw.com/software.html. -You need to locate the link labelled "SAMBA" amongst the -Download Printer Drivers for ESP Print Pro 4.x +You need to locate the link labelled SAMBA among the +Download Printer Drivers for ESP Print Pro 4.x area and download the package. Once installed, you can prepare any driver by simply highlighting the printer in the Printer Manager GUI -and select Export Driver... from the menu. Of -course you need to have prepared Samba beforehand too to handle the -driver files; i.e. mainly setup the [print$] -share, etc. The ESP Print Pro package includes the CUPS driver files -as well as a (licensed) set of Adobe drivers for the Windows 95/98/ME +and select Export Driver... from the menu. Of +course you need to have prepared Samba beforehand to handle the +driver files; i.e., setup the [print$] +share, and so on. The ESP Print Pro package includes the CUPS driver files +as well as a (licensed) set of Adobe drivers for the Windows 95/98/Me client family. -Caveats to be considered +Caveats to be Considered -cupsaddsmb +cupsaddsmb Once you have run the install script (and possibly manually moved the cups.hlp file to /usr/share/cups/drivers/), the driver is ready to be put into Samba's [print$] share (which often maps to -/etc/samba/drivers/ and contains a subdir +/etc/samba/drivers/ and contains a subdirectory tree with WIN40 and -W32X86 branches): You do this by running -"cupsaddsmb" (see also man cupsaddsmb for +W32X86 branches). You do this by running +cupsaddsmb (see also man cupsaddsmb for CUPS since release 1.1.16). @@ -2666,159 +2643,155 @@ You may need to put root into the smbpasswd file by running smbpasswd; this is especially important if you should run this whole procedure for the first time, and are not working in an environment where everything is configured for -Single Sign On to a Windows Domain Controller. +single sign on to a Windows Domain Controller. Once the driver files are in the [print$] share and are initialized, they are ready to be downloaded and installed by -the Win NT/2k/XP clients. +the Windows NT/200x/XP clients. - - -Win 9x/ME clients won't work with the CUPS PostScript driver. For -these you'd still need to use the ADOBE*.* -drivers as previously. - +Win 9x/Me clients will not work with the CUPS PostScript driver. For +these you still need to use the ADOBE*.* +drivers as previously stated. + - + + It is not harmful if you still have the ADOBE*.* driver files from previous installations in the /usr/share/cups/drivers/ -directory. The new cupsaddsmb (from 1.1.16) will -automatically prefer "its own" drivers if it finds both. - +directory. The new cupsaddsmb (from 1.1.16) will +automatically prefer its own drivers if it finds both. + - + "Printers" folder -Should your Win clients have had the old ADOBE*.* +Should your Windows clients have had the old ADOBE*.* files for the Adobe PostScript driver installed, the download and -installation of the new CUPS PostScript driver for Windows NT/2k/XP +installation of the new CUPS PostScript driver for Windows NT/200x/XP will fail at first. You need to wipe the old driver from the clients -first. It is not enough to "delete" the printer, as the driver files +first. It is not enough to delete the printer, as the driver files will still be kept by the clients and re-used if you try to re-install the printer. To really get rid of the Adobe driver files on the -clients, open the "Printers" folder (possibly via Start, Settings, Control Panel, Printers), -right-click onto the folder background and select Server -Properties. When the new dialog opens, select the -Drivers tab. On the list select the driver you -want to delete and click on the Delete +clients, open the Printers folder (possibly via Start > Settings > Control Panel > Printers), +right-click on the folder background and select Server +Properties. When the new dialog opens, select the +Drivers tab. On the list select the driver you +want to delete and click the Delete button. This will only work if there is not one single printer left -which uses that particular driver. You need to "delete" all printers -using this driver in the "Printers" folder first. You will need +that uses that particular driver. You need to delete all printers +using this driver in the Printers folder first. You will need Administrator privileges to do this. - + - + rpcclientsetdriver Once you have successfully downloaded the CUPS PostScript driver to a client, you can easily switch all printers to this one by proceeding -as described in the printing chapter: either change -a driver for an existing printer by running the "Printer Properties" +as described in . Either change +a driver for an existing printer by running the Printer Properties dialog, or use rpcclient with the -setdriver sub-command. - - +setdriver subcommand. -Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver +Windows CUPS PostScript Driver Versus Adobe Driver -You are interested in a comparison between the CUPS and the Adobe +Are you interested in a comparison between the CUPS and the Adobe PostScript drivers? For our purposes these are the most important -items which weigh in favor of the CUPS ones: +items that weigh in favor of the CUPS ones: -no hassle with the Adobe EULA +No hassle with the Adobe EULA. -no hassle with the question Where do I +No hassle with the question Where do I get the ADOBE*.* driver files from? PJL - the Adobe drivers (on request of the printer PPD +The Adobe drivers (on request of the printer PPD associated with them) often put a PJL header in front of the main -PostScript part of the print file. Thus the printfile starts with +PostScript part of the print file. Thus, the printfile starts with <1B >%-12345X or <escape>%-12345X instead of %!PS). This leads to the CUPS daemon auto-typing the incoming file as a print-ready file, -not initiating a pass through the "pstops" filter (to speak more -technically, it is not regarded as the generic MIME type +not initiating a pass through the pstops filter (to speak more +technically, it is not regarded as the generic MIME-type application/postscript -application/postscript, but as +application/postscript, but as the more special MIME type application/cups.vnd-postscript -application/cups.vnd-postscript), +application/cups.vnd-postscript), which therefore also leads to the page accounting in -/var/log/cups/page_log not +/var/log/cups/page_log not receiving the exact number of pages; instead the dummy page number -of "1" is logged in a standard setup) +of 1 is logged in a standard setup). -the Adobe driver has more options to "mis-configure" the +The Adobe driver has more options to misconfigure the PostScript generated by it (like setting it inadvertently to -Optimize for Speed, instead of -Optimize for Portability, which -could lead to CUPS being unable to process it) - -the CUPS PostScript driver output sent by Windows -clients to the CUPS server will be guaranteed to be auto-typed always -as generic MIME type application/postscript, -thusly passing through the CUPS "pstops" filter and logging the +Optimize for Speed, instead of +Optimize for Portability, which +could lead to CUPS being unable to process it). + +The CUPS PostScript driver output sent by Windows +clients to the CUPS server is guaranteed to auto-type +as the generic MIME type application/postscript, +thus passing through the CUPS pstops filter and logging the correct number of pages in the page_log for -accounting and quota purposes +accounting and quota purposes. -the CUPS PostScript driver supports the sending of -additional standard (IPP) print options by Win NT/2k/XP clients. Such +The CUPS PostScript driver supports the sending of +additional standard (IPP) print options by Windows NT/200x/XP clients. Such additional print options are: naming the CUPS standard banner pages (or the custom ones, should they be installed at the time of driver download), using the CUPS -page-label option, setting a -job-priority and setting the scheduled -time of printing (with the option to support additional +page-label option, setting a +job-priority, and setting the scheduled +time of printing (with the option to support additional useful IPP job attributes in the future). -the CUPS PostScript driver supports the inclusion of -the new *cupsJobTicket comments at the +The CUPS PostScript driver supports the inclusion of +the new *cupsJobTicket comments at the beginning of the PostScript file (which could be used in the future for all sort of beneficial extensions on the CUPS side, but which will not disturb any other applications as they will regard it as a comment and simply ignore it). -the CUPS PostScript driver will be the heart of the -fully fledged CUPS IPP client for Windows NT/2K/XP to be released soon -(probably alongside the first Beta release for CUPS +The CUPS PostScript driver will be the heart of the +fully fledged CUPS IPP client for Windows NT/200x/XP to be released soon +(probably alongside the first beta release for CUPS 1.2). -Run "cupsaddsmb" (quiet Mode) +Run cupsaddsmb (Quiet Mode) -cupsaddsmb -point and print -The cupsaddsmb command copies the needed files into your +cupsaddsmb +point 'n' print +The cupsaddsmb command copies the needed files into your [print$] share. Additionally, the PPD associated with this printer is copied from /etc/cups/ppd/ to [print$]. There the files wait for convenient Windows client installations via Point'n'Print. Before we can run the command successfully, we need to be sure that we can authenticate -towards Samba. If you have a small network you are probably using user -level security (securityuser). +toward Samba. If you have a small network, you are probably using user-level +security (securityuser). -Here is an example of a successfully run cupsaddsmb command. +Here is an example of a successfully run cupsaddsmb command: @@ -2829,20 +2802,20 @@ Password for root required to access localhost via Samba: ['secret']< To share all printers and drivers, use the parameter instead of a printer name. Since -cupsaddsmb "exports" the printer drivers to Samba, it should be +cupsaddsmb exports the printer drivers to Samba, it should be obvious that it only works for queues with a CUPS driver associated. -Run "cupsaddsmb" with verbose Output +Run cupsaddsmb with Verbose Output -cupsaddsmb +cupsaddsmb Probably you want to see what's going on. Use the parameter to get a more verbose output. The -output below was edited for better readability: all "\" at the end of +output below was edited for better readability: all \ at the end of a line indicate that I inserted an artificial line break plus some indentation here: @@ -2852,9 +2825,11 @@ You will see the root password for the Samba account printed on screen. + + rpcclientadddriver rpcclientsetdriver - + &rootprompt;cupsaddsmb -U root -v infotec_2105 Password for root required to access localhost via &example.server.samba;: Running command: smbclient //localhost/print\$ -N -U'root%secret' \ @@ -2873,10 +2848,11 @@ putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp Running command: rpcclient localhost -N -U'root%secret' -c 'adddriver "Windows NT x86" \ - "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \ + "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \ RAW:NULL"' cmd = adddriver "Windows NT x86" \ - "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:RAW:NULL" + "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \ + RAW:NULL" Printer Driver infotec_2105 successfully installed. Running command: smbclient //localhost/print\$ -N -U'root%secret' \ @@ -2904,9 +2880,10 @@ Running command: smbclient //localhost/print\$ -N -U'root%secret' \ "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP: \ PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL, \ ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"' - cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL: \ - ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP, \ - PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL" + cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:\ + infotec_2105.PPD:NULL:ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,\ + infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,\ + ICONLIB.DLL" Printer Driver infotec_2105 successfully installed. Running command: rpcclient localhost -N -U'root%secret' \ @@ -2918,101 +2895,99 @@ Running command: smbclient //localhost/print\$ -N -U'root%secret' \ If you look closely, you'll discover your root password was transferred -unencrypted over the wire, so beware! Also, if you look further her, -you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in -between. They occur, because the directories WIN40 and W32X86 already -existed in the [print$] driver download share -(from a previous driver installation). They are harmless here. +unencrypted over the wire, so beware! Also, if you look further, +you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in between. They occur, because the directories WIN40 and W32X86 already existed in the [print$] driver download share (from a previous driver installation). They are harmless here. Understanding cupsaddsmb -cupsaddsmb -What has happened? What did cupsaddsmb do? There are five stages of -the procedure +cupsaddsmb +What has happened? What did cupsaddsmb do? There are five stages of +the procedure: IPP - call the CUPS server via IPP and request the -driver files and the PPD file for the named printer; + Call the CUPS server via IPP and request the +driver files and the PPD file for the named printer. -store the files temporarily in the local +Store the files temporarily in the local TEMPDIR (as defined in -cupsd.conf); +cupsd.conf). -connect via smbclient to the Samba server's +Connect via smbclient to the Samba server's [print$] share and put the files into the - share's WIN40 (for Win95/98/ME) and W32X86/ (for WinNT/2k/XP) sub - directories; + share's WIN40 (for Windows 9x/Me) and W32X86/ (for Windows NT/200x/XP) subdirectories. rpcclientadddriver - connect via rpcclient to the Samba server and -execute the "adddriver" command with the correct -parameters; + Connect via rpcclient to the Samba server and +execute the adddriver command with the correct +parameters. rpcclientsetdriver - connect via rpcclient to the Samba server a second -time and execute the "setdriver" command. + Connect via rpcclient to the Samba server a second +time and execute the setdriver command. + -Note, that you can run the cupsaddsmb utility with parameters to +You can run the cupsaddsmb utility with parameters to specify one remote host as Samba host and a second remote host as CUPS host. Especially if you want to get a deeper understanding, it is a -good idea try it and see more clearly what is going on (though in real +good idea to try it and see more clearly what is going on (though in real life most people will have their CUPS and Samba servers run on the same host): -&rootprompt;cupsaddsmb -H sambaserver -h cupsserver -v printername +&rootprompt;cupsaddsmb -H sambaserver -h cupsserver -v printer + -How to recognize if cupsaddsmb completed successfully +How to Recognize If cupsaddsmb Completed Successfully You must always check if the utility completed -successfully in all fields. You need as a minimum these 3 messages -amongst the output: +successfully in all fields. You need as a minimum these three messages +among the output: Printer Driver infotec_2105 successfully -installed. # (for the W32X86 == WinNT/2K/XP -architecture...) +installed. # (for the W32X86 == Windows NT/200x/XP +architecture). Printer Driver infotec_2105 successfully -installed. # (for the WIN40 == Win9x/ME -architecture...) +installed. # (for the WIN40 == Windows 9x/Me +architecture). Successfully set [printerXPZ] to driver [printerXYZ]. -These messages probably not easily recognized in the general -output. If you run cupsaddsmb with the +These messages are probably not easily recognized in the general +output. If you run cupsaddsmb with the parameter (which tries to prepare all active CUPS printer drivers for download), you might miss if individual printers -drivers had problems to install properly. Here a redirection of the +drivers had problems installing properly. Here a redirection of the output will help you analyze the results in retrospective. -It is impossible to see any diagnostic output if you don't run -cupsaddsmb in verbose mode. Therefore we strongly recommend to not -use the default quiet mode. It will hide any problems from you which +It is impossible to see any diagnostic output if you do not run +cupsaddsmb in verbose mode. Therefore, we strongly recommend to not +use the default quiet mode. It will hide any problems from you that might occur. @@ -3020,11 +2995,11 @@ might occur. cupsaddsmb with a Samba PDC -cupsaddsmb -You can't get the standard cupsaddsmb command to run on a Samba PDC? -You are asked for the password credential all over again and again and +cupsaddsmb +Can't get the standard cupsaddsmb command to run on a Samba PDC? +Are you asked for the password credential all over again and again and the command just will not take off at all? Try one of these variations: @@ -3037,22 +3012,22 @@ variations: (Note the two backslashes: the first one is required to -"escape" the second one). +escape the second one). cupsaddsmb Flowchart -cupsaddsmb -Here is a chart about the procedures, commandflows and -dataflows of the "cupaddsmb" command. Note again: cupsaddsmb is -not intended to, and does not work with, "raw" queues! +cupsaddsmb + shows a chart about the procedures, commandflows and +dataflows of the cupaddsmb command. Note again: cupsaddsmb is +not intended to, and does not work with, raw queues! - cupsaddsmb flowchart + cupsaddsmb flowchart. 14small @@ -3060,50 +3035,51 @@ not intended to, and does not work with, "raw" queues! Installing the PostScript Driver on a Client -point and print -After cupsaddsmb completed, your driver is prepared for the clients to +point 'n' print +After cupsaddsmb is completed, your driver is prepared for the clients to use. Here are the steps you must perform to download and install it -via "Point'n'Print". From a Windows client, browse to the CUPS/Samba -server; +via Point'n'Print. From a Windows client, browse to the CUPS/Samba +server: -"Printers" folder -open the Printers -share of Samba in Network Neighbourhood; + +"Printers" folder +Open the Printers +share of Samba in Network Neighborhood. -right-click on the printer in -question; +Right-click on the printer in +question. -from the opening context-menu select -Install... or -Connect... (depending on the Windows version you +From the opening context-menu select +Install... or +Connect... (depending on the Windows version you use). After a few seconds, there should be a new printer in your -client's local "Printers" folder: On Windows +client's local Printers folder. On Windows XP it will follow a naming convention of PrinterName on SambaServer. (In my current case it is "infotec_2105 on kde-bitshop"). If you want to test it and send your first job from -an application like Winword, the new printer will appears in a +an application like Winword, the new printer appears in a \\SambaServer\PrinterName entry in the -dropdown list of available printers. +drop-down list of available printers. - + PPD -cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher -and Samba from 2.2.4. If it doesn't work, or if the automatic printer -driver download to the clients doesn't succeed, you can still manually +cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher +and Samba from 2.2.4. If it does not work, or if the automatic printer +driver download to the clients does not succeed, you can still manually install the CUPS printer PPD on top of the Adobe PostScript driver on clients. Then point the client's printer queue to the Samba printer share for a UNC type of connection: - + &dosprompt;net use lpt1: \\sambaserver\printershare /user:ntadmin @@ -3111,21 +3087,20 @@ share for a UNC type of connection: should you desire to use the CUPS networked PostScript RIP -functions. (Note that user "ntadmin" needs to be a valid Samba user -with the required privileges to access the printershare) This would -set up the printer connection in the traditional +functions. (Note that user ntadmin needs to be a valid Samba user +with the required privileges to access the printershare.) This +sets up the printer connection in the traditional LanMan way (not using MS-RPC). -Avoiding critical PostScript Driver Settings on the -Client +Avoiding Critical PostScript Driver Settings on the Client -Soooo: printing works, but there are still problems. Most jobs print -well, some don't print at all. Some jobs have problems with fonts, -which don't look very good. Some jobs print fast, and some are +Printing works, but there are still problems. Most jobs print +well, some do not print at all. Some jobs have problems with fonts, +which do not look very good. Some jobs print fast and some are dead-slow. Many of these problems can be greatly reduced or even completely eliminated if you follow a few guidelines. Remember, if your print device is not PostScript-enabled, you are treating your @@ -3134,63 +3109,62 @@ driver settings produce. Treat it well: -Avoid the PostScript Output Option: Optimize -for Speed setting. Rather use the Optimize for -Portability instead (Adobe PostScript +Avoid the PostScript Output Option: Optimize +for Speed setting. Use the Optimize for +Portability instead (Adobe PostScript driver). -Don't use the Page Independence: -NO setting. Instead use Page Independence -YES (CUPS PostScript Driver) +Don't use the Page Independence: +NO setting. Instead, use Page Independence +YES (CUPS PostScript Driver). -Recommended is the True Type Font -Downloading Option: Native True Type over -Automatic and Outline; you -should by all means avoid Bitmap (Adobe -PostScript Driver) +Recommended is the True Type Font +Downloading Option: Native True Type over +Automatic and Outline; you +should by all means avoid Bitmap (Adobe +PostScript Driver). -Choose True Type Font: Download as Softfont -into Printer over the default Replace by Device -Font (for exotic fonts you may need to change it back to -get a printout at all) (Adobe) +Choose True Type Font: Download as Softfont +into Printer over the default Replace by Device +Font (for exotic fonts, you may need to change it back to +get a printout at all) (Adobe). -Sometimes you can choose PostScript Language -Level: in case of problems try 2 -instead of 3 (the latest ESP Ghostscript package +Sometimes you can choose PostScript Language +Level: In case of problems try 2 +instead of 3 (the latest ESP Ghostscript package handles Level 3 PostScript very well) (Adobe). -Say Yes to PostScript -Error Handler (Adobe) +Say Yes to PostScript +Error Handler (Adobe). -Installing PostScript Driver Files manually (using -rpcclient) +Installing PostScript Driver Files Manually Using rpcclient -Of course you can run all the commands which are embedded into the +Of course, you can run all the commands that are embedded into the cupsaddsmb convenience utility yourself, one by one, and hereby upload and prepare the driver files for future client downloads. -prepare Samba (a CUPS printqueue with the name of the +Prepare Samba (A CUPS print queue with the name of the printer should be there. We are providing the driver -now); +now). -copy all files to - [print$] +Copy all files to + [print$]. rpcclientadddriver - run rpcclient adddriver -(for each client architecture you want to support): +Run rpcclient adddriver +(for each client architecture you want to support). rpcclientsetdriver - run rpcclient +Run rpcclient setdriver. @@ -3200,33 +3174,33 @@ setdriver. rpcclientenumdrivers rpcclientsetdriver rpcclientadddriver -We are going to do this now. First, read the man page on "rpcclient" +We are going to do this now. First, read the man page on rpcclient to get a first idea. Look at all the printing related -sub-commands. enumprinters, +subcommands. enumprinters, enumdrivers, enumports, -adddriver, setdriver are amongst -the most interesting ones. rpcclient implements an important part of -the MS-RPC protocol. You can use it to query (and command) a Win NT -(or 2K/XP) PC too. MS-RPC is used by Windows clients, amongst other -things, to benefit from the "Point'n'Print" features. Samba can now -mimic this too. +adddriver, setdriver are among +the most interesting ones. rpcclient implements an important part of +the MS-RPC protocol. You can use it to query (and command) a Windows NT +(or 200x/XP) PC, too. MS-RPC is used by Windows clients, among other +things, to benefit from the Point'n'Print features. Samba can now +mimic this as well. A Check of the rpcclient man Page -First let's have a little check of the rpcclient man page. Here are + First let's check the rpcclient man page. Here are two relevant passages: adddriver <arch> <config> Execute an -AddPrinterDriver() RPC to install the printer driver information on -the server. Note that the driver files should already exist in the -directory returned by getdriverdir. Possible +AddPrinterDriver() RPC to install the printer driver information on +the server. The driver files should already exist in the +directory returned by getdriverdir. Possible values for arch are the same as those for the -getdriverdir command. The +getdriverdir command. The config parameter is defined as follows: @@ -3241,14 +3215,14 @@ Default Data Type:\ Comma Separated list of Files -Any empty fields should be enter as the string "NULL". +Any empty fields should be enter as the string NULL. Samba does not need to support the concept of Print Monitors since these only apply to local printers whose driver can make use of -a bi-directional link for communication. This field should be "NULL". +a bi-directional link for communication. This field should be NULL. On a remote NT print server, the Print Monitor for a driver must already be installed prior to adding the driver or else the RPC will -fail +fail. @@ -3258,24 +3232,23 @@ printer driver associated with an installed printer. The printer driver must already be correctly installed on the print server. - See also the enumprinters and enumdrivers commands for +See also the enumprinters and enumdrivers commands for obtaining a list of installed printers and drivers. -Understanding the rpcclient man page +Understanding the rpcclient man Page The exact format isn't made too clear by the man page, since you have to deal with some parameters containing spaces. Here is a better description for it. We have line-broken the -command and indicated the breaks with "\". Usually you would type the +command and indicated the breaks with \. Usually you would type the command in one line without the linebreaks: - - rpcclientadddriver + adddriver "Architecture" \ @@ -3284,59 +3257,59 @@ command in one line without the linebreaks: -What the man pages denotes as a simple <config> -keyword, does in reality consist of 8 colon-separated fields. The -last field may take multiple (in some, very insane, cases, even -20 different additional files. This might sound confusing at first. -Note, that what the man pages names the "LongPrinterName" in -reality should rather be called the "Driver Name". You can name it +What the man pages denote as a simple <config> +keyword, in reality consists of eight colon-separated fields. The +last field may take multiple (in some very insane cases, even +20 different additional) files. This might sound confusing at first. +What the man pages names the LongPrinterName in +reality should be called the Driver Name. You can name it anything you want, as long as you use this name later in the -rpcclient ... setdriver command. For +rpcclient ... setdriver command. For practical reasons, many name the driver the same as the printer. -True: it isn't simple at all. I hear you asking: -How do I know which files are "Driver -File", "Data File", "Config File", "Help File" and "Language -Monitor File" in each case? -- For an answer you may +It isn't simple at all. I hear you asking: +How do I know which files are "Driver +File, Data File, Config File, Help File and Language +Monitor File" in each case? &smbmdash; For an answer, you may want to have a look at how a Windows NT box with a shared printer presents the files to us. Remember, that this whole procedure has -to be developed by the Samba Team by overhearing the traffic caused +to be developed by the Samba team by overhearing the traffic caused by Windows computers on the wire. We may as well turn to a Windows -box now, and access it from a UNIX workstation. We will query it +box now and access it from a UNIX workstation. We will query it with rpcclient to see what it tells us and -try to understand the man page more clearly which we've read just +try to understand the man page more clearly that we've read just now. -Producing an Example by querying a Windows Box +Producing an Example by Querying a Windows Box rpcclientgetdriver rpcclientgetprinter We could run rpcclient with a getdriver or a getprinter -subcommand (in level 3 verbosity) against it. Just sit down at UNIX or -Linux workstation with the Samba utilities installed. Then type the +subcommand (in level 3 verbosity) against it. Just sit down at a UNIX or +Linux workstation with the Samba utilities installed, then type the following command: -&rootprompt;rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3' +&rootprompt;rpcclient -U'user%secret' NT-SERVER -c 'getdriver printername 3' -From the result it should become clear which is which. Here is an -example from my installation: +From the result it should become clear which is which. Here is an example from my installation: - rpcclientgetdriver - -&rootprompt;rpcclient -U'Danka%xxxx' W2KSERVER \ + +rpcclientgetdriver + +&rootprompt;rpcclient -U'Danka%xxxx' W200xSERVER \ -c'getdriver "DANKA InfoStream Virtual Printer" 3' cmd = getdriver "DANKA InfoStream Virtual Printer" 3 @@ -3365,62 +3338,61 @@ example from my installation: Some printer drivers list additional files under the label -"Dependentfiles": these would go into the last field -ListOfFiles,Comma-separated. For the CUPS -PostScript drivers we don't need any (nor would we for the Adobe -PostScript driver): therefore the field will get a "NULL" entry. +Dependentfiles and these would go into the last field +ListOfFiles,Comma-separated. For the CUPS +PostScript drivers, we do not need any (nor would we for the Adobe +PostScript driver), therefore, the field will get a NULL entry. -What is required for adddriver and setdriver to succeed +Requirements for adddriver and setdriver to Succeed -From the manpage (and from the quoted output -of cupsaddsmb, above) it becomes clear that you +>From the man page (and from the quoted output +of cupsaddsmb above) it becomes clear that you need to have certain conditions in order to make the manual uploading -and initializing of the driver files succeed. The two rpcclient +and initializing of the driver files succeed. The two rpcclient rpcclientadddriver subcommands (adddriver and setdriver) need to encounter the following -pre-conditions to complete successfully: +preconditions to complete successfully: -you are connected as printer admin, or root (note, -that this is not the "Printer Operators" group in -NT, but the printer admin group, as defined in +You are connected as printer admin or root (this is not the Printer Operators group in +NT, but the printer admin group as defined in the [global] section of -&smb.conf;); - -copy all required driver files to -\\sambaserver\print$\w32x86 and -\\sambaserver\print$\win40 as appropriate. They -will end up in the "0" respective "2" subdirectories later -- for now -don't put them there, they'll be automatically -used by the adddriver subcommand.! (if you use -"smbclient" to put the driver files into the share, note that you need -to escape the "$": smbclient //sambaserver/print\$ -U -root); - -the user you're connecting as must be able to write to +&smb.conf;). + +Copy all required driver files to +\\SAMBA\print$\w32x86 and +\\SAMBA\print$\win40 as appropriate. They +will end up in the 0 respective 2 subdirectories later. For now, +do not put them there, they'll be automatically +used by the adddriver subcommand. (If you use +smbclient to put the driver files into the share, note that you need +to escape the $: smbclient //sambaserver/print\$ -U +root.) + +The user you're connecting as must be able to write to the [print$] share and create -subdirectories; +subdirectories. -the printer you are going to setup for the Windows -clients, needs to be installed in CUPS already; +The printer you are going to setup for the Windows +clients needs to be installed in CUPS already. rpcclientsetdriver rpcclientenumprinters - the CUPS printer must be known to Samba, otherwise the + The CUPS printer must be known to Samba, otherwise the setdriver subcommand fails with an NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by -Samba you may use the enumprinters subcommand to -rpcclient. A long-standing bug prevented a proper update of the +Samba, you may use the enumprinters subcommand to +rpcclient. A long-standing bug prevented a proper update of the printer list until every smbd process had received a SIGHUP or was restarted. Remember this in case you've created the CUPS printer just -shortly ago and encounter problems: try restarting +recently and encounter problems: try restarting Samba. @@ -3436,30 +3408,32 @@ single action item as it comes up. - Manual Driver Installation installation + Manual Driver Installation -Install the Printer on CUPS +Install the printer on CUPS. -&rootprompt;lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P canonIR85.ppd +&rootprompt;lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E \ + -P canonIR85.ppd -This installs printer with the name mysmbtstprn +This installs a printer with the name mysmbtstprn to the CUPS system. The printer is accessed via a socket (a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root -for this step +for this step. -(optional) Check if the Printer is recognized by -Samba +(Optional) Check if the printer is recognized by Samba. - rpcclientenumprinters - -&rootprompt;rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn + +rpcclientenumprinters + + &rootprompt;rpcclient -Uroot%xxxx -c 'enumprinters' localhost \ + | grep -C2 mysmbtstprn flags:[0x800000] name:[\\kde-bitshop\mysmbtstprn] description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn] @@ -3467,26 +3441,27 @@ comment:[mysmbtstprn] -This should show the printer in the list. If not, stop and re-start -the Samba daemon (smbd), or send a HUP signal: kill -HUP -`pidof smbd`. Check again. Troubleshoot and repeat until -success. Note the "empty" field between the two commas in the -"description" line. Here would the driver name appear if there was one -already. You need to know root's Samba password (as set by the +This should show the printer in the list. If not, stop and restart +the Samba daemon (smbd), or send a HUP signal: + +&rootprompt;kill -HUP `pidof smbd` +Check again. Troubleshoot and repeat until +successful. Note the empty field between the two commas in the +description line. The driver name would appear here if there was one already. You need to know root's Samba password (as set by the smbpasswd command) for this step and most of the -following steps. Alternatively you can authenticate as one of the -users from the "write list" as defined in &smb.conf; for +following steps. Alternately, you can authenticate as one of the +users from the write list as defined in &smb.conf; for [print$]. -(optional) Check if Samba knows a Driver for the -Printer +(Optional) Check if Samba knows a driver for the printer. + rpcclientgetprinter rpcclientgetdriver - + &rootprompt;rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \ | grep driver drivername:[] @@ -3509,17 +3484,17 @@ printprocessor:[winprint] -Neither method of the three commands shown above should show a driver. +None of the three commands shown above should show a driver. This step was done for the purpose of demonstrating this condition. An attempt to connect to the printer at this stage will prompt the -message along the lines: "The server has not the required printer -driver installed". +message along the lines of: The server does not have the required printer +driver installed. -Put all required Driver Files into Samba's -[print$] +Put all required driver files into Samba's +[print$]. &rootprompt;smbclient //localhost/print\$ -U 'root%xxxx' \ @@ -3531,19 +3506,19 @@ driver installed". -(Note that this command should be entered in one long single -line. Line-breaks and the line-end indicating "\" has been inserted +(This command should be entered in one long single +line. Line-breaks and the line-end indicated by \ have been inserted for readability reasons.) This step is required for the next one to succeed. It makes the driver files physically present in the [print$] share. However, clients would still not be able to install them, because Samba does not yet treat them as driver files. A client asking for the driver would still -be presented with a "not installed here" message. +be presented with a not installed here message. -Verify where the Driver Files are now +Verify where the driver files are now. &rootprompt;ls -l /etc/samba/drivers/W32X86/ @@ -3557,40 +3532,39 @@ drwxr-sr-x 2 root ntadmin 670 May 16 03:15 3 -The driver files now are in the W32X86 architecture "root" of +The driver files now are in the W32X86 architecture root of [print$]. -Tell Samba that these are -<emphasis>Driver</emphasis> Files -(<command>adddriver</command>) +Tell Samba that these are driver files (<command>adddriver</command>). - rpcclientadddriver - -&rootprompt;rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \ - cupsdrvr.dll:mysmbtstprn.PPD: \ + +rpcclientadddriver + +&rootprompt;rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" \ + "mydrivername:cupsdrvr.dll:mysmbtstprn.PPD: \ cupsui.dll:cups.hlp:NULL:RAW:NULL" \ localhost Printer Driver mydrivername successfully installed. -Note that your cannot repeat this step if it fails. It could fail even +You cannot repeat this step if it fails. It could fail even as a result of a simple typo. It will most likely have moved a part of -the driver files into the "2" subdirectory. If this step fails, you -need to go back to the fourth step and repeat it, before you can try -this one again. In this step you need to choose a name for your +the driver files into the 2 subdirectory. If this step fails, you +need to go back to the fourth step and repeat it before you can try +this one again. In this step, you need to choose a name for your driver. It is normally a good idea to use the same name as is used for -the printername; however, in big installations you may use this driver -for a number of printers which have obviously different names. So the +the printer name; however, in big installations you may use this driver +for a number of printers that obviously have different names, so the name of the driver is not fixed. -Verify where the Driver Files are now +Verify where the driver files are now. &rootprompt;ls -l /etc/samba/drivers/W32X86/ @@ -3608,19 +3582,19 @@ total 5039 -Notice how step 6 did also move the driver files to the appropriate -subdirectory. Compare with the situation after step 5. +Notice how step 6 also moved the driver files to the appropriate +subdirectory. Compare this with the situation after step 5. -(optional) Verify if Samba now recognizes the -Driver +(Optional) Verify if Samba now recognizes the driver. - rpcclientenumdrivers - -&rootprompt;rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost \ - | grep -B2 -A5 mydrivername + +rpcclientenumdrivers + +&rootprompt;rpcclient -Uroot%xxxx -c 'enumdrivers 3' \ + localhost | grep -B2 -A5 mydrivername Printer Driver Info 3: Version: [2] Driver Name: [mydrivername] @@ -3632,40 +3606,41 @@ Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp] -Remember, this command greps for the name you did choose for the -driver in step Six. This command must succeed before you can proceed. +Remember, this command greps for the name you chose for the +driver in step 6. This command must succeed before you can proceed. -Tell Samba which Printer should use these Driver -Files (<command>setdriver</command>) +Tell Samba which printer should use these driver files (setdriver). -rpcclientsetdriver - -&rootprompt;rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost + +rpcclientsetdriver + +&rootprompt;rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' \ + localhost Successfully set mysmbtstprn to driver mydrivername -Since you can bind any printername (=printqueue) to any driver, this -is a very convenient way to setup many queues which use the same -driver. You don't need to repeat all the previous steps for the -setdriver command to succeed. The only pre-conditions are: +Since you can bind any printername (print queue) to any driver, this +is a convenient way to setup many queues that use the same +driver. You do not need to repeat all the previous steps for the +setdriver command to succeed. The only preconditions are: enumdrivers must find the driver and enumprinters must find the printer. -(optional) Verify if Samba has this Association -recognized + (Optional) Verify if Samba has recognized this association. + rpcclientgetprinter rpcclientgetdriver rpcclientenumprinters - + &rootprompt;rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \ | grep driver drivername:[mydrivername] @@ -3697,7 +3672,8 @@ Printer Driver Info 3: Monitorname: [] Defaultdatatype: [RAW] -&rootprompt;rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn +&rootprompt;rpcclient -Uroot%xxxx -c 'enumprinters' localhost \ + | grep mysmbtstprn name:[\\kde-bitshop\mysmbtstprn] description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn] comment:[mysmbtstprn] @@ -3706,93 +3682,93 @@ Printer Driver Info 3: rpcclientenumprinters -Compare these results with the ones from steps 2 and 3. Note that -every single of these commands show the driver is installed. Even +Compare these results with the ones from steps 2 and 3. Every one of these commands show the driver is installed. Even the enumprinters command now lists the driver -on the "description" line. +on the description line. -(optional) Tickle the Driver into a correct -Device Mode +(Optional) Tickle the driver into a correct +device mode. "Printers" folder -You certainly know how to install the driver on the client. In case +You certainly know how to install the driver on the client. In case you are not particularly familiar with Windows, here is a short -recipe: browse the Network Neighbourhood, go to the Samba server, look +recipe: Browse the Network Neighborhood, go to the Samba server, and look for the shares. You should see all shared Samba printers. Double-click on the one in question. The driver should get -installed, and the network connection set up. An alternative way is to -open the "Printers (and Faxes)" folder, right-click on the printer in -question and select "Connect" or "Install". As a result, a new printer -should have appeared in your client's local "Printers (and Faxes)" -folder, named something like "printersharename on Sambahostname". +installed and the network connection set up. An alternate way is to +open the Printers (and Faxes) folder, right-click on the printer in +question and select Connect or Install. As a result, a new printer +should have appeared in your client's local Printers (and Faxes) +folder, named something like printersharename on Sambahostname. It is important that you execute this step as a Samba printer admin (as defined in &smb.conf;). Here is another method -to do this on Windows XP. It uses a commandline, which you may type -into the "DOS box" (type root's smbpassword when prompted): +to do this on Windows XP. It uses a command line, which you may type +into the DOS box (type root's smbpassword when prompted): -&dosprompt;runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n\ - \\sambacupsserver\mysmbtstprn" +&dosprompt;runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry \ + /in /n \\sambaserver\mysmbtstprn" -Change any printer setting once (like changing "portrait" to - "landscape"), click Apply; change the setting +Change any printer setting once (like changing portrait to + landscape), click on Apply; change the setting back. -Install the Printer on a Client -("Point'n'Print") +Install the printer on a client +(Point'n'Print). -point and print - -&dosprompt;rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn" + +point 'n' print + +&dosprompt;rundll32 printui.dll,PrintUIEntry /in /n \\sambaserver\mysmbtstprn -If it doesn't work it could be a permission problem with the +If it does not work it could be a permission problem with the [print$] share. -Thirteenth Step (optional): Print a Test Page +(Optional) Print a test page. -&dosprompt;rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn" +&dosprompt;rundll32 printui.dll,PrintUIEntry /p /n "\\sambaserver\mysmbtstprn" -Then hit [TAB] 5 times, [ENTER] twice, [TAB] once and [ENTER] again +Then hit [TAB] five times, [ENTER] twice, [TAB] once and [ENTER] again and march to the printer. -Fourteenth Step (recommended): Study the Test Page +(Recommended) Study the test page. Hmmm.... just kidding! By now you know everything about printer -installations and you don't need to read a word. Just put it in a +installations and you do not need to read a word. Just put it in a frame and bolt it to the wall with the heading "MY FIRST -RPCCLIENT-INSTALLED PRINTER" - why not just throw it away! +RPCCLIENT-INSTALLED PRINTER" &smbmdash; why not just throw it away! -Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your -Success +(Obligatory) Enjoy. Jump. Celebrate your +success. &rootprompt;echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd @@ -3802,7 +3778,7 @@ Success -Troubleshooting revisited +Troubleshooting Revisited The setdriver command will fail, if in Samba's mind the queue is not @@ -3810,64 +3786,62 @@ already there. You had promising messages about the: - Printer Driver ABC successfully installed. - -after the "adddriver" parts of the procedure? But you are also seeing -a disappointing message like this one beneath? +after the adddriver parts of the procedure? But you are also seeing +a disappointing message like this one? - - + result was NT_STATUS_UNSUCCESSFUL - - + lpstat It is not good enough that you -can see the queue in CUPS, using +can see the queue in CUPS, using the lpstat -p ir85wm command. A bug in most recent versions of Samba prevents the proper update of the queuelist. The recognition of newly installed CUPS printers -fails unless you re-start Samba or send a HUP to all smbd -processes. To verify if this is the reason why Samba doesn't -execute the setdriver command successfully, check if Samba "sees" +fails unless you restart Samba or send a HUP to all smbd +processes. To verify if this is the reason why Samba does not +execute the setdriver command successfully, check if Samba sees the printer: + rpcclientenumprinters - -&rootprompt;rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep ir85wm + +&rootprompt;rpcclient transmeta -N -U'root%xxxx' -c 'enumprinters 0'|grep ir85wm printername:[ir85wm] -An alternative command could be this: +An alternate command could be this: + rpcclientgetprinter - + &rootprompt;rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' cmd = getprinter ir85wm flags:[0x800000] name:[\\transmeta\ir85wm] description:[\\transmeta\ir85wm,ir85wm,DPD] - comment:[CUPS PostScript-Treiber for WinNT/2K/XP] + comment:[CUPS PostScript-Treiber for Windows NT/200x/XP] -BTW, you can use these commands, plus a few more, of course, +By the way, you can use these commands, plus a few more, of course, to install drivers on remote Windows NT print servers too! -The printing <filename>*.tdb</filename> Files +The Printing <filename>*.tdb</filename> Files TDB @@ -3884,13 +3858,13 @@ to install drivers on remote Windows NT print servers too! sessionid.tdbTDB secrets.tdbTDB Some mystery is associated with the series of files with a -tdb-suffix appearing in every Samba installation. They are +tdb suffix appearing in every Samba installation. They are connections.tdb, printing.tdb, -share_info.tdb , +share_info.tdb, ntdrivers.tdb, unexpected.tdb, -brlock.tdb , +brlock.tdb, locking.tdb, ntforms.tdb, messages.tdb , @@ -3900,19 +3874,19 @@ tdb-suffix appearing in every Samba installation. They are -Trivial DataBase Files +Trivial Database Files -TDB -A Windows NT (Print) Server keeps track of all information needed to serve +TDB +A Windows NT (print) server keeps track of all information needed to serve its duty toward its clients by storing entries in the Windows -"Registry". Client queries are answered by reading from the registry, -Administrator or user configuration settings are saved by writing into -the Registry. Samba and UNIX obviously don't have such a kind of +registry. Client queries are answered by reading from the registry, +Administrator or user configuration settings that are saved by writing into +the registry. Samba and UNIX obviously do not have such a Registry. Samba instead keeps track of all client related information in a series of *.tdb files. (TDB = Trivial Data Base). These are often located in /var/lib/samba/ -or /var/lock/samba/ . The printing related files +or /var/lock/samba/. The printing related files are ntprinters.tdb, printing.tdb,ntforms.tdb and ntdrivers.tdb. @@ -3924,12 +3898,12 @@ are ntprinters.tdb, *.tdb files are not human readable. They are -written in a binary format. "Why not ASCII?", you may ask. "After all, -ASCII configuration files are a good and proofed tradition on UNIX." --- The reason for this design decision by the Samba Team is mainly +written in a binary format. Why not ASCII?, you may ask. After all, +ASCII configuration files are a good and proven tradition on UNIX. +The reason for this design decision by the Samba team is mainly performance. Samba needs to be fast; it runs a separate smbd process for each client connection, in some -environments many thousand of them. Some of these smbds might need to +environments many thousands of them. Some of these smbds might need to write-access the same *.tdb file at the same time. The file format of Samba's *.tdb files allows for this provision. Many smbd @@ -3945,25 +3919,25 @@ same time. This wouldn't be possible with pure ASCII files. It is very important that all *.tdb files remain consistent over all write and read accesses. However, it may happen that these files do get corrupted. (A -kill -9 `pidof smbd` while a write access is in +kill -9 `pidof smbd' while a write access is in progress could do the damage as well as a power interruption, etc.). In cases of trouble, a deletion of the old printing-related -*.tdb files may be the only option. You need to -re-create all print related setup after that. Or you have made a +*.tdb files may be the only option. After that you need to +re-create all print-related setup or you have made a backup of the *.tdb files in time. -Using <emphasis>tdbbackup</emphasis> +Using <command>tdbbackup</command> -TDBbacking uptdbbackup -tdbbackup -Samba ships with a little utility which helps the root user of your -system to back up your *.tdb files. If you run it -with no argument, it prints a little usage message: +TDBbacking uptdbbackup +tdbbackup +Samba ships with a little utility that helps the root user of your +system to backup your *.tdb files. If you run it +with no argument, it prints a usage message: @@ -3978,14 +3952,14 @@ with no argument, it prints a little usage message: -Here is how I backed up my printing.tdb file: +Here is how I backed up my printing.tdb file: &rootprompt;ls -. browse.dat locking.tdb ntdrivers.tdb printing.tdb -.. share_info.tdb connections.tdb messages.tdb ntforms.tdb -printing.tdbkp unexpected.tdb brlock.tdb gmon.out namelist.debug +. browse.dat locking.tdb ntdrivers.tdb printing.tdb +.. share_info.tdb connections.tdb messages.tdb ntforms.tdb +printing.tdbkp unexpected.tdb brlock.tdb gmon.out namelist.debug ntprinters.tdb sessionid.tdb &rootprompt;tdbbackup -s .bak printing.tdb @@ -4002,16 +3976,17 @@ ntprinters.tdb sessionid.tdb CUPS Print Drivers from Linuxprinting.org -Linuxprinting.org -CUPS ships with good support for HP LaserJet type printers. You can +Linuxprinting.org +CUPS ships with good support for HP LaserJet-type printers. You can install the generic driver as follows: -lpadmin - + +lpadmin + &rootprompt;lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd @@ -4019,56 +3994,57 @@ install the generic driver as follows: The switch will retrieve the laserjet.ppd from the standard repository for not-yet-installed-PPDs, which CUPS typically stores in -/usr/share/cups/model. Alternatively, you may use +/usr/share/cups/model. Alternately, you may use . -The generic laserjet.ppd however does not support every special option -for every LaserJet-compatible model. It constitutes a sort of "least -denominator" of all the models. If for some reason it is ruled out to -you to pay for the commercially available ESP Print Pro drivers, your +The generic laserjet.ppd, however, does not support every special option +for every LaserJet-compatible model. It constitutes a sort of least common +denominator of all the models. If for some reason +you must pay for the commercially available ESP Print Pro drivers, your first move should be to consult the database on http://www.linuxprinting.org/printer_list.cgi. Linuxprinting.org has excellent recommendations about which driver is best used for each printer. Its database is kept current by the tireless work of Till Kamppeter from MandrakeSoft, who is also the -principal author of the foomatic-rip utility. +principal author of the foomatic-rip utility. foomatic-rip -The former "cupsomatic" concept is now be replaced by the new, much -more powerful "foomatic-rip". foomatic-rip is the successor of -cupsomatic. cupsomatic is no longer maintained. Here is the new URL -to the Foomatic-3.0 database:cupsomatic concept is now being replaced by the new +successor, a much +more powerful foomatic-rip. +cupsomatic is no longer maintained. Here is the new URL +to the Foomatic-3.0 database: http://www.linuxprinting.org/driver_list.cgi. -If you upgrade to foomatic-rip, don't forget to also upgrade to the -new-style PPDs for your foomatic-driven printers. foomatic-rip will -not work with PPDs generated for the old cupsomatic. The new-style +If you upgrade to foomatic-rip, remember to also upgrade to the +new-style PPDs for your Foomatic-driven printers. foomatic-rip will +not work with PPDs generated for the old cupsomatic. The new-style PPDs are 100% compliant to the Adobe PPD specification. They are -intended to be used by Samba and the cupsaddsmb utility also, to -provide the driver files for the Windows clients also! +also intended to be used by Samba and the cupsaddsmb utility, to +provide the driver files for the Windows clients! -foomatic-rip and Foomatic explained +foomatic-rip and Foomatic Explained -foomatic -foomatic-rip -Nowadays most Linux distros rely on the utilities of Linuxprinting.org -to create their printing related software (which, BTW, works on all -UNIXes and on Mac OS X or Darwin too). It is not known as well as it -should be, that it also has a very end-user friendly interface which -allows for an easy update of drivers and PPDs, for all supported -models, all spoolers, all operating systems and all package formats +foomatic +foomatic-rip +Nowadays, most Linux distributions rely on the utilities of Linuxprinting.org +to create their printing-related software (which, by the way, works on all +UNIXes and on Mac OS X or Darwin, too). It is not known as well as it +should be, that it also has a very end-user-friendly interface that +allows for an easy update of drivers and PPDs for all supported +models, all spoolers, all operating systems, and all package formats (because there is none). Its history goes back a few years. -Recently Foomatic has achieved the astonishing milestone of 1000 listed printer models. Linuxprinting.org keeps all the important facts about printer drivers, supported models and which @@ -4077,85 +4053,83 @@ its Foomatic database. Currently there are 245 drivers -in the database: many drivers support various models, and many models -may be driven by different drivers; it's your choice! +in the database. Many drivers support various models, and many models +may be driven by different drivers &smbmdash; its your choice! -690 "perfect" Printers +690 <quote>Perfect</quote> Printers -At present there are 690 devices dubbed as working "perfectly", 181 -"mostly", 96 "partially" and 46 are "Paperweights". Keeping in mind +At present, there are 690 devices dubbed as working perfectly, 181 +mostly, 96 partially, and 46 are paperweights. Keeping in mind that most of these are non-PostScript models (PostScript printers are -automatically supported supported by CUPS to perfection, by using -their own manufacturer-provided Windows-PPD...), and that a -multifunctional device never qualifies as working "perfectly" if it -doesn't also scan and copy and fax under GNU/Linux: then this is a -truly astonishing achievement. Three years ago the number was not -more than 500, and Linux or UNIX "printing" at the time wasn't -anywhere near the quality it is today! +automatically supported by CUPS to perfection, by using +their own manufacturer-provided Windows-PPD), and that a +multifunctional device never qualifies as working perfectly if it +does not also scan and copy and fax under GNU/Linux &smbmdash; then this is a +truly astonishing achievement! Three years ago the number was not +more than 500, and Linux or UNIX printing at the time wasn't +anywhere near the quality it is today. -How the "Printing HOWTO" started it all +How the Printing HOWTO Started It All -A few years ago Grant Taylor +A few years ago Grant Taylor started it all. The roots of today's Linuxprinting.org are in the -first Linux Printing -HOWTO which he authored. As a side-project to this document, +first Linux Printing +HOWTO that he authored. As a side-project to this document, which served many Linux users and admins to guide their first steps in this complicated and delicate setup (to a scientist, printing is -"applying a structured deposition of distinct patterns of ink or toner -particles on paper substrates" ;-), he started to +applying a structured deposition of distinct patterns of ink or toner +particles on paper substrates, he started to build in a little Postgres database with information about the hardware and driver zoo that made up Linux printing of the time. This database became the core component of today's Foomatic collection of -tools and data. In the meantime it has moved to an XML representation +tools and data. In the meantime, it has moved to an XML representation of the data. -Foomatic's strange Name +Foomatic's Strange Name -foomatic -"Why the funny name?", you ask. When it really took off, around spring +foomatic +Why the funny name? you ask. When it really took off, around spring 2000, CUPS was far less popular than today, and most systems used LPD, -LPRng or even PDQ to print. CUPS shipped with a few generic "drivers" +LPRng or even PDQ to print. CUPS shipped with a few generic drivers (good for a few hundred different printer models). These didn't support many device-specific options. CUPS also shipped with its own -built-in rasterization filter ("pstoraster", derived from +built-in rasterization filter (pstoraster, derived from Ghostscript). On the other hand, CUPS provided brilliant support for controlling all printer options through -standardized and well-defined "PPD files" (PostScript Printers +standardized and well-defined PPD files (PostScript Printers Description files). Plus, CUPS was designed to be easily extensible. -Grant already had in his database a respectable compilation -of facts about a many more printers, and the Ghostscript "drivers" -they run with. His idea, to generate PPDs from the database info +Taylor already had in his database a respectable compilation +of facts about many more printers and the Ghostscript drivers +they run with. His idea, to generate PPDs from the database information and use them to make standard Ghostscript filters work within CUPS, -proved to work very well. It also "killed several birds with one -stone": +proved to work very well. It also killed several birds with one +stone: It made all current and future Ghostscript filter -developments available for CUPS; +developments available for CUPS. It made available a lot of additional printer models -to CUPS users (because often the "traditional" Ghostscript way of -printing was the only one available); +to CUPS users (because often the traditional Ghostscript way of +printing was the only one available). -It gave all the advanced CUPS options (web interface, +It gave all the advanced CUPS options (Web interface, GUI driver configurations) to users wanting (or needing) to use Ghostscript filters. @@ -4164,36 +4138,35 @@ Ghostscript filters. cupsomatic, pdqomatic, lpdomatic, directomatic + + cupsomatic CUPS-PPD PPDCUPSCUPS-PPD - - CUPS worked through a quickly-hacked up filter script named cupsomatic. +url="http://www.linuxprinting.org/download.cgi?filename=cupsomatic&show=0">cupsomatic. cupsomatic ran the printfile through Ghostscript, constructing automatically the rather complicated command line needed. It just -required to be copied into the CUPS system to make it work. To -"configure" the way cupsomatic controls the Ghostscript rendering +needed to be copied into the CUPS system to make it work. To +configure the way cupsomatic controls the Ghostscript rendering process, it needs a CUPS-PPD. This PPD is generated directly from the contents of the database. For CUPS and the respective printer/filter -combo another Perl script named "CUPS-O-Matic" did the PPD -generation. After that was working, Grant implemented within a few +combo, another Perl script named CUPS-O-Matic did the PPD +generation. After that was working, Taylor implemented within a few days a similar thing for two other spoolers. Names chosen for the config-generator scripts were PDQ-O-Matic (for PDQ) and LPD-O-Matic -(for - you guessed it - LPD); the configuration here didn't use PPDs +(for &smbmdash; you guessed it &smbmdash; LPD); the configuration here didn't use PPDs but other spooler-specific files. -From late summer of that year, Till Kamppeter -started to put work into the database. Till had been newly employed by +From late summer of that year, Till Kamppeter +started to put work into the database. Kamppeter had been newly employed by MandrakeSoft to -convert their printing system over to CUPS, after they had seen his +convert its printing system over to CUPS, after they had seen his FLTK-based XPP (a GUI frontend to the CUPS lp-command). He added a huge amount of new information and new @@ -4201,104 +4174,101 @@ printers. He also developed the support for other spoolers, like PPR (via ppromatic), GNUlpr and LPRng (both via an extended -lpdomatic) and "spoolerless" printing (directomatic).... +lpdomatic) and spoolerless printing (directomatic). -So, to answer your question: "Foomatic" is the general name for all -the overlapping code and data behind the "*omatic" scripts.... -- -Foomatic up to versions 2.0.x required (ugly) Perl data structures -attached the Linuxprinting.org PPDs for CUPS. It had a different -"*omatic" script for every spooler, as well as different printer -configuration files.. +So, to answer your question: Foomatic is the general name for all +the overlapping code and data behind the *omatic scripts. +Foomatic, up to versions 2.0.x, required (ugly) Perl data structures +attached to Linuxprinting.org PPDs for CUPS. It had a different +*omatic script for every spooler, as well as different printer +configuration files. -The <emphasis>Grand Unification</emphasis> -achieved... +The <emphasis>Grand Unification</emphasis> Achieved -foomatic-rip -This all has changed in Foomatic versions 2.9 (Beta) and released as -"stable" 3.0. This has now achieved the convergence of all *omatic -scripts: it is called the foomatic-rip. +foomatic-rip +This has all changed in Foomatic versions 2.9 (beta) and released as +stable 3.0. It has now achieved the convergence of all *omatic +scripts and is called the foomatic-rip. This single script is the unification of the previously different spooler-specific *omatic scripts. foomatic-rip is used by all the -different spoolers alike. Because foomatic-rip can read PPDs (both the +different spoolers alike and because it can read PPDs (both the original PostScript printer PPDs and the Linuxprinting.org-generated ones), all of a sudden all supported spoolers can have the power of -PPDs at their disposal; users only need to plug "foomatic-rip" into -their system.... For users there is improved media type and source -support; paper sizes and trays are easier to configure. +PPDs at their disposal. Users only need to plug foomatic-rip into +their system. For users there is improved media type and source +support &smbmdash; paper sizes and trays are easier to configure. -Also, the New Generation of Linuxprinting.org PPDs doesn't contain -Perl data structures any more. If you are a distro maintainer and have +Also, the New Generation of Linuxprinting.org PPDs no longer contains +Perl data structures. If you are a distro maintainer and have used the previous version of Foomatic, you may want to give the new -one a spin: but don't forget to generate a new-version set of PPDs, +one a spin, but remember to generate a new-version set of PPDs via the new foomatic-db-engine! +url="http://www.linuxprinting.org/download/foomatic/foomatic-db-engine-3.0.0beta1.tar.gz">foomatic-db-engine! Individual users just need to generate a single new PPD specific to their model by following -the steps outlined in the Foomatic tutorial or further -below. This new development is truly amazing. +the steps outlined in the Foomatic tutorial or in this chapter. This new development is truly amazing. foomatic-rip is a very clever wrapper around the need to run -Ghostscript with a different syntax, different options, different -device selections and/or different filters for each different printer -or different spooler. At the same time it can read the PPD associated +Ghostscript with a different syntax, options, device selections, and/or filters for each different printer +or spooler. At the same time it can read the PPD associated with a print queue and modify the print job according to the user selections. Together with this comes the 100% compliance of the new -Foomatic PPDs with the Adobe spec. Some really innovative features of -the Foomatic concept will surprise users: it will support custom paper -sizes for many printers; and it will support printing on media drawn -from different paper trays within the same job (in both cases: even +Foomatic PPDs with the Adobe spec. Some innovative features of +the Foomatic concept may surprise users. It will support custom paper +sizes for many printers and will support printing on media drawn +from different paper trays within the same job (in both cases, even where there is no support for this from Windows-based vendor printer drivers). -Driver Development outside +Driver Development Outside Most driver development itself does not happen within Linuxprinting.org. Drivers are written by independent maintainers. -Linuxprinting.org just pools all the information, and stores it in its +Linuxprinting.org just pools all the information and stores it in its database. In addition, it also provides the Foomatic glue to integrate the many drivers into any modern (or legacy) printing system known to the world. -Speaking of the different driver development groups: most of +Speaking of the different driver development groups, most of the work is currently done in three projects. These are: Omni --- a Free Software project by IBM which tries to convert their printer +&smbmdash; a free software project by IBM that tries to convert their printer driver knowledge from good-ol' OS/2 times into a modern, modular, -universal driver architecture for Linux/UNIX (still Beta). This +universal driver architecture for Linux/UNIX (still beta). This currently supports 437 models. -HPIJS -- -a Free Software project by HP to provide the support for their own +HPIJS &smbmdash; +a free software project by HP to provide the support for their own range of models (very mature, printing in most cases is perfect and provides true photo quality). This currently supports 369 models. Gimp-Print -- a Free software +url="http://gimp-print.sf.net/">Gimp-Print &smbmdash; a free software effort, started by Michael Sweet (also lead developer for CUPS), now directed by Robert Krawitz, which has achieved an amazing level of photo print quality (many Epson users swear that its quality is @@ -4308,30 +4278,29 @@ platforms). This currently supports 522 models. -Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and -commercial UNIX +Forums, Downloads, Tutorials, Howtos &smbmdash; also for Mac OS X and Commercial UNIX -Linuxprinting.org today is the one-stop "shop" to download printer +Linuxprinting.org today is the one-stop shop to download printer drivers. Look for printer information and tutorials or solve printing problems in its popular forums. But -it's not just for GNU/Linux: users and admins of forums. This forum +it's not just for GNU/Linux users, but admins of commercial UNIX systems are also going there, and the relatively new Mac OS X forum has turned out to be one of the most frequented -fora after only a few weeks. +forums after only a few weeks. Linuxprinting.org and the Foomatic driver wrappers around Ghostscript are now a standard toolchain for printing on all the important distros. Most of them also have CUPS underneath. While in recent years -most printer data had been added by Till (who works at Mandrake), many +most printer data had been added by Kamppeter (who works at Mandrake), many additional contributions came from engineers with SuSE, RedHat, -Connectiva, Debian and others. Vendor-neutrality is an important goal +Connectiva, Debian, and others. Vendor-neutrality is an important goal of the Foomatic project. @@ -4343,34 +4312,34 @@ it often, please send him a note showing your appreciation. -Foomatic Database generated PPDs +Foomatic Database-Generated PPDs The Foomatic database is an amazing piece of ingenuity in itself. Not only does it keep the printer and driver information, but it is -organized in a way that it can generate "PPD" files "on the fly" from +organized in a way that it can generate PPD files on the fly from its internal XML-based datasets. While these PPDs are modelled to the -Adobe specification of "PostScript Printer Descriptions" (PPDs), the -Linuxprinting.org/Foomatic-PPDs don't normally drive PostScript -printers: they are used to describe all the bells and whistles you -could ring or blow on an Epson Stylus inkjet, or a HP Photosmart or -what-have-you. The main "trick" is one little additional line, not -envisaged by the PPD specification, starting with the "*cupsFilter" -keyword: it tells the CUPS daemon how to proceed with the PostScript +Adobe specification of PostScript Printer Descriptions (PPDs), the +Linuxprinting.org/Foomatic-PPDs do not normally drive PostScript +printers. They are used to describe all the bells and whistles you +could ring or blow on an Epson Stylus inkjet, or a HP Photosmart, or +what-have-you. The main trick is one little additional line, not +envisaged by the PPD specification, starting with the *cupsFilter +keyword. It tells the CUPS daemon how to proceed with the PostScript print file (old-style Foomatic-PPDs named the -cupsomatic filter script, while the new-style -PPDs now call foomatic-rip). This filter +cupsomatic filter script, while the new-style +PPDs are now call foomatic-rip). This filter script calls Ghostscript on the host system (the recommended variant is ESP Ghostscript) to do the rendering work. foomatic-rip knows which filter or internal device setting it should ask from Ghostscript to convert the PostScript printjob into a raster format ready for the target device. This usage of PPDs to describe the options of non-PS -printers was the invention of the CUPS developers. The rest is easy: -GUI tools (like KDE's marvellous "kprinter", +printers was the invention of the CUPS developers. The rest is easy. +GUI tools (like KDE's marvelous kprinter, or the GNOME "gtklp", "xpp" and the CUPS -web interface) read the PPD too and use this information to present +url="http://gtklp.sourceforge.net/">gtklp, xpp and the CUPS +Web interface) read the PPD as well and use this information to present the available settings to the user as an intuitive menu selection. @@ -4380,44 +4349,41 @@ the available settings to the user as an intuitive menu selection. foomatic-rip and Foomatic-PPD Download and Installation -Here are the steps to install a foomatic-rip driven "LaserJet 4 Plus" -compatible printer in CUPS (note that recent distributions of SuSE, -UnitedLinux and Mandrake may ship with a complete package of -Foomatic-PPDs plus the foomatic-rip utility. going directly to -Linuxprinting.org ensures you to get the latest driver/PPD files): +Here are the steps to install a foomatic-rip driven LaserJet 4 Plus-compatible +printer in CUPS (note that recent distributions of SuSE, UnitedLinux and +Mandrake may ship with a complete package of Foomatic-PPDs plus the +foomatic-rip utility. Going directly to +Linuxprinting.org ensures that you get the latest driver/PPD files): + -Surf to http://www.linuxprinting.org/printer_list.cgi +Open your browser at the Linuxprinting.org printer listpage. -Check the complete list of printers in the database: -http://www.linuxprinting.org/printer_list.cgi?make=Anyone +Check the complete list of printers in the +database.. -There select your model and click on the -link. +Select your model and click on the link. + -You'll arrive at a page listing all drivers working -with this model (for all printers, there will always be -one recommended driver. Try this one -first). +You'll arrive at a page listing all drivers working with this +model (for all printers, there will always be one +recommended driver. Try this one first). + -In our case ("HP LaserJet 4 Plus"), we'll arrive here: - http://www.linuxprinting.org/show_printer.cgi?recnum=HP-LaserJet_4_Plus +In our case (HP LaserJet 4 Plus), we'll arrive at the default driver for the +HP-LaserJet 4 Plus. -The recommended driver is "ljet4". +The recommended driver is ljet4. -There are several links provided here. You should -visit them all, if you are not familiar with the Linuxprinting.org -database. +Several links are provided here. You should visit them all if you +are not familiar with the Linuxprinting.org database. + -There is a link to the database page for the "ljet4": - http://www.linuxprinting.org/show_driver.cgi?driver=ljet4 +There is a link to the database page for the +ljet4. On the driver's page, you'll find important and detailed information about how to use that driver within the various available spoolers. @@ -4425,136 +4391,128 @@ spoolers. Another link may lead you to the homepage of the driver author or the driver. -Important links are the ones which provide hints with -setup instructions for CUPS (http://www.linuxprinting.org/cups-doc.html), -PDQ (http://www.linuxprinting.org/pdq-doc.html), -LPD, LPRng and GNUlpr (http://www.linuxprinting.org/lpd-doc.html) -as well as PPR (http://www.linuxprinting.org/ppr-doc.html) -or "spooler-less" printing (http://www.linuxprinting.org/direct-doc.html -). - -You can view the PPD in your browser through this -link: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1 - You can also (most importantly) -generate and download the PPD: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=0 +Important links are the ones that provide hints with +setup instructions for CUPS, +PDQ, +LPD, LPRng and GNUlpr) +as well as PPR +or spooler-less printing. + + +You can view the PPD in your browser through this link: +http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1 + Most importantly, you can also generate and download +the PPD. The PPD contains all the information needed to use our -model and the driver; this is, once installed, working transparently -for the user. Later you'll only need to choose resolution, paper size -etc. from the web-based menu, or from the print dialog GUI, or from -the commandline. - -Should you have ended up on the driver's page (http://www.linuxprinting.org/show_driver.cgi?driver=ljet4), -you can choose to use the "PPD-O-Matic" online PPD generator +model and the driver; once installed, this works transparently +for the user. Later you'll only need to choose resolution, paper size, +and so on from the Web-based menu, or from the print dialog GUI, or from +the command line. + +If you ended up on the drivers +page +you can choose to use the PPD-O-Matic online PPD generator program. -Select the exact model and check either "download" or -"display PPD file" and click on "Generate PPD file". +Select the exact model and check either Download or +Display PPD file and click Generate PPD file. If you save the PPD file from the browser view, please -don't use "cut'n'past" (since it could possibly damage line endings -and tabs, which makes the PPD likely to fail its duty), but use "Save -as..." in your browser's menu. (Best is to use the "download" option -from the web page directly). - -Another very interesting part on each driver page is -the Show execution details button. If you -select your printer model and click that button, you will get -displayed a complete Ghostscript command line, enumerating all options -available for that driver/printermodel combo. This is a great way to -"Learn Ghostscript By Doing". It is also an excellent "cheat sheet" +do not use cut and paste (since it could possibly damage line endings +and tabs, which makes the PPD likely to fail its duty), but use Save +as... in your browser's menu. (It is best to use the Download option +directly from the Web page). + +Another interesting part on each driver page is +the Show execution details button. If you +select your printer model and click on that button, +a complete Ghostscript command line will be displayed, enumerating all options +available for that combination of driver and printer model. This is a great way to +learn Ghostscript by doing. It is also an excellent cheat sheet for all experienced users who need to re-construct a good command line for that damn printing script, but can't remember the exact -syntax. ;-) +syntax. Some time during your visit to Linuxprinting.org, save the PPD to a suitable place on your harddisk, say /path/to/my-printer.ppd (if you prefer to install -your printers with the help of the CUPS web interface, save the PPD to -the /usr/share/cups/model/ path and re-start +your printers with the help of the CUPS Web interface, save the PPD to +the /usr/share/cups/model/ path and restart cupsd). -Then install the printer with a suitable commandline, -e.g.: +Then install the printer with a suitable command line, +like this: -&rootprompt;lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd +&rootprompt;lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E \ + -P path/to/my-printer.ppd -Note again this: for all the new-style "Foomatic-PPDs" -from Linuxprinting.org, you also need a special "CUPS filter" named -"foomatic-rip".Get the latest version of "foomatic-rip" from: http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0 +For all the new-style Foomatic-PPDs +from Linuxprinting.org, you also need a special CUPS filter named +foomatic-rip. The foomatic-rip Perlscript itself also makes some -interesting reading (http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=1), -because it is very well documented by Till's inline comments (even +interesting reading +because it is well documented by Kamppeter's inline comments (even non-Perl hackers will learn quite a bit about printing by reading -it... ;-) +it). Save foomatic-rip either directly in /usr/lib/cups/filter/foomatic-rip or somewhere in -your $PATH (and don't forget to make it world-executable). Again, -don't save by "copy'n'paste" but use the appropriate link, or the -"Save as..." menu item in your browser. +your $PATH (and remember to make it world-executable). Again, +do not save by copy and paste but use the appropriate link or the +Save as... menu item in your browser. If you save foomatic-rip in your $PATH, create a symlink: -cd /usr/lib/cups/filter/ ; ln -s `which -foomatic-rip`. For CUPS to discover this new -available filter at startup, you need to re-start + +&rootprompt;cd /usr/lib/cups/filter/ ; ln -s `which foomatic-rip' + + + + +CUPS will discover this new available filter at startup after restarting cupsd. -Once you print to a printqueue set up with the Foomatic-PPD, CUPS will +Once you print to a print queue set up with the Foomatic-PPD, CUPS will insert the appropriate commands and comments into the resulting PostScript jobfile. foomatic-rip is able to read and act upon -these. foomatic-rip uses some specially encoded Foomatic comments, +these and uses some specially encoded Foomatic comments embedded in the jobfile. These in turn are used to construct -(transparently for you, the user) the complicated ghostscript command -line telling for the printer driver how exactly the resulting raster -data should look like and which printer commands to embed into the -data stream. - - - -You need: +(transparently for you, the user) the complicated Ghostscript command +line telling the printer driver exactly how the resulting raster +data should look and which printer commands to embed into the +data stream. You need: -A "foomatic+something" PPD -- but it this not enough +A foomatic+something PPD &smbmdash; but this is not enough to print with CUPS (it is only one important -component) +component). -The "foomatic-rip" filter script (Perl) in -/usr/lib/cups/filters/ +The foomatic-rip filter script (Perl) in +/usr/lib/cups/filters/. -Perl to make foomatic-rip run +Perl to make foomatic-rip run. Ghostscript (because it is doing the main work, controlled by the PPD/foomatic-rip combo) to produce the raster data -fit for your printermodel's consumption +fit for your printer model's consumption. Ghostscript must (depending on -the driver/model) contain support for a certain "device", representing -the selected "driver" for your model (as shown by "gs --h") +the driver/model) contain support for a certain device representing +the selected driver for your model (as shown by gs + -h). foomatic-rip needs a new version of PPDs (PPD versions -produced for cupsomatic don't work with +produced for cupsomatic do not work with foomatic-rip). @@ -4564,11 +4522,11 @@ foomatic-rip). Page Accounting with CUPS -CUPSPage Accounting -Often there are questions regarding "print quotas" wherein Samba users +CUPSPage Accounting +Often there are questions regarding print quotas where Samba users (that is, Windows clients) should not be able to print beyond a -certain amount of pages or data volume per day, week or month. This +certain number of pages or data volume per day, week or month. This feature is dependent on the real print subsystem you're using. Samba's part is always to receive the job files from the clients (filtered or unfiltered) and hand it over to this @@ -4576,24 +4534,25 @@ printing subsystem. -Of course one could "hack" things with one's own scripts. But then -there is CUPS. CUPS supports "quotas" which can be based on sizes of -jobs or on the number of pages or both, and are spanning any time +Of course one could hack things with one's own scripts. But then +there is CUPS. CUPS supports quotas that can be based on the size of +jobs or on the number of pages or both, and span any time period you want. -Setting up Quotas +Setting Up Quotas -CUPSquotas -This is an example command how root would set a print quota in CUPS, -assuming an existing printer named "quotaprinter": +CUPSquotas +This is an example command of how root would set a print quota in CUPS, +assuming an existing printer named quotaprinter: -lpadmin - + +lpadmin + &rootprompt;lpadmin -p quotaprinter -o job-quota-period=604800 \ -o job-k-limit=1024 -o job-page-limit=100 @@ -4606,26 +4565,26 @@ week). -Correct and incorrect Accounting +Correct and Incorrect Accounting For CUPS to count correctly, the printfile needs to pass the CUPS -"pstops" filter, otherwise it uses a "dummy" count of "1". Some -printfiles don't pass it (eg: image files) but then those are mostly 1 +pstops filter, otherwise it uses a dummy count of one. Some +print files do not pass it (e.g., image files) but then those are mostly one- page jobs anyway. This also means that proprietary drivers for the target printer running on the client computers and CUPS/Samba, which -then spool these files as "raw" (i.e. leaving them untouched, not -filtering them), will be counted as "1-pagers" too! +then spool these files as raw (i.e., leaving them untouched, not +filtering them), will be counted as one-pagers too! -You need to send PostScript from the clients (i.e. run a PostScript +You need to send PostScript from the clients (i.e., run a PostScript driver there) to have the chance to get accounting done. If the printer is a non-PostScript model, you need to let CUPS do the job to convert the file to a print-ready format for the target printer. This -will be working for currently about 1,000 different printer models, -see the driver list at linuxprinting.org/. +is currently working for about a thousand different printer models. +Linuxprinting has a driver +list. @@ -4633,40 +4592,38 @@ see Adobe and CUPS PostScript Drivers for Windows Clients -Before CUPS-1.1.16 your only option was to use the Adobe PostScript +Before CUPS 1.1.16, your only option was to use the Adobe PostScript Driver on the Windows clients. The output of this driver was not -always passed through the "pstops" filter on the CUPS/Samba side, and +always passed through the pstops filter on the CUPS/Samba side, and therefore was not counted correctly (the reason is that it often, -depending on the "PPD" being used, wrote a "PJL"-header in front of -the real PostScript which caused CUPS to skip pstops and go directly -to the "pstoraster" stage). +depending on the PPD being used, wrote a PJL-header in front of +the real PostScript which caused CUPS to skip pstops and go directly +to the pstoraster stage). -From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver for -Windows NT/2K/XP clients" (which is tagged in the download area of -http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). It does -not work for Win9x/ME clients. But it guarantees: +From CUPS 1.1.16 onward, you can use the CUPS PostScript Driver for +Windows NT/200x/XP clients (which is tagged in the download area of +http://www.cups.org/ as the cups-samba-1.1.16.tar.gz +package). It does not work for Windows 9x/ME clients, but it guarantees: -PJL -to not write an PJL-header + PJL To not write a PJL-header. -to still read and support all PJL-options named in the -driver PPD with its own means +To still read and support all PJL-options named in the +driver PPD with its own means. - that the file will pass through the "pstops" filter -on the CUPS/Samba server +That the file will pass through the pstops filter +on the CUPS/Samba server. -to page-count correctly the -printfile +To page-count correctly the print file. -You can read more about the setup of this combination in the manpage -for "cupsaddsmb" (which is only present with CUPS installed, and only +You can read more about the setup of this combination in the man page +for cupsaddsmb (which is only present with CUPS installed, and only current from CUPS 1.1.16). @@ -4674,10 +4631,10 @@ current from CUPS 1.1.16). The page_log File Syntax -page_log -These are the items CUPS logs in the "page_log" for every -single page of a job: +page_log +These are the items CUPS logs in the page_log for every +page of a job: @@ -4689,36 +4646,35 @@ single page of a job: Time of printing -the page number +The page number -the number of copies +The number of copies -a billing information string -(optional) +A billing information string (optional) -the host which sent the job (included since version -1.1.19) +The host that sent the job (included since version 1.1.19) -Here is an extract of my CUPS server's page_log file to illustrate the +Here is an extract of my CUPS server's page_log file to illustrate the format and included items: -infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13 -infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13 -infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13 -infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13 -DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33 +tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13 +tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13 +tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13 +tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13 +Dig9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33 -This was job ID "401", printed on "infotec_IS2027" by user "kurt", a -64-page job printed in 3 copies and billed to "#marketing", sent -from IP address 10.160.50.13. The next job had ID "402", was sent by -user "boss" from IP address 10.160.51.33,printed from one page 440 -copies and is set to be billed to "finance-dep". +This was job ID 401, printed on tec_IS2027 +by user kurt, a 64-page job printed in three copies and billed to +#marketing, sent from IP address 10.160.50.13. + The next job had ID 402, was sent by user boss +from IP address 10.160.51.33, printed from one page 440 copies and +is set to be billed to finance-dep. @@ -4730,29 +4686,29 @@ What flaws or shortcomings are there with this quota system? -the ones named above (wrongly logged job in case of -printer hardware failure, etc.) +The ones named above (wrongly logged job in case of +printer hardware failure, and so on). -in reality, CUPS counts the job pages that are being +In reality, CUPS counts the job pages that are being processed in software (that is, going through the -"RIP") rather than the physical sheets successfully leaving the -printing device. Thus if there is a jam while printing the 5th sheet out -of 1000 and the job is aborted by the printer, the "page count" will -still show the figure of 1000 for that job +RIP) rather than the physical sheets successfully leaving the +printing device. Thus if there is a jam while printing the fifth sheet out +of a thousand and the job is aborted by the printer, the page count will +still show the figure of a thousand for that job. -all quotas are the same for all users (no flexibility -to give the boss a higher quota than the clerk), no support for -groups +All quotas are the same for all users (no flexibility +to give the boss a higher quota than the clerk) and no support for +groups. -no means to read out the current balance or the -"used-up" number of current quota +No means to read out the current balance or the +used-up number of current quota. -a user having used up 99 sheets of 100 quota will -still be able to send and print a 1,000 sheet job +A user having used up 99 sheets of a 100 quota will +still be able to send and print a thousand sheet job. -a user being denied a job because of a filled-up quota -doesn't get a meaningful error message from CUPS other than -"client-error-not-possible". +A user being denied a job because of a filled-up quota +does not get a meaningful error message from CUPS other than +client-error-not-possible. @@ -4765,21 +4721,22 @@ improvements under development for CUPS 1.2: -page counting will go into the "backends" (these talk +Page counting will go into the backends (these talk directly to the printer and will increase the count in sync with the -actual printing process: thus a jam at the 5th sheet will lead to a -stop in the counting) +actual printing process; thus, a jam at the fifth sheet will lead to a +stop in the counting). -quotas will be handled more flexibly +Quotas will be handled more flexibly. -probably there will be support for users to inquire -their "accounts" in advance +Probably there will be support for users to inquire +about their accounts in advance. -probably there will be support for some other tools -around this topic +Probably there will be support for some other tools +around this topic. + @@ -4794,39 +4752,37 @@ PrintAnalyzer, pyKota, printbill, LogReport. A printer queue with no PPD associated to it is a -"raw" printer and all files will go directly there as received by the -spooler. The exceptions are file types "application/octet-stream" -which need "passthrough feature" enabled. "Raw" queues don't do any +raw printer and all files will go directly there as received by the +spooler. The exceptions are file types application/octet-stream +that need passthrough feature enabled. Raw queues do not do any filtering at all, they hand the file directly to the CUPS backend. -This backend is responsible for the sending of the data to the device -(as in the "device URI" notation: lpd://, socket://, -smb://, ipp://, http://, parallel:/, serial:/, usb:/ etc.) +This backend is responsible for sending the data to the device +(as in the device URI notation: lpd://, socket://, +smb://, ipp://, http://, parallel:/, serial:/, usb:/, and so on). -"cupsomatic"/Foomatic are not native CUPS drivers -and they don't ship with CUPS. They are a Third Party add-on, +cupsomatic/Foomatic are not native CUPS drivers +and they do not ship with CUPS. They are a third party add-on developed at Linuxprinting.org. As such, they are a brilliant hack to make all models (driven by Ghostscript drivers/filters in traditional spoolers) also work via CUPS, with the same (good or bad!) quality as -in these other spoolers. "cupsomatic" is only a vehicle to execute a -ghostscript commandline at that stage in the CUPS filtering chain, -where "normally" the native CUPS "pstoraster" filter would kick -in. cupsomatic by-passes pstoraster, "kidnaps" the printfile from CUPS -away and re-directs it to go through Ghostscript. CUPS accepts this, -because the associated CUPS-O-Matic-/Foomatic-PPD specifies: - - - +in these other spoolers. cupsomatic is only a vehicle to execute a +Ghostscript commandline at that stage in the CUPS filtering chain, +where normally the native CUPS pstoraster filter would kick +in. cupsomatic bypasses pstoraster, kidnaps the printfile from CUPS +away and redirects it to go through Ghostscript. CUPS accepts this, +because the associated cupsomatic/foomatic-PPD specifies: + + *cupsFilter: "application/vnd.cups-postscript 0 cupsomatic" - + - This line persuades CUPS to hand the file to cupsomatic, once it has successfully converted it to the MIME type -"application/vnd.cups-postscript". This conversion will not happen for -Jobs arriving from Windows which are auto-typed -"application/octet-stream", with the according changes in +application/vnd.cups-postscript. This conversion will not happen for +Jobs arriving from Windows that are auto-typed +application/octet-stream, with the according changes in /etc/cups/mime.types in place. @@ -4834,58 +4790,53 @@ Jobs arriving from Windows which are auto-typed CUPS is widely configurable and flexible, even regarding its filtering mechanism. Another workaround in some situations would be to have in /etc/cups/mime.types entries as follows: - - + application/postscript application/vnd.cups-raw 0 - application/vnd.cups-postscript application/vnd.cups-raw 0 - - + - -This would prevent all Postscript files from being filtered (rather, +This would prevent all PostScript files from being filtered (rather, they will through the virtual nullfilter -denoted with "-"). This could only be useful for PS printers. If you +denoted with -). This could only be useful for PS printers. If you want to print PS code on non-PS printers (provided they support ASCII -text printing) an entry as follows could be useful: - +text printing), an entry as follows could be useful: - + */* application/vnd.cups-raw 0 - - + - and would effectively send all files to the backend without further processing. -Lastly, you could have the following entry: - +You could have the following entry: - -application/vnd.cups-postscript application/vnd.cups-raw 0 my_PJL_stripping_filter - + +application/vnd.cups-postscript application/vnd.cups-raw 0 \ + my_PJL_stripping_filter + - -You will need to write a my_PJL_stripping_filter -(could be a shellscript) that parses the PostScript and removes the -unwanted PJL. This would need to conform to CUPS filter design +You will need to write a my_PJL_stripping_filter +(which could be a shell script) that parses the PostScript and removes the +unwanted PJL. This needs to conform to CUPS filter design (mainly, receive and pass the parameters printername, job-id, username, jobtitle, copies, print options and possibly the -filename). It would be installed as world executable into -/usr/lib/cups/filters/ and will be called by CUPS -if it encounters a MIME type "application/vnd.cups-postscript". +filename). It is installed as world executable into +/usr/lib/cups/filters/ and is called by CUPS +if it encounters a MIME type application/vnd.cups-postscript. -CUPS can handle -o job-hold-until=indefinite. -This keeps the job in the queue "on hold". It will only be printed +CUPS can handle -o job-hold-until=indefinite. +This keeps the job in the queue on hold. It will only be printed upon manual release by the printer operator. This is a requirement in -many "central reproduction departments", where a few operators manage +many central reproduction departments, where a few operators manage the jobs of hundreds of users on some big machine, where no user is allowed to have direct access (such as when the operators often need to load the proper paper type before running the 10,000 page job -requested by marketing for the mailing, etc.). +requested by marketing for the mailing, and so on). @@ -4893,17 +4844,18 @@ requested by marketing for the mailing, etc.). Auto-Deletion or Preservation of CUPS Spool Files -Samba print files pass through two "spool" directories. One is the -incoming directory managed by Samba, (set in the path/var/spool/samba directive in the -[printers] section of +Samba print files pass through two spool directories. One is the +incoming directory managed by Samba, (set in the +path/var/spool/samba +directive in the [printers] section of &smb.conf;). The other is the spool directory of your UNIX print subsystem. For CUPS it is normally -/var/spool/cups/, as set by the cupsd.conf +/var/spool/cups/, as set by the cupsd.conf directive RequestRoot /var/spool/cups. -CUPS Configuration Settings explained +CUPS Configuration Settings Explained Some important parameter settings in the CUPS configuration file @@ -4915,39 +4867,39 @@ Some important parameter settings in the CUPS configuration file PreserveJobHistory Yes This keeps some details of jobs in cupsd's mind (well it keeps the -"c12345", "c12346" etc. files in the CUPS spool directory, which do a +c12345, c12346, and so on, files in the CUPS spool directory, which do a similar job as the old-fashioned BSD-LPD control files). This is set -to "Yes" as a default. +to Yes as a default. PreserveJobFiles Yes This keeps the job files themselves in cupsd's mind -(well it keeps the "d12345", "d12346" etc. files in the CUPS spool -directory...). This is set to "No" as the CUPS +(it keeps the d12345, d12346 etc. files in the CUPS spool +directory). This is set to No as the CUPS default. -"MaxJobs 500" +MaxJobs 500 This directive controls the maximum number of jobs that are kept in memory. Once the number of jobs reaches the limit, the oldest completed job is automatically purged from the system to make room for the new one. If all of the known jobs are still -pending or active then the new job will be rejected. Setting the +pending or active, then the new job will be rejected. Setting the maximum to 0 disables this functionality. The default setting is 0. -(There are also additional settings for "MaxJobsPerUser" and -"MaxJobsPerPrinter"...) +(There are also additional settings for MaxJobsPerUser and +MaxJobsPerPrinter...) -Pre-conditions +Pre-Conditions For everything to work as announced, you need to have three @@ -4955,24 +4907,24 @@ things: -a Samba-smbd which is compiled against "libcups" (Check -on Linux by running "ldd `which smbd`") +A Samba-smbd that is compiled against libcups (check +on Linux by running ldd `which smbd'). -a Samba-&smb.conf; setting of - printingcups +A Samba-&smb.conf; setting of + printingcups. -another Samba-&smb.conf; setting of - printcapcups +Another Samba-&smb.conf; setting of + printcapcups. -In this case all other manually set printing-related commands (like +In this case, all other manually set printing-related commands (like print command, lpq command, lprm command, lppause command or lpresume command) are ignored and they should normally have no -influence what-so-ever on your printing. +influence whatsoever on your printing. @@ -4982,82 +4934,56 @@ influence what-so-ever on your printing. If you want to do things manually, replace the printingcups by printingbsd. Then your manually set commands may work -(haven't tested this), and a print commandlp -d %P %s; rm %s" +(I haven't tested this), and a print commandlp -d %P %s; rm %s" may do what you need. -In Case of Trouble..... +Printing from CUPS to Windows Attached Printers -If you have more problems, post the output of these commands -to the CUPS or Samba mailing lists (choose the one which seems more -relevant to your problem): - - - -&prompt;grep -v ^# /etc/cups/cupsd.conf | grep -v ^$ -&prompt;grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;" - - - -(adapt paths as needed). These commands leave out the empty -lines and lines with comments, providing the "naked settings" in a -compact way. Don't forget to name the CUPS and Samba versions you -are using! This saves bandwidth and makes for easier readability -for experts (and you are expecting experts to read them, right? -;-) - - - - - -Printing <emphasis>from</emphasis> CUPS to Windows attached -Printers - - -From time to time the question arises, how you can print +>From time to time the question arises, how can you print to a Windows attached printer -from Samba. Normally the local connection +from Samba? Normally the local connection from Windows host to printer would be done by USB or parallel -cable, but this doesn't matter to Samba. From here only an SMB +cable, but this does not matter to Samba. From here only an SMB connection needs to be opened to the Windows host. Of course, this -printer must be "shared" first. As you have learned by now, CUPS uses +printer must be shared first. As you have learned by now, CUPS uses backends to talk to printers and other -servers. To talk to Windows shared printers you need to use the -smb (surprise, surprise!) backend. Check if this -is in the CUPS backend directory. This resides usually in -/usr/lib/cups/backend/. You need to find a "smb" +servers. To talk to Windows shared printers, you need to use the +smb (surprise, surprise!) backend. Check if this +is in the CUPS backend directory. This usually resides in +/usr/lib/cups/backend/. You need to find an smb file there. It should be a symlink to smbspool -which file must exist and be executable: +and the file must exist and be executable: &rootprompt;ls -l /usr/lib/cups/backend/ total 253 -drwxr-xr-x 3 root root 720 Apr 30 19:04 . -drwxr-xr-x 6 root root 125 Dec 19 17:13 .. --rwxr-xr-x 1 root root 10692 Feb 16 21:29 canon --rwxr-xr-x 1 root root 10692 Feb 16 21:29 epson -lrwxrwxrwx 1 root root 3 Apr 17 22:50 http -> ipp --rwxr-xr-x 1 root root 17316 Apr 17 22:50 ipp --rwxr-xr-x 1 root root 15420 Apr 20 17:01 lpd --rwxr-xr-x 1 root root 8656 Apr 20 17:01 parallel --rwxr-xr-x 1 root root 2162 Mar 31 23:15 pdfdistiller -lrwxrwxrwx 1 root root 25 Apr 30 19:04 ptal -> /usr/sbin/ptal-cups --rwxr-xr-x 1 root root 6284 Apr 20 17:01 scsi -lrwxrwxrwx 1 root root 17 Apr 2 03:11 smb -> /usr/bin/smbspool --rwxr-xr-x 1 root root 7912 Apr 20 17:01 socket --rwxr-xr-x 1 root root 9012 Apr 20 17:01 usb +drwxr-xr-x 3 root root 720 Apr 30 19:04 . +drwxr-xr-x 6 root root 125 Dec 19 17:13 .. +-rwxr-xr-x 1 root root 10692 Feb 16 21:29 canon +-rwxr-xr-x 1 root root 10692 Feb 16 21:29 epson +lrwxrwxrwx 1 root root 3 Apr 17 22:50 http -> ipp +-rwxr-xr-x 1 root root 17316 Apr 17 22:50 ipp +-rwxr-xr-x 1 root root 15420 Apr 20 17:01 lpd +-rwxr-xr-x 1 root root 8656 Apr 20 17:01 parallel +-rwxr-xr-x 1 root root 2162 Mar 31 23:15 pdfdistiller +lrwxrwxrwx 1 root root 25 Apr 30 19:04 ptal -> /usr/sbin/ptal-cups +-rwxr-xr-x 1 root root 6284 Apr 20 17:01 scsi +lrwxrwxrwx 1 root root 17 Apr 2 03:11 smb -> /usr/bin/smbspool +-rwxr-xr-x 1 root root 7912 Apr 20 17:01 socket +-rwxr-xr-x 1 root root 9012 Apr 20 17:01 usb &rootprompt;ls -l `which smbspool` --rwxr-xr-x 1 root root 563245 Dec 28 14:49 /usr/bin/smbspool +-rwxr-xr-x 1 root root 563245 Dec 28 14:49 /usr/bin/smbspool -If this symlink doesn't exist, create it: +If this symlink does not exist, create it: @@ -5065,22 +4991,22 @@ If this symlink doesn't exist, create it: -smbspool has been written by Mike Sweet from the CUPS folks. It is +smbspool has been written by Mike Sweet from the CUPS folks. It is included and ships with Samba. It may also be used with print subsystems other than CUPS, to spool jobs to Windows printer shares. To -set up printer "winprinter" on CUPS, you need to have a "driver" for +set up printer winprinter on CUPS, you need to have a driver for it. Essentially this means to convert the print data on the CUPS/Samba host to a format that the printer can digest (the Windows host is -unable to convert any files you may send). This also means you should +unable to convert any files you may send). This also means you should be able to print to the printer if it were hooked directly at your Samba/CUPS host. For troubleshooting purposes, this is what you -should do, to determine if that part of the process chain is in +should do to determine if that part of the process chain is in order. Then proceed to fix the network connection/authentication to -the Windows host, etc. +the Windows host, and so on. -To install a printer with the smb backend on CUPS, use this command: +To install a printer with the smb backend on CUPS, use this command: @@ -5089,299 +5015,101 @@ To install a printer with the smb backend on CUPS, use this command: -The PPD must be able to direct CUPS to generate -the print data for the target model. For PostScript printers just use +The PPD must be able to direct CUPS to generate +the print data for the target model. For PostScript printers, just use the PPD that would be used with the Windows NT PostScript driver. But what can you do if the printer is only accessible with a password? Or if the printer's host is part of another workgroup? This is provided -for: you can include the required parameters as part of the -smb:// device-URI. Like this: +for: You can include the required parameters as part of the +smb:// device-URI like this: - smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename - smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename - smb://username:password@WINDOWSNETBIOSNAME/printersharename + smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename + smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename + smb://username:password@WINDOWSNETBIOSNAME/printersharename Note that the device-URI will be visible in the process list of the -Samba server (e.g. when someone uses the ps -aux +Samba server (e.g., when someone uses the ps -aux command on Linux), even if the username and passwords are sanitized -before they get written into the log files. So this is an inherently -insecure option. However it is the only one. Don't use it if you want +before they get written into the log files. So this is an inherently +insecure option, however, it is the only one. Don't use it if you want to protect your passwords. Better share the printer in a way that -doesn't require a password! Printing will only work if you have a +does not require a password! Printing will only work if you have a working netbios name resolution up and running. Note that this is a -feature of CUPS and you don't necessarily need to have smbd running -(but who wants that? :-). +feature of CUPS and you do not necessarily need to have smbd running. + -More CUPS filtering Chains +More CUPS-Filtering Chains The following diagrams reveal how CUPS handles print jobs. -cups1Filtering chain 1 - -cups2Filtering chain with cupsomatic - - -Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -CUPS and ESP PrintPro plug-in where rastertosomething is noted. - - - Common Errors - Win9x client can't install driver + Windows 9x/ME Client Can't Install Driver - For Win9x clients require the printer names to be 8 -chars (or "8 plus 3 chars suffix") max; otherwise the driver files -won't get transferred when you want to download them from + For Windows 9x/ME, clients require the printer names to be eight +characters (or 8 plus 3 chars suffix) max; otherwise, the driver files +will not get transferred when you want to download them from Samba. - "cupsaddsmb" keeps asking for root password in - neverending loop + <quote>cupsaddsmb</quote> Keeps Asking for Root Password in Never-ending Loop Have you securityuser? Have you used smbpasswd to give root a Samba account? -You can do 2 things: open another terminal and execute -smbpasswd -a root to create the account, and -continue with entering the password into the first terminal. Or break -out of the loop by hitting ENTER twice (without trying to type a +You can do two things: open another terminal and execute +smbpasswd -a root to create the account and +continue entering the password into the first terminal. Or break +out of the loop by pressing ENTER twice (without trying to type a password). - "cupsaddsmb" gives "No PPD file for printer..." - message while PPD file is present + <quote>cupsaddsmb</quote> Errors + + + The use of cupsaddsmb gives No PPD file for printer... Message While PPD File Is Present. + What might the problem be? + Have you enabled printer sharing on CUPS? This means: -do you have a <Location +Do you have a <Location /printers>....</Location> section in CUPS -server's cupsd.conf which doesn't deny access to -the host you run "cupsaddsmb" from? It could be +server's cupsd.conf that does not deny access to +the host you run cupsaddsmb from? It could be an issue if you use cupsaddsmb remotely, or if you use it with a parameter: cupsaddsmb -H sambaserver -h cupsserver -v printername. Is your -"TempDir" directive in -cupsd.conf +TempDir directive in +cupsd.conf set to a valid value and is it writeable? - Client can't connect to Samba printer + Client Can't Connect to Samba Printer Use smbstatus to check which user you are from Samba's point of view. Do you have the privileges to write into the [print$] @@ -5390,127 +5118,130 @@ share? - Can't reconnect to Samba under new account - from Win2K/XP - Once you are connected as the "wrong" user (for -example as "nobody", which often occurs if you have + New Account Reconnection from Windows 200x/XP Troubles + +Once you are connected as the wrong user (for +example, as nobody, which often occurs if you have map to guestbad user), Windows Explorer will not accept an -attempt to connect again as a different user. There won't be any byte +attempt to connect again as a different user. There will not be any byte transfered on the wire to Samba, but still you'll see a stupid error -message which makes you think that Samba has denied access. Use +message that makes you think Samba has denied access. Use smbstatus to check for active connections. Kill the -PIDs. You still can't re-connect and get the dreaded +PIDs. You still can't re-connect and you get the dreaded You can't connect with a second account from the same -machine message, as soon as you are trying? And you -don't see any single byte arriving at Samba (see logs; use "ethereal") -indicating a renewed connection attempt? Shut all Explorer Windows. +machine message, as soon as you are trying. And you +do not see any single byte arriving at Samba (see logs; use ethereal) +indicating a renewed connection attempt. Shut all Explorer Windows. This makes Windows forget what it has cached in its memory as -established connections. Then re-connect as the right user. Best +established connections. Then reconnect as the right user. The best method is to use a DOS terminal window and first do net use z: \\&example.server.samba;\print$ /user:root. Check with smbstatus that you are connected under a -different account. Now open the "Printers" folder (on the Samba server -in the Network Neighbourhood), right-click the +different account. Now open the Printers folder (on the Samba server +in the Network Neighborhood), right-click on the printer in question and select -Connect... +Connect... - Avoid being connected to the Samba server as the - "wrong" user +Avoid Being Connected to the Samba Server as the Wrong User - You see per smbstatus that you are -connected as user "nobody"; while you wanted to be "root" or -"printeradmin"? This is probably due to -map to guestbad user, which silently connects you under the guest account, +You see per smbstatus that you are +connected as user nobody; while you want to be root or +printeradmin. This is probably due to +map to guestbad user, which silently connects you under the guest account when you gave (maybe by accident) an incorrect username. Remove map to guest, if you want to prevent this. -Upgrading to CUPS drivers from Adobe drivers on - NT/2K/XP clients gives problems + +Upgrading to CUPS Drivers from Adobe Drivers + + +This information came from a mailinglist posting regarding problems experienced when +upgrading from Adobe drivers to CUPS drivers on Microsoft Windows NT/200x/XP Clients. + - First delete all "old" Adobe-using printers. Then -delete all "old" Adobe drivers. (On Win2K/XP, right-click in -background of "Printers" folder, select "Server Properties...", select -tab "Drivers" and delete here). +First delete all old Adobe-using printers. Then +delete all old Adobe drivers. (On Windows 200x/XP, right-click in +the background of Printers folder, select Server Properties..., select +tab Drivers and delete here). -Can't use "cupsaddsmb" on Samba server which is - a PDC -Do you use the "naked" root user name? Try to do it +Can't Use <quote>cupsaddsmb</quote> on Samba Server Which Is a PDC +Do you use the naked root user name? Try to do it this way: cupsaddsmb -U DOMAINNAME\\root -v printername> (note the two backslashes: the first one is -required to "escape" the second one). +required to escape the second one). -Deleted Win2K printer driver is still shown -Deleting a printer on the client won't delete the +Deleted Windows 200x Printer Driver Is Still Shown +Deleting a printer on the client will not delete the driver too (to verify, right-click on the white background of the -"Printers" folder, select "Server Properties" and click on the -"Drivers" tab). These same old drivers will be re-used when you try to +Printers folder, select Server Properties and click on the +Drivers tab). These same old drivers will be re-used when you try to install a printer with the same name. If you want to update to a new driver, delete the old ones first. Deletion is only possible if no other printer uses the same driver. -Win2K/XP "Local Security - Policies" -Local Security Policies may not -allow the installation of unsigned drivers. "Local Security Policies" +Windows 200x/XP "Local Security Policies" +Local Security Policies may not +allow the installation of unsigned drivers. Local Security Policies may not allow the installation of printer drivers at all. -WinXP clients: "Administrator can not install - printers for all local users" -Windows XP handles SMB printers on a "per-user" basis. +Administrator Cannot Install Printers for All Local Users +Windows XP handles SMB printers on a per-user basis. This means every user needs to install the printer himself. To have a printer available for everybody, you might want to use the built-in IPP client capabilities of WinXP. Add a printer with the print path of -http://cupsserver:631/printers/printername. -Still looking into this one: maybe a "logon script" could +http://cupsserver:631/printers/printername. +We're still looking into this one. Maybe a logon script could automatically install printers for all users. -"Print Change Notify" functions on - NT-clients -For "print change notify" functions on NT++ clients, -these need to run the "Server" service first (re-named to -File & Print Sharing for MS Networks in +Print Change Notify Functions on NT-clients +For print change, notify functions on NT++ clients. +These need to run the Server service first (renamed to +File & Print Sharing for MS Networks in XP). -WinXP-SP1 -WinXP-SP1 introduced a Point and Print -Restriction Policy (this restriction doesn't apply to -"Administrator" or "Power User" groups of users). In Group Policy -Object Editor: go to User Configuration, - Administrative Templates, Control Panel, -Printers. The policy is automatically set to -Enabled and the Users can only Point -and Print to machines in their Forest . You probably need -to change it to Disabled or Users can -only Point and Print to these servers in order to make -driver downloads from Samba possible. - -Print options for all users can't be set on Win2K/XP + +WinXP-SP1 + +WinXP-SP1 introduced a Point and Print Restriction Policy (this restriction does not apply to +Administrator or Power User groups of users). In Group Policy +Object Editor, go to User Configuration -> Administrative Templates -> + Control Panel -> Printers. The policy is automatically set to +Enabled and the Users can only Point +and Print to machines in their Forest . You probably need +to change it to Disabled or Users can +only Point and Print to these servers to make +driver downloads from Samba possible. + + + + +Print Options for All Users Can't Be Set on Windows 200x/XP How are you doing it? I bet the wrong way (it is not -very easy to find out, though). There are 3 different ways to bring +easy to find out, though). There are three different ways to bring you to a dialog that seems to set everything. All -three dialogs look the same. Only one of them -does what you intend. You need to be -Administrator or Print Administrator to do this for all users. Here +three dialogs look the same, yet only one of them +does what you intend. You need to be +Administrator or Print Administrator to do this for all users. Here is how I do in on XP: -The first "wrong" way: +The first wrong way: - -Open the Printers + +Open the Printers folder. Right-click on the printer -(remoteprinter on cupshost) and -select in context menu Printing -Preferences... +(remoteprinter on cupshost) and +select in context menu Printing +Preferences... Look at this dialog closely and remember what it looks like. @@ -5518,21 +5249,21 @@ like. -The second "wrong" way: +The second wrong way: - -Open the Printers + +Open the Printers folder. -Right-click on the printer (remoteprinter on -cupshost) and select in the context menu -Properties +Right-click on the printer (remoteprinter on +cupshost) and select the context menu +Properties. -Click on the General -tab +Click on the General +tab. -Click on the button Printing -Preferences... +Click on the button Printing +Preferences... A new dialog opens. Keep this dialog open and go back to the parent dialog. @@ -5540,118 +5271,136 @@ to the parent dialog. -The third, the "correct" way: (should you do -this from the beginning, just carry out steps 1. and 2. from second -"way" above) +The third, and the correct way: + + + +Open the Printers +folder. - -Click on the Advanced -tab. (Hmmm... if everything is "Grayed Out", then you are not logged +Click on the Advanced +tab. (If everything is grayed out, then you are not logged in as a user with enough privileges). -Click on the Printing -Defaults... button. +Click on the Printing +Defaults... button. On any of the two new tabs, click on the -Advanced... +Advanced... button. -A new dialog opens. Compare this one to the other, -identical looking one from "B.5" or A.3". +A new dialog opens. Compare this one to the other +identical looking one from B.5 or A.3". -Do you see any difference? I don't either... However, only the last -one, which you arrived at with steps "C.1.-6." will save any settings +Do you see any difference? I don't either. However, only the last +one, which you arrived at with steps C.1.-6., will save any settings permanently and be the defaults for new users. If you want all clients to get the same defaults, you need to conduct these steps as Administrator (printer admin in &smb.conf;) before a client downloads the driver (the clients can later set their own per-user defaults by following the -procedures A. or B. +procedures A or B above). -Most common blunders in driver - settings on Windows clients - Don't use Optimize for -Speed: use Optimize for -Portability instead (Adobe PS Driver) Don't use -Page Independence: No: always -settle with Page Independence: -Yes (Microsoft PS Driver and CUPS PS Driver for -WinNT/2K/XP) If there are problems with fonts: use -Download as Softfont into -printer (Adobe PS Driver). For -TrueType Download Options -choose Outline. Use PostScript -Level 2, if you are having trouble with a non-PS printer, and if +Most Common Blunders in Driver Settings on Windows Clients +Don't use Optimize for +Speed, but use Optimize for +Portability instead (Adobe PS Driver). Don't use +Page Independence: No: always +settle with Page Independence: +Yes (Microsoft PS Driver and CUPS PS Driver for +Windows NT/200x/XP). If there are problems with fonts, use +Download as Softfont into +printer (Adobe PS Driver). For +TrueType Download Options +choose Outline. Use PostScript +Level 2, if you are having trouble with a non-PS printer and if there is a choice. -<command>cupsaddsmb</command> does not work - with newly installed printer -Symptom: the last command of -cupsaddsmb doesn't complete successfully: +<command>cupsaddsmb</command> Does Not Work with Newly Installed Printer +Symptom: The last command of +cupsaddsmb does not complete successfully: cmd = setdriver printername printername result was NT_STATUS_UNSUCCESSFUL then possibly the printer was not yet -"recognized" by Samba. Did it show up in Network -Neighbourhood? Did it show up in rpcclient -hostname -c 'enumprinters'? Restart smbd (or send a +recognized by Samba. Did it show up in Network +Neighborhood? Did it show up i n rpcclient +hostname -c `enumprinters'? Restart smbd (or send a kill -HUP to all processes listed by smbstatus and try again. -Permissions on -<filename>/var/spool/samba/</filename> get reset after each -reboot -Have you by accident set the CUPS spool directory to -the same location? (RequestRoot -/var/spool/samba/ in cupsd.conf or + +Permissions on <filename>/var/spool/samba/</filename> Get Reset After Each Reboot +Have you ever by accident set the CUPS spool directory to +the same location? (RequestRoot /var/spool/samba/ in cupsd.conf or the other way round: /var/spool/cups/ is set as path> in the [printers] -section). These must be different. Set +section). These must be different. Set + RequestRoot /var/spool/cups/ in cupsd.conf and path /var/spool/samba in the [printers] section of &smb.conf;. Otherwise cupsd will -sanitize permissions to its spool directory with each restart, and +sanitize permissions to its spool directory with each restart and printing will not work reliably. -Printer named "lp" -intermittently swallows jobs and spits out completely different -ones -It is a very bad idea to name any printer "lp". This + +Print Queue Called <quote>lp</quote> Mis-handles Print Jobs + + +In this case a print queue called lp intermittently swallows jobs and +spits out completely different ones from what was sent. + + +It is a bad idea to name any printer lp. This is the traditional UNIX name for the default printer. CUPS may be set -up to do an automatic creation of "Implicit Classes". This means, to +up to do an automatic creation of Implicit Classes. This means, to group all printers with the same name to a pool of devices, and -loadbalancing the jobs across them in a round-robin fashion. Chances -are high that someone else has an "lp" named printer too. You may +load-balancing the jobs across them in a round-robin fashion. Chances +are high that someone else has a printer named lp too. You may receive his jobs and send your own to his device unwittingly. To have tight control over the printer names, set BrowseShortNames -No. It will present any printer as "printername@cupshost" -then, giving you a better control over what may happen in a large +No. It will present any printer as printername@cupshost +and then gives you better control over what may happen in a large networked environment. -Location of Adobe PostScript driver files necessary for "cupsaddsmb" +Location of Adobe PostScript Driver Files for <quote>cupsaddsmb</quote> Use smbclient to connect to any Windows box with a shared PostScript printer: smbclient //windowsbox/print\$ -U guest. You can navigate to the W32X86/2 subdir to mget ADOBE* -and other files or to WIN40/0 to do the same. -- +and other files or to WIN40/0 to do the same. Another option is to download the *.exe packaged -files from the Adobe website. +files from the Adobe Web site. -An Overview of the CUPS Printing Processes +Overview of the CUPS Printing Processes + +A complete overview of the CUPS printing processes can be found in . -CUPS Printing Overview +CUPS printing overview. a_small + + + + + + + + + + + + diff --git a/docs/docbook/projdoc/Compiling.xml b/docs/docbook/projdoc/Compiling.xml index ccb2f46f3f..da28e43859 100644 --- a/docs/docbook/projdoc/Compiling.xml +++ b/docs/docbook/projdoc/Compiling.xml @@ -1,32 +1,33 @@ &author.jelmer; + &author.jht; &author.tridge; 22 May 2001 18 March 2003 -How to compile Samba +How to Compile Samba -You can obtain the samba source from the -samba website. To obtain a development version, -you can download samba from CVS or using rsync. +You can obtain the Samba source from the +Samba Website. To obtain a development version, +you can download Samba from CVS or using rsync. -Access Samba source code via CVS +Access Samba Source Code via CVS -CVS Introduction -Samba is developed in an open environment. Developers use CVS -(Concurrent Versioning System) to "checkin" (also known as -"commit") new source code. Samba's various CVS branches can +CVS +Samba is developed in an open environment. Developers use +Concurrent Versioning System (CVS) to checkin (also known as +commit) new source code. Samba's various CVS branches can be accessed via anonymous CVS using the instructions detailed in this chapter. @@ -44,71 +45,70 @@ This chapter is a modified version of the instructions found at The machine samba.org runs a publicly accessible CVS repository for access to the source code of several packages, -including samba, rsync, distcc, ccache and jitterbug. There are two main ways -of accessing the CVS server on this host. +including Samba, rsync, distcc, ccache, and jitterbug. There are two main ways +of accessing the CVS server on this host: Access via CVSweb -CVSweb -You can access the source code via your -favourite WWW browser. This allows you to access the contents of -individual files in the repository and also to look at the revision +CVSweb +You can access the source code via your favorite WWW browser. This allows you to access +the contents of individual files in the repository and also to look at the revision history and commit logs of individual files. You can also ask for a diff listing between any two versions on the repository. -Use the URL : http://samba.org/cgi-bin/cvsweb +Use the URL: +http://samba.org/cgi-bin/CVSweb -Access via cvs +Access via CVS You can also access the source code via a -normal cvs client. This gives you much more control over what you can +normal CVS client. This gives you much more control over what you can do with the repository and allows you to checkout whole source trees -and keep them up to date via normal cvs commands. This is the +and keep them up-to-date via normal CVS commands. This is the preferred method of access if you are a developer and not just a casual browser. -To download the latest cvs source code, point your +To download the latest CVS source code, point your browser at the URL : http://www.cyclic.com/. -and click on the 'How to get cvs' link. CVS is free software under -the GNU GPL (as is Samba). Note that there are several graphical CVS clients -which provide a graphical interface to the sometimes mundane CVS commands. -Links to theses clients are also available from the Cyclic website. +and click on the How to get CVS link. CVS is free software under +the GNU GPL (as is Samba). Note that there are several graphical CVS clients +that provide a graphical interface to the sometimes mundane CVS commands. +Links to theses clients are also available from the Cyclic Web site. -To gain access via anonymous cvs use the following steps. +To gain access via anonymous CVS, use the following steps. For this example it is assumed that you want a copy of the -samba source code. For the other source code repositories -on this system just substitute the correct package name +Samba source code. For the other source code repositories +on this system just substitute the correct package name. - Retrieving samba using CVS + Retrieving Samba using CVS - Install a recent copy of cvs. All you really need is a - copy of the cvs client binary. + Install a recent copy of CVS. All you really need is a + copy of the CVS client binary. - Run the command + Run the command: @@ -119,7 +119,7 @@ on this system just substitute the correct package name - When it asks you for a password type cvs. + When it asks you for a password, type cvs. @@ -129,32 +129,32 @@ on this system just substitute the correct package name - cvs -d :pserver:cvs@samba.org:/cvsroot co samba + cvs -d :pserver:CVS@samba.org:/cvsroot co samba. - This will create a directory called samba containing the - latest samba source code (i.e. the HEAD tagged cvs branch). This + This will create a directory called samba containing the + latest Samba source code (i.e., the HEAD tagged CVS branch). This currently corresponds to the 3.0 development tree. CVS branches other then HEAD can be obtained by using the - and defining a tag name. A list of branch tag names - can be found on the "Development" page of the samba web site. A common - request is to obtain the latest 3.0 release code. This could be done by + and defining a tag name. A list of branch tag names + can be found on the Development page of the Samba Web site. A common + request is to obtain the latest 3.0 release code. This could be done by using the following command: - cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_3_0 samba + cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_3_0 samba. - Whenever you want to merge in the latest code changes use - the following command from within the samba directory: + Whenever you want to merge in the latest code changes, use + the following command from within the Samba directory: @@ -169,33 +169,34 @@ on this system just substitute the correct package name - Accessing the samba sources via rsync and ftp + Accessing the Samba Sources via rsync and ftp - rsync - ftp - pserver.samba.org also exports unpacked copies of most parts of the CVS + rsync + ftp + pserver.samba.org also exports unpacked copies of most parts of the CVS tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. - See the rsync homepage for more info on rsync. + See the rsync homepage for more info on rsync. The disadvantage of the unpacked trees is that they do not support automatic - merging of local changes like CVS does. rsync access is most convenient - for an initial install. + merging of local changes like CVS does. rsync access is most convenient + for an initial install. -Verifying Samba's PGP signature +Verifying Samba's PGP Signature -In these days of insecurity, it's strongly recommended that you verify the PGP -signature for any source file before installing it. Even if you're not -downloading from a mirror site, verifying PGP signatures should be a -standard reflex. +GPG +It is strongly recommended that you verify the PGP signature for any source file before +installing it. Even if you're not downloading from a mirror site, verifying PGP signatures +should be a standard reflex. Many people today use the GNU GPG toolset in place of PGP. +GPG can substitute for PGP. @@ -210,7 +211,7 @@ With that said, go ahead and download the following files: -GPG +PGP The first file is the PGP signature for the Samba source file; the other is the Samba public PGP key itself. Import the public PGP key with: @@ -220,7 +221,7 @@ PGP key itself. Import the public PGP key with: -And verify the Samba source code integrity with: +and verify the Samba source code integrity with: @@ -229,43 +230,44 @@ And verify the Samba source code integrity with: -If you receive a message like, "Good signature from Samba Distribution -Verification Key..." +If you receive a message like, Good signature from Samba Distribution Verification Key... then all is well. The warnings about trust relationships can be ignored. An example of what you would not want to see would be: - - - gpg: BAD signature from "Samba Distribution Verification Key" - - + + gpg: BAD signature from Samba Distribution Verification Key + Building the Binaries -configure - To do this, first run the program ./configure +configure + To build the binaries, first run the program ./configure in the source directory. This should automatically configure Samba for your operating system. If you have unusual - needs then you may wish to run + needs, then you may wish to run &rootprompt;./configure --help - first to see what special options you can enable. - Then executing +first to see what special options you can enable. Now execute ./configure with any arguments it might need: -make +&rootprompt;./configure [... arguments ...] -&rootprompt;make + Executing + - will create the binaries. Once it's successfully - compiled you can use + +make + &rootprompt;make + + will create the binaries. Once it is successfully + compiled you can use &rootprompt;make install @@ -280,9 +282,9 @@ example of what you would not want to see would be: &rootprompt;make installman - Note that if you are upgrading for a previous version + Note that if you are upgrading from a previous version of Samba you might like to know that the old versions of - the binaries will be renamed with a ".old" extension. You + the binaries will be renamed with an .old extension. You can go back to the previous version with &rootprompt;make revert @@ -291,26 +293,25 @@ example of what you would not want to see would be: if you find this version a disaster! - Compiling samba with Active Directory support + Compiling Samba with Active Directory Support - In order to compile samba with ADS support, you need to have installed + In order to compile Samba with ADS support, you need to have installed on your system: - the MIT kerberos development libraries - (either install from the sources or use a package). The - Heimdal libraries will not work. + The MIT or Heimdal kerberos development libraries + (either install from the sources or use a package). - the OpenLDAP development libraries. + The OpenLDAP development libraries. - If your kerberos libraries are in a non-standard location then + If your kerberos libraries are in a non-standard location, then remember to add the configure option . - After you run configure make sure that - include/config.h it generates contains lines like + After you run configure, make sure that + include/config.h it generates contain lines like this: @@ -318,38 +319,56 @@ example of what you would not want to see would be: #define HAVE_LDAP 1 - If it doesn't then configure did not find your krb5 libraries or - your ldap libraries. Look in config.log to figure + If it does not, configure did not find your KRB5 libraries or + your LDAP libraries. Look in config.log to figure out why and fix it. - Installing the required packages for Debian + Installing the Required Packages for Debian - On Debian you need to install the following packages: + On Debian, you need to install the following packages: - libkrb5-dev - krb5-user + libkrb5-dev + krb5-user - Installing the required packages for RedHat + Installing the Required Packages for Red Hat Linux - On RedHat this means you should have at least: + On Red Hat Linux, this means you should have at least: - krb5-workstation (for kinit) - krb5-libs (for linking with) - krb5-devel (because you are compiling from source) + krb5-workstation (for kinit) + krb5-libs (for linking with) + krb5-devel (because you are compiling from source) in addition to the standard development environment. - Note that these are not standard on a RedHat install, and you may need - to get them off CD2. + If these files are not installed on your system, you should check the installation + CDs to find which has them and install the files using your tool of choice. If in doubt + about what tool to use, refer to the Red Hat Linux documentation. + + + + + SuSE Linux Package Requirements + + SuSE Linux installs Heimdal packages that may be required to allow you to build + binary packages. You should verify that the development libraries have been installed on + your system. + + + SuSE Linux Samba RPMs support Kerberos. Please refer to the documentation for + your SuSE Linux system for information regading SuSE Linux specific configuration. + Additionally, SuSE are very active in the maintenance of Samba packages that provide + the maximum capabilities that are available. You should consider using SuSE provided + packages where they are available. + @@ -360,9 +379,10 @@ example of what you would not want to see would be: Starting the &smbd; and &nmbd; - inetd - You must choose to start &smbd; and &nmbd; either + + inetd + You must choose to start &smbd; and &nmbd; either as daemons or from inetd. Don't try to do both! Either you can put them in inetd.conf and have them started on demand @@ -371,8 +391,8 @@ example of what you would not want to see would be: daemons either from the command line or in /etc/rc.local. See the man pages for details on the command line options. Take particular care to read - the bit about what user you need to be in order to start - Samba. In many cases you must be root. + the bit about what user you need to have to start + Samba. In many cases, you must be root. The main advantage of starting &smbd; and &nmbd; using the recommended daemon method @@ -390,17 +410,17 @@ example of what you would not want to see would be: Look at your /etc/services. - What is defined at port 139/tcp. If nothing is defined + What is defined at port 139/tcp? If nothing is defined, then add a line like this: netbios-ssn 139/tcp - similarly for 137/udp you should have an entry like: + Similarly for 137/udp, you should have an entry like: netbios-ns 137/udp - Next edit your /etc/inetd.conf - and add two lines something like this: + Next, edit your /etc/inetd.conf + and add two lines like this: netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd @@ -408,33 +428,35 @@ example of what you would not want to see would be: The exact syntax of /etc/inetd.conf - varies between unixes. Look at the other entries in inetd.conf + varies between UNIXes. Look at the other entries in inetd.conf for a guide. + xinetd - Some distributions use xinetd instead of inetd. Consult the + Some distributions use xinetd instead of inetd. Consult the xinetd manual for configuration information. - Some unixes already have entries like netbios_ns + Some UNIXes already have entries like netbios_ns (note the underscore) in /etc/services. - You must either edit /etc/services or + You must edit /etc/services or /etc/inetd.conf to make them consistent. + ifconfig - On many systems you may need to use the + On many systems you may need to use the interfaces option in &smb.conf; to specify the IP address and netmask of your interfaces. Run ifconfig - as root if you don't know what the broadcast is for your + as root if you do not know what the broadcast is for your net. &nmbd; tries to determine it at run - time, but fails on some unixes. + time, but fails on some UNIXes. - Many unixes only accept around 5 + Many UNIXes only accept around five parameters on the command line in inetd.conf. This means you shouldn't use spaces between the options and - arguments, or you should use a script, and start the script + arguments, or you should use a script and start the script from inetd. Restart inetd, perhaps just send @@ -447,11 +469,12 @@ example of what you would not want to see would be: - Alternative: starting it as a daemon + Alternative: Starting &smbd; as a Daemon - daemon - To start the server as a daemon you should create + + daemon + To start the server as a daemon, you should create a script something like this one, perhaps calling it startsmb. @@ -461,17 +484,17 @@ example of what you would not want to see would be: /usr/local/samba/bin/nmbd -D - then make it executable with chmod + Make it executable with chmod +x startsmb You can then run startsmb by - hand or execute it from /etc/rc.local + hand or execute it from /etc/rc.local. - To kill it send a kill signal to the processes + To kill it, send a kill signal to the processes &nmbd; and &smbd;. - If you use the SVR4 style init system then + If you use the SVR4 style init system, you may like to look at the examples/svr4-startup script to make Samba fit into that system. diff --git a/docs/docbook/projdoc/DOMAIN_MEMBER.xml b/docs/docbook/projdoc/DOMAIN_MEMBER.xml index 8e0aa92861..b528fe9b61 100644 --- a/docs/docbook/projdoc/DOMAIN_MEMBER.xml +++ b/docs/docbook/projdoc/DOMAIN_MEMBER.xml @@ -6,24 +6,25 @@ &author.jerry; &author.tridge; &author.jelmer; + &person.gd;LDAP updates Domain Membership -Domain Membership is a subject of vital concern, Samba must be able to -participate as a member server in a Microsoft Domain security context, and +Domain Membership is a subject of vital concern. Samba must be able to +participate as a member server in a Microsoft Domain Security context, and Samba must be capable of providing Domain machine member trust accounts, -otherwise it would not be capable of offering a viable option for many users. +otherwise it would not be able to offer a viable option for many users. -This chapter covers background information pertaining to domain membership, -Samba configuration for it, and MS Windows client procedures for joining a -domain. Why is this necessary? Because both are areas in which there exists +This chapter covers background information pertaining to Domain Membership, +the Samba configuration for it, and MS Windows client procedures for joining a +domain. Why is this necessary? Because both are areas in which there exists within the current MS Windows networking world and particularly in the UNIX/Linux networking and administration world, a considerable level of -mis-information, incorrect understanding, and a lack of knowledge. Hopefully +misinformation, incorrect understanding and a lack of knowledge. Hopefully this chapter will fill the voids. @@ -31,40 +32,37 @@ this chapter will fill the voids. Features and Benefits -MS Windows workstations and servers that want to participate in domain security need to -be made Domain members. Participating in Domain security is often called +MS Windows workstations and servers that want to participate in Domain Security need to +be made Domain Members. Participating in Domain Security is often called Single Sign On or SSO for short. This chapter describes the process that must be followed to make a workstation -(or another server - be it an MS Windows NT4 / 200x -server) or a Samba server a member of an MS Windows Domain security context. +(or another server &smbmdash; be it an MS Windows NT4 / 200x +server) or a Samba server a member of an MS Windows Domain Security context. -Samba-3 can join an MS Windows NT4 style domain as a native member server, an +Server TypeDomain Member +Samba-3 can join an MS Windows NT4-style domain as a native member server, an MS Windows Active Directory Domain as a native member server, or a Samba Domain -Control network. - - - -Domain membership has many advantages: +Control network. Domain Membership has many advantages: - MS Windows workstation users get the benefit of SSO +SAM + MS Windows workstation users get the benefit of SSO. - Domain user access rights and file ownership / access controls can be set - from the single Domain SAM (Security Account Manager) database - (works with Domain member servers as well as with MS Windows workstations - that are domain members) + Domain user access rights and file ownership/access controls can be set + from the single Domain Security Account Manager (SAM) database + (works with Domain Member servers as well as with MS Windows workstations + that are Domain Members). - Only MS Windows NT4 / 200x / XP Professional - workstations that are Domain members - can use network logon facilities + Only MS Windows NT4/200x/XP Professional + workstations that are Domain Members can use network logon facilities. @@ -74,15 +72,15 @@ Domain membership has many advantages: Through the use of logon scripts, users can be given transparent access to network - applications that run off application servers + applications that run off application servers. Network administrators gain better application and user access management abilities because there is no need to maintain user accounts on any network client or server, other than the central Domain database - (either NT4/Samba SAM style Domain, NT4 Domain that is back ended with an - LDAP directory, or via an Active Directory infrastructure) + (either NT4/Samba SAM style Domain, NT4 Domain that is backended with an + LDAP directory, or via an Active Directory infrastructure). @@ -91,35 +89,32 @@ Domain membership has many advantages: MS Windows Workstation/Server Machine Trust Accounts -machine trust accounts - -A machine trust account is an account that is used to authenticate a client -machine -(rather than a user) to the Domain Controller server. In Windows terminology, -this is known as a "Computer Account." +Machine Trust Accounts +A Machine Trust Account is an account that is used to authenticate a client +machine (rather than a user) to the Domain Controller server. In Windows terminology, +this is known as a Computer Account. The purpose of the machine account +is to prevent a rogue user and Domain Controller from colluding to gain access to a +domain member workstation. -The password of a machine trust account acts as the shared secret for -secure communication with the Domain Controller. This is a security +The password of a Machine Trust Account acts as the shared secret for +secure communication with the Domain Controller. This is a security feature to prevent an unauthorized machine with the same NetBIOS name from joining the domain and gaining access to domain user/group -accounts. Windows NT, 200x, XP Professional clients use machine trust -accounts, but Windows 9x / Me / XP Home clients do not. Hence, a -Windows 9x / Me / XP Home client is never a true member of a domain -because it does not possess a machine trust account, and thus has no -shared secret with the domain controller. +accounts. Windows NT/200x/XP Professional clients use machine trust +accounts, but Windows 9x/Me/XP Home clients do not. Hence, a +Windows 9x/Me/XP Home client is never a true member of a Domain +because it does not possess a Machine Trust Account, and, thus, has no +shared secret with the Domain Controller. -A Windows NT4 PDC stores each machine trust account in the Windows Registry. +A Windows NT4 PDC stores each Machine Trust Account in the Windows Registry. The introduction of MS Windows 2000 saw the introduction of Active Directory, -the new repository for machine trust accounts. - - - -A Samba PDC, however, stores each machine trust account in two parts, +the new repository for Machine Trust Accounts. A Samba PDC, however, stores +each Machine Trust Account in two parts, as follows: @@ -132,31 +127,30 @@ as follows: The older format of this data is the smbpasswd database - which contains the UNIX login ID, the UNIX user identifier (UID), and the + that contains the UNIX login ID, the UNIX user identifier (UID), and the LanMan and NT encrypted passwords. There is also some other information in this file that we do not need to concern ourselves with here. - The two newer database types are called ldapsam, - tdbsam. Both store considerably more data than the + The two newer database types are called ldapsam, and + tdbsam. Both store considerably more data than the older smbpasswd file did. The extra information - enables new user account controls to be used. + enables new user account controls to be implemented. A corresponding UNIX account, typically stored in - /etc/passwd. Work is in progress to allow a + /etc/passwd. Work is in progress to allow a simplified mode of operation that does not require UNIX user accounts, but this may not be a feature of the early releases of Samba-3. -machine trust accountscreating - -There are three ways to create machine trust accounts: +Machine Trust Accountscreating +There are three ways to create Machine Trust Accounts: @@ -167,14 +161,14 @@ There are three ways to create machine trust accounts: Server Manager - Using the MS Windows NT4 Server Manager (either from an NT4 Domain member - server, or using the Nexus toolkit available from the Microsoft web site. - This tool can be run from any MS Windows machine so long as the user is + Using the MS Windows NT4 Server Manager, either from an NT4 Domain Member + server, or using the Nexus toolkit available from the Microsoft Web site. + This tool can be run from any MS Windows machine as long as the user is logged on as the administrator account. - "On-the-fly" creation. The Samba machine trust account is automatically + On-the-fly creation. The Samba Machine Trust Account is automatically created by Samba at the time the client is joined to the domain. (For security, this is the recommended method.) The corresponding UNIX account may be created automatically or manually. @@ -185,25 +179,27 @@ There are three ways to create machine trust accounts: Manual Creation of Machine Trust Accounts -The first step in manually creating a machine trust account is to manually +The first step in manually creating a Machine Trust Account is to manually create the corresponding UNIX account in /etc/passwd. -This can be done using vipw or another 'add user' command -that is normally used to create new UNIX accounts. The following is an example for a Linux based Samba server: -useradd -vipw - - +This can be done using vipw or another add user command +that is normally used to create new UNIX accounts. The following is an example for +a Linux-based Samba server: +useradd +vipw -&rootprompt;/usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" \ +&rootprompt;/usr/sbin/useradd -g machines -d /dev/null -c "machine nickname" \ -s /bin/false machine_name$ &rootprompt;passwd -l machine_name$ +In the above example above there is an existing system group machines which is used +as the primary group for all machine accounts. In the following examples the machines group has +numeric GID equal 100. chpass @@ -213,14 +209,14 @@ On *BSD systems, this can be done using the chpass utility: &rootprompt;chpass -a \ - "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin" +'machine_name$:*:101:100::0:0:Windows machine_name:/dev/null:/sbin/nologin' The /etc/passwd entry will list the machine name -with a "$" appended, won't have a password, will have a null shell and no -home directory. For example a machine named 'doppy' would have an +with a $ appended, will not have a password, will have a null shell and no +home directory. For example, a machine named doppy would have an /etc/passwd entry like this: @@ -232,15 +228,15 @@ doppy$:x:505:100:machine_nickname:/dev/null:/bin/fals Above, machine_nickname can be any descriptive name for the client, i.e., BasementComputer. machine_name absolutely must be the NetBIOS -name of the client to be joined to the domain. The "$" must be +name of the client to be joined to the domain. The $ must be appended to the NetBIOS name of the client or Samba will not recognize -this as a machine trust account. +this as a Machine Trust Account. Now that the corresponding UNIX account has been created, the next step is to create the Samba account for the client containing the well-known initial -machine trust account password. This can be done using the +Machine Trust Account password. This can be done using the smbpasswd command as shown here: @@ -253,39 +249,47 @@ as shown here: where machine_name is the machine's NetBIOS -name. The RID of the new machine account is generated from the UID of +name. The RID of the new machine account is generated from the UID of the corresponding UNIX account. - Join the client to the domain immediately +Join the client to the domain immediately - - Manually creating a machine trust account using this method is the - equivalent of creating a machine trust account on a Windows NT PDC using - Server Manager - the Server Manager. From the time at which the - account is created to the time which the client joins the domain and - changes the password, your domain is vulnerable to an intruder joining - your domain using a machine with the same NetBIOS name. A PDC inherently - trusts members of the domain and will serve out a large degree of user - information to such clients. You have been warned! - + +Manually creating a Machine Trust Account using this method is the +equivalent of creating a Machine Trust Account on a Windows NT PDC using +Server Manager +the Server Manager. From the time at which the +account is created to the time the client joins the domain and +changes the password, your domain is vulnerable to an intruder joining +your domain using a machine with the same NetBIOS name. A PDC inherently +trusts members of the domain and will serve out a large degree of user +information to such clients. You have been warned! + -Using NT4 Server Manager to Add Machine Accounts to the Domain +Managing Domain Machine Accounts using NT4 Server Manager +A working add machine script script is essential +for machine trust accounts to be automatically created. This applies no matter whether +one uses automatic account creation, or if one wishes to use the NT4 Domain Server Manager. + + + +SRVTOOLS.EXE If the machine from which you are trying to manage the domain is an -MS Windows NT4 workstation or MS Windows 200x / XP Professional -then the tool of choice is the package called SRVTOOLS.EXE. -When executed in the target directory this will unpack SrvMge.exe +MS Windows NT4 workstation or MS Windows 200x/XP Professional, +the tool of choice is the package called SRVTOOLS.EXE. +When executed in the target directory it will unpack SrvMgr.exe and UsrMgr.exe (both are domain management tools for MS Windows NT4 workstation). +Nexus.exe If your workstation is a Microsoft Windows 9x/Me family product you should download the Nexus.exe package from the Microsoft web site. When executed from the target directory this will unpack the same tools but for use on @@ -294,8 +298,13 @@ this platform. Further information about these tools may be obtained from the following locations: - - + + + + + + + @@ -305,31 +314,31 @@ Launch the srvmgr.exe (Server Manager for Domains) and follow Server Manager Account Machine Account Management - From the menu select Computer + From the menu select Computer. - Click on Select Domain + Click Select Domain. - Click on the name of the domain you wish to administer in the + Click the name of the domain you wish to administer in the Select Domain panel and then click OK. - Again from the menu select Computer + Again from the menu select Computer. - Select Add to Domain + Select Add to Domain. - In the dialog box, click on the radio button to + In the dialog box, click the radio button to Add NT Workstation of Server, then - enter the machine name in the field provided, then click the + enter the machine name in the field provided, and click the Add button. @@ -337,30 +346,30 @@ Launch the srvmgr.exe (Server Manager for Domains) and follow -"On-the-Fly" Creation of Machine Trust Accounts +On-the-Fly Creation of Machine Trust Accounts -The second (and recommended) way of creating machine trust accounts is +The second (and recommended) way of creating Machine Trust Accounts is simply to allow the Samba server to create them as needed when the client is joined to the domain. -Since each Samba machine trust account requires a corresponding UNIX account, a method +Since each Samba Machine Trust Account requires a corresponding UNIX account, a method for automatically creating the UNIX account is usually supplied; this requires configuration of the -add machine script option in -&smb.conf;. This method is not required, however; corresponding UNIX +add machine script option in &smb.conf;. This method is not required, however, corresponding UNIX accounts may also be created manually. -Below is an example for a RedHat Linux system. +Here is an example for a Red Hat Linux system. [global] <...remainder of parameters...> -add machine script/usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u +add machine script/usr/sbin/useradd -d /dev/null -g 100 \ + -s /bin/false -M %u @@ -371,67 +380,62 @@ Below is an example for a RedHat Linux system. The procedure for making an MS Windows workstation or server a member of the domain varies -with the version of Windows: +with the version of Windows. - Windows 200x XP Professional + Windows 200x/XP Professional Client - When the user elects to make the client a domain member, Windows 200x prompts for + When the user elects to make the client a Domain Member, Windows 200x prompts for an account and password that has privileges to create machine accounts in the domain. - A Samba administrative account (i.e., a Samba account that has root privileges on the + A Samba Administrator Account (i.e., a Samba account that has root privileges on the Samba server) must be entered here; the operation will fail if an ordinary user account is given. - Note: For security reasons the password for this administrative account should be set - to a password that is other than that used for the root user in the - /etc/passwd. + For security reasons, the password for this Administrator Account should be set + to a password that is other than that used for the root user in /etc/passwd. - The name of the account that is used to create domain member machine accounts can be - anything the network administrator may choose. If it is other than root - then this is easily mapped to root using the file pointed to be the &smb.conf; parameter + The name of the account that is used to create Domain Member machine accounts can be + anything the network administrator may choose. If it is other than root + then this is easily mapped to root in the file named in the &smb.conf; parameter username map/etc/samba/smbusers. - The session key of the Samba administrative account acts as an - encryption key for setting the password of the machine trust - account. The machine trust account will be created on-the-fly, or - updated if it already exists. + The session key of the Samba Administrator Account acts as an encryption key for setting the password of the machine trust + account. The Machine Trust Account will be created on-the-fly, or updated if it already exists. - Windows NT4 + Windows NT4 Client - If the machine trust account was created manually, on the + If the Machine Trust Account was created manually, on the Identification Changes menu enter the domain name, but do not check the box Create a Computer Account in the Domain. - In this case, the existing machine trust account is used to join the machine + In this case, the existing Machine Trust Account is used to join the machine to the domain. - If the machine trust account is to be created - on-the-fly, on the Identification Changes menu enter the domain - name, and check the box Create a Computer Account in the - Domain. In this case, joining the domain proceeds as above - for Windows 2000 (i.e., you must supply a Samba administrative account when + If the Machine Trust Account is to be created on-the-fly, on the Identification Changes menu enter the domain + name and check the box Create a Computer Account in the Domain. In this case, joining + the domain proceeds as above for Windows 2000 (i.e., you must supply a Samba Administrator Account when prompted). - Samba + Samba Client Joining a Samba client to a domain is documented in - the domain member chapter. + . @@ -445,47 +449,62 @@ with the version of Windows: This mode of server operation involves the Samba machine being made a member of a domain security context. This means by definition that all user authentication will be done from a centrally defined authentication regime. -The authentication regime may come from an NT3/4 style (old domain technology) +The authentication regime may come from an NT3/4-style (old domain technology) server, or it may be provided from an Active Directory server (ADS) running on MS Windows 2000 or later. -Of course it should be clear that the authentication back end itself could be +Of course it should be clear that the authentication backend itself could be from any distributed directory architecture server that is supported by Samba. -This can be LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory -Server, etc. +This can be LDAP (from OpenLDAP), or Sun's iPlanet, or NetWare Directory +Server, and so on. + +When Samba is configured to use an LDAP, or other identity management and/or +directory service, it is Samba that continues to perform user and machine +authentication. It should be noted that the LDAP server does not perform +authentication handling in place of what Samba is designed to do. + + -Please refer to the chapter on setting up a PDC -for more information regarding how to create a domain -machine account for a domain member server as well as for information -regarding how to enable the Samba domain member machine to join the domain and -to be fully trusted by it. +Please refer to , for more information regarding +how to create a domain machine account for a Domain Member server as well as for +information on how to enable the Samba Domain Member machine to join the domain +and be fully trusted by it. -Joining an NT4 type Domain with Samba-3 +Joining an NT4-type Domain with Samba-3 - -
    Assumptions - + lists names that have been used in the remainder of this chapter. + +
    Assumptions + + + - NetBIOS name:SERV1 - Win2K/NT domain name:&example.workgroup; - Domain's PDC NetBIOS name:DOMPDC - Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2 - - + + NetBIOS name:SERV1 + + + Windows 200x/NT domain name:&example.workgroup; + + + Domain's PDC NetBIOS name:DOMPDC + + + Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2 + + +
    -     -First, you must edit your &smb.conf; file to tell Samba it should -now use domain security. +First, you must edit your &smb.conf; file to tell Samba it should now use domain security. @@ -512,13 +531,14 @@ section to read: -as this is the name of the domain we are joining. +This is the name of the domain we are joining. -You must also have the parameter -encrypt passwords set to yes - in order for your users to authenticate to the NT PDC. +You must also have the parameter encrypt passwords +set to yes in order for your users to authenticate to the NT PDC. +This is the defaulty setting if this parameter is not specified. There is no need to specify this +parameter, but if it is specified in the &smb.conf; file, it must be set to Yes. @@ -533,16 +553,16 @@ section to read: -These are the primary and backup domain controllers Samba +These are the primary and backup Domain Controllers Samba will attempt to contact in order to authenticate users. Samba will try to contact each of these servers in order, so you may want to rearrange this list in order to spread out the authentication load -among domain controllers. +among Domain Controllers. -Alternatively, if you want smbd to automatically determine -the list of Domain controllers to use for authentication, you may +Alternately, if you want smbd to automatically determine +the list of Domain Controllers to use for authentication, you may set this line to be: @@ -553,44 +573,47 @@ set this line to be: -This method allows Samba to use exactly the same mechanism that NT does. This -method either broadcasts or uses a WINS database in order to -find domain controllers to authenticate against. +This method allows Samba to use exactly the same mechanism that NT does. The +method either uses broadcast-based name resolution, performs a WINS database +lookup in order to find a Domain Controller against which to authenticate, +or locates the Domain Controller using DNS name resolution. -In order to actually join the domain, you must run this command: +To join the domain, run this command: -&rootprompt;net rpc join -S DOMPDC -UAdministrator%password +&rootprompt;net join -S DOMPDC -UAdministrator%password -If the argument is not given then -the domain name will be obtained from &smb.conf;. +If the argument is not given, the domain name will be obtained from &smb.conf;. -As we are joining the domain DOM and the PDC for that domain -(the only machine that has write access to the domain SAM database) -is DOMPDC, we use it for the option. -The Administrator%password is -the login name and password for an account which has the necessary -privilege to add machines to the domain. If this is successful -you will see the message: +The machine is joining the domain DOM, and the PDC for that domain (the only machine +that has write access to the domain SAM database) is DOMPDC, therefore use the +option. The Administrator%password is the login name and +password for an account that has the necessary privilege to add machines to the +domain. If this is successful, you will see the message in your terminal window the +text shown below. Where the older NT4 style domain architecture is used: + +Joined domain DOM. + -Joined domain DOM. -or Joined 'SERV1' to realm 'MYREALM' +Where Active Directory is used: + +Joined SERV1 to realm MYREALM. + -in your terminal window. See the -net man page for more details. +Refer to the net man page for further information. @@ -599,58 +622,56 @@ trust account on the PDC beforehand. -This command goes through the machine account password -change protocol, then writes the new (random) machine account -password for this Samba server into a file in the same directory -in which an smbpasswd file would be stored - normally: - - - +This command goes through the machine account password change protocol, then writes +the new (random) machine account password for this Samba server into a file in the +same directory in which a smbpasswd file would be normally stored: + /usr/local/samba/private/secrets.tdb +or +/etc/samba/secrets.tdb. + -This file is created and owned by root and is not -readable by any other user. It is the key to the domain-level -security for your system, and should be treated as carefully +This file is created and owned by root and is not readable by any other user. It is +the key to the Domain-level security for your system, and should be treated as carefully as a shadow password file. -Finally, restart your Samba daemons and get ready for -clients to begin using domain security! The way you can restart your -samba daemons depends on your distribution, but in most cases running +Finally, restart your Samba daemons and get ready for clients to begin using domain +security. The way you can restart your Samba daemons depends on your distribution, +but in most cases the following will suffice: - &rootprompt;/etc/init.d/samba restart +&rootprompt;/etc/init.d/samba restart -does the job. -Why is this better than security = server? +Why Is This Better Than <parameter>security = server</parameter>? -Currently, domain security in Samba doesn't free you from +Currently, domain security in Samba does not free you from having to create local UNIX users to represent the users attaching -to your server. This means that if domain user DOM\fred - attaches to your domain security Samba server, there needs +to your server. This means that if Domain user DOM\fred + attaches to your Domain Security Samba server, there needs to be a local UNIX user fred to represent that user in the UNIX -filesystem. This is very similar to the older Samba security mode -security = server, +file system. This is similar to the older Samba security mode +securityserver, where Samba would pass through the authentication request to a Windows NT server in the same way as a Windows 95 or Windows 98 server would. - Please refer to the chapter on winbind for information on a system -to automatically assign UNIX uids and gids to Windows NT Domain users and groups. +Please refer to , for information on a system +to automatically assign UNIX UIDs and GIDs to Windows NT Domain users and groups. -The advantage to domain-level security is that the -authentication in domain-level security is passed down the authenticated +The advantage to Domain-level security is that the +authentication in Domain-level security is passed down the authenticated RPC channel in exactly the same way that an NT server would do it. This means Samba servers now participate in domain trust relationships in exactly the same way NT servers do (i.e., you can add Samba servers into @@ -659,13 +680,13 @@ domain PDC to an account domain PDC). -In addition, with securityserver every Samba +In addition, with securityserver, every Samba daemon on a server has to keep a connection open to the authenticating server for as long as that daemon lasts. This can drain the connection resources on a Microsoft NT server and cause it to run out of available connections. With securitydomain, however, the Samba daemons connect to the PDC/BDC only for as long -as is necessary to authenticate the user, and then drop the connection, +as is necessary to authenticate the user and then drop the connection, thus conserving PDC connection resources. @@ -673,16 +694,15 @@ thus conserving PDC connection resources. And finally, acting in the same manner as an NT server authenticating to a PDC means that as part of the authentication reply, the Samba server gets the user identification information such -as the user SID, the list of NT groups the user belongs to, etc. +as the user SID, the list of NT groups the user belongs to, and so on. -Much of the text of this document -was first published in the Web magazine +Much of the text of this document was first published in the Web magazine LinuxWorld as the article Doing -the NIS/NT Samba. +url="http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba.html"/> +Doing the NIS/NT Samba. @@ -692,52 +712,62 @@ the NIS/NT Samba. Samba ADS Domain Membership + Active Directory ADSActive Directory - KDC Kerberos - -This is a rough guide to setting up Samba 3.0 with Kerberos authentication against a -Windows2000 KDC. A familiarity with Kerberos is assumed. +This is a rough guide to setting up Samba-3 with Kerberos authentication against a +Windows 200x KDC. A familiarity with Kerberos is assumed. -Setup your &smb.conf; +Configure &smb.conf; -You must use at least the following 3 options in &smb.conf;: +You must use at least the following three options in &smb.conf;: realmyour.kerberos.REALM securityADS +The following parameter need only be specified if present. +The default setting is not present is Yes. encrypt passwordsyes -In case samba can't figure out your ads server using your realm name, use the -ads server option in &smb.conf;: +In case samba cannot correctly identify the appropriate ADS server using the realm name, use the +password server option in &smb.conf;: -ads serveryour.kerberos.server +password serveryour.kerberos.server You do not need a smbpasswd file, and older clients will be authenticated as -if securitydomain, although it won't do any harm and -allows you to have local users not in the domain. It is expected that the above -required options will change soon when active directory integration will get -better. +if securitydomain, although it will not do any harm and +allows you to have local users not in the domain. -Setup your <filename>/etc/krb5.conf</filename> +Configure <filename>/etc/krb5.conf</filename> + + +/etc/krb5.conf +Kerberos/etc/krb5.conf +With both MIT and Heimdal Kerberos, this is unnecessary, and may be detrimental. All ADS +domains will automatically create SRV records in the DNS zone _kerberos.REALM.NAME for +each KDC in the realm. MIT's, as well as Heimdal's, KRB5 libraries default to checking +for these records, so they will automatically find the KDCs. In addition, +krb5.conf only allows specifying a single KDC, even there if there is more +than one. Using the DNS lookup allows the KRB5 libraries to use whichever KDCs are available. + -The minimal configuration for krb5.conf is: +When manually configuring krb5.conf, the minimal configuration is: @@ -750,77 +780,128 @@ The minimal configuration for krb5.conf is: } -kinit + +When using Heimdal versions before 0.6 use the following configuration settings: + +[libdefaults] + default_realm = YOUR.KERBEROS.REALM + default_etypes = des-cbc-crc des-cbc-md5 + default_etypes_des = des-cbc-crc des-cbc-md5 + + [realms] + YOUR.KERBEROS.REALM = { + kdc = your.kerberos.server + } + + +kinit Test your config by doing a kinit USERNAME@REALM and making sure that your password is accepted by the Win2000 KDC. + +With Heimdal versions earlier than 0.6.x you only can use newly created accounts +in ADS or accounts that have had the password changed once after migration, or +in case of Administrator after installation. At the +moment, a Windows 2003 KDC can only be used with a Heimdal releases later than 0.6 +(and no default etypes in krb5.conf). Unfortunatly this whole area is still +in a state of flux. + + -The realm must be uppercase or you will get Cannot find KDC for -requested realm while getting initial credentials error (Kerberos +The realm must be in uppercase or you will get Cannot find KDC for +requested realm while getting initial credentials error (Kerberos is case-sensitive!). -Time between the two servers must be synchronized. You will get a -kinit(v5): Clock skew too great while getting initial credentials +Time between the two servers must be synchronized. You will get a +kinit(v5): Clock skew too great while getting initial credentials if the time difference is more than five minutes. + +Clock skew limits are configurable in the Kerberos protocols. The default setting is +five minutes. + + You also must ensure that you can do a reverse DNS lookup on the IP address of your KDC. Also, the name that this reverse lookup maps to -must either be the NetBIOS name of the KDC (ie. the hostname with no -domain attached) or it can alternatively be the NetBIOS name -followed by the realm. +must either be the NetBIOS name of the KDC (i.e., the hostname with no +domain attached) or it can alternately be the NetBIOS name followed by the realm. The easiest way to ensure you get this right is to add a /etc/hosts entry mapping the IP address of your KDC to -its NetBIOS name. If you don't get this right then you will get a +its NetBIOS name. If you do not get this correct then you will get a local error when you try to join the realm. If all you want is Kerberos support in &smbclient; then you can skip -straight to Test with &smbclient; now. -Creating a computer account -and testing your servers -is only needed if you want Kerberos support for &smbd; and &winbindd;. +directly to now. + and +are needed only if you want Kerberos support for &smbd; and &winbindd;. -Create the computer account +Create the Computer Account -As a user that has write permission on the Samba private directory -(usually root) run: +As a user who has write permission on the Samba private directory (usually root), run: &rootprompt; net ads join -U Administrator%password + +When making a Windows client a member of an ADS domain within a complex organization, you +may want to create the machine account within a particular organizational unit. Samba-3 permits +this to be done using the following syntax: + +&rootprompt; kinit Administrator@your.kerberos.REALM +&rootprompt; net ads join organizational_unit + + + + +For example, you may want to create the machine account in a container called Servers +under the organizational directory Computers\BusinessUnit\Department like this: + +&rootprompt; net ads join "Computers\BusinessUnit\Department\Servers" + + + + + -Possible errors +Possible Errors ADS support not compiled in Samba must be reconfigured (remove config.cache) and recompiled - (make clean all install) after the Kerberos libs and headers are installed. + (make clean all install) after the Kerberos libiraries and headers files are installed. net ads join prompts for user name You need to login to the domain using kinit USERNAME@REALM. USERNAME must be a user who has rights to add a machine - to the domain. + to the domain.     + + Unsupported encryption/or checksum types + + Make sure that the /etc/krb5.conf is correctly configured + for the type and version of Kerberos installed on the system. + @@ -829,29 +910,33 @@ As a user that has write permission on the Samba private directory -Test your server setup +Testing Server Setup If the join was successful, you will see a new computer account with the -NetBIOS name of your Samba server in Active Directory (in the "Computers" +NetBIOS name of your Samba server in Active Directory (in the Computers folder under Users and Computers. -On a Windows 2000 client try net use * \\server\share. You should -be logged in with Kerberos without needing to know a password. If -this fails then run klist tickets. Did you get a ticket for the -server? Does it have an encoding type of DES-CBC-MD5 ? +On a Windows 2000 client, try net use * \\server\share. You should +be logged in with Kerberos without needing to know a password. If this fails then run +klist tickets. Did you get a ticket for the server? Does it have +an encryption type of DES-CBC-MD5? + +Samba can use both DES-CBC-MD5 encryption as well as ARCFOUR-HMAC-MD5 encoding. + + Testing with &smbclient; -smbclient +smbclient On your Samba server try to login to a Win2000 server or your Samba server using &smbclient; and Kerberos. Use &smbclient; as usual, but specify the option to choose Kerberos authentication. @@ -864,44 +949,76 @@ specify the option to choose Kerberos authentication. You must change administrator password at least once after DC -install, to create the right encoding types +install, to create the right encryption types. -W2k doesn't seem to create the _kerberos._udp and _ldap._tcp in -their defaults DNS setup. Maybe this will be fixed later in service packs. +Windows 200x does not seem to create the _kerberos._udp and _ldap._tcp in +the default DNS setup. Perhaps this will be fixed later in service packs. + +Sharing User ID Mappings between Samba Domain Members + + +Samba maps UNIX users and groups (identified by UIDs and GIDs) to Windows users and groups (identified by SIDs). +These mappings are done by the idmap subsystem of Samba. + + + +In some cases it is useful to share these mappings between Samba Domain Members, +so name->id mapping is identical on all machines. +This may be needed in particular when sharing files over both CIFS and NFS. + + +To use the LDAP ldap idmap suffix, set: + + +ldap idmap suffixou=Idmap,dc=quenya,dc=org + + +See the &smb.conf; man page entry for the ldap idmap suffix +parameter for further information. + + +Do not forget to specify also the ldap admin dn +and to make certain to set the LDAP administrative password into the secrets.tdb using: + +&rootprompt; smbpasswd -w ldap-admin-password + + + + Common Errors -In the process of adding / deleting / re-adding domain member machine accounts there are -many traps for the unwary player and there are many little things that can go wrong. -It is particularly interesting how often subscribers on the samba mailing list have concluded -after repeated failed attempts to add a machine account that it is necessary to "re-install" -MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type -of problem. The real solution is often very simple, and with understanding of how MS Windows -networking functions easy to overcome. +In the process of adding/deleting/re-adding Domain Member machine accounts, there are +many traps for the unwary player and many little things that can go wrong. +It is particularly interesting how often subscribers on the Samba mailing list have concluded +after repeated failed attempts to add a machine account that it is necessary to re-install +MS Windows on the machine. In truth, it is seldom necessary to reinstall because of this type +of problem. The real solution is often quite simple and with an understanding of how MS Windows +networking functions, it is easy to overcome. -Can Not Add Machine Back to Domain +Cannot Add Machine Back to Domain - A Windows workstation was reinstalled. The original domain machine +A Windows workstation was re-installed. The original domain machine account was deleted and added immediately. The workstation will not join the domain if I use the same machine name. Attempts to add the machine fail with a message that the machine already -exists on the network - I know it doesn't. Why is this failing? +exists on the network &smbmdash; I know it does not. Why is this failing? The original name is still in the NetBIOS name cache and must expire after machine account -deletion BEFORE adding that same name as a domain member again. The best advice is to delete -the old account and then to add the machine with a new name. +deletion before adding that same name as a Domain Member again. The best advice is to delete +the old account and then add the machine with a new name. @@ -910,15 +1027,15 @@ the old account and then to add the machine with a new name. Adding Machine to Domain Fails - Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a -message that, The machine could not be added at this time, there is a network problem. - Please try again later. Why? +Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a +message that, `The machine could not be added at this time, there is a network problem. +Please try again later.' Why? You should check that there is an add machine script in your &smb.conf; file. If there is not, please add one that is appropriate for your OS platform. If a script -has been defined you will need to debug it's operation. Increase the log level +has been defined, you will need to debug its operation. Increase the log level in the &smb.conf; file to level 10, then try to rejoin the domain. Check the logs to see which operation is failing. @@ -933,23 +1050,37 @@ Possible causes include: - Corrective Action: Fix it. Make sure that when run manually - that the script will add both the UNIX system account _and_ the Samba SAM account. + Corrective action: Fix it. Make sure when run manually + that the script will add both the UNIX system account and the Samba SAM account. - The machine could not be added to the UNIX system accounts file /etc/passwd + The machine could not be added to the UNIX system accounts file /etc/passwd. - Corrective Action: Check that the machine name is a legal UNIX - system account name. ie: If the UNIX utility useradd is called + Corrective action: Check that the machine name is a legal UNIX + system account name. If the UNIX utility useradd is called, then make sure that the machine name you are trying to add can be added using this tool. Useradd on some systems will not allow any upper case characters nor will it allow spaces in the name. + +The add machine script does not create the +machine account in the Samba backend database, it is there only to create a UNIX system +account to which the Samba backend database account can be mapped. + + + + + + I Can't Join a Windows 2003 PDC + + Windows 2003 requires SMB signing. Client side SMB signing has been implemented in Samba-3.0. + Set client use spnegoyes when communicating + with a Windows 2003 server. diff --git a/docs/docbook/projdoc/Diagnosis.xml b/docs/docbook/projdoc/Diagnosis.xml index 76984f3076..4856e24a46 100644 --- a/docs/docbook/projdoc/Diagnosis.xml +++ b/docs/docbook/projdoc/Diagnosis.xml @@ -2,10 +2,11 @@ &author.tridge; &author.jelmer; + &author.danshearer; Wed Jan 15 -The Samba checklist +The Samba Checklist Introduction @@ -13,21 +14,21 @@ This file contains a list of tests you can perform to validate your Samba server. It also tells you what the likely cause of the problem -is if it fails any one of these steps. If it passes all these tests +is if it fails any one of these steps. If it passes all these tests, then it is probably working fine. -You should do ALL the tests, in the order shown. We have tried to +You should do all the tests, in the order shown. We have tried to carefully choose them so later tests only use capabilities verified in -the earlier tests. However, do not stop at the first error as there +the earlier tests. However, do not stop at the first error as there have been some instances when continuing with the tests has helped to solve a problem. -If you send one of the samba mailing lists an email saying "it doesn't work" -and you have not followed this test procedure then you should not be surprised +If you send one of the Samba mailing lists an email saying, it does not work +and you have not followed this test procedure, you should not be surprised if your email is ignored. @@ -37,7 +38,7 @@ if your email is ignored. Assumptions -In all of the tests it is assumed you have a Samba server called +In all of the tests, it is assumed you have a Samba server called BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP. @@ -47,13 +48,13 @@ The procedure is similar for other types of clients. It is also assumed you know the name of an available share in your -&smb.conf;. I will assume this share is called tmp. -You can add a tmp share like this by adding the -following to &smb.conf;: +&smb.conf;. I will assume this share is called tmp. +You can add a tmp share like this by adding the +lines shown in . - - smb.conf with [tmp] share + +smb.conf with [tmp] share [tmp] commenttemporary files path/tmp @@ -62,80 +63,77 @@ following to &smb.conf;: -These tests assume version 3.0 or later of the samba suite. +These tests assume version 3.0.0 or later of the Samba suite. Some commands shown did not exist in earlier versions. Please pay attention to the error messages you receive. If any error message -reports that your server is being unfriendly you should first check that your -IP name resolution is correctly set up. eg: Make sure your /etc/resolv.conf +reports that your server is being unfriendly, you should first check that your +IP name resolution is correctly set up. Make sure your /etc/resolv.conf file points to name servers that really do exist. -Also, if you do not have DNS server access for name resolution please check +Also, if you do not have DNS server access for name resolution, please check that the settings for your &smb.conf; file results in dns proxy = no. The -best way to check this is with testparm smb.conf. +best way to check this is with testparm smb.conf. -log filesmonitoring +log filesmonitoring It is helpful to monitor the log files during testing by using the -tail -F log_file_name in a separate +tail -F log_file_name in a separate terminal console (use ctrl-alt-F1 through F6 or multiple terminals in X). Relevant log files can be found (for default installations) in -/usr/local/samba/var. Also, connection logs from -machines can be found here or possibly in /var/log/samba +/usr/local/samba/var. Also, connection logs from +machines can be found here or possibly in /var/log/samba, depending on how or if you specified logging in your &smb.conf; file. If you make changes to your &smb.conf; file while going through these test, -don't forget to restart &smbd; and &nmbd;. +remember to restart &smbd; and &nmbd;. -The tests +The Tests -Diagnosing your samba server +Diagnosing your Samba server -testparm +testparm In the directory in which you store your &smb.conf; file, run the command -testparm smb.conf. If it reports any errors then your &smb.conf; +testparm smb.conf. If it reports any errors, then your &smb.conf; configuration file is faulty. Your &smb.conf; file may be located in: /etc/samba -Or in: /usr/local/samba/lib +or in /usr/local/samba/lib. -Run the command ping BIGSERVER from the PC and -ping ACLIENT from -the unix box. If you don't get a valid response then your TCP/IP -software is not correctly installed. +Run the command ping BIGSERVER from the PC and +ping ACLIENT from the UNIX box. If you do not get a valid response, +then your TCP/IP software is not correctly installed. -Note that you will need to start a "dos prompt" window on the PC to -run ping. +You will need to start a dos prompt window on the PC to run ping. -If you get a message saying host not found or similar then your DNS +If you get a message saying host not found or similar, then your DNS software or /etc/hosts file is not correctly setup. -It is possible to -run samba without DNS entries for the server and client, but I assume +It is possible to run Samba without DNS entries for the server and client, but it is assumed you do have correct entries for the remainder of these tests. @@ -143,7 +141,8 @@ you do have correct entries for the remainder of these tests. Another reason why ping might fail is if your host is running firewall software. You will need to relax the rules to let in the workstation in question, perhaps by allowing access from another subnet (on Linux -this is done via the ipfwadm program.) +this is done via the appropriate firewall maintenance commands ipchains +or iptables). @@ -152,96 +151,136 @@ Modern Linux distributions install ipchains/iptables by default. This is a common problem that is often overlooked. + + +If you wish to check what firewall rules may be present in a system under test, simply run +iptables -L -v or if ipchains-based firewall rules are in use, +ipchains -L -v. + + + +Here is a sample listing from a system that has an external ethernet interface (eth1) on which Samba +is not active, and an internal (private network) interface (eth0) on which Samba is active: + +frodo:~ # iptables -L -v +Chain INPUT (policy DROP 98496 packets, 12M bytes) + pkts bytes target prot opt in out source destination + 187K 109M ACCEPT all -- lo any anywhere anywhere + 892K 125M ACCEPT all -- eth0 any anywhere anywhere +1399K 1380M ACCEPT all -- eth1 any anywhere anywhere \ + state RELATED,ESTABLISHED + +Chain FORWARD (policy DROP 0 packets, 0 bytes) + pkts bytes target prot opt in out source destination + 978K 1177M ACCEPT all -- eth1 eth0 anywhere anywhere \ + state RELATED,ESTABLISHED + 658K 40M ACCEPT all -- eth0 eth1 anywhere anywhere + 0 0 LOG all -- any any anywhere anywhere \ + LOG level warning + +Chain OUTPUT (policy ACCEPT 2875K packets, 1508M bytes) + pkts bytes target prot opt in out source destination + +Chain reject_func (0 references) + pkts bytes target prot opt in out source destinat + + + -Run the command smbclient -L BIGSERVER on the unix box. You -should get a list of available shares back. +Run the command: smbclient -L BIGSERVER +on the UNIX box. You should get back a list of available shares. -If you get a error message containing the string "Bad password" then -you probably have either an incorrect hosts allow, -hosts deny or valid users line in your -&smb.conf;, or your guest account is not -valid. Check what your guest account is using &testparm; and -temporarily remove any hosts allow, hosts deny, valid users or invalid users lines. +If you get an error message containing the string Bad password, then +you probably have either an incorrect hosts allow, +hosts deny or valid users line in your +&smb.conf;, or your guest account is not valid. Check what your guest account is using &testparm; and +temporarily remove any hosts allow, hosts deny, +valid users or invalid users lines. -If you get a connection refused response then the smbd server may -not be running. If you installed it in inetd.conf then you probably edited -that file incorrectly. If you installed it as a daemon then check that +If you get a message connection refused response, then the smbd server may +not be running. If you installed it in inetd.conf, then you probably edited +that file incorrectly. If you installed it as a daemon, then check that it is running, and check that the netbios-ssn port is in a LISTEN -state using netstat -a. +state using netstat -a. inetd xinetdinetd -Some Unix / Linux systems use xinetd in place of +Some UNIX/Linux systems use xinetd in place of inetd. Check your system documentation for the location -of the control file/s for your particular system implementation of -this network super daemon. +of the control files for your particular system implementation of +the network super daemon. -If you get a session request failed then the server refused the -connection. If it says "Your server software is being unfriendly" then -its probably because you have invalid command line parameters to &smbd;, +If you get a message saying session request failed, the server refused the +connection. If it says Your server software is being unfriendly, then +it's probably because you have invalid command line parameters to &smbd;, or a similar fatal problem with the initial startup of &smbd;. Also check your config file (&smb.conf;) for syntax errors with &testparm; -and that the various directories where samba keeps its log and lock +and that the various directories where Samba keeps its log and lock files exist. There are a number of reasons for which smbd may refuse or decline a session request. The most common of these involve one or more of -the following &smb.conf; file entries: +the &smb.conf; file entries as shown in . - + + + + Configuration for only allowing connections from a certain subnet +[globals] +... hosts denyALL hosts allowxxx.xxx.xxx.xxx/yy +interfaceseth0 bind interfaces onlyYes - +... + + In the above, no allowance has been made for any session requests that will automatically translate to the loopback adapter address 127.0.0.1. -To solve this problem change these lines to: +To solve this problem, change these lines as shown in . - + + + Configuration for allowing connections from a certain subnet and localhost +[globals] +... hosts denyALL hosts allowxxx.xxx.xxx.xxx/yy 127. - - - -Do not use the bind interfaces only parameter where you -may wish to -use the samba password change facility, or where &smbclient; may need to -access a local service for name resolution or for local resource -connections. (Note: the bind interfaces only parameter deficiency -where it will not allow connections to the loopback address will be -fixed soon). +interfaceseth0 lo +... + inetd Another common cause of these two errors is having something already running -on port 139, such as Samba -(ie: &smbd; is running from inetd already) or +smbclient +on port 139, such as Samba (&smbd; is running from inetd already) or something like Digital's Pathworks. Check your inetd.conf file before trying -to start &smbd; as a daemon, it can avoid a lot of frustration! +to start &smbd; as a daemon &smbmdash; it can avoid a lot of frustration! And yet another possible cause for failure of this test is when the subnet mask -and / or broadcast address settings are incorrect. Please check that the -network interface IP Address / Broadcast Address / Subnet Mask settings are +and/or broadcast address settings are incorrect. Please check that the +network interface IP Address/Broadcast Address/Subnet Mask settings are correct and that Samba has correctly noted these in the log.nmbd file. @@ -250,19 +289,18 @@ correct and that Samba has correctly noted these in the log.nmbd     -Run the command nmblookup -B BIGSERVER __SAMBA__. You should get the -IP address of your Samba server back. +Run the command: nmblookup -B BIGSERVER __SAMBA__. +You should get back the IP address of your Samba server. -If you don't then nmbd is incorrectly installed. Check your inetd.conf -if you run it from there, or that the daemon is running and listening -to udp port 137. +If you do not, then nmbd is incorrectly installed. Check your inetd.conf +if you run it from there, or that the daemon is running and listening to udp port 137. One common problem is that many inetd implementations can't take many -parameters on the command line. If this is the case then create a +parameters on the command line. If this is the case, then create a one-line script that contains the right parameters and run that from inetd. @@ -271,16 +309,18 @@ inetd. -run the command nmblookup -B ACLIENT '*' + +Run the command: nmblookup -B ACLIENT `*' + -You should get the PCs IP address back. If you don't then the client +You should get the PC's IP address back. If you do not then the client software on the PC isn't installed correctly, or isn't started, or you got the name of the PC wrong. -If ACLIENT doesn't resolve via DNS then use the IP address of the +If ACLIENT does not resolve via DNS then use the IP address of the client in the above test. @@ -289,20 +329,20 @@ client in the above test. -Run the command nmblookup -d 2 '*' +Run the command: nmblookup -d 2 '*' This time we are trying the same as the previous test but are trying it via a broadcast to the default broadcast address. A number of -NetBIOS / TCP/IP hosts on the network should respond, although Samba may +NetBIOS/TCP/IP hosts on the network should respond, although Samba may not catch all of the responses in the short time it listens. You -should see got a positive name query response +should see the got a positive name query response messages from several hosts. -If this doesn't give a similar result to the previous test then +If this does not give a similar result to the previous test, then nmblookup isn't correctly getting your broadcast address through its automatic mechanism. In this case you should experiment with the interfaces option in &smb.conf; to manually configure your IP @@ -310,9 +350,8 @@ address, broadcast and netmask. -If your PC and server aren't on the same subnet then you will need to -use the option to set the broadcast address to that of the PCs -subnet. +If your PC and server aren't on the same subnet, then you will need to use the + option to set the broadcast address to that of the PCs subnet. @@ -324,72 +363,69 @@ not correct. (Refer to TEST 3 notes above). -smbclient -Run the command smbclient //BIGSERVER/TMP. You should +smbclient +Run the command: smbclient //BIGSERVER/TMP. You should then be prompted for a password. You should use the password of the account -you are logged into the unix box with. If you want to test with -another account then add the option to the end of -the command line. eg: -smbclient //bigserver/tmp -Ujohndoe +with which you are logged into the UNIX box. If you want to test with +another account, then add the option to the end of +the command line. For example, smbclient //bigserver/tmp -Ujohndoe. -It is possible to specify the password along with the username -as follows: -smbclient //bigserver/tmp -Ujohndoe%secret +It is possible to specify the password along with the username as follows: +smbclient //bigserver/tmp -Ujohndoe%secret. -Once you enter the password you should get the smb> prompt. If you -don't then look at the error message. If it says invalid network -name then the service "tmp" is not correctly setup in your &smb.conf;. +Once you enter the password, you should get the smb> prompt. If you +do not, then look at the error message. If it says invalid network +name, then the service tmp is not correctly setup in your &smb.conf;. -If it says bad password then the likely causes are: +If it says bad password, then the likely causes are: - you have shadow passwords (or some other password system) but didn't - compile in support for them in &smbd; + You have shadow passwords (or some other password system) but didn't + compile in support for them in &smbd;. - your valid users configuration is incorrect + Your valid users configuration is incorrect. - you have a mixed case password and you haven't enabled the password level option at a high enough level + You have a mixed case password and you haven't enabled the password level option at a high enough level. - the path line in &smb.conf; is incorrect. Check it with &testparm; + The path line in &smb.conf; is incorrect. Check it with &testparm;. - you enabled password encryption but didn't map unix to samba users. Run smbpasswd -a username. + You enabled password encryption but didn't map UNIX to Samba users. Run: + smbpasswd -a username -Once connected you should be able to use the commands -dir get put etc. -Type help command for instructions. You should -especially check that the amount of free disk space shown is correct -when you type dir. +Once connected, you should be able to use the commands dir, get, +put and so on. Type help command for instructions. You should +especially check that the amount of free disk space shown is correct when you type dir. @@ -397,58 +433,56 @@ when you type dir. -On the PC, type the command net view \\BIGSERVER. You will -need to do this from within a "dos prompt" window. You should get back a -list of available shares on the server. +On the PC, type the command net view \\BIGSERVER. You will +need to do this from within a dos prompt window. You should get back a +list of shares available on the server. -If you get a network name not found or similar error then netbios -name resolution is not working. This is usually caused by a problem in -nmbd. To overcome it you could do one of the following (you only need -to choose one of them): +If you get a message network name not found or similar error, then netbios +name resolution is not working. This is usually caused by a problem in nmbd. +To overcome it, you could do one of the following (you only need to choose one of them): - fixup the &nmbd; installation + Fixup the &nmbd; installation. - add the IP address of BIGSERVER to the wins server box in the + Add the IP address of BIGSERVER to the wins server box in the advanced TCP/IP setup on the PC. - enable windows name resolution via DNS in the advanced section of - the TCP/IP setup + Enable Windows name resolution via DNS in the advanced section of the TCP/IP setup. - add BIGSERVER to your lmhosts file on the PC. + Add BIGSERVER to your lmhosts file on the PC. -If you get a invalid network name or bad password error then the -same fixes apply as they did for the smbclient -L test above. In -particular, make sure your hosts allow line is correct (see the man -pages) +If you get a message invalid network name or +bad password error, then apply the +same fixes as for the smbclient -L test above. In +particular, make sure your hosts allow line is correct (see the man pages). Also, do not overlook that fact that when the workstation requests the -connection to the samba server it will attempt to connect using the +connection to the Samba server, it will attempt to connect using the name with which you logged onto your Windows machine. You need to make sure that an account exists on your Samba server with that exact same name and password. -If you get specified computer is not receiving requests or similar -it probably means that the host is not contactable via tcp services. -Check to see if the host is running tcp wrappers, and if so add an entry in -the hosts.allow file for your client (or subnet, etc.) +If you get a message specified computer is not receiving requests or similar, +it probably means that the host is not contactable via TCP services. +Check to see if the host is running TCP wrappers, and if so add an entry in +the hosts.allow file for your client (or subnet, and so on.) @@ -456,25 +490,27 @@ the hosts.allow file for your client (or subnet, etc.) -Run the command net use x: \\BIGSERVER\TMP. You should -be prompted for a password then you should get a command completed -successfully message. If not then your PC software is incorrectly -installed or your smb.conf is incorrect. make sure your hosts allow +Run the command net use x: \\BIGSERVER\TMP. You should +be prompted for a password, then you should get a command completed +successfully message. If not, then your PC software is incorrectly +installed or your &smb.conf; is incorrect. Make sure your hosts allow and other config lines in &smb.conf; are correct. -It's also possible that the server can't work out what user name to -connect you as. To see if this is the problem add the line userusername to the [tmp] section of -&smb.conf; where username is the +It's also possible that the server can't work out what user name to connect you as. +To see if this is the problem, add the line +userusername to the +[tmp] section of +&smb.conf; where username is the username corresponding to the password you typed. If you find this -fixes things you may need the username mapping option. +fixes things, you may need the username mapping option. It might also be the case that your client only sends encrypted passwords -and you have encrypt passwordsno in &smb.conf; -Turn it back on to fix. +and you have encrypt passwordsno in &smb.conf;. +Change this to "yes" to fix this. @@ -482,16 +518,16 @@ Turn it back on to fix. -Run the command nmblookup -M testgroup where -testgroup is the name of the workgroup that your Samba server and +Run the command nmblookup -M testgroup where +testgroup is the name of the workgroup that your Samba server and Windows PCs belong to. You should get back the IP address of the master browser for that workgroup. -If you don't then the election process has failed. Wait a minute to -see if it is just being slow then try again. If it still fails after -that then look at the browsing options you have set in &smb.conf;. Make +If you do not, then the election process has failed. Wait a minute to +see if it is just being slow, then try again. If it still fails after +that, then look at the browsing options you have set in &smb.conf;. Make sure you have preferred masteryes to ensure that an election is held at startup. @@ -501,17 +537,17 @@ an election is held at startup. -From file manager try to browse the server. Your samba server should +>From file manager, try to browse the server. Your Samba server should appear in the browse list of your local workgroup (or the one you specified in &smb.conf;). You should be able to double click on the name -of the server and get a list of shares. If you get a "invalid -password" error when you do then you are probably running WinNT and it +of the server and get a list of shares. If you get the error message invalid password, + you are probably running Windows NT and it is refusing to browse a server that has no encrypted password -capability and is in user level security mode. In this case either set -securityserver AND +capability and is in User Level Security mode. In this case, either set +securityserver and password serverWindows_NT_Machine in your &smb.conf; file, or make sure encrypt passwords is -set to "yes". +set to yes. diff --git a/docs/docbook/projdoc/Further-Resources.xml b/docs/docbook/projdoc/Further-Resources.xml index d8905cc659..8d73028e16 100644 --- a/docs/docbook/projdoc/Further-Resources.xml +++ b/docs/docbook/projdoc/Further-Resources.xml @@ -13,7 +13,7 @@ - CIFS: Common Insecurities Fail Scrutiny by "Hobbit" + CIFS: Common Insecurities Fail Scrutiny by Hobbit @@ -48,7 +48,7 @@ - SMB/CIFS by The Root by "ledin" + SMB/CIFS by The Root by ledin @@ -91,7 +91,7 @@ - Introduction to Samba 3.0 by Motonobu Takahashi + Introduction to Samba-3.0 by Motonobu Takahashi (written in Japanese). @@ -140,13 +140,6 @@ - - - W2K Samba deploy HOWTO - by Arnaud Loonstra - - - diff --git a/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml b/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml index 076b870609..3e7dca6358 100644 --- a/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml +++ b/docs/docbook/projdoc/GROUP-MAPPING-HOWTO.xml @@ -1,29 +1,35 @@ + &author.jht; Jean FrançoisMicouleau &author.jerry; - &author.jht; -Mapping MS Windows and UNIX Groups +Group Mapping &smbmdash; MS Windows and UNIX -groupsmapping +groupsmapping Starting with Samba-3, new group mapping functionality is available to create associations between Windows group SIDs and UNIX groups. The groupmap subcommand included with the &net; tool can be used to manage these associations. + + The new facility for mapping NT Groups to UNIX system groups allows the administrator to decide + which NT Domain Groups are to be exposed to MS Windows clients. Only those NT Groups that map + to a UNIX group that has a value other than the default (-1) will be exposed + in group selection lists in tools that access domain users and groups. + + - The first immediate reason to use the group mapping on a Samba PDC, is that domain admin group - the domain admin group has been removed and should no longer - be specified in &smb.conf;. This parameter was used to give the listed users membership - in the Domain Admins Windows group which gave local admin rights on their workstations + The domain admin group parameter has been removed in Samba-3 and should no longer + be specified in &smb.conf;. This parameter was used to give the listed users membership in the + Domain Admins Windows group which gave local admin rights on their workstations (in default configurations). @@ -32,56 +38,76 @@ Features and Benefits - Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to + Samba allows the administrator to create MS Windows NT4/200x group accounts and to arbitrarily associate them with UNIX/Linux group accounts. + UID GID - - Group accounts can be managed using the MS Windows NT4 or MS Windows 200x / XP Professional MMC tools. - Appropriate interface scripts should be provided in &smb.conf; if it is desired that UNIX / Linux system + Group accounts can be managed using the MS Windows NT4 or MS Windows 200x/XP Professional MMC tools. + Appropriate interface scripts should be provided in &smb.conf; if it is desired that UNIX/Linux system accounts should be automatically created when these tools are used. In the absence of these scripts, and - so long as winbind is running, Samba accounts group accounts that are created using these tools will be - allocated UNIX UIDs/GIDs from the parameters set by the idmap uid/idmap gid settings - in the &smb.conf; file. + so long as winbindd is running, Samba group accounts that are created using these + tools will be allocated UNIX UIDs/GIDs from the ID range specified by the + idmap uid/idmap gid + parameters in the &smb.conf; file. +
    IDMAP: group SID to GID resolution. + + + + +
    -
    IDMAP groups +
    IDMAP: GID resolution to matching SID. - - + + + +
    + + + In both cases, when winbindd is not running, only locally resolvable groups can be recognized. Please refer to + and . The net groupmap is + used to establish UNIX group to NT SID mappings as shown in . + + +
    IDMAP storing group mappings. + + +
    - groupadd - groupdel + groupadd + groupdel Administrators should be aware that where &smb.conf; group interface scripts make - direct calls to the UNIX/Linux system tools (eg: the shadow utilities, groupadd, - groupdel, groupmod) then the resulting UNIX/Linux group names will be subject - to any limits imposed by these tools. If the tool does NOT allow upper case characters - or space characters, then the creation of an MS Windows NT4 / 200x style group of + direct calls to the UNIX/Linux system tools (the shadow utilities, groupadd, + groupdel, and groupmod), the resulting UNIX/Linux group names will be subject + to any limits imposed by these tools. If the tool does not allow upper case characters + or space characters, then the creation of an MS Windows NT4/200x style group of Engineering Managers will attempt to create an identically named - UNIX/Linux group, an attempt that will of course fail! + UNIX/Linux group, an attempt that will of course fail. - GID - SID + GID + SID There are several possible work-arounds for the operating system tools limitation. One method is to use a script that generates a name for the UNIX/Linux system group that - fits the operating system limits, and that then just passes the UNIX/Linux group id (GID) + fits the operating system limits, and that then just passes the UNIX/Linux group ID (GID) back to the calling Samba interface. This will provide a dynamic work-around solution. Another work-around is to manually create a UNIX/Linux group, then manually create the - MS Windows NT4 / 200x group on the Samba server and then use the net groupmap + MS Windows NT4/200x group on the Samba server and then use the net groupmap tool to connect the two to each other. @@ -91,39 +117,41 @@ Discussion - When installing MS Windows NT4 / 200x on a computer, the installation + When installing MS Windows NT4/200x on a computer, the installation program creates default users and groups, notably the Administrators group, - and gives that group privileges necessary privileges to perform essential system tasks. - eg: Ability to change the date and time or to kill (or close) any process running on the + and gives that group privileges necessary privileges to perform essential system tasks, + such as the ability to change the date and time or to kill (or close) any process running on the local machine. - Administrator - The 'Administrator' user is a member of the 'Administrators' group, and thus inherits - 'Administrators' group privileges. If a 'joe' user is created to be a member of the - 'Administrator' group, 'joe' has exactly the same rights as 'Administrator'. + Administrator + The Administrator user is a member of the Administrators group, and thus inherits + Administrators group privileges. If a joe user is created to be a member of the + Administrators group, joe has exactly the same rights as the user, + Administrator. - When an MS Windows NT4 / W200x is made a domain member, the "Domain Admins" group of the - PDC is added to the local 'Administrators' group of the workstation. Every member of the - 'Domain Administrators' group inherits the rights of the local 'Administrators' group when + When an MS Windows NT4/200x/XP machine is made a Domain Member, the Domain Admins group of the + PDC is added to the local Administrators group of the workstation. Every member of the + Domain Administrators group inherits the rights of the local Administrators group when logging on the workstation. - The following steps describe how to make Samba PDC users members of the 'Domain Admins' group? + The following steps describe how to make Samba PDC users members of the Domain Admins group? - create a unix group (usually in /etc/group), let's call it domadm + Create a UNIX group (usually in /etc/group), let's call it domadm. - add to this group the users that must be Administrators. For example - if you want joe, john and mary, your entry in /etc/group will - look like: + + Add to this group the users that must be Administrators. For example, + if you want joe, john and mary to be administrators, + your entry in /etc/group will look like this: @@ -132,60 +160,252 @@ - Map this domadm group to the "Domain Admins" group by running the command: + Map this domadm group to the Domain Admins group by running the command: - -&rootprompt;net groupmap add ntgroup="Domain Admins" unixgroup=domadm - - + + &rootprompt;net groupmap add ntgroup=Domain Admins UNIXgroup=domadm + + - "Domain Admins" group - The quotes around "Domain Admins" are necessary due to the space in the group name. - Also make sure to leave no whitespace surrounding the equal character (=). + Domain Admins group + The quotes around Domain Admins are necessary due to the space in the group name. + Also make sure to leave no white-space surrounding the equal character (=). - Now joe, john and mary are domain administrators! + Now joe, john and mary are domain administrators. - groupsdomain - It is possible to map any arbitrary UNIX group to any Windows NT4 / 200x group as well as - making any UNIX group a Windows domain group. For example, if you wanted to include a - UNIX group (e.g. acct) in a ACL on a local file or printer on a domain member machine, + groupsdomain + It is possible to map any arbitrary UNIX group to any Windows NT4/200x group as well as + making any UNIX group a Windows domain group. For example, if you wanted to include a + UNIX group (e.g., acct) in an ACL on a local file or printer on a Domain Member machine, you would flag that group as a domain group by running the following on the Samba PDC: -&rootprompt;net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct +&rootprompt;net groupmap add rid=1000 ntgroup="Accounting" UNIXgroup=acct - Be aware that the RID parameter is a unsigned 32 bit integer that should - normally start at 1000. However, this rid must not overlap with any RID assigned - to a user. Verifying this is done differently depending on the passdb backend - you are using. Future versions of the tools may perform the verification automatically, + Be aware that the RID parameter is a unsigned 32-bit integer that should + normally start at 1000. However, this RID must not overlap with any RID assigned + to a user. Verification for this is done differently depending on the passdb backend + you are using. Future versions of the tools may perform the verification automatically, but for now the burden is on you. + + Default Users, Groups and Relative Identifiers + + +Relative IdentifierRID +RID + When first installed, Microsoft Windows NT4/200x/XP are preconfigured with certain User, Group, and + Alias entities. Each has a well-known Relative Identifier (RID). These must be preserved for continued + integrity of operation. Samba must be provisioned with certain essential Domain Groups that require + the appropriate RID value. When Samba-3 is configured to use tdbsam the essential + Domain Groups are automatically created. It is the LDAP administrators' responsibility to create + (provision) the default NT Groups. + + + + Each essential Domain Group must be assigned its respective well-kown RID. The default Users, Groups, + Aliases, and RIDs are shown in . + + + + When the passdb backend uses LDAP (ldapsam) it is the + admininstrators' responsibility to create the essential Domain Groups, and to assign each its default RID. + + + + It is permissible to create any Domain Group that may be necessary, just make certain that the essential + Domain Groups (well known) have been created and assigned its default RID. Other groups you create may + be assigned any arbitrary RID you care to use. + + + + Be sure to map each Domain Group to a UNIX system group. That is the only way to ensure that the group + will be available for use as an NT Domain Group. + + + + + Well-Known User Default RIDs + + + + + + + + Well-Known Entity + RID + Type + Essential + + + + + Domain Administrator + 500 + User + No + + + Domain Guest + 501 + User + No + + + Domain KRBTGT + 502 + User + No + + + Domain Admins + 512 + Group + Yes + + + Domain Users + 513 + Group + Yes + + + Domain Guests + 514 + Group + Yes + + + Domain Computers + 515 + Group + No + + + Domain Controllers + 516 + Group + No + + + Domain Certificate Admins + 517 + Group + No + + + Domain Schema Admins + 518 + Group + No + + + Domain Enterprise Admins + 519 + Group + No + + + Domain Policy Admins + 520 + Group + No + + + Builtin Admins + 544 + Alias + No + + + Builtin users + 545 + Alias + No + + + Builtin Guests + 546 + Alias + No + + + Builtin Power Users + 547 + Alias + No + + + Builtin Account Operators + 548 + Alias + No + + + Builtin System Operators + 549 + Alias + No + + + Builtin Print Operators + 550 + Alias + No + + + Builtin Backup Operators + 551 + Alias + No + + + Builtin Replicator + 552 + Alias + No + + + Builtin RAS Servers + 553 + Alias + No + + + +
    +     + +     + Example Configuration - You can list the various groups in the mapping database by executing - net groupmap list. Here is an example: + You can list the various groups in the mapping database by executing + net groupmap list. Here is an example: +netgroupmap + &rootprompt; net groupmap list -System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest @@ -205,18 +425,20 @@ Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest Everyone needs tools. Some of us like to create our own, others prefer to use canned tools - (ie: prepared by someone else for general use). + (i.e., prepared by someone else for general use). - Sample &smb.conf; add group script + Sample &smb.conf; Add Group Script - A script to create complying group names for use by the Samba group interfaces: + A script to create complying group names for use by the Samba group interfaces + is provided in . +smbgrpadd.sh - + smbgrpadd.sh @@ -239,47 +461,49 @@ exit 0 - The &smb.conf; entry for the above script would look like: - + The &smb.conf; entry for the above script would be something like that in . + +Configuration of &smb.conf; for the add group script. +[global] +... add group script/path_to_tool/smbgrpadd.sh %g - +... + - Script to configure Group Mapping + Script to Configure Group Mapping In our example we have created a UNIX/Linux group called ntadmin. - Our script will create the additional groups Orks, Elves, Gnomes: + Our script will create the additional groups Orks, Elves, and Gnomes. + It is a good idea to save this shell script for later re-use just in case you ever need to rebuild your mapping database. + For the sake of concenience we elect to save this script as a file called initGroups.sh. + This script is given in . +initGroups.sh + + Script to Set Group Mapping #!/bin/bash net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin net groupmap modify ntgroup="Domain Users" unixgroup=users net groupmap modify ntgroup="Domain Guests" unixgroup=nobody -net groupmap modify ntgroup="Administrators" unixgroup=root -net groupmap modify ntgroup="Users" unixgroup=users -net groupmap modify ntgroup="Guests" unixgroup=nobody -net groupmap modify ntgroup="System Operators" unixgroup=sys -net groupmap modify ntgroup="Account Operators" unixgroup=root -net groupmap modify ntgroup="Backup Operators" unixgroup=bin -net groupmap modify ntgroup="Print Operators" unixgroup=lp -net groupmap modify ntgroup="Replicators" unixgroup=daemon -net groupmap modify ntgroup="Power Users" unixgroup=sys groupadd Orks groupadd Elves groupadd Gnomes -net groupmap add ntgroup="Orks" unixgroup=Orks type=d -net groupmap add ntgroup="Elves" unixgroup=Elves type=d -net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d +net groupmap add ntgroup="Orks" unixgroup=Orks type=d +net groupmap add ntgroup="Elves" unixgroup=Elves type=d +net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d + @@ -316,10 +540,10 @@ manually before putting them into active service. - There are three possible work-arounds. Firstly, use only group names that comply + There are three possible work-arounds. First, use only group names that comply with the limitations of the UNIX/Linux groupadd system tool. - The second involves use of the script mentioned earlier in this chapter, and the - third option is to manually create a UNIX/Linux group account that can substitute + Second, it involves the use of the script mentioned earlier in this chapter, and + third is the option is to manually create a UNIX/Linux group account that can substitute for the MS Windows group name, then use the procedure listed above to map that group to the MS Windows group. @@ -332,35 +556,68 @@ manually before putting them into active service. groupsnested - Samba-3 does NOT support nested groups from the MS Windows control environment. + Samba-3 does not support nested groups from the MS Windows control environment. - Adding <emphasis>Domain Users</emphasis> to the <emphasis>Power Users</emphasis> group + Adding <emphasis>Domain Users</emphasis> to the <emphasis>Power Users</emphasis> Group What must I do to add Domain Users to the Power Users group? +Domain Users group + - The Power Users group is a group that is local to each Windows - 200x / XP Professional workstation. You can not add the Domain Users group to the Power Users - group automatically, this must be done on each workstation by logging in as the local workstation - administrator and then using click on Start / Control Panel / Users and Passwords - now click on the 'Advanced' tab, then on the 'Advanced' Button. + The Power Users group is a group that is local to each Windows 200x/XP Professional workstation. + You cannot add the Domain Users group to the Power Users group automatically, it must be done on + each workstation by logging in as the local workstation administrator and + then using the following procedure: -"Domain Users" group - - Now click on 'Groups', then double click on 'Power Users'. This will launch the panel to add users - or groups to the local machine 'Power Uses' group. Click on the 'Add' button, select the domain - from which the 'Domain Users' group is to be added, double click on the 'Domain Users' group, then - click on the 'Ok' button. Note: If a logon box is presented during this process please remember to - enter the connect as DOMAIN\UserName. ie: For the domain MIDEARTH and the user 'root' enter - MIDEARTH\root. - + + + Click Start -> Control Panel -> Users and Passwords. + + + + Click the Advanced tab. + + + + Click the Advanced button. + + + + Click Groups. + + + + Double click Power Users. This will launch the panel to add users or groups + to the local machine Power Uses group. + + + + Click the Add button. + + + + Select the domain from which the Domain Users group is to be added. + + + + Double click the Domain Users group. + + + + Click the Ok button. If a logon box is presented during this process + please remember to enter the connect as DOMAIN\UserName. i.e., For the + domain MIDEARTH and the user root enter + MIDEARTH\root. + + diff --git a/docs/docbook/projdoc/Integrating-with-Windows.xml b/docs/docbook/projdoc/Integrating-with-Windows.xml index 6beebfb892..ae78e20276 100644 --- a/docs/docbook/projdoc/Integrating-with-Windows.xml +++ b/docs/docbook/projdoc/Integrating-with-Windows.xml @@ -5,23 +5,24 @@ (Jan 01 2001) -Integrating MS Windows networks with Samba +Integrating MS Windows Networks with Samba -NetBIOS +NetBIOS This section deals with NetBIOS over TCP/IP name to IP address resolution. If -your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this -section does not apply to your installation. If your installation involves use of +your MS Windows clients are not configured to use NetBIOS over TCP/IP, then this +section does not apply to your installation. If your installation +involves the use of NetBIOS over TCP/IP then this section may help you to resolve networking problems. - NetBIOS over TCP/IP has nothing to do with NetBEUI. NetBEUI is NetBIOS - over Logical Link Control (LLC). On modern networks it is highly advised - to NOT run NetBEUI at all. Note also that there is NO such thing as - NetBEUI over TCP/IP - the existence of such a protocol is a complete - and utter mis-apprehension. +NetBIOS over TCP/IP has nothing to do with NetBEUI. NetBEUI is NetBIOS +over Logical Link Control (LLC). On modern networks it is highly advised +to not run NetBEUI at all. Note also there is no such thing as +NetBEUI over TCP/IP &smbmdash; the existence of such a protocol is a complete +and utter misapprehension. @@ -31,13 +32,13 @@ NetBIOS over TCP/IP then this section may help you to resolve networking problem Many MS Windows network administrators have never been exposed to basic TCP/IP networking as it is implemented in a UNIX/Linux operating system. Likewise, many UNIX and -Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP based +Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP-based networking (and may have no desire to be either). This chapter gives a short introduction to the basics of how a name can be resolved to -it's IP address for each operating system environment. +its IP address for each operating system environment. @@ -46,35 +47,35 @@ it's IP address for each operating system environment. Background Information -Since the introduction of MS Windows 2000 it is possible to run MS Windows networking +Since the introduction of MS Windows 2000, it is possible to run MS Windows networking without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over -TCP/IP is disabled on MS Windows 2000 and later clients then only TCP port 445 will be -used and UDP port 137 and TCP port 139 will not. +TCP/IP is disabled on MS Windows 2000 and later clients, then only the TCP port 445 will be +used and the UDP port 137 and TCP port 139 will not. -When using Windows 2000 or later clients, if NetBIOS over TCP/IP is NOT disabled, then +When using Windows 2000 or later clients, if NetBIOS over TCP/IP is not disabled, then the client will use UDP port 137 (NetBIOS Name Service, also known as the Windows Internet -Name Service or WINS), TCP port 139 AND TCP port 445 (for actual file and print traffic). +Name Service or WINS), TCP port 139 and TCP port 445 (for actual file and print traffic). -When NetBIOS over TCP/IP is disabled the use of DNS is essential. Most installations that +When NetBIOS over TCP/IP is disabled, the use of DNS is essential. Most installations that disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS requires DNSDynamic Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR). DHCP Use of DHCP with ADS is recommended as a further means of maintaining central control -over client workstation network configuration. +over the client workstation network configuration. -Name Resolution in a pure UNIX/Linux world +Name Resolution in a Pure UNIX/Linux World The key configuration files covered in this section are: @@ -91,64 +92,62 @@ The key configuration files covered in this section are: <filename>/etc/hosts</filename> -Contains a static list of IP addresses and names. -eg: +This file contains a static list of IP addresses and names. 127.0.0.1 localhost localhost.localdomain -192.168.1.1 bigbox.caldera.com bigbox alias4box +192.168.1.1 bigbox.quenya.org bigbox alias4box The purpose of /etc/hosts is to provide a -name resolution mechanism so that uses do not need to remember +name resolution mechanism so uses do not need to remember IP addresses. - Network packets that are sent over the physical network transport layer communicate not via IP addresses but rather using the Media Access Control address, or MAC address. IP addresses are currently 32 bits in length and are typically presented as four (4) decimal -numbers that are separated by a dot (or period). eg: 168.192.1.1. +numbers that are separated by a dot (or period). For example, 168.192.1.1. -MAC Addresses +MAC Addresses MAC Addresses use 48 bits (or 6 bytes) and are typically represented -as two digit hexadecimal numbers separated by colons. eg: -40:8e:0a:12:34:56 +as two-digit hexadecimal numbers separated by colons: 40:8e:0a:12:34:56. -Every network interface must have an MAC address. Associated with -a MAC address there may be one or more IP addresses. There is NO -relationship between an IP address and a MAC address, all such assignments -are arbitrary or discretionary in nature. At the most basic level all -network communications takes place using MAC addressing. Since MAC -addresses must be globally unique, and generally remains fixed for +Every network interface must have a MAC address. Associated with +a MAC address may be one or more IP addresses. There is no +relationship between an IP address and a MAC address; all such assignments +are arbitrary or discretionary in nature. At the most basic level, all +network communications take place using MAC addressing. Since MAC +addresses must be globally unique and generally remain fixed for any particular interface, the assignment of an IP address makes sense from a network management perspective. More than one IP address can -be assigned per MAC address. One address must be the primary IP address, +be assigned per MAC address. One address must be the primary IP +address &smbmdash; this is the address that will be returned in the ARP reply. -When a user or a process wants to communicate with another machine -the protocol implementation ensures that the "machine name" or "host -name" is resolved to an IP address in a manner that is controlled +When a user or a process wants to communicate with another machine, +the protocol implementation ensures that the machine name or host +name is resolved to an IP address in a manner that is controlled by the TCP/IP configuration control files. The file /etc/hosts is one such file. When the IP address of the destination interface has been -determined a protocol called ARP/RARP is used to identify +determined, a protocol called ARP/RARP is used to identify the MAC address of the target interface. ARP stands for Address -Resolution Protocol, and is a broadcast oriented method that -uses UDP (User Datagram Protocol) to send a request to all -interfaces on the local network segment using the all 1's MAC +Resolution Protocol and is a broadcast-oriented method that +uses User Datagram Protocol (UDP) to send a request to all +interfaces on the local network segment using the all 1s MAC address. Network interfaces are programmed to respond to two MAC addresses only; their own unique address and the address ff:ff:ff:ff:ff:ff. The reply packet from an ARP request will @@ -156,13 +155,13 @@ contain the MAC address and the primary IP address for each interface. -/etc/hosts +/etc/hosts The /etc/hosts file is foundational to all UNIX/Linux TCP/IP installations and as a minimum will contain the localhost and local network interface IP addresses and the primary names by which they are known within the local machine. -This file helps to prime the pump so that a basic level of name +This file helps to prime the pump so a basic level of name resolution can exist before any other method of name resolution becomes available. @@ -179,17 +178,17 @@ This file tells the name resolution libraries: The name of the domain to which the machine - belongs + belongs. The name(s) of any domains that should be automatically searched when trying to resolve unqualified - host names to their IP address + host names to their IP address. The name or IP address of available Domain - Name Servers that may be asked to perform name to address - translation lookups + Name Servers that may be asked to perform name-to-address + translation lookups. @@ -200,11 +199,11 @@ This file tells the name resolution libraries: <filename>/etc/host.conf</filename> -/etc/host.conf +/etc/host.conf /etc/host.conf is the primary means by -which the setting in /etc/resolv.conf may be affected. It is a -critical configuration file. This file controls the order by +which the setting in /etc/resolv.conf may be effected. It is a +critical configuration file. This file controls the order by which name resolution may proceed. The typical structure is: @@ -215,7 +214,7 @@ multi on then both addresses should be returned. Please refer to the -man page for host.conf for further details. +man page for host.conf for further details. @@ -226,9 +225,9 @@ man page for host.conf for further details. <filename>/etc/nsswitch.conf</filename> -/etc/nsswitch.conf +/etc/nsswitch.conf This file controls the actual name resolution targets. The file typically has resolver object specifications as follows: @@ -264,25 +263,25 @@ facilities and/or services are correctly configured. It should be noted that unless a network request/message must be -sent, TCP/IP networks are silent. All TCP/IP communications assumes a +sent, TCP/IP networks are silent. All TCP/IP communications assume a principal of speaking only when necessary. -libnss_wins.so -Starting with version 2.2.0 samba has Linux support for extensions to -the name service switch infrastructure so that linux clients will +libnss_wins.so +Starting with version 2.2.0, Samba has Linux support for extensions to +the name service switch infrastructure so Linux clients will be able to obtain resolution of MS Windows NetBIOS names to IP -Addresses. To gain this functionality Samba needs to be compiled -with appropriate arguments to the make command (i.e.: make +Addresses. To gain this functionality, Samba needs to be compiled +with appropriate arguments to the make command (i.e., make nsswitch/libnss_wins.so). The resulting library should then be installed in the /lib directory and -the "wins" parameter needs to be added to the "hosts:" line in -the /etc/nsswitch.conf file. At this point it +the wins parameter needs to be added to the hosts: line in +the /etc/nsswitch.conf file. At this point, it will be possible to ping any MS Windows machine by its NetBIOS -machine name, so long as that machine is within the workgroup to -which both the samba machine and the MS Windows machine belong. +machine name, as long as that machine is within the workgroup to +which both the Samba machine and the MS Windows machine belong. @@ -290,29 +289,29 @@ which both the samba machine and the MS Windows machine belong. -Name resolution as used within MS Windows networking +Name Resolution as Used within MS Windows Networking MS Windows networking is predicated about the name each machine is given. This name is known variously (and inconsistently) as -the "computer name", "machine name", "networking name", "netbios name", -or "SMB name". All terms mean the same thing with the exception of -"netbios name" which can apply also to the name of the workgroup or the -domain name. The terms "workgroup" and "domain" are really just a +the computer name, machine name, networking name, netbios name, +or SMB name. All terms mean the same thing with the exception of +netbios name that can also apply to the name of the workgroup or the +domain name. The terms workgroup and domain are really just a simple name with which the machine is associated. All NetBIOS names -are exactly 16 characters in length. The 16th character is reserved. -It is used to store a one byte value that indicates service level +are exactly 16 characters in length. The 16th character is reserved. +It is used to store a one-byte value that indicates service level information for the NetBIOS name that is registered. A NetBIOS machine -name is therefore registered for each service type that is provided by +name is, therefore, registered for each service type that is provided by the client/server. -The following are typical NetBIOS name/service type registrations: + and list typical NetBIOS name/service type registrations. - -Unique NetBIOS names +
    +Unique NetBIOS Names @@ -325,7 +324,7 @@ The following are typical NetBIOS name/service type registrations:
    - +
    Group Names @@ -344,13 +343,13 @@ The following are typical NetBIOS name/service type registrations: It should be noted that all NetBIOS machines register their own names as per the above. This is in vast contrast to TCP/IP installations where traditionally the system administrator will -determine in the /etc/hosts or in the DNS database what names +determine in the /etc/hosts or in the DNS database what names are associated with each IP address. -NetBIOS -One further point of clarification should be noted, the /etc/hosts +NetBIOS +One further point of clarification should be noted. The /etc/hosts file and the DNS records do not provide the NetBIOS name type information that MS Windows clients depend on to locate the type of service that may be needed. An example of this is what happens when an MS Windows client @@ -359,20 +358,20 @@ address of a server that provides it by performing a lookup (via a NetBIOS broadcast) for enumeration of all machines that have registered the name type *<1c>. A logon request is then sent to each IP address that is returned in the enumerated list of IP addresses. -Whichever machine first replies then ends up providing the logon services. +Whichever machine first replies, it then ends up providing the logon services. -The name "workgroup" or "domain" really can be confusing since these +The name workgroup or domain really can be confusing since these have the added significance of indicating what is the security -architecture of the MS Windows network. The term "workgroup" indicates +architecture of the MS Windows network. The term workgroup indicates that the primary nature of the network environment is that of a -peer-to-peer design. In a WORKGROUP all machines are responsible for -their own security, and generally such security is limited to use of -just a password (known as SHARE MODE security). In most situations -with peer-to-peer networking the users who control their own machines +peer-to-peer design. In a WORKGROUP, all machines are responsible for +their own security, and generally such security is limited to the use of +just a password (known as Share Level security). In most situations +with peer-to-peer networking, the users who control their own machines will simply opt to have no security at all. It is possible to have -USER MODE security in a WORKGROUP environment, thus requiring use +User Level Security in a WORKGROUP environment, thus requiring the use of a user name and a matching password. @@ -381,17 +380,17 @@ MS Windows networking is thus predetermined to use machine names for all local and remote machine message passing. The protocol used is called Server Message Block (SMB) and this is implemented using the NetBIOS protocol (Network Basic Input Output System). NetBIOS can -be encapsulated using LLC (Logical Link Control) protocol - in which case +be encapsulated using LLC (Logical Link Control) protocol &smbmdash; in which case the resulting protocol is called NetBEUI (Network Basic Extended User Interface). NetBIOS can also be run over IPX (Internetworking Packet Exchange) protocol as used by Novell NetWare, and it can be run -over TCP/IP protocols - in which case the resulting protocol is called +over TCP/IP protocols &smbmdash; in which case the resulting protocol is called NBT or NetBT, the NetBIOS over TCP/IP. MS Windows machines use a complex array of name resolution mechanisms. -Since we are primarily concerned with TCP/IP this demonstration is +Since we are primarily concerned with TCP/IP, this demonstration is limited to this area. @@ -399,9 +398,9 @@ limited to this area. The NetBIOS Name Cache -All MS Windows machines employ an in memory buffer in which is +All MS Windows machines employ an in-memory buffer in which is stored the NetBIOS names and IP addresses for all external -machines that that machine has communicated with over the +machines that machine has communicated with over the past 10-15 minutes. It is more efficient to obtain an IP address for a machine from the local cache than it is to go through all the configured name resolution mechanisms. @@ -411,35 +410,34 @@ configured name resolution mechanisms. If a machine whose name is in the local name cache has been shut down before the name had been expired and flushed from the cache, then an attempt to exchange a message with that machine will be subject -to time-out delays. i.e.: Its name is in the cache, so a name resolution -lookup will succeed, but the machine can not respond. This can be -frustrating for users - but it is a characteristic of the protocol. +to time-out delays. Its name is in the cache, so a name resolution +lookup will succeed, but the machine cannot respond. This can be +frustrating for users but is a characteristic of the protocol. + nbtstat nmblookup - The MS Windows utility that allows examination of the NetBIOS -name cache is called "nbtstat". The Samba equivalent of this +name cache is called nbtstat. The Samba equivalent of this is called nmblookup. -The LMHOSTS file +The LMHOSTS File -LMHOSTS -This file is usually located in MS Windows NT 4.0 or -2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains -the IP Address and the machine name in matched pairs. The -LMHOSTS file performs NetBIOS name -to IP address mapping. +LMHOSTS +This file is usually located in MS Windows NT 4.0 or Windows 200x/XP in the directory +C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address +and the machine name in matched pairs. The LMHOSTS file +performs NetBIOS name to IP address mapping. -It typically looks like: +It typically looks like this: @@ -449,7 +447,7 @@ It typically looks like: # over TCP/IP) stack for Windows98 # # This file contains the mappings of IP addresses to NT computernames -# (NetBIOS) names. Each entry should be kept on an individual line. +# (NetBIOS) names. Each entry should be kept on an individual line. # The IP address should be placed in the first column followed by the # corresponding computername. The address and the computername # should be separated by at least one space or tab. The "#" character @@ -471,7 +469,7 @@ It typically looks like: # not preloaded, but are parsed only after dynamic name resolution fails. # # Following an entry with the "#DOM:<domain>" tag will associate the -# entry with the domain specified by <domain>. This affects how the +# entry with the domain specified by <domain>. This effects how the # browser and logon services behave in TCP/IP environments. To preload # the host name associated with #DOM entry, it is necessary to also add a # #PRE to the line. The <domain> is always preloaded although it will not @@ -500,10 +498,10 @@ It typically looks like: # # The following example illustrates all of these extensions: # -# 102.54.94.97 rhino #PRE #DOM:networking #net group's DC -# 102.54.94.102 "appname \0x14" #special app server -# 102.54.94.123 popular #PRE #source server -# 102.54.94.117 localsrv #PRE #needed for the include +# 102.54.94.97 rhino #PRE #DOM:networking #net group's DC +# 102.54.94.102 "appname \0x14" #special app server +# 102.54.94.123 popular #PRE #source server +# 102.54.94.117 localsrv #PRE #needed for the include # # #BEGIN_ALTERNATE # #INCLUDE \\localsrv\public\lmhosts @@ -525,11 +523,11 @@ It typically looks like: -HOSTS file +HOSTS File -This file is usually located in MS Windows NT 4.0 or 2000 in -C:\WINNT\SYSTEM32\DRIVERS\ETC and contains +This file is usually located in MS Windows NT 4.0 or Windows 200x/XP in +the directory C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address and the IP hostname in matched pairs. It can be used by the name resolution infrastructure in MS Windows, depending on how the TCP/IP environment is configured. This file is in @@ -541,12 +539,12 @@ every way the equivalent of the UNIX/Linux /etc/hosts file. DNS Lookup -DNS +DNS This capability is configured in the TCP/IP setup area in the network configuration facility. If enabled, an elaborate name resolution sequence -is followed the precise nature of which is dependant on how the NetBIOS +is followed, the precise nature of which is dependant on how the NetBIOS Node Type parameter is configured. A Node Type of 0 means that NetBIOS broadcast (over UDP broadcast) is used if the name that is the subject of a name lookup is not found in the NetBIOS name @@ -561,9 +559,9 @@ lookup is used. WINS Lookup -WINS +WINS A WINS (Windows Internet Name Server) service is the equivalent of the rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores the names and IP addresses that are registered by a Windows client @@ -571,7 +569,7 @@ if the TCP/IP setup has been given at least one WINS Server IP Address. -To configure Samba to be a WINS server the following parameter needs +To configure Samba to be a WINS server, the following parameter needs to be added to the &smb.conf; file: @@ -580,7 +578,7 @@ to be added to the &smb.conf; file: -To configure Samba to use a WINS server the following parameters are +To configure Samba to use a WINS server, the following parameters are needed in the &smb.conf; file: @@ -595,7 +593,7 @@ of the WINS server. For information about setting up Samba as a WINS server, read - the chapter on network browsing. +. @@ -606,26 +604,26 @@ of the WINS server. TCP/IP network configuration problems find every network administrator sooner or later. The cause can be anything from keyboard mishaps, forgetfulness, simple mistakes, and -carelessness. Of course, no one is every deliberately careless! +carelessness. Of course, no one is ever deliberately careless! - Pinging works only in one way + Pinging Works Only in One Way - I can ping my samba server from Windows, but I can - not ping my Windows machine from the samba server. + I can ping my Samba server from Windows, but I cannot ping my Windows + machine from the Samba server. - The Windows machine was at IP Address 192.168.1.2 with netmask 255.255.255.0, the + Answer: The Windows machine was at IP Address 192.168.1.2 with netmask 255.255.255.0, the Samba server (Linux) was at IP Address 192.168.1.130 with netmask 255.255.255.128. The machines were on a local network with no external connections. Due to inconsistent netmasks, the Windows machine was on network 192.168.1.0/24, while - the Samba server was on network 192.168.1.128/25 - logically a different network. + the Samba server was on network 192.168.1.128/25 &smbmdash; logically a different network. @@ -634,41 +632,42 @@ carelessness. Of course, no one is every deliberately careless! Very Slow Network Connections - A common causes of slow network response includes: + A common cause of slow network response includes: - Client is configured to use DNS and DNS server is down - Client is configured to use remote DNS server, but remote connection is down - Client is configured to use a WINS server, but there is no WINS server - Client is NOT configured to use a WINS server, but there is a WINS server - Firewall is filtering our DNS or WINS traffic + Client is configured to use DNS and the DNS server is down. + Client is configured to use remote DNS server, but the + remote connection is down. + Client is configured to use a WINS server, but there is no WINS server. + Client is not configured to use a WINS server, but there is a WINS server. + Firewall is filtering our DNS or WINS traffic. - Samba server name change problem + Samba Server Name Change Problem - The name of the samba server was changed, samba was restarted, samba server can not be + The name of the Samba server was changed, Samba was restarted, Samba server cannot be pinged by new name from MS Windows NT4 Workstation, but it does still respond to ping using the old name. Why? - From this description three (3) things are rather obvious: + From this description, three things are obvious: - WINS is NOT in use, only broadcast based name resolution is used - The samba server was renamed and restarted within the last 10-15 minutes - The old samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation + WINS is not in use, only broadcast-based name resolution is used. + The Samba server was renamed and restarted within the last 10-15 minutes. + The old Samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation. To find what names are present in the NetBIOS name cache on the MS Windows NT4 machine, - open a cmd shell, then: + open a cmd shell and then: @@ -701,8 +700,8 @@ SARDON <00> GROUP Registered In the above example, &example.server.samba; is the Samba server and &example.workstation.windows; is the MS Windows NT4 Workstation. - The first listing shows the contents of the Local Name Table (i.e.: Identity information on - the MS Windows workstation), the second shows the NetBIOS name in the NetBIOS name cache. + The first listing shows the contents of the Local Name Table (i.e., Identity information on + the MS Windows workstation) and the second shows the NetBIOS name in the NetBIOS name cache. The name cache contains the remote machines known to this workstation. diff --git a/docs/docbook/projdoc/InterdomainTrusts.xml b/docs/docbook/projdoc/InterdomainTrusts.xml index 04efc6fda6..7cbd673643 100644 --- a/docs/docbook/projdoc/InterdomainTrusts.xml +++ b/docs/docbook/projdoc/InterdomainTrusts.xml @@ -14,14 +14,14 @@ Interdomain Trust Relationships -Interdomain Trusts -Samba-3 supports NT4 style domain trust relationships. This is feature that many sites -will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to -adopt Active Directory or an LDAP based authentication back end. This section explains +Interdomain Trusts +Samba-3 supports NT4-style domain trust relationships. This is a feature that many sites +will want to use if they migrate to Samba-3 from an NT4-style domain and do not want to +adopt Active Directory or an LDAP-based authentication backend. This section explains some background information regarding trust relationships and how to create them. It is now -possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba3-to-Samba3 +possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba-to-Samba trusts. @@ -29,14 +29,13 @@ trusts. Features and Benefits -Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4 style -trust relationships. This imparts to Samba similar scalability as is possible with -MS Windows NT4. +Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4-style +trust relationships. This imparts to Samba similar scalability as with MS Windows NT4. Given that Samba-3 has the capability to function with a scalable backend authentication -database such as LDAP, and given it's ability to run in Primary as well as Backup Domain control +database such as LDAP, and given its ability to run in Primary as well as Backup Domain Control modes, the administrator would be well advised to consider alternatives to the use of Interdomain trusts simply because by the very nature of how this works it is fragile. That was, after all, a key reason for the development and adoption of Microsoft Active Directory. @@ -48,49 +47,47 @@ That was, after all, a key reason for the development and adoption of Microsoft Trust Relationship Background -MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure. -The limitations of this architecture as it affects the scalability of MS Windows networking -in large organisations is well known. Additionally, the flat namespace that results from +MS Windows NT3/4 type security domains employ a non-hierarchical security structure. +The limitations of this architecture as it effects the scalability of MS Windows networking +in large organizations is well known. Additionally, the flat namespace that results from this design significantly impacts the delegation of administrative responsibilities in -large and diverse organisations. +large and diverse organizations. Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means -of circumventing the limitations of the older technologies. Not every organisation is ready -or willing to embrace ADS. For small companies the older NT4 style domain security paradigm -is quite adequate, there thus remains an entrenched user base for whom there is no direct +of circumventing the limitations of the older technologies. Not every organization is ready +or willing to embrace ADS. For small companies the older NT4-style domain security paradigm +is quite adequate, there remains an entrenched user base for whom there is no direct desire to go through a disruptive change to adopt ADS. -Microsoft introduced with MS Windows NT the ability to allow differing security domains -to affect a mechanism so that users from one domain may be given access rights and privileges +With MS Windows NT, Microsoft introduced the ability to allow differing security domains +to effect a mechanism so users from one domain may be given access rights and privileges in another domain. The language that describes this capability is couched in terms of Trusts. Specifically, one domain will trust the users from another domain. The domain from which users are available to another security domain is said to be a trusted domain. The domain in which those users have assigned rights and privileges is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only, thus if users in both domains are to have privileges and rights in each others' domain, then it is -necessary to establish two (2) relationships, one in each direction. +necessary to establish two relationships, one in each direction. -In an NT4 style MS security domain, all trusts are non-transitive. This means that if there -are three (3) domains (let's call them RED, WHITE, and BLUE) where RED and WHITE have a trust +In an NT4-style MS security domain, all trusts are non-transitive. This means that if there +are three domains (let's call them RED, WHITE and BLUE) where RED and WHITE have a trust relationship, and WHITE and BLUE have a trust relationship, then it holds that there is no -implied trust between the RED and BLUE domains. ie: Relationships are explicit and not +implied trust between the RED and BLUE domains. Relationships are explicit and not transitive. - New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE -domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is -an inherent feature of ADS domains. Samba-3 implements MS Windows NT4 -style Interdomain trusts and interoperates with MS Windows 200x ADS -security domains in similar manner to MS Windows NT4 style domains. +domains above, with Windows 2000 and ADS the RED and BLUE domains can trust each other. This is +an inherent feature of ADS domains. Samba-3 implements MS Windows NT4-style Interdomain trusts +and interoperates with MS Windows 200x ADS security domains in similar manner to MS Windows NT4-style domains. @@ -99,13 +96,13 @@ security domains in similar manner to MS Windows NT4 style domains. Native MS Windows NT4 Trusts Configuration -There are two steps to creating an interdomain trust relationship. To effect a two-way trust -relationship it is necessary for each domain administrator to create a trust account for the +There are two steps to creating an interdomain trust relationship. To effect a two-way trust +relationship, it is necessary for each domain administrator to create a trust account for the other domain to use in verifying security credentials. - Interdomain Trustscreating + Creating an NT4 Domain Trust @@ -113,11 +110,11 @@ other domain to use in verifying security credentials. For MS Windows NT4, all domain trust relationships are configured using the Domain User Manager. This is done from the Domain User Manager Policies entry on the menu bar. From the Policy menu, select -Trust Relationships. Next to the lower box labelled +Trust Relationships. Next to the lower box labeled Permitted to Trust this Domain are two buttons, Add and Remove. The Add button will open a panel in which to enter the name of the remote domain that will be able to assign access rights to users in -your domain. You will also need to enter a password for this trust relationship, which the +your domain. You will also need to enter a password for this trust relationship, which the trusting domain will use when authenticating users from the trusted domain. The password needs to be typed twice (for standard confirmation). @@ -129,13 +126,13 @@ The password needs to be typed twice (for standard confirmation). Completing an NT4 Domain Trust -Interdomain Trustscompleting +Interdomain TrustsCompleting A trust relationship will work only when the other (trusting) domain makes the appropriate connections -with the trusted domain. To consummate the trust relationship the administrator will launch the -Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the -Add button that is next to the box that is labelled -Trusted Domains. A panel will open in which must be entered the name of the remote -domain as well as the password assigned to that trust. +with the trusted domain. To consummate the trust relationship, the administrator will launch the +Domain User Manager from the menu select Policies, then select +Trust Relationships, click on the Add button +next to the box that is labeled Trusted Domains. A panel will open in which +must be entered the name of the remote domain as well as the password assigned to that trust. @@ -143,83 +140,83 @@ domain as well as the password assigned to that trust. Inter-Domain Trust Facilities -Interdomain TrustsFacilities +Interdomain TrustsFacilities A two-way trust relationship is created when two one-way trusts are created, one in each direction. Where a one-way trust has been established between two MS Windows NT4 domains (let's call them -DomA and DomB) the following facilities are created: +DomA and DomB), the following facilities are created: -trusts1Trusts overview +trusts1Trusts overview. - DomA (completes the trust connection) Trusts DomB + DomA (completes the trust connection) Trusts DomB. - DomA is the Trusting domain + DomA is the Trusting domain. - DomB is the Trusted domain (originates the trust account) + DomB is the Trusted domain (originates the trust account). - Users in DomB can access resources in DomA + Users in DomB can access resources in DomA. - Users in DomA can NOT access resources in DomB + Users in DomA cannot access resources in DomB. - Global groups from DomB CAN be used in DomA + Global groups from DomB can be used in DomA. - Global groups from DomA can NOT be used in DomB + Global groups from DomA cannot be used in DomB. - DomB DOES appear in the logon dialog box on client workstations in DomA + DomB does appear in the logon dialog box on client workstations in DomA. - DomA does NOT appear in the logon dialog box on client workstations in DomB + DomA does not appear in the logon dialog box on client workstations in DomB. - Users / Groups in a trusting domain can NOT be granted rights, permissions or access + Users/Groups in a trusting domain cannot be granted rights, permissions or access to a trusted domain. - The trusting domain CAN access and use accounts (Users / Global Groups) in the + The trusting domain can access and use accounts (Users/Global Groups) in the trusted domain. - Administrators of the trusted domain CAN be granted admininstrative rights in the + Administrators of the trusted domain can be granted admininstrative rights in the trusting domain. - Users in a trusted domain CAN be given rights and privileges in the trusting + Users in a trusted domain can be given rights and privileges in the trusting domain. - Trusted domain Global Groups CAN be given rights and permissions in the trusting + Trusted domain Global Groups can be given rights and permissions in the trusting domain. - Global Groups from the trusted domain CAN be made members in Local Groups on - MS Windows domain member machines. + Global Groups from the trusted domain can be made members in Local Groups on + MS Windows Domain Member machines. @@ -228,17 +225,17 @@ DomA and DomB) the following facilities are created: -Configuring Samba NT-style Domain Trusts +Configuring Samba NT-Style Domain Trusts This description is meant to be a fairly short introduction about how to set up a Samba server so -that it could participate in interdomain trust relationships. Trust relationship support in Samba -is in its early stage, so lot of things don't work yet. +that it can participate in interdomain trust relationships. Trust relationship support in Samba +is at an early stage, so do not be surprised if something does not function as it should. Each of the procedures described below assumes the peer domain in the trust relationship is -controlled by a Windows NT4 server. However, the remote end could just as well be another +controlled by a Windows NT4 server. However, the remote end could just as well be another Samba-3 domain. It can be clearly seen, after reading this document, that combining Samba-specific parts of what's written below leads to trust between domains in a purely Samba environment. @@ -248,12 +245,12 @@ environment. Samba as the Trusted Domain -In order to set the Samba PDC to be the trusted party of the relationship you first need +In order to set the Samba PDC to be the trusted party of the relationship, you first need to create a special account for the domain that will be the trusting party. To do that, -you can use the 'smbpasswd' utility. Creating the trusted domain account is very +you can use the smbpasswd utility. Creating the trusted domain account is similar to creating a trusted machine account. Suppose, your domain is called SAMBA, and the remote domain is called RUMBA. The first step -will be to issue this command from your favourite shell: +will be to issue this command from your favorite shell: @@ -265,35 +262,35 @@ Added user rumba$ where means to add a new account into the -passdb database and means: ''create this -account with the InterDomain trust flag'' +passdb database and means: create this +account with the InterDomain trust flag. -The account name will be 'rumba$' (the name of the remote domain) +The account name will be rumba$ (the name of the remote domain). -After issuing this command you'll be asked to enter the password for +After issuing this command, you will be asked to enter the password for the account. You can use any password you want, but be aware that Windows NT will -not change this password until 7 days following account creation. +not change this password until seven days following account creation. After the command returns successfully, you can look at the entry for the new account (in the standard way as appropriate for your configuration) and see that account's name is -really RUMBA$ and it has the 'I' flag set in the flags field. Now you're ready to confirm +really RUMBA$ and it has the I flag set in the flags field. Now you are ready to confirm the trust by establishing it from Windows NT Server. -User Manager +User Manager Open User Manager for Domains and from the Policies menu, select Trust Relationships.... -Right beside the Trusted domains list box press the +Beside the Trusted domains list box click the Add... button. You will be prompted for the trusted domain name and the relationship password. Type in SAMBA, as this is -the name of the remote domain, and the password used at the time of account creation. -Press OK and, if everything went without incident, you will see -Trusted domain relationship successfully +the name of the remote domain and the password used at the time of account creation. +Click on OK and, if everything went without incident, you will see +the Trusted domain relationship successfully established message. @@ -303,31 +300,31 @@ established message. This time activities are somewhat reversed. Again, we'll assume that your domain -controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA. +controlled by the Samba PDC is called SAMBA and the NT-controlled domain is called RUMBA. The very first step is to add an account for the SAMBA domain on RUMBA's PDC. -User Manager +User Manager Launch the Domain User Manager, then from the menu select Policies, Trust Relationships. Now, next to the Trusted Domains box press the Add -button, and type in the name of the trusted domain (SAMBA) and the password to use in securing +button and type in the name of the trusted domain (SAMBA) and the password to use in securing the relationship. The password can be arbitrarily chosen. It is easy to change the password from the Samba server whenever you want. After confirming the password your account is -ready for use. Now it's Samba's turn. +ready for use. Now its Samba's turn. -Using your favourite shell while being logged in as root, issue this command: +Using your favorite shell while being logged in as root, issue this command: @@ -336,17 +333,17 @@ Using your favourite shell while being logged in as root, issue this command: You will be prompted for the password you just typed on your Windows NT4 Server box. -Do not worry if you see an error message that mentions a return code of -NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the -password you gave is correct and the NT4 Server says the account is -ready for interdomain connection and not for ordinary -connection. After that, be patient; it can take a while (especially -in large networks), but eventually you should see the Success message. -Congratulations! Your trust relationship has just been established. +An error message `NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT' +that may be reported periodically is of no concern and may safely be ignored. +It means the password you gave is correct and the NT4 Server says the account is ready for +interdomain connection and not for ordinary connection. After that, be patient; +it can take a while (especially in large networks), but eventually you should see +the Success message. Congratulations! Your trust +relationship has just been established. -Note that you have to run this command as root because you must have write access to +You have to run this command as root because you must have write access to the secrets.tdb file. @@ -354,11 +351,11 @@ the secrets.tdb file. -NT4-style Domain Trusts with Windows 2000 +NT4-Style Domain Trusts with Windows 2000 Although Domain User Manager is not present in Windows 2000, it is also possible to establish an NT4-style trust relationship with a Windows 2000 domain -controller running in mixed mode as the trusting server. It should also be possible for +controller running in mixed mode as the trusting server. It should also be possible for Samba to trust a Windows 2000 server, however, more testing is still needed in this area. @@ -366,15 +363,15 @@ Samba to trust a Windows 2000 server, however, more testing is still needed in t After creating the interdomain trust account on the Samba server as described above, open Active Directory Domains and Trusts on the AD controller of the domain whose resources you wish Samba users -to have access to. Remember that since NT4-style trusts are not transitive, if you want +to have access to. Remember that since NT4-style trusts are not transitive, if you want your users to have access to multiple mixed-mode domains in your AD forest, you will need to -repeat this process for each of those domains. With Active Directory Domains +repeat this process for each of those domains. With Active Directory Domains and Trusts open, right-click on the name of the Active Directory domain that -will trust our Samba domain and choose Properties, then click on -the Trusts tab. In the upper part of the panel, you will see a list box -labelled Domains trusted by this domain:, and an -Add... button next to it. Press this button, and just as with NT4, you -will be prompted for the trusted domain name and the relationship password. Press OK, and +will trust our Samba domain and choose Properties, then click on +the Trusts tab. In the upper part of the panel, you will see a list box +labeled Domains trusted by this domain:, and an +Add... button next to it. Press this button and just as with NT4, you +will be prompted for the trusted domain name and the relationship password. Press OK and after a moment, Active Directory will respond with The trusted domain has been added and the trust has been verified. Your Samba users can now be granted acess to resources in the AD domain. @@ -385,7 +382,7 @@ granted acess to resources in the AD domain. Common Errors -Interdomain trust relationships should NOT be attempted on networks that are unstable +Interdomain trust relationships should not be attempted on networks that are unstable or that suffer regular outages. Network stability and integrity are key concerns with distributed trusted domains. diff --git a/docs/docbook/projdoc/NT4Migration.xml b/docs/docbook/projdoc/NT4Migration.xml index 36bafee2af..b5ba7c1ced 100644 --- a/docs/docbook/projdoc/NT4Migration.xml +++ b/docs/docbook/projdoc/NT4Migration.xml @@ -7,8 +7,8 @@ Migration from NT4 PDC to Samba-3 PDC -This is a rough guide to assist those wishing to migrate from NT4 domain control to -Samba-3 based domain control. +This is a rough guide to assist those wishing to migrate from NT4 Domain Control to +Samba-3-based Domain Control. @@ -17,11 +17,11 @@ Samba-3 based domain control. In the IT world there is often a saying that all problems are encountered because of poor planning. The corollary to this saying is that not all problems can be anticipated -and planned for. Then again, good planning will anticipate most show stopper type situations. +and planned for. Then again, good planning will anticipate most show-stopper-type situations. -Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control +Those wishing to migrate from MS Windows NT4 Domain Control to a Samba-3 Domain Control environment would do well to develop a detailed migration plan. So here are a few pointers to help migration get under way. @@ -30,69 +30,69 @@ help migration get under way. Objectives -The key objective for most organisations will be to make the migration from MS Windows NT4 -to Samba-3 domain control as painless as possible. One of the challenges you may experience +The key objective for most organizations will be to make the migration from MS Windows NT4 +to Samba-3 Domain Control as painless as possible. One of the challenges you may experience in your migration process may well be one of convincing management that the new environment should remain in place. Many who have introduced open source technologies have experienced -pressure to return to a Microsoft based platform solution at the first sign of trouble. +pressure to return to a Microsoft-based platform solution at the first sign of trouble. -Before attempting a migration to a Samba-3 controlled network make every possible effort to -gain all-round commitment to the change. Know precisely why the change -is important for the organisation. Possible motivations to make a change include: +Before attempting a migration to a Samba-3 controlled network, make every possible effort to +gain all-round commitment to the change. Know precisely why the change +is important for the organization. Possible motivations to make a change include: - Improve network manageability - Obtain better user level functionality - Reduce network operating costs - Reduce exposure caused by Microsoft withdrawal of NT4 support - Avoid MS License 6 implications - Reduce organisation's dependency on Microsoft + Improve network manageability. + Obtain better user level functionality. + Reduce network operating costs. + Reduce exposure caused by Microsoft withdrawal of NT4 support. + Avoid MS License 6 implications. + Reduce organization's dependency on Microsoft. -Make sure that everyone knows that Samba-3 is NOT MS Windows NT4. Samba-3 offers -an alternative solution that is both different from MS Windows NT4 and that offers +Make sure everyone knows that Samba-3 is not MS Windows NT4. Samba-3 offers +an alternative solution that is both different from MS Windows NT4 and offers advantages compared with it. Gain recognition that Samba-3 lacks many of the features that Microsoft has promoted as core values in migration from MS Windows NT4 to MS Windows 2000 and beyond (with or without Active Directory services). -What are the features that Samba-3 can NOT provide? +What are the features that Samba-3 cannot provide? - Active Directory Server - Group Policy Objects (in Active Directory) - Machine Policy objects - Logon Scripts in Active Directory - Software Application and Access Controls in Active Directory + Active Directory Server. + Group Policy Objects (in Active Directory). + Machine Policy Objects. + Logon Scripts in Active Directory. + Software Application and Access Controls in Active Directory. -The features that Samba-3 DOES provide and that may be of compelling interest to your site -includes: +The features that Samba-3 does provide and that may be of compelling interest to your site +include: - Lower Cost of Ownership - Global availability of support with no strings attached - Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system) - Creation of on-the-fly logon scripts - Creation of on-the-fly Policy Files - Greater Stability, Reliability, Performance and Availability - Manageability via an ssh connection - Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam) - Ability to implement a full single-sign-on architecture - Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand + Lower cost of ownership. + Global availability of support with no strings attached. + Dynamic SMB Servers (can run more than one SMB/CIFS server per UNIX/Linux system). + Creation of on-the-fly logon scripts. + Creation of on-the-fly Policy Files. + Greater stability, reliability, performance and availability. + Manageability via an ssh connection. + Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam). + Ability to implement a full single-sign-on architecture. + Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand. -Before migrating a network from MS Windows NT4 to Samba-3 consider all necessary factors. Users -should be educated about changes they may experience so that the change will be a welcome one +Before migrating a network from MS Windows NT4 to Samba-3, consider all necessary factors. Users +should be educated about changes they may experience so the change will be a welcome one and not become an obstacle to the work they need to do. The following are factors that will help ensure a successful migration: @@ -101,28 +101,29 @@ help ensure a successful migration: Domain Layout -Samba-3 can be configured as a domain controller, a back-up domain controller (probably best called -a secondary controller), a domain member, or as a stand-alone server. The Windows network security +Samba-3 can be configured as a Domain Controller, a back-up Domain Controller (probably best called +a secondary controller), a Domain Member, or as a stand-alone Server. The Windows network security domain context should be sized and scoped before implementation. Particular attention needs to be -paid to the location of the primary domain controller (PDC) as well as backup controllers (BDCs). +paid to the location of the primary Domain Controller (PDC) as well as backup controllers (BDCs). One way in which Samba-3 differs from Microsoft technology is that if one chooses to use an LDAP -authentication backend then the same database can be used by several different domains. In a -complex organisation there can be a single LDAP database, which itself can be distributed (ie: Have +authentication backend, then the same database can be used by several different domains. In a +complex organization, there can be a single LDAP database, which itself can be distributed (have a master server and multiple slave servers) that can simultaneously serve multiple domains. -From a design perspective, the number of users per server, as well as the number of servers, per +>From a design perspective, the number of users per server as well as the number of servers per domain should be scaled taking into consideration server capacity and network bandwidth. A physical network segment may house several domains. Each may span multiple network segments. Where domains span routed network segments, consider and test the performance implications of -the design and layout of a network. A Centrally located domain controller that is designed to +the design and layout of a network. A centrally located Domain Controller that is designed to serve multiple routed network segments may result in severe performance problems. Check the -response time (eg: ping timing) between the remote segment and the PDC. If long (more than 100 ms) -locate a backup controller (BDC) on the remote segmanet to serve as the local authentication and +response time (ping timing) between the remote segment and the PDC. If +it's long (more than 100 ms), +locate a backup controller (BDC) on the remote segment to serve as the local authentication and access control server. @@ -131,25 +132,25 @@ access control server. Server Share and Directory Layout -There are cardinal rules to effective network design. These can not be broken with impunity. -The most important rule: Simplicity is king in every well controlled network. Every part of -the infrastructure must be managed, the more complex it is, the greater will be the demand +There are cardinal rules to effective network design that cannot be broken with impunity. +The most important rule: Simplicity is king in every well-controlled network. Every part of +the infrastructure must be managed; the more complex it is, the greater will be the demand of keeping systems secure and functional. -Keep in mind the nature of how data must be share. Physical disk space layout should be considered +Keep in mind the nature of how data must be shared. Physical disk space layout should be considered carefully. Some data must be backed up. The simpler the disk layout the easier it will be to -keep track of backed needs. Identify what back media will be meet needs, consider backup to tape -, CD-ROM or (DVD-ROM), or other off-line storage medium. Plan and implement for minimum -maintenance. Leave nothing to chance in your design, above all, do not leave backups to chance: -Backup and test, validate every backup, create a disaster recovery plan and prove that it works. +keep track of backup needs. Identify what backup media will meet your needs; consider backup to tape, +CD-ROM or (DVD-ROM), or other offline storage medium. Plan and implement for minimum +maintenance. Leave nothing to chance in your design; above all, do not leave backups to chance: +Backup, test, and validate every backup, create a disaster recovery plan and prove that it works. Users should be grouped according to data access control needs. File and directory access -is best controlled via group permissions and the use of the "sticky bit" on group controlled -directories may substantially avoid file access complaints from samba share users. +is best controlled via group permissions and the use of the sticky bit on group controlled +directories may substantially avoid file access complaints from Samba share users. @@ -159,7 +160,7 @@ Keep your design and implementation simple and document your design extensively. audit your documentation. Do not create a complex mess that your successor will not understand. Remember, job security through complex design and implementation may cause loss of operations and downtime to users as the new administrator learns to untangle your knots. Keep access -controls simple and effective and make sure that users will never be interrupted by stupid +controls simple and effective and make sure that users will never be interrupted by obtuse complexity. @@ -168,20 +169,20 @@ complexity. Logon Scripts -Logon scripts can help to ensure that all users gain share and printer connections they need. +Logon scripts can help to ensure that all users gain the share and printer connections they need. -Logon scripts can be created 'on-the-fly' so that all commands executed are specific to the -rights and priviliges granted to the user. The preferred controls should be affected through -group membership so that group information can be used to custom create a logon script using +Logon scripts can be created on-the-fly so all commands executed are specific to the +rights and privileges granted to the user. The preferred controls should be affected through +group membership so group information can be used to create a custom logon script using the root preexec parameters to the NETLOGON share. Some sites prefer to use a tool such as kixstart to establish a controlled -user environment. In any case you may wish to do a google search for logon script process controls. -In particular, you may wish to explore the use of the Microsoft knowledgebase article KB189105 that +user environment. In any case, you may wish to do a Google search for logon script process controls. +In particular, you may wish to explore the use of the Microsoft KnowledgeBase article KB189105 that deals with how to add printers without user intervention via the logon script process. @@ -194,9 +195,11 @@ User and Group Profiles may be migrated using the tools described in the section Management. + +SID Profiles may also be managed using the Samba-3 tool profiles. This tool allows -the MS Windows NT style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file +the MS Windows NT-style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file to be changed to the SID of the Samba-3 domain. @@ -206,9 +209,9 @@ to be changed to the SID of the Samba-3 domain. It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before -attempting to migrate user and group accounts it is STRONGLY advised to create in Samba-3 the -groups that are present on the MS Windows NT4 domain AND to map these to -suitable Unix/Linux groups. By following this simple advice all user and group attributes +attempting to migrate user and group accounts, it is STRONGLY advised to create in Samba-3 the +groups that are present on the MS Windows NT4 domain AND to map them to +suitable UNIX/Linux groups. By following this simple advice, all user and group attributes should migrate painlessly. @@ -216,7 +219,7 @@ should migrate painlessly. -Steps In Migration Process +Steps in Migration Process The approximate migration process is described below. @@ -224,39 +227,46 @@ The approximate migration process is described below. -You will have an NT4 PDC that has the users, groups, policies and profiles to be migrated +You have an NT4 PDC that has the users, groups, policies and profiles to be migrated. -Samba-3 set up as a DC with netlogon share, profile share, etc. Configure the &smb.conf; file -to fucntion as a BDC. ie: domain master = No. +Samba-3 set up as a DC with netlogon share, profile share, and so on. Configure the &smb.conf; file +to fucntion as a BDC, i.e., domain master = No. The Account Migration Process - Create a BDC account for the samba server using NT Server Manager - Samba must NOT be running + +pdbedit + Create a BDC account in the old NT4 domain for the Samba server using NT Server Manager. + Samba must not be running. - net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd + + +netrpc + net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd net rpc vampire -S NT4PDC -U administrator%passwd pdbedit -L - Note - did the users migrate? + Note &smbmdash; did the users migrate? + +netgroupmap +initGroups.sh Now assign each of the UNIX groups to NT groups: - (Note: It may be useful to copy this text to a script called - initGroups.sh) + (It may be useful to copy this text to a script called initGroups.sh) #!/bin/bash #### Keep this as a shell script for future re-use # First assign well known domain global groups -net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmins -net groupmap modify ntgroup="Domain Guests" unixgroup=nobody -net groupmap modify ntgroup="Domain Users" unixgroup=users +net groupmap modify ntgroup="Domain Admins" unixgroup=root rid=512 +net groupmap modify ntgroup="Domain Users" unixgroup=users rid=513 +net groupmap modify ntgroup="Domain Guests" unixgroup=nobody rid=514 # Now for our added domain global groups net groupmap add ntgroup="Designers" unixgroup=designers type=d rid=3200 @@ -266,12 +276,12 @@ net groupmap add ntgroup="QA Team" unixgroup=qateam type=d rid=3220 net groupmap list - Now check that all groups are recognised + Check that all groups are recognized. -Now migrate all the profiles, then migrate all policy files. +Migrate all the profiles, then migrate all policy files. @@ -281,21 +291,21 @@ Now migrate all the profiles, then migrate all policy files. Migration Options -Sites that wish to migrate from MS Windows NT4 Domain Control to a Samba based solution -generally fit into three basic categories. +Sites that wish to migrate from MS Windows NT4 Domain Control to a Samba-based solution +generally fit into three basic categories. shows the possibilities. -
    The 3 Major Site Types +
    The Three Major Site Types - + Number of UsersDescription - < 50Want simple conversion with NO pain - 50 - 250Want new features, can manage some in-house complexity - > 250Solution/Implementation MUST scale well, complex needs. Cross departmental decision process. Local expertise in most areas + < 50Want simple conversion with no pain. + 50 - 250Want new features, can manage some in-house complexity. + > 250Solution/Implementation must scale well, complex needs. Cross-departmental decision process. Local expertise in most areas.
    @@ -305,81 +315,85 @@ generally fit into three basic categories. There are three basic choices for sites that intend to migrate from MS Windows NT4 -to Samba-3. +to Samba-3: - Simple Conversion (total replacement) + Simple conversion (total replacement). - Upgraded Conversion (could be one of integration) + Upgraded conversion (could be one of integration). - Complete Redesign (completely new solution) + Complete redesign (completely new solution). -Minimise down-stream problems by: +Minimize down-stream problems by: - Take sufficient time + Taking sufficient time. - Avoid Panic + Avoiding Panic. - Test ALL assumptions + Testing all assumptions. - Test full roll-out program, including workstation deployment + Testing the full roll-out program, including workstation deployment. -Nature of the Conversion Choices + lists the conversion choices given the type of migration +being contemplated. + + +
    Nature of the Conversion Choices - - - + + + SimpleUpgradedRedesign - Make use of minimal OS specific features - Translate NT4 features to new host OS features + Make use of minimal OS specific features. + Translate NT4 features to new host OS features. Decide: - Suck all accounts from NT4 into Samba-3 - Copy and improve: - Authentication Regime (database location and access) + Move all accounts from NT4 into Samba-3 + Copy and improve + Authentication regime (database location and access) Make least number of operational changes Make progressive improvements - Desktop Management Methods + Desktop management methods Take least amount of time to migrate - Minimise user impact - Better Control of Desktops / Users + Minimize user impact + Better control of Desktops/Users - Live versus Isolated Conversion - Maximise functionality - Identify Needs for: Manageability, Scalability, Security, Availability + Live versus isolated conversion + Maximize functionality + Identify Needs for: Manageability, Scalability, Security, Availability - Integrate Samba-3 then migrate while users are active, then Change of control (ie: swap out) + Integrate Samba-3 then migrate while users are active, then change of control (swap out) Take advantage of lower maintenance opportunity @@ -392,97 +406,112 @@ Minimise down-stream problems by: Samba-3 Implementation Choices - Authentication database/back end: + Authentication Database/Backend Samba-3 can use an external authentication backend: - Winbind (external Samba or NT4/200x server) - External server could use Active Directory or NT4 Domain - Can use pam_mkhomedir.so to auto-create home dirs - + Winbind (external Samba or NT4/200x server). + External server could use Active Directory or NT4 Domain. + Can use pam_mkhomedir.so to auto-create home dirs. + + Samba-3 can use a local authentication backend: smbpasswd, tdbsam, ldapsam, mysqlsam + + + Access Control Points - Samba-3 can use a local authentication backend: - - smbpasswd, tdbsam, ldapsam, mysqlsam - + Samba permits Access Control Points to be set: - - - - Access Control Points: - On the Share itself - using Share ACLs - On the file system - using UNIX permissions on files and directories - Note: Can Enable Posix ACLs in file system also - Through Samba share parameters - Not recommended - except as last resort + On the share itself &smbmdash; using Share ACLs. + On the file system &smbmdash; using UNIX permissions on files and directories. + Note: Can enable Posix ACLs in file system also. + Through Samba share parameters &smbmdash; not recommended except as last resort. - Policies (migrate or create new ones): + Policies (migrate or create new ones) + + Exercise great caution when affecting registry changes, use the right tool and be aware + that changes made through NT4-style NTConfig.POL files can leave + permanent changes. + - Using Group Policy Editor (NT4) - - Watch out for Tattoo effect + Using Group Policy Editor (NT4). + Watch out for Tattoo effect. - User and Group Profiles: + User and Group Profiles - Platform specific so use platform tool to change from a Local to a Roaming profile - Can use new profiles tool to change SIDs (NTUser.DAT) + Platform-specific so use platform tool to change from a Local to a Roaming profile. + Can use new profiles tool to change SIDs (NTUser.DAT). - Logon Scripts: + Logon Scripts - Know how they work + Know how they work. - User and Group mapping to Unix/Linux: + + User and Group Mapping to UNIX/Linux + +pdbedit + User and Group mapping code is new. Many problems have been experienced as network administrators + who are familiar with Samba-2.2.x migrate to Samba-3. Carefully study the chapters that document + the new password backend behavior and the new group mapping functionality. + - username map facility may be needed - Use 'net groupmap' to connect NT4 groups to Unix groups - Use pdbedit to set/change user configuration + The username map facility may be needed. + Use net groupmap to connect NT4 groups to UNIX groups. + Use pdbedit to set/change user configuration. - NOTE: When migrating to LDAP back, end it may be easier to dump initial - LDAP database to LDIF, then edit, then reload into LDAP + When migrating to LDAP backend, it may be easier to dump the initial + LDAP database to LDIF, edit, then reload into LDAP. - OS specific scripts/programs may be needed: + OS Specific Scripts/Programs may be Needed + + Every operating system has its peculiarities. These are the result of engineering decisions + that were based on the experience of the designer, and may have side-effects that were not + anticipated. Limitations that may bite the Windows network administrator include: + Add/Delete Users: Note OS limits on size of name - (Linux 8 chars) NT4 up to 254 chars - Add/Delete Machines: Applied only to domain members - (Note: Machine names may be limited to 16 characters) - Use 'net groupmap' to connect NT4 groups to Unix groups + (Linux 8 chars) NT4 up to 254 chars. + Add/Delete Machines: Applied only to Domain Members + (Note: machine names may be limited to 16 characters). + Use net groupmap to connect NT4 groups to UNIX groups. Add/Delete Groups: Note OS limits on size and nature. - Linux limit is 16 char, no spaces and no upper case chars (groupadd) + Linux limit is 16 char, no spaces and no upper case chars (groupadd). - Migration Tools: + Migration Tools +pdbedit Domain Control (NT4 Style) Profiles, Policies, Access Controls, Security - Samba: net, rpcclient, smbpasswd, pdbedit, profiles - Windows: NT4 Domain User Manager, Server Manager (NEXUS) + Samba: net, rpcclient, smbpasswd, pdbedit, profiles. + Windows: NT4 Domain User Manager, Server Manager (NEXUS) - + diff --git a/docs/docbook/projdoc/NetworkBrowsing.xml b/docs/docbook/projdoc/NetworkBrowsing.xml index 2db154be33..251b387a05 100644 --- a/docs/docbook/projdoc/NetworkBrowsing.xml +++ b/docs/docbook/projdoc/NetworkBrowsing.xml @@ -6,19 +6,19 @@ Updated: April 21, 2003 -Samba / MS Windows Network Browsing Guide +Network Browsing This document contains detailed information as well as a fast track guide to -implementing browsing across subnets and / or across workgroups (or domains). +implementing browsing across subnets and/or across workgroups (or domains). WINS is the best tool for resolution of NetBIOS names to IP addresses. WINS is -NOT involved in browse list handling except by way of name to address resolution. +not involved in browse list handling except by way of name to address resolution. -MS Windows 2000 and later can be configured to operate with NO NetBIOS -over TCP/IP. Samba-3 and later also supports this mode of operation. -When the use of NetBIOS over TCP/IP has been disabled then the primary +MS Windows 2000 and later versions can be configured to operate with no NetBIOS +over TCP/IP. Samba-3 and later versions also support this mode of operation. +When the use of NetBIOS over TCP/IP has been disabled, the primary means for resolution of MS Windows machine names is via DNS and Active Directory. The following information assumes that your site is running NetBIOS over TCP/IP. @@ -27,14 +27,14 @@ The following information assumes that your site is running NetBIOS over TCP/IP. Features and Benefits -Someone once referred to the past in terms of: They were the worst of times, -they were the best of times. The more we look back, them more we long for what was and -hope it never returns!. +Someone once referred to the past in these words It was the best of times, +it was the worst of times. The more we look back, the more we long for what was and +hope it never returns. -NetBIOS +NetBIOS For many MS Windows network administrators, that statement sums up their feelings about NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle nature was just par for the course. For those who never quite managed to tame its @@ -42,62 +42,62 @@ lusty features, NetBIOS is like Paterson's Curse. -For those not familiar with botanical problems in Australia: Paterson's curse, -Echium plantagineum, was introduced to Australia from Europe during the mid-nineteenth +For those not familiar with botanical problems in Australia, Paterson's Curse, +Echium plantagineum, was introduced to Australia from Europe during the mid-nineteenth century. Since then it has spread rapidly. The high seed production, with densities of -thousands of seeds per square metre, a seed longevity of more than seven years, and an +thousands of seeds per square meter, a seed longevity of more than seven years, and an ability to germinate at any time of year, given the right conditions, are some of the features which make it such a persistent weed. -In this chapter we explore vital aspects of SMB (Server Message Block) networking with +In this chapter we explore vital aspects of Server Message Block (SMB) networking with a particular focus on SMB as implemented through running NetBIOS (Network Basic -Input / Output System) over TCP/IP. Since Samba does NOT implement SMB or NetBIOS over -any other protocols we need to know how to configure our network environment and simply +Input/Output System) over TCP/IP. Since Samba does not implement SMB or NetBIOS over +any other protocols, we need to know how to configure our network environment and simply remember to use nothing but TCP/IP on all our MS Windows network clients. Samba provides the ability to implement a WINS (Windows Internetworking Name Server) and implements extensions to Microsoft's implementation of WINS. These extensions -help Samba to affect stable WINS operations beyond the normal scope of MS WINS. +help Samba to effect stable WINS operations beyond the normal scope of MS WINS. -Please note that WINS is exclusively a service that applies only to those systems -that run NetBIOS over TCP/IP. MS Windows 200x / XP have the capacity to turn off -support for NetBIOS, in which case WINS is of no relevance. Samba supports this also. +WINS is exclusively a service that applies only to those systems +that run NetBIOS over TCP/IP. MS Windows 200x/XP have the capacity to operate with +support for NetBIOS disabled, in which case WINS is of no relevance. Samba supports this also. -For those networks on which NetBIOS has been disabled (ie: WINS is NOT required) +For those networks on which NetBIOS has been disabled (i.e., WINS is not required) the use of DNS is necessary for host name resolution. -What is Browsing? +What Is Browsing? -To most people browsing means that they can see the MS Windows and Samba servers +To most people browsing means they can see the MS Windows and Samba servers in the Network Neighborhood, and when the computer icon for a particular server is clicked, it opens up and shows the shares and printers available on the target server. -What seems so simple is in fact a very complex interaction of different technologies. -The technologies (or methods) employed in making all of this work includes: +What seems so simple is in fact a complex interaction of different technologies. +The technologies (or methods) employed in making all of this work include: - MS Windows machines register their presence to the network - Machines announce themselves to other machines on the network - One or more machine on the network collates the local announcements - The client machine finds the machine that has the collated list of machines - The client machine is able to resolve the machine names to IP addresses - The client machine is able to connect to a target machine + MS Windows machines register their presence to the network. + Machines announce themselves to other machines on the network. + One or more machine on the network collates the local announcements. + The client machine finds the machine that has the collated list of machines. + The client machine is able to resolve the machine names to IP addresses. + The client machine is able to connect to a target machine. @@ -127,38 +127,37 @@ called nmbd. The configuration parameters involved in nmbd' wins hook. -WINS +WINS For Samba, the WINS Server and WINS Support are mutually exclusive options. Those marked with -an '*' are the only options that commonly MAY need to be modified. Even if not one of these -parameters is set nmbd will still do it's job. +an (*) are the only options that commonly may need to be modified. Even if none of these +parameters is set, nmbd will still do its job. - + Discussion -Firstly, all MS Windows networking uses SMB (Server Message Block) based messaging. -SMB messaging may be implemented with or without NetBIOS. MS Windows 200x supports -NetBIOS over TCP/IP for backwards compatibility. Microsoft is intent on phasing out NetBIOS -support. +All MS Windows networking uses SMB-based messaging. SMB messaging may be implemented with or without NetBIOS. +MS Windows 200x supports NetBIOS over TCP/IP for backwards compatibility. Microsoft appears intent on phasing +out NetBIOS support. NetBIOS over TCP/IP -Samba implements NetBIOS, as does MS Windows NT / 200x / XP, by encapsulating it over TCP/IP. -MS Windows products can do likewise. NetBIOS based networking uses broadcast messaging to -affect browse list management. When running NetBIOS over TCP/IP, this uses UDP based messaging. +Samba implements NetBIOS, as does MS Windows NT/200x/XP, by encapsulating it over TCP/IP. +MS Windows products can do likewise. NetBIOS-based networking uses broadcast messaging to +effect browse list management. When running NetBIOS over TCP/IP, this uses UDP-based messaging. UDP messages can be broadcast or unicast. -UDP +UDP Normally, only unicast UDP messaging can be forwarded by routers. The remote announce parameter to smb.conf helps to project browse announcements to remote network segments via unicast UDP. Similarly, the @@ -168,177 +167,187 @@ implements browse list collation using unicast UDP. Secondly, in those networks where Samba is the only SMB server technology, -wherever possible nmbd should be configured on one (1) machine as the WINS +wherever possible nmbd should be configured on one machine as the WINS server. This makes it easy to manage the browsing environment. If each network -segment is configured with it's own Samba WINS server, then the only way to -get cross segment browsing to work is by using the +segment is configured with its own Samba WINS server, then the only way to +get cross-segment browsing to work is by using the +LMBLocal Master Browser +Local Master Browser remote announce and the remote browse sync parameters to your &smb.conf; file. WINS -If only one WINS server is used for an entire multi-segment network then +If only one WINS server is used for an entire multi-segment network, then the use of the remote announce and the -remote browse sync parameters should NOT be necessary. +remote browse sync parameters should not be necessary. -As of Samba 3 WINS replication is being worked on. The bulk of the code has -been committed, but it still needs maturation. This is NOT a supported feature +replicationWINS +As of Samba-3 WINS replication is being worked on. The bulk of the code has +been committed, but it still needs maturation. This is not a supported feature of the Samba-3.0.0 release. Hopefully, this will become a supported feature of one of the Samba-3 release series. Right now Samba WINS does not support MS-WINS replication. This means that -when setting up Samba as a WINS server there must only be one nmbd +when setting up Samba as a WINS server, there must only be one nmbd configured as a WINS server on the network. Some sites have used multiple Samba WINS servers for redundancy (one server per subnet) and then used remote browse sync and remote announce -to affect browse list collation across all segments. Note that this means clients +to effect browse list collation across all segments. Note that this means clients will only resolve local names, and must be configured to use DNS to resolve names on other subnets in order to resolve the IP addresses of the servers they can see on other subnets. This setup is not recommended, but is mentioned as a practical -consideration (ie: an 'if all else fails' scenario). +consideration (i.e., an if all else fails scenario). Lastly, take note that browse lists are a collection of unreliable broadcast messages that are repeated at intervals of not more than 15 minutes. This means that it will take time to establish a browse list and it can take up to 45 -minutes to stabilise, particularly across network segments. +minutes to stabilize, particularly across network segments. -TCP/IP - without NetBIOS +TCP/IP without NetBIOS NetBIOS NetBIOS-less DNS -All TCP/IP using systems use various forms of host name resolution. The primary -methods for TCP/IP hostname resolutions involves either a static file (/etc/hosts -) or DNS (the Domain Name System). DNS is the technology that makes -the Internet usable. DNS based host name resolution is supported by nearly all TCP/IP -enabled systems. Only a few embedded TCP/IP systems do not support DNS. +All TCP/IP-enabled systems use various forms of host name resolution. The primary +methods for TCP/IP hostname resolution involve either a static file (/etc/hosts) +or the Domain Name System (DNS). DNS is the technology that makes +the Internet usable. DNS-based host name resolution is supported by nearly all +TCP/IP-enabled systems. Only a few embedded TCP/IP systems do not support DNS. -When an MS Windows 200x / XP system attempts to resolve a host name to an IP address +When an MS Windows 200x/XP system attempts to resolve a host name to an IP address it follows a defined path: Checks the hosts file. It is located in - C:\WinNT\System32\Drivers\etc. + C:\Windows NT\System32\Drivers\etc. - Does a DNS lookup + Does a DNS lookup. - Checks the NetBIOS name cache + Checks the NetBIOS name cache. - Queries the WINS server + Queries the WINS server. - Does a broadcast name lookup over UDP + Does a broadcast name lookup over UDP. - Looks up entries in LMHOSTS. It is located in - C:\WinNT\System32\Drivers\etc. + Looks up entries in LMHOSTS. It is located in + C:\Windows NT\System32\Drivers\etc. -DNS -Windows 200x / XP can register it's host name with a Dynamic DNS server. You can -force register with a Dynamic DNS server in Windows 200x / XP using: -ipconfig /registerdns +DNS +Windows 200x/XP can register its host name with a Dynamic DNS server. You can +force register with a Dynamic DNS server in Windows 200x/XP using: +ipconfig /registerdns. With Active Directory (ADS), a correctly functioning DNS server is absolutely essential. In the absence of a working DNS server that has been correctly configured, -MS Windows clients and servers will be totally unable to locate each other, +MS Windows clients and servers will be unable to locate each other, so consequently network services will be severely impaired. The use of Dynamic DNS is highly recommended with Active Directory, in which case -the use of BIND9 is preferred for it's ability to adequately support the SRV (service) +the use of BIND9 is preferred for its ability to adequately support the SRV (service) records that are needed for Active Directory. - + DNS and Active Directory -DNSActive Directory -Occasionally we hear from UNIX network administrators who want to use a UNIX based Dynamic +DNSActive Directory +Occasionally we hear from UNIX network administrators who want to use a UNIX-based Dynamic DNS server in place of the Microsoft DNS server. While this might be desirable to some, the MS Windows 200x DNS server is auto-configured to work with Active Directory. It is possible to use BIND version 8 or 9, but it will almost certainly be necessary to create service records -so that MS Active Directory clients can resolve host names to locate essential network services. +so MS Active Directory clients can resolve host names to locate essential network services. The following are some of the default service records that Active Directory requires: - - _ldap._tcp.pdc.ms-dcs.Domain - - - This provides the address of the Windows NT PDC for the Domain. - + + + _ldap._tcp.pdc.ms-dcs.Domain + + + This provides the address of the Windows NT PDC for the Domain. + - - _ldap._tcp.pdc.ms-dcs.DomainTree - - - Resolves the addresses of Global Catalog servers in the domain. - + + + _ldap._tcp.pdc.ms-dcs.DomainTree + + + Resolves the addresses of Global Catalog servers in the domain. + - - _ldap._tcp.site.sites.writable.ms-dcs.Domain - - Provides list of domain controllers based on sites. - + + + _ldap._tcp.site.sites.writable.ms-dcs.Domain + + + Provides list of Domain Controllers based on sites. + - - _ldap._tcp.writable.ms-dcs.Domain - - - Enumerates list of domain controllers that have the writable - copies of the Active Directory data store. - + + + _ldap._tcp.writable.ms-dcs.Domain + + + Enumerates list of Domain Controllers that have the writable copies of the Active Directory datastore. + - - _ldap._tcp.GUID.domains.ms-dcs.DomainTree - - Entry used by MS Windows clients to locate machines using the - Global Unique Identifier. - + + + _ldap._tcp.GUID.domains.ms-dcs.DomainTree + + + Entry used by MS Windows clients to locate machines using the Global Unique Identifier. + - - _ldap._tcp.Site.gc.ms-dcs.DomainTree - - Used by MS Windows clients to locate site configuration dependent - Global Catalog server. - + + + _ldap._tcp.Site.gc.ms-dcs.DomainTree + + + Used by MS Windows clients to locate site configuration dependent Global Catalog server. + - + + @@ -349,8 +358,8 @@ The following are some of the default service records that Active Directory requ MS Windows machines register their NetBIOS names -(ie: the machine name for each service type in operation) on start -up. The exact method by which this name registration +(i.e., the machine name for each service type in operation) on start-up. +The exact method by which this name registration takes place is determined by whether or not the MS Windows client/server has been given a WINS server address, whether or not LMHOSTS lookup is enabled, or if DNS for NetBIOS name resolution is enabled, etc. @@ -360,7 +369,7 @@ is enabled, or if DNS for NetBIOS name resolution is enabled, etc. In the case where there is no WINS server, all name registrations as well as name lookups are done by UDP broadcast. This isolates name resolution to the local subnet, unless LMHOSTS is used to list all -names and IP addresses. In such situations Samba provides a means by +names and IP addresses. In such situations, Samba provides a means by which the Samba server name may be forcibly injected into the browse list of a remote MS Windows network (using the remote announce parameter). @@ -374,17 +383,17 @@ and thus WINS allows name resolution to function across routed networks. During the startup process an election will take place to create a -local master browser if one does not already exist. On each NetBIOS network -one machine will be elected to function as the domain master browser. This -domain browsing has nothing to do with MS security domain control. -Instead, the domain master browser serves the role of contacting each local +Local Master Browser if one does not already exist. On each NetBIOS network +one machine will be elected to function as the Domain Master Browser. This +domain browsing has nothing to do with MS security Domain Control. +Instead, the Domain Master Browser serves the role of contacting each local master browser (found by asking WINS or from LMHOSTS) and exchanging browse list contents. This way every master browser will eventually obtain a complete -list of all machines that are on the network. Every 11-15 minutes an election +list of all machines that are on the network. Every 11 to 15 minutes an election is held to determine which machine will be the master browser. By the nature of the election criteria used, the machine with the highest uptime, or the -most senior protocol version, or other criteria, will win the election -as domain master browser. +most senior protocol version or other criteria, will win the election +as Domain Master Browser. @@ -400,43 +409,43 @@ inability to use the network services. -Samba supports a feature that allows forced synchronisation -of browse lists across routed networks using the remote browse sync parameter in the &smb.conf; file. -This causes Samba to contact the local master browser on a remote network and -to request browse list synchronisation. This effectively bridges -two networks that are separated by routers. The two remote -networks may use either broadcast based name resolution or WINS -based name resolution, but it should be noted that the remote browse sync parameter provides browse list synchronisation - and -that is distinct from name to address resolution, in other -words, for cross subnet browsing to function correctly it is -essential that a name to address resolution mechanism be provided. -This mechanism could be via DNS, /etc/hosts, -and so on. +Samba supports a feature that allows forced synchronization of browse lists across +routed networks using the remote browse sync +parameter in the &smb.conf; file. This causes Samba to contact the local master +browser on a remote network and to request browse list synchronization. This +effectively bridges two networks that are separated by routers. The two remote +networks may use either broadcast-based name resolution or WINS-based name +resolution, but it should be noted that the +remote browse sync parameter provides +browse list synchronization &smbmdash; and that is distinct from name to address +resolution. In other words, for cross-subnet browsing to function correctly it is +essential that a name-to-address resolution mechanism be provided. This mechanism +could be via DNS, /etc/hosts, and so on. -Setting up WORKGROUP Browsing +Configuring WORKGROUP Browsing -To set up cross subnet browsing on a network containing machines -in up to be in a WORKGROUP, not an NT Domain you need to set up one -Samba server to be the Domain Master Browser (note that this is *NOT* +To configure cross-subnet browsing on a network containing machines +in a WORKGROUP, not an NT Domain, you need to set up one +Samba server to be the Domain Master Browser (note that this is not the same as a Primary Domain Controller, although in an NT Domain the -same machine plays both roles). The role of a Domain master browser is -to collate the browse lists from local master browsers on all the -subnets that have a machine participating in the workgroup. Without -one machine configured as a domain master browser each subnet would -be an isolated workgroup, unable to see any machines on any other -subnet. It is the presence of a domain master browser that makes -cross subnet browsing possible for a workgroup. +same machine plays both roles). The role of a Domain Master Browser is +to collate the browse lists from Local Master Browsers on all the +subnets that have a machine participating in the workgroup. Without +one machine configured as a Domain Master Browser, each subnet would +be an isolated workgroup unable to see any machines on another +subnet. It is the presence of a Domain Master Browser that makes +cross-subnet browsing possible for a workgroup. -In an WORKGROUP environment the domain master browser must be a -Samba server, and there must only be one domain master browser per -workgroup name. To set up a Samba server as a domain master browser, +In a WORKGROUP environment the Domain Master Browser must be a +Samba server, and there must only be one Domain Master Browser per +workgroup name. To set up a Samba server as a Domain Master Browser, set the following option in the [global] section -of the &smb.conf; file : +of the &smb.conf; file: @@ -446,15 +455,16 @@ of the &smb.conf; file : -The domain master browser should also preferably be the local master -browser for its own subnet. In order to achieve this set the following -options in the [global] section of the &smb.conf; file : +The Domain Master Browser should preferably be the local master +browser for its own subnet. In order to achieve this, set the following +options in the [global] section of the &smb.conf; +file as shown in . - - Domain master browser smb.conf - [global] + +Domain Master Browser smb.conf +[global] domain masteryes local masteryes preferred masteryes @@ -463,25 +473,23 @@ options in the [global] section of the &smb.con -The domain master browser may be the same machine as the WINS -server, if you require. +The Domain Master Browser may be the same machine as the WINS server, if necessary. -Next, you should ensure that each of the subnets contains a -machine that can act as a local master browser for the -workgroup. Any MS Windows NT/2K/XP/2003 machine should be -able to do this, as will Windows 9x machines (although these -tend to get rebooted more often, so it's not such a good idea -to use these). To make a Samba server a local master browser -set the following options in the [global] section of the -&smb.conf; file : +Next, you should ensure that each of the subnets contains a machine that can act as +a Local Master Browser for the workgroup. Any MS Windows NT/200x/XP machine should +be able to do this, as will Windows 9x/Me machines (although these tend to get +rebooted more often, so it is not such a good idea to use these). To make a Samba +server a Local Master Browser set the following options in the +[global] section of the &smb.conf; file as +shown in : - - Local master browser smb.conf - [global] + +Local master browser smb.conf +[global] domain masterno local masteryes preferred masteryes @@ -490,30 +498,27 @@ set the following options in the [global] secti -Do not do this for more than one Samba server on each subnet, -or they will war with each other over which is to be the local -master browser. +Do not do this for more than one Samba server on each subnet, or they will war with +each other over which is to be the Local Master Browser. The local master parameter allows Samba to act as a -local master browser. The preferred master causes nmbd +Local Master Browser. The preferred master causes nmbd to force a browser election on startup and the os level -parameter sets Samba high enough so that it should win any browser elections. +parameter sets Samba high enough so it should win any browser elections. -If you have an NT machine on the subnet that you wish to -be the local master browser then you can disable Samba from -becoming a local master browser by setting the following -options in the [global] section of the -&smb.conf; file : +If you have an NT machine on the subnet that you wish to be the Local Master Browser, you can disable Samba from +becoming a Local Master Browser by setting the following options in the [global] section of the +&smb.conf; file as shown in : - - smb.conf for not being a master browser - [global] + +smb.conf for not being a Master Browser +[global] domain masterno local masterno preferred masterno @@ -524,30 +529,25 @@ options in the [global] section of the -Setting up DOMAIN Browsing +DOMAIN Browsing Configuration -If you are adding Samba servers to a Windows NT Domain then -you must not set up a Samba server as a domain master browser. -By default, a Windows NT Primary Domain Controller for a domain -is also the Domain master browser for that domain, and many -things will break if a Samba server registers the Domain master -browser NetBIOS name (DOMAIN<1B>) +If you are adding Samba servers to a Windows NT Domain, then you must not set up a Samba server as a Domain Master Browser. +By default, a Windows NT Primary Domain Controller for a domain is also the Domain Master Browser for that domain. Network +browsing may break if a Samba server registers the domain master browser NetBIOS name (DOMAIN<1B>) with WINS instead of the PDC. -For subnets other than the one containing the Windows NT PDC -you may set up Samba servers as local master browsers as -described. To make a Samba server a local master browser set -the following options in the [global] section -of the &smb.conf; file : +For subnets other than the one containing the Windows NT PDC, you may set up Samba servers as Local Master Browsers as +described. To make a Samba server a Local Master Browser, set the following options in the [global] section +of the &smb.conf; file as shown in : - - Local master browser smb.conf - [global] + +Local Master Browser smb.conf +[global] domain masterno local masteryes preferred masteryes @@ -556,28 +556,23 @@ of the &smb.conf; file : -If you wish to have a Samba server fight the election with machines -on the same subnet you may set the os level parameter -to lower levels. By doing this you can tune the order of machines that -will become local master browsers if they are running. For -more details on this see the section -Forcing Samba to be the master browser -below. +If you wish to have a Samba server fight the election with machines on the same subnet you +may set the os level parameter to lower levels. +By doing this you can tune the order of machines that will become Local Master Browsers if +they are running. For more details on this refer to . -If you have Windows NT machines that are members of the domain -on all subnets, and you are sure they will always be running then -you can disable Samba from taking part in browser elections and -ever becoming a local master browser by setting following options -in the [global] section of the &smb.conf; -file : +If you have Windows NT machines that are members of the domain on all subnets and you are +sure they will always be running, you can disable Samba from taking part in browser elections +and ever becoming a Local Master Browser by setting the following options in the +[global] section of the &smb.conf; file as shown in : - - smb.conf for not being a master browser - [global] + +&smb.conf; for not being a master browser +[global] domain masterno local masterno preferred masterno @@ -588,109 +583,96 @@ file : -Forcing Samba to be the master +Forcing Samba to Be the Master -Who becomes the master browser is determined by an election -process using broadcasts. Each election packet contains a number of parameters -which determine what precedence (bias) a host should have in the -election. By default Samba uses a very low precedence and thus loses -elections to just about anyone else. +Who becomes the master browser is determined by an election process using broadcasts. Each election packet contains a number of parameters +that determine what precedence (bias) a host should have in the election. By default Samba uses a low precedence and thus loses +elections to just about every Windows network server or client. -If you want Samba to win elections then just set the os level global -option in &smb.conf; to a higher number. It defaults to 0. Using 34 -would make it win all elections over every other system (except other -samba systems!) +If you want Samba to win elections, set the os level +global option in &smb.conf; to a higher number. It defaults to zero. Using 34 would make it win +all elections every other system (except other samba systems). -A os level of 2 would make it beat WfWg and Win95, but not MS Windows -NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32. +An os level of two would make it beat Windows for Workgroups and Windows 9x/Me, but not MS Windows +NT/200x Server. An MS Windows NT/200x Server Domain Controller uses level 32. The maximum os level is 255. -The maximum os level is 255 - -If you want Samba to force an election on startup, then set the -preferred master global option in &smb.conf; to yes. Samba will -then have a slight advantage over other potential master browsers -that are not preferred master browsers. Use this parameter with -care, as if you have two hosts (whether they are Windows 95 or NT or -Samba) on the same local subnet both set with preferred master to -yes, then periodically and continually they will force an election -in order to become the local master browser. +If you want Samba to force an election on startup, set the +preferred master global option in &smb.conf; to yes. +Samba will then have a slight advantage over other potential master browsers that are not Perferred Master Browsers. +Use this parameter with care, as if you have two hosts (whether they are Windows 9x/Me or +NT/200x/XP or Samba) on the same local subnet both set with preferred master +to yes, then periodically and continually they will force an election in order +to become the Local Master Browser. - If you want Samba to be a domain master browser, then it is -recommended that you also set preferred master to yes, because -Samba will not become a domain master browser for the whole of your -LAN or WAN if it is not also a local master browser on its own -broadcast isolated subnet. +If you want Samba to be a Domain Master Browser, then it is recommended that +you also set preferred master to yes, because +Samba will not become a Domain Master Browser for the whole of your LAN or WAN if it is not also a +Local Master Browser on its own broadcast isolated subnet. -It is possible to configure two Samba servers to attempt to become -the domain master browser for a domain. The first server that comes -up will be the domain master browser. All other Samba servers will -attempt to become the domain master browser every 5 minutes. They -will find that another Samba server is already the domain master -browser and will fail. This provides automatic redundancy, should -the current domain master browser fail. +It is possible to configure two Samba servers to attempt to become the Domain Master Browser for a domain. The first server that comes +up will be the Domain Master Browser. All other Samba servers will attempt to become the Domain Master Browser every five minutes. They +will find that another Samba server is already the domain master browser and will fail. This provides automatic redundancy, should +the current Domain Master Browser fail. -Making Samba the domain master +Making Samba the Domain Master -The domain master is responsible for collating the browse lists of -multiple subnets so that browsing can occur between subnets. You can -make Samba act as the domain master by setting domain masteryes -in &smb.conf;. By default it will not be a domain master. +The domain master is responsible for collating the browse lists of multiple subnets so browsing can occur between subnets. You can +make Samba act as the Domain Master by setting domain masteryes +in &smb.conf;. By default it will not be a Domain Master. -Note that you should not set Samba to be the domain master for a -workgroup that has the same name as an NT Domain. +Do not set Samba to be the Domain Master for a workgroup that has the same name as an NT/200x Domain. +If Samba is configured to be the Domain Master for a workgroup that is present on the same +network as a Windows NT/200x domain that has the same name, network browsing problems will +certainly be experienced. -When Samba is the domain master and the master browser, it will listen -for master announcements (made roughly every twelve minutes) from local -master browsers on other subnets and then contact them to synchronise -browse lists. +When Samba is the Domain Master and the Master Browser, it will listen for master +announcements (made roughly every twelve minutes) from Local Master Browsers on +other subnets and then contact them to synchronize browse lists. -If you want Samba to be the domain master then I suggest you also set -the os level high enough to make sure it wins elections, and set -preferred master to yes, to get Samba to force an election on -startup. +If you want Samba to be the domain master, you should also set the +os level high enough to make sure it wins elections, and +set preferred master to yes, to +get Samba to force an election on startup. -Note that all your servers (including Samba) and clients should be -using a WINS server to resolve NetBIOS names. If your clients are only -using broadcasting to resolve NetBIOS names, then two things will occur: +All servers (including Samba) and clients should be using a WINS server to resolve NetBIOS names. If your +clients are only using broadcasting to resolve NetBIOS names, then two things will occur: - your local master browsers will be unable to find a domain master - browser, as it will only be looking on the local subnet. + Local Master Browsers will be unable to find a Domain Master Browser, as they will be looking only on the local subnet. - if a client happens to get hold of a domain-wide browse list, and - a user attempts to access a host in that list, it will be unable to - resolve the NetBIOS name of that host. + If a client happens to get hold of a domain-wide browse list and a user attempts to access a + host in that list, it will be unable to resolve the NetBIOS name of that host. @@ -702,20 +684,16 @@ If, however, both Samba and your clients are using a WINS server, then: - your local master browsers will contact the WINS server and, as long as - Samba has registered that it is a domain master browser with the WINS - server, your local master browser will receive Samba's IP address - as its domain master browser. + Local master browsers will contact the WINS server and, as long as Samba has registered that it is a Domain Master Browser with the WINS + server, the Local Master Browser will receive Samba's IP address as its Domain Master Browser. - when a client receives a domain-wide browse list, and a user attempts - to access a host in that list, it will contact the WINS server to - resolve the NetBIOS name of that host. as long as that host has - registered its NetBIOS name with the same WINS server, the user will - be able to see that host. + When a client receives a domain-wide browse list and a user attempts to access a host in that list, it will contact the WINS server to + resolve the NetBIOS name of that host. As long as that host has registered its NetBIOS name with the same WINS server, the user will + be able to see that host. @@ -723,27 +701,24 @@ If, however, both Samba and your clients are using a WINS server, then: -Note about broadcast addresses +Note about Broadcast Addresses -If your network uses a "0" based broadcast address (for example if it -ends in a 0) then you will strike problems. Windows for Workgroups -does not seem to support a 0's broadcast and you will probably find -that browsing and name lookups won't work. +If your network uses a 0 based broadcast address (for example, if it ends in a 0) then you will strike problems. Windows for Workgroups +does not seem to support a zeros broadcast and you will probably find that browsing and name lookups will not work. -Multiple interfaces +Multiple Interfaces -Samba now supports machines with multiple network interfaces. If you -have multiple interfaces then you will need to use the interfaces -option in &smb.conf; to configure them. +Samba supports machines with multiple network interfaces. If you have multiple interfaces, you will +need to use the interfaces option in &smb.conf; to configure them. -Use of the Remote Announce parameter +Use of the Remote Announce Parameter The remote announce parameter of &smb.conf; can be used to forcibly ensure @@ -759,47 +734,37 @@ The syntax of the remote announce pa where: -a.b.c.d and -e.f.g.h - - LMBLocal Master Browser + a.b.c.d and e.f.g.h + +LMBLocal Master Browser Local Master Browser - - is either the LMB (Local Master Browser) IP address -or the broadcast address of the remote network. -ie: the LMB is at 192.168.1.10, or the address -could be given as 192.168.1.255 where the netmask -is assumed to be 24 bits (255.255.255.0). -When the remote announcement is made to the broadcast -address of the remote network, every host will receive -our announcements. This is noisy and therefore -undesirable but may be necessary if we do NOT know -the IP address of the remote LMB. - - - -WORKGROUP -is optional and can be either our own workgroup -or that of the remote network. If you use the -workgroup name of the remote network then our -NetBIOS machine names will end up looking like -they belong to that workgroup, this may cause -name resolution problems and should be avoided. - - + is either the LMB (Local Master Browser) IP address or the broadcast address of the remote network. + i.e., the LMB is at 192.168.1.10, or the address could be given as 192.168.1.255 where the netmask + is assumed to be 24 bits (255.255.255.0). When the remote announcement is made to the broadcast + address of the remote network, every host will receive our announcements. This is noisy and therefore + undesirable but may be necessary if we do not know the IP address of the remote LMB. + + + + + WORKGROUP + is optional and can be either our own workgroup or that of the remote network. If you use the + workgroup name of the remote network, our NetBIOS machine names will end up looking like + they belong to that workgroup. This may cause name resolution problems and should be avoided. + + -Use of the Remote Browse Sync parameter +Use of the Remote Browse Sync Parameter The remote browse sync parameter of -&smb.conf; is used to announce to -another LMB that it must synchronise its NetBIOS name list with our -Samba LMB. It works ONLY if the Samba server that has this option is +&smb.conf; is used to announce to another LMB that it must synchronize its NetBIOS name list with our +Samba LMB. This works only if the Samba server that has this option is simultaneously the LMB on its network segment. @@ -819,13 +784,13 @@ remote LMB or else is the network broadcast address of the remote segment. -WINS - The Windows Internetworking Name Server +WINS &smbmdash; The Windows Internetworking Name Server -Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly +Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly recommended. Every NetBIOS machine registers its name together with a name_type value for each of several types of service it has available. -eg: It registers its name directly as a unique (the type 0x03) name. +It registers its name directly as a unique (the type 0x03) name. It also registers its name if it is running the LanManager compatible server service (used to make shares and printers available to other users) by registering the server (the type 0x20) name. @@ -833,38 +798,38 @@ by registering the server (the type 0x20) name. All NetBIOS names are up to 15 characters in length. The name_type variable -is added to the end of the name - thus creating a 16 character name. Any +is added to the end of the name, thus creating a 16 character name. Any name that is shorter than 15 characters is padded with spaces to the 15th -character. ie: All NetBIOS names are 16 characters long (including the +character. Thus, all NetBIOS names are 16 characters long (including the name_type information). -WINS can store these 16 character names as they get registered. A client +WINS can store these 16-character names as they get registered. A client that wants to log onto the network can ask the WINS server for a list of all names that have registered the NetLogon service name_type. This saves broadcast traffic and greatly expedites logon processing. Since broadcast -name resolution can not be used across network segments this type of -information can only be provided via WINS or via statically configured -lmhosts files that must reside on all clients in the +name resolution cannot be used across network segments this type of +information can only be provided via WINS or via a statically configured +lmhosts file that must reside on all clients in the absence of WINS. -WINS also serves the purpose of forcing browse list synchronisation by all -LMB's. LMB's must synchronise their browse list with the DMB (domain master -browser) and WINS helps the LMB to identify it's DMB. By definition this -will work only within a single workgroup. Note that the domain master browser -has NOTHING to do with what is referred to as an MS Windows NT Domain. The +WINS also serves the purpose of forcing browse list synchronization by all +LMBs. LMBs must synchronize their browse list with the DMB (Domain Master +Browser) and WINS helps the LMB to identify its DMB. By definition this +will work only within a single workgroup. Note that the Domain Master Browser +has nothing to do with what is referred to as an MS Windows NT Domain. The later is a reference to a security environment while the DMB refers to the master controller for browse list information only. -Use of WINS will work correctly only if EVERY client TCP/IP protocol stack -has been configured to use the WINS server/s. Any client that has not been -configured to use the WINS server will continue to use only broadcast based -name registration so that WINS may NEVER get to know about it. In any case, +WINS will work correctly only if every client TCP/IP protocol stack +has been configured to use the WINS servers. Any client that has not been +configured to use the WINS server will continue to use only broadcast-based +name registration so WINS may never get to know about it. In any case, machines that have not registered with a WINS server will fail name to address lookup attempts by other clients and will therefore cause workstation access errors. @@ -878,76 +843,77 @@ file [global] section. To configure Samba to register with a WINS server just add -wins servera.b.c.d to your &smb.conf; file [global] section. +wins servera.b.c.d +to your &smb.conf; file [global] section. Never use both wins supportyes together with wins servera.b.c.d -particularly not using it's own IP address. -Specifying both will cause &nmbd; to refuse to start! +particularly not using its own IP address. Specifying both will cause &nmbd; to refuse to start! -Setting up a WINS server +WINS Server Configuration -Either a Samba machine or a Windows NT Server machine may be set up -as a WINS server. To set a Samba machine to be a WINS server you must -add the following option to the &smb.conf; file on the selected machine : -in the [global] section add the line +Either a Samba Server or a Windows NT Server machine may be set up +as a WINS server. To configure a Samba Server to be a WINS server you must +add to the &smb.conf; file on the selected Server the following line to +the [global] section: - + wins supportyes Versions of Samba prior to 1.9.17 had this parameter default to -yes. If you have any older versions of Samba on your network it is +yes. If you have any older versions of Samba on your network it is strongly suggested you upgrade to a recent version, or at the very -least set the parameter to 'no' on all these machines. +least set the parameter to no on all these machines. -Machines with wins supportyes will keep a list of +Machines configured with wins supportyes will keep a list of all NetBIOS names registered with them, acting as a DNS for NetBIOS names. -You should set up only ONE WINS server. Do NOT set the +It is strongly recommended to set up only one WINS server. Do not set the wins supportyes option on more than one Samba server. -To set up a Windows NT Server as a WINS server you need to set up -the WINS service - see your NT documentation for details. Note that -Windows NT WINS Servers can replicate to each other, allowing more -than one to be set up in a complex subnet environment. As Microsoft -refuses to document these replication protocols, Samba cannot currently -participate in these replications. It is possible in the future that -a Samba->Samba WINS replication protocol may be defined, in which -case more than one Samba machine could be set up as a WINS server -but currently only one Samba server should have the +replicationWINS +To configure Windows NT/200x Server as a WINS server, install and configure +the WINS service. See the Windows NT/200x documentation for details. +Windows NT/200x WINS servers can replicate to each other, allowing more +than one to be set up in a complex subnet environment. As Microsoft +refuses to document the replication protocols, Samba cannot currently +participate in these replications. It is possible in the future that +a Samba-to-Samba WINS replication protocol may be defined, in which +case more than one Samba machine could be set up as a WINS server. +Currently only one Samba server should have the wins supportyes parameter set. -After the WINS server has been configured you must ensure that all +After the WINS server has been configured, you must ensure that all machines participating on the network are configured with the address -of this WINS server. If your WINS server is a Samba machine, fill in +of this WINS server. If your WINS server is a Samba machine, fill in the Samba machine IP address in the Primary WINS Server field of the Control Panel->Network->Protocols->TCP->WINS Server dialogs -in Windows 95 or Windows NT. To tell a Samba server the IP address -of the WINS server add the following line to the [global] section of -all &smb.conf; files : +in Windows 9x/Me or Windows NT/200x. To tell a Samba server the IP address +of the WINS server, add the following line to the [global] section of +all &smb.conf; files: - + wins server<name or IP address> @@ -958,18 +924,18 @@ machine or its IP address. -Note that this line MUST NOT BE SET in the &smb.conf; file of the Samba -server acting as the WINS server itself. If you set both the +This line must not be set in the &smb.conf; file of the Samba +server acting as the WINS server itself. If you set both the wins supportyes option and the wins server<name> option then -nmbd will fail to start. +nmbd will fail to start. -There are two possible scenarios for setting up cross subnet browsing. -The first details setting up cross subnet browsing on a network containing -Windows 95, Samba and Windows NT machines that are not configured as -part of a Windows NT Domain. The second details setting up cross subnet +There are two possible scenarios for setting up cross-subnet browsing. +The first details setting up cross-subnet browsing on a network containing +Windows 9x/Me, Samba and Windows NT/200x machines that are not configured as +part of a Windows NT Domain. The second details setting up cross-subnet browsing on networks that contain NT Domains. @@ -979,9 +945,10 @@ browsing on networks that contain NT Domains. WINS Replication +replicationWINS Samba-3 permits WINS replication through the use of the wrepld utility. This tool is not currently capable of being used as it is still in active development. -As soon as this tool becomes moderately functional we will prepare man pages and enhance this +As soon as this tool becomes moderately functional, we will prepare man pages and enhance this section of the documentation to provide usage and technical details. @@ -996,7 +963,7 @@ located in /usr/local/samba/var/locks. -Entries in wins.dat take the form of +Entries in wins.dat take the form of: "NAME#TYPE" TTL ADDRESS+ FLAGS @@ -1009,12 +976,12 @@ flags for the registration. -A typical dynamic entry looks like: +A typical dynamic entry looks like this: "MADMAN#03" 1055298378 192.168.1.2 66R -To make it static, all that has to be done is set the TTL to 0: +To make it static, all that has to be done is set the TTL to 0, like this: "MADMAN#03" 0 192.168.1.2 66R @@ -1022,7 +989,7 @@ To make it static, all that has to be done is set the TTL to 0: -Though this method works with early Samba-3 versions, there's a +Though this method works with early Samba-3 versions, there is a possibility that it may change in future versions if WINS replication is added. @@ -1042,11 +1009,11 @@ for many new network administrators. Windows Networking Protocols -Do NOT use more than one (1) protocol on MS Windows machines +Do not use more than one protocol on MS Windows machines. -A very common cause of browsing problems results from installing more than +A common cause of browsing problems results from installing more than one protocol on an MS Windows machine. @@ -1054,33 +1021,33 @@ one protocol on an MS Windows machine. Every NetBIOS machine takes part in a process of electing the LMB (and DMB) every 15 minutes. A set of election criteria is used to determine the order of precedence for winning this election process. A machine running Samba or -Windows NT will be biased so that the most suitable machine will predictably -win and thus retain it's role. +Windows NT will be biased so the most suitable machine will predictably +win and thus retain its role. -The election process is "fought out" so to speak over every NetBIOS network -interface. In the case of a Windows 9x machine that has both TCP/IP and IPX -installed and has NetBIOS enabled over both protocols the election will be -decided over both protocols. As often happens, if the Windows 9x machine is +The election process is fought out so to speak over every NetBIOS network +interface. In the case of a Windows 9x/Me machine that has both TCP/IP and IPX +installed and has NetBIOS enabled over both protocols, the election will be +decided over both protocols. As often happens, if the Windows 9x/Me machine is the only one with both protocols then the LMB may be won on the NetBIOS interface over the IPX protocol. Samba will then lose the LMB role as Windows -9x will insist it knows who the LMB is. Samba will then cease to function -as an LMB and thus browse list operation on all TCP/IP only machines will +9x/Me will insist it knows who the LMB is. Samba will then cease to function +as an LMB and thus browse list operation on all TCP/IP-only machines will fail. - -Windows 95, 98, 98se, Me are referred to generically as Windows 9x. -The Windows NT4, 2000, XP and 2003 use common protocols. These are roughly -referred to as the WinNT family, but it should be recognised that 2000 and + +Windows 95, 98, 98se, and Me are referred to generically as Windows 9x/Me. +The Windows NT4, 200x, and XP use common protocols. These are roughly +referred to as the Windows NT family, but it should be recognized that 2000 and XP/2003 introduce new protocol extensions that cause them to behave -differently from MS Windows NT4. Generally, where a server does NOT support +differently from MS Windows NT4. Generally, where a server does not support the newer or extended protocol, these will fall back to the NT4 protocols. - + -The safest rule of all to follow it this - USE ONLY ONE PROTOCOL! +The safest rule of all to follow is: use only one protocol! @@ -1095,21 +1062,21 @@ are: - WINS: the best tool! - LMHOSTS: is static and hard to maintain. - Broadcast: uses UDP and can not resolve names across remote segments. + WINS &smbmdash; the best tool. + LMHOSTS &smbmdash; static and hard to maintain. + Broadcast &smbmdash; uses UDP and cannot resolve names across remote segments. -Alternative means of name resolution includes: +Alternative means of name resolution include: -/etc/hosts: is static, hard to maintain, and lacks name_type info -DNS: is a good choice but lacks essential name_type info. +Static /etc/hosts &smbmdash; hard to maintain, and lacks name_type info. +DNS &smbmdash; is a good choice but lacks essential name_type info. -Many sites want to restrict DNS lookups and want to avoid broadcast name +Many sites want to restrict DNS lookups and avoid broadcast name resolution traffic. The name resolve order parameter is of great help here. The syntax of the name resolve order parameter is: @@ -1123,7 +1090,7 @@ The default is: name resolve orderhost lmhost wins bcast -where "host" refers to the native methods used by the UNIX system +where host refers to the native methods used by the UNIX system to implement the gethostbyname() function call. This is normally controlled by /etc/host.conf, /etc/nsswitch.conf and /etc/resolv.conf. @@ -1131,68 +1098,67 @@ controlled by /etc/host.conf, /etc/nsswitch.conf< -Technical Overview of browsing +Technical Overview of Browsing SMB networking provides a mechanism by which clients can access a list -of machines in a network, a so-called browse list. This list +of machines in a network, a so-called browse list. This list contains machines that are ready to offer file and/or print services to other machines within the network. Thus it does not include -machines which aren't currently able to do server tasks. The browse -list is heavily used by all SMB clients. Configuration of SMB +machines that aren't currently able to do server tasks. The browse +list is heavily used by all SMB clients. Configuration of SMB browsing has been problematic for some Samba users, hence this document. -MS Windows 2000 and later, as with Samba 3 and later, can be +MS Windows 2000 and later versions, as with Samba-3 and later versions, can be configured to not use NetBIOS over TCP/IP. When configured this way, it is imperative that name resolution (using DNS/LDAP/ADS) be correctly -configured and operative. Browsing will NOT work if name resolution +configured and operative. Browsing will not work if name resolution from SMB machine names to IP addresses does not function correctly. -Where NetBIOS over TCP/IP is enabled use of a WINS server is highly +Where NetBIOS over TCP/IP is enabled, use of a WINS server is highly recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. WINS allows remote segment clients to obtain NetBIOS name_type information -that can NOT be provided by any other means of name resolution. +that cannot be provided by any other means of name resolution. -Browsing support in Samba +Browsing Support in Samba -Samba facilitates browsing. The browsing is supported by &nmbd; +Samba facilitates browsing. The browsing is supported by &nmbd; and is also controlled by options in the &smb.conf; file. Samba can act as a local browse master for a workgroup and the ability to support domain logons and scripts is now available. -Samba can also act as a domain master browser for a workgroup. This -means that it will collate lists from local browse masters into a -wide area network server list. In order for browse clients to +Samba can also act as a Domain Master Browser for a workgroup. This +means that it will collate lists from Local Master Browsers into a +wide area network server list. In order for browse clients to resolve the names they may find in this list, it is recommended that both Samba and your clients use a WINS server. -Note that you should NOT set Samba to be the domain master for a -workgroup that has the same name as an NT Domain: on each wide area -network, you must only ever have one domain master browser per workgroup, -regardless of whether it is NT, Samba or any other type of domain master -that is providing this service. +Do not set Samba to be the Domain Master for a workgroup that has the same +name as an NT Domain. On each wide area network, you must only ever have one +Domain Master Browser per workgroup, regardless of whether it is NT, Samba +or any other type of domain master that is providing this service. -Nmbd can be configured as a WINS server, but it is not -necessary to specifically use Samba as your WINS server. MS Windows -NT4, Server or Advanced Server 2000 or 2003 can be configured as -your WINS server. In a mixed NT/2000/2003 server and Samba environment on +nmbd can be configured as a WINS server, but it is not +necessary to specifically use Samba as your WINS server. MS Windows +NT4, Server or Advanced Server 200x can be configured as +your WINS server. In a mixed NT/200x server and Samba environment on a Wide Area Network, it is recommended that you use the Microsoft -WINS server capabilities. In a Samba-only environment, it is -recommended that you use one and only one Samba server as your WINS server. +WINS server capabilities. In a Samba-only environment, it is +recommended that you use one and only one Samba server as the WINS server. @@ -1203,151 +1169,151 @@ to control what workgroup Samba becomes a part of. Samba also has a useful option for a Samba server to offer itself for -browsing on another subnet. It is recommended that this option is only -used for 'unusual' purposes: announcements over the internet, for -example. See remote announce in the -&smb.conf; man page. +browsing on another subnet. It is recommended that this option is only +used for unusual purposes: announcements over the Internet, for +example. See remote announce in the +&smb.conf; man page. -Problem resolution +Problem Resolution -If something doesn't work then hopefully the log.nmbd file will help -you track down the problem. Try a debug level of 2 or 3 for finding +If something does not work, the log.nmbd file will help +to track down the problem. Try a log level of 2 or 3 for finding problems. Also note that the current browse list usually gets stored in text form in a file called browse.dat. -Note that if it doesn't work for you, then you should still be able to -type the server name as \\SERVER in filemanager then -hit enter and filemanager should display the list of available shares. +If it does not work, you should still be able to +type the server name as \\SERVER in filemanager, then +press enter and filemanager should display the list of available shares. -Some people find browsing fails because they don't have the global -guest account set to a valid account. Remember that the -IPC$ connection that lists the shares is done as guest, and thus you must -have a valid guest account. +Some people find browsing fails because they do not have the global +guest account set to a valid account. Remember that the +IPC$ connection that lists the shares is done as guest and, thus, you must have a valid guest account. - -MS Windows 2000 and upwards (as with Samba) can be configured to disallow -anonymous (ie: Guest account) access to the IPC$ share. In that case, the + +MS Windows 2000 and later (as with Samba) can be configured to disallow +anonymous (i.e., guest account) access to the IPC$ share. In that case, the MS Windows 2000/XP/2003 machine acting as an SMB/CIFS client will use the -name of the currently logged in user to query the IPC$ share. MS Windows -9X clients are not able to do this and thus will NOT be able to browse +name of the currently logged-in user to query the IPC$ share. MS Windows +9x/Me clients are not able to do this and thus will not be able to browse server resources. - + The other big problem people have is that their broadcast address, -netmask or IP address is wrong (specified with the "interfaces" option +netmask or IP address is wrong (specified with the interfaces option in &smb.conf;) -Browsing across subnets +Cross-Subnet Browsing + -Since the release of Samba 1.9.17(alpha1), Samba has supported the +replicationbrowse lists +Since the release of Samba 1.9.17 (alpha1), Samba has supported the replication of browse lists across subnet boundaries. This section describes how to set this feature up in different settings. -To see browse lists that span TCP/IP subnets (ie. networks separated -by routers that don't pass broadcast traffic), you must set up at least -one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing -NetBIOS name to IP address translation to be done by doing a direct -query of the WINS server. This is done via a directed UDP packet on -port 137 to the WINS server machine. The reason for a WINS server is -that by default, all NetBIOS name to IP address translation is done -by broadcasts from the querying machine. This means that machines +To see browse lists that span TCP/IP subnets (i.e., networks separated +by routers that do not pass broadcast traffic), you must set up at least +one WINS server. The WINS server acts as a DNS for NetBIOS names. This will +allow NetBIOS name-to-IP address translation to be completed by a direct +query of the WINS server. This is done via a directed UDP packet on +port 137 to the WINS server machine. The WINS server avoids the necessity +of default NetBIOS name-to-IP address translation, which is done +using UDP broadcasts from the querying machine. This means that machines on one subnet will not be able to resolve the names of machines on another subnet without using a WINS server. Remember, for browsing across subnets to work correctly, all machines, -be they Windows 95, Windows NT, or Samba servers must have the IP address +be they Windows 95, Windows NT or Samba servers, must have the IP address of a WINS server given to them by a DHCP server, or by manual configuration -(for Win95 and WinNT, this is in the TCP/IP Properties, under Network -settings) for Samba this is in the &smb.conf; file. +(for Windows 9x/Me and Windows NT/200x/XP, this is in the TCP/IP Properties, under Network +settings); for Samba, this is in the &smb.conf; file. -How does cross subnet browsing work ? +Behavior of Cross-Subnet Browsing -Cross subnet browsing is a complicated dance, containing multiple -moving parts. It has taken Microsoft several years to get the code +Cross-subnet Browsing is a complicated dance, containing multiple +moving parts. It has taken Microsoft several years to get the code that achieves this correct, and Samba lags behind in some areas. -Samba is capable of cross subnet browsing when configured correctly. +Samba is capable of cross-subnet browsing when configured correctly. - Consider a network set up as in the diagram below. +Consider a network set up as . -Cross subnet browsing examplebrowsing1 +Cross-Subnet Browsing Example.browsing1 -Consisting of 3 subnets (1, 2, 3) connected by two routers -(R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines -on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume -for the moment that all these machines are configured to be in the -same workgroup (for simplicity's sake). Machine N1_C on subnet 1 -is configured as Domain Master Browser (ie. it will collate the -browse lists for the workgroup). Machine N2_D is configured as +This consists of 3 subnets (1, 2, 3) connected by two routers +(R1, R2) which do not pass broadcasts. Subnet 1 has five machines +on it, subnet 2 has four machines, subnet 3 has four machines. Assume +for the moment that all machines are configured to be in the +same workgroup (for simplicity's sake). Machine N1_C on subnet 1 +is configured as Domain Master Browser (i.e., it will collate the +browse lists for the workgroup). Machine N2_D is configured as WINS server and all the other machines are configured to register their NetBIOS names with it. -As all these machines are booted up, elections for master browsers -will take place on each of the three subnets. Assume that machine +As these machines are booted up, elections for master browsers +will take place on each of the three subnets. Assume that machine N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on -subnet 3 - these machines are known as local master browsers for -their particular subnet. N1_C has an advantage in winning as the -local master browser on subnet 1 as it is set up as Domain Master +subnet 3. These machines are known as Local Master Browsers for +their particular subnet. N1_C has an advantage in winning as the +Local Master Browser on subnet 1 as it is set up as Domain Master Browser. On each of the three networks, machines that are configured to offer sharing services will broadcast that they are offering -these services. The local master browser on each subnet will +these services. The Local Master Browser on each subnet will receive these broadcasts and keep a record of the fact that -the machine is offering a service. This list of records is -the basis of the browse list. For this case, assume that -all the machines are configured to offer services so all machines +the machine is offering a service. This list of records is +the basis of the browse list. For this case, assume that +all the machines are configured to offer services, so all machines will be on the browse list. -For each network, the local master browser on that network is -considered 'authoritative' for all the names it receives via -local broadcast. This is because a machine seen by the local -master browser via a local broadcast must be on the same -network as the local master browser and thus is a 'trusted' -and 'verifiable' resource. Machines on other networks that -the local master browsers learn about when collating their -browse lists have not been directly seen - these records are -called 'non-authoritative'. +For each network, the Local Master Browser on that network is +considered authoritative for all the names it receives via +local broadcast. This is because a machine seen by the Local Master +Browser via a local broadcast must be on the same network as the +Local Master Browser and thus is a trusted +and verifiable resource. Machines on other networks that +the Local Master Browsers learn about when collating their +browse lists have not been directly seen. These records are +called non-authoritative. -At this point the browse lists look as follows (these are -the machines you would see in your network neighborhood if -you looked in it on a particular network right now). +At this point the browse lists appear as shown in (these are +the machines you would see in your network neighborhood if you looked in it on a particular network right now). -
    - Browse subnet example 1 +
    + Browse Subnet Example 1 SubnetBrowse MasterList @@ -1363,38 +1329,36 @@ you looked in it on a particular network right now). -Note that at this point all the subnets are separate, no -machine is seen across any of the subnets. +At this point all the subnets are separate, and no machine is seen across any of the subnets. -Now examine subnet 2. As soon as N2_B has become the local -master browser it looks for a Domain master browser to synchronize -its browse list with. It does this by querying the WINS server +Now examine subnet 2. As soon as N2_B has become the Local +Master Browser it looks for a Domain Master Browser with which to synchronize +its browse list. It does this by querying the WINS server (N2_D) for the IP address associated with the NetBIOS name -WORKGROUP<1B>. This name was registered by the Domain master -browser (N1_C) with the WINS server as soon as it was booted. +WORKGROUP<1B>. This name was registered by the Domain Master +Browser (N1_C) with the WINS server as soon as it was started. -Once N2_B knows the address of the Domain master browser it -tells it that is the local master browser for subnet 2 by -sending a MasterAnnouncement packet as a UDP port 138 packet. -It then synchronizes with it by doing a NetServerEnum2 call. This +Once N2_B knows the address of the Domain Master Browser, it +tells it that is the Local Master Browser for subnet 2 by +sending a MasterAnnouncement packet as a UDP port 138 packet. +It then synchronizes with it by doing a NetServerEnum2 call. This tells the Domain Master Browser to send it all the server -names it knows about. Once the domain master browser receives -the MasterAnnouncement packet it schedules a synchronization -request to the sender of that packet. After both synchronizations -are done the browse lists look like : +names it knows about. Once the Domain Master Browser receives +the MasterAnnouncement packet, it schedules a synchronization +request to the sender of that packet. After both synchronizations +are complete the browse lists look as shown in : - -
    - Browse subnet example 2 +
    + Browse Subnet Example 2 - + SubnetBrowse MasterList @@ -1409,7 +1373,8 @@ N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    -Servers with a (*) after them are non-authoritative names. + +Servers with an (*) after them are non-authoritative names. @@ -1420,20 +1385,19 @@ subnet 3 will still only see the servers on their own subnet. The same sequence of events that occurred for N2_B now occurs -for the local master browser on subnet 3 (N3_D). When it -synchronizes browse lists with the domain master browser (N1_A) +for the Local Master Browser on subnet 3 (N3_D). When it +synchronizes browse lists with the Domain Master Browser (N1_A) it gets both the server entries on subnet 1, and those on -subnet 2. After N3_D has synchronized with N1_C and vica-versa -the browse lists look like. +subnet 2. After N3_D has synchronized with N1_C and vica versa, +the browse lists will appear as shown in . - - - Browse subnet example 3 +
    + Browse Subnet Example 3 - + SubnetBrowse MasterList @@ -1450,29 +1414,30 @@ N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)
    -Servers with a (*) after them are non-authoritative names. + +Servers with an (*) after them are non-authoritative names. -At this point users looking in their network neighborhood on -subnets 1 or 3 will see all the servers on all subnets, users on +At this point, users looking in their network neighborhood on +subnets 1 or 3 will see all the servers on all subnets, while users on subnet 2 will still only see the servers on subnets 1 and 2, but not 3. -Finally, the local master browser for subnet 2 (N2_B) will sync again -with the domain master browser (N1_C) and will receive the missing -server entries. Finally - and as a steady state (if no machines -are removed or shut off) the browse lists will look like : +Finally, the Local Master Browser for subnet 2 (N2_B) will sync again +with the Domain Master Browser (N1_C) and will receive the missing +server entries. Finally, as when a steady state (if no machines +are removed or shut off) has been achieved, the browse lists will appear +as shown in . - - - Browse subnet example 4 +
    + Browse Subnet Example 4 - + SubnetBrowse MasterList @@ -1491,25 +1456,26 @@ N2_C(*), N2_D(*)
    - -Servers with a (*) after them are non-authoritative names. + + +Servers with an (*) after them are non-authoritative names. -Synchronizations between the domain master browser and local -master browsers will continue to occur, but this should be a -steady state situation. +Synchronizations between the Domain Master Browser and Local +Master Browsers will continue to occur, but this should remain a +steady state operation. -If either router R1 or R2 fails the following will occur: +If either router R1 or R2 fails, the following will occur: Names of computers on each side of the inaccessible network fragments - will be maintained for as long as 36 minutes, in the network neighbourhood + will be maintained for as long as 36 minutes in the network neighborhood lists. @@ -1517,15 +1483,15 @@ If either router R1 or R2 fails the following will occur: Attempts to connect to these inaccessible computers will fail, but the - names will not be removed from the network neighbourhood lists. + names will not be removed from the network neighborhood lists. If one of the fragments is cut off from the WINS server, it will only - be able to access servers on its local subnet, by using subnet-isolated - broadcast NetBIOS name resolution. The effects are similar to that of + be able to access servers on its local subnet using subnet-isolated + broadcast NetBIOS name resolution. The effects are similar to that of losing access to a DNS server. @@ -1539,54 +1505,126 @@ If either router R1 or R2 fails the following will occur: Many questions are asked on the mailing lists regarding browsing. The majority of browsing -problems originate out of incorrect configuration of NetBIOS name resolution. Some are of +problems originate from incorrect configuration of NetBIOS name resolution. Some are of particular note. -How can one flush the Samba NetBIOS name cache without restarting Samba? +How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba? -Samba's nmbd process controls all browse list handling. Under normal circumstances it is -safe to restart nmbd. This will effectively flush the Samba NetBIOS name cache and cause it -to be rebuilt. Note that this does NOT make certain that a rogue machine name will not re-appear -in the browse list. When nmbd is taken out of service another machine on the network will -become the browse master. This new list may still have the rogue entry in it. If you really -want to clear a rogue machine from the list then every machine on the network will need to be -shut down and restarted at after all machines are down. Failing a complete restart, the only +flush name cache +Samba's nmbd process controls all browse list handling. Under normal circumstances it is +safe to restart nmbd. This will effectively flush the Samba NetBIOS name cache and cause it +to be rebuilt. This does not make certain that a rogue machine name will not re-appear +in the browse list. When nmbd is taken out of service, another machine on the network will +become the Browse Master. This new list may still have the rogue entry in it. If you really +want to clear a rogue machine from the list, every machine on the network will need to be +shut down and restarted after all machines are down. Failing a complete restart, the only other thing you can do is wait until the entry times out and is then flushed from the list. -This may take a long time on some networks (months). +This may take a long time on some networks (perhaps months). - + -My client reports "This server is not configured to list shared resources" + Server Resources Can Not Be Listed +My Client Reports This server is not configured to list shared resources + + Your guest account is probably invalid for some reason. Samba uses the -guest account for browsing in smbd. Check that your guest account is +guest account for browsing in smbd. Check that your guest account is valid. -See also guest account in the &smb.conf; man page. +Also see guest account in the &smb.conf; man page. - I get an <errorname>Unable to browse the network</errorname> error + I get an <errorname>`Unable to browse the network'</errorname> error - This error can have multiple causes: + This error can have multiple causes: +browsing problems + - There is no local master browser. Configure &nmbd; - or any other machine to serve as local master browser. - You can not log onto the machine that is the local master - browser. Can you logon to it as guest user? - There is no IP connectivity to the local master browser. + There is no Local Master Browser. Configure &nmbd; + or any other machine to serve as Local Master Browser. + You cannot log onto the machine that is the local master + browser. Can you logon to it as a guest user? + There is no IP connectivity to the Local Master Browser. Can you reach it by broadcast? + +Browsing of Shares and Directories is Very Slow + + +slow browsing +There are only two machines on a test network. One a Samba server, the other a Windows XP machine. +Authentication and logons work perfectly, but when I try to explore shares on the Samba server, the +Windows XP client becomes unrespsonsive. Sometimes it does not respond for some minutes. Eventually, +Windows Explorer will respond and displays files and directories without problem. +display file and directory. + + + +But, the share is immediately available from a command shell (cmd, followed by +exploration with dos command. Is this a Samba problem or is it a Windows problem? How can I solve this? + + + +Here are a few possibilities: + + + + + Bad Networking Hardware + +bad hardware +WebClient + Most common defective hardware problems center around low cost or defective HUBs, routers, + Network Interface Controllers (NICs) and bad wiring. If one piece of hardware is defective + the whole network may suffer. Bad networking hardware can cause data corruption. Most bad + networking hardware problems are accompanied by an increase in apparent network traffic, + but not all. + + + + + The Windows XP WebClient + + A number of sites have reported similar slow network browsing problems and found that when + the WebClient service is turned off, the problem dissapears. This is certainly something + that should be explored as it is a simple solution &smbmdash; if it works. + + + + + Inconsistent WINS Configuration + + This type of problem is common when one client is configured to use a WINS server (that is + a TCP/IP configuration setting) and there is no WINS server on the network. Alternately, + this will happen is there is a WINS server and Samba is not configured to use it. The use of + WINS is highly recommended if the network is using NetBIOS over TCP/IP protocols. If use + of NetBIOS over TCP/IP is disabled on all clients, Samba should not be configured as a WINS + server neither should it be configured to use one. + + + + + Incorrect DNS Configuration + + If use of NetBIOS over TCP/IP is disabled, Active Directory is in use and the DNS server + has been incorrectly configured. Refer for more information. + + + + +     diff --git a/docs/docbook/projdoc/Other-Clients.xml b/docs/docbook/projdoc/Other-Clients.xml index 968a584f9d..76909e5236 100644 --- a/docs/docbook/projdoc/Other-Clients.xml +++ b/docs/docbook/projdoc/Other-Clients.xml @@ -1,41 +1,38 @@ &author.jelmer; + &author.jht; + &author.danshearer; &person.jmcd;OS/2 5 Mar 2001 -Samba and other CIFS clients +Samba and Other CIFS Clients This chapter contains client-specific information. -Macintosh clients? +Macintosh Clients - Yes. Thursby now has a CIFS Client / Server called DAVE - - - -They test it against Windows 95, Windows NT and samba for -compatibility issues. At the time of writing, DAVE was at version -1.0.1. The 1.0.0 to 1.0.1 update is available as a free download from -the Thursby web site (the speed of finder copies has been greatly -enhanced, and there are bug-fixes included). +Yes. Thursby has a CIFS Client/Server called DAVE. +They test it against Windows 95, Windows NT /200x/XP and Samba for +compatibility issues. At the time of this writing, DAVE was at version +4.1. Please refer to Thursby's Web site for more information regarding this +product. -Alternatives - There are two free implementations of AppleTalk for -several kinds of UNIX machines, and several more commercial ones. +Alternatives &smbmdash; There are two free implementations of AppleTalk for +several kinds of UNIX machines and several more commercial ones. These products allow you to run file services and print services natively to Macintosh users, with no additional support required on -the Macintosh. The two free implementations are -Netatalk, and -CAP. -What Samba offers MS -Windows users, these packages offer to Macs. For more info on these -packages, Samba, and Linux (and other UNIX-based systems) see -http://www.eats.com/linux_mac_win.html +the Macintosh. The two free implementations are +Netatalk, and +CAP. +What Samba offers MS Windows users, these packages offer to Macs. +For more info on these packages, Samba, and Linux (and other UNIX-based systems), see +http://www.eats.com/linux_mac_win.html. Newer versions of the Macintosh (Mac OS X) include Samba. @@ -46,50 +43,48 @@ packages, Samba, and Linux (and other UNIX-based systems) see OS2 Client - Configuring OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba + Configuring OS/2 Warp Connect or OS/2 Warp 4 Basically, you need three components: - The File and Print Client ('IBM Peer') - TCP/IP ('Internet support') - The "NetBIOS over TCP/IP" driver ('TCPBEUI') + The File and Print Client (IBM Peer) + TCP/IP (Internet support) + The NetBIOS over TCP/IP driver (TCPBEUI) Installing the first two together with the base operating system on a blank system is explained in the Warp manual. If Warp has already been installed, but you now want to install the - networking support, use the "Selective Install for Networking" - object in the "System Setup" folder. + networking support, use the Selective Install for Networking + object in the System Setup folder.     - Adding the "NetBIOS over TCP/IP" driver is not described + Adding the NetBIOS over TCP/IP driver is not described in the manual and just barely in the online documentation. Start - MPTS.EXE, click on OK, click on "Configure LAPS" and click - on "IBM OS/2 NETBIOS OVER TCP/IP" in 'Protocols'. This line - is then moved to 'Current Configuration'. Select that line, - click on "Change number" and increase it from 0 to 1. Save this + MPTS.EXE, click on OK, click on Configure LAPS and click + on IBM OS/2 NETBIOS OVER TCP/IP in Protocols. This line + is then moved to Current Configuration. Select that line, + click on Change number and increase it from 0 to 1. Save this configuration. - If the Samba server(s) is not on your local subnet, you + If the Samba server is not on your local subnet, you can optionally add IP names and addresses of these servers - to the "Names List", or specify a WINS server ('NetBIOS - Nameserver' in IBM and RFC terminology). For Warp Connect you - may need to download an update for 'IBM Peer' to bring it on - the same level as Warp 4. See the webpage mentioned above. + to the Names List, or specify a WINS server (NetBIOS + Nameserver in IBM and RFC terminology). For Warp Connect, you + may need to download an update for IBM Peer to bring it on + the same level as Warp 4. See the Web page mentioned above.     - Configuring OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba + Configuring Other Versions of OS/2 + + This sections deals with configuring OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x. - You can use the free Microsoft LAN Manager 2.2c Client - for OS/2 from + You can use the free Microsoft LAN Manager 2.2c Client for OS/2 that is + available from - ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/. - In - a nutshell, edit the file \OS2VER in the root directory of - the OS/2 boot partition and add the lines: + ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/. In a nutshell, edit + the file \OS2VER in the root directory of the OS/2 boot partition and add the lines: 20=setup.exe @@ -97,30 +92,26 @@ packages, Samba, and Linux (and other UNIX-based systems) see 20=netvdd.sys - before you install the client. Also, don't use the - included NE2000 driver because it is buggy. Try the NE2000 - or NS2000 driver from - + before you install the client. Also, do not use the included NE2000 driver because it is buggy. + Try the NE2000 or NS2000 driver from ftp://ftp.cdrom.com/pub/os2/network/ndis/ instead. - Printer driver download for for OS/2 clients? + Printer Driver Download for OS/2 Clients - First, create a share called [PRINTDRV] that is - world-readable. Copy your OS/2 driver files there. Note - that the .EA_ files must still be separate, so you will need - to use the original install files, and not copy an installed - driver from an OS/2 system. + Create a share called [PRINTDRV] that is + world-readable. Copy your OS/2 driver files there. The .EA_ + files must still be separate, so you will need to use the original install files + and not copy an installed driver from an OS/2 system. - Install the NT driver first for that printer. Then, - add to your &smb.conf; a parameter, os2 driver mapfilename. Then, in the file - specified by filename, map the - name of the NT driver name to the OS/2 driver name as - follows: + Install the NT driver first for that printer. Then, add to your &smb.conf; a parameter, + os2 driver mapfilename. + Next, in the file specified by filename, map the + name of the NT driver name to the OS/2 driver name as follows: - nt driver name = os2 driver name.device name, e.g.: + nt driver name = os2 driver name.device name, e.g. HP LaserJet 5L = LASERJET.HP LaserJet 5L @@ -130,8 +121,8 @@ packages, Samba, and Linux (and other UNIX-based systems) see If you only specify the OS/2 driver name, and not the device name, the first attempt to download the driver will actually download the files, but the OS/2 client will tell - you the driver is not available. On the second attempt, it - will work. This is fixed simply by adding the device name + you the driver is not available. On the second attempt, it + will work. This is fixed simply by adding the device name to the mapping, after which it will work on the first attempt. @@ -141,20 +132,17 @@ packages, Samba, and Linux (and other UNIX-based systems) see Windows for Workgroups -Latest TCP/IP stack from Microsoft +Latest TCP/IP Stack from Microsoft Use the latest TCP/IP stack from Microsoft if you use Windows -for Workgroups. - - -The early TCP/IP stacks had lots of bugs. +for Workgroups. The early TCP/IP stacks had lots of bugs. -Microsoft has released an incremental upgrade to their TCP/IP 32-Bit -VxD drivers. The latest release can be found on their ftp site at +Microsoft has released an incremental upgrade to their TCP/IP 32-bit +VxD drivers. The latest release can be found on their ftp site at ftp.microsoft.com, located in /peropsys/windows/public/tcpip/wfwt32.exe. There is an update.txt file there that describes the problems that were -fixed. New files include WINSOCK.DLL, +fixed. New files include WINSOCK.DLL, TELNET.EXE, WSOCK.386, VNBT.386, @@ -167,84 +155,88 @@ fixed. New files include WINSOCK.DLL, -Delete .pwl files after password change +Delete .pwl Files After Password Change -WfWg does a lousy job with passwords. I find that if I change my -password on either the unix box or the PC the safest thing to do is to -delete the .pwl files in the windows directory. The PC will complain about not finding the files, but will soon get over it, allowing you to enter the new password. +Windows for Workgroups does a lousy job with passwords. When you change passwords on either +the UNIX box or the PC, the safest thing to do is to delete the .pwl files in the Windows +directory. The PC will complain about not finding the files, but will soon get over it, +allowing you to enter the new password. -If you don't do this you may find that WfWg remembers and uses the old +If you do not do this, you may find that Windows for Workgroups remembers and uses the old password, even if you told it a new one. -Often WfWg will totally ignore a password you give it in a dialog box. +Often Windows for Workgroups will totally ignore a password you give it in a dialog box. - Configuring WfW password handling +Configuring Windows for Workgroups Password Handling -There is a program call admincfg.exe -on the last disk (disk 8) of the WFW 3.11 disk set. To install it +There is a program call admincfg.exe +on the last disk (disk 8) of the WFW 3.11 disk set. To install it, type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE. -Then add an icon -for it via the Program Manager New Menu. -This program allows you to control how WFW handles passwords. ie disable Password Caching etc -for use with securityuser +Then add an icon for it via the Program Manager New Menu. +This program allows you to control how WFW handles passwords, i.e., +Disable Password Caching and so on. +for use with securityuser. -Case handling of passwords +Password Case Sensitivity -Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the &smb.conf; information on password level to specify what characters samba should try to uppercase when checking. +Windows for Workgroups uppercases the password before sending it to the server. +UNIX passwords can be case-sensitive though. Check the &smb.conf; information on +password level to specify what characters +Samba should try to uppercase when checking. -Use TCP/IP as default protocol +Use TCP/IP as Default Protocol -To support print queue reporting you may find +To support print queue reporting, you may find that you have to use TCP/IP as the default protocol under -WfWg. For some reason if you leave NetBEUI as the default +Windows for Workgroups. For some reason, if you leave NetBEUI as the default, it may break the print queue reporting on some systems. -It is presumably a WfWg bug. +It is presumably a Windows for Workgroups bug. -Speed improvement +Speed Improvement Note that some people have found that setting DefaultRcvWindow in the [MSTCP] section of the -SYSTEM.INI file under WfWg to 3072 gives a -big improvement. I don't know why. +SYSTEM.INI file under Windows for Workgroups to 3072 gives a +big improvement. -My own experience with DefaultRcvWindow is that I get much better +My own experience with DefaultRcvWindow is that I get a much better performance with a large value (16384 or larger). Other people have reported that anything over 3072 slows things down enormously. One person even reported a speed drop of a factor of 30 when he went from -3072 to 8192. I don't know why. +3072 to 8192. -Windows '95/'98 +Windows 95/98 -When using Windows 95 OEM SR2 the following updates are recommended where Samba -is being used. Please NOTE that the above change will affect you once these +When using Windows 95 OEM SR2, the following updates are recommended where Samba +is being used. Please note that the above change will effect you once these updates have been installed. @@ -263,20 +255,20 @@ of Windows 95. -Also, if using MS Outlook it is desirable to +Also, if using MS Outlook, it is desirable to install the OLEUPD.EXE fix. This fix may stop your machine from hanging for an extended period when exiting -Outlook and you may also notice a significant speedup when accessing network +Outlook and you may notice a significant speedup when accessing network neighborhood services. -Speed improvement +Speed Improvement -Configure the win95 TCPIP registry settings to give better -performance. I use a program called MTUSPEED.exe which I got off the -net. There are various other utilities of this type freely available. +Configure the Windows 95 TCP/IP registry settings to give better +performance. I use a program called MTUSPEED.exe that I got off the +Internet. There are various other utilities of this type freely available. @@ -289,9 +281,9 @@ net. There are various other utilities of this type freely available. There are several annoyances with Windows 2000 SP2. One of which only appears when using a Samba server to host user profiles -to Windows 2000 SP2 clients in a Windows domain. This assumes +to Windows 2000 SP2 clients in a Windows domain. This assumes that Samba is a member of the domain, but the problem will -likely occur if it is not. +most likely occur if it is not. @@ -302,19 +294,18 @@ added to the file share which houses the roaming profiles. If this is not done, then the Windows 2000 SP2 client will complain about not being able to access the profile (Access Denied) and create multiple copies of it on disk (DOMAIN.user.001, -DOMAIN.user.002, etc...). See the -&smb.conf; man page -for more details on this option. Also note that the +DOMAIN.user.002, and so on). See the &smb.conf; man page +for more details on this option. Also note that the nt acl support parameter was formally a global parameter in releases prior to Samba 2.2.2. -The following is a minimal profile share: + provides a minimal profile share. - - Minimal profile share + +Minimal profile share [profile] path/export/profile create mask0600 @@ -324,24 +315,23 @@ The following is a minimal profile share: -The reason for this bug is that the Win2k SP2 client copies -the security descriptor for the profile which contains -the Samba server's SID, and not the domain SID. The client +The reason for this bug is that the Windows 200x SP2 client copies +the security descriptor for the profile that contains +the Samba server's SID, and not the domain SID. The client compares the SID for SAMBA\user and realizes it is -different that the one assigned to DOMAIN\user. Hence the reason +different from the one assigned to DOMAIN\user. Hence, the reason for the access denied message. By disabling the nt acl support parameter, Samba will send -the Win2k client a response to the QuerySecurityDescriptor -trans2 call which causes the client to set a default ACL -for the profile. This default ACL includes +the Windows 200x client a response to the QuerySecurityDescriptor trans2 call, which causes the client +to set a default ACL for the profile. This default ACL includes: -DOMAIN\user "Full Control"> +DOMAIN\user Full Control> -This bug does not occur when using winbind to +This bug does not occur when using Winbind to create accounts on the Samba host for Domain users. @@ -350,7 +340,7 @@ create accounts on the Samba host for Domain users. Windows NT 3.1 If you have problems communicating across routers with Windows -NT 3.1 workstations, read this Microsoft Knowledge Base article. +NT 3.1 workstations, read this Microsoft Knowledge Base article. diff --git a/docs/docbook/projdoc/PAM-Authentication-And-Samba.xml b/docs/docbook/projdoc/PAM-Authentication-And-Samba.xml index addd646057..2f8383aae2 100644 --- a/docs/docbook/projdoc/PAM-Authentication-And-Samba.xml +++ b/docs/docbook/projdoc/PAM-Authentication-And-Samba.xml @@ -10,49 +10,50 @@ May 31, 2003 -PAM based Distributed Authentication +PAM-Based Distributed Authentication -This chapter you should help you to deploy winbind based authentication on any PAM enabled -UNIX/Linux system. Winbind can be used to enable user level application access authentication -from any MS Windows NT Domain, MS Windows 200x Active Directory based domain, or any Samba -based domain environment. It will also help you to configure PAM based local host access +This chapter should help you to deploy Winbind-based authentication on any PAM-enabled +UNIX/Linux system. Winbind can be used to enable User-Level application access authentication +from any MS Windows NT Domain, MS Windows 200x Active Directory-based +domain, or any Samba-based domain environment. It will also help you to configure PAM-based local host access controls that are appropriate to your Samba configuration. -In addition to knowing how to configure winbind into PAM, you will learn generic PAM management -possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage. +In addition to knowing how to configure Winbind into PAM, you will learn generic PAM management +possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage. -The use of Winbind require more than PAM configuration alone. Please refer to the Winbind chapter. +The use of Winbind requires more than PAM configuration alone. +Please refer to , for further information regarding Winbind. Features and Benefits -A number of UNIX systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, +A number of UNIX systems (e.g., Sun Solaris), as well as the xxxxBSD family and Linux, now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication, authorization and resource control services. Prior to the introduction of PAM, a decision to use an alternative to the system password database (/etc/passwd) would require the provision of alternatives for all programs that provide security services. -Such a choice would involve provision of alternatives to such programs as: login, -passwd, chown, etc. +Such a choice would involve provision of alternatives to programs such as: login, +passwd, chown, and so on. PAM provides a mechanism that disconnects these security programs from the underlying -authentication/authorization infrastructure. PAM is configured either through one file -/etc/pam.conf (Solaris), or by editing individual files that are +authentication/authorization infrastructure. PAM is configured by making appropriate modifications to one file +/etc/pam.conf (Solaris), or by editing individual control files that are located in /etc/pam.d. -On PAM enabled UNIX/Linux systems it is an easy matter to configure the system to use any -authentication backend, so long as the appropriate dynamically loadable library modules -are available for it. The backend may be local to the system, or may be centralised on a +On PAM-enabled UNIX/Linux systems, it is an easy matter to configure the system to use any +authentication backend so long as the appropriate dynamically loadable library modules +are available for it. The backend may be local to the system, or may be centralized on a remote server. @@ -61,63 +62,63 @@ PAM support modules are available for: - /etc/passwd: + /etc/passwd There are several PAM modules that interact with this standard UNIX user - database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so - and pam_userdb.so. + database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so + and pam_userdb.so. - Kerberos: + Kerberos - The pam_krb5.so module allows the use of any Kerberos compliant server. + The pam_krb5.so module allows the use of any Kerberos compliant server. This tool is used to access MIT Kerberos, Heimdal Kerberos, and potentially Microsoft Active Directory (if enabled). - LDAP: + LDAP - The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend + The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend server. Commonly used LDAP backend servers include: OpenLDAP v2.0 and v2.1, Sun ONE iDentity server, Novell eDirectory server, Microsoft Active Directory. - NetWare Bindery: + NetWare Bindery - The pam_ncp_auth.so module allows authentication off any bindery enabled - NetWare Core Protocol based server. + The pam_ncp_auth.so module allows authentication off any bindery-enabled + NetWare Core Protocol-based server. - SMB Password: + SMB Password - This module, called pam_smbpass.so, will allow user authentication off + This module, called pam_smbpass.so, will allow user authentication off the passdb backend that is configured in the Samba &smb.conf; file. - SMB Server: + SMB Server - The pam_smb_auth.so module is the original MS Windows networking authentication + The pam_smb_auth.so module is the original MS Windows networking authentication tool. This module has been somewhat outdated by the Winbind module. - Winbind: + Winbind - The pam_winbind.so module allows Samba to obtain authentication from any + The pam_winbind.so module allows Samba to obtain authentication from any MS Windows Domain Controller. It can just as easily be used to authenticate - users for access to any PAM enabled application. + users for access to any PAM-enabled application. - RADIUS: + RADIUS There is a PAM RADIUS (Remote Access Dial-In User Service) authentication - module. In most cases the administrator will need to locate the source code + module. In most cases, administrators will need to locate the source code for this tool and compile and install it themselves. RADIUS protocols are used by many routers and terminal servers. @@ -125,15 +126,15 @@ PAM support modules are available for: -Of the above, Samba provides the pam_smbpasswd.so and the pam_winbind.so modules alone. +Of the above, Samba provides the pam_smbpasswd.so and the pam_winbind.so modules alone. Once configured, these permit a remarkable level of flexibility in the location and use -of distributed samba domain controllers that can provide wide are network bandwidth -efficient authentication services for PAM capable systems. In effect, this allows the -deployment of centrally managed and maintained distributed authentication from a single -user account database. +of distributed Samba Domain Controllers that can provide wide area network bandwidth +efficient authentication services for PAM-capable systems. In effect, this allows the +deployment of centrally managed and maintained distributed authentication from a +single-user account database. @@ -145,7 +146,8 @@ user account database. PAM is designed to provide the system administrator with a great deal of flexibility in configuration of the privilege granting applications of their system. The local configuration of system security controlled by PAM is contained in one of two places: -either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory. +either the single system file, /etc/pam.conf, or the +/etc/pam.d/ directory. @@ -153,22 +155,23 @@ either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory. In this section we discuss the correct syntax of and generic options respected by entries to these files. -PAM specific tokens in the configuration file are case insensitive. The module paths, however, are case -sensitive since they indicate a file's name and reflect the case dependence of typical file-systems. +PAM-specific tokens in the configuration file are case insensitive. The module paths, however, are case +sensitive since they indicate a file's name and reflect the case +dependence of typical file systems. The case-sensitivity of the arguments to any given module is defined for each module in turn. In addition to the lines described below, there are two special characters provided for the convenience -of the system administrator: comments are preceded by a `#' and extend to the next end-of-line; also, -module specification lines may be extended with a `\' escaped newline. +of the system administrator: comments are preceded by a # and extend to the next end-of-line; also, +module specification lines may be extended with a \ escaped newline. If the PAM authentication module (loadable link library file) is located in the -default location then it is not necessary to specify the path. In the case of +default location, then it is not necessary to specify the path. In the case of Linux, the default location is /lib/security. If the module -is located outside the default then the path must be specified as: +is located outside the default, then the path must be specified as: @@ -183,11 +186,11 @@ auth required /other_path/pam_strange_module.so The remaining information in this subsection was taken from the documentation of the Linux-PAM project. For more information on PAM, see -The Official Linux-PAM home page +The Official Linux-PAM home page. -A general configuration line of the /etc/pam.conf file has the following form: +A general configuration line of the /etc/pam.conf file has the following form: @@ -203,58 +206,60 @@ Once we have explained the meaning of the above tokens, we will describe this me - service-name: + service-name - The name of the service associated with this entry. Frequently the service name is the conventional - name of the given application. For example, `ftpd', `rlogind' and `su', etc. . + The name of the service associated with this entry. Frequently, the service name is the conventional + name of the given application. For example, ftpd, rlogind and + su, and so on. - There is a special service-name, reserved for defining a default authentication mechanism. It has - the name `OTHER' and may be specified in either lower or upper case characters. Note, when there - is a module specified for a named service, the `OTHER' entries are ignored. + There is a special service-name reserved for defining a default authentication mechanism. It has + the name OTHER and may be specified in either lower- or upper-case characters. + Note, when there is a module specified for a named service, the OTHER + entries are ignored. - module-type: + module-type One of (currently) four types of module. The four types are as follows: - auth: this module type provides two aspects of authenticating the user. - Firstly, it establishes that the user is who they claim to be, by instructing the application + auth: This module type provides two aspects of authenticating the user. + It establishes that the user is who he claims to be by instructing the application to prompt the user for a password or other means of identification. Secondly, the module can grant group membership (independently of the /etc/groups file discussed above) or other privileges through its credential granting properties. - account: this module performs non-authentication based account management. + account: This module performs non-authentication-based account management. It is typically used to restrict/permit access to a service based on the time of day, currently available system resources (maximum number of users) or perhaps the location of the applicant - user `root' login only on the console. + user root login only on the console. - session: primarily, this module is associated with doing things that need - to be done for the user before/after they can be given service. Such things include the logging - of information concerning the opening/closing of some data exchange with a user, mounting - directories, etc. + session: Primarily, this module is associated with doing things that need + to be done for the user before and after they can be given service. Such things include the logging + of information concerning the opening and closing of some data exchange with a user, mounting + directories, and so on. - password: this last module type is required for updating the authentication - token associated with the user. Typically, there is one module for each `challenge/response' - based authentication (auth) module-type. + password: This last module type is required for updating the authentication + token associated with the user. Typically, there is one module for each challenge/response + -based authentication (auth) module type. - control-flag: + control-flag The control-flag is used to indicate how the PAM library will react to the success or failure of the module it is associated with. Since modules can be stacked (modules of the same type execute in series, @@ -269,7 +274,7 @@ Once we have explained the meaning of the above tokens, we will describe this me The simpler (and historical) syntax for the control-flag is a single keyword defined to indicate the severity of concern associated with the success or failure of a specific module. There are four such - keywords: required, requisite, sufficient and optional. + keywords: required, requisite, sufficient and optional. @@ -278,15 +283,15 @@ Once we have explained the meaning of the above tokens, we will describe this me - required: this indicates that the success of the module is required for the + required: This indicates that the success of the module is required for the module-type facility to succeed. Failure of this module will not be apparent to the user until all of the remaining modules (of the same module-type) have been executed. - requisite: like required, however, in the case that such a module returns a + requisite: Like required, however, in the case that such a module returns a failure, control is directly returned to the application. The return value is that associated with - the first required or requisite module to fail. Note, this flag can be used to protect against the + the first required or requisite module to fail. This flag can be used to protect against the possibility of a user getting the opportunity to enter a password over an unsafe medium. It is conceivable that such behavior might inform an attacker of valid accounts on a system. This possibility should be weighed against the not insignificant concerns of exposing a sensitive @@ -294,19 +299,19 @@ Once we have explained the meaning of the above tokens, we will describe this me - sufficient: the success of this module is deemed `sufficient' to satisfy + sufficient: The success of this module is deemed sufficient to satisfy the Linux-PAM library that this module-type has succeeded in its purpose. In the event that no - previous required module has failed, no more `stacked' modules of this type are invoked. (Note, - in this case subsequent required modules are not invoked.). A failure of this module is not deemed + previous required module has failed, no more stacked modules of this type are invoked. + (In this case, subsequent required modules are not invoked). A failure of this module is not deemed as fatal to satisfying the application that this module-type has succeeded. - optional: as its name suggests, this control-flag marks the module as not + optional: As its name suggests, this control-flag marks the module as not being critical to the success or failure of the user's application for service. In general, Linux-PAM ignores such a module when determining if the module stack will succeed or fail. However, in the absence of any definite successes or failures of previous or subsequent stacked - modules this module will determine the nature of the response to the application. One example of + modules, this module will determine the nature of the response to the application. One example of this latter case, is when the other modules return something like PAM_IGNORE. @@ -314,7 +319,7 @@ Once we have explained the meaning of the above tokens, we will describe this me The more elaborate (newer) syntax is much more specific and gives the administrator a great deal of control over how the user is authenticated. This form of the control flag is delimited with square brackets and - consists of a series of value=action tokens: + consists of a series of value=action tokens: @@ -322,16 +327,25 @@ Once we have explained the meaning of the above tokens, we will describe this me - Here, value1 is one of the following return values: success; open_err; symbol_err; service_err; - system_err; buf_err; perm_denied; auth_err; cred_insufficient; authinfo_unavail; user_unknown; maxtries; - new_authtok_reqd; acct_expired; session_err; cred_unavail; cred_expired; cred_err; no_module_data; conv_err; - authtok_err; authtok_recover_err; authtok_lock_busy; authtok_disable_aging; try_again; ignore; abort; - authtok_expired; module_unknown; bad_item; and default. The last of these (default) can be used to set - the action for those return values that are not explicitly defined. + Here, value1 is one of the following return values: + +success; open_err; symbol_err; service_err; system_err; buf_err; +perm_denied; auth_err; cred_insufficient; authinfo_unavail; +user_unknown; maxtries; new_authtok_reqd; acct_expired; session_err; +cred_unavail; cred_expired; cred_err; no_module_data; conv_err; +authtok_err; authtok_recover_err; authtok_lock_busy; +authtok_disable_aging; try_again; ignore; abort; authtok_expired; +module_unknown; bad_item; and default. + + + + + The last of these (default) can be used to set the action for those return values that are not explicitly defined. - The action1 can be a positive integer or one of the following tokens: ignore; ok; done; bad; die; and reset. + The action1 can be a positive integer or one of the following tokens: + ignore; ok; done; bad; die; and reset. A positive integer, J, when specified as the action, can be used to indicate that the next J modules of the current module-type will be skipped. In this way, the administrator can develop a moderately sophisticated stack of modules with a number of different paths of execution. Which path is taken can be determined by the @@ -340,61 +354,61 @@ Once we have explained the meaning of the above tokens, we will describe this me - ignore: when used with a stack of modules, the module's return status will not + ignore: When used with a stack of modules, the module's return status will not contribute to the return code the application obtains. - bad: this action indicates that the return code should be thought of as indicative + bad: This action indicates that the return code should be thought of as indicative of the module failing. If this module is the first in the stack to fail, its status value will be used for that of the whole stack. - die: equivalent to bad with the side effect of terminating the module stack and + die: Equivalent to bad with the side effect of terminating the module stack and PAM immediately returning to the application. - ok: this tells PAM that the administrator thinks this return code should + ok: This tells PAM that the administrator thinks this return code should contribute directly to the return code of the full stack of modules. In other words, if the former state of the stack would lead to a return of PAM_SUCCESS, the module's return code will override this value. Note, if the former state of the stack holds some value that is indicative of a modules - failure, this 'ok' value will not be used to override that value. + failure, this ok value will not be used to override that value. - done: equivalent to ok with the side effect of terminating the module stack and + done: Equivalent to ok with the side effect of terminating the module stack and PAM immediately returning to the application. - reset: clear all memory of the state of the module stack and start again with + reset: Clears all memory of the state of the module stack and starts again with the next stacked module. - Each of the four keywords: required; requisite; sufficient; and optional, have an equivalent expression in - terms of the [...] syntax. They are as follows: + Each of the four keywords: required; requisite; sufficient; and optional, + have an equivalent expression in terms of the [...] syntax. They are as follows: - required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad] + required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad]. - requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die] + requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die]. - sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore] + sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore]. - optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore] + optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore]. @@ -403,49 +417,48 @@ Once we have explained the meaning of the above tokens, we will describe this me Just to get a feel for the power of this new syntax, here is a taste of what you can do with it. With Linux-PAM-0.63, the notion of client plug-in agents was introduced. This is something that makes it possible for PAM to support machine-machine authentication using the transport protocol inherent to the client/server application. With the - [ ... value=action ... ] control syntax, it is possible for an application to be configured + [ ... value=action ... ] control syntax, it is possible for an application to be configured to support binary prompts with compliant clients, but to gracefully fall over into an alternative authentication - mode for older, legacy, applications. + mode for older, legacy applications. - module-path: + module-path The path-name of the dynamically loadable object file; the pluggable module itself. If the first character of the - module path is `/', it is assumed to be a complete path. If this is not the case, the given module path is appended + module path is /, it is assumed to be a complete path. If this is not the case, the given module path is appended to the default module path: /lib/security (but see the notes above). - The args are a list of tokens that are passed to the module when it is invoked. Much like arguments to a typical + The arguments are a list of tokens that are passed to the module when it is invoked, much like arguments to a typical Linux shell command. Generally, valid arguments are optional and are specific to any given module. Invalid arguments are ignored by a module, however, when encountering an invalid argument, the module is required to write an error - to syslog(3). For a list of generic options see the next section. + to syslog(3). For a list of generic options, see the next section. - Note, if you wish to include spaces in an argument, you should surround that argument with square brackets. For example: + If you wish to include spaces in an argument, you should surround that argument with square brackets. For example: squid auth required pam_mysql.so user=passwd_query passwd=mada \ - db=eminence [query=select user_name from internet_service where \ - user_name='%u' and password=PASSWORD('%p') and \ - service='web_proxy'] +db=eminence [query=select user_name from internet_service where \ +user_name=%u and password=PASSWORD(%p) and service=web_proxy] - Note, when using this convention, you can include `[' characters inside the string, and if you wish to include a `]' - character inside the string that will survive the argument parsing, you should use `\['. In other words: + When using this convention, you can include [ characters inside the string, and if you wish to have a ] + character inside the string that will survive the argument parsing, you should use \[. In other words: - + [..[..\]..] --> ..[..].. - Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the + Any line in one of the configuration files that is not formatted correctly will generally tend (erring on the side of caution) to make the authentication process fail. A corresponding error is written to the system log files with a call to syslog(3). @@ -462,18 +475,18 @@ squid auth required pam_mysql.so user=passwd_query passwd=mada \ The following is an example /etc/pam.d/login configuration file. -This example had all options been uncommented is probably not usable -as it stacks many conditions before allowing successful completion +This example had all options uncommented and is probably not usable +because it stacks many conditions before allowing successful completion of the login process. Essentially all conditions can be disabled -by commenting them out except the calls to pam_pwdb.so. +by commenting them out, except the calls to pam_pwdb.so. -PAM: original login config +PAM: Original Login Config #%PAM-1.0 -# The PAM configuration file for the `login' service +# The PAM configuration file for the login service # auth required pam_securetty.so auth required pam_nologin.so @@ -491,7 +504,7 @@ password required pam_pwdb.so shadow md5 -PAM: login using pam_smbpass +PAM: Login Using <filename>pam_smbpass</filename> PAM allows use of replaceable modules. Those available on a sample system include: @@ -506,19 +519,19 @@ pam_nologin.so pam_rootok.so pam_tally.so pam_deny.so pam_issue.so pam_mail.so pam_permit.so pam_securetty.so pam_time.so pam_dialup.so pam_lastlog.so pam_mkhomedir.so -pam_pwdb.so pam_shells.so pam_unix.so +pam_pwdb.so pam_shells.so pam_UNIX.so pam_env.so pam_ldap.so pam_motd.so -pam_radius.so pam_smbpass.so pam_unix_acct.so -pam_wheel.so pam_unix_auth.so pam_unix_passwd.so -pam_userdb.so pam_warn.so pam_unix_session.so +pam_radius.so pam_smbpass.so pam_UNIX_acct.so +pam_wheel.so pam_UNIX_auth.so pam_UNIX_passwd.so +pam_userdb.so pam_warn.so pam_UNIX_session.so The following example for the login program replaces the use of -the pam_pwdb.so module which uses the system +the pam_pwdb.so module that uses the system password database (/etc/passwd, /etc/shadow, /etc/group) with -the module pam_smbpass.so which uses the Samba +the module pam_smbpass.so, which uses the Samba database which contains the Microsoft MD4 encrypted password hashes. This database is stored in either /usr/local/samba/private/smbpasswd, @@ -528,7 +541,7 @@ Samba implementation for your UNIX/Linux system. The pam_smbpass.so module is provided by Samba version 2.2.1 or later. It can be compiled by specifying the options when running Samba's -configure script. For more information +configure script. For more information on the pam_smbpass module, see the documentation in the source/pam_smbpass directory of the Samba source distribution. @@ -536,7 +549,7 @@ source distribution. #%PAM-1.0 -# The PAM configuration file for the `login' service +# The PAM configuration file for the login service # auth required pam_smbpass.so nodelay account required pam_smbpass.so nodelay @@ -551,7 +564,7 @@ Linux system. The default condition uses pam_pwdb.so. #%PAM-1.0 -# The PAM configuration file for the `samba' service +# The PAM configuration file for the samba service # auth required pam_pwdb.so nullok nodelay shadow audit account required pam_pwdb.so audit nodelay @@ -560,16 +573,16 @@ password required pam_pwdb.so shadow md5 -In the following example the decision has been made to use the -smbpasswd database even for basic samba authentication. Such a -decision could also be made for the passwd program and would -thus allow the smbpasswd passwords to be changed using the passwd -program. +In the following example, the decision has been made to use the +smbpasswd database even for basic Samba authentication. Such a +decision could also be made for the passwd program and would +thus allow the smbpasswd passwords to be changed using the +passwd program: #%PAM-1.0 -# The PAM configuration file for the `samba' service +# The PAM configuration file for the samba service # auth required pam_smbpass.so nodelay account required pam_pwdb.so audit nodelay @@ -584,9 +597,9 @@ your particular system implementation for details regarding the specific capabilities of PAM in this environment. Some Linux implementations also provide the pam_stack.so module that allows all authentication to be configured in a single central file. The -pam_stack.so method has some very devoted followers +pam_stack.so method has some devoted followers on the basis that it allows for easier administration. As with all issues in -life though, every decision makes trade-offs, so you may want examine the +life though, every decision makes trade-offs, so you may want to examine the PAM documentation for further helpful information. @@ -595,24 +608,19 @@ PAM documentation for further helpful information. -smb.conf PAM Configuration +&smb.conf; PAM Configuration - There is an option in smb.conf called obey pam restrictions. -The following is from the on-line help for this option in SWAT; + There is an option in &smb.conf; called obey pam restrictions. +The following is from the online help for this option in SWAT; -When Samba is configured to enable PAM support (i.e. -), this parameter will -control whether or not Samba should obey PAM's account -and session management directives. The default behavior -is to use PAM for clear text authentication only and to -ignore any account or session management. Note that Samba always -ignores PAM for authentication in the case of -encrypt passwordsyes. -The reason is that PAM modules cannot support the challenge/response -authentication mechanism needed in the presence of SMB +When Samba is configured to enable PAM support (i.e., ), this parameter will +control whether or not Samba should obey PAM's account and session management directives. The default behavior +is to use PAM for cleartext authentication only and to ignore any account or session management. Samba always +ignores PAM for authentication in the case of encrypt passwordsyes. +The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. @@ -621,7 +629,7 @@ password encryption. -Remote CIFS Authentication using winbindd.so +Remote CIFS Authentication Using <filename>winbindd.so</filename> All operating systems depend on the provision of users credentials acceptable to the platform. @@ -631,72 +639,74 @@ as /etc/passwd. -Users and groups on a Windows NT server are assigned a relative id (rid) which is unique for +Users and groups on a Windows NT server are assigned a relative ID (RID) which is unique for the domain when the user or group is created. To convert the Windows NT user or group into -a unix user or group, a mapping between rids and unix user and group ids is required. This +a UNIX user or group, a mapping between RIDs and UNIX user and group IDs is required. This is one of the jobs that winbind performs. -As winbind users and groups are resolved from a server, user and group ids are allocated +As Winbind users and groups are resolved from a server, user and group IDs are allocated from a specified range. This is done on a first come, first served basis, although all existing users and groups will be mapped as soon as a client performs a user or group -enumeration command. The allocated unix ids are stored in a database file under the Samba +enumeration command. The allocated UNIX IDs are stored in a database file under the Samba lock directory and will be remembered. The astute administrator will realize from this that the combination of pam_smbpass.so, -winbindd, and a distributed passdb backend, such as ldap, will allow the establishment of a -centrally managed, distributed user/password database that can also be used by all PAM (eg: Linux) aware -programs and applications. This arrangement can have particularly potent advantages compared with the use of -Microsoft Active Directory Service (ADS) in so far as reduction of wide area network authentication traffic. +winbindd and a distributed passdb backend, +such as ldap, will allow the establishment of a centrally managed, distributed user/password +database that can also be used by all PAM-aware (e.g., Linux) programs and applications. This arrangement can have +particularly potent advantages compared with the use of Microsoft Active Directory Service (ADS) in so far as +the reduction of wide area network authentication traffic. -The rid to unix id database is the only location where the user and group mappings are -stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd -to determine which user and group ids correspond to Windows NT user and group rids. +The RID to UNIX ID database is the only location where the user and group mappings are +stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd +to determine which user and group IDs correspond to Windows NT user and group RIDs. -Password Synchronization using pam_smbpass.so +Password Synchronization Using <filename>pam_smbpass.so</filename> -pam_smbpass is a PAM module which can be used on conforming systems to -keep the smbpasswd (Samba password) database in sync with the unix +pam_smbpass is a PAM module that can be used on conforming systems to +keep the smbpasswd (Samba password) database in sync with the UNIX password file. PAM (Pluggable Authentication Modules) is an API supported -under some Unices, such as Solaris, HPUX and Linux, that provides a +under some UNIX operating systems, such as Solaris, HPUX and Linux, that provides a generic interface to authentication mechanisms. -This module authenticates a local smbpasswd user database. If you require -support for authenticating against a remote SMB server, or if you're -concerned about the presence of suid root binaries on your system, it is -recommended that you use pam_winbind instead. +This module authenticates a local smbpasswd user database. If you require +support for authenticating against a remote SMB server, or if you are +concerned about the presence of SUID root binaries on your system, it is +recommended that you use pam_winbind instead. -Options recognized by this module are as follows: - - Options recognized by pam_smbpass +Options recognized by this module are shown in . +
    + Options recognized by <parameter>pam_smbpass</parameter> - + - debuglog more debugging info - auditlike debug, but also logs unknown usernames - use_first_passdon't prompt the user for passwords; take them from PAM_ items instead - try_first_passtry to get the password from a previous PAM module, fall back to prompting the user - use_authtoklike try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only) - not_set_passdon't make passwords used by this module available to other modules. - nodelaydon't insert ~1 second delays on authentication failure. + debuglog more debugging info. + auditlike debug, but also logs unknown usernames. + use_first_passdo not prompt the user for passwords; take them from PAM_ items instead. + try_first_passtry to get the password from a previous PAM module fall back to prompting the user. + use_authtok + like try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set (intended for stacking password modules only). + not_set_passdo not make passwords used by this module available to other modules. + nodelaydo not insert ~1 second delays on authentication failure.nulloknull passwords are allowed.nonullnull passwords are not allowed. Used to override the Samba configuration. - migrateonly meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication. + migrateonly meaningful in an auth context; used to update smbpasswd file with a password used for successful authentication.smbconf=filespecify an alternate path to the &smb.conf; file. @@ -704,33 +714,19 @@ Options recognized by this module are as follows: - - Andrew Morgan, for providing the Linux-PAM - framework, without which none of this would have happened - -Christian Gafton and Andrew Morgan again, for the - pam_pwdb module upon which pam_smbpass was originally based - -Luke Leighton for being receptive to the idea, - and for the occasional good-natured complaint about the project's status - that keep me working on it :) -. - - - -The following are examples of the use of pam_smbpass.so in the format of Linux +The following are examples of the use of pam_smbpass.so in the format of Linux /etc/pam.d/ files structure. Those wishing to implement this tool on other platforms will need to adapt this appropriately. -Password Synchronisation Configuration +Password Synchronization Configuration A sample PAM configuration that shows the use of pam_smbpass to make -sure private/smbpasswd is kept in sync when /etc/passwd (/etc/shadow) -is changed. Useful when an expired password might be changed by an -application (such as ssh). +sure private/smbpasswd is kept in sync when /etc/passwd (/etc/shadow) +is changed. Useful when an expired password might be changed by an +application (such as ssh). @@ -738,12 +734,12 @@ application (such as ssh). # password-sync # auth requisite pam_nologin.so -auth required pam_unix.so -account required pam_unix.so +auth required pam_UNIX.so +account required pam_UNIX.so password requisite pam_cracklib.so retry=3 -password requisite pam_unix.so shadow md5 use_authtok try_first_pass +password requisite pam_UNIX.so shadow md5 use_authtok try_first_pass password required pam_smbpass.so nullok use_authtok try_first_pass -session required pam_unix.so +session required pam_UNIX.so @@ -751,11 +747,11 @@ session required pam_unix.so Password Migration Configuration -A sample PAM configuration that shows the use of pam_smbpass to migrate -from plaintext to encrypted passwords for Samba. Unlike other methods, +A sample PAM configuration that shows the use of pam_smbpass to migrate +from plaintext to encrypted passwords for Samba. Unlike other methods, this can be used for users who have never connected to Samba shares: -password migration takes place when users ftp in, login using ssh, pop -their mail, etc. +password migration takes place when users ftp in, login using ssh, pop +their mail, and so on. @@ -763,14 +759,14 @@ their mail, etc. # password-migration # auth requisite pam_nologin.so -# pam_smbpass is called IF pam_unix succeeds. -auth requisite pam_unix.so +# pam_smbpass is called IF pam_UNIX succeeds. +auth requisite pam_UNIX.so auth optional pam_smbpass.so migrate -account required pam_unix.so +account required pam_UNIX.so password requisite pam_cracklib.so retry=3 -password requisite pam_unix.so shadow md5 use_authtok try_first_pass +password requisite pam_UNIX.so shadow md5 use_authtok try_first_pass password optional pam_smbpass.so nullok use_authtok try_first_pass -session required pam_unix.so +session required pam_UNIX.so @@ -778,9 +774,9 @@ session required pam_unix.so Mature Password Configuration -A sample PAM configuration for a 'mature' smbpasswd installation. -private/smbpasswd is fully populated, and we consider it an error if -the smbpasswd doesn't exist or doesn't match the UNIX password. +A sample PAM configuration for a mature smbpasswd installation. +private/smbpasswd is fully populated, and we consider it an error if +the SMB password does not exist or does not match the UNIX password. @@ -788,12 +784,12 @@ the smbpasswd doesn't exist or doesn't match the UNIX password. # password-mature # auth requisite pam_nologin.so -auth required pam_unix.so -account required pam_unix.so +auth required pam_UNIX.so +account required pam_UNIX.so password requisite pam_cracklib.so retry=3 -password requisite pam_unix.so shadow md5 use_authtok try_first_pass +password requisite pam_UNIX.so shadow md5 use_authtok try_first_pass password required pam_smbpass.so use_authtok use_first_pass -session required pam_unix.so +session required pam_UNIX.so @@ -801,8 +797,8 @@ session required pam_unix.so Kerberos Password Integration Configuration -A sample PAM configuration that shows pam_smbpass used together with -pam_krb5. This could be useful on a Samba PDC that is also a member of +A sample PAM configuration that shows pam_smbpass used together with +pam_krb5. This could be useful on a Samba PDC that is also a member of a Kerberos realm. @@ -830,61 +826,57 @@ session required pam_krb5.so Common Errors -PAM can be a very fickle and sensitive to configuration glitches. Here we look at a few cases from +PAM can be fickle and sensitive to configuration glitches. Here we look at a few cases from the Samba mailing list. - pam_winbind problem + pam_winbind Problem - - I have the following PAM configuration: - + A user reported: I have the following PAM configuration: - + auth required /lib/security/pam_securetty.so auth sufficient /lib/security/pam_winbind.so -auth sufficient /lib/security/pam_unix.so use_first_pass nullok +auth sufficient /lib/security/pam_UNIX.so use_first_pass nullok auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account required /lib/security/pam_stack.so service=system-auth account required /lib/security/pam_winbind.so password required /lib/security/pam_stack.so service=system-auth - + - - When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie". - I've tried with user "scienceu+pitie" also. - + When I open a new console with [ctrl][alt][F1], I can't log in with my user pitie. + I have tried with user scienceu+pitie also. - The problem may lie with your inclusion of pam_stack.so + Answer: The problem may lie with your inclusion of pam_stack.so service=system-auth. That file often contains a lot of stuff that may - duplicate what you're already doing. Try commenting out the pam_stack lines - for auth and account and see if things work. If they do, look at + duplicate what you are already doing. Try commenting out the pam_stack lines + for auth and account and see if things work. If they do, look at /etc/pam.d/system-auth and copy only what you need from it into your - /etc/pam.d/login file. Alternatively, if you want all services to use - winbind, you can put the winbind-specific stuff in /etc/pam.d/system-auth. + /etc/pam.d/login file. Alternately, if you want all services to use + Winbind, you can put the Winbind-specific stuff in /etc/pam.d/system-auth. - Winbind is not resolving users and groups + Winbind Is Not Resolving Users and Groups - - My smb.conf file is correctly configured. I have specified + + My &smb.conf; file is correctly configured. I have specified idmap uid12000, and idmap gid3000-3500 and winbind is running. When I do the following it all works fine. - + @@ -909,22 +901,20 @@ bin:x:1:1:bin:/bin:/bin/bash maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false - + - But the following command just fails: - + But this command fails: + -&rootprompt;chown 'maryo' a_file -chown: `maryo': invalid user +&rootprompt;chown maryo a_file +chown: 'maryo': invalid user - -This is driving me nuts! What can be wrong? - + This is driving me nuts! What can be wrong? - Your system is likely running nscd, the name service - caching daemon. Shut it down, do NOT restart it! You will find your problem resolved. + Answer: Your system is likely running nscd, the name service + caching daemon. Shut it down, do not restart it! You will find your problem resolved. diff --git a/docs/docbook/projdoc/PolicyMgmt.xml b/docs/docbook/projdoc/PolicyMgmt.xml index 351c51d1c6..fc06ffefb1 100644 --- a/docs/docbook/projdoc/PolicyMgmt.xml +++ b/docs/docbook/projdoc/PolicyMgmt.xml @@ -7,9 +7,9 @@ System and Account Policies -This chapter summarises the current state of knowledge derived from personal -practice and knowledge from samba mailing list subscribers. Before reproduction -of posted information effort has been made to validate the information provided. +This chapter summarizes the current state of knowledge derived from personal +practice and knowledge from Samba mailing list subscribers. Before reproduction +of posted information, every effort has been made to validate the information given. Where additional information was uncovered through this validation it is provided also. @@ -18,19 +18,22 @@ also. Features and Benefits -When MS Windows NT3.5 was introduced the hot new topic was the ability to implement -Group Policies for users and group. Then along came MS Windows NT4 and a few sites -started to adopt this capability. How do we know that? By way of the number of "booboos" +When MS Windows NT 3.5 was introduced, the hot new topic was the ability to implement +Group Policies for users and groups. Then along came MS Windows NT4 and a few sites +started to adopt this capability. How do we know that? By the number of booboos (or mistakes) administrators made and then requested help to resolve. +group policies +GPOs +group policy objectsGPOs By the time that MS Windows 2000 and Active Directory was released, administrators got the message: Group Policies are a good thing! They can help reduce administrative -costs and actually can help to create happier users. But adoption of the true +costs and actually make happier users. But adoption of the true potential of MS Windows 200x Active Directory and Group Policy Objects (GPOs) for users -and machines were picked up on rather slowly. This was very obvious from the samba -mailing list as in 2000 and 2001 there were very few postings regarding GPOs and +and machines were picked up on rather slowly. This was obvious from the Samba +mailing list as in 2000 and 2001 when there were few postings regarding GPOs and how to replicate them in a Samba environment. @@ -42,8 +45,9 @@ network client workstations. -A tool new to Samba may become an important part of the future Samba Administrators' -arsenal. The editreg tool is described in this document. +A tool new to Samba &smbmdash; the editreg tool +&smbmdash; may become an important part of the future Samba administrators' +arsenal is described in this document. @@ -53,118 +57,122 @@ arsenal. The editreg tool is described in this document. Under MS Windows platforms, particularly those following the release of MS Windows -NT4 and MS Windows 95) it is possible to create a type of file that would be placed -in the NETLOGON share of a domain controller. As the client logs onto the network +NT4 and MS Windows 95, it is possible to create a type of file that would be placed +in the NETLOGON share of a Domain Controller. As the client logs onto the network, this file is read and the contents initiate changes to the registry of the client machine. This file allows changes to be made to those parts of the registry that affect users, groups of users, or machines. -For MS Windows 9x/Me this file must be called Config.POL and may +Config.POL +For MS Windows 9x/ME, this file must be called Config.POL and may be generated using a tool called poledit.exe, better known as the Policy Editor. The policy editor was provided on the Windows 98 installation CD, but disappeared again with the introduction of MS Windows Me (Millennium Edition). From -comments from MS Windows network administrators it would appear that this tool became +comments of MS Windows network administrators, it would appear that this tool became a part of the MS Windows Me Resource Kit. +System Policy Editor MS Windows NT4 Server products include the System Policy Editor -under the Start -> Programs -> Administrative Tools menu item. -For MS Windows NT4 and later clients this file must be called NTConfig.POL. +under Start -> Programs -> Administrative Tools. +For MS Windows NT4 and later clients, this file must be called NTConfig.POL. New with the introduction of MS Windows 2000 was the Microsoft Management Console -or MMC. This tool is the new wave in the ever changing landscape of Microsoft +or MMC. This tool is the new wave in the ever-changing landscape of Microsoft methods for management of network access and security. Every new Microsoft product -or technology seems to obsolete the old rules and to introduce newer and more -complex tools and methods. To Microsoft's credit though, the MMC does appear to +or technology seems to make the old rules obsolete and introduces newer and more +complex tools and methods. To Microsoft's credit, the MMC does appear to be a step forward, but improved functionality comes at a great price. -Before embarking on the configuration of network and system policies it is highly -advisable to read the documentation available from Microsoft's web site regarding +Before embarking on the configuration of network and system policies, it is highly +advisable to read the documentation available from Microsoft's Web site regarding Implementing Profiles and Policies in Windows NT 4.0 available from Microsoft. There are a large number of documents in addition to this old one that should also -be read and understood. Try searching on the Microsoft web site for "Group Policies". +be read and understood. Try searching on the Microsoft Web site for Group Policies. -What follows is a very brief discussion with some helpful notes. The information provided -here is incomplete - you are warned. +What follows is a brief discussion with some helpful notes. The information provided +here is incomplete &smbmdash; you are warned. - Windows 9x/Me Policies + Windows 9x/ME Policies - You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. - It can be found on the Original full product Win98 installation CD under - tools/reskit/netadmin/poledit. Install this using the - Add/Remove Programs facility and then click on the 'Have Disk' tab. + You need the Windows 98 Group Policy Editor to set up Group Profiles under Windows 9x/ME. + It can be found on the original full product Windows 98 installation CD under + tools/reskit/netadmin/poledit. Install this using the + Add/Remove Programs facility and then click on Have Disk. + +NTConfig.POL Use the Group Policy Editor to create a policy file that specifies the location of - user profiles and/or the My Documents etc. Then save these + user profiles and/or My Documents, and so on. Then save these settings in a file called Config.POL that needs to be placed in the - root of the [NETLOGON] share. If Win98 is configured to log onto - the Samba Domain, it will automatically read this file and update the Win9x/Me registry + root of the [NETLOGON] share. If Windows 98 is configured to log onto + the Samba Domain, it will automatically read this file and update the Windows 9x/Me registry of the machine as it logs on. - Further details are covered in the Win98 Resource Kit documentation. + Further details are covered in the Windows 98 Resource Kit documentation. - If you do not take the right steps, then every so often Win9x/Me will check the - integrity of the registry and will restore it's settings from the back-up - copy of the registry it stores on each Win9x/Me machine. Hence, you will + If you do not take the correct steps, then every so often Windows 9x/ME will check the + integrity of the registry and restore its settings from the back-up + copy of the registry it stores on each Windows 9x/ME machine. So, you will occasionally notice things changing back to the original settings. - Install the group policy handler for Win9x to pick up group policies. Look on the - Win98 CD in \tools\reskit\netadmin\poledit. - Install group policies on a Win9x client by double-clicking + Install the group policy handler for Windows 9x/Me to pick up Group Policies. Look on the + Windows 98 CDROM in \tools\reskit\netadmin\poledit. + Install group policies on a Windows 9x/Me client by double-clicking on grouppol.inf. Log off and on again a couple of times and see - if Win98 picks up group policies. Unfortunately this needs to be done on every - Win9x/Me machine that uses group policies. + if Windows 98 picks up Group Policies. Unfortunately, this needs to be done on every + Windows 9x/Me machine that uses Group Policies. - Windows NT4 Style Policy Files + Windows NT4-Style Policy Files To create or edit ntconfig.pol you must use the NT Server - Policy Editor, poledit.exe which is included with NT4 Server - but not NT Workstation. There is a Policy Editor on a NT4 - Workstation but it is not suitable for creating Domain Policies. - Further, although the Windows 95 Policy Editor can be installed on an NT4 + Policy Editor, poledit.exe, which is included with NT4 Server + but not with NT Workstation. There is a Policy Editor on an NT4 + Workstation but it is not suitable for creating domain policies. + Furthermore, although the Windows 95 Policy Editor can be installed on an NT4 Workstation/Server, it will not work with NT clients. However, the files from the NT Server will run happily enough on an NT4 Workstation. You need poledit.exe, common.adm and winnt.adm. - It is convenient to put the two *.adm files in the c:\winnt\inf - directory which is where the binary will look for them unless told otherwise. Note also that that - directory is normally 'hidden'. + It is convenient to put the two *.adm files in the c:\winnt\inf + directory, which is where the binary will look for them unless told otherwise. This + directory is normally hidden. The Windows NT policy editor is also included with the Service Pack 3 (and later) for Windows NT 4.0. Extract the files using servicepackname /x, - i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, - poledit.exe and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible + that's Nt4sp6ai.exe /x for service pack 6a. The Policy Editor, + poledit.exe, and the associated template files (*.adm) should + be extracted as well. It is also possible to downloaded the policy template + files for Office97 and get a copy of the Policy Editor. Another possible location is with the Zero Administration Kit available for download from Microsoft. @@ -172,105 +180,106 @@ here is incomplete - you are warned. Registry Spoiling - With NT4 style registry based policy changes, a large number of settings are not - automatically reversed as the user logs off. Since the settings that were in the - NTConfig.POL file were applied to the client machine registry and that apply to the + With NT4-style registry-based policy changes, a large number of settings are not + automatically reversed as the user logs off. The settings that were in the + NTConfig.POL file were applied to the client machine registry and apply to the hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known - as tattooing. It can have serious consequences down-stream and the administrator must + as tattooing. It can have serious consequences downstream and the administrator must be extremely careful not to lock out the ability to manage the machine at a later date. - - MS Windows 200x / XP Professional Policies + MS Windows 200x/XP Professional Policies - Windows NT4 System policies allows setting of registry parameters specific to - users, groups and computers (client workstations) that are members of the NT4 - style domain. Such policy file will work with MS Windows 2000 / XP clients also. + Windows NT4 system policies allow the setting of registry parameters specific to + users, groups and computers (client workstations) that are members of the NT4-style + domain. Such policy files will work with MS Windows 200x/XP clients also. - New to MS Windows 2000 Microsoft introduced a new style of group policy that confers - a superset of capabilities compared with NT4 style policies. Obviously, the tool used - to create them is different, and the mechanism for implementing them is much changed. + New to MS Windows 2000, Microsoft recently introduced a style of group policy that confers + a superset of capabilities compared with NT4-style policies. Obviously, the tool used + to create them is different, and the mechanism for implementing them is much improved. - The older NT4 style registry based policies are known as Administrative Templates - in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security +GPOs + The older NT4-style registry-based policies are known as Administrative Templates + in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes the ability to set various security configurations, enforce Internet Explorer browser settings, change and redirect aspects of the - users' desktop (including: the location of My Documents files (directory), as + users desktop (including the location of My Documents files (directory), as well as intrinsics of where menu items will appear in the Start menu). An additional new feature is the ability to make available particular software Windows applications to particular users and/or groups. - Remember: NT4 policy files are named NTConfig.POL and are stored in the root - of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password - and selects the domain name to which the logon will attempt to take place. During the logon - process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating - server, modifies the local registry values according to the settings in this file. + Remember, NT4 policy files are named NTConfig.POL and are stored in the root + of the NETLOGON share on the Domain Controllers. A Windows NT4 user enters a username, password + and selects the domain name to which the logon will attempt to take place. During the logon process, + the client machine reads the NTConfig.POL file from the NETLOGON share on + the authenticating server and modifies the local registry values according to the settings in this file. - Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of + Windows 200x GPOs are feature-rich. They are not stored in the NETLOGON share, but rather part of a Windows 200x policy file is stored in the Active Directory itself and the other part is stored in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active - Directory domain controllers. The part that is stored in the Active Directory itself is called the - group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is - known as the group policy template (GPT). + Directory Domain Controllers. The part that is stored in the Active Directory itself is called the + Group Policy Container (GPC), and the part that is stored in the replicated share called SYSVOL is + known as the Group Policy Template (GPT). - With NT4 clients the policy file is read and executed upon only as each user logs onto the network. - MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine - startup (machine specific part) and when the user logs onto the network the user specific part - is applied. In MS Windows 200x style policy management each machine and/or user may be subject + With NT4 clients, the policy file is read and executed only as each user logs onto the network. + MS Windows 200x policies are much more complex &smbmdash; GPOs are processed and applied at client machine + startup (machine specific part) and when the user logs onto the network, the user-specific part + is applied. In MS Windows 200x-style policy management, each machine and/or user may be subject to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows the administrator to also set filters over the policy settings. No such equivalent capability - exists with NT4 style policy files. + exists with NT4-style policy files. - Administration of Win2K / XP Policies + Administration of Windows 200x/XP Policies +GPOs +System Policy Editor Instead of using the tool called The System Policy Editor, commonly called Poledit (from the executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console (MMC) snap-in as follows: - - - Go to the Windows 200x / XP menu Start->Programs->Administrative Tools - and select the MMC snap-in called Active Directory Users and Computers - - - - - Select the domain or organizational unit (OU) that you wish to manage, then right click - to open the context menu for that object, select the properties item. - - - - Now left click on the Group Policy tab, then left click on the New tab. Type a name - for the new policy you will create. - - - - Now left click on the Edit tab to commence the steps needed to create the GPO. - + + Go to the Windows 200x/XP menu Start->Programs->Administrative Tools + and select the MMC snap-in called Active Directory Users and Computers + + + + Select the domain or organizational unit (OU) that you wish to manage, then right-click + to open the context menu for that object, and select the Properties. + + + + Left-click on the Group Policy tab, then + left-click on the New tab. Type a name + for the new policy you will create. + + + + Left-click on the Edit tab to commence the steps needed to create the GPO. + All policy configuration options are controlled through the use of policy administrative - templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. - Beware however, since the .adm files are NOT interchangeable across NT4 and Windows 200x. - The later introduces many new features as well as extended definition capabilities. It is - well beyond the scope of this documentation to explain how to program .adm files, for that + templates. These files have an .adm extension, both in NT4 as well as in Windows 200x/XP. + Beware, however, the .adm files are not interchangeable across NT4 and Windows 200x. + The latter introduces many new features as well as extended definition capabilities. It is + well beyond the scope of this documentation to explain how to program .adm files; for that the administrator is referred to the Microsoft Windows Resource Kit for your particular version of MS Windows. @@ -297,56 +306,80 @@ the policy file. Separate policy files for each user, group, or computer are not -If you create a policy that will be automatically downloaded from validating domain controllers, -you should name the file NTconfig.POL. As system administrator, you have the option of renaming the +NTConfig.POL +If you create a policy that will be automatically downloaded from validating Domain Controllers, +you should name the file NTConfig.POL. As system administrator, you have the option of renaming the policy file and, by modifying the Windows NT-based workstation, directing the computer to update the policy from a manual path. You can do this by either manually changing the registry or by using -the System Policy Editor. This path can even be a local path such that each machine has its own policy file, -but if a change is necessary to all machines, this change must be made individually to each workstation. +the System Policy Editor. This can even be a local path such that each machine has its own policy file, +but if a change is necessary to all machines, it must be made individually to each workstation. -When a Windows NT4/200x/XP machine logs onto the network the NETLOGON share on the authenticating domain -controller for the presence of the NTConfig.POL file. If one exists it is downloaded, parsed and then -applied to the user's part of the registry. +When a Windows NT4/200x/XP machine logs onto the network, the client looks in the NETLOGON share on +the authenticating domain controller for the presence of the NTConfig.POL file. If one exists it is +downloaded, parsed and then applied to the user's part of the registry. -MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally, +GPOs +MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally acquire policy settings through Group Policy Objects (GPOs) that are defined and stored in Active Directory itself. The key benefit of using AS GPOs is that they impose no registry spoiling effect. -This has considerable advantage compared with the use of NTConfig.POL (NT4) style policy updates. +This has considerable advantage compared with the use of NTConfig.POL (NT4) style policy updates. In addition to user access controls that may be imposed or applied via system and/or group policies in a manner that works in conjunction with user profiles, the user management environment under MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied. -Common restrictions that are frequently used includes: +Common restrictions that are frequently used include: +Account Controls - Logon Hours - Password Aging - Permitted Logon from certain machines only - Account type (Local or Global) - User Rights + Logon hours + Password aging + Permitted logon from certain machines only + Account type (local or global) + User rights + + + +Samba-3.0.0 doe not yet implement all account controls that are common to MS Windows NT4/200x/XP. +While it is possible to set many controls using the Domain User Manager for MS Windows NT4, only password +expirey is functional today. Most of the remaining controls at this time have only stub routines +that may eventually be completed to provide actual control. Do not be misled by the fact that a +parameter can be set using the NT4 Domain User Manager or in the NTConfig.POL. + + + + +Management Tools + + +Anyone who wishes to create or manage Group Policies will need to be familiar with a number of tools. +The following sections describe a few key tools that will help you to create a low maintenance user +environment. Samba Editreg Toolset +editreg +NTUser.DAT +NTConfig.POL A new tool called editreg is under development. This tool can be used - to edit registry files (called NTUser.DAT) that are stored in user and group profiles. - NTConfig.POL files have the same structure as the NTUser.DAT file and can be editted using - this tool. editreg is being built with the intent to enable NTConfig.POL - files to be saved in text format and to permit the building of new NTConfig.POL files with - extended capabilities. It is proving difficult to realise this capability, so do not be surprised - if this feature does not materialise. Formal capabilities will be announced at the time that - this tool is released for production use. + to edit registry files (called NTUser.DAT) that are stored in user + and group profiles. NTConfig.POL files have the same structure as the + NTUser.DAT file and can be edited using this tool. editreg + is being built with the intent to enable NTConfig.POL files to be saved in text format and to + permit the building of new NTConfig.POL files with extended capabilities. It is proving difficult + to realize this capability, so do not be surprised if this feature does not materialize. Formal + capabilities will be announced at the time that this tool is released for production use. @@ -356,9 +389,9 @@ Common restrictions that are frequently used includes: The tools that may be used to configure these types of controls from the MS Windows environment are: - The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). - Under MS Windows 200x/XP this is done using the Microsoft Management Console (MMC) with appropriate - "snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor. + the NT4 User Manager for Domains, the NT4 System and Group Policy Editor, and the Registry Editor (regedt32.exe). + Under MS Windows 200x/XP, this is done using the Microsoft Management Console (MMC) with appropriate + snap-ins, the registry editor, and potentially also the NT4 System and Group Policy Editor. @@ -366,10 +399,9 @@ Common restrictions that are frequently used includes: Samba PDC - With a Samba Domain Controller, the new tools for managing of user account and policy information includes: + With a Samba Domain Controller, the new tools for managing user account and policy information include: smbpasswd, pdbedit, net, rpcclient. - The administrator should read the - man pages for these tools and become familiar with their use. + The administrator should read the man pages for these tools and become familiar with their use. @@ -379,23 +411,24 @@ Common restrictions that are frequently used includes: System Startup and Logon Processing Overview -The following attempts to document the order of processing of system and user policies following a system +The following attempts to document the order of processing the system and user policies following a system reboot and as part of the user logon: Network starts, then Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming - Convention Provider (MUP) start + Convention Provider (MUP) start. Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded and applied. The list may include GPOs that: - Apply to the location of machines in a Directory - Apply only when settings have changed - Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc. + Apply to the location of machines in a Directory. + Apply only when settings have changed. + Depend on configuration of the scope of applicability: local, + site, domain, organizational unit, and so on. No desktop user interface is presented until the above have been processed. @@ -405,21 +438,21 @@ reboot and as part of the user logon: - A keyboard action to affect start of logon (Ctrl-Alt-Del). + A keyboard action to effect start of logon (Ctrl-Alt-Del). - User credentials are validated, User profile is loaded (depends on policy settings). + User credentials are validated, user profile is loaded (depends on policy settings). - An ordered list of User GPOs is obtained. The list contents depends on what is configured in respect of: + An ordered list of user GPOs is obtained. The list contents depends on what is configured in respect of: - Is user a domain member, thus subject to particular policies - Loopback enablement, and the state of the loopback policy (Merge or Replace) - Location of the Active Directory itself - Has the list of GPOs changed. No processing is needed if not changed. + Is the user a Domain Member, thus subject to particular policies? + Loopback enablement, and the state of the loopback policy (Merge or Replace). + Location of the Active Directory itself. + Has the list of GPOs changed? No processing is needed if not changed. @@ -428,14 +461,14 @@ reboot and as part of the user logon: - Logon scripts are run. New to Win2K and Active Directory, logon scripts may be obtained based on Group - Policy objects (hidden and executed synchronously). NT4 style logon scripts are then run in a normal + Logon scripts are run. New to Windows 200x and Active Directory, logon scripts may be obtained based on Group + Policy objects (hidden and executed synchronously). NT4-style logon scripts are then run in a normal window. - The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like and NT4 - Domain) machine (system) policies are applied at start-up, User policies are applied at logon. + The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like an NT4 + Domain), machine (system) policies are applied at start-up; user policies are applied at logon. @@ -445,7 +478,7 @@ reboot and as part of the user logon: Common Errors -Policy related problems can be very difficult to diagnose and even more difficult to rectify. The following +Policy-related problems can be quite difficult to diagnose and even more difficult to rectify. The following collection demonstrates only basic issues. @@ -453,15 +486,15 @@ collection demonstrates only basic issues. Policy Does Not Work - We have created the config.pol file and put it in the NETLOGON share. -It has made no difference to our Win XP Pro machines, they just don't see it. IT worked fine with Win 98 but does not +We have created the Config.POL file and put it in the NETLOGON share. +It has made no difference to our Win XP Pro machines, they just do not see it. It worked fine with Win 98 but does not work any longer since we upgraded to Win XP Pro. Any hints? -Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based -platforms. You need to use the NT4 Group Policy Editor to create a file called NTConfig.POL so that -it is in the correct format for your MS Windows XP Pro clients. +Policy files are not portable between Windows 9x/Me and MS Windows NT4/200x/XP-based platforms. You need to +use the NT4 Group Policy Editor to create a file called NTConfig.POL so it is in the +correct format for your MS Windows XP Pro clients. diff --git a/docs/docbook/projdoc/Portability.xml b/docs/docbook/projdoc/Portability.xml index 50cc8b4c7c..90cb8e2d4b 100644 --- a/docs/docbook/projdoc/Portability.xml +++ b/docs/docbook/projdoc/Portability.xml @@ -1,35 +1,35 @@ &author.jelmer; - + &author.jht; + Portability Samba works on a wide range of platforms but the interface all the platforms provide is not always compatible. This chapter contains -platform-specific information about compiling and using samba. +platform-specific information about compiling and using Samba. HPUX -HP's implementation of supplementary groups is, er, non-standard (for -hysterical reasons). There are two group files, /etc/group and +HP's implementation of supplementary groups is non-standard (for +historical reasons). There are two group files, /etc/group and /etc/logingroup; the system maps UIDs to numbers using the former, but -initgroups() reads the latter. Most system admins who know the ropes +initgroups() reads the latter. Most system admins who know the ropes symlink /etc/group to /etc/logingroup -(hard link doesn't work for reasons too stupid to go into here). initgroups() will complain if one of the +(hard link does not work for reasons too obtuse to go into here). initgroups() will complain if one of the groups you're in in /etc/logingroup has what it considers to be an invalid ID, which means outside the range [0..UID_MAX], where UID_MAX is (I think) -60000 currently on HP-UX. This precludes -2 and 65534, the usual nobody +60000 currently on HP-UX. This precludes -2 and 65534, the usual nobody GIDs. -If you encounter this problem, make sure that the programs that are failing -to initgroups() be run as users not in any groups with GIDs outside the +If you encounter this problem, make sure the programs that are failing +to initgroups() are run as users, not in any groups with GIDs outside the allowed range. @@ -37,9 +37,8 @@ allowed range. -On HPUX you must use gcc or the HP ANSI compiler. The free compiler -that comes with HP-UX is not ANSI compliant and cannot compile -Samba. +On HP-UX you must use gcc or the HP ANSI compiler. The free compiler +that comes with HP-UX is not ANSI compliant and cannot compile Samba. @@ -48,9 +47,9 @@ Samba. SCO UNIX -If you run an old version of SCO UNIX then you may need to get important +If you run an old version of SCO UNIX, you may need to get important TCP/IP patches for Samba to work correctly. Without the patch, you may -encounter corrupt data transfers using samba. +encounter corrupt data transfers using Samba. @@ -59,6 +58,16 @@ SCO (ftp.sco.com, directory files uod385a.Z and uod385a.ltr.Z). + +The information provided here refers to an old version of SCO UNIX. If you require +binaries for more recent SCO UNIX products, please contact SCO to obtain packages that are +ready to install. You should also verify with SCO that your platform is up-to-date for the +binary packages you will install. This is important if you wish to avoid data corruption +problems with your installation. To build Samba for SCO UNIX products may +require significant patching of Samba source code. It is much easier to obtain binary +packages directly from SCO. + + @@ -73,17 +82,13 @@ C library for some reason. For this reason Samba by default defines the macro NO_EID in the DNIX section of includes.h. This works around the problem in a limited way, -but it is far from ideal, some things still won't work right. +but it is far from ideal, and some things still will not work right. -To fix the problem properly you need to assemble the following two +To fix the problem properly, you need to assemble the following two functions and then either add them to your C library or link them into -Samba. - - - -put this in the file setegid.s: +Samba. Put the following in the file setegid.s: @@ -102,7 +107,7 @@ _setegid: -put this in the file seteuid.s: +Put this in the file seteuid.s: @@ -121,7 +126,7 @@ _seteuid: -after creating the above files you then assemble them using +After creating the above files, you then assemble them using @@ -135,7 +140,7 @@ that should produce the files seteuid.o and -then you need to add these to the LIBSM line in the DNIX section of +Then you need to add these to the LIBSM line in the DNIX section of the Samba Makefile. Your LIBSM line will then look something like this: @@ -151,15 +156,15 @@ You should then remove the line: #define NO_EID -from the DNIX section of includes.h +from the DNIX section of includes.h. -RedHat Linux Rembrandt-II +Red Hat Linux -By default RedHat Rembrandt-II during installation adds an +By default during installation, some versions of Red Hat Linux add an entry to /etc/hosts as follows: 127.0.0.1 loopback "hostname"."domainname" @@ -169,13 +174,13 @@ entry to /etc/hosts as follows: This causes Samba to loop back onto the loopback interface. The result is that Samba fails to communicate correctly with -the world and therefor may fail to correctly negotiate who +the world and therefore may fail to correctly negotiate who is the master browse list holder and who is the master browser. -Corrective Action: Delete the entry after the word loopback - in the line starting 127.0.0.1 +Corrective Action: Delete the entry after the word "loopback" +in the line starting 127.0.0.1. @@ -195,10 +200,10 @@ Samba performance significantly. Solaris -Locking improvements +Locking Improvements Some people have been experiencing problems with F_SETLKW64/fcntl -when running Samba on Solaris. The built in file locking mechanism was +when running Samba on Solaris. The built-in file locking mechanism was not scalable. Performance would degrade to the point where processes would get into loops of trying to lock a file. It would try a lock, then fail, then try again. The lock attempt was failing before the grant was @@ -213,24 +218,23 @@ has not been released yet. -The patch revision for 2.6 is 105181-34 -for 8 is 108528-19 and for 9 is 112233-04 +The patch revision for 2.6 is 105181-34, for 8 is 108528-19 and for 9 is 112233-04. -After the install of these patches it is recommended to reconfigure -and rebuild samba. +After the install of these patches, it is recommended to reconfigure +and rebuild Samba. -Thanks to Joe Meslovich for reporting +Thanks to Joe Meslovich for reporting this. Winbind on Solaris 9 -Nsswitch on Solaris 9 refuses to use the winbind nss module. This behavior -is fixed by Sun in patch 113476-05 which as of March 2003 is not in any +Nsswitch on Solaris 9 refuses to use the Winbind NSS module. This behavior +is fixed by Sun in patch 113476-05, which as of March 2003, is not in any roll-up packages. diff --git a/docs/docbook/projdoc/Problems.xml b/docs/docbook/projdoc/Problems.xml index 46f3c002d2..2058b6867f 100644 --- a/docs/docbook/projdoc/Problems.xml +++ b/docs/docbook/projdoc/Problems.xml @@ -4,55 +4,57 @@ &author.jerry; &author.jelmer; &author.dbannon; + &author.danshearer; 8 Apr 2003 -Analysing and solving samba problems +Analyzing and Solving Samba Problems There are many sources of information available in the form -of mailing lists, RFC's and documentation. The docs that come -with the samba distribution contain very good explanations of +of mailing lists, RFCs and documentation. The documentation that comes +with the Samba distribution contains good explanations of general SMB topics such as browsing. -Diagnostics tools +Diagnostics Tools With SMB networking, it is often not immediately clear what the cause is of a certain problem. Samba itself provides rather useful information, but in some cases you might have to fall back to using a sniffer. A sniffer is a program that -listens on your LAN, analyses the data sent on it and displays it +listens on your LAN, analyzes the data sent on it and displays it on the screen. -Debugging with Samba itself +Debugging with Samba Itself - -One of the best diagnostic tools for debugging problems is Samba itself. -You can use the for both &smbd; and &nmbd; to specify what -debug level at which to run. See the man pages on smbd, nmbd and -smb.conf for more information on debugging options. The debug + +One of the best diagnostic tools for debugging problems is Samba itself. +You can use the for both &smbd; and &nmbd; to specify the +debug level at which to run. +See the man pages for smbd, nmbd and +&smb.conf; for more information regarding debugging options. The debug level can range from 1 (the default) to 10 (100 for debugging passwords). -Another helpful method of debugging is to compile samba using the -gcc -g flag. This will include debug -information in the binaries and allow you to attach gdb to the -running smbd / nmbd process. In order to attach gdb to an smbd +Another helpful method of debugging is to compile Samba using the +gcc -g flag. This will include debug information in the binaries and +allow you to attach gdb to the running smbd/nmbd process. +To attach gdb to an smbd process for an NT workstation, first get the workstation to make the connection. Pressing ctrl-alt-delete and going down to the domain box -is sufficient (at least, on the first time you join the domain) to -generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation -maintains an open connection, and therefore there will be an smbd +is sufficient (at least, the first time you join the domain) to +generate a LsaEnumTrustedDomains. Thereafter, the workstation +maintains an open connection and there will be an smbd process running (assuming that you haven't set a really short smbd -idle timeout) So, in between pressing ctrl alt delete, and actually -typing in your password, you can attach gdb and continue. +idle timeout). So, in between pressing ctrl-alt-delete and actually +typing in your password, you can attach gdb and continue. -Some useful samba commands worth investigating: +Some useful Samba commands worth investigating are: @@ -65,10 +67,12 @@ Some useful samba commands worth investigating: Tcpdump -Tcpdump was the first -unix sniffer with SMB support. It is a command-line utility and -nowadays, it's SMB support is somewhat less then that of ethereal -and tethereal. + +Tcpdump was the first +UNIX sniffer with SMB support. It is a command-line utility and +now, its SMB support is somewhat lagging that of ethereal +and tethereal. + @@ -77,111 +81,104 @@ and tethereal. Ethereal is a graphical -sniffer, available for both unix (Gtk) and Windows. Ethereal's -SMB support is very good. +sniffer, available for both UNIX (Gtk) and Windows. Ethereal's +SMB support is quite good. -For details on the use of ethereal, read the well-written -ethereal User Guide. +For details on the use of ethereal, read the well-written +Ethereal User Guide. + +ethereal1Starting a capture. -Listen for data on ports 137, 138, 139 and 445. E.g. -use the filter port 137 or port 138 or port 139 or port 445. +Listen for data on ports 137, 138, 139, and 445. For example, use the filter port 137, port 138, port 139, or port 445 as seen in . A console version of ethereal is available as well and is called tethereal. +ethereal2Main ethereal data window. + The Windows Network Monitor -For tracing things on the Microsoft Windows NT, Network Monitor -(aka. netmon) is available on the Microsoft Developer Network CD's, -the Windows NT Server install CD and the SMS CD's. The version of -netmon that ships with SMS allows for dumping packets between any two -computers (i.e. placing the network interface in promiscuous mode). +For tracing things on Microsoft Windows NT, Network Monitor +(aka Netmon) is available on Microsoft Developer Network CDs, +the Windows NT Server install CD and the SMS CDs. The version of +Netmon that ships with SMS allows for dumping packets between any two +computers (i.e., placing the network interface in promiscuous mode). The version on the NT Server install CD will only allow monitoring of network traffic directed to the local NT box and broadcasts on the -local subnet. Be aware that Ethereal can read and write netmon +local subnet. Be aware that Ethereal can read and write Netmon formatted files. -Installing 'Network Monitor' on an NT Workstation +Installing Network Monitor on an NT Workstation -Installing netmon on an NT workstation requires a couple -of steps. The following are for installing Netmon V4.00.349, which comes +Installing Netmon on an NT workstation requires a couple +of steps. The following are instructions for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 4.0, on Microsoft Windows NT -Workstation 4.0. The process should be similar for other versions of -Windows NT / Netmon. You will need both the Microsoft Windows +Workstation 4.0. The process should be similar for other versions of +Windows NT version of Netmon. You will need both the Microsoft Windows NT Server 4.0 Install CD and the Workstation 4.0 Install CD. Initially you will need to install Network Monitor Tools and Agent -on the NT Server. To do this +on the NT Server to do this: - Goto Start - Settings - Control Panel - - Network - Services - Add + Go to Start -> Settings -> Control Panel -> + Network -> Services -> Add. - Select the Network Monitor Tools and Agent and - click on OK. + Select the Network Monitor Tools and Agent and click on OK. - Click OK on the Network Control Panel. - + Click on OK on the Network Control Panel. - Insert the Windows NT Server 4.0 install CD - when prompted. + Insert the Windows NT Server 4.0 install CD when prompted. -At this point the Netmon files should exist in -%SYSTEMROOT%\System32\netmon\*.*. -Two subdirectories exist as well, parsers\ -which contains the necessary DLL's for parsing the netmon packet -dump, and captures\. +At this point, the Netmon files should exist in %SYSTEMROOT%\System32\netmon\*.*. +Two subdirectories exist as well, parsers\ which contains the necessary DLLs +for parsing the Netmon packet dump, and captures\. -In order to install the Netmon tools on an NT Workstation, you will -first need to install the 'Network Monitor Agent' from the Workstation -install CD. +To install the Netmon tools on an NT Workstation, you will first need to install the +Network Monitor Agent from the Workstation install CD. - Goto Start - Settings - Control Panel - - Network - Services - Add + Go to Start -> Settings -> Control Panel -> + Network -> Services -> Add. - Select the Network Monitor Agent and click - on OK. + Select the Network Monitor Agent, click on OK. - Click OK on the Network Control Panel. + Click on OK in the Network Control Panel. - Insert the Windows NT Workstation 4.0 install - CD when prompted. + Insert the Windows NT Workstation 4.0 install CD when prompted. -Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* -to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set -permissions as you deem appropriate for your site. You will need -administrative rights on the NT box to run netmon. +Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon +to %SYSTEMROOT%\System32\netmon on the Workstation and set permissions +as you deem appropriate for your site. You will need administrative rights on the NT box to run Netmon. -Installing 'Network Monitor' on an 9x Workstation +Installing Network Monitor on Windows 9x/Me -To install Netmon on a Windows 9x box install the network monitor agent -from the Windows 9x CD (\admin\nettools\netmon). There is a readme -file located with the netmon driver files on the CD if you need -information on how to do this. Copy the files from a working -Netmon installation. +To install Netmon on Windows 9x/Me, install the Network Monitor Agent +from the Windows 9x/Me CD (\admin\nettools\netmon). +There is a readme file located with the Netmon driver files on the CD if you need +information on how to do this. Copy the files from a working Netmon installation. @@ -204,86 +201,90 @@ Netmon installation. -Getting help from the mailing lists +Getting Mailing List Help -There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror -and then click on Support and then click on -Samba related mailing lists. +and then click on Support and next click on +Samba-related mailing lists. -For questions relating to Samba TNG go to -http://www.samba-tng.org/ -It has been requested that you don't post questions about Samba-TNG to the -main stream Samba lists. - +For questions relating to Samba TNG, go to +http://www.samba-tng.org/. +It has been requested that you do not post questions about Samba-TNG to the +main-stream Samba lists. + -If you post a message to one of the lists please observe the following guide lines : +If you do post a message to one of the lists, please observe the following guidelines : -Always remember that the developers are volunteers, they are -not paid and they never guarantee to produce a particular feature at -a particular time. Any time lines are 'best guess' and nothing more. - - -Always mention what version of samba you are using and what -operating system its running under. You should probably list the -relevant sections of your &smb.conf; file, at least the options -in [global] that affect PDC support. - -In addition to the version, if you obtained Samba via -CVS mention the date when you last checked it out. - - Try and make your question clear and brief, lots of long, -convoluted questions get deleted before they are completely read ! -Don't post html encoded messages (if you can select colour or font -size its html). - - If you run one of those nifty 'I'm on holidays' things when -you are away, make sure its configured to not answer mailing lists. - - - Don't cross post. Work out which is the best list to post to -and see what happens, i.e. don't post to both samba-ntdom and samba-technical. -Many people active on the lists subscribe to more -than one list and get annoyed to see the same message two or more times. -Often someone will see a message and thinking it would be better dealt -with on another, will forward it on for you. - -You might include partial -log files written at a debug level set to as much as 20. -Please don't send the entire log but enough to give the context of the -error messages. - -(Possibly) If you have a complete netmon trace ( from the opening of -the pipe to the error ) you can send the *.CAP file as well. - -Please think carefully before attaching a document to an email. -Consider pasting the relevant parts into the body of the message. The samba -mailing lists go to a huge number of people, do they all need a copy of your -smb.conf in their attach directory? + Always remember that the developers are volunteers, they are + not paid and they never guarantee to produce a particular feature at + a particular time. Any timelines are best guess and nothing more. + + + Always mention what version of Samba you are using and what + operating system it's running under. You should list the relevant sections of + your &smb.conf; file, at least the options in [global] + that affect PDC support. + + + In addition to the version, if you obtained Samba via + CVS, mention the date when you last checked it out. + + Try and make your questions clear and brief. Lots of long, + convoluted questions get deleted before they are completely read! + Do not post HTML encoded messages. Most people on mailing lists simply delete + them. + + + If you run one of those nifty I'm on holidays things when + you are away, make sure its configured to not answer mailing list traffic. Auto-responses + to mailing lists really irritate the thousands of people who end up having to deal + with such bad netiquet bahavior. + + + Don't cross post. Work out which is the best list to post to + and see what happens. Do not post to both samba-ntdom and samba-technical. + Many people active on the lists subscribe to more + than one list and get annoyed to see the same message two or more times. + Often someone will see a message and thinking it would be better dealt + with on another list, will forward it on for you. + + You might include partial + log files written at a debug level set to as much as 20. + Please do not send the entire log but just enough to give the context of the + error messages. + + If you have a complete Netmon trace (from the opening of + the pipe to the error), you can send the *.CAP file as well. + ` + Please think carefully before attaching a document to an email. + Consider pasting the relevant parts into the body of the message. The Samba + mailing lists go to a huge number of people. Do they all need a copy of your + &smb.conf; in their attach directory? -How to get off the mailing lists +How to Get Off the Mailing Lists -To have your name removed from a samba mailing list, go to the -same place you went to to get on it. Go to http://lists.samba.org, -click on your nearest mirror and then click on Support and -then click on Samba related mailing lists. +To have your name removed from a Samba mailing list, go to the same +place where you went to +subscribe to it. Go to http://lists.samba.org, +click on your nearest mirror, click on Support and +then click on Samba related mailing lists. -Please don't post messages to the list asking to be removed, you will just -be referred to the above address (unless that process failed in some way...) +Please do not post messages to the list asking to be removed. You will only +be referred to the above address (unless that process failed in some way). diff --git a/docs/docbook/projdoc/ProfileMgmt.xml b/docs/docbook/projdoc/ProfileMgmt.xml index 37ae2d41e8..7171884410 100644 --- a/docs/docbook/projdoc/ProfileMgmt.xml +++ b/docs/docbook/projdoc/ProfileMgmt.xml @@ -10,22 +10,22 @@ Features and Benefits -Roaming Profiles are feared by some, hated by a few, loved by many, and a Godsend for +Roaming profiles are feared by some, hated by a few, loved by many, and a Godsend for some administrators. -Roaming Profiles allow an administrator to make available a consistent user desktop +Roaming profiles allow an administrator to make available a consistent user desktop as the user moves from one machine to another. This chapter provides much information -regarding how to configure and manage Roaming Profiles. +regarding how to configure and manage roaming profiles. -While Roaming Profiles might sound like nirvana to some, they are a real and tangible +While roaming profiles might sound like nirvana to some, they are a real and tangible problem to others. In particular, users of mobile computing tools, where often there may not -be a sustained network connection, are often better served by purely Local Profiles. -This chapter provides information to help the Samba administrator to deal with those -situations also. +be a sustained network connection, are often better served by purely local profiles. +This chapter provides information to help the Samba administrator deal with those +situations. @@ -35,25 +35,25 @@ situations also. -Roaming profiles support is different for Win9x / Me and Windows NT4/200x. +Roaming profiles support is different for Windows 9x/Me and Windows NT4/200x. Before discussing how to configure roaming profiles, it is useful to see how -Windows 9x / Me and Windows NT4/200x clients implement these features. +Windows 9x/Me and Windows NT4/200x clients implement these features. -Windows 9x / Me clients send a NetUserGetInfo request to the server to get the user's +Windows 9x/Me clients send a NetUserGetInfo request to the server to get the user's profiles location. However, the response does not have room for a separate -profiles location field, only the user's home share. This means that Win9X/Me +profiles location field, only the user's home share. This means that Windows 9x/Me profiles are restricted to being stored in the user's home directory. -Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields, +Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields including a separate field for the location of the user's profiles. @@ -68,8 +68,7 @@ This section documents how to configure Samba for MS Windows client profile supp NT4/200x User Profiles -To support Windows NT4/200x clients, in the [global] section of smb.conf set the -following (for example): +For example, to support Windows NT4/200x clients, set the followoing in the [global] section of the &smb.conf; file: @@ -77,68 +76,66 @@ following (for example): logon path\\profileserver\profileshare\profilepath\%U\moreprofilepath - This is typically implemented like: +This is typically implemented like: logon path\\%L\Profiles\%u -where %L translates to the name of the Samba server and %u translates to the user name +where %L translates to the name of the Samba server and %u translates to the user name. -The default for this option is \\%N\%U\profile, -namely \\sambaserver\username\profile. -The \\N%\%U service is created automatically by the [homes] service. If you are using -a samba server for the profiles, you _must_ make the share specified in the logon path +The default for this option is \\%N\%U\profile, namely \\sambaserver\username\profile. +The \\N%\%U service is created automatically by the [homes] service. If you are using +a Samba server for the profiles, you must make the share that is specified in the logon path browseable. Please refer to the man page for &smb.conf; in respect of the different -semantics of %L and %N, as well as %U and %u. +semantics of %L and %N, as well as %U and %u. -MS Windows NT/2K clients at times do not disconnect a connection to a server -between logons. It is recommended to NOT use the homes -meta-service name as part of the profile share path. +MS Windows NT/200x clients at times do not disconnect a connection to a server between logons. It is recommended +to not use the homes meta-service name as part of the profile share path. -Windows 9x / Me User Profiles +Windows 9x/Me User Profiles - To support Windows 9x / Me clients, you must use the logon home parameter. Samba has -now been fixed so that net use /home now works as well, and it, too, relies +To support Windows 9x/Me clients, you must use the logon home +parameter. Samba has been fixed so net use /home now works as well and it, too, relies on the logon home parameter. -By using the logon home parameter, you are restricted to putting Win9x / Me -profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your &smb.conf; file: +By using the logon home parameter, you are restricted to putting Windows 9x/Me profiles in the user's home +directory. But wait! There is a trick you can use. If you set the following in the +[global] section of your &smb.conf; file: logon home\\%L\%U\.profiles -then your Windows 9x / Me clients will dutifully put their clients in a subdirectory -of your home directory called .profiles (thus making them hidden). +then your Windows 9x/Me clients will dutifully put their clients in a subdirectory +of your home directory called .profiles (making them hidden). -Not only that, but net use /home will also work, because of a feature in -Windows 9x / Me. It removes any directory stuff off the end of the home directory area +Not only that, but net use /home will also work because of a feature in +Windows 9x/Me. It removes any directory stuff off the end of the home directory area and only uses the server and share portion. That is, it looks like you specified \\%L\%U for logon home. -Mixed Windows 9x / Me and Windows NT4/200x User Profiles +Mixed Windows 9x/Me and Windows NT4/200x User Profiles -You can support profiles for both Win9X and WinNT clients by setting both the +You can support profiles for Windows 9x and Windows NT clients by setting both the logon home and logon path parameters. For example: @@ -152,250 +149,205 @@ You can support profiles for both Win9X and WinNT clients by setting both the Disabling Roaming Profile Support - A question often asked is How may I enforce use of local profiles? or - How do I disable Roaming Profiles? +A question often asked is: How may I enforce use of local profiles? or +How do I disable roaming profiles? +roaming profiles There are three ways of doing this: +windows registry settingsroaming profiles + In &smb.conf; - Affect the following settings and ALL clients - will be forced to use a local profile: - - logon home - logon path - + Affect the following settings and ALL clients will be forced to use a local profile: + logon home and logon path - MS Windows Registry: + MS Windows Registry - By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This of course modifies registry settings. The full path to the option is: - - - - Local Computer Policy\ - Computer Configuration\ - Administrative Templates\ - System\ - User Profiles\ - - Disable: Only Allow Local User Profiles - Disable: Prevent Roaming Profile Change from Propagating to the Server - - + By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP + machine to use only a local profile. This, of course, modifies registry settings. The full + path to the option is: + +Local Computer Policy\ + Computer Configuration\ + Administrative Templates\ + System\ + User Profiles\ + +Disable: Only Allow Local User Profiles +Disable: Prevent Roaming Profile Change from Propagating to the Server + + Change of Profile Type: - - From the start menu right click on the - My Computer icon, select Properties, click on the User Profiles - tab, select the profile you wish to change from Roaming type to Local, click Change Type. + From the start menu right-click on My Computer icon, + select Properties, click on the User Profiles + tab, select the profile you wish to change from + Roaming type to Local, and click on + Change Type. -Consult the MS Windows registry guide for your particular MS Windows version for more -information about which registry keys to change to enforce use of only local user -profiles. +Consult the MS Windows registry guide for your particular MS Windows version for more information +about which registry keys to change to enforce use of only local user profiles. The specifics of how to convert a local profile to a roaming profile, or a roaming profile -to a local one vary according to the version of MS Windows you are running. Consult the -Microsoft MS Windows Resource Kit for your version of Windows for specific information. +to a local one vary according to the version of MS Windows you are running. Consult the Microsoft MS +Windows Resource Kit for your version of Windows for specific information. - - + - -Windows Client Profile Configuration Information + Windows Client Profile Configuration Information - -Windows 9x / Me Profile Setup + Windows 9x/Me Profile Setup -When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders Start Menu, Desktop, -Programs and Nethood. -These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options preserve caseyes, short preserve caseyes and -case sensitiveno in order to maintain capital letters in shortcuts -in any of the profile folders. +When a user first logs in on Windows 9X, the file user.DAT is created, as are folders +Start Menu, Desktop, Programs, and +Nethood. These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, taking the +most recent from each. You will need to use the [global] options +preserve caseyes, +short preserve caseyes and +case sensitiveno +in order to maintain capital letters in shortcuts in any of the profile folders. -The user.DAT file contains all the user's preferences. If you wish to -enforce a set of preferences, rename their user.DAT file to user.MAN, -and deny them write access to this file. +The user.DAT file contains all the user's preferences. If you wish to enforce a set of preferences, +rename their user.DAT file to user.MAN, and deny them write access to this file. - - - On the Windows 9x / Me machine, go to Control Panel -> Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer - to reboot. - - - - - - On the Windows 9x / Me machine, go to Control Panel -> Network -> - Client for Microsoft Networks -> Preferences. Select Log on to - NT Domain. Then, ensure that the Primary Logon is Client for - Microsoft Networks. Press OK, and this time allow the computer - to reboot. - - + + On the Windows 9x/Me machine, go to Control Panel -> + Passwords and select the User Profiles tab. + Select the required level of roaming preferences. Press OK, but do not + allow the computer to reboot. + + + + On the Windows 9x/Me machine, go to Control Panel -> + Network -> Client for Microsoft Networks + -> Preferences. Select Log on to NT Domain. Then, + ensure that the Primary Logon is Client for Microsoft Networks. Press + OK, and this time allow the computer to reboot. + - -Under Windows 9x / Me Profiles are downloaded from the Primary Logon. -If you have the Primary Logon as 'Client for Novell Networks', then -the profiles and logon script will be downloaded from your Novell -Server. If you have the Primary Logon as 'Windows Logon', then the -profiles will be loaded from the local machine - a bit against the -concept of roaming profiles, it would seem! - + Under Windows 9x/ME, profiles are downloaded from the Primary Logon. If you have the Primary Logon +as Client for Novell Networks, then the profiles and logon script will be downloaded from +your Novell Server. If you have the Primary Logon as Windows Logon, then the profiles will +be loaded from the local machine &smbmdash; a bit against the concept of roaming profiles, it would seem! -You will now find that the Microsoft Networks Login box contains -[user, password, domain] instead of just [user, password]. Type in -the samba server's domain name (or any other domain known to exist, -but bear in mind that the user will be authenticated against this -domain and profiles downloaded from it, if that domain logon server -supports it), user name and user's password. +You will now find that the Microsoft Networks Login box contains [user, password, domain] instead +of just [user, password]. Type in the Samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this domain and profiles downloaded from it, +if that domain logon server supports it), user name and user's password. - -Once the user has been successfully validated, the Windows 9x / Me machine -will inform you that The user has not logged on before and asks you -Do you wish to save the user's preferences?. Select yes. - + Once the user has been successfully validated, the Windows 9x/Me machine will inform you that +The user has not logged on before and asks you Do you +wish to save the user's preferences? Select Yes. - -Once the Windows 9x / Me client comes up with the desktop, you should be able -to examine the contents of the directory specified in the logon path -on the samba server and verify that the Desktop, Start Menu, -Programs and Nethood folders have been created. - + Once the Windows 9x/Me client comes up with the desktop, you should be able to examine the +contents of the directory specified in the logon path on +the Samba server and verify that the Desktop, Start Menu, +Programs and Nethood folders have been created. - -These folders will be cached locally on the client, and updated when -the user logs off (if you haven't made them read-only by then). -You will find that if the user creates further folders or short-cuts, -that the client will merge the profile contents downloaded with the -contents of the profile directory already on the local client, taking -the newest folders and short-cuts from each set. - + These folders will be cached locally on the client, and updated when the user logs off (if +you haven't made them read-only by then). You will find that if the user creates further folders or +shortcut, that the client will merge the profile contents downloaded with the contents of the profile +directory already on the local client, taking the newest folders and shortcut from each set. - -If you have made the folders / files read-only on the samba server, -then you will get errors from the Windows 9x / Me machine on logon and logout, as -it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the Windows 9x / Me machine, check the UNIX file -permissions and ownership rights on the profile directory contents, -on the samba server. - + If you have made the folders/files read-only on the Samba server, then you will get errors from +the Windows 9x/Me machine on logon and logout as it attempts to merge the local and remote profile. +Basically, if you have any errors reported by the Windows 9x/Me machine, check the UNIX file permissions +and ownership rights on the profile directory contents, on the Samba server. - -If you have problems creating user profiles, you can reset the user's -local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time". - - - - - Before deleting the contents of the - directory listed in the ProfilePath (this is likely to be - c:\windows\profiles\username), ask them if they - have any important files stored on their desktop or in their start menu. - Delete the contents of the directory ProfilePath (making a backup if any - of the files are needed). - + If you have problems creating user profiles, you can reset the user's local desktop cache, as +shown below. When this user next logs in, the user will be told that he/she is logging in for + the first time. + +windows registry settingsprofile path + - - This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. - - + + + Instead of logging in under the [user, password, domain] dialog, press escape. + + + Run the regedit.exe program, and look in: + - - - - instead of logging in under the [user, password, domain] dialog, - press escape. - - - - - - run the regedit.exe program, and look in: - - - - HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList - - - - you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. - - - [Exit the registry editor]. - - - - - search for the user's .PWL password-caching file in the c:\windows - directory, and delete it. - - - - - - log off the windows 9x / Me client. - - - - - - check the contents of the profile path (see logon path described - above), and delete the user.DAT or user.MAN file for the user, - making a backup if required. - - + + HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList + + + You will find an entry for each user of ProfilePath. Note the contents of this key + (likely to be c:\windows\profiles\username), then delete the key + ProfilePath for the required user. + + + + Exit the registry editor. + + + + Search for the user's .PWL password-caching file in the c:\windows directory, and delete it. + + + + Log off the Windows 9x/Me client. + + + + Check the contents of the profile path (see logon path + described above) and delete the user.DAT or user.MAN + file for the user, making a backup if required. + - -If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as ethereal or netmon.exe, and -look for error messages. + +Before deleting the contents of the directory listed in the ProfilePath +(this is likely to be c:\windows\profiles\username), ask the owner if they have +any important files stored on their desktop or in their start menu. Delete the contents of the +directory ProfilePath (making a backup if any of the files are needed). -If you have access to an Windows NT4/200x server, then first set up roaming profiles -and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine -the example packet traces provided with Windows NT4/200x server, and see what the -differences are with the equivalent samba trace. +This will have the effect of removing the local (read-only hidden system file) user.DAT +in their profile directory, as well as the local desktop, nethood, +start menu, and programs folders. + + + +If all else fails, increase Samba's debug log levels to between 3 and 10, and/or run a packet +sniffer program such as ethereal or netmon.exe, and look for error messages. + + + If you have access to an Windows NT4/200x server, then first set up roaming profiles and/or +netlogons on the Windows NT4/200x server. Make a packet trace, or examine the example packet traces +provided with Windows NT4/200x server, and see what the differences are with the equivalent Samba trace. @@ -403,272 +355,206 @@ differences are with the equivalent samba trace. Windows NT4 Workstation - -When a user first logs in to a Windows NT Workstation, the profile -NTuser.DAT is created. The profile location can be now specified -through the logon path parameter. + When a user first logs in to a Windows NT Workstation, the profile NTuser.DAT is created. The profile +location can be now specified through the logon path parameter. - -There is a parameter that is now available for use with NT Profiles: -logon drive. This should be set to H: or any other drive, and -should be used in conjunction with the new logon home parameter. - + There is a parameter that is now available for use with NT Profiles: logon drive. +This should be set to H: or any other drive, and should be used in conjunction with +the new logon home parameter. - -The entry for the NT4 profile is a _directory_ not a file. The NT -help on profiles mentions that a directory is also created with a .PDS -extension. The user, while logging in, must have write permission to -create the full profile path (and the folder with the .PDS extension -for those situations where it might be created.) - + The entry for the NT4 profile is a directory not a file. The NT help on Profiles mentions that a +directory is also created with a .PDS extension. The user, while logging in, must have write permission +to create the full profile path (and the folder with the .PDS extension for those situations where it +might be created.) - -In the profile directory, Windows NT4 creates more folders than Windows 9x / Me. -It creates Application Data and others, as well as Desktop, Nethood, -Start Menu and Programs. The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and -its purpose is currently unknown. - + In the profile directory, Windows NT4 creates more folders than Windows 9x/Me. It creates +Application Data and others, as well as Desktop, +Nethood, Start Menu, and Programs. +The profile itself is stored in a file NTuser.DAT. Nothing appears to be stored +in the .PDS directory, and its purpose is currently unknown. - -You can use the System Control Panel to copy a local profile onto -a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN -turns a profile into a mandatory one. + You can use the System Control Panel to copy a local profile onto +a Samba server (see NT Help on Profiles; it is also capable of firing up the correct location in the +System Control Panel for you). The NT Help file also mentions that renaming +NTuser.DAT to NTuser.MAN turns a profile into a mandatory one. - -The case of the profile is significant. The file must be called -NTuser.DAT or, for a mandatory profile, NTuser.MAN. - - + The case of the profile is significant. The file must be called NTuser.DAT +or, for a mandatory profile, NTuser.MAN. - -Windows 2000/XP Professional + Windows 2000/XP Professional - -You must first convert the profile from a local profile to a domain -profile on the MS Windows workstation as follows: - + You must first convert the profile from a local profile to a domain profile on the MS Windows +workstation as follows: - - Log on as the LOCAL workstation administrator. - - - - Right click on the My Computer Icon, select Properties - - - - Click on the User Profiles tab - - - - Select the profile you wish to convert (click on it once) - - - - Click on the button Copy To - - - - In the Permitted to use box, click on the Change button. - - - - Click on the 'Look in" area that lists the machine name, when you click - here it will open up a selection box. Click on the domain to which the - profile must be accessible. - + Log on as the local workstation administrator. + + Right-click on the My Computer Icon, select + Properties. + + Click on the User Profiles tab. + + Select the profile you wish to convert (click it once). + + Click on the Copy To button. + + In the Permitted to use box, click on the + Change button. - You will need to log on if a logon box opens up. Eg: In the connect as: DOMAIN\root, password: mypassword. - + Click on the Look in area that lists the machine name. When you click here, it will + open up a selection box. Click on the domain to which the profile must be accessible. - - To make the profile capable of being used by anyone select 'Everyone' - + You will need to log on if a logon box opens up. + For example, connect as DOMAIN\root, password: + mypassword. - - Click OK. The Selection box will close. - + To make the profile capable of being used by anyone, select Everyone. - - Now click on the Ok button to create the profile in the path you - nominated. - + Click on OK and the Selection box will close. + + Now click on OK to create the profile in the path + you nominated. - -Done. You now have a profile that can be edited using the samba -profiles tool. + Done. You now have a profile that can be edited using the Samba profiles tool. - - -Under NT/2K the use of mandatory profiles forces the use of MS Exchange -storage of mail data. That keeps desktop profiles usable. - - + +Under Windows NT/200x, the use of mandatory profiles forces the use of MS Exchange storage of mail +data and keeps it out of the desktop profile. That keeps desktop profiles from becoming unusable. + - - Windows XP Service Pack 1 - -This is a security check new to Windows XP (or maybe only -Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is: - -Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders - -...and it should be set to Enabled. -Does the new version of samba have an Active Directory analogue? If so, -then you may be able to set the policy through this. - + +Windows XP Service Pack 1 + + There is a security check new to Windows XP (or maybe only Windows XP service pack 1). + It can be disabled via a group policy in the Active Directory. The policy is called: + - -If you cannot set group policies in samba, then you may be able to set -the policy locally on each machine. If you want to try this, then do -the following (N.B. I don't know for sure that this will work in the -same way as a domain group policy): - + + Computer Configuration\Administrative Templates\System\User Profiles\Do not check for + user ownership of Roaming Profile Foldersi + + + + This should be set to Enabled. + - + + Does the new version of Samba have an Active Directory analogue? If so, then you may be able to set the policy through this. + - -On the XP workstation log in with an Administrator account. - + If you cannot set group policies in Samba, then you may be able to set the policy locally on + each machine. If you want to try this, then do the following (N.B. I do not know for sure that this + will work in the same way as a domain group policy): + - Click: Start, Run - Type: mmc - Click: OK + + On the XP workstation, log in with an Administrative account. + + Click on Start -> Run. + Type mmc. + Click on OK. A Microsoft Management Console should appear. - Click: File, Add/Remove Snap-in..., Add - Double-Click: Group Policy - Click: Finish, Close - Click: OK - - In the "Console Root" window: - Expand: Local Computer Policy, Computer Configuration, - Administrative Templates, System, User Profiles - Double-Click: Do not check for user ownership of Roaming Profile Folders - Select: Enabled - Click: OK - - Close the whole console. You do not need to save the settings (this - refers to the console settings rather than the policies you have - changed). - - Reboot + Click on File -> Add/Remove Snap-in -> Add. + Double-click on Group Policy. + Click on Finish -> Close. + Click on OK. + In the Console Root window expand Local Computer Policy -> + Computer Configuration -> Administrative Templates -> System -> User Profiles. + Double-click on Do not check for user ownership of Roaming Profile Folders. + Select Enabled. + Click on OK. + Close the whole console. You do not need to save the settings (this refers to the + console settings rather than the policies you have changed). + Reboot. + -Sharing Profiles between W9x/Me and NT4/200x/XP workstations + Sharing Profiles between W9x/Me and NT4/200x/XP <?latex \linebreak ?>Workstations - -Sharing of desktop profiles between Windows versions is NOT recommended. -Desktop profiles are an evolving phenomenon and profiles for later versions -of MS Windows clients add features that may interfere with earlier versions -of MS Windows clients. Probably the more salient reason to NOT mix profiles -is that when logging off an earlier version of MS Windows the older format -of profile contents may overwrite information that belongs to the newer -version resulting in loss of profile information content when that user logs -on again with the newer version of MS Windows. - + Sharing of desktop profiles between Windows versions is not recommended. Desktop profiles are an +evolving phenomenon and profiles for later versions of MS Windows clients add features that may interfere +with earlier versions of MS Windows clients. Probably the more salient reason to not mix profiles is +that when logging off an earlier version of MS Windows, the older format of profile contents may overwrite +information that belongs to the newer version resulting in loss of profile information content when that +user logs on again with the newer version of MS Windows. - -If you then want to share the same Start Menu / Desktop with W9x/Me, you will -need to specify a common location for the profiles. The &smb.conf; parameters -that need to be common are logon path and -logon home. - + If you then want to share the same Start Menu/Desktop with W9x/Me, you will need to specify a common +location for the profiles. The &smb.conf; parameters that need to be common are logon path and logon home. - -If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory. - + If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory. Profile Migration from Windows NT4/200x Server to Samba - -There is nothing to stop you specifying any path that you like for the -location of users' profiles. Therefore, you could specify that the -profile be stored on a samba server, or any other SMB server, as long as -that SMB server supports encrypted passwords. - + There is nothing to stop you from specifying any path that you like for the location of users' profiles. +Therefore, you could specify that the profile be stored on a Samba server, or any other SMB server, +as long as that SMB server supports encrypted passwords. Windows NT4 Profile Management Tools - -Unfortunately, the Resource Kit information is specific to the version of MS Windows -NT4/200x. The correct resource kit is required for each platform. - + Unfortunately, the Resource Kit information is specific to the version of MS Windows NT4/200x. The +correct resource kit is required for each platform. - -Here is a quick guide: - +Here is a quick guide: + On your NT4 Domain Controller, right click on My Computer, then select the + tab labeled User Profiles. - -On your NT4 Domain Controller, right click on My Computer, then -select the tab labelled User Profiles. - + Select a user profile you want to migrate and click on it. - -Select a user profile you want to migrate and click on it. - - -I am using the term "migrate" loosely. You can copy a profile to -create a group profile. You can give the user 'Everyone' rights to the -profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC. - + I am using the term migrate loosely. You can copy a profile to create a group + profile. You can give the user Everyone rights to the profile you copy this to. That + is what you need to do, since your Samba domain is not a member of a trust relationship with your NT4 + PDC. -Click the Copy To button. + Click on the Copy To button. - In the box labelled Copy Profile to add your new path, eg: + In the box labeled Copy Profile to add your new path, e.g., c:\temp\foobar - Click on the button Change in the Permitted to use box. + Click on Change in the Permitted to use box. - Click on the group 'Everyone' and then click OK. This closes the - 'choose user' box. + Click on the group Everyone, click on OK. This + closes the choose user box. - Now click OK. + Now click on OK. - -Follow the above for every profile you need to migrate. - + Follow the above for every profile you need to migrate. -Side bar Notes +Side Bar Notes + -You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page. +SID +You should obtain the SID of your NT4 domain. You can use smbpasswd to do this. Read the man +page. - -moveuser.exe + moveuser.exe + + The Windows 200x professional resource kit has moveuser.exe. moveuser.exe changes the security of a profile +from one user to another. This allows the account domain to change, and/or the user name to change. -The W2K professional resource kit has moveuser.exe. moveuser.exe changes -the security of a profile from one user to another. This allows the account -domain to change, and/or the user name to change. +This command is like the Samba profiles tool. @@ -677,83 +563,61 @@ domain to change, and/or the user name to change. Get SID -You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 -Resource Kit. - +SID +You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 Resource Kit. - -Windows NT 4.0 stores the local profile information in the registry under -the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList - + Windows NT 4.0 stores the local profile information in the registry under the following key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList - -Under the ProfileList key, there will be subkeys named with the SIDs of the -users who have logged on to this computer. (To find the profile information -for the user whose locally cached profile you want to move, find the SID for -the user with the GetSID.exe utility.) Inside of the appropriate user's -subkey, you will see a string value named ProfileImagePath. - + Under the ProfileList key, there will be subkeys named with the SIDs of the users who have logged +on to this computer. (To find the profile information for the user whose locally cached profile you want +to move, find the SID for the user with the GetSID.exe utility.) Inside the appropriate user's subkey, +you will see a string value named ProfileImagePath. - - - + - -Mandatory profiles + Mandatory Profiles -A Mandatory Profile is a profile that the user does NOT have the ability to overwrite. -During the user's session it may be possible to change the desktop environment, but -as the user logs out all changes made will be lost. If it is desired to NOT allow the -user any ability to change the desktop environment then this must be done through -policy settings. See previous chapter. - +mandatory profiles +A Mandatory Profile is a profile that the user does not have the ability to overwrite. During the +user's session, it may be possible to change the desktop environment, however, as the user logs out all changes +made will be lost. If it is desired to not allow the user any ability to change the desktop environment, +then this must be done through policy settings. See the previous chapter. - - -Under NO circumstances should the profile directory (or it's contents) be made read-only -as this may render the profile un-usable. - - + +Under NO circumstances should the profile directory (or its contents) be made read-only +as this may render the profile un-usable. Where it is essential to make a profile read-only +within the UNIX file system, this can be done but then you absolutely must use the fake-permissions +VFS module to instruct MS Windows NT/200x/XP clients that the Profile has write permission for the user. See . + - -For MS Windows NT4/200x/XP the above method can be used to create mandatory profiles -also. To convert a group profile into a mandatory profile simply locate the NTUser.DAT -file in the copied profile and rename it to NTUser.MAN. - + For MS Windows NT4/200x/XP, the above method can also be used to create mandatory profiles. To +convert a group profile into a mandatory profile, simply locate the NTUser.DAT file in the copied profile +and rename it to NTUser.MAN. - -For MS Windows 9x / Me it is the User.DAT file that must be renamed to User.MAN to -affect a mandatory profile. - + For MS Windows 9x/ME, it is the User.DAT file that must be renamed to +User.MAN to effect a mandatory profile. -Creating/Managing Group Profiles +Creating and Managing Group Profiles -Most organisations are arranged into departments. There is a nice benefit in -this fact since usually most users in a department will require the same desktop -applications and the same desktop layout. MS Windows NT4/200x/XP will allow the -use of Group Profiles. A Group Profile is a profile that is created firstly using -a template (example) user. Then using the profile migration tool (see above) the -profile is assigned access rights for the user group that needs to be given access -to the group profile. - +group profiles +Most organizations are arranged into departments. There is a nice benefit in this fact since usually +most users in a department require the same desktop applications and the same desktop layout. MS +Windows NT4/200x/XP will allow the use of Group Profiles. A Group Profile is a profile that is created +first using a template (example) user. Then using the profile migration tool (see above), the profile is +assigned access rights for the user group that needs to be given access to the group profile. - -The next step is rather important. Please note: Instead of assigning a group profile -to users (ie: Using User Manager) on a "per user" basis, the group itself is assigned -the now modified profile. - + The next step is rather important. Instead of assigning a group profile to users (Using User Manager) +on a per user basis, the group itself is assigned the now modified profile. - - Be careful with group profiles, if the user who is a member of a group also - has a personal profile, then the result will be a fusion (merge) of the two. - + Be careful with Group Profiles. If the user who is a member of a group also has a personal +profile, then the result will be a fusion (merge) of the two. @@ -762,175 +626,147 @@ the now modified profile. Default Profile for Windows Users -MS Windows 9x / Me and NT4/200x/XP will use a default profile for any user for whom -a profile does not already exist. Armed with a knowledge of where the default profile -is located on the Windows workstation, and knowing which registry keys affect the path -from which the default profile is created, it is possible to modify the default profile -to one that has been optimised for the site. This has significant administrative -advantages. - +default profile +MS Windows 9x/Me and NT4/200x/XP will use a default profile for any user for whom a profile +does not already exist. Armed with a knowledge of where the default profile is located on the Windows +workstation, and knowing which registry keys effect the path from which the default profile is created, +it is possible to modify the default profile to one that has been optimized for the site. This has +significant administrative advantages. MS Windows 9x/Me - -To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System -Policy Editor or change the registry directly. - + To enable default per use profiles in Windows 9x/ME, you can either use the Windows +98 System Policy Editor or change the registry directly. - -To enable default per user profiles in Windows 9x / Me, launch the System Policy Editor, then -select File -> Open Registry, then click on the -Local Computer icon, click on Windows 98 System, -select User Profiles, click on the enable box. Do not forget to save the registry changes. - + To enable default per user profiles in Windows 9x/ME, launch the System Policy +Editor, then select File -> Open Registry, +next click on the Local Computer icon, click on Windows 98 System, +select User Profiles, and click on the enable box. Remember to save the registry +changes. - -To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive -HKEY_LOCAL_MACHINE\Network\Logon. Now add a DWORD type key with the name -"User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0. - + To modify the registry directly, launch the Registry Editor +(regedit.exe) and select the hive HKEY_LOCAL_MACHINE\Network\Logon. Now +add a DWORD type key with the name User Profiles, to +enable user profiles to set the value +to 1; to disable user profiles set it to 0. -How User Profiles Are Handled in Windows 9x / Me? +User Profile Handling with Windows 9x/Me - -When a user logs on to a Windows 9x / Me machine, the local profile path, + When a user logs on to a Windows 9x/Me machine, the local profile path, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList, is checked -for an existing entry for that user: - +for an existing entry for that user. - -If the user has an entry in this registry location, Windows 9x / Me checks for a locally cached -version of the user profile. Windows 9x / Me also checks the user's home directory (or other -specified directory if the location has been modified) on the server for the User Profile. -If a profile exists in both locations, the newer of the two is used. If the User Profile exists -on the server, but does not exist on the local machine, the profile on the server is downloaded -and used. If the User Profile only exists on the local machine, that copy is used. - + If the user has an entry in this registry location, Windows 9x/Me checks for a locally cached +version of the user profile. Windows 9x/Me also checks the user's home directory (or other specified +directory if the location has been modified) on the server for the User Profile. If a profile exists +in both locations, the newer of the two is used. If the User Profile exists on the server, but does not +exist on the local machine, the profile on the server is downloaded and used. If the User Profile only +exists on the local machine, that copy is used. - -If a User Profile is not found in either location, the Default User Profile from the Windows 9x / Me -machine is used and is copied to a newly created folder for the logged on user. At log off, any -changes that the user made are written to the user's local profile. If the user has a roaming -profile, the changes are written to the user's profile on the server. - + If a User Profile is not found in either location, the Default User Profile from the Windows +9x/Me machine is used and copied to a newly created folder for the logged on user. At log off, any +changes that the user made are written to the user's local profile. If the user has a roaming profile, +the changes are written to the user's profile on the server. - - + MS Windows NT4 Workstation - -On MS Windows NT4 the default user profile is obtained from the location + On MS Windows NT4, the default user profile is obtained from the location %SystemRoot%\Profiles which in a default installation will translate to -C:\WinNT\Profiles. Under this directory on a clean install there will be -three (3) directories: Administrator, All Users, Default User. - +C:\Windows NT\Profiles. Under this directory on a clean install there will be three +(3) directories: Administrator, All +Users, and Default +User. - -The All Users directory contains menu settings that are common across all -system users. The Default User directory contains menu entries that are -customisable per user depending on the profile settings chosen/created. - + The All Users directory contains menu settings that are common across all +system users. The Default User directory contains menu entries that are customizable +per user depending on the profile settings chosen/created. - -When a new user first logs onto an MS Windows NT4 machine a new profile is created from: - + When a new user first logs onto an MS Windows NT4 machine, a new profile is created from: - All Users settings - Default User settings (contains the default NTUser.DAT file) + All Users settings. + Default User settings (contains the default NTUser.DAT file). - -When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain -the following steps are followed in respect of profile handling: - - - - - - The users' account information which is obtained during the logon process contains - the location of the users' desktop profile. The profile path may be local to the - machine or it may be located on a network share. If there exists a profile at the location - of the path from the user account, then this profile is copied to the location - %SystemRoot%\Profiles\%USERNAME%. This profile then inherits the - settings in the All Users profile in the %SystemRoot%\Profiles - location. - - - - - - If the user account has a profile path, but at it's location a profile does not exist, - then a new profile is created in the %SystemRoot%\Profiles\%USERNAME% - directory from reading the Default User profile. - - - - - - If the NETLOGON share on the authenticating server (logon server) contains a policy file - (NTConfig.POL) then it's contents are applied to the NTUser.DAT - which is applied to the HKEY_CURRENT_USER part of the registry. - - - - - - When the user logs out, if the profile is set to be a roaming profile it will be written - out to the location of the profile. The NTuser.DAT file is then - re-created from the contents of the HKEY_CURRENT_USER contents. - Thus, should there not exist in the NETLOGON share an NTConfig.POL at the - next logon, the effect of the previous NTConfig.POL will still be held - in the profile. The effect of this is known as tatooing. - - - + When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain, + the following steps are followed in respect of profile handling: - -MS Windows NT4 profiles may be Local or Roaming. A Local profile -will stored in the %SystemRoot%\Profiles\%USERNAME% location. A roaming profile will -also remain stored in the same way, unless the following registry key is created: +NTConfig.POL - - -HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\ -winlogon\"DeleteRoamingCache"=dword:00000001 - -In which case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be -deleted on logout. - - - -Under MS Windows NT4 default locations for common resources (like My Documents -may be redirected to a network share by modifying the following registry keys. These changes may be affected -via use of the System Policy Editor (to do so may require that you create your owns template extension -for the policy editor to allow this to be done through the GUI. Another way to do this is by way of first -creating a default user profile, then while logged in as that user, run regedt32 to edit the key settings. - - - -The Registry Hive key that affects the behaviour of folders that are part of the default user profile -are controlled by entries on Windows NT4 is: - - - -HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\ - - - -The above hive key contains a list of automatically managed folders. The default entries are: - + + The users' account information that is obtained during the logon process + contains the location of the users' desktop profile. The profile path may be local to + the machine or it may be located on a network share. If there exists a profile at the + location of the path from the user account, then this profile is copied to the location + %SystemRoot%\Profiles\%USERNAME%. This profile then inherits the settings + in the All Users profile in the %SystemRoot%\Profiles + location. + + If the user account has a profile path, but at its location a profile does not + exist, then a new profile is created in the %SystemRoot%\Profiles\%USERNAME% + directory from reading the Default User profile. + + If the NETLOGON share on the authenticating server (logon server) contains + a policy file (NTConfig.POL), then its contents are applied to the + NTUser.DAT which is applied to the HKEY_CURRENT_USER + part of the registry. + + + When the user logs out, if the profile is set to be a roaming profile it will be + written out to the location of the profile. The NTuser.DAT file is then + recreated from the contents of the HKEY_CURRENT_USER contents. Thus, + should there not exist in the NETLOGON share an NTConfig.POL at the next + logon, the effect of the previous NTConfig.POL will still be held in the + profile. The effect of this is known as tattooing. + + - -
    - User Shell Folder registry keys default values + MS Windows NT4 profiles may be local or roaming. A local +profile will stored in the %SystemRoot%\Profiles\%USERNAME% location. A roaming +profile will also remain stored in the same way, unless the following registry key is created as shown: + + HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\ +winlogon\"DeleteRoamingCache"=dword:0000000 + +In this case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be deleted +on logout. + + Under MS Windows NT4, default locations for common resources like My Documents +may be redirected to a network share by modifying the following registry keys. These changes may be +affected via use of the System Policy Editor. To do so may require that you create your own template +extension for the policy editor to allow this to be done through the GUI. Another way to do this is by +way of first creating a default user profile, then while logged in as that user, run regedt32 to edit +the key settings. + + +The Registry Hive key that affects the behavior of folders that are part of the default user +profile are controlled by entries on Windows NT4 is: + +HKEY_CURRENT_USER + \Software + \Microsoft + \Windows + \CurrentVersion + \Explorer + \User Shell Folders + +windows registry settingsdefault profile locations + + + The above hive key contains a list of automatically managed folders. The default entries are shown in . + +
    + User Shell Folder Registry Keys Default Values + + NameDefault Value @@ -948,22 +784,19 @@ The above hive key contains a list of automatically managed folders. The default
    -     - -The registry key that contains the location of the default profile settings is: - + The registry key that contains the location of the default profile settings is: - -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ +User Shell Folders - -The default entries are: + The default entries are shown in . - - Defaults of profile settings registry keys +
    + Defaults of Profile Settings Registry Keys + + Common Desktop%SystemRoot%\Profiles\All Users\DesktopCommon Programs%SystemRoot%\Profiles\All Users\Programs @@ -972,104 +805,78 @@ The default entries are:
    -         - -MS Windows 200x/XP + MS Windows 200x/XP - - - MS Windows XP Home Edition does use default per user profiles, but can not participate - in domain security, can not log onto an NT/ADS style domain, and thus can obtain the profile - only from itself. While there are benefits in doing this the beauty of those MS Windows - clients that CAN participate in domain logon processes allows the administrator to create - a global default profile and to enforce it through the use of Group Policy Objects (GPOs). - - + +GPOs +MS Windows XP Home Edition does use default per user profiles, but cannot participate +in domain security, cannot log onto an NT/ADS-style domain, and thus can obtain the profile only +from itself. While there are benefits in doing this, the beauty of those MS Windows clients that +can participate in domain logon processes allows the administrator to create a global default +profile and enforce it through the use of Group Policy Objects (GPOs). + - -When a new user first logs onto MS Windows 200x/XP machine the default profile is obtained from -C:\Documents and Settings\Default User. The administrator can modify (or change -the contents of this location and MS Windows 200x/XP will gladly use it. This is far from the optimum -arrangement since it will involve copying a new default profile to every MS Windows 200x/XP client -workstation. - + When a new user first logs onto an MS Windows 200x/XP machine, the default profile is obtained from +C:\Documents and Settings\Default User. The administrator can modify or change the +contents of this location and MS Windows 200x/XP will gladly use it. This is far from the optimum arrangement +since it will involve copying a new default profile to every MS Windows 200x/XP client workstation. - -When MS Windows 200x/XP participate in a domain security context, and if the default user -profile is not found, then the client will search for a default profile in the NETLOGON share -of the authenticating server. ie: In MS Windows parlance: -%LOGONSERVER%\NETLOGON\Default User and if one exits there it will copy this -to the workstation to the C:\Documents and Settings\ under the Windows -login name of the user. - + When MS Windows 200x/XP participates in a domain security context, and if the default user profile is + not found, then the client will search for a default profile in the NETLOGON share of the authenticating + server. In MS Windows parlance,%LOGONSERVER%\NETLOGON\Default User, and if one +exists there it will copy this to the workstation to the C:\Documents and Settings\ +under the Windows login name of the user. - - - This path translates, in Samba parlance, to the &smb.conf; [NETLOGON] share. The directory - should be created at the root of this share and must be called Default Profile. - - + This path translates, in Samba parlance, to the &smb.conf; +[NETLOGON] share. The directory should be created at the root +of this share and must be called Default Profile. - -If a default profile does not exist in this location then MS Windows 200x/XP will use the local -default profile. - + If a default profile does not exist in this location, then MS Windows 200x/XP will use the local +default profile. - -On logging out, the users' desktop profile will be stored to the location specified in the registry -settings that pertain to the user. If no specific policies have been created, or passed to the client -during the login process (as Samba does automatically), then the user's profile will be written to -the local machine only under the path C:\Documents and Settings\%USERNAME%. - + On logging out, the users' desktop profile will be stored to the location specified in the registry +settings that pertain to the user. If no specific policies have been created or passed to the client +during the login process (as Samba does automatically), then the user's profile will be written to the +local machine only under the path C:\Documents and Settings\%USERNAME%. - -Those wishing to modify the default behaviour can do so through three methods: - + Those wishing to modify the default behavior can do so through these three methods: - - - Modify the registry keys on the local machine manually and place the new default profile in the - NETLOGON share root - NOT recommended as it is maintenance intensive. - - + Modify the registry keys on the local machine manually and place the new + default profile in the NETLOGON share root. This is not recommended as it is maintenance intensive. + - - - Create an NT4 style NTConfig.POL file that specified this behaviour and locate this file - in the root of the NETLOGON share along with the new default profile. - - + Create an NT4-style NTConfig.POL file that specified this behavior and locate + this file in the root of the NETLOGON share along with the new default profile. - - - Create a GPO that enforces this through Active Directory, and place the new default profile - in the NETLOGON share. - - + Create a GPO that enforces this through Active Directory, and place the new + default profile in the NETLOGON share. - -The Registry Hive key that affects the behaviour of folders that are part of the default user profile -are controlled by entries on Windows 200x/XP is: - +The registry hive key that effects the behavior of folders that are part of the default user +profile are controlled by entries on Windows 200x/XP is: - -HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\ - + HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell +Folders\ -The above hive key contains a list of automatically managed folders. The default entries are: +The above hive key contains a list of automatically managed folders. The default entries are shown +in +windows registry settingsdefault profile locations - - - Defaults of default user profile paths registry keys + +
    + Defaults of Default User Profile Paths Registry Keys - NameDefault Value + + + + NameDefault Value + AppData%USERPROFILE%\Application DataCache%USERPROFILE%\Local Settings\Temporary Internet Files @@ -1089,227 +896,171 @@ The above hive key contains a list of automatically managed folders. The default Start Menu%USERPROFILE%\Start MenuStartup%USERPROFILE%\Start Menu\Programs\StartupTemplates%USERPROFILE%\Templates -
    -     + + + - -There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all -the others are of type REG_EXPAND_SZ. - + There is also an entry called Default that has no value set. The default entry is +of type REG_SZ, all the others are of type REG_EXPAND_SZ. - -It makes a huge difference to the speed of handling roaming user profiles if all the folders are -stored on a dedicated location on a network server. This means that it will NOT be necessary to -write the Outlook PST file over the network for every login and logout. - + It makes a huge difference to the speed of handling roaming user profiles if all the folders are +stored on a dedicated location on a network server. This means that it will not be necessary to write +the Outlook PST file over the network for every login and logout. - -To set this to a network location you could use the following examples: - + To set this to a network location, you could use the following examples: %LOGONSERVER%\%USERNAME%\Default Folders - -This would store the folders in the user's home directory under a directory called Default Folders -You could also use: - + This would store the folders in the user's home directory under a directory called Default +Folders. You could also use: \\SambaServer\FolderShare\%USERNAME% - in which case the default folders will be stored in the server named SambaServer -in the share called FolderShare under a directory that has the name of the MS Windows -user as seen by the Linux/UNIX file system. - +in which case the default folders will be stored in the server named SambaServer +in the share called FolderShare under a directory that has the name of the +MS Windows user as seen by the Linux/UNIX file system. - -Please note that once you have created a default profile share, you MUST migrate a user's profile -(default or custom) to it. - + Please note that once you have created a default profile share, you MUST migrate a user's profile +(default or custom) to it. - -MS Windows 200x/XP profiles may be Local or Roaming. -A roaming profile will be cached locally unless the following registry key is created: + MS Windows 200x/XP profiles may be Local or Roaming. + A roaming profile will be cached locally unless the following registry key is created: + +delete roaming profiles - - -HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\ + + HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\ winlogon\"DeleteRoamingCache"=dword:00000001 -In which case, the local cache copy will be deleted on logout. - -     +In this case, the local cache copy will be deleted on logout. + +     - -Common Errors + Common Errors -The following are some typical errors/problems/questions that have been asked. +The following are some typical errors, problems and questions that have been asked on the Samba mailing lists. -Setting up roaming profiles for just a few user's or group's? +Configuring Roaming Profiles for a Few Users or Groups -With samba-2.2.x the choice you have is to enable or disable roaming -profiles support. It is a global only setting. The default is to have -roaming profiles and the default path will locate them in the user's home -directory. +With Samba-2.2.x, the choice you have is to enable or disable roaming profiles support. It is a +global only setting. The default is to have roaming profiles and the default path will locate them in +the user's home directory. -If disabled globally then no-one will have roaming profile ability. -If enabled and you want it to apply only to certain machines, then on -those machines on which roaming profile support is NOT wanted it is then -necessary to disable roaming profile handling in the registry of each such -machine. +If disabled globally, then no one will have roaming profile ability. If enabled and you want it +to apply only to certain machines, then on those machines on which roaming profile support is not wanted +it is then necessary to disable roaming profile handling in the registry of each such machine. -With samba-3 you can have a global profile -setting in &smb.conf; _AND_ you can over-ride this by per-user settings -using the Domain User Manager (as with MS Windows NT4/ Win 2Kx). - +With Samba-3, you can have a global profile setting in &smb.conf; and you can override this by +per-user settings using the Domain User Manager (as with MS Windows NT4/ Win 200xx). - -In any case, you can configure only one profile per user. That profile can -be either: - + In any case, you can configure only one profile per user. That profile can be either: - A profile unique to that user - A mandatory profile (one the user can not change) - A group profile (really should be mandatory ie:unchangable) + A profile unique to that user. + A mandatory profile (one the user cannot change). + A group profile (really should be mandatory, that is unchangable). - -Can NOT use Roaming Profiles + Cannot Use Roaming Profiles - -A user requested the following: - -I do not want Roaming profiles to be implemented. I want to give users a local profile alone. ... -Please help me I am totally lost with this error. For the past two days I tried everything, I googled -around but found no useful pointers. Please help me. - + A user requested the following: I do not want Roaming profiles to be implemented. I want +to give users a local profile alone. Please help me, I am totally lost with this error. For the past +two days I tried everything, I googled around but found no useful pointers. Please help me. - -The choices are: - + The choices are: - Local profiles: - - I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out - + Local profiles I know of no registry keys that will allow + auto-deletion of LOCAL profiles on log out. - + - Roaming profiles: - - As a user logs onto the network a centrally stored profile is copied to the workstation - to form a local profile. This local profile will persist (remain on the workstation disk) - unless a registry key is changed that will cause this profile to be automatically deleted - on logout. - + Roaming profiles As a user logs onto the network, a centrally + stored profile is copied to the workstation to form a local profile. This local profile + will persist (remain on the workstation disk) unless a registry key is changed that will + cause this profile to be automatically deleted on logout. - -The Roaming Profile choices are: - +The roaming profile choices are: - Personal Roaming profiles - - These are typically stored in a profile share on a central (or conveniently located - local) server. - + Personal roaming profiles These are typically stored in + a profile share on a central (or conveniently located local) server. - - Workstations 'cache' (store) a local copy of the profile. This cached copy is used when - the profile can not be downloaded at next logon. - + Workstations cache (store) a local copy of the profile. This cached + copy is used when the profile cannot be downloaded at next logon. - Group profiles - These are loaded from a central profile server + Group profiles These are loaded from a central profile + server. - Mandatory profiles - - Mandatory profiles can be created for a user as well as for any group that a user - is a member of. Mandatory profiles can NOT be changed by ordinary users. Only the administrator - can change or reconfigure a mandatory profile. - + Mandatory profiles Mandatory profiles can be created for + a user as well as for any group that a user is a member of. Mandatory profiles cannot be + changed by ordinary users. Only the administrator can change or reconfigure a mandatory + profile. - -A WinNT4/2K/XP profile can vary in size from 130KB to off the scale. -Outlook PST files are most often part of the profile and can be many GB in -size. On average (in a well controlled environment) roaming profile size of -2MB is a good rule of thumb to use for planning purposes. In an -undisciplined environment I have seen up to 2GB profiles. Users tend to -complain when it take an hour to log onto a workstation but they harvest -the fruits of folly (and ignorance). - + A Windows NT4/200x/XP profile can vary in size from 130KB to very large. Outlook PST files are +most often part of the profile and can be many GB in size. On average (in a well controlled environment), +roaming profile size of 2MB is a good rule of thumb to use for planning purposes. In an undisciplined +environment, I have seen up to 2GB profiles. Users tend to complain when it takes an hour to log onto a +workstation but they harvest the fruits of folly (and ignorance). - -The point of all the above is to show that roaming profiles and good -controls of how they can be changed as well as good discipline make up for -a problem free site. - + The point of all the above is to show that roaming profiles and good controls of how they can be +changed as well as good discipline make up for a problem-free site. - -Microsoft's answer to the PST problem is to store all email in an MS -Exchange Server back-end. This removes the need for a PST file. - + Microsoft's answer to the PST problem is to store all email in an MS Exchange Server backend. This +removes the need for a PST file. - -LOCAL profiles mean: - +Local profiles mean: - If each machine is used my many users then much local disk storage is needed for local profiles - Every workstation the user logs into has it's own profile, these can be very different from machine to machine + If each machine is used by many users, then much local disk storage is needed + for local profiles. Every workstation the user logs into has + its own profile; these can be very different from machine to machine. - -On the other hand, use of roaming profiles means: - + On the other hand, use of roaming profiles means: The network administrator can control the desktop environment of all users. - Use of mandatory profiles drasitcally reduces network management overheads. - In the long run users will be experience fewer problems. + Use of mandatory profiles drastically reduces network management overheads. + In the long run, users will experience fewer problems. -Changing the default profile +Changing the Default Profile - -Question: - -When the client logs onto the domain controller it searches for a profile to download, -where do I put this default profile? - +When the client logs onto the Domain Controller, it searches +for a profile to download. Where do I put this default profile? -Firstly, the samba server needs to be configured as a domain controller. -This can be done by setting in &smb.conf;: - +default profile +First, the Samba server needs to be configured as a Domain Controller. This can be done by +setting in &smb.conf;: securityuser @@ -1317,39 +1068,28 @@ This can be done by setting in &smb.conf;: domain logonsYes - -There must be an [netlogon] share that is world readable. -It is a good idea to add a logon script to pre-set printer and -drive connections. There is also a facility for automatically -synchronizing the workstation time clock with that of the logon -server (another good thing to do). - + There must be a [netlogon] share that is world readable. It is +a good idea to add a logon script to pre-set printer and drive connections. There is also a facility +for automatically synchronizing the workstation time clock with that of the logon server (another good +thing to do). - -To invoke auto-deletion of roaming profile from the local -workstation cache (disk storage) use the Group Policy Editor -to create a file called NTConfig.POL with the appropriate entries. This -file needs to be located in the netlogon share root directory. + To invoke auto-deletion of roaming profile from the local workstation cache (disk storage), use +the Group Policy Editor to create a file called NTConfig.POL +with the appropriate entries. This file needs to be located in the netlogon +share root directory. - -Windows clients need to be members of the domain. Workgroup machines do NOT use network logons so -they do not interoperate with domain profiles. - + Windows clients need to be members of the domain. Workgroup machines do not use network logons +so they do not interoperate with domain profiles. - -For roaming profiles add to &smb.conf;: - + For roaming profiles, add to &smb.conf;: - logon path\\%N\profiles\%U Default logon drive is Z: logon driveH: This requires a PROFILES share that is world writable. - - diff --git a/docs/docbook/projdoc/SWAT.xml b/docs/docbook/projdoc/SWAT.xml index 90994f65e0..346fe86948 100644 --- a/docs/docbook/projdoc/SWAT.xml +++ b/docs/docbook/projdoc/SWAT.xml @@ -4,57 +4,241 @@ April 21, 2003 -SWAT - The Samba Web Administration Tool +SWAT &smbmdash; The Samba Web Administration Tool -There are many and varied opinions regarding the usefulness or otherwise of SWAT. -No matter how hard one tries to produce the perfect configuration tool it remains -an object of personal taste. SWAT is a tool that will allow web based configuration -of samba. It has a wizard that may help to get samba configured quickly, it has context -sensitive help on each smb.conf parameter, it provides for monitoring of current state -of connection information, and it allows network wide MS Windows network password +There are many and varied opinions regarding the usefulness of SWAT. +No matter how hard one tries to produce the perfect configuration tool, it remains +an object of personal taste. SWAT is a tool that will allow Web-based configuration +of Samba. It has a wizard that may help to get Samba configured +quickly, it has context-sensitive help on each &smb.conf; parameter, it provides for monitoring of current state +of connection information, and it allows network-wide MS Windows network password management. Features and Benefits + +SWAT is a facility that is part of the Samba suite. The main executable is called +swat and is invoked by the inter-networking super daemon. +See for details. + + + +SWAT uses integral samba components to locate parameters supported by the particular +version of Samba. Unlike tools and utilities that are external to Samba, SWAT is always +up to date as known Samba parameters change. SWAT provides context-sensitive help for each +configuration parameter, directly from man page entries. + + There are network administrators who believe that it is a good idea to write systems -documentation inside configuration files, for them SWAT will aways be a nasty tool. SWAT +documentation inside configuration files, and for them SWAT will aways be a nasty tool. SWAT does not store the configuration file in any intermediate form, rather, it stores only the -parameter settings, so when SWAT writes the smb.conf file to disk it will write only -those parameters that are at other than the default settings. The result is that all comments -will be lost from the &smb.conf; file. Additionally, the parameters will be written back in -internal ordering. +parameter settings, so when SWAT writes the &smb.conf; file to disk, it will write only +those parameters that are at other than the default settings. The result is that all comments, +as well as parameters that are no longer supported, will be lost from the &smb.conf; file. +Additionally, the parameters will be written back in internal ordering. -So before using SWAT please be warned - SWAT will completely replace your smb.conf with -a fully optimised file that has been stripped of all comments you might have placed there +Before using SWAT, please be warned &smbmdash; SWAT will completely replace your &smb.conf; with +a fully-optimized file that has been stripped of all comments you might have placed there and only non-default settings will be written to the file. + + + +Guidelines and Technical Tips + + +This section aims to unlock the dark secrets behind how SWAT may be made to work, +may be made more secure, and how to solve Internationalization support problems. + + -Enabling SWAT for use +Validate SWAT Installation + + +The very first step that should be taken before attempting to configure a host +system for SWAT operation is to check that it is installed. This may seem a trivial +point to some, however several Linux distributions do not install SWAT by default, +even though they do ship an installable binary support package containing SWAT +on the distribution media. + + + +When you have configrmed that SWAT is installed it is necessary to validate +that the installation includes the binary swat file as well +as all the supporting text and Web files. A number of operating system distributions +in the past have failed to include the necessary support files, evne though the +swat binary executable file was installed. + + + +Finally, when you are sure that SWAT has been fully installed, please check the SWAT +has been enebled in the control file for the internetworking super-daemon (inetd or xinetd) +that is used on your operating system platform. + + + +Locating the <command>swat</command> File + + +To validate that SWAT is installed, first locate the swat binary +file on the system. It may be found under the following directories: + + /usr/local/samba/bin &smbmdash; the default Samba location. + /usr/sbin &smbmdash; the default location on most Linux systems. + /opt/samba/bin + + -SWAT should be installed to run via the network super daemon. Depending on which system -your UNIX/Linux system has you will have either an inetd or -xinetd based system. +The actual location is much dependant on the choice of the operating system vendor, or as determined +by the administrator who compiled and installed Samba. + + + +There are a number methods that may be used to locate the swat binary file. +The following methods may be helpful: + + + +If swat is in your current operating system search path it will be easy to +find it. You can ask what are the command-line options for swat as shown here: + +frodo:~ # swat -? +Usage: swat [OPTION...] + -a, --disable-authentication Disable authentication (demo mode) + +Help options: + -?, --help Show this help message + --usage Display brief usage message + +Common samba options: + -d, --debuglevel=DEBUGLEVEL Set debug level + -s, --configfile=CONFIGFILE Use alternative configuration file + -l, --log-basename=LOGFILEBASE Basename for log/debug files + -V, --version Print version + + + + + + +Locating the SWAT Support Files + + +Now that you have found that swat is in the search path, it is easy +to identify where the file is located. Here is another simple way this may be done: + +frodo:~ # whereis swat +swat: /usr/sbin/swat /usr/share/man/man8/swat.8.gz + + + + +If the above measures fail to locate the swat binary, another approach +is needed. The following may be used: + +frodo:/ # find / -name swat -print +/etc/xinetd.d/swat +/usr/sbin/swat +/usr/share/samba/swat +frodo:/ # + + + + +This list shows that there is a control file for xinetd, the internetwork +super-daemon that is installed on this server. The location of the SWAT binary file is +/usr/sbin/swat, and the support files for it are located under the +directory /usr/share/samba/swat. + + + +We must now check where swat expects to find its support files. This can +be done as follows: + +frodo:/ # strings /usr/sbin/swat | grep "/swat" +/swat/ +... +/usr/share/samba/swat +frodo:/ # + + + + +The /usr/share/samba/swat/ entry shown in this listing is the location of the +support files. You should verify that the support files exist under this directory. A sample +list is as shown: + +jht@frodo:/> find /usr/share/samba/swat -print +/usr/share/samba/swat +/usr/share/samba/swat/help +/usr/share/samba/swat/lang +/usr/share/samba/swat/lang/ja +/usr/share/samba/swat/lang/ja/help +/usr/share/samba/swat/lang/ja/help/welcome.html +/usr/share/samba/swat/lang/ja/images +/usr/share/samba/swat/lang/ja/images/home.gif +... +/usr/share/samba/swat/lang/ja/include +/usr/share/samba/swat/lang/ja/include/header.nocss.html +... +/usr/share/samba/swat/lang/tr +/usr/share/samba/swat/lang/tr/help +/usr/share/samba/swat/lang/tr/help/welcome.html +/usr/share/samba/swat/lang/tr/images +/usr/share/samba/swat/lang/tr/images/home.gif +... +/usr/share/samba/swat/lang/tr/include +/usr/share/samba/swat/lang/tr/include/header.html +/usr/share/samba/swat/using_samba +... +/usr/share/samba/swat/images +/usr/share/samba/swat/images/home.gif +... +/usr/share/samba/swat/include +/usr/share/samba/swat/include/footer.html +/usr/share/samba/swat/include/header.html +jht@frodo:/> + + + + +If the files needed are not available it will be necessary to obtain and install them +before SWAT can be used. + + + + + + +Enabling SWAT for Use + + +SWAT should be installed to run via the network super-daemon. Depending on which system +your UNIX/Linux system has, you will have either an inetd- or +xinetd-based system. The nature and location of the network super-daemon varies with the operating system implementation. The control file (or files) can be located in the file -/etc/inetd.conf or in the directory /etc/[x]inet.d +/etc/inetd.conf or in the directory /etc/[x]inet[d].d or similar. The control entry for the older style file might be: +swatenable + # swat is the Samba Web Administration Tool swat stream tcp nowait.400 root /usr/sbin/swat swat @@ -66,36 +250,36 @@ A control file for the newer style xinetd could be: - # default: off - # description: SWAT is the Samba Web Admin Tool. Use swat \ - # to configure your Samba server. To use SWAT, \ - # connect to port 901 with your favorite web browser. - service swat - { - port = 901 - socket_type = stream - wait = no - only_from = localhost - user = root - server = /usr/sbin/swat - log_on_failure += USERID - disable = yes - } +# default: off +# description: SWAT is the Samba Web Admin Tool. Use swat \ +# to configure your Samba server. To use SWAT, \ +# connect to port 901 with your favorite web browser. +service swat +{ + port = 901 + socket_type = stream + wait = no + only_from = localhost + user = root + server = /usr/sbin/swat + log_on_failure += USERID + disable = yes +} -Both the above examples assume that the swat binary has been -located in the /usr/sbin directory. In addition to the above -SWAT will use a directory access point from which it will load it's help files +Both of the above examples assume that the swat binary has been +located in the /usr/sbin directory. In addition to the above, +SWAT will use a directory access point from which it will load its Help files as well as other control information. The default location for this on most Linux systems is in the directory /usr/share/samba/swat. The default -location using samba defaults will be /usr/local/samba/swat. +location using Samba defaults will be /usr/local/samba/swat. -Access to SWAT will prompt for a logon. If you log onto SWAT as any non-root user +Access to SWAT will prompt for a logon. If you log onto SWAT as any non-root user, the only permission allowed is to view certain aspects of configuration as well as access to the password change facility. The buttons that will be exposed to the non-root user are: HOME, STATUS, VIEW, @@ -104,8 +288,8 @@ change capability in this case is PASSWORD. -So long as you log onto SWAT as the user root you should obtain -full change and commit ability. The buttons that will be exposed includes: +As long as you log onto SWAT as the user root, you should obtain +full change and commit ability. The buttons that will be exposed include: HOME, GLOBALS, SHARES, PRINTERS, WIZARD, STATUS, VIEW, PASSWORD. @@ -115,22 +299,24 @@ full change and commit ability. The buttons that will be exposed includes: Securing SWAT through SSL + -Lots of people have asked about how to setup SWAT with SSL to allow for secure remote -administration of Samba. Here is a method that works, courtesy of Markus Krieger +swatsecurity +Many people have asked about how to setup SWAT with SSL to allow for secure remote +administration of Samba. Here is a method that works, courtesy of Markus Krieger. -Modifications to the swat setup are as following: +Modifications to the SWAT setup are as follows: - install OpenSSL + Install OpenSSL. - generate certificate and private key + Generate certificate and private key. &rootprompt;/usr/bin/openssl req -new -x509 -days 365 -nodes -config \ @@ -139,11 +325,11 @@ Modifications to the swat setup are as following: - remove swat-entry from [x]inetd + Remove swat-entry from [x]inetd. - start stunnel + Start stunnel. &rootprompt;stunnel -p /etc/stunnel/stunnel.pem -d 901 \ @@ -152,33 +338,100 @@ Modifications to the swat setup are as following: -afterwords simply contact to swat by using the URL https://myhost:901, accept the certificate +Afterward, simply connect to swat by using the URL https://myhost:901, accept the certificate and the SSL connection is up. + +Enabling SWAT Internationalization Support + + +SWAT can be configured to display its messages to match the settings of +the language configurations of your Web browser. It will be passed to SWAT +in the Accept-Language header of the HTTP request. + + + +To enable this feature: + + + + + Install the proper msg files from the Samba + source/po directory into $LIBDIR. + + + + Set the correct locale value for display charset. + + + + Set your browser's language setting. + + + + +The name of msg file is same as the language ID sent by the browser. For +example en means "English", ja means "Japanese", fr means "French. + + + +If you do not like some of messages, or there are no msg files for +your locale, you can create them simply by copying the en.msg files +to the dirertory for your language ID.msg and filling in proper strings +to each msgstr. For example, in it.msg, the +msg file for the Italian locale, just set: + +msgid "Set Default" +msgstr "Imposta Default" + +and so on. If you find a mistake or create a new msg file, please email it +to us so we will include this in the next release of Samba. + + + +Note that if you enable this feature and the display charset is not +matched to your browser's setting, the SWAT display may be corrupted. In a future version of +Samba, SWAT will always display messages with UTF-8 encoding. You will then not need to set +this &smb.conf; file parameter. + + + + + + + +Overview and Quick Tour + + +SWAT is a tools that many be used to configure Samba, or just to obtain useful links +to important reference materials such as the contents of this book, as well as other +documents that have been found useful for solving Windows networking problems. + + The SWAT Home Page The SWAT title page provides access to the latest Samba documentation. The manual page for -each samba component is accessible from this page as are the Samba-HOWTO-Collection (this -document) as well as the O'Reilly book "Using Samba". +each Samba component is accessible from this page, as are the Samba HOWTO-Collection (this +document) as well as the O'Reilly book Using Samba. -Administrators who wish to validate their samba configuration may obtain useful information +Administrators who wish to validate their Samba configuration may obtain useful information from the man pages for the diagnostic utilities. These are available from the SWAT home page -also. One diagnostic tool that is NOT mentioned on this page, but that is particularly -useful is ethereal. +also. One diagnostic tool that is not mentioned on this page, but that is particularly +useful is ethereal. -SWAT can be configured to run in demo mode. This is NOT recommended -as it runs SWAT without authentication and with full administrative ability. ie: Allows -changes to smb.conf as well as general operation with root privileges. The option that -creates this ability is the flag to swat. Do not use this in any +SWAT can be configured to run in demo mode. This is not recommended +as it runs SWAT without authentication and with full administrative ability. Allows +changes to &smb.conf; as well as general operation with root privileges. The option that +creates this ability is the flag to swat. Do not use this in a production environment. @@ -188,40 +441,36 @@ production environment. Global Settings -The Globals button will expose a page that allows configuration of the global parameters -in smb.conf. There are three levels of exposure of the parameters: +The GLOBALS button will expose a page that allows configuration of the global parameters +in &smb.conf;. There are two levels of exposure of the parameters: - Basic - exposes common configuration options. + Basic &smbmdash; exposes common configuration options. - Advanced - exposes configuration options needed in more + Advanced &smbmdash; exposes configuration options needed in more complex environments. - - - Developer - exposes configuration options that only the brave - will want to tamper with. - -To switch to other than Basic editing ability click on either the -Advanced or the Developer button. You may also -do this by clicking on the radio button, then click the Commit Changes button. +To switch to other than Basic editing ability, click on Advanced. +You may also do this by clicking on the radio button, then click on the Commit Changes button. -After making any changes to configuration parameters make sure that you click on the -Commit Changes button before moving to another area otherwise -your changes will be immediately lost. +After making any changes to configuration parameters, make sure that +you click on the +Commit Changes button before moving to another area, otherwise +your changes will be lost. -SWAT has context sensitive help. To find out what each parameter is for simply click the +SWAT has context-sensitive help. To find out what each parameter is +for, simply click on the Help link to the left of the configuration parameter. @@ -231,15 +480,16 @@ SWAT has context sensitive help. To find out what each parameter is for simply c Share Settings -To affect a currently configured share, simply click on the pull down button between the +To effect a currently configured share, simply click on the pull down button between the Choose Share and the Delete Share buttons, -select the share you wish to operate on, then to edit the settings click on the -Choose Share button, to delete the share simply press the +select the share you wish to operate on, then to edit the settings +click on the +Choose Share button. To delete the share, simply press the Delete Share button. -To create a new share, next to the button labelled Create Share enter +To create a new share, next to the button labeled Create Share enter into the text field the name of the share to be created, then click on the Create Share button. @@ -252,13 +502,14 @@ into the text field the name of the share to be created, then click on the To affect a currently configured printer, simply click on the pull down button between the Choose Printer and the Delete Printer buttons, -select the printer you wish to operate on, then to edit the settings click on the -Choose Printer button, to delete the share simply press the +select the printer you wish to operate on, then to edit the settings +click on the +Choose Printer button. To delete the share, simply press the Delete Printer button. -To create a new printer, next to the button labelled Create Printer enter +To create a new printer, next to the button labeled Create Printer enter into the text field the name of the share to be created, then click on the Create Printer button. @@ -269,15 +520,15 @@ into the text field the name of the share to be created, then click on the The SWAT Wizard -The purpose if the SWAT Wizard is to help the Microsoft knowledgeable network administrator +The purpose if the SWAT Wizard is to help the Microsoft-knowledgeable network administrator to configure Samba with a minimum of effort. -The Wizard page provides a tool for rewriting the smb.conf file in fully optimised format. -This will also happen if you press the commit button. The two differ in the the rewrite button -ignores any changes that may have been made, while the Commit button causes all changes to be -affected. +The Wizard page provides a tool for rewriting the &smb.conf; file in fully optimized format. +This will also happen if you press the Commit button. The two differ +since the Rewrite button ignores any changes that may have been made, +while the Commit button causes all changes to be affected. @@ -288,7 +539,7 @@ options that may be necessary to create a working Samba server. Finally, there are a limited set of options that will determine what type of server Samba will be configured for, whether it will be a WINS server, participate as a WINS client, or -operate with no WINS support. By clicking on one button you can elect to expose (or not) user +operate with no WINS support. By clicking one button, you can elect to expose (or not) user home directories. @@ -298,13 +549,13 @@ home directories. The Status Page -The status page serves a limited purpose. Firstly, it allows control of the samba daemons. -The key daemons that create the samba server environment are: &smbd;, &nmbd;, &winbindd;. +The status page serves a limited purpose. First, it allows control of the Samba daemons. +The key daemons that create the Samba server environment are: &smbd;, &nmbd;, &winbindd;. The daemons may be controlled individually or as a total group. Additionally, you may set -an automatic screen refresh timing. As MS Windows clients interact with Samba new smbd processes +an automatic screen refresh timing. As MS Windows clients interact with Samba, new smbd processes will be continually spawned. The auto-refresh facility will allow you to track the changing conditions with minimal effort. @@ -320,7 +571,7 @@ free files that may be locked. The View Page -This page allows the administrator to view the optimised &smb.conf; file and, if you are +This page allows the administrator to view the optimized &smb.conf; file and, if you are particularly masochistic, will permit you also to see all possible global configuration parameters and their settings. @@ -331,14 +582,14 @@ parameters and their settings. The Password Change Page -The Password Change page is a popular tool. This tool allows the creation, deletion, deactivation -and reactivation of MS Windows networking users on the local machine. Alternatively, you can use +The Password Change page is a popular tool that allows the creation, deletion, deactivation, +and reactivation of MS Windows networking users on the local machine. Alternately, you can use this tool to change a local password for a user account. -When logged in as a non-root account the user will have to provide the old password as well as -the new password (twice). When logged in as root only the new password is +When logged in as a non-root account, the user will have to provide the old password as well as +the new password (twice). When logged in as root, only the new password is required. diff --git a/docs/docbook/projdoc/Samba-BDC-HOWTO.xml b/docs/docbook/projdoc/Samba-BDC-HOWTO.xml index 9800c508d5..acdf284366 100644 --- a/docs/docbook/projdoc/Samba-BDC-HOWTO.xml +++ b/docs/docbook/projdoc/Samba-BDC-HOWTO.xml @@ -3,121 +3,123 @@ &author.jht; &author.vl; + &person.gd;LDAP updates Backup Domain Control -Before you continue reading in this section, please make sure that you are comfortable -with configuring a Samba Domain Controller as described in chapter on setting up Samba as a PDC. +Before you continue reading this section, please make sure that you are comfortable +with configuring a Samba Domain Controller as described in . -Features And Benefits +Features and Benefits -This is one of the most difficult chapters to summarise. It does not matter what we say here -for someone will still draw conclusions and / or approach the Samba-Team with expectations +This is one of the most difficult chapters to summarize. It does not matter what we say here +for someone will still draw conclusions and/or approach the Samba Team with expectations that are either not yet capable of being delivered, or that can be achieved far more effectively using a totally different approach. In the event that you should have a persistent -concern that is not addressed in this book then please email -John H Terpstra clearly setting out your requirements -and / or question and we will do our best to provide a solution. +concern that is not addressed in this book, please email John H. Terpstra +clearly setting out your requirements and/or question and we will do our best to provide a solution. -Samba-3 is capable of acting as a Backup Domain Controller to another Samba Primary Domain -Controller. A Samba-3 PDC can operate with an LDAP Account backend. The LDAP backend can be +SAM backendLDAP +Samba-3 is capable of acting as a Backup Domain Controller (BDC) to another Samba Primary Domain +Controller (PDC). A Samba-3 PDC can operate with an LDAP Account backend. The LDAP backend can be either a common master LDAP server, or a slave server. The use of a slave LDAP server has the -benefit that when the master is down clients may still be able to log onto the network. -This effectively gives samba a high degree of scalability iand is a very sweet (nice) solution -for large organisations. +benefit that when the master is down, clients may still be able to log onto the network. +This effectively gives Samba a high degree of scalability and is an effective solution +for large organizations. Do not use an LDAP slave server for a PDC, this may cause serious +stability and operational problems. +replicationSAM While it is possible to run a Samba-3 BDC with non-LDAP backend, the administrator will -need to figure out precisely what is the best way to replicate (copy / distribute) the -user and machine Accounts backend. +need to figure out precisely what is the best way to replicate (copy/distribute) the +user and machine accounts' backend. -The use of a non-LDAP backend SAM database is particularly problematic because Domain member -servers and workstations periodically change the machine trust account password. The new +SAM backendnon-LDAP +The use of a non-LDAP backend SAM database is particularly problematic because Domain Member +servers and workstations periodically change the Machine Trust Account password. The new password is then stored only locally. This means that in the absence of a centrally stored -accounts database (such as that provided with an LDAP based solution) if Samba-3 is running -as a BDC, the BDC instance of the Domain member trust account password will not reach the -PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs this results in -overwriting of the SAM that contains the updated (changed) trust account password with resulting +accounts database (such as that provided with an LDAP-based solution) if Samba-3 is running +as a BDC, the BDC instance of the Domain Member trust account password will not reach the +PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs, this results in +overwriting the SAM that contains the updated (changed) trust account password with resulting breakage of the domain trust. -Considering the number of comments and questions raised concerning how to configure a BDC -lets consider each possible option and look at the pro's and con's for each theoretical solution: - - - -Backup Domain Backend Account Distribution Options - - Solution: Passwd Backend is LDAP based, BDCs use a slave LDAP server - - - - Arguments For: This is a neat and manageable solution. The LDAP based SAM (ldapsam) - is constantly kept up to date. - - - - Arguments Against: Complexity - - - - - Passdb Backend is tdbsam based, BDCs use cron based net rpc vampire to - obtain the Accounts database from the PDC and place them into the Samba SAM. - net rpc vampire is a Samba function of the "net" command. - - - - Arguments For: It would be a nice solution - - - - Arguments Against: It does not work because Samba-3 does not support the required - protocols. This may become a later feature but is not available today. - - - - - Make use of rsync to replicate (pull down) copies of the essential account files - - - - Arguments For: It is a simple solution, easy to set up as a scheduled job - - - - Arguments Against: This will over-write the locally changed machine trust account - passwords. This is a broken and flawed solution. Do NOT do this. - - - - - Operate with an entirely local accounts database (not recommended) - - - - Arguments For: Simple, easy to maintain - - - - Arguments Against: All machine trust accounts and user accounts will be locally - maintained. Domain users will NOT be able to roam from office to office. This is - a broken and flawed solution. Do NOT do this. - - - - +Considering the number of comments and questions raised concerning how to configure a BDC, +let's consider each possible option and look at the pros and cons for each possible solution. + lists possible design configurations for a PDC/BDC infrastructure. +netrpc +SAM backendldapsam +SAM backendtdbsam +replicationSAM + + +Domain Backend Account Distribution Options + + + + + + + PDC BackendBDC BackendNotes/Discussion + + + + Master LDAP Server + Slave LDAP Server + The optimal solution that provides high integrity. The SAM will be + replicated to a common master LDAP server. + + + Single Central LDAP Server + Single Central LDAP Server + + A workable solution without fail-over ability. This is a useable solution, but not optimal. + + + + tdbsam + tdbsam + net rpc vampire + + Does not work with Samba-3.0.0; may be implemented in a later release. The downside of this solution + is that an external process will control account database integrity. This solution may appeal to sites + that wish to avoid the complexity of LDAP. The net rpc vampire is used to + synchronize domain accounts from the PDC to the BDC. + + + + tdbsam + tdbsam + rsync + + Do not use this configuration. + Does not work because the TDB files are live and data may not have been flushed to disk. + Use rsync to synchronize the TDB database files from the PDC to the BDC. + + + + smbpasswd file + smbpasswd file + + Do not use this configuration. + Not an elegant solution due to the delays in synchronization. + Use rsync to synchronize the TDB database files from the PDC to the BDC. + Can be made to work using a cron job to synchronize data from the PDC to the BDC. + + + + +
     @@ -131,27 +133,27 @@ provided this capability. The technology has become known as the LanMan Netlogon -When MS Windows NT3.10 was first released, it supported an new style of Domain Control +When MS Windows NT3.10 was first released, it supported a new style of Domain Control and with it a new form of the network logon service that has extended functionality. This service became known as the NT NetLogon Service. The nature of this service has -changed with the evolution of MS Windows NT and today provides a very complex array of -services that are implemented over a complex spectrum of technologies. +changed with the evolution of MS Windows NT and today provides a complex array of +services that are implemented over an intricate spectrum of technologies. -MS Windows NT4 Style Domain Control +MS Windows NT4-style Domain Control -Whenever a user logs into a Windows NT4 / 200x / XP Professional Workstation, -the workstation connects to a Domain Controller (authentication server) to validate -the username and password that the user entered are valid. If the information entered -does not validate against the account information that has been stored in the Domain -Control database (the SAM, or Security Account Manager database) then a set of error +Whenever a user logs into a Windows NT4/200x/XP Professional Workstation, +the workstation connects to a Domain Controller (authentication server) to validate that +the username and password the user entered are valid. If the information entered +does not match account information that has been stored in the Domain +Control database (the SAM, or Security Account Manager database), a set of error codes is returned to the workstation that has made the authentication request. -When the username / password pair has been validated, the Domain Controller +When the username/password pair has been validated, the Domain Controller (authentication server) will respond with full enumeration of the account information that has been stored regarding that user in the User and Machine Accounts database for that Domain. This information contains a complete network access profile for @@ -164,9 +166,10 @@ in all versions of MS Windows NT (3.10, 3.50, 3.51, 4.0). +replicationSAM The account information (user and machine) on Domain Controllers is stored in two files, one containing the Security information and the other the SAM. These are stored in files -by the same name in the C:\WinNT\System32\config directory. These +by the same name in the C:\Windows NT\System32\config directory. These are the files that are involved in replication of the SAM database where Backup Domain Controllers are present on the network. @@ -185,52 +188,69 @@ There are two situations in which it is desirable to install Backup Domain Contr At each remote site, to reduce wide area network traffic and to add stability to remote network operations. The design of the network, the strategic placement of - Backup Domain Controllers, together with an implementation that localises as much - of network to client interchange as possible will help to minimise wide area network + Backup Domain Controllers, together with an implementation that localizes as much + of network to client interchange as possible will help to minimize wide area network bandwidth needs (and thus costs). -The PDC contains the master copy of the SAM. In the event that an administrator makes a -change to the user account database while physically present on the local network that -has the PDC, the change will likely be made directly to the PDC instance of the master -copy of the SAM. In the event that this update may be performed in a branch office the -change will likely be stored in a delta file on the local BDC. The BDC will then send -a trigger to the PDC to commence the process of SAM synchronisation. The PDC will then -request the delta from the BDC and apply it to the master SAM. The PDC will then contact -all the BDCs in the Domain and trigger them to obtain the update and then apply that to -their own copy of the SAM. +The inter-operation of a PDC and its BDCs in a true Windows NT4 environemt is worth +mentioning here. The PDC contains the master copy of the SAM. In the event that an +administrator makes a change to the user account database while physically present +on the local network that has the PDC, the change will likely be made directly to +the PDC instance of the master copy of the SAM. In the event that this update may +be performed in a branch office, the change will likely be stored in a delta file +on the local BDC. The BDC will then send a trigger to the PDC to commence the process +of SAM synchronization. The PDC will then request the delta from the BDC and apply +it to the master SAM. The PDC will then contact all the BDCs in the Domain and +trigger them to obtain the update and then apply that to their own copy of the SAM. + + + +Samba-3 can not participate in true SAM replication and is therefore not able to +employ precisely the same protocols used by MS Windows NT4. A Samba-3 BDC will +not create SAM update delta files. It will not inter-operate with a PDC (NT4 or Samba) +to synchronize the SAM from delta files that are held by BDCs. -Thus the BDC is said to hold a read-only of the SAM from which -it is able to process network logon requests and to authenticate users. The BDC can +Samba-3 cannot function as a BDC to an MS Windows NT4 PDC, and Samba-3 can not +function correctly as a PDC to an MS Windows NT4 BDC. Both Samba-3 and MS Windows +NT4 can function as a BDC to its own type of PDC. + + + +The BDC is said to hold a read-only of the SAM from which +it is able to process network logon requests and authenticate users. The BDC can continue to provide this service, particularly while, for example, the wide area -network link to the PDC is down. Thus a BDC plays a very important role in both -maintenance of Domain security as well as in network integrity. +network link to the PDC is down. A BDC plays a very important role in both the +maintenance of Domain Security as well as in network integrity. -In the event that the PDC should need to be taken out of service, or if it dies, then -one of the BDCs can be promoted to a PDC. If this happens while the original PDC is on -line then it is automatically demoted to a BDC. This is an important aspect of Domain -Controller management. The tool that is used to affect a promotion or a demotion is the -Server Manager for Domains. +In the event that the NT4 PDC should need to be taken out of service, or if it dies, +one of the NT4 BDCs can be promoted to a PDC. If this happens while the original NT4 PDC is on +line, it is automatically demoted to an NT4 BDC. This is an important aspect of Domain +Controller management. The tool that is used to effect a promotion or a demotion is the +Server Manager for Domains. It should be noted that Samba-3 BDCs can not be promoted +in this manner because reconfiguration of Samba requires changes to the &smb.conf; file. Example PDC Configuration -Since version 2.2 Samba officially supports domain logons for all current Windows Clients, -including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some -parameters in the [global]-section of the &smb.conf; have to be set: +Beginning with Version 2.2, Samba officially supports domain logons for all current Windows clients, +including Windows NT4, 2003 and XP Professional. For Samba to be enabled as a PDC, some +parameters in the [global]-section of the &smb.conf; have to be set. +Refer to for an example of the minimum required settings. - -Minimal smb.conf for being a PDC + +Minimal smb.conf for a PDC in Use With a BDC &smbmdash; LDAP Server on PDC. workgroup&example.workgroup; +passdb backendldapsam://localhost:389 domain masteryes domain logonsyes @@ -238,77 +258,190 @@ parameters in the [global]-section of the &smb. Several other things like a [homes] and a [netlogon] share also need to be set along with -settings for the profile path, the users home drive, etc.. This will not be covered in this -chapter, for more information please refer to the chapter about samba as a PDC. +settings for the profile path, the user's home drive, and so on. This is not covered in this +chapter; for more information please refer to . + +LDAP Configuration Notes + + +When configuring a master and a slave LDAP server, it is advisable to use the master LDAP server +for the PDC and slave LDAP servers for the BDCs. It is not essential to use slave LDAP servers, however, +many administrators will want to do so in order to provide redundant services. Of course, one or more BDCs +may use any slave LDAP server. Then again, it is entirely possible to use a single LDAP server for the +entire network. + + + +When configuring a master LDAP server that will have slave LDAP servers, do not forget to configure +this in the /etc/openldap/slapd.conf file. It must be noted that the DN of a +server certificate must use the CN attribute to name the server, and the CN must carry the servers' +fully qualified domain name. Additional alias names and wildcards may be present in the +subjectAltName certificate extension. More details on server certificate names are in RFC2830. + + + +It does not really fit within the scope of this document, but a working LDAP installation is +basic to LDAP enabled Samba operation. When using an OpenLdap server with Transport Layer Security +(TLS), the machine name in /etc/ssl/certs/slapd.pem must be the +same as in /etc/openldap/sldap.conf. The Red Hat Linux startup script +creates the slapd.pem file with hostname localhost.localdomain. +It is impossible to access this LDAP server from a slave LDAP server (i.e., a Samba BDC) unless the +certificate is recreated with a correct hostname. + + + +Do not install a Samba PDC on a OpenLDAP slave server. Joining client machines to the domain +will fail in this configuration because the change to the machine account in the LDAP tree +must take place on the master LDAP server. This is not replicated rapidly enough to the slave +server that the PDC queries. It therfore gives an error message on the client machine about +not being able to set up account credentials. The machine account is created on the LDAP server +but the password fields will be empty. + + + +Possible PDC/BDC plus LDAP configurations include: + + + + + PDC+BDC -> One Central LDAP Server. + + + PDC -> LDAP master server, BDC -> LDAP slave server. + + + PDC -> LDAP master, with secondary slave LDAP server. + + BDC -> LDAP master, with secondary slave LDAP server. + + + PDC -> LDAP master, with secondary slave LDAP server. + + BDC -> LDAP slave server, with secondary master LDAP server. + + + + +In order to have a fall-back configuration (secondary) LDAP server one would specify +the secondary LDAP server in the &smb.conf; file as shown in . + + + + +Multiple LDAP Servers in &smb.conf; +... +passdb backendldapsam:ldap://master.quenya.org +ldapsam:ldap://slave.quenya.org +... + + + + + Active Directory Domain Control As of the release of MS Windows 2000 and Active Directory, this information is now stored in a directory that can be replicated and for which partial or full administrative control -can be delegated. Samba-3 is NOT able to be a Domain Controller within an Active Directory -tree, and it can not be an Active Directory server. This means that Samba-3 also can NOT +can be delegated. Samba-3 is not able to be a Domain Controller within an Active Directory +tree, and it cannot be an Active Directory server. This means that Samba-3 also cannot act as a Backup Domain Controller to an Active Directory Domain Controller. -What qualifies a Domain Controller on the network? +What Qualifies a Domain Controller on the Network? -Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS -group name SAMBA<#1c> with the WINS server and/or by broadcast on the local network. -The PDC also registers the unique NetBIOS name SAMBA<#1b> with the WINS server. +Every machine that is a Domain Controller for the domain MIDEARTH has to register the NetBIOS +group name MIDEARTH<#1c> with the WINS server and/or by broadcast on the local network. +The PDC also registers the unique NetBIOS name MIDEARTH<#1b> with the WINS server. The name type <#1b> name is normally reserved for the Domain Master Browser, a role that has nothing to do with anything related to authentication, but the Microsoft Domain -implementation requires the domain master browser to be on the same machine as the PDC. +implementation requires the Domain Master Browser to be on the same machine as the PDC. + + + +Where a WINS server is not used, broadcast name registrations alone must suffice. Refer to + for more information regarding TCP/IP network protocols and how + SMB/CIFS names are handled. -How does a Workstation find its domain controller? +How does a Workstation find its Domain Controller? + + +There are two different mechanisms to locate a domain controller, one method is used when +NetBIOS over TCP/IP is enabled and the other when it has been disabled in the TCP/IP +network configuration. + + + +Where NetBIOS over TCP/IP is disabled, all name resolution involves the use of DNS, broadcast +messaging over UDP, as well as Active Directory communication technologies. In this type of +environment all machines require appropriate DNS entries. More information may be found in +. + + +NetBIOS Over TCP/IP Enabled -An MS Windows NT4 / 200x / XP Professional workstation in the domain SAMBA that wants a -local user to be authenticated has to find the domain controller for SAMBA. It does this -by doing a NetBIOS name query for the group name SAMBA<#1c>. It assumes that each -of the machines it gets back from the queries is a domain controller and can answer logon -requests. To not open security holes both the workstation and the selected domain controller +An MS Windows NT4/200x/XP Professional workstation in the domain MIDEARTH that wants a +local user to be authenticated has to find the Domain Controller for MIDEARTH. It does this +by doing a NetBIOS name query for the group name MIDEARTH<#1c>. It assumes that each +of the machines it gets back from the queries is a Domain Controller and can answer logon +requests. To not open security holes, both the workstation and the selected Domain Controller authenticate each other. After that the workstation sends the user's credentials (name and -password) to the local Domain Controller, for validation. +password) to the local Domain Controller for validation. - + + +NetBIOS Over TCP/IP Disabled + + +An MS Windows NT4/200x/XP Professional workstation in the realm quenya.org +that has a need to affect user logon authentication will locate the Domain Controller by +requerying DNS servers for the _ldap._tcp.pdc.ms-dcs.quenya.org record. +More information regarding this subject may be found in . + + + +     Backup Domain Controller Configuration -Several things have to be done: +The creation of a BDC requires some steps to prepare the Samba server before +&smbd; is executed for the first time. These steps are outlines as follows: +SID - The domain SID has to be the same on the PDC and the BDC. This used to - be stored in the file private/MACHINE.SID. This file is not created - since Samba 2.2.5. Nowadays the domain SID is stored in the file - private/secrets.tdb. Simply copying the secrets.tdb - from the PDC to the BDC does not work, as the BDC would - generate a new SID for itself and override the domain SID with this - new BDC SID. + The domain SID has to be the same on the PDC and the BDC. In Samba versions + pre-2.2.5, the domain SID was stored in the file private/MACHINE.SID. + The domain SID is now stored in the file private/secrets.tdb. This file + is unique to each server and can not be copied from a PDC to a BDC, the BDC will generate + a new SID at start-up. It will over-write the PDC domain SID with the newly created BDC SID. + There is a procedure that will allow the BDC to aquire the Domain SID. This is described here. + To retrieve the domain SID from the PDC or an existing BDC and store it in the - secrets.tdb, execute: + secrets.tdb, execute: &rootprompt;net rpc getsid @@ -316,31 +449,45 @@ Several things have to be done: + Specification of the ldap admin dn is obligatory. + This also requires the LDAP administration password to be set in the secrets.tdb + using the smbpasswd -w mysecret. + + + + Either ldap suffix or + ldap idmap suffix must be specified in + the &smb.conf; file. + + + +replicationSAM The UNIX user database has to be synchronized from the PDC to the - BDC. This means that both the /etc/passwd and /etc/group have to be - replicated from the PDC to the BDC. This can be done manually - whenever changes are made, or the PDC is set up as a NIS master - server and the BDC as a NIS slave server. To set up the BDC as a - mere NIS client would not be enough, as the BDC would not be able to - access its user database in case of a PDC failure. NIS is by no means - the only method to synchronize passwords. An LDAP solution would work - as well. + BDC. This means that both the /etc/passwd and + /etc/group have to be replicated from the PDC + to the BDC. This can be done manually whenever changes are made. + Alternately, the PDC is set up as an NIS master server and the BDC as an NIS slave + server. To set up the BDC as a mere NIS client would not be enough, + as the BDC would not be able to access its user database in case of + a PDC failure. NIS is by no means the only method to synchronize + passwords. An LDAP solution would also work. - The Samba password database has to be replicated from the PDC to the BDC. - As said above, though possible to synchronise the smbpasswd - file with rsync and ssh, this method is broken and flawed, and is - therefore not recommended. A better solution is to set up slave LDAP - servers for each BDC and a master LDAP server for the PDC. + The Samba password database must be replicated from the PDC to the BDC. + Although it is possible to synchronize the smbpasswd + file with rsync and ssh, this method + is broken and flawed, and is therefore not recommended. A better solution + is to set up slave LDAP servers for each BDC and a master LDAP server for the PDC. - Any netlogon share has to be replicated from the PDC to the + The netlogon share has to be replicated from the PDC to the BDC. This can be done manually whenever login scripts are changed, - or it can be done automatically together with the smbpasswd - synchronization. + or it can be done automatically using a cron job + that will replicate the directory structure in this share using a tool + like rsync. @@ -349,15 +496,16 @@ Several things have to be done: Example Configuration -Finally, the BDC has to be found by the workstations. This can be done by setting: +Finally, the BDC has to be found by the workstations. This can be done by setting Samba as shown in . - + Minimal setup for being a BDC workgroup&example.workgroup; +passdb backendldapsam:ldap://slave-ldap.quenya.org domain masterno domain logonsyes -idmap backendldapsam://slave-ldap.quenya.org +idmap backendldapsam:ldap://slave-ldap.quenya.org @@ -366,24 +514,35 @@ only register the name SAMBA<#1c> with the WINS server. This is no problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to be registered by more than one machine. The parameter domain masterno -forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS +forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS name is reserved for the Primary Domain Controller. +idmap backend +winbindd The idmap backend will redirect the winbindd utility to use the LDAP database to resolve all UIDs and GIDs for UNIX accounts. +Server TypeDomain Member Samba-3 has introduced a new ID mapping facility. One of the features of this facility is that it -allows greater flexibility in how user and group IDs are handled in respect of NT Domain User and Group -SIDs. One of the new facilities provides for explicitly ensuring that UNIX / Linux UID and GID values +allows greater flexibility in how user and group IDs are handled in respect to NT Domain User and Group +SIDs. One of the new facilities provides for explicitly ensuring that UNIX/Linux UID and GID values will be consistent on the PDC, all BDCs and all Domain Member servers. The parameter that controls this is called idmap backend. Please refer to the man page for &smb.conf; for more information -regarding it's behaviour. Do NOT set this parameter except where an LDAP backend (ldapsam) is in use. +regarding its behavior. + +The use of the idmap backendldap://master.quenya/org +option on a BDC only make sense where ldapsam is used on a PDC. The purpose for an LDAP based idmap backend is +also to allow a domain-member (without its own passdb backend) to use winbindd to resolve Windows network users +and groups to common UID/GIDs. In other words, this option is generally intended for use on BDCs and on Domain +Member servers. + + @@ -391,51 +550,55 @@ regarding it's behaviour. Do NOT set this parameter except where an LDAP backend Common Errors -As this is a rather new area for Samba there are not many examples that we may refer to. Keep -watching for updates to this section. +As this is a rather new area for Samba, there are not many examples that we may refer to. +Updates will be published as they become available and may be found in later Samba releases or +from the Samba web site. -Machine Accounts keep expiring, what can I do? +Machine Accounts Keep Expiring -This problem will occur when occur when the passdb (SAM) files are copied from a central -server but the local Backup Domain Controllers. Local machine trust account password updates +Machine Trust Accounts +This problem will occur when the passdb (SAM) files are copied from a central +server but the local Backup Domain Controller is acting as a PDC. This results in the application of +Local Machine Trust Account password updates to the local SAM. Such updates are not copied back to the central server. The newer machine account password is then over -written when the SAM is copied from the PDC. The result is that the Domain member machine -on start up will find that it's passwords does not match the one now in the database and +written when the SAM is re-copied from the PDC. The result is that the Domain Member machine +on start up will find that its passwords do not match the one now in the database and since the startup security check will now fail, this machine will not allow logon attempts to proceed and the account expiry error will be reported. -The solution: use a more robust passdb backend, such as the ldapsam backend, setting up -an slave LDAP server for each BDC, and a master LDAP server for the PDC. +The solution is to use a more robust passdb backend, such as the ldapsam backend, setting up +a slave LDAP server for each BDC, and a master LDAP server for the PDC. -Can Samba be a Backup Domain Controller to an NT4 PDC? +Can Samba Be a Backup Domain Controller to an NT4 PDC? -With version 2.2, no. The native NT4 SAM replication protocols have not yet been fully -implemented. The Samba Team is working on understanding and implementing the protocols, -but this work has not been finished for Samba-3. +replicationSAM +No. The native NT4 SAM replication protocols have not yet been fully implemented. -Can I get the benefits of a BDC with Samba? Yes, but only to a Samba PDC. The main reason for implementing a -BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to -service logon requests whenever the PDC is down. +Can I get the benefits of a BDC with Samba? Yes, but only to a Samba PDC.The +main reason for implementing a BDC is availability. If the PDC is a Samba +machine, a second Samba machine can be set up to service logon requests whenever +the PDC is down. -How do I replicate the smbpasswd file? +How Do I Replicate the smbpasswd File? +replicationSAM Replication of the smbpasswd file is sensitive. It has to be done whenever changes to the SAM are made. Every user's password change is done in the smbpasswd file and has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary. @@ -445,23 +608,23 @@ has to be replicated to the BDC. So replicating the smbpasswd file very often is As the smbpasswd file contains plain text password equivalents, it must not be sent unencrypted over the wire. The best way to set up smbpasswd replication from the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport. -Ssh itself can be set up to accept only rsync transfer without requiring the user -to type a password. +ssh itself can be set up to accept only +rsync transfer without requiring the user to type a password. As said a few times before, use of this method is broken and flawed. Machine trust -accounts will go out of sync, resulting in a very broken domain. This method is +accounts will go out of sync, resulting in a broken domain. This method is not recommended. Try using LDAP instead. -Can I do this all with LDAP? +Can I Do This All with LDAP? -The simple answer is YES. Samba's pdb_ldap code supports binding to a replica +The simple answer is yes. Samba's pdb_ldap code supports binding to a replica LDAP server, and will also follow referrals and rebind to the master if it ever needs to make a modification to the database. (Normally BDCs are read only, so this will not occur often). diff --git a/docs/docbook/projdoc/Samba-PDC-HOWTO.xml b/docs/docbook/projdoc/Samba-PDC-HOWTO.xml index 78a875792c..f86a4d5904 100644 --- a/docs/docbook/projdoc/Samba-PDC-HOWTO.xml +++ b/docs/docbook/projdoc/Samba-PDC-HOWTO.xml @@ -4,36 +4,43 @@ &author.jht; &author.jerry; &author.dbannon; + &person.gd; LDAP updates Domain Control -<emphasis>The Essence of Learning:</emphasis> There are many who approach MS Windows networking with incredible misconceptions. -That's OK, because it gives the rest of us plenty of opportunity to be of assistance. +That's okay, because it gives the rest of us plenty of opportunity to be of assistance. Those who really want help would be well advised to become familiar with information that is already available. - -The reader is advised NOT to tackle this section without having first understood +The reader is advised not to tackle this section without having first understood and mastered some basics. MS Windows networking is not particularly forgiving of misconfiguration. Users of MS Windows networking are likely to complain of persistent niggles that may be caused by a broken network configuration. -To a great many people however, MS Windows networking starts with a domain controller -that in some magical way is expected to solve all ills. +To a great many people, however, MS Windows networking starts with a Domain Controller +that in some magical way is expected to solve all network operational ills. -
    An Example Domain + +The diagram in shows a typical MS Windows Domain Security +network environment. Workstations A, B and C are representative of many physical MS Windows +network clients. + + +
    An Example Domain. - +
    + + From the Samba mailing list one can readily identify many common networking issues. If you are not clear on the following subjects, then it will do much good to read the @@ -42,28 +49,28 @@ networking problems: - Basic TCP/IP configuration - NetBIOS name resolution - Authentication configuration - User and Group configuration - Basic File and Directory Permission Control in UNIX/Linux - Understanding of how MS Windows clients interoperate in a network - environment + Basic TCP/IP configuration. + NetBIOS name resolution. + Authentication configuration. + User and group configuration. + Basic file and directory permission control in UNIX/Linux. + Understanding how MS Windows clients interoperate in a network + environment. Do not be put off; on the surface of it MS Windows networking seems so simple that anyone can do it. In fact, it is not a good idea to set up an MS Windows network with inadequate training and preparation. But let's get our first indelible principle out of the -way: It is perfectly OK to make mistakes! In the right place and at -the right time, mistakes are the essence of learning. It is very much -not ok to make mistakes that cause loss of productivity and impose an avoidable financial -burden on an organisation. +way: It is perfectly okay to make mistakes! In the right place and at +the right time, mistakes are the essence of learning. It is very much not okay to make +mistakes that cause loss of productivity and impose an avoidable financial burden on an +organization. -Where is the right place to make mistakes? Only out of harm's way! If you are going to -make mistakes, then please do this on a test network, away from users and in such a way as +Where is the right place to make mistakes? Only out of harm's way. If you are going to +make mistakes, then please do it on a test network, away from users and in such a way as to not inflict pain on others. Do your learning on a test network. @@ -71,34 +78,36 @@ to not inflict pain on others. Do your learning on a test network. Features and Benefits -What is the key benefit of Microsoft Domain security? +domain security +What is the key benefit of Microsoft Domain Security? -In a word, Single Sign On, or SSO for short. To many, this is the holy -grail of MS Windows NT and beyond networking. SSO allows users in a well designed network +In a word, Single Sign On, or SSO for short. To many, this is the Holy +Grail of MS Windows NT and beyond networking. SSO allows users in a well-designed network to log onto any workstation that is a member of the domain that their user account is in (or in a domain that has an appropriate trust relationship with the domain they are visiting) -and they will be able to log onto the network and access resources (shares, files, and printers) +and they will be able to log onto the network and access resources (shares, files and printers) as if they are sitting at their home (personal) workstation. This is a feature of the Domain -security protocols. +Security protocols. -The benefits of Domain security are available to those sites that deploy a Samba PDC. +SID +The benefits of Domain Security are available to those sites that deploy a Samba PDC. A Domain provides a unique network security identifier (SID). Domain user and group security identifiers are comprised of the network SID plus a relative identifier (RID) that is unique to the account. User and Group SIDs (the network SID plus the RID) can be used to create Access Control Lists (ACLs) attached to network resources to provide organizational access control. UNIX systems -know only of local security identifiers. +recognize only local security identifiers. -Network clients of an MS Windows Domain security environment must be Domain members to be -able to gain access to the advanced features provided. Domain membership involves more than just +Network clients of an MS Windows Domain Security Environment must be Domain Members to be +able to gain access to the advanced features provided. Domain Membership involves more than just setting the workgroup name to the Domain name. It requires the creation of a Domain trust account -for the workstation (called a machine account). Please refer to the chapter on -setting up samba as a domain member for more information. +for the workstation (called a machine account). Refer to +for more information. @@ -107,73 +116,83 @@ The following functionalities are new to the Samba-3 release: - Windows NT4 domain trusts + Windows NT4 domain trusts. + Nexus.exe Adding users via the User Manager for Domains. This can be done on any MS Windows - client using the Nexus toolkit that is available from Microsoft's web site. + client using the Nexus.exe toolkit that is available from Microsoft's Web site. Samba-3 supports the use of the Microsoft Management Console for user management. Introduces replaceable and multiple user account (authentication) - back ends. In the case where the back end is placed in an LDAP database, - Samba-3 confers the benefits of a back end that can be distributed, replicated, + backends. In the case where the backend is placed in an LDAP database, + Samba-3 confers the benefits of a backend that can be distributed, replicated and is highly scalable. - Implements full Unicode support. This simplifies cross locale internationalisation + Implements full Unicode support. This simplifies cross locale internationalization support. It also opens up the use of protocols that Samba-2.2.x had but could not use due to the need to fully support Unicode. -The following functionalities are NOT provided by Samba-3: +The following functionalities are not provided by Samba-3: - +SAM +replication SAM replication with Windows NT4 Domain Controllers - (i.e. a Samba PDC and a Windows NT BDC or vice versa). This means samba + (i.e., a Samba PDC and a Windows NT BDC or vice versa). This means Samba cannot operate as a BDC when the PDC is Microsoft-based or - replicate account data to Windows-BDC's. + replicate account data to Windows BDCs. - Acting as a Windows 2000 Domain Controller (i.e. Kerberos and - Active Directory) - In point of fact, Samba-3 DOES have some + Acting as a Windows 2000 Domain Controller (i.e., Kerberos and + Active Directory). In point of fact, Samba-3 does have some Active Directory Domain Control ability that is at this time - purely experimental AND that is certain - to change as it becomes a fully supported feature some time - during the Samba-3 (or later) life cycle. However, Active Directory is - more then just SMB - it's also LDAP, Kerberos, DHCP and other protocols - (with proprietary extensions, of course). + purely experimental that is certain to change as it becomes a + fully supported feature some time during the Samba-3 (or later) + life cycle. However, Active Directory is more then just SMB &smbmdash; + it's also LDAP, Kerberos, DHCP, and other protocols (with proprietary + extensions, of course). + + + + The Windows 200x/XP MMC (Computer Management) Console can not be used + to manage a Samba-3 server. For this you can use only the MS Windows NT4 + Domain Server manager and the MS Windows NT4 Domain User Manager. Both are + part of the SVRTOOLS.EXE package mentioned later. -Windows 9x / Me / XP Home clients are not true members of a domain for reasons outlined -in this chapter. The protocol for support of Windows 9x / Me style network (domain) logons -is completely different from NT4 / Win2k type domain logons and has been officially supported +Windows 9x/Me/XP Home clients are not true members of a domain for reasons outlined +in this chapter. The protocol for support of Windows 9x/Me style network (domain) logons +is completely different from NT4/Windows 200x type domain logons and has been officially supported for some time. These clients use the old LanMan Network Logon facilities that are supported in Samba since approximately the Samba-1.9.15 series. -Samba-3 has an implementation of group mapping between Windows NT groups +Samba-3 implements group mapping between Windows NT groups and UNIX groups (this is really quite complicated to explain in a short space). This is -discussed more fully in the chapter on group mapping. +discussed more fully in . +Machine Trust Accounts Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store -user and machine trust account information in a suitable backend data store. -Refer to the section on machine trust accounts. With Samba-3 there can be multiple -back-ends for this. A complete discussion of account database backends can be found in -the chapter on Account Information Databases. +user and Machine Trust Account information in a suitable backend datastore. +Refer to . With Samba-3 there can be multiple +backends for this. A complete discussion of account database backends can be found in +. @@ -184,7 +203,7 @@ back-ends for this. A complete discussion of account database backends can be fo Over the years, public perceptions of what Domain Control really is has taken on an almost mystical nature. Before we branch into a brief overview of Domain Control, -there are three basic types of domain controllers: +there are three basic types of Domain Controllers. @@ -197,87 +216,88 @@ there are three basic types of domain controllers: -The Primary Domain Controller or PDC plays an important role in the MS -Windows NT4. In Windows 200x Domain Control architecture this role is held by domain controllers. -There is folk lore that dictates that because of it's role in the MS Windows -network, the domain controllers should be the most powerful and most capable machine in the network. -As strange as it may seem to say this here, good over all network performance dictates that -the entire infrastructure needs to be balanced. It is advisable to invest more in Stand-Alone -(or Domain Member) servers than in the domain controllers. +The Primary Domain Controller or PDC plays an important role in MS +Windows NT4. In Windows 200x Domain Control architecture, this role is held by Domain Controllers. +Folklore dictates that because of its role in the MS Windows +network, the Domain Controller should be the most powerful and most capable machine in the network. +As strange as it may seem to say this here, good overall network performance dictates that +the entire infrastructure needs to be balanced. It is advisable to invest more in Stand-alone +(Domain Member) servers than in the Domain Controllers. -In the case of MS Windows NT4 style domains, it is the PDC that initiates a new Domain Control database. -This forms a part of the Windows registry called the SAM (Security Account Manager). It plays a key -part in NT4 type domain user authentication and in synchronisation of the domain authentication +SAM +In the case of MS Windows NT4-style domains, it is the PDC that initiates a new Domain Control database. +This forms a part of the Windows registry called the Security Account Manager (SAM). It plays a key +part in NT4-type domain user authentication and in synchronization of the domain authentication database with Backup Domain Controllers. -With MS Windows 200x Server based Active Directory domains, one domain controller initiates a potential -hierarchy of domain controllers, each with their own area of delegated control. The master domain -controller has the ability to override any down-stream controller, but a down-line controller has -control only over it's down-line. With Samba-3 this functionality can be implemented using an -LDAP based user and machine account back end. +With MS Windows 200x Server-based Active Directory domains, one Domain Controller initiates a potential +hierarchy of Domain Controllers, each with their own area of delegated control. The master domain +controller has the ability to override any downstream controller, but a downline controller has +control only over its downline. With Samba-3, this functionality can be implemented using an +LDAP-based user and machine account backend. -New to Samba-3 is the ability to use a back-end database that holds the same type of data as -the NT4 style SAM (Security Account Manager) database (one of the registry files). -See also the chapter on Account Information Databases. +New to Samba-3 is the ability to use a backend database that holds the same type of data as +the NT4-style SAM database (one of the registry files)See also .. The Backup Domain Controller or BDC plays a key role in servicing network authentication requests. The BDC is biased to answer logon requests in preference to the PDC. -On a network segment that has a BDC and a PDC the BDC will be most likely to service network +On a network segment that has a BDC and a PDC, the BDC will most likely service network logon requests. The PDC will answer network logon requests when the BDC is too busy (high load). -A BDC can be promoted to a PDC. If the PDC is on line at the time that a BDC is promoted to -PDC, the previous PDC is automatically demoted to a BDC. With Samba-3 this is NOT an automatic -operation; the PDC and BDC must be manually configured and changes need to be made likewise. +A BDC can be promoted to a PDC. If the PDC is online at the time that a BDC is promoted to +PDC, the previous PDC is automatically demoted to a BDC. With Samba-3, this is not an automatic +operation; the PDC and BDC must be manually configured and changes also need to be made. -With MS Windows NT4, it is an install time decision what type of machine the server will be. -It is possible to change the promote a BDC to a PDC and vice versa only, but the only way -to convert a domain controller to a domain member server or a stand-alone server is to +With MS Windows NT4, a decision is made at installation to determine what type of machine the server will be. +It is possible to promote a BDC to a PDC and vice versa. The only way +to convert a Domain Controller to a Domain Member server or a Stand-alone Server is to reinstall it. The install time choices offered are: - Primary Domain Controller - The one that seeds the domain SAM - Backup Domain Controller - One that obtains a copy of the domain SAM - Domain Member Server - One that has NO copy of the domain SAM, rather it obtains authentication from a Domain Controller for all access controls. - Stand-Alone Server - One that plays NO part is SAM synchronisation, has it's own authentication database and plays no role in Domain security. + Primary Domain Controller &smbmdash; the one that seeds the domain SAM. + Backup Domain Controller &smbmdash; one that obtains a copy of the domain SAM. + Domain Member Server &smbmdash; one that has no copy of the domain SAM, rather it obtains authentication from a Domain Controller for all access controls. + Stand-alone Server &smbmdash; one that plays no part is SAM synchronization, has its own authentication database and plays no role in Domain Security. -With MS Windows 2000 the configuration of domain control is done after the server has been +With MS Windows 2000, the configuration of Domain Control is done after the server has been installed. Samba-3 is capable of acting fully as a native member of a Windows 200x server Active Directory domain. -New to Samba-3 is the ability to function fully as an MS Windows NT4 style Domain Controller, -excluding the SAM replication components. However, please be aware that Samba-3 support the -MS Windows 200x domain control protocols also. +replicationSAM +New to Samba-3 is the ability to function fully as an MS Windows NT4-style Domain Controller, +excluding the SAM replication components. However, please be aware that Samba-3 also supports the +MS Windows 200x Domain Control protocols. At this time any appearance that Samba-3 is capable of acting as an Domain Controller in native ADS mode is limited and experimental in nature. -This functionality should not be used until the Samba-Team offers formal support for it. +This functionality should not be used until the Samba Team offers formal support for it. At such a time, the documentation will be revised to duly reflect all configuration and management requirements. Samba can act as a NT4-style DC in a Windows 2000/XP environment. However, there are certain compromises: - No machine policy files - No Group Policy Objects - No synchronously executed AD logon scripts - Can't use ANY Active Directory management tools to manage users and machines - Registry changes tattoo the main registry, while with AD they do NOT. ie: Leave permanent changes in effect - Without AD you can not peprform the function of exporting specific applications to specific users or groups + No machine policy files. + No Group Policy Objects. + No synchronously executed AD logon scripts. + Can't use Active Directory management tools to manage users and machines. + Registry changes tattoo the main registry, while with AD they do not leave permanent changes in effect. + Without AD you cannot perform the function of exporting specific applications to specific users or groups. @@ -287,76 +307,77 @@ environment. However, there are certain compromises: Preparing for Domain Control -There are two ways that MS Windows machines may interact with each other, with other servers, -and with Domain Controllers: Either as Stand-Alone systems, more commonly +There are two ways that MS Windows machines may interact with each other, with other servers +and with Domain Controllers: either as Stand-alone systems, more commonly called Workgroup members, or as full participants in a security system, more commonly called Domain members. -It should be noted that Workgroup membership involve no special configuration -other than the machine being configured so that the network configuration has a commonly used name -for it's workgroup entry. It is not uncommon for the name WORKGROUP to be used for this. With this -mode of configuration there are NO machine trust accounts and any concept of membership as such -is limited to the fact that all machines appear in the network neighbourhood to be logically -grouped together. Again, just to be clear: workgroup mode does not involve any security machine +It should be noted that Workgroup membership involves no special configuration +other than the machine being configured so the network configuration has a commonly used name +for its workgroup entry. It is not uncommon for the name WORKGROUP to be used for this. With this +mode of configurationi, there are no Machine Trust Accounts and any concept of membership as such +is limited to the fact that all machines appear in the network neighborhood to be logically +grouped together. Again, just to be clear: workgroup mode does not involve security machine accounts. -Domain member machines have a machine account in the Domain accounts database. A special procedure -must be followed on each machine to affect Domain membership. This procedure, which can be done -only by the local machine Administrator account, will create the Domain machine account (if -if does not exist), and then initializes that account. When the client first logs onto the +Domain Member machines have a machine account in the Domain accounts database. A special procedure +must be followed on each machine to effect Domain Membership. This procedure, which can be done +only by the local machine Administrator account, will create the Domain machine account (if it does +not exist), and then initializes that account. When the client first logs onto the Domain it triggers a machine password change. -When running a Domain all MS Windows NT / 200x / XP Professional clients should be configured -as full Domain Members - IF A SECURE NETWORK IS WANTED. If the machine is NOT made a member of the -Domain, then it will operate like a workgroup (stand-alone) machine. Please refer to -the chapter on domain membership for information regarding HOW to make your MS Windows clients Domain members. +When Samba is configured as a Domain Controller, secure network operation demands that +all MS Windows NT4/200x/XP Professional clients should be configured as Domain Members. +If a machine is not made a member of the Domain, then it will operate like a workgroup +(Stand-alone) machine. Please refer to for +information regarding Domain Membership. -The following are necessary for configuring Samba-3 as an MS Windows NT4 style PDC for MS Windows -NT4 / 200x / XP clients. +The following are necessary for configuring Samba-3 as an MS Windows NT4-style PDC for MS Windows +NT4/200x/XP clients: - Configuration of basic TCP/IP and MS Windows Networking - Correct designation of the Server Role (securityuser) - Consistent configuration of Name Resolution (See chapter on Network Browsing and on - Integrating Unix into Windows networks) - Domain logons for Windows NT4 / 200x / XP Professional clients - Configuration of Roaming Profiles or explicit configuration to force local profile usage - Configuration of Network/System Policies - Adding and managing domain user accounts - Configuring MS Windows client machines to become domain members + Configuration of basic TCP/IP and MS Windows networking. + Correct designation of the Server Role (securityuser). + Consistent configuration of Name ResolutionSee , and + .. + Domain logons for Windows NT4/200x/XP Professional clients. + Configuration of Roaming Profiles or explicit configuration to force local profile usage. + Configuration of network/system policies. + Adding and managing domain user accounts. + Configuring MS Windows client machines to become Domain Members. -The following provisions are required to serve MS Windows 9x / Me Clients: +The following provisions are required to serve MS Windows 9x/Me clients: - Configuration of basic TCP/IP and MS Windows Networking - Correct designation of the Server Role (securityuser) - Network Logon Configuration (Since Windows 9x / XP Home are not technically domain - members, they do not really participate in the security aspects of Domain logons as such) - Roaming Profile Configuration - Configuration of System Policy handling - Installation of the Network driver "Client for MS Windows Networks" and configuration - to log onto the domain - Placing Windows 9x / Me clients in user level security - if it is desired to allow - all client share access to be controlled according to domain user / group identities. - Adding and managing domain user accounts + Configuration of basic TCP/IP and MS Windows networking. + Correct designation of the server role (securityuser). + Network Logon Configuration (since Windows 9x/Me/XP Home are not technically domain + members, they do not really participate in the security aspects of Domain logons as such). + Roaming Profile Configuration. + Configuration of System Policy handling. + Installation of the network driver Client for MS Windows Networks and configuration + to log onto the domain. + Placing Windows 9x/Me clients in User Level Security &smbmdash; if it is desired to allow + all client share access to be controlled according to domain user/group identities. + Adding and managing domain user accounts. Roaming Profiles and System/Network policies are advanced network administration topics -that are covered in the Profile Management and -Policy Management chapters of this document. However, these are not +that are covered in the and + chapters of this document. However, these are not necessarily specific to a Samba PDC as much as they are related to Windows NT networking concepts. @@ -368,31 +389,29 @@ A Domain Controller is an SMB/CIFS server that: Registers and advertises itself as a Domain Controller (through NetBIOS broadcasts as well as by way of name registrations either by Mailslot Broadcasts over UDP broadcast, - to a WINS server over UDP unicast, or via DNS and Active Directory) + to a WINS server over UDP unicast, or via DNS and Active Directory). - Provides the NETLOGON service (actually a collection of services that runs over - a number of protocols. These include the LanMan Logon service, the Netlogon service, - the Local Security Account service, and variations of them) + Provides the NETLOGON service. (This is actually a collection of services that runs over + mulitple protocols. These include the LanMan Logon service, the Netlogon service, + the Local Security Account service, and variations of them.) - Provides a share called NETLOGON + Provides a share called NETLOGON. - - -For Samba to provide these is rather easy to configure. Each Samba Domain Controller must provide -the NETLOGON service which Samba calls the domain logons functionality -(after the name of the parameter in the &smb.conf; file). Additionally, one (1) server in a Samba-3 -Domain must advertise itself as the domain master browserSee also the chapter about network browsing. This causes the Primary Domain Controller -to claim domain specific NetBIOS name that identifies it as a domain master browser for its given -domain/workgroup. Local master browsers in the same domain/workgroup on broadcast-isolated subnets -then ask for a complete copy of the browse list for the whole wide area network. Browser clients -will then contact their local master browser, and will receive the domain-wide browse list, +It is rather easy to configure Samba to provide these. Each Samba Domain Controller must provide +the NETLOGON service that Samba calls the domain logons functionality +(after the name of the parameter in the &smb.conf; file). Additionally, one server in a Samba-3 +Domain must advertise itself as the Domain Master BrowserSee .. +This causes the Primary Domain Controller to claim a domain-specific NetBIOS name that identifies it as a +Domain Master Browser for its given domain or workgroup. Local master browsers in the same domain or workgroup on +broadcast-isolated subnets then ask for a complete copy of the browse list for the whole wide area network. +Browser clients will then contact their Local Master Browser, and will receive the domain-wide browse list, instead of just the list for their broadcast-isolated subnet. @@ -400,12 +419,11 @@ instead of just the list for their broadcast-isolated subnet. -Domain Control - Example Configuration +Domain Control &smbmdash; Example Configuration The first step in creating a working Samba PDC is to understand the parameters necessary -in &smb.conf;. An example &smb.conf; for acting as a PDC can be found in the example -for being a PDC. +in &smb.conf;. An example &smb.conf; for acting as a PDC can be found in . @@ -414,13 +432,12 @@ in &smb.conf;. An example &smb.conf; for acting as a PDC can be found in the ex [global] netbios nameBELERIAND workgroup&example.workgroup; -passdb backendldapsam, guest +passdb backendtdbsam os level33 preferred masteryes domain masteryes local masteryes securityuser -encrypt passwordsyes domain logonsyes logon path\\%N\profiles\%u logon driveH: @@ -441,58 +458,58 @@ in &smb.conf;. An example &smb.conf; for acting as a PDC can be found in the ex -The basic options shown above are explained as follows: +The basic options shown in are explained as follows: - passdb backend + passdb backend This contains all the user and group account information. Acceptable values for a PDC - are: smbpasswd, tdbsam, ldapsam. The 'guest' entry provides needed - default accounts. + are: smbpasswd, tdbsam, and ldapsam. The guest entry provides + default accounts and is included by default, there is no need to add it explicitly. - Where is is intended to use backup domain controllers (BDCs) the only logical choice is - to use LDAP so that the passdb backend can be distributed. The tdbsam and smbpasswd files - can not effectively be distributed and therefore should not be used. + Where use of backup Domain Controllers (BDCs) is intended, the only logical choice is + to use LDAP so the passdb backend can be distributed. The tdbsam and smbpasswd files + cannot effectively be distributed and therefore should not be used. - Domain Control Parameters + Domain Control Parameters The parameters os level, preferred master, domain master, security, - encrypt passwords, domain logons play a central role in assuring domain + encrypt passwords, and domain logons play a central role in assuring domain control and network logon support. - The os level must be set at or above a value of 32. A domain controller - must be the domain master browser, must be set in user mode security, - must support Microsoft compatible encrypted passwords, and must provide the network logon - service (domain logons). Encrypted passwords must be enabled, for more details on how - to do this, refer to the chapter on account information databases. + The os level must be set at or above a value of 32. A Domain Controller + must be the Domain Master Browser, must be set in user mode security, + must support Microsoft-compatible encrypted passwords, and must provide the network logon + service (domain logons). Encrypted passwords must be enabled. For more details on how + to do this, refer to . - Environment Parameters + Environment Parameters - The parameters logon path, logon home, logon drive, logon script are + The parameters logon path, logon home, logon drive, and logon script are environment support settings that help to facilitate client logon operations and that help to provide automated control facilities to ease network management overheads. Please refer to the man page information for these parameters. - NETLOGON Share + NETLOGON Share - The NETLOGON share plays a central role in domain logon and domain membership support. - This share is provided on all Microsoft domain controllers. It is used to provide logon + The NETLOGON share plays a central role in domain logon and Domain Membership support. + This share is provided on all Microsoft Domain Controllers. It is used to provide logon scripts, to store Group Policy files (NTConfig.POL), as well as to locate other common - tools that may be needed for logon processing. This is an essential share on a domain controller. + tools that may be needed for logon processing. This is an essential share on a Domain Controller. - PROFILE Share + PROFILE Share - This share is used to store user desktop profiles. Eash user must have a directory at the root - of this share. This directory must be write enabled for the user and must be globally read enabled. - Samba-3 has a VFS module called 'fake_permissions' that may be installed on this share. This will - allow a Samba administrator to make the directory read only to everyone. Of course this is useful + This share is used to store user desktop profiles. Each user must have a directory at the root + of this share. This directory must be write-enabled for the user and must be globally read-enabled. + Samba-3 has a VFS module called fake_permissions that may be installed on this share. This will + allow a Samba administrator to make the directory read-only to everyone. Of course this is useful only after the profile has been properly created. @@ -515,7 +532,7 @@ of operation. The following &smb.conf; parameters are the essentials alone: The additional parameters shown in the longer listing above just makes for -more complete explanation. +a more complete explanation. @@ -524,21 +541,21 @@ more complete explanation. Samba ADS Domain Control -Samba-3 is not, and can not act as, an Active Directory Server. It can not truly function as +Samba-3 is not, and cannot act as, an Active Directory Server. It cannot truly function as an Active Directory Primary Domain Controller. The protocols for some of the functionality -the Active Directory Domain Controllers has been partially implemented on an experimental -only basis. Please do NOT expect Samba-3 to support these protocols. Do not depend -on any such functionality either now or in the future. The Samba-Team may remove these -experimental features or may change their behaviour. This is mentioned for the benefit of those -who have discovered secret capabilities in samba-3 and who have asked when this functionality will be -completed. The answer is: Maybe or maybe never! +of Active Directory Domain Controllers has been partially implemented on an experimental +only basis. Please do not expect Samba-3 to support these protocols. Do not depend +on any such functionality either now or in the future. The Samba Team may remove these +experimental features or may change their behavior. This is mentioned for the benefit of those +who have discovered secret capabilities in Samba-3 and who have asked when this functionality will be +completed. The answer is maybe or maybe never! -To be sure: Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4 style -domain controllers have. Samba-3 does NOT have all the capabilities of Windows NT4, but it does have +To be sure, Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4-style +Domain Controllers have. Samba-3 does not have all the capabilities of Windows NT4, but it does have a number of features that Windows NT4 domain contollers do not have. In short, Samba-3 is not NT4 and it -is not Windows Server 200x and it is not an Active Directory server. We hope this is plain and simple +is not Windows Server 200x, it is not an Active Directory server. We hope this is plain and simple enough for all to understand. @@ -558,16 +575,16 @@ an integral part of the essential functionality that is provided by a Domain Con All Domain Controllers must run the netlogon service (domain logons in Samba). One Domain Controller must be configured with domain masterYes -(the Primary Domain Controller); on ALL Backup Domain Controllers domain masterNo +(the Primary Domain Controller); on all Backup Domain Controllers domain masterNo must be set. Example Configuration - - smb.conf for being a PDC - [global] + +smb.conf for being a PDC +[global] domain logonsYes domain master(Yes on PDC, No on BDCs) @@ -582,22 +599,22 @@ must be set. The Special Case of MS Windows XP Home Edition - -MS Windows XP Home Edition does not have the ability to join any type of Domain -security facility. Unlike, MS Windows 9x / Me, MS Windows XP Home Edition also completely -lacks the ability to log onto a network. - - To be completely clear: If you want MS Windows XP Home Edition to integrate with your -MS Windows NT4 or Active Directory Domain security understand - IT CAN NOT BE DONE. -Your only choice is to buy the upgrade pack from MS Windows XP Home Edition to +MS Windows NT4 or Active Directory Domain Security, understand it cannot be done. +The only option is to purchase the upgrade from MS Windows XP Home Edition to MS Windows XP Professional. + +MS Windows XP Home Edition does not have the ability to join any type of Domain +Security facility. Unlike MS Windows 9x/Me, MS Windows XP Home Edition also completely +lacks the ability to log onto a network. + + -Now that this has been said, please do NOT ask the mailing list, or email any of the -Samba-Team members with your questions asking how to make this work. It can't be done. +Now that this has been said, please do not ask the mailing list or email any of the +Samba Team members with your questions asking how to make this work. It can't be done. If it can be done, then to do so would violate your software license agreement with Microsoft, and we recommend that you do not do that. @@ -605,15 +622,15 @@ Microsoft, and we recommend that you do not do that. -The Special Case of Windows 9x / Me +The Special Case of Windows 9x/Me A domain and a workgroup are exactly the same in terms of network -browsing. The difference is that a distributable authentication +browsing. The difference is that a distributable authentication database is associated with a domain, for secure login access to a -network. Also, different access rights can be granted to users if they +network. Also, different access rights can be granted to users if they successfully authenticate against a domain logon server. Samba-3 does this -now in the same way that MS Windows NT/2K. +now in the same way as MS Windows NT/200x. @@ -621,23 +638,23 @@ The SMB client logging on to a domain has an expectation that every other server in the domain should accept the same authentication information. Network browsing functionality of domains and workgroups is identical and is explained in this documentation under the browsing discussions. -It should be noted, that browsing is totally orthogonal to logon support. +It should be noted that browsing is totally orthogonal to logon support. Issues related to the single-logon network model are discussed in this -section. Samba supports domain logons, network logon scripts, and user -profiles for MS Windows for workgroups and MS Windows 9X/ME clients +section. Samba supports domain logons, network logon scripts and user +profiles for MS Windows for workgroups and MS Windows 9X/ME clients, which are the focus of this section. When an SMB client in a domain wishes to logon, it broadcasts requests for a -logon server. The first one to reply gets the job, and validates its +logon server. The first one to reply gets the job, and validates its password using whatever mechanism the Samba administrator has installed. It is possible (but ill advised ) to create a domain where the user -database is not shared between servers, i.e. they are effectively workgroup -servers advertising themselves as participating in a domain. This +database is not shared between servers, i.e., they are effectively workgroup +servers advertising themselves as participating in a domain. This demonstrates how authentication is quite different from but closely involved with domains. @@ -649,13 +666,13 @@ the network and download their preferences, desktop and start menu. -MS Windows XP Home edition is NOT able to join a domain and does not permit +MS Windows XP Home edition is not able to join a domain and does not permit the use of domain logons. Before launching into the configuration instructions, it is -worthwhile to look at how a Windows 9x/ME client performs a logon: +worthwhile to look at how a Windows 9x/Me client performs a logon: @@ -663,7 +680,7 @@ worthwhile to look at how a Windows 9x/ME client performs a logon: The client broadcasts (to the IP broadcast address of the subnet it is in) a NetLogon request. This is sent to the NetBIOS name DOMAIN<#1c> at the - NetBIOS layer. The client chooses the first response it receives, which + NetBIOS layer. The client chooses the first response it receives, which contains the NetBIOS name of the logon server to use in the format of \\SERVER. @@ -671,39 +688,39 @@ worthwhile to look at how a Windows 9x/ME client performs a logon: - The client then connects to that server, logs on (does an SMBsessetupX) and + The client connects to that server, logs on (does an SMBsessetupX) and then connects to the IPC$ share (using an SMBtconX). - The client then does a NetWkstaUserLogon request, which retrieves the name + The client does a NetWkstaUserLogon request, which retrieves the name of the user's logon script. - The client then connects to the NetLogon share and searches for said script - and if it is found and can be read, is retrieved and executed by the client. + The client then connects to the NetLogon share and searches for said script. + If it is found and can be read, it is retrieved and executed by the client. After this, the client disconnects from the NetLogon share. - The client then sends a NetUserGetInfo request to the server, to retrieve + The client sends a NetUserGetInfo request to the server to retrieve the user's home share, which is used to search for profiles. Since the response to the NetUserGetInfo request does not contain much more than - the user's home share, profiles for Win9X clients MUST reside in the user + the user's home share, profiles for Windows 9x clients must reside in the user home directory. - The client then connects to the user's home share and searches for the + The client connects to the user's home share and searches for the user's profile. As it turns out, you can specify the user's home share as a sharename and path. For example, \\server\fred\.winprofile. If the profiles are found, they are implemented. @@ -712,7 +729,7 @@ worthwhile to look at how a Windows 9x/ME client performs a logon: - The client then disconnects from the user's home share, and reconnects to + The client then disconnects from the user's home share and reconnects to the NetLogon share and looks for CONFIG.POL, the policies file. If this is found, it is read and implemented. @@ -720,25 +737,25 @@ worthwhile to look at how a Windows 9x/ME client performs a logon: -The main difference between a PDC and a Windows 9x logon server configuration is that +The main difference between a PDC and a Windows 9x/Me logon server configuration is: - Password encryption is not required for a Windows 9x logon server. But note + Password encryption is not required for a Windows 9x/Me logon server. But note that beginning with MS Windows 98 the default setting is that plain-text password support is disabled. It can be re-enabled with the registry - changes that are documented in the chapter on Policies. + changes that are documented in . - Windows 9x/ME clients do not require and do not use machine trust accounts. + Windows 9x/Me clients do not require and do not use Machine Trust Accounts. -A Samba PDC will act as a Windows 9x logon server; after all, it does provide the -network logon services that MS Windows 9x / Me expect to find. +A Samba PDC will act as a Windows 9x/Me logon server; after all, it does provide the +network logon services that MS Windows 9x/Me expect to find. @@ -753,39 +770,35 @@ using a sniffer tool to examine network traffic. Security Mode and Master Browsers -There are a few comments to make in order to tie up some -loose ends. There has been much debate over the issue of whether -or not it is ok to configure Samba as a Domain Controller in security -modes other than USER. The only security mode -which will not work due to technical reasons is SHARE -mode security. DOMAIN and SERVER -mode security are really just a variation on SMB user level security. +There are a few comments to make in order to tie up some loose ends. There has been +much debate over the issue of whether it is okay to configure Samba as a Domain +Controller in security modes other than user. The only security mode that will +not work due to technical reasons is share-mode security. Domain and server mode +security are really just a variation on SMB User Level Security. Actually, this issue is also closely tied to the debate on whether -or not Samba must be the domain master browser for its workgroup -when operating as a DC. While it may technically be possible +Samba must be the Domain Master Browser for its workgroup +when operating as a DC. While it may technically be possible to configure a server as such (after all, browsing and domain logons are two distinctly different functions), it is not a good idea to do -so. You should remember that the DC must register the DOMAIN<#1b> NetBIOS -name. This is the name used by Windows clients to locate the DC. +so. You should remember that the DC must register the DOMAIN<#1b> NetBIOS +name. This is the name used by Windows clients to locate the DC. Windows clients do not distinguish between the DC and the DMB. -A DMB is a Domain Master Browser - see Domain Master Browser. -For this reason, it is very wise to configure the Samba DC as the DMB. +A DMB is a Domain Master Browser &smbmdash; see . +For this reason, it is wise to configure the Samba DC as the DMB. -Now back to the issue of configuring a Samba DC to use a mode other -than securityuser. If a Samba host is configured to use -another SMB server or DC in order to validate user connection -requests, then it is a fact that some other machine on the network -(the password server) knows more about the user than the Samba host. -99% of the time, this other host is a domain controller. Now -in order to operate in domain mode security, the workgroup parameter -must be set to the name of the Windows NT domain (which already -has a domain controller). If the domain does NOT already have a Domain Controller -then you do not yet have a Domain! +Now back to the issue of configuring a Samba DC to use a mode other than +securityuser. If a Samba host is +configured to use another SMB server or DC in order to validate user connection requests, +it is a fact that some other machine on the network (the password server) +knows more about the user than the Samba host. About 99% of the time, this other host is +a Domain Controller. Now to operate in domain mode security, the workgroup +parameter must be set to the name of the Windows NT domain (which already has a Domain Controller). +If the domain does not already have a Domain Controller, you do not yet have a Domain. @@ -803,61 +816,63 @@ This is the only officially supported mode of operation. Common Errors - '$' cannot be included in machine name + <quote>$</quote> Cannot Be Included in Machine Name -A 'machine account', (typically) stored in /etc/passwd, -takes the form of the machine name with a '$' appended. FreeBSD (and other BSD -systems?) won't create a user with a '$' in their name. +A machine account, typically stored in /etc/passwd, takes the form of the machine +name with a $ appended. FreeBSD (and other BSD systems) will not create a user with a +$ in the name. The problem is only in the program used to make the entry. Once made, it works perfectly. -Create a user without the '$'. Then use vipw to edit the entry, adding -the '$'. Or create the whole entry with vipw if you like; make sure you use a unique User ID! +Create a user without the $. Then use vipw to edit the entry, adding +the $. Or create the whole entry with vipw if you like; make sure you use a unique user login ID. +The machine account must have the exact name that the workstation has. + -The UNIX tool vipw is a common tool for directly editting the /etc/passwd file. +The UNIX tool vipw is a common tool for directly editing the /etc/passwd file. - Joining domain fails because of existing machine account +Joining Domain Fails Because of Existing Machine Account -I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account. - -This happens if you try to create a machine trust account from the -machine itself and already have a connection (e.g. mapped drive) -to a share (or IPC$) on the Samba PDC. The following command -will remove all network drive connections: +I get told, `You already have a connection to the Domain....' or `Cannot join domain, the +credentials supplied conflict with an existing set...' when creating a Machine Trust Account. + +This happens if you try to create a Machine Trust Account from the machine itself and already have a +connection (e.g., mapped drive) to a share (or IPC$) on the Samba PDC. The following command +will remove all network drive connections: &dosprompt;net use * /d + -Further, if the machine is already a 'member of a workgroup' that +Further, if the machine is already a member of a workgroup that is the same name as the domain you are joining (bad idea) you will -get this message. Change the workgroup name to something else, it +get this message. Change the workgroup name to something else, it does not matter what, reboot, and try again. -The system can not log you on (C000019B).... +The System Cannot Log You On (C000019B) I joined the domain successfully but after upgrading -to a newer version of the Samba code I get the message, The system -can not log you on (C000019B), Please try again or consult your -system administrator when attempting to logon. +to a newer version of the Samba code I get the message, `The system +cannot log you on (C000019B), Please try again or consult your +system administrator when attempting to logon.' +SID This occurs when the domain SID stored in the secrets.tdb database is changed. The most common cause of a change in domain SID is when the domain name and/or the server name (NetBIOS name) is changed. @@ -867,7 +882,7 @@ SID may be reset using either the net or rpcclient utilities. -The reset or change the domain SID you can use the net command as follows: +To reset or change the domain SID you can use the net command as follows: &rootprompt;net getlocalsid 'OLDNAME' @@ -876,8 +891,8 @@ The reset or change the domain SID you can use the net command as follows: -Workstation machine trust accounts work only with the Domain (or network) SID. If this SID changes -then domain members (workstations) will not be able to log onto the domain. The original Domain SID +Workstation Machine Trust Accounts work only with the Domain (or network) SID. If this SID changes +Domain Members (workstations) will not be able to log onto the domain. The original Domain SID can be recovered from the secrets.tdb file. The alternative is to visit each workstation to re-join it to the domain. @@ -885,86 +900,88 @@ it to the domain. - The machine trust account not accessible +The Machine Trust Account Is Not Accessible - When I try to join the domain I get the message The machine account -for this computer either does not exist or is not accessible. What's +When I try to join the domain I get the message, `The machine account +for this computer either does not exist or is not accessible'. What's wrong? -This problem is caused by the PDC not having a suitable machine trust account. +This problem is caused by the PDC not having a suitable Machine Trust Account. If you are using the add machine script method to create accounts then this would indicate that it has not worked. Ensure the domain admin user system is working. -Alternatively if you are creating account entries manually then they +Alternately, if you are creating account entries manually then they have not been created correctly. Make sure that you have the entry -correct for the machine trust account in smbpasswd file on the Samba PDC. +correct for the Machine Trust Account in smbpasswd file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, make sure that the account name is the machine NetBIOS name -with a '$' appended to it ( i.e. computer_name$ ). There must be an entry +with a $ appended to it (i.e., computer_name$). There must be an entry in both /etc/passwd and the smbpasswd file. -Some people have also reported -that inconsistent subnet masks between the Samba server and the NT -client can cause this problem. Make sure that these are consistent -for both client and server. +Some people have also reported that inconsistent subnet masks between the Samba server and the NT +client can cause this problem. Make sure that these are consistent for both client and server. - Account disabled +Account Disabled - When I attempt to login to a Samba Domain from a NT4/W2K workstation, - I get a message about my account being disabled. +When I attempt to login to a Samba Domain from a NT4/W200x workstation, +I get a message about my account being disabled. Enable the user accounts with smbpasswd -e username -, this is normally done as an account is created. +. This is normally done as an account is created. - Domain Controller Unavailable +Domain Controller Unavailable - Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable" +Until a few minutes after Samba has started, clients get the error `Domain Controller Unavailable' - - A domain controller has to announce on the network who it is. This usually takes a while. - + +A Domain Controller has to announce its role on the network. This usually takes a while. Be patient for up to fifteen minutes, +then try again. + - Can not log onto domain member workstation after joining domain - - After successfully joining the domain user logons fail with one of two messages: - - One to the effect that the domain controller can not be found, the other claiming that the - account does not exist in the domain or that the password is incorrect. - - This may be due to incompatible settings between - the Windows client and the Samba-3 server for schannel (secure channel) settings - or smb signing settings. Check your samba settings for - client schannel, server schannel, client signing, server signing by executing: - testparm -v | more and looking for the value of these parameters. - +Cannot Log onto Domain Member Workstation After Joining Domain + + +schannel +signing +After successfully joining the domain, user logons fail with one of two messages: one to the +effect that the Domain Controller cannot be found; the other claims that the account does not +exist in the domain or that the password is incorrect. This may be due to incompatible +settings between the Windows client and the Samba-3 server for schannel +(secure channel) settings or smb signing settings. Check your Samba +settings for client schannel, server schannel, client signing, server signing +by executing: + +testparm -v | more and looking for the value of these parameters. + + - - Also use the Microsoft Management Console - Local Security Settings. This tool is available from the - Control Panel. The Policy settings are found in the Local Policies / Securty Options area and are prefixed by - Secure Channel: ..., and Digitally sign .... - + +Also use the Microsoft Management Console &smbmdash; Local Security Settings. This tool is available from the +Control Panel. The Policy settings are found in the Local Policies/Securty Options area and are prefixed by +Secure Channel: ..., and Digitally sign ..... + - - It is important that these be set consistently with the Samba-3 server settings. - + +It is important that these be set consistently with the Samba-3 server settings. + diff --git a/docs/docbook/projdoc/ServerType.xml b/docs/docbook/projdoc/ServerType.xml index 32a5103150..c7ee63cef2 100644 --- a/docs/docbook/projdoc/ServerType.xml +++ b/docs/docbook/projdoc/ServerType.xml @@ -9,22 +9,22 @@ This chapter provides information regarding the types of server that Samba may be -configured to be. A Microsoft network administrator who wishes to migrate to or to -use Samba will want to know what, within a Samba context, terms familiar to MS Windows -administrator mean. This means that it is essential also to define how critical security -modes function BEFORE we get into the details of how to configure the server itself. +configured to be. A Microsoft network administrator who wishes to migrate to or +use Samba will want to know the meaning, within a Samba context, of terms familiar to MS Windows +administrator. This means that it is essential also to define how critical security +modes function before we get into the details of how to configure the server itself. The chapter provides an overview of the security modes of which Samba is capable -and how these relate to MS Windows servers and clients. +and how they relate to MS Windows servers and clients. -A question often asked is, "Why would I want to use Samba?" Most chapters contain a section +A question often asked is, Why would I want to use Samba? Most chapters contain a section that highlights features and benefits. We hope that the information provided will help to answer this question. Be warned though, we want to be fair and reasonable, so not all -features are positive towards Samba so the benefit may be on the side of our competition. +features are positive towards Samba. The benefit may be on the side of our competition. @@ -33,14 +33,14 @@ features are positive towards Samba so the benefit may be on the side of our com Two men were walking down a dusty road, when one suddenly kicked up a small red stone. It hurt his toe and lodged in his sandal. He took the stone out and cursed it with a passion -and fury fitting his anguish. The other looked at the stone and said, that is a garnet - I -can turn that into a precious gem and some day it will make a princess very happy! +and fury befitting his anguish. The other looked at the stone and said, This is a garnet. +I can turn that into a precious gem and some day it will make a princess very happy! The moral of this tale: Two men, two very different perspectives regarding the same stone. Like it or not, Samba is like that stone. Treat it the right way and it can bring great -pleasure, but if you are forced upon it and have no time for its secrets then it can be +pleasure, but if you are forced to use it and have no time for its secrets, then it can be a source of discomfort. @@ -48,26 +48,25 @@ a source of discomfort. Samba started out as a project that sought to provide interoperability for MS Windows 3.x clients with a UNIX server. It has grown up a lot since its humble beginnings and now provides features and functionality fit for large scale deployment. It also has some warts. In sections -like this one we will tell of both. +like this one we tell of both. -So now, what are the benefits of features mentioned in this chapter? +So, what are the benefits of features mentioned in this chapter? - Samba-3 can replace an MS Windows NT4 Domain Controller + Samba-3 can replace an MS Windows NT4 Domain Controller. - Samba-3 offers excellent interoperability with MS Windows NT4 - style domains as well as natively with Microsoft Active - Directory domains. + Samba-3 offers excellent interoperability with MS Windows NT4-style + domains as well as natively with Microsoft Active Directory domains. - Samba-3 permits full NT4 style Interdomain Trusts + Samba-3 permits full NT4-style Interdomain Trusts. @@ -76,7 +75,7 @@ So now, what are the benefits of features mentioned in this chapter? - Samba-3 permits use of multiple account database backends + Samba-3 permits use of multiple account database backends. @@ -93,24 +92,27 @@ So now, what are the benefits of features mentioned in this chapter? Server Types -Administrators of Microsoft networks often refer to three + + +Server Type +Administrators of Microsoft networks often refer to three different type of servers: Domain Controller - Primary Domain Controller - Backup Domain Controller - ADS Domain Controller + Primary Domain Controller + Backup Domain Controller + ADS Domain Controller Domain Member Server - Active Directory Domain Server - NT4 Style Domain Domain Server + Active Directory Domain Server + NT4 Style Domain Domain Server - Stand Alone Server + Stand-alone Server @@ -125,52 +127,53 @@ presented. Samba Security Modes + -In this section the function and purpose of Samba's security +Security Mode +security +In this section the function and purpose of Samba's security modes are described. An accurate understanding of how Samba implements each security mode as well as how to configure MS Windows clients for each mode will significantly reduce user complaints and administrator heartache. -In the SMB/CIFS networking world, there are only two types of security: USER Level -and SHARE Level. We refer to these collectively as security levels. In implementing these two security levels Samba provides flexibilities -that are not available with Microsoft Windows NT4 / 200x servers. Samba knows of five (5) -ways that allow the security levels to be implemented. In actual fact, Samba implements -SHARE Level security only one way, but has four ways of implementing -USER Level security. Collectively, we call the Samba implementations -Security Modes. These are: SHARE, USER, DOMAIN, -ADS, and SERVER -modes. They are documented in this chapter. +In the SMB/CIFS networking world, there are only two types of security: User Level +and Share Level. We refer to these collectively as security levels. +In implementing these two security levels, Samba provides flexibilities +that are not available with Microsoft Windows NT4/200x servers. In actual fact, Samba implements +Share Level security only one way, but has four ways of implementing +User Level security. Collectively, we call the Samba implementations +Security Modes. They are known as: SHARE, USER, +DOMAIN, ADS, and SERVER modes. +They are documented in this chapter. - A SMB server tells the client at startup what security level -it is running. There are two options: share level and -user level. Which of these two the client receives affects -the way the client then tries to authenticate itself. It does not directly affect -(to any great extent) the way the Samba server does security. This may sound strange, -but it fits in with the client/server approach of SMB. In SMB everything is initiated -and controlled by the client, and the server can only tell the client what is -available and whether an action is allowed. +An SMB server tells the client at startup what security level it is running. There are two options: +Share Level and User Level. Which of these two the client receives affects the way the client then +tries to authenticate itself. It does not directly affect (to any great extent) the way the Samba +server does security. This may sound strange, but it fits in with the client/server approach of SMB. +In SMB everything is initiated and controlled by the client, and the server can only tell the client +what is available and whether an action is allowed. User Level Security -We will describe user level security first, as it's simpler. -In user level security, the client will send a -session setup command directly after the protocol negotiation. -This contains a username and password. The server can either accept or reject that -username/password combination. Note that at this stage the server has no idea what +We will describe User Level Security first, as its simpler. +In User Level Security, the client will send a +session setup request directly following protocol negotiation. +This request provides a username and password. The server can either accept or reject that +username/password combination. At this stage the server has no idea what share the client will eventually try to connect to, so it can't base the accept/reject on anything other than: -The username/password -The name of the client machine +the username/password. +the name of the client machine. @@ -191,7 +194,7 @@ authentication contexts in this way (WinDD is an example of an application that Example Configuration -The &smb.conf; parameter that sets User Level Security is: +The &smb.conf; parameter that sets user level security is: @@ -199,7 +202,7 @@ The &smb.conf; parameter that sets User Level Security is: -This is the default setting since samba-2.2.x. +This is the default setting since Samba-2.2.x. @@ -209,31 +212,30 @@ This is the default setting since samba-2.2.x. Share Level Security -Ok, now for share level security. In share level security, the client authenticates -itself separately for each share. It will send a password along with each -tree connection (share mount). It does not explicitly send a +In Share Level security, the client authenticates +itself separately for each share. It sends a password along with each +tree connection (share mount). It does not explicitly send a username with this operation. The client expects a password to be associated with each share, independent of the user. This means that Samba has to work out what username the client probably wants to use. It is never explicitly sent the username. Some commercial SMB servers such as NT actually associate passwords directly with -shares in share level security, but Samba always uses the unix authentication scheme +shares in Share Level security, but Samba always uses the UNIX authentication scheme where it is a username/password pair that is authenticated, not a share/password pair. -To gain understanding of the MS Windows networking parallels to this, one should think +To understand the MS Windows networking parallels, one should think in terms of MS Windows 9x/Me where one can create a shared folder that provides read-only or full access, with or without a password. -Many clients send a session setup even if the server is in share -level security. They normally send a valid username but no password. Samba records -this username in a list of possible usernames. When the client -then does a tree connection it also adds to this list the name +Many clients send a session setup even if the server is in Share Level security. They +normally send a valid username but no password. Samba records this username in a list +of possible usernames. When the client then does a tree connection it also adds to this list the name of the share they try to connect to (useful for home directories) and any users -listed in the user &smb.conf; line. The password is then checked -in turn against these possible usernames. If a match is found +listed in the user parameter in the &smb.conf; file. +The password is then checked in turn against these possible usernames. If a match is found then the client is authenticated as that user. @@ -241,7 +243,7 @@ then the client is authenticated as that user. Example Configuration -The &smb.conf; parameter that sets Share Level Security is: +The &smb.conf; parameter that sets Share Level security is: @@ -249,8 +251,8 @@ The &smb.conf; parameter that sets Share Level Security is: -Please note that there are reports that recent MS Windows clients do not like to work -with share mode security servers. You are strongly discouraged from using share level security. +There are reports that recent MS Windows clients do not like to work +with share mode security servers. You are strongly discouraged from using Share Level security. @@ -260,9 +262,11 @@ with share mode security servers. You are strongly discouraged from using share Domain Security Mode (User Level Security) +Domain Member When Samba is operating in securitydomain mode, -the Samba server has a domain security trust account (a machine account) and will cause -all authentication requests to be passed through to the domain controllers. +the Samba server has a domain security trust account (a machine account) and causes +all authentication requests to be passed through to the Domain Controllers. +In other words, this configuration makes the Samba server a Domain Member server. @@ -271,7 +275,9 @@ all authentication requests to be passed through to the domain controllers. Samba as a Domain Member Server + +Server TypeDomain Member This method involves addition of the following parameters in the &smb.conf; file: @@ -283,21 +289,24 @@ This method involves addition of the following parameters in the &smb.conf; file In order for this method to work, the Samba server needs to join the MS Windows NT security domain. This is done as follows: +netrpc +Domain Memberjoining + - On the MS Windows NT domain controller, using + On the MS Windows NT Domain Controller, using the Server Manager, add a machine account for the Samba server. - Next, on the UNIX/Linux system execute: + On the UNIX/Linux system execute: &rootprompt;net rpc join -U administrator%password -Samba-2.2.4 and later can auto-join a Windows NT4 style Domain just by executing: +Samba-2.2.4 and later can auto-join a Windows NT4-style Domain just by executing: &rootprompt;smbpasswd -j DOMAIN_NAME -r PDC_NAME \ -U Administrator%password @@ -314,18 +323,18 @@ It is not necessary with Samba-3 to specify the DOMAIN_NAME Use of this mode of authentication does require there to be a standard UNIX account for each user in order to assign a UID once the account has been authenticated by -the remote Windows DC. This account can be blocked to prevent logons by clients other than +the remote Windows DC. This account can be blocked to prevent logons by clients other than MS Windows through means such as setting an invalid shell in the /etc/passwd entry. An alternative to assigning UIDs to Windows users on a Samba member server is -presented in the chapter about winbind. +presented in . - For more information of being a domain member, see the chapter about domain membership. +For more information regarding Domain Membership, see . @@ -335,11 +344,11 @@ presented in the chapter about winbind. ADS Security Mode (User Level Security) -Both Samba 2.2 and 3.0 can join an Active Directory domain. This is +Both Samba-2.2, and Samba-3 can join an Active Directory domain. This is possible if the domain is run in native mode. Active Directory in -native mode perfectly allows NT4-style domain members. This is contrary to -popular belief. The only thing that Active Directory in native mode -prohibits is Backup Domain Controllers running NT4. +native mode perfectly allows NT4-style Domain Members. This is contrary to +popular belief. Active Directory in native mode prohibits only the use of +Backup Domain Controllers running MS Windows NT4. @@ -347,7 +356,7 @@ If you are using Active Directory, starting with Samba-3 you can join as a native AD member. Why would you want to do that? Your security policy might prohibit the use of NT-compatible authentication protocols. All your machines are running Windows 2000 -and above and all use Kerberos. In this case Samba as a NT4-style +and above and all use Kerberos. In this case Samba as an NT4-style domain would still require NT-compatible authentication data. Samba in AD-member mode can accept Kerberos tickets. @@ -365,11 +374,11 @@ The following parameter may be required: -ads serveryour.kerberos.server +password serveryour.kerberos.server -Please refer to the chapter on domain membership +Please refer to and for more information regarding this configuration option. @@ -380,34 +389,34 @@ for more information regarding this configuration option. Server Security (User Level Security) -Server security mode is a left over from the time when Samba was not capable of acting -as a domain member server. It is highly recommended NOT to use this feature. Server -security mode has many draw backs. The draw backs include: +Server Security Mode is left over from the time when Samba was not capable of acting +as a Domain Member server. It is highly recommended not to use this feature. Server +security mode has many drawbacks that include: - Potential Account Lockout on MS Windows NT4/200x password servers - Lack of assurance that the password server is the one specified - Does not work with Winbind, particularly needed when storing profiles remotely + Potential Account Lockout on MS Windows NT4/200x password servers. + Lack of assurance that the password server is the one specified. + Does not work with Winbind, which is particularly needed when storing profiles remotely. This mode may open connections to the password server, and keep them open for extended periods. - Security on the Samba server breaks badly when the remote password server suddenly shuts down + Security on the Samba server breaks badly when the remote password server suddenly shuts down. With this mode there is NO security account in the domain that the password server belongs to for the Samba server. -In server security mode the Samba server reports to the client that it is in user level -security. The client then does a session setup as described earlier. +In Server Security Mode the Samba server reports to the client that it is in User Level +security. The client then does a session setup as described earlier. The Samba server takes the username/password that the client sends and attempts to login to the password server by sending exactly the same username/password that -it got from the client. If that server is in user level security and accepts the password, -then Samba accepts the clients connection. This allows the Samba server to use another SMB +it got from the client. If that server is in User Level Security and accepts the password, +then Samba accepts the client's connection. This allows the Samba server to use another SMB server as the password server. -You should also note that at the very start of all this, where the server tells the client +You should also note that at the start of all this where the server tells the client what security level it is in, it also tells the client if it supports encryption. If it -does then it supplies the client with a random cryptkey. The client will then send all +does, it supplies the client with a random cryptkey. The client will then send all passwords in encrypted form. Samba supports this type of encryption by default. @@ -416,24 +425,24 @@ The parameter securityserveruser mode but actually passes off all authentication requests to another user mode server. This requires an additional parameter password server that points to the real authentication server. -That real authentication server can be another Samba server or can be a Windows NT server, -the later natively capable of encrypted password support. +The real authentication server can be another Samba server, or it can be a Windows NT server, +the latter being natively capable of encrypted password support. -When Samba is running in server security mode it is essential that +When Samba is running in Server Security Mode it is essential that the parameter password server is set to the precise NetBIOS machine -name of the target authentication server. Samba can NOT determine this from NetBIOS name -lookups because the choice of the target authentication server is arbitrary and can not +name of the target authentication server. Samba cannot determine this from NetBIOS name +lookups because the choice of the target authentication server is arbitrary and cannot be determined from a domain name. In essence, a Samba server that is in -server security mode is operating in what used to be known as +Server Security Mode is operating in what used to be known as workgroup mode. Example Configuration -Using MS Windows NT as an authentication server +Using MS Windows NT as an Authentication Server @@ -448,13 +457,13 @@ This method involves the additions of the following parameters in the &smb.conf; -There are two ways of identifying whether or not a username and password pair was valid. +There are two ways of identifying whether or not a username and password pair is valid. One uses the reply information provided as part of the authentication messaging process, the other uses just an error code. -The down-side of this mode of configuration is the fact that for security reasons Samba +The downside of this mode of configuration is the fact that for security reasons Samba will send the password server a bogus username and a bogus password and if the remote server fails to reject the username and password pair then an alternative mode of identification of validation is used. Where a site uses password lock out after a @@ -462,8 +471,8 @@ certain number of failed authentication attempts this will result in user lockou -Use of this mode of authentication does require there to be a standard UNIX account -for the user, though this account can be blocked to prevent logons by non-SMB/CIFS clients. +Use of this mode of authentication requires a standard UNIX account for the user. +This account can be blocked to prevent logons by non-SMB/CIFS clients. @@ -472,13 +481,13 @@ for the user, though this account can be blocked to prevent logons by non-SMB/CI -Password checking +Password Checking MS Windows clients may use encrypted passwords as part of a challenge/response -authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or clear text strings for simple -password based authentication. It should be realized that with the SMB protocol, -the password is passed over the network either in plain text or encrypted, but +authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or cleartext strings for simple +password-based authentication. It should be realized that with the SMB protocol, +the password is passed over the network either in plain-text or encrypted, but not both in the same authentication request. @@ -488,14 +497,14 @@ is encrypted in two ways: - An MD4 hash of the UNICODE of the password - string. This is known as the NT hash. + An MD4 hash of the unicode of the password + string. This is known as the NT hash. The password is converted to upper case, - and then padded or truncated to 14 bytes. This string is + and then padded or truncated to 14 bytes. This string is then appended with 5 bytes of NULL characters and split to - form two 56 bit DES keys to encrypt a "magic" 8 byte value. + form two 56-bit DES keys to encrypt a magic 8-byte value. The resulting 16 bytes form the LanMan hash. @@ -516,17 +525,17 @@ a cached copy of the password. When Microsoft changed the default password mode, support was dropped for caching -of the plain text password. This means that when the registry parameter is changed -to re-enable use of plain text passwords it appears to work, but when a dropped -service connection mapping attempts to revalidate it will fail if the remote -authentication server does not support encrypted passwords. This means that it -is definitely not a good idea to re-enable plain text password support in such clients. +of the plain-text password. This means that when the registry parameter is changed +to re-enable use of plain-text passwords it appears to work, but when a dropped +service connection mapping attempts to revalidate, this will fail if the remote +authentication server does not support encrypted passwords. It is definitely not +a good idea to re-enable plain-text password support in such clients. -The following parameters can be used to work around the issue of Windows 9x clients -upper casing usernames and password before transmitting them to the SMB server -when using clear text authentication. +The following parameters can be used to work around the issue of Windows 9x/Me clients +upper-casing usernames and passwords before transmitting them to the SMB server +when using cleartext authentication: @@ -535,27 +544,27 @@ when using clear text authentication. -By default Samba will lower case the username before attempting to lookup the user -in the database of local system accounts. Because UNIX usernames conventionally -only contain lower-case character, the username level parameter +By default Samba will convert to lower case the username before attempting to lookup the user +in the database of local system accounts. Because UNIX usernames conventionally +only contain lower-case characters, the username level parameter is rarely needed. However, passwords on UNIX systems often make use of mixed-case characters. -This means that in order for a user on a Windows 9x client to connect to a Samba -server using clear text authentication, the password level -must be set to the maximum number of upper case letters which could -appear in a password. Note that if the server OS uses the traditional DES version +This means that in order for a user on a Windows 9x/Me client to connect to a Samba +server using cleartext authentication, the password level +must be set to the maximum number of upper case letters that could +appear in a password. Note that if the server OS uses the traditional DES version of crypt(), a password level of 8 will result in case -insensitive passwords as seen from Windows users. This will also result in longer +insensitive passwords as seen from Windows users. This will also result in longer login times as Samba has to compute the permutations of the password string and try them one by one until a match is located (or all combinations fail). The best option to adopt is to enable support for encrypted passwords wherever -Samba is used. Most attempts to apply the registry change to re-enable plain text +Samba is used. Most attempts to apply the registry change to re-enable plain-text passwords will eventually lead to user complaints and unhappiness. @@ -565,48 +574,48 @@ passwords will eventually lead to user complaints and unhappiness. Common Errors -We all make mistakes. It is Ok to make mistakes, so long as they are made in the right places -and at the right time. A mistake that causes lost productivity is seldom tolerated. A mistake +We all make mistakes. It is okay to make mistakes, as long as they are made in the right places +and at the right time. A mistake that causes lost productivity is seldom tolerated, however a mistake made in a developmental test lab is expected. Here we look at common mistakes and misapprehensions that have been the subject of discussions -on the Samba mailing lists. Many of these are avoidable by doing you homework before attempting -a Samba implementation. Some are the result of misunderstanding of the English language. The -English language has many turns of phrase that are potentially vague and may be highly confusing +on the Samba mailing lists. Many of these are avoidable by doing your homework before attempting +a Samba implementation. Some are the result of a misunderstanding of the English language. The +English language, which has many phrases that are potentially vague and may be highly confusing to those for whom English is not their native tongue. -What makes Samba a SERVER? +What Makes Samba a Server? -To some the nature of the Samba security mode is very obvious, but entirely +To some the nature of the Samba security mode is obvious, but entirely wrong all the same. It is assumed that securityserver means that Samba -will act as a server. Not so! See above - this setting means that Samba will try -to use another SMB server as its source of user authentication alone. +will act as a server. Not so! This setting means that Samba will try +to use another SMB server as its source for user authentication alone. -What makes Samba a Domain Controller? +What Makes Samba a Domain Controller? -The &smb.conf; parameter securitydomain does NOT really make Samba behave -as a Domain Controller! This setting means we want Samba to be a domain member! +The &smb.conf; parameter securitydomain does not really make Samba behave +as a Domain Controller. This setting means we want Samba to be a Domain Member. -What makes Samba a Domain Member? +What Makes Samba a Domain Member? -Guess! So many others do. But whatever you do, do NOT think that securityuser -makes Samba act as a domain member. Read the manufacturers manual before the warranty expires! See -the chapter about domain membership for more information. +Guess! So many others do. But whatever you do, do not think that securityuser +makes Samba act as a Domain Member. Read the manufacturer's manual before the warranty expires. See + for more information. @@ -617,15 +626,16 @@ makes Samba act as a domain member. Read the manufacturers manual before the war -Why does server_validate() simply give up rather than re-establishing its connection to the +Why does server_validate() simply give up rather than re-establish its connection to the password server? Though I am not fluent in the SMB protocol, perhaps the cluster server process passes along to its client workstation the session key it receives from the password server, which means the password hashes submitted by the client would not work on a subsequent -connection, whose session key would be different. So server_validate() must give up. +connection whose session key would be different. So server_validate() must give up. - Indeed. That's why securityserver is at best a nasty hack. Please use securitydomain. +Indeed. That's why securityserver +is at best a nasty hack. Please use securitydomain; securityserver mode is also known as pass-through authentication. diff --git a/docs/docbook/projdoc/Speed.xml b/docs/docbook/projdoc/Speed.xml index f462bb8a8a..987915acd2 100644 --- a/docs/docbook/projdoc/Speed.xml +++ b/docs/docbook/projdoc/Speed.xml @@ -19,42 +19,42 @@ The Samba server uses TCP to talk to the client. Thus if you are -trying to see if it performs well you should really compare it to +trying to see if it performs well, you should really compare it to programs that use the same protocol. The most readily available -programs for file transfer that use TCP are ftp or another TCP based +programs for file transfer that use TCP are ftp or another TCP-based SMB server. -If you want to test against something like a NT or WfWg server then +If you want to test against something like an NT or Windows for Workgroups server, then you will have to disable all but TCP on either the client or -server. Otherwise you may well be using a totally different protocol +server. Otherwise, you may well be using a totally different protocol (such as NetBEUI) and comparisons may not be valid. -Generally you should find that Samba performs similarly to ftp at raw +Generally, you should find that Samba performs similarly to ftp at raw transfer speed. It should perform quite a bit faster than NFS, -although this very much depends on your system. +although this depends on your system. Several people have done comparisons between Samba and Novell, NFS or -WinNT. In some cases Samba performed the best, in others the worst. I -suspect the biggest factor is not Samba vs some other system but the +Windows NT. In some cases Samba performed the best, in others the worst. I +suspect the biggest factor is not Samba versus some other system, but the hardware and drivers used on the various systems. Given similar -hardware Samba should certainly be competitive in speed with other +hardware, Samba should certainly be competitive in speed with other systems. -Socket options +Socket Options There are a number of socket options that can greatly affect the -performance of a TCP based server like Samba. +performance of a TCP-based server like Samba. @@ -68,29 +68,29 @@ to set these and gives recommendations. -Getting the socket options right can make a big difference to your +Getting the socket options correct can make a big difference to your performance, but getting them wrong can degrade it by just as much. The correct settings are very dependent on your local network. -The socket option TCP_NODELAY is the one that seems to make the -biggest single difference for most networks. Many people report that -adding socket optionsTCP_NODELAY doubles the read -performance of a Samba drive. The best explanation I have seen for this is -that the Microsoft TCP/IP stack is slow in sending tcp ACKs. +The socket option TCP_NODELAY is the one that seems to make the biggest single difference +for most networks. Many people report that adding +socket optionsTCP_NODELAY +doubles the read performance of a Samba drive. The best explanation I have seen for +this is that the Microsoft TCP/IP stack is slow in sending TCP ACKs. -Read size +Read Size The option read size affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and -SMBreadbraw) is larger than this value then the server begins writing +SMBreadbraw) is larger than this value, then the server begins writing the data before it has received the whole packet from the network, or in the case of SMBreadbraw, it begins writing to the network before all the data has been read from disk. @@ -98,13 +98,13 @@ all the data has been read from disk. This overlapping works best when the speeds of disk and network access -are similar, having very little effect when the speed of one is much +are similar, having little effect when the speed of one is much greater than the other. -The default value is 16384, but very little experimentation has been -done yet to determine the optimal value, and it is likely that the best +The default value is 16384, but little experimentation has been +done as yet to determine the optimal value, and it is likely that the best value will vary greatly between systems anyway. A value over 65536 is pointless and will cause you to allocate memory unnecessarily. @@ -112,73 +112,69 @@ pointless and will cause you to allocate memory unnecessarily. -Max xmit +Max Xmit At startup the client and server negotiate a maximum transmit size, which limits the size of nearly all SMB commands. You can set the maximum size that Samba will negotiate using the max xmit option in &smb.conf;. Note that this is the maximum size of SMB requests that -Samba will accept, but not the maximum size that the *client* will accept. +Samba will accept, but not the maximum size that the client will accept. The client maximum receive size is sent to Samba by the client and Samba -honours this limit. +honors this limit. It defaults to 65536 bytes (the maximum), but it is possible that some clients may perform better with a smaller transmit unit. Trying values of less than 2048 is likely to cause severe problems. - - - In most cases the default is the best option. -Log level +Log Level If you set the log level (also known as debug level) higher than 2 then you may suffer a large drop in performance. This is because the -server flushes the log file after each operation, which can be very +server flushes the log file after each operation, which can be quite expensive. -Read raw +Read Raw -The read raw operation is designed to be an optimised, low-latency +The read raw operation is designed to be an optimized, low-latency file read operation. A server may choose to not support it, -however. and Samba makes support for read raw optional, with it +however, and Samba makes support for read raw optional, with it being enabled by default. -In some cases clients don't handle read raw very well and actually +In some cases clients do not handle read raw very well and actually get lower performance using it than they get using the conventional read operations. So you might like to try read rawno and see what happens on your -network. It might lower, raise or not affect your performance. Only +network. It might lower, raise or not effect your performance. Only testing can really tell. -Write raw +Write Raw -The write raw operation is designed to be an optimised, low-latency -file write operation. A server may choose to not support it, -however. and Samba makes support for write raw optional, with it -being enabled by default. +The write raw operation is designed to be an optimized, low-latency +file write operation. A server may choose to not support it, however, and Samba makes support for +write raw optional, with it being enabled by default. @@ -199,37 +195,45 @@ the lowest practical password level -Client tuning +Client Tuning Often a speed problem can be traced to the client. The client (for example Windows for Workgroups) can often be tuned for better TCP performance. Check the sections on the various clients in -Samba and Other Clients. +. -Samba performance problem due changing kernel +Samba Performance Problem Due to Changing Linux Kernel + + +A user wrote the following to the mailing list: + + + +I am running Gentoo on my server and Samba 2.2.8a. Recently +I changed kernel version from linux-2.4.19-gentoo-r10 to +linux-2.4.20-wolk4.0s. And now I have a performance issue with Samba. +Many of you will probably say, Move to vanilla sources! +Well, I tried that and it didn't work. I have a 100mb LAN and two computers (Linux and +Windows 2000). The Linux server shares directories with DivX files, the client +(Windows 2000) plays them via LAN. Before when I was running the 2.4.19 kernel +everything was fine, but now movies freeze and stop. I tried moving +files between the server and Windows and it is terribly slow. + -Hi everyone. I am running Gentoo on my server and samba 2.2.8a. Recently -I changed kernel version from linux-2.4.19-gentoo-r10 to -linux-2.4.20-wolk4.0s. And now I have performance issue with samba. Ok -many of you will probably say that move to vanilla sources...well I tried -it too and it didn't work. I have 100mb LAN and two computers (linux + -Windows2000). Linux server shares directory with DivX files, client -(windows2000) plays them via LAN. Before when I was running 2.4.19 kernel -everything was fine, but now movies freezes and stops...I tried moving -files between server and Windows and it's terribly slow. +The answer he was given is: -Grab mii-tool and check the duplex settings on the NIC. +Grab the mii-tool and check the duplex settings on the NIC. My guess is that it is a link layer issue, not an application -layer problem. Also run ifconfig and verify that the framing -error, collisions, etc... look normal for ethernet. +layer problem. Also run ifconfig and verify that the framing +error, collisions, and so on, look normal for ethernet. @@ -238,31 +242,30 @@ error, collisions, etc... look normal for ethernet. Corrupt tdb Files -Well today it happened, Our first major problem using samba. -Our samba PDC server has been hosting 3 TB of data to our 500+ users -[Windows NT/XP] for the last 3 years using samba, no problem. -But today all shares went SLOW; very slow. Also the main smbd kept +Our Samba PDC server has been hosting three TB of data to our 500+ users +[Windows NT/XP] for the last three years using Samba without a problem. +Today all shares went very slow. Also the main smbd kept spawning new processes so we had 1600+ running smbd's (normally we avg. 250). -It crashed the SUN E3500 cluster twice. After a lot of searching I +It crashed the SUN E3500 cluster twice. After a lot of searching, I decided to rm /var/locks/*.tdb. Happy again. -Q1) Is there any method of keeping the *.tdb files in top condition or -how to early detect corruption? +Question: Is there any method of keeping the *.tdb files in top condition or +how can I detect early corruption? -A1) Yes, run tdbbackup each time after stopping nmbd and before starting nmbd. +Answer: Yes, run tdbbackup each time after stopping nmbd and before starting nmbd. -Q2) What I also would like to mention is that the service latency seems -a lot lower then before the locks cleanup, any ideas on keeping it top notch? +Question: What I also would like to mention is that the service latency seems +a lot lower than before the locks cleanup. Any ideas on keeping it top notch? -A2) Yes! Same answer as for Q1! +Answer: Yes. Same answer as for previous question! diff --git a/docs/docbook/projdoc/StandAloneServer.xml b/docs/docbook/projdoc/StandAloneServer.xml index ec4f9f2693..b52ad29fe1 100644 --- a/docs/docbook/projdoc/StandAloneServer.xml +++ b/docs/docbook/projdoc/StandAloneServer.xml @@ -2,12 +2,12 @@ &author.jht; -Stand-Alone Servers +Stand-alone Servers -Stand-Alone servers are independent of Domain Controllers on the network. -They are NOT domain members and function more like workgroup servers. In many -cases a stand-alone server is configured with a minimum of security control +Stand-alone Servers are independent of Domain Controllers on the network. +They are not Domain Members and function more like workgroup servers. In many +cases a Stand-alone Server is configured with a minimum of security control with the intent that all data served will be readily accessible to all users. @@ -15,25 +15,25 @@ with the intent that all data served will be readily accessible to all users. Features and Benefits -Stand-Alone servers can be as secure or as insecure as needs dictate. They can +Stand-alone Servers can be as secure or as insecure as needs dictate. They can have simple or complex configurations. Above all, despite the hoopla about -Domain security they remain a very common installation. +Domain Security they remain a common installation. If all that is needed is a server for read-only files, or for -printers alone, it may not make sense to affect a complex installation. +printers alone, it may not make sense to effect a complex installation. For example: A drafting office needs to store old drawings and reference -standards. No-one can write files to the server as it is legislatively -important that all documents remain unaltered. A share mode read-only stand-alone -server is an ideal solution. +standards. Noone can write files to the server as it is legislatively +important that all documents remain unaltered. A share mode read-only Stand-alone +Server is an ideal solution. Another situation that warrants simplicity is an office that has many printers that are queued off a single central server. Everyone needs to be able to print -to the printers, there is no need to affect any access controls and no files will -be served from the print server. Again a share mode stand-alone server makes +to the printers, there is no need to effect any access controls and no files will +be served from the print server. Again, a share mode Stand-alone Server makes a great solution. @@ -42,39 +42,38 @@ a great solution. Background -The term stand-alone server means that the server +The term Stand-alone Server means that it will provide local authentication and access control for all resources that are available from it. In general this means that there will be a -local user database. In more technical terms, it means that resources +local user database. In more technical terms, it means resources on the machine will be made available in either SHARE mode or in USER mode. No special action is needed other than to create user accounts. Stand-alone -servers do NOT provide network logon services. This means that machines that -use this server do NOT perform a domain logon to it. Whatever logon facility -the workstations are subject to is independent of this machine. It is however -necessary to accommodate any network user so that the logon name they use will -be translated (mapped) locally on the stand-alone server to a locally known +servers do not provide network logon services. This means that machines that +use this server do not perform a domain logon to it. Whatever logon facility +the workstations are subject to is independent of this machine. It is, however, +necessary to accommodate any network user so the logon name they use will +be translated (mapped) locally on the Stand-alone Server to a locally known user name. There are several ways this can be done. Samba tends to blur the distinction a little in respect of what is -a stand-alone server. This is because the authentication database may be -local or on a remote server, even if from the Samba protocol perspective -the Samba server is NOT a member of a domain security context. +a Stand-alone Server. This is because the authentication database may be +local or on a remote server, even if from the SMB protocol perspective +the Samba server is not a member of a domain security context. -Through the use of PAM (Pluggable Authentication Modules) and nsswitch -(the name service switcher, which maintains the unix user database) the source of authentication may reside on +Through the use of Pluggable Authentication Modules (PAM) and the name service switcher (NSSWITCH), +which maintains the UNIX-user database) the source of authentication may reside on another server. We would be inclined to call this the authentication server. This means that the Samba server may use the local UNIX/Linux system password database (/etc/passwd or /etc/shadow), may use a -local smbpasswd file, or may use -an LDAP back end, or even via PAM and Winbind another CIFS/SMB server +local smbpasswd file, or may use an LDAP backend, or even via PAM and Winbind another CIFS/SMB server for authentication. @@ -84,23 +83,23 @@ for authentication. Example Configuration -The following examples are designed to inspire simplicity. It is too easy to -attempt a high level of creativity and to introduce too much complexity in -server and network design. +The examples, , and link linkend="SimplePrintServer"/>, +are designed to inspire simplicity. It is too easy to attempt a high level of creativity +and to introduce too much complexity in server and network design. Reference Documentation Server -Configuration of a read-only data server that EVERYONE can access is very simple. -Here is the smb.conf file that will do this. Assume that all the reference documents -are stored in the directory /export, that the documents are owned by a user other than -nobody. No home directories are shared, that are no users in the /etc/passwd -UNIX system database. This is a very simple system to administer. +Configuration of a read-only data server that everyone can access is very simple. + is the &smb.conf; file that will do this. Assume that all the reference documents +are stored in the directory /export, and the documents are owned by a user other than +nobody. No home directories are shared, and there are no users in the /etc/passwd +UNIX system database. This is a simple system to administer. - + smb.conf for Reference Documentation Server Global parameters [global] @@ -116,11 +115,10 @@ UNIX system database. This is a very simple system to administer. -In the above example the machine name is set to REFDOCS, the workgroup is set to the name -of the local workgroup so that the machine will appear in with systems users are familiar -with. The only password backend required is the "guest" backend so as to allow default -unprivileged account names to be used. Given that there is a WINS server on this network -we do use it. +In above, the machine name is set to &example.server.samba;, the workgroup is set to the name +of the local workgroup (&example.workgroup;) so the machine will appear together with systems with +which users are familiar. The only password backend required is the guest backend to allow default +unprivileged account names to be used. As there is a WINS server on this networki, we of obviously make use of it. @@ -129,30 +127,29 @@ we do use it. Central Print Serving -Configuration of a simple print server is very simple if you have all the right tools +Configuration of a simple print server is easy if you have all the right tools on your system. Assumptions: - The print server must require no administration + The print server must require no administration. The print spooling and processing system on our print server will be CUPS. - (Please refer to the chapter about CUPS for more information). + (Please refer to for more information). - All printers that the print server will service will be network - printers. They will be correctly configured, by the administrator, - in the CUPS environment. + The print server will service only network printers. The network administrator + will correctly configure the CUPS environment to support the printers. - All workstations will be installed using postscript drivers. The printer - of choice is the Apple Color LaserWriter. + All workstations will use only postscript drivers. The printer driver + of choice is the one shipped with the Windows OS for the Apple Color LaserWriter. @@ -168,12 +165,12 @@ the anonymous (guest) user, two things will be required: The UNIX/Linux system must have a guest account. The default for this is usually the account nobody. - To find the correct name to use for your version of Samba do the + To find the correct name to use for your version of Samba, do the following: &prompt;testparm -s -v | grep "guest account" - Then make sure that this account exists in your system password + Make sure that this account exists in your system password database (/etc/passwd). @@ -190,15 +187,18 @@ the anonymous (guest) user, two things will be required: - - smb.conf for anonymous printing +The contents of the &smb.conf; file is shown in . + + + + +&smb.conf; for Anonymous Printing Global parameters [global] workgroup&example.workgroup; netbios name&example.server.samba; securitySHARE passdb backendguest -wins server&example.server.wins; printingcups printcap namecups @@ -213,6 +213,17 @@ the anonymous (guest) user, two things will be required: + + +MIMEraw +raw printing +On CUPS-enabled systems there is a facility to pass raw data directly to the printer without +intermediate processing via CUPS print filters. Where use of this mode of operation is desired, +it is necessary to configure a raw printing device. It is also necessary to enable the raw mime +handler in the /etc/mime.conv and /etc/mime.types +files. Refer to . + + diff --git a/docs/docbook/projdoc/UNIX_INSTALL.xml b/docs/docbook/projdoc/UNIX_INSTALL.xml index 6a38e60c0e..65a26702c4 100644 --- a/docs/docbook/projdoc/UNIX_INSTALL.xml +++ b/docs/docbook/projdoc/UNIX_INSTALL.xml @@ -3,7 +3,8 @@ &author.tridge; &author.jelmer; &author.jht; - KarlAuer + &author.kauer; + &author.danshearer; @@ -11,52 +12,89 @@ How to Install and Test SAMBA - Obtaining and installing samba + Obtaining and Installing Samba - Binary packages of samba are included in almost any Linux or + Binary packages of Samba are included in almost any Linux or UNIX distribution. There are also some packages available at - the samba homepage. + the Samba homepage. Refer to + the manual of your operating system for details on installing packages + for your specific operating system. - If you need to compile samba from source, check - the chapter about compiling samba from scratch. - - If you have already installed samba, or if your operating system - was pre-installed with samba, then you may not need to bother with this - chapter. On the other hand, you may want to read this chapter anyhow - for information about updating samba. + If you need to compile Samba from source, check + . - Configuring samba (smb.conf) + Configuring Samba (smb.conf) - Samba's configuration is stored in the &smb.conf; file, - that usually resides in /etc/samba/smb.conf + Samba's configuration is stored in the &smb.conf; file, which + usually resides in /etc/samba/smb.conf or /usr/local/samba/lib/smb.conf. You can either edit this file yourself or do it using one of the many graphical - tools that are available, such as the web-based interface swat, that - is included with samba. + tools that are available, such as the Web-based interface SWAT, that + is included with Samba. + + + Configuration file syntax + + The &smb.conf; file uses the same syntax as the various old + .ini files in Windows 3.1: Each file consists of various sections, + which are started by putting the section name between brackets ([]) + on a new line. Each contains zero or more key/value-pairs seperated by an + equality sign (=). The file is just a plain-text file, so you can + open and edit it with your favorite editing tool. + + Each section in the &smb.conf; file represents a share + on the Samba server. The section global is special, since it + contains settings that apply to the whole Samba server and not + to one share in particular. + + contains a very minimal &smb.conf;. + minimal configuration + + + + A minimal smb.conf + + [global] + workgroupWKG + netbios nameMYNAME + [share1] + path/tmp + + [share2] + path/my_shared_folder + commentSome random files + + + Example Configuration There are sample configuration files in the examples subdirectory in the - distribution. I suggest you read them carefully so you can see how the options - go together in practice. See the man page for all the options. + distribution. It is suggested you read them carefully so you can see how the options + go together in practice. See the man page for all the options. + It might be worthwhile to start out with the smb.conf.default + configuration file and adapt it to your needs. It contains plenty of + comments. - The simplest useful configuration file would be something like this: + The simplest useful configuration file would contain something like shown in + . - - Simplest possible smb.conf file + simple configuration + + Another simple smb.conf File [global] workgroup&example.workgroup; @@ -68,36 +106,41 @@ This will allow connections by anyone with an account on the server, using either - their login name or homes" as the service name. - (Note that the workgroup that Samba must also be set.) + their login name or homes as the service name. + (Note: The workgroup that Samba should appear in must also be set. The default + workgroup name is WORKGROUP.) - Make sure you put the &smb.conf; file in the correct place - (usually in /etc/samba). + Make sure you put the &smb.conf; file in the correct place. For more information about security settings for the [homes] share please refer to - "Securing Samba". + . - Test your config file with <command>testparm</command> + Test Your Config File with <command>testparm</command> - It's important that you test the validity of your &smb.conf; - file using the &testparm; program. If testparm runs OK - then it will list the loaded services. If not it will give an error message. + It's important to validate the contents of the &smb.conf; file using the &testparm; program. + If testparm runs correctly, it will list the loaded services. If not, it will give an error message. + Make sure it runs correctly and that the services look reasonable before proceeding. Enter the command: - - Make sure it runs OK and that the services look reasonable before proceeding. - + + &rootprompt; testparm /etc/samba/smb.conf + + + Testparm will parse your configuration file and report + any unknown parameters or incorrect syntax. + + - Always run testparm again when you change &smb.conf;! + Always run testparm again whenever the &smb.conf; file is changed! @@ -107,68 +150,68 @@ SWAT - SWAT is a web-based interface that helps you configure samba. - SWAT might not be available in the samba package on your platform, - but in a separate package. Please read the swat manpage - on compiling, installing and configuring swat from source. + swat + SWAT is a Web-based interface that can be used to facilitate the configuration of Samba. + SWAT might not be available in the Samba package that shipped with your platform, + but in a separate package. Please read the SWAT manpage + on compiling, installing and configuring SWAT from source. - To launch SWAT just run your favorite web browser and - point it at http://localhost:901/. Replace - localhost - with the name of the computer you are running samba on if you - are running samba on a different computer than your browser. + To launch SWAT, just run your favorite Web browser and point it to + http://localhost:901/. + Replace localhost with the name of the computer on which + Samba is running if that is a different computer than your browser. - Note that you can attach to SWAT from any IP connected - machine but connecting from a remote machine leaves your - connection open to password sniffing as passwords will be sent - in the clear over the wire. + SWAT can be used from a browser on any IP-connected machine, but be aware that connecting from a remote + machine leaves your connection open to password sniffing as passwords will be sent over the wire in the clear. + + More information about SWAT can be found in . + + - Try listing the shares available on your - server + List Shares Available on the Server + + + To list shares that are available from the configured Samba server execute the + following command: + &prompt;smbclient -L yourhostname - You should get back a list of shares available on - your server. If you don't then something is incorrectly setup. - Note that this method can also be used to see what shares - are available on other LanManager clients (such as WfWg). - - If you choose user level security then you may find - that Samba requests a password before it will list the shares. - See the smbclient man page for details. (you - can force it to list the shares without a password by - adding the option -U% to the command line. This will not work - with non-Samba servers) + You should see a list of shares available on your server. If you do not, then + something is incorrectly configured. This method can also be used to see what shares + are available on other SMB servers, such as Windows 2000. + + If you choose user-level security you may find that Samba requests a password + before it will list the shares. See the smbclient man page for details. + You can force it to list the shares without a password by adding the option + to the command line. - Try connecting with the unix client + Connect with a UNIX Client + Enter the following command: &prompt;smbclient //yourhostname/aservice - Typically the yourhostname - would be the name of the host where you installed &smbd;. - The aservice is - any service you have defined in the &smb.conf; - file. Try your user name if you just have a [homes] - section - in &smb.conf;. + Typically yourhostname is the name of the host on which &smbd; + has been installed. The aservice is any service that has been defined in the &smb.conf; + file. Try your user name if you just have a [homes] section in the &smb.conf; file. - For example if your unix host is bambi - and your login name is fred you would type: + Example: If the UNIX host is called bambi and a valid login name + is fred, you would type: &prompt;smbclient //bambi/fred @@ -176,15 +219,21 @@ - Try connecting from another SMB client + Connect from a Remote SMB Client + + Now that Samba is working correctly locally, you can try to + access it from other clients. Within a few minutes, the Samba host + should be listed in the Network Neighborhood on all Windows + clients of its subnet. Try browsing the server from another client + or 'mounting' it. - Try mounting disks. from a DOS, Windows or OS/2 client, eg: + Mounting disks from a DOS, Windows or OS/2 client can be done by running a command such as: &dosprompt;net use d: \\servername\service - Try printing. eg: + Try printing, e.g. @@ -199,10 +248,12 @@ What If Things Don't Work? - Then you might read the file chapter diagnosis - and the FAQ. If you are still stuck then refer to "Analysing and solving problems". - Samba has been successfully installed at thousands of sites worldwide, - so maybe someone else has hit your problem and has overcome it. + You might want to read . + If you are still stuck, refer to . + Samba has been successfully installed at thousands of sites worldwide. + It is unlikely that your particular problem is unique, so it might be + productive to perform an Internet search to see if someone else has encountered + your problem and has found a way to overcome it. @@ -210,55 +261,62 @@ Common Errors -The following questions and issues get raised on the samba mailing list over and over again. +The following questions and issues are raised repeatedly on the Samba mailing list. - Large number of smbd processes + Large Number of smbd Processes -Samba consists on three core programs: -&nmbd;, &smbd;, &winbindd;. &nmbd; is the name server message daemon, -&smbd; is the server message daemon, &winbindd; is the daemon that -handles communication with Domain Controllers. +Samba consists of three core programs: &nmbd;, &smbd;, and &winbindd;. &nmbd; is the name server message daemon, +&smbd; is the server message daemon, and &winbindd; is the daemon that handles communication with Domain Controllers. -If your system is NOT running as a WINS server, then there will be one (1) single instance of +If Samba is not running as a WINS server, then there will be one single instance of &nmbd; running on your system. If it is running as a WINS server then there will be -two (2) instances - one to handle the WINS requests. +two instances &smbmdash; one to handle the WINS requests. -&smbd; handles ALL connection requests and then spawns a new process for each client -connection made. That is why you are seeing so many of them, one (1) per client connection. +&smbd; handles all connection requests. It spawns a new process for each client +connection made. That is why you may see so many of them, one per client connection. &winbindd; will run as one or two daemons, depending on whether or not it is being -run in "split mode" (in which case there will be two instances). +run in split mode (in which case there will be two instances). - "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" - Your loopback device isn't working correctly. Make sure it's configured properly. The loopback device is an internal (virtual) network device with - the ip address 127.0.0.1. Read your OS documentation for details - on how to configure the loopback on your system. + Error Message: open_oplock_ipc + + An error message is observed in the log files when &smbd; is started: open_oplock_ipc: Failed to get local UDP socket + for address 100007f. Error was Cannot assign requested. + + Your loopback device isn't working correctly. Make sure it is configured correctly. The loopback + device is an internal (virtual) network device with the IP address 127.0.0.1. + Read your OS documentation for details on how to configure the loopback on your system. + - "<errorname>The network name cannot be found</errorname>" + <quote><errorname>The network name cannot be found</errorname></quote> - This error can be caused by one of these misconfigurations: + This error can be caused by one of these misconfigurations: - You specified an nonexisting path for the share in &smb.conf; + You specified an nonexisting path + for the share in &smb.conf;. + The user you are trying to access the share with does not - have sufficient permissions to access the path for the share. Both read (r) and access (x) should be possible. + have sufficient permissions to access the path for + the share. Both read (r) and access (x) should be possible. + The share you are trying to access does not exist. diff --git a/docs/docbook/projdoc/VFS.xml b/docs/docbook/projdoc/VFS.xml index c949055371..58bb64d3ef 100644 --- a/docs/docbook/projdoc/VFS.xml +++ b/docs/docbook/projdoc/VFS.xml @@ -2,7 +2,7 @@ &author.jelmer; &author.jht; - TimPotter + &author.tpot; SimoSorceoriginal vfs_skel README AlexanderBokovoyoriginal vfs_netatalk docs StefanMetzmacherUpdate for multiple modules @@ -13,9 +13,9 @@ Features and Benefits -Since Samba-3, there is support for stackable VFS(Virtual File System) modules. -Samba passes each request to access the unix file system thru the loaded VFS modules. -This chapter covers all the modules that come with the samba source and references to +Since Samba-3, there is support for stackable VFS (Virtual File System) modules. +Samba passes each request to access the UNIX file system through the loaded VFS modules. +This chapter covers all the modules that come with the Samba source and references to some external modules. @@ -27,17 +27,17 @@ some external modules. If not supplied with your platform distribution binary Samba package you may have problems -to compile these modules, as shared libraries are compiled and linked in different ways -on different systems. They currently have been tested against GNU/Linux and IRIX. +compiling these modules, as shared libraries are compiled and linked in different ways +on different systems. They currently have been tested against GNU/Linux and IRIX. -To use the VFS modules, create a share similar to the one below. The +To use the VFS modules, create a share similar to the one below. The important parameter is the vfs objects parameter where you can list one or more VFS modules by name. For example, to log all access -to files and put deleted files in a recycle bin: +to files and put deleted files in a recycle bin, see . - + smb.conf with VFS modules [audit] commentAudited /data directory @@ -53,17 +53,16 @@ The modules are used in the order in which they are specified. -Samba will attempt to load modules from the lib -directory in the root directory of the samba installation (usually -/usr/lib/samba/vfs or /usr/local/samba/lib/vfs +Samba will attempt to load modules from the /lib directory in the root directory of the +Samba installation (usually /usr/lib/samba/vfs or /usr/local/samba/lib/vfs ). Some modules can be used twice for the same share. -This can be done using a configuration similar to the one below. +This can be done using a configuration similar to the one shown in . - + smb.conf with multiple VFS modules [test] commentVFS TEST @@ -80,19 +79,19 @@ This can be done using a configuration similar to the one below. -Included modules +Included Modules audit A simple module to audit file access to the syslog - facility. The following operations are logged: + facility. The following operations are logged: - share - connect/disconnect - directory opens/create/remove - file open/close/rename/unlink/chmod + share + connect/disconnect + directory opens/create/remove + file open/close/rename/unlink/chmod @@ -102,18 +101,17 @@ This can be done using a configuration similar to the one below. extd_audit - This module is identical with the audit module above except - that it sends audit logs to both syslog as well as the smbd log file/s. The - loglevel for this module is set in the smb.conf file. + This module is identical with the audit module above except + that it sends audit logs to both syslog as well as the smbd log files. The + log level for this module is set in the &smb.conf; file. - The logging information that will be written to the smbd log file is controlled by - the log level parameter in &smb.conf;. The - following information will be recorded: + Valid settings and the information that will be recorded are shown in . - Extended Auditing Log Information +
    + Extended Auditing Log Information Log LevelLog Details - File and Directory Operations @@ -128,12 +126,12 @@ This can be done using a configuration similar to the one below. - + fake_perms This module was created to allow Roaming Profile files and directories to be set (on the Samba server - under Unix) as read only. This module will if installed on the Profiles share will report to the client + under UNIX) as read only. This module will, if installed on the Profiles share, report to the client that the Profile files and directories are writable. This satisfies the client even though the files will never be overwritten as the client logs out or shuts down. @@ -144,67 +142,82 @@ This can be done using a configuration similar to the one below. recycle - A recycle-bin like module. When used any unlink call - will be intercepted and files moved to the recycle - directory instead of being deleted. This gives the same - effect as the "Recycle Bin" on Windows computers. + A Recycle Bin-like module. Where used, unlink calls will be intercepted and files moved + to the recycle directory instead of being deleted. This gives the same effect as the + Recycle Bin on Windows computers. + + + + The Recycle Bin will not appear in Windows Explorer views of the network file system + (share) nor on any mapped drive. Instead, a directory called .recycle will be + automatically created when the first file is deleted. Users can recover files from the + .recycle directory. If the recycle:keeptree has been + specified, deleted files will be found in a path identical with that from which the file was deleted. - Supported options: + Supported options for the recycle module are as follow: recycle:repository - Relative path of the directory where deleted files should be moved to + + Relative path of the directory where deleted files should be moved. + recycle:keeptree - Specifies whether the directory structure should - be kept or if the files in the directory that is being - deleted should be kept seperately in the recycle bin. - + + Specifies whether the directory structure should be kept or if the files in the directory that is being + deleted should be kept seperately in the recycle bin. + recycle:versions - If this option is set, two files - with the same name that are deleted will both - be kept in the recycle bin. Newer deleted versions - of a file will be called "Copy #x of filename". + + If this option is set, two files + with the same name that are deleted will both + be kept in the recycle bin. Newer deleted versions + of a file will be called Copy #x of filename. + recycle:touch - Specifies whether a file's access - date should be touched when the file is moved to - the recycle bin. + + Specifies whether a file's access date should be touched when the file is moved to the recycle bin. + recycle:maxsize - Files that are larger than the number - of bytes specified by this parameter will - not be put into the recycle bin. + + Files that are larger than the number of bytes specified by this parameter will not be put into the recycle bin. + recycle:exclude - List of files that should not - be put into the recycle bin when deleted, but deleted - in the regular way. + + List of files that should not be put into the recycle bin when deleted, but deleted in the regular way. + recycle:exclude_dir - Contains a list of directories. When files from - these directories are deleted, they are not put into the - recycle bin, but deleted in the regular way. - + + Contains a list of directories. When files from these directories are + deleted, they are not put into the + recycle bin but are deleted in the + regular way. + recycle:noversions - Opposite of recycle:versions. If both options are specified, this one takes precedence. + + Opposite of recycle:versions. If both options are specified, this one takes precedence. + @@ -215,14 +228,13 @@ This can be done using a configuration similar to the one below. netatalk - A netatalk module, that will ease co-existence of samba and - netatalk file sharing services. + A netatalk module will ease co-existence of Samba and netatalk file sharing services. Advantages compared to the old netatalk module: - it doesn't care about creating of .AppleDouble forks, just keeps them in sync - if a share in &smb.conf; doesn't contain .AppleDouble item in hide or veto list, it will be added automatically + Does not care about creating .AppleDouble forks, just keeps them in sync. + If a share in &smb.conf; does not contain .AppleDouble item in hide or veto list, it will be added automatically. @@ -231,12 +243,12 @@ This can be done using a configuration similar to the one below. -VFS modules available elsewhere +VFS Modules Available Elsewhere This section contains a listing of various other VFS modules that -have been posted but don't currently reside in the Samba CVS -tree for one reason or another (e.g. it is easy for the maintainer +have been posted but do not currently reside in the Samba CVS +tree for one reason or another (e.g., it is easy for the maintainer to have his or her own CVS tree). @@ -252,22 +264,23 @@ should be implied due to its presence here. URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php - By Eric Lorimer. + By Eric Lorimer. - I have created a VFS module which implements a fairly complete read-only - filesystem. It presents information from a database as a filesystem in + I have created a VFS module that implements a fairly complete read-only + filesystem. It presents information from a database as a filesystem in a modular and generic way to allow different databases to be used (originally designed for organizing MP3s under directories such as - "Artists," "Song Keywords," etc... I have since applied it to a student - roster database very easily). The directory structure is stored in the + Artists, Song Keywords, and so on. I have since easily + applied it to a student + roster database.) The directory structure is stored in the database itself and the module makes no assumptions about the database structure beyond the table it requires to run. Any feedback would be appreciated: comments, suggestions, patches, - etc... If nothing else, hopefully it might prove useful for someone + and so on. If nothing else, hopefully it might prove useful for someone else who wishes to create a virtual filesystem. @@ -279,10 +292,10 @@ should be implied due to its presence here. URL: http://www.openantivirus.org/ - samba-vscan is a proof-of-concept module for Samba, which + samba-vscan is a proof-of-concept module for Samba, which uses the VFS (virtual file system) features of Samba 2.2.x/3.0 alphaX. Of course, Samba has to be compiled with VFS support. - samba-vscan supports various virus scanners and is maintained + samba-vscan supports various virus scanners and is maintained by Rainer Link. diff --git a/docs/docbook/projdoc/locking.xml b/docs/docbook/projdoc/locking.xml index 17dc518226..8bdb06ca8f 100644 --- a/docs/docbook/projdoc/locking.xml +++ b/docs/docbook/projdoc/locking.xml @@ -8,8 +8,8 @@ File and Record Locking -One area which causes trouble for many network administrators is locking. -The extent of the problem is readily evident from searches over the internet. +One area that causes trouble for many network administrators is locking. +The extent of the problem is readily evident from searches over the Internet. @@ -17,7 +17,7 @@ The extent of the problem is readily evident from searches over the internet. Samba provides all the same locking semantics that MS Windows clients expect -and that MS Windows NT4 / 200x servers provide also. +and that MS Windows NT4/200x servers also provide. @@ -27,10 +27,10 @@ a range of functions that are all categorized under this one term. Opportunistic locking is a desirable feature when it can enhance the -perceived performance of applications on a networked client. However, the -opportunistic locking protocol is not robust, and therefore can -encounter problems when invoked beyond a simplistic configuration, or -on extended, slow, or faulty networks. In these cases, operating +perceived performance of applications on a networked client. However, the +opportunistic locking protocol is not robust and, therefore, can +encounter problems when invoked beyond a simplistic configuration or +on extended slow or faulty networks. In these cases, operating system management of opportunistic locking and/or recovering from repetitive errors can offset the perceived performance advantage that it is intended to provide. @@ -38,13 +38,13 @@ it is intended to provide. The MS Windows network administrator needs to be aware that file and record -locking semantics (behaviour) can be controlled either in Samba or by way of registry +locking semantics (behavior) can be controlled either in Samba or by way of registry settings on the MS Windows client. -Sometimes it is necessary to disable locking control settings BOTH on the Samba +Sometimes it is necessary to disable locking control settings on both the Samba server as well as on each MS Windows client! @@ -55,45 +55,46 @@ server as well as on each MS Windows client! Discussion -There are two types of locking which need to be performed by a SMB server. -The first is record locking which allows a client to lock -a range of bytes in a open file. The second is the deny modes +There are two types of locking that need to be performed by an SMB server. +The first is record locking that allows a client to lock +a range of bytes in a open file. The second is the deny modes that are specified when a file is open. Record locking semantics under UNIX are very different from record locking under -Windows. Versions of Samba before 2.2 have tried to use the native fcntl() unix +Windows. Versions of Samba before 2.2 have tried to use the native fcntl() UNIX system call to implement proper record locking between different Samba clients. -This can not be fully correct due to several reasons. The simplest is the fact +This cannot be fully correct for several reasons. The simplest is the fact that a Windows client is allowed to lock a byte range up to 2^32 or 2^64, -depending on the client OS. The unix locking only supports byte ranges up to 2^31. +depending on the client OS. The UNIX locking only supports byte ranges up to 2^31. So it is not possible to correctly satisfy a lock request above 2^31. There are many more differences, too many to be listed here. Samba 2.2 and above implements record locking completely independent of the -underlying unix system. If a byte range lock that the client requests happens -to fall into the range 0-2^31, Samba hands this request down to the UNIX system. -All other locks can not be seen by unix anyway. +underlying UNIX system. If a byte range lock that the client requests happens +to fall into the range of 0-2^31, Samba hands this request down to the UNIX system. +All other locks cannot be seen by UNIX, anyway. -Strictly an SMB server should check for locks before every read and write call on -a file. Unfortunately with the way fcntl() works this can be slow and may over-stress -the rpc.lockd. It is also almost always unnecessary as clients are supposed to -independently make locking calls before reads and writes anyway if locking is -important to them. By default Samba only makes locking calls when explicitly asked -to by a client, but if you set strict lockingyes then it -will make lock checking calls on every read and write. +Strictly speaking, an SMB server should check for locks before every read and write call on +a file. Unfortunately with the way fcntl() works, this can be slow and may overstress +the rpc.lockd. This is almost always unnecessary as clients are supposed to +independently make locking calls before reads and writes if locking is +important to them. By default, Samba only makes locking calls when explicitly asked +to by a client, but if you set strict lockingyes, it +will make lock checking calls on every read and write call. -You can also disable byte range locking completely using lockingno. -This is useful for those shares that don't support locking or don't need it -(such as cdroms). In this case Samba fakes the return codes of locking calls to -tell clients that everything is OK. +You can also disable byte range locking completely by using +lockingno. +This is useful for those shares that do not support locking or do not need it +(such as CDROMs). In this case, Samba fakes the return codes of locking calls to +tell clients that everything is okay. @@ -101,7 +102,7 @@ The second class of locking is the deny modes. These are set by an application when it opens a file to determine what types of access should be allowed simultaneously with its open. A client may ask for DENY_NONE, DENY_READ, -DENY_WRITE or DENY_ALL. There are also special compatibility +DENY_WRITE, or DENY_ALL. There are also special compatibility modes called DENY_FCB and DENY_DOS. @@ -110,57 +111,58 @@ modes called DENY_FCB and DENY_DOS. Opportunistic locking (Oplocks) is invoked by the Windows file system -(as opposed to an API) via registry entries (on the server AND client) +(as opposed to an API) via registry entries (on the server and the client) for the purpose of enhancing network performance when accessing a file residing on a server. Performance is enhanced by caching the file -locally on the client which allows: +locally on the client that allows: Read-ahead: - The client reads the local copy of the file, eliminating network latency + The client reads the local copy of the file, eliminating network latency. Write caching: - The client writes to the local copy of the file, eliminating network latency + The client writes to the local copy of the file, eliminating network latency. Lock caching: - The client caches application locks locally, eliminating network latency + The client caches application locks locally, eliminating network latency. The performance enhancement of oplocks is due to the opportunity of -exclusive access to the file - even if it is opened with deny-none - +exclusive access to the file &smbmdash; even if it is opened with deny-none &smbmdash; because Windows monitors the file's status for concurrent access from other processes. Windows defines 4 kinds of Oplocks: - Level1 Oplock: + + Level1 Oplock The redirector sees that the file was opened with deny none (allowing concurrent access), verifies that no other process is accessing the file, checks that oplocks are enabled, then grants deny-all/read-write/exclusive - access to the file. The client now performs + access to the file. The client now performs operations on the cached local file. If a second process attempts to open the file, the open - is deferred while the redirector "breaks" the original - oplock. The oplock break signals the caching client to + is deferred while the redirector breaks the original + oplock. The oplock break signals the caching client to write the local file back to the server, flush the - local locks, and discard read-ahead data. The break is + local locks and discard read-ahead data. The break is then complete, the deferred open is granted, and the multiple processes can enjoy concurrent file access as dictated by mandatory or byte-range locking options. @@ -171,60 +173,60 @@ other processes. - Level2 Oplock: + Level2 Oplock - Performs like a level1 oplock, except caching is only + Performs like a Level1 oplock, except caching is only operative for reads. All other operations are performed on the server disk copy of the file. - Filter Oplock: + Filter Oplock - Does not allow write or delete file access + Does not allow write or delete file access. - Batch Oplock: + Batch Oplock - Manipulates file openings and closings - allows caching - of file attributes + Manipulates file openings and closings and allows caching + of file attributes. An important detail is that oplocks are invoked by the file system, not -an application API. Therefore, an application can close an oplocked -file, but the file system does not relinquish the oplock. When the +an application API. Therefore, an application can close an oplocked +file, but the file system does not relinquish the oplock. When the oplock break is issued, the file system then simply closes the file in preparation for the subsequent open by the second process. -Opportunistic Locking is actually an improper name for this feature. +Opportunistic locking is actually an improper name for this feature. The true benefit of this feature is client-side data caching, and oplocks is merely a notification mechanism for writing data back to the -networked storage disk. The limitation of opportunistic locking is the +networked storage disk. The limitation of opportunistic locking is the reliability of the mechanism to process an oplock break (notification) -between the server and the caching client. If this exchange is faulty -(usually due to timing out for any number of reasons) then the +between the server and the caching client. If this exchange is faulty +(usually due to timing out for any number of reasons), then the client-side caching benefit is negated. The actual decision that a user or administrator should consider is -whether it is sensible to share amongst multiple users data that will -be cached locally on a client. In many cases the answer is no. +whether it is sensible to share among multiple users data that will +be cached locally on a client. In many cases the answer is no. Deciding when to cache or not cache data is the real question, and thus -"opportunistic locking" should be treated as a toggle for client-side -caching. Turn it "ON" when client-side caching is desirable and -reliable. Turn it "OFF" when client-side caching is redundant, -unreliable, or counter-productive. +opportunistic locking should be treated as a toggle for client-side +caching. Turn it on when client-side caching is desirable and +reliable. Turn it off when client-side caching is redundant, +unreliable or counter-productive. -Opportunistic locking is by default set to "on" by Samba on all +Opportunistic locking is by default set to on by Samba on all configured shares, so careful attention should be given to each case to determine if the potential benefit is worth the potential for delays. The following recommendations will help to characterize the environment @@ -232,27 +234,27 @@ where opportunistic locking may be effectively configured. -Windows Opportunistic Locking is a lightweight performance-enhancing -feature. It is not a robust and reliable protocol. Every -implementation of Opportunistic Locking should be evaluated as a -tradeoff between perceived performance and reliability. Reliability -decreases as each successive rule above is not enforced. Consider a +Windows opportunistic locking is a lightweight performance-enhancing +feature. It is not a robust and reliable protocol. Every +implementation of opportunistic locking should be evaluated as a +tradeoff between perceived performance and reliability. Reliability +decreases as each successive rule above is not enforced. Consider a share with oplocks enabled, over a wide area network, to a client on a South Pacific atoll, on a high-availability server, serving a -mission-critical multi-user corporate database, during a tropical -storm. This configuration will likely encounter problems with oplocks. +mission-critical multi-user corporate database during a tropical +storm. This configuration will likely encounter problems with oplocks. Oplocks can be beneficial to perceived client performance when treated -as a configuration toggle for client-side data caching. If the data +as a configuration toggle for client-side data caching. If the data caching is likely to be interrupted, then oplock usage should be -reviewed. Samba enables opportunistic locking by default on all -shares. Careful attention should be given to the client usage of -shared data on the server, the server network reliability, and the +reviewed. Samba enables opportunistic locking by default on all +shares. Careful attention should be given to the client usage of +shared data on the server, the server network reliability and the opportunistic locking configuration of each share. -n mission critical high availability environments, data integrity is -often a priority. Complex and expensive configurations are implemented +In mission critical high availability environments, data integrity is +often a priority. Complex and expensive configurations are implemented to ensure that if a client loses connectivity with a file server, a failover replacement will be available immediately to provide continuous data availability. @@ -260,30 +262,30 @@ continuous data availability. Windows client failover behavior is more at risk of application -interruption than other platforms because it is dependant upon an -established TCP transport connection. If the connection is interrupted -- as in a file server failover - a new session must be established. +interruption than other platforms because it is dependent upon an +established TCP transport connection. If the connection is interrupted +&smbmdash; as in a file server failover &smbmdash; a new session must be established. It is rare for Windows client applications to be coded to recover -correctly from a transport connection loss, therefore most applications -will experience some sort of interruption - at worst, abort and +correctly from a transport connection loss, therefore, most applications +will experience some sort of interruption &smbmdash; at worst, abort and require restarting. If a client session has been caching writes and reads locally due to opportunistic locking, it is likely that the data will be lost when the -application restarts, or recovers from the TCP interrupt. When the TCP -connection drops, the client state is lost. When the file server -recovers, an oplock break is not sent to the client. In this case, the -work from the prior session is lost. Observing this scenario with -oplocks disabled, and the client was writing data to the file server -real-time, then the failover will provide the data on disk as it +application restarts or recovers from the TCP interrupt. When the TCP +connection drops, the client state is lost. When the file server +recovers, an oplock break is not sent to the client. In this case, the +work from the prior session is lost. Observing this scenario with +oplocks disabled and with the client writing data to the file server +real-time, the failover will provide the data on disk as it existed at the time of the disconnect. -In mission critical high availability environments, careful attention -should be given to opportunistic locking. Ideally, comprehensive +In mission-critical high-availability environments, careful attention +should be given to opportunistic locking. Ideally, comprehensive testing should be done with all affected applications with oplocks enabled and disabled. @@ -294,7 +296,7 @@ enabled and disabled. Opportunistic locking is most effective when it is confined to shares that are exclusively accessed by a single user, or by only one user at -a time. Because the true value of opportunistic locking is the local +a time. Because the true value of opportunistic locking is the local client caching of data, any operation that interrupts the caching mechanism will cause a delay. @@ -312,10 +314,10 @@ benefit of opportunistic locking can be safely realized. As each additional user accesses a file in a share with opportunistic locking enabled, the potential for delays and resulting perceived poor -performance increases. When multiple users are accessing a file on a +performance increases. When multiple users are accessing a file on a share that has oplocks enabled, the management impact of sending and -receiving oplock breaks, and the resulting latency while other clients -wait for the caching client to flush data, offset the performance gains +receiving oplock breaks and the resulting latency while other clients +wait for the caching client to flush data offset the performance gains of the caching user. @@ -328,11 +330,11 @@ in a performance bottleneck. -UNIX or NFS Client Accessed Files +UNIX or NFS Client-Accessed Files Local UNIX and NFS clients access files without a mandatory -file locking mechanism. Thus, these client platforms are incapable of +file-locking mechanism. Thus, these client platforms are incapable of initiating an oplock break request from the server to a Windows client that has a file cached. Local UNIX or NFS file access can therefore write to a file that has been cached by a Windows client, which @@ -341,7 +343,7 @@ exposes the file to likely data corruption. If files are shared between Windows clients, and either local UNIX -or NFS users, then turn opportunistic locking off. +or NFS users, turn opportunistic locking off. @@ -354,8 +356,8 @@ The biggest potential performance improvement for opportunistic locking occurs when the client-side caching of reads and writes delivers the most differential over sending those reads and writes over the wire. This is most likely to occur when the network is extremely slow, -congested, or distributed (as in a WAN). However, network latency also -has a very high impact on the reliability of the oplock break +congested, or distributed (as in a WAN). However, network latency also +has a high impact on the reliability of the oplock break mechanism, and thus increases the likelihood of encountering oplock problems that more than offset the potential perceived performance gain. Of course, if an oplock break never has to be sent, then this is @@ -374,11 +376,11 @@ regularly opening the same file. Multi-User Databases -Multi-user databases clearly pose a risk due to their very nature - +Multi-user databases clearly pose a risk due to their very nature &smbmdash; they are typically heavily accessed by numerous users at random -intervals. Placing a multi-user database on a share with opportunistic +intervals. Placing a multi-user database on a share with opportunistic locking enabled will likely result in a locking management bottleneck -on the Samba server. Whether the database application is developed +on the Samba server. Whether the database application is developed in-house or a commercially available product, ensure that the share has opportunistic locking disabled. @@ -389,15 +391,15 @@ has opportunistic locking disabled. PDM Data Shares -Process Data Management (PDM) applications such as IMAN, Enovia, and -Clearcase, are increasing in usage with Windows client platforms, and -therefore SMB data stores. PDM applications manage multi-user -environments for critical data security and access. The typical PDM +Process Data Management (PDM) applications such as IMAN, Enovia and +Clearcase are increasing in usage with Windows client platforms, and +therefore SMB datastores. PDM applications manage multi-user +environments for critical data security and access. The typical PDM environment is usually associated with sophisticated client design -applications that will load data locally as demanded. In addition, the +applications that will load data locally as demanded. In addition, the PDM application will usually monitor the data-state of each client. In this case, client-side data caching is best left to the local -application and PDM server to negotiate and maintain. It is +application and PDM server to negotiate and maintain. It is appropriate to eliminate the client OS from any caching tasks, and the server from any oplock management, by disabling opportunistic locking on the share. @@ -411,11 +413,11 @@ the share. Samba includes an &smb.conf; parameter called force user that changes the user accessing a share from the incoming user to whatever user is -defined by the smb.conf variable. If opportunistic locking is enabled +defined by the smb.conf variable. If opportunistic locking is enabled on a share, the change in user access causes an oplock break to be sent -to the client, even if the user has not explicitly loaded a file. In +to the client, even if the user has not explicitly loaded a file. In cases where the network is slow or unreliable, an oplock break can -become lost without the user even accessing a file. This can cause +become lost without the user even accessing a file. This can cause apparent performance degradation as the client continually reconnects to overcome the lost oplock break. @@ -434,7 +436,7 @@ Avoid the combination of the following: - Opportunistic Locking Enabled + Opportunistic locking enabled @@ -446,29 +448,29 @@ Avoid the combination of the following: Samba provides opportunistic locking parameters that allow the administrator to adjust various properties of the oplock mechanism to -account for timing and usage levels. These parameters provide good +account for timing and usage levels. These parameters provide good versatility for implementing oplocks in environments where they would -likely cause problems. The parameters are: +likely cause problems. The parameters are: oplock break wait time, oplock contention limit. -For most users, administrators, and environments, if these parameters +For most users, administrators and environments, if these parameters are required, then the better option is to simply turn oplocks off. -The samba SWAT help text for both parameters reads "DO NOT CHANGE THIS -PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." +The Samba SWAT help text for both parameters reads: Do not change +this parameter unless you have read and understood the Samba oplock code. This is good advice. -Mission Critical High Availability +Mission-Critical High-Availability -In mission critical high availability environments, data integrity is -often a priority. Complex and expensive configurations are implemented +In mission-critical high-availability environments, data integrity is +often a priority. Complex and expensive configurations are implemented to ensure that if a client loses connectivity with a file server, a failover replacement will be available immediately to provide continuous data availability. @@ -477,11 +479,11 @@ continuous data availability. Windows client failover behavior is more at risk of application interruption than other platforms because it is dependant upon an -established TCP transport connection. If the connection is interrupted -- as in a file server failover - a new session must be established. +established TCP transport connection. If the connection is interrupted +&smbmdash; as in a file server failover &smbmdash; a new session must be established. It is rare for Windows client applications to be coded to recover -correctly from a transport connection loss, therefore most applications -will experience some sort of interruption - at worst, abort and +correctly from a transport connection loss, therefore, most applications +will experience some sort of interruption &smbmdash; at worst, abort and require restarting. @@ -489,18 +491,18 @@ require restarting. If a client session has been caching writes and reads locally due to opportunistic locking, it is likely that the data will be lost when the application restarts, or recovers from the TCP interrupt. When the TCP -connection drops, the client state is lost. When the file server -recovers, an oplock break is not sent to the client. In this case, the -work from the prior session is lost. Observing this scenario with +connection drops, the client state is lost. When the file server +recovers, an oplock break is not sent to the client. In this case, the +work from the prior session is lost. Observing this scenario with oplocks disabled, and the client was writing data to the file server real-time, then the failover will provide the data on disk as it existed at the time of the disconnect. -In mission critical high availability environments, careful attention -should be given to opportunistic locking. Ideally, comprehensive -testing should be done with all affected applications with oplocks +In mission-critical high-availability environments, careful attention +should be given to opportunistic locking. Ideally, comprehensive +testing should be done with all effected applications with oplocks enabled and disabled. @@ -512,20 +514,20 @@ enabled and disabled. Samba Opportunistic Locking Control -Opportunistic Locking is a unique Windows file locking feature. It is +Opportunistic locking is a unique Windows file locking feature. It is not really file locking, but is included in most discussions of Windows file locking, so is considered a de facto locking feature. -Opportunistic Locking is actually part of the Windows client file -caching mechanism. It is not a particularly robust or reliable feature +Opportunistic locking is actually part of the Windows client file +caching mechanism. It is not a particularly robust or reliable feature when implemented on the variety of customized networks that exist in enterprise computing. -Like Windows, Samba implements Opportunistic Locking as a server-side -component of the client caching mechanism. Because of the lightweight +Like Windows, Samba implements opportunistic locking as a server-side +component of the client caching mechanism. Because of the lightweight nature of the Windows feature design, effective configuration of -Opportunistic Locking requires a good understanding of its limitations, +opportunistic locking requires a good understanding of its limitations, and then applying that understanding when configuring data access for each particular customized network and client usage state. @@ -533,13 +535,13 @@ each particular customized network and client usage state. Opportunistic locking essentially means that the client is allowed to download and cache a file on their hard drive while making changes; if a second client wants to access the -file, the first client receives a break and must synchronise the file back to the server. +file, the first client receives a break and must synchronize the file back to the server. This can give significant performance gains in some cases; some programs insist on -synchronising the contents of the entire file back to the server for a single change. +synchronizing the contents of the entire file back to the server for a single change. -Level1 Oplocks (aka just plain "oplocks") is another term for opportunistic locking. +Level1 Oplocks (also known as just plain oplocks) is another term for opportunistic locking. @@ -551,18 +553,18 @@ on files that the client has no initial intention to write to at time of opening Kernel Oplocks are essentially a method that allows the Linux kernel to co-exist with Samba's oplocked files, although this has provided better integration of MS Windows network -file locking with the under lying OS, SGI IRIX and Linux are the only two OS's that are -oplock aware at this time. +file locking with the underlying OS, SGI IRIX and Linux are the only two OSs that are +oplock-aware at this time. Unless your system supports kernel oplocks, you should disable oplocks if you are accessing the same files from both UNIX/Linux and SMB clients. Regardless, oplocks should always be disabled if you are sharing a database file (e.g., Microsoft Access) between -multiple clients, as any break the first client receives will affect synchronisation of +multiple clients, as any break the first client receives will affect synchronization of the entire file (not just the single record), which will result in a noticeable performance impairment and, more likely, problems accessing the database in the first place. Notably, -Microsoft Outlook's personal folders (*.pst) react very badly to oplocks. If in doubt, +Microsoft Outlook's personal folders (*.pst) react quite badly to oplocks. If in doubt, disable oplocks and tune your system from that point. @@ -583,7 +585,7 @@ measurable speed benefit on your network, it might not be worth the hassle of de Example Configuration -In the following we examine two distinct aspects of Samba locking controls. +In the following section we examine two distinct aspects of Samba locking controls. @@ -602,7 +604,7 @@ You can disable oplocks on a per-share basis with the following: -The default oplock type is Level1. Level2 Oplocks are enabled on a per-share basis +The default oplock type is Level1. Level2 oplocks are enabled on a per-share basis in the &smb.conf; file. @@ -618,52 +620,52 @@ Alternately, you could disable oplocks on a per-file basis within the share: If you are experiencing problems with oplocks as apparent from Samba's log entries, -you may want to play it safe and disable oplocks and level2 oplocks. +you may want to play it safe and disable oplocks and Level2 oplocks. -Disabling Kernel OpLocks +Disabling Kernel Oplocks -Kernel OpLocks is an &smb.conf; parameter that notifies Samba (if +Kernel oplocks is an &smb.conf; parameter that notifies Samba (if the UNIX kernel has the capability to send a Windows client an oplock break) when a UNIX process is attempting to open the file that is -cached. This parameter addresses sharing files between UNIX and -Windows with Oplocks enabled on the Samba server: the UNIX process +cached. This parameter addresses sharing files between UNIX and +Windows with oplocks enabled on the Samba server: the UNIX process can open the file that is Oplocked (cached) by the Windows client and the smbd process will not send an oplock break, which exposes the file -to the risk of data corruption. If the UNIX kernel has the ability to +to the risk of data corruption. If the UNIX kernel has the ability to send an oplock break, then the kernel oplocks parameter enables Samba -to send the oplock break. Kernel oplocks are enabled on a per-server +to send the oplock break. Kernel oplocks are enabled on a per-server basis in the &smb.conf; file. - + kernel oplocksyes -The default is "no". +The default is no. -Veto OpLocks is an &smb.conf; parameter that identifies specific files for -which Oplocks are disabled. When a Windows client opens a file that +Veto opLocks is an &smb.conf; parameter that identifies specific files for +which oplocks are disabled. When a Windows client opens a file that has been configured for veto oplocks, the client will not be granted the oplock, and all operations will be executed on the original file on -disk instead of a client-cached file copy. By explicitly identifying -files that are shared with UNIX processes, and disabling oplocks for +disk instead of a client-cached file copy. By explicitly identifying +files that are shared with UNIX processes and disabling oplocks for those files, the server-wide Oplock configuration can be enabled to allow Windows clients to utilize the performance benefit of file -caching without the risk of data corruption. Veto Oplocks can be +caching without the risk of data corruption. Veto Oplocks can be enabled on a per-share basis, or globally for the entire server, in the -&smb.conf; file: +&smb.conf; file as shown in . - - Share with some files oplocked + +Share with some files oplocked [global] veto oplock files/filename.htm/*.txt/ @@ -673,11 +675,10 @@ enabled on a per-share basis, or globally for the entire server, in the - oplock break wait time is an &smb.conf; parameter that adjusts the time -interval for Samba to reply to an oplock break request. Samba -recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND -UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Wait Time can only be -configured globally in the &smb.conf; file: +oplock break wait time is an &smb.conf; parameter +that adjusts the time interval for Samba to reply to an oplock break request. Samba recommends: +Do not change this parameter unless you have read and understood the Samba oplock code. +Oplock break Wait Time can only be configured globally in the &smb.conf; file as shown below. @@ -689,15 +690,15 @@ configured globally in the &smb.conf; file: Oplock break contention limit is an &smb.conf; parameter that limits the response of the Samba server to grant an oplock if the configured -number of contending clients reaches the limit specified by the -parameter. Samba recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU -HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break -Contention Limit can be enable on a per-share basis, or globally for -the entire server, in the &smb.conf; file: +number of contending clients reaches the limit specified by the parameter. Samba recommends +Do not change this parameter unless you have read and understood the Samba oplock code. +Oplock break Contention Limit can be enable on a per-share basis, or globally for +the entire server, in the &smb.conf; file as shown in . - + + Configuration with oplock break contention limit [global] oplock break contention limit 2 (default) @@ -718,11 +719,11 @@ the entire server, in the &smb.conf; file: There is a known issue when running applications (like Norton Anti-Virus) on a Windows 2000/ XP workstation computer that can affect any application attempting to access shared database files across a network. This is a result of a default setting configured in the Windows 2000/XP -operating system known as Opportunistic Locking. When a workstation +operating system known as opportunistic locking. When a workstation attempts to access shared data files located on another Windows 2000/XP computer, the Windows 2000/XP operating system will attempt to increase performance by locking the files and caching information locally. When this occurs, the application is unable to -properly function, which results in an Access Denied +properly function, which results in an Access Denied error message being displayed during network operations. @@ -730,7 +731,7 @@ properly function, which results in an Access Denied All Windows operating systems in the NT family that act as database servers for data files (meaning that data files are stored there and accessed by other Windows PCs) may need to have opportunistic locking disabled in order to minimize the risk of data file corruption. -This includes Windows 9x/Me, Windows NT, Windows 200x and Windows XP. +This includes Windows 9x/Me, Windows NT, Windows 200x, and Windows XP. @@ -748,7 +749,7 @@ may be used. -You can verify (or change or add, if necessary) this Registry value using the Windows +You can verify (change or add, if necessary) this registry value using the Windows Registry Editor. When you change this registry value, you will have to reboot the PC to ensure that the new setting goes into effect. @@ -802,44 +803,44 @@ files) to allow or deny opportunistic locks on local files. -To force closure of open oplocks on close or program exit EnableOpLockForceClose must be set to 1. +To force closure of open oplocks on close or program exit, EnableOpLockForceClose must be set to 1. -An illustration of how level II oplocks work: +An illustration of how Level2 oplocks work: - Station 1 opens the file, requesting oplock. + Station 1 opens the file requesting oplock. Since no other station has the file open, the server grants station 1 exclusive oplock. - Station 2 opens the file, requesting oplock. + Station 2 opens the file requesting oplock. - Since station 1 has not yet written to the file, the server asks station 1 to Break - to Level II Oplock. + Since station 1 has not yet written to the file, the server asks station 1 to break + to Level2 oplock. Station 1 complies by flushing locally buffered lock information to the server. - Station 1 informs the server that it has Broken to Level II Oplock (alternatively, + Station 1 informs the server that it has Broken to Level2 Oplock (alternately, station 1 could have closed the file). - The server responds to station 2's open request, granting it level II oplock. - Other stations can likewise open the file and obtain level II oplock. + The server responds to station 2's open request, granting it Level2 oplock. + Other stations can likewise open the file and obtain Level2 oplock. Station 2 (or any station that has the file open) sends a write request SMB. The server returns the write response. - The server asks all stations that have the file open to Break to None, meaning no + The server asks all stations that have the file open to break to none, meaning no station holds any oplock on the file. Because the workstations can have no cached writes or locks at this point, they need not respond to the break-to-none advisory; all they need do is invalidate locally cashed read-ahead data. @@ -858,7 +859,7 @@ An illustration of how level II oplocks work: -Indicates whether the redirector should use opportunistic-locking (oplock) performance +This indicates whether the redirector should use opportunistic-locking (oplock) performance enhancement. This parameter should be disabled only to isolate problems. @@ -875,9 +876,9 @@ enhancement. This parameter should be disabled only to isolate problems. -Specifies whether the server allows clients to use oplocks on files. Oplocks are a +This specifies whether the server allows clients to use oplocks on files. Oplocks are a significant performance enhancement, but have the potential to cause lost cached -data on some networks, particularly wide-area networks. +data on some networks, particularly wide area networks. @@ -886,7 +887,7 @@ data on some networks, particularly wide-area networks. -Specifies the minimum link throughput allowed by the server before it disables +This specifies the minimum link throughput allowed by the server before it disables raw and opportunistic locks for this connection. @@ -896,7 +897,7 @@ raw and opportunistic locks for this connection. -Specifies the maximum time allowed for a link delay. If delays exceed this number, +This specifies the maximum time allowed for a link delay. If delays exceed this number, the server disables raw I/O and opportunistic locking for this connection. @@ -906,7 +907,7 @@ the server disables raw I/O and opportunistic locking for this connection. -Specifies the time that the server waits for a client to respond to an oplock break +This specifies the time that the server waits for a client to respond to an oplock break request. Smaller values can allow detection of crashed clients more quickly but can potentially cause loss of cached data. @@ -919,7 +920,7 @@ potentially cause loss of cached data. If you have applied all of the settings discussed in this chapter but data corruption problems -and other symptoms persist, here are some additional things to check out: +and other symptoms persist, here are some additional things to check out. @@ -938,86 +939,84 @@ our Knowledge Base. Common Errors -In some sites locking problems surface as soon as a server is installed, in other sites +In some sites, locking problems surface as soon as a server is installed; in other sites locking problems may not surface for a long time. Almost without exception, when a locking problem does surface it will cause embarrassment and potential data corruption. -Over the past few years there have been a number of complaints on the samba mailing lists -that have claimed that samba caused data corruption. Three causes have been identified +Over the past few years there have been a number of complaints on the Samba mailing lists +that have claimed that Samba caused data corruption. Three causes have been identified so far: Incorrect configuration of opportunistic locking (incompatible with the application - being used. This is a VERY common problem even where MS Windows NT4 or MS Windows 200x - based servers were in use. It is imperative that the software application vendors' + being used. This is a common problem even where MS Windows NT4 or MS Windows + 200x-based servers were in use. It is imperative that the software application vendors' instructions for configuration of file locking should be followed. If in doubt, disable oplocks on both the server and the client. Disabling of all forms of file caching on the MS Windows client may be necessary also. - Defective network cards, cables, or HUBs / Switched. This is generally a more - prevalent factor with low cost networking hardware, though occasionally there - have been problems with incompatibilities in more up market hardware also. + Defective network cards, cables, or HUBs/Switched. This is generally a more + prevalent factor with low cost networking hardware, although occasionally there + have also been problems with incompatibilities in more up-market hardware. - There have been some random reports of samba log files being written over data - files. This has been reported by very few sites (about 5 in the past 3 years) - and all attempts to reproduce the problem have failed. The Samba-Team has been - unable to catch this happening and thus has NOT been able to isolate any particular - cause. Considering the millions of systems that use samba, for the sites that have - been affected by this as well as for the Samba-Team this is a frustrating and - a vexing challenge. If you see this type of thing happening please create a bug - report on https://bugzilla.samba.org without delay. Make sure that you give as much - information as you possibly can to help isolate the cause and to allow reproduction - of the problem (an essential step in problem isolation and correction). + There have been some random reports of Samba log files being written over data + files. This has been reported by very few sites (about five in the past three years) + and all attempts to reproduce the problem have failed. The Samba Team has been + unable to catch this happening and thus has not been able to isolate any particular + cause. Considering the millions of systems that use Samba, for the sites that have + been affected by this as well as for the Samba Team this is a frustrating and + a vexing challenge. If you see this type of thing happening, please create a bug + report on Samba Bugzilla without delay. + Make sure that you give as much information as you possibly can help isolate the + cause and to allow replication of the problem (an essential step in problem isolation and correction). - locking.tdb error messages + locking.tdb Error Messages - We are seeing lots of errors in the samba logs like: - + We are seeing lots of errors in the Samba logs, like: tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic 0x4d6f4b61 at offset=36116 - + What do these mean? - Corrupted tdb. Stop all instances of smbd, delete locking.tdb, restart smbd. + This error indicated a corrupted tdb. Stop all instances of smbd, delete locking.tdb, and restart smbd. - Problems saving files in MS Office on Windows XP + Problems Saving Files in MS Office on Windows XP This is a bug in Windows XP. More information can be - found in Microsoft Knowledge Base article 812937. + found in Microsoft Knowledge Base article 812937. - Long delays deleting files over network with XP SP1 + Long Delays Deleting Files Over Network with XP SP1 - It sometimes takes approximately 35 seconds to delete files over the network after XP SP1 has been applied + It sometimes takes approximately 35 seconds to delete files over the network after XP SP1 has been applied. - This is a bug in Windows XP. More information can be - found in - Microsoft Knowledge Base article 811492. + This is a bug in Windows XP. More information can be found in + Microsoft Knowledge Base article 811492. @@ -1028,7 +1027,7 @@ tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic You may want to check for an updated version of this white paper on our Web site from time to time. Many of our white papers are updated as information changes. For those papers, -the Last Edited date is always at the top of the paper. +the last edited date is always at the top of the paper. @@ -1043,18 +1042,19 @@ Windows Base Services > Files and I/O > SDK Documentation > File Storag -Microsoft Knowledge Base Article Q224992 "Maintaining Transactional Integrity with OPLOCKS", + Microsoft Knowledge Base Article Q224992 Maintaining Transactional Integrity +with OPLOCKS, Microsoft Corporation, April 1999, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q224992. -Microsoft Knowledge Base Article Q296264 "Configuring Opportunistic Locking in Windows 2000", +Microsoft Knowledge Base Article Q296264 Configuring Opportunistic Locking in Windows 2000, Microsoft Corporation, April 2001, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296264. -Microsoft Knowledge Base Article Q129202 "PC Ext: Explanation of Opportunistic Locking on Windows NT", - Microsoft Corporation, April 1995, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202. +Microsoft Knowledge Base Article Q129202 PC Ext: Explanation of Opportunistic Locking on Windows NT, +Microsoft Corporation, April 1995, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202. diff --git a/docs/docbook/projdoc/msdfs_setup.xml b/docs/docbook/projdoc/msdfs_setup.xml index 90259f6a51..94241e03f1 100644 --- a/docs/docbook/projdoc/msdfs_setup.xml +++ b/docs/docbook/projdoc/msdfs_setup.xml @@ -10,6 +10,7 @@ + &author.jht; 12 Jul 2000 @@ -20,44 +21,48 @@ Features and Benefits - The Distributed File System (or DFS) provides a means of separating the logical + The Distributed File System (DFS) provides a means of separating the logical view of files and directories that users see from the actual physical locations of these resources on the network. It allows for higher availability, smoother - storage expansion, load balancing etc. + storage expansion, load balancing, and so on. For information about DFS, refer to the Microsoft documentation. - - - This document explains how to host a DFS tree on a UNIX machine (for DFS-aware clients to browse) using Samba. - To enable SMB-based DFS for Samba, configure it with the + To enable SMB-based DFS for Samba, configure it with the option. Once built, a Samba server can be made a DFS server by setting the global - boolean host msdfs + Boolean host msdfs parameter in the &smb.conf; file. You designate a share as a DFS - root using the share level boolean msdfs root parameter. A DFS root directory on Samba hosts DFS + root using the Share Level Boolean msdfs root parameter. A DFS root directory on Samba hosts DFS links in the form of symbolic links that point to other servers. For example, a symbolic link junction->msdfs:storage1\share1 in the share directory acts as the DFS junction. When DFS-aware clients attempt to access the junction link, - they are redirected to the storage location (in this case, \\storage1\share1). + they are redirected to the storage location (in this case, \\storage1\share1). DFS trees on Samba work with all DFS-aware clients ranging from Windows 95 to 200x. - - - - Here's an example of setting up a DFS tree on a Samba server. - + shows how to setup a DFS tree on a Samba server. + In the /export/dfsroot directory, you set up your DFS links to + other servers on the network. + +&rootprompt;cd /export/dfsroot +&rootprompt;chown root /export/dfsroot +&rootprompt;chmod 755 /export/dfsroot +&rootprompt;ln -s msdfs:storageA\\shareA linka +&rootprompt;ln -s msdfs:serverB\\share,serverC\\share linkb + + - - smb.conf with DFS configured + + +smb.conf with DFS configured [global] netbios name&example.server.samba; host msdfs yes @@ -65,27 +70,16 @@ [dfs] path/export/dfsroot msdfs rootyes - - - - In the /export/dfsroot directory we set up our DFS links to - other servers on the network. - - -&rootprompt;cd /export/dfsroot -&rootprompt;chown root /export/dfsroot -&rootprompt;chmod 755 /export/dfsroot -&rootprompt;ln -s msdfs:storageA\\shareA linka -&rootprompt;ln -s msdfs:serverB\\share,serverC\\share linkb - + + You should set up the permissions and ownership of - the directory acting as the DFS root such that only designated + the directory acting as the DFS root so that only designated users can create, delete or modify the msdfs links. Also note that symlink names should be all lowercase. This limitation exists to have Samba avoid trying all the case combinations to get at - the link name. Finally set up the symbolic links to point to the - network shares you want, and start Samba. + the link name. Finally, set up the symbolic links to point to the + network shares you want and start Samba. Users on DFS-aware clients can now browse the DFS tree on the Samba server at \\samba\dfs. Accessing @@ -97,21 +91,70 @@ Common Errors Windows clients need to be rebooted - if a previously mounted non-dfs share is made a DFS + if a previously mounted non-DFS share is made a DFS root or vice versa. A better way is to introduce a new share and make it the DFS root. - Currently there's a restriction that msdfs + Currently, there's a restriction that msdfs symlink names should all be lowercase. For security purposes, the directory acting as the root of the DFS tree should have ownership - and permissions set so that only designated users can + and permissions set so only designated users can modify the symbolic links in the directory. + + + MSDFS UNIX Path Is Case-Critical + + + A network administrator sent advice to the Samba mailing list + after a long sessions trying to determine why DFS was not working. + His advice is worth noting. + + + + I spent some time trying to figure out why my particular + dfs root wasn't working. I noted in the documenation that + the symlink should be in all lowercase. It should be + amended that the entire path to the symlink should all be + in lowercase as well. + + + + For example, I had a share defined as such: + + + [pub] + path = /export/home/Shares/public_share + msdfs root = yes + + + and I could not make my Windows 9x/Me (with the dfs client installed) + follow this symlink: + + + damage1 -> msdfs:damage\test-share + + + + + Running a debug level of 10 reveals: + + + [2003/08/20 11:40:33, 5] msdfs/msdfs.c:is_msdfs_link(176) + is_msdfs_link: /export/home/shares/public_share/* does not exist. + + + Curious. So I changed the directory name from .../Shares/... to + .../shares/... (along with my service definition) and it worked! + + + + diff --git a/docs/docbook/projdoc/printer_driver2.xml b/docs/docbook/projdoc/printer_driver2.xml index 0d0dbb0188..c823de28bf 100644 --- a/docs/docbook/projdoc/printer_driver2.xml +++ b/docs/docbook/projdoc/printer_driver2.xml @@ -9,6 +9,7 @@ &author.jerry; + &author.jht; May 31, 2003 @@ -18,47 +19,48 @@ Features and Benefits -Printing is often a mission-critical service for the users. Samba can +Printing is often a mission-critical service for the users. Samba can provide this service reliably and seamlessly for a client network consisting of Windows workstations. -A Samba print service may be run on a Standalone or a Domain -member server, side by side with file serving functions, or on a -dedicated print server. It can be made as tight or as loosely secured -as needs dictate. Configurations may be simple or complex. Available -authentication schemes are essentially the same as described for file -services in previous chapters. Overall, Samba's printing support is -now able to replace an NT or Windows 2000 print server full-square, -with additional benefits in many cases. Clients may download and -install drivers and printers through their familiar "Point'n'Print" -mechanism. Printer installations executed by "Logon Scripts" are no -problem. Administrators can upload and manage drivers to be used by -clients through the familiar "Add Printer Wizard". As an additional -benefit, driver and printer management may be run from the command line -or through scripts, making it more efficient in case of large numbers -of printers. If a central accounting of print jobs (tracking every -single page and supplying the raw data for all sorts of statistical -reports) is required, this is best supported by CUPS as the print -subsystem underneath the Samba hood. +A Samba print service may be run on a Stand-alone or Domain Member server, +side by side with file serving functions, or on a dedicated print server. +It can be made as tight or as loosely secured as needs dictate. Configurations +may be simple or complex. Available authentication schemes are essentially +the same as described for file services in previous chapters. Overall, +Samba's printing support is now able to replace an NT or Windows 2000 +print server full-square, with additional benefits in many cases. Clients +may download and install drivers and printers through their familiar +Point'n'Print mechanism. Printer installations executed by +Logon Scripts are no problem. Administrators can upload and +manage drivers to be used by clients through the familiar Add Printer +Wizard. As an additional benefit, driver and printer management may +be run from the command line or through scripts, making it more efficient +in case of large numbers of printers. If a central accounting of print jobs +(tracking every single page and supplying the raw data for all sorts of +statistical reports) is required, this function is best supported by +the newer Common UNIX Printing System (CUPS) +as the print subsystem underneath the Samba hood. -This chapter deals with the foundations of Samba printing, as they -implemented by the more traditional UNIX (BSD- and System V-style) -printing systems. Many things apply to CUPS, the newer Common UNIX -Printing System, too; so if you use CUPS, you might be tempted to jump -to the next chapter -- but you will certainly miss a few things if you -do so. Better to read this chapter too. +This chapter deals with the foundations of Samba printing as they +are implemented by the more traditional UNIX (BSD- and System V-style) +printing systems. Many things covered in this chapter apply also to CUPS. +If you use CUPS, you may be tempted +to jump to the next chapter but you will certainly miss a few things if +you do. It is recommended that you read this chapter as well as . -Most of the given examples have been verified on Windows XP +Most of the following examples have been verified on Windows XP Professional clients. Where this document describes the responses to -commands given, bear in mind that Windows 2000 clients are very -similar, but may differ in details. Windows NT is somewhat different +commands given, bear in mind that Windows 200x/XP clients are quite +similar, but may differ in minor details. Windows NT is somewhat different again. @@ -69,52 +71,68 @@ again. Technical Introduction -Samba's printing support always relies on the installed print -subsystem of the UNIX OS it runs on. Samba is a "middleman". It takes -printfiles from Windows (or other SMB) clients and passes them to the -real printing system for further processing. Therefore it needs to -"talk" to two sides: to the Windows print clients and to the UNIX -printing system. Hence we must differentiate between the various -client OS types each of which behave differently, as well as the -various UNIX print subsystems, which themselves have different -features and are accessed differently. This part of the Samba HOWTO -Collection deals with the "traditional" way of UNIX printing first; -the next chapter covers in great detail the more modern -Common UNIX Printing System -(CUPS). +Samba's printing support always relies on the installed print subsystem +of the UNIX OS it runs on. Samba is a middleman. It takes +print files from Windows (or other SMB) clients and passes them to the real +printing system for further processing, therefore, it needs to communicate with +both sides: the Windows print clients and the UNIX printing system. Hence, we +must differentiate between the various client OS types, each of which behave +differently, as well as the various UNIX print subsystems, which themselves +have different features and are accessed differently. + + + +This deals with the traditional way of UNIX printing. The next chapter +covers in great detail the more modern Common UNIX Printing +System (CUPS). + + +CUPS users, be warned: do not just jump on to the next +chapter. You might miss important information only found here! + -CUPS users, be warned: don't just jump on to the next -chapter. You might miss important information contained only -here! + +It is apparent from postings on the Samba mailing list that print configuration +is one of the most problematic aspects of Samba administration today. Many +new Samba administrators have the impression that Samba performs some sort +of print processing. Rest assured, Samba does not peform any type of print +processing. It does not do any form of print filtering. + + + +Samba obtains from its clients a data stream (print job) that it spools to a +local spool area. When the entire print job has been received, Samba invokes +a local UNIX/Linux print command and passes the spooled file to it. It is +up to the local system printing subsystems to correctly process the print +job and to submit it to the printer. -What happens if you send a Job from a Client +Client to Samba Print Job Processing -To successfully print a job from a Windows client via a Samba -print server to a UNIX printer, there are 6 (potentially 7) -stages: +Successful printing from a Windows client via a Samba print server to a UNIX +printer involves six (potentially seven) stages: -Windows opens a connection to the printer share +Windows opens a connection to the printer share. -Samba must authenticate the user +Samba must authenticate the user. -Windows sends a copy of the printfile over the network -into Samba's spooling area +Windows sends a copy of the print file over the network +into Samba's spooling area. -Windows closes the connection again +Windows closes the connection. Samba invokes the print command to hand the file over -to the UNIX print subsystem's spooling area +to the UNIX print subsystem's spooling area. -The UNIX print subsystem processes the print -job +The UNIX print subsystem processes the print job. -The printfile may need to be explicitly deleted -from the Samba spooling area. +The print file may need to be explicitly deleted +from the Samba spooling area. This item depends on your print spooler +configuration settings. @@ -123,97 +141,52 @@ from the Samba spooling area.Printing Related Configuration Parameters -There are a number of configuration parameters in - controlling Samba's printing -behaviour. Please also refer to the man page for smb.conf to -acquire an overview about these. As with other parameters, there are -Global Level (tagged with a "G" in the listings) and -Service Level ("S") parameters. +There are a number of configuration parameters to control Samba's +printing behavior. Please refer to the man page for &smb.conf; for an +overview of these. As with other parameters, there are Global Level +(tagged with a G in the listings) and Service Level +(S) parameters. -Service Level Parameters -These may go into the -[global] section of &smb.conf;. -In this case they define the default -behaviour of all individual or service level shares (provided those -don't have a different setting defined for the same parameter, thus -overriding the global default). - - -Global Parameters -These may not go into individual -shares. If they go in by error, the "testparm" utility can discover -this (if you run it) and tell you so. - + Global Parameters + These may not go into + individual share definitions. If they go in by error, + the testparm utility can discover this + (if you run it) and tell you so. + + + + Service Level Parameters + These may be specified in the + [global] section of &smb.conf;. + In this case they define the default behavior of all individual + or service level shares (provided they do not have a different + setting defined for the same parameter, thus overriding the + global default). + + - -Parameters Recommended for Use - -The following &smb.conf; parameters directly -related to printing are used in Samba. See also the -&smb.conf; man page for detailed explanations: - - -Global level parameters: addprinter command, -deleteprinter command, -disable spoolss, -enumports command, -load printers, -lpq cache time, -os2 driver map, -printcap name, printcap, -show add printer wizard, -total print jobs, -use client driver. - - -Service level parameters: hosts allow, -hosts deny, -lppause command, -lpq command, -lpresume command, -lprm command, -max print jobs, -min print space, -print command, -printable, print ok , -printer name, printer, -printer admin, -printing[cups|bsd|lprng...], -queuepause command, -queueresume command, -total print jobs. - - - -Samba's printing support implements the Microsoft Remote Procedure -Calls (MS-RPC) methods for printing. These are used by Windows NT (and -later) print servers. The old "LanMan" protocol is still supported as -a fallback resort, and for older clients to use. More details will -follow further beneath. - - - -A simple Configuration to Print +Simple Print Configuration -Here is a very simple example configuration for print related settings -in the file. If you compare it with your own system's , you probably find some -additional parameters included there (as pre-configured by your OS -vendor). Further below is a discussion and explanation of the -parameters. Note, that this example doesn't use many parameters. + shows a simple printing configuration. +If you compare this with your own, you may find +additional parameters that have been pre-configured by your OS +vendor. Below is a discussion and explanation of the +parameters. This example does not use many parameters. However, in many environments these are enough to provide a valid -&smb.conf; file which enables all clients to print. +&smb.conf; file that enables all clients to print. - - Simple configuration with BSD printing + + +Simple configuration with BSD printing [global] printingbsd load printersyes @@ -226,44 +199,44 @@ However, in many environments these are enough to provide a valid -This is only an example configuration. Samba assigns default values to all -configuration parameters. On the whole the defaults are conservative and -sensible. When a parameter is specified in the &smb.conf; file this overwrites -the default value. The testparm utility when run as root -is capable of reporting all setting, both default as well as &smb.conf; file -settings. Testparm gives warnings for all mis-configured -settings. The complete output is easily 340 lines and more, so you may want -to pipe it through a pager program. +This is only an example configuration. Samba assigns default values to +all configuration parameters. The defaults are conservative +and sensible. When a parameter is specified in the &smb.conf; file, this +overwrites the default value. The testparm utility when +run as root is capable of reporting all setting, both default as well as +&smb.conf; file settings. Testparm gives warnings for all +misconfigured settings. The complete output is easily 340 lines and more, +so you may want to pipe it through a pager program. The syntax for the configuration file is easy to grasp. You should -know that is not very picky about its -syntax. It has been explained elsewhere in this document. A short -reminder: It even tolerates some spelling errors (like "browsable" -instead of "browseable"). Most spelling is case-insensitive. Also, you -can use "Yes|No" or "True|False" for boolean settings. Lists of names +know that is not very picky about its syntax. As has been explained +elsewhere in this document, Samba tolerates some spelling errors (such +as browsable instead of +browseable), and spelling is +case-insensitive. It is permissible to use Yes/No +or True/False for Boolean settings. Lists of names may be separated by commas, spaces or tabs. -Verification of "Settings in Use" with <command>testparm</command> +Verifing Configuration with <command>testparm</command> -To see all (or at least most) printing related settings in Samba, -including the implicitly used ones, try the command outlined below -(hit "ENTER" twice!). It greps for all occurrences of "lp", "print", -"spool", "driver", "ports" and "[" in testparm's output and gives you -a nice overview about the running smbd's print configuration. (Note -that this command does not show individually created printer shares, -or the spooling paths in each case). Here is the output of my Samba -setup, with exactly the same settings in -as shown above: +To see all (or at least most) printing-related settings in Samba, including +the implicitly used ones, try the command outlined below. This command greps +for all occurrences of lp, print, spool, driver, ports +and [ in testparms output. This provides a convenient +overview of the running smbd print configuration. This +command does not show individually created printer shares or the spooling +paths they may use. Here is the output of my Samba setup, with settings +shown in : -&rootprompt;testparm -v | egrep "(lp|print|spool|driver|ports|\[)" - Load smb config files from /etc/samba/smb.conf.simpleprinting +&rootprompt;testparm -s -v | egrep "(lp|print|spool|driver|ports|\[)" + Load smb config files from /etc/samba/smb.conf Processing section "[homes]" Processing section "[printers]" @@ -297,104 +270,95 @@ as shown above: [printers] path = /var/spool/samba printable = Yes - - + + You can easily verify which settings were implicitly added by Samba's -default behaviour. Don't forget about this point: it may +default behavior. Remember: it may be important in your future dealings with Samba. - testparm in samba 3 behaves differently from 2.2.x: used -without the "-v" switch it only shows you the settings actually -written into ! To see the complete -configuration used, add the "-v" parameter to testparm. + testparm in Samba-3 behaves differently from that in 2.2.x: used +without the -v switch it only shows you the settings actually +written into! To see the complete +configuration used, add the -v parameter to testparm. -A little Experiment to warn you +Rapid Configuration Validation Should you need to troubleshoot at any stage, please always come back -to this point first and verify if "testparm" shows the parameters you -expect! To give you an example from personal experience as a warning, -try to just "comment out" the load printers" +to this point first and verify if testparm shows the parameters you +expect. To give you a warning from personal experience, +try to just comment out the load printers parameter. If your 2.2.x system behaves like mine, you'll see this: &rootprompt;grep "load printers" /etc/samba/smb.conf - # load printers = Yes - # This setting is commented ooouuuuut!! + # load printers = Yes + # This setting is commented out!! &rootprompt;testparm -v /etc/samba/smb.conf | egrep "(load printers)" load printers = Yes - -Despite my imagination that the commenting out of this setting should -prevent Samba from publishing my printers, it still did! Oh Boy -- it -cost me quite some time to find out the reason. But I am not fooled -any more... at least not by this ;-) +I assumed that commenting out of this setting should prevent Samba from +publishing my printers, but it still did. It took some time to figure out +the reason. But I am no longer fooled ... at least not by this. &rootprompt;grep -A1 "load printers" /etc/samba/smb.conf load printers = No - # This setting is what I mean!! - # load printers = Yes - # This setting is commented ooouuuuut!! + # The above setting is what I want! + # load printers = Yes + # This setting is commented out! -&rootprompt;testparm -v smb.conf.simpleprinting | egrep "(load printers)" +&rootprompt;testparm -s -v smb.conf.simpleprinting | egrep "(load printers)" load printers = No -Only when setting the parameter explicitly to -"load printersNo" -would Samba recognize my intentions. So my strong advice is: +Only when the parameter is explicitly set to +load printersNo +would Samba conform with my intentions. So, my strong advice is: -Never rely on "commented out" parameters! +Never rely on commented out parameters. -Always set it up explicitly as you intend it to +Always set parameters explicitly as you intend them to behave. Use testparm to uncover hidden -settings which might not reflect your intentions. +settings that might not reflect your intentions. -You can have a working Samba print configuration with this -minimal : - - - +The following is the most minimal configuration file: + &rootprompt;cat /etc/samba/smb.conf-minimal [printers] - -This example should show you that you can use testparm to test any -filename for fitness as a Samba configuration. Actually, we want to -encourage you not to change your - on a working system (unless you know -exactly what you are doing)! Don't rely on an assumption that changes -will only take effect after you re-start smbd! This is not the -case. Samba re-reads its every 60 -seconds and on each new client connection. You might have to face -changes for your production clients that you didn't intend to apply at -this time! You will now note a few more interesting things. Let's now -ask testparm what the Samba print configuration -would be, if you used this minimalistic file as your real -: +This example should show that you can use testparm to test any Samba +configuration file. Actually, we encourage you not +to change your working system (unless you know exactly what you are +doing). Don't rely on the assumption that changes will only take effect after +you re-start smbd! This is not the case. Samba re-reads it every 60 seconds +and on each new client connection. You might have to face changes for your +production clients that you didn't intend to apply. You will now +note a few more interesting things; testparm is useful to +identify what the Samba print configuration would be if you used this minimalistic +configuration. Here is what you can expect to find: @@ -422,71 +386,69 @@ would be, if you used this minimalistic file as your real lpq command = lpq -P%p printer name = use client driver = No + [printers] printable = Yes -testparm issued 2 warnings: +testparm issued two warnings: -because we didn't specify the -[printers] section as printable, -and - -because we didn't tell it which spool directory to -use. - + We did not specify the [printers] section as printable. + We did not tell Samba which spool directory to use. -However, this was not fatal, and samba will default to values that -will work here. Please, don't rely on this and don't use this -example! This was only meant to make you careful to design and specify -your setup to be what you really want it to be. The outcome on your -system may vary for some parameters, since you may have a Samba built -with a different compile-time configuration. -Warning: don't put a comment sign at -the end of a valid line. It -will cause the parameter to be ignored (just as if you had put the -comment sign at the front). At first I regarded this as a bug in my -Samba version(s). But the man page states: Internal whitespace -in a parameter value is retained verbatim. This means that a -line consisting of, for example, +However, this was not fatal and Samba will default to values that will +work. Please, do not rely on this and do not use this example. This was +included to encourage you to be careful to design and specify your setup to do +precisely what you require. The outcome on your system may vary for some +parameters given, since Samba may have been built with different compile-time +options. Warning: do not put a comment sign +at the end of a valid line. It will cause the parameter +to be ignored (just as if you had put the comment sign at the front). At first +I regarded this as a bug in my Samba versions. But the man page clearly says: +Internal whitespace in a parameter value is retained verbatim. +This means that a line consisting of, for example: -This defines LPRng as the printing system" +This defines LPRng as the printing system printinglprng -will regard the whole of the string after the "=" -sign as the value you want to define. And this is an invalid value -that will be ignored, and a default value used instead.] +will regard the whole of the string after the += sign as the value you want to +define. This is an invalid value that will be ignored and a default +value will be +used in its place. -Extended Sample Configuration to Print +Extended Printing Configuration - In the extended BSD configuration example we show a more verbose example configuration for print related - settings in BSD-printing style environment . Below is a discussion -and explanation of the various parameters. We chose to use BSD-style -printing here, because we guess it is still the most commonly used -system on legacy Linux installations (new installs now predominantly -have CUPS, which is discussed entirely in the next chapter of this -document). Note, that this example explicitly names many parameters -which don't need to be specified because they are set by default. You -might be able to do with a leaner &smb.conf; file. +In we show a more verbose example configuration +for print-related settings in a BSD-style printing environment. What follows +is a discussion and explanation of the various parameters. We chose to +use BSD-style printing here because it is still the most commonly used +system on legacy UNIX/Linux installations. New installations predominantly +use CUPS, which is discussed in a separate chapter. explicitly +names many parameters that do not need to be specified because they are set +by default. You could use a much leaner &smb.conf; file. Alternately, you can use +testparm or SWAT to optimize the &smb.conf; +file to remove all parameters that are set at default. + - Extended configuration with BSD printing - [global] + Extended BSD Printing Configuration +[global] printingbsd load printersyes show add printer wizardyes @@ -519,532 +481,485 @@ might be able to do with a leaner &smb.conf; file. -This also is only an example configuration. You -may not find all the settings in your own - (as pre-configured by your OS -vendor). Many configuration parameters, if not explicitly set to a -specific value, are used and set by Samba implicitly to its own -default, because these have been compiled in. To see all settings, let -root use the testparm -utility. testparm also gives warnings if you have -mis-configured certain things.. +This is an example configuration. You may not find all the settings that are in +the confioguration file that was provided by the OS vendor. Samba configuration +parameters, if not explicitly set default to a sensible value. +To see all settings, as root use the testparm +utility. testparm gives warnings for misconfigured settings. - - -Detailed Explanation of the Example's Settings + +Detailed Explanation Settings -Following is a discussion of the settings from above shown example. +The following is a discussion of the settings from above shown example. - + The [global] Section -The [global] section is one of 4 special +The [global] section is one of four special sections (along with [[homes], -[printers] and -[print$]...) It contains all parameters which -apply to the server as a whole. It is the place for parameters which -have only a "global" meaning. It may also contain service level -parameters which then define default settings for all other -sections and shares. This way you can simplify the configuration and -avoid setting the same value repeatedly. (Within each individual -section or share you may however override these globally set "share -level" settings and specify other values). +[printers] +and [print$]...). The +[global] contains all parameters which apply +to the server as a whole. It is the place for parameters that have only a +global meaning. It may also contain service level parameters that then define +default settings for all other sections and shares. This way you can simplify +the configuration and avoid setting the same value repeatedly. (Within each +individual section or share you may, however, override these globally set +share settings and specify other values). -printingbsd - this causes Samba to use default print commands -applicable for the BSD (a.k.a. RFC 1179 style or LPR/LPD) printing -system. In general, the "printing" parameter informs Samba about the -print subsystem it should expect. Samba supports CUPS, LPD, LPRNG, -SYSV, HPUX, AIX, QNX and PLP. Each of these systems defaults to a -different print command (and other queue control -commands). -The printing parameter is -normally a service level parameter. Since it is included here in the -[global] section, it will take effect for all -printer shares that are not defined differently. Samba 3 no longer -supports the SOFTQ printing system. - - -load printersyes - this tells Samba to create automatically all -available printer shares. "Available" printer shares are discovered by -scanning the printcap file. All created printer shares are also loaded -for browsing. If you use this parameter, you do not need to specify -separate shares for each printer. Each automatically created printer -share will clone the configuration options found in the -[printers] section. (A load printers -= no setting will allow you to specify each UNIX printer -you want to share separately, leaving out some you don't want to be -publicly visible and available). - -show add printer wizardyes this setting is normally -enabled by default (even if the parameter is not written into the -). It makes the Add Printer Wizard icon -show up in the Printers folder of the Samba host's -share listing (as shown in Network Neighbourhood or -by the net view command). To disable it, you need to -explicitly set it to no (commenting it out -will not suffice!). The Add Printer Wizard lets you upload printer -drivers to the [print$] share and associate it -with a printer (if the respective queue exists there before the -action), or exchange a printer's driver against any other previously -uploaded driver. - -total print jobs100 - this setting sets the upper limit to 100 print jobs -being active on the Samba server at any one time. Should a client -submit a job which exceeds this number, a no more space -available on server type of error message will be returned by -Samba to the client. A setting of "0" (the default) means there is -no limit at all! - - -printcap name/etc/printcap - - this tells Samba where to look for a list of -available printer names. (If you use CUPS, make sure that a printcap -file is written: this is controlled by the "Printcap" directive of -cupsd.conf). - - -printer admin@ntadmin - members of the ntadmin group should be able to add -drivers and set printer properties ("ntadmin" is only an example name, -it needs to be a valid UNIX group name); root is implicitly always a -printer admin. The "@" sign precedes group names in -. A printer admin can do anything to -printers via the remote administration interfaces offered by MS-RPC -(see below). Note that the printer admin -parameter is normally a share level parameter, so you may associate -different groups to different printer shares in larger installations, -if you use the printer admin parameter on the -share levels). - - -lpq cache time20 - this controls the cache time for the results of the -lpq command. It prevents the lpq command being called too often and -reduces load on a heavily used print server. - - -use client driverno - if set to yes, this setting only -takes effect for Win NT/2k/XP clients (and not for Win 95/98/ME). Its -default value is No (or False). -It must not be enabled on print shares -(with a yes or true setting) which -have valid drivers installed on the Samba server! For more detailed -explanations see the man page of &smb.conf;. - + printingbsd + Causes Samba to use default print commands + applicable for the BSD (also known as RFC 1179 style or LPR/LPD) printing + system. In general, the printing parameter informs Samba about the + print subsystem it should expect. Samba supports CUPS, LPD, LPRNG, + SYSV, HPUX, AIX, QNX, and PLP. Each of these systems defaults to a + different print command (and other queue control + commands). + + The printing parameter is + normally a service level parameter. Since it is included here in the + [global] section, it will take effect for all + printer shares that are not defined differently. Samba-3 no longer + supports the SOFTQ printing system. + + + load printersyes + Tells Samba to create automatically all + available printer shares. Available printer shares are discovered by + scanning the printcap file. All created printer shares are also loaded + for browsing. If you use this parameter, you do not need to specify + separate shares for each printer. Each automatically created printer + share will clone the configuration options found in the + [printers] section. (The load printers + = no setting will allow you to specify each UNIX printer + you want to share separately, leaving out some you do not want to be + publicly visible and available). + + + show add printer wizardyes + Setting is normally enabled by default (even if the parameter is not specified in &smb.conf;). + It causes the Add Printer Wizard icon to appear + in the Printers folder of the Samba host's + share listing (as shown in Network Neighborhood or + by the net view command). To disable it, you need to + explicitly set it to no (commenting it out + will not suffice). The Add Printer Wizard lets you upload printer + drivers to the [print$] share and associate it + with a printer (if the respective queue exists before the + action), or exchange a printer's driver against any other previously + uploaded driver. + + + total print jobs100 + Sets the upper limit to 100 print jobs + being active on the Samba server at any one time. Should a client + submit a job that exceeds this number, a no more space + available on server type of error message will be returned by + Samba to the client. A setting of zero (the default) means there is + no limit at all. + + + printcap name/etc/printcap + Tells Samba where to look for a list of + available printer names. Where CUPS is used, make sure that a printcap + file is written. This is controlled by the Printcap directive in the + cupsd.conf file. + + + printer admin@ntadmin + Members of the ntadmin group should be able to add + drivers and set printer properties (ntadmin is only an example name, + it needs to be a valid UNIX group name); root is implicitly always a + printer admin. The @ sign precedes group names in the + /etc/group. A printer admin can do anything to + printers via the remote administration interfaces offered by MS-RPC + (see below). In larger installations, the printer admin + parameter is normally a per-share parameter. This permits different groups to administer each printer share. + + + lpq cache time20 + Controls the cache time for the results of the + lpq command. It prevents the lpq command being called too often and + reduces the load on a heavily used print server. + + + use client driverno + If set to yes, only + takes effect for Windows NT/200x/XP clients (and not for Win 95/98/ME). Its + default value is No (or False). + It must not be enabled on print shares + (with a yes or true setting) that + have valid drivers installed on the Samba server. For more detailed + explanations see the &smb.conf; man page. + - + - + The [printers] Section -This is the second special section. If a section with this name -appears in the &smb.conf;, users are able to -connect to any printer specified in the Samba host's printcap file, -because Samba on startup then creates a printer share for every -printername it finds in the printcap file. You could regard this -section as a general convenience shortcut to share all printers with -minimal configuration. It is also a container for settings which -should apply as default to all printers. (For more details see the -&smb.conf; man page.) Settings inside this -container must be share level parameters. +This is the second special section. If a section with this name appears in +the &smb.conf;, users are able to connect to any printer specified in the +Samba host's printcap file, because Samba on startup then creates a printer +share for every printername it finds in the printcap file. You could regard +this section as a general convenience shortcut to share all printers with +minimal configuration. It is also a container for settings that should +apply as default to all printers. (For more details see the &smb.conf; +man page.) Settings inside this container must be Share Level parameters. -commentAll printers - the comment is shown next to -the share if a client queries the server, either via Network -Neighbourhood or with the net view command to list -available shares. - - -printableyes - please note well, that the -[printers] service must be -declared as printable. If you specify otherwise, smbd will refuse to -load at startup. This parameter allows -connected clients to open, write to and submit spool files into the -directory specified with the path parameter for -this service. It is used by Samba to differentiate printer shares from -file shares. - -path/var/spool/samba -this must point to a directory used by Samba to spool -incoming print files. It must not be the same as the spool -directory specified in the configuration of your UNIX print -subsystem! The path would typically point to a directory -which is world writeable, with the "sticky" bit set to it. - - -browseableno - this is always set to no if -printableyes. It makes the -[printer] share itself invisible in the -list of available shares in a net view command or -in the Explorer browse list. (Note that you will of course see the -individual printers). - - -guest okyes - - -if set to yes, then no password is required to -connect to the printers service. Access will be granted with the -privileges of the guest account. On many systems the -guest account will map to a user named "nobody". This user is in the UNIX -passwd file with an empty password, but with no valid UNIX login. -(Note: on some systems the guest account might not have the -privilege to be able to print. Test this by logging in as your -guest user using su - guest and run a system print -command like - - -lpr -P printername /etc/motd - - - -publicyes - this is a synonym for guest okyes. Since we have guest okyes, -it really doesn't need to be here! (This leads to the interesting -question: What, if I by accident have to contradictory settings -for the same share? The answer is: the last one encountered by -Samba wins. The "winner" is shown by testparm. Testparm doesn't -complain about different settings of the same parameter for the same -share! You can test this by setting up multiple lines for the "guest -account" parameter with different usernames, and then run testparm to -see which one is actually used by Samba.) - - -read onlyyes -this normally (for other types of shares) prevents -users creating or modifying files in the service's directory. However, -in a "printable" service, it is always allowed to -write to the directory (if user privileges allow the connection), but -only via print spooling operations. "Normal" write operations are not -allowed. - -writeableno - -synonym for read onlyyes - + commentAll printers + + The comment is shown next to the share if + a client queries the server, either via Network Neighborhood or with + the net view command to list available shares. + + + + printableyes + + The [printers] service must + be declared as printable. If you specify otherwise, smbd will refuse to load at + startup. This parameter allows connected clients to open, write to and submit spool files + into the directory specified with the path + parameter for this service. It is used by Samba to differentiate printer shares from + file shares. + + + + path/var/spool/samba + + Must point to a directory used by Samba to spool incoming print files. It + must not be the same as the spool directory specified in the configuration of your UNIX + print subsystem! The path typically points to a directory that is world + writeable, with the sticky bit set to it. + + + + browseableno + + Is always set to no if + printableyes. It makes + the [printer] share itself invisible in the list of + available shares in a net view command or in the Explorer browse + list. (You will of course see the individual printers). + + + + guest okyes + + If this parameter is set to yes, no password is required to + connect to the printer's service. Access will be granted with the privileges of the + guest account. On many systems the guest + account will map to a user named nobody. This user will usually be found + in the UNIX passwd file with an empty password, but with no valid UNIX login. (On some + systems the guest account might not have the privilege to be able to print. Test this + by logging in as your guest user using su - guest and run a system + print command like: + + + + lpr -P printername /etc/motd + + + + publicyes + + Is a synonym for guest okyes. + Since we have guest okyes, it + really does not need to be here. (This leads to the interesting question: What if I + by accident have two contradictory settings for the same share? The answer is the + last one encountered by Samba wins. Testparm does not complain about different settings + of the same parameter for the same share. You can test this by setting up multiple + lines for the guest account parameter with different usernames, + and then run testparm to see which one is actually used by Samba.) + + + + read onlyyes + + Normally (for other types of shares) prevents users from creating or modifying files + in the service's directory. However, in a printable service, it is + always allowed to write to the directory (if user privileges allow the + connection), but only via print spooling operations. Normal write operations are not permitted. + + + + writeableno + + Is a synonym for read onlyyes. + + - + - + Any [my_printer_name] Section -If a section appears in the , which is -tagged as printableyes, Samba presents it as -a printer share to its clients. Note, that Win95/98/ME clients may -have problems with connecting or loading printer drivers if the share -name has more than 8 characters! Also be very careful if you give a -printer the same name as an existing user or file share name: upon a -client's connection request to a certain sharename, Samba always tries -to find file shares with that name first; if it finds one, it will -connect to this and will never ultimately connect to a printer with -the same name! +If a section appears in the &smb.conf; file, which when given the parameter +printableyes causes Samba to configure it +as a printer share. Windows 9x/Me clients may have problems with connecting or loading printer drivers +if the share name has more than eight characters. Do not name a printer share with a name that may conflict +with an existing user or file share name. On Client connection requests, Samba always tries to find file +shares with that name first. If it finds one, it will connect to this and will not connect +to a printer with the same name! -commentPrinter with Restricted Access - the comment says it all. - - -path/var/spool/samba_my_printer - here we set the spooling area for this printer to -another directory than the default. It is not a requirement to set it -differently, but the option is available. - - -printer adminkurt - the printer admin definition is different for this -explicitly defined printer share from the general -[printers] share. It is not a requirement; we -did it to show that it is possible if you want it. - - -browseableyes - we also made this printer browseable (so that the -clients may conveniently find it when browsing the Network -Neighbourhood). - - -printableyes -see explanation in last subsection. - - -writeableno -see explanation in last subsection. - - -hosts allow10.160.50.,10.160.51. -here we exercise a certain degree of access control -by using the hosts allow and hosts deny parameters. Note, that -this is not by any means a safe bet. It is not a way to secure your -printers. This line accepts all clients from a certain subnet in a -first evaluation of access control - - -hosts denyturbo_xp,10.160.50.23,10.160.51.60 -all listed hosts are not allowed here (even if they -belong to the "allowed subnets"). As you can see, you could name IP -addresses as well as NetBIOS hostnames -here. - - -guest okno -this printer is not open for the guest account! - - + commentPrinter with Restricted Access + + The comment says it all. + + + + path/var/spool/samba_my_printer + + Sets the spooling area for this printer to a directory other than the default. It is not + necessary to set it differently, but the option is available. + + + + printer adminkurt + + The printer admin definition is different for this explicitly defined printer share from the general + [printers] share. It is not a requirement; we + did it to show that it is possible. + + + + browseableyes + + This makes the printer browseable so the clients may conveniently find it when browsing the + Network Neighborhood. + + + + printableyes + + See . + + + + writeableno + + See . + + + + hosts allow10.160.50.,10.160.51. + + Here we exercise a certain degree of access control by using the hosts allow and hosts deny + parameters. This is not by any means a safe bet. It is not a way to secure your + printers. This line accepts all clients from a certain subnet in a first evaluation of + access control. + + + + hosts denyturbo_xp,10.160.50.23,10.160.51.60 + + All listed hosts are not allowed here (even if they belong to the allowed subnets). As + you can see, you could name IP addresses as well as NetBIOS hostnames here. + + + + guest okno + + This printer is not open for the guest account. + + - + - + Print Commands -In each section defining a printer (or in the -[printers] section), a print -command parameter may be defined. It sets a command to -process the files which have been placed into the Samba print spool -directory for that printer. (That spool directory was, if you -remember, set up with the path -parameter). Typically, this command will submit the spool file to the -Samba host's print subsystem, using the suitable system print -command. But there is no requirement that this needs to be the -case. For debugging purposes or some other reason you may want to do -something completely different than "print" the file. An example is a -command that just copies the print file to a temporary location for -further investigation when you need to debug printing. If you craft -your own print commands (or even develop print command shell scripts), -make sure you pay attention to the need to remove the files from the -Samba spool directory. Otherwise your hard disk may soon suffer from -shortage of free space. - - - - -Default Print Commands for various UNIX Print Subsystems - - -You learned earlier on, that Samba in most cases uses its built-in -settings for many parameters if it can not find an explicitly stated -one in its configuration file. The same is true for the -print command. The default print command varies -depending on the printing parameter -setting. In the commands listed below, you will notice some parameters -of the form %X where X is -p, s, J etc. These letters stand for -"printername", "spoolfile" and "job ID" respectively. They are -explained in more detail further below. Here is an overview (excluding -the special case of CUPS, which is discussed in the next chapter): - - - - - - -If this setting is active... -...this is used in lieu of an explicit command: - - - - -printingbsd|aix|lprng|plp -print command is lpr -r -P%p %s - - -printingsysv|hpux -print command is lp -c -P%p %s; rm %s - - - printingqnx -print command is lp -r -P%p -s %s - - -printingbsd|aix|lprng|plp -lpq command is lpq -P%p - - -printingsysv|hpux -lpq command is lpstat -o%p - - -printingqnx -lpq command is lpq -P%p - - -printingbsd|aix|lprng|plp -lprm command is lprm -P%p %j - - -printingsysv|hpux -lprm command is cancel %p-%j - - -printingqnx -lprm command is cancel %p-%j - - -printingbsd|aix|lprng|plp -lppause command is lp -i %p-%j -H hold - - -printingsysv|hpux -lppause command (...is empty) - - -printingqnx -lppause command (...is empty) - - -printingbsd|aix|lprng|plp -lpresume command is lp -i %p-%j -H resume - - -printingsysv|hpux -lpresume command (...is empty) - - -printingqnx -lpresume command (...is empty) - - - - - - -We excluded the special CUPS case here, because it is discussed in the -next chapter. Just a short summary. For printing = -CUPS: If SAMBA is compiled against libcups, it uses the -CUPS API to submit jobs, etc. (It is a good idea also to set -printcapcups in case your -cupsd.conf is set to write its autogenerated -printcap file to an unusual place). Otherwise Samba maps to the System -V printing commands with the -oraw option for printing, i.e. it uses -lp -c -d%p -oraw; rm %s With printing = -cups , and if SAMBA is compiled against libcups, any -manually set print command will be ignored! - - - - -Having listed the above mappings here, you should note that there used -to be a bug in recent 2.2.x versions which -prevented the mapping from taking effect. It lead to the -"bsd|aix|lprng|plp" settings taking effect for all other systems, for -the most important commands (the print command, the -lpq command and the lprm -command). The lppause command and the -lpresume command remained empty. Of course, these -commands worked on bsd|aix|lprng|plp but they didn't work on -sysv|hpux|qnx systems. To work around this bug, you need to -explicitly set the commands. Use testparm -v to -check which command takes effect. Then check that this command is -adequate and actually works for your installed print subsystem. It is -always a good idea to explicitly set up your configuration files the -way you want them to work and not rely on any built-in defaults. +In each section defining a printer (or in the [printers] section), +a print command parameter may be defined. It sets a command to process the files +that have been placed into the Samba print spool directory for that printer. (That spool directory was, +if you remember, set up with the path parameter). Typically, +this command will submit the spool file to the Samba host's print subsystem, using the suitable system +print command. But there is no requirement that this needs to be the case. For debugging or +some other reason, you may want to do something completely different than print the file. An example is a +command that just copies the print file to a temporary location for further investigation when you need +to debug printing. If you craft your own print commands (or even develop print command shell scripts), +make sure you pay attention to the need to remove the files from the Samba spool directory. Otherwise, +your hard disk may soon suffer from shortage of free space. - + - -Setting up your own Print Commands - - -After a print job has finished spooling to a service, the -print command will be used by Samba via a -system() call to process the spool file. Usually -the command specified will submit the spool file to the host's -printing subsystem. But there is no requirement at all that this must -be the case. The print subsystem will probably not remove the spool -file on its own. So whatever command you specify on your own you -should ensure that the spool file is deleted after it has been -processed. - - - -There is no difficulty with using your own customized print commands -with the traditional printing systems. However, if you don't wish to -"roll your own", you should be well informed about the default -built-in commands that Samba uses for each printing subsystem (see the -table above). In all the commands listed in the last paragraphs you -see parameters of the form %X These are -macros, or shortcuts, used as place holders for -the names of real objects. At the time of running a command with such -a placeholder, Samba will insert the appropriate value -automatically. Print commands can handle all Samba macro -substitutions. In regard to printing, the following ones do have -special relevance: + +Default UNIX System Printing Commands + + +You learned earlier on that Samba, in most cases, uses its built-in settings for many parameters +if it cannot find an explicitly stated one in its configuration file. The same is true for the +print command. The default print command varies depending +on the printing parameter setting. In the commands listed +below, you will notice some parameters of the form %X where X is +p, s, J, and so on. These letters stand for printer name, spoolfile and job ID, respectively. +They are explained in more detail further below. presents an overview of key +printing options but excludes the special case of CUPS that is discussed in . + + +
    + Default Printing Settings + + + + + + Setting + Default Printing Commands + + + + + printingbsd|aix|lprng|plp + print command is lpr -r -P%p %s + + + printingsysv|hpux + print command is lp -c -P%p %s; rm %s + + + printingqnx + print command is lp -r -P%p -s %s + + + printingbsd|aix|lprng|plp + lpq command is lpq -P%p + + + printingsysv|hpux + lpq command is lpstat -o%p + + + printingqnx + lpq command is lpq -P%p + + + printingbsd|aix|lprng|plp + lprm command is lprm -P%p %j + + + printingsysv|hpux + lprm command is cancel %p-%j + + + printingqnx + lprm command is cancel %p-%j + + + printingbsd|aix|lprng|plp + lppause command is lp -i %p-%j -H hold + + + printingsysv|hpux + lppause command (...is empty) + + + printingqnx + lppause command (...is empty) + + + printingbsd|aix|lprng|plp + lpresume command is lp -i %p-%j -H resume + + + printingsysv|hpux + lpresume command (...is empty) + + + printingqnx + lpresume command (...is empty) + + + +
    + + +We excluded the special case of CUPS here, because it is discussed in the next chapter. For +printing = CUPS, if Samba is compiled against libcups, it uses the CUPS API to submit +jobs. (It is a good idea also to set printcapcups +in case your cupsd.conf is set to write its autogenerated printcap file to an +unusual place). Otherwise, Samba maps to the System V printing commands with the -oraw option for printing, +i.e., it uses lp -c -d%p -oraw; rm %s. With printing = cups, +and if Samba is compiled against libcups, any manually set print command will be ignored! - -%s, %f - the path to the spool -file name - -%p - the appropriate printer -name + -%J - the job name as -transmitted by the client. + +Custom Print Commands -%c - the number of printed -pages of the spooled job (if known). + +After a print job has finished spooling to a service, the print command + will be used by Samba via a system() call to process the +spool file. Usually the command specified will submit the spool file to the host's printing subsystem. But +there is no requirement at all that this must be the case. The print subsystem may not remove the spool +file on its own. So whatever command you specify, you should ensure that the spool file is deleted after +it has been processed. + -%z - the size of the spooled -print job (in bytes) + +There is no difficulty with using your own customized print commands with the traditional printing +systems. However, if you do not wish to roll your own, you should be well informed about the default +built-in commands that Samba uses for each printing subsystem (see +Table 17.1). In all the +commands listed in the last paragraphs, you see parameters of the form %X. These are +macros, or shortcuts, used as placeholders for the names of real objects. At the time +of running a command with such a placeholder, Samba will insert the appropriate value automatically. Print +commands can handle all Samba macro substitutions. In regard to printing, the following ones do have +special relevance: + + + %s, %f &smbmdash; the path to the spool file name. + %p &smbmdash; the appropriate printer name. + %J &smbmdash; the job name as transmitted by the client. + %c &smbmdash; the number of printed pages of the spooled job (if known). + %z &smbmdash; the size of the spooled print job (in bytes). -The print command MUST contain at least one occurrence of -%s or %f. -- The -%p is optional. If no printer name is supplied, -the %p will be silently removed from the print -command. In this case the job is sent to the default printer. +The print command must contain at least one occurrence of %s or +the %f. The %p is optional. If no printer name is supplied, +the %p will be silently removed from the print command. In this case, the job is +sent to the default printer. -If specified in the [global] section, the print -command given will be used for any printable service that does not -have its own print command specified. If there is neither a specified -print command for a printable service nor a global print command, -spool files will be created but not processed! And (most importantly): -print files will not be removed, so they will start filling your Samba -hard disk. +If specified in the [global] section, the print command given will be +used for any printable service that does not have its own print command specified. If there is neither a +specified print command for a printable service nor a global print command, spool files will be created +but not processed! Most importantly, print files will not be removed, so they will consume disk space. -Note that printing may fail on some UNIXes from the "nobody" -account. If this happens, create an alternative guest account and -supply it with the privilege to print. Set up this guest account in -the [global] section with the guest -account parameter. +Printing may fail on some UNIX systems when using the nobody account. If this happens, create an +alternative guest account and give it the privilege to print. Set up this guest account in the +[global] section with the guest account parameter. -You can form quite complex print commands. You need to realize that -print commands are just passed to a UNIX shell. The shell is able to -expand the included environment variables as usual. (The syntax to -include a UNIX environment variable $variable -in or in the Samba print command is -%$variable.) To give you a working -print command example, the following will log a -print job to /tmp/print.log, print the file, then -remove it. Note that ';' is the usual separator for commands in shell -scripts: +You can form quite complex print commands. You need to realize that print commands are just +passed to a UNIX shell. The shell is able to expand the included environment variables as +usual. (The syntax to include a UNIX environment variable $variable +in the Samba print command is %$variable.) To give you a working +print command example, the following will log a print job +to /tmp/print.log, print the file, then remove it. The semicolon (; +is the usual separator for commands in shell scripts: @@ -1052,30 +967,28 @@ scripts: -You may have to vary your own command considerably from this example -depending on how you normally print files on your system. The default -for the print command parameter varies depending on the setting of -the printing parameter. Another example is: +You may have to vary your own command considerably from this example depending on how you normally print +files on your system. The default for the print command +parameter varies depending on the setting of the printing +parameter. Another example is: print command/usr/local/samba/bin/myprintscript %p %s +     -Innovations in Samba Printing since 2.2 +Printing Developments Since Samba-2.2 -Before version 2.2.0, Samba's print server support for Windows clients -was limited to the level of LanMan printing -calls. This is the same protocol level as Windows 9x PCs offer when -they share printers. Beginning with the 2.2.0 release, Samba started -to support the native Windows NT printing mechanisms. These are -implemented via MS-RPC (RPC = Remote -Procedure Calls ). MS-RPCs use the -SPOOLSS named pipe for all printing. +Prior to Samba-2.2.x, print server support for Windows clients was limited to LanMan +printing calls. This is the same protocol level as Windows 9x/Me PCs offer when they share printers. +Beginning with the 2.2.0 release, Samba started to support the native Windows NT printing mechanisms. These +are implemented via MS-RPC (RPC = Remote Procedure Calls +). MS-RPCs use the SPOOLSS named pipe for all printing. @@ -1083,182 +996,170 @@ The additional functionality provided by the new SPOOLSS support includes: -Support for downloading printer driver files to Windows -95/98/NT/2000 clients upon demand (Point'n'Print); - - -Uploading of printer drivers via the Windows NT -Add Printer Wizard (APW) or the -Imprints tool set. - + + Support for downloading printer driver files to Windows 95/98/NT/2000 clients upon + demand (Point'n'Print). + -Support for the native MS-RPC printing calls such as - StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation for more information on the Win32 printing API); + + Uploading of printer drivers via the Windows NT Add Printer Wizard (APW) + or the Imprints tool set. + -Support for NT Access Control -Lists (ACL) on printer objects; + + Support for the native MS-RPC printing calls such as + StartDocPrinter, EnumJobs(), and so on. (See the + MSDN documentation for more information on the + Win32 printing API). + -Improved support for printer queue manipulation -through the use of internal databases for spooled job information -(implemented by various *.tdb -files). + + Support for NT Access Control Lists (ACL) on printer objects. + + + Improved support for printer queue manipulation through the use of internal databases for spooled + job information (implemented by various *.tdb files). + -One other benefit of an update is this: Samba 3 is able to publish -all its printers in Active Directory (or LDAP)! +A benefit of updating is that Samba-3 is able to publish its printers to Active Directory (or LDAP). -One slight difference is here: it is possible on a Windows NT print -server to have printers listed in the Printers folder which are -not shared. Samba does not make this -distinction. By definition, the only printers of which Samba is aware -are those which are specified as shares in -. The reason is that Windows NT/200x/XP Professional -clients do not normally need to use the standard SMB printer share; -rather they can print directly to any printer on another Windows NT -host using MS-RPC. This of course assumes that the printing client has -the necessary privileges on the remote host serving the printer. The -default permissions assigned by Windows NT to a printer gives the -"Print" permissions to the well-known Everyone -group. (The older clients of type Win9x can only print to "shared" +A fundamental difference exists between MS Windows NT print servers and Samba operation. Windows NT +permits the installation of local printers that are not shared. This is an artifact of the fact that +any Windows NT machine (server or client) may be used by a user as a workstation. Samba will publish all +printers that are made available, either by default or by specific declaration via printer-specific shares. + + + +Windows NT/200x/XP Professional clients do not have to use the standard SMB printer share; they can +print directly to any printer on another Windows NT host using MS-RPC. This, of course, assumes that +the client has the necessary privileges on the remote host that serves the printer resource. The +default permissions assigned by Windows NT to a printer gives the Print permissions to the well-known +Everyone group. (The older clients of type Windows 9x/Me can only print to shared printers). -Client Drivers on Samba Server for <emphasis>Point'n'Print</emphasis> +Point'n'Print Client Drivers on Samba Servers -There is still confusion about what all this means: Is it or -is it not a requirement for printer drivers to be installed on a Samba -host in order to support printing from Windows clients? The -answer to this is: No, it is not a -requirement. Windows NT/2000 clients can, of -course, also run their APW to install drivers -locally (which then connect to a Samba served -print queue). This is the same method as used by Windows 9x -clients. (However, a bug existed in Samba 2.2.0 -which made Windows NT/2000 clients require that the Samba server -possess a valid driver for the printer. This was fixed in Samba -2.2.1). +There is much confusion about what all this means. The question is often asked, Is it or is +it not necessary for printer drivers to be installed on a Samba host in order to support printing from +Windows clients? The answer to this is no, it is not necessary. -But it is a new option to install the printer -drivers into the [print$] share of the Samba -server, and a big convenience too. Then all -clients (including 95/98/ME) get the driver installed when they first -connect to this printer share. The uploading or -depositing of the driver into this -[print$] share, and the following binding of -this driver to an existing Samba printer share can be achieved by -different means: +Windows NT/2000 clients can, of course, also run their APW to install drivers locally +(which then connect to a Samba-served print queue). This is the same method used by Windows 9x/Me +clients. (However, a bug existed in Samba 2.2.0 that made Windows NT/2000 clients +require that the Samba server possess a valid driver for the printer. This was fixed in Samba 2.2.1). - -running the APW on an -NT/200x/XP Professional client (this doesn't work from 95/98/ME -clients); + +But it is a new capability to install the printer drivers into the [print$] +share of the Samba server, and a big convenience, too. Then all clients +(including 95/98/ME) get the driver installed when they first connect to this printer share. The +uploading or depositing of the driver into this +[print$] share and the following binding of this driver to an existing +Samba printer share can be achieved by different means: + -using the Imprints -toolset; + + + Running the APW on an NT/200x/XP Professional client (this does not work from 95/98/ME clients). + -using the smbclient and -rpcclient commandline tools; + + Using the Imprints toolset. + -using cupsaddsmb(only works for -the CUPS printing system, not for LPR/LPD, LPRng -etc.). + + Using the smbclient and rpcclient commandline tools. + + + Using cupsaddsmb (only works for the CUPS + printing system, not for LPR/LPD, LPRng, and so on). + -Please take additional note of the following fact: Samba -does not use these uploaded drivers in any way to process spooled -files. Drivers are utilized entirely by the clients, who -download and install them via the "Point'n'Print" mechanism supported -by Samba. The clients use these drivers to generate print files in the -format the printer (or the UNIX print system) requires. Print files -received by Samba are handed over to the UNIX printing system, which -is responsible for all further processing, if needed. +Samba does not use these uploaded drivers in any way to process spooled files. These drivers are utilized +entirely by the clients who download and install them via the Point'n'Print mechanism +supported by Samba. The clients use these drivers to generate print files in the format the printer +(or the UNIX print system) requires. Print files received by Samba are handed over to the UNIX printing +system, which is responsible for all further processing, as needed. -The [printer$] Section is removed from Samba 3 - - -<smbconfsection>[print$]</smbconfsection> vs. <smbconfsection>[printer$]</smbconfsection> - - - -Versions of Samba prior to 2.2 made it possible to use a share -named [printer$]. This name was taken from the -same named service created by Windows 9x clients when a printer was -shared by them. Windows 9x printer servers always have a -[printer$] service which provides read-only -access (with no password required) in order to support printer driver -downloads. However, Samba's initial implementation allowed for a -parameter named printer driver location to be -used on a per share basis. This specified the location of the driver -files associated with that printer. Another parameter named -printer driver provided a means of defining the -printer driver name to be sent to the client. These parameters, -including the printer driver file parameter, -are now removed and can not be used in installations of samba-3. -Now the share name [print$] is used for the -location of downloadable printer drivers. It is taken from the -[print$] service created by Windows NT PCs when -a printer is shared by them. Windows NT print servers always have a -[print$] service which provides read-write -access (in the context of its ACLs) in order to support printer driver -down- and uploads. Don't fear -- this does not mean Windows 9x -clients are thrown aside now. They can use Samba's -[print$] share support just fine. - +The Obsoleted [printer$] Section + + + Versions of Samba prior to 2.2 made it possible to use a share named + [printer$]. This name was taken from the same named service created by + Windows 9x/Me clients when a printer was shared by them. Windows 9x/Me printer servers always + have a [printer$] service that provides read-only access (with + no password required) to support printer driver downloads. However, Samba's initial + implementation allowed for a parameter named printer driver location to + be used on a per share basis. This specified the location of the driver files associated with + that printer. Another parameter named printer driver provided a means of + defining the printer driver name to be sent to the client. + + + + These parameters, including the printer driver file parameter, + are now removed and cannot be used in installations of Samba-3. The share name + [print$] is now used for the location of downloadable printer + drivers. It is taken from the [print$] service created + by Windows NT PCs when a printer is shared by them. Windows NT print servers always have a + [print$] service that provides read-write access (in the context + of its ACLs) to support printer driver downloads and uploads. This does not mean Windows + 9x/Me clients are now thrown aside. They can use Samba's [print$] + share support just fine. + Creating the [print$] Share -In order to support the up- and downloading of printer driver files, -you must first configure a file share named -[print$]. The "public" name of this share is -hard coded in Samba's internals (because it is hard coded in the MS -Windows clients too). It cannot be renamed since Windows clients are -programmed to search for a service of exactly this name if they want -to retrieve printer driver files. +In order to support the uploading and downloading of printer driver files, you must first configure a +file share named [print$]. The public name of this share is hard coded +in the MS Windows clients. It cannot be renamed since Windows clients are programmed to search for a +service of exactly this name if they want to retrieve printer driver files. -You should modify the server's file to -add the global parameters and create the -[print$] file share (of course, some of the -parameter values, such as 'path' are arbitrary and should be replaced -with appropriate values for your site): +You should modify the server's file to add the global parameters and create the +[print$] file share (of course, some of the parameter values, such +as path are arbitrary and should be replaced with appropriate values for your +site). See . - - [print\$] example - [global] - members of the ntadmin group should be able to add drivers and set - printer properties. root is implicitly always a 'printer admin'. - printer admin@ntadmin - ... - [printers] - ... - - [print$] + + +[print\$] example +[global] +members of the ntadmin group should be able to add drivers and set +printer properties. root is implicitly always a 'printer admin'. +printer admin@ntadmin +... +[printers] +... +[print$] commentPrinter Driver Download Area path/etc/samba/drivers browseableyes guest okyes read onlyyes write list@ntadmin, root - + + Of course, you also need to ensure that the directory named by the @@ -1268,143 +1169,139 @@ Of course, you also need to ensure that the directory named by the -Parameters in the [print$] Section +[print$] Section Parameters -[print$] is a special section in -. It contains settings relevant to -potential printer driver download and local installation by clients. +The [print$] is a special section in &smb.conf;. It contains settings relevant to +potential printer driver download and is used by windows clients for local print driver installation. +The following parameters are frequently needed in this share section: - commentPrinter Driver - Download Area - the comment appears next to the share name if it is -listed in a share list (usually Windows clients won't see it often but -it will also appear up in a smbclient -L sambaserver - output). - -path/etc/samba/printers - this is the path to the location of the Windows -driver file deposit from the UNIX point of -view. - -browseableno - this makes the [print$] share -"invisible" in Network Neighbourhood to clients. However, you can -still "mount" it from any client using the net use -g:\\sambaserver\print$ command in a "DOS box" or the -"Connect network drive" menu from Windows -Explorer. - -guest okyes -this gives read only access to this share for all -guest users. Access may be used to download and install printer -drivers on clients. The requirement for guest ok = -yes depends upon how your site is configured. If users -will be guaranteed to have an account on the Samba host, then this is -a non-issue. - - -The non-issue is this: if all your Windows NT users are guaranteed to -be authenticated by the Samba server (for example if Samba -authenticates via an NT domain server and the NT user has already been -validated by the Domain Controller in order to logon to the Windows NT -session), then guest access is not necessary. Of course, in a -workgroup environment where you just want to be able to print without -worrying about silly accounts and security, then configure the share -for guest access. You'll probably want to add map to guestBad User in the -[global] section -as well. Make sure you understand what this parameter does before -using it. - - -read onlyyes -as we don't want everybody to upload driver files (or -even change driver settings) we tagged this share as not -writeable. - -write list@ntadmin,root -since the [print$] was made -read only by the previous setting, we need to create a "write list" -also. UNIX groups (denoted with a leading "@" character) and users -listed here are allowed write access (as an exception to the general -public's "read-only" access), which they need to update files on the -share. Normally you will want to only name administrative level user -accounts in this setting. Check the file system permissions to make -sure these accounts can copy files to the share. If this is a non-root -account, then the account should also be mentioned in the global -printer admin parameter. See the - man page for more information on -configuring file shares. - + commentPrinter Driver Download Area + + The comment appears next to the share name if it is listed in a share list (usually Windows + clients will not see it, but it will also appear up in a smbclient -L sambaserver + output). + + + + path/etc/samba/printers + + Is the path to the location of the Windows driver file deposit from the UNIX point of view. + + + + browseableno + + Makes the [print$] share invisible to clients from the + Network Neighborhood. However, you can still mount it from any client + using the net use g:\\sambaserver\print$ command in a DOS-box or the + Connect network drive menu> from Windows Explorer. + + + + guest okyes + + Gives read-only access to this share for all guest users. Access may be granted to + download and install printer drivers on clients. The requirement for guest ok + = yes depends on how your site is configured. If users will be guaranteed + to have an account on the Samba host, then this is a non-issue. + + + + If all your Windows NT users are guaranteed to be authenticated by the Samba server + (for example, if Samba authenticates via an NT domain server and the user has already been + validated by the Domain Controller in order to logon to the Windows NT session), then guest + access is not necessary. Of course, in a workgroup environment where you just want + to print without worrying about silly accounts and security, then configure the share for + guest access. You should consider adding map to guestBad + User in the [global] section + as well. Make sure you understand what this parameter does before using it. + + + + + read onlyyes + + Because we do not want everybody to upload driver files (or even change driver settings), + we tagged this share as not writeable. + + + + write list@ntadmin, root + + The [print$] was made read-only by the previous + setting so we should create a write list entry also. UNIX + groups (denoted with a leading @ character). Users listed here are allowed + write-access (as an exception to the general public's read-only access), which they need to + update files on the share. Normally, you will want to only name administrative-level user + account in this setting. Check the file system permissions to make sure these accounts + can copy files to the share. If this is a non-root account, then the account should also + be mentioned in the global printer admin + parameter. See the &smb.conf; man page for more information on configuring file shares. + + -Subdirectory Structure in [print$] +The [print$] Share Directory -In order for a Windows NT print server to support the downloading of -driver files by multiple client architectures, you must create several -subdirectories within the [print$] service -(i.e. the UNIX directory named by the path -parameter). These correspond to each of the supported client -architectures. Samba follows this model as well. Just like the name of -the [print$] share itself, the subdirectories -*must* be exactly the names listed below (you may leave out the -subdirectories of architectures you don't want to support). +In order for a Windows NT print server to support the downloading of driver files by multiple client +architectures, you must create several subdirectories within the [print$] +service (i.e., the UNIX directory named by the path +parameter). These correspond to each of the supported client architectures. Samba follows this model as +well. Just like the name of the [print$] share itself, the subdirectories +must be exactly the names listed below (you may leave out the subdirectories of architectures you do +not need to support). Therefore, create a directory tree below the [print$] share for each architecture you wish -to support. +to support like this: - -[print$]--+-- - |--W32X86 # serves drivers to "Windows NT x86" - |--WIN40 # serves drivers to "Windows 95/98" - |--W32ALPHA # serves drivers to "Windows NT Alpha_AXP" - |--W32MIPS # serves drivers to "Windows NT R4000" - |--W32PPC # serves drivers to "Windows NT PowerPC" - - -Required permissions - - -In order to add a new driver to your Samba host, one of two conditions -must hold true: +[print$]--+ + |--W32X86 # serves drivers to Windows NT x86 + |--WIN40 # serves drivers to Windows 95/98 + |--W32ALPHA # serves drivers to Windows NT Alpha_AXP + |--W32MIPS # serves drivers to Windows NT R4000 + |--W32PPC # serves drivers to Windows NT PowerPC + - -The account used to connect to the Samba host must -have a UID of 0 (i.e. a root account) - -The account used to connect to the Samba host must be -named in the printer adminlist. - - - - -Of course, the connected account must still possess access to add -files to the subdirectories beneath -[print$]. Remember that all file shares are set -to 'read only' by default. - +Required permissions + + In order to add a new driver to your Samba host, one of two conditions must hold true: + + + + + The account used to connect to the Samba host must have a UID of 0 (i.e., a root account). + + + + The account used to connect to the Samba host must be named in the printer adminlist. + + + + + Of course, the connected account must still have write access to add files to the subdirectories beneath + [print$]. Remember that all file shares are set to read-only by default. + -Once you have created the required [print$] -service and associated subdirectories, go to a Windows NT 4.0/2k/XP -client workstation. Open Network Neighbourhood or -My Network Places and browse for the Samba host. -Once you have located the server, navigate to its Printers and -Faxes folder. You should see an initial listing of printers -that matches the printer shares defined on your Samba host. +Once you have created the required [print$] service and +associated subdirectories, go to a Windows NT 4.0/200x/XP client workstation. Open Network +Neighborhood or My Network Places and browse for the Samba host. Once you +have located the server, navigate to its Printers and Faxes folder. You should see +an initial listing of printers that matches the printer shares defined on your Samba host. @@ -1413,191 +1310,163 @@ that matches the printer shares defined on your Samba host. Installing Drivers into [print$] -You have successfully created the [print$] -share in ? And Samba has re-read its -configuration? Good. But you are not yet ready to take off. The -driver files need to be present in this share, -too! So far it is still an empty share. Unfortunately, it is not enough -to just copy the driver files over. They need to be set -up too. And that is a bit tricky, to say the least. We -will now discuss two alternative ways to install the drivers into -[print$]: +Have you successfully created the [print$] share in &smb.conf;, and have your forced Samba +to re-read its &smb.conf; file? Good. But you are not yet ready to use the new facility. The client driver +files need to be installed into this share. So far it is still an empty share. Unfortunately, it is +not enough to just copy the driver files over. They need to be +correctly installed so that appropriate +records for each driver will exist in the Samba internal databases so it can provide the correct +drivers as they are requested from MS Windows clients. And that is a bit tricky, to say the least. We +now discuss two alternative ways to install the drivers into [print$]: + + Using the Samba commandline utility rpcclient with its various subcommands (here: + adddriver and setdriver) from any UNIX workstation. + -using the Samba commandline utility -rpcclient with its various subcommands (here: -adddriver and setdriver) from -any UNIX workstation; - -running a GUI (Printer -Properties and Add Printer Wizard) -from any Windows NT/2k/XP client workstation. - + + Running a GUI (Printer Properties and Add Printer Wizard) + from any Windows NT/200x/XP client workstation. + -The latter option is probably the easier one (even if the only -entrance to this realm seems a little bit weird at first). +The latter option is probably the easier one (even if the process may seem a little bit weird at first). -Setting Drivers for existing Printers with a Client GUI +Add Printer Wizard Driver Installation -The initial listing of printers in the Samba host's -Printers folder accessed from a client's Explorer -will have no real printer driver assigned to them. By default -this driver name is set to a NULL -string. This must be changed now. The local Add Printer -Wizard, run from NT/2000/XP clients, will help us in this -task. +The initial listing of printers in the Samba host's Printers folder accessed from a +client's Explorer will have no real printer driver assigned to them. By default this driver name is set +to a null string. This must be changed now. The local Add Printer Wizard (APW), run from +NT/2000/XP clients, will help us in this task. -However, the job to set a valid driver for the printer is not a -straightforward one: You must attempt to view the printer properties -for the printer to which you want the driver assigned. Open the -Windows Explorer, open Network Neighbourhood, browse to the Samba -host, open Samba's Printers folder, right-click the printer icon and -select Properties.... You are now trying to view printer and driver -properties for a queue which has this default NULL driver -assigned. This will result in an error message (this is normal here): +Installation of a valid printer driver is not straightforward. You must attempt +to view the printer properties for the printer to which you want the driver assigned. Open the Windows +Explorer, open Network Neighborhood, browse to the Samba host, open Samba's Printers +folder, right-click on the printer icon and select Properties.... You are now trying to +view printer and driver properties for a queue that has this default NULL driver +assigned. This will result in the following error message: - Device settings cannot be displayed. The driver -for the specified printer is not installed, only spooler properties -will be displayed. Do you want to install the driver -now? + + Device settings cannot be displayed. The driver for the specified printer is not installed, + only spooler properties will be displayed. Do you want to install the driver now? + -Important:Don't click Yes! Instead, -click No in the error dialog. -Only now you will be presented with the printer properties window. From here, -the way to assign a driver to a printer is open to us. You have now the choice -either: +Do not click on Yes! Instead, click on No in the error dialog. +Only now you will be presented with the printer properties window. From here, the way to assign a driver +to a printer is open to us. You now have the choice of: -select a driver from the pop-up list of installed -drivers. Initially this list will be empty. -Or + + Select a driver from the pop-up list of installed drivers. Initially this list will be empty. + -use the New Driver... button to -install a new printer driver (which will in fact start up the -APW). + + Click on New Driver to install a new printer driver (which will + start up the APW). + -Once the APW is started, the procedure is exactly the same as the one -you are familiar with in Windows (we assume here that you are -familiar with the printer driver installations procedure on Windows -NT). Make sure your connection is in fact setup as a user with -printer admin privileges (if in doubt, use -smbstatus to check for this). If you wish to -install printer drivers for client operating systems other than -Windows NT x86, you will need to use the -Sharing tab of the printer properties dialog. +Once the APW is started, the procedure is exactly the same as the one you are familiar with in Windows (we +assume here that you are familiar with the printer driver installations procedure on Windows NT). Make sure +your connection is, in fact, setup as a user with printer admin +privileges (if in doubt, use smbstatus to check for this). If you wish to install +printer drivers for client operating systems other than Windows NT x86, +you will need to use the Sharing tab of the printer properties dialog. -Assuming you have connected with an administrative (or root) account -(as named by the printer admin parameter), -you will also be able to modify other printer properties such as ACLs -and default device settings using this dialog. For the default device -settings, please consider the advice given further below. +Assuming you have connected with an administrative (or root) account (as named by the +printer admin parameter), you will also be able to modify +other printer properties such as ACLs and default device settings using this dialog. For the default +device settings, please consider the advice given further in . - -Setting Drivers for existing Printers with -<command>rpcclient</command> + +Installing Print Drivers Using <command>rpcclient</command> -The second way to install printer drivers into -[print$] and set them up in a valid way can be -done from the UNIX command line. This involves four distinct steps: +The second way to install printer drivers into [print$] and set them +up in a valid way is to do it from the UNIX command line. This involves four distinct steps: -gathering the info about the required driver files -and collecting the files together; + + Gather info about required driver files and collect the files. + -deposit the driver files into the -[print$] share's correct subdirectories -(possibly by using smbclient); + + Deposit the driver files into the [print$] share's correct subdirectories + (possibly by using smbclient). + -running the rpcclient -commandline utility once with the adddriver -subcommand, + + Run the rpcclient command line utility once with the adddriver + subcommand. + -running rpcclient a second -time with the setdriver -subcommand. + + Run rpcclient a second time with the setdriver subcommand. + -We will provide detailed hints for each of these steps in the next few -paragraphs. +We provide detailed hints for each of these steps in the paragraphs that follow. -Identifying the Driver Files - - -To find out about the driver files, you have two options: you could -investigate the driver CD which comes with your printer. Study the -*.inf file on the CD, if it is contained. This -may not be the possible, since the *.inf file might be -missing. Unfortunately, many vendors have now started to use their own -installation programs. These installations packages are often some -sort of Windows platform archive format, plus, the files may get -re-named during the installation process. This makes it extremely -difficult to identify the driver files you need. - - - -Then you only have the second option: install the driver first on a -Windows client *locally* and investigate which file names and paths it -uses after they are installed. (Note, that you need to repeat this -procedure for every client platform you want to support. We are going -to show it here for the W32X86 platform only, a -name used by Microsoft for all WinNT/2k/XP clients...) - - - -A good method to recognize the driver files this is to print the test -page from the driver's Properties Dialog -(General tab). Then look at the list of driver -files named on the printout. You'll need to recognize what Windows -(and Samba) are calling the Driver File , the -Data File, the Config File, -the Help File and (optionally) the -Dependent Driver Files (this may vary slightly -for Windows NT). You need to remember all names (or better take a -note) for the next steps. - - - -Another method to quickly test the driver filenames and related paths -is provided by the rpcclient utility. Run it with -enumdrivers or with the -getdriver subcommand, each in the -3 level. In the following example, -TURBO_XP is the name of the Windows PC (in this -case it was a Windows XP Professional laptop, BTW). I had installed -the driver locally to TURBO_XP while kde-bitshop is -the name of the Linux host from which I am working. We could run an -interactive rpcclient session; -then we'd get an rpcclient /> prompt and would -type the subcommands at this prompt. This is left as a good exercise -to the reader. For now we use rpcclient with the - parameter to execute a single subcommand -line and exit again. This is the method you would use if you want to -create scripts to automate the procedure for a large number of -printers and drivers. Note the different quotes used to overcome the -different spaces in between words: +Identifying Driver Files + + +To find out about the driver files, you have two options. You could check the contents of the driver +CDROM that came with your printer. Study the *.inf files lcoated on the CDROM. This +may not be possible, since the *.inf file might be missing. Unfortunately, vendors have now started +to use their own installation programs. These installations packages are often in some Windows platform +archive format. Additionally, the files may be re-named during the installation process. This makes it +extremely difficult to identify the driver files required. + + + +Then you only have the second option. Install the driver locally on a Windows client and +investigate which file names and paths it uses after they are installed. (You need to repeat +this procedure for every client platform you want to support. We show it here for the +W32X86 platform only, a name used by Microsoft for all Windows NT/200x/XP +clients.) + + + +A good method to recognize the driver files is to print the test page from the driver's +Properties dialog (General tab). Then look at the list of +driver files named on the printout. You'll need to recognize what Windows (and Samba) are calling the +Driver File, Data File, Config File, +Help File and (optionally) the Dependent Driver Files +(this may vary slightly for Windows NT). You need to take a note of all file names for the next steps. + + + +Another method to quickly test the driver filenames and related paths is provided by the +rpcclient utility. Run it with enumdrivers or with the +getdriver subcommand, each at the 3 info level. In the following example, +TURBO_XP is the name of the Windows PC (in this case it was a Windows XP Professional +laptop). I installed the driver locally to TURBO_XP, from a Samba server called KDE-BITSHOP. +We could run an interactive rpcclient session; then we would get an +rpcclient /> prompt and would type the subcommands at this prompt. This is left as +a good exercise to the reader. For now, we use rpcclient with the +parameter to execute a single subcommand line and exit again. This is the method you would use if you +want to create scripts to automate the procedure for a large number of printers and drivers. Note the +different quotes used to overcome the different spaces in between words: @@ -1617,14 +1486,12 @@ Printer Driver Info 3: Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.DLL] Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.INI] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1KMMin.DLL] Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.dat] Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.cat] Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.def] Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hre] Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.vnd] Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hlp] - Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de_reg.HLP] Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01Aux.dll] Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.NTF] @@ -1633,56 +1500,47 @@ Printer Driver Info 3: -You may notice, that this driver has quite a big number of -Dependentfiles (I know worse cases however). Also, -strangely, the Driver File is here tagged as -Driver Path.... oh, well. Here we don't have yet -support for the so-called WIN40 architecture -installed. This name is used by Microsoft for the Win95/98/ME platforms. -If we want to support these, we need to install the Win95/98/ME driver -files in addition to those for W32X86 -(i.e. the WinNT72000/XP clients) onto a Windows PC. This PC -can also host the Win9x drivers, even if itself runs on Windows NT, -2000 or XP. +You may notice that this driver has quite a large number of Dependent files +(there are worse cases, however). Also, strangely, the +Driver File is tagged here +Driver Path. We do not yet have support for the so-called +WIN40 architecture installed. This name is used by Microsoft for the Windows +9x/Me platforms. If we want to support these, we need to install the Windows 9x/Me driver files in +addition to those for W32X86 (i.e., the Windows NT72000/XP clients) onto a +Windows PC. This PC can also host the Windows 9x/Me drivers, even if it runs on Windows NT, 2000 or XP. -Since the [print$] share is usually accessible -through the Network Neighbourhood, you can also use the UNC notation -from Windows Explorer to poke at it. The Win9x driver files will end -up in subdirectory "0" of the "WIN40" directory. The full path to -access them will be -\\WINDOWSHOST\print$\WIN40\0\. +Since the [print$] share is usually accessible through the Network +Neighborhood, you can also use the UNC notation from Windows Explorer to poke at it. The Windows +9x/Me driver files will end up in subdirectory 0 of the WIN40 +directory. The full path to access them will be \\WINDOWSHOST\print$\WIN40\0\. - more recent drivers on Windows 2000 and Windows XP are -installed into the "3" subdirectory instead of the "2". The version 2 -of drivers, as used in Windows NT, were running in Kernel Mode. -Windows 2000 changed this. While it still can use the Kernel Mode -drivers (if this is enabled by the Admin), its native mode for printer -drivers is User Mode execution. This requires drivers designed for -this. These type of drivers install into the "3" subdirectory. + +More recent drivers on Windows 2000 and Windows XP are installed into the 3 subdirectory +instead of the 2. The version 2 of drivers, as used in Windows NT, were running in Kernel +Mode. Windows 2000 changed this. While it still can use the Kernel Mode drivers (if this is enabled by +the Admin), its native mode for printer drivers is User Mode execution. This requires drivers designed +for this. These types of drivers install into the 3 subdirectory. -Collecting the Driver Files from a Windows Host's -[print$] Share +Obtaining Driver Files from Windows Client [print$] Shares -Now we need to collect all the driver files we identified. in our -previous step. Where do we get them from? Well, why not retrieve them -from the very PC and the same [print$] share -which we investigated in our last step to identify the files? We can -use smbclient to do this. We will use the paths and -names which were leaked to us by getdriver. The +Now we need to collect all the driver files we identified in our previous step. Where do we get them +from? Well, why not retrieve them from the very PC and the same [print$] +share that we investigated in our last step to identify the files? We can use smbclient +to do this. We will use the paths and names that were leaked to us by getdriver. The listing is edited to include linebreaks for readability: -&rootprompt;smbclient //TURBO_XP/print\$ -U'Danka%xxxx' \ - -c 'cd W32X86/2;mget HD*_de.* \ - hd*ppd Hd*_de.* Hddm*dll HDN*Aux.DLL' +&rootprompt;smbclient //TURBO_XP/print\$ -U'Danka%xxxx' \ + -c 'cd W32X86/2;mget HD*_de.* hd*ppd Hd*_de.* Hddm*dll HDN*Aux.DLL' + added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 Got a positive name query response from 10.160.50.8 ( 10.160.50.8 ) Domain=[DEVELOPMENT] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager] @@ -1692,63 +1550,58 @@ getting file \W32X86\2\Hddm91c1_de.def of size 428 as Hddm91c1_de.def Get file Hddm91c1_de.DLL? y getting file \W32X86\2\Hddm91c1_de.DLL of size 876544 as Hddm91c1_de.DLL [...] - -After this command is complete, the files are in our current local -directory. You probably have noticed that this time we passed several -commands to the parameter, separated by semi-colons. This -effects that all commands are executed in sequence on the remote -Windows server before smbclient exits again. +After this command is complete, the files are in our current local directory. You probably have noticed +that this time we passed several commands to the parameter, separated by semi-colons. +This effects that all commands are executed in sequence on the remote Windows server before smbclient +exits again. -Don't forget to repeat the procedure for the WIN40 -architecture should you need to support Win95/98/XP clients. Remember, the -files for these architectures are in the WIN40/0/ subdir. Once we are -complete, we can run smbclient ... put to store -the collected files on the Samba server's -[print$] share. +Remember to repeat the procedure for the WIN40 architecture should +you need to support Windows 9x/Me/XP clients. Remember too, the files for these architectures are in the +WIN40/0/ subdirectory. Once this is complete, we can run smbclient ... +put to store the collected files on the Samba server's [print$] +share. -Depositing the Driver Files into [print$] +Installing Driver Files into [print$] -So, now we are going to put the driver files into the -[print$] share. Remember, the UNIX path to this -share has been defined previously in your -. You also have created subdirectories -for the different Windows client types you want to support. Supposing -your [print$] share maps to the UNIX path -/etc/samba/drivers/, your driver files should now -go here: +We are now going to locate the driver files into the [print$] +share. Remember, the UNIX path to this share has been defined +previously in your words missing here. You +also have created subdirectories for the different Windows client types you want to +support. Supposing your [print$] share maps to the UNIX path +/etc/samba/drivers/, your driver files should now go here: -for all Windows NT, 2000 and XP clients into -/etc/samba/drivers/W32X86/ but -*not*(yet) into the "2" subdir! + + For all Windows NT, 2000 and XP clients into /etc/samba/drivers/W32X86/ but + not (yet) into the 2 subdirectory. + -for all Windows 95, 98 and ME clients into -/etc/samba/drivers/WIN40/ -- but *not* -(yet) into the "0" subdir! + + For all Windows 95, 98 and ME clients into /etc/samba/drivers/WIN40/ but not + (yet) into the 0 subdirectory. + -We again use smbclient to transfer the driver files across the -network. We specify the same files and paths as were leaked to us by -running getdriver against the original -Windows install. However, now we are going to -store the files into a Samba/UNIX print server's -[print$] share... +We again use smbclient to transfer the driver files across the network. We specify the same files +and paths as were leaked to us by running getdriver against the original +Windows install. However, now we are going to store the files into a +Samba/UNIX print server's [print$] share. - &rootprompt;smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c \ - 'cd W32X86; put HDNIS01_de.DLL; \ +&rootprompt;smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c \ + 'cd W32X86; put HDNIS01_de.DLL; \ put Hddm91c1_de.ppd; put HDNIS01U_de.DLL; \ put HDNIS01U_de.HLP; put Hddm91c1_de.DLL; \ put Hddm91c1_de.INI; put Hddm91c1KMMin.DLL; \ @@ -1757,6 +1610,7 @@ store the files into a Samba/UNIX print server's put Hddm91c1_de.vnd; put Hddm91c1_de.hlp; \ put Hddm91c1_de_reg.HLP; put HDNIS01Aux.dll; \ put HDNIS01_de.NTF' + added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 Got a positive name query response from 10.160.51.162 ( 10.160.51.162 ) Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a] @@ -1776,29 +1630,23 @@ putting file Hddm91c1_de.hlp as \W32X86\Hddm91c1_de.hlp putting file Hddm91c1_de_reg.HLP as \W32X86\Hddm91c1_de_reg.HLP putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF - + - -Phewww -- that was a lot of typing! Most drivers are a lot smaller -- -many only having 3 generic PostScript driver files plus 1 PPD. Note, -that while we did retrieve the files from the "2" subdirectory of the -"W32X86" directory from the Windows box, we don't -put them (for now) in this same subdirectory of the Samba box! This -re-location will automatically be done by the -adddriver command which we will run shortly (and -don't forget to also put the files for the Win95/98/ME architecture -into the WIN40/ subdirectory should you need -them). +Whew &smbmdash; that was a lot of typing! Most drivers are a lot smaller &smbmdash; many only having three generic +PostScript driver files plus one PPD. While we did retrieve the files from the 2 +subdirectory of the W32X86 directory from the Windows box, we do not put them +(for now) in this same subdirectory of the Samba box. This relocation will automatically be done by the +adddriver command, which we will run shortly (and do not forget to also put the files +for the Windows 9x/Me architecture into the WIN40/ subdirectory should you need them). -Check if the Driver Files are there (with smbclient) +<command>smbclient</command> to Confirm Driver Installation -For now we verify that our files are there. This can be done with -smbclient too (but of course you can log in via SSH -also and do this through a standard UNIX shell access too): +For now we verify that our files are there. This can be done with smbclient, too +(but, of course, you can log in via SSH also and do this through a standard UNIX shell access): @@ -1806,11 +1654,11 @@ also and do this through a standard UNIX shell access too): -c 'cd W32X86; pwd; dir; cd 2; pwd; dir' added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0 Got a positive name query response from 10.160.51.162 ( 10.160.51.162 ) -Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a] +Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.8a] Current directory is \\SAMBA-CUPS\print$\W32X86\ -. D 0 Sun May 4 03:56:35 2003 -.. D 0 Thu Apr 10 23:47:40 2003 +. D 0 Sun May 4 03:56:35 2003 +.. D 0 Thu Apr 10 23:47:40 2003 2 D 0 Sun May 4 03:56:18 2003 HDNIS01Aux.dll A 15356 Sun May 4 03:58:59 2003 Hddm91c1KMMin.DLL A 46966 Sun May 4 03:58:59 2003 @@ -1830,8 +1678,8 @@ Hddm91c1_de_reg.HLP A 228417 Sun May 4 03:58:59 2003 40976 blocks of size 262144. 709 blocks available Current directory is \\SAMBA-CUPS\print$\W32X86\2\ -. D 0 Sun May 4 03:56:18 2003 -.. D 0 Sun May 4 03:56:35 2003 +. D 0 Sun May 4 03:56:18 2003 +.. D 0 Sun May 4 03:56:35 2003 ADOBEPS5.DLL A 434400 Sat May 3 23:18:45 2003 laserjet4.ppd A 9639 Thu Apr 24 01:05:32 2003 ADOBEPSU.DLL A 109568 Sat May 3 23:18:45 2003 @@ -1841,94 +1689,82 @@ PDFcreator2.PPD A 15746 Sun Apr 20 22:24:07 2003 -Notice that there are already driver files present in the -2 subdir (probably from a previous -installation). Once the files for the new driver are there too, you -are still a few steps away from being able to use them on the -clients. The only thing you could do *now* is to retrieve them from a -client just like you retrieve ordinary files from a file share, by -opening print$ in Windows Explorer. But that wouldn't install them per -Point'n'Print. The reason is: Samba doesn't know yet that these files -are something special, namely printer driver -files and it doesn't know yet to which print queue(s) these -driver files belong. +Notice that there are already driver files present in the 2 subdirectory (probably +from a previous installation). Once the files for the new driver are there too, you are still a few +steps away from being able to use them on the clients. The only thing you could do now is to retrieve +them from a client just like you retrieve ordinary files from a file share, by opening print$ in Windows +Explorer. But that wouldn't install them per Point'n'Print. The reason +is: Samba does not yet know that +these files are something special, namely printer driver files and it does not know +to which print queue(s) these driver files belong. -Running <command>rpcclient</command> with -<command>adddriver</command> +Running <command>rpcclient</command> with <command>adddriver</command> -So, next you must tell Samba about the special category of the files -you just uploaded into the [print$] share. This -is done by the adddriver command. It will -prompt Samba to register the driver files into its internal TDB -database files. The following command and its output has been edited, -again, for readability: +Next, you must tell Samba about the special category of the files you just uploaded into the +[print$] share. This is done by the adddriver +command. It will prompt Samba to register the driver files into its internal TDB database files. The +following command and its output has been edited, again, for readability: - &rootprompt;rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" \ -"dm9110:HDNIS01_de.DLL: \ -Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP: \ - NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ - Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ - Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ - HDNIS01Aux.dll,HDNIS01_de.NTF, \ - Hddm91c1_de_reg.HLP' SAMBA-CUPS +&rootprompt;rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" \ + "dm9110:HDNIS01_de.DLL: \ + Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP: \ + NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ + Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ + Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ + HDNIS01Aux.dll,HDNIS01_de.NTF, \ + Hddm91c1_de_reg.HLP' SAMBA-CUPS cmd = adddriver "Windows NT x86" \ -"dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL: \ - HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ - Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ - Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ - HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP" + "dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL: \ + HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ + Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ + Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ + HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP" Printer Driver dm9110 successfully installed. - -After this step the driver should be recognized by Samba on the print -server. You need to be very careful when typing the command. Don't -exchange the order of the fields. Some changes would lead to a -NT_STATUS_UNSUCCESSFUL error -message. These become obvious. Other changes might install the driver -files successfully, but render the driver unworkable. So take care! -Hints about the syntax of the adddriver command are in the man -page. The CUPS printing chapter of this HOWTO collection provides a -more detailed description, if you should need it. +After this step, the driver should be recognized by Samba on the print server. You need to be very +careful when typing the command. Don't exchange the order of the fields. Some changes would lead to +an NT_STATUS_UNSUCCESSFUL error message. These become obvious. Other +changes might install the driver files successfully, but render the driver unworkable. So take care! +Hints about the syntax of the adddriver command are in the man page. The CUPS printing chapter +provides a more detailed description, should you need it. -Check how Driver Files have been moved after -<command>adddriver</command> finished +Checking <command>adddriver</command> Completion -One indication for Samba's recognition of the files as driver files is -the successfully installed message. -Another one is the fact, that our files have been moved by the -adddriver command into the 2 -subdirectory. You can check this again with -smbclient: +One indication for Samba's recognition of the files as driver files is the successfully +installed message. Another one is the fact that our files have been moved by the +adddriver command into the 2 subdirectory. You can check this +again with smbclient: -&rootprompt;smbclient //SAMBA-CUPS/print\$ -Uroot%xx -c 'cd W32X86;dir;pwd;cd 2;dir;pwd' +&rootprompt;smbclient //SAMBA-CUPS/print\$ -Uroot%xx \ + -c 'cd W32X86;dir;pwd;cd 2;dir;pwd' added interface ip=10.160.51.162 bcast=10.160.51.255 nmask=255.255.252.0 Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a] Current directory is \\SAMBA-CUPS\print$\W32X86\ - . D 0 Sun May 4 04:32:48 2003 - .. D 0 Thu Apr 10 23:47:40 2003 + . D 0 Sun May 4 04:32:48 2003 + .. D 0 Thu Apr 10 23:47:40 2003 2 D 0 Sun May 4 04:32:48 2003 40976 blocks of size 262144. 731 blocks available Current directory is \\SAMBA-CUPS\print$\W32X86\2\ - . D 0 Sun May 4 04:32:48 2003 - .. D 0 Sun May 4 04:32:48 2003 + . D 0 Sun May 4 04:32:48 2003 + .. D 0 Sun May 4 04:32:48 2003 DigiMaster.PPD A 148336 Thu Apr 24 01:07:00 2003 ADOBEPS5.DLL A 434400 Sat May 3 23:18:45 2003 laserjet4.ppd A 9639 Thu Apr 24 01:05:32 2003 @@ -1951,93 +1787,85 @@ subdirectory. You can check this again with HDNIS01U_de.HLP A 19770 Sun May 4 04:32:18 2003 Hddm91c1_de_reg.HLP A 228417 Sun May 4 04:32:18 2003 40976 blocks of size 262144. 731 blocks available - -Another verification is that the timestamp of the printing TDB files -is now updated (and possibly their filesize has increased). +Another verification is that the timestamp of the printing TDB files is now updated +(and possibly their file size has increased). -Check if the Driver is recognized by Samba +Check Samba for Driver Recognition -Now the driver should be registered with Samba. We can easily verify -this, and will do so in a moment. However, this driver is -not yet associated with a particular -printer. We may check the driver status of the -files by at least three methods: +Now the driver should be registered with Samba. We can easily verify this, and will do so in a +moment. However, this driver is not yet associated with a particular printer. We may check the driver +status of the files by at least three methods: -from any Windows client browse Network Neighbourhood, -find the Samba host and open the Samba Printers and -Faxes folder. Select any printer icon, right-click and -select the printer Properties. Click on the -Advanced tab. Here is a field indicating the -driver for that printer. A drop down menu allows you to change that -driver (be careful to not do this unwittingly.). You can use this -list to view all drivers know to Samba. Your new one should be amongst -them. (Each type of client will only see his own architecture's -list. If you don't have every driver installed for each platform, the -list will differ if you look at it from Windows95/98/ME or -WindowsNT/2000/XP.) - -from a Windows 2000 or XP client (not WinNT) browse -Network Neighbourhood, search for the Samba -server and open the server's Printers folder, -right-click the white background (with no printer highlighted). Select -Server Properties. On the -Drivers tab you will see the new driver listed -now. This view enables you to also inspect the list of files belonging -to that driver (this doesn't work on Windows NT, but only on -Windows 2000 and Windows XP. WinNT doesn't provide the "Drivers" -tab).. An alternative, much quicker method for Windows -2000/XP to start this dialog is by typing into a DOS box (you must of -course adapt the name to your Samba server instead of SAMBA-CUPS): - - - rundll32 printui.dll,PrintUIEntry /s /t2 /n\\SAMBA-CUPS - - -from a UNIX prompt run this command (or a variant -thereof), where SAMBA-CUPS is the name of the Samba -host and "xxxx" represents the actual Samba password assigned to root: - - -rpcclient -U'root%xxxx' -c 'enumdrivers' SAMBA-CUPS - - -You will see a listing of all drivers Samba knows about. Your new one -should be amongst them. But it is only listed under the [Windows NT -x86] heading, not under [Windows 4.0], -since we didn't install that part. Or did *you*? -- You will see a listing of -all drivers Samba knows about. Your new one should be amongst them. In our -example it is named dm9110. Note that the 3rd column -shows the other installed drivers twice, for each supported architecture one -time. Our new driver only shows up for -Windows NT 4.0 or 2000. To -have it present for Windows 95, 98 and ME you'll -have to repeat the whole procedure with the WIN40 architecture and subdirectory. - + + From any Windows client browse Network Neighborhood, find the Samba host and open the Samba + Printers and Faxes folder. Select any printer icon, right-click and select + the printer Properties. Click the Advanced + tab. Here is a field indicating the driver for that printer. A drop-down menu allows you to + change that driver (be careful not to do this unwittingly). You can use this list to view + all drivers known to Samba. Your new one should be among them. (Each type of client will only + see his own architecture's list. If you do not have every driver installed for each platform, + the list will differ if you look at it from Windows95/98/ME or WindowsNT/2000/XP.) + + + + From a Windows 200x/XP client (not Windows NT) browse Network Neighborhood, + search for the Samba server and open the server's Printers folder, + right-click on the white background (with no printer highlighted). Select Server + Properties. On the Drivers tab you will see the new driver + listed. This view enables you to also inspect the list of files belonging to that driver + (this does not work on Windows NT, but only on Windows 2000 and Windows XP; Windows NT does not + provide the Drivers tab). An + alternative and much quicker method for + Windows 2000/XP to start this dialog is by typing into a DOS box (you must of course adapt the + name to your Samba server instead of SAMBA-CUPS): + + + rundll32 printui.dll,PrintUIEntry /s /t2 /n\\SAMBA-CUPS + + + + From a UNIX prompt, run this command (or a variant thereof) where + SAMBA-CUPS is the name of the Samba host and xxxx represents the + actual Samba password assigned to root: + + + rpcclient -U'root%xxxx' -c 'enumdrivers' SAMBA-CUPS + + + You will see a listing of all drivers Samba knows about. Your new one should be among + them. But it is only listed under the [Windows NT x86] heading, not under + [Windows 4.0], since you didn't install that part. Or did you? + You will see a listing of all drivers Samba knows about. Your new one should be among them. In + our example it is named dm9110. Note that the third column shows the other + installed drivers twice, one time for each supported architecture. Our new driver only shows up + for Windows NT 4.0 or 2000. To have it present for Windows + 95, 98 and ME, you'll have to repeat the whole procedure with the WIN40 architecture + and subdirectory. + -A side note: you are not bound to specific driver names +Specific Driver Name Flexibility -You can name the driver as you like. If you repeat the -adddriver step, with the same files as before, but -with a different driver name, it will work the same: +You can name the driver as you like. If you repeat the adddriver step with the same +files as before but with a different driver name, it will work the same: -&rootprompt;rpcclient -Uroot%xxxx \ +&rootprompt;rpcclient -Uroot%xxxx \ -c 'adddriver "Windows NT x86" \ - "myphantasydrivername:HDNIS01_de.DLL: \ + "mydrivername:HDNIS01_de.DLL: \ Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP: \ NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ @@ -2045,297 +1873,283 @@ with a different driver name, it will work the same: HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP' SAMBA-CUPS - cmd = adddriver "Windows NT x86" - "myphantasydrivername:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:\ - HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ - Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ - Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ - HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP" - - Printer Driver myphantasydrivername successfully installed. +cmd = adddriver "Windows NT x86" \ + "mydrivername:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:\ + HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ + Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ + Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ + HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP" +Printer Driver mydrivername successfully installed. -You will also be able to bind that driver to any print queue (however, -you are responsible yourself that you associate drivers to queues -which make sense to the target printer). Note, that you can't run the -rpcclient adddriver command -repeatedly. Each run "consumes" the files you had put into the -[print$] share by moving them into the -respective subdirectories. So you must precede an -smbclient ... put command before each -rpcclient ... adddriver" command. +You will be able to bind that driver to any print queue (however, you are responsible that +you associate drivers to queues that make sense with respect to target printers). You cannot run the +rpcclient adddriver command repeatedly. Each run consumes the +files you had put into the [print$] share by moving them into the +respective subdirectories. So you must execute an smbclient ... put command before +each rpcclient ... adddriver command. -Running <command>rpcclient</command> with -<command>setdriver</command> +Running <command>rpcclient</command> with the <command>setdriver</command> -Samba still needs to know which printer's driver -this is. It needs to create a mapping of the driver to a printer, and -store this info in its "memory", the TDB files. The rpcclient -setdriver command achieves exactly this: +Samba needs to know which printer owns which driver. Create a mapping of the driver to a printer, and +store this info in Samba's memory, the TDB files. The rpcclient setdriver command +achieves exactly this: -&rootprompt;rpcclient -U'root%xxxx' -c 'setdriver dm9110 myphantasydrivername' SAMBA-CUPS - cmd = setdriver dm9110 myphantasydrivername - Successfully set dm9110 to driver myphantasydrivername. +&rootprompt;rpcclient -U'root%xxxx' -c 'setdriver dm9110 mydrivername' SAMBA-CUPS + cmd = setdriver dm9110 mydrivername + +Successfully set dm9110 to driver mydrivername. -Ahhhhh -- no, I didn't want to do that. Repeat, this time with the -name I intended: +Ah, no, I did not want to do that. Repeat, this time with the name I intended: &rootprompt;rpcclient -U'root%xxxx' -c 'setdriver dm9110 dm9110' SAMBA-CUPS cmd = setdriver dm9110 dm9110 - Successfully set dm9110 to driver dm9110. +Successfully set dm9110 to driver dm9110. -The syntax of the command is rpcclient --U'root%sambapassword' -c 'setdriver -"printername" -"drivername' -SAMBA-Hostname . -- -Now we have done *most* of the work. But not yet all.... +The syntax of the command is: + +rpcclient -U'root%sambapassword' -c 'setdriver printername \ + drivername' SAMBA-Hostname. + +Now we have done most of the work, but not all of it. -the setdriver command will only succeed if the printer is -known to -Samba already. A bug in 2.2.x prevented Samba from recognizing freshly -installed printers. You had to restart Samba, or at least send a HUP -signal to all running smbd processes to work around this: -kill -HUP `pidof smbd`. +The setdriver command will only succeed if the +printer is already known to Samba. A +bug in 2.2.x prevented Samba from recognizing freshly installed printers. You had to restart Samba, +or at least send an HUP signal to all running smbd processes to work around this: kill -HUP +`pidof smbd`. + -Client Driver Install Procedure +Client Driver Installation Procedure -A famous philosopher said once: The Proof of the Pudding lies -in the Eating. The proof for our setup lies in the printing. -So let's install the printer driver onto the client PCs. This is not -as straightforward as it may seem. Read on. +As Don Quixote said: The proof of the pudding is in the eating. The proof +for our setup lies in the printing. So let's install the printer driver onto the client PCs. This is +not as straightforward as it may seem. Read on. -The first Client Driver Installation +First Client Driver Installation -Especially important is the installation onto the first client PC (for -each architectural platform separately). Once this is done correctly, -all further clients are easy to setup and shouldn't need further -attention. What follows is a description for the recommended first -procedure. You work now from a client workstation. First you should -guarantee that your connection is not unwittingly mapped to -bad user "nobody". In a DOS box type: +Especially important is the installation onto the first client PC (for each architectural platform +separately). Once this is done correctly, all further clients are easy to setup and shouldn't need further +attention. What follows is a description for the recommended first procedure. You work now from a client +workstation. You should guarantee that your connection is not unwittingly mapped to bad +user nobody. In a DOS box type: net use \\SAMBA-SERVER\print$ /user:root -Replace root, if needed, by another valid -printer admin user as given in the definition. -Should you already be connected as a different user, you'll get an error -message. There is no easy way to get rid of that connection, because -Windows doesn't seem to know a concept of "logging off" from a share -connection (don't confuse this with logging off from the local -workstation; that is a different matter). You can try to close -all Windows file explorer and Internet Explorer -windows. As a last resort, you may have to reboot. Make sure there is -no automatic re-connection set up. It may be easier to go to a -different workstation and try from there. After you have made sure you -are connected as a printer admin user (you can check this with the -smbstatus command on Samba) do this from the -Windows workstation: +Replace root, if needed, by another valid printer admin user as given in +the definition. Should you already be connected as a different user, you will get an error message. There +is no easy way to get rid of that connection, because Windows does not seem to know a concept of logging +off from a share connection (do not confuse this with logging off from the local workstation; that is +a different matter). You can try to close all Windows file explorer +and Internet Explorer for Windows. As +a last resort, you may have to reboot. Make sure there is no automatic reconnection set up. It may be +easier to go to a different workstation and try from there. After you have made sure you are connected +as a printer admin user (you can check this with the smbstatus command on Samba), +do this from the Windows workstation: - -Open Network -Neighbourhood + + + Open Network Neighborhood. + -Browse to Samba server + + Browse to Samba server. + -Open its Printers and -Faxes folder + + Open its Printers and Faxes folder. + -Highlight and right-click the printer + + Highlight and right-click on the printer. + -Select Connect... (for WinNT4/2K -it is possibly Install...) - + + Select Connect (for Windows NT4/200x + it is possibly Install). + + -A new printer (named printername on -samba-server) should now have appeared in your -local Printer folder (check Start -- -Settings -- Control Panel --- Printers and Faxes). +A new printer (named printername on Samba-server) should now have +appeared in your local Printer folder (check Start -- +Settings -- Control Panel -- Printers +and Faxes). -Most likely you are now tempted to try and print a test page. After -all, you now can open the printer properties and on the "General" tab, -there is a button offering to do just that. But chances are that you -get an error message saying Unable to print Test -Page. The reason might be that there is not yet a -valid Device Mode set for the driver, or that the "Printer Driver -Data" set is still incomplete. +Most likely you are now tempted to try to print a test page. After all, you now can open the printer +properties, and on the General tab there is a button offering to do just that. But +chances are that you get an error message saying Unable to print Test Page. The +reason might be that there is not yet a valid Device Mode set for the driver, or that the Printer +Driver Data set is still incomplete. -You must now make sure that a valid "Device Mode" is set for the -driver. Don't fear -- we will explain now what that means. +You must make sure that a valid Device Mode is set for the +driver. We now explain what that means. -IMPORTANT! Setting Device Modes on new Printers +Setting Device Modes on New Printers -In order for a printer to be truly usable by a Windows NT/2K/XP -client, it must possess: +For a printer to be truly usable by a Windows NT/200x/XP client, it must possess: -a valid Device Mode generated by -the driver for the printer (defining things like paper size, -orientation and duplex settings), and + + A valid Device Mode generated by the driver for the printer (defining things + like paper size, orientation and duplex settings). + -a complete set of -Printer Driver Data generated by the -driver. + + A complete set of Printer Driver Data generated by the driver. + -If either one of these is incomplete, the clients can produce less -than optimal output at best. In the worst cases, unreadable garbage or -nothing at all comes from the printer or they produce a harvest of -error messages when attempting to print. Samba stores the named values -and all printing related info in its internal TDB database files -(ntprinters.tdb, -ntdrivers.tdb, printing.tdb -and ntforms.tdb). +If either of these is incomplete, the clients can produce less than optimal output at best. In the +worst cases, unreadable garbage or nothing at all comes from the printer or it produces a harvest of +error messages when attempting to print. Samba stores the named values and all printing related information in +its internal TDB database files (ntprinters.tdb, ntdrivers.tdb, +printing.tdb and ntforms.tdb). -What do these two words stand for? Basically, the Device Mode and the -set of Printer Driver Data is a collection of settings for all print -queue properties, initialized in a sensible way. Device Modes and -Printer Driver Data should initially be set on the print server (that is -here: the Samba host) to healthy values so that the clients can start -to use them immediately. How do we set these initial healthy values? -This can be achieved by accessing the drivers remotely from an NT (or -2k/XP) client, as is discussed in the next paragraphs. +What do these two words stand for? Basically, the Device Mode and the set of Printer Driver Data is a +collection of settings for all print queue properties, initialized in a sensible way. Device Modes and +Printer Driver Data should initially be set on the print server (the Samba host) to healthy +values so the clients can start to use them immediately. How do we set these initial healthy values? +This can be achieved by accessing the drivers remotely from an NT (or 200x/XP) client, as is discussed +in the following paragraphs. -Be aware, that a valid Device Mode can only be initiated by a -printer admin, or root (the reason should be -obvious). Device Modes can only correctly be set by executing the -printer driver program itself. Since Samba can not execute this Win32 -platform driver code, it sets this field initially to NULL (which is -not a valid setting for clients to use). Fortunately, most drivers -generate themselves the Printer Driver Data that is needed, when they -are uploaded to the [print$] share with the -help of the APW or rpcclient. +Be aware that a valid Device Mode can only be initiated by a +printer admin, or root +(the reason should be obvious). Device Modes can only be correctly +set by executing the printer driver program itself. Since Samba cannot execute this Win32 platform driver +code, it sets this field initially to NULL (which is not a valid setting for clients to use). Fortunately, +most drivers automatically generate the Printer Driver Data that is needed when they are uploaded to the +[print$] share with the help of the APW or rpcclient. -The generation and setting of a first valid Device Mode however -requires some "tickling" from a client, to set it on the Samba -server. The easiest means of doing so is to simply change the page -orientation on the server's printer. This "executes" enough of the -printer driver program on the client for the desired effect to happen, -and feeds back the new Device Mode to our Samba server. You can use the -native Windows NT/2K/XP printer properties page from a Window client -for this: +The generation and setting of a first valid Device Mode, however, requires some tickling from a client, +to set it on the Samba server. The easiest means of doing so is to simply change the page orientation on +the server's printer. This executes enough of the printer driver program on the client for the desired +effect to happen, and feeds back the new Device Mode to our Samba server. You can use the native Windows +NT/200x/XP printer properties page from a Window client for this: - - Browse the Network Neighbourhood + + + Browse the Network Neighborhood. + -Find the Samba server + + Find the Samba server. + -Open the Samba server's Printers and - Faxes folder + + Open the Samba server's Printers and Faxes folder. + -Highlight the shared printer in question + + Highlight the shared printer in question. + -Right-click the printer (you may already be here, if you -followed the last section's description) + + Right-click on the printer (you may already be here, if you followed the last section's description). + -At the bottom of the context menu select -Properties.... (if the menu still offers the -Connect... entry -further above, you need to click that one first to achieve the driver -installation as shown in the last section) + + At the bottom of the context menu select Properties (if the menu still offers the + Connect entry further above, you + need to click on that one first to achieve the driver + installation as shown in the last section). + -Go to the Advanced tab; click on -Printing Defaults... + + Go to the Advanced tab; click on Printing Defaults. + -Change the "Portrait" page setting to "Landscape" (and -back) + + Change the Portrait page setting to Landscape (and back). + -(Oh, and make sure to apply -changes between swapping the page orientation to cause the change to -actually take effect...). + + Make sure to apply changes between swapping the page orientation to cause the change to actually take effect. + -While you're at it, you may optionally also want to -set the desired printing defaults here, which then apply to all future -client driver installations on the remaining from now -on. - + + While you are at it, you may also want to set the desired printing defaults here, which then apply to all future + client driver installations on the remaining from now on. + + -This procedure has executed the printer driver program on the client -platform and fed back the correct Device Mode to Samba, which now -stored it in its TDB files. Once the driver is installed on the -client, you can follow the analogous steps by accessing the -local Printers folder too if you are -a Samba printer admin user. From now on printing should work as expected. +This procedure has executed the printer driver program on the client platform and fed back the correct +Device Mode to Samba, which now stored it in its TDB files. Once the driver is installed on the client, +you can follow the analogous steps by accessing the local Printers +folder, too, if you are a Samba printer admin user. From now on, printing should work as expected. -Samba also includes a service level parameter name default -devmode for generating a default Device Mode for a -printer. Some drivers will function well with Samba's default set of -properties. Others may crash the client's spooler service. So use this -parameter with caution. It is always better to have the client -generate a valid device mode for the printer and store it on the -server for you. +Samba includes a service level parameter name default devmode for generating a default +Device Mode for a printer. Some drivers will function well with Samba's default set of properties. Others +may crash the client's spooler service. So use this parameter with caution. It is always better to have +the client generate a valid device mode for the printer and store it on the server for you. -Further Client Driver Install Procedures +Additional Client Driver Installation -Every further driver may be done by any user, along the lines -described above: Browse network, open printers folder on Samba server, -right-click printer and choose Connect.... Once -this completes (should be not more than a few seconds, but could also take -a minute, depending on network conditions), you should find the new printer in -your client workstation local Printers and -Faxes folder. +Every additional driver may be installed, along the lines described +above. Browse network, open the +Printers folder on Samba server, right-click on Printer and choose +Connect.... Once this completes (should be not more than a few seconds, +but could also take a minute, depending on network conditions), you should find the new printer in your +client workstation local Printers and Faxes folder. You can also open your local Printers and Faxes folder by -using this command on Windows 2000 and Windows XP Professional workstations: +using this command on Windows 200x/XP Professional workstations: -rundll32 shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder - +rundll32 shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder or this command on Windows NT 4.0 workstations: @@ -2346,45 +2160,40 @@ rundll32 shell32.dll,Control_RunDLL MAIN.CPL @2 -You can enter the commands either inside a DOS box window -or in the Run command... field from the -Start menu. +You can enter the commands either inside a DOS box window or in the Run +command... field from the Start menu. -Always make first Client Connection as root or "printer admin" +Always Make First Client Connection as root or <quote>printer admin</quote> -After you installed the driver on the Samba server (in its -[print$] share, you should always make sure -that your first client installation completes correctly. Make it a habit for -yourself to build that the very first connection from a client as -printer admin. This is to make sure that: +After you installed the driver on the Samba server (in its [print$] +share, you should always make sure that your first client installation completes correctly. Make it a +habit for yourself to build the very first connection from a client as printer admin. This is to make sure that: + + A first valid Device Mode is really initialized (see above for more + explanation details). + - a first valid Device Mode is -really initialized (see above for more explanation details), and -that - - the default print settings of your printer for all -further client installations are as you want them + + The default print settings of your printer for all further client installations are as you want them. + -Do this by changing the orientation to landscape, click -Apply, and then change it back again. Then modify -the other settings (for example, you don't want the default media size -set to Letter, when you are all using -A4, right? You may want to set the printer for -duplex as the default; etc.). +Do this by changing the orientation to landscape, click on Apply, and then change it +back again. Next, modify the other settings (for example, you do not want the default media size set to +Letter when you are all using A4, right? You may want to set the +printer for duplex as the default, and so on). -To connect as root to a Samba printer, try this command from a Windows -2K/XP DOS box command prompt: +To connect as root to a Samba printer, try this command from a Windows 200x/XP DOS box command prompt: @@ -2395,18 +2204,15 @@ To connect as root to a Samba printer, try this command from a Windows You will be prompted for root's Samba-password; type it, wait a few -seconds, click on Printing Defaults... and -proceed to set the job options as should be used as defaults by all -clients. Alternatively, instead of root you can name one other member -of the printer admin from the setting. +seconds, click on Printing +Defaults, and proceed to set the job options that should be used as defaults by all +clients. Alternately, instead of root you can name one other member of the printer admin from the setting. -Now all the other users downloading and installing the driver -the same way (called Point'n'Print) will -have the same defaults set for them. If you miss this step you'll -get a lot of helpdesk calls from your users. But maybe you like to -talk to people.... ;-) + Now all the other users downloading and installing the driver the same way (called +Point'n'Print) will have the same defaults set for them. If you miss this step +you'll get a lot of Help Desk calls from your users, but maybe you like to talk to people. @@ -2415,137 +2221,112 @@ talk to people.... ;-) Other Gotchas -Your driver is installed. It is ready for -Point'n'Print installation by the clients -now. You may have tried to download and use it -onto your first client machine now. But wait... let's make you -acquainted first with a few tips and tricks you may find useful. For -example, suppose you didn't manage to "set the defaults" on the -printer, as advised in the preceding paragraphs? And your users -complain about various issues (such as We need to set the paper -size for each job from Letter to A4 and it won't store it!) +Your driver is installed. It is now ready for Point'n'Print +installation by the clients. You may have tried to download and use it +onto your first client machine, but +wait. Let's make sure you are acquainted first with a few tips and tricks you may find useful. For example, +suppose you did not set the defaults on the printer, as advised in the preceding +paragraphs. Your users complain about various issues (such as, We need to set the paper size +for each job from Letter to A4 and it will not store it.) -Setting Default Print Options for the Client Drivers +Setting Default Print Options for Client Drivers The last sentence might be viewed with mixed feelings by some users and -admins. They have struggled for hours and hours and couldn't arrive at -a point were their settings seemed to be saved. It is not their -fault. The confusing thing is this: in the multi-tabbed dialog that pops -up when you right-click the printer name and select -Properties..., you can arrive at two identically -looking dialogs, each claiming that they help you to set printer options, -in three different ways. Here is the definite answer to the "Samba -Default Driver Setting FAQ": +admins. They have struggled for hours and could not arrive at a point +where their settings seemed to be saved. It is not their fault. The confusing +thing is that in the multi-tabbed dialog that pops up when you right-click +on the printer name and select Properties, you +can arrive at two dialogs that appear identical, each claiming that they help +you to set printer options in three different ways. Here is the definite +answer to the Samba default driver setting FAQ: -<quote>I can't set and save default print options -for all users on Win2K/XP! Why not?</quote> +<quote>I can not set and save default print options +for all users on Windows 200x/XP. Why not?</quote> -How are you doing it? I bet the wrong way.... (it is not very -easy to find out, though). There are 3 different ways to bring you to -a dialog that seems to set everything. All three -dialogs look the same. Only one of them -does what you intend. -Important: you need to be Administrator or Print -Administrator to do this for all users. Here is how I reproduce it in -on XP Professional: - - - -The first "wrong" way: - - -Open the Printers -folder. - -Right-click on the printer -(remoteprinter on cupshost) and -select in context menu Printing -Preferences... - -Look at this dialog closely and remember what it looks -like. - +How are you doing it? I bet the wrong way. (It is not easy to find out, though). There are three different +ways to bring you to a dialog that seems to set everything. All three +dialogs look the same, but only one +of them does what you intend. You need to be Administrator or Print Administrator to do this for all +users. Here is how I reproduce it in an XP Professional: - - -The second "wrong" way: - - - Open the Printers -folder. +The following list needs periods after the letters and numbers::::::::: + + The first wrong way: + + Open the Printers folder. -Right-click on the printer (remoteprinter on -cupshost) and select in the context menu -Properties + Right-click on the printer (remoteprinter on cupshost) and + select in context menu Printing Preferences.... -Click on the General -tab + Look at this dialog closely and remember what it looks like. + -Click on the button Printing -Preferences... + The second wrong way: + + Open the Printers folder. -A new dialog opens. Keep this dialog open and go back -to the parent dialog. - - - + Right-click on the printer (remoteprinter on + cupshost) and select in the context menu + Properties -The third, the "correct" way: (should you do -this from the beginning, just carry out steps 1. and 2. from second -"way" above) + Click on the General + tab. - -Click on the Advanced -tab. (Hmmm... if everything is "Grayed Out", then you are not logged -in as a user with enough privileges). + Click on the Printing + Preferences... button. -Click on the Printing -Defaults... button. - -On any of the two new tabs, click on the -Advanced... button. + A new dialog opens. Keep this dialog open and go back + to the parent dialog. + + -A new dialog opens. Compare this one to the other, -identical looking one from "B.5" or A.3". - - - + + The third and correct way: (should you do this from the beginning, just carry out steps 1 + and 2 from the second method above). + + + + Click on the Advanced + tab. (If everything is grayed out, then you are not logged + in as a user with enough privileges). + + Click on the Printing + Defaults button. + + On any of the two new tabs, + click on the + Advanced button. + + A new dialog opens. Compare + this one to the other. Are they + identical looking comparing one from + B.5 and one from A.3". + + -Do you see any difference in the two settings dialogs? I don't -either. However, only the last one, which you arrived at with steps -C.1.-6. will permanently save any settings which will then become the -defaults for new users. If you want all clients to have the same -defaults, you need to conduct these steps as administrator -(printer admin in ) -before a client downloads the driver (the clients -can later set their own per-user defaults by -following the procedures A. -or B. above...). (This is new: Windows 2000 and -Windows XP allow per-user default settings and -the ones the administrator gives them, before they set up their own). -The "parents" of the identically looking dialogs have a slight -difference in their window names: one is called -Default Print Values for Printer Foo on Server -Bar" (which is the one you need) and the other is -called "Print Settings for Printer Foo on Server -Bar". The last one is the one you arrive at when you -right-click on the printer and select Print -Settings.... This is the one what you were -taught to use back in the days of Windows NT! So it is only natural to -try the same way with Win2k or WinXP. You wouldn't dream -that there is now a different "clicking path" to arrive at an -identically looking, but functionally different dialog to set defaults -for all users! + +Do you see any difference in the two settings dialogs? I do not either. However, only the last one, which +you arrived at with steps C.1 through 6 will permanently save any settings which will then become the defaults +for new users. If you want all clients to have the same defaults, you need to conduct these steps as +administrator (printer admin in ) before +a client downloads the driver (the clients can later set their own per-user defaults +by following procedures A or B above). Windows 200x/XP allow per-user default settings and the ones the +administrator gives them, before they set up their own. The parents of the identically-looking dialogs have a slight difference in their window names; one is called Default Print +Values for Printer Foo on Server Bar" (which is the one you need) and the other is called +Print Settings for Printer Foo on Server Bar. The last one is the one you +arrive at when you right-click on the printer and select Print Settings.... This +is the one that you were taught to use back in the days of Windows NT, so it is only natural to try the +same way with Windows 200x/XP. You would not dream that there is now a different path to arrive at an +identically looking, but functionally different, dialog to set defaults for all users. -Try (on Win2000 and WinXP) to run this command (as a user -with the right privileges): +Try (on Windows 200x/XP) to run this command (as a user with the right privileges): @@ -2553,8 +2334,7 @@ rundll32 printui.dll,PrintUIEntry /p /t3 /n\\SAMBA-SERVER -to see the tab with the Printing Defaults... -button (the one you need). Also run this command: +To see the tab with the Printing Defaults button (the one you need),also run this command: @@ -2562,36 +2342,31 @@ rundll32 printui.dll,PrintUIEntry /p /t0 /n\\SAMBA-SERVER -to see the tab with the Printing Preferences... -button (the one which doesn't set system-wide defaults). You can -start the commands from inside a DOS box" or from the Start --- Run... menu. +To see the tab with the Printing Preferences +button (the one which does not set system-wide defaults), you can +start the commands from inside a DOS box" or from Start -> Run. -Supporting large Numbers of Printers +Supporting Large Numbers of Printers -One issue that has arisen during the recent development phase of Samba -is the need to support driver downloads for 100's of printers. Using -Windows NT APW here is somewhat awkward (to say the least). If you -don't want to acquire RSS pains from such the printer installation -clicking orgy alone, you need to think about a non-interactive script. +One issue that has arisen during the recent development phase of Samba is the need to support driver +downloads for hunderds of printers. Using Windows NT APW here is somewhat awkward (to say the least). If +you do not want to acquire RSS pains from the printer installation clicking orgy alone, you need +to think about a non-interactive script. -If more than one printer is using the same driver, the -rpcclient setdriver command can be used to set the -driver associated with an installed queue. If the driver is uploaded -to [print$] once and registered with the -printing TDBs, it can be used by multiple print queues. In this case -you just need to repeat the setprinter subcommand -of rpcclient for every queue (without the need to -conduct the adddriver again and again). The -following is an example of how this could be accomplished: +If more than one printer is using the same driver, the rpcclient setdriver +command can be used to set the driver associated with an installed queue. If the driver is uploaded to +[print$] once and registered with the printing TDBs, it can be used by +multiple print queues. In this case, you just need to repeat the setprinter subcommand of +rpcclient for every queue (without the need to conduct the adddriver +repeatedly). The following is an example of how this could be accomplished: @@ -2612,7 +2387,7 @@ following is an example of how this could be accomplished: Driver Name: [dm9110] Printer Driver Info 1: - Driver Name: [myphantasydrivername] + Driver Name: [mydrivername] [....] @@ -2646,9 +2421,9 @@ following is an example of how this could be accomplished: -&rootprompt;rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 myphantasydrivername' - cmd = setdriver dm9110 myphantasydrivername - Successfully set dm9110 to myphantasydrivername. +&rootprompt;rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 mydrivername' + cmd = setdriver dm9110 mydrivername + Successfully set dm9110 to mydrivername. @@ -2656,54 +2431,48 @@ following is an example of how this could be accomplished: cmd = enumprinters flags:[0x800000] name:[\\SAMBA-CUPS\dm9110] - description:[\\SAMBA-CUPS\dm9110,myphantasydrivername,\ + description:[\\SAMBA-CUPS\dm9110,mydrivername,\ 110ppm HiVolume DANKA Stuttgart] comment:[110ppm HiVolume DANKA Stuttgart] [....] -It may be not easy to recognize: but the first call to -enumprinters showed the "dm9110" printer with an -empty string where the driver should have been listed (between the 2 -commas in the "description" field). After the -setdriver command succeeded, all is well. (The -CUPS Printing chapter has more info about the installation of printer -drivers with the help of rpcclient). +It may not be easy to recognize that the first call to enumprinters showed the +dm9110 printer with an empty string where the driver should have been listed (between +the 2 commas in the description field). After the setdriver command +succeeded, all is well. -Adding new Printers with the Windows NT APW +Adding New Printers with the Windows NT APW -By default, Samba exhibits all printer shares defined in -&smb.conf; in the -Printers... folder. Also located in this folder -is the Windows NT Add Printer Wizard icon. The APW will be shown only -if: +By default, Samba exhibits all printer shares defined in &smb.conf; in the Printers +folder. Also located in this folder is the Windows NT Add Printer Wizard icon. The APW will be shown only if: -...the connected user is able to successfully execute -an OpenPrinterEx(\\server) with administrative -privileges (i.e. root or printer admin). - + + The connected user is able to successfully execute an OpenPrinterEx(\\server) with + administrative privileges (i.e., root or printer admin). + - Try this from a Windows 2K/XP DOS box command prompt: - + Try this from a Windows 200x/XP DOS box command prompt: + - -runas /netonly /user:root rundll32 printui.dll,PrintUIEntry /p /t0 /n \\SAMBA-SERVER\printersharename - + + runas /netonly /user:root rundll32 printui.dll,PrintUIEntry /p /t0 /n \\SAMBA-SERVER\printersharename + - -and click on Printing Preferences... - + + Click on Printing Preferences. + -... contains the setting -show add printer wizardyes (the -default). + ... contains the setting + show add printer wizardyes (the + default). @@ -2711,122 +2480,104 @@ The APW can do various things: -upload a new driver to the Samba -[print$] share; + + Upload a new driver to the Samba [print$] share. + -associate an uploaded driver with an existing (but -still "driverless") print queue; + + Associate an uploaded driver with an existing (but still driverless) print queue. + -exchange the currently used driver for an existing -print queue with one that has been uploaded before; + + Exchange the currently used driver for an existing print queue with one that has been uploaded before. + -add an entirely new printer to the Samba host (only in -conjunction with a working add printer command; -a corresponding delete printer command for -removing entries from the Printers... folder -may be provided too) + + Add an entirely new printer to the Samba host (only in conjunction with a working + add printer command. A corresponding + delete printer command for removing entries from the + Printers folder may also be provided). + -The last one (add a new printer) requires more effort than the -previous ones. In order to use the APW to successfully add a printer -to a Samba server, the add printer command must -have a defined value. The program hook must successfully add the -printer to the UNIX print system (i.e. to -/etc/printcap, -/etc/cups/printers.conf or other appropriate -files) and to if necessary. +The last one (add a new printer) requires more effort than the previous ones. To use +the APW to successfully add a printer to a Samba server, the add printer command must have a defined value. The program hook must successfully +add the printer to the UNIX print system (i.e., to /etc/printcap, +/etc/cups/printers.conf or other appropriate files) and to &smb.conf; if necessary. -When using the APW from a client, if the named printer share does not -exist, smbd will execute the add printer -command and reparse to the -to attempt to locate the new printer share. If the share is still not -defined, an error of Access Denied is -returned to the client. Note that the add printer command is executed under the context of the connected -user, not necessarily a root account. A map to guestbad user may have connected you unwittingly under the wrong -privilege; you should check it by using the -smbstatus command. +When using the APW from a client, if the named printer share does not exist, smbd will execute the +add printer command and reparse to the to attempt to locate the new printer +share. If the share is still not defined, an error of Access Denied is returned to +the client. The add printer command is executed +under the context of the connected user, not necessarily a root account. A map to guestbad user may have connected you unwittingly under the wrong +privilege. You should check it by using the smbstatus command. + -Weird Error Message <errorname>Cannot connect under a -different Name</errorname> +Error Message: <quote><errorname>Cannot connect under a different Name</errorname></quote> -Once you are connected with the wrong credentials, there is no means -to reverse the situation other than to close all Explorer windows, and -perhaps reboot. +Once you are connected with the wrong credentials, there is no means to reverse the situation other than +to close all Explorer Windows, and perhaps reboot. -The net use \\SAMBA-SERVER\sharename -/user:root gives you an error message: Multiple -connections to a server or a shared resource by the same user -utilizing the several user names are not allowed. Disconnect all -previous connections to the server, resp. the shared resource, and try -again. - -Every attempt to "connect a network drive" to -\\SAMBASERVER\\print$ to z: is countered by the -pertinacious message. This network folder is currently -connected under different credentials (username and password). -Disconnect first any existing connection to this network share in -order to connect again under a different username and -password. + + The net use \\SAMBA-SERVER\sharename /user:root gives you an error message: + Multiple connections to a server or a shared resource by the same user utilizing + the several user names are not allowed. Disconnect all previous connections to the server, + resp. the shared resource, and try again. + + + + Every attempt to connect a network drive to \\SAMBASERVER\\print$ + to z: is countered by the pertinacious message: This + network folder is currently connected under different credentials (username and password). + Disconnect first any existing connection to this network share in order to connect again under + a different username and password. + -So you close all connections. You try again. You get the same -message. You check from the Samba side, using -smbstatus. Yes, there are some more -connections. You kill them all. The client still gives you the same -error message. You watch the smbd.log file on a very high debug level -and try re-connect. Same error message, but not a single line in the -log. You start to wonder if there was a connection attempt at all. You -run ethereal and tcpdump while you try to connect. Result: not a -single byte goes on the wire. Windows still gives the error -message. You close all Explorer Windows and start it again. You try to -connect - and this times it works! Windows seems to cache connection -info somewhere and doesn't keep it up to date (if you are unlucky you -might need to reboot to get rid of the error message). +So you close all connections. You try again. You get the same message. You check from the Samba side, +using smbstatus. Yes, there are more connections. You kill them all. The client +still gives you the same error message. You watch the smbd.log file on a high debug level and try +reconnect. Same error message, but not a single line in the log. You start to wonder if there was a +connection attempt at all. You run ethereal and tcpdump while you try to connect. Result: not a single +byte goes on the wire. Windows still gives the error message. You close all Explorer windows and start it +again. You try to connect &smbmdash; and this times it works! Windows seems to cache connection informtion somewhere and +does not keep it up-to-date (if you are unlucky you might need to reboot to get rid of the error message). -Be careful when assembling Driver Files - - -You need to be very careful when you take notes about the files and -belonging to a particular driver. Don't confuse the files for driver -version "0" (for Win95/98/ME, going into -[print$]/WIN/0/), driver version "2" (Kernel Mode -driver for WinNT, going into [print$]/W32X86/2/ -may be used on Win2K/XP too), and driver version -"3" (non-Kernel Mode driver going into -[print$]/W32X86/3/ can not -be used on WinNT). Very often these different driver versions contain -files carrying the same name; but still the files are very different! -Also, if you look at them from the Windows Explorer (they reside in -%WINDOWS%\system32\spool\drivers\W32X86\) you -will probably see names in capital letters, while an "enumdrivers" -command from Samba would show mixed or lower case letters. So it is -easy to confuse them. If you install them manually using -rpcclient and subcommands, you may even succeed -without an error message. Only later, when you try install on a -client, you will encounter error messages like This -server has no appropriate driver for the printer. - - - -Here is an example. You are invited to look very closely at the -various files, compare their names and their spelling, and discover -the differences in the composition of the version-2 and -3 sets -Note: the version-0 set contained 40 (!) -Dependentfiles, so I left it out for space -reasons: +Take Care When Assembling Driver Files + + +You need to be extremely careful when you take notes about the files and belonging to a particular +driver. Don't confuse the files for driver version 0 (for Windows 9x/Me, going into +[print$]/WIN/0/), driver version 2 (Kernel Mode driver for Windows NT, +going into [print$]/W32X86/2/ may be used on Windows 200x/XP also), and +driver version 3 (non-Kernel Mode driver going into [print$]/W32X86/3/ +cannot be used on Windows NT). Quite often these different driver versions contain +files that have the same name but actually are very different. If you look at them from +the Windows Explorer (they reside in %WINDOWS%\system32\spool\drivers\W32X86\), +you will probably see names in capital letters, while an enumdrivers command from Samba +would show mixed or lower case letters. So it is easy to confuse them. If you install them manually using +rpcclient and subcommands, you may even succeed without an error message. Only later, +when you try install on a client, you will encounter error messages like This server +has no appropriate driver for the printer. + + + +Here is an example. You are invited to look closely at the various files, compare their names and +their spelling, and discover the differences in the composition of the version 2 and 3 sets. Note: the +version 0 set contained 40 Dependentfiles, so I left it out for space reasons: @@ -2890,7 +2641,7 @@ reasons: -If we write the "version 2" files and the "version 3" files +If we write the version 2 files and the version 3 files into different text files and compare the result, we see this picture: @@ -2923,10 +2674,9 @@ picture: > cpcqm407.cnt > cns3ggr.dll ]]> - + - -Don't be fooled though! Driver files for each version with identical +Do not be fooled! Driver files for each version with identical names may be different in their content, as you can see from this size comparison: @@ -2945,13 +2695,12 @@ comparison: CNS3G.DLL A 1145088 Thu May 30 02:31:00 2002 CNS3G.DLL A 15872 Thu May 30 02:31:00 2002 - -In my example were even more differences than shown here. Conclusion: -you must be very careful to select the correct driver files for each -driver version. Don't rely on the names alone. Don't interchange files +In my example were even more differences than shown here. Conclusion: you must be careful to select +the correct driver files for each driver version. Don't rely on the +names alone and don't interchange files belonging to different driver versions. @@ -2960,43 +2709,36 @@ belonging to different driver versions. Samba and Printer Ports -Windows NT/2000 print servers associate a port with each -printer. These normally take the form of LPT1:, -COM1:, FILE:, etc. Samba -must also support the concept of ports associated with a printer. By -default, only one printer port, named "Samba Printer Port", exists on -a system. Samba does not really need such a "port" in order to print; -it rather is a requirement of Windows clients. They insist on being -told about an available port when they request this info, otherwise -they throw an error message at you. So Samba fakes the port +Windows NT/2000 print servers associate a port with each printer. These normally take the form of +LPT1:, COM1:, +FILE:, and so on. Samba must also +support the concept of ports associated with a printer. By default, only one printer port, named Samba +Printer Port, exists on a system. Samba does not really need such a port in order +to print; rather it is a requirement of Windows clients. They insist on being told about an available +port when they request this information, otherwise they throw an error message at you. So Samba fakes the port information to keep the Windows clients happy. -Note that Samba does not support the concept of "Printer Pooling" -internally either. Printer Pooling assigns a logical printer to -multiple ports as a form of load balancing or fail over. +Samba does not support the concept of Printer Pooling internally either. Printer +Pooling assigns a logical printer to multiple ports as a form of load balancing or fail over. -If you require that multiple ports be defined for some reason or -another (My users and my Boss should not know that they are -working with Samba), possesses a -enumports command which can be used to define -an external program that generates a listing of ports on a system. +If you require multiple ports be defined for some reason or another (my users and my boss should not know +that they are working with Samba), configure enumports command +which can be used to define an external program that generates a listing of ports on a system. -Avoiding the most common Misconfigurations of the Client Driver +Avoiding Common Client Driver Misconfiguration -So - printing works, but there are still problems. Most jobs print -well, some don't print at all. Some jobs have problems with fonts, -which don't look good at all. Some jobs print fast, and some are -dead-slow. We can't cover it all; but we want to encourage you to read -the little paragraph about "Avoiding the wrong PostScript Driver -Settings" in the CUPS Printing part of this document. +So now the printing works, but there are still problems. Most jobs print well, some do not print at +all. Some jobs have problems with fonts, which do not look good. Some jobs print fast and some +are dead-slow. We cannot cover it all, but we want to encourage you to read the brief paragraph about +Avoiding the Wrong PostScript Driver Settings in the CUPS Printing part of this document. @@ -3005,27 +2747,22 @@ Settings" in the CUPS Printing part of this document. The Imprints Toolset -The Imprints tool set provides a UNIX equivalent of the -Windows NT Add Printer Wizard. For complete information, please -refer to the Imprints web site -at http://imprints.sourceforge.net/ -as well as the documentation included with the imprints source -distribution. This section will only provide a brief introduction -to the features of Imprints. +The Imprints tool set provides a UNIX equivalent of the Windows NT Add Printer +Wizard. For complete information, please refer to the Imprints Web site at http://imprints.sourceforge.net/ as well as the documentation +included with the imprints source distribution. This section only provides a brief introduction to +the features of Imprints. -Attention! Maintainer required - -Unfortunately, the Imprints toolset is no longer maintained. As of -December, 2000, the project is in need of a new maintainer. The most -important skill to have is decent perl coding and an interest in -MS-RPC based printing using Samba. If you wish to volunteer, please -coordinate your efforts on the samba-technical mailing list. The -toolset is still in usable form; but only for a series of older -printer models, where there are prepared packages to use. Packages for -more up to date print devices are needed if Imprints should have a -future. +Unfortunately, the Imprints toolset is no longer maintained. As of December 2000, the project is in +need of a new maintainer. The most important skill to have is Perl coding and an interest in MS-RPC-based +printing used in Samba. If you wish to volunteer, please coordinate +your efforts on the Samba technical +mailing list. The toolset is still in usable form, but only for a series of older printer models where +there are prepared packages to use. Packages for more up-to-date print devices are needed if Imprints +should have a future. + What is Imprints? @@ -3035,16 +2772,18 @@ Imprints is a collection of tools for supporting these goals: -Providing a central repository information regarding -Windows NT and 95/98 printer driver packages + + Providing a central repository of information regarding Windows NT and 95/98 printer driver packages. + -Providing the tools necessary for creating the -Imprints printer driver packages. + + Providing the tools necessary for creating the Imprints printer driver packages. + -Providing an installation client which will obtain -printer drivers from a central internet (or intranet) Imprints Server -repository and install them on remote Samba and Windows NT4 print -servers. + + Providing an installation client that will obtain printer drivers from a central Internet (or intranet) Imprints Server + repository and install them on remote Samba and Windows NT4 print servers. + @@ -3052,11 +2791,10 @@ servers. Creating Printer Driver Packages -The process of creating printer driver packages is beyond the scope of -this document (refer to Imprints.txt also included with the Samba -distribution for more information). In short, an Imprints driver -package is a gzipped tarball containing the driver files, related INF -files, and a control file needed by the installation client. +The process of creating printer driver packages is beyond the scope of this document (refer to Imprints.txt +also included with the Samba distribution for more information). In short, an Imprints driver package +is a gzipped tarball containing the driver files, related INF files, and a control file needed by the +installation client. @@ -3064,13 +2802,12 @@ files, and a control file needed by the installation client. The Imprints Server -The Imprints server is really a database server that may be queried -via standard HTTP mechanisms. Each printer entry in the database has -an associated URL for the actual downloading of the package. Each +The Imprints server is really a database server that may be queried via standard HTTP mechanisms. Each +printer entry in the database has an associated URL for the actual downloading of the package. Each package is digitally signed via GnuPG which can be used to verify that -package downloaded is actually the one referred in the Imprints -database. It is strongly recommended that this security check -not be disabled. +the package downloaded is actually +the one referred in the Imprints database. It is strongly recommended that this security check +not be disabled. @@ -3078,59 +2815,49 @@ database. It is strongly recommended that this security check The Installation Client -More information regarding the Imprints installation client is -available in the Imprints-Client-HOWTO.ps file -included with the imprints source package. +More information regarding the Imprints installation client is available from the the documentation file +Imprints-Client-HOWTO.ps that is included with the Imprints source package. The Imprints +installation client comes in two forms: - -The Imprints installation client comes in two forms. - -a set of command line Perl scripts - -a GTK+ based graphical interface to the command line Perl -scripts + A set of command line Perl scripts. + A GTK+ based graphical interface to the command line Perl scripts. -The installation client (in both forms) provides a means of querying -the Imprints database server for a matching list of known printer -model names as well as a means to download and install the drivers on +The installation client (in both forms) provides a means of querying the Imprints database server for +a matching list of known printer model names as well as a means to download and install the drivers on remote Samba and Windows NT print servers. -The basic installation process is in four steps and perl code is -wrapped around smbclient and rpcclient +The basic installation process is in four steps and Perl code is wrapped around smbclient and rpcclient. - foreach (supported architecture for a given driver) + For each supported architecture for a given driver: - rpcclient: Get the appropriate upload directory on the remote server - smbclient: Upload the driver files - rpcclient: Issues an AddPrinterDriver() MS-RPC + rpcclient: Get the appropriate upload directory on the remote server. + smbclient: Upload the driver files. + rpcclient: Issues an AddPrinterDriver() MS-RPC. - rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer + rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer. -One of the problems encountered when implementing the Imprints tool -set was the name space issues between various supported client -architectures. For example, Windows NT includes a driver named "Apple -LaserWriter II NTX v51.8" and Windows 95 calls its version of this -driver "Apple LaserWriter II NTX" +One of the problems encountered when implementing the Imprints tool set was the name space issues between +various supported client architectures. For example, Windows NT includes a driver named Apple LaserWriter +II NTX v51.8 and Windows 95 calls its version of this driver Apple LaserWriter II NTX. -The problem is how to know what client drivers have been uploaded for -a printer. An astute reader will remember that the Windows NT Printer -Properties dialog only includes space for one printer driver name. A -quick look in the Windows NT 4.0 system registry at +The problem is how to know what client drivers have been uploaded for a printer. An astute reader will +remember that the Windows NT Printer Properties dialog only includes space for one printer driver name. A +quick look in the Windows NT 4.0 system registry at: @@ -3138,56 +2865,46 @@ quick look in the Windows NT 4.0 system registry at -will reveal that Windows NT always uses the NT driver name. This is -ok as Windows NT always requires that at least the Windows NT version -of the printer driver is present. However, Samba does not have the -requirement internally. Therefore, how can you use the NT driver name -if is has not already been installed? +will reveal that Windows NT always uses the NT driver name. This is okay as Windows NT always requires +that at least the Windows NT version of the printer driver is present. Samba does not have the +requirement internally, therefore, How can you use the NT driver name if it has not already been installed? -The way of sidestepping this limitation is to require that all -Imprints printer driver packages include both the Intel Windows NT and -95/98 printer drivers and that NT driver is installed first. +The way of sidestepping this limitation is to require that all Imprints printer driver packages include both the Intel Windows NT and +95/98 printer drivers and that the NT driver is installed first. -Add Network Printers at Logon without User Interaction +Adding Network Printers without User Interaction -The following MS Knowledge Base article may be of some help if you -need to handle Windows 2000 clients: How to Add Printers -with No User Interaction in Windows 2000. ( http://support.microsoft.com/default.aspx?scid=kb;en-us;189105 -). It also applies to Windows XP Professional clients. - - - -The ideas sketched out below are inspired by this article. It -describes a commandline method which can be applied to install -network and local printers and their drivers. This is most useful -if integrated in Logon Scripts. You can see what options are -available by typing in a command prompt ("DOS box") this: +The following MS Knowledge Base article may be of some help if you need to handle Windows 2000 +clients: How to Add Printers with No User Interaction in Windows 2000, (http://support.microsoft.com/default.aspx?scid=kb;en-us;189105). +It also applies to Windows XP Professional clients. +The ideas sketched out in this section are inspired by this article, which describes a commandline method that can be +applied to install network and local printers and their drivers. This is most useful if integrated in Logon +Scripts. You can see what options are available by typing in the command prompt (DOS box): rundll32 printui.dll,PrintUIEntry /? -A window pops up which shows you all of the commandline switches -available. An extensive list of examples is also provided. This is -only for Win 2k/XP. It doesn't work on WinNT. WinNT has probably some -other tools in the respective Resource Kit. Here is a suggestion about -what a client logon script might contain, with a short explanation of -what the lines actually do (it works if 2k/XP Windows clients access -printers via Samba, but works for Windows-based print servers too): +A window pops up that shows you all of the commandline switches available. An extensive list of examples +is also provided. This is only for Win 200x/XP, it does not work on +Windows NT. Windows NT probably has +some other tools in the respective Resource Kit. Here is a suggestion about what a client logon script +might contain, with a short explanation of what the lines actually do (it works if 200x/XP Windows +clients access printers via Samba, and works for Windows-based print servers too): -rundll32 printui.dll,PrintUIEntry /dn /n "\\sambacupsserver\infotec2105-IPDS" /q -rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\infotec2105-PS" -rundll32 printui.dll,PrintUIEntry /y /n "\\sambacupsserver\infotec2105-PS" +rundll32 printui.dll,PrintUIEntry /dn /n "\\cupsserver\infotec2105-IPDS" /q +rundll32 printui.dll,PrintUIEntry /in /n "\\cupsserver\infotec2105-PS" +rundll32 printui.dll,PrintUIEntry /y /n "\\cupsserver\infotec2105-PS" @@ -3195,66 +2912,62 @@ Here is a list of the used commandline parameters: -/dn -deletes a network printer - -/q -quiet modus - -/n -names a printer - -/in -adds a network printer connection - -/y -sets printer as default printer - + /dn + deletes a network printer + + /q + quiet modus + + /n + names a printer + + /in + adds a network printer connection + + /y + sets printer as default printer + -Line 1 deletes a possibly existing previous network -printer infotec2105-IPDS (which had used native -Windows drivers with LPRng that were removed from the server which was -converted to CUPS). The /q at the end eliminates -"Confirm" or error dialog boxes popping up. They should not be -presented to the user logging on. - -Line 2 adds the new printer -infotec2105-PS (which actually is same physical -device but is now run by the new CUPS printing system and associated -with the CUPS/Adobe PS drivers). The printer and its driver -must have been added to Samba prior to the user -logging in (e.g. by a procedure as discussed earlier in this chapter, -or by running cupsaddsmb). The driver is now -auto-downloaded to the client PC where the user is about to log -in. - -Line 3 sets the default printer to this new network -printer (there might be several other printers installed with this -same method and some may be local as well -- so we decide for a -default printer). The default printer selection may of course be -different for different users. + + Line 1 deletes a possibly existing previous network printer infotec2105-IPDS + (which had used native Windows drivers with LPRng that were removed from the server that was + converted to CUPS). The /q at the end eliminates Confirm + or error dialog boxes from popping up. They should not be presented to the user logging on. + + + + Line 2 adds the new printer + infotec2105-PS (which actually is the same + physical device but is now run by the new CUPS printing system and associated with the + CUPS/Adobe PS drivers). The printer and its driver must have been added to Samba prior to + the user logging in (e.g., by a procedure as discussed earlier in this chapter, or by running + cupsaddsmb). The driver is now auto-downloaded to the client PC where the + user is about to log in. + + + + Line 3 sets the default printer to this new network printer (there might be several other + printers installed with this same method and some may be local as well, so we decide for a + default printer). The default printer selection may, of course, be different for different users. + -Note that the second line only works if the printer -infotec2105-PS has an already working print queue -on "sambacupsserver", and if the printer drivers have successfully been -uploaded (via APW , -smbclient/rpcclient or -cupsaddsmb) into the -[print$] driver repository of Samba. Also, some -Samba versions prior to version 3.0 required a re-start of smbd after -the printer install and the driver upload, otherwise the script (or -any other client driver download) would fail. +The second line only works if the printer infotec2105-PS has an already working +print queue on the cupsserver, and if the +printer drivers have been successfully uploaded +(via the APW, smbclient/rpcclient, or cupsaddsmb) +into the [print$] driver repository of Samba. Some Samba versions +prior to version 3.0 required a re-start of smbd after the printer install and the driver upload, +otherwise the script (or any other client driver download) would fail. -Since there no easy way to test for the existence of an installed -network printer from the logon script, the suggestion is: don't bother -checking and just allow the deinstallation/reinstallation to occur -every time a user logs in; it's really quick anyway (1 to 2 seconds). +Since there no easy way to test for the existence of an installed network printer from the logon script, +do not bother checking, just allow the deinstallation/reinstallation to occur every time a user logs in; +it's really quick anyway (1 to 2 seconds). @@ -3262,96 +2975,91 @@ The additional benefits for this are: -It puts in place any printer default setup changes -automatically at every user logon. + + It puts in place any printer default setup changes automatically at every user logon. + -It allows for "roaming" users' login into the domain from -different workstations. + + It allows for roaming users' login into the domain from different workstations. + -Since network printers are installed per user this much simplifies the -process of keeping the installation up-to-date. The extra few seconds -at logon time will not really be noticeable. Printers can be centrally -added, changed, and deleted at will on the server with no user -intervention required on the clients (you just need to keep the logon -scripts up to date). +Since network printers are installed per user, this much simplifies the process of keeping the installation +up-to-date. The few extra seconds at logon time will not really be noticeable. Printers can be centrally +added, changed and deleted at will on the server with no user intervention required from the clients +(you just need to keep the logon scripts up-to-date). -The <command>addprinter</command> command +The <command>addprinter</command> Command -The addprinter command can be configured to be a -shell script or program executed by Samba. It is triggered by running -the APW from a client against the Samba print server. The APW asks the -user to fill in several fields (such as printer name, driver to be -used, comment, port monitor, etc.). These parameters are passed on to -Samba by the APW. If the addprinter command is designed in a way that -it can create a new printer (through writing correct printcap entries -on legacy systems, or execute the lpadmin command -on more modern systems) and create the associated share in -, then the APW will in effect really -create a new printer on Samba and the UNIX print subsystem! +The addprinter command can be configured to be a shell script or program executed by +Samba. It is triggered by running the APW from a client against the Samba print server. The APW asks +the user to fill in several fields (such as printer name, driver to be used, comment, port monitor, +and so on). These parameters are passed on to Samba by the APW. If the addprinter command is designed in a +way that it can create a new printer (through writing correct printcap entries on legacy systems, or +execute the lpadmin command on more modern systems) and create the associated share +in, then the APW will in effect really create a new printer on Samba and the UNIX print subsystem! -Migration of "Classical" printing to Samba +Migration of Classical Printing to Samba -The basic "NT-style" printer driver management has not changed -considerably in 3.0 over the 2.2.x releases (apart from many small -improvements). Here migration should be quite easy, especially if you -followed previous advice to stop using deprecated parameters in your -setup. For migrations from an existing 2.0.x setup, or if you -continued "Win9x-style" printing in your Samba 2.2 installations, it -is more of an effort. Please read the appropriate release notes and -the HOWTO Collection for 2.2. You can follow several paths. Here are -possible scenarios for migration: +The basic NT-style printer driver management has not changed considerably in 3.0 over the 2.2.x releases +(apart from many small improvements). Here migration should be quite easy, especially if you followed +previous advice to stop using deprecated parameters in your setup. For migrations from an existing 2.0.x +setup, or if you continued Windows 9x/Me-style printing in your Samba 2.2 installations, it is more of +an effort. Please read the appropriate release notes and the HOWTO Collection for Samba-2.2.x. You can +follow several paths. Here are possible scenarios for migration: -You need to study and apply the new Windows NT printer -and driver support. Previously used parameters printer -driver file, printer driver and -printer driver location are no longer -supported. - -If you want to take advantage of WinNT printer driver -support you also need to migrate the Win9x/ME drivers to the new -setup. - -An existing printers.def file - (the one specified in the now removed parameter printer driver file) will work no longer with samba 3. In -3.0, smbd attempts to locate a Win9x/ME driver files for the printer -in [print$] and additional settings in the TDB -and only there; if it fails it will not (as 2.2.x -used to do) drop down to using a printers.def -(and all associated parameters). The make_printerdef tool is removed -and there is no backwards compatibility for this. - -You need to install a Windows 9x driver into the -[print$] share for a printer on your Samba -host. The driver files will be stored in the "WIN40/0" subdirectory of -[print$], and some other settings and info go -into the printing-related TDBs. + + You need to study and apply the new Windows NT printer and driver support. Previously used + parameters printer driver file, printer driver + and printer driver location are no longer supported. + -If you want to migrate an existing -printers.def file into the new setup, the current -only solution is to use the Windows NT APW to install the NT drivers -and the 9x drivers. This can be scripted using smbclient and -rpcclient. See the Imprints installation client at: - + + If you want to take advantage of Windows NT printer driver support, you also need to migrate the + Windows 9x/Me drivers to the new setup. + - - http://imprints.sourceforge.net/ - + + An existing printers.def file (the one specified in the now removed parameter + printer driver file) will no longer work with Samba-3. In 3.0, smbd attempts + to locate a Windows 9x/Me driver files for the printer in [print$] + and additional settings in the TDB and only there; if it fails, it will not + (as 2.2.x used to do) drop down to using a printers.def (and all associated + parameters). The make_printerdef tool is removed and there is no backward compatibility for this. + - -for an example. See also the discussion of rpcclient usage in the -"CUPS Printing" section. + You need to install a Windows 9x/Me driver into the + [print$] share for a printer on your Samba + host. The driver files will be stored in the WIN40/0 subdirectory of + [print$], and some other settings and information go + into the printing-related TDBs. + + If you want to migrate an existing + printers.def file into the new setup, the + only current + solution is to use the Windows NT APW to install the NT drivers + and the 9x/Me drivers. This can be scripted using smbclient and + rpcclient. See the Imprints installation client at: + + + + http://imprints.sourceforge.net/ + + + + for an example. See also the discussion of rpcclient usage in the + CUPS Printing section. @@ -3359,7 +3067,8 @@ for an example. See also the discussion of rpcclient usage in the Publishing Printer Information in Active Directory or LDAP -We will publish an update to this section shortly. +This will be addressed in a later update of this document. If you wish to volunteer your services to help +document this, please contact John H Terpstra. @@ -3367,26 +3076,30 @@ We will publish an update to this section shortly. Common Errors -I give my root password but I don't get access +I Give My Root Password but I Do Not Get Access -Don't confuse the root password which is valid for the UNIX system -(and in most cases stored in the form of a one-way hash in a file -named /etc/shadow) with the password used to -authenticate against Samba!. Samba doesn't know the UNIX password; for -root to access Samba resources via Samba-type access, a Samba account -for root must be created first. This is often done with the -smbpasswd command. +Do not confuse the root password which is valid for the UNIX system (and in most cases stored in the +form of a one-way hash in a file named /etc/shadow), with the password used to +authenticate against Samba. Samba does not know the UNIX password. Root access to Samba resources +requires that a Samba account for root must first be created. This is done with the smbpasswd +command as follows: + + +&rootprompt; smbpasswd -a root +New SMB password: secret +Retype new SMB password: secret + + -My printjobs get spooled into the spooling directory, but then get lost +My Print Jobs Get Spooled into the Spooling Directory, but Then Get Lost -Don't use the existing UNIX print system spool directory for the Samba -spool directory. It may seem convenient and a saving of space, but it -only leads to problems. The two must be separate. +Do not use the existing UNIX print system spool directory for the Samba spool directory. It may seem +convenient and a savings of space, but it only leads to problems. The two must be separate. diff --git a/docs/docbook/projdoc/securing-samba.xml b/docs/docbook/projdoc/securing-samba.xml index d59b0f381e..52e07f2206 100644 --- a/docs/docbook/projdoc/securing-samba.xml +++ b/docs/docbook/projdoc/securing-samba.xml @@ -12,18 +12,20 @@ Introduction This note was attached to the Samba 2.2.8 release notes as it contained an -important security fix. The information contained here applies to Samba +important security fix. The information contained here applies to Samba installations in general. +
    -A new apprentice reported for duty to the Chief Engineer of a boiler house. He said, "Here I am, -if you will show me the boiler I'll start working on it." Then engineer replied, "You're leaning -on it!" +A new apprentice reported for duty to the chief engineer of a boiler house. He said, Here I am, +if you will show me the boiler I'll start working on it. Then engineer replied, You're leaning +on it! +
    -Security concerns are just like that: You need to know a little about the subject to appreciate +Security concerns are just like that. You need to know a little about the subject to appreciate how obvious most of it really is. The challenge for most of us is to discover that first morsel of knowledge with which we may unlock the secrets of the masters. @@ -34,9 +36,9 @@ of knowledge with which we may unlock the secrets of the masters. Features and Benefits -There are three level at which security principals must be observed in order to render a site -at least moderately secure. These are: the perimeter firewall, the configuration of the host -server that is running Samba, and Samba itself. +There are three levels at which security principals must be observed in order to render a site +at least moderately secure. They are the perimeter firewall, the configuration of the host +server that is running Samba and Samba itself. @@ -46,18 +48,17 @@ the latest protocols to permit more secure MS Windows file and print operations. Samba may be secured from connections that originate from outside the local network. This may be -done using host based protection (using samba's implementation of a technology -known as "tcpwrappers", or it may be done be using interface based exclusion -so that &smbd; will bind only to specifically permitted interfaces. It is also -possible to set specific share or resource based exclusions, eg: on the [IPC$] +done using host-based protection (using samba's implementation of a technology +known as tcpwrappers, or it may be done be using interface-based exclusion +so &smbd; will bind only to specifically permitted interfaces. It is also +possible to set specific share or resource-based exclusions, for example on the [IPC$] auto-share. The [IPC$] share is used for browsing purposes as well as to establish TCP/IP connections. -Another method by which Samba may be secured is by way of setting Access Control Entries in an Access -Control List on the shares themselves. This is discussed in the chapter on File, Directory and Share Access -Control. +Another method by which Samba may be secured is by setting Access Control Entries (ACEs) in an Access +Control List (ACL) on the shares themselves. This is discussed in . @@ -74,11 +75,11 @@ before someone will find yet another vulnerability. - Using host based protection + Using Host-Based Protection - In many installations of Samba the greatest threat comes for outside - your immediate network. By default Samba will accept connections from + In many installations of Samba, the greatest threat comes from outside + your immediate network. By default, Samba will accept connections from any host, which means that if you run an insecure version of Samba on a host that is directly connected to the Internet you can be especially vulnerable. @@ -87,8 +88,7 @@ before someone will find yet another vulnerability. One of the simplest fixes in this case is to use the hosts allow and hosts deny options in the Samba &smb.conf; configuration file to only - allow access to your server from a specific range of hosts. An example - might be: + allow access to your server from a specific range of hosts. An example might be: @@ -97,20 +97,19 @@ before someone will find yet another vulnerability. - The above will only allow SMB connections from 'localhost' (your own - computer) and from the two private networks 192.168.2 and - 192.168.3. All other connections will be refused as soon - as the client sends its first packet. The refusal will be marked as a - not listening on called name error. + The above will only allow SMB connections from localhost (your own + computer) and from the two private networks 192.168.2 and 192.168.3. All other + connections will be refused as soon as the client sends its first packet. The refusal + will be marked as not listening on called name error. - User based protection + User-Based Protection - If you want to restrict access to your server to valid users only then the following + If you want to restrict access to your server to valid users only, then the following method may be of use. In the &smb.conf; [global] section put: @@ -119,7 +118,7 @@ before someone will find yet another vulnerability. - What this does is, it restricts all server access to either the user jacko + This restricts all server access to either the user jacko or to members of the system group smbusers. @@ -127,17 +126,17 @@ before someone will find yet another vulnerability. - Using interface protection + Using Interface Protection - By default Samba will accept connections on any network interface that + By default, Samba will accept connections on any network interface that it finds on your system. That means if you have a ISDN line or a PPP connection to the Internet then Samba will accept connections on those links. This may not be what you want. - You can change this behaviour using options like the following: + You can change this behavior using options like this: @@ -147,35 +146,35 @@ before someone will find yet another vulnerability. This tells Samba to only listen for connections on interfaces with a - name starting with 'eth' such as eth0, eth1, plus on the loopback - interface called 'lo'. The name you will need to use depends on what - OS you are using, in the above I used the common name for Ethernet + name starting with eth such as eth0, eth1 plus on the loopback + interface called lo. The name you will need to use depends on what + OS you are using. In the above, I used the common name for Ethernet adapters on Linux. - If you use the above and someone tries to make a SMB connection to - your host over a PPP interface called 'ppp0' then they will get a TCP - connection refused reply. In that case no Samba code is run at all as + If you use the above and someone tries to make an SMB connection to + your host over a PPP interface called ppp0, then they will get a TCP + connection refused reply. In that case, no Samba code is run at all as the operating system has been told not to pass connections from that - interface to any samba process. + interface to any Samba process. - Using a firewall + Using a Firewall - Many people use a firewall to deny access to services that they don't - want exposed outside their network. This can be a very good idea, - although I would recommend using it in conjunction with the above - methods so that you are protected even if your firewall is not active + Many people use a firewall to deny access to services they do not + want exposed outside their network. This can be a good idea, + although I recommend using it in conjunction with the above + methods so you are protected even if your firewall is not active for some reason. - If you are setting up a firewall then you need to know what TCP and + If you are setting up a firewall, you need to know what TCP and UDP ports to allow and block. Samba uses the following: @@ -195,7 +194,7 @@ before someone will find yet another vulnerability. - Using a IPC$ share deny + Using IPC$ Share-Based Denials If the above methods are not suitable, then you could also place a @@ -206,34 +205,29 @@ before someone will find yet another vulnerability. - To do that you could use: + To do this you could use: -[ipc$] +[IPC$] hosts allow192.168.115.0/24 127.0.0.1 hosts deny0.0.0.0/0 - this would tell Samba that IPC$ connections are not allowed from - anywhere but the two listed places (localhost and a local - subnet). Connections to other shares would still be allowed. As the - IPC$ share is the only share that is always accessible anonymously + This instructs Samba that IPC$ connections are not allowed from + anywhere except from the two listed network addresses (localhost and the 192.168.115 + subnet). Connections to other shares are still allowed. As the + IPC$ share is the only share that is always accessible anonymously, this provides some level of protection against attackers that do not - know a username/password for your host. + know a valid username/password for your host. - If you use this method then clients will be given a access denied - reply when they try to access the IPC$ share. That means that those - clients will not be able to browse shares, and may also be unable to - access some other resources. - - - - This is not recommended unless you cannot use one of the other - methods listed above for some reason. + If you use this method, then clients will be given an `access denied' + reply when they try to access the IPC$ share. Those clients will not be able to + browse shares, and may also be unable to access some other resources. This is not + recommended unless you cannot use one of the other methods listed above for some reason. @@ -242,7 +236,7 @@ before someone will find yet another vulnerability. NTLMv2 Security - To configure NTLMv2 authentication the following registry keys are worth knowing about: + To configure NTLMv2 authentication, the following registry keys are worth knowing about: @@ -253,9 +247,9 @@ before someone will find yet another vulnerability. - 0x3 - Send NTLMv2 response only. Clients will use NTLMv2 authentication, - use NTLMv2 session security if the server supports it. Domain - controllers accept LM, NTLM and NTLMv2 authentication. + The value 0x00000003 means send NTLMv2 response only. Clients will use NTLMv2 authentication, + use NTLMv2 session security if the server supports it. Domain Controllers accept LM, + NTLM and NTLMv2 authentication. @@ -266,9 +260,9 @@ before someone will find yet another vulnerability. - 0x80000 - NTLMv2 session security. If either NtlmMinClientSec or - NtlmMinServerSec is set to 0x80000, the connection will fail if NTLMv2 - session security is not negotiated. + The value 0x00080000 means permit only NTLMv2 session security. If either NtlmMinClientSec or + NtlmMinServerSec is set to 0x00080000, the connection will fail if NTLMv2 + session security is not negotiated. @@ -278,7 +272,7 @@ before someone will find yet another vulnerability. Please check regularly on http://www.samba.org/ for updates and -important announcements. Occasionally security releases are made and +important announcements. Occasionally security releases are made and it is highly recommended to upgrade Samba when a security vulnerability is discovered. Check with your OS vendor for OS specific upgrades. @@ -289,81 +283,75 @@ is discovered. Check with your OS vendor for OS specific upgrades. Common Errors -If all of samba and host platform configuration were really as intuitive as one might like then this +If all of Samba and host platform configuration were really as intuitive as one might like them to be, this section would not be necessary. Security issues are often vexing for a support person to resolve, not -because of the complexity of the problem, but for reason that most administrators who post what turns +because of the complexity of the problem, but for the reason that most administrators who post what turns out to be a security problem request are totally convinced that the problem is with Samba. - Smbclient works on localhost, but the network is dead + Smbclient Works on Localhost, but the Network Is Dead - This is a very common problem. Red Hat Linux (as do others) will install a default firewall. - With the default firewall in place only traffic on the loopback adapter (IP address 127.0.0.1) - will be allowed through the firewall. + This is a common problem. Red Hat Linux (and others) installs a default firewall. + With the default firewall in place, only traffic on the loopback adapter (IP address 127.0.0.1) + is allowed through the firewall. - The solution is either to remove the firewall (stop it) or to modify the firewall script to + The solution is either to remove the firewall (stop it) or modify the firewall script to allow SMB networking traffic through. See section above in this chapter. - Why can users access home directories of other users? + Why Can Users Access Home Directories of Other Users? We are unable to keep individual users from mapping to any other user's home directory once they have supplied a valid password! They only need - to enter their own password. I have not found *any* method that I can - use to configure samba to enforce that only a user may map their own - home directory. + to enter their own password. I have not found any method to configure + Samba so that users may map only their own home directory. User xyzzy can map his home directory. Once mapped user xyzzy can also map - *anyone* else's home directory! + anyone else's home directory. - This is not a security flaw, it is by design. Samba allows - users to have *exactly* the same access to the UNIX filesystem - as they would if they were logged onto the UNIX box, except - that it only allows such views onto the file system as are - allowed by the defined shares. + This is not a security flaw, it is by design. Samba allows users to have + exactly the same access to the UNIX file system as when they were logged + onto the UNIX box, except that it only allows such views onto the file + system as are allowed by the defined shares. - This means that if your UNIX home directories are set up - such that one user can happily cd into another users - directory and do an ls, the UNIX security solution is to - change the UNIX file permissions on the users home directories - such that the cd and ls would be denied. + If your UNIX home directories are set up so that one user can happily cd + into another users directory and execute ls, the UNIX security solution is to change file + permissions on the user's home directories such that the cd and ls are denied. - Samba tries very hard not to second guess the UNIX administrators - security policies, and trusts the UNIX admin to set - the policies and permissions he or she desires. + Samba tries very hard not to second guess the UNIX administrators security policies, and + trusts the UNIX admin to set the policies and permissions he or she desires. - Samba does allow the setup you require when you have set the - only useryes option on the share, is that you have not set the - valid users list for the share. + Samba allows the behavior you require. Simply put the only user%S + option in the [homes] share definition. - Note that only user works in conjunction with the users= list, + The only user works in conjunction with the userslist, so to get the behavior you require, add the line : users%S - this is equivalent to: + this is equivalent to adding valid users%S diff --git a/docs/docbook/projdoc/unicode.xml b/docs/docbook/projdoc/unicode.xml index 28d6f76cdf..699f29f1ba 100644 --- a/docs/docbook/projdoc/unicode.xml +++ b/docs/docbook/projdoc/unicode.xml @@ -1,6 +1,7 @@ &author.jelmer; + &author.jht; TAKAHASHIMotonobu @@ -25,62 +26,65 @@ origin. Of all the effort that has been brought to bear on providing native language support -for all computer users, the efforts of the Openi18n organisation is deserving of +for all computer users, the efforts of the Openi18n organization is deserving of special mention. Samba-2.x supported a single locale through a mechanism called codepages. Samba-3 is destined to become a truly trans-global -file and printer sharing platform. +file and printer-sharing platform. -What are charsets and unicode? +What Are Charsets and Unicode? Computers communicate in numbers. In texts, each number will be translated to a corresponding letter. The meaning that will be assigned -to a certain number depends on the character set(charset) +to a certain number depends on the character set (charset) that is used. + + + A charset can be seen as a table that is used to translate numbers to letters. Not all computers use the same charset (there are charsets -with German umlauts, Japanese characters, etc). Usually a charset contains +with German umlauts, Japanese characters, and so on). Usually a charset contains 256 characters, which means that storing a character with it takes exactly one byte. There are also charsets that support even more characters, -but those need twice(or even more) as much storage space. These +but those need twice as much storage space (or more). These charsets can contain 256 * 256 = 65536 characters, which -is more then all possible characters one could think of. They are called -multibyte charsets (because they use more then one byte to -store one character). +is more than all possible characters one could think of. They are called +multibyte charsets because they use more then one byte to +store one character. - A standardised multibyte charset is unicode. +A standardized multibyte charset is unicode. A big advantage of using a multibyte charset is that you only need one; there is no need to make sure two computers use the same charset when they are communicating. -Old windows clients use single-byte charsets, named -'codepages' by Microsoft. However, there is no support for -negotiating the charset to be used in the smb protocol. Thus, you +Old Windows clients use single-byte charsets, named +codepages, by Microsoft. However, there is no support for +negotiating the charset to be used in the SMB/CIFS protocol. Thus, you have to make sure you are using the same charset when talking to an older client. -Newer clients (Windows NT, 2K, XP) talk unicode over the wire. +Newer clients (Windows NT, 200x, XP) talk unicode over the wire. -Samba and charsets +Samba and Charsets -As of samba 3.0, samba can (and will) talk unicode over the wire. Internally, -samba knows of three kinds of character sets: +As of Samba-3.0, Samba can (and will) talk unicode over the wire. Internally, +Samba knows of three kinds of character sets: @@ -89,21 +93,21 @@ samba knows of three kinds of character sets: This is the charset used internally by your operating system. The default is UTF-8, which is fine for most - systems. The default in previous samba releases was ASCII. + systems, which covers all characters in all languages. The default in previous Samba releases was ASCII.     display charset - This is the charset samba will use to print messages - on your screen. It should generally be the same as the unix charset. + This is the charset Samba will use to print messages + on your screen. It should generally be the same as the unix charset. dos charset - This is the charset samba uses when communicating with - DOS and Windows 9x clients. It will talk unicode to all newer clients. + This is the charset Samba uses when communicating with + DOS and Windows 9x/Me clients. It will talk unicode to all newer clients. The default depends on the charsets you have installed on your system. Run testparm -v | grep "dos charset" to see what the default is on your system. @@ -114,42 +118,38 @@ samba knows of three kinds of character sets: -Conversion from old names +Conversion from Old Names -Because previous samba versions did not do any charset conversion, -characters in filenames are usually not correct in the unix charset but only +Because previous Samba versions did not do any charset conversion, +characters in filenames are usually not correct in the UNIX charset but only for the local charset used by the DOS/Windows clients. -Bjoern Jacke has written a utility named convm that can convert whole directory - structures to different charsets with one single command. - - -Japanese charsets +Japanese Charsets -Samba doesn't work correctly with Japanese charsets yet. Here are +Samba does not work correctly with Japanese charsets yet. Here are points of attention when setting it up: You should set mangling methodhash -There are various iconv() implementations around and not -all of them work equally well. glibc2's iconv() has a critical problem -in CP932. libiconv-1.8 works with CP932 but still has some problems and -does not work with EUC-JP. + There are various iconv() implementations around and not + all of them work equally well. glibc2's iconv() has a critical problem + in CP932. libiconv-1.8 works with CP932 but still has some problems and + does not work with EUC-JP. -You should set dos charsetCP932, not -Shift_JIS, SJIS... + You should set dos charsetCP932, not + Shift_JIS, SJIS. -Currently only unix charsetCP932 -will work (but still has some problems...) because of iconv() issues. -unix charsetEUC-JP doesn't work well because of -iconv() issues. + Currently only UNIX charsetCP932 + will work (but still has some problems...) because of iconv() issues. + UNIX charsetEUC-JP does not work well because of + iconv() issues. -Currently Samba 3.0 does not support unix charsetUTF8-MAC/CAP/HEX/JIS* + Currently Samba-3.0 does not support UNIX charsetUTF8-MAC/CAP/HEX/JIS*. @@ -158,16 +158,19 @@ iconv() issues. - Common errors + Common Errors - CP850.so can't be found + CP850.so Can't Be Found - Samba is complaining about a missing CP850.so file. + Samba is complaining about a missing CP850.so file. - CP850 is the default dos charset. The dos charset is used to convert data to the codepage used by your dos clients. If you don't have any dos clients, you can safely ignore this message. + Answer: CP850 is the default dos charset. + The dos charset is used to convert data to the codepage used by your dos clients. + If you do not have any dos clients, you can safely ignore this message. - CP850 should be supported by your local iconv implementation. Make sure you have all the required packages installed. If you compiled samba from source, make sure configure found iconv. + CP850 should be supported by your local iconv implementation. Make sure you have all the required packages installed. + If you compiled Samba from source, make sure to configure found iconv. diff --git a/docs/docbook/projdoc/upgrading-to-3.0.xml b/docs/docbook/projdoc/upgrading-to-3.0.xml index 74af0cbb9e..4461f0fdcb 100644 --- a/docs/docbook/projdoc/upgrading-to-3.0.xml +++ b/docs/docbook/projdoc/upgrading-to-3.0.xml @@ -8,83 +8,123 @@ Upgrading from Samba-2.x to Samba-3.0.0 + +This chapter deals exclusively with the differences between Samba-3.0.0 and Samba-2.2.8a. +It points out where configuration parameters have changed, and provides a simple guide for +the move from 2.2.x to 3.0.0. + + + +Quick Migration Guide + + +Samba-3.0.0 default behavior should be approximately the same as Samba-2.2.x. +The default behavior when the new parameter passdb backend +is not defined in the &smb.conf; file provides the same default behviour as Samba-2.2.x +with encrypt passwordsYes, and +will use the smbpasswd database. + + + +So why say that behavior should be approximately the same as Samba-2.2.x? Because +Samba-3.0.0 can negotiate new protocols, such as support for native Unicode, that may result in +differing protocol code paths being taken. The new behavior under such circumstances is not +exactly the same as the old one. The good news is that the domain and machine SIDs will be +preserved across the upgrade. + + + +If the Samba-2.2.x system was using an LDAP backend, and there is no time to update the LDAP +database, then make sure that passdb backendldapsam_compat +is specified in the &smb.conf; file. For the rest, behavior should remain more or less the same. +At a later date, when there is time to implement a new Samba-3 compatible LDAP backend, it is possible +to migrate the old LDAP database to the new one through use of the pdbedit. +See . + + + New Features in Samba-3 -Major new features: +The major new features are: - + - Active Directory support. This release is able to join a ADS realm + Active Directory support. This release is able to join an ADS realm as a member server and authenticate users using LDAP/kerberos. - Unicode support. Samba will now negotiate UNICODE on the wire and - internally there is now a much better infrastructure for multi-byte - and UNICODE character sets. + Unicode support. Samba will now negotiate unicode on the wire and + internally there is a much better infrastructure for multi-byte + and unicode character sets. New authentication system. The internal authentication system has been almost completely rewritten. Most of the changes are internal, - but the new auth system is also very configurable. + but the new authoring system is also very configurable. New filename mangling system. The filename mangling system has been completely rewritten. An internal database now stores mangling maps - persistently. This needs lots of testing. + persistently. - New "net" command. A new "net" command has been added. It is - somewhat similar to the "net" command in windows. Eventually we + New net command. A new net command has been added. It is + somewhat similar to the net command in Windows. Eventually, we plan to replace a bunch of other utilities (such as smbpasswd) - with subcommands in "net", at the moment only a few things are - implemented. + with subcommands in net. Samba now negotiates NT-style status32 codes on the wire. This - improves error handling a lot. + considerably improves error handling. - Better Windows 2000/XP/2003 printing support including publishing - printer attributes in active directory + Better Windows 200x/XP printing support including publishing + printer attributes in Active Directory. - New loadable RPC modules + New loadable RPC modules for passdb backends and character sets. - New dual-daemon winbindd support (-B) for better performance + New default dual-daemon winbindd support for better performance. Support for migrating from a Windows NT 4.0 domain to a Samba - domain and maintaining user, group and domain SIDs + domain and maintaining user, group and domain SIDs. Support for establishing trust relationships with Windows NT 4.0 - domain controllers + Domain Controllers. Initial support for a distributed Winbind architecture using - an LDAP directory for storing SID to uid/gid mappings + an LDAP directory for storing SID to UID/GID mappings. Major updates to the Samba documentation tree. + + + Full support for client and server SMB signing to ensure + compatibility with default Windows 2003 security settings. + + Plus lots of other improvements! @@ -95,15 +135,15 @@ Plus lots of other improvements! Configuration Parameter Changes -This section contains a brief listing of changes to smb.conf options -in the 3.0.0 release. Please refer to the smb.conf(5) man page for +This section contains a brief listing of changes to &smb.conf; options +in the 3.0.0 release. Please refer to the smb.conf(5) man page for complete descriptions of new or modified parameters. Removed Parameters -(order alphabetically): +(Ordered Alphabetically): admin log @@ -121,6 +161,7 @@ complete descriptions of new or modified parameters. printer driver file printer driver location status + stip dot total print jobs use rhosts valid chars @@ -132,16 +173,16 @@ complete descriptions of new or modified parameters. New Parameters -(new parameters have been grouped by function): +(New parameters have been grouped by function): -Remote management +Remote Management abort shutdown script shutdown script -User and Group Account Management +User and Group Account Management: add group script @@ -154,15 +195,14 @@ complete descriptions of new or modified parameters. set primary group script -Authentication +Authentication: auth methods - ads server realm -Protocol Options +Protocol Options: client lanman auth @@ -174,11 +214,12 @@ complete descriptions of new or modified parameters. ntlm auth paranoid server security server schannel + server signing smb ports use spnego -File Service +File Service: get quota command @@ -187,38 +228,42 @@ complete descriptions of new or modified parameters. hostname lookups kernel change notify mangle prefix + map acl inherit msdfs proxy set quota command use sendfile vfs objects -Printing +Printing: max reported print jobs -UNICODE and Character Sets +Unicode and Character Sets: display charset dos charset unicode - unix charset + UNIX charset -SID to uid/gid Mappings +SID to UID/GID Mappings: idmap backend idmap gid - idmap only idmap uid + winbind enable local accounts + winbind trusted domains only + template primary group + enable rid algorithm -LDAP +LDAP: ldap delete dn @@ -230,7 +275,7 @@ complete descriptions of new or modified parameters. ldap user suffix -General Configuration +General Configuration: preload modules @@ -240,19 +285,20 @@ complete descriptions of new or modified parameters. -Modified Parameters (changes in behavior): +Modified Parameters (Changes in Behavior): encrypt passwords (enabled by default) - mangling method (set to 'hash2' by default) + mangling method (set to hash2 by default) passwd chat passwd program + password server restrict anonymous (integer value) - security (new 'ads' value) + security (new ads value) strict locking (enabled by default) winbind cache time (increased to 5 minutes) - winbind uid (deprecated in favor of 'idmap uid') - winbind gid (deprecated in favor of 'idmap gid') + winbind uid (deprecated in favor of idmap uid) + winbind gid (deprecated in favor of idmap gid) @@ -267,17 +313,21 @@ complete descriptions of new or modified parameters. This section contains brief descriptions of any new databases - introduced in Samba 3.0. Please remember to backup your existing - ${lock directory}/*tdb before upgrading to Samba 3.0. Samba will + introduced in Samba-3. Please remember to backup your existing + ${lock directory}/*tdb before upgrading to Samba-3. Samba will upgrade databases as they are opened (if necessary), but downgrading from 3.0 to 2.2 is an unsupported path. + + The new tdb files are described in . + + - TDB File Descriptions +
    TDB File Descriptions - + @@ -299,12 +349,12 @@ complete descriptions of new or modified parameters. group_mapping - Mapping table from Windows groups/SID to unix groups + Mapping table from Windows groups/SID to UNIX groups yes idmap - new ID map table from SIDS to UNIX uids/gids + new ID map table from SIDS to UNIX UIDs/GIDs yes @@ -320,14 +370,14 @@ complete descriptions of new or modified parameters. printing/*.tdb - Cached output from 'lpq command' created on a per print + Cached output from `lpq command' created on a per print service basis no registry - Read-only samba registry skeleton that provides support for + Read-only Samba registry skeleton that provides support for exporting various db tables via the winreg RPCs no @@ -341,26 +391,26 @@ complete descriptions of new or modified parameters. Changes in Behavior - The following issues are known changes in behavior between Samba 2.2 and - Samba 3.0 that may affect certain installations of Samba. + The following issues are known changes in behavior between Samba-2.2 and + Samba-3 that may affect certain installations of Samba. - When operating as a member of a Windows domain, Samba 2.2 would - map any users authenticated by the remote DC to the 'guest account' - if a uid could not be obtained via the getpwnam() call. Samba 3.0 - rejects the connection as NT_STATUS_LOGON_FAILURE. There is no - current work around to re-establish the 2.2 behavior. + When operating as a member of a Windows domain, Samba-2.2 would + map any users authenticated by the remote DC to the guest account + if a uid could not be obtained via the getpwnam() call. Samba-3 + rejects the connection as NT_STATUS_LOGON_FAILURE. There is no + current work around to re-establish the Samba-2.2 behavior. - When adding machines to a Samba 2.2 controlled domain, the - 'add user script' was used to create the UNIX identity of the - machine trust account. Samba 3.0 introduces a new 'add machine - script' that must be specified for this purpose. Samba 3.0 will - not fall back to using the 'add user script' in the absence of - an 'add machine script' + When adding machines to a Samba-2.2 controlled domain, the + add user script was used to create the UNIX identity of the + Machine Trust Account. Samba-3 introduces a new add machine + script that must be specified for this purpose. Samba-3 will + not fall back to using the add user script in the absence of + an add machine script. @@ -371,8 +421,7 @@ complete descriptions of new or modified parameters. You might experience problems with special characters when communicating with old DOS - clients. Codepage support has changed in samba 3.0. Read the chapter - Unicode support for details. + clients. Codepage support has changed in Samba-3. Read , for details. @@ -382,52 +431,41 @@ complete descriptions of new or modified parameters. There have been a few new changes that Samba administrators should be - aware of when moving to Samba 3.0. + aware of when moving to Samba-3. Encrypted passwords have been enabled by default in order to - inter-operate better with out-of-the-box Windows client - installations. This does mean that either (a) a samba account - must be created for each user, or (b) 'encrypt passwords = no' - must be explicitly defined in smb.conf. + interoperate better with out-of-the-box Windows client + installations. This does mean that either (a) a Samba account + must be created for each user, or (b) encrypt passwords = no + must be explicitly defined in &smb.conf;. - Inclusion of new securityads option for integration - with an Active Directory domain using the native Windows - Kerberos 5 and LDAP protocols. + Inclusion of new securityads option for integration + with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols. - Samba 3.0 also includes the possibility of setting up chains + Samba-3 also includes the possibility of setting up chains of authentication methods (auth methods) and account storage backends (passdb backend). Please refer to the &smb.conf; - man page and the chapter about account information databases for details. While both parameters assume sane default + man page and , for details. While both parameters assume sane default values, it is likely that you will need to understand what the values actually mean in order to ensure Samba operates correctly. - Certain functions of the smbpasswd(8) tool have been split between the - new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8) - utility. See the respective man pages for details. - - - - - - Charsets - - - You might experience problems with special characters when communicating with old DOS - clients. Codepage support has changed in samba 3.0. Read the chapter - Unicode support for details. +pdbedit + Certain functions of the smbpasswd tool have been split between the + new smbpasswd utility, the net tool and the new pdbedit + utility. See the respective man pages for details. @@ -436,7 +474,7 @@ complete descriptions of new or modified parameters. LDAP - This section outlines the new features affecting Samba / LDAP integration. + This section outlines the new features effecting Samba/LDAP integration. @@ -444,14 +482,14 @@ complete descriptions of new or modified parameters. A new object class (sambaSamAccount) has been introduced to replace - the old sambaAccount. This change aids us in the renaming of attributes - to prevent clashes with attributes from other vendors. There is a - conversion script (examples/LDAP/convertSambaAccount) to modify and LDIF + the old sambaAccount. This change aids us in the renaming of attributes + to prevent clashes with attributes from other vendors. There is a + conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF file to the new schema. - Example: + Example: &prompt;ldapsearch .... -b "ou=people,dc=..." > old.ldif @@ -459,17 +497,20 @@ complete descriptions of new or modified parameters. - The <DOM SID> can be obtained by running 'net getlocalsid <DOMAINNAME> + The <DOM SID> can be obtained by running + +&prompt;net getlocalsid <DOMAINNAME> + on the Samba PDC as root. The old sambaAccount schema may still be used by specifying the - "ldapsam_compat" passdb backend. However, the sambaAccount and + ldapsam_compat passdb backend. However, the sambaAccount and associated attributes have been moved to the historical section of the schema file and must be uncommented before use if needed. - The 2.2 object class declaration for a sambaAccount has not changed - in the 3.0 samba.schema file. + The Samba-2.2 object class declaration for a sambaAccount has not changed + in the Samba-3 samba.schema file. @@ -478,29 +519,29 @@ complete descriptions of new or modified parameters. - sambaDomain - domain information used to allocate rids - for users and groups as necessary. The attributes are added - in 'ldap suffix' directory entry automatically if - an idmap uid/gid range has been set and the 'ldapsam' + sambaDomain &smbmdash; domain information used to allocate RIDs + for users and groups as necessary. The attributes are added + in ldap suffix directory entry automatically if + an idmap UID/GID range has been set and the ldapsam passdb backend has been selected. - sambaGroupMapping - an object representing the + sambaGroupMapping &smbmdash; an object representing the relationship between a posixGroup and a Windows - group/SID. These entries are stored in the 'ldap - group suffix' and managed by the 'net groupmap' command. + group/SID. These entries are stored in the ldap + group suffix and managed by the net groupmap command. - sambaUnixIdPool - created in the 'ldap idmap suffix' entry - automatically and contains the next available 'idmap uid' and - 'idmap gid' + sambaUNIXIdPool &smbmdash; created in the ldap idmap suffix entry + automatically and contains the next available idmap UID and + idmap GID. - sambaIdmapEntry - object storing a mapping between a - SID and a UNIX uid/gid. These objects are created by the + sambaIdmapEntry &smbmdash; object storing a mapping between a + SID and a UNIX UID/GID. These objects are created by the idmap_ldap module as needed. @@ -512,55 +553,54 @@ complete descriptions of new or modified parameters. The following new smb.conf parameters have been added to aid in directing - certain LDAP queries when 'passdb backend = ldapsam://...' has been + certain LDAP queries when passdb backend = ldapsam://... has been specified. - ldap suffix - used to search for user and computer accounts - ldap user suffix - used to store user accounts - ldap machine suffix - used to store machine trust accounts - ldap group suffix - location of posixGroup/sambaGroupMapping entries - ldap idmap suffix - location of sambaIdmapEntry objects + ldap suffix &smbmdash; used to search for user and computer accounts. + ldap user suffix &smbmdash; used to store user accounts. + ldap machine suffix &smbmdash; used to store Machine Trust Accounts. + ldap group suffix &smbmdash; location of posixGroup/sambaGroupMapping entries. + ldap idmap suffix &smbmdash; location of sambaIdmapEntry objects. - If an 'ldap suffix' is defined, it will be appended to all of the - remaining sub-suffix parameters. In this case, the order of the suffix - listings in smb.conf is important. Always place the 'ldap suffix' first + If an ldap suffix is defined, it will be appended to all of the + remaining sub-suffix parameters. In this case, the order of the suffix + listings in smb.conf is important. Always place the ldap suffix first in the list. - Due to a limitation in Samba's smb.conf parsing, you should not surround - the DN's with quotation marks. + Due to a limitation in Samba's &smb.conf; parsing, you should not surround + the DNs with quotation marks. - IdMap LDAP support + IdMap LDAP Support - Samba 3.0 supports an ldap backend for the idmap subsystem. The - following options would inform Samba that the idmap table should be - stored on the directory server onterose in the "ou=idmap,dc=plainjoe, - dc=org" partition. + Samba-3 supports an ldap backend for the idmap subsystem. The + following options inform Samba that the idmap table should be + stored on the directory server onterose in the "ou=idmap,dc=quenya,dc=org" partition. [global] ... idmap backendldap:ldap://onterose/ - ldap idmap suffixou=idmap,dc=plainjoe,dc=org + ldap idmap suffixou=idmap,dc=quenya,dc=org idmap uid40000-50000 idmap gid40000-50000 - This configuration allows winbind installations on multiple servers to - share a uid/gid number space, thus avoiding the interoperability problems - with NFS that were present in Samba 2.2. + This configuration allows Winbind installations on multiple servers to + share a UID/GID number space, thus avoiding the interoperability problems + with NFS that were present in Samba-2.2. diff --git a/docs/docbook/projdoc/winbind.xml b/docs/docbook/projdoc/winbind.xml index 001b2f16c1..d460694496 100644 --- a/docs/docbook/projdoc/winbind.xml +++ b/docs/docbook/projdoc/winbind.xml @@ -1,7 +1,6 @@ - TimPotter @@ -20,14 +19,13 @@ JohnTrostel - SNAP
    jtrostel@snapserver.com
    + SNAP     &author.jelmer; &author.jht; -     27 June 2002     @@ -38,7 +36,7 @@ Integration of UNIX and Microsoft Windows NT through a unified logon has - been considered a "holy grail" in heterogeneous computing environments for + been considered a holy grail in heterogeneous computing environments for a long time. @@ -50,11 +48,11 @@ - winbind is a component of the Samba suite of programs + winbind is a component of the Samba suite of programs that solves the unified logon problem. Winbind uses a UNIX implementation of Microsoft RPC calls, Pluggable Authentication Modules, and the Name Service Switch to allow Windows NT domain users to appear and operate as UNIX users on a UNIX - machine. This chapter describes the winbind system, explaining the functionality + machine. This chapter describes the Winbind system, explaining the functionality it provides, how it is configured, and how it works internally. @@ -64,27 +62,27 @@ - Authentication of user credentials (via PAM) + Authentication of user credentials (via PAM). - Identity resolution (via NSS)` + Identity resolution (via NSS). - Windindd maintains a database called winbind_idmap.tdb in which it stores + Winbind maintains a database called winbind_idmap.tdb in which it stores mappings between UNIX UIDs / GIDs and NT SIDs. This mapping is used only for users and groups that do not have a local UID/GID. It stored the UID/GID allocated from the idmap uid/gid range that it has mapped to the NT SID. If idmap backend has been specified as ldapsam:url - then instead of using a local mapping winbindd will obtain this information + then instead of using a local mapping Winbind will obtain this information from the LDAP database. - If winbindd is not running, then smbd (which calls winbindd) will fall back to - using purely local information from /etc/passwd and /etc/group and no dynamic + If winbindd is not running, smbd (which calls winbindd) will fall back to + using purely local information from /etc/passwd and /etc/group and no dynamic mapping will be used. @@ -94,7 +92,7 @@ ---> + --> @@ -111,9 +109,9 @@ One common solution in use today has been to create identically named user accounts on both the UNIX and Windows systems and use the Samba suite of programs to provide file and print services - between the two. This solution is far from perfect however, as + between the two. This solution is far from perfect, however, as adding and deleting users on both sets of machines becomes a chore - and two sets of passwords are required both of which + and two sets of passwords are required &smbmdash; both of which can lead to synchronization problems between the UNIX and Windows systems and confusion for users. @@ -121,13 +119,13 @@ three smaller problems: - Obtaining Windows NT user and group information + Obtaining Windows NT user and group information. - Authenticating Windows NT users + Authenticating Windows NT users. - Password changing for Windows NT users + Password changing for Windows NT users. @@ -136,7 +134,7 @@ would satisfy all the above components without duplication of information on the UNIX machines and without creating additional tasks for the system administrator when maintaining users and - groups on either system. The winbind system provides a simple + groups on either system. The Winbind system provides a simple and elegant solution to all three components of the unified logon problem. @@ -146,53 +144,53 @@ What Winbind Provides Winbind unifies UNIX and Windows NT account management by - allowing a UNIX box to become a full member of a NT domain. Once + allowing a UNIX box to become a full member of an NT domain. Once this is done the UNIX box will see NT users and groups as if - they were native UNIX users and groups, allowing the NT domain + they were native UNIX users and groups, allowing the NT domain to be used in much the same manner that NIS+ is used within UNIX-only environments. The end result is that whenever any program on the UNIX machine asks the operating system to lookup a user or group name, the query will be resolved by asking the - NT domain controller for the specified domain to do the lookup. + NT Domain Controller for the specified domain to do the lookup. Because Winbind hooks into the operating system at a low level - (via the NSS name resolution modules in the C library) this - redirection to the NT domain controller is completely + (via the NSS name resolution modules in the C library), this + redirection to the NT Domain Controller is completely transparent. Users on the UNIX machine can then use NT user and group - names as they would use "native" UNIX names. They can chown files - so that they are owned by NT domain users or even login to the + names as they would native UNIX names. They can chown files + so they are owned by NT domain users or even login to the UNIX machine and run a UNIX X-Window session as a domain user. The only obvious indication that Winbind is being used is - that user and group names take the form DOMAIN\user and - DOMAIN\group. This is necessary as it allows Winbind to determine - that redirection to a domain controller is wanted for a particular + that user and group names take the form DOMAIN\user and + DOMAIN\group. This is necessary as it allows Winbind to determine + that redirection to a Domain Controller is wanted for a particular lookup and which trusted domain is being referenced. Additionally, Winbind provides an authentication service that hooks into the Pluggable Authentication Modules (PAM) system - to provide authentication via a NT domain to any PAM enabled + to provide authentication via an NT domain to any PAM-enabled applications. This capability solves the problem of synchronizing passwords between systems since all passwords are stored in a single - location (on the domain controller). + location (on the Domain Controller). Target Uses Winbind is targeted at organizations that have an - existing NT based domain infrastructure into which they wish + existing NT-based domain infrastructure into which they wish to put UNIX workstations or servers. Winbind will allow these organizations to deploy UNIX workstations without having to maintain a separate account infrastructure. This greatly simplifies the administrative overhead of deploying UNIX - workstations into a NT based organization. + workstations into an NT-based organization. Another interesting way in which we expect Winbind to - be used is as a central part of UNIX based appliances. Appliances - that provide file and print services to Microsoft based networks + be used is as a central part of UNIX-based appliances. Appliances + that provide file and print services to Microsoft-based networks will be able to use Winbind to provide seamless integration of the appliance into the domain. @@ -203,13 +201,13 @@ How Winbind Works - The winbind system is designed around a client/server + The Winbind system is designed around a client/server architecture. A long running winbindd daemon listens on a UNIX domain socket waiting for requests to arrive. These requests are generated by the NSS and PAM - clients and processed sequentially. + clients and is processed sequentially. - The technologies used to implement winbind are described + The technologies used to implement Winbind are described in detail below. @@ -218,18 +216,18 @@ Over the last few years, efforts have been underway by various Samba Team members to decode various aspects of the Microsoft Remote Procedure Call (MSRPC) system. This - system is used for most network related operations between + system is used for most network-related operations between Windows NT machines including remote management, user authentication and print spooling. Although initially this work was done to aid the implementation of Primary Domain Controller (PDC) - functionality in Samba, it has also yielded a body of code which + functionality in Samba, it has also yielded a body of code that can be used for other purposes. Winbind uses various MSRPC calls to enumerate domain users and groups and to obtain detailed information about individual users or groups. Other MSRPC calls can be used to authenticate NT domain users and to change user passwords. By directly querying - a Windows PDC for user and group information, winbind maps the + a Windows PDC for user and group information, Winbind maps the NT account information onto UNIX user and group names. @@ -238,13 +236,12 @@ Since late 2001, Samba has gained the ability to - interact with Microsoft Windows 2000 using its 'Native - Mode' protocols, rather than the NT4 RPC services. - Using LDAP and Kerberos, a domain member running - winbind can enumerate users and groups in exactly the - same way as a Win2k client would, and in so doing - provide a much more efficient and - effective winbind implementation. + interact with Microsoft Windows 2000 using its Native + Mode protocols, rather than the NT4 RPC services. + Using LDAP and Kerberos, a Domain Member running + Winbind can enumerate users and groups in exactly the + same way as a Windows 200x client would, and in so doing + provide a much more efficient and effective Winbind implementation. @@ -258,45 +255,45 @@ UNIX workstation may resolve system information from a series of flat files stored on the local filesystem. A networked workstation may first attempt to resolve system information from local files, - and then consult a NIS database for user information or a DNS server + and then consult an NIS database for user information or a DNS server for hostname information. - The NSS application programming interface allows winbind + The NSS application programming interface allows Winbind to present itself as a source of system information when - resolving UNIX usernames and groups. Winbind uses this interface, + resolving UNIX usernames and groups. Winbind uses this interface, and information obtained from a Windows NT server using MSRPC - calls to provide a new source of account enumeration. Using standard + calls to provide a new source of account enumeration. Using standard UNIX library calls, one can enumerate the users and groups on - a UNIX machine running winbind and see all users and groups in + a UNIX machine running Winbind and see all users and groups in a NT domain plus any trusted domain as though they were local users and groups. The primary control file for NSS is /etc/nsswitch.conf. - When a UNIX application makes a request to do a lookup + When a UNIX application makes a request to do a lookup, the C library looks in /etc/nsswitch.conf - for a line which matches the service type being requested, for - example the "passwd" service type is used when user or group names - are looked up. This config line specifies which implementations + for a line that matches the service type being requested, for + example the passwd service type is used when user or group names + are looked up. This config line specifies which implementations of that service should be tried and in what order. If the passwd config line is: - -passwd: files example - + + passwd: files example + then the C library will first load a module called /lib/libnss_files.so followed by the module /lib/libnss_example.so. The C library will dynamically load each of these modules in turn and call resolver functions within the modules to try to resolve - the request. Once the request is resolved the C library returns the + the request. Once the request is resolved, the C library returns the result to the application. - This NSS interface provides a very easy way for Winbind + This NSS interface provides an easy way for Winbind to hook into the operating system. All that needs to be done is to put libnss_winbind.so in /lib/ - then add "winbind" into /etc/nsswitch.conf at + then add winbind into /etc/nsswitch.conf at the appropriate place. The C library will then call Winbind to resolve user and group names. @@ -325,33 +322,33 @@ passwd: files example PAM is configured by providing control files in the directory /etc/pam.d/ for each of the services that require authentication. When an authentication request is made - by an application the PAM code in the C library looks up this + by an application, the PAM code in the C library looks up this control file to determine what modules to load to do the authentication check and in what order. This interface makes adding - a new authentication service for Winbind very easy, all that needs + a new authentication service for Winbind very easy. All that needs to be done is that the pam_winbind.so module is copied to /lib/security/ and the PAM control files for relevant services are updated to allow - authentication via winbind. See the PAM documentation - for more details. + authentication via Winbind. See the PAM documentation + in for more information. User and Group ID Allocation - When a user or group is created under Windows NT - is it allocated a numerical relative identifier (RID). This is - slightly different to UNIX which has a range of numbers that are + When a user or group is created under Windows NT/200x + it is allocated a numerical relative identifier (RID). This is + slightly different from UNIX which has a range of numbers that are used to identify users, and the same range in which to identify - groups. It is winbind's job to convert RIDs to UNIX id numbers and - vice versa. When winbind is configured it is given part of the UNIX - user id space and a part of the UNIX group id space in which to + groups. It is Winbind's job to convert RIDs to UNIX ID numbers and + vice versa. When Winbind is configured, it is given part of the UNIX + user ID space and a part of the UNIX group ID space in which to store Windows NT users and groups. If a Windows NT user is - resolved for the first time, it is allocated the next UNIX id from + resolved for the first time, it is allocated the next UNIX ID from the range. The same process applies for Windows NT groups. Over - time, winbind will have mapped all Windows NT users and groups - to UNIX user ids and group ids. + time, Winbind will have mapped all Windows NT users and groups + to UNIX user IDs and group IDs. The results of this mapping are stored persistently in an ID mapping database held in a tdb database). This ensures that @@ -362,17 +359,19 @@ passwd: files example Result Caching - An active system can generate a lot of user and group - name lookups. To reduce the network cost of these lookups winbind + +SAM + An active system can generate a lot of user and group + name lookups. To reduce the network cost of these lookups, Winbind uses a caching scheme based on the SAM sequence number supplied - by NT domain controllers. User or group information returned - by a PDC is cached by winbind along with a sequence number also + by NT Domain Controllers. User or group information returned + by a PDC is cached by Winbind along with a sequence number also returned by the PDC. This sequence number is incremented by Windows NT whenever any user or group information is modified. If a cached entry has expired, the sequence number is requested from the PDC and compared against the sequence number of the cached entry. If the sequence numbers do not match, then the cached information - is discarded and up to date information is requested directly + is discarded and up-to-date information is requested directly from the PDC. @@ -385,23 +384,23 @@ passwd: files example Introduction -This section describes the procedures used to get winbind up and -running. Winbind is capable of providing access +This section describes the procedures used to get Winbind up and +running. Winbind is capable of providing access and authentication control for Windows Domain users through an NT -or Win2K PDC for 'regular' services, such as telnet a nd ftp, as -well for SAMBA services. +or Windows 200x PDC for regular services, such as telnet and ftp, as +well for Samba services. - Why should I to this? + Why should I do this? - This allows the SAMBA administrator to rely on the - authentication mechanisms on the NT/Win2K PDC for the authentication - of domain members. NT/Win2K users no longer need to have separate - accounts on the SAMBA server. + This allows the Samba administrator to rely on the + authentication mechanisms on the Windows NT/200x PDC for the authentication + of Domain Members. Windows NT/200x users no longer need to have separate + accounts on the Samba server. @@ -411,12 +410,10 @@ well for SAMBA services. - This HOWTO is designed for system administrators. If you are - implementing SAMBA on a file server and wish to (fairly easily) - integrate existing NT/Win2K users from your PDC onto the - SAMBA server, this HOWTO is for you. That said, I am no NT or PAM - expert, so you may find a better or easier way to accomplish - these tasks. + This document is designed for system administrators. If you are + implementing Samba on a file server and wish to (fairly easily) + integrate existing Windows NT/200x users from your PDC onto the + Samba server, this document is for you. @@ -427,38 +424,29 @@ well for SAMBA services. Requirements -If you have a Samba configuration file that you are currently -using... BACK IT UP! If your system already uses PAM, -back up the /etc/pam.d directory -contents! If you haven't already made a boot disk, -MAKE ONE NOW! +If you have a Samba configuration file that you are currently using, BACK IT UP! +If your system already uses PAM, back up the /etc/pam.d directory +contents! If you haven't already made a boot disk, MAKE ONE NOW! -Messing with the PAM configuration files can make it nearly impossible -to log in to your machine. That's why you want to be able to boot back -into your machine in single user mode and restore your -/etc/pam.d back to the original state they were in if -you get frustrated with the way things are going. ;-) +Messing with the PAM configuration files can make it nearly impossible to log in to your machine. That's +why you want to be able to boot back into your machine in single user mode and restore your +/etc/pam.d back to the original state they were in if you get frustrated with the +way things are going. -The latest version of SAMBA (version 3.0 as of this writing), now -includes a functioning winbindd daemon. Please refer to the -main SAMBA web page or, -better yet, your closest SAMBA mirror site for instructions on -downloading the source code. +The latest version of Samba-3 includes a functioning winbindd daemon. Please refer to the main Samba Web page or, better yet, your closest Samba mirror site for +instructions on downloading the source code. -To allow Domain users the ability to access SAMBA shares and -files, as well as potentially other services provided by your -SAMBA machine, PAM (pluggable authentication modules) must -be setup properly on your machine. In order to compile the -winbind modules, you should have at least the pam libraries resident -on your system. For recent RedHat systems (7.1, for instance), that -means pam-0.74-22. For best results, it is helpful to also -install the development packages in pam-devel-0.74-22. +To allow domain users the ability to access Samba shares and files, as well as potentially other services +provided by your Samba machine, PAM must be set up properly on your +machine. In order to compile the Winbind modules, you should have at least the PAM development libraries installed +on your system. Please refer the PAM web site . @@ -466,25 +454,29 @@ install the development packages in pam-devel-0.74-22. Testing Things Out -Before starting, it is probably best to kill off all the SAMBA -related daemons running on your server. Kill off all &smbd;, -&nmbd;, and &winbindd; processes that may -be running. To use PAM, you will want to make sure that you have the -standard PAM package which supplies the /etc/pam.d -directory structure, including the pam modules are used by pam-aware -services, several pam libraries, and the /usr/doc -and /usr/man entries for pam. Winbind built better -in SAMBA if the pam-devel package was also installed. This package includes -the header files needed to compile pam-aware applications. +Before starting, it is probably best to kill off all the Samba-related daemons running on your server. +Kill off all &smbd;, &nmbd;, and &winbindd; processes that may be running. To use PAM, +make sure that you have the standard PAM package that supplies the /etc/pam.d +directory structure, including the PAM modules that are used by PAM-aware services, several pam libraries, +and the /usr/doc and /usr/man entries for pam. Winbind built +better in Samba if the pam-devel package is also installed. This package includes the header files +needed to compile PAM-aware applications. -Configure <filename>nsswitch.conf</filename> and the -winbind libraries on Linux and Solaris +Configure <filename>nsswitch.conf</filename> and the Winbind Libraries on Linux and Solaris + + +PAM is a standard component of most current generation UNIX/Linux systems. Unfortunately, few systems install +the pam-devel libraries that are needed to build PAM-enabled Samba. Additionally, Samba-3 +may auto-install the Winbind files into their correct locations on your system, so before you get too far down +the track be sure to check if the following configuration is really +necessary. You may only need to configure +/etc/nsswitch.conf. + -The libraries needed to run the &winbindd; daemon -through nsswitch need to be copied to their proper locations, so +The libraries needed to run the &winbindd; daemon through nsswitch need to be copied to their proper locations: @@ -511,7 +503,7 @@ I also found it necessary to make the following symbolic link: Now, as root you need to edit /etc/nsswitch.conf to allow user and group entries to be visible from the &winbindd; -daemon. My /etc/nsswitch.conf file look like +daemon. My /etc/nsswitch.conf file look like this after editing: @@ -522,10 +514,9 @@ this after editing: -The libraries needed by the winbind daemon will be automatically +The libraries needed by the winbindd daemon will be automatically entered into the ldconfig cache the next time -your system reboots, but it -is faster (and you don't need to reboot) if you do it manually: +your system reboots, but it is faster (and you do not need to reboot) if you do it manually: @@ -542,13 +533,12 @@ and echos back a check to you. NSS Winbind on AIX -(This section is only for those running AIX) +(This section is only for those running AIX.) -The winbind AIX identification module gets built as libnss_winbind.so in the -nsswitch directory of the samba source. This file can be copied to -/usr/lib/security, and the AIX naming convention would indicate that it -should be named WINBIND. A stanza like the following: +The Winbind AIX identification module gets built as libnss_winbind.so in the +nsswitch directory of the Samba source. This file can be copied to /usr/lib/security, +and the AIX naming convention would indicate that it should be named WINBIND. A stanza like the following: @@ -557,19 +547,19 @@ WINBIND: options = authonly -can then be added to -/usr/lib/security/methods.cfg. This module only -supports identification, but there have been success reports using the -standard winbind pam module for authentication. Use caution configuring -loadable authentication modules as it is possible to make it impossible -to logon to the system. More information about the AIX authentication -module API can be found at "Kernel Extensions and Device Support -Programming Concepts for AIX": +can then be added to /usr/lib/security/methods.cfg. This module only supports +identification, but there have been success reports using the standard Winbind PAM module for +authentication. Use caution configuring loadable authentication +modules since you can make +it impossible to logon to the system. More information about the AIX authentication module API can +be found at Kernel Extensions and Device Support Programming Concepts for AIX -Chapter 18. Loadable Authentication Module Programming Interface -and more information on administering the modules at -"System Management Guide: Operating System and Devices". +in Chapter 18(John, there is no section like this in 18). Loadable Authentication Module Programming +Interface and more information on administering the modules +can be found at System +Management Guide: Operating System and Devices. @@ -577,19 +567,16 @@ url="http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixbman/baseadmn/ia Configure smb.conf -Several parameters are needed in the smb.conf file to control -the behavior of &winbindd;. Configure -&smb.conf; These are described in more detail in -the winbindd -8 man page. My -&smb.conf; file was modified to -include the following entries in the [global] section: +Several parameters are needed in the &smb.conf; file to control the behavior of &winbindd;. These +are described in more detail in the winbindd +8 man page. My &smb.conf; file, as shown in , was modified to include the necessary entries in the [global] section. - - smb.conf for winbind set-up + + smb.conf for Winbind set-up [global] -... + <...> separate domain and username with '+', like DOMAIN+username winbind separator+ use uids from 10000 to 20000 for domain users @@ -608,10 +595,10 @@ include the following entries in the [global] section: -Join the SAMBA server to the PDC domain +Join the Samba Server to the PDC Domain -Enter the following command to make the SAMBA server join the +Enter the following command to make the Samba server join the PDC domain, where DOMAIN is the name of your Windows domain and Administrator is a domain user who has administrative privileges in the domain. @@ -624,22 +611,21 @@ a domain user who has administrative privileges in the domain. -The proper response to the command should be: "Joined the domain -DOMAIN" where DOMAIN +The proper response to the command should be: Joined the domain +DOMAIN where DOMAIN is your DOMAIN name. - -Start up the winbindd daemon and test it! +Starting and Testing the <command>winbindd</command> Daemon -Eventually, you will want to modify your smb startup script to +Eventually, you will want to modify your Samba startup script to automatically invoke the winbindd daemon when the other parts of -SAMBA start, but it is possible to test out just the winbind -portion first. To start up winbind services, enter the following +Samba start, but it is possible to test out just the Winbind +portion first. To start up Winbind services, enter the following command as root: @@ -647,12 +633,18 @@ command as root: &rootprompt;/usr/local/samba/bin/winbindd + +The above assumes that Samba has been installed in the /usr/local/samba +directory tree. You may need to search for the location of Samba files if this is not the +location of winbindd on your system. + + -Winbindd can now also run in 'dual daemon mode'. This will make it -run as 2 processes. The first will answer all requests from the cache, +Winbindd can now also run in dual daemon modei. This will make it +run as two processes. The first will answer all requests from the cache, thus making responses to clients faster. The other will update the cache for the query that the first has just responded. -Advantage of this is that responses stay accurate and are faster. +The advantage of this is that responses stay accurate and are faster. You can enable dual daemon mode by adding to the commandline: @@ -661,23 +653,22 @@ You can enable dual daemon mode by adding to the commandline -I'm always paranoid and like to make sure the daemon -is really running... +I'm always paranoid and like to make sure the daemon is really running. &rootprompt;ps -ae | grep winbindd -This command should produce output like this, if the daemon is running +This command should produce output like this, if the daemon is running you would expect +to see a report something like this: 3025 ? 00:00:00 winbindd -Now... for the real test, try to get some information about the -users on your PDC +Now, for the real test, try to get some information about the users on your PDC: @@ -686,7 +677,7 @@ users on your PDC This should echo back a list of users on your Windows users on -your PDC. For example, I get the following response: +your PDC. For example, I get the following response: @@ -699,12 +690,11 @@ your PDC. For example, I get the following response: - Obviously, I have named my domain 'CEO' and my winbind separator is '+'. +Obviously, I have named my domain CEO and my winbind separator is +. -You can do the same sort of thing to get group information from -the PDC: +You can do the same sort of thing to get group information from the PDC: @@ -721,9 +711,8 @@ the PDC: -The function 'getent' can now be used to get unified -lists of both local and PDC users and groups. -Try the following command: +The function getent can now be used to get unified +lists of both local and PDC users and groups. Try the following command: @@ -732,12 +721,12 @@ Try the following command: You should get a list that looks like your /etc/passwd -list followed by the domain users with their new uids, gids, home +list followed by the domain users with their new UIDs, GIDs, home directories and default shells. -The same thing can be done for groups with the command +The same thing can be done for groups with the command: @@ -748,20 +737,19 @@ The same thing can be done for groups with the command -Fix the init.d startup scripts +Fix the init.d Startup Scripts Linux -The &winbindd; daemon needs to start up after the -&smbd; and &nmbd; daemons are running. +The &winbindd; daemon needs to start up after the &smbd; and &nmbd; daemons are running. To accomplish this task, you need to modify the startup scripts of your system. -They are located at /etc/init.d/smb in RedHat and -/etc/init.d/samba in Debian. -script to add commands to invoke this daemon in the proper sequence. My +They are located at /etc/init.d/smb in Red Hat Linux and they are located in +/etc/init.d/samba in Debian Linux. Edit your +script to add commands to invoke this daemon in the proper sequence. My startup script starts up &smbd;, &nmbd;, and &winbindd; from the -/usr/local/samba/bin directory directly. The 'start' +/usr/local/samba/bin directory directly. The start function in the script looks like this: @@ -789,7 +777,7 @@ start() { If you would like to run winbindd in dual daemon mode, replace -the line +the line : daemon /usr/local/samba/bin/winbindd @@ -802,7 +790,7 @@ in the example above with: -The 'stop' function has a corresponding entry to shut down the +The stop function has a corresponding entry to shut down the services and looks like this: @@ -833,13 +821,14 @@ stop() { Solaris -Winbind doesn't work on Solaris 9, see the Portability chapter for details. + +Winbind does not work on Solaris 9, see for details. + -On Solaris, you need to modify the -/etc/init.d/samba.server startup script. It usually -only starts smbd and nmbd but should now start winbindd too. If you -have samba installed in /usr/local/samba/bin, -the file could contains something like this: + +On Solaris, you need to modify the /etc/init.d/samba.server startup script. It +usually only starts smbd and nmbd but should now start winbindd, too. If you have Samba installed in +/usr/local/samba/bin, the file could contains something like this: @@ -859,7 +848,7 @@ the file could contains something like this: [ "$pid" != "" ] && kill $pid } - # Start/stop processes required for samba server + # Start/stop processes required for Samba server case "$1" in @@ -892,13 +881,11 @@ the file could contains something like this: -Again, if you would like to run samba in dual daemon mode, replace +Again, if you would like to run Samba in dual daemon mode, replace: /usr/local/samba/bin/winbindd - in the script above with: - /usr/local/samba/bin/winbindd -B @@ -910,7 +897,7 @@ in the script above with: Restarting If you restart the &smbd;, &nmbd;, and &winbindd; daemons at this point, you -should be able to connect to the samba server as a domain member just as +should be able to connect to the Samba server as a Domain Member just as if you were a local user. @@ -920,17 +907,17 @@ if you were a local user. Configure Winbind and PAM -If you have made it this far, you know that winbindd and samba are working -together. If you want to use winbind to provide authentication for other -services, keep reading. The pam configuration files need to be altered in -this step. (Did you remember to make backups of your original +If you have made it this far, you know that winbindd and Samba are working +together. If you want to use Winbind to provide authentication for other +services, keep reading. The PAM configuration files need to be altered in +this step. (Did you remember to make backups of your original /etc/pam.d files? If not, do it now.) -You will need a pam module to use winbindd with these other services. This +You will need a PAM module to use winbindd with these other services. This module will be compiled in the ../source/nsswitch directory -by invoking the command +by invoking the command: @@ -938,10 +925,10 @@ by invoking the command -from the ../source directory. The +from the ../source directory. The pam_winbind.so file should be copied to the location of -your other pam security modules. On my RedHat system, this was the -/lib/security directory. On Solaris, the pam security +your other PAM security modules. On my RedHat system, this was the +/lib/security directory. On Solaris, the PAM security modules reside in /usr/lib/security. @@ -964,25 +951,21 @@ just left this file as it was: -The other services that I modified to allow the use of winbind +The other services that I modified to allow the use of Winbind as an authentication service were the normal login on the console (or a terminal -session), telnet logins, and ftp service. In order to enable these +session), telnet logins, and ftp service. In order to enable these services, you may first need to change the entries in -/etc/xinetd.d (or /etc/inetd.conf). -RedHat 7.1 uses the new xinetd.d structure, in this case you need +/etc/xinetd.d (or /etc/inetd.conf). +Red Hat Linux 7.1 and later uses the new xinetd.d structure, in this case you need to change the lines in /etc/xinetd.d/telnet and /etc/xinetd.d/wu-ftp from enable = no - - - -to - - - + +to: + enable = yes @@ -990,51 +973,51 @@ to For ftp services to work properly, you will also need to either have individual directories for the domain users already present on the server, or change the home directory template to a general -directory for all domain users. These can be easily set using +directory for all domain users. These can be easily set using the &smb.conf; global entry template homedir. The /etc/pam.d/ftp file can be changed -to allow winbind ftp access in a manner similar to the -samba file. My /etc/pam.d/ftp file was +to allow Winbind ftp access in a manner similar to the +samba file. My /etc/pam.d/ftp file was changed to look like this: - auth required /lib/security/pam_listfile.so item=user sense=deny \ - file=/etc/ftpusers onerr=succeed - auth sufficient /lib/security/pam_winbind.so - auth required /lib/security/pam_stack.so service=system-auth - auth required /lib/security/pam_shells.so - account sufficient /lib/security/pam_winbind.so - account required /lib/security/pam_stack.so service=system-auth - session required /lib/security/pam_stack.so service=system-auth +auth required /lib/security/pam_listfile.so item=user sense=deny \ + file=/etc/ftpusers onerr=succeed +auth sufficient /lib/security/pam_winbind.so +auth required /lib/security/pam_stack.so service=system-auth +auth required /lib/security/pam_shells.so +account sufficient /lib/security/pam_winbind.so +account required /lib/security/pam_stack.so service=system-auth +session required /lib/security/pam_stack.so service=system-auth The /etc/pam.d/login file can be changed nearly the -same way. It now looks like this: +same way. It now looks like this: - auth required /lib/security/pam_securetty.so - auth sufficient /lib/security/pam_winbind.so - auth sufficient /lib/security/pam_unix.so use_first_pass - auth required /lib/security/pam_stack.so service=system-auth - auth required /lib/security/pam_nologin.so - account sufficient /lib/security/pam_winbind.so - account required /lib/security/pam_stack.so service=system-auth - password required /lib/security/pam_stack.so service=system-auth - session required /lib/security/pam_stack.so service=system-auth - session optional /lib/security/pam_console.so +auth required /lib/security/pam_securetty.so +auth sufficient /lib/security/pam_winbind.so +auth sufficient /lib/security/pam_UNIX.so use_first_pass +auth required /lib/security/pam_stack.so service=system-auth +auth required /lib/security/pam_nologin.so +account sufficient /lib/security/pam_winbind.so +account required /lib/security/pam_stack.so service=system-auth +password required /lib/security/pam_stack.so service=system-auth +session required /lib/security/pam_stack.so service=system-auth +session optional /lib/security/pam_console.so In this case, I added the auth sufficient /lib/security/pam_winbind.so lines as before, but also added the required pam_securetty.so -above it, to disallow root logins over the network. I also added a +above it, to disallow root logins over the network. I also added a sufficient /lib/security/pam_unix.so use_first_pass line after the winbind.so line to get rid of annoying double prompts for passwords. @@ -1046,78 +1029,78 @@ double prompts for passwords. Solaris-specific configuration -The /etc/pam.conf needs to be changed. I changed this file so that my Domain -users can logon both locally as well as telnet.The following are the changes -that I made.You can customize the pam.conf file as per your requirements,but +The /etc/pam.conf needs to be changed. I changed this file so my Domain +users can logon both locally as well as telnet. The following are the changes +that I made. You can customize the pam.conf file as per your requirements, but be sure of those changes because in the worst case it will leave your system nearly impossible to boot. - # - #ident "@(#)pam.conf 1.14 99/09/16 SMI" - # - # Copyright (c) 1996-1999, Sun Microsystems, Inc. - # All Rights Reserved. - # - # PAM configuration - # - # Authentication management - # - login auth required /usr/lib/security/pam_winbind.so - login auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass - login auth required /usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass - # - rlogin auth sufficient /usr/lib/security/pam_winbind.so - rlogin auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1 - rlogin auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass - # - dtlogin auth sufficient /usr/lib/security/pam_winbind.so - dtlogin auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass - # - rsh auth required /usr/lib/security/$ISA/pam_rhosts_auth.so.1 - other auth sufficient /usr/lib/security/pam_winbind.so - other auth required /usr/lib/security/$ISA/pam_unix.so.1 try_first_pass - # - # Account management - # - login account sufficient /usr/lib/security/pam_winbind.so - login account requisite /usr/lib/security/$ISA/pam_roles.so.1 - login account required /usr/lib/security/$ISA/pam_unix.so.1 - # - dtlogin account sufficient /usr/lib/security/pam_winbind.so - dtlogin account requisite /usr/lib/security/$ISA/pam_roles.so.1 - dtlogin account required /usr/lib/security/$ISA/pam_unix.so.1 - # - other account sufficient /usr/lib/security/pam_winbind.so - other account requisite /usr/lib/security/$ISA/pam_roles.so.1 - other account required /usr/lib/security/$ISA/pam_unix.so.1 - # - # Session management - # - other session required /usr/lib/security/$ISA/pam_unix.so.1 - # - # Password management - # - #other password sufficient /usr/lib/security/pam_winbind.so - other password required /usr/lib/security/$ISA/pam_unix.so.1 - dtsession auth required /usr/lib/security/$ISA/pam_unix.so.1 - # - # Support for Kerberos V5 authentication (uncomment to use Kerberos) - # - #rlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass - #login auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass - #dtlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass - #other auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass - #dtlogin account optional /usr/lib/security/$ISA/pam_krb5.so.1 - #other account optional /usr/lib/security/$ISA/pam_krb5.so.1 - #other session optional /usr/lib/security/$ISA/pam_krb5.so.1 - #other password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +# +#ident "@(#)pam.conf 1.14 99/09/16 SMI" +# +# Copyright (c) 1996-1999, Sun Microsystems, Inc. +# All Rights Reserved. +# +# PAM configuration +# +# Authentication management +# +login auth required /usr/lib/security/pam_winbind.so +login auth required /usr/lib/security/$ISA/pam_UNIX.so.1 try_first_pass +login auth required /usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass +# +rlogin auth sufficient /usr/lib/security/pam_winbind.so +rlogin auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1 +rlogin auth required /usr/lib/security/$ISA/pam_UNIX.so.1 try_first_pass +# +dtlogin auth sufficient /usr/lib/security/pam_winbind.so +dtlogin auth required /usr/lib/security/$ISA/pam_UNIX.so.1 try_first_pass +# +rsh auth required /usr/lib/security/$ISA/pam_rhosts_auth.so.1 +other auth sufficient /usr/lib/security/pam_winbind.so +other auth required /usr/lib/security/$ISA/pam_UNIX.so.1 try_first_pass +# +# Account management +# +login account sufficient /usr/lib/security/pam_winbind.so +login account requisite /usr/lib/security/$ISA/pam_roles.so.1 +login account required /usr/lib/security/$ISA/pam_UNIX.so.1 +# +dtlogin account sufficient /usr/lib/security/pam_winbind.so +dtlogin account requisite /usr/lib/security/$ISA/pam_roles.so.1 +dtlogin account required /usr/lib/security/$ISA/pam_UNIX.so.1 +# +other account sufficient /usr/lib/security/pam_winbind.so +other account requisite /usr/lib/security/$ISA/pam_roles.so.1 +other account required /usr/lib/security/$ISA/pam_UNIX.so.1 +# +# Session management +# +other session required /usr/lib/security/$ISA/pam_UNIX.so.1 +# +# Password management +# +#other password sufficient /usr/lib/security/pam_winbind.so +other password required /usr/lib/security/$ISA/pam_UNIX.so.1 +dtsession auth required /usr/lib/security/$ISA/pam_UNIX.so.1 +# +# Support for Kerberos V5 authentication (uncomment to use Kerberos) +# +#rlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#login auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#dtlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#other auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#dtlogin account optional /usr/lib/security/$ISA/pam_krb5.so.1 +#other account optional /usr/lib/security/$ISA/pam_krb5.so.1 +#other session optional /usr/lib/security/$ISA/pam_krb5.so.1 +#other password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass -I also added a try_first_pass line after the winbind.so line to get rid of -annoying double prompts for passwords. +I also added a try_first_pass line after the winbind.so +line to get rid of annoying double prompts for passwords. @@ -1136,12 +1119,12 @@ configured in the pam.conf. Conclusion - The winbind system, through the use of the Name Service - Switch, Pluggable Authentication Modules, and appropriate - Microsoft RPC calls have allowed us to provide seamless - integration of Microsoft Windows NT domain users on a - UNIX system. The result is a great reduction in the administrative - cost of running a mixed UNIX and NT network. +The Winbind system, through the use of the Name Service +Switch, Pluggable Authentication Modules, and appropriate +Microsoft RPC calls have allowed us to provide seamless +integration of Microsoft Windows NT domain users on a +UNIX system. The result is a great reduction in the administrative +cost of running a mixed UNIX and NT network. @@ -1154,23 +1137,23 @@ configured in the pam.conf. Winbind is currently only available for - the Linux, Solaris, AIX and IRIX operating systems, although ports to other operating + the Linux, Solaris, AIX, and IRIX operating systems, although ports to other operating systems are certainly possible. For such ports to be feasible, we require the C library of the target operating system to support the Name Service Switch and Pluggable Authentication Modules systems. This is becoming more common as NSS and PAM gain support among UNIX vendors. - The mappings of Windows NT RIDs to UNIX ids + The mappings of Windows NT RIDs to UNIX IDs is not made algorithmically and depends on the order in which - unmapped users or groups are seen by winbind. It may be difficult - to recover the mappings of rid to UNIX id mapping if the file + unmapped users or groups are seen by Winbind. It may be difficult + to recover the mappings of RID to UNIX ID mapping if the file containing this information is corrupted or destroyed. - Currently the winbind PAM module does not take + Currently the Winbind PAM module does not take into account possible workstation and logon time restrictions - that may be been set for Windows NT users, this is + that may be set for Windows NT users, this is instead up to the PDC to enforce. @@ -1179,19 +1162,67 @@ configured in the pam.conf. - - Do NOT under ANY circumstances run nscd on any system - on which winbind is running. - + + Do not under any circumstances run nscd on any system + on which winbindd is running. + If nscd is running on the UNIX/Linux system, then - even though NSSWITCH is correctly configured it will NOT be possible to resolve + even though NSSWITCH is correctly configured it will not be possible to resolve domain users and groups for file and directory controls. + + + Winbind Is Not Resolving Users and Groups + + + My &smb.conf; file is correctly configured. I have specified + idmap uid12000, + and idmap gid3000-3500 + and winbind is running. When I do the following it all works fine. + + + +&rootprompt;wbinfo -u +MIDEARTH+maryo +MIDEARTH+jackb +MIDEARTH+ameds +... +MIDEARTH+root + +&rootprompt;wbinfo -g +MIDEARTH+Domain Users +MIDEARTH+Domain Admins +MIDEARTH+Domain Guests +... +MIDEARTH+Accounts + +&rootprompt;getent passwd +root:x:0:0:root:/root:/bin/bash +bin:x:1:1:bin:/bin:/bin/bash +... +maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false + + + +But the following command just fails: + +&rootprompt;chown maryo a_file +chown: `maryo': invalid user + +This is driving me nuts! What can be wrong? + + + +Same problem as the one above. +Your system is likely running nscd, the name service +caching daemon. Shut it down, do not restart it! You will find your problem resolved. + + +     - diff --git a/docs/faq/FAQ-ClientApp.html b/docs/faq/FAQ-ClientApp.html index 6ba4b1d36c..77e65c9f58 100644 --- a/docs/faq/FAQ-ClientApp.html +++ b/docs/faq/FAQ-ClientApp.html @@ -1,4 +1,4 @@ -Chapter 3. Specific client application problems
    Chapter 3. Specific client application problems
    Prev   Next

    Chapter 3. Specific client application problems

    Table of Contents

    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"
    How to use a Samba share as an administrative share for MS Office, etc.
    Microsoft Access database opening errors

    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"

    +Chapter 3. Specific client application problems

    Chapter 3. Specific client application problems
    Prev   Next

    Chapter 3. Specific client application problems

    Table of Contents

    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"
    How to use a Samba share as an administrative share for MS Office, etc.
    Microsoft Access database opening errors

    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"

    When installing MS Office on a Samba drive for which you have admin user permissions, ie. admin users = username, you will find the setup program unable to complete the installation. @@ -10,7 +10,7 @@ rdonly by trying to open it for writing. Admin users can always open a file for writing, as they run as root. You just have to install as a non-admin user and then use "chown -R" to fix the owner. -

    How to use a Samba share as an administrative share for MS Office, etc.

    +

    How to use a Samba share as an administrative share for MS Office, etc.

    Microsoft Office products can be installed as an administrative installation from which the application can either be run off the administratively installed product that resides on a shared resource, or from which that product can be @@ -45,7 +45,7 @@ set the following parameters on the share containing it: public = yes

  • Now you are ready to run the setup program from the Microsoft Windows workstation as follows: \\"Server_Name"\MSOP95\msoffice\setup -

    • Microsoft Access database opening errors

    +

    Microsoft Access database opening errors

    Here are some notes on running MS-Access on a Samba drive from Stefan Kjellberg

    Opening a database in 'exclusive' mode does NOT work. Samba ignores r/w/share modes on file open.
    Make sure that you open the database as 'shared' and to 'lock modified records'
    Of course locking must be enabled for the particular share (smb.conf)

    Prev Up Next
    Chapter 2. Compiling and installing Samba on a Unix host Home Chapter 4. Common errors
    diff --git a/docs/faq/FAQ-Install.html b/docs/faq/FAQ-Install.html index c331922fdb..956c5872a5 100644 --- a/docs/faq/FAQ-Install.html +++ b/docs/faq/FAQ-Install.html @@ -1,4 +1,4 @@ -Chapter 2. Compiling and installing Samba on a Unix host
    Chapter 2. Compiling and installing Samba on a Unix host
    Prev   Next

    Chapter 2. Compiling and installing Samba on a Unix host

    Table of Contents

    My client reports "cannot locate specified share name" or similar
    Why are my file's timestamps off by an hour, or by a few hours?

    My client reports "cannot locate specified share name" or similar

    +Chapter 2. Compiling and installing Samba on a Unix host

    Chapter 2. Compiling and installing Samba on a Unix host
    Prev   Next

    Chapter 2. Compiling and installing Samba on a Unix host

    Table of Contents

    My client reports "cannot locate specified share name" or similar
    Why are my file's timestamps off by an hour, or by a few hours?

    My client reports "cannot locate specified share name" or similar

    This message indicates that your client CAN locate the specified server, which is a good start, but that it cannot find a service of the name you gave. @@ -7,7 +7,7 @@ The first step is to check the exact name of the service you are trying to connect to (consult your system administrator). Assuming it exists and you specified it correctly (read your client's docs on how to specify a service name correctly), read on: -

    Many clients cannot accept or use service names longer than eight characters.
    Many clients cannot accept or use service names containing spaces.
    Some servers (not Samba though) are case sensitive with service names.
    Some clients force service names into upper case.

    Why are my file's timestamps off by an hour, or by a few hours?

    +

    Many clients cannot accept or use service names longer than eight characters.
    Many clients cannot accept or use service names containing spaces.
    Some servers (not Samba though) are case sensitive with service names.
    Some clients force service names into upper case.

    Why are my file's timestamps off by an hour, or by a few hours?

    This is from Paul Eggert eggert@twinsun.com.

    Most likely it's a problem with your time zone settings. diff --git a/docs/faq/FAQ-errors.html b/docs/faq/FAQ-errors.html index 45314a811c..e7019df0b6 100644 --- a/docs/faq/FAQ-errors.html +++ b/docs/faq/FAQ-errors.html @@ -1,4 +1,4 @@ -Chapter 4. Common errors

    Chapter 4. Common errors
    Prev   Next

    Chapter 4. Common errors

    Table of Contents

    Not listening for calling name
    System Error 1240
    smbclient ignores -N !
    The data on the CD-Drive I've shared seems to be corrupted!

    Not listening for calling name

    +Chapter 4. Common errors

    Chapter 4. Common errors
    Prev   Next

    Chapter 4. Common errors

    Table of Contents

    Not listening for calling name
    System Error 1240
    smbclient ignores -N !
    The data on the CD-Drive I've shared seems to be corrupted!

    Not listening for calling name

     Session request failed (131,129) with myname=HOBBES destname=CALVIN
 Not listening for calling name
@@ -14,7 +14,7 @@ global section of smb.conf.
 It can also be a problem with reverse DNS lookups not functioning 
 correctly, leading to the remote host identity not being able to
 be confirmed, but that is less likely.
-

    System Error 1240

    +

    System Error 1240

    System error 1240 means that the client is refusing to talk to a non-encrypting server. Microsoft changed WinNT in service pack 3 to refuse to connect to servers that do not support @@ -24,7 +24,7 @@ SMB password encryption. the samba HOWTO Collectiondisable this behaviour in NT. See the section about Windows NT in the chapter "Portability" of the samba HOWTO collection

    -

    smbclient ignores -N !

    +

    smbclient ignores -N !

    “When getting the list of shares available on a host using the command smbclient -N -L the program always prompts for the password if the server is a Samba server. @@ -42,7 +42,7 @@ This will set both the username and password to null, which is an anonymous login for SMB. Using -N would only set the password to null, and this is not accepted as an anonymous login for most SMB servers. -

    The data on the CD-Drive I've shared seems to be corrupted!

    +

    The data on the CD-Drive I've shared seems to be corrupted!

    Some OSes (notably Linux) default to auto detection of file type on cdroms and do cr/lf translation. This is a very bad idea when use with Samba. It causes all sorts of stuff ups. diff --git a/docs/faq/FAQ-features.html b/docs/faq/FAQ-features.html index 5d20ba6fa0..091566bb94 100644 --- a/docs/faq/FAQ-features.html +++ b/docs/faq/FAQ-features.html @@ -1,7 +1,7 @@ -Chapter 5. Features

    Chapter 5. Features
    Prev   

    Chapter 5. Features

    Table of Contents

    How can I use samba as a fax server?
    Tools for printing faxes
    Making the fax-server
    Installing the client drivers
    Example smb.conf
    Samba doesn't work well together with DHCP!
    How can I assign NetBIOS names to clients with DHCP?
    How do I convert between unix and dos text formats?
    Does samba have wins replication support?

    How can I use samba as a fax server?

    Contributor: Gerhard Zuber

    Requirements: +Chapter 5. Features

    Chapter 5. Features
    Prev   

    Chapter 5. Features

    Table of Contents

    How can I use samba as a fax server?
    Tools for printing faxes
    Making the fax-server
    Installing the client drivers
    Example smb.conf
    Samba doesn't work well together with DHCP!
    How can I assign NetBIOS names to clients with DHCP?
    How do I convert between unix and dos text formats?
    Does samba have wins replication support?

    How can I use samba as a fax server?

    Contributor: Gerhard Zuber

    Requirements:

    UNIX box (Linux preferred) with SAMBA and a faxmodem
    ghostscript package
    mgetty+sendfax package
    pbm package (portable bitmap tools)

    First, install and configure the required packages. Be sure to read the mgetty+sendfax -manual carefully.

    Tools for printing faxes

    Your incomed faxes are in: +manual carefully.

    Tools for printing faxes

    Your incomed faxes are in: /var/spool/fax/incoming. Print it with:

     for i in *
 do
@@ -15,7 +15,7 @@ for printing to HP lasers.
 If you want to produce files for displaying and printing with Windows, use
 some tools from the pbm-package like the following command: g3cat $i | g3topbm - |  ppmtopcx - >$i.pcx
 and view it with your favourite Windows tool (maybe paintbrush)
-

    Making the fax-server

    fetch the file mgetty+sendfax/frontends/winword/faxfilter and place it in /usr/local/etc/mgetty+sendfax/(replace /usr/local/ with whatever place you installed mgetty+sendfax)

    prepare your faxspool file as mentioned in this file +

    Making the fax-server

    fetch the file mgetty+sendfax/frontends/winword/faxfilter and place it in /usr/local/etc/mgetty+sendfax/(replace /usr/local/ with whatever place you installed mgetty+sendfax)

    prepare your faxspool file as mentioned in this file edit fax/faxspool.in and reinstall or change the final /usr/local/bin/faxspool too. 

    @@ -33,7 +33,7 @@ lp3|fax:\
         :sd=/usr/spool/lp3:\
         :if=/usr/local/etc/mgetty+sendfax/faxfilter:sh:sf:mx#0:\
         :lf=/usr/spool/lp3/fax-log:
-

    Now, edit your smb.conf so you have a smb based printer named "fax"

    Installing the client drivers

    +

    Now, edit your smb.conf so you have a smb based printer named "fax"

    Installing the client drivers

    Now you have a printer called "fax" which can be used via TCP/IP-printing (lpd-system) or via SAMBA (windows printing).

    @@ -72,7 +72,7 @@ uses the found number as the fax-destination-number. Now print your fax through the fax-printer and it will be queued for later transmission. Use faxrunq for sending the queue out. -

    Example smb.conf

    +

    Example smb.conf

     [global]
  printcap name = /etc/printcap
  print command = /usr/bin/lpr -r -P %p %s
@@ -88,7 +88,7 @@ queue out.
     create mode = 0700
     browseable = yes
     guest ok = no
-

    Samba doesn't work well together with DHCP!

    +

    Samba doesn't work well together with DHCP!

    We wish to help those folks who wish to use the ISC DHCP Server and provide sample configuration settings. Most operating systems today come ship with the ISC DHCP Server. ISC DHCP is available from: @@ -148,7 +148,7 @@ Server provides only a sub-set of rfc1533 functionality this is hardly an issue in those sites that already have a large investment and commitment to Unix systems and technologies. The current state of the art of the DHCP Server specification in covered in rfc2132. -

    How can I assign NetBIOS names to clients with DHCP?

    +

    How can I assign NetBIOS names to clients with DHCP?

    SMB network clients need to be configured so that all standard TCP/IP name to address resolution works correctly. Once this has been achieved the SMB environment provides additional tools and services that act as helper agents in @@ -163,13 +163,13 @@ This can be done, but needs a few NT registry hacks and you need to be able to speak UNICODE, which is of course no problem for a True Wizzard(tm) :) Instructions on how to do this (including a small util for less capable Wizzards) can be found at -

    http://www.unixtools.org/~nneul/sw/nt/dhcp-netbios-hostname.html

    How do I convert between unix and dos text formats?

    +

    http://www.unixtools.org/~nneul/sw/nt/dhcp-netbios-hostname.html

    How do I convert between unix and dos text formats?

    Jim barry has written an excellent drag-and-drop cr/lf converter for windows. Just drag your file onto the icon and it converts the file.

    The utilities unix2dos and dos2unix(in the mtools package) should do the job under unix. -

    Does samba have wins replication support?

    +

    Does samba have wins replication support?

    At the time of writing there is currently being worked on a wins replication implementation(wrepld).

    Prev Up 
    Chapter 4. Common errors Home 
    diff --git a/docs/faq/FAQ-general.html b/docs/faq/FAQ-general.html index 98b94c3011..b21c27e068 100644 --- a/docs/faq/FAQ-general.html +++ b/docs/faq/FAQ-general.html @@ -1,4 +1,4 @@ -Chapter 1. General Information
    Chapter 1. General Information
    Prev   Next

    Chapter 1. General Information

    Table of Contents

    What do the version numbers mean?
    What platforms are supported?
    How do I subscribe to the Samba Mailing Lists?

    What do the version numbers mean?

    +Chapter 1. General Information

    Chapter 1. General Information
    Prev   Next

    Chapter 1. General Information

    Table of Contents

    What do the version numbers mean?
    What platforms are supported?
    How do I subscribe to the Samba Mailing Lists?

    What do the version numbers mean?

    It is not recommended that you run a version of Samba with the word "alpha" in its name unless you know what you are doing and are willing to do some debugging. Many, many people just get the latest @@ -37,11 +37,11 @@ The above system means that whenever someone looks at the samba ftp site they will be able to grab the highest numbered release without an alpha in the name and be sure of getting the current recommended version. -

    What platforms are supported?

    +

    What platforms are supported?

    Many different platforms have run Samba successfully. The platforms most widely used and thus best tested are Linux and SunOS.

    At time of writing, there is support (or has been support for in earlier versions): -

    A/UX 3.0
    AIX
    Altos Series 386/1000
    Amiga
    Apollo Domain/OS sr10.3
    BSDI
    B.O.S. (Bull Operating System)
    Cray, Unicos 8.0
    Convex
    DGUX.
    DNIX.
    FreeBSD
    HP-UX
    Intergraph.
    Linux with/without shadow passwords and quota
    LYNX 2.3.0
    MachTen (a unix like system for Macintoshes)
    Motorola 88xxx/9xx range of machines
    NetBSD
    NEXTSTEP Release 2.X, 3.0 and greater (including OPENSTEP for Mach).
    OS/2 using EMX 0.9b
    OSF1
    QNX 4.22
    RiscIX.
    RISCOs 5.0B
    SEQUENT.
    SCO (including: 3.2v2, European dist., OpenServer 5)
    SGI.
    SMP_DC.OSx v1.1-94c079 on Pyramid S series
    SONY NEWS, NEWS-OS (4.2.x and 6.1.x)
    SUNOS 4
    SUNOS 5.2, 5.3, and 5.4 (Solaris 2.2, 2.3, and '2.4 and later')
    Sunsoft ISC SVR3V4
    SVR4
    System V with some berkely extensions (Motorola 88k R32V3.2).
    ULTRIX.
    UNIXWARE
    UXP/DS

    How do I subscribe to the Samba Mailing Lists?

    +

    A/UX 3.0
    AIX
    Altos Series 386/1000
    Amiga
    Apollo Domain/OS sr10.3
    BSDI
    B.O.S. (Bull Operating System)
    Cray, Unicos 8.0
    Convex
    DGUX.
    DNIX.
    FreeBSD
    HP-UX
    Intergraph.
    Linux with/without shadow passwords and quota
    LYNX 2.3.0
    MachTen (a unix like system for Macintoshes)
    Motorola 88xxx/9xx range of machines
    NetBSD
    NEXTSTEP Release 2.X, 3.0 and greater (including OPENSTEP for Mach).
    OS/2 using EMX 0.9b
    OSF1
    QNX 4.22
    RiscIX.
    RISCOs 5.0B
    SEQUENT.
    SCO (including: 3.2v2, European dist., OpenServer 5)
    SGI.
    SMP_DC.OSx v1.1-94c079 on Pyramid S series
    SONY NEWS, NEWS-OS (4.2.x and 6.1.x)
    SUNOS 4
    SUNOS 5.2, 5.3, and 5.4 (Solaris 2.2, 2.3, and '2.4 and later')
    Sunsoft ISC SVR3V4
    SVR4
    System V with some berkely extensions (Motorola 88k R32V3.2).
    ULTRIX.
    UNIXWARE
    UXP/DS

    How do I subscribe to the Samba Mailing Lists?

    Look at the samba mailing list page

    Prev Up Next
    Samba FAQ Home Chapter 2. Compiling and installing Samba on a Unix host
    diff --git a/docs/faq/samba-faq.html b/docs/faq/samba-faq.html index 832577fb64..4614418467 100644 --- a/docs/faq/samba-faq.html +++ b/docs/faq/samba-faq.html @@ -1,4 +1,4 @@ -Samba FAQ
    Samba FAQ
       Next

    Samba FAQ

    Samba Team

    October 2002

    Dedication

    +Samba FAQ

    Samba FAQ
       Next

    Samba FAQ

    Samba Team

    October 2002

    Dedication

    This is the Frequently Asked Questions (FAQ) document for Samba, the free and very popular SMB server product. An SMB server allows file and printer connections from clients such as Windows, @@ -7,4 +7,4 @@ corrections to the samba documentation mailinglist at samba-doc@samba.org. This FAQ was based on the old Samba FAQ by Dan Shearer and Paul Blackman, and the old samba text documents which were mostly written by John Terpstra. -

    Table of Contents

    1. General Information
    What do the version numbers mean?
    What platforms are supported?
    How do I subscribe to the Samba Mailing Lists?
    2. Compiling and installing Samba on a Unix host
    My client reports "cannot locate specified share name" or similar
    Why are my file's timestamps off by an hour, or by a few hours?
    3. Specific client application problems
    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"
    How to use a Samba share as an administrative share for MS Office, etc.
    Microsoft Access database opening errors
    4. Common errors
    Not listening for calling name
    System Error 1240
    smbclient ignores -N !
    The data on the CD-Drive I've shared seems to be corrupted!
    5. Features
    How can I use samba as a fax server?
    Tools for printing faxes
    Making the fax-server
    Installing the client drivers
    Example smb.conf
    Samba doesn't work well together with DHCP!
    How can I assign NetBIOS names to clients with DHCP?
    How do I convert between unix and dos text formats?
    Does samba have wins replication support?
       Next
       Chapter 1. General Information
    +

    Table of Contents

    1. General Information
    What do the version numbers mean?
    What platforms are supported?
    How do I subscribe to the Samba Mailing Lists?
    2. Compiling and installing Samba on a Unix host
    My client reports "cannot locate specified share name" or similar
    Why are my file's timestamps off by an hour, or by a few hours?
    3. Specific client application problems
    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"
    How to use a Samba share as an administrative share for MS Office, etc.
    Microsoft Access database opening errors
    4. Common errors
    Not listening for calling name
    System Error 1240
    smbclient ignores -N !
    The data on the CD-Drive I've shared seems to be corrupted!
    5. Features
    How can I use samba as a fax server?
    Tools for printing faxes
    Making the fax-server
    Installing the client drivers
    Example smb.conf
    Samba doesn't work well together with DHCP!
    How can I assign NetBIOS names to clients with DHCP?
    How do I convert between unix and dos text formats?
    Does samba have wins replication support?
       Next
       Chapter 1. General Information
    diff --git a/docs/htmldocs/AccessControls.html b/docs/htmldocs/AccessControls.html index 7330836f36..9a15b01948 100644 --- a/docs/htmldocs/AccessControls.html +++ b/docs/htmldocs/AccessControls.html @@ -1,40 +1,44 @@ -Chapter 13. File, Directory and Share Access Controls
    Chapter 13. File, Directory and Share Access Controls
    Prev Part III. Advanced Configuration Next

    Chapter 13. File, Directory and Share Access Controls

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    drawing
    The Samba Team

    May 10, 2003

    Table of Contents

    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute mapping
    Common Errors
    Users can not write to a public share
    I have set force user but Samba still makes root the owner of all the files I touch!
    MS Word with Samba changes owner of file

    +Chapter 13. File, Directory and Share Access Controls

    Chapter 13. File, Directory and Share Access Controls
    Prev Part III. Advanced Configuration Next

    Chapter 13. File, Directory and Share Access Controls

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    drawing
    The Samba Team

    May 10, 2003

    Table of Contents

    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group-Based Controls
    File and Directory Permissions-Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX Permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing File Ownership
    Viewing File or Directory Permissions
    Modifying File or Directory Permissions
    Interaction with the Standard Samba create mask Parameters
    Interaction with the Standard Samba File Attribute Mapping
    Common Errors
    Users Cannot Write to a Public Share
    File Operations Done as root with force user Set
    MS Word with Samba Changes Owner of File

    + Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of resources shared via Samba do not behave in the manner they might expect. MS Windows network administrators are often confused regarding network access controls and how to -provide users with the access they need while protecting resources from unauthorised access. +provide users with the access they need while protecting resources from unauthorized access.

    Many UNIX administrators are unfamiliar with the MS Windows environment and in particular have difficulty in visualizing what the MS Windows user wishes to achieve in attempts to set file and directory access permissions.

    The problem lies in the differences in how file and directory permissions and controls work -between the two environments. This difference is one that Samba can not completely hide, even +between the two environments. This difference is one that Samba cannot completely hide, even though it does try to bridge the chasm to a degree. -

    +

    + + + POSIX Access Control List technology has been available (along with Extended Attributes) for UNIX for many years, yet there is little evidence today of any significant use. This explains to some extent the slow adoption of ACLs into commercial Linux products. MS Windows -administrators are astounded at this given that ACLs were a foundational capability of the now -decade old MS Windows NT operating system. +administrators are astounded at this, given that ACLs were a foundational capability of the now +decade-old MS Windows NT operating system.

    The purpose of this chapter is to present each of the points of control that are possible with Samba-3 in the hope that this will help the network administrator to find the optimum method for delivering the best environment for MS Windows desktop users.

    This is an opportune point to mention that Samba was created to provide a means of interoperability -and interchange of data between differing operating environments. Samba has no intent change +and interchange of data between differing operating environments. Samba has no intent to change UNIX/Linux into a platform like MS Windows. Instead the purpose was and is to provide a sufficient -level of exchange of data between the two environments. What is available today extends well +level of exchange of data between the two environments. What is available today extends well beyond early plans and expectations, yet the gap continues to shrink. -

    Features and Benefits

    +

    Features and Benefits

    Samba offers a lot of flexibility in file system access management. These are the key access control facilities present in Samba today:

    Samba Access Control Facilities

    • + UNIX File and Directory Permissions

      - Samba honours and implements UNIX file system access controls. Users + Samba honors and implements UNIX file system access controls. Users who access a Samba server will do so as a particular MS Windows user. This information is passed to the Samba server as part of the logon or connection setup process. Samba uses this user identity to validate @@ -44,116 +48,132 @@ beyond early plans and expectations, yet the gap continues to shrink.

    • Samba Share Definitions

      - In configuring share settings and controls in the smb.conf file - the network administrator can exercise over-rides to native file - system permissions and behaviours. This can be handy and convenient - to affect behaviour that is more like what MS Windows NT users expect + In configuring share settings and controls in the smb.conf file, + the network administrator can exercise overrides to native file + system permissions and behaviors. This can be handy and convenient + to effect behavior that is more like what MS Windows NT users expect but it is seldom the best way to achieve this. The basic options and techniques are described herein.

    • Samba Share ACLs +

      Just like it is possible in MS Windows NT to set ACLs on shares themselves, so it is possible to do this in Samba. - Very few people make use of this facility, yet it remains on of the + Few people make use of this facility, yet it remains on of the easiest ways to affect access controls (restrictions) and can often do so with minimum invasiveness compared with other methods.

    • + + MS Windows ACLs through UNIX POSIX ACLs

      - The use of POSIX ACLs on UNIX/Linux is possible ONLY if the underlying + The use of POSIX ACLs on UNIX/Linux is possible only if the underlying operating system supports them. If not, then this option will not be available to you. Current UNIX technology platforms have native support - for POSIX ACLs. There are patches for the Linux kernel that provide - this also. Sadly, few Linux platforms ship today with native ACLs and + for POSIX ACLs. There are patches for the Linux kernel that also provide + this. Sadly, few Linux platforms ship today with native ACLs and Extended Attributes enabled. This chapter has pertinent information for users of platforms that support them. -

    File System Access Controls

    -Perhaps the most important recognition to be made is the simple fact that MS Windows NT4 / 200x / XP +

    File System Access Controls

    +Perhaps the most important recognition to be made is the simple fact that MS Windows NT4/200x/XP implement a totally divergent file system technology from what is provided in the UNIX operating system -environment. Firstly we should consider what the most significant differences are, then we shall look +environment. First we consider what the most significant differences are, then we look at how Samba helps to bridge the differences. -

    MS Windows NTFS Comparison with UNIX File Systems

    +

    MS Windows NTFS Comparison with UNIX File Systems

    + + + + + Samba operates on top of the UNIX file system. This means it is subject to UNIX file system conventions and permissions. It also means that if the MS Windows networking environment requires file system - behaviour that differs from unix file system behaviour then somehow Samba is responsible for emulating + behavior that differs from UNIX file system behavior then somehow Samba is responsible for emulating that in a transparent and consistent manner.

    - It is good news that Samba does this to a very large extent and on top of that provides a high degree - of optional configuration to over-ride the default behaviour. We will look at some of these over-rides, - but for the greater part we will stay within the bounds of default behaviour. Those wishing to explore - to depths of control ability should review the smb.conf man page. -

    File System Feature Comparison

    Name Space

    - MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, UNIX file names - may be 1023 characters long. In MS Windows file extensions indicate particular file types, + It is good news that Samba does this to a large extent and on top of that provides a high degree + of optional configuration to override the default behavior. We look at some of these over-rides, + but for the greater part we will stay within the bounds of default behavior. Those wishing to explore + the depths of control ability should review the smb.conf man page. +

    The following compares file system features for UNIX with those of Microsoft Windows NT/200x: + + +

    Name Space

    + MS Windows NT4/200x/XP files names may be up to 254 characters long, and UNIX file names + may be 1023 characters long. In MS Windows, file extensions indicate particular file types, in UNIX this is not so rigorously observed as all names are considered arbitrary.

    - What MS Windows calls a Folder, UNIX calls a directory. + What MS Windows calls a folder, UNIX calls a directory.

    Case Sensitivity

    - - MS Windows file names are generally upper case if made up of 8.3 (ie: 8 character file name - and 3 character extension. If longer than 8.3 file names are Case Preserving, and Case - Insensitive. + + + MS Windows file names are generally upper case if made up of 8.3 (8 character file name + and 3 character extension. File names that are longer than 8.3 are case preserving and case + insensitive.

    UNIX file and directory names are case sensitive and case preserving. Samba implements the - MS Windows file name behaviour, but it does so as a user application. The UNIX file system + MS Windows file name behavior, but it does so as a user application. The UNIX file system provides no mechanism to perform case insensitive file name lookups. MS Windows does this by default. This means that Samba has to carry the processing overhead to provide features - that are NOT native to the UNIX operating system environment. + that are not native to the UNIX operating system environment.

    - Consider the following, all are unique UNIX names but one single MS Windows file name: - + Consider the following. All are unique UNIX names but one single MS Windows file name: + 

     				MYFILE.TXT
 				MyFile.txt
 				myfile.txt
-		
-		So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in UNIX 
-		they can. So what should Samba do if all three are present? Answer, the one that is lexically
-		first will be accessible to MS Windows users, the others are invisible and unaccessible - any
+

    + So clearly, in an MS Windows file name space these three files cannot co-exist, but in UNIX + they can. +

    + So what should Samba do if all three are present? That which is lexically first will be + accessible to MS Windows users, the others are invisible and unaccessible any other solution would be suicidal.

    Directory Separators

    - MS Windows and DOS uses the back-slash '\' as a directory delimiter, UNIX uses the forward-slash '/' - as it's directory delimiter. This is transparently handled by Samba. + + MS Windows and DOS uses the backslash \ as a directory delimiter, and UNIX uses + the forward-slash / as its directory delimiter. This is handled transparently by Samba.

    Drive Identification

    + MS Windows products support a notion of drive letters, like C: to represent - disk partitions. UNIX has NO concept if separate identifiers for file partitions since each - such file system is mounted to become part of the over-all directory tree. - The UNIX directory tree begins at '/', just like the root of a DOS drive is specified like - C:\. + disk partitions. UNIX has no concept of separate identifiers for file partitions, each + such file system is mounted to become part of the overall directory tree. + The UNIX directory tree begins at / just like the root of a DOS drive is specified as + C:\.

    File Naming Conventions

    - MS Windows generally never experiences file names that begin with a '.', while in UNIX these - are commonly found in a user's home directory. Files that begin with a '.' are typically - either start up files for various UNIX applications, or they may be files that contain + + MS Windows generally never experiences file names that begin with a dot (.) while in UNIX these + are commonly found in a user's home directory. Files that begin with a dot (.) are typically + either start-up files for various UNIX applications, or they may be files that contain start-up configuration data.

    Links and Short-Cuts

    - - - - - MS Windows make use of "links and Short-Cuts" that are actually special types of files that will + + + + MS Windows make use of “links and short-cuts” that are actually special types of files that will redirect an attempt to execute the file to the real location of the file. UNIX knows of file and directory links, but they are entirely different from what MS Windows users are used to.

    - Symbolic links are files in UNIX that contain the actual location of the data (file OR directory). An + Symbolic links are files in UNIX that contain the actual location of the data (file or directory). An operation (like read or write) will operate directly on the file referenced. Symbolic links are also - referred to as 'soft links'. A hard link is something that MS Windows is NOT familiar with. It allows + referred to as “soft links.” A hard link is something that MS Windows is not familiar with. It allows one physical file to be known simultaneously by more than one file name.

    There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort in the process of becoming familiar with UNIX/Linux. These are best left for a text that is dedicated to the - purpose of UNIX/Linux training/education. -

    Managing Directories

    - There are three basic operations for managing directories, create, delete, rename. -

    Table 13.1. Managing directories with unix and windows

    ActionMS Windows CommandUNIX Command
    createmd foldermkdir folder
    deleterd folderrmdir folder
    renamerename oldname newnamemv oldname newname

    -

    File and Directory Access Control

    + purpose of UNIX/Linux training and education. +

    Managing Directories

    + There are three basic operations for managing directories: create, delete, rename. +

    Table 13.1. Managing Directories with UNIX and Windows

    ActionMS Windows CommandUNIX Command
    createmd foldermkdir folder
    deleterd folderrmdir folder
    renamerename oldname newnamemv oldname newname

    +

    File and Directory Access Control

    + The network administrator is strongly advised to read foundational training manuals and reference materials regarding file and directory permissions maintenance. Much can be achieved with the basic UNIX permissions without having to resort to more complex facilities like POSIX Access Control Lists (ACLs) or Extended Attributes (EAs).

    - UNIX/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. - A UNIX file listing looks as follows:- - + UNIX/Linux file and directory access permissions involves setting three primary sets of data and one control set. + A UNIX file listing looks as follows: 

     $ ls -la
 total 632
@@ -174,393 +194,381 @@ drwsrwsrwx    2 maryo   gnomes       48 2003-05-12 22:29 muchado08
 	
    
 	The columns above represent (from left to right): permissions, number of hard links to file, owner, group, size (bytes), access date, access time, file name.
 	
    
-		An overview of the permissions field can be found in the image below.
-	
    Figure 13.1. Overview of unix permissions field
    Overview of unix permissions field
    
-	Any bit flag may be unset. An unset bit flag is the equivalent of 'Can NOT' and is represented as a '-' character.
+		An overview of the permissions field can be found in .
+	
    Figure 13.1. Overview of UNIX permissions field.
    Overview of UNIX permissions field.
    
+	Any bit flag may be unset. An unset bit flag is the equivalent of “cannot” and is represented as a “-” character.
 
-	
    Example 13.1. Example File
    +	
    Example 13.1. Example File
     		-rwxr-x---   Means: The owner (user) can read, write, execute
 		                    the group can read and execute
-		                    everyone else can NOT do anything with it
+		                    everyone else cannot do anything with it.
 		
    
 
 	
    
 	Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = UNIX Domain Socket.
 	
    
-	The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x),
+	The letters rwxXst set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x),
 	execute  only  if  the  file  is a directory or already has execute permission for some user (X), set user or group ID on execution (s),
 	sticky (t).
 	
    
 	When the sticky bit is set on a directory, files in that directory may be unlinked (deleted) or renamed only by root or their owner. 
 	Without the sticky  bit, anyone able to write to the directory can delete or rename files. The sticky bit is commonly found on
-	directories, such as /tmp, that are world-writable.
+	directories, such as /tmp, that are world-writable.
 	
    
 	When the set user or group ID bit (s) is set on a directory, then all files created within it will be owned by the user and/or
-	group whose 'set user or group' bit is set. This can be very helpful in setting up directories that for which it is desired that
+	group whose `set user or group' bit is set. This can be helpful in setting up directories for which it is desired that
 	all users who are in a group should be able to write to and read from a file, particularly when it is undesirable for that file
-	to be exclusively owned by a user who's primary group is not the group that all such users belong to.
+	to be exclusively owned by a user whose primary group is not the group that all such users belong to.
 	
    
 	When a directory is set drw-r----- this means that the owner can read and create (write) files in it, but because
-	the (x) execute flags are not set files can not be listed (seen) in the directory by anyone. The group can read files in the
-	directory but can NOT create new files. NOTE: If files in the directory are set to be readable and writable for the group, then
+	the (x) execute flags are not set, files cannot be listed (seen) in the directory by anyone. The group can read files in the
+	directory but cannot create new files. If files in the directory are set to be readable and writable for the group, then
 	group members will be able to write to (or delete) them.
-

    Share Definition Access Controls

    -The following parameters in the smb.conf file sections that define a share control or affect access controls. -Before using any of the following options please refer to the man page for smb.conf. -

    User and Group Based Controls

    - User and group based controls can prove very useful. In some situations it is distinctly desirable to affect all - file system operations as if a single user is doing this, the use of the force user and - force group behaviour will achieve this. In other situations it may be necessary to affect a - paranoia level of control to ensure that only particular authorised persons will be able to access a share or - it's contents, here the use of the valid users or the invalid users may - be most useful. +

    Share Definition Access Controls

    + +The following parameters in the smb.conf file sections define a share control or effect access controls. +Before using any of the following options, please refer to the man page for smb.conf. +

    User and Group-Based Controls

    + User and group-based controls can prove quite useful. In some situations it is distinctly desirable to affect all + file system operations as if a single user were doing so. The use of the force user and + force group behavior will achieve this. In other situations it may be necessary to effect a + paranoia level of control to ensure that only particular authorized persons will be able to access a share or + its contents. Here the use of the valid users or the + invalid users may be most useful.

    As always, it is highly advisable to use the least difficult to maintain and the least ambiguous method for - controlling access. Remember, that when you leave the scene someone else will need to provide assistance and - if that person finds too great a mess, or if they do not understand what you have done then there is risk of + controlling access. Remember, when you leave the scene someone else will need to provide assistance and + if he finds too great a mess or does not understand what you have done, there is risk of Samba being removed and an alternative solution being adopted. -

    Table 13.2. User and Group Based Controls

    Control ParameterDescription - Action - Notes
    admin users

    +

    + enumerates these controls. +

    Table 13.2. User and Group Based Controls

    Control ParameterDescription - Action - Notes
    admin users

    List of users who will be granted administrative privileges on the share. - They will do all file operations as the super-user (root). + They will do all file operations as the super-user (root). Any user in this list will be able to do anything they like on the share, irrespective of file permissions. -

    force group

    +

    force group

    Specifies a UNIX group name that will be assigned as the default primary group for all users connecting to this service. -

    force user

    +

    force user

    Specifies a UNIX user name that will be assigned as the default user for all users connecting to this service. This is useful for sharing files. Incorrect use can cause security problems. -

    guest ok

    +

    guest ok

    If this parameter is set for a service, then no password is required to connect to the service. Privileges will be those of the guest account. -

    invalid users

    +

    invalid users

    List of users that should not be allowed to login to this service. -

    only user

    +

    only user

    Controls whether connections with usernames not in the user list will be allowed. -

    read list

    +

    read list

    List of users that are given read-only access to a service. Users in this list will not be given write access, no matter what the read only option is set to. -

    username

    - Refer to the smb.conf man page for more information - this is a complex and potentially misused parameter. -

    valid users

    +

    username

    + Refer to the smb.conf man page for more information -- this is a complex and potentially misused parameter. +

    valid users

    List of users that should be allowed to login to this service. -

    write list

    +

    write list

    List of users that are given read-write access to a service. -

    File and Directory Permissions Based Controls

    - The following file and directory permission based controls, if misused, can result in considerable difficulty to - diagnose the cause of mis-configuration. Use them sparingly and carefully. By gradually introducing each one by one - undesirable side-effects may be detected. In the event of a problem, always comment all of them out and then gradually - re-introduce them in a controlled fashion. -

    Table 13.3. File and Directory Permission Based Controls

    Control ParameterDescription - Action - Notes
    create mask

    +

    File and Directory Permissions-Based Controls

    + The following file and directory permission-based controls, if misused, can result in considerable difficulty to + diagnose causes of misconfiguration. Use them sparingly and carefully. By gradually introducing each one by one, + undesirable side effects may be detected. In the event of a problem, always comment all of them out and then gradually + reintroduce them in a controlled way. +

    + Refer to for information regarding the parameters that may be used to affect file and + directory permission-based access controls. +

    Table 13.3. File and Directory Permission Based Controls

    Control ParameterDescription - Action - Notes
    create mask

    Refer to the smb.conf man page. -

    directory mask

    +

    directory mask

    The octal modes used when converting DOS modes to UNIX modes when creating UNIX directories. See also: directory security mask. -

    dos filemode

    +

    dos filemode

    Enabling this parameter allows a user who has write access to the file to modify the permissions on it. -

    force create mode

    +

    force create mode

    This parameter specifies a set of UNIX mode bit permissions that will always be set on a file created by Samba. -

    force directory mode

    +

    force directory mode

    This parameter specifies a set of UNIX mode bit permissions that will always be set on a directory created by Samba. -

    force directory security mode

    - Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory -

    force security mode

    +

    force directory security mode

    + Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory. +

    force security mode

    Controls UNIX permission bits modified when a Windows NT client manipulates UNIX permissions. -

    hide unreadable

    +

    hide unreadable

    Prevents clients from seeing the existence of files that cannot be read. -

    hide unwriteable files

    +

    hide unwriteable files

    Prevents clients from seeing the existence of files that cannot be written to. Unwriteable directories are shown as usual. -

    nt acl support

    +

    nt acl support

    This parameter controls whether smbd will attempt to map UNIX permissions into Windows NT access control lists. -

    security mask

    +

    security mask

    Controls UNIX permission bits modified when a Windows NT client is manipulating the UNIX permissions on a file. -

    Miscellaneous Controls

    +

    Miscellaneous Controls

    The following are documented because of the prevalence of administrators creating inadvertent barriers to file - access by not understanding the full implications of smb.conf file settings. -

    Table 13.4. Other Controls

    Control ParameterDescription - Action - Notes
    case sensitive, default case, short preserve case

    + access by not understanding the full implications of smb.conf file settings. See . +

    Table 13.4. Other Controls

    Control ParameterDescription - Action - Notes
    case sensitive, default case, short preserve case

    This means that all file name lookup will be done in a case sensitive manner. - Files will be created with the precise filename Samba received from the MS Windows client. -

    csc policy

    + Files will be created with the precise file name Samba received from the MS Windows client. +

    csc policy

    Client Side Caching Policy - parallels MS Windows client side file caching capabilities. -

    dont descend

    - Allows to specify a comma-delimited list of directories that the server should always show as empty. -

    dos filetime resolution

    +

    dont descend

    + Allows specifying a comma-delimited list of directories that the server should always show as empty. +

    dos filetime resolution

    This option is mainly used as a compatibility option for Visual C++ when used against Samba shares. -

    dos filetimes

    - DOS and Windows allows users to change file time stamps if they can write to the file. POSIX semantics prevent this. - This options allows DOS and Windows behaviour. -

    fake oplocks

    +

    dos filetimes

    + DOS and Windows allow users to change file time stamps if they can write to the file. POSIX semantics prevent this. + This option allows DOS and Windows behavior. +

    fake oplocks

    Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an - oplock then the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. -

    hide dot files, hide files, veto files

    + oplock, the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. +

    hide dot files, hide files, veto files

    Note: MS Windows Explorer allows over-ride of files marked as hidden so they will still be visible. -

    read only

    +

    read only

    If this parameter is yes, then users of a service may not create or modify files in the service's directory. -

    veto files

    +

    veto files

    List of files and directories that are neither visible nor accessible. -

    Access Controls on Shares

    +

    Access Controls on Shares

    + This section deals with how to configure Samba per share access control restrictions. By default, Samba sets no restrictions on the share itself. Restrictions on the share itself - can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can + can be set on MS Windows NT4/200x/XP shares. This can be an effective way to limit who can connect to a share. In the absence of specific restrictions the default setting is to allow - the global user Everyone Full Control (ie: Full control, Change and Read). + the global user Everyone - Full Control (full control, change and read).

    - At this time Samba does NOT provide a tool for configuring access control setting on the Share + At this time Samba does not provide a tool for configuring access control setting on the share itself. Samba does have the capacity to store and act on access control settings, but the only way to create those settings is to use either the NT4 Server Manager or the Windows 200x MMC for Computer Management.

    Samba stores the per share access control settings in a file called share_info.tdb. - The location of this file on your system will depend on how samba was compiled. The default location + The location of this file on your system will depend on how Samba was compiled. The default location for Samba's tdb files is under /usr/local/samba/var. If the tdbdump utility has been compiled and installed on your system, then you can examine the contents of this file - by: tdbdump share_info.tdb. -

    Share Permissions Management

    + by executing: tdbdump share_info.tdb in the directory containing the tdb files. +

    Share Permissions Management

    The best tool for the task is platform dependant. Choose the best tool for your environment. -

    Windows NT4 Workstation/Server

    +

    Windows NT4 Workstation/Server

    The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. - You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below. + You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft see details below.

    Procedure 13.1. Instructions

    1. - Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu - select Computer, then click on the Shared Directories entry. + Launch the NT4 Server Manager, click on the Samba server you want to administer. From the menu + select Computer, then click on Shared Directories.

    2. - Now click on the share that you wish to manage, then click on the Properties tab, next click on + Click on the share that you wish to manage, then click the Properties tab. then click the Permissions tab. Now you can add or change access control settings as you wish. -

    Windows 200x/XP

    +

    Windows 200x/XP

    On MS Windows NT4/200x/XP system access control lists on the share itself are set using native - tools, usually from file manager. For example, in Windows 200x: right click on the shared folder, + tools, usually from File Manager. For example, in Windows 200x, right click on the shared folder, then select Sharing, then click on Permissions. The default - Windows NT4/200x permission allows Everyone Full Control on the Share. + Windows NT4/200x permission allows “Everyone” full control on the share.

    - MS Windows 200x and later all comes with a tool called the Computer Management snap-in for the - Microsoft Management Console (MMC). This tool is located by clicking on Control Panel -> - Administrative Tools -> Computer Management. + MS Windows 200x and later versions come with a tool called the Computer Management snap-in for the + Microsoft Management Console (MMC). This tool is located by clicking on Control Panel -> + Administrative Tools -> Computer Management.

    Procedure 13.2. Instructions

    1. - After launching the MMC with the Computer Management snap-in, click on the menu item Action, - select Connect to another computer. If you are not logged onto a domain you will be prompted - to enter a domain login user identifier and a password. This will authenticate you to the domain. - If you where already logged in with administrative privilege this step is not offered. + After launching the MMC with the Computer Management snap-in, click the menu item Action, + and select Connect to another computer. If you are not logged onto a domain you will be prompted + to enter a domain login user identifier and a password. This will authenticate you to the domain. + If you are already logged in with administrative privilege, this step is not offered.

    2. - If the Samba server is not shown in the Select Computer box, then type in the name of the target - Samba server in the field Name:. Now click on the [+] next to + If the Samba server is not shown in the Select Computer box, type in the name of the target + Samba server in the field Name:. Now click the on [+] next to System Tools, then on the [+] next to Shared Folders in the left panel.

    3. - Now in the right panel, double-click on the share you wish to set access control permissions on. - Then click on the tab Share Permissions. It is now possible to add access control entities - to the shared folder. Do NOT forget to set what type of access (full control, change, read) you + In the right panel, double-click on the share on which you wish to set access control permissions. + Then click the tab Share Permissions. It is now possible to add access control entities + to the shared folder. Remember to set what type of access (full control, change, read) you wish to assign for each entry.

    Warning

    - Be careful. If you take away all permissions from the Everyone user without removing this user - then effectively no user will be able to access the share. This is a result of what is known as - ACL precedence. ie: Everyone with no access means that MaryK who is part of the group - Everyone will have no access even if this user is given explicit full control access. -

    MS Windows Access Control Lists and UNIX Interoperability

    Managing UNIX permissions Using NT Security Dialogs

    + Be careful. If you take away all permissions from the Everyone user without removing this user, + effectively no user will be able to access the share. This is a result of what is known as + ACL precedence. Everyone with no access means that MaryK who is part of the group + Everyone will have no access even if she is given explicit full control access. +

    MS Windows Access Control Lists and UNIX Interoperability

    Managing UNIX Permissions Using NT Security Dialogs

    + Windows NT clients can use their native security settings dialog box to view and modify the underlying UNIX permissions.

    - Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and + This ability is careful not to compromise the security of the UNIX host on which Samba is running, and still obeys all the file permission rules that a Samba administrator can set.

    - Samba does not attempt to go beyond POSIX ACLs, so that the various finer-grained access control - options provided in Windows are actually ignore. + Samba does not attempt to go beyond POSIX ACLs, so the various finer-grained access control + options provided in Windows are actually ignored.

    Note

    All access to UNIX/Linux system files via Samba is controlled by the operating system file access controls. - When trying to figure out file access problems it is vitally important to find the identity of the Windows + When trying to figure out file access problems, it is vitally important to find the identity of the Windows user as it is presented by Samba at the point of file access. This can best be determined from the Samba log files. -

    Viewing File Security on a Samba Share

    - From an NT4/2000/XP client, single-click with the right mouse button on any file or directory in a Samba - mounted drive letter or UNC path. When the menu pops-up, click on the Properties - entry at the bottom of the menu. This brings up the file properties dialog box. Click on the tab - Security and you will see three buttons, Permissions, +

    Viewing File Security on a Samba Share

    + From an NT4/2000/XP client, right click on any file or directory in a Samba-mounted drive letter + or UNC path. When the menu pops up, click on the Properties entry at the bottom + of the menu. This brings up the file Properties dialog box. Click on the + Security tab and you will see three buttons: Permissions, Auditing, and Ownership. The Auditing - button will cause either an error message A requested privilege is not held by the client + button will cause either an error message `A requested privilege is not held by the client' to appear if the user is not the NT Administrator, or a dialog which is intended to allow an Administrator to add auditing requirements to a file if the user is logged on as the NT Administrator. This dialog is non-functional with a Samba share at this time, as the only useful button, the Add - button will not currently allow a list of users to be seen. -

    Viewing file ownership

    + button, will not currently allow a list of users to be seen. +

    Viewing File Ownership

    Clicking on the Ownership button brings up a dialog box telling you who owns - the given file. The owner name will be of the form: + the given file. The owner name will be displayed like this:

    - "SERVER\user (Long name)" + “SERVER\user (Long name)”

    - Where SERVER is the NetBIOS name of the Samba server, user + SERVER is the NetBIOS name of the Samba server, user is the user name of the UNIX user who owns the file, and (Long name) is the descriptive string identifying the user (normally found in the GECOS field of the UNIX password database). Click on the Close button to remove this dialog.

    - If the parameter nt acl support is set to false - then the file owner will be shown as the NT user "Everyone". + If the parameter nt acl support is set to false, + the file owner will be shown as the NT user Everyone.

    The Take Ownership button will not allow you to change the ownership of this file to - yourself (clicking on it will display a dialog box complaining that the user you are currently logged onto + yourself (clicking it will display a dialog box complaining that the user you are currently logged onto the NT client cannot be found). The reason for this is that changing the ownership of a file is a privileged operation in UNIX, available only to the root user. As clicking on this button causes - NT to attempt to change the ownership of a file to the current user logged into the NT client this will + NT to attempt to change the ownership of a file to the current user logged into the NT clienti, this will not work with Samba at this time.

    - There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected + There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected to a Samba server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS or Samba drive. This is available as part of the Seclib NT security library written - by Jeremy Allison of the Samba-Team, available from the main Samba FTP site.

    Viewing File or Directory Permissions

    + by Jeremy Allison of the Samba Team, and is available from the main Samba FTP site.

    Viewing File or Directory Permissions

    The third button is the Permissions button. Clicking on this brings up a dialog box - that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed in the form: -

    "SERVER\ + that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed like this: +

    SERVER\ user - (Long name)"

    Where SERVER is the NetBIOS name of the Samba server, + (Long name)

    Where SERVER is the NetBIOS name of the Samba server, user is the user name of the UNIX user who owns the file, and (Long name) is the descriptive string identifying the user (normally found in the GECOS field of the UNIX password database).

    - If the parameter nt acl support is set to false - then the file owner will be shown as the NT user "Everyone" and the permissions will be - shown as NT "Full Control". + If the parameter nt acl support is set to false, + the file owner will be shown as the NT user Everyone and the permissions will be + shown as NT “Full Control”.

    The permissions field is displayed differently for files and directories, so I'll describe the way file permissions are displayed first. -

    File Permissions

    The standard UNIX user/group/world triplet and - the corresponding "read", "write", "execute" permissions - triplets are mapped by Samba into a three element NT ACL - with the 'r', 'w', and 'x' bits mapped into the corresponding - NT permissions. The UNIX world permissions are mapped into - the global NT group Everyone, followed - by the list of permissions allowed for UNIX world. The UNIX - owner and group permissions are displayed as an NT - user icon and an NT local - group icon respectively followed by the list - of permissions allowed for the UNIX user and group.

    As many UNIX permission sets don't map into common - NT names such as read, - "change" or full control then - usually the permissions will be prefixed by the words - "Special Access" in the NT display list.

    But what happens if the file has no permissions allowed - for a particular UNIX user group or world component? In order - to allow "no permissions" to be seen and modified then Samba - overloads the NT "Take Ownership" ACL attribute - (which has no meaning in UNIX) and reports a component with - no permissions as having the NT "O" bit set. - This was chosen of course to make it look like a zero, meaning - zero permissions. More details on the decision behind this will - be given below.

    Directory Permissions

    Directories on an NT NTFS file system have two - different sets of permissions. The first set of permissions - is the ACL set on the directory itself, this is usually displayed - in the first set of parentheses in the normal "RW" - NT style. This first set of permissions is created by Samba in - exactly the same way as normal file permissions are, described - above, and is displayed in the same way.

    The second set of directory permissions has no real meaning - in the UNIX permissions world and represents the - inherited permissions that any file created within - this directory would inherit.

    Samba synthesises these inherited permissions for NT by - returning as an NT ACL the UNIX permission mode that a new file - created by Samba on this share would receive.

    Modifying file or directory permissions

    Modifying file and directory permissions is as simple +

    File Permissions

    The standard UNIX user/group/world triplet and the corresponding read, write, execute permissions + triplets are mapped by Samba into a three element NT ACL with the “r”, “w” and “x” bits mapped into the corresponding + NT permissions. The UNIX world permissions are mapped into the global NT group Everyone, followed + by the list of permissions allowed for UNIX world. The UNIX owner and group permissions are displayed as an NT + user icon and an NT local group icon, respectively, followed by the list + of permissions allowed for the UNIX user and group.

    Because many UNIX permission sets do not map into common NT names such as read, + change or full control, usually the permissions will be prefixed + by the words Special Access in the NT display list.

    But what happens if the file has no permissions allowed for a particular UNIX user group or world component? In order + to allow “no permissions” to be seen and modified Samba then overloads the NT Take Ownership ACL attribute + (which has no meaning in UNIX) and reports a component with no permissions as having the NT O bit set. + This was chosen, of course, to make it look like a zero, meaning zero permissions. More details on the decision behind this is + given below.

    Directory Permissions

    Directories on an NT NTFS file system have two different sets of permissions. The first set is the ACL set on the + directory itself, which is usually displayed in the first set of parentheses in the normal RW + NT style. This first set of permissions is created by Samba in exactly the same way as normal file permissions are, described + above, and is displayed in the same way.

    The second set of directory permissions has no real meaning in the UNIX permissions world and represents the + inherited permissions that any file created within this directory would inherit.

    Samba synthesises these inherited permissions for NT by returning as an NT ACL the UNIX permission mode that a new file + created by Samba on this share would receive.

    Modifying File or Directory Permissions

    Modifying file and directory permissions is as simple as changing the displayed permissions in the dialog box, and - clicking the OK button. However, there are + clicking on OK. However, there are limitations that a user needs to be aware of, and also interactions with the standard Samba permission masks and mapping of DOS - attributes that need to also be taken into account.

    If the parameter nt acl support - is set to false then any attempt to set - security permissions will fail with an "Access Denied" - message.

    The first thing to note is that the "Add" + attributes that need to also be taken into account.

    If the parameter nt acl support + is set to false, any attempt to set + security permissions will fail with an `Access Denied' + message.

    The first thing to note is that the Add button will not return a list of users in Samba (it will give - an error message of The remote procedure call failed - and did not execute). This means that you can only + an error message saying `The remote procedure call failed + and did not execute'). This means that you can only manipulate the current user/group/world permissions listed in the dialog box. This actually works quite well as these are the only permissions that UNIX actually has.

    If a permission triplet (either user, group, or world) is removed from the list of permissions in the NT dialog box, then when the OK button is pressed it will - be applied as "no permissions" on the UNIX side. If you then - view the permissions again the "no permissions" entry will appear - as the NT "O" flag, as described above. This + be applied as “no permissions” on the UNIX side. If you then + view the permissions again, the “no permissions” entry will appear + as the NT O flag, as described above. This allows you to add permissions back to a file or directory once - you have removed them from a triplet component.

    As UNIX supports only the "r", "w" and "x" bits of - an NT ACL then if other NT security attributes such as "Delete - access" are selected then they will be ignored when applied on - the Samba server.

    When setting permissions on a directory the second + you have removed them from a triplet component.

    As UNIX supports only the “r”, “w” and “x” bits of + an NT ACL, if other NT security attributes such as Delete Access are + selected they will be ignored when applied on the Samba server.

    When setting permissions on a directory, the second set of permissions (in the second set of parentheses) is by default applied to all files within that directory. If this - is not what you want you must uncheck the Replace + is not what you want, you must uncheck the Replace permissions on existing files checkbox in the NT - dialog before clicking OK.

    If you wish to remove all permissions from a - user/group/world component then you may either highlight the - component and click the Remove button, + dialog before clicking on OK.

    If you wish to remove all permissions from a + user/group/world component, you may either highlight the + component and click on the Remove button, or set the component to only have the special Take - Ownership permission (displayed as "O" - ) highlighted.

    Interaction with the standard Samba create mask - parameters

    There are four parameters - to control interaction with the standard Samba create mask parameters. - These are : + Ownership permission (displayed as O + ) highlighted.

    Interaction with the Standard Samba “create mask” Parameters

    There are four parameters that control interaction with the standard Samba create mask parameters. + These are: -

    • security mask

    • force security mode

    • directory security mask

    • force directory security mode

    +

    • security mask
    • force security mode
    • directory security mask
    • force directory security mode

    -

    Once a user clicks OK to apply the - permissions Samba maps the given permissions into a user/group/world - r/w/x triplet set, and then will check the changed permissions for a +

    Once a user clicks on OK to apply the + permissions, Samba maps the given permissions into a user/group/world + r/w/x triplet set, and then checks the changed permissions for a file against the bits set in the - security mask parameter. Any bits that - were changed that are not set to '1' in this parameter are left alone - in the file permissions.

    Essentially, zero bits in the security mask - mask may be treated as a set of bits the user is not + security mask parameter. Any bits that + were changed that are not set to “1” in this parameter are left alone + in the file permissions.

    Essentially, zero bits in the security mask + may be treated as a set of bits the user is not allowed to change, and one bits are those the user is allowed to change. -

    If not set explicitly this parameter is set to the same value as - the create mask parameter. To allow a user to modify all the - user/group/world permissions on a file, set this parameter - to 0777.

    Next Samba checks the changed permissions for a file against - the bits set in the - force security mode parameter. Any bits - that were changed that correspond to bits set to '1' in this parameter - are forced to be set.

    Essentially, bits set in the force security mode - parameter may be treated as a set of bits that, when - modifying security on a file, the user has always set to be 'on'.

    If not set explicitly this parameter is set to the same value - as the force create mode parameter. +

    If not explicitly set, this parameter defaults to the same value as + the create mask parameter. To allow a user to modify all the + user/group/world permissions on a file, set this parameter to 0777. +

    Next Samba checks the changed permissions for a file against the bits set in the + force security mode parameter. Any bits + that were changed that correspond to bits set to “1” in this parameter + are forced to be set.

    Essentially, bits set in the force security mode parameter + may be treated as a set of bits that, when modifying security on a file, the user has always set to be “on”.

    If not explicitly set, this parameter defaults to the same value + as the force create mode parameter. To allow a user to modify all the user/group/world permissions on a file - with no restrictions set this parameter to 000.

    The security mask and force + with no restrictions set this parameter to 000. The + security mask and force security mode parameters are applied to the change - request in that order.

    For a directory Samba will perform the same operations as - described above for a file except using the parameter + request in that order.

    For a directory, Samba will perform the same operations as + described above for a file except it uses the parameter directory security mask instead of security mask, and force directory security mode parameter instead of force security mode - .

    The directory security mask parameter + .

    The directory security mask parameter by default is set to the same value as the directory mask parameter and the force directory security mode parameter by default is set to the same value as - the force directory mode parameter.

    In this way Samba enforces the permission restrictions that - an administrator can set on a Samba share, whilst still allowing users + the force directory mode parameter. + In this way Samba enforces the permission restrictions that + an administrator can set on a Samba share, while still allowing users to modify the permission bits within that restriction.

    If you want to set up a share that allows users full control in modifying the permission bits on their files and directories and - doesn't force any particular bits to be set 'on', then set the following - parameters in the smb.conf file in that share specific section : -

    security mask = 0777
    force security mode = 0
    directory security mask = 0777
    force directory security mode = 0

    Interaction with the standard Samba file attribute mapping

    Note

    Samba maps some of the DOS attribute bits (such as "read - only") into the UNIX permissions of a file. This means there can + does not force any particular bits to be set “on”, then set the following + parameters in the smb.conf file in that share-specific section: +

    security mask = 0777
    force security mode = 0
    directory security mask = 0777
    force directory security mode = 0

    Interaction with the Standard Samba File Attribute Mapping

    Note

    Samba maps some of the DOS attribute bits (such as “read + only”) into the UNIX permissions of a file. This means there can be a conflict between the permission bits set via the security dialog and the permission bits set by the file attribute mapping. -

    One way this can show up is if a file has no UNIX read access - for the owner it will show up as "read only" in the standard - file attributes tabbed dialog. Unfortunately this dialog is - the same one that contains the security info in another tab.

    What this can mean is that if the owner changes the permissions - to allow themselves read access using the security dialog, clicks +

    If a file has no UNIX read access for the owner, it will show up + as “read only” in the standard file attributes tabbed dialog. + Unfortunately, this dialog is the same one that contains the security information + in another tab.

    What this can mean is that if the owner changes the permissions + to allow himself read access using the security dialog, clicks on OK to get back to the standard attributes tab - dialog, and then clicks OK on that dialog, then + dialog, and clicks on OK on that dialog, then NT will set the file permissions back to read-only (as that is what the attributes still say in the dialog). This means that after setting - permissions and clicking OK to get back to the - attributes dialog you should always hit Cancel + permissions and clicking on OK to get back to the + attributes dialog, you should always press Cancel rather than OK to ensure that your changes - are not overridden.

    Common Errors

    -File, Directory and Share access problems are very common on the mailing list. The following + are not overridden.

    Common Errors

    +File, directory and share access problems are common on the mailing list. The following are examples taken from the mailing list in recent times. -

    Users can not write to a public share

    +

    Users Cannot Write to a Public Share

    “ - We are facing some troubles with file / directory permissions. I can log on the domain as admin user(root), - and there's a public share, on which everyone needs to have permission to create / modify files, but only - root can change the file, no one else can. We need to constantly go to server to + We are facing some troubles with file/directory permissions. I can log on the domain as admin user(root), + and there's a public share on which everyone needs to have permission to create/modify files, but only + root can change the file, no one else can. We need to constantly go to the server to chgrp -R users * and chown -R nobody * to allow others users to change the file. ”

    - There are many ways to solve this problem, here are a few hints: + There are many ways to solve this problem and here are a few hints:

    1. - Go to the top of the directory that is shared + Go to the top of the directory that is shared.

    2. Set the ownership to what ever public owner and group you want 

      @@ -570,7 +578,7 @@ are examples taken from the mailing list in recent times.
 $ find 'directory_name' -type f -exec chown user.group {}\;

      Note

      - The above will set the 'sticky bit' on all directories. Read your + The above will set the sticky bit on all directories. Read your UNIX/Linux man page on what that does. It causes the OS to assign to all files created in the directories the ownership of the directory. @@ -580,10 +588,13 @@ are examples taken from the mailing list in recent times. 

       $ chown jack.engr /foodbar

      -

      Note

      This is the same as doing:

      +			
      Note
      
+				
      This is the same as doing:
      
+
       $ chown jack /foodbar
 $ chgrp engr /foodbar
-

    3. Now do: +

      +

  • Now type: 

     $ chmod 6775 /foodbar
@@ -594,7 +605,7 @@ are examples taken from the mailing list in recent times.
 
     drwsrwsr-x  2 jack  engr    48 2003-02-04 09:55 foodbar
 
    
-

  • Now do: +

  • Now type: 

     $ su - jill
 $ cd /foodbar
@@ -611,31 +622,31 @@ drwsrwsr-x  2 jack  engr    48 2003-02-04 09:55 foodbar
 		Now in your smb.conf for the share add:
 		
    force create mode = 0775
    force direcrtory mode = 6775
    
 		
    Note
    
-		The above are only needed if your users are not members of the group
-		you have used. ie: Within the OS do not have write permission on the directory.
+		These procedures are needed only if your users are not members of the group
+		you have used. That is if within the OS do not have write permission on the directory.
 		
    
 		An alternative is to set in the smb.conf entry for the share:
 		
    force user = jack
    force group = engr
    
-

    • I have set force user but Samba still makes root the owner of all the files I touch!

    - When you have a user in admin users, samba will always do file operations for - this user as root, even if force user has been set. -

    MS Word with Samba changes owner of file

    - Question: “When userB saves a word document that is owned by userA the updated file is now owned by userB. +

    File Operations Done as root with force user Set

    + When you have a user in admin users, Samba will always do file operations for + this user as root, even if force user has been set. +

    MS Word with Samba Changes Owner of File

    + Question: “When user B saves a word document that is owned by user A the updated file is now owned by user B. Why is Samba doing this? How do I fix this?”

    - Answer: Word does the following when you modify/change a Word document: Word Creates a NEW document with + Answer: Word does the following when you modify/change a Word document: MS Word creates a NEW document with a temporary name, Word then closes the old document and deletes it, Word then renames the new document to the original document name. - There is NO mechanism by which Samba CAN IN ANY WAY know that the new document really should be owned by the owners - of the original file. Samba has no way of knowing that the file will be renamed by MS Word. As far as Samba is able + There is no mechanism by which Samba can in any way know that the new document really should be owned by the owners + of the original file. Samba has no way of knowing that the file will be renamed by MS Word. As far as Samba is able to tell, the file that gets created is a NEW file, not one that the application (Word) is updating.

    There is a work-around to solve the permissions problem. That work-around involves understanding how you can manage file - system behaviour from within the smb.conf file, as well as understanding how Unix file systems work. Set on the directory - in which you are changing word documents: chmod g+s 'directory_name' This ensures that all files will - be created with the group that owns the directory. In smb.conf share declaration section set: + system behavior from within the smb.conf file, as well as understanding how UNIX file systems work. Set on the directory + in which you are changing Word documents: chmod g+s `directory_name' This ensures that all files will + be created with the group that owns the directory. In smb.conf share declaration section set:

    force create mode = 0660
    force directory mode = 0770

    These two settings will ensure that all directories and files that get created in the share will be read/writable by the owner and group set on the directory itself. -

    Prev Up Next
    Chapter 12. Mapping MS Windows and UNIX Groups Home Chapter 14. File and Record Locking
    +

    Prev Up Next
    Chapter 12. Group Mapping MS Windows and UNIX Home Chapter 14. File and Record Locking
    diff --git a/docs/htmldocs/AdvancedNetworkManagement.html b/docs/htmldocs/AdvancedNetworkManagement.html index 1052f45e92..aa13cd37ee 100644 --- a/docs/htmldocs/AdvancedNetworkManagement.html +++ b/docs/htmldocs/AdvancedNetworkManagement.html @@ -1,137 +1,132 @@ -Chapter 22. Advanced Network Management
    Chapter 22. Advanced Network Management
    Prev Part III. Advanced Configuration Next

    Chapter 22. Advanced Network Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors

    +Chapter 22. Advanced Network Management

    Chapter 22. Advanced Network Management
    Prev Part III. Advanced Configuration Next

    Chapter 22. Advanced Network Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachine.Com
    Network Logon Script Magic
    Adding Printers without User Intervention

    This section documents peripheral issues that are of great importance to network administrators who want to improve network resource access control, to automate the user -environment, and to make their lives a little easier. -

    Features and Benefits

    +environment and to make their lives a little easier. +

    Features and Benefits

    Often the difference between a working network environment and a well appreciated one can -best be measured by the little things that makes everything work more -harmoniously. A key part of every network environment solution is the ability to remotely -manage MS Windows workstations, to remotely access the Samba server, to provide customised -logon scripts, as well as other house keeping activities that help to sustain more reliable +best be measured by the little things that make everything work more +harmoniously. A key part of every network environment solution is the +ability to remotely +manage MS Windows workstations, remotely access the Samba server, provide customized +logon scripts, as well as other housekeeping activities that help to sustain more reliable network operations.

    -This chapter presents information on each of these area. They are placed here, and not in +This chapter presents information on each of these areas. They are placed here, and not in other chapters, for ease of reference. -

    Remote Server Administration

    -How do I get 'User Manager' and 'Server Manager'? +

    Remote Server Administration

    “How do I get `User Manager' and `Server Manager'?”

    + + + +Since I do not need to buy an NT4 Server, how do I get the `User Manager for Domains' +and the `Server Manager'?

    - Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains', -the 'Server Manager'? + +Microsoft distributes a version of these tools called Nexus.exe for installation +on Windows 9x/Me systems. The tools set includes: +

    • Server Manager
    • User Manager for Domains
    • Event Viewer

    +Download the archived file at ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE.

    -Microsoft distributes a version of these tools called nexus for installation -on Windows 9x / Me systems. The tools set includes: -

    Server Manager
    User Manager for Domains
    Event Viewer

    -Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE -

    -The Windows NT 4.0 version of the 'User Manager for -Domains' and 'Server Manager' are available from Microsoft via ftp -from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE -

    Remote Desktop Management

    + +The Windows NT 4.0 version of the `User Manager for +Domains' and `Server Manager' are available from Microsoft via ftp. +

    Remote Desktop Management

    There are a number of possible remote desktop management solutions that range from free -through costly. Do not let that put you off. Sometimes the most costly solutions is the +through costly. Do not let that put you off. Sometimes the most costly solution is the most cost effective. In any case, you will need to draw your own conclusions as to which is the best tool in your network environment. -

    Remote Management from NoMachines.Com

    +

    Remote Management from NoMachine.Com

    + The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003. It is presented in slightly edited form (with author details omitted for privacy reasons). The entire answer is reproduced below with some comments removed. -

    -

    -> I have a wonderful linux/samba server running as PDC for a network.
-> Now I would like to add remote desktop capabilities so that
-> users outside could login to the system and get their desktop up from
-> home or another country..
->
-> Is there a way to accomplish this? Do I need a windows terminal server?
-> Do I need to configure it so that it is a member of the domain or a
-> BDC,PDC? Are there any hacks for MS Windows XP to enable remote login
-> even if the computer is in a domain?
->
-> Any ideas/experience would be appreciated :)
-

    -

    - Answer provided: Check out the new offer from NoMachine, "NX" software: - http://www.nomachine.com/. -

    - It implements a very easy-to-use interface to the remote X protocol as +

    “ + I have a wonderful Linux/Samba server running as pdc for a network. Now I would like to add remote + desktop capabilities so users outside could login to the system and get their desktop up from home or + another country. + ”

    “ + Is there a way to accomplish this? Do I need a Windows Terminal Server? Do I need to configure it so + it is a member of the domain or a BDC,PDC? Are there any hacks for MS Windows XP to enable remote login + even if the computer is in a domain? + ”

    + Answer provided: Check out the new offer from NoMachine, “NX” software: + http://www.nomachine.com/. +

    + It implements an easy-to-use interface to the Remote X protocol as well as incorporating VNC/RFB and rdesktop/RDP into it, but at a speed - performance much better than anything you may have ever seen... + performance much better than anything you may have ever seen.

    - Remote X is not new at all -- but what they did achieve successfully is - a new way of compression and caching technologies which makes the thing + Remote X is not new at all, but what they did achieve successfully is + a new way of compression and caching technologies that makes the thing fast enough to run even over slow modem/ISDN connections.

    - I could test drive their (public) RedHat machine in Italy, over a loaded - internet connection, with enabled thumbnail previews in KDE konqueror - which popped up immediately on "mouse-over". From inside that (remote X) + I could test drive their (public) Red Hat machine in Italy, over a loaded + Internet connection, with enabled thumbnail previews in KDE konqueror + which popped up immediately on “mouse-over”. From inside that (remote X) session I started a rdesktop session on another, a Windows XP machine. - To test the performance, I played Pinball. I am proud to announce here - that my score was 631750 points at first try... + To test the performance, I played Pinball. I am proud to announce + that my score was 631750 points at first try.

    - NX performs better on my local LAN than any of the other "pure" + NX performs better on my local LAN than any of the other “pure” connection methods I am using from time to time: TightVNC, rdesktop or - remote X. It is even faster than a direct crosslink connection between + Remote X. It is even faster than a direct crosslink connection between two nodes.

    - I even got sound playing from the remote X app to my local boxes, and - had a working "copy'n'paste" from an NX window (running a KDE session - in Italy) to my Mozilla mailing agent... These guys are certainly doing + I even got sound playing from the Remote X app to my local boxes, and + had a working “copy'n'paste” from an NX window (running a KDE session + in Italy) to my Mozilla mailing agent. These guys are certainly doing something right!

    - I recommend to test drive NX to anybody with a only a remote interest - in remote computing - http://www.nomachine.com/testdrive.php. + I recommend to test drive NX to anybody with a only a passing interest in remote computing + http://www.nomachine.com/testdrive.php.

    - Just download the free of charge client software (available for RedHat, - SuSE, Debian and Windows) and be up and running within 5 minutes (they + Just download the free of charge client software (available for Red Hat, + SuSE, Debian and Windows) and be up and running within five minutes (they need to send you your account data, though, because you are assigned - a real Unix account on their testdrive.nomachine.com box... + a real UNIX account on their testdrive.nomachine.com box.

    They plan to get to the point were you can have NX application servers running as a cluster of nodes, and users simply start an NX session locally, and can select applications to run transparently (apps may even run on another NX node, but pretend to be on the same as used for initial login, - because it displays in the same window.... well, you also can run it + because it displays in the same window. You also can run it fullscreen, and after a short time you forget that it is a remote session at all).

    - Now the best thing at the end: all the core compression and caching + Now the best thing for last: All the core compression and caching technologies are released under the GPL and available as source code to anybody who wants to build on it! These technologies are working, albeit started from the command line only (and very inconvenient to - use in order to get a fully running remote X session up and running....) + use in order to get a fully running remote X session up and running.)

    To answer your questions:

    • - You don't need to install a terminal server; XP has RDP support built in. + You do not need to install a terminal server; XP has RDP support built in.

    • - NX is much cheaper than Citrix -- and comparable in performance, probably faster + NX is much cheaper than Citrix and comparable in performance, probably faster.

    • - You don't need to hack XP -- it just works + You do not need to hack XP it just works.

    • You log into the XP box from remote transparently (and I think there is no - need to change anything to get a connection, even if authentication is against a domain) + need to change anything to get a connection, even if authentication is against a domain).

    • - The NX core technologies are all Open Source and released under the GPL -- - you can today use a (very inconvenient) commandline to use it at no cost, - but you can buy a comfortable (proprietary) NX GUI frontend for money + The NX core technologies are all Open Source and released under the GPL + you can now use a (very inconvenient) commandline at no cost, + but you can buy a comfortable (proprietary) NX GUI frontend for money.

    • NoMachine are encouraging and offering help to OSS/Free Software implementations for such a frontend too, even if it means competition to them (they have written - to this effect even to the LTSP, KDE and GNOME developer mailing lists) -

    Network Logon Script Magic

    -This section needs work. Volunteer contributions most welcome. Please send your patches or updates -to John Terpstra. -

    + to this effect even to the LTSP, KDE and GNOME developer mailing lists). +

    Network Logon Script Magic

    There are several opportunities for creating a custom network startup configuration environment. -

    No Logon Script
    Simple universal Logon Script that applies to all users
    Use of a conditional Logon Script that applies per user or per group attributes
    Use of Samba's Preexec and Postexec functions on access to the NETLOGON share to create - a custom Logon Script and then execute it.
    User of a tool such as KixStart

    +

    • No Logon Script.
    • Simple universal Logon Script that applies to all users.
    • Use of a conditional Logon Script that applies per user or per group attributes.
    • Use of Samba's preexec and postexec functions on access to the NETLOGON share to create + a custom logon script and then execute it.
    • User of a tool such as KixStart.

    The Samba source code tree includes two logon script generation/execution tools. See examples directory genlogon and ntlogon subdirectories.

    The following listings are from the genlogon directory.

    + This is the genlogon.pl file: 

    @@ -140,8 +135,8 @@ This is the genlogon.pl file:
 	# genlogon.pl
 	#
 	# Perl script to generate user logon scripts on the fly, when users
-	# connect from a Windows client.  This script should be called from smb.conf
-	# with the %U, %G and %L parameters. I.e:
+	# connect from a Windows client. This script should be called from 
+	# smb.conf with the %U, %G and %L parameters. I.e:
 	#
 	#       root preexec = genlogon.pl %U %G %L
 	#
@@ -161,64 +156,62 @@ This is the genlogon.pl file:
 	# Log client connection
 	#($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
 	($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
-	open LOG, ">>/var/log/samba/netlogon.log";
-	print LOG "$mon/$mday/$year $hour:$min:$sec - User $ARGV[0] logged into $ARGV[1]\n";
+	open LOG, ">>/var/log/samba/netlogon.log";
+	print LOG "$mon/$mday/$year $hour:$min:$sec";
+	print LOG " - User $ARGV[0] logged into $ARGV[1]\n";
 	close LOG;
 
 	# Start generating logon script
-	open LOGON, ">/shared/netlogon/$ARGV[0].bat";
-	print LOGON "\@ECHO OFF\r\n";
+	open LOGON, ">/shared/netlogon/$ARGV[0].bat";
+	print LOGON "\@ECHO OFF\r\n";
 
 	# Connect shares just use by Software Development group
-	if ($ARGV[1] eq "SOFTDEV" || $ARGV[0] eq "softdev")
+	if ($ARGV[1] eq "SOFTDEV" || $ARGV[0] eq "softdev")
 	{
-		print LOGON "NET USE M: \\\\$ARGV[2]\\SOURCE\r\n";
+		print LOGON "NET USE M: \\\\$ARGV[2]\\SOURCE\r\n";
 	}
 
 	# Connect shares just use by Technical Support staff
-	if ($ARGV[1] eq "SUPPORT" || $ARGV[0] eq "support")
+	if ($ARGV[1] eq "SUPPORT" || $ARGV[0] eq "support")
 	{
-		print LOGON "NET USE S: \\\\$ARGV[2]\\SUPPORT\r\n";
+		print LOGON "NET USE S: \\\\$ARGV[2]\\SUPPORT\r\n";
 	}
 
 	# Connect shares just used by Administration staff
-	If ($ARGV[1] eq "ADMIN" || $ARGV[0] eq "admin")
+	If ($ARGV[1] eq "ADMIN" || $ARGV[0] eq "admin")
 	{
-		print LOGON "NET USE L: \\\\$ARGV[2]\\ADMIN\r\n";
-		print LOGON "NET USE K: \\\\$ARGV[2]\\MKTING\r\n";
+		print LOGON "NET USE L: \\\\$ARGV[2]\\ADMIN\r\n";
+		print LOGON "NET USE K: \\\\$ARGV[2]\\MKTING\r\n";
 	}
 
-	# Now connect Printers.  We handle just two or three users a little
+	# Now connect Printers. We handle just two or three users a little
 	# differently, because they are the exceptions that have desktop
 	# printers on LPT1: - all other user's go to the LaserJet on the
 	# server.
 	if ($ARGV[0] eq 'jim'
 	    || $ARGV[0] eq 'yvonne')
 	{
-		print LOGON "NET USE LPT2: \\\\$ARGV[2]\\LJET3\r\n";
-		print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
+		print LOGON "NET USE LPT2: \\\\$ARGV[2]\\LJET3\r\n";
+		print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
 	}
 	else
 	{
-		print LOGON "NET USE LPT1: \\\\$ARGV[2]\\LJET3\r\n";
-		print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
+		print LOGON "NET USE LPT1: \\\\$ARGV[2]\\LJET3\r\n";
+		print LOGON "NET USE LPT3: \\\\$ARGV[2]\\FAXQ\r\n";
 	}
 
 	# All done! Close the output file.
 	close LOGON;

    -Those wishing to use more elaborate or capable logon processing system should check out the following sites: -

    http://www.craigelachie.org/rhacer/ntlogon
    http://www.kixtart.org
    http://support.microsoft.com/default.asp?scid=kb;en-us;189105

    Adding printers without user intervention

    +Those wishing to use more elaborate or capable logon processing system should check out these sites: +

    • http://www.craigelachi.e.org/rhacer/ntlogon
    • http://www.kixtart.org

    Adding Printers without User Intervention

    + Printers may be added automatically during logon script processing through the use of: -

    -	rundll32 printui.dll,PrintUIEntry /?
+
    +C:\> rundll32 printui.dll,PrintUIEntry /?
 
    
 
-See the documentation in the Microsoft knowledgebase article no: 189105.
-

    Common Errors

    -The information provided in this chapter has been reproduced from postings on the samba@samba.org -mailing list. No implied endorsement or recommendation is offered. Administrators should conduct -their own evaluation of alternatives and are encouraged to draw their own conclusions. -

    Prev Up Next
    Chapter 21. Winbind: Use of Domain Accounts Home Chapter 23. System and Account Policies
    +See the documentation in the Microsoft knowledgebase article 189105. +

    Prev Up Next
    Chapter 21. Winbind: Use of Domain Accounts Home Chapter 23. System and Account Policies
    diff --git a/docs/htmldocs/Appendixes.html b/docs/htmldocs/Appendixes.html index 6d77a0ba65..c2e126377e 100644 --- a/docs/htmldocs/Appendixes.html +++ b/docs/htmldocs/Appendixes.html @@ -1,3 +1 @@ -Part VI. Appendixes
    Part VI. Appendixes
    Prev   Next

    Appendixes

    Table of Contents

    36. How to compile Samba
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    37. Portability
    HPUX
    SCO UNIX
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    Configuring OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba
    Configuring OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba
    Printer driver download for for OS/2 clients?
    Windows for Workgroups
    Latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configuring WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Prev Up Next
    Chapter 35. Reporting Bugs Home Chapter 36. How to compile Samba
    +Part VI. Appendixes
    Part VI. Appendixes
    Prev   Next

    Appendixes

    Table of Contents

    36. How to Compile Samba
    Access Samba Source Code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the Samba Sources via rsync and ftp
    Verifying Samba's PGP Signature
    Building the Binaries
    Compiling Samba with Active Directory Support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: Starting smbd as a Daemon
    37. Portability
    HPUX
    SCO UNIX
    DNIX
    Red Hat Linux
    AIX
    Sequential Read Ahead
    Solaris
    Locking Improvements
    Winbind on Solaris 9
    38. Samba and Other CIFS Clients
    Macintosh Clients
    OS2 Client
    Configuring OS/2 Warp Connect or OS/2 Warp 4
    Configuring Other Versions of OS/2
    Printer Driver Download for OS/2 Clients
    Windows for Workgroups
    Latest TCP/IP Stack from Microsoft
    Delete .pwl Files After Password Change
    Configuring Windows for Workgroups Password Handling
    Password Case Sensitivity
    Use TCP/IP as Default Protocol
    Speed Improvement
    Windows 95/98
    Speed Improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket Options
    Read Size
    Max Xmit
    Log Level
    Read Raw
    Write Raw
    Slow Logins
    Client Tuning
    Samba Performance Problem Due to Changing Linux Kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Prev Up Next
    Chapter 35. Reporting Bugs Home Chapter 36. How to Compile Samba
    diff --git a/docs/htmldocs/Backup.html b/docs/htmldocs/Backup.html index f19bd6d2b3..aa573dfdb7 100644 --- a/docs/htmldocs/Backup.html +++ b/docs/htmldocs/Backup.html @@ -1,11 +1,11 @@ -Chapter 28. Samba Backup Techniques
    Chapter 28. Samba Backup Techniques
    Prev Part III. Advanced Configuration Next

    Chapter 28. Samba Backup Techniques

    John H. Terpstra

    Samba Team

    Table of Contents

    Note
    Features and Benefits

    Note

    +Chapter 28. Samba Backup Techniques

    Chapter 28. Samba Backup Techniques
    Prev Part III. Advanced Configuration Next

    Chapter 28. Samba Backup Techniques

    John H. Terpstra

    Samba Team

    Table of Contents

    Note
    Features and Benefits

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Features and Benefits

    +

    Features and Benefits

    We need feedback from people who are backing up samba servers. We would like to know what software tools you are using to backup your samba server/s.

    In particular, if you have any success and / or failure stories you could share with other users this would be appreciated. -

    Prev Up Next
    Chapter 27. Unicode/Charsets Home Chapter 29. High Availability Options
    +

    Prev Up Next
    Chapter 27. Unicode/Charsets Home Chapter 29. High Availability Options
    diff --git a/docs/htmldocs/CUPS-printing.html b/docs/htmldocs/CUPS-printing.html index 8bfe11405f..19c9d7a021 100644 --- a/docs/htmldocs/CUPS-printing.html +++ b/docs/htmldocs/CUPS-printing.html @@ -1,94 +1,67 @@ -Chapter 19. CUPS Printing Support in Samba 3.0
    Chapter 19. CUPS Printing Support in Samba 3.0
    Prev Part III. Advanced Configuration Next

    Chapter 19. CUPS Printing Support in Samba 3.0

    Kurt Pfeifle

    Danka Deutschland GmbH

    Ciprian Vizitiu

    drawings

    Jelmer R. Vernooij

    drawings
    The Samba Team

    (3 June 2003)

    Table of Contents

    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for -CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for -application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and -native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print -Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many -Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel -Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Caveats to be considered
    Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsmb completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the -Client
    Installing PostScript Driver Files manually (using -rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    In Case of Trouble.....
    Printing from CUPS to Windows attached -Printers
    More CUPS filtering Chains
    Common Errors
    Win9x client can't install driver
    "cupsaddsmb" keeps asking for root password in - neverending loop
    "cupsaddsmb" gives "No PPD file for printer..." - message while PPD file is present
    Client can't connect to Samba printer
    Can't reconnect to Samba under new account - from Win2K/XP
    Avoid being connected to the Samba server as the - "wrong" user
    Upgrading to CUPS drivers from Adobe drivers on - NT/2K/XP clients gives problems
    Can't use "cupsaddsmb" on Samba server which is - a PDC
    Deleted Win2K printer driver is still shown
    Win2K/XP "Local Security - Policies"
    WinXP clients: "Administrator can not install - printers for all local users"
    "Print Change Notify" functions on - NT-clients
    WinXP-SP1
    Print options for all users can't be set on Win2K/XP
    Most common blunders in driver - settings on Windows clients
    cupsaddsmb does not work - with newly installed printer
    Permissions on -/var/spool/samba/ get reset after each -reboot
    Printer named "lp" -intermittently swallows jobs and spits out completely different -ones
    Location of Adobe PostScript driver files necessary for "cupsaddsmb"
    An Overview of the CUPS Printing Processes

    Introduction

    Features and Benefits

    - The Common UNIX Print System (CUPS) has become very popular. All - major Linux distributions now ship it as their default printing - system. To many it is still a very mystical tool. Mostly, it - "just works" (TM). People tend to regard it as a "black box" - which they don't want to look into, as long as it works. But once - there is a little problem, they are in trouble to find out where to - start debugging it. Refer to the "Classical Printing" chapter also, it - contains a lot of information that is relevant for CUPS. +Chapter 19. CUPS Printing Support

    Chapter 19. CUPS Printing Support
    Prev Part III. Advanced Configuration Next

    Chapter 19. CUPS Printing Support

    Kurt Pfeifle

    Danka Deutschland GmbH

    Ciprian Vizitiu

    drawings

    Jelmer R. Vernooij

    drawings
    The Samba Team

    (3 June 2003)

    Table of Contents

    Introduction
    Features and Benefits
    Overview
    Basic CUPS Support Configuration
    Linking smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More Complex CUPS smb.conf Settings
    Advanced Configuration
    Central Spooling vs. Peer-to-Peer Printing
    Raw Print Serving Vendor Drivers on Windows Clients
    Installation of Windows Client Drivers
    Explicitly Enable raw Printing for application/octet-stream
    Driver Upload Methods
    Advanced Intelligent Printing with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript the Software RIP for Non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    Using Windows-Formatted Vendor PPDs
    CUPS Also Uses PPDs for Non-PostScript Printers
    The CUPS Filtering Architecture
    MIME Types and CUPS Filters
    MIME Type Conversion Rules
    Filtering Overview
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    The Role of cupsomatic/foomatic
    The Complete Picture
    mime.convs
    Raw Printing
    application/octet-stream Printing
    PostScript Printer Descriptions (PPDs) for Non-PS Printers
    cupsomatic/foomatic-rip Versus native CUPS Printing
    Examples for Filtering Chains
    Sources of CUPS Drivers/PPDs
    Printing with Interface Scripts
    Network Printing (Purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows Clients UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba Receiving Jobfiles and Passing Them to CUPS
    Network PostScript RIP
    PPDs for Non-PS Printers on UNIX
    PPDs for Non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers Running in Kernel Mode Cause Many +Problems
    Workarounds Impose Heavy Limitations
    CUPS: A Magical Stone?
    PostScript Drivers with No Major Problems Even in Kernel +Mode
    Configuring CUPS for Driver Download
    cupsaddsmb: The Unknown Utility
    Prepare Your smb.conf for cupsaddsmb
    CUPS PostScript Driver for Windows NT/200x/XP
    Recognizing Different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro PostScript Driver for Windows NT/200x/XP
    Caveats to be Considered
    Windows CUPS PostScript Driver Versus Adobe Driver
    Run cupsaddsmb (Quiet Mode)
    Run cupsaddsmb with Verbose Output
    Understanding cupsaddsmb
    How to Recognize If cupsaddsmb Completed Successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding Critical PostScript Driver Settings on the Client
    Installing PostScript Driver Files Manually Using rpcclient
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by Querying a Windows Box
    Requirements for adddriver and setdriver to Succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting Revisited
    The Printing *.tdb Files
    Trivial Database Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic Explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting Up Quotas
    Correct and Incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings Explained
    Pre-Conditions
    Manual Configuration
    Printing from CUPS to Windows Attached Printers
    More CUPS-Filtering Chains
    Common Errors
    Windows 9x/ME Client Can't Install Driver
    cupsaddsmb Keeps Asking for Root Password in Never-ending Loop
    cupsaddsmb Errors
    Client Can't Connect to Samba Printer
    New Account Reconnection from Windows 200x/XP Troubles
    Avoid Being Connected to the Samba Server as the Wrong User
    Upgrading to CUPS Drivers from Adobe Drivers
    Can't Use cupsaddsmb on Samba Server Which Is a PDC
    Deleted Windows 200x Printer Driver Is Still Shown
    Windows 200x/XP "Local Security Policies"
    Administrator Cannot Install Printers for All Local Users
    Print Change Notify Functions on NT-clients
    WinXP-SP1
    Print Options for All Users Can't Be Set on Windows 200x/XP
    Most Common Blunders in Driver Settings on Windows Clients
    cupsaddsmb Does Not Work with Newly Installed Printer
    Permissions on /var/spool/samba/ Get Reset After Each Reboot
    Print Queue Called lp Mis-handles Print Jobs
    Location of Adobe PostScript Driver Files for cupsaddsmb
    Overview of the CUPS Printing Processes

    Introduction

    Features and Benefits

    + The Common UNIX Print System (CUPS) + has become quite popular. All major Linux distributions now ship it as their default printing + system. To many, it is still a mystical tool. Mostly, it just works. + People tend to regard it as a “black box” + that they do not want to look into as long as it works. But once + there is a little problem, they are in trouble to find out where to + start debugging it. Refer to the chapter “Classical Printing” that + contains a lot of information that is relevant for CUPS.

    - CUPS sports quite a few unique and powerful features. While their - basic functions may be grasped quite easily, they are also - new. Because they are different from other, more traditional printing - systems, it is best to try and not apply any prior knowledge about - printing upon this new system. Rather, try to understand CUPS - from the beginning. This documentation will lead you to a - complete understanding of CUPS. Let's start with the most basic - things first. -

    Overview

    - CUPS is more than just a print spooling system. It is a complete - printer management system that complies with the new IPP - (Internet Printing Protocol). IPP is an industry - and IETF (Internet Engineering Task Force) - standard for network printing. Many of its functions can be managed - remotely (or locally) via a web browser (giving you a - platform-independent access to the CUPS print server). Additionally, it - has the traditional command line and several more modern GUI interfaces - (GUI interfaces developed by 3rd parties, like KDE's - overwhelming KDEPrint). + CUPS sports quite a few unique and powerful features. While their + basic functions may be grasped quite easily, they are also + new. Because they are different from other, more traditional printing + systems, it is best not to try and apply any prior knowledge about + printing to this new system. Rather, try to understand CUPS + from the beginning. This documentation will lead you to a + complete understanding of CUPS. Let's start with the most basic + things first. +

    Overview

    + CUPS is more than just a print spooling system. It is a complete + printer management system that complies with the new + Internet Printing Protocol (IPP). IPP is an industry + and Internet Engineering Task Force (IETF) + standard for network printing. Many of its functions can be managed + remotely (or locally) via a Web browser (giving you a + platform-independent access to the CUPS print server). Additionally, it + has the traditional command line and several more modern GUI interfaces + (GUI interfaces developed by third parties, like KDE's + overwhelming KDEPrint).

    - CUPS allows creation of "raw" printers (ie: NO print file - format translation) as well as "smart" printers (i.e. CUPS does - file format conversion as required for the printer). In many ways - this gives CUPS similar capabilities to the MS Windows print - monitoring system. Of course, if you are a CUPS advocate, you would - argue that CUPS is better! In any case, let us now move on to - explore how one may configure CUPS for interfacing with MS Windows - print clients via Samba. -

    Basic Configuration of CUPS support

    - Printing with CUPS in the most basic smb.conf setup in Samba 3.0 (as was true for 2.2.x) only needs two - settings: printing = cups and - printcap = cups. CUPS does not need a printcap file. - However, the cupsd.conf configuration file knows of two related directives that control - how such a file will be automatically created and maintained by CUPS for the convenience of third party - applications (example: Printcap /etc/printcap and PrintcapFormat BSD). - Legacy programs often require the existence of a printcap file containing printer names or they will refuse to - print. Make sure CUPS is set to generate and maintain a printcap file! For details see - man cupsd.conf and other CUPS-related documentation, like the wealth of documents on your CUPS server - itself: http://localhost:631/documentation.html. -

    Linking of smbd with libcups.so

    - Samba has a very special relationship to CUPS. Samba can be compiled with CUPS library support. - Most recent installations have this support enabled. Per default CUPS linking is compiled - into smbd and other Samba binaries. Of course, you can use CUPS even - if Samba is not linked against libcups.so -- but - there are some differences in required or supported configuration - then. + CUPS allows creation of “raw” printers (i.e., no print file + format translation) as well as “smart” printers (i.e., CUPS does + file format conversion as required for the printer). In many ways + this gives CUPS similar capabilities to the MS Windows print + monitoring system. Of course, if you are a CUPS advocate, you would + argue that CUPS is better! In any case, let us now move on to + explore how one may configure CUPS for interfacing with MS Windows + print clients via Samba. +

    Basic CUPS Support Configuration

    + Printing with CUPS in the most basic smb.conf setup in Samba-3.0 (as was true for 2.2.x) only needs two + settings: printing = cups and + printcap = cups. CUPS does not need a printcap file. + However, the cupsd.conf configuration file knows of two related directives that control + how such a file will be automatically created and maintained by CUPS for the convenience of third-party + applications (example: Printcap /etc/printcap and PrintcapFormat BSD). + Legacy programs often require the existence of a printcap file containing printer names or they will refuse to + print. Make sure CUPS is set to generate and maintain a printcap file. For details, see + man cupsd.conf and other CUPS-related documentation, like the wealth of documents on your CUPS server + itself: http://localhost:631/documentation.html. +

    Linking smbd with libcups.so

    + Samba has a special relationship to CUPS. Samba can be compiled with CUPS library support. + Most recent installations have this support enabled. Per default, CUPS linking is compiled + into smbd and other Samba binaries. Of course, you can use CUPS even + if Samba is not linked against libcups.so but + there are some differences in required or supported configuration.

    - When Samba is compiled against libcups, printcap = cups - uses the CUPS API to list printers, submit jobs, query queues, etc. Otherwise it maps to the System V - commands with an additional -oraw option for printing. On a Linux - system, you can use the ldd utility to find out details (ldd may not be present on - other OS platforms, or its function may be embodied by a different command): + When Samba is compiled against libcups, printcap = cups + uses the CUPS API to list printers, submit jobs, query queues, and so on. Otherwise it maps to the System V + commands with an additional -oraw option for printing. On a Linux + system, you can use the ldd utility to find out details (ldd may not be present on + other OS platforms, or its function may be embodied by a different command): 

     root# ldd `which smbd`
 libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000)
@@ -96,726 +69,785 @@ libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000)
 libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000)
 [....]

    - The line libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) shows - there is CUPS support compiled into this version of Samba. If this is the case, and printing = cups - is set, then any otherwise manually set print command in smb.conf is ignored. - This is an important point to remember! + The line libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) shows + there is CUPS support compiled into this version of Samba. If this is the case, and printing = cups + is set, then any otherwise manually set print command in smb.conf is ignored. + This is an important point to remember!

    Tip

    Should it be necessary, for any reason, to set your own print commands, you can do this by setting - printing = sysv. However, you will loose all the benefits + printing = sysv. However, you will loose all the benefits of tight CUPS/Samba integration. When you do this you must manually configure the printing system commands - (most important: print command; other commands are - lppause command, - lpresume command, - lpq command, - lprm command, - queuepause command and - queue resume command).

    Simple smb.conf Settings for CUPS

    - To summarize, here is the simplest printing-related setup for smb.conf to enable basic CUPS support: -

    Example 19.1. Simplest printing-related smb.conf

    [global]
    load printers = yes
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    public = yes
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root, @ntadmins

    - This is all you need for basic printing setup for CUPS. It will print - all Graphic, Text, PDF and PostScript file submitted from Windows - clients. However, most of your Windows users would not know how to - send these kind of files to print without opening a GUI - application. Windows clients tend to have local printer drivers - installed. And the GUI application's print buttons start a printer - driver. Your users also very rarely send files from the command - line. Unlike UNIX clients, they hardly submit graphic, text or PDF - formatted files directly to the spooler. They nearly exclusively print - from GUI applications, with a "printer driver" hooked in between the - applications native format and the print data stream. If the backend - printer is not a PostScript device, the print data stream is "binary", - sensible only for the target printer. Read on to learn which problem - this may cause and how to avoid it. -

    More complex smb.conf Settings for -CUPS

    -Here is a slightly more complex printing-related setup -for smb.conf. It enables general CUPS printing -support for all printers, but defines one printer share which is set -up differently. -

    Example 19.2. Overriding global CUPS settings for one printer

    [global]
    printing = cups
    printcap name = cups
    load printers = yes
    [printers]
    comment = All Printers
    path = /var/spool/samba
    public = yes
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root, @ntadmins
    [special_printer]
    comment = A special printer with his own settings
    path = /var/spool/samba-special
    printing = sysv
    printcap = lpstat
    print command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ; \
    echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; \
    echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log : rm %f
    public = no
    guest ok = no
    writeable = no
    printable = yes
    printer admin = kurt
    hosts deny = 0.0.0.0
    hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60

    -This special share is only there for testing purposes. It does not write the print job to a file. It just logs the job parameters -known to Samba into the /tmp/smbprn.log file and deletes the jobfile. Moreover, the -printer admin of this share is "kurt" (not the "@ntadmins" group); -guest access is not allowed; the share isn not published to the Network Neighbourhood (so you need to know it is there), and it only -allows access from only three hosts. To prevent CUPS kicking in and taking over the print jobs for that share, we need to set -printing = sysv and -printcap = lpstat. -

    Advanced Configuration

    -Before we delve into all the configuration options, let us clarify a few -points. Network printing needs to be organized and setup -correctly. Often this is not done correctly. Legacy systems -or small business LAN environments often lack design and good housekeeping. -

    Central spooling vs. "Peer-to-Peer" printing

    -Many small office or home networks, as well as badly organized larger -environments, allow each client a direct access to available network -printers. This is generally a bad idea. It often blocks one client's -access to the printer when another client's job is printing. It also -might freeze the first client's application while it is waiting to get -rid of the job. Also, there are frequent complaints about various jobs -being printed with their pages mixed with each other. A better concept -is the usage of a "print server": it routes all jobs through one -central system, which responds immediately, takes jobs from multiple -concurrent clients at the same time and in turn transfers them to the -printer(s) in the correct order. -

    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients

    -Most traditionally configured UNIX print servers acting on behalf of -Samba's Windows clients represented a really simple setup. Their only -task was to manage the "raw" spooling of all jobs handed to them by -Samba. This approach meant that the Windows clients were expected to -prepare the print job file that it s ready to be sent to the printing -device. Here a native (vendor-supplied) Windows printer -driver for the target device needed to be installed on each and every -client. -

    -It is possible to configure CUPS, Samba and your Windows clients in the -same, traditional and simple way. When CUPS printers are configured -for RAW print-through mode operation it is the responsibility of the -Samba client to fully render the print job (file). The file must be -sent in a format that is suitable for direct delivery to the -printer. Clients need to run the vendor-provided drivers to do -this. In this case CUPS will NOT do any print file format conversion -work. -

    Driver Installation Methods on Windows Clients

    -The printer drivers on the Windows clients may be installed -in two functionally different ways: -

    • manually install the drivers locally on each client, -one by one; this yields the old LanMan style -printing; it uses a \\sambaserver\printershare -type of connection.

    • - - deposit and prepare the drivers (for later download) on -the print server (Samba); this enables the clients to use -"Point and Print" to get drivers semi-automatically installed the -first time they access the printer; with this method NT/2K/XP -clients use the SPOOLSS/MS-RPC -type printing calls.

    -The second method is recommended for use over the first. -

    Explicitly enable "raw" printing for -application/octet-stream!

    -If you use the first option (drivers are installed on the client -side), there is one setting to take care of: CUPS needs to be told -that it should allow "raw" printing of deliberate (binary) file -formats. The CUPS files that need to be correctly set for RAW mode -printers to work are: -

    • /etc/cups/mime.types -

    • /etc/cups/mime.convs

    -Both contain entries (at the end of the respective files) which must -be uncommented to allow RAW mode operation. -In/etc/cups/mime.types make sure this line is -present: -

    - application/octet-stream
-

    -In /etc/cups/mime.convs, -have this line: -

    - application/octet-stream   application/vnd.cups-raw   0   - 
-

    -If these two files are not set up correctly for raw Windows client -printing, you may encounter the dreaded Unable to -convert file 0 in your CUPS error_log file. -

    Note

    editing the mime.convs and the -mime.types file does not -enforce "raw" printing, it only -allows it. -

    Background.  -CUPS being a more security-aware printing system than traditional ones -does not by default allow a user to send deliberate (possibly binary) -data to printing devices. This could be easily abused to launch a -"Denial of Service" attack on your printer(s), causing at the least -the loss of a lot of paper and ink. "Unknown" data are tagged by CUPS -as MIME type: application/octet-stream and not -allowed to go to the printer. By default, you can only send other -(known) MIME types "raw". Sending data "raw" means that CUPS does not -try to convert them and passes them to the printer untouched (see next -chapter for even more background explanations). -

    -This is all you need to know to get the CUPS/Samba combo printing -"raw" files prepared by Windows clients, which have vendor drivers -locally installed. If you are not interested in background information about -more advanced CUPS/Samba printing, simply skip the remaining sections -of this chapter. -

    Three familiar Methods for driver upload plus a new one

    -If you want to use the MS-RPC type printing, you must upload the -drivers onto the Samba server first ([print$] -share). For a discussion on how to deposit printer drivers on the -Samba host (so that the Windows clients can download and use them via -"Point'n'Print") please also refer to the previous chapter of this -HOWTO Collection. There you will find a description or reference to -three methods of preparing the client drivers on the Samba server: -

    • the GUI, "Add Printer Wizard" -upload-from-a-Windows-client -method;

    • the commandline, "smbclient/rpcclient" -upload-from-a-UNIX-workstation -method;

    • - - the Imprints Toolset -method.

    -These 3 methods apply to CUPS all the same. A new and more -convenient way to load the Windows drivers into Samba is provided -if you use CUPS: -

    • the cupsaddsmb -utility.

    -cupsaddsmb is discussed in much detail further below. But we will -first explore the CUPS filtering system and compare the Windows and -UNIX printing architectures. -

    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download

    -Are you still following this? Good. Let's go into more detail then. We now know -how to set up a "dump" printserver, that is, a server which is spooling -printjobs "raw", leaving the print data untouched. -

    -Possibly you need to setup CUPS in a more smart way. The reasons could -be manifold: -

    • Maybe your boss wants to get monthly statistics: Which -printer did how many pages? What was the average data size of a job? -What was the average print run per day? What are the typical hourly -peaks in printing? Which departments prints how -much?

    • Maybe you are asked to setup a print quota system: -users should not be able to print more jobs, once they have surpassed -a given limit per period?

    • Maybe your previous network printing setup is a mess -and shall be re-organized from a clean beginning?

    • Maybe you have experiencing too many "Blue Screens", -originating from poorly debugged printer drivers running in NT "kernel -mode"?

    -These goals cannot be achieved by a raw print server. To build a -server meeting these requirements, you'll first need to learn about -how CUPS works and how you can enable its features. -

    -What follows is the comparison of some fundamental concepts for -Windows and UNIX printing; then is the time for a description of the -CUPS filtering system, how it works and how you can tweak it. -

    GDI on Windows -- PostScript on UNIX

    -Network printing is one of the most complicated and error-prone -day-to-day tasks any user or an administrator may encounter. This is -true for all OS platforms. And there are reasons for this. -

    -You can't expect for most file formats to just throw them towards -printers and they get printed. There needs to be a file format -conversion in between. The problem is: there is no common standard for -print file formats across all manufacturers and printer types. While -PostScript (trademark held by Adobe), and, to an -extent, PCL (trademark held by HP), have developed -into semi-official "standards", by being the most widely used PDLs -(Page Description Languages), there are still -many manufacturers who "roll their own" (their reasons may be -unacceptable license fees for using printer-embedded PostScript -interpreters, etc.). -

    Windows Drivers, GDI and EMF

    -In Windows OS, the format conversion job is done by the printer -drivers. On MS Windows OS platforms all application programmers have -at their disposal a built-in API, the GDI (Graphical Device -Interface), as part and parcel of the OS itself, to base -themselves on. This GDI core is used as one common unified ground, for -all Windows programs, to draw pictures, fonts and documents -on screen as well as on -paper (=print). Therefore printer driver developers can -standardize on a well-defined GDI output for their own driver -input. Achieving WYSIWYG ("What You See Is What You Get") is -relatively easy, because the on-screen graphic primitives, as well as -the on-paper drawn objects, come from one common source. This source, -the GDI, produces often a file format called EMF (Enhanced -MetaFile). The EMF is processed by the printer driver and -converted to the printer-specific file format. -

    Note

    - -To the GDI foundation in MS Windows, Apple has chosen to -put paper and screen output on a common foundation for their -(BSD-UNIX-based, did you know??) Mac OS X and Darwin Operating -Systems. Their Core Graphic Engine uses a -PDF derivative for all display work. -

    + (most important: + print command; other commands are + lppause command, + lpresume command, + lpq command, + lprm command, + queuepause command and + queue resume command).

    Simple smb.conf Settings for CUPS

    + To summarize, shows simplest printing-related setup for smb.conf to enable basic CUPS support: +

    Example 19.1. Simplest printing-related smb.conf

    [global]
    load printers = yes
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    public = yes
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root, @ntadmins

    + This is all you need for basic printing setup for CUPS. It will print + all graphic, text, PDF, and PostScript files submitted from Windows + clients. However, most of your Windows users would not know how to + send these kinds of files to print without opening a GUI + application. Windows clients tend to have local printer drivers + installed, and the GUI application's print buttons start a printer + driver. Your users also rarely send files from the command + line. Unlike UNIX clients, they hardly submit graphic, text or PDF + formatted files directly to the spooler. They nearly exclusively print + from GUI applications with a “printer driver” hooked in between the + application's native format and the print-data-stream. If the backend + printer is not a PostScript device, the print data stream is “binary,” + sensible only for the target printer. Read on to learn which problem + this may cause and how to avoid it. +

    More Complex CUPS smb.conf Settings

    + is a slightly more complex printing-related setup + for smb.conf. It enables general CUPS printing + support for all printers, but defines one printer share, which is set + up differently. +

    Example 19.2. Overriding global CUPS settings for one printer

    [global]
    printing = cups
    printcap name = cups
    load printers = yes
    [printers]
    comment = All Printers
    path = /var/spool/samba
    public = yes
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root, @ntadmins
    [special_printer]
    comment = A special printer with his own settings
    path = /var/spool/samba-special
    printing = sysv
    printcap = lpstat
    print command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ; \
    echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; \
    echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log : rm %f
    public = no
    guest ok = no
    writeable = no
    printable = yes
    printer admin = kurt
    hosts deny = 0.0.0.0
    hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60

    + This special share is only there for testing purposes. It does not write the print job to a file. It just logs the job parameters + known to Samba into the /tmp/smbprn.log file and deletes the jobfile. Moreover, the + printer admin of this share is “kurt” (not the “@ntadmins” group), + guest access is not allowed, the share isn't published to the Network Neighborhood (so you need to know it is there), and it only + allows access from only three hosts. To prevent CUPS kicking in and taking over the print jobs for that share, we need to set + printing = sysv and + printcap = lpstat. +

    Advanced Configuration

    + Before we delve into all the configuration options, let us clarify a few + points. Network printing needs to be organized and setup + correctly. This frequently doesn't happen. Legacy systems + or small business LAN environments often lack design and good housekeeping. +

    Central Spooling vs. “Peer-to-Peer” Printing

    + + + Many small office or home networks, as well as badly organized larger + environments, allow each client a direct access to available network + printers. This is generally a bad idea. It often blocks one client's + access to the printer when another client's job is printing. It might + freeze the first client's application while it is waiting to get + rid of the job. Also, there are frequent complaints about various jobs + being printed with their pages mixed with each other. A better concept + is the usage of a print server: it routes all jobs through one + central system, which responds immediately, takes jobs from multiple + concurrent clients at the same time, and in turn transfers them to the + printer(s) in the correct order. +

    Raw Print Serving Vendor Drivers on Windows Clients

    + + + Most traditionally configured UNIX print servers acting on behalf of + Samba's Windows clients represented a really simple setup. Their only + task was to manage the “raw” spooling of all jobs handed to them by + Samba. This approach meant that the Windows clients were expected to + prepare the print job file that its ready to be sent to the printing + device. Here is a native (vendor-supplied) Windows printer + driver for the target device needed to be installed on each and every + client. +

    + It is possible to configure CUPS, Samba and your Windows clients in the + same traditional and simple way. When CUPS printers are configured + for RAW print-through mode operation, it is the responsibility of the + Samba client to fully render the print job (file). The file must be + sent in a format that is suitable for direct delivery to the + printer. Clients need to run the vendor-provided drivers to do + this. In this case, CUPS will not do any print file format conversion + work. +

    Installation of Windows Client Drivers

    + The printer drivers on the Windows clients may be installed + in two functionally different ways: +

    • Manually install the drivers locally on each client, + one by one; this yields the old LanMan style + printing and uses a \\sambaserver\printershare + type of connection.

    • + + Deposit and prepare the drivers (for later download) on + the print server (Samba); this enables the clients to use + “Point'n'Print” to get drivers semi-automatically installed the + first time they access the printer; with this method NT/200x/XP + clients use the SPOOLSS/MS-RPC + type printing calls.

    + The second method is recommended for use over the first. +

    Explicitly Enable “raw” Printing for application/octet-stream

    + + + + If you use the first option (drivers are installed on the client + side), there is one setting to take care of: CUPS needs to be told + that it should allow “raw” printing of deliberate (binary) file + formats. The CUPS files that need to be correctly set for RAW mode + printers to work are: +

    • /etc/cups/mime.types

    • /etc/cups/mime.convs

    + Both contain entries (at the end of the respective files) which must + be uncommented to allow RAW mode operation. + In /etc/cups/mime.types, make sure this line is + present: -

    Figure 19.1. Windows Printing to a local Printer

    Windows Printing to a local Printer

    -

    UNIX Printfile Conversion and GUI Basics

    -In UNIX and Linux, there is no comparable layer built into the OS -kernel(s) or the X (screen display) server. Every application is -responsible for itself to create its print output. Fortunately, most -use PostScript. That gives at least some common ground. Unfortunately, -there are many different levels of quality for this PostScript. And -worse: there is a huge difference (and no common root) in the way how -the same document is displayed on screen and how it is presented on -paper. WYSIWYG is more difficult to achieve. This goes back to the -time decades ago, when the predecessors of X.org, -designing the UNIX foundations and protocols for Graphical User -Interfaces refused to take over responsibility for "paper output" -also, as some had demanded at the time, and restricted itself to -"on-screen only". (For some years now, the "Xprint" project has been -under development, attempting to build printing support into the X -framework, including a PostScript and a PCL driver, but it is not yet -ready for prime time.) You can see this unfavorable inheritance up to -the present day by looking into the various "font" directories on your -system; there are separate ones for fonts used for X display and fonts -to be used on paper. -

    Background.  -The PostScript programming language is an "invention" by Adobe Inc., -but its specifications have been published to the full. Its strength -lies in its powerful abilities to describe graphical objects (fonts, -shapes, patterns, lines, curves, dots...), their attributes (color, -linewidth...) and the way to manipulate (scale, distort, rotate, -shift...) them. Because of its open specification, anybody with the -skill can start writing his own implementation of a PostScript -interpreter and use it to display PostScript files on screen or on -paper. Most graphical output devices are based on the concept of -"raster images" or "pixels" (one notable exception are pen -plotters). Of course, you can look at a PostScript file in its textual -form and you will be reading its PostScript code, the language -instructions which need to be interpreted by a rasterizer. Rasterizers -produce pixel images, which may be displayed on screen by a viewer -program or on paper by a printer. -

    PostScript and Ghostscript

    -So, UNIX is lacking a common ground for printing on paper and -displaying on screen. Despite this unfavorable legacy for UNIX, basic -printing is fairly easy: if you have PostScript printers at your -disposal! The reason is: these devices have a built-in PostScript -language "interpreter", also called a Raster Image -Processor (RIP), (which makes them more expensive than -other types of printers); throw PostScript towards them, and they will -spit out your printed pages. Their RIP is doing all the hard work of -converting the PostScript drawing commands into a bitmap picture as -you see it on paper, in a resolution as done by your printer. This is -no different to PostScript printing of a file from a Windows origin. -

    Note

    - -Traditional UNIX programs and printing systems -- while -using PostScript -- are largely not PPD-aware. PPDs are "PostScript -Printer Description" files. They enable you to specify and control all -options a printer supports: duplexing, stapling, punching... Therefore -UNIX users for a long time couldn't choose many of the supported -device and job options, unlike Windows or Apple users. But now there -is CUPS.... -

    -

    Figure 19.2. Printing to a Postscript Printer

    Printing to a Postscript Printer

    -

    -However, there are other types of printers out there. These don't know -how to print PostScript. They use their own Page Description -Language (PDL, often proprietary). To print to them is much -more demanding. Since your UNIX applications mostly produce -PostScript, and since these devices don't understand PostScript, you -need to convert the printfiles to a format suitable for your printer -on the host, before you can send it away. -

    Ghostscript -- the Software RIP for non-PostScript Printers

    -Here is where Ghostscript kicks in. Ghostscript is -the traditional (and quite powerful) PostScript interpreter used on -UNIX platforms. It is a RIP in software, capable to do a -lot of file format conversions, for a very broad -spectrum of hardware devices as well as software file formats. -Ghostscript technology and drivers is what enables PostScript printing -to non-PostScript hardware. -

    -

    Figure 19.3. Ghostscript as a RIP for non-postscript printers

    Ghostscript as a RIP for non-postscript printers

    -

    Tip

    -Use the "gs -h" command to check for all built-in "devices" of your -Ghostscript version. If you specify e.g. a parameter of --sDEVICE=png256 on your Ghostscript command -line, you are asking Ghostscript to convert the input into a PNG -file. Naming a "device" on the commandline is the most important -single parameter to tell Ghostscript how exactly it should render the -input. New Ghostscript versions are released at fairly regular -intervals, now by artofcode LLC. They are initially put under the -"AFPL" license, but re-released under the GNU GPL as soon as the next -AFPL version appears. GNU Ghostscript is probably the version -installed on most Samba systems. But it has got some -deficiencies. Therefore ESP Ghostscript was developed as an -enhancement over GNU Ghostscript, with lots of bug-fixes, additional -devices and improvements. It is jointly maintained by developers from -CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat and Debian. It includes -the "cups" device (essential to print to non-PS printers from CUPS). -

    PostScript Printer Description (PPD) Specification

    -While PostScript in essence is a Page Description -Language (PDL) to represent the page layout in a -device independent way, real world print jobs are -always ending up to be output on a hardware with device-specific -features. To take care of all the differences in hardware, and to -allow for innovations, Adobe has specified a syntax and file format -for PostScript Printer Description (PPD) -files. Every PostScript printer ships with one of these files. -

    -PPDs contain all information about general and special features of the -given printer model: Which different resolutions can it handle? Does -it have a Duplexing Unit? How many paper trays are there? What media -types and sizes does it take? For each item it also names the special -command string to be sent to the printer (mostly inside the PostScript -file) in order to enable it. -

    -Information from these PPDs is meant to be taken into account by the -printer drivers. Therefore, installed as part of the Windows -PostScript driver for a given printer is the printer's PPD. Where it -makes sense, the PPD features are presented in the drivers' UI dialogs -to display to the user as choice of print options. In the end, the -user selections are somehow written (in the form of special -PostScript, PJL, JCL or vendor-dependent commands) into the PostScript -file created by the driver. -

    Warning

    - -A PostScript file that was created to contain device-specific commands -for achieving a certain print job output (e.g. duplexed, stapled and -punched) on a specific target machine, may not print as expected, or -may not be printable at all on other models; it also may not be fit -for further processing by software (e.g. by a PDF distilling program). -

    CUPS can use all Windows-formatted Vendor PPDs

    -CUPS can handle all spec-compliant PPDs as supplied by the -manufacturers for their PostScript models. Even if a -UNIX/Linux-illiterate vendor might not have mentioned our favorite -OS in his manuals and brochures -- you can safely trust this: -if you get hold of the Windows NT version of the PPD, you -can use it unchanged in CUPS and thus access the full -power of your printer just like a Windows NT user could! -

    Tip

    -To check the spec compliance of any PPD online, go to http://www.cups.org/testppd.php -and upload your PPD. You will see the results displayed -immediately. CUPS in all versions after 1.1.19 has a much more strict -internal PPD parsing and checking code enabled; in case of printing -trouble this online resource should be one of your first pitstops. -

    Warning

    - - -For real PostScript printers don't use the -Foomatic or cupsomatic -PPDs from Linuxprinting.org. With these devices the original -vendor-provided PPDs are always the first choice! -

    Tip

    -If you are looking for an original vendor-provided PPD of a specific -device, and you know that an NT4 box (or any other Windows box) on -your LAN has the PostScript driver installed, just use -smbclient //NT4-box/print\$ -U username to -access the Windows directory where all printer driver files are -stored. First look in the W32X86/2 subdir for -the PPD you are seeking. -

    CUPS also uses PPDs for non-PostScript Printers

    -CUPS also uses specially crafted PPDs to handle non-PostScript -printers. These PPDs are usually not available from the vendors (and -no, you can't just take the PPD of a Postscript printer with the same -model name and hope it works for the non-PostScript version too). To -understand how these PPDs work for non-PS printers we first need to -dive deeply into the CUPS filtering and file format conversion -architecture. Stay tuned. -

    The CUPS Filtering Architecture

    + 

    +	 application/octet-stream
+

    + + + + + In /etc/cups/mime.convs, + have this line: + + + + 

    +		application/octet-stream   application/vnd.cups-raw   0   - 
+

    + + If these two files are not set up correctly for raw Windows client + printing, you may encounter the dreaded Unable to + convert file 0 in your CUPS error_log file. +

    Note

    Editing the mime.convs and the + mime.types file does not + enforce “raw” printing, it only + allows it. +

    Background.  + + CUPS being a more security-aware printing system than traditional ones + does not by default allow a user to send deliberate (possibly binary) + data to printing devices. This could be easily abused to launch a + “Denial of Service” attack on your printer(s), causing at least + the loss of a lot of paper and ink. “Unknown” data are tagged by CUPS + as MIME type: application/octet-stream and not + allowed to go to the printer. By default, you can only send other + (known) MIME types “raw”. Sending data “raw” means that CUPS does not + try to convert them and passes them to the printer untouched (see the next + chapter for even more background explanations). +

    + This is all you need to know to get the CUPS/Samba combo printing + “raw” files prepared by Windows clients, which have vendor drivers + locally installed. If you are not interested in background information about + more advanced CUPS/Samba printing, simply skip the remaining sections + of this chapter. +

    Driver Upload Methods

    + This section describes three familiar methods, plus one new one, by which + printer drivers may be uploaded. +

    + + If you want to use the MS-RPC type printing, you must upload the + drivers onto the Samba server first ([print$] + share). For a discussion on how to deposit printer drivers on the + Samba host (so the Windows clients can download and use them via + “Point'n'Print”), please refer to the previous chapter of this + HOWTO Collection. There you will find a description or reference to + three methods of preparing the client drivers on the Samba server: +

    • + + The GUI, “Add Printer Wizard” + upload-from-a-Windows-client + method.

    • The command line, “smbclient/rpcclient” + upload-from-a-UNIX-workstation method.

    • + + The Imprints Toolset + method.

    + These three methods apply to CUPS all the same. A new and more + convenient way to load the Windows drivers into Samba is provided + if you use CUPS: +

    • + + the cupsaddsmb + utility.

    + cupsaddsmb is discussed in much detail further below. But we first + explore the CUPS filtering system and compare the Windows and UNIX printing architectures. +

    Advanced Intelligent Printing with PostScript Driver Download

    + + We now know + how to set up a “dump” printserver, that is, a server which is spooling + printjobs “raw”, leaving the print data untouched. +

    + Possibly you need to setup CUPS in a smarter way. The reasons could + be manifold: +

    • Maybe your boss wants to get monthly statistics: Which + printer did how many pages? What was the average data size of a job? + What was the average print run per day? What are the typical hourly + peaks in printing? Which department prints how much?

    • Maybe you are asked to setup a print quota system: + Users should not be able to print more jobs, once they have surpassed + a given limit per period.

    • Maybe your previous network printing setup is a mess + and must be re-organized from a clean beginning.

    • Maybe you have experiencing too many “blue screens” + originating from poorly debugged printer drivers running in NT “kernel mode”?

    + These goals cannot be achieved by a raw print server. To build a + server meeting these requirements, you'll first need to learn about + how CUPS works and how you can enable its features. +

    + What follows is the comparison of some fundamental concepts for + Windows and UNIX printing; then follows a description of the + CUPS filtering system, how it works and how you can tweak it. +

    GDI on Windows -- PostScript on UNIX

    + + + Network printing is one of the most complicated and error-prone + day-to-day tasks any user or administrator may encounter. This is + true for all OS platforms. And there are reasons for this. +

    + + + You can't expect most file formats to just throw them toward + printers and they get printed. There needs to be a file format + conversion in between. The problem is that there is no common standard for + print file formats across all manufacturers and printer types. While + PostScript (trademark held by Adobe) and, to an + extent, PCL (trademark held by HP) have developed + into semi-official “standards” by being the most widely used PDLs + Page Description Languages (PDLs), there are still + many manufacturers who “roll their own” (their reasons may be + unacceptable license fees for using printer-embedded PostScript + interpreters, and so on). +

    Windows Drivers, GDI and EMF

    + + + + In Windows OS, the format conversion job is done by the printer + drivers. On MS Windows OS platforms all application programmers have + at their disposal a built-in API, the Graphical Device + Interface (GDI), as part and parcel of the OS itself to base + themselves on. This GDI core is used as one common unified ground for + all Windows programs to draw pictures, fonts and documents + on screen as well as on + paper (print). Therefore, printer driver developers can + standardize on a well-defined GDI output for their own driver + input. Achieving WYSIWYG (“What You See Is What You Get”) is + relatively easy, because the on-screen graphic primitives, as well as + the on-paper drawn objects, come from one common source. This source, + the GDI, often produces a file format called Enhanced + MetaFile (EMF). The EMF is processed by the printer driver and + converted to the printer-specific file format. +

    Note

    + + To the GDI foundation in MS Windows, Apple has chosen to + put paper and screen output on a common foundation for their + (BSD-UNIX-based, did you know?) Mac OS X and Darwin Operating + + + + + Systems. Their Core Graphic Engine uses a + PDF derivative for all display work. +

    + +

    Figure 19.1. Windows printing to a local printer.

    Windows printing to a local printer.

    +

    UNIX Printfile Conversion and GUI Basics

    + + + + + In UNIX and Linux, there is no comparable layer built into the OS + kernel(s) or the X (screen display) server. Every application is + responsible for itself to create its print output. Fortunately, most + use PostScript and that at least gives some common ground. Unfortunately, + there are many different levels of quality for this PostScript. And + worse, there is a huge difference (and no common root) in the way + the same document is displayed on screen and how it is presented on + paper. WYSIWYG is more difficult to achieve. This goes back to the + time, decades ago, when the predecessors of X.org, + designing the UNIX foundations and protocols for Graphical User + Interfaces, refused to take responsibility for “paper output” + also, as some had demanded at the time, and restricted itself to + “on-screen only.” (For some years now, the “Xprint” project has been + under development, attempting to build printing support into the X + framework, including a PostScript and a PCL driver, but it is not yet + ready for prime time.) You can see this unfavorable inheritance up to + the present day by looking into the various “font” directories on your + system; there are separate ones for fonts used for X display and fonts + to be used on paper. +

    Background.  + + The PostScript programming language is an “invention” by Adobe Inc., + but its specifications have been published to the full. Its strength + lies in its powerful abilities to describe graphical objects (fonts, + shapes, patterns, lines, curves, and dots), their attributes (color, + linewidth) and the way to manipulate (scale, distort, rotate, + shift) them. Because of its open specification, anybody with the + skill can start writing his own implementation of a PostScript + interpreter and use it to display PostScript files on screen or on + paper. Most graphical output devices are based on the concept of + “raster images” or “pixels” (one notable exception is pen + plotters). Of course, you can look at a PostScript file in its textual + form and you will be reading its PostScript code, the language + instructions which need to be interpreted by a rasterizer. Rasterizers + produce pixel images, which may be displayed on screen by a viewer + program or on paper by a printer. +

    PostScript and Ghostscript

    + + + + So, UNIX is lacking a common ground for printing on paper and + displaying on screen. Despite this unfavorable legacy for UNIX, basic + printing is fairly easy if you have PostScript printers at your + disposal. The reason is these devices have a built-in PostScript + language “interpreter,” also called a Raster Image + Processor (RIP) (which makes them more expensive than + other types of printers); throw PostScript toward them, and they will + spit out your printed pages. Their RIP is doing all the hard work of + converting the PostScript drawing commands into a bitmap picture as + you see it on paper, in a resolution as done by your printer. This is + no different to PostScript printing a file from a Windows origin. +

    Note

    + + Traditional UNIX programs and printing systems while + using PostScript are largely not PPD-aware. PPDs are “PostScript + Printer Description” files. They enable you to specify and control all + options a printer supports: duplexing, stapling and punching. Therefore, + UNIX users for a long time couldn't choose many of the supported + device and job options, unlike Windows or Apple users. But now there + is CUPS. +

    +

    Figure 19.2. Printing to a PostScript printer.

    Printing to a PostScript printer.

    +

    + + However, there are other types of printers out there. These do not know + how to print PostScript. They use their own Page Description + Language (PDL, often proprietary). To print to them is much + more demanding. Since your UNIX applications mostly produce + PostScript, and since these devices do not understand PostScript, you + need to convert the printfiles to a format suitable for your printer + on the host before you can send it away. +

    Ghostscript the Software RIP for Non-PostScript Printers

    + + Here is where Ghostscript kicks in. Ghostscript is + the traditional (and quite powerful) PostScript interpreter used on + UNIX platforms. It is a RIP in software, capable of doing a + lot of file format conversions for a very broad + spectrum of hardware devices as well as software file formats. + Ghostscript technology and drivers are what enable PostScript printing + to non-PostScript hardware. +

    +

    Figure 19.3. Ghostscript as a RIP for non-postscript printers.

    Ghostscript as a RIP for non-postscript printers.

    +

    Tip

    + Use the “gs -h” command to check for all built-in “devices” + of your Ghostscript version. If you specify a parameter of + -sDEVICE=png256 on your Ghostscript command + line, you are asking Ghostscript to convert the input into a PNG + file. Naming a “device” on the command line is the most important + single parameter to tell Ghostscript exactly how it should render the + input. New Ghostscript versions are released at fairly regular + intervals, now by artofcode LLC. They are initially put under the + “AFPL” license, but re-released under the GNU GPL as soon as the next + AFPL version appears. GNU Ghostscript is probably the version + installed on most Samba systems. But it has some deficiencies. + + Therefore, ESP Ghostscript was developed as an + enhancement over GNU Ghostscript, with lots of bug-fixes, additional + devices and improvements. It is jointly maintained by developers from + CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat, and Debian. It includes + the “cups” device (essential to print to non-PS printers from CUPS). +

    PostScript Printer Description (PPD) Specification

    + + While PostScript in essence is a Page Description + Language (PDL) to represent the page layout in a + device-independent way, real-world print jobs are + always ending up being output on hardware with device-specific + features. To take care of all the differences in hardware and to + allow for innovations, Adobe has specified a syntax and file format + for PostScript Printer Description (PPD) + files. Every PostScript printer ships with one of these files. +

    + PPDs contain all the information about general and special features of the + given printer model: Which different resolutions can it handle? Does + it have a Duplexing Unit? How many paper trays are there? What media + types and sizes does it take? For each item, it also names the special + command string to be sent to the printer (mostly inside the PostScript + file) in order to enable it. +

    + Information from these PPDs is meant to be taken into account by the + printer drivers. Therefore, installed as part of the Windows + PostScript driver for a given printer is the printer's PPD. Where it + makes sense, the PPD features are presented in the drivers' UI dialogs + to display to the user a choice of print options. In the end, the + user selections are somehow written (in the form of special + PostScript, PJL, JCL or vendor-dependent commands) into the PostScript + file created by the driver. +

    Warning

    + + A PostScript file that was created to contain device-specific commands + for achieving a certain print job output (e.g., duplexed, stapled and + punched) on a specific target machine, may not print as expected, or + may not be printable at all on other models; it also may not be fit + for further processing by software (e.g., by a PDF distilling program). +

    Using Windows-Formatted Vendor PPDs

    + CUPS can handle all spec-compliant PPDs as supplied by the + manufacturers for their PostScript models. Even if a + vendor might not have mentioned our favorite + OS in his manuals and brochures, you can safely trust this: + If you get the Windows NT version of the PPD, you + can use it unchanged in CUPS and thus access the full + power of your printer just like a Windows NT user could! +

    Tip

    + To check the spec compliance of any PPD online, go to http://www.cups.org/testppd.php + and upload your PPD. You will see the results displayed + immediately. CUPS in all versions after 1.1.19 has a much more strict + internal PPD parsing and checking code enabled; in case of printing + trouble, this online resource should be one of your first pitstops. +

    Warning

    + + + For real PostScript printers, do not use the + Foomatic or cupsomatic + PPDs from Linuxprinting.org. With these devices, the original + vendor-provided PPDs are always the first choice! +

    Tip

    + If you are looking for an original vendor-provided PPD of a specific + device, and you know that an NT4 box (or any other Windows box) on + your LAN has the PostScript driver installed, just use + smbclient //NT4-box/print\$ -U username to + access the Windows directory where all printer driver files are + stored. First look in the W32X86/2 subdir for + the PPD you are seeking. +

    CUPS Also Uses PPDs for Non-PostScript Printers

    + CUPS also uses specially crafted PPDs to handle non-PostScript + printers. These PPDs are usually not available from the vendors (and + no, you can't just take the PPD of a PostScript printer with the same + model name and hope it works for the non-PostScript version too). To + understand how these PPDs work for non-PS printers, we first need to + dive deeply into the CUPS filtering and file format conversion + architecture. Stay tuned. +

    The CUPS Filtering Architecture

    The core of the CUPS filtering system is based on -Ghostscript. In addition to Ghostscript, CUPS +Ghostscript. In addition to Ghostscript, CUPS uses some other filters of its own. You (or your OS vendor) may have plugged in even more filters. CUPS handles all data file formats under -the label of various MIME types. Every incoming +the label of various MIME types. Every incoming printfile is subjected to an initial -auto-typing. The auto-typing determines its given +auto-typing. The auto-typing determines its given MIME type. A given MIME type implies zero or more possible filtering chains relevant to the selected target printer. This section discusses how MIME types recognition and conversion rules interact. They are used by CUPS to automatically setup a working filtering chain for any given input data format.

    -If CUPS rasterizes a PostScript file natively to -a bitmap, this is done in 2 stages: -

    • the first stage uses a Ghostscript device named "cups" +If CUPS rasterizes a PostScript file natively to +a bitmap, this is done in two stages: +

      • The first stage uses a Ghostscript device named “cups” (this is since version 1.1.15) and produces a generic raster format -called "CUPS raster". -

      • the second stage uses a "raster driver" which converts -the generic CUPS raster to a device specific raster.

      -Make sure your Ghostscript version has the "cups" device compiled in -(check with gs -h | grep cups). Otherwise you +called “CUPS raster”. +

    • The second stage uses a “raster driver” that converts + the generic CUPS raster to a device-specific raster.

    +Make sure your Ghostscript version has the “cups” device compiled in +(check with gs -h | grep cups). Otherwise you may encounter the dreaded Unable to convert file -0 in your CUPS error_log file. To have "cups" as a -device in your Ghostscript, you either need to patch GNU -Ghostscript and re-compile or use ESP Ghostscript. The -superior alternative is ESP Ghostscript: it supports not just CUPS, +0 in your CUPS error_log file. To have “cups” as a +device in your Ghostscript, you either need to patch GNU +Ghostscript and re-compile, or use ESP Ghostscript. The +superior alternative is ESP Ghostscript. It supports not just CUPS, but 300 other devices too (while GNU Ghostscript supports only about 180). Because of this broad output device support, ESP Ghostscript is -the first choice for non-CUPS spoolers too. It is now recommended by +the first choice for non-CUPS spoolers, too. It is now recommended by Linuxprinting.org for all spoolers.

    - - -CUPS printers may be setup to use external -rendering paths. One of the most common ones is provided by the -Foomatic/cupsomatic concept, from Linuxprinting.org. This + + +CUPS printers may be setup to use external +rendering paths. One of the most common is provided by the +Foomatic/cupsomatic concept from Linuxprinting.org. This uses the classical Ghostscript approach, doing everything in one -step. It doesn't use the "cups" device, but one of the many +step. It does not use the “cups” device, but one of the many others. However, even for Foomatic/cupsomatic usage, best results and - + broadest printer model support is provided by ESP Ghostscript (more about cupsomatic/Foomatic, particularly the new version called now foomatic-rip, follows below). -

    MIME types and CUPS Filters

    - +

    MIME Types and CUPS Filters

    + + CUPS reads the file /etc/cups/mime.types (and all other files carrying a *.types suffix in the same directory) upon startup. These files contain the MIME -type recognition rules which are applied when CUPS runs its +type recognition rules that are applied when CUPS runs its auto-typing routines. The rule syntax is explained in the man page for mime.types and in the comments section of the mime.types file itself. A simple rule reads like this: -

    - -

    +
+
+
      application/pdf         pdf string(0,%PDF)
 
    
-This means: if a filename has either a
-.pdf suffix, or if the magic
+
+This means if a filename has either a
+.pdf suffix or if the magic
 string %PDF is right at the
 beginning of the file itself (offset 0 from the start), then it is
-a PDF file (application/pdf).
+a PDF file (application/pdf).
 Another rule is this: 
-
    +
+
      application/postscript  ai eps ps string(0,%!) string(0,<04>%!)
 
    
-Its meaning: if the filename has one of the suffixes
+
+If the filename has one of the suffixes
 .ai, .eps,
 .ps or if the file itself starts with one of the
 strings %! or <04>%!, it
 is a generic PostScript file
-(application/postscript).
-
    Note
    
-There is a very important difference between two similar MIME type in
-CUPS: one is application/postscript, the other is
-application/vnd.cups-postscript. While
-application/postscript is meant to be device
+(application/postscript).
+
    Warning
    
+Don't confuse the other mime.types files your system might be using
+with the one in the /etc/cups/ directory.
+
    Note
    
+There is an important difference between two similar MIME types in
+CUPS: one is application/postscript, the other is
+application/vnd.cups-postscript. While
+application/postscript is meant to be device
 independent (job options for the file are still outside the PS file
-content, embedded in commandline or environment variables by CUPS),
-application/vnd.cups-postscript may have the job
-options inserted into the PostScript data itself (were
+content, embedded in command line or environment variables by CUPS),
+application/vnd.cups-postscript may have the job
+options inserted into the PostScript data itself (where
 applicable). The transformation of the generic PostScript
-(application/postscript) to the device-specific version
-(application/vnd.cups-postscript) is the responsibility of the
-CUPS pstops filter. pstops uses information
+(application/postscript) to the device-specific version
+(application/vnd.cups-postscript) is the responsibility of the
+CUPS pstops filter. pstops uses information
 contained in the PPD to do the transformation.
-
    Warning
    
-Don't confuse the other mime.types file your system might be using
-with the one in the /etc/cups/ directory.
 
    
-CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI and a
-lot of image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster,
-PNM, PBM, SGI-RGB and some more) and their associated MIME types
+CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI, and
+many image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster,
+PNM, PBM, SGI-RGB, and more) and their associated MIME types
 with its filters.
-
    MIME type Conversion Rules
    
+
    MIME Type Conversion Rules
    
+
+
 CUPS reads the file /etc/cups/mime.convs
 (and all other files named with a *.convs
 suffix in the same directory) upon startup. These files contain
 lines naming an input MIME type, an output MIME type, a format
-conversion filter which can produce the output from the input type
+conversion filter that can produce the output from the input type
 and virtual costs associated with this conversion. One example line
 reads like this:
-
    +
+
      application/pdf         application/postscript   33   pdftops
 
    
-This means that the pdftops filter will take
-application/pdf as input and produce
-application/postscript as output, the virtual
+
+This means that the pdftops filter will take
+application/pdf as input and produce
+application/postscript as output; the virtual
 cost of this operation is 33 CUPS-$. The next filter is more
 expensive, costing 66 CUPS-$:
-
    +
+
+
+
      application/vnd.hp-HPGL application/postscript   66   hpgltops
 
    
-This is the hpgltops, which processes HP-GL
+
+This is the hpgltops, which processes HP-GL
 plotter files to PostScript.
-
    +
+
+
+
      application/octet-stream
 
    
+
 Here are two more examples: 
-
    +
+
+
+
      application/x-shell     application/postscript   33    texttops
  text/plain              application/postscript   33    texttops
 
    
-The last two examples name the texttops filter
-to work on "text/plain" as well as on "application/x-shell". (Hint:
-this differentiation is needed for the syntax highlighting feature of
-"texttops").
-
    Filter Requirements
    
-There are many more combinations named in mime.convs.  However, you
+
+The last two examples name the texttops filter
+to work on text/plain as well as on application/x-shell. (Hint:
+This differentiation is needed for the syntax highlighting feature of
+texttops).
+
    Filtering  Overview
    
+
+There are many more combinations named in mime.convs. However, you
 are not limited to use the ones pre-defined there. You can plug in any
 filter you like into the CUPS framework. It must meet, or must be made
-to meet some minimal requirements. If you find (or write) a cool
+to meet, some minimal requirements. If you find (or write) a cool
 conversion filter of some kind, make sure it complies to what CUPS
-needs, and put in the right lines in mime.types
+needs and put in the right lines in mime.types
 and mime.convs, then it will work seamlessly
-inside CUPS!
-
    Tip
    
-The mentioned "CUPS requirements" for filters are simple. Take
+inside CUPS.
+
    Filter requirements
    
+The mentioned “CUPS requirements” for filters are simple. Take
 filenames or stdin as input and write to
 stdout. They should take these 5 or 6 arguments:
 printer job user title copies options [filename]
-
    Printer
    The name of the printer queue (normally this is the
-name of the filter being run)
    job
    The numeric job ID for the job being
-printed
    user
    The string from the originating-user-name
-attribute
    title
    The string from the job-name attribute
    copies
    The numeric value from the number-copies
-attribute
    options
    The job options
    filename
    (Optionally) The print request file (if missing,
+
    Printer 
    The name of the printer queue (normally this is the
+name of the filter being run).
    job 
    The numeric job ID for the job being
+printed.
    user 
    The string from the originating-user-name
+attribute.
    title 
    The string from the job-name attribute.
    copies 
    The numeric value from the number-copies
+attribute.
    options 
    The job options.
    filename 
    (Optionally) The print request file (if missing,
 filters expected data fed through stdin). In most
-cases it is very easy to write a simple wrapper script around existing
-filters to make them work with CUPS.
    Prefilters
    
-As was said, PostScript is the central file format to any UNIX based
+cases, it is easy to write a simple wrapper script around existing
+filters to make them work with CUPS.
    Prefilters
    
+
+As previously stated, PostScript is the central file format to any UNIX-based
 printing system. From PostScript, CUPS generates raster data to feed
 non-PostScript printers.
 
    
-But what is happening if you send one of the supported non-PS formats
-to print? Then CUPS runs "pre-filters" on these input formats to
+But what happens if you send one of the supported non-PS formats
+to print? Then CUPS runs “pre-filters” on these input formats to
 generate PostScript first. There are pre-filters to create PS from
-ASCII text, PDF, DVI or HP-GL. The outcome of these filters is always
-of MIME type application/postscript (meaning that
+ASCII text, PDF, DVI, or HP-GL. The outcome of these filters is always
+of MIME type application/postscript (meaning that
 any device-specific print options are not yet embedded into the
 PostScript by CUPS, and that the next filter to be called is
 pstops). Another pre-filter is running on all supported image formats,
-the imagetops filter. Its outcome is always of
-MIME type application/vnd.cups-postscript
-(not application/postscript), meaning it has the
+the imagetops filter. Its outcome is always of
+MIME type application/vnd.cups-postscript
+(not application/postscript), meaning it has the
 print options already embedded into the file.
 
    
-	
    Figure 19.4. Prefiltering in CUPS to form Postscript
    Prefiltering in CUPS to form Postscript
    
-
    pstops
    
-pstopsis the filter to convert
-application/postscript to
-application/vnd.cups-postscript. It was said
+	
    Figure 19.4. Pre-filtering in CUPS to form PostScript.
    Pre-filtering in CUPS to form PostScript.
    
+
    pstops
    
+pstops is the filter to convert
+application/postscript to 
+application/vnd.cups-postscript. It was said
 above that this filter inserts all device-specific print options
 (commands to the printer to ask for the duplexing of output, or
-stapling an punching it, etc.) into the PostScript file.
+stapling and punching it, and so on) into the PostScript file.
 
    
-	
    Figure 19.5. Adding Device-specific Print Options
    Adding Device-specific Print Options
    
+	
    Figure 19.5. Adding device-specific print options.
    Adding device-specific print options.
    
 
    
-This is not all: other tasks performed by it are:
+This is not all. Other tasks performed by it are:
 
    • 
-selecting the range of pages to be printed (if you choose to
-print only pages "3, 6, 8-11, 16, 19-21", or only the odd numbered
-ones)
+Selecting the range of pages to be printed (if you choose to
+print only pages “3, 6, 8-11, 16, 19-21”, or only the odd numbered
+ones).
 
    • 
-putting 2 or more logical pages on one sheet of paper (the
-so-called "number-up" function)
-
    • counting the pages of the job to insert the accounting
-information into the /var/log/cups/page_log
-
    pstoraster
    
-pstoraster is at the core of the CUPS filtering
+Putting 2 or more logical pages on one sheet of paper (the
+so-called “number-up” function).
+
  • Counting the pages of the job to insert the accounting
+information into the /var/log/cups/page_log.
+

    • pstoraster

    +pstoraster is at the core of the CUPS filtering system. It is responsible for the first stage of the rasterization process. Its input is of MIME type application/vnd.cups-postscript; its output is application/vnd.cups-raster. This output format is not yet meant to be printable. Its aim is to serve as a general purpose -input format for more specialized raster drivers, +input format for more specialized raster drivers that are able to generate device-specific printer data.

    -

    Figure 19.6. Postscript to intermediate Raster format

    Postscript to intermediate Raster format

    +

    Figure 19.6. PostScript to intermediate raster format.

    PostScript to intermediate raster format.

    CUPS raster is a generic raster format with powerful features. It is -able to include per-page information, color profiles and more to be +able to include per-page information, color profiles, and more, to be used by the following downstream raster drivers. Its MIME type is -registered with IANA and its specification is of course completely -open. It is designed to make it very easy and inexpensive for +registered with IANA and its specification is, of course, completely +open. It is designed to make it quite easy and inexpensive for manufacturers to develop Linux and UNIX raster drivers for their printer models, should they choose to do so. CUPS always takes care -for the first stage of rasterization so these vendors don't need to care +for the first stage of rasterization so these vendors do not need to care about Ghostscript complications (in fact, there is currently more than one vendor financing the development of CUPS raster drivers).

    -

    Figure 19.7. CUPS-raster production using Ghostscript

    CUPS-raster production using Ghostscript

    +

    Figure 19.7. CUPS-raster production using Ghostscript.

    CUPS-raster production using Ghostscript.

    CUPS versions before version 1.1.15 were shipping a binary (or source -code) standalone filter, named "pstoraster". pstoraster was derived +code) standalone filter, named pstoraster. pstoraster was derived from GNU Ghostscript 5.50, and could be installed besides and in addition to any GNU or AFPL Ghostscript package without conflicting.

    -From version 1.1.15, this has changed. The functions for this has been +>From version 1.1.15, this has changed. The functions for this have been integrated back into Ghostscript (now based on GNU Ghostscript version -7.05). The "pstoraster" filter is now a simple shell script calling +7.05). The pstoraster filter is now a simple shell script calling gs with the -sDEVICE=cups -parameter. If your Ghostscript doesn't show a success on asking for +parameter. If your Ghostscript does not show a success on asking for gs -h |grep cups, you might not be able to -print. Update your Ghostscript then! -

    imagetops and imagetoraster

    -Above in the section about prefilters, we mentioned the prefilter -that generates PostScript from image formats. The imagetoraster +print. Update your Ghostscript. +

    imagetops and imagetoraster

    +In the section about pre-filters, we mentioned the pre-filter +that generates PostScript from image formats. The imagetoraster filter is used to convert directly from image to raster, without the intermediate PostScript stage. It is used more often than the above -mentioned prefilters. Here is a summarizing flowchart of image file -filtering: +mentioned pre-filters. A summarizing flowchart of image file +filtering is shown in .

    -

    Figure 19.8. Image format to CUPS-raster format conversion

    Image format to CUPS-raster format conversion

    -

    rasterto [printers specific]

    -CUPS ships with quite some different raster drivers processing CUPS +

    Figure 19.8. Image format to CUPS-raster format conversion.

    Image format to CUPS-raster format conversion.

    +

    rasterto [printers specific]

    +CUPS ships with quite different raster drivers processing CUPS raster. On my system I find in /usr/lib/cups/filter/ these: rastertoalps, rastertobj, rastertoepson, rastertoescp, rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo, -rastertoescp, rastertohp and +rastertoescp, rastertohp, and rastertoprinter. Don't worry if you have less than this; some of these are installed by commercial add-ons to CUPS (like rastertoturboprint), others (like -rastertoprinter) by 3rd party driver +rastertoprinter) by third-party driver development projects (such as Gimp-Print) wanting to cooperate as closely as possible with CUPS.

    -

    Figure 19.9. Raster to Printer Specific formats

    Raster to Printer Specific formats

    -

    CUPS Backends

    -The last part of any CUPS filtering chain is a "backend". Backends +

    Figure 19.9. Raster to printer-specific formats.

    Raster to printer-specific formats.

    +

    CUPS Backends

    +The last part of any CUPS filtering chain is a backend. Backends are special programs that send the print-ready file to the final device. There is a separate backend program for any transfer -"protocol" of sending printjobs over the network, or for every local -interface. Every CUPS printqueue needs to have a CUPS "device-URI" +protocol of sending printjobs over the network, or for every local +interface. Every CUPS print queue needs to have a CUPS “device-URI” associated with it. The device URI is the way to encode the backend used to send the job to its destination. Network device-URIs are using two slashes in their syntax, local device URIs only one, as you can see from the following list. Keep in mind that local interface names may vary much from my examples, if your OS is not Linux: -

    usb

    -This backend sends printfiles to USB-connected printers. An -example for the CUPS device-URI to use is: -usb:/dev/usb/lp0 -

    serial

    -This backend sends printfiles to serially connected printers. -An example for the CUPS device-URI to use is: -serial:/dev/ttyS0?baud=11500 -

    parallel

    -This backend sends printfiles to printers connected to the -parallel port. An example for the CUPS device-URI to use is: -parallel:/dev/lp0 -

    scsi

    -This backend sends printfiles to printers attached to the -SCSI interface. An example for the CUPS device-URI to use is: -scsi:/dev/sr1 -

    lpd

    -This backend sends printfiles to LPR/LPD connected network -printers. An example for the CUPS device-URI to use is: -lpd://remote_host_name/remote_queue_name -

    AppSocket/HP JetDirect

    -This backend sends printfiles to AppSocket (a.k.a. "HP -JetDirect") connected network printers. An example for the CUPS -device-URI to use is: -socket://10.11.12.13:9100 -

    ipp

    -This backend sends printfiles to IPP connected network -printers (or to other CUPS servers). Examples for CUPS device-URIs -to use are: -ipp:://192.193.194.195/ipp -(for many HP printers) or -ipp://remote_cups_server/printers/remote_printer_name -

    http

    -This backend sends printfiles to HTTP connected printers. -(The http:// CUPS backend is only a symlink to the ipp:// backend.) -Examples for the CUPS device-URIs to use are: -http:://192.193.194.195:631/ipp -(for many HP printers) or -http://remote_cups_server:631/printers/remote_printer_name -

    smb

    -This backend sends printfiles to printers shared by a Windows -host. An example for CUPS device-URIs to use are: -smb://workgroup/server/printersharename -Or -smb://server/printersharename -or -smb://username:password@workgroup/server/printersharename -or -smb://username:password@server/printersharename. -The smb:// backend is a symlink to the Samba utility -smbspool (doesn't ship with CUPS). If the -symlink is not present in your CUPS backend directory, have your -root user create it: ln -s `which smbspool` -/usr/lib/cups/backend/smb. -

    -It is easy to write your own backends as Shell or Perl scripts, if you +

    usb

    + This backend sends printfiles to USB-connected printers. An + example for the CUPS device-URI to use is: + usb:/dev/usb/lp0. +

    serial

    + This backend sends printfiles to serially connected printers. + An example for the CUPS device-URI to use is: + serial:/dev/ttyS0?baud=11500. +

    parallel

    + This backend sends printfiles to printers connected to the + parallel port. An example for the CUPS device-URI to use is: + parallel:/dev/lp0. +

    scsi

    + This backend sends printfiles to printers attached to the + SCSI interface. An example for the CUPS device-URI to use is: + scsi:/dev/sr1. +

    lpd

    + This backend sends printfiles to LPR/LPD connected network + printers. An example for the CUPS device-URI to use is: + lpd://remote_host_name/remote_queue_name. +

    AppSocket/HP JetDirect

    + This backend sends printfiles to AppSocket (a.k.a. "HP + JetDirect") connected network printers. An example for the CUPS + device-URI to use is: + socket://10.11.12.13:9100. +

    ipp

    + This backend sends printfiles to IPP connected network + printers (or to other CUPS servers). Examples for CUPS device-URIs + to use are: + ipp:://192.193.194.195/ipp + (for many HP printers) or + ipp://remote_cups_server/printers/remote_printer_name. +

    http

    + This backend sends printfiles to HTTP connected printers. + (The http:// CUPS backend is only a symlink to the ipp:// backend.) + Examples for the CUPS device-URIs to use are: + http:://192.193.194.195:631/ipp + (for many HP printers) or + http://remote_cups_server:631/printers/remote_printer_name. +

    smb

    + This backend sends printfiles to printers shared by a Windows + host. An example for CUPS device-URIs that may be used includes: +

    +

    smb://workgroup/server/printersharename
    smb://server/printersharename
    smb://username:password@workgroup/server/printersharename
    smb://username:password@server/printersharename

    +

    + The smb:// backend is a symlink to the Samba utility + smbspool (does not ship with CUPS). If the + symlink is not present in your CUPS backend directory, have your + root user create it: ln -s `which smbspool' + /usr/lib/cups/backend/smb. +

    +It is easy to write your own backends as shell or Perl scripts, if you need any modification or extension to the CUPS print system. One -reason could be that you want to create "special" printers which send -the printjobs as email (through a "mailto:/" backend), convert them to -PDF (through a "pdfgen:/" backend) or dump them to "/dev/null" (In +reason could be that you want to create “special” printers that send +the printjobs as email (through a “mailto:/” backend), convert them to +PDF (through a “pdfgen:/” backend) or dump them to “/dev/null”. (In fact I have the system-wide default printer set up to be connected to -a "devnull:/" backend: there are just too many people sending jobs -without specifying a printer, or scripts and programs which don't name +a devnull:/ backend: there are just too many people sending jobs +without specifying a printer, or scripts and programs which do not name a printer. The system-wide default deletes the job and sends a polite -mail back to the $USER asking him to always specify a correct -printername). +email back to the $USER asking him to always specify the correct +printer name.)

    Not all of the mentioned backends may be present on your system or usable (depending on your hardware configuration). One test for all @@ -824,315 +856,332 @@ utility. Used with the -v parameter, it lists all available backends: 

     $ lpinfo -v
-

    cupsomatic/Foomatic -- how do they fit into the Picture?

    -"cupsomatic" filters may be the most widely used on CUPS +

    The Role of cupsomatic/foomatic

    + + +cupsomatic filters may be the most widely used on CUPS installations. You must be clear about the fact that these were not -developed by the CUPS people. They are a "Third Party" add-on to +developed by the CUPS people. They are a third party add-on to CUPS. They utilize the traditional Ghostscript devices to render jobs for CUPS. When troubleshooting, you should know about the difference. Here the whole rendering process is done in one stage, -inside Ghostscript, using an appropriate "device" for the target -printer. cupsomatic uses PPDs which are generated from the "Foomatic" +inside Ghostscript, using an appropriate device for the target +printer. cupsomatic uses PPDs that are generated from the Foomatic Printer & Driver Database at Linuxprinting.org.

    You can recognize these PPDs from the line calling the -cupsomatic filter: -

    - *cupsFilter: "application/vnd.cups-postscript  0  cupsomatic"
+cupsomatic filter:
+
+
    + *cupsFilter: "application/vnd.cups-postscript  0  cupsomatic"
 
    
-This line you may find amongst the first 40 or so lines of the PPD
+
+You may find this line among the first 40 or so lines of the PPD
 file. If you have such a PPD installed, the printer shows up in the
-CUPS web interface with a foomatic namepart for
-the driver description. cupsomatic is a Perl script that runs
-Ghostscript, with all the complicated commandline options
-auto-constructed from the selected PPD and commandline options give to
+CUPS Web interface with a foomatic namepart for
+the driver description. cupsomatic is a Perl script that runs
+Ghostscript with all the complicated command line options
+auto-constructed from the selected PPD and command line options give to
 the printjob.
-
    
-However, cupsomatic is now deprecated. Its PPDs (especially the first
+
    
+
+	However, cupsomatic is now deprecated. Its PPDs (especially the first
 generation of them, still in heavy use out there) are not meeting the
 Adobe specifications. You might also suffer difficulties when you try
-to download them with "Point'n'Print" to Windows clients. A better,
-and more powerful successor is now in a very stable Beta-version
-available: it is called foomatic-rip. To use
-foomatic-rip as a filter with CUPS, you need the new-type PPDs.  These
-have a similar, but different line:
-
    -
- *cupsFilter: "application/vnd.cups-postscript  0  foomatic-rip"
+to download them with “Point'n'Print” to Windows clients. A better
+and more powerful successor is now in a stable beta-version: it is called foomatic-rip. To use
+foomatic-rip as a filter with CUPS, you need the new-type PPDs. These
+have a similar but different line:
 
+
    + *cupsFilter: "application/vnd.cups-postscript  0  foomatic-rip"
 
    
+
 The PPD generating engine at Linuxprinting.org has been revamped.
 The new PPDs comply to the Adobe spec. On top, they also provide a
 new way to specify different quality levels (hi-res photo, normal
-color, grayscale, draft...) with a single click (whereas before you
-could have required 5 or more different selections (media type,
-resolution, inktype, dithering algorithm...). There is support for
+color, grayscale, and draft) with a single click, whereas before you
+could have required five or more different selections (media type,
+resolution, inktype and dithering algorithm). There is support for
 custom-size media built in. There is support to switch
-print-options from page to page, in the middle of a job. And the
-best thing is: the new foomatic-rip now works seamlessly with all
-legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR etc.), providing
-for them access to use PPDs for their printing!
-

    The Complete Picture

    -If you want to see an overview over all the filters and how they +print-options from page to page in the middle of a job. And the +best thing is the new foomatic-rip now works seamlessly with all +legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR and so on), providing +for them access to use PPDs for their printing. +

    The Complete Picture

    +If you want to see an overview of all the filters and how they relate to each other, the complete picture of the puzzle is at the end of this document. -

    mime.convs

    +

    mime.convs

    CUPS auto-constructs all possible filtering chain paths for any given MIME type, and every printer installed. But how does it decide in -favor or against a specific alternative? (There may often be cases, +favor or against a specific alternative? (There may often be cases where there is a choice of two or more possible filtering chains for -the same target printer). Simple: you may have noticed the figures in -the 3rd column of the mime.convs file. They represent virtual costs +the same target printer.) Simple. You may have noticed the figures in +the third column of the mime.convs file. They represent virtual costs assigned to this filter. Every possible filtering chain will sum up to -a total "filter cost". CUPS decides for the most "inexpensive" route. +a total “filter cost.” CUPS decides for the most “inexpensive” route.

    Tip

    The setting of FilterLimit 1000 in cupsd.conf will not allow more filters to run concurrently than will consume a total of 1000 virtual filter -cost. This is a very efficient way to limit the load of any CUPS -server by setting an appropriate "FilterLimit" value. A FilterLimit of -200 allows roughly 1 job at a time, while a FilterLimit of 1000 allows -approximately 5 jobs maximum at a time. -

    "Raw" printing

    -You can tell CUPS to print (nearly) any file "raw". "Raw" means it -will not be filtered. CUPS will send the file to the printer "as is" +cost. This is an efficient way to limit the load of any CUPS +server by setting an appropriate “FilterLimit” value. A FilterLimit of +200 allows roughly one job at a time, while a FilterLimit of 1000 allows +approximately five jobs maximum at a time. +

    “Raw” Printing

    + You can tell CUPS to print (nearly) any file “raw”. “Raw” means it + will not be filtered. CUPS will send the file to the printer “as is” without bothering if the printer is able to digest it. Users need to take care themselves that they send sensible data formats only. Raw -printing can happen on any queue if the "-o raw" option is specified +printing can happen on any queue if the “-o raw” option is specified on the command line. You can also set up raw-only queues by simply not associating any PPD with it. This command: 

     $ lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E

    -sets up a queue named "rawprinter", connected via the "socket" -protocol (a.k.a. "HP JetDirect") to the device at IP address + sets up a queue named “rawprinter”, connected via the “socket” + protocol (a.k.a. “HP JetDirect”) to the device at IP address 11.12.1.3.14, using port 9100. (If you had added a PPD with -P /path/to/PPD to this command line, you would -have installed a "normal" printqueue. +have installed a “normal” print queue.

    -CUPS will automatically treat each job sent to a queue as a "raw" one, -if it can't find a PPD associated with the queue. However, CUPS will +CUPS will automatically treat each job sent to a queue as a “raw” one, +if it can't find a PPD associated with the queue. However, CUPS will only send known MIME types (as defined in its own mime.types file) and refuse others. -

    "application/octet-stream" printing

    +

    application/octet-stream Printing

    Any MIME type with no rule in the /etc/cups/mime.types file is regarded as unknown -or application/octet-stream and will not be +or application/octet-stream and will not be sent. Because CUPS refuses to print unknown MIME types per default, -you will probably have experienced the fact that printjobs originating +you will probably have experienced the fact that print jobs originating from Windows clients were not printed. You may have found an error message in your CUPS logs like: -

    +
    
  Unable to convert file 0 to printable format for job
-

    -To enable the printing of "application/octet-stream" files, edit +

    +To enable the printing of application/octet-stream files, edit these two files:

    • /etc/cups/mime.convs

    • /etc/cups/mime.types

    Both contain entries (at the end of the respective files) which must be uncommented to allow RAW mode operation for -application/octet-stream. In /etc/cups/mime.types +application/octet-stream. In /etc/cups/mime.types make sure this line is present: -

    - application/octet-stream
+
+
+
+
    +application/octet-stream
 
    
+
 This line (with no specific auto-typing rule set) makes all files
-not otherwise auto-typed a member of application/octet-stream. In
+not otherwise auto-typed a member of application/octet-stream. In
 /etc/cups/mime.convs, have this
 line: 
-
    - application/octet-stream   application/vnd.cups-raw   0   -
-
    
+
+
    +application/octet-stream   application/vnd.cups-raw   0   -
+
    
+
+
+
 This line tells CUPS to use the Null Filter
-(denoted as "-", doing... nothing at all) on
-application/octet-stream, and tag the result as
-application/vnd.cups-raw. This last one is
+(denoted as “-”, doing nothing at all) on
+application/octet-stream, and tag the result as
+application/vnd.cups-raw. This last one is
 always a green light to the CUPS scheduler to now hand the file over
-to the "backend" connecting to the printer and sending it over.
-
    Note
     Editing the mime.convs and the
+to the backend connecting to the printer and sending it over.
+
    Note
    Editing the mime.convs and the
 mime.types file does not
-enforce "raw" printing, it only
+enforce “raw” printing, it only
 allows it.
 
    Background. 
 CUPS being a more security-aware printing system than traditional ones
 does not by default allow one to send deliberate (possibly binary)
-data to printing devices.  (This could be easily abused to launch a
+data to printing devices. (This could be easily abused to launch a
 Denial of Service attack on your printer(s), causing at least the loss
-of a lot of paper and ink...) "Unknown" data are regarded by CUPS
+of a lot of paper and ink...) “Unknown” data are regarded by CUPS
 as MIME type
 application/octet-stream. While you
-can send data "raw", the MIME type for these must
+can send data “raw”, the MIME type for these must
 be one that is known to CUPS and an allowed one. The file
-/etc/cups/mime.types defines the "rules" how CUPS
+/etc/cups/mime.types defines the “rules” of how CUPS
 recognizes MIME types. The file
 /etc/cups/mime.convs decides which file
 conversion filter(s) may be applied to which MIME types.
-
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    
+
    PostScript Printer Descriptions (PPDs) for Non-PS Printers
    
+
 Originally PPDs were meant to be used for PostScript printers
 only. Here, they help to send device-specific commands and settings
 to the RIP which processes the jobfile. CUPS has extended this
 scope for PPDs to cover non-PostScript printers too. This was not
-very difficult, because it is a standardized file format. In a way
+difficult, because it is a standardized file format. In a way
 it was logical too: CUPS handles PostScript and uses a PostScript
-RIP (=Ghostscript) to process the jobfiles. The only difference is:
+RIP (Ghostscript) to process the jobfiles. The only difference is:
 a PostScript printer has the RIP built-in, for other types of
 printers the Ghostscript RIP runs on the host computer.
 
    
 PPDs for a non-PS printer have a few lines that are unique to
 CUPS. The most important one looks similar to this:
-
    +
+
+
+
      *cupsFilter: application/vnd.cups-raster  66   rastertoprinter
 
    
+
 It is the last piece in the CUPS filtering puzzle. This line tells the
-CUPS daemon to use as a last filter "rastertoprinter".  This filter
-should be served as input an "application/vnd.cups-raster" MIME type
-file. Therefore CUPS should auto-construct a filtering chain, which
+CUPS daemon to use as a last filter rastertoprinter. This filter
+should be served as input an application/vnd.cups-raster MIME type
+file. Therefore, CUPS should auto-construct a filtering chain, which
 delivers as its last output the specified MIME type. This is then
-taken as input to the specified "rastertoprinter" filter. After this
-the last filter has done its work ("rastertoprinter" is a Gimp-Print
+taken as input to the specified rastertoprinter filter. After this
+the last filter has done its work (rastertoprinter is a Gimp-Print
 filter), the file should go to the backend, which sends it to the
 output device.
 
    
 CUPS by default ships only a few generic PPDs, but they are good for
 several hundred printer models. You may not be able to control
 different paper trays, or you may get larger margins than your
-specific model supports):
-
    Table 19.1. PPD's shipped with CUPS
    PPD filePrinter type
    deskjet.ppdolder HP inkjet printers and compatible
    deskjet2.ppdnewer HP inkjet printers and compatible 
    dymo.ppdlabel printers 
    epson9.ppdEpson 24pin impact printers and compatible 
    epson24.ppdEpson 24pin impact printers and compatible 
    okidata9.ppdOkidata 9pin impact printers and compatible 
    okidat24.ppdOkidata 24pin impact printers and compatible 
    stcolor.ppdolder Epson Stylus Color printers 
    stcolor2.ppdnewer Epson Stylus Color printers 
    stphoto.ppdolder Epson Stylus Photo printers 
    stphoto2.ppdnewer Epson Stylus Photo printers 
    laserjet.ppdall PCL printers. Further below is a discussion of several other driver/PPD-packages suitable for use with CUPS.  
    Difference between cupsomatic/foomatic-rip and
-native CUPS printing
    
-Native CUPS rasterization works in two steps.
+specific model supports. See  for summary information.
+
    Table 19.1. PPDs shipped with CUPS
    PPD filePrinter type
    deskjet.ppdolder HP inkjet printers and compatible
    deskjet2.ppdnewer HP inkjet printers and compatible 
    dymo.ppdlabel printers 
    epson9.ppdEpson 24pin impact printers and compatible 
    epson24.ppdEpson 24pin impact printers and compatible 
    okidata9.ppdOkidata 9pin impact printers and compatible 
    okidat24.ppdOkidata 24pin impact printers and compatible 
    stcolor.ppdolder Epson Stylus Color printers 
    stcolor2.ppdnewer Epson Stylus Color printers 
    stphoto.ppdolder Epson Stylus Photo printers 
    stphoto2.ppdnewer Epson Stylus Photo printers 
    laserjet.ppdall PCL printers. Further below is a discussion
+			of several other driver/PPD-packages suitable for use with CUPS. 
    cupsomatic/foomatic-rip Versus native CUPS Printing
    
+
+
+Native CUPS rasterization works in two steps:
 
    • 
-First is the "pstoraster" step. It uses the special "cups"
-
-device from ESP Ghostscript 7.05.x as its tool
+First is the pstoraster step. It uses the special CUPS
+
+device from ESP Ghostscript 7.05.x as its tool.
 
    • 
-Second comes the "rasterdriver" step. It uses various
+Second comes the rasterdriver step. It uses various
 device-specific filters; there are several vendors who provide good
-quality filters for this step, some are Free Software, some are
-Shareware/Non-Free, some are proprietary.
    
+quality filters for this step. Some are free software, some are
+shareware/non-free and some are proprietary.
    
 Often this produces better quality (and has several more
 advantages) than other methods.
 
    
-	
    Figure 19.10. cupsomatic/foomatic processing versus Native CUPS
    cupsomatic/foomatic processing versus Native CUPS
    
+	
    Figure 19.10. cupsomatic/foomatic Processing versus Native CUPS.
    cupsomatic/foomatic Processing versus Native CUPS.
    
 
    
-One other method is the cupsomatic/foomatic-rip
-way. Note that cupsomatic is not made by the CUPS
+One other method is the cupsomatic/foomatic-rip
+way. Note that cupsomatic is not made by the CUPS
 developers. It is an independent contribution to printing development,
-made by people from Linuxprinting.org (see also http://www.cups.org/cups-help.html).
-cupsomatic is no longer developed and maintained and is no longer
+made by people from Linuxprinting.org [4].
+cupsomatic is no longer developed and maintained and is no longer
 supported. It has now been replaced by
-foomatic-rip. foomatic-rip is a complete re-write
-of the old cupsomatic idea, but very much improved and generalized to
+foomatic-rip. foomatic-rip is a complete re-write
+of the old cupsomatic idea, but very much improved and generalized to
 other (non-CUPS) spoolers. An upgrade to foomatic-rip is strongly
-advised, especially if you are upgrading to a recent version of CUPS
+advised, especially if you are upgrading to a recent version of CUPS,
 too.
 
    
-	
-	
-Both the cupsomatic (old) and the foomatic-rip (new) methods from
+	
+	
+Both the cupsomatic (old) and the foomatic-rip (new) methods from
 Linuxprinting.org use the traditional Ghostscript print file
 processing, doing everything in a single step. It therefore relies on
-all the other devices built-in into Ghostscript. The quality is as
+all the other devices built into Ghostscript. The quality is as
 good (or bad) as Ghostscript rendering is in other spoolers. The
 advantage is that this method supports many printer models not
 supported (yet) by the more modern CUPS method.
 
    
 Of course, you can use both methods side by side on one system (and
-even for one printer, if you set up different queues), and find out
+even for one printer, if you set up different queues) and find out
 which works best for you.
 
    
-cupsomatic "kidnaps" the printfile after the
-application/vnd.cups-postscript stage and
-deviates it through the CUPS-external, system wide Ghostscript
-installation: Therefore the printfile bypasses the "pstoraster" filter
-(and thus also bypasses the CUPS-raster-drivers
-"rastertosomething"). After Ghostscript finished its rasterization,
-cupsomatic hands the rendered file directly to the CUPS backend. The
-flowchart above illustrates the difference between native CUPS
-rendering and the Foomatic/cupsomatic method.
-

    Examples for filtering Chains

    +cupsomatic kidnaps the printfile after the +application/vnd.cups-postscript stage and +deviates it through the CUPS-external, system-wide Ghostscript +installation. Therefore the printfile bypasses the pstoraster filter +(and also bypasses the CUPS-raster-drivers +rastertosomething). After Ghostscript finished its rasterization, +cupsomatic hands the rendered file directly to the CUPS backend. The +flowchart in illustrates the difference between native CUPS +rendering and the Foomatic/cupsomatic method. +

    Examples for Filtering Chains

    Here are a few examples of commonly occurring filtering chains to illustrate the workings of CUPS.

    -Assume you want to print a PDF file to a HP JetDirect-connected +Assume you want to print a PDF file to an HP JetDirect-connected PostScript printer, but you want to print the pages 3-5, 7, 11-13 -only, and you want to print them "2-up" and "duplex": -

    • your print options (page selection as required, 2-up, -duplex) are passed to CUPS on the commandline;

    • the (complete) PDF file is sent to CUPS and autotyped as -application/pdf;

    • the file therefore first must pass the -pdftops pre-filter, which produces PostScript -MIME type application/postscript (a preview here -would still show all pages of the original PDF);

    • the file then passes the pstops -filter which applies the commandline options: it selects the pages -2-5, 7 and 11-13, creates and imposed layout "2 pages on 1 sheet" and -inserts the correct "duplex" command (as is defined in the printer's -PPD) into the new PostScript file; the file now is of PostScript MIME +only, and you want to print them “two-up” and “duplex”: +

      • Your print options (page selection as required, two-up, +duplex) are passed to CUPS on the command line.

      • The (complete) PDF file is sent to CUPS and autotyped as +application/pdf.

      • The file therefore must first pass the +pdftops pre-filter, which produces PostScript +MIME type application/postscript (a preview here +would still show all pages of the original PDF).

      • The file then passes the pstops +filter that applies the command line options: it selects the pages +2-5, 7 and 11-13, creates an imposed layout “2 pages on 1 sheet” and +inserts the correct “duplex” command (as defined in the printer's +PPD) into the new PostScript file; the file is now of PostScript MIME type -application/vnd.cups-postscript;

      • the file goes to the socket +application/vnd.cups-postscript.

      • The file goes to the socket backend, which transfers the job to the printers.

      - The resulting filter chain therefore is as drawn in the image below. -

      Figure 19.11. PDF to socket chain

      PDF to socket chain

      + The resulting filter chain, therefore, is as drawn in . +

      Figure 19.11. PDF to socket chain.

      PDF to socket chain.

      Assume your want to print the same filter to an USB-connected -Epson Stylus Photo printer, installed with the CUPS +Epson Stylus Photo printer installed with the CUPS stphoto2.ppd. The first few filtering stages are nearly the same: -

      • your print options (page selection as required, 2-up, -duplex) are passed to CUPS on the commandline;

      • the (complete) PDF file is sent to CUPS and autotyped as -application/pdf;

      • the file therefore first must pass the -pdftops pre-filter, which produces PostScript -MIME type application/postscript (a preview here -would still show all pages of the original PDF);

      • the file then passes the "pstops" filter which applies +

        • Your print options (page selection as required, two-up, +duplex) are passed to CUPS on the commandline.

        • The (complete) PDF file is sent to CUPS and autotyped as +application/pdf.

        • The file must first pass the +pdftops pre-filter, which produces PostScript +MIME type application/postscript (a preview here +would still show all pages of the original PDF).

        • The file then passes the “pstops” filter that applies the commandline options: it selects the pages 2-5, 7 and 11-13, -creates and imposed layout "2 pages on 1 sheet" and inserts the -correct "duplex" command... (OOoops -- this printer and his PPD -don't support duplex printing at all -- this option will be ignored -then) into the new PostScript file; the file now is of PostScript +creates an imposed layout “two pages on one sheet” and inserts the +correct “duplex” command... (Oops this printer and PPD +do not support duplex printing at all so this option will +be ignored) into the new PostScript file; the file is now of PostScript MIME type -application/vnd.cups-postscript;

        • the file then passes the -pstoraster stage and becomes MIME type -application/cups-raster;

        • finally, the rastertoepson filter -does its work (as is indicated in the printer's PPD), creating the -printer-specific raster data and embedding any user-selected -print-options into the print data stream;

        • the file goes to the usb backend, +application/vnd.cups-postscript.

        • The file then passes the + +pstoraster stage and becomes MIME type +application/ +cups-raster.

        • Finally, the rastertoepson filter +does its work (as indicated in the printer's PPD), creating the +rinter-specific raster data and embedding any user-selected +print-options into the print data stream.

        • The file goes to the usb backend, which transfers the job to the printers.

        - The resulting filter chain therefore is as drawn in the image below. -

        Figure 19.12. PDF to USB chain

        PDF to USB chain

      Sources of CUPS drivers / PPDs

      -On the internet you can find now many thousand CUPS-PPD files -(with their companion filters), in many national languages, -supporting more than 1000 non-PostScript models. -

      • ESP -PrintPro (commercial, -non-Free) is packaged with more than 3000 PPDs, ready for -successful use "out of the box" on Linux, Mac OS X, IBM-AIX, -HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital UNIX and some + The resulting filter chain therefore is as drawn in . +

        Figure 19.12. PDF to USB chain.

        PDF to USB chain.

      Sources of CUPS Drivers/PPDs

      +On the Internet you can now find many thousands of CUPS-PPD files +(with their companion filters), in many national languages +supporting more than thousand non-PostScript models. +

      • ESP +PrintPro (commercial, +non-free) is packaged with more than three thousand PPDs, ready for +successful use “out of the box” on Linux, Mac OS X, IBM-AIX, +HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital UNIX, and some more commercial Unices (it is written by the CUPS developers themselves and its sales help finance the further development of -CUPS, as they feed their creators).

      • the Gimp-Print-Project - (GPL, Free Software) +CUPS, as they feed their creators).

      • The Gimp-Print-Project + (GPL, free software) provides around 140 PPDs (supporting nearly 400 printers, many driven to photo quality output), to be used alongside the Gimp-Print CUPS -filters;

      • TurboPrint - (Shareware, non-Free) supports +filters.

      • TurboPrint + (shareware, non-free) supports roughly the same amount of printers in excellent -quality;

      • OMNI - -(LPGL, Free) is a package made by IBM, now containing support for more +quality.

      • OMNI + +(LPGL, free) is a package made by IBM, now containing support for more than 400 printers, stemming from the inheritance of IBM OS/2 Know-How -ported over to Linux (CUPS support is in a Beta-stage at -present);

      • HPIJS - (BSD-style licenses, Free) +ported over to Linux (CUPS support is in a beta-stage at +present).

      • HPIJS + (BSD-style licenses, free) supports around 150 of HP's own printers and is also providing excellent print quality now (currently available only via the Foomatic -path);

      • Foomatic/cupsomatic - (LPGL, Free) from +path).

      • Foomatic/cupsomatic + (LPGL, free) from Linuxprinting.org are providing PPDs for practically every Ghostscript filter known to the world (including Omni, Gimp-Print and -HPIJS).

      Note

      -The cupsomatic/Foomatic trick from Linuxprinting.org works -differently from the other drivers. This is explained elsewhere in this -document. -

      Printing with Interface Scripts

      -CUPS also supports the usage of "interface scripts" as known from +HPIJS).

    Printing with Interface Scripts

    +CUPS also supports the usage of “interface scripts” as known from System V AT&T printing systems. These are often used for PCL -printers, from applications that generate PCL print jobs. Interface +printers, from applications that generate PCL print jobs. Interface scripts are specific to printer models. They have a similar role as PPDs for PostScript printers. Interface scripts may inject the Escape sequences as required into the print data stream, if the user has @@ -1145,126 +1194,138 @@ the -i option: root# lpadmin -p pclprinter -v socket://11.12.13.14:9100 \ -i /path/to/interface-script

    -Interface scripts might be the "unknown animal" to many. However, -with CUPS they provide the most easy way to plug in your own +Interface scripts might be the “unknown animal” to many. However, +with CUPS they provide the easiest way to plug in your own custom-written filtering script or program into one specific print queue (some information about the traditional usage of interface scripts is -to be found at http://playground.sun.com/printing/documentation/interface.html). -

    Network printing (purely Windows)

    +to be found at http://playground.sun.com/printing/documentation/interface.html). +

    Network Printing (Purely Windows)

    Network printing covers a lot of ground. To understand what exactly goes on with Samba when it is printing on behalf of its Windows -clients, let's first look at a "purely Windows" setup: Windows clients +clients, let's first look at a “purely Windows” setup: Windows clients with a Windows NT print server. -

    From Windows Clients to an NT Print Server

    +

    From Windows Clients to an NT Print Server

    Windows clients printing to an NT-based print server have two -options. They may -

    • execute the driver locally and render the GDI output -(EMF) into the printer specific format on their own, -or

    • send the GDI output (EMF) to the server, where the +options. They may: + + +

      • Execute the driver locally and render the GDI output + (EMF) into the printer-specific format on their own. +

      • Send the GDI output (EMF) to the server, where the driver is executed to render the printer specific output.

      -Both print paths are shown in the flowcharts below. -

    Driver Execution on the Client

    -In the first case the print server must spool the file as "raw", + Both print paths are shown in the flowcharts in the figures below. +

    Driver Execution on the Client

    +In the first case the print server must spool the file as raw, meaning it shouldn't touch the jobfile and try to convert it in any -way. This is what traditional UNIX-based print server can do too; and -at a better performance and more reliably than NT print server. This +way. This is what a traditional UNIX-based print server can do too, and +at a better performance and more reliably than an NT print server. This is what most Samba administrators probably are familiar with. One -advantage of this setup is that this "spooling-only" print server may +advantage of this setup is that this “spooling-only” print server may be used even if no driver(s) for UNIX are available it is sufficient -to have the Windows client drivers available and installed on the +to have the Windows client drivers available; and installed on the clients.

    -

    Figure 19.13. Print Driver execution on the Client

    Print Driver execution on the Client

    -

    Driver Execution on the Server

    -The other path executes the printer driver on the server. The clients +

    Figure 19.13. Print driver execution on the client.

    Print driver execution on the client.

    +

    Driver Execution on the Server

    + + + + + +The other path executes the printer driver on the server. The client transfers print files in EMF format to the server. The server uses the PostScript, PCL, ESC/P or other driver to convert the EMF file into the printer-specific language. It is not possible for UNIX to do the -same. Currently there is no program or method to convert a Windows +same. Currently, there is no program or method to convert a Windows client's GDI output on a UNIX server into something a printer could understand.

    -

    Figure 19.14. Print Driver execution on the Server

    Print Driver execution on the Server

    +

    Figure 19.14. Print driver execution on the server.

    Print driver execution on the server.

    -However, there is something similar possible with CUPS. Read on... -

    Network Printing (Windows clients -- UNIX/Samba Print +However, there is something similar possible with CUPS. Read on. +

    Network Printing (Windows Clients UNIX/Samba Print Servers)

    Since UNIX print servers cannot execute the Win32 program code on their platform, the picture is somewhat -different. However, this doesn't limit your options all that -much. In the contrary, you may have a way here to implement printing -features which are not possible otherwise. -

    From Windows Clients to a CUPS/Samba Print Server

    -Here is a simple recipe showing how you can take advantage of CUPS +different. However, this does not limit your options all that +much. On the contrary, you may have a way here to implement printing +features that are not possible otherwise. +

    From Windows Clients to a CUPS/Samba Print Server

    +Here is a simple recipe showing how you can take advantage of CUPS' powerful features for the benefit of your Windows network printing clients:

    • Let the Windows clients send PostScript to the CUPS -server.

    • Let the CUPS server render the PostScript into device -specific raster format.

    +server.

  • Let the CUPS server render the PostScript into device-specific raster format.

    • This requires the clients to use a PostScript driver (even if the printer is a non-PostScript model. It also requires that you have a -"driver" on the CUPS server. +driver on the CUPS server.

    -Firstly, to enable CUPS based printing through Samba the +First, to enable CUPS-based rinting through Samba the following options should be set in your smb.conf file [global] section: -

    • printing = cups

    • printcap = cups

    +

    printing = cups
    printcap = cups

    When these parameters are specified, all manually set print directives -(like print command, or lppause command) in smb.conf (as well as -in samba itself) will be ignored. Instead, Samba will directly -interface with CUPS through it's application program interface (API) - +(like print command, or lppause command) in smb.conf (as well as +in Samba itself) will be ignored. Instead, Samba will directly +interface with CUPS through its application program interface (API), as long as Samba has been compiled with CUPS library (libcups) -support. If Samba has NOT been compiled with CUPS support, and if no +support. If Samba has not been compiled with CUPS support, and if no other print commands are set up, then printing will use the System V AT&T command set, with the -oraw option automatically passing through (if you want your own defined print commands to work with a Samba that has CUPS support compiled in, -simply use printing = sysv). +simply use printing = sysv).

    -

    Figure 19.15. Printing via CUPS/samba server

    Printing via CUPS/samba server

    -

    Samba receiving Jobfiles and passing them to CUPS

    +

    Figure 19.15. Printing via CUPS/Samba server.

    Printing via CUPS/Samba server.

    +

    Samba Receiving Jobfiles and Passing Them to CUPS

    Samba must use its own spool directory (it is set -by a line similar to path = /var/spool/samba, +by a line similar to path = /var/spool/samba, in the [printers] or [printername] section of smb.conf). Samba receives the job in its own spool space and passes it into the spool directory of CUPS (the CUPS spooling directory is set by the RequestRoot directive, in a line that defaults to RequestRoot -/var/spool/cups). CUPS checks the access rights of its -spool dir and resets it to healthy values with every re-start. We have -seen quite some people who had used a common spooling space for Samba -and CUPS, and were struggling for weeks with this "problem". +/var/spool/cups). CUPS checks the access rights of its +spool dir and resets it to healthy values with every restart. We have +seen quite a few people who had used a common spooling space for Samba +and CUPS, and were struggling for weeks with this “problem.”

    A Windows user authenticates only to Samba (by whatever means is configured). If Samba runs on the same host as CUPS, you only need to -allow "localhost" to print. If they run on different machines, you +allow “localhost” to print. If they run on different machines, you need to make sure the Samba host gets access to printing on CUPS. -

    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs

    +

    Network PostScript RIP

    +This section discusses the use of CUPS filters on the server configuration where +clients make use of a PostScript driver with CUPS-PPDs. +

    + + + PPDs can control all print device options. They are usually provided -by the manufacturer; if you own a PostScript printer, that is. PPD +by the manufacturer, if you own a PostScript printer, that is. PPD files (PostScript Printer Descriptions) are always a component of PostScript printer drivers on MS Windows or Apple Mac OS systems. They are ASCII files containing user-selectable print options, mapped to appropriate PostScript, PCL or PJL commands for the target printer. Printer driver GUI dialogs translate these options -"on-the-fly" into buttons and drop-down lists for the user to select. +“on-the-fly” into buttons and drop-down lists for the user to select.

    CUPS can load, without any conversions, the PPD file from any Windows (NT is recommended) PostScript driver and handle the options. There is -a web browser interface to the print options (select http://localhost:631/printers/ -and click on one Configure Printer button to see -it), or a commandline interface (see man lpoptions -or see if you have lphelp on your system). There are also some +a Web browser interface to the print options (select http://localhost:631/printers/ +and click on one Configure Printer button to see +it), or a command line interface (see man lpoptions +or see if you have lphelp on your system). There are also some different GUI frontends on Linux/UNIX, which can present PPD options to users. PPD options are normally meant to be evaluated by the PostScript RIP on the real PostScript printer. -

    PPDs for non-PS Printers on UNIX

    -CUPS doesn't limit itself to "real" PostScript printers in its usage +

    PPDs for Non-PS Printers on UNIX

    + +CUPS does not limit itself to “real” PostScript printers in its usage of PPDs. The CUPS developers have extended the scope of the PPD -concept, to also describe available device and driver options for +concept to also describe available device and driver options for non-PostScript printers through CUPS-PPDs.

    This is logical, as CUPS includes a fully featured PostScript @@ -1272,104 +1333,109 @@ interpreter (RIP). This RIP is based on Ghostscript. It can process all received PostScript (and additionally many other file formats) from clients. All CUPS-PPDs geared to non-PostScript printers contain an additional line, starting with the keyword -*cupsFilter . This line tells the CUPS print +*cupsFilter. This line tells the CUPS print system which printer-specific filter to use for the interpretation of the supplied PostScript. Thus CUPS lets all its printers appear as PostScript devices to its clients, because it can act as a PostScript RIP for those printers, processing the received PostScript code into a proper raster print format. -

    PPDs for non-PS Printers on Windows

    +

    PPDs for Non-PS Printers on Windows

    + CUPS-PPDs can also be used on Windows-Clients, on top of a -"core" PostScript driver (now recommended is the "CUPS PostScript -Driver for WindowsNT/2K/XP"; you can also use the Adobe one, with +“core” PostScript driver (now recommended is the "CUPS PostScript +Driver for WindowsNT/200x/XP"; you can also use the Adobe one, with limitations). This feature enables CUPS to do a few tricks no other spooler can do: -

    • act as a networked PostScript RIP (Raster Image +

      • Act as a networked PostScript RIP (Raster Image Processor), handling printfiles from all client platforms in a uniform -way;

      • act as a central accounting and billing server, since -all files are passed through the pstops filter and are therefore +way.

      • Act as a central accounting and billing server, since +all files are passed through the pstops filter and are, therefore, logged in the CUPS page_log file. -NOTE: this can not happen with "raw" print jobs, -which always remain unfiltered per definition;

      • enable clients to consolidate on a single PostScript +Note: this cannot happen with “raw” print jobs, +which always remain unfiltered per definition.

      • Enable clients to consolidate on a single PostScript driver, even for many different target printers.

      Using CUPS PPDs on Windows clients enables these to control -all print job settings just as a UNIX client can do too. -

    Windows Terminal Servers (WTS) as CUPS Clients

    +all print job settings just as a UNIX client can do. +

    Windows Terminal Servers (WTS) as CUPS Clients

    This setup may be of special interest to people experiencing major -problems in WTS environments. WTS need often a multitude of +problems in WTS environments. WTS often need a multitude of non-PostScript drivers installed to run their clients' variety of different printer models. This often imposes the price of much increased instability. -

    Printer Drivers running in "Kernel Mode" cause many +

    Printer Drivers Running in “Kernel Mode” Cause Many Problems

    -The reason is that in Win NT printer drivers run in "Kernel -Mode", this introduces a high risk for the stability of the system + In Windows NT printer drivers which run in “Kernel +Mode”, introduces a high risk for the stability of the system if the driver is not really stable and well-tested. And there are a lot of bad drivers out there! Especially notorious is the example of the PCL printer driver that had an additional sound module running, to notify users via soundcard of their finished jobs. Do I -need to say that this one was also reliably causing "Blue Screens -of Death" on a regular basis? +need to say that this one was also reliably causing “blue screens +of death” on a regular basis?

    -PostScript drivers generally are very well tested. They are not known -to cause any problems, even though they run in Kernel Mode too. This -might be because there have so far only been 2 different PostScript +PostScript drivers are generally well tested. They are not known +to cause any problems, even though they also run in kernel mode. This +might be because there have been so far only two different PostScript drivers: the ones from Adobe and the one from Microsoft. Both are -very well tested and are as stable as you ever can imagine on +well tested and are as stable as you can imagine on Windows. The CUPS driver is derived from the Microsoft one. -

    Workarounds impose Heavy Limitations

    +

    Workarounds Impose Heavy Limitations

    In many cases, in an attempt to work around this problem, site -administrators have resorted to restrict the allowed drivers installed -on their WTS to one generic PCL- and one PostScript driver. This -however restricts the clients in the amount of printer options -available for them; often they can't get out more than simplex +administrators have resorted to restricting the allowed drivers installed +on their WTS to one generic PCL and one PostScript driver. This, +however, restricts the clients in the number of printer options +available for them. Often they can't get out more than simplex prints from one standard paper tray, while their devices could do much -better, if driven by a different driver! ) -

    CUPS: a "Magical Stone"?

    +better, if driven by a different driver! +

    CUPS: A “Magical Stone”?

    + + Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very elegant way to overcome all these shortcomings. There are, depending -on the version of Windows OS you use, up to 3 different PostScript +on the version of Windows OS you use, up to three different PostScript drivers available: Adobe, Microsoft and CUPS PostScript drivers. None of them is known to cause major stability problems on WTS (even if used with many different PPDs). The clients will be able to (again) chose paper trays, duplex printing and other settings. However, there is a certain price for this too: a CUPS server acting as a PostScript RIP for its clients requires more CPU and RAM than when just acting as -a "raw spooling" device. Plus, this setup is not yet widely tested, +a “raw spooling” device. Plus, this setup is not yet widely tested, although the first feedbacks look very promising. -

    PostScript Drivers with no major problems -- even in Kernel -Mode

    -More recent printer drivers on W2K and XP don't run in Kernel mode -(unlike Win NT) any more. However, both operating systems can still -use the NT drivers, running in Kernel mode (you can roughly tell which -is which as the drivers in subdirectory "2" of "W32X86" are "old" -ones). As was said before, the Adobe as well as the Microsoft +

    PostScript Drivers with No Major Problems Even in Kernel +Mode

    + +More recent printer drivers on W200x and XP no longer run in kernel mode +(unlike Windows NT). However, both operating systems can still +use the NT drivers, running in kernel mode (you can roughly tell which +is which as the drivers in subdirectory “2” of “W32X86” are “old” +ones). As was said before, the Adobe as well as the Microsoft PostScript drivers are not known to cause any stability problems. The CUPS driver is derived from the Microsoft one. There is a simple -reason for this: The MS DDK (Device Development Kit) for Win NT (which +reason for this: The MS DDK (Device Development Kit) for Windows NT (which used to be available at no cost to licensees of Visual Studio) includes the source code of the Microsoft driver, and licensees of Visual Studio are allowed to use and modify it for their own driver development efforts. This is what the CUPS people have done. The -license doesn't allow them to publish the whole of the source code. -However, they have released the "diff" under the GPL, and if you are -owner of an "MS DDK for Win NT", you can check the driver yourself. -

    Setting up CUPS for driver Download

    -As we have said before: all previously known methods to prepare client -printer drivers on the Samba server for download and "Point'n'Print" -convenience of Windows workstations are working with CUPS too. These +license does not allow them to publish the whole of the source code. +However, they have released the “diff” under the GPL, and if you are +the owner of an “MS DDK for Windows NT,” you can check the driver yourself. +

    Configuring CUPS for Driver Download

    +As we have said before, all previously known methods to prepare client +printer drivers on the Samba server for download and Point'n'Print +convenience of Windows workstations are working with CUPS, too. These methods were described in the previous chapter. In reality, this is a -pure Samba business, and only relates to the Samba/Win client +pure Samba business and only relates to the Samba/Windows client relationship. -

    cupsaddsmb: the unknown Utility

    -The cupsaddsmb utility (shipped with all current CUPS versions) is an -alternative method to transfer printer drivers into the Samba +

    cupsaddsmb: The Unknown Utility

    + +The cupsaddsmb utility (shipped with all current CUPS versions) is an +alternate method to transfer printer drivers into the Samba [print$] share. Remember, this share is where clients expect drivers deposited and setup for download and -installation. It makes the sharing of any (or all) installed CUPS -printers very easy. cupsaddsmb can use the Adobe PostScript driver as -well as the newly developed CUPS PostScript Driver for -WinNT/2K/XP. Note, that cupsaddsmb does +installation. It makes the sharing of any (or all) installed CUPS +printers quite easy. cupsaddsmb can use the Adobe PostScript driver as +well as the newly developed CUPS PostScript Driver for +Windows NT/200x/XP. cupsaddsmb does not work with arbitrary vendor printer drivers, but only with the exact driver files that are named in its man page. @@ -1378,23 +1444,24 @@ The CUPS printer driver is available from the CUPS download site. Its package name is cups-samba-[version].tar.gz . It is preferred over the Adobe drivers since it has a number of advantages: -

    • it supports a much more accurate page -accounting;

    • it supports banner pages, and page labels on all -printers;

    • it supports the setting of a number of job IPP +

      • It supports a much more accurate page +accounting.

      • It supports banner pages, and page labels on all +printers.

      • It supports the setting of a number of job IPP attributes (such as job-priority, page-label and -job-billing)

      -However, currently only Windows NT, 2000, and XP are supported by the -CUPS drivers. You will need to get the respective part of Adobe driver -too if you need to support Windows 95, 98, and ME clients. -

    Prepare your smb.conf for cupsaddsmb

    -Prior to running cupsaddsmb, you need the following settings in -smb.conf: -

    Example 19.3. smb.conf for cupsaddsmb usage

    [global]
    load printers = yes
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    public = yes
    # setting depends on your requirements
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root
    [print$]
    comment = Printer Drivers
    path = /etc/samba/drivers
    browseable = yes
    guest ok = no
    read only = yes
    write list = root

    CUPS Package of "PostScript Driver for WinNT/2k/XP"

    -CUPS users may get the exactly same packages from http://www.cups.org/software.html. +job-billing).

    +However, currently only Windows NT, 2000 and XP are supported by the +CUPS drivers. You will also need to get the respective part of Adobe driver +if you need to support Windows 95, 98 and ME clients. +

    Prepare Your smb.conf for cupsaddsmb

    +Prior to running cupsaddsmb, you need the settings in +smb.conf as shown in : +

    Example 19.3. smb.conf for cupsaddsmb usage

    [global]
    load printers = yes
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    public = yes
    # setting depends on your requirements
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root
    [print$]
    comment = Printer Drivers
    path = /etc/samba/drivers
    browseable = yes
    guest ok = no
    read only = yes
    write list = root

    CUPS “PostScript Driver for Windows NT/200x/XP”

    + +CUPS users may get the exact same packages from http://www.cups.org/software.html. It is a separate package from the CUPS base software files, tagged as -CUPS 1.1.x Windows NT/2k/XP Printer Driver for Samba -(tar.gz, 192k). The filename to download is -cups-samba-1.1.x.tar.gz. Upon untar-/unzip-ing, +CUPS 1.1.x Windows NT/200x/XP Printer Driver for Samba +(tar.gz, 192k). The filename to download is +cups-samba-1.1.x.tar.gz. Upon untar and unzipping, it will reveal these files: 

     root# tar xvzf cups-samba-1.1.19.tar.gz
@@ -1404,15 +1471,15 @@ cups-samba.readme
 cups-samba.remove
 cups-samba.ss

    - - + + These have been packaged with the ESP meta packager software -"EPM". The *.install and +EPM. The *.install and *.remove files are simple shell scripts, which untars the *.ss (the *.ss is -nothing else but a tar-archive, which can be untar-ed by "tar" +nothing else but a tar-archive, which can be untarred by “tar” too). Then it puts the content into -/usr/share/cups/drivers/. This content includes 3 +/usr/share/cups/drivers/. This content includes three files: 

     root# tar tv cups-samba.ss
@@ -1420,7 +1487,7 @@ cupsdrvr.dll
 cupsui.dll
 cups.hlp

    -The cups-samba.install shell scripts is easy to +The cups-samba.install shell scripts are easy to handle: 

     root# ./cups-samba.install
@@ -1428,7 +1495,7 @@ handle:
 Installing software...
 Updating file permissions...
 Running post-install commands...
-Installation is complete.        
+Installation is complete.

    The script should automatically put the driver files into the /usr/share/cups/drivers/ directory. @@ -1439,206 +1506,210 @@ into/usr/share/drivers/ instead of /usr/share/cups/drivers/. To work around this, copy/move the file (after running the ./cups-samba.install script) manually to the -right place. +correct place. 

     root# cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/
-

    +

    + This new CUPS PostScript driver is currently binary-only, but free of -charge. No complete source code is provided (yet). The reason is this: -it has been developed with the help of the Microsoft Driver -Developer Kit (DDK) and compiled with Microsoft Visual +charge. No complete source code is provided (yet). The reason is that +it has been developed with the help of the Microsoft Driver +Developer Kit (DDK) and compiled with Microsoft Visual Studio 6. Driver developers are not allowed to distribute the whole of -the source code as Free Software. However, CUPS developers released -the "diff" in source code under the GPL, so anybody with a license of +the source code as free software. However, CUPS developers released +the “diff” in source code under the GPL, so anybody with a license of Visual Studio and a DDK will be able to compile for him/herself. -

    Recognize the different Driver Files

    -The CUPS drivers don't support the "older" Windows 95/98/ME, but only -the Windows NT/2000/XP client: -

    Windows NT, 2000, and XP are supported by:

    -

    • cups.hlp

    • cupsdrvr.dll

    • cupsui.dll

    -

    -Adobe drivers are available for the older Windows 95/98/ME as well as -the Windows NT/2000/XP clients. The set of files is different for the +

    Recognizing Different Driver Files

    +The CUPS drivers do not support the older Windows 95/98/Me, but only +the Windows NT/2000/XP client. +

    Windows NT, 2000 and XP are supported by:

    +

    • cups.hlp
    • cupsdrvr.dll
    • cupsui.dll

    +

    +Adobe drivers are available for the older Windows 95/98/Me as well as +the Windows NT/2000/XP clients. The set of files is different from the different platforms. -

    Windows 95, 98, and Me are supported by:

    -

    • ADFONTS.MFM

    • ADOBEPS4.DRV

    • ADOBEPS4.HLP

    • DEFPRTR2.PPD

    • ICONLIB.DLL

    • PSMON.DLL

    -

    Windows NT, 2000, and XP are supported by:

    -

    • ADOBEPS5.DLL

    • ADOBEPSU.DLL

    • ADOBEPSU.HLP

    +

    Windows 95, 98 and ME are supported by:

    +

    • ADFONTS.MFM
    • ADOBEPS4.DRV
    • ADOBEPS4.HLP
    • DEFPRTR2.PPD
    • ICONLIB.DLL
    • PSMON.DLL

    +

    Windows NT, 2000 and XP are supported by:

    +

    • ADOBEPS5.DLL
    • ADOBEPSU.DLL
    • ADOBEPSU.HLP

    Note

    -If both, the Adobe driver files and the CUPS driver files for the -support of WinNT/2k/XP are present in , the Adobe ones will be ignored -and the CUPS ones will be used. If you prefer -- for whatever reason --- to use Adobe-only drivers, move away the 3 CUPS driver files. The -Win95/98/ME clients use the Adobe drivers in any case. -

    Acquiring the Adobe Driver Files

    +If both the Adobe driver files and the CUPS driver files for the +support of Windows NT/200x/XP are present in FIXME, the Adobe ones will be ignored +and the CUPS ones will be used. If you prefer for whatever reason + to use Adobe-only drivers, move away the three CUPS driver files. The +Windows 9x/Me clients use the Adobe drivers in any case. +

    Acquiring the Adobe Driver Files

    Acquiring the Adobe driver files seems to be unexpectedly difficult -for many users. They are not available on the Adobe website as single -files and the self-extracting and/or self-installing Windows-exe is +for many users. They are not available on the Adobe Web site as single +files and the self-extracting and/or self-installing Windows-.exe is not easy to locate either. Probably you need to use the included native installer and run the installation process on one client once. This will install the drivers (and one Generic PostScript -printer) locally on the client. When they are installed, share the -Generic PostScript printer. After this, the client's +printer) locally on the client. When they are installed, share the +Generic PostScript printer. After this, the client's [print$] share holds the Adobe files, from -where you can get them with smbclient from the CUPS host. A more -detailed description about this is in the next (the CUPS printing) -chapter. -

    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"

    -Users of the ESP Print Pro software are able to install their "Samba -Drivers" package for this purpose with no problem. Retrieve the driver +where you can get them with smbclient from the CUPS host. +

    ESP Print Pro PostScript Driver for Windows NT/200x/XP

    + +Users of the ESP Print Pro software are able to install their Samba +drivers package for this purpose with no problem. Retrieve the driver files from the normal download area of the ESP Print Pro software -at http://www.easysw.com/software.html. -You need to locate the link labelled "SAMBA" amongst the -Download Printer Drivers for ESP Print Pro 4.x +at http://www.easysw.com/software.html. +You need to locate the link labelled “SAMBA” among the +Download Printer Drivers for ESP Print Pro 4.x area and download the package. Once installed, you can prepare any driver by simply highlighting the printer in the Printer Manager GUI -and select Export Driver... from the menu. Of -course you need to have prepared Samba beforehand too to handle the -driver files; i.e. mainly setup the [print$] -share, etc. The ESP Print Pro package includes the CUPS driver files -as well as a (licensed) set of Adobe drivers for the Windows 95/98/ME +and select Export Driver... from the menu. Of +course you need to have prepared Samba beforehand to handle the +driver files; i.e., setup the [print$] +share, and so on. The ESP Print Pro package includes the CUPS driver files +as well as a (licensed) set of Adobe drivers for the Windows 95/98/Me client family. -

    Caveats to be considered

    +

    Caveats to be Considered

    + Once you have run the install script (and possibly manually moved the cups.hlp file to /usr/share/cups/drivers/), the driver is ready to be put into Samba's [print$] share (which often maps to -/etc/samba/drivers/ and contains a subdir +/etc/samba/drivers/ and contains a subdirectory tree with WIN40 and -W32X86 branches): You do this by running -"cupsaddsmb" (see also man cupsaddsmb for +W32X86 branches). You do this by running +cupsaddsmb (see also man cupsaddsmb for CUPS since release 1.1.16).

    Tip

    - + You may need to put root into the smbpasswd file by running smbpasswd; this is especially important if you should run this whole procedure for the first time, and are not working in an environment where everything is configured for -Single Sign On to a Windows Domain Controller. +single sign on to a Windows Domain Controller.

    Once the driver files are in the [print$] share and are initialized, they are ready to be downloaded and installed by -the Win NT/2k/XP clients. +the Windows NT/200x/XP clients.

    Note

    -

    1. -Win 9x/ME clients won't work with the CUPS PostScript driver. For -these you'd still need to use the ADOBE*.* -drivers as previously. -

    2. +Win 9x/Me clients will not work with the CUPS PostScript driver. For +these you still need to use the ADOBE*.* +drivers as previously stated. +

    Note

    It is not harmful if you still have the ADOBE*.* driver files from previous installations in the /usr/share/cups/drivers/ -directory. The new cupsaddsmb (from 1.1.16) will -automatically prefer "its own" drivers if it finds both. -

  • - -Should your Win clients have had the old ADOBE*.* +directory. The new cupsaddsmb (from 1.1.16) will +automatically prefer its own drivers if it finds both. +

    • Note

    + +Should your Windows clients have had the old ADOBE*.* files for the Adobe PostScript driver installed, the download and -installation of the new CUPS PostScript driver for Windows NT/2k/XP +installation of the new CUPS PostScript driver for Windows NT/200x/XP will fail at first. You need to wipe the old driver from the clients -first. It is not enough to "delete" the printer, as the driver files +first. It is not enough to “delete” the printer, as the driver files will still be kept by the clients and re-used if you try to re-install the printer. To really get rid of the Adobe driver files on the -clients, open the "Printers" folder (possibly via Start, Settings, Control Panel, Printers), -right-click onto the folder background and select Server -Properties. When the new dialog opens, select the -Drivers tab. On the list select the driver you -want to delete and click on the Delete +clients, open the Printers folder (possibly via Start > Settings > Control Panel > Printers), +right-click on the folder background and select Server +Properties. When the new dialog opens, select the +Drivers tab. On the list select the driver you +want to delete and click the Delete button. This will only work if there is not one single printer left -which uses that particular driver. You need to "delete" all printers -using this driver in the "Printers" folder first. You will need +that uses that particular driver. You need to “delete” all printers +using this driver in the Printers folder first. You will need Administrator privileges to do this. -

  • - +

    • Note

    + Once you have successfully downloaded the CUPS PostScript driver to a client, you can easily switch all printers to this one by proceeding -as described in the printing chapter: either change -a driver for an existing printer by running the "Printer Properties" +as described in . Either change +a driver for an existing printer by running the Printer Properties dialog, or use rpcclient with the -setdriver sub-command. -

    -

    Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver

    -You are interested in a comparison between the CUPS and the Adobe +setdriver subcommand. +

    Windows CUPS PostScript Driver Versus Adobe Driver

    +Are you interested in a comparison between the CUPS and the Adobe PostScript drivers? For our purposes these are the most important -items which weigh in favor of the CUPS ones: -

    • no hassle with the Adobe EULA

    • no hassle with the question “Where do I +items that weigh in favor of the CUPS ones: +

      • No hassle with the Adobe EULA.

      • No hassle with the question “Where do I get the ADOBE*.* driver files from?”

      • - - the Adobe drivers (on request of the printer PPD + +The Adobe drivers (on request of the printer PPD associated with them) often put a PJL header in front of the main -PostScript part of the print file. Thus the printfile starts with +PostScript part of the print file. Thus, the printfile starts with <1B >%-12345X or <escape>%-12345X instead of %!PS). This leads to the CUPS daemon auto-typing the incoming file as a print-ready file, -not initiating a pass through the "pstops" filter (to speak more -technically, it is not regarded as the generic MIME type - -application/postscript, but as +not initiating a pass through the pstops filter (to speak more +technically, it is not regarded as the generic MIME-type + +application/postscript, but as the more special MIME type - -application/cups.vnd-postscript), + +application/cups.vnd-postscript), which therefore also leads to the page accounting in -/var/log/cups/page_log not +/var/log/cups/page_log not receiving the exact number of pages; instead the dummy page number -of "1" is logged in a standard setup)

      • the Adobe driver has more options to "mis-configure" the +of “1” is logged in a standard setup).

      • The Adobe driver has more options to misconfigure the PostScript generated by it (like setting it inadvertently to -Optimize for Speed, instead of -Optimize for Portability, which -could lead to CUPS being unable to process it)

      • the CUPS PostScript driver output sent by Windows -clients to the CUPS server will be guaranteed to be auto-typed always -as generic MIME type application/postscript, -thusly passing through the CUPS "pstops" filter and logging the +Optimize for Speed, instead of +Optimize for Portability, which +could lead to CUPS being unable to process it).

      • The CUPS PostScript driver output sent by Windows +clients to the CUPS server is guaranteed to auto-type +as the generic MIME type application/postscript, +thus passing through the CUPS pstops filter and logging the correct number of pages in the page_log for -accounting and quota purposes

      • the CUPS PostScript driver supports the sending of -additional standard (IPP) print options by Win NT/2k/XP clients. Such +accounting and quota purposes.

      • The CUPS PostScript driver supports the sending of +additional standard (IPP) print options by Windows NT/200x/XP clients. Such additional print options are: naming the CUPS standard banner pages (or the custom ones, should they be installed at the time of driver download), using the CUPS -page-label option, setting a -job-priority and setting the scheduled -time of printing (with the option to support additional -useful IPP job attributes in the future).

      • the CUPS PostScript driver supports the inclusion of -the new *cupsJobTicket comments at the +page-label option, setting a +job-priority, and setting the scheduled +time of printing (with the option to support additional +useful IPP job attributes in the future).

      • The CUPS PostScript driver supports the inclusion of +the new *cupsJobTicket comments at the beginning of the PostScript file (which could be used in the future for all sort of beneficial extensions on the CUPS side, but which will not disturb any other applications as they will regard it as a comment -and simply ignore it).

      • the CUPS PostScript driver will be the heart of the -fully fledged CUPS IPP client for Windows NT/2K/XP to be released soon -(probably alongside the first Beta release for CUPS -1.2).

    Run "cupsaddsmb" (quiet Mode)

    -The cupsaddsmb command copies the needed files into your +and simply ignore it).

  • The CUPS PostScript driver will be the heart of the +fully fledged CUPS IPP client for Windows NT/200x/XP to be released soon +(probably alongside the first beta release for CUPS +1.2).

    • Run cupsaddsmb (Quiet Mode)

    + + +The cupsaddsmb command copies the needed files into your [print$] share. Additionally, the PPD associated with this printer is copied from /etc/cups/ppd/ to [print$]. There the files wait for convenient Windows client installations via Point'n'Print. Before we can run the command successfully, we need to be sure that we can authenticate -towards Samba. If you have a small network you are probably using user -level security (security = user). +toward Samba. If you have a small network, you are probably using user-level +security (security = user).

    -Here is an example of a successfully run cupsaddsmb command. +Here is an example of a successfully run cupsaddsmb command: 

     root# cupsaddsmb -U root infotec_IS2027
 Password for root required to access localhost via Samba: ['secret']

    To share all printers and drivers, use the -a parameter instead of a printer name. Since -cupsaddsmb "exports" the printer drivers to Samba, it should be +cupsaddsmb “exports” the printer drivers to Samba, it should be obvious that it only works for queues with a CUPS driver associated. -

    Run "cupsaddsmb" with verbose Output

    +

    Run cupsaddsmb with Verbose Output

    + Probably you want to see what's going on. Use the -v parameter to get a more verbose output. The -output below was edited for better readability: all "\" at the end of +output below was edited for better readability: all “\” at the end of a line indicate that I inserted an artificial line break plus some indentation here:

    Warning

    You will see the root password for the Samba account printed on screen. -

    +

    + + + + 

     root# cupsaddsmb -U root -v infotec_2105
 Password for root required to access localhost via GANDALF:
 Running command: smbclient //localhost/print\$ -N -U'root%secret' \
@@ -1656,11 +1727,12 @@ putting file /usr/share/cups/drivers/cupsui.dll as \W32X86/cupsui.dll
 putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp
   
 Running command: rpcclient localhost -N -U'root%secret' 
-   -c 'adddriver "Windows NT x86"   \
-   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:   \
-    RAW:NULL"'
-cmd = adddriver "Windows NT x86" \
-    "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:RAW:NULL"
+   -c 'adddriver "Windows NT x86"   \
+   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \
+    RAW:NULL"'
+cmd = adddriver "Windows NT x86" \
+   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \
+	RAW:NULL"
 Printer Driver infotec_2105 successfully installed.
   
 Running command: smbclient //localhost/print\$ -N -U'root%secret' \
@@ -1684,13 +1756,14 @@ Running command: smbclient //localhost/print\$ -N -U'root%secret' \
   putting file /usr/share/cups/drivers/PSMON.DLL as \WIN40/PSMON.DLL
   
   Running command: rpcclient localhost -N -U'root%secret' \
-   -c 'adddriver "Windows 4.0"      \
-   "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP: \
+   -c 'adddriver "Windows 4.0"      \
+   "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP: \
    PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL, \
-    ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
-  cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:          \
-    ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,  \
-                   PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"
+    ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
+	cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:\
+	infotec_2105.PPD:NULL:ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,\
+	infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,\
+	ICONLIB.DLL"
   Printer Driver infotec_2105 successfully installed.
   
   Running command: rpcclient localhost -N -U'root%secret'  \
@@ -1700,62 +1773,60 @@ Running command: smbclient //localhost/print\$ -N -U'root%secret' \

    If you look closely, you'll discover your root password was transferred -unencrypted over the wire, so beware! Also, if you look further her, -you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in -between. They occur, because the directories WIN40 and W32X86 already -existed in the [print$] driver download share -(from a previous driver installation). They are harmless here. -

    Understanding cupsaddsmb

    -What has happened? What did cupsaddsmb do? There are five stages of -the procedure +unencrypted over the wire, so beware! Also, if you look further, +you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in between. They occur, because the directories WIN40 and W32X86 already existed in the [print$] driver download share (from a previous driver installation). They are harmless here. +

    Understanding cupsaddsmb

    + +What has happened? What did cupsaddsmb do? There are five stages of +the procedure:

    1. - - call the CUPS server via IPP and request the -driver files and the PPD file for the named printer;

    2. store the files temporarily in the local + + Call the CUPS server via IPP and request the +driver files and the PPD file for the named printer.

    3. Store the files temporarily in the local TEMPDIR (as defined in -cupsd.conf);

    4. connect via smbclient to the Samba server's +cupsd.conf).

    5. Connect via smbclient to the Samba server's [print$] share and put the files into the - share's WIN40 (for Win95/98/ME) and W32X86/ (for WinNT/2k/XP) sub - directories;

    6. - - connect via rpcclient to the Samba server and -execute the "adddriver" command with the correct -parameters;

    7. - - connect via rpcclient to the Samba server a second -time and execute the "setdriver" command.

    -Note, that you can run the cupsaddsmb utility with parameters to + share's WIN40 (for Windows 9x/Me) and W32X86/ (for Windows NT/200x/XP) subdirectories.

  • + + Connect via rpcclient to the Samba server and +execute the adddriver command with the correct +parameters.

  • + + Connect via rpcclient to the Samba server a second +time and execute the setdriver command.

    • Note

    +You can run the cupsaddsmb utility with parameters to specify one remote host as Samba host and a second remote host as CUPS host. Especially if you want to get a deeper understanding, it is a -good idea try it and see more clearly what is going on (though in real +good idea to try it and see more clearly what is going on (though in real life most people will have their CUPS and Samba servers run on the same host): 

    -root# cupsaddsmb -H sambaserver -h cupsserver -v printername
-

    How to recognize if cupsaddsmb completed successfully

    +root# cupsaddsmb -H sambaserver -h cupsserver -v printer +

    How to Recognize If cupsaddsmb Completed Successfully

    You must always check if the utility completed -successfully in all fields. You need as a minimum these 3 messages -amongst the output: +successfully in all fields. You need as a minimum these three messages +among the output:

    1. Printer Driver infotec_2105 successfully -installed. # (for the W32X86 == WinNT/2K/XP -architecture...)

    2. Printer Driver infotec_2105 successfully -installed. # (for the WIN40 == Win9x/ME -architecture...)

    3. Successfully set [printerXPZ] to driver +installed. # (for the W32X86 == Windows NT/200x/XP +architecture).

    4. Printer Driver infotec_2105 successfully +installed. # (for the WIN40 == Windows 9x/Me +architecture).

    5. Successfully set [printerXPZ] to driver [printerXYZ].

    -These messages probably not easily recognized in the general -output. If you run cupsaddsmb with the -a +These messages are probably not easily recognized in the general +output. If you run cupsaddsmb with the -a parameter (which tries to prepare all active CUPS printer drivers for download), you might miss if individual printers -drivers had problems to install properly. Here a redirection of the +drivers had problems installing properly. Here a redirection of the output will help you analyze the results in retrospective.

    Note

    -It is impossible to see any diagnostic output if you don't run -cupsaddsmb in verbose mode. Therefore we strongly recommend to not -use the default quiet mode. It will hide any problems from you which +It is impossible to see any diagnostic output if you do not run +cupsaddsmb in verbose mode. Therefore, we strongly recommend to not +use the default quiet mode. It will hide any problems from you that might occur. -

    cupsaddsmb with a Samba PDC

    -You can't get the standard cupsaddsmb command to run on a Samba PDC? -You are asked for the password credential all over again and again and +

    cupsaddsmb with a Samba PDC

    + +Can't get the standard cupsaddsmb command to run on a Samba PDC? +Are you asked for the password credential all over again and again and the command just will not take off at all? Try one of these variations: 

    @@ -1764,114 +1835,116 @@ variations:
 root# cupsaddsmb -H SAURON -U MIDEARTH\\root -h cups-server -v printername

    (Note the two backslashes: the first one is required to -"escape" the second one). -

    cupsaddsmb Flowchart

    -Here is a chart about the procedures, commandflows and -dataflows of the "cupaddsmb" command. Note again: cupsaddsmb is -not intended to, and does not work with, "raw" queues! -

    -

    Figure 19.16. cupsaddsmb flowchart

    cupsaddsmb flowchart

    -

    Installing the PostScript Driver on a Client

    -After cupsaddsmb completed, your driver is prepared for the clients to +“escape” the second one). +

    cupsaddsmb Flowchart

    + + shows a chart about the procedures, commandflows and +dataflows of the cupaddsmb command. Note again: cupsaddsmb is +not intended to, and does not work with, raw queues! +

    +

    Figure 19.16. cupsaddsmb flowchart.

    cupsaddsmb flowchart.

    +

    Installing the PostScript Driver on a Client

    + +After cupsaddsmb is completed, your driver is prepared for the clients to use. Here are the steps you must perform to download and install it -via "Point'n'Print". From a Windows client, browse to the CUPS/Samba -server; -

    • open the Printers -share of Samba in Network Neighbourhood;

    • right-click on the printer in -question;

    • from the opening context-menu select -Install... or -Connect... (depending on the Windows version you +via Point'n'Print. From a Windows client, browse to the CUPS/Samba +server: +

      • + +Open the Printers +share of Samba in Network Neighborhood.

      • Right-click on the printer in +question.

      • From the opening context-menu select +Install... or +Connect... (depending on the Windows version you use).

      After a few seconds, there should be a new printer in your -client's local "Printers" folder: On Windows +client's local Printers folder. On Windows XP it will follow a naming convention of PrinterName on -SambaServer. (In my current case it is "infotec_2105 on -kde-bitshop"). If you want to test it and send your first job from -an application like Winword, the new printer will appears in a +SambaServer. (In my current case it is "infotec_2105 on +kde-bitshop"). If you want to test it and send your first job from +an application like Winword, the new printer appears in a \\SambaServer\PrinterName entry in the -dropdown list of available printers. -

      Note

      - -cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher -and Samba from 2.2.4. If it doesn't work, or if the automatic printer -driver download to the clients doesn't succeed, you can still manually +drop-down list of available printers. +

      + +cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher +and Samba from 2.2.4. If it does not work, or if the automatic printer +driver download to the clients does not succeed, you can still manually install the CUPS printer PPD on top of the Adobe PostScript driver on clients. Then point the client's printer queue to the Samba printer share for a UNC type of connection: -

      +
       C:\> net use lpt1: \\sambaserver\printershare /user:ntadmin
 
      
 should you desire to use the CUPS networked PostScript RIP
-functions. (Note that user "ntadmin" needs to be a valid Samba user
-with the required privileges to access the printershare) This would
-set up the printer connection in the traditional
+functions. (Note that user “ntadmin” needs to be a valid Samba user
+with the required privileges to access the printershare.) This
+sets up the printer connection in the traditional
 LanMan way (not using MS-RPC).
-

    Avoiding critical PostScript Driver Settings on the -Client

    -Soooo: printing works, but there are still problems. Most jobs print -well, some don't print at all. Some jobs have problems with fonts, -which don't look very good. Some jobs print fast, and some are +

    Avoiding Critical PostScript Driver Settings on the Client

    +Printing works, but there are still problems. Most jobs print +well, some do not print at all. Some jobs have problems with fonts, +which do not look very good. Some jobs print fast and some are dead-slow. Many of these problems can be greatly reduced or even completely eliminated if you follow a few guidelines. Remember, if your print device is not PostScript-enabled, you are treating your Ghostscript installation on your CUPS host with the output your client driver settings produce. Treat it well: -

    • Avoid the PostScript Output Option: Optimize -for Speed setting. Rather use the Optimize for -Portability instead (Adobe PostScript -driver).

    • Don't use the Page Independence: -NO setting. Instead use Page Independence -YES (CUPS PostScript Driver)

    • Recommended is the True Type Font -Downloading Option: Native True Type over -Automatic and Outline; you -should by all means avoid Bitmap (Adobe -PostScript Driver)

    • Choose True Type Font: Download as Softfont -into Printer over the default Replace by Device -Font (for exotic fonts you may need to change it back to -get a printout at all) (Adobe)

    • Sometimes you can choose PostScript Language -Level: in case of problems try 2 -instead of 3 (the latest ESP Ghostscript package -handles Level 3 PostScript very well) (Adobe).

    • Say Yes to PostScript -Error Handler (Adobe)

    Installing PostScript Driver Files manually (using -rpcclient)

    -Of course you can run all the commands which are embedded into the +

    • Avoid the PostScript Output Option: Optimize +for Speed setting. Use the Optimize for +Portability instead (Adobe PostScript +driver).

    • Don't use the Page Independence: +NO setting. Instead, use Page Independence +YES (CUPS PostScript Driver).

    • Recommended is the True Type Font +Downloading Option: Native True Type over +Automatic and Outline; you +should by all means avoid Bitmap (Adobe +PostScript Driver).

    • Choose True Type Font: Download as Softfont +into Printer over the default Replace by Device +Font (for exotic fonts, you may need to change it back to +get a printout at all) (Adobe).

    • Sometimes you can choose PostScript Language +Level: In case of problems try 2 +instead of 3 (the latest ESP Ghostscript package +handles Level 3 PostScript very well) (Adobe).

    • Say Yes to PostScript +Error Handler (Adobe).

    Installing PostScript Driver Files Manually Using rpcclient

    +Of course, you can run all the commands that are embedded into the cupsaddsmb convenience utility yourself, one by one, and hereby upload and prepare the driver files for future client downloads. -

    1. prepare Samba (a CUPS printqueue with the name of the +

      1. Prepare Samba (A CUPS print queue with the name of the printer should be there. We are providing the driver -now);

      2. copy all files to - [print$]

      3. - - run rpcclient adddriver -(for each client architecture you want to support):

      4. - - run rpcclient +now).

      5. Copy all files to + [print$].

      6. + +Run rpcclient adddriver +(for each client architecture you want to support).

      7. + +Run rpcclient setdriver.

      - - - - - -We are going to do this now. First, read the man page on "rpcclient" + + + + + +We are going to do this now. First, read the man page on rpcclient to get a first idea. Look at all the printing related -sub-commands. enumprinters, +subcommands. enumprinters, enumdrivers, enumports, -adddriver, setdriver are amongst -the most interesting ones. rpcclient implements an important part of -the MS-RPC protocol. You can use it to query (and command) a Win NT -(or 2K/XP) PC too. MS-RPC is used by Windows clients, amongst other -things, to benefit from the "Point'n'Print" features. Samba can now -mimic this too. -

      A Check of the rpcclient man Page

      -First let's have a little check of the rpcclient man page. Here are +adddriver, setdriver are among +the most interesting ones. rpcclient implements an important part of +the MS-RPC protocol. You can use it to query (and command) a Windows NT +(or 200x/XP) PC, too. MS-RPC is used by Windows clients, among other +things, to benefit from the Point'n'Print features. Samba can now +mimic this as well. +

      A Check of the rpcclient man Page

      + First let's check the rpcclient man page. Here are two relevant passages:

      adddriver <arch> <config> Execute an -AddPrinterDriver() RPC to install the printer driver information on -the server. Note that the driver files should already exist in the -directory returned by getdriverdir. Possible +AddPrinterDriver() RPC to install the printer driver information on +the server. The driver files should already exist in the +directory returned by getdriverdir. Possible values for arch are the same as those for the -getdriverdir command. The +getdriverdir command. The config parameter is defined as follows: 

       Long Printer Name:\
@@ -1882,70 +1955,72 @@ Help File Name:\
 Language Monitor Name:\
 Default Data Type:\
 Comma Separated list of Files
-

      Any empty fields should be enter as the string "NULL".

      Samba does not need to support the concept of Print Monitors +

      Any empty fields should be enter as the string “NULL”.

      Samba does not need to support the concept of Print Monitors since these only apply to local printers whose driver can make use of -a bi-directional link for communication. This field should be "NULL". +a bi-directional link for communication. This field should be “NULL”. On a remote NT print server, the Print Monitor for a driver must already be installed prior to adding the driver or else the RPC will -fail +fail.

      setdriver <printername> <drivername> Execute a SetPrinter() command to update the printer driver associated with an installed printer. The printer driver must already be correctly installed on the print server. -

      See also the enumprinters and enumdrivers commands for +

      See also the enumprinters and enumdrivers commands for obtaining a list of installed printers and drivers. -

      Understanding the rpcclient man page

      +

      Understanding the rpcclient man Page

      The exact format isn't made too clear by the man page, since you have to deal with some parameters containing spaces. Here is a better description for it. We have line-broken the -command and indicated the breaks with "\". Usually you would type the +command and indicated the breaks with “\”. Usually you would type the command in one line without the linebreaks: -

      - adddriver "Architecture" \
-           "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\
-           LanguageMonitorFile:DataType:ListOfFiles,Comma-separated"
+
+
      + adddriver "Architecture" \
+           "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\
+           LanguageMonitorFile:DataType:ListOfFiles,Comma-separated"
 
      
-What the man pages denotes as a simple <config>
-keyword, does in reality consist of 8 colon-separated fields. The
-last field may take multiple (in some, very insane, cases, even
-20 different additional files. This might sound confusing at first.
-Note, that what the man pages names the "LongPrinterName" in
-reality should rather be called the "Driver Name". You can name it
+What the man pages denote as a simple <config>
+keyword, in reality consists of eight colon-separated fields. The
+last field may take multiple (in some very insane cases, even
+20 different additional) files. This might sound confusing at first.
+What the man pages names the “LongPrinterName” in
+reality should be called the “Driver Name”. You can name it
 anything you want, as long as you use this name later in the
-rpcclient ... setdriver command. For
+rpcclient ... setdriver command. For
 practical reasons, many name the driver the same as the
 printer.
 
      
-True: it isn't simple at all. I hear you asking:
-How do I know which files are "Driver
-File", "Data File", "Config File", "Help File" and "Language
-Monitor File" in each case? -- For an answer you may
+It isn't simple at all. I hear you asking:
+“How do I know which files are "Driver
+File”, “Data File”, “Config File”, “Help File” and “Language
+Monitor File" in each case?”  For an answer, you may
 want to have a look at how a Windows NT box with a shared printer
 presents the files to us. Remember, that this whole procedure has
-to be developed by the Samba Team by overhearing the traffic caused
+to be developed by the Samba team by overhearing the traffic caused
 by Windows computers on the wire. We may as well turn to a Windows
-box now, and access it from a UNIX workstation. We will query it
+box now and access it from a UNIX workstation. We will query it
 with rpcclient to see what it tells us and
-try to understand the man page more clearly which we've read just
+try to understand the man page more clearly that we've read just
 now.
-

      Producing an Example by querying a Windows Box

      - - +

      Producing an Example by Querying a Windows Box

      + + We could run rpcclient with a getdriver or a getprinter -subcommand (in level 3 verbosity) against it. Just sit down at UNIX or -Linux workstation with the Samba utilities installed. Then type the +subcommand (in level 3 verbosity) against it. Just sit down at a UNIX or +Linux workstation with the Samba utilities installed, then type the following command: 

      -root# rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3'
+root# rpcclient -U'user%secret' NT-SERVER -c 'getdriver printername 3'

      -From the result it should become clear which is which. Here is an -example from my installation: -

      -root# rpcclient -U'Danka%xxxx' W2KSERVER \
-	-c'getdriver "DANKA InfoStream Virtual Printer" 3'
- cmd = getdriver "DANKA InfoStream Virtual Printer" 3
+From the result it should become clear which is which. Here is an example from my installation:
+
      
+
+	
      +root# rpcclient -U'Danka%xxxx' W200xSERVER \
+	-c'getdriver "DANKA InfoStream Virtual Printer" 3'
+ cmd = getdriver "DANKA InfoStream Virtual Printer" 3
 
  [Windows NT x86]
  Printer Driver Info 3:
@@ -1970,77 +2045,82 @@ example from my installation:
 
 
      
 Some printer drivers list additional files under the label
-"Dependentfiles": these would go into the last field
-ListOfFiles,Comma-separated. For the CUPS
-PostScript drivers we don't need any (nor would we for the Adobe
-PostScript driver): therefore the field will get a "NULL" entry.
-

      What is required for adddriver and setdriver to succeed

      -From the manpage (and from the quoted output -of cupsaddsmb, above) it becomes clear that you +Dependentfiles and these would go into the last field +ListOfFiles,Comma-separated. For the CUPS +PostScript drivers, we do not need any (nor would we for the Adobe +PostScript driver), therefore, the field will get a “NULL” entry. +

      Requirements for adddriver and setdriver to Succeed

      +>From the man page (and from the quoted output +of cupsaddsmb above) it becomes clear that you need to have certain conditions in order to make the manual uploading -and initializing of the driver files succeed. The two rpcclient - +and initializing of the driver files succeed. The two rpcclient + subcommands (adddriver and setdriver) need to encounter the following -pre-conditions to complete successfully: -

      • you are connected as printer admin, or root (note, -that this is not the "Printer Operators" group in -NT, but the printer admin group, as defined in +preconditions to complete successfully: +

        • You are connected as printer admin or root (this is not the “Printer Operators” group in +NT, but the printer admin group as defined in the [global] section of -smb.conf);

        • copy all required driver files to -\\sambaserver\print$\w32x86 and -\\sambaserver\print$\win40 as appropriate. They -will end up in the "0" respective "2" subdirectories later -- for now -don't put them there, they'll be automatically -used by the adddriver subcommand.! (if you use -"smbclient" to put the driver files into the share, note that you need -to escape the "$": smbclient //sambaserver/print\$ -U -root);

        • the user you're connecting as must be able to write to +smb.conf).

        • Copy all required driver files to +\\SAMBA\print$\w32x86 and +\\SAMBA\print$\win40 as appropriate. They +will end up in the “0” respective “2” subdirectories later. For now, +do not put them there, they'll be automatically +used by the adddriver subcommand. (If you use +smbclient to put the driver files into the share, note that you need +to escape the “$”: smbclient //sambaserver/print\$ -U +root.)

        • The user you're connecting as must be able to write to the [print$] share and create -subdirectories;

        • the printer you are going to setup for the Windows -clients, needs to be installed in CUPS already;

        • - - - the CUPS printer must be known to Samba, otherwise the +subdirectories.

        • The printer you are going to setup for the Windows +clients needs to be installed in CUPS already.

        • + + + The CUPS printer must be known to Samba, otherwise the setdriver subcommand fails with an NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by -Samba you may use the enumprinters subcommand to -rpcclient. A long-standing bug prevented a proper update of the +Samba, you may use the enumprinters subcommand to +rpcclient. A long-standing bug prevented a proper update of the printer list until every smbd process had received a SIGHUP or was restarted. Remember this in case you've created the CUPS printer just -shortly ago and encounter problems: try restarting -Samba.

      Manual Driver Installation in 15 Steps

      +recently and encounter problems: try restarting +Samba.

    Manual Driver Installation in 15 Steps

    We are going to install a printer driver now by manually executing all required commands. As this may seem a rather complicated process at first, we go through the procedure step by step, explaining every single action item as it comes up. -

    Procedure 19.1. Manual Driver Installation installation

    1. Install the Printer on CUPS

      -root# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P canonIR85.ppd
+
      Procedure 19.1. Manual Driver Installation
      1. Install the printer on CUPS.
        +root# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E \
+			-P canonIR85.ppd
 
        
-This installs printer with the name mysmbtstprn
+This installs a printer with the name mysmbtstprn
 to the CUPS system. The printer is accessed via a socket
 (a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root
-for this step
-
      2. (optional) Check if the Printer is recognized by
-Samba
        -root# rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn
+for this step.
+
      3. (Optional) Check if the printer is recognized by Samba.
        
+
+
        +	root# rpcclient -Uroot%xxxx -c 'enumprinters' localhost \
+  | grep -C2 mysmbtstprn
 flags:[0x800000]
 name:[\\kde-bitshop\mysmbtstprn]
 description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn]
 comment:[mysmbtstprn]
 
        
-This should show the printer in the list. If not, stop and re-start
-the Samba daemon (smbd), or send a HUP signal: kill -HUP
-`pidof smbd`. Check again.  Troubleshoot and repeat until
-success. Note the "empty" field between the two commas in the
-"description" line. Here would the driver name appear if there was one
-already. You need to know root's Samba password (as set by the
+This should show the printer in the list. If not, stop and restart
+the Samba daemon (smbd), or send a HUP signal: 
+
        +root# kill -HUP `pidof smbd`
+
        Check again. Troubleshoot and repeat until
+successful. Note the “empty” field between the two commas in the
+“description” line. The driver name would appear here if there was one already. You need to know root's Samba password (as set by the
 smbpasswd command) for this step and most of the
-following steps. Alternatively you can authenticate as one of the
-users from the "write list" as defined in smb.conf for
+following steps. Alternately, you can authenticate as one of the
+users from the “write list” as defined in smb.conf for
 [print$].
-
      4. (optional) Check if Samba knows a Driver for the
-Printer
        +
      5. (Optional) Check if Samba knows a driver for the printer.
        
+	
+	
+	
         root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
 			| grep driver 
 drivername:[]
@@ -2061,13 +2141,13 @@ printprocessor:[winprint]
  result was WERR_UNKNOWN_PRINTER_DRIVER
 
 
        
-Neither method of the three commands shown above should show a driver.
+None of the three commands shown above should show a driver.
 This step was done for the purpose of demonstrating this condition. An
 attempt to connect to the printer at this stage will prompt the
-message along the lines: "The server has not the required printer
-driver installed".
-
      6. Put all required Driver Files into Samba's
-[print$]
        +message along the lines of: “The server does not have the required printer
+driver installed.”
+
      7. Put all required driver files into Samba's
+[print$].
         root# smbclient //localhost/print\$ -U 'root%xxxx' \
 	-c 'cd W32X86; \
 	put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD; \ 
@@ -2075,15 +2155,15 @@ driver installed".
 	put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \
 	put /usr/share/cups/drivers/cups.hlp cups.hlp'
 
        
-(Note that this command should be entered in one long single
-line. Line-breaks and the line-end indicating "\" has been inserted
+(This command should be entered in one long single
+line. Line-breaks and the line-end indicated by “\” have been inserted
 for readability reasons.) This step is required
 for the next one to succeed. It makes the driver files physically
 present in the [print$] share. However, clients
 would still not be able to install them, because Samba does not yet
 treat them as driver files. A client asking for the driver would still
-be presented with a "not installed here" message.
-
      8. Verify where the Driver Files are now
        +be presented with a “not installed here” message.
+
      9. Verify where the driver files are now.
         root# ls -l /etc/samba/drivers/W32X86/
 total 669
 drwxr-sr-x    2 root     ntadmin       532 May 25 23:08 2
@@ -2093,27 +2173,27 @@ drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
 -rwxr--r--    1 root     ntadmin    215848 May 25 23:21 cupsui.dll
 -rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
 
        
-The driver files now are in the W32X86 architecture "root" of
+The driver files now are in the W32X86 architecture “root” of
 [print$].
-
      10. Tell Samba that these are
-Driver Files
-(adddriver)
        -root# rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \
-  cupsdrvr.dll:mysmbtstprn.PPD: \
-  cupsui.dll:cups.hlp:NULL:RAW:NULL" \
+
      11. Tell Samba that these are driver files (adddriver).
        
+
+
        +root# rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" \
+	"mydrivername:cupsdrvr.dll:mysmbtstprn.PPD: \
+  cupsui.dll:cups.hlp:NULL:RAW:NULL" \
   localhost
 Printer Driver mydrivername successfully installed.
 
        
-Note that your cannot repeat this step if it fails. It could fail even
+You cannot repeat this step if it fails. It could fail even
 as a result of a simple typo. It will most likely have moved a part of
-the driver files into the "2" subdirectory. If this step fails, you
-need to go back to the fourth step and repeat it, before you can try
-this one again. In this step you need to choose a name for your
+the driver files into the “2” subdirectory. If this step fails, you
+need to go back to the fourth step and repeat it before you can try
+this one again. In this step, you need to choose a name for your
 driver. It is normally a good idea to use the same name as is used for
-the printername; however, in big installations you may use this driver
-for a number of printers which have obviously different names. So the
+the printer name; however, in big installations you may use this driver
+for a number of printers that obviously have different names, so the
 name of the driver is not fixed.
-
      12. Verify where the Driver Files are now
        +
      13. Verify where the driver files are now.
         root# ls -l /etc/samba/drivers/W32X86/
 total 1
 drwxr-sr-x    2 root     ntadmin       532 May 25 23:22 2
@@ -2127,12 +2207,13 @@ total 5039
 -rwxr--r--    1 root     ntadmin    215848 May 13 13:53 cupsui.dll
 -rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
 
        
-Notice how step 6 did also move the driver files to the appropriate
-subdirectory. Compare with the situation after step 5.
-
      14. (optional) Verify if Samba now recognizes the
-Driver
        -root# rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost \
-	| grep -B2 -A5 mydrivername
+Notice how step 6 also moved the driver files to the appropriate
+subdirectory. Compare this with the situation after step 5.
+
      15. (Optional) Verify if Samba now recognizes the driver.
        
+
+
        +root# rpcclient -Uroot%xxxx -c 'enumdrivers 3' \
+	localhost | grep -B2 -A5 mydrivername
 Printer Driver Info 3:
 Version: [2]
 Driver Name: [mydrivername]
@@ -2142,21 +2223,26 @@ Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
 Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
 Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
 
        
-Remember, this command greps for the name you did choose for the
-driver in step Six. This command must succeed before you can proceed.
-
      16. Tell Samba which Printer should use these Driver
-Files (setdriver)
        -root# rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost
+Remember, this command greps for the name you chose for the
+driver in step 6. This command must succeed before you can proceed.
+
      17. Tell Samba which printer should use these driver files (setdriver).
        
+
+
        +root# rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' \
+	localhost
 Successfully set mysmbtstprn to driver mydrivername
 
        
-Since you can bind any printername (=printqueue) to any driver, this
-is a very convenient way to setup many queues which use the same
-driver. You don't need to repeat all the previous steps for the
-setdriver command to succeed. The only pre-conditions are:
+Since you can bind any printername (print queue) to any driver, this
+is a convenient way to setup many queues that use the same
+driver. You do not need to repeat all the previous steps for the
+setdriver command to succeed. The only preconditions are:
 enumdrivers must find the driver and
 enumprinters must find the printer.
-
      18. (optional) Verify if Samba has this Association
-recognized
        +
      19. (Optional) Verify if Samba has recognized this association.
        
+
+
+
+
         root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
   | grep driver
 drivername:[mydrivername]
@@ -2188,169 +2274,174 @@ Printer Driver Info 3:
      Monitorname: []
      Defaultdatatype: [RAW]
  
-root# rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn
+root# rpcclient -Uroot%xxxx -c 'enumprinters' localhost \
+	| grep mysmbtstprn
      name:[\\kde-bitshop\mysmbtstprn]
      description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn]
      comment:[mysmbtstprn]
 
 
        
-
-Compare these results with the ones from steps 2 and 3. Note that
-every single of these commands show the driver is installed.  Even
+
+Compare these results with the ones from steps 2 and 3. Every one of these commands show the driver is installed. Even
 the enumprinters command now lists the driver
-on the "description" line.
-
      20. (optional) Tickle the Driver into a correct
-Device Mode
        
-
-You certainly know how to install the driver on the client.  In case
+on the “description” line.
+
      21. (Optional) Tickle the driver into a correct
+device mode.
        
+
+You certainly know how to install the driver on the client. In case
 you are not particularly familiar with Windows, here is a short
-recipe: browse the Network Neighbourhood, go to the Samba server, look
+recipe: Browse the Network Neighborhood, go to the Samba server, and look
 for the shares. You should see all shared Samba printers.
 Double-click on the one in question. The driver should get
-installed, and the network connection set up. An alternative way is to
-open the "Printers (and Faxes)" folder, right-click on the printer in
-question and select "Connect" or "Install". As a result, a new printer
-should have appeared in your client's local "Printers (and Faxes)"
-folder, named something like "printersharename on Sambahostname".
+installed and the network connection set up. An alternate way is to
+open the Printers (and Faxes) folder, right-click on the printer in
+question and select Connect or Install. As a result, a new printer
+should have appeared in your client's local Printers (and Faxes)
+folder, named something like printersharename on Sambahostname.
 
        
 It is important that you execute this step as a Samba printer admin
 (as defined in smb.conf). Here is another method
-to do this on Windows XP. It uses a commandline, which you may type
-into the "DOS box" (type root's smbpassword when prompted):
+to do this on Windows XP. It uses a command line, which you may type
+into the “DOS box” (type root's smbpassword when prompted):
 
        -C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n\
-			\\sambacupsserver\mysmbtstprn"
+C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry \
+	/in /n \\sambaserver\mysmbtstprn"
 
        
-Change any printer setting once (like changing "portrait" to
-	"landscape"), click Apply; change the setting
+Change any printer setting once (like changing portrait to
+	landscape), click on Apply; change the setting
 back.
-
      22. Install the Printer on a Client
-("Point'n'Print")
        -C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn"
+
      23. Install the printer on a client
+(Point'n'Print).
        
+
+	
        +C:\> rundll32 printui.dll,PrintUIEntry /in /n “\\sambaserver\mysmbtstprn”
 
        
-If it doesn't work it could be a permission problem with the
+If it does not work it could be a permission problem with the
 [print$] share.
-
      24. Thirteenth Step (optional): Print a Test Page
        -C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn"
+
      25. (Optional) Print a test page.
        +C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambaserver\mysmbtstprn"
 
        
-Then hit [TAB] 5 times, [ENTER] twice, [TAB] once and [ENTER] again
+Then hit [TAB] five times, [ENTER] twice, [TAB] once and [ENTER] again
 and march to the printer.
-
      26. Fourteenth Step (recommended): Study the Test Page
        
+
      27. (Recommended) Study the test page.
        
 Hmmm.... just kidding! By now you know everything about printer
-installations and you don't need to read a word. Just put it in a
-frame and bolt it to the wall with the heading "MY FIRST
-RPCCLIENT-INSTALLED PRINTER" - why not just throw it away!
-
      28. Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your
-Success
        -root# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd
-

    Troubleshooting revisited

    +installations and you do not need to read a word. Just put it in a +frame and bolt it to the wall with the heading "MY FIRST +RPCCLIENT-INSTALLED PRINTER" why not just throw it away! +

  • (Obligatory) Enjoy. Jump. Celebrate your +success.

    +root# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd
+

    • Troubleshooting Revisited

    The setdriver command will fail, if in Samba's mind the queue is not already there. You had promising messages about the: 

    -
  Printer Driver ABC successfully installed.
-

    -after the "adddriver" parts of the procedure? But you are also seeing -a disappointing message like this one beneath? -

    -
+after the adddriver parts of the procedure?  But you are also seeing
+a disappointing message like this one?
+
    
  result was NT_STATUS_UNSUCCESSFUL
-
-

    - +

    + It is not good enough that you -can see the queue in CUPS, using +can see the queue in CUPS, using the lpstat -p ir85wm command. A bug in most recent versions of Samba prevents the proper update of the queuelist. The recognition of newly installed CUPS printers -fails unless you re-start Samba or send a HUP to all smbd -processes. To verify if this is the reason why Samba doesn't -execute the setdriver command successfully, check if Samba "sees" +fails unless you restart Samba or send a HUP to all smbd +processes. To verify if this is the reason why Samba does not +execute the setdriver command successfully, check if Samba “sees” the printer: -

    -root# rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep  ir85wm
+
    
+
+	
    +root# rpcclient transmeta -N -U'root%xxxx' -c 'enumprinters 0'|grep ir85wm
         printername:[ir85wm]
 
    
-An alternative command could be this: 
-
    +An alternate command could be this: 
+
    
+
+	
     root# rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' 
         cmd = getprinter ir85wm
         flags:[0x800000]
         name:[\\transmeta\ir85wm]
         description:[\\transmeta\ir85wm,ir85wm,DPD]
-        comment:[CUPS PostScript-Treiber for WinNT/2K/XP]
+        comment:[CUPS PostScript-Treiber for Windows NT/200x/XP]
 
    
-BTW, you can use these commands, plus a few more, of course,
+By the way, you can use these commands, plus a few more, of course,
 to install drivers on remote Windows NT print servers too!
-

    The printing *.tdb Files

    - - - - - - - - - - - - - +

    The Printing *.tdb Files

    + + + + + + + + + + + + + Some mystery is associated with the series of files with a -tdb-suffix appearing in every Samba installation. They are +tdb suffix appearing in every Samba installation. They are connections.tdb, printing.tdb, -share_info.tdb , +share_info.tdb, ntdrivers.tdb, unexpected.tdb, -brlock.tdb , +brlock.tdb, locking.tdb, ntforms.tdb, messages.tdb , ntprinters.tdb, sessionid.tdb and secrets.tdb. What is their purpose? -

    Trivial DataBase Files

    -A Windows NT (Print) Server keeps track of all information needed to serve +

    Trivial Database Files

    + +A Windows NT (print) server keeps track of all information needed to serve its duty toward its clients by storing entries in the Windows -"Registry". Client queries are answered by reading from the registry, -Administrator or user configuration settings are saved by writing into -the Registry. Samba and UNIX obviously don't have such a kind of +registry. Client queries are answered by reading from the registry, +Administrator or user configuration settings that are saved by writing into +the registry. Samba and UNIX obviously do not have such a Registry. Samba instead keeps track of all client related information in a series of *.tdb files. (TDB = Trivial Data Base). These are often located in /var/lib/samba/ -or /var/lock/samba/ . The printing related files +or /var/lock/samba/. The printing related files are ntprinters.tdb, printing.tdb,ntforms.tdb and ntdrivers.tdb. -

    Binary Format

    +

    Binary Format

    *.tdb files are not human readable. They are -written in a binary format. "Why not ASCII?", you may ask. "After all, -ASCII configuration files are a good and proofed tradition on UNIX." --- The reason for this design decision by the Samba Team is mainly +written in a binary format. “Why not ASCII?”, you may ask. “After all, +ASCII configuration files are a good and proven tradition on UNIX.” +The reason for this design decision by the Samba team is mainly performance. Samba needs to be fast; it runs a separate smbd process for each client connection, in some -environments many thousand of them. Some of these smbds might need to +environments many thousands of them. Some of these smbds might need to write-access the same *.tdb file at the same time. The file format of Samba's *.tdb files allows for this provision. Many smbd processes may write to the same *.tdb file at the same time. This wouldn't be possible with pure ASCII files. -

    Losing *.tdb Files

    +

    Losing *.tdb Files

    It is very important that all *.tdb files remain consistent over all write and read accesses. However, it may happen that these files do get corrupted. (A -kill -9 `pidof smbd` while a write access is in +kill -9 `pidof smbd' while a write access is in progress could do the damage as well as a power interruption, etc.). In cases of trouble, a deletion of the old printing-related -*.tdb files may be the only option. You need to -re-create all print related setup after that. Or you have made a +*.tdb files may be the only option. After that you need to +re-create all print-related setup or you have made a backup of the *.tdb files in time. -

    Using tdbbackup

    -Samba ships with a little utility which helps the root user of your -system to back up your *.tdb files. If you run it -with no argument, it prints a little usage message: +

    Using tdbbackup

    + + +Samba ships with a little utility that helps the root user of your +system to backup your *.tdb files. If you run it +with no argument, it prints a usage message: 

     root# tdbbackup
  Usage: tdbbackup [options] <fname...>
@@ -2361,12 +2452,12 @@ with no argument, it prints a little usage message:
    -v            verify mode (restore if corrupt)

    -Here is how I backed up my printing.tdb file: +Here is how I backed up my printing.tdb file: 

     root# ls
-.              browse.dat       locking.tdb     ntdrivers.tdb   printing.tdb
-..             share_info.tdb   connections.tdb messages.tdb    ntforms.tdb
-printing.tdbkp unexpected.tdb   brlock.tdb      gmon.out        namelist.debug  
+.              browse.dat     locking.tdb     ntdrivers.tdb printing.tdb
+..             share_info.tdb connections.tdb messages.tdb  ntforms.tdb
+printing.tdbkp unexpected.tdb brlock.tdb      gmon.out      namelist.debug  
 ntprinters.tdb sessionid.tdb
  
 root# tdbbackup -s .bak printing.tdb
@@ -2376,850 +2467,845 @@ ntprinters.tdb sessionid.tdb
  -rw-------    1 root     root        40960 May  2 03:44 printing.tdb
  -rw-------    1 root     root        40960 May  2 03:44 printing.tdb.bak
 
-

    CUPS Print Drivers from Linuxprinting.org

    -CUPS ships with good support for HP LaserJet type printers. You can +

    CUPS Print Drivers from Linuxprinting.org

    + +CUPS ships with good support for HP LaserJet-type printers. You can install the generic driver as follows: -

    +
    
+
+	
     root# lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
 
    
 The -m switch will retrieve the
 laserjet.ppd from the standard repository for
 not-yet-installed-PPDs, which CUPS typically stores in
-/usr/share/cups/model. Alternatively, you may use
+/usr/share/cups/model. Alternately, you may use
 -P /path/to/your.ppd.
 
    
-The generic laserjet.ppd however does not support every special option
-for every LaserJet-compatible model. It constitutes a sort of "least
-denominator" of all the models. If for some reason it is ruled out to
-you to pay for the commercially available ESP Print Pro drivers, your
-first move should be to consult the database on http://www.linuxprinting.org/printer_list.cgi.
+The generic laserjet.ppd, however, does not support every special option
+for every LaserJet-compatible model. It constitutes a sort of “least common
+denominator” of all the models. If for some reason
+you must pay for the commercially available ESP Print Pro drivers, your
+first move should be to consult the database on http://www.linuxprinting.org/printer_list.cgi.
 Linuxprinting.org has excellent recommendations about which driver is
 best used for each printer. Its database is kept current by the
 tireless work of Till Kamppeter from MandrakeSoft, who is also the
-principal author of the foomatic-rip utility.
+principal author of the foomatic-rip utility.
 
    Note
    
-
-The former "cupsomatic" concept is now be replaced by the new, much
-more powerful "foomatic-rip". foomatic-rip is the successor of
-cupsomatic. cupsomatic is no longer maintained. Here is the new URL
-to the Foomatic-3.0 database:http://www.linuxprinting.org/driver_list.cgi.
-If you upgrade to foomatic-rip, don't forget to also upgrade to the
-new-style PPDs for your foomatic-driven printers. foomatic-rip will
-not work with PPDs generated for the old cupsomatic. The new-style
+
+The former cupsomatic concept is now being replaced by the new
+successor, a much
+more powerful foomatic-rip.
+cupsomatic is no longer maintained. Here is the new URL
+to the Foomatic-3.0 database: http://www.linuxprinting.org/driver_list.cgi.
+If you upgrade to foomatic-rip, remember to also upgrade to the
+new-style PPDs for your Foomatic-driven printers. foomatic-rip will
+not work with PPDs generated for the old cupsomatic. The new-style
 PPDs are 100% compliant to the Adobe PPD specification. They are
-intended to be used by Samba and the cupsaddsmb utility also, to
-provide the driver files for the Windows clients also!
-
    foomatic-rip and Foomatic explained
    
-Nowadays most Linux distros rely on the utilities of Linuxprinting.org
-to create their printing related software (which, BTW, works on all
-UNIXes and on Mac OS X or Darwin too). It is not known as well as it
-should be, that it also has a very end-user friendly interface which
-allows for an easy update of drivers and PPDs, for all supported
-models, all spoolers, all operating systems and all package formats
+also intended to be used by Samba and the cupsaddsmb utility, to
+provide the driver files for the Windows clients!
+
    foomatic-rip and Foomatic Explained
    
+
+
+Nowadays, most Linux distributions rely on the utilities of Linuxprinting.org
+to create their printing-related software (which, by the way, works on all
+UNIXes and on Mac OS X or Darwin, too). It is not known as well as it
+should be, that it also has a very end-user-friendly interface that
+allows for an easy update of drivers and PPDs for all supported
+models, all spoolers, all operating systems, and all package formats
 (because there is none). Its history goes back a few years.
 
    
-Recently Foomatic has achieved the astonishing milestone of 1000
-listed printer models. Linuxprinting.org keeps all the
+Recently, Foomatic has achieved the astonishing milestone of 1000
+listed printer models. Linuxprinting.org keeps all the
 important facts about printer drivers, supported models and which
 options are available for the various driver/printer combinations in
-its Foomatic
-database. Currently there are 245 drivers
-in the database: many drivers support various models, and many models
-may be driven by different drivers; it's your choice!
-
    690 "perfect" Printers
    
-At present there are 690 devices dubbed as working "perfectly", 181
-"mostly", 96 "partially" and 46 are "Paperweights". Keeping in mind
+its Foomatic
+database. Currently there are 245 drivers
+in the database. Many drivers support various models, and many models
+may be driven by different drivers  its your choice!
+
    690 “Perfect” Printers
    
+At present, there are 690 devices dubbed as working perfectly, 181
+mostly, 96 partially, and 46 are paperweights. Keeping in mind
 that most of these are non-PostScript models (PostScript printers are
-automatically supported supported by CUPS to perfection, by using
-their own manufacturer-provided Windows-PPD...), and that a
-multifunctional device never qualifies as working "perfectly" if it
-doesn't also scan and copy and fax under GNU/Linux: then this is a
-truly astonishing achievement. Three years ago the number was not
-more than 500, and Linux or UNIX "printing" at the time wasn't
-anywhere near the quality it is today!
-
    How the "Printing HOWTO" started it all
    
-A few years ago Grant Taylor
+automatically supported by CUPS to perfection, by using
+their own manufacturer-provided Windows-PPD), and that a
+multifunctional device never qualifies as working perfectly if it
+does not also scan and copy and fax under GNU/Linux  then this is a
+truly astonishing achievement! Three years ago the number was not
+more than 500, and Linux or UNIX printing at the time wasn't
+anywhere near the quality it is today.
+
    How the Printing HOWTO Started It All
    
+A few years ago Grant Taylor
 started it all. The roots of today's Linuxprinting.org are in the
-first Linux Printing
-HOWTO which he authored. As a side-project to this document,
+first Linux Printing
+HOWTO that he authored. As a side-project to this document,
 which served many Linux users and admins to guide their first steps in
 this complicated and delicate setup (to a scientist, printing is
-"applying a structured deposition of distinct patterns of ink or toner
-particles on paper substrates" ;-), he started to
+“applying a structured deposition of distinct patterns of ink or toner
+particles on paper substrates”, he started to
 build in a little Postgres database with information about the
 hardware and driver zoo that made up Linux printing of the time. This
 database became the core component of today's Foomatic collection of
-tools and data. In the meantime it has moved to an XML representation
+tools and data. In the meantime, it has moved to an XML representation
 of the data.
-
    Foomatic's strange Name
    
-"Why the funny name?", you ask. When it really took off, around spring
+
    Foomatic's Strange Name
    
+
+“Why the funny name?” you ask. When it really took off, around spring
 2000, CUPS was far less popular than today, and most systems used LPD,
-LPRng or even PDQ to print. CUPS shipped with a few generic "drivers"
+LPRng or even PDQ to print. CUPS shipped with a few generic drivers
 (good for a few hundred different printer models). These didn't
 support many device-specific options. CUPS also shipped with its own
-built-in rasterization filter ("pstoraster", derived from
+built-in rasterization filter (pstoraster, derived from
 Ghostscript). On the other hand, CUPS provided brilliant support for
 controlling all printer options through
-standardized and well-defined "PPD files" (PostScript Printers
+standardized and well-defined PPD files (PostScript Printers
 Description files). Plus, CUPS was designed to be easily extensible.
 
    
-Grant already had in his database a respectable compilation
-of facts about a many more printers, and the Ghostscript "drivers"
-they run with. His idea, to generate PPDs from the database info
+Taylor already had in his database a respectable compilation
+of facts about many more printers and the Ghostscript “drivers”
+they run with. His idea, to generate PPDs from the database information
 and use them to make standard Ghostscript filters work within CUPS,
-proved to work very well. It also "killed several birds with one
-stone":
+proved to work very well. It also killed several birds with one
+stone:
 
    • It made all current and future Ghostscript filter
-developments available for CUPS;
    • It made available a lot of additional printer models
-to CUPS users (because often the "traditional" Ghostscript way of
-printing was the only one available);
    • It gave all the advanced CUPS options (web interface,
+developments available for CUPS.
    • It made available a lot of additional printer models
+to CUPS users (because often the traditional Ghostscript way of
+printing was the only one available).
    • It gave all the advanced CUPS options (Web interface,
 GUI driver configurations) to users wanting (or needing) to use
-Ghostscript filters.
    cupsomatic, pdqomatic, lpdomatic, directomatic
    
-CUPS worked through a quickly-hacked up filter script named cupsomatic.
+Ghostscript filters.
    cupsomatic, pdqomatic, lpdomatic, directomatic
    
+
+
+
+CUPS worked through a quickly-hacked up filter script named cupsomatic.
 cupsomatic ran the printfile through Ghostscript, constructing
 automatically the rather complicated command line needed. It just
-required to be copied into the CUPS system to make it work. To
-"configure" the way cupsomatic controls the Ghostscript rendering
+needed to be copied into the CUPS system to make it work. To
+configure the way cupsomatic controls the Ghostscript rendering
 process, it needs a CUPS-PPD. This PPD is generated directly from the
 contents of the database. For CUPS and the respective printer/filter
-combo another Perl script named "CUPS-O-Matic" did the PPD
-generation. After that was working, Grant implemented within a few
+combo, another Perl script named CUPS-O-Matic did the PPD
+generation. After that was working, Taylor implemented within a few
 days a similar thing for two other spoolers. Names chosen for the
-config-generator scripts were PDQ-O-Matic
-(for PDQ) and LPD-O-Matic
-(for - you guessed it - LPD); the configuration here didn't use PPDs
+config-generator scripts were PDQ-O-Matic
+(for PDQ) and LPD-O-Matic
+(for  you guessed it  LPD); the configuration here didn't use PPDs
 but other spooler-specific files.
 
    
-From late summer of that year, Till Kamppeter
-started to put work into the database. Till had been newly employed by
-MandrakeSoft to
-convert their printing system over to CUPS, after they had seen his
-FLTK-based XPP (a GUI frontend to
+From late summer of that year, Till Kamppeter
+started to put work into the database. Kamppeter had been newly employed by
+MandrakeSoft to
+convert its printing system over to CUPS, after they had seen his
+FLTK-based XPP (a GUI frontend to
 the CUPS lp-command). He added a huge amount of new information and new
 printers. He also developed the support for other spoolers, like
-PPR (via ppromatic),
-GNUlpr and
-LPRng (both via an extended
-lpdomatic) and "spoolerless" printing (directomatic)....
-
    
-So, to answer your question: "Foomatic" is the general name for all
-the overlapping code and data behind the "*omatic" scripts.... --
-Foomatic up to versions 2.0.x required (ugly) Perl data structures
-attached the Linuxprinting.org PPDs for CUPS. It had a different
-"*omatic" script for every spooler, as well as different printer
-configuration files..
-
    The Grand Unification
-achieved...
    
-This all has changed in Foomatic versions 2.9 (Beta) and released as
-"stable" 3.0. This has now achieved the convergence of all *omatic
-scripts: it is called the foomatic-rip.
+PPR (via ppromatic),
+GNUlpr and
+LPRng (both via an extended
+lpdomatic) and spoolerless printing (directomatic).
+
    
+So, to answer your question: “Foomatic” is the general name for all
+the overlapping code and data behind the “*omatic” scripts.
+Foomatic, up to versions 2.0.x, required (ugly) Perl data structures
+attached to Linuxprinting.org PPDs for CUPS. It had a different
+“*omatic” script for every spooler, as well as different printer
+configuration files.
+
    The Grand Unification Achieved
    
+
+This has all changed in Foomatic versions 2.9 (beta) and released as
+“stable” 3.0. It has now achieved the convergence of all *omatic
+scripts and is called the foomatic-rip.
 This single script is the unification of the previously different
 spooler-specific *omatic scripts. foomatic-rip is used by all the
-different spoolers alike. Because foomatic-rip can read PPDs (both the
+different spoolers alike and because it can read PPDs (both the
 original PostScript printer PPDs and the Linuxprinting.org-generated
 ones), all of a sudden all supported spoolers can have the power of
-PPDs at their disposal; users only need to plug "foomatic-rip" into
-their system.... For users there is improved media type and source
-support; paper sizes and trays are easier to configure.
+PPDs at their disposal. Users only need to plug foomatic-rip into
+their system. For users there is improved media type and source
+support  paper sizes and trays are easier to configure.
 
    
-Also, the New Generation of Linuxprinting.org PPDs doesn't contain
-Perl data structures any more. If you are a distro maintainer and have
+Also, the New Generation of Linuxprinting.org PPDs no longer contains
+Perl data structures. If you are a distro maintainer and have
 used the previous version of Foomatic, you may want to give the new
-one a spin: but don't forget to generate a new-version set of PPDs,
-via the new foomatic-db-engine!
+one a spin, but remember to generate a new-version set of PPDs
+via the new foomatic-db-engine!
 Individual users just need to generate a single new PPD specific to
-their model by following
-the steps outlined in the Foomatic tutorial or further
-below. This new development is truly amazing.
+their model by following
+the steps outlined in the Foomatic tutorial or in this chapter. This new development is truly amazing.
 
    
 foomatic-rip is a very clever wrapper around the need to run
-Ghostscript with a different syntax, different options, different
-device selections and/or different filters for each different printer
-or different spooler. At the same time it can read the PPD associated
+Ghostscript with a different syntax, options, device selections, and/or filters for each different printer
+or spooler. At the same time it can read the PPD associated
 with a print queue and modify the print job according to the user
 selections. Together with this comes the 100% compliance of the new
-Foomatic PPDs with the Adobe spec. Some really innovative features of
-the Foomatic concept will surprise users: it will support custom paper
-sizes for many printers; and it will support printing on media drawn
-from different paper trays within the same job (in both cases: even
+Foomatic PPDs with the Adobe spec. Some innovative features of
+the Foomatic concept may surprise users. It will support custom paper
+sizes for many printers and will support printing on media drawn
+from different paper trays within the same job (in both cases, even
 where there is no support for this from Windows-based vendor printer
 drivers).
-
    Driver Development outside
    
+
    Driver Development Outside
    
 Most driver development itself does not happen within
 Linuxprinting.org. Drivers are written by independent maintainers.
-Linuxprinting.org just pools all the information, and stores it in its
+Linuxprinting.org just pools all the information and stores it in its
 database. In addition, it also provides the Foomatic glue to integrate
 the many drivers into any modern (or legacy) printing system known to
 the world.
 
    
-Speaking of the different driver development groups: most of
+Speaking of the different driver development groups, most of
 the work is currently done in three projects. These are:
-
    • Omni
--- a Free Software project by IBM which tries to convert their printer
+
      • Omni
+ a free software project by IBM that tries to convert their printer
 driver knowledge from good-ol' OS/2 times into a modern, modular,
-universal driver architecture for Linux/UNIX (still Beta).  This
-currently supports 437 models.
      • HPIJS --
-a Free Software project by HP to provide the support for their own
+universal driver architecture for Linux/UNIX (still beta). This
+currently supports 437 models.
      • HPIJS 
+a free software project by HP to provide the support for their own
 range of models (very mature, printing in most cases is perfect and
 provides true photo quality). This currently supports 369
-models.
      • Gimp-Print -- a Free software
+models.
      • Gimp-Print  a free software
 effort, started by Michael Sweet (also lead developer for CUPS), now
 directed by Robert Krawitz, which has achieved an amazing level of
 photo print quality (many Epson users swear that its quality is
 better than the vendor drivers provided by Epson for the Microsoft
-platforms). This currently supports 522 models.
    Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and
-commercial UNIX
    
-Linuxprinting.org today is the one-stop "shop" to download printer
-drivers. Look for printer information and tutorials
-or solve printing problems in its popular forums.  But
-it's not just for GNU/Linux: users and admins of commercial UNIX
-systems are also going there, and the relatively new Mac
-OS X forum has turned out to be one of the most frequented
-fora after only a few weeks.
+platforms). This currently supports 522 models.
    Forums, Downloads, Tutorials, Howtos  also for Mac OS X and Commercial UNIX
    
+Linuxprinting.org today is the one-stop shop to download printer
+drivers. Look for printer information and tutorials
+or solve printing problems in its popular forums. This forum 
+it's not just for GNU/Linux users, but admins of commercial UNIX
+systems are also going there, and the relatively new Mac
+OS X forum has turned out to be one of the most frequented
+forums after only a few weeks.
 
    
 Linuxprinting.org and the Foomatic driver wrappers around Ghostscript
 are now a standard toolchain for printing on all the important
 distros. Most of them also have CUPS underneath. While in recent years
-most printer data had been added by Till (who works at Mandrake), many
+most printer data had been added by Kamppeter (who works at Mandrake), many
 additional contributions came from engineers with SuSE, RedHat,
-Connectiva, Debian and others. Vendor-neutrality is an important goal
+Connectiva, Debian, and others. Vendor-neutrality is an important goal
 of the Foomatic project.
 
    Note
    
 Till Kamppeter from MandrakeSoft is doing an excellent job in his
 spare time to maintain Linuxprinting.org and Foomatic. So if you use
 it often, please send him a note showing your appreciation.
-
    Foomatic Database generated PPDs
    
+
    Foomatic Database-Generated PPDs
    
 The Foomatic database is an amazing piece of ingenuity in itself. Not
 only does it keep the printer and driver information, but it is
-organized in a way that it can generate "PPD" files "on the fly" from
+organized in a way that it can generate PPD files on the fly from
 its internal XML-based datasets. While these PPDs are modelled to the
-Adobe specification of "PostScript Printer Descriptions" (PPDs), the
-Linuxprinting.org/Foomatic-PPDs don't normally drive PostScript
-printers: they are used to describe all the bells and whistles you
-could ring or blow on an Epson Stylus inkjet, or a HP Photosmart or
-what-have-you. The main "trick" is one little additional line, not
-envisaged by the PPD specification, starting with the "*cupsFilter"
-keyword: it tells the CUPS daemon how to proceed with the PostScript
+Adobe specification of PostScript Printer Descriptions (PPDs), the
+Linuxprinting.org/Foomatic-PPDs do not normally drive PostScript
+printers. They are used to describe all the bells and whistles you
+could ring or blow on an Epson Stylus inkjet, or a HP Photosmart, or
+what-have-you. The main trick is one little additional line, not
+envisaged by the PPD specification, starting with the *cupsFilter
+keyword. It tells the CUPS daemon how to proceed with the PostScript
 print file (old-style Foomatic-PPDs named the
-cupsomatic filter script, while the new-style
-PPDs now call foomatic-rip). This filter
+cupsomatic filter script, while the new-style
+PPDs are now call foomatic-rip). This filter
 script calls Ghostscript on the host system (the recommended variant
 is ESP Ghostscript) to do the rendering work. foomatic-rip knows which
 filter or internal device setting it should ask from Ghostscript to
 convert the PostScript printjob into a raster format ready for the
 target device. This usage of PPDs to describe the options of non-PS
-printers was the invention of the CUPS developers. The rest is easy:
-GUI tools (like KDE's marvellous "kprinter",
-or the GNOME "gtklp", "xpp" and the CUPS
-web interface) read the PPD too and use this information to present
+printers was the invention of the CUPS developers. The rest is easy.
+GUI tools (like KDE's marvelous kprinter,
+or the GNOME gtklp, xpp and the CUPS
+Web interface) read the PPD as well and use this information to present
 the available settings to the user as an intuitive menu selection.
-

    foomatic-rip and Foomatic-PPD Download and Installation

    -Here are the steps to install a foomatic-rip driven "LaserJet 4 Plus" -compatible printer in CUPS (note that recent distributions of SuSE, -UnitedLinux and Mandrake may ship with a complete package of -Foomatic-PPDs plus the foomatic-rip utility. going directly to -Linuxprinting.org ensures you to get the latest driver/PPD files): -

    foomatic-rip and Foomatic-PPD Download and Installation

    +Here are the steps to install a foomatic-rip driven LaserJet 4 Plus-compatible +printer in CUPS (note that recent distributions of SuSE, UnitedLinux and +Mandrake may ship with a complete package of Foomatic-PPDs plus the +foomatic-rip utility. Going directly to +Linuxprinting.org ensures that you get the latest driver/PPD files): +

    • Open your browser at the Linuxprinting.org printer listpage. +

    • Check the complete list of printers in the +database.. +

    • Select your model and click on the link. +

    • You'll arrive at a page listing all drivers working with this +model (for all printers, there will always be one +recommended driver. Try this one first). +

    • In our case (HP LaserJet 4 Plus), we'll arrive at the default driver for the +HP-LaserJet 4 Plus. +

    • The recommended driver is ljet4.

    • Several links are provided here. You should visit them all if you +are not familiar with the Linuxprinting.org database. +

    • There is a link to the database page for the +ljet4. On the driver's page, you'll find important and detailed information about how to use that driver within the various available spoolers.

    • Another link may lead you to the homepage of the -driver author or the driver.

    • Important links are the ones which provide hints with -setup instructions for CUPS (http://www.linuxprinting.org/cups-doc.html), -PDQ (http://www.linuxprinting.org/pdq-doc.html), -LPD, LPRng and GNUlpr (http://www.linuxprinting.org/lpd-doc.html) -as well as PPR (http://www.linuxprinting.org/ppr-doc.html) -or "spooler-less" printing (http://www.linuxprinting.org/direct-doc.html -).

    • You can view the PPD in your browser through this -link: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1 -

    • You can also (most importantly) -generate and download the PPD: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=0 +driver author or the driver.

    • Important links are the ones that provide hints with +setup instructions for CUPS, +PDQ, +LPD, LPRng and GNUlpr) +as well as PPR +or “spooler-less” printing. +

    • You can view the PPD in your browser through this link: +http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1 +

    • Most importantly, you can also generate and download +the PPD.

    • The PPD contains all the information needed to use our -model and the driver; this is, once installed, working transparently -for the user. Later you'll only need to choose resolution, paper size -etc. from the web-based menu, or from the print dialog GUI, or from -the commandline.

    • Should you have ended up on the driver's page (http://www.linuxprinting.org/show_driver.cgi?driver=ljet4), -you can choose to use the "PPD-O-Matic" online PPD generator -program.

    • Select the exact model and check either "download" or -"display PPD file" and click on "Generate PPD file".

    • If you save the PPD file from the browser view, please -don't use "cut'n'past" (since it could possibly damage line endings -and tabs, which makes the PPD likely to fail its duty), but use "Save -as..." in your browser's menu. (Best is to use the "download" option -from the web page directly).

    • Another very interesting part on each driver page is -the Show execution details button. If you -select your printer model and click that button, you will get -displayed a complete Ghostscript command line, enumerating all options -available for that driver/printermodel combo. This is a great way to -"Learn Ghostscript By Doing". It is also an excellent "cheat sheet" +model and the driver; once installed, this works transparently +for the user. Later you'll only need to choose resolution, paper size, +and so on from the Web-based menu, or from the print dialog GUI, or from +the command line.

    • If you ended up on the drivers +page +you can choose to use the “PPD-O-Matic” online PPD generator +program.

    • Select the exact model and check either Download or +Display PPD file and click Generate PPD file.

    • If you save the PPD file from the browser view, please +do not use cut and paste (since it could possibly damage line endings +and tabs, which makes the PPD likely to fail its duty), but use Save +as... in your browser's menu. (It is best to use the Download option +directly from the Web page).

    • Another interesting part on each driver page is +the Show execution details button. If you +select your printer model and click on that button, +a complete Ghostscript command line will be displayed, enumerating all options +available for that combination of driver and printer model. This is a great way to +“learn Ghostscript by doing”. It is also an excellent cheat sheet for all experienced users who need to re-construct a good command line for that damn printing script, but can't remember the exact -syntax. ;-)

    • Some time during your visit to Linuxprinting.org, save +syntax.

    • Some time during your visit to Linuxprinting.org, save the PPD to a suitable place on your harddisk, say /path/to/my-printer.ppd (if you prefer to install -your printers with the help of the CUPS web interface, save the PPD to -the /usr/share/cups/model/ path and re-start -cupsd).

    • Then install the printer with a suitable commandline, -e.g.: +your printers with the help of the CUPS Web interface, save the PPD to +the /usr/share/cups/model/ path and restart +cupsd).

    • Then install the printer with a suitable command line, +like this: 

      -root# lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd
-

    • Note again this: for all the new-style "Foomatic-PPDs" -from Linuxprinting.org, you also need a special "CUPS filter" named -"foomatic-rip".Get the latest version of "foomatic-rip" from: http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0 +root# lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E \ + -P path/to/my-printer.ppd +

    • For all the new-style “Foomatic-PPDs” +from Linuxprinting.org, you also need a special CUPS filter named +foomatic-rip.

    • The foomatic-rip Perlscript itself also makes some -interesting reading (http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=1), -because it is very well documented by Till's inline comments (even +interesting reading +because it is well documented by Kamppeter's inline comments (even non-Perl hackers will learn quite a bit about printing by reading -it... ;-)

    • Save foomatic-rip either directly in +it).

    • Save foomatic-rip either directly in /usr/lib/cups/filter/foomatic-rip or somewhere in -your $PATH (and don't forget to make it world-executable). Again, -don't save by "copy'n'paste" but use the appropriate link, or the -"Save as..." menu item in your browser.

    • If you save foomatic-rip in your $PATH, create a symlink: -cd /usr/lib/cups/filter/ ; ln -s `which -foomatic-rip`. For CUPS to discover this new -available filter at startup, you need to re-start +your $PATH (and remember to make it world-executable). Again, +do not save by copy and paste but use the appropriate link or the +Save as... menu item in your browser.

    • If you save foomatic-rip in your $PATH, create a symlink: +

      +root# cd /usr/lib/cups/filter/ ; ln -s `which foomatic-rip'
+

      +

      +CUPS will discover this new available filter at startup after restarting cupsd.

    -Once you print to a printqueue set up with the Foomatic-PPD, CUPS will +Once you print to a print queue set up with the Foomatic-PPD, CUPS will insert the appropriate commands and comments into the resulting PostScript jobfile. foomatic-rip is able to read and act upon -these. foomatic-rip uses some specially encoded Foomatic comments, +these and uses some specially encoded Foomatic comments embedded in the jobfile. These in turn are used to construct -(transparently for you, the user) the complicated ghostscript command -line telling for the printer driver how exactly the resulting raster -data should look like and which printer commands to embed into the -data stream. -

    -You need: -

    • A "foomatic+something" PPD -- but it this not enough +(transparently for you, the user) the complicated Ghostscript command +line telling the printer driver exactly how the resulting raster +data should look and which printer commands to embed into the +data stream. You need: +

      • A “foomatic+something” PPD but this is not enough to print with CUPS (it is only one important -component)

      • The "foomatic-rip" filter script (Perl) in -/usr/lib/cups/filters/

      • Perl to make foomatic-rip run

      • Ghostscript (because it is doing the main work, +component).

      • The foomatic-rip filter script (Perl) in +/usr/lib/cups/filters/.

      • Perl to make foomatic-rip run.

      • Ghostscript (because it is doing the main work, controlled by the PPD/foomatic-rip combo) to produce the raster data -fit for your printermodel's consumption

      • Ghostscript must (depending on -the driver/model) contain support for a certain "device", representing -the selected "driver" for your model (as shown by "gs --h")

      • foomatic-rip needs a new version of PPDs (PPD versions -produced for cupsomatic don't work with -foomatic-rip).

    Page Accounting with CUPS

    -Often there are questions regarding "print quotas" wherein Samba users +fit for your printer model's consumption.

  • Ghostscript must (depending on +the driver/model) contain support for a certain device representing +the selected driver for your model (as shown by gs + -h).

  • foomatic-rip needs a new version of PPDs (PPD versions +produced for cupsomatic do not work with +foomatic-rip).

    • Page Accounting with CUPS

    + +Often there are questions regarding print quotas where Samba users (that is, Windows clients) should not be able to print beyond a -certain amount of pages or data volume per day, week or month. This +certain number of pages or data volume per day, week or month. This feature is dependent on the real print subsystem you're using. Samba's part is always to receive the job files from the clients (filtered or unfiltered) and hand it over to this printing subsystem.

    -Of course one could "hack" things with one's own scripts. But then -there is CUPS. CUPS supports "quotas" which can be based on sizes of -jobs or on the number of pages or both, and are spanning any time +Of course one could hack things with one's own scripts. But then +there is CUPS. CUPS supports quotas that can be based on the size of +jobs or on the number of pages or both, and span any time period you want. -

    Setting up Quotas

    -This is an example command how root would set a print quota in CUPS, -assuming an existing printer named "quotaprinter": -

    +
    Setting Up Quotas
    
+
+This is an example command of how root would set a print quota in CUPS,
+assuming an existing printer named “quotaprinter”:
+
    
+
+	
     root# lpadmin -p quotaprinter -o job-quota-period=604800 \
 	-o job-k-limit=1024 -o job-page-limit=100
 
    
 This would limit every single user to print 100 pages or 1024 KB of
 data (whichever comes first) within the last 604,800 seconds ( = 1
 week).
-
    Correct and incorrect Accounting
    
+
    Correct and Incorrect Accounting
    
 For CUPS to count correctly, the printfile needs to pass the CUPS
-"pstops" filter, otherwise it uses a "dummy" count of "1".  Some
-printfiles don't pass it (eg: image files) but then those are mostly 1
+pstops filter, otherwise it uses a dummy count of “one”. Some
+print files do not pass it (e.g., image files) but then those are mostly one-
 page jobs anyway. This also means that proprietary drivers for the
 target printer running on the client computers and CUPS/Samba, which
-then spool these files as "raw" (i.e. leaving them untouched, not
-filtering them), will be counted as "1-pagers" too!
+then spool these files as “raw” (i.e., leaving them untouched, not
+filtering them), will be counted as one-pagers too!
 
    
-You need to send PostScript from the clients (i.e. run a PostScript
+You need to send PostScript from the clients (i.e., run a PostScript
 driver there) to have the chance to get accounting done. If the
 printer is a non-PostScript model, you need to let CUPS do the job to
 convert the file to a print-ready format for the target printer. This
-will be working for currently about 1,000 different printer models,
-see the driver list at linuxprinting.org/.
-
    Adobe and CUPS PostScript Drivers for Windows Clients
    
-Before CUPS-1.1.16 your only option was to use the Adobe PostScript
+is currently working for about a thousand different printer models.
+Linuxprinting has a driver
+list.
+
    Adobe and CUPS PostScript Drivers for Windows Clients
    
+Before CUPS 1.1.16, your only option was to use the Adobe PostScript
 Driver on the Windows clients. The output of this driver was not
-always passed through the "pstops" filter on the CUPS/Samba side, and
+always passed through the pstops filter on the CUPS/Samba side, and
 therefore was not counted correctly (the reason is that it often,
-depending on the "PPD" being used, wrote a "PJL"-header in front of
-the real PostScript which caused CUPS to skip pstops and go directly
-to the "pstoraster" stage).
-
    
-From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver for
-Windows NT/2K/XP clients" (which is tagged in the download area of
-http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). It does
-not work for Win9x/ME clients. But it guarantees:
-
    • to not write an PJL-header
    • to still read and support all PJL-options named in the
-driver PPD with its own means
    •  that the file will pass through the "pstops" filter
-on the CUPS/Samba server
    • to page-count correctly the
-printfile
    
-You can read more about the setup of this combination in the manpage
-for "cupsaddsmb" (which is only present with CUPS installed, and only
+depending on the PPD being used, wrote a PJL-header in front of
+the real PostScript which caused CUPS to skip pstops and go directly
+to the pstoraster stage).
+
    
+From CUPS 1.1.16 onward, you can use the CUPS PostScript Driver for
+Windows NT/200x/XP clients (which is tagged in the download area of
+http://www.cups.org/ as the cups-samba-1.1.16.tar.gz
+package). It does not work for Windows 9x/ME clients, but it guarantees:
+
    •   To not write a PJL-header.
    • To still read and support all PJL-options named in the
+driver PPD with its own means.
    • That the file will pass through the pstops filter
+on the CUPS/Samba server.
    • To page-count correctly the print file.
    
+You can read more about the setup of this combination in the man page
+for cupsaddsmb (which is only present with CUPS installed, and only
 current from CUPS 1.1.16).
-
    The page_log File Syntax
    
-These are the items CUPS logs in the "page_log" for every
-single page of a job:
-
    • Printer name
    • User name
    • Job ID
    • Time of printing
    • the page number
    • the number of copies
    • a billing information string
-(optional)
    • the host which sent the job (included since version
-1.1.19)
    
-Here is an extract of my CUPS server's page_log file to illustrate the
+
    The page_log File Syntax
    
+
+These are the items CUPS logs in the page_log for every
+page of a job:
+
    • Printer name
    • User name
    • Job ID
    • Time of printing
    • The page number
    • The number of copies
    • A billing information string (optional)
    • The host that sent the job (included since version 1.1.19)
    
+Here is an extract of my CUPS server's page_log file to illustrate the
 format and included items:
 
    -infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13
-infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13
-infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13
-infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13
-DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33
+tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13
+tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13
+tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13
+tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13
+Dig9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33
 
    
-This was job ID "401", printed on "infotec_IS2027" by user "kurt", a
-64-page job printed in 3 copies and billed to "#marketing", sent
-from IP address 10.160.50.13. The next job had ID "402", was sent by
-user "boss" from IP address 10.160.51.33,printed from one page 440
-copies and is set to be billed to "finance-dep".
-
    Possible Shortcomings
    
+This was job ID 401, printed on tec_IS2027
+by user kurt, a 64-page job printed in three copies and billed to
+#marketing, sent from IP address 10.160.50.13.
+ The next job had ID 402, was sent by user boss
+from IP address 10.160.51.33, printed from one page 440 copies and
+is set to be billed to finance-dep.
+
    Possible Shortcomings
    
 What flaws or shortcomings are there with this quota system?
-
    • the ones named above (wrongly logged job in case of
-printer hardware failure, etc.)
    • in reality, CUPS counts the job pages that are being
+
      • The ones named above (wrongly logged job in case of
+printer hardware failure, and so on).
      • In reality, CUPS counts the job pages that are being
 processed in software (that is, going through the
-"RIP") rather than the physical sheets successfully leaving the
-printing device. Thus if there is a jam while printing the 5th sheet out
-of 1000 and the job is aborted by the printer, the "page count" will
-still show the figure of 1000 for that job
      • all quotas are the same for all users (no flexibility
-to give the boss a higher quota than the clerk), no support for
-groups
      • no means to read out the current balance or the
-"used-up" number of current quota
      • a user having used up 99 sheets of 100 quota will
-still be able to send and print a 1,000 sheet job
      • a user being denied a job because of a filled-up quota
-doesn't get a meaningful error message from CUPS other than
-"client-error-not-possible".
    Future Developments
    
+RIP) rather than the physical sheets successfully leaving the
+printing device. Thus if there is a jam while printing the fifth sheet out
+of a thousand and the job is aborted by the printer, the page count will
+still show the figure of a thousand for that job.
  • All quotas are the same for all users (no flexibility
+to give the boss a higher quota than the clerk) and no support for
+groups.
  • No means to read out the current balance or the
+“used-up” number of current quota.
  • A user having used up 99 sheets of a 100 quota will
+still be able to send and print a thousand sheet job.
  • A user being denied a job because of a filled-up quota
+does not get a meaningful error message from CUPS other than
+“client-error-not-possible”.
    • Future Developments
    
 This is the best system currently available, and there are huge
 improvements under development for CUPS 1.2:
-
    • page counting will go into the "backends" (these talk
+
      • Page counting will go into the backends (these talk
 directly to the printer and will increase the count in sync with the
-actual printing process: thus a jam at the 5th sheet will lead to a
-stop in the counting)
      • quotas will be handled more flexibly
      • probably there will be support for users to inquire
-their "accounts" in advance
      • probably there will be support for some other tools
-around this topic
    Other Accounting Tools
    
-PrintAnalyzer, pyKota, printbill, LogReport.
-
    Additional Material
    
+actual printing process; thus, a jam at the fifth sheet will lead to a
+stop in the counting).
  • Quotas will be handled more flexibly.
  • Probably there will be support for users to inquire
+about their accounts in advance.
  • Probably there will be support for some other tools
+around this topic.

    • Additional Material

    A printer queue with no PPD associated to it is a -"raw" printer and all files will go directly there as received by the -spooler. The exceptions are file types "application/octet-stream" -which need "passthrough feature" enabled. "Raw" queues don't do any +“raw” printer and all files will go directly there as received by the +spooler. The exceptions are file types application/octet-stream +that need passthrough feature enabled. “Raw” queues do not do any filtering at all, they hand the file directly to the CUPS backend. -This backend is responsible for the sending of the data to the device -(as in the "device URI" notation: lpd://, socket://, -smb://, ipp://, http://, parallel:/, serial:/, usb:/ etc.) +This backend is responsible for sending the data to the device +(as in the “device URI” notation: lpd://, socket://, +smb://, ipp://, http://, parallel:/, serial:/, usb:/, and so on).

    -"cupsomatic"/Foomatic are not native CUPS drivers -and they don't ship with CUPS. They are a Third Party add-on, +cupsomatic/Foomatic are not native CUPS drivers +and they do not ship with CUPS. They are a third party add-on developed at Linuxprinting.org. As such, they are a brilliant hack to make all models (driven by Ghostscript drivers/filters in traditional spoolers) also work via CUPS, with the same (good or bad!) quality as -in these other spoolers. "cupsomatic" is only a vehicle to execute a -ghostscript commandline at that stage in the CUPS filtering chain, -where "normally" the native CUPS "pstoraster" filter would kick -in. cupsomatic by-passes pstoraster, "kidnaps" the printfile from CUPS -away and re-directs it to go through Ghostscript. CUPS accepts this, -because the associated CUPS-O-Matic-/Foomatic-PPD specifies: +in these other spoolers. cupsomatic is only a vehicle to execute a +Ghostscript commandline at that stage in the CUPS filtering chain, +where normally the native CUPS pstoraster filter would kick +in. cupsomatic bypasses pstoraster, kidnaps the printfile from CUPS +away and redirects it to go through Ghostscript. CUPS accepts this, +because the associated cupsomatic/foomatic-PPD specifies: + 

    -  *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"
+  *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"

    + This line persuades CUPS to hand the file to cupsomatic, once it has successfully converted it to the MIME type -"application/vnd.cups-postscript". This conversion will not happen for -Jobs arriving from Windows which are auto-typed -"application/octet-stream", with the according changes in +application/vnd.cups-postscript. This conversion will not happen for +Jobs arriving from Windows that are auto-typed +application/octet-stream, with the according changes in /etc/cups/mime.types in place.

    CUPS is widely configurable and flexible, even regarding its filtering mechanism. Another workaround in some situations would be to have in /etc/cups/mime.types entries as follows: + 

      application/postscript           application/vnd.cups-raw  0  -
  application/vnd.cups-postscript  application/vnd.cups-raw  0  -

    -This would prevent all Postscript files from being filtered (rather, + +This would prevent all PostScript files from being filtered (rather, they will through the virtual nullfilter -denoted with "-"). This could only be useful for PS printers. If you +denoted with “-”). This could only be useful for PS printers. If you want to print PS code on non-PS printers (provided they support ASCII -text printing) an entry as follows could be useful: +text printing), an entry as follows could be useful: + 

      */*           application/vnd.cups-raw  0  -

    + and would effectively send all files to the backend without further processing.

    -Lastly, you could have the following entry: +You could have the following entry: + 

    -application/vnd.cups-postscript application/vnd.cups-raw 0 my_PJL_stripping_filter
+application/vnd.cups-postscript application/vnd.cups-raw 0 \
+	my_PJL_stripping_filter

    -You will need to write a my_PJL_stripping_filter -(could be a shellscript) that parses the PostScript and removes the -unwanted PJL. This would need to conform to CUPS filter design + +You will need to write a my_PJL_stripping_filter +(which could be a shell script) that parses the PostScript and removes the +unwanted PJL. This needs to conform to CUPS filter design (mainly, receive and pass the parameters printername, job-id, username, jobtitle, copies, print options and possibly the -filename). It would be installed as world executable into -/usr/lib/cups/filters/ and will be called by CUPS -if it encounters a MIME type "application/vnd.cups-postscript". +filename). It is installed as world executable into +/usr/lib/cups/filters/ and is called by CUPS +if it encounters a MIME type application/vnd.cups-postscript.

    -CUPS can handle -o job-hold-until=indefinite. -This keeps the job in the queue "on hold". It will only be printed +CUPS can handle -o job-hold-until=indefinite. +This keeps the job in the queue on hold. It will only be printed upon manual release by the printer operator. This is a requirement in -many "central reproduction departments", where a few operators manage +many central reproduction departments, where a few operators manage the jobs of hundreds of users on some big machine, where no user is allowed to have direct access (such as when the operators often need to load the proper paper type before running the 10,000 page job -requested by marketing for the mailing, etc.). -

    Auto-Deletion or Preservation of CUPS Spool Files

    -Samba print files pass through two "spool" directories. One is the -incoming directory managed by Samba, (set in the path = /var/spool/samba directive in the -[printers] section of +requested by marketing for the mailing, and so on). +

    Auto-Deletion or Preservation of CUPS Spool Files

    +Samba print files pass through two spool directories. One is the +incoming directory managed by Samba, (set in the +path = /var/spool/samba +directive in the [printers] section of smb.conf). The other is the spool directory of your UNIX print subsystem. For CUPS it is normally -/var/spool/cups/, as set by the cupsd.conf +/var/spool/cups/, as set by the cupsd.conf directive RequestRoot /var/spool/cups. -

    CUPS Configuration Settings explained

    +

    CUPS Configuration Settings Explained

    Some important parameter settings in the CUPS configuration file cupsd.conf are:

    PreserveJobHistory Yes

    This keeps some details of jobs in cupsd's mind (well it keeps the -"c12345", "c12346" etc. files in the CUPS spool directory, which do a +c12345, c12346, and so on, files in the CUPS spool directory, which do a similar job as the old-fashioned BSD-LPD control files). This is set -to "Yes" as a default. +to “Yes” as a default.

    PreserveJobFiles Yes

    This keeps the job files themselves in cupsd's mind -(well it keeps the "d12345", "d12346" etc. files in the CUPS spool -directory...). This is set to "No" as the CUPS +(it keeps the d12345, d12346 etc. files in the CUPS spool +directory). This is set to “No” as the CUPS default. -

    "MaxJobs 500"

    +

    “MaxJobs 500”

    This directive controls the maximum number of jobs that are kept in memory. Once the number of jobs reaches the limit, the oldest completed job is automatically purged from the system to make room for the new one. If all of the known jobs are still -pending or active then the new job will be rejected. Setting the +pending or active, then the new job will be rejected. Setting the maximum to 0 disables this functionality. The default setting is 0.

    -(There are also additional settings for "MaxJobsPerUser" and -"MaxJobsPerPrinter"...) -

    Pre-conditions

    +(There are also additional settings for MaxJobsPerUser and +MaxJobsPerPrinter...) +

    Pre-Conditions

    For everything to work as announced, you need to have three things: -

    • a Samba-smbd which is compiled against "libcups" (Check -on Linux by running "ldd `which smbd`")

    • a Samba-smb.conf setting of - printing = cups

    • another Samba-smb.conf setting of - printcap = cups

    Note

    -In this case all other manually set printing-related commands (like -print command, -lpq command, -lprm command, -lppause command or -lpresume command) are ignored and they should normally have no -influence what-so-ever on your printing. -

    Manual Configuration

    -If you want to do things manually, replace the printing = cups -by printing = bsd. Then your manually set commands may work -(haven't tested this), and a print command = lp -d %P %s; rm %s" +

    • A Samba-smbd that is compiled against libcups (check +on Linux by running ldd `which smbd').

    • A Samba-smb.conf setting of + printing = cups.

    • Another Samba-smb.conf setting of + printcap = cups.

    Note

    +In this case, all other manually set printing-related commands (like +print command, +lpq command, +lprm command, +lppause command or +lpresume command) are ignored and they should normally have no +influence whatsoever on your printing. +

    Manual Configuration

    +If you want to do things manually, replace the printing = cups +by printing = bsd. Then your manually set commands may work +(I haven't tested this), and a print command = lp -d %P %s; rm %s" may do what you need. -

    In Case of Trouble.....

    -If you have more problems, post the output of these commands -to the CUPS or Samba mailing lists (choose the one which seems more -relevant to your problem): -

    -$ grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
-$ grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"
-

    -(adapt paths as needed). These commands leave out the empty -lines and lines with comments, providing the "naked settings" in a -compact way. Don't forget to name the CUPS and Samba versions you -are using! This saves bandwidth and makes for easier readability -for experts (and you are expecting experts to read them, right? -;-) -

    Printing from CUPS to Windows attached -Printers

    -From time to time the question arises, how you can print +

    Printing from CUPS to Windows Attached Printers

    +>From time to time the question arises, how can you print to a Windows attached printer -from Samba. Normally the local connection +from Samba? Normally the local connection from Windows host to printer would be done by USB or parallel -cable, but this doesn't matter to Samba. From here only an SMB +cable, but this does not matter to Samba. From here only an SMB connection needs to be opened to the Windows host. Of course, this -printer must be "shared" first. As you have learned by now, CUPS uses +printer must be shared first. As you have learned by now, CUPS uses backends to talk to printers and other -servers. To talk to Windows shared printers you need to use the -smb (surprise, surprise!) backend. Check if this -is in the CUPS backend directory. This resides usually in -/usr/lib/cups/backend/. You need to find a "smb" +servers. To talk to Windows shared printers, you need to use the +smb (surprise, surprise!) backend. Check if this +is in the CUPS backend directory. This usually resides in +/usr/lib/cups/backend/. You need to find an smb file there. It should be a symlink to smbspool -which file must exist and be executable: +and the file must exist and be executable: 

     root# ls -l /usr/lib/cups/backend/
 total 253
-drwxr-xr-x    3 root     root          720 Apr 30 19:04 .
-drwxr-xr-x    6 root     root          125 Dec 19 17:13 ..
--rwxr-xr-x    1 root     root        10692 Feb 16 21:29 canon
--rwxr-xr-x    1 root     root        10692 Feb 16 21:29 epson
-lrwxrwxrwx    1 root     root            3 Apr 17 22:50 http -> ipp
--rwxr-xr-x    1 root     root        17316 Apr 17 22:50 ipp
--rwxr-xr-x    1 root     root        15420 Apr 20 17:01 lpd
--rwxr-xr-x    1 root     root         8656 Apr 20 17:01 parallel
--rwxr-xr-x    1 root     root         2162 Mar 31 23:15 pdfdistiller
-lrwxrwxrwx    1 root     root           25 Apr 30 19:04 ptal -> /usr/sbin/ptal-cups
--rwxr-xr-x    1 root     root         6284 Apr 20 17:01 scsi
-lrwxrwxrwx    1 root     root           17 Apr  2 03:11 smb -> /usr/bin/smbspool
--rwxr-xr-x    1 root     root         7912 Apr 20 17:01 socket
--rwxr-xr-x    1 root     root         9012 Apr 20 17:01 usb
+drwxr-xr-x    3 root   root     720 Apr 30 19:04 .
+drwxr-xr-x    6 root   root     125 Dec 19 17:13 ..
+-rwxr-xr-x    1 root   root   10692 Feb 16 21:29 canon
+-rwxr-xr-x    1 root   root   10692 Feb 16 21:29 epson
+lrwxrwxrwx    1 root   root       3 Apr 17 22:50 http -> ipp
+-rwxr-xr-x    1 root   root   17316 Apr 17 22:50 ipp
+-rwxr-xr-x    1 root   root   15420 Apr 20 17:01 lpd
+-rwxr-xr-x    1 root   root    8656 Apr 20 17:01 parallel
+-rwxr-xr-x    1 root   root    2162 Mar 31 23:15 pdfdistiller
+lrwxrwxrwx    1 root   root      25 Apr 30 19:04 ptal -> /usr/sbin/ptal-cups
+-rwxr-xr-x    1 root   root    6284 Apr 20 17:01 scsi
+lrwxrwxrwx    1 root   root      17 Apr  2 03:11 smb -> /usr/bin/smbspool
+-rwxr-xr-x    1 root   root    7912 Apr 20 17:01 socket
+-rwxr-xr-x    1 root   root    9012 Apr 20 17:01 usb
 
 root# ls -l `which smbspool`
--rwxr-xr-x    1 root     root       563245 Dec 28 14:49 /usr/bin/smbspool
+-rwxr-xr-x    1 root   root  563245 Dec 28 14:49 /usr/bin/smbspool

    -If this symlink doesn't exist, create it: +If this symlink does not exist, create it: 

     root# ln -s `which smbspool` /usr/lib/cups/backend/smb

    -smbspool has been written by Mike Sweet from the CUPS folks. It is +smbspool has been written by Mike Sweet from the CUPS folks. It is included and ships with Samba. It may also be used with print subsystems other than CUPS, to spool jobs to Windows printer shares. To -set up printer "winprinter" on CUPS, you need to have a "driver" for +set up printer winprinter on CUPS, you need to have a driver for it. Essentially this means to convert the print data on the CUPS/Samba host to a format that the printer can digest (the Windows host is -unable to convert any files you may send). This also means you should +unable to convert any files you may send). This also means you should be able to print to the printer if it were hooked directly at your Samba/CUPS host. For troubleshooting purposes, this is what you -should do, to determine if that part of the process chain is in +should do to determine if that part of the process chain is in order. Then proceed to fix the network connection/authentication to -the Windows host, etc. +the Windows host, and so on.

    -To install a printer with the smb backend on CUPS, use this command: +To install a printer with the smb backend on CUPS, use this command: 

     root# lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename \
   -P /path/to/PPD

    -The PPD must be able to direct CUPS to generate -the print data for the target model. For PostScript printers just use +The PPD must be able to direct CUPS to generate +the print data for the target model. For PostScript printers, just use the PPD that would be used with the Windows NT PostScript driver. But what can you do if the printer is only accessible with a password? Or if the printer's host is part of another workgroup? This is provided -for: you can include the required parameters as part of the -smb:// device-URI. Like this: -

    • smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename

    • smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename

    • smb://username:password@WINDOWSNETBIOSNAME/printersharename

    +for: You can include the required parameters as part of the +smb:// device-URI like this: +

    • smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename
    • smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename
    • smb://username:password@WINDOWSNETBIOSNAME/printersharename

    Note that the device-URI will be visible in the process list of the -Samba server (e.g. when someone uses the ps -aux +Samba server (e.g., when someone uses the ps -aux command on Linux), even if the username and passwords are sanitized -before they get written into the log files. So this is an inherently -insecure option. However it is the only one. Don't use it if you want +before they get written into the log files. So this is an inherently +insecure option, however, it is the only one. Don't use it if you want to protect your passwords. Better share the printer in a way that -doesn't require a password! Printing will only work if you have a +does not require a password! Printing will only work if you have a working netbios name resolution up and running. Note that this is a -feature of CUPS and you don't necessarily need to have smbd running -(but who wants that? :-). -

    More CUPS filtering Chains

    +feature of CUPS and you do not necessarily need to have smbd running. + +

    More CUPS-Filtering Chains

    The following diagrams reveal how CUPS handles print jobs. -

    Figure 19.17. Filtering chain 1

    Filtering chain 1

    Figure 19.18. Filtering chain with cupsomatic

    Filtering chain with cupsomatic

    Note

    -Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -CUPS and ESP PrintPro plug-in where rastertosomething is noted. -

    Common Errors

    Win9x client can't install driver

    For Win9x clients require the printer names to be 8 -chars (or "8 plus 3 chars suffix") max; otherwise the driver files -won't get transferred when you want to download them from -Samba.

    "cupsaddsmb" keeps asking for root password in - neverending loop

    Have you security = user? Have +

    Figure 19.17. Filtering chain 1.

    Filtering chain 1.

    Figure 19.18. Filtering chain with cupsomatic

    Filtering chain with cupsomatic

    Common Errors

    Windows 9x/ME Client Can't Install Driver

    For Windows 9x/ME, clients require the printer names to be eight +characters (or “8 plus 3 chars suffix”) max; otherwise, the driver files +will not get transferred when you want to download them from +Samba.

    “cupsaddsmb” Keeps Asking for Root Password in Never-ending Loop

    Have you security = user? Have you used smbpasswd to give root a Samba account? -You can do 2 things: open another terminal and execute -smbpasswd -a root to create the account, and -continue with entering the password into the first terminal. Or break -out of the loop by hitting ENTER twice (without trying to type a -password).

    "cupsaddsmb" gives "No PPD file for printer..." - message while PPD file is present

    Have you enabled printer sharing on CUPS? This means: -do you have a <Location +You can do two things: open another terminal and execute +smbpasswd -a root to create the account and +continue entering the password into the first terminal. Or break +out of the loop by pressing ENTER twice (without trying to type a +password).

    “cupsaddsmb” Errors

    + The use of “cupsaddsmb” gives “No PPD file for printer...” Message While PPD File Is Present. + What might the problem be? +

    Have you enabled printer sharing on CUPS? This means: +Do you have a <Location /printers>....</Location> section in CUPS -server's cupsd.conf which doesn't deny access to -the host you run "cupsaddsmb" from? It could be +server's cupsd.conf that does not deny access to +the host you run “cupsaddsmb” from? It could be an issue if you use cupsaddsmb remotely, or if you use it with a -h parameter: cupsaddsmb -H sambaserver -h cupsserver -v printername.

    Is your -"TempDir" directive in -cupsd.conf +TempDir directive in +cupsd.conf set to a valid value and is it writeable? -

    Client can't connect to Samba printer

    Use smbstatus to check which user +

    Client Can't Connect to Samba Printer

    Use smbstatus to check which user you are from Samba's point of view. Do you have the privileges to write into the [print$] -share?

    Can't reconnect to Samba under new account - from Win2K/XP

    Once you are connected as the "wrong" user (for -example as "nobody", which often occurs if you have -map to guest = bad user), Windows Explorer will not accept an -attempt to connect again as a different user. There won't be any byte +share?

    New Account Reconnection from Windows 200x/XP Troubles

    Once you are connected as the wrong user (for +example, as nobody, which often occurs if you have +map to guest = bad user), Windows Explorer will not accept an +attempt to connect again as a different user. There will not be any byte transfered on the wire to Samba, but still you'll see a stupid error -message which makes you think that Samba has denied access. Use +message that makes you think Samba has denied access. Use smbstatus to check for active connections. Kill the -PIDs. You still can't re-connect and get the dreaded +PIDs. You still can't re-connect and you get the dreaded You can't connect with a second account from the same -machine message, as soon as you are trying? And you -don't see any single byte arriving at Samba (see logs; use "ethereal") -indicating a renewed connection attempt? Shut all Explorer Windows. +machine message, as soon as you are trying. And you +do not see any single byte arriving at Samba (see logs; use “ethereal”) +indicating a renewed connection attempt. Shut all Explorer Windows. This makes Windows forget what it has cached in its memory as -established connections. Then re-connect as the right user. Best +established connections. Then reconnect as the right user. The best method is to use a DOS terminal window and first do net use z: \\GANDALF\print$ /user:root. Check with smbstatus that you are connected under a -different account. Now open the "Printers" folder (on the Samba server -in the Network Neighbourhood), right-click the +different account. Now open the Printers folder (on the Samba server +in the Network Neighborhood), right-click on the printer in question and select -Connect...

    Avoid being connected to the Samba server as the - "wrong" user

    You see per smbstatus that you are -connected as user "nobody"; while you wanted to be "root" or -"printeradmin"? This is probably due to -map to guest = bad user, which silently connects you under the guest account, +Connect...

    Avoid Being Connected to the Samba Server as the Wrong User

    You see per smbstatus that you are +connected as user nobody; while you want to be root or +printeradmin. This is probably due to +map to guest = bad user, which silently connects you under the guest account when you gave (maybe by accident) an incorrect username. Remove -map to guest, if you want to prevent -this.

    Upgrading to CUPS drivers from Adobe drivers on - NT/2K/XP clients gives problems

    First delete all "old" Adobe-using printers. Then -delete all "old" Adobe drivers. (On Win2K/XP, right-click in -background of "Printers" folder, select "Server Properties...", select -tab "Drivers" and delete here).

    Can't use "cupsaddsmb" on Samba server which is - a PDC

    Do you use the "naked" root user name? Try to do it +map to guest, if you want to prevent +this.

    Upgrading to CUPS Drivers from Adobe Drivers

    +This information came from a mailinglist posting regarding problems experienced when +upgrading from Adobe drivers to CUPS drivers on Microsoft Windows NT/200x/XP Clients. +

    First delete all old Adobe-using printers. Then +delete all old Adobe drivers. (On Windows 200x/XP, right-click in +the background of Printers folder, select Server Properties..., select +tab Drivers and delete here).

    Can't Use “cupsaddsmb” on Samba Server Which Is a PDC

    Do you use the “naked” root user name? Try to do it this way: cupsaddsmb -U DOMAINNAME\\root -v printername> (note the two backslashes: the first one is -required to "escape" the second one).

    Deleted Win2K printer driver is still shown

    Deleting a printer on the client won't delete the +required to “escape” the second one).

    Deleted Windows 200x Printer Driver Is Still Shown

    Deleting a printer on the client will not delete the driver too (to verify, right-click on the white background of the -"Printers" folder, select "Server Properties" and click on the -"Drivers" tab). These same old drivers will be re-used when you try to +Printers folder, select Server Properties and click on the +Drivers tab). These same old drivers will be re-used when you try to install a printer with the same name. If you want to update to a new driver, delete the old ones first. Deletion is only possible if no -other printer uses the same driver.

    Win2K/XP "Local Security - Policies"

    Local Security Policies may not -allow the installation of unsigned drivers. "Local Security Policies" +other printer uses the same driver.

    Windows 200x/XP "Local Security Policies"

    Local Security Policies may not +allow the installation of unsigned drivers. “Local Security Policies” may not allow the installation of printer drivers at -all.

    WinXP clients: "Administrator can not install - printers for all local users"

    Windows XP handles SMB printers on a "per-user" basis. +all.

    Administrator Cannot Install Printers for All Local Users

    Windows XP handles SMB printers on a “per-user” basis. This means every user needs to install the printer himself. To have a printer available for everybody, you might want to use the built-in IPP client capabilities of WinXP. Add a printer with the print path of -http://cupsserver:631/printers/printername. -Still looking into this one: maybe a "logon script" could +http://cupsserver:631/printers/printername. +We're still looking into this one. Maybe a logon script could automatically install printers for all -users.

    "Print Change Notify" functions on - NT-clients

    For "print change notify" functions on NT++ clients, -these need to run the "Server" service first (re-named to -File & Print Sharing for MS Networks in -XP).

    WinXP-SP1

    WinXP-SP1 introduced a Point and Print -Restriction Policy (this restriction doesn't apply to -"Administrator" or "Power User" groups of users). In Group Policy -Object Editor: go to User Configuration, - Administrative Templates, Control Panel, -Printers. The policy is automatically set to -Enabled and the Users can only Point -and Print to machines in their Forest . You probably need -to change it to Disabled or Users can -only Point and Print to these servers in order to make -driver downloads from Samba possible.

    Print options for all users can't be set on Win2K/XP

    How are you doing it? I bet the wrong way (it is not -very easy to find out, though). There are 3 different ways to bring +users.

    Print Change Notify Functions on NT-clients

    For print change, notify functions on NT++ clients. +These need to run the Server service first (renamed to +File & Print Sharing for MS Networks in +XP).

    WinXP-SP1

    WinXP-SP1 introduced a Point and Print Restriction Policy (this restriction does not apply to +“Administrator” or “Power User” groups of users). In Group Policy +Object Editor, go to User Configuration -> Administrative Templates -> + Control Panel -> Printers. The policy is automatically set to +Enabled and the Users can only Point +and Print to machines in their Forest . You probably need +to change it to Disabled or Users can +only Point and Print to these servers to make +driver downloads from Samba possible. +

    Print Options for All Users Can't Be Set on Windows 200x/XP

    How are you doing it? I bet the wrong way (it is not +easy to find out, though). There are three different ways to bring you to a dialog that seems to set everything. All -three dialogs look the same. Only one of them -does what you intend. You need to be -Administrator or Print Administrator to do this for all users. Here +three dialogs look the same, yet only one of them +does what you intend. You need to be +Administrator or Print Administrator to do this for all users. Here is how I do in on XP: -

    1. The first "wrong" way: +

      1. The first wrong way: -

        1. Open the Printers +

          1. Open the Printers folder.

          2. Right-click on the printer -(remoteprinter on cupshost) and -select in context menu Printing -Preferences...

          3. Look at this dialog closely and remember what it looks +(remoteprinter on cupshost) and +select in context menu Printing +Preferences...

          4. Look at this dialog closely and remember what it looks like.

          -

        2. The second "wrong" way: +

        3. The second wrong way: -

          1. Open the Printers -folder.

          2. Right-click on the printer (remoteprinter on -cupshost) and select in the context menu -Properties

          3. Click on the General -tab

          4. Click on the button Printing -Preferences...

          5. A new dialog opens. Keep this dialog open and go back +

            1. Open the Printers +folder.

            2. Right-click on the printer (remoteprinter on +cupshost) and select the context menu +Properties.

            3. Click on the General +tab.

            4. Click on the button Printing +Preferences...

            5. A new dialog opens. Keep this dialog open and go back to the parent dialog.

            -

          6. The third, the "correct" way: (should you do -this from the beginning, just carry out steps 1. and 2. from second -"way" above) +

          7. The third, and the correct way: -

            1. Click on the Advanced -tab. (Hmmm... if everything is "Grayed Out", then you are not logged -in as a user with enough privileges).

            2. Click on the Printing -Defaults... button.

            3. On any of the two new tabs, click on the -Advanced... -button.

            4. A new dialog opens. Compare this one to the other, -identical looking one from "B.5" or A.3".

            +

            1. Open the Printers +folder.

            2. Click on the Advanced +tab. (If everything is “grayed out,” then you are not logged +in as a user with enough privileges).

            3. Click on the Printing +Defaults... button.

            4. On any of the two new tabs, click on the +Advanced... +button.

            5. A new dialog opens. Compare this one to the other +identical looking one from “B.5” or A.3".

          -Do you see any difference? I don't either... However, only the last -one, which you arrived at with steps "C.1.-6." will save any settings +Do you see any difference? I don't either. However, only the last +one, which you arrived at with steps “C.1.-6.”, will save any settings permanently and be the defaults for new users. If you want all clients to get the same defaults, you need to conduct these steps as -Administrator (printer admin in +Administrator (printer admin in smb.conf) before a client downloads the driver (the clients can later set their own per-user defaults by following the -procedures A. or B. -above).

        Most common blunders in driver - settings on Windows clients

        Don't use Optimize for -Speed: use Optimize for -Portability instead (Adobe PS Driver) Don't use -Page Independence: No: always -settle with Page Independence: -Yes (Microsoft PS Driver and CUPS PS Driver for -WinNT/2K/XP) If there are problems with fonts: use -Download as Softfont into -printer (Adobe PS Driver). For -TrueType Download Options -choose Outline. Use PostScript -Level 2, if you are having trouble with a non-PS printer, and if -there is a choice.

        cupsaddsmb does not work - with newly installed printer

        Symptom: the last command of -cupsaddsmb doesn't complete successfully: +procedures A or B +above).

        Most Common Blunders in Driver Settings on Windows Clients

        Don't use Optimize for +Speed, but use Optimize for +Portability instead (Adobe PS Driver). Don't use +Page Independence: No: always +settle with Page Independence: +Yes (Microsoft PS Driver and CUPS PS Driver for +Windows NT/200x/XP). If there are problems with fonts, use +Download as Softfont into +printer (Adobe PS Driver). For +TrueType Download Options +choose Outline. Use PostScript +Level 2, if you are having trouble with a non-PS printer and if +there is a choice.

        cupsaddsmb Does Not Work with Newly Installed Printer

        Symptom: The last command of +cupsaddsmb does not complete successfully: cmd = setdriver printername printername result was NT_STATUS_UNSUCCESSFUL then possibly the printer was not yet -"recognized" by Samba. Did it show up in Network -Neighbourhood? Did it show up in rpcclient -hostname -c 'enumprinters'? Restart smbd (or send a +recognized by Samba. Did it show up in Network +Neighborhood? Did it show up i n rpcclient +hostname -c `enumprinters'? Restart smbd (or send a kill -HUP to all processes listed by smbstatus and try -again.

        Permissions on -/var/spool/samba/ get reset after each -reboot

        Have you by accident set the CUPS spool directory to -the same location? (RequestRoot -/var/spool/samba/ in cupsd.conf or +again.

        Permissions on /var/spool/samba/ Get Reset After Each Reboot

        Have you ever by accident set the CUPS spool directory to +the same location? (RequestRoot /var/spool/samba/ in cupsd.conf or the other way round: /var/spool/cups/ is set as -path> in the [printers] -section). These must be different. Set +path> in the [printers] +section). These must be different. Set + RequestRoot /var/spool/cups/ in -cupsd.conf and path = +cupsd.conf and path = /var/spool/samba in the [printers] section of smb.conf. Otherwise cupsd will -sanitize permissions to its spool directory with each restart, and -printing will not work reliably.

        Printer named "lp" -intermittently swallows jobs and spits out completely different -ones

        It is a very bad idea to name any printer "lp". This +sanitize permissions to its spool directory with each restart and +printing will not work reliably.

        Print Queue Called “lp” Mis-handles Print Jobs

        +In this case a print queue called “lp” intermittently swallows jobs and +spits out completely different ones from what was sent. +

        It is a bad idea to name any printer “lp”. This is the traditional UNIX name for the default printer. CUPS may be set -up to do an automatic creation of "Implicit Classes". This means, to +up to do an automatic creation of Implicit Classes. This means, to group all printers with the same name to a pool of devices, and -loadbalancing the jobs across them in a round-robin fashion. Chances -are high that someone else has an "lp" named printer too. You may +load-balancing the jobs across them in a round-robin fashion. Chances +are high that someone else has a printer named “lp” too. You may receive his jobs and send your own to his device unwittingly. To have tight control over the printer names, set BrowseShortNames -No. It will present any printer as "printername@cupshost" -then, giving you a better control over what may happen in a large -networked environment.

        Location of Adobe PostScript driver files necessary for "cupsaddsmb"

        Use smbclient to connect to any +No. It will present any printer as printername@cupshost +and then gives you better control over what may happen in a large +networked environment.

        Location of Adobe PostScript Driver Files for “cupsaddsmb”

        Use smbclient to connect to any Windows box with a shared PostScript printer: smbclient //windowsbox/print\$ -U guest. You can navigate to the W32X86/2 subdir to mget ADOBE* -and other files or to WIN40/0 to do the same. -- +and other files or to WIN40/0 to do the same. Another option is to download the *.exe packaged -files from the Adobe website.

      An Overview of the CUPS Printing Processes

      Figure 19.19. CUPS Printing Overview

      CUPS Printing Overview
    Prev Up Next
    Chapter 18. Classical Printing Support Home Chapter 20. Stackable VFS modules
    +files from the Adobe Web site.

    Overview of the CUPS Printing Processes

    A complete overview of the CUPS printing processes can be found in .

    Figure 19.19. CUPS printing overview.

    CUPS printing overview.

    [4] http://www.cups.org/cups-help.html
    Prev Up Next
    Chapter 18. Classical Printing Support Home Chapter 20. Stackable VFS modules
    diff --git a/docs/htmldocs/ClientConfig.html b/docs/htmldocs/ClientConfig.html index ab34354e2d..ce1f591cdd 100644 --- a/docs/htmldocs/ClientConfig.html +++ b/docs/htmldocs/ClientConfig.html @@ -1,4 +1,4 @@ -Chapter 9. MS Windows Network Configuration Guide
    Chapter 9. MS Windows Network Configuration Guide
    Prev Part II. Server Configuration Basics Next

    Chapter 9. MS Windows Network Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +Chapter 9. MS Windows Network Configuration Guide

    Chapter 9. MS Windows Network Configuration Guide
    Prev Part II. Server Configuration Basics Next

    Chapter 9. MS Windows Network Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Prev Up Next
    Chapter 8. Stand-Alone Servers Home Part III. Advanced Configuration
    +

    Prev Up Next
    Chapter 8. Stand-alone Servers Home Part III. Advanced Configuration
    diff --git a/docs/htmldocs/DNSDHCP.html b/docs/htmldocs/DNSDHCP.html index 1472c1925b..fa61a0f7f2 100644 --- a/docs/htmldocs/DNSDHCP.html +++ b/docs/htmldocs/DNSDHCP.html @@ -1,4 +1,4 @@ -Chapter 40. DNS and DHCP Configuration Guide
    Chapter 40. DNS and DHCP Configuration Guide
    Prev Part VI. Appendixes Next

    Chapter 40. DNS and DHCP Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +Chapter 40. DNS and DHCP Configuration Guide

    Chapter 40. DNS and DHCP Configuration Guide
    Prev Part VI. Appendixes Next

    Chapter 40. DNS and DHCP Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Prev Up Next
    Chapter 39. Samba Performance Tuning Home Chapter 41. Further Resources
    +

    Prev Up Next
    Chapter 39. Samba Performance Tuning Home Chapter 41. Further Resources
    diff --git a/docs/htmldocs/FastStart.html b/docs/htmldocs/FastStart.html index 64c38702fd..fb1f5bcc79 100644 --- a/docs/htmldocs/FastStart.html +++ b/docs/htmldocs/FastStart.html @@ -1,4 +1,4 @@ -Chapter 3. Fast Start for the Impatient
    Chapter 3. Fast Start for the Impatient
    Prev Part I. General Installation Next

    Chapter 3. Fast Start for the Impatient

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +Chapter 3. Fast Start for the Impatient

    Chapter 3. Fast Start for the Impatient
    Prev Part I. General Installation Next

    Chapter 3. Fast Start for the Impatient

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Prev Up Next
    Chapter 2. How to Install and Test SAMBA Home Part II. Server Configuration Basics
    +

    Prev Up Next
    Chapter 2. How to Install and Test SAMBA Home Part II. Server Configuration Basics
    diff --git a/docs/htmldocs/Further-Resources.html b/docs/htmldocs/Further-Resources.html index 8464c480c2..39c13a5ad5 100644 --- a/docs/htmldocs/Further-Resources.html +++ b/docs/htmldocs/Further-Resources.html @@ -1,100 +1,100 @@ -Chapter 41. Further Resources
    Chapter 41. Further Resources
    Prev Part VI. Appendixes Next

    Chapter 41. Further Resources

    Jelmer R. Vernooij

    The Samba Team

    May 1, 2003

    Table of Contents

    Websites
    Related updates from Microsoft

    Websites

    Related updates from Microsoft

    • + + Enhanced Encryption for Windows 95 Password Cache + +

    • + + Windows '95 File Sharing Updates + +

    • + + Windows for Workgroups Sharing Updates + +

    Prev Up Next
    Chapter 40. DNS and DHCP Configuration Guide Home Index
    diff --git a/docs/htmldocs/InterdomainTrusts.html b/docs/htmldocs/InterdomainTrusts.html index 8422c52073..358321dac2 100644 --- a/docs/htmldocs/InterdomainTrusts.html +++ b/docs/htmldocs/InterdomainTrusts.html @@ -1,138 +1,136 @@ -Chapter 16. Interdomain Trust Relationships
    Chapter 16. Interdomain Trust Relationships
    Prev Part III. Advanced Configuration Next

    Chapter 16. Interdomain Trust Relationships

    John H. Terpstra

    Samba Team

    Rafal Szczesniak

    Samba Team

    Jelmer R. Vernooij

    drawing
    The Samba Team

    Stephen Langasek

    April 3, 2003

    Table of Contents

    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-style Domain Trusts with Windows 2000
    Common Errors

    -Samba-3 supports NT4 style domain trust relationships. This is feature that many sites -will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to -adopt Active Directory or an LDAP based authentication back end. This section explains +Chapter 16. Interdomain Trust Relationships

    Chapter 16. Interdomain Trust Relationships
    Prev Part III. Advanced Configuration Next

    Chapter 16. Interdomain Trust Relationships

    John H. Terpstra

    Samba Team

    Rafal Szczesniak

    Samba Team

    Jelmer R. Vernooij

    drawing
    The Samba Team

    Stephen Langasek

    April 3, 2003

    Table of Contents

    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-Style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-Style Domain Trusts with Windows 2000
    Common Errors

    + +Samba-3 supports NT4-style domain trust relationships. This is a feature that many sites +will want to use if they migrate to Samba-3 from an NT4-style domain and do not want to +adopt Active Directory or an LDAP-based authentication backend. This section explains some background information regarding trust relationships and how to create them. It is now -possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba3-to-Samba3 +possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba-to-Samba trusts. -

    Features and Benefits

    -Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4 style -trust relationships. This imparts to Samba similar scalability as is possible with -MS Windows NT4. +

    Features and Benefits

    +Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4-style +trust relationships. This imparts to Samba similar scalability as with MS Windows NT4.

    Given that Samba-3 has the capability to function with a scalable backend authentication -database such as LDAP, and given it's ability to run in Primary as well as Backup Domain control +database such as LDAP, and given its ability to run in Primary as well as Backup Domain Control modes, the administrator would be well advised to consider alternatives to the use of Interdomain trusts simply because by the very nature of how this works it is fragile. That was, after all, a key reason for the development and adoption of Microsoft Active Directory. -

    Trust Relationship Background

    -MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure. -The limitations of this architecture as it affects the scalability of MS Windows networking -in large organisations is well known. Additionally, the flat namespace that results from +

    Trust Relationship Background

    +MS Windows NT3/4 type security domains employ a non-hierarchical security structure. +The limitations of this architecture as it effects the scalability of MS Windows networking +in large organizations is well known. Additionally, the flat namespace that results from this design significantly impacts the delegation of administrative responsibilities in -large and diverse organisations. +large and diverse organizations.

    Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means -of circumventing the limitations of the older technologies. Not every organisation is ready -or willing to embrace ADS. For small companies the older NT4 style domain security paradigm -is quite adequate, there thus remains an entrenched user base for whom there is no direct +of circumventing the limitations of the older technologies. Not every organization is ready +or willing to embrace ADS. For small companies the older NT4-style domain security paradigm +is quite adequate, there remains an entrenched user base for whom there is no direct desire to go through a disruptive change to adopt ADS.

    -Microsoft introduced with MS Windows NT the ability to allow differing security domains -to affect a mechanism so that users from one domain may be given access rights and privileges +With MS Windows NT, Microsoft introduced the ability to allow differing security domains +to effect a mechanism so users from one domain may be given access rights and privileges in another domain. The language that describes this capability is couched in terms of Trusts. Specifically, one domain will trust the users from another domain. The domain from which users are available to another security domain is said to be a trusted domain. The domain in which those users have assigned rights and privileges is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only, thus if users in both domains are to have privileges and rights in each others' domain, then it is -necessary to establish two (2) relationships, one in each direction. +necessary to establish two relationships, one in each direction.

    -In an NT4 style MS security domain, all trusts are non-transitive. This means that if there -are three (3) domains (let's call them RED, WHITE, and BLUE) where RED and WHITE have a trust +In an NT4-style MS security domain, all trusts are non-transitive. This means that if there +are three domains (let's call them RED, WHITE and BLUE) where RED and WHITE have a trust relationship, and WHITE and BLUE have a trust relationship, then it holds that there is no -implied trust between the RED and BLUE domains. ie: Relationships are explicit and not +implied trust between the RED and BLUE domains. Relationships are explicit and not transitive.

    - New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE -domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is -an inherent feature of ADS domains. Samba-3 implements MS Windows NT4 -style Interdomain trusts and interoperates with MS Windows 200x ADS -security domains in similar manner to MS Windows NT4 style domains. -

    Native MS Windows NT4 Trusts Configuration

    -There are two steps to creating an interdomain trust relationship. To effect a two-way trust -relationship it is necessary for each domain administrator to create a trust account for the +domains above, with Windows 2000 and ADS the RED and BLUE domains can trust each other. This is +an inherent feature of ADS domains. Samba-3 implements MS Windows NT4-style Interdomain trusts +and interoperates with MS Windows 200x ADS security domains in similar manner to MS Windows NT4-style domains. +

    Native MS Windows NT4 Trusts Configuration

    +There are two steps to creating an interdomain trust relationship. To effect a two-way trust +relationship, it is necessary for each domain administrator to create a trust account for the other domain to use in verifying security credentials. - - -

    Creating an NT4 Domain Trust

    + +

    Creating an NT4 Domain Trust

    For MS Windows NT4, all domain trust relationships are configured using the Domain User Manager. This is done from the Domain User Manager Policies entry on the menu bar. From the Policy menu, select -Trust Relationships. Next to the lower box labelled +Trust Relationships. Next to the lower box labeled Permitted to Trust this Domain are two buttons, Add and Remove. The Add button will open a panel in which to enter the name of the remote domain that will be able to assign access rights to users in -your domain. You will also need to enter a password for this trust relationship, which the +your domain. You will also need to enter a password for this trust relationship, which the trusting domain will use when authenticating users from the trusted domain. The password needs to be typed twice (for standard confirmation). -

    Completing an NT4 Domain Trust

    - +

    Completing an NT4 Domain Trust

    + A trust relationship will work only when the other (trusting) domain makes the appropriate connections -with the trusted domain. To consummate the trust relationship the administrator will launch the -Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the -Add button that is next to the box that is labelled -Trusted Domains. A panel will open in which must be entered the name of the remote -domain as well as the password assigned to that trust. -

    Inter-Domain Trust Facilities

    +with the trusted domain. To consummate the trust relationship, the administrator will launch the +Domain User Manager from the menu select Policies, then select +Trust Relationships, click on the Add button +next to the box that is labeled Trusted Domains. A panel will open in which +must be entered the name of the remote domain as well as the password assigned to that trust. +

    Inter-Domain Trust Facilities

    + A two-way trust relationship is created when two one-way trusts are created, one in each direction. Where a one-way trust has been established between two MS Windows NT4 domains (let's call them -DomA and DomB) the following facilities are created: -

    Figure 16.1. Trusts overview

    Trusts overview

    • - DomA (completes the trust connection) Trusts DomB +DomA and DomB), the following facilities are created: +

      Figure 16.1. Trusts overview.

      Trusts overview.

      • + DomA (completes the trust connection) Trusts DomB.

      • - DomA is the Trusting domain + DomA is the Trusting domain.

      • - DomB is the Trusted domain (originates the trust account) + DomB is the Trusted domain (originates the trust account).

      • - Users in DomB can access resources in DomA + Users in DomB can access resources in DomA.

      • - Users in DomA can NOT access resources in DomB + Users in DomA cannot access resources in DomB.

      • - Global groups from DomB CAN be used in DomA + Global groups from DomB can be used in DomA.

      • - Global groups from DomA can NOT be used in DomB + Global groups from DomA cannot be used in DomB.

      • - DomB DOES appear in the logon dialog box on client workstations in DomA + DomB does appear in the logon dialog box on client workstations in DomA.

      • - DomA does NOT appear in the logon dialog box on client workstations in DomB + DomA does not appear in the logon dialog box on client workstations in DomB.

      • - Users / Groups in a trusting domain can NOT be granted rights, permissions or access + Users/Groups in a trusting domain cannot be granted rights, permissions or access to a trusted domain.

      • - The trusting domain CAN access and use accounts (Users / Global Groups) in the + The trusting domain can access and use accounts (Users/Global Groups) in the trusted domain.

      • - Administrators of the trusted domain CAN be granted admininstrative rights in the + Administrators of the trusted domain can be granted admininstrative rights in the trusting domain.

      • - Users in a trusted domain CAN be given rights and privileges in the trusting + Users in a trusted domain can be given rights and privileges in the trusting domain.

      • - Trusted domain Global Groups CAN be given rights and permissions in the trusting + Trusted domain Global Groups can be given rights and permissions in the trusting domain.

      • - Global Groups from the trusted domain CAN be made members in Local Groups on - MS Windows domain member machines. -

    Configuring Samba NT-style Domain Trusts

    + Global Groups from the trusted domain can be made members in Local Groups on + MS Windows Domain Member machines. +

    Configuring Samba NT-Style Domain Trusts

    This description is meant to be a fairly short introduction about how to set up a Samba server so -that it could participate in interdomain trust relationships. Trust relationship support in Samba -is in its early stage, so lot of things don't work yet. +that it can participate in interdomain trust relationships. Trust relationship support in Samba +is at an early stage, so do not be surprised if something does not function as it should.

    Each of the procedures described below assumes the peer domain in the trust relationship is -controlled by a Windows NT4 server. However, the remote end could just as well be another +controlled by a Windows NT4 server. However, the remote end could just as well be another Samba-3 domain. It can be clearly seen, after reading this document, that combining Samba-specific parts of what's written below leads to trust between domains in a purely Samba environment.

    Samba as the Trusted Domain

    -In order to set the Samba PDC to be the trusted party of the relationship you first need +In order to set the Samba PDC to be the trusted party of the relationship, you first need to create a special account for the domain that will be the trusting party. To do that, -you can use the 'smbpasswd' utility. Creating the trusted domain account is very +you can use the smbpasswd utility. Creating the trusted domain account is similar to creating a trusted machine account. Suppose, your domain is called SAMBA, and the remote domain is called RUMBA. The first step -will be to issue this command from your favourite shell: +will be to issue this command from your favorite shell: 

     root#  smbpasswd -a -i rumba
@@ -142,82 +140,83 @@ Added user rumba$

    where -a means to add a new account into the -passdb database and -i means: ''create this -account with the InterDomain trust flag'' +passdb database and -i means: “create this +account with the InterDomain trust flag”.

    -The account name will be 'rumba$' (the name of the remote domain) +The account name will be “rumba$” (the name of the remote domain).

    -After issuing this command you'll be asked to enter the password for +After issuing this command, you will be asked to enter the password for the account. You can use any password you want, but be aware that Windows NT will -not change this password until 7 days following account creation. +not change this password until seven days following account creation. After the command returns successfully, you can look at the entry for the new account (in the standard way as appropriate for your configuration) and see that account's name is -really RUMBA$ and it has the 'I' flag set in the flags field. Now you're ready to confirm +really RUMBA$ and it has the “I” flag set in the flags field. Now you are ready to confirm the trust by establishing it from Windows NT Server. -

    +

    + Open User Manager for Domains and from the Policies menu, select Trust Relationships.... -Right beside the Trusted domains list box press the +Beside the Trusted domains list box click the Add... button. You will be prompted for the trusted domain name and the relationship password. Type in SAMBA, as this is -the name of the remote domain, and the password used at the time of account creation. -Press OK and, if everything went without incident, you will see -Trusted domain relationship successfully +the name of the remote domain and the password used at the time of account creation. +Click on OK and, if everything went without incident, you will see +the Trusted domain relationship successfully established message. -

    Samba as the Trusting Domain

    +

    Samba as the Trusting Domain

    This time activities are somewhat reversed. Again, we'll assume that your domain -controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA. +controlled by the Samba PDC is called SAMBA and the NT-controlled domain is called RUMBA.

    The very first step is to add an account for the SAMBA domain on RUMBA's PDC. -

    +

    + Launch the Domain User Manager, then from the menu select Policies, Trust Relationships. Now, next to the Trusted Domains box press the Add -button, and type in the name of the trusted domain (SAMBA) and the password to use in securing +button and type in the name of the trusted domain (SAMBA) and the password to use in securing the relationship.

    The password can be arbitrarily chosen. It is easy to change the password from the Samba server whenever you want. After confirming the password your account is -ready for use. Now it's Samba's turn. +ready for use. Now its Samba's turn.

    -Using your favourite shell while being logged in as root, issue this command: +Using your favorite shell while being logged in as root, issue this command:

    root# net rpc trustdom establish rumba

    You will be prompted for the password you just typed on your Windows NT4 Server box. -Do not worry if you see an error message that mentions a return code of -NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the -password you gave is correct and the NT4 Server says the account is -ready for interdomain connection and not for ordinary -connection. After that, be patient; it can take a while (especially -in large networks), but eventually you should see the Success message. -Congratulations! Your trust relationship has just been established. +An error message `NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT' +that may be reported periodically is of no concern and may safely be ignored. +It means the password you gave is correct and the NT4 Server says the account is ready for +interdomain connection and not for ordinary connection. After that, be patient; +it can take a while (especially in large networks), but eventually you should see +the Success message. Congratulations! Your trust +relationship has just been established.

    Note

    -Note that you have to run this command as root because you must have write access to +You have to run this command as root because you must have write access to the secrets.tdb file. -

    NT4-style Domain Trusts with Windows 2000

    +

    NT4-Style Domain Trusts with Windows 2000

    Although Domain User Manager is not present in Windows 2000, it is also possible to establish an NT4-style trust relationship with a Windows 2000 domain -controller running in mixed mode as the trusting server. It should also be possible for +controller running in mixed mode as the trusting server. It should also be possible for Samba to trust a Windows 2000 server, however, more testing is still needed in this area.

    -After creating the interdomain trust account on the -Samba server as described above, open Active Directory Domains and +After as described above, open Active Directory Domains and Trusts on the AD controller of the domain whose resources you wish Samba users -to have access to. Remember that since NT4-style trusts are not transitive, if you want +to have access to. Remember that since NT4-style trusts are not transitive, if you want your users to have access to multiple mixed-mode domains in your AD forest, you will need to -repeat this process for each of those domains. With Active Directory Domains +repeat this process for each of those domains. With Active Directory Domains and Trusts open, right-click on the name of the Active Directory domain that -will trust our Samba domain and choose Properties, then click on -the Trusts tab. In the upper part of the panel, you will see a list box -labelled Domains trusted by this domain:, and an -Add... button next to it. Press this button, and just as with NT4, you -will be prompted for the trusted domain name and the relationship password. Press OK, and +will trust our Samba domain and choose Properties, then click on +the Trusts tab. In the upper part of the panel, you will see a list box +labeled Domains trusted by this domain:, and an +Add... button next to it. Press this button and just as with NT4, you +will be prompted for the trusted domain name and the relationship password. Press OK and after a moment, Active Directory will respond with The trusted domain has been added and the trust has been verified. Your Samba users can now be granted acess to resources in the AD domain. -

    Common Errors

    -Interdomain trust relationships should NOT be attempted on networks that are unstable +

    Common Errors

    +Interdomain trust relationships should not be attempted on networks that are unstable or that suffer regular outages. Network stability and integrity are key concerns with distributed trusted domains. -

    Prev Up Next
    Chapter 15. Securing Samba Home Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    +

    Prev Up Next
    Chapter 15. Securing Samba Home Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    diff --git a/docs/htmldocs/IntroSMB.html b/docs/htmldocs/IntroSMB.html index 51a22f14fa..5e3796fdeb 100644 --- a/docs/htmldocs/IntroSMB.html +++ b/docs/htmldocs/IntroSMB.html @@ -1,5 +1,5 @@ -Chapter 1. Introduction to Samba
    Chapter 1. Introduction to Samba
    Prev Part I. General Installation Next

    Chapter 1. Introduction to Samba

    David Lechnyr

    Unofficial HOWTO

    April 14, 2003

    Table of Contents

    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous

    “ -"If you understand what you're doing, you're not learning anything." +Chapter 1. Introduction to Samba

    Chapter 1. Introduction to Samba
    Prev Part I. General Installation Next

    Chapter 1. Introduction to Samba

    David Lechnyr

    Unofficial HOWTO

    April 14, 2003

    Table of Contents

    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous

    “ +"If you understand what you're doing, you're not learning anything." -- Anonymous ”

    Samba is a file and print server for Windows-based clients using TCP/IP as the underlying @@ -7,7 +7,7 @@ transport protocol. In fact, it can support any SMB/CIFS-enabled client. One of strengths is that you can use it to blend your mix of Windows and Linux machines together without requiring a separate Windows NT/2000/2003 Server. Samba is actively being developed by a global team of about 30 active programmers and was originally developed by Andrew Tridgell. -

    Background

    +

    Background

    Once long ago, there was a buzzword referred to as DCE/RPC. This stood for Distributed Computing Environment/Remote Procedure Calls and conceptually was a good idea. It was originally developed by Apollo/HP as NCA 1.0 (Network Computing Architecture) and only @@ -15,12 +15,12 @@ ran over UDP. When there was a need to run it over TCP so that it would be compa with DECnet 3.0, it was redesigned, submitted to The Open Group, and officially became known as DCE/RPC. Microsoft came along and decided, rather than pay $20 per seat to license this technology, to reimplement DCE/RPC themselves as MSRPC. From this, the -concept continued in the form of SMB (Server Message Block, or the "what") using the -NetBIOS (Network Basic Input/Output System, or the "how") compatibility layer. You can +concept continued in the form of SMB (Server Message Block, or the "what") using the +NetBIOS (Network Basic Input/Output System, or the "how") compatibility layer. You can run SMB (i.e., transport) over several different protocols; many different implementations arose as a result, including NBIPX (NetBIOS over IPX, NwLnkNb, or NWNBLink) and NBT (NetBIOS over TCP/IP, or NetBT). As the years passed, NBT became the most common form -of implementation until the advance of "Direct-Hosted TCP" -- the Microsoft marketing +of implementation until the advance of "Direct-Hosted TCP" -- the Microsoft marketing term for eliminating NetBIOS entirely and running SMB by itself across TCP port 445 only. As of yet, direct-hosted TCP has yet to catch on.

    @@ -33,23 +33,23 @@ been dutifully waded through during the information-gathering stages of this pro are *still* many missing pieces... While often tedious, at least the way has been generously littered with occurrences of clapping hand to forehead and muttering 'crikey, what are they thinking? -

    Terminology

    • - SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol. +

    Terminology

    • + SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol.

    • - CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently - decided that SMB needed the word "Internet" in it, so they changed it to CIFS. + CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently + decided that SMB needed the word "Internet" in it, so they changed it to CIFS.

    • Direct-Hosted: A method of providing file/printer sharing services over port 445/tcp only using DNS for name resolution instead of WINS.

    • - IPC: Acronym for "Inter-Process Communication". A method to communicate specific + IPC: Acronym for "Inter-Process Communication". A method to communicate specific information between programs.

    • Marshalling: - A method of serializing (i.e., sequential ordering of) variable data suitable for transmission via a network connection or storing in a file. The source data can be re-created using a similar process called unmarshalling.

    • - NetBIOS: Acronym for "Network Basic Input/Output System". This is not a protocol; + NetBIOS: Acronym for "Network Basic Input/Output System". This is not a protocol; it is a method of communication across an existing protocol. This is a standard which was originally developed for IBM by Sytek in 1983. To exaggerate the analogy a bit, it can help to think of this in comparison your computer's BIOS -- it controls the @@ -60,15 +60,15 @@ thinking? brilliant people tend to interchange NetBIOS with terms like NetBEUI without a second thought; this will cause no end (and no doubt) of confusion.

    • - NetBEUI: Acronym for the "NetBIOS Extended User Interface". Unlike NetBIOS, NetBEUI + NetBEUI: Acronym for the "NetBIOS Extended User Interface". Unlike NetBIOS, NetBEUI is a protocol, not a standard. It is also not routable, so traffic on one side of a router will be unable to communicate with the other side. Understanding NetBEUI is not essential to deciphering SMB; however it helps to point out that it is not the same as NetBIOS and to improve your score in trivia at parties. NetBEUI was originally - referred to by Microsoft as "NBF", or "The Windows NT NetBEUI Frame protocol driver". + referred to by Microsoft as "NBF", or "The Windows NT NetBEUI Frame protocol driver". It is not often heard from these days.

    • - NBT: Acronym for "NetBIOS over TCP"; also known as "NetBT". Allows the continued use + NBT: Acronym for "NetBIOS over TCP"; also known as "NetBT". Allows the continued use of NetBIOS traffic proxied over TCP/IP. As a result, NetBIOS names are made to IP addresses and NetBIOS name types are conceptually equivalent to TCP/IP ports. This is how file and printer sharing are accomplished in Windows 95/98/ME. They @@ -82,8 +82,8 @@ thinking?

    • W3K: Acronym for Windows 2003 Server

    If you plan on getting help, make sure to subscribe to the Samba Mailing List (available at -http://www.samba.org). -

    Related Projects

    +http://www.samba.org). +

    Related Projects

    There are currently two network filesystem client projects for Linux that are directly related to Samba: SMBFS and CIFS VFS. These are both available in the Linux kernel itself.

    • @@ -103,23 +103,23 @@ Again, it's important to note that these are implementations for client filesyst nothing to do with acting as a file and print server for SMB/CIFS clients.

      There are other Open Source CIFS client implementations, such as the -jCIFS project +jCIFS project which provides an SMB client toolkit written in Java. -

    SMB Methodology

    +

    SMB Methodology

    Traditionally, SMB uses UDP port 137 (NetBIOS name service, or netbios-ns), UDP port 138 (NetBIOS datagram service, or netbios-dgm), and TCP port 139 (NetBIOS session service, or netbios-ssn). Anyone looking at their network with a good packet sniffer will be amazed at the amount of traffic generated by just opening up a single file. In general, SMB sessions are established in the following order:

    • - "TCP Connection" - establish 3-way handshake (connection) to port 139/tcp + "TCP Connection" - establish 3-way handshake (connection) to port 139/tcp or 445/tcp.

    • - "NetBIOS Session Request" - using the following "Calling Names": The local + "NetBIOS Session Request" - using the following "Calling Names": The local machine's NetBIOS name plus the 16th character 0x00; The server's NetBIOS name plus the 16th character 0x20

    • - "SMB Negotiate Protocol" - determine the protocol dialect to use, which will + "SMB Negotiate Protocol" - determine the protocol dialect to use, which will be one of the following: PC Network Program 1.0 (Core) - share level security mode only; Microsoft Networks 1.03 (Core Plus) - share level security mode only; Lanman1.0 (LAN Manager 1.0) - uses Challenge/Response @@ -135,9 +135,9 @@ up a single file. In general, SMB sessions are established in the following orde to a service type (e.g., IPC$ named pipe)

    A good way to examine this process in depth is to try out -SecurityFriday's SWB program. +SecurityFriday's SWB program. It allows you to walk through the establishment of a SMB/CIFS session step by step. -

    Epilogue

    “ +

    Epilogue

    “ What's fundamentally wrong is that nobody ever had any taste when they did it. Microsoft has been very much into making the user interface look good, but internally it's just a complete mess. And even people who program for Microsoft @@ -161,14 +161,14 @@ halts in the middle of something that shouldn't be strange. Normally it works fine and then once in a blue moon for some completely unknown reason, it's dead, and nobody knows why. Not Microsoft, not the experienced user and certainly not the completely clueless user who probably sits there shivering thinking -"What did I do wrong?" when they didn't do anything wrong at all. +"What did I do wrong?" when they didn't do anything wrong at all. ”

    “ -That's what's really irritating to me." +That's what's really irritating to me." ”

    -- -Linus Torvalds, from an interview with BOOT Magazine, Sept 1998 -

    Miscellaneous

    +Linus Torvalds, from an interview with BOOT Magazine, Sept 1998 +

    Miscellaneous

    This chapter is Copyright 2003 David Lechnyr (david at lechnyr dot com). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation. A copy of the license is available at http://www.gnu.org/licenses/fdl.txt. -

    Prev Up Next
    Part I. General Installation Home Chapter 2. How to Install and Test SAMBA
    +

    Prev Up Next
    Part I. General Installation Home Chapter 2. How to Install and Test SAMBA
    diff --git a/docs/htmldocs/NT4Migration.html b/docs/htmldocs/NT4Migration.html index b561492644..878aa5ec22 100644 --- a/docs/htmldocs/NT4Migration.html +++ b/docs/htmldocs/NT4Migration.html @@ -1,76 +1,77 @@ -Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    Prev Part IV. Migration and Updating Next

    Chapter 31. Migration from NT4 PDC to Samba-3 PDC

    John H. Terpstra

    Samba Team

    April 3, 2003

    Table of Contents

    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices

    -This is a rough guide to assist those wishing to migrate from NT4 domain control to -Samba-3 based domain control. -

    Planning and Getting Started

    +Chapter 31. Migration from NT4 PDC to Samba-3 PDC

    Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    Prev Part IV. Migration and Updating Next

    Chapter 31. Migration from NT4 PDC to Samba-3 PDC

    John H. Terpstra

    Samba Team

    April 3, 2003

    Table of Contents

    Planning and Getting Started
    Objectives
    Steps in Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices

    +This is a rough guide to assist those wishing to migrate from NT4 Domain Control to +Samba-3-based Domain Control. +

    Planning and Getting Started

    In the IT world there is often a saying that all problems are encountered because of poor planning. The corollary to this saying is that not all problems can be anticipated -and planned for. Then again, good planning will anticipate most show stopper type situations. +and planned for. Then again, good planning will anticipate most show-stopper-type situations.

    -Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control +Those wishing to migrate from MS Windows NT4 Domain Control to a Samba-3 Domain Control environment would do well to develop a detailed migration plan. So here are a few pointers to help migration get under way. -

    Objectives

    -The key objective for most organisations will be to make the migration from MS Windows NT4 -to Samba-3 domain control as painless as possible. One of the challenges you may experience +

    Objectives

    +The key objective for most organizations will be to make the migration from MS Windows NT4 +to Samba-3 Domain Control as painless as possible. One of the challenges you may experience in your migration process may well be one of convincing management that the new environment should remain in place. Many who have introduced open source technologies have experienced -pressure to return to a Microsoft based platform solution at the first sign of trouble. +pressure to return to a Microsoft-based platform solution at the first sign of trouble.

    -Before attempting a migration to a Samba-3 controlled network make every possible effort to -gain all-round commitment to the change. Know precisely why the change -is important for the organisation. Possible motivations to make a change include: -

    • Improve network manageability

    • Obtain better user level functionality

    • Reduce network operating costs

    • Reduce exposure caused by Microsoft withdrawal of NT4 support

    • Avoid MS License 6 implications

    • Reduce organisation's dependency on Microsoft

    -Make sure that everyone knows that Samba-3 is NOT MS Windows NT4. Samba-3 offers -an alternative solution that is both different from MS Windows NT4 and that offers +Before attempting a migration to a Samba-3 controlled network, make every possible effort to +gain all-round commitment to the change. Know precisely why the change +is important for the organization. Possible motivations to make a change include: +

    • Improve network manageability.

    • Obtain better user level functionality.

    • Reduce network operating costs.

    • Reduce exposure caused by Microsoft withdrawal of NT4 support.

    • Avoid MS License 6 implications.

    • Reduce organization's dependency on Microsoft.

    +Make sure everyone knows that Samba-3 is not MS Windows NT4. Samba-3 offers +an alternative solution that is both different from MS Windows NT4 and offers advantages compared with it. Gain recognition that Samba-3 lacks many of the features that Microsoft has promoted as core values in migration from MS Windows NT4 to MS Windows 2000 and beyond (with or without Active Directory services).

    -What are the features that Samba-3 can NOT provide? -

    • Active Directory Server

    • Group Policy Objects (in Active Directory)

    • Machine Policy objects

    • Logon Scripts in Active Directory

    • Software Application and Access Controls in Active Directory

    -The features that Samba-3 DOES provide and that may be of compelling interest to your site -includes: -

    • Lower Cost of Ownership

    • Global availability of support with no strings attached

    • Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system)

    • Creation of on-the-fly logon scripts

    • Creation of on-the-fly Policy Files

    • Greater Stability, Reliability, Performance and Availability

    • Manageability via an ssh connection

    • Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam)

    • Ability to implement a full single-sign-on architecture

    • Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand

    -Before migrating a network from MS Windows NT4 to Samba-3 consider all necessary factors. Users -should be educated about changes they may experience so that the change will be a welcome one +What are the features that Samba-3 cannot provide? +

    • Active Directory Server.

    • Group Policy Objects (in Active Directory).

    • Machine Policy Objects.

    • Logon Scripts in Active Directory.

    • Software Application and Access Controls in Active Directory.

    +The features that Samba-3 does provide and that may be of compelling interest to your site +include: +

    • Lower cost of ownership.

    • Global availability of support with no strings attached.

    • Dynamic SMB Servers (can run more than one SMB/CIFS server per UNIX/Linux system).

    • Creation of on-the-fly logon scripts.

    • Creation of on-the-fly Policy Files.

    • Greater stability, reliability, performance and availability.

    • Manageability via an ssh connection.

    • Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam).

    • Ability to implement a full single-sign-on architecture.

    • Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand.

    +Before migrating a network from MS Windows NT4 to Samba-3, consider all necessary factors. Users +should be educated about changes they may experience so the change will be a welcome one and not become an obstacle to the work they need to do. The following are factors that will help ensure a successful migration: -

    Domain Layout

    -Samba-3 can be configured as a domain controller, a back-up domain controller (probably best called -a secondary controller), a domain member, or as a stand-alone server. The Windows network security +

    Domain Layout

    +Samba-3 can be configured as a Domain Controller, a back-up Domain Controller (probably best called +a secondary controller), a Domain Member, or as a stand-alone Server. The Windows network security domain context should be sized and scoped before implementation. Particular attention needs to be -paid to the location of the primary domain controller (PDC) as well as backup controllers (BDCs). +paid to the location of the primary Domain Controller (PDC) as well as backup controllers (BDCs). One way in which Samba-3 differs from Microsoft technology is that if one chooses to use an LDAP -authentication backend then the same database can be used by several different domains. In a -complex organisation there can be a single LDAP database, which itself can be distributed (ie: Have +authentication backend, then the same database can be used by several different domains. In a +complex organization, there can be a single LDAP database, which itself can be distributed (have a master server and multiple slave servers) that can simultaneously serve multiple domains.

    -From a design perspective, the number of users per server, as well as the number of servers, per +>From a design perspective, the number of users per server as well as the number of servers per domain should be scaled taking into consideration server capacity and network bandwidth.

    A physical network segment may house several domains. Each may span multiple network segments. Where domains span routed network segments, consider and test the performance implications of -the design and layout of a network. A Centrally located domain controller that is designed to +the design and layout of a network. A centrally located Domain Controller that is designed to serve multiple routed network segments may result in severe performance problems. Check the -response time (eg: ping timing) between the remote segment and the PDC. If long (more than 100 ms) -locate a backup controller (BDC) on the remote segmanet to serve as the local authentication and +response time (ping timing) between the remote segment and the PDC. If +it's long (more than 100 ms), +locate a backup controller (BDC) on the remote segment to serve as the local authentication and access control server. -

    Server Share and Directory Layout

    -There are cardinal rules to effective network design. These can not be broken with impunity. -The most important rule: Simplicity is king in every well controlled network. Every part of -the infrastructure must be managed, the more complex it is, the greater will be the demand +

    Server Share and Directory Layout

    +There are cardinal rules to effective network design that cannot be broken with impunity. +The most important rule: Simplicity is king in every well-controlled network. Every part of +the infrastructure must be managed; the more complex it is, the greater will be the demand of keeping systems secure and functional.

    -Keep in mind the nature of how data must be share. Physical disk space layout should be considered +Keep in mind the nature of how data must be shared. Physical disk space layout should be considered carefully. Some data must be backed up. The simpler the disk layout the easier it will be to -keep track of backed needs. Identify what back media will be meet needs, consider backup to tape -, CD-ROM or (DVD-ROM), or other off-line storage medium. Plan and implement for minimum -maintenance. Leave nothing to chance in your design, above all, do not leave backups to chance: -Backup and test, validate every backup, create a disaster recovery plan and prove that it works. +keep track of backup needs. Identify what backup media will meet your needs; consider backup to tape, +CD-ROM or (DVD-ROM), or other offline storage medium. Plan and implement for minimum +maintenance. Leave nothing to chance in your design; above all, do not leave backups to chance: +Backup, test, and validate every backup, create a disaster recovery plan and prove that it works.

    Users should be grouped according to data access control needs. File and directory access -is best controlled via group permissions and the use of the "sticky bit" on group controlled -directories may substantially avoid file access complaints from samba share users. +is best controlled via group permissions and the use of the “sticky bit” on group controlled +directories may substantially avoid file access complaints from Samba share users.

    Inexperienced network administrators often attempt elaborate techniques to set access controls on files, directories, shares, as well as in share definitions. @@ -78,101 +79,123 @@ Keep your design and implementation simple and document your design extensively. audit your documentation. Do not create a complex mess that your successor will not understand. Remember, job security through complex design and implementation may cause loss of operations and downtime to users as the new administrator learns to untangle your knots. Keep access -controls simple and effective and make sure that users will never be interrupted by stupid +controls simple and effective and make sure that users will never be interrupted by obtuse complexity. -

    Logon Scripts

    -Logon scripts can help to ensure that all users gain share and printer connections they need. +

    Logon Scripts

    +Logon scripts can help to ensure that all users gain the share and printer connections they need.

    -Logon scripts can be created 'on-the-fly' so that all commands executed are specific to the -rights and priviliges granted to the user. The preferred controls should be affected through -group membership so that group information can be used to custom create a logon script using -the root preexec parameters to the NETLOGON share. +Logon scripts can be created on-the-fly so all commands executed are specific to the +rights and privileges granted to the user. The preferred controls should be affected through +group membership so group information can be used to create a custom logon script using +the root preexec parameters to the NETLOGON share.

    Some sites prefer to use a tool such as kixstart to establish a controlled -user environment. In any case you may wish to do a google search for logon script process controls. -In particular, you may wish to explore the use of the Microsoft knowledgebase article KB189105 that +user environment. In any case, you may wish to do a Google search for logon script process controls. +In particular, you may wish to explore the use of the Microsoft KnowledgeBase article KB189105 that deals with how to add printers without user intervention via the logon script process. -

    Profile Migration/Creation

    +

    Profile Migration/Creation

    User and Group Profiles may be migrated using the tools described in the section titled Desktop Profile Management.

    + Profiles may also be managed using the Samba-3 tool profiles. This tool allows -the MS Windows NT style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file +the MS Windows NT-style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file to be changed to the SID of the Samba-3 domain. -

    User and Group Accounts

    +

    User and Group Accounts

    It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before -attempting to migrate user and group accounts it is STRONGLY advised to create in Samba-3 the -groups that are present on the MS Windows NT4 domain AND to map these to -suitable Unix/Linux groups. By following this simple advice all user and group attributes +attempting to migrate user and group accounts, it is STRONGLY advised to create in Samba-3 the +groups that are present on the MS Windows NT4 domain AND to map them to +suitable UNIX/Linux groups. By following this simple advice, all user and group attributes should migrate painlessly. -

    Steps In Migration Process

    +

    Steps in Migration Process

    The approximate migration process is described below.

    • -You will have an NT4 PDC that has the users, groups, policies and profiles to be migrated +You have an NT4 PDC that has the users, groups, policies and profiles to be migrated.

    • -Samba-3 set up as a DC with netlogon share, profile share, etc. Configure the smb.conf file -to fucntion as a BDC. ie: domain master = No. -

    Procedure 31.1. The Account Migration Process

    1. Create a BDC account for the samba server using NT Server Manager

      1. Samba must NOT be running

    2. net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd

    3. net rpc vampire -S NT4PDC -U administrator%passwd

    4. pdbedit -L

      1. Note - did the users migrate?

    5. +Samba-3 set up as a DC with netlogon share, profile share, and so on. Configure the smb.conf file +to fucntion as a BDC, i.e., domain master = No. +

    Procedure 31.1. The Account Migration Process

    1. + + Create a BDC account in the old NT4 domain for the Samba server using NT Server Manager.

      1. Samba must not be running.

    2. + + net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd

    3. net rpc vampire -S NT4PDC -U administrator%passwd

    4. pdbedit -L

      1. Note did the users migrate?

    5. + + Now assign each of the UNIX groups to NT groups: - (Note: It may be useful to copy this text to a script called - initGroups.sh) + (It may be useful to copy this text to a script called initGroups.sh) 

       #!/bin/bash
 #### Keep this as a shell script for future re-use
 			
 # First assign well known domain global groups
-net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmins
-net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
-net groupmap modify ntgroup="Domain Users" unixgroup=users
+net groupmap modify ntgroup="Domain Admins" unixgroup=root   rid=512
+net groupmap modify ntgroup="Domain Users"  unixgroup=users  rid=513
+net groupmap modify ntgroup="Domain Guests" unixgroup=nobody rid=514
 
 # Now for our added domain global groups
-net groupmap add ntgroup="Designers" unixgroup=designers type=d rid=3200
-net groupmap add ntgroup="Engineers" unixgroup=engineers type=d rid=3210
-net groupmap add ntgroup="QA Team"   unixgroup=qateam    type=d rid=3220
+net groupmap add ntgroup="Designers" unixgroup=designers type=d rid=3200
+net groupmap add ntgroup="Engineers" unixgroup=engineers type=d rid=3210
+net groupmap add ntgroup="QA Team"   unixgroup=qateam    type=d rid=3220

      -

    6. net groupmap list

      1. Now check that all groups are recognised

    -Now migrate all the profiles, then migrate all policy files. -

    Migration Options

    -Sites that wish to migrate from MS Windows NT4 Domain Control to a Samba based solution -generally fit into three basic categories. -

    Table 31.1. The 3 Major Site Types

    Number of UsersDescription
    < 50

    Want simple conversion with NO pain

    50 - 250

    Want new features, can manage some in-house complexity

    > 250

    Solution/Implementation MUST scale well, complex needs. Cross departmental decision process. Local expertise in most areas

    Planning for Success

    +

  • net groupmap list

    1. Check that all groups are recognized.

    • +Migrate all the profiles, then migrate all policy files. +

    Migration Options

    +Sites that wish to migrate from MS Windows NT4 Domain Control to a Samba-based solution +generally fit into three basic categories. shows the possibilities. +

    Table 31.1. The Three Major Site Types

    Number of UsersDescription
    < 50

    Want simple conversion with no pain.

    50 - 250

    Want new features, can manage some in-house complexity.

    > 250

    Solution/Implementation must scale well, complex needs. Cross-departmental decision process. Local expertise in most areas.

    Planning for Success

    There are three basic choices for sites that intend to migrate from MS Windows NT4 -to Samba-3. +to Samba-3:

    • - Simple Conversion (total replacement) + Simple conversion (total replacement).

    • - Upgraded Conversion (could be one of integration) + Upgraded conversion (could be one of integration).

    • - Complete Redesign (completely new solution) + Complete redesign (completely new solution).

    -Minimise down-stream problems by: +Minimize down-stream problems by:

    • - Take sufficient time + Taking sufficient time.

    • - Avoid Panic + Avoiding Panic.

    • - Test ALL assumptions + Testing all assumptions.

    • - Test full roll-out program, including workstation deployment -

    Table 31.2. Nature of the Conversion Choices

    SimpleUpgradedRedesign

    Make use of minimal OS specific features

    Translate NT4 features to new host OS features

    Decide:

    Suck all accounts from NT4 into Samba-3

    Copy and improve:

    Authentication Regime (database location and access)

    Make least number of operational changes

    Make progressive improvements

    Desktop Management Methods

    Take least amount of time to migrate

    Minimise user impact

    Better Control of Desktops / Users

    Live versus Isolated Conversion

    Maximise functionality

    Identify Needs for: Manageability, Scalability, Security, Availability

    Integrate Samba-3 then migrate while users are active, then Change of control (ie: swap out)

    Take advantage of lower maintenance opportunity

    Samba-3 Implementation Choices

    Authentication database/back end:

    + Testing the full roll-out program, including workstation deployment. +

    lists the conversion choices given the type of migration +being contemplated. +

    Table 31.2. Nature of the Conversion Choices

    SimpleUpgradedRedesign

    Make use of minimal OS specific features.

    Translate NT4 features to new host OS features.

    Decide:

    Move all accounts from NT4 into Samba-3

    Copy and improve

    Authentication regime (database location and access)

    Make least number of operational changes

    Make progressive improvements

    Desktop management methods

    Take least amount of time to migrate

    Minimize user impact

    Better control of Desktops/Users

    Live versus isolated conversion

    Maximize functionality

    Identify Needs for: Manageability, Scalability, Security, Availability

    Integrate Samba-3 then migrate while users are active, then change of control (swap out)

    Take advantage of lower maintenance opportunity

    Samba-3 Implementation Choices

    Authentication Database/Backend

    Samba-3 can use an external authentication backend:

    -

    • Winbind (external Samba or NT4/200x server)

    • External server could use Active Directory or NT4 Domain

    • Can use pam_mkhomedir.so to auto-create home dirs

    -

    - Samba-3 can use a local authentication backend: -

    • smbpasswd, tdbsam, ldapsam, mysqlsam

    -

    Access Control Points:

    • On the Share itself - using Share ACLs

    • On the file system - using UNIX permissions on files and directories

      Note: Can Enable Posix ACLs in file system also

    • Through Samba share parameters - Not recommended - except as last resort

    Policies (migrate or create new ones):

    • Using Group Policy Editor (NT4)

    • - Watch out for Tattoo effect

    User and Group Profiles:

    - Platform specific so use platform tool to change from a Local to a Roaming profile - Can use new profiles tool to change SIDs (NTUser.DAT) -

    Logon Scripts:

    - Know how they work -

    User and Group mapping to Unix/Linux:

    • username map facility may be needed

    • Use 'net groupmap' to connect NT4 groups to Unix groups

    • Use pdbedit to set/change user configuration

      - NOTE: When migrating to LDAP back, end it may be easier to dump initial - LDAP database to LDIF, then edit, then reload into LDAP -

    OS specific scripts/programs may be needed:

    • Add/Delete Users: Note OS limits on size of name - (Linux 8 chars) NT4 up to 254 chars

    • Add/Delete Machines: Applied only to domain members - (Note: Machine names may be limited to 16 characters)

    • Use 'net groupmap' to connect NT4 groups to Unix groups

    • Add/Delete Groups: Note OS limits on size and nature. - Linux limit is 16 char, no spaces and no upper case chars (groupadd)

    Migration Tools:

    +

    • Winbind (external Samba or NT4/200x server).

    • External server could use Active Directory or NT4 Domain.

    • Can use pam_mkhomedir.so to auto-create home dirs.

    • + Samba-3 can use a local authentication backend: smbpasswd, tdbsam, ldapsam, mysqlsam

    +

    Access Control Points

    + Samba permits Access Control Points to be set: +

    • On the share itself using Share ACLs.

    • On the file system using UNIX permissions on files and directories.

      Note: Can enable Posix ACLs in file system also.

    • Through Samba share parameters not recommended except as last resort.

    Policies (migrate or create new ones)

    + Exercise great caution when affecting registry changes, use the right tool and be aware + that changes made through NT4-style NTConfig.POL files can leave + permanent changes. +

    • Using Group Policy Editor (NT4).

    • Watch out for Tattoo effect.

    User and Group Profiles

    + Platform-specific so use platform tool to change from a Local to a Roaming profile. + Can use new profiles tool to change SIDs (NTUser.DAT). +

    Logon Scripts

    + Know how they work. +

    User and Group Mapping to UNIX/Linux

    + + User and Group mapping code is new. Many problems have been experienced as network administrators + who are familiar with Samba-2.2.x migrate to Samba-3. Carefully study the chapters that document + the new password backend behavior and the new group mapping functionality. +

    • The username map facility may be needed.

    • Use net groupmap to connect NT4 groups to UNIX groups.

    • Use pdbedit to set/change user configuration.

      + When migrating to LDAP backend, it may be easier to dump the initial + LDAP database to LDIF, edit, then reload into LDAP. +

    OS Specific Scripts/Programs may be Needed

    + Every operating system has its peculiarities. These are the result of engineering decisions + that were based on the experience of the designer, and may have side-effects that were not + anticipated. Limitations that may bite the Windows network administrator include: +

    • Add/Delete Users: Note OS limits on size of name + (Linux 8 chars) NT4 up to 254 chars.

    • Add/Delete Machines: Applied only to Domain Members + (Note: machine names may be limited to 16 characters).

    • Use net groupmap to connect NT4 groups to UNIX groups.

    • Add/Delete Groups: Note OS limits on size and nature. + Linux limit is 16 char, no spaces and no upper case chars (groupadd).

    Migration Tools

    + Domain Control (NT4 Style) Profiles, Policies, Access Controls, Security -

    • Samba: net, rpcclient, smbpasswd, pdbedit, profiles

    • Windows: NT4 Domain User Manager, Server Manager (NEXUS)

    -

    Prev Up Next
    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0 Home Chapter 32. SWAT - The Samba Web Administration Tool
    +

    • Samba: net, rpcclient, smbpasswd, pdbedit, profiles.

    • Windows: NT4 Domain User Manager, Server Manager (NEXUS)

    +

    Prev Up Next
    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0 Home Chapter 32. SWAT The Samba Web Administration Tool
    diff --git a/docs/htmldocs/NetworkBrowsing.html b/docs/htmldocs/NetworkBrowsing.html index 4507c0067f..ffe96d2471 100644 --- a/docs/htmldocs/NetworkBrowsing.html +++ b/docs/htmldocs/NetworkBrowsing.html @@ -1,192 +1,196 @@ -Chapter 10. Samba / MS Windows Network Browsing Guide
    Chapter 10. Samba / MS Windows Network Browsing Guide
    Prev Part III. Advanced Configuration Next

    Chapter 10. Samba / MS Windows Network Browsing Guide

    John H. Terpstra

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    July 5, 1998

    Updated: April 21, 2003

    Table of Contents

    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    I get an Unable to browse the network error

    +Chapter 10. Network Browsing

    Chapter 10. Network Browsing
    Prev Part III. Advanced Configuration Next

    Chapter 10. Network Browsing

    John H. Terpstra

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    July 5, 1998

    Updated: April 21, 2003

    Table of Contents

    Features and Benefits
    What Is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Configuring WORKGROUP Browsing
    DOMAIN Browsing Configuration
    Forcing Samba to Be the Master
    Making Samba the Domain Master
    Note about Broadcast Addresses
    Multiple Interfaces
    Use of the Remote Announce Parameter
    Use of the Remote Browse Sync Parameter
    WINS The Windows Internetworking Name Server
    WINS Server Configuration
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of Browsing
    Browsing Support in Samba
    Problem Resolution
    Cross-Subnet Browsing
    Common Errors
    How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?
    Server Resources Can Not Be Listed
    I get an `Unable to browse the network' error
    Browsing of Shares and Directories is Very Slow

    This document contains detailed information as well as a fast track guide to -implementing browsing across subnets and / or across workgroups (or domains). +implementing browsing across subnets and/or across workgroups (or domains). WINS is the best tool for resolution of NetBIOS names to IP addresses. WINS is -NOT involved in browse list handling except by way of name to address resolution. +not involved in browse list handling except by way of name to address resolution.

    Note

    -MS Windows 2000 and later can be configured to operate with NO NetBIOS -over TCP/IP. Samba-3 and later also supports this mode of operation. -When the use of NetBIOS over TCP/IP has been disabled then the primary +MS Windows 2000 and later versions can be configured to operate with no NetBIOS +over TCP/IP. Samba-3 and later versions also support this mode of operation. +When the use of NetBIOS over TCP/IP has been disabled, the primary means for resolution of MS Windows machine names is via DNS and Active Directory. The following information assumes that your site is running NetBIOS over TCP/IP. -

    Features and Benefits

    -Someone once referred to the past in terms of: They were the worst of times, -they were the best of times. The more we look back, them more we long for what was and -hope it never returns!. -

    +

    Features and Benefits

    +Someone once referred to the past in these words “It was the best of times, +it was the worst of times.” The more we look back, the more we long for what was and +hope it never returns. +

    + For many MS Windows network administrators, that statement sums up their feelings about NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle nature was just par for the course. For those who never quite managed to tame its lusty features, NetBIOS is like Paterson's Curse.

    -For those not familiar with botanical problems in Australia: Paterson's curse, -Echium plantagineum, was introduced to Australia from Europe during the mid-nineteenth +For those not familiar with botanical problems in Australia, Paterson's Curse, +Echium plantagineum, was introduced to Australia from Europe during the mid-nineteenth century. Since then it has spread rapidly. The high seed production, with densities of -thousands of seeds per square metre, a seed longevity of more than seven years, and an +thousands of seeds per square meter, a seed longevity of more than seven years, and an ability to germinate at any time of year, given the right conditions, are some of the features which make it such a persistent weed.

    -In this chapter we explore vital aspects of SMB (Server Message Block) networking with +In this chapter we explore vital aspects of Server Message Block (SMB) networking with a particular focus on SMB as implemented through running NetBIOS (Network Basic -Input / Output System) over TCP/IP. Since Samba does NOT implement SMB or NetBIOS over -any other protocols we need to know how to configure our network environment and simply +Input/Output System) over TCP/IP. Since Samba does not implement SMB or NetBIOS over +any other protocols, we need to know how to configure our network environment and simply remember to use nothing but TCP/IP on all our MS Windows network clients.

    Samba provides the ability to implement a WINS (Windows Internetworking Name Server) and implements extensions to Microsoft's implementation of WINS. These extensions -help Samba to affect stable WINS operations beyond the normal scope of MS WINS. +help Samba to effect stable WINS operations beyond the normal scope of MS WINS.

    -Please note that WINS is exclusively a service that applies only to those systems -that run NetBIOS over TCP/IP. MS Windows 200x / XP have the capacity to turn off -support for NetBIOS, in which case WINS is of no relevance. Samba supports this also. +WINS is exclusively a service that applies only to those systems +that run NetBIOS over TCP/IP. MS Windows 200x/XP have the capacity to operate with +support for NetBIOS disabled, in which case WINS is of no relevance. Samba supports this also.

    -For those networks on which NetBIOS has been disabled (ie: WINS is NOT required) +For those networks on which NetBIOS has been disabled (i.e., WINS is not required) the use of DNS is necessary for host name resolution. -

    What is Browsing?

    -To most people browsing means that they can see the MS Windows and Samba servers +

    What Is Browsing?

    +To most people browsing means they can see the MS Windows and Samba servers in the Network Neighborhood, and when the computer icon for a particular server is clicked, it opens up and shows the shares and printers available on the target server.

    -What seems so simple is in fact a very complex interaction of different technologies. -The technologies (or methods) employed in making all of this work includes: -

    • MS Windows machines register their presence to the network

    • Machines announce themselves to other machines on the network

    • One or more machine on the network collates the local announcements

    • The client machine finds the machine that has the collated list of machines

    • The client machine is able to resolve the machine names to IP addresses

    • The client machine is able to connect to a target machine

    +What seems so simple is in fact a complex interaction of different technologies. +The technologies (or methods) employed in making all of this work include: +

    • MS Windows machines register their presence to the network.
    • Machines announce themselves to other machines on the network.
    • One or more machine on the network collates the local announcements.
    • The client machine finds the machine that has the collated list of machines.
    • The client machine is able to resolve the machine names to IP addresses.
    • The client machine is able to connect to a target machine.

    The Samba application that controls browse list management and name resolution is called nmbd. The configuration parameters involved in nmbd's operation are: -

    Browsing options: os level(*), - lm announce, - lm interval, - preferred master(*), - local master(*), - domain master(*), - browse list, - enhanced browsing. +

    Browsing options: os level(*), + lm announce, + lm interval, + preferred master(*), + local master(*), + domain master(*), + browse list, + enhanced browsing.

    Name Resolution Method: - name resolve order(*). + name resolve order(*).

    WINS options: - dns proxy, - wins proxy, - wins server(*), - wins support(*), - wins hook. -

    + dns proxy, + wins proxy, + wins server(*), + wins support(*), + wins hook. +

    + For Samba, the WINS Server and WINS Support are mutually exclusive options. Those marked with -an '*' are the only options that commonly MAY need to be modified. Even if not one of these -parameters is set nmbd will still do it's job. -

    Discussion

    -Firstly, all MS Windows networking uses SMB (Server Message Block) based messaging. -SMB messaging may be implemented with or without NetBIOS. MS Windows 200x supports -NetBIOS over TCP/IP for backwards compatibility. Microsoft is intent on phasing out NetBIOS -support. -

    NetBIOS over TCP/IP

    -Samba implements NetBIOS, as does MS Windows NT / 200x / XP, by encapsulating it over TCP/IP. -MS Windows products can do likewise. NetBIOS based networking uses broadcast messaging to -affect browse list management. When running NetBIOS over TCP/IP, this uses UDP based messaging. +an (*) are the only options that commonly may need to be modified. Even if none of these +parameters is set, nmbd will still do its job. +

    Discussion

    +All MS Windows networking uses SMB-based messaging. SMB messaging may be implemented with or without NetBIOS. +MS Windows 200x supports NetBIOS over TCP/IP for backwards compatibility. Microsoft appears intent on phasing +out NetBIOS support. +

    NetBIOS over TCP/IP

    +Samba implements NetBIOS, as does MS Windows NT/200x/XP, by encapsulating it over TCP/IP. +MS Windows products can do likewise. NetBIOS-based networking uses broadcast messaging to +effect browse list management. When running NetBIOS over TCP/IP, this uses UDP-based messaging. UDP messages can be broadcast or unicast. -

    +

    + Normally, only unicast UDP messaging can be forwarded by routers. The -remote announce parameter to smb.conf helps to project browse announcements +remote announce parameter to smb.conf helps to project browse announcements to remote network segments via unicast UDP. Similarly, the -remote browse sync parameter of smb.conf +remote browse sync parameter of smb.conf implements browse list collation using unicast UDP.

    Secondly, in those networks where Samba is the only SMB server technology, -wherever possible nmbd should be configured on one (1) machine as the WINS +wherever possible nmbd should be configured on one machine as the WINS server. This makes it easy to manage the browsing environment. If each network -segment is configured with it's own Samba WINS server, then the only way to -get cross segment browsing to work is by using the -remote announce and the remote browse sync +segment is configured with its own Samba WINS server, then the only way to +get cross-segment browsing to work is by using the + + +remote announce and the remote browse sync parameters to your smb.conf file.

    - -If only one WINS server is used for an entire multi-segment network then -the use of the remote announce and the -remote browse sync parameters should NOT be necessary. + +If only one WINS server is used for an entire multi-segment network, then +the use of the remote announce and the +remote browse sync parameters should not be necessary.

    -As of Samba 3 WINS replication is being worked on. The bulk of the code has -been committed, but it still needs maturation. This is NOT a supported feature + +As of Samba-3 WINS replication is being worked on. The bulk of the code has +been committed, but it still needs maturation. This is not a supported feature of the Samba-3.0.0 release. Hopefully, this will become a supported feature of one of the Samba-3 release series.

    Right now Samba WINS does not support MS-WINS replication. This means that -when setting up Samba as a WINS server there must only be one nmbd +when setting up Samba as a WINS server, there must only be one nmbd configured as a WINS server on the network. Some sites have used multiple Samba WINS servers for redundancy (one server per subnet) and then used -remote browse sync and remote announce -to affect browse list collation across all segments. Note that this means clients +remote browse sync and remote announce +to effect browse list collation across all segments. Note that this means clients will only resolve local names, and must be configured to use DNS to resolve names on other subnets in order to resolve the IP addresses of the servers they can see on other subnets. This setup is not recommended, but is mentioned as a practical -consideration (ie: an 'if all else fails' scenario). +consideration (i.e., an “if all else fails” scenario).

    Lastly, take note that browse lists are a collection of unreliable broadcast messages that are repeated at intervals of not more than 15 minutes. This means that it will take time to establish a browse list and it can take up to 45 -minutes to stabilise, particularly across network segments. -

    TCP/IP - without NetBIOS

    - - - -All TCP/IP using systems use various forms of host name resolution. The primary -methods for TCP/IP hostname resolutions involves either a static file (/etc/hosts -) or DNS (the Domain Name System). DNS is the technology that makes -the Internet usable. DNS based host name resolution is supported by nearly all TCP/IP -enabled systems. Only a few embedded TCP/IP systems do not support DNS. -

    -When an MS Windows 200x / XP system attempts to resolve a host name to an IP address +minutes to stabilize, particularly across network segments. +

    TCP/IP without NetBIOS

    + + + +All TCP/IP-enabled systems use various forms of host name resolution. The primary +methods for TCP/IP hostname resolution involve either a static file (/etc/hosts) +or the Domain Name System (DNS). DNS is the technology that makes +the Internet usable. DNS-based host name resolution is supported by nearly all +TCP/IP-enabled systems. Only a few embedded TCP/IP systems do not support DNS. +

    +When an MS Windows 200x/XP system attempts to resolve a host name to an IP address it follows a defined path:

    1. Checks the hosts file. It is located in - C:\WinNT\System32\Drivers\etc. + C:\Windows NT\System32\Drivers\etc.

    2. - Does a DNS lookup + Does a DNS lookup.

    3. - Checks the NetBIOS name cache + Checks the NetBIOS name cache.

    4. - Queries the WINS server + Queries the WINS server.

    5. - Does a broadcast name lookup over UDP + Does a broadcast name lookup over UDP.

    6. - Looks up entries in LMHOSTS. It is located in - C:\WinNT\System32\Drivers\etc. -

    -Windows 200x / XP can register it's host name with a Dynamic DNS server. You can -force register with a Dynamic DNS server in Windows 200x / XP using: -ipconfig /registerdns + Looks up entries in LMHOSTS. It is located in + C:\Windows NT\System32\Drivers\etc. +

    + +Windows 200x/XP can register its host name with a Dynamic DNS server. You can +force register with a Dynamic DNS server in Windows 200x/XP using: +ipconfig /registerdns.

    With Active Directory (ADS), a correctly functioning DNS server is absolutely essential. In the absence of a working DNS server that has been correctly configured, -MS Windows clients and servers will be totally unable to locate each other, +MS Windows clients and servers will be unable to locate each other, so consequently network services will be severely impaired.

    The use of Dynamic DNS is highly recommended with Active Directory, in which case -the use of BIND9 is preferred for it's ability to adequately support the SRV (service) +the use of BIND9 is preferred for its ability to adequately support the SRV (service) records that are needed for Active Directory. -

    DNS and Active Directory

    -Occasionally we hear from UNIX network administrators who want to use a UNIX based Dynamic +

    DNS and Active Directory

    + +Occasionally we hear from UNIX network administrators who want to use a UNIX-based Dynamic DNS server in place of the Microsoft DNS server. While this might be desirable to some, the MS Windows 200x DNS server is auto-configured to work with Active Directory. It is possible to use BIND version 8 or 9, but it will almost certainly be necessary to create service records -so that MS Active Directory clients can resolve host names to locate essential network services. +so MS Active Directory clients can resolve host names to locate essential network services. The following are some of the default service records that Active Directory requires: -

    • _ldap._tcp.pdc.ms-dcs.Domain

      - This provides the address of the Windows NT PDC for the Domain. -

    • _ldap._tcp.pdc.ms-dcs.DomainTree

      - Resolves the addresses of Global Catalog servers in the domain. -

    • _ldap._tcp.site.sites.writable.ms-dcs.Domain

      - Provides list of domain controllers based on sites. -

    • _ldap._tcp.writable.ms-dcs.Domain

      - Enumerates list of domain controllers that have the writable - copies of the Active Directory data store. -

    • _ldap._tcp.GUID.domains.ms-dcs.DomainTree

      - Entry used by MS Windows clients to locate machines using the - Global Unique Identifier. -

    • _ldap._tcp.Site.gc.ms-dcs.DomainTree

      - Used by MS Windows clients to locate site configuration dependent - Global Catalog server. -

    How Browsing Functions

    +

    _ldap._tcp.pdc.ms-dcs.Domain

    + This provides the address of the Windows NT PDC for the Domain. +

    _ldap._tcp.pdc.ms-dcs.DomainTree

    + Resolves the addresses of Global Catalog servers in the domain. +

    _ldap._tcp.site.sites.writable.ms-dcs.Domain

    + Provides list of Domain Controllers based on sites. +

    _ldap._tcp.writable.ms-dcs.Domain

    + Enumerates list of Domain Controllers that have the writable copies of the Active Directory datastore. +

    _ldap._tcp.GUID.domains.ms-dcs.DomainTree

    + Entry used by MS Windows clients to locate machines using the Global Unique Identifier. +

    _ldap._tcp.Site.gc.ms-dcs.DomainTree

    + Used by MS Windows clients to locate site configuration dependent Global Catalog server. +

    How Browsing Functions

    MS Windows machines register their NetBIOS names -(ie: the machine name for each service type in operation) on start -up. The exact method by which this name registration +(i.e., the machine name for each service type in operation) on start-up. +The exact method by which this name registration takes place is determined by whether or not the MS Windows client/server has been given a WINS server address, whether or not LMHOSTS lookup is enabled, or if DNS for NetBIOS name resolution is enabled, etc. @@ -194,27 +198,27 @@ is enabled, or if DNS for NetBIOS name resolution is enabled, etc. In the case where there is no WINS server, all name registrations as well as name lookups are done by UDP broadcast. This isolates name resolution to the local subnet, unless LMHOSTS is used to list all -names and IP addresses. In such situations Samba provides a means by +names and IP addresses. In such situations, Samba provides a means by which the Samba server name may be forcibly injected into the browse list of a remote MS Windows network (using the -remote announce parameter). +remote announce parameter).

    Where a WINS server is used, the MS Windows client will use UDP unicast to register with the WINS server. Such packets can be routed and thus WINS allows name resolution to function across routed networks.

    During the startup process an election will take place to create a -local master browser if one does not already exist. On each NetBIOS network -one machine will be elected to function as the domain master browser. This -domain browsing has nothing to do with MS security domain control. -Instead, the domain master browser serves the role of contacting each local +Local Master Browser if one does not already exist. On each NetBIOS network +one machine will be elected to function as the Domain Master Browser. This +domain browsing has nothing to do with MS security Domain Control. +Instead, the Domain Master Browser serves the role of contacting each local master browser (found by asking WINS or from LMHOSTS) and exchanging browse list contents. This way every master browser will eventually obtain a complete -list of all machines that are on the network. Every 11-15 minutes an election +list of all machines that are on the network. Every 11 to 15 minutes an election is held to determine which machine will be the master browser. By the nature of the election criteria used, the machine with the highest uptime, or the -most senior protocol version, or other criteria, will win the election -as domain master browser. +most senior protocol version or other criteria, will win the election +as Domain Master Browser.

    Clients wishing to browse the network make use of this list, but also depend on the availability of correct name resolution to the respective IP @@ -224,361 +228,321 @@ Any configuration that breaks name resolution and/or browsing intrinsics will annoy users because they will have to put up with protracted inability to use the network services.

    -Samba supports a feature that allows forced synchronisation -of browse lists across routed networks using the remote browse sync parameter in the smb.conf file. -This causes Samba to contact the local master browser on a remote network and -to request browse list synchronisation. This effectively bridges -two networks that are separated by routers. The two remote -networks may use either broadcast based name resolution or WINS -based name resolution, but it should be noted that the remote browse sync parameter provides browse list synchronisation - and -that is distinct from name to address resolution, in other -words, for cross subnet browsing to function correctly it is -essential that a name to address resolution mechanism be provided. -This mechanism could be via DNS, /etc/hosts, -and so on. -

    Setting up WORKGROUP Browsing

    -To set up cross subnet browsing on a network containing machines -in up to be in a WORKGROUP, not an NT Domain you need to set up one -Samba server to be the Domain Master Browser (note that this is *NOT* +Samba supports a feature that allows forced synchronization of browse lists across +routed networks using the remote browse sync +parameter in the smb.conf file. This causes Samba to contact the local master +browser on a remote network and to request browse list synchronization. This +effectively bridges two networks that are separated by routers. The two remote +networks may use either broadcast-based name resolution or WINS-based name +resolution, but it should be noted that the +remote browse sync parameter provides +browse list synchronization and that is distinct from name to address +resolution. In other words, for cross-subnet browsing to function correctly it is +essential that a name-to-address resolution mechanism be provided. This mechanism +could be via DNS, /etc/hosts, and so on. +

    Configuring WORKGROUP Browsing

    +To configure cross-subnet browsing on a network containing machines +in a WORKGROUP, not an NT Domain, you need to set up one +Samba server to be the Domain Master Browser (note that this is not the same as a Primary Domain Controller, although in an NT Domain the -same machine plays both roles). The role of a Domain master browser is -to collate the browse lists from local master browsers on all the -subnets that have a machine participating in the workgroup. Without -one machine configured as a domain master browser each subnet would -be an isolated workgroup, unable to see any machines on any other -subnet. It is the presence of a domain master browser that makes -cross subnet browsing possible for a workgroup. -

    -In an WORKGROUP environment the domain master browser must be a -Samba server, and there must only be one domain master browser per -workgroup name. To set up a Samba server as a domain master browser, +same machine plays both roles). The role of a Domain Master Browser is +to collate the browse lists from Local Master Browsers on all the +subnets that have a machine participating in the workgroup. Without +one machine configured as a Domain Master Browser, each subnet would +be an isolated workgroup unable to see any machines on another +subnet. It is the presence of a Domain Master Browser that makes +cross-subnet browsing possible for a workgroup. +

    +In a WORKGROUP environment the Domain Master Browser must be a +Samba server, and there must only be one Domain Master Browser per +workgroup name. To set up a Samba server as a Domain Master Browser, set the following option in the [global] section -of the smb.conf file : +of the smb.conf file:

    domain master = yes

    -The domain master browser should also preferably be the local master -browser for its own subnet. In order to achieve this set the following -options in the [global] section of the smb.conf file : -

    -

    Example 10.1. Domain master browser smb.conf

    [global]
    domain master = yes
    local master = yes
    preferred master = yes
    os level = 65

    -

    -The domain master browser may be the same machine as the WINS -server, if you require. -

    -Next, you should ensure that each of the subnets contains a -machine that can act as a local master browser for the -workgroup. Any MS Windows NT/2K/XP/2003 machine should be -able to do this, as will Windows 9x machines (although these -tend to get rebooted more often, so it's not such a good idea -to use these). To make a Samba server a local master browser -set the following options in the [global] section of the -smb.conf file : -

    -

    Example 10.2. Local master browser smb.conf

    [global]
    domain master = no
    local master = yes
    preferred master = yes
    os level = 65

    -

    -Do not do this for more than one Samba server on each subnet, -or they will war with each other over which is to be the local -master browser. -

    -The local master parameter allows Samba to act as a -local master browser. The preferred master causes nmbd -to force a browser election on startup and the os level -parameter sets Samba high enough so that it should win any browser elections. -

    -If you have an NT machine on the subnet that you wish to -be the local master browser then you can disable Samba from -becoming a local master browser by setting the following -options in the [global] section of the -smb.conf file : -

    -

    Example 10.3. smb.conf for not being a master browser

    [global]
    domain master = no
    local master = no
    preferred master = no
    os level = 0

    -

    Setting up DOMAIN Browsing

    -If you are adding Samba servers to a Windows NT Domain then -you must not set up a Samba server as a domain master browser. -By default, a Windows NT Primary Domain Controller for a domain -is also the Domain master browser for that domain, and many -things will break if a Samba server registers the Domain master -browser NetBIOS name (DOMAIN<1B>) +The Domain Master Browser should preferably be the local master +browser for its own subnet. In order to achieve this, set the following +options in the [global] section of the smb.conf +file as shown in . +

    +

    Example 10.1. Domain Master Browser smb.conf

    [global]
    domain master = yes
    local master = yes
    preferred master = yes
    os level = 65

    +

    +The Domain Master Browser may be the same machine as the WINS server, if necessary. +

    +Next, you should ensure that each of the subnets contains a machine that can act as +a Local Master Browser for the workgroup. Any MS Windows NT/200x/XP machine should +be able to do this, as will Windows 9x/Me machines (although these tend to get +rebooted more often, so it is not such a good idea to use these). To make a Samba +server a Local Master Browser set the following options in the +[global] section of the smb.conf file as +shown in : +

    +

    Example 10.2. Local master browser smb.conf

    [global]
    domain master = no
    local master = yes
    preferred master = yes
    os level = 65

    +

    +Do not do this for more than one Samba server on each subnet, or they will war with +each other over which is to be the Local Master Browser. +

    +The local master parameter allows Samba to act as a +Local Master Browser. The preferred master causes nmbd +to force a browser election on startup and the os level +parameter sets Samba high enough so it should win any browser elections. +

    +If you have an NT machine on the subnet that you wish to be the Local Master Browser, you can disable Samba from +becoming a Local Master Browser by setting the following options in the [global] section of the +smb.conf file as shown in : +

    +

    Example 10.3. smb.conf for not being a Master Browser

    [global]
    domain master = no
    local master = no
    preferred master = no
    os level = 0

    +

    DOMAIN Browsing Configuration

    +If you are adding Samba servers to a Windows NT Domain, then you must not set up a Samba server as a Domain Master Browser. +By default, a Windows NT Primary Domain Controller for a domain is also the Domain Master Browser for that domain. Network +browsing may break if a Samba server registers the domain master browser NetBIOS name (DOMAIN<1B>) with WINS instead of the PDC.

    -For subnets other than the one containing the Windows NT PDC -you may set up Samba servers as local master browsers as -described. To make a Samba server a local master browser set -the following options in the [global] section -of the smb.conf file : -

    -

    Example 10.4. Local master browser smb.conf

    [global]
    domain master = no
    local master = yes
    preferred master = yes
    os level = 65

    -

    -If you wish to have a Samba server fight the election with machines -on the same subnet you may set the os level parameter -to lower levels. By doing this you can tune the order of machines that -will become local master browsers if they are running. For -more details on this see the section -Forcing Samba to be the master browser -below. -

    -If you have Windows NT machines that are members of the domain -on all subnets, and you are sure they will always be running then -you can disable Samba from taking part in browser elections and -ever becoming a local master browser by setting following options -in the [global] section of the smb.conf -file : -

    -

    Example 10.5. smb.conf for not being a master browser

    [global]
    domain master = no
    local master = no
    preferred master = no
    os level = 0

    -

    Forcing Samba to be the master

    -Who becomes the master browser is determined by an election -process using broadcasts. Each election packet contains a number of parameters -which determine what precedence (bias) a host should have in the -election. By default Samba uses a very low precedence and thus loses -elections to just about anyone else. -

    -If you want Samba to win elections then just set the os level global -option in smb.conf to a higher number. It defaults to 0. Using 34 -would make it win all elections over every other system (except other -samba systems!) -

    -A os level of 2 would make it beat WfWg and Win95, but not MS Windows -NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32. -

    The maximum os level is 255

    -If you want Samba to force an election on startup, then set the -preferred master global option in smb.conf to yes. Samba will -then have a slight advantage over other potential master browsers -that are not preferred master browsers. Use this parameter with -care, as if you have two hosts (whether they are Windows 95 or NT or -Samba) on the same local subnet both set with preferred master to -yes, then periodically and continually they will force an election -in order to become the local master browser. -

    - If you want Samba to be a domain master browser, then it is -recommended that you also set preferred master to yes, because -Samba will not become a domain master browser for the whole of your -LAN or WAN if it is not also a local master browser on its own -broadcast isolated subnet. -

    -It is possible to configure two Samba servers to attempt to become -the domain master browser for a domain. The first server that comes -up will be the domain master browser. All other Samba servers will -attempt to become the domain master browser every 5 minutes. They -will find that another Samba server is already the domain master -browser and will fail. This provides automatic redundancy, should -the current domain master browser fail. -

    Making Samba the domain master

    -The domain master is responsible for collating the browse lists of -multiple subnets so that browsing can occur between subnets. You can -make Samba act as the domain master by setting domain master = yes -in smb.conf. By default it will not be a domain master. -

    -Note that you should not set Samba to be the domain master for a -workgroup that has the same name as an NT Domain. -

    -When Samba is the domain master and the master browser, it will listen -for master announcements (made roughly every twelve minutes) from local -master browsers on other subnets and then contact them to synchronise -browse lists. -

    -If you want Samba to be the domain master then I suggest you also set -the os level high enough to make sure it wins elections, and set -preferred master to yes, to get Samba to force an election on -startup. -

    -Note that all your servers (including Samba) and clients should be -using a WINS server to resolve NetBIOS names. If your clients are only -using broadcasting to resolve NetBIOS names, then two things will occur: +For subnets other than the one containing the Windows NT PDC, you may set up Samba servers as Local Master Browsers as +described. To make a Samba server a Local Master Browser, set the following options in the [global] section +of the smb.conf file as shown in : +

    +

    Example 10.4. Local Master Browser smb.conf

    [global]
    domain master = no
    local master = yes
    preferred master = yes
    os level = 65

    +

    +If you wish to have a Samba server fight the election with machines on the same subnet you +may set the os level parameter to lower levels. +By doing this you can tune the order of machines that will become Local Master Browsers if +they are running. For more details on this refer to . +

    +If you have Windows NT machines that are members of the domain on all subnets and you are +sure they will always be running, you can disable Samba from taking part in browser elections +and ever becoming a Local Master Browser by setting the following options in the +[global] section of the smb.conf file as shown in : +

    +

    Example 10.5. smb.conf for not being a master browser

    [global]
    domain master = no
    local master = no
    preferred master = no
    os level = 0

    +

    Forcing Samba to Be the Master

    +Who becomes the master browser is determined by an election process using broadcasts. Each election packet contains a number of parameters +that determine what precedence (bias) a host should have in the election. By default Samba uses a low precedence and thus loses +elections to just about every Windows network server or client. +

    +If you want Samba to win elections, set the os level +global option in smb.conf to a higher number. It defaults to zero. Using 34 would make it win +all elections every other system (except other samba systems). +

    +An os level of two would make it beat Windows for Workgroups and Windows 9x/Me, but not MS Windows +NT/200x Server. An MS Windows NT/200x Server Domain Controller uses level 32. The maximum os level is 255. +

    +If you want Samba to force an election on startup, set the +preferred master global option in smb.conf to yes. +Samba will then have a slight advantage over other potential master browsers that are not Perferred Master Browsers. +Use this parameter with care, as if you have two hosts (whether they are Windows 9x/Me or +NT/200x/XP or Samba) on the same local subnet both set with preferred master +to yes, then periodically and continually they will force an election in order +to become the Local Master Browser. +

    +If you want Samba to be a Domain Master Browser, then it is recommended that +you also set preferred master to yes, because +Samba will not become a Domain Master Browser for the whole of your LAN or WAN if it is not also a +Local Master Browser on its own broadcast isolated subnet. +

    +It is possible to configure two Samba servers to attempt to become the Domain Master Browser for a domain. The first server that comes +up will be the Domain Master Browser. All other Samba servers will attempt to become the Domain Master Browser every five minutes. They +will find that another Samba server is already the domain master browser and will fail. This provides automatic redundancy, should +the current Domain Master Browser fail. +

    Making Samba the Domain Master

    +The domain master is responsible for collating the browse lists of multiple subnets so browsing can occur between subnets. You can +make Samba act as the Domain Master by setting domain master = yes +in smb.conf. By default it will not be a Domain Master. +

    +Do not set Samba to be the Domain Master for a workgroup that has the same name as an NT/200x Domain. +If Samba is configured to be the Domain Master for a workgroup that is present on the same +network as a Windows NT/200x domain that has the same name, network browsing problems will +certainly be experienced. +

    +When Samba is the Domain Master and the Master Browser, it will listen for master +announcements (made roughly every twelve minutes) from Local Master Browsers on +other subnets and then contact them to synchronize browse lists. +

    +If you want Samba to be the domain master, you should also set the +os level high enough to make sure it wins elections, and +set preferred master to yes, to +get Samba to force an election on startup. +

    +All servers (including Samba) and clients should be using a WINS server to resolve NetBIOS names. If your +clients are only using broadcasting to resolve NetBIOS names, then two things will occur:

    1. - your local master browsers will be unable to find a domain master - browser, as it will only be looking on the local subnet. + Local Master Browsers will be unable to find a Domain Master Browser, as they will be looking only on the local subnet.

    2. - if a client happens to get hold of a domain-wide browse list, and - a user attempts to access a host in that list, it will be unable to - resolve the NetBIOS name of that host. + If a client happens to get hold of a domain-wide browse list and a user attempts to access a + host in that list, it will be unable to resolve the NetBIOS name of that host.

    If, however, both Samba and your clients are using a WINS server, then:

    1. - your local master browsers will contact the WINS server and, as long as - Samba has registered that it is a domain master browser with the WINS - server, your local master browser will receive Samba's IP address - as its domain master browser. + Local master browsers will contact the WINS server and, as long as Samba has registered that it is a Domain Master Browser with the WINS + server, the Local Master Browser will receive Samba's IP address as its Domain Master Browser.

    2. - when a client receives a domain-wide browse list, and a user attempts - to access a host in that list, it will contact the WINS server to - resolve the NetBIOS name of that host. as long as that host has - registered its NetBIOS name with the same WINS server, the user will - be able to see that host. -

    Note about broadcast addresses

    -If your network uses a "0" based broadcast address (for example if it -ends in a 0) then you will strike problems. Windows for Workgroups -does not seem to support a 0's broadcast and you will probably find -that browsing and name lookups won't work. -

    Multiple interfaces

    -Samba now supports machines with multiple network interfaces. If you -have multiple interfaces then you will need to use the interfaces -option in smb.conf to configure them. -

    Use of the Remote Announce parameter

    -The remote announce parameter of + When a client receives a domain-wide browse list and a user attempts to access a host in that list, it will contact the WINS server to + resolve the NetBIOS name of that host. As long as that host has registered its NetBIOS name with the same WINS server, the user will + be able to see that host. +

    Note about Broadcast Addresses

    +If your network uses a 0 based broadcast address (for example, if it ends in a 0) then you will strike problems. Windows for Workgroups +does not seem to support a zeros broadcast and you will probably find that browsing and name lookups will not work. +

    Multiple Interfaces

    +Samba supports machines with multiple network interfaces. If you have multiple interfaces, you will +need to use the interfaces option in smb.conf to configure them. +

    Use of the Remote Announce Parameter

    +The remote announce parameter of smb.conf can be used to forcibly ensure that all the NetBIOS names on a network get announced to a remote network. -The syntax of the remote announce parameter is: +The syntax of the remote announce parameter is:

    remote announce = a.b.c.d [e.f.g.h] ...

    or

    remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...

    where: -

    a.b.c.d and -e.f.g.h

    - - - - is either the LMB (Local Master Browser) IP address -or the broadcast address of the remote network. -ie: the LMB is at 192.168.1.10, or the address -could be given as 192.168.1.255 where the netmask -is assumed to be 24 bits (255.255.255.0). -When the remote announcement is made to the broadcast -address of the remote network, every host will receive -our announcements. This is noisy and therefore -undesirable but may be necessary if we do NOT know -the IP address of the remote LMB.

    WORKGROUP

    is optional and can be either our own workgroup -or that of the remote network. If you use the -workgroup name of the remote network then our -NetBIOS machine names will end up looking like -they belong to that workgroup, this may cause -name resolution problems and should be avoided. -

    -

    Use of the Remote Browse Sync parameter

    -The remote browse sync parameter of -smb.conf is used to announce to -another LMB that it must synchronise its NetBIOS name list with our -Samba LMB. It works ONLY if the Samba server that has this option is +

    a.b.c.d and e.f.g.h

    + + + is either the LMB (Local Master Browser) IP address or the broadcast address of the remote network. + i.e., the LMB is at 192.168.1.10, or the address could be given as 192.168.1.255 where the netmask + is assumed to be 24 bits (255.255.255.0). When the remote announcement is made to the broadcast + address of the remote network, every host will receive our announcements. This is noisy and therefore + undesirable but may be necessary if we do not know the IP address of the remote LMB. +

    WORKGROUP

    is optional and can be either our own workgroup or that of the remote network. If you use the + workgroup name of the remote network, our NetBIOS machine names will end up looking like + they belong to that workgroup. This may cause name resolution problems and should be avoided. +

    +

    Use of the Remote Browse Sync Parameter

    +The remote browse sync parameter of +smb.conf is used to announce to another LMB that it must synchronize its NetBIOS name list with our +Samba LMB. This works only if the Samba server that has this option is simultaneously the LMB on its network segment.

    -The syntax of the remote browse sync parameter is: +The syntax of the remote browse sync parameter is:

    remote browse sync = a.b.c.d

    where a.b.c.d is either the IP address of the remote LMB or else is the network broadcast address of the remote segment. -

    WINS - The Windows Internetworking Name Server

    -Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly +

    WINS The Windows Internetworking Name Server

    +Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly recommended. Every NetBIOS machine registers its name together with a name_type value for each of several types of service it has available. -eg: It registers its name directly as a unique (the type 0x03) name. +It registers its name directly as a unique (the type 0x03) name. It also registers its name if it is running the LanManager compatible server service (used to make shares and printers available to other users) by registering the server (the type 0x20) name.

    All NetBIOS names are up to 15 characters in length. The name_type variable -is added to the end of the name - thus creating a 16 character name. Any +is added to the end of the name, thus creating a 16 character name. Any name that is shorter than 15 characters is padded with spaces to the 15th -character. ie: All NetBIOS names are 16 characters long (including the +character. Thus, all NetBIOS names are 16 characters long (including the name_type information).

    -WINS can store these 16 character names as they get registered. A client +WINS can store these 16-character names as they get registered. A client that wants to log onto the network can ask the WINS server for a list of all names that have registered the NetLogon service name_type. This saves broadcast traffic and greatly expedites logon processing. Since broadcast -name resolution can not be used across network segments this type of -information can only be provided via WINS or via statically configured -lmhosts files that must reside on all clients in the +name resolution cannot be used across network segments this type of +information can only be provided via WINS or via a statically configured +lmhosts file that must reside on all clients in the absence of WINS.

    -WINS also serves the purpose of forcing browse list synchronisation by all -LMB's. LMB's must synchronise their browse list with the DMB (domain master -browser) and WINS helps the LMB to identify it's DMB. By definition this -will work only within a single workgroup. Note that the domain master browser -has NOTHING to do with what is referred to as an MS Windows NT Domain. The +WINS also serves the purpose of forcing browse list synchronization by all +LMBs. LMBs must synchronize their browse list with the DMB (Domain Master +Browser) and WINS helps the LMB to identify its DMB. By definition this +will work only within a single workgroup. Note that the Domain Master Browser +has nothing to do with what is referred to as an MS Windows NT Domain. The later is a reference to a security environment while the DMB refers to the master controller for browse list information only.

    -Use of WINS will work correctly only if EVERY client TCP/IP protocol stack -has been configured to use the WINS server/s. Any client that has not been -configured to use the WINS server will continue to use only broadcast based -name registration so that WINS may NEVER get to know about it. In any case, +WINS will work correctly only if every client TCP/IP protocol stack +has been configured to use the WINS servers. Any client that has not been +configured to use the WINS server will continue to use only broadcast-based +name registration so WINS may never get to know about it. In any case, machines that have not registered with a WINS server will fail name to address lookup attempts by other clients and will therefore cause workstation access errors.

    To configure Samba as a WINS server just add -wins support = yes to the smb.conf +wins support = yes to the smb.conf file [global] section.

    To configure Samba to register with a WINS server just add -wins server = a.b.c.d to your smb.conf file [global] section. +wins server = a.b.c.d +to your smb.conf file [global] section.

    Important

    -Never use both wins support = yes together -with wins server = a.b.c.d -particularly not using it's own IP address. -Specifying both will cause nmbd to refuse to start! -

    Setting up a WINS server

    -Either a Samba machine or a Windows NT Server machine may be set up -as a WINS server. To set a Samba machine to be a WINS server you must -add the following option to the smb.conf file on the selected machine : -in the [global] section add the line -

    -

    wins support = yes

    +Never use both wins support = yes together +with wins server = a.b.c.d +particularly not using its own IP address. Specifying both will cause nmbd to refuse to start! +

    WINS Server Configuration

    +Either a Samba Server or a Windows NT Server machine may be set up +as a WINS server. To configure a Samba Server to be a WINS server you must +add to the smb.conf file on the selected Server the following line to +the [global] section: +

    +

    wins support = yes

    Versions of Samba prior to 1.9.17 had this parameter default to -yes. If you have any older versions of Samba on your network it is +yes. If you have any older versions of Samba on your network it is strongly suggested you upgrade to a recent version, or at the very -least set the parameter to 'no' on all these machines. +least set the parameter to “no” on all these machines.

    -Machines with wins support = yes will keep a list of +Machines configured with wins support = yes will keep a list of all NetBIOS names registered with them, acting as a DNS for NetBIOS names.

    -You should set up only ONE WINS server. Do NOT set the -wins support = yes option on more than one Samba +It is strongly recommended to set up only one WINS server. Do not set the +wins support = yes option on more than one Samba server.

    -To set up a Windows NT Server as a WINS server you need to set up -the WINS service - see your NT documentation for details. Note that -Windows NT WINS Servers can replicate to each other, allowing more -than one to be set up in a complex subnet environment. As Microsoft -refuses to document these replication protocols, Samba cannot currently -participate in these replications. It is possible in the future that -a Samba->Samba WINS replication protocol may be defined, in which -case more than one Samba machine could be set up as a WINS server -but currently only one Samba server should have the -wins support = yes parameter set. -

    -After the WINS server has been configured you must ensure that all + +To configure Windows NT/200x Server as a WINS server, install and configure +the WINS service. See the Windows NT/200x documentation for details. +Windows NT/200x WINS servers can replicate to each other, allowing more +than one to be set up in a complex subnet environment. As Microsoft +refuses to document the replication protocols, Samba cannot currently +participate in these replications. It is possible in the future that +a Samba-to-Samba WINS replication protocol may be defined, in which +case more than one Samba machine could be set up as a WINS server. +Currently only one Samba server should have the +wins support = yes parameter set. +

    +After the WINS server has been configured, you must ensure that all machines participating on the network are configured with the address -of this WINS server. If your WINS server is a Samba machine, fill in +of this WINS server. If your WINS server is a Samba machine, fill in the Samba machine IP address in the Primary WINS Server field of the Control Panel->Network->Protocols->TCP->WINS Server dialogs -in Windows 95 or Windows NT. To tell a Samba server the IP address -of the WINS server add the following line to the [global] section of -all smb.conf files : +in Windows 9x/Me or Windows NT/200x. To tell a Samba server the IP address +of the WINS server, add the following line to the [global] section of +all smb.conf files:

    -

    wins server = <name or IP address>

    +

    wins server = <name or IP address>

    where <name or IP address> is either the DNS name of the WINS server machine or its IP address.

    -Note that this line MUST NOT BE SET in the smb.conf file of the Samba -server acting as the WINS server itself. If you set both the -wins support = yes option and the -wins server = <name> option then -nmbd will fail to start. +This line must not be set in the smb.conf file of the Samba +server acting as the WINS server itself. If you set both the +wins support = yes option and the +wins server = <name> option then +nmbd will fail to start.

    -There are two possible scenarios for setting up cross subnet browsing. -The first details setting up cross subnet browsing on a network containing -Windows 95, Samba and Windows NT machines that are not configured as -part of a Windows NT Domain. The second details setting up cross subnet +There are two possible scenarios for setting up cross-subnet browsing. +The first details setting up cross-subnet browsing on a network containing +Windows 9x/Me, Samba and Windows NT/200x machines that are not configured as +part of a Windows NT Domain. The second details setting up cross-subnet browsing on networks that contain NT Domains. -

    WINS Replication

    +

    WINS Replication

    + Samba-3 permits WINS replication through the use of the wrepld utility. This tool is not currently capable of being used as it is still in active development. -As soon as this tool becomes moderately functional we will prepare man pages and enhance this +As soon as this tool becomes moderately functional, we will prepare man pages and enhance this section of the documentation to provide usage and technical details. -

    Static WINS Entries

    +

    Static WINS Entries

    Adding static entries to your Samba WINS server is actually fairly easy. All you have to do is add a line to wins.dat, typically located in /usr/local/samba/var/locks.

    -Entries in wins.dat take the form of +Entries in wins.dat take the form of: 

    -"NAME#TYPE" TTL ADDRESS+ FLAGS
+"NAME#TYPE" TTL ADDRESS+ FLAGS

    where NAME is the NetBIOS name, TYPE is the NetBIOS type, TTL is the @@ -586,61 +550,61 @@ time-to-live as an absolute time in seconds, ADDRESS+ is one or more addresses corresponding to the registration and FLAGS are the NetBIOS flags for the registration.

    -A typical dynamic entry looks like: +A typical dynamic entry looks like this: 

    -"MADMAN#03" 1055298378 192.168.1.2 66R
+"MADMAN#03" 1055298378 192.168.1.2 66R

    -To make it static, all that has to be done is set the TTL to 0: +To make it static, all that has to be done is set the TTL to 0, like this: 

    -"MADMAN#03" 0 192.168.1.2 66R
+"MADMAN#03" 0 192.168.1.2 66R

    -Though this method works with early Samba-3 versions, there's a +Though this method works with early Samba-3 versions, there is a possibility that it may change in future versions if WINS replication is added. -

    Helpful Hints

    +

    Helpful Hints

    The following hints should be carefully considered as they are stumbling points for many new network administrators. -

    Windows Networking Protocols

    Warning

    -Do NOT use more than one (1) protocol on MS Windows machines +

    Windows Networking Protocols

    Warning

    +Do not use more than one protocol on MS Windows machines.

    -A very common cause of browsing problems results from installing more than +A common cause of browsing problems results from installing more than one protocol on an MS Windows machine.

    Every NetBIOS machine takes part in a process of electing the LMB (and DMB) every 15 minutes. A set of election criteria is used to determine the order of precedence for winning this election process. A machine running Samba or -Windows NT will be biased so that the most suitable machine will predictably -win and thus retain it's role. +Windows NT will be biased so the most suitable machine will predictably +win and thus retain its role.

    -The election process is "fought out" so to speak over every NetBIOS network -interface. In the case of a Windows 9x machine that has both TCP/IP and IPX -installed and has NetBIOS enabled over both protocols the election will be -decided over both protocols. As often happens, if the Windows 9x machine is +The election process is “fought out” so to speak over every NetBIOS network +interface. In the case of a Windows 9x/Me machine that has both TCP/IP and IPX +installed and has NetBIOS enabled over both protocols, the election will be +decided over both protocols. As often happens, if the Windows 9x/Me machine is the only one with both protocols then the LMB may be won on the NetBIOS interface over the IPX protocol. Samba will then lose the LMB role as Windows -9x will insist it knows who the LMB is. Samba will then cease to function -as an LMB and thus browse list operation on all TCP/IP only machines will +9x/Me will insist it knows who the LMB is. Samba will then cease to function +as an LMB and thus browse list operation on all TCP/IP-only machines will fail. -

    -Windows 95, 98, 98se, Me are referred to generically as Windows 9x. -The Windows NT4, 2000, XP and 2003 use common protocols. These are roughly -referred to as the WinNT family, but it should be recognised that 2000 and +

    +Windows 95, 98, 98se, and Me are referred to generically as Windows 9x/Me. +The Windows NT4, 200x, and XP use common protocols. These are roughly +referred to as the Windows NT family, but it should be recognized that 2000 and XP/2003 introduce new protocol extensions that cause them to behave -differently from MS Windows NT4. Generally, where a server does NOT support +differently from MS Windows NT4. Generally, where a server does not support the newer or extended protocol, these will fall back to the NT4 protocols. -

    -The safest rule of all to follow it this - USE ONLY ONE PROTOCOL! -

    Name Resolution Order

    +

    +The safest rule of all to follow is: use only one protocol! +

    Name Resolution Order

    Resolution of NetBIOS names to IP addresses can take place using a number of methods. The only ones that can provide NetBIOS name_type information are: -

    • WINS: the best tool!

    • LMHOSTS: is static and hard to maintain.

    • Broadcast: uses UDP and can not resolve names across remote segments.

    -Alternative means of name resolution includes: -

    • /etc/hosts: is static, hard to maintain, and lacks name_type info

    • DNS: is a good choice but lacks essential name_type info.

    -Many sites want to restrict DNS lookups and want to avoid broadcast name +

    • WINS the best tool.
    • LMHOSTS static and hard to maintain.
    • Broadcast uses UDP and cannot resolve names across remote segments.

    +Alternative means of name resolution include: +

    • Static /etc/hosts hard to maintain, and lacks name_type info.
    • DNS is a good choice but lacks essential name_type info.

    +Many sites want to restrict DNS lookups and avoid broadcast name resolution traffic. The name resolve order parameter is of great help here. The syntax of the name resolve order parameter is:

    name resolve order = wins lmhosts bcast host

    @@ -648,260 +612,289 @@ The syntax of the name resolve order parameter

    name resolve order = wins lmhosts (eliminates bcast and host)

    The default is:

    name resolve order = host lmhost wins bcast

    -where "host" refers to the native methods used by the UNIX system +where “host” refers to the native methods used by the UNIX system to implement the gethostbyname() function call. This is normally controlled by /etc/host.conf, /etc/nsswitch.conf and /etc/resolv.conf. -

    Technical Overview of browsing

    +

    Technical Overview of Browsing

    SMB networking provides a mechanism by which clients can access a list -of machines in a network, a so-called browse list. This list +of machines in a network, a so-called browse list. This list contains machines that are ready to offer file and/or print services to other machines within the network. Thus it does not include -machines which aren't currently able to do server tasks. The browse -list is heavily used by all SMB clients. Configuration of SMB +machines that aren't currently able to do server tasks. The browse +list is heavily used by all SMB clients. Configuration of SMB browsing has been problematic for some Samba users, hence this document.

    -MS Windows 2000 and later, as with Samba 3 and later, can be +MS Windows 2000 and later versions, as with Samba-3 and later versions, can be configured to not use NetBIOS over TCP/IP. When configured this way, it is imperative that name resolution (using DNS/LDAP/ADS) be correctly -configured and operative. Browsing will NOT work if name resolution +configured and operative. Browsing will not work if name resolution from SMB machine names to IP addresses does not function correctly.

    -Where NetBIOS over TCP/IP is enabled use of a WINS server is highly +Where NetBIOS over TCP/IP is enabled, use of a WINS server is highly recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. WINS allows remote segment clients to obtain NetBIOS name_type information -that can NOT be provided by any other means of name resolution. -

    Browsing support in Samba

    -Samba facilitates browsing. The browsing is supported by nmbd +that cannot be provided by any other means of name resolution. +

    Browsing Support in Samba

    +Samba facilitates browsing. The browsing is supported by nmbd and is also controlled by options in the smb.conf file. Samba can act as a local browse master for a workgroup and the ability to support domain logons and scripts is now available.

    -Samba can also act as a domain master browser for a workgroup. This -means that it will collate lists from local browse masters into a -wide area network server list. In order for browse clients to +Samba can also act as a Domain Master Browser for a workgroup. This +means that it will collate lists from Local Master Browsers into a +wide area network server list. In order for browse clients to resolve the names they may find in this list, it is recommended that both Samba and your clients use a WINS server.

    -Note that you should NOT set Samba to be the domain master for a -workgroup that has the same name as an NT Domain: on each wide area -network, you must only ever have one domain master browser per workgroup, -regardless of whether it is NT, Samba or any other type of domain master -that is providing this service. +Do not set Samba to be the Domain Master for a workgroup that has the same +name as an NT Domain. On each wide area network, you must only ever have one +Domain Master Browser per workgroup, regardless of whether it is NT, Samba +or any other type of domain master that is providing this service.

    Note

    -Nmbd can be configured as a WINS server, but it is not -necessary to specifically use Samba as your WINS server. MS Windows -NT4, Server or Advanced Server 2000 or 2003 can be configured as -your WINS server. In a mixed NT/2000/2003 server and Samba environment on +nmbd can be configured as a WINS server, but it is not +necessary to specifically use Samba as your WINS server. MS Windows +NT4, Server or Advanced Server 200x can be configured as +your WINS server. In a mixed NT/200x server and Samba environment on a Wide Area Network, it is recommended that you use the Microsoft -WINS server capabilities. In a Samba-only environment, it is -recommended that you use one and only one Samba server as your WINS server. +WINS server capabilities. In a Samba-only environment, it is +recommended that you use one and only one Samba server as the WINS server.

    To get browsing to work you need to run nmbd as usual, but will need -to use the workgroup option in smb.conf +to use the workgroup option in smb.conf to control what workgroup Samba becomes a part of.

    Samba also has a useful option for a Samba server to offer itself for -browsing on another subnet. It is recommended that this option is only -used for 'unusual' purposes: announcements over the internet, for -example. See remote announce in the -smb.conf man page. -

    Problem resolution

    -If something doesn't work then hopefully the log.nmbd file will help -you track down the problem. Try a debug level of 2 or 3 for finding +browsing on another subnet. It is recommended that this option is only +used for “unusual” purposes: announcements over the Internet, for +example. See remote announce in the +smb.conf man page. +

    Problem Resolution

    +If something does not work, the log.nmbd file will help +to track down the problem. Try a log level of 2 or 3 for finding problems. Also note that the current browse list usually gets stored in text form in a file called browse.dat.

    -Note that if it doesn't work for you, then you should still be able to -type the server name as \\SERVER in filemanager then -hit enter and filemanager should display the list of available shares. -

    -Some people find browsing fails because they don't have the global -guest account set to a valid account. Remember that the -IPC$ connection that lists the shares is done as guest, and thus you must -have a valid guest account. -

    -MS Windows 2000 and upwards (as with Samba) can be configured to disallow -anonymous (ie: Guest account) access to the IPC$ share. In that case, the +If it does not work, you should still be able to +type the server name as \\SERVER in filemanager, then +press enter and filemanager should display the list of available shares. +

    +Some people find browsing fails because they do not have the global +guest account set to a valid account. Remember that the +IPC$ connection that lists the shares is done as guest and, thus, you must have a valid guest account. +

    +MS Windows 2000 and later (as with Samba) can be configured to disallow +anonymous (i.e., guest account) access to the IPC$ share. In that case, the MS Windows 2000/XP/2003 machine acting as an SMB/CIFS client will use the -name of the currently logged in user to query the IPC$ share. MS Windows -9X clients are not able to do this and thus will NOT be able to browse +name of the currently logged-in user to query the IPC$ share. MS Windows +9x/Me clients are not able to do this and thus will not be able to browse server resources. -

    +

    The other big problem people have is that their broadcast address, -netmask or IP address is wrong (specified with the "interfaces" option +netmask or IP address is wrong (specified with the interfaces option in smb.conf) -

    Browsing across subnets

    -Since the release of Samba 1.9.17(alpha1), Samba has supported the +

    Cross-Subnet Browsing

    + +Since the release of Samba 1.9.17 (alpha1), Samba has supported the replication of browse lists across subnet boundaries. This section describes how to set this feature up in different settings.

    -To see browse lists that span TCP/IP subnets (ie. networks separated -by routers that don't pass broadcast traffic), you must set up at least -one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing -NetBIOS name to IP address translation to be done by doing a direct -query of the WINS server. This is done via a directed UDP packet on -port 137 to the WINS server machine. The reason for a WINS server is -that by default, all NetBIOS name to IP address translation is done -by broadcasts from the querying machine. This means that machines +To see browse lists that span TCP/IP subnets (i.e., networks separated +by routers that do not pass broadcast traffic), you must set up at least +one WINS server. The WINS server acts as a DNS for NetBIOS names. This will +allow NetBIOS name-to-IP address translation to be completed by a direct +query of the WINS server. This is done via a directed UDP packet on +port 137 to the WINS server machine. The WINS server avoids the necessity +of default NetBIOS name-to-IP address translation, which is done +using UDP broadcasts from the querying machine. This means that machines on one subnet will not be able to resolve the names of machines on another subnet without using a WINS server.

    Remember, for browsing across subnets to work correctly, all machines, -be they Windows 95, Windows NT, or Samba servers must have the IP address +be they Windows 95, Windows NT or Samba servers, must have the IP address of a WINS server given to them by a DHCP server, or by manual configuration -(for Win95 and WinNT, this is in the TCP/IP Properties, under Network -settings) for Samba this is in the smb.conf file. -

    How does cross subnet browsing work ?

    -Cross subnet browsing is a complicated dance, containing multiple -moving parts. It has taken Microsoft several years to get the code +(for Windows 9x/Me and Windows NT/200x/XP, this is in the TCP/IP Properties, under Network +settings); for Samba, this is in the smb.conf file. +

    Behavior of Cross-Subnet Browsing

    +Cross-subnet Browsing is a complicated dance, containing multiple +moving parts. It has taken Microsoft several years to get the code that achieves this correct, and Samba lags behind in some areas. -Samba is capable of cross subnet browsing when configured correctly. -

    - Consider a network set up as in the diagram below. -

    Figure 10.1. Cross subnet browsing example

    Cross subnet browsing example

    -Consisting of 3 subnets (1, 2, 3) connected by two routers -(R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines -on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume -for the moment that all these machines are configured to be in the -same workgroup (for simplicity's sake). Machine N1_C on subnet 1 -is configured as Domain Master Browser (ie. it will collate the -browse lists for the workgroup). Machine N2_D is configured as +Samba is capable of cross-subnet browsing when configured correctly. +

    +Consider a network set up as . +

    Figure 10.1. Cross-Subnet Browsing Example.

    Cross-Subnet Browsing Example.

    +This consists of 3 subnets (1, 2, 3) connected by two routers +(R1, R2) which do not pass broadcasts. Subnet 1 has five machines +on it, subnet 2 has four machines, subnet 3 has four machines. Assume +for the moment that all machines are configured to be in the +same workgroup (for simplicity's sake). Machine N1_C on subnet 1 +is configured as Domain Master Browser (i.e., it will collate the +browse lists for the workgroup). Machine N2_D is configured as WINS server and all the other machines are configured to register their NetBIOS names with it.

    -As all these machines are booted up, elections for master browsers -will take place on each of the three subnets. Assume that machine +As these machines are booted up, elections for master browsers +will take place on each of the three subnets. Assume that machine N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on -subnet 3 - these machines are known as local master browsers for -their particular subnet. N1_C has an advantage in winning as the -local master browser on subnet 1 as it is set up as Domain Master +subnet 3. These machines are known as Local Master Browsers for +their particular subnet. N1_C has an advantage in winning as the +Local Master Browser on subnet 1 as it is set up as Domain Master Browser.

    On each of the three networks, machines that are configured to offer sharing services will broadcast that they are offering -these services. The local master browser on each subnet will +these services. The Local Master Browser on each subnet will receive these broadcasts and keep a record of the fact that -the machine is offering a service. This list of records is -the basis of the browse list. For this case, assume that -all the machines are configured to offer services so all machines +the machine is offering a service. This list of records is +the basis of the browse list. For this case, assume that +all the machines are configured to offer services, so all machines will be on the browse list.

    -For each network, the local master browser on that network is -considered 'authoritative' for all the names it receives via -local broadcast. This is because a machine seen by the local -master browser via a local broadcast must be on the same -network as the local master browser and thus is a 'trusted' -and 'verifiable' resource. Machines on other networks that -the local master browsers learn about when collating their -browse lists have not been directly seen - these records are -called 'non-authoritative'. +For each network, the Local Master Browser on that network is +considered “authoritative” for all the names it receives via +local broadcast. This is because a machine seen by the Local Master +Browser via a local broadcast must be on the same network as the +Local Master Browser and thus is a “trusted” +and “verifiable” resource. Machines on other networks that +the Local Master Browsers learn about when collating their +browse lists have not been directly seen. These records are +called “non-authoritative.”

    -At this point the browse lists look as follows (these are -the machines you would see in your network neighborhood if -you looked in it on a particular network right now). +At this point the browse lists appear as shown in (these are +the machines you would see in your network neighborhood if you looked in it on a particular network right now).

    -

    Table 10.1. Browse subnet example 1

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    +

    Table 10.1. Browse Subnet Example 1

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    -Note that at this point all the subnets are separate, no -machine is seen across any of the subnets. +At this point all the subnets are separate, and no machine is seen across any of the subnets.

    -Now examine subnet 2. As soon as N2_B has become the local -master browser it looks for a Domain master browser to synchronize -its browse list with. It does this by querying the WINS server +Now examine subnet 2. As soon as N2_B has become the Local +Master Browser it looks for a Domain Master Browser with which to synchronize +its browse list. It does this by querying the WINS server (N2_D) for the IP address associated with the NetBIOS name -WORKGROUP<1B>. This name was registered by the Domain master -browser (N1_C) with the WINS server as soon as it was booted. +WORKGROUP<1B>. This name was registered by the Domain Master +Browser (N1_C) with the WINS server as soon as it was started.

    -Once N2_B knows the address of the Domain master browser it -tells it that is the local master browser for subnet 2 by -sending a MasterAnnouncement packet as a UDP port 138 packet. -It then synchronizes with it by doing a NetServerEnum2 call. This +Once N2_B knows the address of the Domain Master Browser, it +tells it that is the Local Master Browser for subnet 2 by +sending a MasterAnnouncement packet as a UDP port 138 packet. +It then synchronizes with it by doing a NetServerEnum2 call. This tells the Domain Master Browser to send it all the server -names it knows about. Once the domain master browser receives -the MasterAnnouncement packet it schedules a synchronization -request to the sender of that packet. After both synchronizations -are done the browse lists look like : -

    -

    Table 10.2. Browse subnet example 2

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +names it knows about. Once the Domain Master Browser receives +the MasterAnnouncement packet, it schedules a synchronization +request to the sender of that packet. After both synchronizations +are complete the browse lists look as shown in : +

    Table 10.2. Browse Subnet Example 2

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    - -Servers with a (*) after them are non-authoritative names. +Servers with an (*) after them are non-authoritative names.

    At this point users looking in their network neighborhood on subnets 1 or 2 will see all the servers on both, users on subnet 3 will still only see the servers on their own subnet.

    The same sequence of events that occurred for N2_B now occurs -for the local master browser on subnet 3 (N3_D). When it -synchronizes browse lists with the domain master browser (N1_A) +for the Local Master Browser on subnet 3 (N3_D). When it +synchronizes browse lists with the Domain Master Browser (N1_A) it gets both the server entries on subnet 1, and those on -subnet 2. After N3_D has synchronized with N1_C and vica-versa -the browse lists look like. -

    -

    Table 10.3. Browse subnet example 3

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +subnet 2. After N3_D has synchronized with N1_C and vica versa, +the browse lists will appear as shown in . +

    Table 10.3. Browse Subnet Example 3

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)

    - -Servers with a (*) after them are non-authoritative names. +Servers with an (*) after them are non-authoritative names.

    -At this point users looking in their network neighborhood on -subnets 1 or 3 will see all the servers on all subnets, users on +At this point, users looking in their network neighborhood on +subnets 1 or 3 will see all the servers on all subnets, while users on subnet 2 will still only see the servers on subnets 1 and 2, but not 3.

    -Finally, the local master browser for subnet 2 (N2_B) will sync again -with the domain master browser (N1_C) and will receive the missing -server entries. Finally - and as a steady state (if no machines -are removed or shut off) the browse lists will look like : -

    -

    Table 10.4. Browse subnet example 4

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +Finally, the Local Master Browser for subnet 2 (N2_B) will sync again +with the Domain Master Browser (N1_C) and will receive the missing +server entries. Finally, as when a steady state (if no machines +are removed or shut off) has been achieved, the browse lists will appear +as shown in . +

    Table 10.4. Browse Subnet Example 4

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)

    - -Servers with a (*) after them are non-authoritative names. +Servers with an (*) after them are non-authoritative names.

    -Synchronizations between the domain master browser and local -master browsers will continue to occur, but this should be a -steady state situation. +Synchronizations between the Domain Master Browser and Local +Master Browsers will continue to occur, but this should remain a +steady state operation.

    -If either router R1 or R2 fails the following will occur: +If either router R1 or R2 fails, the following will occur:

    1. Names of computers on each side of the inaccessible network fragments - will be maintained for as long as 36 minutes, in the network neighbourhood + will be maintained for as long as 36 minutes in the network neighborhood lists.

    2. Attempts to connect to these inaccessible computers will fail, but the - names will not be removed from the network neighbourhood lists. + names will not be removed from the network neighborhood lists.

    3. If one of the fragments is cut off from the WINS server, it will only - be able to access servers on its local subnet, by using subnet-isolated - broadcast NetBIOS name resolution. The effects are similar to that of + be able to access servers on its local subnet using subnet-isolated + broadcast NetBIOS name resolution. The effects are similar to that of losing access to a DNS server. -

    Common Errors

    +

    Common Errors

    Many questions are asked on the mailing lists regarding browsing. The majority of browsing -problems originate out of incorrect configuration of NetBIOS name resolution. Some are of +problems originate from incorrect configuration of NetBIOS name resolution. Some are of particular note. -

    How can one flush the Samba NetBIOS name cache without restarting Samba?

    -Samba's nmbd process controls all browse list handling. Under normal circumstances it is -safe to restart nmbd. This will effectively flush the Samba NetBIOS name cache and cause it -to be rebuilt. Note that this does NOT make certain that a rogue machine name will not re-appear -in the browse list. When nmbd is taken out of service another machine on the network will -become the browse master. This new list may still have the rogue entry in it. If you really -want to clear a rogue machine from the list then every machine on the network will need to be -shut down and restarted at after all machines are down. Failing a complete restart, the only +

    How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?

    + +Samba's nmbd process controls all browse list handling. Under normal circumstances it is +safe to restart nmbd. This will effectively flush the Samba NetBIOS name cache and cause it +to be rebuilt. This does not make certain that a rogue machine name will not re-appear +in the browse list. When nmbd is taken out of service, another machine on the network will +become the Browse Master. This new list may still have the rogue entry in it. If you really +want to clear a rogue machine from the list, every machine on the network will need to be +shut down and restarted after all machines are down. Failing a complete restart, the only other thing you can do is wait until the entry times out and is then flushed from the list. -This may take a long time on some networks (months). -

    My client reports "This server is not configured to list shared resources"

    +This may take a long time on some networks (perhaps months). +

    Server Resources Can Not Be Listed

    “My Client Reports ‘This server is not configured to list shared resources’”

    Your guest account is probably invalid for some reason. Samba uses the -guest account for browsing in smbd. Check that your guest account is +guest account for browsing in smbd. Check that your guest account is valid. -

    See also guest account in the smb.conf man page.

    I get an Unable to browse the network error

    This error can have multiple causes:

    • There is no local master browser. Configure nmbd - or any other machine to serve as local master browser.

    • You can not log onto the machine that is the local master - browser. Can you logon to it as guest user?

    • There is no IP connectivity to the local master browser. - Can you reach it by broadcast?

    Prev Up Next
    Part III. Advanced Configuration Home Chapter 11. Account Information Databases
    +

    Also see guest account in the smb.conf man page.

    I get an `Unable to browse the network' error

    This error can have multiple causes: + +

    • There is no Local Master Browser. Configure nmbd + or any other machine to serve as Local Master Browser.

    • You cannot log onto the machine that is the local master + browser. Can you logon to it as a guest user?

    • There is no IP connectivity to the Local Master Browser. + Can you reach it by broadcast?

    Browsing of Shares and Directories is Very Slow

    “ + +There are only two machines on a test network. One a Samba server, the other a Windows XP machine. +Authentication and logons work perfectly, but when I try to explore shares on the Samba server, the +Windows XP client becomes unrespsonsive. Sometimes it does not respond for some minutes. Eventually, +Windows Explorer will respond and displays files and directories without problem. +display file and directory.” +

    “ +But, the share is immediately available from a command shell (cmd, followed by +exploration with dos command. Is this a Samba problem or is it a Windows problem? How can I solve this? +”

    +Here are a few possibilities: +

    Bad Networking Hardware

    + + + Most common defective hardware problems center around low cost or defective HUBs, routers, + Network Interface Controllers (NICs) and bad wiring. If one piece of hardware is defective + the whole network may suffer. Bad networking hardware can cause data corruption. Most bad + networking hardware problems are accompanied by an increase in apparent network traffic, + but not all. +

    The Windows XP WebClient

    + A number of sites have reported similar slow network browsing problems and found that when + the WebClient service is turned off, the problem dissapears. This is certainly something + that should be explored as it is a simple solution if it works. +

    Inconsistent WINS Configuration

    + This type of problem is common when one client is configured to use a WINS server (that is + a TCP/IP configuration setting) and there is no WINS server on the network. Alternately, + this will happen is there is a WINS server and Samba is not configured to use it. The use of + WINS is highly recommended if the network is using NetBIOS over TCP/IP protocols. If use + of NetBIOS over TCP/IP is disabled on all clients, Samba should not be configured as a WINS + server neither should it be configured to use one. +

    Incorrect DNS Configuration

    + If use of NetBIOS over TCP/IP is disabled, Active Directory is in use and the DNS server + has been incorrectly configured. Refer for more information. +

    Prev Up Next
    Part III. Advanced Configuration Home Chapter 11. Account Information Databases
    diff --git a/docs/htmldocs/Other-Clients.html b/docs/htmldocs/Other-Clients.html index dffa1122ac..9e3c643103 100644 --- a/docs/htmldocs/Other-Clients.html +++ b/docs/htmldocs/Other-Clients.html @@ -1,80 +1,66 @@ -Chapter 38. Samba and other CIFS clients
    Chapter 38. Samba and other CIFS clients
    Prev Part VI. Appendixes Next

    Chapter 38. Samba and other CIFS clients

    Jelmer R. Vernooij

    The Samba Team

    Jim McDonough

    OS/2
    IBM

    5 Mar 2001

    Table of Contents

    Macintosh clients?
    OS2 Client
    Configuring OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba
    Configuring OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba
    Printer driver download for for OS/2 clients?
    Windows for Workgroups
    Latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configuring WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1

    This chapter contains client-specific information.

    Macintosh clients?

    - Yes. Thursby now has a CIFS Client / Server called DAVE -

    -They test it against Windows 95, Windows NT and samba for -compatibility issues. At the time of writing, DAVE was at version -1.0.1. The 1.0.0 to 1.0.1 update is available as a free download from -the Thursby web site (the speed of finder copies has been greatly -enhanced, and there are bug-fixes included). +Chapter 38. Samba and Other CIFS Clients

    Chapter 38. Samba and Other CIFS Clients
    Prev Part VI. Appendixes Next

    Chapter 38. Samba and Other CIFS Clients

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Dan Shearer

    Samba Team

    Jim McDonough

    OS/2
    IBM

    5 Mar 2001

    Table of Contents

    Macintosh Clients
    OS2 Client
    Configuring OS/2 Warp Connect or OS/2 Warp 4
    Configuring Other Versions of OS/2
    Printer Driver Download for OS/2 Clients
    Windows for Workgroups
    Latest TCP/IP Stack from Microsoft
    Delete .pwl Files After Password Change
    Configuring Windows for Workgroups Password Handling
    Password Case Sensitivity
    Use TCP/IP as Default Protocol
    Speed Improvement
    Windows 95/98
    Speed Improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1

    This chapter contains client-specific information.

    Macintosh Clients

    +Yes. Thursby has a CIFS Client/Server called DAVE. +They test it against Windows 95, Windows NT /200x/XP and Samba for +compatibility issues. At the time of this writing, DAVE was at version +4.1. Please refer to Thursby's Web site for more information regarding this +product.

    -Alternatives - There are two free implementations of AppleTalk for -several kinds of UNIX machines, and several more commercial ones. +Alternatives There are two free implementations of AppleTalk for +several kinds of UNIX machines and several more commercial ones. These products allow you to run file services and print services natively to Macintosh users, with no additional support required on -the Macintosh. The two free implementations are -Netatalk, and -CAP. -What Samba offers MS -Windows users, these packages offer to Macs. For more info on these -packages, Samba, and Linux (and other UNIX-based systems) see -http://www.eats.com/linux_mac_win.html -

    Newer versions of the Macintosh (Mac OS X) include Samba.

    OS2 Client

    Configuring OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba

    Basically, you need three components:

    • The File and Print Client ('IBM Peer')

    • TCP/IP ('Internet support')

    • The "NetBIOS over TCP/IP" driver ('TCPBEUI')

    Installing the first two together with the base operating +the Macintosh. The two free implementations are +Netatalk, and +CAP. +What Samba offers MS Windows users, these packages offer to Macs. +For more info on these packages, Samba, and Linux (and other UNIX-based systems), see +http://www.eats.com/linux_mac_win.html. +

    Newer versions of the Macintosh (Mac OS X) include Samba.

    OS2 Client

    Configuring OS/2 Warp Connect or OS/2 Warp 4

    Basically, you need three components:

    • The File and Print Client (IBM Peer)
    • TCP/IP (Internet support)
    • The “NetBIOS over TCP/IP” driver (TCPBEUI)

    Installing the first two together with the base operating system on a blank system is explained in the Warp manual. If Warp has already been installed, but you now want to install the - networking support, use the "Selective Install for Networking" - object in the "System Setup" folder.

    Adding the "NetBIOS over TCP/IP" driver is not described + networking support, use the “Selective Install for Networking” + object in the “System Setup” folder.

    Adding the “NetBIOS over TCP/IP” driver is not described in the manual and just barely in the online documentation. Start - MPTS.EXE, click on OK, click on "Configure LAPS" and click - on "IBM OS/2 NETBIOS OVER TCP/IP" in 'Protocols'. This line - is then moved to 'Current Configuration'. Select that line, - click on "Change number" and increase it from 0 to 1. Save this - configuration.

    If the Samba server(s) is not on your local subnet, you + MPTS.EXE, click on OK, click on Configure LAPS and click + on IBM OS/2 NETBIOS OVER TCP/IP in Protocols. This line + is then moved to Current Configuration. Select that line, + click on Change number and increase it from 0 to 1. Save this + configuration.

    If the Samba server is not on your local subnet, you can optionally add IP names and addresses of these servers - to the "Names List", or specify a WINS server ('NetBIOS - Nameserver' in IBM and RFC terminology). For Warp Connect you - may need to download an update for 'IBM Peer' to bring it on - the same level as Warp 4. See the webpage mentioned above.

    Configuring OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba

    You can use the free Microsoft LAN Manager 2.2c Client - for OS/2 from - - ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/. - In - a nutshell, edit the file \OS2VER in the root directory of - the OS/2 boot partition and add the lines:

    +		to the Names List, or specify a  WINS server (NetBIOS 
+		Nameserver in IBM and RFC terminology). For Warp Connect, you 
+		may need to download an update for IBM Peer to bring it on 
+		the same level as Warp 4. See the Web page mentioned above.

    Configuring Other Versions of OS/2

    This sections deals with configuring OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x.

    You can use the free Microsoft LAN Manager 2.2c Client for OS/2 that is + available from + + ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/. In a nutshell, edit + the file \OS2VER in the root directory of the OS/2 boot partition and add the lines:

     		20=setup.exe
 		20=netwksta.sys
 		20=netvdd.sys
-

    before you install the client. Also, don't use the - included NE2000 driver because it is buggy. Try the NE2000 - or NS2000 driver from - - ftp://ftp.cdrom.com/pub/os2/network/ndis/ instead. -

    Printer driver download for for OS/2 clients?

    First, create a share called [PRINTDRV] that is - world-readable. Copy your OS/2 driver files there. Note - that the .EA_ files must still be separate, so you will need - to use the original install files, and not copy an installed - driver from an OS/2 system.

    Install the NT driver first for that printer. Then, - add to your smb.conf a parameter, os2 driver map = filename. Then, in the file - specified by filename, map the - name of the NT driver name to the OS/2 driver name as - follows:

    nt driver name = os2 driver name.device name, e.g.:

    +

    before you install the client. Also, do not use the included NE2000 driver because it is buggy. + Try the NE2000 or NS2000 driver from + ftp://ftp.cdrom.com/pub/os2/network/ndis/ instead. +

    Printer Driver Download for OS/2 Clients

    Create a share called [PRINTDRV] that is + world-readable. Copy your OS/2 driver files there. The .EA_ + files must still be separate, so you will need to use the original install files + and not copy an installed driver from an OS/2 system.

    Install the NT driver first for that printer. Then, add to your smb.conf a parameter, + os2 driver map = filename. + Next, in the file specified by filename, map the + name of the NT driver name to the OS/2 driver name as follows:

    nt driver name = os2 driver name.device name, e.g.

    HP LaserJet 5L = LASERJET.HP LaserJet 5L

    You can have multiple drivers mapped in this file.

    If you only specify the OS/2 driver name, and not the device name, the first attempt to download the driver will actually download the files, but the OS/2 client will tell - you the driver is not available. On the second attempt, it - will work. This is fixed simply by adding the device name + you the driver is not available. On the second attempt, it + will work. This is fixed simply by adding the device name to the mapping, after which it will work on the first attempt. -

    Windows for Workgroups

    Latest TCP/IP stack from Microsoft

    Use the latest TCP/IP stack from Microsoft if you use Windows -for Workgroups. -

    The early TCP/IP stacks had lots of bugs.

    -Microsoft has released an incremental upgrade to their TCP/IP 32-Bit -VxD drivers. The latest release can be found on their ftp site at +

    Windows for Workgroups

    Latest TCP/IP Stack from Microsoft

    Use the latest TCP/IP stack from Microsoft if you use Windows +for Workgroups. The early TCP/IP stacks had lots of bugs.

    +Microsoft has released an incremental upgrade to their TCP/IP 32-bit +VxD drivers. The latest release can be found on their ftp site at ftp.microsoft.com, located in /peropsys/windows/public/tcpip/wfwt32.exe. There is an update.txt file there that describes the problems that were -fixed. New files include WINSOCK.DLL, +fixed. New files include WINSOCK.DLL, TELNET.EXE, WSOCK.386, VNBT.386, @@ -82,91 +68,93 @@ fixed. New files include WINSOCK.DLL, TRACERT.EXE, NETSTAT.EXE, and NBTSTAT.EXE. -

    Delete .pwl files after password change

    -WfWg does a lousy job with passwords. I find that if I change my -password on either the unix box or the PC the safest thing to do is to -delete the .pwl files in the windows directory. The PC will complain about not finding the files, but will soon get over it, allowing you to enter the new password. +

    Delete .pwl Files After Password Change

    +Windows for Workgroups does a lousy job with passwords. When you change passwords on either +the UNIX box or the PC, the safest thing to do is to delete the .pwl files in the Windows +directory. The PC will complain about not finding the files, but will soon get over it, +allowing you to enter the new password.

    -If you don't do this you may find that WfWg remembers and uses the old +If you do not do this, you may find that Windows for Workgroups remembers and uses the old password, even if you told it a new one.

    -Often WfWg will totally ignore a password you give it in a dialog box. -

    Configuring WfW password handling

    -There is a program call admincfg.exe -on the last disk (disk 8) of the WFW 3.11 disk set. To install it +Often Windows for Workgroups will totally ignore a password you give it in a dialog box. +

    Configuring Windows for Workgroups Password Handling

    +There is a program call admincfg.exe +on the last disk (disk 8) of the WFW 3.11 disk set. To install it, type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE. -Then add an icon -for it via the Program Manager New Menu. -This program allows you to control how WFW handles passwords. ie disable Password Caching etc -for use with security = user -

    Case handling of passwords

    Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf information on password level to specify what characters samba should try to uppercase when checking.

    Use TCP/IP as default protocol

    To support print queue reporting you may find +Then add an icon for it via the Program Manager New Menu. +This program allows you to control how WFW handles passwords, i.e., +Disable Password Caching and so on. +for use with security = user. +

    Password Case Sensitivity

    Windows for Workgroups uppercases the password before sending it to the server. +UNIX passwords can be case-sensitive though. Check the smb.conf information on +password level to specify what characters +Samba should try to uppercase when checking.

    Use TCP/IP as Default Protocol

    To support print queue reporting, you may find that you have to use TCP/IP as the default protocol under -WfWg. For some reason if you leave NetBEUI as the default +Windows for Workgroups. For some reason, if you leave NetBEUI as the default, it may break the print queue reporting on some systems. -It is presumably a WfWg bug.

    Speed improvement

    +It is presumably a Windows for Workgroups bug.

    Speed Improvement

    Note that some people have found that setting DefaultRcvWindow in the [MSTCP] section of the -SYSTEM.INI file under WfWg to 3072 gives a -big improvement. I don't know why. +SYSTEM.INI file under Windows for Workgroups to 3072 gives a +big improvement.

    -My own experience with DefaultRcvWindow is that I get much better +My own experience with DefaultRcvWindow is that I get a much better performance with a large value (16384 or larger). Other people have reported that anything over 3072 slows things down enormously. One person even reported a speed drop of a factor of 30 when he went from -3072 to 8192. I don't know why. -

    Windows '95/'98

    -When using Windows 95 OEM SR2 the following updates are recommended where Samba -is being used. Please NOTE that the above change will affect you once these +3072 to 8192. +

    Windows 95/98

    +When using Windows 95 OEM SR2, the following updates are recommended where Samba +is being used. Please note that the above change will effect you once these updates have been installed.

    There are more updates than the ones mentioned here. You are referred to the Microsoft Web site for all currently available updates to your specific version of Windows 95.

    Kernel Update: KRNLUPD.EXE
    Ping Fix: PINGUPD.EXE
    RPC Update: RPCRTUPD.EXE
    TCP/IP Update: VIPUPD.EXE
    Redirector Update: VRDRUPD.EXE

    -Also, if using MS Outlook it is desirable to +Also, if using MS Outlook, it is desirable to install the OLEUPD.EXE fix. This fix may stop your machine from hanging for an extended period when exiting -Outlook and you may also notice a significant speedup when accessing network +Outlook and you may notice a significant speedup when accessing network neighborhood services. -

    Speed improvement

    -Configure the win95 TCPIP registry settings to give better -performance. I use a program called MTUSPEED.exe which I got off the -net. There are various other utilities of this type freely available. -

    Windows 2000 Service Pack 2

    +

    Speed Improvement

    +Configure the Windows 95 TCP/IP registry settings to give better +performance. I use a program called MTUSPEED.exe that I got off the +Internet. There are various other utilities of this type freely available. +

    Windows 2000 Service Pack 2

    There are several annoyances with Windows 2000 SP2. One of which only appears when using a Samba server to host user profiles -to Windows 2000 SP2 clients in a Windows domain. This assumes +to Windows 2000 SP2 clients in a Windows domain. This assumes that Samba is a member of the domain, but the problem will -likely occur if it is not. +most likely occur if it is not.

    In order to serve profiles successfully to Windows 2000 SP2 clients (when not operating as a PDC), Samba must have -nt acl support = no +nt acl support = no added to the file share which houses the roaming profiles. If this is not done, then the Windows 2000 SP2 client will complain about not being able to access the profile (Access Denied) and create multiple copies of it on disk (DOMAIN.user.001, -DOMAIN.user.002, etc...). See the -smb.conf man page -for more details on this option. Also note that the -nt acl support parameter was formally a global parameter in +DOMAIN.user.002, and so on). See the smb.conf man page +for more details on this option. Also note that the +nt acl support parameter was formally a global parameter in releases prior to Samba 2.2.2.

    -The following is a minimal profile share: -

    Example 38.1. Minimal profile share

    [profile]
    path = /export/profile
    create mask = 0600
    directory mask = 0700
    nt acl support = no
    read only = no

    -The reason for this bug is that the Win2k SP2 client copies -the security descriptor for the profile which contains -the Samba server's SID, and not the domain SID. The client + provides a minimal profile share. +

    Example 38.1. Minimal profile share

    [profile]
    path = /export/profile
    create mask = 0600
    directory mask = 0700
    nt acl support = no
    read only = no

    +The reason for this bug is that the Windows 200x SP2 client copies +the security descriptor for the profile that contains +the Samba server's SID, and not the domain SID. The client compares the SID for SAMBA\user and realizes it is -different that the one assigned to DOMAIN\user. Hence the reason +different from the one assigned to DOMAIN\user. Hence, the reason for the access denied message.

    -By disabling the nt acl support parameter, Samba will send -the Win2k client a response to the QuerySecurityDescriptor -trans2 call which causes the client to set a default ACL -for the profile. This default ACL includes -

    DOMAIN\user "Full Control">

    Note

    This bug does not occur when using winbind to -create accounts on the Samba host for Domain users.

    Windows NT 3.1

    If you have problems communicating across routers with Windows -NT 3.1 workstations, read this Microsoft Knowledge Base article. +By disabling the nt acl support parameter, Samba will send +the Windows 200x client a response to the QuerySecurityDescriptor trans2 call, which causes the client +to set a default ACL for the profile. This default ACL includes: +

    DOMAIN\user “Full Control”>

    Note

    This bug does not occur when using Winbind to +create accounts on the Samba host for Domain users.

    Windows NT 3.1

    If you have problems communicating across routers with Windows +NT 3.1 workstations, read this Microsoft Knowledge Base article. -

    Prev Up Next
    Chapter 37. Portability Home Chapter 39. Samba Performance Tuning
    +

    Prev Up Next
    Chapter 37. Portability Home Chapter 39. Samba Performance Tuning
    diff --git a/docs/htmldocs/PolicyMgmt.html b/docs/htmldocs/PolicyMgmt.html index 754ca9b686..4adc7b6860 100644 --- a/docs/htmldocs/PolicyMgmt.html +++ b/docs/htmldocs/PolicyMgmt.html @@ -1,21 +1,24 @@ -Chapter 23. System and Account Policies
    Chapter 23. System and Account Policies
    Prev Part III. Advanced Configuration Next

    Chapter 23. System and Account Policies

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work

    -This chapter summarises the current state of knowledge derived from personal -practice and knowledge from samba mailing list subscribers. Before reproduction -of posted information effort has been made to validate the information provided. +Chapter 23. System and Account Policies

    Chapter 23. System and Account Policies
    Prev Part III. Advanced Configuration Next

    Chapter 23. System and Account Policies

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/ME Policies
    Windows NT4-Style Policy Files
    MS Windows 200x/XP Professional Policies
    Managing Account/User Policies
    Management Tools
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work

    +This chapter summarizes the current state of knowledge derived from personal +practice and knowledge from Samba mailing list subscribers. Before reproduction +of posted information, every effort has been made to validate the information given. Where additional information was uncovered through this validation it is provided also. -

    Features and Benefits

    -When MS Windows NT3.5 was introduced the hot new topic was the ability to implement -Group Policies for users and group. Then along came MS Windows NT4 and a few sites -started to adopt this capability. How do we know that? By way of the number of "booboos" +

    Features and Benefits

    +When MS Windows NT 3.5 was introduced, the hot new topic was the ability to implement +Group Policies for users and groups. Then along came MS Windows NT4 and a few sites +started to adopt this capability. How do we know that? By the number of “booboos” (or mistakes) administrators made and then requested help to resolve.

    + + + By the time that MS Windows 2000 and Active Directory was released, administrators got the message: Group Policies are a good thing! They can help reduce administrative -costs and actually can help to create happier users. But adoption of the true +costs and actually make happier users. But adoption of the true potential of MS Windows 200x Active Directory and Group Policy Objects (GPOs) for users -and machines were picked up on rather slowly. This was very obvious from the samba -mailing list as in 2000 and 2001 there were very few postings regarding GPOs and +and machines were picked up on rather slowly. This was obvious from the Samba +mailing list as in 2000 and 2001 when there were few postings regarding GPOs and how to replicate them in a Samba environment.

    Judging by the traffic volume since mid 2002, GPOs have become a standard part of @@ -23,245 +26,269 @@ the deployment in many sites. This chapter reviews techniques and methods that c be used to exploit opportunities for automation of control over user desktops and network client workstations.

    -A tool new to Samba may become an important part of the future Samba Administrators' -arsenal. The editreg tool is described in this document. -

    Creating and Managing System Policies

    +A tool new to Samba the editreg tool + may become an important part of the future Samba administrators' +arsenal is described in this document. +

    Creating and Managing System Policies

    Under MS Windows platforms, particularly those following the release of MS Windows -NT4 and MS Windows 95) it is possible to create a type of file that would be placed -in the NETLOGON share of a domain controller. As the client logs onto the network +NT4 and MS Windows 95, it is possible to create a type of file that would be placed +in the NETLOGON share of a Domain Controller. As the client logs onto the network, this file is read and the contents initiate changes to the registry of the client machine. This file allows changes to be made to those parts of the registry that affect users, groups of users, or machines.

    -For MS Windows 9x/Me this file must be called Config.POL and may + +For MS Windows 9x/ME, this file must be called Config.POL and may be generated using a tool called poledit.exe, better known as the Policy Editor. The policy editor was provided on the Windows 98 installation CD, but disappeared again with the introduction of MS Windows Me (Millennium Edition). From -comments from MS Windows network administrators it would appear that this tool became +comments of MS Windows network administrators, it would appear that this tool became a part of the MS Windows Me Resource Kit.

    + MS Windows NT4 Server products include the System Policy Editor -under the Start -> Programs -> Administrative Tools menu item. -For MS Windows NT4 and later clients this file must be called NTConfig.POL. +under Start -> Programs -> Administrative Tools. +For MS Windows NT4 and later clients, this file must be called NTConfig.POL.

    New with the introduction of MS Windows 2000 was the Microsoft Management Console -or MMC. This tool is the new wave in the ever changing landscape of Microsoft +or MMC. This tool is the new wave in the ever-changing landscape of Microsoft methods for management of network access and security. Every new Microsoft product -or technology seems to obsolete the old rules and to introduce newer and more -complex tools and methods. To Microsoft's credit though, the MMC does appear to +or technology seems to make the old rules obsolete and introduces newer and more +complex tools and methods. To Microsoft's credit, the MMC does appear to be a step forward, but improved functionality comes at a great price.

    -Before embarking on the configuration of network and system policies it is highly -advisable to read the documentation available from Microsoft's web site regarding - -Implementing Profiles and Policies in Windows NT 4.0 available from Microsoft. +Before embarking on the configuration of network and system policies, it is highly +advisable to read the documentation available from Microsoft's Web site regarding + +Implementing Profiles and Policies in Windows NT 4.0 available from Microsoft. There are a large number of documents in addition to this old one that should also -be read and understood. Try searching on the Microsoft web site for "Group Policies". +be read and understood. Try searching on the Microsoft Web site for “Group Policies”.

    -What follows is a very brief discussion with some helpful notes. The information provided -here is incomplete - you are warned. -

    Windows 9x/Me Policies

    - You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. - It can be found on the Original full product Win98 installation CD under - tools/reskit/netadmin/poledit. Install this using the - Add/Remove Programs facility and then click on the 'Have Disk' tab. +What follows is a brief discussion with some helpful notes. The information provided +here is incomplete you are warned. +

    Windows 9x/ME Policies

    + You need the Windows 98 Group Policy Editor to set up Group Profiles under Windows 9x/ME. + It can be found on the original full product Windows 98 installation CD under + tools/reskit/netadmin/poledit. Install this using the + Add/Remove Programs facility and then click on Have Disk.

    + Use the Group Policy Editor to create a policy file that specifies the location of - user profiles and/or the My Documents etc. Then save these + user profiles and/or My Documents, and so on. Then save these settings in a file called Config.POL that needs to be placed in the - root of the [NETLOGON] share. If Win98 is configured to log onto - the Samba Domain, it will automatically read this file and update the Win9x/Me registry + root of the [NETLOGON] share. If Windows 98 is configured to log onto + the Samba Domain, it will automatically read this file and update the Windows 9x/Me registry of the machine as it logs on.

    - Further details are covered in the Win98 Resource Kit documentation. + Further details are covered in the Windows 98 Resource Kit documentation.

    - If you do not take the right steps, then every so often Win9x/Me will check the - integrity of the registry and will restore it's settings from the back-up - copy of the registry it stores on each Win9x/Me machine. Hence, you will + If you do not take the correct steps, then every so often Windows 9x/ME will check the + integrity of the registry and restore its settings from the back-up + copy of the registry it stores on each Windows 9x/ME machine. So, you will occasionally notice things changing back to the original settings.

    - Install the group policy handler for Win9x to pick up group policies. Look on the - Win98 CD in \tools\reskit\netadmin\poledit. - Install group policies on a Win9x client by double-clicking + Install the group policy handler for Windows 9x/Me to pick up Group Policies. Look on the + Windows 98 CDROM in \tools\reskit\netadmin\poledit. + Install group policies on a Windows 9x/Me client by double-clicking on grouppol.inf. Log off and on again a couple of times and see - if Win98 picks up group policies. Unfortunately this needs to be done on every - Win9x/Me machine that uses group policies. -

    Windows NT4 Style Policy Files

    + if Windows 98 picks up Group Policies. Unfortunately, this needs to be done on every + Windows 9x/Me machine that uses Group Policies. +

    Windows NT4-Style Policy Files

    To create or edit ntconfig.pol you must use the NT Server - Policy Editor, poledit.exe which is included with NT4 Server - but not NT Workstation. There is a Policy Editor on a NT4 - Workstation but it is not suitable for creating Domain Policies. - Further, although the Windows 95 Policy Editor can be installed on an NT4 + Policy Editor, poledit.exe, which is included with NT4 Server + but not with NT Workstation. There is a Policy Editor on an NT4 + Workstation but it is not suitable for creating domain policies. + Furthermore, although the Windows 95 Policy Editor can be installed on an NT4 Workstation/Server, it will not work with NT clients. However, the files from the NT Server will run happily enough on an NT4 Workstation.

    You need poledit.exe, common.adm and winnt.adm. - It is convenient to put the two *.adm files in the c:\winnt\inf - directory which is where the binary will look for them unless told otherwise. Note also that that - directory is normally 'hidden'. + It is convenient to put the two *.adm files in the c:\winnt\inf + directory, which is where the binary will look for them unless told otherwise. This + directory is normally “hidden.”

    The Windows NT policy editor is also included with the Service Pack 3 (and later) for Windows NT 4.0. Extract the files using servicepackname /x, - i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, - poledit.exe and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible + that's Nt4sp6ai.exe /x for service pack 6a. The Policy Editor, + poledit.exe, and the associated template files (*.adm) should + be extracted as well. It is also possible to downloaded the policy template + files for Office97 and get a copy of the Policy Editor. Another possible location is with the Zero Administration Kit available for download from Microsoft. -

    Registry Spoiling

    - With NT4 style registry based policy changes, a large number of settings are not - automatically reversed as the user logs off. Since the settings that were in the - NTConfig.POL file were applied to the client machine registry and that apply to the +

    Registry Spoiling

    + With NT4-style registry-based policy changes, a large number of settings are not + automatically reversed as the user logs off. The settings that were in the + NTConfig.POL file were applied to the client machine registry and apply to the hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known - as tattooing. It can have serious consequences down-stream and the administrator must + as tattooing. It can have serious consequences downstream and the administrator must be extremely careful not to lock out the ability to manage the machine at a later date. -

    MS Windows 200x / XP Professional Policies

    - Windows NT4 System policies allows setting of registry parameters specific to - users, groups and computers (client workstations) that are members of the NT4 - style domain. Such policy file will work with MS Windows 2000 / XP clients also. +

    MS Windows 200x/XP Professional Policies

    + Windows NT4 system policies allow the setting of registry parameters specific to + users, groups and computers (client workstations) that are members of the NT4-style + domain. Such policy files will work with MS Windows 200x/XP clients also.

    - New to MS Windows 2000 Microsoft introduced a new style of group policy that confers - a superset of capabilities compared with NT4 style policies. Obviously, the tool used - to create them is different, and the mechanism for implementing them is much changed. + New to MS Windows 2000, Microsoft recently introduced a style of group policy that confers + a superset of capabilities compared with NT4-style policies. Obviously, the tool used + to create them is different, and the mechanism for implementing them is much improved.

    - The older NT4 style registry based policies are known as Administrative Templates - in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security + + The older NT4-style registry-based policies are known as Administrative Templates + in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes the ability to set various security configurations, enforce Internet Explorer browser settings, change and redirect aspects of the - users' desktop (including: the location of My Documents files (directory), as + users desktop (including the location of My Documents files (directory), as well as intrinsics of where menu items will appear in the Start menu). An additional new feature is the ability to make available particular software Windows applications to particular users and/or groups.

    - Remember: NT4 policy files are named NTConfig.POL and are stored in the root - of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password - and selects the domain name to which the logon will attempt to take place. During the logon - process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating - server, modifies the local registry values according to the settings in this file. + Remember, NT4 policy files are named NTConfig.POL and are stored in the root + of the NETLOGON share on the Domain Controllers. A Windows NT4 user enters a username, password + and selects the domain name to which the logon will attempt to take place. During the logon process, + the client machine reads the NTConfig.POL file from the NETLOGON share on + the authenticating server and modifies the local registry values according to the settings in this file.

    - Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of + Windows 200x GPOs are feature-rich. They are not stored in the NETLOGON share, but rather part of a Windows 200x policy file is stored in the Active Directory itself and the other part is stored in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active - Directory domain controllers. The part that is stored in the Active Directory itself is called the - group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is - known as the group policy template (GPT). + Directory Domain Controllers. The part that is stored in the Active Directory itself is called the + Group Policy Container (GPC), and the part that is stored in the replicated share called SYSVOL is + known as the Group Policy Template (GPT).

    - With NT4 clients the policy file is read and executed upon only as each user logs onto the network. - MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine - startup (machine specific part) and when the user logs onto the network the user specific part - is applied. In MS Windows 200x style policy management each machine and/or user may be subject + With NT4 clients, the policy file is read and executed only as each user logs onto the network. + MS Windows 200x policies are much more complex GPOs are processed and applied at client machine + startup (machine specific part) and when the user logs onto the network, the user-specific part + is applied. In MS Windows 200x-style policy management, each machine and/or user may be subject to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows the administrator to also set filters over the policy settings. No such equivalent capability - exists with NT4 style policy files. -

    Administration of Win2K / XP Policies

    + exists with NT4-style policy files. +

    Administration of Windows 200x/XP Policies

    + + Instead of using the tool called The System Policy Editor, commonly called Poledit (from the executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console (MMC) snap-in as follows:

    1. - Go to the Windows 200x / XP menu Start->Programs->Administrative Tools - and select the MMC snap-in called Active Directory Users and Computers -

    2. - Select the domain or organizational unit (OU) that you wish to manage, then right click - to open the context menu for that object, select the properties item. -

    3. - Now left click on the Group Policy tab, then left click on the New tab. Type a name - for the new policy you will create. -

    4. - Now left click on the Edit tab to commence the steps needed to create the GPO. -

    + Go to the Windows 200x/XP menu Start->Programs->Administrative Tools + and select the MMC snap-in called Active Directory Users and Computers +

  • + Select the domain or organizational unit (OU) that you wish to manage, then right-click + to open the context menu for that object, and select the Properties. +

  • + Left-click on the Group Policy tab, then + left-click on the New tab. Type a name + for the new policy you will create. +

  • + Left-click on the Edit tab to commence the steps needed to create the GPO. +

    • All policy configuration options are controlled through the use of policy administrative - templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. - Beware however, since the .adm files are NOT interchangeable across NT4 and Windows 200x. - The later introduces many new features as well as extended definition capabilities. It is - well beyond the scope of this documentation to explain how to program .adm files, for that + templates. These files have an .adm extension, both in NT4 as well as in Windows 200x/XP. + Beware, however, the .adm files are not interchangeable across NT4 and Windows 200x. + The latter introduces many new features as well as extended definition capabilities. It is + well beyond the scope of this documentation to explain how to program .adm files; for that the administrator is referred to the Microsoft Windows Resource Kit for your particular version of MS Windows.

    Note

    The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you use this powerful tool. Please refer to the resource kit manuals for specific usage information. -

    Managing Account/User Policies

    +

    Managing Account/User Policies

    Policies can define a specific user's settings or the settings for a group of users. The resulting policy file contains the registry settings for all users, groups, and computers that will be using the policy file. Separate policy files for each user, group, or computer are not necessary.

    -If you create a policy that will be automatically downloaded from validating domain controllers, -you should name the file NTconfig.POL. As system administrator, you have the option of renaming the + +If you create a policy that will be automatically downloaded from validating Domain Controllers, +you should name the file NTConfig.POL. As system administrator, you have the option of renaming the policy file and, by modifying the Windows NT-based workstation, directing the computer to update the policy from a manual path. You can do this by either manually changing the registry or by using -the System Policy Editor. This path can even be a local path such that each machine has its own policy file, -but if a change is necessary to all machines, this change must be made individually to each workstation. +the System Policy Editor. This can even be a local path such that each machine has its own policy file, +but if a change is necessary to all machines, it must be made individually to each workstation.

    -When a Windows NT4/200x/XP machine logs onto the network the NETLOGON share on the authenticating domain -controller for the presence of the NTConfig.POL file. If one exists it is downloaded, parsed and then -applied to the user's part of the registry. +When a Windows NT4/200x/XP machine logs onto the network, the client looks in the NETLOGON share on +the authenticating domain controller for the presence of the NTConfig.POL file. If one exists it is +downloaded, parsed and then applied to the user's part of the registry.

    -MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally, + +MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally acquire policy settings through Group Policy Objects (GPOs) that are defined and stored in Active Directory itself. The key benefit of using AS GPOs is that they impose no registry spoiling effect. -This has considerable advantage compared with the use of NTConfig.POL (NT4) style policy updates. +This has considerable advantage compared with the use of NTConfig.POL (NT4) style policy updates.

    In addition to user access controls that may be imposed or applied via system and/or group policies in a manner that works in conjunction with user profiles, the user management environment under MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied. -Common restrictions that are frequently used includes: +Common restrictions that are frequently used include:

    -

    • Logon Hours

    • Password Aging

    • Permitted Logon from certain machines only

    • Account type (Local or Global)

    • User Rights

    -

    Samba Editreg Toolset

    + +

    • Logon hours
    • Password aging
    • Permitted logon from certain machines only
    • Account type (local or global)
    • User rights

    +

    +Samba-3.0.0 doe not yet implement all account controls that are common to MS Windows NT4/200x/XP. +While it is possible to set many controls using the Domain User Manager for MS Windows NT4, only password +expirey is functional today. Most of the remaining controls at this time have only stub routines +that may eventually be completed to provide actual control. Do not be misled by the fact that a +parameter can be set using the NT4 Domain User Manager or in the NTConfig.POL. +

    Management Tools

    +Anyone who wishes to create or manage Group Policies will need to be familiar with a number of tools. +The following sections describe a few key tools that will help you to create a low maintenance user +environment. +

    Samba Editreg Toolset

    + + + A new tool called editreg is under development. This tool can be used - to edit registry files (called NTUser.DAT) that are stored in user and group profiles. - NTConfig.POL files have the same structure as the NTUser.DAT file and can be editted using - this tool. editreg is being built with the intent to enable NTConfig.POL - files to be saved in text format and to permit the building of new NTConfig.POL files with - extended capabilities. It is proving difficult to realise this capability, so do not be surprised - if this feature does not materialise. Formal capabilities will be announced at the time that - this tool is released for production use. -

    Windows NT4/200x

    + to edit registry files (called NTUser.DAT) that are stored in user + and group profiles. NTConfig.POL files have the same structure as the + NTUser.DAT file and can be edited using this tool. editreg + is being built with the intent to enable NTConfig.POL files to be saved in text format and to + permit the building of new NTConfig.POL files with extended capabilities. It is proving difficult + to realize this capability, so do not be surprised if this feature does not materialize. Formal + capabilities will be announced at the time that this tool is released for production use. +

    Windows NT4/200x

    The tools that may be used to configure these types of controls from the MS Windows environment are: - The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). - Under MS Windows 200x/XP this is done using the Microsoft Management Console (MMC) with appropriate - "snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor. -

    Samba PDC

    - With a Samba Domain Controller, the new tools for managing of user account and policy information includes: + the NT4 User Manager for Domains, the NT4 System and Group Policy Editor, and the Registry Editor (regedt32.exe). + Under MS Windows 200x/XP, this is done using the Microsoft Management Console (MMC) with appropriate + “snap-ins,” the registry editor, and potentially also the NT4 System and Group Policy Editor. +

    Samba PDC

    + With a Samba Domain Controller, the new tools for managing user account and policy information include: smbpasswd, pdbedit, net, rpcclient. - The administrator should read the - man pages for these tools and become familiar with their use. -

    System Startup and Logon Processing Overview

    -The following attempts to document the order of processing of system and user policies following a system + The administrator should read the man pages for these tools and become familiar with their use. +

    System Startup and Logon Processing Overview

    +The following attempts to document the order of processing the system and user policies following a system reboot and as part of the user logon:

    1. Network starts, then Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming - Convention Provider (MUP) start + Convention Provider (MUP) start.

    2. Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded and applied. The list may include GPOs that: -

      • Apply to the location of machines in a Directory

      • Apply only when settings have changed

      • Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.

      +

      • Apply to the location of machines in a Directory.

      • Apply only when settings have changed.

      • Depend on configuration of the scope of applicability: local, + site, domain, organizational unit, and so on.

      No desktop user interface is presented until the above have been processed.

    3. Execution of start-up scripts (hidden and synchronous by default).

    4. - A keyboard action to affect start of logon (Ctrl-Alt-Del). + A keyboard action to effect start of logon (Ctrl-Alt-Del).

    5. - User credentials are validated, User profile is loaded (depends on policy settings). + User credentials are validated, user profile is loaded (depends on policy settings).

    6. - An ordered list of User GPOs is obtained. The list contents depends on what is configured in respect of: + An ordered list of user GPOs is obtained. The list contents depends on what is configured in respect of: -

      • Is user a domain member, thus subject to particular policies

      • Loopback enablement, and the state of the loopback policy (Merge or Replace)

      • Location of the Active Directory itself

      • Has the list of GPOs changed. No processing is needed if not changed.

      +

      • Is the user a Domain Member, thus subject to particular policies?
      • Loopback enablement, and the state of the loopback policy (Merge or Replace).
      • Location of the Active Directory itself.
      • Has the list of GPOs changed? No processing is needed if not changed.

    7. User Policies are applied from Active Directory. Note: There are several types.

    8. - Logon scripts are run. New to Win2K and Active Directory, logon scripts may be obtained based on Group - Policy objects (hidden and executed synchronously). NT4 style logon scripts are then run in a normal + Logon scripts are run. New to Windows 200x and Active Directory, logon scripts may be obtained based on Group + Policy objects (hidden and executed synchronously). NT4-style logon scripts are then run in a normal window.

    9. - The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like and NT4 - Domain) machine (system) policies are applied at start-up, User policies are applied at logon. -

    Common Errors

    -Policy related problems can be very difficult to diagnose and even more difficult to rectify. The following + The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like an NT4 + Domain), machine (system) policies are applied at start-up; user policies are applied at logon. +

    Common Errors

    +Policy-related problems can be quite difficult to diagnose and even more difficult to rectify. The following collection demonstrates only basic issues. -

    Policy Does Not Work

    - “We have created the config.pol file and put it in the NETLOGON share. -It has made no difference to our Win XP Pro machines, they just don't see it. IT worked fine with Win 98 but does not +

    Policy Does Not Work

    +“We have created the Config.POL file and put it in the NETLOGON share. +It has made no difference to our Win XP Pro machines, they just do not see it. It worked fine with Win 98 but does not work any longer since we upgraded to Win XP Pro. Any hints?”

    -Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based -platforms. You need to use the NT4 Group Policy Editor to create a file called NTConfig.POL so that -it is in the correct format for your MS Windows XP Pro clients. -

    Prev Up Next
    Chapter 22. Advanced Network Management Home Chapter 24. Desktop Profile Management
    +Policy files are not portable between Windows 9x/Me and MS Windows NT4/200x/XP-based platforms. You need to +use the NT4 Group Policy Editor to create a file called NTConfig.POL so it is in the +correct format for your MS Windows XP Pro clients. +

    Prev Up Next
    Chapter 22. Advanced Network Management Home Chapter 24. Desktop Profile Management
    diff --git a/docs/htmldocs/Portability.html b/docs/htmldocs/Portability.html index 50d14207d0..3451a8bd17 100644 --- a/docs/htmldocs/Portability.html +++ b/docs/htmldocs/Portability.html @@ -1,47 +1,52 @@ -Chapter 37. Portability
    Chapter 37. Portability
    Prev Part VI. Appendixes Next

    Chapter 37. Portability

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    HPUX
    SCO UNIX
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9

    Samba works on a wide range of platforms but the interface all the +Chapter 37. Portability

    Chapter 37. Portability
    Prev Part VI. Appendixes Next

    Chapter 37. Portability

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    HPUX
    SCO UNIX
    DNIX
    Red Hat Linux
    AIX
    Sequential Read Ahead
    Solaris
    Locking Improvements
    Winbind on Solaris 9

    Samba works on a wide range of platforms but the interface all the platforms provide is not always compatible. This chapter contains -platform-specific information about compiling and using samba.

    HPUX

    -HP's implementation of supplementary groups is, er, non-standard (for -hysterical reasons). There are two group files, /etc/group and +platform-specific information about compiling and using Samba.

    HPUX

    +HP's implementation of supplementary groups is non-standard (for +historical reasons). There are two group files, /etc/group and /etc/logingroup; the system maps UIDs to numbers using the former, but -initgroups() reads the latter. Most system admins who know the ropes +initgroups() reads the latter. Most system admins who know the ropes symlink /etc/group to /etc/logingroup -(hard link doesn't work for reasons too stupid to go into here). initgroups() will complain if one of the +(hard link does not work for reasons too obtuse to go into here). initgroups() will complain if one of the groups you're in in /etc/logingroup has what it considers to be an invalid ID, which means outside the range [0..UID_MAX], where UID_MAX is (I think) -60000 currently on HP-UX. This precludes -2 and 65534, the usual nobody +60000 currently on HP-UX. This precludes -2 and 65534, the usual nobody GIDs.

    -If you encounter this problem, make sure that the programs that are failing -to initgroups() be run as users not in any groups with GIDs outside the +If you encounter this problem, make sure the programs that are failing +to initgroups() are run as users, not in any groups with GIDs outside the allowed range.

    This is documented in the HP manual pages under setgroups(2) and passwd(4).

    -On HPUX you must use gcc or the HP ANSI compiler. The free compiler -that comes with HP-UX is not ANSI compliant and cannot compile -Samba. -

    SCO UNIX

    -If you run an old version of SCO UNIX then you may need to get important +On HP-UX you must use gcc or the HP ANSI compiler. The free compiler +that comes with HP-UX is not ANSI compliant and cannot compile Samba. +

    SCO UNIX

    +If you run an old version of SCO UNIX, you may need to get important TCP/IP patches for Samba to work correctly. Without the patch, you may -encounter corrupt data transfers using samba. +encounter corrupt data transfers using Samba.

    The patch you need is UOD385 Connection Drivers SLS. It is available from -SCO (ftp.sco.com, directory SLS, +SCO (ftp.sco.com, directory SLS, files uod385a.Z and uod385a.ltr.Z). -

    DNIX

    +

    +The information provided here refers to an old version of SCO UNIX. If you require +binaries for more recent SCO UNIX products, please contact SCO to obtain packages that are +ready to install. You should also verify with SCO that your platform is up-to-date for the +binary packages you will install. This is important if you wish to avoid data corruption +problems with your installation. To build Samba for SCO UNIX products may +require significant patching of Samba source code. It is much easier to obtain binary +packages directly from SCO. +

    DNIX

    DNIX has a problem with seteuid() and setegid(). These routines are needed for Samba to work correctly, but they were left out of the DNIX C library for some reason.

    For this reason Samba by default defines the macro NO_EID in the DNIX section of includes.h. This works around the problem in a limited way, -but it is far from ideal, some things still won't work right. +but it is far from ideal, and some things still will not work right.

    -To fix the problem properly you need to assemble the following two +To fix the problem properly, you need to assemble the following two functions and then either add them to your C library or link them into -Samba. -

    -put this in the file setegid.s: +Samba. Put the following in the file setegid.s: 

             .globl  _setegid
 _setegid:
@@ -56,7 +61,7 @@ _setegid:
         clrl    d0
         rts

    -put this in the file seteuid.s: +Put this in the file seteuid.s: 

             .globl  _seteuid
 _seteuid:
@@ -71,7 +76,7 @@ _seteuid:
         clrl    d0
         rts

    -after creating the above files you then assemble them using +After creating the above files, you then assemble them using 

     $ as seteuid.s
 $ as setegid.s
@@ -79,7 +84,7 @@ after creating the above files you then assemble them using
 that should produce the files seteuid.o and 
 setegid.o
 
    
-then you need to add these to the LIBSM line in the DNIX section of
+Then you need to add these to the LIBSM line in the DNIX section of
 the Samba Makefile. Your LIBSM line will then look something like this:
 
     LIBSM = setegid.o seteuid.o -ln
@@ -87,25 +92,25 @@ LIBSM = setegid.o seteuid.o -ln
 You should then remove the line:
 
     #define NO_EID
-
    from the DNIX section of includes.h

    RedHat Linux Rembrandt-II

    -By default RedHat Rembrandt-II during installation adds an +

    from the DNIX section of includes.h.

    Red Hat Linux

    +By default during installation, some versions of Red Hat Linux add an entry to /etc/hosts as follows: 

    -	127.0.0.1 loopback "hostname"."domainname"
+	127.0.0.1 loopback "hostname"."domainname"

    This causes Samba to loop back onto the loopback interface. The result is that Samba fails to communicate correctly with -the world and therefor may fail to correctly negotiate who +the world and therefore may fail to correctly negotiate who is the master browse list holder and who is the master browser.

    -Corrective Action: Delete the entry after the word loopback - in the line starting 127.0.0.1 -

    AIX

    Sequential Read Ahead

    +Corrective Action: Delete the entry after the word "loopback" +in the line starting 127.0.0.1. +

    AIX

    Sequential Read Ahead

    Disabling Sequential Read Ahead using vmtune -r 0 improves Samba performance significantly. -

    Solaris

    Locking improvements

    Some people have been experiencing problems with F_SETLKW64/fcntl -when running Samba on Solaris. The built in file locking mechanism was +

    Solaris

    Locking Improvements

    Some people have been experiencing problems with F_SETLKW64/fcntl +when running Samba on Solaris. The built-in file locking mechanism was not scalable. Performance would degrade to the point where processes would get into loops of trying to lock a file. It would try a lock, then fail, then try again. The lock attempt was failing before the grant was @@ -116,13 +121,12 @@ be stuck if F_SETLKW64 loops. Sun released patches for Solaris 2.6, 8, and 9. The patch for Solaris 7 has not been released yet.

    -The patch revision for 2.6 is 105181-34 -for 8 is 108528-19 and for 9 is 112233-04 +The patch revision for 2.6 is 105181-34, for 8 is 108528-19 and for 9 is 112233-04.

    -After the install of these patches it is recommended to reconfigure -and rebuild samba. -

    Thanks to Joe Meslovich for reporting

    Winbind on Solaris 9

    -Nsswitch on Solaris 9 refuses to use the winbind nss module. This behavior -is fixed by Sun in patch 113476-05 which as of March 2003 is not in any +After the install of these patches, it is recommended to reconfigure +and rebuild Samba. +

    Thanks to Joe Meslovich for reporting this.

    Winbind on Solaris 9

    +Nsswitch on Solaris 9 refuses to use the Winbind NSS module. This behavior +is fixed by Sun in patch 113476-05, which as of March 2003, is not in any roll-up packages. -

    Prev Up Next
    Chapter 36. How to compile Samba Home Chapter 38. Samba and other CIFS clients
    +

    Prev Up Next
    Chapter 36. How to Compile Samba Home Chapter 38. Samba and Other CIFS Clients
    diff --git a/docs/htmldocs/ProfileMgmt.html b/docs/htmldocs/ProfileMgmt.html index 765ae4b0c4..9947526194 100644 --- a/docs/htmldocs/ProfileMgmt.html +++ b/docs/htmldocs/ProfileMgmt.html @@ -1,652 +1,443 @@ -Chapter 24. Desktop Profile Management
    Chapter 24. Desktop Profile Management
    Prev Part III. Advanced Configuration Next

    Chapter 24. Desktop Profile Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Setting up roaming profiles for just a few user's or group's?
    Can NOT use Roaming Profiles
    Changing the default profile

    Features and Benefits

    -Roaming Profiles are feared by some, hated by a few, loved by many, and a Godsend for +Chapter 24. Desktop Profile Management

    Chapter 24. Desktop Profile Management
    Prev Part III. Advanced Configuration Next

    Chapter 24. Desktop Profile Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP Workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory Profiles
    Creating and Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Configuring Roaming Profiles for a Few Users or Groups
    Cannot Use Roaming Profiles
    Changing the Default Profile

    Features and Benefits

    +Roaming profiles are feared by some, hated by a few, loved by many, and a Godsend for some administrators.

    -Roaming Profiles allow an administrator to make available a consistent user desktop +Roaming profiles allow an administrator to make available a consistent user desktop as the user moves from one machine to another. This chapter provides much information -regarding how to configure and manage Roaming Profiles. +regarding how to configure and manage roaming profiles.

    -While Roaming Profiles might sound like nirvana to some, they are a real and tangible +While roaming profiles might sound like nirvana to some, they are a real and tangible problem to others. In particular, users of mobile computing tools, where often there may not -be a sustained network connection, are often better served by purely Local Profiles. -This chapter provides information to help the Samba administrator to deal with those -situations also. -

    Roaming Profiles

    Warning

    -Roaming profiles support is different for Win9x / Me and Windows NT4/200x. +be a sustained network connection, are often better served by purely local profiles. +This chapter provides information to help the Samba administrator deal with those +situations. +

    Roaming Profiles

    Warning

    +Roaming profiles support is different for Windows 9x/Me and Windows NT4/200x.

    Before discussing how to configure roaming profiles, it is useful to see how -Windows 9x / Me and Windows NT4/200x clients implement these features. +Windows 9x/Me and Windows NT4/200x clients implement these features.

    -Windows 9x / Me clients send a NetUserGetInfo request to the server to get the user's +Windows 9x/Me clients send a NetUserGetInfo request to the server to get the user's profiles location. However, the response does not have room for a separate -profiles location field, only the user's home share. This means that Win9X/Me +profiles location field, only the user's home share. This means that Windows 9x/Me profiles are restricted to being stored in the user's home directory.

    -Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields, +Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields including a separate field for the location of the user's profiles. -

    Samba Configuration for Profile Handling

    +

    Samba Configuration for Profile Handling

    This section documents how to configure Samba for MS Windows client profile support. -

    NT4/200x User Profiles

    -To support Windows NT4/200x clients, in the [global] section of smb.conf set the -following (for example): +

    NT4/200x User Profiles

    +For example, to support Windows NT4/200x clients, set the followoing in the [global] section of the smb.conf file:

    logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath

    - This is typically implemented like: +This is typically implemented like:

    logon path = \\%L\Profiles\%u

    -where %L translates to the name of the Samba server and %u translates to the user name +where “%L” translates to the name of the Samba server and “%u” translates to the user name.

    -The default for this option is \\%N\%U\profile, -namely \\sambaserver\username\profile. -The \\N%\%U service is created automatically by the [homes] service. If you are using -a samba server for the profiles, you _must_ make the share specified in the logon path +The default for this option is \\%N\%U\profile, namely \\sambaserver\username\profile. +The \\N%\%U service is created automatically by the [homes] service. If you are using +a Samba server for the profiles, you must make the share that is specified in the logon path browseable. Please refer to the man page for smb.conf in respect of the different -semantics of %L and %N, as well as %U and %u. +semantics of “%L” and “%N”, as well as “%U” and “%u”.

    Note

    -MS Windows NT/2K clients at times do not disconnect a connection to a server -between logons. It is recommended to NOT use the homes -meta-service name as part of the profile share path. -

    Windows 9x / Me User Profiles

    - To support Windows 9x / Me clients, you must use the logon home parameter. Samba has -now been fixed so that net use /home now works as well, and it, too, relies +MS Windows NT/200x clients at times do not disconnect a connection to a server between logons. It is recommended +to not use the homes meta-service name as part of the profile share path. +

    Windows 9x/Me User Profiles

    +To support Windows 9x/Me clients, you must use the logon home +parameter. Samba has been fixed so net use /home now works as well and it, too, relies on the logon home parameter.

    -By using the logon home parameter, you are restricted to putting Win9x / Me -profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your smb.conf file: +By using the logon home parameter, you are restricted to putting Windows 9x/Me profiles in the user's home +directory. But wait! There is a trick you can use. If you set the following in the +[global] section of your smb.conf file:

    logon home = \\%L\%U\.profiles

    -then your Windows 9x / Me clients will dutifully put their clients in a subdirectory -of your home directory called .profiles (thus making them hidden). +then your Windows 9x/Me clients will dutifully put their clients in a subdirectory +of your home directory called .profiles (making them hidden).

    -Not only that, but net use /home will also work, because of a feature in -Windows 9x / Me. It removes any directory stuff off the end of the home directory area +Not only that, but net use /home will also work because of a feature in +Windows 9x/Me. It removes any directory stuff off the end of the home directory area and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for logon home. -

    Mixed Windows 9x / Me and Windows NT4/200x User Profiles

    -You can support profiles for both Win9X and WinNT clients by setting both the -logon home and logon path parameters. For example: -

    logon home = \\%L\%u\.profiles
    logon path = \\%L\profiles\%u

    Disabling Roaming Profile Support

    - A question often asked is “How may I enforce use of local profiles?” or - “How do I disable Roaming Profiles?” -

    +specified \\%L\%U for logon home. +

    Mixed Windows 9x/Me and Windows NT4/200x User Profiles

    +You can support profiles for Windows 9x and Windows NT clients by setting both the +logon home and logon path parameters. For example: +

    logon home = \\%L\%u\.profiles
    logon path = \\%L\profiles\%u

    Disabling Roaming Profile Support

    +A question often asked is: “How may I enforce use of local profiles?” or +“How do I disable roaming profiles?” +

    + There are three ways of doing this: +

    In smb.conf

    - Affect the following settings and ALL clients - will be forced to use a local profile: -

    logon home
    logon path

    -

    MS Windows Registry:

    - By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This of course modifies registry settings. The full path to the option is: - - - 

    -	Local Computer Policy\
-		Computer Configuration\
-			Administrative Templates\
-				System\
-					User Profiles\
+		Affect the following settings and ALL clients will be forced to use a local profile:
+		logon home and logon path
+
    MS Windows Registry

    + By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP + machine to use only a local profile. This, of course, modifies registry settings. The full + path to the option is: +

    +Local Computer Policy\
+	Computer Configuration\
+		Administrative Templates\
+			System\
+				User Profiles\
 
-	Disable:	Only Allow Local User Profiles
-	Disable:	Prevent Roaming Profile Change from Propagating to the Server
-

    -

    Change of Profile Type:

    - From the start menu right click on the - My Computer icon, select Properties, click on the User Profiles - tab, select the profile you wish to change from Roaming type to Local, click Change Type. +Disable: Only Allow Local User Profiles +Disable: Prevent Roaming Profile Change from Propagating to the Server +

    +

    Change of Profile Type:

    From the start menu right-click on My Computer icon, + select Properties, click on the User Profiles + tab, select the profile you wish to change from + Roaming type to Local, and click on + Change Type.

    -Consult the MS Windows registry guide for your particular MS Windows version for more -information about which registry keys to change to enforce use of only local user -profiles. +Consult the MS Windows registry guide for your particular MS Windows version for more information +about which registry keys to change to enforce use of only local user profiles.

    Note

    The specifics of how to convert a local profile to a roaming profile, or a roaming profile -to a local one vary according to the version of MS Windows you are running. Consult the -Microsoft MS Windows Resource Kit for your version of Windows for specific information. -

    Windows Client Profile Configuration Information

    Windows 9x / Me Profile Setup

    -When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders Start Menu, Desktop, -Programs and Nethood. -These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options preserve case = yes, short preserve case = yes and -case sensitive = no in order to maintain capital letters in shortcuts -in any of the profile folders. -

    -The user.DAT file contains all the user's preferences. If you wish to -enforce a set of preferences, rename their user.DAT file to user.MAN, -and deny them write access to this file. +to a local one vary according to the version of MS Windows you are running. Consult the Microsoft MS +Windows Resource Kit for your version of Windows for specific information. +

    Windows Client Profile Configuration Information

    Windows 9x/Me Profile Setup

    +When a user first logs in on Windows 9X, the file user.DAT is created, as are folders +Start Menu, Desktop, Programs, and +Nethood. These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, taking the +most recent from each. You will need to use the [global] options +preserve case = yes, +short preserve case = yes and +case sensitive = no +in order to maintain capital letters in shortcuts in any of the profile folders. +

    +The user.DAT file contains all the user's preferences. If you wish to enforce a set of preferences, +rename their user.DAT file to user.MAN, and deny them write access to this file.

    1. - On the Windows 9x / Me machine, go to Control Panel -> Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer - to reboot. -

    2. - On the Windows 9x / Me machine, go to Control Panel -> Network -> - Client for Microsoft Networks -> Preferences. Select Log on to - NT Domain. Then, ensure that the Primary Logon is Client for - Microsoft Networks. Press OK, and this time allow the computer - to reboot. -

    -Under Windows 9x / Me Profiles are downloaded from the Primary Logon. -If you have the Primary Logon as 'Client for Novell Networks', then -the profiles and logon script will be downloaded from your Novell -Server. If you have the Primary Logon as 'Windows Logon', then the -profiles will be loaded from the local machine - a bit against the -concept of roaming profiles, it would seem! -

    -You will now find that the Microsoft Networks Login box contains -[user, password, domain] instead of just [user, password]. Type in -the samba server's domain name (or any other domain known to exist, -but bear in mind that the user will be authenticated against this -domain and profiles downloaded from it, if that domain logon server -supports it), user name and user's password. -

    -Once the user has been successfully validated, the Windows 9x / Me machine -will inform you that The user has not logged on before and asks you -Do you wish to save the user's preferences?. Select yes. -

    -Once the Windows 9x / Me client comes up with the desktop, you should be able -to examine the contents of the directory specified in the logon path -on the samba server and verify that the Desktop, Start Menu, -Programs and Nethood folders have been created. -

    -These folders will be cached locally on the client, and updated when -the user logs off (if you haven't made them read-only by then). -You will find that if the user creates further folders or short-cuts, -that the client will merge the profile contents downloaded with the -contents of the profile directory already on the local client, taking -the newest folders and short-cuts from each set. -

    -If you have made the folders / files read-only on the samba server, -then you will get errors from the Windows 9x / Me machine on logon and logout, as -it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the Windows 9x / Me machine, check the UNIX file -permissions and ownership rights on the profile directory contents, -on the samba server. -

    -If you have problems creating user profiles, you can reset the user's -local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time". -

    Warning

    - Before deleting the contents of the - directory listed in the ProfilePath (this is likely to be - c:\windows\profiles\username), ask them if they - have any important files stored on their desktop or in their start menu. - Delete the contents of the directory ProfilePath (making a backup if any - of the files are needed). -

    - This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. -

    1. - instead of logging in under the [user, password, domain] dialog, - press escape. -

    2. - run the regedit.exe program, and look in: -

      - HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList -

      - you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. -

      [Exit the registry editor].

    3. - search for the user's .PWL password-caching file in the c:\windows - directory, and delete it. -

    4. - log off the windows 9x / Me client. -

    5. - check the contents of the profile path (see logon path described - above), and delete the user.DAT or user.MAN file for the user, - making a backup if required. -

    -If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as ethereal or netmon.exe, and -look for error messages. -

    -If you have access to an Windows NT4/200x server, then first set up roaming profiles -and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine -the example packet traces provided with Windows NT4/200x server, and see what the -differences are with the equivalent samba trace. -

    Windows NT4 Workstation

    -When a user first logs in to a Windows NT Workstation, the profile -NTuser.DAT is created. The profile location can be now specified -through the logon path parameter. -

    -There is a parameter that is now available for use with NT Profiles: -logon drive. This should be set to H: or any other drive, and -should be used in conjunction with the new logon home parameter. -

    -The entry for the NT4 profile is a _directory_ not a file. The NT -help on profiles mentions that a directory is also created with a .PDS -extension. The user, while logging in, must have write permission to -create the full profile path (and the folder with the .PDS extension -for those situations where it might be created.) -

    -In the profile directory, Windows NT4 creates more folders than Windows 9x / Me. -It creates Application Data and others, as well as Desktop, Nethood, -Start Menu and Programs. The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and -its purpose is currently unknown. -

    -You can use the System Control Panel to copy a local profile onto -a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN -turns a profile into a mandatory one. -

    -The case of the profile is significant. The file must be called -NTuser.DAT or, for a mandatory profile, NTuser.MAN. -

    Windows 2000/XP Professional

    -You must first convert the profile from a local profile to a domain -profile on the MS Windows workstation as follows: -

    1. - Log on as the LOCAL workstation administrator. + On the Windows 9x/Me machine, go to Control Panel -> + Passwords and select the User Profiles tab. + Select the required level of roaming preferences. Press OK, but do not + allow the computer to reboot.

    2. - Right click on the My Computer Icon, select Properties + On the Windows 9x/Me machine, go to Control Panel -> + Network -> Client for Microsoft Networks + -> Preferences. Select Log on to NT Domain. Then, + ensure that the Primary Logon is Client for Microsoft Networks. Press + OK, and this time allow the computer to reboot. +

    Under Windows 9x/ME, profiles are downloaded from the Primary Logon. If you have the Primary Logon +as “Client for Novell Networks”, then the profiles and logon script will be downloaded from +your Novell Server. If you have the Primary Logon as “Windows Logon”, then the profiles will +be loaded from the local machine a bit against the concept of roaming profiles, it would seem!

    +You will now find that the Microsoft Networks Login box contains [user, password, domain] instead +of just [user, password]. Type in the Samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this domain and profiles downloaded from it, +if that domain logon server supports it), user name and user's password. +

    Once the user has been successfully validated, the Windows 9x/Me machine will inform you that +The user has not logged on before and asks you Do you +wish to save the user's preferences? Select Yes.

    Once the Windows 9x/Me client comes up with the desktop, you should be able to examine the +contents of the directory specified in the logon path on +the Samba server and verify that the Desktop, Start Menu, +Programs and Nethood folders have been created.

    These folders will be cached locally on the client, and updated when the user logs off (if +you haven't made them read-only by then). You will find that if the user creates further folders or +shortcut, that the client will merge the profile contents downloaded with the contents of the profile +directory already on the local client, taking the newest folders and shortcut from each set.

    If you have made the folders/files read-only on the Samba server, then you will get errors from +the Windows 9x/Me machine on logon and logout as it attempts to merge the local and remote profile. +Basically, if you have any errors reported by the Windows 9x/Me machine, check the UNIX file permissions +and ownership rights on the profile directory contents, on the Samba server.

    If you have problems creating user profiles, you can reset the user's local desktop cache, as +shown below. When this user next logs in, the user will be told that he/she is logging in “for + the first time”. + + +

    1. + Instead of logging in under the [user, password, domain] dialog, press escape.

    2. - Click on the User Profiles tab + Run the regedit.exe program, and look in: +

      + HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList +

      + You will find an entry for each user of ProfilePath. Note the contents of this key + (likely to be c:\windows\profiles\username), then delete the key + ProfilePath for the required user.

    3. - Select the profile you wish to convert (click on it once) + Exit the registry editor.

    4. - Click on the button Copy To + Search for the user's .PWL password-caching file in the c:\windows directory, and delete it.

    5. - In the Permitted to use box, click on the Change button. + Log off the Windows 9x/Me client.

    6. - Click on the 'Look in" area that lists the machine name, when you click - here it will open up a selection box. Click on the domain to which the - profile must be accessible. -

      Note

      You will need to log on if a logon box opens up. Eg: In the connect as: DOMAIN\root, password: mypassword.

    7. - To make the profile capable of being used by anyone select 'Everyone' -

    8. - Click OK. The Selection box will close. -

    9. - Now click on the Ok button to create the profile in the path you - nominated. -

    -Done. You now have a profile that can be edited using the samba -profiles tool. -

    Note

    -Under NT/2K the use of mandatory profiles forces the use of MS Exchange -storage of mail data. That keeps desktop profiles usable. -

    Procedure 24.2. Windows XP Service Pack 1

    1. -This is a security check new to Windows XP (or maybe only -Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is:

      Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders

      ...and it should be set to Enabled. -Does the new version of samba have an Active Directory analogue? If so, -then you may be able to set the policy through this. -

      -If you cannot set group policies in samba, then you may be able to set -the policy locally on each machine. If you want to try this, then do -the following (N.B. I don't know for sure that this will work in the -same way as a domain group policy): -

    2. -On the XP workstation log in with an Administrator account. -

    3. Click: Start, Run

    4. Type: mmc

    5. Click: OK

    6. A Microsoft Management Console should appear.

    7. Click: File, Add/Remove Snap-in..., Add

    8. Double-Click: Group Policy

    9. Click: Finish, Close

    10. Click: OK

    11. In the "Console Root" window:

    12. Expand: Local Computer Policy, Computer Configuration, - Administrative Templates, System, User Profiles

    13. Double-Click: Do not check for user ownership of Roaming Profile Folders

    14. Select: Enabled

    15. Click: OK

    16. Close the whole console. You do not need to save the settings (this - refers to the console settings rather than the policies you have - changed).

    17. Reboot

    Sharing Profiles between W9x/Me and NT4/200x/XP workstations

    -Sharing of desktop profiles between Windows versions is NOT recommended. -Desktop profiles are an evolving phenomenon and profiles for later versions -of MS Windows clients add features that may interfere with earlier versions -of MS Windows clients. Probably the more salient reason to NOT mix profiles -is that when logging off an earlier version of MS Windows the older format -of profile contents may overwrite information that belongs to the newer -version resulting in loss of profile information content when that user logs -on again with the newer version of MS Windows. -

    -If you then want to share the same Start Menu / Desktop with W9x/Me, you will -need to specify a common location for the profiles. The smb.conf parameters -that need to be common are logon path and -logon home. -

    -If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory. -

    Profile Migration from Windows NT4/200x Server to Samba

    -There is nothing to stop you specifying any path that you like for the -location of users' profiles. Therefore, you could specify that the -profile be stored on a samba server, or any other SMB server, as long as -that SMB server supports encrypted passwords. -

    Windows NT4 Profile Management Tools

    -Unfortunately, the Resource Kit information is specific to the version of MS Windows -NT4/200x. The correct resource kit is required for each platform. -

    -Here is a quick guide: -

    1. -On your NT4 Domain Controller, right click on My Computer, then -select the tab labelled User Profiles. -

    2. -Select a user profile you want to migrate and click on it. -

      Note

      I am using the term "migrate" loosely. You can copy a profile to -create a group profile. You can give the user 'Everyone' rights to the -profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC.

    3. Click the Copy To button.

    4. In the box labelled Copy Profile to add your new path, eg: - c:\temp\foobar

    5. Click on the button Change in the Permitted to use box.

    6. Click on the group 'Everyone' and then click OK. This closes the - 'choose user' box.

    7. Now click OK.

    -Follow the above for every profile you need to migrate. -

    Side bar Notes

    -You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page.

    moveuser.exe

    -The W2K professional resource kit has moveuser.exe. moveuser.exe changes -the security of a profile from one user to another. This allows the account -domain to change, and/or the user name to change. -

    Get SID

    -You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 -Resource Kit. -

    -Windows NT 4.0 stores the local profile information in the registry under -the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList -

    -Under the ProfileList key, there will be subkeys named with the SIDs of the -users who have logged on to this computer. (To find the profile information -for the user whose locally cached profile you want to move, find the SID for -the user with the GetSID.exe utility.) Inside of the appropriate user's -subkey, you will see a string value named ProfileImagePath. -

    Mandatory profiles

    -A Mandatory Profile is a profile that the user does NOT have the ability to overwrite. -During the user's session it may be possible to change the desktop environment, but -as the user logs out all changes made will be lost. If it is desired to NOT allow the -user any ability to change the desktop environment then this must be done through -policy settings. See previous chapter. -

    Note

    -Under NO circumstances should the profile directory (or it's contents) be made read-only -as this may render the profile un-usable. + Check the contents of the profile path (see logon path + described above) and delete the user.DAT or user.MAN + file for the user, making a backup if required. +

    Warning

    +Before deleting the contents of the directory listed in the ProfilePath +(this is likely to be c:\windows\profiles\username), ask the owner if they have +any important files stored on their desktop or in their start menu. Delete the contents of the +directory ProfilePath (making a backup if any of the files are needed). +

    +This will have the effect of removing the local (read-only hidden system file) user.DAT +in their profile directory, as well as the local “desktop,” “nethood,” +“start menu,” and “programs” folders.

    -For MS Windows NT4/200x/XP the above method can be used to create mandatory profiles -also. To convert a group profile into a mandatory profile simply locate the NTUser.DAT -file in the copied profile and rename it to NTUser.MAN. -

    -For MS Windows 9x / Me it is the User.DAT file that must be renamed to User.MAN to -affect a mandatory profile. -

    Creating/Managing Group Profiles

    -Most organisations are arranged into departments. There is a nice benefit in -this fact since usually most users in a department will require the same desktop -applications and the same desktop layout. MS Windows NT4/200x/XP will allow the -use of Group Profiles. A Group Profile is a profile that is created firstly using -a template (example) user. Then using the profile migration tool (see above) the -profile is assigned access rights for the user group that needs to be given access -to the group profile. -

    -The next step is rather important. Please note: Instead of assigning a group profile -to users (ie: Using User Manager) on a "per user" basis, the group itself is assigned -the now modified profile. +If all else fails, increase Samba's debug log levels to between 3 and 10, and/or run a packet +sniffer program such as ethereal or netmon.exe, and look for error messages. +

    If you have access to an Windows NT4/200x server, then first set up roaming profiles and/or +netlogons on the Windows NT4/200x server. Make a packet trace, or examine the example packet traces +provided with Windows NT4/200x server, and see what the differences are with the equivalent Samba trace. +

    Windows NT4 Workstation

    When a user first logs in to a Windows NT Workstation, the profile NTuser.DAT is created. The profile +location can be now specified through the logon path parameter. +

    There is a parameter that is now available for use with NT Profiles: logon drive. +This should be set to H: or any other drive, and should be used in conjunction with +the new logon home parameter.

    The entry for the NT4 profile is a directory not a file. The NT help on Profiles mentions that a +directory is also created with a .PDS extension. The user, while logging in, must have write permission +to create the full profile path (and the folder with the .PDS extension for those situations where it +might be created.)

    In the profile directory, Windows NT4 creates more folders than Windows 9x/Me. It creates +Application Data and others, as well as Desktop, +Nethood, Start Menu, and Programs. +The profile itself is stored in a file NTuser.DAT. Nothing appears to be stored +in the .PDS directory, and its purpose is currently unknown.

    You can use the System Control Panel to copy a local profile onto +a Samba server (see NT Help on Profiles; it is also capable of firing up the correct location in the +System Control Panel for you). The NT Help file also mentions that renaming +NTuser.DAT to NTuser.MAN turns a profile into a mandatory one. +

    The case of the profile is significant. The file must be called NTuser.DAT +or, for a mandatory profile, NTuser.MAN.

    Windows 2000/XP Professional

    You must first convert the profile from a local profile to a domain profile on the MS Windows +workstation as follows:

    1. Log on as the local workstation administrator.

    2. Right-click on the My Computer Icon, select + Properties.

    3. Click on the User Profiles tab.

    4. Select the profile you wish to convert (click it once).

    5. Click on the Copy To button.

    6. In the Permitted to use box, click on the + Change button.

    7. Click on the Look in area that lists the machine name. When you click here, it will + open up a selection box. Click on the domain to which the profile must be accessible.

      Note

      You will need to log on if a logon box opens up. + For example, connect as DOMAIN\root, password: + mypassword.

    8. To make the profile capable of being used by anyone, select “Everyone”.

    9. Click on OK and the Selection box will close.

    10. Now click on OK to create the profile in the path + you nominated.

    Done. You now have a profile that can be edited using the Samba profiles tool.

    Note

    - Be careful with group profiles, if the user who is a member of a group also - has a personal profile, then the result will be a fusion (merge) of the two. -

    Default Profile for Windows Users

    -MS Windows 9x / Me and NT4/200x/XP will use a default profile for any user for whom -a profile does not already exist. Armed with a knowledge of where the default profile -is located on the Windows workstation, and knowing which registry keys affect the path -from which the default profile is created, it is possible to modify the default profile -to one that has been optimised for the site. This has significant administrative -advantages. -

    MS Windows 9x/Me

    -To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System -Policy Editor or change the registry directly. -

    -To enable default per user profiles in Windows 9x / Me, launch the System Policy Editor, then -select File -> Open Registry, then click on the -Local Computer icon, click on Windows 98 System, -select User Profiles, click on the enable box. Do not forget to save the registry changes. -

    -To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive -HKEY_LOCAL_MACHINE\Network\Logon. Now add a DWORD type key with the name -"User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0. -

    How User Profiles Are Handled in Windows 9x / Me?

    -When a user logs on to a Windows 9x / Me machine, the local profile path, +Under Windows NT/200x, the use of mandatory profiles forces the use of MS Exchange storage of mail +data and keeps it out of the desktop profile. That keeps desktop profiles from becoming unusable. +

    Windows XP Service Pack 1

    + There is a security check new to Windows XP (or maybe only Windows XP service pack 1). + It can be disabled via a group policy in the Active Directory. The policy is called: +

    + Computer Configuration\Administrative Templates\System\User Profiles\Do not check for + user ownership of Roaming Profile Foldersi +

    + This should be set to Enabled. +

    + Does the new version of Samba have an Active Directory analogue? If so, then you may be able to set the policy through this. +

    If you cannot set group policies in Samba, then you may be able to set the policy locally on + each machine. If you want to try this, then do the following (N.B. I do not know for sure that this + will work in the same way as a domain group policy): +

    1. On the XP workstation, log in with an Administrative account.

    2. Click on Start -> Run.

    3. Type mmc.

    4. Click on OK.

    5. A Microsoft Management Console should appear.

    6. Click on File -> Add/Remove Snap-in -> Add.

    7. Double-click on Group Policy.

    8. Click on Finish -> Close.

    9. Click on OK.

    10. In the “Console Root” window expand Local Computer Policy -> + Computer Configuration -> Administrative Templates -> System -> User Profiles.

    11. Double-click on Do not check for user ownership of Roaming Profile Folders.

    12. Select Enabled.

    13. Click on OK.

    14. Close the whole console. You do not need to save the settings (this refers to the + console settings rather than the policies you have changed).

    15. Reboot.

    Sharing Profiles between W9x/Me and NT4/200x/XP Workstations

    Sharing of desktop profiles between Windows versions is not recommended. Desktop profiles are an +evolving phenomenon and profiles for later versions of MS Windows clients add features that may interfere +with earlier versions of MS Windows clients. Probably the more salient reason to not mix profiles is +that when logging off an earlier version of MS Windows, the older format of profile contents may overwrite +information that belongs to the newer version resulting in loss of profile information content when that +user logs on again with the newer version of MS Windows.

    If you then want to share the same Start Menu/Desktop with W9x/Me, you will need to specify a common +location for the profiles. The smb.conf parameters that need to be common are logon path and logon home.

    If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory.

    Profile Migration from Windows NT4/200x Server to Samba

    There is nothing to stop you from specifying any path that you like for the location of users' profiles. +Therefore, you could specify that the profile be stored on a Samba server, or any other SMB server, +as long as that SMB server supports encrypted passwords.

    Windows NT4 Profile Management Tools

    Unfortunately, the Resource Kit information is specific to the version of MS Windows NT4/200x. The +correct resource kit is required for each platform.

    Here is a quick guide:

    1. On your NT4 Domain Controller, right click on My Computer, then select the + tab labeled User Profiles.

    2. Select a user profile you want to migrate and click on it.

      Note

      I am using the term “migrate” loosely. You can copy a profile to create a group + profile. You can give the user Everyone rights to the profile you copy this to. That + is what you need to do, since your Samba domain is not a member of a trust relationship with your NT4 + PDC.

    3. Click on the Copy To button.

    4. In the box labeled Copy Profile to add your new path, e.g., + c:\temp\foobar

    5. Click on Change in the Permitted to use box.

    6. Click on the group “Everyone”, click on OK. This + closes the “choose user” box.

    7. Now click on OK.

    Follow the above for every profile you need to migrate.

    Side Bar Notes

    + +You should obtain the SID of your NT4 domain. You can use smbpasswd to do this. Read the man +page.

    moveuser.exe

    The Windows 200x professional resource kit has moveuser.exe. moveuser.exe changes the security of a profile +from one user to another. This allows the account domain to change, and/or the user name to change.

    +This command is like the Samba profiles tool. +

    Get SID

    + +You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 Resource Kit.

    Windows NT 4.0 stores the local profile information in the registry under the following key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

    Under the ProfileList key, there will be subkeys named with the SIDs of the users who have logged +on to this computer. (To find the profile information for the user whose locally cached profile you want +to move, find the SID for the user with the GetSID.exe utility.) Inside the appropriate user's subkey, +you will see a string value named ProfileImagePath.

    Mandatory Profiles

    + +A Mandatory Profile is a profile that the user does not have the ability to overwrite. During the +user's session, it may be possible to change the desktop environment, however, as the user logs out all changes +made will be lost. If it is desired to not allow the user any ability to change the desktop environment, +then this must be done through policy settings. See the previous chapter.

    Note

    +Under NO circumstances should the profile directory (or its contents) be made read-only +as this may render the profile un-usable. Where it is essential to make a profile read-only +within the UNIX file system, this can be done but then you absolutely must use the fake-permissions +VFS module to instruct MS Windows NT/200x/XP clients that the Profile has write permission for the user. See . +

    For MS Windows NT4/200x/XP, the above method can also be used to create mandatory profiles. To +convert a group profile into a mandatory profile, simply locate the NTUser.DAT file in the copied profile +and rename it to NTUser.MAN.

    For MS Windows 9x/ME, it is the User.DAT file that must be renamed to +User.MAN to effect a mandatory profile.

    Creating and Managing Group Profiles

    + +Most organizations are arranged into departments. There is a nice benefit in this fact since usually +most users in a department require the same desktop applications and the same desktop layout. MS +Windows NT4/200x/XP will allow the use of Group Profiles. A Group Profile is a profile that is created +first using a template (example) user. Then using the profile migration tool (see above), the profile is +assigned access rights for the user group that needs to be given access to the group profile.

    The next step is rather important. Instead of assigning a group profile to users (Using User Manager) +on a “per user” basis, the group itself is assigned the now modified profile.

    Note

    Be careful with Group Profiles. If the user who is a member of a group also has a personal +profile, then the result will be a fusion (merge) of the two.

    Default Profile for Windows Users

    + +MS Windows 9x/Me and NT4/200x/XP will use a default profile for any user for whom a profile +does not already exist. Armed with a knowledge of where the default profile is located on the Windows +workstation, and knowing which registry keys effect the path from which the default profile is created, +it is possible to modify the default profile to one that has been optimized for the site. This has +significant administrative advantages.

    MS Windows 9x/Me

    To enable default per use profiles in Windows 9x/ME, you can either use the Windows +98 System Policy Editor or change the registry directly.

    To enable default per user profiles in Windows 9x/ME, launch the System Policy +Editor, then select File -> Open Registry, +next click on the Local Computer icon, click on Windows 98 System, +select User Profiles, and click on the enable box. Remember to save the registry +changes.

    To modify the registry directly, launch the Registry Editor +(regedit.exe) and select the hive HKEY_LOCAL_MACHINE\Network\Logon. Now +add a DWORD type key with the name “User Profiles,” to +enable user profiles to set the value +to 1; to disable user profiles set it to 0.

    User Profile Handling with Windows 9x/Me

    When a user logs on to a Windows 9x/Me machine, the local profile path, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList, is checked -for an existing entry for that user: -

    -If the user has an entry in this registry location, Windows 9x / Me checks for a locally cached -version of the user profile. Windows 9x / Me also checks the user's home directory (or other -specified directory if the location has been modified) on the server for the User Profile. -If a profile exists in both locations, the newer of the two is used. If the User Profile exists -on the server, but does not exist on the local machine, the profile on the server is downloaded -and used. If the User Profile only exists on the local machine, that copy is used. -

    -If a User Profile is not found in either location, the Default User Profile from the Windows 9x / Me -machine is used and is copied to a newly created folder for the logged on user. At log off, any -changes that the user made are written to the user's local profile. If the user has a roaming -profile, the changes are written to the user's profile on the server. -

    MS Windows NT4 Workstation

    -On MS Windows NT4 the default user profile is obtained from the location +for an existing entry for that user.

    If the user has an entry in this registry location, Windows 9x/Me checks for a locally cached +version of the user profile. Windows 9x/Me also checks the user's home directory (or other specified +directory if the location has been modified) on the server for the User Profile. If a profile exists +in both locations, the newer of the two is used. If the User Profile exists on the server, but does not +exist on the local machine, the profile on the server is downloaded and used. If the User Profile only +exists on the local machine, that copy is used.

    If a User Profile is not found in either location, the Default User Profile from the Windows +9x/Me machine is used and copied to a newly created folder for the logged on user. At log off, any +changes that the user made are written to the user's local profile. If the user has a roaming profile, +the changes are written to the user's profile on the server.

    MS Windows NT4 Workstation

    On MS Windows NT4, the default user profile is obtained from the location %SystemRoot%\Profiles which in a default installation will translate to -C:\WinNT\Profiles. Under this directory on a clean install there will be -three (3) directories: Administrator, All Users, Default User. -

    -The All Users directory contains menu settings that are common across all -system users. The Default User directory contains menu entries that are -customisable per user depending on the profile settings chosen/created. -

    -When a new user first logs onto an MS Windows NT4 machine a new profile is created from: -

    • All Users settings

    • Default User settings (contains the default NTUser.DAT file)

    -When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain -the following steps are followed in respect of profile handling: -

    1. - The users' account information which is obtained during the logon process contains - the location of the users' desktop profile. The profile path may be local to the - machine or it may be located on a network share. If there exists a profile at the location - of the path from the user account, then this profile is copied to the location - %SystemRoot%\Profiles\%USERNAME%. This profile then inherits the - settings in the All Users profile in the %SystemRoot%\Profiles - location. -

    2. - If the user account has a profile path, but at it's location a profile does not exist, - then a new profile is created in the %SystemRoot%\Profiles\%USERNAME% - directory from reading the Default User profile. -

    3. - If the NETLOGON share on the authenticating server (logon server) contains a policy file - (NTConfig.POL) then it's contents are applied to the NTUser.DAT - which is applied to the HKEY_CURRENT_USER part of the registry. -

    4. - When the user logs out, if the profile is set to be a roaming profile it will be written - out to the location of the profile. The NTuser.DAT file is then - re-created from the contents of the HKEY_CURRENT_USER contents. - Thus, should there not exist in the NETLOGON share an NTConfig.POL at the - next logon, the effect of the previous NTConfig.POL will still be held - in the profile. The effect of this is known as tatooing. -

    -MS Windows NT4 profiles may be Local or Roaming. A Local profile -will stored in the %SystemRoot%\Profiles\%USERNAME% location. A roaming profile will -also remain stored in the same way, unless the following registry key is created: -

    -

    -HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
-winlogon\"DeleteRoamingCache"=dword:00000001
-

    +C:\Windows NT\Profiles. Under this directory on a clean install there will be three +(3) directories: Administrator, All +Users, and Default +User.

    The All Users directory contains menu settings that are common across all +system users. The Default User directory contains menu entries that are customizable +per user depending on the profile settings chosen/created.

    When a new user first logs onto an MS Windows NT4 machine, a new profile is created from:

    • All Users settings.

    • Default User settings (contains the default NTUser.DAT file).

    When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain, + the following steps are followed in respect of profile handling: -In which case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be -deleted on logout. -

    -Under MS Windows NT4 default locations for common resources (like My Documents -may be redirected to a network share by modifying the following registry keys. These changes may be affected -via use of the System Policy Editor (to do so may require that you create your owns template extension -for the policy editor to allow this to be done through the GUI. Another way to do this is by way of first -creating a default user profile, then while logged in as that user, run regedt32 to edit the key settings. -

    -The Registry Hive key that affects the behaviour of folders that are part of the default user profile -are controlled by entries on Windows NT4 is: -

    -HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\ -

    -The above hive key contains a list of automatically managed folders. The default entries are: -

    -

    Table 24.1. User Shell Folder registry keys default values

    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    NetHood%USERPROFILE%\NetHood
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu %USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup

    -

    -The registry key that contains the location of the default profile settings is: -

    -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders -

    -The default entries are: + +

    1. The users' account information that is obtained during the logon process + contains the location of the users' desktop profile. The profile path may be local to + the machine or it may be located on a network share. If there exists a profile at the + location of the path from the user account, then this profile is copied to the location + %SystemRoot%\Profiles\%USERNAME%. This profile then inherits the settings + in the All Users profile in the %SystemRoot%\Profiles + location.

    2. If the user account has a profile path, but at its location a profile does not + exist, then a new profile is created in the %SystemRoot%\Profiles\%USERNAME% + directory from reading the Default User profile.

    3. If the NETLOGON share on the authenticating server (logon server) contains + a policy file (NTConfig.POL), then its contents are applied to the + NTUser.DAT which is applied to the HKEY_CURRENT_USER + part of the registry. +

    4. When the user logs out, if the profile is set to be a roaming profile it will be + written out to the location of the profile. The NTuser.DAT file is then + recreated from the contents of the HKEY_CURRENT_USER contents. Thus, + should there not exist in the NETLOGON share an NTConfig.POL at the next + logon, the effect of the previous NTConfig.POL will still be held in the + profile. The effect of this is known as tattooing. +

    MS Windows NT4 profiles may be local or roaming. A local +profile will stored in the %SystemRoot%\Profiles\%USERNAME% location. A roaming +profile will also remain stored in the same way, unless the following registry key is created as shown: 

     HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
+winlogon\"DeleteRoamingCache"=dword:0000000
+

    +In this case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be deleted +on logout.

    Under MS Windows NT4, default locations for common resources like My Documents +may be redirected to a network share by modifying the following registry keys. These changes may be +affected via use of the System Policy Editor. To do so may require that you create your own template +extension for the policy editor to allow this to be done through the GUI. Another way to do this is by +way of first creating a default user profile, then while logged in as that user, run regedt32 to edit +the key settings.

    +The Registry Hive key that affects the behavior of folders that are part of the default user +profile are controlled by entries on Windows NT4 is: +

    +HKEY_CURRENT_USER
+	\Software
+		\Microsoft
+			\Windows
+				\CurrentVersion
+					\Explorer
+						\User Shell Folders
+

    + +

    The above hive key contains a list of automatically managed folders. The default entries are shown in .

    Table 24.1. User Shell Folder Registry Keys Default Values

    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    NetHood%USERPROFILE%\NetHood
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu %USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup

    The registry key that contains the location of the default profile settings is:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ +User Shell Folders

    The default entries are shown in .

    Table 24.2. Defaults of Profile Settings Registry Keys

    Common Desktop%SystemRoot%\Profiles\All Users\Desktop
    Common Programs%SystemRoot%\Profiles\All Users\Programs
    Common Start Menu%SystemRoot%\Profiles\All Users\Start Menu
    Common Startup%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup

    MS Windows 200x/XP

    Note

    + +MS Windows XP Home Edition does use default per user profiles, but cannot participate +in domain security, cannot log onto an NT/ADS-style domain, and thus can obtain the profile only +from itself. While there are benefits in doing this, the beauty of those MS Windows clients that +can participate in domain logon processes allows the administrator to create a global default +profile and enforce it through the use of Group Policy Objects (GPOs). +

    When a new user first logs onto an MS Windows 200x/XP machine, the default profile is obtained from +C:\Documents and Settings\Default User. The administrator can modify or change the +contents of this location and MS Windows 200x/XP will gladly use it. This is far from the optimum arrangement +since it will involve copying a new default profile to every MS Windows 200x/XP client workstation.

    When MS Windows 200x/XP participates in a domain security context, and if the default user profile is + not found, then the client will search for a default profile in the NETLOGON share of the authenticating + server. In MS Windows parlance,%LOGONSERVER%\NETLOGON\Default User, and if one +exists there it will copy this to the workstation to the C:\Documents and Settings\ +under the Windows login name of the user.

    Note

    This path translates, in Samba parlance, to the smb.conf +[NETLOGON] share. The directory should be created at the root +of this share and must be called Default Profile.

    If a default profile does not exist in this location, then MS Windows 200x/XP will use the local +default profile.

    On logging out, the users' desktop profile will be stored to the location specified in the registry +settings that pertain to the user. If no specific policies have been created or passed to the client +during the login process (as Samba does automatically), then the user's profile will be written to the +local machine only under the path C:\Documents and Settings\%USERNAME%.

    Those wishing to modify the default behavior can do so through these three methods:

    • Modify the registry keys on the local machine manually and place the new + default profile in the NETLOGON share root. This is not recommended as it is maintenance intensive. +

    • Create an NT4-style NTConfig.POL file that specified this behavior and locate + this file in the root of the NETLOGON share along with the new default profile.

    • Create a GPO that enforces this through Active Directory, and place the new + default profile in the NETLOGON share.

    The registry hive key that effects the behavior of folders that are part of the default user +profile are controlled by entries on Windows 200x/XP is:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell +Folders\

    +The above hive key contains a list of automatically managed folders. The default entries are shown +in + +

    Table 24.3. Defaults of Default User Profile Paths Registry Keys

    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Cache%USERPROFILE%\Local Settings\Temporary Internet Files
    Cookies%USERPROFILE%\Cookies
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    History%USERPROFILE%\Local Settings\History
    Local AppData%USERPROFILE%\Local Settings\Application Data
    Local Settings%USERPROFILE%\Local Settings
    My Pictures%USERPROFILE%\My Documents\My Pictures
    NetHood%USERPROFILE%\NetHood
    Personal%USERPROFILE%\My Documents
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu%USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup
    Templates%USERPROFILE%\Templates

    There is also an entry called “Default” that has no value set. The default entry is +of type REG_SZ, all the others are of type REG_EXPAND_SZ.

    It makes a huge difference to the speed of handling roaming user profiles if all the folders are +stored on a dedicated location on a network server. This means that it will not be necessary to write +the Outlook PST file over the network for every login and logout.

    To set this to a network location, you could use the following examples:

    %LOGONSERVER%\%USERNAME%\Default Folders

    This would store the folders in the user's home directory under a directory called Default +Folders. You could also use:

    \\SambaServer\FolderShare\%USERNAME%

    +in which case the default folders will be stored in the server named SambaServer +in the share called FolderShare under a directory that has the name of the +MS Windows user as seen by the Linux/UNIX file system.

    Please note that once you have created a default profile share, you MUST migrate a user's profile +(default or custom) to it.

    MS Windows 200x/XP profiles may be Local or Roaming. + A roaming profile will be cached locally unless the following registry key is created: -

    Table 24.2. Defaults of profile settings registry keys

    Common Desktop%SystemRoot%\Profiles\All Users\Desktop
    Common Programs%SystemRoot%\Profiles\All Users\Programs
    Common Start Menu%SystemRoot%\Profiles\All Users\Start Menu
    Common Startup%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup

    -

    MS Windows 200x/XP

    Note

    - MS Windows XP Home Edition does use default per user profiles, but can not participate - in domain security, can not log onto an NT/ADS style domain, and thus can obtain the profile - only from itself. While there are benefits in doing this the beauty of those MS Windows - clients that CAN participate in domain logon processes allows the administrator to create - a global default profile and to enforce it through the use of Group Policy Objects (GPOs). -

    -When a new user first logs onto MS Windows 200x/XP machine the default profile is obtained from -C:\Documents and Settings\Default User. The administrator can modify (or change -the contents of this location and MS Windows 200x/XP will gladly use it. This is far from the optimum -arrangement since it will involve copying a new default profile to every MS Windows 200x/XP client -workstation. -

    -When MS Windows 200x/XP participate in a domain security context, and if the default user -profile is not found, then the client will search for a default profile in the NETLOGON share -of the authenticating server. ie: In MS Windows parlance: -%LOGONSERVER%\NETLOGON\Default User and if one exits there it will copy this -to the workstation to the C:\Documents and Settings\ under the Windows -login name of the user. -

    Note

    - This path translates, in Samba parlance, to the smb.conf [NETLOGON] share. The directory - should be created at the root of this share and must be called Default Profile. -

    -If a default profile does not exist in this location then MS Windows 200x/XP will use the local -default profile. -

    -On logging out, the users' desktop profile will be stored to the location specified in the registry -settings that pertain to the user. If no specific policies have been created, or passed to the client -during the login process (as Samba does automatically), then the user's profile will be written to -the local machine only under the path C:\Documents and Settings\%USERNAME%. -

    -Those wishing to modify the default behaviour can do so through three methods: -

    • - Modify the registry keys on the local machine manually and place the new default profile in the - NETLOGON share root - NOT recommended as it is maintenance intensive. -

    • - Create an NT4 style NTConfig.POL file that specified this behaviour and locate this file - in the root of the NETLOGON share along with the new default profile. -

    • - Create a GPO that enforces this through Active Directory, and place the new default profile - in the NETLOGON share. -

    -The Registry Hive key that affects the behaviour of folders that are part of the default user profile -are controlled by entries on Windows 200x/XP is: -

    -HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\ -

    -The above hive key contains a list of automatically managed folders. The default entries are: -

    -

    Table 24.3. Defaults of default user profile paths registry keys

    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Cache%USERPROFILE%\Local Settings\Temporary Internet Files
    Cookies%USERPROFILE%\Cookies
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    History%USERPROFILE%\Local Settings\History
    Local AppData%USERPROFILE%\Local Settings\Application Data
    Local Settings%USERPROFILE%\Local Settings
    My Pictures%USERPROFILE%\My Documents\My Pictures
    NetHood%USERPROFILE%\NetHood
    Personal%USERPROFILE%\My Documents
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu%USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup
    Templates%USERPROFILE%\Templates

    -

    -There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all -the others are of type REG_EXPAND_SZ. -

    -It makes a huge difference to the speed of handling roaming user profiles if all the folders are -stored on a dedicated location on a network server. This means that it will NOT be necessary to -write the Outlook PST file over the network for every login and logout. -

    -To set this to a network location you could use the following examples: -

    %LOGONSERVER%\%USERNAME%\Default Folders

    -This would store the folders in the user's home directory under a directory called Default Folders -You could also use: -

    \\SambaServer\FolderShare\%USERNAME%

    - in which case the default folders will be stored in the server named SambaServer -in the share called FolderShare under a directory that has the name of the MS Windows -user as seen by the Linux/UNIX file system. -

    -Please note that once you have created a default profile share, you MUST migrate a user's profile -(default or custom) to it. -

    -MS Windows 200x/XP profiles may be Local or Roaming. -A roaming profile will be cached locally unless the following registry key is created: -

    -

    -HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
-	winlogon\"DeleteRoamingCache"=dword:00000001

    -In which case, the local cache copy will be deleted on logout. -

    Common Errors

    -The following are some typical errors/problems/questions that have been asked. -

    Setting up roaming profiles for just a few user's or group's?

    -With samba-2.2.x the choice you have is to enable or disable roaming -profiles support. It is a global only setting. The default is to have -roaming profiles and the default path will locate them in the user's home -directory. -

    -If disabled globally then no-one will have roaming profile ability. -If enabled and you want it to apply only to certain machines, then on -those machines on which roaming profile support is NOT wanted it is then -necessary to disable roaming profile handling in the registry of each such -machine. -

    -With samba-3 you can have a global profile -setting in smb.conf _AND_ you can over-ride this by per-user settings -using the Domain User Manager (as with MS Windows NT4/ Win 2Kx). -

    -In any case, you can configure only one profile per user. That profile can -be either: -

    • A profile unique to that user

    • A mandatory profile (one the user can not change)

    • A group profile (really should be mandatory ie:unchangable)

    Can NOT use Roaming Profiles

    -A user requested the following: -“ -I do not want Roaming profiles to be implemented. I want to give users a local profile alone. ... -Please help me I am totally lost with this error. For the past two days I tried everything, I googled -around but found no useful pointers. Please help me. -”

    -The choices are: -

    Local profiles:

    - I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out -

    Roaming profiles:

    - As a user logs onto the network a centrally stored profile is copied to the workstation - to form a local profile. This local profile will persist (remain on the workstation disk) - unless a registry key is changed that will cause this profile to be automatically deleted - on logout. -

    -The Roaming Profile choices are: -

    Personal Roaming profiles

    - These are typically stored in a profile share on a central (or conveniently located - local) server. -

    - Workstations 'cache' (store) a local copy of the profile. This cached copy is used when - the profile can not be downloaded at next logon. -

    Group profiles

    These are loaded from a central profile server

    Mandatory profiles

    - Mandatory profiles can be created for a user as well as for any group that a user - is a member of. Mandatory profiles can NOT be changed by ordinary users. Only the administrator - can change or reconfigure a mandatory profile. -

    -A WinNT4/2K/XP profile can vary in size from 130KB to off the scale. -Outlook PST files are most often part of the profile and can be many GB in -size. On average (in a well controlled environment) roaming profile size of -2MB is a good rule of thumb to use for planning purposes. In an -undisciplined environment I have seen up to 2GB profiles. Users tend to -complain when it take an hour to log onto a workstation but they harvest -the fruits of folly (and ignorance). -

    -The point of all the above is to show that roaming profiles and good -controls of how they can be changed as well as good discipline make up for -a problem free site. -

    -Microsoft's answer to the PST problem is to store all email in an MS -Exchange Server back-end. This removes the need for a PST file. -

    -LOCAL profiles mean: -

    • If each machine is used my many users then much local disk storage is needed for local profiles

    • Every workstation the user logs into has it's own profile, these can be very different from machine to machine

    -On the other hand, use of roaming profiles means: -

    • The network administrator can control the desktop environment of all users.

    • Use of mandatory profiles drasitcally reduces network management overheads.

    • In the long run users will be experience fewer problems.

    Changing the default profile

    -Question: -“ -When the client logs onto the domain controller it searches for a profile to download, -where do I put this default profile? -”

    -Firstly, the samba server needs to be configured as a domain controller. -This can be done by setting in smb.conf: -

    security = user
    os level = 32 (or more)
    domain logons = Yes

    -There must be an [netlogon] share that is world readable. -It is a good idea to add a logon script to pre-set printer and -drive connections. There is also a facility for automatically -synchronizing the workstation time clock with that of the logon -server (another good thing to do). -

    Note

    -To invoke auto-deletion of roaming profile from the local -workstation cache (disk storage) use the Group Policy Editor -to create a file called NTConfig.POL with the appropriate entries. This -file needs to be located in the netlogon share root directory.

    -Windows clients need to be members of the domain. Workgroup machines do NOT use network logons so -they do not interoperate with domain profiles. -

    -For roaming profiles add to smb.conf: -

    -

    logon path = \\%N\profiles\%U
    # Default logon drive is Z:
    logon drive = H:
    # This requires a PROFILES share that is world writable.

    -

    Prev Up Next
    Chapter 23. System and Account Policies Home Chapter 25. PAM based Distributed Authentication
    + +

     HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
+	winlogon\"DeleteRoamingCache"=dword:00000001

    +In this case, the local cache copy will be deleted on logout. +

    Common Errors

    +The following are some typical errors, problems and questions that have been asked on the Samba mailing lists. +

    Configuring Roaming Profiles for a Few Users or Groups

    +With Samba-2.2.x, the choice you have is to enable or disable roaming profiles support. It is a +global only setting. The default is to have roaming profiles and the default path will locate them in +the user's home directory. +

    +If disabled globally, then no one will have roaming profile ability. If enabled and you want it +to apply only to certain machines, then on those machines on which roaming profile support is not wanted +it is then necessary to disable roaming profile handling in the registry of each such machine. +

    +With Samba-3, you can have a global profile setting in smb.conf and you can override this by +per-user settings using the Domain User Manager (as with MS Windows NT4/ Win 200xx).

    In any case, you can configure only one profile per user. That profile can be either:

    • A profile unique to that user.
    • A mandatory profile (one the user cannot change).
    • A group profile (really should be mandatory, that is unchangable).

    Cannot Use Roaming Profiles

    A user requested the following: “ I do not want Roaming profiles to be implemented. I want +to give users a local profile alone. Please help me, I am totally lost with this error. For the past +two days I tried everything, I googled around but found no useful pointers. Please help me. ”

    The choices are:

    Local profiles

    I know of no registry keys that will allow + auto-deletion of LOCAL profiles on log out.

    Roaming profiles

    As a user logs onto the network, a centrally + stored profile is copied to the workstation to form a local profile. This local profile + will persist (remain on the workstation disk) unless a registry key is changed that will + cause this profile to be automatically deleted on logout.

    The roaming profile choices are:

    Personal roaming profiles

    These are typically stored in + a profile share on a central (or conveniently located local) server.

    Workstations cache (store) a local copy of the profile. This cached + copy is used when the profile cannot be downloaded at next logon.

    Group profiles

    These are loaded from a central profile + server.

    Mandatory profiles

    Mandatory profiles can be created for + a user as well as for any group that a user is a member of. Mandatory profiles cannot be + changed by ordinary users. Only the administrator can change or reconfigure a mandatory + profile.

    A Windows NT4/200x/XP profile can vary in size from 130KB to very large. Outlook PST files are +most often part of the profile and can be many GB in size. On average (in a well controlled environment), +roaming profile size of 2MB is a good rule of thumb to use for planning purposes. In an undisciplined +environment, I have seen up to 2GB profiles. Users tend to complain when it takes an hour to log onto a +workstation but they harvest the fruits of folly (and ignorance).

    The point of all the above is to show that roaming profiles and good controls of how they can be +changed as well as good discipline make up for a problem-free site.

    Microsoft's answer to the PST problem is to store all email in an MS Exchange Server backend. This +removes the need for a PST file.

    Local profiles mean:

    • If each machine is used by many users, then much local disk storage is needed + for local profiles.

    • Every workstation the user logs into has + its own profile; these can be very different from machine to machine.

    On the other hand, use of roaming profiles means:

    • The network administrator can control the desktop environment of all users.

    • Use of mandatory profiles drastically reduces network management overheads.

    • In the long run, users will experience fewer problems.

    Changing the Default Profile

    “When the client logs onto the Domain Controller, it searches +for a profile to download. Where do I put this default profile?”

    + +First, the Samba server needs to be configured as a Domain Controller. This can be done by +setting in smb.conf:

    security = user
    os level = 32 (or more)
    domain logons = Yes

    There must be a [netlogon] share that is world readable. It is +a good idea to add a logon script to pre-set printer and drive connections. There is also a facility +for automatically synchronizing the workstation time clock with that of the logon server (another good +thing to do).

    Note

    To invoke auto-deletion of roaming profile from the local workstation cache (disk storage), use +the Group Policy Editor to create a file called NTConfig.POL +with the appropriate entries. This file needs to be located in the netlogon +share root directory.

    Windows clients need to be members of the domain. Workgroup machines do not use network logons +so they do not interoperate with domain profiles.

    For roaming profiles, add to smb.conf:

    logon path = \\%N\profiles\%U
    # Default logon drive is Z:
    logon drive = H:
    # This requires a PROFILES share that is world writable.
    Prev Up Next
    Chapter 23. System and Account Policies Home Chapter 25. PAM-Based Distributed Authentication
    diff --git a/docs/htmldocs/SWAT.html b/docs/htmldocs/SWAT.html index 30df1ed778..d4c8b78dcf 100644 --- a/docs/htmldocs/SWAT.html +++ b/docs/htmldocs/SWAT.html @@ -1,34 +1,162 @@ -Chapter 32. SWAT - The Samba Web Administration Tool
    Chapter 32. SWAT - The Samba Web Administration Tool
    Prev Part IV. Migration and Updating Next

    Chapter 32. SWAT - The Samba Web Administration Tool

    John H. Terpstra

    Samba Team

    April 21, 2003

    Table of Contents

    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    -There are many and varied opinions regarding the usefulness or otherwise of SWAT. -No matter how hard one tries to produce the perfect configuration tool it remains -an object of personal taste. SWAT is a tool that will allow web based configuration -of samba. It has a wizard that may help to get samba configured quickly, it has context -sensitive help on each smb.conf parameter, it provides for monitoring of current state -of connection information, and it allows network wide MS Windows network password +Chapter 32. SWAT The Samba Web Administration Tool

    Chapter 32. SWAT The Samba Web Administration Tool
    Prev Part IV. Migration and Updating Next

    Chapter 32. SWAT The Samba Web Administration Tool

    John H. Terpstra

    Samba Team

    April 21, 2003

    Table of Contents

    Features and Benefits
    Guidelines and Technical Tips
    Validate SWAT Installation
    Enabling SWAT for Use
    Securing SWAT through SSL
    Enabling SWAT Internationalization Support
    Overview and Quick Tour
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    +There are many and varied opinions regarding the usefulness of SWAT. +No matter how hard one tries to produce the perfect configuration tool, it remains +an object of personal taste. SWAT is a tool that will allow Web-based configuration +of Samba. It has a wizard that may help to get Samba configured +quickly, it has context-sensitive help on each smb.conf parameter, it provides for monitoring of current state +of connection information, and it allows network-wide MS Windows network password management. -

    Features and Benefits

    +

    Features and Benefits

    +SWAT is a facility that is part of the Samba suite. The main executable is called +swat and is invoked by the inter-networking super daemon. +See for details. +

    +SWAT uses integral samba components to locate parameters supported by the particular +version of Samba. Unlike tools and utilities that are external to Samba, SWAT is always +up to date as known Samba parameters change. SWAT provides context-sensitive help for each +configuration parameter, directly from man page entries. +

    There are network administrators who believe that it is a good idea to write systems -documentation inside configuration files, for them SWAT will aways be a nasty tool. SWAT +documentation inside configuration files, and for them SWAT will aways be a nasty tool. SWAT does not store the configuration file in any intermediate form, rather, it stores only the -parameter settings, so when SWAT writes the smb.conf file to disk it will write only -those parameters that are at other than the default settings. The result is that all comments -will be lost from the smb.conf file. Additionally, the parameters will be written back in -internal ordering. +parameter settings, so when SWAT writes the smb.conf file to disk, it will write only +those parameters that are at other than the default settings. The result is that all comments, +as well as parameters that are no longer supported, will be lost from the smb.conf file. +Additionally, the parameters will be written back in internal ordering.

    Note

    -So before using SWAT please be warned - SWAT will completely replace your smb.conf with -a fully optimised file that has been stripped of all comments you might have placed there +Before using SWAT, please be warned SWAT will completely replace your smb.conf with +a fully-optimized file that has been stripped of all comments you might have placed there and only non-default settings will be written to the file. -

    Enabling SWAT for use

    -SWAT should be installed to run via the network super daemon. Depending on which system -your UNIX/Linux system has you will have either an inetd or -xinetd based system. +

    Guidelines and Technical Tips

    +This section aims to unlock the dark secrets behind how SWAT may be made to work, +may be made more secure, and how to solve Internationalization support problems. +

    Validate SWAT Installation

    +The very first step that should be taken before attempting to configure a host +system for SWAT operation is to check that it is installed. This may seem a trivial +point to some, however several Linux distributions do not install SWAT by default, +even though they do ship an installable binary support package containing SWAT +on the distribution media. +

    +When you have configrmed that SWAT is installed it is necessary to validate +that the installation includes the binary swat file as well +as all the supporting text and Web files. A number of operating system distributions +in the past have failed to include the necessary support files, evne though the +swat binary executable file was installed. +

    +Finally, when you are sure that SWAT has been fully installed, please check the SWAT +has been enebled in the control file for the internetworking super-daemon (inetd or xinetd) +that is used on your operating system platform. +

    Locating the swat File

    +To validate that SWAT is installed, first locate the swat binary +file on the system. It may be found under the following directories: +

    /usr/local/samba/bin the default Samba location.
    /usr/sbin the default location on most Linux systems.
    /opt/samba/bin

    +

    +The actual location is much dependant on the choice of the operating system vendor, or as determined +by the administrator who compiled and installed Samba. +

    +There are a number methods that may be used to locate the swat binary file. +The following methods may be helpful: +

    +If swat is in your current operating system search path it will be easy to +find it. You can ask what are the command-line options for swat as shown here: +

    +frodo:~ # swat -?
+Usage: swat [OPTION...]
+  -a, --disable-authentication         Disable authentication (demo mode)
+
+Help options:
+  -?, --help                           Show this help message
+  --usage                              Display brief usage message
+
+Common samba options:
+  -d, --debuglevel=DEBUGLEVEL          Set debug level
+  -s, --configfile=CONFIGFILE          Use alternative configuration file
+  -l, --log-basename=LOGFILEBASE       Basename for log/debug files
+  -V, --version                        Print version
+

    +

    Locating the SWAT Support Files

    +Now that you have found that swat is in the search path, it is easy +to identify where the file is located. Here is another simple way this may be done: +

    +frodo:~ # whereis swat
+swat: /usr/sbin/swat /usr/share/man/man8/swat.8.gz
+

    +

    +If the above measures fail to locate the swat binary, another approach +is needed. The following may be used: +

    +frodo:/ # find / -name swat -print
+/etc/xinetd.d/swat
+/usr/sbin/swat
+/usr/share/samba/swat
+frodo:/ #
+

    +

    +This list shows that there is a control file for xinetd, the internetwork +super-daemon that is installed on this server. The location of the SWAT binary file is +/usr/sbin/swat, and the support files for it are located under the +directory /usr/share/samba/swat. +

    +We must now check where swat expects to find its support files. This can +be done as follows: +

    +frodo:/ # strings /usr/sbin/swat | grep "/swat"
+/swat/
+...
+/usr/share/samba/swat
+frodo:/ #
+

    +

    +The /usr/share/samba/swat/ entry shown in this listing is the location of the +support files. You should verify that the support files exist under this directory. A sample +list is as shown: +

    +jht@frodo:/> find /usr/share/samba/swat -print
+/usr/share/samba/swat
+/usr/share/samba/swat/help
+/usr/share/samba/swat/lang
+/usr/share/samba/swat/lang/ja
+/usr/share/samba/swat/lang/ja/help
+/usr/share/samba/swat/lang/ja/help/welcome.html
+/usr/share/samba/swat/lang/ja/images
+/usr/share/samba/swat/lang/ja/images/home.gif
+...
+/usr/share/samba/swat/lang/ja/include
+/usr/share/samba/swat/lang/ja/include/header.nocss.html
+...
+/usr/share/samba/swat/lang/tr
+/usr/share/samba/swat/lang/tr/help
+/usr/share/samba/swat/lang/tr/help/welcome.html
+/usr/share/samba/swat/lang/tr/images
+/usr/share/samba/swat/lang/tr/images/home.gif
+...
+/usr/share/samba/swat/lang/tr/include
+/usr/share/samba/swat/lang/tr/include/header.html
+/usr/share/samba/swat/using_samba
+...
+/usr/share/samba/swat/images
+/usr/share/samba/swat/images/home.gif
+...
+/usr/share/samba/swat/include
+/usr/share/samba/swat/include/footer.html
+/usr/share/samba/swat/include/header.html
+jht@frodo:/>
+

    +

    +If the files needed are not available it will be necessary to obtain and install them +before SWAT can be used. +

    Enabling SWAT for Use

    +SWAT should be installed to run via the network super-daemon. Depending on which system +your UNIX/Linux system has, you will have either an inetd- or +xinetd-based system.

    The nature and location of the network super-daemon varies with the operating system implementation. The control file (or files) can be located in the file -/etc/inetd.conf or in the directory /etc/[x]inet.d +/etc/inetd.conf or in the directory /etc/[x]inet[d].d or similar.

    The control entry for the older style file might be: + 

     	# swat is the Samba Web Administration Tool
 	swat stream tcp nowait.400 root /usr/sbin/swat swat
@@ -36,164 +164,212 @@ The control entry for the older style file might be:
 A control file for the newer style xinetd could be:
 
    
 
    -	# default: off
-	# description: SWAT is the Samba Web Admin Tool. Use swat \
-	#              to configure your Samba server. To use SWAT, \
-	#              connect to port 901 with your favorite web browser.
-	service swat
-	{
-		port    = 901
-		socket_type     = stream
-		wait    = no
-		only_from = localhost
-		user    = root
-		server  = /usr/sbin/swat
-		log_on_failure  += USERID
-		disable = yes
-	}
+# default: off
+# description: SWAT is the Samba Web Admin Tool. Use swat \
+#              to configure your Samba server. To use SWAT, \
+#              connect to port 901 with your favorite web browser.
+service swat
+{
+	port    = 901
+	socket_type     = stream
+	wait    = no
+	only_from = localhost
+	user    = root
+	server  = /usr/sbin/swat
+	log_on_failure  += USERID
+	disable = yes
+}
 
    
 
 
    
-Both the above examples assume that the swat binary has been
-located in the /usr/sbin directory. In addition to the above
-SWAT will use a directory access point from which it will load it's help files
+Both of the above examples assume that the swat binary has been
+located in the /usr/sbin directory. In addition to the above,
+SWAT will use a directory access point from which it will load its Help files
 as well as other control information. The default location for this on most Linux
 systems is in the directory /usr/share/samba/swat. The default
-location using samba defaults will be /usr/local/samba/swat.
+location using Samba defaults will be /usr/local/samba/swat.
 
    
-Access to SWAT will prompt for a logon. If you log onto SWAT as any non-root user
+Access to SWAT will prompt for a logon. If you log onto SWAT as any non-root user,
 the only permission allowed is to view certain aspects of configuration as well as
 access to the password change facility. The buttons that will be exposed to the non-root
 user are: HOME, STATUS, VIEW, 
 PASSWORD. The only page that allows
 change capability in this case is PASSWORD.
 
    
-So long as you log onto SWAT as the user root you should obtain
-full change and commit ability. The buttons that will be exposed includes:
+As long as you log onto SWAT as the user root, you should obtain
+full change and commit ability. The buttons that will be exposed include:
 HOME, GLOBALS, SHARES, PRINTERS, 
 WIZARD, STATUS, VIEW, PASSWORD.
-

    Securing SWAT through SSL

    -Lots of people have asked about how to setup SWAT with SSL to allow for secure remote -administration of Samba. Here is a method that works, courtesy of Markus Krieger +

    Securing SWAT through SSL

    + +Many people have asked about how to setup SWAT with SSL to allow for secure remote +administration of Samba. Here is a method that works, courtesy of Markus Krieger.

    -Modifications to the swat setup are as following: +Modifications to the SWAT setup are as follows:

    1. - install OpenSSL + Install OpenSSL.

    2. - generate certificate and private key + Generate certificate and private key. 

       root# /usr/bin/openssl req -new -x509 -days 365 -nodes -config \
 	/usr/share/doc/packages/stunnel/stunnel.cnf \
 	-out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem

    3. - remove swat-entry from [x]inetd + Remove swat-entry from [x]inetd.

    4. - start stunnel + Start stunnel. 

       root# stunnel -p /etc/stunnel/stunnel.pem -d 901 \
 	 -l /usr/local/samba/bin/swat swat

    -afterwords simply contact to swat by using the URL https://myhost:901, accept the certificate +Afterward, simply connect to swat by using the URL https://myhost:901, accept the certificate and the SSL connection is up. -

    The SWAT Home Page

    +

    Enabling SWAT Internationalization Support

    +SWAT can be configured to display its messages to match the settings of +the language configurations of your Web browser. It will be passed to SWAT +in the Accept-Language header of the HTTP request. +

    + +

    +To enable this feature: +

    + +

    • + Install the proper msg files from the Samba + source/po directory into $LIBDIR. +

    • + Set the correct locale value for display charset. +

    • + Set your browser's language setting. +

    + +

    +The name of msg file is same as the language ID sent by the browser. For +example en means "English", ja means "Japanese", fr means "French. +

    + +

    +If you do not like some of messages, or there are no msg files for +your locale, you can create them simply by copying the en.msg files +to the dirertory for “your language ID.msg” and filling in proper strings +to each “msgstr”. For example, in it.msg, the +msg file for the Italian locale, just set: +

    +msgid "Set Default"
+msgstr "Imposta Default"
+

    +and so on. If you find a mistake or create a new msg file, please email it +to us so we will include this in the next release of Samba. +

    + +

    +Note that if you enable this feature and the display charset is not +matched to your browser's setting, the SWAT display may be corrupted. In a future version of +Samba, SWAT will always display messages with UTF-8 encoding. You will then not need to set +this smb.conf file parameter. +

    Overview and Quick Tour

    +SWAT is a tools that many be used to configure Samba, or just to obtain useful links +to important reference materials such as the contents of this book, as well as other +documents that have been found useful for solving Windows networking problems. +

    The SWAT Home Page

    The SWAT title page provides access to the latest Samba documentation. The manual page for -each samba component is accessible from this page as are the Samba-HOWTO-Collection (this -document) as well as the O'Reilly book "Using Samba". +each Samba component is accessible from this page, as are the Samba HOWTO-Collection (this +document) as well as the O'Reilly book “Using Samba.”

    -Administrators who wish to validate their samba configuration may obtain useful information +Administrators who wish to validate their Samba configuration may obtain useful information from the man pages for the diagnostic utilities. These are available from the SWAT home page -also. One diagnostic tool that is NOT mentioned on this page, but that is particularly -useful is ethereal. +also. One diagnostic tool that is not mentioned on this page, but that is particularly +useful is ethereal.

    Warning

    -SWAT can be configured to run in demo mode. This is NOT recommended -as it runs SWAT without authentication and with full administrative ability. ie: Allows -changes to smb.conf as well as general operation with root privileges. The option that -creates this ability is the -a flag to swat. Do not use this in any +SWAT can be configured to run in demo mode. This is not recommended +as it runs SWAT without authentication and with full administrative ability. Allows +changes to smb.conf as well as general operation with root privileges. The option that +creates this ability is the -a flag to swat. Do not use this in a production environment. -

    Global Settings

    -The Globals button will expose a page that allows configuration of the global parameters -in smb.conf. There are three levels of exposure of the parameters: +

    Global Settings

    +The GLOBALS button will expose a page that allows configuration of the global parameters +in smb.conf. There are two levels of exposure of the parameters:

    • - Basic - exposes common configuration options. + Basic exposes common configuration options.

    • - Advanced - exposes configuration options needed in more + Advanced exposes configuration options needed in more complex environments. -

    • - Developer - exposes configuration options that only the brave - will want to tamper with.

    -To switch to other than Basic editing ability click on either the -Advanced or the Developer button. You may also -do this by clicking on the radio button, then click the Commit Changes button. +To switch to other than Basic editing ability, click on Advanced. +You may also do this by clicking on the radio button, then click on the Commit Changes button.

    -After making any changes to configuration parameters make sure that you click on the -Commit Changes button before moving to another area otherwise -your changes will be immediately lost. +After making any changes to configuration parameters, make sure that +you click on the +Commit Changes button before moving to another area, otherwise +your changes will be lost.

    Note

    -SWAT has context sensitive help. To find out what each parameter is for simply click the +SWAT has context-sensitive help. To find out what each parameter is +for, simply click on the Help link to the left of the configuration parameter. -

    Share Settings

    -To affect a currently configured share, simply click on the pull down button between the +

    Share Settings

    +To effect a currently configured share, simply click on the pull down button between the Choose Share and the Delete Share buttons, -select the share you wish to operate on, then to edit the settings click on the -Choose Share button, to delete the share simply press the +select the share you wish to operate on, then to edit the settings +click on the +Choose Share button. To delete the share, simply press the Delete Share button.

    -To create a new share, next to the button labelled Create Share enter +To create a new share, next to the button labeled Create Share enter into the text field the name of the share to be created, then click on the Create Share button. -

    Printers Settings

    +

    Printers Settings

    To affect a currently configured printer, simply click on the pull down button between the Choose Printer and the Delete Printer buttons, -select the printer you wish to operate on, then to edit the settings click on the -Choose Printer button, to delete the share simply press the +select the printer you wish to operate on, then to edit the settings +click on the +Choose Printer button. To delete the share, simply press the Delete Printer button.

    -To create a new printer, next to the button labelled Create Printer enter +To create a new printer, next to the button labeled Create Printer enter into the text field the name of the share to be created, then click on the Create Printer button. -

    The SWAT Wizard

    -The purpose if the SWAT Wizard is to help the Microsoft knowledgeable network administrator +

    The SWAT Wizard

    +The purpose if the SWAT Wizard is to help the Microsoft-knowledgeable network administrator to configure Samba with a minimum of effort.

    -The Wizard page provides a tool for rewriting the smb.conf file in fully optimised format. -This will also happen if you press the commit button. The two differ in the the rewrite button -ignores any changes that may have been made, while the Commit button causes all changes to be -affected. +The Wizard page provides a tool for rewriting the smb.conf file in fully optimized format. +This will also happen if you press the Commit button. The two differ +since the Rewrite button ignores any changes that may have been made, +while the Commit button causes all changes to be affected.

    The Edit button permits the editing (setting) of the minimal set of options that may be necessary to create a working Samba server.

    Finally, there are a limited set of options that will determine what type of server Samba will be configured for, whether it will be a WINS server, participate as a WINS client, or -operate with no WINS support. By clicking on one button you can elect to expose (or not) user +operate with no WINS support. By clicking one button, you can elect to expose (or not) user home directories. -

    The Status Page

    -The status page serves a limited purpose. Firstly, it allows control of the samba daemons. -The key daemons that create the samba server environment are: smbd, nmbd, winbindd. +

    The Status Page

    +The status page serves a limited purpose. First, it allows control of the Samba daemons. +The key daemons that create the Samba server environment are: smbd, nmbd, winbindd.

    The daemons may be controlled individually or as a total group. Additionally, you may set -an automatic screen refresh timing. As MS Windows clients interact with Samba new smbd processes +an automatic screen refresh timing. As MS Windows clients interact with Samba, new smbd processes will be continually spawned. The auto-refresh facility will allow you to track the changing conditions with minimal effort.

    Lastly, the Status page may be used to terminate specific smbd client connections in order to free files that may be locked. -

    The View Page

    -This page allows the administrator to view the optimised smb.conf file and, if you are +

    The View Page

    +This page allows the administrator to view the optimized smb.conf file and, if you are particularly masochistic, will permit you also to see all possible global configuration parameters and their settings. -

    The Password Change Page

    -The Password Change page is a popular tool. This tool allows the creation, deletion, deactivation -and reactivation of MS Windows networking users on the local machine. Alternatively, you can use +

    The Password Change Page

    +The Password Change page is a popular tool that allows the creation, deletion, deactivation, +and reactivation of MS Windows networking users on the local machine. Alternately, you can use this tool to change a local password for a user account.

    -When logged in as a non-root account the user will have to provide the old password as well as -the new password (twice). When logged in as root only the new password is +When logged in as a non-root account, the user will have to provide the old password as well as +the new password (twice). When logged in as root, only the new password is required.

    One popular use for this tool is to change user passwords across a range of remote MS Windows servers. -

    Prev Up Next
    Chapter 31. Migration from NT4 PDC to Samba-3 PDC Home Part V. Troubleshooting
    +

    Prev Up Next
    Chapter 31. Migration from NT4 PDC to Samba-3 PDC Home Part V. Troubleshooting
    diff --git a/docs/htmldocs/Samba-Developers-Guide.html b/docs/htmldocs/Samba-Developers-Guide.html index 97e48f3e27..2c9329518b 100644 --- a/docs/htmldocs/Samba-Developers-Guide.html +++ b/docs/htmldocs/Samba-Developers-Guide.html @@ -20,21 +20,21 @@ people developing samba or those interested in doing so. It's nothing more than a collection of documents written by samba developers about the internals of various parts of samba and the SMB protocol. It's still incomplete. The most recent version of this document -can be found at http://devel.samba.org/. -Please send updates to Jelmer Vernooij. +can be found at http://devel.samba.org/. +Please send updates to Jelmer Vernooij.

    This documentation is distributed under the GNU General Public License (GPL) version 2. A copy of the license is included with the Samba source -distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt -

    Table of Contents

    Attributions
    1. Definition of NetBIOS Protocol and Name Resolution Modes
    NETBIOS
    BROADCAST NetBIOS
    NBNS NetBIOS
    2. Samba Architecture
    Introduction
    Multithreading and Samba
    Threading smbd
    Threading nmbd
    nbmd Design
    3. The samba DEBUG system
    New Output Syntax
    The DEBUG() Macro
    The DEBUGADD() Macro
    The DEBUGLVL() Macro
    New Functions
    dbgtext()
    dbghdr()
    format_debug_text()
    4. Coding Suggestions
    5. Samba Internals
    Character Handling
    The new functions
    Macros in byteorder.h
    CVAL(buf,pos)
    PVAL(buf,pos)
    SCVAL(buf,pos,val)
    SVAL(buf,pos)
    IVAL(buf,pos)
    SVALS(buf,pos)
    IVALS(buf,pos)
    SSVAL(buf,pos,val)
    SIVAL(buf,pos,val)
    SSVALS(buf,pos,val)
    SIVALS(buf,pos,val)
    RSVAL(buf,pos)
    RIVAL(buf,pos)
    RSSVAL(buf,pos,val)
    RSIVAL(buf,pos,val)
    LAN Manager Samba API
    Parameters
    Return value
    Code character table
    6. The smb.conf file
    Lexical Analysis
    Handling of Whitespace
    Handling of Line Continuation
    Line Continuation Quirks
    Syntax
    About params.c
    7. NetBIOS in a Unix World
    Introduction
    Usernames
    File Ownership
    Passwords
    Locking
    Deny Modes
    Trapdoor UIDs
    Port numbers
    Protocol Complexity
    8. Tracing samba system calls
    9. Finding useful information on windows
    Netlogon debugging output
    10. NT Domain RPC's
    Introduction
    Sources
    Credits
    Notes and Structures
    Notes
    Enumerations
    Structures
    MSRPC over Transact Named Pipe
    MSRPC Pipes
    Header
    Tail
    RPC Bind / Bind Ack
    NTLSA Transact Named Pipe
    LSA Open Policy
    LSA Query Info Policy
    LSA Enumerate Trusted Domains
    LSA Open Secret
    LSA Close
    LSA Lookup SIDS
    LSA Lookup Names
    NETLOGON rpc Transact Named Pipe
    LSA Request Challenge
    LSA Authenticate 2
    LSA Server Password Set
    LSA SAM Logon
    LSA SAM Logoff
    \\MAILSLOT\NET\NTLOGON
    Query for PDC
    SAM Logon
    SRVSVC Transact Named Pipe
    Net Share Enum
    Net Server Get Info
    Cryptographic side of NT Domain Authentication
    Definitions
    Protocol
    Comments
    SIDs and RIDs
    Well-known SIDs
    Well-known RIDS
    11. Samba Printing Internals
    Abstract
    +distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt +

    Table of Contents

    Attributions
    1. Definition of NetBIOS Protocol and Name Resolution Modes
    NETBIOS
    BROADCAST NetBIOS
    NBNS NetBIOS
    2. Samba Architecture
    Introduction
    Multithreading and Samba
    Threading smbd
    Threading nmbd
    nbmd Design
    3. The samba DEBUG system
    New Output Syntax
    The DEBUG() Macro
    The DEBUGADD() Macro
    The DEBUGLVL() Macro
    New Functions
    dbgtext()
    dbghdr()
    format_debug_text()
    4. Coding Suggestions
    5. Samba Internals
    Character Handling
    The new functions
    Macros in byteorder.h
    CVAL(buf,pos)
    PVAL(buf,pos)
    SCVAL(buf,pos,val)
    SVAL(buf,pos)
    IVAL(buf,pos)
    SVALS(buf,pos)
    IVALS(buf,pos)
    SSVAL(buf,pos,val)
    SIVAL(buf,pos,val)
    SSVALS(buf,pos,val)
    SIVALS(buf,pos,val)
    RSVAL(buf,pos)
    RIVAL(buf,pos)
    RSSVAL(buf,pos,val)
    RSIVAL(buf,pos,val)
    LAN Manager Samba API
    Parameters
    Return value
    Code character table
    6. The smb.conf file
    Lexical Analysis
    Handling of Whitespace
    Handling of Line Continuation
    Line Continuation Quirks
    Syntax
    About params.c
    7. NetBIOS in a Unix World
    Introduction
    Usernames
    File Ownership
    Passwords
    Locking
    Deny Modes
    Trapdoor UIDs
    Port numbers
    Protocol Complexity
    8. Tracing samba system calls
    9. Finding useful information on windows
    Netlogon debugging output
    10. NT Domain RPC's
    Introduction
    Sources
    Credits
    Notes and Structures
    Notes
    Enumerations
    Structures
    MSRPC over Transact Named Pipe
    MSRPC Pipes
    Header
    Tail
    RPC Bind / Bind Ack
    NTLSA Transact Named Pipe
    LSA Open Policy
    LSA Query Info Policy
    LSA Enumerate Trusted Domains
    LSA Open Secret
    LSA Close
    LSA Lookup SIDS
    LSA Lookup Names
    NETLOGON rpc Transact Named Pipe
    LSA Request Challenge
    LSA Authenticate 2
    LSA Server Password Set
    LSA SAM Logon
    LSA SAM Logoff
    \\MAILSLOT\NET\NTLOGON
    Query for PDC
    SAM Logon
    SRVSVC Transact Named Pipe
    Net Share Enum
    Net Server Get Info
    Cryptographic side of NT Domain Authentication
    Definitions
    Protocol
    Comments
    SIDs and RIDs
    Well-known SIDs
    Well-known RIDS
    11. Samba Printing Internals
    Abstract
    Printing Interface to Various Back ends -
    +
    Print Queue TDB's -
    +
    ChangeID and Client Caching of Printer Information -
    +
    Windows NT/2K Printer Change Notify -
    12. Samba WINS Internals
    WINS Failover
    13. The Upcoming SAM System
    Security in the 'new SAM'
    Standalone from UNIX
    Handles and Races in the new SAM
    Layers
    Application
    SAM Interface
    SAM Modules
    SAM Modules
    Special Module: sam_passdb
    sam_ads
    Memory Management
    Testing
    14. LanMan and NT Password Encryption
    Introduction
    How does it work?
    The smbpasswd file
    15. Modules
    Advantages
    Loading modules
    Static modules
    Shared modules
    Writing modules
    Static/Shared selection in configure.in
    16. RPC Pluggable Modules
    About
    General Overview
    17. VFS Modules
    The Samba (Posix) VFS layer
    The general interface
    Possible VFS operation layers
    The Interaction between the Samba VFS subsystem and the modules
    Initialization and registration
    How the Modules handle per connection data
    Upgrading to the New VFS Interface
    Upgrading from 2.2.* and 3.0aplha modules
    Some Notes
    Implement TRANSPARENT functions
    Implement OPAQUE functions
    18. Notes to packagers
    Versioning
    Modules
    19. Contributing code

    Attributions

    Definition of NetBIOS Protocol and Name Resolution Modes

    • Luke Leighton

    Samba Architecture

    • Dan Shearer

    The samba DEBUG system

    • Chris Hertel

    Coding Suggestions

    • Steve French

    • Simo Sorce

    • Andrew Bartlett

    • Tim Potter

    • Martin Pool

    Samba Internals

    The smb.conf file

    • Chris Hertel

    NetBIOS in a Unix World

    • Andrew Tridgell

    Tracing samba system calls

    • Andrew Tridgell

    Finding useful information on windows

    NT Domain RPC's

    Samba Printing Internals

    • Gerald Carter

    Samba WINS Internals

    • Gerald Carter

    The Upcoming SAM System

    • Andrew Bartlett

    LanMan and NT Password Encryption

    Modules

    RPC Pluggable Modules

    VFS Modules

    Notes to packagers

    • Jelmer Vernooij

    Contributing code

    Chapter 1. Definition of NetBIOS Protocol and Name Resolution Modes

    Luke Leighton

    12 June 1997

    Table of Contents

    NETBIOS
    BROADCAST NetBIOS
    NBNS NetBIOS

    NETBIOS

    +

    12. Samba WINS Internals
    WINS Failover
    13. The Upcoming SAM System
    Security in the 'new SAM'
    Standalone from UNIX
    Handles and Races in the new SAM
    Layers
    Application
    SAM Interface
    SAM Modules
    SAM Modules
    Special Module: sam_passdb
    sam_ads
    Memory Management
    Testing
    14. LanMan and NT Password Encryption
    Introduction
    How does it work?
    The smbpasswd file
    15. Modules
    Advantages
    Loading modules
    Static modules
    Shared modules
    Writing modules
    Static/Shared selection in configure.in
    16. RPC Pluggable Modules
    About
    General Overview
    17. VFS Modules
    The Samba (Posix) VFS layer
    The general interface
    Possible VFS operation layers
    The Interaction between the Samba VFS subsystem and the modules
    Initialization and registration
    How the Modules handle per connection data
    Upgrading to the New VFS Interface
    Upgrading from 2.2.* and 3.0aplha modules
    Some Notes
    Implement TRANSPARENT functions
    Implement OPAQUE functions
    18. Notes to packagers
    Versioning
    Modules
    19. Contributing code

    Attributions

    • Luke Leighton

    • Dan Shearer

    • Chris Hertel

    • Steve French

    • Simo Sorce

    • Andrew Bartlett

    • Tim Potter

    • Martin Pool

    • David Chappell <David.Chappell@mail.trincoll.edu>

    • Chris Hertel

    • Andrew Tridgell

    • Andrew Tridgell

    • Jelmer R. Vernooij <jelmer@samba.org>

    • Andrew Tridgell <tridge@samba.org>

    • Luke Leighton <lkcl@switchboard.net>

    • Paul Ashton <paul@argo.demon.co.uk>

    • Duncan Stansfield <duncans@sco.com>

    • Gerald Carter

    • Gerald Carter

    • Andrew Bartlett

    • Jeremy Allison <samba@samba.org>

    • Jelmer Vernooij <jelmer@samba.org>

    • Anthony Liguori <aliguor@us.ibm.com>

    • Jelmer Vernooij <jelmer@samba.org>

    • Alexander Bokovoy <ab@samba.org>

    • Stefan Metzmacher <metze@metzemix.de>

    • Jelmer Vernooij

    • Jelmer R. Vernooij <jelmer@samba.org>

    Chapter 1. Definition of NetBIOS Protocol and Name Resolution Modes

    Luke Leighton

    12 June 1997

    Table of Contents

    NETBIOS
    BROADCAST NetBIOS
    NBNS NetBIOS

    NETBIOS

    NetBIOS runs over the following tranports: TCP/IP; NetBEUI and IPX/SPX. Samba only uses NetBIOS over TCP/IP. For details on the TCP/IP NetBIOS Session Service NetBIOS Datagram Service, and NetBIOS Names, see @@ -75,7 +75,7 @@ NetBIOS names are either UNIQUE or GROUP. Only one application can claim a UNIQUE NetBIOS name on a network.

    There are two kinds of NetBIOS Name resolution: Broadcast and Point-to-Point. -

    BROADCAST NetBIOS

    +

    BROADCAST NetBIOS

    Clients can claim names, and therefore offer services on successfully claimed names, on their broadcast-isolated subnet. One way to get NetBIOS services (such as browsing: see ftp.microsoft.com/drg/developr/CIFS/browdiff.txt; and @@ -87,7 +87,7 @@ find that some of your hosts spend 95 percent of their time dealing with broadcast traffic. [If you have IPX/SPX on your LAN or WAN, you will find that this is already happening: a packet analyzer will show, roughly every twelve minutes, great swathes of broadcast traffic!]. -

    NBNS NetBIOS

    +

    NBNS NetBIOS

    rfc1001.txt describes, amongst other things, the implementation and use of, a 'NetBIOS Name Service'. NT/AS offers 'Windows Internet Name Service' which is fully rfc1001/2 compliant, but has had to take specific action @@ -128,7 +128,7 @@ WINS Clients therefore claim names from the WINS server. If the WINS server allows them to register a name, the client's NetBIOS session service can then offer services on this name. Other WINS clients will then contact the WINS server to resolve a NetBIOS name. -

    Chapter 2. Samba Architecture

    Dan Shearer

    November 1997

    Table of Contents

    Introduction
    Multithreading and Samba
    Threading smbd
    Threading nmbd
    nbmd Design

    Introduction

    +

    Chapter 2. Samba Architecture

    Dan Shearer

    November 1997

    Table of Contents

    Introduction
    Multithreading and Samba
    Threading smbd
    Threading nmbd
    nbmd Design

    Introduction

    This document gives a general overview of how Samba works internally. The Samba Team has tried to come up with a model which is the best possible compromise between elegance, portability, security @@ -139,7 +139,7 @@ It also tries to answer some of the frequently asked questions such as:

    1. Is Samba secure when running on Unix? The xyz platform? What about the root priveliges issue? -

    2. Pros and cons of multithreading in various parts of Samba

    3. Why not have a separate process for name resolution, WINS, and browsing?

    Multithreading and Samba

    +

  • Pros and cons of multithreading in various parts of Samba

  • Why not have a separate process for name resolution, WINS, and browsing?

    • Multithreading and Samba

    People sometimes tout threads as a uniformly good thing. They are very nice in their place but are quite inappropriate for smbd. nmbd is another matter, and multi-threading it would be very nice. @@ -156,7 +156,7 @@ smbd multi-threaded. Multi-threading would actually make Samba much slower, less scalable, less portable and much less robust. The fact that we use a separate process for each connection is one of Samba's biggest advantages. -

    Threading smbd

    +

    Threading smbd

    A few problems that would arise from a threaded smbd are:

    1. It's not only to create threads instead of processes, but you @@ -181,7 +181,7 @@ A few problems that would arise from a threaded smbd are:

    2. we couldn't use the system locking calls as the locking context of fcntl() is a process, not a thread. -

    Threading nmbd

    +

    Threading nmbd

    This would be ideal, but gets sunk by portability requirements.

    Andrew tried to write a test threads library for nmbd that used only @@ -208,7 +208,7 @@ packet that arrives. Having a pool of processes is possible but is nasty to program cleanly due to the enormous amount of shared data (in complex structures) between the processes. We can't rely on each platform having a shared memory system. -

    nbmd Design

    +

    nbmd Design

    Originally Andrew used recursion to simulate a multi-threaded environment, which use the stack enormously and made for really confusing debugging sessions. Luke Leighton rewrote it to use a @@ -229,7 +229,7 @@ keeps the idea of a distinct packet. See "struct packet_struct" in nameserv.h. It has all the detail but none of the on-the-wire mess. This makes it ideal for using in disk or memory-based databases for browsing and WINS support. -

    Chapter 3. The samba DEBUG system

    Chris Hertel

    July 1998

    Table of Contents

    New Output Syntax
    The DEBUG() Macro
    The DEBUGADD() Macro
    The DEBUGLVL() Macro
    New Functions
    dbgtext()
    dbghdr()
    format_debug_text()

    New Output Syntax

    +

    Chapter 3. The samba DEBUG system

    Chris Hertel

    July 1998

    Table of Contents

    New Output Syntax
    The DEBUG() Macro
    The DEBUGADD() Macro
    The DEBUGLVL() Macro
    New Functions
    dbgtext()
    dbghdr()
    format_debug_text()

    New Output Syntax

    The syntax of a debugging log file is represented as: 

       >debugfile< :== { >debugmsg< }
@@ -282,7 +282,7 @@ by a newline.
 Note that in the above example the function names are not listed on
 the header line. That's because the example above was generated on an
 SGI Indy, and the SGI compiler doesn't support the __FUNCTION__ macro.
-

    The DEBUG() Macro

    +

    The DEBUG() Macro

    Use of the DEBUG() macro is unchanged. DEBUG() takes two parameters. The first is the message level, the second is the body of a function call to the Debug1() function. @@ -333,7 +333,7 @@ would look like this: [1998/07/30 16:00:51, 0] file.c:function(261) .

    Which isn't much use. The format buffer kludge fixes this problem. -

    The DEBUGADD() Macro

    +

    The DEBUGADD() Macro

    In addition to the kludgey solution to the broken line problem described above, there is a clean solution. The DEBUGADD() macro never generates a header. It will append new text to the current debug @@ -347,7 +347,7 @@ DEBUGADD() macro is the same as that of the DEBUG() macro. This is the first line. This is the second line. This is the third line. -

    The DEBUGLVL() Macro

    +

    The DEBUGLVL() Macro

    One of the problems with the DEBUG() macro was that DEBUG() lines tended to get a bit long. Consider this example from nmbd_sendannounce.c: @@ -382,7 +382,7 @@ within the DEBUGLVL() block.

  • Processing that is only relevant to debug output can be contained within the DEBUGLVL() block. -

    • New Functions

    dbgtext()

    +

    New Functions

    dbgtext()

    This function prints debug message text to the debug file (and possibly to syslog) via the format buffer. The function uses a variable argument list just like printf() or Debug1(). The @@ -391,7 +391,7 @@ and then passed to format_debug_text(). If you use DEBUGLVL() you will probably print the body of the message using dbgtext(). -

    dbghdr()

    +

    dbghdr()

    This is the function that writes a debug message header. Headers are not processed via the format buffer. Also note that if the format buffer is not empty, a call to dbghdr() will not @@ -399,7 +399,7 @@ produce any output. See the comments in dbghdr() for more info.

    It is not likely that this function will be called directly. It is used by DEBUG() and DEBUGADD(). -

    format_debug_text()

    +

    format_debug_text()

    This is a static function in debug.c. It stores the output text for the body of the message in a buffer until it encounters a newline. When the newline character is found, the buffer is @@ -429,9 +429,9 @@ have observed that eight character tabs seem to be preferred in Samba source. If you are interested in the topic of coding style, two oft-quoted documents are:

    -http://lxr.linux.no/source/Documentation/CodingStyle +http://lxr.linux.no/source/Documentation/CodingStyle

    -http://www.fsf.org/prep/standards_toc.html +http://www.fsf.org/prep/standards_toc.html

    But note that coding style in Samba varies due to the many different programmers who have contributed. @@ -550,7 +550,7 @@ The suggestions above are simply that, suggestions, but the information may help in reducing the routine rework done on new code. The preceeding list is expected to change routinely as new support routines and macros are added. -

    Chapter 5. Samba Internals

    8 May 1996

    Table of Contents

    Character Handling
    The new functions
    Macros in byteorder.h
    CVAL(buf,pos)
    PVAL(buf,pos)
    SCVAL(buf,pos,val)
    SVAL(buf,pos)
    IVAL(buf,pos)
    SVALS(buf,pos)
    IVALS(buf,pos)
    SSVAL(buf,pos,val)
    SIVAL(buf,pos,val)
    SSVALS(buf,pos,val)
    SIVALS(buf,pos,val)
    RSVAL(buf,pos)
    RIVAL(buf,pos)
    RSSVAL(buf,pos,val)
    RSIVAL(buf,pos,val)
    LAN Manager Samba API
    Parameters
    Return value
    Code character table

    Character Handling

    +

    Chapter 5. Samba Internals

    8 May 1996

    Table of Contents

    Character Handling
    The new functions
    Macros in byteorder.h
    CVAL(buf,pos)
    PVAL(buf,pos)
    SCVAL(buf,pos,val)
    SVAL(buf,pos)
    IVAL(buf,pos)
    SVALS(buf,pos)
    IVALS(buf,pos)
    SSVAL(buf,pos,val)
    SIVAL(buf,pos,val)
    SSVALS(buf,pos,val)
    SIVALS(buf,pos,val)
    RSVAL(buf,pos)
    RIVAL(buf,pos)
    RSSVAL(buf,pos,val)
    RSIVAL(buf,pos,val)
    LAN Manager Samba API
    Parameters
    Return value
    Code character table

    Character Handling

    This section describes character set handling in Samba, as implemented in Samba 3.0 and above

    @@ -560,7 +560,7 @@ strings to/from DOS codepages. The problem is that there was no way of telling if a particular char* is in dos codepage or unix codepage. This led to a nightmare of code that tried to cope with particular cases without handlingt the general case. -

    The new functions

    +

    The new functions

    The new system works like this:

    1. all char* strings inside Samba are "unix" strings. These are @@ -622,28 +622,28 @@ The new system works like this: parameters is gone.

    2. all vfs functions take unix strings. Don't convert when passing to them -

    Macros in byteorder.h

    +

    Macros in byteorder.h

    This section describes the macros defined in byteorder.h. These macros are used extensively in the Samba code. -

    CVAL(buf,pos)

    +

    CVAL(buf,pos)

    returns the byte at offset pos within buffer buf as an unsigned character. -

    PVAL(buf,pos)

    returns the value of CVAL(buf,pos) cast to type unsigned integer.

    SCVAL(buf,pos,val)

    sets the byte at offset pos within buffer buf to value val.

    SVAL(buf,pos)

    +

    PVAL(buf,pos)

    returns the value of CVAL(buf,pos) cast to type unsigned integer.

    SCVAL(buf,pos,val)

    sets the byte at offset pos within buffer buf to value val.

    SVAL(buf,pos)

    returns the value of the unsigned short (16 bit) little-endian integer at offset pos within buffer buf. An integer of this type is sometimes refered to as "USHORT". -

    IVAL(buf,pos)

    returns the value of the unsigned 32 bit little-endian integer at offset -pos within buffer buf.

    SVALS(buf,pos)

    returns the value of the signed short (16 bit) little-endian integer at -offset pos within buffer buf.

    IVALS(buf,pos)

    returns the value of the signed 32 bit little-endian integer at offset pos -within buffer buf.

    SSVAL(buf,pos,val)

    sets the unsigned short (16 bit) little-endian integer at offset pos within -buffer buf to value val.

    SIVAL(buf,pos,val)

    sets the unsigned 32 bit little-endian integer at offset pos within buffer -buf to the value val.

    SSVALS(buf,pos,val)

    sets the short (16 bit) signed little-endian integer at offset pos within -buffer buf to the value val.

    SIVALS(buf,pos,val)

    sets the signed 32 bit little-endian integer at offset pos withing buffer -buf to the value val.

    RSVAL(buf,pos)

    returns the value of the unsigned short (16 bit) big-endian integer at -offset pos within buffer buf.

    RIVAL(buf,pos)

    returns the value of the unsigned 32 bit big-endian integer at offset -pos within buffer buf.

    RSSVAL(buf,pos,val)

    sets the value of the unsigned short (16 bit) big-endian integer at +

    IVAL(buf,pos)

    returns the value of the unsigned 32 bit little-endian integer at offset +pos within buffer buf.

    SVALS(buf,pos)

    returns the value of the signed short (16 bit) little-endian integer at +offset pos within buffer buf.

    IVALS(buf,pos)

    returns the value of the signed 32 bit little-endian integer at offset pos +within buffer buf.

    SSVAL(buf,pos,val)

    sets the unsigned short (16 bit) little-endian integer at offset pos within +buffer buf to value val.

    SIVAL(buf,pos,val)

    sets the unsigned 32 bit little-endian integer at offset pos within buffer +buf to the value val.

    SSVALS(buf,pos,val)

    sets the short (16 bit) signed little-endian integer at offset pos within +buffer buf to the value val.

    SIVALS(buf,pos,val)

    sets the signed 32 bit little-endian integer at offset pos withing buffer +buf to the value val.

    RSVAL(buf,pos)

    returns the value of the unsigned short (16 bit) big-endian integer at +offset pos within buffer buf.

    RIVAL(buf,pos)

    returns the value of the unsigned 32 bit big-endian integer at offset +pos within buffer buf.

    RSSVAL(buf,pos,val)

    sets the value of the unsigned short (16 bit) big-endian integer at offset pos within buffer buf to value val. -refered to as "USHORT".

    RSIVAL(buf,pos,val)

    sets the value of the unsigned 32 bit big-endian integer at offset -pos within buffer buf to value val.

    LAN Manager Samba API

    +refered to as "USHORT".

    RSIVAL(buf,pos,val)

    sets the value of the unsigned 32 bit big-endian integer at offset +pos within buffer buf to value val.

    LAN Manager Samba API

    This section describes the functions need to make a LAN Manager RPC call. This information had been obtained by examining the Samba code and the LAN Manager 2.0 API documentation. It should not be considered entirely @@ -656,7 +656,7 @@ call_api(int prcnt, int drcnt, int mprcnt, int mdrcnt,

    This function is defined in client.c. It uses an SMB transaction to call a remote api. -

    Parameters

    The parameters are as follows:

    1. +

      Parameters

      The parameters are as follows:

      1. prcnt: the number of bytes of parameters begin sent.

      2. drcnt: the number of bytes of data begin sent. @@ -701,7 +701,7 @@ substructures apply, this string is of zero length.

      The code in client.c always calls call_api() with no data. It is unclear when a non-zero length data buffer would be sent. -

      Return value

      +

      Return value

      The returned parameters (pointed to by rparam), in their order of appearance are:

      1. An unsigned 16 bit integer which contains the API function's return code. @@ -732,7 +732,7 @@ fix_char_ptr() in client.c can be used for this purpose. The third parameter (which may be read as "SVAL(rparam,4)") has something to do with indicating the amount of data returned or possibly the amount of data which can be returned if enough buffer space is allowed. -

      Code character table

      +

    Code character table

    Certain data structures are described by means of ASCIIz strings containing code characters. These are the code characters:

    1. @@ -755,7 +755,7 @@ r pointer to returned data buffer??? L length in bytes of returned data buffer???

    2. h number of bytes of information available??? -

    Chapter 6. The smb.conf file

    Chris Hertel

    November 1997

    Table of Contents

    Lexical Analysis
    Handling of Whitespace
    Handling of Line Continuation
    Line Continuation Quirks
    Syntax
    About params.c

    Lexical Analysis

    +

    Chapter 6. The smb.conf file

    Chris Hertel

    November 1997

    Table of Contents

    Lexical Analysis
    Handling of Whitespace
    Handling of Line Continuation
    Line Continuation Quirks
    Syntax
    About params.c

    Lexical Analysis

    Basically, the file is processed on a line by line basis. There are four types of lines that are recognized by the lexical analyzer (params.c): @@ -782,7 +782,7 @@ ignores them. The latter two line types are scanned for These are the only tokens passed to the parameter loader (loadparm.c). Parameter names and values are divided from one another by an equal sign: '='. -

    Handling of Whitespace

    +

    Handling of Whitespace

    Whitespace is defined as all characters recognized by the isspace() function (see ctype(3C)) except for the newline character ('\n') The newline is excluded because it identifies the end of the line. @@ -797,7 +797,7 @@ the exception of carriage return characters ('\r'), all of which are removed.

  • Leading and trailing whitespace is removed from names and values. -

    • Handling of Line Continuation

    +

    Handling of Line Continuation

    Long section header and parameter lines may be extended across multiple lines by use of the backslash character ('\\'). Line continuation is ignored for blank and comment lines. @@ -820,7 +820,7 @@ line, plus the four preceeding the word 'with' in the second line. Line continuation characters are ignored on blank lines and at the end of comments. They are *only* recognized within section and parameter lines. -

    Line Continuation Quirks

    Note the following example:

    +

    Line Continuation Quirks

    Note the following example:

     	param name = parameter value string \
     \
     with line continuation.
@@ -844,7 +844,7 @@ terminating character, and the rest of the line is ignored.  The lines

    are read as

     	[section name]
     param name = value
-

    Syntax

    The syntax of the smb.conf file is as follows:

    +

    Syntax

    The syntax of the smb.conf file is as follows:

       <file>            :==  { <section> } EOF
   <section>         :==  <section header> { <parameter line> }
   <section header>  :==  '[' NAME ']'
@@ -863,12 +863,12 @@ terminating character, and the rest of the line is ignored.  The lines
 	A parameter line is divided into a NAME and a VALUE.  The *first*
 	equal sign on the line separates the NAME from the VALUE.  The
 	VALUE is terminated by a newline character (NL = '\n').
-

    About params.c

    +

    About params.c

    The parsing of the config file is a bit unusual if you are used to lex, yacc, bison, etc. Both lexical analysis (scanning) and parsing are performed by params.c. Values are loaded via callbacks to loadparm.c. -

    Chapter 7. NetBIOS in a Unix World

    Andrew Tridgell

    April 1995

    Table of Contents

    Introduction
    Usernames
    File Ownership
    Passwords
    Locking
    Deny Modes
    Trapdoor UIDs
    Port numbers
    Protocol Complexity

    Introduction

    +

    Chapter 7. NetBIOS in a Unix World

    Andrew Tridgell

    April 1995

    Table of Contents

    Introduction
    Usernames
    File Ownership
    Passwords
    Locking
    Deny Modes
    Trapdoor UIDs
    Port numbers
    Protocol Complexity

    Introduction

    This is a short document that describes some of the issues that confront a SMB implementation on unix, and how Samba copes with them. They may help people who are looking at unix<->PC @@ -876,7 +876,7 @@ interoperability.

    It was written to help out a person who was writing a paper on unix to PC connectivity. -

    Usernames

    +

    Usernames

    The SMB protocol has only a loose username concept. Early SMB protocols (such as CORE and COREPLUS) have no username concept at all. Even in later protocols clients often attempt operations @@ -913,7 +913,7 @@ in the vast majority of cases. The methods include username maps, the service%user syntax, the saving of session setup usernames for later validation and the derivation of the username from the service name (either directly or via the user= option). -

    File Ownership

    +

    File Ownership

    The commonly used SMB protocols have no way of saying "you can't do that because you don't own the file". They have, in fact, no concept of file ownership at all. @@ -931,7 +931,7 @@ file time comparisons right. There are several possible solutions to this problem, including username mapping, and forcing a specific username for particular shares. -

    Passwords

    +

    Passwords

    Many SMB clients uppercase passwords before sending them. I have no idea why they do this. Interestingly WfWg uppercases the password only if the server is running a protocol greater than COREPLUS, so @@ -953,7 +953,7 @@ This means that it is *VERY* important to ensure that the Samba smbpasswd file containing these password hashes is only readable by the root user. See the documentation ENCRYPTION.txt for more details. -

    Locking

    +

    Locking

    Since samba 2.2, samba supports other types of locking as well. This section is outdated.

    @@ -984,7 +984,7 @@ asking the server to notify it if anyone else tries to do something on the same file, at which time the client will say if it is willing to give up its lock. Unix has no simple way of implementing opportunistic locking, and currently Samba has no support for it. -

    Deny Modes

    +

    Deny Modes

    When a SMB client opens a file it asks for a particular "deny mode" to be placed on the file. These modes (DENY_NONE, DENY_READ, DENY_WRITE, DENY_ALL, DENY_FCB and DENY_DOS) specify what actions should be @@ -998,7 +998,7 @@ directory or a shared memory implementation. The lock file method is clumsy and consumes processing and file resources, the shared memory implementation is vastly prefered and is turned on by default for those systems that support it. -

    Trapdoor UIDs

    +

    Trapdoor UIDs

    A SMB session can run with several uids on the one socket. This happens when a user connects to two shares with different usernames. To cope with this the unix server needs to switch uids @@ -1008,7 +1008,7 @@ a single uid.

    Note that you can also get the "trapdoor uid" message for other reasons. Please see the FAQ for details. -

    Port numbers

    +

    Port numbers

    There is a convention that clients on sockets use high "unprivilaged" port numbers (>1000) and connect to servers on low "privilaged" port numbers. This is enforced in Unix as non-root users can't open a @@ -1031,7 +1031,7 @@ to any of these OSes unless they are running as root. The answer comes back, but it goes to port 137 which the unix user can't listen on. Interestingly WinNT3.1 got this right - it sends node status responses back to the source port in the request. -

    Protocol Complexity

    +

    Protocol Complexity

    There are many "protocol levels" in the SMB protocol. It seems that each time new functionality was added to a Microsoft operating system, they added the equivalent functions in a new protocol level of the SMB @@ -1145,9 +1145,9 @@ causes printing to fail with Samba: The process is trying to first open /dev/null read-write then read-only. Both fail. This means /dev/null has incorrect permissions. -

    Chapter 9. Finding useful information on windows

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    Table of Contents

    Netlogon debugging output

    Netlogon debugging output

    1. stop netlogon service on PDC

    2. rename original netlogon.dll to netlogon.dll.original

    3. copy checked version of netlogon.dll to system32 directory

    4. set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DBFlag to 0x20000004

    5. start netlogon service on PDC

    Chapter 10. NT Domain RPC's

    Luke Leighton

    Duncan Stansfield

    01 November 97(version 0.0.24)

    Table of Contents

    Introduction
    Sources
    Credits
    Notes and Structures
    Notes
    Enumerations
    Structures
    MSRPC over Transact Named Pipe
    MSRPC Pipes
    Header
    Tail
    RPC Bind / Bind Ack
    NTLSA Transact Named Pipe
    LSA Open Policy
    LSA Query Info Policy
    LSA Enumerate Trusted Domains
    LSA Open Secret
    LSA Close
    LSA Lookup SIDS
    LSA Lookup Names
    NETLOGON rpc Transact Named Pipe
    LSA Request Challenge
    LSA Authenticate 2
    LSA Server Password Set
    LSA SAM Logon
    LSA SAM Logoff
    \\MAILSLOT\NET\NTLOGON
    Query for PDC
    SAM Logon
    SRVSVC Transact Named Pipe
    Net Share Enum
    Net Server Get Info
    Cryptographic side of NT Domain Authentication
    Definitions
    Protocol
    Comments
    SIDs and RIDs
    Well-known SIDs
    Well-known RIDS

    Introduction

    +

    Chapter 9. Finding useful information on windows

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    Table of Contents

    Netlogon debugging output

    Netlogon debugging output

    1. stop netlogon service on PDC

    2. rename original netlogon.dll to netlogon.dll.original

    3. copy checked version of netlogon.dll to system32 directory

    4. set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DBFlag to 0x20000004

    5. start netlogon service on PDC

    Chapter 10. NT Domain RPC's

    Luke Leighton

    Duncan Stansfield

    01 November 97(version 0.0.24)

    Table of Contents

    Introduction
    Sources
    Credits
    Notes and Structures
    Notes
    Enumerations
    Structures
    MSRPC over Transact Named Pipe
    MSRPC Pipes
    Header
    Tail
    RPC Bind / Bind Ack
    NTLSA Transact Named Pipe
    LSA Open Policy
    LSA Query Info Policy
    LSA Enumerate Trusted Domains
    LSA Open Secret
    LSA Close
    LSA Lookup SIDS
    LSA Lookup Names
    NETLOGON rpc Transact Named Pipe
    LSA Request Challenge
    LSA Authenticate 2
    LSA Server Password Set
    LSA SAM Logon
    LSA SAM Logoff
    \\MAILSLOT\NET\NTLOGON
    Query for PDC
    SAM Logon
    SRVSVC Transact Named Pipe
    Net Share Enum
    Net Server Get Info
    Cryptographic side of NT Domain Authentication
    Definitions
    Protocol
    Comments
    SIDs and RIDs
    Well-known SIDs
    Well-known RIDS

    Introduction

    This document contains information to provide an NT workstation with login -services, without the need for an NT server. It is the sgml version of http://mailhost.cb1.com/~lkcl/cifsntdomain.txt, controlled by Luke. +services, without the need for an NT server. It is the sgml version of http://mailhost.cb1.com/~lkcl/cifsntdomain.txt, controlled by Luke.

    It should be possible to select a domain instead of a workgroup (in the NT workstation's TCP/IP settings) and after the obligatory reboot, type in a @@ -1169,10 +1169,10 @@ This document is available from comp.protocols.smb; from the ntsecurity.net digest and from the samba digest, amongst other sources.

    A copy is available from: -

    http://ntbugtraq.rc.on.ca/SCRIPTS/WA.EXE?A2=ind9708;L=ntbugtraq;O=A;P=2935

    http://mailhost.cb1.com/~lkcl/crypt.html

    -A c-code implementation, provided by Linus Nordberg +

    http://ntbugtraq.rc.on.ca/SCRIPTS/WA.EXE?A2=ind9708;L=ntbugtraq;O=A;P=2935

    http://mailhost.cb1.com/~lkcl/crypt.html

    +A c-code implementation, provided by Linus Nordberg of this protocol is available from: -

    http://samba.org/cgi-bin/mfs/01/digest/1997/97aug/0391.html

    http://mailhost.cb1.com/~lkcl/crypt.txt

    +

    http://samba.org/cgi-bin/mfs/01/digest/1997/97aug/0391.html

    http://mailhost.cb1.com/~lkcl/crypt.txt

    Also used to provide debugging information is the Check Build version of NT workstation, and enabling full debugging in NETLOGON. This is achieved by setting the following REG_SZ registry key to 0x1ffffff: @@ -1191,7 +1191,7 @@ Failure to return this error code will make the workstation report that it is already a member of the domain.

  • the cryptographic side of the NetrServerPasswordSet command, which would allow the workstation to change its password. This password is used to generate the long-term session key. [It is possible to reject this -command, and keep the default workstation password].

    • Sources

    cket Traces from Netmonitor (Service Pack 1 and above)
    ul Ashton and Luke Leighton's other "NT Domain" doc.
    FS documentation - cifs6.txt
    FS documentation - cifsrap2.txt

    Credits

    Paul Ashton: loads of work with Net Monitor; understanding the NT authentication system; reference implementation of the NT domain support on which this document is originally based.
    Duncan Stansfield: low-level analysis of MSRPC Pipes.
    Linus Nordberg: producing c-code from Paul's crypto spec.
    Windows Sourcer development team

    Notes and Structures

    Notes

    1. +command, and keep the default workstation password].

    Sources

    cket Traces from Netmonitor (Service Pack 1 and above)
    ul Ashton and Luke Leighton's other "NT Domain" doc.
    FS documentation - cifs6.txt
    FS documentation - cifsrap2.txt

    Credits

    Paul Ashton: loads of work with Net Monitor; understanding the NT authentication system; reference implementation of the NT domain support on which this document is originally based.
    Duncan Stansfield: low-level analysis of MSRPC Pipes.
    Linus Nordberg: producing c-code from Paul's crypto spec.
    Windows Sourcer development team

    Notes and Structures

    Notes

    1. In the SMB Transact pipes, some "Structures", described here, appear to be 4-byte aligned with the SMB header, at their start. Exactly which "Structures" need aligning is not precisely known or documented. @@ -1219,15 +1219,15 @@ into or taken out of the SMB data stream. if the count is non-zero, then the pointer is also non-zero. immediately following the pointer is the count again, followed by an array of container sub-structures. the count appears a third time after the last sub-structure. -

    Enumerations

    MSRPC Header type

    command number in the msrpc packet header

    MSRPC_Request:

    0x00

    MSRPC_Response:

    0x02

    MSRPC_Bind:

    0x0B

    MSRPC_BindAck:

    0x0C

    MSRPC Packet info

    The meaning of these flags is undocumented

    FirstFrag:

    0x01

    LastFrag:

    0x02

    NotaFrag:

    0x04

    RecRespond:

    0x08

    NoMultiplex:

    0x10

    NotForIdemp:

    0x20

    NotforBcast:

    0x40

    NoUuid:

    0x80

    Structures

    VOID *

    sizeof VOID* is 32 bits.

    char

    sizeof char is 8 bits.

    UTIME

    UTIME is 32 bits, indicating time in seconds since 01jan1970. documented in cifs6.txt (section 3.5 page, page 30).

    NTTIME

    NTTIME is 64 bits. documented in cifs6.txt (section 3.5 page, page 30).

    DOM_SID (domain SID structure)

    UINT32

    num of sub-authorities in domain SID

    UINT8

    SID revision number

    UINT8

    num of sub-authorities in domain SID

    UINT8[6]

    6 bytes for domain SID - Identifier Authority.

    UINT16[n_subauths]

    domain SID sub-authorities

    Note: the domain SID is documented elsewhere. -

    STR (string)

    STR (string) is a char[] : a null-terminated string of ascii characters.

    UNIHDR (unicode string header)

    UINT16

    length of unicode string

    UINT16

    max length of unicode string

    UINT32

    4 - undocumented.

    UNIHDR2 (unicode string header plus buffer pointer)

    UNIHDR

    unicode string header

    VOID*

    undocumented buffer pointer

    UNISTR (unicode string)

    UINT16[]

    null-terminated string of unicode characters.

    NAME (length-indicated unicode string)

    UINT32

    length of unicode string

    UINT16[]

    null-terminated string of unicode characters.

    UNISTR2 (aligned unicode string)

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    max length of unicode string

    UINT32

    0 - undocumented

    UINT32

    length of unicode string

    UINT16[]

    string of uncode characters

    OBJ_ATTR (object attributes)

    UINT32

    0x18 - length (in bytes) including the length field.

    VOID*

    0 - root directory (pointer)

    VOID*

    0 - object name (pointer)

    UINT32

    0 - attributes (undocumented)

    VOID*

    0 - security descriptior (pointer)

    UINT32

    0 - security quality of service

    POL_HND (LSA policy handle)

    char[20]

    policy handle

    DOM_SID2 (domain SID structure, SIDS stored in unicode)

    UINT32

    5 - SID type

    UINT32

    0 - undocumented

    UNIHDR2

    domain SID unicode string header

    UNISTR

    domain SID unicode string

    Note: there is a conflict between the unicode string header and the unicode string itself as to which to use to indicate string length. this will need to be resolved.

    Note: the SID type indicates, for example, an alias; a well-known group etc. this is documented somewhere.

    DOM_RID (domain RID structure)

    UINT32

    5 - well-known SID. 1 - user SID (see ShowACLs)

    UINT32

    5 - undocumented

    UINT32

    domain RID

    UINT32

    0 - domain index out of above reference domains

    LOG_INFO (server, account, client structure)

    Note: logon server name starts with two '\' characters and is upper case.

    Note: account name is the logon client name from the LSA Request Challenge, with a $ on the end of it, in upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    account name unicode string

    UINT16

    sec_chan - security channel type

    UNISTR2

    logon client machine unicode string

    CLNT_SRV (server, client names structure)

    Note: logon server name starts with two '\' characters and is upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon client machine unicode string

    CREDS (credentials + time stamp)

    char[8]

    credentials

    UTIME

    time stamp

    CLNT_INFO2 (server, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will beused in subsequent credential checks. the presumed intention is to - maintain an authenticated request/response trail.

    CLNT_SRV

    client and server names

    UINT8[]

    ???? padding, for 4-byte alignment with SMB header.

    VOID*

    pointer to client credentials.

    CREDS

    client-calculated credentials + client time

    CLNT_INFO (server, account, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will be used in subsequent credential checks. the presumed intention is to maintain an authenticated request/response trail.

    LOG_INFO

    logon account info

    CREDS

    client-calculated credentials + client time

    ID_INFO_1 (id info structure, auth level 1)

    VOID*

    ptr_id_info_1

    UNIHDR

    domain name unicode header

    UINT32

    param control

    UINT64

    logon ID

    UNIHDR

    user name unicode header

    UNIHDR

    workgroup name unicode header

    char[16]

    arc4 LM OWF Password

    char[16]

    arc4 NT OWF Password

    UNISTR2

    domain name unicode string

    UNISTR2

    user name unicode string

    UNISTR2

    workstation name unicode string

    SAM_INFO (sam logon/logoff id info structure)

    Note: presumably, the return credentials is supposedly for the server to verify that the credential chain hasn't been compromised.

    CLNT_INFO2

    client identification/authentication info

    VOID*

    pointer to return credentials.

    CRED

    return credentials - ignored.

    UINT16

    logon level

    UINT16

    switch value

    +

    Enumerations

    MSRPC Header type

    command number in the msrpc packet header

    MSRPC_Request:

    0x00

    MSRPC_Response:

    0x02

    MSRPC_Bind:

    0x0B

    MSRPC_BindAck:

    0x0C

    MSRPC Packet info

    The meaning of these flags is undocumented

    FirstFrag:

    0x01

    LastFrag:

    0x02

    NotaFrag:

    0x04

    RecRespond:

    0x08

    NoMultiplex:

    0x10

    NotForIdemp:

    0x20

    NotforBcast:

    0x40

    NoUuid:

    0x80

    Structures

    VOID *

    sizeof VOID* is 32 bits.

    char

    sizeof char is 8 bits.

    UTIME

    UTIME is 32 bits, indicating time in seconds since 01jan1970. documented in cifs6.txt (section 3.5 page, page 30).

    NTTIME

    NTTIME is 64 bits. documented in cifs6.txt (section 3.5 page, page 30).

    DOM_SID (domain SID structure)

    UINT32

    num of sub-authorities in domain SID

    UINT8

    SID revision number

    UINT8

    num of sub-authorities in domain SID

    UINT8[6]

    6 bytes for domain SID - Identifier Authority.

    UINT16[n_subauths]

    domain SID sub-authorities

    Note: the domain SID is documented elsewhere. +

    STR (string)

    STR (string) is a char[] : a null-terminated string of ascii characters.

    UNIHDR (unicode string header)

    UINT16

    length of unicode string

    UINT16

    max length of unicode string

    UINT32

    4 - undocumented.

    UNIHDR2 (unicode string header plus buffer pointer)

    UNIHDR

    unicode string header

    VOID*

    undocumented buffer pointer

    UNISTR (unicode string)

    UINT16[]

    null-terminated string of unicode characters.

    NAME (length-indicated unicode string)

    UINT32

    length of unicode string

    UINT16[]

    null-terminated string of unicode characters.

    UNISTR2 (aligned unicode string)

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    max length of unicode string

    UINT32

    0 - undocumented

    UINT32

    length of unicode string

    UINT16[]

    string of uncode characters

    OBJ_ATTR (object attributes)

    UINT32

    0x18 - length (in bytes) including the length field.

    VOID*

    0 - root directory (pointer)

    VOID*

    0 - object name (pointer)

    UINT32

    0 - attributes (undocumented)

    VOID*

    0 - security descriptior (pointer)

    UINT32

    0 - security quality of service

    POL_HND (LSA policy handle)

    char[20]

    policy handle

    DOM_SID2 (domain SID structure, SIDS stored in unicode)

    UINT32

    5 - SID type

    UINT32

    0 - undocumented

    UNIHDR2

    domain SID unicode string header

    UNISTR

    domain SID unicode string

    Note: there is a conflict between the unicode string header and the unicode string itself as to which to use to indicate string length. this will need to be resolved.

    Note: the SID type indicates, for example, an alias; a well-known group etc. this is documented somewhere.

    DOM_RID (domain RID structure)

    UINT32

    5 - well-known SID. 1 - user SID (see ShowACLs)

    UINT32

    5 - undocumented

    UINT32

    domain RID

    UINT32

    0 - domain index out of above reference domains

    LOG_INFO (server, account, client structure)

    Note: logon server name starts with two '\' characters and is upper case.

    Note: account name is the logon client name from the LSA Request Challenge, with a $ on the end of it, in upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    account name unicode string

    UINT16

    sec_chan - security channel type

    UNISTR2

    logon client machine unicode string

    CLNT_SRV (server, client names structure)

    Note: logon server name starts with two '\' characters and is upper case.

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon client machine unicode string

    CREDS (credentials + time stamp)

    char[8]

    credentials

    UTIME

    time stamp

    CLNT_INFO2 (server, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will beused in subsequent credential checks. the presumed intention is to + maintain an authenticated request/response trail.

    CLNT_SRV

    client and server names

    UINT8[]

    ???? padding, for 4-byte alignment with SMB header.

    VOID*

    pointer to client credentials.

    CREDS

    client-calculated credentials + client time

    CLNT_INFO (server, account, client structure, client credentials)

    Note: whenever this structure appears in a request, you must take a copy of the client-calculated credentials received, because they will be used in subsequent credential checks. the presumed intention is to maintain an authenticated request/response trail.

    LOG_INFO

    logon account info

    CREDS

    client-calculated credentials + client time

    ID_INFO_1 (id info structure, auth level 1)

    VOID*

    ptr_id_info_1

    UNIHDR

    domain name unicode header

    UINT32

    param control

    UINT64

    logon ID

    UNIHDR

    user name unicode header

    UNIHDR

    workgroup name unicode header

    char[16]

    arc4 LM OWF Password

    char[16]

    arc4 NT OWF Password

    UNISTR2

    domain name unicode string

    UNISTR2

    user name unicode string

    UNISTR2

    workstation name unicode string

    SAM_INFO (sam logon/logoff id info structure)

    Note: presumably, the return credentials is supposedly for the server to verify that the credential chain hasn't been compromised.

    CLNT_INFO2

    client identification/authentication info

    VOID*

    pointer to return credentials.

    CRED

    return credentials - ignored.

    UINT16

    logon level

    UINT16

    switch value

             switch (switch_value)
         case 1:
         {
             ID_INFO_1     id_info_1;
         }
-

    GID (group id info)

    UINT32

    group id

    UINT32

    user attributes (only used by NT 3.1 and 3.51)

    DOM_REF (domain reference info)

    VOID*

    undocumented buffer pointer.

    UINT32

    num referenced domains?

    VOID*

    undocumented domain name buffer pointer.

    UINT32

    32 - max number of entries

    UINT32

    4 - num referenced domains?

    UNIHDR2

    domain name unicode string header

    UNIHDR2[num_ref_doms-1]

    referenced domain unicode string headers

    UNISTR

    domain name unicode string

    DOM_SID[num_ref_doms]

    referenced domain SIDs

    DOM_INFO (domain info, levels 3 and 5 are the same))

    UINT8[]

    ??? padding to get 4-byte alignment with start of SMB header

    UINT16

    domain name string length * 2

    UINT16

    domain name string length * 2

    VOID*

    undocumented domain name string buffer pointer

    VOID*

    undocumented domain SID string buffer pointer

    UNISTR2

    domain name (unicode string)

    DOM_SID

    domain SID

    USER_INFO (user logon info)

    Note: it would be nice to know what the 16 byte user session key is for.

    NTTIME

    logon time

    NTTIME

    logoff time

    NTTIME

    kickoff time

    NTTIME

    password last set time

    NTTIME

    password can change time

    NTTIME

    password must change time

    UNIHDR

    username unicode string header

    UNIHDR

    user's full name unicode string header

    UNIHDR

    logon script unicode string header

    UNIHDR

    profile path unicode string header

    UNIHDR

    home directory unicode string header

    UNIHDR

    home directory drive unicode string header

    UINT16

    logon count

    UINT16

    bad password count

    UINT32

    User ID

    UINT32

    Group ID

    UINT32

    num groups

    VOID*

    undocumented buffer pointer to groups.

    UINT32

    user flags

    char[16]

    user session key

    UNIHDR

    logon server unicode string header

    UNIHDR

    logon domain unicode string header

    VOID*

    undocumented logon domain id pointer

    char[40]

    40 undocumented padding bytes. future expansion?

    UINT32

    0 - num_other_sids?

    VOID*

    NULL - undocumented pointer to other domain SIDs.

    UNISTR2

    username unicode string

    UNISTR2

    user's full name unicode string

    UNISTR2

    logon script unicode string

    UNISTR2

    profile path unicode string

    UNISTR2

    home directory unicode string

    UNISTR2

    home directory drive unicode string

    UINT32

    num groups

    GID[num_groups]

    group info

    UNISTR2

    logon server unicode string

    UNISTR2

    logon domain unicode string

    DOM_SID

    domain SID

    DOM_SID[num_sids]

    other domain SIDs?

    SH_INFO_1_PTR (pointers to level 1 share info strings)

    Note: see cifsrap2.txt section5, page 10.

    0 for shi1_type indicates a Disk.
    1 for shi1_type indicates a Print Queue.
    2 for shi1_type indicates a Device.
    3 for shi1_type indicates an IPC pipe.
    0x8000 0000 (top bit set in shi1_type) indicates a hidden share.
    VOID*

    shi1_netname - pointer to net name

    UINT32

    shi1_type - type of share. 0 - undocumented.

    VOID*

    shi1_remark - pointer to comment.

    SH_INFO_1_STR (level 1 share info strings)

    UNISTR2

    shi1_netname - unicode string of net name

    UNISTR2

    shi1_remark - unicode string of comment.

    SHARE_INFO_1_CTR

    share container with 0 entries:

    UINT32

    0 - EntriesRead

    UINT32

    0 - Buffer

    share container with > 0 entries:

    UINT32

    EntriesRead

    UINT32

    non-zero - Buffer

    UINT32

    EntriesRead

    SH_INFO_1_PTR[EntriesRead]

    share entry pointers

    SH_INFO_1_STR[EntriesRead]

    share entry strings

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    UINT32

    EntriesRead

    UINT32

    0 - padding

    SERVER_INFO_101

    Note: see cifs6.txt section 6.4 - the fields described therein will be of assistance here. for example, the type listed below is the same as fServerType, which is described in 6.4.1.

    SV_TYPE_WORKSTATION

    0x00000001 All workstations

    SV_TYPE_SERVER

    0x00000002 All servers

    SV_TYPE_SQLSERVER

    0x00000004 Any server running with SQL server

    SV_TYPE_DOMAIN_CTRL

    0x00000008 Primary domain controller

    SV_TYPE_DOMAIN_BAKCTRL

    0x00000010 Backup domain controller

    SV_TYPE_TIME_SOURCE

    0x00000020 Server running the timesource service

    SV_TYPE_AFP

    0x00000040 Apple File Protocol servers

    SV_TYPE_NOVELL

    0x00000080 Novell servers

    SV_TYPE_DOMAIN_MEMBER

    0x00000100 Domain Member

    SV_TYPE_PRINTQ_SERVER

    0x00000200 Server sharing print queue

    SV_TYPE_DIALIN_SERVER

    0x00000400 Server running dialin service.

    SV_TYPE_XENIX_SERVER

    0x00000800 Xenix server

    SV_TYPE_NT

    0x00001000 NT server

    SV_TYPE_WFW

    0x00002000 Server running Windows for

    SV_TYPE_SERVER_NT

    0x00008000 Windows NT non DC server

    SV_TYPE_POTENTIAL_BROWSER

    0x00010000 Server that can run the browser service

    SV_TYPE_BACKUP_BROWSER

    0x00020000 Backup browser server

    SV_TYPE_MASTER_BROWSER

    0x00040000 Master browser server

    SV_TYPE_DOMAIN_MASTER

    0x00080000 Domain Master Browser server

    SV_TYPE_LOCAL_LIST_ONLY

    0x40000000 Enumerate only entries marked "local"

    SV_TYPE_DOMAIN_ENUM

    0x80000000 Enumerate Domains. The pszServer and pszDomain parameters must be NULL.

    UINT32

    500 - platform_id

    VOID*

    pointer to name

    UINT32

    5 - major version

    UINT32

    4 - minor version

    UINT32

    type (SV_TYPE_... bit field)

    VOID*

    pointer to comment

    UNISTR2

    sv101_name - unicode string of server name

    UNISTR2

    sv_101_comment - unicode string of server comment.

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    MSRPC over Transact Named Pipe

    For details on the SMB Transact Named Pipe, see cifs6.txt

    MSRPC Pipes

    +

    GID (group id info)

    UINT32

    group id

    UINT32

    user attributes (only used by NT 3.1 and 3.51)

    DOM_REF (domain reference info)

    VOID*

    undocumented buffer pointer.

    UINT32

    num referenced domains?

    VOID*

    undocumented domain name buffer pointer.

    UINT32

    32 - max number of entries

    UINT32

    4 - num referenced domains?

    UNIHDR2

    domain name unicode string header

    UNIHDR2[num_ref_doms-1]

    referenced domain unicode string headers

    UNISTR

    domain name unicode string

    DOM_SID[num_ref_doms]

    referenced domain SIDs

    DOM_INFO (domain info, levels 3 and 5 are the same))

    UINT8[]

    ??? padding to get 4-byte alignment with start of SMB header

    UINT16

    domain name string length * 2

    UINT16

    domain name string length * 2

    VOID*

    undocumented domain name string buffer pointer

    VOID*

    undocumented domain SID string buffer pointer

    UNISTR2

    domain name (unicode string)

    DOM_SID

    domain SID

    USER_INFO (user logon info)

    Note: it would be nice to know what the 16 byte user session key is for.

    NTTIME

    logon time

    NTTIME

    logoff time

    NTTIME

    kickoff time

    NTTIME

    password last set time

    NTTIME

    password can change time

    NTTIME

    password must change time

    UNIHDR

    username unicode string header

    UNIHDR

    user's full name unicode string header

    UNIHDR

    logon script unicode string header

    UNIHDR

    profile path unicode string header

    UNIHDR

    home directory unicode string header

    UNIHDR

    home directory drive unicode string header

    UINT16

    logon count

    UINT16

    bad password count

    UINT32

    User ID

    UINT32

    Group ID

    UINT32

    num groups

    VOID*

    undocumented buffer pointer to groups.

    UINT32

    user flags

    char[16]

    user session key

    UNIHDR

    logon server unicode string header

    UNIHDR

    logon domain unicode string header

    VOID*

    undocumented logon domain id pointer

    char[40]

    40 undocumented padding bytes. future expansion?

    UINT32

    0 - num_other_sids?

    VOID*

    NULL - undocumented pointer to other domain SIDs.

    UNISTR2

    username unicode string

    UNISTR2

    user's full name unicode string

    UNISTR2

    logon script unicode string

    UNISTR2

    profile path unicode string

    UNISTR2

    home directory unicode string

    UNISTR2

    home directory drive unicode string

    UINT32

    num groups

    GID[num_groups]

    group info

    UNISTR2

    logon server unicode string

    UNISTR2

    logon domain unicode string

    DOM_SID

    domain SID

    DOM_SID[num_sids]

    other domain SIDs?

    SH_INFO_1_PTR (pointers to level 1 share info strings)

    Note: see cifsrap2.txt section5, page 10.

    0 for shi1_type indicates a Disk.
    1 for shi1_type indicates a Print Queue.
    2 for shi1_type indicates a Device.
    3 for shi1_type indicates an IPC pipe.
    0x8000 0000 (top bit set in shi1_type) indicates a hidden share.
    VOID*

    shi1_netname - pointer to net name

    UINT32

    shi1_type - type of share. 0 - undocumented.

    VOID*

    shi1_remark - pointer to comment.

    SH_INFO_1_STR (level 1 share info strings)

    UNISTR2

    shi1_netname - unicode string of net name

    UNISTR2

    shi1_remark - unicode string of comment.

    SHARE_INFO_1_CTR

    share container with 0 entries:

    UINT32

    0 - EntriesRead

    UINT32

    0 - Buffer

    share container with > 0 entries:

    UINT32

    EntriesRead

    UINT32

    non-zero - Buffer

    UINT32

    EntriesRead

    SH_INFO_1_PTR[EntriesRead]

    share entry pointers

    SH_INFO_1_STR[EntriesRead]

    share entry strings

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    UINT32

    EntriesRead

    UINT32

    0 - padding

    SERVER_INFO_101

    Note: see cifs6.txt section 6.4 - the fields described therein will be of assistance here. for example, the type listed below is the same as fServerType, which is described in 6.4.1.

    SV_TYPE_WORKSTATION

    0x00000001 All workstations

    SV_TYPE_SERVER

    0x00000002 All servers

    SV_TYPE_SQLSERVER

    0x00000004 Any server running with SQL server

    SV_TYPE_DOMAIN_CTRL

    0x00000008 Primary domain controller

    SV_TYPE_DOMAIN_BAKCTRL

    0x00000010 Backup domain controller

    SV_TYPE_TIME_SOURCE

    0x00000020 Server running the timesource service

    SV_TYPE_AFP

    0x00000040 Apple File Protocol servers

    SV_TYPE_NOVELL

    0x00000080 Novell servers

    SV_TYPE_DOMAIN_MEMBER

    0x00000100 Domain Member

    SV_TYPE_PRINTQ_SERVER

    0x00000200 Server sharing print queue

    SV_TYPE_DIALIN_SERVER

    0x00000400 Server running dialin service.

    SV_TYPE_XENIX_SERVER

    0x00000800 Xenix server

    SV_TYPE_NT

    0x00001000 NT server

    SV_TYPE_WFW

    0x00002000 Server running Windows for

    SV_TYPE_SERVER_NT

    0x00008000 Windows NT non DC server

    SV_TYPE_POTENTIAL_BROWSER

    0x00010000 Server that can run the browser service

    SV_TYPE_BACKUP_BROWSER

    0x00020000 Backup browser server

    SV_TYPE_MASTER_BROWSER

    0x00040000 Master browser server

    SV_TYPE_DOMAIN_MASTER

    0x00080000 Domain Master Browser server

    SV_TYPE_LOCAL_LIST_ONLY

    0x40000000 Enumerate only entries marked "local"

    SV_TYPE_DOMAIN_ENUM

    0x80000000 Enumerate Domains. The pszServer and pszDomain parameters must be NULL.

    UINT32

    500 - platform_id

    VOID*

    pointer to name

    UINT32

    5 - major version

    UINT32

    4 - minor version

    UINT32

    type (SV_TYPE_... bit field)

    VOID*

    pointer to comment

    UNISTR2

    sv101_name - unicode string of server name

    UNISTR2

    sv_101_comment - unicode string of server comment.

    UINT8[]

    padding to get unicode string 4-byte aligned with start of the SMB header.

    MSRPC over Transact Named Pipe

    For details on the SMB Transact Named Pipe, see cifs6.txt

    MSRPC Pipes

    The MSRPC is conducted over an SMB Transact Pipe with a name of \PIPE\. You must first obtain a 16 bit file handle, by sending a SMBopenX with the pipe name \PIPE\srvsvc for @@ -1268,11 +1268,11 @@ listed below:

             initial SMBopenX request:         RPC API command 0x26 params:
         "\\PIPE\\lsarpc"                  0x65 0x63; 0x72 0x70; 0x44 0x65;
         "\\PIPE\\srvsvc"                  0x73 0x76; 0x4E 0x00; 0x5C 0x43;
-

    Header

    [section to be rewritten, following receipt of work by Duncan Stansfield]

    Interesting note: if you set packed data representation to 0x0100 0000 -then all 4-byte and 2-byte word ordering is turned around!

    The start of each of the NTLSA and NETLOGON named pipes begins with:

    offset: 00

    Variable type: UINT8

    Variable data: 5 - RPC major version

    offset: 01

    Variable type: UINT8

    Variable data: 0 - RPC minor version

    offset: 02

    Variable type: UINT8

    Variable data: 2 - RPC response packet

    offset: 03

    Variable type: UINT8

    Variable data: 3 - (FirstFrag bit-wise or with LastFrag)

    offset: 04

    Variable type: UINT32

    Variable data: 0x1000 0000 - packed data representation

    offset: 08

    Variable type: UINT16

    Variable data: fragment length - data size (bytes) inc header and tail.

    offset: 0A

    Variable type: UINT16

    Variable data: 0 - authentication length

    offset: 0C

    Variable type: UINT32

    Variable data: call identifier. matches 12th UINT32 of incoming RPC data.

    offset: 10

    Variable type: UINT32

    Variable data: allocation hint - data size (bytes) minus header and tail.

    offset: 14

    Variable type: UINT16

    Variable data: 0 - presentation context identifier

    offset: 16

    Variable type: UINT8

    Variable data: 0 - cancel count

    offset: 17

    Variable type: UINT8

    Variable data: in replies: 0 - reserved; in requests: opnum - see #defines.

    offset: 18

    Variable type: ......

    Variable data: start of data (goes on for allocation_hint bytes)

    RPC_Packet for request, response, bind and bind acknowledgement

    UINT8 versionmaj

    reply same as request (0x05)

    UINT8 versionmin

    reply same as request (0x00)

    UINT8 type

    one of the MSRPC_Type enums

    UINT8 flags

    reply same as request (0x00 for Bind, 0x03 for Request)

    UINT32 representation

    reply same as request (0x00000010)

    UINT16 fraglength

    the length of the data section of the SMB trans packet

    UINT16 authlength

    UINT32 callid

    call identifier. (e.g. 0x00149594)

    * stub USE TvPacket

    the remainder of the packet depending on the "type"

    Interface identification

    the interfaces are numbered. as yet I haven't seen more than one interface used on the same pipe name srvsvc

    +

    Header

    [section to be rewritten, following receipt of work by Duncan Stansfield]

    Interesting note: if you set packed data representation to 0x0100 0000 +then all 4-byte and 2-byte word ordering is turned around!

    The start of each of the NTLSA and NETLOGON named pipes begins with:

    offset: 00

    Variable type: UINT8

    Variable data: 5 - RPC major version

    offset: 01

    Variable type: UINT8

    Variable data: 0 - RPC minor version

    offset: 02

    Variable type: UINT8

    Variable data: 2 - RPC response packet

    offset: 03

    Variable type: UINT8

    Variable data: 3 - (FirstFrag bit-wise or with LastFrag)

    offset: 04

    Variable type: UINT32

    Variable data: 0x1000 0000 - packed data representation

    offset: 08

    Variable type: UINT16

    Variable data: fragment length - data size (bytes) inc header and tail.

    offset: 0A

    Variable type: UINT16

    Variable data: 0 - authentication length

    offset: 0C

    Variable type: UINT32

    Variable data: call identifier. matches 12th UINT32 of incoming RPC data.

    offset: 10

    Variable type: UINT32

    Variable data: allocation hint - data size (bytes) minus header and tail.

    offset: 14

    Variable type: UINT16

    Variable data: 0 - presentation context identifier

    offset: 16

    Variable type: UINT8

    Variable data: 0 - cancel count

    offset: 17

    Variable type: UINT8

    Variable data: in replies: 0 - reserved; in requests: opnum - see #defines.

    offset: 18

    Variable type: ......

    Variable data: start of data (goes on for allocation_hint bytes)

    RPC_Packet for request, response, bind and bind acknowledgement

    UINT8 versionmaj

    reply same as request (0x05)

    UINT8 versionmin

    reply same as request (0x00)

    UINT8 type

    one of the MSRPC_Type enums

    UINT8 flags

    reply same as request (0x00 for Bind, 0x03 for Request)

    UINT32 representation

    reply same as request (0x00000010)

    UINT16 fraglength

    the length of the data section of the SMB trans packet

    UINT16 authlength

    UINT32 callid

    call identifier. (e.g. 0x00149594)

    * stub USE TvPacket

    the remainder of the packet depending on the "type"

    Interface identification

    the interfaces are numbered. as yet I haven't seen more than one interface used on the same pipe name srvsvc

     abstract (0x4B324FC8, 0x01D31670, 0x475A7812, 0x88E16EBF, 0x00000003)
 transfer (0x8A885D04, 0x11C91CEB, 0x0008E89F, 0x6048102B, 0x00000002)
-

    RPC_Iface RW

    UINT8 byte[16]

    16 bytes of number

    UINT32 version

    the interface number

    RPC_ReqBind RW

    the remainder of the packet after the header if "type" was Bind in the response header, "type" should be BindAck

    UINT16 maxtsize

    maximum transmission fragment size (0x1630)

    UINT16 maxrsize

    max receive fragment size (0x1630)

    UINT32 assocgid

    associated group id (0x0)

    UINT32 numelements

    the number of elements (0x1)

    UINT16 contextid

    presentation context identifier (0x0)

    UINT8 numsyntaxes

    the number of syntaxes (has always been 1?)(0x1)

    UINT8[]

    4-byte alignment padding, against SMB header

    * abstractint USE RPC_Iface

    num and vers. of interface client is using

    * transferint USE RPC_Iface

    num and vers. of interface to use for replies

    RPC_Address RW

    UINT16 length

    length of the string including null terminator

    * port USE string

    the string above in single byte, null terminated form

    RPC_ResBind RW

    the response to place after the header in the reply packet

    UINT16 maxtsize

    same as request

    UINT16 maxrsize

    same as request

    UINT32 assocgid

    zero

    * secondaddr USE RPC_Address

    the address string, as described earlier

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT8 numresults

    the number of results (0x01)

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT16 result

    result (0x00 = accept)

    UINT16 reason

    reason (0x00 = no reason specified)

    * transfersyntax USE RPC_Iface

    the transfer syntax from the request

    RPC_ReqNorm RW

    the remainder of the packet after the header for every other other request

    UINT32 allochint

    the size of the stub data in bytes

    UINT16 prescontext

    presentation context identifier (0x0)

    UINT16 opnum

    operation number (0x15)

    * stub USE TvPacket

    a packet dependent on the pipe name (probably the interface) and the op number)

    RPC_ResNorm RW

    UINT32 allochint

    # size of the stub data in bytes

    UINT16 prescontext

    # presentation context identifier (same as request)

    UINT8 cancelcount

    # cancel count? (0x0)

    UINT8 reserved

    # 0 - one byte padding

    * stub USE TvPacket

    # the remainder of the reply

    Tail

    The end of each of the NTLSA and NETLOGON named pipes ends with:

    ......

    end of data

    UINT32

    return code

    RPC Bind / Bind Ack

    +

    RPC_Iface RW

    UINT8 byte[16]

    16 bytes of number

    UINT32 version

    the interface number

    RPC_ReqBind RW

    the remainder of the packet after the header if "type" was Bind in the response header, "type" should be BindAck

    UINT16 maxtsize

    maximum transmission fragment size (0x1630)

    UINT16 maxrsize

    max receive fragment size (0x1630)

    UINT32 assocgid

    associated group id (0x0)

    UINT32 numelements

    the number of elements (0x1)

    UINT16 contextid

    presentation context identifier (0x0)

    UINT8 numsyntaxes

    the number of syntaxes (has always been 1?)(0x1)

    UINT8[]

    4-byte alignment padding, against SMB header

    * abstractint USE RPC_Iface

    num and vers. of interface client is using

    * transferint USE RPC_Iface

    num and vers. of interface to use for replies

    RPC_Address RW

    UINT16 length

    length of the string including null terminator

    * port USE string

    the string above in single byte, null terminated form

    RPC_ResBind RW

    the response to place after the header in the reply packet

    UINT16 maxtsize

    same as request

    UINT16 maxrsize

    same as request

    UINT32 assocgid

    zero

    * secondaddr USE RPC_Address

    the address string, as described earlier

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT8 numresults

    the number of results (0x01)

    UINT8[]

    4-byte alignment padding, against SMB header

    UINT16 result

    result (0x00 = accept)

    UINT16 reason

    reason (0x00 = no reason specified)

    * transfersyntax USE RPC_Iface

    the transfer syntax from the request

    RPC_ReqNorm RW

    the remainder of the packet after the header for every other other request

    UINT32 allochint

    the size of the stub data in bytes

    UINT16 prescontext

    presentation context identifier (0x0)

    UINT16 opnum

    operation number (0x15)

    * stub USE TvPacket

    a packet dependent on the pipe name (probably the interface) and the op number)

    RPC_ResNorm RW

    UINT32 allochint

    # size of the stub data in bytes

    UINT16 prescontext

    # presentation context identifier (same as request)

    UINT8 cancelcount

    # cancel count? (0x0)

    UINT8 reserved

    # 0 - one byte padding

    * stub USE TvPacket

    # the remainder of the reply

    Tail

    The end of each of the NTLSA and NETLOGON named pipes ends with:

    ......

    end of data

    UINT32

    return code

    RPC Bind / Bind Ack

    RPC Binds are the process of associating an RPC pipe (e.g \PIPE\lsarpc) with a "transfer syntax" (see RPC_Iface structure). The purpose for doing this is unknown. @@ -1280,7 +1280,7 @@ this is unknown. returned by the SMBopenX Transact response.

    Note: The RPC_ResBind members maxtsize, maxrsize and assocgid are the same in the response as the same members in the RPC_ReqBind. The RPC_ResBind member transfersyntax is the same in the response as the

    Note: The RPC_ResBind response member secondaddr contains the name of what is presumed to be the service behind the RPC pipe. The - mapping identified so far is:

    initial SMBopenX request:

    RPC_ResBind response:

    "\\PIPE\\srvsvc"

    "\\PIPE\\ntsvcs"

    "\\PIPE\\samr"

    "\\PIPE\\lsass"

    "\\PIPE\\lsarpc"

    "\\PIPE\\lsass"

    "\\PIPE\\wkssvc"

    "\\PIPE\\wksvcs"

    "\\PIPE\\NETLOGON"

    "\\PIPE\\NETLOGON"

    Note: The RPC_Packet fraglength member in both the Bind Request and Bind Acknowledgment must contain the length of the entire RPC data, including the RPC_Packet header.

    Request:

    RPC_Packet
    RPC_ReqBind

    Response:

    RPC_Packet
    RPC_ResBind

    NTLSA Transact Named Pipe

    The sequence of actions taken on this pipe are:

    Establish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    Open an RPC Pipe with the name "\\PIPE\\lsarpc". Store the file handle.
    Using the file handle, send a Set Named Pipe Handle state to 0x4300.
    Send an LSA Open Policy request. Store the Policy Handle.
    Using the Policy Handle, send LSA Query Info Policy requests, etc.
    Using the Policy Handle, send an LSA Close.
    Close the IPC$ share.

    Defines for this pipe, identifying the query are:

    LSA Open Policy:

    0x2c

    LSA Query Info Policy:

    0x07

    LSA Enumerate Trusted Domains:

    0x0d

    LSA Open Secret:

    0xff

    LSA Lookup SIDs:

    0xfe

    LSA Lookup Names:

    0xfd

    LSA Close:

    0x00

    LSA Open Policy

    Note: The policy handle can be anything you like.

    Request

    VOID*

    buffer pointer

    UNISTR2

    server name - unicode string starting with two '\'s

    OBJ_ATTR

    object attributes

    UINT32

    1 - desired access

    Response

    POL_HND

    LSA policy handle

    return

    0 - indicates success

    LSA Query Info Policy

    Note: The info class in response must be the same as that in the request.

    Request

    POL_HND

    LSA policy handle

    UINT16

    info class (also a policy handle?)

    Response

    VOID*

    undocumented buffer pointer

    UINT16

    info class (same as info class in request).

    +	mapping identified so far is:
    initial SMBopenX request:
    RPC_ResBind response:
    "\\PIPE\\srvsvc"
    "\\PIPE\\ntsvcs"
    "\\PIPE\\samr"
    "\\PIPE\\lsass"
    "\\PIPE\\lsarpc"
    "\\PIPE\\lsass"
    "\\PIPE\\wkssvc"
    "\\PIPE\\wksvcs"
    "\\PIPE\\NETLOGON"
    "\\PIPE\\NETLOGON"
    Note:	The RPC_Packet fraglength member in both the Bind Request and Bind Acknowledgment must contain the length of the entire RPC data, including the RPC_Packet header.
    Request:
    RPC_Packet
    RPC_ReqBind
    Response:
    RPC_Packet
    RPC_ResBind

    NTLSA Transact Named Pipe

    The sequence of actions taken on this pipe are:

    Establish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    Open an RPC Pipe with the name "\\PIPE\\lsarpc". Store the file handle.
    Using the file handle, send a Set Named Pipe Handle state to 0x4300.
    Send an LSA Open Policy request. Store the Policy Handle.
    Using the Policy Handle, send LSA Query Info Policy requests, etc.
    Using the Policy Handle, send an LSA Close.
    Close the IPC$ share.

    Defines for this pipe, identifying the query are:

    LSA Open Policy:

    0x2c

    LSA Query Info Policy:

    0x07

    LSA Enumerate Trusted Domains:

    0x0d

    LSA Open Secret:

    0xff

    LSA Lookup SIDs:

    0xfe

    LSA Lookup Names:

    0xfd

    LSA Close:

    0x00

    LSA Open Policy

    Note: The policy handle can be anything you like.

    Request

    VOID*

    buffer pointer

    UNISTR2

    server name - unicode string starting with two '\'s

    OBJ_ATTR

    object attributes

    UINT32

    1 - desired access

    Response

    POL_HND

    LSA policy handle

    return

    0 - indicates success

    LSA Query Info Policy

    Note: The info class in response must be the same as that in the request.

    Request

    POL_HND

    LSA policy handle

    UINT16

    info class (also a policy handle?)

    Response

    VOID*

    undocumented buffer pointer

    UINT16

    info class (same as info class in request).

     switch (info class)
 case 3:
 case 5:
@@ -1289,11 +1289,11 @@ DOM_INFO domain info, levels 3 and 5 (are the same).
 }
 
 return    0 - indicates success
-

    LSA Enumerate Trusted Domains

    Request

    no extra data

    Response

    UINT32

    0 - enumeration context

    UINT32

    0 - entries read

    UINT32

    0 - trust information

    return

    0x8000 001a - "no trusted domains" success code

    LSA Open Secret

    Request

    no extra data

    Response

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    return 0x0C00 0034 - "no such secret" success code

    LSA Close

    Request

    POL_HND

    policy handle to be closed

    Response

    POL_HND

    0s - closed policy handle (all zeros)

    return 0 - indicates success

    LSA Lookup SIDS

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    VOID*[num_entries] undocumented domain SID pointers to be looked up. -

    DOM_SID[num_entries] domain SIDs to be looked up.

    char[16]

    completely undocumented 16 bytes.

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_SID2[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    LSA Lookup Names

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    NAME[num_entries]

    names to be looked up.

    char[]

    undocumented bytes - falsely translated SID structure?

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_RID[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    NETLOGON rpc Transact Named Pipe

    The sequence of actions taken on this pipe are:

    tablish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    en an RPC Pipe with the name "\\PIPE\\NETLOGON". Store the file handle.
    ing the file handle, send a Set Named Pipe Handle state to 0x4300.
    eate Client Challenge. Send LSA Request Challenge. Store Server Challenge.
    lculate Session Key. Send an LSA Auth 2 Challenge. Store Auth2 Challenge.
    lc/Verify Client Creds. Send LSA Srv PW Set. Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logon . Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logoff. Calc/Verify Server Creds.
    ose the IPC$ share.

    Defines for this pipe, identifying the query are

    LSA Request Challenge:

    0x04

    LSA Server Password Set:

    0x06

    LSA SAM Logon:

    0x02

    LSA SAM Logoff:

    0x03

    LSA Auth 2:

    0x0f

    LSA Logon Control:

    0x0e

    LSA Request Challenge

    Note: logon server name starts with two '\' characters and is upper case.

    Note: logon client is the machine, not the user.

    Note: the initial LanManager password hash, against which the challenge is issued, is the machine name itself (lower case). there will becalls issued (LSA Server Password Set) which will change this, later. refusing these calls allows you to always deal with the same password (i.e the LM# of the machine name in lower case).

    Request

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    logon client unicode string

    char[8]

    client challenge

    Response

    char[8]

    server challenge

    return 0 - indicates success

    LSA Authenticate 2

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: neg_flags in the response is the same as that in the request.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    LOG_INFO

    client identification info

    char[8]

    client-calculated credentials

    UINT8[]

    padding to 4-byte align with start of SMB header.

    UINT32

    neg_flags - negotiated flags (usual value is 0x0000 01ff)

    Response

    char[8]

    server credentials.

    UINT32

    neg_flags - same as neg_flags in request.

    return 0 - indicates success. failure value unknown.

    LSA Server Password Set

    Note: the new password is suspected to be a DES encryption using the old password to generate the key.

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: the server credentials are constructed from the client-calculated credentials and the client time + 1 second.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    CLNT_INFO

    client identification/authentication info

    char[]

    new password - undocumented.

    Response

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success; 0xC000 006a indicates failure

    LSA SAM Logon

    +

    LSA Enumerate Trusted Domains

    Request

    no extra data

    Response

    UINT32

    0 - enumeration context

    UINT32

    0 - entries read

    UINT32

    0 - trust information

    return

    0x8000 001a - "no trusted domains" success code

    LSA Open Secret

    Request

    no extra data

    Response

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    UINT32

    0 - undocumented

    return 0x0C00 0034 - "no such secret" success code

    LSA Close

    Request

    POL_HND

    policy handle to be closed

    Response

    POL_HND

    0s - closed policy handle (all zeros)

    return 0 - indicates success

    LSA Lookup SIDS

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    VOID*[num_entries] undocumented domain SID pointers to be looked up. +

    DOM_SID[num_entries] domain SIDs to be looked up.

    char[16]

    completely undocumented 16 bytes.

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_SID2[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    LSA Lookup Names

    Note: num_entries in response must be same as num_entries in request.

    Request

    POL_HND

    LSA policy handle

    UINT32

    num_entries

    UINT32

    num_entries

    VOID*

    undocumented domain SID buffer pointer

    VOID*

    undocumented domain name buffer pointer

    NAME[num_entries]

    names to be looked up.

    char[]

    undocumented bytes - falsely translated SID structure?

    Response

    DOM_REF

    domain reference response

    UINT32

    num_entries (listed above)

    VOID*

    undocumented buffer pointer

    UINT32

    num_entries (listed above)

    DOM_RID[num_entries]

    domain SIDs (from Request, listed above).

    UINT32

    num_entries (listed above)

    return 0 - indicates success

    NETLOGON rpc Transact Named Pipe

    The sequence of actions taken on this pipe are:

    tablish a connection to the IPC$ share (SMBtconX). use encrypted passwords.
    en an RPC Pipe with the name "\\PIPE\\NETLOGON". Store the file handle.
    ing the file handle, send a Set Named Pipe Handle state to 0x4300.
    eate Client Challenge. Send LSA Request Challenge. Store Server Challenge.
    lculate Session Key. Send an LSA Auth 2 Challenge. Store Auth2 Challenge.
    lc/Verify Client Creds. Send LSA Srv PW Set. Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logon . Calc/Verify Server Creds.
    lc/Verify Client Creds. Send LSA SAM Logoff. Calc/Verify Server Creds.
    ose the IPC$ share.

    Defines for this pipe, identifying the query are

    LSA Request Challenge:

    0x04

    LSA Server Password Set:

    0x06

    LSA SAM Logon:

    0x02

    LSA SAM Logoff:

    0x03

    LSA Auth 2:

    0x0f

    LSA Logon Control:

    0x0e

    LSA Request Challenge

    Note: logon server name starts with two '\' characters and is upper case.

    Note: logon client is the machine, not the user.

    Note: the initial LanManager password hash, against which the challenge is issued, is the machine name itself (lower case). there will becalls issued (LSA Server Password Set) which will change this, later. refusing these calls allows you to always deal with the same password (i.e the LM# of the machine name in lower case).

    Request

    VOID*

    undocumented buffer pointer

    UNISTR2

    logon server unicode string

    UNISTR2

    logon client unicode string

    char[8]

    client challenge

    Response

    char[8]

    server challenge

    return 0 - indicates success

    LSA Authenticate 2

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: neg_flags in the response is the same as that in the request.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    LOG_INFO

    client identification info

    char[8]

    client-calculated credentials

    UINT8[]

    padding to 4-byte align with start of SMB header.

    UINT32

    neg_flags - negotiated flags (usual value is 0x0000 01ff)

    Response

    char[8]

    server credentials.

    UINT32

    neg_flags - same as neg_flags in request.

    return 0 - indicates success. failure value unknown.

    LSA Server Password Set

    Note: the new password is suspected to be a DES encryption using the old password to generate the key.

    Note: in between request and response, calculate the client credentials, and check them against the client-calculated credentials (this process uses the previously received client credentials).

    Note: the server credentials are constructed from the client-calculated credentials and the client time + 1 second.

    Note: you must take a copy of the client-calculated credentials received here, because they will be used in subsequent authentication packets.

    Request

    CLNT_INFO

    client identification/authentication info

    char[]

    new password - undocumented.

    Response

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success; 0xC000 006a indicates failure

    LSA SAM Logon

    Note: valid_user is True iff the username and password hash are valid for the requested domain. -

    Request

    SAM_INFO

    sam_id structure

    Response

    VOID*

    undocumented buffer pointer

    CREDS

    server credentials. server time stamp appears to be ignored.

    +
    Request
    SAM_INFO
    sam_id structure
    Response
    VOID*
    undocumented buffer pointer
    CREDS
    server credentials.  server time stamp appears to be ignored.
     if (valid_user)
 {
 	UINT16      3 - switch value indicating USER_INFO structure.
@@ -1313,16 +1313,16 @@ else
 
     return    0xC000 0064 - NT_STATUS_NO_SUCH_USER.
 }
-

    LSA SAM Logoff

    +

    LSA SAM Logoff

    Note: presumably, the SAM_INFO structure is validated, and a (currently undocumented) error code returned if the Logoff is invalid. -

    Request

    SAM_INFO

    sam_id structure

    Response

    VOID*

    undocumented buffer pointer

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success. undocumented failure indication.

    \\MAILSLOT\NET\NTLOGON

    +

    Request

    SAM_INFO

    sam_id structure

    Response

    VOID*

    undocumented buffer pointer

    CREDS

    server credentials. server time stamp appears to be ignored.

    return 0 - indicates success. undocumented failure indication.

    \\MAILSLOT\NET\NTLOGON

    Note: mailslots will contain a response mailslot, to which the response should be sent. the target NetBIOS name is REQUEST_NAME<20>, where REQUEST_NAME is the name of the machine that sent the request. -

    Query for PDC

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Request

    UINT16

    0x0007 - Query for PDC

    STR

    machine name

    STR

    response mailslot

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x000A - Respose to Query for PDC

    STR

    machine name (in uppercase)

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UNISTR

    domain name

    UINT32

    NTversion (same as received in request)

    UINT16

    LMNTtoken (same as received in request)

    UINT16

    LM20token (same as received in request)

    SAM Logon

    Note: machine name in response is preceded by two '\' characters.

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Note: user name in the response is presumably the same as that in the request.

    Request

    UINT16

    0x0012 - SAM Logon

    UINT16

    request count

    UNISTR

    machine name

    UNISTR

    user name

    STR

    response mailslot

    UINT32

    alloweable account

    UINT32

    domain SID size

    char[sid_size]

    domain SID, of sid_size bytes.

    UINT8[]

    ???? padding to 4? 2? -byte align with start of mailslot.

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x0013 - Response to SAM Logon

    UNISTR

    machine name

    UNISTR

    user name - workstation trust account

    UNISTR

    domain name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    SRVSVC Transact Named Pipe

    Defines for this pipe, identifying the query are:

    Net Share Enum

    0x0f

    Net Server Get Info

    0x15

    Net Share Enum

    Note: share level and switch value in the response are presumably the same as those in the request.

    Note: cifsrap2.txt (section 5) may be of limited assistance here.

    Request

    VOID*

    pointer (to server name?)

    UNISTR2

    server name

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info with 0 entries

    UINT32

    preferred maximum length (0xffff ffff)

    Response

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info (only added if share info ptr is non-zero)

    return 0 - indicates success

    Net Server Get Info

    Note: level is the same value as in the request.

    Request

    UNISTR2

    server name

    UINT32

    switch level

    Response

    UINT32

    switch level

    VOID*

    pointer to SERVER_INFO_101

    SERVER_INFO_101

    server info (only added if server info ptr is non-zero)

    return 0 - indicates success

    Cryptographic side of NT Domain Authentication

    Definitions

    Add(A1,A2)

    Intel byte ordered addition of corresponding 4 byte words in arrays A1 and A2

    E(K,D)

    DES ECB encryption of 8 byte data D using 7 byte key K

    lmowf()

    Lan man hash

    ntowf()

    NT hash

    PW

    md4(machine_password) == md4(lsadump $machine.acc) == +

    Query for PDC

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Request

    UINT16

    0x0007 - Query for PDC

    STR

    machine name

    STR

    response mailslot

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x000A - Respose to Query for PDC

    STR

    machine name (in uppercase)

    UINT8[]

    padding to 2-byte align with start of mailslot.

    UNISTR

    machine name

    UNISTR

    domain name

    UINT32

    NTversion (same as received in request)

    UINT16

    LMNTtoken (same as received in request)

    UINT16

    LM20token (same as received in request)

    SAM Logon

    Note: machine name in response is preceded by two '\' characters.

    Note: NTversion, LMNTtoken, LM20token in response are the same as those given in the request.

    Note: user name in the response is presumably the same as that in the request.

    Request

    UINT16

    0x0012 - SAM Logon

    UINT16

    request count

    UNISTR

    machine name

    UNISTR

    user name

    STR

    response mailslot

    UINT32

    alloweable account

    UINT32

    domain SID size

    char[sid_size]

    domain SID, of sid_size bytes.

    UINT8[]

    ???? padding to 4? 2? -byte align with start of mailslot.

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    Response

    UINT16

    0x0013 - Response to SAM Logon

    UNISTR

    machine name

    UNISTR

    user name - workstation trust account

    UNISTR

    domain name

    UINT32

    NTversion

    UINT16

    LMNTtoken

    UINT16

    LM20token

    SRVSVC Transact Named Pipe

    Defines for this pipe, identifying the query are:

    Net Share Enum

    0x0f

    Net Server Get Info

    0x15

    Net Share Enum

    Note: share level and switch value in the response are presumably the same as those in the request.

    Note: cifsrap2.txt (section 5) may be of limited assistance here.

    Request

    VOID*

    pointer (to server name?)

    UNISTR2

    server name

    UINT8[]

    padding to get unicode string 4-byte aligned with the start of the SMB header.

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info with 0 entries

    UINT32

    preferred maximum length (0xffff ffff)

    Response

    UINT32

    share level

    UINT32

    switch value

    VOID*

    pointer to SHARE_INFO_1_CTR

    SHARE_INFO_1_CTR

    share info (only added if share info ptr is non-zero)

    return 0 - indicates success

    Net Server Get Info

    Note: level is the same value as in the request.

    Request

    UNISTR2

    server name

    UINT32

    switch level

    Response

    UINT32

    switch level

    VOID*

    pointer to SERVER_INFO_101

    SERVER_INFO_101

    server info (only added if server info ptr is non-zero)

    return 0 - indicates success

    Cryptographic side of NT Domain Authentication

    Definitions

    Add(A1,A2)

    Intel byte ordered addition of corresponding 4 byte words in arrays A1 and A2

    E(K,D)

    DES ECB encryption of 8 byte data D using 7 byte key K

    lmowf()

    Lan man hash

    ntowf()

    NT hash

    PW

    md4(machine_password) == md4(lsadump $machine.acc) == pwdump(machine$) (initially) == md4(lmowf(unicode(machine))) -

    ARC4(K,Lk,D,Ld)

    ARC4 encryption of data D of length Ld with key K of length Lk

    v[m..n(,l)]

    subset of v from bytes m to n, optionally padded with zeroes to length l

    Cred(K,D)

    E(K[7..7,7],E(K[0..6],D)) computes a credential

    Time()

    4 byte current time

    Cc,Cs

    8 byte client and server challenges Rc,Rs: 8 byte client and server credentials

    Protocol

    +
    ARC4(K,Lk,D,Ld)
    ARC4 encryption of data D of length Ld with key K of length Lk
    v[m..n(,l)]
    subset of v from bytes m to n, optionally padded with zeroes to length l
    Cred(K,D)
    E(K[7..7,7],E(K[0..6],D)) computes a credential
    Time()
    4 byte current time
    Cc,Cs
    8 byte client and server challenges Rc,Rs: 8 byte client and server credentials

    Protocol

     C->S ReqChal,Cc
 S->C Cs
 
    @@ -1358,7 +1358,7 @@ S: Ts = Time()
 S->C Cred(Ks,Cred(Ks,Rc+Tc+1)),userinfo(logon script,UID,SIDs,etc)
 C: assert(Rs == Cred(Ks,Cred(Rc+Tc+1))
 C: Rc = Cred(Ks,Rc+Tc+1)
-

    Comments

    +

    Comments

    On first joining the domain the session key could be computed by anyone listening in on the network as the machine password has a well known value. Until the machine is rebooted it will use this session @@ -1379,30 +1379,30 @@ returned by the server. The password OWFs should NOT be sent over the network reversibly encrypted. They should be sent using ARC4(Ks,md4(owf)) with the server computing the same function using the owf values in the SAM. -

    SIDs and RIDs

    +

    SIDs and RIDs

    SIDs and RIDs are well documented elsewhere.

    A SID is an NT Security ID (see DOM_SID structure). They are of the form:

    revision-NN-SubAuth1-SubAuth2-SubAuth3...
    revision-0xNNNNNNNNNNNN-SubAuth1-SubAuth2-SubAuth3...

    currently, the SID revision is 1. The Sub-Authorities are known as Relative IDs (RIDs). -

    Well-known SIDs

    Universal well-known SIDs

    Null SID

    S-1-0-0

    World

    S-1-1-0

    Local

    S-1-2-0

    Creator Owner ID

    S-1-3-0

    Creator Group ID

    S-1-3-1

    Creator Owner Server ID

    S-1-3-2

    Creator Group Server ID

    S-1-3-3

    (Non-unique IDs)

    S-1-4

    NT well-known SIDs

    NT Authority

    S-1-5

    Dialup

    S-1-5-1

    Network

    S-1-5-2

    Batch

    S-1-5-3

    Interactive

    S-1-5-4

    Service

    S-1-5-6

    AnonymousLogon(aka null logon session)

    S-1-5-7

    Proxy

    S-1-5-8

    ServerLogon(aka domain controller account)

    S-1-5-8

    (Logon IDs)

    S-1-5-5-X-Y

    (NT non-unique IDs)

    S-1-5-0x15-...

    (Built-in domain)

    s-1-5-0x20

    Well-known RIDS

    +

    Well-known SIDs

    Universal well-known SIDs

    Null SID

    S-1-0-0

    World

    S-1-1-0

    Local

    S-1-2-0

    Creator Owner ID

    S-1-3-0

    Creator Group ID

    S-1-3-1

    Creator Owner Server ID

    S-1-3-2

    Creator Group Server ID

    S-1-3-3

    (Non-unique IDs)

    S-1-4

    NT well-known SIDs

    NT Authority

    S-1-5

    Dialup

    S-1-5-1

    Network

    S-1-5-2

    Batch

    S-1-5-3

    Interactive

    S-1-5-4

    Service

    S-1-5-6

    AnonymousLogon(aka null logon session)

    S-1-5-7

    Proxy

    S-1-5-8

    ServerLogon(aka domain controller account)

    S-1-5-8

    (Logon IDs)

    S-1-5-5-X-Y

    (NT non-unique IDs)

    S-1-5-0x15-...

    (Built-in domain)

    s-1-5-0x20

    Well-known RIDS

    A RID is a sub-authority value, as part of either a SID, or in the case of Group RIDs, part of the DOM_GID structure, in the USER_INFO_1 structure, in the LSA SAM Logon response. -

    Well-known RID users

    Groupname: DOMAIN_USER_RID_ADMIN

    ????: 0x0000

    RID: 01F4

    Groupname: DOMAIN_USER_RID_GUEST

    ????: 0x0000

    RID: 01F5

    Well-known RID groups

    Groupname: DOMAIN_GROUP_RID_ADMINS

    ????: 0x0000

    RID: 0200

    Groupname: DOMAIN_GROUP_RID_USERS

    ????: 0x0000

    RID: 0201

    Groupname: DOMAIN_GROUP_RID_GUESTS

    ????: 0x0000

    RID: 0202

    Well-known RID aliases

    Groupname: DOMAIN_ALIAS_RID_ADMINS

    ????: 0x0000

    RID: 0220

    Groupname: DOMAIN_ALIAS_RID_USERS

    ????: 0x0000

    RID: 0221

    Groupname: DOMAIN_ALIAS_RID_GUESTS

    ????: 0x0000

    RID: 0222

    Groupname: DOMAIN_ALIAS_RID_POWER_USERS

    ????: 0x0000

    RID: 0223

    Groupname: DOMAIN_ALIAS_RID_ACCOUNT_OPS

    ????: 0x0000

    RID: 0224

    Groupname: DOMAIN_ALIAS_RID_SYSTEM_OPS

    ????: 0x0000

    RID: 0225

    Groupname: DOMAIN_ALIAS_RID_PRINT_OPS

    ????: 0x0000

    RID: 0226

    Groupname: DOMAIN_ALIAS_RID_BACKUP_OPS

    ????: 0x0000

    RID: 0227

    Groupname: DOMAIN_ALIAS_RID_REPLICATOR

    ????: 0x0000

    RID: 0228

    Chapter 11. Samba Printing Internals

    Gerald Carter

    October 2002

    Table of Contents

    Abstract
    +

    Well-known RID users

    Groupname: DOMAIN_USER_RID_ADMIN

    ????: 0x0000

    RID: 01F4

    Groupname: DOMAIN_USER_RID_GUEST

    ????: 0x0000

    RID: 01F5

    Well-known RID groups

    Groupname: DOMAIN_GROUP_RID_ADMINS

    ????: 0x0000

    RID: 0200

    Groupname: DOMAIN_GROUP_RID_USERS

    ????: 0x0000

    RID: 0201

    Groupname: DOMAIN_GROUP_RID_GUESTS

    ????: 0x0000

    RID: 0202

    Well-known RID aliases

    Groupname: DOMAIN_ALIAS_RID_ADMINS

    ????: 0x0000

    RID: 0220

    Groupname: DOMAIN_ALIAS_RID_USERS

    ????: 0x0000

    RID: 0221

    Groupname: DOMAIN_ALIAS_RID_GUESTS

    ????: 0x0000

    RID: 0222

    Groupname: DOMAIN_ALIAS_RID_POWER_USERS

    ????: 0x0000

    RID: 0223

    Groupname: DOMAIN_ALIAS_RID_ACCOUNT_OPS

    ????: 0x0000

    RID: 0224

    Groupname: DOMAIN_ALIAS_RID_SYSTEM_OPS

    ????: 0x0000

    RID: 0225

    Groupname: DOMAIN_ALIAS_RID_PRINT_OPS

    ????: 0x0000

    RID: 0226

    Groupname: DOMAIN_ALIAS_RID_BACKUP_OPS

    ????: 0x0000

    RID: 0227

    Groupname: DOMAIN_ALIAS_RID_REPLICATOR

    ????: 0x0000

    RID: 0228

    Chapter 11. Samba Printing Internals

    Gerald Carter

    October 2002

    Table of Contents

    Abstract
    Printing Interface to Various Back ends -
    +
    Print Queue TDB's -
    +
    ChangeID and Client Caching of Printer Information -
    +
    Windows NT/2K Printer Change Notify -

    Abstract

    +

    Abstract

    The purpose of this document is to provide some insight into Samba's printing functionality and also to describe the semantics of certain features of Windows client printing. -

    +

    Printing Interface to Various Back ends

    Samba uses a table of function pointers to seven functions. The @@ -1413,7 +1413,7 @@ Currently there are only two printing back end implementations defined.

    • a generic set of functions for working with standard UNIX printing subsystems

    • a set of CUPS specific functions (this is only enabled if - the CUPS libraries were located at compile time).

    + the CUPS libraries were located at compile time).

    Print Queue TDB's

    Samba provides periodic caching of the output from the "lpq command" @@ -1502,11 +1502,11 @@ and the job has the printer's device mode associated with it by default. Only non-default Device Mode are stored with print jobs in the print queue TDB. Otherwise, the Device Mode is obtained from the printer object when the client issues a GetJob(level == 2) request. -

    +

    ChangeID and Client Caching of Printer Information

    [To be filled in later] -

    +

    Windows NT/2K Printer Change Notify

    When working with Windows NT+ clients, it is possible for a @@ -1604,7 +1604,7 @@ handle for notification. Samba currently uses the snum of the printer for this which can break if the list of services has been modified since the notification handle was registered.

  • The size is either (a) the string length in UNICODE for strings, (b) the size in bytes of the security descriptor, or (c) 0 for -data values.

    • Chapter 12. Samba WINS Internals

    Gerald Carter

    October 2002

    Table of Contents

    WINS Failover

    WINS Failover

    +data values.

    Chapter 12. Samba WINS Internals

    Gerald Carter

    October 2002

    Table of Contents

    WINS Failover

    WINS Failover

    The current Samba codebase possesses the capability to use groups of WINS servers that share a common namespace for NetBIOS name registration and resolution. The formal parameter syntax is @@ -1646,7 +1646,7 @@ If a timeout occurs when querying a specific WINS server, that server is marked prevent further timeouts and the next server in the WINS group is contacted. Once marked as dead, Samba will not attempt to contact that server for name registration/resolution queries for a period of 10 minutes. -

    Chapter 13. The Upcoming SAM System

    Andrew Bartlett

    1 October 2002

    Table of Contents

    Security in the 'new SAM'
    Standalone from UNIX
    Handles and Races in the new SAM
    Layers
    Application
    SAM Interface
    SAM Modules
    SAM Modules
    Special Module: sam_passdb
    sam_ads
    Memory Management
    Testing

    Security in the 'new SAM'

    One of the biggest problems with passdb is it's implementation of +

    Chapter 13. The Upcoming SAM System

    Andrew Bartlett

    1 October 2002

    Table of Contents

    Security in the 'new SAM'
    Standalone from UNIX
    Handles and Races in the new SAM
    Layers
    Application
    SAM Interface
    SAM Modules
    SAM Modules
    Special Module: sam_passdb
    sam_ads
    Memory Management
    Testing

    Security in the 'new SAM'

    One of the biggest problems with passdb is it's implementation of 'security'. Access control is on a 'are you root at the moment' basis, and it has no concept of NT ACLs. Things like ldapsam had to add 'magic' 'are you root' checks.

    We took this very seriously when we started work, and the new structure @@ -1706,7 +1706,7 @@ actual data store (like the LDAP server).

    Finally, we have generic get_sec_desc() and set_sec_desc() routines to allow external ACL manipulation. These do lookups based on SID. -

    Standalone from UNIX

    +

    Standalone from UNIX

    One of the primary tenants of the 'new SAM' is that it would not attempt to deal with 'what unix id for that'. This would be left to the 'SMS' (Sid Mapping System') or SID farm, and probably administered via @@ -1716,7 +1716,7 @@ Accounts not preexisting in unix would be served up via winbind.

    This is an *optional* part, and my preferred end-game. We have a fare way to go before things like winbind up to it however. -

    Handles and Races in the new SAM

    +

    Handles and Races in the new SAM

    One of the things that the 'new SAM' work has tried to face is both compatibility with existing code, and a closer alignment to the SAMR interface. I consider SAMR to be a 'primary customer' to the this work, @@ -1741,11 +1741,11 @@ have *really* changed. 'conflicting' updates: Currently we don't deal with this (in passdb or the new sam stuff), but the design is sufficiently flexible to 'deny' a second update. I don't foresee locking records however. -

    Layers

    Application

    +

    Layers

    Application

    This is where smbd, samtest and whatever end-user replacement we have for pdbedit sits. They use only the SAM interface, and do not get 'special knowledge' of what is below them. -

    SAM Interface

    +

    SAM Interface

    This level 'owns' the various handle structures, the get/set routines on those structures and provides the public interface. The application layer may initialize a 'context' to be passed to all interface routines, @@ -1756,7 +1756,7 @@ abstraction to the modules below, and arrange for their initial loading.

    We could possibly add ACL checking at this layer, to avoid discrepancies in implementation modules. -

    SAM Modules

    +

    SAM Modules

    These do not communicate with the application directly, only by setting values in the handles, and receiving requests from the interface. These modules are responsible for translating values from the handle's @@ -1764,13 +1764,13 @@ modules are responsible for translating values from the handle's to 'know' things like it's own domain SID, domain name, and any other state attached to the SAM. Simpler modules may call back to some helper routine. -

    SAM Modules

    Special Module: sam_passdb

    +

    SAM Modules

    Special Module: sam_passdb

    In order for there to be a smooth transition, kai is writing a module that reads existing passdb backends, and translates them into SAM replies. (Also pulling data from the account policy DB etc). We also intend to write a module that does the reverse - gives the SAM a passdb interface. -

    sam_ads

    +

    sam_ads

    This is the first of the SAM modules to be committed to the tree - mainly because I needed to coordinate work with metze (who authored most of it). This module aims to use Samba's libads code to provide an @@ -1782,7 +1782,7 @@ the construction of an Samba AD DC.

    We also intend to construct a Samba 2.2/3.0 compatible ldap module, again using libads code. -

    Memory Management

    +

    Memory Management

    The 'new SAM' development effort also concerned itself with getting a sane implementation of memory management. It was decided that we would be (as much as possible) talloc based, using an 'internal talloc @@ -1811,7 +1811,7 @@ NT_USER_TOKEN *access_token, uint32 access_desired, const DOM_SID NTSTATUS sam_enum_accounts(const SAM_CONTEXT *context, const NT_USER_TOKEN *access_token, const DOM_SID *domainsid, uint16 acct_ctrl, int32 *account_count, SAM_ACCOUNT_ENUM **accounts) -

    Testing

    +

    Testing

    Testing is vital in any piece of software, and Samba is certainly no exception. In designing this new subsystem, we have taken care to ensure it is easily tested, independent of outside protocols. @@ -1840,13 +1840,13 @@ Because the 'new SAM' is NT ACL based, there will be a command to specify an arbitrary NT ACL, but for now it uses 'system' by default.

    Chapter 14. LanMan and NT Password Encryption

    Jeremy Allison

    Samba Team



    -

    19 Apr 1999

    Table of Contents

    Introduction
    How does it work?
    The smbpasswd file

    Introduction

    With the development of LanManager and Windows NT +

    19 Apr 1999

    Table of Contents

    Introduction
    How does it work?
    The smbpasswd file

    Introduction

    With the development of LanManager and Windows NT compatible password encryption for Samba, it is now able to validate user connections in exactly the same way as a LanManager or Windows NT server.

    This document describes how the SMB password encryption algorithm works and what issues there are in choosing whether you want to use it. You should read it carefully, especially - the part about security and the "PROS and CONS" section.

    How does it work?

    LanManager encryption is somewhat similar to UNIX + the part about security and the "PROS and CONS" section.

    How does it work?

    LanManager encryption is somewhat similar to UNIX password encryption. The server uses a file containing a hashed value of a user's password. This is created by taking the user's plaintext password, capitalising it, and either @@ -1883,7 +1883,7 @@ specify an arbitrary NT ACL, but for now it uses 'system' by default. know the correct password and is denied access.

    Note that the Samba server never knows or stores the cleartext of the user's password - just the 16 byte hashed values derived from it. Also note that the cleartext password or 16 byte hashed values - are never transmitted over the network - thus increasing security.

    The smbpasswd file

    In order for Samba to participate in the above protocol + are never transmitted over the network - thus increasing security.

    The smbpasswd file

    In order for Samba to participate in the above protocol it must be able to look up the 16 byte hashed values given a user name. Unfortunately, as the UNIX password value is also a one way hash function (ie. it is impossible to retrieve the cleartext of the user's @@ -1940,10 +1940,10 @@ bob:100:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: to enable this on your server.

    Note : This file should be protected very carefully. Anyone with access to this file can (with enough knowledge of the protocols) gain access to your SMB server. The file is thus more - sensitive than a normal unix /etc/passwd file.

    Chapter 15. Modules

    Jelmer Vernooij

    Samba Team

    19 March 2003

    Table of Contents

    Advantages
    Loading modules
    Static modules
    Shared modules
    Writing modules
    Static/Shared selection in configure.in

    Advantages

    + sensitive than a normal unix /etc/passwd file.

    Chapter 15. Modules

    Jelmer Vernooij

    Samba Team

    19 March 2003

    Table of Contents

    Advantages
    Loading modules
    Static modules
    Shared modules
    Writing modules
    Static/Shared selection in configure.in

    Advantages

    The new modules system has the following advantages:

    Transparent loading of static and shared modules (no need -for a subsystem to know about modules)
    Simple selection between shared and static modules at configure time
    "preload modules" option for increasing performance for stable modules
    No nasty #define stuff anymore
    All backends are available as plugin now (including pdb_ldap and pdb_tdb)

    Loading modules

    +for a subsystem to know about modules)

    Simple selection between shared and static modules at configure time
    "preload modules" option for increasing performance for stable modules
    No nasty #define stuff anymore
    All backends are available as plugin now (including pdb_ldap and pdb_tdb)

    Loading modules

    Some subsystems in samba use different backends. These backends can be either statically linked in to samba or available as a plugin. A subsystem should have a function that allows a module to register itself. For example, @@ -1953,7 +1953,7 @@ NTSTATUS smb_register_passdb(int version, const char *name, pdb_init_function in

    This function will be called by the initialisation function of the module to register itself. -

    Static modules

    +

    Static modules

    The modules system compiles a list of initialisation functions for the static modules of each subsystem. This is a define. For example, it is here currently (from include/config.h): @@ -1963,7 +1963,7 @@ it is here currently (from include/config.h):

    These functions should be called before the subsystem is used. That should be done when the subsystem is initialised or first used. -

    Shared modules

    +

    Shared modules

    If a subsystem needs a certain backend, it should check if it has already been registered. If the backend hasn't been registered already, the subsystem should call smb_probe_module(char *subsystem, char *backend). @@ -1973,7 +1973,7 @@ is a slash, smb_probe_module() tries to load the module from the absolute path specified in 'backend'.

    After smb_probe_module() has been executed, the subsystem should check again if the module has been registered. -

    Writing modules

    +

    Writing modules

    Each module has an initialisation function. For modules that are included with samba this name is 'subsystem_backend_init'. For external modules (that will never be built-in, but only available as a module) this name is always 'init_module'. (In the case of modules included with samba, the configure system will add a #define subsystem_backend_init() init_module()). The prototype for these functions is: @@ -1988,7 +1988,7 @@ smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam); smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_nua", pdb_init_ldapsam_nua); return NT_STATUS_OK; } -

    Static/Shared selection in configure.in

    +

    Static/Shared selection in configure.in

    Some macros in configure.in generate the various defines and substs that are necessary for the system to work correct. All modules that should be built by default have to be added to the variable 'default_modules'. @@ -2009,13 +2009,13 @@ Practically, this means all c files that contain static_init_

    Note

    There currently also is a configure.in command called SMB_MODULE_PROVIVES(). This is used for modules that register multiple things. It should not -be used as probing will most likely disappear in the future.

    Chapter 16. RPC Pluggable Modules

    Anthony Liguori

    IBM

    Jelmer Vernooij

    Samba Team

    January 2003

    Table of Contents

    About
    General Overview

    About

    +be used as probing will most likely disappear in the future.

    Chapter 16. RPC Pluggable Modules

    Anthony Liguori

    IBM

    Jelmer Vernooij

    Samba Team

    January 2003

    Table of Contents

    About
    General Overview

    About

    This document describes how to make use the new RPC Pluggable Modules features of Samba 3.0. This architecture was added to increase the maintainability of Samba allowing RPC Pipes to be worked on separately from the main CVS branch. The RPM architecture will also allow third-party vendors to add functionality to Samba through plug-ins. -

    General Overview

    +

    General Overview

    When an RPC call is sent to smbd, smbd tries to load a shared library by the name librpc_<pipename>.so to handle the call if it doesn't know how to handle the call internally. For instance, LSA calls @@ -2032,7 +2032,7 @@ NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *s argument.

    clnt

    the Client name of the named pipe

    srv

    the Server name of the named pipe

    cmds

    a list of api_structs that map RPC ordinal numbers to function calls

    size

    the number of api_structs contained in cmds

    See rpc_server/srv_reg.c and rpc_server/srv_reg_nt.c for a small example of how to use this library. -

    Chapter 17. VFS Modules

    Alexander Bokovoy

    Stefan Metzmacher

    27 May 2003

    Table of Contents

    The Samba (Posix) VFS layer
    The general interface
    Possible VFS operation layers
    The Interaction between the Samba VFS subsystem and the modules
    Initialization and registration
    How the Modules handle per connection data
    Upgrading to the New VFS Interface
    Upgrading from 2.2.* and 3.0aplha modules
    Some Notes
    Implement TRANSPARENT functions
    Implement OPAQUE functions

    The Samba (Posix) VFS layer

    The general interface

    +

    Chapter 17. VFS Modules

    Alexander Bokovoy

    Stefan Metzmacher

    27 May 2003

    Table of Contents

    The Samba (Posix) VFS layer
    The general interface
    Possible VFS operation layers
    The Interaction between the Samba VFS subsystem and the modules
    Initialization and registration
    How the Modules handle per connection data
    Upgrading to the New VFS Interface
    Upgrading from 2.2.* and 3.0aplha modules
    Some Notes
    Implement TRANSPARENT functions
    Implement OPAQUE functions

    The Samba (Posix) VFS layer

    The general interface

    Each VFS operation has a vfs_op_type, a function pointer and a handle pointer in the struct vfs_ops and tree macros to make it easier to call the operations. (Take a look at include/vfs.h and include/vfs_macros.h.) @@ -2128,7 +2128,7 @@ DO NOT ACCESS conn->vfs.ops.* directly !!! (tofd), (fsp), (fromfd), (header), (offset), (count))) ... -

    Possible VFS operation layers

    +

    Possible VFS operation layers

    These values are used by the VFS subsystem when building the conn->vfs and conn->vfs_opaque structs for a connection with multiple VFS modules. Internally, Samba differentiates only opaque and transparent layers at this process. @@ -2157,7 +2157,7 @@ typedef enum _vfs_op_layer { SMB_VFS_LAYER_SCANNER /* - Checks data and possibly initiates additional */ /* file activity like logging to files _inside_ samba VFS */ } vfs_op_layer; -

    The Interaction between the Samba VFS subsystem and the modules

    Initialization and registration

    +

    The Interaction between the Samba VFS subsystem and the modules

    Initialization and registration

    As each Samba module a VFS module should have a 

    NTSTATUS vfs_example_init(void);

    function if it's staticly linked to samba or 

    NTSTATUS init_module(void);

    function if it's a shared module. @@ -2197,7 +2197,7 @@ NTSTATUS init_module(void) { return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "example", example_op_tuples); } -

    How the Modules handle per connection data

    Each VFS function has as first parameter a pointer to the modules vfs_handle_struct. +

    How the Modules handle per connection data

    Each VFS function has as first parameter a pointer to the modules vfs_handle_struct. 

     typedef struct vfs_handle_struct {
 	struct vfs_handle_struct  *next, *prev;
@@ -2298,7 +2298,7 @@ you can set this function pointer to NULL.

    Some useful MAC (handle)->vfs_next.handles.sendfile,\ (tofd), (fsp), (fromfd), (header), (offset), (count))) ... -

    Upgrading to the New VFS Interface

    Upgrading from 2.2.* and 3.0aplha modules

    1. +

    Upgrading to the New VFS Interface

    Upgrading from 2.2.* and 3.0aplha modules

    1. Add "vfs_handle_struct *handle, " as first parameter to all vfs operation functions. e.g. example_connect(connection_struct *conn, const char *service, const char *user); -> example_connect(vfs_handle_struct *handle, connection_struct *conn, const char *service, const char *user); @@ -2422,7 +2422,7 @@ remember the struct smb_vfs_handle_struct.

    2. (Only for 3.0alpha* modules) Check if your vfs_done() function contains needed code. -

      If NOT you can remove the vfs_done() function.
      If YES decide if you can move the code to the example_disconnect() operation. Otherwise register a SMB_EXIT_EVENT with smb_register_exit_event(); (Described in the modules section) And then remove vfs_done(). e.g. the freeing of private data should go to example_disconnect(). +

      If NOT you can remove the vfs_done() function.
      If YES decide if you can move the code to the example_disconnect() operation. Otherwise register a SMB_EXIT_EVENT with smb_register_exit_event(); (Described in the ) And then remove vfs_done(). e.g. the freeing of private data should go to example_disconnect().

    3. Check if you have any global variables left. @@ -2561,7 +2561,7 @@ for your module.

    4. Compiling & Testing...

      ./configure --enable-developer ...
      make
      Try to fix all compiler warnings
      make
      Testing, Testing, Testing ...

      -

      5. Some Notes

      Implement TRANSPARENT functions

      +

      Some Notes

      Implement TRANSPARENT functions

      Avoid writing functions like this: 

      @@ -2572,7 +2572,7 @@ static int example_close(vfs_handle_struct *handle, files_struct *fsp, int fd)

      Overload only the functions you really need to! -

      Implement OPAQUE functions

      +

      Implement OPAQUE functions

      If you want to just implement a better version of a default samba opaque function (e.g. like a disk_free() function for a special filesystem) @@ -2592,12 +2592,12 @@ static int example_rename(vfs_handle_struct *handle, connection_struct *conn, errno = ENOSYS; return -1; } -

      Chapter 18. Notes to packagers

      Jelmer Vernooij

      Table of Contents

      Versioning
      Modules

      Versioning

      Please, please update the version number in +

      Chapter 18. Notes to packagers

      Jelmer Vernooij

      Table of Contents

      Versioning
      Modules

      Versioning

      Please, please update the version number in source/include/version.h to include the versioning of your package. This makes it easier to distinguish standard samba builds from custom-build samba builds (distributions often patch packages). For example, a good version would be: 

       Version 2.999+3.0.alpha21-5 for Debian
-

      Modules

      Samba now has support for building parts of samba as plugins. This +

      Modules

      Samba now has support for building parts of samba as plugins. This makes it possible to, for example, put ldap or mysql support in a seperate package, thus making it possible to have a normal samba package not depending on ldap or mysql. To build as much parts of samba @@ -2631,11 +2631,11 @@ as a plugin, run: 

       		with one that had issues.
      Make sure your patch complies to the samba coding style as suggested in the coding-suggestions chapter.

      Sending in bugfixes

      Bugfixes to bugs in samba should be submitted to samba's - bugzilla system, + bugzilla system, along with a description of the bug.

      Sending in feature patches

      Send feature patches along with a description of what the patch is supposed to do to the - Samba-technical mailinglist and possibly to a samba team member who is (one of the) 'owners' + Samba-technical mailinglist and possibly to a samba team member who is (one of the) 'owners' of the code you made modifications to. We are all busy people so everybody tends to 'let one of the others handle it'. If nobody responded to your patch for a week, try to send it again until you diff --git a/docs/htmldocs/Samba-HOWTO-Collection.html b/docs/htmldocs/Samba-HOWTO-Collection.html index 566f0b4068..99b80eccdc 100644 --- a/docs/htmldocs/Samba-HOWTO-Collection.html +++ b/docs/htmldocs/Samba-HOWTO-Collection.html @@ -21,11 +21,11 @@ This book is a collection of HOWTOs added to Samba documentation over the years. Samba is always under development, and so is its' documentation. This release of the documentation represents a major revision or layout as well as contents. The most recent version of this document can be found at -http://www.samba.org/ +http://www.samba.org/ on the "Documentation" page. Please send updates to -Jelmer Vernooij, -John H. Terpstra or -Gerald (Jerry) Carter. +Jelmer Vernooij, +John H. Terpstra or +Gerald (Jerry) Carter.

      The Samba-Team would like to express sincere thanks to the many people who have with or without their knowledge contributed to this update. The size and scope of this @@ -34,49 +34,16 @@ insignificant number of ideas for inclusion (if not content itself) has been obt from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. Please keep publishing your Unofficial HOWTOs - they are a source of inspiration and application knowledge that is most to be desired by many Samba users and administrators. -

    Table of Contents

    Legal Notice
    Attributions
    I. General Installation
    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from another SMB client
    What If Things Don't Work?
    Common Errors
    Large number of smbd processes
    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
    "The network name cannot be found"
    3. Fast Start for the Impatient
    Note
    II. Server Configuration Basics
    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password checking
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    '$' cannot be included in machine name
    Joining domain fails because of existing machine account
    The system can not log you on (C000019B)....
    The machine trust account not accessible
    Account disabled
    Domain Controller Unavailable
    Can not log onto domain member workstation after joining domain
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    III. Advanced Configuration
    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    I get an Unable to browse the network error
    11. Account Information Databases
    Features and Benefits
    Backwards Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon
    Users being added to wrong backend database
    auth methods does not work
    12. Mapping MS Windows and UNIX Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users group
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute mapping
    Common Errors
    Users can not write to a public share
    I have set force user but Samba still makes root the owner of all the files I touch!
    MS Word with Samba changes owner of file
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Problems saving files in MS Office on Windows XP
    Long delays deleting files over network with XP SP1
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-style Domain Trusts with Windows 2000
    Common Errors
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    A simple Configuration to Print
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various UNIX Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba 3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with -rpcclient
    Client Driver Install Procedure
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a -different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for -CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for -application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and -native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print -Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many -Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel -Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Caveats to be considered
    Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsmb completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the -Client
    Installing PostScript Driver Files manually (using -rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    In Case of Trouble.....
    Printing from CUPS to Windows attached -Printers
    More CUPS filtering Chains
    Common Errors
    Win9x client can't install driver
    "cupsaddsmb" keeps asking for root password in - neverending loop
    "cupsaddsmb" gives "No PPD file for printer..." - message while PPD file is present
    Client can't connect to Samba printer
    Can't reconnect to Samba under new account - from Win2K/XP
    Avoid being connected to the Samba server as the - "wrong" user
    Upgrading to CUPS drivers from Adobe drivers on - NT/2K/XP clients gives problems
    Can't use "cupsaddsmb" on Samba server which is - a PDC
    Deleted Win2K printer driver is still shown
    Win2K/XP "Local Security - Policies"
    WinXP clients: "Administrator can not install - printers for all local users"
    "Print Change Notify" functions on - NT-clients
    WinXP-SP1
    Print options for all users can't be set on Win2K/XP
    Most common blunders in driver - settings on Windows clients
    cupsaddsmb does not work - with newly installed printer
    Permissions on -/var/spool/samba/ get reset after each -reboot
    Printer named "lp" -intermittently swallows jobs and spits out completely different -ones
    Location of Adobe PostScript driver files necessary for "cupsaddsmb"
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    21. Winbind: Use of Domain Accounts
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Setting up roaming profiles for just a few user's or group's?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    Winbind is not resolving users and groups
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure UNIX/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging works only in one way
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    Common errors
    CP850.so can't be found
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    IV. Migration and Updating
    30. Upgrading from Samba-2.x to Samba-3.0.0
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (changes in behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    Charsets
    LDAP
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    V. Troubleshooting
    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    34. Analysing and solving samba problems
    Diagnostics tools
    Debugging with Samba itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches
    VI. Appendixes
    36. How to compile Samba
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    37. Portability
    HPUX
    SCO UNIX
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    Configuring OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba
    Configuring OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba
    Printer driver download for for OS/2 clients?
    Windows for Workgroups
    Latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configuring WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Index

    List of Figures

    5.1. An Example Domain
    10.1. Cross subnet browsing example
    11.1. IDMAP
    12.1. IDMAP groups
    13.1. Overview of unix permissions field
    16.1. Trusts overview
    19.1. Windows Printing to a local Printer
    19.2. Printing to a Postscript Printer
    19.3. Ghostscript as a RIP for non-postscript printers
    19.4. Prefiltering in CUPS to form Postscript
    19.5. Adding Device-specific Print Options
    19.6. Postscript to intermediate Raster format
    19.7. CUPS-raster production using Ghostscript
    19.8. Image format to CUPS-raster format conversion
    19.9. Raster to Printer Specific formats
    19.10. cupsomatic/foomatic processing versus Native CUPS
    19.11. PDF to socket chain
    19.12. PDF to USB chain
    19.13. Print Driver execution on the Client
    19.14. Print Driver execution on the Server
    19.15. Printing via CUPS/samba server
    19.16. cupsaddsmb flowchart
    19.17. Filtering chain 1
    19.18. Filtering chain with cupsomatic
    19.19. CUPS Printing Overview

    List of Tables

    7.1. Assumptions
    10.1. Browse subnet example 1
    10.2. Browse subnet example 2
    10.3. Browse subnet example 3
    10.4. Browse subnet example 4
    11.1. Attributes in the sambaSamAccount objectclass (LDAP)
    11.2. Basic smb.conf options for MySQL passdb backend
    11.3. MySQL field names for MySQL passdb backend
    13.1. Managing directories with unix and windows
    13.2. User and Group Based Controls
    13.3. File and Directory Permission Based Controls
    13.4. Other Controls
    19.1. PPD's shipped with CUPS
    20.1. Extended Auditing Log Information
    24.1. User Shell Folder registry keys default values
    24.2. Defaults of profile settings registry keys
    24.3. Defaults of default user profile paths registry keys
    25.1. Options recognized by pam_smbpass
    26.1. Unique NetBIOS names
    26.2. Group Names
    30.1. TDB File Descriptions
    31.1. The 3 Major Site Types
    31.2. Nature of the Conversion Choices

    List of Examples

    2.1. Simplest possible smb.conf file
    5.1. smb.conf for being a PDC
    5.2. smb.conf for being a PDC
    6.1. Minimal smb.conf for being a PDC
    6.2. Minimal setup for being a BDC
    8.1. smb.conf for Reference Documentation Server
    8.2. smb.conf for anonymous printing
    10.1. Domain master browser smb.conf
    10.2. Local master browser smb.conf
    10.3. smb.conf for not being a master browser
    10.4. Local master browser smb.conf
    10.5. smb.conf for not being a master browser
    11.1.
    11.2. Configuration with LDAP
    12.1. smbgrpadd.sh
    13.1. Example File
    14.1. Share with some files oplocked
    14.2.
    17.1. smb.conf with DFS configured
    18.1. Simple configuration with BSD printing
    18.2. Extended configuration with BSD printing
    18.3. [print\$] example
    19.1. Simplest printing-related smb.conf
    19.2. Overriding global CUPS settings for one printer
    19.3. smb.conf for cupsaddsmb usage
    20.1. smb.conf with VFS modules
    20.2. smb.conf with multiple VFS modules
    21.1. smb.conf for winbind set-up
    33.1. smb.conf with [tmp] share
    38.1. Minimal profile share

    Legal Notice

    +

    Table of Contents

    Legal Notice
    Attributions
    I. General Installation
    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and Installing Samba
    Configuring Samba (smb.conf)
    Configuration file syntax
    Example Configuration
    SWAT
    List Shares Available on the Server
    Connect with a UNIX Client
    Connect from a Remote SMB Client
    What If Things Don't Work?
    Common Errors
    Large Number of smbd Processes
    Error Message: open_oplock_ipc
    The network name cannot be found
    3. Fast Start for the Impatient
    Note
    II. Server Configuration Basics
    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password Checking
    Common Errors
    What Makes Samba a Server?
    What Makes Samba a Domain Controller?
    What Makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    $ Cannot Be Included in Machine Name
    Joining Domain Fails Because of Existing Machine Account
    The System Cannot Log You On (C000019B)
    The Machine Trust Account Is Not Accessible
    Account Disabled
    Domain Controller Unavailable
    Cannot Log onto Domain Member Workstation After Joining Domain
    6. Backup Domain Control
    Features and Benefits
    Essential Background Information
    MS Windows NT4-style Domain Control
    LDAP Configuration Notes
    Active Directory Domain Control
    What Qualifies a Domain Controller on the Network?
    How does a Workstation find its Domain Controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts Keep Expiring
    Can Samba Be a Backup Domain Controller to an NT4 PDC?
    How Do I Replicate the smbpasswd File?
    Can I Do This All with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Managing Domain Machine Accounts using NT4 Server Manager
    On-the-Fly Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4-type Domain with Samba-3
    Why Is This Better Than security = server?
    Samba ADS Domain Membership
    Configure smb.conf
    Configure /etc/krb5.conf
    Create the Computer Account
    Testing Server Setup
    Testing with smbclient
    Notes
    Sharing User ID Mappings between Samba Domain Members
    Common Errors
    Cannot Add Machine Back to Domain
    Adding Machine to Domain Fails
    I Can't Join a Windows 2003 PDC
    8. Stand-alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    III. Advanced Configuration
    10. Network Browsing
    Features and Benefits
    What Is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Configuring WORKGROUP Browsing
    DOMAIN Browsing Configuration
    Forcing Samba to Be the Master
    Making Samba the Domain Master
    Note about Broadcast Addresses
    Multiple Interfaces
    Use of the Remote Announce Parameter
    Use of the Remote Browse Sync Parameter
    WINS The Windows Internetworking Name Server
    WINS Server Configuration
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of Browsing
    Browsing Support in Samba
    Problem Resolution
    Cross-Subnet Browsing
    Common Errors
    How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?
    Server Resources Can Not Be Listed
    I get an `Unable to browse the network' error
    Browsing of Shares and Directories is Very Slow
    11. Account Information Databases
    Features and Benefits
    Backward Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plaintext
    smbpasswd Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users Cannot Logon
    Users Being Added to the Wrong Backend Database
    Configuration of auth methods
    12. Group Mapping MS Windows and UNIX
    Features and Benefits
    Discussion
    Default Users, Groups and Relative Identifiers
    Example Configuration
    Configuration Scripts
    Sample smb.conf Add Group Script
    Script to Configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users Group
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group-Based Controls
    File and Directory Permissions-Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX Permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing File Ownership
    Viewing File or Directory Permissions
    Modifying File or Directory Permissions
    Interaction with the Standard Samba create mask Parameters
    Interaction with the Standard Samba File Attribute Mapping
    Common Errors
    Users Cannot Write to a Public Share
    File Operations Done as root with force user Set
    MS Word with Samba Changes Owner of File
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb Error Messages
    Problems Saving Files in MS Office on Windows XP
    Long Delays Deleting Files Over Network with XP SP1
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using Host-Based Protection
    User-Based Protection
    Using Interface Protection
    Using a Firewall
    Using IPC$ Share-Based Denials
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient Works on Localhost, but the Network Is Dead
    Why Can Users Access Home Directories of Other Users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-Style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-Style Domain Trusts with Windows 2000
    Common Errors
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    MSDFS UNIX Path Is Case-Critical
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    Client to Samba Print Job Processing
    Printing Related Configuration Parameters
    Simple Print Configuration
    Verifing Configuration with testparm
    Rapid Configuration Validation
    Extended Printing Configuration
    Detailed Explanation Settings
    Printing Developments Since Samba-2.2
    Point'n'Print Client Drivers on Samba Servers
    The Obsoleted [printer$] Section
    Creating the [print$] Share
    [print$] Section Parameters
    The [print$] Share Directory
    Installing Drivers into [print$]
    Add Printer Wizard Driver Installation
    Installing Print Drivers Using rpcclient
    Client Driver Installation Procedure
    First Client Driver Installation
    Setting Device Modes on New Printers
    Additional Client Driver Installation
    Always Make First Client Connection as root or printer admin
    Other Gotchas
    Setting Default Print Options for Client Drivers
    Supporting Large Numbers of Printers
    Adding New Printers with the Windows NT APW
    Error Message: Cannot connect under a different Name
    Take Care When Assembling Driver Files
    Samba and Printer Ports
    Avoiding Common Client Driver Misconfiguration
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Adding Network Printers without User Interaction
    The addprinter Command
    Migration of Classical Printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I Give My Root Password but I Do Not Get Access
    My Print Jobs Get Spooled into the Spooling Directory, but Then Get Lost
    19. CUPS Printing Support
    Introduction
    Features and Benefits
    Overview
    Basic CUPS Support Configuration
    Linking smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More Complex CUPS smb.conf Settings
    Advanced Configuration
    Central Spooling vs. Peer-to-Peer Printing
    Raw Print Serving Vendor Drivers on Windows Clients
    Installation of Windows Client Drivers
    Explicitly Enable raw Printing for application/octet-stream
    Driver Upload Methods
    Advanced Intelligent Printing with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript the Software RIP for Non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    Using Windows-Formatted Vendor PPDs
    CUPS Also Uses PPDs for Non-PostScript Printers
    The CUPS Filtering Architecture
    MIME Types and CUPS Filters
    MIME Type Conversion Rules
    Filtering Overview
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    The Role of cupsomatic/foomatic
    The Complete Picture
    mime.convs
    Raw Printing
    application/octet-stream Printing
    PostScript Printer Descriptions (PPDs) for Non-PS Printers
    cupsomatic/foomatic-rip Versus native CUPS Printing
    Examples for Filtering Chains
    Sources of CUPS Drivers/PPDs
    Printing with Interface Scripts
    Network Printing (Purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows Clients UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba Receiving Jobfiles and Passing Them to CUPS
    Network PostScript RIP
    PPDs for Non-PS Printers on UNIX
    PPDs for Non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers Running in Kernel Mode Cause Many +Problems
    Workarounds Impose Heavy Limitations
    CUPS: A Magical Stone?
    PostScript Drivers with No Major Problems Even in Kernel +Mode
    Configuring CUPS for Driver Download
    cupsaddsmb: The Unknown Utility
    Prepare Your smb.conf for cupsaddsmb
    CUPS PostScript Driver for Windows NT/200x/XP
    Recognizing Different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro PostScript Driver for Windows NT/200x/XP
    Caveats to be Considered
    Windows CUPS PostScript Driver Versus Adobe Driver
    Run cupsaddsmb (Quiet Mode)
    Run cupsaddsmb with Verbose Output
    Understanding cupsaddsmb
    How to Recognize If cupsaddsmb Completed Successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding Critical PostScript Driver Settings on the Client
    Installing PostScript Driver Files Manually Using rpcclient
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by Querying a Windows Box
    Requirements for adddriver and setdriver to Succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting Revisited
    The Printing *.tdb Files
    Trivial Database Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic Explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting Up Quotas
    Correct and Incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings Explained
    Pre-Conditions
    Manual Configuration
    Printing from CUPS to Windows Attached Printers
    More CUPS-Filtering Chains
    Common Errors
    Windows 9x/ME Client Can't Install Driver
    cupsaddsmb Keeps Asking for Root Password in Never-ending Loop
    cupsaddsmb Errors
    Client Can't Connect to Samba Printer
    New Account Reconnection from Windows 200x/XP Troubles
    Avoid Being Connected to the Samba Server as the Wrong User
    Upgrading to CUPS Drivers from Adobe Drivers
    Can't Use cupsaddsmb on Samba Server Which Is a PDC
    Deleted Windows 200x Printer Driver Is Still Shown
    Windows 200x/XP "Local Security Policies"
    Administrator Cannot Install Printers for All Local Users
    Print Change Notify Functions on NT-clients
    WinXP-SP1
    Print Options for All Users Can't Be Set on Windows 200x/XP
    Most Common Blunders in Driver Settings on Windows Clients
    cupsaddsmb Does Not Work with Newly Installed Printer
    Permissions on /var/spool/samba/ Get Reset After Each Reboot
    Print Queue Called lp Mis-handles Print Jobs
    Location of Adobe PostScript Driver Files for cupsaddsmb
    Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included Modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS Modules Available Elsewhere
    DatabaseFS
    vscan
    21. Winbind: Use of Domain Accounts
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    Winbind Is Not Resolving Users and Groups
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachine.Com
    Network Logon Script Magic
    Adding Printers without User Intervention
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/ME Policies
    Windows NT4-Style Policy Files
    MS Windows 200x/XP Professional Policies
    Managing Account/User Policies
    Management Tools
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP Workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory Profiles
    Creating and Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Configuring Roaming Profiles for a Few Users or Groups
    Cannot Use Roaming Profiles
    Changing the Default Profile
    25. PAM-Based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication Using winbindd.so
    Password Synchronization Using pam_smbpass.so
    Common Errors
    pam_winbind Problem
    Winbind Is Not Resolving Users and Groups
    26. Integrating MS Windows Networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a Pure UNIX/Linux World
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name Resolution as Used within MS Windows Networking
    The NetBIOS Name Cache
    The LMHOSTS File
    HOSTS File
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging Works Only in One Way
    Very Slow Network Connections
    Samba Server Name Change Problem
    27. Unicode/Charsets
    Features and Benefits
    What Are Charsets and Unicode?
    Samba and Charsets
    Conversion from Old Names
    Japanese Charsets
    Common Errors
    CP850.so Can't Be Found
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    IV. Migration and Updating
    30. Upgrading from Samba-2.x to Samba-3.0.0
    Quick Migration Guide
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (Changes in Behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    LDAP
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps in Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices
    32. SWAT The Samba Web Administration Tool
    Features and Benefits
    Guidelines and Technical Tips
    Validate SWAT Installation
    Enabling SWAT for Use
    Securing SWAT through SSL
    Enabling SWAT Internationalization Support
    Overview and Quick Tour
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    V. Troubleshooting
    33. The Samba Checklist
    Introduction
    Assumptions
    The Tests
    34. Analyzing and Solving Samba Problems
    Diagnostics Tools
    Debugging with Samba Itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting Mailing List Help
    How to Get Off the Mailing Lists
    35. Reporting Bugs
    Introduction
    General Information
    Debug Levels
    Internal Errors
    Attaching to a Running Process
    Patches
    VI. Appendixes
    36. How to Compile Samba
    Access Samba Source Code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the Samba Sources via rsync and ftp
    Verifying Samba's PGP Signature
    Building the Binaries
    Compiling Samba with Active Directory Support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: Starting smbd as a Daemon
    37. Portability
    HPUX
    SCO UNIX
    DNIX
    Red Hat Linux
    AIX
    Sequential Read Ahead
    Solaris
    Locking Improvements
    Winbind on Solaris 9
    38. Samba and Other CIFS Clients
    Macintosh Clients
    OS2 Client
    Configuring OS/2 Warp Connect or OS/2 Warp 4
    Configuring Other Versions of OS/2
    Printer Driver Download for OS/2 Clients
    Windows for Workgroups
    Latest TCP/IP Stack from Microsoft
    Delete .pwl Files After Password Change
    Configuring Windows for Workgroups Password Handling
    Password Case Sensitivity
    Use TCP/IP as Default Protocol
    Speed Improvement
    Windows 95/98
    Speed Improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket Options
    Read Size
    Max Xmit
    Log Level
    Read Raw
    Write Raw
    Slow Logins
    Client Tuning
    Samba Performance Problem Due to Changing Linux Kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Index

    List of Figures

    5.1. An Example Domain.
    10.1. Cross-Subnet Browsing Example.
    11.1. IDMAP: Resolution of SIDs to UIDs.
    11.2. IDMAP: Resolution of UIDs to SIDs.
    12.1. IDMAP: group SID to GID resolution.
    12.2. IDMAP: GID resolution to matching SID.
    12.3. IDMAP storing group mappings.
    13.1. Overview of UNIX permissions field.
    16.1. Trusts overview.
    19.1. Windows printing to a local printer.
    19.2. Printing to a PostScript printer.
    19.3. Ghostscript as a RIP for non-postscript printers.
    19.4. Pre-filtering in CUPS to form PostScript.
    19.5. Adding device-specific print options.
    19.6. PostScript to intermediate raster format.
    19.7. CUPS-raster production using Ghostscript.
    19.8. Image format to CUPS-raster format conversion.
    19.9. Raster to printer-specific formats.
    19.10. cupsomatic/foomatic Processing versus Native CUPS.
    19.11. PDF to socket chain.
    19.12. PDF to USB chain.
    19.13. Print driver execution on the client.
    19.14. Print driver execution on the server.
    19.15. Printing via CUPS/Samba server.
    19.16. cupsaddsmb flowchart.
    19.17. Filtering chain 1.
    19.18. Filtering chain with cupsomatic
    19.19. CUPS printing overview.
    34.1. Starting a capture.
    34.2. Main ethereal data window.

    List of Tables

    6.1. Domain Backend Account Distribution Options
    7.1. Assumptions
    10.1. Browse Subnet Example 1
    10.2. Browse Subnet Example 2
    10.3. Browse Subnet Example 3
    10.4. Browse Subnet Example 4
    11.1. Attributes in the sambaSamAccount objectclass (LDAP) Part A
    11.2. Attributes in the sambaSamAccount objectclass (LDAP) Part B
    11.3. Possible ldap passwd sync values
    11.4. Basic smb.conf options for MySQL passdb backend
    11.5. MySQL field names for MySQL passdb backend
    12.1. Well-Known User Default RIDs
    13.1. Managing Directories with UNIX and Windows
    13.2. User and Group Based Controls
    13.3. File and Directory Permission Based Controls
    13.4. Other Controls
    18.1. Default Printing Settings
    19.1. PPDs shipped with CUPS
    20.1. Extended Auditing Log Information
    24.1. User Shell Folder Registry Keys Default Values
    24.2. Defaults of Profile Settings Registry Keys
    24.3. Defaults of Default User Profile Paths Registry Keys
    25.1. Options recognized by pam_smbpass
    26.1. Unique NetBIOS Names
    26.2. Group Names
    30.1. TDB File Descriptions
    31.1. The Three Major Site Types
    31.2. Nature of the Conversion Choices

    List of Examples

    2.1. A minimal smb.conf
    2.2. Another simple smb.conf File
    5.1. smb.conf for being a PDC
    5.2. smb.conf for being a PDC
    6.1. Minimal smb.conf for a PDC in Use With a BDC LDAP Server on PDC.
    6.2. Multiple LDAP Servers in smb.conf
    6.3. Minimal setup for being a BDC
    8.1. smb.conf for Reference Documentation Server
    8.2. smb.conf for Anonymous Printing
    10.1. Domain Master Browser smb.conf
    10.2. Local master browser smb.conf
    10.3. smb.conf for not being a Master Browser
    10.4. Local Master Browser smb.conf
    10.5. smb.conf for not being a master browser
    11.1. Example configuration with the LDAP idmap backend
    11.2. Configuration with LDAP
    11.3. Example configuration for the MySQL passdb backend
    12.1. smbgrpadd.sh
    12.2. Configuration of smb.conf for the add group script.
    12.3. Script to Set Group Mapping
    13.1. Example File
    14.1. Share with some files oplocked
    14.2. Configuration with oplock break contention limit
    17.1. smb.conf with DFS configured
    18.1. Simple configuration with BSD printing
    18.2. Extended BSD Printing Configuration
    18.3. [print\$] example
    19.1. Simplest printing-related smb.conf
    19.2. Overriding global CUPS settings for one printer
    19.3. smb.conf for cupsaddsmb usage
    20.1. smb.conf with VFS modules
    20.2. smb.conf with multiple VFS modules
    21.1. smb.conf for Winbind set-up
    33.1. smb.conf with [tmp] share
    33.2. Configuration for only allowing connections from a certain subnet
    33.3. Configuration for allowing connections from a certain subnet and localhost
    38.1. Minimal profile share

    Legal Notice

    This documentation is distributed under the GNU General Public License (GPL) version 2. A copy of the license is included with the Samba source -distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt -

    Attributions

    Introduction to Samba

    How to Install and Test SAMBA

    Fast Start for the Impatient

    Server Types and Security Modes

    Domain Control

    Backup Domain Control

    Domain Membership

    Stand-Alone Servers

    MS Windows Network Configuration Guide

    Samba / MS Windows Network Browsing Guide

    Account Information Databases

    Mapping MS Windows and UNIX Groups

    File, Directory and Share Access Controls

    File and Record Locking

    Securing Samba

    Interdomain Trust Relationships

    Hosting a Microsoft Distributed File System tree on Samba

    Classical Printing Support

    CUPS Printing Support in Samba 3.0

    Stackable VFS modules

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Tim Potter

    • Simo Sorce (original vfs_skel README)

    • Alexander Bokovoy (original vfs_netatalk docs)

    • Stefan Metzmacher (Update for multiple modules)

    Advanced Network Management

    System and Account Policies

    Desktop Profile Management

    PAM based Distributed Authentication

    Integrating MS Windows networks with Samba

    Unicode/Charsets

    Samba Backup Techniques

    High Availability Options

    Upgrading from Samba-2.x to Samba-3.0.0

    Migration from NT4 PDC to Samba-3 PDC

    SWAT - The Samba Web Administration Tool

    The Samba checklist

    Analysing and solving samba problems

    Reporting Bugs

    How to compile Samba

    Portability

    Samba and other CIFS clients

    Samba Performance Tuning

    DNS and DHCP Configuration Guide

    Further Resources

    General Installation

    Preparing Samba for Configuration

    This section of the Samba-HOWTO-Collection contains general info on how to install samba +distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt +

    Attributions

    • David Lechnyr <david@lechnyr.com>

    • Andrew Tridgell <tridge@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Karl Auer <kauer@biplane.com.au>

    • Dan Shearer <dan@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Andrew Tridgell <tridge@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Gerald (Jerry) Carter <jerry@samba.org>

    • David Bannon <dbannon@samba.org>

    • Guenther Deschner <gd@suse.de> (LDAP updates)

    • John H. Terpstra <jht@samba.org>

    • Volker Lendecke <Volker.Lendecke@SerNet.DE>

    • Guenther Deschner <gd@suse.de> (LDAP updates)

    • John H. Terpstra <jht@samba.org>

    • Jeremy Allison <jra@samba.org>

    • Gerald (Jerry) Carter <jerry@samba.org>

    • Andrew Tridgell <tridge@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • Guenther Deschner <gd@suse.de> (LDAP updates)

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Gerald (Jerry) Carter <jerry@samba.org>

    • Jeremy Allison <jra@samba.org>

    • Guenther Deschner <gd@suse.de> (LDAP updates)

    • Olivier (lem) Lemaire <olem@IDEALX.org>

    • John H. Terpstra <jht@samba.org>

    • Jean François Micouleau

    • Gerald (Jerry) Carter <jerry@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Jeremy Allison <jra@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org> (drawing)

    • Jeremy Allison <jra@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Eric Roseme <eric.roseme@hp.com>

    • Andrew Tridgell <tridge@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Rafal Szczesniak <mimir@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org> (drawing)

    • Stephen Langasek <vorlon@netexpress.net>

    • Shirish Kalele <samba@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Kurt Pfeifle <kpfeifle@danka.de>

    • Gerald (Jerry) Carter <jerry@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Kurt Pfeifle <kpfeifle@danka.de>

    • Ciprian Vizitiu <CVizitiu@gbif.org> (drawings)

    • Jelmer R. Vernooij <jelmer@samba.org> (drawings)

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Tim Potter <tpot@samba.org>

    • Simo Sorce (original vfs_skel README)

    • Alexander Bokovoy (original vfs_netatalk docs)

    • Stefan Metzmacher (Update for multiple modules)

    • Tim Potter <tpot@linuxcare.com.au>

    • Andrew Tridgell <tridge@samba.org>

    • Naag Mummaneni <getnag@rediffmail.com> (Notes for Solaris)

    • John Trostel <jtrostel@snapserver.com>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Stephen Langasek <vorlon@netexpress.net>

    • John H. Terpstra <jht@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • TAKAHASHI Motonobu <monyo@home.monyo.com>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Gerald (Jerry) Carter <jerry@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Andrew Tridgell <tridge@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • Dan Shearer <dan@samba.org>

    • Gerald (Jerry) Carter <jerry@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • David Bannon <dbannon@samba.org>

    • Dan Shearer <dan@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • Andrew Tridgell <tridge@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Andrew Tridgell <tridge@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Dan Shearer <dan@samba.org>

    • Jim McDonough <jmcd@us.ibm.com> (OS/2)

    • Paul Cochrane <paulc@dth.scot.nhs.uk>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    General Installation

    Preparing Samba for Configuration

    This section of the Samba-HOWTO-Collection contains general info on how to install samba and how to configure the parts of samba you will most likely need. -PLEASE read this.

    Table of Contents

    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from another SMB client
    What If Things Don't Work?
    Common Errors
    Large number of smbd processes
    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
    "The network name cannot be found"
    3. Fast Start for the Impatient
    Note

    Chapter 1. Introduction to Samba

    David Lechnyr

    Unofficial HOWTO

    April 14, 2003

    Table of Contents

    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous

    “ +PLEASE read this.

    Table of Contents

    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and Installing Samba
    Configuring Samba (smb.conf)
    Configuration file syntax
    Example Configuration
    SWAT
    List Shares Available on the Server
    Connect with a UNIX Client
    Connect from a Remote SMB Client
    What If Things Don't Work?
    Common Errors
    Large Number of smbd Processes
    Error Message: open_oplock_ipc
    The network name cannot be found
    3. Fast Start for the Impatient
    Note

    Chapter 1. Introduction to Samba

    David Lechnyr

    Unofficial HOWTO

    April 14, 2003

    Table of Contents

    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous

    “ "If you understand what you're doing, you're not learning anything." -- Anonymous ”

    @@ -85,7 +52,7 @@ transport protocol. In fact, it can support any SMB/CIFS-enabled client. One of strengths is that you can use it to blend your mix of Windows and Linux machines together without requiring a separate Windows NT/2000/2003 Server. Samba is actively being developed by a global team of about 30 active programmers and was originally developed by Andrew Tridgell. -

    Background

    +

    Background

    Once long ago, there was a buzzword referred to as DCE/RPC. This stood for Distributed Computing Environment/Remote Procedure Calls and conceptually was a good idea. It was originally developed by Apollo/HP as NCA 1.0 (Network Computing Architecture) and only @@ -111,7 +78,7 @@ been dutifully waded through during the information-gathering stages of this pro are *still* many missing pieces... While often tedious, at least the way has been generously littered with occurrences of clapping hand to forehead and muttering 'crikey, what are they thinking? -

    Terminology

    • +

    Terminology

    • SMB: Acronym for "Server Message Block". This is Microsoft's file and printer sharing protocol.

    • CIFS: Acronym for "Common Internet File System". Around 1996, Microsoft apparently @@ -160,8 +127,8 @@ thinking?

    • W3K: Acronym for Windows 2003 Server

    If you plan on getting help, make sure to subscribe to the Samba Mailing List (available at -http://www.samba.org). -

    Related Projects

    +http://www.samba.org). +

    Related Projects

    There are currently two network filesystem client projects for Linux that are directly related to Samba: SMBFS and CIFS VFS. These are both available in the Linux kernel itself.

    • @@ -181,9 +148,9 @@ Again, it's important to note that these are implementations for client filesyst nothing to do with acting as a file and print server for SMB/CIFS clients.

      There are other Open Source CIFS client implementations, such as the -jCIFS project +jCIFS project which provides an SMB client toolkit written in Java. -

    SMB Methodology

    +

    SMB Methodology

    Traditionally, SMB uses UDP port 137 (NetBIOS name service, or netbios-ns), UDP port 138 (NetBIOS datagram service, or netbios-dgm), and TCP port 139 (NetBIOS session service, or netbios-ssn). Anyone looking at their network with a good @@ -213,9 +180,9 @@ up a single file. In general, SMB sessions are established in the following orde to a service type (e.g., IPC$ named pipe)

    A good way to examine this process in depth is to try out -SecurityFriday's SWB program. +SecurityFriday's SWB program. It allows you to walk through the establishment of a SMB/CIFS session step by step. -

    Epilogue

    “ +

    Epilogue

    “ What's fundamentally wrong is that nobody ever had any taste when they did it. Microsoft has been very much into making the user interface look good, but internally it's just a complete mess. And even people who program for Microsoft @@ -243,222 +210,238 @@ not the completely clueless user who probably sits there shivering thinking ”

    “ That's what's really irritating to me." ”

    -- -Linus Torvalds, from an interview with BOOT Magazine, Sept 1998 -

    Miscellaneous

    +Linus Torvalds, from an interview with BOOT Magazine, Sept 1998 +

    Miscellaneous

    This chapter is Copyright 2003 David Lechnyr (david at lechnyr dot com). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation. A copy of the license is available at http://www.gnu.org/licenses/fdl.txt. -

    Chapter 2. How to Install and Test SAMBA

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Karl Auer

    Table of Contents

    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from another SMB client
    What If Things Don't Work?
    Common Errors
    Large number of smbd processes
    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
    "The network name cannot be found"

    Obtaining and installing samba

    - Binary packages of samba are included in almost any Linux or +

    Chapter 2. How to Install and Test SAMBA

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Karl Auer

    Samba Team

    Dan Shearer

    Samba Team

    Table of Contents

    Obtaining and Installing Samba
    Configuring Samba (smb.conf)
    Configuration file syntax
    Example Configuration
    SWAT
    List Shares Available on the Server
    Connect with a UNIX Client
    Connect from a Remote SMB Client
    What If Things Don't Work?
    Common Errors
    Large Number of smbd Processes
    Error Message: open_oplock_ipc
    The network name cannot be found

    Obtaining and Installing Samba

    + Binary packages of Samba are included in almost any Linux or UNIX distribution. There are also some packages available at - the samba homepage. -

    If you need to compile samba from source, check - the chapter about compiling samba from scratch.

    If you have already installed samba, or if your operating system - was pre-installed with samba, then you may not need to bother with this - chapter. On the other hand, you may want to read this chapter anyhow - for information about updating samba.

    Configuring samba (smb.conf)

    - Samba's configuration is stored in the smb.conf file, - that usually resides in /etc/samba/smb.conf + the Samba homepage. Refer to + the manual of your operating system for details on installing packages + for your specific operating system. +

    If you need to compile Samba from source, check + .

    Configuring Samba (smb.conf)

    + Samba's configuration is stored in the smb.conf file, which + usually resides in /etc/samba/smb.conf or /usr/local/samba/lib/smb.conf. You can either edit this file yourself or do it using one of the many graphical - tools that are available, such as the web-based interface swat, that - is included with samba. -

    Example Configuration

    + tools that are available, such as the Web-based interface SWAT, that + is included with Samba. +

    Configuration file syntax

    The smb.conf file uses the same syntax as the various old + .ini files in Windows 3.1: Each file consists of various sections, + which are started by putting the section name between brackets ([]) + on a new line. Each contains zero or more key/value-pairs seperated by an + equality sign (=). The file is just a plain-text file, so you can + open and edit it with your favorite editing tool.

    Each section in the smb.conf file represents a share + on the Samba server. The section “global” is special, since it + contains settings that apply to the whole Samba server and not + to one share in particular.

    contains a very minimal smb.conf. + +

    Example 2.1. A minimal smb.conf

    [global]
    workgroup = WKG
    netbios name = MYNAME
    [share1]
    path = /tmp
    [share2]
    path = /my_shared_folder
    comment = Some random files

    Example Configuration

    There are sample configuration files in the examples subdirectory in the - distribution. I suggest you read them carefully so you can see how the options - go together in practice. See the man page for all the options. + distribution. It is suggested you read them carefully so you can see how the options + go together in practice. See the man page for all the options. + It might be worthwhile to start out with the smb.conf.default + configuration file and adapt it to your needs. It contains plenty of + comments.

    - The simplest useful configuration file would be something like this: + The simplest useful configuration file would contain something like shown in + .

    -

    Example 2.1. Simplest possible smb.conf file

    [global]
    workgroup = MIDEARTH
    [homes]
    guest ok = no
    read only = no

    + +

    Example 2.2. Another simple smb.conf File

    [global]
    workgroup = MIDEARTH
    [homes]
    guest ok = no
    read only = no

    This will allow connections by anyone with an account on the server, using either - their login name or homes" as the service name. - (Note that the workgroup that Samba must also be set.) + their login name or homes as the service name. + (Note: The workgroup that Samba should appear in must also be set. The default + workgroup name is WORKGROUP.)

    - Make sure you put the smb.conf file in the correct place - (usually in /etc/samba). + Make sure you put the smb.conf file in the correct place.

    For more information about security settings for the [homes] share please refer to - "Securing Samba". -

    Test your config file with testparm

    - It's important that you test the validity of your smb.conf - file using the testparm program. If testparm runs OK - then it will list the loaded services. If not it will give an error message. -

    - Make sure it runs OK and that the services look reasonable before proceeding. -

    - Always run testparm again when you change smb.conf! -

    SWAT

    - SWAT is a web-based interface that helps you configure samba. - SWAT might not be available in the samba package on your platform, - but in a separate package. Please read the swat manpage - on compiling, installing and configuring swat from source. -

    - To launch SWAT just run your favorite web browser and - point it at http://localhost:901/. Replace - localhost - with the name of the computer you are running samba on if you - are running samba on a different computer than your browser. -

    - Note that you can attach to SWAT from any IP connected - machine but connecting from a remote machine leaves your - connection open to password sniffing as passwords will be sent - in the clear over the wire. -

    Try listing the shares available on your - server

    +	.
+	
    Test Your Config File with testparm
    
+	It's important to validate the contents of the smb.conf file using the testparm program.
+	If testparm runs correctly, it will list the loaded services. If not, it will give an error message.
+	Make sure it runs correctly and that the services look reasonable before proceeding. Enter the command: 
+	
    +	root#  testparm /etc/samba/smb.conf
+	
    Testparm will parse your configuration file and report 
+	any unknown parameters or incorrect syntax. 
    
+	Always run testparm again whenever the smb.conf file is changed!
+

    SWAT

    + + SWAT is a Web-based interface that can be used to facilitate the configuration of Samba. + SWAT might not be available in the Samba package that shipped with your platform, + but in a separate package. Please read the SWAT manpage + on compiling, installing and configuring SWAT from source. +

    + To launch SWAT, just run your favorite Web browser and point it to + http://localhost:901/. + Replace localhost with the name of the computer on which + Samba is running if that is a different computer than your browser. +

    + SWAT can be used from a browser on any IP-connected machine, but be aware that connecting from a remote + machine leaves your connection open to password sniffing as passwords will be sent over the wire in the clear. +

    More information about SWAT can be found in .

    List Shares Available on the Server

    + To list shares that are available from the configured Samba server execute the + following command: + 

     $ smbclient -L yourhostname
-

    You should get back a list of shares available on - your server. If you don't then something is incorrectly setup. - Note that this method can also be used to see what shares - are available on other LanManager clients (such as WfWg).

    If you choose user level security then you may find - that Samba requests a password before it will list the shares. - See the smbclient man page for details. (you - can force it to list the shares without a password by - adding the option -U% to the command line. This will not work - with non-Samba servers)

    Try connecting with the unix client

    +

    You should see a list of shares available on your server. If you do not, then + something is incorrectly configured. This method can also be used to see what shares + are available on other SMB servers, such as Windows 2000.

    If you choose user-level security you may find that Samba requests a password + before it will list the shares. See the smbclient man page for details. + You can force it to list the shares without a password by adding the option + -N to the command line.

    Connect with a UNIX Client

    + Enter the following command: 

     $ smbclient  //yourhostname/aservice
-

    Typically the yourhostname - would be the name of the host where you installed smbd. - The aservice is - any service you have defined in the smb.conf - file. Try your user name if you just have a [homes] - section - in smb.conf.

    For example if your unix host is bambi - and your login name is fred you would type:

    +

    Typically yourhostname is the name of the host on which smbd + has been installed. The aservice is any service that has been defined in the smb.conf + file. Try your user name if you just have a [homes] section in the smb.conf file.

    Example: If the UNIX host is called bambi and a valid login name + is fred, you would type:

     $ smbclient //bambi/fred
-

    Try connecting from another SMB client

    Try mounting disks. from a DOS, Windows or OS/2 client, eg:

    +

    Connect from a Remote SMB Client

    Now that Samba is working correctly locally, you can try to + access it from other clients. Within a few minutes, the Samba host + should be listed in the Network Neighborhood on all Windows + clients of its subnet. Try browsing the server from another client + or 'mounting' it.

    Mounting disks from a DOS, Windows or OS/2 client can be done by running a command such as:

     C:\> net use d: \\servername\service
-

    Try printing. eg:

    +

    Try printing, e.g.

     C:\> net use lpt1:	\\servername\spoolservice
 

    C:\> print filename
-

    What If Things Don't Work?

    Then you might read the file chapter diagnosis - and the FAQ. If you are still stuck then refer to "Analysing and solving problems". - Samba has been successfully installed at thousands of sites worldwide, - so maybe someone else has hit your problem and has overcome it.

    Common Errors

    -The following questions and issues get raised on the samba mailing list over and over again. -

    Large number of smbd processes

    -Samba consists on three core programs: -nmbd, smbd, winbindd. nmbd is the name server message daemon, -smbd is the server message daemon, winbindd is the daemon that -handles communication with Domain Controllers. -

    -If your system is NOT running as a WINS server, then there will be one (1) single instance of +

    What If Things Don't Work?

    You might want to read . + If you are still stuck, refer to . + Samba has been successfully installed at thousands of sites worldwide. + It is unlikely that your particular problem is unique, so it might be + productive to perform an Internet search to see if someone else has encountered + your problem and has found a way to overcome it.

    Common Errors

    +The following questions and issues are raised repeatedly on the Samba mailing list. +

    Large Number of smbd Processes

    +Samba consists of three core programs: nmbd, smbd, and winbindd. nmbd is the name server message daemon, +smbd is the server message daemon, and winbindd is the daemon that handles communication with Domain Controllers. +

    +If Samba is not running as a WINS server, then there will be one single instance of nmbd running on your system. If it is running as a WINS server then there will be -two (2) instances - one to handle the WINS requests. +two instances one to handle the WINS requests.

    -smbd handles ALL connection requests and then spawns a new process for each client -connection made. That is why you are seeing so many of them, one (1) per client connection. +smbd handles all connection requests. It spawns a new process for each client +connection made. That is why you may see so many of them, one per client connection.

    winbindd will run as one or two daemons, depending on whether or not it is being -run in "split mode" (in which case there will be two instances). -

    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"

    Your loopback device isn't working correctly. Make sure it's configured properly. The loopback device is an internal (virtual) network device with - the ip address 127.0.0.1. Read your OS documentation for details - on how to configure the loopback on your system.

    "The network name cannot be found"

    - This error can be caused by one of these misconfigurations: -

    • You specified an nonexisting path for the share in smb.conf

    • The user you are trying to access the share with does not - have sufficient permissions to access the path for the share. Both read (r) and access (x) should be possible.

    • The share you are trying to access does not exist.

    Chapter 3. Fast Start for the Impatient

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +run in split mode (in which case there will be two instances). +

    Error Message: open_oplock_ipc

    An error message is observed in the log files when smbd is started: “open_oplock_ipc: Failed to get local UDP socket + for address 100007f. Error was Cannot assign requested.”

    Your loopback device isn't working correctly. Make sure it is configured correctly. The loopback + device is an internal (virtual) network device with the IP address 127.0.0.1. + Read your OS documentation for details on how to configure the loopback on your system.

    “The network name cannot be found”

    + This error can be caused by one of these misconfigurations: +

    • You specified an nonexisting path + for the share in smb.conf.

    • The user you are trying to access the share with does not + have sufficient permissions to access the path for + the share. Both read (r) and access (x) should be possible.

    • The share you are trying to access does not exist.

    Chapter 3. Fast Start for the Impatient

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Server Configuration Basics

    First Steps in Server Configuration

    +

    Server Configuration Basics

    First Steps in Server Configuration

    Samba can operate in various modes within SMB networks. This HOWTO section contains information on configuring samba to function as the type of server your network requires. Please read this section carefully. -

    Table of Contents

    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password checking
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    '$' cannot be included in machine name
    Joining domain fails because of existing machine account
    The system can not log you on (C000019B)....
    The machine trust account not accessible
    Account disabled
    Domain Controller Unavailable
    Can not log onto domain member workstation after joining domain
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note

    Chapter 4. Server Types and Security Modes

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password checking
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server

    +

    Table of Contents

    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password Checking
    Common Errors
    What Makes Samba a Server?
    What Makes Samba a Domain Controller?
    What Makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    $ Cannot Be Included in Machine Name
    Joining Domain Fails Because of Existing Machine Account
    The System Cannot Log You On (C000019B)
    The Machine Trust Account Is Not Accessible
    Account Disabled
    Domain Controller Unavailable
    Cannot Log onto Domain Member Workstation After Joining Domain
    6. Backup Domain Control
    Features and Benefits
    Essential Background Information
    MS Windows NT4-style Domain Control
    LDAP Configuration Notes
    Active Directory Domain Control
    What Qualifies a Domain Controller on the Network?
    How does a Workstation find its Domain Controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts Keep Expiring
    Can Samba Be a Backup Domain Controller to an NT4 PDC?
    How Do I Replicate the smbpasswd File?
    Can I Do This All with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Managing Domain Machine Accounts using NT4 Server Manager
    On-the-Fly Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4-type Domain with Samba-3
    Why Is This Better Than security = server?
    Samba ADS Domain Membership
    Configure smb.conf
    Configure /etc/krb5.conf
    Create the Computer Account
    Testing Server Setup
    Testing with smbclient
    Notes
    Sharing User ID Mappings between Samba Domain Members
    Common Errors
    Cannot Add Machine Back to Domain
    Adding Machine to Domain Fails
    I Can't Join a Windows 2003 PDC
    8. Stand-alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note

    Chapter 4. Server Types and Security Modes

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password Checking
    Common Errors
    What Makes Samba a Server?
    What Makes Samba a Domain Controller?
    What Makes Samba a Domain Member?
    Constantly Losing Connections to Password Server

    This chapter provides information regarding the types of server that Samba may be -configured to be. A Microsoft network administrator who wishes to migrate to or to -use Samba will want to know what, within a Samba context, terms familiar to MS Windows -administrator mean. This means that it is essential also to define how critical security -modes function BEFORE we get into the details of how to configure the server itself. +configured to be. A Microsoft network administrator who wishes to migrate to or +use Samba will want to know the meaning, within a Samba context, of terms familiar to MS Windows +administrator. This means that it is essential also to define how critical security +modes function before we get into the details of how to configure the server itself.

    The chapter provides an overview of the security modes of which Samba is capable -and how these relate to MS Windows servers and clients. +and how they relate to MS Windows servers and clients.

    -A question often asked is, "Why would I want to use Samba?" Most chapters contain a section +A question often asked is, “Why would I want to use Samba?” Most chapters contain a section that highlights features and benefits. We hope that the information provided will help to answer this question. Be warned though, we want to be fair and reasonable, so not all -features are positive towards Samba so the benefit may be on the side of our competition. -

    Features and Benefits

    +features are positive towards Samba. The benefit may be on the side of our competition. +

    Features and Benefits

    Two men were walking down a dusty road, when one suddenly kicked up a small red stone. It hurt his toe and lodged in his sandal. He took the stone out and cursed it with a passion -and fury fitting his anguish. The other looked at the stone and said, that is a garnet - I -can turn that into a precious gem and some day it will make a princess very happy! +and fury befitting his anguish. The other looked at the stone and said, “This is a garnet. +I can turn that into a precious gem and some day it will make a princess very happy!”

    The moral of this tale: Two men, two very different perspectives regarding the same stone. Like it or not, Samba is like that stone. Treat it the right way and it can bring great -pleasure, but if you are forced upon it and have no time for its secrets then it can be +pleasure, but if you are forced to use it and have no time for its secrets, then it can be a source of discomfort.

    Samba started out as a project that sought to provide interoperability for MS Windows 3.x clients with a UNIX server. It has grown up a lot since its humble beginnings and now provides features and functionality fit for large scale deployment. It also has some warts. In sections -like this one we will tell of both. +like this one we tell of both.

    -So now, what are the benefits of features mentioned in this chapter? +So, what are the benefits of features mentioned in this chapter?

    • - Samba-3 can replace an MS Windows NT4 Domain Controller + Samba-3 can replace an MS Windows NT4 Domain Controller.

    • - Samba-3 offers excellent interoperability with MS Windows NT4 - style domains as well as natively with Microsoft Active - Directory domains. + Samba-3 offers excellent interoperability with MS Windows NT4-style + domains as well as natively with Microsoft Active Directory domains.

    • - Samba-3 permits full NT4 style Interdomain Trusts + Samba-3 permits full NT4-style Interdomain Trusts.

    • Samba has security modes that permit more flexible authentication than is possible with MS Windows NT4 Domain Controllers.

    • - Samba-3 permits use of multiple account database backends + Samba-3 permits use of multiple account database backends.

    • The account (password) database backends can be distributed and replicated using multiple methods. This gives Samba-3 greater flexibility than MS Windows NT4 and in many cases a significantly higher utility than Active Directory domains with MS Windows 200x. -

    Server Types

    Administrators of Microsoft networks often refer to three -different type of servers:

    • Domain Controller

      • Primary Domain Controller

      • Backup Domain Controller

      • ADS Domain Controller

    • Domain Member Server

      • Active Directory Domain Server

      • NT4 Style Domain Domain Server

    • Stand Alone Server

    +

    Server Types

    + +Administrators of Microsoft networks often refer to three +different type of servers:

    • Domain Controller

      • Primary Domain Controller
      • Backup Domain Controller
      • ADS Domain Controller

    • Domain Member Server

      • Active Directory Domain Server
      • NT4 Style Domain Domain Server

    • Stand-alone Server

    The chapters covering Domain Control, Backup Domain Control and Domain Membership provide pertinent information regarding Samba configuration for each of these server roles. The reader is strongly encouraged to become intimately familiar with the information presented. -

    Samba Security Modes

    -In this section the function and purpose of Samba's security +

    Samba Security Modes

    + + +In this section the function and purpose of Samba's security modes are described. An accurate understanding of how Samba implements each security mode as well as how to configure MS Windows clients for each mode will significantly reduce user complaints and administrator heartache.

    -In the SMB/CIFS networking world, there are only two types of security: USER Level -and SHARE Level. We refer to these collectively as security levels. In implementing these two security levels Samba provides flexibilities -that are not available with Microsoft Windows NT4 / 200x servers. Samba knows of five (5) -ways that allow the security levels to be implemented. In actual fact, Samba implements -SHARE Level security only one way, but has four ways of implementing -USER Level security. Collectively, we call the Samba implementations -Security Modes. These are: SHARE, USER, DOMAIN, -ADS, and SERVER -modes. They are documented in this chapter. -

    - A SMB server tells the client at startup what security level -it is running. There are two options: share level and -user level. Which of these two the client receives affects -the way the client then tries to authenticate itself. It does not directly affect -(to any great extent) the way the Samba server does security. This may sound strange, -but it fits in with the client/server approach of SMB. In SMB everything is initiated -and controlled by the client, and the server can only tell the client what is -available and whether an action is allowed. -

    User Level Security

    -We will describe user level security first, as it's simpler. -In user level security, the client will send a -session setup command directly after the protocol negotiation. -This contains a username and password. The server can either accept or reject that -username/password combination. Note that at this stage the server has no idea what +In the SMB/CIFS networking world, there are only two types of security: User Level +and Share Level. We refer to these collectively as security levels. +In implementing these two security levels, Samba provides flexibilities +that are not available with Microsoft Windows NT4/200x servers. In actual fact, Samba implements +Share Level security only one way, but has four ways of implementing +User Level security. Collectively, we call the Samba implementations +Security Modes. They are known as: SHARE, USER, +DOMAIN, ADS, and SERVER modes. +They are documented in this chapter. +

    +An SMB server tells the client at startup what security level it is running. There are two options: +Share Level and User Level. Which of these two the client receives affects the way the client then +tries to authenticate itself. It does not directly affect (to any great extent) the way the Samba +server does security. This may sound strange, but it fits in with the client/server approach of SMB. +In SMB everything is initiated and controlled by the client, and the server can only tell the client +what is available and whether an action is allowed. +

    User Level Security

    +We will describe User Level Security first, as its simpler. +In User Level Security, the client will send a +session setup request directly following protocol negotiation. +This request provides a username and password. The server can either accept or reject that +username/password combination. At this stage the server has no idea what share the client will eventually try to connect to, so it can't base the accept/reject on anything other than: -

    1. The username/password

    2. The name of the client machine

    +

    1. the username/password.

    2. the name of the client machine.

    If the server accepts the username/password then the client expects to be able to mount shares (using a tree connection) without specifying a password. It expects that all access rights will be as the username/password @@ -468,53 +451,57 @@ It is also possible for a client to send multiple ses requests. When the server responds, it gives the client a uid to use as an authentication tag for that username/password. The client can maintain multiple authentication contexts in this way (WinDD is an example of an application that does this). -

    Example Configuration

    -The smb.conf parameter that sets User Level Security is: +

    Example Configuration

    +The smb.conf parameter that sets user level security is:

    security = user

    -This is the default setting since samba-2.2.x. -

    Share Level Security

    -Ok, now for share level security. In share level security, the client authenticates -itself separately for each share. It will send a password along with each -tree connection (share mount). It does not explicitly send a +This is the default setting since Samba-2.2.x. +

    Share Level Security

    +In Share Level security, the client authenticates +itself separately for each share. It sends a password along with each +tree connection (share mount). It does not explicitly send a username with this operation. The client expects a password to be associated with each share, independent of the user. This means that Samba has to work out what username the client probably wants to use. It is never explicitly sent the username. Some commercial SMB servers such as NT actually associate passwords directly with -shares in share level security, but Samba always uses the unix authentication scheme +shares in Share Level security, but Samba always uses the UNIX authentication scheme where it is a username/password pair that is authenticated, not a share/password pair.

    -To gain understanding of the MS Windows networking parallels to this, one should think +To understand the MS Windows networking parallels, one should think in terms of MS Windows 9x/Me where one can create a shared folder that provides read-only or full access, with or without a password.

    -Many clients send a session setup even if the server is in share -level security. They normally send a valid username but no password. Samba records -this username in a list of possible usernames. When the client -then does a tree connection it also adds to this list the name +Many clients send a session setup even if the server is in Share Level security. They +normally send a valid username but no password. Samba records this username in a list +of possible usernames. When the client then does a tree connection it also adds to this list the name of the share they try to connect to (useful for home directories) and any users -listed in the user smb.conf line. The password is then checked -in turn against these possible usernames. If a match is found +listed in the user parameter in the smb.conf file. +The password is then checked in turn against these possible usernames. If a match is found then the client is authenticated as that user. -

    Example Configuration

    -The smb.conf parameter that sets Share Level Security is: +

    Example Configuration

    +The smb.conf parameter that sets Share Level security is:

    security = share

    -Please note that there are reports that recent MS Windows clients do not like to work -with share mode security servers. You are strongly discouraged from using share level security. -

    Domain Security Mode (User Level Security)

    -When Samba is operating in security = domain mode, -the Samba server has a domain security trust account (a machine account) and will cause -all authentication requests to be passed through to the domain controllers. -

    Example Configuration

    +There are reports that recent MS Windows clients do not like to work +with share mode security servers. You are strongly discouraged from using Share Level security. +

    Domain Security Mode (User Level Security)

    + +When Samba is operating in security = domain mode, +the Samba server has a domain security trust account (a machine account) and causes +all authentication requests to be passed through to the Domain Controllers. +In other words, this configuration makes the Samba server a Domain Member server. +

    Example Configuration

    Samba as a Domain Member Server

    + This method involves addition of the following parameters in the smb.conf file:

    security = domain
    workgroup = MIDEARTH

    In order for this method to work, the Samba server needs to join the MS Windows NT security domain. This is done as follows: -

    1. On the MS Windows NT domain controller, using + + +

      1. On the MS Windows NT Domain Controller, using the Server Manager, add a machine account for the Samba server. -

      2. Next, on the UNIX/Linux system execute:

        root# net rpc join -U administrator%password

      Note

      -Samba-2.2.4 and later can auto-join a Windows NT4 style Domain just by executing: +

    2. On the UNIX/Linux system execute:

      root# net rpc join -U administrator%password

    Note

    +Samba-2.2.4 and later can auto-join a Windows NT4-style Domain just by executing: 

     root# smbpasswd -j DOMAIN_NAME -r PDC_NAME \
 	 -U Administrator%password
@@ -529,97 +516,97 @@ It is not necessary with Samba-3 to specify the DOMAI

    Use of this mode of authentication does require there to be a standard UNIX account for each user in order to assign a UID once the account has been authenticated by -the remote Windows DC. This account can be blocked to prevent logons by clients other than +the remote Windows DC. This account can be blocked to prevent logons by clients other than MS Windows through means such as setting an invalid shell in the /etc/passwd entry.

    An alternative to assigning UIDs to Windows users on a Samba member server is -presented in the chapter about winbind. +presented in .

    - For more information of being a domain member, see the chapter about domain membership. -

    ADS Security Mode (User Level Security)

    -Both Samba 2.2 and 3.0 can join an Active Directory domain. This is +For more information regarding Domain Membership, see . +

    ADS Security Mode (User Level Security)

    +Both Samba-2.2, and Samba-3 can join an Active Directory domain. This is possible if the domain is run in native mode. Active Directory in -native mode perfectly allows NT4-style domain members. This is contrary to -popular belief. The only thing that Active Directory in native mode -prohibits is Backup Domain Controllers running NT4. +native mode perfectly allows NT4-style Domain Members. This is contrary to +popular belief. Active Directory in native mode prohibits only the use of +Backup Domain Controllers running MS Windows NT4.

    If you are using Active Directory, starting with Samba-3 you can join as a native AD member. Why would you want to do that? Your security policy might prohibit the use of NT-compatible authentication protocols. All your machines are running Windows 2000 -and above and all use Kerberos. In this case Samba as a NT4-style +and above and all use Kerberos. In this case Samba as an NT4-style domain would still require NT-compatible authentication data. Samba in AD-member mode can accept Kerberos tickets. -

    Example Configuration

    realm = your.kerberos.REALM
    security = ADS

    +

    Example Configuration

    realm = your.kerberos.REALM
    security = ADS

    The following parameter may be required: -

    ads server = your.kerberos.server

    -Please refer to the chapter on domain membership +

    password server = your.kerberos.server

    +Please refer to and for more information regarding this configuration option. -

    Server Security (User Level Security)

    -Server security mode is a left over from the time when Samba was not capable of acting -as a domain member server. It is highly recommended NOT to use this feature. Server -security mode has many draw backs. The draw backs include: -

    • Potential Account Lockout on MS Windows NT4/200x password servers

    • Lack of assurance that the password server is the one specified

    • Does not work with Winbind, particularly needed when storing profiles remotely

    • This mode may open connections to the password server, and keep them open for extended periods.

    • Security on the Samba server breaks badly when the remote password server suddenly shuts down

    • With this mode there is NO security account in the domain that the password server belongs to for the Samba server.

    -In server security mode the Samba server reports to the client that it is in user level -security. The client then does a session setup as described earlier. +

    Server Security (User Level Security)

    +Server Security Mode is left over from the time when Samba was not capable of acting +as a Domain Member server. It is highly recommended not to use this feature. Server +security mode has many drawbacks that include: +

    • Potential Account Lockout on MS Windows NT4/200x password servers.

    • Lack of assurance that the password server is the one specified.

    • Does not work with Winbind, which is particularly needed when storing profiles remotely.

    • This mode may open connections to the password server, and keep them open for extended periods.

    • Security on the Samba server breaks badly when the remote password server suddenly shuts down.

    • With this mode there is NO security account in the domain that the password server belongs to for the Samba server.

    +In Server Security Mode the Samba server reports to the client that it is in User Level +security. The client then does a session setup as described earlier. The Samba server takes the username/password that the client sends and attempts to login to the -password server by sending exactly the same username/password that -it got from the client. If that server is in user level security and accepts the password, -then Samba accepts the clients connection. This allows the Samba server to use another SMB -server as the password server. +password server by sending exactly the same username/password that +it got from the client. If that server is in User Level Security and accepts the password, +then Samba accepts the client's connection. This allows the Samba server to use another SMB +server as the password server.

    -You should also note that at the very start of all this, where the server tells the client +You should also note that at the start of all this where the server tells the client what security level it is in, it also tells the client if it supports encryption. If it -does then it supplies the client with a random cryptkey. The client will then send all +does, it supplies the client with a random cryptkey. The client will then send all passwords in encrypted form. Samba supports this type of encryption by default.

    -The parameter security = server means that Samba reports to clients that +The parameter security = server means that Samba reports to clients that it is running in user mode but actually passes off all authentication requests to another user mode server. This requires an additional -parameter password server that points to the real authentication server. -That real authentication server can be another Samba server or can be a Windows NT server, -the later natively capable of encrypted password support. +parameter password server that points to the real authentication server. +The real authentication server can be another Samba server, or it can be a Windows NT server, +the latter being natively capable of encrypted password support.

    Note

    -When Samba is running in server security mode it is essential that +When Samba is running in Server Security Mode it is essential that the parameter password server is set to the precise NetBIOS machine -name of the target authentication server. Samba can NOT determine this from NetBIOS name -lookups because the choice of the target authentication server is arbitrary and can not +name of the target authentication server. Samba cannot determine this from NetBIOS name +lookups because the choice of the target authentication server is arbitrary and cannot be determined from a domain name. In essence, a Samba server that is in -server security mode is operating in what used to be known as +Server Security Mode is operating in what used to be known as workgroup mode. -

    Example Configuration

    -Using MS Windows NT as an authentication server +

    Example Configuration

    +Using MS Windows NT as an Authentication Server

    This method involves the additions of the following parameters in the smb.conf file:

    encrypt passwords = Yes
    security = server
    password server = "NetBIOS_name_of_a_DC"

    -There are two ways of identifying whether or not a username and password pair was valid. +There are two ways of identifying whether or not a username and password pair is valid. One uses the reply information provided as part of the authentication messaging process, the other uses just an error code.

    -The down-side of this mode of configuration is the fact that for security reasons Samba +The downside of this mode of configuration is the fact that for security reasons Samba will send the password server a bogus username and a bogus password and if the remote server fails to reject the username and password pair then an alternative mode of identification of validation is used. Where a site uses password lock out after a certain number of failed authentication attempts this will result in user lockouts.

    -Use of this mode of authentication does require there to be a standard UNIX account -for the user, though this account can be blocked to prevent logons by non-SMB/CIFS clients. -

    Password checking

    +Use of this mode of authentication requires a standard UNIX account for the user. +This account can be blocked to prevent logons by non-SMB/CIFS clients. +

    Password Checking

    MS Windows clients may use encrypted passwords as part of a challenge/response -authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or clear text strings for simple -password based authentication. It should be realized that with the SMB protocol, -the password is passed over the network either in plain text or encrypted, but +authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or cleartext strings for simple +password-based authentication. It should be realized that with the SMB protocol, +the password is passed over the network either in plain-text or encrypted, but not both in the same authentication request.

    When encrypted passwords are used, a password that has been entered by the user is encrypted in two ways: -

    • An MD4 hash of the UNICODE of the password - string. This is known as the NT hash. +

      • An MD4 hash of the unicode of the password + string. This is known as the NT hash.

      • The password is converted to upper case, - and then padded or truncated to 14 bytes. This string is + and then padded or truncated to 14 bytes. This string is then appended with 5 bytes of NULL characters and split to - form two 56 bit DES keys to encrypt a "magic" 8 byte value. + form two 56-bit DES keys to encrypt a “magic” 8-byte value. The resulting 16 bytes form the LanMan hash.

      MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0 @@ -633,324 +620,340 @@ connection that has been dropped, the client re-establishes the connection using a cached copy of the password.

      When Microsoft changed the default password mode, support was dropped for caching -of the plain text password. This means that when the registry parameter is changed -to re-enable use of plain text passwords it appears to work, but when a dropped -service connection mapping attempts to revalidate it will fail if the remote -authentication server does not support encrypted passwords. This means that it -is definitely not a good idea to re-enable plain text password support in such clients. -

      -The following parameters can be used to work around the issue of Windows 9x clients -upper casing usernames and password before transmitting them to the SMB server -when using clear text authentication. +of the plain-text password. This means that when the registry parameter is changed +to re-enable use of plain-text passwords it appears to work, but when a dropped +service connection mapping attempts to revalidate, this will fail if the remote +authentication server does not support encrypted passwords. It is definitely not +a good idea to re-enable plain-text password support in such clients. +

      +The following parameters can be used to work around the issue of Windows 9x/Me clients +upper-casing usernames and passwords before transmitting them to the SMB server +when using cleartext authentication:

      password level = integer
      username level = integer

      -By default Samba will lower case the username before attempting to lookup the user -in the database of local system accounts. Because UNIX usernames conventionally -only contain lower-case character, the username level parameter +By default Samba will convert to lower case the username before attempting to lookup the user +in the database of local system accounts. Because UNIX usernames conventionally +only contain lower-case characters, the username level parameter is rarely needed.

      However, passwords on UNIX systems often make use of mixed-case characters. -This means that in order for a user on a Windows 9x client to connect to a Samba -server using clear text authentication, the password level -must be set to the maximum number of upper case letters which could -appear in a password. Note that if the server OS uses the traditional DES version -of crypt(), a password level of 8 will result in case -insensitive passwords as seen from Windows users. This will also result in longer +This means that in order for a user on a Windows 9x/Me client to connect to a Samba +server using cleartext authentication, the password level +must be set to the maximum number of upper case letters that could +appear in a password. Note that if the server OS uses the traditional DES version +of crypt(), a password level of 8 will result in case +insensitive passwords as seen from Windows users. This will also result in longer login times as Samba has to compute the permutations of the password string and try them one by one until a match is located (or all combinations fail).

      The best option to adopt is to enable support for encrypted passwords wherever -Samba is used. Most attempts to apply the registry change to re-enable plain text +Samba is used. Most attempts to apply the registry change to re-enable plain-text passwords will eventually lead to user complaints and unhappiness. -

    Common Errors

    -We all make mistakes. It is Ok to make mistakes, so long as they are made in the right places -and at the right time. A mistake that causes lost productivity is seldom tolerated. A mistake +

    Common Errors

    +We all make mistakes. It is okay to make mistakes, as long as they are made in the right places +and at the right time. A mistake that causes lost productivity is seldom tolerated, however a mistake made in a developmental test lab is expected.

    Here we look at common mistakes and misapprehensions that have been the subject of discussions -on the Samba mailing lists. Many of these are avoidable by doing you homework before attempting -a Samba implementation. Some are the result of misunderstanding of the English language. The -English language has many turns of phrase that are potentially vague and may be highly confusing +on the Samba mailing lists. Many of these are avoidable by doing your homework before attempting +a Samba implementation. Some are the result of a misunderstanding of the English language. The +English language, which has many phrases that are potentially vague and may be highly confusing to those for whom English is not their native tongue. -

    What makes Samba a SERVER?

    -To some the nature of the Samba security mode is very obvious, but entirely -wrong all the same. It is assumed that security = server means that Samba -will act as a server. Not so! See above - this setting means that Samba will try -to use another SMB server as its source of user authentication alone. -

    What makes Samba a Domain Controller?

    -The smb.conf parameter security = domain does NOT really make Samba behave -as a Domain Controller! This setting means we want Samba to be a domain member! -

    What makes Samba a Domain Member?

    -Guess! So many others do. But whatever you do, do NOT think that security = user -makes Samba act as a domain member. Read the manufacturers manual before the warranty expires! See -the chapter about domain membership for more information. -

    Constantly Losing Connections to Password Server

    +

    What Makes Samba a Server?

    +To some the nature of the Samba security mode is obvious, but entirely +wrong all the same. It is assumed that security = server means that Samba +will act as a server. Not so! This setting means that Samba will try +to use another SMB server as its source for user authentication alone. +

    What Makes Samba a Domain Controller?

    +The smb.conf parameter security = domain does not really make Samba behave +as a Domain Controller. This setting means we want Samba to be a Domain Member. +

    What Makes Samba a Domain Member?

    +Guess! So many others do. But whatever you do, do not think that security = user +makes Samba act as a Domain Member. Read the manufacturer's manual before the warranty expires. See + for more information. +

    Constantly Losing Connections to Password Server

    “ -Why does server_validate() simply give up rather than re-establishing its connection to the +Why does server_validate() simply give up rather than re-establish its connection to the password server? Though I am not fluent in the SMB protocol, perhaps the cluster server process passes along to its client workstation the session key it receives from the password server, which means the password hashes submitted by the client would not work on a subsequent -connection, whose session key would be different. So server_validate() must give up.” +connection whose session key would be different. So server_validate() must give up.”

    - Indeed. That's why security = server is at best a nasty hack. Please use security = domain. -security = server mode is also known as pass-through authentication. -

    Chapter 5. Domain Control

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    David Bannon

    Samba Team

    Table of Contents

    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    '$' cannot be included in machine name
    Joining domain fails because of existing machine account
    The system can not log you on (C000019B)....
    The machine trust account not accessible
    Account disabled
    Domain Controller Unavailable
    Can not log onto domain member workstation after joining domain

    The Essence of Learning:  +Indeed. That's why security = server +is at best a nasty hack. Please use security = domain; +security = server mode is also known as pass-through authentication. +

    Chapter 5. Domain Control

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    David Bannon

    Samba Team

    Guenther Deschner

    LDAP updates
    SuSE

    Table of Contents

    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    $ Cannot Be Included in Machine Name
    Joining Domain Fails Because of Existing Machine Account
    The System Cannot Log You On (C000019B)
    The Machine Trust Account Is Not Accessible
    Account Disabled
    Domain Controller Unavailable
    Cannot Log onto Domain Member Workstation After Joining Domain

    There are many who approach MS Windows networking with incredible misconceptions. -That's OK, because it gives the rest of us plenty of opportunity to be of assistance. +That's okay, because it gives the rest of us plenty of opportunity to be of assistance. Those who really want help would be well advised to become familiar with information that is already available.

    -The reader is advised NOT to tackle this section without having first understood +The reader is advised not to tackle this section without having first understood and mastered some basics. MS Windows networking is not particularly forgiving of misconfiguration. Users of MS Windows networking are likely to complain of persistent niggles that may be caused by a broken network configuration. -To a great many people however, MS Windows networking starts with a domain controller -that in some magical way is expected to solve all ills. -

    Figure 5.1. An Example Domain

    An Example Domain

    +To a great many people, however, MS Windows networking starts with a Domain Controller +that in some magical way is expected to solve all network operational ills. +

    +The diagram in shows a typical MS Windows Domain Security +network environment. Workstations A, B and C are representative of many physical MS Windows +network clients. +

    Figure 5.1. An Example Domain.

    An Example Domain.

    From the Samba mailing list one can readily identify many common networking issues. If you are not clear on the following subjects, then it will do much good to read the sections of this HOWTO that deal with it. These are the most common causes of MS Windows networking problems: -

    • Basic TCP/IP configuration

    • NetBIOS name resolution

    • Authentication configuration

    • User and Group configuration

    • Basic File and Directory Permission Control in UNIX/Linux

    • Understanding of how MS Windows clients interoperate in a network - environment

    +

    • Basic TCP/IP configuration.

    • NetBIOS name resolution.

    • Authentication configuration.

    • User and group configuration.

    • Basic file and directory permission control in UNIX/Linux.

    • Understanding how MS Windows clients interoperate in a network + environment.

    Do not be put off; on the surface of it MS Windows networking seems so simple that anyone can do it. In fact, it is not a good idea to set up an MS Windows network with inadequate training and preparation. But let's get our first indelible principle out of the -way: It is perfectly OK to make mistakes! In the right place and at -the right time, mistakes are the essence of learning. It is very much -not ok to make mistakes that cause loss of productivity and impose an avoidable financial -burden on an organisation. +way: It is perfectly okay to make mistakes! In the right place and at +the right time, mistakes are the essence of learning. It is very much not okay to make +mistakes that cause loss of productivity and impose an avoidable financial burden on an +organization.

    -Where is the right place to make mistakes? Only out of harm's way! If you are going to -make mistakes, then please do this on a test network, away from users and in such a way as +Where is the right place to make mistakes? Only out of harm's way. If you are going to +make mistakes, then please do it on a test network, away from users and in such a way as to not inflict pain on others. Do your learning on a test network. -

    Features and Benefits

    -What is the key benefit of Microsoft Domain security? +

    Features and Benefits

    + +What is the key benefit of Microsoft Domain Security?

    -In a word, Single Sign On, or SSO for short. To many, this is the holy -grail of MS Windows NT and beyond networking. SSO allows users in a well designed network +In a word, Single Sign On, or SSO for short. To many, this is the Holy +Grail of MS Windows NT and beyond networking. SSO allows users in a well-designed network to log onto any workstation that is a member of the domain that their user account is in (or in a domain that has an appropriate trust relationship with the domain they are visiting) -and they will be able to log onto the network and access resources (shares, files, and printers) +and they will be able to log onto the network and access resources (shares, files and printers) as if they are sitting at their home (personal) workstation. This is a feature of the Domain -security protocols. +Security protocols.

    -The benefits of Domain security are available to those sites that deploy a Samba PDC. + +The benefits of Domain Security are available to those sites that deploy a Samba PDC. A Domain provides a unique network security identifier (SID). Domain user and group security identifiers are comprised of the network SID plus a relative identifier (RID) that is unique to the account. User and Group SIDs (the network SID plus the RID) can be used to create Access Control Lists (ACLs) attached to network resources to provide organizational access control. UNIX systems -know only of local security identifiers. +recognize only local security identifiers.

    Note

    -Network clients of an MS Windows Domain security environment must be Domain members to be -able to gain access to the advanced features provided. Domain membership involves more than just +Network clients of an MS Windows Domain Security Environment must be Domain Members to be +able to gain access to the advanced features provided. Domain Membership involves more than just setting the workgroup name to the Domain name. It requires the creation of a Domain trust account -for the workstation (called a machine account). Please refer to the chapter on -setting up samba as a domain member for more information. +for the workstation (called a machine account). Refer to +for more information.

    The following functionalities are new to the Samba-3 release:

    • - Windows NT4 domain trusts + Windows NT4 domain trusts.

    • + Adding users via the User Manager for Domains. This can be done on any MS Windows - client using the Nexus toolkit that is available from Microsoft's web site. + client using the Nexus.exe toolkit that is available from Microsoft's Web site. Samba-3 supports the use of the Microsoft Management Console for user management.

    • Introduces replaceable and multiple user account (authentication) - back ends. In the case where the back end is placed in an LDAP database, - Samba-3 confers the benefits of a back end that can be distributed, replicated, + backends. In the case where the backend is placed in an LDAP database, + Samba-3 confers the benefits of a backend that can be distributed, replicated and is highly scalable.

    • - Implements full Unicode support. This simplifies cross locale internationalisation + Implements full Unicode support. This simplifies cross locale internationalization support. It also opens up the use of protocols that Samba-2.2.x had but could not use due to the need to fully support Unicode.

    -The following functionalities are NOT provided by Samba-3: +The following functionalities are not provided by Samba-3:

    • + + SAM replication with Windows NT4 Domain Controllers - (i.e. a Samba PDC and a Windows NT BDC or vice versa). This means samba + (i.e., a Samba PDC and a Windows NT BDC or vice versa). This means Samba cannot operate as a BDC when the PDC is Microsoft-based or - replicate account data to Windows-BDC's. + replicate account data to Windows BDCs.

    • - Acting as a Windows 2000 Domain Controller (i.e. Kerberos and - Active Directory) - In point of fact, Samba-3 DOES have some + Acting as a Windows 2000 Domain Controller (i.e., Kerberos and + Active Directory). In point of fact, Samba-3 does have some Active Directory Domain Control ability that is at this time - purely experimental AND that is certain - to change as it becomes a fully supported feature some time - during the Samba-3 (or later) life cycle. However, Active Directory is - more then just SMB - it's also LDAP, Kerberos, DHCP and other protocols - (with proprietary extensions, of course). + purely experimental that is certain to change as it becomes a + fully supported feature some time during the Samba-3 (or later) + life cycle. However, Active Directory is more then just SMB + it's also LDAP, Kerberos, DHCP, and other protocols (with proprietary + extensions, of course). +

    • + The Windows 200x/XP MMC (Computer Management) Console can not be used + to manage a Samba-3 server. For this you can use only the MS Windows NT4 + Domain Server manager and the MS Windows NT4 Domain User Manager. Both are + part of the SVRTOOLS.EXE package mentioned later.

    -Windows 9x / Me / XP Home clients are not true members of a domain for reasons outlined -in this chapter. The protocol for support of Windows 9x / Me style network (domain) logons -is completely different from NT4 / Win2k type domain logons and has been officially supported +Windows 9x/Me/XP Home clients are not true members of a domain for reasons outlined +in this chapter. The protocol for support of Windows 9x/Me style network (domain) logons +is completely different from NT4/Windows 200x type domain logons and has been officially supported for some time. These clients use the old LanMan Network Logon facilities that are supported in Samba since approximately the Samba-1.9.15 series.

    -Samba-3 has an implementation of group mapping between Windows NT groups +Samba-3 implements group mapping between Windows NT groups and UNIX groups (this is really quite complicated to explain in a short space). This is -discussed more fully in the chapter on group mapping. +discussed more fully in .

    + Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store -user and machine trust account information in a suitable backend data store. -Refer to the section on machine trust accounts. With Samba-3 there can be multiple -back-ends for this. A complete discussion of account database backends can be found in -the chapter on Account Information Databases. -

    Basics of Domain Control

    +user and Machine Trust Account information in a suitable backend datastore. +Refer to . With Samba-3 there can be multiple +backends for this. A complete discussion of account database backends can be found in +. +

    Basics of Domain Control

    Over the years, public perceptions of what Domain Control really is has taken on an almost mystical nature. Before we branch into a brief overview of Domain Control, -there are three basic types of domain controllers: -

    Domain Controller Types

    • Primary Domain Controller

    • Backup Domain Controller

    • ADS Domain Controller

    -The Primary Domain Controller or PDC plays an important role in the MS -Windows NT4. In Windows 200x Domain Control architecture this role is held by domain controllers. -There is folk lore that dictates that because of it's role in the MS Windows -network, the domain controllers should be the most powerful and most capable machine in the network. -As strange as it may seem to say this here, good over all network performance dictates that -the entire infrastructure needs to be balanced. It is advisable to invest more in Stand-Alone -(or Domain Member) servers than in the domain controllers. -

    -In the case of MS Windows NT4 style domains, it is the PDC that initiates a new Domain Control database. -This forms a part of the Windows registry called the SAM (Security Account Manager). It plays a key -part in NT4 type domain user authentication and in synchronisation of the domain authentication +there are three basic types of Domain Controllers. +

    Domain Controller Types

    • Primary Domain Controller

    • Backup Domain Controller

    • ADS Domain Controller

    +The Primary Domain Controller or PDC plays an important role in MS +Windows NT4. In Windows 200x Domain Control architecture, this role is held by Domain Controllers. +Folklore dictates that because of its role in the MS Windows +network, the Domain Controller should be the most powerful and most capable machine in the network. +As strange as it may seem to say this here, good overall network performance dictates that +the entire infrastructure needs to be balanced. It is advisable to invest more in Stand-alone +(Domain Member) servers than in the Domain Controllers. +

    + +In the case of MS Windows NT4-style domains, it is the PDC that initiates a new Domain Control database. +This forms a part of the Windows registry called the Security Account Manager (SAM). It plays a key +part in NT4-type domain user authentication and in synchronization of the domain authentication database with Backup Domain Controllers.

    -With MS Windows 200x Server based Active Directory domains, one domain controller initiates a potential -hierarchy of domain controllers, each with their own area of delegated control. The master domain -controller has the ability to override any down-stream controller, but a down-line controller has -control only over it's down-line. With Samba-3 this functionality can be implemented using an -LDAP based user and machine account back end. +With MS Windows 200x Server-based Active Directory domains, one Domain Controller initiates a potential +hierarchy of Domain Controllers, each with their own area of delegated control. The master domain +controller has the ability to override any downstream controller, but a downline controller has +control only over its downline. With Samba-3, this functionality can be implemented using an +LDAP-based user and machine account backend.

    -New to Samba-3 is the ability to use a back-end database that holds the same type of data as -the NT4 style SAM (Security Account Manager) database (one of the registry files). -[1] +New to Samba-3 is the ability to use a backend database that holds the same type of data as +the NT4-style SAM database (one of the registry files)[1].

    The Backup Domain Controller or BDC plays a key role in servicing network authentication requests. The BDC is biased to answer logon requests in preference to the PDC. -On a network segment that has a BDC and a PDC the BDC will be most likely to service network +On a network segment that has a BDC and a PDC, the BDC will most likely service network logon requests. The PDC will answer network logon requests when the BDC is too busy (high load). -A BDC can be promoted to a PDC. If the PDC is on line at the time that a BDC is promoted to -PDC, the previous PDC is automatically demoted to a BDC. With Samba-3 this is NOT an automatic -operation; the PDC and BDC must be manually configured and changes need to be made likewise. +A BDC can be promoted to a PDC. If the PDC is online at the time that a BDC is promoted to +PDC, the previous PDC is automatically demoted to a BDC. With Samba-3, this is not an automatic +operation; the PDC and BDC must be manually configured and changes also need to be made.

    -With MS Windows NT4, it is an install time decision what type of machine the server will be. -It is possible to change the promote a BDC to a PDC and vice versa only, but the only way -to convert a domain controller to a domain member server or a stand-alone server is to +With MS Windows NT4, a decision is made at installation to determine what type of machine the server will be. +It is possible to promote a BDC to a PDC and vice versa. The only way +to convert a Domain Controller to a Domain Member server or a Stand-alone Server is to reinstall it. The install time choices offered are: -

    • Primary Domain Controller - The one that seeds the domain SAM

    • Backup Domain Controller - One that obtains a copy of the domain SAM

    • Domain Member Server - One that has NO copy of the domain SAM, rather it obtains authentication from a Domain Controller for all access controls.

    • Stand-Alone Server - One that plays NO part is SAM synchronisation, has it's own authentication database and plays no role in Domain security.

    -With MS Windows 2000 the configuration of domain control is done after the server has been +

    • Primary Domain Controller the one that seeds the domain SAM.

    • Backup Domain Controller one that obtains a copy of the domain SAM.

    • Domain Member Server one that has no copy of the domain SAM, rather it obtains authentication from a Domain Controller for all access controls.

    • Stand-alone Server one that plays no part is SAM synchronization, has its own authentication database and plays no role in Domain Security.

    +With MS Windows 2000, the configuration of Domain Control is done after the server has been installed. Samba-3 is capable of acting fully as a native member of a Windows 200x server Active Directory domain.

    -New to Samba-3 is the ability to function fully as an MS Windows NT4 style Domain Controller, -excluding the SAM replication components. However, please be aware that Samba-3 support the -MS Windows 200x domain control protocols also. + +New to Samba-3 is the ability to function fully as an MS Windows NT4-style Domain Controller, +excluding the SAM replication components. However, please be aware that Samba-3 also supports the +MS Windows 200x Domain Control protocols.

    At this time any appearance that Samba-3 is capable of acting as an Domain Controller in native ADS mode is limited and experimental in nature. -This functionality should not be used until the Samba-Team offers formal support for it. +This functionality should not be used until the Samba Team offers formal support for it. At such a time, the documentation will be revised to duly reflect all configuration and management requirements. Samba can act as a NT4-style DC in a Windows 2000/XP environment. However, there are certain compromises: -

    • No machine policy files

    • No Group Policy Objects

    • No synchronously executed AD logon scripts

    • Can't use ANY Active Directory management tools to manage users and machines

    • Registry changes tattoo the main registry, while with AD they do NOT. ie: Leave permanent changes in effect

    • Without AD you can not peprform the function of exporting specific applications to specific users or groups

    -

    Preparing for Domain Control

    -There are two ways that MS Windows machines may interact with each other, with other servers, -and with Domain Controllers: Either as Stand-Alone systems, more commonly +

    • No machine policy files.
    • No Group Policy Objects.
    • No synchronously executed AD logon scripts.
    • Can't use Active Directory management tools to manage users and machines.
    • Registry changes tattoo the main registry, while with AD they do not leave permanent changes in effect.
    • Without AD you cannot perform the function of exporting specific applications to specific users or groups.

    +

    Preparing for Domain Control

    +There are two ways that MS Windows machines may interact with each other, with other servers +and with Domain Controllers: either as Stand-alone systems, more commonly called Workgroup members, or as full participants in a security system, more commonly called Domain members.

    -It should be noted that Workgroup membership involve no special configuration -other than the machine being configured so that the network configuration has a commonly used name -for it's workgroup entry. It is not uncommon for the name WORKGROUP to be used for this. With this -mode of configuration there are NO machine trust accounts and any concept of membership as such -is limited to the fact that all machines appear in the network neighbourhood to be logically -grouped together. Again, just to be clear: workgroup mode does not involve any security machine +It should be noted that Workgroup membership involves no special configuration +other than the machine being configured so the network configuration has a commonly used name +for its workgroup entry. It is not uncommon for the name WORKGROUP to be used for this. With this +mode of configurationi, there are no Machine Trust Accounts and any concept of membership as such +is limited to the fact that all machines appear in the network neighborhood to be logically +grouped together. Again, just to be clear: workgroup mode does not involve security machine accounts.

    -Domain member machines have a machine account in the Domain accounts database. A special procedure -must be followed on each machine to affect Domain membership. This procedure, which can be done -only by the local machine Administrator account, will create the Domain machine account (if -if does not exist), and then initializes that account. When the client first logs onto the +Domain Member machines have a machine account in the Domain accounts database. A special procedure +must be followed on each machine to effect Domain Membership. This procedure, which can be done +only by the local machine Administrator account, will create the Domain machine account (if it does +not exist), and then initializes that account. When the client first logs onto the Domain it triggers a machine password change.

    Note

    -When running a Domain all MS Windows NT / 200x / XP Professional clients should be configured -as full Domain Members - IF A SECURE NETWORK IS WANTED. If the machine is NOT made a member of the -Domain, then it will operate like a workgroup (stand-alone) machine. Please refer to -the chapter on domain membership for information regarding HOW to make your MS Windows clients Domain members. +When Samba is configured as a Domain Controller, secure network operation demands that +all MS Windows NT4/200x/XP Professional clients should be configured as Domain Members. +If a machine is not made a member of the Domain, then it will operate like a workgroup +(Stand-alone) machine. Please refer to for +information regarding Domain Membership.

    -The following are necessary for configuring Samba-3 as an MS Windows NT4 style PDC for MS Windows -NT4 / 200x / XP clients. -

    • Configuration of basic TCP/IP and MS Windows Networking

    • Correct designation of the Server Role (security = user)

    • Consistent configuration of Name Resolution (See chapter on Network Browsing and on - Integrating Unix into Windows networks)

    • Domain logons for Windows NT4 / 200x / XP Professional clients

    • Configuration of Roaming Profiles or explicit configuration to force local profile usage

    • Configuration of Network/System Policies

    • Adding and managing domain user accounts

    • Configuring MS Windows client machines to become domain members

    -The following provisions are required to serve MS Windows 9x / Me Clients: -

    • Configuration of basic TCP/IP and MS Windows Networking

    • Correct designation of the Server Role (security = user)

    • Network Logon Configuration (Since Windows 9x / XP Home are not technically domain - members, they do not really participate in the security aspects of Domain logons as such)

    • Roaming Profile Configuration

    • Configuration of System Policy handling

    • Installation of the Network driver "Client for MS Windows Networks" and configuration - to log onto the domain

    • Placing Windows 9x / Me clients in user level security - if it is desired to allow - all client share access to be controlled according to domain user / group identities.

    • Adding and managing domain user accounts

    Note

    +The following are necessary for configuring Samba-3 as an MS Windows NT4-style PDC for MS Windows +NT4/200x/XP clients: +

    • Configuration of basic TCP/IP and MS Windows networking.

    • Correct designation of the Server Role (security = user).

    • Consistent configuration of Name Resolution[2].

    • Domain logons for Windows NT4/200x/XP Professional clients.

    • Configuration of Roaming Profiles or explicit configuration to force local profile usage.

    • Configuration of network/system policies.

    • Adding and managing domain user accounts.

    • Configuring MS Windows client machines to become Domain Members.

    +The following provisions are required to serve MS Windows 9x/Me clients: +

    • Configuration of basic TCP/IP and MS Windows networking.

    • Correct designation of the server role (security = user).

    • Network Logon Configuration (since Windows 9x/Me/XP Home are not technically domain + members, they do not really participate in the security aspects of Domain logons as such).

    • Roaming Profile Configuration.

    • Configuration of System Policy handling.

    • Installation of the network driver “Client for MS Windows Networks” and configuration + to log onto the domain.

    • Placing Windows 9x/Me clients in User Level Security if it is desired to allow + all client share access to be controlled according to domain user/group identities.

    • Adding and managing domain user accounts.

    Note

    Roaming Profiles and System/Network policies are advanced network administration topics -that are covered in the Profile Management and -Policy Management chapters of this document. However, these are not +that are covered in the and + chapters of this document. However, these are not necessarily specific to a Samba PDC as much as they are related to Windows NT networking concepts.

    A Domain Controller is an SMB/CIFS server that:

    • Registers and advertises itself as a Domain Controller (through NetBIOS broadcasts as well as by way of name registrations either by Mailslot Broadcasts over UDP broadcast, - to a WINS server over UDP unicast, or via DNS and Active Directory) + to a WINS server over UDP unicast, or via DNS and Active Directory).

    • - Provides the NETLOGON service (actually a collection of services that runs over - a number of protocols. These include the LanMan Logon service, the Netlogon service, - the Local Security Account service, and variations of them) + Provides the NETLOGON service. (This is actually a collection of services that runs over + mulitple protocols. These include the LanMan Logon service, the Netlogon service, + the Local Security Account service, and variations of them.)

    • - Provides a share called NETLOGON + Provides a share called NETLOGON.

    -For Samba to provide these is rather easy to configure. Each Samba Domain Controller must provide -the NETLOGON service which Samba calls the domain logons functionality -(after the name of the parameter in the smb.conf file). Additionally, one (1) server in a Samba-3 -Domain must advertise itself as the domain master browser[2]. This causes the Primary Domain Controller -to claim domain specific NetBIOS name that identifies it as a domain master browser for its given -domain/workgroup. Local master browsers in the same domain/workgroup on broadcast-isolated subnets -then ask for a complete copy of the browse list for the whole wide area network. Browser clients -will then contact their local master browser, and will receive the domain-wide browse list, +It is rather easy to configure Samba to provide these. Each Samba Domain Controller must provide +the NETLOGON service that Samba calls the domain logons functionality +(after the name of the parameter in the smb.conf file). Additionally, one server in a Samba-3 +Domain must advertise itself as the Domain Master Browser[3]. +This causes the Primary Domain Controller to claim a domain-specific NetBIOS name that identifies it as a +Domain Master Browser for its given domain or workgroup. Local master browsers in the same domain or workgroup on +broadcast-isolated subnets then ask for a complete copy of the browse list for the whole wide area network. +Browser clients will then contact their Local Master Browser, and will receive the domain-wide browse list, instead of just the list for their broadcast-isolated subnet. -

    Domain Control - Example Configuration

    +

    Domain Control Example Configuration

    The first step in creating a working Samba PDC is to understand the parameters necessary -in smb.conf. An example smb.conf for acting as a PDC can be found in the example -for being a PDC. +in smb.conf. An example smb.conf for acting as a PDC can be found in .

    -

    Example 5.1. smb.conf for being a PDC

    [global]
    netbios name = BELERIAND
    workgroup = MIDEARTH
    passdb backend = ldapsam, guest
    os level = 33
    preferred master = yes
    domain master = yes
    local master = yes
    security = user
    encrypt passwords = yes
    domain logons = yes
    logon path = \\%N\profiles\%u
    logon drive = H:
    logon home = \\homeserver\%u\winprofile
    logon script = logon.cmd
    [netlogon]
    path = /var/lib/samba/netlogon
    read only = yes
    write list = ntadmin
    [profiles]
    path = /var/lib/samba/profiles
    read only = no
    create mask = 0600
    directory mask = 0700

    +

    Example 5.1. smb.conf for being a PDC

    [global]
    netbios name = BELERIAND
    workgroup = MIDEARTH
    passdb backend = tdbsam
    os level = 33
    preferred master = yes
    domain master = yes
    local master = yes
    security = user
    domain logons = yes
    logon path = \\%N\profiles\%u
    logon drive = H:
    logon home = \\homeserver\%u\winprofile
    logon script = logon.cmd
    [netlogon]
    path = /var/lib/samba/netlogon
    read only = yes
    write list = ntadmin
    [profiles]
    path = /var/lib/samba/profiles
    read only = no
    create mask = 0600
    directory mask = 0700

    -The basic options shown above are explained as follows: -

    passdb backend

    +The basic options shown in are explained as follows: +

    passdb backend

    This contains all the user and group account information. Acceptable values for a PDC - are: smbpasswd, tdbsam, ldapsam. The 'guest' entry provides needed - default accounts.

    - Where is is intended to use backup domain controllers (BDCs) the only logical choice is - to use LDAP so that the passdb backend can be distributed. The tdbsam and smbpasswd files - can not effectively be distributed and therefore should not be used. -

    Domain Control Parameters

    + are: smbpasswd, tdbsam, and ldapsam. The “guest” entry provides + default accounts and is included by default, there is no need to add it explicitly.

    + Where use of backup Domain Controllers (BDCs) is intended, the only logical choice is + to use LDAP so the passdb backend can be distributed. The tdbsam and smbpasswd files + cannot effectively be distributed and therefore should not be used. +

    Domain Control Parameters

    The parameters os level, preferred master, domain master, security, - encrypt passwords, domain logons play a central role in assuring domain + encrypt passwords, and domain logons play a central role in assuring domain control and network logon support.

    - The os level must be set at or above a value of 32. A domain controller - must be the domain master browser, must be set in user mode security, - must support Microsoft compatible encrypted passwords, and must provide the network logon - service (domain logons). Encrypted passwords must be enabled, for more details on how - to do this, refer to the chapter on account information databases. -

    Environment Parameters

    - The parameters logon path, logon home, logon drive, logon script are + The os level must be set at or above a value of 32. A Domain Controller + must be the Domain Master Browser, must be set in user mode security, + must support Microsoft-compatible encrypted passwords, and must provide the network logon + service (domain logons). Encrypted passwords must be enabled. For more details on how + to do this, refer to . +

    Environment Parameters

    + The parameters logon path, logon home, logon drive, and logon script are environment support settings that help to facilitate client logon operations and that help to provide automated control facilities to ease network management overheads. Please refer to the man page information for these parameters. -

    NETLOGON Share

    - The NETLOGON share plays a central role in domain logon and domain membership support. - This share is provided on all Microsoft domain controllers. It is used to provide logon +

    NETLOGON Share

    + The NETLOGON share plays a central role in domain logon and Domain Membership support. + This share is provided on all Microsoft Domain Controllers. It is used to provide logon scripts, to store Group Policy files (NTConfig.POL), as well as to locate other common - tools that may be needed for logon processing. This is an essential share on a domain controller. -

    PROFILE Share

    - This share is used to store user desktop profiles. Eash user must have a directory at the root - of this share. This directory must be write enabled for the user and must be globally read enabled. - Samba-3 has a VFS module called 'fake_permissions' that may be installed on this share. This will - allow a Samba administrator to make the directory read only to everyone. Of course this is useful + tools that may be needed for logon processing. This is an essential share on a Domain Controller. +

    PROFILE Share

    + This share is used to store user desktop profiles. Each user must have a directory at the root + of this share. This directory must be write-enabled for the user and must be globally read-enabled. + Samba-3 has a VFS module called “fake_permissions” that may be installed on this share. This will + allow a Samba administrator to make the directory read-only to everyone. Of course this is useful only after the profile has been properly created.

    Note

    The above parameters make for a full set of parameters that may define the server's mode @@ -959,69 +962,69 @@ of operation. The following smb.conf parameters are th

    netbios name = BELERIAND
    workgroup = MIDEARTH
    domain logons = Yes
    domain master = Yes
    security = User

    The additional parameters shown in the longer listing above just makes for -more complete explanation. -

    Samba ADS Domain Control

    -Samba-3 is not, and can not act as, an Active Directory Server. It can not truly function as +a more complete explanation. +

    Samba ADS Domain Control

    +Samba-3 is not, and cannot act as, an Active Directory Server. It cannot truly function as an Active Directory Primary Domain Controller. The protocols for some of the functionality -the Active Directory Domain Controllers has been partially implemented on an experimental -only basis. Please do NOT expect Samba-3 to support these protocols. Do not depend -on any such functionality either now or in the future. The Samba-Team may remove these -experimental features or may change their behaviour. This is mentioned for the benefit of those -who have discovered secret capabilities in samba-3 and who have asked when this functionality will be -completed. The answer is: Maybe or maybe never! -

    -To be sure: Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4 style -domain controllers have. Samba-3 does NOT have all the capabilities of Windows NT4, but it does have +of Active Directory Domain Controllers has been partially implemented on an experimental +only basis. Please do not expect Samba-3 to support these protocols. Do not depend +on any such functionality either now or in the future. The Samba Team may remove these +experimental features or may change their behavior. This is mentioned for the benefit of those +who have discovered secret capabilities in Samba-3 and who have asked when this functionality will be +completed. The answer is maybe or maybe never! +

    +To be sure, Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4-style +Domain Controllers have. Samba-3 does not have all the capabilities of Windows NT4, but it does have a number of features that Windows NT4 domain contollers do not have. In short, Samba-3 is not NT4 and it -is not Windows Server 200x and it is not an Active Directory server. We hope this is plain and simple +is not Windows Server 200x, it is not an Active Directory server. We hope this is plain and simple enough for all to understand. -

    Domain and Network Logon Configuration

    +

    Domain and Network Logon Configuration

    The subject of Network or Domain Logons is discussed here because it forms an integral part of the essential functionality that is provided by a Domain Controller. -

    Domain Network Logon Service

    +

    Domain Network Logon Service

    All Domain Controllers must run the netlogon service (domain logons -in Samba). One Domain Controller must be configured with domain master = Yes -(the Primary Domain Controller); on ALL Backup Domain Controllers domain master = No +in Samba). One Domain Controller must be configured with domain master = Yes +(the Primary Domain Controller); on all Backup Domain Controllers domain master = No must be set. -

    Example Configuration

    Example 5.2. smb.conf for being a PDC

    [global]
    domain logons = Yes
    domain master = (Yes on PDC, No on BDCs)
    [netlogon]
    comment = Network Logon Service
    path = /var/lib/samba/netlogon
    guest ok = Yes
    browseable = No

    The Special Case of MS Windows XP Home Edition

    Note

    +

    Example Configuration

    Example 5.2. smb.conf for being a PDC

    [global]
    domain logons = Yes
    domain master = (Yes on PDC, No on BDCs)
    [netlogon]
    comment = Network Logon Service
    path = /var/lib/samba/netlogon
    guest ok = Yes
    browseable = No

    The Special Case of MS Windows XP Home Edition

    +To be completely clear: If you want MS Windows XP Home Edition to integrate with your +MS Windows NT4 or Active Directory Domain Security, understand it cannot be done. +The only option is to purchase the upgrade from MS Windows XP Home Edition to +MS Windows XP Professional. +

    Note

    MS Windows XP Home Edition does not have the ability to join any type of Domain -security facility. Unlike, MS Windows 9x / Me, MS Windows XP Home Edition also completely +Security facility. Unlike MS Windows 9x/Me, MS Windows XP Home Edition also completely lacks the ability to log onto a network.

    -To be completely clear: If you want MS Windows XP Home Edition to integrate with your -MS Windows NT4 or Active Directory Domain security understand - IT CAN NOT BE DONE. -Your only choice is to buy the upgrade pack from MS Windows XP Home Edition to -MS Windows XP Professional. -

    -Now that this has been said, please do NOT ask the mailing list, or email any of the -Samba-Team members with your questions asking how to make this work. It can't be done. +Now that this has been said, please do not ask the mailing list or email any of the +Samba Team members with your questions asking how to make this work. It can't be done. If it can be done, then to do so would violate your software license agreement with Microsoft, and we recommend that you do not do that. -

    The Special Case of Windows 9x / Me

    +

    The Special Case of Windows 9x/Me

    A domain and a workgroup are exactly the same in terms of network -browsing. The difference is that a distributable authentication +browsing. The difference is that a distributable authentication database is associated with a domain, for secure login access to a -network. Also, different access rights can be granted to users if they +network. Also, different access rights can be granted to users if they successfully authenticate against a domain logon server. Samba-3 does this -now in the same way that MS Windows NT/2K. +now in the same way as MS Windows NT/200x.

    The SMB client logging on to a domain has an expectation that every other server in the domain should accept the same authentication information. Network browsing functionality of domains and workgroups is identical and is explained in this documentation under the browsing discussions. -It should be noted, that browsing is totally orthogonal to logon support. +It should be noted that browsing is totally orthogonal to logon support.

    Issues related to the single-logon network model are discussed in this -section. Samba supports domain logons, network logon scripts, and user -profiles for MS Windows for workgroups and MS Windows 9X/ME clients +section. Samba supports domain logons, network logon scripts and user +profiles for MS Windows for workgroups and MS Windows 9X/ME clients, which are the focus of this section.

    When an SMB client in a domain wishes to logon, it broadcasts requests for a -logon server. The first one to reply gets the job, and validates its +logon server. The first one to reply gets the job, and validates its password using whatever mechanism the Samba administrator has installed. It is possible (but ill advised ) to create a domain where the user -database is not shared between servers, i.e. they are effectively workgroup -servers advertising themselves as participating in a domain. This +database is not shared between servers, i.e., they are effectively workgroup +servers advertising themselves as participating in a domain. This demonstrates how authentication is quite different from but closely involved with domains.

    @@ -1029,121 +1032,119 @@ Using these features you can make your clients verify their logon via the Samba server; make clients run a batch file when they logon to the network and download their preferences, desktop and start menu.

    -MS Windows XP Home edition is NOT able to join a domain and does not permit +MS Windows XP Home edition is not able to join a domain and does not permit the use of domain logons.

    Before launching into the configuration instructions, it is -worthwhile to look at how a Windows 9x/ME client performs a logon: +worthwhile to look at how a Windows 9x/Me client performs a logon:

    1. The client broadcasts (to the IP broadcast address of the subnet it is in) a NetLogon request. This is sent to the NetBIOS name DOMAIN<#1c> at the - NetBIOS layer. The client chooses the first response it receives, which + NetBIOS layer. The client chooses the first response it receives, which contains the NetBIOS name of the logon server to use in the format of \\SERVER.

    2. - The client then connects to that server, logs on (does an SMBsessetupX) and + The client connects to that server, logs on (does an SMBsessetupX) and then connects to the IPC$ share (using an SMBtconX).

    3. - The client then does a NetWkstaUserLogon request, which retrieves the name + The client does a NetWkstaUserLogon request, which retrieves the name of the user's logon script.

    4. - The client then connects to the NetLogon share and searches for said script - and if it is found and can be read, is retrieved and executed by the client. + The client then connects to the NetLogon share and searches for said script. + If it is found and can be read, it is retrieved and executed by the client. After this, the client disconnects from the NetLogon share.

    5. - The client then sends a NetUserGetInfo request to the server, to retrieve + The client sends a NetUserGetInfo request to the server to retrieve the user's home share, which is used to search for profiles. Since the response to the NetUserGetInfo request does not contain much more than - the user's home share, profiles for Win9X clients MUST reside in the user + the user's home share, profiles for Windows 9x clients must reside in the user home directory.

    6. - The client then connects to the user's home share and searches for the + The client connects to the user's home share and searches for the user's profile. As it turns out, you can specify the user's home share as a sharename and path. For example, \\server\fred\.winprofile. If the profiles are found, they are implemented.

    7. - The client then disconnects from the user's home share, and reconnects to + The client then disconnects from the user's home share and reconnects to the NetLogon share and looks for CONFIG.POL, the policies file. If this is found, it is read and implemented.

    -The main difference between a PDC and a Windows 9x logon server configuration is that +The main difference between a PDC and a Windows 9x/Me logon server configuration is:

    • - Password encryption is not required for a Windows 9x logon server. But note + Password encryption is not required for a Windows 9x/Me logon server. But note that beginning with MS Windows 98 the default setting is that plain-text password support is disabled. It can be re-enabled with the registry - changes that are documented in the chapter on Policies. + changes that are documented in .

    • - Windows 9x/ME clients do not require and do not use machine trust accounts. + Windows 9x/Me clients do not require and do not use Machine Trust Accounts.

    -A Samba PDC will act as a Windows 9x logon server; after all, it does provide the -network logon services that MS Windows 9x / Me expect to find. +A Samba PDC will act as a Windows 9x/Me logon server; after all, it does provide the +network logon services that MS Windows 9x/Me expect to find.

    Note

    Use of plain-text passwords is strongly discouraged. Where used they are easily detected using a sniffer tool to examine network traffic. -

    Security Mode and Master Browsers

    -There are a few comments to make in order to tie up some -loose ends. There has been much debate over the issue of whether -or not it is ok to configure Samba as a Domain Controller in security -modes other than USER. The only security mode -which will not work due to technical reasons is SHARE -mode security. DOMAIN and SERVER -mode security are really just a variation on SMB user level security. +

    Security Mode and Master Browsers

    +There are a few comments to make in order to tie up some loose ends. There has been +much debate over the issue of whether it is okay to configure Samba as a Domain +Controller in security modes other than user. The only security mode that will +not work due to technical reasons is share-mode security. Domain and server mode +security are really just a variation on SMB User Level Security.

    Actually, this issue is also closely tied to the debate on whether -or not Samba must be the domain master browser for its workgroup -when operating as a DC. While it may technically be possible +Samba must be the Domain Master Browser for its workgroup +when operating as a DC. While it may technically be possible to configure a server as such (after all, browsing and domain logons are two distinctly different functions), it is not a good idea to do -so. You should remember that the DC must register the DOMAIN<#1b> NetBIOS -name. This is the name used by Windows clients to locate the DC. +so. You should remember that the DC must register the DOMAIN<#1b> NetBIOS +name. This is the name used by Windows clients to locate the DC. Windows clients do not distinguish between the DC and the DMB. -A DMB is a Domain Master Browser - see Domain Master Browser. -For this reason, it is very wise to configure the Samba DC as the DMB. -

    -Now back to the issue of configuring a Samba DC to use a mode other -than security = user. If a Samba host is configured to use -another SMB server or DC in order to validate user connection -requests, then it is a fact that some other machine on the network -(the password server) knows more about the user than the Samba host. -99% of the time, this other host is a domain controller. Now -in order to operate in domain mode security, the workgroup parameter -must be set to the name of the Windows NT domain (which already -has a domain controller). If the domain does NOT already have a Domain Controller -then you do not yet have a Domain! +A DMB is a Domain Master Browser see . +For this reason, it is wise to configure the Samba DC as the DMB. +

    +Now back to the issue of configuring a Samba DC to use a mode other than +security = user. If a Samba host is +configured to use another SMB server or DC in order to validate user connection requests, +it is a fact that some other machine on the network (the password server) +knows more about the user than the Samba host. About 99% of the time, this other host is +a Domain Controller. Now to operate in domain mode security, the workgroup +parameter must be set to the name of the Windows NT domain (which already has a Domain Controller). +If the domain does not already have a Domain Controller, you do not yet have a Domain.

    Configuring a Samba box as a DC for a domain that already by definition has a PDC is asking for trouble. Therefore, you should always configure the Samba DC -to be the DMB for its domain and set security = user. +to be the DMB for its domain and set security = user. This is the only officially supported mode of operation. -

    Common Errors

    '$' cannot be included in machine name

    -A 'machine account', (typically) stored in /etc/passwd, -takes the form of the machine name with a '$' appended. FreeBSD (and other BSD -systems?) won't create a user with a '$' in their name. +

    Common Errors

    “$” Cannot Be Included in Machine Name

    +A machine account, typically stored in /etc/passwd, takes the form of the machine +name with a “$” appended. FreeBSD (and other BSD systems) will not create a user with a +“$” in the name.

    The problem is only in the program used to make the entry. Once made, it works perfectly. -Create a user without the '$'. Then use vipw to edit the entry, adding -the '$'. Or create the whole entry with vipw if you like; make sure you use a unique User ID! -

    Note

    -The UNIX tool vipw is a common tool for directly editting the /etc/passwd file. -

    Joining domain fails because of existing machine account

    “I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.”

    -This happens if you try to create a machine trust account from the -machine itself and already have a connection (e.g. mapped drive) -to a share (or IPC$) on the Samba PDC. The following command +Create a user without the “$”. Then use vipw to edit the entry, adding +the “$”. Or create the whole entry with vipw if you like; make sure you use a unique user login ID. +

    Note

    The machine account must have the exact name that the workstation has.

    Note

    +The UNIX tool vipw is a common tool for directly editing the /etc/passwd file. +

    Joining Domain Fails Because of Existing Machine Account

    +“I get told, `You already have a connection to the Domain....' or `Cannot join domain, the +credentials supplied conflict with an existing set...' when creating a Machine Trust Account.” +

    +This happens if you try to create a Machine Trust Account from the machine itself and already have a +connection (e.g., mapped drive) to a share (or IPC$) on the Samba PDC. The following command will remove all network drive connections: 

     C:\> net use * /d

    -Further, if the machine is already a 'member of a workgroup' that +

    +Further, if the machine is already a “member of a workgroup” that is the same name as the domain you are joining (bad idea) you will -get this message. Change the workgroup name to something else, it +get this message. Change the workgroup name to something else, it does not matter what, reboot, and try again. -

    The system can not log you on (C000019B)....

    “I joined the domain successfully but after upgrading -to a newer version of the Samba code I get the message, The system -can not log you on (C000019B), Please try again or consult your -system administrator when attempting to logon.” +

    The System Cannot Log You On (C000019B)

    “I joined the domain successfully but after upgrading +to a newer version of the Samba code I get the message, `The system +cannot log you on (C000019B), Please try again or consult your +system administrator when attempting to logon.'”

    + This occurs when the domain SID stored in the secrets.tdb database is changed. The most common cause of a change in domain SID is when the domain name and/or the server name (NetBIOS name) is changed. @@ -1151,141 +1152,142 @@ The only way to correct the problem is to restore the original domain SID or remove the domain client from the domain and rejoin. The domain SID may be reset using either the net or rpcclient utilities.

    -The reset or change the domain SID you can use the net command as follows: +To reset or change the domain SID you can use the net command as follows: 

     root# net getlocalsid 'OLDNAME'
 root# net setlocalsid 'SID'

    -Workstation machine trust accounts work only with the Domain (or network) SID. If this SID changes -then domain members (workstations) will not be able to log onto the domain. The original Domain SID +Workstation Machine Trust Accounts work only with the Domain (or network) SID. If this SID changes +Domain Members (workstations) will not be able to log onto the domain. The original Domain SID can be recovered from the secrets.tdb file. The alternative is to visit each workstation to re-join it to the domain. -

    The machine trust account not accessible

    - “When I try to join the domain I get the message The machine account -for this computer either does not exist or is not accessible. What's +

    The Machine Trust Account Is Not Accessible

    +“When I try to join the domain I get the message, `The machine account +for this computer either does not exist or is not accessible'. What's wrong?”

    -This problem is caused by the PDC not having a suitable machine trust account. -If you are using the add machine script method to create +This problem is caused by the PDC not having a suitable Machine Trust Account. +If you are using the add machine script method to create accounts then this would indicate that it has not worked. Ensure the domain admin user system is working.

    -Alternatively if you are creating account entries manually then they +Alternately, if you are creating account entries manually then they have not been created correctly. Make sure that you have the entry -correct for the machine trust account in smbpasswd file on the Samba PDC. +correct for the Machine Trust Account in smbpasswd file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, make sure that the account name is the machine NetBIOS name -with a '$' appended to it ( i.e. computer_name$ ). There must be an entry +with a “$” appended to it (i.e., computer_name$). There must be an entry in both /etc/passwd and the smbpasswd file.

    -Some people have also reported -that inconsistent subnet masks between the Samba server and the NT -client can cause this problem. Make sure that these are consistent -for both client and server. -

    Account disabled

    “When I attempt to login to a Samba Domain from a NT4/W2K workstation, - I get a message about my account being disabled.”

    +Some people have also reported that inconsistent subnet masks between the Samba server and the NT +client can cause this problem. Make sure that these are consistent for both client and server. +

    Account Disabled

    “When I attempt to login to a Samba Domain from a NT4/W200x workstation, +I get a message about my account being disabled.”

    Enable the user accounts with smbpasswd -e username -, this is normally done as an account is created. -

    Domain Controller Unavailable

    “Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"”

    - A domain controller has to announce on the network who it is. This usually takes a while. -

    Can not log onto domain member workstation after joining domain

    After successfully joining the domain user logons fail with one of two messages:

    One to the effect that the domain controller can not be found, the other claiming that the - account does not exist in the domain or that the password is incorrect.

    This may be due to incompatible settings between - the Windows client and the Samba-3 server for schannel (secure channel) settings - or smb signing settings. Check your samba settings for - client schannel, server schannel, client signing, server signing by executing: - testparm -v | more and looking for the value of these parameters. -

    - Also use the Microsoft Management Console - Local Security Settings. This tool is available from the - Control Panel. The Policy settings are found in the Local Policies / Securty Options area and are prefixed by - Secure Channel: ..., and Digitally sign .... -

    - It is important that these be set consistently with the Samba-3 server settings. -


    [1] See also the chapter on Account Information Databases.

    [2] See also the chapter about network browsing

    Chapter 6. Backup Domain Control

    John H. Terpstra

    Samba Team

    Volker Lendecke

    Samba Team

    Table of Contents

    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?

    -Before you continue reading in this section, please make sure that you are comfortable -with configuring a Samba Domain Controller as described in chapter on setting up Samba as a PDC. -

    Features And Benefits

    -This is one of the most difficult chapters to summarise. It does not matter what we say here -for someone will still draw conclusions and / or approach the Samba-Team with expectations +. This is normally done as an account is created. +

    Domain Controller Unavailable

    “Until a few minutes after Samba has started, clients get the error `Domain Controller Unavailable'”

    +A Domain Controller has to announce its role on the network. This usually takes a while. Be patient for up to fifteen minutes, +then try again. +

    Cannot Log onto Domain Member Workstation After Joining Domain

    + + +After successfully joining the domain, user logons fail with one of two messages: one to the +effect that the Domain Controller cannot be found; the other claims that the account does not +exist in the domain or that the password is incorrect. This may be due to incompatible +settings between the Windows client and the Samba-3 server for schannel +(secure channel) settings or smb signing settings. Check your Samba +settings for client schannel, server schannel, client signing, server signing +by executing: +

    +testparm -v | more and looking for the value of these parameters.
+

    +

    +Also use the Microsoft Management Console Local Security Settings. This tool is available from the +Control Panel. The Policy settings are found in the Local Policies/Securty Options area and are prefixed by +Secure Channel: ..., and Digitally sign ..... +

    +It is important that these be set consistently with the Samba-3 server settings. +


    [2] See , and + .

    Chapter 6. Backup Domain Control

    John H. Terpstra

    Samba Team

    Volker Lendecke

    Samba Team

    Guenther Deschner

    LDAP updates
    SuSE

    Table of Contents

    Features and Benefits
    Essential Background Information
    MS Windows NT4-style Domain Control
    LDAP Configuration Notes
    Active Directory Domain Control
    What Qualifies a Domain Controller on the Network?
    How does a Workstation find its Domain Controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts Keep Expiring
    Can Samba Be a Backup Domain Controller to an NT4 PDC?
    How Do I Replicate the smbpasswd File?
    Can I Do This All with LDAP?

    +Before you continue reading this section, please make sure that you are comfortable +with configuring a Samba Domain Controller as described in . +

    Features and Benefits

    +This is one of the most difficult chapters to summarize. It does not matter what we say here +for someone will still draw conclusions and/or approach the Samba Team with expectations that are either not yet capable of being delivered, or that can be achieved far more effectively using a totally different approach. In the event that you should have a persistent -concern that is not addressed in this book then please email -John H Terpstra clearly setting out your requirements -and / or question and we will do our best to provide a solution. +concern that is not addressed in this book, please email John H. Terpstra +clearly setting out your requirements and/or question and we will do our best to provide a solution.

    -Samba-3 is capable of acting as a Backup Domain Controller to another Samba Primary Domain -Controller. A Samba-3 PDC can operate with an LDAP Account backend. The LDAP backend can be + +Samba-3 is capable of acting as a Backup Domain Controller (BDC) to another Samba Primary Domain +Controller (PDC). A Samba-3 PDC can operate with an LDAP Account backend. The LDAP backend can be either a common master LDAP server, or a slave server. The use of a slave LDAP server has the -benefit that when the master is down clients may still be able to log onto the network. -This effectively gives samba a high degree of scalability iand is a very sweet (nice) solution -for large organisations. +benefit that when the master is down, clients may still be able to log onto the network. +This effectively gives Samba a high degree of scalability and is an effective solution +for large organizations. Do not use an LDAP slave server for a PDC, this may cause serious +stability and operational problems.

    + While it is possible to run a Samba-3 BDC with non-LDAP backend, the administrator will -need to figure out precisely what is the best way to replicate (copy / distribute) the -user and machine Accounts backend. +need to figure out precisely what is the best way to replicate (copy/distribute) the +user and machine accounts' backend.

    -The use of a non-LDAP backend SAM database is particularly problematic because Domain member -servers and workstations periodically change the machine trust account password. The new + +The use of a non-LDAP backend SAM database is particularly problematic because Domain Member +servers and workstations periodically change the Machine Trust Account password. The new password is then stored only locally. This means that in the absence of a centrally stored -accounts database (such as that provided with an LDAP based solution) if Samba-3 is running -as a BDC, the BDC instance of the Domain member trust account password will not reach the -PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs this results in -overwriting of the SAM that contains the updated (changed) trust account password with resulting +accounts database (such as that provided with an LDAP-based solution) if Samba-3 is running +as a BDC, the BDC instance of the Domain Member trust account password will not reach the +PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs, this results in +overwriting the SAM that contains the updated (changed) trust account password with resulting breakage of the domain trust.

    -Considering the number of comments and questions raised concerning how to configure a BDC -lets consider each possible option and look at the pro's and con's for each theoretical solution: -

    Backup Domain Backend Account Distribution Options

    • - Solution: Passwd Backend is LDAP based, BDCs use a slave LDAP server -

      - Arguments For: This is a neat and manageable solution. The LDAP based SAM (ldapsam) - is constantly kept up to date. -

      - Arguments Against: Complexity -

    • - Passdb Backend is tdbsam based, BDCs use cron based net rpc vampire to - obtain the Accounts database from the PDC and place them into the Samba SAM. - net rpc vampire is a Samba function of the "net" command. -

      - Arguments For: It would be a nice solution -

      - Arguments Against: It does not work because Samba-3 does not support the required - protocols. This may become a later feature but is not available today. -

    • - Make use of rsync to replicate (pull down) copies of the essential account files -

      - Arguments For: It is a simple solution, easy to set up as a scheduled job -

      - Arguments Against: This will over-write the locally changed machine trust account - passwords. This is a broken and flawed solution. Do NOT do this. -

    • - Operate with an entirely local accounts database (not recommended) -

      - Arguments For: Simple, easy to maintain -

      - Arguments Against: All machine trust accounts and user accounts will be locally - maintained. Domain users will NOT be able to roam from office to office. This is - a broken and flawed solution. Do NOT do this. -

    Essential Background Information

    +Considering the number of comments and questions raised concerning how to configure a BDC, +let's consider each possible option and look at the pros and cons for each possible solution. + lists possible design configurations for a PDC/BDC infrastructure. + + + + +

    Table 6.1. Domain Backend Account Distribution Options

    PDC BackendBDC BackendNotes/Discussion

    Master LDAP Server

    Slave LDAP Server

    The optimal solution that provides high integrity. The SAM will be + replicated to a common master LDAP server.

    Single Central LDAP Server

    Single Central LDAP Server

    + A workable solution without fail-over ability. This is a useable solution, but not optimal. +

    tdbsam

    tdbsam + net rpc vampire

    + Does not work with Samba-3.0.0; may be implemented in a later release. The downside of this solution + is that an external process will control account database integrity. This solution may appeal to sites + that wish to avoid the complexity of LDAP. The net rpc vampire is used to + synchronize domain accounts from the PDC to the BDC. +

    tdbsam

    tdbsam + rsync

    + Do not use this configuration. + Does not work because the TDB files are live and data may not have been flushed to disk. + Use rsync to synchronize the TDB database files from the PDC to the BDC. +

    smbpasswd file

    smbpasswd file

    + Do not use this configuration. + Not an elegant solution due to the delays in synchronization. + Use rsync to synchronize the TDB database files from the PDC to the BDC. + Can be made to work using a cron job to synchronize data from the PDC to the BDC. +

    Essential Background Information

    A Domain Controller is a machine that is able to answer logon requests from network workstations. Microsoft LanManager and IBM LanServer were two early products that provided this capability. The technology has become known as the LanMan Netlogon service.

    -When MS Windows NT3.10 was first released, it supported an new style of Domain Control +When MS Windows NT3.10 was first released, it supported a new style of Domain Control and with it a new form of the network logon service that has extended functionality. This service became known as the NT NetLogon Service. The nature of this service has -changed with the evolution of MS Windows NT and today provides a very complex array of -services that are implemented over a complex spectrum of technologies. -

    MS Windows NT4 Style Domain Control

    -Whenever a user logs into a Windows NT4 / 200x / XP Professional Workstation, -the workstation connects to a Domain Controller (authentication server) to validate -the username and password that the user entered are valid. If the information entered -does not validate against the account information that has been stored in the Domain -Control database (the SAM, or Security Account Manager database) then a set of error +changed with the evolution of MS Windows NT and today provides a complex array of +services that are implemented over an intricate spectrum of technologies. +

    MS Windows NT4-style Domain Control

    +Whenever a user logs into a Windows NT4/200x/XP Professional Workstation, +the workstation connects to a Domain Controller (authentication server) to validate that +the username and password the user entered are valid. If the information entered +does not match account information that has been stored in the Domain +Control database (the SAM, or Security Account Manager database), a set of error codes is returned to the workstation that has made the authentication request.

    -When the username / password pair has been validated, the Domain Controller +When the username/password pair has been validated, the Domain Controller (authentication server) will respond with full enumeration of the account information that has been stored regarding that user in the User and Machine Accounts database for that Domain. This information contains a complete network access profile for @@ -1296,9 +1298,10 @@ network access time limits, account validity information, machine names from whi user may access the network, and much more. All this information was stored in the SAM in all versions of MS Windows NT (3.10, 3.50, 3.51, 4.0).

    + The account information (user and machine) on Domain Controllers is stored in two files, one containing the Security information and the other the SAM. These are stored in files -by the same name in the C:\WinNT\System32\config directory. These +by the same name in the C:\Windows NT\System32\config directory. These are the files that are involved in replication of the SAM database where Backup Domain Controllers are present on the network.

    @@ -1310,139 +1313,240 @@ There are two situations in which it is desirable to install Backup Domain Contr

  • At each remote site, to reduce wide area network traffic and to add stability to remote network operations. The design of the network, the strategic placement of - Backup Domain Controllers, together with an implementation that localises as much - of network to client interchange as possible will help to minimise wide area network + Backup Domain Controllers, together with an implementation that localizes as much + of network to client interchange as possible will help to minimize wide area network bandwidth needs (and thus costs).

    • -The PDC contains the master copy of the SAM. In the event that an administrator makes a -change to the user account database while physically present on the local network that -has the PDC, the change will likely be made directly to the PDC instance of the master -copy of the SAM. In the event that this update may be performed in a branch office the -change will likely be stored in a delta file on the local BDC. The BDC will then send -a trigger to the PDC to commence the process of SAM synchronisation. The PDC will then -request the delta from the BDC and apply it to the master SAM. The PDC will then contact -all the BDCs in the Domain and trigger them to obtain the update and then apply that to -their own copy of the SAM. -

    -Thus the BDC is said to hold a read-only of the SAM from which -it is able to process network logon requests and to authenticate users. The BDC can +The inter-operation of a PDC and its BDCs in a true Windows NT4 environemt is worth +mentioning here. The PDC contains the master copy of the SAM. In the event that an +administrator makes a change to the user account database while physically present +on the local network that has the PDC, the change will likely be made directly to +the PDC instance of the master copy of the SAM. In the event that this update may +be performed in a branch office, the change will likely be stored in a delta file +on the local BDC. The BDC will then send a trigger to the PDC to commence the process +of SAM synchronization. The PDC will then request the delta from the BDC and apply +it to the master SAM. The PDC will then contact all the BDCs in the Domain and +trigger them to obtain the update and then apply that to their own copy of the SAM. +

    +Samba-3 can not participate in true SAM replication and is therefore not able to +employ precisely the same protocols used by MS Windows NT4. A Samba-3 BDC will +not create SAM update delta files. It will not inter-operate with a PDC (NT4 or Samba) +to synchronize the SAM from delta files that are held by BDCs. +

    +Samba-3 cannot function as a BDC to an MS Windows NT4 PDC, and Samba-3 can not +function correctly as a PDC to an MS Windows NT4 BDC. Both Samba-3 and MS Windows +NT4 can function as a BDC to its own type of PDC. +

    +The BDC is said to hold a read-only of the SAM from which +it is able to process network logon requests and authenticate users. The BDC can continue to provide this service, particularly while, for example, the wide area -network link to the PDC is down. Thus a BDC plays a very important role in both -maintenance of Domain security as well as in network integrity. -

    -In the event that the PDC should need to be taken out of service, or if it dies, then -one of the BDCs can be promoted to a PDC. If this happens while the original PDC is on -line then it is automatically demoted to a BDC. This is an important aspect of Domain -Controller management. The tool that is used to affect a promotion or a demotion is the -Server Manager for Domains. -

    Example PDC Configuration

    -Since version 2.2 Samba officially supports domain logons for all current Windows Clients, -including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some -parameters in the [global]-section of the smb.conf have to be set: -

    Example 6.1. Minimal smb.conf for being a PDC

    workgroup = MIDEARTH
    domain master = yes
    domain logons = yes

    +network link to the PDC is down. A BDC plays a very important role in both the +maintenance of Domain Security as well as in network integrity. +

    +In the event that the NT4 PDC should need to be taken out of service, or if it dies, +one of the NT4 BDCs can be promoted to a PDC. If this happens while the original NT4 PDC is on +line, it is automatically demoted to an NT4 BDC. This is an important aspect of Domain +Controller management. The tool that is used to effect a promotion or a demotion is the +Server Manager for Domains. It should be noted that Samba-3 BDCs can not be promoted +in this manner because reconfiguration of Samba requires changes to the smb.conf file. +

    Example PDC Configuration

    +Beginning with Version 2.2, Samba officially supports domain logons for all current Windows clients, +including Windows NT4, 2003 and XP Professional. For Samba to be enabled as a PDC, some +parameters in the [global]-section of the smb.conf have to be set. +Refer to for an example of the minimum required settings. +

    Example 6.1. Minimal smb.conf for a PDC in Use With a BDC LDAP Server on PDC.

    workgroup = MIDEARTH
    passdb backend = ldapsam://localhost:389
    domain master = yes
    domain logons = yes

    Several other things like a [homes] and a [netlogon] share also need to be set along with -settings for the profile path, the users home drive, etc.. This will not be covered in this -chapter, for more information please refer to the chapter about samba as a PDC. -

    Active Directory Domain Control

    +settings for the profile path, the user's home drive, and so on. This is not covered in this +chapter; for more information please refer to . +

    LDAP Configuration Notes

    +When configuring a master and a slave LDAP server, it is advisable to use the master LDAP server +for the PDC and slave LDAP servers for the BDCs. It is not essential to use slave LDAP servers, however, +many administrators will want to do so in order to provide redundant services. Of course, one or more BDCs +may use any slave LDAP server. Then again, it is entirely possible to use a single LDAP server for the +entire network. +

    +When configuring a master LDAP server that will have slave LDAP servers, do not forget to configure +this in the /etc/openldap/slapd.conf file. It must be noted that the DN of a +server certificate must use the CN attribute to name the server, and the CN must carry the servers' +fully qualified domain name. Additional alias names and wildcards may be present in the +subjectAltName certificate extension. More details on server certificate names are in RFC2830. +

    +It does not really fit within the scope of this document, but a working LDAP installation is +basic to LDAP enabled Samba operation. When using an OpenLdap server with Transport Layer Security +(TLS), the machine name in /etc/ssl/certs/slapd.pem must be the +same as in /etc/openldap/sldap.conf. The Red Hat Linux startup script +creates the slapd.pem file with hostname “localhost.localdomain.” +It is impossible to access this LDAP server from a slave LDAP server (i.e., a Samba BDC) unless the +certificate is recreated with a correct hostname. +

    +Do not install a Samba PDC on a OpenLDAP slave server. Joining client machines to the domain +will fail in this configuration because the change to the machine account in the LDAP tree +must take place on the master LDAP server. This is not replicated rapidly enough to the slave +server that the PDC queries. It therfore gives an error message on the client machine about +not being able to set up account credentials. The machine account is created on the LDAP server +but the password fields will be empty. +

    +Possible PDC/BDC plus LDAP configurations include: +

    • + PDC+BDC -> One Central LDAP Server. +

    • + PDC -> LDAP master server, BDC -> LDAP slave server. +

    • + PDC -> LDAP master, with secondary slave LDAP server. +

      + BDC -> LDAP master, with secondary slave LDAP server. +

    • + PDC -> LDAP master, with secondary slave LDAP server. +

      + BDC -> LDAP slave server, with secondary master LDAP server. +

    +In order to have a fall-back configuration (secondary) LDAP server one would specify +the secondary LDAP server in the smb.conf file as shown in . +

    +

    Example 6.2. Multiple LDAP Servers in smb.conf

    ...
    passdb backend = ldapsam:ldap://master.quenya.org
    ldapsam:ldap://slave.quenya.org
    ...

    +

    Active Directory Domain Control

    As of the release of MS Windows 2000 and Active Directory, this information is now stored in a directory that can be replicated and for which partial or full administrative control -can be delegated. Samba-3 is NOT able to be a Domain Controller within an Active Directory -tree, and it can not be an Active Directory server. This means that Samba-3 also can NOT +can be delegated. Samba-3 is not able to be a Domain Controller within an Active Directory +tree, and it cannot be an Active Directory server. This means that Samba-3 also cannot act as a Backup Domain Controller to an Active Directory Domain Controller. -

    What qualifies a Domain Controller on the network?

    -Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS -group name SAMBA<#1c> with the WINS server and/or by broadcast on the local network. -The PDC also registers the unique NetBIOS name SAMBA<#1b> with the WINS server. +

    What Qualifies a Domain Controller on the Network?

    +Every machine that is a Domain Controller for the domain MIDEARTH has to register the NetBIOS +group name MIDEARTH<#1c> with the WINS server and/or by broadcast on the local network. +The PDC also registers the unique NetBIOS name MIDEARTH<#1b> with the WINS server. The name type <#1b> name is normally reserved for the Domain Master Browser, a role that has nothing to do with anything related to authentication, but the Microsoft Domain -implementation requires the domain master browser to be on the same machine as the PDC. -

    How does a Workstation find its domain controller?

    -An MS Windows NT4 / 200x / XP Professional workstation in the domain SAMBA that wants a -local user to be authenticated has to find the domain controller for SAMBA. It does this -by doing a NetBIOS name query for the group name SAMBA<#1c>. It assumes that each -of the machines it gets back from the queries is a domain controller and can answer logon -requests. To not open security holes both the workstation and the selected domain controller +implementation requires the Domain Master Browser to be on the same machine as the PDC. +

    +Where a WINS server is not used, broadcast name registrations alone must suffice. Refer to + for more information regarding TCP/IP network protocols and how + SMB/CIFS names are handled. +

    How does a Workstation find its Domain Controller?

    +There are two different mechanisms to locate a domain controller, one method is used when +NetBIOS over TCP/IP is enabled and the other when it has been disabled in the TCP/IP +network configuration. +

    +Where NetBIOS over TCP/IP is disabled, all name resolution involves the use of DNS, broadcast +messaging over UDP, as well as Active Directory communication technologies. In this type of +environment all machines require appropriate DNS entries. More information may be found in +. +

    NetBIOS Over TCP/IP Enabled

    +An MS Windows NT4/200x/XP Professional workstation in the domain MIDEARTH that wants a +local user to be authenticated has to find the Domain Controller for MIDEARTH. It does this +by doing a NetBIOS name query for the group name MIDEARTH<#1c>. It assumes that each +of the machines it gets back from the queries is a Domain Controller and can answer logon +requests. To not open security holes, both the workstation and the selected Domain Controller authenticate each other. After that the workstation sends the user's credentials (name and -password) to the local Domain Controller, for validation. -

    Backup Domain Controller Configuration

    -Several things have to be done: +password) to the local Domain Controller for validation. +

    NetBIOS Over TCP/IP Disabled

    +An MS Windows NT4/200x/XP Professional workstation in the realm quenya.org +that has a need to affect user logon authentication will locate the Domain Controller by +requerying DNS servers for the _ldap._tcp.pdc.ms-dcs.quenya.org record. +More information regarding this subject may be found in . +

    Backup Domain Controller Configuration

    +The creation of a BDC requires some steps to prepare the Samba server before +smbd is executed for the first time. These steps are outlines as follows: +

    • - The domain SID has to be the same on the PDC and the BDC. This used to - be stored in the file private/MACHINE.SID. This file is not created - since Samba 2.2.5. Nowadays the domain SID is stored in the file - private/secrets.tdb. Simply copying the secrets.tdb - from the PDC to the BDC does not work, as the BDC would - generate a new SID for itself and override the domain SID with this - new BDC SID.

      + The domain SID has to be the same on the PDC and the BDC. In Samba versions + pre-2.2.5, the domain SID was stored in the file private/MACHINE.SID. + The domain SID is now stored in the file private/secrets.tdb. This file + is unique to each server and can not be copied from a PDC to a BDC, the BDC will generate + a new SID at start-up. It will over-write the PDC domain SID with the newly created BDC SID. + There is a procedure that will allow the BDC to aquire the Domain SID. This is described here. +

      To retrieve the domain SID from the PDC or an existing BDC and store it in the - secrets.tdb, execute: + secrets.tdb, execute: 

       root# net rpc getsid

    • + Specification of the ldap admin dn is obligatory. + This also requires the LDAP administration password to be set in the secrets.tdb + using the smbpasswd -w mysecret. +

    • + Either ldap suffix or + ldap idmap suffix must be specified in + the smb.conf file. +

    • + The UNIX user database has to be synchronized from the PDC to the - BDC. This means that both the /etc/passwd and /etc/group have to be - replicated from the PDC to the BDC. This can be done manually - whenever changes are made, or the PDC is set up as a NIS master - server and the BDC as a NIS slave server. To set up the BDC as a - mere NIS client would not be enough, as the BDC would not be able to - access its user database in case of a PDC failure. NIS is by no means - the only method to synchronize passwords. An LDAP solution would work - as well. -

    • - The Samba password database has to be replicated from the PDC to the BDC. - As said above, though possible to synchronise the smbpasswd - file with rsync and ssh, this method is broken and flawed, and is - therefore not recommended. A better solution is to set up slave LDAP - servers for each BDC and a master LDAP server for the PDC. -

    • - Any netlogon share has to be replicated from the PDC to the + BDC. This means that both the /etc/passwd and + /etc/group have to be replicated from the PDC + to the BDC. This can be done manually whenever changes are made. + Alternately, the PDC is set up as an NIS master server and the BDC as an NIS slave + server. To set up the BDC as a mere NIS client would not be enough, + as the BDC would not be able to access its user database in case of + a PDC failure. NIS is by no means the only method to synchronize + passwords. An LDAP solution would also work. +

    • + The Samba password database must be replicated from the PDC to the BDC. + Although it is possible to synchronize the smbpasswd + file with rsync and ssh, this method + is broken and flawed, and is therefore not recommended. A better solution + is to set up slave LDAP servers for each BDC and a master LDAP server for the PDC. +

    • + The netlogon share has to be replicated from the PDC to the BDC. This can be done manually whenever login scripts are changed, - or it can be done automatically together with the smbpasswd - synchronization. -

    Example Configuration

    -Finally, the BDC has to be found by the workstations. This can be done by setting: -

    Example 6.2. Minimal setup for being a BDC

    workgroup = MIDEARTH
    domain master = no
    domain logons = yes
    idmap backend = ldapsam://slave-ldap.quenya.org

    + or it can be done automatically using a cron job + that will replicate the directory structure in this share using a tool + like rsync. +

    Example Configuration

    +Finally, the BDC has to be found by the workstations. This can be done by setting Samba as shown in . +

    Example 6.3. Minimal setup for being a BDC

    workgroup = MIDEARTH
    passdb backend = ldapsam:ldap://slave-ldap.quenya.org
    domain master = no
    domain logons = yes
    idmap backend = ldapsam:ldap://slave-ldap.quenya.org

    In the [global]-section of the smb.conf of the BDC. This makes the BDC only register the name SAMBA<#1c> with the WINS server. This is no problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to be registered by more than one machine. The parameter -domain master = no +domain master = no forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS name is reserved for the Primary Domain Controller.

    + + The idmap backend will redirect the winbindd utility to use the LDAP database to resolve all UIDs and GIDs for UNIX accounts.

    Note

    + Samba-3 has introduced a new ID mapping facility. One of the features of this facility is that it -allows greater flexibility in how user and group IDs are handled in respect of NT Domain User and Group -SIDs. One of the new facilities provides for explicitly ensuring that UNIX / Linux UID and GID values +allows greater flexibility in how user and group IDs are handled in respect to NT Domain User and Group +SIDs. One of the new facilities provides for explicitly ensuring that UNIX/Linux UID and GID values will be consistent on the PDC, all BDCs and all Domain Member servers. The parameter that controls this is called idmap backend. Please refer to the man page for smb.conf for more information -regarding it's behaviour. Do NOT set this parameter except where an LDAP backend (ldapsam) is in use. -

    Common Errors

    -As this is a rather new area for Samba there are not many examples that we may refer to. Keep -watching for updates to this section. -

    Machine Accounts keep expiring, what can I do?

    -This problem will occur when occur when the passdb (SAM) files are copied from a central -server but the local Backup Domain Controllers. Local machine trust account password updates +regarding its behavior. +

    +The use of the idmap backend = ldap://master.quenya/org +option on a BDC only make sense where ldapsam is used on a PDC. The purpose for an LDAP based idmap backend is +also to allow a domain-member (without its own passdb backend) to use winbindd to resolve Windows network users +and groups to common UID/GIDs. In other words, this option is generally intended for use on BDCs and on Domain +Member servers. +

    Common Errors

    +As this is a rather new area for Samba, there are not many examples that we may refer to. +Updates will be published as they become available and may be found in later Samba releases or +from the Samba web site. +

    Machine Accounts Keep Expiring

    + +This problem will occur when the passdb (SAM) files are copied from a central +server but the local Backup Domain Controller is acting as a PDC. This results in the application of +Local Machine Trust Account password updates to the local SAM. Such updates are not copied back to the central server. The newer machine account password is then over -written when the SAM is copied from the PDC. The result is that the Domain member machine -on start up will find that it's passwords does not match the one now in the database and +written when the SAM is re-copied from the PDC. The result is that the Domain Member machine +on start up will find that its passwords do not match the one now in the database and since the startup security check will now fail, this machine will not allow logon attempts to proceed and the account expiry error will be reported.

    -The solution: use a more robust passdb backend, such as the ldapsam backend, setting up -an slave LDAP server for each BDC, and a master LDAP server for the PDC. -

    Can Samba be a Backup Domain Controller to an NT4 PDC?

    -With version 2.2, no. The native NT4 SAM replication protocols have not yet been fully -implemented. The Samba Team is working on understanding and implementing the protocols, -but this work has not been finished for Samba-3. -

    -Can I get the benefits of a BDC with Samba? Yes, but only to a Samba PDC. The main reason for implementing a -BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to -service logon requests whenever the PDC is down. -

    How do I replicate the smbpasswd file?

    +The solution is to use a more robust passdb backend, such as the ldapsam backend, setting up +a slave LDAP server for each BDC, and a master LDAP server for the PDC. +

    Can Samba Be a Backup Domain Controller to an NT4 PDC?

    + +No. The native NT4 SAM replication protocols have not yet been fully implemented. +

    +Can I get the benefits of a BDC with Samba? Yes, but only to a Samba PDC.The +main reason for implementing a BDC is availability. If the PDC is a Samba +machine, a second Samba machine can be set up to service logon requests whenever +the PDC is down. +

    How Do I Replicate the smbpasswd File?

    + Replication of the smbpasswd file is sensitive. It has to be done whenever changes to the SAM are made. Every user's password change is done in the smbpasswd file and has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary. @@ -1450,154 +1554,156 @@ has to be replicated to the BDC. So replicating the smbpasswd file very often is As the smbpasswd file contains plain text password equivalents, it must not be sent unencrypted over the wire. The best way to set up smbpasswd replication from the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport. -Ssh itself can be set up to accept only rsync transfer without requiring the user -to type a password. +ssh itself can be set up to accept only +rsync transfer without requiring the user to type a password.

    As said a few times before, use of this method is broken and flawed. Machine trust -accounts will go out of sync, resulting in a very broken domain. This method is +accounts will go out of sync, resulting in a broken domain. This method is not recommended. Try using LDAP instead. -

    Can I do this all with LDAP?

    -The simple answer is YES. Samba's pdb_ldap code supports binding to a replica +

    Can I Do This All with LDAP?

    +The simple answer is yes. Samba's pdb_ldap code supports binding to a replica LDAP server, and will also follow referrals and rebind to the master if it ever needs to make a modification to the database. (Normally BDCs are read only, so this will not occur often). -

    Chapter 7. Domain Membership

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails

    -Domain Membership is a subject of vital concern, Samba must be able to -participate as a member server in a Microsoft Domain security context, and +

    Chapter 7. Domain Membership

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Guenther Deschner

    LDAP updates
    SuSE

    Table of Contents

    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Managing Domain Machine Accounts using NT4 Server Manager
    On-the-Fly Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4-type Domain with Samba-3
    Why Is This Better Than security = server?
    Samba ADS Domain Membership
    Configure smb.conf
    Configure /etc/krb5.conf
    Create the Computer Account
    Testing Server Setup
    Testing with smbclient
    Notes
    Sharing User ID Mappings between Samba Domain Members
    Common Errors
    Cannot Add Machine Back to Domain
    Adding Machine to Domain Fails
    I Can't Join a Windows 2003 PDC

    +Domain Membership is a subject of vital concern. Samba must be able to +participate as a member server in a Microsoft Domain Security context, and Samba must be capable of providing Domain machine member trust accounts, -otherwise it would not be capable of offering a viable option for many users. +otherwise it would not be able to offer a viable option for many users.

    -This chapter covers background information pertaining to domain membership, -Samba configuration for it, and MS Windows client procedures for joining a -domain. Why is this necessary? Because both are areas in which there exists +This chapter covers background information pertaining to Domain Membership, +the Samba configuration for it, and MS Windows client procedures for joining a +domain. Why is this necessary? Because both are areas in which there exists within the current MS Windows networking world and particularly in the UNIX/Linux networking and administration world, a considerable level of -mis-information, incorrect understanding, and a lack of knowledge. Hopefully +misinformation, incorrect understanding and a lack of knowledge. Hopefully this chapter will fill the voids. -

    Features and Benefits

    -MS Windows workstations and servers that want to participate in domain security need to -be made Domain members. Participating in Domain security is often called +

    Features and Benefits

    +MS Windows workstations and servers that want to participate in Domain Security need to +be made Domain Members. Participating in Domain Security is often called Single Sign On or SSO for short. This chapter describes the process that must be followed to make a workstation -(or another server - be it an MS Windows NT4 / 200x -server) or a Samba server a member of an MS Windows Domain security context. +(or another server be it an MS Windows NT4 / 200x +server) or a Samba server a member of an MS Windows Domain Security context.

    -Samba-3 can join an MS Windows NT4 style domain as a native member server, an + +Samba-3 can join an MS Windows NT4-style domain as a native member server, an MS Windows Active Directory Domain as a native member server, or a Samba Domain -Control network. -

    -Domain membership has many advantages: +Control network. Domain Membership has many advantages:

    • - MS Windows workstation users get the benefit of SSO + + MS Windows workstation users get the benefit of SSO.

    • - Domain user access rights and file ownership / access controls can be set - from the single Domain SAM (Security Account Manager) database - (works with Domain member servers as well as with MS Windows workstations - that are domain members) + Domain user access rights and file ownership/access controls can be set + from the single Domain Security Account Manager (SAM) database + (works with Domain Member servers as well as with MS Windows workstations + that are Domain Members).

    • - Only MS Windows NT4 / 200x / XP Professional - workstations that are Domain members - can use network logon facilities + Only MS Windows NT4/200x/XP Professional + workstations that are Domain Members can use network logon facilities.

    • Domain Member workstations can be better controlled through the use of Policy files (NTConfig.POL) and Desktop Profiles.

    • Through the use of logon scripts, users can be given transparent access to network - applications that run off application servers + applications that run off application servers.

    • Network administrators gain better application and user access management abilities because there is no need to maintain user accounts on any network client or server, other than the central Domain database - (either NT4/Samba SAM style Domain, NT4 Domain that is back ended with an - LDAP directory, or via an Active Directory infrastructure) -

    MS Windows Workstation/Server Machine Trust Accounts

    -A machine trust account is an account that is used to authenticate a client -machine -(rather than a user) to the Domain Controller server. In Windows terminology, -this is known as a "Computer Account." -

    -The password of a machine trust account acts as the shared secret for -secure communication with the Domain Controller. This is a security + (either NT4/Samba SAM style Domain, NT4 Domain that is backended with an + LDAP directory, or via an Active Directory infrastructure). +

    MS Windows Workstation/Server Machine Trust Accounts

    + +A Machine Trust Account is an account that is used to authenticate a client +machine (rather than a user) to the Domain Controller server. In Windows terminology, +this is known as a “Computer Account.” The purpose of the machine account +is to prevent a rogue user and Domain Controller from colluding to gain access to a +domain member workstation. +

    +The password of a Machine Trust Account acts as the shared secret for +secure communication with the Domain Controller. This is a security feature to prevent an unauthorized machine with the same NetBIOS name from joining the domain and gaining access to domain user/group -accounts. Windows NT, 200x, XP Professional clients use machine trust -accounts, but Windows 9x / Me / XP Home clients do not. Hence, a -Windows 9x / Me / XP Home client is never a true member of a domain -because it does not possess a machine trust account, and thus has no -shared secret with the domain controller. +accounts. Windows NT/200x/XP Professional clients use machine trust +accounts, but Windows 9x/Me/XP Home clients do not. Hence, a +Windows 9x/Me/XP Home client is never a true member of a Domain +because it does not possess a Machine Trust Account, and, thus, has no +shared secret with the Domain Controller.

    -A Windows NT4 PDC stores each machine trust account in the Windows Registry. +A Windows NT4 PDC stores each Machine Trust Account in the Windows Registry. The introduction of MS Windows 2000 saw the introduction of Active Directory, -the new repository for machine trust accounts. -

    -A Samba PDC, however, stores each machine trust account in two parts, +the new repository for Machine Trust Accounts. A Samba PDC, however, stores +each Machine Trust Account in two parts, as follows:

    • A Domain Security Account (stored in the - passdb backend that has been configured in the + passdb backend that has been configured in the smb.conf file. The precise nature of the account information that is stored depends on the type of backend database that has been chosen.

      The older format of this data is the smbpasswd database - which contains the UNIX login ID, the UNIX user identifier (UID), and the + that contains the UNIX login ID, the UNIX user identifier (UID), and the LanMan and NT encrypted passwords. There is also some other information in this file that we do not need to concern ourselves with here.

      - The two newer database types are called ldapsam, - tdbsam. Both store considerably more data than the + The two newer database types are called ldapsam, and + tdbsam. Both store considerably more data than the older smbpasswd file did. The extra information - enables new user account controls to be used. + enables new user account controls to be implemented.

    • A corresponding UNIX account, typically stored in - /etc/passwd. Work is in progress to allow a + /etc/passwd. Work is in progress to allow a simplified mode of operation that does not require UNIX user accounts, but this may not be a feature of the early releases of Samba-3.

    -

    -There are three ways to create machine trust accounts: +

    + +There are three ways to create Machine Trust Accounts:

    • Manual creation from the UNIX/Linux command line. Here, both the Samba and corresponding UNIX account are created by hand.

    • - - Using the MS Windows NT4 Server Manager (either from an NT4 Domain member - server, or using the Nexus toolkit available from the Microsoft web site. - This tool can be run from any MS Windows machine so long as the user is + + Using the MS Windows NT4 Server Manager, either from an NT4 Domain Member + server, or using the Nexus toolkit available from the Microsoft Web site. + This tool can be run from any MS Windows machine as long as the user is logged on as the administrator account.

    • - "On-the-fly" creation. The Samba machine trust account is automatically + “On-the-fly” creation. The Samba Machine Trust Account is automatically created by Samba at the time the client is joined to the domain. (For security, this is the recommended method.) The corresponding UNIX account may be created automatically or manually. -

    Manual Creation of Machine Trust Accounts

    -The first step in manually creating a machine trust account is to manually +

    Manual Creation of Machine Trust Accounts

    +The first step in manually creating a Machine Trust Account is to manually create the corresponding UNIX account in /etc/passwd. -This can be done using vipw or another 'add user' command -that is normally used to create new UNIX accounts. The following is an example for a Linux based Samba server: - - - - +This can be done using vipw or another “add user” command +that is normally used to create new UNIX accounts. The following is an example for +a Linux-based Samba server:

    + + 

    -root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" \
+root# /usr/sbin/useradd -g machines -d /dev/null -c "machine nickname" \
    -s /bin/false machine_name$ 
 
 root# passwd -l machine_name$

    -

    - +

    In the above example above there is an existing system group “machines” which is used +as the primary group for all machine accounts. In the following examples the “machines” group has +numeric GID equal 100.

    + On *BSD systems, this can be done using the chpass utility: 

     root# chpass -a \
-  "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin"
+'machine_name$:*:101:100::0:0:Windows machine_name:/dev/null:/sbin/nologin'

    The /etc/passwd entry will list the machine name -with a "$" appended, won't have a password, will have a null shell and no -home directory. For example a machine named 'doppy' would have an +with a “$” appended, will not have a password, will have a null shell and no +home directory. For example, a machine named “doppy” would have an /etc/passwd entry like this: 

     doppy$:x:505:100:machine_nickname:/dev/null:/bin/false
@@ -1605,13 +1711,13 @@ doppy$:x:505:100:machine_nickname:/dev/null:
 Above, machine_nickname can be any
 descriptive name for the client, i.e., BasementComputer.
 machine_name absolutely must be the NetBIOS
-name of the client to be joined to the domain.  The "$" must be
+name of the client to be joined to the domain. The “$” must be
 appended to the NetBIOS name of the client or Samba will not recognize
-this as a machine trust account.
+this as a Machine Trust Account.
 
    
 Now that the corresponding UNIX account has been created, the next step is to create 
 the Samba account for the client containing the well-known initial 
-machine trust account password.  This can be done using the 
+Machine Trust Account password. This can be done using the 
 smbpasswd command 
 as shown here:
 
    
@@ -1620,267 +1726,282 @@ as shown here:

    where machine_name is the machine's NetBIOS -name. The RID of the new machine account is generated from the UID of +name. The RID of the new machine account is generated from the UID of the corresponding UNIX account.

    Join the client to the domain immediately

    - Manually creating a machine trust account using this method is the - equivalent of creating a machine trust account on a Windows NT PDC using - - the Server Manager. From the time at which the - account is created to the time which the client joins the domain and - changes the password, your domain is vulnerable to an intruder joining - your domain using a machine with the same NetBIOS name. A PDC inherently - trusts members of the domain and will serve out a large degree of user - information to such clients. You have been warned! -

    Using NT4 Server Manager to Add Machine Accounts to the Domain

    +Manually creating a Machine Trust Account using this method is the +equivalent of creating a Machine Trust Account on a Windows NT PDC using + +the Server Manager. From the time at which the +account is created to the time the client joins the domain and +changes the password, your domain is vulnerable to an intruder joining +your domain using a machine with the same NetBIOS name. A PDC inherently +trusts members of the domain and will serve out a large degree of user +information to such clients. You have been warned! +

    Managing Domain Machine Accounts using NT4 Server Manager

    +A working add machine script script is essential +for machine trust accounts to be automatically created. This applies no matter whether +one uses automatic account creation, or if one wishes to use the NT4 Domain Server Manager. +

    + If the machine from which you are trying to manage the domain is an -MS Windows NT4 workstation or MS Windows 200x / XP Professional -then the tool of choice is the package called SRVTOOLS.EXE. -When executed in the target directory this will unpack SrvMge.exe +MS Windows NT4 workstation or MS Windows 200x/XP Professional, +the tool of choice is the package called SRVTOOLS.EXE. +When executed in the target directory it will unpack SrvMgr.exe and UsrMgr.exe (both are domain management tools for MS Windows NT4 workstation).

    + If your workstation is a Microsoft Windows 9x/Me family product you should download the Nexus.exe package from the Microsoft web site. When executed from the target directory this will unpack the same tools but for use on this platform.

    Further information about these tools may be obtained from the following locations: -http://support.microsoft.com/default.aspx?scid=kb;en-us;173673 -http://support.microsoft.com/default.aspx?scid=kb;en-us;172540 +

    +

    http://support.microsoft.com/default.aspx?scid=kb;en-us;173673
    http://support.microsoft.com/default.aspx?scid=kb;en-us;172540

    Launch the srvmgr.exe (Server Manager for Domains) and follow these steps:

    Procedure 7.1. Server Manager Account Machine Account Management

    1. - From the menu select Computer + From the menu select Computer.

    2. - Click on Select Domain + Click Select Domain.

    3. - Click on the name of the domain you wish to administer in the + Click the name of the domain you wish to administer in the Select Domain panel and then click OK.

    4. - Again from the menu select Computer + Again from the menu select Computer.

    5. - Select Add to Domain + Select Add to Domain.

    6. - In the dialog box, click on the radio button to + In the dialog box, click the radio button to Add NT Workstation of Server, then - enter the machine name in the field provided, then click the + enter the machine name in the field provided, and click the Add button. -

    "On-the-Fly" Creation of Machine Trust Accounts

    -The second (and recommended) way of creating machine trust accounts is +

    On-the-Fly Creation of Machine Trust Accounts

    +The second (and recommended) way of creating Machine Trust Accounts is simply to allow the Samba server to create them as needed when the client is joined to the domain. -

    Since each Samba machine trust account requires a corresponding UNIX account, a method +

    Since each Samba Machine Trust Account requires a corresponding UNIX account, a method for automatically creating the UNIX account is usually supplied; this requires configuration of the -add machine script option in -smb.conf. This method is not required, however; corresponding UNIX +add machine script option in smb.conf. This method is not required, however, corresponding UNIX accounts may also be created manually.

    -Below is an example for a RedHat Linux system. -

    [global]
    # <...remainder of parameters...>
    add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u

    Making an MS Windows Workstation or Server a Domain Member

    -The procedure for making an MS Windows workstation of server a member of the domain varies -with the version of Windows: -

    Windows 200x XP Professional

    - When the user elects to make the client a domain member, Windows 200x prompts for +Here is an example for a Red Hat Linux system. +

    [global]
    # <...remainder of parameters...>
    add machine script = /usr/sbin/useradd -d /dev/null -g 100 \
    -s /bin/false -M %u

    Making an MS Windows Workstation or Server a Domain Member

    +The procedure for making an MS Windows workstation or server a member of the domain varies +with the version of Windows. +

    Windows 200x/XP Professional Client

    + When the user elects to make the client a Domain Member, Windows 200x prompts for an account and password that has privileges to create machine accounts in the domain. - A Samba administrative account (i.e., a Samba account that has root privileges on the + A Samba Administrator Account (i.e., a Samba account that has root privileges on the Samba server) must be entered here; the operation will fail if an ordinary user account is given.

    - Note: For security reasons the password for this administrative account should be set - to a password that is other than that used for the root user in the - /etc/passwd. -

    - The name of the account that is used to create domain member machine accounts can be - anything the network administrator may choose. If it is other than root - then this is easily mapped to root using the file pointed to be the smb.conf parameter - username map = /etc/samba/smbusers. -

    - The session key of the Samba administrative account acts as an - encryption key for setting the password of the machine trust - account. The machine trust account will be created on-the-fly, or - updated if it already exists. -

    Windows NT4

    - If the machine trust account was created manually, on the + For security reasons, the password for this Administrator Account should be set + to a password that is other than that used for the root user in /etc/passwd. +

    + The name of the account that is used to create Domain Member machine accounts can be + anything the network administrator may choose. If it is other than root + then this is easily mapped to root in the file named in the smb.conf parameter + username map = /etc/samba/smbusers. +

    + The session key of the Samba Administrator Account acts as an encryption key for setting the password of the machine trust + account. The Machine Trust Account will be created on-the-fly, or updated if it already exists. +

    Windows NT4 Client

    + If the Machine Trust Account was created manually, on the Identification Changes menu enter the domain name, but do not check the box Create a Computer Account in the Domain. - In this case, the existing machine trust account is used to join the machine + In this case, the existing Machine Trust Account is used to join the machine to the domain.

    - If the machine trust account is to be created - on-the-fly, on the Identification Changes menu enter the domain - name, and check the box Create a Computer Account in the - Domain. In this case, joining the domain proceeds as above - for Windows 2000 (i.e., you must supply a Samba administrative account when + If the Machine Trust Account is to be created on-the-fly, on the Identification Changes menu enter the domain + name and check the box Create a Computer Account in the Domain. In this case, joining + the domain proceeds as above for Windows 2000 (i.e., you must supply a Samba Administrator Account when prompted). -

    Samba

    Joining a Samba client to a domain is documented in - the domain member chapter. +

    Samba Client

    Joining a Samba client to a domain is documented in + .

    Domain Member Server

    This mode of server operation involves the Samba machine being made a member of a domain security context. This means by definition that all user authentication will be done from a centrally defined authentication regime. -The authentication regime may come from an NT3/4 style (old domain technology) +The authentication regime may come from an NT3/4-style (old domain technology) server, or it may be provided from an Active Directory server (ADS) running on MS Windows 2000 or later.

    -Of course it should be clear that the authentication back end itself could be +Of course it should be clear that the authentication backend itself could be from any distributed directory architecture server that is supported by Samba. -This can be LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory -Server, etc. +This can be LDAP (from OpenLDAP), or Sun's iPlanet, or NetWare Directory +Server, and so on. -

    -Please refer to the chapter on setting up a PDC -for more information regarding how to create a domain -machine account for a domain member server as well as for information -regarding how to enable the Samba domain member machine to join the domain and -to be fully trusted by it. -

    Joining an NT4 type Domain with Samba-3

    -

    Table 7.1. Assumptions

    NetBIOS name:SERV1
    Win2K/NT domain name:MIDEARTH
    Domain's PDC NetBIOS name:DOMPDC
    Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2

    -

    -First, you must edit your smb.conf file to tell Samba it should -now use domain security. +

    Note

    +When Samba is configured to use an LDAP, or other identity management and/or +directory service, it is Samba that continues to perform user and machine +authentication. It should be noted that the LDAP server does not perform +authentication handling in place of what Samba is designed to do. +

    +Please refer to , for more information regarding +how to create a domain machine account for a Domain Member server as well as for +information on how to enable the Samba Domain Member machine to join the domain +and be fully trusted by it. +

    Joining an NT4-type Domain with Samba-3

    lists names that have been used in the remainder of this chapter.

    Table 7.1. Assumptions

    NetBIOS name:SERV1
    Windows 200x/NT domain name:MIDEARTH
    Domain's PDC NetBIOS name:DOMPDC
    Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2

    +First, you must edit your smb.conf file to tell Samba it should now use domain security.

    Change (or add) your - security line in the [global] section + security line in the [global] section of your smb.conf to read:

    security = domain

    -Next change the workgroup line in the [global] +Next change the workgroup line in the [global] section to read:

    workgroup = MIDEARTH

    -as this is the name of the domain we are joining. +This is the name of the domain we are joining.

    -You must also have the parameter -encrypt passwords set to yes - in order for your users to authenticate to the NT PDC. +You must also have the parameter encrypt passwords +set to yes in order for your users to authenticate to the NT PDC. +This is the defaulty setting if this parameter is not specified. There is no need to specify this +parameter, but if it is specified in the smb.conf file, it must be set to Yes.

    -Finally, add (or modify) a password server line in the [global] +Finally, add (or modify) a password server line in the [global] section to read:

    password server = DOMPDC DOMBDC1 DOMBDC2

    -These are the primary and backup domain controllers Samba +These are the primary and backup Domain Controllers Samba will attempt to contact in order to authenticate users. Samba will try to contact each of these servers in order, so you may want to rearrange this list in order to spread out the authentication load -among domain controllers. +among Domain Controllers.

    -Alternatively, if you want smbd to automatically determine -the list of Domain controllers to use for authentication, you may +Alternately, if you want smbd to automatically determine +the list of Domain Controllers to use for authentication, you may set this line to be:

    password server = *

    -This method allows Samba to use exactly the same mechanism that NT does. This -method either broadcasts or uses a WINS database in order to -find domain controllers to authenticate against. +This method allows Samba to use exactly the same mechanism that NT does. The +method either uses broadcast-based name resolution, performs a WINS database +lookup in order to find a Domain Controller against which to authenticate, +or locates the Domain Controller using DNS name resolution.

    -In order to actually join the domain, you must run this command: +To join the domain, run this command: 

    -root# net rpc join -S DOMPDC -UAdministrator%password
+root# net join -S DOMPDC -UAdministrator%password

    -If the -S DOMPDC argument is not given then -the domain name will be obtained from smb.conf. -

    -As we are joining the domain DOM and the PDC for that domain -(the only machine that has write access to the domain SAM database) -is DOMPDC, we use it for the -S option. -The Administrator%password is -the login name and password for an account which has the necessary -privilege to add machines to the domain. If this is successful -you will see the message: +If the -S DOMPDC argument is not given, the domain name will be obtained from smb.conf.

    +The machine is joining the domain DOM, and the PDC for that domain (the only machine +that has write access to the domain SAM database) is DOMPDC, therefore use the -S +option. The Administrator%password is the login name and +password for an account that has the necessary privilege to add machines to the +domain. If this is successful, you will see the message in your terminal window the +text shown below. Where the older NT4 style domain architecture is used: +

     Joined domain DOM.
-or Joined 'SERV1' to realm 'MYREALM'
+

    +

    +Where Active Directory is used: +

    +Joined SERV1 to realm MYREALM.
+

    -in your terminal window. See the -net man page for more details. +Refer to the net man page for further information.

    This process joins the server to the domain without having to create the machine trust account on the PDC beforehand.

    -This command goes through the machine account password -change protocol, then writes the new (random) machine account -password for this Samba server into a file in the same directory -in which an smbpasswd file would be stored - normally: -

    +This command goes through the machine account password change protocol, then writes +the new (random) machine account password for this Samba server into a file in the +same directory in which a smbpasswd file would be normally stored: +

     /usr/local/samba/private/secrets.tdb
+or 
+/etc/samba/secrets.tdb.
+

    -This file is created and owned by root and is not -readable by any other user. It is the key to the domain-level -security for your system, and should be treated as carefully +This file is created and owned by root and is not readable by any other user. It is +the key to the Domain-level security for your system, and should be treated as carefully as a shadow password file.

    -Finally, restart your Samba daemons and get ready for -clients to begin using domain security! The way you can restart your -samba daemons depends on your distribution, but in most cases running +Finally, restart your Samba daemons and get ready for clients to begin using domain +security. The way you can restart your Samba daemons depends on your distribution, +but in most cases the following will suffice: 

    -	root# /etc/init.d/samba restart
+root# /etc/init.d/samba restart

    -does the job. -

    Why is this better than security = server?

    -Currently, domain security in Samba doesn't free you from +

    Why Is This Better Than security = server?

    +Currently, domain security in Samba does not free you from having to create local UNIX users to represent the users attaching -to your server. This means that if domain user DOM\fred - attaches to your domain security Samba server, there needs +to your server. This means that if Domain user DOM\fred + attaches to your Domain Security Samba server, there needs to be a local UNIX user fred to represent that user in the UNIX -filesystem. This is very similar to the older Samba security mode -security = server, +file system. This is similar to the older Samba security mode +security = server, where Samba would pass through the authentication request to a Windows NT server in the same way as a Windows 95 or Windows 98 server would.

    - Please refer to the chapter on winbind for information on a system -to automatically assign UNIX uids and gids to Windows NT Domain users and groups. +Please refer to , for information on a system +to automatically assign UNIX UIDs and GIDs to Windows NT Domain users and groups.

    -The advantage to domain-level security is that the -authentication in domain-level security is passed down the authenticated +The advantage to Domain-level security is that the +authentication in Domain-level security is passed down the authenticated RPC channel in exactly the same way that an NT server would do it. This means Samba servers now participate in domain trust relationships in exactly the same way NT servers do (i.e., you can add Samba servers into a resource domain and have the authentication passed on from a resource domain PDC to an account domain PDC).

    -In addition, with security = server every Samba +In addition, with security = server, every Samba daemon on a server has to keep a connection open to the authenticating server for as long as that daemon lasts. This can drain the connection resources on a Microsoft NT server and cause it to run -out of available connections. With security = domain, +out of available connections. With security = domain, however, the Samba daemons connect to the PDC/BDC only for as long -as is necessary to authenticate the user, and then drop the connection, +as is necessary to authenticate the user and then drop the connection, thus conserving PDC connection resources.

    And finally, acting in the same manner as an NT server authenticating to a PDC means that as part of the authentication reply, the Samba server gets the user identification information such -as the user SID, the list of NT groups the user belongs to, etc. +as the user SID, the list of NT groups the user belongs to, and so on.

    Note

    -Much of the text of this document -was first published in the Web magazine -LinuxWorld as the article Doing -the NIS/NT Samba. -

    Samba ADS Domain Membership

    -This is a rough guide to setting up Samba 3.0 with Kerberos authentication against a -Windows2000 KDC. A familiarity with Kerberos is assumed. -

    Setup your smb.conf

    -You must use at least the following 3 options in smb.conf: -

    realm = your.kerberos.REALM
    security = ADS
    encrypt passwords = yes

    -In case samba can't figure out your ads server using your realm name, use the -ads server option in smb.conf: -

    ads server = your.kerberos.server

    +Much of the text of this document was first published in the Web magazine +LinuxWorld as the article http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba.html +Doing the NIS/NT Samba. +

    Samba ADS Domain Membership

    + + + + +This is a rough guide to setting up Samba-3 with Kerberos authentication against a +Windows 200x KDC. A familiarity with Kerberos is assumed. +

    Configure smb.conf

    +You must use at least the following three options in smb.conf: +

    realm = your.kerberos.REALM
    security = ADS
    # The following parameter need only be specified if present.
    # The default setting is not present is Yes.
    encrypt passwords = yes

    +In case samba cannot correctly identify the appropriate ADS server using the realm name, use the +password server option in smb.conf: +

    password server = your.kerberos.server

    Note

    You do not need a smbpasswd file, and older clients will be authenticated as -if security = domain, although it won't do any harm and -allows you to have local users not in the domain. It is expected that the above -required options will change soon when active directory integration will get -better. -

    Setup your /etc/krb5.conf

    -The minimal configuration for krb5.conf is: +if security = domain, although it will not do any harm and +allows you to have local users not in the domain. +

    Configure /etc/krb5.conf

    + + +With both MIT and Heimdal Kerberos, this is unnecessary, and may be detrimental. All ADS +domains will automatically create SRV records in the DNS zone _kerberos.REALM.NAME for +each KDC in the realm. MIT's, as well as Heimdal's, KRB5 libraries default to checking +for these records, so they will automatically find the KDCs. In addition, +krb5.conf only allows specifying a single KDC, even there if there is more +than one. Using the DNS lookup allows the KRB5 libraries to use whichever KDCs are available. +

    +When manually configuring krb5.conf, the minimal configuration is: 

     [libdefaults]
    default_realm = YOUR.KERBEROS.REALM
@@ -1889,92 +2010,146 @@ The minimal configuration for krb5.conf is:
 	YOUR.KERBEROS.REALM = {
 	kdc = your.kerberos.server
 	    }
-

    +

    +When using Heimdal versions before 0.6 use the following configuration settings: +

    +[libdefaults]
+   default_realm      = YOUR.KERBEROS.REALM
+   default_etypes     = des-cbc-crc des-cbc-md5
+   default_etypes_des = des-cbc-crc des-cbc-md5
+
+        [realms]
+        YOUR.KERBEROS.REALM = {
+        kdc = your.kerberos.server
+            }
+

    +

    + Test your config by doing a kinit USERNAME@REALM and making sure that your password is accepted by the Win2000 KDC. +

    +With Heimdal versions earlier than 0.6.x you only can use newly created accounts +in ADS or accounts that have had the password changed once after migration, or +in case of Administrator after installation. At the +moment, a Windows 2003 KDC can only be used with a Heimdal releases later than 0.6 +(and no default etypes in krb5.conf). Unfortunatly this whole area is still +in a state of flux.

    Note

    -The realm must be uppercase or you will get Cannot find KDC for -requested realm while getting initial credentials error (Kerberos +The realm must be in uppercase or you will get “Cannot find KDC for +requested realm while getting initial credentials” error (Kerberos is case-sensitive!).

    Note

    -Time between the two servers must be synchronized. You will get a -kinit(v5): Clock skew too great while getting initial credentials +Time between the two servers must be synchronized. You will get a +“kinit(v5): Clock skew too great while getting initial credentials” if the time difference is more than five minutes.

    +Clock skew limits are configurable in the Kerberos protocols. The default setting is +five minutes. +

    You also must ensure that you can do a reverse DNS lookup on the IP address of your KDC. Also, the name that this reverse lookup maps to -must either be the NetBIOS name of the KDC (ie. the hostname with no -domain attached) or it can alternatively be the NetBIOS name -followed by the realm. +must either be the NetBIOS name of the KDC (i.e., the hostname with no +domain attached) or it can alternately be the NetBIOS name followed by the realm.

    The easiest way to ensure you get this right is to add a /etc/hosts entry mapping the IP address of your KDC to -its NetBIOS name. If you don't get this right then you will get a +its NetBIOS name. If you do not get this correct then you will get a local error when you try to join the realm.

    If all you want is Kerberos support in smbclient then you can skip -straight to Test with smbclient now. -Creating a computer account -and testing your servers -is only needed if you want Kerberos support for smbd and winbindd. -

    Create the computer account

    -As a user that has write permission on the Samba private directory -(usually root) run: +directly to now. + and +are needed only if you want Kerberos support for smbd and winbindd. +

    Create the Computer Account

    +As a user who has write permission on the Samba private directory (usually root), run: 

     root#  net ads join -U Administrator%password

    -

    Possible errors

    +

    +When making a Windows client a member of an ADS domain within a complex organization, you +may want to create the machine account within a particular organizational unit. Samba-3 permits +this to be done using the following syntax: +

    +root#   kinit Administrator@your.kerberos.REALM
+root#  net ads join “organizational_unit”
+

    +

    +For example, you may want to create the machine account in a container called “Servers” +under the organizational directory “Computers\BusinessUnit\Department” like this: +

    +root#  net ads join "Computers\BusinessUnit\Department\Servers"
+

    +

    Possible Errors

    ADS support not compiled in

    Samba must be reconfigured (remove config.cache) and recompiled - (make clean all install) after the Kerberos libs and headers are installed. + (make clean all install) after the Kerberos libiraries and headers files are installed.

    net ads join prompts for user name

    You need to login to the domain using kinit USERNAME@REALM. USERNAME must be a user who has rights to add a machine - to the domain.

    -

    Test your server setup

    + to the domain.

    Unsupported encryption/or checksum types

    + Make sure that the /etc/krb5.conf is correctly configured + for the type and version of Kerberos installed on the system. +

    +

    Testing Server Setup

    If the join was successful, you will see a new computer account with the -NetBIOS name of your Samba server in Active Directory (in the "Computers" +NetBIOS name of your Samba server in Active Directory (in the “Computers” folder under Users and Computers.

    -On a Windows 2000 client try net use * \\server\share. You should -be logged in with Kerberos without needing to know a password. If -this fails then run klist tickets. Did you get a ticket for the -server? Does it have an encoding type of DES-CBC-MD5 ? -

    Testing with smbclient

    +On a Windows 2000 client, try net use * \\server\share. You should +be logged in with Kerberos without needing to know a password. If this fails then run +klist tickets. Did you get a ticket for the server? Does it have +an encryption type of DES-CBC-MD5? +

    Note

    +Samba can use both DES-CBC-MD5 encryption as well as ARCFOUR-HMAC-MD5 encoding. +

    Testing with smbclient

    + On your Samba server try to login to a Win2000 server or your Samba server using smbclient and Kerberos. Use smbclient as usual, but specify the -k option to choose Kerberos authentication. -

    Notes

    +

    Notes

    You must change administrator password at least once after DC -install, to create the right encoding types -

    -W2k doesn't seem to create the _kerberos._udp and _ldap._tcp in -their defaults DNS setup. Maybe this will be fixed later in service packs. -

    Common Errors

    -In the process of adding / deleting / re-adding domain member machine accounts there are -many traps for the unwary player and there are many “little” things that can go wrong. -It is particularly interesting how often subscribers on the samba mailing list have concluded -after repeated failed attempts to add a machine account that it is necessary to "re-install" -MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type -of problem. The real solution is often very simple, and with understanding of how MS Windows -networking functions easy to overcome. -

    Can Not Add Machine Back to Domain

    -“ A Windows workstation was reinstalled. The original domain machine +install, to create the right encryption types. +

    +Windows 200x does not seem to create the _kerberos._udp and _ldap._tcp in +the default DNS setup. Perhaps this will be fixed later in service packs. +

    Sharing User ID Mappings between Samba Domain Members

    +Samba maps UNIX users and groups (identified by UIDs and GIDs) to Windows users and groups (identified by SIDs). +These mappings are done by the idmap subsystem of Samba. +

    +In some cases it is useful to share these mappings between Samba Domain Members, +so name->id mapping is identical on all machines. +This may be needed in particular when sharing files over both CIFS and NFS. +

    To use the LDAP ldap idmap suffix, set:

    ldap idmap suffix = ou=Idmap,dc=quenya,dc=org

    See the smb.conf man page entry for the ldap idmap suffix +parameter for further information.

    +Do not forget to specify also the ldap admin dn +and to make certain to set the LDAP administrative password into the secrets.tdb using: +

    +root#  smbpasswd -w ldap-admin-password
+

    Common Errors

    +In the process of adding/deleting/re-adding Domain Member machine accounts, there are +many traps for the unwary player and many “little” things that can go wrong. +It is particularly interesting how often subscribers on the Samba mailing list have concluded +after repeated failed attempts to add a machine account that it is necessary to “re-install” +MS Windows on the machine. In truth, it is seldom necessary to reinstall because of this type +of problem. The real solution is often quite simple and with an understanding of how MS Windows +networking functions, it is easy to overcome. +

    Cannot Add Machine Back to Domain

    +“A Windows workstation was re-installed. The original domain machine account was deleted and added immediately. The workstation will not join the domain if I use the same machine name. Attempts to add the machine fail with a message that the machine already -exists on the network - I know it doesn't. Why is this failing?” +exists on the network I know it does not. Why is this failing?”

    The original name is still in the NetBIOS name cache and must expire after machine account -deletion BEFORE adding that same name as a domain member again. The best advice is to delete -the old account and then to add the machine with a new name. -

    Adding Machine to Domain Fails

    - “Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a -message that, The machine could not be added at this time, there is a network problem. - Please try again later. Why?” -

    -You should check that there is an add machine script in your smb.conf +deletion before adding that same name as a Domain Member again. The best advice is to delete +the old account and then add the machine with a new name. +

    Adding Machine to Domain Fails

    +“Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a +message that, `The machine could not be added at this time, there is a network problem. +Please try again later.' Why?” +

    +You should check that there is an add machine script in your smb.conf file. If there is not, please add one that is appropriate for your OS platform. If a script -has been defined you will need to debug it's operation. Increase the log level +has been defined, you will need to debug its operation. Increase the log level in the smb.conf file to level 10, then try to rejoin the domain. Check the logs to see which operation is failing.

    @@ -1982,98 +2157,101 @@ Possible causes include:

    • The script does not actually exist, or could not be located in the path specified.

      - Corrective Action: Fix it. Make sure that when run manually - that the script will add both the UNIX system account _and_ the Samba SAM account. + Corrective action: Fix it. Make sure when run manually + that the script will add both the UNIX system account and the Samba SAM account.

    • - The machine could not be added to the UNIX system accounts file /etc/passwd + The machine could not be added to the UNIX system accounts file /etc/passwd.

      - Corrective Action: Check that the machine name is a legal UNIX - system account name. ie: If the UNIX utility useradd is called + Corrective action: Check that the machine name is a legal UNIX + system account name. If the UNIX utility useradd is called, then make sure that the machine name you are trying to add can be added using this tool. Useradd on some systems will not allow any upper case characters nor will it allow spaces in the name. -

    Chapter 8. Stand-Alone Servers

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors

    -Stand-Alone servers are independent of Domain Controllers on the network. -They are NOT domain members and function more like workgroup servers. In many -cases a stand-alone server is configured with a minimum of security control +

    +The add machine script does not create the +machine account in the Samba backend database, it is there only to create a UNIX system +account to which the Samba backend database account can be mapped. +

    I Can't Join a Windows 2003 PDC

    Windows 2003 requires SMB signing. Client side SMB signing has been implemented in Samba-3.0. + Set client use spnego = yes when communicating + with a Windows 2003 server.

    Chapter 8. Stand-alone Servers

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors

    +Stand-alone Servers are independent of Domain Controllers on the network. +They are not Domain Members and function more like workgroup servers. In many +cases a Stand-alone Server is configured with a minimum of security control with the intent that all data served will be readily accessible to all users. -

    Features and Benefits

    -Stand-Alone servers can be as secure or as insecure as needs dictate. They can +

    Features and Benefits

    +Stand-alone Servers can be as secure or as insecure as needs dictate. They can have simple or complex configurations. Above all, despite the hoopla about -Domain security they remain a very common installation. +Domain Security they remain a common installation.

    If all that is needed is a server for read-only files, or for -printers alone, it may not make sense to affect a complex installation. +printers alone, it may not make sense to effect a complex installation. For example: A drafting office needs to store old drawings and reference -standards. No-one can write files to the server as it is legislatively -important that all documents remain unaltered. A share mode read-only stand-alone -server is an ideal solution. +standards. Noone can write files to the server as it is legislatively +important that all documents remain unaltered. A share mode read-only Stand-alone +Server is an ideal solution.

    Another situation that warrants simplicity is an office that has many printers that are queued off a single central server. Everyone needs to be able to print -to the printers, there is no need to affect any access controls and no files will -be served from the print server. Again a share mode stand-alone server makes +to the printers, there is no need to effect any access controls and no files will +be served from the print server. Again, a share mode Stand-alone Server makes a great solution. -

    Background

    -The term stand-alone server means that the server +

    Background

    +The term Stand-alone Server means that it will provide local authentication and access control for all resources that are available from it. In general this means that there will be a -local user database. In more technical terms, it means that resources +local user database. In more technical terms, it means resources on the machine will be made available in either SHARE mode or in USER mode.

    No special action is needed other than to create user accounts. Stand-alone -servers do NOT provide network logon services. This means that machines that -use this server do NOT perform a domain logon to it. Whatever logon facility -the workstations are subject to is independent of this machine. It is however -necessary to accommodate any network user so that the logon name they use will -be translated (mapped) locally on the stand-alone server to a locally known +servers do not provide network logon services. This means that machines that +use this server do not perform a domain logon to it. Whatever logon facility +the workstations are subject to is independent of this machine. It is, however, +necessary to accommodate any network user so the logon name they use will +be translated (mapped) locally on the Stand-alone Server to a locally known user name. There are several ways this can be done.

    Samba tends to blur the distinction a little in respect of what is -a stand-alone server. This is because the authentication database may be -local or on a remote server, even if from the Samba protocol perspective -the Samba server is NOT a member of a domain security context. +a Stand-alone Server. This is because the authentication database may be +local or on a remote server, even if from the SMB protocol perspective +the Samba server is not a member of a domain security context.

    -Through the use of PAM (Pluggable Authentication Modules) and nsswitch -(the name service switcher, which maintains the unix user database) the source of authentication may reside on +Through the use of Pluggable Authentication Modules (PAM) and the name service switcher (NSSWITCH), +which maintains the UNIX-user database) the source of authentication may reside on another server. We would be inclined to call this the authentication server. This means that the Samba server may use the local UNIX/Linux system password database (/etc/passwd or /etc/shadow), may use a -local smbpasswd file, or may use -an LDAP back end, or even via PAM and Winbind another CIFS/SMB server +local smbpasswd file, or may use an LDAP backend, or even via PAM and Winbind another CIFS/SMB server for authentication. -

    Example Configuration

    -The following examples are designed to inspire simplicity. It is too easy to -attempt a high level of creativity and to introduce too much complexity in -server and network design. +

    Example Configuration

    +The examples, , and link linkend="SimplePrintServer"/>, +are designed to inspire simplicity. It is too easy to attempt a high level of creativity +and to introduce too much complexity in server and network design.

    Reference Documentation Server

    -Configuration of a read-only data server that EVERYONE can access is very simple. -Here is the smb.conf file that will do this. Assume that all the reference documents -are stored in the directory /export, that the documents are owned by a user other than -nobody. No home directories are shared, that are no users in the /etc/passwd -UNIX system database. This is a very simple system to administer. -

    Example 8.1. smb.conf for Reference Documentation Server

    # Global parameters
    [global]
    workgroup = MIDEARTH
    netbios name = GANDALF
    security = SHARE
    passdb backend = guest
    wins server = 192.168.1.1
    [data]
    comment = Data
    path = /export
    guest only = Yes

    -In the above example the machine name is set to REFDOCS, the workgroup is set to the name -of the local workgroup so that the machine will appear in with systems users are familiar -with. The only password backend required is the "guest" backend so as to allow default -unprivileged account names to be used. Given that there is a WINS server on this network -we do use it. +Configuration of a read-only data server that everyone can access is very simple. + is the smb.conf file that will do this. Assume that all the reference documents +are stored in the directory /export, and the documents are owned by a user other than +nobody. No home directories are shared, and there are no users in the /etc/passwd +UNIX system database. This is a simple system to administer. +

    Example 8.1. smb.conf for Reference Documentation Server

    # Global parameters
    [global]
    workgroup = MIDEARTH
    netbios name = GANDALF
    security = SHARE
    passdb backend = guest
    wins server = 192.168.1.1
    [data]
    comment = Data
    path = /export
    guest only = Yes

    +In above, the machine name is set to GANDALF, the workgroup is set to the name +of the local workgroup (MIDEARTH) so the machine will appear together with systems with +which users are familiar. The only password backend required is the “guest” backend to allow default +unprivileged account names to be used. As there is a WINS server on this networki, we of obviously make use of it.

    Central Print Serving

    -Configuration of a simple print server is very simple if you have all the right tools +Configuration of a simple print server is easy if you have all the right tools on your system.

    Assumptions:

    1. - The print server must require no administration + The print server must require no administration.

    2. The print spooling and processing system on our print server will be CUPS. - (Please refer to the chapter about CUPS for more information). + (Please refer to for more information).

    3. - All printers that the print server will service will be network - printers. They will be correctly configured, by the administrator, - in the CUPS environment. + The print server will service only network printers. The network administrator + will correctly configure the CUPS environment to support the printers.

    4. - All workstations will be installed using postscript drivers. The printer - of choice is the Apple Color LaserWriter. + All workstations will use only postscript drivers. The printer driver + of choice is the one shipped with the Windows OS for the Apple Color LaserWriter.

    In this example our print server will spool all incoming print jobs to /var/spool/samba until the job is ready to be submitted by @@ -2082,12 +2260,12 @@ the anonymous (guest) user, two things will be required:

    Enabling Anonymous Printing

    • The UNIX/Linux system must have a guest account. The default for this is usually the account nobody. - To find the correct name to use for your version of Samba do the + To find the correct name to use for your version of Samba, do the following: 

       $ testparm -s -v | grep "guest account"

      - Then make sure that this account exists in your system password + Make sure that this account exists in your system password database (/etc/passwd).

    • The directory into which Samba will spool the file must have write @@ -2099,236 +2277,221 @@ the anonymous (guest) user, two things will be required: root# chmod a+rwt /var/spool/samba

    -

    Example 8.2. smb.conf for anonymous printing

    # Global parameters
    [global]
    workgroup = MIDEARTH
    netbios name = GANDALF
    security = SHARE
    passdb backend = guest
    wins server = noldor
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    printer admin = root
    guest ok = Yes
    printable = Yes
    use client driver = Yes
    browseable = No

    -

    Common Errors

    +The contents of the smb.conf file is shown in . +

    +

    Example 8.2. smb.conf for Anonymous Printing

    # Global parameters
    [global]
    workgroup = MIDEARTH
    netbios name = GANDALF
    security = SHARE
    passdb backend = guest
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    printer admin = root
    guest ok = Yes
    printable = Yes
    use client driver = Yes
    browseable = No

    +

    Note

    + + +On CUPS-enabled systems there is a facility to pass raw data directly to the printer without +intermediate processing via CUPS print filters. Where use of this mode of operation is desired, +it is necessary to configure a raw printing device. It is also necessary to enable the raw mime +handler in the /etc/mime.conv and /etc/mime.types +files. Refer to . +

    Common Errors

    The greatest mistake so often made is to make a network configuration too complex. It pays to use the simplest solution that will meet the needs of the moment. -

    Chapter 9. MS Windows Network Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +

    Chapter 9. MS Windows Network Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Advanced Configuration

    Valuable Nuts and Bolts Information

    +

    Advanced Configuration

    Valuable Nuts and Bolts Information

    Samba has several features that you might want or might not want to use. The chapters in this part each cover specific Samba features. -

    Table of Contents

    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    I get an Unable to browse the network error
    11. Account Information Databases
    Features and Benefits
    Backwards Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon
    Users being added to wrong backend database
    auth methods does not work
    12. Mapping MS Windows and UNIX Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users group
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute mapping
    Common Errors
    Users can not write to a public share
    I have set force user but Samba still makes root the owner of all the files I touch!
    MS Word with Samba changes owner of file
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Problems saving files in MS Office on Windows XP
    Long delays deleting files over network with XP SP1
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-style Domain Trusts with Windows 2000
    Common Errors
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    A simple Configuration to Print
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various UNIX Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba 3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with -rpcclient
    Client Driver Install Procedure
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a -different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for -CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for -application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and -native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print -Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many -Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel -Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Caveats to be considered
    Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsmb completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the -Client
    Installing PostScript Driver Files manually (using -rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    In Case of Trouble.....
    Printing from CUPS to Windows attached -Printers
    More CUPS filtering Chains
    Common Errors
    Win9x client can't install driver
    "cupsaddsmb" keeps asking for root password in - neverending loop
    "cupsaddsmb" gives "No PPD file for printer..." - message while PPD file is present
    Client can't connect to Samba printer
    Can't reconnect to Samba under new account - from Win2K/XP
    Avoid being connected to the Samba server as the - "wrong" user
    Upgrading to CUPS drivers from Adobe drivers on - NT/2K/XP clients gives problems
    Can't use "cupsaddsmb" on Samba server which is - a PDC
    Deleted Win2K printer driver is still shown
    Win2K/XP "Local Security - Policies"
    WinXP clients: "Administrator can not install - printers for all local users"
    "Print Change Notify" functions on - NT-clients
    WinXP-SP1
    Print options for all users can't be set on Win2K/XP
    Most common blunders in driver - settings on Windows clients
    cupsaddsmb does not work - with newly installed printer
    Permissions on -/var/spool/samba/ get reset after each -reboot
    Printer named "lp" -intermittently swallows jobs and spits out completely different -ones
    Location of Adobe PostScript driver files necessary for "cupsaddsmb"
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    21. Winbind: Use of Domain Accounts
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Setting up roaming profiles for just a few user's or group's?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    Winbind is not resolving users and groups
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure UNIX/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging works only in one way
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    Common errors
    CP850.so can't be found
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note

    Chapter 10. Samba / MS Windows Network Browsing Guide

    John H. Terpstra

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    July 5, 1998

    Updated: April 21, 2003

    Table of Contents

    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    I get an Unable to browse the network error

    +

    Table of Contents

    10. Network Browsing
    Features and Benefits
    What Is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Configuring WORKGROUP Browsing
    DOMAIN Browsing Configuration
    Forcing Samba to Be the Master
    Making Samba the Domain Master
    Note about Broadcast Addresses
    Multiple Interfaces
    Use of the Remote Announce Parameter
    Use of the Remote Browse Sync Parameter
    WINS The Windows Internetworking Name Server
    WINS Server Configuration
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of Browsing
    Browsing Support in Samba
    Problem Resolution
    Cross-Subnet Browsing
    Common Errors
    How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?
    Server Resources Can Not Be Listed
    I get an `Unable to browse the network' error
    Browsing of Shares and Directories is Very Slow
    11. Account Information Databases
    Features and Benefits
    Backward Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plaintext
    smbpasswd Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users Cannot Logon
    Users Being Added to the Wrong Backend Database
    Configuration of auth methods
    12. Group Mapping MS Windows and UNIX
    Features and Benefits
    Discussion
    Default Users, Groups and Relative Identifiers
    Example Configuration
    Configuration Scripts
    Sample smb.conf Add Group Script
    Script to Configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users Group
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group-Based Controls
    File and Directory Permissions-Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX Permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing File Ownership
    Viewing File or Directory Permissions
    Modifying File or Directory Permissions
    Interaction with the Standard Samba create mask Parameters
    Interaction with the Standard Samba File Attribute Mapping
    Common Errors
    Users Cannot Write to a Public Share
    File Operations Done as root with force user Set
    MS Word with Samba Changes Owner of File
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb Error Messages
    Problems Saving Files in MS Office on Windows XP
    Long Delays Deleting Files Over Network with XP SP1
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using Host-Based Protection
    User-Based Protection
    Using Interface Protection
    Using a Firewall
    Using IPC$ Share-Based Denials
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient Works on Localhost, but the Network Is Dead
    Why Can Users Access Home Directories of Other Users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-Style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-Style Domain Trusts with Windows 2000
    Common Errors
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    MSDFS UNIX Path Is Case-Critical
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    Client to Samba Print Job Processing
    Printing Related Configuration Parameters
    Simple Print Configuration
    Verifing Configuration with testparm
    Rapid Configuration Validation
    Extended Printing Configuration
    Detailed Explanation Settings
    Printing Developments Since Samba-2.2
    Point'n'Print Client Drivers on Samba Servers
    The Obsoleted [printer$] Section
    Creating the [print$] Share
    [print$] Section Parameters
    The [print$] Share Directory
    Installing Drivers into [print$]
    Add Printer Wizard Driver Installation
    Installing Print Drivers Using rpcclient
    Client Driver Installation Procedure
    First Client Driver Installation
    Setting Device Modes on New Printers
    Additional Client Driver Installation
    Always Make First Client Connection as root or printer admin
    Other Gotchas
    Setting Default Print Options for Client Drivers
    Supporting Large Numbers of Printers
    Adding New Printers with the Windows NT APW
    Error Message: Cannot connect under a different Name
    Take Care When Assembling Driver Files
    Samba and Printer Ports
    Avoiding Common Client Driver Misconfiguration
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Adding Network Printers without User Interaction
    The addprinter Command
    Migration of Classical Printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I Give My Root Password but I Do Not Get Access
    My Print Jobs Get Spooled into the Spooling Directory, but Then Get Lost
    19. CUPS Printing Support
    Introduction
    Features and Benefits
    Overview
    Basic CUPS Support Configuration
    Linking smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More Complex CUPS smb.conf Settings
    Advanced Configuration
    Central Spooling vs. Peer-to-Peer Printing
    Raw Print Serving Vendor Drivers on Windows Clients
    Installation of Windows Client Drivers
    Explicitly Enable raw Printing for application/octet-stream
    Driver Upload Methods
    Advanced Intelligent Printing with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript the Software RIP for Non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    Using Windows-Formatted Vendor PPDs
    CUPS Also Uses PPDs for Non-PostScript Printers
    The CUPS Filtering Architecture
    MIME Types and CUPS Filters
    MIME Type Conversion Rules
    Filtering Overview
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    The Role of cupsomatic/foomatic
    The Complete Picture
    mime.convs
    Raw Printing
    application/octet-stream Printing
    PostScript Printer Descriptions (PPDs) for Non-PS Printers
    cupsomatic/foomatic-rip Versus native CUPS Printing
    Examples for Filtering Chains
    Sources of CUPS Drivers/PPDs
    Printing with Interface Scripts
    Network Printing (Purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows Clients UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba Receiving Jobfiles and Passing Them to CUPS
    Network PostScript RIP
    PPDs for Non-PS Printers on UNIX
    PPDs for Non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers Running in Kernel Mode Cause Many +Problems
    Workarounds Impose Heavy Limitations
    CUPS: A Magical Stone?
    PostScript Drivers with No Major Problems Even in Kernel +Mode
    Configuring CUPS for Driver Download
    cupsaddsmb: The Unknown Utility
    Prepare Your smb.conf for cupsaddsmb
    CUPS PostScript Driver for Windows NT/200x/XP
    Recognizing Different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro PostScript Driver for Windows NT/200x/XP
    Caveats to be Considered
    Windows CUPS PostScript Driver Versus Adobe Driver
    Run cupsaddsmb (Quiet Mode)
    Run cupsaddsmb with Verbose Output
    Understanding cupsaddsmb
    How to Recognize If cupsaddsmb Completed Successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding Critical PostScript Driver Settings on the Client
    Installing PostScript Driver Files Manually Using rpcclient
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by Querying a Windows Box
    Requirements for adddriver and setdriver to Succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting Revisited
    The Printing *.tdb Files
    Trivial Database Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic Explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting Up Quotas
    Correct and Incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings Explained
    Pre-Conditions
    Manual Configuration
    Printing from CUPS to Windows Attached Printers
    More CUPS-Filtering Chains
    Common Errors
    Windows 9x/ME Client Can't Install Driver
    cupsaddsmb Keeps Asking for Root Password in Never-ending Loop
    cupsaddsmb Errors
    Client Can't Connect to Samba Printer
    New Account Reconnection from Windows 200x/XP Troubles
    Avoid Being Connected to the Samba Server as the Wrong User
    Upgrading to CUPS Drivers from Adobe Drivers
    Can't Use cupsaddsmb on Samba Server Which Is a PDC
    Deleted Windows 200x Printer Driver Is Still Shown
    Windows 200x/XP "Local Security Policies"
    Administrator Cannot Install Printers for All Local Users
    Print Change Notify Functions on NT-clients
    WinXP-SP1
    Print Options for All Users Can't Be Set on Windows 200x/XP
    Most Common Blunders in Driver Settings on Windows Clients
    cupsaddsmb Does Not Work with Newly Installed Printer
    Permissions on /var/spool/samba/ Get Reset After Each Reboot
    Print Queue Called lp Mis-handles Print Jobs
    Location of Adobe PostScript Driver Files for cupsaddsmb
    Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included Modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS Modules Available Elsewhere
    DatabaseFS
    vscan
    21. Winbind: Use of Domain Accounts
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    Winbind Is Not Resolving Users and Groups
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachine.Com
    Network Logon Script Magic
    Adding Printers without User Intervention
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/ME Policies
    Windows NT4-Style Policy Files
    MS Windows 200x/XP Professional Policies
    Managing Account/User Policies
    Management Tools
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP Workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory Profiles
    Creating and Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Configuring Roaming Profiles for a Few Users or Groups
    Cannot Use Roaming Profiles
    Changing the Default Profile
    25. PAM-Based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication Using winbindd.so
    Password Synchronization Using pam_smbpass.so
    Common Errors
    pam_winbind Problem
    Winbind Is Not Resolving Users and Groups
    26. Integrating MS Windows Networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a Pure UNIX/Linux World
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name Resolution as Used within MS Windows Networking
    The NetBIOS Name Cache
    The LMHOSTS File
    HOSTS File
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging Works Only in One Way
    Very Slow Network Connections
    Samba Server Name Change Problem
    27. Unicode/Charsets
    Features and Benefits
    What Are Charsets and Unicode?
    Samba and Charsets
    Conversion from Old Names
    Japanese Charsets
    Common Errors
    CP850.so Can't Be Found
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note

    Chapter 10. Network Browsing

    John H. Terpstra

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    July 5, 1998

    Updated: April 21, 2003

    Table of Contents

    Features and Benefits
    What Is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Configuring WORKGROUP Browsing
    DOMAIN Browsing Configuration
    Forcing Samba to Be the Master
    Making Samba the Domain Master
    Note about Broadcast Addresses
    Multiple Interfaces
    Use of the Remote Announce Parameter
    Use of the Remote Browse Sync Parameter
    WINS The Windows Internetworking Name Server
    WINS Server Configuration
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of Browsing
    Browsing Support in Samba
    Problem Resolution
    Cross-Subnet Browsing
    Common Errors
    How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?
    Server Resources Can Not Be Listed
    I get an `Unable to browse the network' error
    Browsing of Shares and Directories is Very Slow

    This document contains detailed information as well as a fast track guide to -implementing browsing across subnets and / or across workgroups (or domains). +implementing browsing across subnets and/or across workgroups (or domains). WINS is the best tool for resolution of NetBIOS names to IP addresses. WINS is -NOT involved in browse list handling except by way of name to address resolution. +not involved in browse list handling except by way of name to address resolution.

    Note

    -MS Windows 2000 and later can be configured to operate with NO NetBIOS -over TCP/IP. Samba-3 and later also supports this mode of operation. -When the use of NetBIOS over TCP/IP has been disabled then the primary +MS Windows 2000 and later versions can be configured to operate with no NetBIOS +over TCP/IP. Samba-3 and later versions also support this mode of operation. +When the use of NetBIOS over TCP/IP has been disabled, the primary means for resolution of MS Windows machine names is via DNS and Active Directory. The following information assumes that your site is running NetBIOS over TCP/IP. -

    Features and Benefits

    -Someone once referred to the past in terms of: They were the worst of times, -they were the best of times. The more we look back, them more we long for what was and -hope it never returns!. -

    +

    Features and Benefits

    +Someone once referred to the past in these words “It was the best of times, +it was the worst of times.” The more we look back, the more we long for what was and +hope it never returns. +

    + For many MS Windows network administrators, that statement sums up their feelings about NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle nature was just par for the course. For those who never quite managed to tame its lusty features, NetBIOS is like Paterson's Curse.

    -For those not familiar with botanical problems in Australia: Paterson's curse, -Echium plantagineum, was introduced to Australia from Europe during the mid-nineteenth +For those not familiar with botanical problems in Australia, Paterson's Curse, +Echium plantagineum, was introduced to Australia from Europe during the mid-nineteenth century. Since then it has spread rapidly. The high seed production, with densities of -thousands of seeds per square metre, a seed longevity of more than seven years, and an +thousands of seeds per square meter, a seed longevity of more than seven years, and an ability to germinate at any time of year, given the right conditions, are some of the features which make it such a persistent weed.

    -In this chapter we explore vital aspects of SMB (Server Message Block) networking with +In this chapter we explore vital aspects of Server Message Block (SMB) networking with a particular focus on SMB as implemented through running NetBIOS (Network Basic -Input / Output System) over TCP/IP. Since Samba does NOT implement SMB or NetBIOS over -any other protocols we need to know how to configure our network environment and simply +Input/Output System) over TCP/IP. Since Samba does not implement SMB or NetBIOS over +any other protocols, we need to know how to configure our network environment and simply remember to use nothing but TCP/IP on all our MS Windows network clients.

    Samba provides the ability to implement a WINS (Windows Internetworking Name Server) and implements extensions to Microsoft's implementation of WINS. These extensions -help Samba to affect stable WINS operations beyond the normal scope of MS WINS. +help Samba to effect stable WINS operations beyond the normal scope of MS WINS.

    -Please note that WINS is exclusively a service that applies only to those systems -that run NetBIOS over TCP/IP. MS Windows 200x / XP have the capacity to turn off -support for NetBIOS, in which case WINS is of no relevance. Samba supports this also. +WINS is exclusively a service that applies only to those systems +that run NetBIOS over TCP/IP. MS Windows 200x/XP have the capacity to operate with +support for NetBIOS disabled, in which case WINS is of no relevance. Samba supports this also.

    -For those networks on which NetBIOS has been disabled (ie: WINS is NOT required) +For those networks on which NetBIOS has been disabled (i.e., WINS is not required) the use of DNS is necessary for host name resolution. -

    What is Browsing?

    -To most people browsing means that they can see the MS Windows and Samba servers +

    What Is Browsing?

    +To most people browsing means they can see the MS Windows and Samba servers in the Network Neighborhood, and when the computer icon for a particular server is clicked, it opens up and shows the shares and printers available on the target server.

    -What seems so simple is in fact a very complex interaction of different technologies. -The technologies (or methods) employed in making all of this work includes: -

    • MS Windows machines register their presence to the network

    • Machines announce themselves to other machines on the network

    • One or more machine on the network collates the local announcements

    • The client machine finds the machine that has the collated list of machines

    • The client machine is able to resolve the machine names to IP addresses

    • The client machine is able to connect to a target machine

    +What seems so simple is in fact a complex interaction of different technologies. +The technologies (or methods) employed in making all of this work include: +

    • MS Windows machines register their presence to the network.
    • Machines announce themselves to other machines on the network.
    • One or more machine on the network collates the local announcements.
    • The client machine finds the machine that has the collated list of machines.
    • The client machine is able to resolve the machine names to IP addresses.
    • The client machine is able to connect to a target machine.

    The Samba application that controls browse list management and name resolution is called nmbd. The configuration parameters involved in nmbd's operation are: -

    Browsing options: os level(*), - lm announce, - lm interval, - preferred master(*), - local master(*), - domain master(*), - browse list, - enhanced browsing. +

    Browsing options: os level(*), + lm announce, + lm interval, + preferred master(*), + local master(*), + domain master(*), + browse list, + enhanced browsing.

    Name Resolution Method: - name resolve order(*). + name resolve order(*).

    WINS options: - dns proxy, - wins proxy, - wins server(*), - wins support(*), - wins hook. -

    + dns proxy, + wins proxy, + wins server(*), + wins support(*), + wins hook. +

    + For Samba, the WINS Server and WINS Support are mutually exclusive options. Those marked with -an '*' are the only options that commonly MAY need to be modified. Even if not one of these -parameters is set nmbd will still do it's job. -

    Discussion

    -Firstly, all MS Windows networking uses SMB (Server Message Block) based messaging. -SMB messaging may be implemented with or without NetBIOS. MS Windows 200x supports -NetBIOS over TCP/IP for backwards compatibility. Microsoft is intent on phasing out NetBIOS -support. -

    NetBIOS over TCP/IP

    -Samba implements NetBIOS, as does MS Windows NT / 200x / XP, by encapsulating it over TCP/IP. -MS Windows products can do likewise. NetBIOS based networking uses broadcast messaging to -affect browse list management. When running NetBIOS over TCP/IP, this uses UDP based messaging. +an (*) are the only options that commonly may need to be modified. Even if none of these +parameters is set, nmbd will still do its job. +

    Discussion

    +All MS Windows networking uses SMB-based messaging. SMB messaging may be implemented with or without NetBIOS. +MS Windows 200x supports NetBIOS over TCP/IP for backwards compatibility. Microsoft appears intent on phasing +out NetBIOS support. +

    NetBIOS over TCP/IP

    +Samba implements NetBIOS, as does MS Windows NT/200x/XP, by encapsulating it over TCP/IP. +MS Windows products can do likewise. NetBIOS-based networking uses broadcast messaging to +effect browse list management. When running NetBIOS over TCP/IP, this uses UDP-based messaging. UDP messages can be broadcast or unicast. -

    +

    + Normally, only unicast UDP messaging can be forwarded by routers. The -remote announce parameter to smb.conf helps to project browse announcements +remote announce parameter to smb.conf helps to project browse announcements to remote network segments via unicast UDP. Similarly, the -remote browse sync parameter of smb.conf +remote browse sync parameter of smb.conf implements browse list collation using unicast UDP.

    Secondly, in those networks where Samba is the only SMB server technology, -wherever possible nmbd should be configured on one (1) machine as the WINS +wherever possible nmbd should be configured on one machine as the WINS server. This makes it easy to manage the browsing environment. If each network -segment is configured with it's own Samba WINS server, then the only way to -get cross segment browsing to work is by using the -remote announce and the remote browse sync +segment is configured with its own Samba WINS server, then the only way to +get cross-segment browsing to work is by using the + + +remote announce and the remote browse sync parameters to your smb.conf file.

    - -If only one WINS server is used for an entire multi-segment network then -the use of the remote announce and the -remote browse sync parameters should NOT be necessary. + +If only one WINS server is used for an entire multi-segment network, then +the use of the remote announce and the +remote browse sync parameters should not be necessary.

    -As of Samba 3 WINS replication is being worked on. The bulk of the code has -been committed, but it still needs maturation. This is NOT a supported feature + +As of Samba-3 WINS replication is being worked on. The bulk of the code has +been committed, but it still needs maturation. This is not a supported feature of the Samba-3.0.0 release. Hopefully, this will become a supported feature of one of the Samba-3 release series.

    Right now Samba WINS does not support MS-WINS replication. This means that -when setting up Samba as a WINS server there must only be one nmbd +when setting up Samba as a WINS server, there must only be one nmbd configured as a WINS server on the network. Some sites have used multiple Samba WINS servers for redundancy (one server per subnet) and then used -remote browse sync and remote announce -to affect browse list collation across all segments. Note that this means clients +remote browse sync and remote announce +to effect browse list collation across all segments. Note that this means clients will only resolve local names, and must be configured to use DNS to resolve names on other subnets in order to resolve the IP addresses of the servers they can see on other subnets. This setup is not recommended, but is mentioned as a practical -consideration (ie: an 'if all else fails' scenario). +consideration (i.e., an “if all else fails” scenario).

    Lastly, take note that browse lists are a collection of unreliable broadcast messages that are repeated at intervals of not more than 15 minutes. This means that it will take time to establish a browse list and it can take up to 45 -minutes to stabilise, particularly across network segments. -

    TCP/IP - without NetBIOS

    - - - -All TCP/IP using systems use various forms of host name resolution. The primary -methods for TCP/IP hostname resolutions involves either a static file (/etc/hosts -) or DNS (the Domain Name System). DNS is the technology that makes -the Internet usable. DNS based host name resolution is supported by nearly all TCP/IP -enabled systems. Only a few embedded TCP/IP systems do not support DNS. -

    -When an MS Windows 200x / XP system attempts to resolve a host name to an IP address +minutes to stabilize, particularly across network segments. +

    TCP/IP without NetBIOS

    + + + +All TCP/IP-enabled systems use various forms of host name resolution. The primary +methods for TCP/IP hostname resolution involve either a static file (/etc/hosts) +or the Domain Name System (DNS). DNS is the technology that makes +the Internet usable. DNS-based host name resolution is supported by nearly all +TCP/IP-enabled systems. Only a few embedded TCP/IP systems do not support DNS. +

    +When an MS Windows 200x/XP system attempts to resolve a host name to an IP address it follows a defined path:

    1. Checks the hosts file. It is located in - C:\WinNT\System32\Drivers\etc. + C:\Windows NT\System32\Drivers\etc.

    2. - Does a DNS lookup + Does a DNS lookup.

    3. - Checks the NetBIOS name cache + Checks the NetBIOS name cache.

    4. - Queries the WINS server + Queries the WINS server.

    5. - Does a broadcast name lookup over UDP + Does a broadcast name lookup over UDP.

    6. - Looks up entries in LMHOSTS. It is located in - C:\WinNT\System32\Drivers\etc. -

    -Windows 200x / XP can register it's host name with a Dynamic DNS server. You can -force register with a Dynamic DNS server in Windows 200x / XP using: -ipconfig /registerdns + Looks up entries in LMHOSTS. It is located in + C:\Windows NT\System32\Drivers\etc. +

    + +Windows 200x/XP can register its host name with a Dynamic DNS server. You can +force register with a Dynamic DNS server in Windows 200x/XP using: +ipconfig /registerdns.

    With Active Directory (ADS), a correctly functioning DNS server is absolutely essential. In the absence of a working DNS server that has been correctly configured, -MS Windows clients and servers will be totally unable to locate each other, +MS Windows clients and servers will be unable to locate each other, so consequently network services will be severely impaired.

    The use of Dynamic DNS is highly recommended with Active Directory, in which case -the use of BIND9 is preferred for it's ability to adequately support the SRV (service) +the use of BIND9 is preferred for its ability to adequately support the SRV (service) records that are needed for Active Directory. -

    DNS and Active Directory

    -Occasionally we hear from UNIX network administrators who want to use a UNIX based Dynamic +

    DNS and Active Directory

    + +Occasionally we hear from UNIX network administrators who want to use a UNIX-based Dynamic DNS server in place of the Microsoft DNS server. While this might be desirable to some, the MS Windows 200x DNS server is auto-configured to work with Active Directory. It is possible to use BIND version 8 or 9, but it will almost certainly be necessary to create service records -so that MS Active Directory clients can resolve host names to locate essential network services. +so MS Active Directory clients can resolve host names to locate essential network services. The following are some of the default service records that Active Directory requires: -

    • _ldap._tcp.pdc.ms-dcs.Domain

      - This provides the address of the Windows NT PDC for the Domain. -

    • _ldap._tcp.pdc.ms-dcs.DomainTree

      - Resolves the addresses of Global Catalog servers in the domain. -

    • _ldap._tcp.site.sites.writable.ms-dcs.Domain

      - Provides list of domain controllers based on sites. -

    • _ldap._tcp.writable.ms-dcs.Domain

      - Enumerates list of domain controllers that have the writable - copies of the Active Directory data store. -

    • _ldap._tcp.GUID.domains.ms-dcs.DomainTree

      - Entry used by MS Windows clients to locate machines using the - Global Unique Identifier. -

    • _ldap._tcp.Site.gc.ms-dcs.DomainTree

      - Used by MS Windows clients to locate site configuration dependent - Global Catalog server. -

    How Browsing Functions

    +

    _ldap._tcp.pdc.ms-dcs.Domain

    + This provides the address of the Windows NT PDC for the Domain. +

    _ldap._tcp.pdc.ms-dcs.DomainTree

    + Resolves the addresses of Global Catalog servers in the domain. +

    _ldap._tcp.site.sites.writable.ms-dcs.Domain

    + Provides list of Domain Controllers based on sites. +

    _ldap._tcp.writable.ms-dcs.Domain

    + Enumerates list of Domain Controllers that have the writable copies of the Active Directory datastore. +

    _ldap._tcp.GUID.domains.ms-dcs.DomainTree

    + Entry used by MS Windows clients to locate machines using the Global Unique Identifier. +

    _ldap._tcp.Site.gc.ms-dcs.DomainTree

    + Used by MS Windows clients to locate site configuration dependent Global Catalog server. +

    How Browsing Functions

    MS Windows machines register their NetBIOS names -(ie: the machine name for each service type in operation) on start -up. The exact method by which this name registration +(i.e., the machine name for each service type in operation) on start-up. +The exact method by which this name registration takes place is determined by whether or not the MS Windows client/server has been given a WINS server address, whether or not LMHOSTS lookup is enabled, or if DNS for NetBIOS name resolution is enabled, etc. @@ -2336,27 +2499,27 @@ is enabled, or if DNS for NetBIOS name resolution is enabled, etc. In the case where there is no WINS server, all name registrations as well as name lookups are done by UDP broadcast. This isolates name resolution to the local subnet, unless LMHOSTS is used to list all -names and IP addresses. In such situations Samba provides a means by +names and IP addresses. In such situations, Samba provides a means by which the Samba server name may be forcibly injected into the browse list of a remote MS Windows network (using the -remote announce parameter). +remote announce parameter).

    Where a WINS server is used, the MS Windows client will use UDP unicast to register with the WINS server. Such packets can be routed and thus WINS allows name resolution to function across routed networks.

    During the startup process an election will take place to create a -local master browser if one does not already exist. On each NetBIOS network -one machine will be elected to function as the domain master browser. This -domain browsing has nothing to do with MS security domain control. -Instead, the domain master browser serves the role of contacting each local +Local Master Browser if one does not already exist. On each NetBIOS network +one machine will be elected to function as the Domain Master Browser. This +domain browsing has nothing to do with MS security Domain Control. +Instead, the Domain Master Browser serves the role of contacting each local master browser (found by asking WINS or from LMHOSTS) and exchanging browse list contents. This way every master browser will eventually obtain a complete -list of all machines that are on the network. Every 11-15 minutes an election +list of all machines that are on the network. Every 11 to 15 minutes an election is held to determine which machine will be the master browser. By the nature of the election criteria used, the machine with the highest uptime, or the -most senior protocol version, or other criteria, will win the election -as domain master browser. +most senior protocol version or other criteria, will win the election +as Domain Master Browser.

    Clients wishing to browse the network make use of this list, but also depend on the availability of correct name resolution to the respective IP @@ -2366,358 +2529,318 @@ Any configuration that breaks name resolution and/or browsing intrinsics will annoy users because they will have to put up with protracted inability to use the network services.

    -Samba supports a feature that allows forced synchronisation -of browse lists across routed networks using the remote browse sync parameter in the smb.conf file. -This causes Samba to contact the local master browser on a remote network and -to request browse list synchronisation. This effectively bridges -two networks that are separated by routers. The two remote -networks may use either broadcast based name resolution or WINS -based name resolution, but it should be noted that the remote browse sync parameter provides browse list synchronisation - and -that is distinct from name to address resolution, in other -words, for cross subnet browsing to function correctly it is -essential that a name to address resolution mechanism be provided. -This mechanism could be via DNS, /etc/hosts, -and so on. -

    Setting up WORKGROUP Browsing

    -To set up cross subnet browsing on a network containing machines -in up to be in a WORKGROUP, not an NT Domain you need to set up one -Samba server to be the Domain Master Browser (note that this is *NOT* +Samba supports a feature that allows forced synchronization of browse lists across +routed networks using the remote browse sync +parameter in the smb.conf file. This causes Samba to contact the local master +browser on a remote network and to request browse list synchronization. This +effectively bridges two networks that are separated by routers. The two remote +networks may use either broadcast-based name resolution or WINS-based name +resolution, but it should be noted that the +remote browse sync parameter provides +browse list synchronization and that is distinct from name to address +resolution. In other words, for cross-subnet browsing to function correctly it is +essential that a name-to-address resolution mechanism be provided. This mechanism +could be via DNS, /etc/hosts, and so on. +

    Configuring WORKGROUP Browsing

    +To configure cross-subnet browsing on a network containing machines +in a WORKGROUP, not an NT Domain, you need to set up one +Samba server to be the Domain Master Browser (note that this is not the same as a Primary Domain Controller, although in an NT Domain the -same machine plays both roles). The role of a Domain master browser is -to collate the browse lists from local master browsers on all the -subnets that have a machine participating in the workgroup. Without -one machine configured as a domain master browser each subnet would -be an isolated workgroup, unable to see any machines on any other -subnet. It is the presence of a domain master browser that makes -cross subnet browsing possible for a workgroup. -

    -In an WORKGROUP environment the domain master browser must be a -Samba server, and there must only be one domain master browser per -workgroup name. To set up a Samba server as a domain master browser, +same machine plays both roles). The role of a Domain Master Browser is +to collate the browse lists from Local Master Browsers on all the +subnets that have a machine participating in the workgroup. Without +one machine configured as a Domain Master Browser, each subnet would +be an isolated workgroup unable to see any machines on another +subnet. It is the presence of a Domain Master Browser that makes +cross-subnet browsing possible for a workgroup. +

    +In a WORKGROUP environment the Domain Master Browser must be a +Samba server, and there must only be one Domain Master Browser per +workgroup name. To set up a Samba server as a Domain Master Browser, set the following option in the [global] section -of the smb.conf file : +of the smb.conf file:

    domain master = yes

    -The domain master browser should also preferably be the local master -browser for its own subnet. In order to achieve this set the following -options in the [global] section of the smb.conf file : -

    -

    Example 10.1. Domain master browser smb.conf

    [global]
    domain master = yes
    local master = yes
    preferred master = yes
    os level = 65

    -

    -The domain master browser may be the same machine as the WINS -server, if you require. -

    -Next, you should ensure that each of the subnets contains a -machine that can act as a local master browser for the -workgroup. Any MS Windows NT/2K/XP/2003 machine should be -able to do this, as will Windows 9x machines (although these -tend to get rebooted more often, so it's not such a good idea -to use these). To make a Samba server a local master browser -set the following options in the [global] section of the -smb.conf file : -

    -

    Example 10.2. Local master browser smb.conf

    [global]
    domain master = no
    local master = yes
    preferred master = yes
    os level = 65

    -

    -Do not do this for more than one Samba server on each subnet, -or they will war with each other over which is to be the local -master browser. -

    -The local master parameter allows Samba to act as a -local master browser. The preferred master causes nmbd -to force a browser election on startup and the os level -parameter sets Samba high enough so that it should win any browser elections. -

    -If you have an NT machine on the subnet that you wish to -be the local master browser then you can disable Samba from -becoming a local master browser by setting the following -options in the [global] section of the -smb.conf file : -

    -

    Example 10.3. smb.conf for not being a master browser

    [global]
    domain master = no
    local master = no
    preferred master = no
    os level = 0

    -

    Setting up DOMAIN Browsing

    -If you are adding Samba servers to a Windows NT Domain then -you must not set up a Samba server as a domain master browser. -By default, a Windows NT Primary Domain Controller for a domain -is also the Domain master browser for that domain, and many -things will break if a Samba server registers the Domain master -browser NetBIOS name (DOMAIN<1B>) +The Domain Master Browser should preferably be the local master +browser for its own subnet. In order to achieve this, set the following +options in the [global] section of the smb.conf +file as shown in . +

    +

    Example 10.1. Domain Master Browser smb.conf

    [global]
    domain master = yes
    local master = yes
    preferred master = yes
    os level = 65

    +

    +The Domain Master Browser may be the same machine as the WINS server, if necessary. +

    +Next, you should ensure that each of the subnets contains a machine that can act as +a Local Master Browser for the workgroup. Any MS Windows NT/200x/XP machine should +be able to do this, as will Windows 9x/Me machines (although these tend to get +rebooted more often, so it is not such a good idea to use these). To make a Samba +server a Local Master Browser set the following options in the +[global] section of the smb.conf file as +shown in : +

    +

    Example 10.2. Local master browser smb.conf

    [global]
    domain master = no
    local master = yes
    preferred master = yes
    os level = 65

    +

    +Do not do this for more than one Samba server on each subnet, or they will war with +each other over which is to be the Local Master Browser. +

    +The local master parameter allows Samba to act as a +Local Master Browser. The preferred master causes nmbd +to force a browser election on startup and the os level +parameter sets Samba high enough so it should win any browser elections. +

    +If you have an NT machine on the subnet that you wish to be the Local Master Browser, you can disable Samba from +becoming a Local Master Browser by setting the following options in the [global] section of the +smb.conf file as shown in : +

    +

    Example 10.3. smb.conf for not being a Master Browser

    [global]
    domain master = no
    local master = no
    preferred master = no
    os level = 0

    +

    DOMAIN Browsing Configuration

    +If you are adding Samba servers to a Windows NT Domain, then you must not set up a Samba server as a Domain Master Browser. +By default, a Windows NT Primary Domain Controller for a domain is also the Domain Master Browser for that domain. Network +browsing may break if a Samba server registers the domain master browser NetBIOS name (DOMAIN<1B>) with WINS instead of the PDC.

    -For subnets other than the one containing the Windows NT PDC -you may set up Samba servers as local master browsers as -described. To make a Samba server a local master browser set -the following options in the [global] section -of the smb.conf file : -

    -

    Example 10.4. Local master browser smb.conf

    [global]
    domain master = no
    local master = yes
    preferred master = yes
    os level = 65

    -

    -If you wish to have a Samba server fight the election with machines -on the same subnet you may set the os level parameter -to lower levels. By doing this you can tune the order of machines that -will become local master browsers if they are running. For -more details on this see the section -Forcing Samba to be the master browser -below. -

    -If you have Windows NT machines that are members of the domain -on all subnets, and you are sure they will always be running then -you can disable Samba from taking part in browser elections and -ever becoming a local master browser by setting following options -in the [global] section of the smb.conf -file : -

    -

    Example 10.5. smb.conf for not being a master browser

    [global]
    domain master = no
    local master = no
    preferred master = no
    os level = 0

    -

    Forcing Samba to be the master

    -Who becomes the master browser is determined by an election -process using broadcasts. Each election packet contains a number of parameters -which determine what precedence (bias) a host should have in the -election. By default Samba uses a very low precedence and thus loses -elections to just about anyone else. -

    -If you want Samba to win elections then just set the os level global -option in smb.conf to a higher number. It defaults to 0. Using 34 -would make it win all elections over every other system (except other -samba systems!) -

    -A os level of 2 would make it beat WfWg and Win95, but not MS Windows -NT/2K Server. A MS Windows NT/2K Server domain controller uses level 32. -

    The maximum os level is 255

    -If you want Samba to force an election on startup, then set the -preferred master global option in smb.conf to yes. Samba will -then have a slight advantage over other potential master browsers -that are not preferred master browsers. Use this parameter with -care, as if you have two hosts (whether they are Windows 95 or NT or -Samba) on the same local subnet both set with preferred master to -yes, then periodically and continually they will force an election -in order to become the local master browser. -

    - If you want Samba to be a domain master browser, then it is -recommended that you also set preferred master to yes, because -Samba will not become a domain master browser for the whole of your -LAN or WAN if it is not also a local master browser on its own -broadcast isolated subnet. -

    -It is possible to configure two Samba servers to attempt to become -the domain master browser for a domain. The first server that comes -up will be the domain master browser. All other Samba servers will -attempt to become the domain master browser every 5 minutes. They -will find that another Samba server is already the domain master -browser and will fail. This provides automatic redundancy, should -the current domain master browser fail. -

    Making Samba the domain master

    -The domain master is responsible for collating the browse lists of -multiple subnets so that browsing can occur between subnets. You can -make Samba act as the domain master by setting domain master = yes -in smb.conf. By default it will not be a domain master. -

    -Note that you should not set Samba to be the domain master for a -workgroup that has the same name as an NT Domain. -

    -When Samba is the domain master and the master browser, it will listen -for master announcements (made roughly every twelve minutes) from local -master browsers on other subnets and then contact them to synchronise -browse lists. -

    -If you want Samba to be the domain master then I suggest you also set -the os level high enough to make sure it wins elections, and set -preferred master to yes, to get Samba to force an election on -startup. -

    -Note that all your servers (including Samba) and clients should be -using a WINS server to resolve NetBIOS names. If your clients are only -using broadcasting to resolve NetBIOS names, then two things will occur: +For subnets other than the one containing the Windows NT PDC, you may set up Samba servers as Local Master Browsers as +described. To make a Samba server a Local Master Browser, set the following options in the [global] section +of the smb.conf file as shown in : +

    +

    Example 10.4. Local Master Browser smb.conf

    [global]
    domain master = no
    local master = yes
    preferred master = yes
    os level = 65

    +

    +If you wish to have a Samba server fight the election with machines on the same subnet you +may set the os level parameter to lower levels. +By doing this you can tune the order of machines that will become Local Master Browsers if +they are running. For more details on this refer to . +

    +If you have Windows NT machines that are members of the domain on all subnets and you are +sure they will always be running, you can disable Samba from taking part in browser elections +and ever becoming a Local Master Browser by setting the following options in the +[global] section of the smb.conf file as shown in : +

    +

    Example 10.5. smb.conf for not being a master browser

    [global]
    domain master = no
    local master = no
    preferred master = no
    os level = 0

    +

    Forcing Samba to Be the Master

    +Who becomes the master browser is determined by an election process using broadcasts. Each election packet contains a number of parameters +that determine what precedence (bias) a host should have in the election. By default Samba uses a low precedence and thus loses +elections to just about every Windows network server or client. +

    +If you want Samba to win elections, set the os level +global option in smb.conf to a higher number. It defaults to zero. Using 34 would make it win +all elections every other system (except other samba systems). +

    +An os level of two would make it beat Windows for Workgroups and Windows 9x/Me, but not MS Windows +NT/200x Server. An MS Windows NT/200x Server Domain Controller uses level 32. The maximum os level is 255. +

    +If you want Samba to force an election on startup, set the +preferred master global option in smb.conf to yes. +Samba will then have a slight advantage over other potential master browsers that are not Perferred Master Browsers. +Use this parameter with care, as if you have two hosts (whether they are Windows 9x/Me or +NT/200x/XP or Samba) on the same local subnet both set with preferred master +to yes, then periodically and continually they will force an election in order +to become the Local Master Browser. +

    +If you want Samba to be a Domain Master Browser, then it is recommended that +you also set preferred master to yes, because +Samba will not become a Domain Master Browser for the whole of your LAN or WAN if it is not also a +Local Master Browser on its own broadcast isolated subnet. +

    +It is possible to configure two Samba servers to attempt to become the Domain Master Browser for a domain. The first server that comes +up will be the Domain Master Browser. All other Samba servers will attempt to become the Domain Master Browser every five minutes. They +will find that another Samba server is already the domain master browser and will fail. This provides automatic redundancy, should +the current Domain Master Browser fail. +

    Making Samba the Domain Master

    +The domain master is responsible for collating the browse lists of multiple subnets so browsing can occur between subnets. You can +make Samba act as the Domain Master by setting domain master = yes +in smb.conf. By default it will not be a Domain Master. +

    +Do not set Samba to be the Domain Master for a workgroup that has the same name as an NT/200x Domain. +If Samba is configured to be the Domain Master for a workgroup that is present on the same +network as a Windows NT/200x domain that has the same name, network browsing problems will +certainly be experienced. +

    +When Samba is the Domain Master and the Master Browser, it will listen for master +announcements (made roughly every twelve minutes) from Local Master Browsers on +other subnets and then contact them to synchronize browse lists. +

    +If you want Samba to be the domain master, you should also set the +os level high enough to make sure it wins elections, and +set preferred master to yes, to +get Samba to force an election on startup. +

    +All servers (including Samba) and clients should be using a WINS server to resolve NetBIOS names. If your +clients are only using broadcasting to resolve NetBIOS names, then two things will occur:

    1. - your local master browsers will be unable to find a domain master - browser, as it will only be looking on the local subnet. + Local Master Browsers will be unable to find a Domain Master Browser, as they will be looking only on the local subnet.

    2. - if a client happens to get hold of a domain-wide browse list, and - a user attempts to access a host in that list, it will be unable to - resolve the NetBIOS name of that host. + If a client happens to get hold of a domain-wide browse list and a user attempts to access a + host in that list, it will be unable to resolve the NetBIOS name of that host.

    If, however, both Samba and your clients are using a WINS server, then:

    1. - your local master browsers will contact the WINS server and, as long as - Samba has registered that it is a domain master browser with the WINS - server, your local master browser will receive Samba's IP address - as its domain master browser. -

    2. - when a client receives a domain-wide browse list, and a user attempts - to access a host in that list, it will contact the WINS server to - resolve the NetBIOS name of that host. as long as that host has - registered its NetBIOS name with the same WINS server, the user will - be able to see that host. -

    Note about broadcast addresses

    -If your network uses a "0" based broadcast address (for example if it -ends in a 0) then you will strike problems. Windows for Workgroups -does not seem to support a 0's broadcast and you will probably find -that browsing and name lookups won't work. -

    Multiple interfaces

    -Samba now supports machines with multiple network interfaces. If you -have multiple interfaces then you will need to use the interfaces -option in smb.conf to configure them. -

    Use of the Remote Announce parameter

    -The remote announce parameter of + Local master browsers will contact the WINS server and, as long as Samba has registered that it is a Domain Master Browser with the WINS + server, the Local Master Browser will receive Samba's IP address as its Domain Master Browser. +

  • + When a client receives a domain-wide browse list and a user attempts to access a host in that list, it will contact the WINS server to + resolve the NetBIOS name of that host. As long as that host has registered its NetBIOS name with the same WINS server, the user will + be able to see that host. +

    • Note about Broadcast Addresses

    +If your network uses a 0 based broadcast address (for example, if it ends in a 0) then you will strike problems. Windows for Workgroups +does not seem to support a zeros broadcast and you will probably find that browsing and name lookups will not work. +

    Multiple Interfaces

    +Samba supports machines with multiple network interfaces. If you have multiple interfaces, you will +need to use the interfaces option in smb.conf to configure them. +

    Use of the Remote Announce Parameter

    +The remote announce parameter of smb.conf can be used to forcibly ensure that all the NetBIOS names on a network get announced to a remote network. -The syntax of the remote announce parameter is: +The syntax of the remote announce parameter is:

    remote announce = a.b.c.d [e.f.g.h] ...

    or

    remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...

    where: -

    a.b.c.d and -e.f.g.h

    - - - - is either the LMB (Local Master Browser) IP address -or the broadcast address of the remote network. -ie: the LMB is at 192.168.1.10, or the address -could be given as 192.168.1.255 where the netmask -is assumed to be 24 bits (255.255.255.0). -When the remote announcement is made to the broadcast -address of the remote network, every host will receive -our announcements. This is noisy and therefore -undesirable but may be necessary if we do NOT know -the IP address of the remote LMB.

    WORKGROUP

    is optional and can be either our own workgroup -or that of the remote network. If you use the -workgroup name of the remote network then our -NetBIOS machine names will end up looking like -they belong to that workgroup, this may cause -name resolution problems and should be avoided. -

    -

    Use of the Remote Browse Sync parameter

    -The remote browse sync parameter of -smb.conf is used to announce to -another LMB that it must synchronise its NetBIOS name list with our -Samba LMB. It works ONLY if the Samba server that has this option is +

    a.b.c.d and e.f.g.h

    + + + is either the LMB (Local Master Browser) IP address or the broadcast address of the remote network. + i.e., the LMB is at 192.168.1.10, or the address could be given as 192.168.1.255 where the netmask + is assumed to be 24 bits (255.255.255.0). When the remote announcement is made to the broadcast + address of the remote network, every host will receive our announcements. This is noisy and therefore + undesirable but may be necessary if we do not know the IP address of the remote LMB. +

    WORKGROUP

    is optional and can be either our own workgroup or that of the remote network. If you use the + workgroup name of the remote network, our NetBIOS machine names will end up looking like + they belong to that workgroup. This may cause name resolution problems and should be avoided. +

    +

    Use of the Remote Browse Sync Parameter

    +The remote browse sync parameter of +smb.conf is used to announce to another LMB that it must synchronize its NetBIOS name list with our +Samba LMB. This works only if the Samba server that has this option is simultaneously the LMB on its network segment.

    -The syntax of the remote browse sync parameter is: +The syntax of the remote browse sync parameter is:

    remote browse sync = a.b.c.d

    where a.b.c.d is either the IP address of the remote LMB or else is the network broadcast address of the remote segment. -

    WINS - The Windows Internetworking Name Server

    -Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly +

    WINS The Windows Internetworking Name Server

    +Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly recommended. Every NetBIOS machine registers its name together with a name_type value for each of several types of service it has available. -eg: It registers its name directly as a unique (the type 0x03) name. +It registers its name directly as a unique (the type 0x03) name. It also registers its name if it is running the LanManager compatible server service (used to make shares and printers available to other users) by registering the server (the type 0x20) name.

    All NetBIOS names are up to 15 characters in length. The name_type variable -is added to the end of the name - thus creating a 16 character name. Any +is added to the end of the name, thus creating a 16 character name. Any name that is shorter than 15 characters is padded with spaces to the 15th -character. ie: All NetBIOS names are 16 characters long (including the +character. Thus, all NetBIOS names are 16 characters long (including the name_type information).

    -WINS can store these 16 character names as they get registered. A client +WINS can store these 16-character names as they get registered. A client that wants to log onto the network can ask the WINS server for a list of all names that have registered the NetLogon service name_type. This saves broadcast traffic and greatly expedites logon processing. Since broadcast -name resolution can not be used across network segments this type of -information can only be provided via WINS or via statically configured -lmhosts files that must reside on all clients in the +name resolution cannot be used across network segments this type of +information can only be provided via WINS or via a statically configured +lmhosts file that must reside on all clients in the absence of WINS.

    -WINS also serves the purpose of forcing browse list synchronisation by all -LMB's. LMB's must synchronise their browse list with the DMB (domain master -browser) and WINS helps the LMB to identify it's DMB. By definition this -will work only within a single workgroup. Note that the domain master browser -has NOTHING to do with what is referred to as an MS Windows NT Domain. The +WINS also serves the purpose of forcing browse list synchronization by all +LMBs. LMBs must synchronize their browse list with the DMB (Domain Master +Browser) and WINS helps the LMB to identify its DMB. By definition this +will work only within a single workgroup. Note that the Domain Master Browser +has nothing to do with what is referred to as an MS Windows NT Domain. The later is a reference to a security environment while the DMB refers to the master controller for browse list information only.

    -Use of WINS will work correctly only if EVERY client TCP/IP protocol stack -has been configured to use the WINS server/s. Any client that has not been -configured to use the WINS server will continue to use only broadcast based -name registration so that WINS may NEVER get to know about it. In any case, +WINS will work correctly only if every client TCP/IP protocol stack +has been configured to use the WINS servers. Any client that has not been +configured to use the WINS server will continue to use only broadcast-based +name registration so WINS may never get to know about it. In any case, machines that have not registered with a WINS server will fail name to address lookup attempts by other clients and will therefore cause workstation access errors.

    To configure Samba as a WINS server just add -wins support = yes to the smb.conf +wins support = yes to the smb.conf file [global] section.

    To configure Samba to register with a WINS server just add -wins server = a.b.c.d to your smb.conf file [global] section. +wins server = a.b.c.d +to your smb.conf file [global] section.

    Important

    -Never use both wins support = yes together -with wins server = a.b.c.d -particularly not using it's own IP address. -Specifying both will cause nmbd to refuse to start! -

    Setting up a WINS server

    -Either a Samba machine or a Windows NT Server machine may be set up -as a WINS server. To set a Samba machine to be a WINS server you must -add the following option to the smb.conf file on the selected machine : -in the [global] section add the line -

    -

    wins support = yes

    +Never use both wins support = yes together +with wins server = a.b.c.d +particularly not using its own IP address. Specifying both will cause nmbd to refuse to start! +

    WINS Server Configuration

    +Either a Samba Server or a Windows NT Server machine may be set up +as a WINS server. To configure a Samba Server to be a WINS server you must +add to the smb.conf file on the selected Server the following line to +the [global] section: +

    +

    wins support = yes

    Versions of Samba prior to 1.9.17 had this parameter default to -yes. If you have any older versions of Samba on your network it is +yes. If you have any older versions of Samba on your network it is strongly suggested you upgrade to a recent version, or at the very -least set the parameter to 'no' on all these machines. +least set the parameter to “no” on all these machines.

    -Machines with wins support = yes will keep a list of +Machines configured with wins support = yes will keep a list of all NetBIOS names registered with them, acting as a DNS for NetBIOS names.

    -You should set up only ONE WINS server. Do NOT set the -wins support = yes option on more than one Samba +It is strongly recommended to set up only one WINS server. Do not set the +wins support = yes option on more than one Samba server.

    -To set up a Windows NT Server as a WINS server you need to set up -the WINS service - see your NT documentation for details. Note that -Windows NT WINS Servers can replicate to each other, allowing more -than one to be set up in a complex subnet environment. As Microsoft -refuses to document these replication protocols, Samba cannot currently -participate in these replications. It is possible in the future that -a Samba->Samba WINS replication protocol may be defined, in which -case more than one Samba machine could be set up as a WINS server -but currently only one Samba server should have the -wins support = yes parameter set. -

    -After the WINS server has been configured you must ensure that all + +To configure Windows NT/200x Server as a WINS server, install and configure +the WINS service. See the Windows NT/200x documentation for details. +Windows NT/200x WINS servers can replicate to each other, allowing more +than one to be set up in a complex subnet environment. As Microsoft +refuses to document the replication protocols, Samba cannot currently +participate in these replications. It is possible in the future that +a Samba-to-Samba WINS replication protocol may be defined, in which +case more than one Samba machine could be set up as a WINS server. +Currently only one Samba server should have the +wins support = yes parameter set. +

    +After the WINS server has been configured, you must ensure that all machines participating on the network are configured with the address -of this WINS server. If your WINS server is a Samba machine, fill in +of this WINS server. If your WINS server is a Samba machine, fill in the Samba machine IP address in the Primary WINS Server field of the Control Panel->Network->Protocols->TCP->WINS Server dialogs -in Windows 95 or Windows NT. To tell a Samba server the IP address -of the WINS server add the following line to the [global] section of -all smb.conf files : +in Windows 9x/Me or Windows NT/200x. To tell a Samba server the IP address +of the WINS server, add the following line to the [global] section of +all smb.conf files:

    -

    wins server = <name or IP address>

    +

    wins server = <name or IP address>

    where <name or IP address> is either the DNS name of the WINS server machine or its IP address.

    -Note that this line MUST NOT BE SET in the smb.conf file of the Samba -server acting as the WINS server itself. If you set both the -wins support = yes option and the -wins server = <name> option then -nmbd will fail to start. +This line must not be set in the smb.conf file of the Samba +server acting as the WINS server itself. If you set both the +wins support = yes option and the +wins server = <name> option then +nmbd will fail to start.

    -There are two possible scenarios for setting up cross subnet browsing. -The first details setting up cross subnet browsing on a network containing -Windows 95, Samba and Windows NT machines that are not configured as -part of a Windows NT Domain. The second details setting up cross subnet +There are two possible scenarios for setting up cross-subnet browsing. +The first details setting up cross-subnet browsing on a network containing +Windows 9x/Me, Samba and Windows NT/200x machines that are not configured as +part of a Windows NT Domain. The second details setting up cross-subnet browsing on networks that contain NT Domains. -

    WINS Replication

    +

    WINS Replication

    + Samba-3 permits WINS replication through the use of the wrepld utility. This tool is not currently capable of being used as it is still in active development. -As soon as this tool becomes moderately functional we will prepare man pages and enhance this +As soon as this tool becomes moderately functional, we will prepare man pages and enhance this section of the documentation to provide usage and technical details. -

    Static WINS Entries

    +

    Static WINS Entries

    Adding static entries to your Samba WINS server is actually fairly easy. All you have to do is add a line to wins.dat, typically located in /usr/local/samba/var/locks.

    -Entries in wins.dat take the form of +Entries in wins.dat take the form of: 

     "NAME#TYPE" TTL ADDRESS+ FLAGS
@@ -2728,61 +2851,61 @@ time-to-live as an absolute time in seconds, ADDRESS+ is one or more
 addresses corresponding to the registration and FLAGS are the NetBIOS
 flags for the registration.
 
    
-A typical dynamic entry looks like:
+A typical dynamic entry looks like this:
 
     "MADMAN#03" 1055298378 192.168.1.2 66R
 
    
 
-To make it static, all that has to be done is set the TTL to 0:
+To make it static, all that has to be done is set the TTL to 0, like this:
 
 
     "MADMAN#03" 0 192.168.1.2 66R
 
    
 
    
-Though this method works with early Samba-3 versions, there's a
+Though this method works with early Samba-3 versions, there is a
 possibility that it may change in future versions if WINS replication
 is added.
-

    Helpful Hints

    +

    Helpful Hints

    The following hints should be carefully considered as they are stumbling points for many new network administrators. -

    Windows Networking Protocols

    Warning

    -Do NOT use more than one (1) protocol on MS Windows machines +

    Windows Networking Protocols

    Warning

    +Do not use more than one protocol on MS Windows machines.

    -A very common cause of browsing problems results from installing more than +A common cause of browsing problems results from installing more than one protocol on an MS Windows machine.

    Every NetBIOS machine takes part in a process of electing the LMB (and DMB) every 15 minutes. A set of election criteria is used to determine the order of precedence for winning this election process. A machine running Samba or -Windows NT will be biased so that the most suitable machine will predictably -win and thus retain it's role. +Windows NT will be biased so the most suitable machine will predictably +win and thus retain its role.

    -The election process is "fought out" so to speak over every NetBIOS network -interface. In the case of a Windows 9x machine that has both TCP/IP and IPX -installed and has NetBIOS enabled over both protocols the election will be -decided over both protocols. As often happens, if the Windows 9x machine is +The election process is “fought out” so to speak over every NetBIOS network +interface. In the case of a Windows 9x/Me machine that has both TCP/IP and IPX +installed and has NetBIOS enabled over both protocols, the election will be +decided over both protocols. As often happens, if the Windows 9x/Me machine is the only one with both protocols then the LMB may be won on the NetBIOS interface over the IPX protocol. Samba will then lose the LMB role as Windows -9x will insist it knows who the LMB is. Samba will then cease to function -as an LMB and thus browse list operation on all TCP/IP only machines will +9x/Me will insist it knows who the LMB is. Samba will then cease to function +as an LMB and thus browse list operation on all TCP/IP-only machines will fail. -

    -Windows 95, 98, 98se, Me are referred to generically as Windows 9x. -The Windows NT4, 2000, XP and 2003 use common protocols. These are roughly -referred to as the WinNT family, but it should be recognised that 2000 and +

    +Windows 95, 98, 98se, and Me are referred to generically as Windows 9x/Me. +The Windows NT4, 200x, and XP use common protocols. These are roughly +referred to as the Windows NT family, but it should be recognized that 2000 and XP/2003 introduce new protocol extensions that cause them to behave -differently from MS Windows NT4. Generally, where a server does NOT support +differently from MS Windows NT4. Generally, where a server does not support the newer or extended protocol, these will fall back to the NT4 protocols. -

    -The safest rule of all to follow it this - USE ONLY ONE PROTOCOL! -

    Name Resolution Order

    +

    +The safest rule of all to follow is: use only one protocol! +

    Name Resolution Order

    Resolution of NetBIOS names to IP addresses can take place using a number of methods. The only ones that can provide NetBIOS name_type information are: -

    • WINS: the best tool!

    • LMHOSTS: is static and hard to maintain.

    • Broadcast: uses UDP and can not resolve names across remote segments.

    -Alternative means of name resolution includes: -

    • /etc/hosts: is static, hard to maintain, and lacks name_type info

    • DNS: is a good choice but lacks essential name_type info.

    -Many sites want to restrict DNS lookups and want to avoid broadcast name +

    • WINS the best tool.
    • LMHOSTS static and hard to maintain.
    • Broadcast uses UDP and cannot resolve names across remote segments.

    +Alternative means of name resolution include: +

    • Static /etc/hosts hard to maintain, and lacks name_type info.
    • DNS is a good choice but lacks essential name_type info.

    +Many sites want to restrict DNS lookups and avoid broadcast name resolution traffic. The name resolve order parameter is of great help here. The syntax of the name resolve order parameter is:

    name resolve order = wins lmhosts bcast host

    @@ -2790,482 +2913,546 @@ The syntax of the name resolve order parameter

    name resolve order = wins lmhosts (eliminates bcast and host)

    The default is:

    name resolve order = host lmhost wins bcast

    -where "host" refers to the native methods used by the UNIX system +where “host” refers to the native methods used by the UNIX system to implement the gethostbyname() function call. This is normally controlled by /etc/host.conf, /etc/nsswitch.conf and /etc/resolv.conf. -

    Technical Overview of browsing

    +

    Technical Overview of Browsing

    SMB networking provides a mechanism by which clients can access a list -of machines in a network, a so-called browse list. This list +of machines in a network, a so-called browse list. This list contains machines that are ready to offer file and/or print services to other machines within the network. Thus it does not include -machines which aren't currently able to do server tasks. The browse -list is heavily used by all SMB clients. Configuration of SMB +machines that aren't currently able to do server tasks. The browse +list is heavily used by all SMB clients. Configuration of SMB browsing has been problematic for some Samba users, hence this document.

    -MS Windows 2000 and later, as with Samba 3 and later, can be +MS Windows 2000 and later versions, as with Samba-3 and later versions, can be configured to not use NetBIOS over TCP/IP. When configured this way, it is imperative that name resolution (using DNS/LDAP/ADS) be correctly -configured and operative. Browsing will NOT work if name resolution +configured and operative. Browsing will not work if name resolution from SMB machine names to IP addresses does not function correctly.

    -Where NetBIOS over TCP/IP is enabled use of a WINS server is highly +Where NetBIOS over TCP/IP is enabled, use of a WINS server is highly recommended to aid the resolution of NetBIOS (SMB) names to IP addresses. WINS allows remote segment clients to obtain NetBIOS name_type information -that can NOT be provided by any other means of name resolution. -

    Browsing support in Samba

    -Samba facilitates browsing. The browsing is supported by nmbd +that cannot be provided by any other means of name resolution. +

    Browsing Support in Samba

    +Samba facilitates browsing. The browsing is supported by nmbd and is also controlled by options in the smb.conf file. Samba can act as a local browse master for a workgroup and the ability to support domain logons and scripts is now available.

    -Samba can also act as a domain master browser for a workgroup. This -means that it will collate lists from local browse masters into a -wide area network server list. In order for browse clients to +Samba can also act as a Domain Master Browser for a workgroup. This +means that it will collate lists from Local Master Browsers into a +wide area network server list. In order for browse clients to resolve the names they may find in this list, it is recommended that both Samba and your clients use a WINS server.

    -Note that you should NOT set Samba to be the domain master for a -workgroup that has the same name as an NT Domain: on each wide area -network, you must only ever have one domain master browser per workgroup, -regardless of whether it is NT, Samba or any other type of domain master -that is providing this service. +Do not set Samba to be the Domain Master for a workgroup that has the same +name as an NT Domain. On each wide area network, you must only ever have one +Domain Master Browser per workgroup, regardless of whether it is NT, Samba +or any other type of domain master that is providing this service.

    Note

    -Nmbd can be configured as a WINS server, but it is not -necessary to specifically use Samba as your WINS server. MS Windows -NT4, Server or Advanced Server 2000 or 2003 can be configured as -your WINS server. In a mixed NT/2000/2003 server and Samba environment on +nmbd can be configured as a WINS server, but it is not +necessary to specifically use Samba as your WINS server. MS Windows +NT4, Server or Advanced Server 200x can be configured as +your WINS server. In a mixed NT/200x server and Samba environment on a Wide Area Network, it is recommended that you use the Microsoft -WINS server capabilities. In a Samba-only environment, it is -recommended that you use one and only one Samba server as your WINS server. +WINS server capabilities. In a Samba-only environment, it is +recommended that you use one and only one Samba server as the WINS server.

    To get browsing to work you need to run nmbd as usual, but will need -to use the workgroup option in smb.conf +to use the workgroup option in smb.conf to control what workgroup Samba becomes a part of.

    Samba also has a useful option for a Samba server to offer itself for -browsing on another subnet. It is recommended that this option is only -used for 'unusual' purposes: announcements over the internet, for -example. See remote announce in the -smb.conf man page. -

    Problem resolution

    -If something doesn't work then hopefully the log.nmbd file will help -you track down the problem. Try a debug level of 2 or 3 for finding +browsing on another subnet. It is recommended that this option is only +used for “unusual” purposes: announcements over the Internet, for +example. See remote announce in the +smb.conf man page. +

    Problem Resolution

    +If something does not work, the log.nmbd file will help +to track down the problem. Try a log level of 2 or 3 for finding problems. Also note that the current browse list usually gets stored in text form in a file called browse.dat.

    -Note that if it doesn't work for you, then you should still be able to -type the server name as \\SERVER in filemanager then -hit enter and filemanager should display the list of available shares. +If it does not work, you should still be able to +type the server name as \\SERVER in filemanager, then +press enter and filemanager should display the list of available shares.

    -Some people find browsing fails because they don't have the global -guest account set to a valid account. Remember that the -IPC$ connection that lists the shares is done as guest, and thus you must -have a valid guest account. -

    -MS Windows 2000 and upwards (as with Samba) can be configured to disallow -anonymous (ie: Guest account) access to the IPC$ share. In that case, the +Some people find browsing fails because they do not have the global +guest account set to a valid account. Remember that the +IPC$ connection that lists the shares is done as guest and, thus, you must have a valid guest account. +

    +MS Windows 2000 and later (as with Samba) can be configured to disallow +anonymous (i.e., guest account) access to the IPC$ share. In that case, the MS Windows 2000/XP/2003 machine acting as an SMB/CIFS client will use the -name of the currently logged in user to query the IPC$ share. MS Windows -9X clients are not able to do this and thus will NOT be able to browse +name of the currently logged-in user to query the IPC$ share. MS Windows +9x/Me clients are not able to do this and thus will not be able to browse server resources. -

    +

    The other big problem people have is that their broadcast address, -netmask or IP address is wrong (specified with the "interfaces" option +netmask or IP address is wrong (specified with the interfaces option in smb.conf) -

    Browsing across subnets

    -Since the release of Samba 1.9.17(alpha1), Samba has supported the +

    Cross-Subnet Browsing

    + +Since the release of Samba 1.9.17 (alpha1), Samba has supported the replication of browse lists across subnet boundaries. This section describes how to set this feature up in different settings.

    -To see browse lists that span TCP/IP subnets (ie. networks separated -by routers that don't pass broadcast traffic), you must set up at least -one WINS server. The WINS server acts as a DNS for NetBIOS names, allowing -NetBIOS name to IP address translation to be done by doing a direct -query of the WINS server. This is done via a directed UDP packet on -port 137 to the WINS server machine. The reason for a WINS server is -that by default, all NetBIOS name to IP address translation is done -by broadcasts from the querying machine. This means that machines +To see browse lists that span TCP/IP subnets (i.e., networks separated +by routers that do not pass broadcast traffic), you must set up at least +one WINS server. The WINS server acts as a DNS for NetBIOS names. This will +allow NetBIOS name-to-IP address translation to be completed by a direct +query of the WINS server. This is done via a directed UDP packet on +port 137 to the WINS server machine. The WINS server avoids the necessity +of default NetBIOS name-to-IP address translation, which is done +using UDP broadcasts from the querying machine. This means that machines on one subnet will not be able to resolve the names of machines on another subnet without using a WINS server.

    Remember, for browsing across subnets to work correctly, all machines, -be they Windows 95, Windows NT, or Samba servers must have the IP address +be they Windows 95, Windows NT or Samba servers, must have the IP address of a WINS server given to them by a DHCP server, or by manual configuration -(for Win95 and WinNT, this is in the TCP/IP Properties, under Network -settings) for Samba this is in the smb.conf file. -

    How does cross subnet browsing work ?

    -Cross subnet browsing is a complicated dance, containing multiple -moving parts. It has taken Microsoft several years to get the code +(for Windows 9x/Me and Windows NT/200x/XP, this is in the TCP/IP Properties, under Network +settings); for Samba, this is in the smb.conf file. +

    Behavior of Cross-Subnet Browsing

    +Cross-subnet Browsing is a complicated dance, containing multiple +moving parts. It has taken Microsoft several years to get the code that achieves this correct, and Samba lags behind in some areas. -Samba is capable of cross subnet browsing when configured correctly. -

    - Consider a network set up as in the diagram below. -

    Figure 10.1. Cross subnet browsing example

    Cross subnet browsing example

    -Consisting of 3 subnets (1, 2, 3) connected by two routers -(R1, R2) - these do not pass broadcasts. Subnet 1 has 5 machines -on it, subnet 2 has 4 machines, subnet 3 has 4 machines. Assume -for the moment that all these machines are configured to be in the -same workgroup (for simplicity's sake). Machine N1_C on subnet 1 -is configured as Domain Master Browser (ie. it will collate the -browse lists for the workgroup). Machine N2_D is configured as +Samba is capable of cross-subnet browsing when configured correctly. +

    +Consider a network set up as . +

    Figure 10.1. Cross-Subnet Browsing Example.

    Cross-Subnet Browsing Example.

    +This consists of 3 subnets (1, 2, 3) connected by two routers +(R1, R2) which do not pass broadcasts. Subnet 1 has five machines +on it, subnet 2 has four machines, subnet 3 has four machines. Assume +for the moment that all machines are configured to be in the +same workgroup (for simplicity's sake). Machine N1_C on subnet 1 +is configured as Domain Master Browser (i.e., it will collate the +browse lists for the workgroup). Machine N2_D is configured as WINS server and all the other machines are configured to register their NetBIOS names with it.

    -As all these machines are booted up, elections for master browsers -will take place on each of the three subnets. Assume that machine +As these machines are booted up, elections for master browsers +will take place on each of the three subnets. Assume that machine N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on -subnet 3 - these machines are known as local master browsers for -their particular subnet. N1_C has an advantage in winning as the -local master browser on subnet 1 as it is set up as Domain Master +subnet 3. These machines are known as Local Master Browsers for +their particular subnet. N1_C has an advantage in winning as the +Local Master Browser on subnet 1 as it is set up as Domain Master Browser.

    On each of the three networks, machines that are configured to offer sharing services will broadcast that they are offering -these services. The local master browser on each subnet will +these services. The Local Master Browser on each subnet will receive these broadcasts and keep a record of the fact that -the machine is offering a service. This list of records is -the basis of the browse list. For this case, assume that -all the machines are configured to offer services so all machines +the machine is offering a service. This list of records is +the basis of the browse list. For this case, assume that +all the machines are configured to offer services, so all machines will be on the browse list.

    -For each network, the local master browser on that network is -considered 'authoritative' for all the names it receives via -local broadcast. This is because a machine seen by the local -master browser via a local broadcast must be on the same -network as the local master browser and thus is a 'trusted' -and 'verifiable' resource. Machines on other networks that -the local master browsers learn about when collating their -browse lists have not been directly seen - these records are -called 'non-authoritative'. +For each network, the Local Master Browser on that network is +considered “authoritative” for all the names it receives via +local broadcast. This is because a machine seen by the Local Master +Browser via a local broadcast must be on the same network as the +Local Master Browser and thus is a “trusted” +and “verifiable” resource. Machines on other networks that +the Local Master Browsers learn about when collating their +browse lists have not been directly seen. These records are +called “non-authoritative.”

    -At this point the browse lists look as follows (these are -the machines you would see in your network neighborhood if -you looked in it on a particular network right now). +At this point the browse lists appear as shown in (these are +the machines you would see in your network neighborhood if you looked in it on a particular network right now).

    -

    Table 10.1. Browse subnet example 1

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    +

    Table 10.1. Browse Subnet Example 1

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    -Note that at this point all the subnets are separate, no -machine is seen across any of the subnets. +At this point all the subnets are separate, and no machine is seen across any of the subnets.

    -Now examine subnet 2. As soon as N2_B has become the local -master browser it looks for a Domain master browser to synchronize -its browse list with. It does this by querying the WINS server +Now examine subnet 2. As soon as N2_B has become the Local +Master Browser it looks for a Domain Master Browser with which to synchronize +its browse list. It does this by querying the WINS server (N2_D) for the IP address associated with the NetBIOS name -WORKGROUP<1B>. This name was registered by the Domain master -browser (N1_C) with the WINS server as soon as it was booted. +WORKGROUP<1B>. This name was registered by the Domain Master +Browser (N1_C) with the WINS server as soon as it was started.

    -Once N2_B knows the address of the Domain master browser it -tells it that is the local master browser for subnet 2 by -sending a MasterAnnouncement packet as a UDP port 138 packet. -It then synchronizes with it by doing a NetServerEnum2 call. This +Once N2_B knows the address of the Domain Master Browser, it +tells it that is the Local Master Browser for subnet 2 by +sending a MasterAnnouncement packet as a UDP port 138 packet. +It then synchronizes with it by doing a NetServerEnum2 call. This tells the Domain Master Browser to send it all the server -names it knows about. Once the domain master browser receives -the MasterAnnouncement packet it schedules a synchronization -request to the sender of that packet. After both synchronizations -are done the browse lists look like : -

    -

    Table 10.2. Browse subnet example 2

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +names it knows about. Once the Domain Master Browser receives +the MasterAnnouncement packet, it schedules a synchronization +request to the sender of that packet. After both synchronizations +are complete the browse lists look as shown in : +

    Table 10.2. Browse Subnet Example 2

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D

    - -Servers with a (*) after them are non-authoritative names. +Servers with an (*) after them are non-authoritative names.

    At this point users looking in their network neighborhood on subnets 1 or 2 will see all the servers on both, users on subnet 3 will still only see the servers on their own subnet.

    The same sequence of events that occurred for N2_B now occurs -for the local master browser on subnet 3 (N3_D). When it -synchronizes browse lists with the domain master browser (N1_A) +for the Local Master Browser on subnet 3 (N3_D). When it +synchronizes browse lists with the Domain Master Browser (N1_A) it gets both the server entries on subnet 1, and those on -subnet 2. After N3_D has synchronized with N1_C and vica-versa -the browse lists look like. -

    -

    Table 10.3. Browse subnet example 3

    ", (winstype == 0) ? "checked" : ""); d_printf("", (winstype == 1) ? "checked" : ""); d_printf("", (winstype == 2) ? "checked" : ""); + d_printf("\n"); + d_printf(""); d_printf(""); } - d_printf(""); d_printf("\n","Expose Home Directories: "); d_printf("", (have_home == -1) ? "" : "checked "); d_printf("", (have_home == -1 ) ? "checked" : ""); @@ -780,7 +781,7 @@ static void globals_page(void) unsigned int parm_filter = FLAG_BASIC; int mode = 0; - d_printf("

    %s

    \n", _("Global Variables")); + d_printf("

    %s

    \n", _("Global Parameters")); if (cgi_variable("Commit")) { commit_parameters(GLOBAL_SECTION_SNUM); -- cgit From 22634870b8f3672755276a28270365ba15e6e44f Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 29 Sep 2003 06:20:55 +0000 Subject: Merge from 3.0: >Fix to parse the level-2 strings. From Anthony Liguori aliguor@us.ibm.com. >Jeremy. (This used to be commit 3420320714798427bf9b760ed89fa4ce9346ad19) --- source3/utils/net_ads_cldap.c | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-) diff --git a/source3/utils/net_ads_cldap.c b/source3/utils/net_ads_cldap.c index 595e6e9434..44de9cb891 100644 --- a/source3/utils/net_ads_cldap.c +++ b/source3/utils/net_ads_cldap.c @@ -32,19 +32,15 @@ struct cldap_netlogon_reply { GUID guid; char forest[MAX_DNS_LABEL]; - char unk0[MAX_DNS_LABEL]; char domain[MAX_DNS_LABEL]; char hostname[MAX_DNS_LABEL]; char netbios_domain[MAX_DNS_LABEL]; - char unk1[MAX_DNS_LABEL]; char netbios_hostname[MAX_DNS_LABEL]; - char unk2[MAX_DNS_LABEL]; + char unk[MAX_DNS_LABEL]; char user_name[MAX_DNS_LABEL]; - char unk3[MAX_DNS_LABEL]; char site_name[MAX_DNS_LABEL]; - char unk4[MAX_DNS_LABEL]; char site_name_2[MAX_DNS_LABEL]; uint32 version; @@ -115,7 +111,7 @@ static unsigned pull_netlogon_string(char *ret, const char *ptr, } } while (*ptr); - return ret_len ? ret_len : 1; + return followed_ptr ? ret_len : ret_len + 1; } /* @@ -249,13 +245,11 @@ static int recv_cldap_netlogon(int sock, struct cldap_netlogon_reply *reply) p += GUID_SIZE; p += pull_netlogon_string(reply->forest, p, (const char *)os3.data); - p += pull_netlogon_string(reply->unk0, p, (const char *)os3.data); p += pull_netlogon_string(reply->domain, p, (const char *)os3.data); p += pull_netlogon_string(reply->hostname, p, (const char *)os3.data); p += pull_netlogon_string(reply->netbios_domain, p, (const char *)os3.data); - p += pull_netlogon_string(reply->unk1, p, (const char *)os3.data); p += pull_netlogon_string(reply->netbios_hostname, p, (const char *)os3.data); - p += pull_netlogon_string(reply->unk2, p, (const char *)os3.data); + p += pull_netlogon_string(reply->unk, p, (const char *)os3.data); if (reply->type == SAMLOGON_AD_R) { p += pull_netlogon_string(reply->user_name, p, (const char *)os3.data); @@ -263,9 +257,7 @@ static int recv_cldap_netlogon(int sock, struct cldap_netlogon_reply *reply) *reply->user_name = 0; } - p += pull_netlogon_string(reply->unk3, p, (const char *)os3.data); p += pull_netlogon_string(reply->site_name, p, (const char *)os3.data); - p += pull_netlogon_string(reply->unk4, p, (const char *)os3.data); p += pull_netlogon_string(reply->site_name_2, p, (const char *)os3.data); reply->version = IVAL(p, 0); @@ -349,20 +341,16 @@ int ads_cldap_netlogon(ADS_STRUCT *ads) (reply.flags & ADS_NDNC) ? "yes" : "no"); printf("Forest:\t\t\t%s\n", reply.forest); - if (*reply.unk0) printf("Unk0:\t\t\t%s\n", reply.unk0); printf("Domain:\t\t\t%s\n", reply.domain); printf("Domain Controller:\t%s\n", reply.hostname); printf("Pre-Win2k Domain:\t%s\n", reply.netbios_domain); - if (*reply.unk1) printf("Unk1:\t\t\t%s\n", reply.unk1); printf("Pre-Win2k Hostname:\t%s\n", reply.netbios_hostname); - if (*reply.unk2) printf("Unk2:\t\t\t%s\n", reply.unk2); + if (*reply.unk) printf("Unk:\t\t\t%s\n", reply.unk); if (*reply.user_name) printf("User name:\t%s\n", reply.user_name); - if (*reply.unk3) printf("Unk3:\t\t\t%s\n", reply.unk3); printf("Site Name:\t\t%s\n", reply.site_name); - if (*reply.unk4) printf("Unk4:\t\t\t%s\n", reply.unk4); printf("Site Name (2):\t\t%s\n", reply.site_name_2); d_printf("NT Version: %d\n", reply.version); -- cgit From cd5c595ccd6e4861c0d744645fb17eb9adbe5908 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 29 Sep 2003 06:21:01 +0000 Subject: Remove Japanese swat image files. (This used to be commit fab80c98a05645f420014c61f1d7f156f400ec55) --- swat/lang/ja/images/globals.gif | Bin 1613 -> 0 bytes swat/lang/ja/images/home.gif | Bin 1881 -> 0 bytes swat/lang/ja/images/passwd.gif | Bin 1427 -> 0 bytes swat/lang/ja/images/printers.gif | Bin 1987 -> 0 bytes swat/lang/ja/images/samba.gif | Bin 3877 -> 0 bytes swat/lang/ja/images/shares.gif | Bin 1590 -> 0 bytes swat/lang/ja/images/status.gif | Bin 2582 -> 0 bytes swat/lang/ja/images/viewconfig.gif | Bin 1485 -> 0 bytes 8 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 swat/lang/ja/images/globals.gif delete mode 100644 swat/lang/ja/images/home.gif delete mode 100644 swat/lang/ja/images/passwd.gif delete mode 100644 swat/lang/ja/images/printers.gif delete mode 100644 swat/lang/ja/images/samba.gif delete mode 100644 swat/lang/ja/images/shares.gif delete mode 100644 swat/lang/ja/images/status.gif delete mode 100644 swat/lang/ja/images/viewconfig.gif diff --git a/swat/lang/ja/images/globals.gif b/swat/lang/ja/images/globals.gif deleted file mode 100644 index 5f8eb15b34..0000000000 Binary files a/swat/lang/ja/images/globals.gif and /dev/null differ diff --git a/swat/lang/ja/images/home.gif b/swat/lang/ja/images/home.gif deleted file mode 100644 index a4e6122958..0000000000 Binary files a/swat/lang/ja/images/home.gif and /dev/null differ diff --git a/swat/lang/ja/images/passwd.gif b/swat/lang/ja/images/passwd.gif deleted file mode 100644 index c8242bf722..0000000000 Binary files a/swat/lang/ja/images/passwd.gif and /dev/null differ diff --git a/swat/lang/ja/images/printers.gif b/swat/lang/ja/images/printers.gif deleted file mode 100644 index f0db94cb57..0000000000 Binary files a/swat/lang/ja/images/printers.gif and /dev/null differ diff --git a/swat/lang/ja/images/samba.gif b/swat/lang/ja/images/samba.gif deleted file mode 100644 index 0c13dc9ef3..0000000000 Binary files a/swat/lang/ja/images/samba.gif and /dev/null differ diff --git a/swat/lang/ja/images/shares.gif b/swat/lang/ja/images/shares.gif deleted file mode 100644 index afc1b55cf5..0000000000 Binary files a/swat/lang/ja/images/shares.gif and /dev/null differ diff --git a/swat/lang/ja/images/status.gif b/swat/lang/ja/images/status.gif deleted file mode 100644 index f506cda77f..0000000000 Binary files a/swat/lang/ja/images/status.gif and /dev/null differ diff --git a/swat/lang/ja/images/viewconfig.gif b/swat/lang/ja/images/viewconfig.gif deleted file mode 100644 index ebc05f6c69..0000000000 Binary files a/swat/lang/ja/images/viewconfig.gif and /dev/null differ -- cgit From 981c82b16e82da859f7205cfc37ffe849e58b78c Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 29 Sep 2003 06:22:04 +0000 Subject: Merge from 3.0: >Allow d_printf() to handle strings with escaped quotation marks since the >msg file includes the escape character. > >Fixes bug #489. (This used to be commit 0871be2bfad8bfa5d4f0ff78e732c1073055da2e) --- source3/intl/lang_tdb.c | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) diff --git a/source3/intl/lang_tdb.c b/source3/intl/lang_tdb.c index 5409ce6619..af70b529ff 100644 --- a/source3/intl/lang_tdb.c +++ b/source3/intl/lang_tdb.c @@ -176,16 +176,47 @@ BOOL lang_tdb_init(const char *lang) const char *lang_msg(const char *msgid) { TDB_DATA key, data; + char *p, *q, *msgid_quoted; + int count; lang_tdb_init(NULL); if (!tdb) return msgid; - key.dptr = (char *)msgid; - key.dsize = strlen(msgid)+1; + /* Due to the way quotes in msgids are escaped in the msg file we + must replace " with \" before doing a lookup in the tdb. */ + + count = 0; + + for(p = msgid; *p; p++) { + if (*p == '\"') + count++; + } + + if (!(msgid_quoted = malloc(strlen(msgid) + count + 1))) + return msgid; + + /* string_sub() is unsuitable here as it replaces some punctuation + chars with underscores. */ + + for(p = msgid, q = msgid_quoted; *p; p++) { + if (*p == '\"') { + *q = '\\'; + q++; + } + *q = *p; + q++; + } + + *q = 0; + + key.dptr = (char *)msgid_quoted; + key.dsize = strlen(msgid_quoted)+1; data = tdb_fetch(tdb, key); + free(msgid_quoted); + /* if the message isn't found then we still need to return a pointer that can be freed. Pity. */ if (!data.dptr) -- cgit From 1052b52178fb4ce0e83ddfc48339d68d34fd43c3 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 29 Sep 2003 06:22:55 +0000 Subject: Merge from 3.0: >Apply some NULL pointer paranoia to previous wins hook fix. >Fix broken wins hook functionality. A i18n fixe caused the name type >to be appended to the netbios name between angle brackets. This interfered >the 'sh -c' used to implement smbrun(). Closes bug #528. (This used to be commit 12659ae74965f8a088361cb4fbf8730cdad84af1) --- source3/nmbd/nmbd_winsserver.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/source3/nmbd/nmbd_winsserver.c b/source3/nmbd/nmbd_winsserver.c index 484588c662..3694072420 100644 --- a/source3/nmbd/nmbd_winsserver.c +++ b/source3/nmbd/nmbd_winsserver.c @@ -107,7 +107,7 @@ static void wins_hook(const char *operation, struct name_record *namerec, int tt { pstring command; char *cmd = lp_wins_hook(); - char *p; + char *p, *namestr; int i; if (!cmd || !*cmd) return; @@ -119,11 +119,17 @@ static void wins_hook(const char *operation, struct name_record *namerec, int tt } } + /* Use the name without the nametype (and scope) appended */ + + namestr = nmb_namestr(&namerec->name); + if ((p = strchr(namestr, '<'))) + *p = 0; + p = command; p += slprintf(p, sizeof(command)-1, "%s %s %s %02x %d", cmd, operation, - nmb_namestr(&namerec->name), + namestr, namerec->name.name_type, ttl); -- cgit From 10ab4ce58abbd9b38bfb43165452cf45005159b4 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 29 Sep 2003 06:23:56 +0000 Subject: Merge from 3.0: >iconv isn't const safe. Neither should smb_iconv be. >Jeremy. (This used to be commit 7bd450f8b678e835ba4f9cfdc3d096b04da6f8f7) --- source3/lib/iconv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/lib/iconv.c b/source3/lib/iconv.c index 3d26d7e17c..0326ca7061 100644 --- a/source3/lib/iconv.c +++ b/source3/lib/iconv.c @@ -136,7 +136,7 @@ static size_t sys_iconv(void *cd, * enough that Samba works on systems that don't have iconv. **/ size_t smb_iconv(smb_iconv_t cd, - const char **inbuf, size_t *inbytesleft, + char **inbuf, size_t *inbytesleft, char **outbuf, size_t *outbytesleft) { char cvtbuf[2048]; -- cgit From 0dde70c2330b7fad898f27ba3102f425a8e5f579 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Mon, 29 Sep 2003 23:35:39 +0000 Subject: Take care of condition where DOS and NT error codes must differ. Found by DOS program test by Amir Hardon . Jeremy. (This used to be commit 294f376aa908a9c56b73b9bfe48d56012a8f557b) --- source3/smbd/reply.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c index 6ac4cffddb..303e33cc48 100644 --- a/source3/smbd/reply.c +++ b/source3/smbd/reply.c @@ -417,7 +417,7 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size if (check_name(name,conn)) { if (VALID_STAT(sbuf) || SMB_VFS_STAT(conn,name,&sbuf) == 0) if (!(ok = S_ISDIR(sbuf.st_mode))) - errno = ENOTDIR; + return ERROR_BOTH(NT_STATUS_NOT_A_DIRECTORY,ERRDOS,ERRbadpath); } if (!ok) { -- cgit From e1f16f33219b44f0a66af0da0a02d8e8781a24f6 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 1 Oct 2003 17:02:09 +0000 Subject: merge of parameter changes from 3.0 and fix for bug 550 (This used to be commit b6433f5db77a1d62309946c6f23c18c6c299d0c5) --- source3/lib/system.c | 8 +++++--- source3/lib/system_smbd.c | 2 +- source3/param/loadparm.c | 5 +---- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/source3/lib/system.c b/source3/lib/system.c index b020a20373..2e95efec79 100644 --- a/source3/lib/system.c +++ b/source3/lib/system.c @@ -693,7 +693,6 @@ int sys_getgroups(int setlen, gid_t *gidset) #endif /* HAVE_BROKEN_GETGROUPS */ } -#ifdef HAVE_SETGROUPS /************************************************************************** Wrapper for setgroups. Deals with broken (int) case. Automatically used @@ -702,6 +701,11 @@ int sys_getgroups(int setlen, gid_t *gidset) int sys_setgroups(int setlen, gid_t *gidset) { +#if !defined(HAVE_SETGROUPS) + errno = ENOSYS; + return -1; +#endif /* HAVE_SETGROUPS */ + #if !defined(HAVE_BROKEN_GETGROUPS) return setgroups(setlen, gidset); #else @@ -742,8 +746,6 @@ int sys_setgroups(int setlen, gid_t *gidset) #endif /* HAVE_BROKEN_GETGROUPS */ } -#endif /* HAVE_SETGROUPS */ - /************************************************************************** Wrappers for setpwent(), getpwent() and endpwent() ****************************************************************************/ diff --git a/source3/lib/system_smbd.c b/source3/lib/system_smbd.c index bcbc8c61e6..73c910e631 100644 --- a/source3/lib/system_smbd.c +++ b/source3/lib/system_smbd.c @@ -92,7 +92,7 @@ static int getgrouplist_internals(const char *user, gid_t gid, gid_t *groups, in restore_re_gid(); - if (setgroups(ngrp_saved, gids_saved) != 0) { + if (sys_setgroups(ngrp_saved, gids_saved) != 0) { /* yikes! */ DEBUG(0,("ERROR: getgrouplist: failed to reset group list!\n")); smb_panic("getgrouplist: failed to reset group list!\n"); diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index 0efa2796c3..45626192db 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -185,7 +185,6 @@ typedef struct int mangle_prefix; int max_log_size; char *szLogLevel; - int mangled_stack; int max_xmit; int max_mux; int max_open_files; @@ -972,7 +971,6 @@ static struct parm_struct parm_table[] = { {"mangling method", P_STRING, P_GLOBAL, &Globals.szManglingMethod, NULL, NULL, FLAG_ADVANCED}, {"mangle prefix", P_INTEGER, P_GLOBAL, &Globals.mangle_prefix, NULL, NULL, FLAG_ADVANCED}, - {"mangled stack", P_INTEGER, P_GLOBAL, &Globals.mangled_stack, NULL, NULL, FLAG_ADVANCED}, {"default case", P_ENUM, P_LOCAL, &sDefault.iDefaultCase, NULL, enum_case, FLAG_ADVANCED | FLAG_SHARE}, {"case sensitive", P_BOOL, P_LOCAL, &sDefault.bCaseSensitive, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, {"casesignames", P_BOOL, P_LOCAL, &sDefault.bCaseSensitive, NULL, NULL, FLAG_HIDE}, @@ -992,7 +990,7 @@ static struct parm_struct parm_table[] = { {"map hidden", P_BOOL, P_LOCAL, &sDefault.bMap_hidden, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, {"map archive", P_BOOL, P_LOCAL, &sDefault.bMap_archive, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, {"mangled names", P_BOOL, P_LOCAL, &sDefault.bMangledNames, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, - {"mangled map", P_STRING, P_LOCAL, &sDefault.szMangledMap, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"mangled map", P_STRING, P_LOCAL, &sDefault.szMangledMap, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL | FLAG_DEPRECATED }, {"stat cache", P_BOOL, P_GLOBAL, &Globals.bStatCache, NULL, NULL, FLAG_ADVANCED}, {"Domain Options", P_SEP, P_SEPARATOR}, @@ -1361,7 +1359,6 @@ static void init_globals(void) Globals.AlgorithmicRidBase = BASE_RID; Globals.bLoadPrinters = True; - Globals.mangled_stack = 50; /* Was 65535 (0xFFFF). 0x4101 matches W2K and causes major speed improvements... */ /* Discovered by 2 days of pain by Don McCall @ HP :-). */ Globals.max_xmit = 0x4104; -- cgit From bf498934c14dca51ed93a083b52429a37aea9c70 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 1 Oct 2003 17:07:28 +0000 Subject: remove duplicate smbspool link on SWAT's front page; bug 541 (This used to be commit b19316e071bfee15c8bbf1a521d87f1a4ab53cbe) --- swat/help/welcome.html | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/swat/help/welcome.html b/swat/help/welcome.html index 8fc54ad5f2..59429ba47d 100644 --- a/swat/help/welcome.html +++ b/swat/help/welcome.html @@ -33,13 +33,12 @@ Please choose a configuration action using one of the above buttons
  • smbclient - command line SMB client
  • smbmnt - helper utility for mounting SMB filesystems on Linux hosts
  • smbmount - user space tool for mounting SMB filesystems under Linux -
  • smbspool - command line SMB print client
  • smbumount - user space tool for umounting SMB filesystems under Linux
  • ntlm_auth - allow external programs to use NTLM authentication
  • smbcquotas - get or set quotas on NTFS 5 shares
  • smbsh - Allow access to remote SMB shares using a UNIX shell -
  • smbtree - Text-based SMB network browsing
  • smbspool - Send a print job to an SMB printer +
  • smbtree - Text-based SMB network browsing
  • Diagnostic Utilities
      -- cgit From 411c7463fbbf36462c34c9cbf90405472f12c2db Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 1 Oct 2003 17:56:51 +0000 Subject: make sure libnss_winbind.so.2 is included in the RedHAT RPMS (This used to be commit ceeb18d171d0e4ffc5c47ac4018909f266fd122c) --- packaging/RedHat/samba.spec.tmpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packaging/RedHat/samba.spec.tmpl b/packaging/RedHat/samba.spec.tmpl index 063af05dd3..4a9c6df163 100644 --- a/packaging/RedHat/samba.spec.tmpl +++ b/packaging/RedHat/samba.spec.tmpl @@ -158,7 +158,7 @@ install -m755 source/nsswitch/libnss_wins.so $RPM_BUILD_ROOT/lib # Install winbind shared libraries install -m755 source/nsswitch/libnss_winbind.so $RPM_BUILD_ROOT/lib -( cd $RPM_BUILD_ROOT/lib; ln -sf libnss_winbind.so libnss_winbind.so.2; ) +( cd $RPM_BUILD_ROOT/lib; ln -sf libnss_winbind.so libnss_winbind.so.2 ) install -m755 source/nsswitch/pam_winbind.so $RPM_BUILD_ROOT/lib/security # Install pam_smbpass.so @@ -445,6 +445,6 @@ MANDIR_MACRO/man8/* %dir /var/log/samba %dir /var/run/samba %attr(1777,root,root) %dir /var/spool/samba -%attr(-,root,root) /lib/libnss_winbind.so +%attr(-,root,root) /lib/libnss_winbind.so* %attr(-,root,root) /lib/security/pam_winbind.so %attr(-,root,root) /lib/security/pam_smbpass.so -- cgit From 4d0f0c0594c5a81e22686ff006ff689a2ca1fe47 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 1 Oct 2003 18:54:29 +0000 Subject: save and restore CFLAGS before/after AC_PROG_CC; this macro seems to overwrite the CFLAGS variable (This used to be commit aa7fccf6ad81da8a4a14abd699d1f765e18cd10c) --- source3/configure.in | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/source3/configure.in b/source3/configure.in index 8c2e9e7f9b..987e1ceb6b 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -166,6 +166,7 @@ AC_SUBST(EXTRA_ALL_TARGETS) AC_ARG_ENABLE(debug, [ --enable-debug Turn on compiler debugging information (default=no)], [if eval "test x$enable_debug = xyes"; then + echo "DEBUGGING TURNED ON!!!!" CFLAGS="${CFLAGS} -g" fi]) @@ -192,7 +193,15 @@ then fi dnl Checks for programs. + +## +## for some reason this macro resets the CFLAGS +## so save and restore +## +OLD_CFLAGS=${CFLAGS} AC_PROG_CC +CFLAGS=${OLD_CFLAGS} + AC_PROG_INSTALL AC_PROG_AWK AC_PATH_PROG(PERL, perl) -- cgit From 73953efac3e219e67d127e31e965756d8fa46104 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Wed, 1 Oct 2003 19:33:27 +0000 Subject: Allow ^C to interrupt smbpasswd if using our getpass. Jeremy. (This used to be commit 8a284463458cfaaff9986bbc459dfc113f921c6c) --- source3/lib/getsmbpass.c | 148 +++++++++++++++++++++++++++-------------------- 1 file changed, 86 insertions(+), 62 deletions(-) diff --git a/source3/lib/getsmbpass.c b/source3/lib/getsmbpass.c index b6ae09b318..93449b004d 100644 --- a/source3/lib/getsmbpass.c +++ b/source3/lib/getsmbpass.c @@ -83,71 +83,95 @@ static int tcsetattr(int fd, int flags, struct sgttyb *t) static struct termios t; #endif /* SYSV_TERMIO */ +static SIG_ATOMIC_T gotintr; +static int in_fd = -1; + +/*************************************************************** + Signal function to tell us were ^C'ed. +****************************************************************/ + +static void gotintr_sig(void) +{ + gotintr = 1; + if (in_fd != -1) + close(in_fd); /* Safe way to force a return. */ + in_fd = -1; +} + char *getsmbpass(const char *prompt) { - FILE *in, *out; - int echo_off; - static char buf[256]; - static size_t bufsize = sizeof(buf); - size_t nread; - - /* Catch problematic signals */ - CatchSignal(SIGINT, SIGNAL_CAST SIG_IGN); - - /* Try to write to and read from the terminal if we can. - If we can't open the terminal, use stderr and stdin. */ - - in = fopen ("/dev/tty", "w+"); - if (in == NULL) - { - in = stdin; - out = stderr; - } - else - out = in; - - setvbuf(in, NULL, _IONBF, 0); - - /* Turn echoing off if it is on now. */ - - if (tcgetattr (fileno (in), &t) == 0) - { - if (ECHO_IS_ON(t)) - { - TURN_ECHO_OFF(t); - echo_off = tcsetattr (fileno (in), TCSAFLUSH, &t) == 0; - TURN_ECHO_ON(t); + FILE *in, *out; + int echo_off; + static char buf[256]; + static size_t bufsize = sizeof(buf); + size_t nread; + + /* Catch problematic signals */ + CatchSignal(SIGINT, SIGNAL_CAST gotintr_sig); + + /* Try to write to and read from the terminal if we can. + If we can't open the terminal, use stderr and stdin. */ + + in = fopen ("/dev/tty", "w+"); + if (in == NULL) { + in = stdin; + out = stderr; + } else { + out = in; + } + + setvbuf(in, NULL, _IONBF, 0); + + /* Turn echoing off if it is on now. */ + + if (tcgetattr (fileno (in), &t) == 0) { + if (ECHO_IS_ON(t)) { + TURN_ECHO_OFF(t); + echo_off = tcsetattr (fileno (in), TCSAFLUSH, &t) == 0; + TURN_ECHO_ON(t); + } else { + echo_off = 0; + } + } else { + echo_off = 0; + } + + /* Write the prompt. */ + fputs(prompt, out); + fflush(out); + + /* Read the password. */ + buf[0] = 0; + if (!gotintr) { + in_fd = fileno(in); + fgets(buf, bufsize, in); + } + nread = strlen(buf); + if (buf[nread - 1] == '\n') + buf[nread - 1] = '\0'; + + /* Restore echoing. */ + if (echo_off) { + if (gotintr && in_fd == -1) + in = fopen ("/dev/tty", "w+"); + if (in != NULL) + tcsetattr (fileno (in), TCSANOW, &t); + } + + if (in != stdin) /* We opened the terminal; now close it. */ + fclose(in); + + /* Catch problematic signals */ + CatchSignal(SIGINT, SIGNAL_CAST SIG_DFL); + + printf("\n"); + + if (gotintr_sig) { + printf("Interupted by signal.\n"); + fflush(stdout); + exit(1); } - else - echo_off = 0; - } - else - echo_off = 0; - - /* Write the prompt. */ - fputs (prompt, out); - fflush (out); - - /* Read the password. */ - buf[0] = 0; - fgets(buf, bufsize, in); - nread = strlen(buf); - if (buf[nread - 1] == '\n') - buf[nread - 1] = '\0'; - - /* Restore echoing. */ - if (echo_off) - (void) tcsetattr (fileno (in), TCSANOW, &t); - - if (in != stdin) - /* We opened the terminal; now close it. */ - fclose (in); - - /* Catch problematic signals */ - CatchSignal(SIGINT, SIGNAL_CAST SIG_DFL); - - printf("\n"); - return buf; + return buf; } #else -- cgit From b8092fbf99d01783110566b51dfaf26d4802f403 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Wed, 1 Oct 2003 21:17:46 +0000 Subject: Fixed silly typo checking for signal_handler not signal. Jeremy. (This used to be commit 202d4e46527993d359df7cd04fb611c22cc920c3) --- source3/lib/getsmbpass.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/lib/getsmbpass.c b/source3/lib/getsmbpass.c index 93449b004d..27cd5e6dfa 100644 --- a/source3/lib/getsmbpass.c +++ b/source3/lib/getsmbpass.c @@ -166,7 +166,7 @@ char *getsmbpass(const char *prompt) printf("\n"); - if (gotintr_sig) { + if (gotintr) { printf("Interupted by signal.\n"); fflush(stdout); exit(1); -- cgit From e9568f8df282a8de58d077fb88b54b43023795ca Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 1 Oct 2003 22:00:19 +0000 Subject: commit sign only patch from Andrew; bug 167; tested using 2k & XP clientspreviously joined to the Samba domain (This used to be commit 9d2e585e5e6f9066c6901aa8d8308734f8667296) --- source3/include/rpc_dce.h | 11 +++- source3/rpc_client/cli_pipe.c | 29 ++++----- source3/rpc_parse/parse_prs.c | 147 +++++++++++++++++++++++++----------------- source3/rpc_parse/parse_rpc.c | 6 +- source3/rpc_server/srv_pipe.c | 30 +++++---- source3/rpcclient/rpcclient.c | 50 ++++++++------ 6 files changed, 159 insertions(+), 114 deletions(-) diff --git a/source3/include/rpc_dce.h b/source3/include/rpc_dce.h index 2e4a418bb7..52fe08d875 100644 --- a/source3/include/rpc_dce.h +++ b/source3/include/rpc_dce.h @@ -61,8 +61,14 @@ enum RPC_PKT_TYPE /* Netlogon schannel auth type and level */ #define NETSEC_AUTH_TYPE 0x44 -#define NETSEC_SIGNATURE { 0x77, 0x00, 0x7a, 0x00, 0xff, 0xff, 0x00, 0x00 } +#define NETSEC_SIGN_SIGNATURE { 0x77, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00 } +#define NETSEC_SEAL_SIGNATURE { 0x77, 0x00, 0x7a, 0x00, 0xff, 0xff, 0x00, 0x00 } #define RPC_AUTH_NETSEC_CHK_LEN 0x20 + +/* The 7 here seems to be required to get Win2k not to downgrade us + to NT4. Actually, anything other than 1ff would seem to do... */ +#define NETLOGON_NEG_AUTH2_FLAGS 0x000701ff + #define NETLOGON_NEG_SCHANNEL 0x40000000 enum netsec_direction @@ -239,13 +245,14 @@ typedef struct rpc_auth_netsec_chk_info uint8 sig [8]; /* 77 00 7a 00 ff ff 00 00 */ uint8 packet_digest[8]; /* checksum over the packet, MD5'ed with session key */ uint8 seq_num[8]; /* verifier, seq num */ - uint8 data8[8]; /* random 8-byte nonce */ + uint8 confounder[8]; /* random 8-byte nonce */ } RPC_AUTH_NETSEC_CHK; struct netsec_auth_struct { uchar sess_key[16]; uint32 seq_num; + int auth_flags; }; /* RPC_BIND_REQ - ms req bind */ diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c index dedbf017a9..9ce10202db 100644 --- a/source3/rpc_client/cli_pipe.c +++ b/source3/rpc_client/cli_pipe.c @@ -29,7 +29,9 @@ extern struct pipe_id_info pipe_names[]; -static void get_auth_type_level(int pipe_auth_flags, int *auth_type, int *auth_level) +/* convert pipe auth flags into the RPC auth type and level */ + +void get_auth_type_level(int pipe_auth_flags, int *auth_type, int *auth_level) { *auth_type = 0; *auth_level = 0; @@ -938,7 +940,6 @@ BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num, uint32 data_len, send_size; uint8 flags = 0; uint32 auth_padding = 0; - RPC_AUTH_NETSEC_CHK verf; DATA_BLOB sign_blob; /* @@ -1022,14 +1023,10 @@ BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num, } else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) { - static const uchar netsec_sig[8] = NETSEC_SIGNATURE; - static const uchar nullbytes[8] = { 0,0,0,0,0,0,0,0 }; size_t parse_offset_marker; + RPC_AUTH_NETSEC_CHK verf; DEBUG(10,("SCHANNEL seq_num=%d\n", cli->auth_info.seq_num)); - init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes, - nullbytes, nullbytes); - netsec_encode(&cli->auth_info, cli->pipe_auth_flags, SENDER_IS_INITIATOR, @@ -1277,8 +1274,10 @@ static BOOL rpc_send_auth_reply(struct cli_state *cli, prs_struct *rdata, uint32 prs_init(&rpc_out, RPC_HEADER_LEN + RPC_HDR_AUTHA_LEN, /* need at least this much */ cli->mem_ctx, MARSHALL); - create_rpc_bind_resp(cli, rpc_call_id, - &rpc_out); + if (!NT_STATUS_IS_OK(create_rpc_bind_resp(cli, rpc_call_id, + &rpc_out))) { + return False; + } if ((ret = cli_write(cli, cli->nt_pipe_fnum, 0x8, prs_data_p(&rpc_out), 0, (size_t)prs_offset(&rpc_out))) != (ssize_t)prs_offset(&rpc_out)) { @@ -1493,9 +1492,7 @@ NTSTATUS cli_nt_establish_netlogon(struct cli_state *cli, int sec_chan, const uchar trust_password[16]) { NTSTATUS result; - /* The 7 here seems to be required to get Win2k not to downgrade us - to NT4. Actually, anything other than 1ff would seem to do... */ - uint32 neg_flags = 0x000701ff; + uint32 neg_flags = NETLOGON_NEG_AUTH2_FLAGS; int fnum; cli_nt_netlogon_netsec_session_close(cli); @@ -1584,13 +1581,11 @@ NTSTATUS cli_nt_establish_netlogon(struct cli_state *cli, int sec_chan, } -NTSTATUS cli_nt_setup_netsec(struct cli_state *cli, int sec_chan, +NTSTATUS cli_nt_setup_netsec(struct cli_state *cli, int sec_chan, int auth_flags, const uchar trust_password[16]) { NTSTATUS result; - /* The 7 here seems to be required to get Win2k not to downgrade us - to NT4. Actually, anything other than 1ff would seem to do... */ - uint32 neg_flags = 0x000701ff; + uint32 neg_flags = NETLOGON_NEG_AUTH2_FLAGS; cli->pipe_auth_flags = 0; if (lp_client_schannel() == False) { @@ -1632,7 +1627,7 @@ NTSTATUS cli_nt_setup_netsec(struct cli_state *cli, int sec_chan, cli->nt_pipe_fnum = 0; /* doing schannel, not per-user auth */ - cli->pipe_auth_flags = AUTH_PIPE_NETSEC | AUTH_PIPE_SIGN | AUTH_PIPE_SEAL; + cli->pipe_auth_flags = auth_flags; return NT_STATUS_OK; } diff --git a/source3/rpc_parse/parse_prs.c b/source3/rpc_parse/parse_prs.c index 81a9573077..b30c41c090 100644 --- a/source3/rpc_parse/parse_prs.c +++ b/source3/rpc_parse/parse_prs.c @@ -3,7 +3,8 @@ Samba memory buffer functions Copyright (C) Andrew Tridgell 1992-1997 Copyright (C) Luke Kenneth Casson Leighton 1996-1997 - Copyright (C) Jeremy Allison 1999. + Copyright (C) Jeremy Allison 1999 + Copyright (C) Andrew Bartlett 2003. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -1337,47 +1338,6 @@ BOOL prs_hash1(prs_struct *ps, uint32 offset, uint8 sess_key[16], int len) return True; } -static void netsechash(uchar * key, uchar * data, int data_len) -{ - uchar hash[256]; - uchar index_i = 0; - uchar index_j = 0; - uchar j = 0; - int ind; - - for (ind = 0; ind < 256; ind++) - { - hash[ind] = (uchar) ind; - } - - for (ind = 0; ind < 256; ind++) - { - uchar tc; - - j += (hash[ind] + key[ind % 16]); - - tc = hash[ind]; - hash[ind] = hash[j]; - hash[j] = tc; - } - - for (ind = 0; ind < data_len; ind++) - { - uchar tc; - uchar t; - - index_i++; - index_j += hash[index_i]; - - tc = hash[index_i]; - hash[index_i] = hash[index_j]; - hash[index_j] = tc; - - t = hash[index_i] + hash[index_j]; - data[ind] ^= hash[t]; - } -} - /******************************************************************* Create a digest over the entire packet (including the data), and @@ -1400,7 +1360,7 @@ static void netsec_digest(struct netsec_auth_struct *a, MD5Update(&ctx3, zeros, sizeof(zeros)); MD5Update(&ctx3, verf->sig, sizeof(verf->sig)); if (auth_flags & AUTH_PIPE_SEAL) { - MD5Update(&ctx3, verf->data8, sizeof(verf->data8)); + MD5Update(&ctx3, verf->confounder, sizeof(verf->confounder)); } MD5Update(&ctx3, (const unsigned char *)data, data_len); MD5Final(whole_packet_digest, &ctx3); @@ -1456,10 +1416,29 @@ static void netsec_deal_with_seq_num(struct netsec_auth_struct *a, dump_data_pw("sequence_key:\n", sequence_key, sizeof(sequence_key)); dump_data_pw("seq_num (before):\n", verf->seq_num, sizeof(verf->seq_num)); - netsechash(sequence_key, verf->seq_num, 8); + SamOEMhash(verf->seq_num, sequence_key, 8); dump_data_pw("seq_num (after):\n", verf->seq_num, sizeof(verf->seq_num)); } +/******************************************************************* +creates an RPC_AUTH_NETSEC_CHK structure. +********************************************************************/ +static BOOL init_rpc_auth_netsec_chk(RPC_AUTH_NETSEC_CHK * chk, + const uchar sig[8], + const uchar packet_digest[8], + const uchar seq_num[8], const uchar confounder[8]) +{ + if (chk == NULL) + return False; + + memcpy(chk->sig, sig, sizeof(chk->sig)); + memcpy(chk->packet_digest, packet_digest, sizeof(chk->packet_digest)); + memcpy(chk->seq_num, seq_num, sizeof(chk->seq_num)); + memcpy(chk->confounder, confounder, sizeof(chk->confounder)); + + return True; +} + /******************************************************************* Encode a blob of data using the netsec (schannel) alogrithm, also produceing @@ -1469,26 +1448,47 @@ static void netsec_deal_with_seq_num(struct netsec_auth_struct *a, ********************************************************************/ void netsec_encode(struct netsec_auth_struct *a, int auth_flags, enum netsec_direction direction, - RPC_AUTH_NETSEC_CHK * verf, char *data, size_t data_len) + RPC_AUTH_NETSEC_CHK * verf, + char *data, size_t data_len) { uchar digest_final[16]; + uchar confounder[8]; + uchar seq_num[8]; + static const uchar nullbytes[8]; + + static const uchar netsec_seal_sig[8] = NETSEC_SEAL_SIGNATURE; + static const uchar netsec_sign_sig[8] = NETSEC_SIGN_SIGNATURE; + const uchar *netsec_sig; DEBUG(10,("SCHANNEL: netsec_encode seq_num=%d data_len=%lu\n", a->seq_num, (unsigned long)data_len)); + + if (auth_flags & AUTH_PIPE_SEAL) { + netsec_sig = netsec_seal_sig; + } else if (auth_flags & AUTH_PIPE_SIGN) { + netsec_sig = netsec_sign_sig; + } + + /* fill the 'confounder' with random data */ + generate_random_buffer(confounder, sizeof(confounder), False); + dump_data_pw("a->sess_key:\n", a->sess_key, sizeof(a->sess_key)); - RSIVAL(verf->seq_num, 0, a->seq_num); + RSIVAL(seq_num, 0, a->seq_num); switch (direction) { case SENDER_IS_INITIATOR: - SIVAL(verf->seq_num, 4, 0x80); + SIVAL(seq_num, 4, 0x80); break; case SENDER_IS_ACCEPTOR: - SIVAL(verf->seq_num, 4, 0x0); + SIVAL(seq_num, 4, 0x0); break; } - dump_data_pw("verf->seq_num:\n", verf->seq_num, sizeof(verf->seq_num)); + dump_data_pw("verf->seq_num:\n", seq_num, sizeof(verf->seq_num)); + init_rpc_auth_netsec_chk(verf, netsec_sig, nullbytes, + seq_num, confounder); + /* produce a digest of the packet to prove it's legit (before we seal it) */ netsec_digest(a, auth_flags, verf, data, data_len, digest_final); memcpy(verf->packet_digest, digest_final, sizeof(verf->packet_digest)); @@ -1500,14 +1500,14 @@ void netsec_encode(struct netsec_auth_struct *a, int auth_flags, netsec_get_sealing_key(a, verf, sealing_key); /* encode the verification data */ - dump_data_pw("verf->data8:\n", verf->data8, sizeof(verf->data8)); - netsechash(sealing_key, verf->data8, 8); + dump_data_pw("verf->confounder:\n", verf->confounder, sizeof(verf->confounder)); + SamOEMhash(verf->confounder, sealing_key, 8); - dump_data_pw("verf->data8_enc:\n", verf->data8, sizeof(verf->data8)); + dump_data_pw("verf->confounder_enc:\n", verf->confounder, sizeof(verf->confounder)); /* encode the packet payload */ dump_data_pw("data:\n", (const unsigned char *)data, data_len); - netsechash(sealing_key, (unsigned char *)data, data_len); + SamOEMhash((unsigned char *)data, sealing_key, data_len); dump_data_pw("data_enc:\n", (const unsigned char *)data, data_len); } @@ -1531,8 +1531,21 @@ BOOL netsec_decode(struct netsec_auth_struct *a, int auth_flags, { uchar digest_final[16]; - /* Create the expected sequence number for comparison */ + static const uchar netsec_seal_sig[8] = NETSEC_SEAL_SIGNATURE; + static const uchar netsec_sign_sig[8] = NETSEC_SIGN_SIGNATURE; + const uchar *netsec_sig; + uchar seq_num[8]; + + DEBUG(10,("SCHANNEL: netsec_encode seq_num=%d data_len=%lu\n", a->seq_num, (unsigned long)data_len)); + + if (auth_flags & AUTH_PIPE_SEAL) { + netsec_sig = netsec_seal_sig; + } else if (auth_flags & AUTH_PIPE_SIGN) { + netsec_sig = netsec_sign_sig; + } + + /* Create the expected sequence number for comparison */ RSIVAL(seq_num, 0, a->seq_num); switch (direction) { @@ -1560,6 +1573,20 @@ BOOL netsec_decode(struct netsec_auth_struct *a, int auth_flags, digest, as supplied by the client. We check that it's a valid checksum after the decode, below */ + DEBUG(2, ("netsec_decode: FAILED: packet sequence number:\n")); + dump_data(2, verf->seq_num, sizeof(verf->seq_num)); + DEBUG(2, ("should be:\n")); + dump_data(2, seq_num, sizeof(seq_num)); + + return False; + } + + if (memcmp(verf->sig, netsec_sig, sizeof(verf->sig))) { + /* Validate that the other end sent the expected header */ + DEBUG(2, ("netsec_decode: FAILED: packet header:\n")); + dump_data(2, verf->sig, sizeof(verf->sig)); + DEBUG(2, ("should be:\n")); + dump_data(2, netsec_sig, sizeof(netsec_sig)); return False; } @@ -1570,16 +1597,16 @@ BOOL netsec_decode(struct netsec_auth_struct *a, int auth_flags, netsec_get_sealing_key(a, verf, sealing_key); /* extract the verification data */ - dump_data_pw("verf->data8:\n", verf->data8, - sizeof(verf->data8)); - netsechash(sealing_key, verf->data8, 8); + dump_data_pw("verf->confounder:\n", verf->confounder, + sizeof(verf->confounder)); + SamOEMhash(verf->confounder, sealing_key, 8); - dump_data_pw("verf->data8_dec:\n", verf->data8, - sizeof(verf->data8)); + dump_data_pw("verf->confounder_dec:\n", verf->confounder, + sizeof(verf->confounder)); /* extract the packet payload */ dump_data_pw("data :\n", (const unsigned char *)data, data_len); - netsechash(sealing_key, (unsigned char *)data, data_len); + SamOEMhash((unsigned char *)data, sealing_key, data_len); dump_data_pw("datadec:\n", (const unsigned char *)data, data_len); } diff --git a/source3/rpc_parse/parse_rpc.c b/source3/rpc_parse/parse_rpc.c index 34ba62caa9..558378548a 100644 --- a/source3/rpc_parse/parse_rpc.c +++ b/source3/rpc_parse/parse_rpc.c @@ -1175,7 +1175,7 @@ creates an RPC_AUTH_NETSEC_CHK structure. BOOL init_rpc_auth_netsec_chk(RPC_AUTH_NETSEC_CHK * chk, const uchar sig[8], const uchar packet_digest[8], - const uchar seq_num[8], const uchar data8[8]) + const uchar seq_num[8], const uchar confounder[8]) { if (chk == NULL) return False; @@ -1183,7 +1183,7 @@ BOOL init_rpc_auth_netsec_chk(RPC_AUTH_NETSEC_CHK * chk, memcpy(chk->sig, sig, sizeof(chk->sig)); memcpy(chk->packet_digest, packet_digest, sizeof(chk->packet_digest)); memcpy(chk->seq_num, seq_num, sizeof(chk->seq_num)); - memcpy(chk->data8, data8, sizeof(chk->data8)); + memcpy(chk->confounder, confounder, sizeof(chk->confounder)); return True; } @@ -1203,7 +1203,7 @@ BOOL smb_io_rpc_auth_netsec_chk(const char *desc, RPC_AUTH_NETSEC_CHK * chk, prs_uint8s(False, "sig ", ps, depth, chk->sig, sizeof(chk->sig)); prs_uint8s(False, "seq_num", ps, depth, chk->seq_num, sizeof(chk->seq_num)); prs_uint8s(False, "packet_digest", ps, depth, chk->packet_digest, sizeof(chk->packet_digest)); - prs_uint8s(False, "data8", ps, depth, chk->data8, sizeof(chk->data8)); + prs_uint8s(False, "data8", ps, depth, chk->confounder, sizeof(chk->confounder)); return True; } diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c index d1fb587d74..96261c665f 100644 --- a/source3/rpc_server/srv_pipe.c +++ b/source3/rpc_server/srv_pipe.c @@ -254,18 +254,19 @@ BOOL create_next_pdu(pipes_struct *p) } if (p->netsec_auth_validated) { + int auth_type, auth_level; char *data; RPC_HDR_AUTH auth_info; - static const uchar netsec_sig[8] = NETSEC_SIGNATURE; - static const uchar nullbytes[8] = { 0,0,0,0,0,0,0,0 }; RPC_AUTH_NETSEC_CHK verf; prs_struct rverf; prs_struct rauth; data = prs_data_p(&outgoing_pdu) + data_pos; + /* Check it's the type of reply we were expecting to decode */ - init_rpc_hdr_auth(&auth_info, NETSEC_AUTH_TYPE, RPC_PIPE_AUTH_SEAL_LEVEL, + get_auth_type_level(p->netsec_auth.auth_flags, &auth_type, &auth_level); + init_rpc_hdr_auth(&auth_info, auth_type, auth_level, RPC_HDR_AUTH_LEN, 1); if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) { @@ -277,10 +278,8 @@ BOOL create_next_pdu(pipes_struct *p) prs_init(&rverf, 0, p->mem_ctx, MARSHALL); prs_init(&rauth, 0, p->mem_ctx, MARSHALL); - init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes, nullbytes, nullbytes); - netsec_encode(&p->netsec_auth, - AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN|AUTH_PIPE_SEAL, + p->netsec_auth.auth_flags, SENDER_IS_ACCEPTOR, &verf, data, data_len); @@ -1337,10 +1336,19 @@ BOOL api_pipe_netsec_process(pipes_struct *p, prs_struct *rpc_in) return False; } - if ((auth_info.auth_type != NETSEC_AUTH_TYPE) || - (auth_info.auth_level != RPC_PIPE_AUTH_SEAL_LEVEL)) { - DEBUG(0,("Invalid auth info %d or level %d on schannel\n", - auth_info.auth_type, auth_info.auth_level)); + if (auth_info.auth_type != NETSEC_AUTH_TYPE) { + DEBUG(0,("Invalid auth info %d on schannel\n", + auth_info.auth_type)); + return False; + } + + if (auth_info.auth_level == RPC_PIPE_AUTH_SEAL_LEVEL) { + p->netsec_auth.auth_flags = AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN|AUTH_PIPE_SEAL; + } else if (auth_info.auth_level == RPC_PIPE_AUTH_SIGN_LEVEL) { + p->netsec_auth.auth_flags = AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN; + } else { + DEBUG(0,("Invalid auth level %d on schannel\n", + auth_info.auth_level)); return False; } @@ -1350,7 +1358,7 @@ BOOL api_pipe_netsec_process(pipes_struct *p, prs_struct *rpc_in) } if (!netsec_decode(&p->netsec_auth, - AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN|AUTH_PIPE_SEAL, + p->netsec_auth.auth_flags, SENDER_IS_INITIATOR, &netsec_chk, prs_data_p(rpc_in)+old_offset, data_len)) { diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c index 515489292b..773441a27c 100644 --- a/source3/rpcclient/rpcclient.c +++ b/source3/rpcclient/rpcclient.c @@ -352,38 +352,33 @@ static NTSTATUS cmd_none(struct cli_state *cli, TALLOC_CTX *mem_ctx, return NT_STATUS_OK; } -static NTSTATUS cmd_schannel(struct cli_state *cli, TALLOC_CTX *mem_ctx, - int argc, const char **argv) +static NTSTATUS setup_schannel(struct cli_state *cli, int pipe_auth_flags, + int argc, const char **argv) { NTSTATUS ret; + static uchar zeros[16]; uchar trust_password[16]; uint32 sec_channel_type; - static uchar zeros[16]; - if (argc == 2) { strhex_to_str((char *)cli->auth_info.sess_key, strlen(argv[1]), argv[1]); memcpy(cli->sess_key, cli->auth_info.sess_key, sizeof(cli->sess_key)); - cli->pipe_auth_flags = AUTH_PIPE_NETSEC; - cli->pipe_auth_flags |= AUTH_PIPE_SIGN; - cli->pipe_auth_flags |= AUTH_PIPE_SEAL; - + cli->pipe_auth_flags = pipe_auth_flags; return NT_STATUS_OK; } /* Cleanup */ if ((memcmp(cli->auth_info.sess_key, zeros, sizeof(cli->auth_info.sess_key)) != 0)) { - if (cli->pipe_auth_flags == (AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN|AUTH_PIPE_SEAL)) { + if (cli->pipe_auth_flags == pipe_auth_flags) { /* already in this mode nothing to do */ return NT_STATUS_OK; } else { - /* schannel is setup, just need to use it again */ - cli->pipe_auth_flags = AUTH_PIPE_NETSEC; - cli->pipe_auth_flags |= AUTH_PIPE_SIGN; - cli->pipe_auth_flags |= AUTH_PIPE_SEAL; + /* schannel is setup, just need to use it again with new flags */ + cli->pipe_auth_flags = pipe_auth_flags; + if (cli->nt_pipe_fnum != 0) cli_nt_session_close(cli); return NT_STATUS_OK; @@ -393,17 +388,13 @@ static NTSTATUS cmd_schannel(struct cli_state *cli, TALLOC_CTX *mem_ctx, if (cli->nt_pipe_fnum != 0) cli_nt_session_close(cli); - cli->pipe_auth_flags = AUTH_PIPE_NETSEC; - cli->pipe_auth_flags |= AUTH_PIPE_SIGN; - cli->pipe_auth_flags |= AUTH_PIPE_SEAL; - if (!secrets_fetch_trust_account_password(lp_workgroup(), trust_password, NULL, &sec_channel_type)) { return NT_STATUS_UNSUCCESSFUL; } - ret = cli_nt_setup_netsec(cli, sec_channel_type, trust_password); + ret = cli_nt_setup_netsec(cli, sec_channel_type, pipe_auth_flags, trust_password); if (NT_STATUS_IS_OK(ret)) { char *hex_session_key; hex_encode(cli->auth_info.sess_key, @@ -415,6 +406,24 @@ static NTSTATUS cmd_schannel(struct cli_state *cli, TALLOC_CTX *mem_ctx, return ret; } + +static NTSTATUS cmd_schannel(struct cli_state *cli, TALLOC_CTX *mem_ctx, + int argc, const char **argv) +{ + d_printf("Setting schannel - sign and seal\n"); + return setup_schannel(cli, AUTH_PIPE_NETSEC | AUTH_PIPE_SIGN | AUTH_PIPE_SEAL, + argc, argv); +} + +static NTSTATUS cmd_schannel_sign(struct cli_state *cli, TALLOC_CTX *mem_ctx, + int argc, const char **argv) +{ + d_printf("Setting schannel - sign only\n"); + return setup_schannel(cli, AUTH_PIPE_NETSEC | AUTH_PIPE_SIGN, + argc, argv); +} + + /* Built in rpcclient commands */ static struct cmd_set rpcclient_commands[] = { @@ -430,6 +439,7 @@ static struct cmd_set rpcclient_commands[] = { { "sign", RPC_RTYPE_NTSTATUS, cmd_sign, NULL, -1, "Force RPC pipe connections to be signed", "" }, { "seal", RPC_RTYPE_NTSTATUS, cmd_seal, NULL, -1, "Force RPC pipe connections to be sealed", "" }, { "schannel", RPC_RTYPE_NTSTATUS, cmd_schannel, NULL, -1, "Force RPC pipe connections to be sealed with 'schannel' (NETSEC). Assumes valid machine account to this domain controller.", "" }, + { "schannelsign", RPC_RTYPE_NTSTATUS, cmd_schannel_sign, NULL, -1, "Force RPC pipe connections to be signed (not sealed) with 'schannel' (NETSEC). Assumes valid machine account to this domain controller.", "" }, { "none", RPC_RTYPE_NTSTATUS, cmd_none, NULL, -1, "Force RPC pipe connections to have no special properties", "" }, { NULL } @@ -522,9 +532,7 @@ static NTSTATUS do_cmd(struct cli_state *cli, /* some of the DsXXX commands use the netlogon pipe */ if (lp_client_schannel() && (cmd_entry->pipe_idx == PI_NETLOGON) && !(cli->pipe_auth_flags & AUTH_PIPE_NETSEC)) { - /* The 7 here seems to be required to get Win2k not to downgrade us - to NT4. Actually, anything other than 1ff would seem to do... */ - uint32 neg_flags = 0x000001ff; + uint32 neg_flags = NETLOGON_NEG_AUTH2_FLAGS; uint32 sec_channel_type; if (!secrets_fetch_trust_account_password(lp_workgroup(), -- cgit From 418749050ba387a4657cc23dfb86cf06548703cf Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 2 Oct 2003 00:55:20 +0000 Subject: Fix for not opening Excel 2000 files that are read-only. Needs tidying up but works for now. Jeremy. (This used to be commit d9b9113a0815aeeddb8fdcccb64e7692fe02a9c2) --- source3/smbd/error.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/source3/smbd/error.c b/source3/smbd/error.c index 9d0e34bf52..7eec5e25df 100644 --- a/source3/smbd/error.c +++ b/source3/smbd/error.c @@ -61,9 +61,6 @@ int unix_error_packet(char *outbuf,int def_class,uint32 def_code, eclass = unix_ERR_class; ecode = unix_ERR_code; ntstatus = unix_ERR_ntstatus; - unix_ERR_class = SMB_SUCCESS; - unix_ERR_code = 0; - unix_ERR_ntstatus = NT_STATUS_OK; } else { while (unix_dos_nt_errmap[i].dos_class != 0) { if (unix_dos_nt_errmap[i].unix_error == errno) { @@ -93,6 +90,10 @@ int error_packet(char *outbuf,NTSTATUS ntstatus, if (errno != 0) DEBUG(3,("error string = %s\n",strerror(errno))); + unix_ERR_class = SMB_SUCCESS; + unix_ERR_code = 0; + unix_ERR_ntstatus = NT_STATUS_OK; + /* * We can explicitly force 32 bit error codes even when the * parameter "nt status" is set to no by pre-setting the -- cgit From 64f88c008cc4f047ecd8e457fbdcafde32e9def5 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 2 Oct 2003 17:26:44 +0000 Subject: Correct fix for excel read-only bug. Add panic for logic error in developer mode. Jeremy. (This used to be commit 0857932c1c1960fd68a10f3d1f8c300b7a28b6d7) --- source3/smbd/error.c | 10 +++++++--- source3/smbd/trans2.c | 3 --- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/source3/smbd/error.c b/source3/smbd/error.c index 7eec5e25df..795bf0949c 100644 --- a/source3/smbd/error.c +++ b/source3/smbd/error.c @@ -61,6 +61,9 @@ int unix_error_packet(char *outbuf,int def_class,uint32 def_code, eclass = unix_ERR_class; ecode = unix_ERR_code; ntstatus = unix_ERR_ntstatus; + unix_ERR_class = SMB_SUCCESS; + unix_ERR_code = 0; + unix_ERR_ntstatus = NT_STATUS_OK; } else { while (unix_dos_nt_errmap[i].dos_class != 0) { if (unix_dos_nt_errmap[i].unix_error == errno) { @@ -90,9 +93,10 @@ int error_packet(char *outbuf,NTSTATUS ntstatus, if (errno != 0) DEBUG(3,("error string = %s\n",strerror(errno))); - unix_ERR_class = SMB_SUCCESS; - unix_ERR_code = 0; - unix_ERR_ntstatus = NT_STATUS_OK; +#if defined(DEVELOPER) + if (unix_ERR_class != SMB_SUCCESS || unix_ERR_code != 0 || !NT_STATUS_IS_OK(unix_ERR_ntstatus)) + smb_panic("logic error in error processing"); +#endif /* * We can explicitly force 32 bit error codes even when the diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c index 033e76a33e..ee63220d18 100644 --- a/source3/smbd/trans2.c +++ b/source3/smbd/trans2.c @@ -1785,12 +1785,9 @@ int set_bad_path_error(int err, BOOL bad_path, char *outbuf, int def_class, uint err, (int)bad_path )); if(err == ENOENT) { - unix_ERR_class = ERRDOS; if (bad_path) { - unix_ERR_code = ERRbadpath; return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND); } else { - unix_ERR_code = ERRbadfile; return ERROR_NT(NT_STATUS_OBJECT_NAME_NOT_FOUND); } } -- cgit From 460aa846391df5a29bcbc80317c7b73d68a6a78b Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 2 Oct 2003 17:36:45 +0000 Subject: Portability fix from schmitz@hp.com (Joachim Schmitz) for bug #548. Jeremy. (This used to be commit a0828a2a1ce04075f0a7cb4a201cea0781998237) --- source3/rpc_server/srv_spoolss_nt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c index 493f58f8a8..f2fb02176b 100644 --- a/source3/rpc_server/srv_spoolss_nt.c +++ b/source3/rpc_server/srv_spoolss_nt.c @@ -1803,7 +1803,7 @@ Can't find printer handle we created for printer %s\n", name )); && (RA_WIN2K == get_remote_arch()) ) { DEBUG(10,("_spoolss_open_printer_ex: Enabling LAN/WAN hack for Win2k clients.\n")); - usleep( 500000 ); + sys_usleep( 500000 ); } return WERR_OK; -- cgit From e8fb38d8dda4fe44324c454c88e3e58d2e877a56 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 2 Oct 2003 17:53:55 +0000 Subject: Portability fix from schmitz@hp.com (Joachim Schmitz). Bug #547. Jeremy. (This used to be commit 9519ffc7cbdb37a4279c8804230596978679220e) --- source3/passdb/pdb_smbpasswd.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/source3/passdb/pdb_smbpasswd.c b/source3/passdb/pdb_smbpasswd.c index 8171b65adc..8cdbec9b9d 100644 --- a/source3/passdb/pdb_smbpasswd.c +++ b/source3/passdb/pdb_smbpasswd.c @@ -261,7 +261,11 @@ static FILE *startsmbfilepwent(const char *pfile, enum pwf_access_type type, int setvbuf(fp, (char *)NULL, _IOFBF, 1024); /* Make sure it is only rw by the owner */ +#ifdef HAVE_FCHMOD if(fchmod(fileno(fp), S_IRUSR|S_IWUSR) == -1) { +#else + if(chmod(pfile, S_IRUSR|S_IWUSR) == -1) { +#endif DEBUG(0, ("startsmbfilepwent_internal: failed to set 0600 permissions on password file %s. \ Error was %s\n.", pfile, strerror(errno) )); pw_file_unlock(fileno(fp), lock_depth); -- cgit From 4ed89be00f0239179182da04b6c3d017a639664d Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 2 Oct 2003 18:22:48 +0000 Subject: Portability fixes from schmitz@hp.com (Joachim Schmitz). Bug #549. Jeremy. (This used to be commit 6defe43e6d48619cee31b6c7fc602973e8eeef3f) --- source3/tdb/tdbback.c | 11 +++++++++++ source3/tdb/tdbbackup.c | 12 ++++++++++++ source3/utils/profiles.c | 8 +++++++- 3 files changed, 30 insertions(+), 1 deletion(-) diff --git a/source3/tdb/tdbback.c b/source3/tdb/tdbback.c index 744cface55..9466c29991 100644 --- a/source3/tdb/tdbback.c +++ b/source3/tdb/tdbback.c @@ -18,6 +18,11 @@ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ +#ifdef STANDALONE +#if HAVE_CONFIG_H +#include +#endif + #include #include #include @@ -27,10 +32,16 @@ #include #include #include + #include #include #include #include + +#else +#include "includes.h" +#endif + #include "tdb.h" static int failed; diff --git a/source3/tdb/tdbbackup.c b/source3/tdb/tdbbackup.c index 0eaf6b6c0b..1a0e1c1588 100644 --- a/source3/tdb/tdbbackup.c +++ b/source3/tdb/tdbbackup.c @@ -41,6 +41,11 @@ */ +#ifdef STANDALONE +#if HAVE_CONFIG_H +#include +#endif + #include #include #include @@ -54,6 +59,13 @@ #include #include #include + +#else + +#include "includes.h" + +#endif + #include "tdb.h" #include "tdbback.h" diff --git a/source3/utils/profiles.c b/source3/utils/profiles.c index 3230eb21fc..20b1222e72 100644 --- a/source3/utils/profiles.c +++ b/source3/utils/profiles.c @@ -295,7 +295,6 @@ Hope this helps.... (Although it was "fun" for me to uncover this things, #include #include #include -#include typedef unsigned int DWORD; typedef unsigned short WORD; @@ -610,7 +609,12 @@ int main(int argc, char *argv[]) * dealing with the records. We are interested in the sk record */ start = 0; + +#ifdef HAVE_MMAP base = mmap(&start, sbuf.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); +#else + base = (char *)-1; +#endif if ((int)base == -1) { fprintf(stderr, "Could not mmap file: %s, %s\n", poptPeekArg(pc), @@ -726,7 +730,9 @@ int main(int argc, char *argv[]) sk_hdr = (SK_HDR *)(base + OFF(IVAL(&sk_hdr->prev_off, 0))); } while (sk_off != first_sk_off); +#ifdef HAVE_MMAP munmap(base, sbuf.st_size); +#endif poptFreeContext(pc); -- cgit From 8ae168b46df07414f1d56a74e2ecb8aa2332d50a Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Fri, 3 Oct 2003 15:08:16 +0000 Subject: abstract UUID parsing code to an individual function; patch from Anthony (This used to be commit 6cbdbdf9e1e76837c8ef03e795db11caa74ccf18) --- source3/rpc_parse/parse_rpc.c | 33 ++++++++++++++++++++++++++------- 1 file changed, 26 insertions(+), 7 deletions(-) diff --git a/source3/rpc_parse/parse_rpc.c b/source3/rpc_parse/parse_rpc.c index 558378548a..c1e663f877 100644 --- a/source3/rpc_parse/parse_rpc.c +++ b/source3/rpc_parse/parse_rpc.c @@ -243,29 +243,48 @@ BOOL smb_io_rpc_hdr(const char *desc, RPC_HDR *rpc, prs_struct *ps, int depth) } /******************************************************************* - Reads or writes an RPC_IFACE structure. + Reads or writes an RPC_UUID structure. ********************************************************************/ -static BOOL smb_io_rpc_iface(const char *desc, RPC_IFACE *ifc, prs_struct *ps, int depth) +static BOOL smb_io_rpc_uuid(const char *desc, RPC_UUID *uuid, prs_struct *ps, int depth) { if (ifc == NULL) return False; - prs_debug(ps, depth, desc, "smb_io_rpc_iface"); + prs_debug(ps, depth, desc, "smb_io_rpc_uuid"); depth++; if(!prs_align(ps)) return False; - if(!prs_uint32 ("data ", ps, depth, &ifc->uuid.time_low)) + if(!prs_uint32 ("data ", ps, depth, &uuid->time_low)) + return False; + if(!prs_uint16 ("data ", ps, depth, &uuid->time_mid)) + return False; + if(!prs_uint16 ("data ", ps, depth, &uuid->time_hi_and_version)) return False; - if(!prs_uint16 ("data ", ps, depth, &ifc->uuid.time_mid)) + + if(!prs_uint8s (False, "data ", ps, depth, uuid->remaining, sizeof(uuid->remaining))) return False; - if(!prs_uint16 ("data ", ps, depth, &ifc->uuid.time_hi_and_version)) + + return true; +} + +/******************************************************************* + Reads or writes an RPC_IFACE structure. +********************************************************************/ + +static BOOL smb_io_rpc_iface(const char *desc, RPC_IFACE *ifc, prs_struct *ps, int depth) +{ + if (ifc == NULL) return False; - if(!prs_uint8s (False, "data ", ps, depth, ifc->uuid.remaining, sizeof(ifc->uuid.remaining))) + prs_debug(ps, depth, desc, "smb_io_rpc_iface"); + depth++; + + if (!smb_io_rpc_uuid( "uuid", ps, depth, &ifc->uuid)) return False; + if(!prs_uint32 ( "version", ps, depth, &ifc->version)) return False; -- cgit From ec7716734ef8860ec8071ef7872672c4cb02a4e8 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Fri, 3 Oct 2003 15:11:38 +0000 Subject: cleaning out patch list; patch from Steve L. to change the cwd before the postexec script (This used to be commit bbc403ec6ee119f1bbb636deb40563dfdf258a74) --- source3/smbd/service.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/source3/smbd/service.c b/source3/smbd/service.c index e4c3890f86..e5655bd9f4 100644 --- a/source3/smbd/service.c +++ b/source3/smbd/service.c @@ -894,6 +894,9 @@ void close_cnum(connection_struct *conn, uint16 vuid) file_close_conn(conn); dptr_closecnum(conn); + /* make sure we leave the directory available for unmount */ + vfs_ChDir(conn, "/"); + /* execute any "postexec = " line */ if (*lp_postexec(SNUM(conn)) && change_to_user(conn, vuid)) { @@ -913,8 +916,5 @@ void close_cnum(connection_struct *conn, uint16 vuid) smbrun(cmd,NULL); } - /* make sure we leave the directory available for unmount */ - vfs_ChDir(conn, "/"); - conn_free(conn); } -- cgit From 9cfd26141cf9530f27e673bfae119d9879894dd4 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Fri, 3 Oct 2003 21:43:56 +0000 Subject: don't call ads_destroy() twice; fixes segfault in winbindd when DC goes down; bug 437 (This used to be commit 9da4d1f7dbb289dd1db5e57a4fd78004bbfbd26b) --- source3/libads/ldap.c | 3 ++- source3/libads/ldap_utils.c | 7 ++++++- source3/nsswitch/winbindd_ads.c | 15 +++++++++++---- 3 files changed, 19 insertions(+), 6 deletions(-) diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c index 48401cc3d8..8c3185ea5e 100644 --- a/source3/libads/ldap.c +++ b/source3/libads/ldap.c @@ -1787,7 +1787,8 @@ ADS_STATUS ads_USN(ADS_STRUCT *ads, uint32 *usn) void *res; status = ads_do_search_retry(ads, "", LDAP_SCOPE_BASE, "(objectclass=*)", attrs, &res); - if (!ADS_ERR_OK(status)) return status; + if (!ADS_ERR_OK(status)) + return status; if (ads_count_replies(ads, res) != 1) { return ADS_ERROR(LDAP_NO_RESULTS_RETURNED); diff --git a/source3/libads/ldap_utils.c b/source3/libads/ldap_utils.c index 1fa9ebfc97..4142bceabc 100644 --- a/source3/libads/ldap_utils.c +++ b/source3/libads/ldap_utils.c @@ -54,15 +54,20 @@ ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path, int scope return status; } - if (*res) ads_msgfree(ads, *res); + if (*res) + ads_msgfree(ads, *res); *res = NULL; + DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n", ads->config.realm, ads_errstr(status))); + if (ads->ld) { ldap_unbind(ads->ld); } + ads->ld = NULL; status = ads_connect(ads); + if (!ADS_ERR_OK(status)) { DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n", ads_errstr(status))); diff --git a/source3/nsswitch/winbindd_ads.c b/source3/nsswitch/winbindd_ads.c index c64359a224..ef3f0f8fc2 100644 --- a/source3/nsswitch/winbindd_ads.c +++ b/source3/nsswitch/winbindd_ads.c @@ -787,9 +787,13 @@ static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq) } rc = ads_USN(ads, seq); + if (!ADS_ERR_OK(rc)) { - /* its a dead connection */ - ads_destroy(&ads); + + /* its a dead connection ; don't destroy it + through since ads_USN() has already done + that indirectly */ + domain->private = NULL; } return ads_ntstatus(rc); @@ -910,8 +914,11 @@ static NTSTATUS domain_sid(struct winbindd_domain *domain, DOM_SID *sid) rc = ads_domain_sid(ads, sid); if (!ADS_ERR_OK(rc)) { - /* its a dead connection */ - ads_destroy(&ads); + + /* its a dead connection; don't destroy it though + since that has already been done indirectly + by ads_domain_sid() */ + domain->private = NULL; } -- cgit From 762e7e1dff89cc14b0130fc9a22038b0845630a2 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 6 Oct 2003 01:24:48 +0000 Subject: split some security related functions in their own files. (no need to include all of smbd files to use some basic sec functions) also minor compile fixes (This used to be commit 66074d3b097d8cf2a231bf08c7f4db62da68189d) --- source3/Makefile.in | 7 +- source3/include/privileges.h | 2 + source3/include/rpc_lsa.h | 6 +- source3/include/talloc.h | 21 ++ source3/lib/privileges.c | 345 +++++++++++++++++++ source3/lib/secace.c | 285 ++++++++++++++++ source3/lib/secacl.c | 118 +++++++ source3/lib/secdesc.c | 522 +++++++++++++++++++++++++++++ source3/lib/talloc.c | 21 -- source3/lib/util_seaccess.c | 129 ------- source3/lib/util_sid.c | 2 +- source3/passdb/pdb_get_set.c | 4 +- source3/rpc_client/cli_lsarpc.c | 6 +- source3/rpc_parse/parse_lsa.c | 43 ++- source3/rpc_parse/parse_rpc.c | 6 +- source3/rpc_parse/parse_sec.c | 727 ---------------------------------------- source3/rpc_server/srv_lsa.c | 2 +- source3/rpc_server/srv_lsa_nt.c | 70 ++-- source3/script/mkproto.awk | 2 +- source3/tdb/tdbback.c | 3 +- 20 files changed, 1376 insertions(+), 945 deletions(-) create mode 100644 source3/lib/privileges.c create mode 100644 source3/lib/secace.c create mode 100644 source3/lib/secacl.c create mode 100644 source3/lib/secdesc.c diff --git a/source3/Makefile.in b/source3/Makefile.in index 0ea2c4411f..57950bebde 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -181,7 +181,8 @@ LIB_OBJ = lib/version.o lib/charcnv.o lib/debug.o lib/fault.o \ nsswitch/wb_client.o nsswitch/wb_common.o \ lib/pam_errors.o intl/lang_tdb.o lib/account_pol.o \ lib/adt_tree.o lib/gencache.o $(TDB_OBJ) \ - lib/module.o lib/ldap_escape.o @CHARSET_STATIC@ + lib/module.o lib/ldap_escape.o @CHARSET_STATIC@ \ + lib/privileges.o lib/secdesc.o lib/secace.o lib/secacl.o LIB_SMBD_OBJ = lib/system_smbd.o lib/util_smbd.o @@ -218,7 +219,7 @@ LIBSMB_OBJ = libsmb/clientgen.o libsmb/cliconnect.o libsmb/clifile.o \ libsmb/clirap.o libsmb/clierror.o libsmb/climessage.o \ libsmb/clireadwrite.o libsmb/clilist.o libsmb/cliprint.o \ libsmb/clitrans.o libsmb/clisecdesc.o libsmb/clidgram.o \ - libsmb/clistr.o \ + libsmb/clistr.o lib/util_seaccess.o \ libsmb/cliquota.o libsmb/clifsinfo.o \ libsmb/smberr.o libsmb/credentials.o libsmb/pwd_cache.o \ libsmb/clioplock.o libsmb/errormap.o libsmb/clirap2.o \ @@ -345,7 +346,7 @@ SMBD_OBJ_SRV = smbd/files.o smbd/chgpasswd.o smbd/connection.o \ smbd/vfs.o smbd/vfs-wrap.o smbd/statcache.o \ smbd/posix_acls.o lib/sysacls.o lib/server_mutex.o \ smbd/process.o smbd/service.o smbd/error.o \ - printing/printfsp.o lib/util_seaccess.o \ + printing/printfsp.o \ lib/sysquotas.o smbd/change_trust_pw.o smbd/fake_file.o \ smbd/quotas.o smbd/ntquotas.o lib/afs.o \ $(MANGLE_OBJ) @VFS_STATIC@ diff --git a/source3/include/privileges.h b/source3/include/privileges.h index 67d8a2cbcc..b7e1b44c2a 100644 --- a/source3/include/privileges.h +++ b/source3/include/privileges.h @@ -53,6 +53,8 @@ typedef struct LUID_ATTR typedef struct privilege_set { + TALLOC_CTX *mem_ctx; + BOOL ext_ctx; uint32 count; uint32 control; LUID_ATTR *set; diff --git a/source3/include/rpc_lsa.h b/source3/include/rpc_lsa.h index 93bc08a0ce..2064a38056 100644 --- a/source3/include/rpc_lsa.h +++ b/source3/include/rpc_lsa.h @@ -657,7 +657,7 @@ typedef struct lsa_r_enumprivsaccount { uint32 ptr; uint32 count; - PRIVILEGE_SET set; + PRIVILEGE_SET *set; NTSTATUS status; } LSA_R_ENUMPRIVSACCOUNT; @@ -703,7 +703,7 @@ typedef struct lsa_q_addprivs { POLICY_HND pol; /* policy handle */ uint32 count; - PRIVILEGE_SET set; + PRIVILEGE_SET *set; } LSA_Q_ADDPRIVS; typedef struct lsa_r_addprivs @@ -718,7 +718,7 @@ typedef struct lsa_q_removeprivs uint32 allrights; uint32 ptr; uint32 count; - PRIVILEGE_SET set; + PRIVILEGE_SET *set; } LSA_Q_REMOVEPRIVS; typedef struct lsa_r_removeprivs diff --git a/source3/include/talloc.h b/source3/include/talloc.h index 4badddbb88..433b52ec95 100644 --- a/source3/include/talloc.h +++ b/source3/include/talloc.h @@ -30,6 +30,27 @@ /** * talloc allocation pool. All allocated blocks can be freed in one go. **/ + +struct talloc_chunk { + struct talloc_chunk *next; + size_t size; + void *ptr; +}; + +struct talloc_ctx { + struct talloc_chunk *list; + size_t total_alloc_size; + + /** The name recorded for this pool, if any. Should describe + * the purpose for which it was allocated. The string is + * allocated within the pool. **/ + char *name; + + /** Pointer to the next allocate talloc pool, so that we can + * summarize all talloc memory usage. **/ + struct talloc_ctx *next_ctx; +}; + typedef struct talloc_ctx TALLOC_CTX; TALLOC_CTX *talloc_init(char const *fmt, ...) PRINTF_ATTRIBUTE(1, 2); diff --git a/source3/lib/privileges.c b/source3/lib/privileges.c new file mode 100644 index 0000000000..1c23d9e40e --- /dev/null +++ b/source3/lib/privileges.c @@ -0,0 +1,345 @@ +/* + Unix SMB/CIFS implementation. + Privileges handling functions + Copyright (C) Jean François Micouleau 1998-2001 + Copyright (C) Simo Sorce 2002-2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" + +/* defines */ + +#define ALLOC_CHECK(ptr, err, label, str) do { if ((ptr) == NULL) { DEBUG(0, ("%s: out of memory!\n", str)); err = NT_STATUS_NO_MEMORY; goto label; } } while(0) +#define NTSTATUS_CHECK(err, label, str1, str2) do { if (!NT_STATUS_IS_OK(err)) { DEBUG(0, ("%s: %s failed!\n", str1, str2)); } } while(0) + +/**************************************************************************** + Check if a user is a mapped group. + + This function will check if the group SID is mapped onto a + system managed gid or onto a winbind manged sid. + In the first case it will be threated like a mapped group + and the backend should take the member list with a getgrgid + and ignore any user that have been possibly set into the group + object. + + In the second case, the group is a fully SAM managed group + served back to the system through winbind. In this case the + members of a Local group are "unrolled" to cope with the fact + that unix cannot contain groups inside groups. + The backend MUST never call any getgr* / getpw* function or + loops with winbind may happen. + ****************************************************************************/ + +#if 0 +NTSTATUS is_mapped_group(BOOL *mapped, const DOM_SID *sid) +{ + NTSTATUS result; + gid_t id; + + /* look if mapping exist, do not make idmap alloc an uid if SID is not found */ + result = idmap_get_gid_from_sid(&id, sid, False); + if (NT_STATUS_IS_OK(result)) { + *mapped = gid_is_in_winbind_range(id); + } else { + *mapped = False; + } + + return result; +} +#endif + +/**************************************************************************** + duplicate alloc luid_attr + ****************************************************************************/ +NTSTATUS dupalloc_luid_attr(TALLOC_CTX *mem_ctx, LUID_ATTR **new_la, LUID_ATTR *old_la) +{ + NTSTATUS ret; + + *new_la = (LUID_ATTR *)talloc(mem_ctx, sizeof(LUID_ATTR)); + ALLOC_CHECK(new_la, ret, done, "dupalloc_luid_attr"); + + (*new_la)->luid.high = old_la->luid.high; + (*new_la)->luid.low = old_la->luid.low; + (*new_la)->attr = old_la->attr; + + ret = NT_STATUS_OK; + +done: + return ret; +} + +/**************************************************************************** + initialise a privilege list + ****************************************************************************/ +NTSTATUS init_privilege(PRIVILEGE_SET **priv_set) +{ + NTSTATUS ret; + TALLOC_CTX *mem_ctx = talloc_init("privilege set"); + ALLOC_CHECK(mem_ctx, ret, done, "init_privilege"); + + *priv_set = talloc_zero(mem_ctx, sizeof(PRIVILEGE_SET)); + ALLOC_CHECK(*priv_set, ret, done, "init_privilege"); + + (*priv_set)->mem_ctx = mem_ctx; + + ret = NT_STATUS_OK; + +done: + return ret; +} + +NTSTATUS init_priv_with_ctx(TALLOC_CTX *mem_ctx, PRIVILEGE_SET **priv_set) +{ + NTSTATUS ret; + + *priv_set = talloc_zero(mem_ctx, sizeof(PRIVILEGE_SET)); + ALLOC_CHECK(*priv_set, ret, done, "init_privilege"); + + (*priv_set)->mem_ctx = mem_ctx; + (*priv_set)->ext_ctx = True; + + ret = NT_STATUS_OK; + +done: + return ret; +} + +void reset_privilege(PRIVILEGE_SET *priv_set) +{ + priv_set->count = 0; + priv_set->control = 0; + priv_set->set = NULL; +} + +void destroy_privilege(PRIVILEGE_SET **priv_set) +{ + reset_privilege(*priv_set); + if (!((*priv_set)->ext_ctx)) + /* mem_ctx is local, destroy it */ + talloc_destroy((*priv_set)->mem_ctx); + *priv_set = NULL; +} + +/**************************************************************************** + add a privilege to a privilege array + ****************************************************************************/ +NTSTATUS add_privilege(PRIVILEGE_SET *priv_set, LUID_ATTR set) +{ + NTSTATUS ret; + LUID_ATTR *new_set; + + /* check if the privilege is not already in the list */ + if (NT_STATUS_IS_OK(check_priv_in_privilege(priv_set, set))) + return NT_STATUS_UNSUCCESSFUL; + + /* we can allocate memory to add the new privilege */ + + new_set = (LUID_ATTR *)talloc_realloc(priv_set->mem_ctx, priv_set->set, (priv_set->count + 1) * (sizeof(LUID_ATTR))); + ALLOC_CHECK(new_set, ret, done, "add_privilege"); + + new_set[priv_set->count].luid.high = set.luid.high; + new_set[priv_set->count].luid.low = set.luid.low; + new_set[priv_set->count].attr = set.attr; + + priv_set->count++; + priv_set->set = new_set; + + ret = NT_STATUS_OK; + +done: + return ret; +} + +/**************************************************************************** + add all the privileges to a privilege array + ****************************************************************************/ +NTSTATUS add_all_privilege(PRIVILEGE_SET *priv_set) +{ + NTSTATUS result = NT_STATUS_OK; + LUID_ATTR set; + + set.attr = 0; + set.luid.high = 0; + + /* TODO: set a proper list of privileges */ + set.luid.low = SE_PRIV_ADD_USERS; + result = add_privilege(priv_set, set); + NTSTATUS_CHECK(result, done, "add_all_privilege", "add_privilege"); + + set.luid.low = SE_PRIV_ADD_MACHINES; + result = add_privilege(priv_set, set); + NTSTATUS_CHECK(result, done, "add_all_privilege", "add_privilege"); + + set.luid.low = SE_PRIV_PRINT_OPERATOR; + result = add_privilege(priv_set, set); + NTSTATUS_CHECK(result, done, "add_all_privilege", "add_privilege"); + +done: + return result; +} + +/**************************************************************************** + check if the privilege list is empty + ****************************************************************************/ +NTSTATUS check_empty_privilege(PRIVILEGE_SET *priv_set) +{ + if (!priv_set) + return NT_STATUS_INVALID_PARAMETER; + + if (priv_set->count == 0) + return NT_STATUS_OK; + + return NT_STATUS_UNSUCCESSFUL; +} + +/**************************************************************************** + check if the privilege is in the privilege list + ****************************************************************************/ +NTSTATUS check_priv_in_privilege(PRIVILEGE_SET *priv_set, LUID_ATTR set) +{ + int i; + + if (!priv_set) + return NT_STATUS_INVALID_PARAMETER; + + /* if the list is empty, obviously we can't have it */ + if (NT_STATUS_IS_OK(check_empty_privilege(priv_set))) + return NT_STATUS_UNSUCCESSFUL; + + for (i = 0; i < priv_set->count; i++) { + LUID_ATTR *cur_set; + + cur_set = &priv_set->set[i]; + /* check only the low and high part. Checking the attr field has no meaning */ + if ( (cur_set->luid.low == set.luid.low) && + (cur_set->luid.high == set.luid.high) ) { + return NT_STATUS_OK; + } + } + + return NT_STATUS_UNSUCCESSFUL; +} + +/**************************************************************************** + remove a privilege from a privilege array + ****************************************************************************/ +NTSTATUS remove_privilege(PRIVILEGE_SET *priv_set, LUID_ATTR set) +{ + NTSTATUS ret; + LUID_ATTR *new_set; + LUID_ATTR *old_set; + int i,j; + + if (!priv_set) + return NT_STATUS_INVALID_PARAMETER; + + /* check if the privilege is in the list */ + if (!NT_STATUS_IS_OK(check_priv_in_privilege(priv_set, set))) + return NT_STATUS_UNSUCCESSFUL; + + /* special case if it's the only privilege in the list */ + if (priv_set->count == 1) { + reset_privilege(priv_set); + return NT_STATUS_OK; + } + + /* + * the privilege is there, create a new list, + * and copy the other privileges + */ + + old_set = priv_set->set; + + new_set = (LUID_ATTR *)talloc(priv_set->mem_ctx, (priv_set->count - 1) * (sizeof(LUID_ATTR))); + ALLOC_CHECK(new_set, ret, done, "remove_privilege"); + + for (i=0, j=0; i < priv_set->count; i++) { + if ( (old_set[i].luid.low == set.luid.low) && + (old_set[i].luid.high == set.luid.high) ) { + continue; + } + + new_set[j].luid.low = old_set[i].luid.low; + new_set[j].luid.high = old_set[i].luid.high; + new_set[j].attr = old_set[i].attr; + + j++; + } + + if (j != priv_set->count - 1) { + DEBUG(0,("remove_privilege: mismatch ! difference is not -1\n")); + DEBUGADD(0,("old count:%d, new count:%d\n", priv_set->count, j)); + return NT_STATUS_INTERNAL_ERROR; + } + + /* ok everything is fine */ + + priv_set->count--; + priv_set->set = new_set; + + ret = NT_STATUS_OK; + +done: + return ret; +} + +/**************************************************************************** + duplicates a privilege array + the new privilege set must be passed inited + (use init_privilege or init_priv_with_ctx) + ****************************************************************************/ +NTSTATUS dup_priv_set(PRIVILEGE_SET *new_priv_set, PRIVILEGE_SET *priv_set) +{ + NTSTATUS ret; + LUID_ATTR *new_set; + LUID_ATTR *old_set; + int i; + + if (!new_priv_set || !priv_set) + return NT_STATUS_INVALID_PARAMETER; + + /* special case if there are no privileges in the list */ + if (priv_set->count == 0) { + return NT_STATUS_OK; + } + + /* + * create a new list, + * and copy the other privileges + */ + + old_set = priv_set->set; + + new_set = (LUID_ATTR *)talloc(new_priv_set->mem_ctx, (priv_set->count - 1) * (sizeof(LUID_ATTR))); + ALLOC_CHECK(new_set, ret, done, "dup_priv_set"); + + for (i=0; i < priv_set->count; i++) { + + new_set[i].luid.low = old_set[i].luid.low; + new_set[i].luid.high = old_set[i].luid.high; + new_set[i].attr = old_set[i].attr; + } + + new_priv_set->count = priv_set->count; + new_priv_set->control = priv_set->control; + new_priv_set->set = new_set; + + ret = NT_STATUS_OK; + +done: + return ret; +} diff --git a/source3/lib/secace.c b/source3/lib/secace.c new file mode 100644 index 0000000000..6769f1288a --- /dev/null +++ b/source3/lib/secace.c @@ -0,0 +1,285 @@ +/* + * Unix SMB/Netbios implementation. + * SEC_ACE handling functions + * Copyright (C) Andrew Tridgell 1992-1998, + * Copyright (C) Jeremy R. Allison 1995-2003. + * Copyright (C) Luke Kenneth Casson Leighton 1996-1998, + * Copyright (C) Paul Ashton 1997-1998. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "includes.h" + +/******************************************************************* + Check if ACE has OBJECT type. +********************************************************************/ + +BOOL sec_ace_object(uint8 type) +{ + if (type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT || + type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT || + type == SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT || + type == SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT) { + return True; + } + return False; +} + +/******************************************************************* + copy a SEC_ACE structure. +********************************************************************/ +void sec_ace_copy(SEC_ACE *ace_dest, SEC_ACE *ace_src) +{ + ace_dest->type = ace_src->type; + ace_dest->flags = ace_src->flags; + ace_dest->size = ace_src->size; + ace_dest->info.mask = ace_src->info.mask; + ace_dest->obj_flags = ace_src->obj_flags; + memcpy(&ace_dest->obj_guid, &ace_src->obj_guid, GUID_SIZE); + memcpy(&ace_dest->inh_guid, &ace_src->inh_guid, GUID_SIZE); + sid_copy(&ace_dest->trustee, &ace_src->trustee); +} + +/******************************************************************* + Sets up a SEC_ACE structure. +********************************************************************/ + +void init_sec_ace(SEC_ACE *t, DOM_SID *sid, uint8 type, SEC_ACCESS mask, uint8 flag) +{ + t->type = type; + t->flags = flag; + t->size = sid_size(sid) + 8; + t->info = mask; + + ZERO_STRUCTP(&t->trustee); + sid_copy(&t->trustee, sid); +} + +/******************************************************************* + adds new SID with its permissions to ACE list +********************************************************************/ + +NTSTATUS sec_ace_add_sid(TALLOC_CTX *ctx, SEC_ACE **new, SEC_ACE *old, unsigned *num, DOM_SID *sid, uint32 mask) +{ + unsigned int i = 0; + + if (!ctx || !new || !old || !sid || !num) return NT_STATUS_INVALID_PARAMETER; + + *num += 1; + + if((new[0] = (SEC_ACE *) talloc_zero(ctx, (*num) * sizeof(SEC_ACE))) == 0) + return NT_STATUS_NO_MEMORY; + + for (i = 0; i < *num - 1; i ++) + sec_ace_copy(&(*new)[i], &old[i]); + + (*new)[i].type = 0; + (*new)[i].flags = 0; + (*new)[i].size = SEC_ACE_HEADER_SIZE + sid_size(sid); + (*new)[i].info.mask = mask; + sid_copy(&(*new)[i].trustee, sid); + return NT_STATUS_OK; +} + +/******************************************************************* + modify SID's permissions at ACL +********************************************************************/ + +NTSTATUS sec_ace_mod_sid(SEC_ACE *ace, size_t num, DOM_SID *sid, uint32 mask) +{ + unsigned int i = 0; + + if (!ace || !sid) return NT_STATUS_INVALID_PARAMETER; + + for (i = 0; i < num; i ++) { + if (sid_compare(&ace[i].trustee, sid) == 0) { + ace[i].info.mask = mask; + return NT_STATUS_OK; + } + } + return NT_STATUS_NOT_FOUND; +} + +/******************************************************************* + delete SID from ACL +********************************************************************/ + +NTSTATUS sec_ace_del_sid(TALLOC_CTX *ctx, SEC_ACE **new, SEC_ACE *old, uint32 *num, DOM_SID *sid) +{ + unsigned int i = 0; + unsigned int n_del = 0; + + if (!ctx || !new || !old || !sid || !num) return NT_STATUS_INVALID_PARAMETER; + + if((new[0] = (SEC_ACE *) talloc_zero(ctx, (*num) * sizeof(SEC_ACE))) == 0) + return NT_STATUS_NO_MEMORY; + + for (i = 0; i < *num; i ++) { + if (sid_compare(&old[i].trustee, sid) != 0) + sec_ace_copy(&(*new)[i], &old[i]); + else + n_del ++; + } + if (n_del == 0) + return NT_STATUS_NOT_FOUND; + else { + *num -= n_del; + return NT_STATUS_OK; + } +} + +/******************************************************************* + Compares two SEC_ACE structures +********************************************************************/ + +BOOL sec_ace_equal(SEC_ACE *s1, SEC_ACE *s2) +{ + /* Trivial case */ + + if (!s1 && !s2) return True; + + /* Check top level stuff */ + + if (s1->type != s2->type || s1->flags != s2->flags || + s1->info.mask != s2->info.mask) { + return False; + } + + /* Check SID */ + + if (!sid_equal(&s1->trustee, &s2->trustee)) { + return False; + } + + return True; +} + +int nt_ace_inherit_comp( SEC_ACE *a1, SEC_ACE *a2) +{ + int a1_inh = a1->flags & SEC_ACE_FLAG_INHERITED_ACE; + int a2_inh = a2->flags & SEC_ACE_FLAG_INHERITED_ACE; + + if (a1_inh == a2_inh) + return 0; + + if (!a1_inh && a2_inh) + return -1; + return 1; +} + +/******************************************************************* + Comparison function to apply the order explained below in a group. +*******************************************************************/ + +int nt_ace_canon_comp( SEC_ACE *a1, SEC_ACE *a2) +{ + if ((a1->type == SEC_ACE_TYPE_ACCESS_DENIED) && + (a2->type != SEC_ACE_TYPE_ACCESS_DENIED)) + return -1; + + if ((a2->type == SEC_ACE_TYPE_ACCESS_DENIED) && + (a1->type != SEC_ACE_TYPE_ACCESS_DENIED)) + return 1; + + /* Both access denied or access allowed. */ + + /* 1. ACEs that apply to the object itself */ + + if (!(a1->flags & SEC_ACE_FLAG_INHERIT_ONLY) && + (a2->flags & SEC_ACE_FLAG_INHERIT_ONLY)) + return -1; + else if (!(a2->flags & SEC_ACE_FLAG_INHERIT_ONLY) && + (a1->flags & SEC_ACE_FLAG_INHERIT_ONLY)) + return 1; + + /* 2. ACEs that apply to a subobject of the object, such as + * a property set or property. */ + + if (a1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT) && + !(a2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT))) + return -1; + else if (a2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT) && + !(a1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT))) + return 1; + + return 0; +} + +/******************************************************************* + Functions to convert a SEC_DESC ACE DACL list into canonical order. + JRA. + +--- from http://msdn.microsoft.com/library/default.asp?url=/library/en-us/security/security/order_of_aces_in_a_dacl.asp + +The following describes the preferred order: + + To ensure that noninherited ACEs have precedence over inherited ACEs, + place all noninherited ACEs in a group before any inherited ACEs. + This ordering ensures, for example, that a noninherited access-denied ACE + is enforced regardless of any inherited ACE that allows access. + + Within the groups of noninherited ACEs and inherited ACEs, order ACEs according to ACE type, as the following shows: + 1. Access-denied ACEs that apply to the object itself + 2. Access-denied ACEs that apply to a subobject of the object, such as a property set or property + 3. Access-allowed ACEs that apply to the object itself + 4. Access-allowed ACEs that apply to a subobject of the object" + +********************************************************************/ + +void dacl_sort_into_canonical_order(SEC_ACE *srclist, unsigned int num_aces) +{ + unsigned int i; + + if (!srclist || num_aces == 0) + return; + + /* Sort so that non-inherited ACE's come first. */ + qsort( srclist, num_aces, sizeof(srclist[0]), QSORT_CAST nt_ace_inherit_comp); + + /* Find the boundary between non-inherited ACEs. */ + for (i = 0; i < num_aces; i++ ) { + SEC_ACE *curr_ace = &srclist[i]; + + if (curr_ace->flags & SEC_ACE_FLAG_INHERITED_ACE) + break; + } + + /* i now points at entry number of the first inherited ACE. */ + + /* Sort the non-inherited ACEs. */ + if (i) + qsort( srclist, i, sizeof(srclist[0]), QSORT_CAST nt_ace_canon_comp); + + /* Now sort the inherited ACEs. */ + if (num_aces - i) + qsort( &srclist[i], num_aces - i, sizeof(srclist[0]), QSORT_CAST nt_ace_canon_comp); +} + +/******************************************************************* + Check if this ACE has a SID in common with the token. +********************************************************************/ + +BOOL token_sid_in_ace(const NT_USER_TOKEN *token, const SEC_ACE *ace) +{ + size_t i; + + for (i = 0; i < token->num_sids; i++) { + if (sid_equal(&ace->trustee, &token->user_sids[i])) + return True; + } + + return False; +} diff --git a/source3/lib/secacl.c b/source3/lib/secacl.c new file mode 100644 index 0000000000..756685a821 --- /dev/null +++ b/source3/lib/secacl.c @@ -0,0 +1,118 @@ +/* + * Unix SMB/Netbios implementation. + * SEC_ACL handling routines + * Copyright (C) Andrew Tridgell 1992-1998, + * Copyright (C) Jeremy R. Allison 1995-2003. + * Copyright (C) Luke Kenneth Casson Leighton 1996-1998, + * Copyright (C) Paul Ashton 1997-1998. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "includes.h" + +/******************************************************************* + Create a SEC_ACL structure. +********************************************************************/ + +SEC_ACL *make_sec_acl(TALLOC_CTX *ctx, uint16 revision, int num_aces, SEC_ACE *ace_list) +{ + SEC_ACL *dst; + int i; + + if((dst = (SEC_ACL *)talloc_zero(ctx,sizeof(SEC_ACL))) == NULL) + return NULL; + + dst->revision = revision; + dst->num_aces = num_aces; + dst->size = SEC_ACL_HEADER_SIZE; + + /* Now we need to return a non-NULL address for the ace list even + if the number of aces required is zero. This is because there + is a distinct difference between a NULL ace and an ace with zero + entries in it. This is achieved by checking that num_aces is a + positive number. */ + + if ((num_aces) && + ((dst->ace = (SEC_ACE *)talloc(ctx, sizeof(SEC_ACE) * num_aces)) + == NULL)) { + return NULL; + } + + for (i = 0; i < num_aces; i++) { + dst->ace[i] = ace_list[i]; /* Structure copy. */ + dst->size += ace_list[i].size; + } + + return dst; +} + +/******************************************************************* + Duplicate a SEC_ACL structure. +********************************************************************/ + +SEC_ACL *dup_sec_acl(TALLOC_CTX *ctx, SEC_ACL *src) +{ + if(src == NULL) + return NULL; + + return make_sec_acl(ctx, src->revision, src->num_aces, src->ace); +} + +/******************************************************************* + Compares two SEC_ACL structures +********************************************************************/ + +BOOL sec_acl_equal(SEC_ACL *s1, SEC_ACL *s2) +{ + unsigned int i, j; + + /* Trivial cases */ + + if (!s1 && !s2) return True; + if (!s1 || !s2) return False; + + /* Check top level stuff */ + + if (s1->revision != s2->revision) { + DEBUG(10, ("sec_acl_equal(): revision differs (%d != %d)\n", + s1->revision, s2->revision)); + return False; + } + + if (s1->num_aces != s2->num_aces) { + DEBUG(10, ("sec_acl_equal(): num_aces differs (%d != %d)\n", + s1->revision, s2->revision)); + return False; + } + + /* The ACEs could be in any order so check each ACE in s1 against + each ACE in s2. */ + + for (i = 0; i < s1->num_aces; i++) { + BOOL found = False; + + for (j = 0; j < s2->num_aces; j++) { + if (sec_ace_equal(&s1->ace[i], &s2->ace[j])) { + found = True; + break; + } + } + + if (!found) return False; + } + + return True; +} diff --git a/source3/lib/secdesc.c b/source3/lib/secdesc.c new file mode 100644 index 0000000000..411185dbfa --- /dev/null +++ b/source3/lib/secdesc.c @@ -0,0 +1,522 @@ +/* + * Unix SMB/Netbios implementation. + * SEC_DESC handling functions + * Copyright (C) Andrew Tridgell 1992-1998, + * Copyright (C) Jeremy R. Allison 1995-2003. + * Copyright (C) Luke Kenneth Casson Leighton 1996-1998, + * Copyright (C) Paul Ashton 1997-1998. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "includes.h" + +/******************************************************************* + Works out the linearization size of a SEC_DESC. +********************************************************************/ + +size_t sec_desc_size(SEC_DESC *psd) +{ + size_t offset; + + if (!psd) return 0; + + offset = SEC_DESC_HEADER_SIZE; + + /* don't align */ + + if (psd->owner_sid != NULL) + offset += sid_size(psd->owner_sid); + + if (psd->grp_sid != NULL) + offset += sid_size(psd->grp_sid); + + if (psd->sacl != NULL) + offset += psd->sacl->size; + + if (psd->dacl != NULL) + offset += psd->dacl->size; + + return offset; +} + +/******************************************************************* + Compares two SEC_DESC structures +********************************************************************/ + +BOOL sec_desc_equal(SEC_DESC *s1, SEC_DESC *s2) +{ + /* Trivial case */ + + if (!s1 && !s2) { + goto done; + } + + /* Check top level stuff */ + + if (s1->revision != s2->revision) { + DEBUG(10, ("sec_desc_equal(): revision differs (%d != %d)\n", + s1->revision, s2->revision)); + return False; + } + + if (s1->type!= s2->type) { + DEBUG(10, ("sec_desc_equal(): type differs (%d != %d)\n", + s1->type, s2->type)); + return False; + } + + /* Check owner and group */ + + if (!sid_equal(s1->owner_sid, s2->owner_sid)) { + fstring str1, str2; + + sid_to_string(str1, s1->owner_sid); + sid_to_string(str2, s2->owner_sid); + + DEBUG(10, ("sec_desc_equal(): owner differs (%s != %s)\n", + str1, str2)); + return False; + } + + if (!sid_equal(s1->grp_sid, s2->grp_sid)) { + fstring str1, str2; + + sid_to_string(str1, s1->grp_sid); + sid_to_string(str2, s2->grp_sid); + + DEBUG(10, ("sec_desc_equal(): group differs (%s != %s)\n", + str1, str2)); + return False; + } + + /* Check ACLs present in one but not the other */ + + if ((s1->dacl && !s2->dacl) || (!s1->dacl && s2->dacl) || + (s1->sacl && !s2->sacl) || (!s1->sacl && s2->sacl)) { + DEBUG(10, ("sec_desc_equal(): dacl or sacl not present\n")); + return False; + } + + /* Sigh - we have to do it the hard way by iterating over all + the ACEs in the ACLs */ + + if (!sec_acl_equal(s1->dacl, s2->dacl) || + !sec_acl_equal(s1->sacl, s2->sacl)) { + DEBUG(10, ("sec_desc_equal(): dacl/sacl list not equal\n")); + return False; + } + + done: + DEBUG(10, ("sec_desc_equal(): secdescs are identical\n")); + return True; +} + +/******************************************************************* + Merge part of security descriptor old_sec in to the empty sections of + security descriptor new_sec. +********************************************************************/ + +SEC_DESC_BUF *sec_desc_merge(TALLOC_CTX *ctx, SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb) +{ + DOM_SID *owner_sid, *group_sid; + SEC_DESC_BUF *return_sdb; + SEC_ACL *dacl, *sacl; + SEC_DESC *psd = NULL; + uint16 secdesc_type; + size_t secdesc_size; + + /* Copy over owner and group sids. There seems to be no flag for + this so just check the pointer values. */ + + owner_sid = new_sdb->sec->owner_sid ? new_sdb->sec->owner_sid : + old_sdb->sec->owner_sid; + + group_sid = new_sdb->sec->grp_sid ? new_sdb->sec->grp_sid : + old_sdb->sec->grp_sid; + + secdesc_type = new_sdb->sec->type; + + /* Ignore changes to the system ACL. This has the effect of making + changes through the security tab audit button not sticking. + Perhaps in future Samba could implement these settings somehow. */ + + sacl = NULL; + secdesc_type &= ~SEC_DESC_SACL_PRESENT; + + /* Copy across discretionary ACL */ + + if (secdesc_type & SEC_DESC_DACL_PRESENT) { + dacl = new_sdb->sec->dacl; + } else { + dacl = old_sdb->sec->dacl; + } + + /* Create new security descriptor from bits */ + + psd = make_sec_desc(ctx, new_sdb->sec->revision, secdesc_type, + owner_sid, group_sid, sacl, dacl, &secdesc_size); + + return_sdb = make_sec_desc_buf(ctx, secdesc_size, psd); + + return(return_sdb); +} + +/******************************************************************* + Creates a SEC_DESC structure +********************************************************************/ + +SEC_DESC *make_sec_desc(TALLOC_CTX *ctx, uint16 revision, uint16 type, + DOM_SID *owner_sid, DOM_SID *grp_sid, + SEC_ACL *sacl, SEC_ACL *dacl, size_t *sd_size) +{ + SEC_DESC *dst; + uint32 offset = 0; + + *sd_size = 0; + + if(( dst = (SEC_DESC *)talloc_zero(ctx, sizeof(SEC_DESC))) == NULL) + return NULL; + + dst->revision = revision; + dst->type = type; + + if (sacl) + dst->type |= SEC_DESC_SACL_PRESENT; + if (dacl) + dst->type |= SEC_DESC_DACL_PRESENT; + + dst->off_owner_sid = 0; + dst->off_grp_sid = 0; + dst->off_sacl = 0; + dst->off_dacl = 0; + + if(owner_sid && ((dst->owner_sid = sid_dup_talloc(ctx,owner_sid)) == NULL)) + goto error_exit; + + if(grp_sid && ((dst->grp_sid = sid_dup_talloc(ctx,grp_sid)) == NULL)) + goto error_exit; + + if(sacl && ((dst->sacl = dup_sec_acl(ctx, sacl)) == NULL)) + goto error_exit; + + if(dacl && ((dst->dacl = dup_sec_acl(ctx, dacl)) == NULL)) + goto error_exit; + + offset = SEC_DESC_HEADER_SIZE; + + /* + * Work out the linearization sizes. + */ + + if (dst->sacl != NULL) { + dst->off_sacl = offset; + offset += dst->sacl->size; + } + if (dst->dacl != NULL) { + dst->off_dacl = offset; + offset += dst->dacl->size; + } + + if (dst->owner_sid != NULL) { + dst->off_owner_sid = offset; + offset += sid_size(dst->owner_sid); + } + + if (dst->grp_sid != NULL) { + dst->off_grp_sid = offset; + offset += sid_size(dst->grp_sid); + } + + *sd_size = (size_t)offset; + return dst; + +error_exit: + + *sd_size = 0; + return NULL; +} + +/******************************************************************* + Duplicate a SEC_DESC structure. +********************************************************************/ + +SEC_DESC *dup_sec_desc(TALLOC_CTX *ctx, const SEC_DESC *src) +{ + size_t dummy; + + if(src == NULL) + return NULL; + + return make_sec_desc( ctx, src->revision, src->type, + src->owner_sid, src->grp_sid, src->sacl, + src->dacl, &dummy); +} + +/******************************************************************* + Creates a SEC_DESC structure with typical defaults. +********************************************************************/ + +SEC_DESC *make_standard_sec_desc(TALLOC_CTX *ctx, DOM_SID *owner_sid, DOM_SID *grp_sid, + SEC_ACL *dacl, size_t *sd_size) +{ + return make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, + owner_sid, grp_sid, NULL, dacl, sd_size); +} + +/******************************************************************* + Creates a SEC_DESC_BUF structure. +********************************************************************/ + +SEC_DESC_BUF *make_sec_desc_buf(TALLOC_CTX *ctx, size_t len, SEC_DESC *sec_desc) +{ + SEC_DESC_BUF *dst; + + if((dst = (SEC_DESC_BUF *)talloc_zero(ctx, sizeof(SEC_DESC_BUF))) == NULL) + return NULL; + + /* max buffer size (allocated size) */ + dst->max_len = (uint32)len; + dst->len = (uint32)len; + + if(sec_desc && ((dst->sec = dup_sec_desc(ctx, sec_desc)) == NULL)) { + return NULL; + } + + dst->ptr = 0x1; + + return dst; +} + +/******************************************************************* + Duplicates a SEC_DESC_BUF structure. +********************************************************************/ + +SEC_DESC_BUF *dup_sec_desc_buf(TALLOC_CTX *ctx, SEC_DESC_BUF *src) +{ + if(src == NULL) + return NULL; + + return make_sec_desc_buf( ctx, src->len, src->sec); +} + +/******************************************************************* + Add a new SID with its permissions to SEC_DESC. +********************************************************************/ + +NTSTATUS sec_desc_add_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, uint32 mask, size_t *sd_size) +{ + SEC_DESC *sd = 0; + SEC_ACL *dacl = 0; + SEC_ACE *ace = 0; + NTSTATUS status; + + *sd_size = 0; + + if (!ctx || !psd || !sid || !sd_size) + return NT_STATUS_INVALID_PARAMETER; + + status = sec_ace_add_sid(ctx, &ace, psd[0]->dacl->ace, &psd[0]->dacl->num_aces, sid, mask); + + if (!NT_STATUS_IS_OK(status)) + return status; + + if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace))) + return NT_STATUS_UNSUCCESSFUL; + + if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid, + psd[0]->grp_sid, psd[0]->sacl, dacl, sd_size))) + return NT_STATUS_UNSUCCESSFUL; + + *psd = sd; + sd = 0; + return NT_STATUS_OK; +} + +/******************************************************************* + Modify a SID's permissions in a SEC_DESC. +********************************************************************/ + +NTSTATUS sec_desc_mod_sid(SEC_DESC *sd, DOM_SID *sid, uint32 mask) +{ + NTSTATUS status; + + if (!sd || !sid) + return NT_STATUS_INVALID_PARAMETER; + + status = sec_ace_mod_sid(sd->dacl->ace, sd->dacl->num_aces, sid, mask); + + if (!NT_STATUS_IS_OK(status)) + return status; + + return NT_STATUS_OK; +} + +/******************************************************************* + Delete a SID from a SEC_DESC. +********************************************************************/ + +NTSTATUS sec_desc_del_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, size_t *sd_size) +{ + SEC_DESC *sd = 0; + SEC_ACL *dacl = 0; + SEC_ACE *ace = 0; + NTSTATUS status; + + *sd_size = 0; + + if (!ctx || !psd[0] || !sid || !sd_size) + return NT_STATUS_INVALID_PARAMETER; + + status = sec_ace_del_sid(ctx, &ace, psd[0]->dacl->ace, &psd[0]->dacl->num_aces, sid); + + if (!NT_STATUS_IS_OK(status)) + return status; + + if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace))) + return NT_STATUS_UNSUCCESSFUL; + + if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid, + psd[0]->grp_sid, psd[0]->sacl, dacl, sd_size))) + return NT_STATUS_UNSUCCESSFUL; + + *psd = sd; + sd = 0; + return NT_STATUS_OK; +} + +/* Create a child security descriptor using another security descriptor as + the parent container. This child object can either be a container or + non-container object. */ + +SEC_DESC_BUF *se_create_child_secdesc(TALLOC_CTX *ctx, SEC_DESC *parent_ctr, + BOOL child_container) +{ + SEC_DESC_BUF *sdb; + SEC_DESC *sd; + SEC_ACL *new_dacl, *the_acl; + SEC_ACE *new_ace_list = NULL; + unsigned int new_ace_list_ndx = 0, i; + size_t size; + + /* Currently we only process the dacl when creating the child. The + sacl should also be processed but this is left out as sacls are + not implemented in Samba at the moment.*/ + + the_acl = parent_ctr->dacl; + + if (!(new_ace_list = talloc(ctx, sizeof(SEC_ACE) * the_acl->num_aces))) + return NULL; + + for (i = 0; the_acl && i < the_acl->num_aces; i++) { + SEC_ACE *ace = &the_acl->ace[i]; + SEC_ACE *new_ace = &new_ace_list[new_ace_list_ndx]; + uint8 new_flags = 0; + BOOL inherit = False; + fstring sid_str; + + /* The OBJECT_INHERIT_ACE flag causes the ACE to be + inherited by non-container children objects. Container + children objects will inherit it as an INHERIT_ONLY + ACE. */ + + if (ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT) { + + if (!child_container) { + new_flags |= SEC_ACE_FLAG_OBJECT_INHERIT; + } else { + new_flags |= SEC_ACE_FLAG_INHERIT_ONLY; + } + + inherit = True; + } + + /* The CONAINER_INHERIT_ACE flag means all child container + objects will inherit and use the ACE. */ + + if (ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) { + if (!child_container) { + inherit = False; + } else { + new_flags |= SEC_ACE_FLAG_CONTAINER_INHERIT; + } + } + + /* The INHERIT_ONLY_ACE is not used by the se_access_check() + function for the parent container, but is inherited by + all child objects as a normal ACE. */ + + if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) { + /* Move along, nothing to see here */ + } + + /* The SEC_ACE_FLAG_NO_PROPAGATE_INHERIT flag means the ACE + is inherited by child objects but not grandchildren + objects. We clear the object inherit and container + inherit flags in the inherited ACE. */ + + if (ace->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) { + new_flags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT | + SEC_ACE_FLAG_CONTAINER_INHERIT); + } + + /* Add ACE to ACE list */ + + if (!inherit) + continue; + + init_sec_access(&new_ace->info, ace->info.mask); + init_sec_ace(new_ace, &ace->trustee, ace->type, + new_ace->info, new_flags); + + sid_to_string(sid_str, &ace->trustee); + + DEBUG(5, ("se_create_child_secdesc(): %s:%d/0x%02x/0x%08x " + " inherited as %s:%d/0x%02x/0x%08x\n", sid_str, + ace->type, ace->flags, ace->info.mask, + sid_str, new_ace->type, new_ace->flags, + new_ace->info.mask)); + + new_ace_list_ndx++; + } + + /* Create child security descriptor to return */ + + new_dacl = make_sec_acl(ctx, ACL_REVISION, new_ace_list_ndx, new_ace_list); + + /* Use the existing user and group sids. I don't think this is + correct. Perhaps the user and group should be passed in as + parameters by the caller? */ + + sd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, + parent_ctr->owner_sid, + parent_ctr->grp_sid, + parent_ctr->sacl, + new_dacl, &size); + + sdb = make_sec_desc_buf(ctx, size, sd); + + return sdb; +} + +/******************************************************************* + Sets up a SEC_ACCESS structure. +********************************************************************/ + +void init_sec_access(SEC_ACCESS *t, uint32 mask) +{ + t->mask = mask; +} + diff --git a/source3/lib/talloc.c b/source3/lib/talloc.c index b6c8b2efdf..485dc28f31 100644 --- a/source3/lib/talloc.c +++ b/source3/lib/talloc.c @@ -54,27 +54,6 @@ #include "includes.h" -struct talloc_chunk { - struct talloc_chunk *next; - size_t size; - void *ptr; -}; - - -struct talloc_ctx { - struct talloc_chunk *list; - size_t total_alloc_size; - - /** The name recorded for this pool, if any. Should describe - * the purpose for which it was allocated. The string is - * allocated within the pool. **/ - char *name; - - /** Pointer to the next allocate talloc pool, so that we can - * summarize all talloc memory usage. **/ - struct talloc_ctx *next_ctx; -}; - /** * Start of linked list of all talloc pools. diff --git a/source3/lib/util_seaccess.c b/source3/lib/util_seaccess.c index 2482d582d2..cb0f46e2f9 100644 --- a/source3/lib/util_seaccess.c +++ b/source3/lib/util_seaccess.c @@ -23,22 +23,6 @@ extern DOM_SID global_sid_Builtin; -/********************************************************************************** - Check if this ACE has a SID in common with the token. -**********************************************************************************/ - -static BOOL token_sid_in_ace(const NT_USER_TOKEN *token, const SEC_ACE *ace) -{ - size_t i; - - for (i = 0; i < token->num_sids; i++) { - if (sid_equal(&ace->trustee, &token->user_sids[i])) - return True; - } - - return False; -} - /********************************************************************************* Check an ACE against a SID. We return the remaining needed permission bits not yet granted. Zero means permission allowed (no more needed bits). @@ -332,119 +316,6 @@ BOOL se_access_check(const SEC_DESC *sd, const NT_USER_TOKEN *token, return False; } -/* Create a child security descriptor using another security descriptor as - the parent container. This child object can either be a container or - non-container object. */ - -SEC_DESC_BUF *se_create_child_secdesc(TALLOC_CTX *ctx, SEC_DESC *parent_ctr, - BOOL child_container) -{ - SEC_DESC_BUF *sdb; - SEC_DESC *sd; - SEC_ACL *new_dacl, *the_acl; - SEC_ACE *new_ace_list = NULL; - unsigned int new_ace_list_ndx = 0, i; - size_t size; - - /* Currently we only process the dacl when creating the child. The - sacl should also be processed but this is left out as sacls are - not implemented in Samba at the moment.*/ - - the_acl = parent_ctr->dacl; - - if (!(new_ace_list = talloc(ctx, sizeof(SEC_ACE) * the_acl->num_aces))) - return NULL; - - for (i = 0; the_acl && i < the_acl->num_aces; i++) { - SEC_ACE *ace = &the_acl->ace[i]; - SEC_ACE *new_ace = &new_ace_list[new_ace_list_ndx]; - uint8 new_flags = 0; - BOOL inherit = False; - fstring sid_str; - - /* The OBJECT_INHERIT_ACE flag causes the ACE to be - inherited by non-container children objects. Container - children objects will inherit it as an INHERIT_ONLY - ACE. */ - - if (ace->flags & SEC_ACE_FLAG_OBJECT_INHERIT) { - - if (!child_container) { - new_flags |= SEC_ACE_FLAG_OBJECT_INHERIT; - } else { - new_flags |= SEC_ACE_FLAG_INHERIT_ONLY; - } - - inherit = True; - } - - /* The CONAINER_INHERIT_ACE flag means all child container - objects will inherit and use the ACE. */ - - if (ace->flags & SEC_ACE_FLAG_CONTAINER_INHERIT) { - if (!child_container) { - inherit = False; - } else { - new_flags |= SEC_ACE_FLAG_CONTAINER_INHERIT; - } - } - - /* The INHERIT_ONLY_ACE is not used by the se_access_check() - function for the parent container, but is inherited by - all child objects as a normal ACE. */ - - if (ace->flags & SEC_ACE_FLAG_INHERIT_ONLY) { - /* Move along, nothing to see here */ - } - - /* The SEC_ACE_FLAG_NO_PROPAGATE_INHERIT flag means the ACE - is inherited by child objects but not grandchildren - objects. We clear the object inherit and container - inherit flags in the inherited ACE. */ - - if (ace->flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT) { - new_flags &= ~(SEC_ACE_FLAG_OBJECT_INHERIT | - SEC_ACE_FLAG_CONTAINER_INHERIT); - } - - /* Add ACE to ACE list */ - - if (!inherit) - continue; - - init_sec_access(&new_ace->info, ace->info.mask); - init_sec_ace(new_ace, &ace->trustee, ace->type, - new_ace->info, new_flags); - - sid_to_string(sid_str, &ace->trustee); - - DEBUG(5, ("se_create_child_secdesc(): %s:%d/0x%02x/0x%08x " - " inherited as %s:%d/0x%02x/0x%08x\n", sid_str, - ace->type, ace->flags, ace->info.mask, - sid_str, new_ace->type, new_ace->flags, - new_ace->info.mask)); - - new_ace_list_ndx++; - } - - /* Create child security descriptor to return */ - - new_dacl = make_sec_acl(ctx, ACL_REVISION, new_ace_list_ndx, new_ace_list); - - /* Use the existing user and group sids. I don't think this is - correct. Perhaps the user and group should be passed in as - parameters by the caller? */ - - sd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, - parent_ctr->owner_sid, - parent_ctr->grp_sid, - parent_ctr->sacl, - new_dacl, &size); - - sdb = make_sec_desc_buf(ctx, size, sd); - - return sdb; -} /******************************************************************* samr_make_sam_obj_sd diff --git a/source3/lib/util_sid.c b/source3/lib/util_sid.c index fbb393770d..50bbb4c72c 100644 --- a/source3/lib/util_sid.c +++ b/source3/lib/util_sid.c @@ -638,7 +638,7 @@ void print_guid(GUID *guid) Tallocs a duplicate SID. ********************************************************************/ -DOM_SID *sid_dup_talloc(TALLOC_CTX *ctx, DOM_SID *src) +DOM_SID *sid_dup_talloc(TALLOC_CTX *ctx, const DOM_SID *src) { DOM_SID *dst; diff --git a/source3/passdb/pdb_get_set.c b/source3/passdb/pdb_get_set.c index 9c2b7e4c70..46c49be8b1 100644 --- a/source3/passdb/pdb_get_set.c +++ b/source3/passdb/pdb_get_set.c @@ -509,7 +509,7 @@ BOOL pdb_set_init_flags (SAM_ACCOUNT *sampass, enum pdb_elements element, enum p return True; } -BOOL pdb_set_user_sid (SAM_ACCOUNT *sampass, DOM_SID *u_sid, enum pdb_value_state flag) +BOOL pdb_set_user_sid (SAM_ACCOUNT *sampass, const DOM_SID *u_sid, enum pdb_value_state flag) { if (!sampass || !u_sid) return False; @@ -545,7 +545,7 @@ BOOL pdb_set_user_sid_from_string (SAM_ACCOUNT *sampass, fstring u_sid, enum pdb return True; } -BOOL pdb_set_group_sid (SAM_ACCOUNT *sampass, DOM_SID *g_sid, enum pdb_value_state flag) +BOOL pdb_set_group_sid (SAM_ACCOUNT *sampass, const DOM_SID *g_sid, enum pdb_value_state flag) { if (!sampass || !g_sid) return False; diff --git a/source3/rpc_client/cli_lsarpc.c b/source3/rpc_client/cli_lsarpc.c index db873236e4..65115419b4 100644 --- a/source3/rpc_client/cli_lsarpc.c +++ b/source3/rpc_client/cli_lsarpc.c @@ -1035,9 +1035,9 @@ NTSTATUS cli_lsa_enum_privsaccount(struct cli_state *cli, TALLOC_CTX *mem_ctx, } for (i=0; iset[i].luid.low; + (*set)[i].luid.high = r.set->set[i].luid.high; + (*set)[i].attr = r.set->set[i].attr; } *count=r.count; diff --git a/source3/rpc_parse/parse_lsa.c b/source3/rpc_parse/parse_lsa.c index 3a5b232dc3..22dbd5307a 100644 --- a/source3/rpc_parse/parse_lsa.c +++ b/source3/rpc_parse/parse_lsa.c @@ -1809,14 +1809,20 @@ static BOOL lsa_io_privilege_set(const char *desc, PRIVILEGE_SET *r_c, prs_struc return True; } -void init_lsa_r_enum_privsaccount(LSA_R_ENUMPRIVSACCOUNT *r_u, LUID_ATTR *set, uint32 count, uint32 control) +NTSTATUS init_lsa_r_enum_privsaccount(TALLOC_CTX *mem_ctx, LSA_R_ENUMPRIVSACCOUNT *r_u, LUID_ATTR *set, uint32 count, uint32 control) { - r_u->ptr=1; - r_u->count=count; - r_u->set.set=set; - r_u->set.count=count; - r_u->set.control=control; - DEBUG(10,("init_lsa_r_enum_privsaccount: %d %d privileges\n", r_u->count, r_u->set.count)); + NTSTATUS ret; + + r_u->ptr = 1; + r_u->count = count; + + if (!NT_STATUS_IS_OK(ret = init_priv_with_ctx(mem_ctx, &(r_u->set)))) + return ret; + + if (!NT_STATUS_IS_OK(ret = dupalloc_luid_attr(r_u->set->mem_ctx, &(r_u->set->set), set))) + return ret; + + DEBUG(10,("init_lsa_r_enum_privsaccount: %d %d privileges\n", r_u->count, r_u->set->count)); } /******************************************************************* @@ -1840,13 +1846,16 @@ BOOL lsa_io_r_enum_privsaccount(const char *desc, LSA_R_ENUMPRIVSACCOUNT *r_c, p /* malloc memory if unmarshalling here */ - if (UNMARSHALLING(ps) && r_c->count!=0) { - if (!(r_c->set.set = (LUID_ATTR *)prs_alloc_mem(ps,sizeof(LUID_ATTR) * r_c->count))) + if (UNMARSHALLING(ps) && r_c->count != 0) { + if (!NT_STATUS_IS_OK(init_priv_with_ctx(ps->mem_ctx, &(r_c->set)))) + return False; + + if (!(r_c->set->set = (LUID_ATTR *)prs_alloc_mem(ps,sizeof(LUID_ATTR) * r_c->count))) return False; } - if(!lsa_io_privilege_set(desc, &r_c->set, ps, depth)) + if(!lsa_io_privilege_set(desc, r_c->set, ps, depth)) return False; } @@ -2008,11 +2017,14 @@ BOOL lsa_io_q_addprivs(const char *desc, LSA_Q_ADDPRIVS *r_c, prs_struct *ps, in return False; if (UNMARSHALLING(ps) && r_c->count!=0) { - if (!(r_c->set.set = (LUID_ATTR *)prs_alloc_mem(ps,sizeof(LUID_ATTR) * r_c->count))) + if (!NT_STATUS_IS_OK(init_priv_with_ctx(ps->mem_ctx, &(r_c->set)))) + return False; + + if (!(r_c->set->set = (LUID_ATTR *)prs_alloc_mem(ps, sizeof(LUID_ATTR) * r_c->count))) return False; } - if(!lsa_io_privilege_set(desc, &r_c->set, ps, depth)) + if(!lsa_io_privilege_set(desc, r_c->set, ps, depth)) return False; return True; @@ -2067,11 +2079,14 @@ BOOL lsa_io_q_removeprivs(const char *desc, LSA_Q_REMOVEPRIVS *r_c, prs_struct * return False; if (UNMARSHALLING(ps) && r_c->count!=0) { - if (!(r_c->set.set = (LUID_ATTR *)prs_alloc_mem(ps,sizeof(LUID_ATTR) * r_c->count))) + if (!NT_STATUS_IS_OK(init_priv_with_ctx(ps->mem_ctx, &(r_c->set)))) + return False; + + if (!(r_c->set->set = (LUID_ATTR *)prs_alloc_mem(ps, sizeof(LUID_ATTR) * r_c->count))) return False; } - if(!lsa_io_privilege_set(desc, &r_c->set, ps, depth)) + if(!lsa_io_privilege_set(desc, r_c->set, ps, depth)) return False; } diff --git a/source3/rpc_parse/parse_rpc.c b/source3/rpc_parse/parse_rpc.c index c1e663f877..7e51f1e35b 100644 --- a/source3/rpc_parse/parse_rpc.c +++ b/source3/rpc_parse/parse_rpc.c @@ -248,7 +248,7 @@ BOOL smb_io_rpc_hdr(const char *desc, RPC_HDR *rpc, prs_struct *ps, int depth) static BOOL smb_io_rpc_uuid(const char *desc, RPC_UUID *uuid, prs_struct *ps, int depth) { - if (ifc == NULL) + if (uuid == NULL) return False; prs_debug(ps, depth, desc, "smb_io_rpc_uuid"); @@ -267,7 +267,7 @@ static BOOL smb_io_rpc_uuid(const char *desc, RPC_UUID *uuid, prs_struct *ps, in if(!prs_uint8s (False, "data ", ps, depth, uuid->remaining, sizeof(uuid->remaining))) return False; - return true; + return True; } /******************************************************************* @@ -282,7 +282,7 @@ static BOOL smb_io_rpc_iface(const char *desc, RPC_IFACE *ifc, prs_struct *ps, i prs_debug(ps, depth, desc, "smb_io_rpc_iface"); depth++; - if (!smb_io_rpc_uuid( "uuid", ps, depth, &ifc->uuid)) + if (!smb_io_rpc_uuid( "uuid", &ifc->uuid, ps, depth)) return False; if(!prs_uint32 ( "version", ps, depth, &ifc->version)) diff --git a/source3/rpc_parse/parse_sec.c b/source3/rpc_parse/parse_sec.c index 0ed930c08d..bf43ef288a 100644 --- a/source3/rpc_parse/parse_sec.c +++ b/source3/rpc_parse/parse_sec.c @@ -27,15 +27,6 @@ #undef DBGC_CLASS #define DBGC_CLASS DBGC_RPC_PARSE -/******************************************************************* - Sets up a SEC_ACCESS structure. -********************************************************************/ - -void init_sec_access(SEC_ACCESS *t, uint32 mask) -{ - t->mask = mask; -} - /******************************************************************* Reads or writes a SEC_ACCESS structure. ********************************************************************/ @@ -54,51 +45,6 @@ BOOL sec_io_access(const char *desc, SEC_ACCESS *t, prs_struct *ps, int depth) return True; } -/******************************************************************* - Check if ACE has OBJECT type. -********************************************************************/ - -BOOL sec_ace_object(uint8 type) -{ - if (type == SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT || - type == SEC_ACE_TYPE_ACCESS_DENIED_OBJECT || - type == SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT || - type == SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT) { - return True; - } - return False; -} - -/******************************************************************* - copy a SEC_ACE structure. -********************************************************************/ -void sec_ace_copy(SEC_ACE *ace_dest, SEC_ACE *ace_src) -{ - ace_dest->type = ace_src->type; - ace_dest->flags = ace_src->flags; - ace_dest->size = ace_src->size; - ace_dest->info.mask = ace_src->info.mask; - ace_dest->obj_flags = ace_src->obj_flags; - memcpy(&ace_dest->obj_guid, &ace_src->obj_guid, GUID_SIZE); - memcpy(&ace_dest->inh_guid, &ace_src->inh_guid, GUID_SIZE); - sid_copy(&ace_dest->trustee, &ace_src->trustee); -} - -/******************************************************************* - Sets up a SEC_ACE structure. -********************************************************************/ - -void init_sec_ace(SEC_ACE *t, DOM_SID *sid, uint8 type, SEC_ACCESS mask, uint8 flag) -{ - t->type = type; - t->flags = flag; - t->size = sid_size(sid) + 8; - t->info = mask; - - ZERO_STRUCTP(&t->trustee); - sid_copy(&t->trustee, sid); -} - /******************************************************************* Reads or writes a SEC_ACE structure. ********************************************************************/ @@ -153,127 +99,6 @@ BOOL sec_io_ace(const char *desc, SEC_ACE *psa, prs_struct *ps, int depth) return True; } -/******************************************************************* - adds new SID with its permissions to ACE list -********************************************************************/ - -NTSTATUS sec_ace_add_sid(TALLOC_CTX *ctx, SEC_ACE **new, SEC_ACE *old, unsigned *num, DOM_SID *sid, uint32 mask) -{ - unsigned int i = 0; - - if (!ctx || !new || !old || !sid || !num) return NT_STATUS_INVALID_PARAMETER; - - *num += 1; - - if((new[0] = (SEC_ACE *) talloc_zero(ctx, (*num) * sizeof(SEC_ACE))) == 0) - return NT_STATUS_NO_MEMORY; - - for (i = 0; i < *num - 1; i ++) - sec_ace_copy(&(*new)[i], &old[i]); - - (*new)[i].type = 0; - (*new)[i].flags = 0; - (*new)[i].size = SEC_ACE_HEADER_SIZE + sid_size(sid); - (*new)[i].info.mask = mask; - sid_copy(&(*new)[i].trustee, sid); - return NT_STATUS_OK; -} - -/******************************************************************* - modify SID's permissions at ACL -********************************************************************/ - -NTSTATUS sec_ace_mod_sid(SEC_ACE *ace, size_t num, DOM_SID *sid, uint32 mask) -{ - unsigned int i = 0; - - if (!ace || !sid) return NT_STATUS_INVALID_PARAMETER; - - for (i = 0; i < num; i ++) { - if (sid_compare(&ace[i].trustee, sid) == 0) { - ace[i].info.mask = mask; - return NT_STATUS_OK; - } - } - return NT_STATUS_NOT_FOUND; -} - -/******************************************************************* - delete SID from ACL -********************************************************************/ - -static NTSTATUS sec_ace_del_sid(TALLOC_CTX *ctx, SEC_ACE **new, SEC_ACE *old, uint32 *num, DOM_SID *sid) -{ - unsigned int i = 0; - unsigned int n_del = 0; - - if (!ctx || !new || !old || !sid || !num) return NT_STATUS_INVALID_PARAMETER; - - if((new[0] = (SEC_ACE *) talloc_zero(ctx, (*num) * sizeof(SEC_ACE))) == 0) - return NT_STATUS_NO_MEMORY; - - for (i = 0; i < *num; i ++) { - if (sid_compare(&old[i].trustee, sid) != 0) - sec_ace_copy(&(*new)[i], &old[i]); - else - n_del ++; - } - if (n_del == 0) - return NT_STATUS_NOT_FOUND; - else { - *num -= n_del; - return NT_STATUS_OK; - } -} - -/******************************************************************* - Create a SEC_ACL structure. -********************************************************************/ - -SEC_ACL *make_sec_acl(TALLOC_CTX *ctx, uint16 revision, int num_aces, SEC_ACE *ace_list) -{ - SEC_ACL *dst; - int i; - - if((dst = (SEC_ACL *)talloc_zero(ctx,sizeof(SEC_ACL))) == NULL) - return NULL; - - dst->revision = revision; - dst->num_aces = num_aces; - dst->size = SEC_ACL_HEADER_SIZE; - - /* Now we need to return a non-NULL address for the ace list even - if the number of aces required is zero. This is because there - is a distinct difference between a NULL ace and an ace with zero - entries in it. This is achieved by checking that num_aces is a - positive number. */ - - if ((num_aces) && - ((dst->ace = (SEC_ACE *)talloc(ctx, sizeof(SEC_ACE) * num_aces)) - == NULL)) { - return NULL; - } - - for (i = 0; i < num_aces; i++) { - dst->ace[i] = ace_list[i]; /* Structure copy. */ - dst->size += ace_list[i].size; - } - - return dst; -} - -/******************************************************************* - Duplicate a SEC_ACL structure. -********************************************************************/ - -SEC_ACL *dup_sec_acl(TALLOC_CTX *ctx, SEC_ACL *src) -{ - if(src == NULL) - return NULL; - - return make_sec_acl(ctx, src->revision, src->num_aces, src->ace); -} - /******************************************************************* Reads or writes a SEC_ACL structure. @@ -346,332 +171,6 @@ BOOL sec_io_acl(const char *desc, SEC_ACL **ppsa, prs_struct *ps, int depth) return True; } -/******************************************************************* - Works out the linearization size of a SEC_DESC. -********************************************************************/ - -size_t sec_desc_size(SEC_DESC *psd) -{ - size_t offset; - - if (!psd) return 0; - - offset = SEC_DESC_HEADER_SIZE; - - /* don't align */ - - if (psd->owner_sid != NULL) - offset += sid_size(psd->owner_sid); - - if (psd->grp_sid != NULL) - offset += sid_size(psd->grp_sid); - - if (psd->sacl != NULL) - offset += psd->sacl->size; - - if (psd->dacl != NULL) - offset += psd->dacl->size; - - return offset; -} - -/******************************************************************* - Compares two SEC_ACE structures -********************************************************************/ - -BOOL sec_ace_equal(SEC_ACE *s1, SEC_ACE *s2) -{ - /* Trivial case */ - - if (!s1 && !s2) return True; - - /* Check top level stuff */ - - if (s1->type != s2->type || s1->flags != s2->flags || - s1->info.mask != s2->info.mask) { - return False; - } - - /* Check SID */ - - if (!sid_equal(&s1->trustee, &s2->trustee)) { - return False; - } - - return True; -} - -/******************************************************************* - Compares two SEC_ACL structures -********************************************************************/ - -BOOL sec_acl_equal(SEC_ACL *s1, SEC_ACL *s2) -{ - unsigned int i, j; - - /* Trivial cases */ - - if (!s1 && !s2) return True; - if (!s1 || !s2) return False; - - /* Check top level stuff */ - - if (s1->revision != s2->revision) { - DEBUG(10, ("sec_acl_equal(): revision differs (%d != %d)\n", - s1->revision, s2->revision)); - return False; - } - - if (s1->num_aces != s2->num_aces) { - DEBUG(10, ("sec_acl_equal(): num_aces differs (%d != %d)\n", - s1->revision, s2->revision)); - return False; - } - - /* The ACEs could be in any order so check each ACE in s1 against - each ACE in s2. */ - - for (i = 0; i < s1->num_aces; i++) { - BOOL found = False; - - for (j = 0; j < s2->num_aces; j++) { - if (sec_ace_equal(&s1->ace[i], &s2->ace[j])) { - found = True; - break; - } - } - - if (!found) return False; - } - - return True; -} - -/******************************************************************* - Compares two SEC_DESC structures -********************************************************************/ - -BOOL sec_desc_equal(SEC_DESC *s1, SEC_DESC *s2) -{ - /* Trivial case */ - - if (!s1 && !s2) { - goto done; - } - - /* Check top level stuff */ - - if (s1->revision != s2->revision) { - DEBUG(10, ("sec_desc_equal(): revision differs (%d != %d)\n", - s1->revision, s2->revision)); - return False; - } - - if (s1->type!= s2->type) { - DEBUG(10, ("sec_desc_equal(): type differs (%d != %d)\n", - s1->type, s2->type)); - return False; - } - - /* Check owner and group */ - - if (!sid_equal(s1->owner_sid, s2->owner_sid)) { - fstring str1, str2; - - sid_to_string(str1, s1->owner_sid); - sid_to_string(str2, s2->owner_sid); - - DEBUG(10, ("sec_desc_equal(): owner differs (%s != %s)\n", - str1, str2)); - return False; - } - - if (!sid_equal(s1->grp_sid, s2->grp_sid)) { - fstring str1, str2; - - sid_to_string(str1, s1->grp_sid); - sid_to_string(str2, s2->grp_sid); - - DEBUG(10, ("sec_desc_equal(): group differs (%s != %s)\n", - str1, str2)); - return False; - } - - /* Check ACLs present in one but not the other */ - - if ((s1->dacl && !s2->dacl) || (!s1->dacl && s2->dacl) || - (s1->sacl && !s2->sacl) || (!s1->sacl && s2->sacl)) { - DEBUG(10, ("sec_desc_equal(): dacl or sacl not present\n")); - return False; - } - - /* Sigh - we have to do it the hard way by iterating over all - the ACEs in the ACLs */ - - if (!sec_acl_equal(s1->dacl, s2->dacl) || - !sec_acl_equal(s1->sacl, s2->sacl)) { - DEBUG(10, ("sec_desc_equal(): dacl/sacl list not equal\n")); - return False; - } - - done: - DEBUG(10, ("sec_desc_equal(): secdescs are identical\n")); - return True; -} - -/******************************************************************* - Merge part of security descriptor old_sec in to the empty sections of - security descriptor new_sec. -********************************************************************/ - -SEC_DESC_BUF *sec_desc_merge(TALLOC_CTX *ctx, SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb) -{ - DOM_SID *owner_sid, *group_sid; - SEC_DESC_BUF *return_sdb; - SEC_ACL *dacl, *sacl; - SEC_DESC *psd = NULL; - uint16 secdesc_type; - size_t secdesc_size; - - /* Copy over owner and group sids. There seems to be no flag for - this so just check the pointer values. */ - - owner_sid = new_sdb->sec->owner_sid ? new_sdb->sec->owner_sid : - old_sdb->sec->owner_sid; - - group_sid = new_sdb->sec->grp_sid ? new_sdb->sec->grp_sid : - old_sdb->sec->grp_sid; - - secdesc_type = new_sdb->sec->type; - - /* Ignore changes to the system ACL. This has the effect of making - changes through the security tab audit button not sticking. - Perhaps in future Samba could implement these settings somehow. */ - - sacl = NULL; - secdesc_type &= ~SEC_DESC_SACL_PRESENT; - - /* Copy across discretionary ACL */ - - if (secdesc_type & SEC_DESC_DACL_PRESENT) { - dacl = new_sdb->sec->dacl; - } else { - dacl = old_sdb->sec->dacl; - } - - /* Create new security descriptor from bits */ - - psd = make_sec_desc(ctx, new_sdb->sec->revision, secdesc_type, - owner_sid, group_sid, sacl, dacl, &secdesc_size); - - return_sdb = make_sec_desc_buf(ctx, secdesc_size, psd); - - return(return_sdb); -} - -/******************************************************************* - Creates a SEC_DESC structure -********************************************************************/ - -SEC_DESC *make_sec_desc(TALLOC_CTX *ctx, uint16 revision, uint16 type, - DOM_SID *owner_sid, DOM_SID *grp_sid, - SEC_ACL *sacl, SEC_ACL *dacl, size_t *sd_size) -{ - SEC_DESC *dst; - uint32 offset = 0; - - *sd_size = 0; - - if(( dst = (SEC_DESC *)talloc_zero(ctx, sizeof(SEC_DESC))) == NULL) - return NULL; - - dst->revision = revision; - dst->type = type; - - if (sacl) - dst->type |= SEC_DESC_SACL_PRESENT; - if (dacl) - dst->type |= SEC_DESC_DACL_PRESENT; - - dst->off_owner_sid = 0; - dst->off_grp_sid = 0; - dst->off_sacl = 0; - dst->off_dacl = 0; - - if(owner_sid && ((dst->owner_sid = sid_dup_talloc(ctx,owner_sid)) == NULL)) - goto error_exit; - - if(grp_sid && ((dst->grp_sid = sid_dup_talloc(ctx,grp_sid)) == NULL)) - goto error_exit; - - if(sacl && ((dst->sacl = dup_sec_acl(ctx, sacl)) == NULL)) - goto error_exit; - - if(dacl && ((dst->dacl = dup_sec_acl(ctx, dacl)) == NULL)) - goto error_exit; - - offset = SEC_DESC_HEADER_SIZE; - - /* - * Work out the linearization sizes. - */ - - if (dst->sacl != NULL) { - dst->off_sacl = offset; - offset += dst->sacl->size; - } - - if (dst->dacl != NULL) { - dst->off_dacl = offset; - offset += dst->dacl->size; - } - - if (dst->owner_sid != NULL) { - dst->off_owner_sid = offset; - offset += sid_size(dst->owner_sid); - } - - if (dst->grp_sid != NULL) { - dst->off_grp_sid = offset; - offset += sid_size(dst->grp_sid); - } - - *sd_size = (size_t)offset; - return dst; - -error_exit: - - *sd_size = 0; - return NULL; -} - -/******************************************************************* - Duplicate a SEC_DESC structure. -********************************************************************/ - -SEC_DESC *dup_sec_desc( TALLOC_CTX *ctx, SEC_DESC *src) -{ - size_t dummy; - - if(src == NULL) - return NULL; - - return make_sec_desc( ctx, src->revision, src->type, - src->owner_sid, src->grp_sid, src->sacl, - src->dacl, &dummy); -} - -/******************************************************************* - Creates a SEC_DESC structure with typical defaults. -********************************************************************/ - -SEC_DESC *make_standard_sec_desc(TALLOC_CTX *ctx, DOM_SID *owner_sid, DOM_SID *grp_sid, - SEC_ACL *dacl, size_t *sd_size) -{ - return make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, - owner_sid, grp_sid, NULL, dacl, sd_size); -} - /******************************************************************* Reads or writes a SEC_DESC structure. If reading and the *ppsd = NULL, allocates the structure. @@ -807,42 +306,6 @@ BOOL sec_io_desc(const char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth) return True; } -/******************************************************************* - Creates a SEC_DESC_BUF structure. -********************************************************************/ - -SEC_DESC_BUF *make_sec_desc_buf(TALLOC_CTX *ctx, size_t len, SEC_DESC *sec_desc) -{ - SEC_DESC_BUF *dst; - - if((dst = (SEC_DESC_BUF *)talloc_zero(ctx, sizeof(SEC_DESC_BUF))) == NULL) - return NULL; - - /* max buffer size (allocated size) */ - dst->max_len = (uint32)len; - dst->len = (uint32)len; - - if(sec_desc && ((dst->sec = dup_sec_desc(ctx, sec_desc)) == NULL)) { - return NULL; - } - - dst->ptr = 0x1; - - return dst; -} - -/******************************************************************* - Duplicates a SEC_DESC_BUF structure. -********************************************************************/ - -SEC_DESC_BUF *dup_sec_desc_buf(TALLOC_CTX *ctx, SEC_DESC_BUF *src) -{ - if(src == NULL) - return NULL; - - return make_sec_desc_buf( ctx, src->len, src->sec); -} - /******************************************************************* Reads or writes a SEC_DESC_BUF structure. ********************************************************************/ @@ -901,193 +364,3 @@ BOOL sec_io_desc_buf(const char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int return True; } - -/******************************************************************* - Add a new SID with its permissions to SEC_DESC. -********************************************************************/ - -NTSTATUS sec_desc_add_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, uint32 mask, size_t *sd_size) -{ - SEC_DESC *sd = 0; - SEC_ACL *dacl = 0; - SEC_ACE *ace = 0; - NTSTATUS status; - - *sd_size = 0; - - if (!ctx || !psd || !sid || !sd_size) - return NT_STATUS_INVALID_PARAMETER; - - status = sec_ace_add_sid(ctx, &ace, psd[0]->dacl->ace, &psd[0]->dacl->num_aces, sid, mask); - - if (!NT_STATUS_IS_OK(status)) - return status; - - if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace))) - return NT_STATUS_UNSUCCESSFUL; - - if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid, - psd[0]->grp_sid, psd[0]->sacl, dacl, sd_size))) - return NT_STATUS_UNSUCCESSFUL; - - *psd = sd; - sd = 0; - return NT_STATUS_OK; -} - -/******************************************************************* - Modify a SID's permissions in a SEC_DESC. -********************************************************************/ - -NTSTATUS sec_desc_mod_sid(SEC_DESC *sd, DOM_SID *sid, uint32 mask) -{ - NTSTATUS status; - - if (!sd || !sid) - return NT_STATUS_INVALID_PARAMETER; - - status = sec_ace_mod_sid(sd->dacl->ace, sd->dacl->num_aces, sid, mask); - - if (!NT_STATUS_IS_OK(status)) - return status; - - return NT_STATUS_OK; -} - -/******************************************************************* - Delete a SID from a SEC_DESC. -********************************************************************/ - -NTSTATUS sec_desc_del_sid(TALLOC_CTX *ctx, SEC_DESC **psd, DOM_SID *sid, size_t *sd_size) -{ - SEC_DESC *sd = 0; - SEC_ACL *dacl = 0; - SEC_ACE *ace = 0; - NTSTATUS status; - - *sd_size = 0; - - if (!ctx || !psd[0] || !sid || !sd_size) - return NT_STATUS_INVALID_PARAMETER; - - status = sec_ace_del_sid(ctx, &ace, psd[0]->dacl->ace, &psd[0]->dacl->num_aces, sid); - - if (!NT_STATUS_IS_OK(status)) - return status; - - if (!(dacl = make_sec_acl(ctx, psd[0]->dacl->revision, psd[0]->dacl->num_aces, ace))) - return NT_STATUS_UNSUCCESSFUL; - - if (!(sd = make_sec_desc(ctx, psd[0]->revision, psd[0]->type, psd[0]->owner_sid, - psd[0]->grp_sid, psd[0]->sacl, dacl, sd_size))) - return NT_STATUS_UNSUCCESSFUL; - - *psd = sd; - sd = 0; - return NT_STATUS_OK; -} - -/******************************************************************* - Comparison function to sort non-inherited first. -*******************************************************************/ - -static int nt_ace_inherit_comp( SEC_ACE *a1, SEC_ACE *a2) -{ - int a1_inh = a1->flags & SEC_ACE_FLAG_INHERITED_ACE; - int a2_inh = a2->flags & SEC_ACE_FLAG_INHERITED_ACE; - - if (a1_inh == a2_inh) - return 0; - - if (!a1_inh && a2_inh) - return -1; - return 1; -} - -/******************************************************************* - Comparison function to apply the order explained below in a group. -*******************************************************************/ - -static int nt_ace_canon_comp( SEC_ACE *a1, SEC_ACE *a2) -{ - if ((a1->type == SEC_ACE_TYPE_ACCESS_DENIED) && - (a2->type != SEC_ACE_TYPE_ACCESS_DENIED)) - return -1; - - if ((a2->type == SEC_ACE_TYPE_ACCESS_DENIED) && - (a1->type != SEC_ACE_TYPE_ACCESS_DENIED)) - return 1; - - /* Both access denied or access allowed. */ - - /* 1. ACEs that apply to the object itself */ - - if (!(a1->flags & SEC_ACE_FLAG_INHERIT_ONLY) && - (a2->flags & SEC_ACE_FLAG_INHERIT_ONLY)) - return -1; - else if (!(a2->flags & SEC_ACE_FLAG_INHERIT_ONLY) && - (a1->flags & SEC_ACE_FLAG_INHERIT_ONLY)) - return 1; - - /* 2. ACEs that apply to a subobject of the object, such as - * a property set or property. */ - - if (a1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT) && - !(a2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT))) - return -1; - else if (a2->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT) && - !(a1->flags & (SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_OBJECT_INHERIT))) - return 1; - - return 0; -} - -/******************************************************************* - Functions to convert a SEC_DESC ACE DACL list into canonical order. - JRA. - ---- from http://msdn.microsoft.com/library/default.asp?url=/library/en-us/security/security/order_of_aces_in_a_dacl.asp - -The following describes the preferred order: - - To ensure that noninherited ACEs have precedence over inherited ACEs, - place all noninherited ACEs in a group before any inherited ACEs. - This ordering ensures, for example, that a noninherited access-denied ACE - is enforced regardless of any inherited ACE that allows access. - - Within the groups of noninherited ACEs and inherited ACEs, order ACEs according to ACE type, as the following shows: - 1. Access-denied ACEs that apply to the object itself - 2. Access-denied ACEs that apply to a subobject of the object, such as a property set or property - 3. Access-allowed ACEs that apply to the object itself - 4. Access-allowed ACEs that apply to a subobject of the object" - -********************************************************************/ - -void dacl_sort_into_canonical_order(SEC_ACE *srclist, unsigned int num_aces) -{ - unsigned int i; - - if (!srclist || num_aces == 0) - return; - - /* Sort so that non-inherited ACE's come first. */ - qsort( srclist, num_aces, sizeof(srclist[0]), QSORT_CAST nt_ace_inherit_comp); - - /* Find the boundary between non-inherited ACEs. */ - for (i = 0; i < num_aces; i++ ) { - SEC_ACE *curr_ace = &srclist[i]; - - if (curr_ace->flags & SEC_ACE_FLAG_INHERITED_ACE) - break; - } - - /* i now points at entry number of the first inherited ACE. */ - - /* Sort the non-inherited ACEs. */ - if (i) - qsort( srclist, i, sizeof(srclist[0]), QSORT_CAST nt_ace_canon_comp); - - /* Now sort the inherited ACEs. */ - if (num_aces - i) - qsort( &srclist[i], num_aces - i, sizeof(srclist[0]), QSORT_CAST nt_ace_canon_comp); -} diff --git a/source3/rpc_server/srv_lsa.c b/source3/rpc_server/srv_lsa.c index 138fb1d7ef..5d6c1551c9 100644 --- a/source3/rpc_server/srv_lsa.c +++ b/source3/rpc_server/srv_lsa.c @@ -443,7 +443,7 @@ static BOOL api_lsa_enum_privsaccount(pipes_struct *p) return False; } - r_u.status = _lsa_enum_privsaccount(p, &q_u, &r_u); + r_u.status = _lsa_enum_privsaccount(p, rdata, &q_u, &r_u); /* store the response in the SMB stream */ if(!lsa_io_r_enum_privsaccount("", &r_u, rdata, 0)) { diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c index 0921824cad..0a8ad404cb 100644 --- a/source3/rpc_server/srv_lsa_nt.c +++ b/source3/rpc_server/srv_lsa_nt.c @@ -955,7 +955,7 @@ NTSTATUS _lsa_open_account(pipes_struct *p, LSA_Q_OPENACCOUNT *q_u, LSA_R_OPENAC For a given SID, enumerate all the privilege this account has. ***************************************************************************/ -NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, LSA_Q_ENUMPRIVSACCOUNT *q_u, LSA_R_ENUMPRIVSACCOUNT *r_u) +NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, prs_struct *ps, LSA_Q_ENUMPRIVSACCOUNT *q_u, LSA_R_ENUMPRIVSACCOUNT *r_u) { struct lsa_info *info=NULL; GROUP_MAP map; @@ -971,29 +971,29 @@ NTSTATUS _lsa_enum_privsaccount(pipes_struct *p, LSA_Q_ENUMPRIVSACCOUNT *q_u, LS return NT_STATUS_NO_SUCH_GROUP; #if 0 /* privileges currently not implemented! */ - DEBUG(10,("_lsa_enum_privsaccount: %d privileges\n", map.priv_set.count)); - if (map.priv_set.count!=0) { + DEBUG(10,("_lsa_enum_privsaccount: %d privileges\n", map.priv_set->count)); + if (map.priv_set->count!=0) { - set=(LUID_ATTR *)talloc(p->mem_ctx, map.priv_set.count*sizeof(LUID_ATTR)); + set=(LUID_ATTR *)talloc(map.priv_set->mem_ctx, map.priv_set.count*sizeof(LUID_ATTR)); if (set == NULL) { - free_privilege(&map.priv_set); + destroy_privilege(&map.priv_set); return NT_STATUS_NO_MEMORY; } - for (i=0; iset[i].luid.low; + set[i].luid.high = map.priv_set->set[i].luid.high; + set[i].attr = map.priv_set->set[i].attr; DEBUG(10,("_lsa_enum_privsaccount: priv %d: %d:%d:%d\n", i, set[i].luid.high, set[i].luid.low, set[i].attr)); } } - init_lsa_r_enum_privsaccount(r_u, set, map.priv_set.count, 0); - free_privilege(&map.priv_set); + init_lsa_r_enum_privsaccount(ps->mem_ctx, r_u, set, map.priv_set->count, 0); + destroy_privilege(&map.priv_set); #endif - init_lsa_r_enum_privsaccount(r_u, set, 0, 0); + init_lsa_r_enum_privsaccount(ps->mem_ctx, r_u, set, 0, 0); return r_u->status; } @@ -1059,11 +1059,11 @@ NTSTATUS _lsa_setsystemaccount(pipes_struct *p, LSA_Q_SETSYSTEMACCOUNT *q_u, LSA NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u) { #if 0 - struct lsa_info *info=NULL; + struct lsa_info *info = NULL; GROUP_MAP map; - int i=0; - LUID_ATTR *luid_attr=NULL; - PRIVILEGE_SET *set=NULL; + int i = 0; + LUID_ATTR *luid_attr = NULL; + PRIVILEGE_SET *set = NULL; #endif r_u->status = NT_STATUS_OK; @@ -1076,24 +1076,24 @@ NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u if (!pdb_getgrsid(&map, info->sid)) return NT_STATUS_NO_SUCH_GROUP; - set=&q_u->set; + set = &q_u->set; - for (i=0; icount; i++) { - luid_attr=&set->set[i]; + for (i = 0; i < set->count; i++) { + luid_attr = &set->set[i]; /* check if the privilege is already there */ - if (check_priv_in_privilege(&map.priv_set, *luid_attr)){ - free_privilege(&map.priv_set); + if (check_priv_in_privilege(map.priv_set, *luid_attr)){ + destroy_privilege(&map.priv_set); return NT_STATUS_NO_SUCH_PRIVILEGE; } - add_privilege(&map.priv_set, *luid_attr); + add_privilege(map.priv_set, *luid_attr); } if(!pdb_update_group_mapping_entry(&map)) return NT_STATUS_NO_SUCH_GROUP; - free_privilege(&map.priv_set); + destroy_privilege(&map.priv_set); #endif return r_u->status; @@ -1106,11 +1106,11 @@ NTSTATUS _lsa_addprivs(pipes_struct *p, LSA_Q_ADDPRIVS *q_u, LSA_R_ADDPRIVS *r_u NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEPRIVS *r_u) { #if 0 - struct lsa_info *info=NULL; + struct lsa_info *info = NULL; GROUP_MAP map; int i=0; - LUID_ATTR *luid_attr=NULL; - PRIVILEGE_SET *set=NULL; + LUID_ATTR *luid_attr = NULL; + PRIVILEGE_SET *set = NULL; #endif r_u->status = NT_STATUS_OK; @@ -1123,37 +1123,37 @@ NTSTATUS _lsa_removeprivs(pipes_struct *p, LSA_Q_REMOVEPRIVS *q_u, LSA_R_REMOVEP if (!pdb_getgrsid(&map, info->sid)) return NT_STATUS_NO_SUCH_GROUP; - if (q_u->allrights!=0) { + if (q_u->allrights != 0) { /* log it and return, until I see one myself don't do anything */ DEBUG(5,("_lsa_removeprivs: trying to remove all privileges ?\n")); return NT_STATUS_OK; } - if (q_u->ptr==0) { + if (q_u->ptr == 0) { /* log it and return, until I see one myself don't do anything */ DEBUG(5,("_lsa_removeprivs: no privileges to remove ?\n")); return NT_STATUS_OK; } - set=&q_u->set; + set = &q_u->set; - for (i=0; icount; i++) { - luid_attr=&set->set[i]; + for (i = 0; i < set->count; i++) { + luid_attr = &set->set[i]; /* if we don't have the privilege, we're trying to remove, give up */ /* what else can we do ??? JFM. */ - if (!check_priv_in_privilege(&map.priv_set, *luid_attr)){ - free_privilege(&map.priv_set); + if (!check_priv_in_privilege(map.priv_set, *luid_attr)){ + destroy_privilege(&map.priv_set); return NT_STATUS_NO_SUCH_PRIVILEGE; } - remove_privilege(&map.priv_set, *luid_attr); + remove_privilege(map.priv_set, *luid_attr); } if(!pdb_update_group_mapping_entry(&map)) return NT_STATUS_NO_SUCH_GROUP; - free_privilege(&map.priv_set); + destroy_privilege(&map.priv_set); #endif return r_u->status; } diff --git a/source3/script/mkproto.awk b/source3/script/mkproto.awk index b6e911699e..3835ea3af3 100644 --- a/source3/script/mkproto.awk +++ b/source3/script/mkproto.awk @@ -120,7 +120,7 @@ END { gotstart = 1; } - if( $0 ~ /^ADS_STRUCT|^ADS_STATUS|^DATA_BLOB|^ASN1_DATA|^TDB_CONTEXT|^TDB_DATA|^smb_ucs2_t|^TALLOC_CTX|^hash_element|^NT_DEVICEMODE|^enum.*\(|^NT_USER_TOKEN|^SAM_ACCOUNT/ ) { + if( $0 ~ /^ADS_STRUCT|^ADS_STATUS|^DATA_BLOB|^ASN1_DATA|^TDB_CONTEXT|^TDB_DATA|^smb_ucs2_t|^TALLOC_CTX|^hash_element|^NT_DEVICEMODE|^enum.*\(|^NT_USER_TOKEN|^SAM_ACCOUNT|^NTTIME/ ) { gotstart = 1; } diff --git a/source3/tdb/tdbback.c b/source3/tdb/tdbback.c index 9466c29991..68b6fadc88 100644 --- a/source3/tdb/tdbback.c +++ b/source3/tdb/tdbback.c @@ -55,8 +55,7 @@ char *add_suffix(const char *name, const char *suffix) fprintf(stderr,"Out of memory!\n"); exit(1); } - strncpy(ret, name, len); - strncat(ret, suffix, len); + snprintf(ret, len, "%s%s", name, suffix); return ret; } -- cgit
    • SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +subnet 2. After N3_D has synchronized with N1_C and vica versa, +the browse lists will appear as shown in . +

    Table 10.3. Browse Subnet Example 3

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)

    - -Servers with a (*) after them are non-authoritative names. +Servers with an (*) after them are non-authoritative names.

    -At this point users looking in their network neighborhood on -subnets 1 or 3 will see all the servers on all subnets, users on +At this point, users looking in their network neighborhood on +subnets 1 or 3 will see all the servers on all subnets, while users on subnet 2 will still only see the servers on subnets 1 and 2, but not 3.

    -Finally, the local master browser for subnet 2 (N2_B) will sync again -with the domain master browser (N1_C) and will receive the missing -server entries. Finally - and as a steady state (if no machines -are removed or shut off) the browse lists will look like : -

    -

    Table 10.4. Browse subnet example 4

    + + + + + + + + + +
    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, +Finally, the Local Master Browser for subnet 2 (N2_B) will sync again +with the Domain Master Browser (N1_C) and will receive the missing +server entries. Finally, as when a steady state (if no machines +are removed or shut off) has been achieved, the browse lists will appear +as shown in . +

    Table 10.4. Browse Subnet Example 4

    SubnetBrowse MasterList
    Subnet1N1_CN1_A, N1_B, N1_C, N1_D, N1_E, N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet2N2_BN2_A, N2_B, N2_C, N2_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)
    Subnet3N3_DN3_A, N3_B, N3_C, N3_D, N1_A(*), N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)

    - -Servers with a (*) after them are non-authoritative names. +Servers with an (*) after them are non-authoritative names.

    -Synchronizations between the domain master browser and local -master browsers will continue to occur, but this should be a -steady state situation. +Synchronizations between the Domain Master Browser and Local +Master Browsers will continue to occur, but this should remain a +steady state operation.

    -If either router R1 or R2 fails the following will occur: +If either router R1 or R2 fails, the following will occur:

    1. Names of computers on each side of the inaccessible network fragments - will be maintained for as long as 36 minutes, in the network neighbourhood + will be maintained for as long as 36 minutes in the network neighborhood lists.

    2. Attempts to connect to these inaccessible computers will fail, but the - names will not be removed from the network neighbourhood lists. + names will not be removed from the network neighborhood lists.

    3. If one of the fragments is cut off from the WINS server, it will only - be able to access servers on its local subnet, by using subnet-isolated - broadcast NetBIOS name resolution. The effects are similar to that of + be able to access servers on its local subnet using subnet-isolated + broadcast NetBIOS name resolution. The effects are similar to that of losing access to a DNS server. -

    Common Errors

    +

    Common Errors

    Many questions are asked on the mailing lists regarding browsing. The majority of browsing -problems originate out of incorrect configuration of NetBIOS name resolution. Some are of +problems originate from incorrect configuration of NetBIOS name resolution. Some are of particular note. -

    How can one flush the Samba NetBIOS name cache without restarting Samba?

    -Samba's nmbd process controls all browse list handling. Under normal circumstances it is -safe to restart nmbd. This will effectively flush the Samba NetBIOS name cache and cause it -to be rebuilt. Note that this does NOT make certain that a rogue machine name will not re-appear -in the browse list. When nmbd is taken out of service another machine on the network will -become the browse master. This new list may still have the rogue entry in it. If you really -want to clear a rogue machine from the list then every machine on the network will need to be -shut down and restarted at after all machines are down. Failing a complete restart, the only +

    How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?

    + +Samba's nmbd process controls all browse list handling. Under normal circumstances it is +safe to restart nmbd. This will effectively flush the Samba NetBIOS name cache and cause it +to be rebuilt. This does not make certain that a rogue machine name will not re-appear +in the browse list. When nmbd is taken out of service, another machine on the network will +become the Browse Master. This new list may still have the rogue entry in it. If you really +want to clear a rogue machine from the list, every machine on the network will need to be +shut down and restarted after all machines are down. Failing a complete restart, the only other thing you can do is wait until the entry times out and is then flushed from the list. -This may take a long time on some networks (months). -

    My client reports "This server is not configured to list shared resources"

    +This may take a long time on some networks (perhaps months). +

    Server Resources Can Not Be Listed

    “My Client Reports ‘This server is not configured to list shared resources’”

    Your guest account is probably invalid for some reason. Samba uses the -guest account for browsing in smbd. Check that your guest account is +guest account for browsing in smbd. Check that your guest account is valid. -

    See also guest account in the smb.conf man page.

    I get an Unable to browse the network error

    This error can have multiple causes:

    • There is no local master browser. Configure nmbd - or any other machine to serve as local master browser.

    • You can not log onto the machine that is the local master - browser. Can you logon to it as guest user?

    • There is no IP connectivity to the local master browser. - Can you reach it by broadcast?

    Chapter 11. Account Information Databases

    Jelmer R. Vernooij

    The Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Jeremy Allison

    Samba Team

    John H. Terpstra

    Samba Team

    Olivier (lem) Lemaire

    IDEALX

    May 24, 2003

    Table of Contents

    Features and Benefits
    Backwards Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon
    Users being added to wrong backend database
    auth methods does not work

    -Samba 3 implements a new capability to work concurrently with multiple account backends. -The possible new combinations of password backends allows Samba 3 a degree of flexibility +

    Also see guest account in the smb.conf man page.

    I get an `Unable to browse the network' error

    This error can have multiple causes: + +

    • There is no Local Master Browser. Configure nmbd + or any other machine to serve as Local Master Browser.

    • You cannot log onto the machine that is the local master + browser. Can you logon to it as a guest user?

    • There is no IP connectivity to the Local Master Browser. + Can you reach it by broadcast?

    Browsing of Shares and Directories is Very Slow

    “ + +There are only two machines on a test network. One a Samba server, the other a Windows XP machine. +Authentication and logons work perfectly, but when I try to explore shares on the Samba server, the +Windows XP client becomes unrespsonsive. Sometimes it does not respond for some minutes. Eventually, +Windows Explorer will respond and displays files and directories without problem. +display file and directory.” +

    “ +But, the share is immediately available from a command shell (cmd, followed by +exploration with dos command. Is this a Samba problem or is it a Windows problem? How can I solve this? +”

    +Here are a few possibilities: +

    Bad Networking Hardware

    + + + Most common defective hardware problems center around low cost or defective HUBs, routers, + Network Interface Controllers (NICs) and bad wiring. If one piece of hardware is defective + the whole network may suffer. Bad networking hardware can cause data corruption. Most bad + networking hardware problems are accompanied by an increase in apparent network traffic, + but not all. +

    The Windows XP WebClient

    + A number of sites have reported similar slow network browsing problems and found that when + the WebClient service is turned off, the problem dissapears. This is certainly something + that should be explored as it is a simple solution if it works. +

    Inconsistent WINS Configuration

    + This type of problem is common when one client is configured to use a WINS server (that is + a TCP/IP configuration setting) and there is no WINS server on the network. Alternately, + this will happen is there is a WINS server and Samba is not configured to use it. The use of + WINS is highly recommended if the network is using NetBIOS over TCP/IP protocols. If use + of NetBIOS over TCP/IP is disabled on all clients, Samba should not be configured as a WINS + server neither should it be configured to use one. +

    Incorrect DNS Configuration

    + If use of NetBIOS over TCP/IP is disabled, Active Directory is in use and the DNS server + has been incorrectly configured. Refer for more information. +

    Chapter 11. Account Information Databases

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Jeremy Allison

    Samba Team

    Guenther Deschner

    LDAP updates
    SuSE

    Olivier (lem) Lemaire

    IDEALX

    May 24, 2003

    Table of Contents

    Features and Benefits
    Backward Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plaintext
    smbpasswd Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users Cannot Logon
    Users Being Added to the Wrong Backend Database
    Configuration of auth methods

    +Samba-3 implements a new capability to work concurrently with multiple account backends. +The possible new combinations of password backends allows Samba-3 a degree of flexibility and scalability that previously could be achieved only with MS Windows Active Directory. This chapter describes the new functionality and how to get the most out of it.

    -In the course of development of Samba-3, a number of requests were received to provide the +In the development of Samba-3, a number of requests were received to provide the ability to migrate MS Windows NT4 SAM accounts to Samba-3 without the need to provide -matching UNIX/Linux accounts. We called this the Non UNIX Accounts (NUA) +matching UNIX/Linux accounts. We called this the Non-UNIX Accounts (NUA) capability. The intent was that an administrator could decide to use the tdbsam -backend and by simply specifying passdb backend = tdbsam_nua +backend and by simply specifying passdb backend = tdbsam_nua, this would allow Samba-3 to implement a solution that did not use UNIX accounts per se. Late in the development cycle, the team doing this work hit upon some obstacles that prevents this -solution from being used. Given the delays with Samba-3 release a decision was made to NOT -deliver this functionality until a better method of recognising NT Group SIDs from NT User -SIDs could be found. This feature may thus return during the life cycle for the Samba-3 series. +solution from being used. Given the delays with the Samba-3 release, a decision was made to not +deliver this functionality until a better method of recognizing NT Group SIDs from NT User +SIDs could be found. This feature may return during the life cycle for the Samba-3 series.

    Note

    -Samba-3 does NOT support Non-UNIX Account (NUA) operation for user accounts. +Samba-3 does not support Non-UNIX Account (NUA) operation for user accounts. Samba-3 does support NUA operation for machine accounts. -

    Features and Benefits

    -Samba-3 provides for complete backwards compatibility with Samba-2.2.x functionality +

    Features and Benefits

    +Samba-3 provides for complete backward compatibility with Samba-2.2.x functionality as follows: -

    Backwards Compatibility Backends

    Plain Text:

    + + + +

    Backward Compatibility Backends

    Plain Text

    This option uses nothing but the UNIX/Linux /etc/passwd - style back end. On systems that have PAM (Pluggable Authentication Modules) - support all PAM modules are supported. The behaviour is just as it was with + style backend. On systems that have Pluggable Authentication Modules (PAM) + support, all PAM modules are supported. The behavior is just as it was with Samba-2.2.x, and the protocol limitations imposed by MS Windows clients - apply likewise. -

    smbpasswd:

    - This option allows continues use of the smbpasswd + apply likewise. Please refer to for more information + regarding the limitations of Plain Text password usage. +

    smbpasswd

    + This option allows continued use of the smbpasswd file that maintains a plain ASCII (text) layout that includes the MS Windows LanMan and NT encrypted passwords as well as a field that stores some - account information. This form of password backend does NOT store any of - the MS Windows NT/200x SAM (Security Account Manager) information needed to + account information. This form of password backend does not store any of + the MS Windows NT/200x SAM (Security Account Manager) information required to provide the extended controls that are needed for more comprehensive - interoperation with MS Windows NT4 / 200x servers. + interoperation with MS Windows NT4/200x servers.

    - This backend should be used only for backwards compatibility with older + This backend should be used only for backward compatibility with older versions of Samba. It may be deprecated in future releases. -

    ldapsam_compat (Samba-2.2 LDAP Compatibility):

    +

    ldapsam_compat (Samba-2.2 LDAP Compatibility)

    There is a password backend option that allows continued operation with - a existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension. + an existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension. This option is provided primarily as a migration tool, although there is - no reason to force migration at this time. Note that this tool will eventually + no reason to force migration at this time. This tool will eventually be deprecated. -

    New Backends

    -Samba-3 introduces the following new password backend capabilities: -

    tdbsam:

    +

    +Samba-3 introduces a number of new password backend capabilities. + + + + +

    New Backends

    tdbsam

    This backend provides a rich database backend for local servers. This - backend is NOT suitable for multiple domain controller (ie: PDC + one + backend is not suitable for multiple Domain Controllers (i.e., PDC + one or more BDC) installations.

    The tdbsam password backend stores the old - smbpasswd information PLUS the extended MS Windows NT / 200x + smbpasswd information plus the extended MS Windows NT / 200x SAM information into a binary format TDB (trivial database) file. The inclusion of the extended information makes it possible for Samba-3 to implement the same account and system access controls that are possible - with MS Windows NT4 and MS Windows 200x based systems. + with MS Windows NT4/200x-based systems.

    The inclusion of the tdbsam capability is a direct response to user requests to allow simple site operation without the overhead of the complexities of running OpenLDAP. It is recommended to use this only - for sites that have fewer than 250 users. For larger sites or implementations + for sites that have fewer than 250 users. For larger sites or implementations, the use of OpenLDAP or of Active Directory integration is strongly recommended. -

    ldapsam:

    +

    ldapsam

    This provides a rich directory backend for distributed account installation.

    Samba-3 has a new and extended LDAP implementation that requires configuration - of OpenLDAP with a new format samba schema. The new format schema file is + of OpenLDAP with a new format Samba schema. The new format schema file is included in the examples/LDAP directory of the Samba distribution.

    The new LDAP implementation significantly expands the control abilities that were possible with prior versions of Samba. It is now possible to specify - "per user" profile settings, home directories, account access controls, and - much more. Corporate sites will see that the Samba-Team has listened to their + “per user” profile settings, home directories, account access controls, and + much more. Corporate sites will see that the Samba Team has listened to their requests both for capability and to allow greater scalability. -

    mysqlsam (MySQL based backend):

    - It is expected that the MySQL based SAM will be very popular in some corners. - This database backend will be on considerable interest to sites that want to +

    mysqlsam (MySQL based backend)

    + It is expected that the MySQL-based SAM will be very popular in some corners. + This database backend will be of considerable interest to sites that want to leverage existing MySQL technology. -

    xmlsam (XML based datafile):

    +

    xmlsam (XML based datafile)

    + Allows the account and password data to be stored in an XML format - data file. This backend can not be used for normal operation, it can only + data file. This backend cannot be used for normal operation, it can only be used in conjunction with pdbedit's pdb2pdb functionality. The DTD that is used might be subject to changes in the future.

    - The xmlsam option can be useful for account migration between database + The xmlsam option can be useful for account migration between database backends or backups. Use of this tool will allow the data to be edited before migration into another backend format. -

    Technical Information

    - Old windows clients send plain text passwords over the wire. Samba can check these - passwords by crypting them and comparing them to the hash stored in the unix user database. +

    Technical Information

    + Old Windows clients send plain text passwords over the wire. Samba can check these + passwords by encrypting them and comparing them to the hash stored in the UNIX user database.

    - Newer windows clients send encrypted passwords (so-called Lanman and NT hashes) over + + Newer Windows clients send encrypted passwords (so-called Lanman and NT hashes) over the wire, instead of plain text passwords. The newest clients will send only encrypted passwords and refuse to send plain text passwords, unless their registry is tweaked.

    - These passwords can't be converted to unix style encrypted passwords. Because of that, - you can't use the standard unix user database, and you have to store the Lanman and NT + These passwords can't be converted to UNIX-style encrypted passwords. Because of that, + you can't use the standard UNIX user database, and you have to store the Lanman and NT hashes somewhere else.

    - In addition to differently encrypted passwords, windows also stores certain data for each - user that is not stored in a unix user database. e.g: workstations the user may logon from, - the location where the users' profile is stored, and so on. Samba retrieves and stores this - information using a passdb backend. Commonly available backends are LDAP, plain text - file, MySQL and nisplus. For more information, see the man page for smb.conf regarding the - passdb backend parameter. -

    Figure 11.1. IDMAP

    IDMAP

    Important Notes About Security

    - The unix and SMB password encryption techniques seem similar on the surface. This - similarity is, however, only skin deep. The unix scheme typically sends clear text + In addition to differently encrypted passwords, Windows also stores certain data for each + user that is not stored in a UNIX user database. For example, workstations the user may logon from, + the location where the user's profile is stored, and so on. Samba retrieves and stores this + information using a passdb backend. Commonly available backends are LDAP, plain text + file, and MySQL. For more information, see the man page for smb.conf regarding the + passdb backend parameter. +

    Figure 11.1. IDMAP: Resolution of SIDs to UIDs.

    IDMAP: Resolution of SIDs to UIDs.

    + + The resolution of SIDs to UIDs is fundamental to correct operation of Samba. In both cases shown, if winbindd is not running, or cannot + be contacted, then only local SID/UID resolution is possible. See and + . +

    Figure 11.2. IDMAP: Resolution of UIDs to SIDs.

    IDMAP: Resolution of UIDs to SIDs.

    Important Notes About Security

    + The UNIX and SMB password encryption techniques seem similar on the surface. This + similarity is, however, only skin deep. The UNIX scheme typically sends cleartext passwords over the network when logging in. This is bad. The SMB encryption scheme never sends the cleartext password over the network but it does store the 16 byte hashed values on disk. This is also bad. Why? Because the 16 byte hashed values - are a "password equivalent". You cannot derive the user's password from them, but + are a “password equivalent.” You cannot derive the user's password from them, but they could potentially be used in a modified client to gain access to a server. This would require considerable technical knowledge on behalf of the attacker but - is perfectly possible. You should thus treat the data stored in whatever passdb - backend you use (smbpasswd file, ldap, mysql) as though it contained the cleartext - passwords of all your users. Its contents must be kept secret, and the file should + is perfectly possible. You should thus treat the datastored in whatever passdb + backend you use (smbpasswd file, LDAP, MYSQL) as though it contained the cleartext + passwords of all your users. Its contents must be kept secret and the file should be protected accordingly.

    - Ideally we would like a password scheme that involves neither plain text passwords - on the net nor on disk. Unfortunately this is not available as Samba is stuck with - having to be compatible with other SMB systems (WinNT, WfWg, Win95 etc). + Ideally, we would like a password scheme that involves neither plain text passwords + on the network nor on disk. Unfortunately, this is not available as Samba is stuck with + having to be compatible with other SMB systems (Windows NT, Windows for Workgroups, Windows 9x/Me).

    - Windows NT 4.0 Service pack 3 changed the default setting so that plaintext passwords + Windows NT 4.0 Service Pack 3 changed the default setting so plaintext passwords are disabled from being sent over the wire. This mandates either the use of encrypted - password support or edit the Windows NT registry to re-enable plaintext passwords. + password support or editing the Windows NT registry to re-enable plaintext passwords.

    - The following versions of MS Windows do not support full domain security protocols, + The following versions of Microsoft Windows do not support full domain security protocols, although they may log onto a domain environment: -

    • MS DOS Network client 3.0 with the basic network redirector installed

    • Windows 95 with the network redirector update installed

    • Windows 98 [se]

    • Windows Me

    Note

    - MS Windows XP Home does not have facilities to become a domain member and it can - not participate in domain logons. +

    • MS DOS Network client 3.0 with the basic network redirector installed.
    • Windows 95 with the network redirector update installed.
    • Windows 98 [Second Edition].
    • Windows Me.

    Note

    + MS Windows XP Home does not have facilities to become a Domain Member and it cannot participate in domain logons.

    The following versions of MS Windows fully support domain security protocols. -

    • Windows NT 3.5x

    • Windows NT 4.0

    • Windows 2000 Professional

    • Windows 200x Server/Advanced Server

    • Windows XP Professional

    - All current release of Microsoft SMB/CIFS clients support authentication via the - SMB Challenge/Response mechanism described here. Enabling clear text authentication +

    • Windows NT 3.5x.
    • Windows NT 4.0.
    • Windows 2000 Professional.
    • Windows 200x Server/Advanced Server.
    • Windows XP Professional.

    + All current releases of Microsoft SMB/CIFS clients support authentication via the + SMB Challenge/Response mechanism described here. Enabling cleartext authentication does not disable the ability of the client to participate in encrypted authentication. - Instead, it allows the client to negotiate either plain text _or_ encrypted password + Instead, it allows the client to negotiate either plain text or encrypted password handling.

    MS Windows clients will cache the encrypted password alone. Where plain text passwords - are re-enabled, through the appropriate registry change, the plain text password is NEVER + are re-enabled through the appropriate registry change, the plain text password is never cached. This means that in the event that a network connections should become disconnected - (broken) only the cached (encrypted) password will be sent to the resource server to - affect a auto-reconnect. If the resource server does not support encrypted passwords the - auto-reconnect will fail. USE OF ENCRYPTED PASSWORDS IS STRONGLY ADVISED. -

    Advantages of Encrypted Passwords

    • Plain text passwords are not passed across + (broken), only the cached (encrypted) password will be sent to the resource server to + effect an auto-reconnect. If the resource server does not support encrypted passwords the + auto-reconnect will fail. Use of encrypted passwords is strongly advised. +

      Advantages of Encrypted Passwords

      • Plaintext passwords are not passed across the network. Someone using a network sniffer cannot just - record passwords going to the SMB server.

      • Plain text passwords are not stored anywhere in - memory or on disk.

      • WinNT doesn't like talking to a server + record passwords going to the SMB server.

      • Plaintext passwords are not stored anywhere in + memory or on disk.

      • Windows NT does not like talking to a server that does not support encrypted passwords. It will refuse - to browse the server if the server is also in user level + to browse the server if the server is also in User Level security mode. It will insist on prompting the user for the password on each connection, which is very annoying. The only things you can do to stop this is to use SMB encryption.

      • Encrypted password support allows automatic share (resource) reconnects.

      • Encrypted passwords are essential for PDC/BDC - operation.

      Advantages of non-encrypted passwords

      • Plain text passwords are not kept - on disk, and are NOT cached in memory.

      • Uses same password file as other unix - services such as login and ftp

      • Use of other services (such as telnet and ftp) which - send plain text passwords over the net, so sending them for SMB - isn't such a big deal.

    Mapping User Identifiers between MS Windows and UNIX

    + operation.

    Advantages of Non-Encrypted Passwords

    • Plaintext passwords are not kept + on disk, and are not cached in memory.

    • Uses same password file as other UNIX + services such as Login and FTP.

    • Use of other services (such as Telnet and FTP) that + send plain text passwords over the network, so sending them for SMB + is not such a big deal.

    Mapping User Identifiers between MS Windows and UNIX

    Every operation in UNIX/Linux requires a user identifier (UID), just as in - MS Windows NT4 / 200x this requires a Security Identifier (SID). Samba provides + MS Windows NT4/200x this requires a Security Identifier (SID). Samba provides two means for mapping an MS Windows user to a UNIX/Linux UID.

    - Firstly, all Samba SAM (Security Account Manager database) accounts require + First, all Samba SAM (Security Account Manager database) accounts require a UNIX/Linux UID that the account will map to. As users are added to the account - information database, Samba will call the add user script + information database, Samba will call the add user script interface to add the account to the Samba host OS. In essence all accounts in the local SAM require a local user account.

    - The second way to affect Windows SID to UNIX UID mapping is via the - idmap uid, idmap gid parameters in smb.conf. + The second way to effect Windows SID to UNIX UID mapping is via the + idmap uid and idmap gid parameters in smb.conf. Please refer to the man page for information about these parameters. These parameters are essential when mapping users from a remote SAM server.

    Mapping Common UIDs/GIDs on Distributed Machines

    Samba-3 has a special facility that makes it possible to maintain identical UIDs and GIDs on all servers in a distributed network. A distributed network is one where there exists - a PDC, one or more BDCs and/or one or more domain member servers. Why is this important? - This is important if files are being shared over more than one protocol (eg: NFS) and where + a PDC, one or more BDCs and/or one or more Domain Member servers. Why is this important? + This is important if files are being shared over more than one protocol (e.g., NFS) and where users are copying files across UNIX/Linux systems using tools such as rsync.

    The special facility is enabled using a parameter called idmap backend. - The default setting for this parameter is an empty string. Administrators should NOT set this - parameter except when an LDAP based passdb backend is in use. An example of use is: + The default setting for this parameter is an empty string. Technically it is possible to use + an LDAP based idmap backend for UIDs and GIDs, but it makes most sense when this is done for + network configurations that also use LDAP for the SAM backend. A sample use is shown in + .

    -

    Example 11.1. 

    [global]
    idmap backend = ldapsam://ldap-server.quenya.org:636

    -

    Account Management Tools

    -Samba provides two (2) tools for management of User and machine accounts. These tools are + +

    Example 11.1. Example configuration with the LDAP idmap backend

    [global]
    idmap backend = ldapsam:ldap://ldap-server.quenya.org:636
    idmap backend = ldapsam:ldaps://ldap-server.quenya.org

    +

    + A network administrator who wants to make significant use of LDAP backends will sooner or later be + exposed to the excellent work done by PADL Software. PADL http://www.padl.com have + produced and released to open source an array of tools that might be of interest. These tools include: +

    • + nss_ldap: An LDAP Name Service Switch module to provide native + name service support for AIX, Linux, Solaris, and other operating systems. This tool + can be used for centralized storage and retrieval of UIDs/GIDs. +

    • + pam_ldap: A PAM module that provides LDAP integration for UNIX/Linux + system access authentication. +

    • + idmap_ad: An IDMAP backend that supports the Microsoft Services for + UNIX RFC 2307 schema available from their web + site. +

    Account Management Tools

    + +Samba provides two tools for management of user and machine accounts. These tools are called smbpasswd and pdbedit. A third tool is under -development but is NOT expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK -GUI tool that looks much like the MS Windows NT4 Domain User Manager - hopefully this will +development but is not expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK +GUI tool that looks much like the MS Windows NT4 Domain User Manager. Hopefully this will be announced in time for the Samba-3.0.1 release. -

    The smbpasswd Command

    - The smbpasswd utility is a utility similar to the passwd - or yppasswd programs. It maintains the two 32 byte password +

    The smbpasswd Command

    + The smbpasswd utility is similar to the passwd + or yppasswd programs. It maintains the two 32 byte password fields in the passdb backend.

    smbpasswd works in a client-server mode where it contacts the - local smbd to change the user's password on its behalf. This has enormous benefits - as follows: + local smbd to change the user's password on its behalf. This has enormous benefits.

    smbpasswd has the capability to change passwords on Windows NT servers (this only works when the request is sent to the NT Primary Domain Controller if changing an NT Domain user's password).

    smbpasswd can be used to: -

    • add user or machine accounts

    • delete user or machine accounts

    • enable user or machine accounts

    • disable user or machine accounts

    • set to NULL user passwords

    • manage interdomain trust accounts

    + + + +

    • add user or machine accounts.
    • delete user or machine accounts.
    • enable user or machine accounts.
    • disable user or machine accounts.
    • set to NULL user passwords.
    • manage interdomain trust accounts.

    To run smbpasswd as a normal user just type: 

     $ smbpasswd
 Old SMB password: secret

    - For secret type old value here - or hit return if - there was no old password + For secret, type old value here or press return if + there is no old password. 

     New SMB Password: new secret
 Repeat New SMB Password: new secret
@@ -3274,32 +3461,38 @@ be announced in time for the Samba-3.0.1 release.
 		If the old value does not match the current value stored for that user, or the two
 		new values do not match each other, then the password will not be changed.
 		
    
-		When invoked by an ordinary user it will only allow change of their own
+		When invoked by an ordinary user, the command will only allow the user to change his or her own
 		SMB password.
 		
    
-		When run by root smbpasswd may take an optional argument, specifying
-		the user name whose SMB password you wish to change. When run as root, smbpasswd
+		When run by root, smbpasswd may take an optional argument specifying
+		the user name whose SMB password you wish to change. When run as root, smbpasswd
 		does not prompt for or check the old password value, thus allowing root to set passwords 
 		for users who have forgotten their passwords.
 		
    
 		smbpasswd is designed to work in the way familiar to UNIX
 		users who use the passwd or yppasswd commands.
-		While designed for administrative use, this tool provides essential user level
+		While designed for administrative use, this tool provides essential User Level
 		password change capabilities.
 		
    
-		For more details on using smbpasswd refer to the man page (the
+		For more details on using smbpasswd, refer to the man page (the
 		definitive reference).
-

    The pdbedit Command

    +

    The pdbedit Command

    + pdbedit is a tool that can be used only by root. It is used to manage the passdb backend. pdbedit can be used to: -

    • add, remove or modify user accounts

    • listing user accounts

    • migrate user accounts

    + + + +

    • add, remove or modify user accounts.
    • list user accounts.
    • migrate user accounts.

    + The pdbedit tool is the only one that can manage the account security and policy settings. It is capable of all operations that smbpasswd can do as well as a super set of them.

    + One particularly important purpose of the pdbedit is to allow the migration of account information from one passdb backend to another. See the - XML password backend section of this chapter. + password backend section of this chapter.

    The following is an example of the user account information that is stored in a tdbsam password backend. This listing was produced by running: @@ -3326,12 +3519,13 @@ Password last set: Sat, 14 Dec 2002 14:37:03 GMT Password can change: Sat, 14 Dec 2002 14:37:03 GMT Password must change: Mon, 18 Jan 2038 20:14:07 GMT

    + The pdbedit tool allows migration of authentication (account) databases from one backend to another. For example: To migrate accounts from an old smbpasswd database to a tdbsam backend:

    1. - Set the passdb backend = tdbsam, smbpasswd. + Set the passdb backend = tdbsam, smbpasswd.

    2. Execute: 

      @@ -3340,7 +3534,7 @@ Password must change: Mon, 18 Jan 2038 20:14:07 GMT

    3. Now remove the smbpasswd from the passdb backend configuration in smb.conf. -

    Password Backends

    +

    Password Backends

    Samba offers the greatest flexibility in backend account database design of any SMB/CIFS server technology available today. The flexibility is immediately obvious as one begins to explore this capability. @@ -3348,92 +3542,95 @@ capability. It is possible to specify not only multiple different password backends, but even multiple backends of the same type. For example, to use two different tdbsam databases:

    -

    passdb backend = tdbsam:/etc/samba/passdb.tdb, tdbsam:/etc/samba/old-passdb.tdb

    -

    Plain Text

    - Older versions of Samba retrieved user information from the unix user database +

    passdb backend = tdbsam:/etc/samba/passdb.tdb \
    tdbsam:/etc/samba/old-passdb.tdb

    +

    Plaintext

    + Older versions of Samba retrieved user information from the UNIX user database and eventually some other fields from the file /etc/samba/smbpasswd or /etc/smbpasswd. When password encryption is disabled, no SMB specific data is stored at all. Instead all operations are conducted via the way that the Samba host OS will access its /etc/passwd database. - eg: On Linux systems that is done via PAM. -

    smbpasswd - Encrypted Password Database

    - Traditionally, when configuring encrypt passwords = yes in Samba's smb.conf file, user account + Linux systems For example, all operations are done via PAM. +

    smbpasswd Encrypted Password Database

    + + Traditionally, when configuring encrypt passwords = yes in Samba's smb.conf file, user account information such as username, LM/NT password hashes, password change times, and account - flags have been stored in the smbpasswd(5) file. There are several - disadvantages to this approach for sites with very large numbers of users (counted + flags have been stored in the smbpasswd(5) file. There are several + disadvantages to this approach for sites with large numbers of users (counted in the thousands).

    • - The first is that all lookups must be performed sequentially. Given that + The first problem is that all lookups must be performed sequentially. Given that there are approximately two lookups per domain logon (one for a normal session connection such as when mapping a network drive or printer), this - is a performance bottleneck for large sites. What is needed is an indexed approach - such as is used in databases. + is a performance bottleneck for large sites. What is needed is an indexed approach + such as used in databases.

    • The second problem is that administrators who desire to replicate a smbpasswd file to more than one Samba server were left to use external tools such as rsync(1) and ssh(1) and wrote custom, in-house scripts.

    • - And finally, the amount of information which is stored in an smbpasswd entry leaves + Finally, the amount of information that is stored in an smbpasswd entry leaves no room for additional attributes such as a home directory, password expiration time, or even a Relative Identifier (RID).

    As a result of these deficiencies, a more robust means of storing user attributes - used by smbd was developed. The API which defines access to user accounts + used by smbd was developed. The API which defines access to user accounts is commonly referred to as the samdb interface (previously this was called the passdb API, and is still so named in the Samba CVS trees).

    Samba provides an enhanced set of passdb backends that overcome the deficiencies - of the smbpasswd plain text database. These are tdbsam, ldapsam, and xmlsam. - Of these ldapsam will be of most interest to large corporate or enterprise sites. -

    tdbsam

    Samba can store user and machine account data in a "TDB" (Trivial Database). - Using this backend doesn't require any additional configuration. This backend is + of the smbpasswd plain text database. These are tdbsam, ldapsam and xmlsam. + Of these, ldapsam will be of most interest to large corporate or enterprise sites. +

    tdbsam

    + + Samba can store user and machine account data in a “TDB” (Trivial Database). + Using this backend does not require any additional configuration. This backend is recommended for new installations that do not require LDAP.

    - As a general guide the Samba-Team does NOT recommend using the tdbsam backend for sites + As a general guide, the Samba Team does not recommend using the tdbsam backend for sites that have 250 or more users. Additionally, tdbsam is not capable of scaling for use - in sites that require PDB/BDC implementations that requires replication of the account + in sites that require PDB/BDC implementations that require replication of the account database. Clearly, for reason of scalability, the use of ldapsam should be encouraged. -

    ldapsam

    +

    + The recommendation of a 250 user limit is purely based on the notion that this + would generally involve a site that has routed networks, possibly spread across + more than one physical location. The Samba Team has not at this time established + the performance based scalability limits of the tdbsam architecture. +

    ldapsam

    + There are a few points to stress that the ldapsam does not provide. The LDAP - support referred to in the this documentation does not include: + support referred to in this documentation does not include:

    • A means of retrieving user account information from an Windows 200x Active Directory server.

    • A means of replacing /etc/passwd.

    - The second item can be accomplished by using LDAP NSS and PAM modules. LGPL - versions of these libraries can be obtained from PADL Software - (http://www.padl.com/). More - information about the configuration of these packages may be found at "LDAP, - System Administration; Gerald Carter, O'Reilly; Chapter 6: Replacing NIS". - Refer to - http://safari.oreilly.com/?XmlId=1-56592-491-6 for those who might wish to know - more about configuration and administration of an OpenLDAP server. -

    Note

    - This section is outdated for Samba-3 schema. Samba-3 introduces a new schema - that has not been documented at the time of this publication. -

    + The second item can be accomplished by using LDAP NSS and PAM modules. LGPL + versions of these libraries can be obtained from + PADL Software. + More information about the configuration of these packages may be found at + + LDAP, System Administration; Gerald Carter by O'Reilly; Chapter 6: Replacing NIS." +

    This document describes how to use an LDAP directory for storing Samba user - account information traditionally stored in the smbpasswd(5) file. It is + account information traditionally stored in the smbpasswd(5) file. It is assumed that the reader already has a basic understanding of LDAP concepts - and has a working directory server already installed. For more information - on LDAP architectures and Directories, please refer to the following sites. -

    - Two additional Samba resources which may prove to be helpful are -

    • The Samba-PDC-LDAP-HOWTO - maintained by Ignacio Coupeau.

    • The NT migration scripts from IDEALX that are + and has a working directory server already installed. For more information + on LDAP architectures and directories, please refer to the following sites: +

      • OpenLDAP

      • Sun iPlanet Directory Server

      + Two additional Samba resources which may prove to be helpful are: +

      • The Samba-PDC-LDAP-HOWTO + maintained by Ignacio Coupeau.

      • The NT migration scripts from IDEALX that are geared to manage users and group in such a Samba-LDAP Domain Controller configuration. -

      Supported LDAP Servers

      +

    Supported LDAP Servers

    The LDAP ldapsam code has been developed and tested using the OpenLDAP 2.0 and 2.1 server and - client libraries. The same code should work with Netscape's Directory Server and client SDK. + client libraries. The same code should work with Netscape's Directory Server and client SDK. However, there are bound to be compile errors and bugs. These should not be hard to fix. - Please submit fixes via Bug reporting facility. -

    Schema and Relationship to the RFC 2307 posixAccount

    - Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in - examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: + Please submit fixes via the process outlined in . +

    Schema and Relationship to the RFC 2307 posixAccount

    + Samba-3.0 includes the necessary schema file for OpenLDAP 2.0 in + examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: 

    -objectclass ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY
-    DESC 'Samba 3.0 Auxiliary SAM Account'
+objectclass (1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY
+    DESC 'Samba-3.0 Auxiliary SAM Account'
     MUST ( uid $ sambaSID )
     MAY  ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $
           sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $
@@ -3444,41 +3641,41 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY

    The samba.schema file has been formatted for OpenLDAP 2.0/2.1. - The OID's are owned by the Samba Team and as such is legal to be openly published. - If you translate the schema to be used with Netscape DS, please - submit the modified schema file as a patch to - jerry@samba.org. + The Samba Team owns the OID space used by the above schema and recommends its use. + If you translate the schema to be used with Netscape DS, please submit the modified + schema file as a patch to jerry@samba.org.

    - Just as the smbpasswd file is meant to store information which supplements a + Just as the smbpasswd file is meant to store information that provides information additional to a user's /etc/passwd entry, so is the sambaSamAccount object - meant to supplement the UNIX user account information. A sambaSamAccount is a - STRUCTURAL objectclass so it can be stored individually - in the directory. However, there are several fields (e.g. uid) which overlap - with the posixAccount objectclass outlined in RFC2307. This is by design. + meant to supplement the UNIX user account information. A sambaSamAccount is a + AUXILIARY objectclass so it can be used to augment existing + user account information in the LDAP directory, thus providing information needed + for Samba account handling. However, there are several fields (e.g., uid) that overlap + with the posixAccount objectclass outlined in RFC2307. This is by design.

    In order to store all user account information (UNIX and Samba) in the directory, it is necessary to use the sambaSamAccount and posixAccount objectclasses in - combination. However, smbd will still obtain the user's UNIX account - information via the standard C library calls (e.g. getpwnam(), et. al.). + combination. However, smbd will still obtain the user's UNIX account + information via the standard C library calls (e.g., getpwnam(), et al). This means that the Samba server must also have the LDAP NSS library installed - and functioning correctly. This division of information makes it possible to + and functioning correctly. This division of information makes it possible to store all Samba account information in LDAP, but still maintain UNIX account information in NIS while the network is transitioning to a full LDAP infrastructure. -

    OpenLDAP configuration

    +

    OpenLDAP Configuration

    To include support for the sambaSamAccount object in an OpenLDAP directory server, first copy the samba.schema file to slapd's configuration directory. The samba.schema file can be found in the directory examples/LDAP - in the samba source distribution. + in the Samba source distribution. 

     root# cp samba.schema /etc/openldap/schema/

    Next, include the samba.schema file in slapd.conf. - The sambaSamAccount object contains two attributes which depend upon other schema - files. The 'uid' attribute is defined in cosine.schema and - the 'displayName' attribute is defined in the inetorgperson.schema - file. Both of these must be included before the samba.schema file. + The sambaSamAccount object contains two attributes that depend on other schema + files. The uid attribute is defined in cosine.schema and + the displayName attribute is defined in the inetorgperson.schema + file. Both of these must be included before the samba.schema file. 

     ## /etc/openldap/slapd.conf
@@ -3495,8 +3692,8 @@ include            /etc/openldap/schema/nis.schema

    It is recommended that you maintain some indices on some of the most useful attributes, - like in the following example, to speed up searches made on sambaSamAccount objectclasses - (and possibly posixAccount and posixGroup as well). + as in the following example, to speed up searches made on sambaSamAccount objectclasses + (and possibly posixAccount and posixGroup as well): 

     # Indices to maintain
@@ -3533,10 +3730,10 @@ index   default               sub
 
     root# /etc/init.d/slapd restart
 
    
-

    Initialise the LDAP database

    +

    Initialize the LDAP Database

    Before you can add accounts to the LDAP database you must create the account containers that they will be stored in. The following LDIF file should be modified to match your - needs (ie: Your DNS entries, etc.). + needs (DNS entries, and so on): 

     # Organization for Samba Base
@@ -3566,6 +3763,34 @@ objectclass: top
 objectclass: organizationalRole
 objectclass: simpleSecurityObject
 userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz
+
+# Setting up container for groups
+dn: ou=Groups,dc=quenya,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: People
+
+# Setting up admin handle for Groups OU
+dn: cn=admin,ou=Groups,dc=quenya,dc=org
+cn: admin
+objectclass: top
+objectclass: organizationalRole
+objectclass: simpleSecurityObject
+userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz
+
+# Setting up container for computers
+dn: ou=Computers,dc=quenya,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: People
+
+# Setting up admin handle for Computers OU
+dn: cn=admin,ou=Computers,dc=quenya,dc=org
+cn: admin
+objectclass: top
+objectclass: organizationalRole
+objectclass: simpleSecurityObject
+userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz

    The userPassword shown above should be generated using slappasswd. @@ -3577,7 +3802,7 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz $ slapadd -v -l initldap.dif

    - Do not forget to secure your LDAP server with an adequate access control list, + Do not forget to secure your LDAP server with an adequate access control list as well as an admin password.

    Note

    Before Samba can access the LDAP server you need to store the LDAP admin password @@ -3585,124 +3810,142 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz 

     root# smbpasswd -w secret

    -

    Configuring Samba

    +

    Configuring Samba

    The following parameters are available in smb.conf only if your - version of samba was built with LDAP support. Samba automatically builds with LDAP support if the + version of Samba was built with LDAP support. Samba automatically builds with LDAP support if the LDAP libraries are found.

    LDAP related smb.conf options: - passdb backend = ldapsam:url, - ldap ssl, - ldap admin dn, - ldap suffix, - ldap filter, - ldap machine suffix, - ldap user suffix, - ldap delete dn, - ldap passwd sync, - ldap trust ids. + passdb backend = ldapsam:url, + ldap admin dn, + ldap delete dn, + ldap filter, + ldap group suffix, + ldap idmap suffix, + ldap machine suffix, + ldap passwd sync, + ldap ssl, + ldap suffix, + ldap user suffix,

    These are described in the smb.conf man - page and so will not be repeated here. However, a sample smb.conf file for - use with an LDAP directory could appear as + page and so will not be repeated here. However, a sample smb.conf file for + use with an LDAP directory could appear as shown in .

    -

    Example 11.2. Configuration with LDAP

    [global]
    security = user
    encrypt passwords = yes
    netbios name = TASHTEGO
    workgroup = NARNIA
    # ldap related parameters
    # define the DN to use when binding to the directory servers
    # The password for this DN is not stored in smb.conf. Rather it
    # must be set by using 'smbpasswd -w secretpw' to store the
    # passphrase in the secrets.tdb file. If the "ldap admin dn" values
    # change, this password will need to be reset.
    ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"
    # Define the SSL option when connecting to the directory
    # ('off', 'start tls', or 'on' (default))
    ldap ssl = start tls
    # syntax: passdb backend = ldapsam:ldap://server-name[:port]
    passdb backend = ldapsam:ldap://funball.samba.org
    # smbpasswd -x delete the entire dn-entry
    ldap delete dn = no
    # the machine and user suffix added to the base suffix
    # wrote WITHOUT quotes. NULL suffixes by default
    ldap user suffix = ou=People
    ldap machine suffix = ou=Systems
    # Trust unix account information in LDAP
    # (see the smb.conf manpage for details)
    ldap trust ids = Yes
    # specify the base DN to use when searching the directory
    ldap suffix = "ou=people,dc=samba,dc=org"
    # generally the default ldap search filter is ok
    ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))"

    -

    Accounts and Groups management

    - As users accounts are managed through the sambaSamAccount objectclass, you should +

    Example 11.2. Configuration with LDAP

    [global]
    security = user
    encrypt passwords = yes
    netbios name = MORIA
    workgroup = NOLDOR
    # ldap related parameters
    # define the DN to use when binding to the directory servers
    # The password for this DN is not stored in smb.conf. Rather it
    # must be set by using 'smbpasswd -w secretpw' to store the
    # passphrase in the secrets.tdb file. If the "ldap admin dn" values
    # change, this password will need to be reset.
    ldap admin dn = "cn=Manager,ou=People,dc=quenya,dc=org"
    # Define the SSL option when connecting to the directory
    # ('off', 'start tls', or 'on' (default))
    ldap ssl = start tls
    # syntax: passdb backend = ldapsam:ldap://server-name[:port]
    passdb backend = ldapsam:ldap://frodo.quenya.org
    # smbpasswd -x delete the entire dn-entry
    ldap delete dn = no
    # the machine and user suffix added to the base suffix
    # wrote WITHOUT quotes. NULL suffixes by default
    ldap user suffix = ou=People
    ldap group suffix = ou=Groups
    ldap machine suffix = ou=Computers
    # Trust UNIX account information in LDAP
    # (see the smb.conf manpage for details)
    # specify the base DN to use when searching the directory
    ldap suffix = ou=People,dc=quenya,dc=org
    # generally the default ldap search filter is ok
    ldap filter = (&(uid=%u)(objectclass=sambaSamAccount))

    +

    Accounts and Groups Management

    + + + + As user accounts are managed through the sambaSamAccount objectclass, you should modify your existing administration tools to deal with sambaSamAccount attributes.

    - Machines accounts are managed with the sambaSamAccount objectclass, just - like users accounts. However, it's up to you to store those accounts - in a different tree of your LDAP namespace: you should use - "ou=Groups,dc=quenya,dc=org" to store groups and - "ou=People,dc=quenya,dc=org" to store users. Just configure your - NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration - file). + Machine accounts are managed with the sambaSamAccount objectclass, just + like users accounts. However, it is up to you to store those accounts + in a different tree of your LDAP namespace. You should use + “ou=Groups,dc=quenya,dc=org” to store groups and + “ou=People,dc=quenya,dc=org” to store users. Just configure your + NSS and PAM accordingly (usually, in the /etc/openldap/sldap.conf + configuration file).

    - In Samba release 3.0, the group management system is based on POSIX + In Samba-3, the group management system is based on POSIX groups. This means that Samba makes use of the posixGroup objectclass. For now, there is no NT-like group system management (global and local - groups). -

    Security and sambaSamAccount

    + groups). Samba-3 knows only about Domain Groups + and, unlike MS Windows 2000 and Active Directory, Samba-3 does not + support nested groups. +

    Security and sambaSamAccount

    There are two important points to remember when discussing the security of sambaSamAccount entries in the directory.

    • Never retrieve the lmPassword or ntPassword attribute values over an unencrypted LDAP session.

    • Never allow non-admin users to view the lmPassword or ntPassword attribute values.

    - These password hashes are clear text equivalents and can be used to impersonate - the user without deriving the original clear text strings. For more information + These password hashes are cleartext equivalents and can be used to impersonate + the user without deriving the original cleartext strings. For more information on the details of LM/NT password hashes, refer to the - Account Information Database section of this chapter. + section of this chapter.

    - To remedy the first security issue, the ldap ssl smb.conf parameter defaults - to require an encrypted session (ldap ssl = on) using + To remedy the first security issue, the ldap ssl smb.conf parameter defaults + to require an encrypted session (ldap ssl = on) using the default port of 636 - when contacting the directory server. When using an OpenLDAP server, it + when contacting the directory server. When using an OpenLDAP server, it is possible to use the use the StartTLS LDAP extended operation in the place of - LDAPS. In either case, you are strongly discouraged to disable this security - (ldap ssl = off). + LDAPS. In either case, you are strongly discouraged to disable this security + (ldap ssl = off).

    Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS - extended operation. However, the OpenLDAP library still provides support for + extended operation. However, the OpenLDAP library still provides support for the older method of securing communication between clients and servers.

    The second security precaution is to prevent non-administrative users from - harvesting password hashes from the directory. This can be done using the + harvesting password hashes from the directory. This can be done using the following ACL in slapd.conf: 

     ## allow the "ldap admin dn" access, but deny everyone else
 access to attrs=lmPassword,ntPassword
-     by dn="cn=Samba Admin,ou=people,dc=quenya,dc=org" write
+     by dn="cn=Samba Admin,ou=People,dc=quenya,dc=org" write
      by * none

    -

    LDAP special attributes for sambaSamAccounts

    - The sambaSamAccount objectclass is composed of the following attributes: +

    LDAP Special Attributes for sambaSamAccounts

    + The sambaSamAccount objectclass is composed of the attributes shown in , and .

    -

    Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP)

    sambaLMPasswordthe LANMAN password 16-byte hash stored as a character -representation of a hexadecimal string.
    sambaNTPasswordthe NT password hash 16-byte stored as a character +

    Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP) Part A

    sambaLMPasswordThe LANMAN password 16-byte hash stored as a character + representation of a hexadecimal string.
    sambaNTPasswordThe NT password hash 16-byte stored as a character representation of a hexadecimal string.
    sambaPwdLastSetThe integer time in seconds since 1970 when the sambaLMPassword and sambaNTPassword attributes were last set. -
    sambaAcctFlagsstring of 11 characters surrounded by square brackets [] - representing account flags such as U (user), W(workstation), X(no password expiration), - I(Domain trust account), H(Home dir required), S(Server trust account), - and D(disabled).
    sambaLogonTimeInteger value currently unused
    sambaLogoffTimeInteger value currently unused
    sambaKickoffTimeInteger value currently unused
    sambaPwdCanChangeInteger value currently unused
    sambaPwdMustChangeInteger value currently unused
    sambaHomeDrivespecifies the drive letter to which to map the - UNC path specified by sambaHomePath. The drive letter must be specified in the form "X:" - where X is the letter of the drive to map. Refer to the "logon drive" parameter in the +
    sambaAcctFlagsString of 11 characters surrounded by square brackets [] + representing account flags such as U (user), W (workstation), X (no password expiration), + I (Domain trust account), H (Home dir required), S (Server trust account), + and D (disabled).
    sambaLogonTimeInteger value currently unused
    sambaLogoffTimeInteger value currently unused
    sambaKickoffTimeSpecifies the time (UNIX time format) when the user + will be locked down and cannot login any longer. If this attribute is ommited, then the account will never expire. + If you use this attribute together with `shadowExpire' of the `shadowAccount' objectClass, will enable accounts to + expire completly on an exact date.
    sambaPwdCanChangeSpecifies the time (UNIX time format) from which on the user is allowed to + change his password. If attribute is not set, the user will be free to change his password whenever he wants.
    sambaPwdMustChangeSpecifies the time (UNIX time format) since when the user is + forced to change his password. If this value is set to `0', the user will have to change his password at first login. + If this attribute is not set, then the password will never expire.
    sambaHomeDriveSpecifies the drive letter to which to map the + UNC path specified by sambaHomePath. The drive letter must be specified in the form “X:” + where X is the letter of the drive to map. Refer to the “logon drive” parameter in the smb.conf(5) man page for more information.
    sambaLogonScriptThe sambaLogonScript property specifies the path of the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path - is relative to the netlogon share. Refer to the logon script parameter in the - smb.conf man page for more information.
    sambaProfilePathspecifies a path to the user's profile. - This value can be a null string, a local absolute path, or a UNC path. Refer to the - logon path parameter in the smb.conf man page for more information.
    sambaHomePathThe sambaHomePath property specifies the path of -the home directory for the user. The string can be null. If sambaHomeDrive is set and specifies -a drive letter, sambaHomePath should be a UNC path. The path must be a network -UNC path of the form \\server\share\directory. This value can be a null string. -Refer to the logon home parameter in the smb.conf man page for more information. -
    sambaUserWorkstationscharacter string value currently unused. -
    sambaSIDThe security identifier(SID) of the user. The windows equivalent of unix uid's.
    sambaPrimaryGroupSIDthe relative identifier (RID) of the primary group - of the user.
    sambaDomainNamedomain the user is part of.

    + is relative to the netlogon share. Refer to the logon script parameter in the + smb.conf man page for more information.

    sambaProfilePathSpecifies a path to the user's profile. + This value can be a null string, a local absolute path, or a UNC path. Refer to the + logon path parameter in the smb.conf man page for more information.
    sambaHomePathThe sambaHomePath property specifies the path of + the home directory for the user. The string can be null. If sambaHomeDrive is set and specifies + a drive letter, sambaHomePath should be a UNC path. The path must be a network + UNC path of the form \\server\share\directory. This value can be a null string. + Refer to the logon home parameter in the smb.conf man page for more information. +

    +

    +

    Table 11.2. Attributes in the sambaSamAccount objectclass (LDAP) Part B

    sambaUserWorkstationsHere you can give a comma-seperated list of machines + on which the user is allowed to login. You may observe problems when you try to connect to an Samba Domain Member. + Bacause Domain Members are not in this list, the Domain Controllers will reject them. Where this attribute is ommited, + the default implies no restrictions. +
    sambaSIDThe security identifier(SID) of the user. + The Windows equivalent of UNIX UIDs.
    sambaPrimaryGroupSIDThe Security IDentifier (SID) of the primary group + of the user.
    sambaDomainNameDomain the user is part of.

    The majority of these parameters are only used when Samba is acting as a PDC of - a domain (refer to the Samba as a primary domain controller chapter for details on + a domain (refer to , for details on how to configure Samba as a Primary Domain Controller). The following four attributes are only stored with the sambaSamAccount entry if the values are non-default values: -

    • sambaHomePath

    • sambaLogonScript

    • sambaProfilePath

    • sambaHomeDrive

    +

    • sambaHomePath
    • sambaLogonScript
    • sambaProfilePath
    • sambaHomeDrive

    These attributes are only stored with the sambaSamAccount entry if - the values are non-default values. For example, assume TASHTEGO has now been - configured as a PDC and that logon home = \\%L\%u was defined in - its smb.conf file. When a user named "becky" logons to the domain, - the logon home string is expanded to \\TASHTEGO\becky. - If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", - this value is used. However, if this attribute does not exist, then the value - of the logon home parameter is used in its place. Samba + the values are non-default values. For example, assume MORIA has now been + configured as a PDC and that logon home = \\%L\%u was defined in + its smb.conf file. When a user named “becky” logons to the domain, + the logon home string is expanded to \\MORIA\becky. + If the smbHome attribute exists in the entry “uid=becky,ou=People,dc=samba,dc=org”, + this value is used. However, if this attribute does not exist, then the value + of the logon home parameter is used in its place. Samba will only write the attribute value to the directory entry if the value is - something other than the default (e.g. \\MOBY\becky). -

    Example LDIF Entries for a sambaSamAccount

    - The following is a working LDIF with the inclusion of the posixAccount objectclass: + something other than the default (e.g., \\MOBY\becky). +

    Example LDIF Entries for a sambaSamAccount

    + The following is a working LDIF that demonstrates the use of the SambaSamAccount objectclass: 

    -	dn: uid=guest2, ou=people,dc=quenya,dc=org
-	sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7
+	dn: uid=guest2, ou=People,dc=quenya,dc=org
+	sambaLMPassword: 878D8014606CDA29677A44EFA1353FC7
 	sambaPwdMustChange: 2147483647
 	sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-513
 	sambaNTPassword: 552902031BEDE9EFAAD3B435B51404EE
@@ -3721,7 +3964,7 @@ Refer to the logon home parameter in the 
-	dn: uid=gcarter, ou=people,dc=quenya,dc=org
+	dn: uid=gcarter, ou=People,dc=quenya,dc=org
 	sambaLogonTime: 0
 	displayName: Gerald Carter
 	sambaLMPassword: 552902031BEDE9EFAAD3B435B51404EE
@@ -3739,206 +3982,258 @@ Refer to the logon home parameter in the 
    Password synchronisation
    
-		Since version 3.0 samba can update the non-samba (LDAP) password stored with an account. When
-		using pam_ldap, this allows changing both unix and windows passwords at once.
-		
    The ldap passwd sync options can have the following values:
    yes
    When the user changes his password, update
-					       ntPassword, lmPassword
-					       and the password fields.
    no
    Only update ntPassword and lmPassword.
    only
    Only update the LDAP password and let the LDAP server worry about the other fields. This option is only available on some LDAP servers. [3]
    More information can be found in the smb.conf manpage.
-

    MySQL

    - Every so often someone will come along with a great new idea. Storing of user accounts in an +

    Password Synchronization

    + Samba-3 and later can update the non-samba (LDAP) password stored with an account. When + using pam_ldap, this allows changing both UNIX and Windows passwords at once. +

    The ldap passwd sync options can have the values shown in + .

    Table 11.3. Possible ldap passwd sync values

    ValueDescription
    yes

    When the user changes his password, update + ntPassword, lmPassword + and the password fields.

    no

    Only update ntPassword and lmPassword.

    only

    Only update the LDAP password and let the LDAP server worry about the other fields. + This option is only available on some LDAP servers. Only when the LDAP server + supports LDAP_EXOP_X_MODIFY_PASSWD.

    More information can be found in the smb.conf manpage.

    MySQL

    + + Every so often someone will come along with a great new idea. Storing user accounts in a SQL backend is one of them. Those who want to do this are in the best position to know what the - specific benefits are to them. This may sound like a cop-out, but in truth we can not attempt - to document every nitty little detail why certain things of marginal utility to the bulk of + specific benefits are to them. This may sound like a cop-out, but in truth we cannot attempt + to document every little detail why certain things of marginal utility to the bulk of Samba users might make sense to the rest. In any case, the following instructions should help the determined SQL user to implement a working system. -

    Creating the database

    - You either can set up your own table and specify the field names to pdb_mysql (see below +

    Creating the Database

    + You can set up your own table and specify the field names to pdb_mysql (see below for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump - contains the correct queries to create the required tables. Use the command : + contains the correct queries to create the required tables. Use the command: 

     $ mysql -uusername -hhostname -ppassword \
-databasename < /path/to/samba/examples/pdb/mysql/mysql.dump
+	databasename < /path/to/samba/examples/pdb/mysql/mysql.dump

    -

    Configuring

    This plugin lacks some good documentation, but here is some short info:

    Add a the following to the passdb backend variable in your smb.conf: -

    passdb backend = [other-plugins] mysql:identifier [other-plugins]

    -

    The identifier can be any string you like, as long as it doesn't collide with +

    Configuring

    This plugin lacks some good documentation, but here is some brief infoormation. Add the following to the + passdb backend variable in your smb.conf: +

    passdb backend = [other-plugins] mysql:identifier [other-plugins]

    +

    The identifier can be any string you like, as long as it does not collide with the identifiers of other plugins or other instances of pdb_mysql. If you - specify multiple pdb_mysql.so entries in passdb backend, you also need to - use different identifiers! -

    - Additional options can be given through the smb.conf file in the [global] section. + specify multiple pdb_mysql.so entries in passdb backend, you also need to + use different identifiers.

    -

    Table 11.2. Basic smb.conf options for MySQL passdb backend

    FieldContents
    mysql hosthost name, defaults to 'localhost'
    mysql password 
    mysql userdefaults to 'samba'
    mysql databasedefaults to 'samba'
    mysql portdefaults to 3306
    tableName of the table containing users

    -

    Warning

    - Since the password for the MySQL user is stored in the - smb.conf file, you should make the smb.conf file - readable only to the user that runs Samba This is considered a security - bug and will be fixed soon. -

    Names of the columns in this table (I've added column types those columns should have first):

    -

    Table 11.3. MySQL field names for MySQL passdb backend

    FieldTypeContents
    logon time columnint(9) 
    logoff time columnint(9) 
    kickoff time columnint(9) 
    pass last set time columnint(9) 
    pass can change time columnint(9) 
    pass must change time columnint(9) 
    username columnvarchar(255)unix username
    domain columnvarchar(255)NT domain user is part of
    nt username columnvarchar(255)NT username
    fullname columnvarchar(255)Full name of user
    home dir columnvarchar(255)UNIX homedir path
    dir drive columnvarchar(2)Directory drive path (eg: 'H:')
    logon script columnvarchar(255)Batch file to run on client side when logging on
    profile path columnvarchar(255)Path of profile
    acct desc columnvarchar(255)Some ASCII NT user data
    workstations columnvarchar(255)Workstations user can logon to (or NULL for all)
    unknown string columnvarchar(255)unknown string
    munged dial columnvarchar(255)?
    user sid columnvarchar(255)NT user SID
    group sid columnvarchar(255)NT group ID
    lanman pass columnvarchar(255)encrypted lanman password
    nt pass columnvarchar(255)encrypted nt passwd
    plain pass columnvarchar(255)plaintext password
    acct control columnint(9)nt user data
    unknown 3 columnint(9)unknown
    logon divs columnint(9)?
    hours len columnint(9)?
    unknown 5 columnint(9)unknown
    unknown 6 columnint(9)unknown

    + Additional options can be given through the smb.conf file in the [global] section. + Refer to . +

    Table 11.4. Basic smb.conf options for MySQL passdb backend

    FieldContents
    mysql hostHost name, defaults to `localhost'
    mysql password 
    mysql userDefaults to `samba'
    mysql databaseDefaults to `samba'
    mysql portDefaults to 3306
    tableName of the table containing the users

    Warning

    + Since the password for the MySQL user is stored in the smb.conf file, you should make the smb.conf file + readable only to the user who runs Samba. This is considered a security bug and will soon be fixed. +

    Names of the columns are given in . The default column names can be found in the example table dump. +

    +

    Table 11.5. MySQL field names for MySQL passdb backend

    FieldTypeContents
    logon time columnint(9)UNIX time stamp of last logon of user
    logoff time columnint(9)UNIX time stamp of last logoff of user
    kickoff time columnint(9)UNIX time stamp of moment user should be kicked off workstation (not enforced)
    pass last set time columnint(9)UNIX time stamp of moment password was last set
    pass can change time columnint(9)UNIX time stamp of moment from which password can be changed
    pass must change time columnint(9)UNIX time stamp of moment on which password must be changed
    username columnvarchar(255)UNIX username
    domain columnvarchar(255)NT domain user belongs to
    nt username columnvarchar(255)NT username
    fullname columnvarchar(255)Full name of user
    home dir columnvarchar(255)UNIX homedir path
    dir drive columnvarchar(2)Directory drive path (e.g., “H:”)
    logon script columnvarchar(255)Batch file to run on client side when logging on
    profile path columnvarchar(255)Path of profile
    acct desc columnvarchar(255)Some ASCII NT user data
    workstations columnvarchar(255)Workstations user can logon to (or NULL for all)
    unknown string columnvarchar(255)Unknown string
    munged dial columnvarchar(255)Unknown
    user sid columnvarchar(255)NT user SID
    group sid columnvarchar(255)NT group SID
    lanman pass columnvarchar(255)Encrypted lanman password
    nt pass columnvarchar(255)Encrypted nt passwd
    plain pass columnvarchar(255)Plaintext password
    acct ctrl columnint(9)NT user data
    unknown 3 columnint(9)Unknown
    logon divs columnint(9)Unknown
    hours len columnint(9)Unknown
    bad password count columnint(5)Number of failed password tries before disabling an account
    logon count columnint(5)Number of logon attempts
    unknown 6 columnint(9)Unknown

    - Eventually, you can put a colon (:) after the name of each column, which + You can put a colon (:) after the name of each column, which should specify the column to update when updating the table. You can also - specify nothing behind the colon - then the data from the field will not be - updated. -

    Using plaintext passwords or encrypted password

    - I strongly discourage the use of plaintext passwords, however, you can use them: + specify nothing behind the colon. Then the field data will not be updated. Setting a column name to NULL means the field should not be used. +

    An example configuration can be found in . +

    Example 11.3. Example configuration for the MySQL passdb backend

    [global]
    passdb backend = mysql:foo
    foo:mysql user = samba
    foo:mysql password = abmas
    foo:mysql database = samba
    # domain name is static and can't be changed
    foo:domain column = 'MYWORKGROUP':
    # The fullname column comes from several other columns
    foo:fullname column = CONCAT(firstname,' ',surname):
    # Samba should never write to the password columns
    foo:lanman pass column = lm_pass:
    foo:nt pass column = nt_pass:
    # The unknown 3 column is not stored
    foo:unknown 3 column = NULL

    Using Plaintext Passwords or Encrypted Password

    + + I strongly discourage the use of plaintext passwords, however, you can use them.

    If you would like to use plaintext passwords, set - 'identifier:lanman pass column' and 'identifier:nt pass column' to - 'NULL' (without the quotes) and 'identifier:plain pass column' to the + `identifier:lanman pass column' and `identifier:nt pass column' to + `NULL' (without the quotes) and `identifier:plain pass column' to the name of the column containing the plaintext passwords.

    If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default. -

    Getting non-column data from the table

    - It is possible to have not all data in the database and making some 'constant'. +

    Getting Non-Column Data from the Table

    + It is possible to have not all data in the database by making some `constant'.

    - For example, you can set 'identifier:fullname column' to : - CONCAT(First_name,' ',Sur_name) + For example, you can set `identifier:fullname column' to + something like CONCAT(Firstname,' ',Surname)

    - Or, set 'identifier:workstations column' to : - NULL

    See the MySQL documentation for more language constructs.

    XML

    This module requires libxml2 to be installed.

    The usage of pdb_xml is pretty straightforward. To export data, use: + Or, set `identifier:workstations column' to: + NULL

    See the MySQL documentation for more language constructs.

    XML

    + + This module requires libxml2 to be installed.

    The usage of pdb_xml is fairly straightforward. To export data, use:

    + $ pdbedit -e xml:filename

    (where filename is the name of the file to put the data in)

    To import data, use: $ pdbedit -i xml:filename -

    Common Errors

    Users can not logon

    “I've installed samba, but now I can't log on with my unix account!”

    Make sure your user has been added to the current samba passdb backend. Read the section Account Management Tools for details.

    Users being added to wrong backend database

    +

    Common Errors

    Users Cannot Logon

    “I've installed Samba, but now I can't log on with my UNIX account! ”

    Make sure your user has been added to the current Samba passdb backend. Read the section for details.

    Users Being Added to the Wrong Backend Database

    A few complaints have been received from users that just moved to Samba-3. The following smb.conf file entries were causing problems, new accounts were being added to the old smbpasswd file, not to the tdbsam passdb.tdb file:

    -

    [global]
    ...
    passdb backend = smbpasswd, tdbsam
    ...

    +

    [global]
    ...
    passdb backend = smbpasswd, tdbsam
    ...

    Samba will add new accounts to the first entry in the passdb backend parameter entry. If you want to update to the tdbsam, then change the entry to:

    -

    [globals]
    ...
    passdb backend = tdbsam, smbpasswd
    ...

    -

    auth methods does not work

    - If you explicitly set an auth methods parameter, guest must be specified as the first - entry on the line. Eg: auth methods = guest sam. +

    passdb backend = tdbsam, smbpasswd

    +

    Configuration of auth methods

    + When explicitly setting an auth methods parameter, + guest must be specified as the first entry on the line, + for example, auth methods = guest sam.

    - This is the exact opposite of the requirement for the passdb backend + This is the exact opposite of the requirement for the passdb backend option, where it must be the LAST parameter on the line. -


    [3] Only when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD

    Chapter 12. Mapping MS Windows and UNIX Groups

    Jean François Micouleau

    Gerald (Jerry) Carter

    Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users group

    +

    Chapter 12. Group Mapping MS Windows and UNIX

    John H. Terpstra

    Samba Team

    Jean François Micouleau

    Gerald (Jerry) Carter

    Samba Team

    Table of Contents

    Features and Benefits
    Discussion
    Default Users, Groups and Relative Identifiers
    Example Configuration
    Configuration Scripts
    Sample smb.conf Add Group Script
    Script to Configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users Group

    + Starting with Samba-3, new group mapping functionality is available to create associations between Windows group SIDs and UNIX groups. The groupmap subcommand included with the net tool can be used to manage these associations. +

    + The new facility for mapping NT Groups to UNIX system groups allows the administrator to decide + which NT Domain Groups are to be exposed to MS Windows clients. Only those NT Groups that map + to a UNIX group that has a value other than the default (-1) will be exposed + in group selection lists in tools that access domain users and groups.

    Warning

    - The first immediate reason to use the group mapping on a Samba PDC, is that - - the domain admin group has been removed and should no longer - be specified in smb.conf. This parameter was used to give the listed users membership - in the Domain Admins Windows group which gave local admin rights on their workstations + + The domain admin group parameter has been removed in Samba-3 and should no longer + be specified in smb.conf. This parameter was used to give the listed users membership in the + Domain Admins Windows group which gave local admin rights on their workstations (in default configurations). -

    Features and Benefits

    - Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to +

    Features and Benefits

    + Samba allows the administrator to create MS Windows NT4/200x group accounts and to arbitrarily associate them with UNIX/Linux group accounts. -

    - Group accounts can be managed using the MS Windows NT4 or MS Windows 200x / XP Professional MMC tools. - Appropriate interface scripts should be provided in smb.conf if it is desired that UNIX / Linux system +

    + + + Group accounts can be managed using the MS Windows NT4 or MS Windows 200x/XP Professional MMC tools. + Appropriate interface scripts should be provided in smb.conf if it is desired that UNIX/Linux system accounts should be automatically created when these tools are used. In the absence of these scripts, and - so long as winbind is running, Samba accounts group accounts that are created using these tools will be - allocated UNIX UIDs/GIDs from the parameters set by the idmap uid/idmap gid settings - in the smb.conf file. -

    Figure 12.1. IDMAP groups

    IDMAP groups

    + so long as winbindd is running, Samba group accounts that are created using these + tools will be allocated UNIX UIDs/GIDs from the ID range specified by the + idmap uid/idmap gid + parameters in the smb.conf file. +

    Figure 12.1. IDMAP: group SID to GID resolution.

    IDMAP: group SID to GID resolution.

    Figure 12.2. IDMAP: GID resolution to matching SID.

    IDMAP: GID resolution to matching SID.

    + In both cases, when winbindd is not running, only locally resolvable groups can be recognized. Please refer to + and . The net groupmap is + used to establish UNIX group to NT SID mappings as shown in . +

    Figure 12.3. IDMAP storing group mappings.

    IDMAP storing group mappings.

    + + Administrators should be aware that where smb.conf group interface scripts make - direct calls to the UNIX/Linux system tools (eg: the shadow utilities, groupadd, - groupdel, groupmod) then the resulting UNIX/Linux group names will be subject - to any limits imposed by these tools. If the tool does NOT allow upper case characters - or space characters, then the creation of an MS Windows NT4 / 200x style group of + direct calls to the UNIX/Linux system tools (the shadow utilities, groupadd, + groupdel, and groupmod), the resulting UNIX/Linux group names will be subject + to any limits imposed by these tools. If the tool does not allow upper case characters + or space characters, then the creation of an MS Windows NT4/200x style group of Engineering Managers will attempt to create an identically named - UNIX/Linux group, an attempt that will of course fail! -

    + UNIX/Linux group, an attempt that will of course fail. +

    + + There are several possible work-arounds for the operating system tools limitation. One method is to use a script that generates a name for the UNIX/Linux system group that - fits the operating system limits, and that then just passes the UNIX/Linux group id (GID) + fits the operating system limits, and that then just passes the UNIX/Linux group ID (GID) back to the calling Samba interface. This will provide a dynamic work-around solution.

    Another work-around is to manually create a UNIX/Linux group, then manually create the - MS Windows NT4 / 200x group on the Samba server and then use the net groupmap + MS Windows NT4/200x group on the Samba server and then use the net groupmap tool to connect the two to each other. -

    Discussion

    - When installing MS Windows NT4 / 200x on a computer, the installation +

    Discussion

    + When installing MS Windows NT4/200x on a computer, the installation program creates default users and groups, notably the Administrators group, - and gives that group privileges necessary privileges to perform essential system tasks. - eg: Ability to change the date and time or to kill (or close) any process running on the + and gives that group privileges necessary privileges to perform essential system tasks, + such as the ability to change the date and time or to kill (or close) any process running on the local machine. -

    - The 'Administrator' user is a member of the 'Administrators' group, and thus inherits - 'Administrators' group privileges. If a 'joe' user is created to be a member of the - 'Administrator' group, 'joe' has exactly the same rights as 'Administrator'. -

    - When an MS Windows NT4 / W200x is made a domain member, the "Domain Admins" group of the - PDC is added to the local 'Administrators' group of the workstation. Every member of the - 'Domain Administrators' group inherits the rights of the local 'Administrators' group when +

    + + The Administrator user is a member of the Administrators group, and thus inherits + Administrators group privileges. If a joe user is created to be a member of the + Administrators group, joe has exactly the same rights as the user, + Administrator. +

    + When an MS Windows NT4/200x/XP machine is made a Domain Member, the “Domain Admins” group of the + PDC is added to the local Administrators group of the workstation. Every member of the + Domain Administrators group inherits the rights of the local Administrators group when logging on the workstation.

    - The following steps describe how to make Samba PDC users members of the 'Domain Admins' group? + The following steps describe how to make Samba PDC users members of the Domain Admins group?

    1. - create a unix group (usually in /etc/group), let's call it domadm -

    2. add to this group the users that must be Administrators. For example - if you want joe, john and mary, your entry in /etc/group will - look like: + Create a UNIX group (usually in /etc/group), let's call it domadm. +

    3. + Add to this group the users that must be “Administrators”. For example, + if you want joe, john and mary to be administrators, + your entry in /etc/group will look like this: 

       		domadm:x:502:joe,john,mary

    4. - Map this domadm group to the "Domain Admins" group by running the command: + Map this domadm group to the “Domain Admins” group by running the command:

      -

      -root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm
-

      -

      - The quotes around "Domain Admins" are necessary due to the space in the group name. - Also make sure to leave no whitespace surrounding the equal character (=). + 

      +	root# net groupmap add ntgroup=“Domain Admins” UNIXgroup=domadm
+

      +

      + + The quotes around “Domain Admins” are necessary due to the space in the group name. + Also make sure to leave no white-space surrounding the equal character (=).

    - Now joe, john and mary are domain administrators! -

    - It is possible to map any arbitrary UNIX group to any Windows NT4 / 200x group as well as - making any UNIX group a Windows domain group. For example, if you wanted to include a - UNIX group (e.g. acct) in a ACL on a local file or printer on a domain member machine, + Now joe, john and mary are domain administrators. +

    + + It is possible to map any arbitrary UNIX group to any Windows NT4/200x group as well as + making any UNIX group a Windows domain group. For example, if you wanted to include a + UNIX group (e.g., acct) in an ACL on a local file or printer on a Domain Member machine, you would flag that group as a domain group by running the following on the Samba PDC: 

    -root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct
+root# net groupmap add rid=1000 ntgroup="Accounting" UNIXgroup=acct

    - Be aware that the RID parameter is a unsigned 32 bit integer that should - normally start at 1000. However, this rid must not overlap with any RID assigned - to a user. Verifying this is done differently depending on the passdb backend - you are using. Future versions of the tools may perform the verification automatically, + Be aware that the RID parameter is a unsigned 32-bit integer that should + normally start at 1000. However, this RID must not overlap with any RID assigned + to a user. Verification for this is done differently depending on the passdb backend + you are using. Future versions of the tools may perform the verification automatically, but for now the burden is on you. -

    Example Configuration

    - You can list the various groups in the mapping database by executing - net groupmap list. Here is an example: -

    +

    Default Users, Groups and Relative Identifiers

    + + + When first installed, Microsoft Windows NT4/200x/XP are preconfigured with certain User, Group, and + Alias entities. Each has a well-known Relative Identifier (RID). These must be preserved for continued + integrity of operation. Samba must be provisioned with certain essential Domain Groups that require + the appropriate RID value. When Samba-3 is configured to use tdbsam the essential + Domain Groups are automatically created. It is the LDAP administrators' responsibility to create + (provision) the default NT Groups. +

    + Each essential Domain Group must be assigned its respective well-kown RID. The default Users, Groups, + Aliases, and RIDs are shown in . +

    Note

    + When the passdb backend uses LDAP (ldapsam) it is the + admininstrators' responsibility to create the essential Domain Groups, and to assign each its default RID. +

    + It is permissible to create any Domain Group that may be necessary, just make certain that the essential + Domain Groups (well known) have been created and assigned its default RID. Other groups you create may + be assigned any arbitrary RID you care to use. +

    + Be sure to map each Domain Group to a UNIX system group. That is the only way to ensure that the group + will be available for use as an NT Domain Group. +

    +

    Table 12.1. Well-Known User Default RIDs

    Well-Known EntityRIDTypeEssential
    Domain Administrator500UserNo
    Domain Guest501UserNo
    Domain KRBTGT502UserNo
    Domain Admins512GroupYes
    Domain Users513GroupYes
    Domain Guests514GroupYes
    Domain Computers515GroupNo
    Domain Controllers516GroupNo
    Domain Certificate Admins517GroupNo
    Domain Schema Admins518GroupNo
    Domain Enterprise Admins519GroupNo
    Domain Policy Admins520GroupNo
    Builtin Admins544AliasNo
    Builtin users545AliasNo
    Builtin Guests546AliasNo
    Builtin Power Users547AliasNo
    Builtin Account Operators548AliasNo
    Builtin System Operators549AliasNo
    Builtin Print Operators550AliasNo
    Builtin Backup Operators551AliasNo
    Builtin Replicator552AliasNo
    Builtin RAS Servers553AliasNo

    +

    Example Configuration

    + You can list the various groups in the mapping database by executing + net groupmap list. Here is an example: + 

     root#  net groupmap list
-System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin
 Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
 Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
 Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest

    For complete details on net groupmap, refer to the net(8) man page. -

    Configuration Scripts

    +

    Configuration Scripts

    Everyone needs tools. Some of us like to create our own, others prefer to use canned tools - (ie: prepared by someone else for general use). -

    Sample smb.conf add group script

    - A script to create complying group names for use by the Samba group interfaces: -

    -

    Example 12.1. smbgrpadd.sh

    +	(i.e., prepared by someone else for general use). 
+	
    Sample smb.conf Add Group Script
    
+		A script to create complying group names for use by the Samba group interfaces
+		is provided in .
+		
    
+
    Example 12.1. smbgrpadd.sh
     
 #!/bin/bash
 
@@ -3956,112 +4251,125 @@ echo $thegid
 exit 0
 
    
 
    
-		The smb.conf entry for the above script would look like:
-		
    add group script = /path_to_tool/smbgrpadd.sh %g
    
-		
    Script to configure Group Mapping
    
+		The smb.conf entry for the above script would be something like that in .
+
    Example 12.2. Configuration of smb.conf for the add group script.
     
    [global]
    ...
    add group script = /path_to_tool/smbgrpadd.sh %g
    ...
    
+		
    Script to Configure Group Mapping
    
 		In our example we have created a UNIX/Linux group called ntadmin.
-		Our script will create the additional groups Orks, Elves, Gnomes:
+		Our script will create the additional groups Orks, Elves, and Gnomes.
+		It is a good idea to save this shell script for later re-use just in case you ever need to rebuild your mapping database.
+		For the sake of concenience we elect to save this script as a file called initGroups.sh.
+		This script is given in .
 	
    
-
    +
+
    Example 12.3. Script to Set Group Mapping
     #!/bin/bash
 
 net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin
 net groupmap modify ntgroup="Domain Users" unixgroup=users
 net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
-net groupmap modify ntgroup="Administrators" unixgroup=root
-net groupmap modify ntgroup="Users" unixgroup=users
-net groupmap modify ntgroup="Guests" unixgroup=nobody
-net groupmap modify ntgroup="System Operators" unixgroup=sys
-net groupmap modify ntgroup="Account Operators" unixgroup=root
-net groupmap modify ntgroup="Backup Operators" unixgroup=bin
-net groupmap modify ntgroup="Print Operators" unixgroup=lp
-net groupmap modify ntgroup="Replicators" unixgroup=daemon
-net groupmap modify ntgroup="Power Users" unixgroup=sys
 
 groupadd Orks
 groupadd Elves
 groupadd Gnomes
 
-net groupmap add ntgroup="Orks"       unixgroup=Orks         type=d
-net groupmap add ntgroup="Elves"      unixgroup=Elves        type=d
-net groupmap add ntgroup="Gnomes"     unixgroup=Gnomes       type=d
-
    
+net groupmap add ntgroup="Orks"   unixgroup=Orks   type=d
+net groupmap add ntgroup="Elves"  unixgroup=Elves  type=d
+net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d
+
    
 
    
 	Of course it is expected that the administrator will modify this to suit local needs.
 	For information regarding the use of the net groupmap tool please
 	refer to the man page.
-

    Common Errors

    +

    Common Errors

    At this time there are many little surprises for the unwary administrator. In a real sense it is imperative that every step of automated control scripts must be carefully tested manually before putting them into active service. -

    Adding Groups Fails

    +

    Adding Groups Fails

    This is a common problem when the groupadd is called directly - by the Samba interface script for the add group script in + by the Samba interface script for the add group script in the smb.conf file.

    The most common cause of failure is an attempt to add an MS Windows group account that has either an upper case character and/or a space character in it.

    - There are three possible work-arounds. Firstly, use only group names that comply + There are three possible work-arounds. First, use only group names that comply with the limitations of the UNIX/Linux groupadd system tool. - The second involves use of the script mentioned earlier in this chapter, and the - third option is to manually create a UNIX/Linux group account that can substitute + Second, it involves the use of the script mentioned earlier in this chapter, and + third is the option is to manually create a UNIX/Linux group account that can substitute for the MS Windows group name, then use the procedure listed above to map that group to the MS Windows group. -

    Adding MS Windows Groups to MS Windows Groups Fails

    - Samba-3 does NOT support nested groups from the MS Windows control environment. -

    Adding Domain Users to the Power Users group

    “ +

    Adding MS Windows Groups to MS Windows Groups Fails

    + Samba-3 does not support nested groups from the MS Windows control environment. +

    Adding Domain Users to the Power Users Group

    “ What must I do to add Domain Users to the Power Users group? - ”

    - The Power Users group is a group that is local to each Windows - 200x / XP Professional workstation. You can not add the Domain Users group to the Power Users - group automatically, this must be done on each workstation by logging in as the local workstation - administrator and then using click on Start / Control Panel / Users and Passwords - now click on the 'Advanced' tab, then on the 'Advanced' Button. -

    - Now click on 'Groups', then double click on 'Power Users'. This will launch the panel to add users - or groups to the local machine 'Power Uses' group. Click on the 'Add' button, select the domain - from which the 'Domain Users' group is to be added, double click on the 'Domain Users' group, then - click on the 'Ok' button. Note: If a logon box is presented during this process please remember to - enter the connect as DOMAIN\UserName. ie: For the domain MIDEARTH and the user 'root' enter - MIDEARTH\root. -

    Chapter 13. File, Directory and Share Access Controls

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    drawing
    The Samba Team

    May 10, 2003

    Table of Contents

    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute mapping
    Common Errors
    Users can not write to a public share
    I have set force user but Samba still makes root the owner of all the files I touch!
    MS Word with Samba changes owner of file

    + ”

    + The Power Users group is a group that is local to each Windows 200x/XP Professional workstation. + You cannot add the Domain Users group to the Power Users group automatically, it must be done on + each workstation by logging in as the local workstation administrator and + then using the following procedure: +

    1. + Click Start -> Control Panel -> Users and Passwords. +

    2. + Click the Advanced tab. +

    3. + Click the Advanced button. +

    4. + Click Groups. +

    5. + Double click Power Users. This will launch the panel to add users or groups + to the local machine Power Uses group. +

    6. + Click the Add button. +

    7. + Select the domain from which the Domain Users group is to be added. +

    8. + Double click the Domain Users group. +

    9. + Click the Ok button. If a logon box is presented during this process + please remember to enter the connect as DOMAIN\UserName. i.e., For the + domain MIDEARTH and the user root enter + MIDEARTH\root. +

    Chapter 13. File, Directory and Share Access Controls

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    drawing
    The Samba Team

    May 10, 2003

    Table of Contents

    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group-Based Controls
    File and Directory Permissions-Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX Permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing File Ownership
    Viewing File or Directory Permissions
    Modifying File or Directory Permissions
    Interaction with the Standard Samba create mask Parameters
    Interaction with the Standard Samba File Attribute Mapping
    Common Errors
    Users Cannot Write to a Public Share
    File Operations Done as root with force user Set
    MS Word with Samba Changes Owner of File

    + Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of resources shared via Samba do not behave in the manner they might expect. MS Windows network administrators are often confused regarding network access controls and how to -provide users with the access they need while protecting resources from unauthorised access. +provide users with the access they need while protecting resources from unauthorized access.

    Many UNIX administrators are unfamiliar with the MS Windows environment and in particular have difficulty in visualizing what the MS Windows user wishes to achieve in attempts to set file and directory access permissions.

    The problem lies in the differences in how file and directory permissions and controls work -between the two environments. This difference is one that Samba can not completely hide, even +between the two environments. This difference is one that Samba cannot completely hide, even though it does try to bridge the chasm to a degree. -

    +

    + + + POSIX Access Control List technology has been available (along with Extended Attributes) for UNIX for many years, yet there is little evidence today of any significant use. This explains to some extent the slow adoption of ACLs into commercial Linux products. MS Windows -administrators are astounded at this given that ACLs were a foundational capability of the now -decade old MS Windows NT operating system. +administrators are astounded at this, given that ACLs were a foundational capability of the now +decade-old MS Windows NT operating system.

    The purpose of this chapter is to present each of the points of control that are possible with Samba-3 in the hope that this will help the network administrator to find the optimum method for delivering the best environment for MS Windows desktop users.

    This is an opportune point to mention that Samba was created to provide a means of interoperability -and interchange of data between differing operating environments. Samba has no intent change +and interchange of data between differing operating environments. Samba has no intent to change UNIX/Linux into a platform like MS Windows. Instead the purpose was and is to provide a sufficient -level of exchange of data between the two environments. What is available today extends well +level of exchange of data between the two environments. What is available today extends well beyond early plans and expectations, yet the gap continues to shrink. -

    Features and Benefits

    +

    Features and Benefits

    Samba offers a lot of flexibility in file system access management. These are the key access control facilities present in Samba today:

    Samba Access Control Facilities

    • + UNIX File and Directory Permissions

      - Samba honours and implements UNIX file system access controls. Users + Samba honors and implements UNIX file system access controls. Users who access a Samba server will do so as a particular MS Windows user. This information is passed to the Samba server as part of the logon or connection setup process. Samba uses this user identity to validate @@ -4071,116 +4379,132 @@ beyond early plans and expectations, yet the gap continues to shrink.

    • Samba Share Definitions

      - In configuring share settings and controls in the smb.conf file - the network administrator can exercise over-rides to native file - system permissions and behaviours. This can be handy and convenient - to affect behaviour that is more like what MS Windows NT users expect + In configuring share settings and controls in the smb.conf file, + the network administrator can exercise overrides to native file + system permissions and behaviors. This can be handy and convenient + to effect behavior that is more like what MS Windows NT users expect but it is seldom the best way to achieve this. The basic options and techniques are described herein.

    • Samba Share ACLs +

      Just like it is possible in MS Windows NT to set ACLs on shares themselves, so it is possible to do this in Samba. - Very few people make use of this facility, yet it remains on of the + Few people make use of this facility, yet it remains on of the easiest ways to affect access controls (restrictions) and can often do so with minimum invasiveness compared with other methods.

    • + + MS Windows ACLs through UNIX POSIX ACLs

      - The use of POSIX ACLs on UNIX/Linux is possible ONLY if the underlying + The use of POSIX ACLs on UNIX/Linux is possible only if the underlying operating system supports them. If not, then this option will not be available to you. Current UNIX technology platforms have native support - for POSIX ACLs. There are patches for the Linux kernel that provide - this also. Sadly, few Linux platforms ship today with native ACLs and + for POSIX ACLs. There are patches for the Linux kernel that also provide + this. Sadly, few Linux platforms ship today with native ACLs and Extended Attributes enabled. This chapter has pertinent information for users of platforms that support them. -

    File System Access Controls

    -Perhaps the most important recognition to be made is the simple fact that MS Windows NT4 / 200x / XP +

    File System Access Controls

    +Perhaps the most important recognition to be made is the simple fact that MS Windows NT4/200x/XP implement a totally divergent file system technology from what is provided in the UNIX operating system -environment. Firstly we should consider what the most significant differences are, then we shall look +environment. First we consider what the most significant differences are, then we look at how Samba helps to bridge the differences. -

    MS Windows NTFS Comparison with UNIX File Systems

    +

    MS Windows NTFS Comparison with UNIX File Systems

    + + + + + Samba operates on top of the UNIX file system. This means it is subject to UNIX file system conventions and permissions. It also means that if the MS Windows networking environment requires file system - behaviour that differs from unix file system behaviour then somehow Samba is responsible for emulating + behavior that differs from UNIX file system behavior then somehow Samba is responsible for emulating that in a transparent and consistent manner.

    - It is good news that Samba does this to a very large extent and on top of that provides a high degree - of optional configuration to over-ride the default behaviour. We will look at some of these over-rides, - but for the greater part we will stay within the bounds of default behaviour. Those wishing to explore - to depths of control ability should review the smb.conf man page. -

    File System Feature Comparison

    Name Space

    - MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, UNIX file names - may be 1023 characters long. In MS Windows file extensions indicate particular file types, + It is good news that Samba does this to a large extent and on top of that provides a high degree + of optional configuration to override the default behavior. We look at some of these over-rides, + but for the greater part we will stay within the bounds of default behavior. Those wishing to explore + the depths of control ability should review the smb.conf man page. +

    The following compares file system features for UNIX with those of Microsoft Windows NT/200x: + + +

    Name Space

    + MS Windows NT4/200x/XP files names may be up to 254 characters long, and UNIX file names + may be 1023 characters long. In MS Windows, file extensions indicate particular file types, in UNIX this is not so rigorously observed as all names are considered arbitrary.

    - What MS Windows calls a Folder, UNIX calls a directory. + What MS Windows calls a folder, UNIX calls a directory.

    Case Sensitivity

    - - MS Windows file names are generally upper case if made up of 8.3 (ie: 8 character file name - and 3 character extension. If longer than 8.3 file names are Case Preserving, and Case - Insensitive. + + + MS Windows file names are generally upper case if made up of 8.3 (8 character file name + and 3 character extension. File names that are longer than 8.3 are case preserving and case + insensitive.

    UNIX file and directory names are case sensitive and case preserving. Samba implements the - MS Windows file name behaviour, but it does so as a user application. The UNIX file system + MS Windows file name behavior, but it does so as a user application. The UNIX file system provides no mechanism to perform case insensitive file name lookups. MS Windows does this by default. This means that Samba has to carry the processing overhead to provide features - that are NOT native to the UNIX operating system environment. + that are not native to the UNIX operating system environment.

    - Consider the following, all are unique UNIX names but one single MS Windows file name: - + Consider the following. All are unique UNIX names but one single MS Windows file name: + 

     				MYFILE.TXT
 				MyFile.txt
 				myfile.txt
-		
-		So clearly, In an MS Windows file name space these three files CAN NOT co-exist! But in UNIX 
-		they can. So what should Samba do if all three are present? Answer, the one that is lexically
-		first will be accessible to MS Windows users, the others are invisible and unaccessible - any
+

    + So clearly, in an MS Windows file name space these three files cannot co-exist, but in UNIX + they can. +

    + So what should Samba do if all three are present? That which is lexically first will be + accessible to MS Windows users, the others are invisible and unaccessible any other solution would be suicidal.

    Directory Separators

    - MS Windows and DOS uses the back-slash '\' as a directory delimiter, UNIX uses the forward-slash '/' - as it's directory delimiter. This is transparently handled by Samba. + + MS Windows and DOS uses the backslash \ as a directory delimiter, and UNIX uses + the forward-slash / as its directory delimiter. This is handled transparently by Samba.

    Drive Identification

    + MS Windows products support a notion of drive letters, like C: to represent - disk partitions. UNIX has NO concept if separate identifiers for file partitions since each - such file system is mounted to become part of the over-all directory tree. - The UNIX directory tree begins at '/', just like the root of a DOS drive is specified like - C:\. + disk partitions. UNIX has no concept of separate identifiers for file partitions, each + such file system is mounted to become part of the overall directory tree. + The UNIX directory tree begins at / just like the root of a DOS drive is specified as + C:\.

    File Naming Conventions

    - MS Windows generally never experiences file names that begin with a '.', while in UNIX these - are commonly found in a user's home directory. Files that begin with a '.' are typically - either start up files for various UNIX applications, or they may be files that contain + + MS Windows generally never experiences file names that begin with a dot (.) while in UNIX these + are commonly found in a user's home directory. Files that begin with a dot (.) are typically + either start-up files for various UNIX applications, or they may be files that contain start-up configuration data.

    Links and Short-Cuts

    - - - - - MS Windows make use of "links and Short-Cuts" that are actually special types of files that will + + + + MS Windows make use of “links and short-cuts” that are actually special types of files that will redirect an attempt to execute the file to the real location of the file. UNIX knows of file and directory links, but they are entirely different from what MS Windows users are used to.

    - Symbolic links are files in UNIX that contain the actual location of the data (file OR directory). An + Symbolic links are files in UNIX that contain the actual location of the data (file or directory). An operation (like read or write) will operate directly on the file referenced. Symbolic links are also - referred to as 'soft links'. A hard link is something that MS Windows is NOT familiar with. It allows + referred to as “soft links.” A hard link is something that MS Windows is not familiar with. It allows one physical file to be known simultaneously by more than one file name.

    There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort in the process of becoming familiar with UNIX/Linux. These are best left for a text that is dedicated to the - purpose of UNIX/Linux training/education. -

    Managing Directories

    - There are three basic operations for managing directories, create, delete, rename. -

    Table 13.1. Managing directories with unix and windows

    ActionMS Windows CommandUNIX Command
    createmd foldermkdir folder
    deleterd folderrmdir folder
    renamerename oldname newnamemv oldname newname

    -

    File and Directory Access Control

    + purpose of UNIX/Linux training and education. +

    Managing Directories

    + There are three basic operations for managing directories: create, delete, rename. +

    Table 13.1. Managing Directories with UNIX and Windows

    ActionMS Windows CommandUNIX Command
    createmd foldermkdir folder
    deleterd folderrmdir folder
    renamerename oldname newnamemv oldname newname

    +

    File and Directory Access Control

    + The network administrator is strongly advised to read foundational training manuals and reference materials regarding file and directory permissions maintenance. Much can be achieved with the basic UNIX permissions without having to resort to more complex facilities like POSIX Access Control Lists (ACLs) or Extended Attributes (EAs).

    - UNIX/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. - A UNIX file listing looks as follows:- - + UNIX/Linux file and directory access permissions involves setting three primary sets of data and one control set. + A UNIX file listing looks as follows: 

     $ ls -la
 total 632
@@ -4201,393 +4525,381 @@ drwsrwsrwx    2 maryo   gnomes       48 2003-05-12 22:29 muchado08
 	
    
 	The columns above represent (from left to right): permissions, number of hard links to file, owner, group, size (bytes), access date, access time, file name.
 	
    
-		An overview of the permissions field can be found in the image below.
-	
    Figure 13.1. Overview of unix permissions field
    Overview of unix permissions field
    
-	Any bit flag may be unset. An unset bit flag is the equivalent of 'Can NOT' and is represented as a '-' character.
+		An overview of the permissions field can be found in .
+	
    Figure 13.1. Overview of UNIX permissions field.
    Overview of UNIX permissions field.
    
+	Any bit flag may be unset. An unset bit flag is the equivalent of “cannot” and is represented as a “-” character.
 
-	
    Example 13.1. Example File
    +	
    Example 13.1. Example File
     		-rwxr-x---   Means: The owner (user) can read, write, execute
 		                    the group can read and execute
-		                    everyone else can NOT do anything with it
+		                    everyone else cannot do anything with it.
 		
    
 
 	
    
 	Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = UNIX Domain Socket.
 	
    
-	The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x),
+	The letters rwxXst set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x),
 	execute  only  if  the  file  is a directory or already has execute permission for some user (X), set user or group ID on execution (s),
 	sticky (t).
 	
    
 	When the sticky bit is set on a directory, files in that directory may be unlinked (deleted) or renamed only by root or their owner. 
 	Without the sticky  bit, anyone able to write to the directory can delete or rename files. The sticky bit is commonly found on
-	directories, such as /tmp, that are world-writable.
+	directories, such as /tmp, that are world-writable.
 	
    
 	When the set user or group ID bit (s) is set on a directory, then all files created within it will be owned by the user and/or
-	group whose 'set user or group' bit is set. This can be very helpful in setting up directories that for which it is desired that
+	group whose `set user or group' bit is set. This can be helpful in setting up directories for which it is desired that
 	all users who are in a group should be able to write to and read from a file, particularly when it is undesirable for that file
-	to be exclusively owned by a user who's primary group is not the group that all such users belong to.
+	to be exclusively owned by a user whose primary group is not the group that all such users belong to.
 	
    
 	When a directory is set drw-r----- this means that the owner can read and create (write) files in it, but because
-	the (x) execute flags are not set files can not be listed (seen) in the directory by anyone. The group can read files in the
-	directory but can NOT create new files. NOTE: If files in the directory are set to be readable and writable for the group, then
+	the (x) execute flags are not set, files cannot be listed (seen) in the directory by anyone. The group can read files in the
+	directory but cannot create new files. If files in the directory are set to be readable and writable for the group, then
 	group members will be able to write to (or delete) them.
-

    Share Definition Access Controls

    -The following parameters in the smb.conf file sections that define a share control or affect access controls. -Before using any of the following options please refer to the man page for smb.conf. -

    User and Group Based Controls

    - User and group based controls can prove very useful. In some situations it is distinctly desirable to affect all - file system operations as if a single user is doing this, the use of the force user and - force group behaviour will achieve this. In other situations it may be necessary to affect a - paranoia level of control to ensure that only particular authorised persons will be able to access a share or - it's contents, here the use of the valid users or the invalid users may - be most useful. +

    Share Definition Access Controls

    + +The following parameters in the smb.conf file sections define a share control or effect access controls. +Before using any of the following options, please refer to the man page for smb.conf. +

    User and Group-Based Controls

    + User and group-based controls can prove quite useful. In some situations it is distinctly desirable to affect all + file system operations as if a single user were doing so. The use of the force user and + force group behavior will achieve this. In other situations it may be necessary to effect a + paranoia level of control to ensure that only particular authorized persons will be able to access a share or + its contents. Here the use of the valid users or the + invalid users may be most useful.

    As always, it is highly advisable to use the least difficult to maintain and the least ambiguous method for - controlling access. Remember, that when you leave the scene someone else will need to provide assistance and - if that person finds too great a mess, or if they do not understand what you have done then there is risk of + controlling access. Remember, when you leave the scene someone else will need to provide assistance and + if he finds too great a mess or does not understand what you have done, there is risk of Samba being removed and an alternative solution being adopted. -

    Table 13.2. User and Group Based Controls

    Control ParameterDescription - Action - Notes
    admin users

    +

    + enumerates these controls. +

    Table 13.2. User and Group Based Controls

    Control ParameterDescription - Action - Notes
    admin users

    List of users who will be granted administrative privileges on the share. - They will do all file operations as the super-user (root). + They will do all file operations as the super-user (root). Any user in this list will be able to do anything they like on the share, irrespective of file permissions. -

    force group

    +

    force group

    Specifies a UNIX group name that will be assigned as the default primary group for all users connecting to this service. -

    force user

    +

    force user

    Specifies a UNIX user name that will be assigned as the default user for all users connecting to this service. This is useful for sharing files. Incorrect use can cause security problems. -

    guest ok

    +

    guest ok

    If this parameter is set for a service, then no password is required to connect to the service. Privileges will be those of the guest account. -

    invalid users

    +

    invalid users

    List of users that should not be allowed to login to this service. -

    only user

    +

    only user

    Controls whether connections with usernames not in the user list will be allowed. -

    read list

    +

    read list

    List of users that are given read-only access to a service. Users in this list will not be given write access, no matter what the read only option is set to. -

    username

    - Refer to the smb.conf man page for more information - this is a complex and potentially misused parameter. -

    valid users

    +

    username

    + Refer to the smb.conf man page for more information -- this is a complex and potentially misused parameter. +

    valid users

    List of users that should be allowed to login to this service. -

    write list

    +

    write list

    List of users that are given read-write access to a service. -

    File and Directory Permissions Based Controls

    - The following file and directory permission based controls, if misused, can result in considerable difficulty to - diagnose the cause of mis-configuration. Use them sparingly and carefully. By gradually introducing each one by one - undesirable side-effects may be detected. In the event of a problem, always comment all of them out and then gradually - re-introduce them in a controlled fashion. -

    Table 13.3. File and Directory Permission Based Controls

    Control ParameterDescription - Action - Notes
    create mask

    +

    File and Directory Permissions-Based Controls

    + The following file and directory permission-based controls, if misused, can result in considerable difficulty to + diagnose causes of misconfiguration. Use them sparingly and carefully. By gradually introducing each one by one, + undesirable side effects may be detected. In the event of a problem, always comment all of them out and then gradually + reintroduce them in a controlled way. +

    + Refer to for information regarding the parameters that may be used to affect file and + directory permission-based access controls. +

    Table 13.3. File and Directory Permission Based Controls

    Control ParameterDescription - Action - Notes
    create mask

    Refer to the smb.conf man page. -

    directory mask

    +

    directory mask

    The octal modes used when converting DOS modes to UNIX modes when creating UNIX directories. See also: directory security mask. -

    dos filemode

    +

    dos filemode

    Enabling this parameter allows a user who has write access to the file to modify the permissions on it. -

    force create mode

    +

    force create mode

    This parameter specifies a set of UNIX mode bit permissions that will always be set on a file created by Samba. -

    force directory mode

    +

    force directory mode

    This parameter specifies a set of UNIX mode bit permissions that will always be set on a directory created by Samba. -

    force directory security mode

    - Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory -

    force security mode

    +

    force directory security mode

    + Controls UNIX permission bits modified when a Windows NT client is manipulating UNIX permissions on a directory. +

    force security mode

    Controls UNIX permission bits modified when a Windows NT client manipulates UNIX permissions. -

    hide unreadable

    +

    hide unreadable

    Prevents clients from seeing the existence of files that cannot be read. -

    hide unwriteable files

    +

    hide unwriteable files

    Prevents clients from seeing the existence of files that cannot be written to. Unwriteable directories are shown as usual. -

    nt acl support

    +

    nt acl support

    This parameter controls whether smbd will attempt to map UNIX permissions into Windows NT access control lists. -

    security mask

    +

    security mask

    Controls UNIX permission bits modified when a Windows NT client is manipulating the UNIX permissions on a file. -

    Miscellaneous Controls

    +

    Miscellaneous Controls

    The following are documented because of the prevalence of administrators creating inadvertent barriers to file - access by not understanding the full implications of smb.conf file settings. -

    Table 13.4. Other Controls

    Control ParameterDescription - Action - Notes
    case sensitive, default case, short preserve case

    + access by not understanding the full implications of smb.conf file settings. See . +

    Table 13.4. Other Controls

    Control ParameterDescription - Action - Notes
    case sensitive, default case, short preserve case

    This means that all file name lookup will be done in a case sensitive manner. - Files will be created with the precise filename Samba received from the MS Windows client. -

    csc policy

    + Files will be created with the precise file name Samba received from the MS Windows client. +

    csc policy

    Client Side Caching Policy - parallels MS Windows client side file caching capabilities. -

    dont descend

    - Allows to specify a comma-delimited list of directories that the server should always show as empty. -

    dos filetime resolution

    +

    dont descend

    + Allows specifying a comma-delimited list of directories that the server should always show as empty. +

    dos filetime resolution

    This option is mainly used as a compatibility option for Visual C++ when used against Samba shares. -

    dos filetimes

    - DOS and Windows allows users to change file time stamps if they can write to the file. POSIX semantics prevent this. - This options allows DOS and Windows behaviour. -

    fake oplocks

    +

    dos filetimes

    + DOS and Windows allow users to change file time stamps if they can write to the file. POSIX semantics prevent this. + This option allows DOS and Windows behavior. +

    fake oplocks

    Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an - oplock then the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. -

    hide dot files, hide files, veto files

    + oplock, the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. +

    hide dot files, hide files, veto files

    Note: MS Windows Explorer allows over-ride of files marked as hidden so they will still be visible. -

    read only

    +

    read only

    If this parameter is yes, then users of a service may not create or modify files in the service's directory. -

    veto files

    +

    veto files

    List of files and directories that are neither visible nor accessible. -

    Access Controls on Shares

    +

    Access Controls on Shares

    + This section deals with how to configure Samba per share access control restrictions. By default, Samba sets no restrictions on the share itself. Restrictions on the share itself - can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can + can be set on MS Windows NT4/200x/XP shares. This can be an effective way to limit who can connect to a share. In the absence of specific restrictions the default setting is to allow - the global user Everyone Full Control (ie: Full control, Change and Read). + the global user Everyone - Full Control (full control, change and read).

    - At this time Samba does NOT provide a tool for configuring access control setting on the Share + At this time Samba does not provide a tool for configuring access control setting on the share itself. Samba does have the capacity to store and act on access control settings, but the only way to create those settings is to use either the NT4 Server Manager or the Windows 200x MMC for Computer Management.

    Samba stores the per share access control settings in a file called share_info.tdb. - The location of this file on your system will depend on how samba was compiled. The default location + The location of this file on your system will depend on how Samba was compiled. The default location for Samba's tdb files is under /usr/local/samba/var. If the tdbdump utility has been compiled and installed on your system, then you can examine the contents of this file - by: tdbdump share_info.tdb. -

    Share Permissions Management

    + by executing: tdbdump share_info.tdb in the directory containing the tdb files. +

    Share Permissions Management

    The best tool for the task is platform dependant. Choose the best tool for your environment. -

    Windows NT4 Workstation/Server

    +

    Windows NT4 Workstation/Server

    The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. - You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below. + You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft see details below.

    Procedure 13.1. Instructions

    1. - Launch the NT4 Server Manager, click on the Samba server you want to administer, then from the menu - select Computer, then click on the Shared Directories entry. + Launch the NT4 Server Manager, click on the Samba server you want to administer. From the menu + select Computer, then click on Shared Directories.

    2. - Now click on the share that you wish to manage, then click on the Properties tab, next click on + Click on the share that you wish to manage, then click the Properties tab. then click the Permissions tab. Now you can add or change access control settings as you wish. -

    Windows 200x/XP

    +

    Windows 200x/XP

    On MS Windows NT4/200x/XP system access control lists on the share itself are set using native - tools, usually from file manager. For example, in Windows 200x: right click on the shared folder, + tools, usually from File Manager. For example, in Windows 200x, right click on the shared folder, then select Sharing, then click on Permissions. The default - Windows NT4/200x permission allows Everyone Full Control on the Share. + Windows NT4/200x permission allows “Everyone” full control on the share.

    - MS Windows 200x and later all comes with a tool called the Computer Management snap-in for the - Microsoft Management Console (MMC). This tool is located by clicking on Control Panel -> - Administrative Tools -> Computer Management. + MS Windows 200x and later versions come with a tool called the Computer Management snap-in for the + Microsoft Management Console (MMC). This tool is located by clicking on Control Panel -> + Administrative Tools -> Computer Management.

    Procedure 13.2. Instructions

    1. - After launching the MMC with the Computer Management snap-in, click on the menu item Action, - select Connect to another computer. If you are not logged onto a domain you will be prompted - to enter a domain login user identifier and a password. This will authenticate you to the domain. - If you where already logged in with administrative privilege this step is not offered. + After launching the MMC with the Computer Management snap-in, click the menu item Action, + and select Connect to another computer. If you are not logged onto a domain you will be prompted + to enter a domain login user identifier and a password. This will authenticate you to the domain. + If you are already logged in with administrative privilege, this step is not offered.

    2. - If the Samba server is not shown in the Select Computer box, then type in the name of the target - Samba server in the field Name:. Now click on the [+] next to + If the Samba server is not shown in the Select Computer box, type in the name of the target + Samba server in the field Name:. Now click the on [+] next to System Tools, then on the [+] next to Shared Folders in the left panel.

    3. - Now in the right panel, double-click on the share you wish to set access control permissions on. - Then click on the tab Share Permissions. It is now possible to add access control entities - to the shared folder. Do NOT forget to set what type of access (full control, change, read) you + In the right panel, double-click on the share on which you wish to set access control permissions. + Then click the tab Share Permissions. It is now possible to add access control entities + to the shared folder. Remember to set what type of access (full control, change, read) you wish to assign for each entry.

    Warning

    - Be careful. If you take away all permissions from the Everyone user without removing this user - then effectively no user will be able to access the share. This is a result of what is known as - ACL precedence. ie: Everyone with no access means that MaryK who is part of the group - Everyone will have no access even if this user is given explicit full control access. -

    MS Windows Access Control Lists and UNIX Interoperability

    Managing UNIX permissions Using NT Security Dialogs

    + Be careful. If you take away all permissions from the Everyone user without removing this user, + effectively no user will be able to access the share. This is a result of what is known as + ACL precedence. Everyone with no access means that MaryK who is part of the group + Everyone will have no access even if she is given explicit full control access. +

    MS Windows Access Control Lists and UNIX Interoperability

    Managing UNIX Permissions Using NT Security Dialogs

    + Windows NT clients can use their native security settings dialog box to view and modify the underlying UNIX permissions.

    - Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and + This ability is careful not to compromise the security of the UNIX host on which Samba is running, and still obeys all the file permission rules that a Samba administrator can set.

    - Samba does not attempt to go beyond POSIX ACLs, so that the various finer-grained access control - options provided in Windows are actually ignore. + Samba does not attempt to go beyond POSIX ACLs, so the various finer-grained access control + options provided in Windows are actually ignored.

    Note

    All access to UNIX/Linux system files via Samba is controlled by the operating system file access controls. - When trying to figure out file access problems it is vitally important to find the identity of the Windows + When trying to figure out file access problems, it is vitally important to find the identity of the Windows user as it is presented by Samba at the point of file access. This can best be determined from the Samba log files. -

    Viewing File Security on a Samba Share

    - From an NT4/2000/XP client, single-click with the right mouse button on any file or directory in a Samba - mounted drive letter or UNC path. When the menu pops-up, click on the Properties - entry at the bottom of the menu. This brings up the file properties dialog box. Click on the tab - Security and you will see three buttons, Permissions, +

    Viewing File Security on a Samba Share

    + From an NT4/2000/XP client, right click on any file or directory in a Samba-mounted drive letter + or UNC path. When the menu pops up, click on the Properties entry at the bottom + of the menu. This brings up the file Properties dialog box. Click on the + Security tab and you will see three buttons: Permissions, Auditing, and Ownership. The Auditing - button will cause either an error message A requested privilege is not held by the client + button will cause either an error message `A requested privilege is not held by the client' to appear if the user is not the NT Administrator, or a dialog which is intended to allow an Administrator to add auditing requirements to a file if the user is logged on as the NT Administrator. This dialog is non-functional with a Samba share at this time, as the only useful button, the Add - button will not currently allow a list of users to be seen. -

    Viewing file ownership

    + button, will not currently allow a list of users to be seen. +

    Viewing File Ownership

    Clicking on the Ownership button brings up a dialog box telling you who owns - the given file. The owner name will be of the form: + the given file. The owner name will be displayed like this:

    - "SERVER\user (Long name)" + “SERVER\user (Long name)”

    - Where SERVER is the NetBIOS name of the Samba server, user + SERVER is the NetBIOS name of the Samba server, user is the user name of the UNIX user who owns the file, and (Long name) is the descriptive string identifying the user (normally found in the GECOS field of the UNIX password database). Click on the Close button to remove this dialog.

    - If the parameter nt acl support is set to false - then the file owner will be shown as the NT user "Everyone". + If the parameter nt acl support is set to false, + the file owner will be shown as the NT user Everyone.

    The Take Ownership button will not allow you to change the ownership of this file to - yourself (clicking on it will display a dialog box complaining that the user you are currently logged onto + yourself (clicking it will display a dialog box complaining that the user you are currently logged onto the NT client cannot be found). The reason for this is that changing the ownership of a file is a privileged operation in UNIX, available only to the root user. As clicking on this button causes - NT to attempt to change the ownership of a file to the current user logged into the NT client this will + NT to attempt to change the ownership of a file to the current user logged into the NT clienti, this will not work with Samba at this time.

    - There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected + There is an NT chown command that will work with Samba and allow a user with Administrator privilege connected to a Samba server as root to change the ownership of files on both a local NTFS filesystem or remote mounted NTFS or Samba drive. This is available as part of the Seclib NT security library written - by Jeremy Allison of the Samba-Team, available from the main Samba FTP site.

    Viewing File or Directory Permissions

    + by Jeremy Allison of the Samba Team, and is available from the main Samba FTP site.

    Viewing File or Directory Permissions

    The third button is the Permissions button. Clicking on this brings up a dialog box - that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed in the form: -

    "SERVER\ + that shows both the permissions and the UNIX owner of the file or directory. The owner is displayed like this: +

    SERVER\ user - (Long name)"

    Where SERVER is the NetBIOS name of the Samba server, + (Long name)

    Where SERVER is the NetBIOS name of the Samba server, user is the user name of the UNIX user who owns the file, and (Long name) is the descriptive string identifying the user (normally found in the GECOS field of the UNIX password database).

    - If the parameter nt acl support is set to false - then the file owner will be shown as the NT user "Everyone" and the permissions will be - shown as NT "Full Control". + If the parameter nt acl support is set to false, + the file owner will be shown as the NT user Everyone and the permissions will be + shown as NT “Full Control”.

    The permissions field is displayed differently for files and directories, so I'll describe the way file permissions are displayed first. -

    File Permissions

    The standard UNIX user/group/world triplet and - the corresponding "read", "write", "execute" permissions - triplets are mapped by Samba into a three element NT ACL - with the 'r', 'w', and 'x' bits mapped into the corresponding - NT permissions. The UNIX world permissions are mapped into - the global NT group Everyone, followed - by the list of permissions allowed for UNIX world. The UNIX - owner and group permissions are displayed as an NT - user icon and an NT local - group icon respectively followed by the list - of permissions allowed for the UNIX user and group.

    As many UNIX permission sets don't map into common - NT names such as read, - "change" or full control then - usually the permissions will be prefixed by the words - "Special Access" in the NT display list.

    But what happens if the file has no permissions allowed - for a particular UNIX user group or world component? In order - to allow "no permissions" to be seen and modified then Samba - overloads the NT "Take Ownership" ACL attribute - (which has no meaning in UNIX) and reports a component with - no permissions as having the NT "O" bit set. - This was chosen of course to make it look like a zero, meaning - zero permissions. More details on the decision behind this will - be given below.

    Directory Permissions

    Directories on an NT NTFS file system have two - different sets of permissions. The first set of permissions - is the ACL set on the directory itself, this is usually displayed - in the first set of parentheses in the normal "RW" - NT style. This first set of permissions is created by Samba in - exactly the same way as normal file permissions are, described - above, and is displayed in the same way.

    The second set of directory permissions has no real meaning - in the UNIX permissions world and represents the - inherited permissions that any file created within - this directory would inherit.

    Samba synthesises these inherited permissions for NT by - returning as an NT ACL the UNIX permission mode that a new file - created by Samba on this share would receive.

    Modifying file or directory permissions

    Modifying file and directory permissions is as simple +

    File Permissions

    The standard UNIX user/group/world triplet and the corresponding read, write, execute permissions + triplets are mapped by Samba into a three element NT ACL with the “r”, “w” and “x” bits mapped into the corresponding + NT permissions. The UNIX world permissions are mapped into the global NT group Everyone, followed + by the list of permissions allowed for UNIX world. The UNIX owner and group permissions are displayed as an NT + user icon and an NT local group icon, respectively, followed by the list + of permissions allowed for the UNIX user and group.

    Because many UNIX permission sets do not map into common NT names such as read, + change or full control, usually the permissions will be prefixed + by the words Special Access in the NT display list.

    But what happens if the file has no permissions allowed for a particular UNIX user group or world component? In order + to allow “no permissions” to be seen and modified Samba then overloads the NT Take Ownership ACL attribute + (which has no meaning in UNIX) and reports a component with no permissions as having the NT O bit set. + This was chosen, of course, to make it look like a zero, meaning zero permissions. More details on the decision behind this is + given below.

    Directory Permissions

    Directories on an NT NTFS file system have two different sets of permissions. The first set is the ACL set on the + directory itself, which is usually displayed in the first set of parentheses in the normal RW + NT style. This first set of permissions is created by Samba in exactly the same way as normal file permissions are, described + above, and is displayed in the same way.

    The second set of directory permissions has no real meaning in the UNIX permissions world and represents the + inherited permissions that any file created within this directory would inherit.

    Samba synthesises these inherited permissions for NT by returning as an NT ACL the UNIX permission mode that a new file + created by Samba on this share would receive.

    Modifying File or Directory Permissions

    Modifying file and directory permissions is as simple as changing the displayed permissions in the dialog box, and - clicking the OK button. However, there are + clicking on OK. However, there are limitations that a user needs to be aware of, and also interactions with the standard Samba permission masks and mapping of DOS - attributes that need to also be taken into account.

    If the parameter nt acl support - is set to false then any attempt to set - security permissions will fail with an "Access Denied" - message.

    The first thing to note is that the "Add" + attributes that need to also be taken into account.

    If the parameter nt acl support + is set to false, any attempt to set + security permissions will fail with an `Access Denied' + message.

    The first thing to note is that the Add button will not return a list of users in Samba (it will give - an error message of The remote procedure call failed - and did not execute). This means that you can only + an error message saying `The remote procedure call failed + and did not execute'). This means that you can only manipulate the current user/group/world permissions listed in the dialog box. This actually works quite well as these are the only permissions that UNIX actually has.

    If a permission triplet (either user, group, or world) is removed from the list of permissions in the NT dialog box, then when the OK button is pressed it will - be applied as "no permissions" on the UNIX side. If you then - view the permissions again the "no permissions" entry will appear - as the NT "O" flag, as described above. This + be applied as “no permissions” on the UNIX side. If you then + view the permissions again, the “no permissions” entry will appear + as the NT O flag, as described above. This allows you to add permissions back to a file or directory once - you have removed them from a triplet component.

    As UNIX supports only the "r", "w" and "x" bits of - an NT ACL then if other NT security attributes such as "Delete - access" are selected then they will be ignored when applied on - the Samba server.

    When setting permissions on a directory the second + you have removed them from a triplet component.

    As UNIX supports only the “r”, “w” and “x” bits of + an NT ACL, if other NT security attributes such as Delete Access are + selected they will be ignored when applied on the Samba server.

    When setting permissions on a directory, the second set of permissions (in the second set of parentheses) is by default applied to all files within that directory. If this - is not what you want you must uncheck the Replace + is not what you want, you must uncheck the Replace permissions on existing files checkbox in the NT - dialog before clicking OK.

    If you wish to remove all permissions from a - user/group/world component then you may either highlight the - component and click the Remove button, + dialog before clicking on OK.

    If you wish to remove all permissions from a + user/group/world component, you may either highlight the + component and click on the Remove button, or set the component to only have the special Take - Ownership permission (displayed as "O" - ) highlighted.

    Interaction with the standard Samba create mask - parameters

    There are four parameters - to control interaction with the standard Samba create mask parameters. - These are : + Ownership permission (displayed as O + ) highlighted.

    Interaction with the Standard Samba “create mask” Parameters

    There are four parameters that control interaction with the standard Samba create mask parameters. + These are: -

    • security mask

    • force security mode

    • directory security mask

    • force directory security mode

    +

    • security mask
    • force security mode
    • directory security mask
    • force directory security mode

    -

    Once a user clicks OK to apply the - permissions Samba maps the given permissions into a user/group/world - r/w/x triplet set, and then will check the changed permissions for a +

    Once a user clicks on OK to apply the + permissions, Samba maps the given permissions into a user/group/world + r/w/x triplet set, and then checks the changed permissions for a file against the bits set in the - security mask parameter. Any bits that - were changed that are not set to '1' in this parameter are left alone - in the file permissions.

    Essentially, zero bits in the security mask - mask may be treated as a set of bits the user is not + security mask parameter. Any bits that + were changed that are not set to “1” in this parameter are left alone + in the file permissions.

    Essentially, zero bits in the security mask + may be treated as a set of bits the user is not allowed to change, and one bits are those the user is allowed to change. -

    If not set explicitly this parameter is set to the same value as - the create mask parameter. To allow a user to modify all the - user/group/world permissions on a file, set this parameter - to 0777.

    Next Samba checks the changed permissions for a file against - the bits set in the - force security mode parameter. Any bits - that were changed that correspond to bits set to '1' in this parameter - are forced to be set.

    Essentially, bits set in the force security mode - parameter may be treated as a set of bits that, when - modifying security on a file, the user has always set to be 'on'.

    If not set explicitly this parameter is set to the same value - as the force create mode parameter. +

    If not explicitly set, this parameter defaults to the same value as + the create mask parameter. To allow a user to modify all the + user/group/world permissions on a file, set this parameter to 0777. +

    Next Samba checks the changed permissions for a file against the bits set in the + force security mode parameter. Any bits + that were changed that correspond to bits set to “1” in this parameter + are forced to be set.

    Essentially, bits set in the force security mode parameter + may be treated as a set of bits that, when modifying security on a file, the user has always set to be “on”.

    If not explicitly set, this parameter defaults to the same value + as the force create mode parameter. To allow a user to modify all the user/group/world permissions on a file - with no restrictions set this parameter to 000.

    The security mask and force + with no restrictions set this parameter to 000. The + security mask and force security mode parameters are applied to the change - request in that order.

    For a directory Samba will perform the same operations as - described above for a file except using the parameter + request in that order.

    For a directory, Samba will perform the same operations as + described above for a file except it uses the parameter directory security mask instead of security mask, and force directory security mode parameter instead of force security mode - .

    The directory security mask parameter + .

    The directory security mask parameter by default is set to the same value as the directory mask parameter and the force directory security mode parameter by default is set to the same value as - the force directory mode parameter.

    In this way Samba enforces the permission restrictions that - an administrator can set on a Samba share, whilst still allowing users + the force directory mode parameter. + In this way Samba enforces the permission restrictions that + an administrator can set on a Samba share, while still allowing users to modify the permission bits within that restriction.

    If you want to set up a share that allows users full control in modifying the permission bits on their files and directories and - doesn't force any particular bits to be set 'on', then set the following - parameters in the smb.conf file in that share specific section : -

    security mask = 0777
    force security mode = 0
    directory security mask = 0777
    force directory security mode = 0

    Interaction with the standard Samba file attribute mapping

    Note

    Samba maps some of the DOS attribute bits (such as "read - only") into the UNIX permissions of a file. This means there can + does not force any particular bits to be set “on”, then set the following + parameters in the smb.conf file in that share-specific section: +

    security mask = 0777
    force security mode = 0
    directory security mask = 0777
    force directory security mode = 0

    Interaction with the Standard Samba File Attribute Mapping

    Note

    Samba maps some of the DOS attribute bits (such as “read + only”) into the UNIX permissions of a file. This means there can be a conflict between the permission bits set via the security dialog and the permission bits set by the file attribute mapping. -

    One way this can show up is if a file has no UNIX read access - for the owner it will show up as "read only" in the standard - file attributes tabbed dialog. Unfortunately this dialog is - the same one that contains the security info in another tab.

    What this can mean is that if the owner changes the permissions - to allow themselves read access using the security dialog, clicks +

    If a file has no UNIX read access for the owner, it will show up + as “read only” in the standard file attributes tabbed dialog. + Unfortunately, this dialog is the same one that contains the security information + in another tab.

    What this can mean is that if the owner changes the permissions + to allow himself read access using the security dialog, clicks on OK to get back to the standard attributes tab - dialog, and then clicks OK on that dialog, then + dialog, and clicks on OK on that dialog, then NT will set the file permissions back to read-only (as that is what the attributes still say in the dialog). This means that after setting - permissions and clicking OK to get back to the - attributes dialog you should always hit Cancel + permissions and clicking on OK to get back to the + attributes dialog, you should always press Cancel rather than OK to ensure that your changes - are not overridden.

    Common Errors

    -File, Directory and Share access problems are very common on the mailing list. The following + are not overridden.

    Common Errors

    +File, directory and share access problems are common on the mailing list. The following are examples taken from the mailing list in recent times. -

    Users can not write to a public share

    +

    Users Cannot Write to a Public Share

    “ - We are facing some troubles with file / directory permissions. I can log on the domain as admin user(root), - and there's a public share, on which everyone needs to have permission to create / modify files, but only - root can change the file, no one else can. We need to constantly go to server to + We are facing some troubles with file/directory permissions. I can log on the domain as admin user(root), + and there's a public share on which everyone needs to have permission to create/modify files, but only + root can change the file, no one else can. We need to constantly go to the server to chgrp -R users * and chown -R nobody * to allow others users to change the file. ”

    - There are many ways to solve this problem, here are a few hints: + There are many ways to solve this problem and here are a few hints:

    1. - Go to the top of the directory that is shared + Go to the top of the directory that is shared.

    2. Set the ownership to what ever public owner and group you want 

      @@ -4597,7 +4909,7 @@ are examples taken from the mailing list in recent times.
 $ find 'directory_name' -type f -exec chown user.group {}\;

      Note

      - The above will set the 'sticky bit' on all directories. Read your + The above will set the sticky bit on all directories. Read your UNIX/Linux man page on what that does. It causes the OS to assign to all files created in the directories the ownership of the directory. @@ -4607,10 +4919,13 @@ are examples taken from the mailing list in recent times. 

       $ chown jack.engr /foodbar

      -

      Note

      This is the same as doing:

      +			
      Note
      
+				
      This is the same as doing:
      
+
       $ chown jack /foodbar
 $ chgrp engr /foodbar
-

    3. Now do: +

      +

  • Now type: 

     $ chmod 6775 /foodbar
@@ -4621,7 +4936,7 @@ are examples taken from the mailing list in recent times.
 
     drwsrwsr-x  2 jack  engr    48 2003-02-04 09:55 foodbar
 
    
-

  • Now do: +

  • Now type: 

     $ su - jill
 $ cd /foodbar
@@ -4638,127 +4953,128 @@ drwsrwsr-x  2 jack  engr    48 2003-02-04 09:55 foodbar
 		Now in your smb.conf for the share add:
 		
    force create mode = 0775
    force direcrtory mode = 6775
    
 		
    Note
    
-		The above are only needed if your users are not members of the group
-		you have used. ie: Within the OS do not have write permission on the directory.
+		These procedures are needed only if your users are not members of the group
+		you have used. That is if within the OS do not have write permission on the directory.
 		
    
 		An alternative is to set in the smb.conf entry for the share:
 		
    force user = jack
    force group = engr
    
-

    • I have set force user but Samba still makes root the owner of all the files I touch!

    - When you have a user in admin users, samba will always do file operations for - this user as root, even if force user has been set. -

    MS Word with Samba changes owner of file

    - Question: “When userB saves a word document that is owned by userA the updated file is now owned by userB. +

    File Operations Done as root with force user Set

    + When you have a user in admin users, Samba will always do file operations for + this user as root, even if force user has been set. +

    MS Word with Samba Changes Owner of File

    + Question: “When user B saves a word document that is owned by user A the updated file is now owned by user B. Why is Samba doing this? How do I fix this?”

    - Answer: Word does the following when you modify/change a Word document: Word Creates a NEW document with + Answer: Word does the following when you modify/change a Word document: MS Word creates a NEW document with a temporary name, Word then closes the old document and deletes it, Word then renames the new document to the original document name. - There is NO mechanism by which Samba CAN IN ANY WAY know that the new document really should be owned by the owners - of the original file. Samba has no way of knowing that the file will be renamed by MS Word. As far as Samba is able + There is no mechanism by which Samba can in any way know that the new document really should be owned by the owners + of the original file. Samba has no way of knowing that the file will be renamed by MS Word. As far as Samba is able to tell, the file that gets created is a NEW file, not one that the application (Word) is updating.

    There is a work-around to solve the permissions problem. That work-around involves understanding how you can manage file - system behaviour from within the smb.conf file, as well as understanding how Unix file systems work. Set on the directory - in which you are changing word documents: chmod g+s 'directory_name' This ensures that all files will - be created with the group that owns the directory. In smb.conf share declaration section set: + system behavior from within the smb.conf file, as well as understanding how UNIX file systems work. Set on the directory + in which you are changing Word documents: chmod g+s `directory_name' This ensures that all files will + be created with the group that owns the directory. In smb.conf share declaration section set:

    force create mode = 0660
    force directory mode = 0770

    These two settings will ensure that all directories and files that get created in the share will be read/writable by the owner and group set on the directory itself. -

    Chapter 14. File and Record Locking

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Eric Roseme

    HP Oplocks Usage Recommendations Whitepaper

    Table of Contents

    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Problems saving files in MS Office on Windows XP
    Long delays deleting files over network with XP SP1
    Additional Reading

    -One area which causes trouble for many network administrators is locking. -The extent of the problem is readily evident from searches over the internet. -

    Features and Benefits

    +

    Chapter 14. File and Record Locking

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Eric Roseme

    HP Oplocks Usage Recommendations Whitepaper

    Table of Contents

    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb Error Messages
    Problems Saving Files in MS Office on Windows XP
    Long Delays Deleting Files Over Network with XP SP1
    Additional Reading

    +One area that causes trouble for many network administrators is locking. +The extent of the problem is readily evident from searches over the Internet. +

    Features and Benefits

    Samba provides all the same locking semantics that MS Windows clients expect -and that MS Windows NT4 / 200x servers provide also. +and that MS Windows NT4/200x servers also provide.

    The term locking has exceptionally broad meaning and covers a range of functions that are all categorized under this one term.

    Opportunistic locking is a desirable feature when it can enhance the -perceived performance of applications on a networked client. However, the -opportunistic locking protocol is not robust, and therefore can -encounter problems when invoked beyond a simplistic configuration, or -on extended, slow, or faulty networks. In these cases, operating +perceived performance of applications on a networked client. However, the +opportunistic locking protocol is not robust and, therefore, can +encounter problems when invoked beyond a simplistic configuration or +on extended slow or faulty networks. In these cases, operating system management of opportunistic locking and/or recovering from repetitive errors can offset the perceived performance advantage that it is intended to provide.

    The MS Windows network administrator needs to be aware that file and record -locking semantics (behaviour) can be controlled either in Samba or by way of registry +locking semantics (behavior) can be controlled either in Samba or by way of registry settings on the MS Windows client.

    Note

    -Sometimes it is necessary to disable locking control settings BOTH on the Samba +Sometimes it is necessary to disable locking control settings on both the Samba server as well as on each MS Windows client! -

    Discussion

    -There are two types of locking which need to be performed by a SMB server. -The first is record locking which allows a client to lock -a range of bytes in a open file. The second is the deny modes +

    Discussion

    +There are two types of locking that need to be performed by an SMB server. +The first is record locking that allows a client to lock +a range of bytes in a open file. The second is the deny modes that are specified when a file is open.

    Record locking semantics under UNIX are very different from record locking under -Windows. Versions of Samba before 2.2 have tried to use the native fcntl() unix +Windows. Versions of Samba before 2.2 have tried to use the native fcntl() UNIX system call to implement proper record locking between different Samba clients. -This can not be fully correct due to several reasons. The simplest is the fact +This cannot be fully correct for several reasons. The simplest is the fact that a Windows client is allowed to lock a byte range up to 2^32 or 2^64, -depending on the client OS. The unix locking only supports byte ranges up to 2^31. +depending on the client OS. The UNIX locking only supports byte ranges up to 2^31. So it is not possible to correctly satisfy a lock request above 2^31. There are many more differences, too many to be listed here.

    Samba 2.2 and above implements record locking completely independent of the -underlying unix system. If a byte range lock that the client requests happens -to fall into the range 0-2^31, Samba hands this request down to the UNIX system. -All other locks can not be seen by unix anyway. -

    -Strictly an SMB server should check for locks before every read and write call on -a file. Unfortunately with the way fcntl() works this can be slow and may over-stress -the rpc.lockd. It is also almost always unnecessary as clients are supposed to -independently make locking calls before reads and writes anyway if locking is -important to them. By default Samba only makes locking calls when explicitly asked -to by a client, but if you set strict locking = yes then it -will make lock checking calls on every read and write. -

    -You can also disable byte range locking completely using locking = no. -This is useful for those shares that don't support locking or don't need it -(such as cdroms). In this case Samba fakes the return codes of locking calls to -tell clients that everything is OK. +underlying UNIX system. If a byte range lock that the client requests happens +to fall into the range of 0-2^31, Samba hands this request down to the UNIX system. +All other locks cannot be seen by UNIX, anyway. +

    +Strictly speaking, an SMB server should check for locks before every read and write call on +a file. Unfortunately with the way fcntl() works, this can be slow and may overstress +the rpc.lockd. This is almost always unnecessary as clients are supposed to +independently make locking calls before reads and writes if locking is +important to them. By default, Samba only makes locking calls when explicitly asked +to by a client, but if you set strict locking = yes, it +will make lock checking calls on every read and write call. +

    +You can also disable byte range locking completely by using +locking = no. +This is useful for those shares that do not support locking or do not need it +(such as CDROMs). In this case, Samba fakes the return codes of locking calls to +tell clients that everything is okay.

    The second class of locking is the deny modes. These are set by an application when it opens a file to determine what types of access should be allowed simultaneously with its open. A client may ask for DENY_NONE, DENY_READ, -DENY_WRITE or DENY_ALL. There are also special compatibility +DENY_WRITE, or DENY_ALL. There are also special compatibility modes called DENY_FCB and DENY_DOS. -

    Opportunistic Locking Overview

    +

    Opportunistic Locking Overview

    Opportunistic locking (Oplocks) is invoked by the Windows file system -(as opposed to an API) via registry entries (on the server AND client) +(as opposed to an API) via registry entries (on the server and the client) for the purpose of enhancing network performance when accessing a file residing on a server. Performance is enhanced by caching the file -locally on the client which allows: +locally on the client that allows:

    Read-ahead:

    - The client reads the local copy of the file, eliminating network latency + The client reads the local copy of the file, eliminating network latency.

    Write caching:

    - The client writes to the local copy of the file, eliminating network latency + The client writes to the local copy of the file, eliminating network latency.

    Lock caching:

    - The client caches application locks locally, eliminating network latency + The client caches application locks locally, eliminating network latency.

    The performance enhancement of oplocks is due to the opportunity of -exclusive access to the file - even if it is opened with deny-none - +exclusive access to the file even if it is opened with deny-none because Windows monitors the file's status for concurrent access from other processes. -

    Windows defines 4 kinds of Oplocks:

    Level1 Oplock:

    +

    Windows defines 4 kinds of Oplocks:

    Level1 Oplock

    The redirector sees that the file was opened with deny none (allowing concurrent access), verifies that no other process is accessing the file, checks that oplocks are enabled, then grants deny-all/read-write/exclusive - access to the file. The client now performs + access to the file. The client now performs operations on the cached local file.

    If a second process attempts to open the file, the open - is deferred while the redirector "breaks" the original - oplock. The oplock break signals the caching client to + is deferred while the redirector “breaks” the original + oplock. The oplock break signals the caching client to write the local file back to the server, flush the - local locks, and discard read-ahead data. The break is + local locks and discard read-ahead data. The break is then complete, the deferred open is granted, and the multiple processes can enjoy concurrent file access as dictated by mandatory or byte-range locking options. @@ -4766,130 +5082,130 @@ other processes. file with a share mode other than deny-none, then the second process is granted limited or no access, despite the oplock break. -

    Level2 Oplock:

    - Performs like a level1 oplock, except caching is only +

    Level2 Oplock

    + Performs like a Level1 oplock, except caching is only operative for reads. All other operations are performed on the server disk copy of the file. -

    Filter Oplock:

    - Does not allow write or delete file access -

    Batch Oplock:

    - Manipulates file openings and closings - allows caching - of file attributes +

    Filter Oplock

    + Does not allow write or delete file access. +

    Batch Oplock

    + Manipulates file openings and closings and allows caching + of file attributes.

    An important detail is that oplocks are invoked by the file system, not -an application API. Therefore, an application can close an oplocked -file, but the file system does not relinquish the oplock. When the +an application API. Therefore, an application can close an oplocked +file, but the file system does not relinquish the oplock. When the oplock break is issued, the file system then simply closes the file in preparation for the subsequent open by the second process.

    -Opportunistic Locking is actually an improper name for this feature. +Opportunistic locking is actually an improper name for this feature. The true benefit of this feature is client-side data caching, and oplocks is merely a notification mechanism for writing data back to the -networked storage disk. The limitation of opportunistic locking is the +networked storage disk. The limitation of opportunistic locking is the reliability of the mechanism to process an oplock break (notification) -between the server and the caching client. If this exchange is faulty -(usually due to timing out for any number of reasons) then the +between the server and the caching client. If this exchange is faulty +(usually due to timing out for any number of reasons), then the client-side caching benefit is negated.

    The actual decision that a user or administrator should consider is -whether it is sensible to share amongst multiple users data that will -be cached locally on a client. In many cases the answer is no. +whether it is sensible to share among multiple users data that will +be cached locally on a client. In many cases the answer is no. Deciding when to cache or not cache data is the real question, and thus -"opportunistic locking" should be treated as a toggle for client-side -caching. Turn it "ON" when client-side caching is desirable and -reliable. Turn it "OFF" when client-side caching is redundant, -unreliable, or counter-productive. +“opportunistic locking” should be treated as a toggle for client-side +caching. Turn it “on” when client-side caching is desirable and +reliable. Turn it “off” when client-side caching is redundant, +unreliable or counter-productive.

    -Opportunistic locking is by default set to "on" by Samba on all +Opportunistic locking is by default set to “on” by Samba on all configured shares, so careful attention should be given to each case to determine if the potential benefit is worth the potential for delays. The following recommendations will help to characterize the environment where opportunistic locking may be effectively configured.

    -Windows Opportunistic Locking is a lightweight performance-enhancing -feature. It is not a robust and reliable protocol. Every -implementation of Opportunistic Locking should be evaluated as a -tradeoff between perceived performance and reliability. Reliability -decreases as each successive rule above is not enforced. Consider a +Windows opportunistic locking is a lightweight performance-enhancing +feature. It is not a robust and reliable protocol. Every +implementation of opportunistic locking should be evaluated as a +tradeoff between perceived performance and reliability. Reliability +decreases as each successive rule above is not enforced. Consider a share with oplocks enabled, over a wide area network, to a client on a South Pacific atoll, on a high-availability server, serving a -mission-critical multi-user corporate database, during a tropical -storm. This configuration will likely encounter problems with oplocks. +mission-critical multi-user corporate database during a tropical +storm. This configuration will likely encounter problems with oplocks.

    Oplocks can be beneficial to perceived client performance when treated -as a configuration toggle for client-side data caching. If the data +as a configuration toggle for client-side data caching. If the data caching is likely to be interrupted, then oplock usage should be -reviewed. Samba enables opportunistic locking by default on all -shares. Careful attention should be given to the client usage of -shared data on the server, the server network reliability, and the +reviewed. Samba enables opportunistic locking by default on all +shares. Careful attention should be given to the client usage of +shared data on the server, the server network reliability and the opportunistic locking configuration of each share. -n mission critical high availability environments, data integrity is -often a priority. Complex and expensive configurations are implemented +In mission critical high availability environments, data integrity is +often a priority. Complex and expensive configurations are implemented to ensure that if a client loses connectivity with a file server, a failover replacement will be available immediately to provide continuous data availability.

    Windows client failover behavior is more at risk of application -interruption than other platforms because it is dependant upon an -established TCP transport connection. If the connection is interrupted -- as in a file server failover - a new session must be established. +interruption than other platforms because it is dependent upon an +established TCP transport connection. If the connection is interrupted + as in a file server failover a new session must be established. It is rare for Windows client applications to be coded to recover -correctly from a transport connection loss, therefore most applications -will experience some sort of interruption - at worst, abort and +correctly from a transport connection loss, therefore, most applications +will experience some sort of interruption at worst, abort and require restarting.

    If a client session has been caching writes and reads locally due to opportunistic locking, it is likely that the data will be lost when the -application restarts, or recovers from the TCP interrupt. When the TCP -connection drops, the client state is lost. When the file server -recovers, an oplock break is not sent to the client. In this case, the -work from the prior session is lost. Observing this scenario with -oplocks disabled, and the client was writing data to the file server -real-time, then the failover will provide the data on disk as it +application restarts or recovers from the TCP interrupt. When the TCP +connection drops, the client state is lost. When the file server +recovers, an oplock break is not sent to the client. In this case, the +work from the prior session is lost. Observing this scenario with +oplocks disabled and with the client writing data to the file server +real-time, the failover will provide the data on disk as it existed at the time of the disconnect.

    -In mission critical high availability environments, careful attention -should be given to opportunistic locking. Ideally, comprehensive +In mission-critical high-availability environments, careful attention +should be given to opportunistic locking. Ideally, comprehensive testing should be done with all affected applications with oplocks enabled and disabled. -

    Exclusively Accessed Shares

    +

    Exclusively Accessed Shares

    Opportunistic locking is most effective when it is confined to shares that are exclusively accessed by a single user, or by only one user at -a time. Because the true value of opportunistic locking is the local +a time. Because the true value of opportunistic locking is the local client caching of data, any operation that interrupts the caching mechanism will cause a delay.

    Home directories are the most obvious examples of where the performance benefit of opportunistic locking can be safely realized. -

    Multiple-Accessed Shares or Files

    +

    Multiple-Accessed Shares or Files

    As each additional user accesses a file in a share with opportunistic locking enabled, the potential for delays and resulting perceived poor -performance increases. When multiple users are accessing a file on a +performance increases. When multiple users are accessing a file on a share that has oplocks enabled, the management impact of sending and -receiving oplock breaks, and the resulting latency while other clients -wait for the caching client to flush data, offset the performance gains +receiving oplock breaks and the resulting latency while other clients +wait for the caching client to flush data offset the performance gains of the caching user.

    As each additional client attempts to access a file with oplocks set, the potential performance improvement is negated and eventually results in a performance bottleneck. -

    UNIX or NFS Client Accessed Files

    +

    UNIX or NFS Client-Accessed Files

    Local UNIX and NFS clients access files without a mandatory -file locking mechanism. Thus, these client platforms are incapable of +file-locking mechanism. Thus, these client platforms are incapable of initiating an oplock break request from the server to a Windows client that has a file cached. Local UNIX or NFS file access can therefore write to a file that has been cached by a Windows client, which exposes the file to likely data corruption.

    If files are shared between Windows clients, and either local UNIX -or NFS users, then turn opportunistic locking off. -

    Slow and/or Unreliable Networks

    +or NFS users, turn opportunistic locking off. +

    Slow and/or Unreliable Networks

    The biggest potential performance improvement for opportunistic locking occurs when the client-side caching of reads and writes delivers the most differential over sending those reads and writes over the wire. This is most likely to occur when the network is extremely slow, -congested, or distributed (as in a WAN). However, network latency also -has a very high impact on the reliability of the oplock break +congested, or distributed (as in a WAN). However, network latency also +has a high impact on the reliability of the oplock break mechanism, and thus increases the likelihood of encountering oplock problems that more than offset the potential perceived performance gain. Of course, if an oplock break never has to be sent, then this is @@ -4898,112 +5214,112 @@ the most advantageous scenario to utilize opportunistic locking. If the network is slow, unreliable, or a WAN, then do not configure opportunistic locking if there is any chance of multiple users regularly opening the same file. -

    Multi-User Databases

    -Multi-user databases clearly pose a risk due to their very nature - +

    Multi-User Databases

    +Multi-user databases clearly pose a risk due to their very nature they are typically heavily accessed by numerous users at random -intervals. Placing a multi-user database on a share with opportunistic +intervals. Placing a multi-user database on a share with opportunistic locking enabled will likely result in a locking management bottleneck -on the Samba server. Whether the database application is developed +on the Samba server. Whether the database application is developed in-house or a commercially available product, ensure that the share has opportunistic locking disabled. -

    PDM Data Shares

    -Process Data Management (PDM) applications such as IMAN, Enovia, and -Clearcase, are increasing in usage with Windows client platforms, and -therefore SMB data stores. PDM applications manage multi-user -environments for critical data security and access. The typical PDM +

    PDM Data Shares

    +Process Data Management (PDM) applications such as IMAN, Enovia and +Clearcase are increasing in usage with Windows client platforms, and +therefore SMB datastores. PDM applications manage multi-user +environments for critical data security and access. The typical PDM environment is usually associated with sophisticated client design -applications that will load data locally as demanded. In addition, the +applications that will load data locally as demanded. In addition, the PDM application will usually monitor the data-state of each client. In this case, client-side data caching is best left to the local -application and PDM server to negotiate and maintain. It is +application and PDM server to negotiate and maintain. It is appropriate to eliminate the client OS from any caching tasks, and the server from any oplock management, by disabling opportunistic locking on the share. -

    Beware of Force User

    -Samba includes an smb.conf parameter called force user that changes +

    Beware of Force User

    +Samba includes an smb.conf parameter called force user that changes the user accessing a share from the incoming user to whatever user is -defined by the smb.conf variable. If opportunistic locking is enabled +defined by the smb.conf variable. If opportunistic locking is enabled on a share, the change in user access causes an oplock break to be sent -to the client, even if the user has not explicitly loaded a file. In +to the client, even if the user has not explicitly loaded a file. In cases where the network is slow or unreliable, an oplock break can -become lost without the user even accessing a file. This can cause +become lost without the user even accessing a file. This can cause apparent performance degradation as the client continually reconnects to overcome the lost oplock break.

    Avoid the combination of the following:

    • - force user in the smb.conf share configuration. + force user in the smb.conf share configuration.

    • Slow or unreliable networks

    • - Opportunistic Locking Enabled -

    Advanced Samba Opportunistic Locking Parameters

    + Opportunistic locking enabled +

    Advanced Samba Opportunistic Locking Parameters

    Samba provides opportunistic locking parameters that allow the administrator to adjust various properties of the oplock mechanism to -account for timing and usage levels. These parameters provide good +account for timing and usage levels. These parameters provide good versatility for implementing oplocks in environments where they would -likely cause problems. The parameters are: -oplock break wait time, -oplock contention limit. +likely cause problems. The parameters are: +oplock break wait time, +oplock contention limit.

    -For most users, administrators, and environments, if these parameters +For most users, administrators and environments, if these parameters are required, then the better option is to simply turn oplocks off. -The samba SWAT help text for both parameters reads "DO NOT CHANGE THIS -PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." +The Samba SWAT help text for both parameters reads: “Do not change +this parameter unless you have read and understood the Samba oplock code.” This is good advice. -

    Mission Critical High Availability

    -In mission critical high availability environments, data integrity is -often a priority. Complex and expensive configurations are implemented +

    Mission-Critical High-Availability

    +In mission-critical high-availability environments, data integrity is +often a priority. Complex and expensive configurations are implemented to ensure that if a client loses connectivity with a file server, a failover replacement will be available immediately to provide continuous data availability.

    Windows client failover behavior is more at risk of application interruption than other platforms because it is dependant upon an -established TCP transport connection. If the connection is interrupted -- as in a file server failover - a new session must be established. +established TCP transport connection. If the connection is interrupted + as in a file server failover a new session must be established. It is rare for Windows client applications to be coded to recover -correctly from a transport connection loss, therefore most applications -will experience some sort of interruption - at worst, abort and +correctly from a transport connection loss, therefore, most applications +will experience some sort of interruption at worst, abort and require restarting.

    If a client session has been caching writes and reads locally due to opportunistic locking, it is likely that the data will be lost when the application restarts, or recovers from the TCP interrupt. When the TCP -connection drops, the client state is lost. When the file server -recovers, an oplock break is not sent to the client. In this case, the -work from the prior session is lost. Observing this scenario with +connection drops, the client state is lost. When the file server +recovers, an oplock break is not sent to the client. In this case, the +work from the prior session is lost. Observing this scenario with oplocks disabled, and the client was writing data to the file server real-time, then the failover will provide the data on disk as it existed at the time of the disconnect.

    -In mission critical high availability environments, careful attention -should be given to opportunistic locking. Ideally, comprehensive -testing should be done with all affected applications with oplocks +In mission-critical high-availability environments, careful attention +should be given to opportunistic locking. Ideally, comprehensive +testing should be done with all effected applications with oplocks enabled and disabled. -

    Samba Opportunistic Locking Control

    -Opportunistic Locking is a unique Windows file locking feature. It is +

    Samba Opportunistic Locking Control

    +Opportunistic locking is a unique Windows file locking feature. It is not really file locking, but is included in most discussions of Windows file locking, so is considered a de facto locking feature. -Opportunistic Locking is actually part of the Windows client file -caching mechanism. It is not a particularly robust or reliable feature +Opportunistic locking is actually part of the Windows client file +caching mechanism. It is not a particularly robust or reliable feature when implemented on the variety of customized networks that exist in enterprise computing.

    -Like Windows, Samba implements Opportunistic Locking as a server-side -component of the client caching mechanism. Because of the lightweight +Like Windows, Samba implements opportunistic locking as a server-side +component of the client caching mechanism. Because of the lightweight nature of the Windows feature design, effective configuration of -Opportunistic Locking requires a good understanding of its limitations, +opportunistic locking requires a good understanding of its limitations, and then applying that understanding when configuring data access for each particular customized network and client usage state.

    Opportunistic locking essentially means that the client is allowed to download and cache a file on their hard drive while making changes; if a second client wants to access the -file, the first client receives a break and must synchronise the file back to the server. +file, the first client receives a break and must synchronize the file back to the server. This can give significant performance gains in some cases; some programs insist on -synchronising the contents of the entire file back to the server for a single change. +synchronizing the contents of the entire file back to the server for a single change.

    -Level1 Oplocks (aka just plain "oplocks") is another term for opportunistic locking. +Level1 Oplocks (also known as just plain “oplocks”) is another term for opportunistic locking.

    Level2 Oplocks provides opportunistic locking for a file that will be treated as read only. Typically this is used on files that are read-only or @@ -5011,16 +5327,16 @@ on files that the client has no initial intention to write to at time of opening

    Kernel Oplocks are essentially a method that allows the Linux kernel to co-exist with Samba's oplocked files, although this has provided better integration of MS Windows network -file locking with the under lying OS, SGI IRIX and Linux are the only two OS's that are -oplock aware at this time. +file locking with the underlying OS, SGI IRIX and Linux are the only two OSs that are +oplock-aware at this time.

    Unless your system supports kernel oplocks, you should disable oplocks if you are accessing the same files from both UNIX/Linux and SMB clients. Regardless, oplocks should always be disabled if you are sharing a database file (e.g., Microsoft Access) between -multiple clients, as any break the first client receives will affect synchronisation of +multiple clients, as any break the first client receives will affect synchronization of the entire file (not just the single record), which will result in a noticeable performance impairment and, more likely, problems accessing the database in the first place. Notably, -Microsoft Outlook's personal folders (*.pst) react very badly to oplocks. If in doubt, +Microsoft Outlook's personal folders (*.pst) react quite badly to oplocks. If in doubt, disable oplocks and tune your system from that point.

    If client-side caching is desirable and reliable on your network, you will benefit from @@ -5031,14 +5347,14 @@ of your client sending oplock breaks and will instead want to disable oplocks fo

    Another factor to consider is the perceived performance of file access. If oplocks provide no measurable speed benefit on your network, it might not be worth the hassle of dealing with them. -

    Example Configuration

    -In the following we examine two distinct aspects of Samba locking controls. -

    Disabling Oplocks

    +

    Example Configuration

    +In the following section we examine two distinct aspects of Samba locking controls. +

    Disabling Oplocks

    You can disable oplocks on a per-share basis with the following:

    [acctdata]
    oplocks = False
    level2 oplocks = False

    -The default oplock type is Level1. Level2 Oplocks are enabled on a per-share basis +The default oplock type is Level1. Level2 oplocks are enabled on a per-share basis in the smb.conf file.

    Alternately, you could disable oplocks on a per-file basis within the share: @@ -5046,69 +5362,67 @@ Alternately, you could disable oplocks on a per-file basis within the share:

    veto oplock files = /*.mdb/*.MDB/*.dbf/*.DBF/

    If you are experiencing problems with oplocks as apparent from Samba's log entries, -you may want to play it safe and disable oplocks and level2 oplocks. -

    Disabling Kernel OpLocks

    -Kernel OpLocks is an smb.conf parameter that notifies Samba (if +you may want to play it safe and disable oplocks and Level2 oplocks. +

    Disabling Kernel Oplocks

    +Kernel oplocks is an smb.conf parameter that notifies Samba (if the UNIX kernel has the capability to send a Windows client an oplock break) when a UNIX process is attempting to open the file that is -cached. This parameter addresses sharing files between UNIX and -Windows with Oplocks enabled on the Samba server: the UNIX process +cached. This parameter addresses sharing files between UNIX and +Windows with oplocks enabled on the Samba server: the UNIX process can open the file that is Oplocked (cached) by the Windows client and the smbd process will not send an oplock break, which exposes the file -to the risk of data corruption. If the UNIX kernel has the ability to +to the risk of data corruption. If the UNIX kernel has the ability to send an oplock break, then the kernel oplocks parameter enables Samba -to send the oplock break. Kernel oplocks are enabled on a per-server +to send the oplock break. Kernel oplocks are enabled on a per-server basis in the smb.conf file.

    -

    kernel oplocks = yes

    -The default is "no". +

    kernel oplocks = yes

    +The default is no.

    -Veto OpLocks is an smb.conf parameter that identifies specific files for -which Oplocks are disabled. When a Windows client opens a file that +Veto opLocks is an smb.conf parameter that identifies specific files for +which oplocks are disabled. When a Windows client opens a file that has been configured for veto oplocks, the client will not be granted the oplock, and all operations will be executed on the original file on -disk instead of a client-cached file copy. By explicitly identifying -files that are shared with UNIX processes, and disabling oplocks for +disk instead of a client-cached file copy. By explicitly identifying +files that are shared with UNIX processes and disabling oplocks for those files, the server-wide Oplock configuration can be enabled to allow Windows clients to utilize the performance benefit of file -caching without the risk of data corruption. Veto Oplocks can be +caching without the risk of data corruption. Veto Oplocks can be enabled on a per-share basis, or globally for the entire server, in the -smb.conf file: +smb.conf file as shown in .

    -

    Example 14.1. Share with some files oplocked

    [global]
    veto oplock files = /filename.htm/*.txt/
    [share_name]
    veto oplock files = /*.exe/filename.ext/

    +

    Example 14.1. Share with some files oplocked

    [global]
    veto oplock files = /filename.htm/*.txt/
    [share_name]
    veto oplock files = /*.exe/filename.ext/

    - oplock break wait time is an smb.conf parameter that adjusts the time -interval for Samba to reply to an oplock break request. Samba -recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND -UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Wait Time can only be -configured globally in the smb.conf file: +oplock break wait time is an smb.conf parameter +that adjusts the time interval for Samba to reply to an oplock break request. Samba recommends: +“Do not change this parameter unless you have read and understood the Samba oplock code.” +Oplock break Wait Time can only be configured globally in the smb.conf file as shown below.

    oplock break wait time = 0 (default)

    Oplock break contention limit is an smb.conf parameter that limits the response of the Samba server to grant an oplock if the configured -number of contending clients reaches the limit specified by the -parameter. Samba recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU -HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break -Contention Limit can be enable on a per-share basis, or globally for -the entire server, in the smb.conf file: -

    -

    Example 14.2. 

    [global]
    oplock break contention limit = 2 (default)
    [share_name]
    oplock break contention limit = 2 (default)

    -

    MS Windows Opportunistic Locking and Caching Controls

    +number of contending clients reaches the limit specified by the parameter. Samba recommends +“Do not change this parameter unless you have read and understood the Samba oplock code.” +Oplock break Contention Limit can be enable on a per-share basis, or globally for +the entire server, in the smb.conf file as shown in . +

    +

    Example 14.2. Configuration with oplock break contention limit

    [global]
    oplock break contention limit = 2 (default)
    [share_name]
    oplock break contention limit = 2 (default)

    +

    MS Windows Opportunistic Locking and Caching Controls

    There is a known issue when running applications (like Norton Anti-Virus) on a Windows 2000/ XP workstation computer that can affect any application attempting to access shared database files across a network. This is a result of a default setting configured in the Windows 2000/XP -operating system known as Opportunistic Locking. When a workstation +operating system known as opportunistic locking. When a workstation attempts to access shared data files located on another Windows 2000/XP computer, the Windows 2000/XP operating system will attempt to increase performance by locking the files and caching information locally. When this occurs, the application is unable to -properly function, which results in an Access Denied +properly function, which results in an “Access Denied” error message being displayed during network operations.

    All Windows operating systems in the NT family that act as database servers for data files (meaning that data files are stored there and accessed by other Windows PCs) may need to have opportunistic locking disabled in order to minimize the risk of data file corruption. -This includes Windows 9x/Me, Windows NT, Windows 200x and Windows XP. +This includes Windows 9x/Me, Windows NT, Windows 200x, and Windows XP.

    If you are using a Windows NT family workstation in place of a server, you must also disable opportunistic locking (oplocks) on that workstation. For example, if you use a @@ -5120,7 +5434,7 @@ The major difference is the location in the Windows registry where the values fo oplocks are entered. Instead of the LanManServer location, the LanManWorkstation location may be used.

    -You can verify (or change or add, if necessary) this Registry value using the Windows +You can verify (change or add, if necessary) this registry value using the Windows Registry Editor. When you change this registry value, you will have to reboot the PC to ensure that the new setting goes into effect.

    @@ -5158,75 +5472,75 @@ request opportunistic locks on a remote file. To disable oplocks, the value of The EnableOplocks value configures Windows-based servers (including Workstations sharing files) to allow or deny opportunistic locks on local files.

    -To force closure of open oplocks on close or program exit EnableOpLockForceClose must be set to 1. +To force closure of open oplocks on close or program exit, EnableOpLockForceClose must be set to 1.

    -An illustration of how level II oplocks work: +An illustration of how Level2 oplocks work:

    • - Station 1 opens the file, requesting oplock. + Station 1 opens the file requesting oplock.

    • Since no other station has the file open, the server grants station 1 exclusive oplock.

    • - Station 2 opens the file, requesting oplock. + Station 2 opens the file requesting oplock.

    • - Since station 1 has not yet written to the file, the server asks station 1 to Break - to Level II Oplock. + Since station 1 has not yet written to the file, the server asks station 1 to break + to Level2 oplock.

    • Station 1 complies by flushing locally buffered lock information to the server.

    • - Station 1 informs the server that it has Broken to Level II Oplock (alternatively, + Station 1 informs the server that it has Broken to Level2 Oplock (alternately, station 1 could have closed the file).

    • - The server responds to station 2's open request, granting it level II oplock. - Other stations can likewise open the file and obtain level II oplock. + The server responds to station 2's open request, granting it Level2 oplock. + Other stations can likewise open the file and obtain Level2 oplock.

    • Station 2 (or any station that has the file open) sends a write request SMB. The server returns the write response.

    • - The server asks all stations that have the file open to Break to None, meaning no + The server asks all stations that have the file open to break to none, meaning no station holds any oplock on the file. Because the workstations can have no cached writes or locks at this point, they need not respond to the break-to-none advisory; all they need do is invalidate locally cashed read-ahead data. -

    Workstation Service Entries

    +

    Workstation Service Entries

     	\HKEY_LOCAL_MACHINE\System\
 		CurrentControlSet\Services\LanmanWorkstation\Parameters
 
 	UseOpportunisticLocking   REG_DWORD   0 or 1
 	Default: 1 (true)

    -Indicates whether the redirector should use opportunistic-locking (oplock) performance +This indicates whether the redirector should use opportunistic-locking (oplock) performance enhancement. This parameter should be disabled only to isolate problems. -

    Server Service Entries

    +

    Server Service Entries

     	\HKEY_LOCAL_MACHINE\System\
 		CurrentControlSet\Services\LanmanServer\Parameters
 
 	EnableOplocks   REG_DWORD   0 or 1
 	Default: 1 (true)

    -Specifies whether the server allows clients to use oplocks on files. Oplocks are a +This specifies whether the server allows clients to use oplocks on files. Oplocks are a significant performance enhancement, but have the potential to cause lost cached -data on some networks, particularly wide-area networks. +data on some networks, particularly wide area networks. 

     	MinLinkThroughput   REG_DWORD   0 to infinite bytes per second
 	Default: 0

    -Specifies the minimum link throughput allowed by the server before it disables +This specifies the minimum link throughput allowed by the server before it disables raw and opportunistic locks for this connection. 

     	MaxLinkDelay   REG_DWORD   0 to 100,000 seconds
 	Default: 60

    -Specifies the maximum time allowed for a link delay. If delays exceed this number, +This specifies the maximum time allowed for a link delay. If delays exceed this number, the server disables raw I/O and opportunistic locking for this connection. 

     	OplockBreakWait   REG_DWORD   10 to 180 seconds
 	Default: 35

    -Specifies the time that the server waits for a client to respond to an oplock break +This specifies the time that the server waits for a client to respond to an oplock break request. Smaller values can allow detection of crashed clients more quickly but can potentially cause loss of cached data. -

    Persistent Data Corruption

    +

    Persistent Data Corruption

    If you have applied all of the settings discussed in this chapter but data corruption problems -and other symptoms persist, here are some additional things to check out: +and other symptoms persist, here are some additional things to check out.

    We have credible reports from developers that faulty network hardware, such as a single faulty network card, can cause symptoms similar to read caching and data corruption. @@ -5235,398 +5549,383 @@ rebuild the data files in question. This involves creating a new data file with same definition as the file to be rebuilt and transferring the data from the old file to the new one. There are several known methods for doing this that can be found in our Knowledge Base. -

    Common Errors

    -In some sites locking problems surface as soon as a server is installed, in other sites +

    Common Errors

    +In some sites, locking problems surface as soon as a server is installed; in other sites locking problems may not surface for a long time. Almost without exception, when a locking problem does surface it will cause embarrassment and potential data corruption.

    -Over the past few years there have been a number of complaints on the samba mailing lists -that have claimed that samba caused data corruption. Three causes have been identified +Over the past few years there have been a number of complaints on the Samba mailing lists +that have claimed that Samba caused data corruption. Three causes have been identified so far:

    • Incorrect configuration of opportunistic locking (incompatible with the application - being used. This is a VERY common problem even where MS Windows NT4 or MS Windows 200x - based servers were in use. It is imperative that the software application vendors' + being used. This is a common problem even where MS Windows NT4 or MS Windows + 200x-based servers were in use. It is imperative that the software application vendors' instructions for configuration of file locking should be followed. If in doubt, disable oplocks on both the server and the client. Disabling of all forms of file caching on the MS Windows client may be necessary also.

    • - Defective network cards, cables, or HUBs / Switched. This is generally a more - prevalent factor with low cost networking hardware, though occasionally there - have been problems with incompatibilities in more up market hardware also. -

    • - There have been some random reports of samba log files being written over data - files. This has been reported by very few sites (about 5 in the past 3 years) - and all attempts to reproduce the problem have failed. The Samba-Team has been - unable to catch this happening and thus has NOT been able to isolate any particular - cause. Considering the millions of systems that use samba, for the sites that have - been affected by this as well as for the Samba-Team this is a frustrating and - a vexing challenge. If you see this type of thing happening please create a bug - report on https://bugzilla.samba.org without delay. Make sure that you give as much - information as you possibly can to help isolate the cause and to allow reproduction - of the problem (an essential step in problem isolation and correction). -

    locking.tdb error messages

    + Defective network cards, cables, or HUBs/Switched. This is generally a more + prevalent factor with low cost networking hardware, although occasionally there + have also been problems with incompatibilities in more up-market hardware. +

  • + There have been some random reports of Samba log files being written over data + files. This has been reported by very few sites (about five in the past three years) + and all attempts to reproduce the problem have failed. The Samba Team has been + unable to catch this happening and thus has not been able to isolate any particular + cause. Considering the millions of systems that use Samba, for the sites that have + been affected by this as well as for the Samba Team this is a frustrating and + a vexing challenge. If you see this type of thing happening, please create a bug + report on Samba Bugzilla without delay. + Make sure that you give as much information as you possibly can help isolate the + cause and to allow replication of the problem (an essential step in problem isolation and correction). +

    • locking.tdb Error Messages

    “ - We are seeing lots of errors in the samba logs like: -” -

    +	We are seeing lots of errors in the Samba logs, like:
+
     tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic
  0x4d6f4b61 at offset=36116
-
    
-“
+
    + What do these mean? ”

    - Corrupted tdb. Stop all instances of smbd, delete locking.tdb, restart smbd. -

    Problems saving files in MS Office on Windows XP

    This is a bug in Windows XP. More information can be - found in Microsoft Knowledge Base article 812937.

    Long delays deleting files over network with XP SP1

    “It sometimes takes approximately 35 seconds to delete files over the network after XP SP1 has been applied”

    This is a bug in Windows XP. More information can be - found in - Microsoft Knowledge Base article 811492.

    Additional Reading

    + This error indicated a corrupted tdb. Stop all instances of smbd, delete locking.tdb, and restart smbd. +

    Problems Saving Files in MS Office on Windows XP

    This is a bug in Windows XP. More information can be + found in Microsoft Knowledge Base article 812937.

    Long Delays Deleting Files Over Network with XP SP1

    “It sometimes takes approximately 35 seconds to delete files over the network after XP SP1 has been applied.”

    This is a bug in Windows XP. More information can be found in + Microsoft Knowledge Base article 811492.

    Additional Reading

    You may want to check for an updated version of this white paper on our Web site from time to time. Many of our white papers are updated as information changes. For those papers, -the Last Edited date is always at the top of the paper. +the last edited date is always at the top of the paper.

    Section of the Microsoft MSDN Library on opportunistic locking:

    Opportunistic Locks, Microsoft Developer Network (MSDN), Windows Development > Windows Base Services > Files and I/O > SDK Documentation > File Storage > File Systems > About File Systems > Opportunistic Locks, Microsoft Corporation. -http://msdn.microsoft.com/library/en-us/fileio/storage_5yk3.asp +http://msdn.microsoft.com/library/en-us/fileio/storage_5yk3.asp

    -Microsoft Knowledge Base Article Q224992 "Maintaining Transactional Integrity with OPLOCKS", -Microsoft Corporation, April 1999, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q224992. + Microsoft Knowledge Base Article Q224992 “Maintaining Transactional Integrity +with OPLOCKS”, +Microsoft Corporation, April 1999, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q224992.

    -Microsoft Knowledge Base Article Q296264 "Configuring Opportunistic Locking in Windows 2000", -Microsoft Corporation, April 2001, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296264. +Microsoft Knowledge Base Article Q296264 “Configuring Opportunistic Locking in Windows 2000”, +Microsoft Corporation, April 2001, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296264.

    -Microsoft Knowledge Base Article Q129202 "PC Ext: Explanation of Opportunistic Locking on Windows NT", - Microsoft Corporation, April 1995, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202. -

    Chapter 15. Securing Samba

    Andrew Tridgell

    Samba Team

    John H. Terpstra

    Samba Team

    May 26, 2003

    Table of Contents

    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?

    Introduction

    +Microsoft Knowledge Base Article Q129202 “PC Ext: Explanation of Opportunistic Locking on Windows NT”, +Microsoft Corporation, April 1995, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202. +

    Chapter 15. Securing Samba

    Andrew Tridgell

    Samba Team

    John H. Terpstra

    Samba Team

    May 26, 2003

    Table of Contents

    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using Host-Based Protection
    User-Based Protection
    Using Interface Protection
    Using a Firewall
    Using IPC$ Share-Based Denials
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient Works on Localhost, but the Network Is Dead
    Why Can Users Access Home Directories of Other Users?

    Introduction

    This note was attached to the Samba 2.2.8 release notes as it contained an -important security fix. The information contained here applies to Samba +important security fix. The information contained here applies to Samba installations in general. -

    -A new apprentice reported for duty to the Chief Engineer of a boiler house. He said, "Here I am, -if you will show me the boiler I'll start working on it." Then engineer replied, "You're leaning -on it!" -

    -Security concerns are just like that: You need to know a little about the subject to appreciate +

    +A new apprentice reported for duty to the chief engineer of a boiler house. He said, “Here I am, +if you will show me the boiler I'll start working on it.” Then engineer replied, “You're leaning +on it!” +

    +Security concerns are just like that. You need to know a little about the subject to appreciate how obvious most of it really is. The challenge for most of us is to discover that first morsel of knowledge with which we may unlock the secrets of the masters. -

    Features and Benefits

    -There are three level at which security principals must be observed in order to render a site -at least moderately secure. These are: the perimeter firewall, the configuration of the host -server that is running Samba, and Samba itself. +

    Features and Benefits

    +There are three levels at which security principals must be observed in order to render a site +at least moderately secure. They are the perimeter firewall, the configuration of the host +server that is running Samba and Samba itself.

    Samba permits a most flexible approach to network security. As far as possible Samba implements the latest protocols to permit more secure MS Windows file and print operations.

    Samba may be secured from connections that originate from outside the local network. This may be -done using host based protection (using samba's implementation of a technology -known as "tcpwrappers", or it may be done be using interface based exclusion -so that smbd will bind only to specifically permitted interfaces. It is also -possible to set specific share or resource based exclusions, eg: on the [IPC$] +done using host-based protection (using samba's implementation of a technology +known as “tcpwrappers,” or it may be done be using interface-based exclusion +so smbd will bind only to specifically permitted interfaces. It is also +possible to set specific share or resource-based exclusions, for example on the [IPC$] auto-share. The [IPC$] share is used for browsing purposes as well as to establish TCP/IP connections.

    -Another method by which Samba may be secured is by way of setting Access Control Entries in an Access -Control List on the shares themselves. This is discussed in the chapter on File, Directory and Share Access -Control. -

    Technical Discussion of Protective Measures and Issues

    +Another method by which Samba may be secured is by setting Access Control Entries (ACEs) in an Access +Control List (ACL) on the shares themselves. This is discussed in . +

    Technical Discussion of Protective Measures and Issues

    The key challenge of security is the fact that protective measures suffice at best only to close the door on known exploits and breach techniques. Never assume that because you have followed these few measures that the Samba server is now an impenetrable fortress! Given the history of information systems so far, it is only a matter of time before someone will find yet another vulnerability. -

    Using host based protection

    - In many installations of Samba the greatest threat comes for outside - your immediate network. By default Samba will accept connections from +

    Using Host-Based Protection

    + In many installations of Samba, the greatest threat comes from outside + your immediate network. By default, Samba will accept connections from any host, which means that if you run an insecure version of Samba on a host that is directly connected to the Internet you can be especially vulnerable.

    - One of the simplest fixes in this case is to use the hosts allow and - hosts deny options in the Samba smb.conf configuration file to only - allow access to your server from a specific range of hosts. An example - might be: + One of the simplest fixes in this case is to use the hosts allow and + hosts deny options in the Samba smb.conf configuration file to only + allow access to your server from a specific range of hosts. An example might be:

    hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
    hosts deny = 0.0.0.0/0

    - The above will only allow SMB connections from 'localhost' (your own - computer) and from the two private networks 192.168.2 and - 192.168.3. All other connections will be refused as soon - as the client sends its first packet. The refusal will be marked as a - not listening on called name error. -

    User based protection

    - If you want to restrict access to your server to valid users only then the following + The above will only allow SMB connections from localhost (your own + computer) and from the two private networks 192.168.2 and 192.168.3. All other + connections will be refused as soon as the client sends its first packet. The refusal + will be marked as not listening on called name error. +

    User-Based Protection

    + If you want to restrict access to your server to valid users only, then the following method may be of use. In the smb.conf [global] section put:

    valid users = @smbusers, jacko

    - What this does is, it restricts all server access to either the user jacko + This restricts all server access to either the user jacko or to members of the system group smbusers. -

    Using interface protection

    - By default Samba will accept connections on any network interface that +

    Using Interface Protection

    + By default, Samba will accept connections on any network interface that it finds on your system. That means if you have a ISDN line or a PPP connection to the Internet then Samba will accept connections on those links. This may not be what you want.

    - You can change this behaviour using options like the following: + You can change this behavior using options like this:

    interfaces = eth* lo
    bind interfaces only = yes

    This tells Samba to only listen for connections on interfaces with a - name starting with 'eth' such as eth0, eth1, plus on the loopback - interface called 'lo'. The name you will need to use depends on what - OS you are using, in the above I used the common name for Ethernet + name starting with eth such as eth0, eth1 plus on the loopback + interface called lo. The name you will need to use depends on what + OS you are using. In the above, I used the common name for Ethernet adapters on Linux.

    - If you use the above and someone tries to make a SMB connection to - your host over a PPP interface called 'ppp0' then they will get a TCP - connection refused reply. In that case no Samba code is run at all as + If you use the above and someone tries to make an SMB connection to + your host over a PPP interface called ppp0, then they will get a TCP + connection refused reply. In that case, no Samba code is run at all as the operating system has been told not to pass connections from that - interface to any samba process. -

    Using a firewall

    - Many people use a firewall to deny access to services that they don't - want exposed outside their network. This can be a very good idea, - although I would recommend using it in conjunction with the above - methods so that you are protected even if your firewall is not active + interface to any Samba process. +

    Using a Firewall

    + Many people use a firewall to deny access to services they do not + want exposed outside their network. This can be a good idea, + although I recommend using it in conjunction with the above + methods so you are protected even if your firewall is not active for some reason.

    - If you are setting up a firewall then you need to know what TCP and + If you are setting up a firewall, you need to know what TCP and UDP ports to allow and block. Samba uses the following:

    UDP/137 - used by nmbd
    UDP/138 - used by nmbd
    TCP/139 - used by smbd
    TCP/445 - used by smbd

    The last one is important as many older firewall setups may not be aware of it, given that this port was only added to the protocol in recent years. -

    Using a IPC$ share deny

    +

    Using IPC$ Share-Based Denials

    If the above methods are not suitable, then you could also place a more specific deny on the IPC$ share that is used in the recently discovered security hole. This allows you to offer access to other shares while denying access to IPC$ from potentially untrustworthy hosts.

    - To do that you could use: -

    [ipc$]
    hosts allow = 192.168.115.0/24 127.0.0.1
    hosts deny = 0.0.0.0/0

    - this would tell Samba that IPC$ connections are not allowed from - anywhere but the two listed places (localhost and a local - subnet). Connections to other shares would still be allowed. As the - IPC$ share is the only share that is always accessible anonymously + To do this you could use: +

    [IPC$]
    hosts allow = 192.168.115.0/24 127.0.0.1
    hosts deny = 0.0.0.0/0

    + This instructs Samba that IPC$ connections are not allowed from + anywhere except from the two listed network addresses (localhost and the 192.168.115 + subnet). Connections to other shares are still allowed. As the + IPC$ share is the only share that is always accessible anonymously, this provides some level of protection against attackers that do not - know a username/password for your host. -

    - If you use this method then clients will be given a access denied - reply when they try to access the IPC$ share. That means that those - clients will not be able to browse shares, and may also be unable to - access some other resources. + know a valid username/password for your host.

    - This is not recommended unless you cannot use one of the other - methods listed above for some reason. -

    NTLMv2 Security

    - To configure NTLMv2 authentication the following registry keys are worth knowing about: + If you use this method, then clients will be given an `access denied' + reply when they try to access the IPC$ share. Those clients will not be able to + browse shares, and may also be unable to access some other resources. This is not + recommended unless you cannot use one of the other methods listed above for some reason. +

    NTLMv2 Security

    + To configure NTLMv2 authentication, the following registry keys are worth knowing about: 

     		[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
 		"lmcompatibilitylevel"=dword:00000003

    - 0x3 - Send NTLMv2 response only. Clients will use NTLMv2 authentication, - use NTLMv2 session security if the server supports it. Domain - controllers accept LM, NTLM and NTLMv2 authentication. + The value 0x00000003 means send NTLMv2 response only. Clients will use NTLMv2 authentication, + use NTLMv2 session security if the server supports it. Domain Controllers accept LM, + NTLM and NTLMv2 authentication. 

     		[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
 		"NtlmMinClientSec"=dword:00080000

    - 0x80000 - NTLMv2 session security. If either NtlmMinClientSec or - NtlmMinServerSec is set to 0x80000, the connection will fail if NTLMv2 - session security is not negotiated. -

    Upgrading Samba

    -Please check regularly on http://www.samba.org/ for updates and -important announcements. Occasionally security releases are made and + The value 0x00080000 means permit only NTLMv2 session security. If either NtlmMinClientSec or + NtlmMinServerSec is set to 0x00080000, the connection will fail if NTLMv2 + session security is not negotiated. +

    Upgrading Samba

    +Please check regularly on http://www.samba.org/ for updates and +important announcements. Occasionally security releases are made and it is highly recommended to upgrade Samba when a security vulnerability is discovered. Check with your OS vendor for OS specific upgrades. -

    Common Errors

    -If all of samba and host platform configuration were really as intuitive as one might like then this +

    Common Errors

    +If all of Samba and host platform configuration were really as intuitive as one might like them to be, this section would not be necessary. Security issues are often vexing for a support person to resolve, not -because of the complexity of the problem, but for reason that most administrators who post what turns +because of the complexity of the problem, but for the reason that most administrators who post what turns out to be a security problem request are totally convinced that the problem is with Samba. -

    Smbclient works on localhost, but the network is dead

    - This is a very common problem. Red Hat Linux (as do others) will install a default firewall. - With the default firewall in place only traffic on the loopback adapter (IP address 127.0.0.1) - will be allowed through the firewall. +

    Smbclient Works on Localhost, but the Network Is Dead

    + This is a common problem. Red Hat Linux (and others) installs a default firewall. + With the default firewall in place, only traffic on the loopback adapter (IP address 127.0.0.1) + is allowed through the firewall.

    - The solution is either to remove the firewall (stop it) or to modify the firewall script to + The solution is either to remove the firewall (stop it) or modify the firewall script to allow SMB networking traffic through. See section above in this chapter. -

    Why can users access home directories of other users?

    +

    Why Can Users Access Home Directories of Other Users?

    “ We are unable to keep individual users from mapping to any other user's home directory once they have supplied a valid password! They only need - to enter their own password. I have not found *any* method that I can - use to configure samba to enforce that only a user may map their own - home directory. + to enter their own password. I have not found any method to configure + Samba so that users may map only their own home directory. ”

    “ User xyzzy can map his home directory. Once mapped user xyzzy can also map - *anyone* else's home directory! + anyone else's home directory. ”

    - This is not a security flaw, it is by design. Samba allows - users to have *exactly* the same access to the UNIX filesystem - as they would if they were logged onto the UNIX box, except - that it only allows such views onto the file system as are - allowed by the defined shares. -

    - This means that if your UNIX home directories are set up - such that one user can happily cd into another users - directory and do an ls, the UNIX security solution is to - change the UNIX file permissions on the users home directories - such that the cd and ls would be denied. -

    - Samba tries very hard not to second guess the UNIX administrators - security policies, and trusts the UNIX admin to set - the policies and permissions he or she desires. -

    - Samba does allow the setup you require when you have set the - only user = yes option on the share, is that you have not set the - valid users list for the share. -

    - Note that only user works in conjunction with the users= list, + This is not a security flaw, it is by design. Samba allows users to have + exactly the same access to the UNIX file system as when they were logged + onto the UNIX box, except that it only allows such views onto the file + system as are allowed by the defined shares. +

    + If your UNIX home directories are set up so that one user can happily cd + into another users directory and execute ls, the UNIX security solution is to change file + permissions on the user's home directories such that the cd and ls are denied. +

    + Samba tries very hard not to second guess the UNIX administrators security policies, and + trusts the UNIX admin to set the policies and permissions he or she desires. +

    + Samba allows the behavior you require. Simply put the only user = %S + option in the [homes] share definition. +

    + The only user works in conjunction with the users = list, so to get the behavior you require, add the line :

    users = %S

    - this is equivalent to: + this is equivalent to adding

    valid users = %S

    to the definition of the [homes] share, as recommended in the smb.conf man page. -

    Chapter 16. Interdomain Trust Relationships

    John H. Terpstra

    Samba Team

    Rafal Szczesniak

    Samba Team

    Jelmer R. Vernooij

    drawing
    The Samba Team

    Stephen Langasek

    April 3, 2003

    Table of Contents

    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-style Domain Trusts with Windows 2000
    Common Errors

    -Samba-3 supports NT4 style domain trust relationships. This is feature that many sites -will want to use if they migrate to Samba-3 from and NT4 style domain and do NOT want to -adopt Active Directory or an LDAP based authentication back end. This section explains +

    Chapter 16. Interdomain Trust Relationships

    John H. Terpstra

    Samba Team

    Rafal Szczesniak

    Samba Team

    Jelmer R. Vernooij

    drawing
    The Samba Team

    Stephen Langasek

    April 3, 2003

    Table of Contents

    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-Style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-Style Domain Trusts with Windows 2000
    Common Errors

    + +Samba-3 supports NT4-style domain trust relationships. This is a feature that many sites +will want to use if they migrate to Samba-3 from an NT4-style domain and do not want to +adopt Active Directory or an LDAP-based authentication backend. This section explains some background information regarding trust relationships and how to create them. It is now -possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba3-to-Samba3 +possible for Samba-3 to trust NT4 (and vice versa), as well as to create Samba-to-Samba trusts. -

    Features and Benefits

    -Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4 style -trust relationships. This imparts to Samba similar scalability as is possible with -MS Windows NT4. +

    Features and Benefits

    +Samba-3 can participate in Samba-to-Samba as well as in Samba-to-MS Windows NT4-style +trust relationships. This imparts to Samba similar scalability as with MS Windows NT4.

    Given that Samba-3 has the capability to function with a scalable backend authentication -database such as LDAP, and given it's ability to run in Primary as well as Backup Domain control +database such as LDAP, and given its ability to run in Primary as well as Backup Domain Control modes, the administrator would be well advised to consider alternatives to the use of Interdomain trusts simply because by the very nature of how this works it is fragile. That was, after all, a key reason for the development and adoption of Microsoft Active Directory. -

    Trust Relationship Background

    -MS Windows NT3.x/4.0 type security domains employ a non-hierarchical security structure. -The limitations of this architecture as it affects the scalability of MS Windows networking -in large organisations is well known. Additionally, the flat namespace that results from +

    Trust Relationship Background

    +MS Windows NT3/4 type security domains employ a non-hierarchical security structure. +The limitations of this architecture as it effects the scalability of MS Windows networking +in large organizations is well known. Additionally, the flat namespace that results from this design significantly impacts the delegation of administrative responsibilities in -large and diverse organisations. +large and diverse organizations.

    Microsoft developed Active Directory Service (ADS), based on Kerberos and LDAP, as a means -of circumventing the limitations of the older technologies. Not every organisation is ready -or willing to embrace ADS. For small companies the older NT4 style domain security paradigm -is quite adequate, there thus remains an entrenched user base for whom there is no direct +of circumventing the limitations of the older technologies. Not every organization is ready +or willing to embrace ADS. For small companies the older NT4-style domain security paradigm +is quite adequate, there remains an entrenched user base for whom there is no direct desire to go through a disruptive change to adopt ADS.

    -Microsoft introduced with MS Windows NT the ability to allow differing security domains -to affect a mechanism so that users from one domain may be given access rights and privileges +With MS Windows NT, Microsoft introduced the ability to allow differing security domains +to effect a mechanism so users from one domain may be given access rights and privileges in another domain. The language that describes this capability is couched in terms of Trusts. Specifically, one domain will trust the users from another domain. The domain from which users are available to another security domain is said to be a trusted domain. The domain in which those users have assigned rights and privileges is the trusting domain. With NT3.x/4.0 all trust relationships are always in one direction only, thus if users in both domains are to have privileges and rights in each others' domain, then it is -necessary to establish two (2) relationships, one in each direction. +necessary to establish two relationships, one in each direction.

    -In an NT4 style MS security domain, all trusts are non-transitive. This means that if there -are three (3) domains (let's call them RED, WHITE, and BLUE) where RED and WHITE have a trust +In an NT4-style MS security domain, all trusts are non-transitive. This means that if there +are three domains (let's call them RED, WHITE and BLUE) where RED and WHITE have a trust relationship, and WHITE and BLUE have a trust relationship, then it holds that there is no -implied trust between the RED and BLUE domains. ie: Relationships are explicit and not +implied trust between the RED and BLUE domains. Relationships are explicit and not transitive.

    - New to MS Windows 2000 ADS security contexts is the fact that trust relationships are two-way by default. Also, all inter-ADS domain trusts are transitive. In the case of the RED, WHITE and BLUE -domains above, with Windows 2000 and ADS the RED and BLUE domains CAN trust each other. This is -an inherent feature of ADS domains. Samba-3 implements MS Windows NT4 -style Interdomain trusts and interoperates with MS Windows 200x ADS -security domains in similar manner to MS Windows NT4 style domains. -

    Native MS Windows NT4 Trusts Configuration

    -There are two steps to creating an interdomain trust relationship. To effect a two-way trust -relationship it is necessary for each domain administrator to create a trust account for the +domains above, with Windows 2000 and ADS the RED and BLUE domains can trust each other. This is +an inherent feature of ADS domains. Samba-3 implements MS Windows NT4-style Interdomain trusts +and interoperates with MS Windows 200x ADS security domains in similar manner to MS Windows NT4-style domains. +

    Native MS Windows NT4 Trusts Configuration

    +There are two steps to creating an interdomain trust relationship. To effect a two-way trust +relationship, it is necessary for each domain administrator to create a trust account for the other domain to use in verifying security credentials. - - -

    Creating an NT4 Domain Trust

    + +

    Creating an NT4 Domain Trust

    For MS Windows NT4, all domain trust relationships are configured using the Domain User Manager. This is done from the Domain User Manager Policies entry on the menu bar. From the Policy menu, select -Trust Relationships. Next to the lower box labelled +Trust Relationships. Next to the lower box labeled Permitted to Trust this Domain are two buttons, Add and Remove. The Add button will open a panel in which to enter the name of the remote domain that will be able to assign access rights to users in -your domain. You will also need to enter a password for this trust relationship, which the +your domain. You will also need to enter a password for this trust relationship, which the trusting domain will use when authenticating users from the trusted domain. The password needs to be typed twice (for standard confirmation). -

    Completing an NT4 Domain Trust

    - +

    Completing an NT4 Domain Trust

    + A trust relationship will work only when the other (trusting) domain makes the appropriate connections -with the trusted domain. To consummate the trust relationship the administrator will launch the -Domain User Manager, from the menu select Policies, then select Trust Relationships, then click on the -Add button that is next to the box that is labelled -Trusted Domains. A panel will open in which must be entered the name of the remote -domain as well as the password assigned to that trust. -

    Inter-Domain Trust Facilities

    +with the trusted domain. To consummate the trust relationship, the administrator will launch the +Domain User Manager from the menu select Policies, then select +Trust Relationships, click on the Add button +next to the box that is labeled Trusted Domains. A panel will open in which +must be entered the name of the remote domain as well as the password assigned to that trust. +

    Inter-Domain Trust Facilities

    + A two-way trust relationship is created when two one-way trusts are created, one in each direction. Where a one-way trust has been established between two MS Windows NT4 domains (let's call them -DomA and DomB) the following facilities are created: -

    Figure 16.1. Trusts overview

    Trusts overview

    • - DomA (completes the trust connection) Trusts DomB +DomA and DomB), the following facilities are created: +

      Figure 16.1. Trusts overview.

      Trusts overview.

      • + DomA (completes the trust connection) Trusts DomB.

      • - DomA is the Trusting domain + DomA is the Trusting domain.

      • - DomB is the Trusted domain (originates the trust account) + DomB is the Trusted domain (originates the trust account).

      • - Users in DomB can access resources in DomA + Users in DomB can access resources in DomA.

      • - Users in DomA can NOT access resources in DomB + Users in DomA cannot access resources in DomB.

      • - Global groups from DomB CAN be used in DomA + Global groups from DomB can be used in DomA.

      • - Global groups from DomA can NOT be used in DomB + Global groups from DomA cannot be used in DomB.

      • - DomB DOES appear in the logon dialog box on client workstations in DomA + DomB does appear in the logon dialog box on client workstations in DomA.

      • - DomA does NOT appear in the logon dialog box on client workstations in DomB + DomA does not appear in the logon dialog box on client workstations in DomB.

      • - Users / Groups in a trusting domain can NOT be granted rights, permissions or access + Users/Groups in a trusting domain cannot be granted rights, permissions or access to a trusted domain.

      • - The trusting domain CAN access and use accounts (Users / Global Groups) in the + The trusting domain can access and use accounts (Users/Global Groups) in the trusted domain.

      • - Administrators of the trusted domain CAN be granted admininstrative rights in the + Administrators of the trusted domain can be granted admininstrative rights in the trusting domain.

      • - Users in a trusted domain CAN be given rights and privileges in the trusting + Users in a trusted domain can be given rights and privileges in the trusting domain.

      • - Trusted domain Global Groups CAN be given rights and permissions in the trusting + Trusted domain Global Groups can be given rights and permissions in the trusting domain.

      • - Global Groups from the trusted domain CAN be made members in Local Groups on - MS Windows domain member machines. -

    Configuring Samba NT-style Domain Trusts

    + Global Groups from the trusted domain can be made members in Local Groups on + MS Windows Domain Member machines. +

    Configuring Samba NT-Style Domain Trusts

    This description is meant to be a fairly short introduction about how to set up a Samba server so -that it could participate in interdomain trust relationships. Trust relationship support in Samba -is in its early stage, so lot of things don't work yet. +that it can participate in interdomain trust relationships. Trust relationship support in Samba +is at an early stage, so do not be surprised if something does not function as it should.

    Each of the procedures described below assumes the peer domain in the trust relationship is -controlled by a Windows NT4 server. However, the remote end could just as well be another +controlled by a Windows NT4 server. However, the remote end could just as well be another Samba-3 domain. It can be clearly seen, after reading this document, that combining Samba-specific parts of what's written below leads to trust between domains in a purely Samba environment.

    Samba as the Trusted Domain

    -In order to set the Samba PDC to be the trusted party of the relationship you first need +In order to set the Samba PDC to be the trusted party of the relationship, you first need to create a special account for the domain that will be the trusting party. To do that, -you can use the 'smbpasswd' utility. Creating the trusted domain account is very +you can use the smbpasswd utility. Creating the trusted domain account is similar to creating a trusted machine account. Suppose, your domain is called SAMBA, and the remote domain is called RUMBA. The first step -will be to issue this command from your favourite shell: +will be to issue this command from your favorite shell: 

     root#  smbpasswd -a -i rumba
@@ -5636,286 +5935,297 @@ Added user rumba$

    where -a means to add a new account into the -passdb database and -i means: ''create this -account with the InterDomain trust flag'' +passdb database and -i means: “create this +account with the InterDomain trust flag”.

    -The account name will be 'rumba$' (the name of the remote domain) +The account name will be “rumba$” (the name of the remote domain).

    -After issuing this command you'll be asked to enter the password for +After issuing this command, you will be asked to enter the password for the account. You can use any password you want, but be aware that Windows NT will -not change this password until 7 days following account creation. +not change this password until seven days following account creation. After the command returns successfully, you can look at the entry for the new account (in the standard way as appropriate for your configuration) and see that account's name is -really RUMBA$ and it has the 'I' flag set in the flags field. Now you're ready to confirm +really RUMBA$ and it has the “I” flag set in the flags field. Now you are ready to confirm the trust by establishing it from Windows NT Server. -

    +

    + Open User Manager for Domains and from the Policies menu, select Trust Relationships.... -Right beside the Trusted domains list box press the +Beside the Trusted domains list box click the Add... button. You will be prompted for the trusted domain name and the relationship password. Type in SAMBA, as this is -the name of the remote domain, and the password used at the time of account creation. -Press OK and, if everything went without incident, you will see -Trusted domain relationship successfully +the name of the remote domain and the password used at the time of account creation. +Click on OK and, if everything went without incident, you will see +the Trusted domain relationship successfully established message. -

    Samba as the Trusting Domain

    +

    Samba as the Trusting Domain

    This time activities are somewhat reversed. Again, we'll assume that your domain -controlled by the Samba PDC is called SAMBA and NT-controlled domain is called RUMBA. +controlled by the Samba PDC is called SAMBA and the NT-controlled domain is called RUMBA.

    The very first step is to add an account for the SAMBA domain on RUMBA's PDC. -

    +

    + Launch the Domain User Manager, then from the menu select Policies, Trust Relationships. Now, next to the Trusted Domains box press the Add -button, and type in the name of the trusted domain (SAMBA) and the password to use in securing +button and type in the name of the trusted domain (SAMBA) and the password to use in securing the relationship.

    The password can be arbitrarily chosen. It is easy to change the password from the Samba server whenever you want. After confirming the password your account is -ready for use. Now it's Samba's turn. +ready for use. Now its Samba's turn.

    -Using your favourite shell while being logged in as root, issue this command: +Using your favorite shell while being logged in as root, issue this command:

    root# net rpc trustdom establish rumba

    You will be prompted for the password you just typed on your Windows NT4 Server box. -Do not worry if you see an error message that mentions a return code of -NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT. It means the -password you gave is correct and the NT4 Server says the account is -ready for interdomain connection and not for ordinary -connection. After that, be patient; it can take a while (especially -in large networks), but eventually you should see the Success message. -Congratulations! Your trust relationship has just been established. +An error message `NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT' +that may be reported periodically is of no concern and may safely be ignored. +It means the password you gave is correct and the NT4 Server says the account is ready for +interdomain connection and not for ordinary connection. After that, be patient; +it can take a while (especially in large networks), but eventually you should see +the Success message. Congratulations! Your trust +relationship has just been established.

    Note

    -Note that you have to run this command as root because you must have write access to +You have to run this command as root because you must have write access to the secrets.tdb file. -

    NT4-style Domain Trusts with Windows 2000

    +

    NT4-Style Domain Trusts with Windows 2000

    Although Domain User Manager is not present in Windows 2000, it is also possible to establish an NT4-style trust relationship with a Windows 2000 domain -controller running in mixed mode as the trusting server. It should also be possible for +controller running in mixed mode as the trusting server. It should also be possible for Samba to trust a Windows 2000 server, however, more testing is still needed in this area.

    -After creating the interdomain trust account on the -Samba server as described above, open Active Directory Domains and +After as described above, open Active Directory Domains and Trusts on the AD controller of the domain whose resources you wish Samba users -to have access to. Remember that since NT4-style trusts are not transitive, if you want +to have access to. Remember that since NT4-style trusts are not transitive, if you want your users to have access to multiple mixed-mode domains in your AD forest, you will need to -repeat this process for each of those domains. With Active Directory Domains +repeat this process for each of those domains. With Active Directory Domains and Trusts open, right-click on the name of the Active Directory domain that -will trust our Samba domain and choose Properties, then click on -the Trusts tab. In the upper part of the panel, you will see a list box -labelled Domains trusted by this domain:, and an -Add... button next to it. Press this button, and just as with NT4, you -will be prompted for the trusted domain name and the relationship password. Press OK, and +will trust our Samba domain and choose Properties, then click on +the Trusts tab. In the upper part of the panel, you will see a list box +labeled Domains trusted by this domain:, and an +Add... button next to it. Press this button and just as with NT4, you +will be prompted for the trusted domain name and the relationship password. Press OK and after a moment, Active Directory will respond with The trusted domain has been added and the trust has been verified. Your Samba users can now be granted acess to resources in the AD domain. -

    Common Errors

    -Interdomain trust relationships should NOT be attempted on networks that are unstable +

    Common Errors

    +Interdomain trust relationships should not be attempted on networks that are unstable or that suffer regular outages. Network stability and integrity are key concerns with distributed trusted domains.

    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba

    Shirish Kalele

    Samba Team & Veritas Software



    -

    12 Jul 2000

    Table of Contents

    Features and Benefits
    Common Errors

    Features and Benefits

    - The Distributed File System (or DFS) provides a means of separating the logical +

    John H. Terpstra

    Samba Team

    12 Jul 2000

    Table of Contents

    Features and Benefits
    Common Errors
    MSDFS UNIX Path Is Case-Critical

    Features and Benefits

    + The Distributed File System (DFS) provides a means of separating the logical view of files and directories that users see from the actual physical locations of these resources on the network. It allows for higher availability, smoother - storage expansion, load balancing etc. + storage expansion, load balancing, and so on.

    For information about DFS, refer to the -Microsoft documentation. -

    +Microsoft documentation. This document explains how to host a DFS tree on a UNIX machine (for DFS-aware clients to browse) using Samba.

    - To enable SMB-based DFS for Samba, configure it with the --with-msdfs + To enable SMB-based DFS for Samba, configure it with the --with-msdfs option. Once built, a Samba server can be made a DFS server by setting the global - boolean host msdfs + Boolean host msdfs parameter in the smb.conf file. You designate a share as a DFS - root using the share level boolean msdfs root parameter. A DFS root directory on Samba hosts DFS + root using the Share Level Boolean msdfs root parameter. A DFS root directory on Samba hosts DFS links in the form of symbolic links that point to other servers. For example, a symbolic link junction->msdfs:storage1\share1 in the share directory acts as the DFS junction. When DFS-aware clients attempt to access the junction link, - they are redirected to the storage location (in this case, \\storage1\share1). + they are redirected to the storage location (in this case, \\storage1\share1).

    DFS trees on Samba work with all DFS-aware clients ranging from Windows 95 to 200x. -

    - Here's an example of setting up a DFS tree on a Samba server. -

    Example 17.1. smb.conf with DFS configured

    [global]
    netbios name = GANDALF
    host msdfs = yes
    [dfs]
    path = /export/dfsroot
    msdfs root = yes

    In the /export/dfsroot directory we set up our DFS links to - other servers on the network.

    +	 shows how to setup a DFS tree on a Samba server.
+	In the /export/dfsroot directory, you set up your DFS links to 
+	other servers on the network.
+
     root# cd /export/dfsroot
 root# chown root /export/dfsroot
 root# chmod 755 /export/dfsroot
 root# ln -s msdfs:storageA\\shareA linka
 root# ln -s msdfs:serverB\\share,serverC\\share linkb
-
    You should set up the permissions and ownership of 
-	the directory acting as the DFS root such that only designated 
+

    +

    +

    Example 17.1. smb.conf with DFS configured

    [global]
    netbios name = GANDALF
    host msdfs = yes
    [dfs]
    path = /export/dfsroot
    msdfs root = yes

    +

    You should set up the permissions and ownership of + the directory acting as the DFS root so that only designated users can create, delete or modify the msdfs links. Also note that symlink names should be all lowercase. This limitation exists to have Samba avoid trying all the case combinations to get at - the link name. Finally set up the symbolic links to point to the - network shares you want, and start Samba.

    Users on DFS-aware clients can now browse the DFS tree + the link name. Finally, set up the symbolic links to point to the + network shares you want and start Samba.

    Users on DFS-aware clients can now browse the DFS tree on the Samba server at \\samba\dfs. Accessing links linka or linkb (which appear as directories to the client) - takes users directly to the appropriate shares on the network.

    Common Errors

    • Windows clients need to be rebooted - if a previously mounted non-dfs share is made a DFS + takes users directly to the appropriate shares on the network.

    Common Errors

    • Windows clients need to be rebooted + if a previously mounted non-DFS share is made a DFS root or vice versa. A better way is to introduce a - new share and make it the DFS root.

    • Currently there's a restriction that msdfs + new share and make it the DFS root.

    • Currently, there's a restriction that msdfs symlink names should all be lowercase.

    • For security purposes, the directory acting as the root of the DFS tree should have ownership - and permissions set so that only designated users can - modify the symbolic links in the directory.

    Chapter 18. Classical Printing Support

    Kurt Pfeifle

    Danka Deutschland GmbH

    Gerald (Jerry) Carter

    Samba Team

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    A simple Configuration to Print
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various UNIX Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba 3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with -rpcclient
    Client Driver Install Procedure
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a -different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost

    Features and Benefits

    -Printing is often a mission-critical service for the users. Samba can + and permissions set so only designated users can + modify the symbolic links in the directory.

    MSDFS UNIX Path Is Case-Critical

    + A network administrator sent advice to the Samba mailing list + after a long sessions trying to determine why DFS was not working. + His advice is worth noting. +

    “ + I spent some time trying to figure out why my particular + dfs root wasn't working. I noted in the documenation that + the symlink should be in all lowercase. It should be + amended that the entire path to the symlink should all be + in lowercase as well. + ”

    + For example, I had a share defined as such: + + 

    +		[pub]
+			path = /export/home/Shares/public_share
+			msdfs root = yes
+

    + + and I could not make my Windows 9x/Me (with the dfs client installed) + follow this symlink: + + 

    +			damage1 -> msdfs:damage\test-share
+

    +

    + Running a debug level of 10 reveals: + + 

    +		[2003/08/20 11:40:33, 5] msdfs/msdfs.c:is_msdfs_link(176)
+		  is_msdfs_link: /export/home/shares/public_share/* does not exist.
+

    + + Curious. So I changed the directory name from .../Shares/... to + .../shares/... (along with my service definition) and it worked! +

    Chapter 18. Classical Printing Support

    Kurt Pfeifle

    Danka Deutschland GmbH

    Gerald (Jerry) Carter

    Samba Team

    John H. Terpstra

    Samba Team

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Introduction
    Client to Samba Print Job Processing
    Printing Related Configuration Parameters
    Simple Print Configuration
    Verifing Configuration with testparm
    Rapid Configuration Validation
    Extended Printing Configuration
    Detailed Explanation Settings
    Printing Developments Since Samba-2.2
    Point'n'Print Client Drivers on Samba Servers
    The Obsoleted [printer$] Section
    Creating the [print$] Share
    [print$] Section Parameters
    The [print$] Share Directory
    Installing Drivers into [print$]
    Add Printer Wizard Driver Installation
    Installing Print Drivers Using rpcclient
    Client Driver Installation Procedure
    First Client Driver Installation
    Setting Device Modes on New Printers
    Additional Client Driver Installation
    Always Make First Client Connection as root or printer admin
    Other Gotchas
    Setting Default Print Options for Client Drivers
    Supporting Large Numbers of Printers
    Adding New Printers with the Windows NT APW
    Error Message: Cannot connect under a different Name
    Take Care When Assembling Driver Files
    Samba and Printer Ports
    Avoiding Common Client Driver Misconfiguration
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Adding Network Printers without User Interaction
    The addprinter Command
    Migration of Classical Printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I Give My Root Password but I Do Not Get Access
    My Print Jobs Get Spooled into the Spooling Directory, but Then Get Lost

    Features and Benefits

    +Printing is often a mission-critical service for the users. Samba can provide this service reliably and seamlessly for a client network consisting of Windows workstations.

    -A Samba print service may be run on a Standalone or a Domain -member server, side by side with file serving functions, or on a -dedicated print server. It can be made as tight or as loosely secured -as needs dictate. Configurations may be simple or complex. Available -authentication schemes are essentially the same as described for file -services in previous chapters. Overall, Samba's printing support is -now able to replace an NT or Windows 2000 print server full-square, -with additional benefits in many cases. Clients may download and -install drivers and printers through their familiar "Point'n'Print" -mechanism. Printer installations executed by "Logon Scripts" are no -problem. Administrators can upload and manage drivers to be used by -clients through the familiar "Add Printer Wizard". As an additional -benefit, driver and printer management may be run from the command line -or through scripts, making it more efficient in case of large numbers -of printers. If a central accounting of print jobs (tracking every -single page and supplying the raw data for all sorts of statistical -reports) is required, this is best supported by CUPS as the print -subsystem underneath the Samba hood. -

    -This chapter deals with the foundations of Samba printing, as they -implemented by the more traditional UNIX (BSD- and System V-style) -printing systems. Many things apply to CUPS, the newer Common UNIX -Printing System, too; so if you use CUPS, you might be tempted to jump -to the next chapter -- but you will certainly miss a few things if you -do so. Better to read this chapter too. +A Samba print service may be run on a Stand-alone or Domain Member server, +side by side with file serving functions, or on a dedicated print server. +It can be made as tight or as loosely secured as needs dictate. Configurations +may be simple or complex. Available authentication schemes are essentially +the same as described for file services in previous chapters. Overall, +Samba's printing support is now able to replace an NT or Windows 2000 +print server full-square, with additional benefits in many cases. Clients +may download and install drivers and printers through their familiar +“Point'n'Print” mechanism. Printer installations executed by +“Logon Scripts” are no problem. Administrators can upload and +manage drivers to be used by clients through the familiar “Add Printer +Wizard”. As an additional benefit, driver and printer management may +be run from the command line or through scripts, making it more efficient +in case of large numbers of printers. If a central accounting of print jobs +(tracking every single page and supplying the raw data for all sorts of +statistical reports) is required, this function is best supported by +the newer Common UNIX Printing System (CUPS) +as the print subsystem underneath the Samba hood. +

    +This chapter deals with the foundations of Samba printing as they +are implemented by the more traditional UNIX (BSD- and System V-style) +printing systems. Many things covered in this chapter apply also to CUPS. +If you use CUPS, you may be tempted +to jump to the next chapter but you will certainly miss a few things if +you do. It is recommended that you read this chapter as well as .

    Note

    -Most of the given examples have been verified on Windows XP +Most of the following examples have been verified on Windows XP Professional clients. Where this document describes the responses to -commands given, bear in mind that Windows 2000 clients are very -similar, but may differ in details. Windows NT is somewhat different +commands given, bear in mind that Windows 200x/XP clients are quite +similar, but may differ in minor details. Windows NT is somewhat different again. -

    Technical Introduction

    -Samba's printing support always relies on the installed print -subsystem of the UNIX OS it runs on. Samba is a "middleman". It takes -printfiles from Windows (or other SMB) clients and passes them to the -real printing system for further processing. Therefore it needs to -"talk" to two sides: to the Windows print clients and to the UNIX -printing system. Hence we must differentiate between the various -client OS types each of which behave differently, as well as the -various UNIX print subsystems, which themselves have different -features and are accessed differently. This part of the Samba HOWTO -Collection deals with the "traditional" way of UNIX printing first; -the next chapter covers in great detail the more modern -Common UNIX Printing System -(CUPS). - -

    Important

    CUPS users, be warned: don't just jump on to the next -chapter. You might miss important information contained only -here!

    -

    What happens if you send a Job from a Client

    -To successfully print a job from a Windows client via a Samba -print server to a UNIX printer, there are 6 (potentially 7) -stages: -

    1. Windows opens a connection to the printer share

    2. Samba must authenticate the user

    3. Windows sends a copy of the printfile over the network -into Samba's spooling area

    4. Windows closes the connection again

    5. Samba invokes the print command to hand the file over -to the UNIX print subsystem's spooling area

    6. The UNIX print subsystem processes the print -job

    7. The printfile may need to be explicitly deleted -from the Samba spooling area.

    Printing Related Configuration Parameters

    -There are a number of configuration parameters in - controlling Samba's printing -behaviour. Please also refer to the man page for smb.conf to -acquire an overview about these. As with other parameters, there are -Global Level (tagged with a "G" in the listings) and -Service Level ("S") parameters. -

    Service Level Parameters

    These may go into the -[global] section of smb.conf. -In this case they define the default -behaviour of all individual or service level shares (provided those -don't have a different setting defined for the same parameter, thus -overriding the global default).

    Global Parameters

    These may not go into individual -shares. If they go in by error, the "testparm" utility can discover -this (if you run it) and tell you so.

    Parameters Recommended for Use

    The following smb.conf parameters directly -related to printing are used in Samba. See also the -smb.conf man page for detailed explanations: -

    Global level parameters: addprinter command, -deleteprinter command, -disable spoolss, -enumports command, -load printers, -lpq cache time, -os2 driver map, -printcap name, printcap, -show add printer wizard, -total print jobs, -use client driver. -

    Service level parameters: hosts allow, -hosts deny, -lppause command, -lpq command, -lpresume command, -lprm command, -max print jobs, -min print space, -print command, -printable, print ok , -printer name, printer, -printer admin, -printing = [cups|bsd|lprng...], -queuepause command, -queueresume command, -total print jobs. -

    -Samba's printing support implements the Microsoft Remote Procedure -Calls (MS-RPC) methods for printing. These are used by Windows NT (and -later) print servers. The old "LanMan" protocol is still supported as -a fallback resort, and for older clients to use. More details will -follow further beneath. -

    A simple Configuration to Print

    -Here is a very simple example configuration for print related settings -in the file. If you compare it with your own system's , you probably find some -additional parameters included there (as pre-configured by your OS -vendor). Further below is a discussion and explanation of the -parameters. Note, that this example doesn't use many parameters. +

    Technical Introduction

    +Samba's printing support always relies on the installed print subsystem +of the UNIX OS it runs on. Samba is a “middleman.” It takes +print files from Windows (or other SMB) clients and passes them to the real +printing system for further processing, therefore, it needs to communicate with +both sides: the Windows print clients and the UNIX printing system. Hence, we +must differentiate between the various client OS types, each of which behave +differently, as well as the various UNIX print subsystems, which themselves +have different features and are accessed differently. +

    +This deals with the traditional way of UNIX printing. The next chapter +covers in great detail the more modern Common UNIX Printing +System (CUPS). +

    Important

    CUPS users, be warned: do not just jump on to the next +chapter. You might miss important information only found here! +

    +It is apparent from postings on the Samba mailing list that print configuration +is one of the most problematic aspects of Samba administration today. Many +new Samba administrators have the impression that Samba performs some sort +of print processing. Rest assured, Samba does not peform any type of print +processing. It does not do any form of print filtering. +

    +Samba obtains from its clients a data stream (print job) that it spools to a +local spool area. When the entire print job has been received, Samba invokes +a local UNIX/Linux print command and passes the spooled file to it. It is +up to the local system printing subsystems to correctly process the print +job and to submit it to the printer. +

    Client to Samba Print Job Processing

    +Successful printing from a Windows client via a Samba print server to a UNIX +printer involves six (potentially seven) stages: +

    1. Windows opens a connection to the printer share.

    2. Samba must authenticate the user.

    3. Windows sends a copy of the print file over the network +into Samba's spooling area.

    4. Windows closes the connection.

    5. Samba invokes the print command to hand the file over +to the UNIX print subsystem's spooling area.

    6. The UNIX print subsystem processes the print job.

    7. The print file may need to be explicitly deleted +from the Samba spooling area. This item depends on your print spooler +configuration settings.

    Printing Related Configuration Parameters

    +There are a number of configuration parameters to control Samba's +printing behavior. Please refer to the man page for smb.conf for an +overview of these. As with other parameters, there are Global Level +(tagged with a G in the listings) and Service Level +(S) parameters. +

    Global Parameters

    These may not go into + individual share definitions. If they go in by error, + the testparm utility can discover this + (if you run it) and tell you so. +

    Service Level Parameters

    These may be specified in the + [global] section of smb.conf. + In this case they define the default behavior of all individual + or service level shares (provided they do not have a different + setting defined for the same parameter, thus overriding the + global default). +

    Simple Print Configuration

    + shows a simple printing configuration. +If you compare this with your own, you may find +additional parameters that have been pre-configured by your OS +vendor. Below is a discussion and explanation of the +parameters. This example does not use many parameters. However, in many environments these are enough to provide a valid -smb.conf file which enables all clients to print. -

    Example 18.1. Simple configuration with BSD printing

    [global]
    printing = bsd
    load printers = yes
    [printers]
    path = /var/spool/samba
    printable = yes
    public = yes
    writable = no

    -This is only an example configuration. Samba assigns default values to all -configuration parameters. On the whole the defaults are conservative and -sensible. When a parameter is specified in the smb.conf file this overwrites -the default value. The testparm utility when run as root -is capable of reporting all setting, both default as well as smb.conf file -settings. Testparm gives warnings for all mis-configured -settings. The complete output is easily 340 lines and more, so you may want -to pipe it through a pager program. +smb.conf file that enables all clients to print. +

    +

    Example 18.1. Simple configuration with BSD printing

    [global]
    printing = bsd
    load printers = yes
    [printers]
    path = /var/spool/samba
    printable = yes
    public = yes
    writable = no

    +This is only an example configuration. Samba assigns default values to +all configuration parameters. The defaults are conservative +and sensible. When a parameter is specified in the smb.conf file, this +overwrites the default value. The testparm utility when +run as root is capable of reporting all setting, both default as well as +smb.conf file settings. Testparm gives warnings for all +misconfigured settings. The complete output is easily 340 lines and more, +so you may want to pipe it through a pager program.

    The syntax for the configuration file is easy to grasp. You should -know that is not very picky about its -syntax. It has been explained elsewhere in this document. A short -reminder: It even tolerates some spelling errors (like "browsable" -instead of "browseable"). Most spelling is case-insensitive. Also, you -can use "Yes|No" or "True|False" for boolean settings. Lists of names +know that is not very picky about its syntax. As has been explained +elsewhere in this document, Samba tolerates some spelling errors (such +as browsable instead of +browseable), and spelling is +case-insensitive. It is permissible to use Yes/No +or True/False for Boolean settings. Lists of names may be separated by commas, spaces or tabs. -

    Verification of "Settings in Use" with testparm

    -To see all (or at least most) printing related settings in Samba, -including the implicitly used ones, try the command outlined below -(hit "ENTER" twice!). It greps for all occurrences of "lp", "print", -"spool", "driver", "ports" and "[" in testparm's output and gives you -a nice overview about the running smbd's print configuration. (Note -that this command does not show individually created printer shares, -or the spooling paths in each case). Here is the output of my Samba -setup, with exactly the same settings in -as shown above: +

    Verifing Configuration with testparm

    +To see all (or at least most) printing-related settings in Samba, including +the implicitly used ones, try the command outlined below. This command greps +for all occurrences of lp, print, spool, driver, ports +and [ in testparms output. This provides a convenient +overview of the running smbd print configuration. This +command does not show individually created printer shares or the spooling +paths they may use. Here is the output of my Samba setup, with settings +shown in : 

    -root# testparm -v | egrep "(lp|print|spool|driver|ports|\[)"
- Load smb config files from /etc/samba/smb.conf.simpleprinting
+root# testparm -s -v | egrep "(lp|print|spool|driver|ports|\[)"
+ Load smb config files from /etc/samba/smb.conf
  Processing section "[homes]"
  Processing section "[printers]"
  
@@ -5949,70 +6259,63 @@ as shown above:
  [printers]
         path = /var/spool/samba
         printable = Yes
-

    +

    You can easily verify which settings were implicitly added by Samba's -default behaviour. Don't forget about this point: it may +default behavior. Remember: it may be important in your future dealings with Samba. -

    Note

    testparm in samba 3 behaves differently from 2.2.x: used -without the "-v" switch it only shows you the settings actually -written into ! To see the complete -configuration used, add the "-v" parameter to testparm.

    A little Experiment to warn you

    +

    Note

    testparm in Samba-3 behaves differently from that in 2.2.x: used +without the “-v” switch it only shows you the settings actually +written into! To see the complete +configuration used, add the “-v” parameter to testparm.

    Rapid Configuration Validation

    Should you need to troubleshoot at any stage, please always come back -to this point first and verify if "testparm" shows the parameters you -expect! To give you an example from personal experience as a warning, -try to just "comment out" the load printers" +to this point first and verify if testparm shows the parameters you +expect. To give you a warning from personal experience, +try to just comment out the load printers parameter. If your 2.2.x system behaves like mine, you'll see this: 

     root# grep "load printers" /etc/samba/smb.conf
- #      load printers = Yes
- # This setting is commented ooouuuuut!!
+        #  load printers = Yes
+        # This setting is commented out!!
  
 root# testparm -v /etc/samba/smb.conf | egrep "(load printers)"
         load printers = Yes
-

    -Despite my imagination that the commenting out of this setting should -prevent Samba from publishing my printers, it still did! Oh Boy -- it -cost me quite some time to find out the reason. But I am not fooled -any more... at least not by this ;-) +I assumed that commenting out of this setting should prevent Samba from +publishing my printers, but it still did. It took some time to figure out +the reason. But I am no longer fooled ... at least not by this. 

     root# grep -A1 "load printers" /etc/samba/smb.conf
         load printers = No
-        # This setting is what I mean!!
- #      load printers = Yes
-        # This setting is commented ooouuuuut!!
+        # The above setting is what I want!
+        #  load printers = Yes
+        # This setting is commented out!
 
-root# testparm -v smb.conf.simpleprinting | egrep "(load printers)"
+root# testparm -s -v smb.conf.simpleprinting | egrep "(load printers)"
         load printers = No

    -Only when setting the parameter explicitly to -"load printers = No" -would Samba recognize my intentions. So my strong advice is: -

    • Never rely on "commented out" parameters!

    • Always set it up explicitly as you intend it to +Only when the parameter is explicitly set to +load printers = No +would Samba conform with my intentions. So, my strong advice is: +

      • Never rely on commented out parameters.

      • Always set parameters explicitly as you intend them to behave.

      • Use testparm to uncover hidden -settings which might not reflect your intentions.

      -You can have a working Samba print configuration with this -minimal : +settings that might not reflect your intentions.

    +The following is the most minimal configuration file: 

     root# cat /etc/samba/smb.conf-minimal
         [printers]
-

    -This example should show you that you can use testparm to test any -filename for fitness as a Samba configuration. Actually, we want to -encourage you not to change your - on a working system (unless you know -exactly what you are doing)! Don't rely on an assumption that changes -will only take effect after you re-start smbd! This is not the -case. Samba re-reads its every 60 -seconds and on each new client connection. You might have to face -changes for your production clients that you didn't intend to apply at -this time! You will now note a few more interesting things. Let's now -ask testparm what the Samba print configuration -would be, if you used this minimalistic file as your real -: +This example should show that you can use testparm to test any Samba +configuration file. Actually, we encourage you not +to change your working system (unless you know exactly what you are +doing). Don't rely on the assumption that changes will only take effect after +you re-start smbd! This is not the case. Samba re-reads it every 60 seconds +and on each new client connection. You might have to face changes for your +production clients that you didn't intend to apply. You will now +note a few more interesting things; testparm is useful to +identify what the Samba print configuration would be if you used this minimalistic +configuration. Here is what you can expect to find: 

     root# testparm -v smb.conf-minimal | egrep "(print|lpq|spool|driver|ports|[)"
  Processing section "[printers]"
@@ -6038,677 +6341,570 @@ would be, if you used this minimalistic file as your real
         lpq command = lpq -P%p
         printer name =
         use client driver = No
+
  [printers]
         printable = Yes

    -testparm issued 2 warnings: -

    • because we didn't specify the -[printers] section as printable, -and

    • because we didn't tell it which spool directory to -use.

    -However, this was not fatal, and samba will default to values that -will work here. Please, don't rely on this and don't use this -example! This was only meant to make you careful to design and specify -your setup to be what you really want it to be. The outcome on your -system may vary for some parameters, since you may have a Samba built -with a different compile-time configuration. -Warning: don't put a comment sign at -the end of a valid line. It -will cause the parameter to be ignored (just as if you had put the -comment sign at the front). At first I regarded this as a bug in my -Samba version(s). But the man page states: “Internal whitespace -in a parameter value is retained verbatim.” This means that a -line consisting of, for example, -

    # This defines LPRng as the printing system"
    printing = lprng

    -will regard the whole of the string after the "=" -sign as the value you want to define. And this is an invalid value -that will be ignored, and a default value used instead.] -

    Extended Sample Configuration to Print

    - In the extended BSD configuration example we show a more verbose example configuration for print related - settings in BSD-printing style environment . Below is a discussion -and explanation of the various parameters. We chose to use BSD-style -printing here, because we guess it is still the most commonly used -system on legacy Linux installations (new installs now predominantly -have CUPS, which is discussed entirely in the next chapter of this -document). Note, that this example explicitly names many parameters -which don't need to be specified because they are set by default. You -might be able to do with a leaner smb.conf file.

    Example 18.2. Extended configuration with BSD printing

    [global]
    printing = bsd
    load printers = yes
    show add printer wizard = yes
    printcap name = /etc/printcap
    printer admin = @ntadmin, root
    total print jobs = 100
    lpq cache time = 20
    use client driver = no
    [printers]
    comment = All Printers
    printable = yes
    path = /var/spool/samba
    browseable = no
    guest ok = yes
    public = yes
    read only = yes
    writable = no
    [my_printer_name]
    comment = Printer with Restricted Access
    path = /var/spool/samba_my_printer
    printer admin = kurt
    browseable = yes
    printable = yes
    writeable = no
    hosts allow = 0.0.0.0
    hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60
    guest ok = no

    -This also is only an example configuration. You -may not find all the settings in your own - (as pre-configured by your OS -vendor). Many configuration parameters, if not explicitly set to a -specific value, are used and set by Samba implicitly to its own -default, because these have been compiled in. To see all settings, let -root use the testparm -utility. testparm also gives warnings if you have -mis-configured certain things.. -

    Detailed Explanation of the Example's Settings

    -Following is a discussion of the settings from above shown example. -

    The [global] Section

    -The [global] section is one of 4 special +testparm issued two warnings: +

    • We did not specify the [printers] section as printable.

    • We did not tell Samba which spool directory to use.

    +However, this was not fatal and Samba will default to values that will +work. Please, do not rely on this and do not use this example. This was +included to encourage you to be careful to design and specify your setup to do +precisely what you require. The outcome on your system may vary for some +parameters given, since Samba may have been built with different compile-time +options. Warning: do not put a comment sign +at the end of a valid line. It will cause the parameter +to be ignored (just as if you had put the comment sign at the front). At first +I regarded this as a bug in my Samba versions. But the man page clearly says: +“Internal whitespace in a parameter value is retained verbatim.” +This means that a line consisting of, for example: +

    # This defines LPRng as the printing system
    printing = lprng

    +will regard the whole of the string after the +“=” sign as the value you want to +define. This is an invalid value that will be ignored and a default +value will be +used in its place. +

    Extended Printing Configuration

    +In we show a more verbose example configuration +for print-related settings in a BSD-style printing environment. What follows +is a discussion and explanation of the various parameters. We chose to +use BSD-style printing here because it is still the most commonly used +system on legacy UNIX/Linux installations. New installations predominantly +use CUPS, which is discussed in a separate chapter. explicitly +names many parameters that do not need to be specified because they are set +by default. You could use a much leaner smb.conf file. Alternately, you can use +testparm or SWAT to optimize the smb.conf +file to remove all parameters that are set at default. +

    Example 18.2. Extended BSD Printing Configuration

    [global]
    printing = bsd
    load printers = yes
    show add printer wizard = yes
    printcap name = /etc/printcap
    printer admin = @ntadmin, root
    total print jobs = 100
    lpq cache time = 20
    use client driver = no
    [printers]
    comment = All Printers
    printable = yes
    path = /var/spool/samba
    browseable = no
    guest ok = yes
    public = yes
    read only = yes
    writable = no
    [my_printer_name]
    comment = Printer with Restricted Access
    path = /var/spool/samba_my_printer
    printer admin = kurt
    browseable = yes
    printable = yes
    writeable = no
    hosts allow = 0.0.0.0
    hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60
    guest ok = no

    +This is an example configuration. You may not find all the settings that are in +the confioguration file that was provided by the OS vendor. Samba configuration +parameters, if not explicitly set default to a sensible value. +To see all settings, as root use the testparm +utility. testparm gives warnings for misconfigured settings. +

    Detailed Explanation Settings

    +The following is a discussion of the settings from above shown example. +

    The [global] Section

    +The [global] section is one of four special sections (along with [[homes], -[printers] and -[print$]...) It contains all parameters which -apply to the server as a whole. It is the place for parameters which -have only a "global" meaning. It may also contain service level -parameters which then define default settings for all other -sections and shares. This way you can simplify the configuration and -avoid setting the same value repeatedly. (Within each individual -section or share you may however override these globally set "share -level" settings and specify other values). -

    printing = bsd

    this causes Samba to use default print commands -applicable for the BSD (a.k.a. RFC 1179 style or LPR/LPD) printing -system. In general, the "printing" parameter informs Samba about the -print subsystem it should expect. Samba supports CUPS, LPD, LPRNG, -SYSV, HPUX, AIX, QNX and PLP. Each of these systems defaults to a -different print command (and other queue control -commands).

    Caution

    The printing parameter is -normally a service level parameter. Since it is included here in the -[global] section, it will take effect for all -printer shares that are not defined differently. Samba 3 no longer -supports the SOFTQ printing system.

    load printers = yes

    this tells Samba to create automatically all -available printer shares. "Available" printer shares are discovered by -scanning the printcap file. All created printer shares are also loaded -for browsing. If you use this parameter, you do not need to specify -separate shares for each printer. Each automatically created printer -share will clone the configuration options found in the -[printers] section. (A load printers -= no setting will allow you to specify each UNIX printer -you want to share separately, leaving out some you don't want to be -publicly visible and available).

    show add printer wizard = yes

    this setting is normally -enabled by default (even if the parameter is not written into the -). It makes the Add Printer Wizard icon -show up in the Printers folder of the Samba host's -share listing (as shown in Network Neighbourhood or -by the net view command). To disable it, you need to -explicitly set it to no (commenting it out -will not suffice!). The Add Printer Wizard lets you upload printer -drivers to the [print$] share and associate it -with a printer (if the respective queue exists there before the -action), or exchange a printer's driver against any other previously -uploaded driver.

    total print jobs = 100

    this setting sets the upper limit to 100 print jobs -being active on the Samba server at any one time. Should a client -submit a job which exceeds this number, a “no more space -available on server” type of error message will be returned by -Samba to the client. A setting of "0" (the default) means there is -no limit at all! -

    printcap name = /etc/printcap

    this tells Samba where to look for a list of -available printer names. (If you use CUPS, make sure that a printcap -file is written: this is controlled by the "Printcap" directive of -cupsd.conf). -

    printer admin = @ntadmin

    members of the ntadmin group should be able to add -drivers and set printer properties ("ntadmin" is only an example name, -it needs to be a valid UNIX group name); root is implicitly always a -printer admin. The "@" sign precedes group names in -. A printer admin can do anything to -printers via the remote administration interfaces offered by MS-RPC -(see below). Note that the printer admin -parameter is normally a share level parameter, so you may associate -different groups to different printer shares in larger installations, -if you use the printer admin parameter on the -share levels). -

    lpq cache time = 20

    this controls the cache time for the results of the -lpq command. It prevents the lpq command being called too often and -reduces load on a heavily used print server. -

    use client driver = no

    if set to yes, this setting only -takes effect for Win NT/2k/XP clients (and not for Win 95/98/ME). Its -default value is No (or False). -It must not be enabled on print shares -(with a yes or true setting) which -have valid drivers installed on the Samba server! For more detailed -explanations see the man page of smb.conf. -

    The [printers] Section

    -This is the second special section. If a section with this name -appears in the smb.conf, users are able to -connect to any printer specified in the Samba host's printcap file, -because Samba on startup then creates a printer share for every -printername it finds in the printcap file. You could regard this -section as a general convenience shortcut to share all printers with -minimal configuration. It is also a container for settings which -should apply as default to all printers. (For more details see the -smb.conf man page.) Settings inside this -container must be share level parameters. -

    comment = All printers

    the comment is shown next to -the share if a client queries the server, either via Network -Neighbourhood or with the net view command to list -available shares. -

    printable = yes

    please note well, that the -[printers] service must be -declared as printable. If you specify otherwise, smbd will refuse to -load at startup. This parameter allows -connected clients to open, write to and submit spool files into the -directory specified with the path parameter for -this service. It is used by Samba to differentiate printer shares from -file shares.

    path = /var/spool/samba

    this must point to a directory used by Samba to spool -incoming print files. It must not be the same as the spool -directory specified in the configuration of your UNIX print -subsystem! The path would typically point to a directory -which is world writeable, with the "sticky" bit set to it. -

    browseable = no

    this is always set to no if -printable = yes. It makes the -[printer] share itself invisible in the -list of available shares in a net view command or -in the Explorer browse list. (Note that you will of course see the -individual printers). -

    guest ok = yes

    -if set to yes, then no password is required to -connect to the printers service. Access will be granted with the -privileges of the guest account. On many systems the -guest account will map to a user named "nobody". This user is in the UNIX -passwd file with an empty password, but with no valid UNIX login. -(Note: on some systems the guest account might not have the -privilege to be able to print. Test this by logging in as your -guest user using su - guest and run a system print -command like -

    lpr -P printername /etc/motd

    public = yes

    this is a synonym for guest ok = yes. Since we have guest ok = yes, -it really doesn't need to be here! (This leads to the interesting -question: “What, if I by accident have to contradictory settings -for the same share?” The answer is: the last one encountered by -Samba wins. The "winner" is shown by testparm. Testparm doesn't -complain about different settings of the same parameter for the same -share! You can test this by setting up multiple lines for the "guest -account" parameter with different usernames, and then run testparm to -see which one is actually used by Samba.) -

    read only = yes

    this normally (for other types of shares) prevents -users creating or modifying files in the service's directory. However, -in a "printable" service, it is always allowed to -write to the directory (if user privileges allow the connection), but -only via print spooling operations. "Normal" write operations are not -allowed.

    writeable = no

    -synonym for read only = yes -

    Any [my_printer_name] Section

    -If a section appears in the , which is -tagged as printable = yes, Samba presents it as -a printer share to its clients. Note, that Win95/98/ME clients may -have problems with connecting or loading printer drivers if the share -name has more than 8 characters! Also be very careful if you give a -printer the same name as an existing user or file share name: upon a -client's connection request to a certain sharename, Samba always tries -to find file shares with that name first; if it finds one, it will -connect to this and will never ultimately connect to a printer with -the same name! -

    comment = Printer with Restricted Access

    the comment says it all. -

    path = /var/spool/samba_my_printer

    here we set the spooling area for this printer to -another directory than the default. It is not a requirement to set it -differently, but the option is available. -

    printer admin = kurt

    the printer admin definition is different for this -explicitly defined printer share from the general -[printers] share. It is not a requirement; we -did it to show that it is possible if you want it. -

    browseable = yes

    we also made this printer browseable (so that the -clients may conveniently find it when browsing the Network -Neighbourhood). -

    printable = yes

    see explanation in last subsection. -

    writeable = no

    see explanation in last subsection. -

    hosts allow = 10.160.50.,10.160.51.

    here we exercise a certain degree of access control -by using the hosts allow and hosts deny parameters. Note, that -this is not by any means a safe bet. It is not a way to secure your -printers. This line accepts all clients from a certain subnet in a -first evaluation of access control -

    hosts deny = turbo_xp,10.160.50.23,10.160.51.60

    all listed hosts are not allowed here (even if they -belong to the "allowed subnets"). As you can see, you could name IP -addresses as well as NetBIOS hostnames -here. -

    guest ok = no

    this printer is not open for the guest account! -

    Print Commands

    -In each section defining a printer (or in the -[printers] section), a print -command parameter may be defined. It sets a command to -process the files which have been placed into the Samba print spool -directory for that printer. (That spool directory was, if you -remember, set up with the path -parameter). Typically, this command will submit the spool file to the -Samba host's print subsystem, using the suitable system print -command. But there is no requirement that this needs to be the -case. For debugging purposes or some other reason you may want to do -something completely different than "print" the file. An example is a -command that just copies the print file to a temporary location for -further investigation when you need to debug printing. If you craft -your own print commands (or even develop print command shell scripts), -make sure you pay attention to the need to remove the files from the -Samba spool directory. Otherwise your hard disk may soon suffer from -shortage of free space. -

    Default Print Commands for various UNIX Print Subsystems

    -You learned earlier on, that Samba in most cases uses its built-in -settings for many parameters if it can not find an explicitly stated -one in its configuration file. The same is true for the -print command. The default print command varies -depending on the printing parameter -setting. In the commands listed below, you will notice some parameters -of the form %X where X is -p, s, J etc. These letters stand for -"printername", "spoolfile" and "job ID" respectively. They are -explained in more detail further below. Here is an overview (excluding -the special case of CUPS, which is discussed in the next chapter): -

    If this setting is active......this is used in lieu of an explicit command:
    printing = bsd|aix|lprng|plpprint command is lpr -r -P%p %s
    printing = sysv|hpuxprint command is lp -c -P%p %s; rm %s
    printing = qnxprint command is lp -r -P%p -s %s
    printing = bsd|aix|lprng|plplpq command is lpq -P%p
    printing = sysv|hpuxlpq command is lpstat -o%p
    printing = qnxlpq command is lpq -P%p
    printing = bsd|aix|lprng|plplprm command is lprm -P%p %j
    printing = sysv|hpuxlprm command is cancel %p-%j
    printing = qnxlprm command is cancel %p-%j
    printing = bsd|aix|lprng|plplppause command is lp -i %p-%j -H hold
    printing = sysv|hpuxlppause command (...is empty)
    printing = qnxlppause command (...is empty)
    printing = bsd|aix|lprng|plplpresume command is lp -i %p-%j -H resume
    printing = sysv|hpuxlpresume command (...is empty)
    printing = qnxlpresume command (...is empty)

    -We excluded the special CUPS case here, because it is discussed in the -next chapter. Just a short summary. For printing = -CUPS: If SAMBA is compiled against libcups, it uses the -CUPS API to submit jobs, etc. (It is a good idea also to set -printcap = cups in case your -cupsd.conf is set to write its autogenerated -printcap file to an unusual place). Otherwise Samba maps to the System -V printing commands with the -oraw option for printing, i.e. it uses -lp -c -d%p -oraw; rm %s With printing = -cups , and if SAMBA is compiled against libcups, any -manually set print command will be ignored! -

    -Having listed the above mappings here, you should note that there used -to be a bug in recent 2.2.x versions which -prevented the mapping from taking effect. It lead to the -"bsd|aix|lprng|plp" settings taking effect for all other systems, for -the most important commands (the print command, the -lpq command and the lprm -command). The lppause command and the -lpresume command remained empty. Of course, these -commands worked on bsd|aix|lprng|plp but they didn't work on -sysv|hpux|qnx systems. To work around this bug, you need to -explicitly set the commands. Use testparm -v to -check which command takes effect. Then check that this command is -adequate and actually works for your installed print subsystem. It is -always a good idea to explicitly set up your configuration files the -way you want them to work and not rely on any built-in defaults. -

    Setting up your own Print Commands

    -After a print job has finished spooling to a service, the -print command will be used by Samba via a -system() call to process the spool file. Usually -the command specified will submit the spool file to the host's -printing subsystem. But there is no requirement at all that this must -be the case. The print subsystem will probably not remove the spool -file on its own. So whatever command you specify on your own you -should ensure that the spool file is deleted after it has been -processed. -

    -There is no difficulty with using your own customized print commands -with the traditional printing systems. However, if you don't wish to -"roll your own", you should be well informed about the default -built-in commands that Samba uses for each printing subsystem (see the -table above). In all the commands listed in the last paragraphs you -see parameters of the form %X These are -macros, or shortcuts, used as place holders for -the names of real objects. At the time of running a command with such -a placeholder, Samba will insert the appropriate value -automatically. Print commands can handle all Samba macro -substitutions. In regard to printing, the following ones do have +[printers] +and [print$]...). The +[global] contains all parameters which apply +to the server as a whole. It is the place for parameters that have only a +global meaning. It may also contain service level parameters that then define +default settings for all other sections and shares. This way you can simplify +the configuration and avoid setting the same value repeatedly. (Within each +individual section or share you may, however, override these globally set +share settings and specify other values). +

    printing = bsd

    Causes Samba to use default print commands + applicable for the BSD (also known as RFC 1179 style or LPR/LPD) printing + system. In general, the printing parameter informs Samba about the + print subsystem it should expect. Samba supports CUPS, LPD, LPRNG, + SYSV, HPUX, AIX, QNX, and PLP. Each of these systems defaults to a + different print command (and other queue control + commands).

    Caution

    The printing parameter is + normally a service level parameter. Since it is included here in the + [global] section, it will take effect for all + printer shares that are not defined differently. Samba-3 no longer + supports the SOFTQ printing system.

    load printers = yes

    Tells Samba to create automatically all + available printer shares. Available printer shares are discovered by + scanning the printcap file. All created printer shares are also loaded + for browsing. If you use this parameter, you do not need to specify + separate shares for each printer. Each automatically created printer + share will clone the configuration options found in the + [printers] section. (The load printers + = no setting will allow you to specify each UNIX printer + you want to share separately, leaving out some you do not want to be + publicly visible and available).

    show add printer wizard = yes

    Setting is normally enabled by default (even if the parameter is not specified in smb.conf). + It causes the Add Printer Wizard icon to appear + in the Printers folder of the Samba host's + share listing (as shown in Network Neighborhood or + by the net view command). To disable it, you need to + explicitly set it to no (commenting it out + will not suffice). The Add Printer Wizard lets you upload printer + drivers to the [print$] share and associate it + with a printer (if the respective queue exists before the + action), or exchange a printer's driver against any other previously + uploaded driver.

    total print jobs = 100

    Sets the upper limit to 100 print jobs + being active on the Samba server at any one time. Should a client + submit a job that exceeds this number, a “no more space + available on server” type of error message will be returned by + Samba to the client. A setting of zero (the default) means there is + no limit at all. +

    printcap name = /etc/printcap

    Tells Samba where to look for a list of + available printer names. Where CUPS is used, make sure that a printcap + file is written. This is controlled by the Printcap directive in the + cupsd.conf file. +

    printer admin = @ntadmin

    Members of the ntadmin group should be able to add + drivers and set printer properties (ntadmin is only an example name, + it needs to be a valid UNIX group name); root is implicitly always a + printer admin. The @ sign precedes group names in the + /etc/group. A printer admin can do anything to + printers via the remote administration interfaces offered by MS-RPC + (see below). In larger installations, the printer admin + parameter is normally a per-share parameter. This permits different groups to administer each printer share. +

    lpq cache time = 20

    Controls the cache time for the results of the + lpq command. It prevents the lpq command being called too often and + reduces the load on a heavily used print server. +

    use client driver = no

    If set to yes, only + takes effect for Windows NT/200x/XP clients (and not for Win 95/98/ME). Its + default value is No (or False). + It must not be enabled on print shares + (with a yes or true setting) that + have valid drivers installed on the Samba server. For more detailed + explanations see the smb.conf man page. +

    The [printers] Section

    +This is the second special section. If a section with this name appears in +the smb.conf, users are able to connect to any printer specified in the +Samba host's printcap file, because Samba on startup then creates a printer +share for every printername it finds in the printcap file. You could regard +this section as a general convenience shortcut to share all printers with +minimal configuration. It is also a container for settings that should +apply as default to all printers. (For more details see the smb.conf +man page.) Settings inside this container must be Share Level parameters. +

    comment = All printers

    + The comment is shown next to the share if + a client queries the server, either via Network Neighborhood or with + the net view command to list available shares. +

    printable = yes

    + The [printers] service must + be declared as printable. If you specify otherwise, smbd will refuse to load at + startup. This parameter allows connected clients to open, write to and submit spool files + into the directory specified with the path + parameter for this service. It is used by Samba to differentiate printer shares from + file shares. +

    path = /var/spool/samba

    + Must point to a directory used by Samba to spool incoming print files. It + must not be the same as the spool directory specified in the configuration of your UNIX + print subsystem! The path typically points to a directory that is world + writeable, with the “sticky” bit set to it. +

    browseable = no

    + Is always set to no if + printable = yes. It makes + the [printer] share itself invisible in the list of + available shares in a net view command or in the Explorer browse + list. (You will of course see the individual printers). +

    guest ok = yes

    + If this parameter is set to yes, no password is required to + connect to the printer's service. Access will be granted with the privileges of the + guest account. On many systems the guest + account will map to a user named “nobody”. This user will usually be found + in the UNIX passwd file with an empty password, but with no valid UNIX login. (On some + systems the guest account might not have the privilege to be able to print. Test this + by logging in as your guest user using su - guest and run a system + print command like: +

    + lpr -P printername /etc/motd +

    public = yes

    + Is a synonym for guest ok = yes. + Since we have guest ok = yes, it + really does not need to be here. (This leads to the interesting question: “What if I + by accident have two contradictory settings for the same share?” The answer is the + last one encountered by Samba wins. Testparm does not complain about different settings + of the same parameter for the same share. You can test this by setting up multiple + lines for the guest account parameter with different usernames, + and then run testparm to see which one is actually used by Samba.) +

    read only = yes

    + Normally (for other types of shares) prevents users from creating or modifying files + in the service's directory. However, in a “printable” service, it is + always allowed to write to the directory (if user privileges allow the + connection), but only via print spooling operations. Normal write operations are not permitted. +

    writeable = no

    + Is a synonym for read only = yes. +

    Any [my_printer_name] Section

    +If a section appears in the smb.conf file, which when given the parameter +printable = yes causes Samba to configure it +as a printer share. Windows 9x/Me clients may have problems with connecting or loading printer drivers +if the share name has more than eight characters. Do not name a printer share with a name that may conflict +with an existing user or file share name. On Client connection requests, Samba always tries to find file +shares with that name first. If it finds one, it will connect to this and will not connect +to a printer with the same name! +

    comment = Printer with Restricted Access

    + The comment says it all. +

    path = /var/spool/samba_my_printer

    + Sets the spooling area for this printer to a directory other than the default. It is not + necessary to set it differently, but the option is available. +

    printer admin = kurt

    + The printer admin definition is different for this explicitly defined printer share from the general + [printers] share. It is not a requirement; we + did it to show that it is possible. +

    browseable = yes

    + This makes the printer browseable so the clients may conveniently find it when browsing the + Network Neighborhood. +

    printable = yes

    + See . +

    writeable = no

    + See . +

    hosts allow = 10.160.50.,10.160.51.

    + Here we exercise a certain degree of access control by using the hosts allow and hosts deny + parameters. This is not by any means a safe bet. It is not a way to secure your + printers. This line accepts all clients from a certain subnet in a first evaluation of + access control. +

    hosts deny = turbo_xp,10.160.50.23,10.160.51.60

    + All listed hosts are not allowed here (even if they belong to the allowed subnets). As + you can see, you could name IP addresses as well as NetBIOS hostnames here. +

    guest ok = no

    + This printer is not open for the guest account. +

    Print Commands

    +In each section defining a printer (or in the [printers] section), +a print command parameter may be defined. It sets a command to process the files +that have been placed into the Samba print spool directory for that printer. (That spool directory was, +if you remember, set up with the path parameter). Typically, +this command will submit the spool file to the Samba host's print subsystem, using the suitable system +print command. But there is no requirement that this needs to be the case. For debugging or +some other reason, you may want to do something completely different than print the file. An example is a +command that just copies the print file to a temporary location for further investigation when you need +to debug printing. If you craft your own print commands (or even develop print command shell scripts), +make sure you pay attention to the need to remove the files from the Samba spool directory. Otherwise, +your hard disk may soon suffer from shortage of free space. +

    Default UNIX System Printing Commands

    +You learned earlier on that Samba, in most cases, uses its built-in settings for many parameters +if it cannot find an explicitly stated one in its configuration file. The same is true for the +print command. The default print command varies depending +on the printing parameter setting. In the commands listed +below, you will notice some parameters of the form %X where X is +p, s, J, and so on. These letters stand for printer name, spoolfile and job ID, respectively. +They are explained in more detail further below. presents an overview of key +printing options but excludes the special case of CUPS that is discussed in . +

    Table 18.1. Default Printing Settings

    SettingDefault Printing Commands
    printing = bsd|aix|lprng|plpprint command is lpr -r -P%p %s
    printing = sysv|hpuxprint command is lp -c -P%p %s; rm %s
    printing = qnxprint command is lp -r -P%p -s %s
    printing = bsd|aix|lprng|plplpq command is lpq -P%p
    printing = sysv|hpuxlpq command is lpstat -o%p
    printing = qnxlpq command is lpq -P%p
    printing = bsd|aix|lprng|plplprm command is lprm -P%p %j
    printing = sysv|hpuxlprm command is cancel %p-%j
    printing = qnxlprm command is cancel %p-%j
    printing = bsd|aix|lprng|plplppause command is lp -i %p-%j -H hold
    printing = sysv|hpuxlppause command (...is empty)
    printing = qnxlppause command (...is empty)
    printing = bsd|aix|lprng|plplpresume command is lp -i %p-%j -H resume
    printing = sysv|hpuxlpresume command (...is empty)
    printing = qnxlpresume command (...is empty)

    +We excluded the special case of CUPS here, because it is discussed in the next chapter. For +printing = CUPS, if Samba is compiled against libcups, it uses the CUPS API to submit +jobs. (It is a good idea also to set printcap = cups +in case your cupsd.conf is set to write its autogenerated printcap file to an +unusual place). Otherwise, Samba maps to the System V printing commands with the -oraw option for printing, +i.e., it uses lp -c -d%p -oraw; rm %s. With printing = cups, +and if Samba is compiled against libcups, any manually set print command will be ignored! +

    Custom Print Commands

    +After a print job has finished spooling to a service, the print command + will be used by Samba via a system() call to process the +spool file. Usually the command specified will submit the spool file to the host's printing subsystem. But +there is no requirement at all that this must be the case. The print subsystem may not remove the spool +file on its own. So whatever command you specify, you should ensure that the spool file is deleted after +it has been processed. +

    +There is no difficulty with using your own customized print commands with the traditional printing +systems. However, if you do not wish to roll your own, you should be well informed about the default +built-in commands that Samba uses for each printing subsystem (see +Table 17.1). In all the +commands listed in the last paragraphs, you see parameters of the form %X. These are +macros, or shortcuts, used as placeholders for the names of real objects. At the time +of running a command with such a placeholder, Samba will insert the appropriate value automatically. Print +commands can handle all Samba macro substitutions. In regard to printing, the following ones do have special relevance: -

    • %s, %f - the path to the spool -file name

    • %p - the appropriate printer -name

    • %J - the job name as -transmitted by the client.

    • %c - the number of printed -pages of the spooled job (if known).

    • %z - the size of the spooled -print job (in bytes)

    -The print command MUST contain at least one occurrence of -%s or %f. -- The -%p is optional. If no printer name is supplied, -the %p will be silently removed from the print -command. In this case the job is sent to the default printer. -

    -If specified in the [global] section, the print -command given will be used for any printable service that does not -have its own print command specified. If there is neither a specified -print command for a printable service nor a global print command, -spool files will be created but not processed! And (most importantly): -print files will not be removed, so they will start filling your Samba -hard disk. -

    -Note that printing may fail on some UNIXes from the "nobody" -account. If this happens, create an alternative guest account and -supply it with the privilege to print. Set up this guest account in -the [global] section with the guest -account parameter. -

    -You can form quite complex print commands. You need to realize that -print commands are just passed to a UNIX shell. The shell is able to -expand the included environment variables as usual. (The syntax to -include a UNIX environment variable $variable -in or in the Samba print command is -%$variable.) To give you a working -print command example, the following will log a -print job to /tmp/print.log, print the file, then -remove it. Note that ';' is the usual separator for commands in shell -scripts: +

    • %s, %f the path to the spool file name.

    • %p the appropriate printer name.

    • %J the job name as transmitted by the client.

    • %c the number of printed pages of the spooled job (if known).

    • %z the size of the spooled print job (in bytes).

    +The print command must contain at least one occurrence of %s or +the %f. The %p is optional. If no printer name is supplied, +the %p will be silently removed from the print command. In this case, the job is +sent to the default printer. +

    +If specified in the [global] section, the print command given will be +used for any printable service that does not have its own print command specified. If there is neither a +specified print command for a printable service nor a global print command, spool files will be created +but not processed! Most importantly, print files will not be removed, so they will consume disk space. +

    +Printing may fail on some UNIX systems when using the “nobody” account. If this happens, create an +alternative guest account and give it the privilege to print. Set up this guest account in the +[global] section with the guest account parameter. +

    +You can form quite complex print commands. You need to realize that print commands are just +passed to a UNIX shell. The shell is able to expand the included environment variables as +usual. (The syntax to include a UNIX environment variable $variable +in the Samba print command is %$variable.) To give you a working +print command example, the following will log a print job +to /tmp/print.log, print the file, then remove it. The semicolon (“;” +is the usual separator for commands in shell scripts:

    print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s

    -You may have to vary your own command considerably from this example -depending on how you normally print files on your system. The default -for the print command parameter varies depending on the setting of -the printing parameter. Another example is: -

    print command = /usr/local/samba/bin/myprintscript %p %s

    Innovations in Samba Printing since 2.2

    -Before version 2.2.0, Samba's print server support for Windows clients -was limited to the level of LanMan printing -calls. This is the same protocol level as Windows 9x PCs offer when -they share printers. Beginning with the 2.2.0 release, Samba started -to support the native Windows NT printing mechanisms. These are -implemented via MS-RPC (RPC = Remote -Procedure Calls ). MS-RPCs use the -SPOOLSS named pipe for all printing. +You may have to vary your own command considerably from this example depending on how you normally print +files on your system. The default for the print command +parameter varies depending on the setting of the printing +parameter. Another example is: +

    print command = /usr/local/samba/bin/myprintscript %p %s

    Printing Developments Since Samba-2.2

    +Prior to Samba-2.2.x, print server support for Windows clients was limited to LanMan +printing calls. This is the same protocol level as Windows 9x/Me PCs offer when they share printers. +Beginning with the 2.2.0 release, Samba started to support the native Windows NT printing mechanisms. These +are implemented via MS-RPC (RPC = Remote Procedure Calls +). MS-RPCs use the SPOOLSS named pipe for all printing.

    The additional functionality provided by the new SPOOLSS support includes: -

    • Support for downloading printer driver files to Windows -95/98/NT/2000 clients upon demand (Point'n'Print); -

    • Uploading of printer drivers via the Windows NT -Add Printer Wizard (APW) or the -Imprints tool set. -

    • Support for the native MS-RPC printing calls such as - StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation for more information on the Win32 printing API);

    • Support for NT Access Control -Lists (ACL) on printer objects;

    • Improved support for printer queue manipulation -through the use of internal databases for spooled job information -(implemented by various *.tdb -files).

    -One other benefit of an update is this: Samba 3 is able to publish -all its printers in Active Directory (or LDAP)! -

    -One slight difference is here: it is possible on a Windows NT print -server to have printers listed in the Printers folder which are -not shared. Samba does not make this -distinction. By definition, the only printers of which Samba is aware -are those which are specified as shares in -. The reason is that Windows NT/200x/XP Professional -clients do not normally need to use the standard SMB printer share; -rather they can print directly to any printer on another Windows NT -host using MS-RPC. This of course assumes that the printing client has -the necessary privileges on the remote host serving the printer. The -default permissions assigned by Windows NT to a printer gives the -"Print" permissions to the well-known Everyone -group. (The older clients of type Win9x can only print to "shared" +

    • + Support for downloading printer driver files to Windows 95/98/NT/2000 clients upon + demand (Point'n'Print). +

    • + Uploading of printer drivers via the Windows NT Add Printer Wizard (APW) + or the Imprints tool set. +

    • + Support for the native MS-RPC printing calls such as + StartDocPrinter, EnumJobs(), and so on. (See the + MSDN documentation for more information on the + Win32 printing API). +

    • + Support for NT Access Control Lists (ACL) on printer objects. +

    • + Improved support for printer queue manipulation through the use of internal databases for spooled + job information (implemented by various *.tdb files). +

    +A benefit of updating is that Samba-3 is able to publish its printers to Active Directory (or LDAP). +

    +A fundamental difference exists between MS Windows NT print servers and Samba operation. Windows NT +permits the installation of local printers that are not shared. This is an artifact of the fact that +any Windows NT machine (server or client) may be used by a user as a workstation. Samba will publish all +printers that are made available, either by default or by specific declaration via printer-specific shares. +

    +Windows NT/200x/XP Professional clients do not have to use the standard SMB printer share; they can +print directly to any printer on another Windows NT host using MS-RPC. This, of course, assumes that +the client has the necessary privileges on the remote host that serves the printer resource. The +default permissions assigned by Windows NT to a printer gives the Print permissions to the well-known +Everyone group. (The older clients of type Windows 9x/Me can only print to shared printers). -

    Client Drivers on Samba Server for Point'n'Print

    -There is still confusion about what all this means: Is it or -is it not a requirement for printer drivers to be installed on a Samba -host in order to support printing from Windows clients? The -answer to this is: No, it is not a -requirement. Windows NT/2000 clients can, of -course, also run their APW to install drivers -locally (which then connect to a Samba served -print queue). This is the same method as used by Windows 9x -clients. (However, a bug existed in Samba 2.2.0 -which made Windows NT/2000 clients require that the Samba server -possess a valid driver for the printer. This was fixed in Samba -2.2.1). -

    -But it is a new option to install the printer -drivers into the [print$] share of the Samba -server, and a big convenience too. Then all -clients (including 95/98/ME) get the driver installed when they first -connect to this printer share. The uploading or -depositing of the driver into this -[print$] share, and the following binding of -this driver to an existing Samba printer share can be achieved by -different means: -

    • running the APW on an -NT/200x/XP Professional client (this doesn't work from 95/98/ME -clients);

    • using the Imprints -toolset;

    • using the smbclient and -rpcclient commandline tools;

    • using cupsaddsmb(only works for -the CUPS printing system, not for LPR/LPD, LPRng -etc.).

    -Please take additional note of the following fact: Samba -does not use these uploaded drivers in any way to process spooled -files. Drivers are utilized entirely by the clients, who -download and install them via the "Point'n'Print" mechanism supported -by Samba. The clients use these drivers to generate print files in the -format the printer (or the UNIX print system) requires. Print files -received by Samba are handed over to the UNIX printing system, which -is responsible for all further processing, if needed. -

    The [printer$] Section is removed from Samba 3

    -[print$] vs. [printer$] -.  -Versions of Samba prior to 2.2 made it possible to use a share -named [printer$]. This name was taken from the -same named service created by Windows 9x clients when a printer was -shared by them. Windows 9x printer servers always have a -[printer$] service which provides read-only -access (with no password required) in order to support printer driver -downloads. However, Samba's initial implementation allowed for a -parameter named printer driver location to be -used on a per share basis. This specified the location of the driver -files associated with that printer. Another parameter named -printer driver provided a means of defining the -printer driver name to be sent to the client. These parameters, -including the printer driver file parameter, -are now removed and can not be used in installations of samba-3. -Now the share name [print$] is used for the -location of downloadable printer drivers. It is taken from the -[print$] service created by Windows NT PCs when -a printer is shared by them. Windows NT print servers always have a -[print$] service which provides read-write -access (in the context of its ACLs) in order to support printer driver -down- and uploads. Don't fear -- this does not mean Windows 9x -clients are thrown aside now. They can use Samba's -[print$] share support just fine. -

    Creating the [print$] Share

    -In order to support the up- and downloading of printer driver files, -you must first configure a file share named -[print$]. The "public" name of this share is -hard coded in Samba's internals (because it is hard coded in the MS -Windows clients too). It cannot be renamed since Windows clients are -programmed to search for a service of exactly this name if they want -to retrieve printer driver files. -

    -You should modify the server's file to -add the global parameters and create the -[print$] file share (of course, some of the -parameter values, such as 'path' are arbitrary and should be replaced -with appropriate values for your site): -

    Example 18.3. [print\$] example

    [global]
    # members of the ntadmin group should be able to add drivers and set
    # printer properties. root is implicitly always a 'printer admin'.
    printer admin = @ntadmin
    ...
    [printers]
    ...
    [print$]
    comment = Printer Driver Download Area
    path = /etc/samba/drivers
    browseable = yes
    guest ok = yes
    read only = yes
    write list = @ntadmin, root

    +

    Point'n'Print Client Drivers on Samba Servers

    +There is much confusion about what all this means. The question is often asked, “Is it or is +it not necessary for printer drivers to be installed on a Samba host in order to support printing from +Windows clients?” The answer to this is no, it is not necessary. +

    +Windows NT/2000 clients can, of course, also run their APW to install drivers locally +(which then connect to a Samba-served print queue). This is the same method used by Windows 9x/Me +clients. (However, a bug existed in Samba 2.2.0 that made Windows NT/2000 clients +require that the Samba server possess a valid driver for the printer. This was fixed in Samba 2.2.1). +

    +But it is a new capability to install the printer drivers into the [print$] +share of the Samba server, and a big convenience, too. Then all clients +(including 95/98/ME) get the driver installed when they first connect to this printer share. The +uploading or depositing of the driver into this +[print$] share and the following binding of this driver to an existing +Samba printer share can be achieved by different means: +

    • + Running the APW on an NT/200x/XP Professional client (this does not work from 95/98/ME clients). +

    • + Using the Imprints toolset. +

    • + Using the smbclient and rpcclient commandline tools. +

    • + Using cupsaddsmb (only works for the CUPS + printing system, not for LPR/LPD, LPRng, and so on). +

    +Samba does not use these uploaded drivers in any way to process spooled files. These drivers are utilized +entirely by the clients who download and install them via the “Point'n'Print” mechanism +supported by Samba. The clients use these drivers to generate print files in the format the printer +(or the UNIX print system) requires. Print files received by Samba are handed over to the UNIX printing +system, which is responsible for all further processing, as needed. +

    The Obsoleted [printer$] Section

    + Versions of Samba prior to 2.2 made it possible to use a share named + [printer$]. This name was taken from the same named service created by + Windows 9x/Me clients when a printer was shared by them. Windows 9x/Me printer servers always + have a [printer$] service that provides read-only access (with + no password required) to support printer driver downloads. However, Samba's initial + implementation allowed for a parameter named printer driver location to + be used on a per share basis. This specified the location of the driver files associated with + that printer. Another parameter named printer driver provided a means of + defining the printer driver name to be sent to the client. +

    + These parameters, including the printer driver file parameter, + are now removed and cannot be used in installations of Samba-3. The share name + [print$] is now used for the location of downloadable printer + drivers. It is taken from the [print$] service created + by Windows NT PCs when a printer is shared by them. Windows NT print servers always have a + [print$] service that provides read-write access (in the context + of its ACLs) to support printer driver downloads and uploads. This does not mean Windows + 9x/Me clients are now thrown aside. They can use Samba's [print$] + share support just fine. +

    Creating the [print$] Share

    +In order to support the uploading and downloading of printer driver files, you must first configure a +file share named [print$]. The public name of this share is hard coded +in the MS Windows clients. It cannot be renamed since Windows clients are programmed to search for a +service of exactly this name if they want to retrieve printer driver files. +

    +You should modify the server's file to add the global parameters and create the +[print$] file share (of course, some of the parameter values, such +as path are arbitrary and should be replaced with appropriate values for your +site). See . +

    +

    Example 18.3. [print\$] example

    [global]
    # members of the ntadmin group should be able to add drivers and set
    # printer properties. root is implicitly always a 'printer admin'.
    printer admin = @ntadmin
    ...
    [printers]
    ...
    [print$]
    comment = Printer Driver Download Area
    path = /etc/samba/drivers
    browseable = yes
    guest ok = yes
    read only = yes
    write list = @ntadmin, root

    +

    Of course, you also need to ensure that the directory named by the -path parameter exists on the UNIX file system. -

    Parameters in the [print$] Section

    -[print$] is a special section in -. It contains settings relevant to -potential printer driver download and local installation by clients. -

    comment = Printer Driver - Download Area

    the comment appears next to the share name if it is -listed in a share list (usually Windows clients won't see it often but -it will also appear up in a smbclient -L sambaserver - output).

    path = /etc/samba/printers

    this is the path to the location of the Windows -driver file deposit from the UNIX point of -view.

    browseable = no

    this makes the [print$] share -"invisible" in Network Neighbourhood to clients. However, you can -still "mount" it from any client using the net use -g:\\sambaserver\print$ command in a "DOS box" or the -"Connect network drive" menu from Windows -Explorer.

    guest ok = yes

    this gives read only access to this share for all -guest users. Access may be used to download and install printer -drivers on clients. The requirement for guest ok = -yes depends upon how your site is configured. If users -will be guaranteed to have an account on the Samba host, then this is -a non-issue.

    Note

    -The non-issue is this: if all your Windows NT users are guaranteed to -be authenticated by the Samba server (for example if Samba -authenticates via an NT domain server and the NT user has already been -validated by the Domain Controller in order to logon to the Windows NT -session), then guest access is not necessary. Of course, in a -workgroup environment where you just want to be able to print without -worrying about silly accounts and security, then configure the share -for guest access. You'll probably want to add map to guest = Bad User in the -[global] section -as well. Make sure you understand what this parameter does before -using it. -

    read only = yes

    as we don't want everybody to upload driver files (or -even change driver settings) we tagged this share as not -writeable.

    write list = @ntadmin,root

    since the [print$] was made -read only by the previous setting, we need to create a "write list" -also. UNIX groups (denoted with a leading "@" character) and users -listed here are allowed write access (as an exception to the general -public's "read-only" access), which they need to update files on the -share. Normally you will want to only name administrative level user -accounts in this setting. Check the file system permissions to make -sure these accounts can copy files to the share. If this is a non-root -account, then the account should also be mentioned in the global -printer admin parameter. See the - man page for more information on -configuring file shares.

    Subdirectory Structure in [print$]

    -In order for a Windows NT print server to support the downloading of -driver files by multiple client architectures, you must create several -subdirectories within the [print$] service -(i.e. the UNIX directory named by the path -parameter). These correspond to each of the supported client -architectures. Samba follows this model as well. Just like the name of -the [print$] share itself, the subdirectories -*must* be exactly the names listed below (you may leave out the -subdirectories of architectures you don't want to support). +path parameter exists on the UNIX file system. +

    [print$] Section Parameters

    +The [print$] is a special section in smb.conf. It contains settings relevant to +potential printer driver download and is used by windows clients for local print driver installation. +The following parameters are frequently needed in this share section: +

    comment = Printer Driver Download Area

    + The comment appears next to the share name if it is listed in a share list (usually Windows + clients will not see it, but it will also appear up in a smbclient -L sambaserver + output). +

    path = /etc/samba/printers

    + Is the path to the location of the Windows driver file deposit from the UNIX point of view. +

    browseable = no

    + Makes the [print$] share invisible to clients from the + Network Neighborhood. However, you can still mount it from any client + using the net use g:\\sambaserver\print$ command in a DOS-box or the + Connect network drive menu> from Windows Explorer. +

    guest ok = yes

    + Gives read-only access to this share for all guest users. Access may be granted to + download and install printer drivers on clients. The requirement for guest ok + = yes depends on how your site is configured. If users will be guaranteed + to have an account on the Samba host, then this is a non-issue. +

    Note

    + If all your Windows NT users are guaranteed to be authenticated by the Samba server + (for example, if Samba authenticates via an NT domain server and the user has already been + validated by the Domain Controller in order to logon to the Windows NT session), then guest + access is not necessary. Of course, in a workgroup environment where you just want + to print without worrying about silly accounts and security, then configure the share for + guest access. You should consider adding map to guest = Bad + User in the [global] section + as well. Make sure you understand what this parameter does before using it. +

    read only = yes

    + Because we do not want everybody to upload driver files (or even change driver settings), + we tagged this share as not writeable. +

    write list = @ntadmin, root

    + The [print$] was made read-only by the previous + setting so we should create a write list entry also. UNIX + groups (denoted with a leading “@” character). Users listed here are allowed + write-access (as an exception to the general public's read-only access), which they need to + update files on the share. Normally, you will want to only name administrative-level user + account in this setting. Check the file system permissions to make sure these accounts + can copy files to the share. If this is a non-root account, then the account should also + be mentioned in the global printer admin + parameter. See the smb.conf man page for more information on configuring file shares. +

    The [print$] Share Directory

    +In order for a Windows NT print server to support the downloading of driver files by multiple client +architectures, you must create several subdirectories within the [print$] +service (i.e., the UNIX directory named by the path +parameter). These correspond to each of the supported client architectures. Samba follows this model as +well. Just like the name of the [print$] share itself, the subdirectories +must be exactly the names listed below (you may leave out the subdirectories of architectures you do +not need to support).

    Therefore, create a directory tree below the [print$] share for each architecture you wish -to support. +to support like this: 

    -[print$]--+--
-          |--W32X86           # serves drivers to "Windows NT x86"
-          |--WIN40            # serves drivers to "Windows 95/98"
-          |--W32ALPHA         # serves drivers to "Windows NT Alpha_AXP"
-          |--W32MIPS          # serves drivers to "Windows NT R4000"
-          |--W32PPC           # serves drivers to "Windows NT PowerPC"
-

    Required permissions

    -In order to add a new driver to your Samba host, one of two conditions -must hold true: -

    • The account used to connect to the Samba host must -have a UID of 0 (i.e. a root account)

    • The account used to connect to the Samba host must be -named in the printer adminlist.

    -Of course, the connected account must still possess access to add -files to the subdirectories beneath -[print$]. Remember that all file shares are set -to 'read only' by default. -

    -Once you have created the required [print$] -service and associated subdirectories, go to a Windows NT 4.0/2k/XP -client workstation. Open Network Neighbourhood or -My Network Places and browse for the Samba host. -Once you have located the server, navigate to its Printers and -Faxes folder. You should see an initial listing of printers -that matches the printer shares defined on your Samba host. -

    Installing Drivers into [print$]

    -You have successfully created the [print$] -share in ? And Samba has re-read its -configuration? Good. But you are not yet ready to take off. The -driver files need to be present in this share, -too! So far it is still an empty share. Unfortunately, it is not enough -to just copy the driver files over. They need to be set -up too. And that is a bit tricky, to say the least. We -will now discuss two alternative ways to install the drivers into -[print$]: -

    • using the Samba commandline utility -rpcclient with its various subcommands (here: -adddriver and setdriver) from -any UNIX workstation;

    • running a GUI (Printer -Properties and Add Printer Wizard) -from any Windows NT/2k/XP client workstation.

    -The latter option is probably the easier one (even if the only -entrance to this realm seems a little bit weird at first). -

    Setting Drivers for existing Printers with a Client GUI

    -The initial listing of printers in the Samba host's -Printers folder accessed from a client's Explorer -will have no real printer driver assigned to them. By default -this driver name is set to a NULL -string. This must be changed now. The local Add Printer -Wizard, run from NT/2000/XP clients, will help us in this -task. -

    -However, the job to set a valid driver for the printer is not a -straightforward one: You must attempt to view the printer properties -for the printer to which you want the driver assigned. Open the -Windows Explorer, open Network Neighbourhood, browse to the Samba -host, open Samba's Printers folder, right-click the printer icon and -select Properties.... You are now trying to view printer and driver -properties for a queue which has this default NULL driver -assigned. This will result in an error message (this is normal here): -

    Device settings cannot be displayed. The driver -for the specified printer is not installed, only spooler properties -will be displayed. Do you want to install the driver -now?

    -Important:Don't click Yes! Instead, -click No in the error dialog. -Only now you will be presented with the printer properties window. From here, -the way to assign a driver to a printer is open to us. You have now the choice -either: -

    • select a driver from the pop-up list of installed -drivers. Initially this list will be empty. -Or

    • use the New Driver... button to -install a new printer driver (which will in fact start up the -APW).

    -Once the APW is started, the procedure is exactly the same as the one -you are familiar with in Windows (we assume here that you are -familiar with the printer driver installations procedure on Windows -NT). Make sure your connection is in fact setup as a user with -printer admin privileges (if in doubt, use -smbstatus to check for this). If you wish to -install printer drivers for client operating systems other than -Windows NT x86, you will need to use the -Sharing tab of the printer properties dialog. -

    -Assuming you have connected with an administrative (or root) account -(as named by the printer admin parameter), -you will also be able to modify other printer properties such as ACLs -and default device settings using this dialog. For the default device -settings, please consider the advice given further below. -

    Setting Drivers for existing Printers with -rpcclient

    -The second way to install printer drivers into -[print$] and set them up in a valid way can be -done from the UNIX command line. This involves four distinct steps: -

    1. gathering the info about the required driver files -and collecting the files together;

    2. deposit the driver files into the -[print$] share's correct subdirectories -(possibly by using smbclient);

    3. running the rpcclient -commandline utility once with the adddriver -subcommand,

    4. running rpcclient a second -time with the setdriver -subcommand.

    -We will provide detailed hints for each of these steps in the next few -paragraphs. -

    Identifying the Driver Files

    -To find out about the driver files, you have two options: you could -investigate the driver CD which comes with your printer. Study the -*.inf file on the CD, if it is contained. This -may not be the possible, since the *.inf file might be -missing. Unfortunately, many vendors have now started to use their own -installation programs. These installations packages are often some -sort of Windows platform archive format, plus, the files may get -re-named during the installation process. This makes it extremely -difficult to identify the driver files you need. -

    -Then you only have the second option: install the driver first on a -Windows client *locally* and investigate which file names and paths it -uses after they are installed. (Note, that you need to repeat this -procedure for every client platform you want to support. We are going -to show it here for the W32X86 platform only, a -name used by Microsoft for all WinNT/2k/XP clients...) -

    -A good method to recognize the driver files this is to print the test -page from the driver's Properties Dialog -(General tab). Then look at the list of driver -files named on the printout. You'll need to recognize what Windows -(and Samba) are calling the Driver File , the -Data File, the Config File, -the Help File and (optionally) the -Dependent Driver Files (this may vary slightly -for Windows NT). You need to remember all names (or better take a -note) for the next steps. -

    -Another method to quickly test the driver filenames and related paths -is provided by the rpcclient utility. Run it with -enumdrivers or with the -getdriver subcommand, each in the -3 level. In the following example, -TURBO_XP is the name of the Windows PC (in this -case it was a Windows XP Professional laptop, BTW). I had installed -the driver locally to TURBO_XP while kde-bitshop is -the name of the Linux host from which I am working. We could run an -interactive rpcclient session; -then we'd get an rpcclient /> prompt and would -type the subcommands at this prompt. This is left as a good exercise -to the reader. For now we use rpcclient with the --c parameter to execute a single subcommand -line and exit again. This is the method you would use if you want to -create scripts to automate the procedure for a large number of -printers and drivers. Note the different quotes used to overcome the -different spaces in between words: -

    -root# rpcclient -U'Danka%xxxx' -c \
-	'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP
-cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3
-
-[Windows NT x86]
+[print$]--+
+          |--W32X86           # serves drivers to Windows NT x86
+          |--WIN40            # serves drivers to Windows 95/98
+          |--W32ALPHA         # serves drivers to Windows NT Alpha_AXP
+          |--W32MIPS          # serves drivers to Windows NT R4000
+          |--W32PPC           # serves drivers to Windows NT PowerPC
+

    +

    Required permissions

    + In order to add a new driver to your Samba host, one of two conditions must hold true: +

    • + The account used to connect to the Samba host must have a UID of 0 (i.e., a root account). +

    • + The account used to connect to the Samba host must be named in the printer adminlist. +

    + Of course, the connected account must still have write access to add files to the subdirectories beneath + [print$]. Remember that all file shares are set to “read-only” by default. +

    +Once you have created the required [print$] service and +associated subdirectories, go to a Windows NT 4.0/200x/XP client workstation. Open Network +Neighborhood or My Network Places and browse for the Samba host. Once you +have located the server, navigate to its Printers and Faxes folder. You should see +an initial listing of printers that matches the printer shares defined on your Samba host. +

    Installing Drivers into [print$]

    +Have you successfully created the [print$] share in smb.conf, and have your forced Samba +to re-read its smb.conf file? Good. But you are not yet ready to use the new facility. The client driver +files need to be installed into this share. So far it is still an empty share. Unfortunately, it is +not enough to just copy the driver files over. They need to be +correctly installed so that appropriate +records for each driver will exist in the Samba internal databases so it can provide the correct +drivers as they are requested from MS Windows clients. And that is a bit tricky, to say the least. We +now discuss two alternative ways to install the drivers into [print$]: +

    • + Using the Samba commandline utility rpcclient with its various subcommands (here: + adddriver and setdriver) from any UNIX workstation. +

    • + Running a GUI (Printer Properties and Add Printer Wizard) + from any Windows NT/200x/XP client workstation. +

    +The latter option is probably the easier one (even if the process may seem a little bit weird at first). +

    Add Printer Wizard Driver Installation

    +The initial listing of printers in the Samba host's Printers folder accessed from a +client's Explorer will have no real printer driver assigned to them. By default this driver name is set +to a null string. This must be changed now. The local Add Printer Wizard (APW), run from +NT/2000/XP clients, will help us in this task. +

    +Installation of a valid printer driver is not straightforward. You must attempt +to view the printer properties for the printer to which you want the driver assigned. Open the Windows +Explorer, open Network Neighborhood, browse to the Samba host, open Samba's Printers +folder, right-click on the printer icon and select Properties.... You are now trying to +view printer and driver properties for a queue that has this default NULL driver +assigned. This will result in the following error message: +

    + Device settings cannot be displayed. The driver for the specified printer is not installed, + only spooler properties will be displayed. Do you want to install the driver now? +

    +Do not click on Yes! Instead, click on No in the error dialog. +Only now you will be presented with the printer properties window. From here, the way to assign a driver +to a printer is open to us. You now have the choice of: +

    • + Select a driver from the pop-up list of installed drivers. Initially this list will be empty. +

    • + Click on New Driver to install a new printer driver (which will + start up the APW). +

    +Once the APW is started, the procedure is exactly the same as the one you are familiar with in Windows (we +assume here that you are familiar with the printer driver installations procedure on Windows NT). Make sure +your connection is, in fact, setup as a user with printer admin +privileges (if in doubt, use smbstatus to check for this). If you wish to install +printer drivers for client operating systems other than Windows NT x86, +you will need to use the Sharing tab of the printer properties dialog. +

    +Assuming you have connected with an administrative (or root) account (as named by the +printer admin parameter), you will also be able to modify +other printer properties such as ACLs and default device settings using this dialog. For the default +device settings, please consider the advice given further in . +

    Installing Print Drivers Using rpcclient

    +The second way to install printer drivers into [print$] and set them +up in a valid way is to do it from the UNIX command line. This involves four distinct steps: +

    1. + Gather info about required driver files and collect the files. +

    2. + Deposit the driver files into the [print$] share's correct subdirectories + (possibly by using smbclient). +

    3. + Run the rpcclient command line utility once with the adddriver + subcommand. +

    4. + Run rpcclient a second time with the setdriver subcommand. +

    +We provide detailed hints for each of these steps in the paragraphs that follow. +

    Identifying Driver Files

    +To find out about the driver files, you have two options. You could check the contents of the driver +CDROM that came with your printer. Study the *.inf files lcoated on the CDROM. This +may not be possible, since the *.inf file might be missing. Unfortunately, vendors have now started +to use their own installation programs. These installations packages are often in some Windows platform +archive format. Additionally, the files may be re-named during the installation process. This makes it +extremely difficult to identify the driver files required. +

    +Then you only have the second option. Install the driver locally on a Windows client and +investigate which file names and paths it uses after they are installed. (You need to repeat +this procedure for every client platform you want to support. We show it here for the +W32X86 platform only, a name used by Microsoft for all Windows NT/200x/XP +clients.) +

    +A good method to recognize the driver files is to print the test page from the driver's +Properties dialog (General tab). Then look at the list of +driver files named on the printout. You'll need to recognize what Windows (and Samba) are calling the +Driver File, Data File, Config File, +Help File and (optionally) the Dependent Driver Files +(this may vary slightly for Windows NT). You need to take a note of all file names for the next steps. +

    +Another method to quickly test the driver filenames and related paths is provided by the +rpcclient utility. Run it with enumdrivers or with the +getdriver subcommand, each at the 3 info level. In the following example, +TURBO_XP is the name of the Windows PC (in this case it was a Windows XP Professional +laptop). I installed the driver locally to TURBO_XP, from a Samba server called KDE-BITSHOP. +We could run an interactive rpcclient session; then we would get an +rpcclient /> prompt and would type the subcommands at this prompt. This is left as +a good exercise to the reader. For now, we use rpcclient with the -c +parameter to execute a single subcommand line and exit again. This is the method you would use if you +want to create scripts to automate the procedure for a large number of printers and drivers. Note the +different quotes used to overcome the different spaces in between words: +

    +root# rpcclient -U'Danka%xxxx' -c \
+	'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP
+cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3
+
+[Windows NT x86]
 Printer Driver Info 3:
   Version: [2]
   Driver Name: [Heidelberg Digimaster 9110 (PS)]
@@ -6720,58 +6916,47 @@ Printer Driver Info 3:
   
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.DLL]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.INI]
-  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1KMMin.DLL]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.dat]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.cat]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.def]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hre]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.vnd]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hlp]
-  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de_reg.HLP]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01Aux.dll]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.NTF]
   
   Monitorname: []
   Defaultdatatype: []

    -You may notice, that this driver has quite a big number of -Dependentfiles (I know worse cases however). Also, -strangely, the Driver File is here tagged as -Driver Path.... oh, well. Here we don't have yet -support for the so-called WIN40 architecture -installed. This name is used by Microsoft for the Win95/98/ME platforms. -If we want to support these, we need to install the Win95/98/ME driver -files in addition to those for W32X86 -(i.e. the WinNT72000/XP clients) onto a Windows PC. This PC -can also host the Win9x drivers, even if itself runs on Windows NT, -2000 or XP. -

    -Since the [print$] share is usually accessible -through the Network Neighbourhood, you can also use the UNC notation -from Windows Explorer to poke at it. The Win9x driver files will end -up in subdirectory "0" of the "WIN40" directory. The full path to -access them will be -\\WINDOWSHOST\print$\WIN40\0\. -

    Note

    more recent drivers on Windows 2000 and Windows XP are -installed into the "3" subdirectory instead of the "2". The version 2 -of drivers, as used in Windows NT, were running in Kernel Mode. -Windows 2000 changed this. While it still can use the Kernel Mode -drivers (if this is enabled by the Admin), its native mode for printer -drivers is User Mode execution. This requires drivers designed for -this. These type of drivers install into the "3" subdirectory. -

    Collecting the Driver Files from a Windows Host's -[print$] Share

    -Now we need to collect all the driver files we identified. in our -previous step. Where do we get them from? Well, why not retrieve them -from the very PC and the same [print$] share -which we investigated in our last step to identify the files? We can -use smbclient to do this. We will use the paths and -names which were leaked to us by getdriver. The +You may notice that this driver has quite a large number of Dependent files +(there are worse cases, however). Also, strangely, the +Driver File is tagged here +Driver Path. We do not yet have support for the so-called +WIN40 architecture installed. This name is used by Microsoft for the Windows +9x/Me platforms. If we want to support these, we need to install the Windows 9x/Me driver files in +addition to those for W32X86 (i.e., the Windows NT72000/XP clients) onto a +Windows PC. This PC can also host the Windows 9x/Me drivers, even if it runs on Windows NT, 2000 or XP. +

    +Since the [print$] share is usually accessible through the Network +Neighborhood, you can also use the UNC notation from Windows Explorer to poke at it. The Windows +9x/Me driver files will end up in subdirectory 0 of the WIN40 +directory. The full path to access them will be \\WINDOWSHOST\print$\WIN40\0\. +

    Note

    +More recent drivers on Windows 2000 and Windows XP are installed into the “3” subdirectory +instead of the “2”. The version 2 of drivers, as used in Windows NT, were running in Kernel +Mode. Windows 2000 changed this. While it still can use the Kernel Mode drivers (if this is enabled by +the Admin), its native mode for printer drivers is User Mode execution. This requires drivers designed +for this. These types of drivers install into the “3” subdirectory. +

    Obtaining Driver Files from Windows Client [print$] Shares

    +Now we need to collect all the driver files we identified in our previous step. Where do we get them +from? Well, why not retrieve them from the very PC and the same [print$] +share that we investigated in our last step to identify the files? We can use smbclient +to do this. We will use the paths and names that were leaked to us by getdriver. The listing is edited to include linebreaks for readability: 

    -root# smbclient //TURBO_XP/print\$ -U'Danka%xxxx'	\ 
-	-c 'cd W32X86/2;mget HD*_de.*             \
-	hd*ppd Hd*_de.* Hddm*dll HDN*Aux.DLL'
+root# smbclient //TURBO_XP/print\$ -U'Danka%xxxx' \ 
+   -c 'cd W32X86/2;mget HD*_de.* hd*ppd Hd*_de.* Hddm*dll HDN*Aux.DLL'
+
 added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
 Got a positive name query response from 10.160.50.8 ( 10.160.50.8 )
 Domain=[DEVELOPMENT] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager]
@@ -6781,43 +6966,38 @@ getting file \W32X86\2\Hddm91c1_de.def of size 428 as Hddm91c1_de.def
 Get file Hddm91c1_de.DLL? y
 getting file \W32X86\2\Hddm91c1_de.DLL of size 876544 as Hddm91c1_de.DLL
 [...]
-

    -After this command is complete, the files are in our current local -directory. You probably have noticed that this time we passed several -commands to the -c parameter, separated by semi-colons. This -effects that all commands are executed in sequence on the remote -Windows server before smbclient exits again. -

    -Don't forget to repeat the procedure for the WIN40 -architecture should you need to support Win95/98/XP clients. Remember, the -files for these architectures are in the WIN40/0/ subdir. Once we are -complete, we can run smbclient ... put to store -the collected files on the Samba server's -[print$] share. -

    Depositing the Driver Files into [print$]

    -So, now we are going to put the driver files into the -[print$] share. Remember, the UNIX path to this -share has been defined previously in your -. You also have created subdirectories -for the different Windows client types you want to support. Supposing -your [print$] share maps to the UNIX path -/etc/samba/drivers/, your driver files should now -go here: -

    • for all Windows NT, 2000 and XP clients into -/etc/samba/drivers/W32X86/ but -*not*(yet) into the "2" subdir!

    • for all Windows 95, 98 and ME clients into -/etc/samba/drivers/WIN40/ -- but *not* -(yet) into the "0" subdir!

    -We again use smbclient to transfer the driver files across the -network. We specify the same files and paths as were leaked to us by -running getdriver against the original -Windows install. However, now we are going to -store the files into a Samba/UNIX print server's -[print$] share... +After this command is complete, the files are in our current local directory. You probably have noticed +that this time we passed several commands to the -c parameter, separated by semi-colons. +This effects that all commands are executed in sequence on the remote Windows server before smbclient +exits again. +

    +Remember to repeat the procedure for the WIN40 architecture should +you need to support Windows 9x/Me/XP clients. Remember too, the files for these architectures are in the +WIN40/0/ subdirectory. Once this is complete, we can run smbclient ... +put to store the collected files on the Samba server's [print$] +share. +

    Installing Driver Files into [print$]

    +We are now going to locate the driver files into the [print$] +share. Remember, the UNIX path to this share has been defined +previously in your words missing here. You +also have created subdirectories for the different Windows client types you want to +support. Supposing your [print$] share maps to the UNIX path +/etc/samba/drivers/, your driver files should now go here: +

    • + For all Windows NT, 2000 and XP clients into /etc/samba/drivers/W32X86/ but + not (yet) into the 2 subdirectory. +

    • + For all Windows 95, 98 and ME clients into /etc/samba/drivers/WIN40/ but not + (yet) into the 0 subdirectory. +

    +We again use smbclient to transfer the driver files across the network. We specify the same files +and paths as were leaked to us by running getdriver against the original +Windows install. However, now we are going to store the files into a +Samba/UNIX print server's [print$] share. 

    -		root# smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c \
- 'cd W32X86; put HDNIS01_de.DLL; \
+root# smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c \
+  'cd W32X86; put HDNIS01_de.DLL; \
   put Hddm91c1_de.ppd; put HDNIS01U_de.DLL;        \
   put HDNIS01U_de.HLP; put Hddm91c1_de.DLL;        \
   put Hddm91c1_de.INI; put Hddm91c1KMMin.DLL;      \
@@ -6826,6 +7006,7 @@ store the files into a Samba/UNIX print s
   put Hddm91c1_de.vnd; put Hddm91c1_de.hlp;        \
   put Hddm91c1_de_reg.HLP; put HDNIS01Aux.dll;     \
   put HDNIS01_de.NTF'
+
 added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
 Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
 Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
@@ -6846,30 +7027,26 @@ putting file Hddm91c1_de_reg.HLP as \W32X86\Hddm91c1_de_reg.HLP
 putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll
 putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF

    -Phewww -- that was a lot of typing! Most drivers are a lot smaller -- -many only having 3 generic PostScript driver files plus 1 PPD. Note, -that while we did retrieve the files from the "2" subdirectory of the -"W32X86" directory from the Windows box, we don't -put them (for now) in this same subdirectory of the Samba box! This -re-location will automatically be done by the -adddriver command which we will run shortly (and -don't forget to also put the files for the Win95/98/ME architecture -into the WIN40/ subdirectory should you need -them). -

    Check if the Driver Files are there (with smbclient)

    -For now we verify that our files are there. This can be done with -smbclient too (but of course you can log in via SSH -also and do this through a standard UNIX shell access too): + +Whew that was a lot of typing! Most drivers are a lot smaller many only having three generic +PostScript driver files plus one PPD. While we did retrieve the files from the 2 +subdirectory of the W32X86 directory from the Windows box, we do not put them +(for now) in this same subdirectory of the Samba box. This relocation will automatically be done by the +adddriver command, which we will run shortly (and do not forget to also put the files +for the Windows 9x/Me architecture into the WIN40/ subdirectory should you need them). +

    smbclient to Confirm Driver Installation

    +For now we verify that our files are there. This can be done with smbclient, too +(but, of course, you can log in via SSH also and do this through a standard UNIX shell access): 

     root# smbclient //SAMBA-CUPS/print\$ -U 'root%xxxx' \
 	-c 'cd W32X86; pwd; dir; cd 2; pwd; dir'
  added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
 Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
-Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
+Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.8a]
 
 Current directory is \\SAMBA-CUPS\print$\W32X86\
-.                                   D        0  Sun May  4 03:56:35 2003
-..                                  D        0  Thu Apr 10 23:47:40 2003
+.                                  D        0  Sun May  4 03:56:35 2003
+..                                 D        0  Thu Apr 10 23:47:40 2003
 2                                   D        0  Sun May  4 03:56:18 2003
 HDNIS01Aux.dll                      A    15356  Sun May  4 03:58:59 2003
 Hddm91c1KMMin.DLL                   A    46966  Sun May  4 03:58:59 2003
@@ -6889,8 +7066,8 @@ Hddm91c1_de_reg.HLP                 A   228417  Sun May  4 03:58:59 2003
               40976 blocks of size 262144. 709 blocks available
 
 Current directory is \\SAMBA-CUPS\print$\W32X86\2\
-.                                   D        0  Sun May  4 03:56:18 2003
-..                                  D        0  Sun May  4 03:56:35 2003
+.                                  D        0  Sun May  4 03:56:18 2003
+..                                 D        0  Sun May  4 03:56:35 2003
 ADOBEPS5.DLL                        A   434400  Sat May  3 23:18:45 2003
 laserjet4.ppd                       A     9639  Thu Apr 24 01:05:32 2003
 ADOBEPSU.DLL                        A   109568  Sat May  3 23:18:45 2003
@@ -6898,76 +7075,64 @@ ADOBEPSU.HLP                        A    18082  Sat May  3 23:18:45 2003
 PDFcreator2.PPD                     A    15746  Sun Apr 20 22:24:07 2003
               40976 blocks of size 262144. 709 blocks available

    -Notice that there are already driver files present in the -2 subdir (probably from a previous -installation). Once the files for the new driver are there too, you -are still a few steps away from being able to use them on the -clients. The only thing you could do *now* is to retrieve them from a -client just like you retrieve ordinary files from a file share, by -opening print$ in Windows Explorer. But that wouldn't install them per -Point'n'Print. The reason is: Samba doesn't know yet that these files -are something special, namely printer driver -files and it doesn't know yet to which print queue(s) these -driver files belong. -

    Running rpcclient with -adddriver

    -So, next you must tell Samba about the special category of the files -you just uploaded into the [print$] share. This -is done by the adddriver command. It will -prompt Samba to register the driver files into its internal TDB -database files. The following command and its output has been edited, -again, for readability: +Notice that there are already driver files present in the 2 subdirectory (probably +from a previous installation). Once the files for the new driver are there too, you are still a few +steps away from being able to use them on the clients. The only thing you could do now is to retrieve +them from a client just like you retrieve ordinary files from a file share, by opening print$ in Windows +Explorer. But that wouldn't install them per Point'n'Print. The reason +is: Samba does not yet know that +these files are something special, namely printer driver files and it does not know +to which print queue(s) these driver files belong. +

    Running rpcclient with adddriver

    +Next, you must tell Samba about the special category of the files you just uploaded into the +[print$] share. This is done by the adddriver +command. It will prompt Samba to register the driver files into its internal TDB database files. The +following command and its output has been edited, again, for readability: 

    -		root# rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" \
-"dm9110:HDNIS01_de.DLL: \
-Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
- NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
- Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
- Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
- HDNIS01Aux.dll,HDNIS01_de.NTF,                     \
- Hddm91c1_de_reg.HLP' SAMBA-CUPS
+root# rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" \
+  "dm9110:HDNIS01_de.DLL: \
+  Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
+  NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
+  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
+  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+  HDNIS01Aux.dll,HDNIS01_de.NTF,                     \
+  Hddm91c1_de_reg.HLP' SAMBA-CUPS
 
 cmd = adddriver "Windows NT x86" \
-"dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:    \
- HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
- Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,          \
- Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,        \
- HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
+  "dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:   \
+  HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
+  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,          \
+  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,        \
+  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
 
 Printer Driver dm9110 successfully installed.
-

    -After this step the driver should be recognized by Samba on the print -server. You need to be very careful when typing the command. Don't -exchange the order of the fields. Some changes would lead to a -NT_STATUS_UNSUCCESSFUL error -message. These become obvious. Other changes might install the driver -files successfully, but render the driver unworkable. So take care! -Hints about the syntax of the adddriver command are in the man -page. The CUPS printing chapter of this HOWTO collection provides a -more detailed description, if you should need it. -

    Check how Driver Files have been moved after -adddriver finished

    -One indication for Samba's recognition of the files as driver files is -the successfully installed message. -Another one is the fact, that our files have been moved by the -adddriver command into the 2 -subdirectory. You can check this again with -smbclient: +After this step, the driver should be recognized by Samba on the print server. You need to be very +careful when typing the command. Don't exchange the order of the fields. Some changes would lead to +an NT_STATUS_UNSUCCESSFUL error message. These become obvious. Other +changes might install the driver files successfully, but render the driver unworkable. So take care! +Hints about the syntax of the adddriver command are in the man page. The CUPS printing chapter +provides a more detailed description, should you need it. +

    Checking adddriver Completion

    +One indication for Samba's recognition of the files as driver files is the successfully +installed message. Another one is the fact that our files have been moved by the +adddriver command into the 2 subdirectory. You can check this +again with smbclient: 

    -root# smbclient //SAMBA-CUPS/print\$ -Uroot%xx -c 'cd W32X86;dir;pwd;cd 2;dir;pwd'
+root# smbclient //SAMBA-CUPS/print\$ -Uroot%xx \
+	-c 'cd W32X86;dir;pwd;cd 2;dir;pwd'
  added interface ip=10.160.51.162 bcast=10.160.51.255 nmask=255.255.252.0
  Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
 
   Current directory is \\SAMBA-CUPS\print$\W32X86\
-  .                                   D        0  Sun May  4 04:32:48 2003
-  ..                                  D        0  Thu Apr 10 23:47:40 2003
+  .                                  D        0  Sun May  4 04:32:48 2003
+  ..                                 D        0  Thu Apr 10 23:47:40 2003
   2                                   D        0  Sun May  4 04:32:48 2003
                 40976 blocks of size 262144. 731 blocks available 
 
   Current directory is \\SAMBA-CUPS\print$\W32X86\2\
-  .                                   D        0  Sun May  4 04:32:48 2003
-  ..                                  D        0  Sun May  4 04:32:48 2003
+  .                                  D        0  Sun May  4 04:32:48 2003
+  ..                                 D        0  Sun May  4 04:32:48 2003
   DigiMaster.PPD                      A   148336  Thu Apr 24 01:07:00 2003
   ADOBEPS5.DLL                        A   434400  Sat May  3 23:18:45 2003
   laserjet4.ppd                       A     9639  Thu Apr 24 01:05:32 2003
@@ -6990,62 +7155,54 @@ subdirectory. You can check this again with
   HDNIS01U_de.HLP                     A    19770  Sun May  4 04:32:18 2003
   Hddm91c1_de_reg.HLP                 A   228417  Sun May  4 04:32:18 2003
                 40976 blocks of size 262144. 731 blocks available
-

    -Another verification is that the timestamp of the printing TDB files -is now updated (and possibly their filesize has increased). -

    Check if the Driver is recognized by Samba

    -Now the driver should be registered with Samba. We can easily verify -this, and will do so in a moment. However, this driver is -not yet associated with a particular -printer. We may check the driver status of the -files by at least three methods: -

    • from any Windows client browse Network Neighbourhood, -find the Samba host and open the Samba Printers and -Faxes folder. Select any printer icon, right-click and -select the printer Properties. Click on the -Advanced tab. Here is a field indicating the -driver for that printer. A drop down menu allows you to change that -driver (be careful to not do this unwittingly.). You can use this -list to view all drivers know to Samba. Your new one should be amongst -them. (Each type of client will only see his own architecture's -list. If you don't have every driver installed for each platform, the -list will differ if you look at it from Windows95/98/ME or -WindowsNT/2000/XP.)

    • from a Windows 2000 or XP client (not WinNT) browse -Network Neighbourhood, search for the Samba -server and open the server's Printers folder, -right-click the white background (with no printer highlighted). Select -Server Properties. On the -Drivers tab you will see the new driver listed -now. This view enables you to also inspect the list of files belonging -to that driver (this doesn't work on Windows NT, but only on -Windows 2000 and Windows XP. WinNT doesn't provide the "Drivers" -tab).. An alternative, much quicker method for Windows -2000/XP to start this dialog is by typing into a DOS box (you must of -course adapt the name to your Samba server instead of SAMBA-CUPS): -

      rundll32 printui.dll,PrintUIEntry /s /t2 /n\\SAMBA-CUPS

    • from a UNIX prompt run this command (or a variant -thereof), where SAMBA-CUPS is the name of the Samba -host and "xxxx" represents the actual Samba password assigned to root: -

      rpcclient -U'root%xxxx' -c 'enumdrivers' SAMBA-CUPS

      -You will see a listing of all drivers Samba knows about. Your new one -should be amongst them. But it is only listed under the [Windows NT -x86] heading, not under [Windows 4.0], -since we didn't install that part. Or did *you*? -- You will see a listing of -all drivers Samba knows about. Your new one should be amongst them. In our -example it is named dm9110. Note that the 3rd column -shows the other installed drivers twice, for each supported architecture one -time. Our new driver only shows up for -Windows NT 4.0 or 2000. To -have it present for Windows 95, 98 and ME you'll -have to repeat the whole procedure with the WIN40 architecture and subdirectory. -

    A side note: you are not bound to specific driver names

    -You can name the driver as you like. If you repeat the -adddriver step, with the same files as before, but -with a different driver name, it will work the same: +Another verification is that the timestamp of the printing TDB files is now updated +(and possibly their file size has increased). +

    Check Samba for Driver Recognition

    +Now the driver should be registered with Samba. We can easily verify this, and will do so in a +moment. However, this driver is not yet associated with a particular printer. We may check the driver +status of the files by at least three methods: +

    • + From any Windows client browse Network Neighborhood, find the Samba host and open the Samba + Printers and Faxes folder. Select any printer icon, right-click and select + the printer Properties. Click the Advanced + tab. Here is a field indicating the driver for that printer. A drop-down menu allows you to + change that driver (be careful not to do this unwittingly). You can use this list to view + all drivers known to Samba. Your new one should be among them. (Each type of client will only + see his own architecture's list. If you do not have every driver installed for each platform, + the list will differ if you look at it from Windows95/98/ME or WindowsNT/2000/XP.) +

    • + From a Windows 200x/XP client (not Windows NT) browse Network Neighborhood, + search for the Samba server and open the server's Printers folder, + right-click on the white background (with no printer highlighted). Select Server + Properties. On the Drivers tab you will see the new driver + listed. This view enables you to also inspect the list of files belonging to that driver + (this does not work on Windows NT, but only on Windows 2000 and Windows XP; Windows NT does not + provide the Drivers tab). An + alternative and much quicker method for + Windows 2000/XP to start this dialog is by typing into a DOS box (you must of course adapt the + name to your Samba server instead of SAMBA-CUPS): +

      rundll32 printui.dll,PrintUIEntry /s /t2 /n\\SAMBA-CUPS

    • + From a UNIX prompt, run this command (or a variant thereof) where + SAMBA-CUPS is the name of the Samba host and xxxx represents the + actual Samba password assigned to root: +

      rpcclient -U'root%xxxx' -c 'enumdrivers' SAMBA-CUPS

      + You will see a listing of all drivers Samba knows about. Your new one should be among + them. But it is only listed under the [Windows NT x86] heading, not under + [Windows 4.0], since you didn't install that part. Or did you? + You will see a listing of all drivers Samba knows about. Your new one should be among them. In + our example it is named dm9110. Note that the third column shows the other + installed drivers twice, one time for each supported architecture. Our new driver only shows up + for Windows NT 4.0 or 2000. To have it present for Windows + 95, 98 and ME, you'll have to repeat the whole procedure with the WIN40 architecture + and subdirectory. +

    Specific Driver Name Flexibility

    +You can name the driver as you like. If you repeat the adddriver step with the same +files as before but with a different driver name, it will work the same: 

    -root# rpcclient -Uroot%xxxx                                        \
+root# rpcclient -Uroot%xxxx         \
   -c 'adddriver "Windows NT x86"                     \
-  "myphantasydrivername:HDNIS01_de.DLL:              \
+  "mydrivername:HDNIS01_de.DLL:              \
   Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
   NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
   Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
@@ -7053,345 +7210,292 @@ with a different driver name, it will work the same:
   HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP' SAMBA-CUPS
   
 
- cmd = adddriver "Windows NT x86" 
-                 "myphantasydrivername:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:\
-                  HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,           \
-                  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,                    \
-                  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,                  \
-                  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
-
- Printer Driver myphantasydrivername successfully installed.
-
-

    -You will also be able to bind that driver to any print queue (however, -you are responsible yourself that you associate drivers to queues -which make sense to the target printer). Note, that you can't run the -rpcclient adddriver command -repeatedly. Each run "consumes" the files you had put into the -[print$] share by moving them into the -respective subdirectories. So you must precede an -smbclient ... put command before each -rpcclient ... adddriver" command. -

    Running rpcclient with -setdriver

    -Samba still needs to know which printer's driver -this is. It needs to create a mapping of the driver to a printer, and -store this info in its "memory", the TDB files. The rpcclient -setdriver command achieves exactly this: +cmd = adddriver "Windows NT x86" \ + "mydrivername:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:\ + HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \ + Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre, \ + Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \ + HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP" + +Printer Driver mydrivername successfully installed. +

    +You will be able to bind that driver to any print queue (however, you are responsible that +you associate drivers to queues that make sense with respect to target printers). You cannot run the +rpcclient adddriver command repeatedly. Each run consumes the +files you had put into the [print$] share by moving them into the +respective subdirectories. So you must execute an smbclient ... put command before +each rpcclient ... adddriver command. +

    Running rpcclient with the setdriver

    +Samba needs to know which printer owns which driver. Create a mapping of the driver to a printer, and +store this info in Samba's memory, the TDB files. The rpcclient setdriver command +achieves exactly this: 

    -root# rpcclient -U'root%xxxx' -c 'setdriver dm9110 myphantasydrivername' SAMBA-CUPS
- cmd = setdriver dm9110 myphantasydrivername
- Successfully set dm9110 to driver myphantasydrivername.
+root# rpcclient -U'root%xxxx' -c 'setdriver dm9110 mydrivername' SAMBA-CUPS
+ cmd = setdriver dm9110 mydrivername
+
+Successfully set dm9110 to driver mydrivername.

    -Ahhhhh -- no, I didn't want to do that. Repeat, this time with the -name I intended: +Ah, no, I did not want to do that. Repeat, this time with the name I intended: 

     root# rpcclient -U'root%xxxx' -c 'setdriver dm9110 dm9110' SAMBA-CUPS
  cmd = setdriver dm9110 dm9110
- Successfully set dm9110 to driver dm9110.
-

    -The syntax of the command is rpcclient --U'root%sambapassword' -c 'setdriver -"printername" -"drivername' -SAMBA-Hostname . -- -Now we have done *most* of the work. But not yet all.... +Successfully set dm9110 to driver dm9110. +

    +The syntax of the command is: +

    +rpcclient -U'root%sambapassword' -c 'setdriver printername \
+ drivername' SAMBA-Hostname. 
+

    +Now we have done most of the work, but not all of it.

    Note

    -the setdriver command will only succeed if the printer is -known to -Samba already. A bug in 2.2.x prevented Samba from recognizing freshly -installed printers. You had to restart Samba, or at least send a HUP -signal to all running smbd processes to work around this: -kill -HUP `pidof smbd`.

    Client Driver Install Procedure

    -A famous philosopher said once: “The Proof of the Pudding lies -in the Eating”. The proof for our setup lies in the printing. -So let's install the printer driver onto the client PCs. This is not -as straightforward as it may seem. Read on. -

    The first Client Driver Installation

    -Especially important is the installation onto the first client PC (for -each architectural platform separately). Once this is done correctly, -all further clients are easy to setup and shouldn't need further -attention. What follows is a description for the recommended first -procedure. You work now from a client workstation. First you should -guarantee that your connection is not unwittingly mapped to -bad user "nobody". In a DOS box type: +The setdriver command will only succeed if the +printer is already known to Samba. A +bug in 2.2.x prevented Samba from recognizing freshly installed printers. You had to restart Samba, +or at least send an HUP signal to all running smbd processes to work around this: kill -HUP +`pidof smbd`. +

    Client Driver Installation Procedure

    +As Don Quixote said: “The proof of the pudding is in the eating.” The proof +for our setup lies in the printing. So let's install the printer driver onto the client PCs. This is +not as straightforward as it may seem. Read on. +

    First Client Driver Installation

    +Especially important is the installation onto the first client PC (for each architectural platform +separately). Once this is done correctly, all further clients are easy to setup and shouldn't need further +attention. What follows is a description for the recommended first procedure. You work now from a client +workstation. You should guarantee that your connection is not unwittingly mapped to bad +user nobody. In a DOS box type:

    net use \\SAMBA-SERVER\print$ /user:root

    -Replace root, if needed, by another valid -printer admin user as given in the definition. -Should you already be connected as a different user, you'll get an error -message. There is no easy way to get rid of that connection, because -Windows doesn't seem to know a concept of "logging off" from a share -connection (don't confuse this with logging off from the local -workstation; that is a different matter). You can try to close -all Windows file explorer and Internet Explorer -windows. As a last resort, you may have to reboot. Make sure there is -no automatic re-connection set up. It may be easier to go to a -different workstation and try from there. After you have made sure you -are connected as a printer admin user (you can check this with the -smbstatus command on Samba) do this from the -Windows workstation: -

    • Open Network -Neighbourhood

    • Browse to Samba server

    • Open its Printers and -Faxes folder

    • Highlight and right-click the printer

    • Select Connect... (for WinNT4/2K -it is possibly Install...)

    -A new printer (named printername on -samba-server) should now have appeared in your -local Printer folder (check Start -- -Settings -- Control Panel --- Printers and Faxes). -

    -Most likely you are now tempted to try and print a test page. After -all, you now can open the printer properties and on the "General" tab, -there is a button offering to do just that. But chances are that you -get an error message saying Unable to print Test -Page. The reason might be that there is not yet a -valid Device Mode set for the driver, or that the "Printer Driver -Data" set is still incomplete. -

    -You must now make sure that a valid "Device Mode" is set for the -driver. Don't fear -- we will explain now what that means. -

    IMPORTANT! Setting Device Modes on new Printers

    -In order for a printer to be truly usable by a Windows NT/2K/XP -client, it must possess: -

    • a valid Device Mode generated by -the driver for the printer (defining things like paper size, -orientation and duplex settings), and

    • a complete set of -Printer Driver Data generated by the -driver.

    -If either one of these is incomplete, the clients can produce less -than optimal output at best. In the worst cases, unreadable garbage or -nothing at all comes from the printer or they produce a harvest of -error messages when attempting to print. Samba stores the named values -and all printing related info in its internal TDB database files -(ntprinters.tdb, -ntdrivers.tdb, printing.tdb -and ntforms.tdb). -

    -What do these two words stand for? Basically, the Device Mode and the -set of Printer Driver Data is a collection of settings for all print -queue properties, initialized in a sensible way. Device Modes and -Printer Driver Data should initially be set on the print server (that is -here: the Samba host) to healthy values so that the clients can start -to use them immediately. How do we set these initial healthy values? -This can be achieved by accessing the drivers remotely from an NT (or -2k/XP) client, as is discussed in the next paragraphs. -

    -Be aware, that a valid Device Mode can only be initiated by a -printer admin, or root (the reason should be -obvious). Device Modes can only correctly be set by executing the -printer driver program itself. Since Samba can not execute this Win32 -platform driver code, it sets this field initially to NULL (which is -not a valid setting for clients to use). Fortunately, most drivers -generate themselves the Printer Driver Data that is needed, when they -are uploaded to the [print$] share with the -help of the APW or rpcclient. -

    -The generation and setting of a first valid Device Mode however -requires some "tickling" from a client, to set it on the Samba -server. The easiest means of doing so is to simply change the page -orientation on the server's printer. This "executes" enough of the -printer driver program on the client for the desired effect to happen, -and feeds back the new Device Mode to our Samba server. You can use the -native Windows NT/2K/XP printer properties page from a Window client -for this: -

    • Browse the Network Neighbourhood

    • Find the Samba server

    • Open the Samba server's Printers and - Faxes folder

    • Highlight the shared printer in question

    • Right-click the printer (you may already be here, if you -followed the last section's description)

    • At the bottom of the context menu select -Properties.... (if the menu still offers the -Connect... entry -further above, you need to click that one first to achieve the driver -installation as shown in the last section)

    • Go to the Advanced tab; click on -Printing Defaults...

    • Change the "Portrait" page setting to "Landscape" (and -back)

    • (Oh, and make sure to apply -changes between swapping the page orientation to cause the change to -actually take effect...).

    • While you're at it, you may optionally also want to -set the desired printing defaults here, which then apply to all future -client driver installations on the remaining from now -on.

    -This procedure has executed the printer driver program on the client -platform and fed back the correct Device Mode to Samba, which now -stored it in its TDB files. Once the driver is installed on the -client, you can follow the analogous steps by accessing the -local Printers folder too if you are -a Samba printer admin user. From now on printing should work as expected. -

    -Samba also includes a service level parameter name default -devmode for generating a default Device Mode for a -printer. Some drivers will function well with Samba's default set of -properties. Others may crash the client's spooler service. So use this -parameter with caution. It is always better to have the client -generate a valid device mode for the printer and store it on the -server for you. -

    Further Client Driver Install Procedures

    -Every further driver may be done by any user, along the lines -described above: Browse network, open printers folder on Samba server, -right-click printer and choose Connect.... Once -this completes (should be not more than a few seconds, but could also take -a minute, depending on network conditions), you should find the new printer in -your client workstation local Printers and -Faxes folder. +Replace root, if needed, by another valid printer admin user as given in +the definition. Should you already be connected as a different user, you will get an error message. There +is no easy way to get rid of that connection, because Windows does not seem to know a concept of logging +off from a share connection (do not confuse this with logging off from the local workstation; that is +a different matter). You can try to close all Windows file explorer +and Internet Explorer for Windows. As +a last resort, you may have to reboot. Make sure there is no automatic reconnection set up. It may be +easier to go to a different workstation and try from there. After you have made sure you are connected +as a printer admin user (you can check this with the smbstatus command on Samba), +do this from the Windows workstation: +

    1. + Open Network Neighborhood. +

    2. + Browse to Samba server. +

    3. + Open its Printers and Faxes folder. +

    4. + Highlight and right-click on the printer. +

    5. + Select Connect (for Windows NT4/200x + it is possibly Install). +

    +A new printer (named printername on Samba-server) should now have +appeared in your local Printer folder (check Start -- +Settings -- Control Panel -- Printers +and Faxes). +

    +Most likely you are now tempted to try to print a test page. After all, you now can open the printer +properties, and on the General tab there is a button offering to do just that. But +chances are that you get an error message saying Unable to print Test Page. The +reason might be that there is not yet a valid Device Mode set for the driver, or that the “Printer +Driver Data” set is still incomplete. +

    +You must make sure that a valid Device Mode is set for the +driver. We now explain what that means. +

    Setting Device Modes on New Printers

    +For a printer to be truly usable by a Windows NT/200x/XP client, it must possess: +

    • + A valid Device Mode generated by the driver for the printer (defining things + like paper size, orientation and duplex settings). +

    • + A complete set of Printer Driver Data generated by the driver. +

    +If either of these is incomplete, the clients can produce less than optimal output at best. In the +worst cases, unreadable garbage or nothing at all comes from the printer or it produces a harvest of +error messages when attempting to print. Samba stores the named values and all printing related information in +its internal TDB database files (ntprinters.tdb, ntdrivers.tdb, +printing.tdb and ntforms.tdb). +

    +What do these two words stand for? Basically, the Device Mode and the set of Printer Driver Data is a +collection of settings for all print queue properties, initialized in a sensible way. Device Modes and +Printer Driver Data should initially be set on the print server (the Samba host) to healthy +values so the clients can start to use them immediately. How do we set these initial healthy values? +This can be achieved by accessing the drivers remotely from an NT (or 200x/XP) client, as is discussed +in the following paragraphs. +

    +Be aware that a valid Device Mode can only be initiated by a +printer admin, or root +(the reason should be obvious). Device Modes can only be correctly +set by executing the printer driver program itself. Since Samba cannot execute this Win32 platform driver +code, it sets this field initially to NULL (which is not a valid setting for clients to use). Fortunately, +most drivers automatically generate the Printer Driver Data that is needed when they are uploaded to the +[print$] share with the help of the APW or rpcclient. +

    +The generation and setting of a first valid Device Mode, however, requires some tickling from a client, +to set it on the Samba server. The easiest means of doing so is to simply change the page orientation on +the server's printer. This executes enough of the printer driver program on the client for the desired +effect to happen, and feeds back the new Device Mode to our Samba server. You can use the native Windows +NT/200x/XP printer properties page from a Window client for this: +

    1. + Browse the Network Neighborhood. +

    2. + Find the Samba server. +

    3. + Open the Samba server's Printers and Faxes folder. +

    4. + Highlight the shared printer in question. +

    5. + Right-click on the printer (you may already be here, if you followed the last section's description). +

    6. + At the bottom of the context menu select Properties (if the menu still offers the + Connect entry further above, you + need to click on that one first to achieve the driver + installation as shown in the last section). +

    7. + Go to the Advanced tab; click on Printing Defaults. +

    8. + Change the Portrait page setting to Landscape (and back). +

    9. + Make sure to apply changes between swapping the page orientation to cause the change to actually take effect. +

    10. + While you are at it, you may also want to set the desired printing defaults here, which then apply to all future + client driver installations on the remaining from now on. +

    +This procedure has executed the printer driver program on the client platform and fed back the correct +Device Mode to Samba, which now stored it in its TDB files. Once the driver is installed on the client, +you can follow the analogous steps by accessing the local Printers +folder, too, if you are a Samba printer admin user. From now on, printing should work as expected. +

    +Samba includes a service level parameter name default devmode for generating a default +Device Mode for a printer. Some drivers will function well with Samba's default set of properties. Others +may crash the client's spooler service. So use this parameter with caution. It is always better to have +the client generate a valid device mode for the printer and store it on the server for you. +

    Additional Client Driver Installation

    +Every additional driver may be installed, along the lines described +above. Browse network, open the +Printers folder on Samba server, right-click on Printer and choose +Connect.... Once this completes (should be not more than a few seconds, +but could also take a minute, depending on network conditions), you should find the new printer in your +client workstation local Printers and Faxes folder.

    You can also open your local Printers and Faxes folder by -using this command on Windows 2000 and Windows XP Professional workstations: -

    rundll32 shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder -

    +using this command on Windows 200x/XP Professional workstations: +

    rundll32 shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder

    or this command on Windows NT 4.0 workstations:

    rundll32 shell32.dll,Control_RunDLL MAIN.CPL @2

    -You can enter the commands either inside a DOS box window -or in the Run command... field from the -Start menu. -

    Always make first Client Connection as root or "printer admin"

    -After you installed the driver on the Samba server (in its -[print$] share, you should always make sure -that your first client installation completes correctly. Make it a habit for -yourself to build that the very first connection from a client as -printer admin. This is to make sure that: -

    • a first valid Device Mode is -really initialized (see above for more explanation details), and -that

    • the default print settings of your printer for all -further client installations are as you want them

    -Do this by changing the orientation to landscape, click -Apply, and then change it back again. Then modify -the other settings (for example, you don't want the default media size -set to Letter, when you are all using -A4, right? You may want to set the printer for -duplex as the default; etc.). -

    -To connect as root to a Samba printer, try this command from a Windows -2K/XP DOS box command prompt: +You can enter the commands either inside a DOS box window or in the Run +command... field from the Start menu. +

    Always Make First Client Connection as root or “printer admin”

    +After you installed the driver on the Samba server (in its [print$] +share, you should always make sure that your first client installation completes correctly. Make it a +habit for yourself to build the very first connection from a client as printer admin. This is to make sure that: +

    • + A first valid Device Mode is really initialized (see above for more + explanation details). +

    • + The default print settings of your printer for all further client installations are as you want them. +

    +Do this by changing the orientation to landscape, click on Apply, and then change it +back again. Next, modify the other settings (for example, you do not want the default media size set to +Letter when you are all using A4, right? You may want to set the +printer for duplex as the default, and so on). +

    +To connect as root to a Samba printer, try this command from a Windows 200x/XP DOS box command prompt: 

     C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n 
 	\\SAMBA-SERVER\printername"

    You will be prompted for root's Samba-password; type it, wait a few -seconds, click on Printing Defaults... and -proceed to set the job options as should be used as defaults by all -clients. Alternatively, instead of root you can name one other member -of the printer admin from the setting. -

    -Now all the other users downloading and installing the driver -the same way (called Point'n'Print) will -have the same defaults set for them. If you miss this step you'll -get a lot of helpdesk calls from your users. But maybe you like to -talk to people.... ;-) -

    Other Gotchas

    -Your driver is installed. It is ready for -Point'n'Print installation by the clients -now. You may have tried to download and use it -onto your first client machine now. But wait... let's make you -acquainted first with a few tips and tricks you may find useful. For -example, suppose you didn't manage to "set the defaults" on the -printer, as advised in the preceding paragraphs? And your users -complain about various issues (such as “We need to set the paper -size for each job from Letter to A4 and it won't store it!”) -

    Setting Default Print Options for the Client Drivers

    +seconds, click on Printing +Defaults, and proceed to set the job options that should be used as defaults by all +clients. Alternately, instead of root you can name one other member of the printer admin from the setting. +

    + Now all the other users downloading and installing the driver the same way (called +“Point'n'Print”) will have the same defaults set for them. If you miss this step +you'll get a lot of Help Desk calls from your users, but maybe you like to talk to people. +

    Other Gotchas

    +Your driver is installed. It is now ready for Point'n'Print +installation by the clients. You may have tried to download and use it +onto your first client machine, but +wait. Let's make sure you are acquainted first with a few tips and tricks you may find useful. For example, +suppose you did not set the defaults on the printer, as advised in the preceding +paragraphs. Your users complain about various issues (such as, “We need to set the paper size +for each job from Letter to A4 and it will not store it.”) +

    Setting Default Print Options for Client Drivers

    The last sentence might be viewed with mixed feelings by some users and -admins. They have struggled for hours and hours and couldn't arrive at -a point were their settings seemed to be saved. It is not their -fault. The confusing thing is this: in the multi-tabbed dialog that pops -up when you right-click the printer name and select -Properties..., you can arrive at two identically -looking dialogs, each claiming that they help you to set printer options, -in three different ways. Here is the definite answer to the "Samba -Default Driver Setting FAQ": -

    “I can't set and save default print options -for all users on Win2K/XP! Why not?”  -How are you doing it? I bet the wrong way.... (it is not very -easy to find out, though). There are 3 different ways to bring you to -a dialog that seems to set everything. All three -dialogs look the same. Only one of them -does what you intend. -Important: you need to be Administrator or Print -Administrator to do this for all users. Here is how I reproduce it in -on XP Professional: - -

    1. The first "wrong" way: - -

      1. Open the Printers -folder.

      2. Right-click on the printer -(remoteprinter on cupshost) and -select in context menu Printing -Preferences...

      3. Look at this dialog closely and remember what it looks -like.

      -

    2. The second "wrong" way: - -

      1. Open the Printers -folder.

      2. Right-click on the printer (remoteprinter on -cupshost) and select in the context menu -Properties

      3. Click on the General -tab

      4. Click on the button Printing -Preferences...

      5. A new dialog opens. Keep this dialog open and go back -to the parent dialog.

      -

    3. The third, the "correct" way: (should you do -this from the beginning, just carry out steps 1. and 2. from second -"way" above) - -

      1. Click on the Advanced -tab. (Hmmm... if everything is "Grayed Out", then you are not logged -in as a user with enough privileges).

      2. Click on the Printing -Defaults... button.

      3. On any of the two new tabs, click on the -Advanced... button.

      4. A new dialog opens. Compare this one to the other, -identical looking one from "B.5" or A.3".

      -

    - -Do you see any difference in the two settings dialogs? I don't -either. However, only the last one, which you arrived at with steps -C.1.-6. will permanently save any settings which will then become the -defaults for new users. If you want all clients to have the same -defaults, you need to conduct these steps as administrator -(printer admin in ) -before a client downloads the driver (the clients -can later set their own per-user defaults by -following the procedures A. -or B. above...). (This is new: Windows 2000 and -Windows XP allow per-user default settings and -the ones the administrator gives them, before they set up their own). -The "parents" of the identically looking dialogs have a slight -difference in their window names: one is called -Default Print Values for Printer Foo on Server -Bar" (which is the one you need) and the other is -called "Print Settings for Printer Foo on Server -Bar". The last one is the one you arrive at when you -right-click on the printer and select Print -Settings.... This is the one what you were -taught to use back in the days of Windows NT! So it is only natural to -try the same way with Win2k or WinXP. You wouldn't dream -that there is now a different "clicking path" to arrive at an -identically looking, but functionally different dialog to set defaults -for all users! -

    Tip

    Try (on Win2000 and WinXP) to run this command (as a user -with the right privileges): +admins. They have struggled for hours and could not arrive at a point +where their settings seemed to be saved. It is not their fault. The confusing +thing is that in the multi-tabbed dialog that pops up when you right-click +on the printer name and select Properties, you +can arrive at two dialogs that appear identical, each claiming that they help +you to set printer options in three different ways. Here is the definite +answer to the Samba default driver setting FAQ: +

    “I can not set and save default print options +for all users on Windows 200x/XP. Why not?”  +How are you doing it? I bet the wrong way. (It is not easy to find out, though). There are three different +ways to bring you to a dialog that seems to set everything. All three +dialogs look the same, but only one +of them does what you intend. You need to be Administrator or Print Administrator to do this for all +users. Here is how I reproduce it in an XP Professional: + +The following list needs periods after the letters and numbers::::::::: +

    1. The first “wrong” way: +

      1. Open the Printers folder.

      2. Right-click on the printer (remoteprinter on cupshost) and + select in context menu Printing Preferences...

      3. Look at this dialog closely and remember what it looks like.

    2. The second “wrong” way: +

      1. Open the Printers folder.

      2. Right-click on the printer (remoteprinter on + cupshost) and select in the context menu + Properties

      3. Click on the General + tab

      4. Click on the Printing + Preferences...

      5. A new dialog opens. Keep this dialog open and go back + to the parent dialog.

      +

    3. + The third and correct way: (should you do this from the beginning, just carry out steps 1 + and 2 from the second method above). +

      1. Click on the Advanced + tab. (If everything is “grayed out,” then you are not logged + in as a user with enough privileges).

      2. Click on the Printing + Defaults button.

      3. On any of the two new tabs, + click on the + Advanced button.

      4. A new dialog opens. Compare + this one to the other. Are they + identical looking comparing one from + “B.5” and one from A.3".

    +Do you see any difference in the two settings dialogs? I do not either. However, only the last one, which +you arrived at with steps C.1 through 6 will permanently save any settings which will then become the defaults +for new users. If you want all clients to have the same defaults, you need to conduct these steps as +administrator (printer admin in ) before +a client downloads the driver (the clients can later set their own per-user defaults +by following procedures A or B above). Windows 200x/XP allow per-user default settings and the ones the +administrator gives them, before they set up their own. The parents of the identically-looking dialogs have a slight difference in their window names; one is called Default Print +Values for Printer Foo on Server Bar" (which is the one you need) and the other is called +“Print Settings for Printer Foo on Server Bar”. The last one is the one you +arrive at when you right-click on the printer and select Print Settings.... This +is the one that you were taught to use back in the days of Windows NT, so it is only natural to try the +same way with Windows 200x/XP. You would not dream that there is now a different path to arrive at an +identically looking, but functionally different, dialog to set defaults for all users. +

    Tip

    Try (on Windows 200x/XP) to run this command (as a user with the right privileges):

    rundll32 printui.dll,PrintUIEntry /p /t3 /n\\SAMBA-SERVER\printersharename

    -to see the tab with the Printing Defaults... -button (the one you need). Also run this command: +To see the tab with the Printing Defaults button (the one you need),also run this command:

    rundll32 printui.dll,PrintUIEntry /p /t0 /n\\SAMBA-SERVER\printersharename

    -to see the tab with the Printing Preferences... -button (the one which doesn't set system-wide defaults). You can -start the commands from inside a DOS box" or from the Start --- Run... menu. -

    Supporting large Numbers of Printers

    -One issue that has arisen during the recent development phase of Samba -is the need to support driver downloads for 100's of printers. Using -Windows NT APW here is somewhat awkward (to say the least). If you -don't want to acquire RSS pains from such the printer installation -clicking orgy alone, you need to think about a non-interactive script. -

    -If more than one printer is using the same driver, the -rpcclient setdriver command can be used to set the -driver associated with an installed queue. If the driver is uploaded -to [print$] once and registered with the -printing TDBs, it can be used by multiple print queues. In this case -you just need to repeat the setprinter subcommand -of rpcclient for every queue (without the need to -conduct the adddriver again and again). The -following is an example of how this could be accomplished: +To see the tab with the Printing Preferences +button (the one which does not set system-wide defaults), you can +start the commands from inside a DOS box" or from Start -> Run. +

    Supporting Large Numbers of Printers

    +One issue that has arisen during the recent development phase of Samba is the need to support driver +downloads for hunderds of printers. Using Windows NT APW here is somewhat awkward (to say the least). If +you do not want to acquire RSS pains from the printer installation clicking orgy alone, you need +to think about a non-interactive script. +

    +If more than one printer is using the same driver, the rpcclient setdriver +command can be used to set the driver associated with an installed queue. If the driver is uploaded to +[print$] once and registered with the printing TDBs, it can be used by +multiple print queues. In this case, you just need to repeat the setprinter subcommand of +rpcclient for every queue (without the need to conduct the adddriver +repeatedly). The following is an example of how this could be accomplished: 

     root# rpcclient SAMBA-CUPS -U root%secret -c 'enumdrivers'
  cmd = enumdrivers
@@ -7410,7 +7514,7 @@ following is an example of how this could be accomplished:
    Driver Name: [dm9110]
 
  Printer Driver Info 1:
-   Driver Name: [myphantasydrivername]
+   Driver Name: [mydrivername]
 
  [....]

    @@ -7444,9 +7548,9 @@ following is an example of how this could be accomplished: 

    -root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 myphantasydrivername'
- cmd = setdriver dm9110 myphantasydrivername
- Successfully set dm9110 to myphantasydrivername.
+root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 mydrivername'
+ cmd = setdriver dm9110 mydrivername
+ Successfully set dm9110 to mydrivername.
 

    @@ -7454,119 +7558,94 @@ following is an example of how this could be accomplished:
  cmd = enumprinters
    flags:[0x800000]
    name:[\\SAMBA-CUPS\dm9110]
-   description:[\\SAMBA-CUPS\dm9110,myphantasydrivername,\
+   description:[\\SAMBA-CUPS\dm9110,mydrivername,\
      110ppm HiVolume DANKA Stuttgart]
    comment:[110ppm HiVolume DANKA Stuttgart]
  [....]

    -It may be not easy to recognize: but the first call to -enumprinters showed the "dm9110" printer with an -empty string where the driver should have been listed (between the 2 -commas in the "description" field). After the -setdriver command succeeded, all is well. (The -CUPS Printing chapter has more info about the installation of printer -drivers with the help of rpcclient). -

    Adding new Printers with the Windows NT APW

    -By default, Samba exhibits all printer shares defined in -smb.conf in the -Printers... folder. Also located in this folder -is the Windows NT Add Printer Wizard icon. The APW will be shown only -if: -

    • ...the connected user is able to successfully execute -an OpenPrinterEx(\\server) with administrative -privileges (i.e. root or printer admin). -

      Tip

      Try this from a Windows 2K/XP DOS box command prompt: -

      -runas /netonly /user:root rundll32 printui.dll,PrintUIEntry /p /t0 /n \\SAMBA-SERVER\printersharename -

      -and click on Printing Preferences... -

    • ... contains the setting -show add printer wizard = yes (the -default).

    +It may not be easy to recognize that the first call to enumprinters showed the +“dm9110” printer with an empty string where the driver should have been listed (between +the 2 commas in the description field). After the setdriver command +succeeded, all is well. +

    Adding New Printers with the Windows NT APW

    +By default, Samba exhibits all printer shares defined in smb.conf in the Printers +folder. Also located in this folder is the Windows NT Add Printer Wizard icon. The APW will be shown only if: +

    • + The connected user is able to successfully execute an OpenPrinterEx(\\server) with + administrative privileges (i.e., root or printer admin). +

      Tip

      Try this from a Windows 200x/XP DOS box command prompt: +

      + runas /netonly /user:root rundll32 printui.dll,PrintUIEntry /p /t0 /n \\SAMBA-SERVER\printersharename +

      + Click on Printing Preferences. +

    • ... contains the setting + show add printer wizard = yes (the + default).

    The APW can do various things: -

    • upload a new driver to the Samba -[print$] share;

    • associate an uploaded driver with an existing (but -still "driverless") print queue;

    • exchange the currently used driver for an existing -print queue with one that has been uploaded before;

    • add an entirely new printer to the Samba host (only in -conjunction with a working add printer command; -a corresponding delete printer command for -removing entries from the Printers... folder -may be provided too)

    -The last one (add a new printer) requires more effort than the -previous ones. In order to use the APW to successfully add a printer -to a Samba server, the add printer command must -have a defined value. The program hook must successfully add the -printer to the UNIX print system (i.e. to -/etc/printcap, -/etc/cups/printers.conf or other appropriate -files) and to if necessary. -

    -When using the APW from a client, if the named printer share does not -exist, smbd will execute the add printer -command and reparse to the -to attempt to locate the new printer share. If the share is still not -defined, an error of Access Denied is -returned to the client. Note that the add printer command is executed under the context of the connected -user, not necessarily a root account. A map to guest = bad user may have connected you unwittingly under the wrong -privilege; you should check it by using the -smbstatus command. -

    Weird Error Message Cannot connect under a -different Name

    -Once you are connected with the wrong credentials, there is no means -to reverse the situation other than to close all Explorer windows, and -perhaps reboot. -

    • The net use \\SAMBA-SERVER\sharename -/user:root gives you an error message: Multiple -connections to a server or a shared resource by the same user -utilizing the several user names are not allowed. Disconnect all -previous connections to the server, resp. the shared resource, and try -again.

    • Every attempt to "connect a network drive" to -\\SAMBASERVER\\print$ to z: is countered by the -pertinacious message. This network folder is currently -connected under different credentials (username and password). -Disconnect first any existing connection to this network share in -order to connect again under a different username and -password.

    -So you close all connections. You try again. You get the same -message. You check from the Samba side, using -smbstatus. Yes, there are some more -connections. You kill them all. The client still gives you the same -error message. You watch the smbd.log file on a very high debug level -and try re-connect. Same error message, but not a single line in the -log. You start to wonder if there was a connection attempt at all. You -run ethereal and tcpdump while you try to connect. Result: not a -single byte goes on the wire. Windows still gives the error -message. You close all Explorer Windows and start it again. You try to -connect - and this times it works! Windows seems to cache connection -info somewhere and doesn't keep it up to date (if you are unlucky you -might need to reboot to get rid of the error message). -

    Be careful when assembling Driver Files

    -You need to be very careful when you take notes about the files and -belonging to a particular driver. Don't confuse the files for driver -version "0" (for Win95/98/ME, going into -[print$]/WIN/0/), driver version "2" (Kernel Mode -driver for WinNT, going into [print$]/W32X86/2/ -may be used on Win2K/XP too), and driver version -"3" (non-Kernel Mode driver going into -[print$]/W32X86/3/ can not -be used on WinNT). Very often these different driver versions contain -files carrying the same name; but still the files are very different! -Also, if you look at them from the Windows Explorer (they reside in -%WINDOWS%\system32\spool\drivers\W32X86\) you -will probably see names in capital letters, while an "enumdrivers" -command from Samba would show mixed or lower case letters. So it is -easy to confuse them. If you install them manually using -rpcclient and subcommands, you may even succeed -without an error message. Only later, when you try install on a -client, you will encounter error messages like This -server has no appropriate driver for the printer. -

    -Here is an example. You are invited to look very closely at the -various files, compare their names and their spelling, and discover -the differences in the composition of the version-2 and -3 sets -Note: the version-0 set contained 40 (!) -Dependentfiles, so I left it out for space -reasons: +

    • + Upload a new driver to the Samba [print$] share. +

    • + Associate an uploaded driver with an existing (but still driverless) print queue. +

    • + Exchange the currently used driver for an existing print queue with one that has been uploaded before. +

    • + Add an entirely new printer to the Samba host (only in conjunction with a working + add printer command. A corresponding + delete printer command for removing entries from the + Printers folder may also be provided). +

    +The last one (add a new printer) requires more effort than the previous ones. To use +the APW to successfully add a printer to a Samba server, the add printer command must have a defined value. The program hook must successfully +add the printer to the UNIX print system (i.e., to /etc/printcap, +/etc/cups/printers.conf or other appropriate files) and to smb.conf if necessary. +

    +When using the APW from a client, if the named printer share does not exist, smbd will execute the +add printer command and reparse to the to attempt to locate the new printer +share. If the share is still not defined, an error of Access Denied is returned to +the client. The add printer command is executed +under the context of the connected user, not necessarily a root account. A map to guest = bad user may have connected you unwittingly under the wrong +privilege. You should check it by using the smbstatus command. +

    Error Message: “Cannot connect under a different Name”

    +Once you are connected with the wrong credentials, there is no means to reverse the situation other than +to close all Explorer Windows, and perhaps reboot. +

    • + The net use \\SAMBA-SERVER\sharename /user:root gives you an error message: + “Multiple connections to a server or a shared resource by the same user utilizing + the several user names are not allowed. Disconnect all previous connections to the server, + resp. the shared resource, and try again.” +

    • + Every attempt to “connect a network drive” to \\SAMBASERVER\\print$ + to z: is countered by the pertinacious message: “This + network folder is currently connected under different credentials (username and password). + Disconnect first any existing connection to this network share in order to connect again under + a different username and password”. +

    +So you close all connections. You try again. You get the same message. You check from the Samba side, +using smbstatus. Yes, there are more connections. You kill them all. The client +still gives you the same error message. You watch the smbd.log file on a high debug level and try +reconnect. Same error message, but not a single line in the log. You start to wonder if there was a +connection attempt at all. You run ethereal and tcpdump while you try to connect. Result: not a single +byte goes on the wire. Windows still gives the error message. You close all Explorer windows and start it +again. You try to connect and this times it works! Windows seems to cache connection informtion somewhere and +does not keep it up-to-date (if you are unlucky you might need to reboot to get rid of the error message). +

    Take Care When Assembling Driver Files

    +You need to be extremely careful when you take notes about the files and belonging to a particular +driver. Don't confuse the files for driver version “0” (for Windows 9x/Me, going into +[print$]/WIN/0/), driver version 2 (Kernel Mode driver for Windows NT, +going into [print$]/W32X86/2/ may be used on Windows 200x/XP also), and +driver version “3” (non-Kernel Mode driver going into [print$]/W32X86/3/ +cannot be used on Windows NT). Quite often these different driver versions contain +files that have the same name but actually are very different. If you look at them from +the Windows Explorer (they reside in %WINDOWS%\system32\spool\drivers\W32X86\), +you will probably see names in capital letters, while an enumdrivers command from Samba +would show mixed or lower case letters. So it is easy to confuse them. If you install them manually using +rpcclient and subcommands, you may even succeed without an error message. Only later, +when you try install on a client, you will encounter error messages like This server +has no appropriate driver for the printer. +

    +Here is an example. You are invited to look closely at the various files, compare their names and +their spelling, and discover the differences in the composition of the version 2 and 3 sets. Note: the +version 0 set contained 40 Dependentfiles, so I left it out for space reasons: 

     root# rpcclient -U 'Administrator%secret' -c 'enumdrivers 3' 10.160.50.8 
 
@@ -7626,7 +7705,7 @@ reasons:
          Defaultdatatype: []

    -If we write the "version 2" files and the "version 3" files +If we write the “version 2” files and the “version 3” files into different text files and compare the result, we see this picture: 

    @@ -7658,7 +7737,8 @@ picture:
                              > cns3ggr.dll

    -Don't be fooled though! Driver files for each version with identical + +Do not be fooled! Driver files for each version with identical names may be different in their content, as you can see from this size comparison: 

    @@ -7675,341 +7755,279 @@ comparison:
 
   CNS3G.DLL               A  1145088  Thu May 30 02:31:00 2002
   CNS3G.DLL               A    15872  Thu May 30 02:31:00 2002
-

    -In my example were even more differences than shown here. Conclusion: -you must be very careful to select the correct driver files for each -driver version. Don't rely on the names alone. Don't interchange files +In my example were even more differences than shown here. Conclusion: you must be careful to select +the correct driver files for each driver version. Don't rely on the +names alone and don't interchange files belonging to different driver versions. -

    Samba and Printer Ports

    -Windows NT/2000 print servers associate a port with each -printer. These normally take the form of LPT1:, -COM1:, FILE:, etc. Samba -must also support the concept of ports associated with a printer. By -default, only one printer port, named "Samba Printer Port", exists on -a system. Samba does not really need such a "port" in order to print; -it rather is a requirement of Windows clients. They insist on being -told about an available port when they request this info, otherwise -they throw an error message at you. So Samba fakes the port +

    Samba and Printer Ports

    +Windows NT/2000 print servers associate a port with each printer. These normally take the form of +LPT1:, COM1:, +FILE:, and so on. Samba must also +support the concept of ports associated with a printer. By default, only one printer port, named “Samba +Printer Port”, exists on a system. Samba does not really need such a “port” in order +to print; rather it is a requirement of Windows clients. They insist on being told about an available +port when they request this information, otherwise they throw an error message at you. So Samba fakes the port information to keep the Windows clients happy.

    -Note that Samba does not support the concept of "Printer Pooling" -internally either. Printer Pooling assigns a logical printer to -multiple ports as a form of load balancing or fail over. -

    -If you require that multiple ports be defined for some reason or -another (“My users and my Boss should not know that they are -working with Samba”), possesses a -enumports command which can be used to define -an external program that generates a listing of ports on a system. -

    Avoiding the most common Misconfigurations of the Client Driver

    -So - printing works, but there are still problems. Most jobs print -well, some don't print at all. Some jobs have problems with fonts, -which don't look good at all. Some jobs print fast, and some are -dead-slow. We can't cover it all; but we want to encourage you to read -the little paragraph about "Avoiding the wrong PostScript Driver -Settings" in the CUPS Printing part of this document. -

    The Imprints Toolset

    -The Imprints tool set provides a UNIX equivalent of the -Windows NT Add Printer Wizard. For complete information, please -refer to the Imprints web site -at http://imprints.sourceforge.net/ -as well as the documentation included with the imprints source -distribution. This section will only provide a brief introduction -to the features of Imprints. -

    Attention! Maintainer required.  -Unfortunately, the Imprints toolset is no longer maintained. As of -December, 2000, the project is in need of a new maintainer. The most -important skill to have is decent perl coding and an interest in -MS-RPC based printing using Samba. If you wish to volunteer, please -coordinate your efforts on the samba-technical mailing list. The -toolset is still in usable form; but only for a series of older -printer models, where there are prepared packages to use. Packages for -more up to date print devices are needed if Imprints should have a -future.

    What is Imprints?

    +Samba does not support the concept of Printer Pooling internally either. Printer +Pooling assigns a logical printer to multiple ports as a form of load balancing or fail over. +

    +If you require multiple ports be defined for some reason or another (my users and my boss should not know +that they are working with Samba), configure enumports command +which can be used to define an external program that generates a listing of ports on a system. +

    Avoiding Common Client Driver Misconfiguration

    +So now the printing works, but there are still problems. Most jobs print well, some do not print at +all. Some jobs have problems with fonts, which do not look good. Some jobs print fast and some +are dead-slow. We cannot cover it all, but we want to encourage you to read the brief paragraph about +“Avoiding the Wrong PostScript Driver Settings” in the CUPS Printing part of this document. +

    The Imprints Toolset

    +The Imprints tool set provides a UNIX equivalent of the Windows NT Add Printer +Wizard. For complete information, please refer to the Imprints Web site at http://imprints.sourceforge.net/ as well as the documentation +included with the imprints source distribution. This section only provides a brief introduction to +the features of Imprints. +

    +Unfortunately, the Imprints toolset is no longer maintained. As of December 2000, the project is in +need of a new maintainer. The most important skill to have is Perl coding and an interest in MS-RPC-based +printing used in Samba. If you wish to volunteer, please coordinate +your efforts on the Samba technical +mailing list. The toolset is still in usable form, but only for a series of older printer models where +there are prepared packages to use. Packages for more up-to-date print devices are needed if Imprints +should have a future. +

    What is Imprints?

    Imprints is a collection of tools for supporting these goals: -

    • Providing a central repository information regarding -Windows NT and 95/98 printer driver packages

    • Providing the tools necessary for creating the -Imprints printer driver packages.

    • Providing an installation client which will obtain -printer drivers from a central internet (or intranet) Imprints Server -repository and install them on remote Samba and Windows NT4 print -servers.

    Creating Printer Driver Packages

    -The process of creating printer driver packages is beyond the scope of -this document (refer to Imprints.txt also included with the Samba -distribution for more information). In short, an Imprints driver -package is a gzipped tarball containing the driver files, related INF -files, and a control file needed by the installation client. -

    The Imprints Server

    -The Imprints server is really a database server that may be queried -via standard HTTP mechanisms. Each printer entry in the database has -an associated URL for the actual downloading of the package. Each +

    • + Providing a central repository of information regarding Windows NT and 95/98 printer driver packages. +

    • + Providing the tools necessary for creating the Imprints printer driver packages. +

    • + Providing an installation client that will obtain printer drivers from a central Internet (or intranet) Imprints Server + repository and install them on remote Samba and Windows NT4 print servers. +

    Creating Printer Driver Packages

    +The process of creating printer driver packages is beyond the scope of this document (refer to Imprints.txt +also included with the Samba distribution for more information). In short, an Imprints driver package +is a gzipped tarball containing the driver files, related INF files, and a control file needed by the +installation client. +

    The Imprints Server

    +The Imprints server is really a database server that may be queried via standard HTTP mechanisms. Each +printer entry in the database has an associated URL for the actual downloading of the package. Each package is digitally signed via GnuPG which can be used to verify that -package downloaded is actually the one referred in the Imprints -database. It is strongly recommended that this security check -not be disabled. -

    The Installation Client

    -More information regarding the Imprints installation client is -available in the Imprints-Client-HOWTO.ps file -included with the imprints source package. -

    -The Imprints installation client comes in two forms. -

    • a set of command line Perl scripts

    • a GTK+ based graphical interface to the command line Perl -scripts

    -The installation client (in both forms) provides a means of querying -the Imprints database server for a matching list of known printer -model names as well as a means to download and install the drivers on +the package downloaded is actually +the one referred in the Imprints database. It is strongly recommended that this security check +not be disabled. +

    The Installation Client

    +More information regarding the Imprints installation client is available from the the documentation file +Imprints-Client-HOWTO.ps that is included with the Imprints source package. The Imprints +installation client comes in two forms: +

    • A set of command line Perl scripts.

    • A GTK+ based graphical interface to the command line Perl scripts.

    +The installation client (in both forms) provides a means of querying the Imprints database server for +a matching list of known printer model names as well as a means to download and install the drivers on remote Samba and Windows NT print servers.

    -The basic installation process is in four steps and perl code is -wrapped around smbclient and rpcclient +The basic installation process is in four steps and Perl code is wrapped around smbclient and rpcclient.

    • - foreach (supported architecture for a given driver) -

      1. rpcclient: Get the appropriate upload directory on the remote server

      2. smbclient: Upload the driver files

      3. rpcclient: Issues an AddPrinterDriver() MS-RPC

      -

    • rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer

    -One of the problems encountered when implementing the Imprints tool -set was the name space issues between various supported client -architectures. For example, Windows NT includes a driver named "Apple -LaserWriter II NTX v51.8" and Windows 95 calls its version of this -driver "Apple LaserWriter II NTX" -

    -The problem is how to know what client drivers have been uploaded for -a printer. An astute reader will remember that the Windows NT Printer -Properties dialog only includes space for one printer driver name. A -quick look in the Windows NT 4.0 system registry at + For each supported architecture for a given driver: +

    1. rpcclient: Get the appropriate upload directory on the remote server.

    2. smbclient: Upload the driver files.

    3. rpcclient: Issues an AddPrinterDriver() MS-RPC.

    +

  • rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer.

    • +One of the problems encountered when implementing the Imprints tool set was the name space issues between +various supported client architectures. For example, Windows NT includes a driver named “Apple LaserWriter +II NTX v51.8” and Windows 95 calls its version of this driver “Apple LaserWriter II NTX”. +

    +The problem is how to know what client drivers have been uploaded for a printer. An astute reader will +remember that the Windows NT Printer Properties dialog only includes space for one printer driver name. A +quick look in the Windows NT 4.0 system registry at:

    HKLM\System\CurrentControlSet\Control\Print\Environment

    -will reveal that Windows NT always uses the NT driver name. This is -ok as Windows NT always requires that at least the Windows NT version -of the printer driver is present. However, Samba does not have the -requirement internally. Therefore, how can you use the NT driver name -if is has not already been installed? -

    -The way of sidestepping this limitation is to require that all -Imprints printer driver packages include both the Intel Windows NT and -95/98 printer drivers and that NT driver is installed first. -

    Add Network Printers at Logon without User Interaction

    -The following MS Knowledge Base article may be of some help if you -need to handle Windows 2000 clients: How to Add Printers -with No User Interaction in Windows 2000. ( http://support.microsoft.com/default.aspx?scid=kb;en-us;189105 -). It also applies to Windows XP Professional clients. -

    -The ideas sketched out below are inspired by this article. It -describes a commandline method which can be applied to install -network and local printers and their drivers. This is most useful -if integrated in Logon Scripts. You can see what options are -available by typing in a command prompt ("DOS box") this: +will reveal that Windows NT always uses the NT driver name. This is okay as Windows NT always requires +that at least the Windows NT version of the printer driver is present. Samba does not have the +requirement internally, therefore, “How can you use the NT driver name if it has not already been installed?” +

    +The way of sidestepping this limitation is to require that all Imprints printer driver packages include both the Intel Windows NT and +95/98 printer drivers and that the NT driver is installed first. +

    Adding Network Printers without User Interaction

    +The following MS Knowledge Base article may be of some help if you need to handle Windows 2000 +clients: How to Add Printers with No User Interaction in Windows 2000, (http://support.microsoft.com/default.aspx?scid=kb;en-us;189105). +It also applies to Windows XP Professional clients. +The ideas sketched out in this section are inspired by this article, which describes a commandline method that can be +applied to install network and local printers and their drivers. This is most useful if integrated in Logon +Scripts. You can see what options are available by typing in the command prompt (DOS box):

    rundll32 printui.dll,PrintUIEntry /?

    -A window pops up which shows you all of the commandline switches -available. An extensive list of examples is also provided. This is -only for Win 2k/XP. It doesn't work on WinNT. WinNT has probably some -other tools in the respective Resource Kit. Here is a suggestion about -what a client logon script might contain, with a short explanation of -what the lines actually do (it works if 2k/XP Windows clients access -printers via Samba, but works for Windows-based print servers too): +A window pops up that shows you all of the commandline switches available. An extensive list of examples +is also provided. This is only for Win 200x/XP, it does not work on +Windows NT. Windows NT probably has +some other tools in the respective Resource Kit. Here is a suggestion about what a client logon script +might contain, with a short explanation of what the lines actually do (it works if 200x/XP Windows +clients access printers via Samba, and works for Windows-based print servers too): 

    -rundll32 printui.dll,PrintUIEntry /dn /n "\\sambacupsserver\infotec2105-IPDS" /q
-rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\infotec2105-PS"
-rundll32 printui.dll,PrintUIEntry /y /n "\\sambacupsserver\infotec2105-PS"
+rundll32 printui.dll,PrintUIEntry /dn /n "\\cupsserver\infotec2105-IPDS" /q
+rundll32 printui.dll,PrintUIEntry /in /n "\\cupsserver\infotec2105-PS"
+rundll32 printui.dll,PrintUIEntry /y /n "\\cupsserver\infotec2105-PS"

    Here is a list of the used commandline parameters: -

    /dn

    deletes a network printer

    /q

    quiet modus

    /n

    names a printer

    /in

    adds a network printer connection

    /y

    sets printer as default printer

    • Line 1 deletes a possibly existing previous network -printer infotec2105-IPDS (which had used native -Windows drivers with LPRng that were removed from the server which was -converted to CUPS). The /q at the end eliminates -"Confirm" or error dialog boxes popping up. They should not be -presented to the user logging on.

    • Line 2 adds the new printer -infotec2105-PS (which actually is same physical -device but is now run by the new CUPS printing system and associated -with the CUPS/Adobe PS drivers). The printer and its driver -must have been added to Samba prior to the user -logging in (e.g. by a procedure as discussed earlier in this chapter, -or by running cupsaddsmb). The driver is now -auto-downloaded to the client PC where the user is about to log -in.

    • Line 3 sets the default printer to this new network -printer (there might be several other printers installed with this -same method and some may be local as well -- so we decide for a -default printer). The default printer selection may of course be -different for different users.

    -Note that the second line only works if the printer -infotec2105-PS has an already working print queue -on "sambacupsserver", and if the printer drivers have successfully been -uploaded (via APW , -smbclient/rpcclient or -cupsaddsmb) into the -[print$] driver repository of Samba. Also, some -Samba versions prior to version 3.0 required a re-start of smbd after -the printer install and the driver upload, otherwise the script (or -any other client driver download) would fail. -

    -Since there no easy way to test for the existence of an installed -network printer from the logon script, the suggestion is: don't bother -checking and just allow the deinstallation/reinstallation to occur -every time a user logs in; it's really quick anyway (1 to 2 seconds). +

    /dn

    deletes a network printer

    /q

    quiet modus

    /n

    names a printer

    /in

    adds a network printer connection

    /y

    sets printer as default printer

    • + Line 1 deletes a possibly existing previous network printer infotec2105-IPDS + (which had used native Windows drivers with LPRng that were removed from the server that was + converted to CUPS). The /q at the end eliminates Confirm + or error dialog boxes from popping up. They should not be presented to the user logging on. +

    • + Line 2 adds the new printer + infotec2105-PS (which actually is the same + physical device but is now run by the new CUPS printing system and associated with the + CUPS/Adobe PS drivers). The printer and its driver must have been added to Samba prior to + the user logging in (e.g., by a procedure as discussed earlier in this chapter, or by running + cupsaddsmb). The driver is now auto-downloaded to the client PC where the + user is about to log in. +

    • + Line 3 sets the default printer to this new network printer (there might be several other + printers installed with this same method and some may be local as well, so we decide for a + default printer). The default printer selection may, of course, be different for different users. +

    +The second line only works if the printer infotec2105-PS has an already working +print queue on the cupsserver, and if the +printer drivers have been successfully uploaded +(via the APW, smbclient/rpcclient, or cupsaddsmb) +into the [print$] driver repository of Samba. Some Samba versions +prior to version 3.0 required a re-start of smbd after the printer install and the driver upload, +otherwise the script (or any other client driver download) would fail. +

    +Since there no easy way to test for the existence of an installed network printer from the logon script, +do not bother checking, just allow the deinstallation/reinstallation to occur every time a user logs in; +it's really quick anyway (1 to 2 seconds).

    The additional benefits for this are: -

    • It puts in place any printer default setup changes -automatically at every user logon.

    • It allows for "roaming" users' login into the domain from -different workstations.

    -Since network printers are installed per user this much simplifies the -process of keeping the installation up-to-date. The extra few seconds -at logon time will not really be noticeable. Printers can be centrally -added, changed, and deleted at will on the server with no user -intervention required on the clients (you just need to keep the logon -scripts up to date). -

    The addprinter command

    -The addprinter command can be configured to be a -shell script or program executed by Samba. It is triggered by running -the APW from a client against the Samba print server. The APW asks the -user to fill in several fields (such as printer name, driver to be -used, comment, port monitor, etc.). These parameters are passed on to -Samba by the APW. If the addprinter command is designed in a way that -it can create a new printer (through writing correct printcap entries -on legacy systems, or execute the lpadmin command -on more modern systems) and create the associated share in -, then the APW will in effect really -create a new printer on Samba and the UNIX print subsystem! -

    Migration of "Classical" printing to Samba

    -The basic "NT-style" printer driver management has not changed -considerably in 3.0 over the 2.2.x releases (apart from many small -improvements). Here migration should be quite easy, especially if you -followed previous advice to stop using deprecated parameters in your -setup. For migrations from an existing 2.0.x setup, or if you -continued "Win9x-style" printing in your Samba 2.2 installations, it -is more of an effort. Please read the appropriate release notes and -the HOWTO Collection for 2.2. You can follow several paths. Here are -possible scenarios for migration: -

    • You need to study and apply the new Windows NT printer -and driver support. Previously used parameters printer -driver file, printer driver and -printer driver location are no longer -supported.

    • If you want to take advantage of WinNT printer driver -support you also need to migrate the Win9x/ME drivers to the new -setup.

    • An existing printers.def file - (the one specified in the now removed parameter printer driver file) will work no longer with samba 3. In -3.0, smbd attempts to locate a Win9x/ME driver files for the printer -in [print$] and additional settings in the TDB -and only there; if it fails it will not (as 2.2.x -used to do) drop down to using a printers.def -(and all associated parameters). The make_printerdef tool is removed -and there is no backwards compatibility for this.

    • You need to install a Windows 9x driver into the -[print$] share for a printer on your Samba -host. The driver files will be stored in the "WIN40/0" subdirectory of -[print$], and some other settings and info go -into the printing-related TDBs.

    • If you want to migrate an existing -printers.def file into the new setup, the current -only solution is to use the Windows NT APW to install the NT drivers -and the 9x drivers. This can be scripted using smbclient and -rpcclient. See the Imprints installation client at: -

      - http://imprints.sourceforge.net/ -

      -for an example. See also the discussion of rpcclient usage in the -"CUPS Printing" section.

    Publishing Printer Information in Active Directory or LDAP

    -We will publish an update to this section shortly. -

    Common Errors

    I give my root password but I don't get access

    -Don't confuse the root password which is valid for the UNIX system -(and in most cases stored in the form of a one-way hash in a file -named /etc/shadow) with the password used to -authenticate against Samba!. Samba doesn't know the UNIX password; for -root to access Samba resources via Samba-type access, a Samba account -for root must be created first. This is often done with the -smbpasswd command. -

    My printjobs get spooled into the spooling directory, but then get lost

    -Don't use the existing UNIX print system spool directory for the Samba -spool directory. It may seem convenient and a saving of space, but it -only leads to problems. The two must be separate. -

    Chapter 19. CUPS Printing Support in Samba 3.0

    Kurt Pfeifle

    Danka Deutschland GmbH

    Ciprian Vizitiu

    drawings

    Jelmer R. Vernooij

    drawings
    The Samba Team

    (3 June 2003)

    Table of Contents

    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for -CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for -application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and -native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print -Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many -Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel -Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Caveats to be considered
    Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsmb completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the -Client
    Installing PostScript Driver Files manually (using -rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    In Case of Trouble.....
    Printing from CUPS to Windows attached -Printers
    More CUPS filtering Chains
    Common Errors
    Win9x client can't install driver
    "cupsaddsmb" keeps asking for root password in - neverending loop
    "cupsaddsmb" gives "No PPD file for printer..." - message while PPD file is present
    Client can't connect to Samba printer
    Can't reconnect to Samba under new account - from Win2K/XP
    Avoid being connected to the Samba server as the - "wrong" user
    Upgrading to CUPS drivers from Adobe drivers on - NT/2K/XP clients gives problems
    Can't use "cupsaddsmb" on Samba server which is - a PDC
    Deleted Win2K printer driver is still shown
    Win2K/XP "Local Security - Policies"
    WinXP clients: "Administrator can not install - printers for all local users"
    "Print Change Notify" functions on - NT-clients
    WinXP-SP1
    Print options for all users can't be set on Win2K/XP
    Most common blunders in driver - settings on Windows clients
    cupsaddsmb does not work - with newly installed printer
    Permissions on -/var/spool/samba/ get reset after each -reboot
    Printer named "lp" -intermittently swallows jobs and spits out completely different -ones
    Location of Adobe PostScript driver files necessary for "cupsaddsmb"
    An Overview of the CUPS Printing Processes

    Introduction

    Features and Benefits

    - The Common UNIX Print System (CUPS) has become very popular. All - major Linux distributions now ship it as their default printing - system. To many it is still a very mystical tool. Mostly, it - "just works" (TM). People tend to regard it as a "black box" - which they don't want to look into, as long as it works. But once - there is a little problem, they are in trouble to find out where to - start debugging it. Refer to the "Classical Printing" chapter also, it - contains a lot of information that is relevant for CUPS. +

    • + It puts in place any printer default setup changes automatically at every user logon. +

    • + It allows for “roaming” users' login into the domain from different workstations. +

    +Since network printers are installed per user, this much simplifies the process of keeping the installation +up-to-date. The few extra seconds at logon time will not really be noticeable. Printers can be centrally +added, changed and deleted at will on the server with no user intervention required from the clients +(you just need to keep the logon scripts up-to-date). +

    The addprinter Command

    +The addprinter command can be configured to be a shell script or program executed by +Samba. It is triggered by running the APW from a client against the Samba print server. The APW asks +the user to fill in several fields (such as printer name, driver to be used, comment, port monitor, +and so on). These parameters are passed on to Samba by the APW. If the addprinter command is designed in a +way that it can create a new printer (through writing correct printcap entries on legacy systems, or +execute the lpadmin command on more modern systems) and create the associated share +in, then the APW will in effect really create a new printer on Samba and the UNIX print subsystem! +

    Migration of Classical Printing to Samba

    +The basic NT-style printer driver management has not changed considerably in 3.0 over the 2.2.x releases +(apart from many small improvements). Here migration should be quite easy, especially if you followed +previous advice to stop using deprecated parameters in your setup. For migrations from an existing 2.0.x +setup, or if you continued Windows 9x/Me-style printing in your Samba 2.2 installations, it is more of +an effort. Please read the appropriate release notes and the HOWTO Collection for Samba-2.2.x. You can +follow several paths. Here are possible scenarios for migration: +

    • + You need to study and apply the new Windows NT printer and driver support. Previously used + parameters printer driver file, printer driver + and printer driver location are no longer supported. +

    • + If you want to take advantage of Windows NT printer driver support, you also need to migrate the + Windows 9x/Me drivers to the new setup. +

    • + An existing printers.def file (the one specified in the now removed parameter + printer driver file) will no longer work with Samba-3. In 3.0, smbd attempts + to locate a Windows 9x/Me driver files for the printer in [print$] + and additional settings in the TDB and only there; if it fails, it will not + (as 2.2.x used to do) drop down to using a printers.def (and all associated + parameters). The make_printerdef tool is removed and there is no backward compatibility for this. +

    • You need to install a Windows 9x/Me driver into the + [print$] share for a printer on your Samba + host. The driver files will be stored in the “WIN40/0” subdirectory of + [print$], and some other settings and information go + into the printing-related TDBs.

    • If you want to migrate an existing + printers.def file into the new setup, the + only current + solution is to use the Windows NT APW to install the NT drivers + and the 9x/Me drivers. This can be scripted using smbclient and + rpcclient. See the Imprints installation client at: +

      + http://imprints.sourceforge.net/ +

      + for an example. See also the discussion of rpcclient usage in the + “CUPS Printing” section.

    Publishing Printer Information in Active Directory or LDAP

    +This will be addressed in a later update of this document. If you wish to volunteer your services to help +document this, please contact John H Terpstra. +

    Common Errors

    I Give My Root Password but I Do Not Get Access

    +Do not confuse the root password which is valid for the UNIX system (and in most cases stored in the +form of a one-way hash in a file named /etc/shadow), with the password used to +authenticate against Samba. Samba does not know the UNIX password. Root access to Samba resources +requires that a Samba account for root must first be created. This is done with the smbpasswd +command as follows: +

    +root#  smbpasswd -a root
+New SMB password: secret
+Retype new SMB password: secret
+

    My Print Jobs Get Spooled into the Spooling Directory, but Then Get Lost

    +Do not use the existing UNIX print system spool directory for the Samba spool directory. It may seem +convenient and a savings of space, but it only leads to problems. The two must be separate. +

    Chapter 19. CUPS Printing Support

    Kurt Pfeifle

    Danka Deutschland GmbH

    Ciprian Vizitiu

    drawings

    Jelmer R. Vernooij

    drawings
    The Samba Team

    (3 June 2003)

    Table of Contents

    Introduction
    Features and Benefits
    Overview
    Basic CUPS Support Configuration
    Linking smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More Complex CUPS smb.conf Settings
    Advanced Configuration
    Central Spooling vs. Peer-to-Peer Printing
    Raw Print Serving Vendor Drivers on Windows Clients
    Installation of Windows Client Drivers
    Explicitly Enable raw Printing for application/octet-stream
    Driver Upload Methods
    Advanced Intelligent Printing with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript the Software RIP for Non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    Using Windows-Formatted Vendor PPDs
    CUPS Also Uses PPDs for Non-PostScript Printers
    The CUPS Filtering Architecture
    MIME Types and CUPS Filters
    MIME Type Conversion Rules
    Filtering Overview
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    The Role of cupsomatic/foomatic
    The Complete Picture
    mime.convs
    Raw Printing
    application/octet-stream Printing
    PostScript Printer Descriptions (PPDs) for Non-PS Printers
    cupsomatic/foomatic-rip Versus native CUPS Printing
    Examples for Filtering Chains
    Sources of CUPS Drivers/PPDs
    Printing with Interface Scripts
    Network Printing (Purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows Clients UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba Receiving Jobfiles and Passing Them to CUPS
    Network PostScript RIP
    PPDs for Non-PS Printers on UNIX
    PPDs for Non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers Running in Kernel Mode Cause Many +Problems
    Workarounds Impose Heavy Limitations
    CUPS: A Magical Stone?
    PostScript Drivers with No Major Problems Even in Kernel +Mode
    Configuring CUPS for Driver Download
    cupsaddsmb: The Unknown Utility
    Prepare Your smb.conf for cupsaddsmb
    CUPS PostScript Driver for Windows NT/200x/XP
    Recognizing Different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro PostScript Driver for Windows NT/200x/XP
    Caveats to be Considered
    Windows CUPS PostScript Driver Versus Adobe Driver
    Run cupsaddsmb (Quiet Mode)
    Run cupsaddsmb with Verbose Output
    Understanding cupsaddsmb
    How to Recognize If cupsaddsmb Completed Successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding Critical PostScript Driver Settings on the Client
    Installing PostScript Driver Files Manually Using rpcclient
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by Querying a Windows Box
    Requirements for adddriver and setdriver to Succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting Revisited
    The Printing *.tdb Files
    Trivial Database Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic Explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting Up Quotas
    Correct and Incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings Explained
    Pre-Conditions
    Manual Configuration
    Printing from CUPS to Windows Attached Printers
    More CUPS-Filtering Chains
    Common Errors
    Windows 9x/ME Client Can't Install Driver
    cupsaddsmb Keeps Asking for Root Password in Never-ending Loop
    cupsaddsmb Errors
    Client Can't Connect to Samba Printer
    New Account Reconnection from Windows 200x/XP Troubles
    Avoid Being Connected to the Samba Server as the Wrong User
    Upgrading to CUPS Drivers from Adobe Drivers
    Can't Use cupsaddsmb on Samba Server Which Is a PDC
    Deleted Windows 200x Printer Driver Is Still Shown
    Windows 200x/XP "Local Security Policies"
    Administrator Cannot Install Printers for All Local Users
    Print Change Notify Functions on NT-clients
    WinXP-SP1
    Print Options for All Users Can't Be Set on Windows 200x/XP
    Most Common Blunders in Driver Settings on Windows Clients
    cupsaddsmb Does Not Work with Newly Installed Printer
    Permissions on /var/spool/samba/ Get Reset After Each Reboot
    Print Queue Called lp Mis-handles Print Jobs
    Location of Adobe PostScript Driver Files for cupsaddsmb
    Overview of the CUPS Printing Processes

    Introduction

    Features and Benefits

    + The Common UNIX Print System (CUPS) + has become quite popular. All major Linux distributions now ship it as their default printing + system. To many, it is still a mystical tool. Mostly, it just works. + People tend to regard it as a “black box” + that they do not want to look into as long as it works. But once + there is a little problem, they are in trouble to find out where to + start debugging it. Refer to the chapter “Classical Printing” that + contains a lot of information that is relevant for CUPS.

    - CUPS sports quite a few unique and powerful features. While their - basic functions may be grasped quite easily, they are also - new. Because they are different from other, more traditional printing - systems, it is best to try and not apply any prior knowledge about - printing upon this new system. Rather, try to understand CUPS - from the beginning. This documentation will lead you to a - complete understanding of CUPS. Let's start with the most basic - things first. -

    Overview

    - CUPS is more than just a print spooling system. It is a complete - printer management system that complies with the new IPP - (Internet Printing Protocol). IPP is an industry - and IETF (Internet Engineering Task Force) - standard for network printing. Many of its functions can be managed - remotely (or locally) via a web browser (giving you a - platform-independent access to the CUPS print server). Additionally, it - has the traditional command line and several more modern GUI interfaces - (GUI interfaces developed by 3rd parties, like KDE's - overwhelming KDEPrint). + CUPS sports quite a few unique and powerful features. While their + basic functions may be grasped quite easily, they are also + new. Because they are different from other, more traditional printing + systems, it is best not to try and apply any prior knowledge about + printing to this new system. Rather, try to understand CUPS + from the beginning. This documentation will lead you to a + complete understanding of CUPS. Let's start with the most basic + things first. +

    Overview

    + CUPS is more than just a print spooling system. It is a complete + printer management system that complies with the new + Internet Printing Protocol (IPP). IPP is an industry + and Internet Engineering Task Force (IETF) + standard for network printing. Many of its functions can be managed + remotely (or locally) via a Web browser (giving you a + platform-independent access to the CUPS print server). Additionally, it + has the traditional command line and several more modern GUI interfaces + (GUI interfaces developed by third parties, like KDE's + overwhelming KDEPrint).

    - CUPS allows creation of "raw" printers (ie: NO print file - format translation) as well as "smart" printers (i.e. CUPS does - file format conversion as required for the printer). In many ways - this gives CUPS similar capabilities to the MS Windows print - monitoring system. Of course, if you are a CUPS advocate, you would - argue that CUPS is better! In any case, let us now move on to - explore how one may configure CUPS for interfacing with MS Windows - print clients via Samba. -

    Basic Configuration of CUPS support

    - Printing with CUPS in the most basic smb.conf setup in Samba 3.0 (as was true for 2.2.x) only needs two - settings: printing = cups and - printcap = cups. CUPS does not need a printcap file. - However, the cupsd.conf configuration file knows of two related directives that control - how such a file will be automatically created and maintained by CUPS for the convenience of third party - applications (example: Printcap /etc/printcap and PrintcapFormat BSD). - Legacy programs often require the existence of a printcap file containing printer names or they will refuse to - print. Make sure CUPS is set to generate and maintain a printcap file! For details see - man cupsd.conf and other CUPS-related documentation, like the wealth of documents on your CUPS server - itself: http://localhost:631/documentation.html. -

    Linking of smbd with libcups.so

    - Samba has a very special relationship to CUPS. Samba can be compiled with CUPS library support. - Most recent installations have this support enabled. Per default CUPS linking is compiled - into smbd and other Samba binaries. Of course, you can use CUPS even - if Samba is not linked against libcups.so -- but - there are some differences in required or supported configuration - then. + CUPS allows creation of “raw” printers (i.e., no print file + format translation) as well as “smart” printers (i.e., CUPS does + file format conversion as required for the printer). In many ways + this gives CUPS similar capabilities to the MS Windows print + monitoring system. Of course, if you are a CUPS advocate, you would + argue that CUPS is better! In any case, let us now move on to + explore how one may configure CUPS for interfacing with MS Windows + print clients via Samba. +

    Basic CUPS Support Configuration

    + Printing with CUPS in the most basic smb.conf setup in Samba-3.0 (as was true for 2.2.x) only needs two + settings: printing = cups and + printcap = cups. CUPS does not need a printcap file. + However, the cupsd.conf configuration file knows of two related directives that control + how such a file will be automatically created and maintained by CUPS for the convenience of third-party + applications (example: Printcap /etc/printcap and PrintcapFormat BSD). + Legacy programs often require the existence of a printcap file containing printer names or they will refuse to + print. Make sure CUPS is set to generate and maintain a printcap file. For details, see + man cupsd.conf and other CUPS-related documentation, like the wealth of documents on your CUPS server + itself: http://localhost:631/documentation.html. +

    Linking smbd with libcups.so

    + Samba has a special relationship to CUPS. Samba can be compiled with CUPS library support. + Most recent installations have this support enabled. Per default, CUPS linking is compiled + into smbd and other Samba binaries. Of course, you can use CUPS even + if Samba is not linked against libcups.so but + there are some differences in required or supported configuration.

    - When Samba is compiled against libcups, printcap = cups - uses the CUPS API to list printers, submit jobs, query queues, etc. Otherwise it maps to the System V - commands with an additional -oraw option for printing. On a Linux - system, you can use the ldd utility to find out details (ldd may not be present on - other OS platforms, or its function may be embodied by a different command): + When Samba is compiled against libcups, printcap = cups + uses the CUPS API to list printers, submit jobs, query queues, and so on. Otherwise it maps to the System V + commands with an additional -oraw option for printing. On a Linux + system, you can use the ldd utility to find out details (ldd may not be present on + other OS platforms, or its function may be embodied by a different command): 

     root# ldd `which smbd`
 libssl.so.0.9.6 => /usr/lib/libssl.so.0.9.6 (0x4002d000)
@@ -8017,726 +8035,785 @@ libcrypto.so.0.9.6 => /usr/lib/libcrypto.so.0.9.6 (0x4005a000)
 libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000)
 [....]

    - The line libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) shows - there is CUPS support compiled into this version of Samba. If this is the case, and printing = cups - is set, then any otherwise manually set print command in smb.conf is ignored. - This is an important point to remember! + The line libcups.so.2 => /usr/lib/libcups.so.2 (0x40123000) shows + there is CUPS support compiled into this version of Samba. If this is the case, and printing = cups + is set, then any otherwise manually set print command in smb.conf is ignored. + This is an important point to remember!

    Tip

    Should it be necessary, for any reason, to set your own print commands, you can do this by setting - printing = sysv. However, you will loose all the benefits + printing = sysv. However, you will loose all the benefits of tight CUPS/Samba integration. When you do this you must manually configure the printing system commands - (most important: print command; other commands are - lppause command, - lpresume command, - lpq command, - lprm command, - queuepause command and - queue resume command).

    Simple smb.conf Settings for CUPS

    - To summarize, here is the simplest printing-related setup for smb.conf to enable basic CUPS support: -

    Example 19.1. Simplest printing-related smb.conf

    [global]
    load printers = yes
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    public = yes
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root, @ntadmins

    - This is all you need for basic printing setup for CUPS. It will print - all Graphic, Text, PDF and PostScript file submitted from Windows - clients. However, most of your Windows users would not know how to - send these kind of files to print without opening a GUI - application. Windows clients tend to have local printer drivers - installed. And the GUI application's print buttons start a printer - driver. Your users also very rarely send files from the command - line. Unlike UNIX clients, they hardly submit graphic, text or PDF - formatted files directly to the spooler. They nearly exclusively print - from GUI applications, with a "printer driver" hooked in between the - applications native format and the print data stream. If the backend - printer is not a PostScript device, the print data stream is "binary", - sensible only for the target printer. Read on to learn which problem - this may cause and how to avoid it. -

    More complex smb.conf Settings for -CUPS

    -Here is a slightly more complex printing-related setup -for smb.conf. It enables general CUPS printing -support for all printers, but defines one printer share which is set -up differently. -

    Example 19.2. Overriding global CUPS settings for one printer

    [global]
    printing = cups
    printcap name = cups
    load printers = yes
    [printers]
    comment = All Printers
    path = /var/spool/samba
    public = yes
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root, @ntadmins
    [special_printer]
    comment = A special printer with his own settings
    path = /var/spool/samba-special
    printing = sysv
    printcap = lpstat
    print command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ; \
    echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; \
    echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log : rm %f
    public = no
    guest ok = no
    writeable = no
    printable = yes
    printer admin = kurt
    hosts deny = 0.0.0.0
    hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60

    -This special share is only there for testing purposes. It does not write the print job to a file. It just logs the job parameters -known to Samba into the /tmp/smbprn.log file and deletes the jobfile. Moreover, the -printer admin of this share is "kurt" (not the "@ntadmins" group); -guest access is not allowed; the share isn not published to the Network Neighbourhood (so you need to know it is there), and it only -allows access from only three hosts. To prevent CUPS kicking in and taking over the print jobs for that share, we need to set -printing = sysv and -printcap = lpstat. -

    Advanced Configuration

    -Before we delve into all the configuration options, let us clarify a few -points. Network printing needs to be organized and setup -correctly. Often this is not done correctly. Legacy systems -or small business LAN environments often lack design and good housekeeping. -

    Central spooling vs. "Peer-to-Peer" printing

    -Many small office or home networks, as well as badly organized larger -environments, allow each client a direct access to available network -printers. This is generally a bad idea. It often blocks one client's -access to the printer when another client's job is printing. It also -might freeze the first client's application while it is waiting to get -rid of the job. Also, there are frequent complaints about various jobs -being printed with their pages mixed with each other. A better concept -is the usage of a "print server": it routes all jobs through one -central system, which responds immediately, takes jobs from multiple -concurrent clients at the same time and in turn transfers them to the -printer(s) in the correct order. -

    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients

    -Most traditionally configured UNIX print servers acting on behalf of -Samba's Windows clients represented a really simple setup. Their only -task was to manage the "raw" spooling of all jobs handed to them by -Samba. This approach meant that the Windows clients were expected to -prepare the print job file that it s ready to be sent to the printing -device. Here a native (vendor-supplied) Windows printer -driver for the target device needed to be installed on each and every -client. -

    -It is possible to configure CUPS, Samba and your Windows clients in the -same, traditional and simple way. When CUPS printers are configured -for RAW print-through mode operation it is the responsibility of the -Samba client to fully render the print job (file). The file must be -sent in a format that is suitable for direct delivery to the -printer. Clients need to run the vendor-provided drivers to do -this. In this case CUPS will NOT do any print file format conversion -work. -

    Driver Installation Methods on Windows Clients

    -The printer drivers on the Windows clients may be installed -in two functionally different ways: -

    • manually install the drivers locally on each client, -one by one; this yields the old LanMan style -printing; it uses a \\sambaserver\printershare -type of connection.

    • - - deposit and prepare the drivers (for later download) on -the print server (Samba); this enables the clients to use -"Point and Print" to get drivers semi-automatically installed the -first time they access the printer; with this method NT/2K/XP -clients use the SPOOLSS/MS-RPC -type printing calls.

    -The second method is recommended for use over the first. -

    Explicitly enable "raw" printing for -application/octet-stream!

    -If you use the first option (drivers are installed on the client -side), there is one setting to take care of: CUPS needs to be told -that it should allow "raw" printing of deliberate (binary) file -formats. The CUPS files that need to be correctly set for RAW mode -printers to work are: -

    • /etc/cups/mime.types -

    • /etc/cups/mime.convs

    -Both contain entries (at the end of the respective files) which must -be uncommented to allow RAW mode operation. -In/etc/cups/mime.types make sure this line is -present: -

    - application/octet-stream
-

    -In /etc/cups/mime.convs, -have this line: -

    - application/octet-stream   application/vnd.cups-raw   0   - 
-

    -If these two files are not set up correctly for raw Windows client -printing, you may encounter the dreaded Unable to -convert file 0 in your CUPS error_log file. -

    Note

    editing the mime.convs and the -mime.types file does not -enforce "raw" printing, it only -allows it. -

    Background.  -CUPS being a more security-aware printing system than traditional ones -does not by default allow a user to send deliberate (possibly binary) -data to printing devices. This could be easily abused to launch a -"Denial of Service" attack on your printer(s), causing at the least -the loss of a lot of paper and ink. "Unknown" data are tagged by CUPS -as MIME type: application/octet-stream and not -allowed to go to the printer. By default, you can only send other -(known) MIME types "raw". Sending data "raw" means that CUPS does not -try to convert them and passes them to the printer untouched (see next -chapter for even more background explanations). -

    -This is all you need to know to get the CUPS/Samba combo printing -"raw" files prepared by Windows clients, which have vendor drivers -locally installed. If you are not interested in background information about -more advanced CUPS/Samba printing, simply skip the remaining sections -of this chapter. -

    Three familiar Methods for driver upload plus a new one

    -If you want to use the MS-RPC type printing, you must upload the -drivers onto the Samba server first ([print$] -share). For a discussion on how to deposit printer drivers on the -Samba host (so that the Windows clients can download and use them via -"Point'n'Print") please also refer to the previous chapter of this -HOWTO Collection. There you will find a description or reference to -three methods of preparing the client drivers on the Samba server: -

    • the GUI, "Add Printer Wizard" -upload-from-a-Windows-client -method;

    • the commandline, "smbclient/rpcclient" -upload-from-a-UNIX-workstation -method;

    • - - the Imprints Toolset -method.

    -These 3 methods apply to CUPS all the same. A new and more -convenient way to load the Windows drivers into Samba is provided -if you use CUPS: -

    • the cupsaddsmb -utility.

    -cupsaddsmb is discussed in much detail further below. But we will -first explore the CUPS filtering system and compare the Windows and -UNIX printing architectures. -

    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download

    -Are you still following this? Good. Let's go into more detail then. We now know -how to set up a "dump" printserver, that is, a server which is spooling -printjobs "raw", leaving the print data untouched. -

    -Possibly you need to setup CUPS in a more smart way. The reasons could -be manifold: -

    • Maybe your boss wants to get monthly statistics: Which -printer did how many pages? What was the average data size of a job? -What was the average print run per day? What are the typical hourly -peaks in printing? Which departments prints how -much?

    • Maybe you are asked to setup a print quota system: -users should not be able to print more jobs, once they have surpassed -a given limit per period?

    • Maybe your previous network printing setup is a mess -and shall be re-organized from a clean beginning?

    • Maybe you have experiencing too many "Blue Screens", -originating from poorly debugged printer drivers running in NT "kernel -mode"?

    -These goals cannot be achieved by a raw print server. To build a -server meeting these requirements, you'll first need to learn about -how CUPS works and how you can enable its features. -

    -What follows is the comparison of some fundamental concepts for -Windows and UNIX printing; then is the time for a description of the -CUPS filtering system, how it works and how you can tweak it. -

    GDI on Windows -- PostScript on UNIX

    -Network printing is one of the most complicated and error-prone -day-to-day tasks any user or an administrator may encounter. This is -true for all OS platforms. And there are reasons for this. -

    -You can't expect for most file formats to just throw them towards -printers and they get printed. There needs to be a file format -conversion in between. The problem is: there is no common standard for -print file formats across all manufacturers and printer types. While -PostScript (trademark held by Adobe), and, to an -extent, PCL (trademark held by HP), have developed -into semi-official "standards", by being the most widely used PDLs -(Page Description Languages), there are still -many manufacturers who "roll their own" (their reasons may be -unacceptable license fees for using printer-embedded PostScript -interpreters, etc.). -

    Windows Drivers, GDI and EMF

    -In Windows OS, the format conversion job is done by the printer -drivers. On MS Windows OS platforms all application programmers have -at their disposal a built-in API, the GDI (Graphical Device -Interface), as part and parcel of the OS itself, to base -themselves on. This GDI core is used as one common unified ground, for -all Windows programs, to draw pictures, fonts and documents -on screen as well as on -paper (=print). Therefore printer driver developers can -standardize on a well-defined GDI output for their own driver -input. Achieving WYSIWYG ("What You See Is What You Get") is -relatively easy, because the on-screen graphic primitives, as well as -the on-paper drawn objects, come from one common source. This source, -the GDI, produces often a file format called EMF (Enhanced -MetaFile). The EMF is processed by the printer driver and -converted to the printer-specific file format. -

    Note

    - -To the GDI foundation in MS Windows, Apple has chosen to -put paper and screen output on a common foundation for their -(BSD-UNIX-based, did you know??) Mac OS X and Darwin Operating -Systems. Their Core Graphic Engine uses a -PDF derivative for all display work. -

    + (most important: + print command; other commands are + lppause command, + lpresume command, + lpq command, + lprm command, + queuepause command and + queue resume command).

    Simple smb.conf Settings for CUPS

    + To summarize, shows simplest printing-related setup for smb.conf to enable basic CUPS support: +

    Example 19.1. Simplest printing-related smb.conf

    [global]
    load printers = yes
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    public = yes
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root, @ntadmins

    + This is all you need for basic printing setup for CUPS. It will print + all graphic, text, PDF, and PostScript files submitted from Windows + clients. However, most of your Windows users would not know how to + send these kinds of files to print without opening a GUI + application. Windows clients tend to have local printer drivers + installed, and the GUI application's print buttons start a printer + driver. Your users also rarely send files from the command + line. Unlike UNIX clients, they hardly submit graphic, text or PDF + formatted files directly to the spooler. They nearly exclusively print + from GUI applications with a “printer driver” hooked in between the + application's native format and the print-data-stream. If the backend + printer is not a PostScript device, the print data stream is “binary,” + sensible only for the target printer. Read on to learn which problem + this may cause and how to avoid it. +

    More Complex CUPS smb.conf Settings

    + is a slightly more complex printing-related setup + for smb.conf. It enables general CUPS printing + support for all printers, but defines one printer share, which is set + up differently. +

    Example 19.2. Overriding global CUPS settings for one printer

    [global]
    printing = cups
    printcap name = cups
    load printers = yes
    [printers]
    comment = All Printers
    path = /var/spool/samba
    public = yes
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root, @ntadmins
    [special_printer]
    comment = A special printer with his own settings
    path = /var/spool/samba-special
    printing = sysv
    printcap = lpstat
    print command = echo "NEW: `date`: printfile %f" >> /tmp/smbprn.log ; \
    echo " `date`: p-%p s-%s f-%f" >> /tmp/smbprn.log ; \
    echo " `date`: j-%j J-%J z-%z c-%c" >> /tmp/smbprn.log : rm %f
    public = no
    guest ok = no
    writeable = no
    printable = yes
    printer admin = kurt
    hosts deny = 0.0.0.0
    hosts allow = turbo_xp, 10.160.50.23, 10.160.51.60

    + This special share is only there for testing purposes. It does not write the print job to a file. It just logs the job parameters + known to Samba into the /tmp/smbprn.log file and deletes the jobfile. Moreover, the + printer admin of this share is “kurt” (not the “@ntadmins” group), + guest access is not allowed, the share isn't published to the Network Neighborhood (so you need to know it is there), and it only + allows access from only three hosts. To prevent CUPS kicking in and taking over the print jobs for that share, we need to set + printing = sysv and + printcap = lpstat. +

    Advanced Configuration

    + Before we delve into all the configuration options, let us clarify a few + points. Network printing needs to be organized and setup + correctly. This frequently doesn't happen. Legacy systems + or small business LAN environments often lack design and good housekeeping. +

    Central Spooling vs. “Peer-to-Peer” Printing

    + + + Many small office or home networks, as well as badly organized larger + environments, allow each client a direct access to available network + printers. This is generally a bad idea. It often blocks one client's + access to the printer when another client's job is printing. It might + freeze the first client's application while it is waiting to get + rid of the job. Also, there are frequent complaints about various jobs + being printed with their pages mixed with each other. A better concept + is the usage of a print server: it routes all jobs through one + central system, which responds immediately, takes jobs from multiple + concurrent clients at the same time, and in turn transfers them to the + printer(s) in the correct order. +

    Raw Print Serving Vendor Drivers on Windows Clients

    + + + Most traditionally configured UNIX print servers acting on behalf of + Samba's Windows clients represented a really simple setup. Their only + task was to manage the “raw” spooling of all jobs handed to them by + Samba. This approach meant that the Windows clients were expected to + prepare the print job file that its ready to be sent to the printing + device. Here is a native (vendor-supplied) Windows printer + driver for the target device needed to be installed on each and every + client. +

    + It is possible to configure CUPS, Samba and your Windows clients in the + same traditional and simple way. When CUPS printers are configured + for RAW print-through mode operation, it is the responsibility of the + Samba client to fully render the print job (file). The file must be + sent in a format that is suitable for direct delivery to the + printer. Clients need to run the vendor-provided drivers to do + this. In this case, CUPS will not do any print file format conversion + work. +

    Installation of Windows Client Drivers

    + The printer drivers on the Windows clients may be installed + in two functionally different ways: +

    • Manually install the drivers locally on each client, + one by one; this yields the old LanMan style + printing and uses a \\sambaserver\printershare + type of connection.

    • + + Deposit and prepare the drivers (for later download) on + the print server (Samba); this enables the clients to use + “Point'n'Print” to get drivers semi-automatically installed the + first time they access the printer; with this method NT/200x/XP + clients use the SPOOLSS/MS-RPC + type printing calls.

    + The second method is recommended for use over the first. +

    Explicitly Enable “raw” Printing for application/octet-stream

    + + + + If you use the first option (drivers are installed on the client + side), there is one setting to take care of: CUPS needs to be told + that it should allow “raw” printing of deliberate (binary) file + formats. The CUPS files that need to be correctly set for RAW mode + printers to work are: +

    • /etc/cups/mime.types

    • /etc/cups/mime.convs

    + Both contain entries (at the end of the respective files) which must + be uncommented to allow RAW mode operation. + In /etc/cups/mime.types, make sure this line is + present: -

    Figure 19.1. Windows Printing to a local Printer

    Windows Printing to a local Printer

    -

    UNIX Printfile Conversion and GUI Basics

    -In UNIX and Linux, there is no comparable layer built into the OS -kernel(s) or the X (screen display) server. Every application is -responsible for itself to create its print output. Fortunately, most -use PostScript. That gives at least some common ground. Unfortunately, -there are many different levels of quality for this PostScript. And -worse: there is a huge difference (and no common root) in the way how -the same document is displayed on screen and how it is presented on -paper. WYSIWYG is more difficult to achieve. This goes back to the -time decades ago, when the predecessors of X.org, -designing the UNIX foundations and protocols for Graphical User -Interfaces refused to take over responsibility for "paper output" -also, as some had demanded at the time, and restricted itself to -"on-screen only". (For some years now, the "Xprint" project has been -under development, attempting to build printing support into the X -framework, including a PostScript and a PCL driver, but it is not yet -ready for prime time.) You can see this unfavorable inheritance up to -the present day by looking into the various "font" directories on your -system; there are separate ones for fonts used for X display and fonts -to be used on paper. -

    Background.  -The PostScript programming language is an "invention" by Adobe Inc., -but its specifications have been published to the full. Its strength -lies in its powerful abilities to describe graphical objects (fonts, -shapes, patterns, lines, curves, dots...), their attributes (color, -linewidth...) and the way to manipulate (scale, distort, rotate, -shift...) them. Because of its open specification, anybody with the -skill can start writing his own implementation of a PostScript -interpreter and use it to display PostScript files on screen or on -paper. Most graphical output devices are based on the concept of -"raster images" or "pixels" (one notable exception are pen -plotters). Of course, you can look at a PostScript file in its textual -form and you will be reading its PostScript code, the language -instructions which need to be interpreted by a rasterizer. Rasterizers -produce pixel images, which may be displayed on screen by a viewer -program or on paper by a printer. -

    PostScript and Ghostscript

    -So, UNIX is lacking a common ground for printing on paper and -displaying on screen. Despite this unfavorable legacy for UNIX, basic -printing is fairly easy: if you have PostScript printers at your -disposal! The reason is: these devices have a built-in PostScript -language "interpreter", also called a Raster Image -Processor (RIP), (which makes them more expensive than -other types of printers); throw PostScript towards them, and they will -spit out your printed pages. Their RIP is doing all the hard work of -converting the PostScript drawing commands into a bitmap picture as -you see it on paper, in a resolution as done by your printer. This is -no different to PostScript printing of a file from a Windows origin. -

    Note

    - -Traditional UNIX programs and printing systems -- while -using PostScript -- are largely not PPD-aware. PPDs are "PostScript -Printer Description" files. They enable you to specify and control all -options a printer supports: duplexing, stapling, punching... Therefore -UNIX users for a long time couldn't choose many of the supported -device and job options, unlike Windows or Apple users. But now there -is CUPS.... -

    -

    Figure 19.2. Printing to a Postscript Printer

    Printing to a Postscript Printer

    -

    -However, there are other types of printers out there. These don't know -how to print PostScript. They use their own Page Description -Language (PDL, often proprietary). To print to them is much -more demanding. Since your UNIX applications mostly produce -PostScript, and since these devices don't understand PostScript, you -need to convert the printfiles to a format suitable for your printer -on the host, before you can send it away. -

    Ghostscript -- the Software RIP for non-PostScript Printers

    -Here is where Ghostscript kicks in. Ghostscript is -the traditional (and quite powerful) PostScript interpreter used on -UNIX platforms. It is a RIP in software, capable to do a -lot of file format conversions, for a very broad -spectrum of hardware devices as well as software file formats. -Ghostscript technology and drivers is what enables PostScript printing -to non-PostScript hardware. -

    -

    Figure 19.3. Ghostscript as a RIP for non-postscript printers

    Ghostscript as a RIP for non-postscript printers

    -

    Tip

    -Use the "gs -h" command to check for all built-in "devices" of your -Ghostscript version. If you specify e.g. a parameter of --sDEVICE=png256 on your Ghostscript command -line, you are asking Ghostscript to convert the input into a PNG -file. Naming a "device" on the commandline is the most important -single parameter to tell Ghostscript how exactly it should render the -input. New Ghostscript versions are released at fairly regular -intervals, now by artofcode LLC. They are initially put under the -"AFPL" license, but re-released under the GNU GPL as soon as the next -AFPL version appears. GNU Ghostscript is probably the version -installed on most Samba systems. But it has got some -deficiencies. Therefore ESP Ghostscript was developed as an -enhancement over GNU Ghostscript, with lots of bug-fixes, additional -devices and improvements. It is jointly maintained by developers from -CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat and Debian. It includes -the "cups" device (essential to print to non-PS printers from CUPS). -

    PostScript Printer Description (PPD) Specification

    -While PostScript in essence is a Page Description -Language (PDL) to represent the page layout in a -device independent way, real world print jobs are -always ending up to be output on a hardware with device-specific -features. To take care of all the differences in hardware, and to -allow for innovations, Adobe has specified a syntax and file format -for PostScript Printer Description (PPD) -files. Every PostScript printer ships with one of these files. -

    -PPDs contain all information about general and special features of the -given printer model: Which different resolutions can it handle? Does -it have a Duplexing Unit? How many paper trays are there? What media -types and sizes does it take? For each item it also names the special -command string to be sent to the printer (mostly inside the PostScript -file) in order to enable it. -

    -Information from these PPDs is meant to be taken into account by the -printer drivers. Therefore, installed as part of the Windows -PostScript driver for a given printer is the printer's PPD. Where it -makes sense, the PPD features are presented in the drivers' UI dialogs -to display to the user as choice of print options. In the end, the -user selections are somehow written (in the form of special -PostScript, PJL, JCL or vendor-dependent commands) into the PostScript -file created by the driver. -

    Warning

    - -A PostScript file that was created to contain device-specific commands -for achieving a certain print job output (e.g. duplexed, stapled and -punched) on a specific target machine, may not print as expected, or -may not be printable at all on other models; it also may not be fit -for further processing by software (e.g. by a PDF distilling program). -

    CUPS can use all Windows-formatted Vendor PPDs

    -CUPS can handle all spec-compliant PPDs as supplied by the -manufacturers for their PostScript models. Even if a -UNIX/Linux-illiterate vendor might not have mentioned our favorite -OS in his manuals and brochures -- you can safely trust this: -if you get hold of the Windows NT version of the PPD, you -can use it unchanged in CUPS and thus access the full -power of your printer just like a Windows NT user could! -

    Tip

    -To check the spec compliance of any PPD online, go to http://www.cups.org/testppd.php -and upload your PPD. You will see the results displayed -immediately. CUPS in all versions after 1.1.19 has a much more strict -internal PPD parsing and checking code enabled; in case of printing -trouble this online resource should be one of your first pitstops. -

    Warning

    - - -For real PostScript printers don't use the -Foomatic or cupsomatic -PPDs from Linuxprinting.org. With these devices the original -vendor-provided PPDs are always the first choice! -

    Tip

    -If you are looking for an original vendor-provided PPD of a specific -device, and you know that an NT4 box (or any other Windows box) on -your LAN has the PostScript driver installed, just use -smbclient //NT4-box/print\$ -U username to -access the Windows directory where all printer driver files are -stored. First look in the W32X86/2 subdir for -the PPD you are seeking. -

    CUPS also uses PPDs for non-PostScript Printers

    -CUPS also uses specially crafted PPDs to handle non-PostScript -printers. These PPDs are usually not available from the vendors (and -no, you can't just take the PPD of a Postscript printer with the same -model name and hope it works for the non-PostScript version too). To -understand how these PPDs work for non-PS printers we first need to -dive deeply into the CUPS filtering and file format conversion -architecture. Stay tuned. -

    The CUPS Filtering Architecture

    + 

    +	 application/octet-stream
+

    + + + + + In /etc/cups/mime.convs, + have this line: + + + + 

    +		application/octet-stream   application/vnd.cups-raw   0   - 
+

    + + If these two files are not set up correctly for raw Windows client + printing, you may encounter the dreaded Unable to + convert file 0 in your CUPS error_log file. +

    Note

    Editing the mime.convs and the + mime.types file does not + enforce “raw” printing, it only + allows it. +

    Background.  + + CUPS being a more security-aware printing system than traditional ones + does not by default allow a user to send deliberate (possibly binary) + data to printing devices. This could be easily abused to launch a + “Denial of Service” attack on your printer(s), causing at least + the loss of a lot of paper and ink. “Unknown” data are tagged by CUPS + as MIME type: application/octet-stream and not + allowed to go to the printer. By default, you can only send other + (known) MIME types “raw”. Sending data “raw” means that CUPS does not + try to convert them and passes them to the printer untouched (see the next + chapter for even more background explanations). +

    + This is all you need to know to get the CUPS/Samba combo printing + “raw” files prepared by Windows clients, which have vendor drivers + locally installed. If you are not interested in background information about + more advanced CUPS/Samba printing, simply skip the remaining sections + of this chapter. +

    Driver Upload Methods

    + This section describes three familiar methods, plus one new one, by which + printer drivers may be uploaded. +

    + + If you want to use the MS-RPC type printing, you must upload the + drivers onto the Samba server first ([print$] + share). For a discussion on how to deposit printer drivers on the + Samba host (so the Windows clients can download and use them via + “Point'n'Print”), please refer to the previous chapter of this + HOWTO Collection. There you will find a description or reference to + three methods of preparing the client drivers on the Samba server: +

    • + + The GUI, “Add Printer Wizard” + upload-from-a-Windows-client + method.

    • The command line, “smbclient/rpcclient” + upload-from-a-UNIX-workstation method.

    • + + The Imprints Toolset + method.

    + These three methods apply to CUPS all the same. A new and more + convenient way to load the Windows drivers into Samba is provided + if you use CUPS: +

    • + + the cupsaddsmb + utility.

    + cupsaddsmb is discussed in much detail further below. But we first + explore the CUPS filtering system and compare the Windows and UNIX printing architectures. +

    Advanced Intelligent Printing with PostScript Driver Download

    + + We now know + how to set up a “dump” printserver, that is, a server which is spooling + printjobs “raw”, leaving the print data untouched. +

    + Possibly you need to setup CUPS in a smarter way. The reasons could + be manifold: +

    • Maybe your boss wants to get monthly statistics: Which + printer did how many pages? What was the average data size of a job? + What was the average print run per day? What are the typical hourly + peaks in printing? Which department prints how much?

    • Maybe you are asked to setup a print quota system: + Users should not be able to print more jobs, once they have surpassed + a given limit per period.

    • Maybe your previous network printing setup is a mess + and must be re-organized from a clean beginning.

    • Maybe you have experiencing too many “blue screens” + originating from poorly debugged printer drivers running in NT “kernel mode”?

    + These goals cannot be achieved by a raw print server. To build a + server meeting these requirements, you'll first need to learn about + how CUPS works and how you can enable its features. +

    + What follows is the comparison of some fundamental concepts for + Windows and UNIX printing; then follows a description of the + CUPS filtering system, how it works and how you can tweak it. +

    GDI on Windows -- PostScript on UNIX

    + + + Network printing is one of the most complicated and error-prone + day-to-day tasks any user or administrator may encounter. This is + true for all OS platforms. And there are reasons for this. +

    + + + You can't expect most file formats to just throw them toward + printers and they get printed. There needs to be a file format + conversion in between. The problem is that there is no common standard for + print file formats across all manufacturers and printer types. While + PostScript (trademark held by Adobe) and, to an + extent, PCL (trademark held by HP) have developed + into semi-official “standards” by being the most widely used PDLs + Page Description Languages (PDLs), there are still + many manufacturers who “roll their own” (their reasons may be + unacceptable license fees for using printer-embedded PostScript + interpreters, and so on). +

    Windows Drivers, GDI and EMF

    + + + + In Windows OS, the format conversion job is done by the printer + drivers. On MS Windows OS platforms all application programmers have + at their disposal a built-in API, the Graphical Device + Interface (GDI), as part and parcel of the OS itself to base + themselves on. This GDI core is used as one common unified ground for + all Windows programs to draw pictures, fonts and documents + on screen as well as on + paper (print). Therefore, printer driver developers can + standardize on a well-defined GDI output for their own driver + input. Achieving WYSIWYG (“What You See Is What You Get”) is + relatively easy, because the on-screen graphic primitives, as well as + the on-paper drawn objects, come from one common source. This source, + the GDI, often produces a file format called Enhanced + MetaFile (EMF). The EMF is processed by the printer driver and + converted to the printer-specific file format. +

    Note

    + + To the GDI foundation in MS Windows, Apple has chosen to + put paper and screen output on a common foundation for their + (BSD-UNIX-based, did you know?) Mac OS X and Darwin Operating + + + + + Systems. Their Core Graphic Engine uses a + PDF derivative for all display work. +

    + +

    Figure 19.1. Windows printing to a local printer.

    Windows printing to a local printer.

    +

    UNIX Printfile Conversion and GUI Basics

    + + + + + In UNIX and Linux, there is no comparable layer built into the OS + kernel(s) or the X (screen display) server. Every application is + responsible for itself to create its print output. Fortunately, most + use PostScript and that at least gives some common ground. Unfortunately, + there are many different levels of quality for this PostScript. And + worse, there is a huge difference (and no common root) in the way + the same document is displayed on screen and how it is presented on + paper. WYSIWYG is more difficult to achieve. This goes back to the + time, decades ago, when the predecessors of X.org, + designing the UNIX foundations and protocols for Graphical User + Interfaces, refused to take responsibility for “paper output” + also, as some had demanded at the time, and restricted itself to + “on-screen only.” (For some years now, the “Xprint” project has been + under development, attempting to build printing support into the X + framework, including a PostScript and a PCL driver, but it is not yet + ready for prime time.) You can see this unfavorable inheritance up to + the present day by looking into the various “font” directories on your + system; there are separate ones for fonts used for X display and fonts + to be used on paper. +

    Background.  + + The PostScript programming language is an “invention” by Adobe Inc., + but its specifications have been published to the full. Its strength + lies in its powerful abilities to describe graphical objects (fonts, + shapes, patterns, lines, curves, and dots), their attributes (color, + linewidth) and the way to manipulate (scale, distort, rotate, + shift) them. Because of its open specification, anybody with the + skill can start writing his own implementation of a PostScript + interpreter and use it to display PostScript files on screen or on + paper. Most graphical output devices are based on the concept of + “raster images” or “pixels” (one notable exception is pen + plotters). Of course, you can look at a PostScript file in its textual + form and you will be reading its PostScript code, the language + instructions which need to be interpreted by a rasterizer. Rasterizers + produce pixel images, which may be displayed on screen by a viewer + program or on paper by a printer. +

    PostScript and Ghostscript

    + + + + So, UNIX is lacking a common ground for printing on paper and + displaying on screen. Despite this unfavorable legacy for UNIX, basic + printing is fairly easy if you have PostScript printers at your + disposal. The reason is these devices have a built-in PostScript + language “interpreter,” also called a Raster Image + Processor (RIP) (which makes them more expensive than + other types of printers); throw PostScript toward them, and they will + spit out your printed pages. Their RIP is doing all the hard work of + converting the PostScript drawing commands into a bitmap picture as + you see it on paper, in a resolution as done by your printer. This is + no different to PostScript printing a file from a Windows origin. +

    Note

    + + Traditional UNIX programs and printing systems while + using PostScript are largely not PPD-aware. PPDs are “PostScript + Printer Description” files. They enable you to specify and control all + options a printer supports: duplexing, stapling and punching. Therefore, + UNIX users for a long time couldn't choose many of the supported + device and job options, unlike Windows or Apple users. But now there + is CUPS. +

    +

    Figure 19.2. Printing to a PostScript printer.

    Printing to a PostScript printer.

    +

    + + However, there are other types of printers out there. These do not know + how to print PostScript. They use their own Page Description + Language (PDL, often proprietary). To print to them is much + more demanding. Since your UNIX applications mostly produce + PostScript, and since these devices do not understand PostScript, you + need to convert the printfiles to a format suitable for your printer + on the host before you can send it away. +

    Ghostscript the Software RIP for Non-PostScript Printers

    + + Here is where Ghostscript kicks in. Ghostscript is + the traditional (and quite powerful) PostScript interpreter used on + UNIX platforms. It is a RIP in software, capable of doing a + lot of file format conversions for a very broad + spectrum of hardware devices as well as software file formats. + Ghostscript technology and drivers are what enable PostScript printing + to non-PostScript hardware. +

    +

    Figure 19.3. Ghostscript as a RIP for non-postscript printers.

    Ghostscript as a RIP for non-postscript printers.

    +

    Tip

    + Use the “gs -h” command to check for all built-in “devices” + of your Ghostscript version. If you specify a parameter of + -sDEVICE=png256 on your Ghostscript command + line, you are asking Ghostscript to convert the input into a PNG + file. Naming a “device” on the command line is the most important + single parameter to tell Ghostscript exactly how it should render the + input. New Ghostscript versions are released at fairly regular + intervals, now by artofcode LLC. They are initially put under the + “AFPL” license, but re-released under the GNU GPL as soon as the next + AFPL version appears. GNU Ghostscript is probably the version + installed on most Samba systems. But it has some deficiencies. + + Therefore, ESP Ghostscript was developed as an + enhancement over GNU Ghostscript, with lots of bug-fixes, additional + devices and improvements. It is jointly maintained by developers from + CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat, and Debian. It includes + the “cups” device (essential to print to non-PS printers from CUPS). +

    PostScript Printer Description (PPD) Specification

    + + While PostScript in essence is a Page Description + Language (PDL) to represent the page layout in a + device-independent way, real-world print jobs are + always ending up being output on hardware with device-specific + features. To take care of all the differences in hardware and to + allow for innovations, Adobe has specified a syntax and file format + for PostScript Printer Description (PPD) + files. Every PostScript printer ships with one of these files. +

    + PPDs contain all the information about general and special features of the + given printer model: Which different resolutions can it handle? Does + it have a Duplexing Unit? How many paper trays are there? What media + types and sizes does it take? For each item, it also names the special + command string to be sent to the printer (mostly inside the PostScript + file) in order to enable it. +

    + Information from these PPDs is meant to be taken into account by the + printer drivers. Therefore, installed as part of the Windows + PostScript driver for a given printer is the printer's PPD. Where it + makes sense, the PPD features are presented in the drivers' UI dialogs + to display to the user a choice of print options. In the end, the + user selections are somehow written (in the form of special + PostScript, PJL, JCL or vendor-dependent commands) into the PostScript + file created by the driver. +

    Warning

    + + A PostScript file that was created to contain device-specific commands + for achieving a certain print job output (e.g., duplexed, stapled and + punched) on a specific target machine, may not print as expected, or + may not be printable at all on other models; it also may not be fit + for further processing by software (e.g., by a PDF distilling program). +

    Using Windows-Formatted Vendor PPDs

    + CUPS can handle all spec-compliant PPDs as supplied by the + manufacturers for their PostScript models. Even if a + vendor might not have mentioned our favorite + OS in his manuals and brochures, you can safely trust this: + If you get the Windows NT version of the PPD, you + can use it unchanged in CUPS and thus access the full + power of your printer just like a Windows NT user could! +

    Tip

    + To check the spec compliance of any PPD online, go to http://www.cups.org/testppd.php + and upload your PPD. You will see the results displayed + immediately. CUPS in all versions after 1.1.19 has a much more strict + internal PPD parsing and checking code enabled; in case of printing + trouble, this online resource should be one of your first pitstops. +

    Warning

    + + + For real PostScript printers, do not use the + Foomatic or cupsomatic + PPDs from Linuxprinting.org. With these devices, the original + vendor-provided PPDs are always the first choice! +

    Tip

    + If you are looking for an original vendor-provided PPD of a specific + device, and you know that an NT4 box (or any other Windows box) on + your LAN has the PostScript driver installed, just use + smbclient //NT4-box/print\$ -U username to + access the Windows directory where all printer driver files are + stored. First look in the W32X86/2 subdir for + the PPD you are seeking. +

    CUPS Also Uses PPDs for Non-PostScript Printers

    + CUPS also uses specially crafted PPDs to handle non-PostScript + printers. These PPDs are usually not available from the vendors (and + no, you can't just take the PPD of a PostScript printer with the same + model name and hope it works for the non-PostScript version too). To + understand how these PPDs work for non-PS printers, we first need to + dive deeply into the CUPS filtering and file format conversion + architecture. Stay tuned. +

    The CUPS Filtering Architecture

    The core of the CUPS filtering system is based on -Ghostscript. In addition to Ghostscript, CUPS +Ghostscript. In addition to Ghostscript, CUPS uses some other filters of its own. You (or your OS vendor) may have plugged in even more filters. CUPS handles all data file formats under -the label of various MIME types. Every incoming +the label of various MIME types. Every incoming printfile is subjected to an initial -auto-typing. The auto-typing determines its given +auto-typing. The auto-typing determines its given MIME type. A given MIME type implies zero or more possible filtering chains relevant to the selected target printer. This section discusses how MIME types recognition and conversion rules interact. They are used by CUPS to automatically setup a working filtering chain for any given input data format.

    -If CUPS rasterizes a PostScript file natively to -a bitmap, this is done in 2 stages: -

    • the first stage uses a Ghostscript device named "cups" +If CUPS rasterizes a PostScript file natively to +a bitmap, this is done in two stages: +

      • The first stage uses a Ghostscript device named “cups” (this is since version 1.1.15) and produces a generic raster format -called "CUPS raster". -

      • the second stage uses a "raster driver" which converts -the generic CUPS raster to a device specific raster.

      -Make sure your Ghostscript version has the "cups" device compiled in -(check with gs -h | grep cups). Otherwise you +called “CUPS raster”. +

    • The second stage uses a “raster driver” that converts + the generic CUPS raster to a device-specific raster.

    +Make sure your Ghostscript version has the “cups” device compiled in +(check with gs -h | grep cups). Otherwise you may encounter the dreaded Unable to convert file -0 in your CUPS error_log file. To have "cups" as a -device in your Ghostscript, you either need to patch GNU -Ghostscript and re-compile or use ESP Ghostscript. The -superior alternative is ESP Ghostscript: it supports not just CUPS, +0 in your CUPS error_log file. To have “cups” as a +device in your Ghostscript, you either need to patch GNU +Ghostscript and re-compile, or use ESP Ghostscript. The +superior alternative is ESP Ghostscript. It supports not just CUPS, but 300 other devices too (while GNU Ghostscript supports only about 180). Because of this broad output device support, ESP Ghostscript is -the first choice for non-CUPS spoolers too. It is now recommended by +the first choice for non-CUPS spoolers, too. It is now recommended by Linuxprinting.org for all spoolers.

    - - -CUPS printers may be setup to use external -rendering paths. One of the most common ones is provided by the -Foomatic/cupsomatic concept, from Linuxprinting.org. This + + +CUPS printers may be setup to use external +rendering paths. One of the most common is provided by the +Foomatic/cupsomatic concept from Linuxprinting.org. This uses the classical Ghostscript approach, doing everything in one -step. It doesn't use the "cups" device, but one of the many +step. It does not use the “cups” device, but one of the many others. However, even for Foomatic/cupsomatic usage, best results and - + broadest printer model support is provided by ESP Ghostscript (more about cupsomatic/Foomatic, particularly the new version called now foomatic-rip, follows below). -

    MIME types and CUPS Filters

    - +

    MIME Types and CUPS Filters

    + + CUPS reads the file /etc/cups/mime.types (and all other files carrying a *.types suffix in the same directory) upon startup. These files contain the MIME -type recognition rules which are applied when CUPS runs its +type recognition rules that are applied when CUPS runs its auto-typing routines. The rule syntax is explained in the man page for mime.types and in the comments section of the mime.types file itself. A simple rule reads like this: -

    - -

    +
+
+
      application/pdf         pdf string(0,%PDF)
 
    
-This means: if a filename has either a
-.pdf suffix, or if the magic
+
+This means if a filename has either a
+.pdf suffix or if the magic
 string %PDF is right at the
 beginning of the file itself (offset 0 from the start), then it is
-a PDF file (application/pdf).
+a PDF file (application/pdf).
 Another rule is this: 
-
    +
+
      application/postscript  ai eps ps string(0,%!) string(0,<04>%!)
 
    
-Its meaning: if the filename has one of the suffixes
+
+If the filename has one of the suffixes
 .ai, .eps,
 .ps or if the file itself starts with one of the
 strings %! or <04>%!, it
 is a generic PostScript file
-(application/postscript).
-
    Note
    
-There is a very important difference between two similar MIME type in
-CUPS: one is application/postscript, the other is
-application/vnd.cups-postscript. While
-application/postscript is meant to be device
+(application/postscript).
+
    Warning
    
+Don't confuse the other mime.types files your system might be using
+with the one in the /etc/cups/ directory.
+
    Note
    
+There is an important difference between two similar MIME types in
+CUPS: one is application/postscript, the other is
+application/vnd.cups-postscript. While
+application/postscript is meant to be device
 independent (job options for the file are still outside the PS file
-content, embedded in commandline or environment variables by CUPS),
-application/vnd.cups-postscript may have the job
-options inserted into the PostScript data itself (were
+content, embedded in command line or environment variables by CUPS),
+application/vnd.cups-postscript may have the job
+options inserted into the PostScript data itself (where
 applicable). The transformation of the generic PostScript
-(application/postscript) to the device-specific version
-(application/vnd.cups-postscript) is the responsibility of the
-CUPS pstops filter. pstops uses information
+(application/postscript) to the device-specific version
+(application/vnd.cups-postscript) is the responsibility of the
+CUPS pstops filter. pstops uses information
 contained in the PPD to do the transformation.
-
    Warning
    
-Don't confuse the other mime.types file your system might be using
-with the one in the /etc/cups/ directory.
 
    
-CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI and a
-lot of image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster,
-PNM, PBM, SGI-RGB and some more) and their associated MIME types
+CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI, and
+many image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster,
+PNM, PBM, SGI-RGB, and more) and their associated MIME types
 with its filters.
-
    MIME type Conversion Rules
    
+
    MIME Type Conversion Rules
    
+
+
 CUPS reads the file /etc/cups/mime.convs
 (and all other files named with a *.convs
 suffix in the same directory) upon startup. These files contain
 lines naming an input MIME type, an output MIME type, a format
-conversion filter which can produce the output from the input type
+conversion filter that can produce the output from the input type
 and virtual costs associated with this conversion. One example line
 reads like this:
-
    +
+
      application/pdf         application/postscript   33   pdftops
 
    
-This means that the pdftops filter will take
-application/pdf as input and produce
-application/postscript as output, the virtual
+
+This means that the pdftops filter will take
+application/pdf as input and produce
+application/postscript as output; the virtual
 cost of this operation is 33 CUPS-$. The next filter is more
 expensive, costing 66 CUPS-$:
-
    +
+
+
+
      application/vnd.hp-HPGL application/postscript   66   hpgltops
 
    
-This is the hpgltops, which processes HP-GL
+
+This is the hpgltops, which processes HP-GL
 plotter files to PostScript.
-
    +
+
+
+
      application/octet-stream
 
    
+
 Here are two more examples: 
-
    +
+
+
+
      application/x-shell     application/postscript   33    texttops
  text/plain              application/postscript   33    texttops
 
    
-The last two examples name the texttops filter
-to work on "text/plain" as well as on "application/x-shell". (Hint:
-this differentiation is needed for the syntax highlighting feature of
-"texttops").
-
    Filter Requirements
    
-There are many more combinations named in mime.convs.  However, you
+
+The last two examples name the texttops filter
+to work on text/plain as well as on application/x-shell. (Hint:
+This differentiation is needed for the syntax highlighting feature of
+texttops).
+
    Filtering  Overview
    
+
+There are many more combinations named in mime.convs. However, you
 are not limited to use the ones pre-defined there. You can plug in any
 filter you like into the CUPS framework. It must meet, or must be made
-to meet some minimal requirements. If you find (or write) a cool
+to meet, some minimal requirements. If you find (or write) a cool
 conversion filter of some kind, make sure it complies to what CUPS
-needs, and put in the right lines in mime.types
+needs and put in the right lines in mime.types
 and mime.convs, then it will work seamlessly
-inside CUPS!
-
    Tip
    
-The mentioned "CUPS requirements" for filters are simple. Take
+inside CUPS.
+
    Filter requirements
    
+The mentioned “CUPS requirements” for filters are simple. Take
 filenames or stdin as input and write to
 stdout. They should take these 5 or 6 arguments:
 printer job user title copies options [filename]
-
    Printer
    The name of the printer queue (normally this is the
-name of the filter being run)
    job
    The numeric job ID for the job being
-printed
    user
    The string from the originating-user-name
-attribute
    title
    The string from the job-name attribute
    copies
    The numeric value from the number-copies
-attribute
    options
    The job options
    filename
    (Optionally) The print request file (if missing,
+
    Printer 
    The name of the printer queue (normally this is the
+name of the filter being run).
    job 
    The numeric job ID for the job being
+printed.
    user 
    The string from the originating-user-name
+attribute.
    title 
    The string from the job-name attribute.
    copies 
    The numeric value from the number-copies
+attribute.
    options 
    The job options.
    filename 
    (Optionally) The print request file (if missing,
 filters expected data fed through stdin). In most
-cases it is very easy to write a simple wrapper script around existing
-filters to make them work with CUPS.
    Prefilters
    
-As was said, PostScript is the central file format to any UNIX based
+cases, it is easy to write a simple wrapper script around existing
+filters to make them work with CUPS.
    Prefilters
    
+
+As previously stated, PostScript is the central file format to any UNIX-based
 printing system. From PostScript, CUPS generates raster data to feed
 non-PostScript printers.
 
    
-But what is happening if you send one of the supported non-PS formats
-to print? Then CUPS runs "pre-filters" on these input formats to
+But what happens if you send one of the supported non-PS formats
+to print? Then CUPS runs “pre-filters” on these input formats to
 generate PostScript first. There are pre-filters to create PS from
-ASCII text, PDF, DVI or HP-GL. The outcome of these filters is always
-of MIME type application/postscript (meaning that
+ASCII text, PDF, DVI, or HP-GL. The outcome of these filters is always
+of MIME type application/postscript (meaning that
 any device-specific print options are not yet embedded into the
 PostScript by CUPS, and that the next filter to be called is
 pstops). Another pre-filter is running on all supported image formats,
-the imagetops filter. Its outcome is always of
-MIME type application/vnd.cups-postscript
-(not application/postscript), meaning it has the
+the imagetops filter. Its outcome is always of
+MIME type application/vnd.cups-postscript
+(not application/postscript), meaning it has the
 print options already embedded into the file.
 
    
-	
    Figure 19.4. Prefiltering in CUPS to form Postscript
    Prefiltering in CUPS to form Postscript
    
-
    pstops
    
-pstopsis the filter to convert
-application/postscript to
-application/vnd.cups-postscript. It was said
+	
    Figure 19.4. Pre-filtering in CUPS to form PostScript.
    Pre-filtering in CUPS to form PostScript.
    
+
    pstops
    
+pstops is the filter to convert
+application/postscript to 
+application/vnd.cups-postscript. It was said
 above that this filter inserts all device-specific print options
 (commands to the printer to ask for the duplexing of output, or
-stapling an punching it, etc.) into the PostScript file.
+stapling and punching it, and so on) into the PostScript file.
 
    
-	
    Figure 19.5. Adding Device-specific Print Options
    Adding Device-specific Print Options
    
+	
    Figure 19.5. Adding device-specific print options.
    Adding device-specific print options.
    
 
    
-This is not all: other tasks performed by it are:
+This is not all. Other tasks performed by it are:
 
    • 
-selecting the range of pages to be printed (if you choose to
-print only pages "3, 6, 8-11, 16, 19-21", or only the odd numbered
-ones)
+Selecting the range of pages to be printed (if you choose to
+print only pages “3, 6, 8-11, 16, 19-21”, or only the odd numbered
+ones).
 
    • 
-putting 2 or more logical pages on one sheet of paper (the
-so-called "number-up" function)
-
    • counting the pages of the job to insert the accounting
-information into the /var/log/cups/page_log
-
    pstoraster
    
-pstoraster is at the core of the CUPS filtering
+Putting 2 or more logical pages on one sheet of paper (the
+so-called “number-up” function).
+
  • Counting the pages of the job to insert the accounting
+information into the /var/log/cups/page_log.
+

    • pstoraster

    +pstoraster is at the core of the CUPS filtering system. It is responsible for the first stage of the rasterization process. Its input is of MIME type application/vnd.cups-postscript; its output is application/vnd.cups-raster. This output format is not yet meant to be printable. Its aim is to serve as a general purpose -input format for more specialized raster drivers, +input format for more specialized raster drivers that are able to generate device-specific printer data.

    -

    Figure 19.6. Postscript to intermediate Raster format

    Postscript to intermediate Raster format

    +

    Figure 19.6. PostScript to intermediate raster format.

    PostScript to intermediate raster format.

    CUPS raster is a generic raster format with powerful features. It is -able to include per-page information, color profiles and more to be +able to include per-page information, color profiles, and more, to be used by the following downstream raster drivers. Its MIME type is -registered with IANA and its specification is of course completely -open. It is designed to make it very easy and inexpensive for +registered with IANA and its specification is, of course, completely +open. It is designed to make it quite easy and inexpensive for manufacturers to develop Linux and UNIX raster drivers for their printer models, should they choose to do so. CUPS always takes care -for the first stage of rasterization so these vendors don't need to care +for the first stage of rasterization so these vendors do not need to care about Ghostscript complications (in fact, there is currently more than one vendor financing the development of CUPS raster drivers).

    -

    Figure 19.7. CUPS-raster production using Ghostscript

    CUPS-raster production using Ghostscript

    +

    Figure 19.7. CUPS-raster production using Ghostscript.

    CUPS-raster production using Ghostscript.

    CUPS versions before version 1.1.15 were shipping a binary (or source -code) standalone filter, named "pstoraster". pstoraster was derived +code) standalone filter, named pstoraster. pstoraster was derived from GNU Ghostscript 5.50, and could be installed besides and in addition to any GNU or AFPL Ghostscript package without conflicting.

    -From version 1.1.15, this has changed. The functions for this has been +>From version 1.1.15, this has changed. The functions for this have been integrated back into Ghostscript (now based on GNU Ghostscript version -7.05). The "pstoraster" filter is now a simple shell script calling +7.05). The pstoraster filter is now a simple shell script calling gs with the -sDEVICE=cups -parameter. If your Ghostscript doesn't show a success on asking for +parameter. If your Ghostscript does not show a success on asking for gs -h |grep cups, you might not be able to -print. Update your Ghostscript then! -

    imagetops and imagetoraster

    -Above in the section about prefilters, we mentioned the prefilter -that generates PostScript from image formats. The imagetoraster +print. Update your Ghostscript. +

    imagetops and imagetoraster

    +In the section about pre-filters, we mentioned the pre-filter +that generates PostScript from image formats. The imagetoraster filter is used to convert directly from image to raster, without the intermediate PostScript stage. It is used more often than the above -mentioned prefilters. Here is a summarizing flowchart of image file -filtering: +mentioned pre-filters. A summarizing flowchart of image file +filtering is shown in .

    -

    Figure 19.8. Image format to CUPS-raster format conversion

    Image format to CUPS-raster format conversion

    -

    rasterto [printers specific]

    -CUPS ships with quite some different raster drivers processing CUPS +

    Figure 19.8. Image format to CUPS-raster format conversion.

    Image format to CUPS-raster format conversion.

    +

    rasterto [printers specific]

    +CUPS ships with quite different raster drivers processing CUPS raster. On my system I find in /usr/lib/cups/filter/ these: rastertoalps, rastertobj, rastertoepson, rastertoescp, rastertopcl, rastertoturboprint, rastertoapdk, rastertodymo, -rastertoescp, rastertohp and +rastertoescp, rastertohp, and rastertoprinter. Don't worry if you have less than this; some of these are installed by commercial add-ons to CUPS (like rastertoturboprint), others (like -rastertoprinter) by 3rd party driver +rastertoprinter) by third-party driver development projects (such as Gimp-Print) wanting to cooperate as closely as possible with CUPS.

    -

    Figure 19.9. Raster to Printer Specific formats

    Raster to Printer Specific formats

    -

    CUPS Backends

    -The last part of any CUPS filtering chain is a "backend". Backends +

    Figure 19.9. Raster to printer-specific formats.

    Raster to printer-specific formats.

    +

    CUPS Backends

    +The last part of any CUPS filtering chain is a backend. Backends are special programs that send the print-ready file to the final device. There is a separate backend program for any transfer -"protocol" of sending printjobs over the network, or for every local -interface. Every CUPS printqueue needs to have a CUPS "device-URI" +protocol of sending printjobs over the network, or for every local +interface. Every CUPS print queue needs to have a CUPS “device-URI” associated with it. The device URI is the way to encode the backend used to send the job to its destination. Network device-URIs are using two slashes in their syntax, local device URIs only one, as you can see from the following list. Keep in mind that local interface names may vary much from my examples, if your OS is not Linux: -

    usb

    -This backend sends printfiles to USB-connected printers. An -example for the CUPS device-URI to use is: -usb:/dev/usb/lp0 -

    serial

    -This backend sends printfiles to serially connected printers. -An example for the CUPS device-URI to use is: -serial:/dev/ttyS0?baud=11500 -

    parallel

    -This backend sends printfiles to printers connected to the -parallel port. An example for the CUPS device-URI to use is: -parallel:/dev/lp0 -

    scsi

    -This backend sends printfiles to printers attached to the -SCSI interface. An example for the CUPS device-URI to use is: -scsi:/dev/sr1 -

    lpd

    -This backend sends printfiles to LPR/LPD connected network -printers. An example for the CUPS device-URI to use is: -lpd://remote_host_name/remote_queue_name -

    AppSocket/HP JetDirect

    -This backend sends printfiles to AppSocket (a.k.a. "HP -JetDirect") connected network printers. An example for the CUPS -device-URI to use is: -socket://10.11.12.13:9100 -

    ipp

    -This backend sends printfiles to IPP connected network -printers (or to other CUPS servers). Examples for CUPS device-URIs -to use are: -ipp:://192.193.194.195/ipp -(for many HP printers) or -ipp://remote_cups_server/printers/remote_printer_name -

    http

    -This backend sends printfiles to HTTP connected printers. -(The http:// CUPS backend is only a symlink to the ipp:// backend.) -Examples for the CUPS device-URIs to use are: -http:://192.193.194.195:631/ipp -(for many HP printers) or -http://remote_cups_server:631/printers/remote_printer_name -

    smb

    -This backend sends printfiles to printers shared by a Windows -host. An example for CUPS device-URIs to use are: -smb://workgroup/server/printersharename -Or -smb://server/printersharename -or -smb://username:password@workgroup/server/printersharename -or -smb://username:password@server/printersharename. -The smb:// backend is a symlink to the Samba utility -smbspool (doesn't ship with CUPS). If the -symlink is not present in your CUPS backend directory, have your -root user create it: ln -s `which smbspool` -/usr/lib/cups/backend/smb. -

    -It is easy to write your own backends as Shell or Perl scripts, if you +

    usb

    + This backend sends printfiles to USB-connected printers. An + example for the CUPS device-URI to use is: + usb:/dev/usb/lp0. +

    serial

    + This backend sends printfiles to serially connected printers. + An example for the CUPS device-URI to use is: + serial:/dev/ttyS0?baud=11500. +

    parallel

    + This backend sends printfiles to printers connected to the + parallel port. An example for the CUPS device-URI to use is: + parallel:/dev/lp0. +

    scsi

    + This backend sends printfiles to printers attached to the + SCSI interface. An example for the CUPS device-URI to use is: + scsi:/dev/sr1. +

    lpd

    + This backend sends printfiles to LPR/LPD connected network + printers. An example for the CUPS device-URI to use is: + lpd://remote_host_name/remote_queue_name. +

    AppSocket/HP JetDirect

    + This backend sends printfiles to AppSocket (a.k.a. "HP + JetDirect") connected network printers. An example for the CUPS + device-URI to use is: + socket://10.11.12.13:9100. +

    ipp

    + This backend sends printfiles to IPP connected network + printers (or to other CUPS servers). Examples for CUPS device-URIs + to use are: + ipp:://192.193.194.195/ipp + (for many HP printers) or + ipp://remote_cups_server/printers/remote_printer_name. +

    http

    + This backend sends printfiles to HTTP connected printers. + (The http:// CUPS backend is only a symlink to the ipp:// backend.) + Examples for the CUPS device-URIs to use are: + http:://192.193.194.195:631/ipp + (for many HP printers) or + http://remote_cups_server:631/printers/remote_printer_name. +

    smb

    + This backend sends printfiles to printers shared by a Windows + host. An example for CUPS device-URIs that may be used includes: +

    +

    smb://workgroup/server/printersharename
    smb://server/printersharename
    smb://username:password@workgroup/server/printersharename
    smb://username:password@server/printersharename

    +

    + The smb:// backend is a symlink to the Samba utility + smbspool (does not ship with CUPS). If the + symlink is not present in your CUPS backend directory, have your + root user create it: ln -s `which smbspool' + /usr/lib/cups/backend/smb. +

    +It is easy to write your own backends as shell or Perl scripts, if you need any modification or extension to the CUPS print system. One -reason could be that you want to create "special" printers which send -the printjobs as email (through a "mailto:/" backend), convert them to -PDF (through a "pdfgen:/" backend) or dump them to "/dev/null" (In +reason could be that you want to create “special” printers that send +the printjobs as email (through a “mailto:/” backend), convert them to +PDF (through a “pdfgen:/” backend) or dump them to “/dev/null”. (In fact I have the system-wide default printer set up to be connected to -a "devnull:/" backend: there are just too many people sending jobs -without specifying a printer, or scripts and programs which don't name +a devnull:/ backend: there are just too many people sending jobs +without specifying a printer, or scripts and programs which do not name a printer. The system-wide default deletes the job and sends a polite -mail back to the $USER asking him to always specify a correct -printername). +email back to the $USER asking him to always specify the correct +printer name.)

    Not all of the mentioned backends may be present on your system or usable (depending on your hardware configuration). One test for all @@ -8745,315 +8822,332 @@ utility. Used with the -v parameter, it lists all available backends: 

     $ lpinfo -v
-

    cupsomatic/Foomatic -- how do they fit into the Picture?

    -"cupsomatic" filters may be the most widely used on CUPS +

    The Role of cupsomatic/foomatic

    + + +cupsomatic filters may be the most widely used on CUPS installations. You must be clear about the fact that these were not -developed by the CUPS people. They are a "Third Party" add-on to +developed by the CUPS people. They are a third party add-on to CUPS. They utilize the traditional Ghostscript devices to render jobs for CUPS. When troubleshooting, you should know about the difference. Here the whole rendering process is done in one stage, -inside Ghostscript, using an appropriate "device" for the target -printer. cupsomatic uses PPDs which are generated from the "Foomatic" +inside Ghostscript, using an appropriate device for the target +printer. cupsomatic uses PPDs that are generated from the Foomatic Printer & Driver Database at Linuxprinting.org.

    You can recognize these PPDs from the line calling the -cupsomatic filter: -

    +cupsomatic filter:
+
+
      *cupsFilter: "application/vnd.cups-postscript  0  cupsomatic"
 
    
-This line you may find amongst the first 40 or so lines of the PPD
+
+You may find this line among the first 40 or so lines of the PPD
 file. If you have such a PPD installed, the printer shows up in the
-CUPS web interface with a foomatic namepart for
-the driver description. cupsomatic is a Perl script that runs
-Ghostscript, with all the complicated commandline options
-auto-constructed from the selected PPD and commandline options give to
+CUPS Web interface with a foomatic namepart for
+the driver description. cupsomatic is a Perl script that runs
+Ghostscript with all the complicated command line options
+auto-constructed from the selected PPD and command line options give to
 the printjob.
-
    
-However, cupsomatic is now deprecated. Its PPDs (especially the first
+
    
+
+	However, cupsomatic is now deprecated. Its PPDs (especially the first
 generation of them, still in heavy use out there) are not meeting the
 Adobe specifications. You might also suffer difficulties when you try
-to download them with "Point'n'Print" to Windows clients. A better,
-and more powerful successor is now in a very stable Beta-version
-available: it is called foomatic-rip. To use
-foomatic-rip as a filter with CUPS, you need the new-type PPDs.  These
-have a similar, but different line:
-
    +to download them with “Point'n'Print” to Windows clients. A better
+and more powerful successor is now in a stable beta-version: it is called foomatic-rip. To use
+foomatic-rip as a filter with CUPS, you need the new-type PPDs. These
+have a similar but different line:
 
+
      *cupsFilter: "application/vnd.cups-postscript  0  foomatic-rip"
-
 
    
+
 The PPD generating engine at Linuxprinting.org has been revamped.
 The new PPDs comply to the Adobe spec. On top, they also provide a
 new way to specify different quality levels (hi-res photo, normal
-color, grayscale, draft...) with a single click (whereas before you
-could have required 5 or more different selections (media type,
-resolution, inktype, dithering algorithm...). There is support for
+color, grayscale, and draft) with a single click, whereas before you
+could have required five or more different selections (media type,
+resolution, inktype and dithering algorithm). There is support for
 custom-size media built in. There is support to switch
-print-options from page to page, in the middle of a job. And the
-best thing is: the new foomatic-rip now works seamlessly with all
-legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR etc.), providing
-for them access to use PPDs for their printing!
-

    The Complete Picture

    -If you want to see an overview over all the filters and how they +print-options from page to page in the middle of a job. And the +best thing is the new foomatic-rip now works seamlessly with all +legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR and so on), providing +for them access to use PPDs for their printing. +

    The Complete Picture

    +If you want to see an overview of all the filters and how they relate to each other, the complete picture of the puzzle is at the end of this document. -

    mime.convs

    +

    mime.convs

    CUPS auto-constructs all possible filtering chain paths for any given MIME type, and every printer installed. But how does it decide in -favor or against a specific alternative? (There may often be cases, +favor or against a specific alternative? (There may often be cases where there is a choice of two or more possible filtering chains for -the same target printer). Simple: you may have noticed the figures in -the 3rd column of the mime.convs file. They represent virtual costs +the same target printer.) Simple. You may have noticed the figures in +the third column of the mime.convs file. They represent virtual costs assigned to this filter. Every possible filtering chain will sum up to -a total "filter cost". CUPS decides for the most "inexpensive" route. +a total “filter cost.” CUPS decides for the most “inexpensive” route.

    Tip

    The setting of FilterLimit 1000 in cupsd.conf will not allow more filters to run concurrently than will consume a total of 1000 virtual filter -cost. This is a very efficient way to limit the load of any CUPS -server by setting an appropriate "FilterLimit" value. A FilterLimit of -200 allows roughly 1 job at a time, while a FilterLimit of 1000 allows -approximately 5 jobs maximum at a time. -

    "Raw" printing

    -You can tell CUPS to print (nearly) any file "raw". "Raw" means it -will not be filtered. CUPS will send the file to the printer "as is" +cost. This is an efficient way to limit the load of any CUPS +server by setting an appropriate “FilterLimit” value. A FilterLimit of +200 allows roughly one job at a time, while a FilterLimit of 1000 allows +approximately five jobs maximum at a time. +

    “Raw” Printing

    + You can tell CUPS to print (nearly) any file “raw”. “Raw” means it + will not be filtered. CUPS will send the file to the printer “as is” without bothering if the printer is able to digest it. Users need to take care themselves that they send sensible data formats only. Raw -printing can happen on any queue if the "-o raw" option is specified +printing can happen on any queue if the “-o raw” option is specified on the command line. You can also set up raw-only queues by simply not associating any PPD with it. This command: 

     $ lpadmin -P rawprinter -v socket://11.12.13.14:9100 -E

    -sets up a queue named "rawprinter", connected via the "socket" -protocol (a.k.a. "HP JetDirect") to the device at IP address + sets up a queue named “rawprinter”, connected via the “socket” + protocol (a.k.a. “HP JetDirect”) to the device at IP address 11.12.1.3.14, using port 9100. (If you had added a PPD with -P /path/to/PPD to this command line, you would -have installed a "normal" printqueue. +have installed a “normal” print queue.

    -CUPS will automatically treat each job sent to a queue as a "raw" one, -if it can't find a PPD associated with the queue. However, CUPS will +CUPS will automatically treat each job sent to a queue as a “raw” one, +if it can't find a PPD associated with the queue. However, CUPS will only send known MIME types (as defined in its own mime.types file) and refuse others. -

    "application/octet-stream" printing

    +

    application/octet-stream Printing

    Any MIME type with no rule in the /etc/cups/mime.types file is regarded as unknown -or application/octet-stream and will not be +or application/octet-stream and will not be sent. Because CUPS refuses to print unknown MIME types per default, -you will probably have experienced the fact that printjobs originating +you will probably have experienced the fact that print jobs originating from Windows clients were not printed. You may have found an error message in your CUPS logs like: -

    +
    
  Unable to convert file 0 to printable format for job
-

    -To enable the printing of "application/octet-stream" files, edit +

    +To enable the printing of application/octet-stream files, edit these two files:

    • /etc/cups/mime.convs

    • /etc/cups/mime.types

    Both contain entries (at the end of the respective files) which must be uncommented to allow RAW mode operation for -application/octet-stream. In /etc/cups/mime.types +application/octet-stream. In /etc/cups/mime.types make sure this line is present: -

    - application/octet-stream
+
+
+
+
    +application/octet-stream
 
    
+
 This line (with no specific auto-typing rule set) makes all files
-not otherwise auto-typed a member of application/octet-stream. In
+not otherwise auto-typed a member of application/octet-stream. In
 /etc/cups/mime.convs, have this
 line: 
-
    - application/octet-stream   application/vnd.cups-raw   0   -
-
    
+
+
    +application/octet-stream   application/vnd.cups-raw   0   -
+
    
+
+
+
 This line tells CUPS to use the Null Filter
-(denoted as "-", doing... nothing at all) on
-application/octet-stream, and tag the result as
-application/vnd.cups-raw. This last one is
+(denoted as “-”, doing nothing at all) on
+application/octet-stream, and tag the result as
+application/vnd.cups-raw. This last one is
 always a green light to the CUPS scheduler to now hand the file over
-to the "backend" connecting to the printer and sending it over.
-
    Note
     Editing the mime.convs and the
+to the backend connecting to the printer and sending it over.
+
    Note
    Editing the mime.convs and the
 mime.types file does not
-enforce "raw" printing, it only
+enforce “raw” printing, it only
 allows it.
 
    Background. 
 CUPS being a more security-aware printing system than traditional ones
 does not by default allow one to send deliberate (possibly binary)
-data to printing devices.  (This could be easily abused to launch a
+data to printing devices. (This could be easily abused to launch a
 Denial of Service attack on your printer(s), causing at least the loss
-of a lot of paper and ink...) "Unknown" data are regarded by CUPS
+of a lot of paper and ink...) “Unknown” data are regarded by CUPS
 as MIME type
 application/octet-stream. While you
-can send data "raw", the MIME type for these must
+can send data “raw”, the MIME type for these must
 be one that is known to CUPS and an allowed one. The file
-/etc/cups/mime.types defines the "rules" how CUPS
+/etc/cups/mime.types defines the “rules” of how CUPS
 recognizes MIME types. The file
 /etc/cups/mime.convs decides which file
 conversion filter(s) may be applied to which MIME types.
-
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    
+
    PostScript Printer Descriptions (PPDs) for Non-PS Printers
    
+
 Originally PPDs were meant to be used for PostScript printers
 only. Here, they help to send device-specific commands and settings
 to the RIP which processes the jobfile. CUPS has extended this
 scope for PPDs to cover non-PostScript printers too. This was not
-very difficult, because it is a standardized file format. In a way
+difficult, because it is a standardized file format. In a way
 it was logical too: CUPS handles PostScript and uses a PostScript
-RIP (=Ghostscript) to process the jobfiles. The only difference is:
+RIP (Ghostscript) to process the jobfiles. The only difference is:
 a PostScript printer has the RIP built-in, for other types of
 printers the Ghostscript RIP runs on the host computer.
 
    
 PPDs for a non-PS printer have a few lines that are unique to
 CUPS. The most important one looks similar to this:
-
    +
+
+
+
      *cupsFilter: application/vnd.cups-raster  66   rastertoprinter
 
    
+
 It is the last piece in the CUPS filtering puzzle. This line tells the
-CUPS daemon to use as a last filter "rastertoprinter".  This filter
-should be served as input an "application/vnd.cups-raster" MIME type
-file. Therefore CUPS should auto-construct a filtering chain, which
+CUPS daemon to use as a last filter rastertoprinter. This filter
+should be served as input an application/vnd.cups-raster MIME type
+file. Therefore, CUPS should auto-construct a filtering chain, which
 delivers as its last output the specified MIME type. This is then
-taken as input to the specified "rastertoprinter" filter. After this
-the last filter has done its work ("rastertoprinter" is a Gimp-Print
+taken as input to the specified rastertoprinter filter. After this
+the last filter has done its work (rastertoprinter is a Gimp-Print
 filter), the file should go to the backend, which sends it to the
 output device.
 
    
 CUPS by default ships only a few generic PPDs, but they are good for
 several hundred printer models. You may not be able to control
 different paper trays, or you may get larger margins than your
-specific model supports):
-
    Table 19.1. PPD's shipped with CUPS
    PPD filePrinter type
    deskjet.ppdolder HP inkjet printers and compatible
    deskjet2.ppdnewer HP inkjet printers and compatible 
    dymo.ppdlabel printers 
    epson9.ppdEpson 24pin impact printers and compatible 
    epson24.ppdEpson 24pin impact printers and compatible 
    okidata9.ppdOkidata 9pin impact printers and compatible 
    okidat24.ppdOkidata 24pin impact printers and compatible 
    stcolor.ppdolder Epson Stylus Color printers 
    stcolor2.ppdnewer Epson Stylus Color printers 
    stphoto.ppdolder Epson Stylus Photo printers 
    stphoto2.ppdnewer Epson Stylus Photo printers 
    laserjet.ppdall PCL printers. Further below is a discussion of several other driver/PPD-packages suitable for use with CUPS.  
    Difference between cupsomatic/foomatic-rip and
-native CUPS printing
    
-Native CUPS rasterization works in two steps.
+specific model supports. See  for summary information.
+
    Table 19.1. PPDs shipped with CUPS
    PPD filePrinter type
    deskjet.ppdolder HP inkjet printers and compatible
    deskjet2.ppdnewer HP inkjet printers and compatible 
    dymo.ppdlabel printers 
    epson9.ppdEpson 24pin impact printers and compatible 
    epson24.ppdEpson 24pin impact printers and compatible 
    okidata9.ppdOkidata 9pin impact printers and compatible 
    okidat24.ppdOkidata 24pin impact printers and compatible 
    stcolor.ppdolder Epson Stylus Color printers 
    stcolor2.ppdnewer Epson Stylus Color printers 
    stphoto.ppdolder Epson Stylus Photo printers 
    stphoto2.ppdnewer Epson Stylus Photo printers 
    laserjet.ppdall PCL printers. Further below is a discussion
+			of several other driver/PPD-packages suitable for use with CUPS. 
    cupsomatic/foomatic-rip Versus native CUPS Printing
    
+
+
+Native CUPS rasterization works in two steps:
 
    • 
-First is the "pstoraster" step. It uses the special "cups"
-
-device from ESP Ghostscript 7.05.x as its tool
+First is the pstoraster step. It uses the special CUPS
+
+device from ESP Ghostscript 7.05.x as its tool.
 
    • 
-Second comes the "rasterdriver" step. It uses various
+Second comes the rasterdriver step. It uses various
 device-specific filters; there are several vendors who provide good
-quality filters for this step, some are Free Software, some are
-Shareware/Non-Free, some are proprietary.
    
+quality filters for this step. Some are free software, some are
+shareware/non-free and some are proprietary.
    
 Often this produces better quality (and has several more
 advantages) than other methods.
 
    
-	
    Figure 19.10. cupsomatic/foomatic processing versus Native CUPS
    cupsomatic/foomatic processing versus Native CUPS
    
+	
    Figure 19.10. cupsomatic/foomatic Processing versus Native CUPS.
    cupsomatic/foomatic Processing versus Native CUPS.
    
 
    
-One other method is the cupsomatic/foomatic-rip
-way. Note that cupsomatic is not made by the CUPS
+One other method is the cupsomatic/foomatic-rip
+way. Note that cupsomatic is not made by the CUPS
 developers. It is an independent contribution to printing development,
-made by people from Linuxprinting.org (see also http://www.cups.org/cups-help.html).
-cupsomatic is no longer developed and maintained and is no longer
+made by people from Linuxprinting.org [4].
+cupsomatic is no longer developed and maintained and is no longer
 supported. It has now been replaced by
-foomatic-rip. foomatic-rip is a complete re-write
-of the old cupsomatic idea, but very much improved and generalized to
+foomatic-rip. foomatic-rip is a complete re-write
+of the old cupsomatic idea, but very much improved and generalized to
 other (non-CUPS) spoolers. An upgrade to foomatic-rip is strongly
-advised, especially if you are upgrading to a recent version of CUPS
+advised, especially if you are upgrading to a recent version of CUPS,
 too.
 
    
-	
-	
-Both the cupsomatic (old) and the foomatic-rip (new) methods from
+	
+	
+Both the cupsomatic (old) and the foomatic-rip (new) methods from
 Linuxprinting.org use the traditional Ghostscript print file
 processing, doing everything in a single step. It therefore relies on
-all the other devices built-in into Ghostscript. The quality is as
+all the other devices built into Ghostscript. The quality is as
 good (or bad) as Ghostscript rendering is in other spoolers. The
 advantage is that this method supports many printer models not
 supported (yet) by the more modern CUPS method.
 
    
 Of course, you can use both methods side by side on one system (and
-even for one printer, if you set up different queues), and find out
+even for one printer, if you set up different queues) and find out
 which works best for you.
 
    
-cupsomatic "kidnaps" the printfile after the
-application/vnd.cups-postscript stage and
-deviates it through the CUPS-external, system wide Ghostscript
-installation: Therefore the printfile bypasses the "pstoraster" filter
-(and thus also bypasses the CUPS-raster-drivers
-"rastertosomething"). After Ghostscript finished its rasterization,
-cupsomatic hands the rendered file directly to the CUPS backend. The
-flowchart above illustrates the difference between native CUPS
-rendering and the Foomatic/cupsomatic method.
-

    Examples for filtering Chains

    +cupsomatic kidnaps the printfile after the +application/vnd.cups-postscript stage and +deviates it through the CUPS-external, system-wide Ghostscript +installation. Therefore the printfile bypasses the pstoraster filter +(and also bypasses the CUPS-raster-drivers +rastertosomething). After Ghostscript finished its rasterization, +cupsomatic hands the rendered file directly to the CUPS backend. The +flowchart in illustrates the difference between native CUPS +rendering and the Foomatic/cupsomatic method. +

    Examples for Filtering Chains

    Here are a few examples of commonly occurring filtering chains to illustrate the workings of CUPS.

    -Assume you want to print a PDF file to a HP JetDirect-connected +Assume you want to print a PDF file to an HP JetDirect-connected PostScript printer, but you want to print the pages 3-5, 7, 11-13 -only, and you want to print them "2-up" and "duplex": -

    • your print options (page selection as required, 2-up, -duplex) are passed to CUPS on the commandline;

    • the (complete) PDF file is sent to CUPS and autotyped as -application/pdf;

    • the file therefore first must pass the -pdftops pre-filter, which produces PostScript -MIME type application/postscript (a preview here -would still show all pages of the original PDF);

    • the file then passes the pstops -filter which applies the commandline options: it selects the pages -2-5, 7 and 11-13, creates and imposed layout "2 pages on 1 sheet" and -inserts the correct "duplex" command (as is defined in the printer's -PPD) into the new PostScript file; the file now is of PostScript MIME +only, and you want to print them “two-up” and “duplex”: +

      • Your print options (page selection as required, two-up, +duplex) are passed to CUPS on the command line.

      • The (complete) PDF file is sent to CUPS and autotyped as +application/pdf.

      • The file therefore must first pass the +pdftops pre-filter, which produces PostScript +MIME type application/postscript (a preview here +would still show all pages of the original PDF).

      • The file then passes the pstops +filter that applies the command line options: it selects the pages +2-5, 7 and 11-13, creates an imposed layout “2 pages on 1 sheet” and +inserts the correct “duplex” command (as defined in the printer's +PPD) into the new PostScript file; the file is now of PostScript MIME type -application/vnd.cups-postscript;

      • the file goes to the socket +application/vnd.cups-postscript.

      • The file goes to the socket backend, which transfers the job to the printers.

      - The resulting filter chain therefore is as drawn in the image below. -

      Figure 19.11. PDF to socket chain

      PDF to socket chain

      + The resulting filter chain, therefore, is as drawn in . +

      Figure 19.11. PDF to socket chain.

      PDF to socket chain.

      Assume your want to print the same filter to an USB-connected -Epson Stylus Photo printer, installed with the CUPS +Epson Stylus Photo printer installed with the CUPS stphoto2.ppd. The first few filtering stages are nearly the same: -

      • your print options (page selection as required, 2-up, -duplex) are passed to CUPS on the commandline;

      • the (complete) PDF file is sent to CUPS and autotyped as -application/pdf;

      • the file therefore first must pass the -pdftops pre-filter, which produces PostScript -MIME type application/postscript (a preview here -would still show all pages of the original PDF);

      • the file then passes the "pstops" filter which applies +

        • Your print options (page selection as required, two-up, +duplex) are passed to CUPS on the commandline.

        • The (complete) PDF file is sent to CUPS and autotyped as +application/pdf.

        • The file must first pass the +pdftops pre-filter, which produces PostScript +MIME type application/postscript (a preview here +would still show all pages of the original PDF).

        • The file then passes the “pstops” filter that applies the commandline options: it selects the pages 2-5, 7 and 11-13, -creates and imposed layout "2 pages on 1 sheet" and inserts the -correct "duplex" command... (OOoops -- this printer and his PPD -don't support duplex printing at all -- this option will be ignored -then) into the new PostScript file; the file now is of PostScript +creates an imposed layout “two pages on one sheet” and inserts the +correct “duplex” command... (Oops this printer and PPD +do not support duplex printing at all so this option will +be ignored) into the new PostScript file; the file is now of PostScript MIME type -application/vnd.cups-postscript;

        • the file then passes the -pstoraster stage and becomes MIME type -application/cups-raster;

        • finally, the rastertoepson filter -does its work (as is indicated in the printer's PPD), creating the -printer-specific raster data and embedding any user-selected -print-options into the print data stream;

        • the file goes to the usb backend, +application/vnd.cups-postscript.

        • The file then passes the + +pstoraster stage and becomes MIME type +application/ +cups-raster.

        • Finally, the rastertoepson filter +does its work (as indicated in the printer's PPD), creating the +rinter-specific raster data and embedding any user-selected +print-options into the print data stream.

        • The file goes to the usb backend, which transfers the job to the printers.

        - The resulting filter chain therefore is as drawn in the image below. -

        Figure 19.12. PDF to USB chain

        PDF to USB chain

      Sources of CUPS drivers / PPDs

      -On the internet you can find now many thousand CUPS-PPD files -(with their companion filters), in many national languages, -supporting more than 1000 non-PostScript models. -

      • ESP -PrintPro (commercial, -non-Free) is packaged with more than 3000 PPDs, ready for -successful use "out of the box" on Linux, Mac OS X, IBM-AIX, -HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital UNIX and some + The resulting filter chain therefore is as drawn in . +

        Figure 19.12. PDF to USB chain.

        PDF to USB chain.

      Sources of CUPS Drivers/PPDs

      +On the Internet you can now find many thousands of CUPS-PPD files +(with their companion filters), in many national languages +supporting more than thousand non-PostScript models. +

      • ESP +PrintPro (commercial, +non-free) is packaged with more than three thousand PPDs, ready for +successful use “out of the box” on Linux, Mac OS X, IBM-AIX, +HP-UX, Sun-Solaris, SGI-IRIX, Compaq Tru64, Digital UNIX, and some more commercial Unices (it is written by the CUPS developers themselves and its sales help finance the further development of -CUPS, as they feed their creators).

      • the Gimp-Print-Project - (GPL, Free Software) +CUPS, as they feed their creators).

      • The Gimp-Print-Project + (GPL, free software) provides around 140 PPDs (supporting nearly 400 printers, many driven to photo quality output), to be used alongside the Gimp-Print CUPS -filters;

      • TurboPrint - (Shareware, non-Free) supports +filters.

      • TurboPrint + (shareware, non-free) supports roughly the same amount of printers in excellent -quality;

      • OMNI - -(LPGL, Free) is a package made by IBM, now containing support for more +quality.

      • OMNI + +(LPGL, free) is a package made by IBM, now containing support for more than 400 printers, stemming from the inheritance of IBM OS/2 Know-How -ported over to Linux (CUPS support is in a Beta-stage at -present);

      • HPIJS - (BSD-style licenses, Free) +ported over to Linux (CUPS support is in a beta-stage at +present).

      • HPIJS + (BSD-style licenses, free) supports around 150 of HP's own printers and is also providing excellent print quality now (currently available only via the Foomatic -path);

      • Foomatic/cupsomatic - (LPGL, Free) from +path).

      • Foomatic/cupsomatic + (LPGL, free) from Linuxprinting.org are providing PPDs for practically every Ghostscript filter known to the world (including Omni, Gimp-Print and -HPIJS).

      Note

      -The cupsomatic/Foomatic trick from Linuxprinting.org works -differently from the other drivers. This is explained elsewhere in this -document. -

      Printing with Interface Scripts

      -CUPS also supports the usage of "interface scripts" as known from +HPIJS).

    Printing with Interface Scripts

    +CUPS also supports the usage of “interface scripts” as known from System V AT&T printing systems. These are often used for PCL -printers, from applications that generate PCL print jobs. Interface +printers, from applications that generate PCL print jobs. Interface scripts are specific to printer models. They have a similar role as PPDs for PostScript printers. Interface scripts may inject the Escape sequences as required into the print data stream, if the user has @@ -9066,126 +9160,138 @@ the -i option: root# lpadmin -p pclprinter -v socket://11.12.13.14:9100 \ -i /path/to/interface-script

    -Interface scripts might be the "unknown animal" to many. However, -with CUPS they provide the most easy way to plug in your own +Interface scripts might be the “unknown animal” to many. However, +with CUPS they provide the easiest way to plug in your own custom-written filtering script or program into one specific print queue (some information about the traditional usage of interface scripts is -to be found at http://playground.sun.com/printing/documentation/interface.html). -

    Network printing (purely Windows)

    +to be found at http://playground.sun.com/printing/documentation/interface.html). +

    Network Printing (Purely Windows)

    Network printing covers a lot of ground. To understand what exactly goes on with Samba when it is printing on behalf of its Windows -clients, let's first look at a "purely Windows" setup: Windows clients +clients, let's first look at a “purely Windows” setup: Windows clients with a Windows NT print server. -

    From Windows Clients to an NT Print Server

    +

    From Windows Clients to an NT Print Server

    Windows clients printing to an NT-based print server have two -options. They may -

    • execute the driver locally and render the GDI output -(EMF) into the printer specific format on their own, -or

    • send the GDI output (EMF) to the server, where the +options. They may: + + +

      • Execute the driver locally and render the GDI output + (EMF) into the printer-specific format on their own. +

      • Send the GDI output (EMF) to the server, where the driver is executed to render the printer specific output.

      -Both print paths are shown in the flowcharts below. -

    Driver Execution on the Client

    -In the first case the print server must spool the file as "raw", + Both print paths are shown in the flowcharts in the figures below. +

    Driver Execution on the Client

    +In the first case the print server must spool the file as raw, meaning it shouldn't touch the jobfile and try to convert it in any -way. This is what traditional UNIX-based print server can do too; and -at a better performance and more reliably than NT print server. This +way. This is what a traditional UNIX-based print server can do too, and +at a better performance and more reliably than an NT print server. This is what most Samba administrators probably are familiar with. One -advantage of this setup is that this "spooling-only" print server may +advantage of this setup is that this “spooling-only” print server may be used even if no driver(s) for UNIX are available it is sufficient -to have the Windows client drivers available and installed on the +to have the Windows client drivers available; and installed on the clients.

    -

    Figure 19.13. Print Driver execution on the Client

    Print Driver execution on the Client

    -

    Driver Execution on the Server

    -The other path executes the printer driver on the server. The clients +

    Figure 19.13. Print driver execution on the client.

    Print driver execution on the client.

    +

    Driver Execution on the Server

    + + + + + +The other path executes the printer driver on the server. The client transfers print files in EMF format to the server. The server uses the PostScript, PCL, ESC/P or other driver to convert the EMF file into the printer-specific language. It is not possible for UNIX to do the -same. Currently there is no program or method to convert a Windows +same. Currently, there is no program or method to convert a Windows client's GDI output on a UNIX server into something a printer could understand.

    -

    Figure 19.14. Print Driver execution on the Server

    Print Driver execution on the Server

    +

    Figure 19.14. Print driver execution on the server.

    Print driver execution on the server.

    -However, there is something similar possible with CUPS. Read on... -

    Network Printing (Windows clients -- UNIX/Samba Print +However, there is something similar possible with CUPS. Read on. +

    Network Printing (Windows Clients UNIX/Samba Print Servers)

    Since UNIX print servers cannot execute the Win32 program code on their platform, the picture is somewhat -different. However, this doesn't limit your options all that -much. In the contrary, you may have a way here to implement printing -features which are not possible otherwise. -

    From Windows Clients to a CUPS/Samba Print Server

    -Here is a simple recipe showing how you can take advantage of CUPS +different. However, this does not limit your options all that +much. On the contrary, you may have a way here to implement printing +features that are not possible otherwise. +

    From Windows Clients to a CUPS/Samba Print Server

    +Here is a simple recipe showing how you can take advantage of CUPS' powerful features for the benefit of your Windows network printing clients:

    • Let the Windows clients send PostScript to the CUPS -server.

    • Let the CUPS server render the PostScript into device -specific raster format.

    +server.

  • Let the CUPS server render the PostScript into device-specific raster format.

    • This requires the clients to use a PostScript driver (even if the printer is a non-PostScript model. It also requires that you have a -"driver" on the CUPS server. +driver on the CUPS server.

    -Firstly, to enable CUPS based printing through Samba the +First, to enable CUPS-based rinting through Samba the following options should be set in your smb.conf file [global] section: -

    • printing = cups

    • printcap = cups

    +

    printing = cups
    printcap = cups

    When these parameters are specified, all manually set print directives -(like print command, or lppause command) in smb.conf (as well as -in samba itself) will be ignored. Instead, Samba will directly -interface with CUPS through it's application program interface (API) - +(like print command, or lppause command) in smb.conf (as well as +in Samba itself) will be ignored. Instead, Samba will directly +interface with CUPS through its application program interface (API), as long as Samba has been compiled with CUPS library (libcups) -support. If Samba has NOT been compiled with CUPS support, and if no +support. If Samba has not been compiled with CUPS support, and if no other print commands are set up, then printing will use the System V AT&T command set, with the -oraw option automatically passing through (if you want your own defined print commands to work with a Samba that has CUPS support compiled in, -simply use printing = sysv). +simply use printing = sysv).

    -

    Figure 19.15. Printing via CUPS/samba server

    Printing via CUPS/samba server

    -

    Samba receiving Jobfiles and passing them to CUPS

    +

    Figure 19.15. Printing via CUPS/Samba server.

    Printing via CUPS/Samba server.

    +

    Samba Receiving Jobfiles and Passing Them to CUPS

    Samba must use its own spool directory (it is set -by a line similar to path = /var/spool/samba, +by a line similar to path = /var/spool/samba, in the [printers] or [printername] section of smb.conf). Samba receives the job in its own spool space and passes it into the spool directory of CUPS (the CUPS spooling directory is set by the RequestRoot directive, in a line that defaults to RequestRoot -/var/spool/cups). CUPS checks the access rights of its -spool dir and resets it to healthy values with every re-start. We have -seen quite some people who had used a common spooling space for Samba -and CUPS, and were struggling for weeks with this "problem". +/var/spool/cups). CUPS checks the access rights of its +spool dir and resets it to healthy values with every restart. We have +seen quite a few people who had used a common spooling space for Samba +and CUPS, and were struggling for weeks with this “problem.”

    A Windows user authenticates only to Samba (by whatever means is configured). If Samba runs on the same host as CUPS, you only need to -allow "localhost" to print. If they run on different machines, you +allow “localhost” to print. If they run on different machines, you need to make sure the Samba host gets access to printing on CUPS. -

    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs

    +

    Network PostScript RIP

    +This section discusses the use of CUPS filters on the server configuration where +clients make use of a PostScript driver with CUPS-PPDs. +

    + + + PPDs can control all print device options. They are usually provided -by the manufacturer; if you own a PostScript printer, that is. PPD +by the manufacturer, if you own a PostScript printer, that is. PPD files (PostScript Printer Descriptions) are always a component of PostScript printer drivers on MS Windows or Apple Mac OS systems. They are ASCII files containing user-selectable print options, mapped to appropriate PostScript, PCL or PJL commands for the target printer. Printer driver GUI dialogs translate these options -"on-the-fly" into buttons and drop-down lists for the user to select. +“on-the-fly” into buttons and drop-down lists for the user to select.

    CUPS can load, without any conversions, the PPD file from any Windows (NT is recommended) PostScript driver and handle the options. There is -a web browser interface to the print options (select http://localhost:631/printers/ -and click on one Configure Printer button to see -it), or a commandline interface (see man lpoptions -or see if you have lphelp on your system). There are also some +a Web browser interface to the print options (select http://localhost:631/printers/ +and click on one Configure Printer button to see +it), or a command line interface (see man lpoptions +or see if you have lphelp on your system). There are also some different GUI frontends on Linux/UNIX, which can present PPD options to users. PPD options are normally meant to be evaluated by the PostScript RIP on the real PostScript printer. -

    PPDs for non-PS Printers on UNIX

    -CUPS doesn't limit itself to "real" PostScript printers in its usage +

    PPDs for Non-PS Printers on UNIX

    + +CUPS does not limit itself to “real” PostScript printers in its usage of PPDs. The CUPS developers have extended the scope of the PPD -concept, to also describe available device and driver options for +concept to also describe available device and driver options for non-PostScript printers through CUPS-PPDs.

    This is logical, as CUPS includes a fully featured PostScript @@ -9193,104 +9299,109 @@ interpreter (RIP). This RIP is based on Ghostscript. It can process all received PostScript (and additionally many other file formats) from clients. All CUPS-PPDs geared to non-PostScript printers contain an additional line, starting with the keyword -*cupsFilter . This line tells the CUPS print +*cupsFilter. This line tells the CUPS print system which printer-specific filter to use for the interpretation of the supplied PostScript. Thus CUPS lets all its printers appear as PostScript devices to its clients, because it can act as a PostScript RIP for those printers, processing the received PostScript code into a proper raster print format. -

    PPDs for non-PS Printers on Windows

    +

    PPDs for Non-PS Printers on Windows

    + CUPS-PPDs can also be used on Windows-Clients, on top of a -"core" PostScript driver (now recommended is the "CUPS PostScript -Driver for WindowsNT/2K/XP"; you can also use the Adobe one, with +“core” PostScript driver (now recommended is the "CUPS PostScript +Driver for WindowsNT/200x/XP"; you can also use the Adobe one, with limitations). This feature enables CUPS to do a few tricks no other spooler can do: -

    • act as a networked PostScript RIP (Raster Image +

      • Act as a networked PostScript RIP (Raster Image Processor), handling printfiles from all client platforms in a uniform -way;

      • act as a central accounting and billing server, since -all files are passed through the pstops filter and are therefore +way.

      • Act as a central accounting and billing server, since +all files are passed through the pstops filter and are, therefore, logged in the CUPS page_log file. -NOTE: this can not happen with "raw" print jobs, -which always remain unfiltered per definition;

      • enable clients to consolidate on a single PostScript +Note: this cannot happen with “raw” print jobs, +which always remain unfiltered per definition.

      • Enable clients to consolidate on a single PostScript driver, even for many different target printers.

      Using CUPS PPDs on Windows clients enables these to control -all print job settings just as a UNIX client can do too. -

    Windows Terminal Servers (WTS) as CUPS Clients

    +all print job settings just as a UNIX client can do. +

    Windows Terminal Servers (WTS) as CUPS Clients

    This setup may be of special interest to people experiencing major -problems in WTS environments. WTS need often a multitude of +problems in WTS environments. WTS often need a multitude of non-PostScript drivers installed to run their clients' variety of different printer models. This often imposes the price of much increased instability. -

    Printer Drivers running in "Kernel Mode" cause many +

    Printer Drivers Running in “Kernel Mode” Cause Many Problems

    -The reason is that in Win NT printer drivers run in "Kernel -Mode", this introduces a high risk for the stability of the system + In Windows NT printer drivers which run in “Kernel +Mode”, introduces a high risk for the stability of the system if the driver is not really stable and well-tested. And there are a lot of bad drivers out there! Especially notorious is the example of the PCL printer driver that had an additional sound module running, to notify users via soundcard of their finished jobs. Do I -need to say that this one was also reliably causing "Blue Screens -of Death" on a regular basis? +need to say that this one was also reliably causing “blue screens +of death” on a regular basis?

    -PostScript drivers generally are very well tested. They are not known -to cause any problems, even though they run in Kernel Mode too. This -might be because there have so far only been 2 different PostScript +PostScript drivers are generally well tested. They are not known +to cause any problems, even though they also run in kernel mode. This +might be because there have been so far only two different PostScript drivers: the ones from Adobe and the one from Microsoft. Both are -very well tested and are as stable as you ever can imagine on +well tested and are as stable as you can imagine on Windows. The CUPS driver is derived from the Microsoft one. -

    Workarounds impose Heavy Limitations

    +

    Workarounds Impose Heavy Limitations

    In many cases, in an attempt to work around this problem, site -administrators have resorted to restrict the allowed drivers installed -on their WTS to one generic PCL- and one PostScript driver. This -however restricts the clients in the amount of printer options -available for them; often they can't get out more than simplex +administrators have resorted to restricting the allowed drivers installed +on their WTS to one generic PCL and one PostScript driver. This, +however, restricts the clients in the number of printer options +available for them. Often they can't get out more than simplex prints from one standard paper tray, while their devices could do much -better, if driven by a different driver! ) -

    CUPS: a "Magical Stone"?

    +better, if driven by a different driver! +

    CUPS: A “Magical Stone”?

    + + Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very elegant way to overcome all these shortcomings. There are, depending -on the version of Windows OS you use, up to 3 different PostScript +on the version of Windows OS you use, up to three different PostScript drivers available: Adobe, Microsoft and CUPS PostScript drivers. None of them is known to cause major stability problems on WTS (even if used with many different PPDs). The clients will be able to (again) chose paper trays, duplex printing and other settings. However, there is a certain price for this too: a CUPS server acting as a PostScript RIP for its clients requires more CPU and RAM than when just acting as -a "raw spooling" device. Plus, this setup is not yet widely tested, +a “raw spooling” device. Plus, this setup is not yet widely tested, although the first feedbacks look very promising. -

    PostScript Drivers with no major problems -- even in Kernel -Mode

    -More recent printer drivers on W2K and XP don't run in Kernel mode -(unlike Win NT) any more. However, both operating systems can still -use the NT drivers, running in Kernel mode (you can roughly tell which -is which as the drivers in subdirectory "2" of "W32X86" are "old" -ones). As was said before, the Adobe as well as the Microsoft +

    PostScript Drivers with No Major Problems Even in Kernel +Mode

    + +More recent printer drivers on W200x and XP no longer run in kernel mode +(unlike Windows NT). However, both operating systems can still +use the NT drivers, running in kernel mode (you can roughly tell which +is which as the drivers in subdirectory “2” of “W32X86” are “old” +ones). As was said before, the Adobe as well as the Microsoft PostScript drivers are not known to cause any stability problems. The CUPS driver is derived from the Microsoft one. There is a simple -reason for this: The MS DDK (Device Development Kit) for Win NT (which +reason for this: The MS DDK (Device Development Kit) for Windows NT (which used to be available at no cost to licensees of Visual Studio) includes the source code of the Microsoft driver, and licensees of Visual Studio are allowed to use and modify it for their own driver development efforts. This is what the CUPS people have done. The -license doesn't allow them to publish the whole of the source code. -However, they have released the "diff" under the GPL, and if you are -owner of an "MS DDK for Win NT", you can check the driver yourself. -

    Setting up CUPS for driver Download

    -As we have said before: all previously known methods to prepare client -printer drivers on the Samba server for download and "Point'n'Print" -convenience of Windows workstations are working with CUPS too. These +license does not allow them to publish the whole of the source code. +However, they have released the “diff” under the GPL, and if you are +the owner of an “MS DDK for Windows NT,” you can check the driver yourself. +

    Configuring CUPS for Driver Download

    +As we have said before, all previously known methods to prepare client +printer drivers on the Samba server for download and Point'n'Print +convenience of Windows workstations are working with CUPS, too. These methods were described in the previous chapter. In reality, this is a -pure Samba business, and only relates to the Samba/Win client +pure Samba business and only relates to the Samba/Windows client relationship. -

    cupsaddsmb: the unknown Utility

    -The cupsaddsmb utility (shipped with all current CUPS versions) is an -alternative method to transfer printer drivers into the Samba +

    cupsaddsmb: The Unknown Utility

    + +The cupsaddsmb utility (shipped with all current CUPS versions) is an +alternate method to transfer printer drivers into the Samba [print$] share. Remember, this share is where clients expect drivers deposited and setup for download and -installation. It makes the sharing of any (or all) installed CUPS -printers very easy. cupsaddsmb can use the Adobe PostScript driver as -well as the newly developed CUPS PostScript Driver for -WinNT/2K/XP. Note, that cupsaddsmb does +installation. It makes the sharing of any (or all) installed CUPS +printers quite easy. cupsaddsmb can use the Adobe PostScript driver as +well as the newly developed CUPS PostScript Driver for +Windows NT/200x/XP. cupsaddsmb does not work with arbitrary vendor printer drivers, but only with the exact driver files that are named in its man page. @@ -9299,23 +9410,24 @@ The CUPS printer driver is available from the CUPS download site. Its package name is cups-samba-[version].tar.gz . It is preferred over the Adobe drivers since it has a number of advantages: -

    • it supports a much more accurate page -accounting;

    • it supports banner pages, and page labels on all -printers;

    • it supports the setting of a number of job IPP +

      • It supports a much more accurate page +accounting.

      • It supports banner pages, and page labels on all +printers.

      • It supports the setting of a number of job IPP attributes (such as job-priority, page-label and -job-billing)

      -However, currently only Windows NT, 2000, and XP are supported by the -CUPS drivers. You will need to get the respective part of Adobe driver -too if you need to support Windows 95, 98, and ME clients. -

    Prepare your smb.conf for cupsaddsmb

    -Prior to running cupsaddsmb, you need the following settings in -smb.conf: -

    Example 19.3. smb.conf for cupsaddsmb usage

    [global]
    load printers = yes
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    public = yes
    # setting depends on your requirements
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root
    [print$]
    comment = Printer Drivers
    path = /etc/samba/drivers
    browseable = yes
    guest ok = no
    read only = yes
    write list = root

    CUPS Package of "PostScript Driver for WinNT/2k/XP"

    -CUPS users may get the exactly same packages from http://www.cups.org/software.html. +job-billing).

    +However, currently only Windows NT, 2000 and XP are supported by the +CUPS drivers. You will also need to get the respective part of Adobe driver +if you need to support Windows 95, 98 and ME clients. +

    Prepare Your smb.conf for cupsaddsmb

    +Prior to running cupsaddsmb, you need the settings in +smb.conf as shown in : +

    Example 19.3. smb.conf for cupsaddsmb usage

    [global]
    load printers = yes
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    browseable = no
    public = yes
    # setting depends on your requirements
    guest ok = yes
    writable = no
    printable = yes
    printer admin = root
    [print$]
    comment = Printer Drivers
    path = /etc/samba/drivers
    browseable = yes
    guest ok = no
    read only = yes
    write list = root

    CUPS “PostScript Driver for Windows NT/200x/XP”

    + +CUPS users may get the exact same packages from http://www.cups.org/software.html. It is a separate package from the CUPS base software files, tagged as -CUPS 1.1.x Windows NT/2k/XP Printer Driver for Samba -(tar.gz, 192k). The filename to download is -cups-samba-1.1.x.tar.gz. Upon untar-/unzip-ing, +CUPS 1.1.x Windows NT/200x/XP Printer Driver for Samba +(tar.gz, 192k). The filename to download is +cups-samba-1.1.x.tar.gz. Upon untar and unzipping, it will reveal these files: 

     root# tar xvzf cups-samba-1.1.19.tar.gz
@@ -9325,15 +9437,15 @@ cups-samba.readme
 cups-samba.remove
 cups-samba.ss

    - - + + These have been packaged with the ESP meta packager software -"EPM". The *.install and +EPM. The *.install and *.remove files are simple shell scripts, which untars the *.ss (the *.ss is -nothing else but a tar-archive, which can be untar-ed by "tar" +nothing else but a tar-archive, which can be untarred by “tar” too). Then it puts the content into -/usr/share/cups/drivers/. This content includes 3 +/usr/share/cups/drivers/. This content includes three files: 

     root# tar tv cups-samba.ss
@@ -9341,7 +9453,7 @@ cupsdrvr.dll
 cupsui.dll
 cups.hlp

    -The cups-samba.install shell scripts is easy to +The cups-samba.install shell scripts are easy to handle: 

     root# ./cups-samba.install
@@ -9349,7 +9461,7 @@ handle:
 Installing software...
 Updating file permissions...
 Running post-install commands...
-Installation is complete.        
+Installation is complete.

    The script should automatically put the driver files into the /usr/share/cups/drivers/ directory. @@ -9360,206 +9472,210 @@ into/usr/share/drivers/ instead of /usr/share/cups/drivers/. To work around this, copy/move the file (after running the ./cups-samba.install script) manually to the -right place. +correct place. 

     root# cp /usr/share/drivers/cups.hlp /usr/share/cups/drivers/
-

    +

    + This new CUPS PostScript driver is currently binary-only, but free of -charge. No complete source code is provided (yet). The reason is this: -it has been developed with the help of the Microsoft Driver -Developer Kit (DDK) and compiled with Microsoft Visual +charge. No complete source code is provided (yet). The reason is that +it has been developed with the help of the Microsoft Driver +Developer Kit (DDK) and compiled with Microsoft Visual Studio 6. Driver developers are not allowed to distribute the whole of -the source code as Free Software. However, CUPS developers released -the "diff" in source code under the GPL, so anybody with a license of +the source code as free software. However, CUPS developers released +the “diff” in source code under the GPL, so anybody with a license of Visual Studio and a DDK will be able to compile for him/herself. -

    Recognize the different Driver Files

    -The CUPS drivers don't support the "older" Windows 95/98/ME, but only -the Windows NT/2000/XP client: -

    Windows NT, 2000, and XP are supported by:

    -

    • cups.hlp

    • cupsdrvr.dll

    • cupsui.dll

    -

    -Adobe drivers are available for the older Windows 95/98/ME as well as -the Windows NT/2000/XP clients. The set of files is different for the +

    Recognizing Different Driver Files

    +The CUPS drivers do not support the older Windows 95/98/Me, but only +the Windows NT/2000/XP client. +

    Windows NT, 2000 and XP are supported by:

    +

    • cups.hlp
    • cupsdrvr.dll
    • cupsui.dll

    +

    +Adobe drivers are available for the older Windows 95/98/Me as well as +the Windows NT/2000/XP clients. The set of files is different from the different platforms. -

    Windows 95, 98, and Me are supported by:

    -

    • ADFONTS.MFM

    • ADOBEPS4.DRV

    • ADOBEPS4.HLP

    • DEFPRTR2.PPD

    • ICONLIB.DLL

    • PSMON.DLL

    -

    Windows NT, 2000, and XP are supported by:

    -

    • ADOBEPS5.DLL

    • ADOBEPSU.DLL

    • ADOBEPSU.HLP

    +

    Windows 95, 98 and ME are supported by:

    +

    • ADFONTS.MFM
    • ADOBEPS4.DRV
    • ADOBEPS4.HLP
    • DEFPRTR2.PPD
    • ICONLIB.DLL
    • PSMON.DLL

    +

    Windows NT, 2000 and XP are supported by:

    +

    • ADOBEPS5.DLL
    • ADOBEPSU.DLL
    • ADOBEPSU.HLP

    Note

    -If both, the Adobe driver files and the CUPS driver files for the -support of WinNT/2k/XP are present in , the Adobe ones will be ignored -and the CUPS ones will be used. If you prefer -- for whatever reason --- to use Adobe-only drivers, move away the 3 CUPS driver files. The -Win95/98/ME clients use the Adobe drivers in any case. -

    Acquiring the Adobe Driver Files

    +If both the Adobe driver files and the CUPS driver files for the +support of Windows NT/200x/XP are present in FIXME, the Adobe ones will be ignored +and the CUPS ones will be used. If you prefer for whatever reason + to use Adobe-only drivers, move away the three CUPS driver files. The +Windows 9x/Me clients use the Adobe drivers in any case. +

    Acquiring the Adobe Driver Files

    Acquiring the Adobe driver files seems to be unexpectedly difficult -for many users. They are not available on the Adobe website as single -files and the self-extracting and/or self-installing Windows-exe is +for many users. They are not available on the Adobe Web site as single +files and the self-extracting and/or self-installing Windows-.exe is not easy to locate either. Probably you need to use the included native installer and run the installation process on one client once. This will install the drivers (and one Generic PostScript -printer) locally on the client. When they are installed, share the -Generic PostScript printer. After this, the client's +printer) locally on the client. When they are installed, share the +Generic PostScript printer. After this, the client's [print$] share holds the Adobe files, from -where you can get them with smbclient from the CUPS host. A more -detailed description about this is in the next (the CUPS printing) -chapter. -

    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"

    -Users of the ESP Print Pro software are able to install their "Samba -Drivers" package for this purpose with no problem. Retrieve the driver +where you can get them with smbclient from the CUPS host. +

    ESP Print Pro PostScript Driver for Windows NT/200x/XP

    + +Users of the ESP Print Pro software are able to install their Samba +drivers package for this purpose with no problem. Retrieve the driver files from the normal download area of the ESP Print Pro software -at http://www.easysw.com/software.html. -You need to locate the link labelled "SAMBA" amongst the -Download Printer Drivers for ESP Print Pro 4.x +at http://www.easysw.com/software.html. +You need to locate the link labelled “SAMBA” among the +Download Printer Drivers for ESP Print Pro 4.x area and download the package. Once installed, you can prepare any driver by simply highlighting the printer in the Printer Manager GUI -and select Export Driver... from the menu. Of -course you need to have prepared Samba beforehand too to handle the -driver files; i.e. mainly setup the [print$] -share, etc. The ESP Print Pro package includes the CUPS driver files -as well as a (licensed) set of Adobe drivers for the Windows 95/98/ME +and select Export Driver... from the menu. Of +course you need to have prepared Samba beforehand to handle the +driver files; i.e., setup the [print$] +share, and so on. The ESP Print Pro package includes the CUPS driver files +as well as a (licensed) set of Adobe drivers for the Windows 95/98/Me client family. -

    Caveats to be considered

    +

    Caveats to be Considered

    + Once you have run the install script (and possibly manually moved the cups.hlp file to /usr/share/cups/drivers/), the driver is ready to be put into Samba's [print$] share (which often maps to -/etc/samba/drivers/ and contains a subdir +/etc/samba/drivers/ and contains a subdirectory tree with WIN40 and -W32X86 branches): You do this by running -"cupsaddsmb" (see also man cupsaddsmb for +W32X86 branches). You do this by running +cupsaddsmb (see also man cupsaddsmb for CUPS since release 1.1.16).

    Tip

    - + You may need to put root into the smbpasswd file by running smbpasswd; this is especially important if you should run this whole procedure for the first time, and are not working in an environment where everything is configured for -Single Sign On to a Windows Domain Controller. +single sign on to a Windows Domain Controller.

    Once the driver files are in the [print$] share and are initialized, they are ready to be downloaded and installed by -the Win NT/2k/XP clients. +the Windows NT/200x/XP clients.

    Note

    -

    1. -Win 9x/ME clients won't work with the CUPS PostScript driver. For -these you'd still need to use the ADOBE*.* -drivers as previously. -

    2. +Win 9x/Me clients will not work with the CUPS PostScript driver. For +these you still need to use the ADOBE*.* +drivers as previously stated. +

    Note

    It is not harmful if you still have the ADOBE*.* driver files from previous installations in the /usr/share/cups/drivers/ -directory. The new cupsaddsmb (from 1.1.16) will -automatically prefer "its own" drivers if it finds both. -

  • - -Should your Win clients have had the old ADOBE*.* +directory. The new cupsaddsmb (from 1.1.16) will +automatically prefer its own drivers if it finds both. +

    • Note

    + +Should your Windows clients have had the old ADOBE*.* files for the Adobe PostScript driver installed, the download and -installation of the new CUPS PostScript driver for Windows NT/2k/XP +installation of the new CUPS PostScript driver for Windows NT/200x/XP will fail at first. You need to wipe the old driver from the clients -first. It is not enough to "delete" the printer, as the driver files +first. It is not enough to “delete” the printer, as the driver files will still be kept by the clients and re-used if you try to re-install the printer. To really get rid of the Adobe driver files on the -clients, open the "Printers" folder (possibly via Start, Settings, Control Panel, Printers), -right-click onto the folder background and select Server -Properties. When the new dialog opens, select the -Drivers tab. On the list select the driver you -want to delete and click on the Delete +clients, open the Printers folder (possibly via Start > Settings > Control Panel > Printers), +right-click on the folder background and select Server +Properties. When the new dialog opens, select the +Drivers tab. On the list select the driver you +want to delete and click the Delete button. This will only work if there is not one single printer left -which uses that particular driver. You need to "delete" all printers -using this driver in the "Printers" folder first. You will need +that uses that particular driver. You need to “delete” all printers +using this driver in the Printers folder first. You will need Administrator privileges to do this. -

  • - +

    • Note

    + Once you have successfully downloaded the CUPS PostScript driver to a client, you can easily switch all printers to this one by proceeding -as described in the printing chapter: either change -a driver for an existing printer by running the "Printer Properties" +as described in . Either change +a driver for an existing printer by running the Printer Properties dialog, or use rpcclient with the -setdriver sub-command. -

    -

    Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver

    -You are interested in a comparison between the CUPS and the Adobe +setdriver subcommand. +

    Windows CUPS PostScript Driver Versus Adobe Driver

    +Are you interested in a comparison between the CUPS and the Adobe PostScript drivers? For our purposes these are the most important -items which weigh in favor of the CUPS ones: -

    • no hassle with the Adobe EULA

    • no hassle with the question “Where do I +items that weigh in favor of the CUPS ones: +

      • No hassle with the Adobe EULA.

      • No hassle with the question “Where do I get the ADOBE*.* driver files from?”

      • - - the Adobe drivers (on request of the printer PPD + +The Adobe drivers (on request of the printer PPD associated with them) often put a PJL header in front of the main -PostScript part of the print file. Thus the printfile starts with +PostScript part of the print file. Thus, the printfile starts with <1B >%-12345X or <escape>%-12345X instead of %!PS). This leads to the CUPS daemon auto-typing the incoming file as a print-ready file, -not initiating a pass through the "pstops" filter (to speak more -technically, it is not regarded as the generic MIME type - -application/postscript, but as +not initiating a pass through the pstops filter (to speak more +technically, it is not regarded as the generic MIME-type + +application/postscript, but as the more special MIME type - -application/cups.vnd-postscript), + +application/cups.vnd-postscript), which therefore also leads to the page accounting in -/var/log/cups/page_log not +/var/log/cups/page_log not receiving the exact number of pages; instead the dummy page number -of "1" is logged in a standard setup)

      • the Adobe driver has more options to "mis-configure" the +of “1” is logged in a standard setup).

      • The Adobe driver has more options to misconfigure the PostScript generated by it (like setting it inadvertently to -Optimize for Speed, instead of -Optimize for Portability, which -could lead to CUPS being unable to process it)

      • the CUPS PostScript driver output sent by Windows -clients to the CUPS server will be guaranteed to be auto-typed always -as generic MIME type application/postscript, -thusly passing through the CUPS "pstops" filter and logging the +Optimize for Speed, instead of +Optimize for Portability, which +could lead to CUPS being unable to process it).

      • The CUPS PostScript driver output sent by Windows +clients to the CUPS server is guaranteed to auto-type +as the generic MIME type application/postscript, +thus passing through the CUPS pstops filter and logging the correct number of pages in the page_log for -accounting and quota purposes

      • the CUPS PostScript driver supports the sending of -additional standard (IPP) print options by Win NT/2k/XP clients. Such +accounting and quota purposes.

      • The CUPS PostScript driver supports the sending of +additional standard (IPP) print options by Windows NT/200x/XP clients. Such additional print options are: naming the CUPS standard banner pages (or the custom ones, should they be installed at the time of driver download), using the CUPS -page-label option, setting a -job-priority and setting the scheduled -time of printing (with the option to support additional -useful IPP job attributes in the future).

      • the CUPS PostScript driver supports the inclusion of -the new *cupsJobTicket comments at the +page-label option, setting a +job-priority, and setting the scheduled +time of printing (with the option to support additional +useful IPP job attributes in the future).

      • The CUPS PostScript driver supports the inclusion of +the new *cupsJobTicket comments at the beginning of the PostScript file (which could be used in the future for all sort of beneficial extensions on the CUPS side, but which will not disturb any other applications as they will regard it as a comment -and simply ignore it).

      • the CUPS PostScript driver will be the heart of the -fully fledged CUPS IPP client for Windows NT/2K/XP to be released soon -(probably alongside the first Beta release for CUPS -1.2).

    Run "cupsaddsmb" (quiet Mode)

    -The cupsaddsmb command copies the needed files into your +and simply ignore it).

  • The CUPS PostScript driver will be the heart of the +fully fledged CUPS IPP client for Windows NT/200x/XP to be released soon +(probably alongside the first beta release for CUPS +1.2).

    • Run cupsaddsmb (Quiet Mode)

    + + +The cupsaddsmb command copies the needed files into your [print$] share. Additionally, the PPD associated with this printer is copied from /etc/cups/ppd/ to [print$]. There the files wait for convenient Windows client installations via Point'n'Print. Before we can run the command successfully, we need to be sure that we can authenticate -towards Samba. If you have a small network you are probably using user -level security (security = user). +toward Samba. If you have a small network, you are probably using user-level +security (security = user).

    -Here is an example of a successfully run cupsaddsmb command. +Here is an example of a successfully run cupsaddsmb command: 

     root# cupsaddsmb -U root infotec_IS2027
 Password for root required to access localhost via Samba: ['secret']

    To share all printers and drivers, use the -a parameter instead of a printer name. Since -cupsaddsmb "exports" the printer drivers to Samba, it should be +cupsaddsmb “exports” the printer drivers to Samba, it should be obvious that it only works for queues with a CUPS driver associated. -

    Run "cupsaddsmb" with verbose Output

    +

    Run cupsaddsmb with Verbose Output

    + Probably you want to see what's going on. Use the -v parameter to get a more verbose output. The -output below was edited for better readability: all "\" at the end of +output below was edited for better readability: all “\” at the end of a line indicate that I inserted an artificial line break plus some indentation here:

    Warning

    You will see the root password for the Samba account printed on screen. -

    +

    + + + + 

     root# cupsaddsmb -U root -v infotec_2105
 Password for root required to access localhost via GANDALF:
 Running command: smbclient //localhost/print\$ -N -U'root%secret' \
@@ -9578,10 +9694,11 @@ putting file /usr/share/cups/drivers/cups.hlp as \W32X86/cups.hlp
   
 Running command: rpcclient localhost -N -U'root%secret' 
    -c 'adddriver "Windows NT x86"   \
-   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:   \
+   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \
     RAW:NULL"'
 cmd = adddriver "Windows NT x86" \
-    "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL:RAW:NULL"
+   "infotec_2105:cupsdrvr.dll:infotec_2105.ppd:cupsui.dll:cups.hlp:NULL: \
+	RAW:NULL"
 Printer Driver infotec_2105 successfully installed.
   
 Running command: smbclient //localhost/print\$ -N -U'root%secret' \
@@ -9609,9 +9726,10 @@ Running command: smbclient //localhost/print\$ -N -U'root%secret' \
    "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:ADOBEPS4.HLP: \
    PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL, \
     ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"'
-  cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:infotec_2105.PPD:NULL:          \
-    ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,infotec_2105.PPD,ADOBEPS4.HLP,  \
-                   PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,ICONLIB.DLL"
+	cmd = adddriver "Windows 4.0" "infotec_2105:ADOBEPS4.DRV:\
+	infotec_2105.PPD:NULL:ADOBEPS4.HLP:PSMON.DLL:RAW:ADOBEPS4.DRV,\
+	infotec_2105.PPD,ADOBEPS4.HLP,PSMON.DLL,ADFONTS.MFM,DEFPRTR2.PPD,\
+	ICONLIB.DLL"
   Printer Driver infotec_2105 successfully installed.
   
   Running command: rpcclient localhost -N -U'root%secret'  \
@@ -9621,62 +9739,60 @@ Running command: smbclient //localhost/print\$ -N -U'root%secret' \

    If you look closely, you'll discover your root password was transferred -unencrypted over the wire, so beware! Also, if you look further her, -you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in -between. They occur, because the directories WIN40 and W32X86 already -existed in the [print$] driver download share -(from a previous driver installation). They are harmless here. -

    Understanding cupsaddsmb

    -What has happened? What did cupsaddsmb do? There are five stages of -the procedure +unencrypted over the wire, so beware! Also, if you look further, +you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in between. They occur, because the directories WIN40 and W32X86 already existed in the [print$] driver download share (from a previous driver installation). They are harmless here. +

    Understanding cupsaddsmb

    + +What has happened? What did cupsaddsmb do? There are five stages of +the procedure:

    1. - - call the CUPS server via IPP and request the -driver files and the PPD file for the named printer;

    2. store the files temporarily in the local + + Call the CUPS server via IPP and request the +driver files and the PPD file for the named printer.

    3. Store the files temporarily in the local TEMPDIR (as defined in -cupsd.conf);

    4. connect via smbclient to the Samba server's +cupsd.conf).

    5. Connect via smbclient to the Samba server's [print$] share and put the files into the - share's WIN40 (for Win95/98/ME) and W32X86/ (for WinNT/2k/XP) sub - directories;

    6. - - connect via rpcclient to the Samba server and -execute the "adddriver" command with the correct -parameters;

    7. - - connect via rpcclient to the Samba server a second -time and execute the "setdriver" command.

    -Note, that you can run the cupsaddsmb utility with parameters to + share's WIN40 (for Windows 9x/Me) and W32X86/ (for Windows NT/200x/XP) subdirectories.

  • + + Connect via rpcclient to the Samba server and +execute the adddriver command with the correct +parameters.

  • + + Connect via rpcclient to the Samba server a second +time and execute the setdriver command.

    • Note

    +You can run the cupsaddsmb utility with parameters to specify one remote host as Samba host and a second remote host as CUPS host. Especially if you want to get a deeper understanding, it is a -good idea try it and see more clearly what is going on (though in real +good idea to try it and see more clearly what is going on (though in real life most people will have their CUPS and Samba servers run on the same host): 

    -root# cupsaddsmb -H sambaserver -h cupsserver -v printername
-

    How to recognize if cupsaddsmb completed successfully

    +root# cupsaddsmb -H sambaserver -h cupsserver -v printer +

    How to Recognize If cupsaddsmb Completed Successfully

    You must always check if the utility completed -successfully in all fields. You need as a minimum these 3 messages -amongst the output: +successfully in all fields. You need as a minimum these three messages +among the output:

    1. Printer Driver infotec_2105 successfully -installed. # (for the W32X86 == WinNT/2K/XP -architecture...)

    2. Printer Driver infotec_2105 successfully -installed. # (for the WIN40 == Win9x/ME -architecture...)

    3. Successfully set [printerXPZ] to driver +installed. # (for the W32X86 == Windows NT/200x/XP +architecture).

    4. Printer Driver infotec_2105 successfully +installed. # (for the WIN40 == Windows 9x/Me +architecture).

    5. Successfully set [printerXPZ] to driver [printerXYZ].

    -These messages probably not easily recognized in the general -output. If you run cupsaddsmb with the -a +These messages are probably not easily recognized in the general +output. If you run cupsaddsmb with the -a parameter (which tries to prepare all active CUPS printer drivers for download), you might miss if individual printers -drivers had problems to install properly. Here a redirection of the +drivers had problems installing properly. Here a redirection of the output will help you analyze the results in retrospective.

    Note

    -It is impossible to see any diagnostic output if you don't run -cupsaddsmb in verbose mode. Therefore we strongly recommend to not -use the default quiet mode. It will hide any problems from you which +It is impossible to see any diagnostic output if you do not run +cupsaddsmb in verbose mode. Therefore, we strongly recommend to not +use the default quiet mode. It will hide any problems from you that might occur. -

    cupsaddsmb with a Samba PDC

    -You can't get the standard cupsaddsmb command to run on a Samba PDC? -You are asked for the password credential all over again and again and +

    cupsaddsmb with a Samba PDC

    + +Can't get the standard cupsaddsmb command to run on a Samba PDC? +Are you asked for the password credential all over again and again and the command just will not take off at all? Try one of these variations: 

    @@ -9685,114 +9801,116 @@ variations:
 root# cupsaddsmb -H SAURON -U MIDEARTH\\root -h cups-server -v printername

    (Note the two backslashes: the first one is required to -"escape" the second one). -

    cupsaddsmb Flowchart

    -Here is a chart about the procedures, commandflows and -dataflows of the "cupaddsmb" command. Note again: cupsaddsmb is -not intended to, and does not work with, "raw" queues! -

    -

    Figure 19.16. cupsaddsmb flowchart

    cupsaddsmb flowchart

    -

    Installing the PostScript Driver on a Client

    -After cupsaddsmb completed, your driver is prepared for the clients to +“escape” the second one). +

    cupsaddsmb Flowchart

    + + shows a chart about the procedures, commandflows and +dataflows of the cupaddsmb command. Note again: cupsaddsmb is +not intended to, and does not work with, raw queues! +

    +

    Figure 19.16. cupsaddsmb flowchart.

    cupsaddsmb flowchart.

    +

    Installing the PostScript Driver on a Client

    + +After cupsaddsmb is completed, your driver is prepared for the clients to use. Here are the steps you must perform to download and install it -via "Point'n'Print". From a Windows client, browse to the CUPS/Samba -server; -

    • open the Printers -share of Samba in Network Neighbourhood;

    • right-click on the printer in -question;

    • from the opening context-menu select -Install... or -Connect... (depending on the Windows version you +via Point'n'Print. From a Windows client, browse to the CUPS/Samba +server: +

      • + +Open the Printers +share of Samba in Network Neighborhood.

      • Right-click on the printer in +question.

      • From the opening context-menu select +Install... or +Connect... (depending on the Windows version you use).

      After a few seconds, there should be a new printer in your -client's local "Printers" folder: On Windows +client's local Printers folder. On Windows XP it will follow a naming convention of PrinterName on SambaServer. (In my current case it is "infotec_2105 on kde-bitshop"). If you want to test it and send your first job from -an application like Winword, the new printer will appears in a +an application like Winword, the new printer appears in a \\SambaServer\PrinterName entry in the -dropdown list of available printers. -

      Note

      - -cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher -and Samba from 2.2.4. If it doesn't work, or if the automatic printer -driver download to the clients doesn't succeed, you can still manually +drop-down list of available printers. +

      + +cupsaddsmb will only reliably work with CUPS version 1.1.15 or higher +and Samba from 2.2.4. If it does not work, or if the automatic printer +driver download to the clients does not succeed, you can still manually install the CUPS printer PPD on top of the Adobe PostScript driver on clients. Then point the client's printer queue to the Samba printer share for a UNC type of connection: -

      +
       C:\> net use lpt1: \\sambaserver\printershare /user:ntadmin
 
      
 should you desire to use the CUPS networked PostScript RIP
-functions. (Note that user "ntadmin" needs to be a valid Samba user
-with the required privileges to access the printershare) This would
-set up the printer connection in the traditional
+functions. (Note that user “ntadmin” needs to be a valid Samba user
+with the required privileges to access the printershare.) This
+sets up the printer connection in the traditional
 LanMan way (not using MS-RPC).
-

    Avoiding critical PostScript Driver Settings on the -Client

    -Soooo: printing works, but there are still problems. Most jobs print -well, some don't print at all. Some jobs have problems with fonts, -which don't look very good. Some jobs print fast, and some are +

    Avoiding Critical PostScript Driver Settings on the Client

    +Printing works, but there are still problems. Most jobs print +well, some do not print at all. Some jobs have problems with fonts, +which do not look very good. Some jobs print fast and some are dead-slow. Many of these problems can be greatly reduced or even completely eliminated if you follow a few guidelines. Remember, if your print device is not PostScript-enabled, you are treating your Ghostscript installation on your CUPS host with the output your client driver settings produce. Treat it well: -

    • Avoid the PostScript Output Option: Optimize -for Speed setting. Rather use the Optimize for -Portability instead (Adobe PostScript -driver).

    • Don't use the Page Independence: -NO setting. Instead use Page Independence -YES (CUPS PostScript Driver)

    • Recommended is the True Type Font -Downloading Option: Native True Type over -Automatic and Outline; you -should by all means avoid Bitmap (Adobe -PostScript Driver)

    • Choose True Type Font: Download as Softfont -into Printer over the default Replace by Device -Font (for exotic fonts you may need to change it back to -get a printout at all) (Adobe)

    • Sometimes you can choose PostScript Language -Level: in case of problems try 2 -instead of 3 (the latest ESP Ghostscript package -handles Level 3 PostScript very well) (Adobe).

    • Say Yes to PostScript -Error Handler (Adobe)

    Installing PostScript Driver Files manually (using -rpcclient)

    -Of course you can run all the commands which are embedded into the +

    • Avoid the PostScript Output Option: Optimize +for Speed setting. Use the Optimize for +Portability instead (Adobe PostScript +driver).

    • Don't use the Page Independence: +NO setting. Instead, use Page Independence +YES (CUPS PostScript Driver).

    • Recommended is the True Type Font +Downloading Option: Native True Type over +Automatic and Outline; you +should by all means avoid Bitmap (Adobe +PostScript Driver).

    • Choose True Type Font: Download as Softfont +into Printer over the default Replace by Device +Font (for exotic fonts, you may need to change it back to +get a printout at all) (Adobe).

    • Sometimes you can choose PostScript Language +Level: In case of problems try 2 +instead of 3 (the latest ESP Ghostscript package +handles Level 3 PostScript very well) (Adobe).

    • Say Yes to PostScript +Error Handler (Adobe).

    Installing PostScript Driver Files Manually Using rpcclient

    +Of course, you can run all the commands that are embedded into the cupsaddsmb convenience utility yourself, one by one, and hereby upload and prepare the driver files for future client downloads. -

    1. prepare Samba (a CUPS printqueue with the name of the +

      1. Prepare Samba (A CUPS print queue with the name of the printer should be there. We are providing the driver -now);

      2. copy all files to - [print$]

      3. - - run rpcclient adddriver -(for each client architecture you want to support):

      4. - - run rpcclient +now).

      5. Copy all files to + [print$].

      6. + +Run rpcclient adddriver +(for each client architecture you want to support).

      7. + +Run rpcclient setdriver.

      - - - - - -We are going to do this now. First, read the man page on "rpcclient" + + + + + +We are going to do this now. First, read the man page on rpcclient to get a first idea. Look at all the printing related -sub-commands. enumprinters, +subcommands. enumprinters, enumdrivers, enumports, -adddriver, setdriver are amongst -the most interesting ones. rpcclient implements an important part of -the MS-RPC protocol. You can use it to query (and command) a Win NT -(or 2K/XP) PC too. MS-RPC is used by Windows clients, amongst other -things, to benefit from the "Point'n'Print" features. Samba can now -mimic this too. -

      A Check of the rpcclient man Page

      -First let's have a little check of the rpcclient man page. Here are +adddriver, setdriver are among +the most interesting ones. rpcclient implements an important part of +the MS-RPC protocol. You can use it to query (and command) a Windows NT +(or 200x/XP) PC, too. MS-RPC is used by Windows clients, among other +things, to benefit from the Point'n'Print features. Samba can now +mimic this as well. +

      A Check of the rpcclient man Page

      + First let's check the rpcclient man page. Here are two relevant passages:

      adddriver <arch> <config> Execute an -AddPrinterDriver() RPC to install the printer driver information on -the server. Note that the driver files should already exist in the -directory returned by getdriverdir. Possible +AddPrinterDriver() RPC to install the printer driver information on +the server. The driver files should already exist in the +directory returned by getdriverdir. Possible values for arch are the same as those for the -getdriverdir command. The +getdriverdir command. The config parameter is defined as follows: 

       Long Printer Name:\
@@ -9803,68 +9921,70 @@ Help File Name:\
 Language Monitor Name:\
 Default Data Type:\
 Comma Separated list of Files
-

      Any empty fields should be enter as the string "NULL".

      Samba does not need to support the concept of Print Monitors +

      Any empty fields should be enter as the string “NULL”.

      Samba does not need to support the concept of Print Monitors since these only apply to local printers whose driver can make use of -a bi-directional link for communication. This field should be "NULL". +a bi-directional link for communication. This field should be “NULL”. On a remote NT print server, the Print Monitor for a driver must already be installed prior to adding the driver or else the RPC will -fail +fail.

      setdriver <printername> <drivername> Execute a SetPrinter() command to update the printer driver associated with an installed printer. The printer driver must already be correctly installed on the print server. -

      See also the enumprinters and enumdrivers commands for +

      See also the enumprinters and enumdrivers commands for obtaining a list of installed printers and drivers. -

      Understanding the rpcclient man page

      +

      Understanding the rpcclient man Page

      The exact format isn't made too clear by the man page, since you have to deal with some parameters containing spaces. Here is a better description for it. We have line-broken the -command and indicated the breaks with "\". Usually you would type the +command and indicated the breaks with “\”. Usually you would type the command in one line without the linebreaks: -

      +
+
        adddriver "Architecture" \
            "LongPrinterName:DriverFile:DataFile:ConfigFile:HelpFile:\
            LanguageMonitorFile:DataType:ListOfFiles,Comma-separated"
 
      
-What the man pages denotes as a simple <config>
-keyword, does in reality consist of 8 colon-separated fields. The
-last field may take multiple (in some, very insane, cases, even
-20 different additional files. This might sound confusing at first.
-Note, that what the man pages names the "LongPrinterName" in
-reality should rather be called the "Driver Name". You can name it
+What the man pages denote as a simple <config>
+keyword, in reality consists of eight colon-separated fields. The
+last field may take multiple (in some very insane cases, even
+20 different additional) files. This might sound confusing at first.
+What the man pages names the “LongPrinterName” in
+reality should be called the “Driver Name”. You can name it
 anything you want, as long as you use this name later in the
-rpcclient ... setdriver command. For
+rpcclient ... setdriver command. For
 practical reasons, many name the driver the same as the
 printer.
 
      
-True: it isn't simple at all. I hear you asking:
-How do I know which files are "Driver
-File", "Data File", "Config File", "Help File" and "Language
-Monitor File" in each case? -- For an answer you may
+It isn't simple at all. I hear you asking:
+“How do I know which files are "Driver
+File”, “Data File”, “Config File”, “Help File” and “Language
+Monitor File" in each case?”  For an answer, you may
 want to have a look at how a Windows NT box with a shared printer
 presents the files to us. Remember, that this whole procedure has
-to be developed by the Samba Team by overhearing the traffic caused
+to be developed by the Samba team by overhearing the traffic caused
 by Windows computers on the wire. We may as well turn to a Windows
-box now, and access it from a UNIX workstation. We will query it
+box now and access it from a UNIX workstation. We will query it
 with rpcclient to see what it tells us and
-try to understand the man page more clearly which we've read just
+try to understand the man page more clearly that we've read just
 now.
-

      Producing an Example by querying a Windows Box

      - - +

      Producing an Example by Querying a Windows Box

      + + We could run rpcclient with a getdriver or a getprinter -subcommand (in level 3 verbosity) against it. Just sit down at UNIX or -Linux workstation with the Samba utilities installed. Then type the +subcommand (in level 3 verbosity) against it. Just sit down at a UNIX or +Linux workstation with the Samba utilities installed, then type the following command: 

      -root# rpcclient -U'USERNAME%PASSWORD' NT-SERVER-NAME -c 'getdriver printername 3'
+root# rpcclient -U'user%secret' NT-SERVER -c 'getdriver printername 3'

      -From the result it should become clear which is which. Here is an -example from my installation: -

      -root# rpcclient -U'Danka%xxxx' W2KSERVER \
+From the result it should become clear which is which. Here is an example from my installation:
+
      
+
+	
      +root# rpcclient -U'Danka%xxxx' W200xSERVER \
 	-c'getdriver "DANKA InfoStream Virtual Printer" 3'
  cmd = getdriver "DANKA InfoStream Virtual Printer" 3
 
@@ -9891,77 +10011,82 @@ example from my installation:
 
 
      
 Some printer drivers list additional files under the label
-"Dependentfiles": these would go into the last field
-ListOfFiles,Comma-separated. For the CUPS
-PostScript drivers we don't need any (nor would we for the Adobe
-PostScript driver): therefore the field will get a "NULL" entry.
-

      What is required for adddriver and setdriver to succeed

      -From the manpage (and from the quoted output -of cupsaddsmb, above) it becomes clear that you +Dependentfiles and these would go into the last field +ListOfFiles,Comma-separated. For the CUPS +PostScript drivers, we do not need any (nor would we for the Adobe +PostScript driver), therefore, the field will get a “NULL” entry. +

      Requirements for adddriver and setdriver to Succeed

      +>From the man page (and from the quoted output +of cupsaddsmb above) it becomes clear that you need to have certain conditions in order to make the manual uploading -and initializing of the driver files succeed. The two rpcclient - +and initializing of the driver files succeed. The two rpcclient + subcommands (adddriver and setdriver) need to encounter the following -pre-conditions to complete successfully: -

      • you are connected as printer admin, or root (note, -that this is not the "Printer Operators" group in -NT, but the printer admin group, as defined in +preconditions to complete successfully: +

        • You are connected as printer admin or root (this is not the “Printer Operators” group in +NT, but the printer admin group as defined in the [global] section of -smb.conf);

        • copy all required driver files to -\\sambaserver\print$\w32x86 and -\\sambaserver\print$\win40 as appropriate. They -will end up in the "0" respective "2" subdirectories later -- for now -don't put them there, they'll be automatically -used by the adddriver subcommand.! (if you use -"smbclient" to put the driver files into the share, note that you need -to escape the "$": smbclient //sambaserver/print\$ -U -root);

        • the user you're connecting as must be able to write to +smb.conf).

        • Copy all required driver files to +\\SAMBA\print$\w32x86 and +\\SAMBA\print$\win40 as appropriate. They +will end up in the “0” respective “2” subdirectories later. For now, +do not put them there, they'll be automatically +used by the adddriver subcommand. (If you use +smbclient to put the driver files into the share, note that you need +to escape the “$”: smbclient //sambaserver/print\$ -U +root.)

        • The user you're connecting as must be able to write to the [print$] share and create -subdirectories;

        • the printer you are going to setup for the Windows -clients, needs to be installed in CUPS already;

        • - - - the CUPS printer must be known to Samba, otherwise the +subdirectories.

        • The printer you are going to setup for the Windows +clients needs to be installed in CUPS already.

        • + + + The CUPS printer must be known to Samba, otherwise the setdriver subcommand fails with an NT_STATUS_UNSUCCESSFUL error. To check if the printer is known by -Samba you may use the enumprinters subcommand to -rpcclient. A long-standing bug prevented a proper update of the +Samba, you may use the enumprinters subcommand to +rpcclient. A long-standing bug prevented a proper update of the printer list until every smbd process had received a SIGHUP or was restarted. Remember this in case you've created the CUPS printer just -shortly ago and encounter problems: try restarting -Samba.

      Manual Driver Installation in 15 Steps

      +recently and encounter problems: try restarting +Samba.

    Manual Driver Installation in 15 Steps

    We are going to install a printer driver now by manually executing all required commands. As this may seem a rather complicated process at first, we go through the procedure step by step, explaining every single action item as it comes up. -

    Procedure 19.1. Manual Driver Installation installation

    1. Install the Printer on CUPS

      -root# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P canonIR85.ppd
+
      Procedure 19.1. Manual Driver Installation
      1. Install the printer on CUPS.
        +root# lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E \
+			-P canonIR85.ppd
 
        
-This installs printer with the name mysmbtstprn
+This installs a printer with the name mysmbtstprn
 to the CUPS system. The printer is accessed via a socket
 (a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root
-for this step
-
      2. (optional) Check if the Printer is recognized by
-Samba
        -root# rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn
+for this step.
+
      3. (Optional) Check if the printer is recognized by Samba.
        
+
+
        +	root# rpcclient -Uroot%xxxx -c 'enumprinters' localhost \
+  | grep -C2 mysmbtstprn
 flags:[0x800000]
 name:[\\kde-bitshop\mysmbtstprn]
 description:[\\kde-bitshop\mysmbtstprn,,mysmbtstprn]
 comment:[mysmbtstprn]
 
        
-This should show the printer in the list. If not, stop and re-start
-the Samba daemon (smbd), or send a HUP signal: kill -HUP
-`pidof smbd`. Check again.  Troubleshoot and repeat until
-success. Note the "empty" field between the two commas in the
-"description" line. Here would the driver name appear if there was one
-already. You need to know root's Samba password (as set by the
+This should show the printer in the list. If not, stop and restart
+the Samba daemon (smbd), or send a HUP signal: 
+
        +root# kill -HUP `pidof smbd`
+
        Check again. Troubleshoot and repeat until
+successful. Note the “empty” field between the two commas in the
+“description” line. The driver name would appear here if there was one already. You need to know root's Samba password (as set by the
 smbpasswd command) for this step and most of the
-following steps. Alternatively you can authenticate as one of the
-users from the "write list" as defined in smb.conf for
+following steps. Alternately, you can authenticate as one of the
+users from the “write list” as defined in smb.conf for
 [print$].
-
      4. (optional) Check if Samba knows a Driver for the
-Printer
        +
      5. (Optional) Check if Samba knows a driver for the printer.
        
+	
+	
+	
         root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
 			| grep driver 
 drivername:[]
@@ -9982,13 +10107,13 @@ printprocessor:[winprint]
  result was WERR_UNKNOWN_PRINTER_DRIVER
 
 
        
-Neither method of the three commands shown above should show a driver.
+None of the three commands shown above should show a driver.
 This step was done for the purpose of demonstrating this condition. An
 attempt to connect to the printer at this stage will prompt the
-message along the lines: "The server has not the required printer
-driver installed".
-
      6. Put all required Driver Files into Samba's
-[print$]
        +message along the lines of: “The server does not have the required printer
+driver installed.”
+
      7. Put all required driver files into Samba's
+[print$].
         root# smbclient //localhost/print\$ -U 'root%xxxx' \
 	-c 'cd W32X86; \
 	put /etc/cups/ppd/mysmbtstprn.ppd mysmbtstprn.PPD; \ 
@@ -9996,15 +10121,15 @@ driver installed".
 	put /usr/share/cups/drivers/cupsdrvr.dll cupsdrvr.dll; \
 	put /usr/share/cups/drivers/cups.hlp cups.hlp'
 
        
-(Note that this command should be entered in one long single
-line. Line-breaks and the line-end indicating "\" has been inserted
+(This command should be entered in one long single
+line. Line-breaks and the line-end indicated by “\” have been inserted
 for readability reasons.) This step is required
 for the next one to succeed. It makes the driver files physically
 present in the [print$] share. However, clients
 would still not be able to install them, because Samba does not yet
 treat them as driver files. A client asking for the driver would still
-be presented with a "not installed here" message.
-
      8. Verify where the Driver Files are now
        +be presented with a “not installed here” message.
+
      9. Verify where the driver files are now.
         root# ls -l /etc/samba/drivers/W32X86/
 total 669
 drwxr-sr-x    2 root     ntadmin       532 May 25 23:08 2
@@ -10014,27 +10139,27 @@ drwxr-sr-x    2 root     ntadmin       670 May 16 03:15 3
 -rwxr--r--    1 root     ntadmin    215848 May 25 23:21 cupsui.dll
 -rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
 
        
-The driver files now are in the W32X86 architecture "root" of
+The driver files now are in the W32X86 architecture “root” of
 [print$].
-
      10. Tell Samba that these are
-Driver Files
-(adddriver)
        -root# rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" "mydrivername: \
-  cupsdrvr.dll:mysmbtstprn.PPD: \
+
      11. Tell Samba that these are driver files (adddriver).
        
+
+
        +root# rpcclient -Uroot%xxxx -c `adddriver "Windows NT x86" \
+	"mydrivername:cupsdrvr.dll:mysmbtstprn.PPD: \
   cupsui.dll:cups.hlp:NULL:RAW:NULL" \
   localhost
 Printer Driver mydrivername successfully installed.
 
        
-Note that your cannot repeat this step if it fails. It could fail even
+You cannot repeat this step if it fails. It could fail even
 as a result of a simple typo. It will most likely have moved a part of
-the driver files into the "2" subdirectory. If this step fails, you
-need to go back to the fourth step and repeat it, before you can try
-this one again. In this step you need to choose a name for your
+the driver files into the “2” subdirectory. If this step fails, you
+need to go back to the fourth step and repeat it before you can try
+this one again. In this step, you need to choose a name for your
 driver. It is normally a good idea to use the same name as is used for
-the printername; however, in big installations you may use this driver
-for a number of printers which have obviously different names. So the
+the printer name; however, in big installations you may use this driver
+for a number of printers that obviously have different names, so the
 name of the driver is not fixed.
-
      12. Verify where the Driver Files are now
        +
      13. Verify where the driver files are now.
         root# ls -l /etc/samba/drivers/W32X86/
 total 1
 drwxr-sr-x    2 root     ntadmin       532 May 25 23:22 2
@@ -10048,12 +10173,13 @@ total 5039
 -rwxr--r--    1 root     ntadmin    215848 May 13 13:53 cupsui.dll
 -rwxr--r--    1 root     ntadmin    169458 May 25 23:21 mysmbtstprn.PPD
 
        
-Notice how step 6 did also move the driver files to the appropriate
-subdirectory. Compare with the situation after step 5.
-
      14. (optional) Verify if Samba now recognizes the
-Driver
        -root# rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost \
-	| grep -B2 -A5 mydrivername
+Notice how step 6 also moved the driver files to the appropriate
+subdirectory. Compare this with the situation after step 5.
+
      15. (Optional) Verify if Samba now recognizes the driver.
        
+
+
        +root# rpcclient -Uroot%xxxx -c 'enumdrivers 3' \
+	localhost | grep -B2 -A5 mydrivername
 Printer Driver Info 3:
 Version: [2]
 Driver Name: [mydrivername]
@@ -10063,21 +10189,26 @@ Datafile: [\\kde-bitshop\print$\W32X86\2\mysmbtstprn.PPD]
 Configfile: [\\kde-bitshop\print$\W32X86\2\cupsui.dll]
 Helpfile: [\\kde-bitshop\print$\W32X86\2\cups.hlp]
 
        
-Remember, this command greps for the name you did choose for the
-driver in step Six. This command must succeed before you can proceed.
-
      16. Tell Samba which Printer should use these Driver
-Files (setdriver)
        -root# rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost
+Remember, this command greps for the name you chose for the
+driver in step 6. This command must succeed before you can proceed.
+
      17. Tell Samba which printer should use these driver files (setdriver).
        
+
+
        +root# rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' \
+	localhost
 Successfully set mysmbtstprn to driver mydrivername
 
        
-Since you can bind any printername (=printqueue) to any driver, this
-is a very convenient way to setup many queues which use the same
-driver. You don't need to repeat all the previous steps for the
-setdriver command to succeed. The only pre-conditions are:
+Since you can bind any printername (print queue) to any driver, this
+is a convenient way to setup many queues that use the same
+driver. You do not need to repeat all the previous steps for the
+setdriver command to succeed. The only preconditions are:
 enumdrivers must find the driver and
 enumprinters must find the printer.
-
      18. (optional) Verify if Samba has this Association
-recognized
        +
      19. (Optional) Verify if Samba has recognized this association.
        
+
+
+
+
         root# rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost \
   | grep driver
 drivername:[mydrivername]
@@ -10109,169 +10240,174 @@ Printer Driver Info 3:
      Monitorname: []
      Defaultdatatype: [RAW]
  
-root# rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep mysmbtstprn
+root# rpcclient -Uroot%xxxx -c 'enumprinters' localhost \
+	| grep mysmbtstprn
      name:[\\kde-bitshop\mysmbtstprn]
      description:[\\kde-bitshop\mysmbtstprn,mydrivername,mysmbtstprn]
      comment:[mysmbtstprn]
 
 
        
-
-Compare these results with the ones from steps 2 and 3. Note that
-every single of these commands show the driver is installed.  Even
+
+Compare these results with the ones from steps 2 and 3. Every one of these commands show the driver is installed. Even
 the enumprinters command now lists the driver
-on the "description" line.
-
      20. (optional) Tickle the Driver into a correct
-Device Mode
        
-
-You certainly know how to install the driver on the client.  In case
+on the “description” line.
+
      21. (Optional) Tickle the driver into a correct
+device mode.
        
+
+You certainly know how to install the driver on the client. In case
 you are not particularly familiar with Windows, here is a short
-recipe: browse the Network Neighbourhood, go to the Samba server, look
+recipe: Browse the Network Neighborhood, go to the Samba server, and look
 for the shares. You should see all shared Samba printers.
 Double-click on the one in question. The driver should get
-installed, and the network connection set up. An alternative way is to
-open the "Printers (and Faxes)" folder, right-click on the printer in
-question and select "Connect" or "Install". As a result, a new printer
-should have appeared in your client's local "Printers (and Faxes)"
-folder, named something like "printersharename on Sambahostname".
+installed and the network connection set up. An alternate way is to
+open the Printers (and Faxes) folder, right-click on the printer in
+question and select Connect or Install. As a result, a new printer
+should have appeared in your client's local Printers (and Faxes)
+folder, named something like printersharename on Sambahostname.
 
        
 It is important that you execute this step as a Samba printer admin
 (as defined in smb.conf). Here is another method
-to do this on Windows XP. It uses a commandline, which you may type
-into the "DOS box" (type root's smbpassword when prompted):
+to do this on Windows XP. It uses a command line, which you may type
+into the “DOS box” (type root's smbpassword when prompted):
 
        -C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /in /n\
-			\\sambacupsserver\mysmbtstprn"
+C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry \
+	/in /n \\sambaserver\mysmbtstprn"
 
        
-Change any printer setting once (like changing "portrait" to
-	"landscape"), click Apply; change the setting
+Change any printer setting once (like changing portrait to
+	landscape), click on Apply; change the setting
 back.
-
      22. Install the Printer on a Client
-("Point'n'Print")
        -C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn"
+
      23. Install the printer on a client
+(Point'n'Print).
        
+
+	
        +C:\> rundll32 printui.dll,PrintUIEntry /in /n “\\sambaserver\mysmbtstprn”
 
        
-If it doesn't work it could be a permission problem with the
+If it does not work it could be a permission problem with the
 [print$] share.
-
      24. Thirteenth Step (optional): Print a Test Page
        -C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn"
+
      25. (Optional) Print a test page.
        +C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambaserver\mysmbtstprn"
 
        
-Then hit [TAB] 5 times, [ENTER] twice, [TAB] once and [ENTER] again
+Then hit [TAB] five times, [ENTER] twice, [TAB] once and [ENTER] again
 and march to the printer.
-
      26. Fourteenth Step (recommended): Study the Test Page
        
+
      27. (Recommended) Study the test page.
        
 Hmmm.... just kidding! By now you know everything about printer
-installations and you don't need to read a word. Just put it in a
+installations and you do not need to read a word. Just put it in a
 frame and bolt it to the wall with the heading "MY FIRST
-RPCCLIENT-INSTALLED PRINTER" - why not just throw it away!
-
      28. Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your
-Success
        +RPCCLIENT-INSTALLED PRINTER"  why not just throw it away!
+
      29. (Obligatory) Enjoy. Jump. Celebrate your
+success.
         root# echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd
-

    Troubleshooting revisited

    +

    Troubleshooting Revisited

    The setdriver command will fail, if in Samba's mind the queue is not already there. You had promising messages about the: 

    -
  Printer Driver ABC successfully installed.
-

    -after the "adddriver" parts of the procedure? But you are also seeing -a disappointing message like this one beneath? -

    -
+after the adddriver parts of the procedure?  But you are also seeing
+a disappointing message like this one?
+
    
  result was NT_STATUS_UNSUCCESSFUL
-
-

    - +

    + It is not good enough that you -can see the queue in CUPS, using +can see the queue in CUPS, using the lpstat -p ir85wm command. A bug in most recent versions of Samba prevents the proper update of the queuelist. The recognition of newly installed CUPS printers -fails unless you re-start Samba or send a HUP to all smbd -processes. To verify if this is the reason why Samba doesn't -execute the setdriver command successfully, check if Samba "sees" +fails unless you restart Samba or send a HUP to all smbd +processes. To verify if this is the reason why Samba does not +execute the setdriver command successfully, check if Samba “sees” the printer: -

    -root# rpcclient transmeta -N -U'root%secret' -c 'enumprinters 0'| grep  ir85wm
+
    
+
+	
    +root# rpcclient transmeta -N -U'root%xxxx' -c 'enumprinters 0'|grep ir85wm
         printername:[ir85wm]
 
    
-An alternative command could be this: 
-
    +An alternate command could be this: 
+
    
+
+	
     root# rpcclient transmeta -N -U'root%secret' -c 'getprinter ir85wm' 
         cmd = getprinter ir85wm
         flags:[0x800000]
         name:[\\transmeta\ir85wm]
         description:[\\transmeta\ir85wm,ir85wm,DPD]
-        comment:[CUPS PostScript-Treiber for WinNT/2K/XP]
+        comment:[CUPS PostScript-Treiber for Windows NT/200x/XP]
 
    
-BTW, you can use these commands, plus a few more, of course,
+By the way, you can use these commands, plus a few more, of course,
 to install drivers on remote Windows NT print servers too!
-

    The printing *.tdb Files

    - - - - - - - - - - - - - +

    The Printing *.tdb Files

    + + + + + + + + + + + + + Some mystery is associated with the series of files with a -tdb-suffix appearing in every Samba installation. They are +tdb suffix appearing in every Samba installation. They are connections.tdb, printing.tdb, -share_info.tdb , +share_info.tdb, ntdrivers.tdb, unexpected.tdb, -brlock.tdb , +brlock.tdb, locking.tdb, ntforms.tdb, messages.tdb , ntprinters.tdb, sessionid.tdb and secrets.tdb. What is their purpose? -

    Trivial DataBase Files

    -A Windows NT (Print) Server keeps track of all information needed to serve +

    Trivial Database Files

    + +A Windows NT (print) server keeps track of all information needed to serve its duty toward its clients by storing entries in the Windows -"Registry". Client queries are answered by reading from the registry, -Administrator or user configuration settings are saved by writing into -the Registry. Samba and UNIX obviously don't have such a kind of +registry. Client queries are answered by reading from the registry, +Administrator or user configuration settings that are saved by writing into +the registry. Samba and UNIX obviously do not have such a Registry. Samba instead keeps track of all client related information in a series of *.tdb files. (TDB = Trivial Data Base). These are often located in /var/lib/samba/ -or /var/lock/samba/ . The printing related files +or /var/lock/samba/. The printing related files are ntprinters.tdb, printing.tdb,ntforms.tdb and ntdrivers.tdb. -

    Binary Format

    +

    Binary Format

    *.tdb files are not human readable. They are -written in a binary format. "Why not ASCII?", you may ask. "After all, -ASCII configuration files are a good and proofed tradition on UNIX." --- The reason for this design decision by the Samba Team is mainly +written in a binary format. “Why not ASCII?”, you may ask. “After all, +ASCII configuration files are a good and proven tradition on UNIX.” +The reason for this design decision by the Samba team is mainly performance. Samba needs to be fast; it runs a separate smbd process for each client connection, in some -environments many thousand of them. Some of these smbds might need to +environments many thousands of them. Some of these smbds might need to write-access the same *.tdb file at the same time. The file format of Samba's *.tdb files allows for this provision. Many smbd processes may write to the same *.tdb file at the same time. This wouldn't be possible with pure ASCII files. -

    Losing *.tdb Files

    +

    Losing *.tdb Files

    It is very important that all *.tdb files remain consistent over all write and read accesses. However, it may happen that these files do get corrupted. (A -kill -9 `pidof smbd` while a write access is in +kill -9 `pidof smbd' while a write access is in progress could do the damage as well as a power interruption, etc.). In cases of trouble, a deletion of the old printing-related -*.tdb files may be the only option. You need to -re-create all print related setup after that. Or you have made a +*.tdb files may be the only option. After that you need to +re-create all print-related setup or you have made a backup of the *.tdb files in time. -

    Using tdbbackup

    -Samba ships with a little utility which helps the root user of your -system to back up your *.tdb files. If you run it -with no argument, it prints a little usage message: +

    Using tdbbackup

    + + +Samba ships with a little utility that helps the root user of your +system to backup your *.tdb files. If you run it +with no argument, it prints a usage message: 

     root# tdbbackup
  Usage: tdbbackup [options] <fname...>
@@ -10282,12 +10418,12 @@ with no argument, it prints a little usage message:
    -v            verify mode (restore if corrupt)

    -Here is how I backed up my printing.tdb file: +Here is how I backed up my printing.tdb file: 

     root# ls
-.              browse.dat       locking.tdb     ntdrivers.tdb   printing.tdb
-..             share_info.tdb   connections.tdb messages.tdb    ntforms.tdb
-printing.tdbkp unexpected.tdb   brlock.tdb      gmon.out        namelist.debug  
+.              browse.dat     locking.tdb     ntdrivers.tdb printing.tdb
+..             share_info.tdb connections.tdb messages.tdb  ntforms.tdb
+printing.tdbkp unexpected.tdb brlock.tdb      gmon.out      namelist.debug  
 ntprinters.tdb sessionid.tdb
  
 root# tdbbackup -s .bak printing.tdb
@@ -10297,956 +10433,961 @@ ntprinters.tdb sessionid.tdb
  -rw-------    1 root     root        40960 May  2 03:44 printing.tdb
  -rw-------    1 root     root        40960 May  2 03:44 printing.tdb.bak
 
-

    CUPS Print Drivers from Linuxprinting.org

    -CUPS ships with good support for HP LaserJet type printers. You can +

    CUPS Print Drivers from Linuxprinting.org

    + +CUPS ships with good support for HP LaserJet-type printers. You can install the generic driver as follows: -

    +
    
+
+	
     root# lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -m laserjet.ppd
 
    
 The -m switch will retrieve the
 laserjet.ppd from the standard repository for
 not-yet-installed-PPDs, which CUPS typically stores in
-/usr/share/cups/model. Alternatively, you may use
+/usr/share/cups/model. Alternately, you may use
 -P /path/to/your.ppd.
 
    
-The generic laserjet.ppd however does not support every special option
-for every LaserJet-compatible model. It constitutes a sort of "least
-denominator" of all the models. If for some reason it is ruled out to
-you to pay for the commercially available ESP Print Pro drivers, your
-first move should be to consult the database on http://www.linuxprinting.org/printer_list.cgi.
+The generic laserjet.ppd, however, does not support every special option
+for every LaserJet-compatible model. It constitutes a sort of “least common
+denominator” of all the models. If for some reason
+you must pay for the commercially available ESP Print Pro drivers, your
+first move should be to consult the database on http://www.linuxprinting.org/printer_list.cgi.
 Linuxprinting.org has excellent recommendations about which driver is
 best used for each printer. Its database is kept current by the
 tireless work of Till Kamppeter from MandrakeSoft, who is also the
-principal author of the foomatic-rip utility.
+principal author of the foomatic-rip utility.
 
    Note
    
-
-The former "cupsomatic" concept is now be replaced by the new, much
-more powerful "foomatic-rip". foomatic-rip is the successor of
-cupsomatic. cupsomatic is no longer maintained. Here is the new URL
-to the Foomatic-3.0 database:http://www.linuxprinting.org/driver_list.cgi.
-If you upgrade to foomatic-rip, don't forget to also upgrade to the
-new-style PPDs for your foomatic-driven printers. foomatic-rip will
-not work with PPDs generated for the old cupsomatic. The new-style
+
+The former cupsomatic concept is now being replaced by the new
+successor, a much
+more powerful foomatic-rip.
+cupsomatic is no longer maintained. Here is the new URL
+to the Foomatic-3.0 database: http://www.linuxprinting.org/driver_list.cgi.
+If you upgrade to foomatic-rip, remember to also upgrade to the
+new-style PPDs for your Foomatic-driven printers. foomatic-rip will
+not work with PPDs generated for the old cupsomatic. The new-style
 PPDs are 100% compliant to the Adobe PPD specification. They are
-intended to be used by Samba and the cupsaddsmb utility also, to
-provide the driver files for the Windows clients also!
-
    foomatic-rip and Foomatic explained
    
-Nowadays most Linux distros rely on the utilities of Linuxprinting.org
-to create their printing related software (which, BTW, works on all
-UNIXes and on Mac OS X or Darwin too). It is not known as well as it
-should be, that it also has a very end-user friendly interface which
-allows for an easy update of drivers and PPDs, for all supported
-models, all spoolers, all operating systems and all package formats
+also intended to be used by Samba and the cupsaddsmb utility, to
+provide the driver files for the Windows clients!
+
    foomatic-rip and Foomatic Explained
    
+
+
+Nowadays, most Linux distributions rely on the utilities of Linuxprinting.org
+to create their printing-related software (which, by the way, works on all
+UNIXes and on Mac OS X or Darwin, too). It is not known as well as it
+should be, that it also has a very end-user-friendly interface that
+allows for an easy update of drivers and PPDs for all supported
+models, all spoolers, all operating systems, and all package formats
 (because there is none). Its history goes back a few years.
 
    
-Recently Foomatic has achieved the astonishing milestone of 1000
-listed printer models. Linuxprinting.org keeps all the
+Recently, Foomatic has achieved the astonishing milestone of 1000
+listed printer models. Linuxprinting.org keeps all the
 important facts about printer drivers, supported models and which
 options are available for the various driver/printer combinations in
-its Foomatic
-database. Currently there are 245 drivers
-in the database: many drivers support various models, and many models
-may be driven by different drivers; it's your choice!
-
    690 "perfect" Printers
    
-At present there are 690 devices dubbed as working "perfectly", 181
-"mostly", 96 "partially" and 46 are "Paperweights". Keeping in mind
+its Foomatic
+database. Currently there are 245 drivers
+in the database. Many drivers support various models, and many models
+may be driven by different drivers  its your choice!
+
    690 “Perfect” Printers
    
+At present, there are 690 devices dubbed as working perfectly, 181
+mostly, 96 partially, and 46 are paperweights. Keeping in mind
 that most of these are non-PostScript models (PostScript printers are
-automatically supported supported by CUPS to perfection, by using
-their own manufacturer-provided Windows-PPD...), and that a
-multifunctional device never qualifies as working "perfectly" if it
-doesn't also scan and copy and fax under GNU/Linux: then this is a
-truly astonishing achievement. Three years ago the number was not
-more than 500, and Linux or UNIX "printing" at the time wasn't
-anywhere near the quality it is today!
-
    How the "Printing HOWTO" started it all
    
-A few years ago Grant Taylor
+automatically supported by CUPS to perfection, by using
+their own manufacturer-provided Windows-PPD), and that a
+multifunctional device never qualifies as working perfectly if it
+does not also scan and copy and fax under GNU/Linux  then this is a
+truly astonishing achievement! Three years ago the number was not
+more than 500, and Linux or UNIX printing at the time wasn't
+anywhere near the quality it is today.
+
    How the Printing HOWTO Started It All
    
+A few years ago Grant Taylor
 started it all. The roots of today's Linuxprinting.org are in the
-first Linux Printing
-HOWTO which he authored. As a side-project to this document,
+first Linux Printing
+HOWTO that he authored. As a side-project to this document,
 which served many Linux users and admins to guide their first steps in
 this complicated and delicate setup (to a scientist, printing is
-"applying a structured deposition of distinct patterns of ink or toner
-particles on paper substrates" ;-), he started to
+“applying a structured deposition of distinct patterns of ink or toner
+particles on paper substrates”, he started to
 build in a little Postgres database with information about the
 hardware and driver zoo that made up Linux printing of the time. This
 database became the core component of today's Foomatic collection of
-tools and data. In the meantime it has moved to an XML representation
+tools and data. In the meantime, it has moved to an XML representation
 of the data.
-
    Foomatic's strange Name
    
-"Why the funny name?", you ask. When it really took off, around spring
+
    Foomatic's Strange Name
    
+
+“Why the funny name?” you ask. When it really took off, around spring
 2000, CUPS was far less popular than today, and most systems used LPD,
-LPRng or even PDQ to print. CUPS shipped with a few generic "drivers"
+LPRng or even PDQ to print. CUPS shipped with a few generic drivers
 (good for a few hundred different printer models). These didn't
 support many device-specific options. CUPS also shipped with its own
-built-in rasterization filter ("pstoraster", derived from
+built-in rasterization filter (pstoraster, derived from
 Ghostscript). On the other hand, CUPS provided brilliant support for
 controlling all printer options through
-standardized and well-defined "PPD files" (PostScript Printers
+standardized and well-defined PPD files (PostScript Printers
 Description files). Plus, CUPS was designed to be easily extensible.
 
    
-Grant already had in his database a respectable compilation
-of facts about a many more printers, and the Ghostscript "drivers"
-they run with. His idea, to generate PPDs from the database info
+Taylor already had in his database a respectable compilation
+of facts about many more printers and the Ghostscript “drivers”
+they run with. His idea, to generate PPDs from the database information
 and use them to make standard Ghostscript filters work within CUPS,
-proved to work very well. It also "killed several birds with one
-stone":
+proved to work very well. It also killed several birds with one
+stone:
 
    • It made all current and future Ghostscript filter
-developments available for CUPS;
    • It made available a lot of additional printer models
-to CUPS users (because often the "traditional" Ghostscript way of
-printing was the only one available);
    • It gave all the advanced CUPS options (web interface,
+developments available for CUPS.
    • It made available a lot of additional printer models
+to CUPS users (because often the traditional Ghostscript way of
+printing was the only one available).
    • It gave all the advanced CUPS options (Web interface,
 GUI driver configurations) to users wanting (or needing) to use
-Ghostscript filters.
    cupsomatic, pdqomatic, lpdomatic, directomatic
    
-CUPS worked through a quickly-hacked up filter script named cupsomatic.
+Ghostscript filters.
    cupsomatic, pdqomatic, lpdomatic, directomatic
    
+
+
+
+CUPS worked through a quickly-hacked up filter script named cupsomatic.
 cupsomatic ran the printfile through Ghostscript, constructing
 automatically the rather complicated command line needed. It just
-required to be copied into the CUPS system to make it work. To
-"configure" the way cupsomatic controls the Ghostscript rendering
+needed to be copied into the CUPS system to make it work. To
+configure the way cupsomatic controls the Ghostscript rendering
 process, it needs a CUPS-PPD. This PPD is generated directly from the
 contents of the database. For CUPS and the respective printer/filter
-combo another Perl script named "CUPS-O-Matic" did the PPD
-generation. After that was working, Grant implemented within a few
+combo, another Perl script named CUPS-O-Matic did the PPD
+generation. After that was working, Taylor implemented within a few
 days a similar thing for two other spoolers. Names chosen for the
-config-generator scripts were PDQ-O-Matic
-(for PDQ) and LPD-O-Matic
-(for - you guessed it - LPD); the configuration here didn't use PPDs
+config-generator scripts were PDQ-O-Matic
+(for PDQ) and LPD-O-Matic
+(for  you guessed it  LPD); the configuration here didn't use PPDs
 but other spooler-specific files.
 
    
-From late summer of that year, Till Kamppeter
-started to put work into the database. Till had been newly employed by
-MandrakeSoft to
-convert their printing system over to CUPS, after they had seen his
-FLTK-based XPP (a GUI frontend to
+From late summer of that year, Till Kamppeter
+started to put work into the database. Kamppeter had been newly employed by
+MandrakeSoft to
+convert its printing system over to CUPS, after they had seen his
+FLTK-based XPP (a GUI frontend to
 the CUPS lp-command). He added a huge amount of new information and new
 printers. He also developed the support for other spoolers, like
-PPR (via ppromatic),
-GNUlpr and
-LPRng (both via an extended
-lpdomatic) and "spoolerless" printing (directomatic)....
-
    
-So, to answer your question: "Foomatic" is the general name for all
-the overlapping code and data behind the "*omatic" scripts.... --
-Foomatic up to versions 2.0.x required (ugly) Perl data structures
-attached the Linuxprinting.org PPDs for CUPS. It had a different
-"*omatic" script for every spooler, as well as different printer
-configuration files..
-
    The Grand Unification
-achieved...
    
-This all has changed in Foomatic versions 2.9 (Beta) and released as
-"stable" 3.0. This has now achieved the convergence of all *omatic
-scripts: it is called the foomatic-rip.
+PPR (via ppromatic),
+GNUlpr and
+LPRng (both via an extended
+lpdomatic) and spoolerless printing (directomatic).
+
    
+So, to answer your question: “Foomatic” is the general name for all
+the overlapping code and data behind the “*omatic” scripts.
+Foomatic, up to versions 2.0.x, required (ugly) Perl data structures
+attached to Linuxprinting.org PPDs for CUPS. It had a different
+“*omatic” script for every spooler, as well as different printer
+configuration files.
+
    The Grand Unification Achieved
    
+
+This has all changed in Foomatic versions 2.9 (beta) and released as
+“stable” 3.0. It has now achieved the convergence of all *omatic
+scripts and is called the foomatic-rip.
 This single script is the unification of the previously different
 spooler-specific *omatic scripts. foomatic-rip is used by all the
-different spoolers alike. Because foomatic-rip can read PPDs (both the
+different spoolers alike and because it can read PPDs (both the
 original PostScript printer PPDs and the Linuxprinting.org-generated
 ones), all of a sudden all supported spoolers can have the power of
-PPDs at their disposal; users only need to plug "foomatic-rip" into
-their system.... For users there is improved media type and source
-support; paper sizes and trays are easier to configure.
+PPDs at their disposal. Users only need to plug foomatic-rip into
+their system. For users there is improved media type and source
+support  paper sizes and trays are easier to configure.
 
    
-Also, the New Generation of Linuxprinting.org PPDs doesn't contain
-Perl data structures any more. If you are a distro maintainer and have
+Also, the New Generation of Linuxprinting.org PPDs no longer contains
+Perl data structures. If you are a distro maintainer and have
 used the previous version of Foomatic, you may want to give the new
-one a spin: but don't forget to generate a new-version set of PPDs,
-via the new foomatic-db-engine!
+one a spin, but remember to generate a new-version set of PPDs
+via the new foomatic-db-engine!
 Individual users just need to generate a single new PPD specific to
-their model by following
-the steps outlined in the Foomatic tutorial or further
-below. This new development is truly amazing.
+their model by following
+the steps outlined in the Foomatic tutorial or in this chapter. This new development is truly amazing.
 
    
 foomatic-rip is a very clever wrapper around the need to run
-Ghostscript with a different syntax, different options, different
-device selections and/or different filters for each different printer
-or different spooler. At the same time it can read the PPD associated
+Ghostscript with a different syntax, options, device selections, and/or filters for each different printer
+or spooler. At the same time it can read the PPD associated
 with a print queue and modify the print job according to the user
 selections. Together with this comes the 100% compliance of the new
-Foomatic PPDs with the Adobe spec. Some really innovative features of
-the Foomatic concept will surprise users: it will support custom paper
-sizes for many printers; and it will support printing on media drawn
-from different paper trays within the same job (in both cases: even
+Foomatic PPDs with the Adobe spec. Some innovative features of
+the Foomatic concept may surprise users. It will support custom paper
+sizes for many printers and will support printing on media drawn
+from different paper trays within the same job (in both cases, even
 where there is no support for this from Windows-based vendor printer
 drivers).
-
    Driver Development outside
    
+
    Driver Development Outside
    
 Most driver development itself does not happen within
 Linuxprinting.org. Drivers are written by independent maintainers.
-Linuxprinting.org just pools all the information, and stores it in its
+Linuxprinting.org just pools all the information and stores it in its
 database. In addition, it also provides the Foomatic glue to integrate
 the many drivers into any modern (or legacy) printing system known to
 the world.
 
    
-Speaking of the different driver development groups: most of
+Speaking of the different driver development groups, most of
 the work is currently done in three projects. These are:
-
    • Omni
--- a Free Software project by IBM which tries to convert their printer
+
      • Omni
+ a free software project by IBM that tries to convert their printer
 driver knowledge from good-ol' OS/2 times into a modern, modular,
-universal driver architecture for Linux/UNIX (still Beta).  This
-currently supports 437 models.
      • HPIJS --
-a Free Software project by HP to provide the support for their own
+universal driver architecture for Linux/UNIX (still beta). This
+currently supports 437 models.
      • HPIJS 
+a free software project by HP to provide the support for their own
 range of models (very mature, printing in most cases is perfect and
 provides true photo quality). This currently supports 369
-models.
      • Gimp-Print -- a Free software
+models.
      • Gimp-Print  a free software
 effort, started by Michael Sweet (also lead developer for CUPS), now
 directed by Robert Krawitz, which has achieved an amazing level of
 photo print quality (many Epson users swear that its quality is
 better than the vendor drivers provided by Epson for the Microsoft
-platforms). This currently supports 522 models.
    Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and
-commercial UNIX
    
-Linuxprinting.org today is the one-stop "shop" to download printer
-drivers. Look for printer information and tutorials
-or solve printing problems in its popular forums.  But
-it's not just for GNU/Linux: users and admins of commercial UNIX
-systems are also going there, and the relatively new Mac
-OS X forum has turned out to be one of the most frequented
-fora after only a few weeks.
+platforms). This currently supports 522 models.
    Forums, Downloads, Tutorials, Howtos  also for Mac OS X and Commercial UNIX
    
+Linuxprinting.org today is the one-stop shop to download printer
+drivers. Look for printer information and tutorials
+or solve printing problems in its popular forums. This forum 
+it's not just for GNU/Linux users, but admins of commercial UNIX
+systems are also going there, and the relatively new Mac
+OS X forum has turned out to be one of the most frequented
+forums after only a few weeks.
 
    
 Linuxprinting.org and the Foomatic driver wrappers around Ghostscript
 are now a standard toolchain for printing on all the important
 distros. Most of them also have CUPS underneath. While in recent years
-most printer data had been added by Till (who works at Mandrake), many
+most printer data had been added by Kamppeter (who works at Mandrake), many
 additional contributions came from engineers with SuSE, RedHat,
-Connectiva, Debian and others. Vendor-neutrality is an important goal
+Connectiva, Debian, and others. Vendor-neutrality is an important goal
 of the Foomatic project.
 
    Note
    
 Till Kamppeter from MandrakeSoft is doing an excellent job in his
 spare time to maintain Linuxprinting.org and Foomatic. So if you use
 it often, please send him a note showing your appreciation.
-
    Foomatic Database generated PPDs
    
+
    Foomatic Database-Generated PPDs
    
 The Foomatic database is an amazing piece of ingenuity in itself. Not
 only does it keep the printer and driver information, but it is
-organized in a way that it can generate "PPD" files "on the fly" from
+organized in a way that it can generate PPD files on the fly from
 its internal XML-based datasets. While these PPDs are modelled to the
-Adobe specification of "PostScript Printer Descriptions" (PPDs), the
-Linuxprinting.org/Foomatic-PPDs don't normally drive PostScript
-printers: they are used to describe all the bells and whistles you
-could ring or blow on an Epson Stylus inkjet, or a HP Photosmart or
-what-have-you. The main "trick" is one little additional line, not
-envisaged by the PPD specification, starting with the "*cupsFilter"
-keyword: it tells the CUPS daemon how to proceed with the PostScript
+Adobe specification of PostScript Printer Descriptions (PPDs), the
+Linuxprinting.org/Foomatic-PPDs do not normally drive PostScript
+printers. They are used to describe all the bells and whistles you
+could ring or blow on an Epson Stylus inkjet, or a HP Photosmart, or
+what-have-you. The main trick is one little additional line, not
+envisaged by the PPD specification, starting with the *cupsFilter
+keyword. It tells the CUPS daemon how to proceed with the PostScript
 print file (old-style Foomatic-PPDs named the
-cupsomatic filter script, while the new-style
-PPDs now call foomatic-rip). This filter
+cupsomatic filter script, while the new-style
+PPDs are now call foomatic-rip). This filter
 script calls Ghostscript on the host system (the recommended variant
 is ESP Ghostscript) to do the rendering work. foomatic-rip knows which
 filter or internal device setting it should ask from Ghostscript to
 convert the PostScript printjob into a raster format ready for the
 target device. This usage of PPDs to describe the options of non-PS
-printers was the invention of the CUPS developers. The rest is easy:
-GUI tools (like KDE's marvellous "kprinter",
-or the GNOME "gtklp", "xpp" and the CUPS
-web interface) read the PPD too and use this information to present
+printers was the invention of the CUPS developers. The rest is easy.
+GUI tools (like KDE's marvelous kprinter,
+or the GNOME gtklp, xpp and the CUPS
+Web interface) read the PPD as well and use this information to present
 the available settings to the user as an intuitive menu selection.
-

    foomatic-rip and Foomatic-PPD Download and Installation

    -Here are the steps to install a foomatic-rip driven "LaserJet 4 Plus" -compatible printer in CUPS (note that recent distributions of SuSE, -UnitedLinux and Mandrake may ship with a complete package of -Foomatic-PPDs plus the foomatic-rip utility. going directly to -Linuxprinting.org ensures you to get the latest driver/PPD files): -

    foomatic-rip and Foomatic-PPD Download and Installation

    +Here are the steps to install a foomatic-rip driven LaserJet 4 Plus-compatible +printer in CUPS (note that recent distributions of SuSE, UnitedLinux and +Mandrake may ship with a complete package of Foomatic-PPDs plus the +foomatic-rip utility. Going directly to +Linuxprinting.org ensures that you get the latest driver/PPD files): +

    • Open your browser at the Linuxprinting.org printer listpage. +

    • Check the complete list of printers in the +database.. +

    • Select your model and click on the link. +

    • You'll arrive at a page listing all drivers working with this +model (for all printers, there will always be one +recommended driver. Try this one first). +

    • In our case (HP LaserJet 4 Plus), we'll arrive at the default driver for the +HP-LaserJet 4 Plus. +

    • The recommended driver is ljet4.

    • Several links are provided here. You should visit them all if you +are not familiar with the Linuxprinting.org database. +

    • There is a link to the database page for the +ljet4. On the driver's page, you'll find important and detailed information about how to use that driver within the various available spoolers.

    • Another link may lead you to the homepage of the -driver author or the driver.

    • Important links are the ones which provide hints with -setup instructions for CUPS (http://www.linuxprinting.org/cups-doc.html), -PDQ (http://www.linuxprinting.org/pdq-doc.html), -LPD, LPRng and GNUlpr (http://www.linuxprinting.org/lpd-doc.html) -as well as PPR (http://www.linuxprinting.org/ppr-doc.html) -or "spooler-less" printing (http://www.linuxprinting.org/direct-doc.html -).

    • You can view the PPD in your browser through this -link: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1 -

    • You can also (most importantly) -generate and download the PPD: http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=0 +driver author or the driver.

    • Important links are the ones that provide hints with +setup instructions for CUPS, +PDQ, +LPD, LPRng and GNUlpr) +as well as PPR +or “spooler-less” printing. +

    • You can view the PPD in your browser through this link: +http://www.linuxprinting.org/ppd-o-matic.cgi?driver=ljet4&printer=HP-LaserJet_4_Plus&show=1 +

    • Most importantly, you can also generate and download +the PPD.

    • The PPD contains all the information needed to use our -model and the driver; this is, once installed, working transparently -for the user. Later you'll only need to choose resolution, paper size -etc. from the web-based menu, or from the print dialog GUI, or from -the commandline.

    • Should you have ended up on the driver's page (http://www.linuxprinting.org/show_driver.cgi?driver=ljet4), -you can choose to use the "PPD-O-Matic" online PPD generator -program.

    • Select the exact model and check either "download" or -"display PPD file" and click on "Generate PPD file".

    • If you save the PPD file from the browser view, please -don't use "cut'n'past" (since it could possibly damage line endings -and tabs, which makes the PPD likely to fail its duty), but use "Save -as..." in your browser's menu. (Best is to use the "download" option -from the web page directly).

    • Another very interesting part on each driver page is -the Show execution details button. If you -select your printer model and click that button, you will get -displayed a complete Ghostscript command line, enumerating all options -available for that driver/printermodel combo. This is a great way to -"Learn Ghostscript By Doing". It is also an excellent "cheat sheet" +model and the driver; once installed, this works transparently +for the user. Later you'll only need to choose resolution, paper size, +and so on from the Web-based menu, or from the print dialog GUI, or from +the command line.

    • If you ended up on the drivers +page +you can choose to use the “PPD-O-Matic” online PPD generator +program.

    • Select the exact model and check either Download or +Display PPD file and click Generate PPD file.

    • If you save the PPD file from the browser view, please +do not use cut and paste (since it could possibly damage line endings +and tabs, which makes the PPD likely to fail its duty), but use Save +as... in your browser's menu. (It is best to use the Download option +directly from the Web page).

    • Another interesting part on each driver page is +the Show execution details button. If you +select your printer model and click on that button, +a complete Ghostscript command line will be displayed, enumerating all options +available for that combination of driver and printer model. This is a great way to +“learn Ghostscript by doing”. It is also an excellent cheat sheet for all experienced users who need to re-construct a good command line for that damn printing script, but can't remember the exact -syntax. ;-)

    • Some time during your visit to Linuxprinting.org, save +syntax.

    • Some time during your visit to Linuxprinting.org, save the PPD to a suitable place on your harddisk, say /path/to/my-printer.ppd (if you prefer to install -your printers with the help of the CUPS web interface, save the PPD to -the /usr/share/cups/model/ path and re-start -cupsd).

    • Then install the printer with a suitable commandline, -e.g.: +your printers with the help of the CUPS Web interface, save the PPD to +the /usr/share/cups/model/ path and restart +cupsd).

    • Then install the printer with a suitable command line, +like this: 

      -root# lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E -P path/to/my-printer.ppd
-

    • Note again this: for all the new-style "Foomatic-PPDs" -from Linuxprinting.org, you also need a special "CUPS filter" named -"foomatic-rip".Get the latest version of "foomatic-rip" from: http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=0 +root# lpadmin -p laserjet4plus -v parallel:/dev/lp0 -E \ + -P path/to/my-printer.ppd +

    • For all the new-style “Foomatic-PPDs” +from Linuxprinting.org, you also need a special CUPS filter named +foomatic-rip.

    • The foomatic-rip Perlscript itself also makes some -interesting reading (http://www.linuxprinting.org/foomatic2.9/download.cgi?filename=foomatic-rip&show=1), -because it is very well documented by Till's inline comments (even +interesting reading +because it is well documented by Kamppeter's inline comments (even non-Perl hackers will learn quite a bit about printing by reading -it... ;-)

    • Save foomatic-rip either directly in +it).

    • Save foomatic-rip either directly in /usr/lib/cups/filter/foomatic-rip or somewhere in -your $PATH (and don't forget to make it world-executable). Again, -don't save by "copy'n'paste" but use the appropriate link, or the -"Save as..." menu item in your browser.

    • If you save foomatic-rip in your $PATH, create a symlink: -cd /usr/lib/cups/filter/ ; ln -s `which -foomatic-rip`. For CUPS to discover this new -available filter at startup, you need to re-start +your $PATH (and remember to make it world-executable). Again, +do not save by copy and paste but use the appropriate link or the +Save as... menu item in your browser.

    • If you save foomatic-rip in your $PATH, create a symlink: +

      +root# cd /usr/lib/cups/filter/ ; ln -s `which foomatic-rip'
+

      +

      +CUPS will discover this new available filter at startup after restarting cupsd.

    -Once you print to a printqueue set up with the Foomatic-PPD, CUPS will +Once you print to a print queue set up with the Foomatic-PPD, CUPS will insert the appropriate commands and comments into the resulting PostScript jobfile. foomatic-rip is able to read and act upon -these. foomatic-rip uses some specially encoded Foomatic comments, +these and uses some specially encoded Foomatic comments embedded in the jobfile. These in turn are used to construct -(transparently for you, the user) the complicated ghostscript command -line telling for the printer driver how exactly the resulting raster -data should look like and which printer commands to embed into the -data stream. -

    -You need: -

    • A "foomatic+something" PPD -- but it this not enough +(transparently for you, the user) the complicated Ghostscript command +line telling the printer driver exactly how the resulting raster +data should look and which printer commands to embed into the +data stream. You need: +

      • A “foomatic+something” PPD but this is not enough to print with CUPS (it is only one important -component)

      • The "foomatic-rip" filter script (Perl) in -/usr/lib/cups/filters/

      • Perl to make foomatic-rip run

      • Ghostscript (because it is doing the main work, +component).

      • The foomatic-rip filter script (Perl) in +/usr/lib/cups/filters/.

      • Perl to make foomatic-rip run.

      • Ghostscript (because it is doing the main work, controlled by the PPD/foomatic-rip combo) to produce the raster data -fit for your printermodel's consumption

      • Ghostscript must (depending on -the driver/model) contain support for a certain "device", representing -the selected "driver" for your model (as shown by "gs --h")

      • foomatic-rip needs a new version of PPDs (PPD versions -produced for cupsomatic don't work with -foomatic-rip).

    Page Accounting with CUPS

    -Often there are questions regarding "print quotas" wherein Samba users +fit for your printer model's consumption.

  • Ghostscript must (depending on +the driver/model) contain support for a certain device representing +the selected driver for your model (as shown by gs + -h).

  • foomatic-rip needs a new version of PPDs (PPD versions +produced for cupsomatic do not work with +foomatic-rip).

    • Page Accounting with CUPS

    + +Often there are questions regarding print quotas where Samba users (that is, Windows clients) should not be able to print beyond a -certain amount of pages or data volume per day, week or month. This +certain number of pages or data volume per day, week or month. This feature is dependent on the real print subsystem you're using. Samba's part is always to receive the job files from the clients (filtered or unfiltered) and hand it over to this printing subsystem.

    -Of course one could "hack" things with one's own scripts. But then -there is CUPS. CUPS supports "quotas" which can be based on sizes of -jobs or on the number of pages or both, and are spanning any time +Of course one could hack things with one's own scripts. But then +there is CUPS. CUPS supports quotas that can be based on the size of +jobs or on the number of pages or both, and span any time period you want. -

    Setting up Quotas

    -This is an example command how root would set a print quota in CUPS, -assuming an existing printer named "quotaprinter": -

    +
    Setting Up Quotas
    
+
+This is an example command of how root would set a print quota in CUPS,
+assuming an existing printer named “quotaprinter”:
+
    
+
+	
     root# lpadmin -p quotaprinter -o job-quota-period=604800 \
 	-o job-k-limit=1024 -o job-page-limit=100
 
    
 This would limit every single user to print 100 pages or 1024 KB of
 data (whichever comes first) within the last 604,800 seconds ( = 1
 week).
-
    Correct and incorrect Accounting
    
+
    Correct and Incorrect Accounting
    
 For CUPS to count correctly, the printfile needs to pass the CUPS
-"pstops" filter, otherwise it uses a "dummy" count of "1".  Some
-printfiles don't pass it (eg: image files) but then those are mostly 1
+pstops filter, otherwise it uses a dummy count of “one”. Some
+print files do not pass it (e.g., image files) but then those are mostly one-
 page jobs anyway. This also means that proprietary drivers for the
 target printer running on the client computers and CUPS/Samba, which
-then spool these files as "raw" (i.e. leaving them untouched, not
-filtering them), will be counted as "1-pagers" too!
+then spool these files as “raw” (i.e., leaving them untouched, not
+filtering them), will be counted as one-pagers too!
 
    
-You need to send PostScript from the clients (i.e. run a PostScript
+You need to send PostScript from the clients (i.e., run a PostScript
 driver there) to have the chance to get accounting done. If the
 printer is a non-PostScript model, you need to let CUPS do the job to
 convert the file to a print-ready format for the target printer. This
-will be working for currently about 1,000 different printer models,
-see the driver list at linuxprinting.org/.
-
    Adobe and CUPS PostScript Drivers for Windows Clients
    
-Before CUPS-1.1.16 your only option was to use the Adobe PostScript
+is currently working for about a thousand different printer models.
+Linuxprinting has a driver
+list.
+
    Adobe and CUPS PostScript Drivers for Windows Clients
    
+Before CUPS 1.1.16, your only option was to use the Adobe PostScript
 Driver on the Windows clients. The output of this driver was not
-always passed through the "pstops" filter on the CUPS/Samba side, and
+always passed through the pstops filter on the CUPS/Samba side, and
 therefore was not counted correctly (the reason is that it often,
-depending on the "PPD" being used, wrote a "PJL"-header in front of
-the real PostScript which caused CUPS to skip pstops and go directly
-to the "pstoraster" stage).
-
    
-From CUPS-1.1.16 onward you can use the "CUPS PostScript Driver for
-Windows NT/2K/XP clients" (which is tagged in the download area of
-http://www.cups.org/ as the "cups-samba-1.1.16.tar.gz" package). It does
-not work for Win9x/ME clients. But it guarantees:
-
    • to not write an PJL-header
    • to still read and support all PJL-options named in the
-driver PPD with its own means
    •  that the file will pass through the "pstops" filter
-on the CUPS/Samba server
    • to page-count correctly the
-printfile
    
-You can read more about the setup of this combination in the manpage
-for "cupsaddsmb" (which is only present with CUPS installed, and only
+depending on the PPD being used, wrote a PJL-header in front of
+the real PostScript which caused CUPS to skip pstops and go directly
+to the pstoraster stage).
+
    
+From CUPS 1.1.16 onward, you can use the CUPS PostScript Driver for
+Windows NT/200x/XP clients (which is tagged in the download area of
+http://www.cups.org/ as the cups-samba-1.1.16.tar.gz
+package). It does not work for Windows 9x/ME clients, but it guarantees:
+
    •   To not write a PJL-header.
    • To still read and support all PJL-options named in the
+driver PPD with its own means.
    • That the file will pass through the pstops filter
+on the CUPS/Samba server.
    • To page-count correctly the print file.
    
+You can read more about the setup of this combination in the man page
+for cupsaddsmb (which is only present with CUPS installed, and only
 current from CUPS 1.1.16).
-
    The page_log File Syntax
    
-These are the items CUPS logs in the "page_log" for every
-single page of a job:
-
    • Printer name
    • User name
    • Job ID
    • Time of printing
    • the page number
    • the number of copies
    • a billing information string
-(optional)
    • the host which sent the job (included since version
-1.1.19)
    
-Here is an extract of my CUPS server's page_log file to illustrate the
+
    The page_log File Syntax
    
+
+These are the items CUPS logs in the page_log for every
+page of a job:
+
    • Printer name
    • User name
    • Job ID
    • Time of printing
    • The page number
    • The number of copies
    • A billing information string (optional)
    • The host that sent the job (included since version 1.1.19)
    
+Here is an extract of my CUPS server's page_log file to illustrate the
 format and included items:
 
    -infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13
-infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13
-infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13
-infotec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13
-DigiMaster9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33
-
    
-This was job ID "401", printed on "infotec_IS2027" by user "kurt", a
-64-page job printed in 3 copies and billed to "#marketing", sent
-from IP address 10.160.50.13. The next job had ID "402", was sent by
-user "boss" from IP address 10.160.51.33,printed from one page 440
-copies and is set to be billed to "finance-dep".
-
    Possible Shortcomings
    
+tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 1 3 #marketing 10.160.50.13
+tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 2 3 #marketing 10.160.50.13
+tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 3 3 #marketing 10.160.50.13
+tec_IS2027 kurt 401 [22/Apr/2003:10:28:43 +0100] 4 3 #marketing 10.160.50.13
+Dig9110 boss 402 [22/Apr/2003:10:33:22 +0100] 1 440 finance-dep 10.160.51.33
+

    +This was job ID 401, printed on tec_IS2027 +by user kurt, a 64-page job printed in three copies and billed to +#marketing, sent from IP address 10.160.50.13. + The next job had ID 402, was sent by user boss +from IP address 10.160.51.33, printed from one page 440 copies and +is set to be billed to finance-dep. +

    Possible Shortcomings

    What flaws or shortcomings are there with this quota system? -

    • the ones named above (wrongly logged job in case of -printer hardware failure, etc.)

    • in reality, CUPS counts the job pages that are being +

      • The ones named above (wrongly logged job in case of +printer hardware failure, and so on).

      • In reality, CUPS counts the job pages that are being processed in software (that is, going through the -"RIP") rather than the physical sheets successfully leaving the -printing device. Thus if there is a jam while printing the 5th sheet out -of 1000 and the job is aborted by the printer, the "page count" will -still show the figure of 1000 for that job

      • all quotas are the same for all users (no flexibility -to give the boss a higher quota than the clerk), no support for -groups

      • no means to read out the current balance or the -"used-up" number of current quota

      • a user having used up 99 sheets of 100 quota will -still be able to send and print a 1,000 sheet job

      • a user being denied a job because of a filled-up quota -doesn't get a meaningful error message from CUPS other than -"client-error-not-possible".

    Future Developments

    +RIP) rather than the physical sheets successfully leaving the +printing device. Thus if there is a jam while printing the fifth sheet out +of a thousand and the job is aborted by the printer, the page count will +still show the figure of a thousand for that job.

  • All quotas are the same for all users (no flexibility +to give the boss a higher quota than the clerk) and no support for +groups.

  • No means to read out the current balance or the +“used-up” number of current quota.

  • A user having used up 99 sheets of a 100 quota will +still be able to send and print a thousand sheet job.

  • A user being denied a job because of a filled-up quota +does not get a meaningful error message from CUPS other than +“client-error-not-possible”.

    • Future Developments

    This is the best system currently available, and there are huge improvements under development for CUPS 1.2: -

    • page counting will go into the "backends" (these talk +

      • Page counting will go into the backends (these talk directly to the printer and will increase the count in sync with the -actual printing process: thus a jam at the 5th sheet will lead to a -stop in the counting)

      • quotas will be handled more flexibly

      • probably there will be support for users to inquire -their "accounts" in advance

      • probably there will be support for some other tools -around this topic

    Other Accounting Tools

    -PrintAnalyzer, pyKota, printbill, LogReport. -

    Additional Material

    +actual printing process; thus, a jam at the fifth sheet will lead to a +stop in the counting).

  • Quotas will be handled more flexibly.

  • Probably there will be support for users to inquire +about their accounts in advance.

  • Probably there will be support for some other tools +around this topic.

    • Additional Material

    A printer queue with no PPD associated to it is a -"raw" printer and all files will go directly there as received by the -spooler. The exceptions are file types "application/octet-stream" -which need "passthrough feature" enabled. "Raw" queues don't do any +“raw” printer and all files will go directly there as received by the +spooler. The exceptions are file types application/octet-stream +that need passthrough feature enabled. “Raw” queues do not do any filtering at all, they hand the file directly to the CUPS backend. -This backend is responsible for the sending of the data to the device -(as in the "device URI" notation: lpd://, socket://, -smb://, ipp://, http://, parallel:/, serial:/, usb:/ etc.) +This backend is responsible for sending the data to the device +(as in the “device URI” notation: lpd://, socket://, +smb://, ipp://, http://, parallel:/, serial:/, usb:/, and so on).

    -"cupsomatic"/Foomatic are not native CUPS drivers -and they don't ship with CUPS. They are a Third Party add-on, +cupsomatic/Foomatic are not native CUPS drivers +and they do not ship with CUPS. They are a third party add-on developed at Linuxprinting.org. As such, they are a brilliant hack to make all models (driven by Ghostscript drivers/filters in traditional spoolers) also work via CUPS, with the same (good or bad!) quality as -in these other spoolers. "cupsomatic" is only a vehicle to execute a -ghostscript commandline at that stage in the CUPS filtering chain, -where "normally" the native CUPS "pstoraster" filter would kick -in. cupsomatic by-passes pstoraster, "kidnaps" the printfile from CUPS -away and re-directs it to go through Ghostscript. CUPS accepts this, -because the associated CUPS-O-Matic-/Foomatic-PPD specifies: +in these other spoolers. cupsomatic is only a vehicle to execute a +Ghostscript commandline at that stage in the CUPS filtering chain, +where normally the native CUPS pstoraster filter would kick +in. cupsomatic bypasses pstoraster, kidnaps the printfile from CUPS +away and redirects it to go through Ghostscript. CUPS accepts this, +because the associated cupsomatic/foomatic-PPD specifies: + 

       *cupsFilter:  "application/vnd.cups-postscript 0 cupsomatic"

    + This line persuades CUPS to hand the file to cupsomatic, once it has successfully converted it to the MIME type -"application/vnd.cups-postscript". This conversion will not happen for -Jobs arriving from Windows which are auto-typed -"application/octet-stream", with the according changes in +application/vnd.cups-postscript. This conversion will not happen for +Jobs arriving from Windows that are auto-typed +application/octet-stream, with the according changes in /etc/cups/mime.types in place.

    CUPS is widely configurable and flexible, even regarding its filtering mechanism. Another workaround in some situations would be to have in /etc/cups/mime.types entries as follows: + 

      application/postscript           application/vnd.cups-raw  0  -
  application/vnd.cups-postscript  application/vnd.cups-raw  0  -

    -This would prevent all Postscript files from being filtered (rather, + +This would prevent all PostScript files from being filtered (rather, they will through the virtual nullfilter -denoted with "-"). This could only be useful for PS printers. If you +denoted with “-”). This could only be useful for PS printers. If you want to print PS code on non-PS printers (provided they support ASCII -text printing) an entry as follows could be useful: +text printing), an entry as follows could be useful: + 

      */*           application/vnd.cups-raw  0  -

    + and would effectively send all files to the backend without further processing.

    -Lastly, you could have the following entry: +You could have the following entry: + 

    -application/vnd.cups-postscript application/vnd.cups-raw 0 my_PJL_stripping_filter
+application/vnd.cups-postscript application/vnd.cups-raw 0 \
+	my_PJL_stripping_filter

    -You will need to write a my_PJL_stripping_filter -(could be a shellscript) that parses the PostScript and removes the -unwanted PJL. This would need to conform to CUPS filter design + +You will need to write a my_PJL_stripping_filter +(which could be a shell script) that parses the PostScript and removes the +unwanted PJL. This needs to conform to CUPS filter design (mainly, receive and pass the parameters printername, job-id, username, jobtitle, copies, print options and possibly the -filename). It would be installed as world executable into -/usr/lib/cups/filters/ and will be called by CUPS -if it encounters a MIME type "application/vnd.cups-postscript". +filename). It is installed as world executable into +/usr/lib/cups/filters/ and is called by CUPS +if it encounters a MIME type application/vnd.cups-postscript.

    -CUPS can handle -o job-hold-until=indefinite. -This keeps the job in the queue "on hold". It will only be printed +CUPS can handle -o job-hold-until=indefinite. +This keeps the job in the queue on hold. It will only be printed upon manual release by the printer operator. This is a requirement in -many "central reproduction departments", where a few operators manage +many central reproduction departments, where a few operators manage the jobs of hundreds of users on some big machine, where no user is allowed to have direct access (such as when the operators often need to load the proper paper type before running the 10,000 page job -requested by marketing for the mailing, etc.). -

    Auto-Deletion or Preservation of CUPS Spool Files

    -Samba print files pass through two "spool" directories. One is the -incoming directory managed by Samba, (set in the path = /var/spool/samba directive in the -[printers] section of +requested by marketing for the mailing, and so on). +

    Auto-Deletion or Preservation of CUPS Spool Files

    +Samba print files pass through two spool directories. One is the +incoming directory managed by Samba, (set in the +path = /var/spool/samba +directive in the [printers] section of smb.conf). The other is the spool directory of your UNIX print subsystem. For CUPS it is normally -/var/spool/cups/, as set by the cupsd.conf +/var/spool/cups/, as set by the cupsd.conf directive RequestRoot /var/spool/cups. -

    CUPS Configuration Settings explained

    +

    CUPS Configuration Settings Explained

    Some important parameter settings in the CUPS configuration file cupsd.conf are:

    PreserveJobHistory Yes

    This keeps some details of jobs in cupsd's mind (well it keeps the -"c12345", "c12346" etc. files in the CUPS spool directory, which do a +c12345, c12346, and so on, files in the CUPS spool directory, which do a similar job as the old-fashioned BSD-LPD control files). This is set -to "Yes" as a default. +to “Yes” as a default.

    PreserveJobFiles Yes

    This keeps the job files themselves in cupsd's mind -(well it keeps the "d12345", "d12346" etc. files in the CUPS spool -directory...). This is set to "No" as the CUPS +(it keeps the d12345, d12346 etc. files in the CUPS spool +directory). This is set to “No” as the CUPS default. -

    "MaxJobs 500"

    +

    “MaxJobs 500”

    This directive controls the maximum number of jobs that are kept in memory. Once the number of jobs reaches the limit, the oldest completed job is automatically purged from the system to make room for the new one. If all of the known jobs are still -pending or active then the new job will be rejected. Setting the +pending or active, then the new job will be rejected. Setting the maximum to 0 disables this functionality. The default setting is 0.

    -(There are also additional settings for "MaxJobsPerUser" and -"MaxJobsPerPrinter"...) -

    Pre-conditions

    +(There are also additional settings for MaxJobsPerUser and +MaxJobsPerPrinter...) +

    Pre-Conditions

    For everything to work as announced, you need to have three things: -

    • a Samba-smbd which is compiled against "libcups" (Check -on Linux by running "ldd `which smbd`")

    • a Samba-smb.conf setting of - printing = cups

    • another Samba-smb.conf setting of - printcap = cups

    Note

    -In this case all other manually set printing-related commands (like -print command, -lpq command, -lprm command, -lppause command or -lpresume command) are ignored and they should normally have no -influence what-so-ever on your printing. -

    Manual Configuration

    -If you want to do things manually, replace the printing = cups -by printing = bsd. Then your manually set commands may work -(haven't tested this), and a print command = lp -d %P %s; rm %s" +

    • A Samba-smbd that is compiled against libcups (check +on Linux by running ldd `which smbd').

    • A Samba-smb.conf setting of + printing = cups.

    • Another Samba-smb.conf setting of + printcap = cups.

    Note

    +In this case, all other manually set printing-related commands (like +print command, +lpq command, +lprm command, +lppause command or +lpresume command) are ignored and they should normally have no +influence whatsoever on your printing. +

    Manual Configuration

    +If you want to do things manually, replace the printing = cups +by printing = bsd. Then your manually set commands may work +(I haven't tested this), and a print command = lp -d %P %s; rm %s" may do what you need. -

    In Case of Trouble.....

    -If you have more problems, post the output of these commands -to the CUPS or Samba mailing lists (choose the one which seems more -relevant to your problem): -

    -$ grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
-$ grep -v ^# /etc/samba/smb.conf | grep -v ^$ | grep -v "^;"
-

    -(adapt paths as needed). These commands leave out the empty -lines and lines with comments, providing the "naked settings" in a -compact way. Don't forget to name the CUPS and Samba versions you -are using! This saves bandwidth and makes for easier readability -for experts (and you are expecting experts to read them, right? -;-) -

    Printing from CUPS to Windows attached -Printers

    -From time to time the question arises, how you can print +

    Printing from CUPS to Windows Attached Printers

    +>From time to time the question arises, how can you print to a Windows attached printer -from Samba. Normally the local connection +from Samba? Normally the local connection from Windows host to printer would be done by USB or parallel -cable, but this doesn't matter to Samba. From here only an SMB +cable, but this does not matter to Samba. From here only an SMB connection needs to be opened to the Windows host. Of course, this -printer must be "shared" first. As you have learned by now, CUPS uses +printer must be shared first. As you have learned by now, CUPS uses backends to talk to printers and other -servers. To talk to Windows shared printers you need to use the -smb (surprise, surprise!) backend. Check if this -is in the CUPS backend directory. This resides usually in -/usr/lib/cups/backend/. You need to find a "smb" +servers. To talk to Windows shared printers, you need to use the +smb (surprise, surprise!) backend. Check if this +is in the CUPS backend directory. This usually resides in +/usr/lib/cups/backend/. You need to find an smb file there. It should be a symlink to smbspool -which file must exist and be executable: +and the file must exist and be executable: 

     root# ls -l /usr/lib/cups/backend/
 total 253
-drwxr-xr-x    3 root     root          720 Apr 30 19:04 .
-drwxr-xr-x    6 root     root          125 Dec 19 17:13 ..
--rwxr-xr-x    1 root     root        10692 Feb 16 21:29 canon
--rwxr-xr-x    1 root     root        10692 Feb 16 21:29 epson
-lrwxrwxrwx    1 root     root            3 Apr 17 22:50 http -> ipp
--rwxr-xr-x    1 root     root        17316 Apr 17 22:50 ipp
--rwxr-xr-x    1 root     root        15420 Apr 20 17:01 lpd
--rwxr-xr-x    1 root     root         8656 Apr 20 17:01 parallel
--rwxr-xr-x    1 root     root         2162 Mar 31 23:15 pdfdistiller
-lrwxrwxrwx    1 root     root           25 Apr 30 19:04 ptal -> /usr/sbin/ptal-cups
--rwxr-xr-x    1 root     root         6284 Apr 20 17:01 scsi
-lrwxrwxrwx    1 root     root           17 Apr  2 03:11 smb -> /usr/bin/smbspool
--rwxr-xr-x    1 root     root         7912 Apr 20 17:01 socket
--rwxr-xr-x    1 root     root         9012 Apr 20 17:01 usb
+drwxr-xr-x    3 root   root     720 Apr 30 19:04 .
+drwxr-xr-x    6 root   root     125 Dec 19 17:13 ..
+-rwxr-xr-x    1 root   root   10692 Feb 16 21:29 canon
+-rwxr-xr-x    1 root   root   10692 Feb 16 21:29 epson
+lrwxrwxrwx    1 root   root       3 Apr 17 22:50 http -> ipp
+-rwxr-xr-x    1 root   root   17316 Apr 17 22:50 ipp
+-rwxr-xr-x    1 root   root   15420 Apr 20 17:01 lpd
+-rwxr-xr-x    1 root   root    8656 Apr 20 17:01 parallel
+-rwxr-xr-x    1 root   root    2162 Mar 31 23:15 pdfdistiller
+lrwxrwxrwx    1 root   root      25 Apr 30 19:04 ptal -> /usr/sbin/ptal-cups
+-rwxr-xr-x    1 root   root    6284 Apr 20 17:01 scsi
+lrwxrwxrwx    1 root   root      17 Apr  2 03:11 smb -> /usr/bin/smbspool
+-rwxr-xr-x    1 root   root    7912 Apr 20 17:01 socket
+-rwxr-xr-x    1 root   root    9012 Apr 20 17:01 usb
 
 root# ls -l `which smbspool`
--rwxr-xr-x    1 root     root       563245 Dec 28 14:49 /usr/bin/smbspool
+-rwxr-xr-x    1 root   root  563245 Dec 28 14:49 /usr/bin/smbspool

    -If this symlink doesn't exist, create it: +If this symlink does not exist, create it: 

     root# ln -s `which smbspool` /usr/lib/cups/backend/smb

    -smbspool has been written by Mike Sweet from the CUPS folks. It is +smbspool has been written by Mike Sweet from the CUPS folks. It is included and ships with Samba. It may also be used with print subsystems other than CUPS, to spool jobs to Windows printer shares. To -set up printer "winprinter" on CUPS, you need to have a "driver" for +set up printer winprinter on CUPS, you need to have a driver for it. Essentially this means to convert the print data on the CUPS/Samba host to a format that the printer can digest (the Windows host is -unable to convert any files you may send). This also means you should +unable to convert any files you may send). This also means you should be able to print to the printer if it were hooked directly at your Samba/CUPS host. For troubleshooting purposes, this is what you -should do, to determine if that part of the process chain is in +should do to determine if that part of the process chain is in order. Then proceed to fix the network connection/authentication to -the Windows host, etc. +the Windows host, and so on.

    -To install a printer with the smb backend on CUPS, use this command: +To install a printer with the smb backend on CUPS, use this command: 

     root# lpadmin -p winprinter -v smb://WINDOWSNETBIOSNAME/printersharename \
   -P /path/to/PPD

    -The PPD must be able to direct CUPS to generate -the print data for the target model. For PostScript printers just use +The PPD must be able to direct CUPS to generate +the print data for the target model. For PostScript printers, just use the PPD that would be used with the Windows NT PostScript driver. But what can you do if the printer is only accessible with a password? Or if the printer's host is part of another workgroup? This is provided -for: you can include the required parameters as part of the -smb:// device-URI. Like this: -

    • smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename

    • smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename

    • smb://username:password@WINDOWSNETBIOSNAME/printersharename

    +for: You can include the required parameters as part of the +smb:// device-URI like this: +

    • smb://WORKGROUP/WINDOWSNETBIOSNAME/printersharename
    • smb://username:password@WORKGROUP/WINDOWSNETBIOSNAME/printersharename
    • smb://username:password@WINDOWSNETBIOSNAME/printersharename

    Note that the device-URI will be visible in the process list of the -Samba server (e.g. when someone uses the ps -aux +Samba server (e.g., when someone uses the ps -aux command on Linux), even if the username and passwords are sanitized -before they get written into the log files. So this is an inherently -insecure option. However it is the only one. Don't use it if you want +before they get written into the log files. So this is an inherently +insecure option, however, it is the only one. Don't use it if you want to protect your passwords. Better share the printer in a way that -doesn't require a password! Printing will only work if you have a +does not require a password! Printing will only work if you have a working netbios name resolution up and running. Note that this is a -feature of CUPS and you don't necessarily need to have smbd running -(but who wants that? :-). -

    More CUPS filtering Chains

    +feature of CUPS and you do not necessarily need to have smbd running. + +

    More CUPS-Filtering Chains

    The following diagrams reveal how CUPS handles print jobs. -

    Figure 19.17. Filtering chain 1

    Filtering chain 1

    Figure 19.18. Filtering chain with cupsomatic

    Filtering chain with cupsomatic

    Note

    -Gimp-Print and some other 3rd-Party-Filters (like TurboPrint) to -CUPS and ESP PrintPro plug-in where rastertosomething is noted. -

    Common Errors

    Win9x client can't install driver

    For Win9x clients require the printer names to be 8 -chars (or "8 plus 3 chars suffix") max; otherwise the driver files -won't get transferred when you want to download them from -Samba.

    "cupsaddsmb" keeps asking for root password in - neverending loop

    Have you security = user? Have +

    Figure 19.17. Filtering chain 1.

    Filtering chain 1.

    Figure 19.18. Filtering chain with cupsomatic

    Filtering chain with cupsomatic

    Common Errors

    Windows 9x/ME Client Can't Install Driver

    For Windows 9x/ME, clients require the printer names to be eight +characters (or “8 plus 3 chars suffix”) max; otherwise, the driver files +will not get transferred when you want to download them from +Samba.

    “cupsaddsmb” Keeps Asking for Root Password in Never-ending Loop

    Have you security = user? Have you used smbpasswd to give root a Samba account? -You can do 2 things: open another terminal and execute -smbpasswd -a root to create the account, and -continue with entering the password into the first terminal. Or break -out of the loop by hitting ENTER twice (without trying to type a -password).

    "cupsaddsmb" gives "No PPD file for printer..." - message while PPD file is present

    Have you enabled printer sharing on CUPS? This means: -do you have a <Location +You can do two things: open another terminal and execute +smbpasswd -a root to create the account and +continue entering the password into the first terminal. Or break +out of the loop by pressing ENTER twice (without trying to type a +password).

    “cupsaddsmb” Errors

    + The use of “cupsaddsmb” gives “No PPD file for printer...” Message While PPD File Is Present. + What might the problem be? +

    Have you enabled printer sharing on CUPS? This means: +Do you have a <Location /printers>....</Location> section in CUPS -server's cupsd.conf which doesn't deny access to -the host you run "cupsaddsmb" from? It could be +server's cupsd.conf that does not deny access to +the host you run “cupsaddsmb” from? It could be an issue if you use cupsaddsmb remotely, or if you use it with a -h parameter: cupsaddsmb -H sambaserver -h cupsserver -v printername.

    Is your -"TempDir" directive in -cupsd.conf +TempDir directive in +cupsd.conf set to a valid value and is it writeable? -

    Client can't connect to Samba printer

    Use smbstatus to check which user +

    Client Can't Connect to Samba Printer

    Use smbstatus to check which user you are from Samba's point of view. Do you have the privileges to write into the [print$] -share?

    Can't reconnect to Samba under new account - from Win2K/XP

    Once you are connected as the "wrong" user (for -example as "nobody", which often occurs if you have -map to guest = bad user), Windows Explorer will not accept an -attempt to connect again as a different user. There won't be any byte +share?

    New Account Reconnection from Windows 200x/XP Troubles

    Once you are connected as the wrong user (for +example, as nobody, which often occurs if you have +map to guest = bad user), Windows Explorer will not accept an +attempt to connect again as a different user. There will not be any byte transfered on the wire to Samba, but still you'll see a stupid error -message which makes you think that Samba has denied access. Use +message that makes you think Samba has denied access. Use smbstatus to check for active connections. Kill the -PIDs. You still can't re-connect and get the dreaded +PIDs. You still can't re-connect and you get the dreaded You can't connect with a second account from the same -machine message, as soon as you are trying? And you -don't see any single byte arriving at Samba (see logs; use "ethereal") -indicating a renewed connection attempt? Shut all Explorer Windows. +machine message, as soon as you are trying. And you +do not see any single byte arriving at Samba (see logs; use “ethereal”) +indicating a renewed connection attempt. Shut all Explorer Windows. This makes Windows forget what it has cached in its memory as -established connections. Then re-connect as the right user. Best +established connections. Then reconnect as the right user. The best method is to use a DOS terminal window and first do net use z: \\GANDALF\print$ /user:root. Check with smbstatus that you are connected under a -different account. Now open the "Printers" folder (on the Samba server -in the Network Neighbourhood), right-click the +different account. Now open the Printers folder (on the Samba server +in the Network Neighborhood), right-click on the printer in question and select -Connect...

    Avoid being connected to the Samba server as the - "wrong" user

    You see per smbstatus that you are -connected as user "nobody"; while you wanted to be "root" or -"printeradmin"? This is probably due to -map to guest = bad user, which silently connects you under the guest account, +Connect...

    Avoid Being Connected to the Samba Server as the Wrong User

    You see per smbstatus that you are +connected as user nobody; while you want to be root or +printeradmin. This is probably due to +map to guest = bad user, which silently connects you under the guest account when you gave (maybe by accident) an incorrect username. Remove -map to guest, if you want to prevent -this.

    Upgrading to CUPS drivers from Adobe drivers on - NT/2K/XP clients gives problems

    First delete all "old" Adobe-using printers. Then -delete all "old" Adobe drivers. (On Win2K/XP, right-click in -background of "Printers" folder, select "Server Properties...", select -tab "Drivers" and delete here).

    Can't use "cupsaddsmb" on Samba server which is - a PDC

    Do you use the "naked" root user name? Try to do it +map to guest, if you want to prevent +this.

    Upgrading to CUPS Drivers from Adobe Drivers

    +This information came from a mailinglist posting regarding problems experienced when +upgrading from Adobe drivers to CUPS drivers on Microsoft Windows NT/200x/XP Clients. +

    First delete all old Adobe-using printers. Then +delete all old Adobe drivers. (On Windows 200x/XP, right-click in +the background of Printers folder, select Server Properties..., select +tab Drivers and delete here).

    Can't Use “cupsaddsmb” on Samba Server Which Is a PDC

    Do you use the “naked” root user name? Try to do it this way: cupsaddsmb -U DOMAINNAME\\root -v printername> (note the two backslashes: the first one is -required to "escape" the second one).

    Deleted Win2K printer driver is still shown

    Deleting a printer on the client won't delete the +required to “escape” the second one).

    Deleted Windows 200x Printer Driver Is Still Shown

    Deleting a printer on the client will not delete the driver too (to verify, right-click on the white background of the -"Printers" folder, select "Server Properties" and click on the -"Drivers" tab). These same old drivers will be re-used when you try to +Printers folder, select Server Properties and click on the +Drivers tab). These same old drivers will be re-used when you try to install a printer with the same name. If you want to update to a new driver, delete the old ones first. Deletion is only possible if no -other printer uses the same driver.

    Win2K/XP "Local Security - Policies"

    Local Security Policies may not -allow the installation of unsigned drivers. "Local Security Policies" +other printer uses the same driver.

    Windows 200x/XP "Local Security Policies"

    Local Security Policies may not +allow the installation of unsigned drivers. “Local Security Policies” may not allow the installation of printer drivers at -all.

    WinXP clients: "Administrator can not install - printers for all local users"

    Windows XP handles SMB printers on a "per-user" basis. +all.

    Administrator Cannot Install Printers for All Local Users

    Windows XP handles SMB printers on a “per-user” basis. This means every user needs to install the printer himself. To have a printer available for everybody, you might want to use the built-in IPP client capabilities of WinXP. Add a printer with the print path of -http://cupsserver:631/printers/printername. -Still looking into this one: maybe a "logon script" could +http://cupsserver:631/printers/printername. +We're still looking into this one. Maybe a logon script could automatically install printers for all -users.

    "Print Change Notify" functions on - NT-clients

    For "print change notify" functions on NT++ clients, -these need to run the "Server" service first (re-named to -File & Print Sharing for MS Networks in -XP).

    WinXP-SP1

    WinXP-SP1 introduced a Point and Print -Restriction Policy (this restriction doesn't apply to -"Administrator" or "Power User" groups of users). In Group Policy -Object Editor: go to User Configuration, - Administrative Templates, Control Panel, -Printers. The policy is automatically set to -Enabled and the Users can only Point -and Print to machines in their Forest . You probably need -to change it to Disabled or Users can -only Point and Print to these servers in order to make -driver downloads from Samba possible.

    Print options for all users can't be set on Win2K/XP

    How are you doing it? I bet the wrong way (it is not -very easy to find out, though). There are 3 different ways to bring +users.

    Print Change Notify Functions on NT-clients

    For print change, notify functions on NT++ clients. +These need to run the Server service first (renamed to +File & Print Sharing for MS Networks in +XP).

    WinXP-SP1

    WinXP-SP1 introduced a Point and Print Restriction Policy (this restriction does not apply to +“Administrator” or “Power User” groups of users). In Group Policy +Object Editor, go to User Configuration -> Administrative Templates -> + Control Panel -> Printers. The policy is automatically set to +Enabled and the Users can only Point +and Print to machines in their Forest . You probably need +to change it to Disabled or Users can +only Point and Print to these servers to make +driver downloads from Samba possible. +

    Print Options for All Users Can't Be Set on Windows 200x/XP

    How are you doing it? I bet the wrong way (it is not +easy to find out, though). There are three different ways to bring you to a dialog that seems to set everything. All -three dialogs look the same. Only one of them -does what you intend. You need to be -Administrator or Print Administrator to do this for all users. Here +three dialogs look the same, yet only one of them +does what you intend. You need to be +Administrator or Print Administrator to do this for all users. Here is how I do in on XP: -

    1. The first "wrong" way: +

      1. The first wrong way: -

        1. Open the Printers +

          1. Open the Printers folder.

          2. Right-click on the printer -(remoteprinter on cupshost) and -select in context menu Printing -Preferences...

          3. Look at this dialog closely and remember what it looks +(remoteprinter on cupshost) and +select in context menu Printing +Preferences...

          4. Look at this dialog closely and remember what it looks like.

          -

        2. The second "wrong" way: - -

          1. Open the Printers -folder.

          2. Right-click on the printer (remoteprinter on -cupshost) and select in the context menu -Properties

          3. Click on the General -tab

          4. Click on the button Printing -Preferences...

          5. A new dialog opens. Keep this dialog open and go back +

          6. The second wrong way: + +

            1. Open the Printers +folder.

            2. Right-click on the printer (remoteprinter on +cupshost) and select the context menu +Properties.

            3. Click on the General +tab.

            4. Click on the button Printing +Preferences...

            5. A new dialog opens. Keep this dialog open and go back to the parent dialog.

            -

          7. The third, the "correct" way: (should you do -this from the beginning, just carry out steps 1. and 2. from second -"way" above) - -

            1. Click on the Advanced -tab. (Hmmm... if everything is "Grayed Out", then you are not logged -in as a user with enough privileges).

            2. Click on the Printing -Defaults... button.

            3. On any of the two new tabs, click on the -Advanced... -button.

            4. A new dialog opens. Compare this one to the other, -identical looking one from "B.5" or A.3".

            +

          8. The third, and the correct way: + +

            1. Open the Printers +folder.

            2. Click on the Advanced +tab. (If everything is “grayed out,” then you are not logged +in as a user with enough privileges).

            3. Click on the Printing +Defaults... button.

            4. On any of the two new tabs, click on the +Advanced... +button.

            5. A new dialog opens. Compare this one to the other +identical looking one from “B.5” or A.3".

          -Do you see any difference? I don't either... However, only the last -one, which you arrived at with steps "C.1.-6." will save any settings +Do you see any difference? I don't either. However, only the last +one, which you arrived at with steps “C.1.-6.”, will save any settings permanently and be the defaults for new users. If you want all clients to get the same defaults, you need to conduct these steps as -Administrator (printer admin in +Administrator (printer admin in smb.conf) before a client downloads the driver (the clients can later set their own per-user defaults by following the -procedures A. or B. -above).

        Most common blunders in driver - settings on Windows clients

        Don't use Optimize for -Speed: use Optimize for -Portability instead (Adobe PS Driver) Don't use -Page Independence: No: always -settle with Page Independence: -Yes (Microsoft PS Driver and CUPS PS Driver for -WinNT/2K/XP) If there are problems with fonts: use -Download as Softfont into -printer (Adobe PS Driver). For -TrueType Download Options -choose Outline. Use PostScript -Level 2, if you are having trouble with a non-PS printer, and if -there is a choice.

        cupsaddsmb does not work - with newly installed printer

        Symptom: the last command of -cupsaddsmb doesn't complete successfully: +procedures A or B +above).

        Most Common Blunders in Driver Settings on Windows Clients

        Don't use Optimize for +Speed, but use Optimize for +Portability instead (Adobe PS Driver). Don't use +Page Independence: No: always +settle with Page Independence: +Yes (Microsoft PS Driver and CUPS PS Driver for +Windows NT/200x/XP). If there are problems with fonts, use +Download as Softfont into +printer (Adobe PS Driver). For +TrueType Download Options +choose Outline. Use PostScript +Level 2, if you are having trouble with a non-PS printer and if +there is a choice.

        cupsaddsmb Does Not Work with Newly Installed Printer

        Symptom: The last command of +cupsaddsmb does not complete successfully: cmd = setdriver printername printername result was NT_STATUS_UNSUCCESSFUL then possibly the printer was not yet -"recognized" by Samba. Did it show up in Network -Neighbourhood? Did it show up in rpcclient -hostname -c 'enumprinters'? Restart smbd (or send a +recognized by Samba. Did it show up in Network +Neighborhood? Did it show up i n rpcclient +hostname -c `enumprinters'? Restart smbd (or send a kill -HUP to all processes listed by smbstatus and try -again.

        Permissions on -/var/spool/samba/ get reset after each -reboot

        Have you by accident set the CUPS spool directory to -the same location? (RequestRoot -/var/spool/samba/ in cupsd.conf or +again.

        Permissions on /var/spool/samba/ Get Reset After Each Reboot

        Have you ever by accident set the CUPS spool directory to +the same location? (RequestRoot /var/spool/samba/ in cupsd.conf or the other way round: /var/spool/cups/ is set as -path> in the [printers] -section). These must be different. Set +path> in the [printers] +section). These must be different. Set + RequestRoot /var/spool/cups/ in -cupsd.conf and path = +cupsd.conf and path = /var/spool/samba in the [printers] section of smb.conf. Otherwise cupsd will -sanitize permissions to its spool directory with each restart, and -printing will not work reliably.

        Printer named "lp" -intermittently swallows jobs and spits out completely different -ones

        It is a very bad idea to name any printer "lp". This +sanitize permissions to its spool directory with each restart and +printing will not work reliably.

        Print Queue Called “lp” Mis-handles Print Jobs

        +In this case a print queue called “lp” intermittently swallows jobs and +spits out completely different ones from what was sent. +

        It is a bad idea to name any printer “lp”. This is the traditional UNIX name for the default printer. CUPS may be set -up to do an automatic creation of "Implicit Classes". This means, to +up to do an automatic creation of Implicit Classes. This means, to group all printers with the same name to a pool of devices, and -loadbalancing the jobs across them in a round-robin fashion. Chances -are high that someone else has an "lp" named printer too. You may +load-balancing the jobs across them in a round-robin fashion. Chances +are high that someone else has a printer named “lp” too. You may receive his jobs and send your own to his device unwittingly. To have tight control over the printer names, set BrowseShortNames -No. It will present any printer as "printername@cupshost" -then, giving you a better control over what may happen in a large -networked environment.

        Location of Adobe PostScript driver files necessary for "cupsaddsmb"

        Use smbclient to connect to any +No. It will present any printer as printername@cupshost +and then gives you better control over what may happen in a large +networked environment.

        Location of Adobe PostScript Driver Files for “cupsaddsmb”

        Use smbclient to connect to any Windows box with a shared PostScript printer: smbclient //windowsbox/print\$ -U guest. You can navigate to the W32X86/2 subdir to mget ADOBE* -and other files or to WIN40/0 to do the same. -- +and other files or to WIN40/0 to do the same. Another option is to download the *.exe packaged -files from the Adobe website.

      An Overview of the CUPS Printing Processes

      Figure 19.19. CUPS Printing Overview

      CUPS Printing Overview

    Chapter 20. Stackable VFS modules

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Tim Potter

    Simo Sorce

    original vfs_skel README

    Alexander Bokovoy

    original vfs_netatalk docs

    Stefan Metzmacher

    Update for multiple modules

    Table of Contents

    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan

    Features and Benefits

    -Since Samba-3, there is support for stackable VFS(Virtual File System) modules. -Samba passes each request to access the unix file system thru the loaded VFS modules. -This chapter covers all the modules that come with the samba source and references to +files from the Adobe Web site.

    Overview of the CUPS Printing Processes

    A complete overview of the CUPS printing processes can be found in .

    Figure 19.19. CUPS printing overview.

    CUPS printing overview.

    [4] http://www.cups.org/cups-help.html

    Chapter 20. Stackable VFS modules

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Tim Potter

    Samba Team

    Simo Sorce

    original vfs_skel README

    Alexander Bokovoy

    original vfs_netatalk docs

    Stefan Metzmacher

    Update for multiple modules

    Table of Contents

    Features and Benefits
    Discussion
    Included Modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS Modules Available Elsewhere
    DatabaseFS
    vscan

    Features and Benefits

    +Since Samba-3, there is support for stackable VFS (Virtual File System) modules. +Samba passes each request to access the UNIX file system through the loaded VFS modules. +This chapter covers all the modules that come with the Samba source and references to some external modules. -

    Discussion

    +

    Discussion

    If not supplied with your platform distribution binary Samba package you may have problems -to compile these modules, as shared libraries are compiled and linked in different ways -on different systems. They currently have been tested against GNU/Linux and IRIX. +compiling these modules, as shared libraries are compiled and linked in different ways +on different systems. They currently have been tested against GNU/Linux and IRIX.

    -To use the VFS modules, create a share similar to the one below. The -important parameter is the vfs objects parameter where +To use the VFS modules, create a share similar to the one below. The +important parameter is the vfs objects parameter where you can list one or more VFS modules by name. For example, to log all access -to files and put deleted files in a recycle bin: +to files and put deleted files in a recycle bin, see . -

    Example 20.1. smb.conf with VFS modules

    [audit]
    comment = Audited /data directory
    path = /data
    vfs objects = audit recycle
    writeable = yes
    browseable = yes

    +

    Example 20.1. smb.conf with VFS modules

    [audit]
    comment = Audited /data directory
    path = /data
    vfs objects = audit recycle
    writeable = yes
    browseable = yes

    The modules are used in the order in which they are specified.

    -Samba will attempt to load modules from the lib -directory in the root directory of the samba installation (usually -/usr/lib/samba/vfs or /usr/local/samba/lib/vfs +Samba will attempt to load modules from the /lib directory in the root directory of the +Samba installation (usually /usr/lib/samba/vfs or /usr/local/samba/lib/vfs ).

    Some modules can be used twice for the same share. -This can be done using a configuration similar to the one below. +This can be done using a configuration similar to the one shown in . -

    Example 20.2. smb.conf with multiple VFS modules

    [test]
    comment = VFS TEST
    path = /data
    writeable = yes
    browseable = yes
    vfs objects = example:example1 example example:test
    example1: parameter = 1
    example: parameter = 5
    test: parameter = 7

    -

    Included modules

    audit

    +

    Example 20.2. smb.conf with multiple VFS modules

    [test]
    comment = VFS TEST
    path = /data
    writeable = yes
    browseable = yes
    vfs objects = example:example1 example example:test
    example1: parameter = 1
    example: parameter = 5
    test: parameter = 7

    +

    Included Modules

    audit

    A simple module to audit file access to the syslog - facility. The following operations are logged: -

    • share

    • connect/disconnect

    • directory opens/create/remove

    • file open/close/rename/unlink/chmod

    -

    extd_audit

    - This module is identical with the audit module above except - that it sends audit logs to both syslog as well as the smbd log file/s. The - loglevel for this module is set in the smb.conf file. + facility. The following operations are logged: +

    • share
    • connect/disconnect
    • directory opens/create/remove
    • file open/close/rename/unlink/chmod

    +

    extd_audit

    + This module is identical with the audit module above except + that it sends audit logs to both syslog as well as the smbd log files. The + log level for this module is set in the smb.conf file.

    - The logging information that will be written to the smbd log file is controlled by - the log level parameter in smb.conf. The - following information will be recorded: -

    Table 20.1. Extended Auditing Log Information

    Log LevelLog Details - File and Directory Operations
    0Creation / Deletion
    1Create / Delete / Rename / Permission Changes
    2Create / Delete / Rename / Perm Change / Open / Close

    fake_perms

    + Valid settings and the information that will be recorded are shown in . +

    Table 20.1. Extended Auditing Log Information

    Log LevelLog Details - File and Directory Operations
    0Creation / Deletion
    1Create / Delete / Rename / Permission Changes
    2Create / Delete / Rename / Perm Change / Open / Close

    fake_perms

    This module was created to allow Roaming Profile files and directories to be set (on the Samba server - under Unix) as read only. This module will if installed on the Profiles share will report to the client + under UNIX) as read only. This module will, if installed on the Profiles share, report to the client that the Profile files and directories are writable. This satisfies the client even though the files will never be overwritten as the client logs out or shuts down. -

    recycle

    - A recycle-bin like module. When used any unlink call - will be intercepted and files moved to the recycle - directory instead of being deleted. This gives the same - effect as the "Recycle Bin" on Windows computers. -

    Supported options: -

    recycle:repository

    Relative path of the directory where deleted files should be moved to

    recycle:keeptree

    Specifies whether the directory structure should - be kept or if the files in the directory that is being - deleted should be kept seperately in the recycle bin. -

    recycle:versions

    If this option is set, two files - with the same name that are deleted will both - be kept in the recycle bin. Newer deleted versions - of a file will be called "Copy #x of filename".

    recycle:touch

    Specifies whether a file's access - date should be touched when the file is moved to - the recycle bin.

    recycle:maxsize

    Files that are larger than the number - of bytes specified by this parameter will - not be put into the recycle bin.

    recycle:exclude

    List of files that should not - be put into the recycle bin when deleted, but deleted - in the regular way.

    recycle:exclude_dir

    Contains a list of directories. When files from - these directories are deleted, they are not put into the - recycle bin, but deleted in the regular way. -

    recycle:noversions

    Opposite of recycle:versions. If both options are specified, this one takes precedence.

    -

    netatalk

    - A netatalk module, that will ease co-existence of samba and - netatalk file sharing services. +

    recycle

    + A Recycle Bin-like module. Where used, unlink calls will be intercepted and files moved + to the recycle directory instead of being deleted. This gives the same effect as the + Recycle Bin on Windows computers. +

    + The Recycle Bin will not appear in Windows Explorer views of the network file system + (share) nor on any mapped drive. Instead, a directory called .recycle will be + automatically created when the first file is deleted. Users can recover files from the + .recycle directory. If the recycle:keeptree has been + specified, deleted files will be found in a path identical with that from which the file was deleted. +

    Supported options for the recycle module are as follow: +

    recycle:repository

    + Relative path of the directory where deleted files should be moved. +

    recycle:keeptree

    + Specifies whether the directory structure should be kept or if the files in the directory that is being + deleted should be kept seperately in the recycle bin. +

    recycle:versions

    + If this option is set, two files + with the same name that are deleted will both + be kept in the recycle bin. Newer deleted versions + of a file will be called “Copy #x of filename”. +

    recycle:touch

    + Specifies whether a file's access date should be touched when the file is moved to the recycle bin. +

    recycle:maxsize

    + Files that are larger than the number of bytes specified by this parameter will not be put into the recycle bin. +

    recycle:exclude

    + List of files that should not be put into the recycle bin when deleted, but deleted in the regular way. +

    recycle:exclude_dir

    + Contains a list of directories. When files from these directories are + deleted, they are not put into the + recycle bin but are deleted in the + regular way. +

    recycle:noversions

    + Opposite of recycle:versions. If both options are specified, this one takes precedence. +

    +

    netatalk

    + A netatalk module will ease co-existence of Samba and netatalk file sharing services.

    Advantages compared to the old netatalk module: -

    • it doesn't care about creating of .AppleDouble forks, just keeps them in sync

    • if a share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically

    -

    VFS modules available elsewhere

    +

    • Does not care about creating .AppleDouble forks, just keeps them in sync.

    • If a share in smb.conf does not contain .AppleDouble item in hide or veto list, it will be added automatically.

    +

    VFS Modules Available Elsewhere

    This section contains a listing of various other VFS modules that -have been posted but don't currently reside in the Samba CVS -tree for one reason or another (e.g. it is easy for the maintainer +have been posted but do not currently reside in the Samba CVS +tree for one reason or another (e.g., it is easy for the maintainer to have his or her own CVS tree).

    No statements about the stability or functionality of any module should be implied due to its presence here. -

    DatabaseFS

    - URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php -

    By Eric Lorimer.

    - I have created a VFS module which implements a fairly complete read-only - filesystem. It presents information from a database as a filesystem in +

    DatabaseFS

    + URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php +

    By Eric Lorimer.

    + I have created a VFS module that implements a fairly complete read-only + filesystem. It presents information from a database as a filesystem in a modular and generic way to allow different databases to be used (originally designed for organizing MP3s under directories such as - "Artists," "Song Keywords," etc... I have since applied it to a student - roster database very easily). The directory structure is stored in the + “Artists,” “Song Keywords,” and so on. I have since easily + applied it to a student + roster database.) The directory structure is stored in the database itself and the module makes no assumptions about the database structure beyond the table it requires to run.

    Any feedback would be appreciated: comments, suggestions, patches, - etc... If nothing else, hopefully it might prove useful for someone + and so on. If nothing else, hopefully it might prove useful for someone else who wishes to create a virtual filesystem. -

    vscan

    URL: http://www.openantivirus.org/

    - samba-vscan is a proof-of-concept module for Samba, which +

    vscan

    URL: http://www.openantivirus.org/

    + samba-vscan is a proof-of-concept module for Samba, which uses the VFS (virtual file system) features of Samba 2.2.x/3.0 alphaX. Of course, Samba has to be compiled with VFS support. - samba-vscan supports various virus scanners and is maintained + samba-vscan supports various virus scanners and is maintained by Rainer Link. -

    Chapter 21. Winbind: Use of Domain Accounts

    Tim Potter

    Samba Team

    Andrew Tridgell

    Samba Team

    Naag Mummaneni

    Notes for Solaris

    John Trostel

    SNAP

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    27 June 2002

    Table of Contents

    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning

    Features and Benefits

    +

    Chapter 21. Winbind: Use of Domain Accounts

    Tim Potter

    Samba Team

    Andrew Tridgell

    Samba Team

    Naag Mummaneni

    Notes for Solaris

    John Trostel

    SNAP

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    27 June 2002

    Table of Contents

    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    Winbind Is Not Resolving Users and Groups

    Features and Benefits

    Integration of UNIX and Microsoft Windows NT through a unified logon has - been considered a "holy grail" in heterogeneous computing environments for + been considered a “holy grail” in heterogeneous computing environments for a long time.

    There is one other facility without which UNIX and Microsoft Windows network @@ -11254,150 +11395,149 @@ should be implied due to its presence here. mechanism for sharing files across UNIX systems and to be able to assign domain user and group ownerships with integrity.

    - winbind is a component of the Samba suite of programs + winbind is a component of the Samba suite of programs that solves the unified logon problem. Winbind uses a UNIX implementation of Microsoft RPC calls, Pluggable Authentication Modules, and the Name Service Switch to allow Windows NT domain users to appear and operate as UNIX users on a UNIX - machine. This chapter describes the winbind system, explaining the functionality + machine. This chapter describes the Winbind system, explaining the functionality it provides, how it is configured, and how it works internally.

    Winbind provides three separate functions:

    • - Authentication of user credentials (via PAM) + Authentication of user credentials (via PAM).

    • - Identity resolution (via NSS)` + Identity resolution (via NSS).

    • - Windindd maintains a database called winbind_idmap.tdb in which it stores + Winbind maintains a database called winbind_idmap.tdb in which it stores mappings between UNIX UIDs / GIDs and NT SIDs. This mapping is used only for users and groups that do not have a local UID/GID. It stored the UID/GID allocated from the idmap uid/gid range that it has mapped to the NT SID. If idmap backend has been specified as ldapsam:url - then instead of using a local mapping winbindd will obtain this information + then instead of using a local mapping Winbind will obtain this information from the LDAP database.

    Note

    - If winbindd is not running, then smbd (which calls winbindd) will fall back to - using purely local information from /etc/passwd and /etc/group and no dynamic + If winbindd is not running, smbd (which calls winbindd) will fall back to + using purely local information from /etc/passwd and /etc/group and no dynamic mapping will be used. -

    Introduction

    It is well known that UNIX and Microsoft Windows NT have +

    Introduction

    It is well known that UNIX and Microsoft Windows NT have different models for representing user and group information and use different technologies for implementing them. This fact has made it difficult to integrate the two systems in a satisfactory manner.

    One common solution in use today has been to create identically named user accounts on both the UNIX and Windows systems and use the Samba suite of programs to provide file and print services - between the two. This solution is far from perfect however, as + between the two. This solution is far from perfect, however, as adding and deleting users on both sets of machines becomes a chore - and two sets of passwords are required both of which + and two sets of passwords are required both of which can lead to synchronization problems between the UNIX and Windows systems and confusion for users.

    We divide the unified logon problem for UNIX machines into - three smaller problems:

    • Obtaining Windows NT user and group information -

    • Authenticating Windows NT users -

    • Password changing for Windows NT users + three smaller problems:

      • Obtaining Windows NT user and group information. +

      • Authenticating Windows NT users. +

      • Password changing for Windows NT users.

      Ideally, a prospective solution to the unified logon problem would satisfy all the above components without duplication of information on the UNIX machines and without creating additional tasks for the system administrator when maintaining users and - groups on either system. The winbind system provides a simple + groups on either system. The Winbind system provides a simple and elegant solution to all three components of the unified logon - problem.

    What Winbind Provides

    Winbind unifies UNIX and Windows NT account management by - allowing a UNIX box to become a full member of a NT domain. Once + problem.

    What Winbind Provides

    Winbind unifies UNIX and Windows NT account management by + allowing a UNIX box to become a full member of an NT domain. Once this is done the UNIX box will see NT users and groups as if - they were native UNIX users and groups, allowing the NT domain + they were “native” UNIX users and groups, allowing the NT domain to be used in much the same manner that NIS+ is used within UNIX-only environments.

    The end result is that whenever any program on the UNIX machine asks the operating system to lookup a user or group name, the query will be resolved by asking the - NT domain controller for the specified domain to do the lookup. + NT Domain Controller for the specified domain to do the lookup. Because Winbind hooks into the operating system at a low level - (via the NSS name resolution modules in the C library) this - redirection to the NT domain controller is completely + (via the NSS name resolution modules in the C library), this + redirection to the NT Domain Controller is completely transparent.

    Users on the UNIX machine can then use NT user and group - names as they would use "native" UNIX names. They can chown files - so that they are owned by NT domain users or even login to the + names as they would “native” UNIX names. They can chown files + so they are owned by NT domain users or even login to the UNIX machine and run a UNIX X-Window session as a domain user.

    The only obvious indication that Winbind is being used is - that user and group names take the form DOMAIN\user and - DOMAIN\group. This is necessary as it allows Winbind to determine - that redirection to a domain controller is wanted for a particular + that user and group names take the form DOMAIN\user and + DOMAIN\group. This is necessary as it allows Winbind to determine + that redirection to a Domain Controller is wanted for a particular lookup and which trusted domain is being referenced.

    Additionally, Winbind provides an authentication service that hooks into the Pluggable Authentication Modules (PAM) system - to provide authentication via a NT domain to any PAM enabled + to provide authentication via an NT domain to any PAM-enabled applications. This capability solves the problem of synchronizing passwords between systems since all passwords are stored in a single - location (on the domain controller).

    Target Uses

    Winbind is targeted at organizations that have an - existing NT based domain infrastructure into which they wish + location (on the Domain Controller).

    Target Uses

    Winbind is targeted at organizations that have an + existing NT-based domain infrastructure into which they wish to put UNIX workstations or servers. Winbind will allow these organizations to deploy UNIX workstations without having to maintain a separate account infrastructure. This greatly simplifies the administrative overhead of deploying UNIX - workstations into a NT based organization.

    Another interesting way in which we expect Winbind to - be used is as a central part of UNIX based appliances. Appliances - that provide file and print services to Microsoft based networks + workstations into an NT-based organization.

    Another interesting way in which we expect Winbind to + be used is as a central part of UNIX-based appliances. Appliances + that provide file and print services to Microsoft-based networks will be able to use Winbind to provide seamless integration of - the appliance into the domain.

    How Winbind Works

    The winbind system is designed around a client/server + the appliance into the domain.

    How Winbind Works

    The Winbind system is designed around a client/server architecture. A long running winbindd daemon listens on a UNIX domain socket waiting for requests to arrive. These requests are generated by the NSS and PAM - clients and processed sequentially.

    The technologies used to implement winbind are described - in detail below.

    Microsoft Remote Procedure Calls

    Over the last few years, efforts have been underway + clients and is processed sequentially.

    The technologies used to implement Winbind are described + in detail below.

    Microsoft Remote Procedure Calls

    Over the last few years, efforts have been underway by various Samba Team members to decode various aspects of the Microsoft Remote Procedure Call (MSRPC) system. This - system is used for most network related operations between + system is used for most network-related operations between Windows NT machines including remote management, user authentication and print spooling. Although initially this work was done to aid the implementation of Primary Domain Controller (PDC) - functionality in Samba, it has also yielded a body of code which + functionality in Samba, it has also yielded a body of code that can be used for other purposes.

    Winbind uses various MSRPC calls to enumerate domain users and groups and to obtain detailed information about individual users or groups. Other MSRPC calls can be used to authenticate NT domain users and to change user passwords. By directly querying - a Windows PDC for user and group information, winbind maps the - NT account information onto UNIX user and group names.

    Microsoft Active Directory Services

    + a Windows PDC for user and group information, Winbind maps the + NT account information onto UNIX user and group names.

    Microsoft Active Directory Services

    Since late 2001, Samba has gained the ability to - interact with Microsoft Windows 2000 using its 'Native - Mode' protocols, rather than the NT4 RPC services. - Using LDAP and Kerberos, a domain member running - winbind can enumerate users and groups in exactly the - same way as a Win2k client would, and in so doing - provide a much more efficient and - effective winbind implementation. -

    Name Service Switch

    The Name Service Switch, or NSS, is a feature that is + interact with Microsoft Windows 2000 using its “Native + Mode” protocols, rather than the NT4 RPC services. + Using LDAP and Kerberos, a Domain Member running + Winbind can enumerate users and groups in exactly the + same way as a Windows 200x client would, and in so doing + provide a much more efficient and effective Winbind implementation. +

    Name Service Switch

    The Name Service Switch, or NSS, is a feature that is present in many UNIX operating systems. It allows system information such as hostnames, mail aliases and user information to be resolved from different sources. For example, a standalone UNIX workstation may resolve system information from a series of flat files stored on the local filesystem. A networked workstation may first attempt to resolve system information from local files, - and then consult a NIS database for user information or a DNS server - for hostname information.

    The NSS application programming interface allows winbind + and then consult an NIS database for user information or a DNS server + for hostname information.

    The NSS application programming interface allows Winbind to present itself as a source of system information when - resolving UNIX usernames and groups. Winbind uses this interface, + resolving UNIX usernames and groups. Winbind uses this interface, and information obtained from a Windows NT server using MSRPC - calls to provide a new source of account enumeration. Using standard + calls to provide a new source of account enumeration. Using standard UNIX library calls, one can enumerate the users and groups on - a UNIX machine running winbind and see all users and groups in + a UNIX machine running Winbind and see all users and groups in a NT domain plus any trusted domain as though they were local users and groups.

    The primary control file for NSS is /etc/nsswitch.conf. - When a UNIX application makes a request to do a lookup + When a UNIX application makes a request to do a lookup, the C library looks in /etc/nsswitch.conf - for a line which matches the service type being requested, for - example the "passwd" service type is used when user or group names - are looked up. This config line specifies which implementations + for a line that matches the service type being requested, for + example the “passwd” service type is used when user or group names + are looked up. This config line specifies which implementations of that service should be tried and in what order. If the passwd - config line is:

    -passwd: files example
+		config line is:
    +		passwd: files example
 		
    then the C library will first load a module called 
 		/lib/libnss_files.so followed by
 		the module /lib/libnss_example.so. The 
 		C library will dynamically load each of these modules in turn 
 		and call resolver functions within the modules to try to resolve 
-		the request. Once the request is resolved the C library returns the
-		result to the application.
    This NSS interface provides a very easy way for Winbind 
+		the request. Once the request is resolved, the C library returns the
+		result to the application.
    This NSS interface provides an easy way for Winbind 
 		to hook into the operating system. All that needs to be done 
 		is to put libnss_winbind.so in /lib/ 
-		then add "winbind" into /etc/nsswitch.conf at 
+		then add “winbind” into /etc/nsswitch.conf at 
 		the appropriate place. The C library will then call Winbind to 
-		resolve user and group names.

    Pluggable Authentication Modules

    Pluggable Authentication Modules, also known as PAM, + resolve user and group names.

    Pluggable Authentication Modules

    Pluggable Authentication Modules, also known as PAM, is a system for abstracting authentication and authorization technologies. With a PAM module it is possible to specify different authentication methods for different system applications without @@ -11414,101 +11554,93 @@ passwd: files example

    PAM is configured by providing control files in the directory /etc/pam.d/ for each of the services that require authentication. When an authentication request is made - by an application the PAM code in the C library looks up this + by an application, the PAM code in the C library looks up this control file to determine what modules to load to do the authentication check and in what order. This interface makes adding - a new authentication service for Winbind very easy, all that needs + a new authentication service for Winbind very easy. All that needs to be done is that the pam_winbind.so module is copied to /lib/security/ and the PAM control files for relevant services are updated to allow - authentication via winbind. See the PAM documentation - for more details.

    User and Group ID Allocation

    When a user or group is created under Windows NT - is it allocated a numerical relative identifier (RID). This is - slightly different to UNIX which has a range of numbers that are + authentication via Winbind. See the PAM documentation + in for more information.

    User and Group ID Allocation

    When a user or group is created under Windows NT/200x + it is allocated a numerical relative identifier (RID). This is + slightly different from UNIX which has a range of numbers that are used to identify users, and the same range in which to identify - groups. It is winbind's job to convert RIDs to UNIX id numbers and - vice versa. When winbind is configured it is given part of the UNIX - user id space and a part of the UNIX group id space in which to + groups. It is Winbind's job to convert RIDs to UNIX ID numbers and + vice versa. When Winbind is configured, it is given part of the UNIX + user ID space and a part of the UNIX group ID space in which to store Windows NT users and groups. If a Windows NT user is - resolved for the first time, it is allocated the next UNIX id from + resolved for the first time, it is allocated the next UNIX ID from the range. The same process applies for Windows NT groups. Over - time, winbind will have mapped all Windows NT users and groups - to UNIX user ids and group ids.

    The results of this mapping are stored persistently in + time, Winbind will have mapped all Windows NT users and groups + to UNIX user IDs and group IDs.

    The results of this mapping are stored persistently in an ID mapping database held in a tdb database). This ensures that - RIDs are mapped to UNIX IDs in a consistent way.

    Result Caching

    An active system can generate a lot of user and group - name lookups. To reduce the network cost of these lookups winbind + RIDs are mapped to UNIX IDs in a consistent way.

    Result Caching

    + + An active system can generate a lot of user and group + name lookups. To reduce the network cost of these lookups, Winbind uses a caching scheme based on the SAM sequence number supplied - by NT domain controllers. User or group information returned - by a PDC is cached by winbind along with a sequence number also + by NT Domain Controllers. User or group information returned + by a PDC is cached by Winbind along with a sequence number also returned by the PDC. This sequence number is incremented by Windows NT whenever any user or group information is modified. If a cached entry has expired, the sequence number is requested from the PDC and compared against the sequence number of the cached entry. If the sequence numbers do not match, then the cached information - is discarded and up to date information is requested directly - from the PDC.

    Installation and Configuration

    Introduction

    -This section describes the procedures used to get winbind up and -running. Winbind is capable of providing access + is discarded and up-to-date information is requested directly + from the PDC.

    Installation and Configuration

    Introduction

    +This section describes the procedures used to get Winbind up and +running. Winbind is capable of providing access and authentication control for Windows Domain users through an NT -or Win2K PDC for 'regular' services, such as telnet a nd ftp, as -well for SAMBA services. +or Windows 200x PDC for regular services, such as telnet and ftp, as +well for Samba services.

    • - Why should I to this? -

      This allows the SAMBA administrator to rely on the - authentication mechanisms on the NT/Win2K PDC for the authentication - of domain members. NT/Win2K users no longer need to have separate - accounts on the SAMBA server. + Why should I do this? +

      This allows the Samba administrator to rely on the + authentication mechanisms on the Windows NT/200x PDC for the authentication + of Domain Members. Windows NT/200x users no longer need to have separate + accounts on the Samba server.

    • Who should be reading this document?

      - This HOWTO is designed for system administrators. If you are - implementing SAMBA on a file server and wish to (fairly easily) - integrate existing NT/Win2K users from your PDC onto the - SAMBA server, this HOWTO is for you. That said, I am no NT or PAM - expert, so you may find a better or easier way to accomplish - these tasks. -

    Requirements

    -If you have a Samba configuration file that you are currently -using... BACK IT UP! If your system already uses PAM, -back up the /etc/pam.d directory -contents! If you haven't already made a boot disk, -MAKE ONE NOW! -

    -Messing with the PAM configuration files can make it nearly impossible -to log in to your machine. That's why you want to be able to boot back -into your machine in single user mode and restore your -/etc/pam.d back to the original state they were in if -you get frustrated with the way things are going. ;-) -

    -The latest version of SAMBA (version 3.0 as of this writing), now -includes a functioning winbindd daemon. Please refer to the -main SAMBA web page or, -better yet, your closest SAMBA mirror site for instructions on -downloading the source code. -

    -To allow Domain users the ability to access SAMBA shares and -files, as well as potentially other services provided by your -SAMBA machine, PAM (pluggable authentication modules) must -be setup properly on your machine. In order to compile the -winbind modules, you should have at least the pam libraries resident -on your system. For recent RedHat systems (7.1, for instance), that -means pam-0.74-22. For best results, it is helpful to also -install the development packages in pam-devel-0.74-22. -

    Testing Things Out

    -Before starting, it is probably best to kill off all the SAMBA -related daemons running on your server. Kill off all smbd, -nmbd, and winbindd processes that may -be running. To use PAM, you will want to make sure that you have the -standard PAM package which supplies the /etc/pam.d -directory structure, including the pam modules are used by pam-aware -services, several pam libraries, and the /usr/doc -and /usr/man entries for pam. Winbind built better -in SAMBA if the pam-devel package was also installed. This package includes -the header files needed to compile pam-aware applications. -

    Configure nsswitch.conf and the -winbind libraries on Linux and Solaris

    -The libraries needed to run the winbindd daemon -through nsswitch need to be copied to their proper locations, so + This document is designed for system administrators. If you are + implementing Samba on a file server and wish to (fairly easily) + integrate existing Windows NT/200x users from your PDC onto the + Samba server, this document is for you. +

    Requirements

    +If you have a Samba configuration file that you are currently using, BACK IT UP! +If your system already uses PAM, back up the /etc/pam.d directory +contents! If you haven't already made a boot disk, MAKE ONE NOW! +

    +Messing with the PAM configuration files can make it nearly impossible to log in to your machine. That's +why you want to be able to boot back into your machine in single user mode and restore your +/etc/pam.d back to the original state they were in if you get frustrated with the +way things are going. +

    +The latest version of Samba-3 includes a functioning winbindd daemon. Please refer to the main Samba Web page or, better yet, your closest Samba mirror site for +instructions on downloading the source code. +

    +To allow domain users the ability to access Samba shares and files, as well as potentially other services +provided by your Samba machine, PAM must be set up properly on your +machine. In order to compile the Winbind modules, you should have at least the PAM development libraries installed +on your system. Please refer the PAM web site http://www.kernel.org/pub/linux/libs/pam/. +

    Testing Things Out

    +Before starting, it is probably best to kill off all the Samba-related daemons running on your server. +Kill off all smbd, nmbd, and winbindd processes that may be running. To use PAM, +make sure that you have the standard PAM package that supplies the /etc/pam.d +directory structure, including the PAM modules that are used by PAM-aware services, several pam libraries, +and the /usr/doc and /usr/man entries for pam. Winbind built +better in Samba if the pam-devel package is also installed. This package includes the header files +needed to compile PAM-aware applications. +

    Configure nsswitch.conf and the Winbind Libraries on Linux and Solaris

    +PAM is a standard component of most current generation UNIX/Linux systems. Unfortunately, few systems install +the pam-devel libraries that are needed to build PAM-enabled Samba. Additionally, Samba-3 +may auto-install the Winbind files into their correct locations on your system, so before you get too far down +the track be sure to check if the following configuration is really +necessary. You may only need to configure +/etc/nsswitch.conf. +

    +The libraries needed to run the winbindd daemon through nsswitch need to be copied to their proper locations: 

     root# cp ../samba/source/nsswitch/libnss_winbind.so /lib
@@ -11524,94 +11656,91 @@ I also found it necessary to make the following symbolic link:

    Now, as root you need to edit /etc/nsswitch.conf to allow user and group entries to be visible from the winbindd -daemon. My /etc/nsswitch.conf file look like +daemon. My /etc/nsswitch.conf file look like this after editing: 

     	passwd:     files winbind
 	shadow:     files 
 	group:      files winbind

    -The libraries needed by the winbind daemon will be automatically +The libraries needed by the winbindd daemon will be automatically entered into the ldconfig cache the next time -your system reboots, but it -is faster (and you don't need to reboot) if you do it manually: +your system reboots, but it is faster (and you do not need to reboot) if you do it manually:

    root# /sbin/ldconfig -v | grep winbind

    This makes libnss_winbind available to winbindd and echos back a check to you. -

    NSS Winbind on AIX

    (This section is only for those running AIX)

    -The winbind AIX identification module gets built as libnss_winbind.so in the -nsswitch directory of the samba source. This file can be copied to -/usr/lib/security, and the AIX naming convention would indicate that it -should be named WINBIND. A stanza like the following: +

    NSS Winbind on AIX

    (This section is only for those running AIX.)

    +The Winbind AIX identification module gets built as libnss_winbind.so in the +nsswitch directory of the Samba source. This file can be copied to /usr/lib/security, +and the AIX naming convention would indicate that it should be named WINBIND. A stanza like the following: 

     WINBIND:
         program = /usr/lib/security/WINBIND
         options = authonly
-

    can then be added to -/usr/lib/security/methods.cfg. This module only -supports identification, but there have been success reports using the -standard winbind pam module for authentication. Use caution configuring -loadable authentication modules as it is possible to make it impossible -to logon to the system. More information about the AIX authentication -module API can be found at "Kernel Extensions and Device Support -Programming Concepts for AIX": -Chapter 18. Loadable Authentication Module Programming Interface -and more information on administering the modules at -"System Management Guide: Operating System and Devices". -

    Configure smb.conf

    -Several parameters are needed in the smb.conf file to control -the behavior of winbindd. Configure -smb.conf These are described in more detail in -the winbindd(8) man page. My -smb.conf file was modified to -include the following entries in the [global] section: -

    Example 21.1. smb.conf for winbind set-up

    [global]
    ...
    # separate domain and username with '+', like DOMAIN+username
    winbind separator = +
    # use uids from 10000 to 20000 for domain users
    idmap uid = 10000-20000
    # use gids from 10000 to 20000 for domain groups
    winbind gid = 10000-20000
    # allow enumeration of winbind users and groups
    winbind enum users = yes
    winbind enum groups = yes
    # give winbind users a real shell (only needed if they have telnet access)
    template homedir = /home/winnt/%D/%U
    template shell = /bin/bash

    Join the SAMBA server to the PDC domain

    -Enter the following command to make the SAMBA server join the +

    +can then be added to /usr/lib/security/methods.cfg. This module only supports +identification, but there have been success reports using the standard Winbind PAM module for +authentication. Use caution configuring loadable authentication +modules since you can make +it impossible to logon to the system. More information about the AIX authentication module API can +be found at “Kernel Extensions and Device Support Programming Concepts for AIX” +in Chapter 18(John, there is no section like this in 18). Loadable Authentication Module Programming +Interface and more information on administering the modules +can be found at System +Management Guide: Operating System and Devices. +

    Configure smb.conf

    +Several parameters are needed in the smb.conf file to control the behavior of winbindd. These +are described in more detail in the winbindd(8) man page. My smb.conf file, as shown in , was modified to include the necessary entries in the [global] section. +

    Example 21.1. smb.conf for Winbind set-up

    [global]
    # separate domain and username with '+', like DOMAIN+username
    winbind separator = +
    # use uids from 10000 to 20000 for domain users
    idmap uid = 10000-20000
    # use gids from 10000 to 20000 for domain groups
    winbind gid = 10000-20000
    # allow enumeration of winbind users and groups
    winbind enum users = yes
    winbind enum groups = yes
    # give winbind users a real shell (only needed if they have telnet access)
    template homedir = /home/winnt/%D/%U
    template shell = /bin/bash

    Join the Samba Server to the PDC Domain

    +Enter the following command to make the Samba server join the PDC domain, where DOMAIN is the name of your Windows domain and Administrator is a domain user who has administrative privileges in the domain.

    root# /usr/local/samba/bin/net rpc join -S PDC -U Administrator

    -The proper response to the command should be: "Joined the domain -DOMAIN" where DOMAIN +The proper response to the command should be: “Joined the domain +DOMAIN” where DOMAIN is your DOMAIN name. -

    Start up the winbindd daemon and test it!

    -Eventually, you will want to modify your smb startup script to +

    Starting and Testing the winbindd Daemon

    +Eventually, you will want to modify your Samba startup script to automatically invoke the winbindd daemon when the other parts of -SAMBA start, but it is possible to test out just the winbind -portion first. To start up winbind services, enter the following +Samba start, but it is possible to test out just the Winbind +portion first. To start up Winbind services, enter the following command as root:

    root# /usr/local/samba/bin/winbindd -

    -Winbindd can now also run in 'dual daemon mode'. This will make it -run as 2 processes. The first will answer all requests from the cache, +

    Note

    +The above assumes that Samba has been installed in the /usr/local/samba +directory tree. You may need to search for the location of Samba files if this is not the +location of winbindd on your system. +

    +Winbindd can now also run in “dual daemon modei”. This will make it +run as two processes. The first will answer all requests from the cache, thus making responses to clients faster. The other will update the cache for the query that the first has just responded. -Advantage of this is that responses stay accurate and are faster. +The advantage of this is that responses stay accurate and are faster. You can enable dual daemon mode by adding -B to the commandline:

    root# /usr/local/samba/bin/winbindd -B

    -I'm always paranoid and like to make sure the daemon -is really running... +I'm always paranoid and like to make sure the daemon is really running.

    root# ps -ae | grep winbindd

    -This command should produce output like this, if the daemon is running +This command should produce output like this, if the daemon is running you would expect +to see a report something like this: 

     3025 ?        00:00:00 winbindd

    -Now... for the real test, try to get some information about the -users on your PDC +Now, for the real test, try to get some information about the users on your PDC:

    root# /usr/local/samba/bin/wbinfo -u

    This should echo back a list of users on your Windows users on -your PDC. For example, I get the following response: +your PDC. For example, I get the following response: 

     	CEO+Administrator
 	CEO+burdell
@@ -11620,10 +11749,9 @@ your PDC.  For example, I get the following response:
 	CEO+krbtgt
 	CEO+TsInternetUser

    - Obviously, I have named my domain 'CEO' and my winbind separator is '+'. +Obviously, I have named my domain “CEO” and my winbind separator is “+”.

    -You can do the same sort of thing to get group information from -the PDC: +You can do the same sort of thing to get group information from the PDC: 

     root# /usr/local/samba/bin/wbinfo -g
 	CEO+Domain Admins
@@ -11636,28 +11764,26 @@ the PDC:
 	CEO+Enterprise Admins
 	CEO+Group Policy Creator Owners

    -The function 'getent' can now be used to get unified -lists of both local and PDC users and groups. -Try the following command: +The function getent can now be used to get unified +lists of both local and PDC users and groups. Try the following command:

    root# getent passwd

    You should get a list that looks like your /etc/passwd -list followed by the domain users with their new uids, gids, home +list followed by the domain users with their new UIDs, GIDs, home directories and default shells.

    -The same thing can be done for groups with the command +The same thing can be done for groups with the command:

    root# getent group -

    Fix the init.d startup scripts

    Linux

    -The winbindd daemon needs to start up after the -smbd and nmbd daemons are running. +

    Fix the init.d Startup Scripts

    Linux

    +The winbindd daemon needs to start up after the smbd and nmbd daemons are running. To accomplish this task, you need to modify the startup scripts of your system. -They are located at /etc/init.d/smb in RedHat and -/etc/init.d/samba in Debian. -script to add commands to invoke this daemon in the proper sequence. My +They are located at /etc/init.d/smb in Red Hat Linux and they are located in +/etc/init.d/samba in Debian Linux. Edit your +script to add commands to invoke this daemon in the proper sequence. My startup script starts up smbd, nmbd, and winbindd from the -/usr/local/samba/bin directory directly. The 'start' +/usr/local/samba/bin directory directly. The start function in the script looks like this: 

     start() {
@@ -11681,7 +11807,7 @@ start() {
         return $RETVAL
 }

    If you would like to run winbindd in dual daemon mode, replace -the line +the line : 

             daemon /usr/local/samba/bin/winbindd

    @@ -11692,7 +11818,7 @@ in the example above with: daemon /usr/local/samba/bin/winbindd -B

    .

    -The 'stop' function has a corresponding entry to shut down the +The stop function has a corresponding entry to shut down the services and looks like this: 

     stop() {
@@ -11715,11 +11841,12 @@ stop() {
         echo ""
         return $RETVAL
 }
-
    Solaris

    Winbind doesn't work on Solaris 9, see the Portability chapter for details.

    On Solaris, you need to modify the -/etc/init.d/samba.server startup script. It usually -only starts smbd and nmbd but should now start winbindd too. If you -have samba installed in /usr/local/samba/bin, -the file could contains something like this: +

    Solaris

    +Winbind does not work on Solaris 9, see for details. +

    +On Solaris, you need to modify the /etc/init.d/samba.server startup script. It +usually only starts smbd and nmbd but should now start winbindd, too. If you have Samba installed in +/usr/local/samba/bin, the file could contains something like this: 

     	##
 	## samba.server
@@ -11737,7 +11864,7 @@ the file could contains something like this:
 		[ "$pid" != "" ] && kill $pid
 	}
 	 
-	# Start/stop processes required for samba server
+	# Start/stop processes required for Samba server
 
 	case "$1" in
 
@@ -11768,336 +11895,365 @@ the file could contains something like this:
 	   ;;
 	esac

    -Again, if you would like to run samba in dual daemon mode, replace +Again, if you would like to run Samba in dual daemon mode, replace: 

     	/usr/local/samba/bin/winbindd

    - in the script above with: - 

     	/usr/local/samba/bin/winbindd -B

    -

    Restarting

    +

    Restarting

    If you restart the smbd, nmbd, and winbindd daemons at this point, you -should be able to connect to the samba server as a domain member just as +should be able to connect to the Samba server as a Domain Member just as if you were a local user. -

    Configure Winbind and PAM

    -If you have made it this far, you know that winbindd and samba are working -together. If you want to use winbind to provide authentication for other -services, keep reading. The pam configuration files need to be altered in -this step. (Did you remember to make backups of your original +

    Configure Winbind and PAM

    +If you have made it this far, you know that winbindd and Samba are working +together. If you want to use Winbind to provide authentication for other +services, keep reading. The PAM configuration files need to be altered in +this step. (Did you remember to make backups of your original /etc/pam.d files? If not, do it now.)

    -You will need a pam module to use winbindd with these other services. This +You will need a PAM module to use winbindd with these other services. This module will be compiled in the ../source/nsswitch directory -by invoking the command +by invoking the command:

    root# make nsswitch/pam_winbind.so

    -from the ../source directory. The +from the ../source directory. The pam_winbind.so file should be copied to the location of -your other pam security modules. On my RedHat system, this was the -/lib/security directory. On Solaris, the pam security +your other PAM security modules. On my RedHat system, this was the +/lib/security directory. On Solaris, the PAM security modules reside in /usr/lib/security.

    root# cp ../samba/source/nsswitch/pam_winbind.so /lib/security -

    Linux/FreeBSD-specific PAM configuration

    +

    Linux/FreeBSD-specific PAM configuration

    The /etc/pam.d/samba file does not need to be changed. I just left this file as it was: 

     	auth    required        /lib/security/pam_stack.so service=system-auth
 	account required        /lib/security/pam_stack.so service=system-auth

    -The other services that I modified to allow the use of winbind +The other services that I modified to allow the use of Winbind as an authentication service were the normal login on the console (or a terminal -session), telnet logins, and ftp service. In order to enable these +session), telnet logins, and ftp service. In order to enable these services, you may first need to change the entries in -/etc/xinetd.d (or /etc/inetd.conf). -RedHat 7.1 uses the new xinetd.d structure, in this case you need +/etc/xinetd.d (or /etc/inetd.conf). +Red Hat Linux 7.1 and later uses the new xinetd.d structure, in this case you need to change the lines in /etc/xinetd.d/telnet and /etc/xinetd.d/wu-ftp from 

     	enable = no

    -to +to: 

     	enable = yes

    For ftp services to work properly, you will also need to either have individual directories for the domain users already present on the server, or change the home directory template to a general -directory for all domain users. These can be easily set using +directory for all domain users. These can be easily set using the smb.conf global entry -template homedir. +template homedir.

    The /etc/pam.d/ftp file can be changed -to allow winbind ftp access in a manner similar to the -samba file. My /etc/pam.d/ftp file was +to allow Winbind ftp access in a manner similar to the +samba file. My /etc/pam.d/ftp file was changed to look like this: 

    -	auth       required     /lib/security/pam_listfile.so item=user sense=deny \
-		 file=/etc/ftpusers onerr=succeed
-	auth       sufficient   /lib/security/pam_winbind.so
-	auth       required     /lib/security/pam_stack.so service=system-auth
-	auth       required     /lib/security/pam_shells.so
-	account    sufficient   /lib/security/pam_winbind.so
-	account    required     /lib/security/pam_stack.so service=system-auth
-	session    required     /lib/security/pam_stack.so service=system-auth
+auth       required     /lib/security/pam_listfile.so item=user sense=deny \
+	 file=/etc/ftpusers onerr=succeed
+auth       sufficient   /lib/security/pam_winbind.so
+auth       required     /lib/security/pam_stack.so service=system-auth
+auth       required     /lib/security/pam_shells.so
+account    sufficient   /lib/security/pam_winbind.so
+account    required     /lib/security/pam_stack.so service=system-auth
+session    required     /lib/security/pam_stack.so service=system-auth

    The /etc/pam.d/login file can be changed nearly the -same way. It now looks like this: +same way. It now looks like this: 

    -	auth       required     /lib/security/pam_securetty.so
-	auth       sufficient   /lib/security/pam_winbind.so
-	auth       sufficient   /lib/security/pam_unix.so use_first_pass
-	auth       required     /lib/security/pam_stack.so service=system-auth
-	auth       required     /lib/security/pam_nologin.so
-	account    sufficient   /lib/security/pam_winbind.so
-	account    required     /lib/security/pam_stack.so service=system-auth
-	password   required     /lib/security/pam_stack.so service=system-auth
-	session    required     /lib/security/pam_stack.so service=system-auth
-	session    optional     /lib/security/pam_console.so
+auth       required     /lib/security/pam_securetty.so
+auth       sufficient   /lib/security/pam_winbind.so
+auth       sufficient   /lib/security/pam_UNIX.so use_first_pass
+auth       required     /lib/security/pam_stack.so service=system-auth
+auth       required     /lib/security/pam_nologin.so
+account    sufficient   /lib/security/pam_winbind.so
+account    required     /lib/security/pam_stack.so service=system-auth
+password   required     /lib/security/pam_stack.so service=system-auth
+session    required     /lib/security/pam_stack.so service=system-auth
+session    optional     /lib/security/pam_console.so

    In this case, I added the 

    auth sufficient /lib/security/pam_winbind.so

    lines as before, but also added the 

    required pam_securetty.so

    -above it, to disallow root logins over the network. I also added a +above it, to disallow root logins over the network. I also added a 

    sufficient /lib/security/pam_unix.so use_first_pass

    line after the winbind.so line to get rid of annoying double prompts for passwords. -

    Solaris-specific configuration

    -The /etc/pam.conf needs to be changed. I changed this file so that my Domain -users can logon both locally as well as telnet.The following are the changes -that I made.You can customize the pam.conf file as per your requirements,but +

    Solaris-specific configuration

    +The /etc/pam.conf needs to be changed. I changed this file so my Domain +users can logon both locally as well as telnet. The following are the changes +that I made. You can customize the pam.conf file as per your requirements, but be sure of those changes because in the worst case it will leave your system nearly impossible to boot. 

    -	#
-	#ident	"@(#)pam.conf	1.14	99/09/16 SMI"
-	#
-	# Copyright (c) 1996-1999, Sun Microsystems, Inc.
-	# All Rights Reserved.
-	#
-	# PAM configuration
-	#
-	# Authentication management
-	#
-	login   auth required   /usr/lib/security/pam_winbind.so
-	login	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass 
-	login	auth required 	/usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass 
-	#
-	rlogin  auth sufficient /usr/lib/security/pam_winbind.so
-	rlogin  auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1
-	rlogin	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
-	#
-	dtlogin auth sufficient /usr/lib/security/pam_winbind.so
-	dtlogin	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
-	#
-	rsh	auth required	/usr/lib/security/$ISA/pam_rhosts_auth.so.1
-	other   auth sufficient /usr/lib/security/pam_winbind.so
-	other	auth required	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
-	#
-	# Account management
-	#
-	login   account sufficient      /usr/lib/security/pam_winbind.so
-	login	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
-	login	account required	/usr/lib/security/$ISA/pam_unix.so.1 
-	#
-	dtlogin account sufficient      /usr/lib/security/pam_winbind.so
-	dtlogin	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
-	dtlogin	account required	/usr/lib/security/$ISA/pam_unix.so.1 
-	#
-	other   account sufficient      /usr/lib/security/pam_winbind.so
-	other	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
-	other	account required	/usr/lib/security/$ISA/pam_unix.so.1 
-	#
-	# Session management
-	#
-	other	session required	/usr/lib/security/$ISA/pam_unix.so.1 
-	#
-	# Password management
-	#
-	#other   password sufficient     /usr/lib/security/pam_winbind.so
-	other	password required	/usr/lib/security/$ISA/pam_unix.so.1 
-	dtsession auth required	/usr/lib/security/$ISA/pam_unix.so.1
-	#
-	# Support for Kerberos V5 authentication (uncomment to use Kerberos)
-	#
-	#rlogin	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
-	#login	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
-	#dtlogin	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
-	#other	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
-	#dtlogin	account optional /usr/lib/security/$ISA/pam_krb5.so.1
-	#other	account optional /usr/lib/security/$ISA/pam_krb5.so.1
-	#other	session optional /usr/lib/security/$ISA/pam_krb5.so.1
-	#other	password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
-

    -I also added a try_first_pass line after the winbind.so line to get rid of -annoying double prompts for passwords. +# +#ident "@(#)pam.conf 1.14 99/09/16 SMI" +# +# Copyright (c) 1996-1999, Sun Microsystems, Inc. +# All Rights Reserved. +# +# PAM configuration +# +# Authentication management +# +login auth required /usr/lib/security/pam_winbind.so +login auth required /usr/lib/security/$ISA/pam_UNIX.so.1 try_first_pass +login auth required /usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass +# +rlogin auth sufficient /usr/lib/security/pam_winbind.so +rlogin auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1 +rlogin auth required /usr/lib/security/$ISA/pam_UNIX.so.1 try_first_pass +# +dtlogin auth sufficient /usr/lib/security/pam_winbind.so +dtlogin auth required /usr/lib/security/$ISA/pam_UNIX.so.1 try_first_pass +# +rsh auth required /usr/lib/security/$ISA/pam_rhosts_auth.so.1 +other auth sufficient /usr/lib/security/pam_winbind.so +other auth required /usr/lib/security/$ISA/pam_UNIX.so.1 try_first_pass +# +# Account management +# +login account sufficient /usr/lib/security/pam_winbind.so +login account requisite /usr/lib/security/$ISA/pam_roles.so.1 +login account required /usr/lib/security/$ISA/pam_UNIX.so.1 +# +dtlogin account sufficient /usr/lib/security/pam_winbind.so +dtlogin account requisite /usr/lib/security/$ISA/pam_roles.so.1 +dtlogin account required /usr/lib/security/$ISA/pam_UNIX.so.1 +# +other account sufficient /usr/lib/security/pam_winbind.so +other account requisite /usr/lib/security/$ISA/pam_roles.so.1 +other account required /usr/lib/security/$ISA/pam_UNIX.so.1 +# +# Session management +# +other session required /usr/lib/security/$ISA/pam_UNIX.so.1 +# +# Password management +# +#other password sufficient /usr/lib/security/pam_winbind.so +other password required /usr/lib/security/$ISA/pam_UNIX.so.1 +dtsession auth required /usr/lib/security/$ISA/pam_UNIX.so.1 +# +# Support for Kerberos V5 authentication (uncomment to use Kerberos) +# +#rlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#login auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#dtlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#other auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +#dtlogin account optional /usr/lib/security/$ISA/pam_krb5.so.1 +#other account optional /usr/lib/security/$ISA/pam_krb5.so.1 +#other session optional /usr/lib/security/$ISA/pam_krb5.so.1 +#other password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass +

    +I also added a try_first_pass line after the winbind.so +line to get rid of annoying double prompts for passwords.

    Now restart your Samba and try connecting through your application that you configured in the pam.conf. -

    Conclusion

    The winbind system, through the use of the Name Service - Switch, Pluggable Authentication Modules, and appropriate - Microsoft RPC calls have allowed us to provide seamless - integration of Microsoft Windows NT domain users on a - UNIX system. The result is a great reduction in the administrative - cost of running a mixed UNIX and NT network.

    Common Errors

    Winbind has a number of limitations in its current +

    Conclusion

    The Winbind system, through the use of the Name Service +Switch, Pluggable Authentication Modules, and appropriate +Microsoft RPC calls have allowed us to provide seamless +integration of Microsoft Windows NT domain users on a +UNIX system. The result is a great reduction in the administrative +cost of running a mixed UNIX and NT network.

    Common Errors

    Winbind has a number of limitations in its current released version that we hope to overcome in future releases:

    • Winbind is currently only available for - the Linux, Solaris, AIX and IRIX operating systems, although ports to other operating + the Linux, Solaris, AIX, and IRIX operating systems, although ports to other operating systems are certainly possible. For such ports to be feasible, we require the C library of the target operating system to support the Name Service Switch and Pluggable Authentication Modules systems. This is becoming more common as NSS and - PAM gain support among UNIX vendors.

    • The mappings of Windows NT RIDs to UNIX ids + PAM gain support among UNIX vendors.

    • The mappings of Windows NT RIDs to UNIX IDs is not made algorithmically and depends on the order in which - unmapped users or groups are seen by winbind. It may be difficult - to recover the mappings of rid to UNIX id mapping if the file - containing this information is corrupted or destroyed.

    • Currently the winbind PAM module does not take + unmapped users or groups are seen by Winbind. It may be difficult + to recover the mappings of RID to UNIX ID mapping if the file + containing this information is corrupted or destroyed.

    • Currently the Winbind PAM module does not take into account possible workstation and logon time restrictions - that may be been set for Windows NT users, this is - instead up to the PDC to enforce.

    NSCD Problem Warning

    Note

    - Do NOT under ANY circumstances run nscd on any system - on which winbind is running. + that may be set for Windows NT users, this is + instead up to the PDC to enforce.

    NSCD Problem Warning

    Warning

    + Do not under any circumstances run nscd on any system + on which winbindd is running.

    If nscd is running on the UNIX/Linux system, then - even though NSSWITCH is correctly configured it will NOT be possible to resolve + even though NSSWITCH is correctly configured it will not be possible to resolve domain users and groups for file and directory controls. -

    Chapter 22. Advanced Network Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors

    +

    Winbind Is Not Resolving Users and Groups

    “ + My smb.conf file is correctly configured. I have specified + idmap uid = 12000, + and idmap gid = 3000-3500 + and winbind is running. When I do the following it all works fine. + ”

    +root# wbinfo -u
+MIDEARTH+maryo
+MIDEARTH+jackb
+MIDEARTH+ameds
+...
+MIDEARTH+root
+
+root# wbinfo -g
+MIDEARTH+Domain Users
+MIDEARTH+Domain Admins
+MIDEARTH+Domain Guests
+...
+MIDEARTH+Accounts
+
+root# getent passwd
+root:x:0:0:root:/root:/bin/bash
+bin:x:1:1:bin:/bin:/bin/bash
+...
+maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false
+

    “ +But the following command just fails: +

    +root# chown maryo a_file
+chown: `maryo': invalid user
+
    +This is driving me nuts! What can be wrong? +”

    +Same problem as the one above. +Your system is likely running nscd, the name service +caching daemon. Shut it down, do not restart it! You will find your problem resolved. +

    Chapter 22. Advanced Network Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachine.Com
    Network Logon Script Magic
    Adding Printers without User Intervention

    This section documents peripheral issues that are of great importance to network administrators who want to improve network resource access control, to automate the user -environment, and to make their lives a little easier. -

    Features and Benefits

    +environment and to make their lives a little easier. +

    Features and Benefits

    Often the difference between a working network environment and a well appreciated one can -best be measured by the little things that makes everything work more -harmoniously. A key part of every network environment solution is the ability to remotely -manage MS Windows workstations, to remotely access the Samba server, to provide customised -logon scripts, as well as other house keeping activities that help to sustain more reliable +best be measured by the little things that make everything work more +harmoniously. A key part of every network environment solution is the +ability to remotely +manage MS Windows workstations, remotely access the Samba server, provide customized +logon scripts, as well as other housekeeping activities that help to sustain more reliable network operations.

    -This chapter presents information on each of these area. They are placed here, and not in +This chapter presents information on each of these areas. They are placed here, and not in other chapters, for ease of reference. -

    Remote Server Administration

    -How do I get 'User Manager' and 'Server Manager'? -

    - Since I don't need to buy an NT4 Server, how do I get the 'User Manager for Domains', -the 'Server Manager'? -

    -Microsoft distributes a version of these tools called nexus for installation -on Windows 9x / Me systems. The tools set includes: -

    Server Manager
    User Manager for Domains
    Event Viewer

    -Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE -

    -The Windows NT 4.0 version of the 'User Manager for -Domains' and 'Server Manager' are available from Microsoft via ftp -from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE -

    Remote Desktop Management

    +

    Remote Server Administration

    “How do I get `User Manager' and `Server Manager'?”

    + + + +Since I do not need to buy an NT4 Server, how do I get the `User Manager for Domains' +and the `Server Manager'? +

    + +Microsoft distributes a version of these tools called Nexus.exe for installation +on Windows 9x/Me systems. The tools set includes: +

    • Server Manager
    • User Manager for Domains
    • Event Viewer

    +Download the archived file at ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE. +

    + +The Windows NT 4.0 version of the `User Manager for +Domains' and `Server Manager' are available from Microsoft via ftp. +

    Remote Desktop Management

    There are a number of possible remote desktop management solutions that range from free -through costly. Do not let that put you off. Sometimes the most costly solutions is the +through costly. Do not let that put you off. Sometimes the most costly solution is the most cost effective. In any case, you will need to draw your own conclusions as to which is the best tool in your network environment. -

    Remote Management from NoMachines.Com

    +

    Remote Management from NoMachine.Com

    + The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003. It is presented in slightly edited form (with author details omitted for privacy reasons). The entire answer is reproduced below with some comments removed. -

    -

    -> I have a wonderful linux/samba server running as PDC for a network.
-> Now I would like to add remote desktop capabilities so that
-> users outside could login to the system and get their desktop up from
-> home or another country..
->
-> Is there a way to accomplish this? Do I need a windows terminal server?
-> Do I need to configure it so that it is a member of the domain or a
-> BDC,PDC? Are there any hacks for MS Windows XP to enable remote login
-> even if the computer is in a domain?
->
-> Any ideas/experience would be appreciated :)
-

    -

    - Answer provided: Check out the new offer from NoMachine, "NX" software: - http://www.nomachine.com/. -

    - It implements a very easy-to-use interface to the remote X protocol as +

    “ + I have a wonderful Linux/Samba server running as pdc for a network. Now I would like to add remote + desktop capabilities so users outside could login to the system and get their desktop up from home or + another country. + ”

    “ + Is there a way to accomplish this? Do I need a Windows Terminal Server? Do I need to configure it so + it is a member of the domain or a BDC,PDC? Are there any hacks for MS Windows XP to enable remote login + even if the computer is in a domain? + ”

    + Answer provided: Check out the new offer from NoMachine, “NX” software: + http://www.nomachine.com/. +

    + It implements an easy-to-use interface to the Remote X protocol as well as incorporating VNC/RFB and rdesktop/RDP into it, but at a speed - performance much better than anything you may have ever seen... + performance much better than anything you may have ever seen.

    - Remote X is not new at all -- but what they did achieve successfully is - a new way of compression and caching technologies which makes the thing + Remote X is not new at all, but what they did achieve successfully is + a new way of compression and caching technologies that makes the thing fast enough to run even over slow modem/ISDN connections.

    - I could test drive their (public) RedHat machine in Italy, over a loaded - internet connection, with enabled thumbnail previews in KDE konqueror - which popped up immediately on "mouse-over". From inside that (remote X) + I could test drive their (public) Red Hat machine in Italy, over a loaded + Internet connection, with enabled thumbnail previews in KDE konqueror + which popped up immediately on “mouse-over”. From inside that (remote X) session I started a rdesktop session on another, a Windows XP machine. - To test the performance, I played Pinball. I am proud to announce here - that my score was 631750 points at first try... + To test the performance, I played Pinball. I am proud to announce + that my score was 631750 points at first try.

    - NX performs better on my local LAN than any of the other "pure" + NX performs better on my local LAN than any of the other “pure” connection methods I am using from time to time: TightVNC, rdesktop or - remote X. It is even faster than a direct crosslink connection between + Remote X. It is even faster than a direct crosslink connection between two nodes.

    - I even got sound playing from the remote X app to my local boxes, and - had a working "copy'n'paste" from an NX window (running a KDE session - in Italy) to my Mozilla mailing agent... These guys are certainly doing + I even got sound playing from the Remote X app to my local boxes, and + had a working “copy'n'paste” from an NX window (running a KDE session + in Italy) to my Mozilla mailing agent. These guys are certainly doing something right!

    - I recommend to test drive NX to anybody with a only a remote interest - in remote computing - http://www.nomachine.com/testdrive.php. + I recommend to test drive NX to anybody with a only a passing interest in remote computing + http://www.nomachine.com/testdrive.php.

    - Just download the free of charge client software (available for RedHat, - SuSE, Debian and Windows) and be up and running within 5 minutes (they + Just download the free of charge client software (available for Red Hat, + SuSE, Debian and Windows) and be up and running within five minutes (they need to send you your account data, though, because you are assigned - a real Unix account on their testdrive.nomachine.com box... + a real UNIX account on their testdrive.nomachine.com box.

    They plan to get to the point were you can have NX application servers running as a cluster of nodes, and users simply start an NX session locally, and can select applications to run transparently (apps may even run on another NX node, but pretend to be on the same as used for initial login, - because it displays in the same window.... well, you also can run it + because it displays in the same window. You also can run it fullscreen, and after a short time you forget that it is a remote session at all).

    - Now the best thing at the end: all the core compression and caching + Now the best thing for last: All the core compression and caching technologies are released under the GPL and available as source code to anybody who wants to build on it! These technologies are working, albeit started from the command line only (and very inconvenient to - use in order to get a fully running remote X session up and running....) + use in order to get a fully running remote X session up and running.)

    To answer your questions:

    • - You don't need to install a terminal server; XP has RDP support built in. + You do not need to install a terminal server; XP has RDP support built in.

    • - NX is much cheaper than Citrix -- and comparable in performance, probably faster + NX is much cheaper than Citrix and comparable in performance, probably faster.

    • - You don't need to hack XP -- it just works + You do not need to hack XP it just works.

    • You log into the XP box from remote transparently (and I think there is no - need to change anything to get a connection, even if authentication is against a domain) + need to change anything to get a connection, even if authentication is against a domain).

    • - The NX core technologies are all Open Source and released under the GPL -- - you can today use a (very inconvenient) commandline to use it at no cost, - but you can buy a comfortable (proprietary) NX GUI frontend for money + The NX core technologies are all Open Source and released under the GPL + you can now use a (very inconvenient) commandline at no cost, + but you can buy a comfortable (proprietary) NX GUI frontend for money.

    • NoMachine are encouraging and offering help to OSS/Free Software implementations for such a frontend too, even if it means competition to them (they have written - to this effect even to the LTSP, KDE and GNOME developer mailing lists) -

    Network Logon Script Magic

    -This section needs work. Volunteer contributions most welcome. Please send your patches or updates -to John Terpstra. -

    + to this effect even to the LTSP, KDE and GNOME developer mailing lists). +

    Network Logon Script Magic

    There are several opportunities for creating a custom network startup configuration environment. -

    No Logon Script
    Simple universal Logon Script that applies to all users
    Use of a conditional Logon Script that applies per user or per group attributes
    Use of Samba's Preexec and Postexec functions on access to the NETLOGON share to create - a custom Logon Script and then execute it.
    User of a tool such as KixStart

    +

    • No Logon Script.
    • Simple universal Logon Script that applies to all users.
    • Use of a conditional Logon Script that applies per user or per group attributes.
    • Use of Samba's preexec and postexec functions on access to the NETLOGON share to create + a custom logon script and then execute it.
    • User of a tool such as KixStart.

    The Samba source code tree includes two logon script generation/execution tools. See examples directory genlogon and ntlogon subdirectories.

    The following listings are from the genlogon directory.

    + This is the genlogon.pl file: 

    @@ -12106,8 +12262,8 @@ This is the genlogon.pl file:
 	# genlogon.pl
 	#
 	# Perl script to generate user logon scripts on the fly, when users
-	# connect from a Windows client.  This script should be called from smb.conf
-	# with the %U, %G and %L parameters. I.e:
+	# connect from a Windows client. This script should be called from 
+	# smb.conf with the %U, %G and %L parameters. I.e:
 	#
 	#       root preexec = genlogon.pl %U %G %L
 	#
@@ -12128,7 +12284,8 @@ This is the genlogon.pl file:
 	#($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
 	($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);
 	open LOG, ">>/var/log/samba/netlogon.log";
-	print LOG "$mon/$mday/$year $hour:$min:$sec - User $ARGV[0] logged into $ARGV[1]\n";
+	print LOG "$mon/$mday/$year $hour:$min:$sec";
+	print LOG " - User $ARGV[0] logged into $ARGV[1]\n";
 	close LOG;
 
 	# Start generating logon script
@@ -12154,7 +12311,7 @@ This is the genlogon.pl file:
 		print LOGON "NET USE K: \\\\$ARGV[2]\\MKTING\r\n";
 	}
 
-	# Now connect Printers.  We handle just two or three users a little
+	# Now connect Printers. We handle just two or three users a little
 	# differently, because they are the exceptions that have desktop
 	# printers on LPT1: - all other user's go to the LaserJet on the
 	# server.
@@ -12174,37 +12331,37 @@ This is the genlogon.pl file:
 	close LOGON;

    -Those wishing to use more elaborate or capable logon processing system should check out the following sites: -

    http://www.craigelachie.org/rhacer/ntlogon
    http://www.kixtart.org
    http://support.microsoft.com/default.asp?scid=kb;en-us;189105

    Adding printers without user intervention

    +Those wishing to use more elaborate or capable logon processing system should check out these sites: +

    • http://www.craigelachi.e.org/rhacer/ntlogon
    • http://www.kixtart.org

    Adding Printers without User Intervention

    + Printers may be added automatically during logon script processing through the use of: -

    -	rundll32 printui.dll,PrintUIEntry /?
-

    - -See the documentation in the Microsoft knowledgebase article no: 189105. -

    Common Errors

    -The information provided in this chapter has been reproduced from postings on the samba@samba.org -mailing list. No implied endorsement or recommendation is offered. Administrators should conduct -their own evaluation of alternatives and are encouraged to draw their own conclusions. -

    Chapter 23. System and Account Policies

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work

    -This chapter summarises the current state of knowledge derived from personal -practice and knowledge from samba mailing list subscribers. Before reproduction -of posted information effort has been made to validate the information provided. +

    +C:\> rundll32 printui.dll,PrintUIEntry /?
+

    + +See the documentation in the Microsoft knowledgebase article 189105. +

    Chapter 23. System and Account Policies

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/ME Policies
    Windows NT4-Style Policy Files
    MS Windows 200x/XP Professional Policies
    Managing Account/User Policies
    Management Tools
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work

    +This chapter summarizes the current state of knowledge derived from personal +practice and knowledge from Samba mailing list subscribers. Before reproduction +of posted information, every effort has been made to validate the information given. Where additional information was uncovered through this validation it is provided also. -

    Features and Benefits

    -When MS Windows NT3.5 was introduced the hot new topic was the ability to implement -Group Policies for users and group. Then along came MS Windows NT4 and a few sites -started to adopt this capability. How do we know that? By way of the number of "booboos" +

    Features and Benefits

    +When MS Windows NT 3.5 was introduced, the hot new topic was the ability to implement +Group Policies for users and groups. Then along came MS Windows NT4 and a few sites +started to adopt this capability. How do we know that? By the number of “booboos” (or mistakes) administrators made and then requested help to resolve.

    + + + By the time that MS Windows 2000 and Active Directory was released, administrators got the message: Group Policies are a good thing! They can help reduce administrative -costs and actually can help to create happier users. But adoption of the true +costs and actually make happier users. But adoption of the true potential of MS Windows 200x Active Directory and Group Policy Objects (GPOs) for users -and machines were picked up on rather slowly. This was very obvious from the samba -mailing list as in 2000 and 2001 there were very few postings regarding GPOs and +and machines were picked up on rather slowly. This was obvious from the Samba +mailing list as in 2000 and 2001 when there were few postings regarding GPOs and how to replicate them in a Samba environment.

    Judging by the traffic volume since mid 2002, GPOs have become a standard part of @@ -12212,996 +12369,814 @@ the deployment in many sites. This chapter reviews techniques and methods that c be used to exploit opportunities for automation of control over user desktops and network client workstations.

    -A tool new to Samba may become an important part of the future Samba Administrators' -arsenal. The editreg tool is described in this document. -

    Creating and Managing System Policies

    +A tool new to Samba the editreg tool + may become an important part of the future Samba administrators' +arsenal is described in this document. +

    Creating and Managing System Policies

    Under MS Windows platforms, particularly those following the release of MS Windows -NT4 and MS Windows 95) it is possible to create a type of file that would be placed -in the NETLOGON share of a domain controller. As the client logs onto the network +NT4 and MS Windows 95, it is possible to create a type of file that would be placed +in the NETLOGON share of a Domain Controller. As the client logs onto the network, this file is read and the contents initiate changes to the registry of the client machine. This file allows changes to be made to those parts of the registry that affect users, groups of users, or machines.

    -For MS Windows 9x/Me this file must be called Config.POL and may + +For MS Windows 9x/ME, this file must be called Config.POL and may be generated using a tool called poledit.exe, better known as the Policy Editor. The policy editor was provided on the Windows 98 installation CD, but disappeared again with the introduction of MS Windows Me (Millennium Edition). From -comments from MS Windows network administrators it would appear that this tool became +comments of MS Windows network administrators, it would appear that this tool became a part of the MS Windows Me Resource Kit.

    + MS Windows NT4 Server products include the System Policy Editor -under the Start -> Programs -> Administrative Tools menu item. -For MS Windows NT4 and later clients this file must be called NTConfig.POL. +under Start -> Programs -> Administrative Tools. +For MS Windows NT4 and later clients, this file must be called NTConfig.POL.

    New with the introduction of MS Windows 2000 was the Microsoft Management Console -or MMC. This tool is the new wave in the ever changing landscape of Microsoft +or MMC. This tool is the new wave in the ever-changing landscape of Microsoft methods for management of network access and security. Every new Microsoft product -or technology seems to obsolete the old rules and to introduce newer and more -complex tools and methods. To Microsoft's credit though, the MMC does appear to +or technology seems to make the old rules obsolete and introduces newer and more +complex tools and methods. To Microsoft's credit, the MMC does appear to be a step forward, but improved functionality comes at a great price.

    -Before embarking on the configuration of network and system policies it is highly -advisable to read the documentation available from Microsoft's web site regarding - -Implementing Profiles and Policies in Windows NT 4.0 available from Microsoft. +Before embarking on the configuration of network and system policies, it is highly +advisable to read the documentation available from Microsoft's Web site regarding + +Implementing Profiles and Policies in Windows NT 4.0 available from Microsoft. There are a large number of documents in addition to this old one that should also -be read and understood. Try searching on the Microsoft web site for "Group Policies". -

    -What follows is a very brief discussion with some helpful notes. The information provided -here is incomplete - you are warned. -

    Windows 9x/Me Policies

    - You need the Win98 Group Policy Editor to set Group Profiles up under Windows 9x/Me. - It can be found on the Original full product Win98 installation CD under - tools/reskit/netadmin/poledit. Install this using the - Add/Remove Programs facility and then click on the 'Have Disk' tab. +be read and understood. Try searching on the Microsoft Web site for “Group Policies”. +

    +What follows is a brief discussion with some helpful notes. The information provided +here is incomplete you are warned. +

    Windows 9x/ME Policies

    + You need the Windows 98 Group Policy Editor to set up Group Profiles under Windows 9x/ME. + It can be found on the original full product Windows 98 installation CD under + tools/reskit/netadmin/poledit. Install this using the + Add/Remove Programs facility and then click on Have Disk.

    + Use the Group Policy Editor to create a policy file that specifies the location of - user profiles and/or the My Documents etc. Then save these + user profiles and/or My Documents, and so on. Then save these settings in a file called Config.POL that needs to be placed in the - root of the [NETLOGON] share. If Win98 is configured to log onto - the Samba Domain, it will automatically read this file and update the Win9x/Me registry + root of the [NETLOGON] share. If Windows 98 is configured to log onto + the Samba Domain, it will automatically read this file and update the Windows 9x/Me registry of the machine as it logs on.

    - Further details are covered in the Win98 Resource Kit documentation. + Further details are covered in the Windows 98 Resource Kit documentation.

    - If you do not take the right steps, then every so often Win9x/Me will check the - integrity of the registry and will restore it's settings from the back-up - copy of the registry it stores on each Win9x/Me machine. Hence, you will + If you do not take the correct steps, then every so often Windows 9x/ME will check the + integrity of the registry and restore its settings from the back-up + copy of the registry it stores on each Windows 9x/ME machine. So, you will occasionally notice things changing back to the original settings.

    - Install the group policy handler for Win9x to pick up group policies. Look on the - Win98 CD in \tools\reskit\netadmin\poledit. - Install group policies on a Win9x client by double-clicking + Install the group policy handler for Windows 9x/Me to pick up Group Policies. Look on the + Windows 98 CDROM in \tools\reskit\netadmin\poledit. + Install group policies on a Windows 9x/Me client by double-clicking on grouppol.inf. Log off and on again a couple of times and see - if Win98 picks up group policies. Unfortunately this needs to be done on every - Win9x/Me machine that uses group policies. -

    Windows NT4 Style Policy Files

    + if Windows 98 picks up Group Policies. Unfortunately, this needs to be done on every + Windows 9x/Me machine that uses Group Policies. +

    Windows NT4-Style Policy Files

    To create or edit ntconfig.pol you must use the NT Server - Policy Editor, poledit.exe which is included with NT4 Server - but not NT Workstation. There is a Policy Editor on a NT4 - Workstation but it is not suitable for creating Domain Policies. - Further, although the Windows 95 Policy Editor can be installed on an NT4 + Policy Editor, poledit.exe, which is included with NT4 Server + but not with NT Workstation. There is a Policy Editor on an NT4 + Workstation but it is not suitable for creating domain policies. + Furthermore, although the Windows 95 Policy Editor can be installed on an NT4 Workstation/Server, it will not work with NT clients. However, the files from the NT Server will run happily enough on an NT4 Workstation.

    You need poledit.exe, common.adm and winnt.adm. - It is convenient to put the two *.adm files in the c:\winnt\inf - directory which is where the binary will look for them unless told otherwise. Note also that that - directory is normally 'hidden'. + It is convenient to put the two *.adm files in the c:\winnt\inf + directory, which is where the binary will look for them unless told otherwise. This + directory is normally “hidden.”

    The Windows NT policy editor is also included with the Service Pack 3 (and later) for Windows NT 4.0. Extract the files using servicepackname /x, - i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, - poledit.exe and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible + that's Nt4sp6ai.exe /x for service pack 6a. The Policy Editor, + poledit.exe, and the associated template files (*.adm) should + be extracted as well. It is also possible to downloaded the policy template + files for Office97 and get a copy of the Policy Editor. Another possible location is with the Zero Administration Kit available for download from Microsoft. -

    Registry Spoiling

    - With NT4 style registry based policy changes, a large number of settings are not - automatically reversed as the user logs off. Since the settings that were in the - NTConfig.POL file were applied to the client machine registry and that apply to the +

    Registry Spoiling

    + With NT4-style registry-based policy changes, a large number of settings are not + automatically reversed as the user logs off. The settings that were in the + NTConfig.POL file were applied to the client machine registry and apply to the hive key HKEY_LOCAL_MACHINE are permanent until explicitly reversed. This is known - as tattooing. It can have serious consequences down-stream and the administrator must + as tattooing. It can have serious consequences downstream and the administrator must be extremely careful not to lock out the ability to manage the machine at a later date. -

    MS Windows 200x / XP Professional Policies

    - Windows NT4 System policies allows setting of registry parameters specific to - users, groups and computers (client workstations) that are members of the NT4 - style domain. Such policy file will work with MS Windows 2000 / XP clients also. +

    MS Windows 200x/XP Professional Policies

    + Windows NT4 system policies allow the setting of registry parameters specific to + users, groups and computers (client workstations) that are members of the NT4-style + domain. Such policy files will work with MS Windows 200x/XP clients also.

    - New to MS Windows 2000 Microsoft introduced a new style of group policy that confers - a superset of capabilities compared with NT4 style policies. Obviously, the tool used - to create them is different, and the mechanism for implementing them is much changed. + New to MS Windows 2000, Microsoft recently introduced a style of group policy that confers + a superset of capabilities compared with NT4-style policies. Obviously, the tool used + to create them is different, and the mechanism for implementing them is much improved.

    - The older NT4 style registry based policies are known as Administrative Templates - in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes ability to set various security + + The older NT4-style registry-based policies are known as Administrative Templates + in MS Windows 2000/XP Group Policy Objects (GPOs). The later includes the ability to set various security configurations, enforce Internet Explorer browser settings, change and redirect aspects of the - users' desktop (including: the location of My Documents files (directory), as + users desktop (including the location of My Documents files (directory), as well as intrinsics of where menu items will appear in the Start menu). An additional new feature is the ability to make available particular software Windows applications to particular users and/or groups.

    - Remember: NT4 policy files are named NTConfig.POL and are stored in the root - of the NETLOGON share on the domain controllers. A Windows NT4 user enters a username, a password - and selects the domain name to which the logon will attempt to take place. During the logon - process the client machine reads the NTConfig.POL file from the NETLOGON share on the authenticating - server, modifies the local registry values according to the settings in this file. + Remember, NT4 policy files are named NTConfig.POL and are stored in the root + of the NETLOGON share on the Domain Controllers. A Windows NT4 user enters a username, password + and selects the domain name to which the logon will attempt to take place. During the logon process, + the client machine reads the NTConfig.POL file from the NETLOGON share on + the authenticating server and modifies the local registry values according to the settings in this file.

    - Windows 2K GPOs are very feature rich. They are NOT stored in the NETLOGON share, rather part of + Windows 200x GPOs are feature-rich. They are not stored in the NETLOGON share, but rather part of a Windows 200x policy file is stored in the Active Directory itself and the other part is stored in a shared (and replicated) volume called the SYSVOL folder. This folder is present on all Active - Directory domain controllers. The part that is stored in the Active Directory itself is called the - group policy container (GPC), and the part that is stored in the replicated share called SYSVOL is - known as the group policy template (GPT). -

    - With NT4 clients the policy file is read and executed upon only as each user logs onto the network. - MS Windows 200x policies are much more complex - GPOs are processed and applied at client machine - startup (machine specific part) and when the user logs onto the network the user specific part - is applied. In MS Windows 200x style policy management each machine and/or user may be subject + Directory Domain Controllers. The part that is stored in the Active Directory itself is called the + Group Policy Container (GPC), and the part that is stored in the replicated share called SYSVOL is + known as the Group Policy Template (GPT). +

    + With NT4 clients, the policy file is read and executed only as each user logs onto the network. + MS Windows 200x policies are much more complex GPOs are processed and applied at client machine + startup (machine specific part) and when the user logs onto the network, the user-specific part + is applied. In MS Windows 200x-style policy management, each machine and/or user may be subject to any number of concurrently applicable (and applied) policy sets (GPOs). Active Directory allows the administrator to also set filters over the policy settings. No such equivalent capability - exists with NT4 style policy files. -

    Administration of Win2K / XP Policies

    + exists with NT4-style policy files. +

    Administration of Windows 200x/XP Policies

    + + Instead of using the tool called The System Policy Editor, commonly called Poledit (from the executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console (MMC) snap-in as follows:

    1. - Go to the Windows 200x / XP menu Start->Programs->Administrative Tools - and select the MMC snap-in called Active Directory Users and Computers -

    2. - Select the domain or organizational unit (OU) that you wish to manage, then right click - to open the context menu for that object, select the properties item. -

    3. - Now left click on the Group Policy tab, then left click on the New tab. Type a name - for the new policy you will create. -

    4. - Now left click on the Edit tab to commence the steps needed to create the GPO. -

    + Go to the Windows 200x/XP menu Start->Programs->Administrative Tools + and select the MMC snap-in called Active Directory Users and Computers +

  • + Select the domain or organizational unit (OU) that you wish to manage, then right-click + to open the context menu for that object, and select the Properties. +

  • + Left-click on the Group Policy tab, then + left-click on the New tab. Type a name + for the new policy you will create. +

  • + Left-click on the Edit tab to commence the steps needed to create the GPO. +

    • All policy configuration options are controlled through the use of policy administrative - templates. These files have a .adm extension, both in NT4 as well as in Windows 200x / XP. - Beware however, since the .adm files are NOT interchangeable across NT4 and Windows 200x. - The later introduces many new features as well as extended definition capabilities. It is - well beyond the scope of this documentation to explain how to program .adm files, for that + templates. These files have an .adm extension, both in NT4 as well as in Windows 200x/XP. + Beware, however, the .adm files are not interchangeable across NT4 and Windows 200x. + The latter introduces many new features as well as extended definition capabilities. It is + well beyond the scope of this documentation to explain how to program .adm files; for that the administrator is referred to the Microsoft Windows Resource Kit for your particular version of MS Windows.

    Note

    The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you use this powerful tool. Please refer to the resource kit manuals for specific usage information. -

    Managing Account/User Policies

    +

    Managing Account/User Policies

    Policies can define a specific user's settings or the settings for a group of users. The resulting policy file contains the registry settings for all users, groups, and computers that will be using the policy file. Separate policy files for each user, group, or computer are not necessary.

    -If you create a policy that will be automatically downloaded from validating domain controllers, -you should name the file NTconfig.POL. As system administrator, you have the option of renaming the + +If you create a policy that will be automatically downloaded from validating Domain Controllers, +you should name the file NTConfig.POL. As system administrator, you have the option of renaming the policy file and, by modifying the Windows NT-based workstation, directing the computer to update the policy from a manual path. You can do this by either manually changing the registry or by using -the System Policy Editor. This path can even be a local path such that each machine has its own policy file, -but if a change is necessary to all machines, this change must be made individually to each workstation. +the System Policy Editor. This can even be a local path such that each machine has its own policy file, +but if a change is necessary to all machines, it must be made individually to each workstation.

    -When a Windows NT4/200x/XP machine logs onto the network the NETLOGON share on the authenticating domain -controller for the presence of the NTConfig.POL file. If one exists it is downloaded, parsed and then -applied to the user's part of the registry. +When a Windows NT4/200x/XP machine logs onto the network, the client looks in the NETLOGON share on +the authenticating domain controller for the presence of the NTConfig.POL file. If one exists it is +downloaded, parsed and then applied to the user's part of the registry.

    -MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally, + +MS Windows 200x/XP clients that log onto an MS Windows Active Directory security domain may additionally acquire policy settings through Group Policy Objects (GPOs) that are defined and stored in Active Directory itself. The key benefit of using AS GPOs is that they impose no registry spoiling effect. -This has considerable advantage compared with the use of NTConfig.POL (NT4) style policy updates. +This has considerable advantage compared with the use of NTConfig.POL (NT4) style policy updates.

    In addition to user access controls that may be imposed or applied via system and/or group policies in a manner that works in conjunction with user profiles, the user management environment under MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied. -Common restrictions that are frequently used includes: -

    -

    • Logon Hours

    • Password Aging

    • Permitted Logon from certain machines only

    • Account type (Local or Global)

    • User Rights

    -

    Samba Editreg Toolset

    +Common restrictions that are frequently used include: +

    + +

    • Logon hours
    • Password aging
    • Permitted logon from certain machines only
    • Account type (local or global)
    • User rights

    +

    +Samba-3.0.0 doe not yet implement all account controls that are common to MS Windows NT4/200x/XP. +While it is possible to set many controls using the Domain User Manager for MS Windows NT4, only password +expirey is functional today. Most of the remaining controls at this time have only stub routines +that may eventually be completed to provide actual control. Do not be misled by the fact that a +parameter can be set using the NT4 Domain User Manager or in the NTConfig.POL. +

    Management Tools

    +Anyone who wishes to create or manage Group Policies will need to be familiar with a number of tools. +The following sections describe a few key tools that will help you to create a low maintenance user +environment. +

    Samba Editreg Toolset

    + + + A new tool called editreg is under development. This tool can be used - to edit registry files (called NTUser.DAT) that are stored in user and group profiles. - NTConfig.POL files have the same structure as the NTUser.DAT file and can be editted using - this tool. editreg is being built with the intent to enable NTConfig.POL - files to be saved in text format and to permit the building of new NTConfig.POL files with - extended capabilities. It is proving difficult to realise this capability, so do not be surprised - if this feature does not materialise. Formal capabilities will be announced at the time that - this tool is released for production use. -

    Windows NT4/200x

    + to edit registry files (called NTUser.DAT) that are stored in user + and group profiles. NTConfig.POL files have the same structure as the + NTUser.DAT file and can be edited using this tool. editreg + is being built with the intent to enable NTConfig.POL files to be saved in text format and to + permit the building of new NTConfig.POL files with extended capabilities. It is proving difficult + to realize this capability, so do not be surprised if this feature does not materialize. Formal + capabilities will be announced at the time that this tool is released for production use. +

    Windows NT4/200x

    The tools that may be used to configure these types of controls from the MS Windows environment are: - The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). - Under MS Windows 200x/XP this is done using the Microsoft Management Console (MMC) with appropriate - "snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor. -

    Samba PDC

    - With a Samba Domain Controller, the new tools for managing of user account and policy information includes: + the NT4 User Manager for Domains, the NT4 System and Group Policy Editor, and the Registry Editor (regedt32.exe). + Under MS Windows 200x/XP, this is done using the Microsoft Management Console (MMC) with appropriate + “snap-ins,” the registry editor, and potentially also the NT4 System and Group Policy Editor. +

    Samba PDC

    + With a Samba Domain Controller, the new tools for managing user account and policy information include: smbpasswd, pdbedit, net, rpcclient. - The administrator should read the - man pages for these tools and become familiar with their use. -

    System Startup and Logon Processing Overview

    -The following attempts to document the order of processing of system and user policies following a system + The administrator should read the man pages for these tools and become familiar with their use. +

    System Startup and Logon Processing Overview

    +The following attempts to document the order of processing the system and user policies following a system reboot and as part of the user logon:

    1. Network starts, then Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming - Convention Provider (MUP) start + Convention Provider (MUP) start.

    2. Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded and applied. The list may include GPOs that: -

      • Apply to the location of machines in a Directory

      • Apply only when settings have changed

      • Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc.

      +

      • Apply to the location of machines in a Directory.

      • Apply only when settings have changed.

      • Depend on configuration of the scope of applicability: local, + site, domain, organizational unit, and so on.

      No desktop user interface is presented until the above have been processed.

    3. Execution of start-up scripts (hidden and synchronous by default).

    4. - A keyboard action to affect start of logon (Ctrl-Alt-Del). + A keyboard action to effect start of logon (Ctrl-Alt-Del).

    5. - User credentials are validated, User profile is loaded (depends on policy settings). + User credentials are validated, user profile is loaded (depends on policy settings).

    6. - An ordered list of User GPOs is obtained. The list contents depends on what is configured in respect of: + An ordered list of user GPOs is obtained. The list contents depends on what is configured in respect of: -

      • Is user a domain member, thus subject to particular policies

      • Loopback enablement, and the state of the loopback policy (Merge or Replace)

      • Location of the Active Directory itself

      • Has the list of GPOs changed. No processing is needed if not changed.

      +

      • Is the user a Domain Member, thus subject to particular policies?
      • Loopback enablement, and the state of the loopback policy (Merge or Replace).
      • Location of the Active Directory itself.
      • Has the list of GPOs changed? No processing is needed if not changed.

    7. User Policies are applied from Active Directory. Note: There are several types.

    8. - Logon scripts are run. New to Win2K and Active Directory, logon scripts may be obtained based on Group - Policy objects (hidden and executed synchronously). NT4 style logon scripts are then run in a normal + Logon scripts are run. New to Windows 200x and Active Directory, logon scripts may be obtained based on Group + Policy objects (hidden and executed synchronously). NT4-style logon scripts are then run in a normal window.

    9. - The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like and NT4 - Domain) machine (system) policies are applied at start-up, User policies are applied at logon. -

    Common Errors

    -Policy related problems can be very difficult to diagnose and even more difficult to rectify. The following + The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like an NT4 + Domain), machine (system) policies are applied at start-up; user policies are applied at logon. +

    Common Errors

    +Policy-related problems can be quite difficult to diagnose and even more difficult to rectify. The following collection demonstrates only basic issues. -

    Policy Does Not Work

    - “We have created the config.pol file and put it in the NETLOGON share. -It has made no difference to our Win XP Pro machines, they just don't see it. IT worked fine with Win 98 but does not +

    Policy Does Not Work

    +“We have created the Config.POL file and put it in the NETLOGON share. +It has made no difference to our Win XP Pro machines, they just do not see it. It worked fine with Win 98 but does not work any longer since we upgraded to Win XP Pro. Any hints?”

    -Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based -platforms. You need to use the NT4 Group Policy Editor to create a file called NTConfig.POL so that -it is in the correct format for your MS Windows XP Pro clients. -

    Chapter 24. Desktop Profile Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Setting up roaming profiles for just a few user's or group's?
    Can NOT use Roaming Profiles
    Changing the default profile

    Features and Benefits

    -Roaming Profiles are feared by some, hated by a few, loved by many, and a Godsend for +Policy files are not portable between Windows 9x/Me and MS Windows NT4/200x/XP-based platforms. You need to +use the NT4 Group Policy Editor to create a file called NTConfig.POL so it is in the +correct format for your MS Windows XP Pro clients. +

    Chapter 24. Desktop Profile Management

    John H. Terpstra

    Samba Team

    April 3 2003

    Table of Contents

    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP Workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory Profiles
    Creating and Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Configuring Roaming Profiles for a Few Users or Groups
    Cannot Use Roaming Profiles
    Changing the Default Profile

    Features and Benefits

    +Roaming profiles are feared by some, hated by a few, loved by many, and a Godsend for some administrators.

    -Roaming Profiles allow an administrator to make available a consistent user desktop +Roaming profiles allow an administrator to make available a consistent user desktop as the user moves from one machine to another. This chapter provides much information -regarding how to configure and manage Roaming Profiles. +regarding how to configure and manage roaming profiles.

    -While Roaming Profiles might sound like nirvana to some, they are a real and tangible +While roaming profiles might sound like nirvana to some, they are a real and tangible problem to others. In particular, users of mobile computing tools, where often there may not -be a sustained network connection, are often better served by purely Local Profiles. -This chapter provides information to help the Samba administrator to deal with those -situations also. -

    Roaming Profiles

    Warning

    -Roaming profiles support is different for Win9x / Me and Windows NT4/200x. +be a sustained network connection, are often better served by purely local profiles. +This chapter provides information to help the Samba administrator deal with those +situations. +

    Roaming Profiles

    Warning

    +Roaming profiles support is different for Windows 9x/Me and Windows NT4/200x.

    Before discussing how to configure roaming profiles, it is useful to see how -Windows 9x / Me and Windows NT4/200x clients implement these features. +Windows 9x/Me and Windows NT4/200x clients implement these features.

    -Windows 9x / Me clients send a NetUserGetInfo request to the server to get the user's +Windows 9x/Me clients send a NetUserGetInfo request to the server to get the user's profiles location. However, the response does not have room for a separate -profiles location field, only the user's home share. This means that Win9X/Me +profiles location field, only the user's home share. This means that Windows 9x/Me profiles are restricted to being stored in the user's home directory.

    -Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields, +Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields including a separate field for the location of the user's profiles. -

    Samba Configuration for Profile Handling

    +

    Samba Configuration for Profile Handling

    This section documents how to configure Samba for MS Windows client profile support. -

    NT4/200x User Profiles

    -To support Windows NT4/200x clients, in the [global] section of smb.conf set the -following (for example): +

    NT4/200x User Profiles

    +For example, to support Windows NT4/200x clients, set the followoing in the [global] section of the smb.conf file:

    logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath

    - This is typically implemented like: +This is typically implemented like:

    logon path = \\%L\Profiles\%u

    -where %L translates to the name of the Samba server and %u translates to the user name +where “%L” translates to the name of the Samba server and “%u” translates to the user name.

    -The default for this option is \\%N\%U\profile, -namely \\sambaserver\username\profile. -The \\N%\%U service is created automatically by the [homes] service. If you are using -a samba server for the profiles, you _must_ make the share specified in the logon path +The default for this option is \\%N\%U\profile, namely \\sambaserver\username\profile. +The \\N%\%U service is created automatically by the [homes] service. If you are using +a Samba server for the profiles, you must make the share that is specified in the logon path browseable. Please refer to the man page for smb.conf in respect of the different -semantics of %L and %N, as well as %U and %u. +semantics of “%L” and “%N”, as well as “%U” and “%u”.

    Note

    -MS Windows NT/2K clients at times do not disconnect a connection to a server -between logons. It is recommended to NOT use the homes -meta-service name as part of the profile share path. -

    Windows 9x / Me User Profiles

    - To support Windows 9x / Me clients, you must use the logon home parameter. Samba has -now been fixed so that net use /home now works as well, and it, too, relies +MS Windows NT/200x clients at times do not disconnect a connection to a server between logons. It is recommended +to not use the homes meta-service name as part of the profile share path. +

    Windows 9x/Me User Profiles

    +To support Windows 9x/Me clients, you must use the logon home +parameter. Samba has been fixed so net use /home now works as well and it, too, relies on the logon home parameter.

    -By using the logon home parameter, you are restricted to putting Win9x / Me -profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your smb.conf file: +By using the logon home parameter, you are restricted to putting Windows 9x/Me profiles in the user's home +directory. But wait! There is a trick you can use. If you set the following in the +[global] section of your smb.conf file:

    logon home = \\%L\%U\.profiles

    -then your Windows 9x / Me clients will dutifully put their clients in a subdirectory -of your home directory called .profiles (thus making them hidden). +then your Windows 9x/Me clients will dutifully put their clients in a subdirectory +of your home directory called .profiles (making them hidden).

    -Not only that, but net use /home will also work, because of a feature in -Windows 9x / Me. It removes any directory stuff off the end of the home directory area +Not only that, but net use /home will also work because of a feature in +Windows 9x/Me. It removes any directory stuff off the end of the home directory area and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for logon home. -

    Mixed Windows 9x / Me and Windows NT4/200x User Profiles

    -You can support profiles for both Win9X and WinNT clients by setting both the -logon home and logon path parameters. For example: -

    logon home = \\%L\%u\.profiles
    logon path = \\%L\profiles\%u

    Disabling Roaming Profile Support

    - A question often asked is “How may I enforce use of local profiles?” or - “How do I disable Roaming Profiles?” -

    +specified \\%L\%U for logon home. +

    Mixed Windows 9x/Me and Windows NT4/200x User Profiles

    +You can support profiles for Windows 9x and Windows NT clients by setting both the +logon home and logon path parameters. For example: +

    logon home = \\%L\%u\.profiles
    logon path = \\%L\profiles\%u

    Disabling Roaming Profile Support

    +A question often asked is: “How may I enforce use of local profiles?” or +“How do I disable roaming profiles?” +

    + There are three ways of doing this: +

    In smb.conf

    - Affect the following settings and ALL clients - will be forced to use a local profile: -

    logon home
    logon path

    -

    MS Windows Registry:

    - By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This of course modifies registry settings. The full path to the option is: - - - 

    -	Local Computer Policy\
-		Computer Configuration\
-			Administrative Templates\
-				System\
-					User Profiles\
-
-	Disable:	Only Allow Local User Profiles
-	Disable:	Prevent Roaming Profile Change from Propagating to the Server
-

    -

    Change of Profile Type:

    - From the start menu right click on the - My Computer icon, select Properties, click on the User Profiles - tab, select the profile you wish to change from Roaming type to Local, click Change Type. + Affect the following settings and ALL clients will be forced to use a local profile: + logon home and logon path +

    MS Windows Registry

    + By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP + machine to use only a local profile. This, of course, modifies registry settings. The full + path to the option is: +

    +Local Computer Policy\
+	Computer Configuration\
+		Administrative Templates\
+			System\
+				User Profiles\
+
+Disable: Only Allow Local User Profiles 
+Disable: Prevent Roaming Profile Change from Propagating to the Server
+

    +

    Change of Profile Type:

    From the start menu right-click on My Computer icon, + select Properties, click on the User Profiles + tab, select the profile you wish to change from + Roaming type to Local, and click on + Change Type.

    -Consult the MS Windows registry guide for your particular MS Windows version for more -information about which registry keys to change to enforce use of only local user -profiles. +Consult the MS Windows registry guide for your particular MS Windows version for more information +about which registry keys to change to enforce use of only local user profiles.

    Note

    The specifics of how to convert a local profile to a roaming profile, or a roaming profile -to a local one vary according to the version of MS Windows you are running. Consult the -Microsoft MS Windows Resource Kit for your version of Windows for specific information. -

    Windows Client Profile Configuration Information

    Windows 9x / Me Profile Setup

    -When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders Start Menu, Desktop, -Programs and Nethood. -These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options preserve case = yes, short preserve case = yes and -case sensitive = no in order to maintain capital letters in shortcuts -in any of the profile folders. -

    -The user.DAT file contains all the user's preferences. If you wish to -enforce a set of preferences, rename their user.DAT file to user.MAN, -and deny them write access to this file. +to a local one vary according to the version of MS Windows you are running. Consult the Microsoft MS +Windows Resource Kit for your version of Windows for specific information. +

    Windows Client Profile Configuration Information

    Windows 9x/Me Profile Setup

    +When a user first logs in on Windows 9X, the file user.DAT is created, as are folders +Start Menu, Desktop, Programs, and +Nethood. These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, taking the +most recent from each. You will need to use the [global] options +preserve case = yes, +short preserve case = yes and +case sensitive = no +in order to maintain capital letters in shortcuts in any of the profile folders. +

    +The user.DAT file contains all the user's preferences. If you wish to enforce a set of preferences, +rename their user.DAT file to user.MAN, and deny them write access to this file.

    1. - On the Windows 9x / Me machine, go to Control Panel -> Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer - to reboot. -

    2. - On the Windows 9x / Me machine, go to Control Panel -> Network -> - Client for Microsoft Networks -> Preferences. Select Log on to - NT Domain. Then, ensure that the Primary Logon is Client for - Microsoft Networks. Press OK, and this time allow the computer - to reboot. -

    -Under Windows 9x / Me Profiles are downloaded from the Primary Logon. -If you have the Primary Logon as 'Client for Novell Networks', then -the profiles and logon script will be downloaded from your Novell -Server. If you have the Primary Logon as 'Windows Logon', then the -profiles will be loaded from the local machine - a bit against the -concept of roaming profiles, it would seem! -

    -You will now find that the Microsoft Networks Login box contains -[user, password, domain] instead of just [user, password]. Type in -the samba server's domain name (or any other domain known to exist, -but bear in mind that the user will be authenticated against this -domain and profiles downloaded from it, if that domain logon server -supports it), user name and user's password. -

    -Once the user has been successfully validated, the Windows 9x / Me machine -will inform you that The user has not logged on before and asks you -Do you wish to save the user's preferences?. Select yes. -

    -Once the Windows 9x / Me client comes up with the desktop, you should be able -to examine the contents of the directory specified in the logon path -on the samba server and verify that the Desktop, Start Menu, -Programs and Nethood folders have been created. -

    -These folders will be cached locally on the client, and updated when -the user logs off (if you haven't made them read-only by then). -You will find that if the user creates further folders or short-cuts, -that the client will merge the profile contents downloaded with the -contents of the profile directory already on the local client, taking -the newest folders and short-cuts from each set. -

    -If you have made the folders / files read-only on the samba server, -then you will get errors from the Windows 9x / Me machine on logon and logout, as -it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the Windows 9x / Me machine, check the UNIX file -permissions and ownership rights on the profile directory contents, -on the samba server. -

    -If you have problems creating user profiles, you can reset the user's -local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time". -

    Warning

    - Before deleting the contents of the - directory listed in the ProfilePath (this is likely to be - c:\windows\profiles\username), ask them if they - have any important files stored on their desktop or in their start menu. - Delete the contents of the directory ProfilePath (making a backup if any - of the files are needed). -

    - This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. -

    1. - instead of logging in under the [user, password, domain] dialog, - press escape. -

    2. - run the regedit.exe program, and look in: -

      - HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList -

      - you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. -

      [Exit the registry editor].

    3. - search for the user's .PWL password-caching file in the c:\windows - directory, and delete it. -

    4. - log off the windows 9x / Me client. -

    5. - check the contents of the profile path (see logon path described - above), and delete the user.DAT or user.MAN file for the user, - making a backup if required. -

    -If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as ethereal or netmon.exe, and -look for error messages. -

    -If you have access to an Windows NT4/200x server, then first set up roaming profiles -and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine -the example packet traces provided with Windows NT4/200x server, and see what the -differences are with the equivalent samba trace. -

    Windows NT4 Workstation

    -When a user first logs in to a Windows NT Workstation, the profile -NTuser.DAT is created. The profile location can be now specified -through the logon path parameter. -

    -There is a parameter that is now available for use with NT Profiles: -logon drive. This should be set to H: or any other drive, and -should be used in conjunction with the new logon home parameter. -

    -The entry for the NT4 profile is a _directory_ not a file. The NT -help on profiles mentions that a directory is also created with a .PDS -extension. The user, while logging in, must have write permission to -create the full profile path (and the folder with the .PDS extension -for those situations where it might be created.) -

    -In the profile directory, Windows NT4 creates more folders than Windows 9x / Me. -It creates Application Data and others, as well as Desktop, Nethood, -Start Menu and Programs. The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and -its purpose is currently unknown. -

    -You can use the System Control Panel to copy a local profile onto -a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN -turns a profile into a mandatory one. -

    -The case of the profile is significant. The file must be called -NTuser.DAT or, for a mandatory profile, NTuser.MAN. -

    Windows 2000/XP Professional

    -You must first convert the profile from a local profile to a domain -profile on the MS Windows workstation as follows: -

    1. - Log on as the LOCAL workstation administrator. -

    2. - Right click on the My Computer Icon, select Properties -

    3. - Click on the User Profiles tab -

    4. - Select the profile you wish to convert (click on it once) + On the Windows 9x/Me machine, go to Control Panel -> + Passwords and select the User Profiles tab. + Select the required level of roaming preferences. Press OK, but do not + allow the computer to reboot. +

    5. + On the Windows 9x/Me machine, go to Control Panel -> + Network -> Client for Microsoft Networks + -> Preferences. Select Log on to NT Domain. Then, + ensure that the Primary Logon is Client for Microsoft Networks. Press + OK, and this time allow the computer to reboot. +

    Under Windows 9x/ME, profiles are downloaded from the Primary Logon. If you have the Primary Logon +as “Client for Novell Networks”, then the profiles and logon script will be downloaded from +your Novell Server. If you have the Primary Logon as “Windows Logon”, then the profiles will +be loaded from the local machine a bit against the concept of roaming profiles, it would seem!

    +You will now find that the Microsoft Networks Login box contains [user, password, domain] instead +of just [user, password]. Type in the Samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this domain and profiles downloaded from it, +if that domain logon server supports it), user name and user's password. +

    Once the user has been successfully validated, the Windows 9x/Me machine will inform you that +The user has not logged on before and asks you Do you +wish to save the user's preferences? Select Yes.

    Once the Windows 9x/Me client comes up with the desktop, you should be able to examine the +contents of the directory specified in the logon path on +the Samba server and verify that the Desktop, Start Menu, +Programs and Nethood folders have been created.

    These folders will be cached locally on the client, and updated when the user logs off (if +you haven't made them read-only by then). You will find that if the user creates further folders or +shortcut, that the client will merge the profile contents downloaded with the contents of the profile +directory already on the local client, taking the newest folders and shortcut from each set.

    If you have made the folders/files read-only on the Samba server, then you will get errors from +the Windows 9x/Me machine on logon and logout as it attempts to merge the local and remote profile. +Basically, if you have any errors reported by the Windows 9x/Me machine, check the UNIX file permissions +and ownership rights on the profile directory contents, on the Samba server.

    If you have problems creating user profiles, you can reset the user's local desktop cache, as +shown below. When this user next logs in, the user will be told that he/she is logging in “for + the first time”. + + +

    1. + Instead of logging in under the [user, password, domain] dialog, press escape.

    2. - Click on the button Copy To + Run the regedit.exe program, and look in: +

      + HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList +

      + You will find an entry for each user of ProfilePath. Note the contents of this key + (likely to be c:\windows\profiles\username), then delete the key + ProfilePath for the required user.

    3. - In the Permitted to use box, click on the Change button. + Exit the registry editor.

    4. - Click on the 'Look in" area that lists the machine name, when you click - here it will open up a selection box. Click on the domain to which the - profile must be accessible. -

      Note

      You will need to log on if a logon box opens up. Eg: In the connect as: DOMAIN\root, password: mypassword.

    5. - To make the profile capable of being used by anyone select 'Everyone' + Search for the user's .PWL password-caching file in the c:\windows directory, and delete it.

    6. - Click OK. The Selection box will close. + Log off the Windows 9x/Me client.

    7. - Now click on the Ok button to create the profile in the path you - nominated. -

    -Done. You now have a profile that can be edited using the samba -profiles tool. -

    Note

    -Under NT/2K the use of mandatory profiles forces the use of MS Exchange -storage of mail data. That keeps desktop profiles usable. -

    Procedure 24.2. Windows XP Service Pack 1

    1. -This is a security check new to Windows XP (or maybe only -Windows XP service pack 1). It can be disabled via a group policy in -Active Directory. The policy is:

      Computer Configuration\Administrative Templates\System\User -Profiles\Do not check for user ownership of Roaming Profile Folders

      ...and it should be set to Enabled. -Does the new version of samba have an Active Directory analogue? If so, -then you may be able to set the policy through this. -

      -If you cannot set group policies in samba, then you may be able to set -the policy locally on each machine. If you want to try this, then do -the following (N.B. I don't know for sure that this will work in the -same way as a domain group policy): -

    2. -On the XP workstation log in with an Administrator account. -

    3. Click: Start, Run

    4. Type: mmc

    5. Click: OK

    6. A Microsoft Management Console should appear.

    7. Click: File, Add/Remove Snap-in..., Add

    8. Double-Click: Group Policy

    9. Click: Finish, Close

    10. Click: OK

    11. In the "Console Root" window:

    12. Expand: Local Computer Policy, Computer Configuration, - Administrative Templates, System, User Profiles

    13. Double-Click: Do not check for user ownership of Roaming Profile Folders

    14. Select: Enabled

    15. Click: OK

    16. Close the whole console. You do not need to save the settings (this - refers to the console settings rather than the policies you have - changed).

    17. Reboot

    Sharing Profiles between W9x/Me and NT4/200x/XP workstations

    -Sharing of desktop profiles between Windows versions is NOT recommended. -Desktop profiles are an evolving phenomenon and profiles for later versions -of MS Windows clients add features that may interfere with earlier versions -of MS Windows clients. Probably the more salient reason to NOT mix profiles -is that when logging off an earlier version of MS Windows the older format -of profile contents may overwrite information that belongs to the newer -version resulting in loss of profile information content when that user logs -on again with the newer version of MS Windows. -

    -If you then want to share the same Start Menu / Desktop with W9x/Me, you will -need to specify a common location for the profiles. The smb.conf parameters -that need to be common are logon path and -logon home. -

    -If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory. -

    Profile Migration from Windows NT4/200x Server to Samba

    -There is nothing to stop you specifying any path that you like for the -location of users' profiles. Therefore, you could specify that the -profile be stored on a samba server, or any other SMB server, as long as -that SMB server supports encrypted passwords. -

    Windows NT4 Profile Management Tools

    -Unfortunately, the Resource Kit information is specific to the version of MS Windows -NT4/200x. The correct resource kit is required for each platform. -

    -Here is a quick guide: -

    1. -On your NT4 Domain Controller, right click on My Computer, then -select the tab labelled User Profiles. -

    2. -Select a user profile you want to migrate and click on it. -

      Note

      I am using the term "migrate" loosely. You can copy a profile to -create a group profile. You can give the user 'Everyone' rights to the -profile you copy this to. That is what you need to do, since your samba -domain is not a member of a trust relationship with your NT4 PDC.

    3. Click the Copy To button.

    4. In the box labelled Copy Profile to add your new path, eg: - c:\temp\foobar

    5. Click on the button Change in the Permitted to use box.

    6. Click on the group 'Everyone' and then click OK. This closes the - 'choose user' box.

    7. Now click OK.

    -Follow the above for every profile you need to migrate. -

    Side bar Notes

    -You should obtain the SID of your NT4 domain. You can use smbpasswd to do -this. Read the man page.

    moveuser.exe

    -The W2K professional resource kit has moveuser.exe. moveuser.exe changes -the security of a profile from one user to another. This allows the account -domain to change, and/or the user name to change. -

    Get SID

    -You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 -Resource Kit. -

    -Windows NT 4.0 stores the local profile information in the registry under -the following key: -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList -

    -Under the ProfileList key, there will be subkeys named with the SIDs of the -users who have logged on to this computer. (To find the profile information -for the user whose locally cached profile you want to move, find the SID for -the user with the GetSID.exe utility.) Inside of the appropriate user's -subkey, you will see a string value named ProfileImagePath. -

    Mandatory profiles

    -A Mandatory Profile is a profile that the user does NOT have the ability to overwrite. -During the user's session it may be possible to change the desktop environment, but -as the user logs out all changes made will be lost. If it is desired to NOT allow the -user any ability to change the desktop environment then this must be done through -policy settings. See previous chapter. -

    Note

    -Under NO circumstances should the profile directory (or it's contents) be made read-only -as this may render the profile un-usable. + Check the contents of the profile path (see logon path + described above) and delete the user.DAT or user.MAN + file for the user, making a backup if required. +

    Warning

    +Before deleting the contents of the directory listed in the ProfilePath +(this is likely to be c:\windows\profiles\username), ask the owner if they have +any important files stored on their desktop or in their start menu. Delete the contents of the +directory ProfilePath (making a backup if any of the files are needed). +

    +This will have the effect of removing the local (read-only hidden system file) user.DAT +in their profile directory, as well as the local “desktop,” “nethood,” +“start menu,” and “programs” folders.

    -For MS Windows NT4/200x/XP the above method can be used to create mandatory profiles -also. To convert a group profile into a mandatory profile simply locate the NTUser.DAT -file in the copied profile and rename it to NTUser.MAN. -

    -For MS Windows 9x / Me it is the User.DAT file that must be renamed to User.MAN to -affect a mandatory profile. -

    Creating/Managing Group Profiles

    -Most organisations are arranged into departments. There is a nice benefit in -this fact since usually most users in a department will require the same desktop -applications and the same desktop layout. MS Windows NT4/200x/XP will allow the -use of Group Profiles. A Group Profile is a profile that is created firstly using -a template (example) user. Then using the profile migration tool (see above) the -profile is assigned access rights for the user group that needs to be given access -to the group profile. -

    -The next step is rather important. Please note: Instead of assigning a group profile -to users (ie: Using User Manager) on a "per user" basis, the group itself is assigned -the now modified profile. +If all else fails, increase Samba's debug log levels to between 3 and 10, and/or run a packet +sniffer program such as ethereal or netmon.exe, and look for error messages. +

    If you have access to an Windows NT4/200x server, then first set up roaming profiles and/or +netlogons on the Windows NT4/200x server. Make a packet trace, or examine the example packet traces +provided with Windows NT4/200x server, and see what the differences are with the equivalent Samba trace. +

    Windows NT4 Workstation

    When a user first logs in to a Windows NT Workstation, the profile NTuser.DAT is created. The profile +location can be now specified through the logon path parameter. +

    There is a parameter that is now available for use with NT Profiles: logon drive. +This should be set to H: or any other drive, and should be used in conjunction with +the new logon home parameter.

    The entry for the NT4 profile is a directory not a file. The NT help on Profiles mentions that a +directory is also created with a .PDS extension. The user, while logging in, must have write permission +to create the full profile path (and the folder with the .PDS extension for those situations where it +might be created.)

    In the profile directory, Windows NT4 creates more folders than Windows 9x/Me. It creates +Application Data and others, as well as Desktop, +Nethood, Start Menu, and Programs. +The profile itself is stored in a file NTuser.DAT. Nothing appears to be stored +in the .PDS directory, and its purpose is currently unknown.

    You can use the System Control Panel to copy a local profile onto +a Samba server (see NT Help on Profiles; it is also capable of firing up the correct location in the +System Control Panel for you). The NT Help file also mentions that renaming +NTuser.DAT to NTuser.MAN turns a profile into a mandatory one. +

    The case of the profile is significant. The file must be called NTuser.DAT +or, for a mandatory profile, NTuser.MAN.

    Windows 2000/XP Professional

    You must first convert the profile from a local profile to a domain profile on the MS Windows +workstation as follows:

    1. Log on as the local workstation administrator.

    2. Right-click on the My Computer Icon, select + Properties.

    3. Click on the User Profiles tab.

    4. Select the profile you wish to convert (click it once).

    5. Click on the Copy To button.

    6. In the Permitted to use box, click on the + Change button.

    7. Click on the Look in area that lists the machine name. When you click here, it will + open up a selection box. Click on the domain to which the profile must be accessible.

      Note

      You will need to log on if a logon box opens up. + For example, connect as DOMAIN\root, password: + mypassword.

    8. To make the profile capable of being used by anyone, select “Everyone”.

    9. Click on OK and the Selection box will close.

    10. Now click on OK to create the profile in the path + you nominated.

    Done. You now have a profile that can be edited using the Samba profiles tool.

    Note

    - Be careful with group profiles, if the user who is a member of a group also - has a personal profile, then the result will be a fusion (merge) of the two. -

    Default Profile for Windows Users

    -MS Windows 9x / Me and NT4/200x/XP will use a default profile for any user for whom -a profile does not already exist. Armed with a knowledge of where the default profile -is located on the Windows workstation, and knowing which registry keys affect the path -from which the default profile is created, it is possible to modify the default profile -to one that has been optimised for the site. This has significant administrative -advantages. -

    MS Windows 9x/Me

    -To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System -Policy Editor or change the registry directly. -

    -To enable default per user profiles in Windows 9x / Me, launch the System Policy Editor, then -select File -> Open Registry, then click on the -Local Computer icon, click on Windows 98 System, -select User Profiles, click on the enable box. Do not forget to save the registry changes. -

    -To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive -HKEY_LOCAL_MACHINE\Network\Logon. Now add a DWORD type key with the name -"User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0. -

    How User Profiles Are Handled in Windows 9x / Me?

    -When a user logs on to a Windows 9x / Me machine, the local profile path, +Under Windows NT/200x, the use of mandatory profiles forces the use of MS Exchange storage of mail +data and keeps it out of the desktop profile. That keeps desktop profiles from becoming unusable. +

    Windows XP Service Pack 1

    + There is a security check new to Windows XP (or maybe only Windows XP service pack 1). + It can be disabled via a group policy in the Active Directory. The policy is called: +

    + Computer Configuration\Administrative Templates\System\User Profiles\Do not check for + user ownership of Roaming Profile Foldersi +

    + This should be set to Enabled. +

    + Does the new version of Samba have an Active Directory analogue? If so, then you may be able to set the policy through this. +

    If you cannot set group policies in Samba, then you may be able to set the policy locally on + each machine. If you want to try this, then do the following (N.B. I do not know for sure that this + will work in the same way as a domain group policy): +

    1. On the XP workstation, log in with an Administrative account.

    2. Click on Start -> Run.

    3. Type mmc.

    4. Click on OK.

    5. A Microsoft Management Console should appear.

    6. Click on File -> Add/Remove Snap-in -> Add.

    7. Double-click on Group Policy.

    8. Click on Finish -> Close.

    9. Click on OK.

    10. In the “Console Root” window expand Local Computer Policy -> + Computer Configuration -> Administrative Templates -> System -> User Profiles.

    11. Double-click on Do not check for user ownership of Roaming Profile Folders.

    12. Select Enabled.

    13. Click on OK.

    14. Close the whole console. You do not need to save the settings (this refers to the + console settings rather than the policies you have changed).

    15. Reboot.

    Sharing Profiles between W9x/Me and NT4/200x/XP Workstations

    Sharing of desktop profiles between Windows versions is not recommended. Desktop profiles are an +evolving phenomenon and profiles for later versions of MS Windows clients add features that may interfere +with earlier versions of MS Windows clients. Probably the more salient reason to not mix profiles is +that when logging off an earlier version of MS Windows, the older format of profile contents may overwrite +information that belongs to the newer version resulting in loss of profile information content when that +user logs on again with the newer version of MS Windows.

    If you then want to share the same Start Menu/Desktop with W9x/Me, you will need to specify a common +location for the profiles. The smb.conf parameters that need to be common are logon path and logon home.

    If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory.

    Profile Migration from Windows NT4/200x Server to Samba

    There is nothing to stop you from specifying any path that you like for the location of users' profiles. +Therefore, you could specify that the profile be stored on a Samba server, or any other SMB server, +as long as that SMB server supports encrypted passwords.

    Windows NT4 Profile Management Tools

    Unfortunately, the Resource Kit information is specific to the version of MS Windows NT4/200x. The +correct resource kit is required for each platform.

    Here is a quick guide:

    1. On your NT4 Domain Controller, right click on My Computer, then select the + tab labeled User Profiles.

    2. Select a user profile you want to migrate and click on it.

      Note

      I am using the term “migrate” loosely. You can copy a profile to create a group + profile. You can give the user Everyone rights to the profile you copy this to. That + is what you need to do, since your Samba domain is not a member of a trust relationship with your NT4 + PDC.

    3. Click on the Copy To button.

    4. In the box labeled Copy Profile to add your new path, e.g., + c:\temp\foobar

    5. Click on Change in the Permitted to use box.

    6. Click on the group “Everyone”, click on OK. This + closes the “choose user” box.

    7. Now click on OK.

    Follow the above for every profile you need to migrate.

    Side Bar Notes

    + +You should obtain the SID of your NT4 domain. You can use smbpasswd to do this. Read the man +page.

    moveuser.exe

    The Windows 200x professional resource kit has moveuser.exe. moveuser.exe changes the security of a profile +from one user to another. This allows the account domain to change, and/or the user name to change.

    +This command is like the Samba profiles tool. +

    Get SID

    + +You can identify the SID by using GetSID.exe from the Windows NT Server 4.0 Resource Kit.

    Windows NT 4.0 stores the local profile information in the registry under the following key: +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

    Under the ProfileList key, there will be subkeys named with the SIDs of the users who have logged +on to this computer. (To find the profile information for the user whose locally cached profile you want +to move, find the SID for the user with the GetSID.exe utility.) Inside the appropriate user's subkey, +you will see a string value named ProfileImagePath.

    Mandatory Profiles

    + +A Mandatory Profile is a profile that the user does not have the ability to overwrite. During the +user's session, it may be possible to change the desktop environment, however, as the user logs out all changes +made will be lost. If it is desired to not allow the user any ability to change the desktop environment, +then this must be done through policy settings. See the previous chapter.

    Note

    +Under NO circumstances should the profile directory (or its contents) be made read-only +as this may render the profile un-usable. Where it is essential to make a profile read-only +within the UNIX file system, this can be done but then you absolutely must use the fake-permissions +VFS module to instruct MS Windows NT/200x/XP clients that the Profile has write permission for the user. See . +

    For MS Windows NT4/200x/XP, the above method can also be used to create mandatory profiles. To +convert a group profile into a mandatory profile, simply locate the NTUser.DAT file in the copied profile +and rename it to NTUser.MAN.

    For MS Windows 9x/ME, it is the User.DAT file that must be renamed to +User.MAN to effect a mandatory profile.

    Creating and Managing Group Profiles

    + +Most organizations are arranged into departments. There is a nice benefit in this fact since usually +most users in a department require the same desktop applications and the same desktop layout. MS +Windows NT4/200x/XP will allow the use of Group Profiles. A Group Profile is a profile that is created +first using a template (example) user. Then using the profile migration tool (see above), the profile is +assigned access rights for the user group that needs to be given access to the group profile.

    The next step is rather important. Instead of assigning a group profile to users (Using User Manager) +on a “per user” basis, the group itself is assigned the now modified profile.

    Note

    Be careful with Group Profiles. If the user who is a member of a group also has a personal +profile, then the result will be a fusion (merge) of the two.

    Default Profile for Windows Users

    + +MS Windows 9x/Me and NT4/200x/XP will use a default profile for any user for whom a profile +does not already exist. Armed with a knowledge of where the default profile is located on the Windows +workstation, and knowing which registry keys effect the path from which the default profile is created, +it is possible to modify the default profile to one that has been optimized for the site. This has +significant administrative advantages.

    MS Windows 9x/Me

    To enable default per use profiles in Windows 9x/ME, you can either use the Windows +98 System Policy Editor or change the registry directly.

    To enable default per user profiles in Windows 9x/ME, launch the System Policy +Editor, then select File -> Open Registry, +next click on the Local Computer icon, click on Windows 98 System, +select User Profiles, and click on the enable box. Remember to save the registry +changes.

    To modify the registry directly, launch the Registry Editor +(regedit.exe) and select the hive HKEY_LOCAL_MACHINE\Network\Logon. Now +add a DWORD type key with the name “User Profiles,” to +enable user profiles to set the value +to 1; to disable user profiles set it to 0.

    User Profile Handling with Windows 9x/Me

    When a user logs on to a Windows 9x/Me machine, the local profile path, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList, is checked -for an existing entry for that user: -

    -If the user has an entry in this registry location, Windows 9x / Me checks for a locally cached -version of the user profile. Windows 9x / Me also checks the user's home directory (or other -specified directory if the location has been modified) on the server for the User Profile. -If a profile exists in both locations, the newer of the two is used. If the User Profile exists -on the server, but does not exist on the local machine, the profile on the server is downloaded -and used. If the User Profile only exists on the local machine, that copy is used. -

    -If a User Profile is not found in either location, the Default User Profile from the Windows 9x / Me -machine is used and is copied to a newly created folder for the logged on user. At log off, any -changes that the user made are written to the user's local profile. If the user has a roaming -profile, the changes are written to the user's profile on the server. -

    MS Windows NT4 Workstation

    -On MS Windows NT4 the default user profile is obtained from the location +for an existing entry for that user.

    If the user has an entry in this registry location, Windows 9x/Me checks for a locally cached +version of the user profile. Windows 9x/Me also checks the user's home directory (or other specified +directory if the location has been modified) on the server for the User Profile. If a profile exists +in both locations, the newer of the two is used. If the User Profile exists on the server, but does not +exist on the local machine, the profile on the server is downloaded and used. If the User Profile only +exists on the local machine, that copy is used.

    If a User Profile is not found in either location, the Default User Profile from the Windows +9x/Me machine is used and copied to a newly created folder for the logged on user. At log off, any +changes that the user made are written to the user's local profile. If the user has a roaming profile, +the changes are written to the user's profile on the server.

    MS Windows NT4 Workstation

    On MS Windows NT4, the default user profile is obtained from the location %SystemRoot%\Profiles which in a default installation will translate to -C:\WinNT\Profiles. Under this directory on a clean install there will be -three (3) directories: Administrator, All Users, Default User. -

    -The All Users directory contains menu settings that are common across all -system users. The Default User directory contains menu entries that are -customisable per user depending on the profile settings chosen/created. -

    -When a new user first logs onto an MS Windows NT4 machine a new profile is created from: -

    • All Users settings

    • Default User settings (contains the default NTUser.DAT file)

    -When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain -the following steps are followed in respect of profile handling: -

    1. - The users' account information which is obtained during the logon process contains - the location of the users' desktop profile. The profile path may be local to the - machine or it may be located on a network share. If there exists a profile at the location - of the path from the user account, then this profile is copied to the location - %SystemRoot%\Profiles\%USERNAME%. This profile then inherits the - settings in the All Users profile in the %SystemRoot%\Profiles - location. -

    2. - If the user account has a profile path, but at it's location a profile does not exist, - then a new profile is created in the %SystemRoot%\Profiles\%USERNAME% - directory from reading the Default User profile. -

    3. - If the NETLOGON share on the authenticating server (logon server) contains a policy file - (NTConfig.POL) then it's contents are applied to the NTUser.DAT - which is applied to the HKEY_CURRENT_USER part of the registry. -

    4. - When the user logs out, if the profile is set to be a roaming profile it will be written - out to the location of the profile. The NTuser.DAT file is then - re-created from the contents of the HKEY_CURRENT_USER contents. - Thus, should there not exist in the NETLOGON share an NTConfig.POL at the - next logon, the effect of the previous NTConfig.POL will still be held - in the profile. The effect of this is known as tatooing. -

    -MS Windows NT4 profiles may be Local or Roaming. A Local profile -will stored in the %SystemRoot%\Profiles\%USERNAME% location. A roaming profile will -also remain stored in the same way, unless the following registry key is created: -

    -

    -HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
-winlogon\"DeleteRoamingCache"=dword:00000001
-

    - -In which case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be -deleted on logout. -

    -Under MS Windows NT4 default locations for common resources (like My Documents -may be redirected to a network share by modifying the following registry keys. These changes may be affected -via use of the System Policy Editor (to do so may require that you create your owns template extension -for the policy editor to allow this to be done through the GUI. Another way to do this is by way of first -creating a default user profile, then while logged in as that user, run regedt32 to edit the key settings. -

    -The Registry Hive key that affects the behaviour of folders that are part of the default user profile -are controlled by entries on Windows NT4 is: -

    -HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\ -

    -The above hive key contains a list of automatically managed folders. The default entries are: -

    -

    Table 24.1. User Shell Folder registry keys default values

    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    NetHood%USERPROFILE%\NetHood
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu %USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup

    -

    -The registry key that contains the location of the default profile settings is: -

    -HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders -

    -The default entries are: - -

    Table 24.2. Defaults of profile settings registry keys

    Common Desktop%SystemRoot%\Profiles\All Users\Desktop
    Common Programs%SystemRoot%\Profiles\All Users\Programs
    Common Start Menu%SystemRoot%\Profiles\All Users\Start Menu
    Common Startup%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup

    -

    MS Windows 200x/XP

    Note

    - MS Windows XP Home Edition does use default per user profiles, but can not participate - in domain security, can not log onto an NT/ADS style domain, and thus can obtain the profile - only from itself. While there are benefits in doing this the beauty of those MS Windows - clients that CAN participate in domain logon processes allows the administrator to create - a global default profile and to enforce it through the use of Group Policy Objects (GPOs). -

    -When a new user first logs onto MS Windows 200x/XP machine the default profile is obtained from -C:\Documents and Settings\Default User. The administrator can modify (or change -the contents of this location and MS Windows 200x/XP will gladly use it. This is far from the optimum -arrangement since it will involve copying a new default profile to every MS Windows 200x/XP client -workstation. -

    -When MS Windows 200x/XP participate in a domain security context, and if the default user -profile is not found, then the client will search for a default profile in the NETLOGON share -of the authenticating server. ie: In MS Windows parlance: -%LOGONSERVER%\NETLOGON\Default User and if one exits there it will copy this -to the workstation to the C:\Documents and Settings\ under the Windows -login name of the user. -

    Note

    - This path translates, in Samba parlance, to the smb.conf [NETLOGON] share. The directory - should be created at the root of this share and must be called Default Profile. -

    -If a default profile does not exist in this location then MS Windows 200x/XP will use the local -default profile. -

    -On logging out, the users' desktop profile will be stored to the location specified in the registry -settings that pertain to the user. If no specific policies have been created, or passed to the client -during the login process (as Samba does automatically), then the user's profile will be written to -the local machine only under the path C:\Documents and Settings\%USERNAME%. -

    -Those wishing to modify the default behaviour can do so through three methods: -

    • - Modify the registry keys on the local machine manually and place the new default profile in the - NETLOGON share root - NOT recommended as it is maintenance intensive. -

    • - Create an NT4 style NTConfig.POL file that specified this behaviour and locate this file - in the root of the NETLOGON share along with the new default profile. -

    • - Create a GPO that enforces this through Active Directory, and place the new default profile - in the NETLOGON share. -

    -The Registry Hive key that affects the behaviour of folders that are part of the default user profile -are controlled by entries on Windows 200x/XP is: -

    -HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\ -

    -The above hive key contains a list of automatically managed folders. The default entries are: -

    -

    Table 24.3. Defaults of default user profile paths registry keys

    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Cache%USERPROFILE%\Local Settings\Temporary Internet Files
    Cookies%USERPROFILE%\Cookies
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    History%USERPROFILE%\Local Settings\History
    Local AppData%USERPROFILE%\Local Settings\Application Data
    Local Settings%USERPROFILE%\Local Settings
    My Pictures%USERPROFILE%\My Documents\My Pictures
    NetHood%USERPROFILE%\NetHood
    Personal%USERPROFILE%\My Documents
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu%USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup
    Templates%USERPROFILE%\Templates

    -

    -There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all -the others are of type REG_EXPAND_SZ. -

    -It makes a huge difference to the speed of handling roaming user profiles if all the folders are -stored on a dedicated location on a network server. This means that it will NOT be necessary to -write the Outlook PST file over the network for every login and logout. -

    -To set this to a network location you could use the following examples: -

    %LOGONSERVER%\%USERNAME%\Default Folders

    -This would store the folders in the user's home directory under a directory called Default Folders -You could also use: -

    \\SambaServer\FolderShare\%USERNAME%

    - in which case the default folders will be stored in the server named SambaServer -in the share called FolderShare under a directory that has the name of the MS Windows -user as seen by the Linux/UNIX file system. -

    -Please note that once you have created a default profile share, you MUST migrate a user's profile -(default or custom) to it. -

    -MS Windows 200x/XP profiles may be Local or Roaming. -A roaming profile will be cached locally unless the following registry key is created: -

    -

    -HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
+C:\Windows NT\Profiles. Under this directory on a clean install there will be three
+(3) directories: Administrator, All
+Users, and Default
+User. 
     The All Users directory contains menu settings that are common across all
+system users. The Default User directory contains menu entries that are customizable
+per user depending on the profile settings chosen/created. 
     When a new user first logs onto an MS Windows NT4 machine, a new profile is created from: 
    • All Users settings.
    • Default User settings (contains the default NTUser.DAT file).
     When a user logs onto an MS Windows NT4 machine that is a member of a Microsoft security domain,
+	the following steps are followed in respect of profile handling: 
+
+
+
    1.  The users' account information that is obtained during the logon process
+	contains the location of the users' desktop profile. The profile path may be local to
+	the machine or it may be located on a network share. If there exists a profile at the
+	location of the path from the user account, then this profile is copied to the location
+	%SystemRoot%\Profiles\%USERNAME%. This profile then inherits the settings
+	in the All Users profile in the %SystemRoot%\Profiles
+	location. 
    2.  If the user account has a profile path, but at its location a profile does not
+	exist, then a new profile is created in the %SystemRoot%\Profiles\%USERNAME%
+	directory from reading the Default User profile. 
    3.  If the NETLOGON share on the authenticating server (logon server) contains
+	a policy file (NTConfig.POL), then its contents are applied to the
+	NTUser.DAT which is applied to the HKEY_CURRENT_USER
+	part of the registry. 
+	
    4.  When the user logs out, if the profile is set to be a roaming profile it will be
+	written out to the location of the profile. The NTuser.DAT file is then
+	recreated from the contents of the HKEY_CURRENT_USER contents. Thus,
+	should there not exist in the NETLOGON share an NTConfig.POL at the next
+	logon, the effect of the previous NTConfig.POL will still be held in the
+	profile. The effect of this is known as tattooing.
+	
     MS Windows NT4 profiles may be local or roaming. A local
+profile will stored in the %SystemRoot%\Profiles\%USERNAME% location. A roaming
+profile will also remain stored in the same way, unless the following registry key is created as shown: 
     HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
+winlogon\"DeleteRoamingCache"=dword:0000000
+ 
    
+In this case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be deleted
+on logout.
     Under MS Windows NT4, default locations for common resources like My Documents
+may be redirected to a network share by modifying the following registry keys. These changes may be
+affected via use of the System Policy Editor. To do so may require that you create your own template
+extension for the policy editor to allow this to be done through the GUI. Another way to do this is by
+way of first creating a default user profile, then while logged in as that user, run regedt32 to edit
+the key settings. 
    
+The Registry Hive key that affects the behavior of folders that are part of the default user
+profile are controlled by entries on Windows NT4 is:
+
    +HKEY_CURRENT_USER
+	\Software
+		\Microsoft
+			\Windows
+				\CurrentVersion
+					\Explorer
+						\User Shell Folders
+
    
+
+
     The above hive key contains a list of automatically managed folders. The default entries are shown in . 
    Table 24.1. User Shell Folder Registry Keys Default Values
    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    NetHood%USERPROFILE%\NetHood
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu %USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup
     The registry key that contains the location of the default profile settings is: 
     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
+User Shell Folders 
     The default entries are shown in .
    Table 24.2. Defaults of Profile Settings Registry Keys
    Common Desktop%SystemRoot%\Profiles\All Users\Desktop
    Common Programs%SystemRoot%\Profiles\All Users\Programs
    Common Start Menu%SystemRoot%\Profiles\All Users\Start Menu
    Common Startup%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup

    MS Windows 200x/XP

    Note

    + +MS Windows XP Home Edition does use default per user profiles, but cannot participate +in domain security, cannot log onto an NT/ADS-style domain, and thus can obtain the profile only +from itself. While there are benefits in doing this, the beauty of those MS Windows clients that +can participate in domain logon processes allows the administrator to create a global default +profile and enforce it through the use of Group Policy Objects (GPOs). +

    When a new user first logs onto an MS Windows 200x/XP machine, the default profile is obtained from +C:\Documents and Settings\Default User. The administrator can modify or change the +contents of this location and MS Windows 200x/XP will gladly use it. This is far from the optimum arrangement +since it will involve copying a new default profile to every MS Windows 200x/XP client workstation.

    When MS Windows 200x/XP participates in a domain security context, and if the default user profile is + not found, then the client will search for a default profile in the NETLOGON share of the authenticating + server. In MS Windows parlance,%LOGONSERVER%\NETLOGON\Default User, and if one +exists there it will copy this to the workstation to the C:\Documents and Settings\ +under the Windows login name of the user.

    Note

    This path translates, in Samba parlance, to the smb.conf +[NETLOGON] share. The directory should be created at the root +of this share and must be called Default Profile.

    If a default profile does not exist in this location, then MS Windows 200x/XP will use the local +default profile.

    On logging out, the users' desktop profile will be stored to the location specified in the registry +settings that pertain to the user. If no specific policies have been created or passed to the client +during the login process (as Samba does automatically), then the user's profile will be written to the +local machine only under the path C:\Documents and Settings\%USERNAME%.

    Those wishing to modify the default behavior can do so through these three methods:

    • Modify the registry keys on the local machine manually and place the new + default profile in the NETLOGON share root. This is not recommended as it is maintenance intensive. +

    • Create an NT4-style NTConfig.POL file that specified this behavior and locate + this file in the root of the NETLOGON share along with the new default profile.

    • Create a GPO that enforces this through Active Directory, and place the new + default profile in the NETLOGON share.

    The registry hive key that effects the behavior of folders that are part of the default user +profile are controlled by entries on Windows 200x/XP is:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell +Folders\

    +The above hive key contains a list of automatically managed folders. The default entries are shown +in + +

    Table 24.3. Defaults of Default User Profile Paths Registry Keys

    NameDefault Value
    AppData%USERPROFILE%\Application Data
    Cache%USERPROFILE%\Local Settings\Temporary Internet Files
    Cookies%USERPROFILE%\Cookies
    Desktop%USERPROFILE%\Desktop
    Favorites%USERPROFILE%\Favorites
    History%USERPROFILE%\Local Settings\History
    Local AppData%USERPROFILE%\Local Settings\Application Data
    Local Settings%USERPROFILE%\Local Settings
    My Pictures%USERPROFILE%\My Documents\My Pictures
    NetHood%USERPROFILE%\NetHood
    Personal%USERPROFILE%\My Documents
    PrintHood%USERPROFILE%\PrintHood
    Programs%USERPROFILE%\Start Menu\Programs
    Recent%USERPROFILE%\Recent
    SendTo%USERPROFILE%\SendTo
    Start Menu%USERPROFILE%\Start Menu
    Startup%USERPROFILE%\Start Menu\Programs\Startup
    Templates%USERPROFILE%\Templates

    There is also an entry called “Default” that has no value set. The default entry is +of type REG_SZ, all the others are of type REG_EXPAND_SZ.

    It makes a huge difference to the speed of handling roaming user profiles if all the folders are +stored on a dedicated location on a network server. This means that it will not be necessary to write +the Outlook PST file over the network for every login and logout.

    To set this to a network location, you could use the following examples:

    %LOGONSERVER%\%USERNAME%\Default Folders

    This would store the folders in the user's home directory under a directory called Default +Folders. You could also use:

    \\SambaServer\FolderShare\%USERNAME%

    +in which case the default folders will be stored in the server named SambaServer +in the share called FolderShare under a directory that has the name of the +MS Windows user as seen by the Linux/UNIX file system.

    Please note that once you have created a default profile share, you MUST migrate a user's profile +(default or custom) to it.

    MS Windows 200x/XP profiles may be Local or Roaming. + A roaming profile will be cached locally unless the following registry key is created: + + +

     HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\
 	winlogon\"DeleteRoamingCache"=dword:00000001

    -In which case, the local cache copy will be deleted on logout. -

    Common Errors

    -The following are some typical errors/problems/questions that have been asked. -

    Setting up roaming profiles for just a few user's or group's?

    -With samba-2.2.x the choice you have is to enable or disable roaming -profiles support. It is a global only setting. The default is to have -roaming profiles and the default path will locate them in the user's home -directory. -

    -If disabled globally then no-one will have roaming profile ability. -If enabled and you want it to apply only to certain machines, then on -those machines on which roaming profile support is NOT wanted it is then -necessary to disable roaming profile handling in the registry of each such -machine. -

    -With samba-3 you can have a global profile -setting in smb.conf _AND_ you can over-ride this by per-user settings -using the Domain User Manager (as with MS Windows NT4/ Win 2Kx). -

    -In any case, you can configure only one profile per user. That profile can -be either: -

    • A profile unique to that user

    • A mandatory profile (one the user can not change)

    • A group profile (really should be mandatory ie:unchangable)

    Can NOT use Roaming Profiles

    -A user requested the following: -“ -I do not want Roaming profiles to be implemented. I want to give users a local profile alone. ... -Please help me I am totally lost with this error. For the past two days I tried everything, I googled -around but found no useful pointers. Please help me. -”

    -The choices are: -

    Local profiles:

    - I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out -

    Roaming profiles:

    - As a user logs onto the network a centrally stored profile is copied to the workstation - to form a local profile. This local profile will persist (remain on the workstation disk) - unless a registry key is changed that will cause this profile to be automatically deleted - on logout. -

    -The Roaming Profile choices are: -

    Personal Roaming profiles

    - These are typically stored in a profile share on a central (or conveniently located - local) server. -

    - Workstations 'cache' (store) a local copy of the profile. This cached copy is used when - the profile can not be downloaded at next logon. -

    Group profiles

    These are loaded from a central profile server

    Mandatory profiles

    - Mandatory profiles can be created for a user as well as for any group that a user - is a member of. Mandatory profiles can NOT be changed by ordinary users. Only the administrator - can change or reconfigure a mandatory profile. -

    -A WinNT4/2K/XP profile can vary in size from 130KB to off the scale. -Outlook PST files are most often part of the profile and can be many GB in -size. On average (in a well controlled environment) roaming profile size of -2MB is a good rule of thumb to use for planning purposes. In an -undisciplined environment I have seen up to 2GB profiles. Users tend to -complain when it take an hour to log onto a workstation but they harvest -the fruits of folly (and ignorance). -

    -The point of all the above is to show that roaming profiles and good -controls of how they can be changed as well as good discipline make up for -a problem free site. -

    -Microsoft's answer to the PST problem is to store all email in an MS -Exchange Server back-end. This removes the need for a PST file. -

    -LOCAL profiles mean: -

    • If each machine is used my many users then much local disk storage is needed for local profiles

    • Every workstation the user logs into has it's own profile, these can be very different from machine to machine

    -On the other hand, use of roaming profiles means: -

    • The network administrator can control the desktop environment of all users.

    • Use of mandatory profiles drasitcally reduces network management overheads.

    • In the long run users will be experience fewer problems.

    Changing the default profile

    -Question: -“ -When the client logs onto the domain controller it searches for a profile to download, -where do I put this default profile? -”

    -Firstly, the samba server needs to be configured as a domain controller. -This can be done by setting in smb.conf: -

    security = user
    os level = 32 (or more)
    domain logons = Yes

    -There must be an [netlogon] share that is world readable. -It is a good idea to add a logon script to pre-set printer and -drive connections. There is also a facility for automatically -synchronizing the workstation time clock with that of the logon -server (another good thing to do). -

    Note

    -To invoke auto-deletion of roaming profile from the local -workstation cache (disk storage) use the Group Policy Editor -to create a file called NTConfig.POL with the appropriate entries. This -file needs to be located in the netlogon share root directory.

    -Windows clients need to be members of the domain. Workgroup machines do NOT use network logons so -they do not interoperate with domain profiles. -

    -For roaming profiles add to smb.conf: -

    -

    logon path = \\%N\profiles\%U
    # Default logon drive is Z:
    logon drive = H:
    # This requires a PROFILES share that is world writable.

    -

    Chapter 25. PAM based Distributed Authentication

    John H. Terpstra

    Samba Team

    Stephen Langasek

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    Winbind is not resolving users and groups

    -This chapter you should help you to deploy winbind based authentication on any PAM enabled -UNIX/Linux system. Winbind can be used to enable user level application access authentication -from any MS Windows NT Domain, MS Windows 200x Active Directory based domain, or any Samba -based domain environment. It will also help you to configure PAM based local host access +In this case, the local cache copy will be deleted on logout. +

    Common Errors

    +The following are some typical errors, problems and questions that have been asked on the Samba mailing lists. +

    Configuring Roaming Profiles for a Few Users or Groups

    +With Samba-2.2.x, the choice you have is to enable or disable roaming profiles support. It is a +global only setting. The default is to have roaming profiles and the default path will locate them in +the user's home directory. +

    +If disabled globally, then no one will have roaming profile ability. If enabled and you want it +to apply only to certain machines, then on those machines on which roaming profile support is not wanted +it is then necessary to disable roaming profile handling in the registry of each such machine. +

    +With Samba-3, you can have a global profile setting in smb.conf and you can override this by +per-user settings using the Domain User Manager (as with MS Windows NT4/ Win 200xx).

    In any case, you can configure only one profile per user. That profile can be either:

    • A profile unique to that user.
    • A mandatory profile (one the user cannot change).
    • A group profile (really should be mandatory, that is unchangable).

    Cannot Use Roaming Profiles

    A user requested the following: “ I do not want Roaming profiles to be implemented. I want +to give users a local profile alone. Please help me, I am totally lost with this error. For the past +two days I tried everything, I googled around but found no useful pointers. Please help me. ”

    The choices are:

    Local profiles

    I know of no registry keys that will allow + auto-deletion of LOCAL profiles on log out.

    Roaming profiles

    As a user logs onto the network, a centrally + stored profile is copied to the workstation to form a local profile. This local profile + will persist (remain on the workstation disk) unless a registry key is changed that will + cause this profile to be automatically deleted on logout.

    The roaming profile choices are:

    Personal roaming profiles

    These are typically stored in + a profile share on a central (or conveniently located local) server.

    Workstations cache (store) a local copy of the profile. This cached + copy is used when the profile cannot be downloaded at next logon.

    Group profiles

    These are loaded from a central profile + server.

    Mandatory profiles

    Mandatory profiles can be created for + a user as well as for any group that a user is a member of. Mandatory profiles cannot be + changed by ordinary users. Only the administrator can change or reconfigure a mandatory + profile.

    A Windows NT4/200x/XP profile can vary in size from 130KB to very large. Outlook PST files are +most often part of the profile and can be many GB in size. On average (in a well controlled environment), +roaming profile size of 2MB is a good rule of thumb to use for planning purposes. In an undisciplined +environment, I have seen up to 2GB profiles. Users tend to complain when it takes an hour to log onto a +workstation but they harvest the fruits of folly (and ignorance).

    The point of all the above is to show that roaming profiles and good controls of how they can be +changed as well as good discipline make up for a problem-free site.

    Microsoft's answer to the PST problem is to store all email in an MS Exchange Server backend. This +removes the need for a PST file.

    Local profiles mean:

    • If each machine is used by many users, then much local disk storage is needed + for local profiles.

    • Every workstation the user logs into has + its own profile; these can be very different from machine to machine.

    On the other hand, use of roaming profiles means:

    • The network administrator can control the desktop environment of all users.

    • Use of mandatory profiles drastically reduces network management overheads.

    • In the long run, users will experience fewer problems.

    Changing the Default Profile

    “When the client logs onto the Domain Controller, it searches +for a profile to download. Where do I put this default profile?”

    + +First, the Samba server needs to be configured as a Domain Controller. This can be done by +setting in smb.conf:

    security = user
    os level = 32 (or more)
    domain logons = Yes

    There must be a [netlogon] share that is world readable. It is +a good idea to add a logon script to pre-set printer and drive connections. There is also a facility +for automatically synchronizing the workstation time clock with that of the logon server (another good +thing to do).

    Note

    To invoke auto-deletion of roaming profile from the local workstation cache (disk storage), use +the Group Policy Editor to create a file called NTConfig.POL +with the appropriate entries. This file needs to be located in the netlogon +share root directory.

    Windows clients need to be members of the domain. Workgroup machines do not use network logons +so they do not interoperate with domain profiles.

    For roaming profiles, add to smb.conf:

    logon path = \\%N\profiles\%U
    # Default logon drive is Z:
    logon drive = H:
    # This requires a PROFILES share that is world writable.

    Chapter 25. PAM-Based Distributed Authentication

    John H. Terpstra

    Samba Team

    Stephen Langasek

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication Using winbindd.so
    Password Synchronization Using pam_smbpass.so
    Common Errors
    pam_winbind Problem
    Winbind Is Not Resolving Users and Groups

    +This chapter should help you to deploy Winbind-based authentication on any PAM-enabled +UNIX/Linux system. Winbind can be used to enable User-Level application access authentication +from any MS Windows NT Domain, MS Windows 200x Active Directory-based +domain, or any Samba-based domain environment. It will also help you to configure PAM-based local host access controls that are appropriate to your Samba configuration.

    -In addition to knowing how to configure winbind into PAM, you will learn generic PAM management -possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage. +In addition to knowing how to configure Winbind into PAM, you will learn generic PAM management +possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage.

    Note

    -The use of Winbind require more than PAM configuration alone. Please refer to the Winbind chapter. -

    Features and Benefits

    -A number of UNIX systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, +The use of Winbind requires more than PAM configuration alone. +Please refer to , for further information regarding Winbind. +

    Features and Benefits

    +A number of UNIX systems (e.g., Sun Solaris), as well as the xxxxBSD family and Linux, now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication, authorization and resource control services. Prior to the introduction of PAM, a decision to use an alternative to the system password database (/etc/passwd) would require the provision of alternatives for all programs that provide security services. -Such a choice would involve provision of alternatives to such programs as: login, -passwd, chown, etc. +Such a choice would involve provision of alternatives to programs such as: login, +passwd, chown, and so on.

    PAM provides a mechanism that disconnects these security programs from the underlying -authentication/authorization infrastructure. PAM is configured either through one file -/etc/pam.conf (Solaris), or by editing individual files that are +authentication/authorization infrastructure. PAM is configured by making appropriate modifications to one file +/etc/pam.conf (Solaris), or by editing individual control files that are located in /etc/pam.d.

    -On PAM enabled UNIX/Linux systems it is an easy matter to configure the system to use any -authentication backend, so long as the appropriate dynamically loadable library modules -are available for it. The backend may be local to the system, or may be centralised on a +On PAM-enabled UNIX/Linux systems, it is an easy matter to configure the system to use any +authentication backend so long as the appropriate dynamically loadable library modules +are available for it. The backend may be local to the system, or may be centralized on a remote server.

    PAM support modules are available for: -

    /etc/passwd:

    +

    /etc/passwd

    There are several PAM modules that interact with this standard UNIX user - database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so - and pam_userdb.so. -

    Kerberos:

    - The pam_krb5.so module allows the use of any Kerberos compliant server. + database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so + and pam_userdb.so. +

    Kerberos

    + The pam_krb5.so module allows the use of any Kerberos compliant server. This tool is used to access MIT Kerberos, Heimdal Kerberos, and potentially Microsoft Active Directory (if enabled). -

    LDAP:

    - The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend +

    LDAP

    + The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend server. Commonly used LDAP backend servers include: OpenLDAP v2.0 and v2.1, Sun ONE iDentity server, Novell eDirectory server, Microsoft Active Directory. -

    NetWare Bindery:

    - The pam_ncp_auth.so module allows authentication off any bindery enabled - NetWare Core Protocol based server. -

    SMB Password:

    - This module, called pam_smbpass.so, will allow user authentication off +

    NetWare Bindery

    + The pam_ncp_auth.so module allows authentication off any bindery-enabled + NetWare Core Protocol-based server. +

    SMB Password

    + This module, called pam_smbpass.so, will allow user authentication off the passdb backend that is configured in the Samba smb.conf file. -

    SMB Server:

    - The pam_smb_auth.so module is the original MS Windows networking authentication +

    SMB Server

    + The pam_smb_auth.so module is the original MS Windows networking authentication tool. This module has been somewhat outdated by the Winbind module. -

    Winbind:

    - The pam_winbind.so module allows Samba to obtain authentication from any +

    Winbind

    + The pam_winbind.so module allows Samba to obtain authentication from any MS Windows Domain Controller. It can just as easily be used to authenticate - users for access to any PAM enabled application. -

    RADIUS:

    + users for access to any PAM-enabled application. +

    RADIUS

    There is a PAM RADIUS (Remote Access Dial-In User Service) authentication - module. In most cases the administrator will need to locate the source code + module. In most cases, administrators will need to locate the source code for this tool and compile and install it themselves. RADIUS protocols are used by many routers and terminal servers.

    -Of the above, Samba provides the pam_smbpasswd.so and the pam_winbind.so modules alone. +Of the above, Samba provides the pam_smbpasswd.so and the pam_winbind.so modules alone.

    Once configured, these permit a remarkable level of flexibility in the location and use -of distributed samba domain controllers that can provide wide are network bandwidth -efficient authentication services for PAM capable systems. In effect, this allows the -deployment of centrally managed and maintained distributed authentication from a single -user account database. -

    Technical Discussion

    +of distributed Samba Domain Controllers that can provide wide area network bandwidth +efficient authentication services for PAM-capable systems. In effect, this allows the +deployment of centrally managed and maintained distributed authentication from a +single-user account database. +

    Technical Discussion

    PAM is designed to provide the system administrator with a great deal of flexibility in configuration of the privilege granting applications of their system. The local configuration of system security controlled by PAM is contained in one of two places: -either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory. -

    PAM Configuration Syntax

    +either the single system file, /etc/pam.conf, or the +/etc/pam.d/ directory. +

    PAM Configuration Syntax

    In this section we discuss the correct syntax of and generic options respected by entries to these files. -PAM specific tokens in the configuration file are case insensitive. The module paths, however, are case -sensitive since they indicate a file's name and reflect the case dependence of typical file-systems. +PAM-specific tokens in the configuration file are case insensitive. The module paths, however, are case +sensitive since they indicate a file's name and reflect the case +dependence of typical file systems. The case-sensitivity of the arguments to any given module is defined for each module in turn.

    In addition to the lines described below, there are two special characters provided for the convenience -of the system administrator: comments are preceded by a `#' and extend to the next end-of-line; also, -module specification lines may be extended with a `\' escaped newline. +of the system administrator: comments are preceded by a “#” and extend to the next end-of-line; also, +module specification lines may be extended with a “\” escaped newline.

    If the PAM authentication module (loadable link library file) is located in the -default location then it is not necessary to specify the path. In the case of +default location, then it is not necessary to specify the path. In the case of Linux, the default location is /lib/security. If the module -is located outside the default then the path must be specified as: +is located outside the default, then the path must be specified as: 

     auth  required  /other_path/pam_strange_module.so

    -

    Anatomy of /etc/pam.d Entries

    +

    Anatomy of /etc/pam.d Entries

    The remaining information in this subsection was taken from the documentation of the Linux-PAM project. For more information on PAM, see -The Official Linux-PAM home page +The Official Linux-PAM home page.

    -A general configuration line of the /etc/pam.conf file has the following form: +A general configuration line of the /etc/pam.conf file has the following form: 

     service-name   module-type   control-flag   module-path   args
@@ -13210,36 +13185,38 @@ service-name   module-type   control-flag   module-path   args
 Below, we explain the meaning of each of these tokens. The second (and more recently adopted)
 way of configuring Linux-PAM is via the contents of the /etc/pam.d/ directory.
 Once we have explained the meaning of the above tokens, we will describe this method.
-
    service-name:
    
-		The name of the service associated with this entry. Frequently the service name is the conventional
-		name of the given application. For example, `ftpd', `rlogind' and `su', etc. .
+
    service-name
    
+		The name of the service associated with this entry. Frequently, the service name is the conventional
+		name of the given application. For example, ftpd, rlogind and
+		su, and so on.
 		
    
-		There is a special service-name, reserved for defining a default authentication mechanism. It has
-		the name `OTHER' and may be specified in either lower or upper case characters. Note, when there
-		is a module specified for a named service, the `OTHER' entries are ignored.
-		
    module-type:
    
+		There is a special service-name reserved for defining a default authentication mechanism. It has
+		the name OTHER and may be specified in either lower- or upper-case characters.
+		Note, when there is a module specified for a named service, the OTHER
+		entries are ignored.
+		
    module-type
    
 		One of (currently) four types of module. The four types are as follows:
 		
    • 
-			auth: this module type provides two aspects of authenticating the user.
-			Firstly, it establishes that the user is who they claim to be, by instructing the application
+			auth: This module type provides two aspects of authenticating the user.
+			It establishes that the user is who he claims to be by instructing the application
 			to prompt the user for a password or other means of identification. Secondly, the module can
 			grant group membership (independently of the /etc/groups file discussed
 			above) or other privileges through its credential granting properties.
 			
    • 
-			account: this module performs non-authentication based account management.
+			account: This module performs non-authentication-based account management.
 			It is typically used to restrict/permit access to a service based on the time of day, currently
 		 	available system resources (maximum number of users) or perhaps the location of the applicant
-			user `root' login only on the console.
+			user “root” login only on the console.
 			
    • 
-			session: primarily, this module is associated with doing things that need
-			to be done for the user before/after they can be given service. Such things include the logging
-			of information concerning the opening/closing of some data exchange with a user, mounting
-			directories, etc.
+			session: Primarily, this module is associated with doing things that need
+			to be done for the user before and after they can be given service. Such things include the logging
+			of information concerning the opening and closing of some data exchange with a user, mounting
+			directories, and so on.
 			
    • 
-			password: this last module type is required for updating the authentication
-			token associated with the user. Typically, there is one module for each `challenge/response'
-			based authentication (auth) module-type.
-			
    control-flag:
    
+			password: This last module type is required for updating the authentication
+			token associated with the user. Typically, there is one module for each “challenge/response”
+			-based authentication (auth) module type.
+			
    control-flag
    
 		The control-flag is used to indicate how the PAM library will react to the success or failure of the
 		module it is associated with. Since modules can be stacked (modules of the same type execute in series,
 		one after another), the control-flags determine the relative importance of each module. The application
@@ -13251,129 +13228,135 @@ Once we have explained the meaning of the above tokens, we will describe this me
 		
    
 		The simpler (and historical) syntax for the control-flag is a single keyword defined to indicate the
 		severity of concern associated with the success or failure of a specific module. There are four such
-		keywords: required, requisite, sufficient and optional.
+		keywords: required, requisite, sufficient and optional.
 		
    
 		The Linux-PAM library interprets these keywords in the following manner:
 		
    • 
-			required: this indicates that the success of the module is required for the
+			required: This indicates that the success of the module is required for the
 			module-type facility to succeed. Failure of this module will not be apparent to the user until all
 			of the remaining modules (of the same module-type) have been executed.
 			
    • 
-			requisite: like required, however, in the case that such a module returns a
+			requisite: Like required, however, in the case that such a module returns a
 			failure, control is directly returned to the application. The return value is that associated with
-			the first required or requisite module to fail. Note, this flag can be used to protect against the
+			the first required or requisite module to fail. This flag can be used to protect against the
 			possibility of a user getting the opportunity to enter a password over an unsafe medium. It is
 			conceivable that such behavior might inform an attacker of valid accounts on a system. This
 			possibility should be weighed against the not insignificant concerns of exposing a sensitive
 			password in a hostile environment.
 			
    • 
-                        sufficient: the success of this module is deemed `sufficient' to satisfy
+                        sufficient: The success of this module is deemed sufficient to satisfy
 			the Linux-PAM library that this module-type has succeeded in its purpose. In the event that no
-			previous required module has failed, no more `stacked' modules of this type are invoked. (Note,
-			in this case subsequent required modules are not invoked.). A failure of this module is not deemed
+			previous required module has failed, no more “stacked” modules of this type are invoked.
+			(In this case, subsequent required modules are not invoked). A failure of this module is not deemed
 			as fatal to satisfying the application that this module-type has succeeded.
 			
    • 
-                        optional: as its name suggests, this control-flag marks the module as not
+                        optional: As its name suggests, this control-flag marks the module as not
 			being critical to the success or failure of the user's application for service. In general,
 			Linux-PAM ignores such a module when determining if the module stack will succeed or fail.
 			However, in the absence of any definite successes or failures of previous or subsequent stacked
-			modules this module will determine the nature of the response to the application. One example of
+			modules, this module will determine the nature of the response to the application. One example of
 			this latter case, is when the other modules return something like PAM_IGNORE.
 			
    
 		The more elaborate (newer) syntax is much more specific and gives the administrator a great deal of control
 		over how the user is authenticated. This form of the control flag is delimited with square brackets and
-		consists of a series of value=action tokens:
+		consists of a series of value=action tokens:
 		
     [value1=action1 value2=action2 ...]
 
    
-		Here, value1 is one of the following return values: success; open_err; symbol_err; service_err;
-		system_err; buf_err; perm_denied; auth_err; cred_insufficient; authinfo_unavail; user_unknown; maxtries;
-		new_authtok_reqd; acct_expired; session_err; cred_unavail; cred_expired; cred_err; no_module_data; conv_err;
-		authtok_err; authtok_recover_err; authtok_lock_busy; authtok_disable_aging; try_again; ignore; abort;
-		authtok_expired; module_unknown; bad_item; and default. The last of these (default) can be used to set
-		the action for those return values that are not explicitly defined.
+		Here, value1 is one of the following return values:
+
    +success; open_err; symbol_err; service_err; system_err; buf_err;
+perm_denied; auth_err; cred_insufficient; authinfo_unavail;
+user_unknown; maxtries; new_authtok_reqd; acct_expired; session_err;
+cred_unavail; cred_expired; cred_err; no_module_data; conv_err;
+authtok_err; authtok_recover_err; authtok_lock_busy;
+authtok_disable_aging; try_again; ignore; abort; authtok_expired;
+module_unknown; bad_item; and default.
+
    
+
    
+		The last of these (default) can be used to set the action for those return values that are not explicitly defined.
 		
    
-		The action1 can be a positive integer or one of the following tokens: ignore; ok; done; bad; die; and reset.
+		The action1 can be a positive integer or one of the following tokens: 
+		ignore; ok; done; bad; die; and reset.
 		A positive integer, J, when specified as the action, can be used to indicate that the next J modules of the
 		current module-type will be skipped. In this way, the administrator can develop a moderately sophisticated
 		stack of modules with a number of different paths of execution. Which path is taken can be determined by the
 		reactions of individual modules.
 		
    • 
-			ignore: when used with a stack of modules, the module's return status will not
+			ignore: When used with a stack of modules, the module's return status will not
 			contribute to the return code the application obtains.
 			
    • 
-                        bad: this action indicates that the return code should be thought of as indicative
+                        bad: This action indicates that the return code should be thought of as indicative
 			of the module failing. If this module is the first in the stack to fail, its status value will be used
 			for that of the whole stack.
 			
    • 
-                        die: equivalent to bad with the side effect of terminating the module stack and
+                        die: Equivalent to bad with the side effect of terminating the module stack and
 			PAM immediately returning to the application.
 			
    • 
-                        ok: this tells PAM that the administrator thinks this return code should
+                        ok: This tells PAM that the administrator thinks this return code should
 			contribute directly to the return code of the full stack of modules. In other words, if the former
 			state of the stack would lead to a return of PAM_SUCCESS, the module's return code will override
 			this value. Note, if the former state of the stack holds some value that is indicative of a modules
-			failure, this 'ok' value will not be used to override that value.
+			failure, this ok value will not be used to override that value.
 			
    • 
-                        done: equivalent to ok with the side effect of terminating the module stack and
+                        done: Equivalent to ok with the side effect of terminating the module stack and
 			PAM immediately returning to the application.
                         
    • 
-                        reset: clear all memory of the state of the module stack and start again with
+                        reset: Clears all memory of the state of the module stack and starts again with
 			the next stacked module.
 			
    
-		Each of the four keywords: required; requisite; sufficient; and optional, have an equivalent expression in
-		terms of the [...] syntax. They are as follows:
+		Each of the four keywords: required; requisite; sufficient; and optional,
+		have an equivalent expression in terms of the [...] syntax. They are as follows:
 		
    
 		
    • 
-			required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad]
+			required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad].
 			
    • 
-			requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die]
+			requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die].
 			
    • 
-			sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore]
+					sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore].
 			
    • 
-			optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore]
+			optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore].
 			
    
 		
    
 		Just to get a feel for the power of this new syntax, here is a taste of what you can do with it. With Linux-PAM-0.63,
 		the notion of client plug-in agents was introduced. This is something that makes it possible for PAM to support
 		machine-machine authentication using the transport protocol inherent to the client/server application. With the
-		[ ... value=action ... ] control syntax, it is possible for an application to be configured
+		[ ... value=action ... ] control syntax, it is possible for an application to be configured
 		to support binary prompts with compliant clients, but to gracefully fall over into an alternative authentication
-		mode for older, legacy, applications.
-		
    module-path:
    
+		mode for older, legacy applications.
+		
    module-path
    
 		The path-name of the dynamically loadable object file; the pluggable module itself. If the first character of the
-		module path is `/', it is assumed to be a complete path. If this is not the case, the given module path is appended
+		module path is “/”, it is assumed to be a complete path. If this is not the case, the given module path is appended
 		to the default module path: /lib/security (but see the notes above).
 		
    
-		The args are a list of tokens that are passed to the module when it is invoked. Much like arguments to a typical
+		The arguments are a list of tokens that are passed to the module when it is invoked, much like arguments to a typical
 		Linux shell command. Generally, valid arguments are optional and are specific to any given module. Invalid arguments
 		are ignored by a module, however, when encountering an invalid argument, the module is required to write an error
-		to syslog(3). For a list of generic options see the next section.
+		to syslog(3). For a list of generic options, see the next section.
 		
    
-		Note, if you wish to include spaces in an argument, you should surround that argument with square brackets. For example:
+		If you wish to include spaces in an argument, you should surround that argument with square brackets. For example:
 		
     squid auth required pam_mysql.so user=passwd_query passwd=mada \
-        db=eminence [query=select user_name from internet_service where \
-                     user_name='%u' and password=PASSWORD('%p') and \
-                     service='web_proxy']
+db=eminence [query=select user_name from internet_service where \
+user_name=“%u” and password=PASSWORD(“%p”) and service=“web_proxy”]
 
    
-		Note, when using this convention, you can include `[' characters inside the string, and if you wish to include a `]'
-		character inside the string that will survive the argument parsing, you should use `\['. In other words:
+		When using this convention, you can include “[” characters inside the string, and if you wish to have a “]”
+		character inside the string that will survive the argument parsing, you should use “\[”. In other words:
 		
     [..[..\]..]    -->   ..[..]..
 
    
-		Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the
+		Any line in one of the configuration files that is not formatted correctly will generally tend (erring on the
 		side of caution) to make the authentication process fail. A corresponding error is written to the system log files
 		with a call to syslog(3). 
-

    Example System Configurations

    +

    Example System Configurations

    The following is an example /etc/pam.d/login configuration file. -This example had all options been uncommented is probably not usable -as it stacks many conditions before allowing successful completion +This example had all options uncommented and is probably not usable +because it stacks many conditions before allowing successful completion of the login process. Essentially all conditions can be disabled -by commenting them out except the calls to pam_pwdb.so. -

    PAM: original login config

    +by commenting them out, except the calls to pam_pwdb.so.
+
    PAM: Original Login Config
     #%PAM-1.0
-# The PAM configuration file for the `login' service
+# The PAM configuration file for the “login” service
 #
 auth         required    pam_securetty.so
 auth         required    pam_nologin.so
@@ -13386,7 +13369,7 @@ session      required    pam_pwdb.so
 # session    optional    pam_lastlog.so
 # password   required    pam_cracklib.so retry=3
 password     required    pam_pwdb.so shadow md5
-
    PAM: login using pam_smbpass
    
+

    PAM: Login Using pam_smbpass

    PAM allows use of replaceable modules. Those available on a sample system include:

    $/bin/ls /lib/security 

    @@ -13397,17 +13380,17 @@ pam_nologin.so   pam_rootok.so       pam_tally.so
 pam_deny.so      pam_issue.so        pam_mail.so       
 pam_permit.so    pam_securetty.so    pam_time.so       
 pam_dialup.so    pam_lastlog.so      pam_mkhomedir.so  
-pam_pwdb.so      pam_shells.so       pam_unix.so       
+pam_pwdb.so      pam_shells.so       pam_UNIX.so       
 pam_env.so       pam_ldap.so         pam_motd.so       
-pam_radius.so    pam_smbpass.so      pam_unix_acct.so  
-pam_wheel.so     pam_unix_auth.so    pam_unix_passwd.so
-pam_userdb.so    pam_warn.so         pam_unix_session.so
+pam_radius.so    pam_smbpass.so      pam_UNIX_acct.so  
+pam_wheel.so     pam_UNIX_auth.so    pam_UNIX_passwd.so
+pam_userdb.so    pam_warn.so         pam_UNIX_session.so

    The following example for the login program replaces the use of -the pam_pwdb.so module which uses the system +the pam_pwdb.so module that uses the system password database (/etc/passwd, /etc/shadow, /etc/group) with -the module pam_smbpass.so which uses the Samba +the module pam_smbpass.so, which uses the Samba database which contains the Microsoft MD4 encrypted password hashes. This database is stored in either /usr/local/samba/private/smbpasswd, @@ -13417,13 +13400,13 @@ Samba implementation for your UNIX/Linux system. The pam_smbpass.so module is provided by Samba version 2.2.1 or later. It can be compiled by specifying the --with-pam_smbpass options when running Samba's -configure script. For more information +configure script. For more information on the pam_smbpass module, see the documentation in the source/pam_smbpass directory of the Samba source distribution. 

     #%PAM-1.0
-# The PAM configuration file for the `login' service
+# The PAM configuration file for the “login” service
 #
 auth        required    pam_smbpass.so nodelay
 account     required    pam_smbpass.so nodelay
@@ -13434,21 +13417,21 @@ The following is the PAM configuration file for a particular
 Linux system. The default condition uses pam_pwdb.so.
 
     #%PAM-1.0
-# The PAM configuration file for the `samba' service
+# The PAM configuration file for the “samba” service
 #
 auth       required     pam_pwdb.so nullok nodelay shadow audit
 account    required     pam_pwdb.so audit nodelay
 session    required     pam_pwdb.so nodelay
 password   required     pam_pwdb.so shadow md5
 
    
-In the following example the decision has been made to use the 
-smbpasswd database even for basic samba authentication. Such a 
-decision could also be made for the passwd program and would 
-thus allow the smbpasswd passwords to be changed using the passwd 
-program.
+In the following example, the decision has been made to use the 
+smbpasswd database even for basic Samba authentication. Such a 
+decision could also be made for the passwd program and would 
+thus allow the smbpasswd passwords to be changed using the
+passwd program:
 
     #%PAM-1.0
-# The PAM configuration file for the `samba' service
+# The PAM configuration file for the “samba” service
 #
 auth       required     pam_smbpass.so nodelay
 account    required     pam_pwdb.so audit nodelay
@@ -13461,128 +13444,118 @@ your particular system implementation for details regarding the specific
 capabilities of PAM in this environment. Some Linux implementations also 
 provide the pam_stack.so module that allows all 
 authentication to be configured in a single central file. The 
-pam_stack.so method has some very devoted followers 
+pam_stack.so method has some devoted followers 
 on the basis that it allows for easier administration. As with all issues in 
-life though, every decision makes trade-offs, so you may want examine the 
+life though, every decision makes trade-offs, so you may want to examine the 
 PAM documentation for further helpful information.
-

    smb.conf PAM Configuration

    - There is an option in smb.conf called obey pam restrictions. -The following is from the on-line help for this option in SWAT; -

    -When Samba is configured to enable PAM support (i.e. ---with-pam), this parameter will -control whether or not Samba should obey PAM's account -and session management directives. The default behavior -is to use PAM for clear text authentication only and to -ignore any account or session management. Note that Samba always -ignores PAM for authentication in the case of -encrypt passwords = yes. -The reason is that PAM modules cannot support the challenge/response -authentication mechanism needed in the presence of SMB +

    smb.conf PAM Configuration

    + There is an option in smb.conf called obey pam restrictions. +The following is from the online help for this option in SWAT; +

    +When Samba is configured to enable PAM support (i.e., --with-pam), this parameter will +control whether or not Samba should obey PAM's account and session management directives. The default behavior +is to use PAM for cleartext authentication only and to ignore any account or session management. Samba always +ignores PAM for authentication in the case of encrypt passwords = yes. +The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. -

    Default: obey pam restrictions = no

    Remote CIFS Authentication using winbindd.so

    +

    Default: obey pam restrictions = no

    Remote CIFS Authentication Using winbindd.so

    All operating systems depend on the provision of users credentials acceptable to the platform. UNIX requires the provision of a user identifier (UID) as well as a group identifier (GID). These are both simple integer type numbers that are obtained from a password backend such as /etc/passwd.

    -Users and groups on a Windows NT server are assigned a relative id (rid) which is unique for +Users and groups on a Windows NT server are assigned a relative ID (RID) which is unique for the domain when the user or group is created. To convert the Windows NT user or group into -a unix user or group, a mapping between rids and unix user and group ids is required. This +a UNIX user or group, a mapping between RIDs and UNIX user and group IDs is required. This is one of the jobs that winbind performs.

    -As winbind users and groups are resolved from a server, user and group ids are allocated +As Winbind users and groups are resolved from a server, user and group IDs are allocated from a specified range. This is done on a first come, first served basis, although all existing users and groups will be mapped as soon as a client performs a user or group -enumeration command. The allocated unix ids are stored in a database file under the Samba +enumeration command. The allocated UNIX IDs are stored in a database file under the Samba lock directory and will be remembered.

    The astute administrator will realize from this that the combination of pam_smbpass.so, -winbindd, and a distributed passdb backend, such as ldap, will allow the establishment of a -centrally managed, distributed user/password database that can also be used by all PAM (eg: Linux) aware -programs and applications. This arrangement can have particularly potent advantages compared with the use of -Microsoft Active Directory Service (ADS) in so far as reduction of wide area network authentication traffic. +winbindd and a distributed passdb backend, +such as ldap, will allow the establishment of a centrally managed, distributed user/password +database that can also be used by all PAM-aware (e.g., Linux) programs and applications. This arrangement can have +particularly potent advantages compared with the use of Microsoft Active Directory Service (ADS) in so far as +the reduction of wide area network authentication traffic.

    Warning

    -The rid to unix id database is the only location where the user and group mappings are -stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd -to determine which user and group ids correspond to Windows NT user and group rids. -

    Password Synchronization using pam_smbpass.so

    -pam_smbpass is a PAM module which can be used on conforming systems to -keep the smbpasswd (Samba password) database in sync with the unix +The RID to UNIX ID database is the only location where the user and group mappings are +stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd +to determine which user and group IDs correspond to Windows NT user and group RIDs. +

    Password Synchronization Using pam_smbpass.so

    +pam_smbpass is a PAM module that can be used on conforming systems to +keep the smbpasswd (Samba password) database in sync with the UNIX password file. PAM (Pluggable Authentication Modules) is an API supported -under some Unices, such as Solaris, HPUX and Linux, that provides a +under some UNIX operating systems, such as Solaris, HPUX and Linux, that provides a generic interface to authentication mechanisms.

    -This module authenticates a local smbpasswd user database. If you require -support for authenticating against a remote SMB server, or if you're -concerned about the presence of suid root binaries on your system, it is -recommended that you use pam_winbind instead. +This module authenticates a local smbpasswd user database. If you require +support for authenticating against a remote SMB server, or if you are +concerned about the presence of SUID root binaries on your system, it is +recommended that you use pam_winbind instead.

    -Options recognized by this module are as follows: -

    Table 25.1. Options recognized by pam_smbpass

    debuglog more debugging info
    auditlike debug, but also logs unknown usernames
    use_first_passdon't prompt the user for passwords; take them from PAM_ items instead
    try_first_passtry to get the password from a previous PAM module, fall back to prompting the user
    use_authtoklike try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only)
    not_set_passdon't make passwords used by this module available to other modules.
    nodelaydon't insert ~1 second delays on authentication failure.
    nulloknull passwords are allowed.
    nonullnull passwords are not allowed. Used to override the Samba configuration.
    migrateonly meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication.
    smbconf=filespecify an alternate path to the smb.conf file.

    +Options recognized by this module are shown in . +

    Table 25.1. Options recognized by pam_smbpass

    debuglog more debugging info.
    auditlike debug, but also logs unknown usernames.
    use_first_passdo not prompt the user for passwords; take them from PAM_ items instead.
    try_first_passtry to get the password from a previous PAM module fall back to prompting the user.
    use_authtoklike try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set (intended for stacking password modules only).
    not_set_passdo not make passwords used by this module available to other modules.
    nodelaydo not insert ~1 second delays on authentication failure.
    nulloknull passwords are allowed.
    nonullnull passwords are not allowed. Used to override the Samba configuration.
    migrateonly meaningful in an “auth” context; used to update smbpasswd file with a password used for successful authentication.
    smbconf=filespecify an alternate path to the smb.conf file.

    -

    • Andrew Morgan, for providing the Linux-PAM - framework, without which none of this would have happened

    • Christian Gafton and Andrew Morgan again, for the - pam_pwdb module upon which pam_smbpass was originally based

    • Luke Leighton for being receptive to the idea, - and for the occasional good-natured complaint about the project's status - that keep me working on it :)

    . -

    -The following are examples of the use of pam_smbpass.so in the format of Linux +The following are examples of the use of pam_smbpass.so in the format of Linux /etc/pam.d/ files structure. Those wishing to implement this tool on other platforms will need to adapt this appropriately. -

    Password Synchronisation Configuration

    +

    Password Synchronization Configuration

    A sample PAM configuration that shows the use of pam_smbpass to make -sure private/smbpasswd is kept in sync when /etc/passwd (/etc/shadow) -is changed. Useful when an expired password might be changed by an -application (such as ssh). +sure private/smbpasswd is kept in sync when /etc/passwd (/etc/shadow) +is changed. Useful when an expired password might be changed by an +application (such as ssh). 

     #%PAM-1.0
 # password-sync
 #
 auth       requisite    pam_nologin.so
-auth       required     pam_unix.so
-account    required     pam_unix.so
+auth       required     pam_UNIX.so
+account    required     pam_UNIX.so
 password   requisite    pam_cracklib.so retry=3
-password   requisite    pam_unix.so shadow md5 use_authtok try_first_pass
+password   requisite    pam_UNIX.so shadow md5 use_authtok try_first_pass
 password   required     pam_smbpass.so nullok use_authtok try_first_pass
-session    required     pam_unix.so
-

    Password Migration Configuration

    -A sample PAM configuration that shows the use of pam_smbpass to migrate -from plaintext to encrypted passwords for Samba. Unlike other methods, +session required pam_UNIX.so +

    Password Migration Configuration

    +A sample PAM configuration that shows the use of pam_smbpass to migrate +from plaintext to encrypted passwords for Samba. Unlike other methods, this can be used for users who have never connected to Samba shares: -password migration takes place when users ftp in, login using ssh, pop -their mail, etc. +password migration takes place when users ftp in, login using ssh, pop +their mail, and so on. 

     #%PAM-1.0
 # password-migration
 #
 auth       requisite   pam_nologin.so
-# pam_smbpass is called IF pam_unix succeeds.
-auth       requisite   pam_unix.so
+# pam_smbpass is called IF pam_UNIX succeeds.
+auth       requisite   pam_UNIX.so
 auth       optional    pam_smbpass.so migrate
-account    required    pam_unix.so
+account    required    pam_UNIX.so
 password   requisite   pam_cracklib.so retry=3
-password   requisite   pam_unix.so shadow md5 use_authtok try_first_pass
+password   requisite   pam_UNIX.so shadow md5 use_authtok try_first_pass
 password   optional    pam_smbpass.so nullok use_authtok try_first_pass
-session    required    pam_unix.so
-

    Mature Password Configuration

    -A sample PAM configuration for a 'mature' smbpasswd installation. -private/smbpasswd is fully populated, and we consider it an error if -the smbpasswd doesn't exist or doesn't match the UNIX password. +session required pam_UNIX.so +

    Mature Password Configuration

    +A sample PAM configuration for a mature smbpasswd installation. +private/smbpasswd is fully populated, and we consider it an error if +the SMB password does not exist or does not match the UNIX password. 

     #%PAM-1.0
 # password-mature
 #
 auth       requisite    pam_nologin.so
-auth       required     pam_unix.so
-account    required     pam_unix.so
+auth       required     pam_UNIX.so
+account    required     pam_UNIX.so
 password   requisite    pam_cracklib.so retry=3
-password   requisite    pam_unix.so shadow md5 use_authtok try_first_pass
+password   requisite    pam_UNIX.so shadow md5 use_authtok try_first_pass
 password   required     pam_smbpass.so use_authtok use_first_pass
-session    required     pam_unix.so
-

    Kerberos Password Integration Configuration

    -A sample PAM configuration that shows pam_smbpass used together with -pam_krb5. This could be useful on a Samba PDC that is also a member of +session required pam_UNIX.so +

    Kerberos Password Integration Configuration

    +A sample PAM configuration that shows pam_smbpass used together with +pam_krb5. This could be useful on a Samba PDC that is also a member of a Kerberos realm. 

     #%PAM-1.0
@@ -13596,44 +13569,40 @@ password   requisite   pam_cracklib.so retry=3
 password   optional    pam_smbpass.so nullok use_authtok try_first_pass
 password   required    pam_krb5.so use_authtok try_first_pass
 session    required    pam_krb5.so
-

    Common Errors

    -PAM can be a very fickle and sensitive to configuration glitches. Here we look at a few cases from +

    Common Errors

    +PAM can be fickle and sensitive to configuration glitches. Here we look at a few cases from the Samba mailing list. -

    pam_winbind problem

    - “ - I have the following PAM configuration: - ” +

    pam_winbind Problem

    + A user reported: I have the following PAM configuration: 

     auth required /lib/security/pam_securetty.so
 auth sufficient /lib/security/pam_winbind.so
-auth sufficient /lib/security/pam_unix.so use_first_pass nullok
+auth sufficient /lib/security/pam_UNIX.so use_first_pass nullok
 auth required /lib/security/pam_stack.so service=system-auth
 auth required /lib/security/pam_nologin.so
 account required /lib/security/pam_stack.so service=system-auth
 account required /lib/security/pam_winbind.so
 password required /lib/security/pam_stack.so service=system-auth

    +

    + When I open a new console with [ctrl][alt][F1], I can't log in with my user “pitie”. + I have tried with user “scienceu+pitie” also.

    - “ - When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie". - I've tried with user "scienceu+pitie" also. -” -

    - The problem may lie with your inclusion of pam_stack.so + Answer: The problem may lie with your inclusion of pam_stack.so service=system-auth. That file often contains a lot of stuff that may - duplicate what you're already doing. Try commenting out the pam_stack lines - for auth and account and see if things work. If they do, look at + duplicate what you are already doing. Try commenting out the pam_stack lines + for auth and account and see if things work. If they do, look at /etc/pam.d/system-auth and copy only what you need from it into your - /etc/pam.d/login file. Alternatively, if you want all services to use - winbind, you can put the winbind-specific stuff in /etc/pam.d/system-auth. -

    Winbind is not resolving users and groups

    - “ - My smb.conf file is correctly configured. I have specified - idmap uid = 12000, - and idmap gid = 3000-3500 + /etc/pam.d/login file. Alternately, if you want all services to use + Winbind, you can put the Winbind-specific stuff in /etc/pam.d/system-auth. +

    Winbind Is Not Resolving Users and Groups

    + “ + My smb.conf file is correctly configured. I have specified + idmap uid = 12000, + and idmap gid = 3000-3500 and winbind is running. When I do the following it all works fine. -” + ” 

     root# wbinfo -u
 MIDEARTH+maryo
@@ -13656,136 +13625,139 @@ bin:x:1:1:bin:/bin:/bin/bash
 maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false

    “ - But the following command just fails: -” + But this command fails: + ” 

    -root# chown 'maryo' a_file
-chown: `maryo': invalid user
+root# chown maryo a_file
+chown: 'maryo': invalid user

    -“ -This is driving me nuts! What can be wrong? -” + “This is driving me nuts! What can be wrong?”

    - Your system is likely running nscd, the name service - caching daemon. Shut it down, do NOT restart it! You will find your problem resolved. -

    Chapter 26. Integrating MS Windows networks with Samba

    John H. Terpstra

    Samba Team

    (Jan 01 2001)

    Table of Contents

    Features and Benefits
    Background Information
    Name Resolution in a pure UNIX/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging works only in one way
    Very Slow Network Connections
    Samba server name change problem

    + Answer: Your system is likely running nscd, the name service + caching daemon. Shut it down, do not restart it! You will find your problem resolved. +

    Chapter 26. Integrating MS Windows Networks with Samba

    John H. Terpstra

    Samba Team

    (Jan 01 2001)

    Table of Contents

    Features and Benefits
    Background Information
    Name Resolution in a Pure UNIX/Linux World
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name Resolution as Used within MS Windows Networking
    The NetBIOS Name Cache
    The LMHOSTS File
    HOSTS File
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging Works Only in One Way
    Very Slow Network Connections
    Samba Server Name Change Problem

    + This section deals with NetBIOS over TCP/IP name to IP address resolution. If -your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this -section does not apply to your installation. If your installation involves use of +your MS Windows clients are not configured to use NetBIOS over TCP/IP, then this +section does not apply to your installation. If your installation +involves the use of NetBIOS over TCP/IP then this section may help you to resolve networking problems.

    Note

    - NetBIOS over TCP/IP has nothing to do with NetBEUI. NetBEUI is NetBIOS - over Logical Link Control (LLC). On modern networks it is highly advised - to NOT run NetBEUI at all. Note also that there is NO such thing as - NetBEUI over TCP/IP - the existence of such a protocol is a complete - and utter mis-apprehension. -

    Features and Benefits

    +NetBIOS over TCP/IP has nothing to do with NetBEUI. NetBEUI is NetBIOS +over Logical Link Control (LLC). On modern networks it is highly advised +to not run NetBEUI at all. Note also there is no such thing as +NetBEUI over TCP/IP the existence of such a protocol is a complete +and utter misapprehension. +

    Features and Benefits

    Many MS Windows network administrators have never been exposed to basic TCP/IP networking as it is implemented in a UNIX/Linux operating system. Likewise, many UNIX and -Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP based +Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP-based networking (and may have no desire to be either).

    This chapter gives a short introduction to the basics of how a name can be resolved to -it's IP address for each operating system environment. -

    Background Information

    -Since the introduction of MS Windows 2000 it is possible to run MS Windows networking +its IP address for each operating system environment. +

    Background Information

    +Since the introduction of MS Windows 2000, it is possible to run MS Windows networking without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over -TCP/IP is disabled on MS Windows 2000 and later clients then only TCP port 445 will be -used and UDP port 137 and TCP port 139 will not. +TCP/IP is disabled on MS Windows 2000 and later clients, then only the TCP port 445 will be +used and the UDP port 137 and TCP port 139 will not.

    Note

    -When using Windows 2000 or later clients, if NetBIOS over TCP/IP is NOT disabled, then +When using Windows 2000 or later clients, if NetBIOS over TCP/IP is not disabled, then the client will use UDP port 137 (NetBIOS Name Service, also known as the Windows Internet -Name Service or WINS), TCP port 139 AND TCP port 445 (for actual file and print traffic). +Name Service or WINS), TCP port 139 and TCP port 445 (for actual file and print traffic).

    -When NetBIOS over TCP/IP is disabled the use of DNS is essential. Most installations that +When NetBIOS over TCP/IP is disabled, the use of DNS is essential. Most installations that disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS requires - + Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR). - + Use of DHCP with ADS is recommended as a further means of maintaining central control -over client workstation network configuration. -

    Name Resolution in a pure UNIX/Linux world

    +over the client workstation network configuration. +

    Name Resolution in a Pure UNIX/Linux World

    The key configuration files covered in this section are: -

    • /etc/hosts

    • /etc/resolv.conf

    • /etc/host.conf

    • /etc/nsswitch.conf

    /etc/hosts

    -Contains a static list of IP addresses and names. -eg: +

    • /etc/hosts

    • /etc/resolv.conf

    • /etc/host.conf

    • /etc/nsswitch.conf

    /etc/hosts

    +This file contains a static list of IP addresses and names. 

     127.0.0.1	localhost localhost.localdomain
-192.168.1.1	bigbox.caldera.com	bigbox	alias4box
+192.168.1.1	bigbox.quenya.org	bigbox	alias4box

    The purpose of /etc/hosts is to provide a -name resolution mechanism so that uses do not need to remember +name resolution mechanism so uses do not need to remember IP addresses.

    Network packets that are sent over the physical network transport layer communicate not via IP addresses but rather using the Media Access Control address, or MAC address. IP addresses are currently 32 bits in length and are typically presented as four (4) decimal -numbers that are separated by a dot (or period). eg: 168.192.1.1. -

    +numbers that are separated by a dot (or period). For example, 168.192.1.1. +

    + MAC Addresses use 48 bits (or 6 bytes) and are typically represented -as two digit hexadecimal numbers separated by colons. eg: -40:8e:0a:12:34:56 -

    -Every network interface must have an MAC address. Associated with -a MAC address there may be one or more IP addresses. There is NO -relationship between an IP address and a MAC address, all such assignments -are arbitrary or discretionary in nature. At the most basic level all -network communications takes place using MAC addressing. Since MAC -addresses must be globally unique, and generally remains fixed for +as two-digit hexadecimal numbers separated by colons: 40:8e:0a:12:34:56. +

    +Every network interface must have a MAC address. Associated with +a MAC address may be one or more IP addresses. There is no +relationship between an IP address and a MAC address; all such assignments +are arbitrary or discretionary in nature. At the most basic level, all +network communications take place using MAC addressing. Since MAC +addresses must be globally unique and generally remain fixed for any particular interface, the assignment of an IP address makes sense from a network management perspective. More than one IP address can -be assigned per MAC address. One address must be the primary IP address, +be assigned per MAC address. One address must be the primary IP +address this is the address that will be returned in the ARP reply.

    -When a user or a process wants to communicate with another machine -the protocol implementation ensures that the "machine name" or "host -name" is resolved to an IP address in a manner that is controlled +When a user or a process wants to communicate with another machine, +the protocol implementation ensures that the “machine name” or “host +name” is resolved to an IP address in a manner that is controlled by the TCP/IP configuration control files. The file /etc/hosts is one such file.

    When the IP address of the destination interface has been -determined a protocol called ARP/RARP is used to identify +determined, a protocol called ARP/RARP is used to identify the MAC address of the target interface. ARP stands for Address -Resolution Protocol, and is a broadcast oriented method that -uses UDP (User Datagram Protocol) to send a request to all -interfaces on the local network segment using the all 1's MAC +Resolution Protocol and is a broadcast-oriented method that +uses User Datagram Protocol (UDP) to send a request to all +interfaces on the local network segment using the all 1s MAC address. Network interfaces are programmed to respond to two MAC addresses only; their own unique address and the address ff:ff:ff:ff:ff:ff. The reply packet from an ARP request will contain the MAC address and the primary IP address for each interface. -

    +

    + The /etc/hosts file is foundational to all UNIX/Linux TCP/IP installations and as a minimum will contain the localhost and local network interface IP addresses and the primary names by which they are known within the local machine. -This file helps to prime the pump so that a basic level of name +This file helps to prime the pump so a basic level of name resolution can exist before any other method of name resolution becomes available. -

    /etc/resolv.conf

    +

    /etc/resolv.conf

    This file tells the name resolution libraries:

    • The name of the domain to which the machine - belongs + belongs.

    • The name(s) of any domains that should be automatically searched when trying to resolve unqualified - host names to their IP address + host names to their IP address.

    • The name or IP address of available Domain - Name Servers that may be asked to perform name to address - translation lookups -

    /etc/host.conf

    + Name Servers that may be asked to perform name-to-address + translation lookups. +

    /etc/host.conf

    + /etc/host.conf is the primary means by -which the setting in /etc/resolv.conf may be affected. It is a -critical configuration file. This file controls the order by +which the setting in /etc/resolv.conf may be effected. It is a +critical configuration file. This file controls the order by which name resolution may proceed. The typical structure is: 

     order hosts,bind
 multi on

    then both addresses should be returned. Please refer to the -man page for host.conf for further details. -

    /etc/nsswitch.conf

    +man page for host.conf for further details. +

    /etc/nsswitch.conf

    + This file controls the actual name resolution targets. The file typically has resolver object specifications as follows: 

    @@ -13814,45 +13786,47 @@ Of course, each of these mechanisms requires that the appropriate
 facilities and/or services are correctly configured.
 
    
 It should be noted that unless a network request/message must be 
-sent, TCP/IP networks are silent. All TCP/IP communications assumes a 
+sent, TCP/IP networks are silent. All TCP/IP communications assume a 
 principal of speaking only when necessary.
-
    
-Starting with version 2.2.0 samba has Linux support for extensions to 
-the name service switch infrastructure so that linux clients will 
+
    
+
+Starting with version 2.2.0, Samba has Linux support for extensions to 
+the name service switch infrastructure so Linux clients will 
 be able to obtain resolution of MS Windows NetBIOS names to IP 
-Addresses. To gain this functionality Samba needs to be compiled 
-with appropriate arguments to the make command (i.e.: make 
+Addresses. To gain this functionality, Samba needs to be compiled 
+with appropriate arguments to the make command (i.e., make 
 nsswitch/libnss_wins.so). The resulting library should 
 then be installed in the /lib directory and 
-the "wins" parameter needs to be added to the "hosts:" line in 
-the /etc/nsswitch.conf file. At this point it 
+the wins parameter needs to be added to the “hosts:” line in 
+the /etc/nsswitch.conf file. At this point, it 
 will be possible to ping any MS Windows machine by its NetBIOS 
-machine name, so long as that machine is within the workgroup to 
-which both the samba machine and the MS Windows machine belong.
-

    Name resolution as used within MS Windows networking

    +machine name, as long as that machine is within the workgroup to +which both the Samba machine and the MS Windows machine belong. +

    Name Resolution as Used within MS Windows Networking

    MS Windows networking is predicated about the name each machine is given. This name is known variously (and inconsistently) as -the "computer name", "machine name", "networking name", "netbios name", -or "SMB name". All terms mean the same thing with the exception of -"netbios name" which can apply also to the name of the workgroup or the -domain name. The terms "workgroup" and "domain" are really just a +the “computer name,” “machine name,” “networking name,” “netbios name,” +or “SMB name.” All terms mean the same thing with the exception of +“netbios name” that can also apply to the name of the workgroup or the +domain name. The terms “workgroup” and “domain” are really just a simple name with which the machine is associated. All NetBIOS names -are exactly 16 characters in length. The 16th character is reserved. -It is used to store a one byte value that indicates service level +are exactly 16 characters in length. The 16th character is reserved. +It is used to store a one-byte value that indicates service level information for the NetBIOS name that is registered. A NetBIOS machine -name is therefore registered for each service type that is provided by +name is, therefore, registered for each service type that is provided by the client/server.

    -The following are typical NetBIOS name/service type registrations: -

    Table 26.1. Unique NetBIOS names

    MACHINENAME<00>Server Service is running on MACHINENAME
    MACHINENAME<03>Generic Machine Name (NetBIOS name)
    MACHINENAME<20>LanMan Server service is running on MACHINENAME
    WORKGROUP<1b>Domain Master Browser

    Table 26.2. Group Names

    WORKGROUP<03>Generic Name registered by all members of WORKGROUP
    WORKGROUP<1c>Domain Controllers / Netlogon Servers
    WORKGROUP<1d>Local Master Browsers
    WORKGROUP<1e>Internet Name Resolvers

    - + and list typical NetBIOS name/service type registrations. +

    Table 26.1. Unique NetBIOS Names

    MACHINENAME<00>Server Service is running on MACHINENAME
    MACHINENAME<03>Generic Machine Name (NetBIOS name)
    MACHINENAME<20>LanMan Server service is running on MACHINENAME
    WORKGROUP<1b>Domain Master Browser

    Table 26.2. Group Names

    WORKGROUP<03>Generic Name registered by all members of WORKGROUP
    WORKGROUP<1c>Domain Controllers / Netlogon Servers
    WORKGROUP<1d>Local Master Browsers
    WORKGROUP<1e>Internet Name Resolvers

    + It should be noted that all NetBIOS machines register their own names as per the above. This is in vast contrast to TCP/IP installations where traditionally the system administrator will -determine in the /etc/hosts or in the DNS database what names +determine in the /etc/hosts or in the DNS database what names are associated with each IP address. -

    -One further point of clarification should be noted, the /etc/hosts +

    + +One further point of clarification should be noted. The /etc/hosts file and the DNS records do not provide the NetBIOS name type information that MS Windows clients depend on to locate the type of service that may be needed. An example of this is what happens when an MS Windows client @@ -13861,38 +13835,38 @@ address of a server that provides it by performing a lookup (via a NetBIOS broadcast) for enumeration of all machines that have registered the name type *<1c>. A logon request is then sent to each IP address that is returned in the enumerated list of IP addresses. -Whichever machine first replies then ends up providing the logon services. +Whichever machine first replies, it then ends up providing the logon services.

    -The name "workgroup" or "domain" really can be confusing since these +The name “workgroup” or “domain” really can be confusing since these have the added significance of indicating what is the security -architecture of the MS Windows network. The term "workgroup" indicates +architecture of the MS Windows network. The term “workgroup” indicates that the primary nature of the network environment is that of a -peer-to-peer design. In a WORKGROUP all machines are responsible for -their own security, and generally such security is limited to use of -just a password (known as SHARE MODE security). In most situations -with peer-to-peer networking the users who control their own machines +peer-to-peer design. In a WORKGROUP, all machines are responsible for +their own security, and generally such security is limited to the use of +just a password (known as Share Level security). In most situations +with peer-to-peer networking, the users who control their own machines will simply opt to have no security at all. It is possible to have -USER MODE security in a WORKGROUP environment, thus requiring use +User Level Security in a WORKGROUP environment, thus requiring the use of a user name and a matching password.

    MS Windows networking is thus predetermined to use machine names for all local and remote machine message passing. The protocol used is called Server Message Block (SMB) and this is implemented using the NetBIOS protocol (Network Basic Input Output System). NetBIOS can -be encapsulated using LLC (Logical Link Control) protocol - in which case +be encapsulated using LLC (Logical Link Control) protocol in which case the resulting protocol is called NetBEUI (Network Basic Extended User Interface). NetBIOS can also be run over IPX (Internetworking Packet Exchange) protocol as used by Novell NetWare, and it can be run -over TCP/IP protocols - in which case the resulting protocol is called +over TCP/IP protocols in which case the resulting protocol is called NBT or NetBT, the NetBIOS over TCP/IP.

    MS Windows machines use a complex array of name resolution mechanisms. -Since we are primarily concerned with TCP/IP this demonstration is +Since we are primarily concerned with TCP/IP, this demonstration is limited to this area. -

    The NetBIOS Name Cache

    -All MS Windows machines employ an in memory buffer in which is +

    The NetBIOS Name Cache

    +All MS Windows machines employ an in-memory buffer in which is stored the NetBIOS names and IP addresses for all external -machines that that machine has communicated with over the +machines that machine has communicated with over the past 10-15 minutes. It is more efficient to obtain an IP address for a machine from the local cache than it is to go through all the configured name resolution mechanisms. @@ -13900,21 +13874,23 @@ configured name resolution mechanisms. If a machine whose name is in the local name cache has been shut down before the name had been expired and flushed from the cache, then an attempt to exchange a message with that machine will be subject -to time-out delays. i.e.: Its name is in the cache, so a name resolution -lookup will succeed, but the machine can not respond. This can be -frustrating for users - but it is a characteristic of the protocol. -

    +to time-out delays. Its name is in the cache, so a name resolution +lookup will succeed, but the machine cannot respond. This can be +frustrating for users but is a characteristic of the protocol. +

    + + The MS Windows utility that allows examination of the NetBIOS -name cache is called "nbtstat". The Samba equivalent of this +name cache is called “nbtstat”. The Samba equivalent of this is called nmblookup. -

    The LMHOSTS file

    -This file is usually located in MS Windows NT 4.0 or -2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains -the IP Address and the machine name in matched pairs. The -LMHOSTS file performs NetBIOS name -to IP address mapping. -

    -It typically looks like: +

    The LMHOSTS File

    + +This file is usually located in MS Windows NT 4.0 or Windows 200x/XP in the directory +C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address +and the machine name in matched pairs. The LMHOSTS file +performs NetBIOS name to IP address mapping. +

    +It typically looks like this: 

     # Copyright (c) 1998 Microsoft Corp.
 #
@@ -13922,7 +13898,7 @@ It typically looks like:
 # over TCP/IP) stack for Windows98
 #
 # This file contains the mappings of IP addresses to NT computernames
-# (NetBIOS) names.  Each entry should be kept on an individual line.
+# (NetBIOS) names. Each entry should be kept on an individual line.
 # The IP address should be placed in the first column followed by the
 # corresponding computername. The address and the computername
 # should be separated by at least one space or tab. The "#" character
@@ -13944,7 +13920,7 @@ It typically looks like:
 # not preloaded, but are parsed only after dynamic name resolution fails.
 #
 # Following an entry with the "#DOM:<domain>" tag will associate the
-# entry with the domain specified by <domain>. This affects how the
+# entry with the domain specified by <domain>. This effects how the
 # browser and logon services behave in TCP/IP environments. To preload
 # the host name associated with #DOM entry, it is necessary to also add a
 # #PRE to the line. The <domain> is always preloaded although it will not
@@ -13973,10 +13949,10 @@ It typically looks like:
 #
 # The following example illustrates all of these extensions:
 #
-# 102.54.94.97     rhino         #PRE #DOM:networking  #net group's DC
-# 102.54.94.102    "appname  \0x14"                    #special app server
-# 102.54.94.123    popular            #PRE             #source server
-# 102.54.94.117    localsrv           #PRE             #needed for the include
+# 102.54.94.97     rhino     #PRE #DOM:networking  #net group's DC
+# 102.54.94.102    "appname  \0x14"       #special app server
+# 102.54.94.123    popular   #PRE         #source server
+# 102.54.94.117    localsrv  #PRE         #needed for the include
 #
 # #BEGIN_ALTERNATE
 # #INCLUDE \\localsrv\public\lmhosts
@@ -13993,17 +13969,18 @@ It typically looks like:
 # so keeping the number of comments to a minimum will improve performance.
 # Therefore it is not advisable to simply add lmhosts file entries onto the
 # end of this file.
-

    HOSTS file

    -This file is usually located in MS Windows NT 4.0 or 2000 in -C:\WINNT\SYSTEM32\DRIVERS\ETC and contains +

    HOSTS File

    +This file is usually located in MS Windows NT 4.0 or Windows 200x/XP in +the directory C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address and the IP hostname in matched pairs. It can be used by the name resolution infrastructure in MS Windows, depending on how the TCP/IP environment is configured. This file is in every way the equivalent of the UNIX/Linux /etc/hosts file. -

    DNS Lookup

    +

    DNS Lookup

    + This capability is configured in the TCP/IP setup area in the network configuration facility. If enabled, an elaborate name resolution sequence -is followed the precise nature of which is dependant on how the NetBIOS +is followed, the precise nature of which is dependant on how the NetBIOS Node Type parameter is configured. A Node Type of 0 means that NetBIOS broadcast (over UDP broadcast) is used if the name that is the subject of a name lookup is not found in the NetBIOS name @@ -14011,46 +13988,48 @@ cache. If that fails then DNS, HOSTS and LMHOSTS are checked. If set to Node Type 8, then a NetBIOS Unicast (over UDP Unicast) is sent to the WINS Server to obtain a lookup before DNS, HOSTS, LMHOSTS, or broadcast lookup is used. -

    WINS Lookup

    +

    WINS Lookup

    + A WINS (Windows Internet Name Server) service is the equivalent of the rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores the names and IP addresses that are registered by a Windows client if the TCP/IP setup has been given at least one WINS Server IP Address.

    -To configure Samba to be a WINS server the following parameter needs +To configure Samba to be a WINS server, the following parameter needs to be added to the smb.conf file:

    wins support = Yes

    -To configure Samba to use a WINS server the following parameters are +To configure Samba to use a WINS server, the following parameters are needed in the smb.conf file:

    wins support = No
    wins server = xxx.xxx.xxx.xxx

    where xxx.xxx.xxx.xxx is the IP address of the WINS server.

    For information about setting up Samba as a WINS server, read - the chapter on network browsing.

    Common Errors

    +.

    Common Errors

    TCP/IP network configuration problems find every network administrator sooner or later. The cause can be anything from keyboard mishaps, forgetfulness, simple mistakes, and -carelessness. Of course, no one is every deliberately careless! -

    Pinging works only in one way

    - “I can ping my samba server from Windows, but I can - not ping my Windows machine from the samba server.” +carelessness. Of course, no one is ever deliberately careless! +

    Pinging Works Only in One Way

    + “I can ping my Samba server from Windows, but I cannot ping my Windows + machine from the Samba server.”

    - The Windows machine was at IP Address 192.168.1.2 with netmask 255.255.255.0, the + Answer: The Windows machine was at IP Address 192.168.1.2 with netmask 255.255.255.0, the Samba server (Linux) was at IP Address 192.168.1.130 with netmask 255.255.255.128. The machines were on a local network with no external connections.

    Due to inconsistent netmasks, the Windows machine was on network 192.168.1.0/24, while - the Samba server was on network 192.168.1.128/25 - logically a different network. -

    Very Slow Network Connections

    - A common causes of slow network response includes: -

    • Client is configured to use DNS and DNS server is down

    • Client is configured to use remote DNS server, but remote connection is down

    • Client is configured to use a WINS server, but there is no WINS server

    • Client is NOT configured to use a WINS server, but there is a WINS server

    • Firewall is filtering our DNS or WINS traffic

    Samba server name change problem

    - “The name of the samba server was changed, samba was restarted, samba server can not be + the Samba server was on network 192.168.1.128/25 logically a different network. +

    Very Slow Network Connections

    + A common cause of slow network response includes: +

    • Client is configured to use DNS and the DNS server is down.

    • Client is configured to use remote DNS server, but the + remote connection is down.

    • Client is configured to use a WINS server, but there is no WINS server.

    • Client is not configured to use a WINS server, but there is a WINS server.

    • Firewall is filtering our DNS or WINS traffic.

    Samba Server Name Change Problem

    + “The name of the Samba server was changed, Samba was restarted, Samba server cannot be pinged by new name from MS Windows NT4 Workstation, but it does still respond to ping using the old name. Why?”

    - From this description three (3) things are rather obvious: -

    • WINS is NOT in use, only broadcast based name resolution is used

    • The samba server was renamed and restarted within the last 10-15 minutes

    • The old samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation

    + From this description, three things are obvious: +

    • WINS is not in use, only broadcast-based name resolution is used.

    • The Samba server was renamed and restarted within the last 10-15 minutes.

    • The old Samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation.

    To find what names are present in the NetBIOS name cache on the MS Windows NT4 machine, - open a cmd shell, then: + open a cmd shell and then: 

     C:\> nbtstat -n
@@ -14079,10 +14058,10 @@ GANDALF	<20>  UNIQUE      192.168.1.1          240

    In the above example, GANDALF is the Samba server and FRODO is the MS Windows NT4 Workstation. - The first listing shows the contents of the Local Name Table (i.e.: Identity information on - the MS Windows workstation), the second shows the NetBIOS name in the NetBIOS name cache. + The first listing shows the contents of the Local Name Table (i.e., Identity information on + the MS Windows workstation) and the second shows the NetBIOS name in the NetBIOS name cache. The name cache contains the remote machines known to this workstation. -

    Chapter 27. Unicode/Charsets

    Jelmer R. Vernooij

    The Samba Team

    TAKAHASHI Motonobu

    25 March 2003

    Table of Contents

    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    Common errors
    CP850.so can't be found

    Features and Benefits

    +

    Chapter 27. Unicode/Charsets

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    TAKAHASHI Motonobu

    25 March 2003

    Table of Contents

    Features and Benefits
    What Are Charsets and Unicode?
    Samba and Charsets
    Conversion from Old Names
    Japanese Charsets
    Common Errors
    CP850.so Can't Be Found

    Features and Benefits

    Every industry eventually matures. One of the great areas of maturation is in the focus that has been given over the past decade to make it possible for anyone anywhere to use a computer. It has not always been that way, in fact, not so long @@ -14090,325 +14069,352 @@ ago it was common for software to be written for exclusive use in the country of origin.

    Of all the effort that has been brought to bear on providing native language support -for all computer users, the efforts of the Openi18n organisation is deserving of +for all computer users, the efforts of the Openi18n organization is deserving of special mention.

    Samba-2.x supported a single locale through a mechanism called codepages. Samba-3 is destined to become a truly trans-global -file and printer sharing platform. -

    What are charsets and unicode?

    +file and printer-sharing platform. +

    What Are Charsets and Unicode?

    Computers communicate in numbers. In texts, each number will be translated to a corresponding letter. The meaning that will be assigned -to a certain number depends on the character set(charset) +to a certain number depends on the character set (charset) that is used. +

    A charset can be seen as a table that is used to translate numbers to letters. Not all computers use the same charset (there are charsets -with German umlauts, Japanese characters, etc). Usually a charset contains +with German umlauts, Japanese characters, and so on). Usually a charset contains 256 characters, which means that storing a character with it takes exactly one byte.

    There are also charsets that support even more characters, -but those need twice(or even more) as much storage space. These +but those need twice as much storage space (or more). These charsets can contain 256 * 256 = 65536 characters, which -is more then all possible characters one could think of. They are called -multibyte charsets (because they use more then one byte to -store one character). +is more than all possible characters one could think of. They are called +multibyte charsets because they use more then one byte to +store one character.

    - A standardised multibyte charset is unicode. +A standardized multibyte charset is unicode. A big advantage of using a multibyte charset is that you only need one; there is no need to make sure two computers use the same charset when they are communicating. -

    Old windows clients use single-byte charsets, named -'codepages' by Microsoft. However, there is no support for -negotiating the charset to be used in the smb protocol. Thus, you +

    Old Windows clients use single-byte charsets, named +codepages, by Microsoft. However, there is no support for +negotiating the charset to be used in the SMB/CIFS protocol. Thus, you have to make sure you are using the same charset when talking to an older client. -Newer clients (Windows NT, 2K, XP) talk unicode over the wire. -

    Samba and charsets

    -As of samba 3.0, samba can (and will) talk unicode over the wire. Internally, -samba knows of three kinds of character sets: -

    unix charset

    +Newer clients (Windows NT, 200x, XP) talk unicode over the wire. +

    Samba and Charsets

    +As of Samba-3.0, Samba can (and will) talk unicode over the wire. Internally, +Samba knows of three kinds of character sets: +

    unix charset

    This is the charset used internally by your operating system. The default is UTF-8, which is fine for most - systems. The default in previous samba releases was ASCII. -

    display charset

    This is the charset samba will use to print messages - on your screen. It should generally be the same as the unix charset. -

    dos charset

    This is the charset samba uses when communicating with - DOS and Windows 9x clients. It will talk unicode to all newer clients. + systems, which covers all characters in all languages. The default in previous Samba releases was ASCII. +

    display charset

    This is the charset Samba will use to print messages + on your screen. It should generally be the same as the unix charset. +

    dos charset

    This is the charset Samba uses when communicating with + DOS and Windows 9x/Me clients. It will talk unicode to all newer clients. The default depends on the charsets you have installed on your system. Run testparm -v | grep "dos charset" to see what the default is on your system. -

    Conversion from old names

    Because previous samba versions did not do any charset conversion, -characters in filenames are usually not correct in the unix charset but only -for the local charset used by the DOS/Windows clients.

    Bjoern Jacke has written a utility named convm that can convert whole directory - structures to different charsets with one single command. -

    Japanese charsets

    Samba doesn't work correctly with Japanese charsets yet. Here are -points of attention when setting it up:

    • You should set mangling method = hash

    • There are various iconv() implementations around and not -all of them work equally well. glibc2's iconv() has a critical problem -in CP932. libiconv-1.8 works with CP932 but still has some problems and -does not work with EUC-JP.

    • You should set dos charset = CP932, not -Shift_JIS, SJIS...

    • Currently only unix charset = CP932 -will work (but still has some problems...) because of iconv() issues. -unix charset = EUC-JP doesn't work well because of -iconv() issues.

    • Currently Samba 3.0 does not support unix charset = UTF8-MAC/CAP/HEX/JIS*

    More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

    Common errors

    CP850.so can't be found

    “Samba is complaining about a missing CP850.so file”.

    CP850 is the default dos charset. The dos charset is used to convert data to the codepage used by your dos clients. If you don't have any dos clients, you can safely ignore this message.

    CP850 should be supported by your local iconv implementation. Make sure you have all the required packages installed. If you compiled samba from source, make sure configure found iconv.

    Chapter 28. Samba Backup Techniques

    John H. Terpstra

    Samba Team

    Table of Contents

    Note
    Features and Benefits

    Note

    +

    Conversion from Old Names

    Because previous Samba versions did not do any charset conversion, +characters in filenames are usually not correct in the UNIX charset but only +for the local charset used by the DOS/Windows clients.

    Japanese Charsets

    Samba does not work correctly with Japanese charsets yet. Here are +points of attention when setting it up:

    • You should set mangling method = hash

    • There are various iconv() implementations around and not + all of them work equally well. glibc2's iconv() has a critical problem + in CP932. libiconv-1.8 works with CP932 but still has some problems and + does not work with EUC-JP.

    • You should set dos charset = CP932, not + Shift_JIS, SJIS.

    • Currently only UNIX charset = CP932 + will work (but still has some problems...) because of iconv() issues. + UNIX charset = EUC-JP does not work well because of + iconv() issues.

    • Currently Samba-3.0 does not support UNIX charset = UTF8-MAC/CAP/HEX/JIS*.

    More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

    Common Errors

    CP850.so Can't Be Found

    “Samba is complaining about a missing CP850.so file.”

    Answer: CP850 is the default dos charset. + The dos charset is used to convert data to the codepage used by your dos clients. + If you do not have any dos clients, you can safely ignore this message.

    CP850 should be supported by your local iconv implementation. Make sure you have all the required packages installed. + If you compiled Samba from source, make sure to configure found iconv.

    Chapter 28. Samba Backup Techniques

    John H. Terpstra

    Samba Team

    Table of Contents

    Note
    Features and Benefits

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Features and Benefits

    +

    Features and Benefits

    We need feedback from people who are backing up samba servers. We would like to know what software tools you are using to backup your samba server/s.

    In particular, if you have any success and / or failure stories you could share with other users this would be appreciated. -

    Chapter 29. High Availability Options

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +

    Chapter 29. High Availability Options

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Migration and Updating

    Table of Contents

    30. Upgrading from Samba-2.x to Samba-3.0.0
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (changes in behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    Charsets
    LDAP
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    June 30, 2003

    Table of Contents

    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (changes in behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    Charsets
    LDAP

    New Features in Samba-3

    -Major new features: +

    Migration and Updating

    Table of Contents

    30. Upgrading from Samba-2.x to Samba-3.0.0
    Quick Migration Guide
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (Changes in Behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    LDAP
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps in Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices
    32. SWAT The Samba Web Administration Tool
    Features and Benefits
    Guidelines and Technical Tips
    Validate SWAT Installation
    Enabling SWAT for Use
    Securing SWAT through SSL
    Enabling SWAT Internationalization Support
    Overview and Quick Tour
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    June 30, 2003

    Table of Contents

    Quick Migration Guide
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (Changes in Behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    LDAP

    +This chapter deals exclusively with the differences between Samba-3.0.0 and Samba-2.2.8a. +It points out where configuration parameters have changed, and provides a simple guide for +the move from 2.2.x to 3.0.0. +

    Quick Migration Guide

    +Samba-3.0.0 default behavior should be approximately the same as Samba-2.2.x. +The default behavior when the new parameter passdb backend +is not defined in the smb.conf file provides the same default behviour as Samba-2.2.x +with encrypt passwords = Yes, and +will use the smbpasswd database. +

    +So why say that behavior should be approximately the same as Samba-2.2.x? Because +Samba-3.0.0 can negotiate new protocols, such as support for native Unicode, that may result in +differing protocol code paths being taken. The new behavior under such circumstances is not +exactly the same as the old one. The good news is that the domain and machine SIDs will be +preserved across the upgrade. +

    +If the Samba-2.2.x system was using an LDAP backend, and there is no time to update the LDAP +database, then make sure that passdb backend = ldapsam_compat +is specified in the smb.conf file. For the rest, behavior should remain more or less the same. +At a later date, when there is time to implement a new Samba-3 compatible LDAP backend, it is possible +to migrate the old LDAP database to the new one through use of the pdbedit. +See . +

    New Features in Samba-3

    +The major new features are:

    1. - Active Directory support. This release is able to join a ADS realm + Active Directory support. This release is able to join an ADS realm as a member server and authenticate users using LDAP/kerberos.

    2. - Unicode support. Samba will now negotiate UNICODE on the wire and - internally there is now a much better infrastructure for multi-byte - and UNICODE character sets. + Unicode support. Samba will now negotiate unicode on the wire and + internally there is a much better infrastructure for multi-byte + and unicode character sets.

    3. New authentication system. The internal authentication system has been almost completely rewritten. Most of the changes are internal, - but the new auth system is also very configurable. + but the new authoring system is also very configurable.

    4. New filename mangling system. The filename mangling system has been completely rewritten. An internal database now stores mangling maps - persistently. This needs lots of testing. + persistently.

    5. - New "net" command. A new "net" command has been added. It is - somewhat similar to the "net" command in windows. Eventually we + New “net” command. A new “net” command has been added. It is + somewhat similar to the “net” command in Windows. Eventually, we plan to replace a bunch of other utilities (such as smbpasswd) - with subcommands in "net", at the moment only a few things are - implemented. + with subcommands in “net”.

    6. Samba now negotiates NT-style status32 codes on the wire. This - improves error handling a lot. + considerably improves error handling.

    7. - Better Windows 2000/XP/2003 printing support including publishing - printer attributes in active directory + Better Windows 200x/XP printing support including publishing + printer attributes in Active Directory.

    8. - New loadable RPC modules + New loadable RPC modules for passdb backends and character sets.

    9. - New dual-daemon winbindd support (-B) for better performance + New default dual-daemon winbindd support for better performance.

    10. Support for migrating from a Windows NT 4.0 domain to a Samba - domain and maintaining user, group and domain SIDs + domain and maintaining user, group and domain SIDs.

    11. Support for establishing trust relationships with Windows NT 4.0 - domain controllers + Domain Controllers.

    12. Initial support for a distributed Winbind architecture using - an LDAP directory for storing SID to uid/gid mappings + an LDAP directory for storing SID to UID/GID mappings.

    13. Major updates to the Samba documentation tree. +

    14. + Full support for client and server SMB signing to ensure + compatibility with default Windows 2003 security settings.

    Plus lots of other improvements! -

    Configuration Parameter Changes

    -This section contains a brief listing of changes to smb.conf options -in the 3.0.0 release. Please refer to the smb.conf(5) man page for +

    Configuration Parameter Changes

    +This section contains a brief listing of changes to smb.conf options +in the 3.0.0 release. Please refer to the smb.conf(5) man page for complete descriptions of new or modified parameters. -

    Removed Parameters

    (order alphabetically):

    • admin log

    • alternate permissions

    • character set

    • client codepage

    • code page directory

    • coding system

    • domain admin group

    • domain guest group

    • force unknown acl user

    • nt smb support

    • post script

    • printer driver

    • printer driver file

    • printer driver location

    • status

    • total print jobs

    • use rhosts

    • valid chars

    • vfs options

    New Parameters

    (new parameters have been grouped by function):

    Remote management

    • abort shutdown script

    • shutdown script

    User and Group Account Management

    • add group script

    • add machine script

    • add user to group script

    • algorithmic rid base

    • delete group script

    • delete user from group script

    • passdb backend

    • set primary group script

    Authentication

    • auth methods

    • ads server

    • realm

    Protocol Options

    • client lanman auth

    • client NTLMv2 auth

    • client schannel

    • client signing

    • client use spnego

    • disable netbios

    • ntlm auth

    • paranoid server security

    • server schannel

    • smb ports

    • use spnego

    File Service

    • get quota command

    • hide special files

    • hide unwriteable files

    • hostname lookups

    • kernel change notify

    • mangle prefix

    • msdfs proxy

    • set quota command

    • use sendfile

    • vfs objects

    Printing

    • max reported print jobs

    UNICODE and Character Sets

    • display charset

    • dos charset

    • unicode

    • unix charset

    SID to uid/gid Mappings

    • idmap backend

    • idmap gid

    • idmap only

    • idmap uid

    LDAP

    • ldap delete dn

    • ldap group suffix

    • ldap idmap suffix

    • ldap machine suffix

    • ldap passwd sync

    • ldap trust ids

    • ldap user suffix

    General Configuration

    • preload modules

    • privatedir

    Modified Parameters (changes in behavior):

    • encrypt passwords (enabled by default)

    • mangling method (set to 'hash2' by default)

    • passwd chat

    • passwd program

    • restrict anonymous (integer value)

    • security (new 'ads' value)

    • strict locking (enabled by default)

    • winbind cache time (increased to 5 minutes)

    • winbind uid (deprecated in favor of 'idmap uid')

    • winbind gid (deprecated in favor of 'idmap gid')

    New Functionality

    Databases

    +

    Removed Parameters

    (Ordered Alphabetically):

    • admin log

    • alternate permissions

    • character set

    • client codepage

    • code page directory

    • coding system

    • domain admin group

    • domain guest group

    • force unknown acl user

    • nt smb support

    • post script

    • printer driver

    • printer driver file

    • printer driver location

    • status

    • stip dot

    • total print jobs

    • use rhosts

    • valid chars

    • vfs options

    New Parameters

    (New parameters have been grouped by function):

    Remote Management

    • abort shutdown script

    • shutdown script

    User and Group Account Management:

    • add group script

    • add machine script

    • add user to group script

    • algorithmic rid base

    • delete group script

    • delete user from group script

    • passdb backend

    • set primary group script

    Authentication:

    • auth methods

    • realm

    Protocol Options:

    • client lanman auth

    • client NTLMv2 auth

    • client schannel

    • client signing

    • client use spnego

    • disable netbios

    • ntlm auth

    • paranoid server security

    • server schannel

    • server signing

    • smb ports

    • use spnego

    File Service:

    • get quota command

    • hide special files

    • hide unwriteable files

    • hostname lookups

    • kernel change notify

    • mangle prefix

    • map acl inherit

    • msdfs proxy

    • set quota command

    • use sendfile

    • vfs objects

    Printing:

    • max reported print jobs

    Unicode and Character Sets:

    • display charset

    • dos charset

    • unicode

    • UNIX charset

    SID to UID/GID Mappings:

    • idmap backend

    • idmap gid

    • idmap uid

    • winbind enable local accounts

    • winbind trusted domains only

    • template primary group

    • enable rid algorithm

    LDAP:

    • ldap delete dn

    • ldap group suffix

    • ldap idmap suffix

    • ldap machine suffix

    • ldap passwd sync

    • ldap trust ids

    • ldap user suffix

    General Configuration:

    • preload modules

    • privatedir

    Modified Parameters (Changes in Behavior):

    • encrypt passwords (enabled by default)

    • mangling method (set to hash2 by default)

    • passwd chat

    • passwd program

    • password server

    • restrict anonymous (integer value)

    • security (new ads value)

    • strict locking (enabled by default)

    • winbind cache time (increased to 5 minutes)

    • winbind uid (deprecated in favor of idmap uid)

    • winbind gid (deprecated in favor of idmap gid)

    New Functionality

    Databases

    This section contains brief descriptions of any new databases - introduced in Samba 3.0. Please remember to backup your existing - ${lock directory}/*tdb before upgrading to Samba 3.0. Samba will + introduced in Samba-3. Please remember to backup your existing + ${lock directory}/*tdb before upgrading to Samba-3. Samba will upgrade databases as they are opened (if necessary), but downgrading from 3.0 to 2.2 is an unsupported path. -

    Table 30.1. TDB File Descriptions

    NameDescriptionBackup?
    account_policyUser policy settingsyes
    gencacheGeneric caching dbno
    group_mapping

    Mapping table from Windows groups/SID to unix groups

    		yes
    idmap

    new ID map table from SIDS to UNIX uids/gids

    		yes
    namecacheName resolution cache entriesno
    netlogon_unigrp

    Cache of universal group membership obtained when operating - as a member of a Windows domain

    		no
    printing/*.tdb

    Cached output from 'lpq command' created on a per print - service basis

    		no
    registry

    Read-only samba registry skeleton that provides support for - exporting various db tables via the winreg RPCs

    		no

    Changes in Behavior

    - The following issues are known changes in behavior between Samba 2.2 and - Samba 3.0 that may affect certain installations of Samba. +

    + The new tdb files are described in . +

    Table 30.1. TDB File Descriptions

    NameDescriptionBackup?
    account_policyUser policy settingsyes
    gencacheGeneric caching dbno
    group_mapping

    Mapping table from Windows groups/SID to UNIX groups

    		yes
    idmap

    new ID map table from SIDS to UNIX UIDs/GIDs

    		yes
    namecacheName resolution cache entriesno
    netlogon_unigrp

    Cache of universal group membership obtained when operating + as a member of a Windows domain

    		no
    printing/*.tdb

    Cached output from `lpq command' created on a per print + service basis

    		no
    registry

    Read-only Samba registry skeleton that provides support for + exporting various db tables via the winreg RPCs

    		no

    Changes in Behavior

    + The following issues are known changes in behavior between Samba-2.2 and + Samba-3 that may affect certain installations of Samba.

    1. - When operating as a member of a Windows domain, Samba 2.2 would - map any users authenticated by the remote DC to the 'guest account' - if a uid could not be obtained via the getpwnam() call. Samba 3.0 - rejects the connection as NT_STATUS_LOGON_FAILURE. There is no - current work around to re-establish the 2.2 behavior. + When operating as a member of a Windows domain, Samba-2.2 would + map any users authenticated by the remote DC to the “guest account” + if a uid could not be obtained via the getpwnam() call. Samba-3 + rejects the connection as NT_STATUS_LOGON_FAILURE. There is no + current work around to re-establish the Samba-2.2 behavior.

    2. - When adding machines to a Samba 2.2 controlled domain, the - 'add user script' was used to create the UNIX identity of the - machine trust account. Samba 3.0 introduces a new 'add machine - script' that must be specified for this purpose. Samba 3.0 will - not fall back to using the 'add user script' in the absence of - an 'add machine script' -

    Charsets

    + When adding machines to a Samba-2.2 controlled domain, the + “add user script” was used to create the UNIX identity of the + Machine Trust Account. Samba-3 introduces a new “add machine + script” that must be specified for this purpose. Samba-3 will + not fall back to using the “add user script” in the absence of + an “add machine script”. +

    Charsets

    You might experience problems with special characters when communicating with old DOS - clients. Codepage support has changed in samba 3.0. Read the chapter - Unicode support for details. -

    Passdb Backends and Authentication

    + clients. Codepage support has changed in Samba-3. Read , for details. +

    Passdb Backends and Authentication

    There have been a few new changes that Samba administrators should be - aware of when moving to Samba 3.0. + aware of when moving to Samba-3.

    1. Encrypted passwords have been enabled by default in order to - inter-operate better with out-of-the-box Windows client - installations. This does mean that either (a) a samba account - must be created for each user, or (b) 'encrypt passwords = no' - must be explicitly defined in smb.conf. + interoperate better with out-of-the-box Windows client + installations. This does mean that either (a) a Samba account + must be created for each user, or (b) “encrypt passwords = no” + must be explicitly defined in smb.conf.

    2. - Inclusion of new security = ads option for integration - with an Active Directory domain using the native Windows - Kerberos 5 and LDAP protocols. + Inclusion of new security = ads option for integration + with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols.

    - Samba 3.0 also includes the possibility of setting up chains + Samba-3 also includes the possibility of setting up chains of authentication methods - (auth methods) and account + (auth methods) and account storage backends - (passdb backend). + (passdb backend). Please refer to the smb.conf - man page and the chapter about account information databases for details. While both parameters assume sane default + man page and , for details. While both parameters assume sane default values, it is likely that you will need to understand what the values actually mean in order to ensure Samba operates correctly.

    - Certain functions of the smbpasswd(8) tool have been split between the - new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8) - utility. See the respective man pages for details. -

    Charsets

    - You might experience problems with special characters when communicating with old DOS - clients. Codepage support has changed in samba 3.0. Read the chapter - Unicode support for details. -

    LDAP

    - This section outlines the new features affecting Samba / LDAP integration. -

    New Schema

    + + Certain functions of the smbpasswd tool have been split between the + new smbpasswd utility, the net tool and the new pdbedit + utility. See the respective man pages for details. +

    LDAP

    + This section outlines the new features effecting Samba/LDAP integration. +

    New Schema

    A new object class (sambaSamAccount) has been introduced to replace - the old sambaAccount. This change aids us in the renaming of attributes - to prevent clashes with attributes from other vendors. There is a - conversion script (examples/LDAP/convertSambaAccount) to modify and LDIF + the old sambaAccount. This change aids us in the renaming of attributes + to prevent clashes with attributes from other vendors. There is a + conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF file to the new schema.

    - Example: + Example: 

     		$ ldapsearch .... -b "ou=people,dc=..." > old.ldif
 		$ convertSambaAccount <DOM SID> old.ldif new.ldif

    - The <DOM SID> can be obtained by running 'net getlocalsid <DOMAINNAME> + The <DOM SID> can be obtained by running +

    +$ net getlocalsid <DOMAINNAME>
+

    on the Samba PDC as root.

    The old sambaAccount schema may still be used by specifying the - "ldapsam_compat" passdb backend. However, the sambaAccount and + ldapsam_compat passdb backend. However, the sambaAccount and associated attributes have been moved to the historical section of the schema file and must be uncommented before use if needed. - The 2.2 object class declaration for a sambaAccount has not changed - in the 3.0 samba.schema file. + The Samba-2.2 object class declaration for a sambaAccount has not changed + in the Samba-3 samba.schema file.

    Other new object classes and their uses include:

    • - sambaDomain - domain information used to allocate rids - for users and groups as necessary. The attributes are added - in 'ldap suffix' directory entry automatically if - an idmap uid/gid range has been set and the 'ldapsam' + sambaDomain domain information used to allocate RIDs + for users and groups as necessary. The attributes are added + in “ldap suffix” directory entry automatically if + an idmap UID/GID range has been set and the “ldapsam” passdb backend has been selected.

    • - sambaGroupMapping - an object representing the + sambaGroupMapping an object representing the relationship between a posixGroup and a Windows - group/SID. These entries are stored in the 'ldap - group suffix' and managed by the 'net groupmap' command. + group/SID. These entries are stored in the “ldap + group suffix” and managed by the “net groupmap” command.

    • - sambaUnixIdPool - created in the 'ldap idmap suffix' entry - automatically and contains the next available 'idmap uid' and - 'idmap gid' + sambaUNIXIdPool created in the “ldap idmap suffix” entry + automatically and contains the next available “idmap UID” and + “idmap GID”.

    • - sambaIdmapEntry - object storing a mapping between a - SID and a UNIX uid/gid. These objects are created by the + sambaIdmapEntry object storing a mapping between a + SID and a UNIX UID/GID. These objects are created by the idmap_ldap module as needed. -

    New Suffix for Searching

    +

    New Suffix for Searching

    The following new smb.conf parameters have been added to aid in directing - certain LDAP queries when 'passdb backend = ldapsam://...' has been + certain LDAP queries when passdb backend = ldapsam://... has been specified. -

    • ldap suffix - used to search for user and computer accounts

    • ldap user suffix - used to store user accounts

    • ldap machine suffix - used to store machine trust accounts

    • ldap group suffix - location of posixGroup/sambaGroupMapping entries

    • ldap idmap suffix - location of sambaIdmapEntry objects

    - If an 'ldap suffix' is defined, it will be appended to all of the - remaining sub-suffix parameters. In this case, the order of the suffix - listings in smb.conf is important. Always place the 'ldap suffix' first +

    • ldap suffix used to search for user and computer accounts.

    • ldap user suffix used to store user accounts.

    • ldap machine suffix used to store Machine Trust Accounts.

    • ldap group suffix location of posixGroup/sambaGroupMapping entries.

    • ldap idmap suffix location of sambaIdmapEntry objects.

    + If an ldap suffix is defined, it will be appended to all of the + remaining sub-suffix parameters. In this case, the order of the suffix + listings in smb.conf is important. Always place the ldap suffix first in the list.

    - Due to a limitation in Samba's smb.conf parsing, you should not surround - the DN's with quotation marks. -

    IdMap LDAP support

    - Samba 3.0 supports an ldap backend for the idmap subsystem. The - following options would inform Samba that the idmap table should be - stored on the directory server onterose in the "ou=idmap,dc=plainjoe, - dc=org" partition. -

    [global]
    ...
    idmap backend = ldap:ldap://onterose/
    ldap idmap suffix = ou=idmap,dc=plainjoe,dc=org
    idmap uid = 40000-50000
    idmap gid = 40000-50000

    - This configuration allows winbind installations on multiple servers to - share a uid/gid number space, thus avoiding the interoperability problems - with NFS that were present in Samba 2.2. -

    Chapter 31. Migration from NT4 PDC to Samba-3 PDC

    John H. Terpstra

    Samba Team

    April 3, 2003

    Table of Contents

    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices

    -This is a rough guide to assist those wishing to migrate from NT4 domain control to -Samba-3 based domain control. -

    Planning and Getting Started

    + Due to a limitation in Samba's smb.conf parsing, you should not surround + the DNs with quotation marks. +

    IdMap LDAP Support

    + Samba-3 supports an ldap backend for the idmap subsystem. The + following options inform Samba that the idmap table should be + stored on the directory server onterose in the "ou=idmap,dc=quenya,dc=org" partition. +

    [global]
    ...
    idmap backend = ldap:ldap://onterose/
    ldap idmap suffix = ou=idmap,dc=quenya,dc=org
    idmap uid = 40000-50000
    idmap gid = 40000-50000

    + This configuration allows Winbind installations on multiple servers to + share a UID/GID number space, thus avoiding the interoperability problems + with NFS that were present in Samba-2.2. +

    Chapter 31. Migration from NT4 PDC to Samba-3 PDC

    John H. Terpstra

    Samba Team

    April 3, 2003

    Table of Contents

    Planning and Getting Started
    Objectives
    Steps in Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices

    +This is a rough guide to assist those wishing to migrate from NT4 Domain Control to +Samba-3-based Domain Control. +

    Planning and Getting Started

    In the IT world there is often a saying that all problems are encountered because of poor planning. The corollary to this saying is that not all problems can be anticipated -and planned for. Then again, good planning will anticipate most show stopper type situations. +and planned for. Then again, good planning will anticipate most show-stopper-type situations.

    -Those wishing to migrate from MS Windows NT4 domain control to a Samba-3 domain control +Those wishing to migrate from MS Windows NT4 Domain Control to a Samba-3 Domain Control environment would do well to develop a detailed migration plan. So here are a few pointers to help migration get under way. -

    Objectives

    -The key objective for most organisations will be to make the migration from MS Windows NT4 -to Samba-3 domain control as painless as possible. One of the challenges you may experience +

    Objectives

    +The key objective for most organizations will be to make the migration from MS Windows NT4 +to Samba-3 Domain Control as painless as possible. One of the challenges you may experience in your migration process may well be one of convincing management that the new environment should remain in place. Many who have introduced open source technologies have experienced -pressure to return to a Microsoft based platform solution at the first sign of trouble. -

    -Before attempting a migration to a Samba-3 controlled network make every possible effort to -gain all-round commitment to the change. Know precisely why the change -is important for the organisation. Possible motivations to make a change include: -

    • Improve network manageability

    • Obtain better user level functionality

    • Reduce network operating costs

    • Reduce exposure caused by Microsoft withdrawal of NT4 support

    • Avoid MS License 6 implications

    • Reduce organisation's dependency on Microsoft

    -Make sure that everyone knows that Samba-3 is NOT MS Windows NT4. Samba-3 offers -an alternative solution that is both different from MS Windows NT4 and that offers +pressure to return to a Microsoft-based platform solution at the first sign of trouble. +

    +Before attempting a migration to a Samba-3 controlled network, make every possible effort to +gain all-round commitment to the change. Know precisely why the change +is important for the organization. Possible motivations to make a change include: +

    • Improve network manageability.

    • Obtain better user level functionality.

    • Reduce network operating costs.

    • Reduce exposure caused by Microsoft withdrawal of NT4 support.

    • Avoid MS License 6 implications.

    • Reduce organization's dependency on Microsoft.

    +Make sure everyone knows that Samba-3 is not MS Windows NT4. Samba-3 offers +an alternative solution that is both different from MS Windows NT4 and offers advantages compared with it. Gain recognition that Samba-3 lacks many of the features that Microsoft has promoted as core values in migration from MS Windows NT4 to MS Windows 2000 and beyond (with or without Active Directory services).

    -What are the features that Samba-3 can NOT provide? -

    • Active Directory Server

    • Group Policy Objects (in Active Directory)

    • Machine Policy objects

    • Logon Scripts in Active Directory

    • Software Application and Access Controls in Active Directory

    -The features that Samba-3 DOES provide and that may be of compelling interest to your site -includes: -

    • Lower Cost of Ownership

    • Global availability of support with no strings attached

    • Dynamic SMB Servers (ie:Can run more than one server per Unix/Linux system)

    • Creation of on-the-fly logon scripts

    • Creation of on-the-fly Policy Files

    • Greater Stability, Reliability, Performance and Availability

    • Manageability via an ssh connection

    • Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam)

    • Ability to implement a full single-sign-on architecture

    • Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand

    -Before migrating a network from MS Windows NT4 to Samba-3 consider all necessary factors. Users -should be educated about changes they may experience so that the change will be a welcome one +What are the features that Samba-3 cannot provide? +

    • Active Directory Server.

    • Group Policy Objects (in Active Directory).

    • Machine Policy Objects.

    • Logon Scripts in Active Directory.

    • Software Application and Access Controls in Active Directory.

    +The features that Samba-3 does provide and that may be of compelling interest to your site +include: +

    • Lower cost of ownership.

    • Global availability of support with no strings attached.

    • Dynamic SMB Servers (can run more than one SMB/CIFS server per UNIX/Linux system).

    • Creation of on-the-fly logon scripts.

    • Creation of on-the-fly Policy Files.

    • Greater stability, reliability, performance and availability.

    • Manageability via an ssh connection.

    • Flexible choices of back-end authentication technologies (tdbsam, ldapsam, mysqlsam).

    • Ability to implement a full single-sign-on architecture.

    • Ability to distribute authentication systems for absolute minimum wide area network bandwidth demand.

    +Before migrating a network from MS Windows NT4 to Samba-3, consider all necessary factors. Users +should be educated about changes they may experience so the change will be a welcome one and not become an obstacle to the work they need to do. The following are factors that will help ensure a successful migration: -

    Domain Layout

    -Samba-3 can be configured as a domain controller, a back-up domain controller (probably best called -a secondary controller), a domain member, or as a stand-alone server. The Windows network security +

    Domain Layout

    +Samba-3 can be configured as a Domain Controller, a back-up Domain Controller (probably best called +a secondary controller), a Domain Member, or as a stand-alone Server. The Windows network security domain context should be sized and scoped before implementation. Particular attention needs to be -paid to the location of the primary domain controller (PDC) as well as backup controllers (BDCs). +paid to the location of the primary Domain Controller (PDC) as well as backup controllers (BDCs). One way in which Samba-3 differs from Microsoft technology is that if one chooses to use an LDAP -authentication backend then the same database can be used by several different domains. In a -complex organisation there can be a single LDAP database, which itself can be distributed (ie: Have +authentication backend, then the same database can be used by several different domains. In a +complex organization, there can be a single LDAP database, which itself can be distributed (have a master server and multiple slave servers) that can simultaneously serve multiple domains.

    -From a design perspective, the number of users per server, as well as the number of servers, per +>From a design perspective, the number of users per server as well as the number of servers per domain should be scaled taking into consideration server capacity and network bandwidth.

    A physical network segment may house several domains. Each may span multiple network segments. Where domains span routed network segments, consider and test the performance implications of -the design and layout of a network. A Centrally located domain controller that is designed to +the design and layout of a network. A centrally located Domain Controller that is designed to serve multiple routed network segments may result in severe performance problems. Check the -response time (eg: ping timing) between the remote segment and the PDC. If long (more than 100 ms) -locate a backup controller (BDC) on the remote segmanet to serve as the local authentication and +response time (ping timing) between the remote segment and the PDC. If +it's long (more than 100 ms), +locate a backup controller (BDC) on the remote segment to serve as the local authentication and access control server. -

    Server Share and Directory Layout

    -There are cardinal rules to effective network design. These can not be broken with impunity. -The most important rule: Simplicity is king in every well controlled network. Every part of -the infrastructure must be managed, the more complex it is, the greater will be the demand +

    Server Share and Directory Layout

    +There are cardinal rules to effective network design that cannot be broken with impunity. +The most important rule: Simplicity is king in every well-controlled network. Every part of +the infrastructure must be managed; the more complex it is, the greater will be the demand of keeping systems secure and functional.

    -Keep in mind the nature of how data must be share. Physical disk space layout should be considered +Keep in mind the nature of how data must be shared. Physical disk space layout should be considered carefully. Some data must be backed up. The simpler the disk layout the easier it will be to -keep track of backed needs. Identify what back media will be meet needs, consider backup to tape -, CD-ROM or (DVD-ROM), or other off-line storage medium. Plan and implement for minimum -maintenance. Leave nothing to chance in your design, above all, do not leave backups to chance: -Backup and test, validate every backup, create a disaster recovery plan and prove that it works. +keep track of backup needs. Identify what backup media will meet your needs; consider backup to tape, +CD-ROM or (DVD-ROM), or other offline storage medium. Plan and implement for minimum +maintenance. Leave nothing to chance in your design; above all, do not leave backups to chance: +Backup, test, and validate every backup, create a disaster recovery plan and prove that it works.

    Users should be grouped according to data access control needs. File and directory access -is best controlled via group permissions and the use of the "sticky bit" on group controlled -directories may substantially avoid file access complaints from samba share users. +is best controlled via group permissions and the use of the “sticky bit” on group controlled +directories may substantially avoid file access complaints from Samba share users.

    Inexperienced network administrators often attempt elaborate techniques to set access controls on files, directories, shares, as well as in share definitions. @@ -14416,134 +14422,284 @@ Keep your design and implementation simple and document your design extensively. audit your documentation. Do not create a complex mess that your successor will not understand. Remember, job security through complex design and implementation may cause loss of operations and downtime to users as the new administrator learns to untangle your knots. Keep access -controls simple and effective and make sure that users will never be interrupted by stupid +controls simple and effective and make sure that users will never be interrupted by obtuse complexity. -

    Logon Scripts

    -Logon scripts can help to ensure that all users gain share and printer connections they need. +

    Logon Scripts

    +Logon scripts can help to ensure that all users gain the share and printer connections they need.

    -Logon scripts can be created 'on-the-fly' so that all commands executed are specific to the -rights and priviliges granted to the user. The preferred controls should be affected through -group membership so that group information can be used to custom create a logon script using -the root preexec parameters to the NETLOGON share. +Logon scripts can be created on-the-fly so all commands executed are specific to the +rights and privileges granted to the user. The preferred controls should be affected through +group membership so group information can be used to create a custom logon script using +the root preexec parameters to the NETLOGON share.

    Some sites prefer to use a tool such as kixstart to establish a controlled -user environment. In any case you may wish to do a google search for logon script process controls. -In particular, you may wish to explore the use of the Microsoft knowledgebase article KB189105 that +user environment. In any case, you may wish to do a Google search for logon script process controls. +In particular, you may wish to explore the use of the Microsoft KnowledgeBase article KB189105 that deals with how to add printers without user intervention via the logon script process. -

    Profile Migration/Creation

    +

    Profile Migration/Creation

    User and Group Profiles may be migrated using the tools described in the section titled Desktop Profile Management.

    + Profiles may also be managed using the Samba-3 tool profiles. This tool allows -the MS Windows NT style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file +the MS Windows NT-style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file to be changed to the SID of the Samba-3 domain. -

    User and Group Accounts

    +

    User and Group Accounts

    It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before -attempting to migrate user and group accounts it is STRONGLY advised to create in Samba-3 the -groups that are present on the MS Windows NT4 domain AND to map these to -suitable Unix/Linux groups. By following this simple advice all user and group attributes +attempting to migrate user and group accounts, it is STRONGLY advised to create in Samba-3 the +groups that are present on the MS Windows NT4 domain AND to map them to +suitable UNIX/Linux groups. By following this simple advice, all user and group attributes should migrate painlessly. -

    Steps In Migration Process

    +

    Steps in Migration Process

    The approximate migration process is described below.

    • -You will have an NT4 PDC that has the users, groups, policies and profiles to be migrated +You have an NT4 PDC that has the users, groups, policies and profiles to be migrated.

    • -Samba-3 set up as a DC with netlogon share, profile share, etc. Configure the smb.conf file -to fucntion as a BDC. ie: domain master = No. -

    Procedure 31.1. The Account Migration Process

    1. Create a BDC account for the samba server using NT Server Manager

      1. Samba must NOT be running

    2. net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd

    3. net rpc vampire -S NT4PDC -U administrator%passwd

    4. pdbedit -L

      1. Note - did the users migrate?

    5. +Samba-3 set up as a DC with netlogon share, profile share, and so on. Configure the smb.conf file +to fucntion as a BDC, i.e., domain master = No. +

    Procedure 31.1. The Account Migration Process

    1. + + Create a BDC account in the old NT4 domain for the Samba server using NT Server Manager.

      1. Samba must not be running.

    2. + + net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd

    3. net rpc vampire -S NT4PDC -U administrator%passwd

    4. pdbedit -L

      1. Note did the users migrate?

    5. + + Now assign each of the UNIX groups to NT groups: - (Note: It may be useful to copy this text to a script called - initGroups.sh) + (It may be useful to copy this text to a script called initGroups.sh) 

       #!/bin/bash
 #### Keep this as a shell script for future re-use
 			
 # First assign well known domain global groups
-net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmins
-net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
-net groupmap modify ntgroup="Domain Users" unixgroup=users
+net groupmap modify ntgroup="Domain Admins" unixgroup=root   rid=512
+net groupmap modify ntgroup="Domain Users"  unixgroup=users  rid=513
+net groupmap modify ntgroup="Domain Guests" unixgroup=nobody rid=514
 
 # Now for our added domain global groups
 net groupmap add ntgroup="Designers" unixgroup=designers type=d rid=3200
 net groupmap add ntgroup="Engineers" unixgroup=engineers type=d rid=3210
 net groupmap add ntgroup="QA Team"   unixgroup=qateam    type=d rid=3220

      -

    6. net groupmap list

      1. Now check that all groups are recognised

    -Now migrate all the profiles, then migrate all policy files. -

    Migration Options

    -Sites that wish to migrate from MS Windows NT4 Domain Control to a Samba based solution -generally fit into three basic categories. -

    Table 31.1. The 3 Major Site Types

    Number of UsersDescription
    < 50

    Want simple conversion with NO pain

    50 - 250

    Want new features, can manage some in-house complexity

    > 250

    Solution/Implementation MUST scale well, complex needs. Cross departmental decision process. Local expertise in most areas

    Planning for Success

    +

  • net groupmap list

    1. Check that all groups are recognized.

    • +Migrate all the profiles, then migrate all policy files. +

    Migration Options

    +Sites that wish to migrate from MS Windows NT4 Domain Control to a Samba-based solution +generally fit into three basic categories. shows the possibilities. +

    Table 31.1. The Three Major Site Types

    Number of UsersDescription
    < 50

    Want simple conversion with no pain.

    50 - 250

    Want new features, can manage some in-house complexity.

    > 250

    Solution/Implementation must scale well, complex needs. Cross-departmental decision process. Local expertise in most areas.

    Planning for Success

    There are three basic choices for sites that intend to migrate from MS Windows NT4 -to Samba-3. +to Samba-3:

    • - Simple Conversion (total replacement) + Simple conversion (total replacement).

    • - Upgraded Conversion (could be one of integration) + Upgraded conversion (could be one of integration).

    • - Complete Redesign (completely new solution) + Complete redesign (completely new solution).

    -Minimise down-stream problems by: +Minimize down-stream problems by:

    • - Take sufficient time + Taking sufficient time.

    • - Avoid Panic + Avoiding Panic.

    • - Test ALL assumptions + Testing all assumptions.

    • - Test full roll-out program, including workstation deployment -

    Table 31.2. Nature of the Conversion Choices

    SimpleUpgradedRedesign

    Make use of minimal OS specific features

    Translate NT4 features to new host OS features

    Decide:

    Suck all accounts from NT4 into Samba-3

    Copy and improve:

    Authentication Regime (database location and access)

    Make least number of operational changes

    Make progressive improvements

    Desktop Management Methods

    Take least amount of time to migrate

    Minimise user impact

    Better Control of Desktops / Users

    Live versus Isolated Conversion

    Maximise functionality

    Identify Needs for: Manageability, Scalability, Security, Availability

    Integrate Samba-3 then migrate while users are active, then Change of control (ie: swap out)

    Take advantage of lower maintenance opportunity

    Samba-3 Implementation Choices

    Authentication database/back end:

    + Testing the full roll-out program, including workstation deployment. +

    lists the conversion choices given the type of migration +being contemplated. +

    Table 31.2. Nature of the Conversion Choices

    SimpleUpgradedRedesign

    Make use of minimal OS specific features.

    Translate NT4 features to new host OS features.

    Decide:

    Move all accounts from NT4 into Samba-3

    Copy and improve

    Authentication regime (database location and access)

    Make least number of operational changes

    Make progressive improvements

    Desktop management methods

    Take least amount of time to migrate

    Minimize user impact

    Better control of Desktops/Users

    Live versus isolated conversion

    Maximize functionality

    Identify Needs for: Manageability, Scalability, Security, Availability

    Integrate Samba-3 then migrate while users are active, then change of control (swap out)

    Take advantage of lower maintenance opportunity

    Samba-3 Implementation Choices

    Authentication Database/Backend

    Samba-3 can use an external authentication backend:

    -

    • Winbind (external Samba or NT4/200x server)

    • External server could use Active Directory or NT4 Domain

    • Can use pam_mkhomedir.so to auto-create home dirs

    -

    - Samba-3 can use a local authentication backend: -

    • smbpasswd, tdbsam, ldapsam, mysqlsam

    -

    Access Control Points:

    • On the Share itself - using Share ACLs

    • On the file system - using UNIX permissions on files and directories

      Note: Can Enable Posix ACLs in file system also

    • Through Samba share parameters - Not recommended - except as last resort

    Policies (migrate or create new ones):

    • Using Group Policy Editor (NT4)

    • - Watch out for Tattoo effect

    User and Group Profiles:

    - Platform specific so use platform tool to change from a Local to a Roaming profile - Can use new profiles tool to change SIDs (NTUser.DAT) -

    Logon Scripts:

    - Know how they work -

    User and Group mapping to Unix/Linux:

    • username map facility may be needed

    • Use 'net groupmap' to connect NT4 groups to Unix groups

    • Use pdbedit to set/change user configuration

      - NOTE: When migrating to LDAP back, end it may be easier to dump initial - LDAP database to LDIF, then edit, then reload into LDAP -

    OS specific scripts/programs may be needed:

    • Add/Delete Users: Note OS limits on size of name - (Linux 8 chars) NT4 up to 254 chars

    • Add/Delete Machines: Applied only to domain members - (Note: Machine names may be limited to 16 characters)

    • Use 'net groupmap' to connect NT4 groups to Unix groups

    • Add/Delete Groups: Note OS limits on size and nature. - Linux limit is 16 char, no spaces and no upper case chars (groupadd)

    Migration Tools:

    +

    • Winbind (external Samba or NT4/200x server).

    • External server could use Active Directory or NT4 Domain.

    • Can use pam_mkhomedir.so to auto-create home dirs.

    • + Samba-3 can use a local authentication backend: smbpasswd, tdbsam, ldapsam, mysqlsam

    +

    Access Control Points

    + Samba permits Access Control Points to be set: +

    • On the share itself using Share ACLs.

    • On the file system using UNIX permissions on files and directories.

      Note: Can enable Posix ACLs in file system also.

    • Through Samba share parameters not recommended except as last resort.

    Policies (migrate or create new ones)

    + Exercise great caution when affecting registry changes, use the right tool and be aware + that changes made through NT4-style NTConfig.POL files can leave + permanent changes. +

    • Using Group Policy Editor (NT4).

    • Watch out for Tattoo effect.

    User and Group Profiles

    + Platform-specific so use platform tool to change from a Local to a Roaming profile. + Can use new profiles tool to change SIDs (NTUser.DAT). +

    Logon Scripts

    + Know how they work. +

    User and Group Mapping to UNIX/Linux

    + + User and Group mapping code is new. Many problems have been experienced as network administrators + who are familiar with Samba-2.2.x migrate to Samba-3. Carefully study the chapters that document + the new password backend behavior and the new group mapping functionality. +

    • The username map facility may be needed.

    • Use net groupmap to connect NT4 groups to UNIX groups.

    • Use pdbedit to set/change user configuration.

      + When migrating to LDAP backend, it may be easier to dump the initial + LDAP database to LDIF, edit, then reload into LDAP. +

    OS Specific Scripts/Programs may be Needed

    + Every operating system has its peculiarities. These are the result of engineering decisions + that were based on the experience of the designer, and may have side-effects that were not + anticipated. Limitations that may bite the Windows network administrator include: +

    • Add/Delete Users: Note OS limits on size of name + (Linux 8 chars) NT4 up to 254 chars.

    • Add/Delete Machines: Applied only to Domain Members + (Note: machine names may be limited to 16 characters).

    • Use net groupmap to connect NT4 groups to UNIX groups.

    • Add/Delete Groups: Note OS limits on size and nature. + Linux limit is 16 char, no spaces and no upper case chars (groupadd).

    Migration Tools

    + Domain Control (NT4 Style) Profiles, Policies, Access Controls, Security -

    • Samba: net, rpcclient, smbpasswd, pdbedit, profiles

    • Windows: NT4 Domain User Manager, Server Manager (NEXUS)

    -

    Chapter 32. SWAT - The Samba Web Administration Tool

    John H. Terpstra

    Samba Team

    April 21, 2003

    Table of Contents

    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    -There are many and varied opinions regarding the usefulness or otherwise of SWAT. -No matter how hard one tries to produce the perfect configuration tool it remains -an object of personal taste. SWAT is a tool that will allow web based configuration -of samba. It has a wizard that may help to get samba configured quickly, it has context -sensitive help on each smb.conf parameter, it provides for monitoring of current state -of connection information, and it allows network wide MS Windows network password +

    • Samba: net, rpcclient, smbpasswd, pdbedit, profiles.

    • Windows: NT4 Domain User Manager, Server Manager (NEXUS)

    +

    Chapter 32. SWAT The Samba Web Administration Tool

    John H. Terpstra

    Samba Team

    April 21, 2003

    Table of Contents

    Features and Benefits
    Guidelines and Technical Tips
    Validate SWAT Installation
    Enabling SWAT for Use
    Securing SWAT through SSL
    Enabling SWAT Internationalization Support
    Overview and Quick Tour
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page

    +There are many and varied opinions regarding the usefulness of SWAT. +No matter how hard one tries to produce the perfect configuration tool, it remains +an object of personal taste. SWAT is a tool that will allow Web-based configuration +of Samba. It has a wizard that may help to get Samba configured +quickly, it has context-sensitive help on each smb.conf parameter, it provides for monitoring of current state +of connection information, and it allows network-wide MS Windows network password management. -

    Features and Benefits

    +

    Features and Benefits

    +SWAT is a facility that is part of the Samba suite. The main executable is called +swat and is invoked by the inter-networking super daemon. +See for details. +

    +SWAT uses integral samba components to locate parameters supported by the particular +version of Samba. Unlike tools and utilities that are external to Samba, SWAT is always +up to date as known Samba parameters change. SWAT provides context-sensitive help for each +configuration parameter, directly from man page entries. +

    There are network administrators who believe that it is a good idea to write systems -documentation inside configuration files, for them SWAT will aways be a nasty tool. SWAT +documentation inside configuration files, and for them SWAT will aways be a nasty tool. SWAT does not store the configuration file in any intermediate form, rather, it stores only the -parameter settings, so when SWAT writes the smb.conf file to disk it will write only -those parameters that are at other than the default settings. The result is that all comments -will be lost from the smb.conf file. Additionally, the parameters will be written back in -internal ordering. +parameter settings, so when SWAT writes the smb.conf file to disk, it will write only +those parameters that are at other than the default settings. The result is that all comments, +as well as parameters that are no longer supported, will be lost from the smb.conf file. +Additionally, the parameters will be written back in internal ordering.

    Note

    -So before using SWAT please be warned - SWAT will completely replace your smb.conf with -a fully optimised file that has been stripped of all comments you might have placed there +Before using SWAT, please be warned SWAT will completely replace your smb.conf with +a fully-optimized file that has been stripped of all comments you might have placed there and only non-default settings will be written to the file. -

    Enabling SWAT for use

    -SWAT should be installed to run via the network super daemon. Depending on which system -your UNIX/Linux system has you will have either an inetd or -xinetd based system. +

    Guidelines and Technical Tips

    +This section aims to unlock the dark secrets behind how SWAT may be made to work, +may be made more secure, and how to solve Internationalization support problems. +

    Validate SWAT Installation

    +The very first step that should be taken before attempting to configure a host +system for SWAT operation is to check that it is installed. This may seem a trivial +point to some, however several Linux distributions do not install SWAT by default, +even though they do ship an installable binary support package containing SWAT +on the distribution media. +

    +When you have configrmed that SWAT is installed it is necessary to validate +that the installation includes the binary swat file as well +as all the supporting text and Web files. A number of operating system distributions +in the past have failed to include the necessary support files, evne though the +swat binary executable file was installed. +

    +Finally, when you are sure that SWAT has been fully installed, please check the SWAT +has been enebled in the control file for the internetworking super-daemon (inetd or xinetd) +that is used on your operating system platform. +

    Locating the swat File

    +To validate that SWAT is installed, first locate the swat binary +file on the system. It may be found under the following directories: +

    /usr/local/samba/bin the default Samba location.
    /usr/sbin the default location on most Linux systems.
    /opt/samba/bin

    +

    +The actual location is much dependant on the choice of the operating system vendor, or as determined +by the administrator who compiled and installed Samba. +

    +There are a number methods that may be used to locate the swat binary file. +The following methods may be helpful: +

    +If swat is in your current operating system search path it will be easy to +find it. You can ask what are the command-line options for swat as shown here: +

    +frodo:~ # swat -?
+Usage: swat [OPTION...]
+  -a, --disable-authentication         Disable authentication (demo mode)
+
+Help options:
+  -?, --help                           Show this help message
+  --usage                              Display brief usage message
+
+Common samba options:
+  -d, --debuglevel=DEBUGLEVEL          Set debug level
+  -s, --configfile=CONFIGFILE          Use alternative configuration file
+  -l, --log-basename=LOGFILEBASE       Basename for log/debug files
+  -V, --version                        Print version
+

    +

    Locating the SWAT Support Files

    +Now that you have found that swat is in the search path, it is easy +to identify where the file is located. Here is another simple way this may be done: +

    +frodo:~ # whereis swat
+swat: /usr/sbin/swat /usr/share/man/man8/swat.8.gz
+

    +

    +If the above measures fail to locate the swat binary, another approach +is needed. The following may be used: +

    +frodo:/ # find / -name swat -print
+/etc/xinetd.d/swat
+/usr/sbin/swat
+/usr/share/samba/swat
+frodo:/ #
+

    +

    +This list shows that there is a control file for xinetd, the internetwork +super-daemon that is installed on this server. The location of the SWAT binary file is +/usr/sbin/swat, and the support files for it are located under the +directory /usr/share/samba/swat. +

    +We must now check where swat expects to find its support files. This can +be done as follows: +

    +frodo:/ # strings /usr/sbin/swat | grep "/swat"
+/swat/
+...
+/usr/share/samba/swat
+frodo:/ #
+

    +

    +The /usr/share/samba/swat/ entry shown in this listing is the location of the +support files. You should verify that the support files exist under this directory. A sample +list is as shown: +

    +jht@frodo:/> find /usr/share/samba/swat -print
+/usr/share/samba/swat
+/usr/share/samba/swat/help
+/usr/share/samba/swat/lang
+/usr/share/samba/swat/lang/ja
+/usr/share/samba/swat/lang/ja/help
+/usr/share/samba/swat/lang/ja/help/welcome.html
+/usr/share/samba/swat/lang/ja/images
+/usr/share/samba/swat/lang/ja/images/home.gif
+...
+/usr/share/samba/swat/lang/ja/include
+/usr/share/samba/swat/lang/ja/include/header.nocss.html
+...
+/usr/share/samba/swat/lang/tr
+/usr/share/samba/swat/lang/tr/help
+/usr/share/samba/swat/lang/tr/help/welcome.html
+/usr/share/samba/swat/lang/tr/images
+/usr/share/samba/swat/lang/tr/images/home.gif
+...
+/usr/share/samba/swat/lang/tr/include
+/usr/share/samba/swat/lang/tr/include/header.html
+/usr/share/samba/swat/using_samba
+...
+/usr/share/samba/swat/images
+/usr/share/samba/swat/images/home.gif
+...
+/usr/share/samba/swat/include
+/usr/share/samba/swat/include/footer.html
+/usr/share/samba/swat/include/header.html
+jht@frodo:/>
+

    +

    +If the files needed are not available it will be necessary to obtain and install them +before SWAT can be used. +

    Enabling SWAT for Use

    +SWAT should be installed to run via the network super-daemon. Depending on which system +your UNIX/Linux system has, you will have either an inetd- or +xinetd-based system.

    The nature and location of the network super-daemon varies with the operating system implementation. The control file (or files) can be located in the file -/etc/inetd.conf or in the directory /etc/[x]inet.d +/etc/inetd.conf or in the directory /etc/[x]inet[d].d or similar.

    The control entry for the older style file might be: + 

     	# swat is the Samba Web Administration Tool
 	swat stream tcp nowait.400 root /usr/sbin/swat swat
@@ -14551,852 +14707,935 @@ The control entry for the older style file might be:
 A control file for the newer style xinetd could be:
 
    
 
    -	# default: off
-	# description: SWAT is the Samba Web Admin Tool. Use swat \
-	#              to configure your Samba server. To use SWAT, \
-	#              connect to port 901 with your favorite web browser.
-	service swat
-	{
-		port    = 901
-		socket_type     = stream
-		wait    = no
-		only_from = localhost
-		user    = root
-		server  = /usr/sbin/swat
-		log_on_failure  += USERID
-		disable = yes
-	}
+# default: off
+# description: SWAT is the Samba Web Admin Tool. Use swat \
+#              to configure your Samba server. To use SWAT, \
+#              connect to port 901 with your favorite web browser.
+service swat
+{
+	port    = 901
+	socket_type     = stream
+	wait    = no
+	only_from = localhost
+	user    = root
+	server  = /usr/sbin/swat
+	log_on_failure  += USERID
+	disable = yes
+}
 
    
 
 
    
-Both the above examples assume that the swat binary has been
-located in the /usr/sbin directory. In addition to the above
-SWAT will use a directory access point from which it will load it's help files
+Both of the above examples assume that the swat binary has been
+located in the /usr/sbin directory. In addition to the above,
+SWAT will use a directory access point from which it will load its Help files
 as well as other control information. The default location for this on most Linux
 systems is in the directory /usr/share/samba/swat. The default
-location using samba defaults will be /usr/local/samba/swat.
+location using Samba defaults will be /usr/local/samba/swat.
 
    
-Access to SWAT will prompt for a logon. If you log onto SWAT as any non-root user
+Access to SWAT will prompt for a logon. If you log onto SWAT as any non-root user,
 the only permission allowed is to view certain aspects of configuration as well as
 access to the password change facility. The buttons that will be exposed to the non-root
 user are: HOME, STATUS, VIEW, 
 PASSWORD. The only page that allows
 change capability in this case is PASSWORD.
 
    
-So long as you log onto SWAT as the user root you should obtain
-full change and commit ability. The buttons that will be exposed includes:
+As long as you log onto SWAT as the user root, you should obtain
+full change and commit ability. The buttons that will be exposed include:
 HOME, GLOBALS, SHARES, PRINTERS, 
 WIZARD, STATUS, VIEW, PASSWORD.
-

    Securing SWAT through SSL

    -Lots of people have asked about how to setup SWAT with SSL to allow for secure remote -administration of Samba. Here is a method that works, courtesy of Markus Krieger +

    Securing SWAT through SSL

    + +Many people have asked about how to setup SWAT with SSL to allow for secure remote +administration of Samba. Here is a method that works, courtesy of Markus Krieger.

    -Modifications to the swat setup are as following: +Modifications to the SWAT setup are as follows:

    1. - install OpenSSL + Install OpenSSL.

    2. - generate certificate and private key + Generate certificate and private key. 

       root# /usr/bin/openssl req -new -x509 -days 365 -nodes -config \
 	/usr/share/doc/packages/stunnel/stunnel.cnf \
 	-out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem

    3. - remove swat-entry from [x]inetd + Remove swat-entry from [x]inetd.

    4. - start stunnel + Start stunnel. 

       root# stunnel -p /etc/stunnel/stunnel.pem -d 901 \
 	 -l /usr/local/samba/bin/swat swat

    -afterwords simply contact to swat by using the URL https://myhost:901, accept the certificate +Afterward, simply connect to swat by using the URL https://myhost:901, accept the certificate and the SSL connection is up. -

    The SWAT Home Page

    +

    Enabling SWAT Internationalization Support

    +SWAT can be configured to display its messages to match the settings of +the language configurations of your Web browser. It will be passed to SWAT +in the Accept-Language header of the HTTP request. +

    + +

    +To enable this feature: +

    + +

    • + Install the proper msg files from the Samba + source/po directory into $LIBDIR. +

    • + Set the correct locale value for display charset. +

    • + Set your browser's language setting. +

    + +

    +The name of msg file is same as the language ID sent by the browser. For +example en means "English", ja means "Japanese", fr means "French. +

    + +

    +If you do not like some of messages, or there are no msg files for +your locale, you can create them simply by copying the en.msg files +to the dirertory for “your language ID.msg” and filling in proper strings +to each “msgstr”. For example, in it.msg, the +msg file for the Italian locale, just set: +

    +msgid "Set Default"
+msgstr "Imposta Default"
+

    +and so on. If you find a mistake or create a new msg file, please email it +to us so we will include this in the next release of Samba. +

    + +

    +Note that if you enable this feature and the display charset is not +matched to your browser's setting, the SWAT display may be corrupted. In a future version of +Samba, SWAT will always display messages with UTF-8 encoding. You will then not need to set +this smb.conf file parameter. +

    Overview and Quick Tour

    +SWAT is a tools that many be used to configure Samba, or just to obtain useful links +to important reference materials such as the contents of this book, as well as other +documents that have been found useful for solving Windows networking problems. +

    The SWAT Home Page

    The SWAT title page provides access to the latest Samba documentation. The manual page for -each samba component is accessible from this page as are the Samba-HOWTO-Collection (this -document) as well as the O'Reilly book "Using Samba". +each Samba component is accessible from this page, as are the Samba HOWTO-Collection (this +document) as well as the O'Reilly book “Using Samba.”

    -Administrators who wish to validate their samba configuration may obtain useful information +Administrators who wish to validate their Samba configuration may obtain useful information from the man pages for the diagnostic utilities. These are available from the SWAT home page -also. One diagnostic tool that is NOT mentioned on this page, but that is particularly -useful is ethereal. +also. One diagnostic tool that is not mentioned on this page, but that is particularly +useful is ethereal.

    Warning

    -SWAT can be configured to run in demo mode. This is NOT recommended -as it runs SWAT without authentication and with full administrative ability. ie: Allows -changes to smb.conf as well as general operation with root privileges. The option that -creates this ability is the -a flag to swat. Do not use this in any +SWAT can be configured to run in demo mode. This is not recommended +as it runs SWAT without authentication and with full administrative ability. Allows +changes to smb.conf as well as general operation with root privileges. The option that +creates this ability is the -a flag to swat. Do not use this in a production environment. -

    Global Settings

    -The Globals button will expose a page that allows configuration of the global parameters -in smb.conf. There are three levels of exposure of the parameters: +

    Global Settings

    +The GLOBALS button will expose a page that allows configuration of the global parameters +in smb.conf. There are two levels of exposure of the parameters:

    • - Basic - exposes common configuration options. + Basic exposes common configuration options.

    • - Advanced - exposes configuration options needed in more + Advanced exposes configuration options needed in more complex environments. -

    • - Developer - exposes configuration options that only the brave - will want to tamper with.

    -To switch to other than Basic editing ability click on either the -Advanced or the Developer button. You may also -do this by clicking on the radio button, then click the Commit Changes button. +To switch to other than Basic editing ability, click on Advanced. +You may also do this by clicking on the radio button, then click on the Commit Changes button.

    -After making any changes to configuration parameters make sure that you click on the -Commit Changes button before moving to another area otherwise -your changes will be immediately lost. +After making any changes to configuration parameters, make sure that +you click on the +Commit Changes button before moving to another area, otherwise +your changes will be lost.

    Note

    -SWAT has context sensitive help. To find out what each parameter is for simply click the +SWAT has context-sensitive help. To find out what each parameter is +for, simply click on the Help link to the left of the configuration parameter. -

    Share Settings

    -To affect a currently configured share, simply click on the pull down button between the +

    Share Settings

    +To effect a currently configured share, simply click on the pull down button between the Choose Share and the Delete Share buttons, -select the share you wish to operate on, then to edit the settings click on the -Choose Share button, to delete the share simply press the +select the share you wish to operate on, then to edit the settings +click on the +Choose Share button. To delete the share, simply press the Delete Share button.

    -To create a new share, next to the button labelled Create Share enter +To create a new share, next to the button labeled Create Share enter into the text field the name of the share to be created, then click on the Create Share button. -

    Printers Settings

    +

    Printers Settings

    To affect a currently configured printer, simply click on the pull down button between the Choose Printer and the Delete Printer buttons, -select the printer you wish to operate on, then to edit the settings click on the -Choose Printer button, to delete the share simply press the +select the printer you wish to operate on, then to edit the settings +click on the +Choose Printer button. To delete the share, simply press the Delete Printer button.

    -To create a new printer, next to the button labelled Create Printer enter +To create a new printer, next to the button labeled Create Printer enter into the text field the name of the share to be created, then click on the Create Printer button. -

    The SWAT Wizard

    -The purpose if the SWAT Wizard is to help the Microsoft knowledgeable network administrator +

    The SWAT Wizard

    +The purpose if the SWAT Wizard is to help the Microsoft-knowledgeable network administrator to configure Samba with a minimum of effort.

    -The Wizard page provides a tool for rewriting the smb.conf file in fully optimised format. -This will also happen if you press the commit button. The two differ in the the rewrite button -ignores any changes that may have been made, while the Commit button causes all changes to be -affected. +The Wizard page provides a tool for rewriting the smb.conf file in fully optimized format. +This will also happen if you press the Commit button. The two differ +since the Rewrite button ignores any changes that may have been made, +while the Commit button causes all changes to be affected.

    The Edit button permits the editing (setting) of the minimal set of options that may be necessary to create a working Samba server.

    Finally, there are a limited set of options that will determine what type of server Samba will be configured for, whether it will be a WINS server, participate as a WINS client, or -operate with no WINS support. By clicking on one button you can elect to expose (or not) user +operate with no WINS support. By clicking one button, you can elect to expose (or not) user home directories. -

    The Status Page

    -The status page serves a limited purpose. Firstly, it allows control of the samba daemons. -The key daemons that create the samba server environment are: smbd, nmbd, winbindd. +

    The Status Page

    +The status page serves a limited purpose. First, it allows control of the Samba daemons. +The key daemons that create the Samba server environment are: smbd, nmbd, winbindd.

    The daemons may be controlled individually or as a total group. Additionally, you may set -an automatic screen refresh timing. As MS Windows clients interact with Samba new smbd processes +an automatic screen refresh timing. As MS Windows clients interact with Samba, new smbd processes will be continually spawned. The auto-refresh facility will allow you to track the changing conditions with minimal effort.

    Lastly, the Status page may be used to terminate specific smbd client connections in order to free files that may be locked. -

    The View Page

    -This page allows the administrator to view the optimised smb.conf file and, if you are +

    The View Page

    +This page allows the administrator to view the optimized smb.conf file and, if you are particularly masochistic, will permit you also to see all possible global configuration parameters and their settings. -

    The Password Change Page

    -The Password Change page is a popular tool. This tool allows the creation, deletion, deactivation -and reactivation of MS Windows networking users on the local machine. Alternatively, you can use +

    The Password Change Page

    +The Password Change page is a popular tool that allows the creation, deletion, deactivation, +and reactivation of MS Windows networking users on the local machine. Alternately, you can use this tool to change a local password for a user account.

    -When logged in as a non-root account the user will have to provide the old password as well as -the new password (twice). When logged in as root only the new password is +When logged in as a non-root account, the user will have to provide the old password as well as +the new password (twice). When logged in as root, only the new password is required.

    One popular use for this tool is to change user passwords across a range of remote MS Windows servers. -

    Troubleshooting

    Table of Contents

    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    34. Analysing and solving samba problems
    Diagnostics tools
    Debugging with Samba itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Chapter 33. The Samba checklist

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Wed Jan 15

    Table of Contents

    Introduction
    Assumptions
    The tests

    Introduction

    +

    Troubleshooting

    Table of Contents

    33. The Samba Checklist
    Introduction
    Assumptions
    The Tests
    34. Analyzing and Solving Samba Problems
    Diagnostics Tools
    Debugging with Samba Itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting Mailing List Help
    How to Get Off the Mailing Lists
    35. Reporting Bugs
    Introduction
    General Information
    Debug Levels
    Internal Errors
    Attaching to a Running Process
    Patches

    Chapter 33. The Samba Checklist

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Dan Shearer

    Samba Team

    Wed Jan 15

    Table of Contents

    Introduction
    Assumptions
    The Tests

    Introduction

    This file contains a list of tests you can perform to validate your Samba server. It also tells you what the likely cause of the problem -is if it fails any one of these steps. If it passes all these tests +is if it fails any one of these steps. If it passes all these tests, then it is probably working fine.

    -You should do ALL the tests, in the order shown. We have tried to +You should do all the tests, in the order shown. We have tried to carefully choose them so later tests only use capabilities verified in -the earlier tests. However, do not stop at the first error as there +the earlier tests. However, do not stop at the first error as there have been some instances when continuing with the tests has helped to solve a problem.

    -If you send one of the samba mailing lists an email saying "it doesn't work" -and you have not followed this test procedure then you should not be surprised +If you send one of the Samba mailing lists an email saying, “it does not work” +and you have not followed this test procedure, you should not be surprised if your email is ignored. -

    Assumptions

    -In all of the tests it is assumed you have a Samba server called +

    Assumptions

    +In all of the tests, it is assumed you have a Samba server called BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP.

    The procedure is similar for other types of clients.

    It is also assumed you know the name of an available share in your -smb.conf. I will assume this share is called tmp. -You can add a tmp share like this by adding the -following to smb.conf: -

    Example 33.1. smb.conf with [tmp] share

    [tmp]
    comment = temporary files
    path = /tmp
    read only = yes

    +smb.conf. I will assume this share is called tmp. +You can add a tmp share like this by adding the +lines shown in . +

    Example 33.1. smb.conf with [tmp] share

    [tmp]
    comment = temporary files
    path = /tmp
    read only = yes

    Note

    -These tests assume version 3.0 or later of the samba suite. +These tests assume version 3.0.0 or later of the Samba suite. Some commands shown did not exist in earlier versions.

    Please pay attention to the error messages you receive. If any error message -reports that your server is being unfriendly you should first check that your -IP name resolution is correctly set up. eg: Make sure your /etc/resolv.conf +reports that your server is being unfriendly, you should first check that your +IP name resolution is correctly set up. Make sure your /etc/resolv.conf file points to name servers that really do exist.

    -Also, if you do not have DNS server access for name resolution please check +Also, if you do not have DNS server access for name resolution, please check that the settings for your smb.conf file results in dns proxy = no. The -best way to check this is with testparm smb.conf. -

    +best way to check this is with testparm smb.conf. +

    + It is helpful to monitor the log files during testing by using the -tail -F log_file_name in a separate +tail -F log_file_name in a separate terminal console (use ctrl-alt-F1 through F6 or multiple terminals in X). Relevant log files can be found (for default installations) in -/usr/local/samba/var. Also, connection logs from -machines can be found here or possibly in /var/log/samba +/usr/local/samba/var. Also, connection logs from +machines can be found here or possibly in /var/log/samba, depending on how or if you specified logging in your smb.conf file.

    If you make changes to your smb.conf file while going through these test, -don't forget to restart smbd and nmbd. -

    The tests

    Procedure 33.1. Diagnosing your samba server

    1. +remember to restart smbd and nmbd. +

    The Tests

    Procedure 33.1. Diagnosing your Samba server

    1. + In the directory in which you store your smb.conf file, run the command -testparm smb.conf. If it reports any errors then your smb.conf +testparm smb.conf. If it reports any errors, then your smb.conf configuration file is faulty.

      Note

      Your smb.conf file may be located in: /etc/samba -Or in: /usr/local/samba/lib +or in /usr/local/samba/lib.

    2. -Run the command ping BIGSERVER from the PC and -ping ACLIENT from -the unix box. If you don't get a valid response then your TCP/IP -software is not correctly installed. +Run the command ping BIGSERVER from the PC and +ping ACLIENT from the UNIX box. If you do not get a valid response, +then your TCP/IP software is not correctly installed.

      -Note that you will need to start a "dos prompt" window on the PC to -run ping. +You will need to start a “dos prompt” window on the PC to run ping.

      -If you get a message saying host not found or similar then your DNS +If you get a message saying “host not found” or similar, then your DNS software or /etc/hosts file is not correctly setup. -It is possible to -run samba without DNS entries for the server and client, but I assume +It is possible to run Samba without DNS entries for the server and client, but it is assumed you do have correct entries for the remainder of these tests.

      Another reason why ping might fail is if your host is running firewall software. You will need to relax the rules to let in the workstation in question, perhaps by allowing access from another subnet (on Linux -this is done via the ipfwadm program.) +this is done via the appropriate firewall maintenance commands ipchains +or iptables).

      Note

      Modern Linux distributions install ipchains/iptables by default. This is a common problem that is often overlooked. -

    3. -Run the command smbclient -L BIGSERVER on the unix box. You -should get a list of available shares back. -

      -If you get a error message containing the string "Bad password" then -you probably have either an incorrect hosts allow, -hosts deny or valid users line in your -smb.conf, or your guest account is not -valid. Check what your guest account is using testparm and -temporarily remove any hosts allow, hosts deny, valid users or invalid users lines. -

      -If you get a connection refused response then the smbd server may -not be running. If you installed it in inetd.conf then you probably edited -that file incorrectly. If you installed it as a daemon then check that +

    +If you wish to check what firewall rules may be present in a system under test, simply run +iptables -L -v or if ipchains-based firewall rules are in use, +ipchains -L -v. +

    +Here is a sample listing from a system that has an external ethernet interface (eth1) on which Samba +is not active, and an internal (private network) interface (eth0) on which Samba is active: +

    +frodo:~ # iptables -L -v
+Chain INPUT (policy DROP 98496 packets, 12M bytes)
+ pkts bytes target     prot opt in     out     source     destination
+ 187K  109M ACCEPT     all  --  lo     any     anywhere   anywhere
+ 892K  125M ACCEPT     all  --  eth0   any     anywhere   anywhere
+1399K 1380M ACCEPT     all  --  eth1   any     anywhere   anywhere  \
+					state RELATED,ESTABLISHED
+
+Chain FORWARD (policy DROP 0 packets, 0 bytes)
+ pkts bytes target     prot opt in     out     source     destination
+ 978K 1177M ACCEPT     all  --  eth1   eth0    anywhere   anywhere \
+					state RELATED,ESTABLISHED
+ 658K   40M ACCEPT     all  --  eth0   eth1    anywhere   anywhere
+    0     0 LOG        all  --  any    any     anywhere   anywhere \
+					LOG level warning
+
+Chain OUTPUT (policy ACCEPT 2875K packets, 1508M bytes)
+ pkts bytes target     prot opt in     out     source     destination
+
+Chain reject_func (0 references)
+ pkts bytes target     prot opt in     out     source     destinat
+

    +

  • +Run the command: smbclient -L BIGSERVER +on the UNIX box. You should get back a list of available shares. +

    +If you get an error message containing the string “Bad password”, then +you probably have either an incorrect hosts allow, +hosts deny or valid users line in your +smb.conf, or your guest account is not valid. Check what your guest account is using testparm and +temporarily remove any hosts allow, hosts deny, +valid users or invalid users lines. +

    +If you get a message “connection refused” response, then the smbd server may +not be running. If you installed it in inetd.conf, then you probably edited +that file incorrectly. If you installed it as a daemon, then check that it is running, and check that the netbios-ssn port is in a LISTEN -state using netstat -a. +state using netstat -a.

    Note

    - - -Some Unix / Linux systems use xinetd in place of + + +Some UNIX/Linux systems use xinetd in place of inetd. Check your system documentation for the location -of the control file/s for your particular system implementation of -this network super daemon. +of the control files for your particular system implementation of +the network super daemon.

    -If you get a session request failed then the server refused the -connection. If it says "Your server software is being unfriendly" then -its probably because you have invalid command line parameters to smbd, +If you get a message saying “session request failed”, the server refused the +connection. If it says “Your server software is being unfriendly”, then +it's probably because you have invalid command line parameters to smbd, or a similar fatal problem with the initial startup of smbd. Also check your config file (smb.conf) for syntax errors with testparm -and that the various directories where samba keeps its log and lock +and that the various directories where Samba keeps its log and lock files exist.

    There are a number of reasons for which smbd may refuse or decline a session request. The most common of these involve one or more of -the following smb.conf file entries: -

    hosts deny = ALL
    hosts allow = xxx.xxx.xxx.xxx/yy
    bind interfaces only = Yes

    +the smb.conf file entries as shown in . +

    +

    Example 33.2. Configuration for only allowing connections from a certain subnet

    [globals]
    ...
    hosts deny = ALL
    hosts allow = xxx.xxx.xxx.xxx/yy
    interfaces = eth0
    bind interfaces only = Yes
    ...

    +

    In the above, no allowance has been made for any session requests that will automatically translate to the loopback adapter address 127.0.0.1. -To solve this problem change these lines to: -

    hosts deny = ALL
    hosts allow = xxx.xxx.xxx.xxx/yy 127.

    -Do not use the bind interfaces only parameter where you -may wish to -use the samba password change facility, or where smbclient may need to -access a local service for name resolution or for local resource -connections. (Note: the bind interfaces only parameter deficiency -where it will not allow connections to the loopback address will be -fixed soon). -

    - +To solve this problem, change these lines as shown in . +

    +

    Example 33.3. Configuration for allowing connections from a certain subnet and localhost

    [globals]
    ...
    hosts deny = ALL
    hosts allow = xxx.xxx.xxx.xxx/yy 127.
    interfaces = eth0 lo
    ...

    +

    + Another common cause of these two errors is having something already running -on port 139, such as Samba -(ie: smbd is running from inetd already) or + +on port 139, such as Samba (smbd is running from inetd already) or something like Digital's Pathworks. Check your inetd.conf file before trying -to start smbd as a daemon, it can avoid a lot of frustration! +to start smbd as a daemon it can avoid a lot of frustration!

    And yet another possible cause for failure of this test is when the subnet mask -and / or broadcast address settings are incorrect. Please check that the -network interface IP Address / Broadcast Address / Subnet Mask settings are +and/or broadcast address settings are incorrect. Please check that the +network interface IP Address/Broadcast Address/Subnet Mask settings are correct and that Samba has correctly noted these in the log.nmbd file.

  • -Run the command nmblookup -B BIGSERVER __SAMBA__. You should get the -IP address of your Samba server back. +Run the command: nmblookup -B BIGSERVER __SAMBA__. +You should get back the IP address of your Samba server.

    -If you don't then nmbd is incorrectly installed. Check your inetd.conf -if you run it from there, or that the daemon is running and listening -to udp port 137. +If you do not, then nmbd is incorrectly installed. Check your inetd.conf +if you run it from there, or that the daemon is running and listening to udp port 137.

    One common problem is that many inetd implementations can't take many -parameters on the command line. If this is the case then create a +parameters on the command line. If this is the case, then create a one-line script that contains the right parameters and run that from inetd. -

  • run the command nmblookup -B ACLIENT '*'

    -You should get the PCs IP address back. If you don't then the client +

  • +Run the command: nmblookup -B ACLIENT `*' +

    +You should get the PC's IP address back. If you do not then the client software on the PC isn't installed correctly, or isn't started, or you got the name of the PC wrong.

    -If ACLIENT doesn't resolve via DNS then use the IP address of the +If ACLIENT does not resolve via DNS then use the IP address of the client in the above test.

  • -Run the command nmblookup -d 2 '*' +Run the command: nmblookup -d 2 '*'

    This time we are trying the same as the previous test but are trying it via a broadcast to the default broadcast address. A number of -NetBIOS / TCP/IP hosts on the network should respond, although Samba may +NetBIOS/TCP/IP hosts on the network should respond, although Samba may not catch all of the responses in the short time it listens. You -should see got a positive name query response +should see the “got a positive name query response” messages from several hosts.

    -If this doesn't give a similar result to the previous test then +If this does not give a similar result to the previous test, then nmblookup isn't correctly getting your broadcast address through its automatic mechanism. In this case you should experiment with the -interfaces option in smb.conf to manually configure your IP +interfaces option in smb.conf to manually configure your IP address, broadcast and netmask.

    -If your PC and server aren't on the same subnet then you will need to -use the -B option to set the broadcast address to that of the PCs -subnet. +If your PC and server aren't on the same subnet, then you will need to use the +-B option to set the broadcast address to that of the PCs subnet.

    This test will probably fail if your subnet mask and broadcast address are not correct. (Refer to TEST 3 notes above). -

  • -Run the command smbclient //BIGSERVER/TMP. You should +

  • + +Run the command: smbclient //BIGSERVER/TMP. You should then be prompted for a password. You should use the password of the account -you are logged into the unix box with. If you want to test with -another account then add the -U accountname option to the end of -the command line. eg: -smbclient //bigserver/tmp -Ujohndoe +with which you are logged into the UNIX box. If you want to test with +another account, then add the -U accountname option to the end of +the command line. For example, smbclient //bigserver/tmp -Ujohndoe.

    Note

    -It is possible to specify the password along with the username -as follows: -smbclient //bigserver/tmp -Ujohndoe%secret +It is possible to specify the password along with the username as follows: +smbclient //bigserver/tmp -Ujohndoe%secret.

    -Once you enter the password you should get the smb> prompt. If you -don't then look at the error message. If it says invalid network -name then the service "tmp" is not correctly setup in your smb.conf. +Once you enter the password, you should get the smb> prompt. If you +do not, then look at the error message. If it says “invalid network +name”, then the service tmp is not correctly setup in your smb.conf.

    -If it says bad password then the likely causes are: +If it says “bad password”, then the likely causes are:

    1. - you have shadow passwords (or some other password system) but didn't - compile in support for them in smbd + You have shadow passwords (or some other password system) but didn't + compile in support for them in smbd.

    2. - your valid users configuration is incorrect + Your valid users configuration is incorrect.

    3. - you have a mixed case password and you haven't enabled the password level option at a high enough level + You have a mixed case password and you haven't enabled the password level option at a high enough level.

    4. - the path line in smb.conf is incorrect. Check it with testparm + The path line in smb.conf is incorrect. Check it with testparm.

    5. - you enabled password encryption but didn't map unix to samba users. Run 

      smbpasswd -a username

      . + You enabled password encryption but didn't map UNIX to Samba users. Run: + smbpasswd -a username

    -Once connected you should be able to use the commands -dir get put etc. -Type help command for instructions. You should -especially check that the amount of free disk space shown is correct -when you type dir. +Once connected, you should be able to use the commands dir, get, +put and so on. Type help command for instructions. You should +especially check that the amount of free disk space shown is correct when you type dir.

  • -On the PC, type the command net view \\BIGSERVER. You will -need to do this from within a "dos prompt" window. You should get back a -list of available shares on the server. -

    -If you get a network name not found or similar error then netbios -name resolution is not working. This is usually caused by a problem in -nmbd. To overcome it you could do one of the following (you only need -to choose one of them): +On the PC, type the command net view \\BIGSERVER. You will +need to do this from within a dos prompt window. You should get back a +list of shares available on the server. +

    +If you get a message “network name not found” or similar error, then netbios +name resolution is not working. This is usually caused by a problem in nmbd. +To overcome it, you could do one of the following (you only need to choose one of them):

    1. - fixup the nmbd installation + Fixup the nmbd installation.

    2. - add the IP address of BIGSERVER to the wins server box in the + Add the IP address of BIGSERVER to the wins server box in the advanced TCP/IP setup on the PC.

    3. - enable windows name resolution via DNS in the advanced section of - the TCP/IP setup + Enable Windows name resolution via DNS in the advanced section of the TCP/IP setup.

    4. - add BIGSERVER to your lmhosts file on the PC. + Add BIGSERVER to your lmhosts file on the PC.

    -If you get a invalid network name or bad password error then the -same fixes apply as they did for the smbclient -L test above. In -particular, make sure your hosts allow line is correct (see the man -pages) +If you get a message “invalid network name” or +“bad password error”, then apply the +same fixes as for the smbclient -L test above. In +particular, make sure your hosts allow line is correct (see the man pages).

    Also, do not overlook that fact that when the workstation requests the -connection to the samba server it will attempt to connect using the +connection to the Samba server, it will attempt to connect using the name with which you logged onto your Windows machine. You need to make sure that an account exists on your Samba server with that exact same name and password.

    -If you get specified computer is not receiving requests or similar -it probably means that the host is not contactable via tcp services. -Check to see if the host is running tcp wrappers, and if so add an entry in -the hosts.allow file for your client (or subnet, etc.) +If you get a message “specified computer is not receiving requests” or similar, +it probably means that the host is not contactable via TCP services. +Check to see if the host is running TCP wrappers, and if so add an entry in +the hosts.allow file for your client (or subnet, and so on.)

  • -Run the command net use x: \\BIGSERVER\TMP. You should -be prompted for a password then you should get a command completed -successfully message. If not then your PC software is incorrectly -installed or your smb.conf is incorrect. make sure your hosts allow +Run the command net use x: \\BIGSERVER\TMP. You should +be prompted for a password, then you should get a command completed +successfully message. If not, then your PC software is incorrectly +installed or your smb.conf is incorrect. Make sure your hosts allow and other config lines in smb.conf are correct.

    -It's also possible that the server can't work out what user name to -connect you as. To see if this is the problem add the line user = username to the [tmp] section of -smb.conf where username is the +It's also possible that the server can't work out what user name to connect you as. +To see if this is the problem, add the line +user = username to the +[tmp] section of +smb.conf where username is the username corresponding to the password you typed. If you find this -fixes things you may need the username mapping option. +fixes things, you may need the username mapping option.

    It might also be the case that your client only sends encrypted passwords -and you have encrypt passwords = no in smb.conf -Turn it back on to fix. +and you have encrypt passwords = no in smb.conf. +Change this to "yes" to fix this.

  • -Run the command nmblookup -M testgroup where -testgroup is the name of the workgroup that your Samba server and +Run the command nmblookup -M testgroup where +testgroup is the name of the workgroup that your Samba server and Windows PCs belong to. You should get back the IP address of the master browser for that workgroup.

    -If you don't then the election process has failed. Wait a minute to -see if it is just being slow then try again. If it still fails after -that then look at the browsing options you have set in smb.conf. Make -sure you have preferred master = yes to ensure that +If you do not, then the election process has failed. Wait a minute to +see if it is just being slow, then try again. If it still fails after +that, then look at the browsing options you have set in smb.conf. Make +sure you have preferred master = yes to ensure that an election is held at startup.

  • -From file manager try to browse the server. Your samba server should +>From file manager, try to browse the server. Your Samba server should appear in the browse list of your local workgroup (or the one you specified in smb.conf). You should be able to double click on the name -of the server and get a list of shares. If you get a "invalid -password" error when you do then you are probably running WinNT and it +of the server and get a list of shares. If you get the error message “invalid password”, + you are probably running Windows NT and it is refusing to browse a server that has no encrypted password -capability and is in user level security mode. In this case either set -security = server AND -password server = Windows_NT_Machine in your -smb.conf file, or make sure encrypt passwords is -set to "yes". -

    • Chapter 34. Analysing and solving samba problems

    Gerald (Jerry) Carter

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    David Bannon

    Samba Team

    8 Apr 2003

    Table of Contents

    Diagnostics tools
    Debugging with Samba itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists

    +capability and is in User Level Security mode. In this case, either set +security = server and +password server = Windows_NT_Machine in your +smb.conf file, or make sure encrypt passwords is +set to “yes”. +

    Chapter 34. Analyzing and Solving Samba Problems

    Gerald (Jerry) Carter

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    David Bannon

    Samba Team

    Dan Shearer

    Samba Team

    8 Apr 2003

    Table of Contents

    Diagnostics Tools
    Debugging with Samba Itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting Mailing List Help
    How to Get Off the Mailing Lists

    There are many sources of information available in the form -of mailing lists, RFC's and documentation. The docs that come -with the samba distribution contain very good explanations of -general SMB topics such as browsing.

    Diagnostics tools

    With SMB networking, it is often not immediately clear what +of mailing lists, RFCs and documentation. The documentation that comes +with the Samba distribution contains good explanations of +general SMB topics such as browsing.

    Diagnostics Tools

    With SMB networking, it is often not immediately clear what the cause is of a certain problem. Samba itself provides rather useful information, but in some cases you might have to fall back to using a sniffer. A sniffer is a program that -listens on your LAN, analyses the data sent on it and displays it -on the screen.

    Debugging with Samba itself

    -One of the best diagnostic tools for debugging problems is Samba itself. -You can use the -d option for both smbd and nmbd to specify what -debug level at which to run. See the man pages on smbd, nmbd and -smb.conf for more information on debugging options. The debug +listens on your LAN, analyzes the data sent on it and displays it +on the screen.

    Debugging with Samba Itself

    +One of the best diagnostic tools for debugging problems is Samba itself. +You can use the -d option for both smbd and nmbd to specify the +debug level at which to run. +See the man pages for smbd, nmbd and +smb.conf for more information regarding debugging options. The debug level can range from 1 (the default) to 10 (100 for debugging passwords).

    -Another helpful method of debugging is to compile samba using the -gcc -g flag. This will include debug -information in the binaries and allow you to attach gdb to the -running smbd / nmbd process. In order to attach gdb to an smbd +Another helpful method of debugging is to compile Samba using the +gcc -g flag. This will include debug information in the binaries and +allow you to attach gdb to the running smbd/nmbd process. +To attach gdb to an smbd process for an NT workstation, first get the workstation to make the connection. Pressing ctrl-alt-delete and going down to the domain box -is sufficient (at least, on the first time you join the domain) to -generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation -maintains an open connection, and therefore there will be an smbd +is sufficient (at least, the first time you join the domain) to +generate a LsaEnumTrustedDomains. Thereafter, the workstation +maintains an open connection and there will be an smbd process running (assuming that you haven't set a really short smbd -idle timeout) So, in between pressing ctrl alt delete, and actually -typing in your password, you can attach gdb and continue. +idle timeout). So, in between pressing ctrl-alt-delete and actually +typing in your password, you can attach gdb and continue.

    -Some useful samba commands worth investigating: +Some useful Samba commands worth investigating are: 

     $ testparm | more
 $ smbclient -L //{netbios name of server}
-

    Tcpdump

    Tcpdump was the first -unix sniffer with SMB support. It is a command-line utility and -nowadays, it's SMB support is somewhat less then that of ethereal -and tethereal.

    Ethereal

    -Ethereal is a graphical -sniffer, available for both unix (Gtk) and Windows. Ethereal's -SMB support is very good.

    For details on the use of ethereal, read the well-written -ethereal User Guide.

    -Listen for data on ports 137, 138, 139 and 445. E.g. -use the filter port 137 or port 138 or port 139 or port 445.

    A console version of ethereal is available as well and is called -tethereal.

    The Windows Network Monitor

    -For tracing things on the Microsoft Windows NT, Network Monitor -(aka. netmon) is available on the Microsoft Developer Network CD's, -the Windows NT Server install CD and the SMS CD's. The version of -netmon that ships with SMS allows for dumping packets between any two -computers (i.e. placing the network interface in promiscuous mode). +

    Tcpdump

    +Tcpdump was the first +UNIX sniffer with SMB support. It is a command-line utility and +now, its SMB support is somewhat lagging that of ethereal +and tethereal. +

    Ethereal

    +Ethereal is a graphical +sniffer, available for both UNIX (Gtk) and Windows. Ethereal's +SMB support is quite good.

    For details on the use of ethereal, read the well-written +Ethereal User Guide.

    Figure 34.1. Starting a capture.

    Starting a capture.

    +Listen for data on ports 137, 138, 139, and 445. For example, use the filter port 137, port 138, port 139, or port 445 as seen in .

    A console version of ethereal is available as well and is called +tethereal.

    Figure 34.2. Main ethereal data window.

    Main ethereal data window.

    The Windows Network Monitor

    +For tracing things on Microsoft Windows NT, Network Monitor +(aka Netmon) is available on Microsoft Developer Network CDs, +the Windows NT Server install CD and the SMS CDs. The version of +Netmon that ships with SMS allows for dumping packets between any two +computers (i.e., placing the network interface in promiscuous mode). The version on the NT Server install CD will only allow monitoring of network traffic directed to the local NT box and broadcasts on the -local subnet. Be aware that Ethereal can read and write netmon +local subnet. Be aware that Ethereal can read and write Netmon formatted files. -

    Installing 'Network Monitor' on an NT Workstation

    -Installing netmon on an NT workstation requires a couple -of steps. The following are for installing Netmon V4.00.349, which comes +

    Installing Network Monitor on an NT Workstation

    +Installing Netmon on an NT workstation requires a couple +of steps. The following are instructions for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 4.0, on Microsoft Windows NT -Workstation 4.0. The process should be similar for other versions of -Windows NT / Netmon. You will need both the Microsoft Windows +Workstation 4.0. The process should be similar for other versions of +Windows NT version of Netmon. You will need both the Microsoft Windows NT Server 4.0 Install CD and the Workstation 4.0 Install CD.

    Initially you will need to install Network Monitor Tools and Agent -on the NT Server. To do this -

    • Goto Start - Settings - Control Panel - - Network - Services - Add

    • Select the Network Monitor Tools and Agent and - click on OK.

    • Click OK on the Network Control Panel. -

    • Insert the Windows NT Server 4.0 install CD - when prompted.

    -At this point the Netmon files should exist in -%SYSTEMROOT%\System32\netmon\*.*. -Two subdirectories exist as well, parsers\ -which contains the necessary DLL's for parsing the netmon packet -dump, and captures\. -

    -In order to install the Netmon tools on an NT Workstation, you will -first need to install the 'Network Monitor Agent' from the Workstation -install CD. -

    • Goto Start - Settings - Control Panel - - Network - Services - Add

    • Select the Network Monitor Agent and click - on OK.

    • Click OK on the Network Control Panel. -

    • Insert the Windows NT Workstation 4.0 install - CD when prompted.

    -Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* -to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set -permissions as you deem appropriate for your site. You will need -administrative rights on the NT box to run netmon. -

    Installing 'Network Monitor' on an 9x Workstation

    -To install Netmon on a Windows 9x box install the network monitor agent -from the Windows 9x CD (\admin\nettools\netmon). There is a readme -file located with the netmon driver files on the CD if you need -information on how to do this. Copy the files from a working -Netmon installation. -

    Useful URLs

    Getting help from the mailing lists

    -There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror -and then click on Support and then click on -Samba related mailing lists. -

    -For questions relating to Samba TNG go to -http://www.samba-tng.org/ -It has been requested that you don't post questions about Samba-TNG to the -main stream Samba lists.

    -If you post a message to one of the lists please observe the following guide lines : -

    • Always remember that the developers are volunteers, they are -not paid and they never guarantee to produce a particular feature at -a particular time. Any time lines are 'best guess' and nothing more. -

    • Always mention what version of samba you are using and what -operating system its running under. You should probably list the -relevant sections of your smb.conf file, at least the options -in [global] that affect PDC support.

    • In addition to the version, if you obtained Samba via -CVS mention the date when you last checked it out.

    • Try and make your question clear and brief, lots of long, -convoluted questions get deleted before they are completely read ! -Don't post html encoded messages (if you can select colour or font -size its html).

    • If you run one of those nifty 'I'm on holidays' things when -you are away, make sure its configured to not answer mailing lists. -

    • Don't cross post. Work out which is the best list to post to -and see what happens, i.e. don't post to both samba-ntdom and samba-technical. -Many people active on the lists subscribe to more -than one list and get annoyed to see the same message two or more times. -Often someone will see a message and thinking it would be better dealt -with on another, will forward it on for you.

    • You might include partial -log files written at a debug level set to as much as 20. -Please don't send the entire log but enough to give the context of the -error messages.

    • (Possibly) If you have a complete netmon trace ( from the opening of -the pipe to the error ) you can send the *.CAP file as well.

    • Please think carefully before attaching a document to an email. -Consider pasting the relevant parts into the body of the message. The samba -mailing lists go to a huge number of people, do they all need a copy of your -smb.conf in their attach directory?

    How to get off the mailing lists

    To have your name removed from a samba mailing list, go to the -same place you went to to get on it. Go to http://lists.samba.org, -click on your nearest mirror and then click on Support and -then click on Samba related mailing lists. -

    -Please don't post messages to the list asking to be removed, you will just -be referred to the above address (unless that process failed in some way...) -

    Chapter 35. Reporting Bugs

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    27 June 1997

    Table of Contents

    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Introduction

    Please report bugs using - bugzilla.

    -Please take the time to read this file before you submit a bug -report. Also, please see if it has changed between releases, as we -may be changing the bug reporting mechanism at some time. -

    -Please also do as much as you can yourself to help track down the +on the NT Server to do this: +

    • Go to Start -> Settings -> Control Panel -> + Network -> Services -> Add.

    • Select the Network Monitor Tools and Agent and click on OK.

    • Click on OK on the Network Control Panel.

    • Insert the Windows NT Server 4.0 install CD when prompted.

    +At this point, the Netmon files should exist in %SYSTEMROOT%\System32\netmon\*.*. +Two subdirectories exist as well, parsers\ which contains the necessary DLLs +for parsing the Netmon packet dump, and captures\. +

    +To install the Netmon tools on an NT Workstation, you will first need to install the +Network Monitor Agent from the Workstation install CD. +

    • Go to Start -> Settings -> Control Panel -> + Network -> Services -> Add.

    • Select the Network Monitor Agent, click on OK.

    • Click on OK in the Network Control Panel. +

    • Insert the Windows NT Workstation 4.0 install CD when prompted.

    +Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon +to %SYSTEMROOT%\System32\netmon on the Workstation and set permissions +as you deem appropriate for your site. You will need administrative rights on the NT box to run Netmon. +

    Installing Network Monitor on Windows 9x/Me

    +To install Netmon on Windows 9x/Me, install the Network Monitor Agent +from the Windows 9x/Me CD (\admin\nettools\netmon). +There is a readme file located with the Netmon driver files on the CD if you need +information on how to do this. Copy the files from a working Netmon installation. +

    Useful URLs

    • See how Scott Merrill simulates a BDC behavior at + + http://www.skippy.net/linux/smb-howto.html.

    • FTP site for older SMB specs: + + ftp://ftp.microsoft.com/developr/drg/CIFS/

    Getting Mailing List Help

    +There are a number of Samba-related mailing lists. Go to http://samba.org, click on your nearest mirror +and then click on Support and next click on +Samba-related mailing lists. +

    +For questions relating to Samba TNG, go to +http://www.samba-tng.org/. +It has been requested that you do not post questions about Samba-TNG to the +main-stream Samba lists.

    +If you do post a message to one of the lists, please observe the following guidelines : +

    • Always remember that the developers are volunteers, they are + not paid and they never guarantee to produce a particular feature at + a particular time. Any timelines are “best guess” and nothing more. +

    • Always mention what version of Samba you are using and what + operating system it's running under. You should list the relevant sections of + your smb.conf file, at least the options in [global] + that affect PDC support. +

    • In addition to the version, if you obtained Samba via + CVS, mention the date when you last checked it out.

    • Try and make your questions clear and brief. Lots of long, + convoluted questions get deleted before they are completely read! + Do not post HTML encoded messages. Most people on mailing lists simply delete + them. +

    • If you run one of those nifty “I'm on holidays” things when + you are away, make sure its configured to not answer mailing list traffic. Auto-responses + to mailing lists really irritate the thousands of people who end up having to deal + with such bad netiquet bahavior. +

    • Don't cross post. Work out which is the best list to post to + and see what happens. Do not post to both samba-ntdom and samba-technical. + Many people active on the lists subscribe to more + than one list and get annoyed to see the same message two or more times. + Often someone will see a message and thinking it would be better dealt + with on another list, will forward it on for you.

    • You might include partial + log files written at a debug level set to as much as 20. + Please do not send the entire log but just enough to give the context of the + error messages.

    • If you have a complete Netmon trace (from the opening of + the pipe to the error), you can send the *.CAP file as well.

    • Please think carefully before attaching a document to an email. + Consider pasting the relevant parts into the body of the message. The Samba + mailing lists go to a huge number of people. Do they all need a copy of your + smb.conf in their attach directory?

    How to Get Off the Mailing Lists

    To have your name removed from a Samba mailing list, go to the same +place where you went to +subscribe to it. Go to http://lists.samba.org, +click on your nearest mirror, click on Support and +then click on Samba related mailing lists. +

    +Please do not post messages to the list asking to be removed. You will only +be referred to the above address (unless that process failed in some way). +

    Chapter 35. Reporting Bugs

    John H. Terpstra

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    27 June 1997

    Table of Contents

    Introduction
    General Information
    Debug Levels
    Internal Errors
    Attaching to a Running Process
    Patches

    Introduction

    Please report bugs using Samba's +Bugzilla facilities and +take the time to read this file before you submit a bug +report. Also, check to see if it has changed between releases, as we +may be changing the bug reporting mechanism at some point. +

    +Please do as much as you can yourself to help track down the bug. Samba is maintained by a dedicated group of people who volunteer -their time, skills and efforts. We receive far more mail about it than -we can possibly answer, so you have a much higher chance of an answer -and a fix if you send us a "developer friendly" bug report that lets +their time, skills and efforts. We receive far more mail than +we can possibly answer, so you have a much higher chance of a response +and a fix if you send us a “developer friendly” bug report that lets us fix it fast.

    Do not assume that if you post the bug to the comp.protocols.smb newsgroup or the mailing list that we will read it. If you suspect that your -problem is not a bug but a configuration problem then it is better to send -it to the Samba mailing list, as there are (at last count) 5000 other users on -that list that may be able to help you. +problem is not a bug but a configuration problem, it is better to send +it to the Samba mailing list, as there are thousands of other users on +that list who may be able to help you.

    You may also like to look though the recent mailing list archives, -which are conveniently accessible on the Samba web pages -at http://samba.org/samba/. -

    General info

    -Before submitting a bug report check your config for silly -errors. Look in your log files for obvious messages that tell you that -you've misconfigured something and run testparm to test your config +which are conveniently accessible on the Samba Web pages +at http://samba.org/samba/. +

    General Information

    +Before submitting a bug report, check your config for silly +errors. Look in your log files for obvious messages that tell +you've misconfigured something. Run testparm to check your config file for correct syntax.

    -Have you run through the diagnosis? -This is very important. + Have you looked through ? This is extremely important.

    -If you include part of a log file with your bug report then be sure to +If you include part of a log file with your bug report, then be sure to annotate it with exactly what you were doing on the client at the -time, and exactly what the results were. -

    Debug levels

    +time and exactly what the results were. +

    Debug Levels

    If the bug has anything to do with Samba behaving incorrectly as a -server (like refusing to open a file) then the log files will probably -be very useful. Depending on the problem a log level of between 3 and +server (like refusing to open a file), then the log files will probably +be quite useful. Depending on the problem, a log level of between 3 and 10 showing the problem may be appropriate. A higher level gives more detail, but may use too much disk space.

    -To set the debug level use the log level in your +To set the debug level, use the log level in your smb.conf. You may also find it useful to set the log level higher for just one machine and keep separate logs for each machine. -To do this add the following lines to your main smb.conf file: +To do this, add the following lines to your main smb.conf file:

    log level = 10
    log file = /usr/local/samba/lib/log.%m
    include = /usr/local/samba/lib/smb.conf.%m

    -then create a file -/usr/local/samba/lib/smb.conf.machine where +and create a file /usr/local/samba/lib/smb.conf.machine where machine is the name of the client you wish to debug. In that file put any smb.conf commands you want, for example -log level may be useful. This also allows you to -experiment with different security systems, protocol levels etc on just +log level may be useful. This also allows you to +experiment with different security systems, protocol levels and so on, on just one machine.

    -The smb.conf entry log level -is synonymous with the parameter debuglevel that has -been used in older versions of Samba and is being retained for backwards +The smb.conf entry log level +is synonymous with the parameter debuglevel that has +been used in older versions of Samba and is being retained for backward compatibility of smb.conf files.

    -As the log level value is increased you will record -a significantly increasing level of debugging information. For most -debugging operations you may not need a setting higher than +As the log level value is increased, you will record +a significantly greater level of debugging information. For most +debugging operations, you may not need a setting higher than 3. Nearly all bugs can be tracked at a setting of 10, but be -prepared for a VERY large volume of log data. -

    Internal errors

    -If you get a INTERNAL ERROR message in your log files +prepared for a large volume of log data. +

    Internal Errors

    +If you get the message “INTERNAL ERROR” in your log files, it means that Samba got an unexpected signal while running. It is probably a segmentation fault and almost certainly means a bug in Samba (unless you have faulty hardware or system software).

    -If the message came from smbd then it will probably be accompanied by -a message which details the last SMB message received by smbd. This -info is often very useful in tracking down the problem so please +If the message came from smbd, it will probably be accompanied by +a message that details the last SMB message received by smbd. This +information is often useful in tracking down the problem so please include it in your bug report.

    You should also detail how to reproduce the problem, if possible. Please make this reasonably detailed. -

    +

    + You may also find that a core file appeared in a corefiles -subdirectory of the directory where you keep your samba log +subdirectory of the directory where you keep your Samba log files. This file is the most useful tool for tracking down the bug. To -use it you do this: -

    +use it, you do this:
+
+
+
     $ gdb smbd core
 
    
 adding appropriate paths to smbd and core so gdb can find them. If you
-don't have gdb then try dbx. Then within the debugger
+do not have gdb, try dbx. Then within the debugger,
 use the command where to give a stack trace of where the
 problem occurred. Include this in your report.
 
    
-If you know any assembly language then do a 
-disass of the routine
-where the problem occurred (if its in a library routine then
+If you know any assembly language, do a disass of the routine
+where the problem occurred (if its in a library routine, then
 disassemble the routine that called it) and try to work out exactly
 where the problem is by looking at the surrounding code. Even if you
-don't know assembly, including this info in the bug report can be
+do not know assembly, including this information in the bug report can be
 useful. 
-

    Attaching to a running process

    -Unfortunately some unixes (in particular some recent linux kernels) +

    Attaching to a Running Process

    +Unfortunately, some UNIXes (in particular some recent Linux kernels) refuse to dump a core file if the task has changed uid (which smbd -does often). To debug with this sort of system you could try to attach +does often). To debug with this sort of system, you could try to attach to the running process using gdb smbd PID where you get PID from smbstatus. Then use c to continue and try to cause the core dump using the client. The debugger should catch the fault and tell you where it occurred. -

    Patches

    +

    Patches

    + + The best sort of bug report is one that includes a fix! If you send us -patches please use diff -u format if your version of +patches, please use diff -u format if your version of diff supports it, otherwise use diff -c4. Make sure you do the diff against a clean version of the source and let me know exactly what version you used. -

    Appendixes

    Table of Contents

    36. How to compile Samba
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    37. Portability
    HPUX
    SCO UNIX
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    Configuring OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba
    Configuring OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba
    Printer driver download for for OS/2 clients?
    Windows for Workgroups
    Latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configuring WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft

    Chapter 36. How to compile Samba

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    22 May 2001

    18 March 2003

    Table of Contents

    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon

    -You can obtain the samba source from the -samba website. To obtain a development version, -you can download samba from CVS or using rsync. -

    Access Samba source code via CVS

    Introduction

    -Samba is developed in an open environment. Developers use CVS -(Concurrent Versioning System) to "checkin" (also known as -"commit") new source code. Samba's various CVS branches can +

    Appendixes

    Table of Contents

    36. How to Compile Samba
    Access Samba Source Code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the Samba Sources via rsync and ftp
    Verifying Samba's PGP Signature
    Building the Binaries
    Compiling Samba with Active Directory Support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: Starting smbd as a Daemon
    37. Portability
    HPUX
    SCO UNIX
    DNIX
    Red Hat Linux
    AIX
    Sequential Read Ahead
    Solaris
    Locking Improvements
    Winbind on Solaris 9
    38. Samba and Other CIFS Clients
    Macintosh Clients
    OS2 Client
    Configuring OS/2 Warp Connect or OS/2 Warp 4
    Configuring Other Versions of OS/2
    Printer Driver Download for OS/2 Clients
    Windows for Workgroups
    Latest TCP/IP Stack from Microsoft
    Delete .pwl Files After Password Change
    Configuring Windows for Workgroups Password Handling
    Password Case Sensitivity
    Use TCP/IP as Default Protocol
    Speed Improvement
    Windows 95/98
    Speed Improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket Options
    Read Size
    Max Xmit
    Log Level
    Read Raw
    Write Raw
    Slow Logins
    Client Tuning
    Samba Performance Problem Due to Changing Linux Kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft

    Chapter 36. How to Compile Samba

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Andrew Tridgell

    Samba Team

    22 May 2001

    18 March 2003

    Table of Contents

    Access Samba Source Code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the Samba Sources via rsync and ftp
    Verifying Samba's PGP Signature
    Building the Binaries
    Compiling Samba with Active Directory Support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: Starting smbd as a Daemon

    +You can obtain the Samba source from the +Samba Website. To obtain a development version, +you can download Samba from CVS or using rsync. +

    Access Samba Source Code via CVS

    Introduction

    + +Samba is developed in an open environment. Developers use +Concurrent Versioning System (CVS) to “checkin” (also known as +“commit”) new source code. Samba's various CVS branches can be accessed via anonymous CVS using the instructions detailed in this chapter.

    This chapter is a modified version of the instructions found at -http://samba.org/samba/cvs.html -

    CVS Access to samba.org

    +http://samba.org/samba/cvs.html +

    CVS Access to samba.org

    The machine samba.org runs a publicly accessible CVS repository for access to the source code of several packages, -including samba, rsync, distcc, ccache and jitterbug. There are two main ways -of accessing the CVS server on this host. -

    Access via CVSweb

    -You can access the source code via your -favourite WWW browser. This allows you to access the contents of -individual files in the repository and also to look at the revision +including Samba, rsync, distcc, ccache, and jitterbug. There are two main ways +of accessing the CVS server on this host: +

    Access via CVSweb

    + +You can access the source code via your favorite WWW browser. This allows you to access +the contents of individual files in the repository and also to look at the revision history and commit logs of individual files. You can also ask for a diff listing between any two versions on the repository.

    -Use the URL : http://samba.org/cgi-bin/cvsweb -

    Access via cvs

    +Use the URL: +http://samba.org/cgi-bin/CVSweb +

    Access via CVS

    You can also access the source code via a -normal cvs client. This gives you much more control over what you can +normal CVS client. This gives you much more control over what you can do with the repository and allows you to checkout whole source trees -and keep them up to date via normal cvs commands. This is the +and keep them up-to-date via normal CVS commands. This is the preferred method of access if you are a developer and not just a casual browser.

    -To download the latest cvs source code, point your +To download the latest CVS source code, point your browser at the URL : -http://www.cyclic.com/. -and click on the 'How to get cvs' link. CVS is free software under -the GNU GPL (as is Samba). Note that there are several graphical CVS clients -which provide a graphical interface to the sometimes mundane CVS commands. -Links to theses clients are also available from the Cyclic website. +http://www.cyclic.com/. +and click on the “How to get CVS” link. CVS is free software under +the GNU GPL (as is Samba). Note that there are several graphical CVS clients +that provide a graphical interface to the sometimes mundane CVS commands. +Links to theses clients are also available from the Cyclic Web site.

    -To gain access via anonymous cvs use the following steps. +To gain access via anonymous CVS, use the following steps. For this example it is assumed that you want a copy of the -samba source code. For the other source code repositories -on this system just substitute the correct package name -

    Procedure 36.1. Retrieving samba using CVS

    1. - Install a recent copy of cvs. All you really need is a - copy of the cvs client binary. +Samba source code. For the other source code repositories +on this system just substitute the correct package name. +

      Procedure 36.1. Retrieving Samba using CVS

      1. + Install a recent copy of CVS. All you really need is a + copy of the CVS client binary.

      2. - Run the command + Run the command:

        cvs -d :pserver:cvs@samba.org:/cvsroot login

      3. - When it asks you for a password type cvs. + When it asks you for a password, type cvs.

      4. Run the command

        - cvs -d :pserver:cvs@samba.org:/cvsroot co samba + cvs -d :pserver:CVS@samba.org:/cvsroot co samba.

        - This will create a directory called samba containing the - latest samba source code (i.e. the HEAD tagged cvs branch). This + This will create a directory called samba containing the + latest Samba source code (i.e., the HEAD tagged CVS branch). This currently corresponds to the 3.0 development tree.

        CVS branches other then HEAD can be obtained by using the - -r and defining a tag name. A list of branch tag names - can be found on the "Development" page of the samba web site. A common - request is to obtain the latest 3.0 release code. This could be done by + -r and defining a tag name. A list of branch tag names + can be found on the “Development” page of the Samba Web site. A common + request is to obtain the latest 3.0 release code. This could be done by using the following command:

        - cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_3_0 samba + cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_3_0 samba.

      5. - Whenever you want to merge in the latest code changes use - the following command from within the samba directory: + Whenever you want to merge in the latest code changes, use + the following command from within the Samba directory:

        cvs update -d -P -

    Accessing the samba sources via rsync and ftp

    - pserver.samba.org also exports unpacked copies of most parts of the CVS - tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at - rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. - See the rsync homepage for more info on rsync. +

    Accessing the Samba Sources via rsync and ftp

    + + + pserver.samba.org also exports unpacked copies of most parts of the CVS + tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at + rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. + See the rsync homepage for more info on rsync.

    The disadvantage of the unpacked trees is that they do not support automatic - merging of local changes like CVS does. rsync access is most convenient - for an initial install. -

    Verifying Samba's PGP signature

    -In these days of insecurity, it's strongly recommended that you verify the PGP -signature for any source file before installing it. Even if you're not -downloading from a mirror site, verifying PGP signatures should be a -standard reflex. + merging of local changes like CVS does. rsync access is most convenient + for an initial install. +

    Verifying Samba's PGP Signature

    + +It is strongly recommended that you verify the PGP signature for any source file before +installing it. Even if you're not downloading from a mirror site, verifying PGP signatures +should be a standard reflex. Many people today use the GNU GPG toolset in place of PGP. +GPG can substitute for PGP.

    With that said, go ahead and download the following files: 

     $ wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc
 $ wget http://us1.samba.org/samba/ftp/samba-pubkey.asc

    - + The first file is the PGP signature for the Samba source file; the other is the Samba public PGP key itself. Import the public PGP key with: 

     $ gpg --import samba-pubkey.asc

    -And verify the Samba source code integrity with: +and verify the Samba source code integrity with: 

     $ gzip -d samba-2.2.8a.tar.gz
 $ gpg --verify samba-2.2.8a.tar.asc

    -If you receive a message like, "Good signature from Samba Distribution -Verification Key..." +If you receive a message like, “Good signature from Samba Distribution Verification Key...” then all is well. The warnings about trust relationships can be ignored. An example of what you would not want to see would be: -

    - - gpg: BAD signature from "Samba Distribution Verification Key" - -

    Building the Binaries

    - To do this, first run the program ./configure +

    +     gpg: BAD signature from “Samba Distribution Verification Key”
+

    Building the Binaries

    + + To build the binaries, first run the program ./configure in the source directory. This should automatically configure Samba for your operating system. If you have unusual - needs then you may wish to run

    root# ./configure --help
-

    first to see what special options you can enable. - Then executing

    root# make

    will create the binaries. Once it's successfully - compiled you can use 

    root# make install

    to install the binaries and manual pages. You can + needs, then you may wish to run

    root# ./configure --help
+

    first to see what special options you can enable. Now execute ./configure with any arguments it might need:

    root# ./configure [... arguments ...]

    Executing

    + + 

    root# make

    will create the binaries. Once it is successfully + compiled you can use

    root# make install

    to install the binaries and manual pages. You can separately install the binaries and/or man pages using

    root# make installbin

    and

    root# make installman
-

    Note that if you are upgrading for a previous version +

    Note that if you are upgrading from a previous version of Samba you might like to know that the old versions of - the binaries will be renamed with a ".old" extension. You + the binaries will be renamed with an “.old” extension. You can go back to the previous version with

    root# make revert
-

    if you find this version a disaster!

    Compiling samba with Active Directory support

    In order to compile samba with ADS support, you need to have installed - on your system:

    • the MIT kerberos development libraries - (either install from the sources or use a package). The - Heimdal libraries will not work.

    • the OpenLDAP development libraries.

    If your kerberos libraries are in a non-standard location then +

    if you find this version a disaster!

    Compiling Samba with Active Directory Support

    In order to compile Samba with ADS support, you need to have installed + on your system:

    • The MIT or Heimdal kerberos development libraries + (either install from the sources or use a package).

    • The OpenLDAP development libraries.

    If your kerberos libraries are in a non-standard location, then remember to add the configure option - --with-krb5=DIR.

    After you run configure make sure that - include/config.h it generates contains lines like + --with-krb5=DIR.

    After you run configure, make sure that + include/config.h it generates contain lines like this:

     #define HAVE_KRB5 1
 #define HAVE_LDAP 1
-

    If it doesn't then configure did not find your krb5 libraries or - your ldap libraries. Look in config.log to figure - out why and fix it.

    Installing the required packages for Debian

    On Debian you need to install the following packages:

    -

    • libkrb5-dev

    • krb5-user

    -

    Installing the required packages for RedHat

    On RedHat this means you should have at least:

    -

    • krb5-workstation (for kinit)

    • krb5-libs (for linking with)

    • krb5-devel (because you are compiling from source)

    -

    in addition to the standard development environment.

    Note that these are not standard on a RedHat install, and you may need - to get them off CD2.

    Starting the smbd and nmbd

    You must choose to start smbd and nmbd either +

    If it does not, configure did not find your KRB5 libraries or + your LDAP libraries. Look in config.log to figure + out why and fix it.

    Installing the Required Packages for Debian

    On Debian, you need to install the following packages:

    +

    • libkrb5-dev
    • krb5-user

    +

    Installing the Required Packages for Red Hat Linux

    On Red Hat Linux, this means you should have at least:

    +

    • krb5-workstation (for kinit)
    • krb5-libs (for linking with)
    • krb5-devel (because you are compiling from source)

    +

    in addition to the standard development environment.

    If these files are not installed on your system, you should check the installation + CDs to find which has them and install the files using your tool of choice. If in doubt + about what tool to use, refer to the Red Hat Linux documentation.

    SuSE Linux Package Requirements

    SuSE Linux installs Heimdal packages that may be required to allow you to build + binary packages. You should verify that the development libraries have been installed on + your system. +

    SuSE Linux Samba RPMs support Kerberos. Please refer to the documentation for + your SuSE Linux system for information regading SuSE Linux specific configuration. + Additionally, SuSE are very active in the maintenance of Samba packages that provide + the maximum capabilities that are available. You should consider using SuSE provided + packages where they are available. +

    Starting the smbd and nmbd

    + + You must choose to start smbd and nmbd either as daemons or from inetd. Don't try to do both! Either you can put them in inetd.conf and have them started on demand @@ -15405,94 +15644,105 @@ example of what you would not want to see would be: daemons either from the command line or in /etc/rc.local. See the man pages for details on the command line options. Take particular care to read - the bit about what user you need to be in order to start - Samba. In many cases you must be root.

    The main advantage of starting smbd + the bit about what user you need to have to start + Samba. In many cases, you must be root.

    The main advantage of starting smbd and nmbd using the recommended daemon method is that they will respond slightly more quickly to an initial connection - request.

    Starting from inetd.conf

    Note

    The following will be different if + request.

    Starting from inetd.conf

    Note

    The following will be different if you use NIS, NIS+ or LDAP to distribute services maps.

    Look at your /etc/services. - What is defined at port 139/tcp. If nothing is defined - then add a line like this:

    netbios-ssn     139/tcp

    similarly for 137/udp you should have an entry like:

    netbios-ns	137/udp

    Next edit your /etc/inetd.conf - and add two lines something like this:

    +		What is defined at port 139/tcp? If nothing is defined, 
+		then add a line like this:
    netbios-ssn     139/tcp
    Similarly for 137/udp, you should have an entry like:
    netbios-ns	137/udp
    Next, edit your /etc/inetd.conf 
+		and add two lines like this:
     		netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd 
 		netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd 
 		
    The exact syntax of /etc/inetd.conf 
-		varies between unixes. Look at the other entries in inetd.conf 
-		for a guide. 
    Some distributions use xinetd instead of inetd. Consult the 
-		xinetd manual for configuration information.
    Note
    Some unixes already have entries like netbios_ns 
+		varies between UNIXes. Look at the other entries in inetd.conf 
+		for a guide. 
    
+		
+		Some distributions use xinetd instead of inetd. Consult the 
+		xinetd manual for configuration information.
    Note
    Some UNIXes already have entries like netbios_ns 
 		(note the underscore) in /etc/services. 
-		You must either edit /etc/services or
+		You must edit /etc/services or
 		/etc/inetd.conf to make them consistent.
-		
    Note
    On many systems you may need to use the 
-		interfaces option in smb.conf to specify the IP
+		
    Note
    
+		
+				On many systems you may need to use the 
+		interfaces option in smb.conf to specify the IP
 		address and netmask of your interfaces. Run 
 		ifconfig 
-		as root if you don't know what the broadcast is for your
+		as root if you do not know what the broadcast is for your
 		net. nmbd tries to determine it at run 
-		time, but fails on some unixes. 
-		
    Warning
    Many unixes only accept around 5 
+		time, but fails on some UNIXes. 
+		
    Warning
    Many UNIXes only accept around five 
 		parameters on the command line in inetd.conf. 
 		This means you shouldn't use spaces between the options and 
-		arguments, or you should use a script, and start the script 
+		arguments, or you should use a script and start the script 
 		from inetd.
    Restart inetd, perhaps just send 
 			it a HUP. 
     			root# killall -HUP inetd
-		
    Alternative: starting it as a daemon
    To start the server as a daemon you should create 
+

    Alternative: Starting smbd as a Daemon

    + + To start the server as a daemon, you should create a script something like this one, perhaps calling it startsmb.

     		#!/bin/sh
 		/usr/local/samba/bin/smbd -D 
 		/usr/local/samba/bin/nmbd -D 
-

    then make it executable with chmod +

    Make it executable with chmod +x startsmb

    You can then run startsmb by - hand or execute it from /etc/rc.local -

    To kill it send a kill signal to the processes - nmbd and smbd.

    Note

    If you use the SVR4 style init system then + hand or execute it from /etc/rc.local. +

    To kill it, send a kill signal to the processes + nmbd and smbd.

    Note

    If you use the SVR4 style init system, you may like to look at the examples/svr4-startup - script to make Samba fit into that system.

    Chapter 37. Portability

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    HPUX
    SCO UNIX
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9

    Samba works on a wide range of platforms but the interface all the + script to make Samba fit into that system.

    Chapter 37. Portability

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    HPUX
    SCO UNIX
    DNIX
    Red Hat Linux
    AIX
    Sequential Read Ahead
    Solaris
    Locking Improvements
    Winbind on Solaris 9

    Samba works on a wide range of platforms but the interface all the platforms provide is not always compatible. This chapter contains -platform-specific information about compiling and using samba.

    HPUX

    -HP's implementation of supplementary groups is, er, non-standard (for -hysterical reasons). There are two group files, /etc/group and +platform-specific information about compiling and using Samba.

    HPUX

    +HP's implementation of supplementary groups is non-standard (for +historical reasons). There are two group files, /etc/group and /etc/logingroup; the system maps UIDs to numbers using the former, but -initgroups() reads the latter. Most system admins who know the ropes +initgroups() reads the latter. Most system admins who know the ropes symlink /etc/group to /etc/logingroup -(hard link doesn't work for reasons too stupid to go into here). initgroups() will complain if one of the +(hard link does not work for reasons too obtuse to go into here). initgroups() will complain if one of the groups you're in in /etc/logingroup has what it considers to be an invalid ID, which means outside the range [0..UID_MAX], where UID_MAX is (I think) -60000 currently on HP-UX. This precludes -2 and 65534, the usual nobody +60000 currently on HP-UX. This precludes -2 and 65534, the usual nobody GIDs.

    -If you encounter this problem, make sure that the programs that are failing -to initgroups() be run as users not in any groups with GIDs outside the +If you encounter this problem, make sure the programs that are failing +to initgroups() are run as users, not in any groups with GIDs outside the allowed range.

    This is documented in the HP manual pages under setgroups(2) and passwd(4).

    -On HPUX you must use gcc or the HP ANSI compiler. The free compiler -that comes with HP-UX is not ANSI compliant and cannot compile -Samba. -

    SCO UNIX

    -If you run an old version of SCO UNIX then you may need to get important +On HP-UX you must use gcc or the HP ANSI compiler. The free compiler +that comes with HP-UX is not ANSI compliant and cannot compile Samba. +

    SCO UNIX

    +If you run an old version of SCO UNIX, you may need to get important TCP/IP patches for Samba to work correctly. Without the patch, you may -encounter corrupt data transfers using samba. +encounter corrupt data transfers using Samba.

    The patch you need is UOD385 Connection Drivers SLS. It is available from -SCO (ftp.sco.com, directory SLS, +SCO (ftp.sco.com, directory SLS, files uod385a.Z and uod385a.ltr.Z). -

    DNIX

    +

    +The information provided here refers to an old version of SCO UNIX. If you require +binaries for more recent SCO UNIX products, please contact SCO to obtain packages that are +ready to install. You should also verify with SCO that your platform is up-to-date for the +binary packages you will install. This is important if you wish to avoid data corruption +problems with your installation. To build Samba for SCO UNIX products may +require significant patching of Samba source code. It is much easier to obtain binary +packages directly from SCO. +

    DNIX

    DNIX has a problem with seteuid() and setegid(). These routines are needed for Samba to work correctly, but they were left out of the DNIX C library for some reason.

    For this reason Samba by default defines the macro NO_EID in the DNIX section of includes.h. This works around the problem in a limited way, -but it is far from ideal, some things still won't work right. +but it is far from ideal, and some things still will not work right.

    -To fix the problem properly you need to assemble the following two +To fix the problem properly, you need to assemble the following two functions and then either add them to your C library or link them into -Samba. -

    -put this in the file setegid.s: +Samba. Put the following in the file setegid.s: 

             .globl  _setegid
 _setegid:
@@ -15507,7 +15757,7 @@ _setegid:
         clrl    d0
         rts

    -put this in the file seteuid.s: +Put this in the file seteuid.s: 

             .globl  _seteuid
 _seteuid:
@@ -15522,7 +15772,7 @@ _seteuid:
         clrl    d0
         rts

    -after creating the above files you then assemble them using +After creating the above files, you then assemble them using 

     $ as seteuid.s
 $ as setegid.s
@@ -15530,7 +15780,7 @@ after creating the above files you then assemble them using
 that should produce the files seteuid.o and 
 setegid.o
 
    
-then you need to add these to the LIBSM line in the DNIX section of
+Then you need to add these to the LIBSM line in the DNIX section of
 the Samba Makefile. Your LIBSM line will then look something like this:
 
     LIBSM = setegid.o seteuid.o -ln
@@ -15538,8 +15788,8 @@ LIBSM = setegid.o seteuid.o -ln
 You should then remove the line:
 
     #define NO_EID
-
    from the DNIX section of includes.h

    RedHat Linux Rembrandt-II

    -By default RedHat Rembrandt-II during installation adds an +

    from the DNIX section of includes.h.

    Red Hat Linux

    +By default during installation, some versions of Red Hat Linux add an entry to /etc/hosts as follows: 

     	127.0.0.1 loopback "hostname"."domainname"
@@ -15547,16 +15797,16 @@ entry to /etc/hosts as follows:
 
    
 This causes Samba to loop back onto the loopback interface.
 The result is that Samba fails to communicate correctly with
-the world and therefor may fail to correctly negotiate who
+the world and therefore may fail to correctly negotiate who
 is the master browse list holder and who is the master browser.
 
    
-Corrective Action:	Delete the entry after the word loopback
-	in the line starting 127.0.0.1
-

    AIX

    Sequential Read Ahead

    +Corrective Action: Delete the entry after the word "loopback" +in the line starting 127.0.0.1. +

    AIX

    Sequential Read Ahead

    Disabling Sequential Read Ahead using vmtune -r 0 improves Samba performance significantly. -

    Solaris

    Locking improvements

    Some people have been experiencing problems with F_SETLKW64/fcntl -when running Samba on Solaris. The built in file locking mechanism was +

    Solaris

    Locking Improvements

    Some people have been experiencing problems with F_SETLKW64/fcntl +when running Samba on Solaris. The built-in file locking mechanism was not scalable. Performance would degrade to the point where processes would get into loops of trying to lock a file. It would try a lock, then fail, then try again. The lock attempt was failing before the grant was @@ -15567,92 +15817,77 @@ be stuck if F_SETLKW64 loops. Sun released patches for Solaris 2.6, 8, and 9. The patch for Solaris 7 has not been released yet.

    -The patch revision for 2.6 is 105181-34 -for 8 is 108528-19 and for 9 is 112233-04 +The patch revision for 2.6 is 105181-34, for 8 is 108528-19 and for 9 is 112233-04.

    -After the install of these patches it is recommended to reconfigure -and rebuild samba. -

    Thanks to Joe Meslovich for reporting

    Winbind on Solaris 9

    -Nsswitch on Solaris 9 refuses to use the winbind nss module. This behavior -is fixed by Sun in patch 113476-05 which as of March 2003 is not in any +After the install of these patches, it is recommended to reconfigure +and rebuild Samba. +

    Thanks to Joe Meslovich for reporting this.

    Winbind on Solaris 9

    +Nsswitch on Solaris 9 refuses to use the Winbind NSS module. This behavior +is fixed by Sun in patch 113476-05, which as of March 2003, is not in any roll-up packages. -

    Chapter 38. Samba and other CIFS clients

    Jelmer R. Vernooij

    The Samba Team

    Jim McDonough

    OS/2
    IBM

    5 Mar 2001

    Table of Contents

    Macintosh clients?
    OS2 Client
    Configuring OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba
    Configuring OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba
    Printer driver download for for OS/2 clients?
    Windows for Workgroups
    Latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configuring WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1

    This chapter contains client-specific information.

    Macintosh clients?

    - Yes. Thursby now has a CIFS Client / Server called DAVE -

    -They test it against Windows 95, Windows NT and samba for -compatibility issues. At the time of writing, DAVE was at version -1.0.1. The 1.0.0 to 1.0.1 update is available as a free download from -the Thursby web site (the speed of finder copies has been greatly -enhanced, and there are bug-fixes included). +

    Chapter 38. Samba and Other CIFS Clients

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Dan Shearer

    Samba Team

    Jim McDonough

    OS/2
    IBM

    5 Mar 2001

    Table of Contents

    Macintosh Clients
    OS2 Client
    Configuring OS/2 Warp Connect or OS/2 Warp 4
    Configuring Other Versions of OS/2
    Printer Driver Download for OS/2 Clients
    Windows for Workgroups
    Latest TCP/IP Stack from Microsoft
    Delete .pwl Files After Password Change
    Configuring Windows for Workgroups Password Handling
    Password Case Sensitivity
    Use TCP/IP as Default Protocol
    Speed Improvement
    Windows 95/98
    Speed Improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1

    This chapter contains client-specific information.

    Macintosh Clients

    +Yes. Thursby has a CIFS Client/Server called DAVE. +They test it against Windows 95, Windows NT /200x/XP and Samba for +compatibility issues. At the time of this writing, DAVE was at version +4.1. Please refer to Thursby's Web site for more information regarding this +product.

    -Alternatives - There are two free implementations of AppleTalk for -several kinds of UNIX machines, and several more commercial ones. +Alternatives There are two free implementations of AppleTalk for +several kinds of UNIX machines and several more commercial ones. These products allow you to run file services and print services natively to Macintosh users, with no additional support required on -the Macintosh. The two free implementations are -Netatalk, and -CAP. -What Samba offers MS -Windows users, these packages offer to Macs. For more info on these -packages, Samba, and Linux (and other UNIX-based systems) see -http://www.eats.com/linux_mac_win.html -

    Newer versions of the Macintosh (Mac OS X) include Samba.

    OS2 Client

    Configuring OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba

    Basically, you need three components:

    • The File and Print Client ('IBM Peer')

    • TCP/IP ('Internet support')

    • The "NetBIOS over TCP/IP" driver ('TCPBEUI')

    Installing the first two together with the base operating +the Macintosh. The two free implementations are +Netatalk, and +CAP. +What Samba offers MS Windows users, these packages offer to Macs. +For more info on these packages, Samba, and Linux (and other UNIX-based systems), see +http://www.eats.com/linux_mac_win.html. +

    Newer versions of the Macintosh (Mac OS X) include Samba.

    OS2 Client

    Configuring OS/2 Warp Connect or OS/2 Warp 4

    Basically, you need three components:

    • The File and Print Client (IBM Peer)
    • TCP/IP (Internet support)
    • The “NetBIOS over TCP/IP” driver (TCPBEUI)

    Installing the first two together with the base operating system on a blank system is explained in the Warp manual. If Warp has already been installed, but you now want to install the - networking support, use the "Selective Install for Networking" - object in the "System Setup" folder.

    Adding the "NetBIOS over TCP/IP" driver is not described + networking support, use the “Selective Install for Networking” + object in the “System Setup” folder.

    Adding the “NetBIOS over TCP/IP” driver is not described in the manual and just barely in the online documentation. Start - MPTS.EXE, click on OK, click on "Configure LAPS" and click - on "IBM OS/2 NETBIOS OVER TCP/IP" in 'Protocols'. This line - is then moved to 'Current Configuration'. Select that line, - click on "Change number" and increase it from 0 to 1. Save this - configuration.

    If the Samba server(s) is not on your local subnet, you + MPTS.EXE, click on OK, click on Configure LAPS and click + on IBM OS/2 NETBIOS OVER TCP/IP in Protocols. This line + is then moved to Current Configuration. Select that line, + click on Change number and increase it from 0 to 1. Save this + configuration.

    If the Samba server is not on your local subnet, you can optionally add IP names and addresses of these servers - to the "Names List", or specify a WINS server ('NetBIOS - Nameserver' in IBM and RFC terminology). For Warp Connect you - may need to download an update for 'IBM Peer' to bring it on - the same level as Warp 4. See the webpage mentioned above.

    Configuring OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba

    You can use the free Microsoft LAN Manager 2.2c Client - for OS/2 from - - ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/. - In - a nutshell, edit the file \OS2VER in the root directory of - the OS/2 boot partition and add the lines:

    +		to the Names List, or specify a  WINS server (NetBIOS 
+		Nameserver in IBM and RFC terminology). For Warp Connect, you 
+		may need to download an update for IBM Peer to bring it on 
+		the same level as Warp 4. See the Web page mentioned above.

    Configuring Other Versions of OS/2

    This sections deals with configuring OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x.

    You can use the free Microsoft LAN Manager 2.2c Client for OS/2 that is + available from + + ftp://ftp.microsoft.com/BusSys/Clients/LANMAN.OS2/. In a nutshell, edit + the file \OS2VER in the root directory of the OS/2 boot partition and add the lines:

     		20=setup.exe
 		20=netwksta.sys
 		20=netvdd.sys
-

    before you install the client. Also, don't use the - included NE2000 driver because it is buggy. Try the NE2000 - or NS2000 driver from - - ftp://ftp.cdrom.com/pub/os2/network/ndis/ instead. -

    Printer driver download for for OS/2 clients?

    First, create a share called [PRINTDRV] that is - world-readable. Copy your OS/2 driver files there. Note - that the .EA_ files must still be separate, so you will need - to use the original install files, and not copy an installed - driver from an OS/2 system.

    Install the NT driver first for that printer. Then, - add to your smb.conf a parameter, os2 driver map = filename. Then, in the file - specified by filename, map the - name of the NT driver name to the OS/2 driver name as - follows:

    nt driver name = os2 driver name.device name, e.g.:

    +

    before you install the client. Also, do not use the included NE2000 driver because it is buggy. + Try the NE2000 or NS2000 driver from + ftp://ftp.cdrom.com/pub/os2/network/ndis/ instead. +

    Printer Driver Download for OS/2 Clients

    Create a share called [PRINTDRV] that is + world-readable. Copy your OS/2 driver files there. The .EA_ + files must still be separate, so you will need to use the original install files + and not copy an installed driver from an OS/2 system.

    Install the NT driver first for that printer. Then, add to your smb.conf a parameter, + os2 driver map = filename. + Next, in the file specified by filename, map the + name of the NT driver name to the OS/2 driver name as follows:

    nt driver name = os2 driver name.device name, e.g.

    HP LaserJet 5L = LASERJET.HP LaserJet 5L

    You can have multiple drivers mapped in this file.

    If you only specify the OS/2 driver name, and not the device name, the first attempt to download the driver will actually download the files, but the OS/2 client will tell - you the driver is not available. On the second attempt, it - will work. This is fixed simply by adding the device name + you the driver is not available. On the second attempt, it + will work. This is fixed simply by adding the device name to the mapping, after which it will work on the first attempt. -

    Windows for Workgroups

    Latest TCP/IP stack from Microsoft

    Use the latest TCP/IP stack from Microsoft if you use Windows -for Workgroups. -

    The early TCP/IP stacks had lots of bugs.

    -Microsoft has released an incremental upgrade to their TCP/IP 32-Bit -VxD drivers. The latest release can be found on their ftp site at +

    Windows for Workgroups

    Latest TCP/IP Stack from Microsoft

    Use the latest TCP/IP stack from Microsoft if you use Windows +for Workgroups. The early TCP/IP stacks had lots of bugs.

    +Microsoft has released an incremental upgrade to their TCP/IP 32-bit +VxD drivers. The latest release can be found on their ftp site at ftp.microsoft.com, located in /peropsys/windows/public/tcpip/wfwt32.exe. There is an update.txt file there that describes the problems that were -fixed. New files include WINSOCK.DLL, +fixed. New files include WINSOCK.DLL, TELNET.EXE, WSOCK.386, VNBT.386, @@ -15660,375 +15895,336 @@ fixed. New files include WINSOCK.DLL, TRACERT.EXE, NETSTAT.EXE, and NBTSTAT.EXE. -

    Delete .pwl files after password change

    -WfWg does a lousy job with passwords. I find that if I change my -password on either the unix box or the PC the safest thing to do is to -delete the .pwl files in the windows directory. The PC will complain about not finding the files, but will soon get over it, allowing you to enter the new password. +

    Delete .pwl Files After Password Change

    +Windows for Workgroups does a lousy job with passwords. When you change passwords on either +the UNIX box or the PC, the safest thing to do is to delete the .pwl files in the Windows +directory. The PC will complain about not finding the files, but will soon get over it, +allowing you to enter the new password.

    -If you don't do this you may find that WfWg remembers and uses the old +If you do not do this, you may find that Windows for Workgroups remembers and uses the old password, even if you told it a new one.

    -Often WfWg will totally ignore a password you give it in a dialog box. -

    Configuring WfW password handling

    -There is a program call admincfg.exe -on the last disk (disk 8) of the WFW 3.11 disk set. To install it +Often Windows for Workgroups will totally ignore a password you give it in a dialog box. +

    Configuring Windows for Workgroups Password Handling

    +There is a program call admincfg.exe +on the last disk (disk 8) of the WFW 3.11 disk set. To install it, type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE. -Then add an icon -for it via the Program Manager New Menu. -This program allows you to control how WFW handles passwords. ie disable Password Caching etc -for use with security = user -

    Case handling of passwords

    Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf information on password level to specify what characters samba should try to uppercase when checking.

    Use TCP/IP as default protocol

    To support print queue reporting you may find +Then add an icon for it via the Program Manager New Menu. +This program allows you to control how WFW handles passwords, i.e., +Disable Password Caching and so on. +for use with security = user. +

    Password Case Sensitivity

    Windows for Workgroups uppercases the password before sending it to the server. +UNIX passwords can be case-sensitive though. Check the smb.conf information on +password level to specify what characters +Samba should try to uppercase when checking.

    Use TCP/IP as Default Protocol

    To support print queue reporting, you may find that you have to use TCP/IP as the default protocol under -WfWg. For some reason if you leave NetBEUI as the default +Windows for Workgroups. For some reason, if you leave NetBEUI as the default, it may break the print queue reporting on some systems. -It is presumably a WfWg bug.

    Speed improvement

    +It is presumably a Windows for Workgroups bug.

    Speed Improvement

    Note that some people have found that setting DefaultRcvWindow in the [MSTCP] section of the -SYSTEM.INI file under WfWg to 3072 gives a -big improvement. I don't know why. +SYSTEM.INI file under Windows for Workgroups to 3072 gives a +big improvement.

    -My own experience with DefaultRcvWindow is that I get much better +My own experience with DefaultRcvWindow is that I get a much better performance with a large value (16384 or larger). Other people have reported that anything over 3072 slows things down enormously. One person even reported a speed drop of a factor of 30 when he went from -3072 to 8192. I don't know why. -

    Windows '95/'98

    -When using Windows 95 OEM SR2 the following updates are recommended where Samba -is being used. Please NOTE that the above change will affect you once these +3072 to 8192. +

    Windows 95/98

    +When using Windows 95 OEM SR2, the following updates are recommended where Samba +is being used. Please note that the above change will effect you once these updates have been installed.

    There are more updates than the ones mentioned here. You are referred to the Microsoft Web site for all currently available updates to your specific version of Windows 95.

    Kernel Update: KRNLUPD.EXE
    Ping Fix: PINGUPD.EXE
    RPC Update: RPCRTUPD.EXE
    TCP/IP Update: VIPUPD.EXE
    Redirector Update: VRDRUPD.EXE

    -Also, if using MS Outlook it is desirable to +Also, if using MS Outlook, it is desirable to install the OLEUPD.EXE fix. This fix may stop your machine from hanging for an extended period when exiting -Outlook and you may also notice a significant speedup when accessing network +Outlook and you may notice a significant speedup when accessing network neighborhood services. -

    Speed improvement

    -Configure the win95 TCPIP registry settings to give better -performance. I use a program called MTUSPEED.exe which I got off the -net. There are various other utilities of this type freely available. -

    Windows 2000 Service Pack 2

    +

    Speed Improvement

    +Configure the Windows 95 TCP/IP registry settings to give better +performance. I use a program called MTUSPEED.exe that I got off the +Internet. There are various other utilities of this type freely available. +

    Windows 2000 Service Pack 2

    There are several annoyances with Windows 2000 SP2. One of which only appears when using a Samba server to host user profiles -to Windows 2000 SP2 clients in a Windows domain. This assumes +to Windows 2000 SP2 clients in a Windows domain. This assumes that Samba is a member of the domain, but the problem will -likely occur if it is not. +most likely occur if it is not.

    In order to serve profiles successfully to Windows 2000 SP2 clients (when not operating as a PDC), Samba must have -nt acl support = no +nt acl support = no added to the file share which houses the roaming profiles. If this is not done, then the Windows 2000 SP2 client will complain about not being able to access the profile (Access Denied) and create multiple copies of it on disk (DOMAIN.user.001, -DOMAIN.user.002, etc...). See the -smb.conf man page -for more details on this option. Also note that the -nt acl support parameter was formally a global parameter in +DOMAIN.user.002, and so on). See the smb.conf man page +for more details on this option. Also note that the +nt acl support parameter was formally a global parameter in releases prior to Samba 2.2.2.

    -The following is a minimal profile share: -

    Example 38.1. Minimal profile share

    [profile]
    path = /export/profile
    create mask = 0600
    directory mask = 0700
    nt acl support = no
    read only = no

    -The reason for this bug is that the Win2k SP2 client copies -the security descriptor for the profile which contains -the Samba server's SID, and not the domain SID. The client + provides a minimal profile share. +

    Example 38.1. Minimal profile share

    [profile]
    path = /export/profile
    create mask = 0600
    directory mask = 0700
    nt acl support = no
    read only = no

    +The reason for this bug is that the Windows 200x SP2 client copies +the security descriptor for the profile that contains +the Samba server's SID, and not the domain SID. The client compares the SID for SAMBA\user and realizes it is -different that the one assigned to DOMAIN\user. Hence the reason +different from the one assigned to DOMAIN\user. Hence, the reason for the access denied message.

    -By disabling the nt acl support parameter, Samba will send -the Win2k client a response to the QuerySecurityDescriptor -trans2 call which causes the client to set a default ACL -for the profile. This default ACL includes -

    DOMAIN\user "Full Control">

    Note

    This bug does not occur when using winbind to -create accounts on the Samba host for Domain users.

    Windows NT 3.1

    If you have problems communicating across routers with Windows -NT 3.1 workstations, read this Microsoft Knowledge Base article. +By disabling the nt acl support parameter, Samba will send +the Windows 200x client a response to the QuerySecurityDescriptor trans2 call, which causes the client +to set a default ACL for the profile. This default ACL includes: +

    DOMAIN\user “Full Control”>

    Note

    This bug does not occur when using Winbind to +create accounts on the Samba host for Domain users.

    Windows NT 3.1

    If you have problems communicating across routers with Windows +NT 3.1 workstations, read this Microsoft Knowledge Base article. -

    Chapter 39. Samba Performance Tuning

    Paul Cochrane

    Dundee Limb Fitting Centre

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files

    Comparisons

    +

    Chapter 39. Samba Performance Tuning

    Paul Cochrane

    Dundee Limb Fitting Centre

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Comparisons
    Socket Options
    Read Size
    Max Xmit
    Log Level
    Read Raw
    Write Raw
    Slow Logins
    Client Tuning
    Samba Performance Problem Due to Changing Linux Kernel
    Corrupt tdb Files

    Comparisons

    The Samba server uses TCP to talk to the client. Thus if you are -trying to see if it performs well you should really compare it to +trying to see if it performs well, you should really compare it to programs that use the same protocol. The most readily available -programs for file transfer that use TCP are ftp or another TCP based +programs for file transfer that use TCP are ftp or another TCP-based SMB server.

    -If you want to test against something like a NT or WfWg server then +If you want to test against something like an NT or Windows for Workgroups server, then you will have to disable all but TCP on either the client or -server. Otherwise you may well be using a totally different protocol +server. Otherwise, you may well be using a totally different protocol (such as NetBEUI) and comparisons may not be valid.

    -Generally you should find that Samba performs similarly to ftp at raw +Generally, you should find that Samba performs similarly to ftp at raw transfer speed. It should perform quite a bit faster than NFS, -although this very much depends on your system. +although this depends on your system.

    Several people have done comparisons between Samba and Novell, NFS or -WinNT. In some cases Samba performed the best, in others the worst. I -suspect the biggest factor is not Samba vs some other system but the +Windows NT. In some cases Samba performed the best, in others the worst. I +suspect the biggest factor is not Samba versus some other system, but the hardware and drivers used on the various systems. Given similar -hardware Samba should certainly be competitive in speed with other +hardware, Samba should certainly be competitive in speed with other systems. -

    Socket options

    +

    Socket Options

    There are a number of socket options that can greatly affect the -performance of a TCP based server like Samba. +performance of a TCP-based server like Samba.

    The socket options that Samba uses are settable both on the command line with the -O option, or in the smb.conf file.

    -The socket options section of the smb.conf manual page describes how +The socket options section of the smb.conf manual page describes how to set these and gives recommendations.

    -Getting the socket options right can make a big difference to your +Getting the socket options correct can make a big difference to your performance, but getting them wrong can degrade it by just as much. The correct settings are very dependent on your local network.

    -The socket option TCP_NODELAY is the one that seems to make the -biggest single difference for most networks. Many people report that -adding socket options = TCP_NODELAY doubles the read -performance of a Samba drive. The best explanation I have seen for this is -that the Microsoft TCP/IP stack is slow in sending tcp ACKs. -

    Read size

    -The option read size affects the overlap of disk +The socket option TCP_NODELAY is the one that seems to make the biggest single difference +for most networks. Many people report that adding +socket options = TCP_NODELAY +doubles the read performance of a Samba drive. The best explanation I have seen for +this is that the Microsoft TCP/IP stack is slow in sending TCP ACKs. +

    Read Size

    +The option read size affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and -SMBreadbraw) is larger than this value then the server begins writing +SMBreadbraw) is larger than this value, then the server begins writing the data before it has received the whole packet from the network, or in the case of SMBreadbraw, it begins writing to the network before all the data has been read from disk.

    This overlapping works best when the speeds of disk and network access -are similar, having very little effect when the speed of one is much +are similar, having little effect when the speed of one is much greater than the other.

    -The default value is 16384, but very little experimentation has been -done yet to determine the optimal value, and it is likely that the best +The default value is 16384, but little experimentation has been +done as yet to determine the optimal value, and it is likely that the best value will vary greatly between systems anyway. A value over 65536 is pointless and will cause you to allocate memory unnecessarily. -

    Max xmit

    +

    Max Xmit

    At startup the client and server negotiate a maximum transmit size, which limits the size of nearly all SMB commands. You can set the -maximum size that Samba will negotiate using the max xmit option +maximum size that Samba will negotiate using the max xmit option in smb.conf. Note that this is the maximum size of SMB requests that -Samba will accept, but not the maximum size that the *client* will accept. +Samba will accept, but not the maximum size that the client will accept. The client maximum receive size is sent to Samba by the client and Samba -honours this limit. +honors this limit.

    It defaults to 65536 bytes (the maximum), but it is possible that some clients may perform better with a smaller transmit unit. Trying values of less than 2048 is likely to cause severe problems. -

    In most cases the default is the best option. -

    Log level

    -If you set the log level (also known as debug level) higher than 2 +

    Log Level

    +If you set the log level (also known as debug level) higher than 2 then you may suffer a large drop in performance. This is because the -server flushes the log file after each operation, which can be very +server flushes the log file after each operation, which can be quite expensive. -

    Read raw

    -The read raw operation is designed to be an optimised, low-latency +

    Read Raw

    +The read raw operation is designed to be an optimized, low-latency file read operation. A server may choose to not support it, -however. and Samba makes support for read raw optional, with it +however, and Samba makes support for read raw optional, with it being enabled by default.

    -In some cases clients don't handle read raw very well and actually +In some cases clients do not handle read raw very well and actually get lower performance using it than they get using the conventional read operations.

    -So you might like to try read raw = no and see what happens on your -network. It might lower, raise or not affect your performance. Only +So you might like to try read raw = no and see what happens on your +network. It might lower, raise or not effect your performance. Only testing can really tell. -

    Write raw

    -The write raw operation is designed to be an optimised, low-latency -file write operation. A server may choose to not support it, -however. and Samba makes support for write raw optional, with it -being enabled by default. +

    Write Raw

    +The write raw operation is designed to be an optimized, low-latency +file write operation. A server may choose to not support it, however, and Samba makes support for +write raw optional, with it being enabled by default.

    -Some machines may find write raw slower than normal write, in which +Some machines may find write raw slower than normal write, in which case you may wish to change this option. -

    Slow Logins

    +

    Slow Logins

    Slow logins are almost always due to the password checking time. Using -the lowest practical password level will improve things. -

    Client tuning

    +the lowest practical password level will improve things. +

    Client Tuning

    Often a speed problem can be traced to the client. The client (for example Windows for Workgroups) can often be tuned for better TCP performance. Check the sections on the various clients in -Samba and Other Clients. -

    Samba performance problem due changing kernel

    -Hi everyone. I am running Gentoo on my server and samba 2.2.8a. Recently -I changed kernel version from linux-2.4.19-gentoo-r10 to -linux-2.4.20-wolk4.0s. And now I have performance issue with samba. Ok -many of you will probably say that move to vanilla sources...well I tried -it too and it didn't work. I have 100mb LAN and two computers (linux + -Windows2000). Linux server shares directory with DivX files, client -(windows2000) plays them via LAN. Before when I was running 2.4.19 kernel -everything was fine, but now movies freezes and stops...I tried moving -files between server and Windows and it's terribly slow. -

    -Grab mii-tool and check the duplex settings on the NIC. +. +

    Samba Performance Problem Due to Changing Linux Kernel

    +A user wrote the following to the mailing list: +

    +I am running Gentoo on my server and Samba 2.2.8a. Recently +I changed kernel version from linux-2.4.19-gentoo-r10 to +linux-2.4.20-wolk4.0s. And now I have a performance issue with Samba. +Many of you will probably say, “Move to vanilla sources!” +Well, I tried that and it didn't work. I have a 100mb LAN and two computers (Linux and +Windows 2000). The Linux server shares directories with DivX files, the client +(Windows 2000) plays them via LAN. Before when I was running the 2.4.19 kernel +everything was fine, but now movies freeze and stop. I tried moving +files between the server and Windows and it is terribly slow. +

    +The answer he was given is: +

    +Grab the mii-tool and check the duplex settings on the NIC. My guess is that it is a link layer issue, not an application -layer problem. Also run ifconfig and verify that the framing -error, collisions, etc... look normal for ethernet. -

    Corrupt tdb Files

    -Well today it happened, Our first major problem using samba. -Our samba PDC server has been hosting 3 TB of data to our 500+ users -[Windows NT/XP] for the last 3 years using samba, no problem. -But today all shares went SLOW; very slow. Also the main smbd kept +layer problem. Also run ifconfig and verify that the framing +error, collisions, and so on, look normal for ethernet. +

    Corrupt tdb Files

    +Our Samba PDC server has been hosting three TB of data to our 500+ users +[Windows NT/XP] for the last three years using Samba without a problem. +Today all shares went very slow. Also the main smbd kept spawning new processes so we had 1600+ running smbd's (normally we avg. 250). -It crashed the SUN E3500 cluster twice. After a lot of searching I +It crashed the SUN E3500 cluster twice. After a lot of searching, I decided to rm /var/locks/*.tdb. Happy again.

    -Q1) Is there any method of keeping the *.tdb files in top condition or -how to early detect corruption? +Question: Is there any method of keeping the *.tdb files in top condition or +how can I detect early corruption?

    -A1) Yes, run tdbbackup each time after stopping nmbd and before starting nmbd. +Answer: Yes, run tdbbackup each time after stopping nmbd and before starting nmbd.

    -Q2) What I also would like to mention is that the service latency seems -a lot lower then before the locks cleanup, any ideas on keeping it top notch? +Question: What I also would like to mention is that the service latency seems +a lot lower than before the locks cleanup. Any ideas on keeping it top notch?

    -A2) Yes! Same answer as for Q1! -

    Chapter 40. DNS and DHCP Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +Answer: Yes. Same answer as for previous question! +

    Chapter 40. DNS and DHCP Configuration Guide

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Chapter 41. Further Resources

    Jelmer R. Vernooij

    The Samba Team

    May 1, 2003

    Table of Contents

    Websites
    Related updates from Microsoft

    Websites

    Chapter 41. Further Resources

    Jelmer R. Vernooij

    The Samba Team

    May 1, 2003

    Table of Contents

    Websites
    Related updates from Microsoft

    Websites

    Related updates from Microsoft

    Index

    Symbols

    "Domain Admins" group, Discussion
    "Domain Users" group, Adding Domain Users to the Power Users group
    "Printers" folder, Caveats to be considered, Installing the PostScript Driver on a Client, Manual Driver Installation in 15 Steps
    "raw" printing, CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    /etc/host.conf, /etc/host.conf
    /etc/hosts, /etc/hosts
    /etc/nsswitch.conf, /etc/nsswitch.conf
    8.3
    file names, MS Windows NTFS Comparison with UNIX File Systems

    A

    ACLs, File, Directory and Share Access Controls
    Active Directory, Samba ADS Domain Membership
    add group script, Adding Groups Fails
    add machine script, The machine trust account not accessible, Adding Machine to Domain Fails
    add printer command, Adding new Printers with the Windows NT APW
    add printer wizard, Three familiar Methods for driver upload plus a new one
    add user script, Mapping User Identifiers between MS Windows and UNIX
    addprinter command, Parameters Recommended for Use
    admin users, User and Group Based Controls, I have set force user but Samba still makes root the owner of all the files I touch!
    Administrator, Discussion
    ADS (see Active Directory)
    ads server, Setup your smb.conf
    application/cups.vnd-postscript, Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver
    application/octet-stream, Explicitly enable "raw" printing for -application/octet-stream!, MIME type Conversion Rules, "application/octet-stream" printing
    application/pdf, MIME types and CUPS Filters
    application/postscript, Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver
    application/vnd.cups-raster, PostScript Printer Descriptions (PPDs) for non-PS Printers
    application/vnd.cups-raw, Explicitly enable "raw" printing for -application/octet-stream!
    auth methods, auth methods does not work, Passdb Backends and Authentication

    B

    bind interfaces only, The tests
    brlock.tdb, The printing *.tdb Files
    (see also TDB)
    browse list, What is Browsing?, Technical Overview of browsing
    browseable, The [printers] Section, Any [my_printer_name] Section, Parameters in the [print$] Section

    C

    case sensitive, Miscellaneous Controls, Windows 9x / Me Profile Setup
    chpass, Manual Creation of Machine Trust Accounts
    comment, The [printers] Section, Any [my_printer_name] Section, Parameters in the [print$] Section
    configure, Building the Binaries
    connections.tdb, The printing *.tdb Files
    (see also TDB)
    core files, Internal errors
    create mask, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask - parameters
    csc policy, Miscellaneous Controls
    CUPS
    Page Accounting, Page Accounting with CUPS
    quotas, Setting up Quotas
    CUPS-PPD, cupsomatic, pdqomatic, lpdomatic, directomatic
    cupsaddsmb, Three familiar Methods for driver upload plus a new one, cupsaddsmb: the unknown Utility, Caveats to be considered, Run "cupsaddsmb" (quiet Mode), Run "cupsaddsmb" with verbose Output, Understanding cupsaddsmb, cupsaddsmb with a Samba PDC, cupsaddsmb Flowchart
    cupsomatic, CUPS can use all Windows-formatted Vendor PPDs, The CUPS Filtering Architecture, cupsomatic/Foomatic -- how do they fit into the Picture?, Difference between cupsomatic/foomatic-rip and -native CUPS printing, cupsomatic, pdqomatic, lpdomatic, directomatic
    CVS, Access Samba source code via CVS
    web, Access via CVSweb

    D

    daemon, Alternative: starting it as a daemon
    DDK, PostScript Drivers with no major problems -- even in Kernel -Mode, CUPS Package of "PostScript Driver for WinNT/2k/XP"
    debug, Internal errors
    debug level, Debugging with Samba itself, Log level
    debuglevel, Debug levels
    default case, Miscellaneous Controls
    delete printer command, Adding new Printers with the Windows NT APW
    deleteprinter command, Parameters Recommended for Use
    DHCP, Background Information
    diff, Patches
    directory mask, File and Directory Permissions Based Controls
    directory security mask, Interaction with the standard Samba create mask - parameters
    disable spoolss, Parameters Recommended for Use
    display charset, Samba and charsets
    DNS, TCP/IP - without NetBIOS, DNS Lookup
    Active Directory, DNS and Active Directory
    Dynamic, Background Information
    dns proxy, What is Browsing?
    domain admin group, Mapping MS Windows and UNIX Groups
    domain logons, Preparing for Domain Control
    domain master, Domain Network Logon Service, Example Configuration, What is Browsing?, Making Samba the domain master
    dont descend, Miscellaneous Controls
    dos charset, Samba and charsets, Japanese charsets, CP850.so can't be found
    dos filemode, File and Directory Permissions Based Controls
    dos filetime resolution, Miscellaneous Controls
    dos filetimes, Miscellaneous Controls

    E

    EMF, Windows Drivers, GDI and EMF, From Windows Clients to an NT Print Server, Driver Execution on the Server
    encrypt passwords, Joining an NT4 type Domain with Samba-3, smbpasswd - Encrypted Password Database, smb.conf PAM Configuration, The tests
    enhanced browsing, What is Browsing?
    enumports command, Parameters Recommended for Use, Samba and Printer Ports
    EPM (see ESP meta packager)
    ESC/P, Driver Execution on the Server
    ESP
    Ghostscript, The CUPS Filtering Architecture, Difference between cupsomatic/foomatic-rip and -native CUPS printing
    meta packager, CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Print Pro, Sources of CUPS drivers / PPDs, ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Extended Attributes, File, Directory and Share Access Controls

    F

    fake oplocks, Miscellaneous Controls
    File System, File System Access Controls
    foomatic, CUPS can use all Windows-formatted Vendor PPDs, The CUPS Filtering Architecture, cupsomatic/Foomatic -- how do they fit into the Picture?, Difference between cupsomatic/foomatic-rip and -native CUPS printing, foomatic-rip and Foomatic explained, Foomatic's strange Name
    foomatic-rip, Difference between cupsomatic/foomatic-rip and -native CUPS printing, CUPS Print Drivers from Linuxprinting.org, foomatic-rip and Foomatic explained, The Grand Unification -achieved...
    force create mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask - parameters
    force directory mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask - parameters
    force directory security mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask - parameters
    force group, User and Group Based Controls
    force security mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask - parameters
    force user, User and Group Based Controls, I have set force user but Samba still makes root the owner of all the files I touch!, Beware of Force User
    ftp, Accessing the samba sources via rsync and ftp

    G

    gdb, Internal errors
    GDI, GDI on Windows -- PostScript on UNIX, Windows Drivers, GDI and EMF, From Windows Clients to an NT Print Server, Driver Execution on the Server
    GhostScript, PostScript and Ghostscript, Ghostscript -- the Software RIP for non-PostScript Printers
    (see also PostScript)
    Ghostscript
    ESP (see ESP GhostScript)
    GID, Features and Benefits
    GPG, Verifying Samba's PGP signature
    groupadd, Features and Benefits
    groupdel, Features and Benefits
    groups
    domain, Discussion
    mapping, Mapping MS Windows and UNIX Groups
    nested, Adding MS Windows Groups to MS Windows Groups Fails
    guest account, Problem resolution, My client reports "This server is not configured to list shared resources", The [printers] Section
    guest ok, User and Group Based Controls, The [printers] Section, Any [my_printer_name] Section, Parameters in the [print$] Section

    H

    hide dot files, Miscellaneous Controls
    hide files, Miscellaneous Controls
    hide unreadable, File and Directory Permissions Based Controls
    hide unwriteable files, File and Directory Permissions Based Controls
    host msdfs, Features and Benefits
    hosts allow, Using host based protection, Parameters Recommended for Use, Any [my_printer_name] Section
    hosts deny, Using host based protection, Parameters Recommended for Use, Any [my_printer_name] Section

    I

    idmap gid, Features and Benefits, Winbind is not resolving users and groups
    idmap uid, Features and Benefits, Winbind is not resolving users and groups
    ifconfig, Starting from inetd.conf
    imprints, Three familiar Methods for driver upload plus a new one
    inetd, The tests, Starting the smbd and nmbd, Starting from inetd.conf
    Interdomain Trusts, Interdomain Trust Relationships
    completing, Completing an NT4 Domain Trust
    creating, Native MS Windows NT4 Trusts Configuration
    Facilities, Inter-Domain Trust Facilities
    interfaces, Multiple interfaces, The tests, Starting from inetd.conf
    invalid users, User and Group Based Controls
    IPP, Understanding cupsaddsmb

    K

    KDC, Samba ADS Domain Membership
    Kerberos, Samba ADS Domain Membership
    kinit, Setup your /etc/krb5.conf

    L

    ldap admin dn, Configuring Samba
    ldap delete dn, Configuring Samba
    ldap filter, Configuring Samba
    ldap machine suffix, Configuring Samba
    ldap passwd sync, Configuring Samba, Password synchronisation
    ldap ssl, Configuring Samba, Security and sambaSamAccount
    ldap suffix, Configuring Samba
    ldap trust ids, Configuring Samba
    ldap user suffix, Configuring Samba
    libnss_wins.so, /etc/nsswitch.conf
    Links
    hard, MS Windows NTFS Comparison with UNIX File Systems
    soft, MS Windows NTFS Comparison with UNIX File Systems
    Linuxprinting.org, CUPS Print Drivers from Linuxprinting.org
    lm announce, What is Browsing?
    lm interval, What is Browsing?
    LMB (see Local Master Browser)
    LMHOSTS, The LMHOSTS file
    load printers, Parameters Recommended for Use, A little Experiment to warn you, The [global] Section
    local master, What is Browsing?, Setting up WORKGROUP Browsing
    Local Master Browser, Use of the Remote Announce parameter
    locking, Discussion
    locking.tdb, The printing *.tdb Files
    (see also TDB)
    log files
    monitoring, Assumptions
    log level, Adding Machine to Domain Fails, extd_audit, Debug levels
    logon drive, Windows NT4 Workstation
    logon home, LDAP special attributes for sambaSamAccounts, Windows 9x / Me User Profiles, Mixed Windows 9x / Me and Windows NT4/200x User Profiles, Windows NT4 Workstation, Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    logon path, LDAP special attributes for sambaSamAccounts, Mixed Windows 9x / Me and Windows NT4/200x User Profiles, Windows 9x / Me Profile Setup, Windows NT4 Workstation, Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    logon script, LDAP special attributes for sambaSamAccounts
    lpadmin, CUPS Print Drivers from Linuxprinting.org, Setting up Quotas
    lppause command, Parameters Recommended for Use, Linking of smbd with libcups.so, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions
    lpq cache time, Parameters Recommended for Use, The [global] Section
    lpq command, Parameters Recommended for Use, Linking of smbd with libcups.so, Pre-conditions
    lpresume command, Parameters Recommended for Use, Linking of smbd with libcups.so, Pre-conditions
    lprm command, Parameters Recommended for Use, Linking of smbd with libcups.so, Pre-conditions
    lpstat, Troubleshooting revisited

    M

    MAC Addresses, /etc/hosts
    machine trust accounts, MS Windows Workstation/Server Machine Trust Accounts
    creating, MS Windows Workstation/Server Machine Trust Accounts
    make, Building the Binaries
    mangling method, Japanese charsets
    map to guest, Parameters in the [print$] Section, Adding new Printers with the Windows NT APW, Can't reconnect to Samba under new account - from Win2K/XP, Avoid being connected to the Samba server as the - "wrong" user
    max print jobs, Parameters Recommended for Use
    max xmit, Max xmit
    messages.tdb, The printing *.tdb Files
    (see also TDB)
    MIME, MIME types and CUPS Filters, MIME type Conversion Rules, Filter Requirements, "application/octet-stream" printing
    min print space, Parameters Recommended for Use
    msdfs root, Features and Benefits

    N

    name resolve order, What is Browsing?
    nbtstat, The NetBIOS Name Cache
    NetBIOS, Features and Benefits, TCP/IP - without NetBIOS, Integrating MS Windows networks with Samba, Name resolution as used within MS Windows networking
    NetBIOS-less, TCP/IP - without NetBIOS
    nmblookup, The NetBIOS Name Cache
    nt acl support, File and Directory Permissions Based Controls, Viewing file ownership, Viewing File or Directory Permissions, Modifying file or directory permissions, Windows 2000 Service Pack 2
    ntdrivers.tdb, The printing *.tdb Files
    (see also TDB)
    ntforms.tdb, The printing *.tdb Files
    (see also TDB)
    NTFS, File System Access Controls
    ntprinters.tdb, The printing *.tdb Files
    (see also TDB)

    O

    obey pam restrictions, smb.conf PAM Configuration
    only user, User and Group Based Controls, Why can users access home directories of other users?
    oplock break wait time, Advanced Samba Opportunistic Locking Parameters, Disabling Kernel OpLocks
    oplock contention limit, Advanced Samba Opportunistic Locking Parameters
    os level, What is Browsing?, Setting up WORKGROUP Browsing, Setting up DOMAIN Browsing, Forcing Samba to be the master, Making Samba the domain master
    os2 driver map, Parameters Recommended for Use, Printer driver download for for OS/2 clients?

    P

    page_log, The page_log File Syntax
    passdb backend, MS Windows Workstation/Server Machine Trust Accounts, Account Information Databases, Technical Information, The pdbedit Command, Configuring Samba, Configuring, Users can not logon, auth methods does not work, Passdb Backends and Authentication
    password level, Password checking, The tests, Case handling of passwords, Slow Logins
    password server, Server Security (User Level Security), Security Mode and Master Browsers, Joining an NT4 type Domain with Samba-3, The tests
    patch, Patches
    path, "The network name cannot be found", The [printers] Section, Any [my_printer_name] Section, Print Commands, Creating the [print$] Share, Parameters in the [print$] Section, Subdirectory Structure in [print$], Samba receiving Jobfiles and passing them to CUPS, Auto-Deletion or Preservation of CUPS Spool Files, Permissions on -/var/spool/samba/ get reset after each -reboot, The tests
    PCL, GDI on Windows -- PostScript on UNIX, UNIX Printfile Conversion and GUI Basics, Driver Execution on the Server, Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PDF, Windows Drivers, GDI and EMF, PostScript Printer Description (PPD) Specification
    pdf, MIME type Conversion Rules
    PDL, GDI on Windows -- PostScript on UNIX, PostScript and Ghostscript
    PJL, Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs, Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver, Adobe and CUPS PostScript Drivers for Windows Clients
    point and print, Driver Installation Methods on Windows Clients, Three familiar Methods for driver upload plus a new one, cupsomatic/Foomatic -- how do they fit into the Picture?, Run "cupsaddsmb" (quiet Mode), Installing the PostScript Driver on a Client, Manual Driver Installation in 15 Steps
    PostScript, Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download, GDI on Windows -- PostScript on UNIX, UNIX Printfile Conversion and GUI Basics, PostScript and Ghostscript, Prefilters, Driver Execution on the Server, Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs, CUPS: a "Magical Stone"?, CUPS Package of "PostScript Driver for WinNT/2k/XP"
    (see also Ghostscript)
    RIP, PostScript and Ghostscript
    PPD, PostScript and Ghostscript, PostScript Printer Description (PPD) Specification, PostScript Printer Descriptions (PPDs) for non-PS Printers, PPDs for non-PS Printers on UNIX, PPDs for non-PS Printers on Windows, CUPS: a "Magical Stone"?, Installing the PostScript Driver on a Client
    CUPS (see CUPS-PPD)
    preferred master, What is Browsing?, Setting up WORKGROUP Browsing, Forcing Samba to be the master, Making Samba the domain master, The tests
    preserve case, Windows 9x / Me Profile Setup
    print command, Parameters Recommended for Use, The [global] Section, Default Print Commands for various UNIX Print Subsystems, Setting up your own Print Commands, Linking of smbd with libcups.so, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions, Manual Configuration
    print ok , Parameters Recommended for Use
    printable, Parameters Recommended for Use, The [printers] Section, Any [my_printer_name] Section
    printcap, Parameters Recommended for Use, Default Print Commands for various UNIX Print Subsystems, Basic Configuration of CUPS support, Linking of smbd with libcups.so, More complex smb.conf Settings for -CUPS, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions
    printcap name, Parameters Recommended for Use, The [global] Section
    printer, Parameters Recommended for Use
    printer admin, Parameters Recommended for Use, The [global] Section, Any [my_printer_name] Section, Parameters in the [print$] Section, Setting Drivers for existing Printers with a Client GUI, IMPORTANT! Setting Device Modes on new Printers, Always make first Client Connection as root or "printer admin", Setting Default Print Options for the Client Drivers, Adding new Printers with the Windows NT APW, More complex smb.conf Settings for -CUPS, What is required for adddriver and setdriver to succeed, Print options for all users can't be set on Win2K/XP
    printer name, Parameters Recommended for Use
    printing, Parameters Recommended for Use, The [global] Section, Default Print Commands for various UNIX Print Subsystems, Setting up your own Print Commands, Basic Configuration of CUPS support, Linking of smbd with libcups.so, More complex smb.conf Settings for -CUPS, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions, Manual Configuration
    printing.tdb, The printing *.tdb Files
    (see also TDB)
    PrintPro (see ESP Print Pro)
    public, The [printers] Section

    Q

    queue resume command, Linking of smbd with libcups.so
    queuepause command, Parameters Recommended for Use, Linking of smbd with libcups.so
    queueresume command, Parameters Recommended for Use

    R

    read list, User and Group Based Controls
    read only, Miscellaneous Controls, The [printers] Section, Parameters in the [print$] Section
    read raw, Read raw
    read size, Read size
    remote announce, NetBIOS over TCP/IP, How Browsing Functions, Use of the Remote Announce parameter, Browsing support in Samba
    remote browse sync, NetBIOS over TCP/IP, How Browsing Functions, Use of the Remote Browse Sync parameter
    root preexec, Logon Scripts
    rpcclient
    adddriver, Run "cupsaddsmb" with verbose Output, Understanding cupsaddsmb, Installing PostScript Driver Files manually (using -rpcclient), Understanding the rpcclient man page, What is required for adddriver and setdriver to succeed, Manual Driver Installation in 15 Steps
    enumdrivers, Installing PostScript Driver Files manually (using -rpcclient), Manual Driver Installation in 15 Steps
    enumports, Installing PostScript Driver Files manually (using -rpcclient)
    enumprinters, Installing PostScript Driver Files manually (using -rpcclient), What is required for adddriver and setdriver to succeed, Manual Driver Installation in 15 Steps, Troubleshooting revisited
    getdriver, Producing an Example by querying a Windows Box, Manual Driver Installation in 15 Steps
    getprinter, Producing an Example by querying a Windows Box, Manual Driver Installation in 15 Steps, Troubleshooting revisited
    setdriver, Caveats to be considered, Run "cupsaddsmb" with verbose Output, Understanding cupsaddsmb, Installing PostScript Driver Files manually (using -rpcclient), What is required for adddriver and setdriver to succeed, Manual Driver Installation in 15 Steps
    rsync, Accessing the samba sources via rsync and ftp

    S

    secrets.tdb, The printing *.tdb Files
    (see also TDB)
    security, Samba Security Modes, Domain Security Mode (User Level Security), Server Security (User Level Security), What makes Samba a SERVER?, What makes Samba a Domain Controller?, What makes Samba a Domain Member?, Constantly Losing Connections to Password Server, Preparing for Domain Control, Security Mode and Master Browsers, Joining an NT4 type Domain with Samba-3, Why is this better than security = server?, Setup your smb.conf, Run "cupsaddsmb" (quiet Mode), "cupsaddsmb" keeps asking for root password in - neverending loop, Passdb Backends and Authentication, The tests, Configuring WfW password handling
    security mask, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask - parameters
    Server Manager, MS Windows Workstation/Server Machine Trust Accounts, Manual Creation of Machine Trust Accounts
    sessionid.tdb, The printing *.tdb Files
    (see also TDB)
    share_info.tdb, The printing *.tdb Files
    (see also TDB)
    short preserve case, Miscellaneous Controls, Windows 9x / Me Profile Setup
    Short-Cuts, MS Windows NTFS Comparison with UNIX File Systems
    show add printer wizard, Parameters Recommended for Use, The [global] Section, Adding new Printers with the Windows NT APW
    SID, Features and Benefits
    Single Sign On, Caveats to be considered
    smbclient, Testing with smbclient, The tests
    socket options, Socket options
    spooling
    central, Central spooling vs. "Peer-to-Peer" printing
    peer-to-peer, Central spooling vs. "Peer-to-Peer" printing
    spooling-only, CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    strict locking, Discussion

    T

    TDB, The printing *.tdb Files, Trivial DataBase Files
    backing up (see tdbbackup)
    tdbbackup, Using tdbbackup
    template homedir, Linux/FreeBSD-specific PAM configuration
    testparm, The tests
    text/plain, MIME type Conversion Rules
    total print jobs, Parameters Recommended for Use, The [global] Section

    U

    UDP, NetBIOS over TCP/IP
    UID, Features and Benefits
    unexpected.tdb, The printing *.tdb Files
    (see also TDB)
    unix charset, Samba and charsets, Japanese charsets
    use client driver, Parameters Recommended for Use, The [global] Section
    user, Share Level Security, The tests
    User Manager, Samba as the Trusted Domain, Samba as the Trusting Domain
    useradd, Manual Creation of Machine Trust Accounts
    username, User and Group Based Controls
    username level, Password checking
    username map, Windows 200x XP Professional

    V

    valid users, User and Group Based Controls, The tests
    veto files, Miscellaneous Controls
    vfs objects, Discussion
    vipw, Manual Creation of Machine Trust Accounts

    W

    winbind separator, Start up the winbindd daemon and test it!
    WINS, What is Browsing?, NetBIOS over TCP/IP, WINS Lookup
    wins hook, What is Browsing?
    wins proxy, What is Browsing?
    wins server, What is Browsing?, WINS - The Windows Internetworking Name Server, Setting up a WINS server
    wins support, What is Browsing?, WINS - The Windows Internetworking Name Server, Setting up a WINS server
    workgroup, Security Mode and Master Browsers, Joining an NT4 type Domain with Samba-3, Browsing support in Samba
    write list, User and Group Based Controls, Parameters in the [print$] Section
    write raw, Write raw
    writeable, The [printers] Section, Any [my_printer_name] Section
    WYSIWYG, Windows Drivers, GDI and EMF

    X

    X Window System, UNIX Printfile Conversion and GUI Basics
    xinetd, Starting from inetd.conf (see inetd)
    Xprint, UNIX Printfile Conversion and GUI Basics
    + +

  • + + Samba 2.0.x Troubleshooting guide from Paul Green + +

  • + + Ten Years of Samba + +

  • + + Samba Authenticated Gateway HOWTO + +

  • + + An Introduction to Samba + +

  • + + What is CIFS? + +

  • + + WFWG: Password Caching and How It Affects LAN Manager + Security at Microsoft Knowledge Base + +

    • Related updates from Microsoft

    • + + Enhanced Encryption for Windows 95 Password Cache + +

    • + + Windows '95 File Sharing Updates + +

    • + + Windows for Workgroups Sharing Updates + +

    Index

    Symbols

    "Printers" folder, Caveats to be Considered, Installing the PostScript Driver on a Client, Manual Driver Installation in 15 Steps
    "raw" printing, Raw Print Serving Vendor Drivers on Windows Clients
    /etc/cups/mime.convs, Explicitly Enable raw Printing for application/octet-stream
    /etc/cups/mime.types, Explicitly Enable raw Printing for application/octet-stream
    /etc/host.conf, /etc/host.conf
    /etc/hosts, /etc/hosts
    /etc/krb5.conf, Configure /etc/krb5.conf
    /etc/nsswitch.conf, /etc/nsswitch.conf
    8.3 file names, MS Windows NTFS Comparison with UNIX File Systems

    A

    Account Controls, Managing Account/User Policies
    ACLs, File, Directory and Share Access Controls
    File System, File and Directory Access Control
    POSIX, File, Directory and Share Access Controls, Features and Benefits
    share, Features and Benefits
    Windows, Features and Benefits
    Active Directory, Samba ADS Domain Membership
    add group script, Adding Groups Fails
    add machine script, The Machine Trust Account Is Not Accessible, Managing Domain Machine Accounts using NT4 Server Manager, Adding Machine to Domain Fails
    add printer command, Adding New Printers with the Windows NT APW
    add printer wizard, Driver Upload Methods
    add user script, Mapping User Identifiers between MS Windows and UNIX
    admin users, User and Group-Based Controls, File Operations Done as root with force user Set
    Administrator, Discussion
    ADS (see Active Directory)
    application/cups.vnd-postscript, Windows CUPS PostScript Driver Versus Adobe Driver
    application/octet-stream, Explicitly Enable raw Printing for application/octet-stream, MIME Type Conversion Rules, application/octet-stream Printing
    application/pdf, MIME Types and CUPS Filters, MIME Type Conversion Rules
    application/postscript, Windows CUPS PostScript Driver Versus Adobe Driver
    application/vnd.cups-raster, PostScript Printer Descriptions (PPDs) for Non-PS Printers
    application/vnd.cups-raw, Explicitly Enable raw Printing for application/octet-stream
    auth methods, Configuration of auth methods, Passdb Backends and Authentication

    B

    bad hardware, Browsing of Shares and Directories is Very Slow
    brlock.tdb, The Printing *.tdb Files
    (see also TDB)
    browsable, Simple Print Configuration
    browse list, What Is Browsing?, Technical Overview of Browsing
    browseable, Simple Print Configuration, The [printers] Section, Any [my_printer_name] Section, [print$] Section Parameters
    browsing problems, I get an `Unable to browse the network' error

    C

    case sensitive, Miscellaneous Controls, Windows 9x/Me Profile Setup
    chpass, Manual Creation of Machine Trust Accounts
    client use spnego, I Can't Join a Windows 2003 PDC
    comment, The [printers] Section, Any [my_printer_name] Section, [print$] Section Parameters
    Config.POL, Creating and Managing System Policies
    configure, Building the Binaries
    connections.tdb, The Printing *.tdb Files
    (see also TDB)
    core files, Internal Errors
    create mask, File and Directory Permissions-Based Controls, Interaction with the Standard Samba create mask Parameters
    csc policy, Miscellaneous Controls
    CUPS
    Page Accounting, Page Accounting with CUPS
    quotas, Setting Up Quotas
    CUPS-PPD, cupsomatic, pdqomatic, lpdomatic, directomatic
    cupsaddsmb, Driver Upload Methods, cupsaddsmb: The Unknown Utility, Caveats to be Considered, Run cupsaddsmb (Quiet Mode), Run cupsaddsmb with Verbose Output, Understanding cupsaddsmb, cupsaddsmb with a Samba PDC, cupsaddsmb Flowchart
    cupsomatic, Using Windows-Formatted Vendor PPDs, The CUPS Filtering Architecture, The Role of cupsomatic/foomatic, cupsomatic/foomatic-rip Versus native CUPS Printing, cupsomatic, pdqomatic, lpdomatic, directomatic
    CVS, Introduction
    web, Access via CVSweb

    D

    daemon, Alternative: Starting smbd as a Daemon
    DDK, PostScript Drivers with No Major Problems Even in Kernel +Mode, CUPS PostScript Driver for Windows NT/200x/XP
    debug, Internal Errors
    debug level, Debugging with Samba Itself, Log Level
    debuglevel, Debug Levels
    default case, Miscellaneous Controls
    default profile, Default Profile for Windows Users, Changing the Default Profile
    delete printer command, Adding New Printers with the Windows NT APW
    delete roaming profiles, MS Windows 200x/XP
    DHCP, Background Information
    diff, Patches
    directory mask, File and Directory Permissions-Based Controls
    directory security mask, Interaction with the Standard Samba create mask Parameters
    Directory Separators, MS Windows NTFS Comparison with UNIX File Systems
    display charset, Samba and Charsets, Enabling SWAT Internationalization Support
    DNS, TCP/IP without NetBIOS, DNS Lookup
    Active Directory, DNS and Active Directory
    Dynamic, Background Information
    dns proxy, What Is Browsing?
    domain admin group, Group Mapping MS Windows and UNIX
    Domain Admins group, Discussion
    domain logons, Preparing for Domain Control
    domain master, Domain Network Logon Service, Example Configuration, What Is Browsing?, Making Samba the Domain Master
    Domain Member, Domain Security Mode (User Level Security)
    joining, Example Configuration
    domain security, Features and Benefits
    Domain Users group, Adding Domain Users to the Power Users Group
    dont descend, Miscellaneous Controls
    dos charset, Samba and Charsets, Japanese Charsets, CP850.so Can't Be Found
    dos filemode, File and Directory Permissions-Based Controls
    dos filetime resolution, Miscellaneous Controls
    dos filetimes, Miscellaneous Controls
    Drive Identification, MS Windows NTFS Comparison with UNIX File Systems

    E

    editreg, Samba Editreg Toolset
    EMF, Windows Drivers, GDI and EMF, From Windows Clients to an NT Print Server, Driver Execution on the Server
    encrypt passwords, Joining an NT4-type Domain with Samba-3, smbpasswd Encrypted Password Database, smb.conf PAM Configuration, Quick Migration Guide, The Tests
    encrypted passwords, Features and Benefits, Technical Information, Using Plaintext Passwords or Encrypted Password
    enhanced browsing, What Is Browsing?
    enumports command, Samba and Printer Ports
    EPM (see ESP meta packager)
    ESC/P, Driver Execution on the Server
    ESP
    Ghostscript, The CUPS Filtering Architecture, cupsomatic/foomatic-rip Versus native CUPS Printing
    meta packager, CUPS PostScript Driver for Windows NT/200x/XP
    Print Pro, Sources of CUPS Drivers/PPDs, ESP Print Pro PostScript Driver for Windows NT/200x/XP
    Event Viewer, Remote Server Administration
    Extended Attributes, File, Directory and Share Access Controls

    F

    fake oplocks, Miscellaneous Controls
    File Naming Conventions, MS Windows NTFS Comparison with UNIX File Systems
    File System, MS Windows NTFS Comparison with UNIX File Systems
    case sensitivity, MS Windows NTFS Comparison with UNIX File Systems
    feature comparison, MS Windows NTFS Comparison with UNIX File Systems
    UNIX, MS Windows NTFS Comparison with UNIX File Systems
    Windows, MS Windows NTFS Comparison with UNIX File Systems
    flush name cache, How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?
    foomatic, Using Windows-Formatted Vendor PPDs, The CUPS Filtering Architecture, The Role of cupsomatic/foomatic, cupsomatic/foomatic-rip Versus native CUPS Printing, foomatic-rip and Foomatic Explained, Foomatic's Strange Name
    foomatic-rip, cupsomatic/foomatic-rip Versus native CUPS Printing, CUPS Print Drivers from Linuxprinting.org, foomatic-rip and Foomatic Explained, The Grand Unification Achieved
    force create mode, File and Directory Permissions-Based Controls, Interaction with the Standard Samba create mask Parameters
    force directory mode, File and Directory Permissions-Based Controls, Interaction with the Standard Samba create mask Parameters
    force directory security mode, File and Directory Permissions-Based Controls, Interaction with the Standard Samba create mask Parameters
    force group, User and Group-Based Controls
    force security mode, File and Directory Permissions-Based Controls, Interaction with the Standard Samba create mask Parameters
    force user, User and Group-Based Controls, File Operations Done as root with force user Set, Beware of Force User
    ftp, Accessing the Samba Sources via rsync and ftp

    G

    gdb, Internal Errors
    GDI, GDI on Windows -- PostScript on UNIX, Windows Drivers, GDI and EMF, From Windows Clients to an NT Print Server, Driver Execution on the Server
    genlogon.pl, Network Logon Script Magic
    GhostScript, PostScript and Ghostscript, Ghostscript the Software RIP for Non-PostScript Printers
    (see also PostScript)
    Ghostscript
    ESP (see ESP GhostScript)
    GID, Features and Benefits
    GPG, Verifying Samba's PGP Signature
    GPOs, Features and Benefits, MS Windows 200x/XP Professional Policies, Administration of Windows 200x/XP Policies, Managing Account/User Policies, MS Windows 200x/XP
    group policies, Features and Benefits
    group policy objects (see GPOs)
    group profiles, Creating and Managing Group Profiles
    groupadd, Features and Benefits
    groupdel, Features and Benefits
    groups
    domain, Discussion
    mapping, Group Mapping MS Windows and UNIX
    nested, Adding MS Windows Groups to MS Windows Groups Fails
    guest account, Problem Resolution, Server Resources Can Not Be Listed, The [printers] Section
    guest ok, User and Group-Based Controls, The [printers] Section, Any [my_printer_name] Section, [print$] Section Parameters

    H

    hide dot files, Miscellaneous Controls
    hide files, Miscellaneous Controls
    hide unreadable, File and Directory Permissions-Based Controls
    hide unwriteable files, File and Directory Permissions-Based Controls
    host msdfs, Features and Benefits
    hosts allow, Using Host-Based Protection, Any [my_printer_name] Section
    hosts deny, Using Host-Based Protection, Any [my_printer_name] Section

    I

    idmap backend, Example Configuration
    idmap gid, Features and Benefits, Winbind Is Not Resolving Users and Groups, Winbind Is Not Resolving Users and Groups
    idmap uid, Features and Benefits, Winbind Is Not Resolving Users and Groups, Winbind Is Not Resolving Users and Groups
    ifconfig, Starting from inetd.conf
    imprints, Driver Upload Methods
    inetd, The Tests, Starting the smbd and nmbd, Starting from inetd.conf
    initGroups.sh, Script to Configure Group Mapping, Steps in Migration Process
    Interdomain Trusts, Interdomain Trust Relationships
    Completing, Completing an NT4 Domain Trust
    creating, Native MS Windows NT4 Trusts Configuration
    Facilities, Inter-Domain Trust Facilities
    interfaces, Multiple Interfaces, Problem Resolution, The Tests, Starting from inetd.conf
    invalid users, User and Group-Based Controls
    IPP, Understanding cupsaddsmb

    K

    KDC, Samba ADS Domain Membership
    Kerberos, Samba ADS Domain Membership
    /etc/krb5.conf, Configure /etc/krb5.conf
    kinit, Configure /etc/krb5.conf

    L

    ldap admin dn, Backup Domain Controller Configuration, Sharing User ID Mappings between Samba Domain Members, Configuring Samba
    ldap delete dn, Configuring Samba
    ldap filter, Configuring Samba
    ldap group suffix, Configuring Samba
    ldap idmap suffix, Backup Domain Controller Configuration, Sharing User ID Mappings between Samba Domain Members, Configuring Samba
    ldap machine suffix, Configuring Samba
    ldap passwd sync, Configuring Samba, Password Synchronization
    ldap ssl, Configuring Samba, Security and sambaSamAccount
    ldap suffix, Backup Domain Controller Configuration, Configuring Samba
    ldap user suffix, Configuring Samba
    libnss_wins.so, /etc/nsswitch.conf
    Links
    hard, MS Windows NTFS Comparison with UNIX File Systems
    soft, MS Windows NTFS Comparison with UNIX File Systems
    Linuxprinting.org, CUPS Print Drivers from Linuxprinting.org
    lm announce, What Is Browsing?
    lm interval, What Is Browsing?
    LMB (see Local Master Browser)
    LMHOSTS, The LMHOSTS File
    load printers, Rapid Configuration Validation, The [global] Section
    local master, What Is Browsing?, Configuring WORKGROUP Browsing
    Local Master Browser, NetBIOS over TCP/IP, Use of the Remote Announce Parameter
    locking, Discussion
    locking.tdb, The Printing *.tdb Files
    (see also TDB)
    log files
    monitoring, Assumptions
    log level, Adding Machine to Domain Fails, Problem Resolution, extd_audit, Debug Levels
    logon drive, Windows NT4 Workstation
    logon home, LDAP Special Attributes for sambaSamAccounts, Windows 9x/Me User Profiles, Mixed Windows 9x/Me and Windows NT4/200x User Profiles, Disabling Roaming Profile Support, Windows NT4 Workstation, Sharing Profiles between W9x/Me and NT4/200x/XP Workstations
    logon path, LDAP Special Attributes for sambaSamAccounts, Mixed Windows 9x/Me and Windows NT4/200x User Profiles, Disabling Roaming Profile Support, Windows 9x/Me Profile Setup, Windows NT4 Workstation, Sharing Profiles between W9x/Me and NT4/200x/XP Workstations
    logon script, LDAP Special Attributes for sambaSamAccounts
    lpadmin, CUPS Print Drivers from Linuxprinting.org, Setting Up Quotas
    lppause command, Linking smbd with libcups.so, From Windows Clients to a CUPS/Samba Print Server, Pre-Conditions
    lpq cache time, The [global] Section
    lpq command, Linking smbd with libcups.so, Pre-Conditions
    lpresume command, Linking smbd with libcups.so, Pre-Conditions
    lprm command, Linking smbd with libcups.so, Pre-Conditions
    lpstat, Troubleshooting Revisited

    M

    MAC Addresses, /etc/hosts
    Machine Trust Accounts, Features and Benefits, Machine Accounts Keep Expiring, MS Windows Workstation/Server Machine Trust Accounts
    creating, MS Windows Workstation/Server Machine Trust Accounts
    make, Building the Binaries
    mandatory profiles, Mandatory Profiles
    mangling method, Japanese Charsets
    map to guest, [print$] Section Parameters, Adding New Printers with the Windows NT APW, New Account Reconnection from Windows 200x/XP Troubles, Avoid Being Connected to the Samba Server as the Wrong User
    max xmit, Max Xmit
    messages.tdb, The Printing *.tdb Files
    (see also TDB)
    MIME, MIME Types and CUPS Filters, MIME Type Conversion Rules, Filtering Overview, application/octet-stream Printing
    filters, MIME Types and CUPS Filters
    raw, Central Print Serving, Explicitly Enable raw Printing for application/octet-stream
    minimal configuration, Configuration file syntax
    msdfs root, Features and Benefits

    N

    name resolve order, What Is Browsing?
    nbtstat, The NetBIOS Name Cache
    net
    groupmap, Example Configuration, Steps in Migration Process
    rpc, Example Configuration, Features and Benefits, Steps in Migration Process
    NetBIOS, Features and Benefits, TCP/IP without NetBIOS, Integrating MS Windows Networks with Samba, Name Resolution as Used within MS Windows Networking
    NetBIOS-less, TCP/IP without NetBIOS
    Nexus.exe, Features and Benefits, Managing Domain Machine Accounts using NT4 Server Manager, Remote Server Administration
    nmblookup, The NetBIOS Name Cache
    NoMachine.Com, Remote Management from NoMachine.Com
    nt acl support, File and Directory Permissions-Based Controls, Viewing File Ownership, Viewing File or Directory Permissions, Modifying File or Directory Permissions, Windows 2000 Service Pack 2
    NTConfig.POL, Windows 9x/ME Policies, Managing Account/User Policies, Samba Editreg Toolset, MS Windows NT4 Workstation
    ntdrivers.tdb, The Printing *.tdb Files
    (see also TDB)
    ntforms.tdb, The Printing *.tdb Files
    (see also TDB)
    NTFS, MS Windows NTFS Comparison with UNIX File Systems
    ntprinters.tdb, The Printing *.tdb Files
    (see also TDB)
    NTUser.DAT, Samba Editreg Toolset

    O

    obey pam restrictions, smb.conf PAM Configuration
    only user, User and Group-Based Controls, Why Can Users Access Home Directories of Other Users?
    oplock break wait time, Advanced Samba Opportunistic Locking Parameters, Disabling Kernel Oplocks
    oplock contention limit, Advanced Samba Opportunistic Locking Parameters
    os level, What Is Browsing?, Configuring WORKGROUP Browsing, DOMAIN Browsing Configuration, Forcing Samba to Be the Master, Making Samba the Domain Master
    os2 driver map, Printer Driver Download for OS/2 Clients

    P

    page_log, The page_log File Syntax
    passdb backend, MS Windows Workstation/Server Machine Trust Accounts, Account Information Databases, Technical Information, The pdbedit Command, Configuring Samba, Configuring, Users Cannot Logon, Configuration of auth methods, Remote CIFS Authentication Using winbindd.so, Quick Migration Guide, Passdb Backends and Authentication
    password level, Password Checking, The Tests, Password Case Sensitivity, Slow Logins
    password server, Server Security (User Level Security), Security Mode and Master Browsers, Joining an NT4-type Domain with Samba-3, Configure smb.conf, The Tests
    patch, Patches
    path, The [printers] Section, Any [my_printer_name] Section, Print Commands, Creating the [print$] Share, [print$] Section Parameters, The [print$] Share Directory, Samba Receiving Jobfiles and Passing Them to CUPS, Auto-Deletion or Preservation of CUPS Spool Files, Permissions on /var/spool/samba/ Get Reset After Each Reboot, The Tests
    PCL, GDI on Windows -- PostScript on UNIX, Windows Drivers, GDI and EMF, UNIX Printfile Conversion and GUI Basics, Driver Execution on the Server, Network PostScript RIP
    pdbedit, New Backends, Account Management Tools, The pdbedit Command, XML, Passdb Backends and Authentication, Steps in Migration Process, Samba-3 Implementation Choices
    PDF, Windows Drivers, GDI and EMF, PostScript Printer Description (PPD) Specification
    pdf, MIME Type Conversion Rules
    PDL, GDI on Windows -- PostScript on UNIX, PostScript and Ghostscript
    permissions
    file/directory ACLs, Managing UNIX Permissions Using NT Security Dialogs
    share, Share Definition Access Controls
    share ACLs, Access Controls on Shares
    UNIX file and directory, Features and Benefits
    PGP, Verifying Samba's PGP Signature
    PJL, Network PostScript RIP, Windows CUPS PostScript Driver Versus Adobe Driver, Adobe and CUPS PostScript Drivers for Windows Clients
    point 'n' print, Installation of Windows Client Drivers, Driver Upload Methods, The Role of cupsomatic/foomatic, Run cupsaddsmb (Quiet Mode), Installing the PostScript Driver on a Client, Manual Driver Installation in 15 Steps
    PostScript, Advanced Intelligent Printing with PostScript Driver Download, GDI on Windows -- PostScript on UNIX, Windows Drivers, GDI and EMF, UNIX Printfile Conversion and GUI Basics, PostScript and Ghostscript, Prefilters, Driver Execution on the Server, Network PostScript RIP, CUPS: A Magical Stone?, CUPS PostScript Driver for Windows NT/200x/XP
    (see also Ghostscript)
    RIP, PostScript and Ghostscript
    PPD, PostScript and Ghostscript, PostScript Printer Description (PPD) Specification, PostScript Printer Descriptions (PPDs) for Non-PS Printers, PPDs for Non-PS Printers on UNIX, PPDs for Non-PS Printers on Windows, CUPS: A Magical Stone?, Installing the PostScript Driver on a Client
    CUPS (see CUPS-PPD)
    preferred master, What Is Browsing?, Configuring WORKGROUP Browsing, Forcing Samba to Be the Master, Making Samba the Domain Master, The Tests
    preserve case, Windows 9x/Me Profile Setup
    print command, The [global] Section, Default UNIX System Printing Commands, Custom Print Commands, Linking smbd with libcups.so, From Windows Clients to a CUPS/Samba Print Server, Pre-Conditions, Manual Configuration
    printable, The [printers] Section, Any [my_printer_name] Section
    printcap, Default UNIX System Printing Commands, Basic CUPS Support Configuration, Linking smbd with libcups.so, More Complex CUPS smb.conf Settings, Pre-Conditions
    printcap name, The [global] Section
    printer admin, The [global] Section, Any [my_printer_name] Section, [print$] Section Parameters, Add Printer Wizard Driver Installation, First Client Driver Installation, Setting Device Modes on New Printers, Always Make First Client Connection as root or printer admin, Setting Default Print Options for Client Drivers, Adding New Printers with the Windows NT APW, More Complex CUPS smb.conf Settings, Requirements for adddriver and setdriver to Succeed, Print Options for All Users Can't Be Set on Windows 200x/XP
    printing, The [global] Section, Default UNIX System Printing Commands, Custom Print Commands, Basic CUPS Support Configuration, Linking smbd with libcups.so, More Complex CUPS smb.conf Settings, From Windows Clients to a CUPS/Samba Print Server, Pre-Conditions, Manual Configuration
    printing.tdb, The Printing *.tdb Files
    (see also TDB)
    PrintPro (see ESP Print Pro)
    public, The [printers] Section

    Q

    queue resume command, Linking smbd with libcups.so
    queuepause command, Linking smbd with libcups.so

    R

    raw printing, Central Print Serving, Explicitly Enable raw Printing for application/octet-stream
    read list, User and Group-Based Controls
    read only, Miscellaneous Controls, The [printers] Section, [print$] Section Parameters
    read raw, Read Raw
    read size, Read Size
    Relative Identifier (see RID)
    remote announce, NetBIOS over TCP/IP, How Browsing Functions, Use of the Remote Announce Parameter, Browsing Support in Samba
    remote browse sync, NetBIOS over TCP/IP, How Browsing Functions, Use of the Remote Browse Sync Parameter
    replication, Features and Benefits
    browse lists, Cross-Subnet Browsing
    SAM, Domain Controller Types, Features and Benefits, MS Windows NT4-style Domain Control, Backup Domain Controller Configuration, Can Samba Be a Backup Domain Controller to an NT4 PDC?, How Do I Replicate the smbpasswd File?
    WINS, NetBIOS over TCP/IP, WINS Server Configuration, WINS Replication
    RID, Default Users, Groups and Relative Identifiers
    roaming profiles, Disabling Roaming Profile Support
    root preexec, Logon Scripts
    rpcclient
    adddriver, Run cupsaddsmb with Verbose Output, Understanding cupsaddsmb, Installing PostScript Driver Files Manually Using rpcclient, Understanding the rpcclient man Page, Requirements for adddriver and setdriver to Succeed, Manual Driver Installation in 15 Steps
    enumdrivers, Installing PostScript Driver Files Manually Using rpcclient, Manual Driver Installation in 15 Steps
    enumports, Installing PostScript Driver Files Manually Using rpcclient
    enumprinters, Installing PostScript Driver Files Manually Using rpcclient, Requirements for adddriver and setdriver to Succeed, Manual Driver Installation in 15 Steps, Troubleshooting Revisited
    getdriver, Producing an Example by Querying a Windows Box, Manual Driver Installation in 15 Steps
    getprinter, Producing an Example by Querying a Windows Box, Manual Driver Installation in 15 Steps, Troubleshooting Revisited
    setdriver, Caveats to be Considered, Run cupsaddsmb with Verbose Output, Understanding cupsaddsmb, Installing PostScript Driver Files Manually Using rpcclient, Requirements for adddriver and setdriver to Succeed, Manual Driver Installation in 15 Steps
    rsync, Accessing the Samba Sources via rsync and ftp
    rundll32, Adding Printers without User Intervention

    S

    SAM, Features and Benefits, Domain Controller Types, Features and Benefits, Result Caching
    SAM backend
    LDAP, Features and Benefits
    ldapsam, Features and Benefits, Features and Benefits, Mapping Common UIDs/GIDs on Distributed Machines, ldapsam
    ldapsam_compat, Features and Benefits
    mysqlsam, Features and Benefits, MySQL
    non-LDAP, Features and Benefits
    smbpasswd, Features and Benefits, smbpasswd Encrypted Password Database
    tdbsam, Features and Benefits, Features and Benefits, tdbsam
    xmlsam, Features and Benefits, Mapping Common UIDs/GIDs on Distributed Machines, XML
    schannel, Cannot Log onto Domain Member Workstation After Joining Domain
    secrets.tdb, The Printing *.tdb Files
    (see also TDB)
    security, Samba Security Modes, Domain Security Mode (User Level Security), Server Security (User Level Security), What Makes Samba a Server?, What Makes Samba a Domain Controller?, What Makes Samba a Domain Member?, Constantly Losing Connections to Password Server, Preparing for Domain Control, Security Mode and Master Browsers, Joining an NT4-type Domain with Samba-3, Why Is This Better Than security = server?, Configure smb.conf, Run cupsaddsmb (Quiet Mode), cupsaddsmb Keeps Asking for Root Password in Never-ending Loop, Passdb Backends and Authentication, The Tests, Configuring Windows for Workgroups Password Handling
    security mask, File and Directory Permissions-Based Controls, Interaction with the Standard Samba create mask Parameters
    Security Mode, Samba Security Modes
    Server Manager, MS Windows Workstation/Server Machine Trust Accounts, Manual Creation of Machine Trust Accounts, Remote Server Administration
    Server Type, Server Types
    Domain Member, Example Configuration, Example Configuration, Features and Benefits
    sessionid.tdb, The Printing *.tdb Files
    (see also TDB)
    share_info.tdb, The Printing *.tdb Files
    (see also TDB)
    short preserve case, Miscellaneous Controls, Windows 9x/Me Profile Setup
    Short-Cuts, MS Windows NTFS Comparison with UNIX File Systems
    show add printer wizard, The [global] Section, Adding New Printers with the Windows NT APW
    SID, Features and Benefits, The System Cannot Log You On (C000019B), Backup Domain Controller Configuration, Technical Information, Features and Benefits, Side Bar Notes, Get SID, Profile Migration/Creation
    signing, Cannot Log onto Domain Member Workstation After Joining Domain
    simple configuration, Example Configuration
    Single Sign On, Caveats to be Considered
    slow browsing, Browsing of Shares and Directories is Very Slow
    smbclient, Testing with smbclient, The Tests
    smbgrpadd.sh, Sample smb.conf Add Group Script
    socket options, Socket Options
    spooling
    central, Central Spooling vs. Peer-to-Peer Printing
    peer-to-peer, Central Spooling vs. Peer-to-Peer Printing
    spooling-only, Raw Print Serving Vendor Drivers on Windows Clients
    SRVTOOLS.EXE, Managing Domain Machine Accounts using NT4 Server Manager, Remote Server Administration
    strict locking, Discussion
    swat, SWAT
    enable, Enabling SWAT for Use
    security, Securing SWAT through SSL
    System Policy Editor, Creating and Managing System Policies, Administration of Windows 200x/XP Policies

    T

    TDB, The Printing *.tdb Files, Trivial Database Files
    backing up (see tdbbackup)
    tdbbackup, Using tdbbackup
    template homedir, Linux/FreeBSD-specific PAM configuration
    testparm, The Tests
    text/plain, MIME Type Conversion Rules
    total print jobs, The [global] Section

    U

    UDP, NetBIOS over TCP/IP
    UID, Features and Benefits
    unexpected.tdb, The Printing *.tdb Files
    (see also TDB)
    unix charset, Samba and Charsets
    UNIX charset, Japanese Charsets
    use client driver, The [global] Section
    user, Share Level Security, The Tests
    User Accounts
    Adding/Deleting, The smbpasswd Command, The pdbedit Command, Accounts and Groups Management
    User Management, The smbpasswd Command, The pdbedit Command, Accounts and Groups Management
    User Manager, Samba as the Trusted Domain, Samba as the Trusting Domain, Remote Server Administration
    useradd, Manual Creation of Machine Trust Accounts
    username, User and Group-Based Controls
    username level, Password Checking
    username map, Windows 200x/XP Professional Client
    users, Why Can Users Access Home Directories of Other Users?

    V

    valid users, User and Group-Based Controls, The Tests
    veto files, Miscellaneous Controls
    vfs objects, Discussion
    vipw, Manual Creation of Machine Trust Accounts

    W

    WebClient, Browsing of Shares and Directories is Very Slow
    winbind separator, Starting and Testing the winbindd Daemon
    winbindd, Example Configuration
    windows registry settings
    default profile locations, MS Windows NT4 Workstation, MS Windows 200x/XP
    profile path, Windows 9x/Me Profile Setup
    roaming profiles, Disabling Roaming Profile Support
    WINS, What Is Browsing?, NetBIOS over TCP/IP, WINS Lookup
    wins hook, What Is Browsing?
    wins proxy, What Is Browsing?
    wins server, What Is Browsing?, WINS The Windows Internetworking Name Server, WINS Server Configuration
    wins support, What Is Browsing?, WINS The Windows Internetworking Name Server, WINS Server Configuration
    workgroup, Security Mode and Master Browsers, Joining an NT4-type Domain with Samba-3, Browsing Support in Samba
    write list, User and Group-Based Controls, [print$] Section Parameters
    write raw, Write Raw
    writeable, The [printers] Section, Any [my_printer_name] Section
    WYSIWYG, Windows Drivers, GDI and EMF

    X

    X Window System, Windows Drivers, GDI and EMF, UNIX Printfile Conversion and GUI Basics
    xinetd, Starting from inetd.conf (see inetd)
    Xprint, Windows Drivers, GDI and EMF, UNIX Printfile Conversion and GUI Basics
    diff --git a/docs/htmldocs/SambaHA.html b/docs/htmldocs/SambaHA.html index 39ab6b91d8..7104c8041b 100644 --- a/docs/htmldocs/SambaHA.html +++ b/docs/htmldocs/SambaHA.html @@ -1,4 +1,4 @@ -Chapter 29. High Availability Options
    Chapter 29. High Availability Options
    Prev Part III. Advanced Configuration Next

    Chapter 29. High Availability Options

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    +Chapter 29. High Availability Options

    Chapter 29. High Availability Options
    Prev Part III. Advanced Configuration Next

    Chapter 29. High Availability Options

    John H. Terpstra

    Samba Team

    Table of Contents

    Note

    Note

    This chapter did not make it into this release. It is planned for the published release of this document. -

    Prev Up Next
    Chapter 28. Samba Backup Techniques Home Part IV. Migration and Updating
    +

    Prev Up Next
    Chapter 28. Samba Backup Techniques Home Part IV. Migration and Updating
    diff --git a/docs/htmldocs/ServerType.html b/docs/htmldocs/ServerType.html index 7b5b7117a6..77a2937d95 100644 --- a/docs/htmldocs/ServerType.html +++ b/docs/htmldocs/ServerType.html @@ -1,92 +1,93 @@ -Chapter 4. Server Types and Security Modes
    Chapter 4. Server Types and Security Modes
    Prev Part II. Server Configuration Basics Next

    Chapter 4. Server Types and Security Modes

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password checking
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server

    +Chapter 4. Server Types and Security Modes

    Chapter 4. Server Types and Security Modes
    Prev Part II. Server Configuration Basics Next

    Chapter 4. Server Types and Security Modes

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password Checking
    Common Errors
    What Makes Samba a Server?
    What Makes Samba a Domain Controller?
    What Makes Samba a Domain Member?
    Constantly Losing Connections to Password Server

    This chapter provides information regarding the types of server that Samba may be -configured to be. A Microsoft network administrator who wishes to migrate to or to -use Samba will want to know what, within a Samba context, terms familiar to MS Windows -administrator mean. This means that it is essential also to define how critical security -modes function BEFORE we get into the details of how to configure the server itself. +configured to be. A Microsoft network administrator who wishes to migrate to or +use Samba will want to know the meaning, within a Samba context, of terms familiar to MS Windows +administrator. This means that it is essential also to define how critical security +modes function before we get into the details of how to configure the server itself.

    The chapter provides an overview of the security modes of which Samba is capable -and how these relate to MS Windows servers and clients. +and how they relate to MS Windows servers and clients.

    -A question often asked is, "Why would I want to use Samba?" Most chapters contain a section +A question often asked is, “Why would I want to use Samba?” Most chapters contain a section that highlights features and benefits. We hope that the information provided will help to answer this question. Be warned though, we want to be fair and reasonable, so not all -features are positive towards Samba so the benefit may be on the side of our competition. -

    Features and Benefits

    +features are positive towards Samba. The benefit may be on the side of our competition. +

    Features and Benefits

    Two men were walking down a dusty road, when one suddenly kicked up a small red stone. It hurt his toe and lodged in his sandal. He took the stone out and cursed it with a passion -and fury fitting his anguish. The other looked at the stone and said, that is a garnet - I -can turn that into a precious gem and some day it will make a princess very happy! +and fury befitting his anguish. The other looked at the stone and said, “This is a garnet. +I can turn that into a precious gem and some day it will make a princess very happy!”

    The moral of this tale: Two men, two very different perspectives regarding the same stone. Like it or not, Samba is like that stone. Treat it the right way and it can bring great -pleasure, but if you are forced upon it and have no time for its secrets then it can be +pleasure, but if you are forced to use it and have no time for its secrets, then it can be a source of discomfort.

    Samba started out as a project that sought to provide interoperability for MS Windows 3.x clients with a UNIX server. It has grown up a lot since its humble beginnings and now provides features and functionality fit for large scale deployment. It also has some warts. In sections -like this one we will tell of both. +like this one we tell of both.

    -So now, what are the benefits of features mentioned in this chapter? +So, what are the benefits of features mentioned in this chapter?

    • - Samba-3 can replace an MS Windows NT4 Domain Controller + Samba-3 can replace an MS Windows NT4 Domain Controller.

    • - Samba-3 offers excellent interoperability with MS Windows NT4 - style domains as well as natively with Microsoft Active - Directory domains. + Samba-3 offers excellent interoperability with MS Windows NT4-style + domains as well as natively with Microsoft Active Directory domains.

    • - Samba-3 permits full NT4 style Interdomain Trusts + Samba-3 permits full NT4-style Interdomain Trusts.

    • Samba has security modes that permit more flexible authentication than is possible with MS Windows NT4 Domain Controllers.

    • - Samba-3 permits use of multiple account database backends + Samba-3 permits use of multiple account database backends.

    • The account (password) database backends can be distributed and replicated using multiple methods. This gives Samba-3 greater flexibility than MS Windows NT4 and in many cases a significantly higher utility than Active Directory domains with MS Windows 200x. -

    Server Types

    Administrators of Microsoft networks often refer to three -different type of servers:

    • Domain Controller

      • Primary Domain Controller

      • Backup Domain Controller

      • ADS Domain Controller

    • Domain Member Server

      • Active Directory Domain Server

      • NT4 Style Domain Domain Server

    • Stand Alone Server

    +

    Server Types

    + +Administrators of Microsoft networks often refer to three +different type of servers:

    • Domain Controller

      • Primary Domain Controller
      • Backup Domain Controller
      • ADS Domain Controller

    • Domain Member Server

      • Active Directory Domain Server
      • NT4 Style Domain Domain Server

    • Stand-alone Server

    The chapters covering Domain Control, Backup Domain Control and Domain Membership provide pertinent information regarding Samba configuration for each of these server roles. The reader is strongly encouraged to become intimately familiar with the information presented. -

    Samba Security Modes

    -In this section the function and purpose of Samba's security +

    Samba Security Modes

    + + +In this section the function and purpose of Samba's security modes are described. An accurate understanding of how Samba implements each security mode as well as how to configure MS Windows clients for each mode will significantly reduce user complaints and administrator heartache.

    -In the SMB/CIFS networking world, there are only two types of security: USER Level -and SHARE Level. We refer to these collectively as security levels. In implementing these two security levels Samba provides flexibilities -that are not available with Microsoft Windows NT4 / 200x servers. Samba knows of five (5) -ways that allow the security levels to be implemented. In actual fact, Samba implements -SHARE Level security only one way, but has four ways of implementing -USER Level security. Collectively, we call the Samba implementations -Security Modes. These are: SHARE, USER, DOMAIN, -ADS, and SERVER -modes. They are documented in this chapter. +In the SMB/CIFS networking world, there are only two types of security: User Level +and Share Level. We refer to these collectively as security levels. +In implementing these two security levels, Samba provides flexibilities +that are not available with Microsoft Windows NT4/200x servers. In actual fact, Samba implements +Share Level security only one way, but has four ways of implementing +User Level security. Collectively, we call the Samba implementations +Security Modes. They are known as: SHARE, USER, +DOMAIN, ADS, and SERVER modes. +They are documented in this chapter.

    - A SMB server tells the client at startup what security level -it is running. There are two options: share level and -user level. Which of these two the client receives affects -the way the client then tries to authenticate itself. It does not directly affect -(to any great extent) the way the Samba server does security. This may sound strange, -but it fits in with the client/server approach of SMB. In SMB everything is initiated -and controlled by the client, and the server can only tell the client what is -available and whether an action is allowed. -

    User Level Security

    -We will describe user level security first, as it's simpler. -In user level security, the client will send a -session setup command directly after the protocol negotiation. -This contains a username and password. The server can either accept or reject that -username/password combination. Note that at this stage the server has no idea what +An SMB server tells the client at startup what security level it is running. There are two options: +Share Level and User Level. Which of these two the client receives affects the way the client then +tries to authenticate itself. It does not directly affect (to any great extent) the way the Samba +server does security. This may sound strange, but it fits in with the client/server approach of SMB. +In SMB everything is initiated and controlled by the client, and the server can only tell the client +what is available and whether an action is allowed. +

    User Level Security

    +We will describe User Level Security first, as its simpler. +In User Level Security, the client will send a +session setup request directly following protocol negotiation. +This request provides a username and password. The server can either accept or reject that +username/password combination. At this stage the server has no idea what share the client will eventually try to connect to, so it can't base the accept/reject on anything other than: -

    1. The username/password

    2. The name of the client machine

    +

    1. the username/password.

    2. the name of the client machine.

    If the server accepts the username/password then the client expects to be able to mount shares (using a tree connection) without specifying a password. It expects that all access rights will be as the username/password @@ -96,53 +97,57 @@ It is also possible for a client to send multiple ses requests. When the server responds, it gives the client a uid to use as an authentication tag for that username/password. The client can maintain multiple authentication contexts in this way (WinDD is an example of an application that does this). -

    Example Configuration

    -The smb.conf parameter that sets User Level Security is: +

    Example Configuration

    +The smb.conf parameter that sets user level security is:

    security = user

    -This is the default setting since samba-2.2.x. -

    Share Level Security

    -Ok, now for share level security. In share level security, the client authenticates -itself separately for each share. It will send a password along with each -tree connection (share mount). It does not explicitly send a +This is the default setting since Samba-2.2.x. +

    Share Level Security

    +In Share Level security, the client authenticates +itself separately for each share. It sends a password along with each +tree connection (share mount). It does not explicitly send a username with this operation. The client expects a password to be associated with each share, independent of the user. This means that Samba has to work out what username the client probably wants to use. It is never explicitly sent the username. Some commercial SMB servers such as NT actually associate passwords directly with -shares in share level security, but Samba always uses the unix authentication scheme +shares in Share Level security, but Samba always uses the UNIX authentication scheme where it is a username/password pair that is authenticated, not a share/password pair.

    -To gain understanding of the MS Windows networking parallels to this, one should think +To understand the MS Windows networking parallels, one should think in terms of MS Windows 9x/Me where one can create a shared folder that provides read-only or full access, with or without a password.

    -Many clients send a session setup even if the server is in share -level security. They normally send a valid username but no password. Samba records -this username in a list of possible usernames. When the client -then does a tree connection it also adds to this list the name +Many clients send a session setup even if the server is in Share Level security. They +normally send a valid username but no password. Samba records this username in a list +of possible usernames. When the client then does a tree connection it also adds to this list the name of the share they try to connect to (useful for home directories) and any users -listed in the user smb.conf line. The password is then checked -in turn against these possible usernames. If a match is found +listed in the user parameter in the smb.conf file. +The password is then checked in turn against these possible usernames. If a match is found then the client is authenticated as that user. -

    Example Configuration

    -The smb.conf parameter that sets Share Level Security is: +

    Example Configuration

    +The smb.conf parameter that sets Share Level security is:

    security = share

    -Please note that there are reports that recent MS Windows clients do not like to work -with share mode security servers. You are strongly discouraged from using share level security. -

    Domain Security Mode (User Level Security)

    -When Samba is operating in security = domain mode, -the Samba server has a domain security trust account (a machine account) and will cause -all authentication requests to be passed through to the domain controllers. -

    Example Configuration

    +There are reports that recent MS Windows clients do not like to work +with share mode security servers. You are strongly discouraged from using Share Level security. +

    Domain Security Mode (User Level Security)

    + +When Samba is operating in security = domain mode, +the Samba server has a domain security trust account (a machine account) and causes +all authentication requests to be passed through to the Domain Controllers. +In other words, this configuration makes the Samba server a Domain Member server. +

    Example Configuration

    Samba as a Domain Member Server

    + This method involves addition of the following parameters in the smb.conf file:

    security = domain
    workgroup = MIDEARTH

    In order for this method to work, the Samba server needs to join the MS Windows NT security domain. This is done as follows: -

    1. On the MS Windows NT domain controller, using + + +

      1. On the MS Windows NT Domain Controller, using the Server Manager, add a machine account for the Samba server. -

      2. Next, on the UNIX/Linux system execute:

        root# net rpc join -U administrator%password

      Note

      -Samba-2.2.4 and later can auto-join a Windows NT4 style Domain just by executing: +

    2. On the UNIX/Linux system execute:

      root# net rpc join -U administrator%password

    Note

    +Samba-2.2.4 and later can auto-join a Windows NT4-style Domain just by executing: 

     root# smbpasswd -j DOMAIN_NAME -r PDC_NAME \
 	 -U Administrator%password
@@ -157,97 +162,97 @@ It is not necessary with Samba-3 to specify the DOMAI

    Use of this mode of authentication does require there to be a standard UNIX account for each user in order to assign a UID once the account has been authenticated by -the remote Windows DC. This account can be blocked to prevent logons by clients other than +the remote Windows DC. This account can be blocked to prevent logons by clients other than MS Windows through means such as setting an invalid shell in the /etc/passwd entry.

    An alternative to assigning UIDs to Windows users on a Samba member server is -presented in the chapter about winbind. +presented in .

    - For more information of being a domain member, see the chapter about domain membership. -

    ADS Security Mode (User Level Security)

    -Both Samba 2.2 and 3.0 can join an Active Directory domain. This is +For more information regarding Domain Membership, see . +

    ADS Security Mode (User Level Security)

    +Both Samba-2.2, and Samba-3 can join an Active Directory domain. This is possible if the domain is run in native mode. Active Directory in -native mode perfectly allows NT4-style domain members. This is contrary to -popular belief. The only thing that Active Directory in native mode -prohibits is Backup Domain Controllers running NT4. +native mode perfectly allows NT4-style Domain Members. This is contrary to +popular belief. Active Directory in native mode prohibits only the use of +Backup Domain Controllers running MS Windows NT4.

    If you are using Active Directory, starting with Samba-3 you can join as a native AD member. Why would you want to do that? Your security policy might prohibit the use of NT-compatible authentication protocols. All your machines are running Windows 2000 -and above and all use Kerberos. In this case Samba as a NT4-style +and above and all use Kerberos. In this case Samba as an NT4-style domain would still require NT-compatible authentication data. Samba in AD-member mode can accept Kerberos tickets. -

    Example Configuration

    realm = your.kerberos.REALM
    security = ADS

    +

    Example Configuration

    realm = your.kerberos.REALM
    security = ADS

    The following parameter may be required: -

    ads server = your.kerberos.server

    -Please refer to the chapter on domain membership +

    password server = your.kerberos.server

    +Please refer to and for more information regarding this configuration option. -

    Server Security (User Level Security)

    -Server security mode is a left over from the time when Samba was not capable of acting -as a domain member server. It is highly recommended NOT to use this feature. Server -security mode has many draw backs. The draw backs include: -

    • Potential Account Lockout on MS Windows NT4/200x password servers

    • Lack of assurance that the password server is the one specified

    • Does not work with Winbind, particularly needed when storing profiles remotely

    • This mode may open connections to the password server, and keep them open for extended periods.

    • Security on the Samba server breaks badly when the remote password server suddenly shuts down

    • With this mode there is NO security account in the domain that the password server belongs to for the Samba server.

    -In server security mode the Samba server reports to the client that it is in user level -security. The client then does a session setup as described earlier. +

    Server Security (User Level Security)

    +Server Security Mode is left over from the time when Samba was not capable of acting +as a Domain Member server. It is highly recommended not to use this feature. Server +security mode has many drawbacks that include: +

    • Potential Account Lockout on MS Windows NT4/200x password servers.

    • Lack of assurance that the password server is the one specified.

    • Does not work with Winbind, which is particularly needed when storing profiles remotely.

    • This mode may open connections to the password server, and keep them open for extended periods.

    • Security on the Samba server breaks badly when the remote password server suddenly shuts down.

    • With this mode there is NO security account in the domain that the password server belongs to for the Samba server.

    +In Server Security Mode the Samba server reports to the client that it is in User Level +security. The client then does a session setup as described earlier. The Samba server takes the username/password that the client sends and attempts to login to the -password server by sending exactly the same username/password that -it got from the client. If that server is in user level security and accepts the password, -then Samba accepts the clients connection. This allows the Samba server to use another SMB -server as the password server. +password server by sending exactly the same username/password that +it got from the client. If that server is in User Level Security and accepts the password, +then Samba accepts the client's connection. This allows the Samba server to use another SMB +server as the password server.

    -You should also note that at the very start of all this, where the server tells the client +You should also note that at the start of all this where the server tells the client what security level it is in, it also tells the client if it supports encryption. If it -does then it supplies the client with a random cryptkey. The client will then send all +does, it supplies the client with a random cryptkey. The client will then send all passwords in encrypted form. Samba supports this type of encryption by default.

    -The parameter security = server means that Samba reports to clients that +The parameter security = server means that Samba reports to clients that it is running in user mode but actually passes off all authentication requests to another user mode server. This requires an additional -parameter password server that points to the real authentication server. -That real authentication server can be another Samba server or can be a Windows NT server, -the later natively capable of encrypted password support. +parameter password server that points to the real authentication server. +The real authentication server can be another Samba server, or it can be a Windows NT server, +the latter being natively capable of encrypted password support.

    Note

    -When Samba is running in server security mode it is essential that +When Samba is running in Server Security Mode it is essential that the parameter password server is set to the precise NetBIOS machine -name of the target authentication server. Samba can NOT determine this from NetBIOS name -lookups because the choice of the target authentication server is arbitrary and can not +name of the target authentication server. Samba cannot determine this from NetBIOS name +lookups because the choice of the target authentication server is arbitrary and cannot be determined from a domain name. In essence, a Samba server that is in -server security mode is operating in what used to be known as +Server Security Mode is operating in what used to be known as workgroup mode. -

    Example Configuration

    -Using MS Windows NT as an authentication server +

    Example Configuration

    +Using MS Windows NT as an Authentication Server

    This method involves the additions of the following parameters in the smb.conf file: -

    encrypt passwords = Yes
    security = server
    password server = "NetBIOS_name_of_a_DC"

    -There are two ways of identifying whether or not a username and password pair was valid. +

    encrypt passwords = Yes
    security = server
    password server = "NetBIOS_name_of_a_DC"

    +There are two ways of identifying whether or not a username and password pair is valid. One uses the reply information provided as part of the authentication messaging process, the other uses just an error code.

    -The down-side of this mode of configuration is the fact that for security reasons Samba +The downside of this mode of configuration is the fact that for security reasons Samba will send the password server a bogus username and a bogus password and if the remote server fails to reject the username and password pair then an alternative mode of identification of validation is used. Where a site uses password lock out after a certain number of failed authentication attempts this will result in user lockouts.

    -Use of this mode of authentication does require there to be a standard UNIX account -for the user, though this account can be blocked to prevent logons by non-SMB/CIFS clients. -

    Password checking

    +Use of this mode of authentication requires a standard UNIX account for the user. +This account can be blocked to prevent logons by non-SMB/CIFS clients. +

    Password Checking

    MS Windows clients may use encrypted passwords as part of a challenge/response -authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or clear text strings for simple -password based authentication. It should be realized that with the SMB protocol, -the password is passed over the network either in plain text or encrypted, but +authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or cleartext strings for simple +password-based authentication. It should be realized that with the SMB protocol, +the password is passed over the network either in plain-text or encrypted, but not both in the same authentication request.

    When encrypted passwords are used, a password that has been entered by the user is encrypted in two ways: -

    • An MD4 hash of the UNICODE of the password - string. This is known as the NT hash. +

      • An MD4 hash of the unicode of the password + string. This is known as the NT hash.

      • The password is converted to upper case, - and then padded or truncated to 14 bytes. This string is + and then padded or truncated to 14 bytes. This string is then appended with 5 bytes of NULL characters and split to - form two 56 bit DES keys to encrypt a "magic" 8 byte value. + form two 56-bit DES keys to encrypt a “magic” 8-byte value. The resulting 16 bytes form the LanMan hash.

      MS Windows 95 pre-service pack 1, MS Windows NT versions 3.x and version 4.0 @@ -261,64 +266,65 @@ connection that has been dropped, the client re-establishes the connection using a cached copy of the password.

      When Microsoft changed the default password mode, support was dropped for caching -of the plain text password. This means that when the registry parameter is changed -to re-enable use of plain text passwords it appears to work, but when a dropped -service connection mapping attempts to revalidate it will fail if the remote -authentication server does not support encrypted passwords. This means that it -is definitely not a good idea to re-enable plain text password support in such clients. +of the plain-text password. This means that when the registry parameter is changed +to re-enable use of plain-text passwords it appears to work, but when a dropped +service connection mapping attempts to revalidate, this will fail if the remote +authentication server does not support encrypted passwords. It is definitely not +a good idea to re-enable plain-text password support in such clients.

      -The following parameters can be used to work around the issue of Windows 9x clients -upper casing usernames and password before transmitting them to the SMB server -when using clear text authentication. +The following parameters can be used to work around the issue of Windows 9x/Me clients +upper-casing usernames and passwords before transmitting them to the SMB server +when using cleartext authentication:

      password level = integer
      username level = integer

      -By default Samba will lower case the username before attempting to lookup the user -in the database of local system accounts. Because UNIX usernames conventionally -only contain lower-case character, the username level parameter +By default Samba will convert to lower case the username before attempting to lookup the user +in the database of local system accounts. Because UNIX usernames conventionally +only contain lower-case characters, the username level parameter is rarely needed.

      However, passwords on UNIX systems often make use of mixed-case characters. -This means that in order for a user on a Windows 9x client to connect to a Samba -server using clear text authentication, the password level -must be set to the maximum number of upper case letters which could -appear in a password. Note that if the server OS uses the traditional DES version -of crypt(), a password level of 8 will result in case -insensitive passwords as seen from Windows users. This will also result in longer +This means that in order for a user on a Windows 9x/Me client to connect to a Samba +server using cleartext authentication, the password level +must be set to the maximum number of upper case letters that could +appear in a password. Note that if the server OS uses the traditional DES version +of crypt(), a password level of 8 will result in case +insensitive passwords as seen from Windows users. This will also result in longer login times as Samba has to compute the permutations of the password string and try them one by one until a match is located (or all combinations fail).

      The best option to adopt is to enable support for encrypted passwords wherever -Samba is used. Most attempts to apply the registry change to re-enable plain text +Samba is used. Most attempts to apply the registry change to re-enable plain-text passwords will eventually lead to user complaints and unhappiness. -

    Common Errors

    -We all make mistakes. It is Ok to make mistakes, so long as they are made in the right places -and at the right time. A mistake that causes lost productivity is seldom tolerated. A mistake +

    Common Errors

    +We all make mistakes. It is okay to make mistakes, as long as they are made in the right places +and at the right time. A mistake that causes lost productivity is seldom tolerated, however a mistake made in a developmental test lab is expected.

    Here we look at common mistakes and misapprehensions that have been the subject of discussions -on the Samba mailing lists. Many of these are avoidable by doing you homework before attempting -a Samba implementation. Some are the result of misunderstanding of the English language. The -English language has many turns of phrase that are potentially vague and may be highly confusing +on the Samba mailing lists. Many of these are avoidable by doing your homework before attempting +a Samba implementation. Some are the result of a misunderstanding of the English language. The +English language, which has many phrases that are potentially vague and may be highly confusing to those for whom English is not their native tongue. -

    What makes Samba a SERVER?

    -To some the nature of the Samba security mode is very obvious, but entirely -wrong all the same. It is assumed that security = server means that Samba -will act as a server. Not so! See above - this setting means that Samba will try -to use another SMB server as its source of user authentication alone. -

    What makes Samba a Domain Controller?

    -The smb.conf parameter security = domain does NOT really make Samba behave -as a Domain Controller! This setting means we want Samba to be a domain member! -

    What makes Samba a Domain Member?

    -Guess! So many others do. But whatever you do, do NOT think that security = user -makes Samba act as a domain member. Read the manufacturers manual before the warranty expires! See -the chapter about domain membership for more information. -

    Constantly Losing Connections to Password Server

    +

    What Makes Samba a Server?

    +To some the nature of the Samba security mode is obvious, but entirely +wrong all the same. It is assumed that security = server means that Samba +will act as a server. Not so! This setting means that Samba will try +to use another SMB server as its source for user authentication alone. +

    What Makes Samba a Domain Controller?

    +The smb.conf parameter security = domain does not really make Samba behave +as a Domain Controller. This setting means we want Samba to be a Domain Member. +

    What Makes Samba a Domain Member?

    +Guess! So many others do. But whatever you do, do not think that security = user +makes Samba act as a Domain Member. Read the manufacturer's manual before the warranty expires. See + for more information. +

    Constantly Losing Connections to Password Server

    “ -Why does server_validate() simply give up rather than re-establishing its connection to the +Why does server_validate() simply give up rather than re-establish its connection to the password server? Though I am not fluent in the SMB protocol, perhaps the cluster server process passes along to its client workstation the session key it receives from the password server, which means the password hashes submitted by the client would not work on a subsequent -connection, whose session key would be different. So server_validate() must give up.” +connection whose session key would be different. So server_validate() must give up.”

    - Indeed. That's why security = server is at best a nasty hack. Please use security = domain. -security = server mode is also known as pass-through authentication. -

    Prev Up Next
    Part II. Server Configuration Basics Home Chapter 5. Domain Control
    +Indeed. That's why security = server +is at best a nasty hack. Please use security = domain; +security = server mode is also known as pass-through authentication. +

    Prev Up Next
    Part II. Server Configuration Basics Home Chapter 5. Domain Control
    diff --git a/docs/htmldocs/StandAloneServer.html b/docs/htmldocs/StandAloneServer.html index f85fdfe3fc..78f219911c 100644 --- a/docs/htmldocs/StandAloneServer.html +++ b/docs/htmldocs/StandAloneServer.html @@ -1,85 +1,82 @@ -Chapter 8. Stand-Alone Servers
    Chapter 8. Stand-Alone Servers
    Prev Part II. Server Configuration Basics Next

    Chapter 8. Stand-Alone Servers

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors

    -Stand-Alone servers are independent of Domain Controllers on the network. -They are NOT domain members and function more like workgroup servers. In many -cases a stand-alone server is configured with a minimum of security control +Chapter 8. Stand-alone Servers

    Chapter 8. Stand-alone Servers
    Prev Part II. Server Configuration Basics Next

    Chapter 8. Stand-alone Servers

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors

    +Stand-alone Servers are independent of Domain Controllers on the network. +They are not Domain Members and function more like workgroup servers. In many +cases a Stand-alone Server is configured with a minimum of security control with the intent that all data served will be readily accessible to all users. -

    Features and Benefits

    -Stand-Alone servers can be as secure or as insecure as needs dictate. They can +

    Features and Benefits

    +Stand-alone Servers can be as secure or as insecure as needs dictate. They can have simple or complex configurations. Above all, despite the hoopla about -Domain security they remain a very common installation. +Domain Security they remain a common installation.

    If all that is needed is a server for read-only files, or for -printers alone, it may not make sense to affect a complex installation. +printers alone, it may not make sense to effect a complex installation. For example: A drafting office needs to store old drawings and reference -standards. No-one can write files to the server as it is legislatively -important that all documents remain unaltered. A share mode read-only stand-alone -server is an ideal solution. +standards. Noone can write files to the server as it is legislatively +important that all documents remain unaltered. A share mode read-only Stand-alone +Server is an ideal solution.

    Another situation that warrants simplicity is an office that has many printers that are queued off a single central server. Everyone needs to be able to print -to the printers, there is no need to affect any access controls and no files will -be served from the print server. Again a share mode stand-alone server makes +to the printers, there is no need to effect any access controls and no files will +be served from the print server. Again, a share mode Stand-alone Server makes a great solution. -

    Background

    -The term stand-alone server means that the server +

    Background

    +The term Stand-alone Server means that it will provide local authentication and access control for all resources that are available from it. In general this means that there will be a -local user database. In more technical terms, it means that resources +local user database. In more technical terms, it means resources on the machine will be made available in either SHARE mode or in USER mode.

    No special action is needed other than to create user accounts. Stand-alone -servers do NOT provide network logon services. This means that machines that -use this server do NOT perform a domain logon to it. Whatever logon facility -the workstations are subject to is independent of this machine. It is however -necessary to accommodate any network user so that the logon name they use will -be translated (mapped) locally on the stand-alone server to a locally known +servers do not provide network logon services. This means that machines that +use this server do not perform a domain logon to it. Whatever logon facility +the workstations are subject to is independent of this machine. It is, however, +necessary to accommodate any network user so the logon name they use will +be translated (mapped) locally on the Stand-alone Server to a locally known user name. There are several ways this can be done.

    Samba tends to blur the distinction a little in respect of what is -a stand-alone server. This is because the authentication database may be -local or on a remote server, even if from the Samba protocol perspective -the Samba server is NOT a member of a domain security context. +a Stand-alone Server. This is because the authentication database may be +local or on a remote server, even if from the SMB protocol perspective +the Samba server is not a member of a domain security context.

    -Through the use of PAM (Pluggable Authentication Modules) and nsswitch -(the name service switcher, which maintains the unix user database) the source of authentication may reside on +Through the use of Pluggable Authentication Modules (PAM) and the name service switcher (NSSWITCH), +which maintains the UNIX-user database) the source of authentication may reside on another server. We would be inclined to call this the authentication server. This means that the Samba server may use the local UNIX/Linux system password database (/etc/passwd or /etc/shadow), may use a -local smbpasswd file, or may use -an LDAP back end, or even via PAM and Winbind another CIFS/SMB server +local smbpasswd file, or may use an LDAP backend, or even via PAM and Winbind another CIFS/SMB server for authentication. -

    Example Configuration

    -The following examples are designed to inspire simplicity. It is too easy to -attempt a high level of creativity and to introduce too much complexity in -server and network design. +

    Example Configuration

    +The examples, , and link linkend="SimplePrintServer"/>, +are designed to inspire simplicity. It is too easy to attempt a high level of creativity +and to introduce too much complexity in server and network design.

    Reference Documentation Server

    -Configuration of a read-only data server that EVERYONE can access is very simple. -Here is the smb.conf file that will do this. Assume that all the reference documents -are stored in the directory /export, that the documents are owned by a user other than -nobody. No home directories are shared, that are no users in the /etc/passwd -UNIX system database. This is a very simple system to administer. -

    Example 8.1. smb.conf for Reference Documentation Server

    # Global parameters
    [global]
    workgroup = MIDEARTH
    netbios name = GANDALF
    security = SHARE
    passdb backend = guest
    wins server = 192.168.1.1
    [data]
    comment = Data
    path = /export
    guest only = Yes

    -In the above example the machine name is set to REFDOCS, the workgroup is set to the name -of the local workgroup so that the machine will appear in with systems users are familiar -with. The only password backend required is the "guest" backend so as to allow default -unprivileged account names to be used. Given that there is a WINS server on this network -we do use it. +Configuration of a read-only data server that everyone can access is very simple. + is the smb.conf file that will do this. Assume that all the reference documents +are stored in the directory /export, and the documents are owned by a user other than +nobody. No home directories are shared, and there are no users in the /etc/passwd +UNIX system database. This is a simple system to administer. +

    Example 8.1. smb.conf for Reference Documentation Server

    # Global parameters
    [global]
    workgroup = MIDEARTH
    netbios name = GANDALF
    security = SHARE
    passdb backend = guest
    wins server = 192.168.1.1
    [data]
    comment = Data
    path = /export
    guest only = Yes

    +In above, the machine name is set to GANDALF, the workgroup is set to the name +of the local workgroup (MIDEARTH) so the machine will appear together with systems with +which users are familiar. The only password backend required is the “guest” backend to allow default +unprivileged account names to be used. As there is a WINS server on this networki, we of obviously make use of it.

    Central Print Serving

    -Configuration of a simple print server is very simple if you have all the right tools +Configuration of a simple print server is easy if you have all the right tools on your system.

    Assumptions:

    1. - The print server must require no administration + The print server must require no administration.

    2. The print spooling and processing system on our print server will be CUPS. - (Please refer to the chapter about CUPS for more information). + (Please refer to for more information).

    3. - All printers that the print server will service will be network - printers. They will be correctly configured, by the administrator, - in the CUPS environment. + The print server will service only network printers. The network administrator + will correctly configure the CUPS environment to support the printers.

    4. - All workstations will be installed using postscript drivers. The printer - of choice is the Apple Color LaserWriter. + All workstations will use only postscript drivers. The printer driver + of choice is the one shipped with the Windows OS for the Apple Color LaserWriter.

    In this example our print server will spool all incoming print jobs to /var/spool/samba until the job is ready to be submitted by @@ -88,12 +85,12 @@ the anonymous (guest) user, two things will be required:

    Enabling Anonymous Printing

    • The UNIX/Linux system must have a guest account. The default for this is usually the account nobody. - To find the correct name to use for your version of Samba do the + To find the correct name to use for your version of Samba, do the following: 

      -$ testparm -s -v | grep "guest account"
+$ testparm -s -v | grep "guest account"

      - Then make sure that this account exists in your system password + Make sure that this account exists in your system password database (/etc/passwd).

    • The directory into which Samba will spool the file must have write @@ -105,8 +102,18 @@ the anonymous (guest) user, two things will be required: root# chmod a+rwt /var/spool/samba

    -

    Example 8.2. smb.conf for anonymous printing

    # Global parameters
    [global]
    workgroup = MIDEARTH
    netbios name = GANDALF
    security = SHARE
    passdb backend = guest
    wins server = noldor
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    printer admin = root
    guest ok = Yes
    printable = Yes
    use client driver = Yes
    browseable = No

    -

    Common Errors

    +The contents of the smb.conf file is shown in . +

    +

    Example 8.2. smb.conf for Anonymous Printing

    # Global parameters
    [global]
    workgroup = MIDEARTH
    netbios name = GANDALF
    security = SHARE
    passdb backend = guest
    printing = cups
    printcap name = cups
    [printers]
    comment = All Printers
    path = /var/spool/samba
    printer admin = root
    guest ok = Yes
    printable = Yes
    use client driver = Yes
    browseable = No

    +

    Note

    + + +On CUPS-enabled systems there is a facility to pass raw data directly to the printer without +intermediate processing via CUPS print filters. Where use of this mode of operation is desired, +it is necessary to configure a raw printing device. It is also necessary to enable the raw mime +handler in the /etc/mime.conv and /etc/mime.types +files. Refer to . +

    Common Errors

    The greatest mistake so often made is to make a network configuration too complex. It pays to use the simplest solution that will meet the needs of the moment. -

    Prev Up Next
    Chapter 7. Domain Membership Home Chapter 9. MS Windows Network Configuration Guide
    +

    Prev Up Next
    Chapter 7. Domain Membership Home Chapter 9. MS Windows Network Configuration Guide
    diff --git a/docs/htmldocs/VFS.html b/docs/htmldocs/VFS.html index ffa767e6c9..cedacd4e07 100644 --- a/docs/htmldocs/VFS.html +++ b/docs/htmldocs/VFS.html @@ -1,102 +1,112 @@ -Chapter 20. Stackable VFS modules
    Chapter 20. Stackable VFS modules
    Prev Part III. Advanced Configuration Next

    Chapter 20. Stackable VFS modules

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Tim Potter

    Simo Sorce

    original vfs_skel README

    Alexander Bokovoy

    original vfs_netatalk docs

    Stefan Metzmacher

    Update for multiple modules

    Table of Contents

    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan

    Features and Benefits

    -Since Samba-3, there is support for stackable VFS(Virtual File System) modules. -Samba passes each request to access the unix file system thru the loaded VFS modules. -This chapter covers all the modules that come with the samba source and references to +Chapter 20. Stackable VFS modules

    Chapter 20. Stackable VFS modules
    Prev Part III. Advanced Configuration Next

    Chapter 20. Stackable VFS modules

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Tim Potter

    Samba Team

    Simo Sorce

    original vfs_skel README

    Alexander Bokovoy

    original vfs_netatalk docs

    Stefan Metzmacher

    Update for multiple modules

    Table of Contents

    Features and Benefits
    Discussion
    Included Modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS Modules Available Elsewhere
    DatabaseFS
    vscan

    Features and Benefits

    +Since Samba-3, there is support for stackable VFS (Virtual File System) modules. +Samba passes each request to access the UNIX file system through the loaded VFS modules. +This chapter covers all the modules that come with the Samba source and references to some external modules. -

    Discussion

    +

    Discussion

    If not supplied with your platform distribution binary Samba package you may have problems -to compile these modules, as shared libraries are compiled and linked in different ways -on different systems. They currently have been tested against GNU/Linux and IRIX. +compiling these modules, as shared libraries are compiled and linked in different ways +on different systems. They currently have been tested against GNU/Linux and IRIX.

    -To use the VFS modules, create a share similar to the one below. The -important parameter is the vfs objects parameter where +To use the VFS modules, create a share similar to the one below. The +important parameter is the vfs objects parameter where you can list one or more VFS modules by name. For example, to log all access -to files and put deleted files in a recycle bin: +to files and put deleted files in a recycle bin, see . -

    Example 20.1. smb.conf with VFS modules

    [audit]
    comment = Audited /data directory
    path = /data
    vfs objects = audit recycle
    writeable = yes
    browseable = yes

    +

    Example 20.1. smb.conf with VFS modules

    [audit]
    comment = Audited /data directory
    path = /data
    vfs objects = audit recycle
    writeable = yes
    browseable = yes

    The modules are used in the order in which they are specified.

    -Samba will attempt to load modules from the lib -directory in the root directory of the samba installation (usually -/usr/lib/samba/vfs or /usr/local/samba/lib/vfs +Samba will attempt to load modules from the /lib directory in the root directory of the +Samba installation (usually /usr/lib/samba/vfs or /usr/local/samba/lib/vfs ).

    Some modules can be used twice for the same share. -This can be done using a configuration similar to the one below. +This can be done using a configuration similar to the one shown in . -

    Example 20.2. smb.conf with multiple VFS modules

    [test]
    comment = VFS TEST
    path = /data
    writeable = yes
    browseable = yes
    vfs objects = example:example1 example example:test
    example1: parameter = 1
    example: parameter = 5
    test: parameter = 7

    -

    Included modules

    audit

    +

    Example 20.2. smb.conf with multiple VFS modules

    [test]
    comment = VFS TEST
    path = /data
    writeable = yes
    browseable = yes
    vfs objects = example:example1 example example:test
    example1: parameter = 1
    example: parameter = 5
    test: parameter = 7

    +

    Included Modules

    audit

    A simple module to audit file access to the syslog - facility. The following operations are logged: -

    • share

    • connect/disconnect

    • directory opens/create/remove

    • file open/close/rename/unlink/chmod

    -

    extd_audit

    - This module is identical with the audit module above except - that it sends audit logs to both syslog as well as the smbd log file/s. The - loglevel for this module is set in the smb.conf file. + facility. The following operations are logged: +

    • share
    • connect/disconnect
    • directory opens/create/remove
    • file open/close/rename/unlink/chmod

    +

    extd_audit

    + This module is identical with the audit module above except + that it sends audit logs to both syslog as well as the smbd log files. The + log level for this module is set in the smb.conf file.

    - The logging information that will be written to the smbd log file is controlled by - the log level parameter in smb.conf. The - following information will be recorded: -

    Table 20.1. Extended Auditing Log Information

    Log LevelLog Details - File and Directory Operations
    0Creation / Deletion
    1Create / Delete / Rename / Permission Changes
    2Create / Delete / Rename / Perm Change / Open / Close

    fake_perms

    + Valid settings and the information that will be recorded are shown in . +

    Table 20.1. Extended Auditing Log Information

    Log LevelLog Details - File and Directory Operations
    0Creation / Deletion
    1Create / Delete / Rename / Permission Changes
    2Create / Delete / Rename / Perm Change / Open / Close

    fake_perms

    This module was created to allow Roaming Profile files and directories to be set (on the Samba server - under Unix) as read only. This module will if installed on the Profiles share will report to the client + under UNIX) as read only. This module will, if installed on the Profiles share, report to the client that the Profile files and directories are writable. This satisfies the client even though the files will never be overwritten as the client logs out or shuts down. -

    recycle

    - A recycle-bin like module. When used any unlink call - will be intercepted and files moved to the recycle - directory instead of being deleted. This gives the same - effect as the "Recycle Bin" on Windows computers. -

    Supported options: -

    recycle:repository

    Relative path of the directory where deleted files should be moved to

    recycle:keeptree

    Specifies whether the directory structure should - be kept or if the files in the directory that is being - deleted should be kept seperately in the recycle bin. -

    recycle:versions

    If this option is set, two files - with the same name that are deleted will both - be kept in the recycle bin. Newer deleted versions - of a file will be called "Copy #x of filename".

    recycle:touch

    Specifies whether a file's access - date should be touched when the file is moved to - the recycle bin.

    recycle:maxsize

    Files that are larger than the number - of bytes specified by this parameter will - not be put into the recycle bin.

    recycle:exclude

    List of files that should not - be put into the recycle bin when deleted, but deleted - in the regular way.

    recycle:exclude_dir

    Contains a list of directories. When files from - these directories are deleted, they are not put into the - recycle bin, but deleted in the regular way. -

    recycle:noversions

    Opposite of recycle:versions. If both options are specified, this one takes precedence.

    -

    netatalk

    - A netatalk module, that will ease co-existence of samba and - netatalk file sharing services. +

    recycle

    + A Recycle Bin-like module. Where used, unlink calls will be intercepted and files moved + to the recycle directory instead of being deleted. This gives the same effect as the + Recycle Bin on Windows computers. +

    + The Recycle Bin will not appear in Windows Explorer views of the network file system + (share) nor on any mapped drive. Instead, a directory called .recycle will be + automatically created when the first file is deleted. Users can recover files from the + .recycle directory. If the recycle:keeptree has been + specified, deleted files will be found in a path identical with that from which the file was deleted. +

    Supported options for the recycle module are as follow: +

    recycle:repository

    + Relative path of the directory where deleted files should be moved. +

    recycle:keeptree

    + Specifies whether the directory structure should be kept or if the files in the directory that is being + deleted should be kept seperately in the recycle bin. +

    recycle:versions

    + If this option is set, two files + with the same name that are deleted will both + be kept in the recycle bin. Newer deleted versions + of a file will be called “Copy #x of filename”. +

    recycle:touch

    + Specifies whether a file's access date should be touched when the file is moved to the recycle bin. +

    recycle:maxsize

    + Files that are larger than the number of bytes specified by this parameter will not be put into the recycle bin. +

    recycle:exclude

    + List of files that should not be put into the recycle bin when deleted, but deleted in the regular way. +

    recycle:exclude_dir

    + Contains a list of directories. When files from these directories are + deleted, they are not put into the + recycle bin but are deleted in the + regular way. +

    recycle:noversions

    + Opposite of recycle:versions. If both options are specified, this one takes precedence. +

    +

    netatalk

    + A netatalk module will ease co-existence of Samba and netatalk file sharing services.

    Advantages compared to the old netatalk module: -

    • it doesn't care about creating of .AppleDouble forks, just keeps them in sync

    • if a share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically

    -

    VFS modules available elsewhere

    +

    • Does not care about creating .AppleDouble forks, just keeps them in sync.

    • If a share in smb.conf does not contain .AppleDouble item in hide or veto list, it will be added automatically.

    +

    VFS Modules Available Elsewhere

    This section contains a listing of various other VFS modules that -have been posted but don't currently reside in the Samba CVS -tree for one reason or another (e.g. it is easy for the maintainer +have been posted but do not currently reside in the Samba CVS +tree for one reason or another (e.g., it is easy for the maintainer to have his or her own CVS tree).

    No statements about the stability or functionality of any module should be implied due to its presence here. -

    DatabaseFS

    - URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php -

    By Eric Lorimer.

    - I have created a VFS module which implements a fairly complete read-only - filesystem. It presents information from a database as a filesystem in +

    DatabaseFS

    + URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php +

    By Eric Lorimer.

    + I have created a VFS module that implements a fairly complete read-only + filesystem. It presents information from a database as a filesystem in a modular and generic way to allow different databases to be used (originally designed for organizing MP3s under directories such as - "Artists," "Song Keywords," etc... I have since applied it to a student - roster database very easily). The directory structure is stored in the + “Artists,” “Song Keywords,” and so on. I have since easily + applied it to a student + roster database.) The directory structure is stored in the database itself and the module makes no assumptions about the database structure beyond the table it requires to run.

    Any feedback would be appreciated: comments, suggestions, patches, - etc... If nothing else, hopefully it might prove useful for someone + and so on. If nothing else, hopefully it might prove useful for someone else who wishes to create a virtual filesystem. -

    vscan

    URL: http://www.openantivirus.org/

    - samba-vscan is a proof-of-concept module for Samba, which +

    vscan

    URL: http://www.openantivirus.org/

    + samba-vscan is a proof-of-concept module for Samba, which uses the VFS (virtual file system) features of Samba 2.2.x/3.0 alphaX. Of course, Samba has to be compiled with VFS support. - samba-vscan supports various virus scanners and is maintained + samba-vscan supports various virus scanners and is maintained by Rainer Link. -

    Prev Up Next
    Chapter 19. CUPS Printing Support in Samba 3.0 Home Chapter 21. Winbind: Use of Domain Accounts
    +

    Prev Up Next
    Chapter 19. CUPS Printing Support Home Chapter 21. Winbind: Use of Domain Accounts
    diff --git a/docs/htmldocs/bugreport.html b/docs/htmldocs/bugreport.html index 49eb2117ca..0e963269d5 100644 --- a/docs/htmldocs/bugreport.html +++ b/docs/htmldocs/bugreport.html @@ -1,115 +1,117 @@ -Chapter 35. Reporting Bugs
    Chapter 35. Reporting Bugs
    Prev Part V. Troubleshooting Next

    Chapter 35. Reporting Bugs

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    27 June 1997

    Table of Contents

    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches

    Introduction

    Please report bugs using - bugzilla.

    -Please take the time to read this file before you submit a bug -report. Also, please see if it has changed between releases, as we -may be changing the bug reporting mechanism at some time. +Chapter 35. Reporting Bugs

    Chapter 35. Reporting Bugs
    Prev Part V. Troubleshooting Next

    Chapter 35. Reporting Bugs

    John H. Terpstra

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    27 June 1997

    Table of Contents

    Introduction
    General Information
    Debug Levels
    Internal Errors
    Attaching to a Running Process
    Patches

    Introduction

    Please report bugs using Samba's +Bugzilla facilities and +take the time to read this file before you submit a bug +report. Also, check to see if it has changed between releases, as we +may be changing the bug reporting mechanism at some point.

    -Please also do as much as you can yourself to help track down the +Please do as much as you can yourself to help track down the bug. Samba is maintained by a dedicated group of people who volunteer -their time, skills and efforts. We receive far more mail about it than -we can possibly answer, so you have a much higher chance of an answer -and a fix if you send us a "developer friendly" bug report that lets +their time, skills and efforts. We receive far more mail than +we can possibly answer, so you have a much higher chance of a response +and a fix if you send us a “developer friendly” bug report that lets us fix it fast.

    Do not assume that if you post the bug to the comp.protocols.smb newsgroup or the mailing list that we will read it. If you suspect that your -problem is not a bug but a configuration problem then it is better to send -it to the Samba mailing list, as there are (at last count) 5000 other users on -that list that may be able to help you. +problem is not a bug but a configuration problem, it is better to send +it to the Samba mailing list, as there are thousands of other users on +that list who may be able to help you.

    You may also like to look though the recent mailing list archives, -which are conveniently accessible on the Samba web pages -at http://samba.org/samba/. -

    General info

    -Before submitting a bug report check your config for silly -errors. Look in your log files for obvious messages that tell you that -you've misconfigured something and run testparm to test your config +which are conveniently accessible on the Samba Web pages +at http://samba.org/samba/. +

    General Information

    +Before submitting a bug report, check your config for silly +errors. Look in your log files for obvious messages that tell +you've misconfigured something. Run testparm to check your config file for correct syntax.

    -Have you run through the diagnosis? -This is very important. + Have you looked through ? This is extremely important.

    -If you include part of a log file with your bug report then be sure to +If you include part of a log file with your bug report, then be sure to annotate it with exactly what you were doing on the client at the -time, and exactly what the results were. -

    Debug levels

    +time and exactly what the results were. +

    Debug Levels

    If the bug has anything to do with Samba behaving incorrectly as a -server (like refusing to open a file) then the log files will probably -be very useful. Depending on the problem a log level of between 3 and +server (like refusing to open a file), then the log files will probably +be quite useful. Depending on the problem, a log level of between 3 and 10 showing the problem may be appropriate. A higher level gives more detail, but may use too much disk space.

    -To set the debug level use the log level in your +To set the debug level, use the log level in your smb.conf. You may also find it useful to set the log level higher for just one machine and keep separate logs for each machine. -To do this add the following lines to your main smb.conf file: +To do this, add the following lines to your main smb.conf file:

    log level = 10
    log file = /usr/local/samba/lib/log.%m
    include = /usr/local/samba/lib/smb.conf.%m

    -then create a file -/usr/local/samba/lib/smb.conf.machine where +and create a file /usr/local/samba/lib/smb.conf.machine where machine is the name of the client you wish to debug. In that file put any smb.conf commands you want, for example -log level may be useful. This also allows you to -experiment with different security systems, protocol levels etc on just +log level may be useful. This also allows you to +experiment with different security systems, protocol levels and so on, on just one machine.

    -The smb.conf entry log level -is synonymous with the parameter debuglevel that has -been used in older versions of Samba and is being retained for backwards +The smb.conf entry log level +is synonymous with the parameter debuglevel that has +been used in older versions of Samba and is being retained for backward compatibility of smb.conf files.

    -As the log level value is increased you will record -a significantly increasing level of debugging information. For most -debugging operations you may not need a setting higher than +As the log level value is increased, you will record +a significantly greater level of debugging information. For most +debugging operations, you may not need a setting higher than 3. Nearly all bugs can be tracked at a setting of 10, but be -prepared for a VERY large volume of log data. -

    Internal errors

    -If you get a INTERNAL ERROR message in your log files +prepared for a large volume of log data. +

    Internal Errors

    +If you get the message “INTERNAL ERROR” in your log files, it means that Samba got an unexpected signal while running. It is probably a segmentation fault and almost certainly means a bug in Samba (unless you have faulty hardware or system software).

    -If the message came from smbd then it will probably be accompanied by -a message which details the last SMB message received by smbd. This -info is often very useful in tracking down the problem so please +If the message came from smbd, it will probably be accompanied by +a message that details the last SMB message received by smbd. This +information is often useful in tracking down the problem so please include it in your bug report.

    You should also detail how to reproduce the problem, if possible. Please make this reasonably detailed. -

    +

    + You may also find that a core file appeared in a corefiles -subdirectory of the directory where you keep your samba log +subdirectory of the directory where you keep your Samba log files. This file is the most useful tool for tracking down the bug. To -use it you do this: -

    +use it, you do this:
+
+
+
     $ gdb smbd core
 
    
 adding appropriate paths to smbd and core so gdb can find them. If you
-don't have gdb then try dbx. Then within the debugger
+do not have gdb, try dbx. Then within the debugger,
 use the command where to give a stack trace of where the
 problem occurred. Include this in your report.
 
    
-If you know any assembly language then do a 
-disass of the routine
-where the problem occurred (if its in a library routine then
+If you know any assembly language, do a disass of the routine
+where the problem occurred (if its in a library routine, then
 disassemble the routine that called it) and try to work out exactly
 where the problem is by looking at the surrounding code. Even if you
-don't know assembly, including this info in the bug report can be
+do not know assembly, including this information in the bug report can be
 useful. 
-

    Attaching to a running process

    -Unfortunately some unixes (in particular some recent linux kernels) +

    Attaching to a Running Process

    +Unfortunately, some UNIXes (in particular some recent Linux kernels) refuse to dump a core file if the task has changed uid (which smbd -does often). To debug with this sort of system you could try to attach +does often). To debug with this sort of system, you could try to attach to the running process using gdb smbd PID where you get PID from smbstatus. Then use c to continue and try to cause the core dump using the client. The debugger should catch the fault and tell you where it occurred. -

    Patches

    +

    Patches

    + + The best sort of bug report is one that includes a fix! If you send us -patches please use diff -u format if your version of +patches, please use diff -u format if your version of diff supports it, otherwise use diff -c4. Make sure you do the diff against a clean version of the source and let me know exactly what version you used. -

    Prev Up Next
    Chapter 34. Analysing and solving samba problems Home Part VI. Appendixes
    +

    Prev Up Next
    Chapter 34. Analyzing and Solving Samba Problems Home Part VI. Appendixes
    diff --git a/docs/htmldocs/compiling.html b/docs/htmldocs/compiling.html index 95cdb0f581..17aed45b4c 100644 --- a/docs/htmldocs/compiling.html +++ b/docs/htmldocs/compiling.html @@ -1,150 +1,164 @@ -Chapter 36. How to compile Samba
    Chapter 36. How to compile Samba
    Prev Part VI. Appendixes Next

    Name

    smbcacls — Set or get ACLs on an NT file or directory names

    Synopsis

    smbcacls {//server/share} {filename} [-D acls] [-M acls] [-A acls] [-S acls] [-C name] [-G name] [-n] [-t] [-U username] [-h] [-d]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The smbcacls program manipulates NT Access Control +smbcacls

    Name

    smbcacls — Set or get ACLs on an NT file or directory names

    Synopsis

    smbcacls {//server/share} {filename} [-D acls] [-M acls] [-a acls] [-S acls] [-C name] [-G name] [-n] [-t] [-U username] [-h] [-d]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    The smbcacls program manipulates NT Access Control Lists (ACLs) on SMB file shares.

    OPTIONS

    The following options are available to the smbcacls program. - The format of ACLs is described in the section ACL FORMAT

    -A acls

    Add the ACLs specified to the ACL list. Existing + The format of ACLs is described in the section ACL FORMAT

    -a acls

    Add the ACLs specified to the ACL list. Existing access control entries are unchanged.

    -M acls

    Modify the mask value (permissions) for the ACLs specified on the command line. An error will be printed for each ACL specified that was not already present in the ACL list @@ -28,8 +28,8 @@ Don't actually do anything, only validate the correctness of the arguments.

    -h|--help

    Print a summary of command line options. -

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -42,13 +42,13 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension ".client" will be appended. The log file is never removed by the client. diff --git a/docs/htmldocs/smbclient.1.html b/docs/htmldocs/smbclient.1.html index 1ee5fd26da..1fc9f30a21 100644 --- a/docs/htmldocs/smbclient.1.html +++ b/docs/htmldocs/smbclient.1.html @@ -11,7 +11,7 @@ is the NetBIOS name of the SMB/CIFS server offering the desired service and service is the name of the service offered. Thus to connect to - the service "printer" on the SMB/CIFS server "smbserver", + the service "printer" on the SMB/CIFS server "smbserver", you would use the servicename //smbserver/printer

    Note that the server name required is NOT necessarily the IP (DNS) host name of the server ! The name required is @@ -39,7 +39,7 @@

    -R <name resolve order>

    This option is used by the programs in the Samba suite to determine what naming services and in what order to resolve host names to IP addresses. The option takes a space-separated - string of different name resolution options.

    The options are :"lmhosts", "host", "wins" and "bcast". They + string of different name resolution options.

    The options are :"lmhosts", "host", "wins" and "bcast". They cause names to be resolved as follows:

    • lmhosts: Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has no name type attached to the NetBIOS name (see @@ -65,7 +65,7 @@ this parameter or any entry in the name resolve order parameter of the smb.conf(5) file the name resolution methods will be attempted in this order.

    -M NetBIOS name

    This options allows you to send messages, using - the "WinPopup" protocol, to another computer. Once a connection is + the "WinPopup" protocol, to another computer. Once a connection is established you then type your message, pressing ^D (control-D) to end.

    If the receiving computer is running WinPopup the user will receive the message and probably a beep. If they are not running @@ -86,7 +86,7 @@ TCP port number for an SMB/CIFS server is 139, which is the default.

    -h|--help

    Print a summary of command line options.

    -I IP-address

    IP address is the address of the server to connect to. - It should be specified in standard "a.b.c.d" notation.

    Normally the client would attempt to locate a named + It should be specified in standard "a.b.c.d" notation.

    Normally the client would attempt to locate a named SMB/CIFS server by looking it up via the NetBIOS name resolution mechanism described above in the name resolve order parameter above. Using this parameter will force the client @@ -115,8 +115,8 @@ size when getting or putting a file from/to the server. The default is 65520 bytes. Setting this value smaller (to 1200 bytes) has been observed to speed up file transfers to and from a Win9x server. -

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -129,15 +129,15 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +".client" will be appended. The log file is never removed by the client.

    -N

    If specified, this parameter suppresses the normal password prompt from the client to the user. This is useful when @@ -170,7 +170,7 @@ via the ps command. To be safe always allow rpcclient to prompt for a password and type it in directly.

    -n <primary NetBIOS name>

    This option allows you to override the NetBIOS name that Samba uses for itself. This is identical -to setting the netbios name parameter in the smb.conf file. +to setting the netbios name parameter in the smb.conf file. However, a command line setting will take precedence over settings in smb.conf.

    -i <scope>

    This specifies a NetBIOS scope that @@ -191,13 +191,13 @@ options.

    -T tar options

    smbcli share. The secondary tar flags that can be given to this option are :

    • c - Create a tar file on UNIX. Must be followed by the name of a tar file, tape device - or "-" for standard output. If using standard output you must + or "-" for standard output. If using standard output you must turn the log level to its lowest value -d0 to avoid corrupting your tar file. This flag is mutually exclusive with the x flag.

    • x - Extract (restore) a local tar file back to a share. Unless the -D option is given, the tar files will be restored from the top level of the share. Must be - followed by the name of the tar file, device or "-" for standard + followed by the name of the tar file, device or "-" for standard input. Mutually exclusive with the c flag. Restored files have their creation times (mtime) set to the date saved in the tar file. Directories currently do not get @@ -235,21 +235,21 @@ options.

    -T tar options

    smbcli

    Tar Filenames

    All file names can be given as DOS path names (with '\\' as the component separator) or as UNIX path names (with '/' as the component separator).

    Examples

    Restore from tar file backup.tar into myshare on mypc - (no password on share).

    smbclient //mypc/yshare "" -N -Tx backup.tar + (no password on share).

    smbclient //mypc/yshare "" -N -Tx backup.tar

    Restore everything except users/docs -

    smbclient //mypc/myshare "" -N -TXx backup.tar +

    smbclient //mypc/myshare "" -N -TXx backup.tar users/docs

    Create a tar file of the files beneath - users/docs.

    smbclient //mypc/myshare "" -N -Tc + users/docs.

    smbclient //mypc/myshare "" -N -Tc backup.tar users/docs

    Create the same tar file as above, but now use - a DOS path name.

    smbclient //mypc/myshare "" -N -tc backup.tar + a DOS path name.

    smbclient //mypc/myshare "" -N -tc backup.tar users\edocs

    Create a tar file of all the files and directories in - the share.

    smbclient //mypc/myshare "" -N -Tc backup.tar * + the share.

    smbclient //mypc/myshare "" -N -Tc backup.tar *

    -D initial directory

    Change to initial directory before starting. Probably only of any use with the tar -T option.

    -c command string

    command string is a semicolon-separated list of commands to be executed instead of prompting from stdin. -N is implied by -c.

    This is particularly useful in scripts and for printing stdin to the server, e.g. -c 'print -'.

    OPERATIONS

    Once the client is running, the user is presented with - a prompt :

    smb:\>

    The backslash ("\\") indicates the current working directory + a prompt :

    smb:\>

    The backslash ("\\") indicates the current working directory on the server, and will change if the current working directory is changed.

    The prompt indicates that the client is ready and waiting to carry out a user command. Each command is a single word, optionally @@ -258,9 +258,9 @@ options.

    -T tar options

    smbcli state otherwise. All commands are case-insensitive. Parameters to commands may or may not be case sensitive, depending on the command.

    You can specify file names which have spaces in them by quoting - the name with double quotes, for example "a long file name".

    Parameters shown in square brackets (e.g., "[parameter]") are + the name with double quotes, for example "a long file name".

    Parameters shown in square brackets (e.g., "[parameter]") are optional. If not given, the command will use suitable defaults. Parameters - shown in angle brackets (e.g., "<parameter>") are required. + shown in angle brackets (e.g., "<parameter>") are required.

    Note that all commands operating on the server are actually performed by issuing a request to the server. Thus the behavior may vary from server to server, depending on how the server was implemented. @@ -271,7 +271,7 @@ options.

    -T tar options

    smbcli command will execute a shell locally and run the specified shell command. If no command is specified, a local shell will be run.

    altname file

    The client will request that the server return - the "alternate" name (the 8.3 name) for a file or directory. + the "alternate" name (the 8.3 name) for a file or directory.

    cancel jobid0 [jobid1] ... [jobidN]

    The client will request that the server cancel the printjobs identified by the given numeric print job ids.

    chmod file mode in octal

    This command depends on the server supporting the CIFS @@ -282,7 +282,7 @@ options.

    -T tar options

    smbcli change the UNIX user and group ownership to the given decimal values. Note there is currently no way to remotely look up the UNIX uid and gid values for a given name. This may be addressed in future versions of the CIFS UNIX extensions. -

    cd [directory name]

    If "directory name" is specified, the current +

    cd [directory name]

    If "directory name" is specified, the current working directory on the server will be changed to the directory specified. This operation will fail if for any reason the specified directory is inaccessible.

    If no directory name is specified, the current working @@ -314,15 +314,15 @@ options.

    -T tar options

    smbcli filters for directories rather than files when recursion is toggled ON.

    The mask specified with the mask command is necessary to filter files within those directories. For example, if the - mask specified in an mget command is "source*" and the mask - specified with the mask command is "*.c" and recursion is + mask specified in an mget command is "source*" and the mask + specified with the mask command is "*.c" and recursion is toggled ON, the mget command will retrieve all files matching - "*.c" in all directories below and including all directories - matching "source*" in the current working directory.

    Note that the value for mask defaults to blank (equivalent - to "*") and remains so until the mask command is used to change it. + "*.c" in all directories below and including all directories + matching "source*" in the current working directory.

    Note that the value for mask defaults to blank (equivalent + to "*") and remains so until the mask command is used to change it. It retains the most recently specified value indefinitely. To avoid unexpected results it would be wise to change the value of - mask back to "*" after using the mget or mput commands.

    md <directory name>

    See the mkdir command.

    mget <mask>

    Copy all files matching mask from the server to + mask back to "*" after using the mget or mput commands.

    md <directory name>

    See the mkdir command.

    mget <mask>

    Copy all files matching mask from the server to the machine running the client.

    Note that mask is interpreted differently during recursive operation and non-recursive operation - refer to the recurse and mask commands for more information. Note that all transfers in @@ -364,7 +364,7 @@ options.

    -T tar options

    smbcli

    tar <c|x>[IXbgNa]

    Performs a tar operation - see the -T command line option above. Behavior may be affected by the tarmode command (see below). Using g (incremental) and N - (newer) will affect tarmode settings. Note that using the "-" option + (newer) will affect tarmode settings. Note that using the "-" option with tar x may not work - use the command line option instead.

    blocksize <blocksize>

    Blocksize. Must be followed by a valid (greater than zero) blocksize. Causes tar file to be written out in @@ -410,8 +410,8 @@ options.

    -T tar options

    smbcli by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/smbcontrol.1.html b/docs/htmldocs/smbcontrol.1.html index e7ccd27f26..b12076e726 100644 --- a/docs/htmldocs/smbcontrol.1.html +++ b/docs/htmldocs/smbcontrol.1.html @@ -9,9 +9,9 @@ to provide. See smb.conf for more information. The default configuration file name is determined at compile time.

    -i

    Run interactively. Individual commands of the form destination message-type parameters can be entered - on STDIN. An empty command line or a "q" will quit the + on STDIN. An empty command line or a "q" will quit the program.

    destination

    One of nmbd, smbd or a process ID.

    The smbd destination causes the - message to "broadcast" to all smbd daemons.

    The nmbd destination causes the + message to "broadcast" to all smbd daemons.

    The nmbd destination causes the message to be sent to the nmbd daemon specified in the nmbd.pid file.

    If a single process ID is given, the message is sent to only that process.

    message-type

    Type of message to send. See @@ -20,18 +20,18 @@ compile time.

    -i

    Run interactiv connections to the named share. Note that this doesn't affect client connections to any other shares. This message-type takes an argument of the share name for which client connections will be closed, or the - "*" character which will close all currently open shares. + "*" character which will close all currently open shares. This may be useful if you made changes to the access controls on the share. This message can only be sent to smbd.

    debug

    Set debug level to the value specified by the parameter. This can be sent to any of the destinations.

    force-election

    This message causes the nmbd daemon to force a new browse master election.

    ping

    - Send specified number of "ping" messages and - wait for the same number of reply "pong" messages. This can be sent to + Send specified number of "ping" messages and + wait for the same number of reply "pong" messages. This can be sent to any of the destinations.

    profile

    Change profile settings of a daemon, based on the - parameter. The parameter can be "on" to turn on profile stats - collection, "off" to turn off profile stats collection, "count" + parameter. The parameter can be "on" to turn on profile stats + collection, "off" to turn off profile stats collection, "count" to enable only collection of count stats (time stats are - disabled), and "flush" to zero the current profile stats. This can + disabled), and "flush" to zero the current profile stats. This can be sent to any smbd or nmbd destinations.

    debuglevel

    Request debuglevel of a certain daemon and write it to stdout. This can be sent to any of the destinations.

    profilelevel

    @@ -65,8 +65,8 @@ compile time.

    -i

    Run interactiv by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/smbcquotas.1.html b/docs/htmldocs/smbcquotas.1.html index 59dcd106ed..2a439b4032 100644 --- a/docs/htmldocs/smbcquotas.1.html +++ b/docs/htmldocs/smbcquotas.1.html @@ -8,8 +8,8 @@

    -v

    Be verbose.

    -h|--help

    Print a summary of command line options. -

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -22,15 +22,15 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +".client" will be appended. The log file is never removed by the client.

    -N

    If specified, this parameter suppresses the normal password prompt from the client to the user. This is useful when @@ -83,4 +83,4 @@ it in directly.

    QU arguments, an exit status of 2 is returned.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar - to the way the Linux kernel is developed.

    smbcacls was written by Stefan Metzmacher.

    + to the way the Linux kernel is developed.

    smbcquotas was written by Stefan Metzmacher.

    diff --git a/docs/htmldocs/smbd.8.html b/docs/htmldocs/smbd.8.html index 291ddbc0f6..fd337acf83 100644 --- a/docs/htmldocs/smbd.8.html +++ b/docs/htmldocs/smbd.8.html @@ -42,14 +42,14 @@

    -S

    If specified, this parameter causes smbd to log to standard output rather than a file.

    -i

    If this parameter is specified it causes the - server to run "interactively", not as a daemon, even if the + server to run "interactively", not as a daemon, even if the server is executed on the command line of a shell. Setting this parameter negates the implicit deamon mode when run from the command line. smbd also logs to standard output, as if the -S parameter had been given. -

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -62,26 +62,26 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +".client" will be appended. The log file is never removed by the client.

    -h|--help

    Print a summary of command line options.

    -b

    Prints information about how Samba was built.

    -l <log directory>

    If specified, log directory - specifies a log directory into which the "log.smbd" log + specifies a log directory into which the "log.smbd" log file will be created for informational and debug messages from the running server. The log file generated is never removed by the server although its size may be controlled by the - max log size + max log size option in the smb.conf(5) file. Beware: If the directory specified does not exist, smbd will log to the default debug log location defined at compile time. @@ -127,7 +127,7 @@ never removed by the client. is not specific to the server, however.

    PAM INTERACTION

    Samba uses PAM for authentication (when presented with a plaintext password), for account checking (is this account disabled?) and for session management. The degree too which samba supports PAM is restricted - by the limitations of the SMB protocol and the obey pam restrictions smb.conf(5) paramater. When this is set, the following restrictions apply: + by the limitations of the SMB protocol and the obey pam restrictions smb.conf(5) paramater. When this is set, the following restrictions apply:

    • Account Validation: All accesses to a samba server are checked against PAM to see if the account is vaild, not disabled and is permitted to @@ -165,14 +165,14 @@ never removed by the client. them after, however this would affect performance.

    SEE ALSO

    hosts_access(5), inetd(8), nmbd(8), smb.conf(5), smbclient(1), testparm(1), testprns(1), and the Internet RFC's rfc1001.txt, rfc1002.txt. In addition the CIFS (formerly SMB) specification is available - as a link from the Web page - http://samba.org/cifs/.

    AUTHOR

    The original Samba software and related utilities + as a link from the Web page + http://samba.org/cifs/.

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/smbmnt.8.html b/docs/htmldocs/smbmnt.8.html index 8caedac3f5..6982fa191b 100644 --- a/docs/htmldocs/smbmnt.8.html +++ b/docs/htmldocs/smbmnt.8.html @@ -16,8 +16,8 @@

    AUTHOR

    Volker Lendecke, Andrew Tridgell, Michael H. Warfield and others.

    The current maintainer of smbfs and the userspace tools smbmount, smbumount, - and smbmnt is Urban Widmark. - The SAMBA Mailing list + and smbmnt is Urban Widmark. + The SAMBA Mailing list is the preferred place to ask questions regarding these programs.

    The conversion of this manpage for Samba 2.2 was performed by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 diff --git a/docs/htmldocs/smbmount.8.html b/docs/htmldocs/smbmount.8.html index 64968b5de7..ec0c69bde1 100644 --- a/docs/htmldocs/smbmount.8.html +++ b/docs/htmldocs/smbmount.8.html @@ -55,7 +55,7 @@ password = <value> tracking down SMB connection problems. A suggested value to start with is 4. If set too high there will be a lot of output, possibly hiding the useful output.

    ip=<arg>

    Sets the destination host or IP address. -

    workgroup=<arg>

    Sets the workgroup on the destination

    sockopt=<arg>

    Sets the TCP socket options. See the smb.conf(5) socket options option. +

    workgroup=<arg>

    Sets the workgroup on the destination

    sockopt=<arg>

    Sets the TCP socket options. See the smb.conf5 socket options option.

    scope=<arg>

    Sets the NetBIOS scope

    guest

    Don't prompt for a password

    ro

    mount read-only

    rw

    mount read-write

    iocharset=<arg>

    sets the charset used by the Linux side for codepage to charset translations (NLS). Argument should be the @@ -100,8 +100,8 @@ password = <value> Sharity or perhaps replacing the SMB server with a NFS server.

    AUTHOR

    Volker Lendecke, Andrew Tridgell, Michael H. Warfield and others.

    The current maintainer of smbfs and the userspace tools smbmount, smbumount, - and smbmnt is Urban Widmark. - The SAMBA Mailing list + and smbmnt is Urban Widmark. + The SAMBA Mailing list is the preferred place to ask questions regarding these programs.

    The conversion of this manpage for Samba 2.2 was performed by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 diff --git a/docs/htmldocs/smbpasswd.5.html b/docs/htmldocs/smbpasswd.5.html index feb899f946..b65ad2dadf 100644 --- a/docs/htmldocs/smbpasswd.5.html +++ b/docs/htmldocs/smbpasswd.5.html @@ -83,8 +83,8 @@ by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/smbpasswd.8.html b/docs/htmldocs/smbpasswd.8.html index 7c98e4b080..d1fe572c35 100644 --- a/docs/htmldocs/smbpasswd.8.html +++ b/docs/htmldocs/smbpasswd.8.html @@ -127,7 +127,7 @@ has been configured to use the experimental --with-ldapsam option. The -w switch is used to specify the password to be used with the - ldap admin dn. Note that the password is stored in + ldap admin dn. Note that the password is stored in the secrets.tdb and is keyed off of the admin's DN. This means that if the value of ldap admin dn ever changes, the password will need to be @@ -153,8 +153,8 @@ by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/smbsh.1.html b/docs/htmldocs/smbsh.1.html index d1360d849d..fb49f92aa9 100644 --- a/docs/htmldocs/smbsh.1.html +++ b/docs/htmldocs/smbsh.1.html @@ -27,13 +27,13 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -R <name resolve order>

    This option is used to determine what naming services and in what order to resolve host names to IP addresses. The option takes a space-separated @@ -66,9 +66,9 @@ resolution methods as it depends on the target host being on a locally connected subnet.

    If this parameter is not set then the name resolve order defined in the smb.conf file parameter -(name resolve order) will be used. +(name resolve order) will be used.

    The default order is lmhosts, host, wins, bcast. Without -this parameter or any entry in the name resolve order parameter of the smb.conf file, the name +this parameter or any entry in the name resolve order parameter of the smb.conf file, the name resolution methods will be attempted in this order.

    -L libdir

    This parameter specifies the location of the shared libraries used by smbsh. The default value is specified at compile time. @@ -101,8 +101,8 @@ resolution methods will be attempted in this order.

    - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/smbspool.8.html b/docs/htmldocs/smbspool.8.html index 7366ab458f..d0365fa6df 100644 --- a/docs/htmldocs/smbspool.8.html +++ b/docs/htmldocs/smbspool.8.html @@ -28,8 +28,8 @@ by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/smbstatus.1.html b/docs/htmldocs/smbstatus.1.html index 99b152e75c..ab268aec23 100644 --- a/docs/htmldocs/smbstatus.1.html +++ b/docs/htmldocs/smbstatus.1.html @@ -1,8 +1,8 @@ smbstatus

    Name

    smbstatus — report on current Samba connections

    Synopsis

    smbstatus [-P] [-b] [-d <debug level>] [-v] [-L] [-B] [-p] [-S] [-s <configuration file>] [-u <username>]

    DESCRIPTION

    This tool is part of the Samba(7) suite.

    smbstatus is a very simple program to list the current Samba connections.

    OPTIONS

    -P|--profile

    If samba has been compiled with the profiling option, print only the contents of the profiling - shared memory area.

    -b|--brief

    gives brief output.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the + shared memory area.

    -b|--brief

    gives brief output.

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -15,15 +15,15 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension -".client" will be appended. The log file is +".client" will be appended. The log file is never removed by the client.

    -v|--verbose

    gives verbose output.

    -L|--locks

    causes smbstatus to only list locks.

    -B|--byterange

    causes smbstatus to include byte range locks.

    -p|--processes

    print a list of smbd(8) processes and exit. @@ -35,8 +35,8 @@ never removed by the client. by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/smbtar.1.html b/docs/htmldocs/smbtar.1.html index 95aabf1bc3..aa084944c2 100644 --- a/docs/htmldocs/smbtar.1.html +++ b/docs/htmldocs/smbtar.1.html @@ -27,13 +27,13 @@ the Samba suite.

    SEE ALSO

    smbd(8), smbclient(1), smb.conf(5).

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar - to the way the Linux kernel is developed.

    Ricky Poulten + to the way the Linux kernel is developed.

    Ricky Poulten wrote the tar extension and this man page. The smbtar - script was heavily rewritten and improved by Martin Kraemer. Many + script was heavily rewritten and improved by Martin Kraemer. Many thanks to everyone who suggested extensions, improvements, bug fixes, etc. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/smbtree.1.html b/docs/htmldocs/smbtree.1.html index cc683838dd..4d18bba56c 100644 --- a/docs/htmldocs/smbtree.1.html +++ b/docs/htmldocs/smbtree.1.html @@ -11,8 +11,8 @@ master browser

    -S

    Only print a list of all the domains and servers responding on broadcast or known by the master browser. -

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -25,13 +25,13 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension ".client" will be appended. The log file is never removed by the client. diff --git a/docs/htmldocs/smbumount.8.html b/docs/htmldocs/smbumount.8.html index f0aa0f974d..73a6e45cac 100644 --- a/docs/htmldocs/smbumount.8.html +++ b/docs/htmldocs/smbumount.8.html @@ -8,8 +8,8 @@ to make umount setuid root.

    OPTIONS

    mount-point

    The directory to unmount.

    SEE ALSO

    smbmount(8)

    AUTHOR

    Volker Lendecke, Andrew Tridgell, Michael H. Warfield and others.

    The current maintainer of smbfs and the userspace tools smbmount, smbumount, - and smbmnt is Urban Widmark. - The SAMBA Mailing list + and smbmnt is Urban Widmark. + The SAMBA Mailing list is the preferred place to ask questions regarding these programs.

    The conversion of this manpage for Samba 2.2 was performed by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 diff --git a/docs/htmldocs/speed.html b/docs/htmldocs/speed.html index 47f19abb70..b55989d053 100644 --- a/docs/htmldocs/speed.html +++ b/docs/htmldocs/speed.html @@ -1,140 +1,141 @@ -Chapter 39. Samba Performance Tuning

    Chapter 39. Samba Performance Tuning
    Prev Part VI. Appendixes Next

    Chapter 39. Samba Performance Tuning

    Paul Cochrane

    Dundee Limb Fitting Centre

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files

    Comparisons

    +Chapter 39. Samba Performance Tuning

    Chapter 39. Samba Performance Tuning
    Prev Part VI. Appendixes Next

    Chapter 39. Samba Performance Tuning

    Paul Cochrane

    Dundee Limb Fitting Centre

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Comparisons
    Socket Options
    Read Size
    Max Xmit
    Log Level
    Read Raw
    Write Raw
    Slow Logins
    Client Tuning
    Samba Performance Problem Due to Changing Linux Kernel
    Corrupt tdb Files

    Comparisons

    The Samba server uses TCP to talk to the client. Thus if you are -trying to see if it performs well you should really compare it to +trying to see if it performs well, you should really compare it to programs that use the same protocol. The most readily available -programs for file transfer that use TCP are ftp or another TCP based +programs for file transfer that use TCP are ftp or another TCP-based SMB server.

    -If you want to test against something like a NT or WfWg server then +If you want to test against something like an NT or Windows for Workgroups server, then you will have to disable all but TCP on either the client or -server. Otherwise you may well be using a totally different protocol +server. Otherwise, you may well be using a totally different protocol (such as NetBEUI) and comparisons may not be valid.

    -Generally you should find that Samba performs similarly to ftp at raw +Generally, you should find that Samba performs similarly to ftp at raw transfer speed. It should perform quite a bit faster than NFS, -although this very much depends on your system. +although this depends on your system.

    Several people have done comparisons between Samba and Novell, NFS or -WinNT. In some cases Samba performed the best, in others the worst. I -suspect the biggest factor is not Samba vs some other system but the +Windows NT. In some cases Samba performed the best, in others the worst. I +suspect the biggest factor is not Samba versus some other system, but the hardware and drivers used on the various systems. Given similar -hardware Samba should certainly be competitive in speed with other +hardware, Samba should certainly be competitive in speed with other systems. -

    Socket options

    +

    Socket Options

    There are a number of socket options that can greatly affect the -performance of a TCP based server like Samba. +performance of a TCP-based server like Samba.

    The socket options that Samba uses are settable both on the command line with the -O option, or in the smb.conf file.

    -The socket options section of the smb.conf manual page describes how +The socket options section of the smb.conf manual page describes how to set these and gives recommendations.

    -Getting the socket options right can make a big difference to your +Getting the socket options correct can make a big difference to your performance, but getting them wrong can degrade it by just as much. The correct settings are very dependent on your local network.

    -The socket option TCP_NODELAY is the one that seems to make the -biggest single difference for most networks. Many people report that -adding socket options = TCP_NODELAY doubles the read -performance of a Samba drive. The best explanation I have seen for this is -that the Microsoft TCP/IP stack is slow in sending tcp ACKs. -

    Read size

    -The option read size affects the overlap of disk +The socket option TCP_NODELAY is the one that seems to make the biggest single difference +for most networks. Many people report that adding +socket options = TCP_NODELAY +doubles the read performance of a Samba drive. The best explanation I have seen for +this is that the Microsoft TCP/IP stack is slow in sending TCP ACKs. +

    Read Size

    +The option read size affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and -SMBreadbraw) is larger than this value then the server begins writing +SMBreadbraw) is larger than this value, then the server begins writing the data before it has received the whole packet from the network, or in the case of SMBreadbraw, it begins writing to the network before all the data has been read from disk.

    This overlapping works best when the speeds of disk and network access -are similar, having very little effect when the speed of one is much +are similar, having little effect when the speed of one is much greater than the other.

    -The default value is 16384, but very little experimentation has been -done yet to determine the optimal value, and it is likely that the best +The default value is 16384, but little experimentation has been +done as yet to determine the optimal value, and it is likely that the best value will vary greatly between systems anyway. A value over 65536 is pointless and will cause you to allocate memory unnecessarily. -

    Max xmit

    +

    Max Xmit

    At startup the client and server negotiate a maximum transmit size, which limits the size of nearly all SMB commands. You can set the -maximum size that Samba will negotiate using the max xmit option +maximum size that Samba will negotiate using the max xmit option in smb.conf. Note that this is the maximum size of SMB requests that -Samba will accept, but not the maximum size that the *client* will accept. +Samba will accept, but not the maximum size that the client will accept. The client maximum receive size is sent to Samba by the client and Samba -honours this limit. +honors this limit.

    It defaults to 65536 bytes (the maximum), but it is possible that some clients may perform better with a smaller transmit unit. Trying values of less than 2048 is likely to cause severe problems. -

    In most cases the default is the best option. -

    Log level

    -If you set the log level (also known as debug level) higher than 2 +

    Log Level

    +If you set the log level (also known as debug level) higher than 2 then you may suffer a large drop in performance. This is because the -server flushes the log file after each operation, which can be very +server flushes the log file after each operation, which can be quite expensive. -

    Read raw

    -The read raw operation is designed to be an optimised, low-latency +

    Read Raw

    +The read raw operation is designed to be an optimized, low-latency file read operation. A server may choose to not support it, -however. and Samba makes support for read raw optional, with it +however, and Samba makes support for read raw optional, with it being enabled by default.

    -In some cases clients don't handle read raw very well and actually +In some cases clients do not handle read raw very well and actually get lower performance using it than they get using the conventional read operations.

    -So you might like to try read raw = no and see what happens on your -network. It might lower, raise or not affect your performance. Only +So you might like to try read raw = no and see what happens on your +network. It might lower, raise or not effect your performance. Only testing can really tell. -

    Write raw

    -The write raw operation is designed to be an optimised, low-latency -file write operation. A server may choose to not support it, -however. and Samba makes support for write raw optional, with it -being enabled by default. +

    Write Raw

    +The write raw operation is designed to be an optimized, low-latency +file write operation. A server may choose to not support it, however, and Samba makes support for +write raw optional, with it being enabled by default.

    -Some machines may find write raw slower than normal write, in which +Some machines may find write raw slower than normal write, in which case you may wish to change this option. -

    Slow Logins

    +

    Slow Logins

    Slow logins are almost always due to the password checking time. Using -the lowest practical password level will improve things. -

    Client tuning

    +the lowest practical password level will improve things. +

    Client Tuning

    Often a speed problem can be traced to the client. The client (for example Windows for Workgroups) can often be tuned for better TCP performance. Check the sections on the various clients in -Samba and Other Clients. -

    Samba performance problem due changing kernel

    -Hi everyone. I am running Gentoo on my server and samba 2.2.8a. Recently -I changed kernel version from linux-2.4.19-gentoo-r10 to -linux-2.4.20-wolk4.0s. And now I have performance issue with samba. Ok -many of you will probably say that move to vanilla sources...well I tried -it too and it didn't work. I have 100mb LAN and two computers (linux + -Windows2000). Linux server shares directory with DivX files, client -(windows2000) plays them via LAN. Before when I was running 2.4.19 kernel -everything was fine, but now movies freezes and stops...I tried moving -files between server and Windows and it's terribly slow. -

    -Grab mii-tool and check the duplex settings on the NIC. +. +

    Samba Performance Problem Due to Changing Linux Kernel

    +A user wrote the following to the mailing list: +

    +I am running Gentoo on my server and Samba 2.2.8a. Recently +I changed kernel version from linux-2.4.19-gentoo-r10 to +linux-2.4.20-wolk4.0s. And now I have a performance issue with Samba. +Many of you will probably say, “Move to vanilla sources!” +Well, I tried that and it didn't work. I have a 100mb LAN and two computers (Linux and +Windows 2000). The Linux server shares directories with DivX files, the client +(Windows 2000) plays them via LAN. Before when I was running the 2.4.19 kernel +everything was fine, but now movies freeze and stop. I tried moving +files between the server and Windows and it is terribly slow. +

    +The answer he was given is: +

    +Grab the mii-tool and check the duplex settings on the NIC. My guess is that it is a link layer issue, not an application -layer problem. Also run ifconfig and verify that the framing -error, collisions, etc... look normal for ethernet. -

    Corrupt tdb Files

    -Well today it happened, Our first major problem using samba. -Our samba PDC server has been hosting 3 TB of data to our 500+ users -[Windows NT/XP] for the last 3 years using samba, no problem. -But today all shares went SLOW; very slow. Also the main smbd kept +layer problem. Also run ifconfig and verify that the framing +error, collisions, and so on, look normal for ethernet. +

    Corrupt tdb Files

    +Our Samba PDC server has been hosting three TB of data to our 500+ users +[Windows NT/XP] for the last three years using Samba without a problem. +Today all shares went very slow. Also the main smbd kept spawning new processes so we had 1600+ running smbd's (normally we avg. 250). -It crashed the SUN E3500 cluster twice. After a lot of searching I +It crashed the SUN E3500 cluster twice. After a lot of searching, I decided to rm /var/locks/*.tdb. Happy again.

    -Q1) Is there any method of keeping the *.tdb files in top condition or -how to early detect corruption? +Question: Is there any method of keeping the *.tdb files in top condition or +how can I detect early corruption?

    -A1) Yes, run tdbbackup each time after stopping nmbd and before starting nmbd. +Answer: Yes, run tdbbackup each time after stopping nmbd and before starting nmbd.

    -Q2) What I also would like to mention is that the service latency seems -a lot lower then before the locks cleanup, any ideas on keeping it top notch? +Question: What I also would like to mention is that the service latency seems +a lot lower than before the locks cleanup. Any ideas on keeping it top notch?

    -A2) Yes! Same answer as for Q1! -

    Prev Up Next
    Chapter 38. Samba and other CIFS clients Home Chapter 40. DNS and DHCP Configuration Guide
    +Answer: Yes. Same answer as for previous question! +

    Prev Up Next
    Chapter 38. Samba and Other CIFS Clients Home Chapter 40. DNS and DHCP Configuration Guide
    diff --git a/docs/htmldocs/swat.8.html b/docs/htmldocs/swat.8.html index a7f2eaaf5b..8e31651272 100644 --- a/docs/htmldocs/swat.8.html +++ b/docs/htmldocs/swat.8.html @@ -13,8 +13,8 @@

    -a

    This option disables authentication and puts swat in demo mode. In that mode anyone will be able to modify the smb.conf file.

    WARNING: Do NOT enable this option on a production - server.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the + server.

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -27,13 +27,13 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension ".client" will be appended. The log file is never removed by the client. @@ -78,8 +78,8 @@ never removed by the client. by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/testparm.1.html b/docs/htmldocs/testparm.1.html index 3732b53f4c..ff379ecad2 100644 --- a/docs/htmldocs/testparm.1.html +++ b/docs/htmldocs/testparm.1.html @@ -14,8 +14,8 @@ to test the output from testparm.

    OPTIONS

    -s

    Without this option, testparm will prompt for a carriage return after printing the service names and before dumping the service definitions.

    -h|--help

    Print a summary of command line options. -

    -V

    Prints the version number for -smbd.

    -L servername

    Sets the value of the %L macro to servername. +

    -V

    Prints the program version number. +

    -L servername

    Sets the value of the %L macro to servername. This is useful for testing include files specified with the %L macro.

    -v

    If this option is specified, testparm will also output all options that were not used in smb.conf(5) and are thus set to their defaults.

    -t encoding

    @@ -44,8 +44,8 @@ by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/testprns.1.html b/docs/htmldocs/testprns.1.html index b63483d5de..156ec6bfec 100644 --- a/docs/htmldocs/testprns.1.html +++ b/docs/htmldocs/testprns.1.html @@ -31,8 +31,8 @@ by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/troubleshooting.html b/docs/htmldocs/troubleshooting.html index d18399caeb..76880a0fff 100644 --- a/docs/htmldocs/troubleshooting.html +++ b/docs/htmldocs/troubleshooting.html @@ -1 +1 @@ -Part V. Troubleshooting
    Part V. Troubleshooting
    Prev   Next

    Troubleshooting

    Table of Contents

    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    34. Analysing and solving samba problems
    Diagnostics tools
    Debugging with Samba itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches
    Prev Up Next
    Chapter 32. SWAT - The Samba Web Administration Tool Home Chapter 33. The Samba checklist
    +Part V. Troubleshooting
    Part V. Troubleshooting
    Prev   Next

    Troubleshooting

    Table of Contents

    33. The Samba Checklist
    Introduction
    Assumptions
    The Tests
    34. Analyzing and Solving Samba Problems
    Diagnostics Tools
    Debugging with Samba Itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting Mailing List Help
    How to Get Off the Mailing Lists
    35. Reporting Bugs
    Introduction
    General Information
    Debug Levels
    Internal Errors
    Attaching to a Running Process
    Patches
    Prev Up Next
    Chapter 32. SWAT The Samba Web Administration Tool Home Chapter 33. The Samba Checklist
    diff --git a/docs/htmldocs/type.html b/docs/htmldocs/type.html index 5322995de4..b85042f009 100644 --- a/docs/htmldocs/type.html +++ b/docs/htmldocs/type.html @@ -1,5 +1,5 @@ -Part II. Server Configuration Basics
    Part II. Server Configuration Basics
    Prev   Next

    Server Configuration Basics

    First Steps in Server Configuration

    +Part II. Server Configuration Basics

    Part II. Server Configuration Basics
    Prev   Next

    Server Configuration Basics

    First Steps in Server Configuration

    Samba can operate in various modes within SMB networks. This HOWTO section contains information on configuring samba to function as the type of server your network requires. Please read this section carefully. -

    Table of Contents

    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password checking
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    '$' cannot be included in machine name
    Joining domain fails because of existing machine account
    The system can not log you on (C000019B)....
    The machine trust account not accessible
    Account disabled
    Domain Controller Unavailable
    Can not log onto domain member workstation after joining domain
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    I can't join a Windows 2003 PDC
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    Prev Up Next
    Chapter 3. Fast Start for the Impatient Home Chapter 4. Server Types and Security Modes
    +

    Table of Contents

    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password Checking
    Common Errors
    What Makes Samba a Server?
    What Makes Samba a Domain Controller?
    What Makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    $ Cannot Be Included in Machine Name
    Joining Domain Fails Because of Existing Machine Account
    The System Cannot Log You On (C000019B)
    The Machine Trust Account Is Not Accessible
    Account Disabled
    Domain Controller Unavailable
    Cannot Log onto Domain Member Workstation After Joining Domain
    6. Backup Domain Control
    Features and Benefits
    Essential Background Information
    MS Windows NT4-style Domain Control
    LDAP Configuration Notes
    Active Directory Domain Control
    What Qualifies a Domain Controller on the Network?
    How does a Workstation find its Domain Controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts Keep Expiring
    Can Samba Be a Backup Domain Controller to an NT4 PDC?
    How Do I Replicate the smbpasswd File?
    Can I Do This All with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Managing Domain Machine Accounts using NT4 Server Manager
    On-the-Fly Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4-type Domain with Samba-3
    Why Is This Better Than security = server?
    Samba ADS Domain Membership
    Configure smb.conf
    Configure /etc/krb5.conf
    Create the Computer Account
    Testing Server Setup
    Testing with smbclient
    Notes
    Sharing User ID Mappings between Samba Domain Members
    Common Errors
    Cannot Add Machine Back to Domain
    Adding Machine to Domain Fails
    I Can't Join a Windows 2003 PDC
    8. Stand-alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    Prev Up Next
    Chapter 3. Fast Start for the Impatient Home Chapter 4. Server Types and Security Modes
    diff --git a/docs/htmldocs/unicode.html b/docs/htmldocs/unicode.html index a4f568576d..01cc974f5c 100644 --- a/docs/htmldocs/unicode.html +++ b/docs/htmldocs/unicode.html @@ -1,4 +1,4 @@ -Chapter 27. Unicode/Charsets
    Chapter 27. Unicode/Charsets
    Prev Part III. Advanced Configuration Next

    Chapter 27. Unicode/Charsets

    Jelmer R. Vernooij

    The Samba Team

    TAKAHASHI Motonobu

    25 March 2003

    Table of Contents

    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    Common errors
    CP850.so can't be found

    Features and Benefits

    +Chapter 27. Unicode/Charsets

    Chapter 27. Unicode/Charsets
    Prev Part III. Advanced Configuration Next

    Chapter 27. Unicode/Charsets

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    TAKAHASHI Motonobu

    25 March 2003

    Table of Contents

    Features and Benefits
    What Are Charsets and Unicode?
    Samba and Charsets
    Conversion from Old Names
    Japanese Charsets
    Common Errors
    CP850.so Can't Be Found

    Features and Benefits

    Every industry eventually matures. One of the great areas of maturation is in the focus that has been given over the past decade to make it possible for anyone anywhere to use a computer. It has not always been that way, in fact, not so long @@ -6,62 +6,64 @@ ago it was common for software to be written for exclusive use in the country of origin.

    Of all the effort that has been brought to bear on providing native language support -for all computer users, the efforts of the Openi18n organisation is deserving of +for all computer users, the efforts of the Openi18n organization is deserving of special mention.

    Samba-2.x supported a single locale through a mechanism called codepages. Samba-3 is destined to become a truly trans-global -file and printer sharing platform. -

    What are charsets and unicode?

    +file and printer-sharing platform. +

    What Are Charsets and Unicode?

    Computers communicate in numbers. In texts, each number will be translated to a corresponding letter. The meaning that will be assigned -to a certain number depends on the character set(charset) +to a certain number depends on the character set (charset) that is used. +

    A charset can be seen as a table that is used to translate numbers to letters. Not all computers use the same charset (there are charsets -with German umlauts, Japanese characters, etc). Usually a charset contains +with German umlauts, Japanese characters, and so on). Usually a charset contains 256 characters, which means that storing a character with it takes exactly one byte.

    There are also charsets that support even more characters, -but those need twice(or even more) as much storage space. These +but those need twice as much storage space (or more). These charsets can contain 256 * 256 = 65536 characters, which -is more then all possible characters one could think of. They are called -multibyte charsets (because they use more then one byte to -store one character). +is more than all possible characters one could think of. They are called +multibyte charsets because they use more then one byte to +store one character.

    - A standardised multibyte charset is unicode. +A standardized multibyte charset is unicode. A big advantage of using a multibyte charset is that you only need one; there is no need to make sure two computers use the same charset when they are communicating. -

    Old windows clients use single-byte charsets, named -'codepages' by Microsoft. However, there is no support for -negotiating the charset to be used in the smb protocol. Thus, you +

    Old Windows clients use single-byte charsets, named +codepages, by Microsoft. However, there is no support for +negotiating the charset to be used in the SMB/CIFS protocol. Thus, you have to make sure you are using the same charset when talking to an older client. -Newer clients (Windows NT, 2K, XP) talk unicode over the wire. -

    Samba and charsets

    -As of samba 3.0, samba can (and will) talk unicode over the wire. Internally, -samba knows of three kinds of character sets: -

    unix charset

    +Newer clients (Windows NT, 200x, XP) talk unicode over the wire. +

    Samba and Charsets

    +As of Samba-3.0, Samba can (and will) talk unicode over the wire. Internally, +Samba knows of three kinds of character sets: +

    unix charset

    This is the charset used internally by your operating system. The default is UTF-8, which is fine for most - systems. The default in previous samba releases was ASCII. -

    display charset

    This is the charset samba will use to print messages - on your screen. It should generally be the same as the unix charset. -

    dos charset

    This is the charset samba uses when communicating with - DOS and Windows 9x clients. It will talk unicode to all newer clients. + systems, which covers all characters in all languages. The default in previous Samba releases was ASCII. +

    display charset

    This is the charset Samba will use to print messages + on your screen. It should generally be the same as the unix charset. +

    dos charset

    This is the charset Samba uses when communicating with + DOS and Windows 9x/Me clients. It will talk unicode to all newer clients. The default depends on the charsets you have installed on your system. - Run testparm -v | grep "dos charset" to see + Run testparm -v | grep "dos charset" to see what the default is on your system. -

    Conversion from old names

    Because previous samba versions did not do any charset conversion, -characters in filenames are usually not correct in the unix charset but only -for the local charset used by the DOS/Windows clients.

    Bjoern Jacke has written a utility named convm that can convert whole directory - structures to different charsets with one single command. -

    Japanese charsets

    Samba doesn't work correctly with Japanese charsets yet. Here are -points of attention when setting it up:

    • You should set mangling method = hash

    • There are various iconv() implementations around and not -all of them work equally well. glibc2's iconv() has a critical problem -in CP932. libiconv-1.8 works with CP932 but still has some problems and -does not work with EUC-JP.

    • You should set dos charset = CP932, not -Shift_JIS, SJIS...

    • Currently only unix charset = CP932 -will work (but still has some problems...) because of iconv() issues. -unix charset = EUC-JP doesn't work well because of -iconv() issues.

    • Currently Samba 3.0 does not support unix charset = UTF8-MAC/CAP/HEX/JIS*

    More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

    Common errors

    CP850.so can't be found

    “Samba is complaining about a missing CP850.so file”.

    CP850 is the default dos charset. The dos charset is used to convert data to the codepage used by your dos clients. If you don't have any dos clients, you can safely ignore this message.

    CP850 should be supported by your local iconv implementation. Make sure you have all the required packages installed. If you compiled samba from source, make sure configure found iconv.

    Prev Up Next
    Chapter 26. Integrating MS Windows networks with Samba Home Chapter 28. Samba Backup Techniques
    +

    Conversion from Old Names

    Because previous Samba versions did not do any charset conversion, +characters in filenames are usually not correct in the UNIX charset but only +for the local charset used by the DOS/Windows clients.

    Japanese Charsets

    Samba does not work correctly with Japanese charsets yet. Here are +points of attention when setting it up:

    • You should set mangling method = hash

    • There are various iconv() implementations around and not + all of them work equally well. glibc2's iconv() has a critical problem + in CP932. libiconv-1.8 works with CP932 but still has some problems and + does not work with EUC-JP.

    • You should set dos charset = CP932, not + Shift_JIS, SJIS.

    • Currently only UNIX charset = CP932 + will work (but still has some problems...) because of iconv() issues. + UNIX charset = EUC-JP does not work well because of + iconv() issues.

    • Currently Samba-3.0 does not support UNIX charset = UTF8-MAC/CAP/HEX/JIS*.

    More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

    Common Errors

    CP850.so Can't Be Found

    “Samba is complaining about a missing CP850.so file.”

    Answer: CP850 is the default dos charset. + The dos charset is used to convert data to the codepage used by your dos clients. + If you do not have any dos clients, you can safely ignore this message.

    CP850 should be supported by your local iconv implementation. Make sure you have all the required packages installed. + If you compiled Samba from source, make sure to configure found iconv.

    Prev Up Next
    Chapter 26. Integrating MS Windows Networks with Samba Home Chapter 28. Samba Backup Techniques
    diff --git a/docs/htmldocs/upgrading-to-3.0.html b/docs/htmldocs/upgrading-to-3.0.html index e7c1c61234..5106814203 100644 --- a/docs/htmldocs/upgrading-to-3.0.html +++ b/docs/htmldocs/upgrading-to-3.0.html @@ -1,176 +1,200 @@ -Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    Prev Part IV. Migration and Updating Next

    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    June 30, 2003

    Table of Contents

    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (changes in behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    Charsets
    LDAP

    New Features in Samba-3

    -Major new features: +Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0

    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    Prev Part IV. Migration and Updating Next

    Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    June 30, 2003

    Table of Contents

    Quick Migration Guide
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (Changes in Behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    LDAP

    +This chapter deals exclusively with the differences between Samba-3.0.0 and Samba-2.2.8a. +It points out where configuration parameters have changed, and provides a simple guide for +the move from 2.2.x to 3.0.0. +

    Quick Migration Guide

    +Samba-3.0.0 default behavior should be approximately the same as Samba-2.2.x. +The default behavior when the new parameter passdb backend +is not defined in the smb.conf file provides the same default behviour as Samba-2.2.x +with encrypt passwords = Yes, and +will use the smbpasswd database. +

    +So why say that behavior should be approximately the same as Samba-2.2.x? Because +Samba-3.0.0 can negotiate new protocols, such as support for native Unicode, that may result in +differing protocol code paths being taken. The new behavior under such circumstances is not +exactly the same as the old one. The good news is that the domain and machine SIDs will be +preserved across the upgrade. +

    +If the Samba-2.2.x system was using an LDAP backend, and there is no time to update the LDAP +database, then make sure that passdb backend = ldapsam_compat +is specified in the smb.conf file. For the rest, behavior should remain more or less the same. +At a later date, when there is time to implement a new Samba-3 compatible LDAP backend, it is possible +to migrate the old LDAP database to the new one through use of the pdbedit. +See . +

    New Features in Samba-3

    +The major new features are:

    1. - Active Directory support. This release is able to join a ADS realm + Active Directory support. This release is able to join an ADS realm as a member server and authenticate users using LDAP/kerberos.

    2. - Unicode support. Samba will now negotiate UNICODE on the wire and - internally there is now a much better infrastructure for multi-byte - and UNICODE character sets. + Unicode support. Samba will now negotiate unicode on the wire and + internally there is a much better infrastructure for multi-byte + and unicode character sets.

    3. New authentication system. The internal authentication system has been almost completely rewritten. Most of the changes are internal, - but the new auth system is also very configurable. + but the new authoring system is also very configurable.

    4. New filename mangling system. The filename mangling system has been completely rewritten. An internal database now stores mangling maps - persistently. This needs lots of testing. + persistently.

    5. - New "net" command. A new "net" command has been added. It is - somewhat similar to the "net" command in windows. Eventually we + New “net” command. A new “net” command has been added. It is + somewhat similar to the “net” command in Windows. Eventually, we plan to replace a bunch of other utilities (such as smbpasswd) - with subcommands in "net", at the moment only a few things are - implemented. + with subcommands in “net”.

    6. Samba now negotiates NT-style status32 codes on the wire. This - improves error handling a lot. + considerably improves error handling.

    7. - Better Windows 2000/XP/2003 printing support including publishing - printer attributes in active directory + Better Windows 200x/XP printing support including publishing + printer attributes in Active Directory.

    8. - New loadable RPC modules + New loadable RPC modules for passdb backends and character sets.

    9. - New dual-daemon winbindd support (-B) for better performance + New default dual-daemon winbindd support for better performance.

    10. Support for migrating from a Windows NT 4.0 domain to a Samba - domain and maintaining user, group and domain SIDs + domain and maintaining user, group and domain SIDs.

    11. Support for establishing trust relationships with Windows NT 4.0 - domain controllers + Domain Controllers.

    12. Initial support for a distributed Winbind architecture using - an LDAP directory for storing SID to uid/gid mappings + an LDAP directory for storing SID to UID/GID mappings.

    13. Major updates to the Samba documentation tree. +

    14. + Full support for client and server SMB signing to ensure + compatibility with default Windows 2003 security settings.

    Plus lots of other improvements! -

    Configuration Parameter Changes

    -This section contains a brief listing of changes to smb.conf options -in the 3.0.0 release. Please refer to the smb.conf(5) man page for +

    Configuration Parameter Changes

    +This section contains a brief listing of changes to smb.conf options +in the 3.0.0 release. Please refer to the smb.conf(5) man page for complete descriptions of new or modified parameters. -

    Removed Parameters

    (order alphabetically):

    • admin log

    • alternate permissions

    • character set

    • client codepage

    • code page directory

    • coding system

    • domain admin group

    • domain guest group

    • force unknown acl user

    • nt smb support

    • post script

    • printer driver

    • printer driver file

    • printer driver location

    • status

    • total print jobs

    • use rhosts

    • valid chars

    • vfs options

    New Parameters

    (new parameters have been grouped by function):

    Remote management

    • abort shutdown script

    • shutdown script

    User and Group Account Management

    • add group script

    • add machine script

    • add user to group script

    • algorithmic rid base

    • delete group script

    • delete user from group script

    • passdb backend

    • set primary group script

    Authentication

    • auth methods

    • ads server

    • realm

    Protocol Options

    • client lanman auth

    • client NTLMv2 auth

    • client schannel

    • client signing

    • client use spnego

    • disable netbios

    • ntlm auth

    • paranoid server security

    • server schannel

    • smb ports

    • use spnego

    File Service

    • get quota command

    • hide special files

    • hide unwriteable files

    • hostname lookups

    • kernel change notify

    • mangle prefix

    • msdfs proxy

    • set quota command

    • use sendfile

    • vfs objects

    Printing

    • max reported print jobs

    UNICODE and Character Sets

    • display charset

    • dos charset

    • unicode

    • unix charset

    SID to uid/gid Mappings

    • idmap backend

    • idmap gid

    • idmap only

    • idmap uid

    LDAP

    • ldap delete dn

    • ldap group suffix

    • ldap idmap suffix

    • ldap machine suffix

    • ldap passwd sync

    • ldap trust ids

    • ldap user suffix

    General Configuration

    • preload modules

    • privatedir

    Modified Parameters (changes in behavior):

    • encrypt passwords (enabled by default)

    • mangling method (set to 'hash2' by default)

    • passwd chat

    • passwd program

    • restrict anonymous (integer value)

    • security (new 'ads' value)

    • strict locking (enabled by default)

    • winbind cache time (increased to 5 minutes)

    • winbind uid (deprecated in favor of 'idmap uid')

    • winbind gid (deprecated in favor of 'idmap gid')

    New Functionality

    Databases

    +

    Removed Parameters

    (Ordered Alphabetically):

    • admin log

    • alternate permissions

    • character set

    • client codepage

    • code page directory

    • coding system

    • domain admin group

    • domain guest group

    • force unknown acl user

    • nt smb support

    • post script

    • printer driver

    • printer driver file

    • printer driver location

    • status

    • stip dot

    • total print jobs

    • use rhosts

    • valid chars

    • vfs options

    New Parameters

    (New parameters have been grouped by function):

    Remote Management

    • abort shutdown script

    • shutdown script

    User and Group Account Management:

    • add group script

    • add machine script

    • add user to group script

    • algorithmic rid base

    • delete group script

    • delete user from group script

    • passdb backend

    • set primary group script

    Authentication:

    • auth methods

    • realm

    Protocol Options:

    • client lanman auth

    • client NTLMv2 auth

    • client schannel

    • client signing

    • client use spnego

    • disable netbios

    • ntlm auth

    • paranoid server security

    • server schannel

    • server signing

    • smb ports

    • use spnego

    File Service:

    • get quota command

    • hide special files

    • hide unwriteable files

    • hostname lookups

    • kernel change notify

    • mangle prefix

    • map acl inherit

    • msdfs proxy

    • set quota command

    • use sendfile

    • vfs objects

    Printing:

    • max reported print jobs

    Unicode and Character Sets:

    • display charset

    • dos charset

    • unicode

    • UNIX charset

    SID to UID/GID Mappings:

    • idmap backend

    • idmap gid

    • idmap uid

    • winbind enable local accounts

    • winbind trusted domains only

    • template primary group

    • enable rid algorithm

    LDAP:

    • ldap delete dn

    • ldap group suffix

    • ldap idmap suffix

    • ldap machine suffix

    • ldap passwd sync

    • ldap trust ids

    • ldap user suffix

    General Configuration:

    • preload modules

    • privatedir

    Modified Parameters (Changes in Behavior):

    • encrypt passwords (enabled by default)

    • mangling method (set to hash2 by default)

    • passwd chat

    • passwd program

    • password server

    • restrict anonymous (integer value)

    • security (new ads value)

    • strict locking (enabled by default)

    • winbind cache time (increased to 5 minutes)

    • winbind uid (deprecated in favor of idmap uid)

    • winbind gid (deprecated in favor of idmap gid)

    New Functionality

    Databases

    This section contains brief descriptions of any new databases - introduced in Samba 3.0. Please remember to backup your existing - ${lock directory}/*tdb before upgrading to Samba 3.0. Samba will + introduced in Samba-3. Please remember to backup your existing + ${lock directory}/*tdb before upgrading to Samba-3. Samba will upgrade databases as they are opened (if necessary), but downgrading from 3.0 to 2.2 is an unsupported path. -

    Table 30.1. TDB File Descriptions

    NameDescriptionBackup?
    account_policyUser policy settingsyes
    gencacheGeneric caching dbno
    group_mapping

    Mapping table from Windows groups/SID to unix groups

    		yes
    idmap

    new ID map table from SIDS to UNIX uids/gids

    		yes
    namecacheName resolution cache entriesno
    netlogon_unigrp

    Cache of universal group membership obtained when operating - as a member of a Windows domain

    		no
    printing/*.tdb

    Cached output from 'lpq command' created on a per print - service basis

    		no
    registry

    Read-only samba registry skeleton that provides support for - exporting various db tables via the winreg RPCs

    		no

    Changes in Behavior

    - The following issues are known changes in behavior between Samba 2.2 and - Samba 3.0 that may affect certain installations of Samba. +

    + The new tdb files are described in . +

    Table 30.1. TDB File Descriptions

    NameDescriptionBackup?
    account_policyUser policy settingsyes
    gencacheGeneric caching dbno
    group_mapping

    Mapping table from Windows groups/SID to UNIX groups

    		yes
    idmap

    new ID map table from SIDS to UNIX UIDs/GIDs

    		yes
    namecacheName resolution cache entriesno
    netlogon_unigrp

    Cache of universal group membership obtained when operating + as a member of a Windows domain

    		no
    printing/*.tdb

    Cached output from `lpq command' created on a per print + service basis

    		no
    registry

    Read-only Samba registry skeleton that provides support for + exporting various db tables via the winreg RPCs

    		no

    Changes in Behavior

    + The following issues are known changes in behavior between Samba-2.2 and + Samba-3 that may affect certain installations of Samba.

    1. - When operating as a member of a Windows domain, Samba 2.2 would - map any users authenticated by the remote DC to the 'guest account' - if a uid could not be obtained via the getpwnam() call. Samba 3.0 - rejects the connection as NT_STATUS_LOGON_FAILURE. There is no - current work around to re-establish the 2.2 behavior. + When operating as a member of a Windows domain, Samba-2.2 would + map any users authenticated by the remote DC to the “guest account” + if a uid could not be obtained via the getpwnam() call. Samba-3 + rejects the connection as NT_STATUS_LOGON_FAILURE. There is no + current work around to re-establish the Samba-2.2 behavior.

    2. - When adding machines to a Samba 2.2 controlled domain, the - 'add user script' was used to create the UNIX identity of the - machine trust account. Samba 3.0 introduces a new 'add machine - script' that must be specified for this purpose. Samba 3.0 will - not fall back to using the 'add user script' in the absence of - an 'add machine script' -

    Charsets

    + When adding machines to a Samba-2.2 controlled domain, the + “add user script” was used to create the UNIX identity of the + Machine Trust Account. Samba-3 introduces a new “add machine + script” that must be specified for this purpose. Samba-3 will + not fall back to using the “add user script” in the absence of + an “add machine script”. +

    Charsets

    You might experience problems with special characters when communicating with old DOS - clients. Codepage support has changed in samba 3.0. Read the chapter - Unicode support for details. -

    Passdb Backends and Authentication

    + clients. Codepage support has changed in Samba-3. Read , for details. +

    Passdb Backends and Authentication

    There have been a few new changes that Samba administrators should be - aware of when moving to Samba 3.0. + aware of when moving to Samba-3.

    1. Encrypted passwords have been enabled by default in order to - inter-operate better with out-of-the-box Windows client - installations. This does mean that either (a) a samba account - must be created for each user, or (b) 'encrypt passwords = no' - must be explicitly defined in smb.conf. + interoperate better with out-of-the-box Windows client + installations. This does mean that either (a) a Samba account + must be created for each user, or (b) “encrypt passwords = no” + must be explicitly defined in smb.conf.

    2. - Inclusion of new security = ads option for integration - with an Active Directory domain using the native Windows - Kerberos 5 and LDAP protocols. + Inclusion of new security = ads option for integration + with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols.

    - Samba 3.0 also includes the possibility of setting up chains + Samba-3 also includes the possibility of setting up chains of authentication methods - (auth methods) and account + (auth methods) and account storage backends - (passdb backend). + (passdb backend). Please refer to the smb.conf - man page and the chapter about account information databases for details. While both parameters assume sane default + man page and , for details. While both parameters assume sane default values, it is likely that you will need to understand what the values actually mean in order to ensure Samba operates correctly.

    - Certain functions of the smbpasswd(8) tool have been split between the - new smbpasswd(8) utility, the net(8) tool, and the new pdbedit(8) - utility. See the respective man pages for details. -

    Charsets

    - You might experience problems with special characters when communicating with old DOS - clients. Codepage support has changed in samba 3.0. Read the chapter - Unicode support for details. -

    LDAP

    - This section outlines the new features affecting Samba / LDAP integration. -

    New Schema

    + + Certain functions of the smbpasswd tool have been split between the + new smbpasswd utility, the net tool and the new pdbedit + utility. See the respective man pages for details. +

    LDAP

    + This section outlines the new features effecting Samba/LDAP integration. +

    New Schema

    A new object class (sambaSamAccount) has been introduced to replace - the old sambaAccount. This change aids us in the renaming of attributes - to prevent clashes with attributes from other vendors. There is a - conversion script (examples/LDAP/convertSambaAccount) to modify and LDIF + the old sambaAccount. This change aids us in the renaming of attributes + to prevent clashes with attributes from other vendors. There is a + conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF file to the new schema.

    - Example: + Example: 

    -		$ ldapsearch .... -b "ou=people,dc=..." > old.ldif
+		$ ldapsearch .... -b "ou=people,dc=..." > old.ldif
 		$ convertSambaAccount <DOM SID> old.ldif new.ldif

    - The <DOM SID> can be obtained by running 'net getlocalsid <DOMAINNAME> + The <DOM SID> can be obtained by running +

    +$ net getlocalsid <DOMAINNAME>
+

    on the Samba PDC as root.

    The old sambaAccount schema may still be used by specifying the - "ldapsam_compat" passdb backend. However, the sambaAccount and + ldapsam_compat passdb backend. However, the sambaAccount and associated attributes have been moved to the historical section of the schema file and must be uncommented before use if needed. - The 2.2 object class declaration for a sambaAccount has not changed - in the 3.0 samba.schema file. + The Samba-2.2 object class declaration for a sambaAccount has not changed + in the Samba-3 samba.schema file.

    Other new object classes and their uses include:

    • - sambaDomain - domain information used to allocate rids - for users and groups as necessary. The attributes are added - in 'ldap suffix' directory entry automatically if - an idmap uid/gid range has been set and the 'ldapsam' + sambaDomain domain information used to allocate RIDs + for users and groups as necessary. The attributes are added + in “ldap suffix” directory entry automatically if + an idmap UID/GID range has been set and the “ldapsam” passdb backend has been selected.

    • - sambaGroupMapping - an object representing the + sambaGroupMapping an object representing the relationship between a posixGroup and a Windows - group/SID. These entries are stored in the 'ldap - group suffix' and managed by the 'net groupmap' command. + group/SID. These entries are stored in the “ldap + group suffix” and managed by the “net groupmap” command.

    • - sambaUnixIdPool - created in the 'ldap idmap suffix' entry - automatically and contains the next available 'idmap uid' and - 'idmap gid' + sambaUNIXIdPool created in the “ldap idmap suffix” entry + automatically and contains the next available “idmap UID” and + “idmap GID”.

    • - sambaIdmapEntry - object storing a mapping between a - SID and a UNIX uid/gid. These objects are created by the + sambaIdmapEntry object storing a mapping between a + SID and a UNIX UID/GID. These objects are created by the idmap_ldap module as needed. -

    New Suffix for Searching

    +

    New Suffix for Searching

    The following new smb.conf parameters have been added to aid in directing - certain LDAP queries when 'passdb backend = ldapsam://...' has been + certain LDAP queries when passdb backend = ldapsam://... has been specified. -

    • ldap suffix - used to search for user and computer accounts

    • ldap user suffix - used to store user accounts

    • ldap machine suffix - used to store machine trust accounts

    • ldap group suffix - location of posixGroup/sambaGroupMapping entries

    • ldap idmap suffix - location of sambaIdmapEntry objects

    - If an 'ldap suffix' is defined, it will be appended to all of the - remaining sub-suffix parameters. In this case, the order of the suffix - listings in smb.conf is important. Always place the 'ldap suffix' first +

    • ldap suffix used to search for user and computer accounts.

    • ldap user suffix used to store user accounts.

    • ldap machine suffix used to store Machine Trust Accounts.

    • ldap group suffix location of posixGroup/sambaGroupMapping entries.

    • ldap idmap suffix location of sambaIdmapEntry objects.

    + If an ldap suffix is defined, it will be appended to all of the + remaining sub-suffix parameters. In this case, the order of the suffix + listings in smb.conf is important. Always place the ldap suffix first in the list.

    - Due to a limitation in Samba's smb.conf parsing, you should not surround - the DN's with quotation marks. -

    IdMap LDAP support

    - Samba 3.0 supports an ldap backend for the idmap subsystem. The - following options would inform Samba that the idmap table should be - stored on the directory server onterose in the "ou=idmap,dc=plainjoe, - dc=org" partition. -

    [global]
    ...
    idmap backend = ldap:ldap://onterose/
    ldap idmap suffix = ou=idmap,dc=plainjoe,dc=org
    idmap uid = 40000-50000
    idmap gid = 40000-50000

    - This configuration allows winbind installations on multiple servers to - share a uid/gid number space, thus avoiding the interoperability problems - with NFS that were present in Samba 2.2. -

    Prev Up Next
    Part IV. Migration and Updating Home Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    + Due to a limitation in Samba's smb.conf parsing, you should not surround + the DNs with quotation marks. +

    IdMap LDAP Support

    + Samba-3 supports an ldap backend for the idmap subsystem. The + following options inform Samba that the idmap table should be + stored on the directory server onterose in the "ou=idmap,dc=quenya,dc=org" partition. +

    [global]
    ...
    idmap backend = ldap:ldap://onterose/
    ldap idmap suffix = ou=idmap,dc=quenya,dc=org
    idmap uid = 40000-50000
    idmap gid = 40000-50000

    + This configuration allows Winbind installations on multiple servers to + share a UID/GID number space, thus avoiding the interoperability problems + with NFS that were present in Samba-2.2. +

    Prev Up Next
    Part IV. Migration and Updating Home Chapter 31. Migration from NT4 PDC to Samba-3 PDC
    diff --git a/docs/htmldocs/vfstest.1.html b/docs/htmldocs/vfstest.1.html index 2cfbfad283..e0efbfdf3f 100644 --- a/docs/htmldocs/vfstest.1.html +++ b/docs/htmldocs/vfstest.1.html @@ -8,8 +8,8 @@

    -l|--logfile=logbasename

    File name for log/debug files. The extension '.client' will be appended. The log file is never removed by the client. -

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -22,13 +22,13 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension ".client" will be appended. The log file is never removed by the client. diff --git a/docs/htmldocs/wbinfo.1.html b/docs/htmldocs/wbinfo.1.html index f5f5af0a27..9cdc7e0906 100644 --- a/docs/htmldocs/wbinfo.1.html +++ b/docs/htmldocs/wbinfo.1.html @@ -70,8 +70,8 @@

    -X group

    Delete an existing local winbindd group.

    -Y sid

    Convert a SID to a UNIX group id. If the SID does not correspond to a UNIX group mapped by winbindd(8) then - the operation will fail.

    -V

    Prints the version number for -smbd.

    -h|--help

    Print a summary of command line options. + the operation will fail.

    -V

    Prints the program version number. +

    -h|--help

    Print a summary of command line options.

    EXIT STATUS

    The wbinfo program returns 0 if the operation succeeded, or 1 if the operation failed. If the winbindd(8) daemon is not working wbinfo will always return failure.

    VERSION

    This man page is correct for version 3.0 of diff --git a/docs/htmldocs/winbind.html b/docs/htmldocs/winbind.html index 1ee1de9f2f..480746898f 100644 --- a/docs/htmldocs/winbind.html +++ b/docs/htmldocs/winbind.html @@ -1,6 +1,6 @@ -Chapter 21. Winbind: Use of Domain Accounts

    Chapter 21. Winbind: Use of Domain Accounts
    Prev Part III. Advanced Configuration Next

    Chapter 21. Winbind: Use of Domain Accounts

    Tim Potter

    Samba Team

    Andrew Tridgell

    Samba Team

    Naag Mummaneni

    Notes for Solaris

    John Trostel

    SNAP

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    27 June 2002

    Table of Contents

    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning

    Features and Benefits

    +Chapter 21. Winbind: Use of Domain Accounts

    Chapter 21. Winbind: Use of Domain Accounts
    Prev Part III. Advanced Configuration Next

    Chapter 21. Winbind: Use of Domain Accounts

    Tim Potter

    Samba Team

    Andrew Tridgell

    Samba Team

    Naag Mummaneni

    Notes for Solaris

    John Trostel

    SNAP

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    27 June 2002

    Table of Contents

    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    Winbind Is Not Resolving Users and Groups

    Features and Benefits

    Integration of UNIX and Microsoft Windows NT through a unified logon has - been considered a "holy grail" in heterogeneous computing environments for + been considered a “holy grail” in heterogeneous computing environments for a long time.

    There is one other facility without which UNIX and Microsoft Windows network @@ -8,150 +8,149 @@ mechanism for sharing files across UNIX systems and to be able to assign domain user and group ownerships with integrity.

    - winbind is a component of the Samba suite of programs + winbind is a component of the Samba suite of programs that solves the unified logon problem. Winbind uses a UNIX implementation of Microsoft RPC calls, Pluggable Authentication Modules, and the Name Service Switch to allow Windows NT domain users to appear and operate as UNIX users on a UNIX - machine. This chapter describes the winbind system, explaining the functionality + machine. This chapter describes the Winbind system, explaining the functionality it provides, how it is configured, and how it works internally.

    Winbind provides three separate functions:

    • - Authentication of user credentials (via PAM) + Authentication of user credentials (via PAM).

    • - Identity resolution (via NSS)` + Identity resolution (via NSS).

    • - Windindd maintains a database called winbind_idmap.tdb in which it stores + Winbind maintains a database called winbind_idmap.tdb in which it stores mappings between UNIX UIDs / GIDs and NT SIDs. This mapping is used only for users and groups that do not have a local UID/GID. It stored the UID/GID allocated from the idmap uid/gid range that it has mapped to the NT SID. If idmap backend has been specified as ldapsam:url - then instead of using a local mapping winbindd will obtain this information + then instead of using a local mapping Winbind will obtain this information from the LDAP database.

    Note

    - If winbindd is not running, then smbd (which calls winbindd) will fall back to - using purely local information from /etc/passwd and /etc/group and no dynamic + If winbindd is not running, smbd (which calls winbindd) will fall back to + using purely local information from /etc/passwd and /etc/group and no dynamic mapping will be used. -

    Introduction

    It is well known that UNIX and Microsoft Windows NT have +

    Introduction

    It is well known that UNIX and Microsoft Windows NT have different models for representing user and group information and use different technologies for implementing them. This fact has made it difficult to integrate the two systems in a satisfactory manner.

    One common solution in use today has been to create identically named user accounts on both the UNIX and Windows systems and use the Samba suite of programs to provide file and print services - between the two. This solution is far from perfect however, as + between the two. This solution is far from perfect, however, as adding and deleting users on both sets of machines becomes a chore - and two sets of passwords are required both of which + and two sets of passwords are required both of which can lead to synchronization problems between the UNIX and Windows systems and confusion for users.

    We divide the unified logon problem for UNIX machines into - three smaller problems:

    • Obtaining Windows NT user and group information -

    • Authenticating Windows NT users -

    • Password changing for Windows NT users + three smaller problems:

      • Obtaining Windows NT user and group information. +

      • Authenticating Windows NT users. +

      • Password changing for Windows NT users.

      Ideally, a prospective solution to the unified logon problem would satisfy all the above components without duplication of information on the UNIX machines and without creating additional tasks for the system administrator when maintaining users and - groups on either system. The winbind system provides a simple + groups on either system. The Winbind system provides a simple and elegant solution to all three components of the unified logon - problem.

    What Winbind Provides

    Winbind unifies UNIX and Windows NT account management by - allowing a UNIX box to become a full member of a NT domain. Once + problem.

    What Winbind Provides

    Winbind unifies UNIX and Windows NT account management by + allowing a UNIX box to become a full member of an NT domain. Once this is done the UNIX box will see NT users and groups as if - they were native UNIX users and groups, allowing the NT domain + they were “native” UNIX users and groups, allowing the NT domain to be used in much the same manner that NIS+ is used within UNIX-only environments.

    The end result is that whenever any program on the UNIX machine asks the operating system to lookup a user or group name, the query will be resolved by asking the - NT domain controller for the specified domain to do the lookup. + NT Domain Controller for the specified domain to do the lookup. Because Winbind hooks into the operating system at a low level - (via the NSS name resolution modules in the C library) this - redirection to the NT domain controller is completely + (via the NSS name resolution modules in the C library), this + redirection to the NT Domain Controller is completely transparent.

    Users on the UNIX machine can then use NT user and group - names as they would use "native" UNIX names. They can chown files - so that they are owned by NT domain users or even login to the + names as they would “native” UNIX names. They can chown files + so they are owned by NT domain users or even login to the UNIX machine and run a UNIX X-Window session as a domain user.

    The only obvious indication that Winbind is being used is - that user and group names take the form DOMAIN\user and - DOMAIN\group. This is necessary as it allows Winbind to determine - that redirection to a domain controller is wanted for a particular + that user and group names take the form DOMAIN\user and + DOMAIN\group. This is necessary as it allows Winbind to determine + that redirection to a Domain Controller is wanted for a particular lookup and which trusted domain is being referenced.

    Additionally, Winbind provides an authentication service that hooks into the Pluggable Authentication Modules (PAM) system - to provide authentication via a NT domain to any PAM enabled + to provide authentication via an NT domain to any PAM-enabled applications. This capability solves the problem of synchronizing passwords between systems since all passwords are stored in a single - location (on the domain controller).

    Target Uses

    Winbind is targeted at organizations that have an - existing NT based domain infrastructure into which they wish + location (on the Domain Controller).

    Target Uses

    Winbind is targeted at organizations that have an + existing NT-based domain infrastructure into which they wish to put UNIX workstations or servers. Winbind will allow these organizations to deploy UNIX workstations without having to maintain a separate account infrastructure. This greatly simplifies the administrative overhead of deploying UNIX - workstations into a NT based organization.

    Another interesting way in which we expect Winbind to - be used is as a central part of UNIX based appliances. Appliances - that provide file and print services to Microsoft based networks + workstations into an NT-based organization.

    Another interesting way in which we expect Winbind to + be used is as a central part of UNIX-based appliances. Appliances + that provide file and print services to Microsoft-based networks will be able to use Winbind to provide seamless integration of - the appliance into the domain.

    How Winbind Works

    The winbind system is designed around a client/server + the appliance into the domain.

    How Winbind Works

    The Winbind system is designed around a client/server architecture. A long running winbindd daemon listens on a UNIX domain socket waiting for requests to arrive. These requests are generated by the NSS and PAM - clients and processed sequentially.

    The technologies used to implement winbind are described - in detail below.

    Microsoft Remote Procedure Calls

    Over the last few years, efforts have been underway + clients and is processed sequentially.

    The technologies used to implement Winbind are described + in detail below.

    Microsoft Remote Procedure Calls

    Over the last few years, efforts have been underway by various Samba Team members to decode various aspects of the Microsoft Remote Procedure Call (MSRPC) system. This - system is used for most network related operations between + system is used for most network-related operations between Windows NT machines including remote management, user authentication and print spooling. Although initially this work was done to aid the implementation of Primary Domain Controller (PDC) - functionality in Samba, it has also yielded a body of code which + functionality in Samba, it has also yielded a body of code that can be used for other purposes.

    Winbind uses various MSRPC calls to enumerate domain users and groups and to obtain detailed information about individual users or groups. Other MSRPC calls can be used to authenticate NT domain users and to change user passwords. By directly querying - a Windows PDC for user and group information, winbind maps the - NT account information onto UNIX user and group names.

    Microsoft Active Directory Services

    + a Windows PDC for user and group information, Winbind maps the + NT account information onto UNIX user and group names.

    Microsoft Active Directory Services

    Since late 2001, Samba has gained the ability to - interact with Microsoft Windows 2000 using its 'Native - Mode' protocols, rather than the NT4 RPC services. - Using LDAP and Kerberos, a domain member running - winbind can enumerate users and groups in exactly the - same way as a Win2k client would, and in so doing - provide a much more efficient and - effective winbind implementation. -

    Name Service Switch

    The Name Service Switch, or NSS, is a feature that is + interact with Microsoft Windows 2000 using its “Native + Mode” protocols, rather than the NT4 RPC services. + Using LDAP and Kerberos, a Domain Member running + Winbind can enumerate users and groups in exactly the + same way as a Windows 200x client would, and in so doing + provide a much more efficient and effective Winbind implementation. +

    Name Service Switch

    The Name Service Switch, or NSS, is a feature that is present in many UNIX operating systems. It allows system information such as hostnames, mail aliases and user information to be resolved from different sources. For example, a standalone UNIX workstation may resolve system information from a series of flat files stored on the local filesystem. A networked workstation may first attempt to resolve system information from local files, - and then consult a NIS database for user information or a DNS server - for hostname information.

    The NSS application programming interface allows winbind + and then consult an NIS database for user information or a DNS server + for hostname information.

    The NSS application programming interface allows Winbind to present itself as a source of system information when - resolving UNIX usernames and groups. Winbind uses this interface, + resolving UNIX usernames and groups. Winbind uses this interface, and information obtained from a Windows NT server using MSRPC - calls to provide a new source of account enumeration. Using standard + calls to provide a new source of account enumeration. Using standard UNIX library calls, one can enumerate the users and groups on - a UNIX machine running winbind and see all users and groups in + a UNIX machine running Winbind and see all users and groups in a NT domain plus any trusted domain as though they were local users and groups.

    The primary control file for NSS is /etc/nsswitch.conf. - When a UNIX application makes a request to do a lookup + When a UNIX application makes a request to do a lookup, the C library looks in /etc/nsswitch.conf - for a line which matches the service type being requested, for - example the "passwd" service type is used when user or group names - are looked up. This config line specifies which implementations + for a line that matches the service type being requested, for + example the “passwd” service type is used when user or group names + are looked up. This config line specifies which implementations of that service should be tried and in what order. If the passwd - config line is:

    -passwd: files example
+		config line is:
    +		passwd: files example
 		
    then the C library will first load a module called 
 		/lib/libnss_files.so followed by
 		the module /lib/libnss_example.so. The 
 		C library will dynamically load each of these modules in turn 
 		and call resolver functions within the modules to try to resolve 
-		the request. Once the request is resolved the C library returns the
-		result to the application.
    This NSS interface provides a very easy way for Winbind 
+		the request. Once the request is resolved, the C library returns the
+		result to the application.
    This NSS interface provides an easy way for Winbind 
 		to hook into the operating system. All that needs to be done 
 		is to put libnss_winbind.so in /lib/ 
-		then add "winbind" into /etc/nsswitch.conf at 
+		then add “winbind” into /etc/nsswitch.conf at 
 		the appropriate place. The C library will then call Winbind to 
-		resolve user and group names.

    Pluggable Authentication Modules

    Pluggable Authentication Modules, also known as PAM, + resolve user and group names.

    Pluggable Authentication Modules

    Pluggable Authentication Modules, also known as PAM, is a system for abstracting authentication and authorization technologies. With a PAM module it is possible to specify different authentication methods for different system applications without @@ -168,101 +167,93 @@ passwd: files example

    PAM is configured by providing control files in the directory /etc/pam.d/ for each of the services that require authentication. When an authentication request is made - by an application the PAM code in the C library looks up this + by an application, the PAM code in the C library looks up this control file to determine what modules to load to do the authentication check and in what order. This interface makes adding - a new authentication service for Winbind very easy, all that needs + a new authentication service for Winbind very easy. All that needs to be done is that the pam_winbind.so module is copied to /lib/security/ and the PAM control files for relevant services are updated to allow - authentication via winbind. See the PAM documentation - for more details.

    User and Group ID Allocation

    When a user or group is created under Windows NT - is it allocated a numerical relative identifier (RID). This is - slightly different to UNIX which has a range of numbers that are + authentication via Winbind. See the PAM documentation + in for more information.

    User and Group ID Allocation

    When a user or group is created under Windows NT/200x + it is allocated a numerical relative identifier (RID). This is + slightly different from UNIX which has a range of numbers that are used to identify users, and the same range in which to identify - groups. It is winbind's job to convert RIDs to UNIX id numbers and - vice versa. When winbind is configured it is given part of the UNIX - user id space and a part of the UNIX group id space in which to + groups. It is Winbind's job to convert RIDs to UNIX ID numbers and + vice versa. When Winbind is configured, it is given part of the UNIX + user ID space and a part of the UNIX group ID space in which to store Windows NT users and groups. If a Windows NT user is - resolved for the first time, it is allocated the next UNIX id from + resolved for the first time, it is allocated the next UNIX ID from the range. The same process applies for Windows NT groups. Over - time, winbind will have mapped all Windows NT users and groups - to UNIX user ids and group ids.

    The results of this mapping are stored persistently in + time, Winbind will have mapped all Windows NT users and groups + to UNIX user IDs and group IDs.

    The results of this mapping are stored persistently in an ID mapping database held in a tdb database). This ensures that - RIDs are mapped to UNIX IDs in a consistent way.

    Result Caching

    An active system can generate a lot of user and group - name lookups. To reduce the network cost of these lookups winbind + RIDs are mapped to UNIX IDs in a consistent way.

    Result Caching

    + + An active system can generate a lot of user and group + name lookups. To reduce the network cost of these lookups, Winbind uses a caching scheme based on the SAM sequence number supplied - by NT domain controllers. User or group information returned - by a PDC is cached by winbind along with a sequence number also + by NT Domain Controllers. User or group information returned + by a PDC is cached by Winbind along with a sequence number also returned by the PDC. This sequence number is incremented by Windows NT whenever any user or group information is modified. If a cached entry has expired, the sequence number is requested from the PDC and compared against the sequence number of the cached entry. If the sequence numbers do not match, then the cached information - is discarded and up to date information is requested directly - from the PDC.

    Installation and Configuration

    Introduction

    -This section describes the procedures used to get winbind up and -running. Winbind is capable of providing access + is discarded and up-to-date information is requested directly + from the PDC.

    Installation and Configuration

    Introduction

    +This section describes the procedures used to get Winbind up and +running. Winbind is capable of providing access and authentication control for Windows Domain users through an NT -or Win2K PDC for 'regular' services, such as telnet a nd ftp, as -well for SAMBA services. +or Windows 200x PDC for regular services, such as telnet and ftp, as +well for Samba services.

    • - Why should I to this? -

      This allows the SAMBA administrator to rely on the - authentication mechanisms on the NT/Win2K PDC for the authentication - of domain members. NT/Win2K users no longer need to have separate - accounts on the SAMBA server. + Why should I do this? +

      This allows the Samba administrator to rely on the + authentication mechanisms on the Windows NT/200x PDC for the authentication + of Domain Members. Windows NT/200x users no longer need to have separate + accounts on the Samba server.

    • Who should be reading this document?

      - This HOWTO is designed for system administrators. If you are - implementing SAMBA on a file server and wish to (fairly easily) - integrate existing NT/Win2K users from your PDC onto the - SAMBA server, this HOWTO is for you. That said, I am no NT or PAM - expert, so you may find a better or easier way to accomplish - these tasks. -

    Requirements

    -If you have a Samba configuration file that you are currently -using... BACK IT UP! If your system already uses PAM, -back up the /etc/pam.d directory -contents! If you haven't already made a boot disk, -MAKE ONE NOW! + This document is designed for system administrators. If you are + implementing Samba on a file server and wish to (fairly easily) + integrate existing Windows NT/200x users from your PDC onto the + Samba server, this document is for you. +

    Requirements

    +If you have a Samba configuration file that you are currently using, BACK IT UP! +If your system already uses PAM, back up the /etc/pam.d directory +contents! If you haven't already made a boot disk, MAKE ONE NOW!

    -Messing with the PAM configuration files can make it nearly impossible -to log in to your machine. That's why you want to be able to boot back -into your machine in single user mode and restore your -/etc/pam.d back to the original state they were in if -you get frustrated with the way things are going. ;-) +Messing with the PAM configuration files can make it nearly impossible to log in to your machine. That's +why you want to be able to boot back into your machine in single user mode and restore your +/etc/pam.d back to the original state they were in if you get frustrated with the +way things are going.

    -The latest version of SAMBA (version 3.0 as of this writing), now -includes a functioning winbindd daemon. Please refer to the -main SAMBA web page or, -better yet, your closest SAMBA mirror site for instructions on -downloading the source code. +The latest version of Samba-3 includes a functioning winbindd daemon. Please refer to the main Samba Web page or, better yet, your closest Samba mirror site for +instructions on downloading the source code.

    -To allow Domain users the ability to access SAMBA shares and -files, as well as potentially other services provided by your -SAMBA machine, PAM (pluggable authentication modules) must -be setup properly on your machine. In order to compile the -winbind modules, you should have at least the pam libraries resident -on your system. For recent RedHat systems (7.1, for instance), that -means pam-0.74-22. For best results, it is helpful to also -install the development packages in pam-devel-0.74-22. -

    Testing Things Out

    -Before starting, it is probably best to kill off all the SAMBA -related daemons running on your server. Kill off all smbd, -nmbd, and winbindd processes that may -be running. To use PAM, you will want to make sure that you have the -standard PAM package which supplies the /etc/pam.d -directory structure, including the pam modules are used by pam-aware -services, several pam libraries, and the /usr/doc -and /usr/man entries for pam. Winbind built better -in SAMBA if the pam-devel package was also installed. This package includes -the header files needed to compile pam-aware applications. -

    Configure nsswitch.conf and the -winbind libraries on Linux and Solaris

    -The libraries needed to run the winbindd daemon -through nsswitch need to be copied to their proper locations, so +To allow domain users the ability to access Samba shares and files, as well as potentially other services +provided by your Samba machine, PAM must be set up properly on your +machine. In order to compile the Winbind modules, you should have at least the PAM development libraries installed +on your system. Please refer the PAM web site http://www.kernel.org/pub/linux/libs/pam/. +

    Testing Things Out

    +Before starting, it is probably best to kill off all the Samba-related daemons running on your server. +Kill off all smbd, nmbd, and winbindd processes that may be running. To use PAM, +make sure that you have the standard PAM package that supplies the /etc/pam.d +directory structure, including the PAM modules that are used by PAM-aware services, several pam libraries, +and the /usr/doc and /usr/man entries for pam. Winbind built +better in Samba if the pam-devel package is also installed. This package includes the header files +needed to compile PAM-aware applications. +

    Configure nsswitch.conf and the Winbind Libraries on Linux and Solaris

    +PAM is a standard component of most current generation UNIX/Linux systems. Unfortunately, few systems install +the pam-devel libraries that are needed to build PAM-enabled Samba. Additionally, Samba-3 +may auto-install the Winbind files into their correct locations on your system, so before you get too far down +the track be sure to check if the following configuration is really +necessary. You may only need to configure +/etc/nsswitch.conf. +

    +The libraries needed to run the winbindd daemon through nsswitch need to be copied to their proper locations: 

     root# cp ../samba/source/nsswitch/libnss_winbind.so /lib
@@ -278,94 +269,91 @@ I also found it necessary to make the following symbolic link:

    Now, as root you need to edit /etc/nsswitch.conf to allow user and group entries to be visible from the winbindd -daemon. My /etc/nsswitch.conf file look like +daemon. My /etc/nsswitch.conf file look like this after editing: 

     	passwd:     files winbind
 	shadow:     files 
 	group:      files winbind

    -The libraries needed by the winbind daemon will be automatically +The libraries needed by the winbindd daemon will be automatically entered into the ldconfig cache the next time -your system reboots, but it -is faster (and you don't need to reboot) if you do it manually: +your system reboots, but it is faster (and you do not need to reboot) if you do it manually:

    root# /sbin/ldconfig -v | grep winbind

    This makes libnss_winbind available to winbindd and echos back a check to you. -

    NSS Winbind on AIX

    (This section is only for those running AIX)

    -The winbind AIX identification module gets built as libnss_winbind.so in the -nsswitch directory of the samba source. This file can be copied to -/usr/lib/security, and the AIX naming convention would indicate that it -should be named WINBIND. A stanza like the following: +

    NSS Winbind on AIX

    (This section is only for those running AIX.)

    +The Winbind AIX identification module gets built as libnss_winbind.so in the +nsswitch directory of the Samba source. This file can be copied to /usr/lib/security, +and the AIX naming convention would indicate that it should be named WINBIND. A stanza like the following: 

     WINBIND:
         program = /usr/lib/security/WINBIND
         options = authonly
-

    can then be added to -/usr/lib/security/methods.cfg. This module only -supports identification, but there have been success reports using the -standard winbind pam module for authentication. Use caution configuring -loadable authentication modules as it is possible to make it impossible -to logon to the system. More information about the AIX authentication -module API can be found at "Kernel Extensions and Device Support -Programming Concepts for AIX": -Chapter 18. Loadable Authentication Module Programming Interface -and more information on administering the modules at -"System Management Guide: Operating System and Devices". -

    Configure smb.conf

    -Several parameters are needed in the smb.conf file to control -the behavior of winbindd. Configure -smb.conf These are described in more detail in -the winbindd(8) man page. My -smb.conf file was modified to -include the following entries in the [global] section: -

    Example 21.1. smb.conf for winbind set-up

    [global]
    ...
    # separate domain and username with '+', like DOMAIN+username
    winbind separator = +
    # use uids from 10000 to 20000 for domain users
    idmap uid = 10000-20000
    # use gids from 10000 to 20000 for domain groups
    winbind gid = 10000-20000
    # allow enumeration of winbind users and groups
    winbind enum users = yes
    winbind enum groups = yes
    # give winbind users a real shell (only needed if they have telnet access)
    template homedir = /home/winnt/%D/%U
    template shell = /bin/bash

    Join the SAMBA server to the PDC domain

    -Enter the following command to make the SAMBA server join the +

    +can then be added to /usr/lib/security/methods.cfg. This module only supports +identification, but there have been success reports using the standard Winbind PAM module for +authentication. Use caution configuring loadable authentication +modules since you can make +it impossible to logon to the system. More information about the AIX authentication module API can +be found at “Kernel Extensions and Device Support Programming Concepts for AIX” +in Chapter 18(John, there is no section like this in 18). Loadable Authentication Module Programming +Interface and more information on administering the modules +can be found at System +Management Guide: Operating System and Devices. +

    Configure smb.conf

    +Several parameters are needed in the smb.conf file to control the behavior of winbindd. These +are described in more detail in the winbindd(8) man page. My smb.conf file, as shown in , was modified to include the necessary entries in the [global] section. +

    Example 21.1. smb.conf for Winbind set-up

    [global]
    # separate domain and username with '+', like DOMAIN+username
    winbind separator = +
    # use uids from 10000 to 20000 for domain users
    idmap uid = 10000-20000
    # use gids from 10000 to 20000 for domain groups
    winbind gid = 10000-20000
    # allow enumeration of winbind users and groups
    winbind enum users = yes
    winbind enum groups = yes
    # give winbind users a real shell (only needed if they have telnet access)
    template homedir = /home/winnt/%D/%U
    template shell = /bin/bash

    Join the Samba Server to the PDC Domain

    +Enter the following command to make the Samba server join the PDC domain, where DOMAIN is the name of your Windows domain and Administrator is a domain user who has administrative privileges in the domain.

    root# /usr/local/samba/bin/net rpc join -S PDC -U Administrator

    -The proper response to the command should be: "Joined the domain -DOMAIN" where DOMAIN +The proper response to the command should be: “Joined the domain +DOMAIN” where DOMAIN is your DOMAIN name. -

    Start up the winbindd daemon and test it!

    -Eventually, you will want to modify your smb startup script to +

    Starting and Testing the winbindd Daemon

    +Eventually, you will want to modify your Samba startup script to automatically invoke the winbindd daemon when the other parts of -SAMBA start, but it is possible to test out just the winbind -portion first. To start up winbind services, enter the following +Samba start, but it is possible to test out just the Winbind +portion first. To start up Winbind services, enter the following command as root:

    root# /usr/local/samba/bin/winbindd -

    -Winbindd can now also run in 'dual daemon mode'. This will make it -run as 2 processes. The first will answer all requests from the cache, +

    Note

    +The above assumes that Samba has been installed in the /usr/local/samba +directory tree. You may need to search for the location of Samba files if this is not the +location of winbindd on your system. +

    +Winbindd can now also run in “dual daemon modei”. This will make it +run as two processes. The first will answer all requests from the cache, thus making responses to clients faster. The other will update the cache for the query that the first has just responded. -Advantage of this is that responses stay accurate and are faster. +The advantage of this is that responses stay accurate and are faster. You can enable dual daemon mode by adding -B to the commandline:

    root# /usr/local/samba/bin/winbindd -B

    -I'm always paranoid and like to make sure the daemon -is really running... +I'm always paranoid and like to make sure the daemon is really running.

    root# ps -ae | grep winbindd

    -This command should produce output like this, if the daemon is running +This command should produce output like this, if the daemon is running you would expect +to see a report something like this: 

     3025 ?        00:00:00 winbindd

    -Now... for the real test, try to get some information about the -users on your PDC +Now, for the real test, try to get some information about the users on your PDC:

    root# /usr/local/samba/bin/wbinfo -u

    This should echo back a list of users on your Windows users on -your PDC. For example, I get the following response: +your PDC. For example, I get the following response: 

     	CEO+Administrator
 	CEO+burdell
@@ -374,10 +362,9 @@ your PDC.  For example, I get the following response:
 	CEO+krbtgt
 	CEO+TsInternetUser

    - Obviously, I have named my domain 'CEO' and my winbind separator is '+'. +Obviously, I have named my domain “CEO” and my winbind separator is “+”.

    -You can do the same sort of thing to get group information from -the PDC: +You can do the same sort of thing to get group information from the PDC: 

     root# /usr/local/samba/bin/wbinfo -g
 	CEO+Domain Admins
@@ -390,43 +377,41 @@ the PDC:
 	CEO+Enterprise Admins
 	CEO+Group Policy Creator Owners

    -The function 'getent' can now be used to get unified -lists of both local and PDC users and groups. -Try the following command: +The function getent can now be used to get unified +lists of both local and PDC users and groups. Try the following command:

    root# getent passwd

    You should get a list that looks like your /etc/passwd -list followed by the domain users with their new uids, gids, home +list followed by the domain users with their new UIDs, GIDs, home directories and default shells.

    -The same thing can be done for groups with the command +The same thing can be done for groups with the command:

    root# getent group -

    Fix the init.d startup scripts

    Linux

    -The winbindd daemon needs to start up after the -smbd and nmbd daemons are running. +

    Fix the init.d Startup Scripts

    Linux

    +The winbindd daemon needs to start up after the smbd and nmbd daemons are running. To accomplish this task, you need to modify the startup scripts of your system. -They are located at /etc/init.d/smb in RedHat and -/etc/init.d/samba in Debian. -script to add commands to invoke this daemon in the proper sequence. My +They are located at /etc/init.d/smb in Red Hat Linux and they are located in +/etc/init.d/samba in Debian Linux. Edit your +script to add commands to invoke this daemon in the proper sequence. My startup script starts up smbd, nmbd, and winbindd from the -/usr/local/samba/bin directory directly. The 'start' +/usr/local/samba/bin directory directly. The start function in the script looks like this: 

     start() {
-        KIND="SMB"
-        echo -n $"Starting $KIND services: "
+        KIND="SMB"
+        echo -n $"Starting $KIND services: "
         daemon /usr/local/samba/bin/smbd $SMBDOPTIONS
         RETVAL=$?
         echo
-        KIND="NMB"
-        echo -n $"Starting $KIND services: "
+        KIND="NMB"
+        echo -n $"Starting $KIND services: "
         daemon /usr/local/samba/bin/nmbd $NMBDOPTIONS
         RETVAL2=$?
         echo
-        KIND="Winbind"
-        echo -n $"Starting $KIND services: "
+        KIND="Winbind"
+        echo -n $"Starting $KIND services: "
         daemon /usr/local/samba/bin/winbindd
         RETVAL3=$?
         echo
@@ -435,7 +420,7 @@ start() {
         return $RETVAL
 }

    If you would like to run winbindd in dual daemon mode, replace -the line +the line : 

             daemon /usr/local/samba/bin/winbindd

    @@ -446,34 +431,35 @@ in the example above with: daemon /usr/local/samba/bin/winbindd -B

    .

    -The 'stop' function has a corresponding entry to shut down the +The stop function has a corresponding entry to shut down the services and looks like this: 

     stop() {
-        KIND="SMB"
-        echo -n $"Shutting down $KIND services: "
+        KIND="SMB"
+        echo -n $"Shutting down $KIND services: "
         killproc smbd
         RETVAL=$?
         echo
-        KIND="NMB"
-        echo -n $"Shutting down $KIND services: "
+        KIND="NMB"
+        echo -n $"Shutting down $KIND services: "
         killproc nmbd
         RETVAL2=$?
         echo
-        KIND="Winbind"
-        echo -n $"Shutting down $KIND services: "
+        KIND="Winbind"
+        echo -n $"Shutting down $KIND services: "
         killproc winbindd
         RETVAL3=$?
         [ $RETVAL -eq 0 -a $RETVAL2 -eq 0 -a $RETVAL3 -eq 0 ] && \
 		 rm -f /var/lock/subsys/smb
-        echo ""
+        echo ""
         return $RETVAL
 }
-
    Solaris

    Winbind doesn't work on Solaris 9, see the Portability chapter for details.

    On Solaris, you need to modify the -/etc/init.d/samba.server startup script. It usually -only starts smbd and nmbd but should now start winbindd too. If you -have samba installed in /usr/local/samba/bin, -the file could contains something like this: +

    Solaris

    +Winbind does not work on Solaris 9, see for details. +

    +On Solaris, you need to modify the /etc/init.d/samba.server startup script. It +usually only starts smbd and nmbd but should now start winbindd, too. If you have Samba installed in +/usr/local/samba/bin, the file could contains something like this: 

     	##
 	## samba.server
@@ -488,12 +474,12 @@ the file could contains something like this:
 		pid=`/usr/bin/ps -e |
 		     /usr/bin/grep -w $1 |
 		     /usr/bin/sed -e 's/^  *//' -e 's/ .*//'`
-		[ "$pid" != "" ] && kill $pid
+		[ "$pid" != "" ] && kill $pid
 	}
 	 
-	# Start/stop processes required for samba server
+	# Start/stop processes required for Samba server
 
-	case "$1" in
+	case "$1" in
 
 	'start')
 	#
@@ -518,204 +504,238 @@ the file could contains something like this:
 	   ;;
 
 	*)
-	   echo "Usage: /etc/init.d/samba.server { start | stop }"
+	   echo "Usage: /etc/init.d/samba.server { start | stop }"
 	   ;;
 	esac

    -Again, if you would like to run samba in dual daemon mode, replace +Again, if you would like to run Samba in dual daemon mode, replace: 

     	/usr/local/samba/bin/winbindd

    - in the script above with: - 

     	/usr/local/samba/bin/winbindd -B

    -

    Restarting

    +

    Restarting

    If you restart the smbd, nmbd, and winbindd daemons at this point, you -should be able to connect to the samba server as a domain member just as +should be able to connect to the Samba server as a Domain Member just as if you were a local user. -

    Configure Winbind and PAM

    -If you have made it this far, you know that winbindd and samba are working -together. If you want to use winbind to provide authentication for other -services, keep reading. The pam configuration files need to be altered in -this step. (Did you remember to make backups of your original +

    Configure Winbind and PAM

    +If you have made it this far, you know that winbindd and Samba are working +together. If you want to use Winbind to provide authentication for other +services, keep reading. The PAM configuration files need to be altered in +this step. (Did you remember to make backups of your original /etc/pam.d files? If not, do it now.)

    -You will need a pam module to use winbindd with these other services. This +You will need a PAM module to use winbindd with these other services. This module will be compiled in the ../source/nsswitch directory -by invoking the command +by invoking the command:

    root# make nsswitch/pam_winbind.so

    -from the ../source directory. The +from the ../source directory. The pam_winbind.so file should be copied to the location of -your other pam security modules. On my RedHat system, this was the -/lib/security directory. On Solaris, the pam security +your other PAM security modules. On my RedHat system, this was the +/lib/security directory. On Solaris, the PAM security modules reside in /usr/lib/security.

    root# cp ../samba/source/nsswitch/pam_winbind.so /lib/security -

    Linux/FreeBSD-specific PAM configuration

    +

    Linux/FreeBSD-specific PAM configuration

    The /etc/pam.d/samba file does not need to be changed. I just left this file as it was: 

     	auth    required        /lib/security/pam_stack.so service=system-auth
 	account required        /lib/security/pam_stack.so service=system-auth

    -The other services that I modified to allow the use of winbind +The other services that I modified to allow the use of Winbind as an authentication service were the normal login on the console (or a terminal -session), telnet logins, and ftp service. In order to enable these +session), telnet logins, and ftp service. In order to enable these services, you may first need to change the entries in -/etc/xinetd.d (or /etc/inetd.conf). -RedHat 7.1 uses the new xinetd.d structure, in this case you need +/etc/xinetd.d (or /etc/inetd.conf). +Red Hat Linux 7.1 and later uses the new xinetd.d structure, in this case you need to change the lines in /etc/xinetd.d/telnet and /etc/xinetd.d/wu-ftp from 

     	enable = no

    -to +to: 

     	enable = yes

    For ftp services to work properly, you will also need to either have individual directories for the domain users already present on the server, or change the home directory template to a general -directory for all domain users. These can be easily set using +directory for all domain users. These can be easily set using the smb.conf global entry -template homedir. +template homedir.

    The /etc/pam.d/ftp file can be changed -to allow winbind ftp access in a manner similar to the -samba file. My /etc/pam.d/ftp file was +to allow Winbind ftp access in a manner similar to the +samba file. My /etc/pam.d/ftp file was changed to look like this: 

    -	auth       required     /lib/security/pam_listfile.so item=user sense=deny \
-		 file=/etc/ftpusers onerr=succeed
-	auth       sufficient   /lib/security/pam_winbind.so
-	auth       required     /lib/security/pam_stack.so service=system-auth
-	auth       required     /lib/security/pam_shells.so
-	account    sufficient   /lib/security/pam_winbind.so
-	account    required     /lib/security/pam_stack.so service=system-auth
-	session    required     /lib/security/pam_stack.so service=system-auth
+auth       required     /lib/security/pam_listfile.so item=user sense=deny \
+	 file=/etc/ftpusers onerr=succeed
+auth       sufficient   /lib/security/pam_winbind.so
+auth       required     /lib/security/pam_stack.so service=system-auth
+auth       required     /lib/security/pam_shells.so
+account    sufficient   /lib/security/pam_winbind.so
+account    required     /lib/security/pam_stack.so service=system-auth
+session    required     /lib/security/pam_stack.so service=system-auth

    The /etc/pam.d/login file can be changed nearly the -same way. It now looks like this: +same way. It now looks like this: 

    -	auth       required     /lib/security/pam_securetty.so
-	auth       sufficient   /lib/security/pam_winbind.so
-	auth       sufficient   /lib/security/pam_unix.so use_first_pass
-	auth       required     /lib/security/pam_stack.so service=system-auth
-	auth       required     /lib/security/pam_nologin.so
-	account    sufficient   /lib/security/pam_winbind.so
-	account    required     /lib/security/pam_stack.so service=system-auth
-	password   required     /lib/security/pam_stack.so service=system-auth
-	session    required     /lib/security/pam_stack.so service=system-auth
-	session    optional     /lib/security/pam_console.so
+auth       required     /lib/security/pam_securetty.so
+auth       sufficient   /lib/security/pam_winbind.so
+auth       sufficient   /lib/security/pam_UNIX.so use_first_pass
+auth       required     /lib/security/pam_stack.so service=system-auth
+auth       required     /lib/security/pam_nologin.so
+account    sufficient   /lib/security/pam_winbind.so
+account    required     /lib/security/pam_stack.so service=system-auth
+password   required     /lib/security/pam_stack.so service=system-auth
+session    required     /lib/security/pam_stack.so service=system-auth
+session    optional     /lib/security/pam_console.so

    In this case, I added the 

    auth sufficient /lib/security/pam_winbind.so

    lines as before, but also added the 

    required pam_securetty.so

    -above it, to disallow root logins over the network. I also added a +above it, to disallow root logins over the network. I also added a 

    sufficient /lib/security/pam_unix.so use_first_pass

    line after the winbind.so line to get rid of annoying double prompts for passwords. -

    Solaris-specific configuration

    -The /etc/pam.conf needs to be changed. I changed this file so that my Domain -users can logon both locally as well as telnet.The following are the changes -that I made.You can customize the pam.conf file as per your requirements,but +

    Solaris-specific configuration

    +The /etc/pam.conf needs to be changed. I changed this file so my Domain +users can logon both locally as well as telnet. The following are the changes +that I made. You can customize the pam.conf file as per your requirements, but be sure of those changes because in the worst case it will leave your system nearly impossible to boot. 

    -	#
-	#ident	"@(#)pam.conf	1.14	99/09/16 SMI"
-	#
-	# Copyright (c) 1996-1999, Sun Microsystems, Inc.
-	# All Rights Reserved.
-	#
-	# PAM configuration
-	#
-	# Authentication management
-	#
-	login   auth required   /usr/lib/security/pam_winbind.so
-	login	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass 
-	login	auth required 	/usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass 
-	#
-	rlogin  auth sufficient /usr/lib/security/pam_winbind.so
-	rlogin  auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1
-	rlogin	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
-	#
-	dtlogin auth sufficient /usr/lib/security/pam_winbind.so
-	dtlogin	auth required 	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
-	#
-	rsh	auth required	/usr/lib/security/$ISA/pam_rhosts_auth.so.1
-	other   auth sufficient /usr/lib/security/pam_winbind.so
-	other	auth required	/usr/lib/security/$ISA/pam_unix.so.1 try_first_pass
-	#
-	# Account management
-	#
-	login   account sufficient      /usr/lib/security/pam_winbind.so
-	login	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
-	login	account required	/usr/lib/security/$ISA/pam_unix.so.1 
-	#
-	dtlogin account sufficient      /usr/lib/security/pam_winbind.so
-	dtlogin	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
-	dtlogin	account required	/usr/lib/security/$ISA/pam_unix.so.1 
-	#
-	other   account sufficient      /usr/lib/security/pam_winbind.so
-	other	account requisite	/usr/lib/security/$ISA/pam_roles.so.1 
-	other	account required	/usr/lib/security/$ISA/pam_unix.so.1 
-	#
-	# Session management
-	#
-	other	session required	/usr/lib/security/$ISA/pam_unix.so.1 
-	#
-	# Password management
-	#
-	#other   password sufficient     /usr/lib/security/pam_winbind.so
-	other	password required	/usr/lib/security/$ISA/pam_unix.so.1 
-	dtsession auth required	/usr/lib/security/$ISA/pam_unix.so.1
-	#
-	# Support for Kerberos V5 authentication (uncomment to use Kerberos)
-	#
-	#rlogin	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
-	#login	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
-	#dtlogin	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
-	#other	auth optional	/usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
-	#dtlogin	account optional /usr/lib/security/$ISA/pam_krb5.so.1
-	#other	account optional /usr/lib/security/$ISA/pam_krb5.so.1
-	#other	session optional /usr/lib/security/$ISA/pam_krb5.so.1
-	#other	password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+#
+#ident "@(#)pam.conf 1.14 99/09/16 SMI"
+#
+# Copyright (c) 1996-1999, Sun Microsystems, Inc.
+# All Rights Reserved.
+#
+# PAM configuration
+#
+# Authentication management
+#
+login   auth required   /usr/lib/security/pam_winbind.so
+login auth required  /usr/lib/security/$ISA/pam_UNIX.so.1 try_first_pass 
+login auth required  /usr/lib/security/$ISA/pam_dial_auth.so.1 try_first_pass 
+#
+rlogin  auth sufficient /usr/lib/security/pam_winbind.so
+rlogin  auth sufficient /usr/lib/security/$ISA/pam_rhosts_auth.so.1
+rlogin auth required  /usr/lib/security/$ISA/pam_UNIX.so.1 try_first_pass
+#
+dtlogin auth sufficient /usr/lib/security/pam_winbind.so
+dtlogin auth required  /usr/lib/security/$ISA/pam_UNIX.so.1 try_first_pass
+#
+rsh auth required /usr/lib/security/$ISA/pam_rhosts_auth.so.1
+other   auth sufficient /usr/lib/security/pam_winbind.so
+other auth required /usr/lib/security/$ISA/pam_UNIX.so.1 try_first_pass
+#
+# Account management
+#
+login   account sufficient      /usr/lib/security/pam_winbind.so
+login account requisite /usr/lib/security/$ISA/pam_roles.so.1 
+login account required /usr/lib/security/$ISA/pam_UNIX.so.1 
+#
+dtlogin account sufficient      /usr/lib/security/pam_winbind.so
+dtlogin account requisite /usr/lib/security/$ISA/pam_roles.so.1 
+dtlogin account required /usr/lib/security/$ISA/pam_UNIX.so.1 
+#
+other   account sufficient      /usr/lib/security/pam_winbind.so
+other account requisite /usr/lib/security/$ISA/pam_roles.so.1 
+other account required /usr/lib/security/$ISA/pam_UNIX.so.1 
+#
+# Session management
+#
+other session required /usr/lib/security/$ISA/pam_UNIX.so.1 
+#
+# Password management
+#
+#other   password sufficient     /usr/lib/security/pam_winbind.so
+other password required /usr/lib/security/$ISA/pam_UNIX.so.1 
+dtsession auth required /usr/lib/security/$ISA/pam_UNIX.so.1
+#
+# Support for Kerberos V5 authentication (uncomment to use Kerberos)
+#
+#rlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+#login auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+#dtlogin auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+#other auth optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass
+#dtlogin account optional /usr/lib/security/$ISA/pam_krb5.so.1
+#other account optional /usr/lib/security/$ISA/pam_krb5.so.1
+#other session optional /usr/lib/security/$ISA/pam_krb5.so.1
+#other password optional /usr/lib/security/$ISA/pam_krb5.so.1 try_first_pass

    -I also added a try_first_pass line after the winbind.so line to get rid of -annoying double prompts for passwords. +I also added a try_first_pass line after the winbind.so +line to get rid of annoying double prompts for passwords.

    Now restart your Samba and try connecting through your application that you configured in the pam.conf. -

    Conclusion

    The winbind system, through the use of the Name Service - Switch, Pluggable Authentication Modules, and appropriate - Microsoft RPC calls have allowed us to provide seamless - integration of Microsoft Windows NT domain users on a - UNIX system. The result is a great reduction in the administrative - cost of running a mixed UNIX and NT network.

    Common Errors

    Winbind has a number of limitations in its current +

    Conclusion

    The Winbind system, through the use of the Name Service +Switch, Pluggable Authentication Modules, and appropriate +Microsoft RPC calls have allowed us to provide seamless +integration of Microsoft Windows NT domain users on a +UNIX system. The result is a great reduction in the administrative +cost of running a mixed UNIX and NT network.

    Common Errors

    Winbind has a number of limitations in its current released version that we hope to overcome in future releases:

    • Winbind is currently only available for - the Linux, Solaris, AIX and IRIX operating systems, although ports to other operating + the Linux, Solaris, AIX, and IRIX operating systems, although ports to other operating systems are certainly possible. For such ports to be feasible, we require the C library of the target operating system to support the Name Service Switch and Pluggable Authentication Modules systems. This is becoming more common as NSS and - PAM gain support among UNIX vendors.

    • The mappings of Windows NT RIDs to UNIX ids + PAM gain support among UNIX vendors.

    • The mappings of Windows NT RIDs to UNIX IDs is not made algorithmically and depends on the order in which - unmapped users or groups are seen by winbind. It may be difficult - to recover the mappings of rid to UNIX id mapping if the file - containing this information is corrupted or destroyed.

    • Currently the winbind PAM module does not take + unmapped users or groups are seen by Winbind. It may be difficult + to recover the mappings of RID to UNIX ID mapping if the file + containing this information is corrupted or destroyed.

    • Currently the Winbind PAM module does not take into account possible workstation and logon time restrictions - that may be been set for Windows NT users, this is - instead up to the PDC to enforce.

    NSCD Problem Warning

    Note

    - Do NOT under ANY circumstances run nscd on any system - on which winbind is running. + that may be set for Windows NT users, this is + instead up to the PDC to enforce.

    NSCD Problem Warning

    Warning

    + Do not under any circumstances run nscd on any system + on which winbindd is running.

    If nscd is running on the UNIX/Linux system, then - even though NSSWITCH is correctly configured it will NOT be possible to resolve + even though NSSWITCH is correctly configured it will not be possible to resolve domain users and groups for file and directory controls. -

    Prev Up Next
    Chapter 20. Stackable VFS modules Home Chapter 22. Advanced Network Management
    +

    Winbind Is Not Resolving Users and Groups

    “ + My smb.conf file is correctly configured. I have specified + idmap uid = 12000, + and idmap gid = 3000-3500 + and winbind is running. When I do the following it all works fine. + ”

    +root# wbinfo -u
+MIDEARTH+maryo
+MIDEARTH+jackb
+MIDEARTH+ameds
+...
+MIDEARTH+root
+
+root# wbinfo -g
+MIDEARTH+Domain Users
+MIDEARTH+Domain Admins
+MIDEARTH+Domain Guests
+...
+MIDEARTH+Accounts
+
+root# getent passwd
+root:x:0:0:root:/root:/bin/bash
+bin:x:1:1:bin:/bin:/bin/bash
+...
+maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false
+

    “ +But the following command just fails: +

    +root# chown maryo a_file
+chown: `maryo': invalid user
+
    +This is driving me nuts! What can be wrong? +”

    +Same problem as the one above. +Your system is likely running nscd, the name service +caching daemon. Shut it down, do not restart it! You will find your problem resolved. +

    Prev Up Next
    Chapter 20. Stackable VFS modules Home Chapter 22. Advanced Network Management
    diff --git a/docs/htmldocs/winbindd.8.html b/docs/htmldocs/winbindd.8.html index 7b2d6e0261..6dd9819c0e 100644 --- a/docs/htmldocs/winbindd.8.html +++ b/docs/htmldocs/winbindd.8.html @@ -49,8 +49,8 @@ group: files winbind package, or the AIX process monitor.

    -S

    If specified, this parameter causes winbindd to log to standard output rather - than a file.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the + than a file.

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -63,13 +63,13 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension ".client" will be appended. The log file is never removed by the client. @@ -108,15 +108,15 @@ never removed by the client. and group rids.

    CONFIGURATION

    Configuration of the winbindd daemon is done through configuration parameters in the smb.conf(5) file. All parameters should be specified in the [global] section of smb.conf.

    EXAMPLE SETUP

    To setup winbindd for user and group lookups plus + winbind separator

  • + idmap uid

  • + idmap gid

  • + winbind cache time

  • + winbind enum users

  • + winbind enum groups

  • + template homedir

  • + template shell

  • + winbind use default domain

    • EXAMPLE SETUP

    To setup winbindd for user and group lookups plus authentication from a domain controller use something like the following setup. This was tested on a RedHat 6.2 Linux box.

    In /etc/nsswitch.conf put the following: diff --git a/docs/manpages/net.8 b/docs/manpages/net.8 index 70a6090792..2051804504 100644 --- a/docs/manpages/net.8 +++ b/docs/manpages/net.8 @@ -98,7 +98,7 @@ Make queries to the external server using the machine account of the local serve \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/nmbd.8 b/docs/manpages/nmbd.8 index 0b63e77ee2..dbf6593d91 100644 --- a/docs/manpages/nmbd.8 +++ b/docs/manpages/nmbd.8 @@ -84,7 +84,7 @@ The default path to this file is compiled into Samba as part of the build proces .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -97,7 +97,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/nmblookup.1 b/docs/manpages/nmblookup.1 index 5cc590ae11..8dc68a366b 100644 --- a/docs/manpages/nmblookup.1 +++ b/docs/manpages/nmblookup.1 @@ -100,7 +100,7 @@ Do a unicast query to the specified address or host \fIunicast address\fR\&. Thi .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -113,7 +113,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/ntlm_auth.1 b/docs/manpages/ntlm_auth.1 index e234ad7fb8..e889634bf0 100644 --- a/docs/manpages/ntlm_auth.1 +++ b/docs/manpages/ntlm_auth.1 @@ -88,7 +88,7 @@ Request NT key .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -101,7 +101,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/pdbedit.8 b/docs/manpages/pdbedit.8 index 75a655a7e7..13113cd3bb 100644 --- a/docs/manpages/pdbedit.8 +++ b/docs/manpages/pdbedit.8 @@ -282,7 +282,7 @@ Print a summary of command line options\&. .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -295,7 +295,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/rpcclient.1 b/docs/manpages/rpcclient.1 index 0684d74197..fe8b6c2e39 100644 --- a/docs/manpages/rpcclient.1 +++ b/docs/manpages/rpcclient.1 @@ -61,7 +61,7 @@ There is no default for this parameter\&. If not supplied, it will be determined .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -74,7 +74,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/smb.conf.5 b/docs/manpages/smb.conf.5 index 55fdc8be44..0ed82400aa 100644 --- a/docs/manpages/smb.conf.5 +++ b/docs/manpages/smb.conf.5 @@ -458,6 +458,10 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIadd user to group script\fR +.TP +\(bu +\fIafs username map\fR + .TP \(bu \fIalgorithmic rid base\fR @@ -1102,10 +1106,6 @@ Here is a list of all global parameters\&. See the section of each parameter for \(bu \fIstat cache\fR -.TP -\(bu -\fIstrip dot\fR - .TP \(bu \fIsyslog\fR @@ -1265,6 +1265,10 @@ Here is a list of all service parameters\&. See the section on each parameter fo \(bu \fIadmin users\fR +.TP +\(bu +\fIafs share\fR + .TP \(bu \fIallow hosts\fR @@ -1941,6 +1945,31 @@ Default: \fBno admin users\fR Example: \fBadmin users = jason\fR +.TP +afs share (S) +This parameter controls whether special AFS features are enabled for this share\&. If enabled, it assumes that the directory exported via the \fIpath\fR parameter is a local AFS import\&. The special AFS features include the attempt to hand-craft an AFS token if you enabled --with-fake-kaserver in configure\&. + + +Default: \fBafs share = no\fR + + +Example: \fBafs share = yes\fR + + +.TP +afs username map (G) +If you are using the fake kaserver AFS feature, you might want to hand-craft the usernames you are creating tokens for\&. For example this is necessary if you have users from several domain in your AFS Protection Database\&. One possible scheme to code users as DOMAIN+User as it is done by winbind with the + as a separator\&. + + +The mapped user name must contain the cell name to log into, so without setting this parameter there will be no token\&. + + +Default: \fBnone\fR + + +Example: \fBafs username map = %u@afs.samba.org\fR + + .TP algorithmic rid base (G) This determines how Samba will use its algorithmic mapping from uids/gid to the RIDs needed to construct NT Security Identifiers\&. @@ -2175,6 +2204,9 @@ This parameter determines whether or not \fBsmbclient\fR(8) will attempt to auth If enabled, only an NTLMv2 and LMv2 response (both much more secure than earlier versions) will be sent\&. Many servers (including NT4 < SP4, Win9x and Samba 2\&.2) are not compatible with NTLMv2\&. +Similarly, if enabled, NTLMv1, \fBclient lanman auth\fR and \fBclient plaintext auth\fR authentication will be disabled\&. This also disables share-level authentication\&. + + If disabled, an NTLM response (and possibly a LANMAN response) will be sent by the client, depending on the value of \fBclient lanman auth\fR\&. @@ -3226,7 +3258,7 @@ Example: \fBhomedir map = amd.homedir\fR .TP host msdfs (G) -This boolean parameter is only available if Samba has been configured and compiled with the \fB --with-msdfs\fR option\&. If set to \fByes\fR, Samba will act as a Dfs server, and allow Dfs-aware clients to browse Dfs trees hosted on the server\&. +If set to \fByes\fR, Samba will act as a Dfs server, and allow Dfs-aware clients to browse Dfs trees hosted on the server\&. See also the \fI msdfs root\fR share level parameter\&. For more information on setting up a Dfs tree on Samba, refer to ???\&. @@ -3579,7 +3611,7 @@ This parameters specifies the suffix that is used when storing idmap mappings\&. Default: \fBnone\fR -Example: \fBdc=samba,ou=Idmap\fR +Example: \fBou=Idmap,dc=samba,dc=org\fR .TP @@ -4584,7 +4616,7 @@ Example: \fBmsdfs proxy = \\\\otherserver\\someshare\fR .TP msdfs root (S) -This boolean parameter is only available if Samba is configured and compiled with the \fB --with-msdfs\fR option\&. If set to \fByes\fR, Samba treats the share as a Dfs root and allows clients to browse the distributed file system tree rooted at the share directory\&. Dfs links are specified in the share directory by symbolic links of the form \fImsdfs:serverA\\\\shareA,serverB\\\\shareB\fR and so on\&. For more information on setting up a Dfs tree on Samba, refer to ???\&. +If set to \fByes\fR, Samba treats the share as a Dfs root and allows clients to browse the distributed file system tree rooted at the share directory\&. Dfs links are specified in the share directory by symbolic links of the form \fImsdfs:serverA\\\\shareA,serverB\\\\shareB\fR and so on\&. For more information on setting up a Dfs tree on Samba, refer to ???\&. See also \fIhost msdfs\fR @@ -6149,13 +6181,13 @@ Default: \fBstrict allocate = no\fR .TP strict locking (S) -This is a boolean that controls the handling of file locking in the server\&. When this is set to \fByes\fR the server will check every read and write access for file locks, and deny access if locks exist\&. This can be slow on some systems\&. +This is a boolean that controls the handling of file locking in the server\&. When this is set to \fByes\fR, the server will check every read and write access for file locks, and deny access if locks exist\&. This can be slow on some systems\&. -When strict locking is \fBno\fR the server does file lock checks only when the client explicitly asks for them\&. +When strict locking is disabled, the server performs file lock checks only when the client explicitly asks for them\&. -Well-behaved clients always ask for lock checks when it is important, so in the vast majority of cases \fBstrict locking = no\fR is preferable\&. +Well-behaved clients always ask for lock checks when it is important\&. So in the vast majority of cases, \fBstrict locking = no\fR is preferable\&. Default: \fBstrict locking = no\fR @@ -6172,14 +6204,6 @@ See also the \fIsync always\fR parameter\&. Default: \fBstrict sync = no\fR -.TP -strip dot (G) -This is a boolean that controls whether to strip trailing dots off UNIX filenames\&. This helps with some CDROMs that have filenames ending in a single dot\&. - - -Default: \fBstrip dot = no\fR - - .TP sync always (S) This is a boolean parameter that controls whether writes will always be written to stable storage before the write call returns\&. If this is \fBno\fR then the server will be guided by the client's request in each write call (clients can set a bit indicating that a particular write should be synchronous)\&. If this is \fByes\fR then every write will be followed by a \fBfsync() \fR call to ensure the data is written to disk\&. Note that the \fIstrict sync\fR parameter must be set to \fByes\fR in order for this parameter to have any affect\&. diff --git a/docs/manpages/smbcacls.1 b/docs/manpages/smbcacls.1 index cb9fcfb884..006679962c 100644 --- a/docs/manpages/smbcacls.1 +++ b/docs/manpages/smbcacls.1 @@ -23,7 +23,7 @@ smbcacls \- Set or get ACLs on an NT file or directory names .SH "SYNOPSIS" .nf -\fBsmbcacls\fR {//server/share} {filename} [-D acls] [-M acls] [-A acls] [-S acls] [-C name] [-G name] [-n] [-t] [-U username] [-h] [-d] +\fBsmbcacls\fR {//server/share} {filename} [-D acls] [-M acls] [-a acls] [-S acls] [-C name] [-G name] [-n] [-t] [-U username] [-h] [-d] .fi @@ -41,7 +41,7 @@ The \fBsmbcacls\fR program manipulates NT Access Control Lists (ACLs) on SMB fil The following options are available to the \fBsmbcacls\fR program\&. The format of ACLs is described in the section ACL FORMAT .TP --A acls +-a acls Add the ACLs specified to the ACL list\&. Existing access control entries are unchanged\&. @@ -98,7 +98,7 @@ Print a summary of command line options\&. .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -111,7 +111,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/smbclient.1 b/docs/manpages/smbclient.1 index 8de0c58a6d..e14a2770a7 100644 --- a/docs/manpages/smbclient.1 +++ b/docs/manpages/smbclient.1 @@ -157,7 +157,7 @@ This option changes the transmit/send buffer size when getting or putting a file .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -170,7 +170,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/smbcquotas.1 b/docs/manpages/smbcquotas.1 index e270fe3b4a..5a3510810a 100644 --- a/docs/manpages/smbcquotas.1 +++ b/docs/manpages/smbcquotas.1 @@ -83,7 +83,7 @@ Print a summary of command line options\&. .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -96,7 +96,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. @@ -195,5 +195,5 @@ This man page is correct for version 3\&.0 of the Samba suite\&. The original Samba software and related utilities were created by Andrew Tridgell\&. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed\&. .PP -\fBsmbcacls\fR was written by Stefan Metzmacher\&. +\fBsmbcquotas\fR was written by Stefan Metzmacher\&. diff --git a/docs/manpages/smbd.8 b/docs/manpages/smbd.8 index 07b563af5c..1c2c75bf4d 100644 --- a/docs/manpages/smbd.8 +++ b/docs/manpages/smbd.8 @@ -71,7 +71,7 @@ If this parameter is specified it causes the server to run "interactively", not .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -84,7 +84,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/smbsh.1 b/docs/manpages/smbsh.1 index 3b9e507246..47903ed104 100644 --- a/docs/manpages/smbsh.1 +++ b/docs/manpages/smbsh.1 @@ -62,7 +62,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/smbstatus.1 b/docs/manpages/smbstatus.1 index 21b05a2429..44f0bae232 100644 --- a/docs/manpages/smbstatus.1 +++ b/docs/manpages/smbstatus.1 @@ -49,7 +49,7 @@ gives brief output\&. .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -62,7 +62,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/smbtree.1 b/docs/manpages/smbtree.1 index 84c2399c77..a76c679c21 100644 --- a/docs/manpages/smbtree.1 +++ b/docs/manpages/smbtree.1 @@ -53,7 +53,7 @@ Only print a list of all the domains and servers responding on broadcast or know .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -66,7 +66,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/swat.8 b/docs/manpages/swat.8 index 26e5376bf6..99e8de0379 100644 --- a/docs/manpages/swat.8 +++ b/docs/manpages/swat.8 @@ -54,7 +54,7 @@ This option disables authentication and puts \fBswat\fR in demo mode\&. In that .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -67,7 +67,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/testparm.1 b/docs/manpages/testparm.1 index 4a6d788f79..4207c2fe9a 100644 --- a/docs/manpages/testparm.1 +++ b/docs/manpages/testparm.1 @@ -58,7 +58,7 @@ Print a summary of command line options\&. .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP diff --git a/docs/manpages/vfstest.1 b/docs/manpages/vfstest.1 index 3400c6b570..20566ee143 100644 --- a/docs/manpages/vfstest.1 +++ b/docs/manpages/vfstest.1 @@ -53,7 +53,7 @@ File name for log/debug files\&. The extension \fB'\&.client'\fR will be appende .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -66,7 +66,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/docs/manpages/wbinfo.1 b/docs/manpages/wbinfo.1 index 6c5ca93e19..f740448b58 100644 --- a/docs/manpages/wbinfo.1 +++ b/docs/manpages/wbinfo.1 @@ -167,7 +167,7 @@ Convert a SID to a UNIX group id\&. If the SID does not correspond to a UNIX gro .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP diff --git a/docs/manpages/winbindd.8 b/docs/manpages/winbindd.8 index 14621e1356..71e014cd4d 100644 --- a/docs/manpages/winbindd.8 +++ b/docs/manpages/winbindd.8 @@ -84,7 +84,7 @@ If specified, this parameter causes \fBwinbindd\fR to log to standard output rat .TP -V -Prints the version number for \fBsmbd\fR\&. +Prints the program version number\&. .TP @@ -97,7 +97,7 @@ The file specified contains the configuration details required by the server\&. \fIdebuglevel\fR is an integer from 0 to 10\&. The default value if this parameter is not specified is zero\&. -The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day to day running - it generates a small amount of information about operations carried out\&. +The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out\&. Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&. diff --git a/examples/LDAP/smbldap-tools/smbldap-groupadd.pl b/examples/LDAP/smbldap-tools/smbldap-groupadd.pl index ee804b34d3..91cd2dad53 100755 --- a/examples/LDAP/smbldap-tools/smbldap-groupadd.pl +++ b/examples/LDAP/smbldap-tools/smbldap-groupadd.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/perl -w # This code was developped by IDEALX (http://IDEALX.org/) and # contributors (their names can be found in the CONTRIBUTORS file). @@ -23,6 +23,9 @@ # Purpose of smbldap-groupadd : group (posix) add use strict; +use FindBin; +use FindBin qw($RealBin); +use lib "$RealBin/"; use smbldap_tools; use Getopt::Std; diff --git a/examples/LDAP/smbldap-tools/smbldap-groupdel.pl b/examples/LDAP/smbldap-tools/smbldap-groupdel.pl index 3d072585b2..89d0d993ac 100755 --- a/examples/LDAP/smbldap-tools/smbldap-groupdel.pl +++ b/examples/LDAP/smbldap-tools/smbldap-groupdel.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/perl -w # This code was developped by IDEALX (http://IDEALX.org/) and # contributors (their names can be found in the CONTRIBUTORS file). @@ -23,6 +23,9 @@ # Purpose of smbldap-groupdel : group (posix) deletion use strict; +use FindBin; +use FindBin qw($RealBin); +use lib "$RealBin/"; use smbldap_tools; use smbldap_conf; @@ -48,9 +51,7 @@ if (!defined($dn_line = get_group_dn($_groupName))) { my $dn = get_dn_from_line($dn_line); -my $rc = system "$ldapdelete $dn >/dev/null"; -die "$0: error while deleting group $_groupName\n" - unless ($rc == 0); +group_del($dn); my $nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1"; diff --git a/examples/LDAP/smbldap-tools/smbldap-groupshow.pl b/examples/LDAP/smbldap-tools/smbldap-groupshow.pl index bc5b4d98fb..18fe082e66 100755 --- a/examples/LDAP/smbldap-tools/smbldap-groupshow.pl +++ b/examples/LDAP/smbldap-tools/smbldap-groupshow.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/perl -w # This code was developped by IDEALX (http://IDEALX.org/) and # contributors (their names can be found in the CONTRIBUTORS file). @@ -26,8 +26,10 @@ # . originally by David Le Corfec use strict; +use FindBin; +use FindBin qw($RealBin); +use lib "$RealBin/"; use smbldap_tools; - use Getopt::Std; my %Options; diff --git a/examples/LDAP/smbldap-tools/smbldap-migrate-accounts.pl b/examples/LDAP/smbldap-tools/smbldap-migrate-accounts.pl index 0d0efa384c..86f52cb53e 100755 --- a/examples/LDAP/smbldap-tools/smbldap-migrate-accounts.pl +++ b/examples/LDAP/smbldap-tools/smbldap-migrate-accounts.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/perl -w # This code was developped by IDEALX (http://IDEALX.org/) and # contributors (their names can be found in the CONTRIBUTORS file). @@ -25,10 +25,13 @@ use strict; use Getopt::Std; +use FindBin; +use FindBin qw($RealBin); +use lib "$RealBin/"; use smbldap_tools; use smbldap_conf; -# smbldap-migrate.pl (-? for help) +# smbldap-migrate.pl (-? or -h for help) # # Read pwdump entries on stdin, and add them to the ldap server. # Output uncreated/unmodified entries (see parameters -C -U) @@ -38,20 +41,19 @@ use smbldap_conf; sub modify_account { my ($login, $basedn, $lmpwd, $ntpwd, $gecos, $homedir) = @_; - - my $tmpldif = -"dn: uid=$login,$basedn -changetype: modify -lmpassword: $lmpwd -ntpassword: $ntpwd -gecos: $gecos -sambaHomePath: $homedir - -"; - - die "$0: error while modifying user $login\n" - unless (do_ldapmodify($tmpldif) == 0); - undef $tmpldif; + # bind to a directory with dn and password + my $ldap_master=connect_ldap_master(); + my $modify = $ldap_master->modify ("uid=$login,$basedn", + changes => [ + replace => [lmpassword => "$lmpwd"], + replace => [ntpassword => "$ntpwd"], + replace => [gecos => "$gecos"], + replace => [sambaHomePath => "$homedir"] + ] + ); + $modify->code && die "failed to modify entry: ", $modify->error ; + # take down the session + $ldap_master->unbind; } ##################### @@ -59,9 +61,9 @@ sambaHomePath: $homedir my %Options; -my $ok = getopts('awA:CUW:?', \%Options); +my $ok = getopts('awA:CUW:?h', \%Options); -if ( (!$ok) || ($Options{'?'}) ) { +if ( (!$ok) || ($Options{'?'}) || ($Options{'h'}) ) { print "Usage: $0 [-awAWCU?]\n"; print " -a process only people, ignore computers\n"; print " -w process only computers, ignore persons\n"; @@ -69,7 +71,7 @@ if ( (!$ok) || ($Options{'?'}) ) { print " -W option string passed verbatim to smbldap-useradd for computers\n"; print " -C if entry not found, don't create it and log it to stdout (default: create it)\n"; print " -U if entry found, don't update it and log it to stdout (default: update it)\n"; - print " -? show this help message\n"; + print " -?|-h show this help message\n"; exit (1); } @@ -81,8 +83,7 @@ my %errors = ( 'user' => 0, 'machine' => 0); my %existing = ( 'user' => 0, 'machine' => 0); my $specialskipped = 0; -while (<>) -{ +while (<>) { my ($login, $rid, $lmpwd, $ntpwd, $gecos, $homedir, $b) = split(/:/, $_); my $usertype; my $userbasedn; @@ -99,8 +100,7 @@ while (<>) $usertype = "-w $Options{'W'}"; $userbasedn = $computersdn; - } - else { # people + } else { # people $processed{'user'}++; if (defined($Options{'w'})) { print STDERR "ignoring $login\n"; @@ -124,7 +124,7 @@ while (<>) # normalize gecos if (!($gecos eq "")) { - $gecos =~ tr/ÁÀÂÄáàâäÇçÉÈÊËÆéèêëæÍÌÏÎíìîÏÑñÓÒÔÖóòôöÚÙÜÛúùüûÝýÿ/AAAAaaaaCcEEEEEeeeeeIIIIiiiiNnOOOOooooUUUUuuuuYyy/; + $gecos =~ tr/ÃÀÂÄáàâäÇçÉÈÊËÆéèêëæÃÃŒÃÎíìîÃÑñÓÒÔÖóòôöÚÙÜÛúùüûÃýÿ/AAAAaaaaCcEEEEEeeeeeIIIIiiiiNnOOOOooooUUUUuuuuYyy/; } else { $gecos = $_userGecos; } @@ -142,25 +142,21 @@ while (<>) next; } # lem modif... a retirer si pb - if ($entry_type eq "user") - { + if ($entry_type eq "user") { modify_account($login, $userbasedn, $lmpwd, $ntpwd, $gecos, $homedir); } $created{$entry_type}++; - } - else { # uid doesn't exist and no create => log + } else { # uid doesn't exist and no create => log print "$_"; $logged{$entry_type}++; } - } - else { # account exists + } else { # account exists $existing{$entry_type}++; if (!defined($Options{'U'})) { # exists and modify modify_account($login, $userbasedn, $lmpwd, $ntpwd, $gecos, $homedir); $updated{$entry_type}++; - } - else { # exists and log + } else { # exists and log print "$_"; $logged{$entry_type}++; } diff --git a/examples/LDAP/smbldap-tools/smbldap-migrate-groups.pl b/examples/LDAP/smbldap-tools/smbldap-migrate-groups.pl index 0d3dd07d50..c60be18caf 100644 --- a/examples/LDAP/smbldap-tools/smbldap-migrate-groups.pl +++ b/examples/LDAP/smbldap-tools/smbldap-migrate-groups.pl @@ -26,6 +26,9 @@ use strict; +use FindBin; +use FindBin qw($RealBin); +use lib "$RealBin/"; use smbldap_tools; use smbldap_conf; use Getopt::Std; @@ -175,8 +178,7 @@ my $group_desc; my $has_members = 0; my @members = (); -while (<>) -{ +while (<>) { my $line = $_; chomp($line); next if ( $line =~ m/^\s*$/ ); diff --git a/examples/LDAP/smbldap-tools/smbldap-passwd.pl b/examples/LDAP/smbldap-tools/smbldap-passwd.pl index 29aee97c50..7845e5548e 100755 --- a/examples/LDAP/smbldap-tools/smbldap-passwd.pl +++ b/examples/LDAP/smbldap-tools/smbldap-passwd.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/perl -w # LDAP to unix password sync script for samba # @@ -27,6 +27,9 @@ # . may also replace /bin/passwd use strict; +use FindBin; +use FindBin qw($RealBin); +use lib "$RealBin/"; use smbldap_tools; use smbldap_conf; @@ -105,6 +108,9 @@ if ($pass ne $pass2) { exit (10); } +# First, connecting to the directory +my $ldap_master=connect_ldap_master(); + # only modify smb passwords if smb user if ($samba == 1) { if (!$with_smbpasswd) { @@ -116,25 +122,19 @@ if ($samba == 1) { my $ntpwd = `$mk_ntpasswd '$pass'`; chomp(my $sambaLMPassword = substr($ntpwd, 0, index($ntpwd, ':'))); chomp(my $sambaNTPassword = substr($ntpwd, index($ntpwd, ':')+1)); - -# change nt/lm passwords - my $tmpldif = -"$dn_line -changetype: modify -replace: sambaLMPassword -sambaLMPassword: $sambaLMPassword -- -changetype: modify -replace: sambaNTPassword -sambaNTPassword: $sambaNTPassword -- - -"; - die "$0: error while modifying password for $user\n" - unless (do_ldapmodify($tmpldif) == 0); - undef $tmpldif; - } - else { + # the sambaPwdLastSet must be updating + my $date=time; + # Let's change nt/lm passwords + my $modify = $ldap_master->modify ( "$dn", + changes => [ + replace => [sambaLMPassword => "$sambaLMPassword"], + replace => [sambaNTPassword => "$sambaNTPassword"], + replace => [sambaPwdLastSet => "$date"] + ] + ); + $modify->code && warn "failed to modify entry: ", $modify->error ; + + } else { if ($< != 0) { my $FILE="|$smbpasswd -s >/dev/null"; open (FILE, $FILE) || die "$!\n"; @@ -157,13 +157,19 @@ EOF } } } + # change unix password -$ret = system "$ldappasswd $dn -s '$pass' > /dev/null"; -if ($ret == 0) { - print "all authentication tokens updated successfully\n"; -} else { - return $ret; -} +my $hash_password = `slappasswd -h {$hash_encrypt} -s '$pass'`; +chomp($hash_password); +my $modify = $ldap_master->modify ( "$dn", + changes => [ + replace => [userPassword => "$hash_password"] + ] + ); +$modify->code && warn "Unable to change password : ", $modify->error ; + +# take down session +$ldap_master->unbind; exit 0; diff --git a/examples/LDAP/smbldap-tools/smbldap-populate.pl b/examples/LDAP/smbldap-tools/smbldap-populate.pl index 1676017c67..ce497672a9 100755 --- a/examples/LDAP/smbldap-tools/smbldap-populate.pl +++ b/examples/LDAP/smbldap-tools/smbldap-populate.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/perl -w # Populate a LDAP base for Samba-LDAP usage # @@ -27,10 +27,13 @@ # . For lazy people, replace ldapadd (with only an ldif parameter) use strict; +use FindBin; +use FindBin qw($RealBin); +use lib "$RealBin/"; use smbldap_tools; use smbldap_conf; - use Getopt::Std; +use Net::LDAP::LDIF; use vars qw(%oc); @@ -56,6 +59,7 @@ if ( (!$ok) || ($Options{'?'}) ) { } my $_ldifName; +my $tmp_ldif_file="/tmp/$$.ldif"; if (@ARGV >= 1) { $_ldifName = $ARGV[0]; @@ -76,6 +80,7 @@ if (!defined($_ldifName)) { my $val; my $objcl; + print "Using builtin directory structure\n"; if ($suffix =~ m/([^=]+)=([^,]+)/) { $attr = $1; $val = $2; @@ -90,8 +95,8 @@ if (!defined($_ldifName)) { my ($organisation,$ext) = ($suffix =~ m/dc=(\w+),dc=(\w+)$/); #my $FILE="|cat"; - my $FILE="|$ldapadd -c"; - open (FILE, $FILE) || die "$!\n"; + my $FILE=$tmp_ldif_file; + open (FILE, ">$FILE") || die "Can't open file $FILE: $!\n"; print FILE <new($tmp_ldif_file, "r", onerror => 'undef' ); +while( not $ldif->eof() ) { + my $entry = $ldif->read_entry(); + if ( $ldif->error() ) { + print "Error msg: ",$ldif->error(),"\n"; + print "Error lines:\n",$ldif->error_lines(),"\n"; + } else { + my $dn = $entry->dn; + print "adding new entry: $dn\n"; + my $result=$ldap_master->add($entry); + $result->code && warn "failed to add entry: ", $result->error ; + } +} +$ldap_master->unbind; +system "rm -f $tmp_ldif_file"; exit(0); @@ -280,9 +299,7 @@ exit(0); If you give an extra parameter, it is assumed to be the ldif file to use instead of the builtin one. Options -a and -b - will be ignored. This usage mode makes the command behave - like ldapadd(1) with extra parameters taken from the smbldap-tools - config (smbldap_conf.pm). + will be ignored. =head1 FILES diff --git a/examples/LDAP/smbldap-tools/smbldap-useradd.pl b/examples/LDAP/smbldap-tools/smbldap-useradd.pl index 99c9525e82..a84d9f68b2 100755 --- a/examples/LDAP/smbldap-tools/smbldap-useradd.pl +++ b/examples/LDAP/smbldap-tools/smbldap-useradd.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/perl -w # This code was developped by IDEALX (http://IDEALX.org/) and # contributors (their names can be found in the CONTRIBUTORS file). @@ -23,6 +23,10 @@ # Purpose of smbldap-useradd : user (posix,shadow,samba) add use strict; + +use FindBin; +use FindBin qw($RealBin); +use lib "$RealBin/"; use smbldap_tools; use smbldap_conf; @@ -31,7 +35,7 @@ use smbldap_conf; use Getopt::Std; my %Options; -my $ok = getopts('axnmwPG:u:g:d:s:c:k:A:B:C:D:E:F:H:?', \%Options); +my $ok = getopts('axnmwPG:u:g:d:s:c:k:A:B:C:D:E:F:H:N:S:?', \%Options); if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { print "Usage: $0 [-awmugdsckGPABCDEFH?] username\n"; @@ -55,6 +59,8 @@ if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { print " -E sambaLogonScript (DOS script to execute on login)\n"; print " -F sambaProfilePath (profile directory, like '\\\\PDC-SRV\\profiles\\foo')\n"; print " -H sambaAcctFlags (samba account control bits like '[NDHTUMWSLKI]')\n"; + print " -N canonical name\n"; + print " -S surname\n"; print " -? show this help message\n"; exit (1); } @@ -75,7 +81,9 @@ if (!defined($userUidNumber)) { $UID_START++; } $userUidNumber = $UID_START; -} elsif (getpwuid($userUidNumber)) { die "Uid already exists.\n"; } +} elsif (getpwuid($userUidNumber)) { + die "Uid already exists.\n"; +} if ($nscd_status == 0) { system "/etc/init.d/nscd start > /dev/null 2>&1"; @@ -126,6 +134,14 @@ if (defined($Options{'x'})) { # Read only first @ARGV my $userName = $ARGV[0]; +# untaint $userName (can finish with one or two $) +if ($userName =~ /^([\w -]+\$?)$/) { + $userName = $1; +} else { + print "$0: illegal username\n"; + exit (1); +} + # user must not exist in LDAP (should it be nss-wide ?) my ($rc, $dn) = get_user_dn2($userName); if ($rc and defined($dn)) { @@ -137,17 +153,24 @@ if ($rc and defined($dn)) { } my $userHomeDirectory; +my ($userCN, $userSN); my $tmp; -if (!defined($userHomeDirectory = $Options{'d'})) -{ +if (!defined($userHomeDirectory = $Options{'d'})) { $userHomeDirectory = $_userHomePrefix."/".$userName; } $_userLoginShell = $tmp if (defined($tmp = $Options{'s'})); $_userGecos = $tmp if (defined($tmp = $Options{'c'})); $_skeletonDir = $tmp if (defined($tmp = $Options{'k'})); +$userCN = ($Options{'c'} || $userName); +$userCN = $tmp if (defined($tmp = $Options{'N'})); +$userSN = $userName; +$userSN = $tmp if (defined($tmp = $Options{'S'})); + ######################## +my $ldap_master=connect_ldap_master(); + # MACHINE ACCOUNT if (defined($tmp = $Options{'w'})) { @@ -163,55 +186,47 @@ if (defined($tmp = $Options{'w'})) { } if (!$with_smbpasswd) { - if (!add_samba_machine_mkntpwd($userName, $userUidNumber)) { - die "$0: error while adding samba account\n"; - } + # (jtournier) + # Objectclass sambaSAMAccount is now added directly by samba when joigning the domain (for samba3) + #if (!add_samba_machine_mkntpwd($userName, $userUidNumber)) { + # die "$0: error while adding samba account\n"; + #} } else { if (!add_samba_machine($userName)) { die "$0: error while adding samba account\n"; } - - my $tmpldif = -"dn: uid=$userName,$computersdn -changetype: modify -sambaAcctFlags: [W ] - -"; - die "$0: error while modifying accountflags of $userName\n" - unless (do_ldapmodify($tmpldif) == 0); - undef $tmpldif; + my $modify = $ldap_master->modify ( "$dn", + changes => [ + replace => [sambaAcctFlags => '[W ]'] + ] + ); + $modify->code && warn "failed to modify entry: ", $modify->error ; } exit 0; } -####################### - # USER ACCOUNT - # add posix account first -my $tmpldif = -"dn: uid=$userName,$usersdn -objectclass: inetOrgPerson -objectclass: posixAccount -cn: $userName -sn: $userName -uid: $userName -uidNumber: $userUidNumber -gidNumber: $userGidNumber -homeDirectory: $userHomeDirectory -loginShell: $_userLoginShell -gecos: $_userGecos -description: $_userGecos -userPassword: {crypt}x - -"; +my $add = $ldap_master->add ("uid=$userName,$usersdn", + attr => [ + 'objectclass' => ['top','inetOrgPerson', 'posixAccount'], + 'cn' => "$userCN", + 'sn' => "$userSN", + 'uid' => "$userName", + 'uidNumber' => "$userUidNumber", + 'gidNumber' => "$userGidNumber", + 'homeDirectory' => "$userHomeDirectory", + 'loginShell' => "$_userLoginShell", + 'gecos' => "$_userGecos", + 'description' => "$_userGecos", + 'userPassword' => "{crypt}x" + ] + ); + +$add->code && warn "failed to add entry: ", $add->error ; -die "$0: error while adding posix user $userName\n" - unless (do_ldapadd($tmpldif) == 0); - -undef $tmpldif; #if ($createGroup) { # group_add($userName, $userGidNumber); @@ -267,28 +282,24 @@ if (defined($Options{'a'})) { $valacctflags = "$tmp"; } - my $tmpldif = -"dn: uid=$userName,$usersdn -changetype: modify -objectClass: inetOrgPerson -objectclass: posixAccount -objectClass: sambaSAMAccount -sambaPwdLastSet: 0 -sambaLogonTime: 0 -sambaLogoffTime: 2147483647 -sambaKickoffTime: 2147483647 -sambaPwdCanChange: $valpwdcanchange -sambaPwdMustChange: $valpwdmustchange -displayName: $_userGecos -sambaAcctFlags: $valacctflags -sambaSID: $smbldap_conf::SID-$userRid - -"; + + my $modify = $ldap_master->modify ( "uid=$userName,$usersdn", + changes => [ + add => [objectClass => 'sambaSAMAccount'], + add => [sambaPwdLastSet => '0'], + add => [sambaLogonTime => '0'], + add => [sambaLogoffTime => '2147483647'], + add => [sambaKickoffTime => '2147483647'], + add => [sambaPwdCanChange => "$valpwdcanchange"], + add => [sambaPwdMustChange => "$valpwdmustchange"], + add => [displayName => "$_userGecos"], + add => [sambaAcctFlags => "$valacctflags"], + add => [sambaSID => "$SID-$userRid"] + ] + ); - die "$0: error while adding samba account to posix user $userName\n" - unless (do_ldapmodify($tmpldif) == 0); + $modify->code && die "failed to add entry: ", $modify->error ; - undef $tmpldif; } else { my $FILE="|smbpasswd -s -a $userName >/dev/null" ; open (FILE, $FILE) || die "$!\n"; @@ -326,24 +337,24 @@ if (defined($tmp = $Options{'F'})) { $valprofilepath = "$tmp"; } - my $tmpldif = -"dn: uid=$userName,$usersdn -changetype: modify -sambaSID: $smbldap_conf::SID-$userRid -sambaPrimaryGroupSID: $smbldap_conf::SID-$userGroupRid -sambaHomeDrive: $valhomedrive -sambaHomePath: $valsmbhome -sambaProfilePath: $valprofilepath -sambaLogonScript: $valscriptpath -sambaLMPassword: XXX -sambaNTPassword: XXX - -"; - - die "$0: error while modifying samba account of user $userName\n" - unless (do_ldapmodify($tmpldif) == 0); - undef $tmpldif; + + my $modify = $ldap_master->modify ( "uid=$userName,$usersdn", + changes => [ + add => [sambaPrimaryGroupSID => "$SID-$userGroupRid"], + add => [sambaHomeDrive => "$valhomedrive"], + add => [sambaHomePath => "$valsmbhome"], + add => [sambaProfilePath => "$valprofilepath"], + add => [sambaLogonScript => "$valscriptpath"], + add => [sambaLMPassword => 'XXX'], + add => [sambaNTPassword => 'XXX'] + ] + ); + + $modify->code && die "failed to add entry: ", $modify->error ; + } +$ldap_master->unbind; # take down session + if (defined($Options{'P'})) { exec "/usr/local/sbin/smbldap-passwd.pl $userName" @@ -418,8 +429,8 @@ exit 0; -m The user's home directory will be created if it does not exist. The files contained in skeleton_dir will be copied to the home - directory if the -k option is used, otherwise the files con­ - tained in /etc/skel will be used instead. Any directories con­ + directory if the -k option is used, otherwise the files con­ + tained in /etc/skel will be used instead. Any directories con­ tained in skeleton_dir or /etc/skel will be created in the user's home directory as well. The -k option is only valid in conjunction with the -m option. The default is to not create @@ -451,6 +462,11 @@ exit 0; -H sambaAcctFlags, spaces and trailing bracket are ignored (samba account control bits like '[NDHTUMWSLKI]') + -N canonical name (defaults to gecos or username, if gecos not set) + + -S surname (defaults to username) + + =head1 SEE ALSO useradd(1) diff --git a/examples/LDAP/smbldap-tools/smbldap-userdel.pl b/examples/LDAP/smbldap-tools/smbldap-userdel.pl index 435be4fdd0..1a1a3214b5 100755 --- a/examples/LDAP/smbldap-tools/smbldap-userdel.pl +++ b/examples/LDAP/smbldap-tools/smbldap-userdel.pl @@ -23,6 +23,9 @@ # Purpose of smbldap-userdel : user (posix,shadow,samba) deletion use strict; +use FindBin; +use FindBin qw($RealBin); +use lib "$RealBin/"; use smbldap_tools; diff --git a/examples/LDAP/smbldap-tools/smbldap-usermod.pl b/examples/LDAP/smbldap-tools/smbldap-usermod.pl index dffb95bace..f25c730fc8 100755 --- a/examples/LDAP/smbldap-tools/smbldap-usermod.pl +++ b/examples/LDAP/smbldap-tools/smbldap-usermod.pl @@ -23,6 +23,9 @@ # Purpose of smbldap-usermod : user (posix,shadow,samba) modification use strict; +use FindBin; +use FindBin qw($RealBin); +use lib "$RealBin/"; use smbldap_tools; use smbldap_conf; @@ -33,13 +36,13 @@ use Getopt::Std; my %Options; my $nscd_status; -my $ok = getopts('A:B:C:D:E:F:H:IJxme:f:u:g:G:d:l:s:c:ok:?', \%Options); -if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { - print "Usage: $0 [-awmugdsckxABCDEFGHI?] username\n"; +my $ok = getopts('A:B:C:D:E:F:H:IJN:S:xme:f:u:g:G:d:l:s:c:ok:?h', \%Options); +if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) || ($Options{'h'}) ) { + print "Usage: $0 [-awmugdsckxABCDEFGHI?h] username\n"; + print "Available options are:\n"; print " -c gecos\n"; print " -d home directory\n"; #print " -m move home directory\n"; - #print " -e expire date (YYYY-MM-DD)\n"; #print " -f inactive days\n"; print " -u uid\n"; print " -o uid can be non unique\n"; @@ -47,6 +50,10 @@ if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { print " -G supplementary groups (comma separated)\n"; print " -l login name\n"; print " -s shell\n"; + print " -N canonical name\n"; + print " -S surname\n"; + print " For samba users:\n"; + print " -e expire date (\"YYYY-MM-DD HH:MM:SS\")\n"; print " -x creates rid and primaryGroupID in hex instead of decimal (for Samba 2.2.2 unpatched only)\n"; print " -A can change password ? 0 if no, 1 if yes\n"; print " -B must change password ? 0 if no, 1 if yes\n"; @@ -57,7 +64,7 @@ if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { print " -H sambaAcctFlags (samba account control bits like '[NDHTUMWSLKI]')\n"; print " -I disable an user. Can't be used with -H or -J\n"; print " -J enable an user. Can't be used with -H or -I\n"; - print " -? show this help message\n"; + print " -?|-h show this help message\n"; exit (1); } @@ -69,30 +76,23 @@ if ($< != 0) { # Read only first @ARGV my $user = $ARGV[0]; -# Read user datas -my $lines = read_user($user); -if (!defined($lines)) { +# Read user data +my $user_entry = read_user_entry($user); +if (!defined($user_entry)) { print "$0: user $user doesn't exist\n"; exit (1); } -#print "$lines\n"; -my $dn_line; -if ( $lines =~ /(^dn: .*)/ ) { - $dn_line = $1; -} - -chomp($dn_line); - my $samba = 0; -if ($lines =~ m/objectClass: sambaAccount/) { +if (grep ($_ =~ /^sambaSamAccount$/i, $user_entry->get_value('objectClass'))) { $samba = 1; } -############ +# get the dn of the user +my $dn= $user_entry->dn(); my $tmp; -my $mods; +my @mods; # Process options my $changed_uid; @@ -119,15 +119,15 @@ if (defined($tmp = $Options{'u'})) { } } + push(@mods, 'uidNumber', $tmp); $_userUidNumber = $tmp; + if ($samba) { # as rid we use 2 * uid + 1000 my $_userRid = 2 * $_userUidNumber + 1000; if (defined($Options{'x'})) { $_userRid= sprint("%x", $_userRid); } - $mods .= "uidNumber: $_userUidNumber\n"; - if ($samba) { - $mods .= "rid: $_userRid\n"; + push(@mods, 'sambaSID', $SID.'-'.$_userRid); } $changed_uid = 1; } @@ -141,42 +141,42 @@ if (defined($tmp = $Options{'g'})) { print "$0: group $tmp doesn't exist\n"; exit (6); } + push(@mods, 'gidNumber', $_userGidNumber); + if ($samba) { # as grouprid we use 2 * gid + 1001 my $_userGroupRid = 2 * $_userGidNumber + 1001; if (defined($Options{'x'})) { $_userGroupRid = sprint("%x", $_userGroupRid); } - $mods .= "gidNumber: $_userGidNumber\n"; - if ($samba) { - $mods .= "primaryGroupID: $_userGroupRid\n"; + push(@mods, 'sambaPrimaryGroupSid', $SID.'-'.$_userGroupRid); } $changed_gid = 1; } -my $changed_shell; -my $_userLoginShell; if (defined($tmp = $Options{'s'})) { - $_userLoginShell = $tmp; - $mods .= "loginShell: $_userLoginShell\n"; - $changed_shell = 1; + push(@mods, 'loginShell' => $tmp); } -my $changed_gecos; -my $_userGecos; + if (defined($tmp = $Options{'c'})) { - $_userGecos = $tmp; - $mods .= "gecos: $_userGecos\n"; - $changed_gecos = 1; + push(@mods, 'gecos' => $tmp, + 'description' => $tmp); + if ($samba == 1) { + push(@mods, 'displayName' => $tmp); + } } -my $changed_homedir; -my $newhomedir; if (defined($tmp = $Options{'d'})) { - $newhomedir = $tmp; - $mods .= "homeDirectory: $newhomedir\n"; - $changed_homedir = 1; + push(@mods, 'homeDirectory' => $tmp); } +if (defined($tmp = $Options{'N'})) { + push(@mods, 'cn' => $tmp); +} + +if (defined($tmp = $Options{'S'})) { + push(@mods, 'sn' => $tmp); +} if (defined($tmp = $Options{'G'})) { @@ -212,102 +212,135 @@ if (defined($tmp = $Options{'G'})) { my $attr; my $winmagic = 2147483647; +my $samba = is_samba_user($user); + +if (defined($tmp = $Options{'e'})) { + if ($samba == 1) { + my $kickoffTime=`date --date='$tmp' +%s`; + chomp($kickoffTime); + push(@mods, 'sambakickoffTime' => $kickoffTime); + } else { + print "User $user is not a samba user\n"; + } +} + +my $_sambaPwdCanChange; if (defined($tmp = $Options{'A'})) { + if ($samba == 1) { $attr = "sambaPwdCanChange"; if ($tmp != 0) { - $mods .= "$attr: 0\n"; + $_sambaPwdCanChange=0; } else { - $mods .= "$attr: $winmagic\n"; + $_sambaPwdCanChange=$winmagic; + } + push(@mods, 'sambaPwdCanChange' => $_sambaPwdCanChange); + } else { + print "User $user is not a samba user\n"; } } +my $_sambaPwdMustChange; if (defined($tmp = $Options{'B'})) { - $attr = "sambaPwdMustChange"; + if ($samba == 1) { if ($tmp != 0) { - $mods .= "$attr: 0\n"; + $_sambaPwdMustChange=0; + } else { + $_sambaPwdMustChange=$winmagic; + } + push(@mods, 'sambaPwdMustChange' => $_sambaPwdMustChange); } else { - $mods .= "$attr: $winmagic\n"; + print "User $user is not a samba user\n"; } } if (defined($tmp = $Options{'C'})) { - $attr = "sambaHomePath"; + if ($samba == 1) { #$tmp =~ s/\\/\\\\/g; - $mods .= "$attr: $tmp\n"; + push(@mods, 'sambaHomePath' => $tmp); + } else { + print "User $user is not a samba user\n"; + } } +my $_sambaHomeDrive; if (defined($tmp = $Options{'D'})) { - $attr = "sambaHomeDrive"; + if ($samba == 1) { $tmp = $tmp.":" unless ($tmp =~ /:/); - $mods .= "$attr: $tmp\n"; + push(@mods, 'sambaHomeDrive' => $tmp); + } else { + print "User $user is not a samba user\n"; + } } if (defined($tmp = $Options{'E'})) { - $attr = "sambaLogonScript"; + if ($samba == 1) { #$tmp =~ s/\\/\\\\/g; - $mods .= "$attr: $tmp\n"; + push(@mods, 'sambaLogonScript' => $tmp); + } else { + print "User $user is not a samba user\n"; + } } if (defined($tmp = $Options{'F'})) { - $attr = "sambaProfilePath"; + if ($samba == 1) { #$tmp =~ s/\\/\\\\/g; - $mods .= "$attr: $tmp\n"; + push(@mods, 'sambaProfilePath' => $tmp); + } else { + print "User $user is not a samba user\n"; + } } +if ($samba == 1 and (defined $Options{'H'} or defined $Options{'I'} or defined $Options{'J'})) { + my $_sambaAcctFlags; if (defined($tmp = $Options{'H'})) { - $attr = "sambaAcctFlags"; #$tmp =~ s/\\/\\\\/g; - $mods .= "$attr: $tmp\n"; -} elsif (defined($tmp = $Options{'I'})) { + $_sambaAcctFlags=$tmp; + } else { + # I or J my $flags; + $flags = $user_entry->get_value('sambaAcctFlags'); - if ( $lines =~ /^sambaAcctFlags: (.*)/m ) { - $flags = $1; - } - - chomp($flags); - + if (defined($tmp = $Options{'I'})) { if ( !($flags =~ /D/) ) { my $letters; if ($flags =~ /(\w+)/) { $letters = $1; } - $mods .= "sambaAcctFlags: \[D$letters\]\n"; + $_sambaAcctFlags="\[D$letters\]"; } } elsif (defined($tmp = $Options{'J'})) { - my $flags; - - if ( $lines =~ /^sambaAcctFlags: (.*)/m ) { - $flags = $1; - } - - chomp($flags); - if ( $flags =~ /D/ ) { my $letters; if ($flags =~ /(\w+)/) { $letters = $1; } $letters =~ s/D//; - $mods .= "sambaAcctFlags: \[$letters\]\n"; + $_sambaAcctFlags="\[$letters\]"; + } } } -if ($mods ne '') { - #print "----\n$dn_line\n$mods\n----\n"; - - my $tmpldif = -"$dn_line -changetype: modify -$mods -"; - die "$0: error while modifying user $user\n" - unless (do_ldapmodify($tmpldif) == 0); + if ("$_sambaAcctFlags" ne '') { + push(@mods, 'sambaAcctFlags' => $_sambaAcctFlags); + } - undef $tmpldif; +} elsif (!$samba == 1 and (defined $Options{'H'} or defined $Options{'I'} or defined $Options{'J'})) { + print "User $user is not a samba user\n"; } +# Let's connect to the directory first +my $ldap_master=connect_ldap_master(); + +# apply changes +my $modify = $ldap_master->modify ( "$dn", + 'replace' => { @mods } + ); +$modify->code && warn "failed to modify entry: ", $modify->error ; + +# take down session +$ldap_master->unbind; + $nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1"; if ($nscd_status == 0) { @@ -358,7 +391,7 @@ if ($nscd_status == 0) { -l login_name The name of the user will be changed from login to login_name. - Nothing else is changed. In particular, the user's home direc­ + Nothing else is changed. In particular, the user's home direc­ tory name should probably be changed to reflect the new login name. @@ -369,7 +402,7 @@ if ($nscd_status == 0) { -u uid The numerical value of the user's ID. This value must be unique, unless the -o option is used. The value must be non- negative. Any files which the user owns and which are - located in the directory tree rooted at the user's home direc­ + located in the directory tree rooted at the user's home direc­ tory will have the file user ID changed automatically. Files outside of the user's home directory must be altered manually. diff --git a/examples/LDAP/smbldap-tools/smbldap-usershow.pl b/examples/LDAP/smbldap-tools/smbldap-usershow.pl index b05f087620..555b35ffd8 100755 --- a/examples/LDAP/smbldap-tools/smbldap-usershow.pl +++ b/examples/LDAP/smbldap-tools/smbldap-usershow.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/perl -w # This code was developped by IDEALX (http://IDEALX.org/) and # contributors (their names can be found in the CONTRIBUTORS file). @@ -23,6 +23,9 @@ # Purpose of smbldap-userdisplay : user (posix,shadow,samba) display use strict; +use FindBin; +use FindBin qw($RealBin); +use lib "$RealBin/"; use smbldap_tools; use Getopt::Std; diff --git a/examples/LDAP/smbldap-tools/smbldap_conf.pm b/examples/LDAP/smbldap-tools/smbldap_conf.pm index dd1d772ea7..c3d5c1732c 100644 --- a/examples/LDAP/smbldap-tools/smbldap_conf.pm +++ b/examples/LDAP/smbldap-tools/smbldap_conf.pm @@ -30,16 +30,14 @@ package smbldap_conf; use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $UID_START $GID_START $smbpasswd $slaveLDAP $masterLDAP $slavePort $masterPort $ldapSSL $slaveURI $masterURI $with_smbpasswd $mk_ntpasswd -$ldap_path $ldap_opts $ldapsearch $ldapsearchnobind -$ldapmodify $ldappasswd $ldapadd $ldapdelete $ldapmodrdn -$suffix $usersdn $computersdn +$ldap_path $ldap_opts $ldapmodify $suffix $usersdn $computersdn $groupsdn $scope $binddn $bindpasswd $slaveDN $slavePw $masterDN $masterPw $_userLoginShell $_userHomePrefix $_userGecos $_defaultUserGid $_defaultComputerGid $_skeletonDir $_userSmbHome $_userProfile $_userHomeDrive -$_userScript $usersou $computersou $groupsou +$_userScript $usersou $computersou $groupsou $SID $hash_encrypt ); use Exporter; @@ -49,14 +47,13 @@ $VERSION = 1.00; @EXPORT = qw( $UID_START $GID_START $smbpasswd $slaveLDAP $masterLDAP $slavePort $masterPort $ldapSSL $slaveURI $masterURI $with_smbpasswd $mk_ntpasswd -$ldap_path $ldap_opts $ldapsearch $ldapsearchnobind $ldapmodify $ldappasswd -$ldapadd $ldapdelete $ldapmodrdn $suffix $usersdn +$ldap_path $ldap_opts $ldapmodify $suffix $usersdn $computersdn $groupsdn $scope $binddn $bindpasswd $slaveDN $slavePw $masterDN $masterPw $_userLoginShell $_userHomePrefix $_userGecos $_defaultUserGid $_defaultComputerGid $_skeletonDir $_userSmbHome $_userProfile $_userHomeDrive $_userScript -$usersou $computersou $groupsou +$usersou $computersou $groupsou $SID $hash_encrypt ); @@ -66,16 +63,13 @@ $usersou $computersou $groupsou # ############################################################################## -# # UID and GID starting at... -# - $UID_START = 1000; $GID_START = 1000; # Put your own SID -# to obtain this number do: # net getlocalsid -our $SID='S-1-5-21-636805976-1992644568-3666589737'; +# to obtain this number do: "net getlocalsid" +$SID='S-1-5-21-3516781642-1962875130-3438800523'; ############################################################################## # @@ -86,84 +80,65 @@ our $SID='S-1-5-21-636805976-1992644568-3666589737'; # Notes: to use to dual ldap servers backend for Samba, you must patch # Samba with the dual-head patch from IDEALX. If not using this patch # just use the same server for slaveLDAP and masterLDAP. -# -# Slave LDAP : needed for read operations -# +# Those two servers declarations can also be used when you have +# . one master LDAP server where all writing operations must be done +# . one slave LDAP server where all reading operations must be done +# (typically a replication directory) + # Ex: $slaveLDAP = "127.0.0.1"; $slaveLDAP = "127.0.0.1"; - $slavePort = "389"; -# # Master LDAP : needed for write operations -# # Ex: $masterLDAP = "127.0.0.1"; $masterLDAP = "127.0.0.1"; - - -# -# Master Port -# 389 636 -# Ex: $masterPort = " $masterPort = "389"; -# # Use SSL for LDAP -# +# If set to "1", this option will use start_tls for connection +# (you should also used the port 389) $ldapSSL = "0"; -# # LDAP Suffix -# # Ex: $suffix = "dc=IDEALX,dc=ORG"; $suffix = "dc=IDEALX,dc=ORG"; -# # Where are stored Users -# # Ex: $usersdn = "ou=Users,$suffix"; for ou=Users,dc=IDEALX,dc=ORG $usersou = q(_USERS_); - $usersdn = "ou=$usersou,$suffix"; -# # Where are stored Computers -# # Ex: $computersdn = "ou=Computers,$suffix"; for ou=Computers,dc=IDEALX,dc=ORG $computersou = q(_COMPUTERS_); - $computersdn = "ou=$computersou,$suffix"; -# # Where are stored Groups -# # Ex $groupsdn = "ou=Groups,$suffix"; for ou=Groups,dc=IDEALX,dc=ORG $groupsou = q(_GROUPS_); - $groupsdn = "ou=$groupsou,$suffix"; -# # Default scope Used -# $scope = "sub"; -# -# Credential Configuration -# +# Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA) +$hash_encrypt="SSHA"; + +############################ +# Credential Configuration # +############################ # Bind DN used # Ex: $binddn = "cn=Manager,$suffix"; for cn=Manager,dc=IDEALX,dc=org $binddn = "cn=Manager,$suffix"; -# + # Bind DN passwd used # Ex: $bindpasswd = 'secret'; for 'secret' $bindpasswd = "secret"; -# # Notes: if using dual ldap patch, you can specify to different configuration # By default, we will use the same DN (so it will work for standard Samba # release) -# $slaveDN = $binddn; $slavePw = $bindpasswd; $masterDN = $binddn; @@ -176,36 +151,24 @@ $masterPw = $bindpasswd; ############################################################################## # Login defs -# # Default Login Shell -# # Ex: $_userLoginShell = q(/bin/bash); $_userLoginShell = q(_LOGINSHELL_); -# # Home directory prefix (without username) -# #Ex: $_userHomePrefix = q(/home/); $_userHomePrefix = q(_HOMEPREFIX_); -# # Gecos -# $_userGecos = q(System User); -# # Default User (POSIX and Samba) GID -# -$_defaultUserGid = 100; +$_defaultUserGid = 513; -# # Default Computer (Samba) GID -# $_defaultComputerGid = 553; -# # Skel dir -# $_skeletonDir = q(/etc/skel); ############################################################################## @@ -214,28 +177,23 @@ $_skeletonDir = q(/etc/skel); # ############################################################################## -# # The UNC path to home drives location without the username last extension # (will be dynamically prepended) # Ex: q(\\\\My-PDC-netbios-name\\homes) for \\My-PDC-netbios-name\homes $_userSmbHome = q(\\\\_PDCNAME_\\homes); -# # The UNC path to profiles locations without the username last extension # (will be dynamically prepended) -# Ex: q(\\\\My-PDC-netbios-name\\profiles) for \\My-PDC-netbios-name\profiles +# Ex: q(\\\\My-PDC-netbios-name\\profiles\\) for \\My-PDC-netbios-name\profiles $_userProfile = q(\\\\_PDCNAME_\\profiles\\); -# # The default Home Drive Letter mapping # (will be automatically mapped at logon time if home directory exist) # Ex: q(U:) for U: $_userHomeDrive = q(_HOMEDRIVE_); -# # The default user netlogon script name # if not used, will be automatically username.cmd -# #$_userScript = q(startup.cmd); # make sure script file is edited under dos @@ -251,28 +209,28 @@ $with_smbpasswd = 0; $smbpasswd = "/usr/bin/smbpasswd"; $mk_ntpasswd = "/usr/local/sbin/mkntpwd"; -if ( $ldapSSL eq "0" ) { +# those next externals commands are kept fot the migration scripts and +# for the populate script: this will be updated as soon as possible $slaveURI = "ldap://$slaveLDAP:$slavePort"; $masterURI = "ldap://$masterLDAP:$masterPort"; -} -elsif ( $ldapSSL eq "1" ) { - $slaveURI = "ldaps://$slaveLDAP:$slavePort"; - $masterURI = "ldaps://$masterLDAP:$masterPort"; -} -else { - die "ldapSSL option must be either 0 or 1.\n"; -} - $ldap_path = "/usr/bin"; + +if ( $ldapSSL eq "0" ) { $ldap_opts = "-x"; -$ldapsearch = "$ldap_path/ldapsearch $ldap_opts -H $slaveURI -D '$slaveDN' -w '$slavePw'"; -$ldapsearchnobind = "$ldap_path/ldapsearch $ldap_opts -H $slaveURI"; +} elsif ( $ldapSSL eq "1" ) { + $ldap_opts = "-x -Z"; +} else { + die "ldapSSL option must be either 0 or 1.\n"; +} + +#$ldapsearch = "$ldap_path/ldapsearch $ldap_opts -H $slaveURI -D '$slaveDN' -w '$slavePw'"; +#$ldapsearchnobind = "$ldap_path/ldapsearch $ldap_opts -H $slaveURI"; $ldapmodify = "$ldap_path/ldapmodify $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; -$ldappasswd = "$ldap_path/ldappasswd $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; -$ldapadd = "$ldap_path/ldapadd $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; -$ldapdelete = "$ldap_path/ldapdelete $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; -$ldapmodrdn = "$ldap_path/ldapmodrdn $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; +#$ldappasswd = "$ldap_path/ldappasswd $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; +#$ldapadd = "$ldap_path/ldapadd $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; +#$ldapdelete = "$ldap_path/ldapdelete $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; +#$ldapmodrdn = "$ldap_path/ldapmodrdn $ldap_opts -H $masterURI -D '$masterDN' -w '$masterPw'"; diff --git a/examples/LDAP/smbldap-tools/smbldap_tools.pm b/examples/LDAP/smbldap-tools/smbldap_tools.pm index ad6ef74eb6..8001442fe8 100755 --- a/examples/LDAP/smbldap-tools/smbldap_tools.pm +++ b/examples/LDAP/smbldap-tools/smbldap_tools.pm @@ -1,4 +1,4 @@ -#! /usr/bin/perl +#! /usr/bin/perl -w use strict; package smbldap_tools; use smbldap_conf; @@ -36,7 +36,9 @@ $VERSION = 1.00; @EXPORT = qw( get_user_dn get_group_dn + is_group_member is_samba_user + is_unix_user is_user_valid get_dn_from_line add_posix_machine @@ -47,8 +49,10 @@ add_grouplist_user disable_user delete_user group_add + group_del get_homedir read_user + read_user_entry read_group find_groups_of parse_group @@ -57,32 +61,74 @@ group_get_members do_ldapadd do_ldapmodify get_user_dn2 + connect_ldap_master + connect_ldap_slave ); -# dn_line = get_user_dn($username) -# where dn_line is like "dn: a=b,c=d" - -#sub ldap_search -#{ -#my ($local_base,$local_scope,$local_filtre)=@_; -#} - +sub connect_ldap_master + { + # bind to a directory with dn and password + my $ldap_master = Net::LDAP->new( + "$masterLDAP", + port => "$masterPort", + version => 3, + # debug => 0xffff, + ) + or die "erreur LDAP: Can't contact master ldap server ($@)"; + if ($ldapSSL == 1) { + $ldap_master->start_tls( + # verify => 'require', + # clientcert => 'mycert.pem', + # clientkey => 'mykey.pem', + # decryptkey => sub { 'secret'; }, + # capath => '/usr/local/cacerts/' + ); + } + $ldap_master->bind ( "$binddn", + password => "$masterPw" + ); + return($ldap_master); + } +sub connect_ldap_slave + { + # bind to a directory with dn and password + my $ldap_slave = Net::LDAP->new( + "$slaveLDAP", + port => "$slavePort", + version => 3, + # debug => 0xffff, + ) + or die "erreur LDAP: Can't contact slave ldap server ($@)"; + if ($ldapSSL == 1) { + $ldap_slave->start_tls( + # verify => 'require', + # clientcert => 'mycert.pem', + # clientkey => 'mykey.pem', + # decryptkey => sub { 'secret'; }, + # capath => '/usr/local/cacerts/' + ); + } + $ldap_slave->bind ( "$binddn", + password => "$slavePw" + ); + return($ldap_slave); + } sub get_user_dn { my $user = shift; my $dn=''; - my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; - $ldap->bind ; - my $mesg = $ldap->search ( base => $suffix, + my $ldap_slave=connect_ldap_slave(); + my $mesg = $ldap_slave->search ( base => $suffix, scope => $scope, filter => "(&(objectclass=posixAccount)(uid=$user))" ); $mesg->code && die $mesg->error; foreach my $entry ($mesg->all_entries) { - $dn= $entry->dn;} - $ldap->unbind; + $dn= $entry->dn; + } + $ldap_slave->unbind; chomp($dn); if ($dn eq '') { return undef; @@ -92,28 +138,21 @@ sub get_user_dn } -sub get_user_dn2 ## migré +sub get_user_dn2 { my $user = shift; my $dn=''; - my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; - $ldap->bind ; - my $mesg = $ldap->search ( base => $suffix, + my $ldap_slave=connect_ldap_slave(); + my $mesg = $ldap_slave->search ( base => $suffix, scope => $scope, filter => "(&(objectclass=posixAccount)(uid=$user))" ); - # $mesg->code && warn $mesg->error; - if ($mesg->code) - { - print("Code erreur : ",$mesg->code,"\n"); - print("Message d'erreur : ",$mesg->error,"\n"); - return (0,undef); - } + $mesg->code && warn "failed to perform search; ", $mesg->error; foreach my $entry ($mesg->all_entries) { $dn= $entry->dn; } - $ldap->unbind; + $ldap_slave->unbind; chomp($dn); if ($dn eq '') { return (1,undef); @@ -127,16 +166,16 @@ sub get_group_dn { my $group = shift; my $dn=''; - my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; - $ldap->bind ; - my $mesg = $ldap->search ( base => $groupsdn, + my $ldap_slave=connect_ldap_slave(); + my $mesg = $ldap_slave->search ( base => $groupsdn, scope => $scope, filter => "(&(objectclass=posixGroup)(|(cn=$group)(gidNumber=$group)))" ); $mesg->code && die $mesg->error; foreach my $entry ($mesg->all_entries) { - $dn= $entry->dn;} - $ldap->unbind; + $dn= $entry->dn; + } + $ldap_slave->unbind; chomp($dn); if ($dn eq '') { return undef; @@ -150,14 +189,41 @@ sub get_group_dn sub is_samba_user { my $user = shift; - my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; - $ldap->bind ; - my $mesg = $ldap->search ( base => $suffix, + my $ldap_slave=connect_ldap_slave(); + my $mesg = $ldap_slave->search ( base => $suffix, scope => $scope, filter => "(&(objectClass=sambaSamAccount)(uid=$user))" ); $mesg->code && die $mesg->error; - $ldap->unbind; + $ldap_slave->unbind; + return ($mesg->count ne 0); + } + +sub is_unix_user + { + my $user = shift; + my $ldap_slave=connect_ldap_slave(); + my $mesg = $ldap_slave->search ( base => $suffix, + scope => $scope, + filter => "(&(objectClass=posixAccount)(uid=$user))" + ); + $mesg->code && die $mesg->error; + $ldap_slave->unbind; + return ($mesg->count ne 0); + } + +sub is_group_member + { + my $dn_group = shift; + my $user = shift; + my $ldap_slave=connect_ldap_slave(); + my $mesg = $ldap_slave->search ( + base => "$dn_group", + scope => 'base', + filter => "(&(memberUid=$user))" + ); + $mesg->code && die $mesg->error; + $ldap_slave->unbind; return ($mesg->count ne 0); } @@ -168,21 +234,19 @@ sub is_user_valid my ($user, $dn, $pass) = @_; my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; my $mesg= $ldap->bind (dn => $dn, password => $pass ); - if ($mesg->code eq 0) - { + if ($mesg->code eq 0) { $ldap->unbind; return 1; - } - else - { + } else { if($ldap->bind()) { $ldap->unbind; return 0; } else { - print ("Le serveur LDAP est indisponible.\nVérifier le serveur, les câblages, ..."); + print ("The LDAP directory is not available.\n Check the server, cables ..."); $ldap->unbind; return 0; - } die "Problème : Contacter votre administrateur"; + } + die "Problem : contact your administrator"; } } @@ -199,27 +263,29 @@ sub get_dn_from_line sub add_posix_machine { my ($user, $uid, $gid) = @_; - my $tmpldif = - "dn: uid=$user,$computersdn -objectclass: inetOrgPerson -objectclass: posixAccount -sn: $user -cn: $user -uid: $user -uidNumber: $uid -gidNumber: $gid -homeDirectory: /dev/null -loginShell: /bin/false -description: Computer - -"; - - die "$0: error while adding posix account to machine $user\n" - unless (do_ldapadd($tmpldif) == 0); - undef $tmpldif; - return 1; + # bind to a directory with dn and password + my $ldap_master=connect_ldap_master(); + my $add = $ldap_master->add ( "uid=$user,$computersdn", + attr => [ + 'objectclass' => ['top','inetOrgPerson', 'posixAccount'], + 'cn' => "$user", + 'sn' => "$user", + 'uid' => "$user", + 'uidNumber' => "$uid", + 'gidNumber' => "$gid", + 'homeDirectory' => '/dev/null', + 'loginShell' => '/bin/false', + 'description' => 'Computer', + ] + ); + + $add->code && warn "failed to add entry: ", $add->error ; + # take down the session + $ldap_master->unbind; + } + # success = add_samba_machine($computername) sub add_samba_machine { @@ -244,33 +310,31 @@ sub add_samba_machine_mkntpwd chomp(my $lmpassword = substr($ntpwd, 0, index($ntpwd, ':'))); chomp(my $ntpassword = substr($ntpwd, index($ntpwd, ':')+1)); - my $tmpldif = - "dn: uid=$user,$computersdn -changetype: modify -objectclass: inetOrgPerson -objectclass: posixAccount -objectClass: sambaSamAccount -sambaPwdLastSet: 0 -sambaLogonTime: 0 -sambaLogoffTime: 2147483647 -sambaKickoffTime: 2147483647 -sambaPwdCanChange: 0 -sambaPwdMustChange: 2147483647 -sambaAcctFlags: [W ] -sambaLMPassword: $lmpassword -sambaNTPassword: $ntpassword -sambaSID: $smbldap_conf::SID-$sambaSID -sambaPrimaryGroupSID: $smbldap_conf::SID-0 - -"; - - die "$0: error while adding samba account to $user\n" - unless (do_ldapmodify($tmpldif) == 0); - undef $tmpldif; + my $ldap_master=connect_ldap_master(); + my $modify = $ldap_master->modify ( "uid=$user,$computersdn", + changes => [ + replace => [objectClass => ['inetOrgPerson', 'posixAccount', 'sambaSAMAccount']], + add => [sambaPwdLastSet => '0'], + add => [sambaLogonTime => '0'], + add => [sambaLogoffTime => '2147483647'], + add => [sambaKickoffTime => '2147483647'], + add => [sambaPwdCanChange => '0'], + add => [sambaPwdMustChange => '0'], + add => [sambaAcctFlags => '[W ]'], + add => [sambaLMPassword => "$lmpassword"], + add => [sambaNTPassword => "$ntpassword"], + add => [sambaSID => "$SID-$sambaSID"], + add => [sambaPrimaryGroupSID => "$SID-0"] + ] + ); + + $modify->code && die "failed to add entry: ", $modify->error ; return 1; - } + # take down the session + $ldap_master->unbind; + } sub group_add_user @@ -278,55 +342,43 @@ sub group_add_user my ($group, $userid) = @_; my $members=''; my $dn_line = get_group_dn($group); + if (!defined(get_group_dn($group))) { + print "$0: group \"$group\" doesn't exist\n"; + exit (6); + } if (!defined($dn_line)) { return 1; } - my $dn = get_dn_from_line($dn_line); - - my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; - $ldap->bind ; - my $mesg = $ldap->search ( base =>$dn, scope => "base", filter => "(objectClass=*)" ); - $mesg->code && die $mesg->error; - foreach my $entry ($mesg->all_entries){ - foreach my $attr ($entry->attributes) - { - if ($attr=~/\bmemberUid\b/){ - foreach my $ent($entry->get_value($attr)) { $members.= $attr.": ".$ent."\n"; } - } + my $dn = get_dn_from_line("$dn_line"); + # on look if the user is already present in the group + my $is_member=is_group_member($dn,$userid); + if ($is_member == 1) { + print "User \"$userid\" already member of the group \"$group\".\n"; + } else { + # bind to a directory with dn and password + my $ldap_master=connect_ldap_master(); + # It does not matter if the user already exist, Net::LDAP will add the user + # if he does not exist, and ignore him if his already in the directory. + my $modify = $ldap_master->modify ( "$dn", + changes => [ + add => [memberUid => $userid] + ] + ); + $modify->code && die "failed to modify entry: ", $modify->error ; + # take down session + $ldap_master->unbind; } } - $ldap->unbind; - chomp($members); - # user already member ? - if ($members =~ m/^memberUid: $userid/) { - return 2; - } - my $mods = ""; - if ($members ne '') { - $mods="$dn_line -changetype: modify -replace: memberUid -$members -memberUid: $userid - -"; - } else { - $mods="$dn_line -changetype: modify -add: memberUid -memberUid: $userid -"; - } - #print "$mods\n"; - my $tmpldif = - "$mods -"; - - die "$0: error while modifying group $group\n" - unless (do_ldapmodify($tmpldif) == 0); - undef $tmpldif; - return 0; +sub group_del + { + my $group_dn=shift; + # bind to a directory with dn and password + my $ldap_master=connect_ldap_master(); + my $modify = $ldap_master->delete ($group_dn); + $modify->code && die "failed to delete group : ", $modify->error ; + # take down session + $ldap_master->unbind; } sub add_grouplist_user @@ -338,43 +390,34 @@ sub add_grouplist_user } } -# XXX FIXME : sambaAcctFlags |= D, and not sambaAcctFlags = D sub disable_user { my $user = shift; my $dn_line; + my $dn = get_dn_from_line($dn_line); if (!defined($dn_line = get_user_dn($user))) { print "$0: user $user doesn't exist\n"; exit (10); } - - my $tmpldif = - "dn: $dn_line -changetype: modify -replace: userPassword -userPassword: {crypt}!x - -"; - - die "$0: error while modifying user $user\n" - unless (do_ldapmodify($tmpldif) == 0); - undef $tmpldif; + my $ldap_master=connect_ldap_master(); + my $modify = $ldap_master->modify ( "$dn", + changes => [ + replace => [userPassword => '{crypt}!x'] + ] + ); + $modify->code && die "failed to modify entry: ", $modify->error ; if (is_samba_user($user)) { - - my $tmpldif = - "dn: $dn_line -changetype: modify -replace: sambaAcctFlags -sambaAcctFlags: [D ] - -"; - - die "$0: error while modifying user $user\n" - unless (do_ldapmodify($tmpldif) == 0); - undef $tmpldif; + my $modify = $ldap_master->modify ( "$dn", + changes => [ + replace => [sambaAcctFlags => '[D ]'] + ] + ); + $modify->code && die "failed to modify entry: ", $modify->error ; } + # take down session + $ldap_master->unbind; } # delete_user($user) @@ -389,7 +432,9 @@ sub delete_user } my $dn = get_dn_from_line($dn_line); - system "$ldapdelete $dn >/dev/null"; + my $ldap_master=connect_ldap_master(); + my $modify = $ldap_master->delete($dn); + $ldap_master->unbind; } # $success = group_add($groupname, $group_gid, $force_using_existing_gid) @@ -415,17 +460,18 @@ sub group_add if ($nscd_status == 0) { system "/etc/init.d/nscd start > /dev/null 2>&1"; } - my $tmpldif = - "dn: cn=$gname,$groupsdn -objectclass: posixGroup -cn: $gname -gidNumber: $gid - -"; - - die "$0: error while adding posix group $gname\n" - unless (do_ldapadd($tmpldif) == 0); - undef $tmpldif; + my $ldap_master=connect_ldap_master(); + my $modify = $ldap_master->add ( "cn=$gname,$groupsdn", + attrs => [ + objectClass => 'posixGroup', + cn => "$gname", + gidNumber => "$gid" + ] + ); + + $modify->code && die "failed to add entry: ", $modify->error ; + # take down session + $ldap_master->unbind; return 1; } @@ -434,14 +480,15 @@ sub get_homedir { my $user = shift; my $homeDir=''; - # my $homeDir=`$ldapsearch -b '$suffix' -s '$scope' '(&(objectclass=posixAccount)(uid=$user))' | grep "^homeDirectory:"`; - my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; - $ldap->bind ; - my $mesg = $ldap->search ( base =>$suffix, scope => $scope, filter => "(&(objectclass=posixAccount)(uid=$user))" ); + my $ldap_slave=connect_ldap_slave(); + my $mesg = $ldap_slave->search ( + base =>$suffix, + scope => $scope, + filter => "(&(objectclass=posixAccount)(uid=$user))" + ); $mesg->code && die $mesg->error; foreach my $entry ($mesg->all_entries){ - foreach my $attr ($entry->attributes) - { + foreach my $attr ($entry->attributes) { if ($attr=~/\bhomeDirectory\b/){ foreach my $ent($entry->get_value($attr)) { $homeDir.= $attr.": ".$ent."\n"; @@ -449,7 +496,7 @@ sub get_homedir } } } - $ldap->unbind; + $ldap_slave->unbind; chomp $homeDir; if ($homeDir eq '') { return undef; @@ -463,9 +510,8 @@ sub read_user { my $user = shift; my $lines =''; - my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; - $ldap->bind ; - my $mesg = $ldap->search ( # perform a search + my $ldap_slave=connect_ldap_slave(); + my $mesg = $ldap_slave->search ( # perform a search base => $suffix, scope => $scope, filter => "(&(objectclass=posixAccount)(uid=$user))" @@ -480,7 +526,8 @@ sub read_user } } } - $ldap->unbind; # take down sessio(n + # take down session + $ldap_slave->unbind; chomp $lines; if ($lines eq '') { return undef; @@ -488,14 +535,31 @@ sub read_user return $lines; } +# search for a user +# return the attributes in an array +sub read_user_entry + { + my $user = shift; + my $ldap_slave=connect_ldap_slave(); + my $mesg = $ldap_slave->search ( # perform a search + base => $suffix, + scope => $scope, + filter => "(&(objectclass=posixAccount)(uid=$user))" + ); + + $mesg->code && die $mesg->error; + my $entry = $mesg->entry(); + $ldap_slave->unbind; + return $entry; + } + # search for a group sub read_group { my $user = shift; my $lines =''; - my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; - $ldap->bind ; - my $mesg = $ldap->search ( # perform a search + my $ldap_slave=connect_ldap_slave(); + my $mesg = $ldap_slave->search ( # perform a search base => $groupsdn, scope => $scope, filter => "(&(objectclass=posixGroup)(cn=$user))" @@ -510,8 +574,8 @@ sub read_group } } } - - $ldap->unbind; # take down sessio(n + # take down session + $ldap_slave->unbind; chomp $lines; if ($lines eq '') { return undef; @@ -525,9 +589,8 @@ sub find_groups_of { my $user = shift; my $lines =''; - my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; - $ldap->bind ; - my $mesg = $ldap->search ( # perform a search + my $ldap_slave=connect_ldap_slave; + my $mesg = $ldap_slave->search ( # perform a search base => $groupsdn, scope => $scope, filter => "(&(objectclass=posixGroup)(memberuid=$user))" @@ -536,9 +599,11 @@ sub find_groups_of foreach my $entry ($mesg->all_entries) { $lines.= "dn: ".$entry->dn."\n"; } - $ldap->unbind; + $ldap_slave->unbind; chomp($lines); - if ($lines eq '') {return undef; } + if ($lines eq '') { + return undef; + } return $lines; } @@ -571,53 +636,20 @@ sub group_remove_member if (!defined($grp_line)) { return 0; } - - my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; - $ldap->bind ; - my $mesg = $ldap->search ( base => $groupsdn, - scope => $scope, - filter => "(&(objectclass=posixgroup)(cn=$group))" + my $dn = get_dn_from_line($grp_line); + # we test if the user exist in the group + my $is_member=is_group_member($dn,$user); + if ($is_member == 1) { + my $ldap_master=connect_ldap_master(); + # delete only the user from the group + my $modify = $ldap_master->modify ( "$dn", + changes => [ + delete => [memberUid => ["$user"]] + ] ); - $mesg->code && die $mesg->error; - foreach my $entry ($mesg->all_entries){ - foreach my $attr ($entry->attributes) - { - if ($attr=~/\bmemberUid\b/){ - foreach my $ent($entry->get_value($attr)) { - $members.= $attr.": ".$ent."\n"; - } + $modify->code && die "failed to delete entry: ", $modify->error ; + $ldap_master->unbind; } - } - } - #print "Valeurs de members :\n$members"; - $ldap->unbind; - # my $members = `$ldapsearch -b '$groupsdn' -s '$scope' '(&(objectclass=posixgroup)(cn=$group))' | grep -i "^memberUid:"`; - # print "avant ---\n$members\n"; - $members =~ s/memberUid: $user\n//; - #print "après ---\n$members\n"; - chomp($members); - - my $header; - if ($members eq '') { - $header = "changetype: modify\n"; - $header .= "delete: memberUid"; - } else { - $header = "changetype: modify\n"; - $header .= "replace: memberUid"; - } - - my $tmpldif = -"$grp_line -$header -$members -"; - - #print "Valeur du tmpldif : \n$tmpldif"; - die "$0: error while modifying group $group\n" - unless (do_ldapmodify($tmpldif) == 0); - undef $tmpldif; - - $ldap->unbind; return 1; } @@ -627,11 +659,14 @@ sub group_get_members my $members; my @resultat; my $grp_line = get_group_dn($group); - if (!defined($grp_line)) { return 0; } + if (!defined($grp_line)) { + return 0; + } my $ldap = Net::LDAP->new($slaveLDAP) or die "erreur LDAP"; $ldap->bind ; - my $mesg = $ldap->search ( base => $groupsdn, + my $mesg = $ldap->search ( + base => $groupsdn, scope => $scope, filter => "(&(objectclass=posixgroup)(cn=$group))" ); @@ -639,57 +674,13 @@ sub group_get_members foreach my $entry ($mesg->all_entries){ foreach my $attr ($entry->attributes){ if ($attr=~/\bmemberUid\b/){ - foreach my $ent($entry->get_value($attr)) { push (@resultat,$ent); } + foreach my $ent ($entry->get_value($attr)) { + push (@resultat,$ent); } } } - return @resultat; - } - -sub file_write { - my ($filename, $filecontent) = @_; - local *FILE; - open (FILE, "> $filename") || - die "Cannot open $filename for writing: $!\n"; - print FILE $filecontent; - close FILE; } - -# wrapper for ldapadd -sub do_ldapadd2 - { - my $ldif = shift; - my $tempfile = "/tmp/smbldapadd.$$"; - file_write($tempfile, $ldif); - - my $rc = system "$ldapadd < $tempfile >/dev/null"; - unlink($tempfile); - return $rc; - } - -sub do_ldapadd - { - my $ldif = shift; - my $FILE = "|$ldapadd >/dev/null"; - open (FILE, $FILE) || die "$!\n"; - print FILE </dev/null"; - unlink($tempfile); - return $rc; + return @resultat; } sub do_ldapmodify diff --git a/packaging/Debian/README b/packaging/Debian/README index 40dd310366..95c75d5fc5 100644 --- a/packaging/Debian/README +++ b/packaging/Debian/README @@ -1,12 +1,12 @@ Building Samba Packages for Debian GNU/Linux -------------------------------------------- -Building Debian packages is not as hard as some people might think. The -following instructions will allow you to build your own Samba Debian -packages. These instructions, and the files in packaging/Debian/, are -current as of Samba 3.0.0rc2, and allow you to build Debian packages +Building Debian packages is not as hard as some people might think. +The following instructions will allow you to build your own Samba +Debian packages. These instructions and the files in packaging/Debian/ +are current as of Samba 3.0.0, and allow you to build Debian packages for Debian unstable (so you need some development packages available -only in Debian unstable.) If you are using something newer than 3.0.0rc2 +only in Debian unstable.) If you are using something newer than 3.0.0 you might want to try to follow the instructions to see if patches apply cleanly. If some patches don't apply cleanly please e-mail samba@packages.debian.org since we might have fixed patches that we have diff --git a/packaging/Debian/debian/README.build-upstream b/packaging/Debian/debian/README.build-upstream index 40dd310366..95c75d5fc5 100644 --- a/packaging/Debian/debian/README.build-upstream +++ b/packaging/Debian/debian/README.build-upstream @@ -1,12 +1,12 @@ Building Samba Packages for Debian GNU/Linux -------------------------------------------- -Building Debian packages is not as hard as some people might think. The -following instructions will allow you to build your own Samba Debian -packages. These instructions, and the files in packaging/Debian/, are -current as of Samba 3.0.0rc2, and allow you to build Debian packages +Building Debian packages is not as hard as some people might think. +The following instructions will allow you to build your own Samba +Debian packages. These instructions and the files in packaging/Debian/ +are current as of Samba 3.0.0, and allow you to build Debian packages for Debian unstable (so you need some development packages available -only in Debian unstable.) If you are using something newer than 3.0.0rc2 +only in Debian unstable.) If you are using something newer than 3.0.0 you might want to try to follow the instructions to see if patches apply cleanly. If some patches don't apply cleanly please e-mail samba@packages.debian.org since we might have fixed patches that we have diff --git a/packaging/Debian/debian/changelog b/packaging/Debian/debian/changelog index e29eeaf920..0561f063fa 100644 --- a/packaging/Debian/debian/changelog +++ b/packaging/Debian/debian/changelog @@ -1,8 +1,25 @@ -samba (3.0.0beta2+3.0.0rc3-1) unstable; urgency=low +samba (3.0.0-1) unstable; urgency=low * Local build. - -- Debian User Mon, 8 Sep 2003 13:33:21 -0400 + -- Debian User Tue, 23 Sep 2003 21:50:26 -0400 + +samba (3.0.0beta2+3.0.0rc4-1) unstable; urgency=low + + * New upstream version. + + -- Eloy A. Paris Sat, 13 Sep 2003 08:47:56 -0400 + +samba (3.0.0beta2+3.0.0rc3-1) unstable; urgency=low + + * New upstream release. Last Release Candidate according to the + Samba Team. Samba 3.0.0 is around the corner, in a week or so. + - Fixes use of non-PIC code in nss shared libraries (closes: #208773) + - 'unix password sync' option now runs the unix password program as + root again (closes: #209739). + * One-line patch to make packages buildable with distcc (closes: #210227) + + -- Eloy A. Paris Tue, 9 Sep 2003 07:57:16 -0400 samba (3.0.0beta2+3.0.0rc2-1) unstable; urgency=low diff --git a/packaging/Debian/debian/patches/fhs.patch b/packaging/Debian/debian/patches/fhs.patch index 1c90499a83..652641216b 100644 --- a/packaging/Debian/debian/patches/fhs.patch +++ b/packaging/Debian/debian/patches/fhs.patch @@ -366,7 +366,7 @@ diff -uNr samba-3.0.0beta2.orig/source/param/loadparm.c samba-3.0.0beta2/source/ char *szLockDir; char *szPidDir; char *szRootdir; -@@ -1082,8 +1082,13 @@ +@@ -1083,8 +1083,13 @@ {"config file", P_STRING, P_GLOBAL, &Globals.szConfigFile, NULL, NULL, FLAG_HIDE}, {"preload", P_STRING, P_GLOBAL, &Globals.szAutoServices, NULL, NULL, FLAG_ADVANCED}, {"auto services", P_STRING, P_GLOBAL, &Globals.szAutoServices, NULL, NULL, FLAG_ADVANCED}, diff --git a/packaging/Debian/debian/patches/samba.patch b/packaging/Debian/debian/patches/samba.patch index 2ea25bb328..8707ec517b 100644 --- a/packaging/Debian/debian/patches/samba.patch +++ b/packaging/Debian/debian/patches/samba.patch @@ -49,7 +49,7 @@ diff -uNr samba-3.0.0beta1.orig/source/script/installbin.sh samba-3.0.0beta1/sou diff -uNr samba-3.0.0beta1.orig/source/smbd/service.c samba-3.0.0beta1/source/smbd/service.c --- samba-3.0.0beta1.orig/source/smbd/service.c 2003-06-07 12:57:39.000000000 -0500 +++ samba-3.0.0beta1/source/smbd/service.c 2003-06-30 20:12:57.000000000 -0500 -@@ -885,6 +885,9 @@ +@@ -887,6 +887,9 @@ file_close_conn(conn); dptr_closecnum(conn); @@ -59,7 +59,7 @@ diff -uNr samba-3.0.0beta1.orig/source/smbd/service.c samba-3.0.0beta1/source/sm /* execute any "postexec = " line */ if (*lp_postexec(SNUM(conn)) && change_to_user(conn, vuid)) { -@@ -904,8 +907,5 @@ +@@ -906,8 +909,5 @@ smbrun(cmd,NULL); } diff --git a/packaging/Debian/debian/rules b/packaging/Debian/debian/rules index a59aebeb9c..73e5d16bc1 100755 --- a/packaging/Debian/debian/rules +++ b/packaging/Debian/debian/rules @@ -108,6 +108,7 @@ build: patch-stamp configure-stamp build-stamp build-stamp: dh_testdir + $(MAKE) -C source headers $(MAKE) -C source all nsswitch/libnss_wins.so python_ext touch build-stamp @@ -211,7 +212,7 @@ install: build # and lib.linux-i686-2.3 directories. Using only the stuff from # the 2.3 directory for now. peloy.- #cp source/build/lib.*/samba/*.so $(DESTDIR)/usr/lib/python2.3/site-packages/ - cp source/build/lib.linux-i686-2.3/samba/*.so $(DESTDIR)/usr/lib/python2.3/site-packages/ + cp source/build/lib.linux-*-2.3/samba/*.so $(DESTDIR)/usr/lib/python2.3/site-packages/ dh_movefiles diff --git a/packaging/RedHat/samba.spec.tmpl b/packaging/RedHat/samba.spec.tmpl index 26e86aa61d..fa4b7b070b 100644 --- a/packaging/RedHat/samba.spec.tmpl +++ b/packaging/RedHat/samba.spec.tmpl @@ -426,6 +426,7 @@ fi %{prefix}/share/swat/lang/*/images/* %{prefix}/share/swat/lang/*/include/*.html %{prefix}/share/swat/using_samba/* +%attr(755,root,root) %{prefix}/lib/samba/*.msg %config(noreplace) /etc/samba/lmhosts %config(noreplace) /etc/samba/smb.conf %config(noreplace) /etc/samba/smbusers -- cgit From 4b10dd945476a93fd9a7d3e047cff7592935ad34 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 24 Sep 2003 15:08:05 +0000 Subject: more syncs from 3.0 (This used to be commit bb7d5ce3762afcb14905fc2c1112df8a7475ffe3) --- docs/docbook/smbdotconf/misc/afsshare.xml | 17 ++++ docs/docbook/smbdotconf/misc/afsusernamemap.xml | 20 +++++ docs/htmldocs/index.html | 40 +++++++++ docs/htmldocs/samba-doc.html | 72 --------------- examples/LDAP/smbldap-tools/AUTHORS | 0 examples/LDAP/smbldap-tools/NEWS | 0 examples/LDAP/smbldap-tools/smbldap-groupmod.pl | 112 ++++++++++++------------ 7 files changed, 133 insertions(+), 128 deletions(-) create mode 100644 docs/docbook/smbdotconf/misc/afsshare.xml create mode 100644 docs/docbook/smbdotconf/misc/afsusernamemap.xml create mode 100755 docs/htmldocs/index.html delete mode 100644 docs/htmldocs/samba-doc.html delete mode 100644 examples/LDAP/smbldap-tools/AUTHORS delete mode 100644 examples/LDAP/smbldap-tools/NEWS diff --git a/docs/docbook/smbdotconf/misc/afsshare.xml b/docs/docbook/smbdotconf/misc/afsshare.xml new file mode 100644 index 0000000000..1933fa5768 --- /dev/null +++ b/docs/docbook/smbdotconf/misc/afsshare.xml @@ -0,0 +1,17 @@ + + + This parameter controls whether special AFS features are enabled + for this share. If enabled, it assumes that the directory exported via + the path parameter is a local AFS import. The + special AFS features include the attempt to hand-craft an AFS token + if you enabled --with-fake-kaserver in configure. + + + Default: afs share = no + + Example: afs share = yes + + diff --git a/docs/docbook/smbdotconf/misc/afsusernamemap.xml b/docs/docbook/smbdotconf/misc/afsusernamemap.xml new file mode 100644 index 0000000000..a312f4309b --- /dev/null +++ b/docs/docbook/smbdotconf/misc/afsusernamemap.xml @@ -0,0 +1,20 @@ + + + If you are using the fake kaserver AFS feature, you might + want to hand-craft the usernames you are creating tokens for. + For example this is necessary if you have users from several domain + in your AFS Protection Database. One possible scheme to code users + as DOMAIN+User as it is done by winbind with the + as a separator. + + + The mapped user name must contain the cell name to log into, + so without setting this parameter there will be no token. + + Default: none + + Example: afs username map = %u@afs.samba.org + + diff --git a/docs/htmldocs/index.html b/docs/htmldocs/index.html new file mode 100755 index 0000000000..c996a93dc7 --- /dev/null +++ b/docs/htmldocs/index.html @@ -0,0 +1,40 @@ +SAMBA Project Documentation

    SAMBA Project Documentation
       Next

    SAMBA Project Documentation

    Edited by

    Jelmer R. Vernooij

    John H. Terpstra

    Gerald (Jerry) Carter

    Monday April 21, 2003

    Abstract

    +This book is a collection of HOWTOs added to Samba documentation over the years. +Samba is always under development, and so is its' documentation. This release of the +documentation represents a major revision or layout as well as contents. +The most recent version of this document can be found at +http://www.samba.org/ +on the "Documentation" page. Please send updates to +Jelmer Vernooij, +John H. Terpstra or +Gerald (Jerry) Carter. +

    +The Samba-Team would like to express sincere thanks to the many people who have with +or without their knowledge contributed to this update. The size and scope of this +project would not have been possible without significant community contribution. A not +insignificant number of ideas for inclusion (if not content itself) has been obtained +from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. +Please keep publishing your Unofficial HOWTOs - they are a source of inspiration and +application knowledge that is most to be desired by many Samba users and administrators. +

    Table of Contents

    Legal Notice
    Attributions
    I. General Installation
    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and Installing Samba
    Configuring Samba (smb.conf)
    Configuration file syntax
    Example Configuration
    SWAT
    List Shares Available on the Server
    Connect with a UNIX Client
    Connect from a Remote SMB Client
    What If Things Don't Work?
    Common Errors
    Large Number of smbd Processes
    Error Message: open_oplock_ipc
    The network name cannot be found
    3. Fast Start for the Impatient
    Note
    II. Server Configuration Basics
    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password Checking
    Common Errors
    What Makes Samba a Server?
    What Makes Samba a Domain Controller?
    What Makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    $ Cannot Be Included in Machine Name
    Joining Domain Fails Because of Existing Machine Account
    The System Cannot Log You On (C000019B)
    The Machine Trust Account Is Not Accessible
    Account Disabled
    Domain Controller Unavailable
    Cannot Log onto Domain Member Workstation After Joining Domain
    6. Backup Domain Control
    Features and Benefits
    Essential Background Information
    MS Windows NT4-style Domain Control
    LDAP Configuration Notes
    Active Directory Domain Control
    What Qualifies a Domain Controller on the Network?
    How does a Workstation find its Domain Controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts Keep Expiring
    Can Samba Be a Backup Domain Controller to an NT4 PDC?
    How Do I Replicate the smbpasswd File?
    Can I Do This All with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Managing Domain Machine Accounts using NT4 Server Manager
    On-the-Fly Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4-type Domain with Samba-3
    Why Is This Better Than security = server?
    Samba ADS Domain Membership
    Configure smb.conf
    Configure /etc/krb5.conf
    Create the Computer Account
    Testing Server Setup
    Testing with smbclient
    Notes
    Sharing User ID Mappings between Samba Domain Members
    Common Errors
    Cannot Add Machine Back to Domain
    Adding Machine to Domain Fails
    I Can't Join a Windows 2003 PDC
    8. Stand-alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    III. Advanced Configuration
    10. Network Browsing
    Features and Benefits
    What Is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Configuring WORKGROUP Browsing
    DOMAIN Browsing Configuration
    Forcing Samba to Be the Master
    Making Samba the Domain Master
    Note about Broadcast Addresses
    Multiple Interfaces
    Use of the Remote Announce Parameter
    Use of the Remote Browse Sync Parameter
    WINS The Windows Internetworking Name Server
    WINS Server Configuration
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of Browsing
    Browsing Support in Samba
    Problem Resolution
    Cross-Subnet Browsing
    Common Errors
    How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?
    Server Resources Can Not Be Listed
    I get an `Unable to browse the network' error
    Browsing of Shares and Directories is Very Slow
    11. Account Information Databases
    Features and Benefits
    Backward Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plaintext
    smbpasswd Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users Cannot Logon
    Users Being Added to the Wrong Backend Database
    Configuration of auth methods
    12. Group Mapping MS Windows and UNIX
    Features and Benefits
    Discussion
    Default Users, Groups and Relative Identifiers
    Example Configuration
    Configuration Scripts
    Sample smb.conf Add Group Script
    Script to Configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users Group
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group-Based Controls
    File and Directory Permissions-Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX Permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing File Ownership
    Viewing File or Directory Permissions
    Modifying File or Directory Permissions
    Interaction with the Standard Samba create mask Parameters
    Interaction with the Standard Samba File Attribute Mapping
    Common Errors
    Users Cannot Write to a Public Share
    File Operations Done as root with force user Set
    MS Word with Samba Changes Owner of File
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb Error Messages
    Problems Saving Files in MS Office on Windows XP
    Long Delays Deleting Files Over Network with XP SP1
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using Host-Based Protection
    User-Based Protection
    Using Interface Protection
    Using a Firewall
    Using IPC$ Share-Based Denials
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient Works on Localhost, but the Network Is Dead
    Why Can Users Access Home Directories of Other Users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-Style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-Style Domain Trusts with Windows 2000
    Common Errors
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    MSDFS UNIX Path Is Case-Critical
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    Client to Samba Print Job Processing
    Printing Related Configuration Parameters
    Simple Print Configuration
    Verifing Configuration with testparm
    Rapid Configuration Validation
    Extended Printing Configuration
    Detailed Explanation Settings
    Printing Developments Since Samba-2.2
    Point'n'Print Client Drivers on Samba Servers
    The Obsoleted [printer$] Section
    Creating the [print$] Share
    [print$] Section Parameters
    The [print$] Share Directory
    Installing Drivers into [print$]
    Add Printer Wizard Driver Installation
    Installing Print Drivers Using rpcclient
    Client Driver Installation Procedure
    First Client Driver Installation
    Setting Device Modes on New Printers
    Additional Client Driver Installation
    Always Make First Client Connection as root or printer admin
    Other Gotchas
    Setting Default Print Options for Client Drivers
    Supporting Large Numbers of Printers
    Adding New Printers with the Windows NT APW
    Error Message: Cannot connect under a different Name
    Take Care When Assembling Driver Files
    Samba and Printer Ports
    Avoiding Common Client Driver Misconfiguration
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Adding Network Printers without User Interaction
    The addprinter Command
    Migration of Classical Printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I Give My Root Password but I Do Not Get Access
    My Print Jobs Get Spooled into the Spooling Directory, but Then Get Lost
    19. CUPS Printing Support
    Introduction
    Features and Benefits
    Overview
    Basic CUPS Support Configuration
    Linking smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More Complex CUPS smb.conf Settings
    Advanced Configuration
    Central Spooling vs. Peer-to-Peer Printing
    Raw Print Serving Vendor Drivers on Windows Clients
    Installation of Windows Client Drivers
    Explicitly Enable raw Printing for application/octet-stream
    Driver Upload Methods
    Advanced Intelligent Printing with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript the Software RIP for Non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    Using Windows-Formatted Vendor PPDs
    CUPS Also Uses PPDs for Non-PostScript Printers
    The CUPS Filtering Architecture
    MIME Types and CUPS Filters
    MIME Type Conversion Rules
    Filtering Overview
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    The Role of cupsomatic/foomatic
    The Complete Picture
    mime.convs
    Raw Printing
    application/octet-stream Printing
    PostScript Printer Descriptions (PPDs) for Non-PS Printers
    cupsomatic/foomatic-rip Versus native CUPS Printing
    Examples for Filtering Chains
    Sources of CUPS Drivers/PPDs
    Printing with Interface Scripts
    Network Printing (Purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows Clients UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba Receiving Jobfiles and Passing Them to CUPS
    Network PostScript RIP
    PPDs for Non-PS Printers on UNIX
    PPDs for Non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers Running in Kernel Mode Cause Many +Problems
    Workarounds Impose Heavy Limitations
    CUPS: A Magical Stone?
    PostScript Drivers with No Major Problems Even in Kernel +Mode
    Configuring CUPS for Driver Download
    cupsaddsmb: The Unknown Utility
    Prepare Your smb.conf for cupsaddsmb
    CUPS PostScript Driver for Windows NT/200x/XP
    Recognizing Different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro PostScript Driver for Windows NT/200x/XP
    Caveats to be Considered
    Windows CUPS PostScript Driver Versus Adobe Driver
    Run cupsaddsmb (Quiet Mode)
    Run cupsaddsmb with Verbose Output
    Understanding cupsaddsmb
    How to Recognize If cupsaddsmb Completed Successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding Critical PostScript Driver Settings on the Client
    Installing PostScript Driver Files Manually Using rpcclient
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by Querying a Windows Box
    Requirements for adddriver and setdriver to Succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting Revisited
    The Printing *.tdb Files
    Trivial Database Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic Explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting Up Quotas
    Correct and Incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings Explained
    Pre-Conditions
    Manual Configuration
    Printing from CUPS to Windows Attached Printers
    More CUPS-Filtering Chains
    Common Errors
    Windows 9x/ME Client Can't Install Driver
    cupsaddsmb Keeps Asking for Root Password in Never-ending Loop
    cupsaddsmb Errors
    Client Can't Connect to Samba Printer
    New Account Reconnection from Windows 200x/XP Troubles
    Avoid Being Connected to the Samba Server as the Wrong User
    Upgrading to CUPS Drivers from Adobe Drivers
    Can't Use cupsaddsmb on Samba Server Which Is a PDC
    Deleted Windows 200x Printer Driver Is Still Shown
    Windows 200x/XP "Local Security Policies"
    Administrator Cannot Install Printers for All Local Users
    Print Change Notify Functions on NT-clients
    WinXP-SP1
    Print Options for All Users Can't Be Set on Windows 200x/XP
    Most Common Blunders in Driver Settings on Windows Clients
    cupsaddsmb Does Not Work with Newly Installed Printer
    Permissions on /var/spool/samba/ Get Reset After Each Reboot
    Print Queue Called lp Mis-handles Print Jobs
    Location of Adobe PostScript Driver Files for cupsaddsmb
    Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included Modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS Modules Available Elsewhere
    DatabaseFS
    vscan
    21. Winbind: Use of Domain Accounts
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    Winbind Is Not Resolving Users and Groups
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachine.Com
    Network Logon Script Magic
    Adding Printers without User Intervention
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/ME Policies
    Windows NT4-Style Policy Files
    MS Windows 200x/XP Professional Policies
    Managing Account/User Policies
    Management Tools
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP Workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory Profiles
    Creating and Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Configuring Roaming Profiles for a Few Users or Groups
    Cannot Use Roaming Profiles
    Changing the Default Profile
    25. PAM-Based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication Using winbindd.so
    Password Synchronization Using pam_smbpass.so
    Common Errors
    pam_winbind Problem
    Winbind Is Not Resolving Users and Groups
    26. Integrating MS Windows Networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a Pure UNIX/Linux World
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name Resolution as Used within MS Windows Networking
    The NetBIOS Name Cache
    The LMHOSTS File
    HOSTS File
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging Works Only in One Way
    Very Slow Network Connections
    Samba Server Name Change Problem
    27. Unicode/Charsets
    Features and Benefits
    What Are Charsets and Unicode?
    Samba and Charsets
    Conversion from Old Names
    Japanese Charsets
    Common Errors
    CP850.so Can't Be Found
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    IV. Migration and Updating
    30. Upgrading from Samba-2.x to Samba-3.0.0
    Quick Migration Guide
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (Changes in Behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    LDAP
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps in Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices
    32. SWAT The Samba Web Administration Tool
    Features and Benefits
    Guidelines and Technical Tips
    Validate SWAT Installation
    Enabling SWAT for Use
    Securing SWAT through SSL
    Enabling SWAT Internationalization Support
    Overview and Quick Tour
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    V. Troubleshooting
    33. The Samba Checklist
    Introduction
    Assumptions
    The Tests
    34. Analyzing and Solving Samba Problems
    Diagnostics Tools
    Debugging with Samba Itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting Mailing List Help
    How to Get Off the Mailing Lists
    35. Reporting Bugs
    Introduction
    General Information
    Debug Levels
    Internal Errors
    Attaching to a Running Process
    Patches
    VI. Appendixes
    36. How to Compile Samba
    Access Samba Source Code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the Samba Sources via rsync and ftp
    Verifying Samba's PGP Signature
    Building the Binaries
    Compiling Samba with Active Directory Support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: Starting smbd as a Daemon
    37. Portability
    HPUX
    SCO UNIX
    DNIX
    Red Hat Linux
    AIX
    Sequential Read Ahead
    Solaris
    Locking Improvements
    Winbind on Solaris 9
    38. Samba and Other CIFS Clients
    Macintosh Clients
    OS2 Client
    Configuring OS/2 Warp Connect or OS/2 Warp 4
    Configuring Other Versions of OS/2
    Printer Driver Download for OS/2 Clients
    Windows for Workgroups
    Latest TCP/IP Stack from Microsoft
    Delete .pwl Files After Password Change
    Configuring Windows for Workgroups Password Handling
    Password Case Sensitivity
    Use TCP/IP as Default Protocol
    Speed Improvement
    Windows 95/98
    Speed Improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket Options
    Read Size
    Max Xmit
    Log Level
    Read Raw
    Write Raw
    Slow Logins
    Client Tuning
    Samba Performance Problem Due to Changing Linux Kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Index

    List of Figures

    5.1. An Example Domain.
    10.1. Cross-Subnet Browsing Example.
    11.1. IDMAP: Resolution of SIDs to UIDs.
    11.2. IDMAP: Resolution of UIDs to SIDs.
    12.1. IDMAP: group SID to GID resolution.
    12.2. IDMAP: GID resolution to matching SID.
    12.3. IDMAP storing group mappings.
    13.1. Overview of UNIX permissions field.
    16.1. Trusts overview.
    19.1. Windows printing to a local printer.
    19.2. Printing to a PostScript printer.
    19.3. Ghostscript as a RIP for non-postscript printers.
    19.4. Pre-filtering in CUPS to form PostScript.
    19.5. Adding device-specific print options.
    19.6. PostScript to intermediate raster format.
    19.7. CUPS-raster production using Ghostscript.
    19.8. Image format to CUPS-raster format conversion.
    19.9. Raster to printer-specific formats.
    19.10. cupsomatic/foomatic Processing versus Native CUPS.
    19.11. PDF to socket chain.
    19.12. PDF to USB chain.
    19.13. Print driver execution on the client.
    19.14. Print driver execution on the server.
    19.15. Printing via CUPS/Samba server.
    19.16. cupsaddsmb flowchart.
    19.17. Filtering chain 1.
    19.18. Filtering chain with cupsomatic
    19.19. CUPS printing overview.
    34.1. Starting a capture.
    34.2. Main ethereal data window.

    List of Tables

    6.1. Domain Backend Account Distribution Options
    7.1. Assumptions
    10.1. Browse Subnet Example 1
    10.2. Browse Subnet Example 2
    10.3. Browse Subnet Example 3
    10.4. Browse Subnet Example 4
    11.1. Attributes in the sambaSamAccount objectclass (LDAP) Part A
    11.2. Attributes in the sambaSamAccount objectclass (LDAP) Part B
    11.3. Possible ldap passwd sync values
    11.4. Basic smb.conf options for MySQL passdb backend
    11.5. MySQL field names for MySQL passdb backend
    12.1. Well-Known User Default RIDs
    13.1. Managing Directories with UNIX and Windows
    13.2. User and Group Based Controls
    13.3. File and Directory Permission Based Controls
    13.4. Other Controls
    18.1. Default Printing Settings
    19.1. PPDs shipped with CUPS
    20.1. Extended Auditing Log Information
    24.1. User Shell Folder Registry Keys Default Values
    24.2. Defaults of Profile Settings Registry Keys
    24.3. Defaults of Default User Profile Paths Registry Keys
    25.1. Options recognized by pam_smbpass
    26.1. Unique NetBIOS Names
    26.2. Group Names
    30.1. TDB File Descriptions
    31.1. The Three Major Site Types
    31.2. Nature of the Conversion Choices

    List of Examples

    2.1. A minimal smb.conf
    2.2. Another simple smb.conf File
    5.1. smb.conf for being a PDC
    5.2. smb.conf for being a PDC
    6.1. Minimal smb.conf for a PDC in Use With a BDC LDAP Server on PDC.
    6.2. Multiple LDAP Servers in smb.conf
    6.3. Minimal setup for being a BDC
    8.1. smb.conf for Reference Documentation Server
    8.2. smb.conf for Anonymous Printing
    10.1. Domain Master Browser smb.conf
    10.2. Local master browser smb.conf
    10.3. smb.conf for not being a Master Browser
    10.4. Local Master Browser smb.conf
    10.5. smb.conf for not being a master browser
    11.1. Example configuration with the LDAP idmap backend
    11.2. Configuration with LDAP
    11.3. Example configuration for the MySQL passdb backend
    12.1. smbgrpadd.sh
    12.2. Configuration of smb.conf for the add group script.
    12.3. Script to Set Group Mapping
    13.1. Example File
    14.1. Share with some files oplocked
    14.2. Configuration with oplock break contention limit
    17.1. smb.conf with DFS configured
    18.1. Simple configuration with BSD printing
    18.2. Extended BSD Printing Configuration
    18.3. [print\$] example
    19.1. Simplest printing-related smb.conf
    19.2. Overriding global CUPS settings for one printer
    19.3. smb.conf for cupsaddsmb usage
    20.1. smb.conf with VFS modules
    20.2. smb.conf with multiple VFS modules
    21.1. smb.conf for Winbind set-up
    33.1. smb.conf with [tmp] share
    33.2. Configuration for only allowing connections from a certain subnet
    33.3. Configuration for allowing connections from a certain subnet and localhost
    38.1. Minimal profile share
       Next
       Legal Notice
    diff --git a/docs/htmldocs/samba-doc.html b/docs/htmldocs/samba-doc.html deleted file mode 100644 index f5dfd49888..0000000000 --- a/docs/htmldocs/samba-doc.html +++ /dev/null @@ -1,72 +0,0 @@ -SAMBA Project Documentation
    SAMBA Project Documentation
       Next

    SAMBA Project Documentation

    Edited by

    Jelmer R. Vernooij

    John H. Terpstra

    Gerald (Jerry) Carter

    Monday April 21, 2003

    Abstract

    -This book is a collection of HOWTOs added to Samba documentation over the years. -Samba is always under development, and so is its' documentation. This release of the -documentation represents a major revision or layout as well as contents. -The most recent version of this document can be found at -http://www.samba.org/ -on the "Documentation" page. Please send updates to -Jelmer Vernooij, -John H. Terpstra or -Gerald (Jerry) Carter. -

    -The Samba-Team would like to express sincere thanks to the many people who have with -or without their knowledge contributed to this update. The size and scope of this -project would not have been possible without significant community contribution. A not -insignificant number of ideas for inclusion (if not content itself) has been obtained -from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. -Please keep publishing your Unofficial HOWTOs - they are a source of inspiration and -application knowledge that is most to be desired by many Samba users and administrators. -

    Table of Contents

    Legal Notice
    Attributions
    I. General Installation
    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from another SMB client
    What If Things Don't Work?
    Common Errors
    Large number of smbd processes
    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
    "The network name cannot be found"
    3. Fast Start for the Impatient
    Note
    II. Server Configuration Basics
    4. Server Types and Security Modes
    Features and Benefits
    Server Types
    Samba Security Modes
    User Level Security
    Share Level Security
    Domain Security Mode (User Level Security)
    ADS Security Mode (User Level Security)
    Server Security (User Level Security)
    Password checking
    Common Errors
    What makes Samba a SERVER?
    What makes Samba a Domain Controller?
    What makes Samba a Domain Member?
    Constantly Losing Connections to Password Server
    5. Domain Control
    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    '$' cannot be included in machine name
    Joining domain fails because of existing machine account
    The system can not log you on (C000019B)....
    The machine trust account not accessible
    Account disabled
    Domain Controller Unavailable
    Can not log onto domain member workstation after joining domain
    6. Backup Domain Control
    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?
    7. Domain Membership
    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    I can't join a Windows 2003 PDC
    8. Stand-Alone Servers
    Features and Benefits
    Background
    Example Configuration
    Reference Documentation Server
    Central Print Serving
    Common Errors
    9. MS Windows Network Configuration Guide
    Note
    III. Advanced Configuration
    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    I get an Unable to browse the network error
    11. Account Information Databases
    Features and Benefits
    Backwards Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon
    Users being added to wrong backend database
    auth methods does not work
    12. Mapping MS Windows and UNIX Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users group
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute mapping
    Common Errors
    Users can not write to a public share
    I have set force user but Samba still makes root the owner of all the files I touch!
    MS Word with Samba changes owner of file
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Problems saving files in MS Office on Windows XP
    Long delays deleting files over network with XP SP1
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-style Domain Trusts with Windows 2000
    Common Errors
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    A simple Configuration to Print
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various UNIX Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba 3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with -rpcclient
    Client Driver Install Procedure
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a -different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for -CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for -application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and -native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print -Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many -Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel -Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Caveats to be considered
    Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsmb completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the -Client
    Installing PostScript Driver Files manually (using -rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    In Case of Trouble.....
    Printing from CUPS to Windows attached -Printers
    More CUPS filtering Chains
    Common Errors
    Win9x client can't install driver
    "cupsaddsmb" keeps asking for root password in - neverending loop
    "cupsaddsmb" gives "No PPD file for printer..." - message while PPD file is present
    Client can't connect to Samba printer
    Can't reconnect to Samba under new account - from Win2K/XP
    Avoid being connected to the Samba server as the - "wrong" user
    Upgrading to CUPS drivers from Adobe drivers on - NT/2K/XP clients gives problems
    Can't use "cupsaddsmb" on Samba server which is - a PDC
    Deleted Win2K printer driver is still shown
    Win2K/XP "Local Security - Policies"
    WinXP clients: "Administrator can not install - printers for all local users"
    "Print Change Notify" functions on - NT-clients
    WinXP-SP1
    Print options for all users can't be set on Win2K/XP
    Most common blunders in driver - settings on Windows clients
    cupsaddsmb does not work - with newly installed printer
    Permissions on -/var/spool/samba/ get reset after each -reboot
    Printer named "lp" -intermittently swallows jobs and spits out completely different -ones
    Location of Adobe PostScript driver files necessary for "cupsaddsmb"
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    21. Winbind: Use of Domain Accounts
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Setting up roaming profiles for just a few user's or group's?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    Winbind is not resolving users and groups
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure UNIX/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging works only in one way
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    Common errors
    CP850.so can't be found
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    IV. Migration and Updating
    30. Upgrading from Samba-2.x to Samba-3.0.0
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (changes in behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    Charsets
    LDAP
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    V. Troubleshooting
    33. The Samba checklist
    Introduction
    Assumptions
    The tests
    34. Analysing and solving samba problems
    Diagnostics tools
    Debugging with Samba itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists
    35. Reporting Bugs
    Introduction
    General info
    Debug levels
    Internal errors
    Attaching to a running process
    Patches
    VI. Appendixes
    36. How to compile Samba
    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon
    37. Portability
    HPUX
    SCO UNIX
    DNIX
    RedHat Linux Rembrandt-II
    AIX
    Sequential Read Ahead
    Solaris
    Locking improvements
    Winbind on Solaris 9
    38. Samba and other CIFS clients
    Macintosh clients?
    OS2 Client
    Configuring OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba
    Configuring OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba
    Printer driver download for for OS/2 clients?
    Windows for Workgroups
    Latest TCP/IP stack from Microsoft
    Delete .pwl files after password change
    Configuring WfW password handling
    Case handling of passwords
    Use TCP/IP as default protocol
    Speed improvement
    Windows '95/'98
    Speed improvement
    Windows 2000 Service Pack 2
    Windows NT 3.1
    39. Samba Performance Tuning
    Comparisons
    Socket options
    Read size
    Max xmit
    Log level
    Read raw
    Write raw
    Slow Logins
    Client tuning
    Samba performance problem due changing kernel
    Corrupt tdb Files
    40. DNS and DHCP Configuration Guide
    Note
    41. Further Resources
    Websites
    Related updates from Microsoft
    Index

    List of Figures

    5.1. An Example Domain
    10.1. Cross subnet browsing example
    11.1. IDMAP
    12.1. IDMAP groups
    13.1. Overview of unix permissions field
    16.1. Trusts overview
    19.1. Windows Printing to a local Printer
    19.2. Printing to a Postscript Printer
    19.3. Ghostscript as a RIP for non-postscript printers
    19.4. Prefiltering in CUPS to form Postscript
    19.5. Adding Device-specific Print Options
    19.6. Postscript to intermediate Raster format
    19.7. CUPS-raster production using Ghostscript
    19.8. Image format to CUPS-raster format conversion
    19.9. Raster to Printer Specific formats
    19.10. cupsomatic/foomatic processing versus Native CUPS
    19.11. PDF to socket chain
    19.12. PDF to USB chain
    19.13. Print Driver execution on the Client
    19.14. Print Driver execution on the Server
    19.15. Printing via CUPS/samba server
    19.16. cupsaddsmb flowchart
    19.17. Filtering chain 1
    19.18. Filtering chain with cupsomatic
    19.19. CUPS Printing Overview

    List of Tables

    7.1. Assumptions
    10.1. Browse subnet example 1
    10.2. Browse subnet example 2
    10.3. Browse subnet example 3
    10.4. Browse subnet example 4
    11.1. Attributes in the sambaSamAccount objectclass (LDAP)
    11.2. Basic smb.conf options for MySQL passdb backend
    11.3. MySQL field names for MySQL passdb backend
    13.1. Managing directories with unix and windows
    13.2. User and Group Based Controls
    13.3. File and Directory Permission Based Controls
    13.4. Other Controls
    19.1. PPD's shipped with CUPS
    20.1. Extended Auditing Log Information
    24.1. User Shell Folder registry keys default values
    24.2. Defaults of profile settings registry keys
    24.3. Defaults of default user profile paths registry keys
    25.1. Options recognized by pam_smbpass
    26.1. Unique NetBIOS names
    26.2. Group Names
    30.1. TDB File Descriptions
    31.1. The 3 Major Site Types
    31.2. Nature of the Conversion Choices

    List of Examples

    2.1. Simplest possible smb.conf file
    5.1. smb.conf for being a PDC
    5.2. smb.conf for being a PDC
    6.1. Minimal smb.conf for being a PDC
    6.2. Minimal setup for being a BDC
    8.1. smb.conf for Reference Documentation Server
    8.2. smb.conf for anonymous printing
    10.1. Domain master browser smb.conf
    10.2. Local master browser smb.conf
    10.3. smb.conf for not being a master browser
    10.4. Local master browser smb.conf
    10.5. smb.conf for not being a master browser
    11.1.
    11.2. Configuration with LDAP
    12.1. smbgrpadd.sh
    13.1. Example File
    14.1. Share with some files oplocked
    14.2.
    17.1. smb.conf with DFS configured
    18.1. Simple configuration with BSD printing
    18.2. Extended configuration with BSD printing
    18.3. [print\$] example
    19.1. Simplest printing-related smb.conf
    19.2. Overriding global CUPS settings for one printer
    19.3. smb.conf for cupsaddsmb usage
    20.1. smb.conf with VFS modules
    20.2. smb.conf with multiple VFS modules
    21.1. smb.conf for winbind set-up
    33.1. smb.conf with [tmp] share
    38.1. Minimal profile share
       Next
       Legal Notice
    diff --git a/examples/LDAP/smbldap-tools/AUTHORS b/examples/LDAP/smbldap-tools/AUTHORS deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/examples/LDAP/smbldap-tools/NEWS b/examples/LDAP/smbldap-tools/NEWS deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/examples/LDAP/smbldap-tools/smbldap-groupmod.pl b/examples/LDAP/smbldap-tools/smbldap-groupmod.pl index 4a891a2772..f897101602 100755 --- a/examples/LDAP/smbldap-tools/smbldap-groupmod.pl +++ b/examples/LDAP/smbldap-tools/smbldap-groupmod.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/perl -w # This code was developped by IDEALX (http://IDEALX.org/) and # contributors (their names can be found in the CONTRIBUTORS file). # @@ -23,6 +23,9 @@ use strict; +use FindBin; +use FindBin qw($RealBin); +use lib "$RealBin/"; use smbldap_tools; use smbldap_conf; @@ -70,45 +73,30 @@ if (defined($tmp = $Options{'g'}) and $tmp =~ /\d+/) { } } if (!($gid == $tmp)) { - my $tmpldif = -"dn: cn=$groupName,$groupsdn -changetype: modify -replace: gidNumber -gidNumber: $tmp - -"; - die "$0: error while modifying group $groupName\n" - unless (do_ldapmodify($tmpldif) == 0); - undef $tmpldif; - + my $ldap_master=connect_ldap_master(); + my $modify = $ldap_master->modify ( "cn=$groupName,$groupsdn", + changes => [ + replace => [gidNumber => $tmp] + ] + ); + $modify->code && die "failed to modify entry: ", $modify->error ; + # take down session + $ldap_master->unbind } } -if (defined($newname)) { - my $FILE="|$ldapmodrdn >/dev/null"; - open (FILE, $FILE) || die "$!\n"; - print FILE <moddn ( + "cn=$groupName,$groupsdn", + newrdn => "cn=$newname", + deleteoldrdn => "1", + newsuperior => "$groupsdn" + ); + $modify->code && die "failed to modify entry: ", $modify->error ; + # take down session + $ldap_master->unbind } # Add members @@ -117,16 +105,24 @@ if (defined($Options{'m'})) { my @members = split( /,/, $members ); my $member; foreach $member ( @members ) { - my $tmpldif = -"dn: cn=$groupName,$groupsdn -changetype: modify -add: memberUid -memberUid: $member - -"; - die "$0: error while modifying group $groupName\n" - unless (do_ldapmodify($tmpldif) == 0); - undef $tmpldif; + if (is_unix_user($member)) { + if (is_group_member("cn=$groupName,$groupsdn",$member)) { + print "User $member already in the group\n"; + } else { + print "adding user $member to group $groupName\n"; + my $ldap_master=connect_ldap_master(); + my $modify = $ldap_master->modify ( "cn=$groupName,$groupsdn", + changes => [ + add => [memberUid => $member] + ] + ); + $modify->code && warn "failed to add entry: ", $modify->error ; + # take down session + $ldap_master->unbind + } + } else { + print "User $member does not exist: create it first !\n"; + } } } @@ -136,16 +132,20 @@ if (defined($Options{'x'})) { my @members = split( /,/, $members ); my $member; foreach $member ( @members ) { - my $tmpldif = -"dn: cn=$groupName,$groupsdn -changetype: modify -delete: memberUid -memberUid: $member - -"; - die "$0: error while modifying group $groupName\n" - unless (do_ldapmodify($tmpldif) == 0); - undef $tmpldif; + if (is_group_member("cn=$groupName,$groupsdn",$member)) { + print "deleting user $member from group $groupName\n"; + my $ldap_master=connect_ldap_master(); + my $modify = $ldap_master->modify ( "cn=$groupName,$groupsdn", + changes => [ + delete => [memberUid => $member] + ] + ); + $modify->code && warn "failed to delete entry: ", $modify->error ; + # take down session + $ldap_master->unbind + } else { + print "User $member is not in the group $groupName!\n"; + } } } -- cgit From 602ad283b4724acac0a416cd1fd1124ce89ee316 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 24 Sep 2003 15:16:57 +0000 Subject: * sync more files from 3.0 * set version string to "CVS 3.1.0alpha1" (This used to be commit c6a61ffcbd0c95afd94bd33fd832b24bc8209de5) --- source3/Makefile.in | 5 +++- source3/VERSION | 8 +++--- source3/lib/afs.c | 60 ++++++++++++++++++++++++++------------------ source3/lib/util_sec.c | 4 +++ source3/param/loadparm.c | 7 ++++++ source3/script/gaptab.awk | 4 +-- source3/script/installmsg.sh | 23 +++++++++++++++++ source3/smbd/service.c | 4 ++- source3/utils/net.c | 6 ++--- 9 files changed, 86 insertions(+), 35 deletions(-) create mode 100644 source3/script/installmsg.sh diff --git a/source3/Makefile.in b/source3/Makefile.in index a2c4a360d4..0ea2c4411f 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -1205,7 +1205,10 @@ installscripts: installdirs installdat: installdirs @$(SHELL) $(srcdir)/script/installdat.sh $(DESTDIR)$(LIBDIR) $(srcdir) -installswat: installdirs +installmsg: installdirs + @$(SHELL) $(srcdir)/script/installmsg.sh $(DESTDIR)$(LIBDIR) $(srcdir) + +installswat: installdirs installmsg @$(SHELL) $(srcdir)/script/installswat.sh $(DESTDIR)$(SWATDIR) $(srcdir) installclientlib: installdirs libsmbclient diff --git a/source3/VERSION b/source3/VERSION index 9cf8b11ef1..d7f386ab42 100644 --- a/source3/VERSION +++ b/source3/VERSION @@ -18,8 +18,8 @@ # -> "3.0.0" # ######################################################## SAMBA_VERSION_MAJOR=3 -SAMBA_VERSION_MINOR=0 -SAMBA_VERSION_RELEASE=1 +SAMBA_VERSION_MINOR=1 +SAMBA_VERSION_RELEASE=0 ######################################################## # If a official release has a serious bug # @@ -41,7 +41,7 @@ SAMBA_VERSION_REVISION= # e.g. SAMBA_VERSION_PRE_RELEASE=1 # # -> "2.2.9pre1" # ######################################################## -SAMBA_VERSION_PRE_RELEASE=1 +SAMBA_VERSION_PRE_RELEASE= ######################################################## # For 'rc' releases the version will be # @@ -71,7 +71,7 @@ SAMBA_VERSION_BETA_RELEASE= # e.g. SAMBA_VERSION_ALPHA_RELEASE=1 # # -> "4.0.0alpha1" # ######################################################## -SAMBA_VERSION_ALPHA_RELEASE= +SAMBA_VERSION_ALPHA_RELEASE=1 ######################################################## # For 'test' releases the version will be # diff --git a/source3/lib/afs.c b/source3/lib/afs.c index b96703e986..882442a79f 100644 --- a/source3/lib/afs.c +++ b/source3/lib/afs.c @@ -35,18 +35,6 @@ _syscall5(int, afs_syscall, int, subcall, char *, cmarg, int, follow); -char *afs_cell(void) -{ - static char *cell = NULL; - - if (cell == NULL) { - cell = strdup(lp_realm()); - strlower_m(cell); - } - - return cell; -} - struct ClearToken { uint32 AuthHandle; char HandShakeKey[8]; @@ -65,7 +53,8 @@ struct ClearToken { to avoid. */ -static BOOL afs_settoken(char *username, const struct ClearToken *ctok, +static BOOL afs_settoken(const char *username, const char *cell, + const struct ClearToken *ctok, char *v4tkt_data, int v4tkt_length) { int ret; @@ -94,13 +83,13 @@ static BOOL afs_settoken(char *username, const struct ClearToken *ctok, memcpy(p, &tmp, sizeof(uint32)); p += sizeof(uint32); - tmp = strlen(afs_cell()); + tmp = strlen(cell); if (tmp >= MAXKTCREALMLEN) { DEBUG(1, ("Realm too long\n")); return False; } - strncpy(p, afs_cell(), tmp); + strncpy(p, cell, tmp); p += tmp; *p = 0; p +=1; @@ -135,12 +124,14 @@ static BOOL afs_settoken(char *username, const struct ClearToken *ctok, For the comments "Alice" is the User to be auth'ed, and "Bob" is the AFS server. */ -BOOL afs_login(char *username) +BOOL afs_login(connection_struct *conn) { fstring ticket; char *p = ticket; uint32 len; struct afs_key key; + pstring afs_username; + char *cell; struct ClearToken ct; @@ -148,13 +139,28 @@ BOOL afs_login(char *username) des_key_schedule key_schedule; - DEBUG(10, ("Trying to log into AFS for user %s@%s\n", - username, afs_cell())); + pstrcpy(afs_username, lp_afs_username_map()); + standard_sub_conn(conn, afs_username, sizeof(afs_username)); + + cell = strchr(afs_username, '@'); + + if (cell == NULL) { + DEBUG(1, ("AFS username doesn't contain a @, " + "could not find cell\n")); + return False; + } + + *cell = '\0'; + cell += 1; + strlower_m(cell); + + DEBUG(10, ("Trying to log into AFS for user %s@%s\n", + afs_username, cell)); if (!secrets_init()) return False; - if (!secrets_fetch_afs_key(afs_cell(), &key)) { + if (!secrets_fetch_afs_key(cell, &key)) { DEBUG(5, ("Could not fetch AFS service key\n")); return False; } @@ -172,14 +178,20 @@ BOOL afs_login(char *username) p += 1; /* "Alice", the client username */ - strncpy(p, username, sizeof(ticket)-PTR_DIFF(p,ticket)-1); + strncpy(p, afs_username, sizeof(ticket)-PTR_DIFF(p,ticket)-1); p += strlen(p)+1; strncpy(p, "", sizeof(ticket)-PTR_DIFF(p,ticket)-1); p += strlen(p)+1; - strncpy(p, afs_cell(), sizeof(ticket)-PTR_DIFF(p,ticket)-1); + strncpy(p, cell, sizeof(ticket)-PTR_DIFF(p,ticket)-1); p += strlen(p)+1; - ct.ViceId = getuid(); + /* As long as we still only use the effective UID we need to set the + * token for it here as well. This involves patching AFS in two + * places. Once we start using the real uid where we have the + * setresuid function, we can use getuid() here which would be more + * correct. */ + + ct.ViceId = geteuid(); DEBUG(10, ("Creating Token for uid %d\n", ct.ViceId)); /* Alice's network layer address. At least Openafs-1.2.10 @@ -235,12 +247,12 @@ BOOL afs_login(char *username) ZERO_STRUCT(key); - return afs_settoken(username, &ct, ticket, len); + return afs_settoken(afs_username, cell, &ct, ticket, len); } #else -BOOL afs_login(char *username) +BOOL afs_login(connection_struct *conn) { return True; } diff --git a/source3/lib/util_sec.c b/source3/lib/util_sec.c index 132748ce13..1980b8bfb7 100644 --- a/source3/lib/util_sec.c +++ b/source3/lib/util_sec.c @@ -183,6 +183,10 @@ void gain_root_group_privilege(void) void set_effective_uid(uid_t uid) { #if USE_SETRESUID + /* On Systems which have this function, would it not be more + * appropriate to also set the real uid by doing + * setresuid(uid,uid,-1)? This would make patching AFS + * unnecessary. See comment in lib/afs.c. */ setresuid(-1,uid,-1); #endif diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index b370b6b049..0efa2796c3 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -126,6 +126,7 @@ typedef struct char *szPasswordServer; char *szSocketOptions; char *szRealm; + char *szAfsUsernameMap; char *szUsernameMap; char *szLogonScript; char *szLogonPath; @@ -413,6 +414,7 @@ typedef struct BOOL bUseSendfile; BOOL bProfileAcls; BOOL bMap_acl_inherit; + BOOL bAfs_Share; param_opt_struct *param_opt; char dummy[3]; /* for alignment */ @@ -533,6 +535,7 @@ static service sDefault = { False, /* bUseSendfile */ False, /* bProfileAcls */ False, /* bMap_acl_inherit */ + False, /* bAfs_Share */ NULL, /* Parametric options */ @@ -762,6 +765,7 @@ static struct parm_struct parm_table[] = { #ifdef WITH_ADS {"realm", P_USTRING, P_GLOBAL, &Globals.szRealm, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD}, #endif + {"afs username map", P_USTRING, P_GLOBAL, &Globals.szAfsUsernameMap, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD}, {"netbios name", P_USTRING, P_GLOBAL, &Globals.szNetbiosName, handle_netbios_name, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD}, {"netbios aliases", P_LIST, P_GLOBAL, &Globals.szNetbiosAliases, handle_netbios_aliases, NULL, FLAG_ADVANCED}, {"netbios scope", P_USTRING, P_GLOBAL, &Globals.szNetbiosScope, handle_netbios_scope, NULL, FLAG_ADVANCED}, @@ -890,6 +894,7 @@ static struct parm_struct parm_table[] = { {"announce version", P_STRING, P_GLOBAL, &Globals.szAnnounceVersion, NULL, NULL, FLAG_ADVANCED}, {"announce as", P_ENUM, P_GLOBAL, &Globals.announce_as, NULL, enum_announce_as, FLAG_ADVANCED}, {"map acl inherit", P_BOOL, P_LOCAL, &sDefault.bMap_acl_inherit, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, + {"afs share", P_BOOL, P_LOCAL, &sDefault.bAfs_Share, NULL, NULL, FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL}, {"max mux", P_INTEGER, P_GLOBAL, &Globals.max_mux, NULL, NULL, FLAG_ADVANCED}, {"max xmit", P_INTEGER, P_GLOBAL, &Globals.max_xmit, NULL, NULL, FLAG_ADVANCED}, @@ -1634,6 +1639,7 @@ FN_GLOBAL_STRING(lp_passwd_chat, &Globals.szPasswdChat) FN_GLOBAL_STRING(lp_passwordserver, &Globals.szPasswordServer) FN_GLOBAL_STRING(lp_name_resolve_order, &Globals.szNameResolveOrder) FN_GLOBAL_STRING(lp_realm, &Globals.szRealm) +FN_GLOBAL_STRING(lp_afs_username_map, &Globals.szAfsUsernameMap) FN_GLOBAL_STRING(lp_username_map, &Globals.szUsernameMap) FN_GLOBAL_CONST_STRING(lp_logon_script, &Globals.szLogonScript) FN_GLOBAL_CONST_STRING(lp_logon_path, &Globals.szLogonPath) @@ -1871,6 +1877,7 @@ FN_LOCAL_BOOL(lp_nt_acl_support, bNTAclSupport) FN_LOCAL_BOOL(_lp_use_sendfile, bUseSendfile) FN_LOCAL_BOOL(lp_profile_acls, bProfileAcls) FN_LOCAL_BOOL(lp_map_acl_inherit, bMap_acl_inherit) +FN_LOCAL_BOOL(lp_afs_share, bAfs_Share) FN_LOCAL_INTEGER(lp_create_mask, iCreate_mask) FN_LOCAL_INTEGER(lp_force_create_mode, iCreate_force_mode) FN_LOCAL_INTEGER(lp_security_mask, iSecurity_mask) diff --git a/source3/script/gaptab.awk b/source3/script/gaptab.awk index f9d1526361..a309089cd5 100644 --- a/source3/script/gaptab.awk +++ b/source3/script/gaptab.awk @@ -23,9 +23,9 @@ function tonum(str) function fmt(val) { if (f++ % 8 == 0) - { printf ("\n '\\x%02x',", val); } + { printf ("\n 0x%02x,", val); } else - { printf (" '\\x%02x',", val); } + { printf (" 0x%02x,", val); } } { diff --git a/source3/script/installmsg.sh b/source3/script/installmsg.sh new file mode 100644 index 0000000000..30ad404aa0 --- /dev/null +++ b/source3/script/installmsg.sh @@ -0,0 +1,23 @@ +#!/bin/sh +# first version (Sept 2003) written by Shiro Yamada +# based on the first verion (March 2002) of installdat.sh written by Herb Lewis + +MSGDIR=$1 +SRCDIR=$2/ + +echo Installing msg files in $MSGDIR + +for f in $SRCDIR/po/*.msg; do + FNAME=$MSGDIR/`basename $f` + echo $FNAME + cp $f $FNAME || echo Cannot install $FNAME. Does $USER have privileges? + chmod 0644 $FNAME +done + +cat << EOF +====================================================================== +The msg files have been installed. +====================================================================== +EOF + +exit 0 diff --git a/source3/smbd/service.c b/source3/smbd/service.c index 70126b9e7f..44d73b2ab2 100644 --- a/source3/smbd/service.c +++ b/source3/smbd/service.c @@ -644,7 +644,9 @@ static connection_struct *make_connection_snum(int snum, user_struct *vuser, } #ifdef WITH_FAKE_KASERVER - afs_login(user); + if (lp_afs_share(SNUM(conn))) { + afs_login(conn); + } #endif #if CHECK_PATH_ON_TCONX diff --git a/source3/utils/net.c b/source3/utils/net.c index e5c078da29..42966b4f83 100644 --- a/source3/utils/net.c +++ b/source3/utils/net.c @@ -476,8 +476,8 @@ static int net_afskey(int argc, const char **argv) int fd; struct afs_keyfile keyfile; - if (argc != 1) { - d_printf("usage: 'net afskey '\n"); + if (argc != 2) { + d_printf("usage: 'net afskey cell'\n"); return -1; } @@ -496,7 +496,7 @@ static int net_afskey(int argc, const char **argv) return -1; } - if (!secrets_store_afs_keyfile(afs_cell(), &keyfile)) { + if (!secrets_store_afs_keyfile(argv[1], &keyfile)) { d_printf("Could not write keyfile to secrets.tdb\n"); return -1; } -- cgit From aa8205c4b071bac3bb66c673f97a6adcf7d4096c Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 24 Sep 2003 15:43:12 +0000 Subject: syncing files from 3.0 (This used to be commit b167f0989d004ba0940196c242c782ac698d1212) --- Roadmap | 7 +- WHATSNEW.txt | 133 ++++-- docs/docbook/projdoc/passdb.xml | 947 +++++++++++++++++++++++----------------- docs/roadmap-3.html | 247 ++++++++--- 4 files changed, 843 insertions(+), 491 deletions(-) diff --git a/Roadmap b/Roadmap index 4692807eab..42c63f7809 100644 --- a/Roadmap +++ b/Roadmap @@ -9,13 +9,12 @@ release. The following development objectives for future releases are in progress: ---------------------------------------------------------------------------- -Samba-3.0.0 The Domain Integration Release +Samba-3.0.0 The Domain Integration Release. -Samba-3.0.x Refinments to the User and Group IDMAP facility and +Samba-3.0.x Improvements in Management and Migration tools, & general code stabilization work. -Samba-3.x.x Improvements in Management and Migration tools, - the introduction of further integration capabilities. +Samba-3.x.x Requirements are currently under discussion. Samba-4 Danger Will Robinson, a big code clean up with major system redesign. More will be announced as this work diff --git a/WHATSNEW.txt b/WHATSNEW.txt index 4a3c3e1d0a..69036fae3c 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -1,15 +1,10 @@ - WHATS NEW IN Samba 3.0.0 RC3 - September 8, 2003 + WHATS NEW IN Samba 3.0.0 + September 24, 2003 ============================== -This is the third release candidate snapshot of Samba 3.0.0. A release -candidate implies that the code is very close to a final release, remember -that this is still a non-production release intended for testing purposes. -Use at your own risk. - -The purpose of this release candidate is to get wider testing of the major -new pieces of code in the current Samba 3.0 development tree. -Please refer to the section on "Known Issues" for more details. +This is the first official release of Samba 3.0.0 code base. Work +on the SAMBA_3_0 CVS branch continues. Please refer to the section +on "Known Issues" for more details. Major new features: @@ -19,13 +14,13 @@ Major new features: join a ADS realm as a member server and authenticate users using LDAP/Kerberos. -2) Unicode support. Samba will now negotiate UNICODE on the wire and - internally there is now a much better infrastructure for multi-byte - and UNICODE character sets. +2) Unicode support. Samba will now negotiate UNICODE on the wire + and internally there is now a much better infrastructure for + multi-byte and UNICODE character sets. -3) New authentication system. The internal authentication system has - been almost completely rewritten. Most of the changes are internal, - but the new auth system is also very configurable. +3) New authentication system. The internal authentication system + has been almost completely rewritten. Most of the changes are + internal, but the new auth system is also very configurable. 4) New default filename mangling system. @@ -37,11 +32,11 @@ Major new features: 6) Samba now negotiates NT-style status32 codes on the wire. This improves error handling a lot. -7) Better Windows 2000/XP/2003 printing support including publishing +7) Better Windows 2000/XP/2003 printing support including publishing printer attributes in active directory. -8) New loadable module support for passdb backends and - character sets. +8) New loadable module support for passdb backends and character + sets. 9) New default dual-daemon winbindd support for better performance. @@ -59,6 +54,10 @@ Major new features: 14) Full support for client and server SMB signing to ensure compatibility with default Windows 2003 security settings. +15) Improvement of ACL mapping features based on code donated by + Andreas Grünbacher. + + Plus lots of other improvements! @@ -82,12 +81,65 @@ License. ###################################################################### -Changes since 3.0rc2 +Changes since 3.0rc4 #################### Please refer to the CVS log for the SAMBA_3_0 branch for complete details: +1) Fix bug that prevented restoring filenames of length + >100 characters. +2) Fix bug that prevented fast path code in strchr_m + from being used. +3) Make sure we store the desired access flag on incoming + SAMR rpc calls. +4) Fix smbd crash when dealing with mangled file names. +5) Ensure that the group comment field is not overwritten + if it already exists. +6) Fix bug that prevented 'net rpc join' from working + with mixed mode AD domains (bug 442). +7) Fix crash in smbd when a Samba PDC is not able to + enumerate trusted domains (bug 450). +8) Fix crash bug found by the Samba4 testsuite. +9) Fix bug that prevented smbd from returning an ACL list + if one of the SIDs could not be resolved (bug 470). +10) Remove -P option from smbclient printing scripts since it + has a different meaning in Samba 3.0 (bug 473). +11) Sync smbldap-tools with latest version +12) Cleanup some warnings produced by the Sun C compiler. +13) Several fixes for SWAT relating to international character + sets. + + +Changes since 3.0rc3 +#################### + +1) Fix incorrect error message in testparm.c regarding 'map system'. +2) Protect against core dump if ioctl for print job sends invalid + fid. +3) Fix bug in generic hash cacluation. +4) Remove references to unused 'strip dot' parameter +5) Fix CPU burn bug in multi-byte character conversion. +6) Use opt_target_workgroup instead of lp_workgroup() in vampire + code so we can override the value in smb.conf with the -w option. +7) Display an error if we can't create a posix account for the + user when running 'net rpc vampire' (bug 323). +8) Fix UTF8 conversion bugs in LDAP passdb and idmap code (bug 296). +9) Fix smbd crash when changing the machine trust account password + (bug 273). +10) Remove getpwnam() calls from init_sam_from_xxx(). This means + that %u & %g will no longer expand in the "login ..." set of + smb.conf options, but %U and %G still do. The payback is that + winbindd local accounts for users work with 'wbinfo -u' + when winbind is running on a Samba PDC. +11) Fix unitiailized timestamp where merging print_jobs and + lpq listing. +12) Fix bug in debian packaging files affecting non-i386 platforms. + + +Changes since 3.0rc2 +#################### + 1) Remove Perl module dependencies in generated RedHat 8/9 RPMS. 2) Update mount helper to take synonyms for file_mode and dir_mode (fmask and dmask). @@ -560,11 +612,12 @@ Removed Parameters (order alphabetically): * domain guest group * force unknown acl user * nt smb support - * post script + * postscript * printer driver * printer driver file * printer driver location * status + * strip dot * total print jobs * use rhosts * valid chars @@ -655,7 +708,7 @@ New Parameters (new parameters have been grouped by function): General Configuration --------------------- * preload modules - * privatedir + * private dir Modified Parameters (changes in behavior): @@ -681,24 +734,24 @@ ${lock directory}/*tdb before upgrading to Samba 3.0. Samba will upgrade databases as they are opened (if necessary), but downgrading from 3.0 to 2.2 is an unsupported path. -Name Description Backup? ----- ----------- ------- -account_policy User policy settings yes -gencache Generic caching db no -group_mapping Mapping table from Windows yes - groups/SID to unix groups -winbindd_idmap ID map table from SIDS to UNIX yes - uids/gids. -namecache Name resolution cache entries no -netsamlogon_cache Cache of NET_USER_INFO_3 structure no - returned as part of a successful - net_sam_logon request -printing/*.tdb Cached output from 'lpq no - command' created on a per print - service basis -registry Read-only samba registry skeleton no - that provides support for exporting - various db tables via the winreg RPCs +Name Description Backup? +---- ----------- ------- +account_policy User policy settings yes +gencache Generic caching db no +group_mapping Mapping table from Windows yes + groups/SID to unix groups +winbindd_idmap ID map table from SIDS to UNIX yes + uids/gids. +namecache Name resolution cache entries no +netsamlogon_cache Cache of NET_USER_INFO_3 structure no + returned as part of a successful + net_sam_logon request +printing/*.tdb Cached output from 'lpq no + command' created on a per print + service basis +registry Read-only samba registry skeleton no + that provides support for exporting + various db tables via the winreg RPCs Changes in Behavior diff --git a/docs/docbook/projdoc/passdb.xml b/docs/docbook/projdoc/passdb.xml index 75d46af33b..1e0fcc6e2b 100644 --- a/docs/docbook/projdoc/passdb.xml +++ b/docs/docbook/projdoc/passdb.xml @@ -1,9 +1,10 @@ &author.jelmer; + &author.jht; &author.jerry; &author.jeremy; - &author.jht; + &person.gd;LDAP updates Olivier (lem)Lemaire @@ -17,27 +18,27 @@ Account Information Databases -Samba 3 implements a new capability to work concurrently with multiple account backends. -The possible new combinations of password backends allows Samba 3 a degree of flexibility +Samba-3 implements a new capability to work concurrently with multiple account backends. +The possible new combinations of password backends allows Samba-3 a degree of flexibility and scalability that previously could be achieved only with MS Windows Active Directory. This chapter describes the new functionality and how to get the most out of it. -In the course of development of Samba-3, a number of requests were received to provide the +In the development of Samba-3, a number of requests were received to provide the ability to migrate MS Windows NT4 SAM accounts to Samba-3 without the need to provide -matching UNIX/Linux accounts. We called this the Non UNIX Accounts (NUA) +matching UNIX/Linux accounts. We called this the Non-UNIX Accounts (NUA) capability. The intent was that an administrator could decide to use the tdbsam -backend and by simply specifying passdb backendtdbsam_nua +backend and by simply specifying passdb backendtdbsam_nua, this would allow Samba-3 to implement a solution that did not use UNIX accounts per se. Late in the development cycle, the team doing this work hit upon some obstacles that prevents this -solution from being used. Given the delays with Samba-3 release a decision was made to NOT -deliver this functionality until a better method of recognising NT Group SIDs from NT User -SIDs could be found. This feature may thus return during the life cycle for the Samba-3 series. +solution from being used. Given the delays with the Samba-3 release, a decision was made to not +deliver this functionality until a better method of recognizing NT Group SIDs from NT User +SIDs could be found. This feature may return during the life cycle for the Samba-3 series. -Samba-3 does NOT support Non-UNIX Account (NUA) operation for user accounts. +Samba-3 does not support Non-UNIX Account (NUA) operation for user accounts. Samba-3 does support NUA operation for machine accounts. @@ -45,52 +46,58 @@ Samba-3 does support NUA operation for machine accounts. Features and Benefits -Samba-3 provides for complete backwards compatibility with Samba-2.2.x functionality +Samba-3 provides for complete backward compatibility with Samba-2.2.x functionality as follows: +SAM backendsmbpasswd +SAM backendldapsam_compat +encrypted passwords + + - Backwards Compatibility Backends + Backward Compatibility Backends - Plain Text: + Plain Text This option uses nothing but the UNIX/Linux /etc/passwd - style back end. On systems that have PAM (Pluggable Authentication Modules) - support all PAM modules are supported. The behaviour is just as it was with + style backend. On systems that have Pluggable Authentication Modules (PAM) + support, all PAM modules are supported. The behavior is just as it was with Samba-2.2.x, and the protocol limitations imposed by MS Windows clients - apply likewise. + apply likewise. Please refer to for more information + regarding the limitations of Plain Text password usage. - smbpasswd: + smbpasswd - This option allows continues use of the smbpasswd + This option allows continued use of the smbpasswd file that maintains a plain ASCII (text) layout that includes the MS Windows LanMan and NT encrypted passwords as well as a field that stores some - account information. This form of password backend does NOT store any of - the MS Windows NT/200x SAM (Security Account Manager) information needed to + account information. This form of password backend does not store any of + the MS Windows NT/200x SAM (Security Account Manager) information required to provide the extended controls that are needed for more comprehensive - interoperation with MS Windows NT4 / 200x servers. + interoperation with MS Windows NT4/200x servers. - This backend should be used only for backwards compatibility with older + This backend should be used only for backward compatibility with older versions of Samba. It may be deprecated in future releases. - ldapsam_compat (Samba-2.2 LDAP Compatibility): + ldapsam_compat (Samba-2.2 LDAP Compatibility) There is a password backend option that allows continued operation with - a existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension. + an existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension. This option is provided primarily as a migration tool, although there is - no reason to force migration at this time. Note that this tool will eventually + no reason to force migration at this time. This tool will eventually be deprecated. @@ -99,44 +106,46 @@ as follows: - - New Backends - -Samba-3 introduces the following new password backend capabilities: +Samba-3 introduces a number of new password backend capabilities. +SAM backendtdbsam +SAM backendldapsam +SAM backendmysqlsam +SAM backendxmlsam - + +New Backends - tdbsam: + tdbsam This backend provides a rich database backend for local servers. This - backend is NOT suitable for multiple domain controller (ie: PDC + one + backend is not suitable for multiple Domain Controllers (i.e., PDC + one or more BDC) installations. The tdbsam password backend stores the old - smbpasswd information PLUS the extended MS Windows NT / 200x + smbpasswd information plus the extended MS Windows NT / 200x SAM information into a binary format TDB (trivial database) file. The inclusion of the extended information makes it possible for Samba-3 to implement the same account and system access controls that are possible - with MS Windows NT4 and MS Windows 200x based systems. + with MS Windows NT4/200x-based systems. The inclusion of the tdbsam capability is a direct response to user requests to allow simple site operation without the overhead of the complexities of running OpenLDAP. It is recommended to use this only - for sites that have fewer than 250 users. For larger sites or implementations + for sites that have fewer than 250 users. For larger sites or implementations, the use of OpenLDAP or of Active Directory integration is strongly recommended. - ldapsam: + ldapsam This provides a rich directory backend for distributed account installation. @@ -144,41 +153,42 @@ Samba-3 introduces the following new password backend capabilities: Samba-3 has a new and extended LDAP implementation that requires configuration - of OpenLDAP with a new format samba schema. The new format schema file is + of OpenLDAP with a new format Samba schema. The new format schema file is included in the examples/LDAP directory of the Samba distribution. The new LDAP implementation significantly expands the control abilities that were possible with prior versions of Samba. It is now possible to specify - "per user" profile settings, home directories, account access controls, and - much more. Corporate sites will see that the Samba-Team has listened to their + per user profile settings, home directories, account access controls, and + much more. Corporate sites will see that the Samba Team has listened to their requests both for capability and to allow greater scalability. - mysqlsam (MySQL based backend): + mysqlsam (MySQL based backend) - It is expected that the MySQL based SAM will be very popular in some corners. - This database backend will be on considerable interest to sites that want to + It is expected that the MySQL-based SAM will be very popular in some corners. + This database backend will be of considerable interest to sites that want to leverage existing MySQL technology. - xmlsam (XML based datafile): + xmlsam (XML based datafile) +pdbedit Allows the account and password data to be stored in an XML format - data file. This backend can not be used for normal operation, it can only + data file. This backend cannot be used for normal operation, it can only be used in conjunction with pdbedit's pdb2pdb functionality. The DTD that is used might be subject to changes in the future. - The xmlsam option can be useful for account migration between database + The xmlsam option can be useful for account migration between database backends or backups. Use of this tool will allow the data to be edited before migration into another backend format. @@ -191,89 +201,93 @@ Samba-3 introduces the following new password backend capabilities: - + Technical Information - Old windows clients send plain text passwords over the wire. Samba can check these - passwords by crypting them and comparing them to the hash stored in the unix user database. + Old Windows clients send plain text passwords over the wire. Samba can check these + passwords by encrypting them and comparing them to the hash stored in the UNIX user database. - + - Newer windows clients send encrypted passwords (so-called Lanman and NT hashes) over +encrypted passwords + Newer Windows clients send encrypted passwords (so-called Lanman and NT hashes) over the wire, instead of plain text passwords. The newest clients will send only encrypted passwords and refuse to send plain text passwords, unless their registry is tweaked. - These passwords can't be converted to unix style encrypted passwords. Because of that, - you can't use the standard unix user database, and you have to store the Lanman and NT + These passwords can't be converted to UNIX-style encrypted passwords. Because of that, + you can't use the standard UNIX user database, and you have to store the Lanman and NT hashes somewhere else. - In addition to differently encrypted passwords, windows also stores certain data for each - user that is not stored in a unix user database. e.g: workstations the user may logon from, - the location where the users' profile is stored, and so on. Samba retrieves and stores this - information using a passdb backend. Commonly available backends are LDAP, plain text - file, MySQL and nisplus. For more information, see the man page for &smb.conf; regarding the + In addition to differently encrypted passwords, Windows also stores certain data for each + user that is not stored in a UNIX user database. For example, workstations the user may logon from, + the location where the user's profile is stored, and so on. Samba retrieves and stores this + information using a passdb backend. Commonly available backends are LDAP, plain text + file, and MySQL. For more information, see the man page for &smb.conf; regarding the passdb backend parameter. -
    IDMAP - - - - -
    + IDMAP: Resolution of SIDs to UIDs.idmap-sid2uid + + +SID + The resolution of SIDs to UIDs is fundamental to correct operation of Samba. In both cases shown, if winbindd is not running, or cannot + be contacted, then only local SID/UID resolution is possible. See and + . + + + IDMAP: Resolution of UIDs to SIDs.idmap-uid2sid Important Notes About Security - The unix and SMB password encryption techniques seem similar on the surface. This - similarity is, however, only skin deep. The unix scheme typically sends clear text + The UNIX and SMB password encryption techniques seem similar on the surface. This + similarity is, however, only skin deep. The UNIX scheme typically sends cleartext passwords over the network when logging in. This is bad. The SMB encryption scheme never sends the cleartext password over the network but it does store the 16 byte hashed values on disk. This is also bad. Why? Because the 16 byte hashed values - are a "password equivalent". You cannot derive the user's password from them, but + are a password equivalent. You cannot derive the user's password from them, but they could potentially be used in a modified client to gain access to a server. This would require considerable technical knowledge on behalf of the attacker but - is perfectly possible. You should thus treat the data stored in whatever passdb - backend you use (smbpasswd file, ldap, mysql) as though it contained the cleartext - passwords of all your users. Its contents must be kept secret, and the file should + is perfectly possible. You should thus treat the datastored in whatever passdb + backend you use (smbpasswd file, LDAP, MYSQL) as though it contained the cleartext + passwords of all your users. Its contents must be kept secret and the file should be protected accordingly. - Ideally we would like a password scheme that involves neither plain text passwords - on the net nor on disk. Unfortunately this is not available as Samba is stuck with - having to be compatible with other SMB systems (WinNT, WfWg, Win95 etc). + Ideally, we would like a password scheme that involves neither plain text passwords + on the network nor on disk. Unfortunately, this is not available as Samba is stuck with + having to be compatible with other SMB systems (Windows NT, Windows for Workgroups, Windows 9x/Me). - Windows NT 4.0 Service pack 3 changed the default setting so that plaintext passwords + Windows NT 4.0 Service Pack 3 changed the default setting so plaintext passwords are disabled from being sent over the wire. This mandates either the use of encrypted - password support or edit the Windows NT registry to re-enable plaintext passwords. + password support or editing the Windows NT registry to re-enable plaintext passwords. - The following versions of MS Windows do not support full domain security protocols, + The following versions of Microsoft Windows do not support full domain security protocols, although they may log onto a domain environment: - MS DOS Network client 3.0 with the basic network redirector installed - Windows 95 with the network redirector update installed - Windows 98 [se] - Windows Me + MS DOS Network client 3.0 with the basic network redirector installed. + Windows 95 with the network redirector update installed. + Windows 98 [Second Edition]. + Windows Me. - MS Windows XP Home does not have facilities to become a domain member and it can - not participate in domain logons. + MS Windows XP Home does not have facilities to become a Domain Member and it cannot participate in domain logons. @@ -282,44 +296,44 @@ Samba-3 introduces the following new password backend capabilities: - Windows NT 3.5x - Windows NT 4.0 - Windows 2000 Professional - Windows 200x Server/Advanced Server - Windows XP Professional + Windows NT 3.5x. + Windows NT 4.0. + Windows 2000 Professional. + Windows 200x Server/Advanced Server. + Windows XP Professional. - All current release of Microsoft SMB/CIFS clients support authentication via the - SMB Challenge/Response mechanism described here. Enabling clear text authentication + All current releases of Microsoft SMB/CIFS clients support authentication via the + SMB Challenge/Response mechanism described here. Enabling cleartext authentication does not disable the ability of the client to participate in encrypted authentication. - Instead, it allows the client to negotiate either plain text _or_ encrypted password + Instead, it allows the client to negotiate either plain text or encrypted password handling. MS Windows clients will cache the encrypted password alone. Where plain text passwords - are re-enabled, through the appropriate registry change, the plain text password is NEVER + are re-enabled through the appropriate registry change, the plain text password is never cached. This means that in the event that a network connections should become disconnected - (broken) only the cached (encrypted) password will be sent to the resource server to - affect a auto-reconnect. If the resource server does not support encrypted passwords the - auto-reconnect will fail. USE OF ENCRYPTED PASSWORDS IS STRONGLY ADVISED. + (broken), only the cached (encrypted) password will be sent to the resource server to + effect an auto-reconnect. If the resource server does not support encrypted passwords the + auto-reconnect will fail. Use of encrypted passwords is strongly advised. Advantages of Encrypted Passwords - Plain text passwords are not passed across + Plaintext passwords are not passed across the network. Someone using a network sniffer cannot just record passwords going to the SMB server. - Plain text passwords are not stored anywhere in + Plaintext passwords are not stored anywhere in memory or on disk. - WinNT doesn't like talking to a server + Windows NT does not like talking to a server that does not support encrypted passwords. It will refuse - to browse the server if the server is also in user level + to browse the server if the server is also in User Level security mode. It will insist on prompting the user for the password on each connection, which is very annoying. The only things you can do to stop this is to use SMB encryption. @@ -335,18 +349,18 @@ Samba-3 introduces the following new password backend capabilities: - Advantages of non-encrypted passwords + Advantages of Non-Encrypted Passwords - Plain text passwords are not kept - on disk, and are NOT cached in memory. + Plaintext passwords are not kept + on disk, and are not cached in memory. - Uses same password file as other unix - services such as login and ftp + Uses same password file as other UNIX + services such as Login and FTP. - Use of other services (such as telnet and ftp) which - send plain text passwords over the net, so sending them for SMB - isn't such a big deal. + Use of other services (such as Telnet and FTP) that + send plain text passwords over the network, so sending them for SMB + is not such a big deal. @@ -356,12 +370,12 @@ Samba-3 introduces the following new password backend capabilities: Every operation in UNIX/Linux requires a user identifier (UID), just as in - MS Windows NT4 / 200x this requires a Security Identifier (SID). Samba provides + MS Windows NT4/200x this requires a Security Identifier (SID). Samba provides two means for mapping an MS Windows user to a UNIX/Linux UID. - Firstly, all Samba SAM (Security Account Manager database) accounts require + First, all Samba SAM (Security Account Manager database) accounts require a UNIX/Linux UID that the account will map to. As users are added to the account information database, Samba will call the add user script interface to add the account to the Samba host OS. In essence all accounts in @@ -369,8 +383,8 @@ Samba-3 introduces the following new password backend capabilities: - The second way to affect Windows SID to UNIX UID mapping is via the - idmap uid, idmap gid parameters in &smb.conf;. + The second way to effect Windows SID to UNIX UID mapping is via the + idmap uid and idmap gid parameters in &smb.conf;. Please refer to the man page for information about these parameters. These parameters are essential when mapping users from a remote SAM server. @@ -383,24 +397,62 @@ Samba-3 introduces the following new password backend capabilities: Samba-3 has a special facility that makes it possible to maintain identical UIDs and GIDs on all servers in a distributed network. A distributed network is one where there exists - a PDC, one or more BDCs and/or one or more domain member servers. Why is this important? - This is important if files are being shared over more than one protocol (eg: NFS) and where + a PDC, one or more BDCs and/or one or more Domain Member servers. Why is this important? + This is important if files are being shared over more than one protocol (e.g., NFS) and where users are copying files across UNIX/Linux systems using tools such as rsync. The special facility is enabled using a parameter called idmap backend. - The default setting for this parameter is an empty string. Administrators should NOT set this - parameter except when an LDAP based passdb backend is in use. An example of use is: + The default setting for this parameter is an empty string. Technically it is possible to use + an LDAP based idmap backend for UIDs and GIDs, but it makes most sense when this is done for + network configurations that also use LDAP for the SAM backend. A sample use is shown in + . +SAM backendldapsam +Example configuration with the LDAP idmap backend +SAM backendxmlsam [global] -idmap backendldapsam://ldap-server.quenya.org:636 +idmap backendldapsam:ldap://ldap-server.quenya.org:636 +Alternately, this could be specified as: +idmap backendldapsam:ldaps://ldap-server.quenya.org + + A network administrator who wants to make significant use of LDAP backends will sooner or later be + exposed to the excellent work done by PADL Software. PADL have + produced and released to open source an array of tools that might be of interest. These tools include: + + + + + + nss_ldap: An LDAP Name Service Switch module to provide native + name service support for AIX, Linux, Solaris, and other operating systems. This tool + can be used for centralized storage and retrieval of UIDs/GIDs. + + + + + + pam_ldap: A PAM module that provides LDAP integration for UNIX/Linux + system access authentication. + + + + + idmap_ad: An IDMAP backend that supports the Microsoft Services for + UNIX RFC 2307 schema available from their web + site. + + + + +     @@ -408,25 +460,25 @@ Samba-3 introduces the following new password backend capabilities: Account Management Tools -Samba provides two (2) tools for management of User and machine accounts. These tools are +pdbedit +Samba provides two tools for management of user and machine accounts. These tools are called smbpasswd and pdbedit. A third tool is under -development but is NOT expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK -GUI tool that looks much like the MS Windows NT4 Domain User Manager - hopefully this will +development but is not expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK +GUI tool that looks much like the MS Windows NT4 Domain User Manager. Hopefully this will be announced in time for the Samba-3.0.1 release. The <emphasis>smbpasswd</emphasis> Command - The smbpasswd utility is a utility similar to the passwd - or yppasswd programs. It maintains the two 32 byte password + The smbpasswd utility is similar to the passwd + or yppasswd programs. It maintains the two 32 byte password fields in the passdb backend. smbpasswd works in a client-server mode where it contacts the - local smbd to change the user's password on its behalf. This has enormous benefits - as follows: + local smbd to change the user's password on its behalf. This has enormous benefits. @@ -437,15 +489,18 @@ be announced in time for the Samba-3.0.1 release. smbpasswd can be used to: - +User Management +User AccountsAdding/Deleting + + - add user or machine accounts - delete user or machine accounts - enable user or machine accounts - disable user or machine accounts - set to NULL user passwords - manage interdomain trust accounts + add user or machine accounts. + delete user or machine accounts. + enable user or machine accounts. + disable user or machine accounts. + set to NULL user passwords. + manage interdomain trust accounts. @@ -457,8 +512,8 @@ be announced in time for the Samba-3.0.1 release. &prompt;smbpasswd Old SMB password: secret - For secret type old value here - or hit return if - there was no old password + For secret, type old value here or press return if + there is no old password. New SMB Password: new secret Repeat New SMB Password: new secret @@ -471,13 +526,13 @@ be announced in time for the Samba-3.0.1 release. - When invoked by an ordinary user it will only allow change of their own + When invoked by an ordinary user, the command will only allow the user to change his or her own SMB password. - When run by root smbpasswd may take an optional argument, specifying - the user name whose SMB password you wish to change. When run as root, smbpasswd + When run by root, smbpasswd may take an optional argument specifying + the user name whose SMB password you wish to change. When run as root, smbpasswd does not prompt for or check the old password value, thus allowing root to set passwords for users who have forgotten their passwords. @@ -485,37 +540,43 @@ be announced in time for the Samba-3.0.1 release. smbpasswd is designed to work in the way familiar to UNIX users who use the passwd or yppasswd commands. - While designed for administrative use, this tool provides essential user level + While designed for administrative use, this tool provides essential User Level password change capabilities. - For more details on using smbpasswd refer to the man page (the + For more details on using smbpasswd, refer to the man page (the definitive reference). - + The <emphasis>pdbedit</emphasis> Command +pdbedit pdbedit is a tool that can be used only by root. It is used to manage the passdb backend. pdbedit can be used to: +User Management +User AccountsAdding/Deleting + - add, remove or modify user accounts - listing user accounts - migrate user accounts + add, remove or modify user accounts. + list user accounts. + migrate user accounts. +pdbedit The pdbedit tool is the only one that can manage the account security and policy settings. It is capable of all operations that smbpasswd can do as well as a super set of them. +pdbedit One particularly important purpose of the pdbedit is to allow the migration of account information from one passdb backend to another. See the XML password backend section of this chapter. @@ -551,6 +612,7 @@ Password must change: Mon, 18 Jan 2038 20:14:07 GMT +pdbedit The pdbedit tool allows migration of authentication (account) databases from one backend to another. For example: To migrate accounts from an old smbpasswd database to a tdbsam @@ -594,43 +656,45 @@ backends of the same type. For example, to use two different tdbsam databases: -passdb backendtdbsam:/etc/samba/passdb.tdb, tdbsam:/etc/samba/old-passdb.tdb + passdb backendtdbsam:/etc/samba/passdb.tdb \ + tdbsam:/etc/samba/old-passdb.tdb - Plain Text + Plaintext - Older versions of Samba retrieved user information from the unix user database + Older versions of Samba retrieved user information from the UNIX user database and eventually some other fields from the file /etc/samba/smbpasswd or /etc/smbpasswd. When password encryption is disabled, no SMB specific data is stored at all. Instead all operations are conducted via the way that the Samba host OS will access its /etc/passwd database. - eg: On Linux systems that is done via PAM. + Linux systems For example, all operations are done via PAM. - smbpasswd - Encrypted Password Database + smbpasswd &smbmdash; Encrypted Password Database +SAM backendsmbpasswd Traditionally, when configuring encrypt passwordsyes in Samba's &smb.conf; file, user account information such as username, LM/NT password hashes, password change times, and account - flags have been stored in the smbpasswd(5) file. There are several - disadvantages to this approach for sites with very large numbers of users (counted + flags have been stored in the smbpasswd(5) file. There are several + disadvantages to this approach for sites with large numbers of users (counted in the thousands). - The first is that all lookups must be performed sequentially. Given that + The first problem is that all lookups must be performed sequentially. Given that there are approximately two lookups per domain logon (one for a normal session connection such as when mapping a network drive or printer), this - is a performance bottleneck for large sites. What is needed is an indexed approach - such as is used in databases. + is a performance bottleneck for large sites. What is needed is an indexed approach + such as used in databases. @@ -641,7 +705,7 @@ backends of the same type. For example, to use two different tdbsam databases: - And finally, the amount of information which is stored in an smbpasswd entry leaves + Finally, the amount of information that is stored in an smbpasswd entry leaves no room for additional attributes such as a home directory, password expiration time, or even a Relative Identifier (RID). @@ -649,15 +713,15 @@ backends of the same type. For example, to use two different tdbsam databases: As a result of these deficiencies, a more robust means of storing user attributes - used by smbd was developed. The API which defines access to user accounts + used by smbd was developed. The API which defines access to user accounts is commonly referred to as the samdb interface (previously this was called the passdb API, and is still so named in the Samba CVS trees). Samba provides an enhanced set of passdb backends that overcome the deficiencies - of the smbpasswd plain text database. These are tdbsam, ldapsam, and xmlsam. - Of these ldapsam will be of most interest to large corporate or enterprise sites. + of the smbpasswd plain text database. These are tdbsam, ldapsam and xmlsam. + Of these, ldapsam will be of most interest to large corporate or enterprise sites. @@ -665,26 +729,36 @@ backends of the same type. For example, to use two different tdbsam databases: tdbsam - Samba can store user and machine account data in a "TDB" (Trivial Database). - Using this backend doesn't require any additional configuration. This backend is + +SAM backendtdbsam + Samba can store user and machine account data in a TDB (Trivial Database). + Using this backend does not require any additional configuration. This backend is recommended for new installations that do not require LDAP. - As a general guide the Samba-Team does NOT recommend using the tdbsam backend for sites + As a general guide, the Samba Team does not recommend using the tdbsam backend for sites that have 250 or more users. Additionally, tdbsam is not capable of scaling for use - in sites that require PDB/BDC implementations that requires replication of the account + in sites that require PDB/BDC implementations that require replication of the account database. Clearly, for reason of scalability, the use of ldapsam should be encouraged. + + The recommendation of a 250 user limit is purely based on the notion that this + would generally involve a site that has routed networks, possibly spread across + more than one physical location. The Samba Team has not at this time established + the performance based scalability limits of the tdbsam architecture. + + ldapsam +SAM backendldapsam There are a few points to stress that the ldapsam does not provide. The LDAP - support referred to in the this documentation does not include: + support referred to in this documentation does not include: @@ -694,32 +768,29 @@ backends of the same type. For example, to use two different tdbsam databases: - The second item can be accomplished by using LDAP NSS and PAM modules. LGPL - versions of these libraries can be obtained from PADL Software - (http://www.padl.com/). More - information about the configuration of these packages may be found at "LDAP, - System Administration; Gerald Carter, O'Reilly; Chapter 6: Replacing NIS". - Refer to - http://safari.oreilly.com/?XmlId=1-56592-491-6 for those who might wish to know - more about configuration and administration of an OpenLDAP server. + The second item can be accomplished by using LDAP NSS and PAM modules. LGPL + versions of these libraries can be obtained from + PADL Software. + More information about the configuration of these packages may be found at + + LDAP, System Administration; Gerald Carter by O'Reilly; Chapter 6: Replacing NIS." This document describes how to use an LDAP directory for storing Samba user - account information traditionally stored in the smbpasswd(5) file. It is + account information traditionally stored in the smbpasswd(5) file. It is assumed that the reader already has a basic understanding of LDAP concepts - and has a working directory server already installed. For more information - on LDAP architectures and Directories, please refer to the following sites. + and has a working directory server already installed. For more information + on LDAP architectures and directories, please refer to the following sites: - OpenLDAP - http://www.openldap.org/ - iPlanet Directory Server - - http://iplanet.netscape.com/directory + OpenLDAP + Sun iPlanet Directory Server - Two additional Samba resources which may prove to be helpful are + Two additional Samba resources which may prove to be helpful are: @@ -736,9 +807,9 @@ backends of the same type. For example, to use two different tdbsam databases: The LDAP ldapsam code has been developed and tested using the OpenLDAP 2.0 and 2.1 server and - client libraries. The same code should work with Netscape's Directory Server and client SDK. + client libraries. The same code should work with Netscape's Directory Server and client SDK. However, there are bound to be compile errors and bugs. These should not be hard to fix. - Please submit fixes via Bug reporting facility. + Please submit fixes via the process outlined in . @@ -748,14 +819,14 @@ backends of the same type. For example, to use two different tdbsam databases: - Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in - examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: + Samba-3.0 includes the necessary schema file for OpenLDAP 2.0 in + examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: -objectclass ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY - DESC 'Samba 3.0 Auxiliary SAM Account' +objectclass (1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY + DESC 'Samba-3.0 Auxiliary SAM Account' MUST ( uid $ sambaSID ) MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $ @@ -768,19 +839,19 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY The samba.schema file has been formatted for OpenLDAP 2.0/2.1. - The OID's are owned by the Samba Team and as such is legal to be openly published. - If you translate the schema to be used with Netscape DS, please - submit the modified schema file as a patch to - jerry@samba.org. + The Samba Team owns the OID space used by the above schema and recommends its use. + If you translate the schema to be used with Netscape DS, please submit the modified + schema file as a patch to jerry@samba.org. - Just as the smbpasswd file is meant to store information which supplements a + Just as the smbpasswd file is meant to store information that provides information additional to a user's /etc/passwd entry, so is the sambaSamAccount object - meant to supplement the UNIX user account information. A sambaSamAccount is a - STRUCTURAL objectclass so it can be stored individually - in the directory. However, there are several fields (e.g. uid) which overlap - with the posixAccount objectclass outlined in RFC2307. This is by design. + meant to supplement the UNIX user account information. A sambaSamAccount is a + AUXILIARY objectclass so it can be used to augment existing + user account information in the LDAP directory, thus providing information needed + for Samba account handling. However, there are several fields (e.g., uid) that overlap + with the posixAccount objectclass outlined in RFC2307. This is by design. + + + +SAMBA - opening windows to a wider world + + + + + + + + + + + + + + + + + + + + - + @@ -79,7 +184,7 @@ for a stable 3.0 release. - + @@ -87,7 +192,7 @@ for a stable 3.0 release. - + @@ -102,16 +207,16 @@ for a stable 3.0 release. - - + + - - + + @@ -119,48 +224,52 @@ for a stable 3.0 release. 4.0 PDC to a Samba PDC - - + + - - + + - - + + - + - - + + - + - - - + + + - + + - + + + + @@ -171,9 +280,10 @@ for a stable 3.0 release. - + + @@ -185,19 +295,34 @@ for a stable 3.0 release. - - - + + + - - - + + + + + + + + + + + + + + + + + +
    + + + samba + + +

    + =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= +


    +

    Roadmap to 3.0

    -

    Page Last Updated : 5 Mar, 2003 -

    Estimated shipdate : When it is ready. -

    Current Alpha Release : Samba-3.0alpha22 +

    Page Last Updated : 12th Sep, 2003 +

    Current Beta Release : Samba-3.0.0rc4

    Road to 3.0

      -
    • (5th Mar, 2003) Samba-3.0alpha22 RPMS for Redhat 6.x, 7.x and 8.0 available -

      Binary packages for RedHat Linux 6.x, 7.x and 8.0 systems of the Samba 3.0alpha22 - release are ready for download from the - Binary_Packages/RedHat directory. +

    • (12th Sep, 2003) The fourth release candidate of Samba 3.0.0 is available for download +

      Samba-3.0.0rc4 is now available in source form from samba.org. See the + Release Notes for more details. +

      • +
    +
      +
    • (8th Sep, 2003) The third release candidate of Samba 3.0.0 is available for download +

      Samba-3.0.0rc3 is now available in source form from samba.org. See the + Release Notes for more details. +

      • +
    +
      +
    • (29th Aug, 2003) The second release candidate of Samba 3.0.0 is available for download +

      Samba-3.0.0rc2 is now available in source form from samba.org. See the + Release Notes for more details. +

      • +
    +
      +
    • (16th Aug, 2003) The first release candidate of Samba 3.0.0 is available for download +

      Samba-3.0.0rc1 is now available in source form from samba.org. See the + Release Notes for more details. +

      • +
    +
      +
    • (16th Jul, 2003) The third beta release of Samba 3.0.0 is available for download +

      Samba-3.0.0beta3 is now available in source form from samba.org. See the + Release Notes for more details. This + could be the last beta release before moving onto 3.0.0 release candidates. +

      • +
    +
      +
    • (1st Jul, 2003) The second beta release of Samba 3.0.0 is available for download +

      Samba-3.0.0beta2 is now available in source form from samba.org. See the + Release Notes for more details. +

      • +
    +
      +
    • (7th Jun, 2003) The first beta release of Samba 3.0.0 is available for download +

      Samba-3.0.0beta1 is now available in source form from samba.org. See the + Release Notes for more details. +

      • +
    +
      +
    • (14th May, 2003) The Feature Freeze is in place with the 3.0alpha24 release +

      The 3.0alpha24 release is provided to aid developers in testing Samba + in preparation for the first beta release of 3.0 tenatively planned for May 26. + Refer to the main page on samba.org + for download locations.

      -
    • (26th Nov, 2002) Samba-3.0alpha21 RPMS for Redhat 7.x and 8.0 available -

      Binary packages for RedHat Linux 7.x and 8.0 systems of the Samba 3.0alpha21 - release are ready for download from the - Binary_Packages/RedHat directory. +

    • (5th May, 2003) Feature Freeze and Samba 3.0 beta release dates +

      The Samba Team has agreed to push the feature freeze for Samba 3.0 + development to May 12, 2003. Following this will be two weeks of testing + with the first planned beta release of Samba 3.0 on May 26. Following + the open-ended beta period will be preview (preX) releases, followed by + release candidate builds (rcX) and finally 3.0.0. There is no estimated + shipping date on the initial stable 3.0.0 release. +

      Here is the mail + sent to samba-technical describing the reasons for the delay.

    +
      -
    • (26th Sept, 2002) SAMBA_3_0 cvs branch -

      With the release of 3.0alpha20, the SAMBA_3_0 cvs branch is now being - officially maintained in an effort to stabilize certain features. If you would - like to continue to test the soon-to-be-3.0 code base, please use this branch - tag when checking out the cvs tree. +

    • (31st Mar, 2003) Samba-3.0alpha23 RPMS for Redhat 6.x, 7.x and 8.0 available +

      Binary packages for RedHat Linux 6.x, 7.x and 8.0 systems of the Samba 3.0alpha23 + release are ready for download from the + Binary_Packages/RedHat directory. +

    +

    Roadmap Overview

    This is a feature list/roadmap for the 3.0 release. A lot of discussion has gone on about this. Implementation is a separate discussion :-) If a feature is already done, I marked it as "Req". It should be obvious from this roadmap that one the major hurdles for releasing the 3.0 code base -is the completion of documentation updates. +is the completion of documentation updates.

    • X = done @@ -71,7 +176,7 @@ for a stable 3.0 release.
    		yes X XoX
    yes X XoX
    yes X XoX
    Windows NT 4.0 Style Trust Relationship yes XooXX
    NTLMv2 yes XooXX
    yes XooXX
    Winbind working with Samba PDC yes XooXX
    Loadable RPC implementations yes XooXX
    hook for utilizing a centralized winbindd id map databaseUtilizing a centralized winbindd id map database yesooXX o
    Group Mapping support(privileges need some work, etc...)Mapping between Windows and UNIX groups yesoooXXX
    Publishing printers in AD (probably will make 3.0 but will not delay release)Publishing printers in AD yes XX oo
     
    Stackable VFS no XoX X
    SAM replication (full implementation still lacks some decoding work; post 3.0) no
    SMB signing (needs more research; not a show stopper) no---XXX
    schannel, ntlmv2 sign & seal (needs more research) noin-progress--XXX
    alternative backend for WINS database (there is a patch that still needs some work)noin-progress--
    Group policy objects, profiles, and SYSVOL replication protocolsnoin-progress--
    @@ -207,9 +332,33 @@ Plus the following interesting, but non-show stopping projects
    • background updates of print queues via a dedicated process
    • WINS replication with Windows NT WINS servers -
    • alternative backend for WINS database (there is a patch that still needs some work)
    - +

    Chapter 36. How to compile Samba

    Jelmer R. Vernooij

    The Samba Team

    Andrew Tridgell

    Samba Team

    22 May 2001

    18 March 2003

    Table of Contents

    Access Samba source code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the samba sources via rsync and ftp
    Verifying Samba's PGP signature
    Building the Binaries
    Compiling samba with Active Directory support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: starting it as a daemon

    -You can obtain the samba source from the -samba website. To obtain a development version, -you can download samba from CVS or using rsync. -

    Access Samba source code via CVS

    Introduction

    -Samba is developed in an open environment. Developers use CVS -(Concurrent Versioning System) to "checkin" (also known as -"commit") new source code. Samba's various CVS branches can +Chapter 36. How to Compile Samba

    Chapter 36. How to Compile Samba
    Prev Part VI. Appendixes Next

    Chapter 36. How to Compile Samba

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Andrew Tridgell

    Samba Team

    22 May 2001

    18 March 2003

    Table of Contents

    Access Samba Source Code via CVS
    Introduction
    CVS Access to samba.org
    Accessing the Samba Sources via rsync and ftp
    Verifying Samba's PGP Signature
    Building the Binaries
    Compiling Samba with Active Directory Support
    Starting the smbd and nmbd
    Starting from inetd.conf
    Alternative: Starting smbd as a Daemon

    +You can obtain the Samba source from the +Samba Website. To obtain a development version, +you can download Samba from CVS or using rsync. +

    Access Samba Source Code via CVS

    Introduction

    + +Samba is developed in an open environment. Developers use +Concurrent Versioning System (CVS) to “checkin” (also known as +“commit”) new source code. Samba's various CVS branches can be accessed via anonymous CVS using the instructions detailed in this chapter.

    This chapter is a modified version of the instructions found at -http://samba.org/samba/cvs.html -

    CVS Access to samba.org

    +http://samba.org/samba/cvs.html +

    CVS Access to samba.org

    The machine samba.org runs a publicly accessible CVS repository for access to the source code of several packages, -including samba, rsync, distcc, ccache and jitterbug. There are two main ways -of accessing the CVS server on this host. -

    Access via CVSweb

    -You can access the source code via your -favourite WWW browser. This allows you to access the contents of -individual files in the repository and also to look at the revision +including Samba, rsync, distcc, ccache, and jitterbug. There are two main ways +of accessing the CVS server on this host: +

    Access via CVSweb

    + +You can access the source code via your favorite WWW browser. This allows you to access +the contents of individual files in the repository and also to look at the revision history and commit logs of individual files. You can also ask for a diff listing between any two versions on the repository.

    -Use the URL : http://samba.org/cgi-bin/cvsweb -

    Access via cvs

    +Use the URL: +http://samba.org/cgi-bin/CVSweb +

    Access via CVS

    You can also access the source code via a -normal cvs client. This gives you much more control over what you can +normal CVS client. This gives you much more control over what you can do with the repository and allows you to checkout whole source trees -and keep them up to date via normal cvs commands. This is the +and keep them up-to-date via normal CVS commands. This is the preferred method of access if you are a developer and not just a casual browser.

    -To download the latest cvs source code, point your +To download the latest CVS source code, point your browser at the URL : -http://www.cyclic.com/. -and click on the 'How to get cvs' link. CVS is free software under -the GNU GPL (as is Samba). Note that there are several graphical CVS clients -which provide a graphical interface to the sometimes mundane CVS commands. -Links to theses clients are also available from the Cyclic website. +http://www.cyclic.com/. +and click on the “How to get CVS” link. CVS is free software under +the GNU GPL (as is Samba). Note that there are several graphical CVS clients +that provide a graphical interface to the sometimes mundane CVS commands. +Links to theses clients are also available from the Cyclic Web site.

    -To gain access via anonymous cvs use the following steps. +To gain access via anonymous CVS, use the following steps. For this example it is assumed that you want a copy of the -samba source code. For the other source code repositories -on this system just substitute the correct package name -

    Procedure 36.1. Retrieving samba using CVS

    1. - Install a recent copy of cvs. All you really need is a - copy of the cvs client binary. +Samba source code. For the other source code repositories +on this system just substitute the correct package name. +

      Procedure 36.1. Retrieving Samba using CVS

      1. + Install a recent copy of CVS. All you really need is a + copy of the CVS client binary.

      2. - Run the command + Run the command:

        cvs -d :pserver:cvs@samba.org:/cvsroot login

      3. - When it asks you for a password type cvs. + When it asks you for a password, type cvs.

      4. Run the command

        - cvs -d :pserver:cvs@samba.org:/cvsroot co samba + cvs -d :pserver:CVS@samba.org:/cvsroot co samba.

        - This will create a directory called samba containing the - latest samba source code (i.e. the HEAD tagged cvs branch). This + This will create a directory called samba containing the + latest Samba source code (i.e., the HEAD tagged CVS branch). This currently corresponds to the 3.0 development tree.

        CVS branches other then HEAD can be obtained by using the - -r and defining a tag name. A list of branch tag names - can be found on the "Development" page of the samba web site. A common - request is to obtain the latest 3.0 release code. This could be done by + -r and defining a tag name. A list of branch tag names + can be found on the “Development” page of the Samba Web site. A common + request is to obtain the latest 3.0 release code. This could be done by using the following command:

        - cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_3_0 samba + cvs -d :pserver:cvs@samba.org:/cvsroot co -r SAMBA_3_0 samba.

      5. - Whenever you want to merge in the latest code changes use - the following command from within the samba directory: + Whenever you want to merge in the latest code changes, use + the following command from within the Samba directory:

        cvs update -d -P -

    Accessing the samba sources via rsync and ftp

    - pserver.samba.org also exports unpacked copies of most parts of the CVS - tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at - rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. - See the rsync homepage for more info on rsync. +

    Accessing the Samba Sources via rsync and ftp

    + + + pserver.samba.org also exports unpacked copies of most parts of the CVS + tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at + rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. + See the rsync homepage for more info on rsync.

    The disadvantage of the unpacked trees is that they do not support automatic - merging of local changes like CVS does. rsync access is most convenient - for an initial install. -

    Verifying Samba's PGP signature

    -In these days of insecurity, it's strongly recommended that you verify the PGP -signature for any source file before installing it. Even if you're not -downloading from a mirror site, verifying PGP signatures should be a -standard reflex. + merging of local changes like CVS does. rsync access is most convenient + for an initial install. +

    Verifying Samba's PGP Signature

    + +It is strongly recommended that you verify the PGP signature for any source file before +installing it. Even if you're not downloading from a mirror site, verifying PGP signatures +should be a standard reflex. Many people today use the GNU GPG toolset in place of PGP. +GPG can substitute for PGP.

    With that said, go ahead and download the following files: 

     $ wget http://us1.samba.org/samba/ftp/samba-2.2.8a.tar.asc
 $ wget http://us1.samba.org/samba/ftp/samba-pubkey.asc

    - + The first file is the PGP signature for the Samba source file; the other is the Samba public PGP key itself. Import the public PGP key with: 

     $ gpg --import samba-pubkey.asc

    -And verify the Samba source code integrity with: +and verify the Samba source code integrity with: 

     $ gzip -d samba-2.2.8a.tar.gz
 $ gpg --verify samba-2.2.8a.tar.asc

    -If you receive a message like, "Good signature from Samba Distribution -Verification Key..." +If you receive a message like, “Good signature from Samba Distribution Verification Key...” then all is well. The warnings about trust relationships can be ignored. An example of what you would not want to see would be: -

    - - gpg: BAD signature from "Samba Distribution Verification Key" - -

    Building the Binaries

    - To do this, first run the program ./configure +

    +     gpg: BAD signature from “Samba Distribution Verification Key”
+

    Building the Binaries

    + + To build the binaries, first run the program ./configure in the source directory. This should automatically configure Samba for your operating system. If you have unusual - needs then you may wish to run

    root# ./configure --help
-

    first to see what special options you can enable. - Then executing

    root# make

    will create the binaries. Once it's successfully - compiled you can use 

    root# make install

    to install the binaries and manual pages. You can + needs, then you may wish to run

    root# ./configure --help
+

    first to see what special options you can enable. Now execute ./configure with any arguments it might need:

    root# ./configure [... arguments ...]

    Executing

    + + 

    root# make

    will create the binaries. Once it is successfully + compiled you can use

    root# make install

    to install the binaries and manual pages. You can separately install the binaries and/or man pages using

    root# make installbin

    and

    root# make installman
-

    Note that if you are upgrading for a previous version +

    Note that if you are upgrading from a previous version of Samba you might like to know that the old versions of - the binaries will be renamed with a ".old" extension. You + the binaries will be renamed with an “.old” extension. You can go back to the previous version with

    root# make revert
-

    if you find this version a disaster!

    Compiling samba with Active Directory support

    In order to compile samba with ADS support, you need to have installed - on your system:

    • the MIT kerberos development libraries - (either install from the sources or use a package). The - Heimdal libraries will not work.

    • the OpenLDAP development libraries.

    If your kerberos libraries are in a non-standard location then +

    if you find this version a disaster!

    Compiling Samba with Active Directory Support

    In order to compile Samba with ADS support, you need to have installed + on your system:

    • The MIT or Heimdal kerberos development libraries + (either install from the sources or use a package).

    • The OpenLDAP development libraries.

    If your kerberos libraries are in a non-standard location, then remember to add the configure option - --with-krb5=DIR.

    After you run configure make sure that - include/config.h it generates contains lines like + --with-krb5=DIR.

    After you run configure, make sure that + include/config.h it generates contain lines like this:

     #define HAVE_KRB5 1
 #define HAVE_LDAP 1
-

    If it doesn't then configure did not find your krb5 libraries or - your ldap libraries. Look in config.log to figure - out why and fix it.

    Installing the required packages for Debian

    On Debian you need to install the following packages:

    -

    • libkrb5-dev

    • krb5-user

    -

    Installing the required packages for RedHat

    On RedHat this means you should have at least:

    -

    • krb5-workstation (for kinit)

    • krb5-libs (for linking with)

    • krb5-devel (because you are compiling from source)

    -

    in addition to the standard development environment.

    Note that these are not standard on a RedHat install, and you may need - to get them off CD2.

    Starting the smbd and nmbd

    You must choose to start smbd and nmbd either +

    If it does not, configure did not find your KRB5 libraries or + your LDAP libraries. Look in config.log to figure + out why and fix it.

    Installing the Required Packages for Debian

    On Debian, you need to install the following packages:

    +

    • libkrb5-dev
    • krb5-user

    +

    Installing the Required Packages for Red Hat Linux

    On Red Hat Linux, this means you should have at least:

    +

    • krb5-workstation (for kinit)
    • krb5-libs (for linking with)
    • krb5-devel (because you are compiling from source)

    +

    in addition to the standard development environment.

    If these files are not installed on your system, you should check the installation + CDs to find which has them and install the files using your tool of choice. If in doubt + about what tool to use, refer to the Red Hat Linux documentation.

    SuSE Linux Package Requirements

    SuSE Linux installs Heimdal packages that may be required to allow you to build + binary packages. You should verify that the development libraries have been installed on + your system. +

    SuSE Linux Samba RPMs support Kerberos. Please refer to the documentation for + your SuSE Linux system for information regading SuSE Linux specific configuration. + Additionally, SuSE are very active in the maintenance of Samba packages that provide + the maximum capabilities that are available. You should consider using SuSE provided + packages where they are available. +

    Starting the smbd and nmbd

    + + You must choose to start smbd and nmbd either as daemons or from inetd. Don't try to do both! Either you can put them in inetd.conf and have them started on demand @@ -153,48 +167,54 @@ example of what you would not want to see would be: daemons either from the command line or in /etc/rc.local. See the man pages for details on the command line options. Take particular care to read - the bit about what user you need to be in order to start - Samba. In many cases you must be root.

    The main advantage of starting smbd + the bit about what user you need to have to start + Samba. In many cases, you must be root.

    The main advantage of starting smbd and nmbd using the recommended daemon method is that they will respond slightly more quickly to an initial connection - request.

    Starting from inetd.conf

    Note

    The following will be different if + request.

    Starting from inetd.conf

    Note

    The following will be different if you use NIS, NIS+ or LDAP to distribute services maps.

    Look at your /etc/services. - What is defined at port 139/tcp. If nothing is defined - then add a line like this:

    netbios-ssn     139/tcp

    similarly for 137/udp you should have an entry like:

    netbios-ns	137/udp

    Next edit your /etc/inetd.conf - and add two lines something like this:

    +		What is defined at port 139/tcp? If nothing is defined, 
+		then add a line like this:
    netbios-ssn     139/tcp
    Similarly for 137/udp, you should have an entry like:
    netbios-ns	137/udp
    Next, edit your /etc/inetd.conf 
+		and add two lines like this:
     		netbios-ssn stream tcp nowait root /usr/local/samba/bin/smbd smbd 
 		netbios-ns dgram udp wait root /usr/local/samba/bin/nmbd nmbd 
 		
    The exact syntax of /etc/inetd.conf 
-		varies between unixes. Look at the other entries in inetd.conf 
-		for a guide. 
    Some distributions use xinetd instead of inetd. Consult the 
-		xinetd manual for configuration information.
    Note
    Some unixes already have entries like netbios_ns 
+		varies between UNIXes. Look at the other entries in inetd.conf 
+		for a guide. 
    
+		
+		Some distributions use xinetd instead of inetd. Consult the 
+		xinetd manual for configuration information.
    Note
    Some UNIXes already have entries like netbios_ns 
 		(note the underscore) in /etc/services. 
-		You must either edit /etc/services or
+		You must edit /etc/services or
 		/etc/inetd.conf to make them consistent.
-		
    Note
    On many systems you may need to use the 
-		interfaces option in smb.conf to specify the IP
+		
    Note
    
+		
+				On many systems you may need to use the 
+		interfaces option in smb.conf to specify the IP
 		address and netmask of your interfaces. Run 
 		ifconfig 
-		as root if you don't know what the broadcast is for your
+		as root if you do not know what the broadcast is for your
 		net. nmbd tries to determine it at run 
-		time, but fails on some unixes. 
-		
    Warning
    Many unixes only accept around 5 
+		time, but fails on some UNIXes. 
+		
    Warning
    Many UNIXes only accept around five 
 		parameters on the command line in inetd.conf. 
 		This means you shouldn't use spaces between the options and 
-		arguments, or you should use a script, and start the script 
+		arguments, or you should use a script and start the script 
 		from inetd.
    Restart inetd, perhaps just send 
 			it a HUP. 
     			root# killall -HUP inetd
-		
    Alternative: starting it as a daemon
    To start the server as a daemon you should create 
+

    Alternative: Starting smbd as a Daemon

    + + To start the server as a daemon, you should create a script something like this one, perhaps calling it startsmb.

     		#!/bin/sh
 		/usr/local/samba/bin/smbd -D 
 		/usr/local/samba/bin/nmbd -D 
-

    then make it executable with chmod +

    Make it executable with chmod +x startsmb

    You can then run startsmb by - hand or execute it from /etc/rc.local -

    To kill it send a kill signal to the processes - nmbd and smbd.

    Note

    If you use the SVR4 style init system then + hand or execute it from /etc/rc.local. +

    To kill it, send a kill signal to the processes + nmbd and smbd.

    Note

    If you use the SVR4 style init system, you may like to look at the examples/svr4-startup - script to make Samba fit into that system.

    Prev Up Next
    Part VI. Appendixes Home Chapter 37. Portability
    + script to make Samba fit into that system.

    Prev Up Next
    Part VI. Appendixes Home Chapter 37. Portability
    diff --git a/docs/htmldocs/diagnosis.html b/docs/htmldocs/diagnosis.html index ea84661d30..3b76bc41c0 100644 --- a/docs/htmldocs/diagnosis.html +++ b/docs/htmldocs/diagnosis.html @@ -1,287 +1,311 @@ -Chapter 33. The Samba checklist
    Chapter 33. The Samba checklist
    Prev Part V. Troubleshooting Next

    Chapter 33. The Samba checklist

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Wed Jan 15

    Table of Contents

    Introduction
    Assumptions
    The tests

    Introduction

    +Chapter 33. The Samba Checklist

    Chapter 33. The Samba Checklist
    Prev Part V. Troubleshooting Next

    Chapter 33. The Samba Checklist

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Dan Shearer

    Samba Team

    Wed Jan 15

    Table of Contents

    Introduction
    Assumptions
    The Tests

    Introduction

    This file contains a list of tests you can perform to validate your Samba server. It also tells you what the likely cause of the problem -is if it fails any one of these steps. If it passes all these tests +is if it fails any one of these steps. If it passes all these tests, then it is probably working fine.

    -You should do ALL the tests, in the order shown. We have tried to +You should do all the tests, in the order shown. We have tried to carefully choose them so later tests only use capabilities verified in -the earlier tests. However, do not stop at the first error as there +the earlier tests. However, do not stop at the first error as there have been some instances when continuing with the tests has helped to solve a problem.

    -If you send one of the samba mailing lists an email saying "it doesn't work" -and you have not followed this test procedure then you should not be surprised +If you send one of the Samba mailing lists an email saying, “it does not work” +and you have not followed this test procedure, you should not be surprised if your email is ignored. -

    Assumptions

    -In all of the tests it is assumed you have a Samba server called +

    Assumptions

    +In all of the tests, it is assumed you have a Samba server called BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP.

    The procedure is similar for other types of clients.

    It is also assumed you know the name of an available share in your -smb.conf. I will assume this share is called tmp. -You can add a tmp share like this by adding the -following to smb.conf: -

    Example 33.1. smb.conf with [tmp] share

    [tmp]
    comment = temporary files
    path = /tmp
    read only = yes

    +smb.conf. I will assume this share is called tmp. +You can add a tmp share like this by adding the +lines shown in . +

    Example 33.1. smb.conf with [tmp] share

    [tmp]
    comment = temporary files
    path = /tmp
    read only = yes

    Note

    -These tests assume version 3.0 or later of the samba suite. +These tests assume version 3.0.0 or later of the Samba suite. Some commands shown did not exist in earlier versions.

    Please pay attention to the error messages you receive. If any error message -reports that your server is being unfriendly you should first check that your -IP name resolution is correctly set up. eg: Make sure your /etc/resolv.conf +reports that your server is being unfriendly, you should first check that your +IP name resolution is correctly set up. Make sure your /etc/resolv.conf file points to name servers that really do exist.

    -Also, if you do not have DNS server access for name resolution please check +Also, if you do not have DNS server access for name resolution, please check that the settings for your smb.conf file results in dns proxy = no. The -best way to check this is with testparm smb.conf. -

    +best way to check this is with testparm smb.conf. +

    + It is helpful to monitor the log files during testing by using the -tail -F log_file_name in a separate +tail -F log_file_name in a separate terminal console (use ctrl-alt-F1 through F6 or multiple terminals in X). Relevant log files can be found (for default installations) in -/usr/local/samba/var. Also, connection logs from -machines can be found here or possibly in /var/log/samba +/usr/local/samba/var. Also, connection logs from +machines can be found here or possibly in /var/log/samba, depending on how or if you specified logging in your smb.conf file.

    If you make changes to your smb.conf file while going through these test, -don't forget to restart smbd and nmbd. -

    The tests

    Procedure 33.1. Diagnosing your samba server

    1. +remember to restart smbd and nmbd. +

    The Tests

    Procedure 33.1. Diagnosing your Samba server

    1. + In the directory in which you store your smb.conf file, run the command -testparm smb.conf. If it reports any errors then your smb.conf +testparm smb.conf. If it reports any errors, then your smb.conf configuration file is faulty.

      Note

      Your smb.conf file may be located in: /etc/samba -Or in: /usr/local/samba/lib +or in /usr/local/samba/lib.

    2. -Run the command ping BIGSERVER from the PC and -ping ACLIENT from -the unix box. If you don't get a valid response then your TCP/IP -software is not correctly installed. +Run the command ping BIGSERVER from the PC and +ping ACLIENT from the UNIX box. If you do not get a valid response, +then your TCP/IP software is not correctly installed.

      -Note that you will need to start a "dos prompt" window on the PC to -run ping. +You will need to start a “dos prompt” window on the PC to run ping.

      -If you get a message saying host not found or similar then your DNS +If you get a message saying “host not found” or similar, then your DNS software or /etc/hosts file is not correctly setup. -It is possible to -run samba without DNS entries for the server and client, but I assume +It is possible to run Samba without DNS entries for the server and client, but it is assumed you do have correct entries for the remainder of these tests.

      Another reason why ping might fail is if your host is running firewall software. You will need to relax the rules to let in the workstation in question, perhaps by allowing access from another subnet (on Linux -this is done via the ipfwadm program.) +this is done via the appropriate firewall maintenance commands ipchains +or iptables).

      Note

      Modern Linux distributions install ipchains/iptables by default. This is a common problem that is often overlooked. -

    3. -Run the command smbclient -L BIGSERVER on the unix box. You -should get a list of available shares back. -

      -If you get a error message containing the string "Bad password" then -you probably have either an incorrect hosts allow, -hosts deny or valid users line in your -smb.conf, or your guest account is not -valid. Check what your guest account is using testparm and -temporarily remove any hosts allow, hosts deny, valid users or invalid users lines. -

      -If you get a connection refused response then the smbd server may -not be running. If you installed it in inetd.conf then you probably edited -that file incorrectly. If you installed it as a daemon then check that +

    +If you wish to check what firewall rules may be present in a system under test, simply run +iptables -L -v or if ipchains-based firewall rules are in use, +ipchains -L -v. +

    +Here is a sample listing from a system that has an external ethernet interface (eth1) on which Samba +is not active, and an internal (private network) interface (eth0) on which Samba is active: +

    +frodo:~ # iptables -L -v
+Chain INPUT (policy DROP 98496 packets, 12M bytes)
+ pkts bytes target     prot opt in     out     source     destination
+ 187K  109M ACCEPT     all  --  lo     any     anywhere   anywhere
+ 892K  125M ACCEPT     all  --  eth0   any     anywhere   anywhere
+1399K 1380M ACCEPT     all  --  eth1   any     anywhere   anywhere  \
+					state RELATED,ESTABLISHED
+
+Chain FORWARD (policy DROP 0 packets, 0 bytes)
+ pkts bytes target     prot opt in     out     source     destination
+ 978K 1177M ACCEPT     all  --  eth1   eth0    anywhere   anywhere \
+					state RELATED,ESTABLISHED
+ 658K   40M ACCEPT     all  --  eth0   eth1    anywhere   anywhere
+    0     0 LOG        all  --  any    any     anywhere   anywhere \
+					LOG level warning
+
+Chain OUTPUT (policy ACCEPT 2875K packets, 1508M bytes)
+ pkts bytes target     prot opt in     out     source     destination
+
+Chain reject_func (0 references)
+ pkts bytes target     prot opt in     out     source     destinat
+

    +

  • +Run the command: smbclient -L BIGSERVER +on the UNIX box. You should get back a list of available shares. +

    +If you get an error message containing the string “Bad password”, then +you probably have either an incorrect hosts allow, +hosts deny or valid users line in your +smb.conf, or your guest account is not valid. Check what your guest account is using testparm and +temporarily remove any hosts allow, hosts deny, +valid users or invalid users lines. +

    +If you get a message “connection refused” response, then the smbd server may +not be running. If you installed it in inetd.conf, then you probably edited +that file incorrectly. If you installed it as a daemon, then check that it is running, and check that the netbios-ssn port is in a LISTEN -state using netstat -a. +state using netstat -a.

    Note

    - - -Some Unix / Linux systems use xinetd in place of + + +Some UNIX/Linux systems use xinetd in place of inetd. Check your system documentation for the location -of the control file/s for your particular system implementation of -this network super daemon. +of the control files for your particular system implementation of +the network super daemon.

    -If you get a session request failed then the server refused the -connection. If it says "Your server software is being unfriendly" then -its probably because you have invalid command line parameters to smbd, +If you get a message saying “session request failed”, the server refused the +connection. If it says “Your server software is being unfriendly”, then +it's probably because you have invalid command line parameters to smbd, or a similar fatal problem with the initial startup of smbd. Also check your config file (smb.conf) for syntax errors with testparm -and that the various directories where samba keeps its log and lock +and that the various directories where Samba keeps its log and lock files exist.

    There are a number of reasons for which smbd may refuse or decline a session request. The most common of these involve one or more of -the following smb.conf file entries: -

    hosts deny = ALL
    hosts allow = xxx.xxx.xxx.xxx/yy
    bind interfaces only = Yes

    +the smb.conf file entries as shown in . +

    +

    Example 33.2. Configuration for only allowing connections from a certain subnet

    [globals]
    ...
    hosts deny = ALL
    hosts allow = xxx.xxx.xxx.xxx/yy
    interfaces = eth0
    bind interfaces only = Yes
    ...

    +

    In the above, no allowance has been made for any session requests that will automatically translate to the loopback adapter address 127.0.0.1. -To solve this problem change these lines to: -

    hosts deny = ALL
    hosts allow = xxx.xxx.xxx.xxx/yy 127.

    -Do not use the bind interfaces only parameter where you -may wish to -use the samba password change facility, or where smbclient may need to -access a local service for name resolution or for local resource -connections. (Note: the bind interfaces only parameter deficiency -where it will not allow connections to the loopback address will be -fixed soon). -

    - +To solve this problem, change these lines as shown in . +

    +

    Example 33.3. Configuration for allowing connections from a certain subnet and localhost

    [globals]
    ...
    hosts deny = ALL
    hosts allow = xxx.xxx.xxx.xxx/yy 127.
    interfaces = eth0 lo
    ...

    +

    + Another common cause of these two errors is having something already running -on port 139, such as Samba -(ie: smbd is running from inetd already) or + +on port 139, such as Samba (smbd is running from inetd already) or something like Digital's Pathworks. Check your inetd.conf file before trying -to start smbd as a daemon, it can avoid a lot of frustration! +to start smbd as a daemon it can avoid a lot of frustration!

    And yet another possible cause for failure of this test is when the subnet mask -and / or broadcast address settings are incorrect. Please check that the -network interface IP Address / Broadcast Address / Subnet Mask settings are +and/or broadcast address settings are incorrect. Please check that the +network interface IP Address/Broadcast Address/Subnet Mask settings are correct and that Samba has correctly noted these in the log.nmbd file.

  • -Run the command nmblookup -B BIGSERVER __SAMBA__. You should get the -IP address of your Samba server back. +Run the command: nmblookup -B BIGSERVER __SAMBA__. +You should get back the IP address of your Samba server.

    -If you don't then nmbd is incorrectly installed. Check your inetd.conf -if you run it from there, or that the daemon is running and listening -to udp port 137. +If you do not, then nmbd is incorrectly installed. Check your inetd.conf +if you run it from there, or that the daemon is running and listening to udp port 137.

    One common problem is that many inetd implementations can't take many -parameters on the command line. If this is the case then create a +parameters on the command line. If this is the case, then create a one-line script that contains the right parameters and run that from inetd. -

  • run the command nmblookup -B ACLIENT '*'

    -You should get the PCs IP address back. If you don't then the client +

  • +Run the command: nmblookup -B ACLIENT `*' +

    +You should get the PC's IP address back. If you do not then the client software on the PC isn't installed correctly, or isn't started, or you got the name of the PC wrong.

    -If ACLIENT doesn't resolve via DNS then use the IP address of the +If ACLIENT does not resolve via DNS then use the IP address of the client in the above test.

  • -Run the command nmblookup -d 2 '*' +Run the command: nmblookup -d 2 '*'

    This time we are trying the same as the previous test but are trying it via a broadcast to the default broadcast address. A number of -NetBIOS / TCP/IP hosts on the network should respond, although Samba may +NetBIOS/TCP/IP hosts on the network should respond, although Samba may not catch all of the responses in the short time it listens. You -should see got a positive name query response +should see the “got a positive name query response” messages from several hosts.

    -If this doesn't give a similar result to the previous test then +If this does not give a similar result to the previous test, then nmblookup isn't correctly getting your broadcast address through its automatic mechanism. In this case you should experiment with the -interfaces option in smb.conf to manually configure your IP +interfaces option in smb.conf to manually configure your IP address, broadcast and netmask.

    -If your PC and server aren't on the same subnet then you will need to -use the -B option to set the broadcast address to that of the PCs -subnet. +If your PC and server aren't on the same subnet, then you will need to use the +-B option to set the broadcast address to that of the PCs subnet.

    This test will probably fail if your subnet mask and broadcast address are not correct. (Refer to TEST 3 notes above). -

  • -Run the command smbclient //BIGSERVER/TMP. You should +

  • + +Run the command: smbclient //BIGSERVER/TMP. You should then be prompted for a password. You should use the password of the account -you are logged into the unix box with. If you want to test with -another account then add the -U accountname option to the end of -the command line. eg: -smbclient //bigserver/tmp -Ujohndoe +with which you are logged into the UNIX box. If you want to test with +another account, then add the -U accountname option to the end of +the command line. For example, smbclient //bigserver/tmp -Ujohndoe.

    Note

    -It is possible to specify the password along with the username -as follows: -smbclient //bigserver/tmp -Ujohndoe%secret +It is possible to specify the password along with the username as follows: +smbclient //bigserver/tmp -Ujohndoe%secret.

    -Once you enter the password you should get the smb> prompt. If you -don't then look at the error message. If it says invalid network -name then the service "tmp" is not correctly setup in your smb.conf. +Once you enter the password, you should get the smb> prompt. If you +do not, then look at the error message. If it says “invalid network +name”, then the service tmp is not correctly setup in your smb.conf.

    -If it says bad password then the likely causes are: +If it says “bad password”, then the likely causes are:

    1. - you have shadow passwords (or some other password system) but didn't - compile in support for them in smbd + You have shadow passwords (or some other password system) but didn't + compile in support for them in smbd.

    2. - your valid users configuration is incorrect + Your valid users configuration is incorrect.

    3. - you have a mixed case password and you haven't enabled the password level option at a high enough level + You have a mixed case password and you haven't enabled the password level option at a high enough level.

    4. - the path line in smb.conf is incorrect. Check it with testparm + The path line in smb.conf is incorrect. Check it with testparm.

    5. - you enabled password encryption but didn't map unix to samba users. Run 

      smbpasswd -a username

      . + You enabled password encryption but didn't map UNIX to Samba users. Run: + smbpasswd -a username

    -Once connected you should be able to use the commands -dir get put etc. -Type help command for instructions. You should -especially check that the amount of free disk space shown is correct -when you type dir. +Once connected, you should be able to use the commands dir, get, +put and so on. Type help command for instructions. You should +especially check that the amount of free disk space shown is correct when you type dir.

  • -On the PC, type the command net view \\BIGSERVER. You will -need to do this from within a "dos prompt" window. You should get back a -list of available shares on the server. -

    -If you get a network name not found or similar error then netbios -name resolution is not working. This is usually caused by a problem in -nmbd. To overcome it you could do one of the following (you only need -to choose one of them): +On the PC, type the command net view \\BIGSERVER. You will +need to do this from within a dos prompt window. You should get back a +list of shares available on the server. +

    +If you get a message “network name not found” or similar error, then netbios +name resolution is not working. This is usually caused by a problem in nmbd. +To overcome it, you could do one of the following (you only need to choose one of them):

    1. - fixup the nmbd installation + Fixup the nmbd installation.

    2. - add the IP address of BIGSERVER to the wins server box in the + Add the IP address of BIGSERVER to the wins server box in the advanced TCP/IP setup on the PC.

    3. - enable windows name resolution via DNS in the advanced section of - the TCP/IP setup + Enable Windows name resolution via DNS in the advanced section of the TCP/IP setup.

    4. - add BIGSERVER to your lmhosts file on the PC. + Add BIGSERVER to your lmhosts file on the PC.

    -If you get a invalid network name or bad password error then the -same fixes apply as they did for the smbclient -L test above. In -particular, make sure your hosts allow line is correct (see the man -pages) +If you get a message “invalid network name” or +“bad password error”, then apply the +same fixes as for the smbclient -L test above. In +particular, make sure your hosts allow line is correct (see the man pages).

    Also, do not overlook that fact that when the workstation requests the -connection to the samba server it will attempt to connect using the +connection to the Samba server, it will attempt to connect using the name with which you logged onto your Windows machine. You need to make sure that an account exists on your Samba server with that exact same name and password.

    -If you get specified computer is not receiving requests or similar -it probably means that the host is not contactable via tcp services. -Check to see if the host is running tcp wrappers, and if so add an entry in -the hosts.allow file for your client (or subnet, etc.) +If you get a message “specified computer is not receiving requests” or similar, +it probably means that the host is not contactable via TCP services. +Check to see if the host is running TCP wrappers, and if so add an entry in +the hosts.allow file for your client (or subnet, and so on.)

  • -Run the command net use x: \\BIGSERVER\TMP. You should -be prompted for a password then you should get a command completed -successfully message. If not then your PC software is incorrectly -installed or your smb.conf is incorrect. make sure your hosts allow +Run the command net use x: \\BIGSERVER\TMP. You should +be prompted for a password, then you should get a command completed +successfully message. If not, then your PC software is incorrectly +installed or your smb.conf is incorrect. Make sure your hosts allow and other config lines in smb.conf are correct.

    -It's also possible that the server can't work out what user name to -connect you as. To see if this is the problem add the line user = username to the [tmp] section of -smb.conf where username is the +It's also possible that the server can't work out what user name to connect you as. +To see if this is the problem, add the line +user = username to the +[tmp] section of +smb.conf where username is the username corresponding to the password you typed. If you find this -fixes things you may need the username mapping option. +fixes things, you may need the username mapping option.

    It might also be the case that your client only sends encrypted passwords -and you have encrypt passwords = no in smb.conf -Turn it back on to fix. +and you have encrypt passwords = no in smb.conf. +Change this to "yes" to fix this.

  • -Run the command nmblookup -M testgroup where -testgroup is the name of the workgroup that your Samba server and +Run the command nmblookup -M testgroup where +testgroup is the name of the workgroup that your Samba server and Windows PCs belong to. You should get back the IP address of the master browser for that workgroup.

    -If you don't then the election process has failed. Wait a minute to -see if it is just being slow then try again. If it still fails after -that then look at the browsing options you have set in smb.conf. Make -sure you have preferred master = yes to ensure that +If you do not, then the election process has failed. Wait a minute to +see if it is just being slow, then try again. If it still fails after +that, then look at the browsing options you have set in smb.conf. Make +sure you have preferred master = yes to ensure that an election is held at startup.

  • -From file manager try to browse the server. Your samba server should +>From file manager, try to browse the server. Your Samba server should appear in the browse list of your local workgroup (or the one you specified in smb.conf). You should be able to double click on the name -of the server and get a list of shares. If you get a "invalid -password" error when you do then you are probably running WinNT and it +of the server and get a list of shares. If you get the error message “invalid password”, + you are probably running Windows NT and it is refusing to browse a server that has no encrypted password -capability and is in user level security mode. In this case either set -security = server AND -password server = Windows_NT_Machine in your -smb.conf file, or make sure encrypt passwords is -set to "yes". -

    • Prev Up Next
    Part V. Troubleshooting Home Chapter 34. Analysing and solving samba problems
    +capability and is in User Level Security mode. In this case, either set +security = server and +password server = Windows_NT_Machine in your +smb.conf file, or make sure encrypt passwords is +set to “yes”. +

    Prev Up Next
    Part V. Troubleshooting Home Chapter 34. Analyzing and Solving Samba Problems
    diff --git a/docs/htmldocs/domain-member.html b/docs/htmldocs/domain-member.html index 313c6e0fc7..2d73b7c616 100644 --- a/docs/htmldocs/domain-member.html +++ b/docs/htmldocs/domain-member.html @@ -1,140 +1,142 @@ -Chapter 7. Domain Membership
    Chapter 7. Domain Membership
    Prev Part II. Server Configuration Basics Next

    Chapter 7. Domain Membership

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Table of Contents

    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Using NT4 Server Manager to Add Machine Accounts to the Domain
    "On-the-Fly" Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4 type Domain with Samba-3
    Why is this better than security = server?
    Samba ADS Domain Membership
    Setup your smb.conf
    Setup your /etc/krb5.conf
    Create the computer account
    Test your server setup
    Testing with smbclient
    Notes
    Common Errors
    Can Not Add Machine Back to Domain
    Adding Machine to Domain Fails
    I can't join a Windows 2003 PDC

    -Domain Membership is a subject of vital concern, Samba must be able to -participate as a member server in a Microsoft Domain security context, and +Chapter 7. Domain Membership

    Chapter 7. Domain Membership
    Prev Part II. Server Configuration Basics Next

    Chapter 7. Domain Membership

    John H. Terpstra

    Samba Team

    Jeremy Allison

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    Guenther Deschner

    LDAP updates
    SuSE

    Table of Contents

    Features and Benefits
    MS Windows Workstation/Server Machine Trust Accounts
    Manual Creation of Machine Trust Accounts
    Managing Domain Machine Accounts using NT4 Server Manager
    On-the-Fly Creation of Machine Trust Accounts
    Making an MS Windows Workstation or Server a Domain Member
    Domain Member Server
    Joining an NT4-type Domain with Samba-3
    Why Is This Better Than security = server?
    Samba ADS Domain Membership
    Configure smb.conf
    Configure /etc/krb5.conf
    Create the Computer Account
    Testing Server Setup
    Testing with smbclient
    Notes
    Sharing User ID Mappings between Samba Domain Members
    Common Errors
    Cannot Add Machine Back to Domain
    Adding Machine to Domain Fails
    I Can't Join a Windows 2003 PDC

    +Domain Membership is a subject of vital concern. Samba must be able to +participate as a member server in a Microsoft Domain Security context, and Samba must be capable of providing Domain machine member trust accounts, -otherwise it would not be capable of offering a viable option for many users. +otherwise it would not be able to offer a viable option for many users.

    -This chapter covers background information pertaining to domain membership, -Samba configuration for it, and MS Windows client procedures for joining a -domain. Why is this necessary? Because both are areas in which there exists +This chapter covers background information pertaining to Domain Membership, +the Samba configuration for it, and MS Windows client procedures for joining a +domain. Why is this necessary? Because both are areas in which there exists within the current MS Windows networking world and particularly in the UNIX/Linux networking and administration world, a considerable level of -mis-information, incorrect understanding, and a lack of knowledge. Hopefully +misinformation, incorrect understanding and a lack of knowledge. Hopefully this chapter will fill the voids. -

    Features and Benefits

    -MS Windows workstations and servers that want to participate in domain security need to -be made Domain members. Participating in Domain security is often called +

    Features and Benefits

    +MS Windows workstations and servers that want to participate in Domain Security need to +be made Domain Members. Participating in Domain Security is often called Single Sign On or SSO for short. This chapter describes the process that must be followed to make a workstation -(or another server - be it an MS Windows NT4 / 200x -server) or a Samba server a member of an MS Windows Domain security context. +(or another server be it an MS Windows NT4 / 200x +server) or a Samba server a member of an MS Windows Domain Security context.

    -Samba-3 can join an MS Windows NT4 style domain as a native member server, an + +Samba-3 can join an MS Windows NT4-style domain as a native member server, an MS Windows Active Directory Domain as a native member server, or a Samba Domain -Control network. -

    -Domain membership has many advantages: +Control network. Domain Membership has many advantages:

    • - MS Windows workstation users get the benefit of SSO + + MS Windows workstation users get the benefit of SSO.

    • - Domain user access rights and file ownership / access controls can be set - from the single Domain SAM (Security Account Manager) database - (works with Domain member servers as well as with MS Windows workstations - that are domain members) + Domain user access rights and file ownership/access controls can be set + from the single Domain Security Account Manager (SAM) database + (works with Domain Member servers as well as with MS Windows workstations + that are Domain Members).

    • - Only MS Windows NT4 / 200x / XP Professional - workstations that are Domain members - can use network logon facilities + Only MS Windows NT4/200x/XP Professional + workstations that are Domain Members can use network logon facilities.

    • Domain Member workstations can be better controlled through the use of Policy files (NTConfig.POL) and Desktop Profiles.

    • Through the use of logon scripts, users can be given transparent access to network - applications that run off application servers + applications that run off application servers.

    • Network administrators gain better application and user access management abilities because there is no need to maintain user accounts on any network client or server, other than the central Domain database - (either NT4/Samba SAM style Domain, NT4 Domain that is back ended with an - LDAP directory, or via an Active Directory infrastructure) -

    MS Windows Workstation/Server Machine Trust Accounts

    -A machine trust account is an account that is used to authenticate a client -machine -(rather than a user) to the Domain Controller server. In Windows terminology, -this is known as a "Computer Account." -

    -The password of a machine trust account acts as the shared secret for -secure communication with the Domain Controller. This is a security + (either NT4/Samba SAM style Domain, NT4 Domain that is backended with an + LDAP directory, or via an Active Directory infrastructure). +

    MS Windows Workstation/Server Machine Trust Accounts

    + +A Machine Trust Account is an account that is used to authenticate a client +machine (rather than a user) to the Domain Controller server. In Windows terminology, +this is known as a “Computer Account.” The purpose of the machine account +is to prevent a rogue user and Domain Controller from colluding to gain access to a +domain member workstation. +

    +The password of a Machine Trust Account acts as the shared secret for +secure communication with the Domain Controller. This is a security feature to prevent an unauthorized machine with the same NetBIOS name from joining the domain and gaining access to domain user/group -accounts. Windows NT, 200x, XP Professional clients use machine trust -accounts, but Windows 9x / Me / XP Home clients do not. Hence, a -Windows 9x / Me / XP Home client is never a true member of a domain -because it does not possess a machine trust account, and thus has no -shared secret with the domain controller. +accounts. Windows NT/200x/XP Professional clients use machine trust +accounts, but Windows 9x/Me/XP Home clients do not. Hence, a +Windows 9x/Me/XP Home client is never a true member of a Domain +because it does not possess a Machine Trust Account, and, thus, has no +shared secret with the Domain Controller.

    -A Windows NT4 PDC stores each machine trust account in the Windows Registry. +A Windows NT4 PDC stores each Machine Trust Account in the Windows Registry. The introduction of MS Windows 2000 saw the introduction of Active Directory, -the new repository for machine trust accounts. -

    -A Samba PDC, however, stores each machine trust account in two parts, +the new repository for Machine Trust Accounts. A Samba PDC, however, stores +each Machine Trust Account in two parts, as follows:

    • A Domain Security Account (stored in the - passdb backend that has been configured in the + passdb backend that has been configured in the smb.conf file. The precise nature of the account information that is stored depends on the type of backend database that has been chosen.

      The older format of this data is the smbpasswd database - which contains the UNIX login ID, the UNIX user identifier (UID), and the + that contains the UNIX login ID, the UNIX user identifier (UID), and the LanMan and NT encrypted passwords. There is also some other information in this file that we do not need to concern ourselves with here.

      - The two newer database types are called ldapsam, - tdbsam. Both store considerably more data than the + The two newer database types are called ldapsam, and + tdbsam. Both store considerably more data than the older smbpasswd file did. The extra information - enables new user account controls to be used. + enables new user account controls to be implemented.

    • A corresponding UNIX account, typically stored in - /etc/passwd. Work is in progress to allow a + /etc/passwd. Work is in progress to allow a simplified mode of operation that does not require UNIX user accounts, but this may not be a feature of the early releases of Samba-3.

    -

    -There are three ways to create machine trust accounts: +

    + +There are three ways to create Machine Trust Accounts:

    • Manual creation from the UNIX/Linux command line. Here, both the Samba and corresponding UNIX account are created by hand.

    • - - Using the MS Windows NT4 Server Manager (either from an NT4 Domain member - server, or using the Nexus toolkit available from the Microsoft web site. - This tool can be run from any MS Windows machine so long as the user is + + Using the MS Windows NT4 Server Manager, either from an NT4 Domain Member + server, or using the Nexus toolkit available from the Microsoft Web site. + This tool can be run from any MS Windows machine as long as the user is logged on as the administrator account.

    • - "On-the-fly" creation. The Samba machine trust account is automatically + “On-the-fly” creation. The Samba Machine Trust Account is automatically created by Samba at the time the client is joined to the domain. (For security, this is the recommended method.) The corresponding UNIX account may be created automatically or manually. -

    Manual Creation of Machine Trust Accounts

    -The first step in manually creating a machine trust account is to manually +

    Manual Creation of Machine Trust Accounts

    +The first step in manually creating a Machine Trust Account is to manually create the corresponding UNIX account in /etc/passwd. -This can be done using vipw or another 'add user' command -that is normally used to create new UNIX accounts. The following is an example for a Linux based Samba server: - - - - +This can be done using vipw or another “add user” command +that is normally used to create new UNIX accounts. The following is an example for +a Linux-based Samba server:

    + + 

    -root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine nickname" \
+root# /usr/sbin/useradd -g machines -d /dev/null -c "machine nickname" \
    -s /bin/false machine_name$ 
 
 root# passwd -l machine_name$

    -

    - +

    In the above example above there is an existing system group “machines” which is used +as the primary group for all machine accounts. In the following examples the “machines” group has +numeric GID equal 100.

    + On *BSD systems, this can be done using the chpass utility: 

     root# chpass -a \
-  "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin"
+'machine_name$:*:101:100::0:0:Windows machine_name:/dev/null:/sbin/nologin'

    The /etc/passwd entry will list the machine name -with a "$" appended, won't have a password, will have a null shell and no -home directory. For example a machine named 'doppy' would have an +with a “$” appended, will not have a password, will have a null shell and no +home directory. For example, a machine named “doppy” would have an /etc/passwd entry like this: 

     doppy$:x:505:100:machine_nickname:/dev/null:/bin/false
@@ -142,13 +144,13 @@ doppy$:x:505:100:machine_nickname:/dev/null:
 Above, machine_nickname can be any
 descriptive name for the client, i.e., BasementComputer.
 machine_name absolutely must be the NetBIOS
-name of the client to be joined to the domain.  The "$" must be
+name of the client to be joined to the domain. The “$” must be
 appended to the NetBIOS name of the client or Samba will not recognize
-this as a machine trust account.
+this as a Machine Trust Account.
 
    
 Now that the corresponding UNIX account has been created, the next step is to create 
 the Samba account for the client containing the well-known initial 
-machine trust account password.  This can be done using the 
+Machine Trust Account password. This can be done using the 
 smbpasswd command 
 as shown here:
 
    
@@ -157,267 +159,282 @@ as shown here:

    where machine_name is the machine's NetBIOS -name. The RID of the new machine account is generated from the UID of +name. The RID of the new machine account is generated from the UID of the corresponding UNIX account.

    Join the client to the domain immediately

    - Manually creating a machine trust account using this method is the - equivalent of creating a machine trust account on a Windows NT PDC using - - the Server Manager. From the time at which the - account is created to the time which the client joins the domain and - changes the password, your domain is vulnerable to an intruder joining - your domain using a machine with the same NetBIOS name. A PDC inherently - trusts members of the domain and will serve out a large degree of user - information to such clients. You have been warned! -

    Using NT4 Server Manager to Add Machine Accounts to the Domain

    +Manually creating a Machine Trust Account using this method is the +equivalent of creating a Machine Trust Account on a Windows NT PDC using + +the Server Manager. From the time at which the +account is created to the time the client joins the domain and +changes the password, your domain is vulnerable to an intruder joining +your domain using a machine with the same NetBIOS name. A PDC inherently +trusts members of the domain and will serve out a large degree of user +information to such clients. You have been warned! +

    Managing Domain Machine Accounts using NT4 Server Manager

    +A working add machine script script is essential +for machine trust accounts to be automatically created. This applies no matter whether +one uses automatic account creation, or if one wishes to use the NT4 Domain Server Manager. +

    + If the machine from which you are trying to manage the domain is an -MS Windows NT4 workstation or MS Windows 200x / XP Professional -then the tool of choice is the package called SRVTOOLS.EXE. -When executed in the target directory this will unpack SrvMge.exe +MS Windows NT4 workstation or MS Windows 200x/XP Professional, +the tool of choice is the package called SRVTOOLS.EXE. +When executed in the target directory it will unpack SrvMgr.exe and UsrMgr.exe (both are domain management tools for MS Windows NT4 workstation).

    + If your workstation is a Microsoft Windows 9x/Me family product you should download the Nexus.exe package from the Microsoft web site. When executed from the target directory this will unpack the same tools but for use on this platform.

    Further information about these tools may be obtained from the following locations: -http://support.microsoft.com/default.aspx?scid=kb;en-us;173673 -http://support.microsoft.com/default.aspx?scid=kb;en-us;172540 +

    +

    http://support.microsoft.com/default.aspx?scid=kb;en-us;173673
    http://support.microsoft.com/default.aspx?scid=kb;en-us;172540

    Launch the srvmgr.exe (Server Manager for Domains) and follow these steps:

    Procedure 7.1. Server Manager Account Machine Account Management

    1. - From the menu select Computer + From the menu select Computer.

    2. - Click on Select Domain + Click Select Domain.

    3. - Click on the name of the domain you wish to administer in the + Click the name of the domain you wish to administer in the Select Domain panel and then click OK.

    4. - Again from the menu select Computer + Again from the menu select Computer.

    5. - Select Add to Domain + Select Add to Domain.

    6. - In the dialog box, click on the radio button to + In the dialog box, click the radio button to Add NT Workstation of Server, then - enter the machine name in the field provided, then click the + enter the machine name in the field provided, and click the Add button. -

    "On-the-Fly" Creation of Machine Trust Accounts

    -The second (and recommended) way of creating machine trust accounts is +

    On-the-Fly Creation of Machine Trust Accounts

    +The second (and recommended) way of creating Machine Trust Accounts is simply to allow the Samba server to create them as needed when the client is joined to the domain. -

    Since each Samba machine trust account requires a corresponding UNIX account, a method +

    Since each Samba Machine Trust Account requires a corresponding UNIX account, a method for automatically creating the UNIX account is usually supplied; this requires configuration of the -add machine script option in -smb.conf. This method is not required, however; corresponding UNIX +add machine script option in smb.conf. This method is not required, however, corresponding UNIX accounts may also be created manually.

    -Below is an example for a RedHat Linux system. -

    [global]
    # <...remainder of parameters...>
    add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u

    Making an MS Windows Workstation or Server a Domain Member

    -The procedure for making an MS Windows workstation of server a member of the domain varies -with the version of Windows: -

    Windows 200x XP Professional

    - When the user elects to make the client a domain member, Windows 200x prompts for +Here is an example for a Red Hat Linux system. +

    [global]
    # <...remainder of parameters...>
    add machine script = /usr/sbin/useradd -d /dev/null -g 100 \
    -s /bin/false -M %u

    Making an MS Windows Workstation or Server a Domain Member

    +The procedure for making an MS Windows workstation or server a member of the domain varies +with the version of Windows. +

    Windows 200x/XP Professional Client

    + When the user elects to make the client a Domain Member, Windows 200x prompts for an account and password that has privileges to create machine accounts in the domain. - A Samba administrative account (i.e., a Samba account that has root privileges on the + A Samba Administrator Account (i.e., a Samba account that has root privileges on the Samba server) must be entered here; the operation will fail if an ordinary user account is given.

    - Note: For security reasons the password for this administrative account should be set - to a password that is other than that used for the root user in the - /etc/passwd. + For security reasons, the password for this Administrator Account should be set + to a password that is other than that used for the root user in /etc/passwd.

    - The name of the account that is used to create domain member machine accounts can be - anything the network administrator may choose. If it is other than root - then this is easily mapped to root using the file pointed to be the smb.conf parameter - username map = /etc/samba/smbusers. + The name of the account that is used to create Domain Member machine accounts can be + anything the network administrator may choose. If it is other than root + then this is easily mapped to root in the file named in the smb.conf parameter + username map = /etc/samba/smbusers.

    - The session key of the Samba administrative account acts as an - encryption key for setting the password of the machine trust - account. The machine trust account will be created on-the-fly, or - updated if it already exists. -

    Windows NT4

    - If the machine trust account was created manually, on the + The session key of the Samba Administrator Account acts as an encryption key for setting the password of the machine trust + account. The Machine Trust Account will be created on-the-fly, or updated if it already exists. +

    Windows NT4 Client

    + If the Machine Trust Account was created manually, on the Identification Changes menu enter the domain name, but do not check the box Create a Computer Account in the Domain. - In this case, the existing machine trust account is used to join the machine + In this case, the existing Machine Trust Account is used to join the machine to the domain.

    - If the machine trust account is to be created - on-the-fly, on the Identification Changes menu enter the domain - name, and check the box Create a Computer Account in the - Domain. In this case, joining the domain proceeds as above - for Windows 2000 (i.e., you must supply a Samba administrative account when + If the Machine Trust Account is to be created on-the-fly, on the Identification Changes menu enter the domain + name and check the box Create a Computer Account in the Domain. In this case, joining + the domain proceeds as above for Windows 2000 (i.e., you must supply a Samba Administrator Account when prompted). -

    Samba

    Joining a Samba client to a domain is documented in - the domain member chapter. +

    Samba Client

    Joining a Samba client to a domain is documented in + .

    Domain Member Server

    This mode of server operation involves the Samba machine being made a member of a domain security context. This means by definition that all user authentication will be done from a centrally defined authentication regime. -The authentication regime may come from an NT3/4 style (old domain technology) +The authentication regime may come from an NT3/4-style (old domain technology) server, or it may be provided from an Active Directory server (ADS) running on MS Windows 2000 or later.

    -Of course it should be clear that the authentication back end itself could be +Of course it should be clear that the authentication backend itself could be from any distributed directory architecture server that is supported by Samba. -This can be LDAP (from OpenLDAP), or Sun's iPlanet, of NetWare Directory -Server, etc. +This can be LDAP (from OpenLDAP), or Sun's iPlanet, or NetWare Directory +Server, and so on. -

    -Please refer to the chapter on setting up a PDC -for more information regarding how to create a domain -machine account for a domain member server as well as for information -regarding how to enable the Samba domain member machine to join the domain and -to be fully trusted by it. -

    Joining an NT4 type Domain with Samba-3

    -

    Table 7.1. Assumptions

    NetBIOS name:SERV1
    Win2K/NT domain name:MIDEARTH
    Domain's PDC NetBIOS name:DOMPDC
    Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2

    -

    -First, you must edit your smb.conf file to tell Samba it should -now use domain security. +

    Note

    +When Samba is configured to use an LDAP, or other identity management and/or +directory service, it is Samba that continues to perform user and machine +authentication. It should be noted that the LDAP server does not perform +authentication handling in place of what Samba is designed to do. +

    +Please refer to , for more information regarding +how to create a domain machine account for a Domain Member server as well as for +information on how to enable the Samba Domain Member machine to join the domain +and be fully trusted by it. +

    Joining an NT4-type Domain with Samba-3

    lists names that have been used in the remainder of this chapter.

    Table 7.1. Assumptions

    NetBIOS name:SERV1
    Windows 200x/NT domain name:MIDEARTH
    Domain's PDC NetBIOS name:DOMPDC
    Domain's BDC NetBIOS names:DOMBDC1 and DOMBDC2

    +First, you must edit your smb.conf file to tell Samba it should now use domain security.

    Change (or add) your - security line in the [global] section + security line in the [global] section of your smb.conf to read:

    security = domain

    -Next change the workgroup line in the [global] +Next change the workgroup line in the [global] section to read:

    workgroup = MIDEARTH

    -as this is the name of the domain we are joining. +This is the name of the domain we are joining.

    -You must also have the parameter -encrypt passwords set to yes - in order for your users to authenticate to the NT PDC. +You must also have the parameter encrypt passwords +set to yes in order for your users to authenticate to the NT PDC. +This is the defaulty setting if this parameter is not specified. There is no need to specify this +parameter, but if it is specified in the smb.conf file, it must be set to Yes.

    -Finally, add (or modify) a password server line in the [global] +Finally, add (or modify) a password server line in the [global] section to read:

    password server = DOMPDC DOMBDC1 DOMBDC2

    -These are the primary and backup domain controllers Samba +These are the primary and backup Domain Controllers Samba will attempt to contact in order to authenticate users. Samba will try to contact each of these servers in order, so you may want to rearrange this list in order to spread out the authentication load -among domain controllers. +among Domain Controllers.

    -Alternatively, if you want smbd to automatically determine -the list of Domain controllers to use for authentication, you may +Alternately, if you want smbd to automatically determine +the list of Domain Controllers to use for authentication, you may set this line to be:

    password server = *

    -This method allows Samba to use exactly the same mechanism that NT does. This -method either broadcasts or uses a WINS database in order to -find domain controllers to authenticate against. +This method allows Samba to use exactly the same mechanism that NT does. The +method either uses broadcast-based name resolution, performs a WINS database +lookup in order to find a Domain Controller against which to authenticate, +or locates the Domain Controller using DNS name resolution.

    -In order to actually join the domain, you must run this command: +To join the domain, run this command: 

    -root# net rpc join -S DOMPDC -UAdministrator%password
+root# net join -S DOMPDC -UAdministrator%password

    -If the -S DOMPDC argument is not given then -the domain name will be obtained from smb.conf. -

    -As we are joining the domain DOM and the PDC for that domain -(the only machine that has write access to the domain SAM database) -is DOMPDC, we use it for the -S option. -The Administrator%password is -the login name and password for an account which has the necessary -privilege to add machines to the domain. If this is successful -you will see the message: +If the -S DOMPDC argument is not given, the domain name will be obtained from smb.conf.

    +The machine is joining the domain DOM, and the PDC for that domain (the only machine +that has write access to the domain SAM database) is DOMPDC, therefore use the -S +option. The Administrator%password is the login name and +password for an account that has the necessary privilege to add machines to the +domain. If this is successful, you will see the message in your terminal window the +text shown below. Where the older NT4 style domain architecture is used: +

     Joined domain DOM.
-or Joined 'SERV1' to realm 'MYREALM'
+

    +

    +Where Active Directory is used: +

    +Joined SERV1 to realm MYREALM.
+

    -in your terminal window. See the -net man page for more details. +Refer to the net man page for further information.

    This process joins the server to the domain without having to create the machine trust account on the PDC beforehand.

    -This command goes through the machine account password -change protocol, then writes the new (random) machine account -password for this Samba server into a file in the same directory -in which an smbpasswd file would be stored - normally: -

    +This command goes through the machine account password change protocol, then writes +the new (random) machine account password for this Samba server into a file in the +same directory in which a smbpasswd file would be normally stored: +

     /usr/local/samba/private/secrets.tdb
+or 
+/etc/samba/secrets.tdb.
+

    -This file is created and owned by root and is not -readable by any other user. It is the key to the domain-level -security for your system, and should be treated as carefully +This file is created and owned by root and is not readable by any other user. It is +the key to the Domain-level security for your system, and should be treated as carefully as a shadow password file.

    -Finally, restart your Samba daemons and get ready for -clients to begin using domain security! The way you can restart your -samba daemons depends on your distribution, but in most cases running +Finally, restart your Samba daemons and get ready for clients to begin using domain +security. The way you can restart your Samba daemons depends on your distribution, +but in most cases the following will suffice: 

    -	root# /etc/init.d/samba restart
+root# /etc/init.d/samba restart

    -does the job. -

    Why is this better than security = server?

    -Currently, domain security in Samba doesn't free you from +

    Why Is This Better Than security = server?

    +Currently, domain security in Samba does not free you from having to create local UNIX users to represent the users attaching -to your server. This means that if domain user DOM\fred - attaches to your domain security Samba server, there needs +to your server. This means that if Domain user DOM\fred + attaches to your Domain Security Samba server, there needs to be a local UNIX user fred to represent that user in the UNIX -filesystem. This is very similar to the older Samba security mode -security = server, +file system. This is similar to the older Samba security mode +security = server, where Samba would pass through the authentication request to a Windows NT server in the same way as a Windows 95 or Windows 98 server would.

    - Please refer to the chapter on winbind for information on a system -to automatically assign UNIX uids and gids to Windows NT Domain users and groups. +Please refer to , for information on a system +to automatically assign UNIX UIDs and GIDs to Windows NT Domain users and groups.

    -The advantage to domain-level security is that the -authentication in domain-level security is passed down the authenticated +The advantage to Domain-level security is that the +authentication in Domain-level security is passed down the authenticated RPC channel in exactly the same way that an NT server would do it. This means Samba servers now participate in domain trust relationships in exactly the same way NT servers do (i.e., you can add Samba servers into a resource domain and have the authentication passed on from a resource domain PDC to an account domain PDC).

    -In addition, with security = server every Samba +In addition, with security = server, every Samba daemon on a server has to keep a connection open to the authenticating server for as long as that daemon lasts. This can drain the connection resources on a Microsoft NT server and cause it to run -out of available connections. With security = domain, +out of available connections. With security = domain, however, the Samba daemons connect to the PDC/BDC only for as long -as is necessary to authenticate the user, and then drop the connection, +as is necessary to authenticate the user and then drop the connection, thus conserving PDC connection resources.

    And finally, acting in the same manner as an NT server authenticating to a PDC means that as part of the authentication reply, the Samba server gets the user identification information such -as the user SID, the list of NT groups the user belongs to, etc. +as the user SID, the list of NT groups the user belongs to, and so on.

    Note

    -Much of the text of this document -was first published in the Web magazine -LinuxWorld as the article Doing -the NIS/NT Samba. -

    Samba ADS Domain Membership

    -This is a rough guide to setting up Samba 3.0 with Kerberos authentication against a -Windows2000 KDC. A familiarity with Kerberos is assumed. -

    Setup your smb.conf

    -You must use at least the following 3 options in smb.conf: -

    realm = your.kerberos.REALM
    security = ADS
    encrypt passwords = yes

    -In case samba can't figure out your ads server using your realm name, use the -ads server option in smb.conf: -

    ads server = your.kerberos.server

    +Much of the text of this document was first published in the Web magazine +LinuxWorld as the article http://www.linuxworld.com/linuxworld/lw-1998-10/lw-10-samba.html +Doing the NIS/NT Samba. +

    Samba ADS Domain Membership

    + + + + +This is a rough guide to setting up Samba-3 with Kerberos authentication against a +Windows 200x KDC. A familiarity with Kerberos is assumed. +

    Configure smb.conf

    +You must use at least the following three options in smb.conf: +

    realm = your.kerberos.REALM
    security = ADS
    # The following parameter need only be specified if present.
    # The default setting is not present is Yes.
    encrypt passwords = yes

    +In case samba cannot correctly identify the appropriate ADS server using the realm name, use the +password server option in smb.conf: +

    password server = your.kerberos.server

    Note

    You do not need a smbpasswd file, and older clients will be authenticated as -if security = domain, although it won't do any harm and -allows you to have local users not in the domain. It is expected that the above -required options will change soon when active directory integration will get -better. -

    Setup your /etc/krb5.conf

    -The minimal configuration for krb5.conf is: +if security = domain, although it will not do any harm and +allows you to have local users not in the domain. +

    Configure /etc/krb5.conf

    + + +With both MIT and Heimdal Kerberos, this is unnecessary, and may be detrimental. All ADS +domains will automatically create SRV records in the DNS zone _kerberos.REALM.NAME for +each KDC in the realm. MIT's, as well as Heimdal's, KRB5 libraries default to checking +for these records, so they will automatically find the KDCs. In addition, +krb5.conf only allows specifying a single KDC, even there if there is more +than one. Using the DNS lookup allows the KRB5 libraries to use whichever KDCs are available. +

    +When manually configuring krb5.conf, the minimal configuration is: 

     [libdefaults]
    default_realm = YOUR.KERBEROS.REALM
@@ -426,92 +443,146 @@ The minimal configuration for krb5.conf is:
 	YOUR.KERBEROS.REALM = {
 	kdc = your.kerberos.server
 	    }
-

    +

    +When using Heimdal versions before 0.6 use the following configuration settings: +

    +[libdefaults]
+   default_realm      = YOUR.KERBEROS.REALM
+   default_etypes     = des-cbc-crc des-cbc-md5
+   default_etypes_des = des-cbc-crc des-cbc-md5
+
+        [realms]
+        YOUR.KERBEROS.REALM = {
+        kdc = your.kerberos.server
+            }
+

    +

    + Test your config by doing a kinit USERNAME@REALM and making sure that your password is accepted by the Win2000 KDC. +

    +With Heimdal versions earlier than 0.6.x you only can use newly created accounts +in ADS or accounts that have had the password changed once after migration, or +in case of Administrator after installation. At the +moment, a Windows 2003 KDC can only be used with a Heimdal releases later than 0.6 +(and no default etypes in krb5.conf). Unfortunatly this whole area is still +in a state of flux.

    Note

    -The realm must be uppercase or you will get Cannot find KDC for -requested realm while getting initial credentials error (Kerberos +The realm must be in uppercase or you will get “Cannot find KDC for +requested realm while getting initial credentials” error (Kerberos is case-sensitive!).

    Note

    -Time between the two servers must be synchronized. You will get a -kinit(v5): Clock skew too great while getting initial credentials +Time between the two servers must be synchronized. You will get a +“kinit(v5): Clock skew too great while getting initial credentials” if the time difference is more than five minutes.

    +Clock skew limits are configurable in the Kerberos protocols. The default setting is +five minutes. +

    You also must ensure that you can do a reverse DNS lookup on the IP address of your KDC. Also, the name that this reverse lookup maps to -must either be the NetBIOS name of the KDC (ie. the hostname with no -domain attached) or it can alternatively be the NetBIOS name -followed by the realm. +must either be the NetBIOS name of the KDC (i.e., the hostname with no +domain attached) or it can alternately be the NetBIOS name followed by the realm.

    The easiest way to ensure you get this right is to add a /etc/hosts entry mapping the IP address of your KDC to -its NetBIOS name. If you don't get this right then you will get a +its NetBIOS name. If you do not get this correct then you will get a local error when you try to join the realm.

    If all you want is Kerberos support in smbclient then you can skip -straight to Test with smbclient now. -Creating a computer account -and testing your servers -is only needed if you want Kerberos support for smbd and winbindd. -

    Create the computer account

    -As a user that has write permission on the Samba private directory -(usually root) run: +directly to now. + and +are needed only if you want Kerberos support for smbd and winbindd. +

    Create the Computer Account

    +As a user who has write permission on the Samba private directory (usually root), run: 

     root#  net ads join -U Administrator%password

    -

    Possible errors

    +

    +When making a Windows client a member of an ADS domain within a complex organization, you +may want to create the machine account within a particular organizational unit. Samba-3 permits +this to be done using the following syntax: +

    +root#   kinit Administrator@your.kerberos.REALM
+root#  net ads join “organizational_unit”
+

    +

    +For example, you may want to create the machine account in a container called “Servers” +under the organizational directory “Computers\BusinessUnit\Department” like this: +

    +root#  net ads join "Computers\BusinessUnit\Department\Servers"
+

    +

    Possible Errors

    ADS support not compiled in

    Samba must be reconfigured (remove config.cache) and recompiled - (make clean all install) after the Kerberos libs and headers are installed. + (make clean all install) after the Kerberos libiraries and headers files are installed.

    net ads join prompts for user name

    You need to login to the domain using kinit USERNAME@REALM. USERNAME must be a user who has rights to add a machine - to the domain.

    -

    Test your server setup

    + to the domain.

    Unsupported encryption/or checksum types

    + Make sure that the /etc/krb5.conf is correctly configured + for the type and version of Kerberos installed on the system. +

    +

    Testing Server Setup

    If the join was successful, you will see a new computer account with the -NetBIOS name of your Samba server in Active Directory (in the "Computers" +NetBIOS name of your Samba server in Active Directory (in the “Computers” folder under Users and Computers.

    -On a Windows 2000 client try net use * \\server\share. You should -be logged in with Kerberos without needing to know a password. If -this fails then run klist tickets. Did you get a ticket for the -server? Does it have an encoding type of DES-CBC-MD5 ? -

    Testing with smbclient

    +On a Windows 2000 client, try net use * \\server\share. You should +be logged in with Kerberos without needing to know a password. If this fails then run +klist tickets. Did you get a ticket for the server? Does it have +an encryption type of DES-CBC-MD5? +

    Note

    +Samba can use both DES-CBC-MD5 encryption as well as ARCFOUR-HMAC-MD5 encoding. +

    Testing with smbclient

    + On your Samba server try to login to a Win2000 server or your Samba server using smbclient and Kerberos. Use smbclient as usual, but specify the -k option to choose Kerberos authentication. -

    Notes

    +

    Notes

    You must change administrator password at least once after DC -install, to create the right encoding types -

    -W2k doesn't seem to create the _kerberos._udp and _ldap._tcp in -their defaults DNS setup. Maybe this will be fixed later in service packs. -

    Common Errors

    -In the process of adding / deleting / re-adding domain member machine accounts there are -many traps for the unwary player and there are many “little” things that can go wrong. -It is particularly interesting how often subscribers on the samba mailing list have concluded -after repeated failed attempts to add a machine account that it is necessary to "re-install" -MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type -of problem. The real solution is often very simple, and with understanding of how MS Windows -networking functions easy to overcome. -

    Can Not Add Machine Back to Domain

    -“ A Windows workstation was reinstalled. The original domain machine +install, to create the right encryption types. +

    +Windows 200x does not seem to create the _kerberos._udp and _ldap._tcp in +the default DNS setup. Perhaps this will be fixed later in service packs. +

    Sharing User ID Mappings between Samba Domain Members

    +Samba maps UNIX users and groups (identified by UIDs and GIDs) to Windows users and groups (identified by SIDs). +These mappings are done by the idmap subsystem of Samba. +

    +In some cases it is useful to share these mappings between Samba Domain Members, +so name->id mapping is identical on all machines. +This may be needed in particular when sharing files over both CIFS and NFS. +

    To use the LDAP ldap idmap suffix, set:

    ldap idmap suffix = ou=Idmap,dc=quenya,dc=org

    See the smb.conf man page entry for the ldap idmap suffix +parameter for further information.

    +Do not forget to specify also the ldap admin dn +and to make certain to set the LDAP administrative password into the secrets.tdb using: +

    +root#  smbpasswd -w ldap-admin-password
+

    Common Errors

    +In the process of adding/deleting/re-adding Domain Member machine accounts, there are +many traps for the unwary player and many “little” things that can go wrong. +It is particularly interesting how often subscribers on the Samba mailing list have concluded +after repeated failed attempts to add a machine account that it is necessary to “re-install” +MS Windows on the machine. In truth, it is seldom necessary to reinstall because of this type +of problem. The real solution is often quite simple and with an understanding of how MS Windows +networking functions, it is easy to overcome. +

    Cannot Add Machine Back to Domain

    +“A Windows workstation was re-installed. The original domain machine account was deleted and added immediately. The workstation will not join the domain if I use the same machine name. Attempts to add the machine fail with a message that the machine already -exists on the network - I know it doesn't. Why is this failing?” +exists on the network I know it does not. Why is this failing?”

    The original name is still in the NetBIOS name cache and must expire after machine account -deletion BEFORE adding that same name as a domain member again. The best advice is to delete -the old account and then to add the machine with a new name. -

    Adding Machine to Domain Fails

    - “Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a -message that, The machine could not be added at this time, there is a network problem. - Please try again later. Why?” -

    -You should check that there is an add machine script in your smb.conf +deletion before adding that same name as a Domain Member again. The best advice is to delete +the old account and then add the machine with a new name. +

    Adding Machine to Domain Fails

    +“Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a +message that, `The machine could not be added at this time, there is a network problem. +Please try again later.' Why?” +

    +You should check that there is an add machine script in your smb.conf file. If there is not, please add one that is appropriate for your OS platform. If a script -has been defined you will need to debug it's operation. Increase the log level +has been defined, you will need to debug its operation. Increase the log level in the smb.conf file to level 10, then try to rejoin the domain. Check the logs to see which operation is failing.

    @@ -519,16 +590,20 @@ Possible causes include:

    • The script does not actually exist, or could not be located in the path specified.

      - Corrective Action: Fix it. Make sure that when run manually - that the script will add both the UNIX system account _and_ the Samba SAM account. + Corrective action: Fix it. Make sure when run manually + that the script will add both the UNIX system account and the Samba SAM account.

    • - The machine could not be added to the UNIX system accounts file /etc/passwd + The machine could not be added to the UNIX system accounts file /etc/passwd.

      - Corrective Action: Check that the machine name is a legal UNIX - system account name. ie: If the UNIX utility useradd is called + Corrective action: Check that the machine name is a legal UNIX + system account name. If the UNIX utility useradd is called, then make sure that the machine name you are trying to add can be added using this tool. Useradd on some systems will not allow any upper case characters nor will it allow spaces in the name. -

    I can't join a Windows 2003 PDC

    Windows 2003 requires SMB signing. Client side SMB signing has - only been implemented partially in Samba 3.0. Set client use spnego = no when communicating - with a windows 2003 server.

    Prev Up Next
    Chapter 6. Backup Domain Control Home Chapter 8. Stand-Alone Servers
    +

    +The add machine script does not create the +machine account in the Samba backend database, it is there only to create a UNIX system +account to which the Samba backend database account can be mapped. +

    I Can't Join a Windows 2003 PDC

    Windows 2003 requires SMB signing. Client side SMB signing has been implemented in Samba-3.0. + Set client use spnego = yes when communicating + with a Windows 2003 server.

    Prev Up Next
    Chapter 6. Backup Domain Control Home Chapter 8. Stand-alone Servers
    diff --git a/docs/htmldocs/findsmb.1.html b/docs/htmldocs/findsmb.1.html index a6013a13ec..ccbe179580 100644 --- a/docs/htmldocs/findsmb.1.html +++ b/docs/htmldocs/findsmb.1.html @@ -55,7 +55,7 @@ IP ADDR NETBIOS NAME WORKGROUP/OS/VERSION by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at ftp://ftp.icce.rug.nl/pub/unix/) + excellent piece of Open Source software, available at ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/groupmapping.html b/docs/htmldocs/groupmapping.html index 39d317e8cf..da8cf8f4b1 100644 --- a/docs/htmldocs/groupmapping.html +++ b/docs/htmldocs/groupmapping.html @@ -1,119 +1,164 @@ -Chapter 12. Mapping MS Windows and UNIX Groups
    Chapter 12. Mapping MS Windows and UNIX Groups
    Prev Part III. Advanced Configuration Next

    Chapter 12. Mapping MS Windows and UNIX Groups

    Jean François Micouleau

    Gerald (Jerry) Carter

    Samba Team

    John H. Terpstra

    Samba Team

    Table of Contents

    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users group

    +Chapter 12. Group Mapping MS Windows and UNIX

    Chapter 12. Group Mapping MS Windows and UNIX
    Prev Part III. Advanced Configuration Next

    Chapter 12. Group Mapping MS Windows and UNIX

    John H. Terpstra

    Samba Team

    Jean François Micouleau

    Gerald (Jerry) Carter

    Samba Team

    Table of Contents

    Features and Benefits
    Discussion
    Default Users, Groups and Relative Identifiers
    Example Configuration
    Configuration Scripts
    Sample smb.conf Add Group Script
    Script to Configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users Group

    + Starting with Samba-3, new group mapping functionality is available to create associations between Windows group SIDs and UNIX groups. The groupmap subcommand included with the net tool can be used to manage these associations. +

    + The new facility for mapping NT Groups to UNIX system groups allows the administrator to decide + which NT Domain Groups are to be exposed to MS Windows clients. Only those NT Groups that map + to a UNIX group that has a value other than the default (-1) will be exposed + in group selection lists in tools that access domain users and groups.

    Warning

    - The first immediate reason to use the group mapping on a Samba PDC, is that - - the domain admin group has been removed and should no longer - be specified in smb.conf. This parameter was used to give the listed users membership - in the Domain Admins Windows group which gave local admin rights on their workstations + + The domain admin group parameter has been removed in Samba-3 and should no longer + be specified in smb.conf. This parameter was used to give the listed users membership in the + Domain Admins Windows group which gave local admin rights on their workstations (in default configurations). -

    Features and Benefits

    - Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to +

    Features and Benefits

    + Samba allows the administrator to create MS Windows NT4/200x group accounts and to arbitrarily associate them with UNIX/Linux group accounts. -

    - Group accounts can be managed using the MS Windows NT4 or MS Windows 200x / XP Professional MMC tools. - Appropriate interface scripts should be provided in smb.conf if it is desired that UNIX / Linux system +

    + + + Group accounts can be managed using the MS Windows NT4 or MS Windows 200x/XP Professional MMC tools. + Appropriate interface scripts should be provided in smb.conf if it is desired that UNIX/Linux system accounts should be automatically created when these tools are used. In the absence of these scripts, and - so long as winbind is running, Samba accounts group accounts that are created using these tools will be - allocated UNIX UIDs/GIDs from the parameters set by the idmap uid/idmap gid settings - in the smb.conf file. -

    Figure 12.1. IDMAP groups

    IDMAP groups

    + so long as winbindd is running, Samba group accounts that are created using these + tools will be allocated UNIX UIDs/GIDs from the ID range specified by the + idmap uid/idmap gid + parameters in the smb.conf file. +

    Figure 12.1. IDMAP: group SID to GID resolution.

    IDMAP: group SID to GID resolution.

    Figure 12.2. IDMAP: GID resolution to matching SID.

    IDMAP: GID resolution to matching SID.

    + In both cases, when winbindd is not running, only locally resolvable groups can be recognized. Please refer to + and . The net groupmap is + used to establish UNIX group to NT SID mappings as shown in . +

    Figure 12.3. IDMAP storing group mappings.

    IDMAP storing group mappings.

    + + Administrators should be aware that where smb.conf group interface scripts make - direct calls to the UNIX/Linux system tools (eg: the shadow utilities, groupadd, - groupdel, groupmod) then the resulting UNIX/Linux group names will be subject - to any limits imposed by these tools. If the tool does NOT allow upper case characters - or space characters, then the creation of an MS Windows NT4 / 200x style group of + direct calls to the UNIX/Linux system tools (the shadow utilities, groupadd, + groupdel, and groupmod), the resulting UNIX/Linux group names will be subject + to any limits imposed by these tools. If the tool does not allow upper case characters + or space characters, then the creation of an MS Windows NT4/200x style group of Engineering Managers will attempt to create an identically named - UNIX/Linux group, an attempt that will of course fail! -

    + UNIX/Linux group, an attempt that will of course fail. +

    + + There are several possible work-arounds for the operating system tools limitation. One method is to use a script that generates a name for the UNIX/Linux system group that - fits the operating system limits, and that then just passes the UNIX/Linux group id (GID) + fits the operating system limits, and that then just passes the UNIX/Linux group ID (GID) back to the calling Samba interface. This will provide a dynamic work-around solution.

    Another work-around is to manually create a UNIX/Linux group, then manually create the - MS Windows NT4 / 200x group on the Samba server and then use the net groupmap + MS Windows NT4/200x group on the Samba server and then use the net groupmap tool to connect the two to each other. -

    Discussion

    - When installing MS Windows NT4 / 200x on a computer, the installation +

    Discussion

    + When installing MS Windows NT4/200x on a computer, the installation program creates default users and groups, notably the Administrators group, - and gives that group privileges necessary privileges to perform essential system tasks. - eg: Ability to change the date and time or to kill (or close) any process running on the + and gives that group privileges necessary privileges to perform essential system tasks, + such as the ability to change the date and time or to kill (or close) any process running on the local machine. -

    - The 'Administrator' user is a member of the 'Administrators' group, and thus inherits - 'Administrators' group privileges. If a 'joe' user is created to be a member of the - 'Administrator' group, 'joe' has exactly the same rights as 'Administrator'.

    - When an MS Windows NT4 / W200x is made a domain member, the "Domain Admins" group of the - PDC is added to the local 'Administrators' group of the workstation. Every member of the - 'Domain Administrators' group inherits the rights of the local 'Administrators' group when + + The Administrator user is a member of the Administrators group, and thus inherits + Administrators group privileges. If a joe user is created to be a member of the + Administrators group, joe has exactly the same rights as the user, + Administrator. +

    + When an MS Windows NT4/200x/XP machine is made a Domain Member, the “Domain Admins” group of the + PDC is added to the local Administrators group of the workstation. Every member of the + Domain Administrators group inherits the rights of the local Administrators group when logging on the workstation.

    - The following steps describe how to make Samba PDC users members of the 'Domain Admins' group? + The following steps describe how to make Samba PDC users members of the Domain Admins group?

    1. - create a unix group (usually in /etc/group), let's call it domadm -

    2. add to this group the users that must be Administrators. For example - if you want joe, john and mary, your entry in /etc/group will - look like: + Create a UNIX group (usually in /etc/group), let's call it domadm. +

    3. + Add to this group the users that must be “Administrators”. For example, + if you want joe, john and mary to be administrators, + your entry in /etc/group will look like this: 

       		domadm:x:502:joe,john,mary

    4. - Map this domadm group to the "Domain Admins" group by running the command: + Map this domadm group to the “Domain Admins” group by running the command:

      -

      -root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm
-

      -

      - The quotes around "Domain Admins" are necessary due to the space in the group name. - Also make sure to leave no whitespace surrounding the equal character (=). + 

      +	root# net groupmap add ntgroup=“Domain Admins” UNIXgroup=domadm
+

      +

      + + The quotes around “Domain Admins” are necessary due to the space in the group name. + Also make sure to leave no white-space surrounding the equal character (=).

    - Now joe, john and mary are domain administrators! -

    - It is possible to map any arbitrary UNIX group to any Windows NT4 / 200x group as well as - making any UNIX group a Windows domain group. For example, if you wanted to include a - UNIX group (e.g. acct) in a ACL on a local file or printer on a domain member machine, + Now joe, john and mary are domain administrators. +

    + + It is possible to map any arbitrary UNIX group to any Windows NT4/200x group as well as + making any UNIX group a Windows domain group. For example, if you wanted to include a + UNIX group (e.g., acct) in an ACL on a local file or printer on a Domain Member machine, you would flag that group as a domain group by running the following on the Samba PDC: 

    -root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct
+root# net groupmap add rid=1000 ntgroup="Accounting" UNIXgroup=acct

    - Be aware that the RID parameter is a unsigned 32 bit integer that should - normally start at 1000. However, this rid must not overlap with any RID assigned - to a user. Verifying this is done differently depending on the passdb backend - you are using. Future versions of the tools may perform the verification automatically, + Be aware that the RID parameter is a unsigned 32-bit integer that should + normally start at 1000. However, this RID must not overlap with any RID assigned + to a user. Verification for this is done differently depending on the passdb backend + you are using. Future versions of the tools may perform the verification automatically, but for now the burden is on you. -

    Example Configuration

    - You can list the various groups in the mapping database by executing - net groupmap list. Here is an example: -

    +

    Default Users, Groups and Relative Identifiers

    + + + When first installed, Microsoft Windows NT4/200x/XP are preconfigured with certain User, Group, and + Alias entities. Each has a well-known Relative Identifier (RID). These must be preserved for continued + integrity of operation. Samba must be provisioned with certain essential Domain Groups that require + the appropriate RID value. When Samba-3 is configured to use tdbsam the essential + Domain Groups are automatically created. It is the LDAP administrators' responsibility to create + (provision) the default NT Groups. +

    + Each essential Domain Group must be assigned its respective well-kown RID. The default Users, Groups, + Aliases, and RIDs are shown in . +

    Note

    + When the passdb backend uses LDAP (ldapsam) it is the + admininstrators' responsibility to create the essential Domain Groups, and to assign each its default RID. +

    + It is permissible to create any Domain Group that may be necessary, just make certain that the essential + Domain Groups (well known) have been created and assigned its default RID. Other groups you create may + be assigned any arbitrary RID you care to use. +

    + Be sure to map each Domain Group to a UNIX system group. That is the only way to ensure that the group + will be available for use as an NT Domain Group. +

    +

    Table 12.1. Well-Known User Default RIDs

    Well-Known EntityRIDTypeEssential
    Domain Administrator500UserNo
    Domain Guest501UserNo
    Domain KRBTGT502UserNo
    Domain Admins512GroupYes
    Domain Users513GroupYes
    Domain Guests514GroupYes
    Domain Computers515GroupNo
    Domain Controllers516GroupNo
    Domain Certificate Admins517GroupNo
    Domain Schema Admins518GroupNo
    Domain Enterprise Admins519GroupNo
    Domain Policy Admins520GroupNo
    Builtin Admins544AliasNo
    Builtin users545AliasNo
    Builtin Guests546AliasNo
    Builtin Power Users547AliasNo
    Builtin Account Operators548AliasNo
    Builtin System Operators549AliasNo
    Builtin Print Operators550AliasNo
    Builtin Backup Operators551AliasNo
    Builtin Replicator552AliasNo
    Builtin RAS Servers553AliasNo

    +

    Example Configuration

    + You can list the various groups in the mapping database by executing + net groupmap list. Here is an example: + 

     root#  net groupmap list
-System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin
 Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin
 Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser
 Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest

    For complete details on net groupmap, refer to the net(8) man page. -

    Configuration Scripts

    +

    Configuration Scripts

    Everyone needs tools. Some of us like to create our own, others prefer to use canned tools - (ie: prepared by someone else for general use). -

    Sample smb.conf add group script

    - A script to create complying group names for use by the Samba group interfaces: -

    -

    Example 12.1. smbgrpadd.sh

    +	(i.e., prepared by someone else for general use). 
+	
    Sample smb.conf Add Group Script
    
+		A script to create complying group names for use by the Samba group interfaces
+		is provided in .
+		
    
+
    Example 12.1. smbgrpadd.sh
     
 #!/bin/bash
 
 # Add the group using normal system groupadd tool.
 groupadd smbtmpgrp00
 
-thegid=`cat /etc/group | grep smbtmpgrp00 | cut -d ":" -f3`
+thegid=`cat /etc/group | grep smbtmpgrp00 | cut -d ":" -f3`
 
 # Now change the name to what we want for the MS Windows networking end
 cp /etc/group /etc/group.bak
@@ -124,73 +169,82 @@ echo $thegid
 exit 0
 
    
 
    
-		The smb.conf entry for the above script would look like:
-		
    add group script = /path_to_tool/smbgrpadd.sh %g
    
-		
    Script to configure Group Mapping
    
+		The smb.conf entry for the above script would be something like that in .
+
    Example 12.2. Configuration of smb.conf for the add group script.
     
    [global]
    ...
    add group script = /path_to_tool/smbgrpadd.sh %g
    ...
    
+		
    Script to Configure Group Mapping
    
 		In our example we have created a UNIX/Linux group called ntadmin.
-		Our script will create the additional groups Orks, Elves, Gnomes:
+		Our script will create the additional groups Orks, Elves, and Gnomes.
+		It is a good idea to save this shell script for later re-use just in case you ever need to rebuild your mapping database.
+		For the sake of concenience we elect to save this script as a file called initGroups.sh.
+		This script is given in .
 	
    
-
    +
+
    Example 12.3. Script to Set Group Mapping
     #!/bin/bash
 
-net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin
-net groupmap modify ntgroup="Domain Users" unixgroup=users
-net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
-net groupmap modify ntgroup="Administrators" unixgroup=root
-net groupmap modify ntgroup="Users" unixgroup=users
-net groupmap modify ntgroup="Guests" unixgroup=nobody
-net groupmap modify ntgroup="System Operators" unixgroup=sys
-net groupmap modify ntgroup="Account Operators" unixgroup=root
-net groupmap modify ntgroup="Backup Operators" unixgroup=bin
-net groupmap modify ntgroup="Print Operators" unixgroup=lp
-net groupmap modify ntgroup="Replicators" unixgroup=daemon
-net groupmap modify ntgroup="Power Users" unixgroup=sys
+net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin
+net groupmap modify ntgroup="Domain Users" unixgroup=users
+net groupmap modify ntgroup="Domain Guests" unixgroup=nobody
 
 groupadd Orks
 groupadd Elves
 groupadd Gnomes
 
-net groupmap add ntgroup="Orks"       unixgroup=Orks         type=d
-net groupmap add ntgroup="Elves"      unixgroup=Elves        type=d
-net groupmap add ntgroup="Gnomes"     unixgroup=Gnomes       type=d
-
    
+net groupmap add ntgroup="Orks"   unixgroup=Orks   type=d
+net groupmap add ntgroup="Elves"  unixgroup=Elves  type=d
+net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d
+
    
 
    
 	Of course it is expected that the administrator will modify this to suit local needs.
 	For information regarding the use of the net groupmap tool please
 	refer to the man page.
-

    Common Errors

    +

    Common Errors

    At this time there are many little surprises for the unwary administrator. In a real sense it is imperative that every step of automated control scripts must be carefully tested manually before putting them into active service. -

    Adding Groups Fails

    +

    Adding Groups Fails

    This is a common problem when the groupadd is called directly - by the Samba interface script for the add group script in + by the Samba interface script for the add group script in the smb.conf file.

    The most common cause of failure is an attempt to add an MS Windows group account that has either an upper case character and/or a space character in it.

    - There are three possible work-arounds. Firstly, use only group names that comply + There are three possible work-arounds. First, use only group names that comply with the limitations of the UNIX/Linux groupadd system tool. - The second involves use of the script mentioned earlier in this chapter, and the - third option is to manually create a UNIX/Linux group account that can substitute + Second, it involves the use of the script mentioned earlier in this chapter, and + third is the option is to manually create a UNIX/Linux group account that can substitute for the MS Windows group name, then use the procedure listed above to map that group to the MS Windows group. -

    Adding MS Windows Groups to MS Windows Groups Fails

    - Samba-3 does NOT support nested groups from the MS Windows control environment. -

    Adding Domain Users to the Power Users group

    “ +

    Adding MS Windows Groups to MS Windows Groups Fails

    + Samba-3 does not support nested groups from the MS Windows control environment. +

    Adding Domain Users to the Power Users Group

    “ What must I do to add Domain Users to the Power Users group? - ”

    - The Power Users group is a group that is local to each Windows - 200x / XP Professional workstation. You can not add the Domain Users group to the Power Users - group automatically, this must be done on each workstation by logging in as the local workstation - administrator and then using click on Start / Control Panel / Users and Passwords - now click on the 'Advanced' tab, then on the 'Advanced' Button. -

    - Now click on 'Groups', then double click on 'Power Users'. This will launch the panel to add users - or groups to the local machine 'Power Uses' group. Click on the 'Add' button, select the domain - from which the 'Domain Users' group is to be added, double click on the 'Domain Users' group, then - click on the 'Ok' button. Note: If a logon box is presented during this process please remember to - enter the connect as DOMAIN\UserName. ie: For the domain MIDEARTH and the user 'root' enter - MIDEARTH\root. -

    Prev Up Next
    Chapter 11. Account Information Databases Home Chapter 13. File, Directory and Share Access Controls
    + ”

    + The Power Users group is a group that is local to each Windows 200x/XP Professional workstation. + You cannot add the Domain Users group to the Power Users group automatically, it must be done on + each workstation by logging in as the local workstation administrator and + then using the following procedure: +

    1. + Click Start -> Control Panel -> Users and Passwords. +

    2. + Click the Advanced tab. +

    3. + Click the Advanced button. +

    4. + Click Groups. +

    5. + Double click Power Users. This will launch the panel to add users or groups + to the local machine Power Uses group. +

    6. + Click the Add button. +

    7. + Select the domain from which the Domain Users group is to be added. +

    8. + Double click the Domain Users group. +

    9. + Click the Ok button. If a logon box is presented during this process + please remember to enter the connect as DOMAIN\UserName. i.e., For the + domain MIDEARTH and the user root enter + MIDEARTH\root. +

    Prev Up Next
    Chapter 11. Account Information Databases Home Chapter 13. File, Directory and Share Access Controls
    diff --git a/docs/htmldocs/install.html b/docs/htmldocs/install.html index 02264c558d..5b9d658984 100644 --- a/docs/htmldocs/install.html +++ b/docs/htmldocs/install.html @@ -1,115 +1,130 @@ -Chapter 2. How to Install and Test SAMBA
    Chapter 2. How to Install and Test SAMBA
    Prev Part I. General Installation Next

    Chapter 2. How to Install and Test SAMBA

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Karl Auer

    Table of Contents

    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from another SMB client
    What If Things Don't Work?
    Common Errors
    Large number of smbd processes
    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
    "The network name cannot be found"

    Obtaining and installing samba

    - Binary packages of samba are included in almost any Linux or +Chapter 2. How to Install and Test SAMBA

    Chapter 2. How to Install and Test SAMBA
    Prev Part I. General Installation Next

    Chapter 2. How to Install and Test SAMBA

    Andrew Tridgell

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Karl Auer

    Samba Team

    Dan Shearer

    Samba Team

    Table of Contents

    Obtaining and Installing Samba
    Configuring Samba (smb.conf)
    Configuration file syntax
    Example Configuration
    SWAT
    List Shares Available on the Server
    Connect with a UNIX Client
    Connect from a Remote SMB Client
    What If Things Don't Work?
    Common Errors
    Large Number of smbd Processes
    Error Message: open_oplock_ipc
    The network name cannot be found

    Obtaining and Installing Samba

    + Binary packages of Samba are included in almost any Linux or UNIX distribution. There are also some packages available at - the samba homepage. -

    If you need to compile samba from source, check - the chapter about compiling samba from scratch.

    If you have already installed samba, or if your operating system - was pre-installed with samba, then you may not need to bother with this - chapter. On the other hand, you may want to read this chapter anyhow - for information about updating samba.

    Configuring samba (smb.conf)

    - Samba's configuration is stored in the smb.conf file, - that usually resides in /etc/samba/smb.conf + the Samba homepage. Refer to + the manual of your operating system for details on installing packages + for your specific operating system. +

    If you need to compile Samba from source, check + .

    Configuring Samba (smb.conf)

    + Samba's configuration is stored in the smb.conf file, which + usually resides in /etc/samba/smb.conf or /usr/local/samba/lib/smb.conf. You can either edit this file yourself or do it using one of the many graphical - tools that are available, such as the web-based interface swat, that - is included with samba. -

    Example Configuration

    + tools that are available, such as the Web-based interface SWAT, that + is included with Samba. +

    Configuration file syntax

    The smb.conf file uses the same syntax as the various old + .ini files in Windows 3.1: Each file consists of various sections, + which are started by putting the section name between brackets ([]) + on a new line. Each contains zero or more key/value-pairs seperated by an + equality sign (=). The file is just a plain-text file, so you can + open and edit it with your favorite editing tool.

    Each section in the smb.conf file represents a share + on the Samba server. The section “global” is special, since it + contains settings that apply to the whole Samba server and not + to one share in particular.

    contains a very minimal smb.conf. + +

    Example 2.1. A minimal smb.conf

    [global]
    workgroup = WKG
    netbios name = MYNAME
    [share1]
    path = /tmp
    [share2]
    path = /my_shared_folder
    comment = Some random files

    Example Configuration

    There are sample configuration files in the examples subdirectory in the - distribution. I suggest you read them carefully so you can see how the options - go together in practice. See the man page for all the options. + distribution. It is suggested you read them carefully so you can see how the options + go together in practice. See the man page for all the options. + It might be worthwhile to start out with the smb.conf.default + configuration file and adapt it to your needs. It contains plenty of + comments.

    - The simplest useful configuration file would be something like this: + The simplest useful configuration file would contain something like shown in + .

    -

    Example 2.1. Simplest possible smb.conf file

    [global]
    workgroup = MIDEARTH
    [homes]
    guest ok = no
    read only = no

    + +

    Example 2.2. Another simple smb.conf File

    [global]
    workgroup = MIDEARTH
    [homes]
    guest ok = no
    read only = no

    This will allow connections by anyone with an account on the server, using either - their login name or homes" as the service name. - (Note that the workgroup that Samba must also be set.) + their login name or homes as the service name. + (Note: The workgroup that Samba should appear in must also be set. The default + workgroup name is WORKGROUP.)

    - Make sure you put the smb.conf file in the correct place - (usually in /etc/samba). + Make sure you put the smb.conf file in the correct place.

    For more information about security settings for the [homes] share please refer to - "Securing Samba". -

    Test your config file with testparm

    - It's important that you test the validity of your smb.conf - file using the testparm program. If testparm runs OK - then it will list the loaded services. If not it will give an error message. + . +

    Test Your Config File with testparm

    + It's important to validate the contents of the smb.conf file using the testparm program. + If testparm runs correctly, it will list the loaded services. If not, it will give an error message. + Make sure it runs correctly and that the services look reasonable before proceeding. Enter the command: + 

    +	root#  testparm /etc/samba/smb.conf
+

    Testparm will parse your configuration file and report + any unknown parameters or incorrect syntax.

    + Always run testparm again whenever the smb.conf file is changed! +

    SWAT

    + + SWAT is a Web-based interface that can be used to facilitate the configuration of Samba. + SWAT might not be available in the Samba package that shipped with your platform, + but in a separate package. Please read the SWAT manpage + on compiling, installing and configuring SWAT from source.

    - Make sure it runs OK and that the services look reasonable before proceeding. + To launch SWAT, just run your favorite Web browser and point it to + http://localhost:901/. + Replace localhost with the name of the computer on which + Samba is running if that is a different computer than your browser.

    - Always run testparm again when you change smb.conf! -

    SWAT

    - SWAT is a web-based interface that helps you configure samba. - SWAT might not be available in the samba package on your platform, - but in a separate package. Please read the swat manpage - on compiling, installing and configuring swat from source. -

    - To launch SWAT just run your favorite web browser and - point it at http://localhost:901/. Replace - localhost - with the name of the computer you are running samba on if you - are running samba on a different computer than your browser. -

    - Note that you can attach to SWAT from any IP connected - machine but connecting from a remote machine leaves your - connection open to password sniffing as passwords will be sent - in the clear over the wire. -

    Try listing the shares available on your - server

    +	SWAT can be used from a browser on any IP-connected machine, but be aware that connecting from a remote
+	machine leaves your connection open to password sniffing as passwords will be sent over the wire in the clear. 
+	
    More information about SWAT can be found in .

    List Shares Available on the Server

    + To list shares that are available from the configured Samba server execute the + following command: + 

     $ smbclient -L yourhostname
-

    You should get back a list of shares available on - your server. If you don't then something is incorrectly setup. - Note that this method can also be used to see what shares - are available on other LanManager clients (such as WfWg).

    If you choose user level security then you may find - that Samba requests a password before it will list the shares. - See the smbclient man page for details. (you - can force it to list the shares without a password by - adding the option -U% to the command line. This will not work - with non-Samba servers)

    Try connecting with the unix client

    +

    You should see a list of shares available on your server. If you do not, then + something is incorrectly configured. This method can also be used to see what shares + are available on other SMB servers, such as Windows 2000.

    If you choose user-level security you may find that Samba requests a password + before it will list the shares. See the smbclient man page for details. + You can force it to list the shares without a password by adding the option + -N to the command line.

    Connect with a UNIX Client

    + Enter the following command: 

     $ smbclient  //yourhostname/aservice
-

    Typically the yourhostname - would be the name of the host where you installed smbd. - The aservice is - any service you have defined in the smb.conf - file. Try your user name if you just have a [homes] - section - in smb.conf.

    For example if your unix host is bambi - and your login name is fred you would type:

    +

    Typically yourhostname is the name of the host on which smbd + has been installed. The aservice is any service that has been defined in the smb.conf + file. Try your user name if you just have a [homes] section in the smb.conf file.

    Example: If the UNIX host is called bambi and a valid login name + is fred, you would type:

     $ smbclient //bambi/fred
-

    Try connecting from another SMB client

    Try mounting disks. from a DOS, Windows or OS/2 client, eg:

    +

    Connect from a Remote SMB Client

    Now that Samba is working correctly locally, you can try to + access it from other clients. Within a few minutes, the Samba host + should be listed in the Network Neighborhood on all Windows + clients of its subnet. Try browsing the server from another client + or 'mounting' it.

    Mounting disks from a DOS, Windows or OS/2 client can be done by running a command such as:

     C:\> net use d: \\servername\service
-

    Try printing. eg:

    +

    Try printing, e.g.

     C:\> net use lpt1:	\\servername\spoolservice
 

    C:\> print filename
-

    What If Things Don't Work?

    Then you might read the file chapter diagnosis - and the FAQ. If you are still stuck then refer to "Analysing and solving problems". - Samba has been successfully installed at thousands of sites worldwide, - so maybe someone else has hit your problem and has overcome it.

    Common Errors

    -The following questions and issues get raised on the samba mailing list over and over again. -

    Large number of smbd processes

    -Samba consists on three core programs: -nmbd, smbd, winbindd. nmbd is the name server message daemon, -smbd is the server message daemon, winbindd is the daemon that -handles communication with Domain Controllers. +

    What If Things Don't Work?

    You might want to read . + If you are still stuck, refer to . + Samba has been successfully installed at thousands of sites worldwide. + It is unlikely that your particular problem is unique, so it might be + productive to perform an Internet search to see if someone else has encountered + your problem and has found a way to overcome it.

    Common Errors

    +The following questions and issues are raised repeatedly on the Samba mailing list. +

    Large Number of smbd Processes

    +Samba consists of three core programs: nmbd, smbd, and winbindd. nmbd is the name server message daemon, +smbd is the server message daemon, and winbindd is the daemon that handles communication with Domain Controllers.

    -If your system is NOT running as a WINS server, then there will be one (1) single instance of +If Samba is not running as a WINS server, then there will be one single instance of nmbd running on your system. If it is running as a WINS server then there will be -two (2) instances - one to handle the WINS requests. +two instances one to handle the WINS requests.

    -smbd handles ALL connection requests and then spawns a new process for each client -connection made. That is why you are seeing so many of them, one (1) per client connection. +smbd handles all connection requests. It spawns a new process for each client +connection made. That is why you may see so many of them, one per client connection.

    winbindd will run as one or two daemons, depending on whether or not it is being -run in "split mode" (in which case there will be two instances). -

    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"

    Your loopback device isn't working correctly. Make sure it's configured properly. The loopback device is an internal (virtual) network device with - the ip address 127.0.0.1. Read your OS documentation for details - on how to configure the loopback on your system.

    "The network name cannot be found"

    - This error can be caused by one of these misconfigurations: -

    • You specified an nonexisting path for the share in smb.conf

    • The user you are trying to access the share with does not - have sufficient permissions to access the path for the share. Both read (r) and access (x) should be possible.

    • The share you are trying to access does not exist.

    Prev Up Next
    Chapter 1. Introduction to Samba Home Chapter 3. Fast Start for the Impatient
    +run in split mode (in which case there will be two instances). +

    Error Message: open_oplock_ipc

    An error message is observed in the log files when smbd is started: “open_oplock_ipc: Failed to get local UDP socket + for address 100007f. Error was Cannot assign requested.”

    Your loopback device isn't working correctly. Make sure it is configured correctly. The loopback + device is an internal (virtual) network device with the IP address 127.0.0.1. + Read your OS documentation for details on how to configure the loopback on your system.

    “The network name cannot be found”

    + This error can be caused by one of these misconfigurations: +

    • You specified an nonexisting path + for the share in smb.conf.

    • The user you are trying to access the share with does not + have sufficient permissions to access the path for + the share. Both read (r) and access (x) should be possible.

    • The share you are trying to access does not exist.

    Prev Up Next
    Chapter 1. Introduction to Samba Home Chapter 3. Fast Start for the Impatient
    diff --git a/docs/htmldocs/integrate-ms-networks.html b/docs/htmldocs/integrate-ms-networks.html index 73971d2a72..2e75885499 100644 --- a/docs/htmldocs/integrate-ms-networks.html +++ b/docs/htmldocs/integrate-ms-networks.html @@ -1,121 +1,126 @@ -Chapter 26. Integrating MS Windows networks with Samba
    Chapter 26. Integrating MS Windows networks with Samba
    Prev Part III. Advanced Configuration Next

    Chapter 26. Integrating MS Windows networks with Samba

    John H. Terpstra

    Samba Team

    (Jan 01 2001)

    Table of Contents

    Features and Benefits
    Background Information
    Name Resolution in a pure UNIX/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging works only in one way
    Very Slow Network Connections
    Samba server name change problem

    +Chapter 26. Integrating MS Windows Networks with Samba

    Chapter 26. Integrating MS Windows Networks with Samba
    Prev Part III. Advanced Configuration Next

    Chapter 26. Integrating MS Windows Networks with Samba

    John H. Terpstra

    Samba Team

    (Jan 01 2001)

    Table of Contents

    Features and Benefits
    Background Information
    Name Resolution in a Pure UNIX/Linux World
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name Resolution as Used within MS Windows Networking
    The NetBIOS Name Cache
    The LMHOSTS File
    HOSTS File
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging Works Only in One Way
    Very Slow Network Connections
    Samba Server Name Change Problem

    + This section deals with NetBIOS over TCP/IP name to IP address resolution. If -your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this -section does not apply to your installation. If your installation involves use of +your MS Windows clients are not configured to use NetBIOS over TCP/IP, then this +section does not apply to your installation. If your installation +involves the use of NetBIOS over TCP/IP then this section may help you to resolve networking problems.

    Note

    - NetBIOS over TCP/IP has nothing to do with NetBEUI. NetBEUI is NetBIOS - over Logical Link Control (LLC). On modern networks it is highly advised - to NOT run NetBEUI at all. Note also that there is NO such thing as - NetBEUI over TCP/IP - the existence of such a protocol is a complete - and utter mis-apprehension. -

    Features and Benefits

    +NetBIOS over TCP/IP has nothing to do with NetBEUI. NetBEUI is NetBIOS +over Logical Link Control (LLC). On modern networks it is highly advised +to not run NetBEUI at all. Note also there is no such thing as +NetBEUI over TCP/IP the existence of such a protocol is a complete +and utter misapprehension. +

    Features and Benefits

    Many MS Windows network administrators have never been exposed to basic TCP/IP networking as it is implemented in a UNIX/Linux operating system. Likewise, many UNIX and -Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP based +Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP-based networking (and may have no desire to be either).

    This chapter gives a short introduction to the basics of how a name can be resolved to -it's IP address for each operating system environment. -

    Background Information

    -Since the introduction of MS Windows 2000 it is possible to run MS Windows networking +its IP address for each operating system environment. +

    Background Information

    +Since the introduction of MS Windows 2000, it is possible to run MS Windows networking without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over -TCP/IP is disabled on MS Windows 2000 and later clients then only TCP port 445 will be -used and UDP port 137 and TCP port 139 will not. +TCP/IP is disabled on MS Windows 2000 and later clients, then only the TCP port 445 will be +used and the UDP port 137 and TCP port 139 will not.

    Note

    -When using Windows 2000 or later clients, if NetBIOS over TCP/IP is NOT disabled, then +When using Windows 2000 or later clients, if NetBIOS over TCP/IP is not disabled, then the client will use UDP port 137 (NetBIOS Name Service, also known as the Windows Internet -Name Service or WINS), TCP port 139 AND TCP port 445 (for actual file and print traffic). +Name Service or WINS), TCP port 139 and TCP port 445 (for actual file and print traffic).

    -When NetBIOS over TCP/IP is disabled the use of DNS is essential. Most installations that +When NetBIOS over TCP/IP is disabled, the use of DNS is essential. Most installations that disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS requires - + Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR). - + Use of DHCP with ADS is recommended as a further means of maintaining central control -over client workstation network configuration. -

    Name Resolution in a pure UNIX/Linux world

    +over the client workstation network configuration. +

    Name Resolution in a Pure UNIX/Linux World

    The key configuration files covered in this section are: -

    • /etc/hosts

    • /etc/resolv.conf

    • /etc/host.conf

    • /etc/nsswitch.conf

    /etc/hosts

    -Contains a static list of IP addresses and names. -eg: +

    • /etc/hosts

    • /etc/resolv.conf

    • /etc/host.conf

    • /etc/nsswitch.conf

    /etc/hosts

    +This file contains a static list of IP addresses and names. 

     127.0.0.1	localhost localhost.localdomain
-192.168.1.1	bigbox.caldera.com	bigbox	alias4box
+192.168.1.1	bigbox.quenya.org	bigbox	alias4box

    The purpose of /etc/hosts is to provide a -name resolution mechanism so that uses do not need to remember +name resolution mechanism so uses do not need to remember IP addresses.

    Network packets that are sent over the physical network transport layer communicate not via IP addresses but rather using the Media Access Control address, or MAC address. IP addresses are currently 32 bits in length and are typically presented as four (4) decimal -numbers that are separated by a dot (or period). eg: 168.192.1.1. -

    +numbers that are separated by a dot (or period). For example, 168.192.1.1. +

    + MAC Addresses use 48 bits (or 6 bytes) and are typically represented -as two digit hexadecimal numbers separated by colons. eg: -40:8e:0a:12:34:56 +as two-digit hexadecimal numbers separated by colons: 40:8e:0a:12:34:56.

    -Every network interface must have an MAC address. Associated with -a MAC address there may be one or more IP addresses. There is NO -relationship between an IP address and a MAC address, all such assignments -are arbitrary or discretionary in nature. At the most basic level all -network communications takes place using MAC addressing. Since MAC -addresses must be globally unique, and generally remains fixed for +Every network interface must have a MAC address. Associated with +a MAC address may be one or more IP addresses. There is no +relationship between an IP address and a MAC address; all such assignments +are arbitrary or discretionary in nature. At the most basic level, all +network communications take place using MAC addressing. Since MAC +addresses must be globally unique and generally remain fixed for any particular interface, the assignment of an IP address makes sense from a network management perspective. More than one IP address can -be assigned per MAC address. One address must be the primary IP address, +be assigned per MAC address. One address must be the primary IP +address this is the address that will be returned in the ARP reply.

    -When a user or a process wants to communicate with another machine -the protocol implementation ensures that the "machine name" or "host -name" is resolved to an IP address in a manner that is controlled +When a user or a process wants to communicate with another machine, +the protocol implementation ensures that the “machine name” or “host +name” is resolved to an IP address in a manner that is controlled by the TCP/IP configuration control files. The file /etc/hosts is one such file.

    When the IP address of the destination interface has been -determined a protocol called ARP/RARP is used to identify +determined, a protocol called ARP/RARP is used to identify the MAC address of the target interface. ARP stands for Address -Resolution Protocol, and is a broadcast oriented method that -uses UDP (User Datagram Protocol) to send a request to all -interfaces on the local network segment using the all 1's MAC +Resolution Protocol and is a broadcast-oriented method that +uses User Datagram Protocol (UDP) to send a request to all +interfaces on the local network segment using the all 1s MAC address. Network interfaces are programmed to respond to two MAC addresses only; their own unique address and the address ff:ff:ff:ff:ff:ff. The reply packet from an ARP request will contain the MAC address and the primary IP address for each interface. -

    +

    + The /etc/hosts file is foundational to all UNIX/Linux TCP/IP installations and as a minimum will contain the localhost and local network interface IP addresses and the primary names by which they are known within the local machine. -This file helps to prime the pump so that a basic level of name +This file helps to prime the pump so a basic level of name resolution can exist before any other method of name resolution becomes available. -

    /etc/resolv.conf

    +

    /etc/resolv.conf

    This file tells the name resolution libraries:

    • The name of the domain to which the machine - belongs + belongs.

    • The name(s) of any domains that should be automatically searched when trying to resolve unqualified - host names to their IP address + host names to their IP address.

    • The name or IP address of available Domain - Name Servers that may be asked to perform name to address - translation lookups -

    /etc/host.conf

    + Name Servers that may be asked to perform name-to-address + translation lookups. +

    /etc/host.conf

    + /etc/host.conf is the primary means by -which the setting in /etc/resolv.conf may be affected. It is a -critical configuration file. This file controls the order by +which the setting in /etc/resolv.conf may be effected. It is a +critical configuration file. This file controls the order by which name resolution may proceed. The typical structure is: 

     order hosts,bind
 multi on

    then both addresses should be returned. Please refer to the -man page for host.conf for further details. -

    /etc/nsswitch.conf

    +man page for host.conf for further details. +

    /etc/nsswitch.conf

    + This file controls the actual name resolution targets. The file typically has resolver object specifications as follows: 

    @@ -144,45 +149,47 @@ Of course, each of these mechanisms requires that the appropriate
 facilities and/or services are correctly configured.
 
    
 It should be noted that unless a network request/message must be 
-sent, TCP/IP networks are silent. All TCP/IP communications assumes a 
+sent, TCP/IP networks are silent. All TCP/IP communications assume a 
 principal of speaking only when necessary.
-
    
-Starting with version 2.2.0 samba has Linux support for extensions to 
-the name service switch infrastructure so that linux clients will 
+
    
+
+Starting with version 2.2.0, Samba has Linux support for extensions to 
+the name service switch infrastructure so Linux clients will 
 be able to obtain resolution of MS Windows NetBIOS names to IP 
-Addresses. To gain this functionality Samba needs to be compiled 
-with appropriate arguments to the make command (i.e.: make 
+Addresses. To gain this functionality, Samba needs to be compiled 
+with appropriate arguments to the make command (i.e., make 
 nsswitch/libnss_wins.so). The resulting library should 
 then be installed in the /lib directory and 
-the "wins" parameter needs to be added to the "hosts:" line in 
-the /etc/nsswitch.conf file. At this point it 
+the wins parameter needs to be added to the “hosts:” line in 
+the /etc/nsswitch.conf file. At this point, it 
 will be possible to ping any MS Windows machine by its NetBIOS 
-machine name, so long as that machine is within the workgroup to 
-which both the samba machine and the MS Windows machine belong.
-

    Name resolution as used within MS Windows networking

    +machine name, as long as that machine is within the workgroup to +which both the Samba machine and the MS Windows machine belong. +

    Name Resolution as Used within MS Windows Networking

    MS Windows networking is predicated about the name each machine is given. This name is known variously (and inconsistently) as -the "computer name", "machine name", "networking name", "netbios name", -or "SMB name". All terms mean the same thing with the exception of -"netbios name" which can apply also to the name of the workgroup or the -domain name. The terms "workgroup" and "domain" are really just a +the “computer name,” “machine name,” “networking name,” “netbios name,” +or “SMB name.” All terms mean the same thing with the exception of +“netbios name” that can also apply to the name of the workgroup or the +domain name. The terms “workgroup” and “domain” are really just a simple name with which the machine is associated. All NetBIOS names -are exactly 16 characters in length. The 16th character is reserved. -It is used to store a one byte value that indicates service level +are exactly 16 characters in length. The 16th character is reserved. +It is used to store a one-byte value that indicates service level information for the NetBIOS name that is registered. A NetBIOS machine -name is therefore registered for each service type that is provided by +name is, therefore, registered for each service type that is provided by the client/server.

    -The following are typical NetBIOS name/service type registrations: -

    Table 26.1. Unique NetBIOS names

    MACHINENAME<00>Server Service is running on MACHINENAME
    MACHINENAME<03>Generic Machine Name (NetBIOS name)
    MACHINENAME<20>LanMan Server service is running on MACHINENAME
    WORKGROUP<1b>Domain Master Browser

    Table 26.2. Group Names

    WORKGROUP<03>Generic Name registered by all members of WORKGROUP
    WORKGROUP<1c>Domain Controllers / Netlogon Servers
    WORKGROUP<1d>Local Master Browsers
    WORKGROUP<1e>Internet Name Resolvers

    - + and list typical NetBIOS name/service type registrations. +

    Table 26.1. Unique NetBIOS Names

    MACHINENAME<00>Server Service is running on MACHINENAME
    MACHINENAME<03>Generic Machine Name (NetBIOS name)
    MACHINENAME<20>LanMan Server service is running on MACHINENAME
    WORKGROUP<1b>Domain Master Browser

    Table 26.2. Group Names

    WORKGROUP<03>Generic Name registered by all members of WORKGROUP
    WORKGROUP<1c>Domain Controllers / Netlogon Servers
    WORKGROUP<1d>Local Master Browsers
    WORKGROUP<1e>Internet Name Resolvers

    + It should be noted that all NetBIOS machines register their own names as per the above. This is in vast contrast to TCP/IP installations where traditionally the system administrator will -determine in the /etc/hosts or in the DNS database what names +determine in the /etc/hosts or in the DNS database what names are associated with each IP address. -

    -One further point of clarification should be noted, the /etc/hosts +

    + +One further point of clarification should be noted. The /etc/hosts file and the DNS records do not provide the NetBIOS name type information that MS Windows clients depend on to locate the type of service that may be needed. An example of this is what happens when an MS Windows client @@ -191,38 +198,38 @@ address of a server that provides it by performing a lookup (via a NetBIOS broadcast) for enumeration of all machines that have registered the name type *<1c>. A logon request is then sent to each IP address that is returned in the enumerated list of IP addresses. -Whichever machine first replies then ends up providing the logon services. +Whichever machine first replies, it then ends up providing the logon services.

    -The name "workgroup" or "domain" really can be confusing since these +The name “workgroup” or “domain” really can be confusing since these have the added significance of indicating what is the security -architecture of the MS Windows network. The term "workgroup" indicates +architecture of the MS Windows network. The term “workgroup” indicates that the primary nature of the network environment is that of a -peer-to-peer design. In a WORKGROUP all machines are responsible for -their own security, and generally such security is limited to use of -just a password (known as SHARE MODE security). In most situations -with peer-to-peer networking the users who control their own machines +peer-to-peer design. In a WORKGROUP, all machines are responsible for +their own security, and generally such security is limited to the use of +just a password (known as Share Level security). In most situations +with peer-to-peer networking, the users who control their own machines will simply opt to have no security at all. It is possible to have -USER MODE security in a WORKGROUP environment, thus requiring use +User Level Security in a WORKGROUP environment, thus requiring the use of a user name and a matching password.

    MS Windows networking is thus predetermined to use machine names for all local and remote machine message passing. The protocol used is called Server Message Block (SMB) and this is implemented using the NetBIOS protocol (Network Basic Input Output System). NetBIOS can -be encapsulated using LLC (Logical Link Control) protocol - in which case +be encapsulated using LLC (Logical Link Control) protocol in which case the resulting protocol is called NetBEUI (Network Basic Extended User Interface). NetBIOS can also be run over IPX (Internetworking Packet Exchange) protocol as used by Novell NetWare, and it can be run -over TCP/IP protocols - in which case the resulting protocol is called +over TCP/IP protocols in which case the resulting protocol is called NBT or NetBT, the NetBIOS over TCP/IP.

    MS Windows machines use a complex array of name resolution mechanisms. -Since we are primarily concerned with TCP/IP this demonstration is +Since we are primarily concerned with TCP/IP, this demonstration is limited to this area. -

    The NetBIOS Name Cache

    -All MS Windows machines employ an in memory buffer in which is +

    The NetBIOS Name Cache

    +All MS Windows machines employ an in-memory buffer in which is stored the NetBIOS names and IP addresses for all external -machines that that machine has communicated with over the +machines that machine has communicated with over the past 10-15 minutes. It is more efficient to obtain an IP address for a machine from the local cache than it is to go through all the configured name resolution mechanisms. @@ -230,21 +237,23 @@ configured name resolution mechanisms. If a machine whose name is in the local name cache has been shut down before the name had been expired and flushed from the cache, then an attempt to exchange a message with that machine will be subject -to time-out delays. i.e.: Its name is in the cache, so a name resolution -lookup will succeed, but the machine can not respond. This can be -frustrating for users - but it is a characteristic of the protocol. -

    +to time-out delays. Its name is in the cache, so a name resolution +lookup will succeed, but the machine cannot respond. This can be +frustrating for users but is a characteristic of the protocol. +

    + + The MS Windows utility that allows examination of the NetBIOS -name cache is called "nbtstat". The Samba equivalent of this +name cache is called “nbtstat”. The Samba equivalent of this is called nmblookup. -

    The LMHOSTS file

    -This file is usually located in MS Windows NT 4.0 or -2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains -the IP Address and the machine name in matched pairs. The -LMHOSTS file performs NetBIOS name -to IP address mapping. +

    The LMHOSTS File

    + +This file is usually located in MS Windows NT 4.0 or Windows 200x/XP in the directory +C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address +and the machine name in matched pairs. The LMHOSTS file +performs NetBIOS name to IP address mapping.

    -It typically looks like: +It typically looks like this: 

     # Copyright (c) 1998 Microsoft Corp.
 #
@@ -252,10 +261,10 @@ It typically looks like:
 # over TCP/IP) stack for Windows98
 #
 # This file contains the mappings of IP addresses to NT computernames
-# (NetBIOS) names.  Each entry should be kept on an individual line.
+# (NetBIOS) names. Each entry should be kept on an individual line.
 # The IP address should be placed in the first column followed by the
 # corresponding computername. The address and the computername
-# should be separated by at least one space or tab. The "#" character
+# should be separated by at least one space or tab. The "#" character
 # is generally used to denote the start of a comment (see the exceptions
 # below).
 #
@@ -269,29 +278,29 @@ It typically looks like:
 #      #END_ALTERNATE
 #      \0xnn (non-printing character support)
 #
-# Following any entry in the file with the characters "#PRE" will cause
+# Following any entry in the file with the characters "#PRE" will cause
 # the entry to be preloaded into the name cache. By default, entries are
 # not preloaded, but are parsed only after dynamic name resolution fails.
 #
-# Following an entry with the "#DOM:<domain>" tag will associate the
-# entry with the domain specified by <domain>. This affects how the
+# Following an entry with the "#DOM:<domain>" tag will associate the
+# entry with the domain specified by <domain>. This effects how the
 # browser and logon services behave in TCP/IP environments. To preload
 # the host name associated with #DOM entry, it is necessary to also add a
 # #PRE to the line. The <domain> is always preloaded although it will not
 # be shown when the name cache is viewed.
 #
-# Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT)
+# Specifying "#INCLUDE <filename>" will force the RFC NetBIOS (NBT)
 # software to seek the specified <filename> and parse it as if it were
 # local. <filename> is generally a UNC-based name, allowing a
 # centralized lmhosts file to be maintained on a server.
 # It is ALWAYS necessary to provide a mapping for the IP address of the
 # server prior to the #INCLUDE. This mapping must use the #PRE directive.
-# In addition the share "public" in the example below must be in the
-# LanManServer list of "NullSessionShares" in order for client machines to
+# In addition the share "public" in the example below must be in the
+# LanManServer list of "NullSessionShares" in order for client machines to
 # be able to read the lmhosts file successfully. This key is under
 # \machine\system\currentcontrolset\services\lanmanserver\
 # parameters\nullsessionshares
-# in the registry. Simply add "public" to the list found there.
+# in the registry. Simply add "public" to the list found there.
 #
 # The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
 # statements to be grouped together. Any single successful include
@@ -303,37 +312,38 @@ It typically looks like:
 #
 # The following example illustrates all of these extensions:
 #
-# 102.54.94.97     rhino         #PRE #DOM:networking  #net group's DC
-# 102.54.94.102    "appname  \0x14"                    #special app server
-# 102.54.94.123    popular            #PRE             #source server
-# 102.54.94.117    localsrv           #PRE             #needed for the include
+# 102.54.94.97     rhino     #PRE #DOM:networking  #net group's DC
+# 102.54.94.102    "appname  \0x14"       #special app server
+# 102.54.94.123    popular   #PRE         #source server
+# 102.54.94.117    localsrv  #PRE         #needed for the include
 #
 # #BEGIN_ALTERNATE
 # #INCLUDE \\localsrv\public\lmhosts
 # #INCLUDE \\rhino\public\lmhosts
 # #END_ALTERNATE
 #
-# In the above example, the "appname" server contains a special
-# character in its name, the "popular" and "localsrv" server names are
-# preloaded, and the "rhino" server name is specified so it can be used
-# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
+# In the above example, the "appname" server contains a special
+# character in its name, the "popular" and "localsrv" server names are
+# preloaded, and the "rhino" server name is specified so it can be used
+# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
 # system is unavailable.
 #
 # Note that the whole file is parsed including comments on each lookup,
 # so keeping the number of comments to a minimum will improve performance.
 # Therefore it is not advisable to simply add lmhosts file entries onto the
 # end of this file.
-

    HOSTS file

    -This file is usually located in MS Windows NT 4.0 or 2000 in -C:\WINNT\SYSTEM32\DRIVERS\ETC and contains +

    HOSTS File

    +This file is usually located in MS Windows NT 4.0 or Windows 200x/XP in +the directory C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address and the IP hostname in matched pairs. It can be used by the name resolution infrastructure in MS Windows, depending on how the TCP/IP environment is configured. This file is in every way the equivalent of the UNIX/Linux /etc/hosts file. -

    DNS Lookup

    +

    DNS Lookup

    + This capability is configured in the TCP/IP setup area in the network configuration facility. If enabled, an elaborate name resolution sequence -is followed the precise nature of which is dependant on how the NetBIOS +is followed, the precise nature of which is dependant on how the NetBIOS Node Type parameter is configured. A Node Type of 0 means that NetBIOS broadcast (over UDP broadcast) is used if the name that is the subject of a name lookup is not found in the NetBIOS name @@ -341,46 +351,48 @@ cache. If that fails then DNS, HOSTS and LMHOSTS are checked. If set to Node Type 8, then a NetBIOS Unicast (over UDP Unicast) is sent to the WINS Server to obtain a lookup before DNS, HOSTS, LMHOSTS, or broadcast lookup is used. -

    WINS Lookup

    +

    WINS Lookup

    + A WINS (Windows Internet Name Server) service is the equivalent of the rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores the names and IP addresses that are registered by a Windows client if the TCP/IP setup has been given at least one WINS Server IP Address.

    -To configure Samba to be a WINS server the following parameter needs +To configure Samba to be a WINS server, the following parameter needs to be added to the smb.conf file:

    wins support = Yes

    -To configure Samba to use a WINS server the following parameters are +To configure Samba to use a WINS server, the following parameters are needed in the smb.conf file:

    wins support = No
    wins server = xxx.xxx.xxx.xxx

    where xxx.xxx.xxx.xxx is the IP address of the WINS server.

    For information about setting up Samba as a WINS server, read - the chapter on network browsing.

    Common Errors

    +.

    Common Errors

    TCP/IP network configuration problems find every network administrator sooner or later. The cause can be anything from keyboard mishaps, forgetfulness, simple mistakes, and -carelessness. Of course, no one is every deliberately careless! -

    Pinging works only in one way

    - “I can ping my samba server from Windows, but I can - not ping my Windows machine from the samba server.” +carelessness. Of course, no one is ever deliberately careless! +

    Pinging Works Only in One Way

    + “I can ping my Samba server from Windows, but I cannot ping my Windows + machine from the Samba server.”

    - The Windows machine was at IP Address 192.168.1.2 with netmask 255.255.255.0, the + Answer: The Windows machine was at IP Address 192.168.1.2 with netmask 255.255.255.0, the Samba server (Linux) was at IP Address 192.168.1.130 with netmask 255.255.255.128. The machines were on a local network with no external connections.

    Due to inconsistent netmasks, the Windows machine was on network 192.168.1.0/24, while - the Samba server was on network 192.168.1.128/25 - logically a different network. -

    Very Slow Network Connections

    - A common causes of slow network response includes: -

    • Client is configured to use DNS and DNS server is down

    • Client is configured to use remote DNS server, but remote connection is down

    • Client is configured to use a WINS server, but there is no WINS server

    • Client is NOT configured to use a WINS server, but there is a WINS server

    • Firewall is filtering our DNS or WINS traffic

    Samba server name change problem

    - “The name of the samba server was changed, samba was restarted, samba server can not be + the Samba server was on network 192.168.1.128/25 logically a different network. +

    Very Slow Network Connections

    + A common cause of slow network response includes: +

    • Client is configured to use DNS and the DNS server is down.

    • Client is configured to use remote DNS server, but the + remote connection is down.

    • Client is configured to use a WINS server, but there is no WINS server.

    • Client is not configured to use a WINS server, but there is a WINS server.

    • Firewall is filtering our DNS or WINS traffic.

    Samba Server Name Change Problem

    + “The name of the Samba server was changed, Samba was restarted, Samba server cannot be pinged by new name from MS Windows NT4 Workstation, but it does still respond to ping using the old name. Why?”

    - From this description three (3) things are rather obvious: -

    • WINS is NOT in use, only broadcast based name resolution is used

    • The samba server was renamed and restarted within the last 10-15 minutes

    • The old samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation

    + From this description, three things are obvious: +

    • WINS is not in use, only broadcast-based name resolution is used.

    • The Samba server was renamed and restarted within the last 10-15 minutes.

    • The old Samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation.

    To find what names are present in the NetBIOS name cache on the MS Windows NT4 machine, - open a cmd shell, then: + open a cmd shell and then: 

     C:\> nbtstat -n
@@ -409,7 +421,7 @@ GANDALF	<20>  UNIQUE      192.168.1.1          240

    In the above example, GANDALF is the Samba server and FRODO is the MS Windows NT4 Workstation. - The first listing shows the contents of the Local Name Table (i.e.: Identity information on - the MS Windows workstation), the second shows the NetBIOS name in the NetBIOS name cache. + The first listing shows the contents of the Local Name Table (i.e., Identity information on + the MS Windows workstation) and the second shows the NetBIOS name in the NetBIOS name cache. The name cache contains the remote machines known to this workstation. -

    Prev Up Next
    Chapter 25. PAM based Distributed Authentication Home Chapter 27. Unicode/Charsets
    +

    Prev Up Next
    Chapter 25. PAM-Based Distributed Authentication Home Chapter 27. Unicode/Charsets
    diff --git a/docs/htmldocs/introduction.html b/docs/htmldocs/introduction.html index 10cb806270..16c243214d 100644 --- a/docs/htmldocs/introduction.html +++ b/docs/htmldocs/introduction.html @@ -1,4 +1,3 @@ -Part I. General Installation
    Part I. General Installation
    Prev   Next

    General Installation

    Preparing Samba for Configuration

    This section of the Samba-HOWTO-Collection contains general info on how to install samba +Part I. General Installation

    Part I. General Installation
    Prev   Next

    General Installation

    Preparing Samba for Configuration

    This section of the Samba-HOWTO-Collection contains general info on how to install samba and how to configure the parts of samba you will most likely need. -PLEASE read this.

    Table of Contents

    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and installing samba
    Configuring samba (smb.conf)
    Example Configuration
    SWAT
    Try listing the shares available on your - server
    Try connecting with the unix client
    Try connecting from another SMB client
    What If Things Don't Work?
    Common Errors
    Large number of smbd processes
    "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested"
    "The network name cannot be found"
    3. Fast Start for the Impatient
    Note
    Prev Up Next
    Attributions Home Chapter 1. Introduction to Samba
    +PLEASE read this.

    Table of Contents

    1. Introduction to Samba
    Background
    Terminology
    Related Projects
    SMB Methodology
    Epilogue
    Miscellaneous
    2. How to Install and Test SAMBA
    Obtaining and Installing Samba
    Configuring Samba (smb.conf)
    Configuration file syntax
    Example Configuration
    SWAT
    List Shares Available on the Server
    Connect with a UNIX Client
    Connect from a Remote SMB Client
    What If Things Don't Work?
    Common Errors
    Large Number of smbd Processes
    Error Message: open_oplock_ipc
    The network name cannot be found
    3. Fast Start for the Impatient
    Note
    Prev Up Next
    Attributions Home Chapter 1. Introduction to Samba
    diff --git a/docs/htmldocs/ix01.html b/docs/htmldocs/ix01.html index 6e09e98de4..b428191507 100644 --- a/docs/htmldocs/ix01.html +++ b/docs/htmldocs/ix01.html @@ -1,39 +1,2 @@ -Index
    Index
    Prev   

    Index

    Symbols

    "Domain Admins" group, Discussion
    "Domain Users" group, Adding Domain Users to the Power Users group
    "Printers" folder, Caveats to be considered, Installing the PostScript Driver on a Client, Manual Driver Installation in 15 Steps
    "raw" printing, CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    /etc/host.conf, /etc/host.conf
    /etc/hosts, /etc/hosts
    /etc/nsswitch.conf, /etc/nsswitch.conf
    8.3
    file names, MS Windows NTFS Comparison with UNIX File Systems

    A

    ACLs, File, Directory and Share Access Controls
    Active Directory, Samba ADS Domain Membership
    add group script, Adding Groups Fails
    add machine script, The machine trust account not accessible, Adding Machine to Domain Fails
    add printer command, Adding new Printers with the Windows NT APW
    add printer wizard, Three familiar Methods for driver upload plus a new one
    add user script, Mapping User Identifiers between MS Windows and UNIX
    addprinter command, Parameters Recommended for Use
    admin users, User and Group Based Controls, I have set force user but Samba still makes root the owner of all the files I touch!
    Administrator, Discussion
    ADS (see Active Directory)
    ads server, Setup your smb.conf
    application/cups.vnd-postscript, Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver
    application/octet-stream, Explicitly enable "raw" printing for -application/octet-stream!, MIME type Conversion Rules, "application/octet-stream" printing
    application/pdf, MIME types and CUPS Filters
    application/postscript, Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver
    application/vnd.cups-raster, PostScript Printer Descriptions (PPDs) for non-PS Printers
    application/vnd.cups-raw, Explicitly enable "raw" printing for -application/octet-stream!
    auth methods, auth methods does not work, Passdb Backends and Authentication

    B

    bind interfaces only, The tests
    brlock.tdb, The printing *.tdb Files
    (see also TDB)
    browse list, What is Browsing?, Technical Overview of browsing
    browseable, The [printers] Section, Any [my_printer_name] Section, Parameters in the [print$] Section

    C

    case sensitive, Miscellaneous Controls, Windows 9x / Me Profile Setup
    chpass, Manual Creation of Machine Trust Accounts
    client use spnego, I can't join a Windows 2003 PDC
    comment, The [printers] Section, Any [my_printer_name] Section, Parameters in the [print$] Section
    configure, Building the Binaries
    connections.tdb, The printing *.tdb Files
    (see also TDB)
    core files, Internal errors
    create mask, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask - parameters
    csc policy, Miscellaneous Controls
    CUPS
    Page Accounting, Page Accounting with CUPS
    quotas, Setting up Quotas
    CUPS-PPD, cupsomatic, pdqomatic, lpdomatic, directomatic
    cupsaddsmb, Three familiar Methods for driver upload plus a new one, cupsaddsmb: the unknown Utility, Caveats to be considered, Run "cupsaddsmb" (quiet Mode), Run "cupsaddsmb" with verbose Output, Understanding cupsaddsmb, cupsaddsmb with a Samba PDC, cupsaddsmb Flowchart
    cupsomatic, CUPS can use all Windows-formatted Vendor PPDs, The CUPS Filtering Architecture, cupsomatic/Foomatic -- how do they fit into the Picture?, Difference between cupsomatic/foomatic-rip and -native CUPS printing, cupsomatic, pdqomatic, lpdomatic, directomatic
    CVS, Access Samba source code via CVS
    web, Access via CVSweb

    D

    daemon, Alternative: starting it as a daemon
    DDK, PostScript Drivers with no major problems -- even in Kernel -Mode, CUPS Package of "PostScript Driver for WinNT/2k/XP"
    debug, Internal errors
    debug level, Debugging with Samba itself, Log level
    debuglevel, Debug levels
    default case, Miscellaneous Controls
    delete printer command, Adding new Printers with the Windows NT APW
    deleteprinter command, Parameters Recommended for Use
    DHCP, Background Information
    diff, Patches
    directory mask, File and Directory Permissions Based Controls
    directory security mask, Interaction with the standard Samba create mask - parameters
    disable spoolss, Parameters Recommended for Use
    display charset, Samba and charsets
    DNS, TCP/IP - without NetBIOS, DNS Lookup
    Active Directory, DNS and Active Directory
    Dynamic, Background Information
    dns proxy, What is Browsing?
    domain admin group, Mapping MS Windows and UNIX Groups
    domain logons, Preparing for Domain Control
    domain master, Domain Network Logon Service, Example Configuration, What is Browsing?, Making Samba the domain master
    dont descend, Miscellaneous Controls
    dos charset, Samba and charsets, Japanese charsets, CP850.so can't be found
    dos filemode, File and Directory Permissions Based Controls
    dos filetime resolution, Miscellaneous Controls
    dos filetimes, Miscellaneous Controls

    E

    EMF, Windows Drivers, GDI and EMF, From Windows Clients to an NT Print Server, Driver Execution on the Server
    encrypt passwords, Joining an NT4 type Domain with Samba-3, smbpasswd - Encrypted Password Database, smb.conf PAM Configuration, The tests
    enhanced browsing, What is Browsing?
    enumports command, Parameters Recommended for Use, Samba and Printer Ports
    EPM (see ESP meta packager)
    ESC/P, Driver Execution on the Server
    ESP
    Ghostscript, The CUPS Filtering Architecture, Difference between cupsomatic/foomatic-rip and -native CUPS printing
    meta packager, CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Print Pro, Sources of CUPS drivers / PPDs, ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Extended Attributes, File, Directory and Share Access Controls

    F

    fake oplocks, Miscellaneous Controls
    File System, File System Access Controls
    foomatic, CUPS can use all Windows-formatted Vendor PPDs, The CUPS Filtering Architecture, cupsomatic/Foomatic -- how do they fit into the Picture?, Difference between cupsomatic/foomatic-rip and -native CUPS printing, foomatic-rip and Foomatic explained, Foomatic's strange Name
    foomatic-rip, Difference between cupsomatic/foomatic-rip and -native CUPS printing, CUPS Print Drivers from Linuxprinting.org, foomatic-rip and Foomatic explained, The Grand Unification -achieved...
    force create mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask - parameters
    force directory mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask - parameters
    force directory security mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask - parameters
    force group, User and Group Based Controls
    force security mode, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask - parameters
    force user, User and Group Based Controls, I have set force user but Samba still makes root the owner of all the files I touch!, Beware of Force User
    ftp, Accessing the samba sources via rsync and ftp

    G

    gdb, Internal errors
    GDI, GDI on Windows -- PostScript on UNIX, Windows Drivers, GDI and EMF, From Windows Clients to an NT Print Server, Driver Execution on the Server
    GhostScript, PostScript and Ghostscript, Ghostscript -- the Software RIP for non-PostScript Printers
    (see also PostScript)
    Ghostscript
    ESP (see ESP GhostScript)
    GID, Features and Benefits
    GPG, Verifying Samba's PGP signature
    groupadd, Features and Benefits
    groupdel, Features and Benefits
    groups
    domain, Discussion
    mapping, Mapping MS Windows and UNIX Groups
    nested, Adding MS Windows Groups to MS Windows Groups Fails
    guest account, Problem resolution, My client reports "This server is not configured to list shared resources", The [printers] Section
    guest ok, User and Group Based Controls, The [printers] Section, Any [my_printer_name] Section, Parameters in the [print$] Section

    H

    hide dot files, Miscellaneous Controls
    hide files, Miscellaneous Controls
    hide unreadable, File and Directory Permissions Based Controls
    hide unwriteable files, File and Directory Permissions Based Controls
    host msdfs, Features and Benefits
    hosts allow, Using host based protection, Parameters Recommended for Use, Any [my_printer_name] Section
    hosts deny, Using host based protection, Parameters Recommended for Use, Any [my_printer_name] Section

    I

    idmap gid, Features and Benefits, Winbind is not resolving users and groups
    idmap uid, Features and Benefits, Winbind is not resolving users and groups
    ifconfig, Starting from inetd.conf
    imprints, Three familiar Methods for driver upload plus a new one
    inetd, The tests, Starting the smbd and nmbd, Starting from inetd.conf
    Interdomain Trusts, Interdomain Trust Relationships
    completing, Completing an NT4 Domain Trust
    creating, Native MS Windows NT4 Trusts Configuration
    Facilities, Inter-Domain Trust Facilities
    interfaces, Multiple interfaces, The tests, Starting from inetd.conf
    invalid users, User and Group Based Controls
    IPP, Understanding cupsaddsmb

    K

    KDC, Samba ADS Domain Membership
    Kerberos, Samba ADS Domain Membership
    kinit, Setup your /etc/krb5.conf

    L

    ldap admin dn, Configuring Samba
    ldap delete dn, Configuring Samba
    ldap filter, Configuring Samba
    ldap machine suffix, Configuring Samba
    ldap passwd sync, Configuring Samba, Password synchronisation
    ldap ssl, Configuring Samba, Security and sambaSamAccount
    ldap suffix, Configuring Samba
    ldap trust ids, Configuring Samba
    ldap user suffix, Configuring Samba
    libnss_wins.so, /etc/nsswitch.conf
    Links
    hard, MS Windows NTFS Comparison with UNIX File Systems
    soft, MS Windows NTFS Comparison with UNIX File Systems
    Linuxprinting.org, CUPS Print Drivers from Linuxprinting.org
    lm announce, What is Browsing?
    lm interval, What is Browsing?
    LMB (see Local Master Browser)
    LMHOSTS, The LMHOSTS file
    load printers, Parameters Recommended for Use, A little Experiment to warn you, The [global] Section
    local master, What is Browsing?, Setting up WORKGROUP Browsing
    Local Master Browser, Use of the Remote Announce parameter
    locking, Discussion
    locking.tdb, The printing *.tdb Files
    (see also TDB)
    log files
    monitoring, Assumptions
    log level, Adding Machine to Domain Fails, extd_audit, Debug levels
    logon drive, Windows NT4 Workstation
    logon home, LDAP special attributes for sambaSamAccounts, Windows 9x / Me User Profiles, Mixed Windows 9x / Me and Windows NT4/200x User Profiles, Windows NT4 Workstation, Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    logon path, LDAP special attributes for sambaSamAccounts, Mixed Windows 9x / Me and Windows NT4/200x User Profiles, Windows 9x / Me Profile Setup, Windows NT4 Workstation, Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    logon script, LDAP special attributes for sambaSamAccounts
    lpadmin, CUPS Print Drivers from Linuxprinting.org, Setting up Quotas
    lppause command, Parameters Recommended for Use, Linking of smbd with libcups.so, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions
    lpq cache time, Parameters Recommended for Use, The [global] Section
    lpq command, Parameters Recommended for Use, Linking of smbd with libcups.so, Pre-conditions
    lpresume command, Parameters Recommended for Use, Linking of smbd with libcups.so, Pre-conditions
    lprm command, Parameters Recommended for Use, Linking of smbd with libcups.so, Pre-conditions
    lpstat, Troubleshooting revisited

    M

    MAC Addresses, /etc/hosts
    machine trust accounts, MS Windows Workstation/Server Machine Trust Accounts
    creating, MS Windows Workstation/Server Machine Trust Accounts
    make, Building the Binaries
    mangling method, Japanese charsets
    map to guest, Parameters in the [print$] Section, Adding new Printers with the Windows NT APW, Can't reconnect to Samba under new account - from Win2K/XP, Avoid being connected to the Samba server as the - "wrong" user
    max print jobs, Parameters Recommended for Use
    max xmit, Max xmit
    messages.tdb, The printing *.tdb Files
    (see also TDB)
    MIME, MIME types and CUPS Filters, MIME type Conversion Rules, Filter Requirements, "application/octet-stream" printing
    min print space, Parameters Recommended for Use
    msdfs root, Features and Benefits

    N

    name resolve order, What is Browsing?
    nbtstat, The NetBIOS Name Cache
    NetBIOS, Features and Benefits, TCP/IP - without NetBIOS, Integrating MS Windows networks with Samba, Name resolution as used within MS Windows networking
    NetBIOS-less, TCP/IP - without NetBIOS
    nmblookup, The NetBIOS Name Cache
    nt acl support, File and Directory Permissions Based Controls, Viewing file ownership, Viewing File or Directory Permissions, Modifying file or directory permissions, Windows 2000 Service Pack 2
    ntdrivers.tdb, The printing *.tdb Files
    (see also TDB)
    ntforms.tdb, The printing *.tdb Files
    (see also TDB)
    NTFS, File System Access Controls
    ntprinters.tdb, The printing *.tdb Files
    (see also TDB)

    O

    obey pam restrictions, smb.conf PAM Configuration
    only user, User and Group Based Controls, Why can users access home directories of other users?
    oplock break wait time, Advanced Samba Opportunistic Locking Parameters, Disabling Kernel OpLocks
    oplock contention limit, Advanced Samba Opportunistic Locking Parameters
    os level, What is Browsing?, Setting up WORKGROUP Browsing, Setting up DOMAIN Browsing, Forcing Samba to be the master, Making Samba the domain master
    os2 driver map, Parameters Recommended for Use, Printer driver download for for OS/2 clients?

    P

    page_log, The page_log File Syntax
    passdb backend, MS Windows Workstation/Server Machine Trust Accounts, Account Information Databases, Technical Information, The pdbedit Command, Configuring Samba, Configuring, Users can not logon, auth methods does not work, Passdb Backends and Authentication
    password level, Password checking, The tests, Case handling of passwords, Slow Logins
    password server, Server Security (User Level Security), Security Mode and Master Browsers, Joining an NT4 type Domain with Samba-3, The tests
    patch, Patches
    path, "The network name cannot be found", The [printers] Section, Any [my_printer_name] Section, Print Commands, Creating the [print$] Share, Parameters in the [print$] Section, Subdirectory Structure in [print$], Samba receiving Jobfiles and passing them to CUPS, Auto-Deletion or Preservation of CUPS Spool Files, Permissions on -/var/spool/samba/ get reset after each -reboot, The tests
    PCL, GDI on Windows -- PostScript on UNIX, UNIX Printfile Conversion and GUI Basics, Driver Execution on the Server, Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PDF, Windows Drivers, GDI and EMF, PostScript Printer Description (PPD) Specification
    pdf, MIME type Conversion Rules
    PDL, GDI on Windows -- PostScript on UNIX, PostScript and Ghostscript
    PJL, Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs, Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver, Adobe and CUPS PostScript Drivers for Windows Clients
    point and print, Driver Installation Methods on Windows Clients, Three familiar Methods for driver upload plus a new one, cupsomatic/Foomatic -- how do they fit into the Picture?, Run "cupsaddsmb" (quiet Mode), Installing the PostScript Driver on a Client, Manual Driver Installation in 15 Steps
    PostScript, Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download, GDI on Windows -- PostScript on UNIX, UNIX Printfile Conversion and GUI Basics, PostScript and Ghostscript, Prefilters, Driver Execution on the Server, Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs, CUPS: a "Magical Stone"?, CUPS Package of "PostScript Driver for WinNT/2k/XP"
    (see also Ghostscript)
    RIP, PostScript and Ghostscript
    PPD, PostScript and Ghostscript, PostScript Printer Description (PPD) Specification, PostScript Printer Descriptions (PPDs) for non-PS Printers, PPDs for non-PS Printers on UNIX, PPDs for non-PS Printers on Windows, CUPS: a "Magical Stone"?, Installing the PostScript Driver on a Client
    CUPS (see CUPS-PPD)
    preferred master, What is Browsing?, Setting up WORKGROUP Browsing, Forcing Samba to be the master, Making Samba the domain master, The tests
    preserve case, Windows 9x / Me Profile Setup
    print command, Parameters Recommended for Use, The [global] Section, Default Print Commands for various UNIX Print Subsystems, Setting up your own Print Commands, Linking of smbd with libcups.so, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions, Manual Configuration
    print ok , Parameters Recommended for Use
    printable, Parameters Recommended for Use, The [printers] Section, Any [my_printer_name] Section
    printcap, Parameters Recommended for Use, Default Print Commands for various UNIX Print Subsystems, Basic Configuration of CUPS support, Linking of smbd with libcups.so, More complex smb.conf Settings for -CUPS, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions
    printcap name, Parameters Recommended for Use, The [global] Section
    printer, Parameters Recommended for Use
    printer admin, Parameters Recommended for Use, The [global] Section, Any [my_printer_name] Section, Parameters in the [print$] Section, Setting Drivers for existing Printers with a Client GUI, IMPORTANT! Setting Device Modes on new Printers, Always make first Client Connection as root or "printer admin", Setting Default Print Options for the Client Drivers, Adding new Printers with the Windows NT APW, More complex smb.conf Settings for -CUPS, What is required for adddriver and setdriver to succeed, Print options for all users can't be set on Win2K/XP
    printer name, Parameters Recommended for Use
    printing, Parameters Recommended for Use, The [global] Section, Default Print Commands for various UNIX Print Subsystems, Setting up your own Print Commands, Basic Configuration of CUPS support, Linking of smbd with libcups.so, More complex smb.conf Settings for -CUPS, From Windows Clients to a CUPS/Samba Print Server, Pre-conditions, Manual Configuration
    printing.tdb, The printing *.tdb Files
    (see also TDB)
    PrintPro (see ESP Print Pro)
    public, The [printers] Section

    Q

    queue resume command, Linking of smbd with libcups.so
    queuepause command, Parameters Recommended for Use, Linking of smbd with libcups.so
    queueresume command, Parameters Recommended for Use

    R

    read list, User and Group Based Controls
    read only, Miscellaneous Controls, The [printers] Section, Parameters in the [print$] Section
    read raw, Read raw
    read size, Read size
    remote announce, NetBIOS over TCP/IP, How Browsing Functions, Use of the Remote Announce parameter, Browsing support in Samba
    remote browse sync, NetBIOS over TCP/IP, How Browsing Functions, Use of the Remote Browse Sync parameter
    root preexec, Logon Scripts
    rpcclient
    adddriver, Run "cupsaddsmb" with verbose Output, Understanding cupsaddsmb, Installing PostScript Driver Files manually (using -rpcclient), Understanding the rpcclient man page, What is required for adddriver and setdriver to succeed, Manual Driver Installation in 15 Steps
    enumdrivers, Installing PostScript Driver Files manually (using -rpcclient), Manual Driver Installation in 15 Steps
    enumports, Installing PostScript Driver Files manually (using -rpcclient)
    enumprinters, Installing PostScript Driver Files manually (using -rpcclient), What is required for adddriver and setdriver to succeed, Manual Driver Installation in 15 Steps, Troubleshooting revisited
    getdriver, Producing an Example by querying a Windows Box, Manual Driver Installation in 15 Steps
    getprinter, Producing an Example by querying a Windows Box, Manual Driver Installation in 15 Steps, Troubleshooting revisited
    setdriver, Caveats to be considered, Run "cupsaddsmb" with verbose Output, Understanding cupsaddsmb, Installing PostScript Driver Files manually (using -rpcclient), What is required for adddriver and setdriver to succeed, Manual Driver Installation in 15 Steps
    rsync, Accessing the samba sources via rsync and ftp

    S

    secrets.tdb, The printing *.tdb Files
    (see also TDB)
    security, Samba Security Modes, Domain Security Mode (User Level Security), Server Security (User Level Security), What makes Samba a SERVER?, What makes Samba a Domain Controller?, What makes Samba a Domain Member?, Constantly Losing Connections to Password Server, Preparing for Domain Control, Security Mode and Master Browsers, Joining an NT4 type Domain with Samba-3, Why is this better than security = server?, Setup your smb.conf, Run "cupsaddsmb" (quiet Mode), "cupsaddsmb" keeps asking for root password in - neverending loop, Passdb Backends and Authentication, The tests, Configuring WfW password handling
    security mask, File and Directory Permissions Based Controls, Interaction with the standard Samba create mask - parameters
    Server Manager, MS Windows Workstation/Server Machine Trust Accounts, Manual Creation of Machine Trust Accounts
    sessionid.tdb, The printing *.tdb Files
    (see also TDB)
    share_info.tdb, The printing *.tdb Files
    (see also TDB)
    short preserve case, Miscellaneous Controls, Windows 9x / Me Profile Setup
    Short-Cuts, MS Windows NTFS Comparison with UNIX File Systems
    show add printer wizard, Parameters Recommended for Use, The [global] Section, Adding new Printers with the Windows NT APW
    SID, Features and Benefits
    Single Sign On, Caveats to be considered
    smbclient, Testing with smbclient, The tests
    socket options, Socket options
    spooling
    central, Central spooling vs. "Peer-to-Peer" printing
    peer-to-peer, Central spooling vs. "Peer-to-Peer" printing
    spooling-only, CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    strict locking, Discussion

    T

    TDB, The printing *.tdb Files, Trivial DataBase Files
    backing up (see tdbbackup)
    tdbbackup, Using tdbbackup
    template homedir, Linux/FreeBSD-specific PAM configuration
    testparm, The tests
    text/plain, MIME type Conversion Rules
    total print jobs, Parameters Recommended for Use, The [global] Section

    U

    UDP, NetBIOS over TCP/IP
    UID, Features and Benefits
    unexpected.tdb, The printing *.tdb Files
    (see also TDB)
    unix charset, Samba and charsets, Japanese charsets
    use client driver, Parameters Recommended for Use, The [global] Section
    user, Share Level Security, The tests
    User Manager, Samba as the Trusted Domain, Samba as the Trusting Domain
    useradd, Manual Creation of Machine Trust Accounts
    username, User and Group Based Controls
    username level, Password checking
    username map, Windows 200x XP Professional

    V

    valid users, User and Group Based Controls, The tests
    veto files, Miscellaneous Controls
    vfs objects, Discussion
    vipw, Manual Creation of Machine Trust Accounts

    W

    winbind separator, Start up the winbindd daemon and test it!
    WINS, What is Browsing?, NetBIOS over TCP/IP, WINS Lookup
    wins hook, What is Browsing?
    wins proxy, What is Browsing?
    wins server, What is Browsing?, WINS - The Windows Internetworking Name Server, Setting up a WINS server
    wins support, What is Browsing?, WINS - The Windows Internetworking Name Server, Setting up a WINS server
    workgroup, Security Mode and Master Browsers, Joining an NT4 type Domain with Samba-3, Browsing support in Samba
    write list, User and Group Based Controls, Parameters in the [print$] Section
    write raw, Write raw
    writeable, The [printers] Section, Any [my_printer_name] Section
    WYSIWYG, Windows Drivers, GDI and EMF

    X

    X Window System, UNIX Printfile Conversion and GUI Basics
    xinetd, Starting from inetd.conf (see inetd)
    Xprint, UNIX Printfile Conversion and GUI Basics
    Prev Up 
    Chapter 41. Further Resources Home 
    +Index
    Index
    Prev   

    Index

    Symbols

    "Printers" folder, Caveats to be Considered, Installing the PostScript Driver on a Client, Manual Driver Installation in 15 Steps
    "raw" printing, Raw Print Serving Vendor Drivers on Windows Clients
    /etc/cups/mime.convs, Explicitly Enable raw Printing for application/octet-stream
    /etc/cups/mime.types, Explicitly Enable raw Printing for application/octet-stream
    /etc/host.conf, /etc/host.conf
    /etc/hosts, /etc/hosts
    /etc/krb5.conf, Configure /etc/krb5.conf
    /etc/nsswitch.conf, /etc/nsswitch.conf
    8.3 file names, MS Windows NTFS Comparison with UNIX File Systems

    A

    Account Controls, Managing Account/User Policies
    ACLs, File, Directory and Share Access Controls
    File System, File and Directory Access Control
    POSIX, File, Directory and Share Access Controls, Features and Benefits
    share, Features and Benefits
    Windows, Features and Benefits
    Active Directory, Samba ADS Domain Membership
    add group script, Adding Groups Fails
    add machine script, The Machine Trust Account Is Not Accessible, Managing Domain Machine Accounts using NT4 Server Manager, Adding Machine to Domain Fails
    add printer command, Adding New Printers with the Windows NT APW
    add printer wizard, Driver Upload Methods
    add user script, Mapping User Identifiers between MS Windows and UNIX
    admin users, User and Group-Based Controls, File Operations Done as root with force user Set
    Administrator, Discussion
    ADS (see Active Directory)
    application/cups.vnd-postscript, Windows CUPS PostScript Driver Versus Adobe Driver
    application/octet-stream, Explicitly Enable raw Printing for application/octet-stream, MIME Type Conversion Rules, application/octet-stream Printing
    application/pdf, MIME Types and CUPS Filters, MIME Type Conversion Rules
    application/postscript, Windows CUPS PostScript Driver Versus Adobe Driver
    application/vnd.cups-raster, PostScript Printer Descriptions (PPDs) for Non-PS Printers
    application/vnd.cups-raw, Explicitly Enable raw Printing for application/octet-stream
    auth methods, Configuration of auth methods, Passdb Backends and Authentication

    B

    bad hardware, Browsing of Shares and Directories is Very Slow
    brlock.tdb, The Printing *.tdb Files
    (see also TDB)
    browsable, Simple Print Configuration
    browse list, What Is Browsing?, Technical Overview of Browsing
    browseable, Simple Print Configuration, The [printers] Section, Any [my_printer_name] Section, [print$] Section Parameters
    browsing problems, I get an `Unable to browse the network' error

    C

    case sensitive, Miscellaneous Controls, Windows 9x/Me Profile Setup
    chpass, Manual Creation of Machine Trust Accounts
    client use spnego, I Can't Join a Windows 2003 PDC
    comment, The [printers] Section, Any [my_printer_name] Section, [print$] Section Parameters
    Config.POL, Creating and Managing System Policies
    configure, Building the Binaries
    connections.tdb, The Printing *.tdb Files
    (see also TDB)
    core files, Internal Errors
    create mask, File and Directory Permissions-Based Controls, Interaction with the Standard Samba create mask Parameters
    csc policy, Miscellaneous Controls
    CUPS
    Page Accounting, Page Accounting with CUPS
    quotas, Setting Up Quotas
    CUPS-PPD, cupsomatic, pdqomatic, lpdomatic, directomatic
    cupsaddsmb, Driver Upload Methods, cupsaddsmb: The Unknown Utility, Caveats to be Considered, Run cupsaddsmb (Quiet Mode), Run cupsaddsmb with Verbose Output, Understanding cupsaddsmb, cupsaddsmb with a Samba PDC, cupsaddsmb Flowchart
    cupsomatic, Using Windows-Formatted Vendor PPDs, The CUPS Filtering Architecture, The Role of cupsomatic/foomatic, cupsomatic/foomatic-rip Versus native CUPS Printing, cupsomatic, pdqomatic, lpdomatic, directomatic
    CVS, Introduction
    web, Access via CVSweb

    D

    daemon, Alternative: Starting smbd as a Daemon
    DDK, PostScript Drivers with No Major Problems Even in Kernel +Mode, CUPS PostScript Driver for Windows NT/200x/XP
    debug, Internal Errors
    debug level, Debugging with Samba Itself, Log Level
    debuglevel, Debug Levels
    default case, Miscellaneous Controls
    default profile, Default Profile for Windows Users, Changing the Default Profile
    delete printer command, Adding New Printers with the Windows NT APW
    delete roaming profiles, MS Windows 200x/XP
    DHCP, Background Information
    diff, Patches
    directory mask, File and Directory Permissions-Based Controls
    directory security mask, Interaction with the Standard Samba create mask Parameters
    Directory Separators, MS Windows NTFS Comparison with UNIX File Systems
    display charset, Samba and Charsets, Enabling SWAT Internationalization Support
    DNS, TCP/IP without NetBIOS, DNS Lookup
    Active Directory, DNS and Active Directory
    Dynamic, Background Information
    dns proxy, What Is Browsing?
    domain admin group, Group Mapping MS Windows and UNIX
    Domain Admins group, Discussion
    domain logons, Preparing for Domain Control
    domain master, Domain Network Logon Service, Example Configuration, What Is Browsing?, Making Samba the Domain Master
    Domain Member, Domain Security Mode (User Level Security)
    joining, Example Configuration
    domain security, Features and Benefits
    Domain Users group, Adding Domain Users to the Power Users Group
    dont descend, Miscellaneous Controls
    dos charset, Samba and Charsets, Japanese Charsets, CP850.so Can't Be Found
    dos filemode, File and Directory Permissions-Based Controls
    dos filetime resolution, Miscellaneous Controls
    dos filetimes, Miscellaneous Controls
    Drive Identification, MS Windows NTFS Comparison with UNIX File Systems

    E

    editreg, Samba Editreg Toolset
    EMF, Windows Drivers, GDI and EMF, From Windows Clients to an NT Print Server, Driver Execution on the Server
    encrypt passwords, Joining an NT4-type Domain with Samba-3, smbpasswd Encrypted Password Database, smb.conf PAM Configuration, Quick Migration Guide, The Tests
    encrypted passwords, Features and Benefits, Technical Information, Using Plaintext Passwords or Encrypted Password
    enhanced browsing, What Is Browsing?
    enumports command, Samba and Printer Ports
    EPM (see ESP meta packager)
    ESC/P, Driver Execution on the Server
    ESP
    Ghostscript, The CUPS Filtering Architecture, cupsomatic/foomatic-rip Versus native CUPS Printing
    meta packager, CUPS PostScript Driver for Windows NT/200x/XP
    Print Pro, Sources of CUPS Drivers/PPDs, ESP Print Pro PostScript Driver for Windows NT/200x/XP
    Event Viewer, Remote Server Administration
    Extended Attributes, File, Directory and Share Access Controls

    F

    fake oplocks, Miscellaneous Controls
    File Naming Conventions, MS Windows NTFS Comparison with UNIX File Systems
    File System, MS Windows NTFS Comparison with UNIX File Systems
    case sensitivity, MS Windows NTFS Comparison with UNIX File Systems
    feature comparison, MS Windows NTFS Comparison with UNIX File Systems
    UNIX, MS Windows NTFS Comparison with UNIX File Systems
    Windows, MS Windows NTFS Comparison with UNIX File Systems
    flush name cache, How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?
    foomatic, Using Windows-Formatted Vendor PPDs, The CUPS Filtering Architecture, The Role of cupsomatic/foomatic, cupsomatic/foomatic-rip Versus native CUPS Printing, foomatic-rip and Foomatic Explained, Foomatic's Strange Name
    foomatic-rip, cupsomatic/foomatic-rip Versus native CUPS Printing, CUPS Print Drivers from Linuxprinting.org, foomatic-rip and Foomatic Explained, The Grand Unification Achieved
    force create mode, File and Directory Permissions-Based Controls, Interaction with the Standard Samba create mask Parameters
    force directory mode, File and Directory Permissions-Based Controls, Interaction with the Standard Samba create mask Parameters
    force directory security mode, File and Directory Permissions-Based Controls, Interaction with the Standard Samba create mask Parameters
    force group, User and Group-Based Controls
    force security mode, File and Directory Permissions-Based Controls, Interaction with the Standard Samba create mask Parameters
    force user, User and Group-Based Controls, File Operations Done as root with force user Set, Beware of Force User
    ftp, Accessing the Samba Sources via rsync and ftp

    G

    gdb, Internal Errors
    GDI, GDI on Windows -- PostScript on UNIX, Windows Drivers, GDI and EMF, From Windows Clients to an NT Print Server, Driver Execution on the Server
    genlogon.pl, Network Logon Script Magic
    GhostScript, PostScript and Ghostscript, Ghostscript the Software RIP for Non-PostScript Printers
    (see also PostScript)
    Ghostscript
    ESP (see ESP GhostScript)
    GID, Features and Benefits
    GPG, Verifying Samba's PGP Signature
    GPOs, Features and Benefits, MS Windows 200x/XP Professional Policies, Administration of Windows 200x/XP Policies, Managing Account/User Policies, MS Windows 200x/XP
    group policies, Features and Benefits
    group policy objects (see GPOs)
    group profiles, Creating and Managing Group Profiles
    groupadd, Features and Benefits
    groupdel, Features and Benefits
    groups
    domain, Discussion
    mapping, Group Mapping MS Windows and UNIX
    nested, Adding MS Windows Groups to MS Windows Groups Fails
    guest account, Problem Resolution, Server Resources Can Not Be Listed, The [printers] Section
    guest ok, User and Group-Based Controls, The [printers] Section, Any [my_printer_name] Section, [print$] Section Parameters

    H

    hide dot files, Miscellaneous Controls
    hide files, Miscellaneous Controls
    hide unreadable, File and Directory Permissions-Based Controls
    hide unwriteable files, File and Directory Permissions-Based Controls
    host msdfs, Features and Benefits
    hosts allow, Using Host-Based Protection, Any [my_printer_name] Section
    hosts deny, Using Host-Based Protection, Any [my_printer_name] Section

    I

    idmap backend, Example Configuration
    idmap gid, Features and Benefits, Winbind Is Not Resolving Users and Groups, Winbind Is Not Resolving Users and Groups
    idmap uid, Features and Benefits, Winbind Is Not Resolving Users and Groups, Winbind Is Not Resolving Users and Groups
    ifconfig, Starting from inetd.conf
    imprints, Driver Upload Methods
    inetd, The Tests, Starting the smbd and nmbd, Starting from inetd.conf
    initGroups.sh, Script to Configure Group Mapping, Steps in Migration Process
    Interdomain Trusts, Interdomain Trust Relationships
    Completing, Completing an NT4 Domain Trust
    creating, Native MS Windows NT4 Trusts Configuration
    Facilities, Inter-Domain Trust Facilities
    interfaces, Multiple Interfaces, Problem Resolution, The Tests, Starting from inetd.conf
    invalid users, User and Group-Based Controls
    IPP, Understanding cupsaddsmb

    K

    KDC, Samba ADS Domain Membership
    Kerberos, Samba ADS Domain Membership
    /etc/krb5.conf, Configure /etc/krb5.conf
    kinit, Configure /etc/krb5.conf

    L

    ldap admin dn, Backup Domain Controller Configuration, Sharing User ID Mappings between Samba Domain Members, Configuring Samba
    ldap delete dn, Configuring Samba
    ldap filter, Configuring Samba
    ldap group suffix, Configuring Samba
    ldap idmap suffix, Backup Domain Controller Configuration, Sharing User ID Mappings between Samba Domain Members, Configuring Samba
    ldap machine suffix, Configuring Samba
    ldap passwd sync, Configuring Samba, Password Synchronization
    ldap ssl, Configuring Samba, Security and sambaSamAccount
    ldap suffix, Backup Domain Controller Configuration, Configuring Samba
    ldap user suffix, Configuring Samba
    libnss_wins.so, /etc/nsswitch.conf
    Links
    hard, MS Windows NTFS Comparison with UNIX File Systems
    soft, MS Windows NTFS Comparison with UNIX File Systems
    Linuxprinting.org, CUPS Print Drivers from Linuxprinting.org
    lm announce, What Is Browsing?
    lm interval, What Is Browsing?
    LMB (see Local Master Browser)
    LMHOSTS, The LMHOSTS File
    load printers, Rapid Configuration Validation, The [global] Section
    local master, What Is Browsing?, Configuring WORKGROUP Browsing
    Local Master Browser, NetBIOS over TCP/IP, Use of the Remote Announce Parameter
    locking, Discussion
    locking.tdb, The Printing *.tdb Files
    (see also TDB)
    log files
    monitoring, Assumptions
    log level, Adding Machine to Domain Fails, Problem Resolution, extd_audit, Debug Levels
    logon drive, Windows NT4 Workstation
    logon home, LDAP Special Attributes for sambaSamAccounts, Windows 9x/Me User Profiles, Mixed Windows 9x/Me and Windows NT4/200x User Profiles, Disabling Roaming Profile Support, Windows NT4 Workstation, Sharing Profiles between W9x/Me and NT4/200x/XP Workstations
    logon path, LDAP Special Attributes for sambaSamAccounts, Mixed Windows 9x/Me and Windows NT4/200x User Profiles, Disabling Roaming Profile Support, Windows 9x/Me Profile Setup, Windows NT4 Workstation, Sharing Profiles between W9x/Me and NT4/200x/XP Workstations
    logon script, LDAP Special Attributes for sambaSamAccounts
    lpadmin, CUPS Print Drivers from Linuxprinting.org, Setting Up Quotas
    lppause command, Linking smbd with libcups.so, From Windows Clients to a CUPS/Samba Print Server, Pre-Conditions
    lpq cache time, The [global] Section
    lpq command, Linking smbd with libcups.so, Pre-Conditions
    lpresume command, Linking smbd with libcups.so, Pre-Conditions
    lprm command, Linking smbd with libcups.so, Pre-Conditions
    lpstat, Troubleshooting Revisited

    M

    MAC Addresses, /etc/hosts
    Machine Trust Accounts, Features and Benefits, Machine Accounts Keep Expiring, MS Windows Workstation/Server Machine Trust Accounts
    creating, MS Windows Workstation/Server Machine Trust Accounts
    make, Building the Binaries
    mandatory profiles, Mandatory Profiles
    mangling method, Japanese Charsets
    map to guest, [print$] Section Parameters, Adding New Printers with the Windows NT APW, New Account Reconnection from Windows 200x/XP Troubles, Avoid Being Connected to the Samba Server as the Wrong User
    max xmit, Max Xmit
    messages.tdb, The Printing *.tdb Files
    (see also TDB)
    MIME, MIME Types and CUPS Filters, MIME Type Conversion Rules, Filtering Overview, application/octet-stream Printing
    filters, MIME Types and CUPS Filters
    raw, Central Print Serving, Explicitly Enable raw Printing for application/octet-stream
    minimal configuration, Configuration file syntax
    msdfs root, Features and Benefits

    N

    name resolve order, What Is Browsing?
    nbtstat, The NetBIOS Name Cache
    net
    groupmap, Example Configuration, Steps in Migration Process
    rpc, Example Configuration, Features and Benefits, Steps in Migration Process
    NetBIOS, Features and Benefits, TCP/IP without NetBIOS, Integrating MS Windows Networks with Samba, Name Resolution as Used within MS Windows Networking
    NetBIOS-less, TCP/IP without NetBIOS
    Nexus.exe, Features and Benefits, Managing Domain Machine Accounts using NT4 Server Manager, Remote Server Administration
    nmblookup, The NetBIOS Name Cache
    NoMachine.Com, Remote Management from NoMachine.Com
    nt acl support, File and Directory Permissions-Based Controls, Viewing File Ownership, Viewing File or Directory Permissions, Modifying File or Directory Permissions, Windows 2000 Service Pack 2
    NTConfig.POL, Windows 9x/ME Policies, Managing Account/User Policies, Samba Editreg Toolset, MS Windows NT4 Workstation
    ntdrivers.tdb, The Printing *.tdb Files
    (see also TDB)
    ntforms.tdb, The Printing *.tdb Files
    (see also TDB)
    NTFS, MS Windows NTFS Comparison with UNIX File Systems
    ntprinters.tdb, The Printing *.tdb Files
    (see also TDB)
    NTUser.DAT, Samba Editreg Toolset

    O

    obey pam restrictions, smb.conf PAM Configuration
    only user, User and Group-Based Controls, Why Can Users Access Home Directories of Other Users?
    oplock break wait time, Advanced Samba Opportunistic Locking Parameters, Disabling Kernel Oplocks
    oplock contention limit, Advanced Samba Opportunistic Locking Parameters
    os level, What Is Browsing?, Configuring WORKGROUP Browsing, DOMAIN Browsing Configuration, Forcing Samba to Be the Master, Making Samba the Domain Master
    os2 driver map, Printer Driver Download for OS/2 Clients

    P

    page_log, The page_log File Syntax
    passdb backend, MS Windows Workstation/Server Machine Trust Accounts, Account Information Databases, Technical Information, The pdbedit Command, Configuring Samba, Configuring, Users Cannot Logon, Configuration of auth methods, Remote CIFS Authentication Using winbindd.so, Quick Migration Guide, Passdb Backends and Authentication
    password level, Password Checking, The Tests, Password Case Sensitivity, Slow Logins
    password server, Server Security (User Level Security), Security Mode and Master Browsers, Joining an NT4-type Domain with Samba-3, Configure smb.conf, The Tests
    patch, Patches
    path, The [printers] Section, Any [my_printer_name] Section, Print Commands, Creating the [print$] Share, [print$] Section Parameters, The [print$] Share Directory, Samba Receiving Jobfiles and Passing Them to CUPS, Auto-Deletion or Preservation of CUPS Spool Files, Permissions on /var/spool/samba/ Get Reset After Each Reboot, The Tests
    PCL, GDI on Windows -- PostScript on UNIX, Windows Drivers, GDI and EMF, UNIX Printfile Conversion and GUI Basics, Driver Execution on the Server, Network PostScript RIP
    pdbedit, New Backends, Account Management Tools, The pdbedit Command, XML, Passdb Backends and Authentication, Steps in Migration Process, Samba-3 Implementation Choices
    PDF, Windows Drivers, GDI and EMF, PostScript Printer Description (PPD) Specification
    pdf, MIME Type Conversion Rules
    PDL, GDI on Windows -- PostScript on UNIX, PostScript and Ghostscript
    permissions
    file/directory ACLs, Managing UNIX Permissions Using NT Security Dialogs
    share, Share Definition Access Controls
    share ACLs, Access Controls on Shares
    UNIX file and directory, Features and Benefits
    PGP, Verifying Samba's PGP Signature
    PJL, Network PostScript RIP, Windows CUPS PostScript Driver Versus Adobe Driver, Adobe and CUPS PostScript Drivers for Windows Clients
    point 'n' print, Installation of Windows Client Drivers, Driver Upload Methods, The Role of cupsomatic/foomatic, Run cupsaddsmb (Quiet Mode), Installing the PostScript Driver on a Client, Manual Driver Installation in 15 Steps
    PostScript, Advanced Intelligent Printing with PostScript Driver Download, GDI on Windows -- PostScript on UNIX, Windows Drivers, GDI and EMF, UNIX Printfile Conversion and GUI Basics, PostScript and Ghostscript, Prefilters, Driver Execution on the Server, Network PostScript RIP, CUPS: A Magical Stone?, CUPS PostScript Driver for Windows NT/200x/XP
    (see also Ghostscript)
    RIP, PostScript and Ghostscript
    PPD, PostScript and Ghostscript, PostScript Printer Description (PPD) Specification, PostScript Printer Descriptions (PPDs) for Non-PS Printers, PPDs for Non-PS Printers on UNIX, PPDs for Non-PS Printers on Windows, CUPS: A Magical Stone?, Installing the PostScript Driver on a Client
    CUPS (see CUPS-PPD)
    preferred master, What Is Browsing?, Configuring WORKGROUP Browsing, Forcing Samba to Be the Master, Making Samba the Domain Master, The Tests
    preserve case, Windows 9x/Me Profile Setup
    print command, The [global] Section, Default UNIX System Printing Commands, Custom Print Commands, Linking smbd with libcups.so, From Windows Clients to a CUPS/Samba Print Server, Pre-Conditions, Manual Configuration
    printable, The [printers] Section, Any [my_printer_name] Section
    printcap, Default UNIX System Printing Commands, Basic CUPS Support Configuration, Linking smbd with libcups.so, More Complex CUPS smb.conf Settings, Pre-Conditions
    printcap name, The [global] Section
    printer admin, The [global] Section, Any [my_printer_name] Section, [print$] Section Parameters, Add Printer Wizard Driver Installation, First Client Driver Installation, Setting Device Modes on New Printers, Always Make First Client Connection as root or printer admin, Setting Default Print Options for Client Drivers, Adding New Printers with the Windows NT APW, More Complex CUPS smb.conf Settings, Requirements for adddriver and setdriver to Succeed, Print Options for All Users Can't Be Set on Windows 200x/XP
    printing, The [global] Section, Default UNIX System Printing Commands, Custom Print Commands, Basic CUPS Support Configuration, Linking smbd with libcups.so, More Complex CUPS smb.conf Settings, From Windows Clients to a CUPS/Samba Print Server, Pre-Conditions, Manual Configuration
    printing.tdb, The Printing *.tdb Files
    (see also TDB)
    PrintPro (see ESP Print Pro)
    public, The [printers] Section

    Q

    queue resume command, Linking smbd with libcups.so
    queuepause command, Linking smbd with libcups.so

    R

    raw printing, Central Print Serving, Explicitly Enable raw Printing for application/octet-stream
    read list, User and Group-Based Controls
    read only, Miscellaneous Controls, The [printers] Section, [print$] Section Parameters
    read raw, Read Raw
    read size, Read Size
    Relative Identifier (see RID)
    remote announce, NetBIOS over TCP/IP, How Browsing Functions, Use of the Remote Announce Parameter, Browsing Support in Samba
    remote browse sync, NetBIOS over TCP/IP, How Browsing Functions, Use of the Remote Browse Sync Parameter
    replication, Features and Benefits
    browse lists, Cross-Subnet Browsing
    SAM, Domain Controller Types, Features and Benefits, MS Windows NT4-style Domain Control, Backup Domain Controller Configuration, Can Samba Be a Backup Domain Controller to an NT4 PDC?, How Do I Replicate the smbpasswd File?
    WINS, NetBIOS over TCP/IP, WINS Server Configuration, WINS Replication
    RID, Default Users, Groups and Relative Identifiers
    roaming profiles, Disabling Roaming Profile Support
    root preexec, Logon Scripts
    rpcclient
    adddriver, Run cupsaddsmb with Verbose Output, Understanding cupsaddsmb, Installing PostScript Driver Files Manually Using rpcclient, Understanding the rpcclient man Page, Requirements for adddriver and setdriver to Succeed, Manual Driver Installation in 15 Steps
    enumdrivers, Installing PostScript Driver Files Manually Using rpcclient, Manual Driver Installation in 15 Steps
    enumports, Installing PostScript Driver Files Manually Using rpcclient
    enumprinters, Installing PostScript Driver Files Manually Using rpcclient, Requirements for adddriver and setdriver to Succeed, Manual Driver Installation in 15 Steps, Troubleshooting Revisited
    getdriver, Producing an Example by Querying a Windows Box, Manual Driver Installation in 15 Steps
    getprinter, Producing an Example by Querying a Windows Box, Manual Driver Installation in 15 Steps, Troubleshooting Revisited
    setdriver, Caveats to be Considered, Run cupsaddsmb with Verbose Output, Understanding cupsaddsmb, Installing PostScript Driver Files Manually Using rpcclient, Requirements for adddriver and setdriver to Succeed, Manual Driver Installation in 15 Steps
    rsync, Accessing the Samba Sources via rsync and ftp
    rundll32, Adding Printers without User Intervention

    S

    SAM, Features and Benefits, Domain Controller Types, Features and Benefits, Result Caching
    SAM backend
    LDAP, Features and Benefits
    ldapsam, Features and Benefits, Features and Benefits, Mapping Common UIDs/GIDs on Distributed Machines, ldapsam
    ldapsam_compat, Features and Benefits
    mysqlsam, Features and Benefits, MySQL
    non-LDAP, Features and Benefits
    smbpasswd, Features and Benefits, smbpasswd Encrypted Password Database
    tdbsam, Features and Benefits, Features and Benefits, tdbsam
    xmlsam, Features and Benefits, Mapping Common UIDs/GIDs on Distributed Machines, XML
    schannel, Cannot Log onto Domain Member Workstation After Joining Domain
    secrets.tdb, The Printing *.tdb Files
    (see also TDB)
    security, Samba Security Modes, Domain Security Mode (User Level Security), Server Security (User Level Security), What Makes Samba a Server?, What Makes Samba a Domain Controller?, What Makes Samba a Domain Member?, Constantly Losing Connections to Password Server, Preparing for Domain Control, Security Mode and Master Browsers, Joining an NT4-type Domain with Samba-3, Why Is This Better Than security = server?, Configure smb.conf, Run cupsaddsmb (Quiet Mode), cupsaddsmb Keeps Asking for Root Password in Never-ending Loop, Passdb Backends and Authentication, The Tests, Configuring Windows for Workgroups Password Handling
    security mask, File and Directory Permissions-Based Controls, Interaction with the Standard Samba create mask Parameters
    Security Mode, Samba Security Modes
    Server Manager, MS Windows Workstation/Server Machine Trust Accounts, Manual Creation of Machine Trust Accounts, Remote Server Administration
    Server Type, Server Types
    Domain Member, Example Configuration, Example Configuration, Features and Benefits
    sessionid.tdb, The Printing *.tdb Files
    (see also TDB)
    share_info.tdb, The Printing *.tdb Files
    (see also TDB)
    short preserve case, Miscellaneous Controls, Windows 9x/Me Profile Setup
    Short-Cuts, MS Windows NTFS Comparison with UNIX File Systems
    show add printer wizard, The [global] Section, Adding New Printers with the Windows NT APW
    SID, Features and Benefits, The System Cannot Log You On (C000019B), Backup Domain Controller Configuration, Technical Information, Features and Benefits, Side Bar Notes, Get SID, Profile Migration/Creation
    signing, Cannot Log onto Domain Member Workstation After Joining Domain
    simple configuration, Example Configuration
    Single Sign On, Caveats to be Considered
    slow browsing, Browsing of Shares and Directories is Very Slow
    smbclient, Testing with smbclient, The Tests
    smbgrpadd.sh, Sample smb.conf Add Group Script
    socket options, Socket Options
    spooling
    central, Central Spooling vs. Peer-to-Peer Printing
    peer-to-peer, Central Spooling vs. Peer-to-Peer Printing
    spooling-only, Raw Print Serving Vendor Drivers on Windows Clients
    SRVTOOLS.EXE, Managing Domain Machine Accounts using NT4 Server Manager, Remote Server Administration
    strict locking, Discussion
    swat, SWAT
    enable, Enabling SWAT for Use
    security, Securing SWAT through SSL
    System Policy Editor, Creating and Managing System Policies, Administration of Windows 200x/XP Policies

    T

    TDB, The Printing *.tdb Files, Trivial Database Files
    backing up (see tdbbackup)
    tdbbackup, Using tdbbackup
    template homedir, Linux/FreeBSD-specific PAM configuration
    testparm, The Tests
    text/plain, MIME Type Conversion Rules
    total print jobs, The [global] Section

    U

    UDP, NetBIOS over TCP/IP
    UID, Features and Benefits
    unexpected.tdb, The Printing *.tdb Files
    (see also TDB)
    unix charset, Samba and Charsets
    UNIX charset, Japanese Charsets
    use client driver, The [global] Section
    user, Share Level Security, The Tests
    User Accounts
    Adding/Deleting, The smbpasswd Command, The pdbedit Command, Accounts and Groups Management
    User Management, The smbpasswd Command, The pdbedit Command, Accounts and Groups Management
    User Manager, Samba as the Trusted Domain, Samba as the Trusting Domain, Remote Server Administration
    useradd, Manual Creation of Machine Trust Accounts
    username, User and Group-Based Controls
    username level, Password Checking
    username map, Windows 200x/XP Professional Client
    users, Why Can Users Access Home Directories of Other Users?

    V

    valid users, User and Group-Based Controls, The Tests
    veto files, Miscellaneous Controls
    vfs objects, Discussion
    vipw, Manual Creation of Machine Trust Accounts

    W

    WebClient, Browsing of Shares and Directories is Very Slow
    winbind separator, Starting and Testing the winbindd Daemon
    winbindd, Example Configuration
    windows registry settings
    default profile locations, MS Windows NT4 Workstation, MS Windows 200x/XP
    profile path, Windows 9x/Me Profile Setup
    roaming profiles, Disabling Roaming Profile Support
    WINS, What Is Browsing?, NetBIOS over TCP/IP, WINS Lookup
    wins hook, What Is Browsing?
    wins proxy, What Is Browsing?
    wins server, What Is Browsing?, WINS The Windows Internetworking Name Server, WINS Server Configuration
    wins support, What Is Browsing?, WINS The Windows Internetworking Name Server, WINS Server Configuration
    workgroup, Security Mode and Master Browsers, Joining an NT4-type Domain with Samba-3, Browsing Support in Samba
    write list, User and Group-Based Controls, [print$] Section Parameters
    write raw, Write Raw
    writeable, The [printers] Section, Any [my_printer_name] Section
    WYSIWYG, Windows Drivers, GDI and EMF

    X

    X Window System, Windows Drivers, GDI and EMF, UNIX Printfile Conversion and GUI Basics
    xinetd, Starting from inetd.conf (see inetd)
    Xprint, Windows Drivers, GDI and EMF, UNIX Printfile Conversion and GUI Basics
    Prev Up 
    Chapter 41. Further Resources Home 
    diff --git a/docs/htmldocs/lmhosts.5.html b/docs/htmldocs/lmhosts.5.html index f0a1d02172..d5f68fd6e5 100644 --- a/docs/htmldocs/lmhosts.5.html +++ b/docs/htmldocs/lmhosts.5.html @@ -30,8 +30,8 @@ to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another excellent piece of Open Source software, available at - - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/locking.html b/docs/htmldocs/locking.html index 07228df19d..5210c015c0 100644 --- a/docs/htmldocs/locking.html +++ b/docs/htmldocs/locking.html @@ -1,97 +1,98 @@ -Chapter 14. File and Record Locking
    Chapter 14. File and Record Locking
    Prev Part III. Advanced Configuration Next

    Chapter 14. File and Record Locking

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Eric Roseme

    HP Oplocks Usage Recommendations Whitepaper

    Table of Contents

    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Problems saving files in MS Office on Windows XP
    Long delays deleting files over network with XP SP1
    Additional Reading

    -One area which causes trouble for many network administrators is locking. -The extent of the problem is readily evident from searches over the internet. -

    Features and Benefits

    +Chapter 14. File and Record Locking

    Chapter 14. File and Record Locking
    Prev Part III. Advanced Configuration Next

    Chapter 14. File and Record Locking

    Jeremy Allison

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Eric Roseme

    HP Oplocks Usage Recommendations Whitepaper

    Table of Contents

    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb Error Messages
    Problems Saving Files in MS Office on Windows XP
    Long Delays Deleting Files Over Network with XP SP1
    Additional Reading

    +One area that causes trouble for many network administrators is locking. +The extent of the problem is readily evident from searches over the Internet. +

    Features and Benefits

    Samba provides all the same locking semantics that MS Windows clients expect -and that MS Windows NT4 / 200x servers provide also. +and that MS Windows NT4/200x servers also provide.

    The term locking has exceptionally broad meaning and covers a range of functions that are all categorized under this one term.

    Opportunistic locking is a desirable feature when it can enhance the -perceived performance of applications on a networked client. However, the -opportunistic locking protocol is not robust, and therefore can -encounter problems when invoked beyond a simplistic configuration, or -on extended, slow, or faulty networks. In these cases, operating +perceived performance of applications on a networked client. However, the +opportunistic locking protocol is not robust and, therefore, can +encounter problems when invoked beyond a simplistic configuration or +on extended slow or faulty networks. In these cases, operating system management of opportunistic locking and/or recovering from repetitive errors can offset the perceived performance advantage that it is intended to provide.

    The MS Windows network administrator needs to be aware that file and record -locking semantics (behaviour) can be controlled either in Samba or by way of registry +locking semantics (behavior) can be controlled either in Samba or by way of registry settings on the MS Windows client.

    Note

    -Sometimes it is necessary to disable locking control settings BOTH on the Samba +Sometimes it is necessary to disable locking control settings on both the Samba server as well as on each MS Windows client! -

    Discussion

    -There are two types of locking which need to be performed by a SMB server. -The first is record locking which allows a client to lock -a range of bytes in a open file. The second is the deny modes +

    Discussion

    +There are two types of locking that need to be performed by an SMB server. +The first is record locking that allows a client to lock +a range of bytes in a open file. The second is the deny modes that are specified when a file is open.

    Record locking semantics under UNIX are very different from record locking under -Windows. Versions of Samba before 2.2 have tried to use the native fcntl() unix +Windows. Versions of Samba before 2.2 have tried to use the native fcntl() UNIX system call to implement proper record locking between different Samba clients. -This can not be fully correct due to several reasons. The simplest is the fact +This cannot be fully correct for several reasons. The simplest is the fact that a Windows client is allowed to lock a byte range up to 2^32 or 2^64, -depending on the client OS. The unix locking only supports byte ranges up to 2^31. +depending on the client OS. The UNIX locking only supports byte ranges up to 2^31. So it is not possible to correctly satisfy a lock request above 2^31. There are many more differences, too many to be listed here.

    Samba 2.2 and above implements record locking completely independent of the -underlying unix system. If a byte range lock that the client requests happens -to fall into the range 0-2^31, Samba hands this request down to the UNIX system. -All other locks can not be seen by unix anyway. -

    -Strictly an SMB server should check for locks before every read and write call on -a file. Unfortunately with the way fcntl() works this can be slow and may over-stress -the rpc.lockd. It is also almost always unnecessary as clients are supposed to -independently make locking calls before reads and writes anyway if locking is -important to them. By default Samba only makes locking calls when explicitly asked -to by a client, but if you set strict locking = yes then it -will make lock checking calls on every read and write. -

    -You can also disable byte range locking completely using locking = no. -This is useful for those shares that don't support locking or don't need it -(such as cdroms). In this case Samba fakes the return codes of locking calls to -tell clients that everything is OK. +underlying UNIX system. If a byte range lock that the client requests happens +to fall into the range of 0-2^31, Samba hands this request down to the UNIX system. +All other locks cannot be seen by UNIX, anyway. +

    +Strictly speaking, an SMB server should check for locks before every read and write call on +a file. Unfortunately with the way fcntl() works, this can be slow and may overstress +the rpc.lockd. This is almost always unnecessary as clients are supposed to +independently make locking calls before reads and writes if locking is +important to them. By default, Samba only makes locking calls when explicitly asked +to by a client, but if you set strict locking = yes, it +will make lock checking calls on every read and write call. +

    +You can also disable byte range locking completely by using +locking = no. +This is useful for those shares that do not support locking or do not need it +(such as CDROMs). In this case, Samba fakes the return codes of locking calls to +tell clients that everything is okay.

    The second class of locking is the deny modes. These are set by an application when it opens a file to determine what types of access should be allowed simultaneously with its open. A client may ask for DENY_NONE, DENY_READ, -DENY_WRITE or DENY_ALL. There are also special compatibility +DENY_WRITE, or DENY_ALL. There are also special compatibility modes called DENY_FCB and DENY_DOS. -

    Opportunistic Locking Overview

    +

    Opportunistic Locking Overview

    Opportunistic locking (Oplocks) is invoked by the Windows file system -(as opposed to an API) via registry entries (on the server AND client) +(as opposed to an API) via registry entries (on the server and the client) for the purpose of enhancing network performance when accessing a file residing on a server. Performance is enhanced by caching the file -locally on the client which allows: +locally on the client that allows:

    Read-ahead:

    - The client reads the local copy of the file, eliminating network latency + The client reads the local copy of the file, eliminating network latency.

    Write caching:

    - The client writes to the local copy of the file, eliminating network latency + The client writes to the local copy of the file, eliminating network latency.

    Lock caching:

    - The client caches application locks locally, eliminating network latency + The client caches application locks locally, eliminating network latency.

    The performance enhancement of oplocks is due to the opportunity of -exclusive access to the file - even if it is opened with deny-none - +exclusive access to the file even if it is opened with deny-none because Windows monitors the file's status for concurrent access from other processes. -

    Windows defines 4 kinds of Oplocks:

    Level1 Oplock:

    +

    Windows defines 4 kinds of Oplocks:

    Level1 Oplock

    The redirector sees that the file was opened with deny none (allowing concurrent access), verifies that no other process is accessing the file, checks that oplocks are enabled, then grants deny-all/read-write/exclusive - access to the file. The client now performs + access to the file. The client now performs operations on the cached local file.

    If a second process attempts to open the file, the open - is deferred while the redirector "breaks" the original - oplock. The oplock break signals the caching client to + is deferred while the redirector “breaks” the original + oplock. The oplock break signals the caching client to write the local file back to the server, flush the - local locks, and discard read-ahead data. The break is + local locks and discard read-ahead data. The break is then complete, the deferred open is granted, and the multiple processes can enjoy concurrent file access as dictated by mandatory or byte-range locking options. @@ -99,130 +100,130 @@ other processes. file with a share mode other than deny-none, then the second process is granted limited or no access, despite the oplock break. -

    Level2 Oplock:

    - Performs like a level1 oplock, except caching is only +

    Level2 Oplock

    + Performs like a Level1 oplock, except caching is only operative for reads. All other operations are performed on the server disk copy of the file. -

    Filter Oplock:

    - Does not allow write or delete file access -

    Batch Oplock:

    - Manipulates file openings and closings - allows caching - of file attributes +

    Filter Oplock

    + Does not allow write or delete file access. +

    Batch Oplock

    + Manipulates file openings and closings and allows caching + of file attributes.

    An important detail is that oplocks are invoked by the file system, not -an application API. Therefore, an application can close an oplocked -file, but the file system does not relinquish the oplock. When the +an application API. Therefore, an application can close an oplocked +file, but the file system does not relinquish the oplock. When the oplock break is issued, the file system then simply closes the file in preparation for the subsequent open by the second process.

    -Opportunistic Locking is actually an improper name for this feature. +Opportunistic locking is actually an improper name for this feature. The true benefit of this feature is client-side data caching, and oplocks is merely a notification mechanism for writing data back to the -networked storage disk. The limitation of opportunistic locking is the +networked storage disk. The limitation of opportunistic locking is the reliability of the mechanism to process an oplock break (notification) -between the server and the caching client. If this exchange is faulty -(usually due to timing out for any number of reasons) then the +between the server and the caching client. If this exchange is faulty +(usually due to timing out for any number of reasons), then the client-side caching benefit is negated.

    The actual decision that a user or administrator should consider is -whether it is sensible to share amongst multiple users data that will -be cached locally on a client. In many cases the answer is no. +whether it is sensible to share among multiple users data that will +be cached locally on a client. In many cases the answer is no. Deciding when to cache or not cache data is the real question, and thus -"opportunistic locking" should be treated as a toggle for client-side -caching. Turn it "ON" when client-side caching is desirable and -reliable. Turn it "OFF" when client-side caching is redundant, -unreliable, or counter-productive. +“opportunistic locking” should be treated as a toggle for client-side +caching. Turn it “on” when client-side caching is desirable and +reliable. Turn it “off” when client-side caching is redundant, +unreliable or counter-productive.

    -Opportunistic locking is by default set to "on" by Samba on all +Opportunistic locking is by default set to “on” by Samba on all configured shares, so careful attention should be given to each case to determine if the potential benefit is worth the potential for delays. The following recommendations will help to characterize the environment where opportunistic locking may be effectively configured.

    -Windows Opportunistic Locking is a lightweight performance-enhancing -feature. It is not a robust and reliable protocol. Every -implementation of Opportunistic Locking should be evaluated as a -tradeoff between perceived performance and reliability. Reliability -decreases as each successive rule above is not enforced. Consider a +Windows opportunistic locking is a lightweight performance-enhancing +feature. It is not a robust and reliable protocol. Every +implementation of opportunistic locking should be evaluated as a +tradeoff between perceived performance and reliability. Reliability +decreases as each successive rule above is not enforced. Consider a share with oplocks enabled, over a wide area network, to a client on a South Pacific atoll, on a high-availability server, serving a -mission-critical multi-user corporate database, during a tropical -storm. This configuration will likely encounter problems with oplocks. +mission-critical multi-user corporate database during a tropical +storm. This configuration will likely encounter problems with oplocks.

    Oplocks can be beneficial to perceived client performance when treated -as a configuration toggle for client-side data caching. If the data +as a configuration toggle for client-side data caching. If the data caching is likely to be interrupted, then oplock usage should be -reviewed. Samba enables opportunistic locking by default on all -shares. Careful attention should be given to the client usage of -shared data on the server, the server network reliability, and the +reviewed. Samba enables opportunistic locking by default on all +shares. Careful attention should be given to the client usage of +shared data on the server, the server network reliability and the opportunistic locking configuration of each share. -n mission critical high availability environments, data integrity is -often a priority. Complex and expensive configurations are implemented +In mission critical high availability environments, data integrity is +often a priority. Complex and expensive configurations are implemented to ensure that if a client loses connectivity with a file server, a failover replacement will be available immediately to provide continuous data availability.

    Windows client failover behavior is more at risk of application -interruption than other platforms because it is dependant upon an -established TCP transport connection. If the connection is interrupted -- as in a file server failover - a new session must be established. +interruption than other platforms because it is dependent upon an +established TCP transport connection. If the connection is interrupted + as in a file server failover a new session must be established. It is rare for Windows client applications to be coded to recover -correctly from a transport connection loss, therefore most applications -will experience some sort of interruption - at worst, abort and +correctly from a transport connection loss, therefore, most applications +will experience some sort of interruption at worst, abort and require restarting.

    If a client session has been caching writes and reads locally due to opportunistic locking, it is likely that the data will be lost when the -application restarts, or recovers from the TCP interrupt. When the TCP -connection drops, the client state is lost. When the file server -recovers, an oplock break is not sent to the client. In this case, the -work from the prior session is lost. Observing this scenario with -oplocks disabled, and the client was writing data to the file server -real-time, then the failover will provide the data on disk as it +application restarts or recovers from the TCP interrupt. When the TCP +connection drops, the client state is lost. When the file server +recovers, an oplock break is not sent to the client. In this case, the +work from the prior session is lost. Observing this scenario with +oplocks disabled and with the client writing data to the file server +real-time, the failover will provide the data on disk as it existed at the time of the disconnect.

    -In mission critical high availability environments, careful attention -should be given to opportunistic locking. Ideally, comprehensive +In mission-critical high-availability environments, careful attention +should be given to opportunistic locking. Ideally, comprehensive testing should be done with all affected applications with oplocks enabled and disabled. -

    Exclusively Accessed Shares

    +

    Exclusively Accessed Shares

    Opportunistic locking is most effective when it is confined to shares that are exclusively accessed by a single user, or by only one user at -a time. Because the true value of opportunistic locking is the local +a time. Because the true value of opportunistic locking is the local client caching of data, any operation that interrupts the caching mechanism will cause a delay.

    Home directories are the most obvious examples of where the performance benefit of opportunistic locking can be safely realized. -

    Multiple-Accessed Shares or Files

    +

    Multiple-Accessed Shares or Files

    As each additional user accesses a file in a share with opportunistic locking enabled, the potential for delays and resulting perceived poor -performance increases. When multiple users are accessing a file on a +performance increases. When multiple users are accessing a file on a share that has oplocks enabled, the management impact of sending and -receiving oplock breaks, and the resulting latency while other clients -wait for the caching client to flush data, offset the performance gains +receiving oplock breaks and the resulting latency while other clients +wait for the caching client to flush data offset the performance gains of the caching user.

    As each additional client attempts to access a file with oplocks set, the potential performance improvement is negated and eventually results in a performance bottleneck. -

    UNIX or NFS Client Accessed Files

    +

    UNIX or NFS Client-Accessed Files

    Local UNIX and NFS clients access files without a mandatory -file locking mechanism. Thus, these client platforms are incapable of +file-locking mechanism. Thus, these client platforms are incapable of initiating an oplock break request from the server to a Windows client that has a file cached. Local UNIX or NFS file access can therefore write to a file that has been cached by a Windows client, which exposes the file to likely data corruption.

    If files are shared between Windows clients, and either local UNIX -or NFS users, then turn opportunistic locking off. -

    Slow and/or Unreliable Networks

    +or NFS users, turn opportunistic locking off. +

    Slow and/or Unreliable Networks

    The biggest potential performance improvement for opportunistic locking occurs when the client-side caching of reads and writes delivers the most differential over sending those reads and writes over the wire. This is most likely to occur when the network is extremely slow, -congested, or distributed (as in a WAN). However, network latency also -has a very high impact on the reliability of the oplock break +congested, or distributed (as in a WAN). However, network latency also +has a high impact on the reliability of the oplock break mechanism, and thus increases the likelihood of encountering oplock problems that more than offset the potential perceived performance gain. Of course, if an oplock break never has to be sent, then this is @@ -231,112 +232,112 @@ the most advantageous scenario to utilize opportunistic locking. If the network is slow, unreliable, or a WAN, then do not configure opportunistic locking if there is any chance of multiple users regularly opening the same file. -

    Multi-User Databases

    -Multi-user databases clearly pose a risk due to their very nature - +

    Multi-User Databases

    +Multi-user databases clearly pose a risk due to their very nature they are typically heavily accessed by numerous users at random -intervals. Placing a multi-user database on a share with opportunistic +intervals. Placing a multi-user database on a share with opportunistic locking enabled will likely result in a locking management bottleneck -on the Samba server. Whether the database application is developed +on the Samba server. Whether the database application is developed in-house or a commercially available product, ensure that the share has opportunistic locking disabled. -

    PDM Data Shares

    -Process Data Management (PDM) applications such as IMAN, Enovia, and -Clearcase, are increasing in usage with Windows client platforms, and -therefore SMB data stores. PDM applications manage multi-user -environments for critical data security and access. The typical PDM +

    PDM Data Shares

    +Process Data Management (PDM) applications such as IMAN, Enovia and +Clearcase are increasing in usage with Windows client platforms, and +therefore SMB datastores. PDM applications manage multi-user +environments for critical data security and access. The typical PDM environment is usually associated with sophisticated client design -applications that will load data locally as demanded. In addition, the +applications that will load data locally as demanded. In addition, the PDM application will usually monitor the data-state of each client. In this case, client-side data caching is best left to the local -application and PDM server to negotiate and maintain. It is +application and PDM server to negotiate and maintain. It is appropriate to eliminate the client OS from any caching tasks, and the server from any oplock management, by disabling opportunistic locking on the share. -

    Beware of Force User

    -Samba includes an smb.conf parameter called force user that changes +

    Beware of Force User

    +Samba includes an smb.conf parameter called force user that changes the user accessing a share from the incoming user to whatever user is -defined by the smb.conf variable. If opportunistic locking is enabled +defined by the smb.conf variable. If opportunistic locking is enabled on a share, the change in user access causes an oplock break to be sent -to the client, even if the user has not explicitly loaded a file. In +to the client, even if the user has not explicitly loaded a file. In cases where the network is slow or unreliable, an oplock break can -become lost without the user even accessing a file. This can cause +become lost without the user even accessing a file. This can cause apparent performance degradation as the client continually reconnects to overcome the lost oplock break.

    Avoid the combination of the following:

    • - force user in the smb.conf share configuration. + force user in the smb.conf share configuration.

    • Slow or unreliable networks

    • - Opportunistic Locking Enabled -

    Advanced Samba Opportunistic Locking Parameters

    + Opportunistic locking enabled +

    Advanced Samba Opportunistic Locking Parameters

    Samba provides opportunistic locking parameters that allow the administrator to adjust various properties of the oplock mechanism to -account for timing and usage levels. These parameters provide good +account for timing and usage levels. These parameters provide good versatility for implementing oplocks in environments where they would -likely cause problems. The parameters are: -oplock break wait time, -oplock contention limit. +likely cause problems. The parameters are: +oplock break wait time, +oplock contention limit.

    -For most users, administrators, and environments, if these parameters +For most users, administrators and environments, if these parameters are required, then the better option is to simply turn oplocks off. -The samba SWAT help text for both parameters reads "DO NOT CHANGE THIS -PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." +The Samba SWAT help text for both parameters reads: “Do not change +this parameter unless you have read and understood the Samba oplock code.” This is good advice. -

    Mission Critical High Availability

    -In mission critical high availability environments, data integrity is -often a priority. Complex and expensive configurations are implemented +

    Mission-Critical High-Availability

    +In mission-critical high-availability environments, data integrity is +often a priority. Complex and expensive configurations are implemented to ensure that if a client loses connectivity with a file server, a failover replacement will be available immediately to provide continuous data availability.

    Windows client failover behavior is more at risk of application interruption than other platforms because it is dependant upon an -established TCP transport connection. If the connection is interrupted -- as in a file server failover - a new session must be established. +established TCP transport connection. If the connection is interrupted + as in a file server failover a new session must be established. It is rare for Windows client applications to be coded to recover -correctly from a transport connection loss, therefore most applications -will experience some sort of interruption - at worst, abort and +correctly from a transport connection loss, therefore, most applications +will experience some sort of interruption at worst, abort and require restarting.

    If a client session has been caching writes and reads locally due to opportunistic locking, it is likely that the data will be lost when the application restarts, or recovers from the TCP interrupt. When the TCP -connection drops, the client state is lost. When the file server -recovers, an oplock break is not sent to the client. In this case, the -work from the prior session is lost. Observing this scenario with +connection drops, the client state is lost. When the file server +recovers, an oplock break is not sent to the client. In this case, the +work from the prior session is lost. Observing this scenario with oplocks disabled, and the client was writing data to the file server real-time, then the failover will provide the data on disk as it existed at the time of the disconnect.

    -In mission critical high availability environments, careful attention -should be given to opportunistic locking. Ideally, comprehensive -testing should be done with all affected applications with oplocks +In mission-critical high-availability environments, careful attention +should be given to opportunistic locking. Ideally, comprehensive +testing should be done with all effected applications with oplocks enabled and disabled. -

    Samba Opportunistic Locking Control

    -Opportunistic Locking is a unique Windows file locking feature. It is +

    Samba Opportunistic Locking Control

    +Opportunistic locking is a unique Windows file locking feature. It is not really file locking, but is included in most discussions of Windows file locking, so is considered a de facto locking feature. -Opportunistic Locking is actually part of the Windows client file -caching mechanism. It is not a particularly robust or reliable feature +Opportunistic locking is actually part of the Windows client file +caching mechanism. It is not a particularly robust or reliable feature when implemented on the variety of customized networks that exist in enterprise computing.

    -Like Windows, Samba implements Opportunistic Locking as a server-side -component of the client caching mechanism. Because of the lightweight +Like Windows, Samba implements opportunistic locking as a server-side +component of the client caching mechanism. Because of the lightweight nature of the Windows feature design, effective configuration of -Opportunistic Locking requires a good understanding of its limitations, +opportunistic locking requires a good understanding of its limitations, and then applying that understanding when configuring data access for each particular customized network and client usage state.

    Opportunistic locking essentially means that the client is allowed to download and cache a file on their hard drive while making changes; if a second client wants to access the -file, the first client receives a break and must synchronise the file back to the server. +file, the first client receives a break and must synchronize the file back to the server. This can give significant performance gains in some cases; some programs insist on -synchronising the contents of the entire file back to the server for a single change. +synchronizing the contents of the entire file back to the server for a single change.

    -Level1 Oplocks (aka just plain "oplocks") is another term for opportunistic locking. +Level1 Oplocks (also known as just plain “oplocks”) is another term for opportunistic locking.

    Level2 Oplocks provides opportunistic locking for a file that will be treated as read only. Typically this is used on files that are read-only or @@ -344,16 +345,16 @@ on files that the client has no initial intention to write to at time of opening

    Kernel Oplocks are essentially a method that allows the Linux kernel to co-exist with Samba's oplocked files, although this has provided better integration of MS Windows network -file locking with the under lying OS, SGI IRIX and Linux are the only two OS's that are -oplock aware at this time. +file locking with the underlying OS, SGI IRIX and Linux are the only two OSs that are +oplock-aware at this time.

    Unless your system supports kernel oplocks, you should disable oplocks if you are accessing the same files from both UNIX/Linux and SMB clients. Regardless, oplocks should always be disabled if you are sharing a database file (e.g., Microsoft Access) between -multiple clients, as any break the first client receives will affect synchronisation of +multiple clients, as any break the first client receives will affect synchronization of the entire file (not just the single record), which will result in a noticeable performance impairment and, more likely, problems accessing the database in the first place. Notably, -Microsoft Outlook's personal folders (*.pst) react very badly to oplocks. If in doubt, +Microsoft Outlook's personal folders (*.pst) react quite badly to oplocks. If in doubt, disable oplocks and tune your system from that point.

    If client-side caching is desirable and reliable on your network, you will benefit from @@ -364,14 +365,14 @@ of your client sending oplock breaks and will instead want to disable oplocks fo

    Another factor to consider is the perceived performance of file access. If oplocks provide no measurable speed benefit on your network, it might not be worth the hassle of dealing with them. -

    Example Configuration

    -In the following we examine two distinct aspects of Samba locking controls. -

    Disabling Oplocks

    +

    Example Configuration

    +In the following section we examine two distinct aspects of Samba locking controls. +

    Disabling Oplocks

    You can disable oplocks on a per-share basis with the following:

    [acctdata]
    oplocks = False
    level2 oplocks = False

    -The default oplock type is Level1. Level2 Oplocks are enabled on a per-share basis +The default oplock type is Level1. Level2 oplocks are enabled on a per-share basis in the smb.conf file.

    Alternately, you could disable oplocks on a per-file basis within the share: @@ -379,69 +380,67 @@ Alternately, you could disable oplocks on a per-file basis within the share:

    veto oplock files = /*.mdb/*.MDB/*.dbf/*.DBF/

    If you are experiencing problems with oplocks as apparent from Samba's log entries, -you may want to play it safe and disable oplocks and level2 oplocks. -

    Disabling Kernel OpLocks

    -Kernel OpLocks is an smb.conf parameter that notifies Samba (if +you may want to play it safe and disable oplocks and Level2 oplocks. +

    Disabling Kernel Oplocks

    +Kernel oplocks is an smb.conf parameter that notifies Samba (if the UNIX kernel has the capability to send a Windows client an oplock break) when a UNIX process is attempting to open the file that is -cached. This parameter addresses sharing files between UNIX and -Windows with Oplocks enabled on the Samba server: the UNIX process +cached. This parameter addresses sharing files between UNIX and +Windows with oplocks enabled on the Samba server: the UNIX process can open the file that is Oplocked (cached) by the Windows client and the smbd process will not send an oplock break, which exposes the file -to the risk of data corruption. If the UNIX kernel has the ability to +to the risk of data corruption. If the UNIX kernel has the ability to send an oplock break, then the kernel oplocks parameter enables Samba -to send the oplock break. Kernel oplocks are enabled on a per-server +to send the oplock break. Kernel oplocks are enabled on a per-server basis in the smb.conf file.

    -

    kernel oplocks = yes

    -The default is "no". +

    kernel oplocks = yes

    +The default is no.

    -Veto OpLocks is an smb.conf parameter that identifies specific files for -which Oplocks are disabled. When a Windows client opens a file that +Veto opLocks is an smb.conf parameter that identifies specific files for +which oplocks are disabled. When a Windows client opens a file that has been configured for veto oplocks, the client will not be granted the oplock, and all operations will be executed on the original file on -disk instead of a client-cached file copy. By explicitly identifying -files that are shared with UNIX processes, and disabling oplocks for +disk instead of a client-cached file copy. By explicitly identifying +files that are shared with UNIX processes and disabling oplocks for those files, the server-wide Oplock configuration can be enabled to allow Windows clients to utilize the performance benefit of file -caching without the risk of data corruption. Veto Oplocks can be +caching without the risk of data corruption. Veto Oplocks can be enabled on a per-share basis, or globally for the entire server, in the -smb.conf file: +smb.conf file as shown in .

    -

    Example 14.1. Share with some files oplocked

    [global]
    veto oplock files = /filename.htm/*.txt/
    [share_name]
    veto oplock files = /*.exe/filename.ext/

    +

    Example 14.1. Share with some files oplocked

    [global]
    veto oplock files = /filename.htm/*.txt/
    [share_name]
    veto oplock files = /*.exe/filename.ext/

    - oplock break wait time is an smb.conf parameter that adjusts the time -interval for Samba to reply to an oplock break request. Samba -recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND -UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Wait Time can only be -configured globally in the smb.conf file: +oplock break wait time is an smb.conf parameter +that adjusts the time interval for Samba to reply to an oplock break request. Samba recommends: +“Do not change this parameter unless you have read and understood the Samba oplock code.” +Oplock break Wait Time can only be configured globally in the smb.conf file as shown below.

    oplock break wait time = 0 (default)

    Oplock break contention limit is an smb.conf parameter that limits the response of the Samba server to grant an oplock if the configured -number of contending clients reaches the limit specified by the -parameter. Samba recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU -HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break -Contention Limit can be enable on a per-share basis, or globally for -the entire server, in the smb.conf file: -

    -

    Example 14.2. 

    [global]
    oplock break contention limit = 2 (default)
    [share_name]
    oplock break contention limit = 2 (default)

    -

    MS Windows Opportunistic Locking and Caching Controls

    +number of contending clients reaches the limit specified by the parameter. Samba recommends +“Do not change this parameter unless you have read and understood the Samba oplock code.” +Oplock break Contention Limit can be enable on a per-share basis, or globally for +the entire server, in the smb.conf file as shown in . +

    +

    Example 14.2. Configuration with oplock break contention limit

    [global]
    oplock break contention limit = 2 (default)
    [share_name]
    oplock break contention limit = 2 (default)

    +

    MS Windows Opportunistic Locking and Caching Controls

    There is a known issue when running applications (like Norton Anti-Virus) on a Windows 2000/ XP workstation computer that can affect any application attempting to access shared database files across a network. This is a result of a default setting configured in the Windows 2000/XP -operating system known as Opportunistic Locking. When a workstation +operating system known as opportunistic locking. When a workstation attempts to access shared data files located on another Windows 2000/XP computer, the Windows 2000/XP operating system will attempt to increase performance by locking the files and caching information locally. When this occurs, the application is unable to -properly function, which results in an Access Denied +properly function, which results in an “Access Denied” error message being displayed during network operations.

    All Windows operating systems in the NT family that act as database servers for data files (meaning that data files are stored there and accessed by other Windows PCs) may need to have opportunistic locking disabled in order to minimize the risk of data file corruption. -This includes Windows 9x/Me, Windows NT, Windows 200x and Windows XP. +This includes Windows 9x/Me, Windows NT, Windows 200x, and Windows XP.

    If you are using a Windows NT family workstation in place of a server, you must also disable opportunistic locking (oplocks) on that workstation. For example, if you use a @@ -453,7 +452,7 @@ The major difference is the location in the Windows registry where the values fo oplocks are entered. Instead of the LanManServer location, the LanManWorkstation location may be used.

    -You can verify (or change or add, if necessary) this Registry value using the Windows +You can verify (change or add, if necessary) this registry value using the Windows Registry Editor. When you change this registry value, you will have to reboot the PC to ensure that the new setting goes into effect.

    @@ -491,75 +490,75 @@ request opportunistic locks on a remote file. To disable oplocks, the value of The EnableOplocks value configures Windows-based servers (including Workstations sharing files) to allow or deny opportunistic locks on local files.

    -To force closure of open oplocks on close or program exit EnableOpLockForceClose must be set to 1. +To force closure of open oplocks on close or program exit, EnableOpLockForceClose must be set to 1.

    -An illustration of how level II oplocks work: +An illustration of how Level2 oplocks work:

    • - Station 1 opens the file, requesting oplock. + Station 1 opens the file requesting oplock.

    • Since no other station has the file open, the server grants station 1 exclusive oplock.

    • - Station 2 opens the file, requesting oplock. + Station 2 opens the file requesting oplock.

    • - Since station 1 has not yet written to the file, the server asks station 1 to Break - to Level II Oplock. + Since station 1 has not yet written to the file, the server asks station 1 to break + to Level2 oplock.

    • Station 1 complies by flushing locally buffered lock information to the server.

    • - Station 1 informs the server that it has Broken to Level II Oplock (alternatively, + Station 1 informs the server that it has Broken to Level2 Oplock (alternately, station 1 could have closed the file).

    • - The server responds to station 2's open request, granting it level II oplock. - Other stations can likewise open the file and obtain level II oplock. + The server responds to station 2's open request, granting it Level2 oplock. + Other stations can likewise open the file and obtain Level2 oplock.

    • Station 2 (or any station that has the file open) sends a write request SMB. The server returns the write response.

    • - The server asks all stations that have the file open to Break to None, meaning no + The server asks all stations that have the file open to break to none, meaning no station holds any oplock on the file. Because the workstations can have no cached writes or locks at this point, they need not respond to the break-to-none advisory; all they need do is invalidate locally cashed read-ahead data. -

    Workstation Service Entries

    +

    Workstation Service Entries

     	\HKEY_LOCAL_MACHINE\System\
 		CurrentControlSet\Services\LanmanWorkstation\Parameters
 
 	UseOpportunisticLocking   REG_DWORD   0 or 1
 	Default: 1 (true)

    -Indicates whether the redirector should use opportunistic-locking (oplock) performance +This indicates whether the redirector should use opportunistic-locking (oplock) performance enhancement. This parameter should be disabled only to isolate problems. -

    Server Service Entries

    +

    Server Service Entries

     	\HKEY_LOCAL_MACHINE\System\
 		CurrentControlSet\Services\LanmanServer\Parameters
 
 	EnableOplocks   REG_DWORD   0 or 1
 	Default: 1 (true)

    -Specifies whether the server allows clients to use oplocks on files. Oplocks are a +This specifies whether the server allows clients to use oplocks on files. Oplocks are a significant performance enhancement, but have the potential to cause lost cached -data on some networks, particularly wide-area networks. +data on some networks, particularly wide area networks. 

     	MinLinkThroughput   REG_DWORD   0 to infinite bytes per second
 	Default: 0

    -Specifies the minimum link throughput allowed by the server before it disables +This specifies the minimum link throughput allowed by the server before it disables raw and opportunistic locks for this connection. 

     	MaxLinkDelay   REG_DWORD   0 to 100,000 seconds
 	Default: 60

    -Specifies the maximum time allowed for a link delay. If delays exceed this number, +This specifies the maximum time allowed for a link delay. If delays exceed this number, the server disables raw I/O and opportunistic locking for this connection. 

     	OplockBreakWait   REG_DWORD   10 to 180 seconds
 	Default: 35

    -Specifies the time that the server waits for a client to respond to an oplock break +This specifies the time that the server waits for a client to respond to an oplock break request. Smaller values can allow detection of crashed clients more quickly but can potentially cause loss of cached data. -

    Persistent Data Corruption

    +

    Persistent Data Corruption

    If you have applied all of the settings discussed in this chapter but data corruption problems -and other symptoms persist, here are some additional things to check out: +and other symptoms persist, here are some additional things to check out.

    We have credible reports from developers that faulty network hardware, such as a single faulty network card, can cause symptoms similar to read caching and data corruption. @@ -568,70 +567,69 @@ rebuild the data files in question. This involves creating a new data file with same definition as the file to be rebuilt and transferring the data from the old file to the new one. There are several known methods for doing this that can be found in our Knowledge Base. -

    Common Errors

    -In some sites locking problems surface as soon as a server is installed, in other sites +

    Common Errors

    +In some sites, locking problems surface as soon as a server is installed; in other sites locking problems may not surface for a long time. Almost without exception, when a locking problem does surface it will cause embarrassment and potential data corruption.

    -Over the past few years there have been a number of complaints on the samba mailing lists -that have claimed that samba caused data corruption. Three causes have been identified +Over the past few years there have been a number of complaints on the Samba mailing lists +that have claimed that Samba caused data corruption. Three causes have been identified so far:

    • Incorrect configuration of opportunistic locking (incompatible with the application - being used. This is a VERY common problem even where MS Windows NT4 or MS Windows 200x - based servers were in use. It is imperative that the software application vendors' + being used. This is a common problem even where MS Windows NT4 or MS Windows + 200x-based servers were in use. It is imperative that the software application vendors' instructions for configuration of file locking should be followed. If in doubt, disable oplocks on both the server and the client. Disabling of all forms of file caching on the MS Windows client may be necessary also.

    • - Defective network cards, cables, or HUBs / Switched. This is generally a more - prevalent factor with low cost networking hardware, though occasionally there - have been problems with incompatibilities in more up market hardware also. + Defective network cards, cables, or HUBs/Switched. This is generally a more + prevalent factor with low cost networking hardware, although occasionally there + have also been problems with incompatibilities in more up-market hardware.

    • - There have been some random reports of samba log files being written over data - files. This has been reported by very few sites (about 5 in the past 3 years) - and all attempts to reproduce the problem have failed. The Samba-Team has been - unable to catch this happening and thus has NOT been able to isolate any particular - cause. Considering the millions of systems that use samba, for the sites that have - been affected by this as well as for the Samba-Team this is a frustrating and - a vexing challenge. If you see this type of thing happening please create a bug - report on https://bugzilla.samba.org without delay. Make sure that you give as much - information as you possibly can to help isolate the cause and to allow reproduction - of the problem (an essential step in problem isolation and correction). -

    locking.tdb error messages

    + There have been some random reports of Samba log files being written over data + files. This has been reported by very few sites (about five in the past three years) + and all attempts to reproduce the problem have failed. The Samba Team has been + unable to catch this happening and thus has not been able to isolate any particular + cause. Considering the millions of systems that use Samba, for the sites that have + been affected by this as well as for the Samba Team this is a frustrating and + a vexing challenge. If you see this type of thing happening, please create a bug + report on Samba Bugzilla without delay. + Make sure that you give as much information as you possibly can help isolate the + cause and to allow replication of the problem (an essential step in problem isolation and correction). +

    locking.tdb Error Messages

    “ - We are seeing lots of errors in the samba logs like: -” -

    +	We are seeing lots of errors in the Samba logs, like:
+
     tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic
  0x4d6f4b61 at offset=36116
-
    
-“
+
    + What do these mean? ”

    - Corrupted tdb. Stop all instances of smbd, delete locking.tdb, restart smbd. -

    Problems saving files in MS Office on Windows XP

    This is a bug in Windows XP. More information can be - found in Microsoft Knowledge Base article 812937.

    Long delays deleting files over network with XP SP1

    “It sometimes takes approximately 35 seconds to delete files over the network after XP SP1 has been applied”

    This is a bug in Windows XP. More information can be - found in - Microsoft Knowledge Base article 811492.

    Additional Reading

    + This error indicated a corrupted tdb. Stop all instances of smbd, delete locking.tdb, and restart smbd. +

    Problems Saving Files in MS Office on Windows XP

    This is a bug in Windows XP. More information can be + found in Microsoft Knowledge Base article 812937.

    Long Delays Deleting Files Over Network with XP SP1

    “It sometimes takes approximately 35 seconds to delete files over the network after XP SP1 has been applied.”

    This is a bug in Windows XP. More information can be found in + Microsoft Knowledge Base article 811492.

    Additional Reading

    You may want to check for an updated version of this white paper on our Web site from time to time. Many of our white papers are updated as information changes. For those papers, -the Last Edited date is always at the top of the paper. +the last edited date is always at the top of the paper.

    Section of the Microsoft MSDN Library on opportunistic locking:

    Opportunistic Locks, Microsoft Developer Network (MSDN), Windows Development > Windows Base Services > Files and I/O > SDK Documentation > File Storage > File Systems > About File Systems > Opportunistic Locks, Microsoft Corporation. -http://msdn.microsoft.com/library/en-us/fileio/storage_5yk3.asp +http://msdn.microsoft.com/library/en-us/fileio/storage_5yk3.asp

    -Microsoft Knowledge Base Article Q224992 "Maintaining Transactional Integrity with OPLOCKS", -Microsoft Corporation, April 1999, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q224992. + Microsoft Knowledge Base Article Q224992 “Maintaining Transactional Integrity +with OPLOCKS”, +Microsoft Corporation, April 1999, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q224992.

    -Microsoft Knowledge Base Article Q296264 "Configuring Opportunistic Locking in Windows 2000", -Microsoft Corporation, April 2001, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296264. +Microsoft Knowledge Base Article Q296264 “Configuring Opportunistic Locking in Windows 2000”, +Microsoft Corporation, April 2001, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q296264.

    -Microsoft Knowledge Base Article Q129202 "PC Ext: Explanation of Opportunistic Locking on Windows NT", - Microsoft Corporation, April 1995, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202. -

    Prev Up Next
    Chapter 13. File, Directory and Share Access Controls Home Chapter 15. Securing Samba
    +Microsoft Knowledge Base Article Q129202 “PC Ext: Explanation of Opportunistic Locking on Windows NT”, +Microsoft Corporation, April 1995, http://support.microsoft.com/default.aspx?scid=kb;en-us;Q129202. +

    Prev Up Next
    Chapter 13. File, Directory and Share Access Controls Home Chapter 15. Securing Samba
    diff --git a/docs/htmldocs/migration.html b/docs/htmldocs/migration.html index 36b6edb0b1..27a4e01348 100644 --- a/docs/htmldocs/migration.html +++ b/docs/htmldocs/migration.html @@ -1 +1 @@ -Part IV. Migration and Updating
    Part IV. Migration and Updating
    Prev   Next

    Migration and Updating

    Table of Contents

    30. Upgrading from Samba-2.x to Samba-3.0.0
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (changes in behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    Charsets
    LDAP
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps In Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices
    32. SWAT - The Samba Web Administration Tool
    Features and Benefits
    Enabling SWAT for use
    Securing SWAT through SSL
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    Prev Up Next
    Chapter 29. High Availability Options Home Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    +Part IV. Migration and Updating
    Part IV. Migration and Updating
    Prev   Next

    Migration and Updating

    Table of Contents

    30. Upgrading from Samba-2.x to Samba-3.0.0
    Quick Migration Guide
    New Features in Samba-3
    Configuration Parameter Changes
    Removed Parameters
    New Parameters
    Modified Parameters (Changes in Behavior):
    New Functionality
    Databases
    Changes in Behavior
    Charsets
    Passdb Backends and Authentication
    LDAP
    31. Migration from NT4 PDC to Samba-3 PDC
    Planning and Getting Started
    Objectives
    Steps in Migration Process
    Migration Options
    Planning for Success
    Samba-3 Implementation Choices
    32. SWAT The Samba Web Administration Tool
    Features and Benefits
    Guidelines and Technical Tips
    Validate SWAT Installation
    Enabling SWAT for Use
    Securing SWAT through SSL
    Enabling SWAT Internationalization Support
    Overview and Quick Tour
    The SWAT Home Page
    Global Settings
    Share Settings
    Printers Settings
    The SWAT Wizard
    The Status Page
    The View Page
    The Password Change Page
    Prev Up Next
    Chapter 29. High Availability Options Home Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0
    diff --git a/docs/htmldocs/msdfs.html b/docs/htmldocs/msdfs.html index 9fdf906ed0..139bfff550 100644 --- a/docs/htmldocs/msdfs.html +++ b/docs/htmldocs/msdfs.html @@ -1,51 +1,88 @@ -Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    Prev Part III. Advanced Configuration Next

    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba

    Shirish Kalele

    Samba Team & Veritas Software


    +Chapter 17. Hosting a Microsoft Distributed File System tree on Samba

    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba
    Prev Part III. Advanced Configuration Next

    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba

    Shirish Kalele

    Samba Team & Veritas Software



    -

    12 Jul 2000

    Table of Contents

    Features and Benefits
    Common Errors

    Features and Benefits

    - The Distributed File System (or DFS) provides a means of separating the logical +

    John H. Terpstra

    Samba Team

    12 Jul 2000

    Table of Contents

    Features and Benefits
    Common Errors
    MSDFS UNIX Path Is Case-Critical

    Features and Benefits

    + The Distributed File System (DFS) provides a means of separating the logical view of files and directories that users see from the actual physical locations of these resources on the network. It allows for higher availability, smoother - storage expansion, load balancing etc. + storage expansion, load balancing, and so on.

    For information about DFS, refer to the -Microsoft documentation. -

    +Microsoft documentation. This document explains how to host a DFS tree on a UNIX machine (for DFS-aware clients to browse) using Samba.

    - To enable SMB-based DFS for Samba, configure it with the --with-msdfs + To enable SMB-based DFS for Samba, configure it with the --with-msdfs option. Once built, a Samba server can be made a DFS server by setting the global - boolean host msdfs + Boolean host msdfs parameter in the smb.conf file. You designate a share as a DFS - root using the share level boolean msdfs root parameter. A DFS root directory on Samba hosts DFS + root using the Share Level Boolean msdfs root parameter. A DFS root directory on Samba hosts DFS links in the form of symbolic links that point to other servers. For example, a symbolic link junction->msdfs:storage1\share1 in the share directory acts as the DFS junction. When DFS-aware clients attempt to access the junction link, - they are redirected to the storage location (in this case, \\storage1\share1). + they are redirected to the storage location (in this case, \\storage1\share1).

    DFS trees on Samba work with all DFS-aware clients ranging from Windows 95 to 200x. -

    - Here's an example of setting up a DFS tree on a Samba server. -

    Example 17.1. smb.conf with DFS configured

    [global]
    netbios name = GANDALF
    host msdfs = yes
    [dfs]
    path = /export/dfsroot
    msdfs root = yes

    In the /export/dfsroot directory we set up our DFS links to - other servers on the network.

    +	 shows how to setup a DFS tree on a Samba server.
+	In the /export/dfsroot directory, you set up your DFS links to 
+	other servers on the network.
+
     root# cd /export/dfsroot
 root# chown root /export/dfsroot
 root# chmod 755 /export/dfsroot
 root# ln -s msdfs:storageA\\shareA linka
 root# ln -s msdfs:serverB\\share,serverC\\share linkb
-
    You should set up the permissions and ownership of 
-	the directory acting as the DFS root such that only designated 
+

    +

    +

    Example 17.1. smb.conf with DFS configured

    [global]
    netbios name = GANDALF
    host msdfs = yes
    [dfs]
    path = /export/dfsroot
    msdfs root = yes

    +

    You should set up the permissions and ownership of + the directory acting as the DFS root so that only designated users can create, delete or modify the msdfs links. Also note that symlink names should be all lowercase. This limitation exists to have Samba avoid trying all the case combinations to get at - the link name. Finally set up the symbolic links to point to the - network shares you want, and start Samba.

    Users on DFS-aware clients can now browse the DFS tree + the link name. Finally, set up the symbolic links to point to the + network shares you want and start Samba.

    Users on DFS-aware clients can now browse the DFS tree on the Samba server at \\samba\dfs. Accessing links linka or linkb (which appear as directories to the client) - takes users directly to the appropriate shares on the network.

    Common Errors

    • Windows clients need to be rebooted - if a previously mounted non-dfs share is made a DFS + takes users directly to the appropriate shares on the network.

    Common Errors

    • Windows clients need to be rebooted + if a previously mounted non-DFS share is made a DFS root or vice versa. A better way is to introduce a - new share and make it the DFS root.

    • Currently there's a restriction that msdfs + new share and make it the DFS root.

    • Currently, there's a restriction that msdfs symlink names should all be lowercase.

    • For security purposes, the directory acting as the root of the DFS tree should have ownership - and permissions set so that only designated users can - modify the symbolic links in the directory.

    Prev Up Next
    Chapter 16. Interdomain Trust Relationships Home Chapter 18. Classical Printing Support
    + and permissions set so only designated users can + modify the symbolic links in the directory.

    MSDFS UNIX Path Is Case-Critical

    + A network administrator sent advice to the Samba mailing list + after a long sessions trying to determine why DFS was not working. + His advice is worth noting. +

    “ + I spent some time trying to figure out why my particular + dfs root wasn't working. I noted in the documenation that + the symlink should be in all lowercase. It should be + amended that the entire path to the symlink should all be + in lowercase as well. + ”

    + For example, I had a share defined as such: + + 

    +		[pub]
+			path = /export/home/Shares/public_share
+			msdfs root = yes
+

    + + and I could not make my Windows 9x/Me (with the dfs client installed) + follow this symlink: + + 

    +			damage1 -> msdfs:damage\test-share
+

    +

    + Running a debug level of 10 reveals: + + 

    +		[2003/08/20 11:40:33, 5] msdfs/msdfs.c:is_msdfs_link(176)
+		  is_msdfs_link: /export/home/shares/public_share/* does not exist.
+

    + + Curious. So I changed the directory name from .../Shares/... to + .../shares/... (along with my service definition) and it worked! +

    Prev Up Next
    Chapter 16. Interdomain Trust Relationships Home Chapter 18. Classical Printing Support
    diff --git a/docs/htmldocs/net.8.html b/docs/htmldocs/net.8.html index a98700e42f..ae7e2e0913 100644 --- a/docs/htmldocs/net.8.html +++ b/docs/htmldocs/net.8.html @@ -24,7 +24,7 @@ Defaults to trying 445 first, then 139.

    -n <primary NetBIOS name>

    This option allows you to override the NetBIOS name that Samba uses for itself. This is identical -to setting the netbios name parameter in the smb.conf file. +to setting the netbios name parameter in the smb.conf file. However, a command line setting will take precedence over settings in smb.conf.

    -s <configuration file>

    The file specified contains the @@ -47,13 +47,13 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    COMMANDS

    CHANGESECRETPW

    This command allows the Samba machine account password to be set from an external application to a machine account password that has already been stored in Active Directory. DO NOT USE this command unless you know exactly what you are doing. The use of this command requires that the force flag (-f) diff --git a/docs/htmldocs/nmbd.8.html b/docs/htmldocs/nmbd.8.html index f3e514fa77..72454f4b60 100644 --- a/docs/htmldocs/nmbd.8.html +++ b/docs/htmldocs/nmbd.8.html @@ -51,7 +51,7 @@

    -H <filename>

    NetBIOS lmhosts file. The lmhosts file is a list of NetBIOS names to IP addresses that is loaded by the nmbd server and used via the name - resolution mechanism name resolve order described in smb.conf(5) to resolve any + resolution mechanism name resolve order described in smb.conf(5) to resolve any NetBIOS name queries needed by the server. Note that the contents of this file are NOT used by nmbd to answer any name queries. @@ -60,8 +60,8 @@ Samba as part of the build process. Common defaults are /usr/local/samba/lib/lmhosts, /usr/samba/lib/lmhosts or - /etc/samba/lmhosts. See the lmhosts(5) man page for details on the contents of this file.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the + /etc/samba/lmhosts. See the lmhosts(5) man page for details on the contents of this file.

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -74,13 +74,13 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension ".client" will be appended. The log file is never removed by the client. @@ -104,13 +104,13 @@ never removed by the client. configuration file. Other common places that systems install this file are /usr/samba/lib/smb.conf and /etc/samba/smb.conf.

    When run as a WINS server (see the - wins support + wins support parameter in the smb.conf(5) man page), nmbd will store the WINS database in the file wins.dat in the var/locks directory configured under wherever Samba was configured to install itself.

    If nmbd is acting as a - browse master (see the local master + browse master (see the local master parameter in the smb.conf(5) man page, nmbd will store the browsing database in the file browse.dat in the var/locks directory @@ -134,14 +134,14 @@ never removed by the client. inetd(8), smbd(8), smb.conf(5), smbclient(1), testparm(1), testprns(1), and the Internet RFC's rfc1001.txt, rfc1002.txt. In addition the CIFS (formerly SMB) specification is available - as a link from the Web page - http://samba.org/cifs/.

    AUTHOR

    The original Samba software and related utilities + as a link from the Web page + http://samba.org/cifs/.

    AUTHOR

    The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/nmblookup.1.html b/docs/htmldocs/nmblookup.1.html index 10131752b3..9ab78808fc 100644 --- a/docs/htmldocs/nmblookup.1.html +++ b/docs/htmldocs/nmblookup.1.html @@ -28,7 +28,7 @@

    -A

    Interpret name as an IP Address and do a node status query on this address.

    -n <primary NetBIOS name>

    This option allows you to override the NetBIOS name that Samba uses for itself. This is identical -to setting the netbios name parameter in the smb.conf file. +to setting the netbios name parameter in the smb.conf file. However, a command line setting will take precedence over settings in smb.conf.

    -i <scope>

    This specifies a NetBIOS scope that @@ -48,13 +48,13 @@ options.

    -h|--help

    Print a sum

    -B <broadcast address>

    Send the query to the given broadcast address. Without this option the default behavior of nmblookup is to send the query to the broadcast address of the network interfaces as - either auto-detected or defined in the interfaces - parameter of the smb.conf(5) file. + either auto-detected or defined in the interfaces + parameter of the smb.conf(5) file.

    -U <unicast address>

    Do a unicast query to the specified address or host unicast address. This option (along with the -R option) is needed to - query a WINS server.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the + query a WINS server.

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -67,13 +67,13 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension ".client" will be appended. The log file is never removed by the client. @@ -98,8 +98,8 @@ never removed by the client. by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/ntlm_auth.1.html b/docs/htmldocs/ntlm_auth.1.html index 27dfee1a0f..a1ba53137d 100644 --- a/docs/htmldocs/ntlm_auth.1.html +++ b/docs/htmldocs/ntlm_auth.1.html @@ -11,8 +11,8 @@ Specify domain of user to authenticate

    --workstation=WORKSTATION

    Specify the workstation the user authenticated from -

    --challenge=STRING

    challenge (HEX encoded)

    --lm-response=RESPONSE

    LM Response to the challenge (HEX encoded)

    --nt-response=RESPONSE

    NT or NTLMv2 Response to the challenge (HEX encoded)

    --password=PASSWORD

    User's plaintext password

    --request-lm-key

    Retreive LM session key

    --request-nt-key

    Request NT key

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +

    --challenge=STRING

    challenge (HEX encoded)

    --lm-response=RESPONSE

    LM Response to the challenge (HEX encoded)

    --nt-response=RESPONSE

    NT or NTLMv2 Response to the challenge (HEX encoded)

    --password=PASSWORD

    User's plaintext password

    --request-lm-key

    Retreive LM session key

    --request-nt-key

    Request NT key

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -25,13 +25,13 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension ".client" will be appended. The log file is never removed by the client. diff --git a/docs/htmldocs/optional.html b/docs/htmldocs/optional.html index bd76a344f8..af8b99a5f3 100644 --- a/docs/htmldocs/optional.html +++ b/docs/htmldocs/optional.html @@ -1,35 +1,6 @@ -Part III. Advanced Configuration

    Part III. Advanced Configuration
    Prev   Next

    Advanced Configuration

    Valuable Nuts and Bolts Information

    +Part III. Advanced Configuration

    Part III. Advanced Configuration
    Prev   Next

    Advanced Configuration

    Valuable Nuts and Bolts Information

    Samba has several features that you might want or might not want to use. The chapters in this part each cover specific Samba features. -

    Table of Contents

    10. Samba / MS Windows Network Browsing Guide
    Features and Benefits
    What is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP - without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Setting up WORKGROUP Browsing
    Setting up DOMAIN Browsing
    Forcing Samba to be the master
    Making Samba the domain master
    Note about broadcast addresses
    Multiple interfaces
    Use of the Remote Announce parameter
    Use of the Remote Browse Sync parameter
    WINS - The Windows Internetworking Name Server
    Setting up a WINS server
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of browsing
    Browsing support in Samba
    Problem resolution
    Browsing across subnets
    Common Errors
    How can one flush the Samba NetBIOS name cache without restarting Samba?
    My client reports "This server is not configured to list shared resources"
    I get an Unable to browse the network error
    11. Account Information Databases
    Features and Benefits
    Backwards Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon
    Users being added to wrong backend database
    auth methods does not work
    12. Mapping MS Windows and UNIX Groups
    Features and Benefits
    Discussion
    Example Configuration
    Configuration Scripts
    Sample smb.conf add group script
    Script to configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users group
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group Based Controls
    File and Directory Permissions Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing file ownership
    Viewing File or Directory Permissions
    Modifying file or directory permissions
    Interaction with the standard Samba create mask - parameters
    Interaction with the standard Samba file attribute mapping
    Common Errors
    Users can not write to a public share
    I have set force user but Samba still makes root the owner of all the files I touch!
    MS Word with Samba changes owner of file
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb error messages
    Problems saving files in MS Office on Windows XP
    Long delays deleting files over network with XP SP1
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-style Domain Trusts with Windows 2000
    Common Errors
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    A simple Configuration to Print
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various UNIX Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba 3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with -rpcclient
    Client Driver Install Procedure
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a -different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost
    19. CUPS Printing Support in Samba 3.0
    Introduction
    Features and Benefits
    Overview
    Basic Configuration of CUPS support
    Linking of smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More complex smb.conf Settings for -CUPS
    Advanced Configuration
    Central spooling vs. "Peer-to-Peer" printing
    CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
    Driver Installation Methods on Windows Clients
    Explicitly enable "raw" printing for -application/octet-stream!
    Three familiar Methods for driver upload plus a new one
    Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript -- the Software RIP for non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    CUPS can use all Windows-formatted Vendor PPDs
    CUPS also uses PPDs for non-PostScript Printers
    The CUPS Filtering Architecture
    MIME types and CUPS Filters
    MIME type Conversion Rules
    Filter Requirements
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    cupsomatic/Foomatic -- how do they fit into the Picture?
    The Complete Picture
    mime.convs
    "Raw" printing
    "application/octet-stream" printing
    PostScript Printer Descriptions (PPDs) for non-PS Printers
    Difference between cupsomatic/foomatic-rip and -native CUPS printing
    Examples for filtering Chains
    Sources of CUPS drivers / PPDs
    Printing with Interface Scripts
    Network printing (purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows clients -- UNIX/Samba Print -Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba receiving Jobfiles and passing them to CUPS
    Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs
    PPDs for non-PS Printers on UNIX
    PPDs for non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers running in "Kernel Mode" cause many -Problems
    Workarounds impose Heavy Limitations
    CUPS: a "Magical Stone"?
    PostScript Drivers with no major problems -- even in Kernel -Mode
    Setting up CUPS for driver Download
    cupsaddsmb: the unknown Utility
    Prepare your smb.conf for cupsaddsmb
    CUPS Package of "PostScript Driver for WinNT/2k/XP"
    Recognize the different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
    Caveats to be considered
    Benefits of using "CUPS PostScript Driver for -Windows NT/2k/XP" instead of Adobe Driver
    Run "cupsaddsmb" (quiet Mode)
    Run "cupsaddsmb" with verbose Output
    Understanding cupsaddsmb
    How to recognize if cupsaddsmb completed successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding critical PostScript Driver Settings on the -Client
    Installing PostScript Driver Files manually (using -rpcclient)
    A Check of the rpcclient man Page
    Understanding the rpcclient man page
    Producing an Example by querying a Windows Box
    What is required for adddriver and setdriver to succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting revisited
    The printing *.tdb Files
    Trivial DataBase Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting up Quotas
    Correct and incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Other Accounting Tools
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings explained
    Pre-conditions
    Manual Configuration
    In Case of Trouble.....
    Printing from CUPS to Windows attached -Printers
    More CUPS filtering Chains
    Common Errors
    Win9x client can't install driver
    "cupsaddsmb" keeps asking for root password in - neverending loop
    "cupsaddsmb" gives "No PPD file for printer..." - message while PPD file is present
    Client can't connect to Samba printer
    Can't reconnect to Samba under new account - from Win2K/XP
    Avoid being connected to the Samba server as the - "wrong" user
    Upgrading to CUPS drivers from Adobe drivers on - NT/2K/XP clients gives problems
    Can't use "cupsaddsmb" on Samba server which is - a PDC
    Deleted Win2K printer driver is still shown
    Win2K/XP "Local Security - Policies"
    WinXP clients: "Administrator can not install - printers for all local users"
    "Print Change Notify" functions on - NT-clients
    WinXP-SP1
    Print options for all users can't be set on Win2K/XP
    Most common blunders in driver - settings on Windows clients
    cupsaddsmb does not work - with newly installed printer
    Permissions on -/var/spool/samba/ get reset after each -reboot
    Printer named "lp" -intermittently swallows jobs and spits out completely different -ones
    Location of Adobe PostScript driver files necessary for "cupsaddsmb"
    An Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS modules available elsewhere
    DatabaseFS
    vscan
    21. Winbind: Use of Domain Accounts
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachines.Com
    Network Logon Script Magic
    Adding printers without user intervention
    Common Errors
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/Me Policies
    Windows NT4 Style Policy Files
    MS Windows 200x / XP Professional Policies
    Managing Account/User Policies
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory profiles
    Creating/Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Setting up roaming profiles for just a few user's or group's?
    Can NOT use Roaming Profiles
    Changing the default profile
    25. PAM based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    Winbind is not resolving users and groups
    26. Integrating MS Windows networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a pure UNIX/Linux world
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name resolution as used within MS Windows networking
    The NetBIOS Name Cache
    The LMHOSTS file
    HOSTS file
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging works only in one way
    Very Slow Network Connections
    Samba server name change problem
    27. Unicode/Charsets
    Features and Benefits
    What are charsets and unicode?
    Samba and charsets
    Conversion from old names
    Japanese charsets
    Common errors
    CP850.so can't be found
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    Prev Up Next
    Chapter 9. MS Windows Network Configuration Guide Home Chapter 10. Samba / MS Windows Network Browsing Guide
    +

    Table of Contents

    10. Network Browsing
    Features and Benefits
    What Is Browsing?
    Discussion
    NetBIOS over TCP/IP
    TCP/IP without NetBIOS
    DNS and Active Directory
    How Browsing Functions
    Configuring WORKGROUP Browsing
    DOMAIN Browsing Configuration
    Forcing Samba to Be the Master
    Making Samba the Domain Master
    Note about Broadcast Addresses
    Multiple Interfaces
    Use of the Remote Announce Parameter
    Use of the Remote Browse Sync Parameter
    WINS The Windows Internetworking Name Server
    WINS Server Configuration
    WINS Replication
    Static WINS Entries
    Helpful Hints
    Windows Networking Protocols
    Name Resolution Order
    Technical Overview of Browsing
    Browsing Support in Samba
    Problem Resolution
    Cross-Subnet Browsing
    Common Errors
    How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?
    Server Resources Can Not Be Listed
    I get an `Unable to browse the network' error
    Browsing of Shares and Directories is Very Slow
    11. Account Information Databases
    Features and Benefits
    Backward Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plaintext
    smbpasswd Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users Cannot Logon
    Users Being Added to the Wrong Backend Database
    Configuration of auth methods
    12. Group Mapping MS Windows and UNIX
    Features and Benefits
    Discussion
    Default Users, Groups and Relative Identifiers
    Example Configuration
    Configuration Scripts
    Sample smb.conf Add Group Script
    Script to Configure Group Mapping
    Common Errors
    Adding Groups Fails
    Adding MS Windows Groups to MS Windows Groups Fails
    Adding Domain Users to the Power Users Group
    13. File, Directory and Share Access Controls
    Features and Benefits
    File System Access Controls
    MS Windows NTFS Comparison with UNIX File Systems
    Managing Directories
    File and Directory Access Control
    Share Definition Access Controls
    User and Group-Based Controls
    File and Directory Permissions-Based Controls
    Miscellaneous Controls
    Access Controls on Shares
    Share Permissions Management
    MS Windows Access Control Lists and UNIX Interoperability
    Managing UNIX Permissions Using NT Security Dialogs
    Viewing File Security on a Samba Share
    Viewing File Ownership
    Viewing File or Directory Permissions
    Modifying File or Directory Permissions
    Interaction with the Standard Samba create mask Parameters
    Interaction with the Standard Samba File Attribute Mapping
    Common Errors
    Users Cannot Write to a Public Share
    File Operations Done as root with force user Set
    MS Word with Samba Changes Owner of File
    14. File and Record Locking
    Features and Benefits
    Discussion
    Opportunistic Locking Overview
    Samba Opportunistic Locking Control
    Example Configuration
    MS Windows Opportunistic Locking and Caching Controls
    Workstation Service Entries
    Server Service Entries
    Persistent Data Corruption
    Common Errors
    locking.tdb Error Messages
    Problems Saving Files in MS Office on Windows XP
    Long Delays Deleting Files Over Network with XP SP1
    Additional Reading
    15. Securing Samba
    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using Host-Based Protection
    User-Based Protection
    Using Interface Protection
    Using a Firewall
    Using IPC$ Share-Based Denials
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient Works on Localhost, but the Network Is Dead
    Why Can Users Access Home Directories of Other Users?
    16. Interdomain Trust Relationships
    Features and Benefits
    Trust Relationship Background
    Native MS Windows NT4 Trusts Configuration
    Creating an NT4 Domain Trust
    Completing an NT4 Domain Trust
    Inter-Domain Trust Facilities
    Configuring Samba NT-Style Domain Trusts
    Samba as the Trusted Domain
    Samba as the Trusting Domain
    NT4-Style Domain Trusts with Windows 2000
    Common Errors
    17. Hosting a Microsoft Distributed File System tree on Samba
    Features and Benefits
    Common Errors
    MSDFS UNIX Path Is Case-Critical
    18. Classical Printing Support
    Features and Benefits
    Technical Introduction
    Client to Samba Print Job Processing
    Printing Related Configuration Parameters
    Simple Print Configuration
    Verifing Configuration with testparm
    Rapid Configuration Validation
    Extended Printing Configuration
    Detailed Explanation Settings
    Printing Developments Since Samba-2.2
    Point'n'Print Client Drivers on Samba Servers
    The Obsoleted [printer$] Section
    Creating the [print$] Share
    [print$] Section Parameters
    The [print$] Share Directory
    Installing Drivers into [print$]
    Add Printer Wizard Driver Installation
    Installing Print Drivers Using rpcclient
    Client Driver Installation Procedure
    First Client Driver Installation
    Setting Device Modes on New Printers
    Additional Client Driver Installation
    Always Make First Client Connection as root or printer admin
    Other Gotchas
    Setting Default Print Options for Client Drivers
    Supporting Large Numbers of Printers
    Adding New Printers with the Windows NT APW
    Error Message: Cannot connect under a different Name
    Take Care When Assembling Driver Files
    Samba and Printer Ports
    Avoiding Common Client Driver Misconfiguration
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Adding Network Printers without User Interaction
    The addprinter Command
    Migration of Classical Printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I Give My Root Password but I Do Not Get Access
    My Print Jobs Get Spooled into the Spooling Directory, but Then Get Lost
    19. CUPS Printing Support
    Introduction
    Features and Benefits
    Overview
    Basic CUPS Support Configuration
    Linking smbd with libcups.so
    Simple smb.conf Settings for CUPS
    More Complex CUPS smb.conf Settings
    Advanced Configuration
    Central Spooling vs. Peer-to-Peer Printing
    Raw Print Serving Vendor Drivers on Windows Clients
    Installation of Windows Client Drivers
    Explicitly Enable raw Printing for application/octet-stream
    Driver Upload Methods
    Advanced Intelligent Printing with PostScript Driver Download
    GDI on Windows -- PostScript on UNIX
    Windows Drivers, GDI and EMF
    UNIX Printfile Conversion and GUI Basics
    PostScript and Ghostscript
    Ghostscript the Software RIP for Non-PostScript Printers
    PostScript Printer Description (PPD) Specification
    Using Windows-Formatted Vendor PPDs
    CUPS Also Uses PPDs for Non-PostScript Printers
    The CUPS Filtering Architecture
    MIME Types and CUPS Filters
    MIME Type Conversion Rules
    Filtering Overview
    Prefilters
    pstops
    pstoraster
    imagetops and imagetoraster
    rasterto [printers specific]
    CUPS Backends
    The Role of cupsomatic/foomatic
    The Complete Picture
    mime.convs
    Raw Printing
    application/octet-stream Printing
    PostScript Printer Descriptions (PPDs) for Non-PS Printers
    cupsomatic/foomatic-rip Versus native CUPS Printing
    Examples for Filtering Chains
    Sources of CUPS Drivers/PPDs
    Printing with Interface Scripts
    Network Printing (Purely Windows)
    From Windows Clients to an NT Print Server
    Driver Execution on the Client
    Driver Execution on the Server
    Network Printing (Windows Clients UNIX/Samba Print +Servers)
    From Windows Clients to a CUPS/Samba Print Server
    Samba Receiving Jobfiles and Passing Them to CUPS
    Network PostScript RIP
    PPDs for Non-PS Printers on UNIX
    PPDs for Non-PS Printers on Windows
    Windows Terminal Servers (WTS) as CUPS Clients
    Printer Drivers Running in Kernel Mode Cause Many +Problems
    Workarounds Impose Heavy Limitations
    CUPS: A Magical Stone?
    PostScript Drivers with No Major Problems Even in Kernel +Mode
    Configuring CUPS for Driver Download
    cupsaddsmb: The Unknown Utility
    Prepare Your smb.conf for cupsaddsmb
    CUPS PostScript Driver for Windows NT/200x/XP
    Recognizing Different Driver Files
    Acquiring the Adobe Driver Files
    ESP Print Pro PostScript Driver for Windows NT/200x/XP
    Caveats to be Considered
    Windows CUPS PostScript Driver Versus Adobe Driver
    Run cupsaddsmb (Quiet Mode)
    Run cupsaddsmb with Verbose Output
    Understanding cupsaddsmb
    How to Recognize If cupsaddsmb Completed Successfully
    cupsaddsmb with a Samba PDC
    cupsaddsmb Flowchart
    Installing the PostScript Driver on a Client
    Avoiding Critical PostScript Driver Settings on the Client
    Installing PostScript Driver Files Manually Using rpcclient
    A Check of the rpcclient man Page
    Understanding the rpcclient man Page
    Producing an Example by Querying a Windows Box
    Requirements for adddriver and setdriver to Succeed
    Manual Driver Installation in 15 Steps
    Troubleshooting Revisited
    The Printing *.tdb Files
    Trivial Database Files
    Binary Format
    Losing *.tdb Files
    Using tdbbackup
    CUPS Print Drivers from Linuxprinting.org
    foomatic-rip and Foomatic Explained
    foomatic-rip and Foomatic-PPD Download and Installation
    Page Accounting with CUPS
    Setting Up Quotas
    Correct and Incorrect Accounting
    Adobe and CUPS PostScript Drivers for Windows Clients
    The page_log File Syntax
    Possible Shortcomings
    Future Developments
    Additional Material
    Auto-Deletion or Preservation of CUPS Spool Files
    CUPS Configuration Settings Explained
    Pre-Conditions
    Manual Configuration
    Printing from CUPS to Windows Attached Printers
    More CUPS-Filtering Chains
    Common Errors
    Windows 9x/ME Client Can't Install Driver
    cupsaddsmb Keeps Asking for Root Password in Never-ending Loop
    cupsaddsmb Errors
    Client Can't Connect to Samba Printer
    New Account Reconnection from Windows 200x/XP Troubles
    Avoid Being Connected to the Samba Server as the Wrong User
    Upgrading to CUPS Drivers from Adobe Drivers
    Can't Use cupsaddsmb on Samba Server Which Is a PDC
    Deleted Windows 200x Printer Driver Is Still Shown
    Windows 200x/XP "Local Security Policies"
    Administrator Cannot Install Printers for All Local Users
    Print Change Notify Functions on NT-clients
    WinXP-SP1
    Print Options for All Users Can't Be Set on Windows 200x/XP
    Most Common Blunders in Driver Settings on Windows Clients
    cupsaddsmb Does Not Work with Newly Installed Printer
    Permissions on /var/spool/samba/ Get Reset After Each Reboot
    Print Queue Called lp Mis-handles Print Jobs
    Location of Adobe PostScript Driver Files for cupsaddsmb
    Overview of the CUPS Printing Processes
    20. Stackable VFS modules
    Features and Benefits
    Discussion
    Included Modules
    audit
    extd_audit
    fake_perms
    recycle
    netatalk
    VFS Modules Available Elsewhere
    DatabaseFS
    vscan
    21. Winbind: Use of Domain Accounts
    Features and Benefits
    Introduction
    What Winbind Provides
    Target Uses
    How Winbind Works
    Microsoft Remote Procedure Calls
    Microsoft Active Directory Services
    Name Service Switch
    Pluggable Authentication Modules
    User and Group ID Allocation
    Result Caching
    Installation and Configuration
    Introduction
    Requirements
    Testing Things Out
    Conclusion
    Common Errors
    NSCD Problem Warning
    Winbind Is Not Resolving Users and Groups
    22. Advanced Network Management
    Features and Benefits
    Remote Server Administration
    Remote Desktop Management
    Remote Management from NoMachine.Com
    Network Logon Script Magic
    Adding Printers without User Intervention
    23. System and Account Policies
    Features and Benefits
    Creating and Managing System Policies
    Windows 9x/ME Policies
    Windows NT4-Style Policy Files
    MS Windows 200x/XP Professional Policies
    Managing Account/User Policies
    Management Tools
    Samba Editreg Toolset
    Windows NT4/200x
    Samba PDC
    System Startup and Logon Processing Overview
    Common Errors
    Policy Does Not Work
    24. Desktop Profile Management
    Features and Benefits
    Roaming Profiles
    Samba Configuration for Profile Handling
    Windows Client Profile Configuration Information
    Sharing Profiles between W9x/Me and NT4/200x/XP Workstations
    Profile Migration from Windows NT4/200x Server to Samba
    Mandatory Profiles
    Creating and Managing Group Profiles
    Default Profile for Windows Users
    MS Windows 9x/Me
    MS Windows NT4 Workstation
    MS Windows 200x/XP
    Common Errors
    Configuring Roaming Profiles for a Few Users or Groups
    Cannot Use Roaming Profiles
    Changing the Default Profile
    25. PAM-Based Distributed Authentication
    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication Using winbindd.so
    Password Synchronization Using pam_smbpass.so
    Common Errors
    pam_winbind Problem
    Winbind Is Not Resolving Users and Groups
    26. Integrating MS Windows Networks with Samba
    Features and Benefits
    Background Information
    Name Resolution in a Pure UNIX/Linux World
    /etc/hosts
    /etc/resolv.conf
    /etc/host.conf
    /etc/nsswitch.conf
    Name Resolution as Used within MS Windows Networking
    The NetBIOS Name Cache
    The LMHOSTS File
    HOSTS File
    DNS Lookup
    WINS Lookup
    Common Errors
    Pinging Works Only in One Way
    Very Slow Network Connections
    Samba Server Name Change Problem
    27. Unicode/Charsets
    Features and Benefits
    What Are Charsets and Unicode?
    Samba and Charsets
    Conversion from Old Names
    Japanese Charsets
    Common Errors
    CP850.so Can't Be Found
    28. Samba Backup Techniques
    Note
    Features and Benefits
    29. High Availability Options
    Note
    Prev Up Next
    Chapter 9. MS Windows Network Configuration Guide Home Chapter 10. Network Browsing
    diff --git a/docs/htmldocs/pam.html b/docs/htmldocs/pam.html index 8edbdb26ca..f41a9bc5c8 100644 --- a/docs/htmldocs/pam.html +++ b/docs/htmldocs/pam.html @@ -1,101 +1,104 @@ -Chapter 25. PAM based Distributed Authentication
    Chapter 25. PAM based Distributed Authentication
    Prev Part III. Advanced Configuration Next

    Chapter 25. PAM based Distributed Authentication

    John H. Terpstra

    Samba Team

    Stephen Langasek

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication using winbindd.so
    Password Synchronization using pam_smbpass.so
    Common Errors
    pam_winbind problem
    Winbind is not resolving users and groups

    -This chapter you should help you to deploy winbind based authentication on any PAM enabled -UNIX/Linux system. Winbind can be used to enable user level application access authentication -from any MS Windows NT Domain, MS Windows 200x Active Directory based domain, or any Samba -based domain environment. It will also help you to configure PAM based local host access +Chapter 25. PAM-Based Distributed Authentication

    Chapter 25. PAM-Based Distributed Authentication
    Prev Part III. Advanced Configuration Next

    Chapter 25. PAM-Based Distributed Authentication

    John H. Terpstra

    Samba Team

    Stephen Langasek

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Discussion
    PAM Configuration Syntax
    Example System Configurations
    smb.conf PAM Configuration
    Remote CIFS Authentication Using winbindd.so
    Password Synchronization Using pam_smbpass.so
    Common Errors
    pam_winbind Problem
    Winbind Is Not Resolving Users and Groups

    +This chapter should help you to deploy Winbind-based authentication on any PAM-enabled +UNIX/Linux system. Winbind can be used to enable User-Level application access authentication +from any MS Windows NT Domain, MS Windows 200x Active Directory-based +domain, or any Samba-based domain environment. It will also help you to configure PAM-based local host access controls that are appropriate to your Samba configuration.

    -In addition to knowing how to configure winbind into PAM, you will learn generic PAM management -possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage. +In addition to knowing how to configure Winbind into PAM, you will learn generic PAM management +possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage.

    Note

    -The use of Winbind require more than PAM configuration alone. Please refer to the Winbind chapter. -

    Features and Benefits

    -A number of UNIX systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, +The use of Winbind requires more than PAM configuration alone. +Please refer to , for further information regarding Winbind. +

    Features and Benefits

    +A number of UNIX systems (e.g., Sun Solaris), as well as the xxxxBSD family and Linux, now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication, authorization and resource control services. Prior to the introduction of PAM, a decision to use an alternative to the system password database (/etc/passwd) would require the provision of alternatives for all programs that provide security services. -Such a choice would involve provision of alternatives to such programs as: login, -passwd, chown, etc. +Such a choice would involve provision of alternatives to programs such as: login, +passwd, chown, and so on.

    PAM provides a mechanism that disconnects these security programs from the underlying -authentication/authorization infrastructure. PAM is configured either through one file -/etc/pam.conf (Solaris), or by editing individual files that are +authentication/authorization infrastructure. PAM is configured by making appropriate modifications to one file +/etc/pam.conf (Solaris), or by editing individual control files that are located in /etc/pam.d.

    -On PAM enabled UNIX/Linux systems it is an easy matter to configure the system to use any -authentication backend, so long as the appropriate dynamically loadable library modules -are available for it. The backend may be local to the system, or may be centralised on a +On PAM-enabled UNIX/Linux systems, it is an easy matter to configure the system to use any +authentication backend so long as the appropriate dynamically loadable library modules +are available for it. The backend may be local to the system, or may be centralized on a remote server.

    PAM support modules are available for: -

    /etc/passwd:

    +

    /etc/passwd

    There are several PAM modules that interact with this standard UNIX user - database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so - and pam_userdb.so. -

    Kerberos:

    - The pam_krb5.so module allows the use of any Kerberos compliant server. + database. The most common are called: pam_unix.so, pam_unix2.so, pam_pwdb.so + and pam_userdb.so. +

    Kerberos

    + The pam_krb5.so module allows the use of any Kerberos compliant server. This tool is used to access MIT Kerberos, Heimdal Kerberos, and potentially Microsoft Active Directory (if enabled). -

    LDAP:

    - The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend +

    LDAP

    + The pam_ldap.so module allows the use of any LDAP v2 or v3 compatible backend server. Commonly used LDAP backend servers include: OpenLDAP v2.0 and v2.1, Sun ONE iDentity server, Novell eDirectory server, Microsoft Active Directory. -

    NetWare Bindery:

    - The pam_ncp_auth.so module allows authentication off any bindery enabled - NetWare Core Protocol based server. -

    SMB Password:

    - This module, called pam_smbpass.so, will allow user authentication off +

    NetWare Bindery

    + The pam_ncp_auth.so module allows authentication off any bindery-enabled + NetWare Core Protocol-based server. +

    SMB Password

    + This module, called pam_smbpass.so, will allow user authentication off the passdb backend that is configured in the Samba smb.conf file. -

    SMB Server:

    - The pam_smb_auth.so module is the original MS Windows networking authentication +

    SMB Server

    + The pam_smb_auth.so module is the original MS Windows networking authentication tool. This module has been somewhat outdated by the Winbind module. -

    Winbind:

    - The pam_winbind.so module allows Samba to obtain authentication from any +

    Winbind

    + The pam_winbind.so module allows Samba to obtain authentication from any MS Windows Domain Controller. It can just as easily be used to authenticate - users for access to any PAM enabled application. -

    RADIUS:

    + users for access to any PAM-enabled application. +

    RADIUS

    There is a PAM RADIUS (Remote Access Dial-In User Service) authentication - module. In most cases the administrator will need to locate the source code + module. In most cases, administrators will need to locate the source code for this tool and compile and install it themselves. RADIUS protocols are used by many routers and terminal servers.

    -Of the above, Samba provides the pam_smbpasswd.so and the pam_winbind.so modules alone. +Of the above, Samba provides the pam_smbpasswd.so and the pam_winbind.so modules alone.

    Once configured, these permit a remarkable level of flexibility in the location and use -of distributed samba domain controllers that can provide wide are network bandwidth -efficient authentication services for PAM capable systems. In effect, this allows the -deployment of centrally managed and maintained distributed authentication from a single -user account database. -

    Technical Discussion

    +of distributed Samba Domain Controllers that can provide wide area network bandwidth +efficient authentication services for PAM-capable systems. In effect, this allows the +deployment of centrally managed and maintained distributed authentication from a +single-user account database. +

    Technical Discussion

    PAM is designed to provide the system administrator with a great deal of flexibility in configuration of the privilege granting applications of their system. The local configuration of system security controlled by PAM is contained in one of two places: -either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory. -

    PAM Configuration Syntax

    +either the single system file, /etc/pam.conf, or the +/etc/pam.d/ directory. +

    PAM Configuration Syntax

    In this section we discuss the correct syntax of and generic options respected by entries to these files. -PAM specific tokens in the configuration file are case insensitive. The module paths, however, are case -sensitive since they indicate a file's name and reflect the case dependence of typical file-systems. +PAM-specific tokens in the configuration file are case insensitive. The module paths, however, are case +sensitive since they indicate a file's name and reflect the case +dependence of typical file systems. The case-sensitivity of the arguments to any given module is defined for each module in turn.

    In addition to the lines described below, there are two special characters provided for the convenience -of the system administrator: comments are preceded by a `#' and extend to the next end-of-line; also, -module specification lines may be extended with a `\' escaped newline. +of the system administrator: comments are preceded by a “#” and extend to the next end-of-line; also, +module specification lines may be extended with a “\” escaped newline.

    If the PAM authentication module (loadable link library file) is located in the -default location then it is not necessary to specify the path. In the case of +default location, then it is not necessary to specify the path. In the case of Linux, the default location is /lib/security. If the module -is located outside the default then the path must be specified as: +is located outside the default, then the path must be specified as: 

     auth  required  /other_path/pam_strange_module.so

    -

    Anatomy of /etc/pam.d Entries

    +

    Anatomy of /etc/pam.d Entries

    The remaining information in this subsection was taken from the documentation of the Linux-PAM project. For more information on PAM, see -The Official Linux-PAM home page +The Official Linux-PAM home page.

    -A general configuration line of the /etc/pam.conf file has the following form: +A general configuration line of the /etc/pam.conf file has the following form: 

     service-name   module-type   control-flag   module-path   args
@@ -104,36 +107,38 @@ service-name   module-type   control-flag   module-path   args
 Below, we explain the meaning of each of these tokens. The second (and more recently adopted)
 way of configuring Linux-PAM is via the contents of the /etc/pam.d/ directory.
 Once we have explained the meaning of the above tokens, we will describe this method.
-
    service-name:
    
-		The name of the service associated with this entry. Frequently the service name is the conventional
-		name of the given application. For example, `ftpd', `rlogind' and `su', etc. .
+
    service-name
    
+		The name of the service associated with this entry. Frequently, the service name is the conventional
+		name of the given application. For example, ftpd, rlogind and
+		su, and so on.
 		
    
-		There is a special service-name, reserved for defining a default authentication mechanism. It has
-		the name `OTHER' and may be specified in either lower or upper case characters. Note, when there
-		is a module specified for a named service, the `OTHER' entries are ignored.
-		
    module-type:
    
+		There is a special service-name reserved for defining a default authentication mechanism. It has
+		the name OTHER and may be specified in either lower- or upper-case characters.
+		Note, when there is a module specified for a named service, the OTHER
+		entries are ignored.
+		
    module-type
    
 		One of (currently) four types of module. The four types are as follows:
 		
    • 
-			auth: this module type provides two aspects of authenticating the user.
-			Firstly, it establishes that the user is who they claim to be, by instructing the application
+			auth: This module type provides two aspects of authenticating the user.
+			It establishes that the user is who he claims to be by instructing the application
 			to prompt the user for a password or other means of identification. Secondly, the module can
 			grant group membership (independently of the /etc/groups file discussed
 			above) or other privileges through its credential granting properties.
 			
    • 
-			account: this module performs non-authentication based account management.
+			account: This module performs non-authentication-based account management.
 			It is typically used to restrict/permit access to a service based on the time of day, currently
 		 	available system resources (maximum number of users) or perhaps the location of the applicant
-			user `root' login only on the console.
+			user “root” login only on the console.
 			
    • 
-			session: primarily, this module is associated with doing things that need
-			to be done for the user before/after they can be given service. Such things include the logging
-			of information concerning the opening/closing of some data exchange with a user, mounting
-			directories, etc.
+			session: Primarily, this module is associated with doing things that need
+			to be done for the user before and after they can be given service. Such things include the logging
+			of information concerning the opening and closing of some data exchange with a user, mounting
+			directories, and so on.
 			
    • 
-			password: this last module type is required for updating the authentication
-			token associated with the user. Typically, there is one module for each `challenge/response'
-			based authentication (auth) module-type.
-			
    control-flag:
    
+			password: This last module type is required for updating the authentication
+			token associated with the user. Typically, there is one module for each “challenge/response”
+			-based authentication (auth) module type.
+			
    control-flag
    
 		The control-flag is used to indicate how the PAM library will react to the success or failure of the
 		module it is associated with. Since modules can be stacked (modules of the same type execute in series,
 		one after another), the control-flags determine the relative importance of each module. The application
@@ -145,129 +150,135 @@ Once we have explained the meaning of the above tokens, we will describe this me
 		
    
 		The simpler (and historical) syntax for the control-flag is a single keyword defined to indicate the
 		severity of concern associated with the success or failure of a specific module. There are four such
-		keywords: required, requisite, sufficient and optional.
+		keywords: required, requisite, sufficient and optional.
 		
    
 		The Linux-PAM library interprets these keywords in the following manner:
 		
    • 
-			required: this indicates that the success of the module is required for the
+			required: This indicates that the success of the module is required for the
 			module-type facility to succeed. Failure of this module will not be apparent to the user until all
 			of the remaining modules (of the same module-type) have been executed.
 			
    • 
-			requisite: like required, however, in the case that such a module returns a
+			requisite: Like required, however, in the case that such a module returns a
 			failure, control is directly returned to the application. The return value is that associated with
-			the first required or requisite module to fail. Note, this flag can be used to protect against the
+			the first required or requisite module to fail. This flag can be used to protect against the
 			possibility of a user getting the opportunity to enter a password over an unsafe medium. It is
 			conceivable that such behavior might inform an attacker of valid accounts on a system. This
 			possibility should be weighed against the not insignificant concerns of exposing a sensitive
 			password in a hostile environment.
 			
    • 
-                        sufficient: the success of this module is deemed `sufficient' to satisfy
+                        sufficient: The success of this module is deemed sufficient to satisfy
 			the Linux-PAM library that this module-type has succeeded in its purpose. In the event that no
-			previous required module has failed, no more `stacked' modules of this type are invoked. (Note,
-			in this case subsequent required modules are not invoked.). A failure of this module is not deemed
+			previous required module has failed, no more “stacked” modules of this type are invoked.
+			(In this case, subsequent required modules are not invoked). A failure of this module is not deemed
 			as fatal to satisfying the application that this module-type has succeeded.
 			
    • 
-                        optional: as its name suggests, this control-flag marks the module as not
+                        optional: As its name suggests, this control-flag marks the module as not
 			being critical to the success or failure of the user's application for service. In general,
 			Linux-PAM ignores such a module when determining if the module stack will succeed or fail.
 			However, in the absence of any definite successes or failures of previous or subsequent stacked
-			modules this module will determine the nature of the response to the application. One example of
+			modules, this module will determine the nature of the response to the application. One example of
 			this latter case, is when the other modules return something like PAM_IGNORE.
 			
    
 		The more elaborate (newer) syntax is much more specific and gives the administrator a great deal of control
 		over how the user is authenticated. This form of the control flag is delimited with square brackets and
-		consists of a series of value=action tokens:
+		consists of a series of value=action tokens:
 		
     [value1=action1 value2=action2 ...]
 
    
-		Here, value1 is one of the following return values: success; open_err; symbol_err; service_err;
-		system_err; buf_err; perm_denied; auth_err; cred_insufficient; authinfo_unavail; user_unknown; maxtries;
-		new_authtok_reqd; acct_expired; session_err; cred_unavail; cred_expired; cred_err; no_module_data; conv_err;
-		authtok_err; authtok_recover_err; authtok_lock_busy; authtok_disable_aging; try_again; ignore; abort;
-		authtok_expired; module_unknown; bad_item; and default. The last of these (default) can be used to set
-		the action for those return values that are not explicitly defined.
+		Here, value1 is one of the following return values:
+
    +success; open_err; symbol_err; service_err; system_err; buf_err;
+perm_denied; auth_err; cred_insufficient; authinfo_unavail;
+user_unknown; maxtries; new_authtok_reqd; acct_expired; session_err;
+cred_unavail; cred_expired; cred_err; no_module_data; conv_err;
+authtok_err; authtok_recover_err; authtok_lock_busy;
+authtok_disable_aging; try_again; ignore; abort; authtok_expired;
+module_unknown; bad_item; and default.
+
    
+
    
+		The last of these (default) can be used to set the action for those return values that are not explicitly defined.
 		
    
-		The action1 can be a positive integer or one of the following tokens: ignore; ok; done; bad; die; and reset.
+		The action1 can be a positive integer or one of the following tokens: 
+		ignore; ok; done; bad; die; and reset.
 		A positive integer, J, when specified as the action, can be used to indicate that the next J modules of the
 		current module-type will be skipped. In this way, the administrator can develop a moderately sophisticated
 		stack of modules with a number of different paths of execution. Which path is taken can be determined by the
 		reactions of individual modules.
 		
    • 
-			ignore: when used with a stack of modules, the module's return status will not
+			ignore: When used with a stack of modules, the module's return status will not
 			contribute to the return code the application obtains.
 			
    • 
-                        bad: this action indicates that the return code should be thought of as indicative
+                        bad: This action indicates that the return code should be thought of as indicative
 			of the module failing. If this module is the first in the stack to fail, its status value will be used
 			for that of the whole stack.
 			
    • 
-                        die: equivalent to bad with the side effect of terminating the module stack and
+                        die: Equivalent to bad with the side effect of terminating the module stack and
 			PAM immediately returning to the application.
 			
    • 
-                        ok: this tells PAM that the administrator thinks this return code should
+                        ok: This tells PAM that the administrator thinks this return code should
 			contribute directly to the return code of the full stack of modules. In other words, if the former
 			state of the stack would lead to a return of PAM_SUCCESS, the module's return code will override
 			this value. Note, if the former state of the stack holds some value that is indicative of a modules
-			failure, this 'ok' value will not be used to override that value.
+			failure, this ok value will not be used to override that value.
 			
    • 
-                        done: equivalent to ok with the side effect of terminating the module stack and
+                        done: Equivalent to ok with the side effect of terminating the module stack and
 			PAM immediately returning to the application.
                         
    • 
-                        reset: clear all memory of the state of the module stack and start again with
+                        reset: Clears all memory of the state of the module stack and starts again with
 			the next stacked module.
 			
    
-		Each of the four keywords: required; requisite; sufficient; and optional, have an equivalent expression in
-		terms of the [...] syntax. They are as follows:
+		Each of the four keywords: required; requisite; sufficient; and optional,
+		have an equivalent expression in terms of the [...] syntax. They are as follows:
 		
    
 		
    • 
-			required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad]
+			required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad].
 			
    • 
-			requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die]
+			requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die].
 			
    • 
-			sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore]
+					sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore].
 			
    • 
-			optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore]
+			optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore].
 			
    
 		
    
 		Just to get a feel for the power of this new syntax, here is a taste of what you can do with it. With Linux-PAM-0.63,
 		the notion of client plug-in agents was introduced. This is something that makes it possible for PAM to support
 		machine-machine authentication using the transport protocol inherent to the client/server application. With the
-		[ ... value=action ... ] control syntax, it is possible for an application to be configured
+		[ ... value=action ... ] control syntax, it is possible for an application to be configured
 		to support binary prompts with compliant clients, but to gracefully fall over into an alternative authentication
-		mode for older, legacy, applications.
-		
    module-path:
    
+		mode for older, legacy applications.
+		
    module-path
    
 		The path-name of the dynamically loadable object file; the pluggable module itself. If the first character of the
-		module path is `/', it is assumed to be a complete path. If this is not the case, the given module path is appended
+		module path is “/”, it is assumed to be a complete path. If this is not the case, the given module path is appended
 		to the default module path: /lib/security (but see the notes above).
 		
    
-		The args are a list of tokens that are passed to the module when it is invoked. Much like arguments to a typical
+		The arguments are a list of tokens that are passed to the module when it is invoked, much like arguments to a typical
 		Linux shell command. Generally, valid arguments are optional and are specific to any given module. Invalid arguments
 		are ignored by a module, however, when encountering an invalid argument, the module is required to write an error
-		to syslog(3). For a list of generic options see the next section.
+		to syslog(3). For a list of generic options, see the next section.
 		
    
-		Note, if you wish to include spaces in an argument, you should surround that argument with square brackets. For example:
+		If you wish to include spaces in an argument, you should surround that argument with square brackets. For example:
 		
     squid auth required pam_mysql.so user=passwd_query passwd=mada \
-        db=eminence [query=select user_name from internet_service where \
-                     user_name='%u' and password=PASSWORD('%p') and \
-                     service='web_proxy']
+db=eminence [query=select user_name from internet_service where \
+user_name=“%u” and password=PASSWORD(“%p”) and service=“web_proxy”]
 
    
-		Note, when using this convention, you can include `[' characters inside the string, and if you wish to include a `]'
-		character inside the string that will survive the argument parsing, you should use `\['. In other words:
+		When using this convention, you can include “[” characters inside the string, and if you wish to have a “]”
+		character inside the string that will survive the argument parsing, you should use “\[”. In other words:
 		
     [..[..\]..]    -->   ..[..]..
 
    
-		Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the
+		Any line in one of the configuration files that is not formatted correctly will generally tend (erring on the
 		side of caution) to make the authentication process fail. A corresponding error is written to the system log files
 		with a call to syslog(3). 
-

    Example System Configurations

    +

    Example System Configurations

    The following is an example /etc/pam.d/login configuration file. -This example had all options been uncommented is probably not usable -as it stacks many conditions before allowing successful completion +This example had all options uncommented and is probably not usable +because it stacks many conditions before allowing successful completion of the login process. Essentially all conditions can be disabled -by commenting them out except the calls to pam_pwdb.so. -

    PAM: original login config

    +by commenting them out, except the calls to pam_pwdb.so.
+
    PAM: Original Login Config
     #%PAM-1.0
-# The PAM configuration file for the `login' service
+# The PAM configuration file for the “login” service
 #
 auth         required    pam_securetty.so
 auth         required    pam_nologin.so
@@ -280,7 +291,7 @@ session      required    pam_pwdb.so
 # session    optional    pam_lastlog.so
 # password   required    pam_cracklib.so retry=3
 password     required    pam_pwdb.so shadow md5
-
    PAM: login using pam_smbpass
    
+

    PAM: Login Using pam_smbpass

    PAM allows use of replaceable modules. Those available on a sample system include:

    $/bin/ls /lib/security 

    @@ -291,17 +302,17 @@ pam_nologin.so   pam_rootok.so       pam_tally.so
 pam_deny.so      pam_issue.so        pam_mail.so       
 pam_permit.so    pam_securetty.so    pam_time.so       
 pam_dialup.so    pam_lastlog.so      pam_mkhomedir.so  
-pam_pwdb.so      pam_shells.so       pam_unix.so       
+pam_pwdb.so      pam_shells.so       pam_UNIX.so       
 pam_env.so       pam_ldap.so         pam_motd.so       
-pam_radius.so    pam_smbpass.so      pam_unix_acct.so  
-pam_wheel.so     pam_unix_auth.so    pam_unix_passwd.so
-pam_userdb.so    pam_warn.so         pam_unix_session.so
+pam_radius.so    pam_smbpass.so      pam_UNIX_acct.so  
+pam_wheel.so     pam_UNIX_auth.so    pam_UNIX_passwd.so
+pam_userdb.so    pam_warn.so         pam_UNIX_session.so

    The following example for the login program replaces the use of -the pam_pwdb.so module which uses the system +the pam_pwdb.so module that uses the system password database (/etc/passwd, /etc/shadow, /etc/group) with -the module pam_smbpass.so which uses the Samba +the module pam_smbpass.so, which uses the Samba database which contains the Microsoft MD4 encrypted password hashes. This database is stored in either /usr/local/samba/private/smbpasswd, @@ -311,13 +322,13 @@ Samba implementation for your UNIX/Linux system. The pam_smbpass.so module is provided by Samba version 2.2.1 or later. It can be compiled by specifying the --with-pam_smbpass options when running Samba's -configure script. For more information +configure script. For more information on the pam_smbpass module, see the documentation in the source/pam_smbpass directory of the Samba source distribution. 

     #%PAM-1.0
-# The PAM configuration file for the `login' service
+# The PAM configuration file for the “login” service
 #
 auth        required    pam_smbpass.so nodelay
 account     required    pam_smbpass.so nodelay
@@ -328,21 +339,21 @@ The following is the PAM configuration file for a particular
 Linux system. The default condition uses pam_pwdb.so.
 
     #%PAM-1.0
-# The PAM configuration file for the `samba' service
+# The PAM configuration file for the “samba” service
 #
 auth       required     pam_pwdb.so nullok nodelay shadow audit
 account    required     pam_pwdb.so audit nodelay
 session    required     pam_pwdb.so nodelay
 password   required     pam_pwdb.so shadow md5
 
    
-In the following example the decision has been made to use the 
-smbpasswd database even for basic samba authentication. Such a 
-decision could also be made for the passwd program and would 
-thus allow the smbpasswd passwords to be changed using the passwd 
-program.
+In the following example, the decision has been made to use the 
+smbpasswd database even for basic Samba authentication. Such a 
+decision could also be made for the passwd program and would 
+thus allow the smbpasswd passwords to be changed using the
+passwd program:
 
     #%PAM-1.0
-# The PAM configuration file for the `samba' service
+# The PAM configuration file for the “samba” service
 #
 auth       required     pam_smbpass.so nodelay
 account    required     pam_pwdb.so audit nodelay
@@ -355,128 +366,118 @@ your particular system implementation for details regarding the specific
 capabilities of PAM in this environment. Some Linux implementations also 
 provide the pam_stack.so module that allows all 
 authentication to be configured in a single central file. The 
-pam_stack.so method has some very devoted followers 
+pam_stack.so method has some devoted followers 
 on the basis that it allows for easier administration. As with all issues in 
-life though, every decision makes trade-offs, so you may want examine the 
+life though, every decision makes trade-offs, so you may want to examine the 
 PAM documentation for further helpful information.
-

    smb.conf PAM Configuration

    - There is an option in smb.conf called obey pam restrictions. -The following is from the on-line help for this option in SWAT; +

    smb.conf PAM Configuration

    + There is an option in smb.conf called obey pam restrictions. +The following is from the online help for this option in SWAT;

    -When Samba is configured to enable PAM support (i.e. ---with-pam), this parameter will -control whether or not Samba should obey PAM's account -and session management directives. The default behavior -is to use PAM for clear text authentication only and to -ignore any account or session management. Note that Samba always -ignores PAM for authentication in the case of -encrypt passwords = yes. -The reason is that PAM modules cannot support the challenge/response -authentication mechanism needed in the presence of SMB +When Samba is configured to enable PAM support (i.e., --with-pam), this parameter will +control whether or not Samba should obey PAM's account and session management directives. The default behavior +is to use PAM for cleartext authentication only and to ignore any account or session management. Samba always +ignores PAM for authentication in the case of encrypt passwords = yes. +The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. -

    Default: obey pam restrictions = no

    Remote CIFS Authentication using winbindd.so

    +

    Default: obey pam restrictions = no

    Remote CIFS Authentication Using winbindd.so

    All operating systems depend on the provision of users credentials acceptable to the platform. UNIX requires the provision of a user identifier (UID) as well as a group identifier (GID). These are both simple integer type numbers that are obtained from a password backend such as /etc/passwd.

    -Users and groups on a Windows NT server are assigned a relative id (rid) which is unique for +Users and groups on a Windows NT server are assigned a relative ID (RID) which is unique for the domain when the user or group is created. To convert the Windows NT user or group into -a unix user or group, a mapping between rids and unix user and group ids is required. This +a UNIX user or group, a mapping between RIDs and UNIX user and group IDs is required. This is one of the jobs that winbind performs.

    -As winbind users and groups are resolved from a server, user and group ids are allocated +As Winbind users and groups are resolved from a server, user and group IDs are allocated from a specified range. This is done on a first come, first served basis, although all existing users and groups will be mapped as soon as a client performs a user or group -enumeration command. The allocated unix ids are stored in a database file under the Samba +enumeration command. The allocated UNIX IDs are stored in a database file under the Samba lock directory and will be remembered.

    The astute administrator will realize from this that the combination of pam_smbpass.so, -winbindd, and a distributed passdb backend, such as ldap, will allow the establishment of a -centrally managed, distributed user/password database that can also be used by all PAM (eg: Linux) aware -programs and applications. This arrangement can have particularly potent advantages compared with the use of -Microsoft Active Directory Service (ADS) in so far as reduction of wide area network authentication traffic. +winbindd and a distributed passdb backend, +such as ldap, will allow the establishment of a centrally managed, distributed user/password +database that can also be used by all PAM-aware (e.g., Linux) programs and applications. This arrangement can have +particularly potent advantages compared with the use of Microsoft Active Directory Service (ADS) in so far as +the reduction of wide area network authentication traffic.

    Warning

    -The rid to unix id database is the only location where the user and group mappings are -stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd -to determine which user and group ids correspond to Windows NT user and group rids. -

    Password Synchronization using pam_smbpass.so

    -pam_smbpass is a PAM module which can be used on conforming systems to -keep the smbpasswd (Samba password) database in sync with the unix +The RID to UNIX ID database is the only location where the user and group mappings are +stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd +to determine which user and group IDs correspond to Windows NT user and group RIDs. +

    Password Synchronization Using pam_smbpass.so

    +pam_smbpass is a PAM module that can be used on conforming systems to +keep the smbpasswd (Samba password) database in sync with the UNIX password file. PAM (Pluggable Authentication Modules) is an API supported -under some Unices, such as Solaris, HPUX and Linux, that provides a +under some UNIX operating systems, such as Solaris, HPUX and Linux, that provides a generic interface to authentication mechanisms.

    -This module authenticates a local smbpasswd user database. If you require -support for authenticating against a remote SMB server, or if you're -concerned about the presence of suid root binaries on your system, it is -recommended that you use pam_winbind instead. -

    -Options recognized by this module are as follows: -

    Table 25.1. Options recognized by pam_smbpass

    debuglog more debugging info
    auditlike debug, but also logs unknown usernames
    use_first_passdon't prompt the user for passwords; take them from PAM_ items instead
    try_first_passtry to get the password from a previous PAM module, fall back to prompting the user
    use_authtoklike try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only)
    not_set_passdon't make passwords used by this module available to other modules.
    nodelaydon't insert ~1 second delays on authentication failure.
    nulloknull passwords are allowed.
    nonullnull passwords are not allowed. Used to override the Samba configuration.
    migrateonly meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication.
    smbconf=filespecify an alternate path to the smb.conf file.

    +This module authenticates a local smbpasswd user database. If you require +support for authenticating against a remote SMB server, or if you are +concerned about the presence of SUID root binaries on your system, it is +recommended that you use pam_winbind instead.

    -

    • Andrew Morgan, for providing the Linux-PAM - framework, without which none of this would have happened

    • Christian Gafton and Andrew Morgan again, for the - pam_pwdb module upon which pam_smbpass was originally based

    • Luke Leighton for being receptive to the idea, - and for the occasional good-natured complaint about the project's status - that keep me working on it :)

    . +Options recognized by this module are shown in . +

    Table 25.1. Options recognized by pam_smbpass

    debuglog more debugging info.
    auditlike debug, but also logs unknown usernames.
    use_first_passdo not prompt the user for passwords; take them from PAM_ items instead.
    try_first_passtry to get the password from a previous PAM module fall back to prompting the user.
    use_authtoklike try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set (intended for stacking password modules only).
    not_set_passdo not make passwords used by this module available to other modules.
    nodelaydo not insert ~1 second delays on authentication failure.
    nulloknull passwords are allowed.
    nonullnull passwords are not allowed. Used to override the Samba configuration.
    migrateonly meaningful in an “auth” context; used to update smbpasswd file with a password used for successful authentication.
    smbconf=filespecify an alternate path to the smb.conf file.

    -The following are examples of the use of pam_smbpass.so in the format of Linux +The following are examples of the use of pam_smbpass.so in the format of Linux /etc/pam.d/ files structure. Those wishing to implement this tool on other platforms will need to adapt this appropriately. -

    Password Synchronisation Configuration

    +

    Password Synchronization Configuration

    A sample PAM configuration that shows the use of pam_smbpass to make -sure private/smbpasswd is kept in sync when /etc/passwd (/etc/shadow) -is changed. Useful when an expired password might be changed by an -application (such as ssh). +sure private/smbpasswd is kept in sync when /etc/passwd (/etc/shadow) +is changed. Useful when an expired password might be changed by an +application (such as ssh). 

     #%PAM-1.0
 # password-sync
 #
 auth       requisite    pam_nologin.so
-auth       required     pam_unix.so
-account    required     pam_unix.so
+auth       required     pam_UNIX.so
+account    required     pam_UNIX.so
 password   requisite    pam_cracklib.so retry=3
-password   requisite    pam_unix.so shadow md5 use_authtok try_first_pass
+password   requisite    pam_UNIX.so shadow md5 use_authtok try_first_pass
 password   required     pam_smbpass.so nullok use_authtok try_first_pass
-session    required     pam_unix.so
-

    Password Migration Configuration

    -A sample PAM configuration that shows the use of pam_smbpass to migrate -from plaintext to encrypted passwords for Samba. Unlike other methods, +session required pam_UNIX.so +

    Password Migration Configuration

    +A sample PAM configuration that shows the use of pam_smbpass to migrate +from plaintext to encrypted passwords for Samba. Unlike other methods, this can be used for users who have never connected to Samba shares: -password migration takes place when users ftp in, login using ssh, pop -their mail, etc. +password migration takes place when users ftp in, login using ssh, pop +their mail, and so on. 

     #%PAM-1.0
 # password-migration
 #
 auth       requisite   pam_nologin.so
-# pam_smbpass is called IF pam_unix succeeds.
-auth       requisite   pam_unix.so
+# pam_smbpass is called IF pam_UNIX succeeds.
+auth       requisite   pam_UNIX.so
 auth       optional    pam_smbpass.so migrate
-account    required    pam_unix.so
+account    required    pam_UNIX.so
 password   requisite   pam_cracklib.so retry=3
-password   requisite   pam_unix.so shadow md5 use_authtok try_first_pass
+password   requisite   pam_UNIX.so shadow md5 use_authtok try_first_pass
 password   optional    pam_smbpass.so nullok use_authtok try_first_pass
-session    required    pam_unix.so
-

    Mature Password Configuration

    -A sample PAM configuration for a 'mature' smbpasswd installation. -private/smbpasswd is fully populated, and we consider it an error if -the smbpasswd doesn't exist or doesn't match the UNIX password. +session required pam_UNIX.so +

    Mature Password Configuration

    +A sample PAM configuration for a mature smbpasswd installation. +private/smbpasswd is fully populated, and we consider it an error if +the SMB password does not exist or does not match the UNIX password. 

     #%PAM-1.0
 # password-mature
 #
 auth       requisite    pam_nologin.so
-auth       required     pam_unix.so
-account    required     pam_unix.so
+auth       required     pam_UNIX.so
+account    required     pam_UNIX.so
 password   requisite    pam_cracklib.so retry=3
-password   requisite    pam_unix.so shadow md5 use_authtok try_first_pass
+password   requisite    pam_UNIX.so shadow md5 use_authtok try_first_pass
 password   required     pam_smbpass.so use_authtok use_first_pass
-session    required     pam_unix.so
-

    Kerberos Password Integration Configuration

    -A sample PAM configuration that shows pam_smbpass used together with -pam_krb5. This could be useful on a Samba PDC that is also a member of +session required pam_UNIX.so +

    Kerberos Password Integration Configuration

    +A sample PAM configuration that shows pam_smbpass used together with +pam_krb5. This could be useful on a Samba PDC that is also a member of a Kerberos realm. 

     #%PAM-1.0
@@ -490,44 +491,40 @@ password   requisite   pam_cracklib.so retry=3
 password   optional    pam_smbpass.so nullok use_authtok try_first_pass
 password   required    pam_krb5.so use_authtok try_first_pass
 session    required    pam_krb5.so
-

    Common Errors

    -PAM can be a very fickle and sensitive to configuration glitches. Here we look at a few cases from +

    Common Errors

    +PAM can be fickle and sensitive to configuration glitches. Here we look at a few cases from the Samba mailing list. -

    pam_winbind problem

    - “ - I have the following PAM configuration: - ” +

    pam_winbind Problem

    + A user reported: I have the following PAM configuration: 

     auth required /lib/security/pam_securetty.so
 auth sufficient /lib/security/pam_winbind.so
-auth sufficient /lib/security/pam_unix.so use_first_pass nullok
+auth sufficient /lib/security/pam_UNIX.so use_first_pass nullok
 auth required /lib/security/pam_stack.so service=system-auth
 auth required /lib/security/pam_nologin.so
 account required /lib/security/pam_stack.so service=system-auth
 account required /lib/security/pam_winbind.so
 password required /lib/security/pam_stack.so service=system-auth

    +

    + When I open a new console with [ctrl][alt][F1], I can't log in with my user “pitie”. + I have tried with user “scienceu+pitie” also.

    - “ - When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie". - I've tried with user "scienceu+pitie" also. -” -

    - The problem may lie with your inclusion of pam_stack.so + Answer: The problem may lie with your inclusion of pam_stack.so service=system-auth. That file often contains a lot of stuff that may - duplicate what you're already doing. Try commenting out the pam_stack lines - for auth and account and see if things work. If they do, look at + duplicate what you are already doing. Try commenting out the pam_stack lines + for auth and account and see if things work. If they do, look at /etc/pam.d/system-auth and copy only what you need from it into your - /etc/pam.d/login file. Alternatively, if you want all services to use - winbind, you can put the winbind-specific stuff in /etc/pam.d/system-auth. -

    Winbind is not resolving users and groups

    - “ - My smb.conf file is correctly configured. I have specified - idmap uid = 12000, - and idmap gid = 3000-3500 + /etc/pam.d/login file. Alternately, if you want all services to use + Winbind, you can put the Winbind-specific stuff in /etc/pam.d/system-auth. +

    Winbind Is Not Resolving Users and Groups

    + “ + My smb.conf file is correctly configured. I have specified + idmap uid = 12000, + and idmap gid = 3000-3500 and winbind is running. When I do the following it all works fine. -” + ” 

     root# wbinfo -u
 MIDEARTH+maryo
@@ -550,16 +547,14 @@ bin:x:1:1:bin:/bin:/bin/bash
 maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false

    “ - But the following command just fails: -” + But this command fails: + ” 

    -root# chown 'maryo' a_file
-chown: `maryo': invalid user
+root# chown maryo a_file
+chown: 'maryo': invalid user

    -“ -This is driving me nuts! What can be wrong? -” + “This is driving me nuts! What can be wrong?”

    - Your system is likely running nscd, the name service - caching daemon. Shut it down, do NOT restart it! You will find your problem resolved. -

    Prev Up Next
    Chapter 24. Desktop Profile Management Home Chapter 26. Integrating MS Windows networks with Samba
    + Answer: Your system is likely running nscd, the name service + caching daemon. Shut it down, do not restart it! You will find your problem resolved. +

    Prev Up Next
    Chapter 24. Desktop Profile Management Home Chapter 26. Integrating MS Windows Networks with Samba
    diff --git a/docs/htmldocs/passdb.html b/docs/htmldocs/passdb.html index 4d5432fd70..fbfcd560da 100644 --- a/docs/htmldocs/passdb.html +++ b/docs/htmldocs/passdb.html @@ -1,223 +1,258 @@ -Chapter 11. Account Information Databases
    Chapter 11. Account Information Databases
    Prev Part III. Advanced Configuration Next

    Chapter 11. Account Information Databases

    Jelmer R. Vernooij

    The Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Jeremy Allison

    Samba Team

    John H. Terpstra

    Samba Team

    Olivier (lem) Lemaire

    IDEALX

    May 24, 2003

    Table of Contents

    Features and Benefits
    Backwards Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plain Text
    smbpasswd - Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users can not logon
    Users being added to wrong backend database
    auth methods does not work

    -Samba 3 implements a new capability to work concurrently with multiple account backends. -The possible new combinations of password backends allows Samba 3 a degree of flexibility +Chapter 11. Account Information Databases

    Chapter 11. Account Information Databases
    Prev Part III. Advanced Configuration Next

    Chapter 11. Account Information Databases

    Jelmer R. Vernooij

    The Samba Team

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    Jeremy Allison

    Samba Team

    Guenther Deschner

    LDAP updates
    SuSE

    Olivier (lem) Lemaire

    IDEALX

    May 24, 2003

    Table of Contents

    Features and Benefits
    Backward Compatibility Backends
    New Backends
    Technical Information
    Important Notes About Security
    Mapping User Identifiers between MS Windows and UNIX
    Mapping Common UIDs/GIDs on Distributed Machines
    Account Management Tools
    The smbpasswd Command
    The pdbedit Command
    Password Backends
    Plaintext
    smbpasswd Encrypted Password Database
    tdbsam
    ldapsam
    MySQL
    XML
    Common Errors
    Users Cannot Logon
    Users Being Added to the Wrong Backend Database
    Configuration of auth methods

    +Samba-3 implements a new capability to work concurrently with multiple account backends. +The possible new combinations of password backends allows Samba-3 a degree of flexibility and scalability that previously could be achieved only with MS Windows Active Directory. This chapter describes the new functionality and how to get the most out of it.

    -In the course of development of Samba-3, a number of requests were received to provide the +In the development of Samba-3, a number of requests were received to provide the ability to migrate MS Windows NT4 SAM accounts to Samba-3 without the need to provide -matching UNIX/Linux accounts. We called this the Non UNIX Accounts (NUA) +matching UNIX/Linux accounts. We called this the Non-UNIX Accounts (NUA) capability. The intent was that an administrator could decide to use the tdbsam -backend and by simply specifying passdb backend = tdbsam_nua +backend and by simply specifying passdb backend = tdbsam_nua, this would allow Samba-3 to implement a solution that did not use UNIX accounts per se. Late in the development cycle, the team doing this work hit upon some obstacles that prevents this -solution from being used. Given the delays with Samba-3 release a decision was made to NOT -deliver this functionality until a better method of recognising NT Group SIDs from NT User -SIDs could be found. This feature may thus return during the life cycle for the Samba-3 series. +solution from being used. Given the delays with the Samba-3 release, a decision was made to not +deliver this functionality until a better method of recognizing NT Group SIDs from NT User +SIDs could be found. This feature may return during the life cycle for the Samba-3 series.

    Note

    -Samba-3 does NOT support Non-UNIX Account (NUA) operation for user accounts. +Samba-3 does not support Non-UNIX Account (NUA) operation for user accounts. Samba-3 does support NUA operation for machine accounts. -

    Features and Benefits

    -Samba-3 provides for complete backwards compatibility with Samba-2.2.x functionality +

    Features and Benefits

    +Samba-3 provides for complete backward compatibility with Samba-2.2.x functionality as follows: -

    Backwards Compatibility Backends

    Plain Text:

    + + + +

    Backward Compatibility Backends

    Plain Text

    This option uses nothing but the UNIX/Linux /etc/passwd - style back end. On systems that have PAM (Pluggable Authentication Modules) - support all PAM modules are supported. The behaviour is just as it was with + style backend. On systems that have Pluggable Authentication Modules (PAM) + support, all PAM modules are supported. The behavior is just as it was with Samba-2.2.x, and the protocol limitations imposed by MS Windows clients - apply likewise. -

    smbpasswd:

    - This option allows continues use of the smbpasswd + apply likewise. Please refer to for more information + regarding the limitations of Plain Text password usage. +

    smbpasswd

    + This option allows continued use of the smbpasswd file that maintains a plain ASCII (text) layout that includes the MS Windows LanMan and NT encrypted passwords as well as a field that stores some - account information. This form of password backend does NOT store any of - the MS Windows NT/200x SAM (Security Account Manager) information needed to + account information. This form of password backend does not store any of + the MS Windows NT/200x SAM (Security Account Manager) information required to provide the extended controls that are needed for more comprehensive - interoperation with MS Windows NT4 / 200x servers. + interoperation with MS Windows NT4/200x servers.

    - This backend should be used only for backwards compatibility with older + This backend should be used only for backward compatibility with older versions of Samba. It may be deprecated in future releases. -

    ldapsam_compat (Samba-2.2 LDAP Compatibility):

    +

    ldapsam_compat (Samba-2.2 LDAP Compatibility)

    There is a password backend option that allows continued operation with - a existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension. + an existing OpenLDAP backend that uses the Samba-2.2.x LDAP schema extension. This option is provided primarily as a migration tool, although there is - no reason to force migration at this time. Note that this tool will eventually + no reason to force migration at this time. This tool will eventually be deprecated. -

    New Backends

    -Samba-3 introduces the following new password backend capabilities: -

    tdbsam:

    +

    +Samba-3 introduces a number of new password backend capabilities. + + + + +

    New Backends

    tdbsam

    This backend provides a rich database backend for local servers. This - backend is NOT suitable for multiple domain controller (ie: PDC + one + backend is not suitable for multiple Domain Controllers (i.e., PDC + one or more BDC) installations.

    The tdbsam password backend stores the old - smbpasswd information PLUS the extended MS Windows NT / 200x + smbpasswd information plus the extended MS Windows NT / 200x SAM information into a binary format TDB (trivial database) file. The inclusion of the extended information makes it possible for Samba-3 to implement the same account and system access controls that are possible - with MS Windows NT4 and MS Windows 200x based systems. + with MS Windows NT4/200x-based systems.

    The inclusion of the tdbsam capability is a direct response to user requests to allow simple site operation without the overhead of the complexities of running OpenLDAP. It is recommended to use this only - for sites that have fewer than 250 users. For larger sites or implementations + for sites that have fewer than 250 users. For larger sites or implementations, the use of OpenLDAP or of Active Directory integration is strongly recommended. -

    ldapsam:

    +

    ldapsam

    This provides a rich directory backend for distributed account installation.

    Samba-3 has a new and extended LDAP implementation that requires configuration - of OpenLDAP with a new format samba schema. The new format schema file is + of OpenLDAP with a new format Samba schema. The new format schema file is included in the examples/LDAP directory of the Samba distribution.

    The new LDAP implementation significantly expands the control abilities that were possible with prior versions of Samba. It is now possible to specify - "per user" profile settings, home directories, account access controls, and - much more. Corporate sites will see that the Samba-Team has listened to their + “per user” profile settings, home directories, account access controls, and + much more. Corporate sites will see that the Samba Team has listened to their requests both for capability and to allow greater scalability. -

    mysqlsam (MySQL based backend):

    - It is expected that the MySQL based SAM will be very popular in some corners. - This database backend will be on considerable interest to sites that want to +

    mysqlsam (MySQL based backend)

    + It is expected that the MySQL-based SAM will be very popular in some corners. + This database backend will be of considerable interest to sites that want to leverage existing MySQL technology. -

    xmlsam (XML based datafile):

    +

    xmlsam (XML based datafile)

    + Allows the account and password data to be stored in an XML format - data file. This backend can not be used for normal operation, it can only + data file. This backend cannot be used for normal operation, it can only be used in conjunction with pdbedit's pdb2pdb functionality. The DTD that is used might be subject to changes in the future.

    - The xmlsam option can be useful for account migration between database + The xmlsam option can be useful for account migration between database backends or backups. Use of this tool will allow the data to be edited before migration into another backend format. -

    Technical Information

    - Old windows clients send plain text passwords over the wire. Samba can check these - passwords by crypting them and comparing them to the hash stored in the unix user database. +

    Technical Information

    + Old Windows clients send plain text passwords over the wire. Samba can check these + passwords by encrypting them and comparing them to the hash stored in the UNIX user database.

    - Newer windows clients send encrypted passwords (so-called Lanman and NT hashes) over + + Newer Windows clients send encrypted passwords (so-called Lanman and NT hashes) over the wire, instead of plain text passwords. The newest clients will send only encrypted passwords and refuse to send plain text passwords, unless their registry is tweaked.

    - These passwords can't be converted to unix style encrypted passwords. Because of that, - you can't use the standard unix user database, and you have to store the Lanman and NT + These passwords can't be converted to UNIX-style encrypted passwords. Because of that, + you can't use the standard UNIX user database, and you have to store the Lanman and NT hashes somewhere else.

    - In addition to differently encrypted passwords, windows also stores certain data for each - user that is not stored in a unix user database. e.g: workstations the user may logon from, - the location where the users' profile is stored, and so on. Samba retrieves and stores this - information using a passdb backend. Commonly available backends are LDAP, plain text - file, MySQL and nisplus. For more information, see the man page for smb.conf regarding the - passdb backend parameter. -

    Figure 11.1. IDMAP

    IDMAP

    Important Notes About Security

    - The unix and SMB password encryption techniques seem similar on the surface. This - similarity is, however, only skin deep. The unix scheme typically sends clear text + In addition to differently encrypted passwords, Windows also stores certain data for each + user that is not stored in a UNIX user database. For example, workstations the user may logon from, + the location where the user's profile is stored, and so on. Samba retrieves and stores this + information using a passdb backend. Commonly available backends are LDAP, plain text + file, and MySQL. For more information, see the man page for smb.conf regarding the + passdb backend parameter. +

    Figure 11.1. IDMAP: Resolution of SIDs to UIDs.

    IDMAP: Resolution of SIDs to UIDs.

    + + The resolution of SIDs to UIDs is fundamental to correct operation of Samba. In both cases shown, if winbindd is not running, or cannot + be contacted, then only local SID/UID resolution is possible. See and + . +

    Figure 11.2. IDMAP: Resolution of UIDs to SIDs.

    IDMAP: Resolution of UIDs to SIDs.

    Important Notes About Security

    + The UNIX and SMB password encryption techniques seem similar on the surface. This + similarity is, however, only skin deep. The UNIX scheme typically sends cleartext passwords over the network when logging in. This is bad. The SMB encryption scheme never sends the cleartext password over the network but it does store the 16 byte hashed values on disk. This is also bad. Why? Because the 16 byte hashed values - are a "password equivalent". You cannot derive the user's password from them, but + are a “password equivalent.” You cannot derive the user's password from them, but they could potentially be used in a modified client to gain access to a server. This would require considerable technical knowledge on behalf of the attacker but - is perfectly possible. You should thus treat the data stored in whatever passdb - backend you use (smbpasswd file, ldap, mysql) as though it contained the cleartext - passwords of all your users. Its contents must be kept secret, and the file should + is perfectly possible. You should thus treat the datastored in whatever passdb + backend you use (smbpasswd file, LDAP, MYSQL) as though it contained the cleartext + passwords of all your users. Its contents must be kept secret and the file should be protected accordingly.

    - Ideally we would like a password scheme that involves neither plain text passwords - on the net nor on disk. Unfortunately this is not available as Samba is stuck with - having to be compatible with other SMB systems (WinNT, WfWg, Win95 etc). + Ideally, we would like a password scheme that involves neither plain text passwords + on the network nor on disk. Unfortunately, this is not available as Samba is stuck with + having to be compatible with other SMB systems (Windows NT, Windows for Workgroups, Windows 9x/Me).

    - Windows NT 4.0 Service pack 3 changed the default setting so that plaintext passwords + Windows NT 4.0 Service Pack 3 changed the default setting so plaintext passwords are disabled from being sent over the wire. This mandates either the use of encrypted - password support or edit the Windows NT registry to re-enable plaintext passwords. + password support or editing the Windows NT registry to re-enable plaintext passwords.

    - The following versions of MS Windows do not support full domain security protocols, + The following versions of Microsoft Windows do not support full domain security protocols, although they may log onto a domain environment: -

    • MS DOS Network client 3.0 with the basic network redirector installed

    • Windows 95 with the network redirector update installed

    • Windows 98 [se]

    • Windows Me

    Note

    - MS Windows XP Home does not have facilities to become a domain member and it can - not participate in domain logons. +

    • MS DOS Network client 3.0 with the basic network redirector installed.
    • Windows 95 with the network redirector update installed.
    • Windows 98 [Second Edition].
    • Windows Me.

    Note

    + MS Windows XP Home does not have facilities to become a Domain Member and it cannot participate in domain logons.

    The following versions of MS Windows fully support domain security protocols. -

    • Windows NT 3.5x

    • Windows NT 4.0

    • Windows 2000 Professional

    • Windows 200x Server/Advanced Server

    • Windows XP Professional

    - All current release of Microsoft SMB/CIFS clients support authentication via the - SMB Challenge/Response mechanism described here. Enabling clear text authentication +

    • Windows NT 3.5x.
    • Windows NT 4.0.
    • Windows 2000 Professional.
    • Windows 200x Server/Advanced Server.
    • Windows XP Professional.

    + All current releases of Microsoft SMB/CIFS clients support authentication via the + SMB Challenge/Response mechanism described here. Enabling cleartext authentication does not disable the ability of the client to participate in encrypted authentication. - Instead, it allows the client to negotiate either plain text _or_ encrypted password + Instead, it allows the client to negotiate either plain text or encrypted password handling.

    MS Windows clients will cache the encrypted password alone. Where plain text passwords - are re-enabled, through the appropriate registry change, the plain text password is NEVER + are re-enabled through the appropriate registry change, the plain text password is never cached. This means that in the event that a network connections should become disconnected - (broken) only the cached (encrypted) password will be sent to the resource server to - affect a auto-reconnect. If the resource server does not support encrypted passwords the - auto-reconnect will fail. USE OF ENCRYPTED PASSWORDS IS STRONGLY ADVISED. -

    Advantages of Encrypted Passwords

    • Plain text passwords are not passed across + (broken), only the cached (encrypted) password will be sent to the resource server to + effect an auto-reconnect. If the resource server does not support encrypted passwords the + auto-reconnect will fail. Use of encrypted passwords is strongly advised. +

      Advantages of Encrypted Passwords

      • Plaintext passwords are not passed across the network. Someone using a network sniffer cannot just - record passwords going to the SMB server.

      • Plain text passwords are not stored anywhere in - memory or on disk.

      • WinNT doesn't like talking to a server + record passwords going to the SMB server.

      • Plaintext passwords are not stored anywhere in + memory or on disk.

      • Windows NT does not like talking to a server that does not support encrypted passwords. It will refuse - to browse the server if the server is also in user level + to browse the server if the server is also in User Level security mode. It will insist on prompting the user for the password on each connection, which is very annoying. The only things you can do to stop this is to use SMB encryption.

      • Encrypted password support allows automatic share (resource) reconnects.

      • Encrypted passwords are essential for PDC/BDC - operation.

      Advantages of non-encrypted passwords

      • Plain text passwords are not kept - on disk, and are NOT cached in memory.

      • Uses same password file as other unix - services such as login and ftp

      • Use of other services (such as telnet and ftp) which - send plain text passwords over the net, so sending them for SMB - isn't such a big deal.

    Mapping User Identifiers between MS Windows and UNIX

    + operation.

    Advantages of Non-Encrypted Passwords

    • Plaintext passwords are not kept + on disk, and are not cached in memory.

    • Uses same password file as other UNIX + services such as Login and FTP.

    • Use of other services (such as Telnet and FTP) that + send plain text passwords over the network, so sending them for SMB + is not such a big deal.

    Mapping User Identifiers between MS Windows and UNIX

    Every operation in UNIX/Linux requires a user identifier (UID), just as in - MS Windows NT4 / 200x this requires a Security Identifier (SID). Samba provides + MS Windows NT4/200x this requires a Security Identifier (SID). Samba provides two means for mapping an MS Windows user to a UNIX/Linux UID.

    - Firstly, all Samba SAM (Security Account Manager database) accounts require + First, all Samba SAM (Security Account Manager database) accounts require a UNIX/Linux UID that the account will map to. As users are added to the account - information database, Samba will call the add user script + information database, Samba will call the add user script interface to add the account to the Samba host OS. In essence all accounts in the local SAM require a local user account.

    - The second way to affect Windows SID to UNIX UID mapping is via the - idmap uid, idmap gid parameters in smb.conf. + The second way to effect Windows SID to UNIX UID mapping is via the + idmap uid and idmap gid parameters in smb.conf. Please refer to the man page for information about these parameters. These parameters are essential when mapping users from a remote SAM server.

    Mapping Common UIDs/GIDs on Distributed Machines

    Samba-3 has a special facility that makes it possible to maintain identical UIDs and GIDs on all servers in a distributed network. A distributed network is one where there exists - a PDC, one or more BDCs and/or one or more domain member servers. Why is this important? - This is important if files are being shared over more than one protocol (eg: NFS) and where + a PDC, one or more BDCs and/or one or more Domain Member servers. Why is this important? + This is important if files are being shared over more than one protocol (e.g., NFS) and where users are copying files across UNIX/Linux systems using tools such as rsync.

    The special facility is enabled using a parameter called idmap backend. - The default setting for this parameter is an empty string. Administrators should NOT set this - parameter except when an LDAP based passdb backend is in use. An example of use is: + The default setting for this parameter is an empty string. Technically it is possible to use + an LDAP based idmap backend for UIDs and GIDs, but it makes most sense when this is done for + network configurations that also use LDAP for the SAM backend. A sample use is shown in + .

    -

    Example 11.1. 

    [global]
    idmap backend = ldapsam://ldap-server.quenya.org:636

    -

    Account Management Tools

    -Samba provides two (2) tools for management of User and machine accounts. These tools are + +

    Example 11.1. Example configuration with the LDAP idmap backend

    [global]
    idmap backend = ldapsam:ldap://ldap-server.quenya.org:636
    idmap backend = ldapsam:ldaps://ldap-server.quenya.org

    +

    + A network administrator who wants to make significant use of LDAP backends will sooner or later be + exposed to the excellent work done by PADL Software. PADL http://www.padl.com have + produced and released to open source an array of tools that might be of interest. These tools include: +

    • + nss_ldap: An LDAP Name Service Switch module to provide native + name service support for AIX, Linux, Solaris, and other operating systems. This tool + can be used for centralized storage and retrieval of UIDs/GIDs. +

    • + pam_ldap: A PAM module that provides LDAP integration for UNIX/Linux + system access authentication. +

    • + idmap_ad: An IDMAP backend that supports the Microsoft Services for + UNIX RFC 2307 schema available from their web + site. +

    Account Management Tools

    + +Samba provides two tools for management of user and machine accounts. These tools are called smbpasswd and pdbedit. A third tool is under -development but is NOT expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK -GUI tool that looks much like the MS Windows NT4 Domain User Manager - hopefully this will +development but is not expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK +GUI tool that looks much like the MS Windows NT4 Domain User Manager. Hopefully this will be announced in time for the Samba-3.0.1 release. -

    The smbpasswd Command

    - The smbpasswd utility is a utility similar to the passwd - or yppasswd programs. It maintains the two 32 byte password +

    The smbpasswd Command

    + The smbpasswd utility is similar to the passwd + or yppasswd programs. It maintains the two 32 byte password fields in the passdb backend.

    smbpasswd works in a client-server mode where it contacts the - local smbd to change the user's password on its behalf. This has enormous benefits - as follows: + local smbd to change the user's password on its behalf. This has enormous benefits.

    smbpasswd has the capability to change passwords on Windows NT servers (this only works when the request is sent to the NT Primary Domain Controller if changing an NT Domain user's password).

    smbpasswd can be used to: -

    • add user or machine accounts

    • delete user or machine accounts

    • enable user or machine accounts

    • disable user or machine accounts

    • set to NULL user passwords

    • manage interdomain trust accounts

    + + + +

    • add user or machine accounts.
    • delete user or machine accounts.
    • enable user or machine accounts.
    • disable user or machine accounts.
    • set to NULL user passwords.
    • manage interdomain trust accounts.

    To run smbpasswd as a normal user just type: 

     $ smbpasswd
 Old SMB password: secret

    - For secret type old value here - or hit return if - there was no old password + For secret, type old value here or press return if + there is no old password. 

     New SMB Password: new secret
 Repeat New SMB Password: new secret
@@ -226,32 +261,38 @@ be announced in time for the Samba-3.0.1 release.
 		If the old value does not match the current value stored for that user, or the two
 		new values do not match each other, then the password will not be changed.
 		
    
-		When invoked by an ordinary user it will only allow change of their own
+		When invoked by an ordinary user, the command will only allow the user to change his or her own
 		SMB password.
 		
    
-		When run by root smbpasswd may take an optional argument, specifying
-		the user name whose SMB password you wish to change. When run as root, smbpasswd
+		When run by root, smbpasswd may take an optional argument specifying
+		the user name whose SMB password you wish to change. When run as root, smbpasswd
 		does not prompt for or check the old password value, thus allowing root to set passwords 
 		for users who have forgotten their passwords.
 		
    
 		smbpasswd is designed to work in the way familiar to UNIX
 		users who use the passwd or yppasswd commands.
-		While designed for administrative use, this tool provides essential user level
+		While designed for administrative use, this tool provides essential User Level
 		password change capabilities.
 		
    
-		For more details on using smbpasswd refer to the man page (the
+		For more details on using smbpasswd, refer to the man page (the
 		definitive reference).
-

    The pdbedit Command

    +

    The pdbedit Command

    + pdbedit is a tool that can be used only by root. It is used to manage the passdb backend. pdbedit can be used to: -

    • add, remove or modify user accounts

    • listing user accounts

    • migrate user accounts

    + + + +

    • add, remove or modify user accounts.
    • list user accounts.
    • migrate user accounts.

    + The pdbedit tool is the only one that can manage the account security and policy settings. It is capable of all operations that smbpasswd can do as well as a super set of them.

    + One particularly important purpose of the pdbedit is to allow the migration of account information from one passdb backend to another. See the - XML password backend section of this chapter. + password backend section of this chapter.

    The following is an example of the user account information that is stored in a tdbsam password backend. This listing was produced by running: @@ -278,12 +319,13 @@ Password last set: Sat, 14 Dec 2002 14:37:03 GMT Password can change: Sat, 14 Dec 2002 14:37:03 GMT Password must change: Mon, 18 Jan 2038 20:14:07 GMT

    + The pdbedit tool allows migration of authentication (account) databases from one backend to another. For example: To migrate accounts from an old smbpasswd database to a tdbsam backend:

    1. - Set the passdb backend = tdbsam, smbpasswd. + Set the passdb backend = tdbsam, smbpasswd.

    2. Execute: 

      @@ -292,7 +334,7 @@ Password must change: Mon, 18 Jan 2038 20:14:07 GMT

    3. Now remove the smbpasswd from the passdb backend configuration in smb.conf. -

    Password Backends

    +

    Password Backends

    Samba offers the greatest flexibility in backend account database design of any SMB/CIFS server technology available today. The flexibility is immediately obvious as one begins to explore this capability. @@ -300,92 +342,95 @@ capability. It is possible to specify not only multiple different password backends, but even multiple backends of the same type. For example, to use two different tdbsam databases:

    -

    passdb backend = tdbsam:/etc/samba/passdb.tdb, tdbsam:/etc/samba/old-passdb.tdb

    -

    Plain Text

    - Older versions of Samba retrieved user information from the unix user database +

    passdb backend = tdbsam:/etc/samba/passdb.tdb \
    tdbsam:/etc/samba/old-passdb.tdb

    +

    Plaintext

    + Older versions of Samba retrieved user information from the UNIX user database and eventually some other fields from the file /etc/samba/smbpasswd or /etc/smbpasswd. When password encryption is disabled, no SMB specific data is stored at all. Instead all operations are conducted via the way that the Samba host OS will access its /etc/passwd database. - eg: On Linux systems that is done via PAM. -

    smbpasswd - Encrypted Password Database

    - Traditionally, when configuring encrypt passwords = yes in Samba's smb.conf file, user account + Linux systems For example, all operations are done via PAM. +

    smbpasswd Encrypted Password Database

    + + Traditionally, when configuring encrypt passwords = yes in Samba's smb.conf file, user account information such as username, LM/NT password hashes, password change times, and account - flags have been stored in the smbpasswd(5) file. There are several - disadvantages to this approach for sites with very large numbers of users (counted + flags have been stored in the smbpasswd(5) file. There are several + disadvantages to this approach for sites with large numbers of users (counted in the thousands).

    • - The first is that all lookups must be performed sequentially. Given that + The first problem is that all lookups must be performed sequentially. Given that there are approximately two lookups per domain logon (one for a normal session connection such as when mapping a network drive or printer), this - is a performance bottleneck for large sites. What is needed is an indexed approach - such as is used in databases. + is a performance bottleneck for large sites. What is needed is an indexed approach + such as used in databases.

    • The second problem is that administrators who desire to replicate a smbpasswd file to more than one Samba server were left to use external tools such as rsync(1) and ssh(1) and wrote custom, in-house scripts.

    • - And finally, the amount of information which is stored in an smbpasswd entry leaves + Finally, the amount of information that is stored in an smbpasswd entry leaves no room for additional attributes such as a home directory, password expiration time, or even a Relative Identifier (RID).

    As a result of these deficiencies, a more robust means of storing user attributes - used by smbd was developed. The API which defines access to user accounts + used by smbd was developed. The API which defines access to user accounts is commonly referred to as the samdb interface (previously this was called the passdb API, and is still so named in the Samba CVS trees).

    Samba provides an enhanced set of passdb backends that overcome the deficiencies - of the smbpasswd plain text database. These are tdbsam, ldapsam, and xmlsam. - Of these ldapsam will be of most interest to large corporate or enterprise sites. -

    tdbsam

    Samba can store user and machine account data in a "TDB" (Trivial Database). - Using this backend doesn't require any additional configuration. This backend is + of the smbpasswd plain text database. These are tdbsam, ldapsam and xmlsam. + Of these, ldapsam will be of most interest to large corporate or enterprise sites. +

    tdbsam

    + + Samba can store user and machine account data in a “TDB” (Trivial Database). + Using this backend does not require any additional configuration. This backend is recommended for new installations that do not require LDAP.

    - As a general guide the Samba-Team does NOT recommend using the tdbsam backend for sites + As a general guide, the Samba Team does not recommend using the tdbsam backend for sites that have 250 or more users. Additionally, tdbsam is not capable of scaling for use - in sites that require PDB/BDC implementations that requires replication of the account + in sites that require PDB/BDC implementations that require replication of the account database. Clearly, for reason of scalability, the use of ldapsam should be encouraged. -

    ldapsam

    +

    + The recommendation of a 250 user limit is purely based on the notion that this + would generally involve a site that has routed networks, possibly spread across + more than one physical location. The Samba Team has not at this time established + the performance based scalability limits of the tdbsam architecture. +

    ldapsam

    + There are a few points to stress that the ldapsam does not provide. The LDAP - support referred to in the this documentation does not include: + support referred to in this documentation does not include:

    • A means of retrieving user account information from an Windows 200x Active Directory server.

    • A means of replacing /etc/passwd.

    - The second item can be accomplished by using LDAP NSS and PAM modules. LGPL - versions of these libraries can be obtained from PADL Software - (http://www.padl.com/). More - information about the configuration of these packages may be found at "LDAP, - System Administration; Gerald Carter, O'Reilly; Chapter 6: Replacing NIS". - Refer to - http://safari.oreilly.com/?XmlId=1-56592-491-6 for those who might wish to know - more about configuration and administration of an OpenLDAP server. -

    Note

    - This section is outdated for Samba-3 schema. Samba-3 introduces a new schema - that has not been documented at the time of this publication. -

    + The second item can be accomplished by using LDAP NSS and PAM modules. LGPL + versions of these libraries can be obtained from + PADL Software. + More information about the configuration of these packages may be found at + + LDAP, System Administration; Gerald Carter by O'Reilly; Chapter 6: Replacing NIS." +

    This document describes how to use an LDAP directory for storing Samba user - account information traditionally stored in the smbpasswd(5) file. It is + account information traditionally stored in the smbpasswd(5) file. It is assumed that the reader already has a basic understanding of LDAP concepts - and has a working directory server already installed. For more information - on LDAP architectures and Directories, please refer to the following sites. -

    - Two additional Samba resources which may prove to be helpful are -

    • The Samba-PDC-LDAP-HOWTO - maintained by Ignacio Coupeau.

    • The NT migration scripts from IDEALX that are + and has a working directory server already installed. For more information + on LDAP architectures and directories, please refer to the following sites: +

      • OpenLDAP

      • Sun iPlanet Directory Server

      + Two additional Samba resources which may prove to be helpful are: +

      • The Samba-PDC-LDAP-HOWTO + maintained by Ignacio Coupeau.

      • The NT migration scripts from IDEALX that are geared to manage users and group in such a Samba-LDAP Domain Controller configuration. -

      Supported LDAP Servers

      +

    Supported LDAP Servers

    The LDAP ldapsam code has been developed and tested using the OpenLDAP 2.0 and 2.1 server and - client libraries. The same code should work with Netscape's Directory Server and client SDK. + client libraries. The same code should work with Netscape's Directory Server and client SDK. However, there are bound to be compile errors and bugs. These should not be hard to fix. - Please submit fixes via Bug reporting facility. -

    Schema and Relationship to the RFC 2307 posixAccount

    - Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in - examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: + Please submit fixes via the process outlined in . +

    Schema and Relationship to the RFC 2307 posixAccount

    + Samba-3.0 includes the necessary schema file for OpenLDAP 2.0 in + examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: 

    -objectclass ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY
-    DESC 'Samba 3.0 Auxiliary SAM Account'
+objectclass (1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY
+    DESC 'Samba-3.0 Auxiliary SAM Account'
     MUST ( uid $ sambaSID )
     MAY  ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $
           sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $
@@ -396,41 +441,41 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY

    The samba.schema file has been formatted for OpenLDAP 2.0/2.1. - The OID's are owned by the Samba Team and as such is legal to be openly published. - If you translate the schema to be used with Netscape DS, please - submit the modified schema file as a patch to - jerry@samba.org. + The Samba Team owns the OID space used by the above schema and recommends its use. + If you translate the schema to be used with Netscape DS, please submit the modified + schema file as a patch to jerry@samba.org.

    - Just as the smbpasswd file is meant to store information which supplements a + Just as the smbpasswd file is meant to store information that provides information additional to a user's /etc/passwd entry, so is the sambaSamAccount object - meant to supplement the UNIX user account information. A sambaSamAccount is a - STRUCTURAL objectclass so it can be stored individually - in the directory. However, there are several fields (e.g. uid) which overlap - with the posixAccount objectclass outlined in RFC2307. This is by design. + meant to supplement the UNIX user account information. A sambaSamAccount is a + AUXILIARY objectclass so it can be used to augment existing + user account information in the LDAP directory, thus providing information needed + for Samba account handling. However, there are several fields (e.g., uid) that overlap + with the posixAccount objectclass outlined in RFC2307. This is by design.

    In order to store all user account information (UNIX and Samba) in the directory, it is necessary to use the sambaSamAccount and posixAccount objectclasses in - combination. However, smbd will still obtain the user's UNIX account - information via the standard C library calls (e.g. getpwnam(), et. al.). + combination. However, smbd will still obtain the user's UNIX account + information via the standard C library calls (e.g., getpwnam(), et al). This means that the Samba server must also have the LDAP NSS library installed - and functioning correctly. This division of information makes it possible to + and functioning correctly. This division of information makes it possible to store all Samba account information in LDAP, but still maintain UNIX account information in NIS while the network is transitioning to a full LDAP infrastructure. -

    OpenLDAP configuration

    +

    OpenLDAP Configuration

    To include support for the sambaSamAccount object in an OpenLDAP directory server, first copy the samba.schema file to slapd's configuration directory. The samba.schema file can be found in the directory examples/LDAP - in the samba source distribution. + in the Samba source distribution. 

     root# cp samba.schema /etc/openldap/schema/

    Next, include the samba.schema file in slapd.conf. - The sambaSamAccount object contains two attributes which depend upon other schema - files. The 'uid' attribute is defined in cosine.schema and - the 'displayName' attribute is defined in the inetorgperson.schema - file. Both of these must be included before the samba.schema file. + The sambaSamAccount object contains two attributes that depend on other schema + files. The uid attribute is defined in cosine.schema and + the displayName attribute is defined in the inetorgperson.schema + file. Both of these must be included before the samba.schema file. 

     ## /etc/openldap/slapd.conf
@@ -447,8 +492,8 @@ include            /etc/openldap/schema/nis.schema

    It is recommended that you maintain some indices on some of the most useful attributes, - like in the following example, to speed up searches made on sambaSamAccount objectclasses - (and possibly posixAccount and posixGroup as well). + as in the following example, to speed up searches made on sambaSamAccount objectclasses + (and possibly posixAccount and posixGroup as well): 

     # Indices to maintain
@@ -485,10 +530,10 @@ index   default               sub
 
     root# /etc/init.d/slapd restart
 
    
-

    Initialise the LDAP database

    +

    Initialize the LDAP Database

    Before you can add accounts to the LDAP database you must create the account containers that they will be stored in. The following LDIF file should be modified to match your - needs (ie: Your DNS entries, etc.). + needs (DNS entries, and so on): 

     # Organization for Samba Base
@@ -518,6 +563,34 @@ objectclass: top
 objectclass: organizationalRole
 objectclass: simpleSecurityObject
 userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz
+
+# Setting up container for groups
+dn: ou=Groups,dc=quenya,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: People
+
+# Setting up admin handle for Groups OU
+dn: cn=admin,ou=Groups,dc=quenya,dc=org
+cn: admin
+objectclass: top
+objectclass: organizationalRole
+objectclass: simpleSecurityObject
+userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz
+
+# Setting up container for computers
+dn: ou=Computers,dc=quenya,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: People
+
+# Setting up admin handle for Computers OU
+dn: cn=admin,ou=Computers,dc=quenya,dc=org
+cn: admin
+objectclass: top
+objectclass: organizationalRole
+objectclass: simpleSecurityObject
+userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz

    The userPassword shown above should be generated using slappasswd. @@ -529,7 +602,7 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz $ slapadd -v -l initldap.dif

    - Do not forget to secure your LDAP server with an adequate access control list, + Do not forget to secure your LDAP server with an adequate access control list as well as an admin password.

    Note

    Before Samba can access the LDAP server you need to store the LDAP admin password @@ -537,124 +610,142 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz 

     root# smbpasswd -w secret

    -

    Configuring Samba

    +

    Configuring Samba

    The following parameters are available in smb.conf only if your - version of samba was built with LDAP support. Samba automatically builds with LDAP support if the + version of Samba was built with LDAP support. Samba automatically builds with LDAP support if the LDAP libraries are found.

    LDAP related smb.conf options: - passdb backend = ldapsam:url, - ldap ssl, - ldap admin dn, - ldap suffix, - ldap filter, - ldap machine suffix, - ldap user suffix, - ldap delete dn, - ldap passwd sync, - ldap trust ids. + passdb backend = ldapsam:url, + ldap admin dn, + ldap delete dn, + ldap filter, + ldap group suffix, + ldap idmap suffix, + ldap machine suffix, + ldap passwd sync, + ldap ssl, + ldap suffix, + ldap user suffix,

    These are described in the smb.conf man - page and so will not be repeated here. However, a sample smb.conf file for - use with an LDAP directory could appear as + page and so will not be repeated here. However, a sample smb.conf file for + use with an LDAP directory could appear as shown in .

    -

    Example 11.2. Configuration with LDAP

    [global]
    security = user
    encrypt passwords = yes
    netbios name = TASHTEGO
    workgroup = NARNIA
    # ldap related parameters
    # define the DN to use when binding to the directory servers
    # The password for this DN is not stored in smb.conf. Rather it
    # must be set by using 'smbpasswd -w secretpw' to store the
    # passphrase in the secrets.tdb file. If the "ldap admin dn" values
    # change, this password will need to be reset.
    ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"
    # Define the SSL option when connecting to the directory
    # ('off', 'start tls', or 'on' (default))
    ldap ssl = start tls
    # syntax: passdb backend = ldapsam:ldap://server-name[:port]
    passdb backend = ldapsam:ldap://funball.samba.org
    # smbpasswd -x delete the entire dn-entry
    ldap delete dn = no
    # the machine and user suffix added to the base suffix
    # wrote WITHOUT quotes. NULL suffixes by default
    ldap user suffix = ou=People
    ldap machine suffix = ou=Systems
    # Trust unix account information in LDAP
    # (see the smb.conf manpage for details)
    ldap trust ids = Yes
    # specify the base DN to use when searching the directory
    ldap suffix = "ou=people,dc=samba,dc=org"
    # generally the default ldap search filter is ok
    ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))"

    -

    Accounts and Groups management

    - As users accounts are managed through the sambaSamAccount objectclass, you should +

    Example 11.2. Configuration with LDAP

    [global]
    security = user
    encrypt passwords = yes
    netbios name = MORIA
    workgroup = NOLDOR
    # ldap related parameters
    # define the DN to use when binding to the directory servers
    # The password for this DN is not stored in smb.conf. Rather it
    # must be set by using 'smbpasswd -w secretpw' to store the
    # passphrase in the secrets.tdb file. If the "ldap admin dn" values
    # change, this password will need to be reset.
    ldap admin dn = "cn=Manager,ou=People,dc=quenya,dc=org"
    # Define the SSL option when connecting to the directory
    # ('off', 'start tls', or 'on' (default))
    ldap ssl = start tls
    # syntax: passdb backend = ldapsam:ldap://server-name[:port]
    passdb backend = ldapsam:ldap://frodo.quenya.org
    # smbpasswd -x delete the entire dn-entry
    ldap delete dn = no
    # the machine and user suffix added to the base suffix
    # wrote WITHOUT quotes. NULL suffixes by default
    ldap user suffix = ou=People
    ldap group suffix = ou=Groups
    ldap machine suffix = ou=Computers
    # Trust UNIX account information in LDAP
    # (see the smb.conf manpage for details)
    # specify the base DN to use when searching the directory
    ldap suffix = ou=People,dc=quenya,dc=org
    # generally the default ldap search filter is ok
    ldap filter = (&(uid=%u)(objectclass=sambaSamAccount))

    +

    Accounts and Groups Management

    + + + + As user accounts are managed through the sambaSamAccount objectclass, you should modify your existing administration tools to deal with sambaSamAccount attributes.

    - Machines accounts are managed with the sambaSamAccount objectclass, just - like users accounts. However, it's up to you to store those accounts - in a different tree of your LDAP namespace: you should use - "ou=Groups,dc=quenya,dc=org" to store groups and - "ou=People,dc=quenya,dc=org" to store users. Just configure your - NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration - file). + Machine accounts are managed with the sambaSamAccount objectclass, just + like users accounts. However, it is up to you to store those accounts + in a different tree of your LDAP namespace. You should use + “ou=Groups,dc=quenya,dc=org” to store groups and + “ou=People,dc=quenya,dc=org” to store users. Just configure your + NSS and PAM accordingly (usually, in the /etc/openldap/sldap.conf + configuration file).

    - In Samba release 3.0, the group management system is based on POSIX + In Samba-3, the group management system is based on POSIX groups. This means that Samba makes use of the posixGroup objectclass. For now, there is no NT-like group system management (global and local - groups). -

    Security and sambaSamAccount

    + groups). Samba-3 knows only about Domain Groups + and, unlike MS Windows 2000 and Active Directory, Samba-3 does not + support nested groups. +

    Security and sambaSamAccount

    There are two important points to remember when discussing the security of sambaSamAccount entries in the directory.

    • Never retrieve the lmPassword or ntPassword attribute values over an unencrypted LDAP session.

    • Never allow non-admin users to view the lmPassword or ntPassword attribute values.

    - These password hashes are clear text equivalents and can be used to impersonate - the user without deriving the original clear text strings. For more information + These password hashes are cleartext equivalents and can be used to impersonate + the user without deriving the original cleartext strings. For more information on the details of LM/NT password hashes, refer to the - Account Information Database section of this chapter. + section of this chapter.

    - To remedy the first security issue, the ldap ssl smb.conf parameter defaults - to require an encrypted session (ldap ssl = on) using + To remedy the first security issue, the ldap ssl smb.conf parameter defaults + to require an encrypted session (ldap ssl = on) using the default port of 636 - when contacting the directory server. When using an OpenLDAP server, it + when contacting the directory server. When using an OpenLDAP server, it is possible to use the use the StartTLS LDAP extended operation in the place of - LDAPS. In either case, you are strongly discouraged to disable this security - (ldap ssl = off). + LDAPS. In either case, you are strongly discouraged to disable this security + (ldap ssl = off).

    Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS - extended operation. However, the OpenLDAP library still provides support for + extended operation. However, the OpenLDAP library still provides support for the older method of securing communication between clients and servers.

    The second security precaution is to prevent non-administrative users from - harvesting password hashes from the directory. This can be done using the + harvesting password hashes from the directory. This can be done using the following ACL in slapd.conf: 

    -## allow the "ldap admin dn" access, but deny everyone else
+## allow the "ldap admin dn" access, but deny everyone else
 access to attrs=lmPassword,ntPassword
-     by dn="cn=Samba Admin,ou=people,dc=quenya,dc=org" write
+     by dn="cn=Samba Admin,ou=People,dc=quenya,dc=org" write
      by * none

    -

    LDAP special attributes for sambaSamAccounts

    - The sambaSamAccount objectclass is composed of the following attributes: +

    LDAP Special Attributes for sambaSamAccounts

    + The sambaSamAccount objectclass is composed of the attributes shown in , and .

    -

    Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP)

    sambaLMPasswordthe LANMAN password 16-byte hash stored as a character -representation of a hexadecimal string.
    sambaNTPasswordthe NT password hash 16-byte stored as a character +

    Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP) Part A

    sambaLMPasswordThe LANMAN password 16-byte hash stored as a character + representation of a hexadecimal string.
    sambaNTPasswordThe NT password hash 16-byte stored as a character representation of a hexadecimal string.
    sambaPwdLastSetThe integer time in seconds since 1970 when the sambaLMPassword and sambaNTPassword attributes were last set. -
    sambaAcctFlagsstring of 11 characters surrounded by square brackets [] - representing account flags such as U (user), W(workstation), X(no password expiration), - I(Domain trust account), H(Home dir required), S(Server trust account), - and D(disabled).
    sambaLogonTimeInteger value currently unused
    sambaLogoffTimeInteger value currently unused
    sambaKickoffTimeInteger value currently unused
    sambaPwdCanChangeInteger value currently unused
    sambaPwdMustChangeInteger value currently unused
    sambaHomeDrivespecifies the drive letter to which to map the - UNC path specified by sambaHomePath. The drive letter must be specified in the form "X:" - where X is the letter of the drive to map. Refer to the "logon drive" parameter in the +
    sambaAcctFlagsString of 11 characters surrounded by square brackets [] + representing account flags such as U (user), W (workstation), X (no password expiration), + I (Domain trust account), H (Home dir required), S (Server trust account), + and D (disabled).
    sambaLogonTimeInteger value currently unused
    sambaLogoffTimeInteger value currently unused
    sambaKickoffTimeSpecifies the time (UNIX time format) when the user + will be locked down and cannot login any longer. If this attribute is ommited, then the account will never expire. + If you use this attribute together with `shadowExpire' of the `shadowAccount' objectClass, will enable accounts to + expire completly on an exact date.
    sambaPwdCanChangeSpecifies the time (UNIX time format) from which on the user is allowed to + change his password. If attribute is not set, the user will be free to change his password whenever he wants.
    sambaPwdMustChangeSpecifies the time (UNIX time format) since when the user is + forced to change his password. If this value is set to `0', the user will have to change his password at first login. + If this attribute is not set, then the password will never expire.
    sambaHomeDriveSpecifies the drive letter to which to map the + UNC path specified by sambaHomePath. The drive letter must be specified in the form “X:” + where X is the letter of the drive to map. Refer to the “logon drive” parameter in the smb.conf(5) man page for more information.
    sambaLogonScriptThe sambaLogonScript property specifies the path of the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path - is relative to the netlogon share. Refer to the logon script parameter in the - smb.conf man page for more information.
    sambaProfilePathspecifies a path to the user's profile. - This value can be a null string, a local absolute path, or a UNC path. Refer to the - logon path parameter in the smb.conf man page for more information.
    sambaHomePathThe sambaHomePath property specifies the path of -the home directory for the user. The string can be null. If sambaHomeDrive is set and specifies -a drive letter, sambaHomePath should be a UNC path. The path must be a network -UNC path of the form \\server\share\directory. This value can be a null string. -Refer to the logon home parameter in the smb.conf man page for more information. -
    sambaUserWorkstationscharacter string value currently unused. -
    sambaSIDThe security identifier(SID) of the user. The windows equivalent of unix uid's.
    sambaPrimaryGroupSIDthe relative identifier (RID) of the primary group - of the user.
    sambaDomainNamedomain the user is part of.

    + is relative to the netlogon share. Refer to the logon script parameter in the + smb.conf man page for more information.

    sambaProfilePathSpecifies a path to the user's profile. + This value can be a null string, a local absolute path, or a UNC path. Refer to the + logon path parameter in the smb.conf man page for more information.
    sambaHomePathThe sambaHomePath property specifies the path of + the home directory for the user. The string can be null. If sambaHomeDrive is set and specifies + a drive letter, sambaHomePath should be a UNC path. The path must be a network + UNC path of the form \\server\share\directory. This value can be a null string. + Refer to the logon home parameter in the smb.conf man page for more information. +

    +

    +

    Table 11.2. Attributes in the sambaSamAccount objectclass (LDAP) Part B

    sambaUserWorkstationsHere you can give a comma-seperated list of machines + on which the user is allowed to login. You may observe problems when you try to connect to an Samba Domain Member. + Bacause Domain Members are not in this list, the Domain Controllers will reject them. Where this attribute is ommited, + the default implies no restrictions. +
    sambaSIDThe security identifier(SID) of the user. + The Windows equivalent of UNIX UIDs.
    sambaPrimaryGroupSIDThe Security IDentifier (SID) of the primary group + of the user.
    sambaDomainNameDomain the user is part of.

    The majority of these parameters are only used when Samba is acting as a PDC of - a domain (refer to the Samba as a primary domain controller chapter for details on + a domain (refer to , for details on how to configure Samba as a Primary Domain Controller). The following four attributes are only stored with the sambaSamAccount entry if the values are non-default values: -

    • sambaHomePath

    • sambaLogonScript

    • sambaProfilePath

    • sambaHomeDrive

    +

    • sambaHomePath
    • sambaLogonScript
    • sambaProfilePath
    • sambaHomeDrive

    These attributes are only stored with the sambaSamAccount entry if - the values are non-default values. For example, assume TASHTEGO has now been - configured as a PDC and that logon home = \\%L\%u was defined in - its smb.conf file. When a user named "becky" logons to the domain, - the logon home string is expanded to \\TASHTEGO\becky. - If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", - this value is used. However, if this attribute does not exist, then the value - of the logon home parameter is used in its place. Samba + the values are non-default values. For example, assume MORIA has now been + configured as a PDC and that logon home = \\%L\%u was defined in + its smb.conf file. When a user named “becky” logons to the domain, + the logon home string is expanded to \\MORIA\becky. + If the smbHome attribute exists in the entry “uid=becky,ou=People,dc=samba,dc=org”, + this value is used. However, if this attribute does not exist, then the value + of the logon home parameter is used in its place. Samba will only write the attribute value to the directory entry if the value is - something other than the default (e.g. \\MOBY\becky). -

    Example LDIF Entries for a sambaSamAccount

    - The following is a working LDIF with the inclusion of the posixAccount objectclass: + something other than the default (e.g., \\MOBY\becky). +

    Example LDIF Entries for a sambaSamAccount

    + The following is a working LDIF that demonstrates the use of the SambaSamAccount objectclass: 

    -	dn: uid=guest2, ou=people,dc=quenya,dc=org
-	sambaNTPassword: 878D8014606CDA29677A44EFA1353FC7
+	dn: uid=guest2, ou=People,dc=quenya,dc=org
+	sambaLMPassword: 878D8014606CDA29677A44EFA1353FC7
 	sambaPwdMustChange: 2147483647
 	sambaPrimaryGroupSID: S-1-5-21-2447931902-1787058256-3961074038-513
 	sambaNTPassword: 552902031BEDE9EFAAD3B435B51404EE
@@ -673,7 +764,7 @@ Refer to the logon home parameter in the 
-	dn: uid=gcarter, ou=people,dc=quenya,dc=org
+	dn: uid=gcarter, ou=People,dc=quenya,dc=org
 	sambaLogonTime: 0
 	displayName: Gerald Carter
 	sambaLMPassword: 552902031BEDE9EFAAD3B435B51404EE
@@ -691,95 +782,102 @@ Refer to the logon home parameter in the 
    Password synchronisation
    
-		Since version 3.0 samba can update the non-samba (LDAP) password stored with an account. When
-		using pam_ldap, this allows changing both unix and windows passwords at once.
-		
    The ldap passwd sync options can have the following values:
    yes
    When the user changes his password, update
-					       ntPassword, lmPassword
-					       and the password fields.
    no
    Only update ntPassword and lmPassword.
    only
    Only update the LDAP password and let the LDAP server worry about the other fields. This option is only available on some LDAP servers. [3]
    More information can be found in the smb.conf manpage.
-

    MySQL

    - Every so often someone will come along with a great new idea. Storing of user accounts in an +

    Password Synchronization

    + Samba-3 and later can update the non-samba (LDAP) password stored with an account. When + using pam_ldap, this allows changing both UNIX and Windows passwords at once. +

    The ldap passwd sync options can have the values shown in + .

    Table 11.3. Possible ldap passwd sync values

    ValueDescription
    yes

    When the user changes his password, update + ntPassword, lmPassword + and the password fields.

    no

    Only update ntPassword and lmPassword.

    only

    Only update the LDAP password and let the LDAP server worry about the other fields. + This option is only available on some LDAP servers. Only when the LDAP server + supports LDAP_EXOP_X_MODIFY_PASSWD.

    More information can be found in the smb.conf manpage.

    MySQL

    + + Every so often someone will come along with a great new idea. Storing user accounts in a SQL backend is one of them. Those who want to do this are in the best position to know what the - specific benefits are to them. This may sound like a cop-out, but in truth we can not attempt - to document every nitty little detail why certain things of marginal utility to the bulk of + specific benefits are to them. This may sound like a cop-out, but in truth we cannot attempt + to document every little detail why certain things of marginal utility to the bulk of Samba users might make sense to the rest. In any case, the following instructions should help the determined SQL user to implement a working system. -

    Creating the database

    - You either can set up your own table and specify the field names to pdb_mysql (see below +

    Creating the Database

    + You can set up your own table and specify the field names to pdb_mysql (see below for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump - contains the correct queries to create the required tables. Use the command : + contains the correct queries to create the required tables. Use the command: 

     $ mysql -uusername -hhostname -ppassword \
-databasename < /path/to/samba/examples/pdb/mysql/mysql.dump
+	databasename < /path/to/samba/examples/pdb/mysql/mysql.dump

    -

    Configuring

    This plugin lacks some good documentation, but here is some short info:

    Add a the following to the passdb backend variable in your smb.conf: -

    passdb backend = [other-plugins] mysql:identifier [other-plugins]

    -

    The identifier can be any string you like, as long as it doesn't collide with +

    Configuring

    This plugin lacks some good documentation, but here is some brief infoormation. Add the following to the + passdb backend variable in your smb.conf: +

    passdb backend = [other-plugins] mysql:identifier [other-plugins]

    +

    The identifier can be any string you like, as long as it does not collide with the identifiers of other plugins or other instances of pdb_mysql. If you - specify multiple pdb_mysql.so entries in passdb backend, you also need to - use different identifiers! -

    - Additional options can be given through the smb.conf file in the [global] section. + specify multiple pdb_mysql.so entries in passdb backend, you also need to + use different identifiers.

    -

    Table 11.2. Basic smb.conf options for MySQL passdb backend

    FieldContents
    mysql hosthost name, defaults to 'localhost'
    mysql password 
    mysql userdefaults to 'samba'
    mysql databasedefaults to 'samba'
    mysql portdefaults to 3306
    tableName of the table containing users

    -

    Warning

    - Since the password for the MySQL user is stored in the - smb.conf file, you should make the smb.conf file - readable only to the user that runs Samba This is considered a security - bug and will be fixed soon. -

    Names of the columns in this table (I've added column types those columns should have first):

    -

    Table 11.3. MySQL field names for MySQL passdb backend

    FieldTypeContents
    logon time columnint(9) 
    logoff time columnint(9) 
    kickoff time columnint(9) 
    pass last set time columnint(9) 
    pass can change time columnint(9) 
    pass must change time columnint(9) 
    username columnvarchar(255)unix username
    domain columnvarchar(255)NT domain user is part of
    nt username columnvarchar(255)NT username
    fullname columnvarchar(255)Full name of user
    home dir columnvarchar(255)UNIX homedir path
    dir drive columnvarchar(2)Directory drive path (eg: 'H:')
    logon script columnvarchar(255)Batch file to run on client side when logging on
    profile path columnvarchar(255)Path of profile
    acct desc columnvarchar(255)Some ASCII NT user data
    workstations columnvarchar(255)Workstations user can logon to (or NULL for all)
    unknown string columnvarchar(255)unknown string
    munged dial columnvarchar(255)?
    user sid columnvarchar(255)NT user SID
    group sid columnvarchar(255)NT group ID
    lanman pass columnvarchar(255)encrypted lanman password
    nt pass columnvarchar(255)encrypted nt passwd
    plain pass columnvarchar(255)plaintext password
    acct control columnint(9)nt user data
    unknown 3 columnint(9)unknown
    logon divs columnint(9)?
    hours len columnint(9)?
    unknown 5 columnint(9)unknown
    unknown 6 columnint(9)unknown

    + Additional options can be given through the smb.conf file in the [global] section. + Refer to . +

    Table 11.4. Basic smb.conf options for MySQL passdb backend

    FieldContents
    mysql hostHost name, defaults to `localhost'
    mysql password 
    mysql userDefaults to `samba'
    mysql databaseDefaults to `samba'
    mysql portDefaults to 3306
    tableName of the table containing the users

    Warning

    + Since the password for the MySQL user is stored in the smb.conf file, you should make the smb.conf file + readable only to the user who runs Samba. This is considered a security bug and will soon be fixed. +

    Names of the columns are given in . The default column names can be found in the example table dump. +

    +

    Table 11.5. MySQL field names for MySQL passdb backend

    FieldTypeContents
    logon time columnint(9)UNIX time stamp of last logon of user
    logoff time columnint(9)UNIX time stamp of last logoff of user
    kickoff time columnint(9)UNIX time stamp of moment user should be kicked off workstation (not enforced)
    pass last set time columnint(9)UNIX time stamp of moment password was last set
    pass can change time columnint(9)UNIX time stamp of moment from which password can be changed
    pass must change time columnint(9)UNIX time stamp of moment on which password must be changed
    username columnvarchar(255)UNIX username
    domain columnvarchar(255)NT domain user belongs to
    nt username columnvarchar(255)NT username
    fullname columnvarchar(255)Full name of user
    home dir columnvarchar(255)UNIX homedir path
    dir drive columnvarchar(2)Directory drive path (e.g., “H:”)
    logon script columnvarchar(255)Batch file to run on client side when logging on
    profile path columnvarchar(255)Path of profile
    acct desc columnvarchar(255)Some ASCII NT user data
    workstations columnvarchar(255)Workstations user can logon to (or NULL for all)
    unknown string columnvarchar(255)Unknown string
    munged dial columnvarchar(255)Unknown
    user sid columnvarchar(255)NT user SID
    group sid columnvarchar(255)NT group SID
    lanman pass columnvarchar(255)Encrypted lanman password
    nt pass columnvarchar(255)Encrypted nt passwd
    plain pass columnvarchar(255)Plaintext password
    acct ctrl columnint(9)NT user data
    unknown 3 columnint(9)Unknown
    logon divs columnint(9)Unknown
    hours len columnint(9)Unknown
    bad password count columnint(5)Number of failed password tries before disabling an account
    logon count columnint(5)Number of logon attempts
    unknown 6 columnint(9)Unknown

    - Eventually, you can put a colon (:) after the name of each column, which + You can put a colon (:) after the name of each column, which should specify the column to update when updating the table. You can also - specify nothing behind the colon - then the data from the field will not be - updated. -

    Using plaintext passwords or encrypted password

    - I strongly discourage the use of plaintext passwords, however, you can use them: + specify nothing behind the colon. Then the field data will not be updated. Setting a column name to NULL means the field should not be used. +

    An example configuration can be found in . +

    Example 11.3. Example configuration for the MySQL passdb backend

    [global]
    passdb backend = mysql:foo
    foo:mysql user = samba
    foo:mysql password = abmas
    foo:mysql database = samba
    # domain name is static and can't be changed
    foo:domain column = 'MYWORKGROUP':
    # The fullname column comes from several other columns
    foo:fullname column = CONCAT(firstname,' ',surname):
    # Samba should never write to the password columns
    foo:lanman pass column = lm_pass:
    foo:nt pass column = nt_pass:
    # The unknown 3 column is not stored
    foo:unknown 3 column = NULL

    Using Plaintext Passwords or Encrypted Password

    + + I strongly discourage the use of plaintext passwords, however, you can use them.

    If you would like to use plaintext passwords, set - 'identifier:lanman pass column' and 'identifier:nt pass column' to - 'NULL' (without the quotes) and 'identifier:plain pass column' to the + `identifier:lanman pass column' and `identifier:nt pass column' to + `NULL' (without the quotes) and `identifier:plain pass column' to the name of the column containing the plaintext passwords.

    If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default. -

    Getting non-column data from the table

    - It is possible to have not all data in the database and making some 'constant'. +

    Getting Non-Column Data from the Table

    + It is possible to have not all data in the database by making some `constant'.

    - For example, you can set 'identifier:fullname column' to : - CONCAT(First_name,' ',Sur_name) + For example, you can set `identifier:fullname column' to + something like CONCAT(Firstname,' ',Surname)

    - Or, set 'identifier:workstations column' to : - NULL

    See the MySQL documentation for more language constructs.

    XML

    This module requires libxml2 to be installed.

    The usage of pdb_xml is pretty straightforward. To export data, use: + Or, set `identifier:workstations column' to: + NULL

    See the MySQL documentation for more language constructs.

    XML

    + + This module requires libxml2 to be installed.

    The usage of pdb_xml is fairly straightforward. To export data, use:

    + $ pdbedit -e xml:filename

    (where filename is the name of the file to put the data in)

    To import data, use: $ pdbedit -i xml:filename -

    Common Errors

    Users can not logon

    “I've installed samba, but now I can't log on with my unix account!”

    Make sure your user has been added to the current samba passdb backend. Read the section Account Management Tools for details.

    Users being added to wrong backend database

    +

    Common Errors

    Users Cannot Logon

    “I've installed Samba, but now I can't log on with my UNIX account! ”

    Make sure your user has been added to the current Samba passdb backend. Read the section for details.

    Users Being Added to the Wrong Backend Database

    A few complaints have been received from users that just moved to Samba-3. The following smb.conf file entries were causing problems, new accounts were being added to the old smbpasswd file, not to the tdbsam passdb.tdb file:

    -

    [global]
    ...
    passdb backend = smbpasswd, tdbsam
    ...

    +

    [global]
    ...
    passdb backend = smbpasswd, tdbsam
    ...

    Samba will add new accounts to the first entry in the passdb backend parameter entry. If you want to update to the tdbsam, then change the entry to:

    -

    [globals]
    ...
    passdb backend = tdbsam, smbpasswd
    ...

    -

    auth methods does not work

    - If you explicitly set an auth methods parameter, guest must be specified as the first - entry on the line. Eg: auth methods = guest sam. +

    passdb backend = tdbsam, smbpasswd

    +

    Configuration of auth methods

    + When explicitly setting an auth methods parameter, + guest must be specified as the first entry on the line, + for example, auth methods = guest sam.

    - This is the exact opposite of the requirement for the passdb backend + This is the exact opposite of the requirement for the passdb backend option, where it must be the LAST parameter on the line. -


    [3] Only when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD

    Prev Up Next
    Chapter 10. Samba / MS Windows Network Browsing Guide Home Chapter 12. Mapping MS Windows and UNIX Groups
    +

    Prev Up Next
    Chapter 10. Network Browsing Home Chapter 12. Group Mapping MS Windows and UNIX
    diff --git a/docs/htmldocs/pdbedit.8.html b/docs/htmldocs/pdbedit.8.html index 39a901923f..3bca3a9d6c 100644 --- a/docs/htmldocs/pdbedit.8.html +++ b/docs/htmldocs/pdbedit.8.html @@ -103,8 +103,8 @@ account policy value for bad lockout attempt is 0 account policy value for bad lockout attempt was 0 account policy value for bad lockout attempt is now 3
    -h|--help

    Print a summary of command line options. -

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the +

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -117,13 +117,13 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension ".client" will be appended. The log file is never removed by the client. diff --git a/docs/htmldocs/pr01.html b/docs/htmldocs/pr01.html index 193564ca32..f0ce4c3d3d 100644 --- a/docs/htmldocs/pr01.html +++ b/docs/htmldocs/pr01.html @@ -1,5 +1,5 @@ -Legal Notice

    Legal Notice
    Prev   Next

    Legal Notice

    +Legal Notice

    Legal Notice
    Prev   Next

    Legal Notice

    This documentation is distributed under the GNU General Public License (GPL) version 2. A copy of the license is included with the Samba source -distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt -

    Prev Up Next
    SAMBA Project Documentation Home Attributions
    +distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt +

    Prev Up Next
    SAMBA Project Documentation Home Attributions
    diff --git a/docs/htmldocs/pr02.html b/docs/htmldocs/pr02.html index 08a02a7142..080c1c2075 100644 --- a/docs/htmldocs/pr02.html +++ b/docs/htmldocs/pr02.html @@ -1 +1 @@ -Attributions
    Attributions
    Prev   Next

    Attributions

    Introduction to Samba

    How to Install and Test SAMBA

    Fast Start for the Impatient

    Server Types and Security Modes

    Domain Control

    Backup Domain Control

    Domain Membership

    Stand-Alone Servers

    MS Windows Network Configuration Guide

    Samba / MS Windows Network Browsing Guide

    Account Information Databases

    Mapping MS Windows and UNIX Groups

    File, Directory and Share Access Controls

    File and Record Locking

    Securing Samba

    Interdomain Trust Relationships

    Hosting a Microsoft Distributed File System tree on Samba

    Classical Printing Support

    CUPS Printing Support in Samba 3.0

    Stackable VFS modules

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Tim Potter

    • Simo Sorce (original vfs_skel README)

    • Alexander Bokovoy (original vfs_netatalk docs)

    • Stefan Metzmacher (Update for multiple modules)

    Advanced Network Management

    System and Account Policies

    Desktop Profile Management

    PAM based Distributed Authentication

    Integrating MS Windows networks with Samba

    Unicode/Charsets

    Samba Backup Techniques

    High Availability Options

    Upgrading from Samba-2.x to Samba-3.0.0

    Migration from NT4 PDC to Samba-3 PDC

    SWAT - The Samba Web Administration Tool

    The Samba checklist

    Analysing and solving samba problems

    Reporting Bugs

    How to compile Samba

    Portability

    Samba and other CIFS clients

    Samba Performance Tuning

    DNS and DHCP Configuration Guide

    Further Resources

    Prev Up Next
    Legal Notice Home Part I. General Installation
    +Attributions
    Attributions
    Prev   Next

    Attributions

    • David Lechnyr <david@lechnyr.com>

    • Andrew Tridgell <tridge@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Karl Auer <kauer@biplane.com.au>

    • Dan Shearer <dan@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Andrew Tridgell <tridge@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Gerald (Jerry) Carter <jerry@samba.org>

    • David Bannon <dbannon@samba.org>

    • Guenther Deschner <gd@suse.de> (LDAP updates)

    • John H. Terpstra <jht@samba.org>

    • Volker Lendecke <Volker.Lendecke@SerNet.DE>

    • Guenther Deschner <gd@suse.de> (LDAP updates)

    • John H. Terpstra <jht@samba.org>

    • Jeremy Allison <jra@samba.org>

    • Gerald (Jerry) Carter <jerry@samba.org>

    • Andrew Tridgell <tridge@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • Guenther Deschner <gd@suse.de> (LDAP updates)

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Gerald (Jerry) Carter <jerry@samba.org>

    • Jeremy Allison <jra@samba.org>

    • Guenther Deschner <gd@suse.de> (LDAP updates)

    • Olivier (lem) Lemaire <olem@IDEALX.org>

    • John H. Terpstra <jht@samba.org>

    • Jean François Micouleau

    • Gerald (Jerry) Carter <jerry@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Jeremy Allison <jra@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org> (drawing)

    • Jeremy Allison <jra@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Eric Roseme <eric.roseme@hp.com>

    • Andrew Tridgell <tridge@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Rafal Szczesniak <mimir@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org> (drawing)

    • Stephen Langasek <vorlon@netexpress.net>

    • Shirish Kalele <samba@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Kurt Pfeifle <kpfeifle@danka.de>

    • Gerald (Jerry) Carter <jerry@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Kurt Pfeifle <kpfeifle@danka.de>

    • Ciprian Vizitiu <CVizitiu@gbif.org> (drawings)

    • Jelmer R. Vernooij <jelmer@samba.org> (drawings)

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Tim Potter <tpot@samba.org>

    • Simo Sorce (original vfs_skel README)

    • Alexander Bokovoy (original vfs_netatalk docs)

    • Stefan Metzmacher (Update for multiple modules)

    • Tim Potter <tpot@linuxcare.com.au>

    • Andrew Tridgell <tridge@samba.org>

    • Naag Mummaneni <getnag@rediffmail.com> (Notes for Solaris)

    • John Trostel <jtrostel@snapserver.com>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Stephen Langasek <vorlon@netexpress.net>

    • John H. Terpstra <jht@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • TAKAHASHI Motonobu <monyo@home.monyo.com>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Gerald (Jerry) Carter <jerry@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Andrew Tridgell <tridge@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • Dan Shearer <dan@samba.org>

    • Gerald (Jerry) Carter <jerry@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • David Bannon <dbannon@samba.org>

    • Dan Shearer <dan@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • Andrew Tridgell <tridge@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Andrew Tridgell <tridge@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Dan Shearer <dan@samba.org>

    • Jim McDonough <jmcd@us.ibm.com> (OS/2)

    • Paul Cochrane <paulc@dth.scot.nhs.uk>

    • Jelmer R. Vernooij <jelmer@samba.org>

    • John H. Terpstra <jht@samba.org>

    • John H. Terpstra <jht@samba.org>

    • Jelmer R. Vernooij <jelmer@samba.org>

    Prev Up Next
    Legal Notice Home Part I. General Installation
    diff --git a/docs/htmldocs/printing.html b/docs/htmldocs/printing.html index 2b0abb56e6..5e7bf473c0 100644 --- a/docs/htmldocs/printing.html +++ b/docs/htmldocs/printing.html @@ -1,157 +1,130 @@ -Chapter 18. Classical Printing Support
    Chapter 18. Classical Printing Support
    Prev Part III. Advanced Configuration Next

    Chapter 18. Classical Printing Support

    Kurt Pfeifle

    Danka Deutschland GmbH

    Gerald (Jerry) Carter

    Samba Team

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Introduction
    What happens if you send a Job from a Client
    Printing Related Configuration Parameters
    Parameters Recommended for Use
    A simple Configuration to Print
    Verification of "Settings in Use" with testparm
    A little Experiment to warn you
    Extended Sample Configuration to Print
    Detailed Explanation of the Example's Settings
    The [global] Section
    The [printers] Section
    Any [my_printer_name] Section
    Print Commands
    Default Print Commands for various UNIX Print Subsystems
    Setting up your own Print Commands
    Innovations in Samba Printing since 2.2
    Client Drivers on Samba Server for Point'n'Print
    The [printer$] Section is removed from Samba 3
    Creating the [print$] Share
    Parameters in the [print$] Section
    Subdirectory Structure in [print$]
    Installing Drivers into [print$]
    Setting Drivers for existing Printers with a Client GUI
    Setting Drivers for existing Printers with -rpcclient
    Client Driver Install Procedure
    The first Client Driver Installation
    IMPORTANT! Setting Device Modes on new Printers
    Further Client Driver Install Procedures
    Always make first Client Connection as root or "printer admin"
    Other Gotchas
    Setting Default Print Options for the Client Drivers
    Supporting large Numbers of Printers
    Adding new Printers with the Windows NT APW
    Weird Error Message Cannot connect under a -different Name
    Be careful when assembling Driver Files
    Samba and Printer Ports
    Avoiding the most common Misconfigurations of the Client Driver
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Add Network Printers at Logon without User Interaction
    The addprinter command
    Migration of "Classical" printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I give my root password but I don't get access
    My printjobs get spooled into the spooling directory, but then get lost

    Features and Benefits

    -Printing is often a mission-critical service for the users. Samba can +Chapter 18. Classical Printing Support

    Chapter 18. Classical Printing Support
    Prev Part III. Advanced Configuration Next

    Chapter 18. Classical Printing Support

    Kurt Pfeifle

    Danka Deutschland GmbH

    Gerald (Jerry) Carter

    Samba Team

    John H. Terpstra

    Samba Team

    May 31, 2003

    Table of Contents

    Features and Benefits
    Technical Introduction
    Client to Samba Print Job Processing
    Printing Related Configuration Parameters
    Simple Print Configuration
    Verifing Configuration with testparm
    Rapid Configuration Validation
    Extended Printing Configuration
    Detailed Explanation Settings
    Printing Developments Since Samba-2.2
    Point'n'Print Client Drivers on Samba Servers
    The Obsoleted [printer$] Section
    Creating the [print$] Share
    [print$] Section Parameters
    The [print$] Share Directory
    Installing Drivers into [print$]
    Add Printer Wizard Driver Installation
    Installing Print Drivers Using rpcclient
    Client Driver Installation Procedure
    First Client Driver Installation
    Setting Device Modes on New Printers
    Additional Client Driver Installation
    Always Make First Client Connection as root or printer admin
    Other Gotchas
    Setting Default Print Options for Client Drivers
    Supporting Large Numbers of Printers
    Adding New Printers with the Windows NT APW
    Error Message: Cannot connect under a different Name
    Take Care When Assembling Driver Files
    Samba and Printer Ports
    Avoiding Common Client Driver Misconfiguration
    The Imprints Toolset
    What is Imprints?
    Creating Printer Driver Packages
    The Imprints Server
    The Installation Client
    Adding Network Printers without User Interaction
    The addprinter Command
    Migration of Classical Printing to Samba
    Publishing Printer Information in Active Directory or LDAP
    Common Errors
    I Give My Root Password but I Do Not Get Access
    My Print Jobs Get Spooled into the Spooling Directory, but Then Get Lost

    Features and Benefits

    +Printing is often a mission-critical service for the users. Samba can provide this service reliably and seamlessly for a client network consisting of Windows workstations.

    -A Samba print service may be run on a Standalone or a Domain -member server, side by side with file serving functions, or on a -dedicated print server. It can be made as tight or as loosely secured -as needs dictate. Configurations may be simple or complex. Available -authentication schemes are essentially the same as described for file -services in previous chapters. Overall, Samba's printing support is -now able to replace an NT or Windows 2000 print server full-square, -with additional benefits in many cases. Clients may download and -install drivers and printers through their familiar "Point'n'Print" -mechanism. Printer installations executed by "Logon Scripts" are no -problem. Administrators can upload and manage drivers to be used by -clients through the familiar "Add Printer Wizard". As an additional -benefit, driver and printer management may be run from the command line -or through scripts, making it more efficient in case of large numbers -of printers. If a central accounting of print jobs (tracking every -single page and supplying the raw data for all sorts of statistical -reports) is required, this is best supported by CUPS as the print -subsystem underneath the Samba hood. +A Samba print service may be run on a Stand-alone or Domain Member server, +side by side with file serving functions, or on a dedicated print server. +It can be made as tight or as loosely secured as needs dictate. Configurations +may be simple or complex. Available authentication schemes are essentially +the same as described for file services in previous chapters. Overall, +Samba's printing support is now able to replace an NT or Windows 2000 +print server full-square, with additional benefits in many cases. Clients +may download and install drivers and printers through their familiar +“Point'n'Print” mechanism. Printer installations executed by +“Logon Scripts” are no problem. Administrators can upload and +manage drivers to be used by clients through the familiar “Add Printer +Wizard”. As an additional benefit, driver and printer management may +be run from the command line or through scripts, making it more efficient +in case of large numbers of printers. If a central accounting of print jobs +(tracking every single page and supplying the raw data for all sorts of +statistical reports) is required, this function is best supported by +the newer Common UNIX Printing System (CUPS) +as the print subsystem underneath the Samba hood.

    -This chapter deals with the foundations of Samba printing, as they -implemented by the more traditional UNIX (BSD- and System V-style) -printing systems. Many things apply to CUPS, the newer Common UNIX -Printing System, too; so if you use CUPS, you might be tempted to jump -to the next chapter -- but you will certainly miss a few things if you -do so. Better to read this chapter too. +This chapter deals with the foundations of Samba printing as they +are implemented by the more traditional UNIX (BSD- and System V-style) +printing systems. Many things covered in this chapter apply also to CUPS. +If you use CUPS, you may be tempted +to jump to the next chapter but you will certainly miss a few things if +you do. It is recommended that you read this chapter as well as .

    Note

    -Most of the given examples have been verified on Windows XP +Most of the following examples have been verified on Windows XP Professional clients. Where this document describes the responses to -commands given, bear in mind that Windows 2000 clients are very -similar, but may differ in details. Windows NT is somewhat different +commands given, bear in mind that Windows 200x/XP clients are quite +similar, but may differ in minor details. Windows NT is somewhat different again. -

    Technical Introduction

    -Samba's printing support always relies on the installed print -subsystem of the UNIX OS it runs on. Samba is a "middleman". It takes -printfiles from Windows (or other SMB) clients and passes them to the -real printing system for further processing. Therefore it needs to -"talk" to two sides: to the Windows print clients and to the UNIX -printing system. Hence we must differentiate between the various -client OS types each of which behave differently, as well as the -various UNIX print subsystems, which themselves have different -features and are accessed differently. This part of the Samba HOWTO -Collection deals with the "traditional" way of UNIX printing first; -the next chapter covers in great detail the more modern -Common UNIX Printing System -(CUPS). - -

    Important

    CUPS users, be warned: don't just jump on to the next -chapter. You might miss important information contained only -here!

    -

    What happens if you send a Job from a Client

    -To successfully print a job from a Windows client via a Samba -print server to a UNIX printer, there are 6 (potentially 7) -stages: -

    1. Windows opens a connection to the printer share

    2. Samba must authenticate the user

    3. Windows sends a copy of the printfile over the network -into Samba's spooling area

    4. Windows closes the connection again

    5. Samba invokes the print command to hand the file over -to the UNIX print subsystem's spooling area

    6. The UNIX print subsystem processes the print -job

    7. The printfile may need to be explicitly deleted -from the Samba spooling area.

    Printing Related Configuration Parameters

    -There are a number of configuration parameters in - controlling Samba's printing -behaviour. Please also refer to the man page for smb.conf to -acquire an overview about these. As with other parameters, there are -Global Level (tagged with a "G" in the listings) and -Service Level ("S") parameters. -

    Service Level Parameters

    These may go into the -[global] section of smb.conf. -In this case they define the default -behaviour of all individual or service level shares (provided those -don't have a different setting defined for the same parameter, thus -overriding the global default).

    Global Parameters

    These may not go into individual -shares. If they go in by error, the "testparm" utility can discover -this (if you run it) and tell you so.

    Parameters Recommended for Use

    The following smb.conf parameters directly -related to printing are used in Samba. See also the -smb.conf man page for detailed explanations: -

    Global level parameters: addprinter command, -deleteprinter command, -disable spoolss, -enumports command, -load printers, -lpq cache time, -os2 driver map, -printcap name, printcap, -show add printer wizard, -total print jobs, -use client driver. -

    Service level parameters: hosts allow, -hosts deny, -lppause command, -lpq command, -lpresume command, -lprm command, -max print jobs, -min print space, -print command, -printable, print ok , -printer name, printer, -printer admin, -printing = [cups|bsd|lprng...], -queuepause command, -queueresume command, -total print jobs. +

    Technical Introduction

    +Samba's printing support always relies on the installed print subsystem +of the UNIX OS it runs on. Samba is a “middleman.” It takes +print files from Windows (or other SMB) clients and passes them to the real +printing system for further processing, therefore, it needs to communicate with +both sides: the Windows print clients and the UNIX printing system. Hence, we +must differentiate between the various client OS types, each of which behave +differently, as well as the various UNIX print subsystems, which themselves +have different features and are accessed differently. +

    +This deals with the traditional way of UNIX printing. The next chapter +covers in great detail the more modern Common UNIX Printing +System (CUPS). +

    Important

    CUPS users, be warned: do not just jump on to the next +chapter. You might miss important information only found here! +

    +It is apparent from postings on the Samba mailing list that print configuration +is one of the most problematic aspects of Samba administration today. Many +new Samba administrators have the impression that Samba performs some sort +of print processing. Rest assured, Samba does not peform any type of print +processing. It does not do any form of print filtering.

    -Samba's printing support implements the Microsoft Remote Procedure -Calls (MS-RPC) methods for printing. These are used by Windows NT (and -later) print servers. The old "LanMan" protocol is still supported as -a fallback resort, and for older clients to use. More details will -follow further beneath. -

    A simple Configuration to Print

    -Here is a very simple example configuration for print related settings -in the file. If you compare it with your own system's , you probably find some -additional parameters included there (as pre-configured by your OS -vendor). Further below is a discussion and explanation of the -parameters. Note, that this example doesn't use many parameters. +Samba obtains from its clients a data stream (print job) that it spools to a +local spool area. When the entire print job has been received, Samba invokes +a local UNIX/Linux print command and passes the spooled file to it. It is +up to the local system printing subsystems to correctly process the print +job and to submit it to the printer. +

    Client to Samba Print Job Processing

    +Successful printing from a Windows client via a Samba print server to a UNIX +printer involves six (potentially seven) stages: +

    1. Windows opens a connection to the printer share.

    2. Samba must authenticate the user.

    3. Windows sends a copy of the print file over the network +into Samba's spooling area.

    4. Windows closes the connection.

    5. Samba invokes the print command to hand the file over +to the UNIX print subsystem's spooling area.

    6. The UNIX print subsystem processes the print job.

    7. The print file may need to be explicitly deleted +from the Samba spooling area. This item depends on your print spooler +configuration settings.

    Printing Related Configuration Parameters

    +There are a number of configuration parameters to control Samba's +printing behavior. Please refer to the man page for smb.conf for an +overview of these. As with other parameters, there are Global Level +(tagged with a G in the listings) and Service Level +(S) parameters. +

    Global Parameters

    These may not go into + individual share definitions. If they go in by error, + the testparm utility can discover this + (if you run it) and tell you so. +

    Service Level Parameters

    These may be specified in the + [global] section of smb.conf. + In this case they define the default behavior of all individual + or service level shares (provided they do not have a different + setting defined for the same parameter, thus overriding the + global default). +

    Simple Print Configuration

    + shows a simple printing configuration. +If you compare this with your own, you may find +additional parameters that have been pre-configured by your OS +vendor. Below is a discussion and explanation of the +parameters. This example does not use many parameters. However, in many environments these are enough to provide a valid -smb.conf file which enables all clients to print. -

    Example 18.1. Simple configuration with BSD printing

    [global]
    printing = bsd
    load printers = yes
    [printers]
    path = /var/spool/samba
    printable = yes
    public = yes
    writable = no

    -This is only an example configuration. Samba assigns default values to all -configuration parameters. On the whole the defaults are conservative and -sensible. When a parameter is specified in the smb.conf file this overwrites -the default value. The testparm utility when run as root -is capable of reporting all setting, both default as well as smb.conf file -settings. Testparm gives warnings for all mis-configured -settings. The complete output is easily 340 lines and more, so you may want -to pipe it through a pager program. +smb.conf file that enables all clients to print. +

    +

    Example 18.1. Simple configuration with BSD printing

    [global]
    printing = bsd
    load printers = yes
    [printers]
    path = /var/spool/samba
    printable = yes
    public = yes
    writable = no

    +This is only an example configuration. Samba assigns default values to +all configuration parameters. The defaults are conservative +and sensible. When a parameter is specified in the smb.conf file, this +overwrites the default value. The testparm utility when +run as root is capable of reporting all setting, both default as well as +smb.conf file settings. Testparm gives warnings for all +misconfigured settings. The complete output is easily 340 lines and more, +so you may want to pipe it through a pager program.

    The syntax for the configuration file is easy to grasp. You should -know that is not very picky about its -syntax. It has been explained elsewhere in this document. A short -reminder: It even tolerates some spelling errors (like "browsable" -instead of "browseable"). Most spelling is case-insensitive. Also, you -can use "Yes|No" or "True|False" for boolean settings. Lists of names +know that is not very picky about its syntax. As has been explained +elsewhere in this document, Samba tolerates some spelling errors (such +as browsable instead of +browseable), and spelling is +case-insensitive. It is permissible to use Yes/No +or True/False for Boolean settings. Lists of names may be separated by commas, spaces or tabs. -

    Verification of "Settings in Use" with testparm

    -To see all (or at least most) printing related settings in Samba, -including the implicitly used ones, try the command outlined below -(hit "ENTER" twice!). It greps for all occurrences of "lp", "print", -"spool", "driver", "ports" and "[" in testparm's output and gives you -a nice overview about the running smbd's print configuration. (Note -that this command does not show individually created printer shares, -or the spooling paths in each case). Here is the output of my Samba -setup, with exactly the same settings in -as shown above: +

    Verifing Configuration with testparm

    +To see all (or at least most) printing-related settings in Samba, including +the implicitly used ones, try the command outlined below. This command greps +for all occurrences of lp, print, spool, driver, ports +and [ in testparms output. This provides a convenient +overview of the running smbd print configuration. This +command does not show individually created printer shares or the spooling +paths they may use. Here is the output of my Samba setup, with settings +shown in : 

    -root# testparm -v | egrep "(lp|print|spool|driver|ports|\[)"
- Load smb config files from /etc/samba/smb.conf.simpleprinting
- Processing section "[homes]"
- Processing section "[printers]"
+root# testparm -s -v | egrep "(lp|print|spool|driver|ports|\[)"
+ Load smb config files from /etc/samba/smb.conf
+ Processing section "[homes]"
+ Processing section "[printers]"
  
  [global]
         smb ports = 445 139
@@ -183,73 +156,66 @@ as shown above:
  [printers]
         path = /var/spool/samba
         printable = Yes
-

    +

    You can easily verify which settings were implicitly added by Samba's -default behaviour. Don't forget about this point: it may +default behavior. Remember: it may be important in your future dealings with Samba. -

    Note

    testparm in samba 3 behaves differently from 2.2.x: used -without the "-v" switch it only shows you the settings actually -written into ! To see the complete -configuration used, add the "-v" parameter to testparm.

    A little Experiment to warn you

    +

    Note

    testparm in Samba-3 behaves differently from that in 2.2.x: used +without the “-v” switch it only shows you the settings actually +written into! To see the complete +configuration used, add the “-v” parameter to testparm.

    Rapid Configuration Validation

    Should you need to troubleshoot at any stage, please always come back -to this point first and verify if "testparm" shows the parameters you -expect! To give you an example from personal experience as a warning, -try to just "comment out" the load printers" +to this point first and verify if testparm shows the parameters you +expect. To give you a warning from personal experience, +try to just comment out the load printers parameter. If your 2.2.x system behaves like mine, you'll see this: 

    -root# grep "load printers" /etc/samba/smb.conf
- #      load printers = Yes
- # This setting is commented ooouuuuut!!
+root# grep "load printers" /etc/samba/smb.conf
+        #  load printers = Yes
+        # This setting is commented out!!
  
-root# testparm -v /etc/samba/smb.conf | egrep "(load printers)"
+root# testparm -v /etc/samba/smb.conf | egrep "(load printers)"
         load printers = Yes
-

    -Despite my imagination that the commenting out of this setting should -prevent Samba from publishing my printers, it still did! Oh Boy -- it -cost me quite some time to find out the reason. But I am not fooled -any more... at least not by this ;-) +I assumed that commenting out of this setting should prevent Samba from +publishing my printers, but it still did. It took some time to figure out +the reason. But I am no longer fooled ... at least not by this. 

    -root# grep -A1 "load printers" /etc/samba/smb.conf
+root# grep -A1 "load printers" /etc/samba/smb.conf
         load printers = No
-        # This setting is what I mean!!
- #      load printers = Yes
-        # This setting is commented ooouuuuut!!
+        # The above setting is what I want!
+        #  load printers = Yes
+        # This setting is commented out!
 
-root# testparm -v smb.conf.simpleprinting | egrep "(load printers)"
+root# testparm -s -v smb.conf.simpleprinting | egrep "(load printers)"
         load printers = No

    -Only when setting the parameter explicitly to -"load printers = No" -would Samba recognize my intentions. So my strong advice is: -

    • Never rely on "commented out" parameters!

    • Always set it up explicitly as you intend it to +Only when the parameter is explicitly set to +load printers = No +would Samba conform with my intentions. So, my strong advice is: +

      • Never rely on commented out parameters.

      • Always set parameters explicitly as you intend them to behave.

      • Use testparm to uncover hidden -settings which might not reflect your intentions.

      -You can have a working Samba print configuration with this -minimal : +settings that might not reflect your intentions.

    +The following is the most minimal configuration file: 

     root# cat /etc/samba/smb.conf-minimal
         [printers]
-

    -This example should show you that you can use testparm to test any -filename for fitness as a Samba configuration. Actually, we want to -encourage you not to change your - on a working system (unless you know -exactly what you are doing)! Don't rely on an assumption that changes -will only take effect after you re-start smbd! This is not the -case. Samba re-reads its every 60 -seconds and on each new client connection. You might have to face -changes for your production clients that you didn't intend to apply at -this time! You will now note a few more interesting things. Let's now -ask testparm what the Samba print configuration -would be, if you used this minimalistic file as your real -: +This example should show that you can use testparm to test any Samba +configuration file. Actually, we encourage you not +to change your working system (unless you know exactly what you are +doing). Don't rely on the assumption that changes will only take effect after +you re-start smbd! This is not the case. Samba re-reads it every 60 seconds +and on each new client connection. You might have to face changes for your +production clients that you didn't intend to apply. You will now +note a few more interesting things; testparm is useful to +identify what the Samba print configuration would be if you used this minimalistic +configuration. Here is what you can expect to find: 

    -root# testparm -v smb.conf-minimal | egrep "(print|lpq|spool|driver|ports|[)"
- Processing section "[printers]"
+root# testparm -v smb.conf-minimal | egrep "(print|lpq|spool|driver|ports|[)"
+ Processing section "[printers]"
  WARNING: [printers] service MUST be printable!
  No path in service printers - using /tmp
 
@@ -272,675 +238,568 @@ would be, if you used this minimalistic file as your real
         lpq command = lpq -P%p
         printer name =
         use client driver = No
+
  [printers]
         printable = Yes

    -testparm issued 2 warnings: -

    • because we didn't specify the -[printers] section as printable, -and

    • because we didn't tell it which spool directory to -use.

    -However, this was not fatal, and samba will default to values that -will work here. Please, don't rely on this and don't use this -example! This was only meant to make you careful to design and specify -your setup to be what you really want it to be. The outcome on your -system may vary for some parameters, since you may have a Samba built -with a different compile-time configuration. -Warning: don't put a comment sign at -the end of a valid line. It -will cause the parameter to be ignored (just as if you had put the -comment sign at the front). At first I regarded this as a bug in my -Samba version(s). But the man page states: “Internal whitespace -in a parameter value is retained verbatim.” This means that a -line consisting of, for example, -

    # This defines LPRng as the printing system"
    printing = lprng

    -will regard the whole of the string after the "=" -sign as the value you want to define. And this is an invalid value -that will be ignored, and a default value used instead.] -

    Extended Sample Configuration to Print

    - In the extended BSD configuration example we show a more verbose example configuration for print related - settings in BSD-printing style environment . Below is a discussion -and explanation of the various parameters. We chose to use BSD-style -printing here, because we guess it is still the most commonly used -system on legacy Linux installations (new installs now predominantly -have CUPS, which is discussed entirely in the next chapter of this -document). Note, that this example explicitly names many parameters -which don't need to be specified because they are set by default. You -might be able to do with a leaner smb.conf file.

    Example 18.2. Extended configuration with BSD printing

    [global]
    printing = bsd
    load printers = yes
    show add printer wizard = yes
    printcap name = /etc/printcap
    printer admin = @ntadmin, root
    total print jobs = 100
    lpq cache time = 20
    use client driver = no
    [printers]
    comment = All Printers
    printable = yes
    path = /var/spool/samba
    browseable = no
    guest ok = yes
    public = yes
    read only = yes
    writable = no
    [my_printer_name]
    comment = Printer with Restricted Access
    path = /var/spool/samba_my_printer
    printer admin = kurt
    browseable = yes
    printable = yes
    writeable = no
    hosts allow = 0.0.0.0
    hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60
    guest ok = no

    -This also is only an example configuration. You -may not find all the settings in your own - (as pre-configured by your OS -vendor). Many configuration parameters, if not explicitly set to a -specific value, are used and set by Samba implicitly to its own -default, because these have been compiled in. To see all settings, let -root use the testparm -utility. testparm also gives warnings if you have -mis-configured certain things.. -

    Detailed Explanation of the Example's Settings

    -Following is a discussion of the settings from above shown example. -

    The [global] Section

    -The [global] section is one of 4 special +testparm issued two warnings: +

    • We did not specify the [printers] section as printable.

    • We did not tell Samba which spool directory to use.

    +However, this was not fatal and Samba will default to values that will +work. Please, do not rely on this and do not use this example. This was +included to encourage you to be careful to design and specify your setup to do +precisely what you require. The outcome on your system may vary for some +parameters given, since Samba may have been built with different compile-time +options. Warning: do not put a comment sign +at the end of a valid line. It will cause the parameter +to be ignored (just as if you had put the comment sign at the front). At first +I regarded this as a bug in my Samba versions. But the man page clearly says: +“Internal whitespace in a parameter value is retained verbatim.” +This means that a line consisting of, for example: +

    # This defines LPRng as the printing system
    printing = lprng

    +will regard the whole of the string after the +“=” sign as the value you want to +define. This is an invalid value that will be ignored and a default +value will be +used in its place. +

    Extended Printing Configuration

    +In we show a more verbose example configuration +for print-related settings in a BSD-style printing environment. What follows +is a discussion and explanation of the various parameters. We chose to +use BSD-style printing here because it is still the most commonly used +system on legacy UNIX/Linux installations. New installations predominantly +use CUPS, which is discussed in a separate chapter. explicitly +names many parameters that do not need to be specified because they are set +by default. You could use a much leaner smb.conf file. Alternately, you can use +testparm or SWAT to optimize the smb.conf +file to remove all parameters that are set at default. +

    Example 18.2. Extended BSD Printing Configuration

    [global]
    printing = bsd
    load printers = yes
    show add printer wizard = yes
    printcap name = /etc/printcap
    printer admin = @ntadmin, root
    total print jobs = 100
    lpq cache time = 20
    use client driver = no
    [printers]
    comment = All Printers
    printable = yes
    path = /var/spool/samba
    browseable = no
    guest ok = yes
    public = yes
    read only = yes
    writable = no
    [my_printer_name]
    comment = Printer with Restricted Access
    path = /var/spool/samba_my_printer
    printer admin = kurt
    browseable = yes
    printable = yes
    writeable = no
    hosts allow = 0.0.0.0
    hosts deny = turbo_xp, 10.160.50.23, 10.160.51.60
    guest ok = no

    +This is an example configuration. You may not find all the settings that are in +the confioguration file that was provided by the OS vendor. Samba configuration +parameters, if not explicitly set default to a sensible value. +To see all settings, as root use the testparm +utility. testparm gives warnings for misconfigured settings. +

    Detailed Explanation Settings

    +The following is a discussion of the settings from above shown example. +

    The [global] Section

    +The [global] section is one of four special sections (along with [[homes], -[printers] and -[print$]...) It contains all parameters which -apply to the server as a whole. It is the place for parameters which -have only a "global" meaning. It may also contain service level -parameters which then define default settings for all other -sections and shares. This way you can simplify the configuration and -avoid setting the same value repeatedly. (Within each individual -section or share you may however override these globally set "share -level" settings and specify other values). -

    printing = bsd

    this causes Samba to use default print commands -applicable for the BSD (a.k.a. RFC 1179 style or LPR/LPD) printing -system. In general, the "printing" parameter informs Samba about the -print subsystem it should expect. Samba supports CUPS, LPD, LPRNG, -SYSV, HPUX, AIX, QNX and PLP. Each of these systems defaults to a -different print command (and other queue control -commands).

    Caution

    The printing parameter is -normally a service level parameter. Since it is included here in the -[global] section, it will take effect for all -printer shares that are not defined differently. Samba 3 no longer -supports the SOFTQ printing system.

    load printers = yes

    this tells Samba to create automatically all -available printer shares. "Available" printer shares are discovered by -scanning the printcap file. All created printer shares are also loaded -for browsing. If you use this parameter, you do not need to specify -separate shares for each printer. Each automatically created printer -share will clone the configuration options found in the -[printers] section. (A load printers -= no setting will allow you to specify each UNIX printer -you want to share separately, leaving out some you don't want to be -publicly visible and available).

    show add printer wizard = yes

    this setting is normally -enabled by default (even if the parameter is not written into the -). It makes the Add Printer Wizard icon -show up in the Printers folder of the Samba host's -share listing (as shown in Network Neighbourhood or -by the net view command). To disable it, you need to -explicitly set it to no (commenting it out -will not suffice!). The Add Printer Wizard lets you upload printer -drivers to the [print$] share and associate it -with a printer (if the respective queue exists there before the -action), or exchange a printer's driver against any other previously -uploaded driver.

    total print jobs = 100

    this setting sets the upper limit to 100 print jobs -being active on the Samba server at any one time. Should a client -submit a job which exceeds this number, a “no more space -available on server” type of error message will be returned by -Samba to the client. A setting of "0" (the default) means there is -no limit at all! -

    printcap name = /etc/printcap

    this tells Samba where to look for a list of -available printer names. (If you use CUPS, make sure that a printcap -file is written: this is controlled by the "Printcap" directive of -cupsd.conf). -

    printer admin = @ntadmin

    members of the ntadmin group should be able to add -drivers and set printer properties ("ntadmin" is only an example name, -it needs to be a valid UNIX group name); root is implicitly always a -printer admin. The "@" sign precedes group names in -. A printer admin can do anything to -printers via the remote administration interfaces offered by MS-RPC -(see below). Note that the printer admin -parameter is normally a share level parameter, so you may associate -different groups to different printer shares in larger installations, -if you use the printer admin parameter on the -share levels). -

    lpq cache time = 20

    this controls the cache time for the results of the -lpq command. It prevents the lpq command being called too often and -reduces load on a heavily used print server. -

    use client driver = no

    if set to yes, this setting only -takes effect for Win NT/2k/XP clients (and not for Win 95/98/ME). Its -default value is No (or False). -It must not be enabled on print shares -(with a yes or true setting) which -have valid drivers installed on the Samba server! For more detailed -explanations see the man page of smb.conf. -

    The [printers] Section

    -This is the second special section. If a section with this name -appears in the smb.conf, users are able to -connect to any printer specified in the Samba host's printcap file, -because Samba on startup then creates a printer share for every -printername it finds in the printcap file. You could regard this -section as a general convenience shortcut to share all printers with -minimal configuration. It is also a container for settings which -should apply as default to all printers. (For more details see the -smb.conf man page.) Settings inside this -container must be share level parameters. -

    comment = All printers

    the comment is shown next to -the share if a client queries the server, either via Network -Neighbourhood or with the net view command to list -available shares. -

    printable = yes

    please note well, that the -[printers] service must be -declared as printable. If you specify otherwise, smbd will refuse to -load at startup. This parameter allows -connected clients to open, write to and submit spool files into the -directory specified with the path parameter for -this service. It is used by Samba to differentiate printer shares from -file shares.

    path = /var/spool/samba

    this must point to a directory used by Samba to spool -incoming print files. It must not be the same as the spool -directory specified in the configuration of your UNIX print -subsystem! The path would typically point to a directory -which is world writeable, with the "sticky" bit set to it. -

    browseable = no

    this is always set to no if -printable = yes. It makes the -[printer] share itself invisible in the -list of available shares in a net view command or -in the Explorer browse list. (Note that you will of course see the -individual printers). -

    guest ok = yes

    -if set to yes, then no password is required to -connect to the printers service. Access will be granted with the -privileges of the guest account. On many systems the -guest account will map to a user named "nobody". This user is in the UNIX -passwd file with an empty password, but with no valid UNIX login. -(Note: on some systems the guest account might not have the -privilege to be able to print. Test this by logging in as your -guest user using su - guest and run a system print -command like -

    lpr -P printername /etc/motd

    public = yes

    this is a synonym for guest ok = yes. Since we have guest ok = yes, -it really doesn't need to be here! (This leads to the interesting -question: “What, if I by accident have to contradictory settings -for the same share?” The answer is: the last one encountered by -Samba wins. The "winner" is shown by testparm. Testparm doesn't -complain about different settings of the same parameter for the same -share! You can test this by setting up multiple lines for the "guest -account" parameter with different usernames, and then run testparm to -see which one is actually used by Samba.) -

    read only = yes

    this normally (for other types of shares) prevents -users creating or modifying files in the service's directory. However, -in a "printable" service, it is always allowed to -write to the directory (if user privileges allow the connection), but -only via print spooling operations. "Normal" write operations are not -allowed.

    writeable = no

    -synonym for read only = yes -

    Any [my_printer_name] Section

    -If a section appears in the , which is -tagged as printable = yes, Samba presents it as -a printer share to its clients. Note, that Win95/98/ME clients may -have problems with connecting or loading printer drivers if the share -name has more than 8 characters! Also be very careful if you give a -printer the same name as an existing user or file share name: upon a -client's connection request to a certain sharename, Samba always tries -to find file shares with that name first; if it finds one, it will -connect to this and will never ultimately connect to a printer with -the same name! -

    comment = Printer with Restricted Access

    the comment says it all. -

    path = /var/spool/samba_my_printer

    here we set the spooling area for this printer to -another directory than the default. It is not a requirement to set it -differently, but the option is available. -

    printer admin = kurt

    the printer admin definition is different for this -explicitly defined printer share from the general -[printers] share. It is not a requirement; we -did it to show that it is possible if you want it. -

    browseable = yes

    we also made this printer browseable (so that the -clients may conveniently find it when browsing the Network -Neighbourhood). -

    printable = yes

    see explanation in last subsection. -

    writeable = no

    see explanation in last subsection. -

    hosts allow = 10.160.50.,10.160.51.

    here we exercise a certain degree of access control -by using the hosts allow and hosts deny parameters. Note, that -this is not by any means a safe bet. It is not a way to secure your -printers. This line accepts all clients from a certain subnet in a -first evaluation of access control -

    hosts deny = turbo_xp,10.160.50.23,10.160.51.60

    all listed hosts are not allowed here (even if they -belong to the "allowed subnets"). As you can see, you could name IP -addresses as well as NetBIOS hostnames -here. -

    guest ok = no

    this printer is not open for the guest account! -

    Print Commands

    -In each section defining a printer (or in the -[printers] section), a print -command parameter may be defined. It sets a command to -process the files which have been placed into the Samba print spool -directory for that printer. (That spool directory was, if you -remember, set up with the path -parameter). Typically, this command will submit the spool file to the -Samba host's print subsystem, using the suitable system print -command. But there is no requirement that this needs to be the -case. For debugging purposes or some other reason you may want to do -something completely different than "print" the file. An example is a -command that just copies the print file to a temporary location for -further investigation when you need to debug printing. If you craft -your own print commands (or even develop print command shell scripts), -make sure you pay attention to the need to remove the files from the -Samba spool directory. Otherwise your hard disk may soon suffer from -shortage of free space. -

    Default Print Commands for various UNIX Print Subsystems

    -You learned earlier on, that Samba in most cases uses its built-in -settings for many parameters if it can not find an explicitly stated -one in its configuration file. The same is true for the -print command. The default print command varies -depending on the printing parameter -setting. In the commands listed below, you will notice some parameters -of the form %X where X is -p, s, J etc. These letters stand for -"printername", "spoolfile" and "job ID" respectively. They are -explained in more detail further below. Here is an overview (excluding -the special case of CUPS, which is discussed in the next chapter): -

    If this setting is active......this is used in lieu of an explicit command:
    printing = bsd|aix|lprng|plpprint command is lpr -r -P%p %s
    printing = sysv|hpuxprint command is lp -c -P%p %s; rm %s
    printing = qnxprint command is lp -r -P%p -s %s
    printing = bsd|aix|lprng|plplpq command is lpq -P%p
    printing = sysv|hpuxlpq command is lpstat -o%p
    printing = qnxlpq command is lpq -P%p
    printing = bsd|aix|lprng|plplprm command is lprm -P%p %j
    printing = sysv|hpuxlprm command is cancel %p-%j
    printing = qnxlprm command is cancel %p-%j
    printing = bsd|aix|lprng|plplppause command is lp -i %p-%j -H hold
    printing = sysv|hpuxlppause command (...is empty)
    printing = qnxlppause command (...is empty)
    printing = bsd|aix|lprng|plplpresume command is lp -i %p-%j -H resume
    printing = sysv|hpuxlpresume command (...is empty)
    printing = qnxlpresume command (...is empty)

    -We excluded the special CUPS case here, because it is discussed in the -next chapter. Just a short summary. For printing = -CUPS: If SAMBA is compiled against libcups, it uses the -CUPS API to submit jobs, etc. (It is a good idea also to set -printcap = cups in case your -cupsd.conf is set to write its autogenerated -printcap file to an unusual place). Otherwise Samba maps to the System -V printing commands with the -oraw option for printing, i.e. it uses -lp -c -d%p -oraw; rm %s With printing = -cups , and if SAMBA is compiled against libcups, any -manually set print command will be ignored! -

    -Having listed the above mappings here, you should note that there used -to be a bug in recent 2.2.x versions which -prevented the mapping from taking effect. It lead to the -"bsd|aix|lprng|plp" settings taking effect for all other systems, for -the most important commands (the print command, the -lpq command and the lprm -command). The lppause command and the -lpresume command remained empty. Of course, these -commands worked on bsd|aix|lprng|plp but they didn't work on -sysv|hpux|qnx systems. To work around this bug, you need to -explicitly set the commands. Use testparm -v to -check which command takes effect. Then check that this command is -adequate and actually works for your installed print subsystem. It is -always a good idea to explicitly set up your configuration files the -way you want them to work and not rely on any built-in defaults. -

    Setting up your own Print Commands

    -After a print job has finished spooling to a service, the -print command will be used by Samba via a -system() call to process the spool file. Usually -the command specified will submit the spool file to the host's -printing subsystem. But there is no requirement at all that this must -be the case. The print subsystem will probably not remove the spool -file on its own. So whatever command you specify on your own you -should ensure that the spool file is deleted after it has been -processed. +[printers] +and [print$]...). The +[global] contains all parameters which apply +to the server as a whole. It is the place for parameters that have only a +global meaning. It may also contain service level parameters that then define +default settings for all other sections and shares. This way you can simplify +the configuration and avoid setting the same value repeatedly. (Within each +individual section or share you may, however, override these globally set +share settings and specify other values). +

    printing = bsd

    Causes Samba to use default print commands + applicable for the BSD (also known as RFC 1179 style or LPR/LPD) printing + system. In general, the printing parameter informs Samba about the + print subsystem it should expect. Samba supports CUPS, LPD, LPRNG, + SYSV, HPUX, AIX, QNX, and PLP. Each of these systems defaults to a + different print command (and other queue control + commands).

    Caution

    The printing parameter is + normally a service level parameter. Since it is included here in the + [global] section, it will take effect for all + printer shares that are not defined differently. Samba-3 no longer + supports the SOFTQ printing system.

    load printers = yes

    Tells Samba to create automatically all + available printer shares. Available printer shares are discovered by + scanning the printcap file. All created printer shares are also loaded + for browsing. If you use this parameter, you do not need to specify + separate shares for each printer. Each automatically created printer + share will clone the configuration options found in the + [printers] section. (The load printers + = no setting will allow you to specify each UNIX printer + you want to share separately, leaving out some you do not want to be + publicly visible and available).

    show add printer wizard = yes

    Setting is normally enabled by default (even if the parameter is not specified in smb.conf). + It causes the Add Printer Wizard icon to appear + in the Printers folder of the Samba host's + share listing (as shown in Network Neighborhood or + by the net view command). To disable it, you need to + explicitly set it to no (commenting it out + will not suffice). The Add Printer Wizard lets you upload printer + drivers to the [print$] share and associate it + with a printer (if the respective queue exists before the + action), or exchange a printer's driver against any other previously + uploaded driver.

    total print jobs = 100

    Sets the upper limit to 100 print jobs + being active on the Samba server at any one time. Should a client + submit a job that exceeds this number, a “no more space + available on server” type of error message will be returned by + Samba to the client. A setting of zero (the default) means there is + no limit at all. +

    printcap name = /etc/printcap

    Tells Samba where to look for a list of + available printer names. Where CUPS is used, make sure that a printcap + file is written. This is controlled by the Printcap directive in the + cupsd.conf file. +

    printer admin = @ntadmin

    Members of the ntadmin group should be able to add + drivers and set printer properties (ntadmin is only an example name, + it needs to be a valid UNIX group name); root is implicitly always a + printer admin. The @ sign precedes group names in the + /etc/group. A printer admin can do anything to + printers via the remote administration interfaces offered by MS-RPC + (see below). In larger installations, the printer admin + parameter is normally a per-share parameter. This permits different groups to administer each printer share. +

    lpq cache time = 20

    Controls the cache time for the results of the + lpq command. It prevents the lpq command being called too often and + reduces the load on a heavily used print server. +

    use client driver = no

    If set to yes, only + takes effect for Windows NT/200x/XP clients (and not for Win 95/98/ME). Its + default value is No (or False). + It must not be enabled on print shares + (with a yes or true setting) that + have valid drivers installed on the Samba server. For more detailed + explanations see the smb.conf man page. +

    The [printers] Section

    +This is the second special section. If a section with this name appears in +the smb.conf, users are able to connect to any printer specified in the +Samba host's printcap file, because Samba on startup then creates a printer +share for every printername it finds in the printcap file. You could regard +this section as a general convenience shortcut to share all printers with +minimal configuration. It is also a container for settings that should +apply as default to all printers. (For more details see the smb.conf +man page.) Settings inside this container must be Share Level parameters. +

    comment = All printers

    + The comment is shown next to the share if + a client queries the server, either via Network Neighborhood or with + the net view command to list available shares. +

    printable = yes

    + The [printers] service must + be declared as printable. If you specify otherwise, smbd will refuse to load at + startup. This parameter allows connected clients to open, write to and submit spool files + into the directory specified with the path + parameter for this service. It is used by Samba to differentiate printer shares from + file shares. +

    path = /var/spool/samba

    + Must point to a directory used by Samba to spool incoming print files. It + must not be the same as the spool directory specified in the configuration of your UNIX + print subsystem! The path typically points to a directory that is world + writeable, with the “sticky” bit set to it. +

    browseable = no

    + Is always set to no if + printable = yes. It makes + the [printer] share itself invisible in the list of + available shares in a net view command or in the Explorer browse + list. (You will of course see the individual printers). +

    guest ok = yes

    + If this parameter is set to yes, no password is required to + connect to the printer's service. Access will be granted with the privileges of the + guest account. On many systems the guest + account will map to a user named “nobody”. This user will usually be found + in the UNIX passwd file with an empty password, but with no valid UNIX login. (On some + systems the guest account might not have the privilege to be able to print. Test this + by logging in as your guest user using su - guest and run a system + print command like: +

    + lpr -P printername /etc/motd +

    public = yes

    + Is a synonym for guest ok = yes. + Since we have guest ok = yes, it + really does not need to be here. (This leads to the interesting question: “What if I + by accident have two contradictory settings for the same share?” The answer is the + last one encountered by Samba wins. Testparm does not complain about different settings + of the same parameter for the same share. You can test this by setting up multiple + lines for the guest account parameter with different usernames, + and then run testparm to see which one is actually used by Samba.) +

    read only = yes

    + Normally (for other types of shares) prevents users from creating or modifying files + in the service's directory. However, in a “printable” service, it is + always allowed to write to the directory (if user privileges allow the + connection), but only via print spooling operations. Normal write operations are not permitted. +

    writeable = no

    + Is a synonym for read only = yes. +

    Any [my_printer_name] Section

    +If a section appears in the smb.conf file, which when given the parameter +printable = yes causes Samba to configure it +as a printer share. Windows 9x/Me clients may have problems with connecting or loading printer drivers +if the share name has more than eight characters. Do not name a printer share with a name that may conflict +with an existing user or file share name. On Client connection requests, Samba always tries to find file +shares with that name first. If it finds one, it will connect to this and will not connect +to a printer with the same name! +

    comment = Printer with Restricted Access

    + The comment says it all. +

    path = /var/spool/samba_my_printer

    + Sets the spooling area for this printer to a directory other than the default. It is not + necessary to set it differently, but the option is available. +

    printer admin = kurt

    + The printer admin definition is different for this explicitly defined printer share from the general + [printers] share. It is not a requirement; we + did it to show that it is possible. +

    browseable = yes

    + This makes the printer browseable so the clients may conveniently find it when browsing the + Network Neighborhood. +

    printable = yes

    + See . +

    writeable = no

    + See . +

    hosts allow = 10.160.50.,10.160.51.

    + Here we exercise a certain degree of access control by using the hosts allow and hosts deny + parameters. This is not by any means a safe bet. It is not a way to secure your + printers. This line accepts all clients from a certain subnet in a first evaluation of + access control. +

    hosts deny = turbo_xp,10.160.50.23,10.160.51.60

    + All listed hosts are not allowed here (even if they belong to the allowed subnets). As + you can see, you could name IP addresses as well as NetBIOS hostnames here. +

    guest ok = no

    + This printer is not open for the guest account. +

    Print Commands

    +In each section defining a printer (or in the [printers] section), +a print command parameter may be defined. It sets a command to process the files +that have been placed into the Samba print spool directory for that printer. (That spool directory was, +if you remember, set up with the path parameter). Typically, +this command will submit the spool file to the Samba host's print subsystem, using the suitable system +print command. But there is no requirement that this needs to be the case. For debugging or +some other reason, you may want to do something completely different than print the file. An example is a +command that just copies the print file to a temporary location for further investigation when you need +to debug printing. If you craft your own print commands (or even develop print command shell scripts), +make sure you pay attention to the need to remove the files from the Samba spool directory. Otherwise, +your hard disk may soon suffer from shortage of free space. +

    Default UNIX System Printing Commands

    +You learned earlier on that Samba, in most cases, uses its built-in settings for many parameters +if it cannot find an explicitly stated one in its configuration file. The same is true for the +print command. The default print command varies depending +on the printing parameter setting. In the commands listed +below, you will notice some parameters of the form %X where X is +p, s, J, and so on. These letters stand for printer name, spoolfile and job ID, respectively. +They are explained in more detail further below. presents an overview of key +printing options but excludes the special case of CUPS that is discussed in . +

    Table 18.1. Default Printing Settings

    SettingDefault Printing Commands
    printing = bsd|aix|lprng|plpprint command is lpr -r -P%p %s
    printing = sysv|hpuxprint command is lp -c -P%p %s; rm %s
    printing = qnxprint command is lp -r -P%p -s %s
    printing = bsd|aix|lprng|plplpq command is lpq -P%p
    printing = sysv|hpuxlpq command is lpstat -o%p
    printing = qnxlpq command is lpq -P%p
    printing = bsd|aix|lprng|plplprm command is lprm -P%p %j
    printing = sysv|hpuxlprm command is cancel %p-%j
    printing = qnxlprm command is cancel %p-%j
    printing = bsd|aix|lprng|plplppause command is lp -i %p-%j -H hold
    printing = sysv|hpuxlppause command (...is empty)
    printing = qnxlppause command (...is empty)
    printing = bsd|aix|lprng|plplpresume command is lp -i %p-%j -H resume
    printing = sysv|hpuxlpresume command (...is empty)
    printing = qnxlpresume command (...is empty)

    +We excluded the special case of CUPS here, because it is discussed in the next chapter. For +printing = CUPS, if Samba is compiled against libcups, it uses the CUPS API to submit +jobs. (It is a good idea also to set printcap = cups +in case your cupsd.conf is set to write its autogenerated printcap file to an +unusual place). Otherwise, Samba maps to the System V printing commands with the -oraw option for printing, +i.e., it uses lp -c -d%p -oraw; rm %s. With printing = cups, +and if Samba is compiled against libcups, any manually set print command will be ignored! +

    Custom Print Commands

    +After a print job has finished spooling to a service, the print command + will be used by Samba via a system() call to process the +spool file. Usually the command specified will submit the spool file to the host's printing subsystem. But +there is no requirement at all that this must be the case. The print subsystem may not remove the spool +file on its own. So whatever command you specify, you should ensure that the spool file is deleted after +it has been processed.

    -There is no difficulty with using your own customized print commands -with the traditional printing systems. However, if you don't wish to -"roll your own", you should be well informed about the default -built-in commands that Samba uses for each printing subsystem (see the -table above). In all the commands listed in the last paragraphs you -see parameters of the form %X These are -macros, or shortcuts, used as place holders for -the names of real objects. At the time of running a command with such -a placeholder, Samba will insert the appropriate value -automatically. Print commands can handle all Samba macro -substitutions. In regard to printing, the following ones do have +There is no difficulty with using your own customized print commands with the traditional printing +systems. However, if you do not wish to roll your own, you should be well informed about the default +built-in commands that Samba uses for each printing subsystem (see +Table 17.1). In all the +commands listed in the last paragraphs, you see parameters of the form %X. These are +macros, or shortcuts, used as placeholders for the names of real objects. At the time +of running a command with such a placeholder, Samba will insert the appropriate value automatically. Print +commands can handle all Samba macro substitutions. In regard to printing, the following ones do have special relevance: -

    • %s, %f - the path to the spool -file name

    • %p - the appropriate printer -name

    • %J - the job name as -transmitted by the client.

    • %c - the number of printed -pages of the spooled job (if known).

    • %z - the size of the spooled -print job (in bytes)

    -The print command MUST contain at least one occurrence of -%s or %f. -- The -%p is optional. If no printer name is supplied, -the %p will be silently removed from the print -command. In this case the job is sent to the default printer. +

    • %s, %f the path to the spool file name.

    • %p the appropriate printer name.

    • %J the job name as transmitted by the client.

    • %c the number of printed pages of the spooled job (if known).

    • %z the size of the spooled print job (in bytes).

    +The print command must contain at least one occurrence of %s or +the %f. The %p is optional. If no printer name is supplied, +the %p will be silently removed from the print command. In this case, the job is +sent to the default printer.

    -If specified in the [global] section, the print -command given will be used for any printable service that does not -have its own print command specified. If there is neither a specified -print command for a printable service nor a global print command, -spool files will be created but not processed! And (most importantly): -print files will not be removed, so they will start filling your Samba -hard disk. +If specified in the [global] section, the print command given will be +used for any printable service that does not have its own print command specified. If there is neither a +specified print command for a printable service nor a global print command, spool files will be created +but not processed! Most importantly, print files will not be removed, so they will consume disk space.

    -Note that printing may fail on some UNIXes from the "nobody" -account. If this happens, create an alternative guest account and -supply it with the privilege to print. Set up this guest account in -the [global] section with the guest -account parameter. +Printing may fail on some UNIX systems when using the “nobody” account. If this happens, create an +alternative guest account and give it the privilege to print. Set up this guest account in the +[global] section with the guest account parameter.

    -You can form quite complex print commands. You need to realize that -print commands are just passed to a UNIX shell. The shell is able to -expand the included environment variables as usual. (The syntax to -include a UNIX environment variable $variable -in or in the Samba print command is -%$variable.) To give you a working -print command example, the following will log a -print job to /tmp/print.log, print the file, then -remove it. Note that ';' is the usual separator for commands in shell -scripts: +You can form quite complex print commands. You need to realize that print commands are just +passed to a UNIX shell. The shell is able to expand the included environment variables as +usual. (The syntax to include a UNIX environment variable $variable +in the Samba print command is %$variable.) To give you a working +print command example, the following will log a print job +to /tmp/print.log, print the file, then remove it. The semicolon (“;” +is the usual separator for commands in shell scripts:

    print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s

    -You may have to vary your own command considerably from this example -depending on how you normally print files on your system. The default -for the print command parameter varies depending on the setting of -the printing parameter. Another example is: -

    print command = /usr/local/samba/bin/myprintscript %p %s

    Innovations in Samba Printing since 2.2

    -Before version 2.2.0, Samba's print server support for Windows clients -was limited to the level of LanMan printing -calls. This is the same protocol level as Windows 9x PCs offer when -they share printers. Beginning with the 2.2.0 release, Samba started -to support the native Windows NT printing mechanisms. These are -implemented via MS-RPC (RPC = Remote -Procedure Calls ). MS-RPCs use the -SPOOLSS named pipe for all printing. +You may have to vary your own command considerably from this example depending on how you normally print +files on your system. The default for the print command +parameter varies depending on the setting of the printing +parameter. Another example is: +

    print command = /usr/local/samba/bin/myprintscript %p %s

    Printing Developments Since Samba-2.2

    +Prior to Samba-2.2.x, print server support for Windows clients was limited to LanMan +printing calls. This is the same protocol level as Windows 9x/Me PCs offer when they share printers. +Beginning with the 2.2.0 release, Samba started to support the native Windows NT printing mechanisms. These +are implemented via MS-RPC (RPC = Remote Procedure Calls +). MS-RPCs use the SPOOLSS named pipe for all printing.

    The additional functionality provided by the new SPOOLSS support includes: -

    • Support for downloading printer driver files to Windows -95/98/NT/2000 clients upon demand (Point'n'Print); -

    • Uploading of printer drivers via the Windows NT -Add Printer Wizard (APW) or the -Imprints tool set. -

    • Support for the native MS-RPC printing calls such as - StartDocPrinter, EnumJobs(), etc... (See the MSDN documentation for more information on the Win32 printing API);

    • Support for NT Access Control -Lists (ACL) on printer objects;

    • Improved support for printer queue manipulation -through the use of internal databases for spooled job information -(implemented by various *.tdb -files).

    -One other benefit of an update is this: Samba 3 is able to publish -all its printers in Active Directory (or LDAP)! +

    • + Support for downloading printer driver files to Windows 95/98/NT/2000 clients upon + demand (Point'n'Print). +

    • + Uploading of printer drivers via the Windows NT Add Printer Wizard (APW) + or the Imprints tool set. +

    • + Support for the native MS-RPC printing calls such as + StartDocPrinter, EnumJobs(), and so on. (See the + MSDN documentation for more information on the + Win32 printing API). +

    • + Support for NT Access Control Lists (ACL) on printer objects. +

    • + Improved support for printer queue manipulation through the use of internal databases for spooled + job information (implemented by various *.tdb files). +

    +A benefit of updating is that Samba-3 is able to publish its printers to Active Directory (or LDAP). +

    +A fundamental difference exists between MS Windows NT print servers and Samba operation. Windows NT +permits the installation of local printers that are not shared. This is an artifact of the fact that +any Windows NT machine (server or client) may be used by a user as a workstation. Samba will publish all +printers that are made available, either by default or by specific declaration via printer-specific shares.

    -One slight difference is here: it is possible on a Windows NT print -server to have printers listed in the Printers folder which are -not shared. Samba does not make this -distinction. By definition, the only printers of which Samba is aware -are those which are specified as shares in -. The reason is that Windows NT/200x/XP Professional -clients do not normally need to use the standard SMB printer share; -rather they can print directly to any printer on another Windows NT -host using MS-RPC. This of course assumes that the printing client has -the necessary privileges on the remote host serving the printer. The -default permissions assigned by Windows NT to a printer gives the -"Print" permissions to the well-known Everyone -group. (The older clients of type Win9x can only print to "shared" +Windows NT/200x/XP Professional clients do not have to use the standard SMB printer share; they can +print directly to any printer on another Windows NT host using MS-RPC. This, of course, assumes that +the client has the necessary privileges on the remote host that serves the printer resource. The +default permissions assigned by Windows NT to a printer gives the Print permissions to the well-known +Everyone group. (The older clients of type Windows 9x/Me can only print to shared printers). -

    Client Drivers on Samba Server for Point'n'Print

    -There is still confusion about what all this means: Is it or -is it not a requirement for printer drivers to be installed on a Samba -host in order to support printing from Windows clients? The -answer to this is: No, it is not a -requirement. Windows NT/2000 clients can, of -course, also run their APW to install drivers -locally (which then connect to a Samba served -print queue). This is the same method as used by Windows 9x -clients. (However, a bug existed in Samba 2.2.0 -which made Windows NT/2000 clients require that the Samba server -possess a valid driver for the printer. This was fixed in Samba -2.2.1). +

    Point'n'Print Client Drivers on Samba Servers

    +There is much confusion about what all this means. The question is often asked, “Is it or is +it not necessary for printer drivers to be installed on a Samba host in order to support printing from +Windows clients?” The answer to this is no, it is not necessary. +

    +Windows NT/2000 clients can, of course, also run their APW to install drivers locally +(which then connect to a Samba-served print queue). This is the same method used by Windows 9x/Me +clients. (However, a bug existed in Samba 2.2.0 that made Windows NT/2000 clients +require that the Samba server possess a valid driver for the printer. This was fixed in Samba 2.2.1). +

    +But it is a new capability to install the printer drivers into the [print$] +share of the Samba server, and a big convenience, too. Then all clients +(including 95/98/ME) get the driver installed when they first connect to this printer share. The +uploading or depositing of the driver into this +[print$] share and the following binding of this driver to an existing +Samba printer share can be achieved by different means: +

    • + Running the APW on an NT/200x/XP Professional client (this does not work from 95/98/ME clients). +

    • + Using the Imprints toolset. +

    • + Using the smbclient and rpcclient commandline tools. +

    • + Using cupsaddsmb (only works for the CUPS + printing system, not for LPR/LPD, LPRng, and so on). +

    +Samba does not use these uploaded drivers in any way to process spooled files. These drivers are utilized +entirely by the clients who download and install them via the “Point'n'Print” mechanism +supported by Samba. The clients use these drivers to generate print files in the format the printer +(or the UNIX print system) requires. Print files received by Samba are handed over to the UNIX printing +system, which is responsible for all further processing, as needed. +

    The Obsoleted [printer$] Section

    + Versions of Samba prior to 2.2 made it possible to use a share named + [printer$]. This name was taken from the same named service created by + Windows 9x/Me clients when a printer was shared by them. Windows 9x/Me printer servers always + have a [printer$] service that provides read-only access (with + no password required) to support printer driver downloads. However, Samba's initial + implementation allowed for a parameter named printer driver location to + be used on a per share basis. This specified the location of the driver files associated with + that printer. Another parameter named printer driver provided a means of + defining the printer driver name to be sent to the client. +

    + These parameters, including the printer driver file parameter, + are now removed and cannot be used in installations of Samba-3. The share name + [print$] is now used for the location of downloadable printer + drivers. It is taken from the [print$] service created + by Windows NT PCs when a printer is shared by them. Windows NT print servers always have a + [print$] service that provides read-write access (in the context + of its ACLs) to support printer driver downloads and uploads. This does not mean Windows + 9x/Me clients are now thrown aside. They can use Samba's [print$] + share support just fine. +

    Creating the [print$] Share

    +In order to support the uploading and downloading of printer driver files, you must first configure a +file share named [print$]. The public name of this share is hard coded +in the MS Windows clients. It cannot be renamed since Windows clients are programmed to search for a +service of exactly this name if they want to retrieve printer driver files. +

    +You should modify the server's file to add the global parameters and create the +[print$] file share (of course, some of the parameter values, such +as path are arbitrary and should be replaced with appropriate values for your +site). See .

    -But it is a new option to install the printer -drivers into the [print$] share of the Samba -server, and a big convenience too. Then all -clients (including 95/98/ME) get the driver installed when they first -connect to this printer share. The uploading or -depositing of the driver into this -[print$] share, and the following binding of -this driver to an existing Samba printer share can be achieved by -different means: -

    • running the APW on an -NT/200x/XP Professional client (this doesn't work from 95/98/ME -clients);

    • using the Imprints -toolset;

    • using the smbclient and -rpcclient commandline tools;

    • using cupsaddsmb(only works for -the CUPS printing system, not for LPR/LPD, LPRng -etc.).

    -Please take additional note of the following fact: Samba -does not use these uploaded drivers in any way to process spooled -files. Drivers are utilized entirely by the clients, who -download and install them via the "Point'n'Print" mechanism supported -by Samba. The clients use these drivers to generate print files in the -format the printer (or the UNIX print system) requires. Print files -received by Samba are handed over to the UNIX printing system, which -is responsible for all further processing, if needed. -

    The [printer$] Section is removed from Samba 3

    -[print$] vs. [printer$] -.  -Versions of Samba prior to 2.2 made it possible to use a share -named [printer$]. This name was taken from the -same named service created by Windows 9x clients when a printer was -shared by them. Windows 9x printer servers always have a -[printer$] service which provides read-only -access (with no password required) in order to support printer driver -downloads. However, Samba's initial implementation allowed for a -parameter named printer driver location to be -used on a per share basis. This specified the location of the driver -files associated with that printer. Another parameter named -printer driver provided a means of defining the -printer driver name to be sent to the client. These parameters, -including the printer driver file parameter, -are now removed and can not be used in installations of samba-3. -Now the share name [print$] is used for the -location of downloadable printer drivers. It is taken from the -[print$] service created by Windows NT PCs when -a printer is shared by them. Windows NT print servers always have a -[print$] service which provides read-write -access (in the context of its ACLs) in order to support printer driver -down- and uploads. Don't fear -- this does not mean Windows 9x -clients are thrown aside now. They can use Samba's -[print$] share support just fine. -

    Creating the [print$] Share

    -In order to support the up- and downloading of printer driver files, -you must first configure a file share named -[print$]. The "public" name of this share is -hard coded in Samba's internals (because it is hard coded in the MS -Windows clients too). It cannot be renamed since Windows clients are -programmed to search for a service of exactly this name if they want -to retrieve printer driver files. +

    Example 18.3. [print\$] example

    [global]
    # members of the ntadmin group should be able to add drivers and set
    # printer properties. root is implicitly always a 'printer admin'.
    printer admin = @ntadmin
    ...
    [printers]
    ...
    [print$]
    comment = Printer Driver Download Area
    path = /etc/samba/drivers
    browseable = yes
    guest ok = yes
    read only = yes
    write list = @ntadmin, root

    -You should modify the server's file to -add the global parameters and create the -[print$] file share (of course, some of the -parameter values, such as 'path' are arbitrary and should be replaced -with appropriate values for your site): -

    Example 18.3. [print\$] example

    [global]
    # members of the ntadmin group should be able to add drivers and set
    # printer properties. root is implicitly always a 'printer admin'.
    printer admin = @ntadmin
    ...
    [printers]
    ...
    [print$]
    comment = Printer Driver Download Area
    path = /etc/samba/drivers
    browseable = yes
    guest ok = yes
    read only = yes
    write list = @ntadmin, root

    Of course, you also need to ensure that the directory named by the -path parameter exists on the UNIX file system. -

    Parameters in the [print$] Section

    -[print$] is a special section in -. It contains settings relevant to -potential printer driver download and local installation by clients. -

    comment = Printer Driver - Download Area

    the comment appears next to the share name if it is -listed in a share list (usually Windows clients won't see it often but -it will also appear up in a smbclient -L sambaserver - output).

    path = /etc/samba/printers

    this is the path to the location of the Windows -driver file deposit from the UNIX point of -view.

    browseable = no

    this makes the [print$] share -"invisible" in Network Neighbourhood to clients. However, you can -still "mount" it from any client using the net use -g:\\sambaserver\print$ command in a "DOS box" or the -"Connect network drive" menu from Windows -Explorer.

    guest ok = yes

    this gives read only access to this share for all -guest users. Access may be used to download and install printer -drivers on clients. The requirement for guest ok = -yes depends upon how your site is configured. If users -will be guaranteed to have an account on the Samba host, then this is -a non-issue.

    Note

    -The non-issue is this: if all your Windows NT users are guaranteed to -be authenticated by the Samba server (for example if Samba -authenticates via an NT domain server and the NT user has already been -validated by the Domain Controller in order to logon to the Windows NT -session), then guest access is not necessary. Of course, in a -workgroup environment where you just want to be able to print without -worrying about silly accounts and security, then configure the share -for guest access. You'll probably want to add map to guest = Bad User in the -[global] section -as well. Make sure you understand what this parameter does before -using it. -

    read only = yes

    as we don't want everybody to upload driver files (or -even change driver settings) we tagged this share as not -writeable.

    write list = @ntadmin,root

    since the [print$] was made -read only by the previous setting, we need to create a "write list" -also. UNIX groups (denoted with a leading "@" character) and users -listed here are allowed write access (as an exception to the general -public's "read-only" access), which they need to update files on the -share. Normally you will want to only name administrative level user -accounts in this setting. Check the file system permissions to make -sure these accounts can copy files to the share. If this is a non-root -account, then the account should also be mentioned in the global -printer admin parameter. See the - man page for more information on -configuring file shares.

    Subdirectory Structure in [print$]

    -In order for a Windows NT print server to support the downloading of -driver files by multiple client architectures, you must create several -subdirectories within the [print$] service -(i.e. the UNIX directory named by the path -parameter). These correspond to each of the supported client -architectures. Samba follows this model as well. Just like the name of -the [print$] share itself, the subdirectories -*must* be exactly the names listed below (you may leave out the -subdirectories of architectures you don't want to support). +path parameter exists on the UNIX file system. +

    [print$] Section Parameters

    +The [print$] is a special section in smb.conf. It contains settings relevant to +potential printer driver download and is used by windows clients for local print driver installation. +The following parameters are frequently needed in this share section: +

    comment = Printer Driver Download Area

    + The comment appears next to the share name if it is listed in a share list (usually Windows + clients will not see it, but it will also appear up in a smbclient -L sambaserver + output). +

    path = /etc/samba/printers

    + Is the path to the location of the Windows driver file deposit from the UNIX point of view. +

    browseable = no

    + Makes the [print$] share invisible to clients from the + Network Neighborhood. However, you can still mount it from any client + using the net use g:\\sambaserver\print$ command in a DOS-box or the + Connect network drive menu> from Windows Explorer. +

    guest ok = yes

    + Gives read-only access to this share for all guest users. Access may be granted to + download and install printer drivers on clients. The requirement for guest ok + = yes depends on how your site is configured. If users will be guaranteed + to have an account on the Samba host, then this is a non-issue. +

    Note

    + If all your Windows NT users are guaranteed to be authenticated by the Samba server + (for example, if Samba authenticates via an NT domain server and the user has already been + validated by the Domain Controller in order to logon to the Windows NT session), then guest + access is not necessary. Of course, in a workgroup environment where you just want + to print without worrying about silly accounts and security, then configure the share for + guest access. You should consider adding map to guest = Bad + User in the [global] section + as well. Make sure you understand what this parameter does before using it. +

    read only = yes

    + Because we do not want everybody to upload driver files (or even change driver settings), + we tagged this share as not writeable. +

    write list = @ntadmin, root

    + The [print$] was made read-only by the previous + setting so we should create a write list entry also. UNIX + groups (denoted with a leading “@” character). Users listed here are allowed + write-access (as an exception to the general public's read-only access), which they need to + update files on the share. Normally, you will want to only name administrative-level user + account in this setting. Check the file system permissions to make sure these accounts + can copy files to the share. If this is a non-root account, then the account should also + be mentioned in the global printer admin + parameter. See the smb.conf man page for more information on configuring file shares. +

    The [print$] Share Directory

    +In order for a Windows NT print server to support the downloading of driver files by multiple client +architectures, you must create several subdirectories within the [print$] +service (i.e., the UNIX directory named by the path +parameter). These correspond to each of the supported client architectures. Samba follows this model as +well. Just like the name of the [print$] share itself, the subdirectories +must be exactly the names listed below (you may leave out the subdirectories of architectures you do +not need to support).

    Therefore, create a directory tree below the [print$] share for each architecture you wish -to support. +to support like this: 

    -[print$]--+--
-          |--W32X86           # serves drivers to "Windows NT x86"
-          |--WIN40            # serves drivers to "Windows 95/98"
-          |--W32ALPHA         # serves drivers to "Windows NT Alpha_AXP"
-          |--W32MIPS          # serves drivers to "Windows NT R4000"
-          |--W32PPC           # serves drivers to "Windows NT PowerPC"
-

    Required permissions

    -In order to add a new driver to your Samba host, one of two conditions -must hold true: -

    • The account used to connect to the Samba host must -have a UID of 0 (i.e. a root account)

    • The account used to connect to the Samba host must be -named in the printer adminlist.

    -Of course, the connected account must still possess access to add -files to the subdirectories beneath -[print$]. Remember that all file shares are set -to 'read only' by default. -

    -Once you have created the required [print$] -service and associated subdirectories, go to a Windows NT 4.0/2k/XP -client workstation. Open Network Neighbourhood or -My Network Places and browse for the Samba host. -Once you have located the server, navigate to its Printers and -Faxes folder. You should see an initial listing of printers -that matches the printer shares defined on your Samba host. -

    Installing Drivers into [print$]

    -You have successfully created the [print$] -share in ? And Samba has re-read its -configuration? Good. But you are not yet ready to take off. The -driver files need to be present in this share, -too! So far it is still an empty share. Unfortunately, it is not enough -to just copy the driver files over. They need to be set -up too. And that is a bit tricky, to say the least. We -will now discuss two alternative ways to install the drivers into -[print$]: -

    • using the Samba commandline utility -rpcclient with its various subcommands (here: -adddriver and setdriver) from -any UNIX workstation;

    • running a GUI (Printer -Properties and Add Printer Wizard) -from any Windows NT/2k/XP client workstation.

    -The latter option is probably the easier one (even if the only -entrance to this realm seems a little bit weird at first). -

    Setting Drivers for existing Printers with a Client GUI

    -The initial listing of printers in the Samba host's -Printers folder accessed from a client's Explorer -will have no real printer driver assigned to them. By default -this driver name is set to a NULL -string. This must be changed now. The local Add Printer -Wizard, run from NT/2000/XP clients, will help us in this -task. +[print$]--+ + |--W32X86 # serves drivers to Windows NT x86 + |--WIN40 # serves drivers to Windows 95/98 + |--W32ALPHA # serves drivers to Windows NT Alpha_AXP + |--W32MIPS # serves drivers to Windows NT R4000 + |--W32PPC # serves drivers to Windows NT PowerPC +

    +

    Required permissions

    + In order to add a new driver to your Samba host, one of two conditions must hold true: +

    • + The account used to connect to the Samba host must have a UID of 0 (i.e., a root account). +

    • + The account used to connect to the Samba host must be named in the printer adminlist. +

    + Of course, the connected account must still have write access to add files to the subdirectories beneath + [print$]. Remember that all file shares are set to “read-only” by default. +

    +Once you have created the required [print$] service and +associated subdirectories, go to a Windows NT 4.0/200x/XP client workstation. Open Network +Neighborhood or My Network Places and browse for the Samba host. Once you +have located the server, navigate to its Printers and Faxes folder. You should see +an initial listing of printers that matches the printer shares defined on your Samba host. +

    Installing Drivers into [print$]

    +Have you successfully created the [print$] share in smb.conf, and have your forced Samba +to re-read its smb.conf file? Good. But you are not yet ready to use the new facility. The client driver +files need to be installed into this share. So far it is still an empty share. Unfortunately, it is +not enough to just copy the driver files over. They need to be +correctly installed so that appropriate +records for each driver will exist in the Samba internal databases so it can provide the correct +drivers as they are requested from MS Windows clients. And that is a bit tricky, to say the least. We +now discuss two alternative ways to install the drivers into [print$]: +

    • + Using the Samba commandline utility rpcclient with its various subcommands (here: + adddriver and setdriver) from any UNIX workstation. +

    • + Running a GUI (Printer Properties and Add Printer Wizard) + from any Windows NT/200x/XP client workstation. +

    +The latter option is probably the easier one (even if the process may seem a little bit weird at first). +

    Add Printer Wizard Driver Installation

    +The initial listing of printers in the Samba host's Printers folder accessed from a +client's Explorer will have no real printer driver assigned to them. By default this driver name is set +to a null string. This must be changed now. The local Add Printer Wizard (APW), run from +NT/2000/XP clients, will help us in this task.

    -However, the job to set a valid driver for the printer is not a -straightforward one: You must attempt to view the printer properties -for the printer to which you want the driver assigned. Open the -Windows Explorer, open Network Neighbourhood, browse to the Samba -host, open Samba's Printers folder, right-click the printer icon and -select Properties.... You are now trying to view printer and driver -properties for a queue which has this default NULL driver -assigned. This will result in an error message (this is normal here): -

    Device settings cannot be displayed. The driver -for the specified printer is not installed, only spooler properties -will be displayed. Do you want to install the driver -now?

    -Important:Don't click Yes! Instead, -click No in the error dialog. -Only now you will be presented with the printer properties window. From here, -the way to assign a driver to a printer is open to us. You have now the choice -either: -

    • select a driver from the pop-up list of installed -drivers. Initially this list will be empty. -Or

    • use the New Driver... button to -install a new printer driver (which will in fact start up the -APW).

    -Once the APW is started, the procedure is exactly the same as the one -you are familiar with in Windows (we assume here that you are -familiar with the printer driver installations procedure on Windows -NT). Make sure your connection is in fact setup as a user with -printer admin privileges (if in doubt, use -smbstatus to check for this). If you wish to -install printer drivers for client operating systems other than -Windows NT x86, you will need to use the -Sharing tab of the printer properties dialog. +Installation of a valid printer driver is not straightforward. You must attempt +to view the printer properties for the printer to which you want the driver assigned. Open the Windows +Explorer, open Network Neighborhood, browse to the Samba host, open Samba's Printers +folder, right-click on the printer icon and select Properties.... You are now trying to +view printer and driver properties for a queue that has this default NULL driver +assigned. This will result in the following error message: +

    + Device settings cannot be displayed. The driver for the specified printer is not installed, + only spooler properties will be displayed. Do you want to install the driver now? +

    +Do not click on Yes! Instead, click on No in the error dialog. +Only now you will be presented with the printer properties window. From here, the way to assign a driver +to a printer is open to us. You now have the choice of: +

    • + Select a driver from the pop-up list of installed drivers. Initially this list will be empty. +

    • + Click on New Driver to install a new printer driver (which will + start up the APW). +

    +Once the APW is started, the procedure is exactly the same as the one you are familiar with in Windows (we +assume here that you are familiar with the printer driver installations procedure on Windows NT). Make sure +your connection is, in fact, setup as a user with printer admin +privileges (if in doubt, use smbstatus to check for this). If you wish to install +printer drivers for client operating systems other than Windows NT x86, +you will need to use the Sharing tab of the printer properties dialog.

    -Assuming you have connected with an administrative (or root) account -(as named by the printer admin parameter), -you will also be able to modify other printer properties such as ACLs -and default device settings using this dialog. For the default device -settings, please consider the advice given further below. -

    Setting Drivers for existing Printers with -rpcclient

    -The second way to install printer drivers into -[print$] and set them up in a valid way can be -done from the UNIX command line. This involves four distinct steps: -

    1. gathering the info about the required driver files -and collecting the files together;

    2. deposit the driver files into the -[print$] share's correct subdirectories -(possibly by using smbclient);

    3. running the rpcclient -commandline utility once with the adddriver -subcommand,

    4. running rpcclient a second -time with the setdriver -subcommand.

    -We will provide detailed hints for each of these steps in the next few -paragraphs. -

    Identifying the Driver Files

    -To find out about the driver files, you have two options: you could -investigate the driver CD which comes with your printer. Study the -*.inf file on the CD, if it is contained. This -may not be the possible, since the *.inf file might be -missing. Unfortunately, many vendors have now started to use their own -installation programs. These installations packages are often some -sort of Windows platform archive format, plus, the files may get -re-named during the installation process. This makes it extremely -difficult to identify the driver files you need. +Assuming you have connected with an administrative (or root) account (as named by the +printer admin parameter), you will also be able to modify +other printer properties such as ACLs and default device settings using this dialog. For the default +device settings, please consider the advice given further in . +

    Installing Print Drivers Using rpcclient

    +The second way to install printer drivers into [print$] and set them +up in a valid way is to do it from the UNIX command line. This involves four distinct steps: +

    1. + Gather info about required driver files and collect the files. +

    2. + Deposit the driver files into the [print$] share's correct subdirectories + (possibly by using smbclient). +

    3. + Run the rpcclient command line utility once with the adddriver + subcommand. +

    4. + Run rpcclient a second time with the setdriver subcommand. +

    +We provide detailed hints for each of these steps in the paragraphs that follow. +

    Identifying Driver Files

    +To find out about the driver files, you have two options. You could check the contents of the driver +CDROM that came with your printer. Study the *.inf files lcoated on the CDROM. This +may not be possible, since the *.inf file might be missing. Unfortunately, vendors have now started +to use their own installation programs. These installations packages are often in some Windows platform +archive format. Additionally, the files may be re-named during the installation process. This makes it +extremely difficult to identify the driver files required.

    -Then you only have the second option: install the driver first on a -Windows client *locally* and investigate which file names and paths it -uses after they are installed. (Note, that you need to repeat this -procedure for every client platform you want to support. We are going -to show it here for the W32X86 platform only, a -name used by Microsoft for all WinNT/2k/XP clients...) +Then you only have the second option. Install the driver locally on a Windows client and +investigate which file names and paths it uses after they are installed. (You need to repeat +this procedure for every client platform you want to support. We show it here for the +W32X86 platform only, a name used by Microsoft for all Windows NT/200x/XP +clients.)

    -A good method to recognize the driver files this is to print the test -page from the driver's Properties Dialog -(General tab). Then look at the list of driver -files named on the printout. You'll need to recognize what Windows -(and Samba) are calling the Driver File , the -Data File, the Config File, -the Help File and (optionally) the -Dependent Driver Files (this may vary slightly -for Windows NT). You need to remember all names (or better take a -note) for the next steps. +A good method to recognize the driver files is to print the test page from the driver's +Properties dialog (General tab). Then look at the list of +driver files named on the printout. You'll need to recognize what Windows (and Samba) are calling the +Driver File, Data File, Config File, +Help File and (optionally) the Dependent Driver Files +(this may vary slightly for Windows NT). You need to take a note of all file names for the next steps.

    -Another method to quickly test the driver filenames and related paths -is provided by the rpcclient utility. Run it with -enumdrivers or with the -getdriver subcommand, each in the -3 level. In the following example, -TURBO_XP is the name of the Windows PC (in this -case it was a Windows XP Professional laptop, BTW). I had installed -the driver locally to TURBO_XP while kde-bitshop is -the name of the Linux host from which I am working. We could run an -interactive rpcclient session; -then we'd get an rpcclient /> prompt and would -type the subcommands at this prompt. This is left as a good exercise -to the reader. For now we use rpcclient with the --c parameter to execute a single subcommand -line and exit again. This is the method you would use if you want to -create scripts to automate the procedure for a large number of -printers and drivers. Note the different quotes used to overcome the -different spaces in between words: +Another method to quickly test the driver filenames and related paths is provided by the +rpcclient utility. Run it with enumdrivers or with the +getdriver subcommand, each at the 3 info level. In the following example, +TURBO_XP is the name of the Windows PC (in this case it was a Windows XP Professional +laptop). I installed the driver locally to TURBO_XP, from a Samba server called KDE-BITSHOP. +We could run an interactive rpcclient session; then we would get an +rpcclient /> prompt and would type the subcommands at this prompt. This is left as +a good exercise to the reader. For now, we use rpcclient with the -c +parameter to execute a single subcommand line and exit again. This is the method you would use if you +want to create scripts to automate the procedure for a large number of printers and drivers. Note the +different quotes used to overcome the different spaces in between words: 

     root# rpcclient -U'Danka%xxxx' -c \
-	'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP
-cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3
+	'getdriver "Heidelberg Digimaster 9110 (PS)" 3' TURBO_XP
+cmd = getdriver "Heidelberg Digimaster 9110 (PS)" 3
 
 [Windows NT x86]
 Printer Driver Info 3:
@@ -954,58 +813,47 @@ Printer Driver Info 3:
   
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.DLL]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.INI]
-  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1KMMin.DLL]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.dat]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.cat]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.def]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hre]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.vnd]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de.hlp]
-  Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\Hddm91c1_de_reg.HLP]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01Aux.dll]
   Dependentfiles: [C:\WINNT\System32\spool\DRIVERS\W32X86\2\HDNIS01_de.NTF]
   
   Monitorname: []
   Defaultdatatype: []

    -You may notice, that this driver has quite a big number of -Dependentfiles (I know worse cases however). Also, -strangely, the Driver File is here tagged as -Driver Path.... oh, well. Here we don't have yet -support for the so-called WIN40 architecture -installed. This name is used by Microsoft for the Win95/98/ME platforms. -If we want to support these, we need to install the Win95/98/ME driver -files in addition to those for W32X86 -(i.e. the WinNT72000/XP clients) onto a Windows PC. This PC -can also host the Win9x drivers, even if itself runs on Windows NT, -2000 or XP. +You may notice that this driver has quite a large number of Dependent files +(there are worse cases, however). Also, strangely, the +Driver File is tagged here +Driver Path. We do not yet have support for the so-called +WIN40 architecture installed. This name is used by Microsoft for the Windows +9x/Me platforms. If we want to support these, we need to install the Windows 9x/Me driver files in +addition to those for W32X86 (i.e., the Windows NT72000/XP clients) onto a +Windows PC. This PC can also host the Windows 9x/Me drivers, even if it runs on Windows NT, 2000 or XP.

    -Since the [print$] share is usually accessible -through the Network Neighbourhood, you can also use the UNC notation -from Windows Explorer to poke at it. The Win9x driver files will end -up in subdirectory "0" of the "WIN40" directory. The full path to -access them will be -\\WINDOWSHOST\print$\WIN40\0\. -

    Note

    more recent drivers on Windows 2000 and Windows XP are -installed into the "3" subdirectory instead of the "2". The version 2 -of drivers, as used in Windows NT, were running in Kernel Mode. -Windows 2000 changed this. While it still can use the Kernel Mode -drivers (if this is enabled by the Admin), its native mode for printer -drivers is User Mode execution. This requires drivers designed for -this. These type of drivers install into the "3" subdirectory. -

    Collecting the Driver Files from a Windows Host's -[print$] Share

    -Now we need to collect all the driver files we identified. in our -previous step. Where do we get them from? Well, why not retrieve them -from the very PC and the same [print$] share -which we investigated in our last step to identify the files? We can -use smbclient to do this. We will use the paths and -names which were leaked to us by getdriver. The +Since the [print$] share is usually accessible through the Network +Neighborhood, you can also use the UNC notation from Windows Explorer to poke at it. The Windows +9x/Me driver files will end up in subdirectory 0 of the WIN40 +directory. The full path to access them will be \\WINDOWSHOST\print$\WIN40\0\. +

    Note

    +More recent drivers on Windows 2000 and Windows XP are installed into the “3” subdirectory +instead of the “2”. The version 2 of drivers, as used in Windows NT, were running in Kernel +Mode. Windows 2000 changed this. While it still can use the Kernel Mode drivers (if this is enabled by +the Admin), its native mode for printer drivers is User Mode execution. This requires drivers designed +for this. These types of drivers install into the “3” subdirectory. +

    Obtaining Driver Files from Windows Client [print$] Shares

    +Now we need to collect all the driver files we identified in our previous step. Where do we get them +from? Well, why not retrieve them from the very PC and the same [print$] +share that we investigated in our last step to identify the files? We can use smbclient +to do this. We will use the paths and names that were leaked to us by getdriver. The listing is edited to include linebreaks for readability: 

    -root# smbclient //TURBO_XP/print\$ -U'Danka%xxxx'	\ 
-	-c 'cd W32X86/2;mget HD*_de.*             \
-	hd*ppd Hd*_de.* Hddm*dll HDN*Aux.DLL'
+root# smbclient //TURBO_XP/print\$ -U'Danka%xxxx' \ 
+   -c 'cd W32X86/2;mget HD*_de.* hd*ppd Hd*_de.* Hddm*dll HDN*Aux.DLL'
+
 added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
 Got a positive name query response from 10.160.50.8 ( 10.160.50.8 )
 Domain=[DEVELOPMENT] OS=[Windows 5.1] Server=[Windows 2000 LAN Manager]
@@ -1015,43 +863,38 @@ getting file \W32X86\2\Hddm91c1_de.def of size 428 as Hddm91c1_de.def
 Get file Hddm91c1_de.DLL? y
 getting file \W32X86\2\Hddm91c1_de.DLL of size 876544 as Hddm91c1_de.DLL
 [...]
-

    -After this command is complete, the files are in our current local -directory. You probably have noticed that this time we passed several -commands to the -c parameter, separated by semi-colons. This -effects that all commands are executed in sequence on the remote -Windows server before smbclient exits again. +After this command is complete, the files are in our current local directory. You probably have noticed +that this time we passed several commands to the -c parameter, separated by semi-colons. +This effects that all commands are executed in sequence on the remote Windows server before smbclient +exits again.

    -Don't forget to repeat the procedure for the WIN40 -architecture should you need to support Win95/98/XP clients. Remember, the -files for these architectures are in the WIN40/0/ subdir. Once we are -complete, we can run smbclient ... put to store -the collected files on the Samba server's -[print$] share. -

    Depositing the Driver Files into [print$]

    -So, now we are going to put the driver files into the -[print$] share. Remember, the UNIX path to this -share has been defined previously in your -. You also have created subdirectories -for the different Windows client types you want to support. Supposing -your [print$] share maps to the UNIX path -/etc/samba/drivers/, your driver files should now -go here: -

    • for all Windows NT, 2000 and XP clients into -/etc/samba/drivers/W32X86/ but -*not*(yet) into the "2" subdir!

    • for all Windows 95, 98 and ME clients into -/etc/samba/drivers/WIN40/ -- but *not* -(yet) into the "0" subdir!

    -We again use smbclient to transfer the driver files across the -network. We specify the same files and paths as were leaked to us by -running getdriver against the original -Windows install. However, now we are going to -store the files into a Samba/UNIX print server's -[print$] share... +Remember to repeat the procedure for the WIN40 architecture should +you need to support Windows 9x/Me/XP clients. Remember too, the files for these architectures are in the +WIN40/0/ subdirectory. Once this is complete, we can run smbclient ... +put to store the collected files on the Samba server's [print$] +share. +

    Installing Driver Files into [print$]

    +We are now going to locate the driver files into the [print$] +share. Remember, the UNIX path to this share has been defined +previously in your words missing here. You +also have created subdirectories for the different Windows client types you want to +support. Supposing your [print$] share maps to the UNIX path +/etc/samba/drivers/, your driver files should now go here: +

    • + For all Windows NT, 2000 and XP clients into /etc/samba/drivers/W32X86/ but + not (yet) into the 2 subdirectory. +

    • + For all Windows 95, 98 and ME clients into /etc/samba/drivers/WIN40/ but not + (yet) into the 0 subdirectory. +

    +We again use smbclient to transfer the driver files across the network. We specify the same files +and paths as were leaked to us by running getdriver against the original +Windows install. However, now we are going to store the files into a +Samba/UNIX print server's [print$] share. 

    -		root# smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c \
- 'cd W32X86; put HDNIS01_de.DLL; \
+root# smbclient //SAMBA-CUPS/print\$ -U'root%xxxx' -c \
+  'cd W32X86; put HDNIS01_de.DLL; \
   put Hddm91c1_de.ppd; put HDNIS01U_de.DLL;        \
   put HDNIS01U_de.HLP; put Hddm91c1_de.DLL;        \
   put Hddm91c1_de.INI; put Hddm91c1KMMin.DLL;      \
@@ -1060,6 +903,7 @@ store the files into a Samba/UNIX print s
   put Hddm91c1_de.vnd; put Hddm91c1_de.hlp;        \
   put Hddm91c1_de_reg.HLP; put HDNIS01Aux.dll;     \
   put HDNIS01_de.NTF'
+
 added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
 Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
 Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
@@ -1080,30 +924,26 @@ putting file Hddm91c1_de_reg.HLP as \W32X86\Hddm91c1_de_reg.HLP
 putting file HDNIS01Aux.dll as \W32X86\HDNIS01Aux.dll
 putting file HDNIS01_de.NTF as \W32X86\HDNIS01_de.NTF

    -Phewww -- that was a lot of typing! Most drivers are a lot smaller -- -many only having 3 generic PostScript driver files plus 1 PPD. Note, -that while we did retrieve the files from the "2" subdirectory of the -"W32X86" directory from the Windows box, we don't -put them (for now) in this same subdirectory of the Samba box! This -re-location will automatically be done by the -adddriver command which we will run shortly (and -don't forget to also put the files for the Win95/98/ME architecture -into the WIN40/ subdirectory should you need -them). -

    Check if the Driver Files are there (with smbclient)

    -For now we verify that our files are there. This can be done with -smbclient too (but of course you can log in via SSH -also and do this through a standard UNIX shell access too): + +Whew that was a lot of typing! Most drivers are a lot smaller many only having three generic +PostScript driver files plus one PPD. While we did retrieve the files from the 2 +subdirectory of the W32X86 directory from the Windows box, we do not put them +(for now) in this same subdirectory of the Samba box. This relocation will automatically be done by the +adddriver command, which we will run shortly (and do not forget to also put the files +for the Windows 9x/Me architecture into the WIN40/ subdirectory should you need them). +

    smbclient to Confirm Driver Installation

    +For now we verify that our files are there. This can be done with smbclient, too +(but, of course, you can log in via SSH also and do this through a standard UNIX shell access): 

     root# smbclient //SAMBA-CUPS/print\$ -U 'root%xxxx' \
 	-c 'cd W32X86; pwd; dir; cd 2; pwd; dir'
  added interface ip=10.160.51.60 bcast=10.160.51.255 nmask=255.255.252.0
 Got a positive name query response from 10.160.51.162 ( 10.160.51.162 )
-Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
+Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.8a]
 
 Current directory is \\SAMBA-CUPS\print$\W32X86\
-.                                   D        0  Sun May  4 03:56:35 2003
-..                                  D        0  Thu Apr 10 23:47:40 2003
+.                                  D        0  Sun May  4 03:56:35 2003
+..                                 D        0  Thu Apr 10 23:47:40 2003
 2                                   D        0  Sun May  4 03:56:18 2003
 HDNIS01Aux.dll                      A    15356  Sun May  4 03:58:59 2003
 Hddm91c1KMMin.DLL                   A    46966  Sun May  4 03:58:59 2003
@@ -1123,8 +963,8 @@ Hddm91c1_de_reg.HLP                 A   228417  Sun May  4 03:58:59 2003
               40976 blocks of size 262144. 709 blocks available
 
 Current directory is \\SAMBA-CUPS\print$\W32X86\2\
-.                                   D        0  Sun May  4 03:56:18 2003
-..                                  D        0  Sun May  4 03:56:35 2003
+.                                  D        0  Sun May  4 03:56:18 2003
+..                                 D        0  Sun May  4 03:56:35 2003
 ADOBEPS5.DLL                        A   434400  Sat May  3 23:18:45 2003
 laserjet4.ppd                       A     9639  Thu Apr 24 01:05:32 2003
 ADOBEPSU.DLL                        A   109568  Sat May  3 23:18:45 2003
@@ -1132,76 +972,64 @@ ADOBEPSU.HLP                        A    18082  Sat May  3 23:18:45 2003
 PDFcreator2.PPD                     A    15746  Sun Apr 20 22:24:07 2003
               40976 blocks of size 262144. 709 blocks available

    -Notice that there are already driver files present in the -2 subdir (probably from a previous -installation). Once the files for the new driver are there too, you -are still a few steps away from being able to use them on the -clients. The only thing you could do *now* is to retrieve them from a -client just like you retrieve ordinary files from a file share, by -opening print$ in Windows Explorer. But that wouldn't install them per -Point'n'Print. The reason is: Samba doesn't know yet that these files -are something special, namely printer driver -files and it doesn't know yet to which print queue(s) these -driver files belong. -

    Running rpcclient with -adddriver

    -So, next you must tell Samba about the special category of the files -you just uploaded into the [print$] share. This -is done by the adddriver command. It will -prompt Samba to register the driver files into its internal TDB -database files. The following command and its output has been edited, -again, for readability: +Notice that there are already driver files present in the 2 subdirectory (probably +from a previous installation). Once the files for the new driver are there too, you are still a few +steps away from being able to use them on the clients. The only thing you could do now is to retrieve +them from a client just like you retrieve ordinary files from a file share, by opening print$ in Windows +Explorer. But that wouldn't install them per Point'n'Print. The reason +is: Samba does not yet know that +these files are something special, namely printer driver files and it does not know +to which print queue(s) these driver files belong. +

    Running rpcclient with adddriver

    +Next, you must tell Samba about the special category of the files you just uploaded into the +[print$] share. This is done by the adddriver +command. It will prompt Samba to register the driver files into its internal TDB database files. The +following command and its output has been edited, again, for readability: 

    -		root# rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" \
-"dm9110:HDNIS01_de.DLL: \
-Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
- NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
- Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
- Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
- HDNIS01Aux.dll,HDNIS01_de.NTF,                     \
- Hddm91c1_de_reg.HLP' SAMBA-CUPS
+root# rpcclient -Uroot%xxxx -c 'adddriver "Windows NT x86" \
+  "dm9110:HDNIS01_de.DLL: \
+  Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
+  NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
+  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
+  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL, \
+  HDNIS01Aux.dll,HDNIS01_de.NTF,                     \
+  Hddm91c1_de_reg.HLP' SAMBA-CUPS
 
-cmd = adddriver "Windows NT x86" \
-"dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:    \
- HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
- Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,          \
- Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,        \
- HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
+cmd = adddriver "Windows NT x86" \
+  "dm9110:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:   \
+  HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI, \
+  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,          \
+  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,        \
+  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
 
 Printer Driver dm9110 successfully installed.
-

    -After this step the driver should be recognized by Samba on the print -server. You need to be very careful when typing the command. Don't -exchange the order of the fields. Some changes would lead to a -NT_STATUS_UNSUCCESSFUL error -message. These become obvious. Other changes might install the driver -files successfully, but render the driver unworkable. So take care! -Hints about the syntax of the adddriver command are in the man -page. The CUPS printing chapter of this HOWTO collection provides a -more detailed description, if you should need it. -

    Check how Driver Files have been moved after -adddriver finished

    -One indication for Samba's recognition of the files as driver files is -the successfully installed message. -Another one is the fact, that our files have been moved by the -adddriver command into the 2 -subdirectory. You can check this again with -smbclient: +After this step, the driver should be recognized by Samba on the print server. You need to be very +careful when typing the command. Don't exchange the order of the fields. Some changes would lead to +an NT_STATUS_UNSUCCESSFUL error message. These become obvious. Other +changes might install the driver files successfully, but render the driver unworkable. So take care! +Hints about the syntax of the adddriver command are in the man page. The CUPS printing chapter +provides a more detailed description, should you need it. +

    Checking adddriver Completion

    +One indication for Samba's recognition of the files as driver files is the successfully +installed message. Another one is the fact that our files have been moved by the +adddriver command into the 2 subdirectory. You can check this +again with smbclient: 

    -root# smbclient //SAMBA-CUPS/print\$ -Uroot%xx -c 'cd W32X86;dir;pwd;cd 2;dir;pwd'
+root# smbclient //SAMBA-CUPS/print\$ -Uroot%xx \
+	-c 'cd W32X86;dir;pwd;cd 2;dir;pwd'
  added interface ip=10.160.51.162 bcast=10.160.51.255 nmask=255.255.252.0
  Domain=[CUPS-PRINT] OS=[UNIX] Server=[Samba 2.2.7a]
 
   Current directory is \\SAMBA-CUPS\print$\W32X86\
-  .                                   D        0  Sun May  4 04:32:48 2003
-  ..                                  D        0  Thu Apr 10 23:47:40 2003
+  .                                  D        0  Sun May  4 04:32:48 2003
+  ..                                 D        0  Thu Apr 10 23:47:40 2003
   2                                   D        0  Sun May  4 04:32:48 2003
                 40976 blocks of size 262144. 731 blocks available 
 
   Current directory is \\SAMBA-CUPS\print$\W32X86\2\
-  .                                   D        0  Sun May  4 04:32:48 2003
-  ..                                  D        0  Sun May  4 04:32:48 2003
+  .                                  D        0  Sun May  4 04:32:48 2003
+  ..                                 D        0  Sun May  4 04:32:48 2003
   DigiMaster.PPD                      A   148336  Thu Apr 24 01:07:00 2003
   ADOBEPS5.DLL                        A   434400  Sat May  3 23:18:45 2003
   laserjet4.ppd                       A     9639  Thu Apr 24 01:05:32 2003
@@ -1224,62 +1052,54 @@ subdirectory. You can check this again with
   HDNIS01U_de.HLP                     A    19770  Sun May  4 04:32:18 2003
   Hddm91c1_de_reg.HLP                 A   228417  Sun May  4 04:32:18 2003
                 40976 blocks of size 262144. 731 blocks available
-

    -Another verification is that the timestamp of the printing TDB files -is now updated (and possibly their filesize has increased). -

    Check if the Driver is recognized by Samba

    -Now the driver should be registered with Samba. We can easily verify -this, and will do so in a moment. However, this driver is -not yet associated with a particular -printer. We may check the driver status of the -files by at least three methods: -

    • from any Windows client browse Network Neighbourhood, -find the Samba host and open the Samba Printers and -Faxes folder. Select any printer icon, right-click and -select the printer Properties. Click on the -Advanced tab. Here is a field indicating the -driver for that printer. A drop down menu allows you to change that -driver (be careful to not do this unwittingly.). You can use this -list to view all drivers know to Samba. Your new one should be amongst -them. (Each type of client will only see his own architecture's -list. If you don't have every driver installed for each platform, the -list will differ if you look at it from Windows95/98/ME or -WindowsNT/2000/XP.)

    • from a Windows 2000 or XP client (not WinNT) browse -Network Neighbourhood, search for the Samba -server and open the server's Printers folder, -right-click the white background (with no printer highlighted). Select -Server Properties. On the -Drivers tab you will see the new driver listed -now. This view enables you to also inspect the list of files belonging -to that driver (this doesn't work on Windows NT, but only on -Windows 2000 and Windows XP. WinNT doesn't provide the "Drivers" -tab).. An alternative, much quicker method for Windows -2000/XP to start this dialog is by typing into a DOS box (you must of -course adapt the name to your Samba server instead of SAMBA-CUPS): -

      rundll32 printui.dll,PrintUIEntry /s /t2 /n\\SAMBA-CUPS

    • from a UNIX prompt run this command (or a variant -thereof), where SAMBA-CUPS is the name of the Samba -host and "xxxx" represents the actual Samba password assigned to root: -

      rpcclient -U'root%xxxx' -c 'enumdrivers' SAMBA-CUPS

      -You will see a listing of all drivers Samba knows about. Your new one -should be amongst them. But it is only listed under the [Windows NT -x86] heading, not under [Windows 4.0], -since we didn't install that part. Or did *you*? -- You will see a listing of -all drivers Samba knows about. Your new one should be amongst them. In our -example it is named dm9110. Note that the 3rd column -shows the other installed drivers twice, for each supported architecture one -time. Our new driver only shows up for -Windows NT 4.0 or 2000. To -have it present for Windows 95, 98 and ME you'll -have to repeat the whole procedure with the WIN40 architecture and subdirectory. -

    A side note: you are not bound to specific driver names

    -You can name the driver as you like. If you repeat the -adddriver step, with the same files as before, but -with a different driver name, it will work the same: +Another verification is that the timestamp of the printing TDB files is now updated +(and possibly their file size has increased). +

    Check Samba for Driver Recognition

    +Now the driver should be registered with Samba. We can easily verify this, and will do so in a +moment. However, this driver is not yet associated with a particular printer. We may check the driver +status of the files by at least three methods: +

    • + From any Windows client browse Network Neighborhood, find the Samba host and open the Samba + Printers and Faxes folder. Select any printer icon, right-click and select + the printer Properties. Click the Advanced + tab. Here is a field indicating the driver for that printer. A drop-down menu allows you to + change that driver (be careful not to do this unwittingly). You can use this list to view + all drivers known to Samba. Your new one should be among them. (Each type of client will only + see his own architecture's list. If you do not have every driver installed for each platform, + the list will differ if you look at it from Windows95/98/ME or WindowsNT/2000/XP.) +

    • + From a Windows 200x/XP client (not Windows NT) browse Network Neighborhood, + search for the Samba server and open the server's Printers folder, + right-click on the white background (with no printer highlighted). Select Server + Properties. On the Drivers tab you will see the new driver + listed. This view enables you to also inspect the list of files belonging to that driver + (this does not work on Windows NT, but only on Windows 2000 and Windows XP; Windows NT does not + provide the Drivers tab). An + alternative and much quicker method for + Windows 2000/XP to start this dialog is by typing into a DOS box (you must of course adapt the + name to your Samba server instead of SAMBA-CUPS): +

      rundll32 printui.dll,PrintUIEntry /s /t2 /n\\SAMBA-CUPS

    • + From a UNIX prompt, run this command (or a variant thereof) where + SAMBA-CUPS is the name of the Samba host and xxxx represents the + actual Samba password assigned to root: +

      rpcclient -U'root%xxxx' -c 'enumdrivers' SAMBA-CUPS

      + You will see a listing of all drivers Samba knows about. Your new one should be among + them. But it is only listed under the [Windows NT x86] heading, not under + [Windows 4.0], since you didn't install that part. Or did you? + You will see a listing of all drivers Samba knows about. Your new one should be among them. In + our example it is named dm9110. Note that the third column shows the other + installed drivers twice, one time for each supported architecture. Our new driver only shows up + for Windows NT 4.0 or 2000. To have it present for Windows + 95, 98 and ME, you'll have to repeat the whole procedure with the WIN40 architecture + and subdirectory. +

    Specific Driver Name Flexibility

    +You can name the driver as you like. If you repeat the adddriver step with the same +files as before but with a different driver name, it will work the same: 

    -root# rpcclient -Uroot%xxxx                                        \
-  -c 'adddriver "Windows NT x86"                     \
-  "myphantasydrivername:HDNIS01_de.DLL:              \
+root# rpcclient -Uroot%xxxx         \
+  -c 'adddriver "Windows NT x86"                     \
+  "mydrivername:HDNIS01_de.DLL:              \
   Hddm91c1_de.ppd:HDNIS01U_de.DLL:HDNIS01U_de.HLP:   \
   NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,          \
   Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,   \
@@ -1287,345 +1107,292 @@ with a different driver name, it will work the same:
   HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP' SAMBA-CUPS
   
 
- cmd = adddriver "Windows NT x86" 
-                 "myphantasydrivername:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:\
-                  HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,           \
-                  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,                    \
-                  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,                  \
-                  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
-
- Printer Driver myphantasydrivername successfully installed.
+cmd = adddriver "Windows NT x86" \
+ "mydrivername:HDNIS01_de.DLL:Hddm91c1_de.ppd:HDNIS01U_de.DLL:\
+  HDNIS01U_de.HLP:NULL:RAW:Hddm91c1_de.DLL,Hddm91c1_de.INI,           \
+  Hddm91c1_de.dat,Hddm91c1_de.def,Hddm91c1_de.hre,                    \
+  Hddm91c1_de.vnd,Hddm91c1_de.hlp,Hddm91c1KMMin.DLL,                  \
+  HDNIS01Aux.dll,HDNIS01_de.NTF,Hddm91c1_de_reg.HLP"
 
+Printer Driver mydrivername successfully installed.

    -You will also be able to bind that driver to any print queue (however, -you are responsible yourself that you associate drivers to queues -which make sense to the target printer). Note, that you can't run the -rpcclient adddriver command -repeatedly. Each run "consumes" the files you had put into the -[print$] share by moving them into the -respective subdirectories. So you must precede an -smbclient ... put command before each -rpcclient ... adddriver" command. -

    Running rpcclient with -setdriver

    -Samba still needs to know which printer's driver -this is. It needs to create a mapping of the driver to a printer, and -store this info in its "memory", the TDB files. The rpcclient -setdriver command achieves exactly this: +You will be able to bind that driver to any print queue (however, you are responsible that +you associate drivers to queues that make sense with respect to target printers). You cannot run the +rpcclient adddriver command repeatedly. Each run consumes the +files you had put into the [print$] share by moving them into the +respective subdirectories. So you must execute an smbclient ... put command before +each rpcclient ... adddriver command. +

    Running rpcclient with the setdriver

    +Samba needs to know which printer owns which driver. Create a mapping of the driver to a printer, and +store this info in Samba's memory, the TDB files. The rpcclient setdriver command +achieves exactly this: 

    -root# rpcclient -U'root%xxxx' -c 'setdriver dm9110 myphantasydrivername' SAMBA-CUPS
- cmd = setdriver dm9110 myphantasydrivername
- Successfully set dm9110 to driver myphantasydrivername.
+root# rpcclient -U'root%xxxx' -c 'setdriver dm9110 mydrivername' SAMBA-CUPS
+ cmd = setdriver dm9110 mydrivername
+
+Successfully set dm9110 to driver mydrivername.

    -Ahhhhh -- no, I didn't want to do that. Repeat, this time with the -name I intended: +Ah, no, I did not want to do that. Repeat, this time with the name I intended: 

     root# rpcclient -U'root%xxxx' -c 'setdriver dm9110 dm9110' SAMBA-CUPS
  cmd = setdriver dm9110 dm9110
- Successfully set dm9110 to driver dm9110.
+Successfully set dm9110 to driver dm9110.
+

    +The syntax of the command is: +

    +rpcclient -U'root%sambapassword' -c 'setdriver printername \
+ drivername' SAMBA-Hostname.

    -The syntax of the command is rpcclient --U'root%sambapassword' -c 'setdriver -"printername" -"drivername' -SAMBA-Hostname . -- -Now we have done *most* of the work. But not yet all.... +Now we have done most of the work, but not all of it.

    Note

    -the setdriver command will only succeed if the printer is -known to -Samba already. A bug in 2.2.x prevented Samba from recognizing freshly -installed printers. You had to restart Samba, or at least send a HUP -signal to all running smbd processes to work around this: -kill -HUP `pidof smbd`.

    Client Driver Install Procedure

    -A famous philosopher said once: “The Proof of the Pudding lies -in the Eating”. The proof for our setup lies in the printing. -So let's install the printer driver onto the client PCs. This is not -as straightforward as it may seem. Read on. -

    The first Client Driver Installation

    -Especially important is the installation onto the first client PC (for -each architectural platform separately). Once this is done correctly, -all further clients are easy to setup and shouldn't need further -attention. What follows is a description for the recommended first -procedure. You work now from a client workstation. First you should -guarantee that your connection is not unwittingly mapped to -bad user "nobody". In a DOS box type: +The setdriver command will only succeed if the +printer is already known to Samba. A +bug in 2.2.x prevented Samba from recognizing freshly installed printers. You had to restart Samba, +or at least send an HUP signal to all running smbd processes to work around this: kill -HUP +`pidof smbd`. +

    Client Driver Installation Procedure

    +As Don Quixote said: “The proof of the pudding is in the eating.” The proof +for our setup lies in the printing. So let's install the printer driver onto the client PCs. This is +not as straightforward as it may seem. Read on. +

    First Client Driver Installation

    +Especially important is the installation onto the first client PC (for each architectural platform +separately). Once this is done correctly, all further clients are easy to setup and shouldn't need further +attention. What follows is a description for the recommended first procedure. You work now from a client +workstation. You should guarantee that your connection is not unwittingly mapped to bad +user nobody. In a DOS box type:

    net use \\SAMBA-SERVER\print$ /user:root

    -Replace root, if needed, by another valid -printer admin user as given in the definition. -Should you already be connected as a different user, you'll get an error -message. There is no easy way to get rid of that connection, because -Windows doesn't seem to know a concept of "logging off" from a share -connection (don't confuse this with logging off from the local -workstation; that is a different matter). You can try to close -all Windows file explorer and Internet Explorer -windows. As a last resort, you may have to reboot. Make sure there is -no automatic re-connection set up. It may be easier to go to a -different workstation and try from there. After you have made sure you -are connected as a printer admin user (you can check this with the -smbstatus command on Samba) do this from the -Windows workstation: -

    • Open Network -Neighbourhood

    • Browse to Samba server

    • Open its Printers and -Faxes folder

    • Highlight and right-click the printer

    • Select Connect... (for WinNT4/2K -it is possibly Install...)

    -A new printer (named printername on -samba-server) should now have appeared in your -local Printer folder (check Start -- -Settings -- Control Panel --- Printers and Faxes). +Replace root, if needed, by another valid printer admin user as given in +the definition. Should you already be connected as a different user, you will get an error message. There +is no easy way to get rid of that connection, because Windows does not seem to know a concept of logging +off from a share connection (do not confuse this with logging off from the local workstation; that is +a different matter). You can try to close all Windows file explorer +and Internet Explorer for Windows. As +a last resort, you may have to reboot. Make sure there is no automatic reconnection set up. It may be +easier to go to a different workstation and try from there. After you have made sure you are connected +as a printer admin user (you can check this with the smbstatus command on Samba), +do this from the Windows workstation: +

    1. + Open Network Neighborhood. +

    2. + Browse to Samba server. +

    3. + Open its Printers and Faxes folder. +

    4. + Highlight and right-click on the printer. +

    5. + Select Connect (for Windows NT4/200x + it is possibly Install). +

    +A new printer (named printername on Samba-server) should now have +appeared in your local Printer folder (check Start -- +Settings -- Control Panel -- Printers +and Faxes).

    -Most likely you are now tempted to try and print a test page. After -all, you now can open the printer properties and on the "General" tab, -there is a button offering to do just that. But chances are that you -get an error message saying Unable to print Test -Page. The reason might be that there is not yet a -valid Device Mode set for the driver, or that the "Printer Driver -Data" set is still incomplete. +Most likely you are now tempted to try to print a test page. After all, you now can open the printer +properties, and on the General tab there is a button offering to do just that. But +chances are that you get an error message saying Unable to print Test Page. The +reason might be that there is not yet a valid Device Mode set for the driver, or that the “Printer +Driver Data” set is still incomplete.

    -You must now make sure that a valid "Device Mode" is set for the -driver. Don't fear -- we will explain now what that means. -

    IMPORTANT! Setting Device Modes on new Printers

    -In order for a printer to be truly usable by a Windows NT/2K/XP -client, it must possess: -

    • a valid Device Mode generated by -the driver for the printer (defining things like paper size, -orientation and duplex settings), and

    • a complete set of -Printer Driver Data generated by the -driver.

    -If either one of these is incomplete, the clients can produce less -than optimal output at best. In the worst cases, unreadable garbage or -nothing at all comes from the printer or they produce a harvest of -error messages when attempting to print. Samba stores the named values -and all printing related info in its internal TDB database files -(ntprinters.tdb, -ntdrivers.tdb, printing.tdb -and ntforms.tdb). +You must make sure that a valid Device Mode is set for the +driver. We now explain what that means. +

    Setting Device Modes on New Printers

    +For a printer to be truly usable by a Windows NT/200x/XP client, it must possess: +

    • + A valid Device Mode generated by the driver for the printer (defining things + like paper size, orientation and duplex settings). +

    • + A complete set of Printer Driver Data generated by the driver. +

    +If either of these is incomplete, the clients can produce less than optimal output at best. In the +worst cases, unreadable garbage or nothing at all comes from the printer or it produces a harvest of +error messages when attempting to print. Samba stores the named values and all printing related information in +its internal TDB database files (ntprinters.tdb, ntdrivers.tdb, +printing.tdb and ntforms.tdb).

    -What do these two words stand for? Basically, the Device Mode and the -set of Printer Driver Data is a collection of settings for all print -queue properties, initialized in a sensible way. Device Modes and -Printer Driver Data should initially be set on the print server (that is -here: the Samba host) to healthy values so that the clients can start -to use them immediately. How do we set these initial healthy values? -This can be achieved by accessing the drivers remotely from an NT (or -2k/XP) client, as is discussed in the next paragraphs. +What do these two words stand for? Basically, the Device Mode and the set of Printer Driver Data is a +collection of settings for all print queue properties, initialized in a sensible way. Device Modes and +Printer Driver Data should initially be set on the print server (the Samba host) to healthy +values so the clients can start to use them immediately. How do we set these initial healthy values? +This can be achieved by accessing the drivers remotely from an NT (or 200x/XP) client, as is discussed +in the following paragraphs.

    -Be aware, that a valid Device Mode can only be initiated by a -printer admin, or root (the reason should be -obvious). Device Modes can only correctly be set by executing the -printer driver program itself. Since Samba can not execute this Win32 -platform driver code, it sets this field initially to NULL (which is -not a valid setting for clients to use). Fortunately, most drivers -generate themselves the Printer Driver Data that is needed, when they -are uploaded to the [print$] share with the -help of the APW or rpcclient. +Be aware that a valid Device Mode can only be initiated by a +printer admin, or root +(the reason should be obvious). Device Modes can only be correctly +set by executing the printer driver program itself. Since Samba cannot execute this Win32 platform driver +code, it sets this field initially to NULL (which is not a valid setting for clients to use). Fortunately, +most drivers automatically generate the Printer Driver Data that is needed when they are uploaded to the +[print$] share with the help of the APW or rpcclient.

    -The generation and setting of a first valid Device Mode however -requires some "tickling" from a client, to set it on the Samba -server. The easiest means of doing so is to simply change the page -orientation on the server's printer. This "executes" enough of the -printer driver program on the client for the desired effect to happen, -and feeds back the new Device Mode to our Samba server. You can use the -native Windows NT/2K/XP printer properties page from a Window client -for this: -

    • Browse the Network Neighbourhood

    • Find the Samba server

    • Open the Samba server's Printers and - Faxes folder

    • Highlight the shared printer in question

    • Right-click the printer (you may already be here, if you -followed the last section's description)

    • At the bottom of the context menu select -Properties.... (if the menu still offers the -Connect... entry -further above, you need to click that one first to achieve the driver -installation as shown in the last section)

    • Go to the Advanced tab; click on -Printing Defaults...

    • Change the "Portrait" page setting to "Landscape" (and -back)

    • (Oh, and make sure to apply -changes between swapping the page orientation to cause the change to -actually take effect...).

    • While you're at it, you may optionally also want to -set the desired printing defaults here, which then apply to all future -client driver installations on the remaining from now -on.

    -This procedure has executed the printer driver program on the client -platform and fed back the correct Device Mode to Samba, which now -stored it in its TDB files. Once the driver is installed on the -client, you can follow the analogous steps by accessing the -local Printers folder too if you are -a Samba printer admin user. From now on printing should work as expected. +The generation and setting of a first valid Device Mode, however, requires some tickling from a client, +to set it on the Samba server. The easiest means of doing so is to simply change the page orientation on +the server's printer. This executes enough of the printer driver program on the client for the desired +effect to happen, and feeds back the new Device Mode to our Samba server. You can use the native Windows +NT/200x/XP printer properties page from a Window client for this: +

    1. + Browse the Network Neighborhood. +

    2. + Find the Samba server. +

    3. + Open the Samba server's Printers and Faxes folder. +

    4. + Highlight the shared printer in question. +

    5. + Right-click on the printer (you may already be here, if you followed the last section's description). +

    6. + At the bottom of the context menu select Properties (if the menu still offers the + Connect entry further above, you + need to click on that one first to achieve the driver + installation as shown in the last section). +

    7. + Go to the Advanced tab; click on Printing Defaults. +

    8. + Change the Portrait page setting to Landscape (and back). +

    9. + Make sure to apply changes between swapping the page orientation to cause the change to actually take effect. +

    10. + While you are at it, you may also want to set the desired printing defaults here, which then apply to all future + client driver installations on the remaining from now on. +

    +This procedure has executed the printer driver program on the client platform and fed back the correct +Device Mode to Samba, which now stored it in its TDB files. Once the driver is installed on the client, +you can follow the analogous steps by accessing the local Printers +folder, too, if you are a Samba printer admin user. From now on, printing should work as expected.

    -Samba also includes a service level parameter name default -devmode for generating a default Device Mode for a -printer. Some drivers will function well with Samba's default set of -properties. Others may crash the client's spooler service. So use this -parameter with caution. It is always better to have the client -generate a valid device mode for the printer and store it on the -server for you. -

    Further Client Driver Install Procedures

    -Every further driver may be done by any user, along the lines -described above: Browse network, open printers folder on Samba server, -right-click printer and choose Connect.... Once -this completes (should be not more than a few seconds, but could also take -a minute, depending on network conditions), you should find the new printer in -your client workstation local Printers and -Faxes folder. +Samba includes a service level parameter name default devmode for generating a default +Device Mode for a printer. Some drivers will function well with Samba's default set of properties. Others +may crash the client's spooler service. So use this parameter with caution. It is always better to have +the client generate a valid device mode for the printer and store it on the server for you. +

    Additional Client Driver Installation

    +Every additional driver may be installed, along the lines described +above. Browse network, open the +Printers folder on Samba server, right-click on Printer and choose +Connect.... Once this completes (should be not more than a few seconds, +but could also take a minute, depending on network conditions), you should find the new printer in your +client workstation local Printers and Faxes folder.

    You can also open your local Printers and Faxes folder by -using this command on Windows 2000 and Windows XP Professional workstations: -

    rundll32 shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder -

    +using this command on Windows 200x/XP Professional workstations: +

    rundll32 shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder

    or this command on Windows NT 4.0 workstations:

    rundll32 shell32.dll,Control_RunDLL MAIN.CPL @2

    -You can enter the commands either inside a DOS box window -or in the Run command... field from the -Start menu. -

    Always make first Client Connection as root or "printer admin"

    -After you installed the driver on the Samba server (in its -[print$] share, you should always make sure -that your first client installation completes correctly. Make it a habit for -yourself to build that the very first connection from a client as -printer admin. This is to make sure that: -

    • a first valid Device Mode is -really initialized (see above for more explanation details), and -that

    • the default print settings of your printer for all -further client installations are as you want them

    -Do this by changing the orientation to landscape, click -Apply, and then change it back again. Then modify -the other settings (for example, you don't want the default media size -set to Letter, when you are all using -A4, right? You may want to set the printer for -duplex as the default; etc.). +You can enter the commands either inside a DOS box window or in the Run +command... field from the Start menu. +

    Always Make First Client Connection as root or “printer admin”

    +After you installed the driver on the Samba server (in its [print$] +share, you should always make sure that your first client installation completes correctly. Make it a +habit for yourself to build the very first connection from a client as printer admin. This is to make sure that: +

    • + A first valid Device Mode is really initialized (see above for more + explanation details). +

    • + The default print settings of your printer for all further client installations are as you want them. +

    +Do this by changing the orientation to landscape, click on Apply, and then change it +back again. Next, modify the other settings (for example, you do not want the default media size set to +Letter when you are all using A4, right? You may want to set the +printer for duplex as the default, and so on).

    -To connect as root to a Samba printer, try this command from a Windows -2K/XP DOS box command prompt: +To connect as root to a Samba printer, try this command from a Windows 200x/XP DOS box command prompt: 

    -C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n 
-	\\SAMBA-SERVER\printername"
+C:\> runas /netonly /user:root "rundll32 printui.dll,PrintUIEntry /p /t3 /n 
+	\\SAMBA-SERVER\printername"

    You will be prompted for root's Samba-password; type it, wait a few -seconds, click on Printing Defaults... and -proceed to set the job options as should be used as defaults by all -clients. Alternatively, instead of root you can name one other member -of the printer admin from the setting. +seconds, click on Printing +Defaults, and proceed to set the job options that should be used as defaults by all +clients. Alternately, instead of root you can name one other member of the printer admin from the setting.

    -Now all the other users downloading and installing the driver -the same way (called Point'n'Print) will -have the same defaults set for them. If you miss this step you'll -get a lot of helpdesk calls from your users. But maybe you like to -talk to people.... ;-) -

    Other Gotchas

    -Your driver is installed. It is ready for -Point'n'Print installation by the clients -now. You may have tried to download and use it -onto your first client machine now. But wait... let's make you -acquainted first with a few tips and tricks you may find useful. For -example, suppose you didn't manage to "set the defaults" on the -printer, as advised in the preceding paragraphs? And your users -complain about various issues (such as “We need to set the paper -size for each job from Letter to A4 and it won't store it!”) -

    Setting Default Print Options for the Client Drivers

    + Now all the other users downloading and installing the driver the same way (called +“Point'n'Print”) will have the same defaults set for them. If you miss this step +you'll get a lot of Help Desk calls from your users, but maybe you like to talk to people. +

    Other Gotchas

    +Your driver is installed. It is now ready for Point'n'Print +installation by the clients. You may have tried to download and use it +onto your first client machine, but +wait. Let's make sure you are acquainted first with a few tips and tricks you may find useful. For example, +suppose you did not set the defaults on the printer, as advised in the preceding +paragraphs. Your users complain about various issues (such as, “We need to set the paper size +for each job from Letter to A4 and it will not store it.”) +

    Setting Default Print Options for Client Drivers

    The last sentence might be viewed with mixed feelings by some users and -admins. They have struggled for hours and hours and couldn't arrive at -a point were their settings seemed to be saved. It is not their -fault. The confusing thing is this: in the multi-tabbed dialog that pops -up when you right-click the printer name and select -Properties..., you can arrive at two identically -looking dialogs, each claiming that they help you to set printer options, -in three different ways. Here is the definite answer to the "Samba -Default Driver Setting FAQ": -

    “I can't set and save default print options -for all users on Win2K/XP! Why not?”  -How are you doing it? I bet the wrong way.... (it is not very -easy to find out, though). There are 3 different ways to bring you to -a dialog that seems to set everything. All three -dialogs look the same. Only one of them -does what you intend. -Important: you need to be Administrator or Print -Administrator to do this for all users. Here is how I reproduce it in -on XP Professional: - -

    1. The first "wrong" way: - -

      1. Open the Printers -folder.

      2. Right-click on the printer -(remoteprinter on cupshost) and -select in context menu Printing -Preferences...

      3. Look at this dialog closely and remember what it looks -like.

      -

    2. The second "wrong" way: +admins. They have struggled for hours and could not arrive at a point +where their settings seemed to be saved. It is not their fault. The confusing +thing is that in the multi-tabbed dialog that pops up when you right-click +on the printer name and select Properties, you +can arrive at two dialogs that appear identical, each claiming that they help +you to set printer options in three different ways. Here is the definite +answer to the Samba default driver setting FAQ: +

      “I can not set and save default print options +for all users on Windows 200x/XP. Why not?”  +How are you doing it? I bet the wrong way. (It is not easy to find out, though). There are three different +ways to bring you to a dialog that seems to set everything. All three +dialogs look the same, but only one +of them does what you intend. You need to be Administrator or Print Administrator to do this for all +users. Here is how I reproduce it in an XP Professional: -

      1. Open the Printers -folder.

      2. Right-click on the printer (remoteprinter on -cupshost) and select in the context menu -Properties

      3. Click on the General -tab

      4. Click on the button Printing -Preferences...

      5. A new dialog opens. Keep this dialog open and go back -to the parent dialog.

      -

    3. The third, the "correct" way: (should you do -this from the beginning, just carry out steps 1. and 2. from second -"way" above) - -

      1. Click on the Advanced -tab. (Hmmm... if everything is "Grayed Out", then you are not logged -in as a user with enough privileges).

      2. Click on the Printing -Defaults... button.

      3. On any of the two new tabs, click on the -Advanced... button.

      4. A new dialog opens. Compare this one to the other, -identical looking one from "B.5" or A.3".

      -

    - -Do you see any difference in the two settings dialogs? I don't -either. However, only the last one, which you arrived at with steps -C.1.-6. will permanently save any settings which will then become the -defaults for new users. If you want all clients to have the same -defaults, you need to conduct these steps as administrator -(printer admin in ) -before a client downloads the driver (the clients -can later set their own per-user defaults by -following the procedures A. -or B. above...). (This is new: Windows 2000 and -Windows XP allow per-user default settings and -the ones the administrator gives them, before they set up their own). -The "parents" of the identically looking dialogs have a slight -difference in their window names: one is called -Default Print Values for Printer Foo on Server -Bar" (which is the one you need) and the other is -called "Print Settings for Printer Foo on Server -Bar". The last one is the one you arrive at when you -right-click on the printer and select Print -Settings.... This is the one what you were -taught to use back in the days of Windows NT! So it is only natural to -try the same way with Win2k or WinXP. You wouldn't dream -that there is now a different "clicking path" to arrive at an -identically looking, but functionally different dialog to set defaults -for all users! -

    Tip

    Try (on Win2000 and WinXP) to run this command (as a user -with the right privileges): +The following list needs periods after the letters and numbers::::::::: +

    1. The first “wrong” way: +

      1. Open the Printers folder.

      2. Right-click on the printer (remoteprinter on cupshost) and + select in context menu Printing Preferences...

      3. Look at this dialog closely and remember what it looks like.

    2. The second “wrong” way: +

      1. Open the Printers folder.

      2. Right-click on the printer (remoteprinter on + cupshost) and select in the context menu + Properties

      3. Click on the General + tab

      4. Click on the Printing + Preferences...

      5. A new dialog opens. Keep this dialog open and go back + to the parent dialog.

      +

    3. + The third and correct way: (should you do this from the beginning, just carry out steps 1 + and 2 from the second method above). +

      1. Click on the Advanced + tab. (If everything is “grayed out,” then you are not logged + in as a user with enough privileges).

      2. Click on the Printing + Defaults button.

      3. On any of the two new tabs, + click on the + Advanced button.

      4. A new dialog opens. Compare + this one to the other. Are they + identical looking comparing one from + “B.5” and one from A.3".

    +Do you see any difference in the two settings dialogs? I do not either. However, only the last one, which +you arrived at with steps C.1 through 6 will permanently save any settings which will then become the defaults +for new users. If you want all clients to have the same defaults, you need to conduct these steps as +administrator (printer admin in ) before +a client downloads the driver (the clients can later set their own per-user defaults +by following procedures A or B above). Windows 200x/XP allow per-user default settings and the ones the +administrator gives them, before they set up their own. The parents of the identically-looking dialogs have a slight difference in their window names; one is called Default Print +Values for Printer Foo on Server Bar" (which is the one you need) and the other is called +“Print Settings for Printer Foo on Server Bar”. The last one is the one you +arrive at when you right-click on the printer and select Print Settings.... This +is the one that you were taught to use back in the days of Windows NT, so it is only natural to try the +same way with Windows 200x/XP. You would not dream that there is now a different path to arrive at an +identically looking, but functionally different, dialog to set defaults for all users. +

    Tip

    Try (on Windows 200x/XP) to run this command (as a user with the right privileges):

    rundll32 printui.dll,PrintUIEntry /p /t3 /n\\SAMBA-SERVER\printersharename

    -to see the tab with the Printing Defaults... -button (the one you need). Also run this command: +To see the tab with the Printing Defaults button (the one you need),also run this command:

    rundll32 printui.dll,PrintUIEntry /p /t0 /n\\SAMBA-SERVER\printersharename

    -to see the tab with the Printing Preferences... -button (the one which doesn't set system-wide defaults). You can -start the commands from inside a DOS box" or from the Start --- Run... menu. -

    Supporting large Numbers of Printers

    -One issue that has arisen during the recent development phase of Samba -is the need to support driver downloads for 100's of printers. Using -Windows NT APW here is somewhat awkward (to say the least). If you -don't want to acquire RSS pains from such the printer installation -clicking orgy alone, you need to think about a non-interactive script. +To see the tab with the Printing Preferences +button (the one which does not set system-wide defaults), you can +start the commands from inside a DOS box" or from Start -> Run. +

    Supporting Large Numbers of Printers

    +One issue that has arisen during the recent development phase of Samba is the need to support driver +downloads for hunderds of printers. Using Windows NT APW here is somewhat awkward (to say the least). If +you do not want to acquire RSS pains from the printer installation clicking orgy alone, you need +to think about a non-interactive script.

    -If more than one printer is using the same driver, the -rpcclient setdriver command can be used to set the -driver associated with an installed queue. If the driver is uploaded -to [print$] once and registered with the -printing TDBs, it can be used by multiple print queues. In this case -you just need to repeat the setprinter subcommand -of rpcclient for every queue (without the need to -conduct the adddriver again and again). The -following is an example of how this could be accomplished: +If more than one printer is using the same driver, the rpcclient setdriver +command can be used to set the driver associated with an installed queue. If the driver is uploaded to +[print$] once and registered with the printing TDBs, it can be used by +multiple print queues. In this case, you just need to repeat the setprinter subcommand of +rpcclient for every queue (without the need to conduct the adddriver +repeatedly). The following is an example of how this could be accomplished: 

     root# rpcclient SAMBA-CUPS -U root%secret -c 'enumdrivers'
  cmd = enumdrivers
@@ -1644,7 +1411,7 @@ following is an example of how this could be accomplished:
    Driver Name: [dm9110]
 
  Printer Driver Info 1:
-   Driver Name: [myphantasydrivername]
+   Driver Name: [mydrivername]
 
  [....]

    @@ -1661,7 +1428,7 @@ following is an example of how this could be accomplished: 

     root# rpcclient SAMBA-CUPS -U root%secret -c \
-  'setdriver dm9110 "Heidelberg Digimaster 9110 (PS)"'
+  'setdriver dm9110 "Heidelberg Digimaster 9110 (PS)"'
  cmd = setdriver dm9110 Heidelberg Digimaster 9110 (PPD)
  Successfully set dm9110 to driver Heidelberg Digimaster 9110 (PS).

    @@ -1678,9 +1445,9 @@ following is an example of how this could be accomplished: 

    -root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 myphantasydrivername'
- cmd = setdriver dm9110 myphantasydrivername
- Successfully set dm9110 to myphantasydrivername.
+root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 mydrivername'
+ cmd = setdriver dm9110 mydrivername
+ Successfully set dm9110 to mydrivername.
 

    @@ -1688,119 +1455,94 @@ following is an example of how this could be accomplished:
  cmd = enumprinters
    flags:[0x800000]
    name:[\\SAMBA-CUPS\dm9110]
-   description:[\\SAMBA-CUPS\dm9110,myphantasydrivername,\
+   description:[\\SAMBA-CUPS\dm9110,mydrivername,\
      110ppm HiVolume DANKA Stuttgart]
    comment:[110ppm HiVolume DANKA Stuttgart]
  [....]

    -It may be not easy to recognize: but the first call to -enumprinters showed the "dm9110" printer with an -empty string where the driver should have been listed (between the 2 -commas in the "description" field). After the -setdriver command succeeded, all is well. (The -CUPS Printing chapter has more info about the installation of printer -drivers with the help of rpcclient). -

    Adding new Printers with the Windows NT APW

    -By default, Samba exhibits all printer shares defined in -smb.conf in the -Printers... folder. Also located in this folder -is the Windows NT Add Printer Wizard icon. The APW will be shown only -if: -

    • ...the connected user is able to successfully execute -an OpenPrinterEx(\\server) with administrative -privileges (i.e. root or printer admin). -

      Tip

      Try this from a Windows 2K/XP DOS box command prompt: -

      -runas /netonly /user:root rundll32 printui.dll,PrintUIEntry /p /t0 /n \\SAMBA-SERVER\printersharename -

      -and click on Printing Preferences... -

    • ... contains the setting -show add printer wizard = yes (the -default).

    +It may not be easy to recognize that the first call to enumprinters showed the +“dm9110” printer with an empty string where the driver should have been listed (between +the 2 commas in the description field). After the setdriver command +succeeded, all is well. +

    Adding New Printers with the Windows NT APW

    +By default, Samba exhibits all printer shares defined in smb.conf in the Printers +folder. Also located in this folder is the Windows NT Add Printer Wizard icon. The APW will be shown only if: +

    • + The connected user is able to successfully execute an OpenPrinterEx(\\server) with + administrative privileges (i.e., root or printer admin). +

      Tip

      Try this from a Windows 200x/XP DOS box command prompt: +

      + runas /netonly /user:root rundll32 printui.dll,PrintUIEntry /p /t0 /n \\SAMBA-SERVER\printersharename +

      + Click on Printing Preferences. +

    • ... contains the setting + show add printer wizard = yes (the + default).

    The APW can do various things: -

    • upload a new driver to the Samba -[print$] share;

    • associate an uploaded driver with an existing (but -still "driverless") print queue;

    • exchange the currently used driver for an existing -print queue with one that has been uploaded before;

    • add an entirely new printer to the Samba host (only in -conjunction with a working add printer command; -a corresponding delete printer command for -removing entries from the Printers... folder -may be provided too)

    -The last one (add a new printer) requires more effort than the -previous ones. In order to use the APW to successfully add a printer -to a Samba server, the add printer command must -have a defined value. The program hook must successfully add the -printer to the UNIX print system (i.e. to -/etc/printcap, -/etc/cups/printers.conf or other appropriate -files) and to if necessary. +

    • + Upload a new driver to the Samba [print$] share. +

    • + Associate an uploaded driver with an existing (but still driverless) print queue. +

    • + Exchange the currently used driver for an existing print queue with one that has been uploaded before. +

    • + Add an entirely new printer to the Samba host (only in conjunction with a working + add printer command. A corresponding + delete printer command for removing entries from the + Printers folder may also be provided). +

    +The last one (add a new printer) requires more effort than the previous ones. To use +the APW to successfully add a printer to a Samba server, the add printer command must have a defined value. The program hook must successfully +add the printer to the UNIX print system (i.e., to /etc/printcap, +/etc/cups/printers.conf or other appropriate files) and to smb.conf if necessary.

    -When using the APW from a client, if the named printer share does not -exist, smbd will execute the add printer -command and reparse to the -to attempt to locate the new printer share. If the share is still not -defined, an error of Access Denied is -returned to the client. Note that the add printer command is executed under the context of the connected -user, not necessarily a root account. A map to guest = bad user may have connected you unwittingly under the wrong -privilege; you should check it by using the -smbstatus command. -

    Weird Error Message Cannot connect under a -different Name

    -Once you are connected with the wrong credentials, there is no means -to reverse the situation other than to close all Explorer windows, and -perhaps reboot. -

    • The net use \\SAMBA-SERVER\sharename -/user:root gives you an error message: Multiple -connections to a server or a shared resource by the same user -utilizing the several user names are not allowed. Disconnect all -previous connections to the server, resp. the shared resource, and try -again.

    • Every attempt to "connect a network drive" to -\\SAMBASERVER\\print$ to z: is countered by the -pertinacious message. This network folder is currently -connected under different credentials (username and password). -Disconnect first any existing connection to this network share in -order to connect again under a different username and -password.

    -So you close all connections. You try again. You get the same -message. You check from the Samba side, using -smbstatus. Yes, there are some more -connections. You kill them all. The client still gives you the same -error message. You watch the smbd.log file on a very high debug level -and try re-connect. Same error message, but not a single line in the -log. You start to wonder if there was a connection attempt at all. You -run ethereal and tcpdump while you try to connect. Result: not a -single byte goes on the wire. Windows still gives the error -message. You close all Explorer Windows and start it again. You try to -connect - and this times it works! Windows seems to cache connection -info somewhere and doesn't keep it up to date (if you are unlucky you -might need to reboot to get rid of the error message). -

    Be careful when assembling Driver Files

    -You need to be very careful when you take notes about the files and -belonging to a particular driver. Don't confuse the files for driver -version "0" (for Win95/98/ME, going into -[print$]/WIN/0/), driver version "2" (Kernel Mode -driver for WinNT, going into [print$]/W32X86/2/ -may be used on Win2K/XP too), and driver version -"3" (non-Kernel Mode driver going into -[print$]/W32X86/3/ can not -be used on WinNT). Very often these different driver versions contain -files carrying the same name; but still the files are very different! -Also, if you look at them from the Windows Explorer (they reside in -%WINDOWS%\system32\spool\drivers\W32X86\) you -will probably see names in capital letters, while an "enumdrivers" -command from Samba would show mixed or lower case letters. So it is -easy to confuse them. If you install them manually using -rpcclient and subcommands, you may even succeed -without an error message. Only later, when you try install on a -client, you will encounter error messages like This -server has no appropriate driver for the printer. +When using the APW from a client, if the named printer share does not exist, smbd will execute the +add printer command and reparse to the to attempt to locate the new printer +share. If the share is still not defined, an error of Access Denied is returned to +the client. The add printer command is executed +under the context of the connected user, not necessarily a root account. A map to guest = bad user may have connected you unwittingly under the wrong +privilege. You should check it by using the smbstatus command. +

    Error Message: “Cannot connect under a different Name”

    +Once you are connected with the wrong credentials, there is no means to reverse the situation other than +to close all Explorer Windows, and perhaps reboot. +

    • + The net use \\SAMBA-SERVER\sharename /user:root gives you an error message: + “Multiple connections to a server or a shared resource by the same user utilizing + the several user names are not allowed. Disconnect all previous connections to the server, + resp. the shared resource, and try again.” +

    • + Every attempt to “connect a network drive” to \\SAMBASERVER\\print$ + to z: is countered by the pertinacious message: “This + network folder is currently connected under different credentials (username and password). + Disconnect first any existing connection to this network share in order to connect again under + a different username and password”. +

    +So you close all connections. You try again. You get the same message. You check from the Samba side, +using smbstatus. Yes, there are more connections. You kill them all. The client +still gives you the same error message. You watch the smbd.log file on a high debug level and try +reconnect. Same error message, but not a single line in the log. You start to wonder if there was a +connection attempt at all. You run ethereal and tcpdump while you try to connect. Result: not a single +byte goes on the wire. Windows still gives the error message. You close all Explorer windows and start it +again. You try to connect and this times it works! Windows seems to cache connection informtion somewhere and +does not keep it up-to-date (if you are unlucky you might need to reboot to get rid of the error message). +

    Take Care When Assembling Driver Files

    +You need to be extremely careful when you take notes about the files and belonging to a particular +driver. Don't confuse the files for driver version “0” (for Windows 9x/Me, going into +[print$]/WIN/0/), driver version 2 (Kernel Mode driver for Windows NT, +going into [print$]/W32X86/2/ may be used on Windows 200x/XP also), and +driver version “3” (non-Kernel Mode driver going into [print$]/W32X86/3/ +cannot be used on Windows NT). Quite often these different driver versions contain +files that have the same name but actually are very different. If you look at them from +the Windows Explorer (they reside in %WINDOWS%\system32\spool\drivers\W32X86\), +you will probably see names in capital letters, while an enumdrivers command from Samba +would show mixed or lower case letters. So it is easy to confuse them. If you install them manually using +rpcclient and subcommands, you may even succeed without an error message. Only later, +when you try install on a client, you will encounter error messages like This server +has no appropriate driver for the printer.

    -Here is an example. You are invited to look very closely at the -various files, compare their names and their spelling, and discover -the differences in the composition of the version-2 and -3 sets -Note: the version-0 set contained 40 (!) -Dependentfiles, so I left it out for space -reasons: +Here is an example. You are invited to look closely at the various files, compare their names and +their spelling, and discover the differences in the composition of the version 2 and 3 sets. Note: the +version 0 set contained 40 Dependentfiles, so I left it out for space reasons: 

     root# rpcclient -U 'Administrator%secret' -c 'enumdrivers 3' 10.160.50.8 
 
@@ -1860,7 +1602,7 @@ reasons:
          Defaultdatatype: []

    -If we write the "version 2" files and the "version 3" files +If we write the “version 2” files and the “version 3” files into different text files and compare the result, we see this picture: 

    @@ -1892,13 +1634,14 @@ picture:
                              > cns3ggr.dll

    -Don't be fooled though! Driver files for each version with identical + +Do not be fooled! Driver files for each version with identical names may be different in their content, as you can see from this size comparison: 

     root# for i in cns3g.hlp cns3gui.dll cns3g.dll; do                  \
            smbclient //10.160.50.8/print\$ -U 'Administrator%xxxx' \
-           -c "cd W32X86/3; dir $i; cd .. ; cd 2; dir $i";      \
+           -c "cd W32X86/3; dir $i; cd .. ; cd 2; dir $i";      \
 		   done
 
   CNS3G.HLP               A   122981  Thu May 30 02:31:00 2002
@@ -1909,248 +1652,213 @@ comparison:
 
   CNS3G.DLL               A  1145088  Thu May 30 02:31:00 2002
   CNS3G.DLL               A    15872  Thu May 30 02:31:00 2002
-

    -In my example were even more differences than shown here. Conclusion: -you must be very careful to select the correct driver files for each -driver version. Don't rely on the names alone. Don't interchange files +In my example were even more differences than shown here. Conclusion: you must be careful to select +the correct driver files for each driver version. Don't rely on the +names alone and don't interchange files belonging to different driver versions. -

    Samba and Printer Ports

    -Windows NT/2000 print servers associate a port with each -printer. These normally take the form of LPT1:, -COM1:, FILE:, etc. Samba -must also support the concept of ports associated with a printer. By -default, only one printer port, named "Samba Printer Port", exists on -a system. Samba does not really need such a "port" in order to print; -it rather is a requirement of Windows clients. They insist on being -told about an available port when they request this info, otherwise -they throw an error message at you. So Samba fakes the port +

    Samba and Printer Ports

    +Windows NT/2000 print servers associate a port with each printer. These normally take the form of +LPT1:, COM1:, +FILE:, and so on. Samba must also +support the concept of ports associated with a printer. By default, only one printer port, named “Samba +Printer Port”, exists on a system. Samba does not really need such a “port” in order +to print; rather it is a requirement of Windows clients. They insist on being told about an available +port when they request this information, otherwise they throw an error message at you. So Samba fakes the port information to keep the Windows clients happy.

    -Note that Samba does not support the concept of "Printer Pooling" -internally either. Printer Pooling assigns a logical printer to -multiple ports as a form of load balancing or fail over. +Samba does not support the concept of Printer Pooling internally either. Printer +Pooling assigns a logical printer to multiple ports as a form of load balancing or fail over.

    -If you require that multiple ports be defined for some reason or -another (“My users and my Boss should not know that they are -working with Samba”), possesses a -enumports command which can be used to define -an external program that generates a listing of ports on a system. -

    Avoiding the most common Misconfigurations of the Client Driver

    -So - printing works, but there are still problems. Most jobs print -well, some don't print at all. Some jobs have problems with fonts, -which don't look good at all. Some jobs print fast, and some are -dead-slow. We can't cover it all; but we want to encourage you to read -the little paragraph about "Avoiding the wrong PostScript Driver -Settings" in the CUPS Printing part of this document. -

    The Imprints Toolset

    -The Imprints tool set provides a UNIX equivalent of the -Windows NT Add Printer Wizard. For complete information, please -refer to the Imprints web site -at http://imprints.sourceforge.net/ -as well as the documentation included with the imprints source -distribution. This section will only provide a brief introduction -to the features of Imprints. -

    Attention! Maintainer required.  -Unfortunately, the Imprints toolset is no longer maintained. As of -December, 2000, the project is in need of a new maintainer. The most -important skill to have is decent perl coding and an interest in -MS-RPC based printing using Samba. If you wish to volunteer, please -coordinate your efforts on the samba-technical mailing list. The -toolset is still in usable form; but only for a series of older -printer models, where there are prepared packages to use. Packages for -more up to date print devices are needed if Imprints should have a -future.

    What is Imprints?

    +If you require multiple ports be defined for some reason or another (my users and my boss should not know +that they are working with Samba), configure enumports command +which can be used to define an external program that generates a listing of ports on a system. +

    Avoiding Common Client Driver Misconfiguration

    +So now the printing works, but there are still problems. Most jobs print well, some do not print at +all. Some jobs have problems with fonts, which do not look good. Some jobs print fast and some +are dead-slow. We cannot cover it all, but we want to encourage you to read the brief paragraph about +“Avoiding the Wrong PostScript Driver Settings” in the CUPS Printing part of this document. +

    The Imprints Toolset

    +The Imprints tool set provides a UNIX equivalent of the Windows NT Add Printer +Wizard. For complete information, please refer to the Imprints Web site at http://imprints.sourceforge.net/ as well as the documentation +included with the imprints source distribution. This section only provides a brief introduction to +the features of Imprints. +

    +Unfortunately, the Imprints toolset is no longer maintained. As of December 2000, the project is in +need of a new maintainer. The most important skill to have is Perl coding and an interest in MS-RPC-based +printing used in Samba. If you wish to volunteer, please coordinate +your efforts on the Samba technical +mailing list. The toolset is still in usable form, but only for a series of older printer models where +there are prepared packages to use. Packages for more up-to-date print devices are needed if Imprints +should have a future. +

    What is Imprints?

    Imprints is a collection of tools for supporting these goals: -

    • Providing a central repository information regarding -Windows NT and 95/98 printer driver packages

    • Providing the tools necessary for creating the -Imprints printer driver packages.

    • Providing an installation client which will obtain -printer drivers from a central internet (or intranet) Imprints Server -repository and install them on remote Samba and Windows NT4 print -servers.

    Creating Printer Driver Packages

    -The process of creating printer driver packages is beyond the scope of -this document (refer to Imprints.txt also included with the Samba -distribution for more information). In short, an Imprints driver -package is a gzipped tarball containing the driver files, related INF -files, and a control file needed by the installation client. -

    The Imprints Server

    -The Imprints server is really a database server that may be queried -via standard HTTP mechanisms. Each printer entry in the database has -an associated URL for the actual downloading of the package. Each +

    • + Providing a central repository of information regarding Windows NT and 95/98 printer driver packages. +

    • + Providing the tools necessary for creating the Imprints printer driver packages. +

    • + Providing an installation client that will obtain printer drivers from a central Internet (or intranet) Imprints Server + repository and install them on remote Samba and Windows NT4 print servers. +

    Creating Printer Driver Packages

    +The process of creating printer driver packages is beyond the scope of this document (refer to Imprints.txt +also included with the Samba distribution for more information). In short, an Imprints driver package +is a gzipped tarball containing the driver files, related INF files, and a control file needed by the +installation client. +

    The Imprints Server

    +The Imprints server is really a database server that may be queried via standard HTTP mechanisms. Each +printer entry in the database has an associated URL for the actual downloading of the package. Each package is digitally signed via GnuPG which can be used to verify that -package downloaded is actually the one referred in the Imprints -database. It is strongly recommended that this security check -not be disabled. -

    The Installation Client

    -More information regarding the Imprints installation client is -available in the Imprints-Client-HOWTO.ps file -included with the imprints source package. -

    -The Imprints installation client comes in two forms. -

    • a set of command line Perl scripts

    • a GTK+ based graphical interface to the command line Perl -scripts

    -The installation client (in both forms) provides a means of querying -the Imprints database server for a matching list of known printer -model names as well as a means to download and install the drivers on +the package downloaded is actually +the one referred in the Imprints database. It is strongly recommended that this security check +not be disabled. +

    The Installation Client

    +More information regarding the Imprints installation client is available from the the documentation file +Imprints-Client-HOWTO.ps that is included with the Imprints source package. The Imprints +installation client comes in two forms: +

    • A set of command line Perl scripts.

    • A GTK+ based graphical interface to the command line Perl scripts.

    +The installation client (in both forms) provides a means of querying the Imprints database server for +a matching list of known printer model names as well as a means to download and install the drivers on remote Samba and Windows NT print servers.

    -The basic installation process is in four steps and perl code is -wrapped around smbclient and rpcclient +The basic installation process is in four steps and Perl code is wrapped around smbclient and rpcclient.

    • - foreach (supported architecture for a given driver) -

      1. rpcclient: Get the appropriate upload directory on the remote server

      2. smbclient: Upload the driver files

      3. rpcclient: Issues an AddPrinterDriver() MS-RPC

      -

    • rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer

    -One of the problems encountered when implementing the Imprints tool -set was the name space issues between various supported client -architectures. For example, Windows NT includes a driver named "Apple -LaserWriter II NTX v51.8" and Windows 95 calls its version of this -driver "Apple LaserWriter II NTX" + For each supported architecture for a given driver: +

    1. rpcclient: Get the appropriate upload directory on the remote server.

    2. smbclient: Upload the driver files.

    3. rpcclient: Issues an AddPrinterDriver() MS-RPC.

    +

  • rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer.

    • +One of the problems encountered when implementing the Imprints tool set was the name space issues between +various supported client architectures. For example, Windows NT includes a driver named “Apple LaserWriter +II NTX v51.8” and Windows 95 calls its version of this driver “Apple LaserWriter II NTX”.

    -The problem is how to know what client drivers have been uploaded for -a printer. An astute reader will remember that the Windows NT Printer -Properties dialog only includes space for one printer driver name. A -quick look in the Windows NT 4.0 system registry at +The problem is how to know what client drivers have been uploaded for a printer. An astute reader will +remember that the Windows NT Printer Properties dialog only includes space for one printer driver name. A +quick look in the Windows NT 4.0 system registry at:

    HKLM\System\CurrentControlSet\Control\Print\Environment

    -will reveal that Windows NT always uses the NT driver name. This is -ok as Windows NT always requires that at least the Windows NT version -of the printer driver is present. However, Samba does not have the -requirement internally. Therefore, how can you use the NT driver name -if is has not already been installed? -

    -The way of sidestepping this limitation is to require that all -Imprints printer driver packages include both the Intel Windows NT and -95/98 printer drivers and that NT driver is installed first. -

    Add Network Printers at Logon without User Interaction

    -The following MS Knowledge Base article may be of some help if you -need to handle Windows 2000 clients: How to Add Printers -with No User Interaction in Windows 2000. ( http://support.microsoft.com/default.aspx?scid=kb;en-us;189105 -). It also applies to Windows XP Professional clients. +will reveal that Windows NT always uses the NT driver name. This is okay as Windows NT always requires +that at least the Windows NT version of the printer driver is present. Samba does not have the +requirement internally, therefore, “How can you use the NT driver name if it has not already been installed?”

    -The ideas sketched out below are inspired by this article. It -describes a commandline method which can be applied to install -network and local printers and their drivers. This is most useful -if integrated in Logon Scripts. You can see what options are -available by typing in a command prompt ("DOS box") this: +The way of sidestepping this limitation is to require that all Imprints printer driver packages include both the Intel Windows NT and +95/98 printer drivers and that the NT driver is installed first. +

    Adding Network Printers without User Interaction

    +The following MS Knowledge Base article may be of some help if you need to handle Windows 2000 +clients: How to Add Printers with No User Interaction in Windows 2000, (http://support.microsoft.com/default.aspx?scid=kb;en-us;189105). +It also applies to Windows XP Professional clients. +The ideas sketched out in this section are inspired by this article, which describes a commandline method that can be +applied to install network and local printers and their drivers. This is most useful if integrated in Logon +Scripts. You can see what options are available by typing in the command prompt (DOS box):

    rundll32 printui.dll,PrintUIEntry /?

    -A window pops up which shows you all of the commandline switches -available. An extensive list of examples is also provided. This is -only for Win 2k/XP. It doesn't work on WinNT. WinNT has probably some -other tools in the respective Resource Kit. Here is a suggestion about -what a client logon script might contain, with a short explanation of -what the lines actually do (it works if 2k/XP Windows clients access -printers via Samba, but works for Windows-based print servers too): +A window pops up that shows you all of the commandline switches available. An extensive list of examples +is also provided. This is only for Win 200x/XP, it does not work on +Windows NT. Windows NT probably has +some other tools in the respective Resource Kit. Here is a suggestion about what a client logon script +might contain, with a short explanation of what the lines actually do (it works if 200x/XP Windows +clients access printers via Samba, and works for Windows-based print servers too): 

    -rundll32 printui.dll,PrintUIEntry /dn /n "\\sambacupsserver\infotec2105-IPDS" /q
-rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\infotec2105-PS"
-rundll32 printui.dll,PrintUIEntry /y /n "\\sambacupsserver\infotec2105-PS"
+rundll32 printui.dll,PrintUIEntry /dn /n "\\cupsserver\infotec2105-IPDS" /q
+rundll32 printui.dll,PrintUIEntry /in /n "\\cupsserver\infotec2105-PS"
+rundll32 printui.dll,PrintUIEntry /y /n "\\cupsserver\infotec2105-PS"

    Here is a list of the used commandline parameters: -

    /dn

    deletes a network printer

    /q

    quiet modus

    /n

    names a printer

    /in

    adds a network printer connection

    /y

    sets printer as default printer

    • Line 1 deletes a possibly existing previous network -printer infotec2105-IPDS (which had used native -Windows drivers with LPRng that were removed from the server which was -converted to CUPS). The /q at the end eliminates -"Confirm" or error dialog boxes popping up. They should not be -presented to the user logging on.

    • Line 2 adds the new printer -infotec2105-PS (which actually is same physical -device but is now run by the new CUPS printing system and associated -with the CUPS/Adobe PS drivers). The printer and its driver -must have been added to Samba prior to the user -logging in (e.g. by a procedure as discussed earlier in this chapter, -or by running cupsaddsmb). The driver is now -auto-downloaded to the client PC where the user is about to log -in.

    • Line 3 sets the default printer to this new network -printer (there might be several other printers installed with this -same method and some may be local as well -- so we decide for a -default printer). The default printer selection may of course be -different for different users.

    -Note that the second line only works if the printer -infotec2105-PS has an already working print queue -on "sambacupsserver", and if the printer drivers have successfully been -uploaded (via APW , -smbclient/rpcclient or -cupsaddsmb) into the -[print$] driver repository of Samba. Also, some -Samba versions prior to version 3.0 required a re-start of smbd after -the printer install and the driver upload, otherwise the script (or -any other client driver download) would fail. +

    /dn

    deletes a network printer

    /q

    quiet modus

    /n

    names a printer

    /in

    adds a network printer connection

    /y

    sets printer as default printer

    • + Line 1 deletes a possibly existing previous network printer infotec2105-IPDS + (which had used native Windows drivers with LPRng that were removed from the server that was + converted to CUPS). The /q at the end eliminates Confirm + or error dialog boxes from popping up. They should not be presented to the user logging on. +

    • + Line 2 adds the new printer + infotec2105-PS (which actually is the same + physical device but is now run by the new CUPS printing system and associated with the + CUPS/Adobe PS drivers). The printer and its driver must have been added to Samba prior to + the user logging in (e.g., by a procedure as discussed earlier in this chapter, or by running + cupsaddsmb). The driver is now auto-downloaded to the client PC where the + user is about to log in. +

    • + Line 3 sets the default printer to this new network printer (there might be several other + printers installed with this same method and some may be local as well, so we decide for a + default printer). The default printer selection may, of course, be different for different users. +

    +The second line only works if the printer infotec2105-PS has an already working +print queue on the cupsserver, and if the +printer drivers have been successfully uploaded +(via the APW, smbclient/rpcclient, or cupsaddsmb) +into the [print$] driver repository of Samba. Some Samba versions +prior to version 3.0 required a re-start of smbd after the printer install and the driver upload, +otherwise the script (or any other client driver download) would fail.

    -Since there no easy way to test for the existence of an installed -network printer from the logon script, the suggestion is: don't bother -checking and just allow the deinstallation/reinstallation to occur -every time a user logs in; it's really quick anyway (1 to 2 seconds). +Since there no easy way to test for the existence of an installed network printer from the logon script, +do not bother checking, just allow the deinstallation/reinstallation to occur every time a user logs in; +it's really quick anyway (1 to 2 seconds).

    The additional benefits for this are: -

    • It puts in place any printer default setup changes -automatically at every user logon.

    • It allows for "roaming" users' login into the domain from -different workstations.

    -Since network printers are installed per user this much simplifies the -process of keeping the installation up-to-date. The extra few seconds -at logon time will not really be noticeable. Printers can be centrally -added, changed, and deleted at will on the server with no user -intervention required on the clients (you just need to keep the logon -scripts up to date). -

    The addprinter command

    -The addprinter command can be configured to be a -shell script or program executed by Samba. It is triggered by running -the APW from a client against the Samba print server. The APW asks the -user to fill in several fields (such as printer name, driver to be -used, comment, port monitor, etc.). These parameters are passed on to -Samba by the APW. If the addprinter command is designed in a way that -it can create a new printer (through writing correct printcap entries -on legacy systems, or execute the lpadmin command -on more modern systems) and create the associated share in -, then the APW will in effect really -create a new printer on Samba and the UNIX print subsystem! -

    Migration of "Classical" printing to Samba

    -The basic "NT-style" printer driver management has not changed -considerably in 3.0 over the 2.2.x releases (apart from many small -improvements). Here migration should be quite easy, especially if you -followed previous advice to stop using deprecated parameters in your -setup. For migrations from an existing 2.0.x setup, or if you -continued "Win9x-style" printing in your Samba 2.2 installations, it -is more of an effort. Please read the appropriate release notes and -the HOWTO Collection for 2.2. You can follow several paths. Here are -possible scenarios for migration: -

    • You need to study and apply the new Windows NT printer -and driver support. Previously used parameters printer -driver file, printer driver and -printer driver location are no longer -supported.

    • If you want to take advantage of WinNT printer driver -support you also need to migrate the Win9x/ME drivers to the new -setup.

    • An existing printers.def file - (the one specified in the now removed parameter printer driver file) will work no longer with samba 3. In -3.0, smbd attempts to locate a Win9x/ME driver files for the printer -in [print$] and additional settings in the TDB -and only there; if it fails it will not (as 2.2.x -used to do) drop down to using a printers.def -(and all associated parameters). The make_printerdef tool is removed -and there is no backwards compatibility for this.

    • You need to install a Windows 9x driver into the -[print$] share for a printer on your Samba -host. The driver files will be stored in the "WIN40/0" subdirectory of -[print$], and some other settings and info go -into the printing-related TDBs.

    • If you want to migrate an existing -printers.def file into the new setup, the current -only solution is to use the Windows NT APW to install the NT drivers -and the 9x drivers. This can be scripted using smbclient and -rpcclient. See the Imprints installation client at: -

      - http://imprints.sourceforge.net/ -

      -for an example. See also the discussion of rpcclient usage in the -"CUPS Printing" section.

    Publishing Printer Information in Active Directory or LDAP

    -We will publish an update to this section shortly. -

    Common Errors

    I give my root password but I don't get access

    -Don't confuse the root password which is valid for the UNIX system -(and in most cases stored in the form of a one-way hash in a file -named /etc/shadow) with the password used to -authenticate against Samba!. Samba doesn't know the UNIX password; for -root to access Samba resources via Samba-type access, a Samba account -for root must be created first. This is often done with the -smbpasswd command. -

    My printjobs get spooled into the spooling directory, but then get lost

    -Don't use the existing UNIX print system spool directory for the Samba -spool directory. It may seem convenient and a saving of space, but it -only leads to problems. The two must be separate. -

    Prev Up Next
    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba Home Chapter 19. CUPS Printing Support in Samba 3.0
    +

    • + It puts in place any printer default setup changes automatically at every user logon. +

    • + It allows for “roaming” users' login into the domain from different workstations. +

    +Since network printers are installed per user, this much simplifies the process of keeping the installation +up-to-date. The few extra seconds at logon time will not really be noticeable. Printers can be centrally +added, changed and deleted at will on the server with no user intervention required from the clients +(you just need to keep the logon scripts up-to-date). +

    The addprinter Command

    +The addprinter command can be configured to be a shell script or program executed by +Samba. It is triggered by running the APW from a client against the Samba print server. The APW asks +the user to fill in several fields (such as printer name, driver to be used, comment, port monitor, +and so on). These parameters are passed on to Samba by the APW. If the addprinter command is designed in a +way that it can create a new printer (through writing correct printcap entries on legacy systems, or +execute the lpadmin command on more modern systems) and create the associated share +in, then the APW will in effect really create a new printer on Samba and the UNIX print subsystem! +

    Migration of Classical Printing to Samba

    +The basic NT-style printer driver management has not changed considerably in 3.0 over the 2.2.x releases +(apart from many small improvements). Here migration should be quite easy, especially if you followed +previous advice to stop using deprecated parameters in your setup. For migrations from an existing 2.0.x +setup, or if you continued Windows 9x/Me-style printing in your Samba 2.2 installations, it is more of +an effort. Please read the appropriate release notes and the HOWTO Collection for Samba-2.2.x. You can +follow several paths. Here are possible scenarios for migration: +

    • + You need to study and apply the new Windows NT printer and driver support. Previously used + parameters printer driver file, printer driver + and printer driver location are no longer supported. +

    • + If you want to take advantage of Windows NT printer driver support, you also need to migrate the + Windows 9x/Me drivers to the new setup. +

    • + An existing printers.def file (the one specified in the now removed parameter + printer driver file) will no longer work with Samba-3. In 3.0, smbd attempts + to locate a Windows 9x/Me driver files for the printer in [print$] + and additional settings in the TDB and only there; if it fails, it will not + (as 2.2.x used to do) drop down to using a printers.def (and all associated + parameters). The make_printerdef tool is removed and there is no backward compatibility for this. +

    • You need to install a Windows 9x/Me driver into the + [print$] share for a printer on your Samba + host. The driver files will be stored in the “WIN40/0” subdirectory of + [print$], and some other settings and information go + into the printing-related TDBs.

    • If you want to migrate an existing + printers.def file into the new setup, the + only current + solution is to use the Windows NT APW to install the NT drivers + and the 9x/Me drivers. This can be scripted using smbclient and + rpcclient. See the Imprints installation client at: +

      + http://imprints.sourceforge.net/ +

      + for an example. See also the discussion of rpcclient usage in the + “CUPS Printing” section.

    Publishing Printer Information in Active Directory or LDAP

    +This will be addressed in a later update of this document. If you wish to volunteer your services to help +document this, please contact John H Terpstra. +

    Common Errors

    I Give My Root Password but I Do Not Get Access

    +Do not confuse the root password which is valid for the UNIX system (and in most cases stored in the +form of a one-way hash in a file named /etc/shadow), with the password used to +authenticate against Samba. Samba does not know the UNIX password. Root access to Samba resources +requires that a Samba account for root must first be created. This is done with the smbpasswd +command as follows: +

    +root#  smbpasswd -a root
+New SMB password: secret
+Retype new SMB password: secret
+

    My Print Jobs Get Spooled into the Spooling Directory, but Then Get Lost

    +Do not use the existing UNIX print system spool directory for the Samba spool directory. It may seem +convenient and a savings of space, but it only leads to problems. The two must be separate. +

    Prev Up Next
    Chapter 17. Hosting a Microsoft Distributed File System tree on Samba Home Chapter 19. CUPS Printing Support
    diff --git a/docs/htmldocs/problems.html b/docs/htmldocs/problems.html index 24ddc7c02c..41ec5ccbd2 100644 --- a/docs/htmldocs/problems.html +++ b/docs/htmldocs/problems.html @@ -1,138 +1,135 @@ -Chapter 34. Analysing and solving samba problems
    Chapter 34. Analysing and solving samba problems
    Prev Part V. Troubleshooting Next

    Chapter 34. Analysing and solving samba problems

    Gerald (Jerry) Carter

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    David Bannon

    Samba Team

    8 Apr 2003

    Table of Contents

    Diagnostics tools
    Debugging with Samba itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting help from the mailing lists
    How to get off the mailing lists

    +Chapter 34. Analyzing and Solving Samba Problems

    Chapter 34. Analyzing and Solving Samba Problems
    Prev Part V. Troubleshooting Next

    Chapter 34. Analyzing and Solving Samba Problems

    Gerald (Jerry) Carter

    Samba Team

    Jelmer R. Vernooij

    The Samba Team

    David Bannon

    Samba Team

    Dan Shearer

    Samba Team

    8 Apr 2003

    Table of Contents

    Diagnostics Tools
    Debugging with Samba Itself
    Tcpdump
    Ethereal
    The Windows Network Monitor
    Useful URLs
    Getting Mailing List Help
    How to Get Off the Mailing Lists

    There are many sources of information available in the form -of mailing lists, RFC's and documentation. The docs that come -with the samba distribution contain very good explanations of -general SMB topics such as browsing.

    Diagnostics tools

    With SMB networking, it is often not immediately clear what +of mailing lists, RFCs and documentation. The documentation that comes +with the Samba distribution contains good explanations of +general SMB topics such as browsing.

    Diagnostics Tools

    With SMB networking, it is often not immediately clear what the cause is of a certain problem. Samba itself provides rather useful information, but in some cases you might have to fall back to using a sniffer. A sniffer is a program that -listens on your LAN, analyses the data sent on it and displays it -on the screen.

    Debugging with Samba itself

    -One of the best diagnostic tools for debugging problems is Samba itself. -You can use the -d option for both smbd and nmbd to specify what -debug level at which to run. See the man pages on smbd, nmbd and -smb.conf for more information on debugging options. The debug +listens on your LAN, analyzes the data sent on it and displays it +on the screen.

    Debugging with Samba Itself

    +One of the best diagnostic tools for debugging problems is Samba itself. +You can use the -d option for both smbd and nmbd to specify the +debug level at which to run. +See the man pages for smbd, nmbd and +smb.conf for more information regarding debugging options. The debug level can range from 1 (the default) to 10 (100 for debugging passwords).

    -Another helpful method of debugging is to compile samba using the -gcc -g flag. This will include debug -information in the binaries and allow you to attach gdb to the -running smbd / nmbd process. In order to attach gdb to an smbd +Another helpful method of debugging is to compile Samba using the +gcc -g flag. This will include debug information in the binaries and +allow you to attach gdb to the running smbd/nmbd process. +To attach gdb to an smbd process for an NT workstation, first get the workstation to make the connection. Pressing ctrl-alt-delete and going down to the domain box -is sufficient (at least, on the first time you join the domain) to -generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation -maintains an open connection, and therefore there will be an smbd +is sufficient (at least, the first time you join the domain) to +generate a LsaEnumTrustedDomains. Thereafter, the workstation +maintains an open connection and there will be an smbd process running (assuming that you haven't set a really short smbd -idle timeout) So, in between pressing ctrl alt delete, and actually -typing in your password, you can attach gdb and continue. +idle timeout). So, in between pressing ctrl-alt-delete and actually +typing in your password, you can attach gdb and continue.

    -Some useful samba commands worth investigating: +Some useful Samba commands worth investigating are: 

     $ testparm | more
 $ smbclient -L //{netbios name of server}
-

    Tcpdump

    Tcpdump was the first -unix sniffer with SMB support. It is a command-line utility and -nowadays, it's SMB support is somewhat less then that of ethereal -and tethereal.

    Ethereal

    -Ethereal is a graphical -sniffer, available for both unix (Gtk) and Windows. Ethereal's -SMB support is very good.

    For details on the use of ethereal, read the well-written -ethereal User Guide.

    -Listen for data on ports 137, 138, 139 and 445. E.g. -use the filter port 137 or port 138 or port 139 or port 445.

    A console version of ethereal is available as well and is called -tethereal.

    The Windows Network Monitor

    -For tracing things on the Microsoft Windows NT, Network Monitor -(aka. netmon) is available on the Microsoft Developer Network CD's, -the Windows NT Server install CD and the SMS CD's. The version of -netmon that ships with SMS allows for dumping packets between any two -computers (i.e. placing the network interface in promiscuous mode). +

    Tcpdump

    +Tcpdump was the first +UNIX sniffer with SMB support. It is a command-line utility and +now, its SMB support is somewhat lagging that of ethereal +and tethereal. +

    Ethereal

    +Ethereal is a graphical +sniffer, available for both UNIX (Gtk) and Windows. Ethereal's +SMB support is quite good.

    For details on the use of ethereal, read the well-written +Ethereal User Guide.

    Figure 34.1. Starting a capture.

    Starting a capture.

    +Listen for data on ports 137, 138, 139, and 445. For example, use the filter port 137, port 138, port 139, or port 445 as seen in .

    A console version of ethereal is available as well and is called +tethereal.

    Figure 34.2. Main ethereal data window.

    Main ethereal data window.

    The Windows Network Monitor

    +For tracing things on Microsoft Windows NT, Network Monitor +(aka Netmon) is available on Microsoft Developer Network CDs, +the Windows NT Server install CD and the SMS CDs. The version of +Netmon that ships with SMS allows for dumping packets between any two +computers (i.e., placing the network interface in promiscuous mode). The version on the NT Server install CD will only allow monitoring of network traffic directed to the local NT box and broadcasts on the -local subnet. Be aware that Ethereal can read and write netmon +local subnet. Be aware that Ethereal can read and write Netmon formatted files. -

    Installing 'Network Monitor' on an NT Workstation

    -Installing netmon on an NT workstation requires a couple -of steps. The following are for installing Netmon V4.00.349, which comes +

    Installing Network Monitor on an NT Workstation

    +Installing Netmon on an NT workstation requires a couple +of steps. The following are instructions for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 4.0, on Microsoft Windows NT -Workstation 4.0. The process should be similar for other versions of -Windows NT / Netmon. You will need both the Microsoft Windows +Workstation 4.0. The process should be similar for other versions of +Windows NT version of Netmon. You will need both the Microsoft Windows NT Server 4.0 Install CD and the Workstation 4.0 Install CD.

    Initially you will need to install Network Monitor Tools and Agent -on the NT Server. To do this -

    • Goto Start - Settings - Control Panel - - Network - Services - Add

    • Select the Network Monitor Tools and Agent and - click on OK.

    • Click OK on the Network Control Panel. -

    • Insert the Windows NT Server 4.0 install CD - when prompted.

    -At this point the Netmon files should exist in -%SYSTEMROOT%\System32\netmon\*.*. -Two subdirectories exist as well, parsers\ -which contains the necessary DLL's for parsing the netmon packet -dump, and captures\. +on the NT Server to do this: +

    • Go to Start -> Settings -> Control Panel -> + Network -> Services -> Add.

    • Select the Network Monitor Tools and Agent and click on OK.

    • Click on OK on the Network Control Panel.

    • Insert the Windows NT Server 4.0 install CD when prompted.

    +At this point, the Netmon files should exist in %SYSTEMROOT%\System32\netmon\*.*. +Two subdirectories exist as well, parsers\ which contains the necessary DLLs +for parsing the Netmon packet dump, and captures\.

    -In order to install the Netmon tools on an NT Workstation, you will -first need to install the 'Network Monitor Agent' from the Workstation -install CD. -

    • Goto Start - Settings - Control Panel - - Network - Services - Add

    • Select the Network Monitor Agent and click - on OK.

    • Click OK on the Network Control Panel. -

    • Insert the Windows NT Workstation 4.0 install - CD when prompted.

    -Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* -to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set -permissions as you deem appropriate for your site. You will need -administrative rights on the NT box to run netmon. -

    Installing 'Network Monitor' on an 9x Workstation

    -To install Netmon on a Windows 9x box install the network monitor agent -from the Windows 9x CD (\admin\nettools\netmon). There is a readme -file located with the netmon driver files on the CD if you need -information on how to do this. Copy the files from a working -Netmon installation. -

    Useful URLs

    Getting help from the mailing lists

    -There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror -and then click on Support and then click on -Samba related mailing lists. +To install the Netmon tools on an NT Workstation, you will first need to install the +Network Monitor Agent from the Workstation install CD. +

    • Go to Start -> Settings -> Control Panel -> + Network -> Services -> Add.

    • Select the Network Monitor Agent, click on OK.

    • Click on OK in the Network Control Panel. +

    • Insert the Windows NT Workstation 4.0 install CD when prompted.

    +Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon +to %SYSTEMROOT%\System32\netmon on the Workstation and set permissions +as you deem appropriate for your site. You will need administrative rights on the NT box to run Netmon. +

    Installing Network Monitor on Windows 9x/Me

    +To install Netmon on Windows 9x/Me, install the Network Monitor Agent +from the Windows 9x/Me CD (\admin\nettools\netmon). +There is a readme file located with the Netmon driver files on the CD if you need +information on how to do this. Copy the files from a working Netmon installation. +

    Useful URLs

    • See how Scott Merrill simulates a BDC behavior at + + http://www.skippy.net/linux/smb-howto.html.

    • FTP site for older SMB specs: + + ftp://ftp.microsoft.com/developr/drg/CIFS/

    Getting Mailing List Help

    +There are a number of Samba-related mailing lists. Go to http://samba.org, click on your nearest mirror +and then click on Support and next click on +Samba-related mailing lists.

    -For questions relating to Samba TNG go to -http://www.samba-tng.org/ -It has been requested that you don't post questions about Samba-TNG to the -main stream Samba lists.

    -If you post a message to one of the lists please observe the following guide lines : -

    • Always remember that the developers are volunteers, they are -not paid and they never guarantee to produce a particular feature at -a particular time. Any time lines are 'best guess' and nothing more. -

    • Always mention what version of samba you are using and what -operating system its running under. You should probably list the -relevant sections of your smb.conf file, at least the options -in [global] that affect PDC support.

    • In addition to the version, if you obtained Samba via -CVS mention the date when you last checked it out.

    • Try and make your question clear and brief, lots of long, -convoluted questions get deleted before they are completely read ! -Don't post html encoded messages (if you can select colour or font -size its html).

    • If you run one of those nifty 'I'm on holidays' things when -you are away, make sure its configured to not answer mailing lists. -

    • Don't cross post. Work out which is the best list to post to -and see what happens, i.e. don't post to both samba-ntdom and samba-technical. -Many people active on the lists subscribe to more -than one list and get annoyed to see the same message two or more times. -Often someone will see a message and thinking it would be better dealt -with on another, will forward it on for you.

    • You might include partial -log files written at a debug level set to as much as 20. -Please don't send the entire log but enough to give the context of the -error messages.

    • (Possibly) If you have a complete netmon trace ( from the opening of -the pipe to the error ) you can send the *.CAP file as well.

    • Please think carefully before attaching a document to an email. -Consider pasting the relevant parts into the body of the message. The samba -mailing lists go to a huge number of people, do they all need a copy of your -smb.conf in their attach directory?

    How to get off the mailing lists

    To have your name removed from a samba mailing list, go to the -same place you went to to get on it. Go to http://lists.samba.org, -click on your nearest mirror and then click on Support and -then click on Samba related mailing lists. +For questions relating to Samba TNG, go to +http://www.samba-tng.org/. +It has been requested that you do not post questions about Samba-TNG to the +main-stream Samba lists.

    +If you do post a message to one of the lists, please observe the following guidelines : +

    • Always remember that the developers are volunteers, they are + not paid and they never guarantee to produce a particular feature at + a particular time. Any timelines are “best guess” and nothing more. +

    • Always mention what version of Samba you are using and what + operating system it's running under. You should list the relevant sections of + your smb.conf file, at least the options in [global] + that affect PDC support. +

    • In addition to the version, if you obtained Samba via + CVS, mention the date when you last checked it out.

    • Try and make your questions clear and brief. Lots of long, + convoluted questions get deleted before they are completely read! + Do not post HTML encoded messages. Most people on mailing lists simply delete + them. +

    • If you run one of those nifty “I'm on holidays” things when + you are away, make sure its configured to not answer mailing list traffic. Auto-responses + to mailing lists really irritate the thousands of people who end up having to deal + with such bad netiquet bahavior. +

    • Don't cross post. Work out which is the best list to post to + and see what happens. Do not post to both samba-ntdom and samba-technical. + Many people active on the lists subscribe to more + than one list and get annoyed to see the same message two or more times. + Often someone will see a message and thinking it would be better dealt + with on another list, will forward it on for you.

    • You might include partial + log files written at a debug level set to as much as 20. + Please do not send the entire log but just enough to give the context of the + error messages.

    • If you have a complete Netmon trace (from the opening of + the pipe to the error), you can send the *.CAP file as well.

    • Please think carefully before attaching a document to an email. + Consider pasting the relevant parts into the body of the message. The Samba + mailing lists go to a huge number of people. Do they all need a copy of your + smb.conf in their attach directory?

    How to Get Off the Mailing Lists

    To have your name removed from a Samba mailing list, go to the same +place where you went to +subscribe to it. Go to http://lists.samba.org, +click on your nearest mirror, click on Support and +then click on Samba related mailing lists.

    -Please don't post messages to the list asking to be removed, you will just -be referred to the above address (unless that process failed in some way...) -

    Prev Up Next
    Chapter 33. The Samba checklist Home Chapter 35. Reporting Bugs
    +Please do not post messages to the list asking to be removed. You will only +be referred to the above address (unless that process failed in some way). +

    Prev Up Next
    Chapter 33. The Samba Checklist Home Chapter 35. Reporting Bugs
    diff --git a/docs/htmldocs/rpcclient.1.html b/docs/htmldocs/rpcclient.1.html index e1ff391cbc..9dca910956 100644 --- a/docs/htmldocs/rpcclient.1.html +++ b/docs/htmldocs/rpcclient.1.html @@ -5,7 +5,7 @@ have now written scripts around it to manage Windows NT clients from their UNIX workstation.

    OPTIONS

    server

    NetBIOS name of Server to which to connect. The server can be any SMB/CIFS server. The name is - resolved using the name resolve order line from smb.conf(5).

    -c|--command='command string'

    execute semicolon separated commands (listed + resolved using the name resolve order line from smb.conf(5).

    -c|--command='command string'

    execute semicolon separated commands (listed below))

    -I IP-address

    IP address is the address of the server to connect to. It should be specified in standard "a.b.c.d" notation.

    Normally the client would attempt to locate a named SMB/CIFS server by looking it up via the NetBIOS name resolution @@ -15,8 +15,8 @@ address and the NetBIOS name component of the resource being connected to will be ignored.

    There is no default for this parameter. If not supplied, it will be determined automatically by the client as described - above.

    -V

    Prints the version number for -smbd.

    -s <configuration file>

    The file specified contains the + above.

    -V

    Prints the program version number. +

    -s <configuration file>

    The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well @@ -29,13 +29,13 @@ not specified is zero.

    The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for -day to day running - it generates a small amount of +day-to-day running - it generates a small amount of information about operations carried out.

    Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

    Note that specifying this parameter here will -override the log level parameter +override the log level parameter in the smb.conf file.

    -l|--logfile=logbasename

    File name for log/debug files. The extension ".client" will be appended. The log file is never removed by the client. @@ -70,7 +70,7 @@ via the ps command. To be safe always allow rpcclient to prompt for a password and type it in directly.

    -n <primary NetBIOS name>

    This option allows you to override the NetBIOS name that Samba uses for itself. This is identical -to setting the netbios name parameter in the smb.conf file. +to setting the netbios name parameter in the smb.conf file. However, a command line setting will take precedence over settings in smb.conf.

    -i <scope>

    This specifies a NetBIOS scope that diff --git a/docs/htmldocs/samba-bdc.html b/docs/htmldocs/samba-bdc.html index c3be7504e2..13a35e5198 100644 --- a/docs/htmldocs/samba-bdc.html +++ b/docs/htmldocs/samba-bdc.html @@ -1,87 +1,81 @@ -Chapter 6. Backup Domain Control

    Chapter 6. Backup Domain Control
    Prev Part II. Server Configuration Basics Next

    Chapter 6. Backup Domain Control

    John H. Terpstra

    Samba Team

    Volker Lendecke

    Samba Team

    Table of Contents

    Features And Benefits
    Essential Background Information
    MS Windows NT4 Style Domain Control
    Active Directory Domain Control
    What qualifies a Domain Controller on the network?
    How does a Workstation find its domain controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts keep expiring, what can I do?
    Can Samba be a Backup Domain Controller to an NT4 PDC?
    How do I replicate the smbpasswd file?
    Can I do this all with LDAP?

    -Before you continue reading in this section, please make sure that you are comfortable -with configuring a Samba Domain Controller as described in chapter on setting up Samba as a PDC. -

    Features And Benefits

    -This is one of the most difficult chapters to summarise. It does not matter what we say here -for someone will still draw conclusions and / or approach the Samba-Team with expectations +Chapter 6. Backup Domain Control

    Chapter 6. Backup Domain Control
    Prev Part II. Server Configuration Basics Next

    Chapter 6. Backup Domain Control

    John H. Terpstra

    Samba Team

    Volker Lendecke

    Samba Team

    Guenther Deschner

    LDAP updates
    SuSE

    Table of Contents

    Features and Benefits
    Essential Background Information
    MS Windows NT4-style Domain Control
    LDAP Configuration Notes
    Active Directory Domain Control
    What Qualifies a Domain Controller on the Network?
    How does a Workstation find its Domain Controller?
    Backup Domain Controller Configuration
    Example Configuration
    Common Errors
    Machine Accounts Keep Expiring
    Can Samba Be a Backup Domain Controller to an NT4 PDC?
    How Do I Replicate the smbpasswd File?
    Can I Do This All with LDAP?

    +Before you continue reading this section, please make sure that you are comfortable +with configuring a Samba Domain Controller as described in . +

    Features and Benefits

    +This is one of the most difficult chapters to summarize. It does not matter what we say here +for someone will still draw conclusions and/or approach the Samba Team with expectations that are either not yet capable of being delivered, or that can be achieved far more effectively using a totally different approach. In the event that you should have a persistent -concern that is not addressed in this book then please email -John H Terpstra clearly setting out your requirements -and / or question and we will do our best to provide a solution. +concern that is not addressed in this book, please email John H. Terpstra +clearly setting out your requirements and/or question and we will do our best to provide a solution.

    -Samba-3 is capable of acting as a Backup Domain Controller to another Samba Primary Domain -Controller. A Samba-3 PDC can operate with an LDAP Account backend. The LDAP backend can be + +Samba-3 is capable of acting as a Backup Domain Controller (BDC) to another Samba Primary Domain +Controller (PDC). A Samba-3 PDC can operate with an LDAP Account backend. The LDAP backend can be either a common master LDAP server, or a slave server. The use of a slave LDAP server has the -benefit that when the master is down clients may still be able to log onto the network. -This effectively gives samba a high degree of scalability iand is a very sweet (nice) solution -for large organisations. +benefit that when the master is down, clients may still be able to log onto the network. +This effectively gives Samba a high degree of scalability and is an effective solution +for large organizations. Do not use an LDAP slave server for a PDC, this may cause serious +stability and operational problems.

    + While it is possible to run a Samba-3 BDC with non-LDAP backend, the administrator will -need to figure out precisely what is the best way to replicate (copy / distribute) the -user and machine Accounts backend. +need to figure out precisely what is the best way to replicate (copy/distribute) the +user and machine accounts' backend.

    -The use of a non-LDAP backend SAM database is particularly problematic because Domain member -servers and workstations periodically change the machine trust account password. The new + +The use of a non-LDAP backend SAM database is particularly problematic because Domain Member +servers and workstations periodically change the Machine Trust Account password. The new password is then stored only locally. This means that in the absence of a centrally stored -accounts database (such as that provided with an LDAP based solution) if Samba-3 is running -as a BDC, the BDC instance of the Domain member trust account password will not reach the -PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs this results in -overwriting of the SAM that contains the updated (changed) trust account password with resulting +accounts database (such as that provided with an LDAP-based solution) if Samba-3 is running +as a BDC, the BDC instance of the Domain Member trust account password will not reach the +PDC (master) copy of the SAM. If the PDC SAM is then replicated to BDCs, this results in +overwriting the SAM that contains the updated (changed) trust account password with resulting breakage of the domain trust.

    -Considering the number of comments and questions raised concerning how to configure a BDC -lets consider each possible option and look at the pro's and con's for each theoretical solution: -

    Backup Domain Backend Account Distribution Options

    • - Solution: Passwd Backend is LDAP based, BDCs use a slave LDAP server -

      - Arguments For: This is a neat and manageable solution. The LDAP based SAM (ldapsam) - is constantly kept up to date. -

      - Arguments Against: Complexity -

    • - Passdb Backend is tdbsam based, BDCs use cron based net rpc vampire to - obtain the Accounts database from the PDC and place them into the Samba SAM. - net rpc vampire is a Samba function of the "net" command. -

      - Arguments For: It would be a nice solution -

      - Arguments Against: It does not work because Samba-3 does not support the required - protocols. This may become a later feature but is not available today. -

    • - Make use of rsync to replicate (pull down) copies of the essential account files -

      - Arguments For: It is a simple solution, easy to set up as a scheduled job -

      - Arguments Against: This will over-write the locally changed machine trust account - passwords. This is a broken and flawed solution. Do NOT do this. -

    • - Operate with an entirely local accounts database (not recommended) -

      - Arguments For: Simple, easy to maintain -

      - Arguments Against: All machine trust accounts and user accounts will be locally - maintained. Domain users will NOT be able to roam from office to office. This is - a broken and flawed solution. Do NOT do this. -

    Essential Background Information

    +Considering the number of comments and questions raised concerning how to configure a BDC, +let's consider each possible option and look at the pros and cons for each possible solution. + lists possible design configurations for a PDC/BDC infrastructure. + + + + +

    Table 6.1. Domain Backend Account Distribution Options

    PDC BackendBDC BackendNotes/Discussion

    Master LDAP Server

    Slave LDAP Server

    The optimal solution that provides high integrity. The SAM will be + replicated to a common master LDAP server.

    Single Central LDAP Server

    Single Central LDAP Server

    + A workable solution without fail-over ability. This is a useable solution, but not optimal. +

    tdbsam

    tdbsam + net rpc vampire

    + Does not work with Samba-3.0.0; may be implemented in a later release. The downside of this solution + is that an external process will control account database integrity. This solution may appeal to sites + that wish to avoid the complexity of LDAP. The net rpc vampire is used to + synchronize domain accounts from the PDC to the BDC. +

    tdbsam

    tdbsam + rsync

    + Do not use this configuration. + Does not work because the TDB files are live and data may not have been flushed to disk. + Use rsync to synchronize the TDB database files from the PDC to the BDC. +

    smbpasswd file

    smbpasswd file

    + Do not use this configuration. + Not an elegant solution due to the delays in synchronization. + Use rsync to synchronize the TDB database files from the PDC to the BDC. + Can be made to work using a cron job to synchronize data from the PDC to the BDC. +

    Essential Background Information

    A Domain Controller is a machine that is able to answer logon requests from network workstations. Microsoft LanManager and IBM LanServer were two early products that provided this capability. The technology has become known as the LanMan Netlogon service.

    -When MS Windows NT3.10 was first released, it supported an new style of Domain Control +When MS Windows NT3.10 was first released, it supported a new style of Domain Control and with it a new form of the network logon service that has extended functionality. This service became known as the NT NetLogon Service. The nature of this service has -changed with the evolution of MS Windows NT and today provides a very complex array of -services that are implemented over a complex spectrum of technologies. -

    MS Windows NT4 Style Domain Control

    -Whenever a user logs into a Windows NT4 / 200x / XP Professional Workstation, -the workstation connects to a Domain Controller (authentication server) to validate -the username and password that the user entered are valid. If the information entered -does not validate against the account information that has been stored in the Domain -Control database (the SAM, or Security Account Manager database) then a set of error +changed with the evolution of MS Windows NT and today provides a complex array of +services that are implemented over an intricate spectrum of technologies. +

    MS Windows NT4-style Domain Control

    +Whenever a user logs into a Windows NT4/200x/XP Professional Workstation, +the workstation connects to a Domain Controller (authentication server) to validate that +the username and password the user entered are valid. If the information entered +does not match account information that has been stored in the Domain +Control database (the SAM, or Security Account Manager database), a set of error codes is returned to the workstation that has made the authentication request.

    -When the username / password pair has been validated, the Domain Controller +When the username/password pair has been validated, the Domain Controller (authentication server) will respond with full enumeration of the account information that has been stored regarding that user in the User and Machine Accounts database for that Domain. This information contains a complete network access profile for @@ -92,9 +86,10 @@ network access time limits, account validity information, machine names from whi user may access the network, and much more. All this information was stored in the SAM in all versions of MS Windows NT (3.10, 3.50, 3.51, 4.0).

    + The account information (user and machine) on Domain Controllers is stored in two files, one containing the Security information and the other the SAM. These are stored in files -by the same name in the C:\WinNT\System32\config directory. These +by the same name in the C:\Windows NT\System32\config directory. These are the files that are involved in replication of the SAM database where Backup Domain Controllers are present on the network.

    @@ -106,139 +101,240 @@ There are two situations in which it is desirable to install Backup Domain Contr

  • At each remote site, to reduce wide area network traffic and to add stability to remote network operations. The design of the network, the strategic placement of - Backup Domain Controllers, together with an implementation that localises as much - of network to client interchange as possible will help to minimise wide area network + Backup Domain Controllers, together with an implementation that localizes as much + of network to client interchange as possible will help to minimize wide area network bandwidth needs (and thus costs).

    • -The PDC contains the master copy of the SAM. In the event that an administrator makes a -change to the user account database while physically present on the local network that -has the PDC, the change will likely be made directly to the PDC instance of the master -copy of the SAM. In the event that this update may be performed in a branch office the -change will likely be stored in a delta file on the local BDC. The BDC will then send -a trigger to the PDC to commence the process of SAM synchronisation. The PDC will then -request the delta from the BDC and apply it to the master SAM. The PDC will then contact -all the BDCs in the Domain and trigger them to obtain the update and then apply that to -their own copy of the SAM. +The inter-operation of a PDC and its BDCs in a true Windows NT4 environemt is worth +mentioning here. The PDC contains the master copy of the SAM. In the event that an +administrator makes a change to the user account database while physically present +on the local network that has the PDC, the change will likely be made directly to +the PDC instance of the master copy of the SAM. In the event that this update may +be performed in a branch office, the change will likely be stored in a delta file +on the local BDC. The BDC will then send a trigger to the PDC to commence the process +of SAM synchronization. The PDC will then request the delta from the BDC and apply +it to the master SAM. The PDC will then contact all the BDCs in the Domain and +trigger them to obtain the update and then apply that to their own copy of the SAM. +

    +Samba-3 can not participate in true SAM replication and is therefore not able to +employ precisely the same protocols used by MS Windows NT4. A Samba-3 BDC will +not create SAM update delta files. It will not inter-operate with a PDC (NT4 or Samba) +to synchronize the SAM from delta files that are held by BDCs.

    -Thus the BDC is said to hold a read-only of the SAM from which -it is able to process network logon requests and to authenticate users. The BDC can +Samba-3 cannot function as a BDC to an MS Windows NT4 PDC, and Samba-3 can not +function correctly as a PDC to an MS Windows NT4 BDC. Both Samba-3 and MS Windows +NT4 can function as a BDC to its own type of PDC. +

    +The BDC is said to hold a read-only of the SAM from which +it is able to process network logon requests and authenticate users. The BDC can continue to provide this service, particularly while, for example, the wide area -network link to the PDC is down. Thus a BDC plays a very important role in both -maintenance of Domain security as well as in network integrity. +network link to the PDC is down. A BDC plays a very important role in both the +maintenance of Domain Security as well as in network integrity.

    -In the event that the PDC should need to be taken out of service, or if it dies, then -one of the BDCs can be promoted to a PDC. If this happens while the original PDC is on -line then it is automatically demoted to a BDC. This is an important aspect of Domain -Controller management. The tool that is used to affect a promotion or a demotion is the -Server Manager for Domains. -

    Example PDC Configuration

    -Since version 2.2 Samba officially supports domain logons for all current Windows Clients, -including Windows NT4, 2003 and XP Professional. For samba to be enabled as a PDC some -parameters in the [global]-section of the smb.conf have to be set: -

    Example 6.1. Minimal smb.conf for being a PDC

    workgroup = MIDEARTH
    domain master = yes
    domain logons = yes

    +In the event that the NT4 PDC should need to be taken out of service, or if it dies, +one of the NT4 BDCs can be promoted to a PDC. If this happens while the original NT4 PDC is on +line, it is automatically demoted to an NT4 BDC. This is an important aspect of Domain +Controller management. The tool that is used to effect a promotion or a demotion is the +Server Manager for Domains. It should be noted that Samba-3 BDCs can not be promoted +in this manner because reconfiguration of Samba requires changes to the smb.conf file. +

    Example PDC Configuration

    +Beginning with Version 2.2, Samba officially supports domain logons for all current Windows clients, +including Windows NT4, 2003 and XP Professional. For Samba to be enabled as a PDC, some +parameters in the [global]-section of the smb.conf have to be set. +Refer to for an example of the minimum required settings. +

    Example 6.1. Minimal smb.conf for a PDC in Use With a BDC LDAP Server on PDC.

    workgroup = MIDEARTH
    passdb backend = ldapsam://localhost:389
    domain master = yes
    domain logons = yes

    Several other things like a [homes] and a [netlogon] share also need to be set along with -settings for the profile path, the users home drive, etc.. This will not be covered in this -chapter, for more information please refer to the chapter about samba as a PDC. -

    Active Directory Domain Control

    +settings for the profile path, the user's home drive, and so on. This is not covered in this +chapter; for more information please refer to . +

    LDAP Configuration Notes

    +When configuring a master and a slave LDAP server, it is advisable to use the master LDAP server +for the PDC and slave LDAP servers for the BDCs. It is not essential to use slave LDAP servers, however, +many administrators will want to do so in order to provide redundant services. Of course, one or more BDCs +may use any slave LDAP server. Then again, it is entirely possible to use a single LDAP server for the +entire network. +

    +When configuring a master LDAP server that will have slave LDAP servers, do not forget to configure +this in the /etc/openldap/slapd.conf file. It must be noted that the DN of a +server certificate must use the CN attribute to name the server, and the CN must carry the servers' +fully qualified domain name. Additional alias names and wildcards may be present in the +subjectAltName certificate extension. More details on server certificate names are in RFC2830. +

    +It does not really fit within the scope of this document, but a working LDAP installation is +basic to LDAP enabled Samba operation. When using an OpenLdap server with Transport Layer Security +(TLS), the machine name in /etc/ssl/certs/slapd.pem must be the +same as in /etc/openldap/sldap.conf. The Red Hat Linux startup script +creates the slapd.pem file with hostname “localhost.localdomain.” +It is impossible to access this LDAP server from a slave LDAP server (i.e., a Samba BDC) unless the +certificate is recreated with a correct hostname. +

    +Do not install a Samba PDC on a OpenLDAP slave server. Joining client machines to the domain +will fail in this configuration because the change to the machine account in the LDAP tree +must take place on the master LDAP server. This is not replicated rapidly enough to the slave +server that the PDC queries. It therfore gives an error message on the client machine about +not being able to set up account credentials. The machine account is created on the LDAP server +but the password fields will be empty. +

    +Possible PDC/BDC plus LDAP configurations include: +

    • + PDC+BDC -> One Central LDAP Server. +

    • + PDC -> LDAP master server, BDC -> LDAP slave server. +

    • + PDC -> LDAP master, with secondary slave LDAP server. +

      + BDC -> LDAP master, with secondary slave LDAP server. +

    • + PDC -> LDAP master, with secondary slave LDAP server. +

      + BDC -> LDAP slave server, with secondary master LDAP server. +

    +In order to have a fall-back configuration (secondary) LDAP server one would specify +the secondary LDAP server in the smb.conf file as shown in . +

    +

    Example 6.2. Multiple LDAP Servers in smb.conf

    ...
    passdb backend = ldapsam:ldap://master.quenya.org
    ldapsam:ldap://slave.quenya.org
    ...

    +

    Active Directory Domain Control

    As of the release of MS Windows 2000 and Active Directory, this information is now stored in a directory that can be replicated and for which partial or full administrative control -can be delegated. Samba-3 is NOT able to be a Domain Controller within an Active Directory -tree, and it can not be an Active Directory server. This means that Samba-3 also can NOT +can be delegated. Samba-3 is not able to be a Domain Controller within an Active Directory +tree, and it cannot be an Active Directory server. This means that Samba-3 also cannot act as a Backup Domain Controller to an Active Directory Domain Controller. -

    What qualifies a Domain Controller on the network?

    -Every machine that is a Domain Controller for the domain SAMBA has to register the NetBIOS -group name SAMBA<#1c> with the WINS server and/or by broadcast on the local network. -The PDC also registers the unique NetBIOS name SAMBA<#1b> with the WINS server. +

    What Qualifies a Domain Controller on the Network?

    +Every machine that is a Domain Controller for the domain MIDEARTH has to register the NetBIOS +group name MIDEARTH<#1c> with the WINS server and/or by broadcast on the local network. +The PDC also registers the unique NetBIOS name MIDEARTH<#1b> with the WINS server. The name type <#1b> name is normally reserved for the Domain Master Browser, a role that has nothing to do with anything related to authentication, but the Microsoft Domain -implementation requires the domain master browser to be on the same machine as the PDC. -

    How does a Workstation find its domain controller?

    -An MS Windows NT4 / 200x / XP Professional workstation in the domain SAMBA that wants a -local user to be authenticated has to find the domain controller for SAMBA. It does this -by doing a NetBIOS name query for the group name SAMBA<#1c>. It assumes that each -of the machines it gets back from the queries is a domain controller and can answer logon -requests. To not open security holes both the workstation and the selected domain controller +implementation requires the Domain Master Browser to be on the same machine as the PDC. +

    +Where a WINS server is not used, broadcast name registrations alone must suffice. Refer to + for more information regarding TCP/IP network protocols and how + SMB/CIFS names are handled. +

    How does a Workstation find its Domain Controller?

    +There are two different mechanisms to locate a domain controller, one method is used when +NetBIOS over TCP/IP is enabled and the other when it has been disabled in the TCP/IP +network configuration. +

    +Where NetBIOS over TCP/IP is disabled, all name resolution involves the use of DNS, broadcast +messaging over UDP, as well as Active Directory communication technologies. In this type of +environment all machines require appropriate DNS entries. More information may be found in +. +

    NetBIOS Over TCP/IP Enabled

    +An MS Windows NT4/200x/XP Professional workstation in the domain MIDEARTH that wants a +local user to be authenticated has to find the Domain Controller for MIDEARTH. It does this +by doing a NetBIOS name query for the group name MIDEARTH<#1c>. It assumes that each +of the machines it gets back from the queries is a Domain Controller and can answer logon +requests. To not open security holes, both the workstation and the selected Domain Controller authenticate each other. After that the workstation sends the user's credentials (name and -password) to the local Domain Controller, for validation. -

    Backup Domain Controller Configuration

    -Several things have to be done: +password) to the local Domain Controller for validation. +

    NetBIOS Over TCP/IP Disabled

    +An MS Windows NT4/200x/XP Professional workstation in the realm quenya.org +that has a need to affect user logon authentication will locate the Domain Controller by +requerying DNS servers for the _ldap._tcp.pdc.ms-dcs.quenya.org record. +More information regarding this subject may be found in . +

    Backup Domain Controller Configuration

    +The creation of a BDC requires some steps to prepare the Samba server before +smbd is executed for the first time. These steps are outlines as follows: +

    • - The domain SID has to be the same on the PDC and the BDC. This used to - be stored in the file private/MACHINE.SID. This file is not created - since Samba 2.2.5. Nowadays the domain SID is stored in the file - private/secrets.tdb. Simply copying the secrets.tdb - from the PDC to the BDC does not work, as the BDC would - generate a new SID for itself and override the domain SID with this - new BDC SID.

      + The domain SID has to be the same on the PDC and the BDC. In Samba versions + pre-2.2.5, the domain SID was stored in the file private/MACHINE.SID. + The domain SID is now stored in the file private/secrets.tdb. This file + is unique to each server and can not be copied from a PDC to a BDC, the BDC will generate + a new SID at start-up. It will over-write the PDC domain SID with the newly created BDC SID. + There is a procedure that will allow the BDC to aquire the Domain SID. This is described here. +

      To retrieve the domain SID from the PDC or an existing BDC and store it in the - secrets.tdb, execute: + secrets.tdb, execute: 

       root# net rpc getsid

    • + Specification of the ldap admin dn is obligatory. + This also requires the LDAP administration password to be set in the secrets.tdb + using the smbpasswd -w mysecret. +

    • + Either ldap suffix or + ldap idmap suffix must be specified in + the smb.conf file. +

    • + The UNIX user database has to be synchronized from the PDC to the - BDC. This means that both the /etc/passwd and /etc/group have to be - replicated from the PDC to the BDC. This can be done manually - whenever changes are made, or the PDC is set up as a NIS master - server and the BDC as a NIS slave server. To set up the BDC as a - mere NIS client would not be enough, as the BDC would not be able to - access its user database in case of a PDC failure. NIS is by no means - the only method to synchronize passwords. An LDAP solution would work - as well. + BDC. This means that both the /etc/passwd and + /etc/group have to be replicated from the PDC + to the BDC. This can be done manually whenever changes are made. + Alternately, the PDC is set up as an NIS master server and the BDC as an NIS slave + server. To set up the BDC as a mere NIS client would not be enough, + as the BDC would not be able to access its user database in case of + a PDC failure. NIS is by no means the only method to synchronize + passwords. An LDAP solution would also work.

    • - The Samba password database has to be replicated from the PDC to the BDC. - As said above, though possible to synchronise the smbpasswd - file with rsync and ssh, this method is broken and flawed, and is - therefore not recommended. A better solution is to set up slave LDAP - servers for each BDC and a master LDAP server for the PDC. + The Samba password database must be replicated from the PDC to the BDC. + Although it is possible to synchronize the smbpasswd + file with rsync and ssh, this method + is broken and flawed, and is therefore not recommended. A better solution + is to set up slave LDAP servers for each BDC and a master LDAP server for the PDC.

    • - Any netlogon share has to be replicated from the PDC to the + The netlogon share has to be replicated from the PDC to the BDC. This can be done manually whenever login scripts are changed, - or it can be done automatically together with the smbpasswd - synchronization. -

    Example Configuration

    -Finally, the BDC has to be found by the workstations. This can be done by setting: -

    Example 6.2. Minimal setup for being a BDC

    workgroup = MIDEARTH
    domain master = no
    domain logons = yes
    idmap backend = ldapsam://slave-ldap.quenya.org

    + or it can be done automatically using a cron job + that will replicate the directory structure in this share using a tool + like rsync. +

    Example Configuration

    +Finally, the BDC has to be found by the workstations. This can be done by setting Samba as shown in . +

    Example 6.3. Minimal setup for being a BDC

    workgroup = MIDEARTH
    passdb backend = ldapsam:ldap://slave-ldap.quenya.org
    domain master = no
    domain logons = yes
    idmap backend = ldapsam:ldap://slave-ldap.quenya.org

    In the [global]-section of the smb.conf of the BDC. This makes the BDC only register the name SAMBA<#1c> with the WINS server. This is no problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to be registered by more than one machine. The parameter -domain master = no +domain master = no forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS name is reserved for the Primary Domain Controller.

    + + The idmap backend will redirect the winbindd utility to use the LDAP database to resolve all UIDs and GIDs for UNIX accounts.

    Note

    + Samba-3 has introduced a new ID mapping facility. One of the features of this facility is that it -allows greater flexibility in how user and group IDs are handled in respect of NT Domain User and Group -SIDs. One of the new facilities provides for explicitly ensuring that UNIX / Linux UID and GID values +allows greater flexibility in how user and group IDs are handled in respect to NT Domain User and Group +SIDs. One of the new facilities provides for explicitly ensuring that UNIX/Linux UID and GID values will be consistent on the PDC, all BDCs and all Domain Member servers. The parameter that controls this is called idmap backend. Please refer to the man page for smb.conf for more information -regarding it's behaviour. Do NOT set this parameter except where an LDAP backend (ldapsam) is in use. -

    Common Errors

    -As this is a rather new area for Samba there are not many examples that we may refer to. Keep -watching for updates to this section. -

    Machine Accounts keep expiring, what can I do?

    -This problem will occur when occur when the passdb (SAM) files are copied from a central -server but the local Backup Domain Controllers. Local machine trust account password updates +regarding its behavior. +

    +The use of the idmap backend = ldap://master.quenya/org +option on a BDC only make sense where ldapsam is used on a PDC. The purpose for an LDAP based idmap backend is +also to allow a domain-member (without its own passdb backend) to use winbindd to resolve Windows network users +and groups to common UID/GIDs. In other words, this option is generally intended for use on BDCs and on Domain +Member servers. +

    Common Errors

    +As this is a rather new area for Samba, there are not many examples that we may refer to. +Updates will be published as they become available and may be found in later Samba releases or +from the Samba web site. +

    Machine Accounts Keep Expiring

    + +This problem will occur when the passdb (SAM) files are copied from a central +server but the local Backup Domain Controller is acting as a PDC. This results in the application of +Local Machine Trust Account password updates to the local SAM. Such updates are not copied back to the central server. The newer machine account password is then over -written when the SAM is copied from the PDC. The result is that the Domain member machine -on start up will find that it's passwords does not match the one now in the database and +written when the SAM is re-copied from the PDC. The result is that the Domain Member machine +on start up will find that its passwords do not match the one now in the database and since the startup security check will now fail, this machine will not allow logon attempts to proceed and the account expiry error will be reported.

    -The solution: use a more robust passdb backend, such as the ldapsam backend, setting up -an slave LDAP server for each BDC, and a master LDAP server for the PDC. -

    Can Samba be a Backup Domain Controller to an NT4 PDC?

    -With version 2.2, no. The native NT4 SAM replication protocols have not yet been fully -implemented. The Samba Team is working on understanding and implementing the protocols, -but this work has not been finished for Samba-3. +The solution is to use a more robust passdb backend, such as the ldapsam backend, setting up +a slave LDAP server for each BDC, and a master LDAP server for the PDC. +

    Can Samba Be a Backup Domain Controller to an NT4 PDC?

    + +No. The native NT4 SAM replication protocols have not yet been fully implemented.

    -Can I get the benefits of a BDC with Samba? Yes, but only to a Samba PDC. The main reason for implementing a -BDC is availability. If the PDC is a Samba machine, a second Samba machine can be set up to -service logon requests whenever the PDC is down. -

    How do I replicate the smbpasswd file?

    +Can I get the benefits of a BDC with Samba? Yes, but only to a Samba PDC.The +main reason for implementing a BDC is availability. If the PDC is a Samba +machine, a second Samba machine can be set up to service logon requests whenever +the PDC is down. +

    How Do I Replicate the smbpasswd File?

    + Replication of the smbpasswd file is sensitive. It has to be done whenever changes to the SAM are made. Every user's password change is done in the smbpasswd file and has to be replicated to the BDC. So replicating the smbpasswd file very often is necessary. @@ -246,15 +342,15 @@ has to be replicated to the BDC. So replicating the smbpasswd file very often is As the smbpasswd file contains plain text password equivalents, it must not be sent unencrypted over the wire. The best way to set up smbpasswd replication from the PDC to the BDC is to use the utility rsync. rsync can use ssh as a transport. -Ssh itself can be set up to accept only rsync transfer without requiring the user -to type a password. +ssh itself can be set up to accept only +rsync transfer without requiring the user to type a password.

    As said a few times before, use of this method is broken and flawed. Machine trust -accounts will go out of sync, resulting in a very broken domain. This method is +accounts will go out of sync, resulting in a broken domain. This method is not recommended. Try using LDAP instead. -

    Can I do this all with LDAP?

    -The simple answer is YES. Samba's pdb_ldap code supports binding to a replica +

    Can I Do This All with LDAP?

    +The simple answer is yes. Samba's pdb_ldap code supports binding to a replica LDAP server, and will also follow referrals and rebind to the master if it ever needs to make a modification to the database. (Normally BDCs are read only, so this will not occur often). -

    Prev Up Next
    Chapter 5. Domain Control Home Chapter 7. Domain Membership
    +

    Prev Up Next
    Chapter 5. Domain Control Home Chapter 7. Domain Membership
    diff --git a/docs/htmldocs/samba-pdc.html b/docs/htmldocs/samba-pdc.html index aab2d4207c..37c513efff 100644 --- a/docs/htmldocs/samba-pdc.html +++ b/docs/htmldocs/samba-pdc.html @@ -1,261 +1,276 @@ -Chapter 5. Domain Control
    Chapter 5. Domain Control
    Prev Part II. Server Configuration Basics Next

    Chapter 5. Domain Control

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    David Bannon

    Samba Team

    Table of Contents

    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control - Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    '$' cannot be included in machine name
    Joining domain fails because of existing machine account
    The system can not log you on (C000019B)....
    The machine trust account not accessible
    Account disabled
    Domain Controller Unavailable
    Can not log onto domain member workstation after joining domain

    The Essence of Learning:  +Chapter 5. Domain Control

    Chapter 5. Domain Control
    Prev Part II. Server Configuration Basics Next

    Chapter 5. Domain Control

    John H. Terpstra

    Samba Team

    Gerald (Jerry) Carter

    Samba Team

    David Bannon

    Samba Team

    Guenther Deschner

    LDAP updates
    SuSE

    Table of Contents

    Features and Benefits
    Basics of Domain Control
    Domain Controller Types
    Preparing for Domain Control
    Domain Control Example Configuration
    Samba ADS Domain Control
    Domain and Network Logon Configuration
    Domain Network Logon Service
    Security Mode and Master Browsers
    Common Errors
    $ Cannot Be Included in Machine Name
    Joining Domain Fails Because of Existing Machine Account
    The System Cannot Log You On (C000019B)
    The Machine Trust Account Is Not Accessible
    Account Disabled
    Domain Controller Unavailable
    Cannot Log onto Domain Member Workstation After Joining Domain

    There are many who approach MS Windows networking with incredible misconceptions. -That's OK, because it gives the rest of us plenty of opportunity to be of assistance. +That's okay, because it gives the rest of us plenty of opportunity to be of assistance. Those who really want help would be well advised to become familiar with information that is already available.

    -The reader is advised NOT to tackle this section without having first understood +The reader is advised not to tackle this section without having first understood and mastered some basics. MS Windows networking is not particularly forgiving of misconfiguration. Users of MS Windows networking are likely to complain of persistent niggles that may be caused by a broken network configuration. -To a great many people however, MS Windows networking starts with a domain controller -that in some magical way is expected to solve all ills. -

    Figure 5.1. An Example Domain

    An Example Domain

    +To a great many people, however, MS Windows networking starts with a Domain Controller +that in some magical way is expected to solve all network operational ills. +

    +The diagram in shows a typical MS Windows Domain Security +network environment. Workstations A, B and C are representative of many physical MS Windows +network clients. +

    Figure 5.1. An Example Domain.

    An Example Domain.

    From the Samba mailing list one can readily identify many common networking issues. If you are not clear on the following subjects, then it will do much good to read the sections of this HOWTO that deal with it. These are the most common causes of MS Windows networking problems: -

    • Basic TCP/IP configuration

    • NetBIOS name resolution

    • Authentication configuration

    • User and Group configuration

    • Basic File and Directory Permission Control in UNIX/Linux

    • Understanding of how MS Windows clients interoperate in a network - environment

    +

    • Basic TCP/IP configuration.

    • NetBIOS name resolution.

    • Authentication configuration.

    • User and group configuration.

    • Basic file and directory permission control in UNIX/Linux.

    • Understanding how MS Windows clients interoperate in a network + environment.

    Do not be put off; on the surface of it MS Windows networking seems so simple that anyone can do it. In fact, it is not a good idea to set up an MS Windows network with inadequate training and preparation. But let's get our first indelible principle out of the -way: It is perfectly OK to make mistakes! In the right place and at -the right time, mistakes are the essence of learning. It is very much -not ok to make mistakes that cause loss of productivity and impose an avoidable financial -burden on an organisation. +way: It is perfectly okay to make mistakes! In the right place and at +the right time, mistakes are the essence of learning. It is very much not okay to make +mistakes that cause loss of productivity and impose an avoidable financial burden on an +organization.

    -Where is the right place to make mistakes? Only out of harm's way! If you are going to -make mistakes, then please do this on a test network, away from users and in such a way as +Where is the right place to make mistakes? Only out of harm's way. If you are going to +make mistakes, then please do it on a test network, away from users and in such a way as to not inflict pain on others. Do your learning on a test network. -

    Features and Benefits

    -What is the key benefit of Microsoft Domain security? +

    Features and Benefits

    + +What is the key benefit of Microsoft Domain Security?

    -In a word, Single Sign On, or SSO for short. To many, this is the holy -grail of MS Windows NT and beyond networking. SSO allows users in a well designed network +In a word, Single Sign On, or SSO for short. To many, this is the Holy +Grail of MS Windows NT and beyond networking. SSO allows users in a well-designed network to log onto any workstation that is a member of the domain that their user account is in (or in a domain that has an appropriate trust relationship with the domain they are visiting) -and they will be able to log onto the network and access resources (shares, files, and printers) +and they will be able to log onto the network and access resources (shares, files and printers) as if they are sitting at their home (personal) workstation. This is a feature of the Domain -security protocols. +Security protocols.

    -The benefits of Domain security are available to those sites that deploy a Samba PDC. + +The benefits of Domain Security are available to those sites that deploy a Samba PDC. A Domain provides a unique network security identifier (SID). Domain user and group security identifiers are comprised of the network SID plus a relative identifier (RID) that is unique to the account. User and Group SIDs (the network SID plus the RID) can be used to create Access Control Lists (ACLs) attached to network resources to provide organizational access control. UNIX systems -know only of local security identifiers. +recognize only local security identifiers.

    Note

    -Network clients of an MS Windows Domain security environment must be Domain members to be -able to gain access to the advanced features provided. Domain membership involves more than just +Network clients of an MS Windows Domain Security Environment must be Domain Members to be +able to gain access to the advanced features provided. Domain Membership involves more than just setting the workgroup name to the Domain name. It requires the creation of a Domain trust account -for the workstation (called a machine account). Please refer to the chapter on -setting up samba as a domain member for more information. +for the workstation (called a machine account). Refer to +for more information.

    The following functionalities are new to the Samba-3 release:

    • - Windows NT4 domain trusts + Windows NT4 domain trusts.

    • + Adding users via the User Manager for Domains. This can be done on any MS Windows - client using the Nexus toolkit that is available from Microsoft's web site. + client using the Nexus.exe toolkit that is available from Microsoft's Web site. Samba-3 supports the use of the Microsoft Management Console for user management.

    • Introduces replaceable and multiple user account (authentication) - back ends. In the case where the back end is placed in an LDAP database, - Samba-3 confers the benefits of a back end that can be distributed, replicated, + backends. In the case where the backend is placed in an LDAP database, + Samba-3 confers the benefits of a backend that can be distributed, replicated and is highly scalable.

    • - Implements full Unicode support. This simplifies cross locale internationalisation + Implements full Unicode support. This simplifies cross locale internationalization support. It also opens up the use of protocols that Samba-2.2.x had but could not use due to the need to fully support Unicode.

    -The following functionalities are NOT provided by Samba-3: +The following functionalities are not provided by Samba-3:

    • + + SAM replication with Windows NT4 Domain Controllers - (i.e. a Samba PDC and a Windows NT BDC or vice versa). This means samba + (i.e., a Samba PDC and a Windows NT BDC or vice versa). This means Samba cannot operate as a BDC when the PDC is Microsoft-based or - replicate account data to Windows-BDC's. + replicate account data to Windows BDCs.

    • - Acting as a Windows 2000 Domain Controller (i.e. Kerberos and - Active Directory) - In point of fact, Samba-3 DOES have some + Acting as a Windows 2000 Domain Controller (i.e., Kerberos and + Active Directory). In point of fact, Samba-3 does have some Active Directory Domain Control ability that is at this time - purely experimental AND that is certain - to change as it becomes a fully supported feature some time - during the Samba-3 (or later) life cycle. However, Active Directory is - more then just SMB - it's also LDAP, Kerberos, DHCP and other protocols - (with proprietary extensions, of course). + purely experimental that is certain to change as it becomes a + fully supported feature some time during the Samba-3 (or later) + life cycle. However, Active Directory is more then just SMB + it's also LDAP, Kerberos, DHCP, and other protocols (with proprietary + extensions, of course). +

    • + The Windows 200x/XP MMC (Computer Management) Console can not be used + to manage a Samba-3 server. For this you can use only the MS Windows NT4 + Domain Server manager and the MS Windows NT4 Domain User Manager. Both are + part of the SVRTOOLS.EXE package mentioned later.

    -Windows 9x / Me / XP Home clients are not true members of a domain for reasons outlined -in this chapter. The protocol for support of Windows 9x / Me style network (domain) logons -is completely different from NT4 / Win2k type domain logons and has been officially supported +Windows 9x/Me/XP Home clients are not true members of a domain for reasons outlined +in this chapter. The protocol for support of Windows 9x/Me style network (domain) logons +is completely different from NT4/Windows 200x type domain logons and has been officially supported for some time. These clients use the old LanMan Network Logon facilities that are supported in Samba since approximately the Samba-1.9.15 series.

    -Samba-3 has an implementation of group mapping between Windows NT groups +Samba-3 implements group mapping between Windows NT groups and UNIX groups (this is really quite complicated to explain in a short space). This is -discussed more fully in the chapter on group mapping. +discussed more fully in .

    + Samba-3, like an MS Windows NT4 PDC or a Windows 200x Active Directory, needs to store -user and machine trust account information in a suitable backend data store. -Refer to the section on machine trust accounts. With Samba-3 there can be multiple -back-ends for this. A complete discussion of account database backends can be found in -the chapter on Account Information Databases. -

    Basics of Domain Control

    +user and Machine Trust Account information in a suitable backend datastore. +Refer to . With Samba-3 there can be multiple +backends for this. A complete discussion of account database backends can be found in +. +

    Basics of Domain Control

    Over the years, public perceptions of what Domain Control really is has taken on an almost mystical nature. Before we branch into a brief overview of Domain Control, -there are three basic types of domain controllers: -

    Domain Controller Types

    • Primary Domain Controller

    • Backup Domain Controller

    • ADS Domain Controller

    -The Primary Domain Controller or PDC plays an important role in the MS -Windows NT4. In Windows 200x Domain Control architecture this role is held by domain controllers. -There is folk lore that dictates that because of it's role in the MS Windows -network, the domain controllers should be the most powerful and most capable machine in the network. -As strange as it may seem to say this here, good over all network performance dictates that -the entire infrastructure needs to be balanced. It is advisable to invest more in Stand-Alone -(or Domain Member) servers than in the domain controllers. -

    -In the case of MS Windows NT4 style domains, it is the PDC that initiates a new Domain Control database. -This forms a part of the Windows registry called the SAM (Security Account Manager). It plays a key -part in NT4 type domain user authentication and in synchronisation of the domain authentication +there are three basic types of Domain Controllers. +

    Domain Controller Types

    • Primary Domain Controller

    • Backup Domain Controller

    • ADS Domain Controller

    +The Primary Domain Controller or PDC plays an important role in MS +Windows NT4. In Windows 200x Domain Control architecture, this role is held by Domain Controllers. +Folklore dictates that because of its role in the MS Windows +network, the Domain Controller should be the most powerful and most capable machine in the network. +As strange as it may seem to say this here, good overall network performance dictates that +the entire infrastructure needs to be balanced. It is advisable to invest more in Stand-alone +(Domain Member) servers than in the Domain Controllers. +

    + +In the case of MS Windows NT4-style domains, it is the PDC that initiates a new Domain Control database. +This forms a part of the Windows registry called the Security Account Manager (SAM). It plays a key +part in NT4-type domain user authentication and in synchronization of the domain authentication database with Backup Domain Controllers.

    -With MS Windows 200x Server based Active Directory domains, one domain controller initiates a potential -hierarchy of domain controllers, each with their own area of delegated control. The master domain -controller has the ability to override any down-stream controller, but a down-line controller has -control only over it's down-line. With Samba-3 this functionality can be implemented using an -LDAP based user and machine account back end. +With MS Windows 200x Server-based Active Directory domains, one Domain Controller initiates a potential +hierarchy of Domain Controllers, each with their own area of delegated control. The master domain +controller has the ability to override any downstream controller, but a downline controller has +control only over its downline. With Samba-3, this functionality can be implemented using an +LDAP-based user and machine account backend.

    -New to Samba-3 is the ability to use a back-end database that holds the same type of data as -the NT4 style SAM (Security Account Manager) database (one of the registry files). -[1] +New to Samba-3 is the ability to use a backend database that holds the same type of data as +the NT4-style SAM database (one of the registry files)[1].

    The Backup Domain Controller or BDC plays a key role in servicing network authentication requests. The BDC is biased to answer logon requests in preference to the PDC. -On a network segment that has a BDC and a PDC the BDC will be most likely to service network +On a network segment that has a BDC and a PDC, the BDC will most likely service network logon requests. The PDC will answer network logon requests when the BDC is too busy (high load). -A BDC can be promoted to a PDC. If the PDC is on line at the time that a BDC is promoted to -PDC, the previous PDC is automatically demoted to a BDC. With Samba-3 this is NOT an automatic -operation; the PDC and BDC must be manually configured and changes need to be made likewise. +A BDC can be promoted to a PDC. If the PDC is online at the time that a BDC is promoted to +PDC, the previous PDC is automatically demoted to a BDC. With Samba-3, this is not an automatic +operation; the PDC and BDC must be manually configured and changes also need to be made.

    -With MS Windows NT4, it is an install time decision what type of machine the server will be. -It is possible to change the promote a BDC to a PDC and vice versa only, but the only way -to convert a domain controller to a domain member server or a stand-alone server is to +With MS Windows NT4, a decision is made at installation to determine what type of machine the server will be. +It is possible to promote a BDC to a PDC and vice versa. The only way +to convert a Domain Controller to a Domain Member server or a Stand-alone Server is to reinstall it. The install time choices offered are: -

    • Primary Domain Controller - The one that seeds the domain SAM

    • Backup Domain Controller - One that obtains a copy of the domain SAM

    • Domain Member Server - One that has NO copy of the domain SAM, rather it obtains authentication from a Domain Controller for all access controls.

    • Stand-Alone Server - One that plays NO part is SAM synchronisation, has it's own authentication database and plays no role in Domain security.

    -With MS Windows 2000 the configuration of domain control is done after the server has been +

    • Primary Domain Controller the one that seeds the domain SAM.

    • Backup Domain Controller one that obtains a copy of the domain SAM.

    • Domain Member Server one that has no copy of the domain SAM, rather it obtains authentication from a Domain Controller for all access controls.

    • Stand-alone Server one that plays no part is SAM synchronization, has its own authentication database and plays no role in Domain Security.

    +With MS Windows 2000, the configuration of Domain Control is done after the server has been installed. Samba-3 is capable of acting fully as a native member of a Windows 200x server Active Directory domain.

    -New to Samba-3 is the ability to function fully as an MS Windows NT4 style Domain Controller, -excluding the SAM replication components. However, please be aware that Samba-3 support the -MS Windows 200x domain control protocols also. + +New to Samba-3 is the ability to function fully as an MS Windows NT4-style Domain Controller, +excluding the SAM replication components. However, please be aware that Samba-3 also supports the +MS Windows 200x Domain Control protocols.

    At this time any appearance that Samba-3 is capable of acting as an Domain Controller in native ADS mode is limited and experimental in nature. -This functionality should not be used until the Samba-Team offers formal support for it. +This functionality should not be used until the Samba Team offers formal support for it. At such a time, the documentation will be revised to duly reflect all configuration and management requirements. Samba can act as a NT4-style DC in a Windows 2000/XP environment. However, there are certain compromises: -

    • No machine policy files

    • No Group Policy Objects

    • No synchronously executed AD logon scripts

    • Can't use ANY Active Directory management tools to manage users and machines

    • Registry changes tattoo the main registry, while with AD they do NOT. ie: Leave permanent changes in effect

    • Without AD you can not peprform the function of exporting specific applications to specific users or groups

    -

    Preparing for Domain Control

    -There are two ways that MS Windows machines may interact with each other, with other servers, -and with Domain Controllers: Either as Stand-Alone systems, more commonly +

    • No machine policy files.
    • No Group Policy Objects.
    • No synchronously executed AD logon scripts.
    • Can't use Active Directory management tools to manage users and machines.
    • Registry changes tattoo the main registry, while with AD they do not leave permanent changes in effect.
    • Without AD you cannot perform the function of exporting specific applications to specific users or groups.

    +

    Preparing for Domain Control

    +There are two ways that MS Windows machines may interact with each other, with other servers +and with Domain Controllers: either as Stand-alone systems, more commonly called Workgroup members, or as full participants in a security system, more commonly called Domain members.

    -It should be noted that Workgroup membership involve no special configuration -other than the machine being configured so that the network configuration has a commonly used name -for it's workgroup entry. It is not uncommon for the name WORKGROUP to be used for this. With this -mode of configuration there are NO machine trust accounts and any concept of membership as such -is limited to the fact that all machines appear in the network neighbourhood to be logically -grouped together. Again, just to be clear: workgroup mode does not involve any security machine +It should be noted that Workgroup membership involves no special configuration +other than the machine being configured so the network configuration has a commonly used name +for its workgroup entry. It is not uncommon for the name WORKGROUP to be used for this. With this +mode of configurationi, there are no Machine Trust Accounts and any concept of membership as such +is limited to the fact that all machines appear in the network neighborhood to be logically +grouped together. Again, just to be clear: workgroup mode does not involve security machine accounts.

    -Domain member machines have a machine account in the Domain accounts database. A special procedure -must be followed on each machine to affect Domain membership. This procedure, which can be done -only by the local machine Administrator account, will create the Domain machine account (if -if does not exist), and then initializes that account. When the client first logs onto the +Domain Member machines have a machine account in the Domain accounts database. A special procedure +must be followed on each machine to effect Domain Membership. This procedure, which can be done +only by the local machine Administrator account, will create the Domain machine account (if it does +not exist), and then initializes that account. When the client first logs onto the Domain it triggers a machine password change.

    Note

    -When running a Domain all MS Windows NT / 200x / XP Professional clients should be configured -as full Domain Members - IF A SECURE NETWORK IS WANTED. If the machine is NOT made a member of the -Domain, then it will operate like a workgroup (stand-alone) machine. Please refer to -the chapter on domain membership for information regarding HOW to make your MS Windows clients Domain members. +When Samba is configured as a Domain Controller, secure network operation demands that +all MS Windows NT4/200x/XP Professional clients should be configured as Domain Members. +If a machine is not made a member of the Domain, then it will operate like a workgroup +(Stand-alone) machine. Please refer to for +information regarding Domain Membership.

    -The following are necessary for configuring Samba-3 as an MS Windows NT4 style PDC for MS Windows -NT4 / 200x / XP clients. -

    • Configuration of basic TCP/IP and MS Windows Networking

    • Correct designation of the Server Role (security = user)

    • Consistent configuration of Name Resolution (See chapter on Network Browsing and on - Integrating Unix into Windows networks)

    • Domain logons for Windows NT4 / 200x / XP Professional clients

    • Configuration of Roaming Profiles or explicit configuration to force local profile usage

    • Configuration of Network/System Policies

    • Adding and managing domain user accounts

    • Configuring MS Windows client machines to become domain members

    -The following provisions are required to serve MS Windows 9x / Me Clients: -

    • Configuration of basic TCP/IP and MS Windows Networking

    • Correct designation of the Server Role (security = user)

    • Network Logon Configuration (Since Windows 9x / XP Home are not technically domain - members, they do not really participate in the security aspects of Domain logons as such)

    • Roaming Profile Configuration

    • Configuration of System Policy handling

    • Installation of the Network driver "Client for MS Windows Networks" and configuration - to log onto the domain

    • Placing Windows 9x / Me clients in user level security - if it is desired to allow - all client share access to be controlled according to domain user / group identities.

    • Adding and managing domain user accounts

    Note

    +The following are necessary for configuring Samba-3 as an MS Windows NT4-style PDC for MS Windows +NT4/200x/XP clients: +

    • Configuration of basic TCP/IP and MS Windows networking.

    • Correct designation of the Server Role (security = user).

    • Consistent configuration of Name Resolution[2].

    • Domain logons for Windows NT4/200x/XP Professional clients.

    • Configuration of Roaming Profiles or explicit configuration to force local profile usage.

    • Configuration of network/system policies.

    • Adding and managing domain user accounts.

    • Configuring MS Windows client machines to become Domain Members.

    +The following provisions are required to serve MS Windows 9x/Me clients: +

    • Configuration of basic TCP/IP and MS Windows networking.

    • Correct designation of the server role (security = user).

    • Network Logon Configuration (since Windows 9x/Me/XP Home are not technically domain + members, they do not really participate in the security aspects of Domain logons as such).

    • Roaming Profile Configuration.

    • Configuration of System Policy handling.

    • Installation of the network driver “Client for MS Windows Networks” and configuration + to log onto the domain.

    • Placing Windows 9x/Me clients in User Level Security if it is desired to allow + all client share access to be controlled according to domain user/group identities.

    • Adding and managing domain user accounts.

    Note

    Roaming Profiles and System/Network policies are advanced network administration topics -that are covered in the Profile Management and -Policy Management chapters of this document. However, these are not +that are covered in the and + chapters of this document. However, these are not necessarily specific to a Samba PDC as much as they are related to Windows NT networking concepts.

    A Domain Controller is an SMB/CIFS server that:

    • Registers and advertises itself as a Domain Controller (through NetBIOS broadcasts as well as by way of name registrations either by Mailslot Broadcasts over UDP broadcast, - to a WINS server over UDP unicast, or via DNS and Active Directory) + to a WINS server over UDP unicast, or via DNS and Active Directory).

    • - Provides the NETLOGON service (actually a collection of services that runs over - a number of protocols. These include the LanMan Logon service, the Netlogon service, - the Local Security Account service, and variations of them) + Provides the NETLOGON service. (This is actually a collection of services that runs over + mulitple protocols. These include the LanMan Logon service, the Netlogon service, + the Local Security Account service, and variations of them.)

    • - Provides a share called NETLOGON + Provides a share called NETLOGON.

    -For Samba to provide these is rather easy to configure. Each Samba Domain Controller must provide -the NETLOGON service which Samba calls the domain logons functionality -(after the name of the parameter in the smb.conf file). Additionally, one (1) server in a Samba-3 -Domain must advertise itself as the domain master browser[2]. This causes the Primary Domain Controller -to claim domain specific NetBIOS name that identifies it as a domain master browser for its given -domain/workgroup. Local master browsers in the same domain/workgroup on broadcast-isolated subnets -then ask for a complete copy of the browse list for the whole wide area network. Browser clients -will then contact their local master browser, and will receive the domain-wide browse list, +It is rather easy to configure Samba to provide these. Each Samba Domain Controller must provide +the NETLOGON service that Samba calls the domain logons functionality +(after the name of the parameter in the smb.conf file). Additionally, one server in a Samba-3 +Domain must advertise itself as the Domain Master Browser[3]. +This causes the Primary Domain Controller to claim a domain-specific NetBIOS name that identifies it as a +Domain Master Browser for its given domain or workgroup. Local master browsers in the same domain or workgroup on +broadcast-isolated subnets then ask for a complete copy of the browse list for the whole wide area network. +Browser clients will then contact their Local Master Browser, and will receive the domain-wide browse list, instead of just the list for their broadcast-isolated subnet. -

    Domain Control - Example Configuration

    +

    Domain Control Example Configuration

    The first step in creating a working Samba PDC is to understand the parameters necessary -in smb.conf. An example smb.conf for acting as a PDC can be found in the example -for being a PDC. +in smb.conf. An example smb.conf for acting as a PDC can be found in .

    -

    Example 5.1. smb.conf for being a PDC

    [global]
    netbios name = BELERIAND
    workgroup = MIDEARTH
    passdb backend = ldapsam, guest
    os level = 33
    preferred master = yes
    domain master = yes
    local master = yes
    security = user
    encrypt passwords = yes
    domain logons = yes
    logon path = \\%N\profiles\%u
    logon drive = H:
    logon home = \\homeserver\%u\winprofile
    logon script = logon.cmd
    [netlogon]
    path = /var/lib/samba/netlogon
    read only = yes
    write list = ntadmin
    [profiles]
    path = /var/lib/samba/profiles
    read only = no
    create mask = 0600
    directory mask = 0700

    +

    Example 5.1. smb.conf for being a PDC

    [global]
    netbios name = BELERIAND
    workgroup = MIDEARTH
    passdb backend = tdbsam
    os level = 33
    preferred master = yes
    domain master = yes
    local master = yes
    security = user
    domain logons = yes
    logon path = \\%N\profiles\%u
    logon drive = H:
    logon home = \\homeserver\%u\winprofile
    logon script = logon.cmd
    [netlogon]
    path = /var/lib/samba/netlogon
    read only = yes
    write list = ntadmin
    [profiles]
    path = /var/lib/samba/profiles
    read only = no
    create mask = 0600
    directory mask = 0700

    -The basic options shown above are explained as follows: -

    passdb backend

    +The basic options shown in are explained as follows: +

    passdb backend

    This contains all the user and group account information. Acceptable values for a PDC - are: smbpasswd, tdbsam, ldapsam. The 'guest' entry provides needed - default accounts.

    - Where is is intended to use backup domain controllers (BDCs) the only logical choice is - to use LDAP so that the passdb backend can be distributed. The tdbsam and smbpasswd files - can not effectively be distributed and therefore should not be used. -

    Domain Control Parameters

    + are: smbpasswd, tdbsam, and ldapsam. The “guest” entry provides + default accounts and is included by default, there is no need to add it explicitly.

    + Where use of backup Domain Controllers (BDCs) is intended, the only logical choice is + to use LDAP so the passdb backend can be distributed. The tdbsam and smbpasswd files + cannot effectively be distributed and therefore should not be used. +

    Domain Control Parameters

    The parameters os level, preferred master, domain master, security, - encrypt passwords, domain logons play a central role in assuring domain + encrypt passwords, and domain logons play a central role in assuring domain control and network logon support.

    - The os level must be set at or above a value of 32. A domain controller - must be the domain master browser, must be set in user mode security, - must support Microsoft compatible encrypted passwords, and must provide the network logon - service (domain logons). Encrypted passwords must be enabled, for more details on how - to do this, refer to the chapter on account information databases. -

    Environment Parameters

    - The parameters logon path, logon home, logon drive, logon script are + The os level must be set at or above a value of 32. A Domain Controller + must be the Domain Master Browser, must be set in user mode security, + must support Microsoft-compatible encrypted passwords, and must provide the network logon + service (domain logons). Encrypted passwords must be enabled. For more details on how + to do this, refer to . +

    Environment Parameters

    + The parameters logon path, logon home, logon drive, and logon script are environment support settings that help to facilitate client logon operations and that help to provide automated control facilities to ease network management overheads. Please refer to the man page information for these parameters. -

    NETLOGON Share

    - The NETLOGON share plays a central role in domain logon and domain membership support. - This share is provided on all Microsoft domain controllers. It is used to provide logon +

    NETLOGON Share

    + The NETLOGON share plays a central role in domain logon and Domain Membership support. + This share is provided on all Microsoft Domain Controllers. It is used to provide logon scripts, to store Group Policy files (NTConfig.POL), as well as to locate other common - tools that may be needed for logon processing. This is an essential share on a domain controller. -

    PROFILE Share

    - This share is used to store user desktop profiles. Eash user must have a directory at the root - of this share. This directory must be write enabled for the user and must be globally read enabled. - Samba-3 has a VFS module called 'fake_permissions' that may be installed on this share. This will - allow a Samba administrator to make the directory read only to everyone. Of course this is useful + tools that may be needed for logon processing. This is an essential share on a Domain Controller. +

    PROFILE Share

    + This share is used to store user desktop profiles. Each user must have a directory at the root + of this share. This directory must be write-enabled for the user and must be globally read-enabled. + Samba-3 has a VFS module called “fake_permissions” that may be installed on this share. This will + allow a Samba administrator to make the directory read-only to everyone. Of course this is useful only after the profile has been properly created.

    Note

    The above parameters make for a full set of parameters that may define the server's mode @@ -264,69 +279,69 @@ of operation. The following smb.conf parameters are th

    netbios name = BELERIAND
    workgroup = MIDEARTH
    domain logons = Yes
    domain master = Yes
    security = User

    The additional parameters shown in the longer listing above just makes for -more complete explanation. -

    Samba ADS Domain Control

    -Samba-3 is not, and can not act as, an Active Directory Server. It can not truly function as +a more complete explanation. +

    Samba ADS Domain Control

    +Samba-3 is not, and cannot act as, an Active Directory Server. It cannot truly function as an Active Directory Primary Domain Controller. The protocols for some of the functionality -the Active Directory Domain Controllers has been partially implemented on an experimental -only basis. Please do NOT expect Samba-3 to support these protocols. Do not depend -on any such functionality either now or in the future. The Samba-Team may remove these -experimental features or may change their behaviour. This is mentioned for the benefit of those -who have discovered secret capabilities in samba-3 and who have asked when this functionality will be -completed. The answer is: Maybe or maybe never! -

    -To be sure: Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4 style -domain controllers have. Samba-3 does NOT have all the capabilities of Windows NT4, but it does have +of Active Directory Domain Controllers has been partially implemented on an experimental +only basis. Please do not expect Samba-3 to support these protocols. Do not depend +on any such functionality either now or in the future. The Samba Team may remove these +experimental features or may change their behavior. This is mentioned for the benefit of those +who have discovered secret capabilities in Samba-3 and who have asked when this functionality will be +completed. The answer is maybe or maybe never! +

    +To be sure, Samba-3 is designed to provide most of the functionality that Microsoft Windows NT4-style +Domain Controllers have. Samba-3 does not have all the capabilities of Windows NT4, but it does have a number of features that Windows NT4 domain contollers do not have. In short, Samba-3 is not NT4 and it -is not Windows Server 200x and it is not an Active Directory server. We hope this is plain and simple +is not Windows Server 200x, it is not an Active Directory server. We hope this is plain and simple enough for all to understand. -

    Domain and Network Logon Configuration

    +

    Domain and Network Logon Configuration

    The subject of Network or Domain Logons is discussed here because it forms an integral part of the essential functionality that is provided by a Domain Controller. -

    Domain Network Logon Service

    +

    Domain Network Logon Service

    All Domain Controllers must run the netlogon service (domain logons -in Samba). One Domain Controller must be configured with domain master = Yes -(the Primary Domain Controller); on ALL Backup Domain Controllers domain master = No +in Samba). One Domain Controller must be configured with domain master = Yes +(the Primary Domain Controller); on all Backup Domain Controllers domain master = No must be set. -

    Example Configuration

    Example 5.2. smb.conf for being a PDC

    [global]
    domain logons = Yes
    domain master = (Yes on PDC, No on BDCs)
    [netlogon]
    comment = Network Logon Service
    path = /var/lib/samba/netlogon
    guest ok = Yes
    browseable = No

    The Special Case of MS Windows XP Home Edition

    Note

    +

    Example Configuration

    Example 5.2. smb.conf for being a PDC

    [global]
    domain logons = Yes
    domain master = (Yes on PDC, No on BDCs)
    [netlogon]
    comment = Network Logon Service
    path = /var/lib/samba/netlogon
    guest ok = Yes
    browseable = No

    The Special Case of MS Windows XP Home Edition

    +To be completely clear: If you want MS Windows XP Home Edition to integrate with your +MS Windows NT4 or Active Directory Domain Security, understand it cannot be done. +The only option is to purchase the upgrade from MS Windows XP Home Edition to +MS Windows XP Professional. +

    Note

    MS Windows XP Home Edition does not have the ability to join any type of Domain -security facility. Unlike, MS Windows 9x / Me, MS Windows XP Home Edition also completely +Security facility. Unlike MS Windows 9x/Me, MS Windows XP Home Edition also completely lacks the ability to log onto a network.

    -To be completely clear: If you want MS Windows XP Home Edition to integrate with your -MS Windows NT4 or Active Directory Domain security understand - IT CAN NOT BE DONE. -Your only choice is to buy the upgrade pack from MS Windows XP Home Edition to -MS Windows XP Professional. -

    -Now that this has been said, please do NOT ask the mailing list, or email any of the -Samba-Team members with your questions asking how to make this work. It can't be done. +Now that this has been said, please do not ask the mailing list or email any of the +Samba Team members with your questions asking how to make this work. It can't be done. If it can be done, then to do so would violate your software license agreement with Microsoft, and we recommend that you do not do that. -

    The Special Case of Windows 9x / Me

    +

    The Special Case of Windows 9x/Me

    A domain and a workgroup are exactly the same in terms of network -browsing. The difference is that a distributable authentication +browsing. The difference is that a distributable authentication database is associated with a domain, for secure login access to a -network. Also, different access rights can be granted to users if they +network. Also, different access rights can be granted to users if they successfully authenticate against a domain logon server. Samba-3 does this -now in the same way that MS Windows NT/2K. +now in the same way as MS Windows NT/200x.

    The SMB client logging on to a domain has an expectation that every other server in the domain should accept the same authentication information. Network browsing functionality of domains and workgroups is identical and is explained in this documentation under the browsing discussions. -It should be noted, that browsing is totally orthogonal to logon support. +It should be noted that browsing is totally orthogonal to logon support.

    Issues related to the single-logon network model are discussed in this -section. Samba supports domain logons, network logon scripts, and user -profiles for MS Windows for workgroups and MS Windows 9X/ME clients +section. Samba supports domain logons, network logon scripts and user +profiles for MS Windows for workgroups and MS Windows 9X/ME clients, which are the focus of this section.

    When an SMB client in a domain wishes to logon, it broadcasts requests for a -logon server. The first one to reply gets the job, and validates its +logon server. The first one to reply gets the job, and validates its password using whatever mechanism the Samba administrator has installed. It is possible (but ill advised ) to create a domain where the user -database is not shared between servers, i.e. they are effectively workgroup -servers advertising themselves as participating in a domain. This +database is not shared between servers, i.e., they are effectively workgroup +servers advertising themselves as participating in a domain. This demonstrates how authentication is quite different from but closely involved with domains.

    @@ -334,121 +349,119 @@ Using these features you can make your clients verify their logon via the Samba server; make clients run a batch file when they logon to the network and download their preferences, desktop and start menu.

    -MS Windows XP Home edition is NOT able to join a domain and does not permit +MS Windows XP Home edition is not able to join a domain and does not permit the use of domain logons.

    Before launching into the configuration instructions, it is -worthwhile to look at how a Windows 9x/ME client performs a logon: +worthwhile to look at how a Windows 9x/Me client performs a logon:

    1. The client broadcasts (to the IP broadcast address of the subnet it is in) a NetLogon request. This is sent to the NetBIOS name DOMAIN<#1c> at the - NetBIOS layer. The client chooses the first response it receives, which + NetBIOS layer. The client chooses the first response it receives, which contains the NetBIOS name of the logon server to use in the format of \\SERVER.

    2. - The client then connects to that server, logs on (does an SMBsessetupX) and + The client connects to that server, logs on (does an SMBsessetupX) and then connects to the IPC$ share (using an SMBtconX).

    3. - The client then does a NetWkstaUserLogon request, which retrieves the name + The client does a NetWkstaUserLogon request, which retrieves the name of the user's logon script.

    4. - The client then connects to the NetLogon share and searches for said script - and if it is found and can be read, is retrieved and executed by the client. + The client then connects to the NetLogon share and searches for said script. + If it is found and can be read, it is retrieved and executed by the client. After this, the client disconnects from the NetLogon share.

    5. - The client then sends a NetUserGetInfo request to the server, to retrieve + The client sends a NetUserGetInfo request to the server to retrieve the user's home share, which is used to search for profiles. Since the response to the NetUserGetInfo request does not contain much more than - the user's home share, profiles for Win9X clients MUST reside in the user + the user's home share, profiles for Windows 9x clients must reside in the user home directory.

    6. - The client then connects to the user's home share and searches for the + The client connects to the user's home share and searches for the user's profile. As it turns out, you can specify the user's home share as a sharename and path. For example, \\server\fred\.winprofile. If the profiles are found, they are implemented.

    7. - The client then disconnects from the user's home share, and reconnects to + The client then disconnects from the user's home share and reconnects to the NetLogon share and looks for CONFIG.POL, the policies file. If this is found, it is read and implemented.

    -The main difference between a PDC and a Windows 9x logon server configuration is that +The main difference between a PDC and a Windows 9x/Me logon server configuration is:

    • - Password encryption is not required for a Windows 9x logon server. But note + Password encryption is not required for a Windows 9x/Me logon server. But note that beginning with MS Windows 98 the default setting is that plain-text password support is disabled. It can be re-enabled with the registry - changes that are documented in the chapter on Policies. + changes that are documented in .

    • - Windows 9x/ME clients do not require and do not use machine trust accounts. + Windows 9x/Me clients do not require and do not use Machine Trust Accounts.

    -A Samba PDC will act as a Windows 9x logon server; after all, it does provide the -network logon services that MS Windows 9x / Me expect to find. +A Samba PDC will act as a Windows 9x/Me logon server; after all, it does provide the +network logon services that MS Windows 9x/Me expect to find.

    Note

    Use of plain-text passwords is strongly discouraged. Where used they are easily detected using a sniffer tool to examine network traffic. -

    Security Mode and Master Browsers

    -There are a few comments to make in order to tie up some -loose ends. There has been much debate over the issue of whether -or not it is ok to configure Samba as a Domain Controller in security -modes other than USER. The only security mode -which will not work due to technical reasons is SHARE -mode security. DOMAIN and SERVER -mode security are really just a variation on SMB user level security. +

    Security Mode and Master Browsers

    +There are a few comments to make in order to tie up some loose ends. There has been +much debate over the issue of whether it is okay to configure Samba as a Domain +Controller in security modes other than user. The only security mode that will +not work due to technical reasons is share-mode security. Domain and server mode +security are really just a variation on SMB User Level Security.

    Actually, this issue is also closely tied to the debate on whether -or not Samba must be the domain master browser for its workgroup -when operating as a DC. While it may technically be possible +Samba must be the Domain Master Browser for its workgroup +when operating as a DC. While it may technically be possible to configure a server as such (after all, browsing and domain logons are two distinctly different functions), it is not a good idea to do -so. You should remember that the DC must register the DOMAIN<#1b> NetBIOS -name. This is the name used by Windows clients to locate the DC. +so. You should remember that the DC must register the DOMAIN<#1b> NetBIOS +name. This is the name used by Windows clients to locate the DC. Windows clients do not distinguish between the DC and the DMB. -A DMB is a Domain Master Browser - see Domain Master Browser. -For this reason, it is very wise to configure the Samba DC as the DMB. -

    -Now back to the issue of configuring a Samba DC to use a mode other -than security = user. If a Samba host is configured to use -another SMB server or DC in order to validate user connection -requests, then it is a fact that some other machine on the network -(the password server) knows more about the user than the Samba host. -99% of the time, this other host is a domain controller. Now -in order to operate in domain mode security, the workgroup parameter -must be set to the name of the Windows NT domain (which already -has a domain controller). If the domain does NOT already have a Domain Controller -then you do not yet have a Domain! +A DMB is a Domain Master Browser see . +For this reason, it is wise to configure the Samba DC as the DMB. +

    +Now back to the issue of configuring a Samba DC to use a mode other than +security = user. If a Samba host is +configured to use another SMB server or DC in order to validate user connection requests, +it is a fact that some other machine on the network (the password server) +knows more about the user than the Samba host. About 99% of the time, this other host is +a Domain Controller. Now to operate in domain mode security, the workgroup +parameter must be set to the name of the Windows NT domain (which already has a Domain Controller). +If the domain does not already have a Domain Controller, you do not yet have a Domain.

    Configuring a Samba box as a DC for a domain that already by definition has a PDC is asking for trouble. Therefore, you should always configure the Samba DC -to be the DMB for its domain and set security = user. +to be the DMB for its domain and set security = user. This is the only officially supported mode of operation. -

    Common Errors

    '$' cannot be included in machine name

    -A 'machine account', (typically) stored in /etc/passwd, -takes the form of the machine name with a '$' appended. FreeBSD (and other BSD -systems?) won't create a user with a '$' in their name. +

    Common Errors

    “$” Cannot Be Included in Machine Name

    +A machine account, typically stored in /etc/passwd, takes the form of the machine +name with a “$” appended. FreeBSD (and other BSD systems) will not create a user with a +“$” in the name.

    The problem is only in the program used to make the entry. Once made, it works perfectly. -Create a user without the '$'. Then use vipw to edit the entry, adding -the '$'. Or create the whole entry with vipw if you like; make sure you use a unique User ID! -

    Note

    -The UNIX tool vipw is a common tool for directly editting the /etc/passwd file. -

    Joining domain fails because of existing machine account

    “I get told "You already have a connection to the Domain...." -or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account.”

    -This happens if you try to create a machine trust account from the -machine itself and already have a connection (e.g. mapped drive) -to a share (or IPC$) on the Samba PDC. The following command +Create a user without the “$”. Then use vipw to edit the entry, adding +the “$”. Or create the whole entry with vipw if you like; make sure you use a unique user login ID. +

    Note

    The machine account must have the exact name that the workstation has.

    Note

    +The UNIX tool vipw is a common tool for directly editing the /etc/passwd file. +

    Joining Domain Fails Because of Existing Machine Account

    +“I get told, `You already have a connection to the Domain....' or `Cannot join domain, the +credentials supplied conflict with an existing set...' when creating a Machine Trust Account.” +

    +This happens if you try to create a Machine Trust Account from the machine itself and already have a +connection (e.g., mapped drive) to a share (or IPC$) on the Samba PDC. The following command will remove all network drive connections: 

     C:\> net use * /d

    -Further, if the machine is already a 'member of a workgroup' that +

    +Further, if the machine is already a “member of a workgroup” that is the same name as the domain you are joining (bad idea) you will -get this message. Change the workgroup name to something else, it +get this message. Change the workgroup name to something else, it does not matter what, reboot, and try again. -

    The system can not log you on (C000019B)....

    “I joined the domain successfully but after upgrading -to a newer version of the Samba code I get the message, The system -can not log you on (C000019B), Please try again or consult your -system administrator when attempting to logon.” +

    The System Cannot Log You On (C000019B)

    “I joined the domain successfully but after upgrading +to a newer version of the Samba code I get the message, `The system +cannot log you on (C000019B), Please try again or consult your +system administrator when attempting to logon.'”

    + This occurs when the domain SID stored in the secrets.tdb database is changed. The most common cause of a change in domain SID is when the domain name and/or the server name (NetBIOS name) is changed. @@ -456,55 +469,62 @@ The only way to correct the problem is to restore the original domain SID or remove the domain client from the domain and rejoin. The domain SID may be reset using either the net or rpcclient utilities.

    -The reset or change the domain SID you can use the net command as follows: +To reset or change the domain SID you can use the net command as follows: 

     root# net getlocalsid 'OLDNAME'
 root# net setlocalsid 'SID'

    -Workstation machine trust accounts work only with the Domain (or network) SID. If this SID changes -then domain members (workstations) will not be able to log onto the domain. The original Domain SID +Workstation Machine Trust Accounts work only with the Domain (or network) SID. If this SID changes +Domain Members (workstations) will not be able to log onto the domain. The original Domain SID can be recovered from the secrets.tdb file. The alternative is to visit each workstation to re-join it to the domain. -

    The machine trust account not accessible

    - “When I try to join the domain I get the message The machine account -for this computer either does not exist or is not accessible. What's +

    The Machine Trust Account Is Not Accessible

    +“When I try to join the domain I get the message, `The machine account +for this computer either does not exist or is not accessible'. What's wrong?”

    -This problem is caused by the PDC not having a suitable machine trust account. -If you are using the add machine script method to create +This problem is caused by the PDC not having a suitable Machine Trust Account. +If you are using the add machine script method to create accounts then this would indicate that it has not worked. Ensure the domain admin user system is working.

    -Alternatively if you are creating account entries manually then they +Alternately, if you are creating account entries manually then they have not been created correctly. Make sure that you have the entry -correct for the machine trust account in smbpasswd file on the Samba PDC. +correct for the Machine Trust Account in smbpasswd file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, make sure that the account name is the machine NetBIOS name -with a '$' appended to it ( i.e. computer_name$ ). There must be an entry +with a “$” appended to it (i.e., computer_name$). There must be an entry in both /etc/passwd and the smbpasswd file.

    -Some people have also reported -that inconsistent subnet masks between the Samba server and the NT -client can cause this problem. Make sure that these are consistent -for both client and server. -

    Account disabled

    “When I attempt to login to a Samba Domain from a NT4/W2K workstation, - I get a message about my account being disabled.”

    +Some people have also reported that inconsistent subnet masks between the Samba server and the NT +client can cause this problem. Make sure that these are consistent for both client and server. +

    Account Disabled

    “When I attempt to login to a Samba Domain from a NT4/W200x workstation, +I get a message about my account being disabled.”

    Enable the user accounts with smbpasswd -e username -, this is normally done as an account is created. -

    Domain Controller Unavailable

    “Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable"”

    - A domain controller has to announce on the network who it is. This usually takes a while. -

    Can not log onto domain member workstation after joining domain

    After successfully joining the domain user logons fail with one of two messages:

    One to the effect that the domain controller can not be found, the other claiming that the - account does not exist in the domain or that the password is incorrect.

    This may be due to incompatible settings between - the Windows client and the Samba-3 server for schannel (secure channel) settings - or smb signing settings. Check your samba settings for - client schannel, server schannel, client signing, server signing by executing: - testparm -v | more and looking for the value of these parameters. -

    - Also use the Microsoft Management Console - Local Security Settings. This tool is available from the - Control Panel. The Policy settings are found in the Local Policies / Securty Options area and are prefixed by - Secure Channel: ..., and Digitally sign .... -

    - It is important that these be set consistently with the Samba-3 server settings. -


    [1] See also the chapter on Account Information Databases.

    [2] See also the chapter about network browsing

    Prev Up Next
    Chapter 4. Server Types and Security Modes Home Chapter 6. Backup Domain Control
    +    . This is normally done as an account is created. +

    Domain Controller Unavailable

    “Until a few minutes after Samba has started, clients get the error `Domain Controller Unavailable'”

    +A Domain Controller has to announce its role on the network. This usually takes a while. Be patient for up to fifteen minutes, +then try again. +

    Cannot Log onto Domain Member Workstation After Joining Domain

    + + +After successfully joining the domain, user logons fail with one of two messages: one to the +effect that the Domain Controller cannot be found; the other claims that the account does not +exist in the domain or that the password is incorrect. This may be due to incompatible +settings between the Windows client and the Samba-3 server for schannel +(secure channel) settings or smb signing settings. Check your Samba +settings for client schannel, server schannel, client signing, server signing +by executing: +

    +testparm -v | more and looking for the value of these parameters.
+

    +

    +Also use the Microsoft Management Console Local Security Settings. This tool is available from the +Control Panel. The Policy settings are found in the Local Policies/Securty Options area and are prefixed by +Secure Channel: ..., and Digitally sign ..... +

    +It is important that these be set consistently with the Samba-3 server settings. +


    [2] See , and + .

    Prev Up Next
    Chapter 4. Server Types and Security Modes Home Chapter 6. Backup Domain Control
    diff --git a/docs/htmldocs/samba.7.html b/docs/htmldocs/samba.7.html index a0e5b8937c..7df44688aa 100644 --- a/docs/htmldocs/samba.7.html +++ b/docs/htmldocs/samba.7.html @@ -2,8 +2,8 @@ that implements the Server Message Block (commonly abbreviated as SMB) protocol for UNIX systems. This protocol is sometimes also referred to as the Common Internet File System (CIFS). For a - more thorough description, see - http://www.ubiqx.org/cifs/. Samba also implements the NetBIOS + more thorough description, see + http://www.ubiqx.org/cifs/. Samba also implements the NetBIOS protocol in nmbd.

    smbd(8)

    The smbd daemon provides the file and print services to SMB clients, such as Windows 95/98, Windows NT, Windows for Workgroups or LanManager. The configuration file @@ -70,9 +70,9 @@ recommended that you read the documentation that comes with Samba and the manual pages of those components that you use. If the manual pages and documents aren't clear enough then please visit - http://devel.samba.org + http://devel.samba.org for information on how to file a bug report or submit a patch.

    If you require help, visit the Samba webpage at - http://www.samba.org/ and + http://www.samba.org/ and explore the many option available to you.

    AVAILABILITY

    The Samba software suite is licensed under the GNU Public License(GPL). A copy of that license should @@ -82,25 +82,25 @@ obtained via anonymous ftp from samba.org in the directory pub/samba/. It is also available on several mirror sites worldwide.

    You may also find useful information about Samba - on the newsgroup - comp.protocol.smb and the Samba mailing + on the newsgroup + comp.protocol.smb and the Samba mailing list. Details on how to join the mailing list are given in the README file that comes with Samba.

    If you have access to a WWW viewer (such as Mozilla or Konqueror) then you will also find lots of useful information, including back issues of the Samba mailing list, at - http://lists.samba.org.

    VERSION

    This man page is correct for version 3.0 of the + http://lists.samba.org.

    VERSION

    This man page is correct for version 3.0 of the Samba suite.

    CONTRIBUTIONS

    If you wish to contribute to the Samba project, then I suggest you join the Samba mailing list at - http://lists.samba.org. + http://lists.samba.org.

    If you have patches to submit, visit - http://devel.samba.org/ + http://devel.samba.org/ for information on how to do it properly. We prefer patches in diff -u format.

    CONTRIBUTORS

    Contributors to the project are now too numerous to mention here but all deserve the thanks of all Samba users. To see a full list, look at the change-log in the source package - for the pre-CVS changes and at - http://cvs.samba.org/ + for the pre-CVS changes and at + http://cvs.samba.org/ for the contributors to Samba post-CVS. CVS is the Open Source source code control system used by the Samba Team to develop Samba. The project would have been unmanageable without it.

    AUTHOR

    The original Samba software and related utilities @@ -108,8 +108,8 @@ by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/securing-samba.html b/docs/htmldocs/securing-samba.html index 492780765e..f4adfe8fd6 100644 --- a/docs/htmldocs/securing-samba.html +++ b/docs/htmldocs/securing-samba.html @@ -1,192 +1,180 @@ -Chapter 15. Securing Samba
    Chapter 15. Securing Samba
    Prev Part III. Advanced Configuration Next

    Chapter 15. Securing Samba

    Andrew Tridgell

    Samba Team

    John H. Terpstra

    Samba Team

    May 26, 2003

    Table of Contents

    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using host based protection
    User based protection
    Using interface protection
    Using a firewall
    Using a IPC$ share deny
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient works on localhost, but the network is dead
    Why can users access home directories of other users?

    Introduction

    +Chapter 15. Securing Samba

    Chapter 15. Securing Samba
    Prev Part III. Advanced Configuration Next

    Chapter 15. Securing Samba

    Andrew Tridgell

    Samba Team

    John H. Terpstra

    Samba Team

    May 26, 2003

    Table of Contents

    Introduction
    Features and Benefits
    Technical Discussion of Protective Measures and Issues
    Using Host-Based Protection
    User-Based Protection
    Using Interface Protection
    Using a Firewall
    Using IPC$ Share-Based Denials
    NTLMv2 Security
    Upgrading Samba
    Common Errors
    Smbclient Works on Localhost, but the Network Is Dead
    Why Can Users Access Home Directories of Other Users?

    Introduction

    This note was attached to the Samba 2.2.8 release notes as it contained an -important security fix. The information contained here applies to Samba +important security fix. The information contained here applies to Samba installations in general. -

    -A new apprentice reported for duty to the Chief Engineer of a boiler house. He said, "Here I am, -if you will show me the boiler I'll start working on it." Then engineer replied, "You're leaning -on it!" -

    -Security concerns are just like that: You need to know a little about the subject to appreciate +

    +A new apprentice reported for duty to the chief engineer of a boiler house. He said, “Here I am, +if you will show me the boiler I'll start working on it.” Then engineer replied, “You're leaning +on it!” +

    +Security concerns are just like that. You need to know a little about the subject to appreciate how obvious most of it really is. The challenge for most of us is to discover that first morsel of knowledge with which we may unlock the secrets of the masters. -

    Features and Benefits

    -There are three level at which security principals must be observed in order to render a site -at least moderately secure. These are: the perimeter firewall, the configuration of the host -server that is running Samba, and Samba itself. +

    Features and Benefits

    +There are three levels at which security principals must be observed in order to render a site +at least moderately secure. They are the perimeter firewall, the configuration of the host +server that is running Samba and Samba itself.

    Samba permits a most flexible approach to network security. As far as possible Samba implements the latest protocols to permit more secure MS Windows file and print operations.

    Samba may be secured from connections that originate from outside the local network. This may be -done using host based protection (using samba's implementation of a technology -known as "tcpwrappers", or it may be done be using interface based exclusion -so that smbd will bind only to specifically permitted interfaces. It is also -possible to set specific share or resource based exclusions, eg: on the [IPC$] +done using host-based protection (using samba's implementation of a technology +known as “tcpwrappers,” or it may be done be using interface-based exclusion +so smbd will bind only to specifically permitted interfaces. It is also +possible to set specific share or resource-based exclusions, for example on the [IPC$] auto-share. The [IPC$] share is used for browsing purposes as well as to establish TCP/IP connections.

    -Another method by which Samba may be secured is by way of setting Access Control Entries in an Access -Control List on the shares themselves. This is discussed in the chapter on File, Directory and Share Access -Control. -

    Technical Discussion of Protective Measures and Issues

    +Another method by which Samba may be secured is by setting Access Control Entries (ACEs) in an Access +Control List (ACL) on the shares themselves. This is discussed in . +

    Technical Discussion of Protective Measures and Issues

    The key challenge of security is the fact that protective measures suffice at best only to close the door on known exploits and breach techniques. Never assume that because you have followed these few measures that the Samba server is now an impenetrable fortress! Given the history of information systems so far, it is only a matter of time before someone will find yet another vulnerability. -

    Using host based protection

    - In many installations of Samba the greatest threat comes for outside - your immediate network. By default Samba will accept connections from +

    Using Host-Based Protection

    + In many installations of Samba, the greatest threat comes from outside + your immediate network. By default, Samba will accept connections from any host, which means that if you run an insecure version of Samba on a host that is directly connected to the Internet you can be especially vulnerable.

    - One of the simplest fixes in this case is to use the hosts allow and - hosts deny options in the Samba smb.conf configuration file to only - allow access to your server from a specific range of hosts. An example - might be: + One of the simplest fixes in this case is to use the hosts allow and + hosts deny options in the Samba smb.conf configuration file to only + allow access to your server from a specific range of hosts. An example might be:

    hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24
    hosts deny = 0.0.0.0/0

    - The above will only allow SMB connections from 'localhost' (your own - computer) and from the two private networks 192.168.2 and - 192.168.3. All other connections will be refused as soon - as the client sends its first packet. The refusal will be marked as a - not listening on called name error. -

    User based protection

    - If you want to restrict access to your server to valid users only then the following + The above will only allow SMB connections from localhost (your own + computer) and from the two private networks 192.168.2 and 192.168.3. All other + connections will be refused as soon as the client sends its first packet. The refusal + will be marked as not listening on called name error. +

    User-Based Protection

    + If you want to restrict access to your server to valid users only, then the following method may be of use. In the smb.conf [global] section put:

    valid users = @smbusers, jacko

    - What this does is, it restricts all server access to either the user jacko + This restricts all server access to either the user jacko or to members of the system group smbusers. -

    Using interface protection

    - By default Samba will accept connections on any network interface that +

    Using Interface Protection

    + By default, Samba will accept connections on any network interface that it finds on your system. That means if you have a ISDN line or a PPP connection to the Internet then Samba will accept connections on those links. This may not be what you want.

    - You can change this behaviour using options like the following: + You can change this behavior using options like this:

    interfaces = eth* lo
    bind interfaces only = yes

    This tells Samba to only listen for connections on interfaces with a - name starting with 'eth' such as eth0, eth1, plus on the loopback - interface called 'lo'. The name you will need to use depends on what - OS you are using, in the above I used the common name for Ethernet + name starting with eth such as eth0, eth1 plus on the loopback + interface called lo. The name you will need to use depends on what + OS you are using. In the above, I used the common name for Ethernet adapters on Linux.

    - If you use the above and someone tries to make a SMB connection to - your host over a PPP interface called 'ppp0' then they will get a TCP - connection refused reply. In that case no Samba code is run at all as + If you use the above and someone tries to make an SMB connection to + your host over a PPP interface called ppp0, then they will get a TCP + connection refused reply. In that case, no Samba code is run at all as the operating system has been told not to pass connections from that - interface to any samba process. -

    Using a firewall

    - Many people use a firewall to deny access to services that they don't - want exposed outside their network. This can be a very good idea, - although I would recommend using it in conjunction with the above - methods so that you are protected even if your firewall is not active + interface to any Samba process. +

    Using a Firewall

    + Many people use a firewall to deny access to services they do not + want exposed outside their network. This can be a good idea, + although I recommend using it in conjunction with the above + methods so you are protected even if your firewall is not active for some reason.

    - If you are setting up a firewall then you need to know what TCP and + If you are setting up a firewall, you need to know what TCP and UDP ports to allow and block. Samba uses the following:

    UDP/137 - used by nmbd
    UDP/138 - used by nmbd
    TCP/139 - used by smbd
    TCP/445 - used by smbd

    The last one is important as many older firewall setups may not be aware of it, given that this port was only added to the protocol in recent years. -

    Using a IPC$ share deny

    +

    Using IPC$ Share-Based Denials

    If the above methods are not suitable, then you could also place a more specific deny on the IPC$ share that is used in the recently discovered security hole. This allows you to offer access to other shares while denying access to IPC$ from potentially untrustworthy hosts.

    - To do that you could use: -

    [ipc$]
    hosts allow = 192.168.115.0/24 127.0.0.1
    hosts deny = 0.0.0.0/0

    - this would tell Samba that IPC$ connections are not allowed from - anywhere but the two listed places (localhost and a local - subnet). Connections to other shares would still be allowed. As the - IPC$ share is the only share that is always accessible anonymously + To do this you could use: +

    [IPC$]
    hosts allow = 192.168.115.0/24 127.0.0.1
    hosts deny = 0.0.0.0/0

    + This instructs Samba that IPC$ connections are not allowed from + anywhere except from the two listed network addresses (localhost and the 192.168.115 + subnet). Connections to other shares are still allowed. As the + IPC$ share is the only share that is always accessible anonymously, this provides some level of protection against attackers that do not - know a username/password for your host. -

    - If you use this method then clients will be given a access denied - reply when they try to access the IPC$ share. That means that those - clients will not be able to browse shares, and may also be unable to - access some other resources. + know a valid username/password for your host.

    - This is not recommended unless you cannot use one of the other - methods listed above for some reason. -

    NTLMv2 Security

    - To configure NTLMv2 authentication the following registry keys are worth knowing about: + If you use this method, then clients will be given an `access denied' + reply when they try to access the IPC$ share. Those clients will not be able to + browse shares, and may also be unable to access some other resources. This is not + recommended unless you cannot use one of the other methods listed above for some reason. +

    NTLMv2 Security

    + To configure NTLMv2 authentication, the following registry keys are worth knowing about: 

     		[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
-		"lmcompatibilitylevel"=dword:00000003
+		"lmcompatibilitylevel"=dword:00000003

    - 0x3 - Send NTLMv2 response only. Clients will use NTLMv2 authentication, - use NTLMv2 session security if the server supports it. Domain - controllers accept LM, NTLM and NTLMv2 authentication. + The value 0x00000003 means send NTLMv2 response only. Clients will use NTLMv2 authentication, + use NTLMv2 session security if the server supports it. Domain Controllers accept LM, + NTLM and NTLMv2 authentication. 

     		[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
-		"NtlmMinClientSec"=dword:00080000
+		"NtlmMinClientSec"=dword:00080000

    - 0x80000 - NTLMv2 session security. If either NtlmMinClientSec or - NtlmMinServerSec is set to 0x80000, the connection will fail if NTLMv2 - session security is not negotiated. -

    Upgrading Samba

    -Please check regularly on http://www.samba.org/ for updates and -important announcements. Occasionally security releases are made and + The value 0x00080000 means permit only NTLMv2 session security. If either NtlmMinClientSec or + NtlmMinServerSec is set to 0x00080000, the connection will fail if NTLMv2 + session security is not negotiated. +

    Upgrading Samba

    +Please check regularly on http://www.samba.org/ for updates and +important announcements. Occasionally security releases are made and it is highly recommended to upgrade Samba when a security vulnerability is discovered. Check with your OS vendor for OS specific upgrades. -

    Common Errors

    -If all of samba and host platform configuration were really as intuitive as one might like then this +

    Common Errors

    +If all of Samba and host platform configuration were really as intuitive as one might like them to be, this section would not be necessary. Security issues are often vexing for a support person to resolve, not -because of the complexity of the problem, but for reason that most administrators who post what turns +because of the complexity of the problem, but for the reason that most administrators who post what turns out to be a security problem request are totally convinced that the problem is with Samba. -

    Smbclient works on localhost, but the network is dead

    - This is a very common problem. Red Hat Linux (as do others) will install a default firewall. - With the default firewall in place only traffic on the loopback adapter (IP address 127.0.0.1) - will be allowed through the firewall. +

    Smbclient Works on Localhost, but the Network Is Dead

    + This is a common problem. Red Hat Linux (and others) installs a default firewall. + With the default firewall in place, only traffic on the loopback adapter (IP address 127.0.0.1) + is allowed through the firewall.

    - The solution is either to remove the firewall (stop it) or to modify the firewall script to + The solution is either to remove the firewall (stop it) or modify the firewall script to allow SMB networking traffic through. See section above in this chapter. -

    Why can users access home directories of other users?

    +

    Why Can Users Access Home Directories of Other Users?

    “ We are unable to keep individual users from mapping to any other user's home directory once they have supplied a valid password! They only need - to enter their own password. I have not found *any* method that I can - use to configure samba to enforce that only a user may map their own - home directory. + to enter their own password. I have not found any method to configure + Samba so that users may map only their own home directory. ”

    “ User xyzzy can map his home directory. Once mapped user xyzzy can also map - *anyone* else's home directory! + anyone else's home directory. ”

    - This is not a security flaw, it is by design. Samba allows - users to have *exactly* the same access to the UNIX filesystem - as they would if they were logged onto the UNIX box, except - that it only allows such views onto the file system as are - allowed by the defined shares. + This is not a security flaw, it is by design. Samba allows users to have + exactly the same access to the UNIX file system as when they were logged + onto the UNIX box, except that it only allows such views onto the file + system as are allowed by the defined shares.

    - This means that if your UNIX home directories are set up - such that one user can happily cd into another users - directory and do an ls, the UNIX security solution is to - change the UNIX file permissions on the users home directories - such that the cd and ls would be denied. + If your UNIX home directories are set up so that one user can happily cd + into another users directory and execute ls, the UNIX security solution is to change file + permissions on the user's home directories such that the cd and ls are denied.

    - Samba tries very hard not to second guess the UNIX administrators - security policies, and trusts the UNIX admin to set - the policies and permissions he or she desires. + Samba tries very hard not to second guess the UNIX administrators security policies, and + trusts the UNIX admin to set the policies and permissions he or she desires.

    - Samba does allow the setup you require when you have set the - only user = yes option on the share, is that you have not set the - valid users list for the share. + Samba allows the behavior you require. Simply put the only user = %S + option in the [homes] share definition.

    - Note that only user works in conjunction with the users= list, + The only user works in conjunction with the users = list, so to get the behavior you require, add the line :

    users = %S

    - this is equivalent to: + this is equivalent to adding

    valid users = %S

    to the definition of the [homes] share, as recommended in the smb.conf man page. -

    Prev Up Next
    Chapter 14. File and Record Locking Home Chapter 16. Interdomain Trust Relationships
    +

    Prev Up Next
    Chapter 14. File and Record Locking Home Chapter 16. Interdomain Trust Relationships
    diff --git a/docs/htmldocs/smb.conf.5.html b/docs/htmldocs/smb.conf.5.html index b6eb609bb0..7db96d5481 100644 --- a/docs/htmldocs/smb.conf.5.html +++ b/docs/htmldocs/smb.conf.5.html @@ -183,8 +183,8 @@ alias|alias|alias|alias... 100% reliable. It currently recognizes Samba, WfWg, Win95, WinNT and Win2k. Anything else will be known as "UNKNOWN". If it gets it wrong then sending a level - 3 log to samba@samba.org - should allow it to be fixed.

    %I

    The IP address of the client machine.

    %T

    the current date and time.

    %D

    Name of the domain or workgroup of the current user.

    %$(envvar)

    The value of the environment variable + 3 log to samba@samba.org + should allow it to be fixed.

    %I

    The IP address of the client machine.

    %T

    the current date and time.

    %D

    Name of the domain or workgroup of the current user.

    %$(envvar)

    The value of the environment variable envar.

    The following substitutes apply only to some configuration options(only those that are used when a connection has been established):

    %S

    the name of the current service, if any.

    %P

    the root directory of the current service, if any.

    %u

    user name of the current service, if any.

    %g

    primary group name of %u.

    %H

    the home directory of the user given @@ -244,11 +244,10 @@ alias|alias|alias|alias... connection is made as the username given in the "guest account =" for the service, irrespective of the supplied password.

    COMPLETE LIST OF GLOBAL PARAMETERS

    Here is a list of all global parameters. See the section of - each parameter for details. Note that some are synonyms.

    COMPLETE LIST OF SERVICE PARAMETERS

    Here is a list of all service parameters. See the section on - each parameter for details. Note that some are synonyms.

    EXPLANATION OF EACH PARAMETER

    abort shutdown script (G)

    This parameter only exists in the HEAD cvs branch + each parameter for details. Note that some are synonyms.

    COMPLETE LIST OF SERVICE PARAMETERS

    Here is a list of all service parameters. See the section on + each parameter for details. Note that some are synonyms.

    EXPLANATION OF EACH PARAMETER

    abort shutdown script (G)

    This parameter only exists in the HEAD cvs branch This a full path name to a script called by smbd(8) that - should stop a shutdown procedure issued by the - shutdown script.

    This command will be run as user.

    Default: None.

    Example: abort shutdown script = /sbin/shutdown -c

    acl compatibility (S)

    This parameter specifies what OS ACL semantics should + should stop a shutdown procedure issued by the .

    This command will be run as user.

    Default: None.

    Example: abort shutdown script = /sbin/shutdown -c

    acl compatibility (S)

    This parameter specifies what OS ACL semantics should be compatible with. Possible values are winnt for Windows NT 4, win2k for Windows 2000 and above and auto. If you specify auto, the value for this parameter @@ -291,11 +290,8 @@ alias|alias|alias|alias... The "add printer command" program can output a single line of text, which Samba will set as the port the new printer is connected to. If this line isn't output, Samba won't reload its printer shares. -

    See also - deleteprinter command, - printing, - show add - printer wizard

    Default: none

    Example: addprinter command = /usr/bin/addprinter

    add share command (G)

    Samba 2.2.0 introduced the ability to dynamically +

    See also , , +

    Default: none

    Example: addprinter command = /usr/bin/addprinter

    add share command (G)

    Samba 2.2.0 introduced the ability to dynamically add and delete shares via the Windows NT 4.0 Server Manager. The add share command is used to define an external program or script which will add a new service definition @@ -316,12 +312,9 @@ alias|alias|alias|alias... with the new share.

    This parameter is only used for add file shares. To add printer shares, - see the addprinter - command. + see the .

    - See also change share - command, delete share - command. + See also , .

    Default: none

    Example: add share command = /usr/local/bin/addshare

    add user script (G)

    This is the full pathname to a script that will be run AS ROOT by smbd(8) under special circumstances described below.

    Normally, a Samba server requires that UNIX users are created for all users accessing files on this server. For sites @@ -343,11 +336,8 @@ alias|alias|alias|alias... any %u argument to be the user name to create.

    If this script successfully creates the user then smbd will continue on as though the UNIX user already existed. In this way, UNIX users are dynamically created to - match existing Windows NT accounts.

    See also - security, - password server, - delete user - script.

    Default: add user script = <empty string>

    Example: add user script = /usr/local/samba/bin/add_user %u

    add user to group script (G)

    Full path to the script that will be called when + match existing Windows NT accounts.

    See also , , + .

    Default: add user script = <empty string>

    Example: add user script = /usr/local/samba/bin/add_user %u

    add user to group script (G)

    Full path to the script that will be called when a user is added to a group using the Windows NT domain administration tools. It will be run by smbd(8) AS ROOT. Any %g will be replaced with the group name and @@ -356,7 +346,18 @@ alias|alias|alias|alias... administrative privileges on the share. This means that they will do all file operations as the super-user (root).

    You should use this option very carefully, as any user in this list will be able to do anything they like on the share, - irrespective of file permissions.

    Default: no admin users

    Example: admin users = jason

    algorithmic rid base (G)

    This determines how Samba will use its + irrespective of file permissions.

    Default: no admin users

    Example: admin users = jason

    afs share (S)

    This parameter controls whether special AFS features are enabled + for this share. If enabled, it assumes that the directory exported via + the path parameter is a local AFS import. The + special AFS features include the attempt to hand-craft an AFS token + if you enabled --with-fake-kaserver in configure. +

    Default: afs share = no

    Example: afs share = yes

    afs username map (G)

    If you are using the fake kaserver AFS feature, you might + want to hand-craft the usernames you are creating tokens for. + For example this is necessary if you have users from several domain + in your AFS Protection Database. One possible scheme to code users + as DOMAIN+User as it is done by winbind with the + as a separator. +

    The mapped user name must contain the cell name to log into, + so without setting this parameter there will be no token.

    Default: none

    Example: afs username map = %u@afs.samba.org

    algorithmic rid base (G)

    This determines how Samba will use its algorithmic mapping from uids/gid to the RIDs needed to construct NT Security Identifiers.

    Setting this option to a larger value could be useful to sites @@ -367,9 +368,7 @@ alias|alias|alias|alias... mapping can't be 'turned off', but pushing it 'out of the way' should resolve the issues. Users and groups can then be assigned 'low' RIDs in arbitary-rid supporting backends. -

    Default: algorithmic rid base = 1000

    Example: algorithmic rid base = 100000

    allow hosts (S)

    Synonym for - hosts allow.

    allow trusted domains (G)

    This option only takes effect when the - security option is set to +

    Default: algorithmic rid base = 1000

    Example: algorithmic rid base = 100000

    allow hosts (S)

    Synonym for .

    allow trusted domains (G)

    This option only takes effect when the option is set to server or domain. If it is set to no, then attempts to connect to a resource from a domain or workgroup other than the one which smbd is running @@ -394,8 +393,7 @@ alias|alias|alias|alias... is 4.9. Do not change this parameter unless you have a specific need to set a Samba server to be a downlevel server.

    Default: announce version = 4.9

    Example: announce version = 2.0

    auth methods (G)

    This option allows the administrator to chose what authentication methods smbd will use when authenticating - a user. This option defaults to sensible values based on - security. This should be considered + a user. This option defaults to sensible values based on . This should be considered a developer option and used only in rare circumstances. In the majority (if not all) of production servers, the default setting should be adequate.

    Each entry in the list attempts to authenticate the user in turn, until the user authenticates. In practice only one method will ever actually @@ -406,15 +404,14 @@ alias|alias|alias|alias... for remote users through winbindd), ntdomain (pre-winbindd method of authentication for remote domain users; deprecated in favour of winbind method), trustdomain (authenticate trusted users by contacting the - remote DC directly from smbd; deprecated in favour of winbind method).

    Default: auth methods = <empty string>

    Example: auth methods = guest sam winbind

    auto services (G)

    This is a synonym for the - preload.

    available (S)

    This parameter lets you "turn off" a service. If + remote DC directly from smbd; deprecated in favour of winbind method).

    Default: auth methods = <empty string>

    Example: auth methods = guest sam winbind

    auto services (G)

    This is a synonym for the .

    available (S)

    This parameter lets you "turn off" a service. If available = no, then ALL attempts to connect to the service will fail. Such failures are logged.

    Default: available = yes

    bind interfaces only (G)

    This global parameter allows the Samba admin to limit what interfaces on a machine will serve SMB requests. It affects file service smbd(8) and name service nmbd(8) in a slightly different ways.

    For name service it causes nmbd to bind to ports 137 and 138 on the interfaces listed in - the interfaces parameter. nmbd also + the parameter. nmbd also binds to the "all addresses" interface (0.0.0.0) on ports 137 and 138 for the purposes of reading broadcast messages. If this option is not set then nmbd will service @@ -429,7 +426,7 @@ alias|alias|alias|alias... interfaces list. IP Source address spoofing does defeat this simple check, however, so it must not be used seriously as a security feature for nmbd.

    For file service it causes smbd(8) to bind only to the interface list - given in the interfaces parameter. This + given in the parameter. This restricts the networks that smbd will serve to packets coming in those interfaces. Note that you should not use this parameter for machines that are serving PPP or other intermittent or non-broadcast network @@ -473,12 +470,11 @@ alias|alias|alias|alias... is an experimental option it may be removed in a future release.

    Changing this option does not change the disk free reporting size, just the block size unit reported to the client. -

    browsable (S)

    See the - browseable.

    browseable (S)

    This controls whether this share is seen in +

    browsable (S)

    See the .

    browseable (S)

    This controls whether this share is seen in the list of available shares in a net view and in the browse list.

    Default: browseable = yes

    browse list (G)

    This controls whether smbd(8) will serve a browse list to a client doing a NetServerEnum call. Normally set to yes. You should never need to change - this.

    Default: browse list = yes

    case sensitive (S)

    See the discussion in the section NAME MANGLING.

    Default: case sensitive = no

    casesignames (S)

    Synonym for case sensitive.

    change notify timeout (G)

    This SMB allows a client to tell a server to + this.

    Default: browse list = yes

    case sensitive (S)

    See the discussion in the section .

    Default: case sensitive = no

    casesignames (S)

    Synonym for .

    change notify timeout (G)

    This SMB allows a client to tell a server to "watch" a particular directory for any changes and only reply to the SMB request when a change has occurred. Such constant scanning of a directory is expensive under UNIX, hence an smbd(8) daemon only performs such a scan @@ -506,9 +502,7 @@ alias|alias|alias|alias... This parameter is only used modify existing file shares definitions. To modify printer shares, use the "Printers..." folder as seen when browsing the Samba host.

    - See also add share - command, delete - share command. + See also , .

    Default: none

    Example: change share command = /usr/local/bin/addshare

    client lanman auth (G)

    This parameter determines whether or not smbclient(8) and other samba client tools will attempt to authenticate itself to servers using the weaker LANMAN password hash. If disabled, only server which support NT @@ -524,7 +518,9 @@ alias|alias|alias|alias... response.

    If enabled, only an NTLMv2 and LMv2 response (both much more secure than earlier versions) will be sent. Many servers (including NT4 < SP4, Win9x and Samba 2.2) are not compatible with - NTLMv2.

    If disabled, an NTLM response (and possibly a LANMAN response) + NTLMv2.

    Similarly, if enabled, NTLMv1, client lanman auth and client plaintext auth + authentication will be disabled. This also disables share-level + authentication.

    If disabled, an NTLM response (and possibly a LANMAN response) will be sent by the client, depending on the value of client lanman auth.

    Note that some sites (particularly those following 'best practice' security polices) only allow NTLMv2 responses, and not the weaker LM or NTLM.

    Default : client ntlmv2 auth = no

    client plaintext auth (G)

    Specifies whether a client should send a plaintext @@ -551,8 +547,7 @@ alias|alias|alias|alias... when a client does a queries the server, either via the network neighborhood or via net view to list what shares are available.

    If you want to set the string that is displayed next to the - machine name then see the - server string parameter.

    Default: No comment string

    Example: comment = Fred's Files

    config file (G)

    This allows you to override the config file + machine name then see the parameter.

    Default: No comment string

    Example: comment = Fred's Files

    config file (G)

    This allows you to override the config file to use, instead of the default (usually smb.conf). There is a chicken and egg problem here as this option is set in the config file!

    For this reason, if the name of the config file has changed @@ -567,8 +562,7 @@ alias|alias|alias|alias... create similar services easily. Note that the service being copied must occur earlier in the configuration file than the service doing the copying.

    Default: no value

    Example: copy = otherservice

    create mask (S)

    A synonym for this parameter is - create mode - .

    When a file is created, the necessary permissions are + .

    When a file is created, the necessary permissions are calculated according to the mapping from DOS modes to UNIX permissions, and the resulting UNIX mode is then bit-wise 'AND'ed with this parameter. This parameter may be thought of as a bit-wise @@ -576,20 +570,13 @@ alias|alias|alias|alias... set here will be removed from the modes set on a file when it is created.

    The default value of this parameter removes the 'group' and 'other' write and execute bits from the UNIX modes.

    Following this Samba will bit-wise 'OR' the UNIX mode created - from this parameter with the value of the - force create mode + from this parameter with the value of the parameter which is set to 000 by default.

    This parameter does not affect directory modes. See the - parameter directory mode - for details.

    See also the force - create mode parameter for forcing particular mode - bits to be set on created files. See also the - directory mode parameter for masking - mode bits on created directories. See also the - inherit permissions parameter.

    Note that this parameter does not apply to permissions + parameter for details.

    See also the parameter for forcing particular mode + bits to be set on created files. See also the parameter for masking + mode bits on created directories. See also the parameter.

    Note that this parameter does not apply to permissions set by Windows NT/2000 ACL editors. If the administrator wishes to enforce - a mask on access control lists also, they need to set the - security mask.

    Default: create mask = 0744

    Example: create mask = 0775

    create mode (S)

    This is a synonym for - create mask.

    csc policy (S)

    This stands for client-side caching + a mask on access control lists also, they need to set the .

    Default: create mask = 0744

    Example: create mask = 0775

    create mode (S)

    This is a synonym for .

    csc policy (S)

    This stands for client-side caching policy, and specifies how clients capable of offline caching will cache the files in the share. The valid values are: manual, documents, programs, disable.

    These values correspond to those used on Windows servers.

    For example, shares containing roaming profiles can have @@ -604,28 +591,20 @@ alias|alias|alias|alias... should be performed.

    Default: deadtime = 0

    Example: deadtime = 15

    debug hires timestamp (G)

    Sometimes the timestamps in the log messages are needed with a resolution of higher that seconds, this boolean parameter adds microsecond resolution to the timestamp - message header when turned on.

    Note that the parameter - debug timestamp must be on for this to have an - effect.

    Default: debug hires timestamp = no

    debuglevel (G)

    Synonym for - log level.

    debug pid (G)

    When using only one log file for more then one forked + message header when turned on.

    Note that the parameter must be on for this to have an + effect.

    Default: debug hires timestamp = no

    debuglevel (G)

    Synonym for .

    debug pid (G)

    When using only one log file for more then one forked smbd(8)-process there may be hard to follow which process outputs which message. This boolean parameter is adds the process-id to the timestamp message headers in the - logfile when turned on.

    Note that the parameter - debug timestamp must be on for this to have an + logfile when turned on.

    Note that the parameter must be on for this to have an effect.

    Default: debug pid = no

    debug timestamp (G)

    Samba debug log messages are timestamped - by default. If you are running at a high - debug level these timestamps + by default. If you are running at a high these timestamps can be distracting. This boolean parameter allows timestamping to be turned off.

    Default: debug timestamp = yes

    debug uid (G)

    Samba is sometimes run as root and sometime run as the connected user, this boolean parameter inserts the current euid, egid, uid and gid to the timestamp message headers - in the log file if turned on.

    Note that the parameter - debug timestamp must be on for this to have an - effect.

    Default: debug uid = no

    default (G)

    A synonym for - default service.

    default case (S)

    See the section on - NAME MANGLING. Also note the - short preserve case parameter.

    Default: default case = lower

    default devmode (S)

    This parameter is only applicable to printable services. + in the log file if turned on.

    Note that the parameter must be on for this to have an + effect.

    Default: debug uid = no

    default (G)

    A synonym for .

    default case (S)

    See the section on . Also note the parameter.

    Default: default case = lower

    default devmode (S)

    This parameter is only applicable to services. When smbd is serving Printer Drivers to Windows NT/2k/XP clients, each printer on the Samba server has a Device Mode which defines things such as paper size and orientation and duplex settings. The device mode can only correctly be @@ -645,15 +624,13 @@ alias|alias|alias|alias... do this all the time, setting default devmode = yes will instruct smbd to generate a default one.

    For more information on Windows NT/2k printing and Device Modes, - see the MSDN documentation. + see the MSDN documentation.

    Default: default devmode = no

    default service (G)

    This parameter specifies the name of a service which will be connected to if the service actually requested cannot be found. Note that the square brackets are NOT given in the parameter value (see example below).

    There is no default value for this parameter. If this parameter is not given, attempting to connect to a nonexistent - service results in an error.

    Typically the default service would be a - guest ok, - read-only service.

    Also note that the apparent service name will be changed + service results in an error.

    Typically the default service would be a , service.

    Also note that the apparent service name will be changed to equal that of the requested service, this is very useful as it allows you to use macros like %S to make a wildcard service.

    Note also that any "_" characters in the name of the service @@ -682,11 +659,8 @@ alias|alias|alias|alias... been executed, smbd will reparse the smb.conf to associated printer no longer exists. If the sharename is still valid, then smbd - will return an ACCESS_DENIED error to the client.

    See also - addprinter command, - printing, - show add - printer wizard

    Default: none

    Example: deleteprinter command = /usr/bin/removeprinter

    delete readonly (S)

    This parameter allows readonly files to be deleted. + will return an ACCESS_DENIED error to the client.

    See also , , +

    Default: none

    Example: deleteprinter command = /usr/bin/removeprinter

    delete readonly (S)

    This parameter allows readonly files to be deleted. This is not normal DOS semantics, but is allowed by UNIX.

    This option may be useful for running applications such as rcs, where UNIX file ownership prevents changing file permissions, and DOS semantics prevent deletion of a read only file.

    Default: delete readonly = no

    delete share command (G)

    Samba 2.2.0 introduced the ability to dynamically @@ -706,12 +680,9 @@ alias|alias|alias|alias... the existing service.

    This parameter is only used to remove file shares. To delete printer shares, - see the deleteprinter - command. + see the .

    - See also add share - command, change - share command. + See also , .

    Default: none

    Example: delete share command = /usr/local/bin/delshare

    delete user from group script (G)

    Full path to the script that will be called when a user is removed from a group using the Windows NT domain administration tools. It will be run by smbd(8) AS ROOT. @@ -724,7 +695,7 @@ alias|alias|alias|alias... from the server, normally using 'User Manager for Domains' or rpcclient.

    This script should delete the given UNIX username.

    Default: delete user script = <empty string>

    Example: delete user script = /usr/local/samba/bin/del_user %u

    delete veto files (S)

    This option is used when Samba is attempting to delete a directory that contains one or more vetoed directories - (see the veto files + (see the option). If this option is set to no (the default) then if a vetoed directory contains any non-vetoed files or directories then the directory delete will fail. This is usually what you want.

    If this option is set to yes, then Samba @@ -734,9 +705,7 @@ alias|alias|alias|alias... directories you might normally veto DOS/Windows users from seeing (e.g. .AppleDouble)

    Setting delete veto files = yes allows these directories to be transparently deleted when the parent directory - is deleted (so long as the user has permissions to do so).

    See also the veto - files parameter.

    Default: delete veto files = no

    deny hosts (S)

    Synonym for hosts - deny.

    dfree command (G)

    The dfree command setting + is deleted (so long as the user has permissions to do so).

    See also the parameter.

    Default: delete veto files = no

    deny hosts (S)

    Synonym for .

    dfree command (G)

    The dfree command setting should only be used on systems where a problem occurs with the internal disk space calculations. This has been known to happen with Ultrix, but may occur with other operating systems. The @@ -759,7 +728,7 @@ df $1 | tail -1 | awk '{print $2" "$4}'

    or perhaps (on Sys V based systems):

     
 #!/bin/sh
 /usr/bin/df -k $1 | tail -1 | awk '{print $3" "$5}'
-

    Note that you may have to replace the command names with full path names on some systems.

    directory (S)

    Synonym for path.

    directory mask (S)

    This parameter is the octal modes which are +

    Note that you may have to replace the command names with full path names on some systems.

    directory (S)

    Synonym for .

    directory mask (S)

    This parameter is the octal modes which are used when converting DOS modes to UNIX modes when creating UNIX directories.

    When a directory is created, the necessary permissions are calculated according to the mapping from DOS modes to UNIX permissions, @@ -770,19 +739,12 @@ df $1 | tail -1 | awk '{print $2" "$4}' created.

    The default value of this parameter removes the 'group' and 'other' write bits from the UNIX mode, allowing only the user who owns the directory to modify it.

    Following this Samba will bit-wise 'OR' the UNIX mode - created from this parameter with the value of the - force directory mode parameter. + created from this parameter with the value of the parameter. This parameter is set to 000 by default (i.e. no extra mode bits are added).

    Note that this parameter does not apply to permissions set by Windows NT/2000 ACL editors. If the administrator wishes to enforce - a mask on access control lists also, they need to set the - directory security mask.

    See the force - directory mode parameter to cause particular mode - bits to always be set on created directories.

    See also the create mode - parameter for masking mode bits on created files, - and the directory - security mask parameter.

    Also refer to the - inherit permissions parameter.

    Default: directory mask = 0755

    Example: directory mask = 0775

    directory mode (S)

    Synonym for - directory mask

    directory security mask (S)

    This parameter controls what UNIX permission bits + a mask on access control lists also, they need to set the .

    See the parameter to cause particular mode + bits to always be set on created directories.

    See also the parameter for masking mode bits on created files, + and the parameter.

    Also refer to the parameter.

    Default: directory mask = 0755

    Example: directory mask = 0775

    directory mode (S)

    Synonym for

    directory security mask (S)

    This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a directory using the native NT security dialog box.

    This parameter is applied as a mask (AND'ed with) to @@ -795,11 +757,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will probably want to leave - it as the default of 0777.

    See also the - force directory security mode, - security mask, - force security mode - parameters.

    Default: directory security mask = 0777

    Example: directory security mask = 0700

    disable netbios (G)

    Enabling this parameter will disable netbios support + it as the default of 0777.

    See also the , , + parameters.

    Default: directory security mask = 0777

    Example: directory security mask = 0700

    disable netbios (G)

    Enabling this parameter will disable netbios support in Samba. Netbios is the only available form of browsing in all windows versions except for 2000 and XP.

    Note

    Note that clients that only support netbios won't be able to see your samba server when netbios support is disabled. @@ -813,7 +772,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' also disable the capability of Windows NT/2000 clients to download print drivers from the Samba host upon demand. Be very careful about enabling this parameter. -

    See also use client driver +

    See also

    Default : disable spoolss = no

    display charset (G)

    Specifies the charset that samba will use to print messages to stdout and stderr and SWAT will use. Should generally be the same as the unix charset. @@ -824,17 +783,14 @@ df $1 | tail -1 | awk '{print $2" "$4}' characters, so the DNS name (or DNS alias) can likewise only be 15 characters, maximum.

    nmbd spawns a second copy of itself to do the DNS name lookup requests, as doing a name lookup is a blocking - action.

    See also the parameter - wins support.

    Default: dns proxy = yes

    domain logons (G)

    If set to yes, the Samba server will serve - Windows 95/98 Domain logons for the - workgroup it is in. Samba 2.2 + action.

    See also the parameter .

    Default: dns proxy = yes

    domain logons (G)

    If set to yes, the Samba server will serve + Windows 95/98 Domain logons for the it is in. Samba 2.2 has limited capability to act as a domain controller for Windows NT 4 Domains. For more details on setting up this feature see the Samba-PDC-HOWTO included in the Samba documentation.

    Default: domain logons = no

    domain master (G)

    Tell smbd(8) to enable WAN-wide browse list collation. Setting this option causes nmbd to claim a special domain specific NetBIOS name that identifies - it as a domain master browser for its given - workgroup. Local master browsers + it as a domain master browser for its given . Local master browsers in the same workgroup on broadcast-isolated subnets will give this nmbd their local browse lists, and then ask smbd(8) for a complete copy of the browse @@ -848,8 +804,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' means that if this parameter is set and nmbd claims the special name for a workgroup before a Windows NT PDC is able to do so then cross subnet browsing will behave - strangely and may fail.

    If domain logons = yes - , then the default behavior is to enable the domain + strangely and may fail.

    If , then the default behavior is to enable the domain master parameter. If domain logons is not enabled (the default setting), then neither will domain master be enabled by default.

    Default: domain master = auto

    dont descend (S)

    There are certain directories on some systems @@ -908,7 +863,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' Samba see the chapter "User Database" in the Samba HOWTO Collection.

    In order for encrypted passwords to work correctly smbd(8) must either have access to a local smbpasswd(5) file (see the smbpasswd(8) program for information on how to set up - and maintain this file), or set the security = [server|domain|ads] parameter which + and maintain this file), or set the parameter which causes smbd to authenticate against another server.

    Default: encrypt passwords = yes

    enhanced browsing (G)

    This option enables a couple of enhancements to cross-subnet browse propagation that have been added in Samba @@ -934,8 +889,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' can define enumports command to point to a program which should generate a list of ports, one per line, to standard output. This listing will then be used in response - to the level 1 and 2 EnumPorts() RPC.

    Default: no enumports command

    Example: enumports command = /usr/bin/listports

    exec (S)

    This is a synonym for - preexec.

    fake directory create times (S)

    NTFS and Windows VFAT file systems keep a create + to the level 1 and 2 EnumPorts() RPC.

    Default: no enumports command

    Example: enumports command = /usr/bin/listports

    exec (S)

    This is a synonym for .

    fake directory create times (S)

    NTFS and Windows VFAT file systems keep a create time for all files and directories. This is not the same as the ctime - status change time - that Unix keeps, so Samba by default reports the earliest of the various times Unix does keep. Setting @@ -962,8 +916,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' cache file data. With some oplock types the client may even cache file open/close operations. This can give enormous performance benefits.

    When you set fake oplocks = yes, smbd(8) will - always grant oplock requests no matter how many clients are using the file.

    It is generally much better to use the real - oplocks support rather + always grant oplock requests no matter how many clients are using the file.

    It is generally much better to use the real support rather than this parameter.

    If you enable this option on all read-only shares or shares that you know will only be accessed from one client at a time such as physically read-only media like CDROMs, you will see @@ -986,9 +939,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' permissions changed. The default for this parameter is (in octal) 000. The modes in this parameter are bitwise 'OR'ed onto the file mode after the mask set in the create mask - parameter is applied.

    See also the parameter create - mask for details on masking mode bits on files.

    See also the inherit - permissions parameter.

    Default: force create mode = 000

    Example: force create mode = 0755

    would force all created files to have read and execute + parameter is applied.

    See also the parameter for details on masking mode bits on files.

    See also the parameter.

    Default: force create mode = 000

    Example: force create mode = 0755

    would force all created files to have read and execute permissions set for 'group' and 'other' as well as the read/write/execute bits set for the 'user'.

    force directory mode (S)

    This parameter specifies a set of UNIX mode bit permissions that will always be set on a directory @@ -997,10 +948,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' parameter is (in octal) 0000 which will not add any extra permission bits to a created directory. This operation is done after the mode mask in the parameter directory mask is - applied.

    See also the parameter - directory mask for details on masking mode bits - on created directories.

    See also the - inherit permissions parameter.

    Default: force directory mode = 000

    Example: force directory mode = 0755

    would force all created directories to have read and execute + applied.

    See also the parameter for details on masking mode bits + on created directories.

    See also the parameter.

    Default: force directory mode = 000

    Example: force directory mode = 0755

    would force all created directories to have read and execute permissions set for 'group' and 'other' as well as the read/write/execute bits set for the 'user'.

    force directory security mode (S)

    This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX @@ -1014,11 +963,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will probably want to leave - it set as 0000.

    See also the - directory security mask, - security mask, - force security mode - parameters.

    Default: force directory security mode = 0

    Example: force directory security mode = 700

    force group (S)

    This specifies a UNIX group name that will be + it set as 0000.

    See also the , , + parameters.

    Default: force directory security mode = 0

    Example: force directory security mode = 700

    force group (S)

    This specifies a UNIX group name that will be assigned as the default primary group for all users connecting to this service. This is useful for sharing files by ensuring that all access to files on service will use the named group for @@ -1035,10 +981,9 @@ df $1 | tail -1 | awk '{print $2" "$4}' example, the setting force group = +sys means that only users who are already in group sys will have their default primary group assigned to sys when accessing this Samba share. All - other users will retain their ordinary primary group.

    If the force user - parameter is also set the group specified in + other users will retain their ordinary primary group.

    If the parameter is also set the group specified in force group will override the primary group - set in force user.

    See also force user.

    Default: no forced group

    Example: force group = agroup

    force security mode (S)

    This parameter controls what UNIX permission + set in force user.

    See also .

    Default: no forced group

    Example: force group = agroup

    force security mode (S)

    This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a file using the native NT security dialog box.

    This parameter is applied as a mask (OR'ed with) to the @@ -1051,11 +996,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will probably want to leave - this set to 0000.

    See also the - force directory security mode, - directory security - mask, - security mask parameters.

    Default: force security mode = 0

    Example: force security mode = 700

    force user (S)

    This specifies a UNIX user name that will be + this set to 0000.

    See also the , + , parameters.

    Default: force security mode = 0

    Example: force security mode = 700

    force user (S)

    This specifies a UNIX user name that will be assigned as the default user for all users connecting to this service. This is useful for sharing files. You should also use it carefully as using it incorrectly can cause security problems.

    This user name only gets used once a connection is established. @@ -1065,7 +1007,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' as. This can be very useful.

    In Samba 2.0.5 and above this parameter also causes the primary group of the forced user to be used as the primary group for all file activity. Prior to 2.0.5 the primary group was left - as the primary group of the connecting user (this was a bug).

    See also force group

    Default: no forced user

    Example: force user = auser

    fstype (S)

    This parameter allows the administrator to + as the primary group of the connecting user (this was a bug).

    See also

    Default: no forced user

    Example: force user = auser

    fstype (S)

    This parameter allows the administrator to configure the string that specifies the type of filesystem a share is using that is reported by smbd(8) when a client queries the filesystem type for a share. The default type is NTFS for @@ -1076,15 +1018,12 @@ df $1 | tail -1 | awk '{print $2" "$4}' samba can use.

    This parameter should specify the path to a script that queries the quota information for the specified user/group for the partition that - the specified directory is on.

    Such a script should take 3 arguments:

    • directory

    • type of query

    • uid of user or gid of group

    The type of query can be one of :

    • 1 - user quotas

    • 2 - user default quotas (uid = -1)

    • 3 - group quotas

    • 4 - group default quotas (gid = -1)

    This script should print its output according to the following format:

    • Line 1 - quota flags (0 = no quotas, 1 = quotas enabled, 2 = quotas enabled and enforced)

    • Line 2 - number of currently used blocks

    • Line 3 - the softlimit number of blocks

    • Line 4 - the hardlimit number of blocks

    • Line 5 - currently used number of inodes

    • Line 6 - the softlimit number of inodes

    • Line 7 - the hardlimit number of inodes

    • Line 8(optional) - the number of bytes in a block(default is 1024)

    See also the set quota command parameter. + the specified directory is on.

    Such a script should take 3 arguments:

    • directory

    • type of query

    • uid of user or gid of group

    The type of query can be one of :

    • 1 - user quotas

    • 2 - user default quotas (uid = -1)

    • 3 - group quotas

    • 4 - group default quotas (gid = -1)

    This script should print its output according to the following format:

    • Line 1 - quota flags (0 = no quotas, 1 = quotas enabled, 2 = quotas enabled and enforced)

    • Line 2 - number of currently used blocks

    • Line 3 - the softlimit number of blocks

    • Line 4 - the hardlimit number of blocks

    • Line 5 - currently used number of inodes

    • Line 6 - the softlimit number of inodes

    • Line 7 - the hardlimit number of inodes

    • Line 8(optional) - the number of bytes in a block(default is 1024)

    See also the parameter.

    Default: get quota command =

    Example: get quota command = /usr/local/sbin/query_quota

    getwd cache (G)

    This is a tuning option. When this is enabled a caching algorithm will be used to reduce the time taken for getwd() calls. This can have a significant impact on performance, especially - when the wide links - parameter is set to no.

    Default: getwd cache = yes

    group (S)

    Synonym for - force group.

    guest account (G,S)

    This is a username which will be used for access - to services which are specified as - guest ok (see below). Whatever privileges this + when the parameter is set to no.

    Default: getwd cache = yes

    group (S)

    Synonym for .

    guest account (G,S)

    This is a username which will be used for access + to services which are specified as (see below). Whatever privileges this user has will be available to any client connecting to the guest service. Typically this user will exist in the password file, but will not have a valid login. The user account "ftp" is often a good choice @@ -1099,16 +1038,11 @@ df $1 | tail -1 | awk '{print $2" "$4}' many parts of the system require this value to be constant for correct operation.

    Default: specified at compile time, usually "nobody"

    Example: guest account = ftp

    guest ok (S)

    If this parameter is yes for a service, then no password is required to connect to the service. - Privileges will be those of the - guest account.

    This paramater nullifies the benifits of setting - restrict - anonymous = 2

    See the section below on - security for more information about this option. + Privileges will be those of the .

    This paramater nullifies the benifits of setting + = 2

    See the section below on for more information about this option.

    Default: guest ok = no

    guest only (S)

    If this parameter is yes for a service, then only guest connections to the service are permitted. - This parameter will have no effect if - guest ok is not set for the service.

    See the section below on - security for more information about this option. + This parameter will have no effect if is not set for the service.

    See the section below on for more information about this option.

    Default: guest only = no

    hide dot files (S)

    This is a boolean parameter that controls whether files starting with a dot appear as hidden files.

    Default: hide dot files = yes

    hide files (S)

    This is a list of files or directories that are not visible but are accessible. The DOS 'hidden' attribute is applied @@ -1119,13 +1053,10 @@ df $1 | tail -1 | awk '{print $2" "$4}' not include the Unix directory separator '/'.

    Note that the case sensitivity option is applicable in hiding files.

    Setting this parameter will affect the performance of Samba, as it will be forced to check all files and directories for a match - as they are scanned.

    See also hide - dot files, - veto files and - case sensitive.

    Default: no file are hidden

    Example: hide files = + as they are scanned.

    See also , and .

    Default: no file are hidden

    Example: hide files = /.*/DesktopFolderDB/TrashFor%m/resource.frk/

    The above example is based on files that the Macintosh - SMB client (DAVE) available from - Thursby creates for internal use, and also still hides + SMB client (DAVE) available from + Thursby creates for internal use, and also still hides all files beginning with a dot.

    hide local users (G)

    This parameter toggles the hiding of local UNIX users (root, wheel, floppy, etc) from remote clients.

    Default: hide local users = no

    hide special files (S)

    This parameter prevents clients from seeing special files such as sockets, devices and fifo's in directory @@ -1134,8 +1065,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' existance of files that cannot be read. Defaults to off.

    Default: hide unreadable = no

    hide unwriteable files (S)

    This parameter prevents clients from seeing the existance of files that cannot be written to. Defaults to off. Note that unwriteable directories are shown as usual. -

    Default: hide unwriteable = no

    homedir map (G)

    Ifnis homedir - is yes, and smbd(8) is also acting +

    Default: hide unwriteable = no

    homedir map (G)

    If is yes, and smbd(8) is also acting as a Win95/98 logon server then this parameter specifies the NIS (or YP) map from which the server for the user's home directory should be extracted. At present, only the Sun @@ -1143,16 +1073,11 @@ df $1 | tail -1 | awk '{print $2" "$4}' the first ':'. There should probably be a better parsing system that copes with different map formats and also Amd (another automounter) maps.

    Note

    A working NIS client is required on - the system for this option to work.

    See also nis homedir - , domain logons - .

    Default: homedir map = <empty string>

    Example: homedir map = amd.homedir

    host msdfs (G)

    This boolean parameter is only available - if Samba has been configured and compiled with the - --with-msdfs option. If set to yes, - Samba will act as a Dfs server, and allow Dfs-aware clients - to browse Dfs trees hosted on the server.

    See also the - msdfs root share level parameter. For + the system for this option to work.

    See also , .

    Default: homedir map = <empty string>

    Example: homedir map = amd.homedir

    host msdfs (G)

    If set to yes, Samba will act as a Dfs + server, and allow Dfs-aware clients to browse Dfs trees hosted + on the server.

    See also the share level parameter. For more information on setting up a Dfs tree on Samba, - refer to ???. + refer to .

    Default: host msdfs = no

    hostname lookups (G)

    Specifies whether samba should use (expensive) hostname lookups or use the ip addresses instead. An example place where hostname lookups are currently used is when checking @@ -1168,8 +1093,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' page hosts_access(5). Note that this man page may not be present on your system, so a brief description will be given here also.

    Note that the localhost address 127.0.0.1 will always - be allowed access unless specifically denied by a - hosts deny option.

    You can also specify hosts by network/netmask pairs and + be allowed access unless specifically denied by a option.

    You can also specify hosts by network/netmask pairs and by netgroup names if your system supports netgroups. The EXCEPT keyword can also be used to limit a wildcard list. The following examples may provide some help:

    Example 1: allow all IPs in 150.203.*.*; except one

    hosts allow = 150.203. EXCEPT 150.203.6.66

    Example 2: allow hosts that match the given network/netmask

    hosts allow = 150.203.15.0/255.255.255.0

    Example 3: allow a couple of hosts

    hosts allow = lapland, arvidsjaur

    Example 4: allow only hosts in NIS netgroup "foonet", but @@ -1181,8 +1105,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' list takes precedence.

    Default: none (i.e., no hosts specifically excluded)

    Example: hosts deny = 150.203.4. badhost.mynet.edu.au

    hosts equiv (G)

    If this global parameter is a non-null string, it specifies the name of a file to read for the names of hosts and users who will be allowed access without specifying a password. -

    This is not be confused with - hosts allow which is about hosts +

    This is not be confused with which is about hosts access to services and is more useful for guest services. hosts equiv may be useful for NT clients which will not supply passwords to Samba.

    Note

    The use of hosts equiv @@ -1214,27 +1137,14 @@ df $1 | tail -1 | awk '{print $2" "$4}' thus guaranteeing that default directory acls are propagated.

    Default: inherit acls = no

    inherit permissions (S)

    The permissions on new files and directories - are normally governed by - create mask, - directory mask, - force create mode - and force - directory mode but the boolean inherit + are normally governed by , , and but the boolean inherit permissions parameter overrides this.

    New directories inherit the mode of the parent directory, including bits such as setgid.

    New files inherit their read/write bits from the parent directory. Their execute bits continue to be determined by - map archive - , map hidden - and map system - as usual.

    Note that the setuid bit is never set via + , and as usual.

    Note that the setuid bit is never set via inheritance (the code explicitly prohibits this).

    This can be particularly useful on large systems with many users, perhaps several thousand, to allow a single [homes] - share to be used flexibly by each user.

    See also create mask - , - directory mask, - force create mode and - force directory mode - .

    Default: inherit permissions = no

    interfaces (G)

    This option allows you to override the default + share to be used flexibly by each user.

    See also , , and .

    Default: inherit permissions = no

    interfaces (G)

    This option allows you to override the default network interfaces list that Samba will use for browsing, name registration and other NBT traffic. By default Samba will query the kernel for the list of all active interfaces and use any @@ -1249,8 +1159,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' decimal IP address or a hostname which will be looked up via the OS's normal hostname resolution mechanisms.

    For example, the following line:

    interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0

    would configure three network interfaces corresponding to the eth0 device and IP addresses 192.168.2.10 and 192.168.3.10. - The netmasks of the latter two interfaces would be set to 255.255.255.0.

    See also bind - interfaces only.

    Default: all active interfaces except 127.0.0.1 + The netmasks of the latter two interfaces would be set to 255.255.255.0.

    See also .

    Default: all active interfaces except 127.0.0.1 that are broadcast capable

    invalid users (S)

    This is a list of users that should not be allowed to login to this service. This is really a paranoid check to absolutely ensure an improper setting does not breach @@ -1266,21 +1175,18 @@ df $1 | tail -1 | awk '{print $2" "$4}' the value &+group means check the NIS netgroup database, followed by the UNIX group database (the same as the '@' prefix).

    The current servicename is substituted for %S. - This is useful in the [homes] section.

    See also valid users - .

    Default: no invalid users

    Example: invalid users = root fred admin @wheel

    keepalive (G)

    The value of the parameter (an integer) represents + This is useful in the [homes] section.

    See also .

    Default: no invalid users

    Example: invalid users = root fred admin @wheel

    keepalive (G)

    The value of the parameter (an integer) represents the number of seconds between keepalive packets. If this parameter is zero, no keepalive packets will be sent. Keepalive packets, if sent, allow the server to tell whether a client is still present and responding.

    Keepalives should, in general, not be needed if the socket - being used has the SO_KEEPALIVE attribute set on it (see - socket options). + being used has the SO_KEEPALIVE attribute set on it (see ). Basically you should only use this option if you strike difficulties.

    Default: keepalive = 300

    Example: keepalive = 600

    kernel change notify (G)

    This parameter specifies whether Samba should ask the kernel for change notifications in directories so that SMB clients can refresh whenever the data on the server changes.

    This parameter is only usd when your kernel supports change notification to user programs, using the F_NOTIFY fcntl. -

    Default: Yes

    kernel oplocks (G)

    For UNIXes that support kernel based - oplocks +

    Default: Yes

    kernel oplocks (G)

    For UNIXes that support kernel based (currently only IRIX and the Linux 2.4 kernel), this parameter allows the use of them to be turned on or off.

    Kernel oplocks support allows Samba oplocks to be broken whenever a local UNIX process or NFS operation @@ -1288,9 +1194,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' data consistency between SMB/CIFS, NFS and local file access (and is a very cool feature :-).

    This parameter defaults to on, but is translated to a no-op on systems that no not have the necessary kernel support. - You should never need to touch this parameter.

    See also the oplocks - and level2 oplocks - parameters.

    Default: kernel oplocks = yes

    lanman auth (G)

    This parameter determines whether or not smbd(8) will attempt to authenticate users + You should never need to touch this parameter.

    See also the and parameters.

    Default: kernel oplocks = yes

    lanman auth (G)

    This parameter determines whether or not smbd(8) will attempt to authenticate users using the LANMAN password hash. If disabled, only clients which support NT password hashes (e.g. Windows NT/2000 clients, smbclient, etc... but not Windows 95/98 or the MS DOS network client) will be able to connect to the Samba host.

    The LANMAN encrypted response is easily broken, due to it's @@ -1329,7 +1233,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' If this parameter is unset, the value of ldap suffix will be used instead.

    Default: none

    Example: dc=samba,ou=Groups

    ldap idmap suffix (G)

    This parameters specifies the suffix that is used when storing idmap mappings. If this parameter is unset, the value of ldap suffix - will be used instead.

    Default: none

    Example: dc=samba,ou=Idmap

    ldap machine suffix (G)

    It specifies where machines should be added to the ldap tree.

    Default: none

    ldap passwd sync (G)

    This option is used to define whether + will be used instead.

    Default: none

    Example: ou=Idmap,dc=samba,dc=org

    ldap machine suffix (G)

    It specifies where machines should be added to the ldap tree.

    Default: none

    ldap passwd sync (G)

    This option is used to define whether or not Samba should sync the LDAP password with the NT and LM hashes for normal accounts (NOT for workstation, server or domain trusts) on a password @@ -1341,8 +1245,8 @@ df $1 | tail -1 | awk '{print $2" "$4}' the LDAP password and let the LDAP server do the rest.

    Default: ldap passwd sync = no

    ldap port (G)

    This parameter is only available if Samba has been configure to include the --with-ldapsam option at compile time.

    This option is used to control the tcp port number used to contact - the ldap server. - The default is to use the stand LDAPS port 636.

    See Also: ldap ssl

    Default : ldap port = 636 ; if ldap ssl = on

    Default : ldap port = 389 ; if ldap ssl = off

    ldap server (G)

    This parameter is only available if Samba has been + the . + The default is to use the stand LDAPS port 636.

    See Also:

    Default : ldap port = 636 ; if ldap ssl = on

    Default : ldap port = 389 ; if ldap ssl = off

    ldap server (G)

    This parameter is only available if Samba has been configure to include the --with-ldapsam option at compile time.

    This parameter should contain the FQDN of the ldap directory server which should be queried to locate user account information. @@ -1357,7 +1261,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' communicating with the directory server.

  • On = Use SSL on the ldaps port when contacting the ldap server. Only available when the backwards-compatiblity --with-ldapsam option is specified - to configure. See passdb backend

    • Default : ldap ssl = start_tls

    ldap suffix (G)

    Specifies where user and machine accounts are added to the + to configure. See

    Default : ldap ssl = start_tls

    ldap suffix (G)

    Specifies where user and machine accounts are added to the tree. Can be overriden by ldap user suffix and ldap machine suffix. It also used as the base dn for all ldap @@ -1375,14 +1279,10 @@ df $1 | tail -1 | awk '{print $2" "$4}' writes to the file all clients are notified (no reply is needed or waited for) and told to break their oplocks to "none" and delete any read-ahead caches.

    It is recommended that this parameter be turned on to - speed access to shared executables.

    For more discussions on level2 oplocks see the CIFS spec.

    Currently, if kernel - oplocks are supported then level2 oplocks are + speed access to shared executables.

    For more discussions on level2 oplocks see the CIFS spec.

    Currently, if are supported then level2 oplocks are not granted (even if this parameter is set to yes). - Note also, the oplocks - parameter must be set to yes on this share in order for - this parameter to have any effect.

    See also the oplocks - and kernel oplocks - parameters.

    Default: level2 oplocks = yes

    lm announce (G)

    This parameter determines if nmbd(8) will produce Lanman announce + Note also, the parameter must be set to yes on this share in order for + this parameter to have any effect.

    See also the and parameters.

    Default: level2 oplocks = yes

    lm announce (G)

    This parameter determines if nmbd(8) will produce Lanman announce broadcasts that are needed by OS/2 clients in order for them to see the Samba server in their browse list. This parameter can have three values, yes, no, or @@ -1394,15 +1294,14 @@ df $1 | tail -1 | awk '{print $2" "$4}' Samba will not send Lanman announce broadcasts by default but will listen for them. If it hears such a broadcast on the wire it will then start sending them at a frequency set by the parameter - lm interval.

    See also lm interval.

    Default: lm announce = auto

    Example: lm announce = yes

    lm interval (G)

    If Samba is set to produce Lanman announce - broadcasts needed by OS/2 clients (see the - lm announce parameter) then this + lm interval.

    See also .

    Default: lm announce = auto

    Example: lm announce = yes

    lm interval (G)

    If Samba is set to produce Lanman announce + broadcasts needed by OS/2 clients (see the parameter) then this parameter defines the frequency in seconds with which they will be made. If this is set to zero then no Lanman announcements will be made despite the setting of the lm announce - parameter.

    See also lm announce.

    Default: lm interval = 60

    Example: lm interval = 120

    load printers (G)

    A boolean variable that controls whether all + parameter.

    See also .

    Default: lm interval = 60

    Example: lm interval = 120

    load printers (G)

    A boolean variable that controls whether all printers in the printcap will be loaded for browsing by default. - See the printers section for + See the section for more details.

    Default: load printers = yes

    local master (G)

    This option allows nmbd(8) to try and become a local master browser on a subnet. If set to no then nmbd will not attempt to become a local master browser @@ -1411,12 +1310,10 @@ df $1 | tail -1 | awk '{print $2" "$4}' yes doesn't mean that Samba will become the local master browser on a subnet, just that nmbd will participate in elections for local master browser.

    Setting this value to no will cause nmbd never to become a local - master browser.

    Default: local master = yes

    lock dir (G)

    Synonym for - lock directory. + master browser.

    Default: local master = yes

    lock dir (G)

    Synonym for .

    lock directory (G)

    This option specifies the directory where lock files will be placed. The lock files are used to implement the - max connections - option.

    Default: lock directory = ${prefix}/var/locks

    Example: lock directory = /var/run/samba/locks

    locking (S)

    This controls whether or not locking will be + option.

    Default: lock directory = ${prefix}/var/locks

    Example: lock directory = /var/run/samba/locks

    locking (S)

    This controls whether or not locking will be performed by the server in response to lock requests from the client.

    If locking = no, all lock and unlock requests will appear to succeed and all lock queries will report @@ -1436,8 +1333,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' and FoxPro.

    Default: lock spin count = 3

    lock spin time (G)

    The time in microseconds that smbd should pause before attempting to gain a failed lock. See - lock spin - count for more details.

    Default: lock spin time = 10

    log file (G)

    This option allows you to override the name + for more details.

    Default: lock spin time = 10

    log file (G)

    This option allows you to override the name of the Samba log file (also known as the debug file).

    This option takes the standard substitutions, allowing you to have separate log files for each user or machine.

    Example: log file = /usr/local/samba/var/log.%m

    log level (G)

    The value of the parameter (a astring) allows the debug level (logging level) to be specified in the @@ -1446,8 +1342,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' level for multiple debug classes. This is to give greater flexibility in the configuration of the system.

    The default will be the log level specified on the command line or level zero if none was specified.

    Example: log level = 3 passdb:5 auth:10 winbind:2

    logon drive (G)

    This parameter specifies the local path to - which the home directory will be connected (see - logon home) + which the home directory will be connected (see ) and is only used by NT Workstations.

    Note that this option is only useful if Samba is set up as a logon server.

    Default: logon drive = z:

    Example: logon drive = h:

    logon home (G)

    This parameter specifies the home directory location when a Win95/98 or NT Workstation logs into a Samba PDC. @@ -1460,8 +1355,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' substitutions made when a client requests the info, generally in a NetUserGetInfo request. Win9X clients truncate the info to \\server\share when a user does net use /home - but use the whole string when dealing with profiles.

    Note that in prior versions of Samba, the - logon path was returned rather than + but use the whole string when dealing with profiles.

    Note that in prior versions of Samba, the was returned rather than logon home. This broke net use /home but allowed profiles outside the home directory. The current implementation is correct, and can be used for profiles if you use the above trick.

    This option is only useful if Samba is set up as a logon @@ -1469,8 +1363,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' where roaming profiles (NTuser.dat etc files for Windows NT) are stored. Contrary to previous versions of these manual pages, it has nothing to do with Win 9X roaming profiles. To find out how to - handle roaming profiles for Win 9X system, see the - logon home parameter.

    This option takes the standard substitutions, allowing you + handle roaming profiles for Win 9X system, see the parameter.

    This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine. It also specifies the directory from which the "Application Data", (desktop, start menu, @@ -1495,8 +1388,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' a user successfully logs in. The file must contain the DOS style CR/LF line endings. Using a DOS-style editor to create the file is recommended.

    The script must be a relative path to the [netlogon] - service. If the [netlogon] service specifies a - path of /usr/local/samba/netlogon, and logon script = STARTUP.BAT, then + service. If the [netlogon] service specifies a of /usr/local/samba/netlogon, and logon script = STARTUP.BAT, then the file that will be downloaded is:

    /usr/local/samba/netlogon/STARTUP.BAT

    The contents of the batch file are entirely your choice. A suggested command would be to add NET TIME \\SERVER /SET /YES, to force every machine to synchronize clocks with @@ -1521,8 +1413,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' if the job priority is lower than the set fence priority it will have the PAUSED status, whereas if the priority is equal or higher it will have the SPOOLED or PRINTING status.

    Note that it is good practice to include the absolute path - in the lppause command as the PATH may not be available to the server.

    See also the printing - parameter.

    Default: Currently no default value is given to + in the lppause command as the PATH may not be available to the server.

    See also the parameter.

    Default: Currently no default value is given to this string, unless the value of the printing parameter is SYSV, in which case the default is :

    lp -i %p-%j -H hold

    or if the value of the printing parameter is SOFTQ, then the default is:

    qstat -s -j%j -h

    Example for HPUX: lppause command = /usr/bin/lpalt %p-%j -p0

    lpq cache time (G)

    This controls how long lpq info will be cached @@ -1534,7 +1425,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' where xxxx is a hash of the lpq command in use.

    The default is 10 seconds, meaning that the cached results of a previous identical lpq command will be used if the cached data is less than 10 seconds old. A large value may - be advisable if your lpq command is very slow.

    A value of 0 will disable caching completely.

    See also the printing parameter.

    Default: lpq cache time = 10

    Example: lpq cache time = 30

    lpq command (S)

    This parameter specifies the command to be + be advisable if your lpq command is very slow.

    A value of 0 will disable caching completely.

    See also the parameter.

    Default: lpq cache time = 10

    Example: lpq cache time = 30

    lpq command (S)

    This parameter specifies the command to be executed on the server host in order to obtain lpq -style printer status information.

    This command should be a program or script which takes a printer name as its only parameter and outputs printer @@ -1552,19 +1443,16 @@ df $1 | tail -1 | awk '{print $2" "$4}' may not be available to the server. When compiled with the CUPS libraries, no lpq command is needed because smbd will make a library call to obtain the - print queue listing.

    See also the printing - parameter.

    Default: depends on the setting of + print queue listing.

    See also the parameter.

    Default: depends on the setting of printing

    Example: lpq command = /usr/bin/lpq -P%p

    lpresume command (S)

    This parameter specifies the command to be executed on the server host in order to restart or continue printing or spooling a specific print job.

    This command should be a program or script which takes a printer name and job number to resume the print job. See - also the lppause command - parameter.

    If a %p is given then the printer name + also the parameter.

    If a %p is given then the printer name is put in its place. A %j is replaced with the job number (an integer).

    Note that it is good practice to include the absolute path in the lpresume command as the PATH may not - be available to the server.

    See also the printing - parameter.

    Default: Currently no default value is given + be available to the server.

    See also the parameter.

    Default: Currently no default value is given to this string, unless the value of the printing parameter is SYSV, in which case the default is :

    lp -i %p-%j -H resume

    or if the value of the printing parameter is SOFTQ, then the default is:

    qstat -s -j%j -r

    Example for HPUX: lpresume command = /usr/bin/lpalt %p-%j -p2

    lprm command (S)

    This parameter specifies the command to be @@ -1573,19 +1461,17 @@ df $1 | tail -1 | awk '{print $2" "$4}' is put in its place. A %j is replaced with the job number (an integer).

    Note that it is good practice to include the absolute path in the lprm command as the PATH may not be - available to the server.

    See also the printing - parameter.

    Default: depends on the setting of printing + available to the server.

    See also the parameter.

    Default: depends on the setting of printing

    Example 1: lprm command = /usr/bin/lprm -P%p %j

    Example 2: lprm command = /usr/bin/cancel %p-%j

    machine password timeout (G)

    If a Samba server is a member of a Windows - NT Domain (see the security = domain) + NT Domain (see the ) parameter) then periodically a running smbd process will try and change the MACHINE ACCOUNT PASSWORD stored in the TDB called private/secrets.tdb . This parameter specifies how often this password will be changed, in seconds. The default is one week (expressed in - seconds), the same as a Windows NT Domain member server.

    See also smbpasswd(8), and the - security = domain) parameter.

    Default: machine password timeout = 604800

    magic output (S)

    This parameter specifies the name of a file + seconds), the same as a Windows NT Domain member server.

    See also smbpasswd(8), and the ) parameter.

    Default: machine password timeout = 604800

    magic output (S)

    This parameter specifies the name of a file which will contain output created by a magic script (see the - magic script + parameter below).

    Warning: If two clients use the same magic script in the same directory the output file content is undefined.

    Default: magic output = <magic script name>.out

    Example: magic output = myfile.txt

    magic script (S)

    This parameter specifies the name of a file which, @@ -1594,13 +1480,12 @@ df $1 | tail -1 | awk '{print $2" "$4}' executed on behalf of the connected user.

    Scripts executed in this way will be deleted upon completion assuming that the user has the appropriate level of privilege and the file permissions allow the deletion.

    If the script generates output, output will be sent to - the file specified by the - magic output parameter (see above).

    Note that some shells are unable to interpret scripts + the file specified by the parameter (see above).

    Note that some shells are unable to interpret scripts containing CR/LF instead of CR as the end-of-line marker. Magic scripts must be executable as is on the host, which for some hosts and some shells will require filtering at the DOS end.

    Magic scripts are EXPERIMENTAL and - should NOT be relied upon.

    Default: None. Magic scripts disabled.

    Example: magic script = user.csh

    mangle case (S)

    See the section on NAME MANGLING

    Default: mangle case = no

    mangled map (S)

    This is for those who want to directly map UNIX + should NOT be relied upon.

    Default: None. Magic scripts disabled.

    Example: magic script = user.csh

    mangle case (S)

    See the section on

    Default: mangle case = no

    mangled map (S)

    This is for those who want to directly map UNIX file names which cannot be represented on Windows/DOS. The mangling of names is not always what is needed. In particular you may have documents with file extensions that differ between DOS and UNIX. @@ -1611,7 +1496,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' off the ends of filenames on some CDROMs (only visible under some UNIXes). To do this use a map of (*;1 *;).

    Default: no mangled map

    Example: mangled map = (*;1 *;)

    mangled names (S)

    This controls whether non-DOS names under UNIX should be mapped to DOS-compatible names ("mangled") and made visible, - or whether non-DOS names should simply be ignored.

    See the section on NAME MANGLING for + or whether non-DOS names should simply be ignored.

    See the section on for details on how to control the mangling process.

    If mangling is used then the mangling algorithm is as follows:

    • The first (up to) five alphanumeric characters before the rightmost dot of the filename are preserved, forced to upper case, and appear as the first (up to) five characters @@ -1621,8 +1506,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' extension). The final extension is included in the hash calculation only if it contains any upper case characters or is longer than three characters.

      Note that the character to use may be specified using - the mangling char - option, if you don't like '~'.

    • The first three alphanumeric characters of the final + the option, if you don't like '~'.

    • The first three alphanumeric characters of the final extension are preserved, forced to upper case and appear as the extension of the mangled name. The final extension is defined as that part of the original filename after the rightmost dot. If there are no @@ -1652,7 +1536,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' value is 1 and the maximum value is 6.

      mangle prefix is effective only when mangling method is hash2.

      Default: mangle prefix = 1

      Example: mangle prefix = 4

    mangling char (S)

    This controls what character is used as - the magic character in name mangling. The + the magic character in . The default is a '~' but this may interfere with some software. Use this option to set it to whatever you prefer. This is effective only when mangling method is hash.

    Default: mangling char = ~

    Example: mangling char = ^

    mangling method (G)

    controls the algorithm used for the generating the mangled names. Can take two different values, "hash" and @@ -1674,17 +1558,13 @@ df $1 | tail -1 | awk '{print $2" "$4}' any file it touches from becoming executable under UNIX. This can be quite annoying for shared source code, documents, etc...

    Note that this requires the create mask parameter to be set such that owner execute bit is not masked out - (i.e. it must include 100). See the parameter - create mask for details.

    Default: map archive = yes

    map hidden (S)

    This controls whether DOS style hidden files + (i.e. it must include 100). See the parameter for details.

    Default: map archive = yes

    map hidden (S)

    This controls whether DOS style hidden files should be mapped to the UNIX world execute bit.

    Note that this requires the create mask to be set such that the world execute bit is not masked out (i.e. - it must include 001). See the parameter - create mask for details.

    Default: map hidden = no

    map system (S)

    This controls whether DOS style system files + it must include 001). See the parameter for details.

    Default: map hidden = no

    map system (S)

    This controls whether DOS style system files should be mapped to the UNIX group execute bit.

    Note that this requires the create mask to be set such that the group execute bit is not masked out (i.e. - it must include 010). See the parameter - create mask for details.

    Default: map system = no

    map to guest (G)

    This parameter is only useful in - security modes other than security = share + it must include 010). See the parameter for details.

    Default: map system = no

    map to guest (G)

    This parameter is only useful in modes other than security = share - i.e. user, server, and domain.

    This parameter can take three different values, which tell smbd(8) what to do with user @@ -1693,10 +1573,9 @@ df $1 | tail -1 | awk '{print $2" "$4}' default.

  • Bad User - Means user logins with an invalid password are rejected, unless the username does not exist, in which case it is treated as a guest login and - mapped into the - guest account.

  • Bad Password - Means user logins + mapped into the .

  • Bad Password - Means user logins with an invalid password are treated as a guest login and mapped - into the guest account. Note that + into the . Note that this can cause problems as it means that any user incorrectly typing their password will be silently logged on as "guest" - and will not know the reason they cannot access files they think @@ -1715,8 +1594,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' If max connections is greater than 0 then connections will be refused if this number of connections to the service are already open. A value of zero mean an unlimited number of connections may be made.

    Record lock files are used to implement this feature. The lock files will be stored in - the directory specified by the - lock directory option.

    Default: max connections = 0

    Example: max connections = 10

    • max disk size (G)

    This option allows you to put an upper limit + the directory specified by the option.

    Default: max connections = 0

    Example: max connections = 10

    max disk size (G)

    This option allows you to put an upper limit on the apparent size of disks. If you set this option to 100 then all shares will appear to be not larger than 100 MB in size.

    Note that this option does not limit the amount of @@ -1740,8 +1618,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' this parameter so you should never need to touch this parameter.

    Default: max open files = 10000

    max print jobs (S)

    This parameter limits the maximum number of jobs allowable in a Samba printer queue at any given moment. If this number is exceeded, smbd(8) will remote "Out of Space" to the client. - See all total - print jobs. + See all .

    Default: max print jobs = 1000

    Example: max print jobs = 5000

    max protocol (G)

    The value of the parameter (a string) is the highest protocol level that will be supported by the server.

    Possible values are :

    • CORE: Earliest version. No concept of user names.

    • COREPLUS: Slight improvements on @@ -1750,16 +1627,13 @@ df $1 | tail -1 | awk '{print $2" "$4}' support.

    • LANMAN2: Updates to Lanman1 protocol.

    • NT1: Current up to date version of the protocol. Used by Windows NT. Known as CIFS.

    Normally this option should not be set as the automatic negotiation phase in the SMB protocol takes care of choosing - the appropriate protocol.

    See also min - protocol

    Default: max protocol = NT1

    Example: max protocol = LANMAN1

    max reported print jobs (S)

    This parameter limits the maximum number of + the appropriate protocol.

    See also

    Default: max protocol = NT1

    Example: max protocol = LANMAN1

    max reported print jobs (S)

    This parameter limits the maximum number of jobs displayed in a port monitor for Samba printer queue at any given moment. If this number is exceeded, the excess jobs will not be shown. A value of zero means there is no limit on the number of print jobs reported. - See all total - print jobs and max print - jobs parameters. + See all and parameters.

    Default: max reported print jobs = 0

    Example: max reported print jobs = 1000

    max smbd processes (G)

    This parameter limits the maximum number of smbd(8) processes concurrently running on a system and is intended as a stopgap to prevent degrading service to clients in the event that the server has insufficient resources to handle more than this number of connections. Remember that under normal operating @@ -1767,12 +1641,10 @@ df $1 | tail -1 | awk '{print $2" "$4}' shares from a given host.

    Default: max smbd processes = 0 ## no limit

    Example: max smbd processes = 1000

    max ttl (G)

    This option tells nmbd(8) what the default 'time to live' of NetBIOS names should be (in seconds) when nmbd is requesting a name using either a broadcast packet or from a WINS server. You should - never need to change this parameter. The default is 3 days.

    Default: max ttl = 259200

    max wins ttl (G)

    This option tells smbd(8) when acting as a WINS server ( - wins support = yes) what the maximum + never need to change this parameter. The default is 3 days.

    Default: max ttl = 259200

    max wins ttl (G)

    This option tells smbd(8) when acting as a WINS server () what the maximum 'time to live' of NetBIOS names that nmbd will grant will be (in seconds). You should never need to change this - parameter. The default is 6 days (518400 seconds).

    See also the min - wins ttl parameter.

    Default: max wins ttl = 518400

    max xmit (G)

    This option controls the maximum packet size + parameter. The default is 6 days (518400 seconds).

    See also the parameter.

    Default: max wins ttl = 518400

    max xmit (G)

    This option controls the maximum packet size that will be negotiated by Samba. The default is 65535, which is the maximum. In some cases you may find you get better performance with a smaller value. A value below 2048 is likely to cause problems. @@ -1799,29 +1671,22 @@ df $1 | tail -1 | awk '{print $2" "$4}' won't be delivered and Samba will tell the sender there was an error. Unfortunately WfWg totally ignores the error code and carries on regardless, saying that the message was delivered. -

    If you want to silently delete it then try:

    message command = rm %s

    Default: no message command

    Example: message command = csh -c 'xedit %s; rm %s' &

    min passwd length (G)

    Synonym for - min password length. +

    If you want to silently delete it then try:

    message command = rm %s

    Default: no message command

    Example: message command = csh -c 'xedit %s; rm %s' &

    min passwd length (G)

    Synonym for .

    min password length (G)

    This option sets the minimum length in characters of a plaintext password that smbd will - accept when performing UNIX password changing.

    See also unix - password sync, - passwd program and - passwd chat debug.

    Default: min password length = 5

    min print space (S)

    This sets the minimum amount of free disk + accept when performing UNIX password changing.

    See also , and .

    Default: min password length = 5

    min print space (S)

    This sets the minimum amount of free disk space that must be available before a user will be able to spool a print job. It is specified in kilobytes. The default is 0, which - means a user can always spool a print job.

    See also the printing - parameter.

    Default: min print space = 0

    Example: min print space = 2000

    min protocol (G)

    The value of the parameter (a string) is the + means a user can always spool a print job.

    See also the parameter.

    Default: min print space = 0

    Example: min print space = 2000

    min protocol (G)

    The value of the parameter (a string) is the lowest SMB protocol dialect than Samba will support. Please refer - to the max protocol + to the parameter for a list of valid protocol names and a brief description of each. You may also wish to refer to the C source code in source/smbd/negprot.c for a listing of known protocol dialects supported by clients.

    If you are viewing this parameter as a security measure, you should - also refer to the lanman - auth parameter. Otherwise, you should never need + also refer to the parameter. Otherwise, you should never need to change this parameter.

    Default : min protocol = CORE

    Example : min protocol = NT1 # disable DOS clients

    min wins ttl (G)

    This option tells nmbd(8) - when acting as a WINS server ( - wins support = yes) what the minimum 'time to live' + when acting as a WINS server () what the minimum 'time to live' of NetBIOS names that nmbd will grant will be (in seconds). You should never need to change this parameter. The default is 6 hours (21600 seconds).

    Default: min wins ttl = 21600

    msdfs proxy (S)

    This parameter indicates that the share is a @@ -1829,17 +1694,15 @@ df $1 | tail -1 | awk '{print $2" "$4}' the value of the parameter. When clients attempt to connect to this share, they are redirected to the proxied share using the SMB-Dfs protocol.

    Only Dfs roots can act as proxy shares. Take a look at the - msdfs root - and host msdfs - options to find out how to set up a Dfs root share.

    Example: msdfs proxy = \\\\otherserver\\someshare

    msdfs root (S)

    This boolean parameter is only available if - Samba is configured and compiled with the - --with-msdfs option. If set to yes, - Samba treats the share as a Dfs root and allows clients to browse - the distributed file system tree rooted at the share directory. - Dfs links are specified in the share directory by symbolic + + and + options to find out how to set up a Dfs root share.

    Example: msdfs proxy = \\\\otherserver\\someshare

    msdfs root (S)

    If set to yes, Samba treats the + share as a Dfs root and allows clients to browse the + distributed file system tree rooted at the share directory. + Dfs links are specified in the share directory by symbolic links of the form msdfs:serverA\\shareA,serverB\\shareB - and so on. For more information on setting up a Dfs tree - on Samba, refer to ???.

    See also host msdfs

    Default: msdfs root = no

    name cache timeout (G)

    Specifies the number of seconds it takes before + and so on. For more information on setting up a Dfs tree on + Samba, refer to .

    See also

    Default: msdfs root = no

    name cache timeout (G)

    Specifies the number of seconds it takes before entries in samba's hostname resolve cache time out. If the timeout is set to 0. the caching is disabled.

    Default: name cache timeout = 660

    Example: name cache timeout = 0

    name resolve order (G)

    This option is used by the programs in the Samba @@ -1850,7 +1713,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' "wins" and "bcast". They cause names to be resolved as follows:

    • lmhosts : Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has - no name type attached to the NetBIOS name (see the lmhosts(5) for details) then + no name type attached to the NetBIOS name (see the lmhosts(5) for details) then any name type matches for lookup.

    • host : Do a standard host name to IP address resolution, using the system /etc/hosts , NIS, or DNS lookups. This method of name resolution @@ -1860,10 +1723,9 @@ df $1 | tail -1 | awk '{print $2" "$4}' type being queried is the 0x20 (server) name type or 0x1c (domain controllers). The latter case is only useful for active directory domains and results in a DNS query for the SRV RR entry matching _ldap._tcp.domain.

    • wins : Query a name with - the IP address listed in the - wins server parameter. If no WINS server has + the IP address listed in the parameter. If no WINS server has been specified this method will be ignored.

    • bcast : Do a broadcast on - each of the known local interfaces listed in the interfaces + each of the known local interfaces listed in the parameter. This is the least reliable of the name resolution methods as it depends on the target host being on a locally connected subnet.

    Default: name resolve order = lmhosts host wins bcast

    Example: name resolve order = lmhosts bcast host

    This will cause the local lmhosts file to be examined @@ -1875,14 +1737,12 @@ df $1 | tail -1 | awk '{print $2" "$4}' to appear in browse lists under multiple names. If a machine is acting as a browse server or logon server none of these names will be advertised as either browse server or logon servers, only the primary name of the machine will be advertised with these capabilities. -

    See also netbios - name.

    Default: empty string (no additional names)

    Example: netbios aliases = TEST TEST1 TEST2

    netbios name (G)

    This sets the NetBIOS name by which a Samba +

    See also .

    Default: empty string (no additional names)

    Example: netbios aliases = TEST TEST1 TEST2

    netbios name (G)

    This sets the NetBIOS name by which a Samba server is known. By default it is the same as the first component of the host's DNS name. If a machine is a browse server or logon server this name (or the first component of the hosts DNS name) will be the name that these services are - advertised under.

    See also netbios - aliases.

    Default: machine DNS name

    Example: netbios name = MYNAME

    netbios scope (G)

    This sets the NetBIOS scope that Samba will + advertised under.

    See also .

    Default: machine DNS name

    Example: netbios name = MYNAME

    netbios scope (G)

    This sets the NetBIOS scope that Samba will operate under. This should not be set unless every machine on your LAN also sets this value.

    nis homedir (G)

    Get the home share server from a NIS map. For UNIX systems that use an automounter, the user's home directory @@ -1897,8 +1757,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' long as a Samba daemon is running on the home directory server, it will be mounted on the Samba client directly from the directory server. When Samba is returning the home share to the client, it - will consult the NIS map specified in - homedir map and return the server + will consult the NIS map specified in and return the server listed there.

    Note that for this option to work there must be a working NIS system and the Samba server with this option must also be a logon server.

    Default: nis homedir = no

    nt acl support (S)

    This boolean parameter controls whether smbd(8) will attempt to map @@ -1923,25 +1782,22 @@ df $1 | tail -1 | awk '{print $2" "$4}' should obey PAM's account and session management directives. The default behavior is to use PAM for clear text authentication only and to ignore any account or session management. Note that Samba - always ignores PAM for authentication in the case of - encrypt passwords = yes. The reason + always ignores PAM for authentication in the case of . The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. -

    Default: obey pam restrictions = no

    only guest (S)

    A synonym for - guest only.

    only user (S)

    This is a boolean option that controls whether +

    Default: obey pam restrictions = no

    only guest (S)

    A synonym for .

    only user (S)

    This is a boolean option that controls whether connections with usernames not in the user list will be allowed. By default this option is disabled so that a client can supply a username to be used by the server. Enabling this parameter will force the server to only use the login names from the user list and is only really - useful in share level + useful in security.

    Note that this also means Samba won't try to deduce usernames from the service name. This can be annoying for the [homes] section. To get around this you could use user = %S which means your user list will be just the service name, which for home directories is the - name of the user.

    See also the user - parameter.

    Default: only user = no

    oplock break wait time (G)

    This is a tuning parameter added due to bugs in + name of the user.

    See also the parameter.

    Default: only user = no

    oplock break wait time (G)

    This is a tuning parameter added due to bugs in both Windows 9x and WinNT. If Samba responds to a client too quickly when that client issues an SMB that can cause an oplock break request, then the network client can fail and not respond @@ -1964,20 +1820,17 @@ df $1 | tail -1 | awk '{print $2" "$4}' default in Windows NT Servers). For more information see the file Speed.txt in the Samba docs/ directory.

    Oplocks may be selectively turned off on certain files with a - share. See the - veto oplock files parameter. On some systems + share. See the parameter. On some systems oplocks are recognized by the underlying operating system. This allows data synchronization between all access to oplocked files, whether it be via Samba or NFS or a local UNIX process. See the - kernel oplocks parameter for details.

    See also the kernel - oplocks and - level2 oplocks parameters.

    Default: oplocks = yes

    os2 driver map (G)

    The parameter is used to define the absolute + kernel oplocks parameter for details.

    See also the and parameters.

    Default: oplocks = yes

    os2 driver map (G)

    The parameter is used to define the absolute path to a file containing a mapping of Windows NT printer driver names to OS/2 printer driver names. The format is:

    <nt driver name> = <os2 driver name>.<device name>

    For example, a valid entry using the HP LaserJet 5 printer driver would appear as HP LaserJet 5L = LASERJET.HP LaserJet 5L.

    The need for the file is due to the printer driver namespace - problem described in ???. For more details on OS/2 clients, please - refer to ???.

    Default: os2 driver map = <empty string>

    os level (G)

    This integer value controls what level Samba + problem described in . For more details on OS/2 clients, please + refer to .

    Default: os2 driver map = <empty string>

    os level (G)

    This integer value controls what level Samba advertises itself as for browse elections. The value of this parameter determines whether nmbd(8) has a chance of becoming a local master browser for the @@ -1991,9 +1844,9 @@ df $1 | tail -1 | awk '{print $2" "$4}' this parameter, it is possible to use PAM's password change control flag for Samba. If enabled, then PAM will be used for password changes when requested by an SMB client instead of the program listed in - passwd program. + . It should be possible to enable this without changing your - passwd chat + parameter for most setups.

    Default: pam password change = no

    panic action (G)

    This is a Samba developer option that allows a system command to be called when either smbd(8) or smbd(8) crashes. This is usually used to draw attention to the fact that a problem occurred.

    Default: panic action = <empty string>

    Example: panic action = "/bin/sleep 90000"

    paranoid server security (G)

    Some version of NT 4.x allow non-guest @@ -2014,11 +1867,10 @@ df $1 | tail -1 | awk '{print $2" "$4}' backend. Takes a path to the smbpasswd file as an optional argument.

  • tdbsam - The TDB based password storage backend. Takes a path to the TDB as an optional argument (defaults to passdb.tdb - in the - private dir directory.

  • ldapsam - The LDAP based passdb + in the directory.

  • ldapsam - The LDAP based passdb backend. Takes an LDAP URL as an optional argument (defaults to ldap://localhost)

    LDAP connections should be secured where possible. This may be done using either - Start-TLS (see ldap ssl) or by + Start-TLS (see ) or by specifying ldaps:// in the URL argument.

  • nisplussam - The NIS+ based passdb backend. Takes name NIS domain as @@ -2032,17 +1884,15 @@ df $1 | tail -1 | awk '{print $2" "$4}' conversation that takes places between smbd(8) and the local password changing program to change the user's password. The string describes a sequence of response-receive pairs that smbd(8) uses to determine what to send to the - passwd program - and what to expect back. If the expected output is not + and what to expect back. If the expected output is not received then the password is not changed.

    This chat sequence is often quite site specific, depending on what local methods are used for password control (such as NIS - etc).

    Note that this parameter only is only used if the unix password sync - parameter is set to yes. This sequence is + etc).

    Note that this parameter only is only used if the parameter is set to yes. This sequence is then called AS ROOT when the SMB password in the smbpasswd file is being changed, without access to the old password cleartext. This means that root must be able to reset the user's password without knowing the text of the previous password. In the presence of - NIS/YP, this means that the passwd program must + NIS/YP, this means that the must be executed on the NIS master.

    The string can contain the macro %n which is substituted for the new password. The chat sequence can also contain the standard @@ -2051,32 +1901,24 @@ df $1 | tail -1 | awk '{print $2" "$4}' a '*' which matches any sequence of characters. Double quotes can be used to collect strings with spaces in them into a single string.

    If the send string in any part of the chat sequence is a full stop ".", then no string is sent. Similarly, if the - expect string is a full stop then no string is expected.

    If the pam - password change parameter is set to yes, the chat pairs + expect string is a full stop then no string is expected.

    If the parameter is set to yes, the chat pairs may be matched in any order, and success is determined by the PAM result, not any particular output. The \n macro is ignored for PAM conversions. -

    See also unix password - sync, - passwd program , - passwd chat debug and - pam password change.

    Default: passwd chat = *new*password* %n\\n +

    See also , , and .

    Default: passwd chat = *new*password* %n\\n *new*password* %n\\n *changed*

    Example: passwd chat = "*Enter OLD password*" %o\\n "*Enter NEW password*" %n\\n "*Reenter NEW password*" %n\\n "*Password changed*"

    • passwd chat debug (G)

    This boolean specifies if the passwd chat script parameter is run in debug mode. In this mode the strings passed to and received from the passwd chat are printed in the smbd(8) log with a - debug level + of 100. This is a dangerous option as it will allow plaintext passwords to be seen in the smbd log. It is available to help Samba admins debug their passwd chat scripts when calling the passwd program and should be turned off after this has been done. This option has no effect if the - pam password change - paramter is set. This parameter is off by default.

    See also passwd chat - , pam password change - , passwd program - .

    Default: passwd chat debug = no

    passwd program (G)

    The name of a program that can be used to set + + paramter is set. This parameter is off by default.

    See also , , .

    Default: passwd chat debug = no

    passwd program (G)

    The name of a program that can be used to set UNIX user passwords. Any occurrences of %u will be replaced with the user name. The user name is checked for existence before calling the password changing program.

    Also note that many passwd programs insist in reasonable @@ -2093,8 +1935,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' is set this parameter MUST USE ABSOLUTE PATHS for ALL programs called, and must be examined for security implications. Note that by default unix - password sync is set to no.

    See also unix - password sync.

    Default: passwd program = /bin/passwd

    Example: passwd program = /sbin/npasswd %u

    password level (G)

    Some client/server combinations have difficulty + password sync is set to no.

    See also .

    Default: passwd program = /bin/passwd

    Example: passwd program = /sbin/npasswd %u

    password level (G)

    Some client/server combinations have difficulty with mixed-case passwords. One offending client is Windows for Workgroups, which for some reason forces passwords to upper case when using the LANMAN1 protocol, but leaves them alone when @@ -2122,8 +1963,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' Samba will use the standard LDAP port of tcp/389. Note that port numbers have no effect on password servers for Windows NT 4.0 domains or netbios connections.

    If parameter is a name, it is looked up using the - parameter name - resolve order and so may resolved + parameter and so may resolved by any method and order described in that parameter.

    The password server must be a machine capable of using the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in user level security mode.

    Note

    Using a password server means your UNIX box (running @@ -2165,8 +2005,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' password server then you will have to ensure that your users are able to login from the Samba server, as when in security = server mode the network logon will appear to - come from there rather than from the users workstation.

    See also the security - parameter.

    Default: password server = <empty string>

    Example: password server = NT-PDC, NT-BDC1, NT-BDC2, *

    Example: password server = windc.mydomain.com:389 192.168.1.101 *

    Example: password server = *

    path (S)

    This parameter specifies a directory to which + come from there rather than from the users workstation.

    See also the parameter.

    Default: password server = <empty string>

    Example: password server = NT-PDC, NT-BDC1, NT-BDC2, *

    Example: password server = windc.mydomain.com:389 192.168.1.101 *

    Example: password server = *

    path (S)

    This parameter specifies a directory to which the user of the service is to be given access. In the case of printable services, this is where print data will spool prior to being submitted to the host for printing.

    For a printable service offering guest access, the service @@ -2178,8 +2017,7 @@ df $1 | tail -1 | awk '{print $2" "$4}' on this connection. Any occurrences of %m will be replaced by the NetBIOS name of the machine they are connecting from. These replacements are very useful for setting - up pseudo home directories for users.

    Note that this path will be based on - root dir if one was specified.

    Default: none

    Example: path = /home/fred

    pid directory (G)

    This option specifies the directory where pid + up pseudo home directories for users.

    Note that this path will be based on if one was specified.

    Default: none

    Example: path = /home/fred

    pid directory (G)

    This option specifies the directory where pid files will be placed.

    Default: pid directory = ${prefix}/var/locks

    Example: pid directory = /var/run/

    posix locking (S)

    The smbd(8) daemon maintains an database of file locks obtained by SMB clients. The default behavior is to map this internal database to POSIX @@ -2190,48 +2028,40 @@ df $1 | tail -1 | awk '{print $2" "$4}' whenever the service is disconnected. It takes the usual substitutions. The command may be run as the root on some systems.

    An interesting example may be to unmount server - resources:

    postexec = /etc/umount /cdrom

    See also preexec.

    Default: none (no command executed)

    Example: postexec = echo \"%u disconnected from %S from %m (%I)\" >> /tmp/log

    preexec (S)

    This option specifies a command to be run whenever + resources:

    postexec = /etc/umount /cdrom

    See also .

    Default: none (no command executed)

    Example: postexec = echo \"%u disconnected from %S from %m (%I)\" >> /tmp/log

    preexec (S)

    This option specifies a command to be run whenever the service is connected to. It takes the usual substitutions.

    An interesting example is to send the users a welcome message every time they log in. Maybe a message of the day? Here - is an example:

    preexec = csh -c 'echo \"Welcome to %S!\" | /usr/local/samba/bin/smbclient -M %m -I %I' &

    Of course, this could get annoying after a while :-)

    See also preexec close and postexec - .

    Default: none (no command executed)

    Example: preexec = echo \"%u connected to %S from %m (%I)\" >> /tmp/log

    preexec close (S)

    This boolean option controls whether a non-zero - return code from preexec - should close the service being connected to.

    Default: preexec close = no

    prefered master (G)

    Synonym for - preferred master for people who cannot spell :-).

    preferred master (G)

    This boolean parameter controls if + is an example:

    preexec = csh -c 'echo \"Welcome to %S!\" | /usr/local/samba/bin/smbclient -M %m -I %I' &

    Of course, this could get annoying after a while :-)

    See also and .

    Default: none (no command executed)

    Example: preexec = echo \"%u connected to %S from %m (%I)\" >> /tmp/log

    preexec close (S)

    This boolean option controls whether a non-zero + return code from should close the service being connected to.

    Default: preexec close = no

    prefered master (G)

    Synonym for for people who cannot spell :-).

    preferred master (G)

    This boolean parameter controls if nmbd(8) is a preferred master browser for its workgroup.

    If this is set to yes, on startup, nmbd will force an election, and it will have a slight advantage in winning the election. It is recommended that this parameter is - used in conjunction with - domain master = yes, so + used in conjunction with = yes, so that nmbd can guarantee becoming a domain master.

    Use this option with caution, because if there are several hosts (whether Samba servers, Windows 95 or NT) that are preferred master browsers on the same subnet, they will each periodically and continuously attempt to become the local master browser. This will result in unnecessary broadcast - traffic and reduced browsing capabilities.

    See also os level.

    Default: preferred master = auto

    preload (G)

    This is a list of services that you want to be + traffic and reduced browsing capabilities.

    See also .

    Default: preferred master = auto

    preload (G)

    This is a list of services that you want to be automatically added to the browse lists. This is most useful for homes and printers services that would otherwise not be visible.

    Note that if you just want all printers in your - printcap file loaded then the - load printers option is easier.

    Default: no preloaded services

    Example: preload = fred lp colorlp

    preload modules (G)

    This is a list of paths to modules that should + printcap file loaded then the option is easier.

    Default: no preloaded services

    Example: preload = fred lp colorlp

    preload modules (G)

    This is a list of paths to modules that should be loaded into smbd before a client connects. This improves the speed of smbd when reacting to new connections somewhat.

    Default: preload modules =

    Example: preload modules = /usr/lib/samba/passdb/mysql.so+++

    preserve case (S)

    This controls if new filenames are created with the case that the client passes, or if they are forced to - be the default case - .

    Default: preserve case = yes

    See the section on NAME MANGLING for a fuller discussion.

    printable (S)

    If this parameter is yes, then + be the .

    Default: preserve case = yes

    See the section on for a fuller discussion.

    printable (S)

    If this parameter is yes, then clients may open, write to and submit spool files on the directory specified for the service.

    Note that a printable service will ALWAYS allow writing to the service path (user privileges permitting) via the spooling - of print data. The read only - parameter controls only non-printing access to - the resource.

    Default: printable = no

    printcap (G)

    Synonym for - printcap name.

    printcap name (S)

    This parameter may be used to override the + of print data. The parameter controls only non-printing access to + the resource.

    Default: printable = no

    printcap (G)

    Synonym for .

    printcap name (S)

    This parameter may be used to override the compiled-in default printcap name used by the server (usually - /etc/printcap). See the discussion of the [printers] section above for reasons + /etc/printcap). See the discussion of the section above for reasons why you might want to do this.

    To use the CUPS printing interface set printcap name = cups . This should be supplemented by an addtional setting - printing = cups in the [global] + in the [global] section. printcap name = cups will use the "dummy" printcap created by CUPS, as specified in your CUPS configuration file. @@ -2276,26 +2106,23 @@ print5|My Printer 5 printable service nor a global print command, spool files will be created but not processed and (most importantly) not removed.

    Note that printing may fail on some UNIXes from the nobody account. If this happens then create - an alternative guest account that can print and set the - guest account + an alternative guest account that can print and set the in the [global] section.

    You can form quite complex print commands by realizing that they are just passed to a shell. For example the following will log a print job, print the file, then remove it. Note that ';' is the usual separator for command in shell scripts.

    print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s

    You may have to vary this command considerably depending on how you normally print files on your system. The default for - the parameter varies depending on the setting of the - printing parameter.

    Default: For printing = BSD, AIX, QNX, LPRNG + the parameter varies depending on the setting of the parameter.

    Default: For printing = BSD, AIX, QNX, LPRNG or PLP :

    print command = lpr -r -P%p %s

    For printing = SYSV or HPUX :

    print command = lp -c -d%p %s; rm %s

    For printing = SOFTQ :

    print command = lp -d%p -s %s; rm %s

    For printing = CUPS : If SAMBA is compiled against - libcups, then printcap = cups + libcups, then uses the CUPS API to submit jobs, etc. Otherwise it maps to the System V commands with the -oraw option for printing, i.e. it uses lp -c -d%p -oraw; rm %s. With printing = cups, and if SAMBA is compiled against libcups, any manually - set print command will be ignored.

    Example: print command = /usr/local/samba/bin/myprintscript %p %s

    printer (S)

    Synonym for - printer name.

    printer admin (S)

    This is a list of users that can do anything to + set print command will be ignored.

    Example: print command = /usr/local/samba/bin/myprintscript %p %s

    printer (S)

    Synonym for .

    printer admin (S)

    This is a list of users that can do anything to printers via the remote administration interfaces offered by MS-RPC (usually using a NT workstation). Note that the root user always has admin rights.

    Default: printer admin = <empty string>

    Example: printer admin = admin, @staff

    printer name (S)

    This parameter specifies the name of the printer @@ -2311,9 +2138,7 @@ print5|My Printer 5 SYSV, HPUX, QNX, SOFTQ, and CUPS.

    To see what the defaults are for the other print - commands when using the various options use the testparm(1) program.

    This option can be set on a per printer basis

    See also the discussion in the - [printers] section.

    print ok (S)

    Synonym for - printable.

    private dir (G)

    This parameters defines the directory + commands when using the various options use the testparm(1) program.

    This option can be set on a per printer basis

    See also the discussion in the section.

    print ok (S)

    Synonym for .

    private dir (G)

    This parameters defines the directory smbd will use for storing such files as smbpasswd and secrets.tdb.

    Default :private dir = ${prefix}/private

    profile acls (S)

    This boolean parameter controls whether smbd(8) @@ -2339,9 +2164,7 @@ print5|My Printer 5 the top level profile directory (named after the user) is created by the workstation profile code and has an ACL restricting entry to the directory tree to the owning user. -

    Default: profile acls = no

    protocol (G)

    Synonym for - max protocol.

    public (S)

    Synonym for guest - ok.

    queuepause command (S)

    This parameter specifies the command to be +

    Default: profile acls = no

    protocol (G)

    Synonym for .

    public (S)

    Synonym for .

    queuepause command (S)

    This parameter specifies the command to be executed on the server host in order to pause the printer queue.

    This command should be a program or script which takes a printer name as its only parameter and stops the printer queue, such that no longer jobs are submitted to the printer.

    This command is not supported by Windows for Workgroups, @@ -2353,8 +2176,7 @@ print5|My Printer 5 server.

    Default: depends on the setting of printing

    Example: queuepause command = disable %p

    queueresume command (S)

    This parameter specifies the command to be executed on the server host in order to resume the printer queue. It is the command to undo the behavior that is caused by the - previous parameter ( - queuepause command).

    This command should be a program or script which takes + previous parameter ().

    This command should be a program or script which takes a printer name as its only parameter and resumes the printer queue, such that queued jobs are resubmitted to the printer.

    This command is not supported by Windows for Workgroups, but can be issued from the Printers window under Windows 95 @@ -2362,22 +2184,15 @@ print5|My Printer 5 is put in its place. Otherwise it is placed at the end of the command.

    Note that it is good practice to include the absolute path in the command as the PATH may not be available to the - server.

    Default: depends on the setting of - printing

    Example: queuepause command = enable %p

    read bmpx (G)

    This boolean parameter controls whether + server.

    Default: depends on the setting of

    Example: queuepause command = enable %p

    read bmpx (G)

    This boolean parameter controls whether smbd(8) will support the "Read Block Multiplex" SMB. This is now rarely used and defaults to no. You should never need to set this parameter.

    Default: read bmpx = no

    read list (S)

    This is a list of users that are given read-only access to a service. If the connecting user is in this list then - they will not be given write access, no matter what the - read only + they will not be given write access, no matter what the option is set to. The list can include group names using the - syntax described in the - invalid users parameter.

    See also the - write list parameter and the - invalid users - parameter.

    Default: read list = <empty string>

    Example: read list = mary, @students

    read only (S)

    An inverted synonym is - writeable.

    If this parameter is yes, then users + syntax described in the parameter.

    See also the parameter and the parameter.

    Default: read list = <empty string>

    Example: read list = mary, @students

    read only (S)

    An inverted synonym is .

    If this parameter is yes, then users of a service may not create or modify files in the service's directory.

    Note that a printable service (printable = yes) will ALWAYS allow writing to the directory @@ -2388,8 +2203,7 @@ print5|My Printer 5

    However, some clients either negotiate the allowable block size incorrectly or are incapable of supporting larger block sizes, and for these clients you may need to disable raw reads.

    In general this parameter should be viewed as a system tuning - tool and left severely alone. See also - write raw.

    Default: read raw = yes

    read size (G)

    The option read size + tool and left severely alone. See also .

    Default: read raw = yes

    read size (G)

    The option read size affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger @@ -2413,10 +2227,10 @@ print5|My Printer 5 192.168.4.255/STAFF

    the above line would cause nmbd to announce itself to the two given IP addresses using the given workgroup names. If you leave out the workgroup name then the one given in - the workgroup + the parameter is used instead.

    The IP addresses you choose would normally be the broadcast addresses of the remote networks, but can also be the IP addresses - of known browse masters if your network config is that stable.

    See ???.

    Default: remote announce = <empty string>

    remote browse sync (G)

    This option allows you to setup nmbd(8) to periodically request + of known browse masters if your network config is that stable.

    See .

    Default: remote announce = <empty string>

    remote browse sync (G)

    This option allows you to setup nmbd(8) to periodically request synchronization of browse lists with the master browser of a Samba server that is on a remote segment. This option will allow you to gain browse lists for multiple workgroups across routed networks. This @@ -2447,20 +2261,16 @@ print5|My Printer 5 means.

    Note

    The security advantage of using restrict anonymous = 2 is removed - by setting guest - ok = yes on any share. -

    Default: restrict anonymous = 0

    root (G)

    Synonym for - root directory". -

    root dir (G)

    Synonym for - root directory". + by setting on any share. +

    Default: restrict anonymous = 0

    root (G)

    Synonym for . +

    root dir (G)

    Synonym for .

    root directory (G)

    The server will chroot() (i.e. Change its root directory) to this directory on startup. This is not strictly necessary for secure operation. Even without it the server will deny access to files not in one of the service entries. It may also check for, and deny access to, soft links to other parts of the filesystem, or attempts to use ".." in file names - to access other directories (depending on the setting of the - wide links + to access other directories (depending on the setting of the parameter).

    Adding a root directory entry other than "/" adds an extra level of security, but at a price. It @@ -2476,16 +2286,11 @@ print5|My Printer 5 operating system dependent.

    Default: root directory = /

    Example: root directory = /homes/smb

    root postexec (S)

    This is the same as the postexec parameter except that the command is run as root. This is useful for unmounting filesystems - (such as CDROMs) after a connection is closed.

    See also - postexec.

    Default: root postexec = <empty string>

    root preexec (S)

    This is the same as the preexec + (such as CDROMs) after a connection is closed.

    See also .

    Default: root postexec = <empty string>

    root preexec (S)

    This is the same as the preexec parameter except that the command is run as root. This is useful for mounting filesystems (such as CDROMs) when a - connection is opened.

    See also - preexec and - preexec close.

    Default: root preexec = <empty string>

    root preexec close (S)

    This is the same as the preexec close - parameter except that the command is run as root.

    See also - preexec and - preexec close.

    Default: root preexec close = no

    security (G)

    This option affects how clients respond to + connection is opened.

    See also and .

    Default: root preexec = <empty string>

    root preexec close (S)

    This is the same as the preexec close + parameter except that the command is run as root.

    See also and .

    Default: root preexec close = no

    security (G)

    This option affects how clients respond to Samba and is one of the most important settings in the smb.conf file.

    The option sets the "security mode bit" in replies to protocol negotiations with smbd(8) to turn share level security on or off. Clients decide @@ -2509,11 +2314,9 @@ print5|My Printer 5 want to mainly setup shares without a password (guest shares). This is commonly used for a shared printer server. It is more difficult to setup guest shares with security = user, see - the map to guest - parameter for details.

    It is possible to use smbd in a + the parameter for details.

    It is possible to use smbd in a hybrid mode where it is offers both user and share - level security under different - NetBIOS aliases.

    The different settings will now be explained.

    SECURITY = SHARE

    When clients connect to a share level security server they + level security under different .

    The different settings will now be explained.

    SECURITY = SHARE

    When clients connect to a share level security server they need not log onto the server with a valid username and password before attempting to connect to a shared resource (although modern clients such as Windows 95/98 and Windows NT will send a logon request with @@ -2526,13 +2329,10 @@ print5|My Printer 5 in share level security, smbd uses several techniques to determine the correct UNIX user to use on behalf of the client.

    A list of possible UNIX usernames to match with the given - client password is constructed using the following methods :

    • If the guest - only parameter is set, then all the other - stages are missed and only the - guest account username is checked. + client password is constructed using the following methods :

      • If the parameter is set, then all the other + stages are missed and only the username is checked.

      • Is a username is sent with the share connection - request, then this username (after mapping - see - username map), + request, then this username (after mapping - see ), is added as a potential username.

      • If the client did a previous logon request (the SessionSetup SMB call) then the @@ -2541,8 +2341,7 @@ print5|My Printer 5 added as a potential username.

      • The NetBIOS name of the client is added to the list as a potential username. -

      • Any users on the - user list are added as potential usernames. +

      • Any users on the list are added as potential usernames.

      If the guest only parameter is not set, then this list is then tried with the supplied password. The first user for whom the password matches will be used as the @@ -2551,29 +2350,19 @@ print5|My Printer 5 as available to the guest account, then this guest user will be used, otherwise access is denied.

      Note that it can be very confusing in share-level security as to which UNIX username will eventually - be used in granting access.

      See also the section - NOTE ABOUT USERNAME/PASSWORD VALIDATION.

      SECURITY = USER

      This is the default security setting in Samba 3.0. + be used in granting access.

      See also the section .

      SECURITY = USER

      This is the default security setting in Samba 3.0. With user-level security a client must first "log-on" with a - valid username and password (which can be mapped using the - username map - parameter). Encrypted passwords (see the - encrypted passwords parameter) can also - be used in this security mode. Parameters such as - user and - guest only if set are then applied and + valid username and password (which can be mapped using the + parameter). Encrypted passwords (see the parameter) can also + be used in this security mode. Parameters such as and if set are then applied and may change the UNIX user to use on this connection, but only after the user has been successfully authenticated.

      Note that the name of the resource being requested is not sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing - the server to automatically map unknown users into the - guest account. - See the map to guest - parameter for details on doing this.

      See also the section - NOTE ABOUT USERNAME/PASSWORD VALIDATION.

      SECURITY = DOMAIN

      This mode will only work correctly if net(8) has been used to add this - machine into a Windows NT Domain. It expects the - encrypted passwords - parameter to be set to yes. In this + the server to automatically map unknown users into the . + See the parameter for details on doing this.

      See also the section .

      SECURITY = DOMAIN

      This mode will only work correctly if net(8) has been used to add this + machine into a Windows NT Domain. It expects the parameter to be set to yes. In this mode Samba will try to validate the username/password by passing it to a Windows NT Primary or Backup Domain Controller, in exactly the same way that a Windows NT Server would do.

      Note that a valid UNIX user must still @@ -2586,18 +2375,11 @@ print5|My Printer 5 requested is not sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing - the server to automatically map unknown users into the - guest account. - See the map to guest - parameter for details on doing this.

      See also the section - NOTE ABOUT USERNAME/PASSWORD VALIDATION.

      See also the password - server parameter and the - encrypted passwords - parameter.

      SECURITY = SERVER

      In this mode Samba will try to validate the username/password + the server to automatically map unknown users into the . + See the parameter for details on doing this.

      See also the section .

      See also the parameter and the parameter.

      SECURITY = SERVER

      In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an NT box. If this fails it will revert to security = - user. It expects the - encrypted passwords parameter + user. It expects the parameter to be set to yes, unless the remote server does not support them. However note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, @@ -2618,20 +2400,12 @@ print5|My Printer 5 requested is not sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing - the server to automatically map unknown users into the - guest account. - See the map to guest - parameter for details on doing this.

      See also the section - NOTE ABOUT USERNAME/PASSWORD VALIDATION.

      See also the password - server parameter and the - encrypted passwords parameter.

      SECURITY = ADS

      In this mode, Samba will act as a domain member in an ADS realm. To operate + the server to automatically map unknown users into the . + See the parameter for details on doing this.

      See also the section .

      See also the parameter and the parameter.

      SECURITY = ADS

      In this mode, Samba will act as a domain member in an ADS realm. To operate in this mode, the machine running Samba will need to have Kerberos installed and configured and Samba will need to be joined to the ADS realm using the net utility.

      Note that this mode does NOT make Samba operate as a Active Directory Domain - Controller.

      Read the chapter about Domain Membership in the HOWTO for details.

      See also the ads server - parameter, the realm - paramter and the - encrypted passwords parameter.

      Default: security = USER

      Example: security = DOMAIN

    security mask (S)

    This parameter controls what UNIX permission + Controller.

    Read the chapter about Domain Membership in the HOWTO for details.

    See also the parameter, the paramter and the parameter.

    Default: security = USER

    Example: security = DOMAIN

    security mask (S)

    This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a file using the native NT security dialog box.

    This parameter is applied as a mask (AND'ed with) to @@ -2644,11 +2418,8 @@ print5|My Printer 5 Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will - probably want to leave it set to 0777.

    See also the - force directory security mode, - directory - security mask, - force security mode parameters.

    Default: security mask = 0777

    Example: security mask = 0770

    server schannel (G)

    This controls whether the server offers or even + probably want to leave it set to 0777.

    See also the , + , parameters.

    Default: security mask = 0777

    Example: security mask = 0770

    server schannel (G)

    This controls whether the server offers or even demands the use of the netlogon schannel. server schannel = no does not offer the schannel, server schannel = @@ -2688,7 +2459,7 @@ print5|My Printer 5 samba can use.

    This parameter should specify the path to a script that can set quota for the specified arguments.

    The specified script should take the following arguments:

    • 1 - quota type

      • 1 - user quotas

      • 2 - user default quotas (uid = -1)

      • 3 - group quotas

      • 4 - group default quotas (gid = -1)

      -

    • 2 - id (uid for user, gid for group, -1 if N/A)

    • 3 - quota state (0 = disable, 1 = enable, 2 = enable and enforce)

    • 4 - block softlimit

    • 5 - block hardlimit

    • 6 - inode softlimit

    • 7 - inode hardlimit

    • 8(optional) - block size, defaults to 1024

    The script should output at least one line of data.

    See also the get quota command parameter. +

  • 2 - id (uid for user, gid for group, -1 if N/A)

  • 3 - quota state (0 = disable, 1 = enable, 2 = enable and enforce)

  • 4 - block softlimit

  • 5 - block hardlimit

  • 6 - inode softlimit

  • 7 - inode hardlimit

  • 8(optional) - block size, defaults to 1024

    • The script should output at least one line of data.

    See also the parameter.

    Default: set quota command =

    Example: set quota command = /usr/local/sbin/set_quota

    share modes (S)

    This enables or disables the honoring of the share modes during a file open. These modes are used by clients to gain exclusive read or write access @@ -2703,10 +2474,8 @@ print5|My Printer 5 off as many Windows applications will break if you do so.

    Default: share modes = yes

    short preserve case (S)

    This boolean parameter controls if new files which conform to 8.3 syntax, that is all in upper case and of suitable length, are created upper case, or if they are forced - to be the default case - . This option can be use with preserve case = yes - to permit long filenames to retain their case, while short - names are lowered.

    See the section on NAME MANGLING.

    Default: short preserve case = yes

    show add printer wizard (G)

    With the introduction of MS-RPC based printing support + to be the . This option can be use with to permit long filenames to retain their case, while short + names are lowered.

    See the section on .

    Default: short preserve case = yes

    show add printer wizard (G)

    With the introduction of MS-RPC based printing support for Windows NT/2000 client in Samba 2.2, a "Printers..." folder will appear on Samba hosts in the share listing. Normally this folder will contain an icon for the MS Add Printer Wizard (APW). However, it is @@ -2722,10 +2491,7 @@ print5|My Printer 5 parameter will always cause the OpenPrinterEx() on the server to fail. Thus the APW icon will never be displayed. Note :This does not prevent the same user from having - administrative privilege on an individual printer.

    See also addprinter - command, - deleteprinter command, - printer admin

    Default :show add printer wizard = yes

    shutdown script (G)

    This parameter only exists in the HEAD cvs branch + administrative privilege on an individual printer.

    See also , ,

    Default :show add printer wizard = yes

    shutdown script (G)

    This parameter only exists in the HEAD cvs branch This a full path name to a script called by smbd(8) that should start a shutdown procedure.

    This command will be run as the user connected to the server.

    %m %t %r %f parameters are expanded:

    • %m will be substituted with the shutdown message sent to the server.

    • %t will be substituted with the number of seconds to wait before effectively starting the @@ -2744,8 +2510,7 @@ let "time++" /sbin/shutdown $3 $4 +$time $1 &

      Shutdown does not return so we need to launch it in background. -

      See also - abort shutdown script.

    smb passwd file (G)

    This option sets the path to the encrypted smbpasswd file. By +

    See also .

    smb passwd file (G)

    This option sets the path to the encrypted smbpasswd file. By default the path to the smbpasswd file is compiled into Samba.

    Default: smb passwd file = ${prefix}/private/smbpasswd

    Example: smb passwd file = /etc/samba/smbpasswd

    smb ports (G)

    Specifies which ports the server should listen on for SMB traffic.

    Default: smb ports = 445 139

    socket address (G)

    This option allows you to control what address Samba will listen for connections on. This is used to support multiple virtual interfaces on the one server, each @@ -2763,8 +2528,8 @@ Shutdown does not return so we need to launch it in background. "Unknown socket option" when you supply an option. This means you either incorrectly typed it or you need to add an include file to includes.h for your OS. If the latter is the case please - send the patch to - samba-technical@samba.org.

    Any of the supported socket options may be combined + send the patch to + samba-technical@samba.org.

    Any of the supported socket options may be combined in any way you like, as long as your OS allows it.

    This is the list of socket options currently settable using this option:

    • SO_KEEPALIVE

    • SO_REUSEADDR

    • SO_BROADCAST

    • TCP_NODELAY

    • IPTOS_LOWDELAY

    • IPTOS_THROUGHPUT

    • SO_SNDBUF *

    • SO_RCVBUF *

    • SO_SNDLOWAT *

    • SO_RCVLOWAT *

    Those marked with a '*' take an integer argument. The others can optionally take a 1 or 0 argument to enable @@ -2792,11 +2557,11 @@ Shutdown does not return so we need to launch it in background. disk block allocation when a file is extended.

    Setting this to yes can help Samba return out of quota messages on systems that are restricting the disk quota of users.

    Default: strict allocate = no

    strict locking (S)

    This is a boolean that controls the handling of - file locking in the server. When this is set to yes + file locking in the server. When this is set to yes, the server will check every read and write access for file locks, and - deny access if locks exist. This can be slow on some systems.

    When strict locking is no the server does file + deny access if locks exist. This can be slow on some systems.

    When strict locking is disabled, the server performs file lock checks only when the client explicitly asks for them.

    Well-behaved clients always ask for lock checks when it - is important, so in the vast majority of cases strict + is important. So in the vast majority of cases, strict locking = no is preferable.

    Default: strict locking = no

    strict sync (S)

    Many Windows applications (including the Windows 98 explorer shell) seem to confuse flushing buffer contents to disk with doing a sync to disk. Under UNIX, a sync call forces the process to be @@ -2809,10 +2574,7 @@ Shutdown does not return so we need to launch it in background. of losing data if the operating system itself that Samba is running on crashes, so there is little danger in this default setting. In addition, this fixes many performance problems that people have - reported with the new Windows98 explorer shell file copies.

    See also the sync - always parameter.

    Default: strict sync = no

    strip dot (G)

    This is a boolean that controls whether to - strip trailing dots off UNIX filenames. This helps with some - CDROMs that have filenames ending in a single dot.

    Default: strip dot = no

    sync always (S)

    This is a boolean parameter that controls + reported with the new Windows98 explorer shell file copies.

    See also the parameter.

    Default: strict sync = no

    sync always (S)

    This is a boolean parameter that controls whether writes will always be written to stable storage before the write call returns. If this is no then the server will be guided by the client's request in each write call (clients can @@ -2821,8 +2583,7 @@ Shutdown does not return so we need to launch it in background. call to ensure the data is written to disk. Note that the strict sync parameter must be set to yes in order for this parameter to have - any affect.

    See also the strict - sync parameter.

    Default: sync always = no

    syslog (G)

    This parameter maps how Samba debug messages + any affect.

    See also the parameter.

    Default: sync always = no

    syslog (G)

    This parameter maps how Samba debug messages are logged onto the system syslog logging levels. Samba debug level zero maps onto syslog LOG_ERR, debug level one maps onto LOG_WARNING, debug level @@ -2847,8 +2608,7 @@ Shutdown does not return so we need to launch it in background. to the normal GMT to local time conversion. This is useful if you are serving a lot of PCs that have incorrect daylight saving time handling.

    Default: time offset = 0

    Example: time offset = 60

    time server (G)

    This parameter determines if nmbd(8) advertises itself as a time server to Windows - clients.

    Default: time server = no

    timestamp logs (G)

    Synonym for - debug timestamp.

    unicode (G)

    Specifies whether Samba should try + clients.

    Default: time server = no

    timestamp logs (G)

    Synonym for .

    unicode (G)

    Specifies whether Samba should try to use unicode on the wire by default. Note: This does NOT mean that samba will assume that the unix machine uses unicode!

    Default: unicode = yes

    unix charset (G)

    Specifies the charset the unix machine @@ -2866,9 +2626,7 @@ Shutdown does not return so we need to launch it in background. programparameter is called AS ROOT - to allow the new UNIX password to be set without access to the old UNIX password (as the SMB password change code has no - access to the old password cleartext, only the new).

    See also passwd - program, - passwd chat. + access to the old password cleartext, only the new).

    See also , .

    Default: unix password sync = no

    update encrypted (G)

    This boolean parameter allows a user logging on with a plaintext password to have their encrypted (hashed) password in the smbpasswd file to be updated automatically as they log @@ -2882,8 +2640,7 @@ Shutdown does not return so we need to launch it in background. over to encrypted passwords to be made over a longer period. Once all users have encrypted representations of their passwords in the smbpasswd file this parameter should be set to - no.

    In order for this parameter to work correctly the - encrypt passwords parameter must + no.

    In order for this parameter to work correctly the parameter must be set to no when this parameter is set to yes.

    Note that even when this parameter is set a user authenticating to smbd must still enter a valid password in order to connect correctly, and to update their hashed @@ -2910,14 +2667,14 @@ Shutdown does not return so we need to launch it in background. to PRINTER_ACCESS_USE instead. Thus allowing the OpenPrinterEx() call to succeed. This parameter MUST not be able enabled on a print share which has valid print driver installed on the Samba - server.

    See also disable spoolss

    Default: use client driver = no

    use mmap (G)

    This global parameter determines if the tdb internals of Samba can + server.

    See also

    Default: use client driver = no

    use mmap (G)

    This global parameter determines if the tdb internals of Samba can depend on mmap working correctly on the running system. Samba requires a coherent mmap/read-write system memory cache. Currently only HPUX does not have such a coherent cache, and so this parameter is set to no by default on HPUX. On all other systems this parameter should be left alone. This parameter is provided to help the Samba developers track down problems with the tdb internal code. -

    Default: use mmap = yes

    user (S)

    Synonym for username.

    username (S)

    Multiple users may be specified in a comma-delimited +

    Default: use mmap = yes

    user (S)

    Synonym for .

    username (S)

    Multiple users may be specified in a comma-delimited list, in which case the supplied password will be tested against each username in turn (left to right).

    The username line is needed only when the PC is unable to supply its own username. This is the case @@ -2936,8 +2693,7 @@ Shutdown does not return so we need to launch it in background. they will be able to do no more damage than if they started a telnet session. The daemon runs as the user that they log in as, so they cannot do anything that user cannot do.

    To restrict a service to a particular set of users you - can use the valid users - parameter.

    If any of the usernames begin with a '@' then the name + can use the parameter.

    If any of the usernames begin with a '@' then the name will be looked up first in the NIS netgroups list (if Samba is compiled with netgroup support), followed by a lookup in the UNIX groups database and will expand to a list of all users @@ -2948,8 +2704,7 @@ Shutdown does not return so we need to launch it in background. is compiled with netgroup support) and will expand to a list of all users in the netgroup group of that name.

    Note that searching though a groups database can take quite some time, and some clients may time out during the - search.

    See the section NOTE ABOUT - USERNAME/PASSWORD VALIDATION for more information on how + search.

    See the section for more information on how this parameter determines access to the services.

    Default: The guest account if a guest service, else <empty string>.

    Examples:username = fred, mary, jack, jane, @users, @pcgroup

    username level (G)

    This option helps Samba to try and 'guess' at @@ -3000,14 +2755,12 @@ guest = * will actually be connecting to \\server\mary and will need to supply a password suitable for mary not fred. The only exception to this is the - username passed to the - password server (if you have one). The password + username passed to the (if you have one). The password server will receive whatever username the client supplies without modification.

    Also note that no reverse mapping is done. The main effect this has is with printing. Users who have been mapped may have trouble deleting print jobs as PrintManager under WfWg will think - they don't own the print job.

    Default: no username map

    Example: username map = /usr/local/samba/lib/users.map

    users (S)

    Synonym for - username.

    use sendfile (S)

    If this parameter is yes, and Samba + they don't own the print job.

    Default: no username map

    Example: username map = /usr/local/samba/lib/users.map

    users (S)

    Synonym for .

    use sendfile (S)

    If this parameter is yes, and Samba was built with the --with-sendfile-support option, and the underlying operating system supports sendfile system call, then some SMB read calls (mainly ReadAndX and ReadRaw) will use the more efficient sendfile system call for files that @@ -3027,13 +2780,11 @@ guest = * are required to create a unique identifier for the incoming user. Enabling this option creates an n^2 algorithm to find this number. This may impede - performance on large installations.

    See also the - utmp directory parameter.

    Default: utmp = no

    utmp directory (G)

    This parameter is only available if Samba has + performance on large installations.

    See also the parameter.

    Default: utmp = no

    utmp directory (G)

    This parameter is only available if Samba has been configured and compiled with the option --with-utmp. It specifies a directory pathname that is used to store the utmp or utmpx files (depending on the UNIX system) that - record user connections to a Samba server. See also the - utmp parameter. By default this is + record user connections to a Samba server. See also the parameter. By default this is not set, meaning the system will use whatever utmp file the native system is set to use (usually /var/run/utmp on Linux).

    Default: no utmp directory

    Example: utmp directory = /var/run/utmp

    -valid (S)

    This parameter indicates whether a share is @@ -3049,8 +2800,7 @@ guest = * invalid users parameter.

    If this is empty (the default) then any user can login. If a username is in both this list and the invalid users list then access is denied for that user.

    The current servicename is substituted for %S - . This is useful in the [homes] section.

    See also invalid users -

    Default: No valid users list (anyone can login) + . This is useful in the [homes] section.

    See also

    Default: No valid users list (anyone can login)

    Example: valid users = greg, @pcusers

    veto files (S)

    This is a list of files and directories that are neither visible nor accessible. Each entry in the list must be separated by a '/', which allows spaces to be included @@ -3066,9 +2816,7 @@ guest = * the delete veto files parameter to yes.

    Setting this parameter will affect the performance of Samba, as it will be forced to check all files and directories - for a match as they are scanned.

    See also hide files - and - case sensitive.

    Default: No files or directories are vetoed. + for a match as they are scanned.

    See also and .

    Default: No files or directories are vetoed.

    Examples: 

     ; Veto any files containing the word Security, 
@@ -3079,12 +2827,11 @@ veto files = /*Security*/*.tmp/*root*/
 ; Veto the Apple specific files that a NetAtalk server
 ; creates.
 veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/
-
    veto oplock files (S)

    This parameter is only valid when the - oplocks +

    veto oplock files (S)

    This parameter is only valid when the parameter is turned on for a share. It allows the Samba administrator to selectively turn off the granting of oplocks on selected files that match a wildcarded list, similar to the wildcarded list used in the - veto files + parameter.

    Default: No files are vetoed for oplock grants

    You might want to do this on files that you know will be heavily contended for by clients. A good example of this is in the NetBench SMB benchmark program, which causes heavy @@ -3092,9 +2839,7 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ To cause Samba not to grant oplocks on these files you would use the line (either in the [global] section or in the section for the particular NetBench share :

    Example: veto oplock files = /*.SEM/

    vfs object (S)

    Synonym for - - vfs objects - . + .

    vfs objects (S)

    This parameter specifies the backend names which are used for Samba VFS I/O operations. By default, normal disk I/O operations are used but these can be overloaded @@ -3195,7 +2940,7 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ seperated from the ip address by a colon.

    Note

    You need to set up Samba to point to a WINS server if you have multiple subnets and wish cross-subnet - browsing to work correctly.

    See the ???.

    Default: not enabled

    Example: wins server = mary:192.9.200.1 fred:192.168.3.199 mary:192.168.2.61

    For this example when querying a certain name, 192.19.200.1 will + browsing to work correctly.

    See the .

    Default: not enabled

    Example: wins server = mary:192.9.200.1 fred:192.168.3.199 mary:192.168.2.61

    For this example when querying a certain name, 192.19.200.1 will be asked first and if that doesn't respond 192.168.2.61. If either of those doesn't know the name 192.168.3.199 will be queried.

    Example: wins server = 192.9.200.1 192.168.2.61

    wins support (G)

    This boolean controls if the nmbd(8) process in Samba will act as a WINS server. You should @@ -3205,10 +2950,8 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ on more than one machine in your network.

    Default: wins support = no

    workgroup (G)

    This controls what workgroup your server will appear to be in when queried by clients. Note that this parameter also controls the Domain name used with - the security = domain - setting.

    Default: set at compile time to WORKGROUP

    Example: workgroup = MYGROUP

    writable (S)

    Synonym for - writeable for people who can't spell :-).

    writeable (S)

    Inverted synonym for - read only.

    write cache size (S)

    If this integer parameter is set to non-zero value, + the + setting.

    Default: set at compile time to WORKGROUP

    Example: workgroup = MYGROUP

    writable (S)

    Synonym for for people who can't spell :-).

    writeable (S)

    Inverted synonym for .

    write cache size (S)

    If this integer parameter is set to non-zero value, Samba will create an in-memory cache for each oplocked file (it does not do this for non-oplocked files). All writes that the client does not request @@ -3223,13 +2966,10 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ memory for userspace programs.

    The integer parameter specifies the size of this cache (per oplocked file) in bytes.

    Default: write cache size = 0

    Example: write cache size = 262144

    for a 256k cache size per file.

    write list (S)

    This is a list of users that are given read-write access to a service. If the connecting user is in this list then - they will be given write access, no matter what the - read only + they will be given write access, no matter what the option is set to. The list can include group names using the @group syntax.

    Note that if a user is in both the read list and the - write list then they will be given write access.

    See also the read list - option.

    Default: write list = <empty string>

    Example: write list = admin, root, @staff

    write ok (S)

    Inverted synonym for - read only.

    write raw (G)

    This parameter controls whether or not the server + write list then they will be given write access.

    See also the option.

    Default: write list = <empty string>

    Example: write list = admin, root, @staff

    write ok (S)

    Inverted synonym for .

    write raw (G)

    This parameter controls whether or not the server will support raw write SMB's when transferring data from clients. You should never need to change this parameter.

    Default: write raw = yes

    wtmp directory (G)

    This parameter is only available if Samba has been configured and compiled with the option @@ -3237,8 +2977,7 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ used to store the wtmp or wtmpx files (depending on the UNIX system) that record user connections to a Samba server. The difference with the utmp directory is the fact that user info is kept after a user - has logged out.

    See also the - utmp parameter. By default this is + has logged out.

    See also the parameter. By default this is not set, meaning the system will use whatever utmp file the native system is set to use (usually /var/run/wtmp on Linux).

    Default: no wtmp directory

    Example: wtmp directory = /var/log/wtmp

    WARNINGS

    Although the configuration file permits service names @@ -3258,8 +2997,8 @@ veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

    The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another - excellent piece of Open Source software, available at - ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 + excellent piece of Open Source software, available at + ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.

    diff --git a/docs/htmldocs/smbcacls.1.html b/docs/htmldocs/smbcacls.1.html index 1c3cc5a2d3..a6bcf60720 100644 --- a/docs/htmldocs/smbcacls.1.html +++ b/docs/htmldocs/smbcacls.1.html @@ -1,6 +1,6 @@ -smbcacls



    =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
    + samba - opening windows to a wider world +
    + + + +
    + + + + +
    + + + + -- cgit From 8efca15a8b45692f27ab783e4759646dee612eae Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Fri, 26 Sep 2003 14:44:11 +0000 Subject: don't write to static pointers; patch from Anthony (This used to be commit b766fe78a7d8e4095d42e123f2b21369113c1f14) --- source3/configure.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/configure.in b/source3/configure.in index b981313c9a..8c2e9e7f9b 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -480,7 +480,7 @@ main() { /* Ensure this is kernel 2.4 or higher */ uname(&uts); - release = uts.release; + release = strdup(uts.release); major = atoi(strsep(&release, ".")); minor = atoi(strsep(&release, ".")); -- cgit From b777c1626f6583d5687a9fb6c5c776df8c524bcf Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Sun, 28 Sep 2003 23:14:56 +0000 Subject: Add draft about new registry subsystem (This used to be commit 6d310e98e0d8654a95de98fcd4aa55e3c681157d) --- docs/docbook/devdoc/dev-doc.xml | 2 + docs/docbook/devdoc/registry.xml | 209 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 211 insertions(+) create mode 100644 docs/docbook/devdoc/registry.xml diff --git a/docs/docbook/devdoc/dev-doc.xml b/docs/docbook/devdoc/dev-doc.xml index 7000d09c98..e112a0f9e1 100644 --- a/docs/docbook/devdoc/dev-doc.xml +++ b/docs/docbook/devdoc/dev-doc.xml @@ -20,6 +20,7 @@ + ]> @@ -82,6 +83,7 @@ url="http://www.fsf.org/licenses/gpl.txt">http://www.fsf.org/licenses/gpl.txt diff --git a/docs/docbook/devdoc/registry.xml b/docs/docbook/devdoc/registry.xml new file mode 100644 index 0000000000..b331ebce7f --- /dev/null +++ b/docs/docbook/devdoc/registry.xml @@ -0,0 +1,209 @@ + + + &author.jelmer; + 24 September 2003 + + + The registry subsystem + + Planned backends + + + The new registry subsystem will work with several different backends: + + + + NT4 (NT4 registry files) + TDB (Samba TDB files) + RPC (Remote Registry over RPC, reg pipe) + wine (Wine Registry Files) + gconf (The GNOME configuration backend) + + + + +Data structures + + +The following structure describes a registry key: + + + +typedef struct reg_key_s { + char *name; /* Name of the key */ + smb_ucs2_t *class_name; /* Name of key class */ + int type; /* One of REG_ROOT_KEY or REG_SUB_KEY */ + NTTIME last_mod; /* Time last modified */ + struct reg_key_s *owner; + struct key_list_s *sub_keys; /* NULL indicates keys not available in memory, function should be called */ + struct val_list_s *values; /* NULL indicates values not available in memory, function should be called */ + SEC_DESC *security; + REG_HANDLE *handle; /* Pointer to REG_HANDLE this key belongs to */ + void *backend_data; /* Pointer used by the backend */ +} REG_KEY; + + +The following structure describes a registry value: + + +typedef struct val_key_s { + char *name; /* NULL if name not available */ + int data_type; + int data_len; + void *data_blk; /* Might want a separate block */ + REG_HANDLE *handle; /* Pointer to REG_HANDLE this key belongs to */ + void *backend_data; +} REG_VAL; + + +The following structures are used for lists of subkeys or values: + + +/* container for registry subkey names */ +typedef struct key_list_s { + TALLOC_CTX *ctx; + uint32 num_subkeys; + REG_KEY **subkeys; +} REG_KEY_LIST; + +/* container for registry values */ +typedef struct val_list_s { + TALLOC_CTX *ctx; + uint32 num_vals; + REG_VAL **vals; +} REG_VAL_LIST; + + + +And this structure is used for an instance of a registry (a registry file that's opened, a remote registry pipe we're connected to, etc). + + + +typedef struct reg_handle_s { + REGISTRY_OPS *functions; + REG_KEY *root; /* NULL if not available */ + void *backend_data; +} REG_HANDLE; + + + + + + External interface + + +REG_HANDLE *reg_open(char *backend, char *location, BOOL try_full_load); +REG_KEY *reg_open_key(REG_KEY *parent, char *name); +REG_VAL *reg_key_get_val(REG_KEY *key, char *name); +REG_VAL_LIST *reg_key_get_vals(REG_KEY *key); +REG_KEY_LIST *reg_key_get_subkeys(REG_KEY *key); +BOOL reg_key_del(REG_KEY *key); +BOOL reg_val_del(REG_VAL *val); +BOOL reg_key_add(REG_KEY *parent, REG_KEY *key); +BOOL reg_val_add(REG_KEY *parent, REG_VAL *val): +BOOL reg_val_update(REG_VAL *val); +BOOL reg_key_update(REG_KEY *key); +void reg_free_key(REG_KEY *key); +void reg_free_val(REG_VAL *val); +void reg_free(REG_HANDLE *h); +void reg_free_key_list(REG_KEY_LIST *list): +void reg_free_val_list(REG_VAL_LIST *list): + + + + + + Utility functions + + The following helper functions are available: + + +void reg_key_list_init( REG_KEY_LIST *ctr ); +int reg_key_list_addkey( REG_KEY_LIST *ctr, const char *keyname ); +int reg_key_list_numkeys( REG_KEY_LIST *ctr ); +char* reg_key_list_specific_key( REG_KEY_LIST *ctr, uint32 key_index ); +void reg_key_list_destroy( REG_KEY_LIST *ctr ); +void reg_val_list_init( REG_VAL_LIST *ctr ); +int reg_val_list_numvals( REG_VAL_LIST *ctr ); +void free_registry_value( REG_VAL *val ); +uint8* regval_data_p( REG_VAL *val ); +int regval_size( REG_VAL *val ); +char* regval_name( REG_VAL *val ); +uint32 regval_type( REG_VAL *val ); +TALLOC_CTX* reg_val_list_getctx( REG_VAL_LIST *val ); +int reg_val_list_addvalue( REG_VAL_LIST *ctr, const char *name, uint16 type, + const char *data_p, size_t size ); +int reg_val_list_copyvalue( REG_VAL_LIST *ctr, REG_VAL *val ); +int reg_val_list_delvalue( REG_VAL_LIST *ctr, const char *name ); +void reg_val_list_destroy( REG_VAL_LIST *ctr ); + + + + + + Writing backends + +There are basically two ways of reading data from the registry: loading +it all into memory and then working in this copy in memory, or +re-reading/re-opening it every time necessary. + +This interface aims to support both types. + +A registry backend should provide the following functions: + + +typedef struct { + REG_HANDLE *(*open_registry) (const char *location, BOOL try_complete_load); + REG_KEY *(*open_root_key) (REG_HANDLE *); + REG_KEY *(*open_key_rel) (REG_KEY *parent, const char *name); + /* if open_key_abs is set to NULL, a default implementation will be provided. */ + REG_KEY *(*open_key_abs) (REG_HANDLE *, const char *name); + REG_KEY_LIST *(*get_subkeys) (REG_KEY *); + REG_VAL_LIST *(*get_values) (REG_KEY *); + BOOL (*add_key)(REG_KEY *, REG_KEY *); + BOOL (*update_key)(REG_KEY *); + BOOL (*del_key)(REG_KEY *); + BOOL (*add_value)(REG_KEY *, REG_VAL *); + BOOL (*update_value)(REG_VAL *); + BOOL (*del_value)(REG_VAL *); + REG_VAL *(*get_value) (REG_KEY *, const char *name); + /* It is not guaranteed that no data has been stored before save() + * has been called. This function is only useful for backends that + * store the data in memory and then write out the whole registry at once */ + BOOL (*save)(REG_HANDLE *, const char *location); + BOOL (*close_registry) (REG_HANDLE *); + void (*free_key)(REG_KEY *); + void (*free_value)(REG_VAL *); +} REGISTRY_OPS; + + +open_root_key() is optional. It's only called if the + root field of the REG_HANDLE struct is NULL. + +open_key_abs() is optional. If it's NULL, the frontend will + provide a replacement, using open_key_rel(). + +get_values() and get_value() are optional. They're only called if +the values field of the REG_KEY struct is NULL. + +get_subkeys() and get_key() are optional. THey're only called + if the subkeys field of the REG_KEY struct is NULL. + + + +Memory allocation + +Okay, so who's responsible for what parts of the memory? + +The memory is basically maintained by the backends. When the user +is finished using a particular structure, it should call the related free +function for the structure it's freeing. + +The backend should then decide what to do with the structure. It may +choose to free it, or, if it's maintaining single copies of everything in +memory, may choose to ignore the free and free it when the registry is closed. + + + + + -- cgit From fbb85e4b422f0f48f31e10025aa293ffacc53178 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Mon, 29 Sep 2003 02:40:09 +0000 Subject: Testparm fixes: - Also check global 'hosts allow'/'hosts deny' when checking access to share - Warn when user specifies 2 arguments instead of 1 or 3. Patch from Jay Fenlason (This used to be commit 034fe96f9c3d3328bc69ef328f10690336dc35b0) --- source3/utils/testparm.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c index 34c25480d9..085156305b 100644 --- a/source3/utils/testparm.c +++ b/source3/utils/testparm.c @@ -226,7 +226,12 @@ via the %%o substitution. With encrypted passwords this is not possible.\n", lp_ cname = poptGetArg(pc); caddr = poptGetArg(pc); - + + if ( cname && ! caddr ) { + printf ( "ERROR: You must specify both a machine name and an IP address.\n" ); + return(1); + } + if (new_local_machine) { set_local_machine_name(new_local_machine, True); } @@ -346,8 +351,9 @@ via the %%o substitution. With encrypted passwords this is not possible.\n", lp_ if(cname && caddr){ /* this is totally ugly, a real `quick' hack */ for (s=0;s<1000;s++) { - if (VALID_SNUM(s)) { - if (allow_access(lp_hostsdeny(s), lp_hostsallow(s), cname, caddr)) { + if (VALID_SNUM(s)) { + if (allow_access(lp_hostsdeny(-1), lp_hostsallow(-1), cname, caddr) + && allow_access(lp_hostsdeny(s), lp_hostsallow(s), cname, caddr)) { printf("Allow connection from %s (%s) to %s\n", cname,caddr,lp_servicename(s)); } else { -- cgit From 929503023527c0b6ffbb3193180729da79695935 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 29 Sep 2003 06:01:11 +0000 Subject: Merge from 3.0: >last minute updates from Buchan (This used to be commit e3e13cbc19d00b10d161a46a78e993232c1504c8) --- packaging/Mandrake/smb.conf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/packaging/Mandrake/smb.conf b/packaging/Mandrake/smb.conf index 6ea6635191..4981d22174 100644 --- a/packaging/Mandrake/smb.conf +++ b/packaging/Mandrake/smb.conf @@ -233,7 +233,7 @@ ; add user to group script = /usr/share/samba/scripts/smbldap-groupmod.pl -m '%u' '%g' ; delete user from group script = /usr/share/samba/scripts/smbldap-groupmod.pl -x '%u' '%g' ; set primary group script = /usr/share/samba/scripts/smbldap-usermod.pl -g '%g' '%u' -; add group script = /usr/share/samba/scripts/smbldap-groupadd.pl '%g' && /usr/share/samba3/scripts/smbldap-groupshow.pl %g|awk '/^gidNumber:/ {print $2}' +; add group script = /usr/share/samba/scripts/smbldap-groupadd.pl '%g' && /usr/share/samba/scripts/smbldap-groupshow.pl %g|awk '/^gidNumber:/ {print $2}' ; delete group script = /usr/share/samba/scripts/smbldap-userdel.pl '%g' @@ -279,7 +279,6 @@ # start_tls should run on 389, but samba defaults incorrectly to 636 ; ldap port = 389 ; ldap suffix = dc=mydomain,dc=com -; ldap server = ldap.mydomain.com # Seperate suffixes are available for machines, users, groups, and idmap, if # ldap suffix appears first, it is appended to the specific suffix. # Example for a unix-ish directory layout: -- cgit From 13a5a0b51ff39181b615d26e82979074261e22f6 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 29 Sep 2003 06:06:11 +0000 Subject: Merge from 3.0: >last minute updates from Buchan (actually was my change to add swat msg translation files to rpm) (This used to be commit 1c14a9d267c41ad632923dd44e324e8b99dd1fee) --- packaging/RedHat/samba.spec.tmpl | 1 + 1 file changed, 1 insertion(+) diff --git a/packaging/RedHat/samba.spec.tmpl b/packaging/RedHat/samba.spec.tmpl index fa4b7b070b..063af05dd3 100644 --- a/packaging/RedHat/samba.spec.tmpl +++ b/packaging/RedHat/samba.spec.tmpl @@ -416,6 +416,7 @@ fi %attr(755,root,root) %{prefix}/lib/samba/charset/*.so #%attr(755,root,root) %{prefix}/lib/samba/pdb/*.so %attr(755,root,root) %{prefix}/lib/samba/*.dat +%attr(755,root,root) %{prefix}/lib/samba/*.msg %{prefix}/include/libsmbclient.h %{prefix}/lib/libsmbclient.a %{prefix}/lib/libsmbclient.so -- cgit From 0a6295debd1db430b6db7fed8767ab6301d9359d Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 29 Sep 2003 06:06:49 +0000 Subject: Merge from 3.0: >make sure to install the *msg files for SWAT (This used to be commit e7006f27729679d56f52838699d894cf6143c019) --- packaging/Solaris/makepkg.sh.tmpl | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/packaging/Solaris/makepkg.sh.tmpl b/packaging/Solaris/makepkg.sh.tmpl index d1da9d5f12..df9d6b89d5 100755 --- a/packaging/Solaris/makepkg.sh.tmpl +++ b/packaging/Solaris/makepkg.sh.tmpl @@ -119,6 +119,13 @@ add_dynamic_entries() do echo "f none samba/$i=$i 0644 root other" done + # add the .msg files for SWAT + echo "#\n# msg files \n#" + for file in $DISTR_BASE/source/po/*.msg ; do + bfile=`basename $file` + echo f none /usr/local/samba/lib/$bfile=source/po/$bfile + done + echo "#\n# HTML documentation for SWAT\n#" cd $DISTR_BASE/docs/htmldocs for htmldoc in * -- cgit From 64dbd7cbff3fa7a4e560571ec38207a7176e4646 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 29 Sep 2003 06:07:30 +0000 Subject: Merge from 3.0: >Change AC_CHECK_LIB_EXT to prepend libraries instead of append. This >is the same way AC_CHECK_LIB works. Fix for bug 508. > >This may have to go a few rounds on the build farm to ensure it works >everywhere. (This used to be commit e2da7c8a9dc0e4c698c330422682feccae879bbd) --- source3/aclocal.m4 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/aclocal.m4 b/source3/aclocal.m4 index 52396e56d6..e1ea9385fd 100644 --- a/source3/aclocal.m4 +++ b/source3/aclocal.m4 @@ -179,7 +179,7 @@ AS_IF([test AS_VAR_GET(ac_Lib_ext) = yes], *-l$1*) ;; *) - $2="$$2 -l$1" + $2="-l$1 $$2" ;; esac]) [$6] -- cgit From 5400952f7f74d6e656fcf4ded173868ecec3cb77 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 29 Sep 2003 06:17:09 +0000 Subject: Merge from 3.0: >Fix for #480. Change the interface for init_unistr2 to not take a length >but a flags field. We were assuming that 2*strlen(mb_string) == length of ucs2-le string. >This is not the case. Count it after conversion. >Jeremy. (This used to be commit e2ab9e54cd0ec0002175cf18ff364f4aebaf85a0) --- source3/include/rpc_lsa.h | 2 - source3/include/rpc_misc.h | 8 +- source3/lib/util_unistr.c | 12 +- source3/python/py_spoolss_forms.c | 2 +- source3/python/py_spoolss_forms_conv.c | 2 +- source3/registry/reg_printing.c | 41 ++-- source3/rpc_client/cli_srvsvc.c | 16 +- source3/rpc_parse/parse_dfs.c | 20 +- source3/rpc_parse/parse_ds.c | 6 +- source3/rpc_parse/parse_lsa.c | 39 +--- source3/rpc_parse/parse_misc.c | 98 ++++---- source3/rpc_parse/parse_net.c | 108 ++++----- source3/rpc_parse/parse_reg.c | 64 ++--- source3/rpc_parse/parse_samr.c | 416 ++++++++++++++------------------- source3/rpc_parse/parse_spoolss.c | 79 +++---- source3/rpc_parse/parse_srv.c | 74 +++--- source3/rpc_server/srv_dfs_nt.c | 12 +- source3/rpc_server/srv_lsa_ds_nt.c | 6 +- source3/rpc_server/srv_lsa_nt.c | 71 +++--- source3/rpc_server/srv_samr_nt.c | 23 +- source3/rpc_server/srv_spoolss_nt.c | 14 +- source3/rpcclient/cmd_spoolss.c | 4 +- 22 files changed, 467 insertions(+), 650 deletions(-) diff --git a/source3/include/rpc_lsa.h b/source3/include/rpc_lsa.h index fa49d76c88..93bc08a0ce 100644 --- a/source3/include/rpc_lsa.h +++ b/source3/include/rpc_lsa.h @@ -728,5 +728,3 @@ typedef struct lsa_r_removeprivs #endif /* _RPC_LSA_H */ - - diff --git a/source3/include/rpc_misc.h b/source3/include/rpc_misc.h index f9dd15c36b..aaaad55c20 100644 --- a/source3/include/rpc_misc.h +++ b/source3/include/rpc_misc.h @@ -148,7 +148,7 @@ typedef struct bufhdr_info typedef struct buffer2_info { uint32 buf_max_len; - uint32 undoc; + uint32 offset; uint32 buf_len; /* unicode characters. ***MUST*** be little-endian. **NOT** necessarily null-terminated */ uint16 *buffer; @@ -173,7 +173,7 @@ typedef struct buffer5_info typedef struct unistr2_info { uint32 uni_max_len; - uint32 undoc; + uint32 offset; uint32 uni_str_len; /* unicode characters. ***MUST*** be little-endian. **must** be null-terminated and the uni_str_len should include @@ -185,7 +185,7 @@ typedef struct unistr2_info typedef struct string2_info { uint32 str_max_len; - uint32 undoc; + uint32 offset; uint32 str_str_len; uint8 *buffer; /* uint8 characters. **NOT** necessarily null-terminated */ } STRING2; @@ -403,5 +403,5 @@ typedef struct buffer4_info } BUFFER4; - +enum unistr2_term_codes { UNI_FLAGS_NONE = 0, UNI_STR_TERMINATE = 1, UNI_MAXLEN_TERMINATE = 2 }; #endif /* _RPC_MISC_H */ diff --git a/source3/lib/util_unistr.c b/source3/lib/util_unistr.c index e7c200218e..e90a824395 100644 --- a/source3/lib/util_unistr.c +++ b/source3/lib/util_unistr.c @@ -819,22 +819,25 @@ UNISTR2* ucs2_to_unistr2(TALLOC_CTX *ctx, UNISTR2* dst, smb_ucs2_t* src) { size_t len; - if (!src) return NULL; + if (!src) + return NULL; len = strlen_w(src); /* allocate UNISTR2 destination if not given */ if (!dst) { dst = (UNISTR2*) talloc(ctx, sizeof(UNISTR2)); - if (!dst) return NULL; + if (!dst) + return NULL; } if (!dst->buffer) { dst->buffer = (uint16*) talloc(ctx, sizeof(uint16) * (len + 1)); - if (!dst->buffer) return NULL; + if (!dst->buffer) + return NULL; } /* set UNISTR2 parameters */ dst->uni_max_len = len + 1; - dst->undoc = 0; + dst->offset = 0; dst->uni_str_len = len; /* copy the actual unicode string */ @@ -842,4 +845,3 @@ UNISTR2* ucs2_to_unistr2(TALLOC_CTX *ctx, UNISTR2* dst, smb_ucs2_t* src) return dst; } - diff --git a/source3/python/py_spoolss_forms.c b/source3/python/py_spoolss_forms.c index ef9ed94533..66a6540e07 100644 --- a/source3/python/py_spoolss_forms.c +++ b/source3/python/py_spoolss_forms.c @@ -59,7 +59,7 @@ PyObject *spoolss_hnd_addform(PyObject *self, PyObject *args, PyObject *kw) PyObject *obj = PyDict_GetItemString(info, "name"); char *form_name = PyString_AsString(obj); - init_unistr2(&form.name, form_name, strlen(form_name) + 1); + init_unistr2(&form.name, form_name, UNI_STR_TERMINATE); break; } default: diff --git a/source3/python/py_spoolss_forms_conv.c b/source3/python/py_spoolss_forms_conv.c index 095a318fd2..ede729cad3 100644 --- a/source3/python/py_spoolss_forms_conv.c +++ b/source3/python/py_spoolss_forms_conv.c @@ -81,7 +81,7 @@ BOOL py_to_FORM(FORM *form, PyObject *dict) obj = PyDict_GetItemString(dict, "name"); name = PyString_AsString(obj); - init_unistr2(&form->name, name, strlen(name) + 1); + init_unistr2(&form->name, name, UNI_STR_TERMINATE); result = True; diff --git a/source3/registry/reg_printing.c b/source3/registry/reg_printing.c index 50ac81dcbb..e50a5f4d4f 100644 --- a/source3/registry/reg_printing.c +++ b/source3/registry/reg_printing.c @@ -288,34 +288,32 @@ static int print_subpath_values_environments( char *key, REGVAL_CTR *val ) info3 = driver_ctr.info_3; filename = dos_basename( info3->driverpath ); - init_unistr2( &data, filename, strlen(filename)+1 ); + init_unistr2( &data, filename, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Driver", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); filename = dos_basename( info3->configfile ); - init_unistr2( &data, filename, strlen(filename)+1 ); + init_unistr2( &data, filename, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Configuration File", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); filename = dos_basename( info3->datafile ); - init_unistr2( &data, filename, strlen(filename)+1 ); + init_unistr2( &data, filename, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Data File", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); filename = dos_basename( info3->helpfile ); - init_unistr2( &data, filename, strlen(filename)+1 ); + init_unistr2( &data, filename, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Help File", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); - init_unistr2( &data, info3->defaultdatatype, strlen(info3->defaultdatatype)+1 ); + init_unistr2( &data, info3->defaultdatatype, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Data Type", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); regval_ctr_addvalue( val, "Version", REG_DWORD, (char*)&info3->cversion, sizeof(info3->cversion) ); - if ( info3->dependentfiles ) - { + if ( info3->dependentfiles ) { /* place the list of dependent files in a single character buffer, separating each file name by a NULL */ - for ( i=0; strcmp(info3->dependentfiles[i], ""); i++ ) - { + for ( i=0; strcmp(info3->dependentfiles[i], ""); i++ ) { /* strip the path to only the file's base name */ filename = dos_basename( info3->dependentfiles[i] ); @@ -327,7 +325,7 @@ static int print_subpath_values_environments( char *key, REGVAL_CTR *val ) break; buffer = buffer2; - init_unistr2( &data, filename, length+1 ); + init_unistr2( &data, filename, UNI_STR_TERMINATE); memcpy( buffer+buffer_size, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); buffer_size += (length + 1)*sizeof(uint16); @@ -339,8 +337,7 @@ static int print_subpath_values_environments( char *key, REGVAL_CTR *val ) if ( !buffer2 ) { SAFE_FREE( buffer ); buffer_size = 0; - } - else { + } else { buffer = buffer2; buffer[buffer_size++] = '\0'; buffer[buffer_size++] = '\0'; @@ -573,25 +570,25 @@ static int print_subpath_values_printers( char *key, REGVAL_CTR *val ) regval_ctr_addvalue( val, "cjobs", REG_DWORD, (char*)&info2->cjobs, sizeof(info2->cjobs) ); regval_ctr_addvalue( val, "AveragePPM", REG_DWORD, (char*)&info2->averageppm, sizeof(info2->averageppm) ); - init_unistr2( &data, info2->printername, strlen(info2->printername)+1 ); + init_unistr2( &data, info2->printername, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Name", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); - init_unistr2( &data, info2->location, strlen(info2->location)+1 ); + init_unistr2( &data, info2->location, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Location", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); - init_unistr2( &data, info2->comment, strlen(info2->comment)+1 ); + init_unistr2( &data, info2->comment, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Comment", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); - init_unistr2( &data, info2->parameters, strlen(info2->parameters)+1 ); + init_unistr2( &data, info2->parameters, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Parameters", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); - init_unistr2( &data, info2->portname, strlen(info2->portname)+1 ); + init_unistr2( &data, info2->portname, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Port", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); - init_unistr2( &data, info2->servername, strlen(info2->servername)+1 ); + init_unistr2( &data, info2->servername, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Server", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); - init_unistr2( &data, info2->sharename, strlen(info2->sharename)+1 ); + init_unistr2( &data, info2->sharename, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Share", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); - init_unistr2( &data, info2->drivername, strlen(info2->drivername)+1 ); + init_unistr2( &data, info2->drivername, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Driver", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); - init_unistr2( &data, info2->sepfile, strlen(info2->sepfile)+1 ); + init_unistr2( &data, info2->sepfile, UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Separator File", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); - init_unistr2( &data, "winprint", strlen("winprint")+1 ); + init_unistr2( &data, "winprint", UNI_STR_TERMINATE); regval_ctr_addvalue( val, "Print Processor", REG_SZ, (char*)data.buffer, data.uni_str_len*sizeof(uint16) ); diff --git a/source3/rpc_client/cli_srvsvc.c b/source3/rpc_client/cli_srvsvc.c index 27349b7295..555703cf4d 100644 --- a/source3/rpc_client/cli_srvsvc.c +++ b/source3/rpc_client/cli_srvsvc.c @@ -138,11 +138,11 @@ WERROR cli_srvsvc_net_share_enum(struct cli_state *cli, TALLOC_CTX *mem_ctx, s = unistr2_tdup(mem_ctx, &r.ctr.share.info1[i].info_1_str.uni_netname); if (s) - init_unistr2(&info1->info_1_str.uni_netname, s, strlen(s) + 1); + init_unistr2(&info1->info_1_str.uni_netname, s, UNI_STR_TERMINATE); s = unistr2_tdup(mem_ctx, &r.ctr.share.info1[i].info_1_str.uni_remark); if (s) - init_unistr2(&info1->info_1_str.uni_remark, s, strlen(s) + 1); + init_unistr2(&info1->info_1_str.uni_remark, s, UNI_STR_TERMINATE); } @@ -166,19 +166,19 @@ WERROR cli_srvsvc_net_share_enum(struct cli_state *cli, TALLOC_CTX *mem_ctx, s = unistr2_tdup(mem_ctx, &r.ctr.share.info2[i].info_2_str.uni_netname); if (s) - init_unistr2(&info2->info_2_str.uni_netname, s, strlen(s) + 1); + init_unistr2(&info2->info_2_str.uni_netname, s, UNI_STR_TERMINATE); s = unistr2_tdup(mem_ctx, &r.ctr.share.info2[i].info_2_str.uni_remark); if (s) - init_unistr2(&info2->info_2_str.uni_remark, s, strlen(s) + 1); + init_unistr2(&info2->info_2_str.uni_remark, s, UNI_STR_TERMINATE); s = unistr2_tdup(mem_ctx, &r.ctr.share.info2[i].info_2_str.uni_path); if (s) - init_unistr2(&info2->info_2_str.uni_path, s, strlen(s) + 1); + init_unistr2(&info2->info_2_str.uni_path, s, UNI_STR_TERMINATE); s = unistr2_tdup(mem_ctx, &r.ctr.share.info2[i].info_2_str.uni_passwd); if (s) - init_unistr2(&info2->info_2_str.uni_passwd, s, strlen(s) + 1); + init_unistr2(&info2->info_2_str.uni_passwd, s, UNI_STR_TERMINATE); } break; } @@ -385,11 +385,11 @@ WERROR cli_srvsvc_net_file_enum(struct cli_state *cli, TALLOC_CTX *mem_ctx, s = unistr2_tdup(mem_ctx, &r.ctr.file.info3[i].info_3_str.uni_path_name); if (s) - init_unistr2(&info3->info_3_str.uni_path_name, s, strlen(s) + 1); + init_unistr2(&info3->info_3_str.uni_path_name, s, UNI_STR_TERMINATE); s = unistr2_tdup(mem_ctx, &r.ctr.file.info3[i].info_3_str.uni_user_name); if (s) - init_unistr2(&info3->info_3_str.uni_user_name, s, strlen(s) + 1); + init_unistr2(&info3->info_3_str.uni_user_name, s, UNI_STR_TERMINATE); } diff --git a/source3/rpc_parse/parse_dfs.c b/source3/rpc_parse/parse_dfs.c index 6f13500359..0d0ce557b2 100644 --- a/source3/rpc_parse/parse_dfs.c +++ b/source3/rpc_parse/parse_dfs.c @@ -80,9 +80,9 @@ BOOL init_dfs_q_dfs_remove(DFS_Q_DFS_REMOVE *q_d, const char *entrypath, const char *servername, const char *sharename) { DEBUG(5,("init_dfs_q_dfs_remove\n")); - init_unistr2(&q_d->DfsEntryPath, entrypath, strlen(entrypath)+1); - init_unistr2(&q_d->ServerName, servername, strlen(servername)+1); - init_unistr2(&q_d->ShareName, sharename, strlen(sharename)+1); + init_unistr2(&q_d->DfsEntryPath, entrypath, UNI_STR_TERMINATE); + init_unistr2(&q_d->ServerName, servername, UNI_STR_TERMINATE); + init_unistr2(&q_d->ShareName, sharename, UNI_STR_TERMINATE); q_d->ptr_ServerName = q_d->ptr_ShareName = 1; return True; } @@ -155,11 +155,11 @@ BOOL init_dfs_q_dfs_add(DFS_Q_DFS_ADD *q_d, const char *entrypath, { DEBUG(5,("init_dfs_q_dfs_add\n")); q_d->ptr_DfsEntryPath = q_d->ptr_ServerName = q_d->ptr_ShareName = 1; - init_unistr2(&q_d->DfsEntryPath, entrypath, strlen(entrypath)+1); - init_unistr2(&q_d->ServerName, servername, strlen(servername)+1); - init_unistr2(&q_d->ShareName, sharename, strlen(sharename)+1); + init_unistr2(&q_d->DfsEntryPath, entrypath, UNI_STR_TERMINATE); + init_unistr2(&q_d->ServerName, servername, UNI_STR_TERMINATE); + init_unistr2(&q_d->ShareName, sharename, UNI_STR_TERMINATE); if(comment != NULL) { - init_unistr2(&q_d->Comment, comment, strlen(comment)+1); + init_unistr2(&q_d->Comment, comment,UNI_STR_TERMINATE); q_d->ptr_Comment = 1; } else { q_d->ptr_Comment = 0; @@ -237,9 +237,9 @@ BOOL init_dfs_q_dfs_get_info(DFS_Q_DFS_GET_INFO *q_d, const char *entrypath, uint32 info_level) { DEBUG(5,("init_dfs_q2_get_info\n")); - init_unistr2(&q_d->uni_path, entrypath, strlen(entrypath)+1); - init_unistr2(&q_d->uni_server, servername, strlen(servername)+1); - init_unistr2(&q_d->uni_share, sharename, strlen(sharename)+1); + init_unistr2(&q_d->uni_path, entrypath, UNI_STR_TERMINATE); + init_unistr2(&q_d->uni_server, servername, UNI_STR_TERMINATE); + init_unistr2(&q_d->uni_share, sharename, UNI_STR_TERMINATE); q_d->level = info_level; q_d->ptr_server = q_d->ptr_share = 1; return True; diff --git a/source3/rpc_parse/parse_ds.c b/source3/rpc_parse/parse_ds.c index f954806036..26dcdb34b8 100644 --- a/source3/rpc_parse/parse_ds.c +++ b/source3/rpc_parse/parse_ds.c @@ -138,8 +138,6 @@ BOOL ds_io_r_getprimdominfo( const char *desc, prs_struct *ps, int depth, DS_R_G BOOL init_q_ds_enum_domain_trusts( DS_Q_ENUM_DOM_TRUSTS *q, const char *server, uint32 flags ) { - int len; - q->flags = flags; if ( server && *server ) @@ -147,9 +145,7 @@ BOOL init_q_ds_enum_domain_trusts( DS_Q_ENUM_DOM_TRUSTS *q, const char *server, else q->server_ptr = 0; - len = q->server_ptr ? strlen(server)+1 : 0; - - init_unistr2( &q->server, server, len ); + init_unistr2( &q->server, server, UNI_STR_TERMINATE); return True; } diff --git a/source3/rpc_parse/parse_lsa.c b/source3/rpc_parse/parse_lsa.c index 07b0da7e9c..3a5b232dc3 100644 --- a/source3/rpc_parse/parse_lsa.c +++ b/source3/rpc_parse/parse_lsa.c @@ -36,14 +36,9 @@ static BOOL lsa_io_trans_names(const char *desc, LSA_TRANS_NAME_ENUM *trn, prs_s void init_lsa_trans_name(LSA_TRANS_NAME *trn, UNISTR2 *uni_name, uint16 sid_name_use, const char *name, uint32 idx) { - int len_name = strlen(name); - - if(len_name == 0) - len_name = 1; - trn->sid_name_use = sid_name_use; - init_uni_hdr(&trn->hdr_name, len_name); - init_unistr2(uni_name, name, len_name); + init_unistr2(uni_name, name, UNI_FLAGS_NONE); + init_uni_hdr(&trn->hdr_name, uni_name); trn->domain_idx = idx; } @@ -346,8 +341,7 @@ void init_q_open_pol2(LSA_Q_OPEN_POL2 *r_q, const char *server_name, r_q->des_access = desired_access; - init_unistr2(&r_q->uni_server_name, server_name, - strlen(server_name) + 1); + init_unistr2(&r_q->uni_server_name, server_name, UNI_STR_TERMINATE); init_lsa_obj_attr(&r_q->attr, attributes, qos); } @@ -566,10 +560,10 @@ void init_r_enum_trust_dom(TALLOC_CTX *ctx, LSA_R_ENUM_TRUST_DOM *r_e, uint32 en /* don't know what actually is this for */ r_e->ptr_enum_domains = 1; - init_uni_hdr2(&r_e->hdr_domain_name[i], strlen_w((td[i])->name)); init_dom_sid2(&r_e->domain_sid[i], &(td[i])->sid); init_unistr2_w(ctx, &r_e->uni_domain_name[i], (td[i])->name); + init_uni_hdr2(&r_e->hdr_domain_name[i], &r_e->uni_domain_name[i]); }; } @@ -1087,11 +1081,8 @@ void init_q_lookup_names(TALLOC_CTX *mem_ctx, LSA_Q_LOOKUP_NAMES *q_l, } for (i = 0; i < num_names; i++) { - int len; - len = strlen(names[i]); - - init_uni_hdr(&q_l->hdr_name[i], len); - init_unistr2(&q_l->uni_name[i], names[i], len); + init_unistr2(&q_l->uni_name[i], names[i], UNI_FLAGS_NONE); + init_uni_hdr(&q_l->hdr_name[i], &q_l->uni_name[i]); } } @@ -1436,15 +1427,10 @@ BOOL lsa_io_r_enum_privs(const char *desc, LSA_R_ENUM_PRIVS *r_q, prs_struct *ps void init_lsa_priv_get_dispname(LSA_Q_PRIV_GET_DISPNAME *trn, POLICY_HND *hnd, const char *name, uint16 lang_id, uint16 lang_id_sys) { - int len_name = strlen(name); - - if(len_name == 0) - len_name = 1; - memcpy(&trn->pol, hnd, sizeof(trn->pol)); - init_uni_hdr(&trn->hdr_name, len_name); - init_unistr2(&trn->name, name, len_name); + init_unistr2(&trn->name, name, UNI_FLAGS_NONE); + init_uni_hdr(&trn->hdr_name, &trn->name); trn->lang_id = lang_id; trn->lang_id_sys = lang_id_sys; } @@ -1954,14 +1940,9 @@ BOOL lsa_io_r_setsystemaccount(const char *desc, LSA_R_SETSYSTEMACCOUNT *r_c, p void init_lsa_q_lookupprivvalue(LSA_Q_LOOKUPPRIVVALUE *trn, POLICY_HND *hnd, const char *name) { - int len_name = strlen(name); memcpy(&trn->pol, hnd, sizeof(trn->pol)); - - if(len_name == 0) - len_name = 1; - - init_uni_hdr(&trn->hdr_right, len_name); - init_unistr2(&trn->uni2_right, name, len_name); + init_unistr2(&trn->uni2_right, name, UNI_FLAGS_NONE); + init_uni_hdr(&trn->hdr_right, &trn->uni2_right); } /******************************************************************* diff --git a/source3/rpc_parse/parse_misc.c b/source3/rpc_parse/parse_misc.c index 17a96fff80..e182535532 100644 --- a/source3/rpc_parse/parse_misc.c +++ b/source3/rpc_parse/parse_misc.c @@ -361,11 +361,11 @@ BOOL smb_io_strhdr(const char *desc, STRHDR *hdr, prs_struct *ps, int depth) Inits a UNIHDR structure. ********************************************************************/ -void init_uni_hdr(UNIHDR *hdr, int len) +void init_uni_hdr(UNIHDR *hdr, UNISTR2 *str2) { - hdr->uni_str_len = 2 * len; - hdr->uni_max_len = 2 * len; - hdr->buffer = len != 0 ? 1 : 0; + hdr->uni_str_len = 2 * (str2->uni_str_len); + hdr->uni_max_len = 2 * (str2->uni_max_len); + hdr->buffer = (str2->uni_str_len != 0) ? 1 : 0; } /******************************************************************* @@ -482,10 +482,10 @@ BOOL smb_io_hdrbuf(const char *desc, BUFHDR *hdr, prs_struct *ps, int depth) creates a UNIHDR2 structure. ********************************************************************/ -void init_uni_hdr2(UNIHDR2 *hdr, int len) +void init_uni_hdr2(UNIHDR2 *hdr, UNISTR2 *str2) { - init_uni_hdr(&hdr->unihdr, len); - hdr->buffer = (len > 0) ? 1 : 0; + init_uni_hdr(&hdr->unihdr, str2); + hdr->buffer = (str2->uni_str_len > 0) ? 1 : 0; } /******************************************************************* @@ -703,7 +703,7 @@ void init_buffer2(BUFFER2 *str, const uint8 *buf, size_t len) /* max buffer size (allocated size) */ str->buf_max_len = len; - str->undoc = 0; + str->offset = 0; str->buf_len = buf != NULL ? len : 0; if (buf != NULL) { @@ -737,7 +737,7 @@ BOOL smb_io_buffer2(const char *desc, BUFFER2 *buf2, uint32 buffer, prs_struct * if(!prs_uint32("uni_max_len", ps, depth, &buf2->buf_max_len)) return False; - if(!prs_uint32("undoc ", ps, depth, &buf2->undoc)) + if(!prs_uint32("offset ", ps, depth, &buf2->offset)) return False; if(!prs_uint32("buf_len ", ps, depth, &buf2->buf_len)) return False; @@ -765,14 +765,11 @@ creates a UNISTR2 structure: sets up the buffer, too void init_buf_unistr2(UNISTR2 *str, uint32 *ptr, const char *buf) { if (buf != NULL) { - *ptr = 1; - init_unistr2(str, buf, strlen(buf)+1); - + init_unistr2(str, buf, UNI_STR_TERMINATE); } else { - *ptr = 0; - init_unistr2(str, "", 0); + init_unistr2(str, NULL, UNI_FLAGS_NONE); } } @@ -783,10 +780,8 @@ void init_buf_unistr2(UNISTR2 *str, uint32 *ptr, const char *buf) void copy_unistr2(UNISTR2 *str, const UNISTR2 *from) { - - /* set up string lengths. add one if string is not null-terminated */ str->uni_max_len = from->uni_max_len; - str->undoc = from->undoc; + str->offset = from->offset; str->uni_str_len = from->uni_str_len; if (from->buffer == NULL) @@ -803,8 +798,7 @@ void copy_unistr2(UNISTR2 *str, const UNISTR2 *from) len *= sizeof(uint16); str->buffer = (uint16 *)talloc_zero(get_talloc_ctx(), len); - if ((str->buffer == NULL) && (len > 0 )) - { + if ((str->buffer == NULL) && (len > 0 )) { smb_panic("copy_unistr2: talloc fail\n"); return; } @@ -824,7 +818,7 @@ void init_string2(STRING2 *str, const char *buf, int max_len, int str_len) /* set up string lengths. */ str->str_max_len = max_len; - str->undoc = 0; + str->offset = 0; str->str_str_len = str_len; /* store the string */ @@ -835,7 +829,7 @@ void init_string2(STRING2 *str, const char *buf, int max_len, int str_len) if (str->buffer == NULL) smb_panic("init_string2: malloc fail\n"); memcpy(str->buffer, buf, str_len); - } + } } /******************************************************************* @@ -860,7 +854,7 @@ BOOL smb_io_string2(const char *desc, STRING2 *str2, uint32 buffer, prs_struct * if(!prs_uint32("str_max_len", ps, depth, &str2->str_max_len)) return False; - if(!prs_uint32("undoc ", ps, depth, &str2->undoc)) + if(!prs_uint32("offset ", ps, depth, &str2->offset)) return False; if(!prs_uint32("str_str_len", ps, depth, &str2->str_str_len)) return False; @@ -885,34 +879,43 @@ BOOL smb_io_string2(const char *desc, STRING2 *str2, uint32 buffer, prs_struct * Inits a UNISTR2 structure. ********************************************************************/ -void init_unistr2(UNISTR2 *str, const char *buf, size_t len) +void init_unistr2(UNISTR2 *str, const char *buf, enum unistr2_term_codes flags) { - ZERO_STRUCTP(str); + size_t len = 0; + uint32 num_chars = 0; - /* set up string lengths. */ - str->uni_max_len = (uint32)len; - str->undoc = 0; - str->uni_str_len = (uint32)len; + if (buf) { + /* We always null terminate the copy. */ + len = strlen(buf) + 1; + } if (len < MAX_UNISTRLEN) len = MAX_UNISTRLEN; len *= sizeof(uint16); str->buffer = (uint16 *)talloc_zero(get_talloc_ctx(), len); - if ((str->buffer == NULL) && (len > 0)) - { + if ((str->buffer == NULL) && (len > 0)) { smb_panic("init_unistr2: malloc fail\n"); return; } /* - * don't move this test above ! The UNISTR2 must be initialized !!! + * The UNISTR2 must be initialized !!! * jfm, 7/7/2001. */ - if (buf==NULL) - return; + if (buf) { + rpcstr_push((char *)str->buffer, buf, len, STR_TERMINATE); + num_chars = strlen_w(str->buffer); + if (flags == STR_TERMINATE || flags == UNI_MAXLEN_TERMINATE) { + num_chars++; + } + } - rpcstr_push((char *)str->buffer, buf, len, STR_TERMINATE); + str->uni_max_len = num_chars; + str->offset = 0; + str->uni_str_len = num_chars; + if (num_chars && (flags == UNI_MAXLEN_TERMINATE)) + str->uni_max_len++; } /** @@ -932,7 +935,7 @@ void init_unistr2_w(TALLOC_CTX *ctx, UNISTR2 *str, const smb_ucs2_t *buf) /* set up string lengths. */ str->uni_max_len = len; - str->undoc = 0; + str->offset = 0; str->uni_str_len = len; if (max_len < MAX_UNISTRLEN) @@ -941,8 +944,7 @@ void init_unistr2_w(TALLOC_CTX *ctx, UNISTR2 *str, const smb_ucs2_t *buf) alloc_len = (max_len + 1) * sizeof(uint16); str->buffer = (uint16 *)talloc_zero(ctx, alloc_len); - if ((str->buffer == NULL) && (alloc_len > 0)) - { + if ((str->buffer == NULL) && (alloc_len > 0)) { smb_panic("init_unistr2_w: malloc fail\n"); return; } @@ -963,9 +965,9 @@ void init_unistr2_w(TALLOC_CTX *ctx, UNISTR2 *str, const smb_ucs2_t *buf) /******************************************************************* Inits a UNISTR2 structure from a UNISTR ********************************************************************/ -void init_unistr2_from_unistr (UNISTR2 *to, const UNISTR *from) -{ +void init_unistr2_from_unistr(UNISTR2 *to, const UNISTR *from) +{ uint32 i; /* the destination UNISTR2 should never be NULL. @@ -987,7 +989,7 @@ void init_unistr2_from_unistr (UNISTR2 *to, const UNISTR *from) /* set up string lengths; uni_max_len is set to i+1 because we need to account for the final NULL termination */ to->uni_max_len = i; - to->undoc = 0; + to->offset = 0; to->uni_str_len = i; /* allocate the space and copy the string buffer */ @@ -995,11 +997,9 @@ void init_unistr2_from_unistr (UNISTR2 *to, const UNISTR *from) if (to->buffer == NULL) smb_panic("init_unistr2_from_unistr: malloc fail\n"); memcpy(to->buffer, from->buffer, to->uni_max_len*sizeof(uint16)); - return; } - /******************************************************************* Reads or writes a UNISTR2 structure. XXXX NOTE: UNISTR2 structures need NOT be null-terminated. @@ -1022,7 +1022,7 @@ BOOL smb_io_unistr2(const char *desc, UNISTR2 *uni2, uint32 buffer, prs_struct * if(!prs_uint32("uni_max_len", ps, depth, &uni2->uni_max_len)) return False; - if(!prs_uint32("undoc ", ps, depth, &uni2->undoc)) + if(!prs_uint32("offset ", ps, depth, &uni2->offset)) return False; if(!prs_uint32("uni_str_len", ps, depth, &uni2->uni_str_len)) return False; @@ -1064,7 +1064,7 @@ BOOL init_unistr2_array(UNISTR2_ARRAY *array, } for (i=0;istrings[i].string, strings[i], strlen(strings[i])); + init_unistr2(&array->strings[i].string, strings[i], UNI_FLAGS_NONE); array->strings[i].size = array->strings[i].string.uni_max_len*2; array->strings[i].length = array->strings[i].size; array->strings[i].ref_id = 1; @@ -1223,14 +1223,14 @@ static void init_clnt_srv(DOM_CLNT_SRV *logcln, const char *logon_srv, const cha if (logon_srv != NULL) { logcln->undoc_buffer = 1; - init_unistr2(&logcln->uni_logon_srv, logon_srv, strlen(logon_srv)+1); + init_unistr2(&logcln->uni_logon_srv, logon_srv, UNI_STR_TERMINATE); } else { logcln->undoc_buffer = 0; } if (comp_name != NULL) { logcln->undoc_buffer2 = 1; - init_unistr2(&logcln->uni_comp_name, comp_name, strlen(comp_name)+1); + init_unistr2(&logcln->uni_comp_name, comp_name, UNI_STR_TERMINATE); } else { logcln->undoc_buffer2 = 0; } @@ -1284,12 +1284,12 @@ void init_log_info(DOM_LOG_INFO *loginfo, const char *logon_srv, const char *acc loginfo->undoc_buffer = 1; - init_unistr2(&loginfo->uni_logon_srv, logon_srv, strlen(logon_srv)+1); - init_unistr2(&loginfo->uni_acct_name, acct_name, strlen(acct_name)+1); + init_unistr2(&loginfo->uni_logon_srv, logon_srv, UNI_STR_TERMINATE); + init_unistr2(&loginfo->uni_acct_name, acct_name, UNI_STR_TERMINATE); loginfo->sec_chan = sec_chan; - init_unistr2(&loginfo->uni_comp_name, comp_name, strlen(comp_name)+1); + init_unistr2(&loginfo->uni_comp_name, comp_name, UNI_STR_TERMINATE); } /******************************************************************* diff --git a/source3/rpc_parse/parse_net.c b/source3/rpc_parse/parse_net.c index dd319df5a0..3b096e088a 100644 --- a/source3/rpc_parse/parse_net.c +++ b/source3/rpc_parse/parse_net.c @@ -136,16 +136,15 @@ static BOOL net_io_netinfo_1(const char *desc, NETLOGON_INFO_1 *info, prs_struct static void init_netinfo_2(NETLOGON_INFO_2 *info, uint32 flags, uint32 pdc_status, uint32 tc_status, const char *trusted_dc_name) { - int len_dc_name = strlen(trusted_dc_name); info->flags = flags; info->pdc_status = pdc_status; info->ptr_trusted_dc_name = 1; info->tc_status = tc_status; if (trusted_dc_name != NULL) - init_unistr2(&info->uni_trusted_dc_name, trusted_dc_name, len_dc_name+1); + init_unistr2(&info->uni_trusted_dc_name, trusted_dc_name, UNI_STR_TERMINATE); else - init_unistr2(&info->uni_trusted_dc_name, "", 1); + init_unistr2(&info->uni_trusted_dc_name, "", UNI_STR_TERMINATE); } /******************************************************************* @@ -230,7 +229,7 @@ void init_net_q_logon_ctrl2(NET_Q_LOGON_CTRL2 *q_l, const char *srv_name, q_l->query_level = query_level; q_l->switch_value = 0x01; - init_unistr2(&q_l->uni_server_name, srv_name, strlen(srv_name) + 1); + init_unistr2(&q_l->uni_server_name, srv_name, UNI_STR_TERMINATE); } /******************************************************************* @@ -360,7 +359,7 @@ void init_net_q_logon_ctrl(NET_Q_LOGON_CTRL *q_l, const char *srv_name, q_l->function_code = 0x01; /* ??? */ q_l->query_level = query_level; - init_unistr2(&q_l->uni_server_name, srv_name, strlen(srv_name) + 1); + init_unistr2(&q_l->uni_server_name, srv_name, UNI_STR_TERMINATE); } /******************************************************************* @@ -447,9 +446,9 @@ void init_r_trust_dom(NET_R_TRUST_DOM_LIST *r_t, fstring domain_name; fstrcpy(domain_name, dom_name); strupper_m(domain_name); - init_unistr2(&r_t->uni_trust_dom_name[i], domain_name, strlen(domain_name)+1); + init_unistr2(&r_t->uni_trust_dom_name[i], domain_name, UNI_STR_TERMINATE); /* the use of UNISTR2 here is non-standard. */ - r_t->uni_trust_dom_name[i].undoc = 0x1; + r_t->uni_trust_dom_name[i].offset = 0x1; } r_t->status = NT_STATUS_OK; @@ -539,8 +538,8 @@ void init_q_req_chal(NET_Q_REQ_CHAL *q_c, q_c->undoc_buffer = 1; /* don't know what this buffer is */ - init_unistr2(&q_c->uni_logon_srv, logon_srv , strlen(logon_srv )+1); - init_unistr2(&q_c->uni_logon_clnt, logon_clnt, strlen(logon_clnt)+1); + init_unistr2(&q_c->uni_logon_srv, logon_srv , UNI_STR_TERMINATE); + init_unistr2(&q_c->uni_logon_clnt, logon_clnt, UNI_STR_TERMINATE); memcpy(q_c->clnt_chal.data, clnt_chal->data, sizeof(clnt_chal->data)); @@ -910,10 +909,6 @@ void init_id_info1(NET_ID_INFO_1 *id, const char *domain_name, const char *sess_key, unsigned char lm_cypher[16], unsigned char nt_cypher[16]) { - int len_domain_name = strlen(domain_name); - int len_user_name = strlen(user_name ); - int len_wksta_name = strlen(wksta_name ); - unsigned char lm_owf[16]; unsigned char nt_owf[16]; @@ -921,13 +916,9 @@ void init_id_info1(NET_ID_INFO_1 *id, const char *domain_name, id->ptr_id_info1 = 1; - init_uni_hdr(&id->hdr_domain_name, len_domain_name); - id->param_ctrl = param_ctrl; init_logon_id(&id->logon_id, log_id_low, log_id_high); - init_uni_hdr(&id->hdr_user_name, len_user_name); - init_uni_hdr(&id->hdr_wksta_name, len_wksta_name); if (lm_cypher && nt_cypher) { unsigned char key[16]; @@ -962,9 +953,12 @@ void init_id_info1(NET_ID_INFO_1 *id, const char *domain_name, init_owf_info(&id->lm_owf, lm_cypher); init_owf_info(&id->nt_owf, nt_cypher); - init_unistr2(&id->uni_domain_name, domain_name, len_domain_name); - init_unistr2(&id->uni_user_name, user_name, len_user_name); - init_unistr2(&id->uni_wksta_name, wksta_name, len_wksta_name); + init_unistr2(&id->uni_domain_name, domain_name, UNI_FLAGS_NONE); + init_uni_hdr(&id->hdr_domain_name, &id->uni_domain_name); + init_unistr2(&id->uni_user_name, user_name, UNI_FLAGS_NONE); + init_uni_hdr(&id->hdr_user_name, &id->uni_user_name); + init_unistr2(&id->uni_wksta_name, wksta_name, UNI_FLAGS_NONE); + init_uni_hdr(&id->hdr_wksta_name, &id->uni_wksta_name); } /******************************************************************* @@ -1041,9 +1035,6 @@ void init_id_info2(NET_ID_INFO_2 * id, const char *domain_name, const uchar * lm_chal_resp, size_t lm_chal_resp_len, const uchar * nt_chal_resp, size_t nt_chal_resp_len) { - size_t len_domain_name = strlen(domain_name); - size_t len_user_name = strlen(user_name ); - size_t len_wksta_name = strlen(wksta_name ); unsigned char lm_owf[24]; unsigned char nt_owf[128]; @@ -1051,14 +1042,10 @@ void init_id_info2(NET_ID_INFO_2 * id, const char *domain_name, id->ptr_id_info2 = 1; - init_uni_hdr(&id->hdr_domain_name, len_domain_name); id->param_ctrl = param_ctrl; init_logon_id(&id->logon_id, log_id_low, log_id_high); - init_uni_hdr(&id->hdr_user_name, len_user_name); - init_uni_hdr(&id->hdr_wksta_name, len_wksta_name); - if (nt_chal_resp) { /* oops. can only send what-ever-it-is direct */ memcpy(nt_owf, nt_chal_resp, MIN(sizeof(nt_owf), nt_chal_resp_len)); @@ -1074,9 +1061,12 @@ void init_id_info2(NET_ID_INFO_2 * id, const char *domain_name, init_str_hdr(&id->hdr_nt_chal_resp, nt_chal_resp_len, nt_chal_resp_len, (nt_chal_resp != NULL) ? 1 : 0); init_str_hdr(&id->hdr_lm_chal_resp, lm_chal_resp_len, lm_chal_resp_len, (lm_chal_resp != NULL) ? 1 : 0); - init_unistr2(&id->uni_domain_name, domain_name, len_domain_name); - init_unistr2(&id->uni_user_name, user_name, len_user_name); - init_unistr2(&id->uni_wksta_name, wksta_name, len_wksta_name); + init_unistr2(&id->uni_domain_name, domain_name, UNI_FLAGS_NONE); + init_uni_hdr(&id->hdr_domain_name, &id->uni_domain_name); + init_unistr2(&id->uni_user_name, user_name, UNI_FLAGS_NONE); + init_uni_hdr(&id->hdr_user_name, &id->uni_user_name); + init_unistr2(&id->uni_wksta_name, wksta_name, UNI_FLAGS_NONE); + init_uni_hdr(&id->hdr_wksta_name, &id->uni_wksta_name); init_string2(&id->nt_chal_resp, (const char *)nt_chal_resp, nt_chal_resp_len, nt_chal_resp_len); init_string2(&id->lm_chal_resp, (const char *)lm_chal_resp, lm_chal_resp_len, lm_chal_resp_len); @@ -1288,26 +1278,10 @@ void init_net_user_info3(TALLOC_CTX *ctx, NET_USER_INFO_3 *usr, pass_last_set_time, pass_can_change_time, pass_must_change_time; - int len_user_name, len_full_name, len_home_dir, - len_dir_drive, len_logon_script, len_profile_path; - - int len_logon_srv = strlen(logon_srv); - int len_logon_dom = strlen(logon_dom); - - len_user_name = strlen(user_name ); - len_full_name = strlen(full_name ); - len_home_dir = strlen(home_dir ); - len_dir_drive = strlen(dir_drive ); - len_logon_script = strlen(logon_script); - len_profile_path = strlen(profile_path); - - ZERO_STRUCTP(usr); usr->ptr_user_info = 1; /* yes, we're bothering to put USER_INFO data here */ - - /* Create NTTIME structs */ unix_to_nt_time (&logon_time, unix_logon_time); unix_to_nt_time (&logoff_time, unix_logoff_time); @@ -1323,13 +1297,6 @@ void init_net_user_info3(TALLOC_CTX *ctx, NET_USER_INFO_3 *usr, usr->pass_can_change_time = pass_can_change_time; usr->pass_must_change_time = pass_must_change_time; - init_uni_hdr(&usr->hdr_user_name, len_user_name); - init_uni_hdr(&usr->hdr_full_name, len_full_name); - init_uni_hdr(&usr->hdr_logon_script, len_logon_script); - init_uni_hdr(&usr->hdr_profile_path, len_profile_path); - init_uni_hdr(&usr->hdr_home_dir, len_home_dir); - init_uni_hdr(&usr->hdr_dir_drive, len_dir_drive); - usr->logon_count = logon_count; usr->bad_pw_count = bad_pw_count; @@ -1345,9 +1312,6 @@ void init_net_user_info3(TALLOC_CTX *ctx, NET_USER_INFO_3 *usr, else memset((char *)usr->user_sess_key, '\0', sizeof(usr->user_sess_key)); - init_uni_hdr(&usr->hdr_logon_srv, len_logon_srv); - init_uni_hdr(&usr->hdr_logon_dom, len_logon_dom); - usr->buffer_dom_id = dom_sid ? 1 : 0; /* yes, we're bothering to put a domain SID in */ memset((char *)usr->padding, '\0', sizeof(usr->padding)); @@ -1357,12 +1321,18 @@ void init_net_user_info3(TALLOC_CTX *ctx, NET_USER_INFO_3 *usr, usr->num_other_sids = num_other_sids; usr->buffer_other_sids = (num_other_sids != 0) ? 1 : 0; - init_unistr2(&usr->uni_user_name, user_name, len_user_name); - init_unistr2(&usr->uni_full_name, full_name, len_full_name); - init_unistr2(&usr->uni_logon_script, logon_script, len_logon_script); - init_unistr2(&usr->uni_profile_path, profile_path, len_profile_path); - init_unistr2(&usr->uni_home_dir, home_dir, len_home_dir); - init_unistr2(&usr->uni_dir_drive, dir_drive, len_dir_drive); + init_unistr2(&usr->uni_user_name, user_name, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_user_name, &usr->uni_user_name); + init_unistr2(&usr->uni_full_name, full_name, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_full_name, &usr->uni_full_name); + init_unistr2(&usr->uni_logon_script, logon_script, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_logon_script, &usr->uni_logon_script); + init_unistr2(&usr->uni_profile_path, profile_path, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_profile_path, &usr->uni_profile_path); + init_unistr2(&usr->uni_home_dir, home_dir, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_home_dir, &usr->uni_home_dir); + init_unistr2(&usr->uni_dir_drive, dir_drive, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_dir_drive, &usr->uni_dir_drive); usr->num_groups2 = num_groups; @@ -1373,8 +1343,10 @@ void init_net_user_info3(TALLOC_CTX *ctx, NET_USER_INFO_3 *usr, for (i = 0; i < num_groups; i++) usr->gids[i] = gids[i]; - init_unistr2(&usr->uni_logon_srv, logon_srv, len_logon_srv); - init_unistr2(&usr->uni_logon_dom, logon_dom, len_logon_dom); + init_unistr2(&usr->uni_logon_srv, logon_srv, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_logon_srv, &usr->uni_logon_srv); + init_unistr2(&usr->uni_logon_dom, logon_dom, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_logon_dom, &usr->uni_logon_dom); init_dom_sid2(&usr->dom_sid, dom_sid); /* "other" sids are set up above */ @@ -1670,8 +1642,8 @@ BOOL init_net_q_sam_sync(NET_Q_SAM_SYNC * q_s, const char *srv_name, { DEBUG(5, ("init_q_sam_sync\n")); - init_unistr2(&q_s->uni_srv_name, srv_name, strlen(srv_name) + 1); - init_unistr2(&q_s->uni_cli_name, cli_name, strlen(cli_name) + 1); + init_unistr2(&q_s->uni_srv_name, srv_name, UNI_STR_TERMINATE); + init_unistr2(&q_s->uni_cli_name, cli_name, UNI_STR_TERMINATE); if (cli_creds) memcpy(&q_s->cli_creds, cli_creds, sizeof(q_s->cli_creds)); @@ -2858,8 +2830,8 @@ BOOL init_net_q_sam_deltas(NET_Q_SAM_DELTAS *q_s, const char *srv_name, { DEBUG(5, ("init_net_q_sam_deltas\n")); - init_unistr2(&q_s->uni_srv_name, srv_name, strlen(srv_name) + 1); - init_unistr2(&q_s->uni_cli_name, cli_name, strlen(cli_name) + 1); + init_unistr2(&q_s->uni_srv_name, srv_name, UNI_STR_TERMINATE); + init_unistr2(&q_s->uni_cli_name, cli_name, UNI_STR_TERMINATE); memcpy(&q_s->cli_creds, cli_creds, sizeof(q_s->cli_creds)); memset(&q_s->ret_creds, 0, sizeof(q_s->ret_creds)); diff --git a/source3/rpc_parse/parse_reg.c b/source3/rpc_parse/parse_reg.c index bbf6e6a8e3..69c0dfc754 100644 --- a/source3/rpc_parse/parse_reg.c +++ b/source3/rpc_parse/parse_reg.c @@ -281,18 +281,15 @@ void init_reg_q_create_key(REG_Q_CREATE_KEY *q_c, POLICY_HND *hnd, char *name, char *class, SEC_ACCESS *sam_access, SEC_DESC_BUF *sec_buf) { - int len_name = name != NULL ? strlen(name ) + 1: 0; - int len_class = class != NULL ? strlen(class) + 1: 0; - ZERO_STRUCTP(q_c); memcpy(&q_c->pnt_pol, hnd, sizeof(q_c->pnt_pol)); - init_uni_hdr(&q_c->hdr_name, len_name); - init_unistr2(&q_c->uni_name, name, len_name); + init_unistr2(&q_c->uni_name, name, UNI_STR_TERMINATE); + init_uni_hdr(&q_c->hdr_name, &q_c->uni_name); - init_uni_hdr(&q_c->hdr_class, len_class); - init_unistr2(&q_c->uni_class, class, len_class); + init_unistr2(&q_c->uni_class, class, UNI_STR_TERMINATE); + init_uni_hdr(&q_c->hdr_class, &q_c->uni_class); q_c->reserved = 0x00000000; memcpy(&q_c->sam_access, sam_access, sizeof(q_c->sam_access)); @@ -397,13 +394,12 @@ BOOL reg_io_r_create_key(const char *desc, REG_R_CREATE_KEY *r_r, prs_struct *p void init_reg_q_delete_val(REG_Q_DELETE_VALUE *q_c, POLICY_HND *hnd, char *name) { - int len_name = name != NULL ? strlen(name ) + 1: 0; ZERO_STRUCTP(q_c); memcpy(&q_c->pnt_pol, hnd, sizeof(q_c->pnt_pol)); - init_uni_hdr(&q_c->hdr_name, len_name); - init_unistr2(&q_c->uni_name, name, len_name); + init_unistr2(&q_c->uni_name, name, UNI_STR_TERMINATE); + init_uni_hdr(&q_c->hdr_name, &q_c->uni_name); } /******************************************************************* @@ -463,13 +459,12 @@ BOOL reg_io_r_delete_val(const char *desc, REG_R_DELETE_VALUE *r_r, prs_struct void init_reg_q_delete_key(REG_Q_DELETE_KEY *q_c, POLICY_HND *hnd, char *name) { - int len_name = name != NULL ? strlen(name ) + 1: 0; ZERO_STRUCTP(q_c); memcpy(&q_c->pnt_pol, hnd, sizeof(q_c->pnt_pol)); - init_uni_hdr(&q_c->hdr_name, len_name); - init_unistr2(&q_c->uni_name, name, len_name); + init_unistr2(&q_c->uni_name, name, UNI_STR_TERMINATE); + init_uni_hdr(&q_c->hdr_name, &q_c->uni_name); } /******************************************************************* @@ -525,14 +520,12 @@ BOOL reg_io_r_delete_key(const char *desc, REG_R_DELETE_KEY *r_r, prs_struct *p Inits a structure. ********************************************************************/ -void init_reg_q_query_key(REG_Q_QUERY_KEY *q_o, POLICY_HND *hnd, - uint32 max_class_len) +void init_reg_q_query_key(REG_Q_QUERY_KEY *q_o, POLICY_HND *hnd, UNISTR2 *uni2) { ZERO_STRUCTP(q_o); memcpy(&q_o->pol, hnd, sizeof(q_o->pol)); - init_uni_hdr(&q_o->hdr_class, max_class_len); - q_o->uni_class.uni_max_len = max_class_len; + init_uni_hdr(&q_o->hdr_class, uni2); } /******************************************************************* @@ -1010,15 +1003,13 @@ makes a structure. BOOL init_reg_q_info(REG_Q_INFO *q_i, POLICY_HND *pol, char* val_name) { - int len_type = val_name != NULL ? strlen(val_name) + 1 : 0; - if (q_i == NULL) return False; q_i->pol = *pol; - init_uni_hdr(&(q_i->hdr_type), len_type); - init_unistr2(&(q_i->uni_type), val_name, len_type); + init_unistr2(&q_i->uni_type, val_name, UNI_STR_TERMINATE); + init_uni_hdr(&q_i->hdr_type, &q_i->uni_type); q_i->ptr_reserved = 1; q_i->ptr_buf = 1; @@ -1230,7 +1221,7 @@ makes a structure. ********************************************************************/ void init_reg_q_enum_val(REG_Q_ENUM_VALUE *q_i, POLICY_HND *pol, - uint32 val_idx, uint32 max_val_len, + uint32 val_idx, UNISTR2 *uni2, uint32 max_buf_len) { ZERO_STRUCTP(q_i); @@ -1238,8 +1229,7 @@ void init_reg_q_enum_val(REG_Q_ENUM_VALUE *q_i, POLICY_HND *pol, memcpy(&q_i->pol, pol, sizeof(q_i->pol)); q_i->val_index = val_idx; - init_uni_hdr(&q_i->hdr_name, max_val_len); - q_i->uni_name.uni_max_len = max_val_len; + init_uni_hdr(&q_i->hdr_name, uni2); q_i->ptr_type = 1; q_i->type = 0x0; @@ -1270,8 +1260,8 @@ void init_reg_r_enum_val(REG_R_ENUM_VALUE *r_u, REGISTRY_VALUE *val ) DEBUG(10,("init_reg_r_enum_val: Valuename => [%s]\n", val->valuename)); - init_uni_hdr( &r_u->hdr_name, strlen(val->valuename)+1 ); - init_unistr2( &r_u->uni_name, val->valuename, strlen(val->valuename)+1 ); + init_unistr2( &r_u->uni_name, val->valuename, UNI_STR_TERMINATE); + init_uni_hdr( &r_u->hdr_name, &r_u->uni_name); /* type */ @@ -1418,14 +1408,12 @@ void init_reg_q_create_val(REG_Q_CREATE_VALUE *q_i, POLICY_HND *pol, char *val_name, uint32 type, BUFFER3 *val) { - int val_len = strlen(val_name) + 1; - ZERO_STRUCTP(q_i); memcpy(&q_i->pol, pol, sizeof(q_i->pol)); - init_uni_hdr(&q_i->hdr_name, val_len); - init_unistr2(&q_i->uni_name, val_name, val_len); + init_unistr2(&q_i->uni_name, val_name, UNI_STR_TERMINATE); + init_uni_hdr(&q_i->hdr_name, &q_i->uni_name); q_i->type = type; q_i->buf_value = val; @@ -1650,12 +1638,10 @@ makes a structure. void init_reg_q_open_entry(REG_Q_OPEN_ENTRY *r_q, POLICY_HND *pol, char *key_name, uint32 access_desired) { - int len_name = strlen(key_name)+1; - memcpy(&r_q->pol, pol, sizeof(r_q->pol)); - init_uni_hdr(&r_q->hdr_name, len_name); - init_unistr2(&r_q->uni_name, key_name, len_name); + init_unistr2(&r_q->uni_name, key_name, UNI_STR_TERMINATE); + init_uni_hdr(&r_q->hdr_name, &r_q->uni_name); r_q->unknown_0 = 0x00000000; r_q->access_desired = access_desired; @@ -1736,29 +1722,27 @@ BOOL reg_io_r_open_entry(const char *desc, REG_R_OPEN_ENTRY *r_r, prs_struct *p /******************************************************************* Inits a structure. ********************************************************************/ + void init_reg_q_shutdown(REG_Q_SHUTDOWN * q_s, const char *msg, uint32 timeout, BOOL do_reboot, BOOL force) { - int msg_len; - msg_len = strlen(msg); - q_s->ptr_0 = 1; q_s->ptr_1 = 1; q_s->ptr_2 = 1; - init_uni_hdr(&(q_s->hdr_msg), msg_len); - init_unistr2(&(q_s->uni_msg), msg, msg_len); + init_unistr2(&q_s->uni_msg, msg, UNI_FLAGS_NONE); + init_uni_hdr(&q_s->hdr_msg, &q_s->uni_msg); q_s->timeout = timeout; q_s->reboot = do_reboot ? 1 : 0; q_s->force = force ? 1 : 0; - } /******************************************************************* reads or writes a structure. ********************************************************************/ + BOOL reg_io_q_shutdown(const char *desc, REG_Q_SHUTDOWN * q_s, prs_struct *ps, int depth) { diff --git a/source3/rpc_parse/parse_samr.c b/source3/rpc_parse/parse_samr.c index 420a727765..939b652a1e 100644 --- a/source3/rpc_parse/parse_samr.c +++ b/source3/rpc_parse/parse_samr.c @@ -93,14 +93,12 @@ inits a SAMR_Q_LOOKUP_DOMAIN structure. void init_samr_q_lookup_domain(SAMR_Q_LOOKUP_DOMAIN * q_u, POLICY_HND *pol, char *dom_name) { - int len_name = strlen(dom_name); - DEBUG(5, ("init_samr_q_lookup_domain\n")); q_u->connect_pol = *pol; - init_uni_hdr(&q_u->hdr_domain, len_name); - init_unistr2(&q_u->uni_domain, dom_name, len_name); + init_unistr2(&q_u->uni_domain, dom_name, UNI_FLAGS_NONE); + init_uni_hdr(&q_u->hdr_domain, &q_u->uni_domain); } /******************************************************************* @@ -630,13 +628,11 @@ static BOOL sam_io_unk_info12(const char *desc, SAM_UNK_INFO_12 * u_12, /******************************************************************* inits a structure. ********************************************************************/ + void init_unk_info5(SAM_UNK_INFO_5 * u_5,const char *server) { - int len_server = strlen(server); - - init_uni_hdr(&u_5->hdr_server, len_server); - - init_unistr2(&u_5->uni_server, server, len_server); + init_unistr2(&u_5->uni_server, server, UNI_FLAGS_NONE); + init_uni_hdr(&u_5->hdr_server, &u_5->uni_server); } /******************************************************************* @@ -664,20 +660,16 @@ static BOOL sam_io_unk_info5(const char *desc, SAM_UNK_INFO_5 * u_5, /******************************************************************* inits a structure. ********************************************************************/ + void init_unk_info2(SAM_UNK_INFO_2 * u_2, const char *domain, const char *server, uint32 seq_num, uint32 num_users, uint32 num_groups, uint32 num_alias) { - int len_domain = strlen(domain); - int len_server = strlen(server); - u_2->unknown_0 = 0x00000000; u_2->unknown_1 = 0x80000000; u_2->unknown_2 = 0x00000000; u_2->ptr_0 = 1; - init_uni_hdr(&u_2->hdr_domain, len_domain); - init_uni_hdr(&u_2->hdr_server, len_server); u_2->seq_num = seq_num; u_2->unknown_3 = 0x00000000; @@ -691,8 +683,10 @@ void init_unk_info2(SAM_UNK_INFO_2 * u_2, memset(u_2->padding, 0, sizeof(u_2->padding)); /* 12 bytes zeros */ - init_unistr2(&u_2->uni_domain, domain, len_domain); - init_unistr2(&u_2->uni_server, server, len_server); + init_unistr2(&u_2->uni_domain, domain, UNI_FLAGS_NONE); + init_uni_hdr(&u_2->hdr_domain, &u_2->uni_domain); + init_unistr2(&u_2->uni_server, server, UNI_FLAGS_NONE); + init_uni_hdr(&u_2->hdr_server, &u_2->uni_server); } /******************************************************************* @@ -984,9 +978,9 @@ static BOOL sam_io_sam_str1(const char *desc, SAM_STR1 * sam, uint32 acct_buf, inits a SAM_ENTRY1 structure. ********************************************************************/ -static void init_sam_entry1(SAM_ENTRY1 * sam, uint32 user_idx, - uint32 len_sam_name, uint32 len_sam_full, - uint32 len_sam_desc, uint32 rid_user, +static void init_sam_entry1(SAM_ENTRY1 *sam, uint32 user_idx, + UNISTR2 *sam_name, UNISTR2 *sam_full, + UNISTR2 *sam_desc, uint32 rid_user, uint16 acb_info) { DEBUG(5, ("init_sam_entry1\n")); @@ -997,9 +991,9 @@ static void init_sam_entry1(SAM_ENTRY1 * sam, uint32 user_idx, sam->rid_user = rid_user; sam->acb_info = acb_info; - init_uni_hdr(&sam->hdr_acct_name, len_sam_name); - init_uni_hdr(&sam->hdr_user_name, len_sam_full); - init_uni_hdr(&sam->hdr_user_desc, len_sam_desc); + init_uni_hdr(&sam->hdr_acct_name, sam_name); + init_uni_hdr(&sam->hdr_user_name, sam_full); + init_uni_hdr(&sam->hdr_user_desc, sam_desc); } /******************************************************************* @@ -1067,7 +1061,7 @@ static BOOL sam_io_sam_str2(const char *desc, SAM_STR2 * sam, uint32 acct_buf, inits a SAM_ENTRY2 structure. ********************************************************************/ static void init_sam_entry2(SAM_ENTRY2 * sam, uint32 user_idx, - uint32 len_sam_name, uint32 len_sam_desc, + UNISTR2 *sam_name, UNISTR2 *sam_desc, uint32 rid_user, uint16 acb_info) { DEBUG(5, ("init_sam_entry2\n")); @@ -1076,8 +1070,8 @@ static void init_sam_entry2(SAM_ENTRY2 * sam, uint32 user_idx, sam->rid_user = rid_user; sam->acb_info = acb_info; - init_uni_hdr(&sam->hdr_srv_name, len_sam_name); - init_uni_hdr(&sam->hdr_srv_desc, len_sam_desc); + init_uni_hdr(&sam->hdr_srv_name, sam_name); + init_uni_hdr(&sam->hdr_srv_desc, sam_desc); } /******************************************************************* @@ -1144,7 +1138,7 @@ inits a SAM_ENTRY3 structure. ********************************************************************/ static void init_sam_entry3(SAM_ENTRY3 * sam, uint32 grp_idx, - uint32 len_grp_name, uint32 len_grp_desc, + UNISTR2 *grp_name, UNISTR2 *grp_desc, uint32 rid_grp) { DEBUG(5, ("init_sam_entry3\n")); @@ -1153,8 +1147,8 @@ static void init_sam_entry3(SAM_ENTRY3 * sam, uint32 grp_idx, sam->rid_grp = rid_grp; sam->attr = 0x07; /* group rid attributes - gets ignored by nt 4.0 */ - init_uni_hdr(&sam->hdr_grp_name, len_grp_name); - init_uni_hdr(&sam->hdr_grp_desc, len_grp_desc); + init_uni_hdr(&sam->hdr_grp_name, grp_name); + init_uni_hdr(&sam->hdr_grp_desc, grp_desc); } /******************************************************************* @@ -1268,12 +1262,12 @@ static BOOL sam_io_sam_entry5(const char *desc, SAM_ENTRY5 * sam, inits a SAM_ENTRY structure. ********************************************************************/ -void init_sam_entry(SAM_ENTRY * sam, uint32 len_sam_name, uint32 rid) +void init_sam_entry(SAM_ENTRY *sam, UNISTR2 *uni2, uint32 rid) { - DEBUG(10, ("init_sam_entry: %d %d\n", len_sam_name, rid)); + DEBUG(10, ("init_sam_entry: %d\n", rid)); sam->rid = rid; - init_uni_hdr(&sam->hdr_name, len_sam_name); + init_uni_hdr(&sam->hdr_name, uni2); } /******************************************************************* @@ -1502,7 +1496,6 @@ NTSTATUS init_sam_dispinfo_1(TALLOC_CTX *ctx, SAM_DISPINFO_1 *sam, uint32 num_en uint32 start_idx, SAM_ACCOUNT *disp_user_info, DOM_SID *domain_sid) { - uint32 len_sam_name, len_sam_full, len_sam_desc; uint32 i; SAM_ACCOUNT *pwd = NULL; @@ -1560,21 +1553,14 @@ NTSTATUS init_sam_dispinfo_1(TALLOC_CTX *ctx, SAM_DISPINFO_1 *sam, uint32 num_en return NT_STATUS_UNSUCCESSFUL; } - len_sam_name = strlen(username); - len_sam_full = strlen(fullname); - len_sam_desc = strlen(acct_desc); + init_unistr2(&sam->str[i].uni_acct_name, pdb_get_username(pwd), UNI_FLAGS_NONE); + init_unistr2(&sam->str[i].uni_full_name, pdb_get_fullname(pwd), UNI_FLAGS_NONE); + init_unistr2(&sam->str[i].uni_acct_desc, pdb_get_acct_desc(pwd), UNI_FLAGS_NONE); init_sam_entry1(&sam->sam[i], start_idx + i + 1, - len_sam_name, len_sam_full, len_sam_desc, + &sam->str[i].uni_acct_name, &sam->str[i].uni_full_name, &sam->str[i].uni_acct_desc, user_rid, pdb_get_acct_ctrl(pwd)); - ZERO_STRUCTP(&sam->str[i].uni_acct_name); - ZERO_STRUCTP(&sam->str[i].uni_full_name); - ZERO_STRUCTP(&sam->str[i].uni_acct_desc); - - init_unistr2(&sam->str[i].uni_acct_name, pdb_get_username(pwd), len_sam_name); - init_unistr2(&sam->str[i].uni_full_name, pdb_get_fullname(pwd), len_sam_full); - init_unistr2(&sam->str[i].uni_acct_desc, pdb_get_acct_desc(pwd), len_sam_desc); } return NT_STATUS_OK; @@ -1637,7 +1623,6 @@ NTSTATUS init_sam_dispinfo_2(TALLOC_CTX *ctx, SAM_DISPINFO_2 *sam, uint32 num_en uint32 start_idx, SAM_ACCOUNT *disp_user_info, DOM_SID *domain_sid ) { - uint32 len_sam_name, len_sam_desc; uint32 i; SAM_ACCOUNT *pwd = NULL; @@ -1680,18 +1665,12 @@ NTSTATUS init_sam_dispinfo_2(TALLOC_CTX *ctx, SAM_DISPINFO_2 *sam, uint32 num_en return NT_STATUS_UNSUCCESSFUL; } - len_sam_name = strlen(username); - len_sam_desc = strlen(acct_desc); - + init_unistr2(&sam->str[i].uni_srv_name, username, UNI_FLAGS_NONE); + init_unistr2(&sam->str[i].uni_srv_desc, pdb_get_acct_desc(pwd), UNI_FLAGS_NONE); + init_sam_entry2(&sam->sam[i], start_idx + i + 1, - len_sam_name, len_sam_desc, + &sam->str[i].uni_srv_name, &sam->str[i].uni_srv_desc, user_rid, pdb_get_acct_ctrl(pwd)); - - ZERO_STRUCTP(&sam->str[i].uni_srv_name); - ZERO_STRUCTP(&sam->str[i].uni_srv_desc); - - init_unistr2(&sam->str[i].uni_srv_name, username, len_sam_name); - init_unistr2(&sam->str[i].uni_srv_desc, pdb_get_acct_desc(pwd), len_sam_desc); } return NT_STATUS_OK; @@ -1755,7 +1734,6 @@ inits a SAM_DISPINFO_3 structure. NTSTATUS init_sam_dispinfo_3(TALLOC_CTX *ctx, SAM_DISPINFO_3 *sam, uint32 num_entries, uint32 start_idx, DOMAIN_GRP *disp_group_info) { - uint32 len_sam_name, len_sam_desc; uint32 i; ZERO_STRUCTP(sam); @@ -1779,13 +1757,11 @@ NTSTATUS init_sam_dispinfo_3(TALLOC_CTX *ctx, SAM_DISPINFO_3 *sam, uint32 num_en DEBUG(11, ("init_sam_dispinfo_3: entry: %d\n",i)); - len_sam_name = strlen(grp->name); - len_sam_desc = strlen(grp->comment); + init_unistr2(&sam->str[i].uni_grp_name, grp->name, UNI_FLAGS_NONE); + init_unistr2(&sam->str[i].uni_grp_desc, grp->comment, UNI_FLAGS_NONE); - init_sam_entry3(&sam->sam[i], start_idx + i + 1, len_sam_name, len_sam_desc, grp->rid); - - init_unistr2(&sam->str[i].uni_grp_name, grp->name, len_sam_name); - init_unistr2(&sam->str[i].uni_grp_desc, grp->comment, len_sam_desc); + init_sam_entry3(&sam->sam[i], start_idx + i + 1, &sam->str[i].uni_grp_name, + &sam->str[i].uni_grp_desc, grp->rid); } return NT_STATUS_OK; @@ -2210,20 +2186,15 @@ void init_samr_group_info1(GROUP_INFO1 * gr1, char *acct_name, char *acct_desc, uint32 num_members) { - int desc_len = acct_desc != NULL ? strlen(acct_desc) : 0; - int acct_len = acct_name != NULL ? strlen(acct_name) : 0; - DEBUG(5, ("init_samr_group_info1\n")); - init_uni_hdr(&gr1->hdr_acct_name, acct_len); - gr1->unknown_1 = 0x3; gr1->num_members = num_members; - init_uni_hdr(&gr1->hdr_acct_desc, desc_len); - - init_unistr2(&gr1->uni_acct_name, acct_name, acct_len); - init_unistr2(&gr1->uni_acct_desc, acct_desc, desc_len); + init_unistr2(&gr1->uni_acct_name, acct_name, UNI_FLAGS_NONE); + init_uni_hdr(&gr1->hdr_acct_name, &gr1->uni_acct_name); + init_unistr2(&gr1->uni_acct_desc, acct_desc, UNI_FLAGS_NONE); + init_uni_hdr(&gr1->hdr_acct_desc, &gr1->uni_acct_desc); } /******************************************************************* @@ -2302,12 +2273,10 @@ inits a GROUP_INFO4 structure. void init_samr_group_info4(GROUP_INFO4 * gr4, char *acct_desc) { - int acct_len = acct_desc != NULL ? strlen(acct_desc) : 0; - DEBUG(5, ("init_samr_group_info4\n")); - init_uni_hdr(&gr4->hdr_acct_desc, acct_len); - init_unistr2(&gr4->uni_acct_desc, acct_desc, acct_len); + init_unistr2(&gr4->uni_acct_desc, acct_desc, UNI_FLAGS_NONE); + init_uni_hdr(&gr4->hdr_acct_desc, &gr4->uni_acct_desc); } /******************************************************************* @@ -2383,14 +2352,12 @@ void init_samr_q_create_dom_group(SAMR_Q_CREATE_DOM_GROUP * q_e, POLICY_HND *pol, char *acct_desc, uint32 access_mask) { - int acct_len = acct_desc != NULL ? strlen(acct_desc) : 0; - DEBUG(5, ("init_samr_q_create_dom_group\n")); q_e->pol = *pol; - init_uni_hdr(&q_e->hdr_acct_desc, acct_len); - init_unistr2(&q_e->uni_acct_desc, acct_desc, acct_len); + init_unistr2(&q_e->uni_acct_desc, acct_desc, UNI_FLAGS_NONE); + init_uni_hdr(&q_e->hdr_acct_desc, &q_e->uni_acct_desc); q_e->access_mask = access_mask; } @@ -3502,18 +3469,15 @@ inits a ALIAS_INFO1 structure. void init_samr_alias_info1(ALIAS_INFO1 * al1, char *acct_name, uint32 num_member, char *acct_desc) { - int acct_len_name = acct_name != NULL ? strlen(acct_name) : 0; - int acct_len_desc = acct_desc != NULL ? strlen(acct_desc) : 0; - DEBUG(5, ("init_samr_alias_info1\n")); - init_uni_hdr(&al1->hdr_acct_name, acct_len_name); - init_unistr2(&al1->uni_acct_name, acct_name, acct_len_name); + init_unistr2(&al1->uni_acct_name, acct_name, UNI_FLAGS_NONE); + init_uni_hdr(&al1->hdr_acct_name, &al1->uni_acct_name); al1->num_member=num_member; - init_uni_hdr(&al1->hdr_acct_desc, acct_len_desc); - init_unistr2(&al1->uni_acct_desc, acct_desc, acct_len_desc); + init_unistr2(&al1->uni_acct_desc, acct_desc, UNI_FLAGS_NONE); + init_uni_hdr(&al1->hdr_acct_desc, &al1->uni_acct_name); } /******************************************************************* @@ -3559,12 +3523,10 @@ inits a ALIAS_INFO3 structure. void init_samr_alias_info3(ALIAS_INFO3 * al3, char *acct_desc) { - int acct_len = acct_desc != NULL ? strlen(acct_desc) : 0; - DEBUG(5, ("init_samr_alias_info3\n")); - init_uni_hdr(&al3->hdr_acct_desc, acct_len); - init_unistr2(&al3->uni_acct_desc, acct_desc, acct_len); + init_unistr2(&al3->uni_acct_desc, acct_desc, UNI_FLAGS_NONE); + init_uni_hdr(&al3->hdr_acct_desc, &al3->uni_acct_desc); } /******************************************************************* @@ -4272,14 +4234,12 @@ inits a SAMR_Q_CREATE_DOM_ALIAS structure. void init_samr_q_create_dom_alias(SAMR_Q_CREATE_DOM_ALIAS * q_u, POLICY_HND *hnd, char *acct_desc) { - int acct_len = acct_desc != NULL ? strlen(acct_desc) : 0; - DEBUG(5, ("init_samr_q_create_dom_alias\n")); q_u->dom_pol = *hnd; - init_uni_hdr(&q_u->hdr_acct_desc, acct_len); - init_unistr2(&q_u->uni_acct_desc, acct_desc, acct_len); + init_unistr2(&q_u->uni_acct_desc, acct_desc, UNI_FLAGS_NONE); + init_uni_hdr(&q_u->hdr_acct_desc, &q_u->uni_acct_desc); q_u->access_mask = 0x001f000f; } @@ -4675,9 +4635,8 @@ NTSTATUS init_samr_q_lookup_names(TALLOC_CTX *ctx, SAMR_Q_LOOKUP_NAMES * q_u, return NT_STATUS_NO_MEMORY; for (i = 0; i < num_names; i++) { - int len_name = name[i] != NULL ? strlen(name[i]) : 0; - init_uni_hdr(&q_u->hdr_name[i], len_name); /* unicode header for user_name */ - init_unistr2(&q_u->uni_name[i], name[i], len_name); /* unicode string for machine account */ + init_unistr2(&q_u->uni_name[i], name[i], UNI_FLAGS_NONE); /* unicode string for machine account */ + init_uni_hdr(&q_u->hdr_name[i], &q_u->uni_name[i]); /* unicode header for user_name */ } return NT_STATUS_OK; @@ -5013,15 +4972,12 @@ void init_samr_q_create_user(SAMR_Q_CREATE_USER * q_u, const char *name, uint32 acb_info, uint32 access_mask) { - int len_name; - len_name = strlen(name); - DEBUG(5, ("samr_init_samr_q_create_user\n")); q_u->domain_pol = *pol; - init_uni_hdr(&q_u->hdr_name, len_name); - init_unistr2(&q_u->uni_name, name, len_name); + init_unistr2(&q_u->uni_name, name, UNI_FLAGS_NONE); + init_uni_hdr(&q_u->hdr_name, &q_u->uni_name); q_u->acb_info = acb_info; q_u->access_mask = access_mask; @@ -5244,16 +5200,11 @@ void init_sam_user_info11(SAM_USER_INFO_11 * usr, char *mach_acct, uint32 rid_user, uint32 rid_group, uint16 acct_ctrl) { - int len_mach_acct; - DEBUG(5, ("init_sam_user_info11\n")); - len_mach_acct = strlen(mach_acct); - - memcpy(&(usr->expiry), expiry, sizeof(usr->expiry)); /* expiry time or something? */ + memcpy(&usr->expiry, expiry, sizeof(usr->expiry)); /* expiry time or something? */ ZERO_STRUCT(usr->padding_1); /* 0 - padding 24 bytes */ - init_uni_hdr(&usr->hdr_mach_acct, len_mach_acct); /* unicode header for machine account */ usr->padding_2 = 0; /* 0 - padding 4 bytes */ usr->ptr_1 = 1; /* pointer */ @@ -5278,7 +5229,8 @@ void init_sam_user_info11(SAM_USER_INFO_11 * usr, ZERO_STRUCT(usr->padding_7); /* 0 - padding 16 bytes */ usr->padding_8 = 0; /* 0 - padding 4 bytes */ - init_unistr2(&usr->uni_mach_acct, mach_acct, len_mach_acct); /* unicode string for machine account */ + init_unistr2(&usr->uni_mach_acct, mach_acct, UNI_FLAGS_NONE); /* unicode string for machine account */ + init_uni_hdr(&usr->hdr_mach_acct, &usr->uni_mach_acct); /* unicode header for machine account */ } /******************************************************************* @@ -5441,17 +5393,6 @@ void init_sam_user_info23W(SAM_USER_INFO_23 * usr, NTTIME * logon_time, /* all z uint16 logon_count, char newpass[516], uint32 unknown_6) { - int len_user_name = user_name != NULL ? user_name->uni_str_len : 0; - int len_full_name = full_name != NULL ? full_name->uni_str_len : 0; - int len_home_dir = home_dir != NULL ? home_dir->uni_str_len : 0; - int len_dir_drive = dir_drive != NULL ? dir_drive->uni_str_len : 0; - int len_logon_script = log_scr != NULL ? log_scr->uni_str_len : 0; - int len_profile_path = prof_path != NULL ? prof_path->uni_str_len : 0; - int len_description = desc != NULL ? desc->uni_str_len : 0; - int len_workstations = wkstas != NULL ? wkstas->uni_str_len : 0; - int len_unknown_str = unk_str != NULL ? unk_str->uni_str_len : 0; - int len_munged_dial = mung_dial != NULL ? mung_dial->uni_str_len : 0; - usr->logon_time = *logon_time; /* all zeros */ usr->logoff_time = *logoff_time; /* all zeros */ usr->kickoff_time = *kickoff_time; /* all zeros */ @@ -5459,17 +5400,6 @@ void init_sam_user_info23W(SAM_USER_INFO_23 * usr, NTTIME * logon_time, /* all z usr->pass_can_change_time = *pass_can_change_time; /* all zeros */ usr->pass_must_change_time = *pass_must_change_time; /* all zeros */ - init_uni_hdr(&usr->hdr_user_name, len_user_name); /* NULL */ - init_uni_hdr(&usr->hdr_full_name, len_full_name); - init_uni_hdr(&usr->hdr_home_dir, len_home_dir); - init_uni_hdr(&usr->hdr_dir_drive, len_dir_drive); - init_uni_hdr(&usr->hdr_logon_script, len_logon_script); - init_uni_hdr(&usr->hdr_profile_path, len_profile_path); - init_uni_hdr(&usr->hdr_acct_desc, len_description); - init_uni_hdr(&usr->hdr_workstations, len_workstations); - init_uni_hdr(&usr->hdr_unknown_str, len_unknown_str); - init_uni_hdr(&usr->hdr_munged_dial, len_munged_dial); - ZERO_STRUCT(usr->nt_pwd); ZERO_STRUCT(usr->lm_pwd); @@ -5496,15 +5426,34 @@ void init_sam_user_info23W(SAM_USER_INFO_23 * usr, NTTIME * logon_time, /* all z memcpy(usr->pass, newpass, sizeof(usr->pass)); copy_unistr2(&usr->uni_user_name, user_name); + init_uni_hdr(&usr->hdr_user_name, &usr->uni_user_name); + copy_unistr2(&usr->uni_full_name, full_name); + init_uni_hdr(&usr->hdr_full_name, &usr->uni_full_name); + copy_unistr2(&usr->uni_home_dir, home_dir); + init_uni_hdr(&usr->hdr_home_dir, &usr->uni_home_dir); + copy_unistr2(&usr->uni_dir_drive, dir_drive); + init_uni_hdr(&usr->hdr_dir_drive, &usr->uni_dir_drive); + copy_unistr2(&usr->uni_logon_script, log_scr); + init_uni_hdr(&usr->hdr_logon_script, &usr->uni_logon_script); + copy_unistr2(&usr->uni_profile_path, prof_path); + init_uni_hdr(&usr->hdr_profile_path, &usr->uni_profile_path); + copy_unistr2(&usr->uni_acct_desc, desc); + init_uni_hdr(&usr->hdr_acct_desc, &usr->uni_acct_desc); + copy_unistr2(&usr->uni_workstations, wkstas); + init_uni_hdr(&usr->hdr_workstations, &usr->uni_workstations); + copy_unistr2(&usr->uni_unknown_str, unk_str); + init_uni_hdr(&usr->hdr_unknown_str, &usr->uni_unknown_str); + copy_unistr2(&usr->uni_munged_dial, mung_dial); + init_uni_hdr(&usr->hdr_munged_dial, &usr->uni_munged_dial); usr->unknown_6 = unknown_6; /* 0x0000 04ec */ usr->padding4 = 0; @@ -5536,17 +5485,6 @@ void init_sam_user_info23A(SAM_USER_INFO_23 * usr, NTTIME * logon_time, /* all z LOGON_HRS * hrs, uint16 bad_password_count, uint16 logon_count, char newpass[516], uint32 unknown_6) { - int len_user_name = user_name != NULL ? strlen(user_name) : 0; - int len_full_name = full_name != NULL ? strlen(full_name) : 0; - int len_home_dir = home_dir != NULL ? strlen(home_dir) : 0; - int len_dir_drive = dir_drive != NULL ? strlen(dir_drive) : 0; - int len_logon_script = log_scr != NULL ? strlen(log_scr) : 0; - int len_profile_path = prof_path != NULL ? strlen(prof_path) : 0; - int len_description = desc != NULL ? strlen(desc) : 0; - int len_workstations = wkstas != NULL ? strlen(wkstas) : 0; - int len_unknown_str = unk_str != NULL ? strlen(unk_str) : 0; - int len_munged_dial = mung_dial != NULL ? strlen(mung_dial) : 0; - usr->logon_time = *logon_time; /* all zeros */ usr->logoff_time = *logoff_time; /* all zeros */ usr->kickoff_time = *kickoff_time; /* all zeros */ @@ -5554,17 +5492,6 @@ void init_sam_user_info23A(SAM_USER_INFO_23 * usr, NTTIME * logon_time, /* all z usr->pass_can_change_time = *pass_can_change_time; /* all zeros */ usr->pass_must_change_time = *pass_must_change_time; /* all zeros */ - init_uni_hdr(&usr->hdr_user_name, len_user_name); /* NULL */ - init_uni_hdr(&usr->hdr_full_name, len_full_name); - init_uni_hdr(&usr->hdr_home_dir, len_home_dir); - init_uni_hdr(&usr->hdr_dir_drive, len_dir_drive); - init_uni_hdr(&usr->hdr_logon_script, len_logon_script); - init_uni_hdr(&usr->hdr_profile_path, len_profile_path); - init_uni_hdr(&usr->hdr_acct_desc, len_description); - init_uni_hdr(&usr->hdr_workstations, len_workstations); - init_uni_hdr(&usr->hdr_unknown_str, len_unknown_str); - init_uni_hdr(&usr->hdr_munged_dial, len_munged_dial); - ZERO_STRUCT(usr->nt_pwd); ZERO_STRUCT(usr->lm_pwd); @@ -5590,16 +5517,35 @@ void init_sam_user_info23A(SAM_USER_INFO_23 * usr, NTTIME * logon_time, /* all z memcpy(usr->pass, newpass, sizeof(usr->pass)); - init_unistr2(&usr->uni_user_name, user_name, len_user_name); /* NULL */ - init_unistr2(&usr->uni_full_name, full_name, len_full_name); - init_unistr2(&usr->uni_home_dir, home_dir, len_home_dir); - init_unistr2(&usr->uni_dir_drive, dir_drive, len_dir_drive); - init_unistr2(&usr->uni_logon_script, log_scr, len_logon_script); - init_unistr2(&usr->uni_profile_path, prof_path, len_profile_path); - init_unistr2(&usr->uni_acct_desc, desc, len_description); - init_unistr2(&usr->uni_workstations, wkstas, len_workstations); - init_unistr2(&usr->uni_unknown_str, unk_str, len_unknown_str); - init_unistr2(&usr->uni_munged_dial, mung_dial, len_munged_dial); + init_unistr2(&usr->uni_user_name, user_name, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_user_name, &usr->uni_user_name); + + init_unistr2(&usr->uni_full_name, full_name, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_full_name, &usr->uni_full_name); + + init_unistr2(&usr->uni_home_dir, home_dir, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_home_dir, &usr->uni_home_dir); + + init_unistr2(&usr->uni_dir_drive, dir_drive, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_dir_drive, &usr->uni_dir_drive); + + init_unistr2(&usr->uni_logon_script, log_scr, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_logon_script, &usr->uni_logon_script); + + init_unistr2(&usr->uni_profile_path, prof_path, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_profile_path, &usr->uni_profile_path); + + init_unistr2(&usr->uni_acct_desc, desc, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_acct_desc, &usr->uni_acct_desc); + + init_unistr2(&usr->uni_workstations, wkstas, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_workstations, &usr->uni_workstations); + + init_unistr2(&usr->uni_unknown_str, unk_str, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_unknown_str, &usr->uni_unknown_str); + + init_unistr2(&usr->uni_munged_dial, mung_dial, UNI_FLAGS_NONE); + init_uni_hdr(&usr->hdr_munged_dial, &usr->uni_munged_dial); usr->unknown_6 = unknown_6; /* 0x0000 04ec */ usr->padding4 = 0; @@ -5900,17 +5846,6 @@ void init_sam_user_info21W(SAM_USER_INFO_21 * usr, uint16 logon_count, uint32 unknown_6) { - int len_user_name = user_name != NULL ? user_name->uni_str_len : 0; - int len_full_name = full_name != NULL ? full_name->uni_str_len : 0; - int len_home_dir = home_dir != NULL ? home_dir->uni_str_len : 0; - int len_dir_drive = dir_drive != NULL ? dir_drive->uni_str_len : 0; - int len_logon_script = log_scr != NULL ? log_scr->uni_str_len : 0; - int len_profile_path = prof_path != NULL ? prof_path->uni_str_len : 0; - int len_description = desc != NULL ? desc->uni_str_len : 0; - int len_workstations = wkstas != NULL ? wkstas->uni_str_len : 0; - int len_unknown_str = unk_str != NULL ? unk_str->uni_str_len : 0; - int len_munged_dial = mung_dial != NULL ? mung_dial->uni_str_len : 0; - usr->logon_time = *logon_time; usr->logoff_time = *logoff_time; usr->kickoff_time = *kickoff_time; @@ -5918,17 +5853,6 @@ void init_sam_user_info21W(SAM_USER_INFO_21 * usr, usr->pass_can_change_time = *pass_can_change_time; usr->pass_must_change_time = *pass_must_change_time; - init_uni_hdr(&usr->hdr_user_name, len_user_name); - init_uni_hdr(&usr->hdr_full_name, len_full_name); - init_uni_hdr(&usr->hdr_home_dir, len_home_dir); - init_uni_hdr(&usr->hdr_dir_drive, len_dir_drive); - init_uni_hdr(&usr->hdr_logon_script, len_logon_script); - init_uni_hdr(&usr->hdr_profile_path, len_profile_path); - init_uni_hdr(&usr->hdr_acct_desc, len_description); - init_uni_hdr(&usr->hdr_workstations, len_workstations); - init_uni_hdr(&usr->hdr_unknown_str, len_unknown_str); - init_uni_hdr(&usr->hdr_munged_dial, len_munged_dial); - memcpy(usr->lm_pwd, lm_pwd, sizeof(usr->lm_pwd)); memcpy(usr->nt_pwd, nt_pwd, sizeof(usr->nt_pwd)); @@ -5952,15 +5876,34 @@ void init_sam_user_info21W(SAM_USER_INFO_21 * usr, ZERO_STRUCT(usr->padding2); copy_unistr2(&usr->uni_user_name, user_name); + init_uni_hdr(&usr->hdr_user_name, &usr->uni_user_name); + copy_unistr2(&usr->uni_full_name, full_name); + init_uni_hdr(&usr->hdr_full_name, &usr->uni_full_name); + copy_unistr2(&usr->uni_home_dir, home_dir); + init_uni_hdr(&usr->hdr_home_dir, &usr->uni_home_dir); + copy_unistr2(&usr->uni_dir_drive, dir_drive); + init_uni_hdr(&usr->hdr_dir_drive, &usr->uni_dir_drive); + copy_unistr2(&usr->uni_logon_script, log_scr); + init_uni_hdr(&usr->hdr_logon_script, &usr->uni_logon_script); + copy_unistr2(&usr->uni_profile_path, prof_path); + init_uni_hdr(&usr->hdr_profile_path, &usr->uni_profile_path); + copy_unistr2(&usr->uni_acct_desc, desc); + init_uni_hdr(&usr->hdr_acct_desc, &usr->uni_acct_desc); + copy_unistr2(&usr->uni_workstations, wkstas); + init_uni_hdr(&usr->hdr_workstations, &usr->uni_workstations); + copy_unistr2(&usr->uni_unknown_str, unk_str); + init_uni_hdr(&usr->hdr_unknown_str, &usr->uni_unknown_str); + copy_unistr2(&usr->uni_munged_dial, mung_dial); + init_uni_hdr(&usr->hdr_munged_dial, &usr->uni_munged_dial); usr->unknown_6 = unknown_6; /* 0x0000 04ec */ usr->padding4 = 0; @@ -5981,11 +5924,6 @@ NTSTATUS init_sam_user_info21A(SAM_USER_INFO_21 *usr, SAM_ACCOUNT *pw, DOM_SID * NTTIME logon_time, logoff_time, kickoff_time, pass_last_set_time, pass_can_change_time, pass_must_change_time; - - int len_user_name, len_full_name, len_home_dir, - len_dir_drive, len_logon_script, len_profile_path, - len_description, len_workstations, len_unknown_str, - len_munged_dial; const char* user_name = pdb_get_username(pw); const char* full_name = pdb_get_fullname(pw); @@ -6003,18 +5941,6 @@ NTSTATUS init_sam_user_info21A(SAM_USER_INFO_21 *usr, SAM_ACCOUNT *pw, DOM_SID * uint32 group_rid; const DOM_SID *group_sid; - len_user_name = user_name != NULL ? strlen(user_name )+1 : 0; - len_full_name = full_name != NULL ? strlen(full_name )+1 : 0; - len_home_dir = home_dir != NULL ? strlen(home_dir )+1 : 0; - len_dir_drive = dir_drive != NULL ? strlen(dir_drive )+1 : 0; - len_logon_script = logon_script != NULL ? strlen(logon_script)+1 : 0; - len_profile_path = profile_path != NULL ? strlen(profile_path)+1 : 0; - len_description = description != NULL ? strlen(description )+1 : 0; - len_workstations = workstations != NULL ? strlen(workstations)+1 : 0; - len_unknown_str = 0; - len_munged_dial = munged_dial != NULL ? strlen(munged_dial )+1 : 0; - - /* Create NTTIME structs */ unix_to_nt_time (&logon_time, pdb_get_logon_time(pw)); unix_to_nt_time (&logoff_time, pdb_get_logoff_time(pw)); @@ -6031,17 +5957,6 @@ NTSTATUS init_sam_user_info21A(SAM_USER_INFO_21 *usr, SAM_ACCOUNT *pw, DOM_SID * usr->pass_can_change_time = pass_can_change_time; usr->pass_must_change_time = pass_must_change_time; - init_uni_hdr(&usr->hdr_user_name, len_user_name); - init_uni_hdr(&usr->hdr_full_name, len_full_name); - init_uni_hdr(&usr->hdr_home_dir, len_home_dir); - init_uni_hdr(&usr->hdr_dir_drive, len_dir_drive); - init_uni_hdr(&usr->hdr_logon_script, len_logon_script); - init_uni_hdr(&usr->hdr_profile_path, len_profile_path); - init_uni_hdr(&usr->hdr_acct_desc, len_description); - init_uni_hdr(&usr->hdr_workstations, len_workstations); - init_uni_hdr(&usr->hdr_unknown_str, len_unknown_str); - init_uni_hdr(&usr->hdr_munged_dial, len_munged_dial); - ZERO_STRUCT(usr->nt_pwd); ZERO_STRUCT(usr->lm_pwd); @@ -6100,16 +6015,35 @@ NTSTATUS init_sam_user_info21A(SAM_USER_INFO_21 *usr, SAM_ACCOUNT *pw, DOM_SID * ZERO_STRUCT(usr->padding1); ZERO_STRUCT(usr->padding2); - init_unistr2(&usr->uni_user_name, user_name, len_user_name); - init_unistr2(&usr->uni_full_name, full_name, len_full_name); - init_unistr2(&usr->uni_home_dir, home_dir, len_home_dir); - init_unistr2(&usr->uni_dir_drive, dir_drive, len_dir_drive); - init_unistr2(&usr->uni_logon_script, logon_script, len_logon_script); - init_unistr2(&usr->uni_profile_path, profile_path, len_profile_path); - init_unistr2(&usr->uni_acct_desc, description, len_description); - init_unistr2(&usr->uni_workstations, workstations, len_workstations); - init_unistr2(&usr->uni_unknown_str, NULL, len_unknown_str); - init_unistr2(&usr->uni_munged_dial, munged_dial, len_munged_dial); + init_unistr2(&usr->uni_user_name, user_name, UNI_STR_TERMINATE); + init_uni_hdr(&usr->hdr_user_name, &usr->uni_user_name); + + init_unistr2(&usr->uni_full_name, full_name, UNI_STR_TERMINATE); + init_uni_hdr(&usr->hdr_full_name, &usr->uni_full_name); + + init_unistr2(&usr->uni_home_dir, home_dir, UNI_STR_TERMINATE); + init_uni_hdr(&usr->hdr_home_dir, &usr->uni_home_dir); + + init_unistr2(&usr->uni_dir_drive, dir_drive, UNI_STR_TERMINATE); + init_uni_hdr(&usr->hdr_dir_drive, &usr->uni_dir_drive); + + init_unistr2(&usr->uni_logon_script, logon_script, UNI_STR_TERMINATE); + init_uni_hdr(&usr->hdr_logon_script, &usr->uni_logon_script); + + init_unistr2(&usr->uni_profile_path, profile_path, UNI_STR_TERMINATE); + init_uni_hdr(&usr->hdr_profile_path, &usr->uni_profile_path); + + init_unistr2(&usr->uni_acct_desc, description, UNI_STR_TERMINATE); + init_uni_hdr(&usr->hdr_acct_desc, &usr->uni_acct_desc); + + init_unistr2(&usr->uni_workstations, workstations, UNI_STR_TERMINATE); + init_uni_hdr(&usr->hdr_workstations, &usr->uni_workstations); + + init_unistr2(&usr->uni_unknown_str, NULL, UNI_STR_TERMINATE); + init_uni_hdr(&usr->hdr_unknown_str, &usr->uni_unknown_str); + + init_unistr2(&usr->uni_munged_dial, munged_dial, UNI_STR_TERMINATE); + init_uni_hdr(&usr->hdr_munged_dial, &usr->uni_munged_dial); usr->unknown_6 = pdb_get_unknown_6(pw); usr->padding4 = 0; @@ -6249,12 +6183,10 @@ static BOOL sam_io_user_info21(const char *desc, SAM_USER_INFO_21 * usr, void init_sam_user_info20A(SAM_USER_INFO_20 *usr, SAM_ACCOUNT *pw) { - int len_munged_dial; - const char* munged_dial = pdb_get_munged_dial(pw); + const char *munged_dial = pdb_get_munged_dial(pw); - len_munged_dial = munged_dial != NULL ? strlen(munged_dial )+1 : 0; - init_uni_hdr(&usr->hdr_munged_dial, len_munged_dial); - init_unistr2(&usr->uni_munged_dial, munged_dial, len_munged_dial); + init_unistr2(&usr->uni_munged_dial, munged_dial, UNI_STR_TERMINATE); + init_uni_hdr(&usr->hdr_munged_dial, &usr->uni_munged_dial); } @@ -6720,13 +6652,11 @@ inits a SAMR_Q_CONNECT structure. void init_samr_q_connect(SAMR_Q_CONNECT * q_u, char *srv_name, uint32 access_mask) { - int len_srv_name = strlen(srv_name); - DEBUG(5, ("init_samr_q_connect\n")); /* make PDC server name \\server */ - q_u->ptr_srv_name = len_srv_name > 0 ? 1 : 0; - init_unistr2(&q_u->uni_srv_name, srv_name, len_srv_name + 1); + q_u->ptr_srv_name = (srv_name != NULL && *srv_name) ? 1 : 0; + init_unistr2(&q_u->uni_srv_name, srv_name, UNI_STR_TERMINATE); /* example values: 0x0000 0002 */ q_u->access_mask = access_mask; @@ -6793,13 +6723,11 @@ inits a SAMR_Q_CONNECT4 structure. void init_samr_q_connect4(SAMR_Q_CONNECT4 * q_u, char *srv_name, uint32 access_mask) { - int len_srv_name = strlen(srv_name); - DEBUG(5, ("init_samr_q_connect\n")); /* make PDC server name \\server */ - q_u->ptr_srv_name = len_srv_name > 0 ? 1 : 0; - init_unistr2(&q_u->uni_srv_name, srv_name, len_srv_name + 1); + q_u->ptr_srv_name = (srv_name != NULL && *srv_name) ? 1 : 0; + init_unistr2(&q_u->uni_srv_name, srv_name, UNI_STR_TERMINATE); /* Only value we've seen, possibly an address type ? */ q_u->unk_0 = 2; @@ -6938,13 +6866,11 @@ inits a SAMR_Q_GET_DOM_PWINFO structure. void init_samr_q_get_dom_pwinfo(SAMR_Q_GET_DOM_PWINFO * q_u, char *srv_name) { - int len_srv_name = strlen(srv_name); - DEBUG(5, ("init_samr_q_get_dom_pwinfo\n")); q_u->ptr = 1; - init_uni_hdr(&q_u->hdr_srv_name, len_srv_name); - init_unistr2(&q_u->uni_srv_name, srv_name, len_srv_name); + init_unistr2(&q_u->uni_srv_name, srv_name, UNI_FLAGS_NONE); + init_uni_hdr(&q_u->hdr_srv_name, &q_u->uni_srv_name); } /******************************************************************* @@ -7105,16 +7031,14 @@ void init_samr_q_chgpasswd_user(SAMR_Q_CHGPASSWD_USER * q_u, char lm_newpass[516], uchar lm_oldhash[16]) { - int len_dest_host = strlen(dest_host); - int len_user_name = strlen(user_name); - DEBUG(5, ("init_samr_q_chgpasswd_user\n")); q_u->ptr_0 = 1; - init_uni_hdr(&q_u->hdr_dest_host, len_dest_host); - init_unistr2(&q_u->uni_dest_host, dest_host, len_dest_host); - init_uni_hdr(&q_u->hdr_user_name, len_user_name); - init_unistr2(&q_u->uni_user_name, user_name, len_user_name); + init_unistr2(&q_u->uni_dest_host, dest_host, UNI_FLAGS_NONE); + init_uni_hdr(&q_u->hdr_dest_host, &q_u->uni_dest_host); + + init_unistr2(&q_u->uni_user_name, user_name, UNI_FLAGS_NONE); + init_uni_hdr(&q_u->hdr_user_name, &q_u->uni_user_name); init_enc_passwd(&q_u->nt_newpass, nt_newpass); init_enc_hash(&q_u->nt_oldhash, nt_oldhash); diff --git a/source3/rpc_parse/parse_spoolss.c b/source3/rpc_parse/parse_spoolss.c index 7ca9bccab4..65f16414a0 100644 --- a/source3/rpc_parse/parse_spoolss.c +++ b/source3/rpc_parse/parse_spoolss.c @@ -916,12 +916,12 @@ BOOL make_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u, { DEBUG(5,("make_spoolss_q_open_printer_ex\n")); q_u->printername_ptr = (printername!=NULL)?1:0; - init_unistr2(&q_u->printername, printername, strlen(printername)+1); + init_unistr2(&q_u->printername, printername, UNI_STR_TERMINATE); q_u->printer_default.datatype_ptr = 0; /* q_u->printer_default.datatype_ptr = (datatype!=NULL)?1:0; - init_unistr2(&q_u->printer_default.datatype, datatype, strlen(datatype)); + init_unistr2(&q_u->printer_default.datatype, datatype, UNI_FLAGS_NONE); */ q_u->printer_default.devmode_cont.size=0; q_u->printer_default.devmode_cont.devmode_ptr=0; @@ -937,8 +937,8 @@ BOOL make_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u, q_u->user_ctr.user1.major=2; q_u->user_ctr.user1.minor=0; q_u->user_ctr.user1.processor=0; - init_unistr2(&q_u->user_ctr.user1.client_name, clientname, strlen(clientname)+1); - init_unistr2(&q_u->user_ctr.user1.user_name, user_name, strlen(user_name)+1); + init_unistr2(&q_u->user_ctr.user1.client_name, clientname, UNI_STR_TERMINATE); + init_unistr2(&q_u->user_ctr.user1.user_name, user_name, UNI_STR_TERMINATE); return True; } @@ -963,7 +963,7 @@ BOOL make_spoolss_q_addprinterex( ZERO_STRUCTP(q_u); q_u->server_name_ptr = (srv_name!=NULL)?1:0; - init_unistr2(&q_u->server_name, srv_name, strlen(srv_name)); + init_unistr2(&q_u->server_name, srv_name, UNI_FLAGS_NONE); q_u->level = level; @@ -991,8 +991,8 @@ BOOL make_spoolss_q_addprinterex( q_u->user_ctr.user1.major=2; q_u->user_ctr.user1.minor=0; q_u->user_ctr.user1.processor=0; - init_unistr2(&q_u->user_ctr.user1.client_name, clientname, strlen(clientname)+1); - init_unistr2(&q_u->user_ctr.user1.user_name, user_name, strlen(user_name)+1); + init_unistr2(&q_u->user_ctr.user1.client_name, clientname, UNI_STR_TERMINATE); + init_unistr2(&q_u->user_ctr.user1.user_name, user_name, UNI_STR_TERMINATE); q_u->user_ctr.user1.size=q_u->user_ctr.user1.user_name.uni_str_len + q_u->user_ctr.user1.client_name.uni_str_len + 2; @@ -1187,15 +1187,13 @@ BOOL make_spoolss_q_deleteprinterdriver( /* these must be NULL terminated or else NT4 will complain about invalid parameters --jerry */ - init_unistr2(&q_u->server, server, strlen(server)+1); - init_unistr2(&q_u->arch, arch, strlen(arch)+1); - init_unistr2(&q_u->driver, driver, strlen(driver)+1); - + init_unistr2(&q_u->server, server, UNI_STR_TERMINATE); + init_unistr2(&q_u->arch, arch, UNI_STR_TERMINATE); + init_unistr2(&q_u->driver, driver, UNI_STR_TERMINATE); return True; } - /******************************************************************* * make a structure. ********************************************************************/ @@ -1209,7 +1207,7 @@ BOOL make_spoolss_q_getprinterdata(SPOOL_Q_GETPRINTERDATA *q_u, DEBUG(5,("make_spoolss_q_getprinterdata\n")); q_u->handle = *handle; - init_unistr2(&q_u->valuename, valuename, strlen(valuename) + 1); + init_unistr2(&q_u->valuename, valuename, UNI_STR_TERMINATE); q_u->size = size; return True; @@ -1229,8 +1227,8 @@ BOOL make_spoolss_q_getprinterdataex(SPOOL_Q_GETPRINTERDATAEX *q_u, DEBUG(5,("make_spoolss_q_getprinterdataex\n")); q_u->handle = *handle; - init_unistr2(&q_u->valuename, valuename, strlen(valuename) + 1); - init_unistr2(&q_u->keyname, keyname, strlen(keyname) + 1); + init_unistr2(&q_u->valuename, valuename, UNI_STR_TERMINATE); + init_unistr2(&q_u->keyname, keyname, UNI_STR_TERMINATE); q_u->size = size; return True; @@ -5317,7 +5315,7 @@ BOOL smb_io_unibuffer(const char *desc, UNISTR2 *buffer, prs_struct *ps, int dep { if (buffer==NULL) return False; - buffer->undoc=0; + buffer->offset=0; buffer->uni_str_len=buffer->uni_max_len; if(!prs_uint32("buffer_size", ps, depth, &buffer->uni_max_len)) @@ -5374,7 +5372,7 @@ BOOL make_spoolss_q_addprinterdriver(TALLOC_CTX *mem_ctx, DEBUG(5,("make_spoolss_q_addprinterdriver\n")); q_u->server_name_ptr = (srv_name!=NULL)?1:0; - init_unistr2(&q_u->server_name, srv_name, strlen(srv_name)+1); + init_unistr2(&q_u->server_name, srv_name, UNI_STR_TERMINATE); q_u->level = level; @@ -6162,7 +6160,7 @@ BOOL make_spoolss_q_enumprinterdataex(SPOOL_Q_ENUMPRINTERDATAEX *q_u, uint32 size) { memcpy(&q_u->handle, hnd, sizeof(q_u->handle)); - init_unistr2(&q_u->key, key, strlen(key)+1); + init_unistr2(&q_u->key, key, UNI_STR_TERMINATE); q_u->size = size; return True; @@ -6175,7 +6173,7 @@ BOOL make_spoolss_q_setprinterdata(SPOOL_Q_SETPRINTERDATA *q_u, const POLICY_HND { memcpy(&q_u->handle, hnd, sizeof(q_u->handle)); q_u->type = data_type; - init_unistr2(&q_u->value, value, strlen(value)+1); + init_unistr2(&q_u->value, value, UNI_STR_TERMINATE); q_u->max_len = q_u->real_len = data_size; q_u->data = (unsigned char *)data; @@ -6191,8 +6189,8 @@ BOOL make_spoolss_q_setprinterdataex(SPOOL_Q_SETPRINTERDATAEX *q_u, const POLICY { memcpy(&q_u->handle, hnd, sizeof(q_u->handle)); q_u->type = data_type; - init_unistr2(&q_u->value, value, strlen(value)+1); - init_unistr2(&q_u->key, key, strlen(key)+1); + init_unistr2(&q_u->value, value, UNI_STR_TERMINATE); + init_unistr2(&q_u->key, key, UNI_STR_TERMINATE); q_u->max_len = q_u->real_len = data_size; q_u->data = (unsigned char *)data; @@ -6589,7 +6587,7 @@ BOOL make_spoolss_q_replyopenprinter(SPOOL_Q_REPLYOPENPRINTER *q_u, if (q_u == NULL) return False; - init_unistr2(&q_u->string, string, strlen(string)+1); + init_unistr2(&q_u->string, string, UNI_STR_TERMINATE); q_u->printer=printer; q_u->type=type; @@ -7092,7 +7090,7 @@ BOOL make_spoolss_q_enumprinterkey(SPOOL_Q_ENUMPRINTERKEY *q_u, DEBUG(5,("make_spoolss_q_enumprinterkey\n")); memcpy(&q_u->handle, hnd, sizeof(q_u->handle)); - init_unistr2(&q_u->key, key, strlen(key)+1); + init_unistr2(&q_u->key, key, UNI_STR_TERMINATE); q_u->size = size; return True; @@ -7161,7 +7159,7 @@ BOOL make_spoolss_q_deleteprinterkey(SPOOL_Q_DELETEPRINTERKEY *q_u, DEBUG(5,("make_spoolss_q_deleteprinterkey\n")); memcpy(&q_u->handle, hnd, sizeof(q_u->handle)); - init_unistr2(&q_u->keyname, keyname, strlen(keyname)+1); + init_unistr2(&q_u->keyname, keyname, UNI_STR_TERMINATE); return True; } @@ -7382,8 +7380,8 @@ BOOL make_spoolss_q_getprintprocessordirectory(SPOOL_Q_GETPRINTPROCESSORDIRECTOR { DEBUG(5,("make_spoolss_q_getprintprocessordirectory\n")); - init_unistr2(&q_u->name, name, strlen(name)+1); - init_unistr2(&q_u->environment, environment, strlen(environment)+1); + init_unistr2(&q_u->name, name, UNI_STR_TERMINATE); + init_unistr2(&q_u->environment, environment, UNI_STR_TERMINATE); q_u->level = level; @@ -7509,7 +7507,7 @@ BOOL make_spoolss_q_setform(SPOOL_Q_SETFORM *q_u, POLICY_HND *handle, q_u->level = level; q_u->level2 = level; memcpy(&q_u->form, form, sizeof(FORM)); - init_unistr2(&q_u->name, form_name, strlen(form_name) + 1); + init_unistr2(&q_u->name, form_name, UNI_STR_TERMINATE); return True; } @@ -7522,7 +7520,7 @@ BOOL make_spoolss_q_deleteform(SPOOL_Q_DELETEFORM *q_u, POLICY_HND *handle, const char *form) { memcpy(&q_u->handle, handle, sizeof(POLICY_HND)); - init_unistr2(&q_u->name, form, strlen(form) + 1); + init_unistr2(&q_u->name, form, UNI_STR_TERMINATE); return True; } @@ -7536,7 +7534,7 @@ BOOL make_spoolss_q_getform(SPOOL_Q_GETFORM *q_u, POLICY_HND *handle, { memcpy(&q_u->handle, handle, sizeof(POLICY_HND)); q_u->level = level; - init_unistr2(&q_u->formname, formname, strlen(formname) + 1); + init_unistr2(&q_u->formname, formname, UNI_STR_TERMINATE); q_u->buffer=buffer; q_u->offered=offered; @@ -7642,17 +7640,9 @@ BOOL make_spoolss_q_startdocprinter(SPOOL_Q_STARTDOCPRINTER *q_u, ctr->docinfo.doc_info_1.p_outputfile = outputfile ? 1 : 0; ctr->docinfo.doc_info_1.p_datatype = datatype ? 1 : 0; - if (docname) - init_unistr2(&ctr->docinfo.doc_info_1.docname, docname, - strlen(docname) + 1); - - if (outputfile) - init_unistr2(&ctr->docinfo.doc_info_1.outputfile, outputfile, - strlen(outputfile) + 1); - - if (datatype) - init_unistr2(&ctr->docinfo.doc_info_1.datatype, datatype, - strlen(datatype) + 1); + init_unistr2(&ctr->docinfo.doc_info_1.docname, docname, UNI_STR_TERMINATE); + init_unistr2(&ctr->docinfo.doc_info_1.outputfile, outputfile, UNI_STR_TERMINATE); + init_unistr2(&ctr->docinfo.doc_info_1.datatype, datatype, UNI_STR_TERMINATE); break; case 2: @@ -7701,7 +7691,7 @@ BOOL make_spoolss_q_deleteprinterdata(SPOOL_Q_DELETEPRINTERDATA *q_u, POLICY_HND *handle, char *valuename) { memcpy(&q_u->handle, handle, sizeof(POLICY_HND)); - init_unistr2(&q_u->valuename, valuename, strlen(valuename) + 1); + init_unistr2(&q_u->valuename, valuename, UNI_STR_TERMINATE); return True; } @@ -7715,8 +7705,8 @@ BOOL make_spoolss_q_deleteprinterdataex(SPOOL_Q_DELETEPRINTERDATAEX *q_u, char *value) { memcpy(&q_u->handle, handle, sizeof(POLICY_HND)); - init_unistr2(&q_u->valuename, value, strlen(value) + 1); - init_unistr2(&q_u->keyname, key, strlen(key) + 1); + init_unistr2(&q_u->valuename, value, UNI_STR_TERMINATE); + init_unistr2(&q_u->keyname, key, UNI_STR_TERMINATE); return True; } @@ -7736,8 +7726,7 @@ BOOL make_spoolss_q_rffpcnex(SPOOL_Q_RFFPCNEX *q_u, POLICY_HND *handle, q_u->localmachine_ptr = 1; - init_unistr2(&q_u->localmachine, localmachine, - strlen(localmachine) + 1); + init_unistr2(&q_u->localmachine, localmachine, UNI_STR_TERMINATE); q_u->printerlocal = printerlocal; diff --git a/source3/rpc_parse/parse_srv.c b/source3/rpc_parse/parse_srv.c index bbb5193ddc..6349fc1632 100644 --- a/source3/rpc_parse/parse_srv.c +++ b/source3/rpc_parse/parse_srv.c @@ -36,8 +36,7 @@ void init_srv_share_info0_str(SH_INFO_0_STR *sh0, const char *net_name) { DEBUG(5,("init_srv_share_info0_str\n")); - if(net_name) - init_unistr2(&sh0->uni_netname, net_name, strlen(net_name)+1); + init_unistr2(&sh0->uni_netname, net_name, UNI_STR_TERMINATE); } /******************************************************************* @@ -101,10 +100,8 @@ void init_srv_share_info1_str(SH_INFO_1_STR *sh1, const char *net_name, const ch { DEBUG(5,("init_srv_share_info1_str\n")); - if(net_name) - init_unistr2(&sh1->uni_netname, net_name, strlen(net_name)+1); - if(remark) - init_unistr2(&sh1->uni_remark, remark, strlen(remark)+1); + init_unistr2(&sh1->uni_netname, net_name, UNI_STR_TERMINATE); + init_unistr2(&sh1->uni_remark, remark, UNI_STR_TERMINATE); } /******************************************************************* @@ -184,14 +181,10 @@ void init_srv_share_info2_str(SH_INFO_2_STR *sh2, { DEBUG(5,("init_srv_share_info2_str\n")); - if (net_name) - init_unistr2(&sh2->uni_netname, net_name, strlen(net_name)+1); - if (remark) - init_unistr2(&sh2->uni_remark, remark, strlen(remark)+1); - if (path) - init_unistr2(&sh2->uni_path, path, strlen(path)+1); - if (passwd) - init_unistr2(&sh2->uni_passwd, passwd, strlen(passwd)+1); + init_unistr2(&sh2->uni_netname, net_name, UNI_STR_TERMINATE); + init_unistr2(&sh2->uni_remark, remark, UNI_STR_TERMINATE); + init_unistr2(&sh2->uni_path, path, UNI_STR_TERMINATE); + init_unistr2(&sh2->uni_passwd, passwd, UNI_STR_TERMINATE); } /******************************************************************* @@ -296,10 +289,8 @@ void init_srv_share_info501_str(SH_INFO_501_STR *sh501, { DEBUG(5,("init_srv_share_info501_str\n")); - if(net_name) - init_unistr2(&sh501->uni_netname, net_name, strlen(net_name)+1); - if(remark) - init_unistr2(&sh501->uni_remark, remark, strlen(remark)+1); + init_unistr2(&sh501->uni_netname, net_name, UNI_STR_TERMINATE); + init_unistr2(&sh501->uni_remark, remark, UNI_STR_TERMINATE); } /******************************************************************* @@ -446,17 +437,13 @@ void init_srv_share_info502_str(SH_INFO_502_STR *sh502str, { DEBUG(5,("init_srv_share_info502_str\n")); - if(net_name) - init_unistr2(&sh502str->uni_netname, net_name, strlen(net_name)+1); - if(remark) - init_unistr2(&sh502str->uni_remark, remark, strlen(remark)+1); - if(path) - init_unistr2(&sh502str->uni_path, path, strlen(path)+1); - if(passwd) - init_unistr2(&sh502str->uni_passwd, passwd, strlen(passwd)+1); - sh502str->sd = psd; + init_unistr2(&sh502str->uni_netname, net_name, UNI_STR_TERMINATE); + init_unistr2(&sh502str->uni_remark, remark, UNI_STR_TERMINATE); + init_unistr2(&sh502str->uni_path, path, UNI_STR_TERMINATE); + init_unistr2(&sh502str->uni_passwd, passwd, UNI_STR_TERMINATE); + sh502str->sd = psd; sh502str->reserved = 0; - sh502str->sd_size = sd_size; + sh502str->sd_size = sd_size; } /******************************************************************* @@ -551,8 +538,7 @@ void init_srv_share_info1004_str(SH_INFO_1004_STR *sh1004, const char *remark) { DEBUG(5,("init_srv_share_info1004_str\n")); - if(remark) - init_unistr2(&sh1004->uni_remark, remark, strlen(remark)+1); + init_unistr2(&sh1004->uni_remark, remark, UNI_STR_TERMINATE); } /******************************************************************* @@ -659,8 +645,7 @@ void init_srv_share_info1007_str(SH_INFO_1007_STR *sh1007, const char *alternate { DEBUG(5,("init_srv_share_info1007_str\n")); - if(alternate_directory_name) - init_unistr2(&sh1007->uni_AlternateDirectoryName, alternate_directory_name, strlen(alternate_directory_name)+1); + init_unistr2(&sh1007->uni_AlternateDirectoryName, alternate_directory_name, UNI_STR_TERMINATE); } /******************************************************************* @@ -1474,7 +1459,7 @@ void init_srv_q_net_share_add(SRV_Q_NET_SHARE_ADD *q, const char *srvname, const char *path, const char *passwd) { q->ptr_srv_name = 1; - init_unistr2(&q->uni_srv_name, srvname, strlen(srvname) +1); + init_unistr2(&q->uni_srv_name, srvname, UNI_STR_TERMINATE); q->info.switch_value = q->info_level = 2; q->info.ptr_share_ctr = 1; @@ -1525,8 +1510,8 @@ void init_srv_q_net_share_del(SRV_Q_NET_SHARE_DEL *del, const char *srvname, const char *sharename) { del->ptr_srv_name = 1; - init_unistr2(&del->uni_srv_name, srvname, strlen(srvname) +1 ); - init_unistr2(&del->uni_share_name, sharename, strlen(sharename) + 1); + init_unistr2(&del->uni_srv_name, srvname, UNI_STR_TERMINATE); + init_unistr2(&del->uni_share_name, sharename, UNI_STR_TERMINATE); } /******************************************************************* @@ -1589,7 +1574,7 @@ void init_srv_sess_info0_str(SESS_INFO_0_STR *ss0, const char *name) { DEBUG(5,("init_srv_sess_info0_str\n")); - init_unistr2(&ss0->uni_name, name, strlen(name)+1); + init_unistr2(&ss0->uni_name, name, UNI_STR_TERMINATE); } /******************************************************************* @@ -1703,8 +1688,8 @@ void init_srv_sess_info1_str(SESS_INFO_1_STR *ss1, const char *name, const char { DEBUG(5,("init_srv_sess_info1_str\n")); - init_unistr2(&ss1->uni_name, name, strlen(name)+1); - init_unistr2(&ss1->uni_user, user, strlen(user)+1); + init_unistr2(&ss1->uni_name, name, UNI_STR_TERMINATE); + init_unistr2(&ss1->uni_user, user, UNI_STR_TERMINATE); } /******************************************************************* @@ -2075,8 +2060,8 @@ void init_srv_conn_info1_str(CONN_INFO_1_STR *ss1, const char *usr_name, const c { DEBUG(5,("init_srv_conn_info1_str\n")); - init_unistr2(&ss1->uni_usr_name, usr_name, strlen(usr_name)+1); - init_unistr2(&ss1->uni_net_name, net_name, strlen(net_name)+1); + init_unistr2(&ss1->uni_usr_name, usr_name, UNI_STR_TERMINATE); + init_unistr2(&ss1->uni_net_name, net_name, UNI_STR_TERMINATE); } /******************************************************************* @@ -2365,8 +2350,8 @@ void init_srv_file_info3_str(FILE_INFO_3_STR *fi3, const char *user_name, const { DEBUG(5,("init_srv_file_info3_str\n")); - init_unistr2(&fi3->uni_path_name, path_name, strlen(path_name)+1); - init_unistr2(&fi3->uni_user_name, user_name, strlen(user_name)+1); + init_unistr2(&fi3->uni_path_name, path_name, UNI_STR_TERMINATE); + init_unistr2(&fi3->uni_user_name, user_name, UNI_STR_TERMINATE); } /******************************************************************* @@ -2628,7 +2613,7 @@ void init_srv_q_net_file_close(SRV_Q_NET_FILE_CLOSE *q_n, const char *server, uint32 file_id) { q_n->ptr_srv_name = 1; - init_unistr2(&q_n->uni_srv_name, server, strlen(server) + 1); + init_unistr2(&q_n->uni_srv_name, server, UNI_STR_TERMINATE); q_n->file_id = file_id; } @@ -3586,6 +3571,5 @@ BOOL srv_io_r_net_file_set_secdesc(const char *desc, SRV_R_NET_FILE_SET_SECDESC void init_srv_q_net_remote_tod(SRV_Q_NET_REMOTE_TOD *q_u, const char *server) { q_u->ptr_srv_name = 1; - init_unistr2(&q_u->uni_srv_name, server, strlen(server) + 1); + init_unistr2(&q_u->uni_srv_name, server, UNI_STR_TERMINATE); } - diff --git a/source3/rpc_server/srv_dfs_nt.c b/source3/rpc_server/srv_dfs_nt.c index 3470ad99b4..751cb6e642 100644 --- a/source3/rpc_server/srv_dfs_nt.c +++ b/source3/rpc_server/srv_dfs_nt.c @@ -198,7 +198,7 @@ static BOOL init_reply_dfs_info_1(struct junction_map* j, DFS_INFO_1* dfs1, int slprintf(str, sizeof(pstring)-1, "\\\\%s\\%s\\%s", global_myname(), j[i].service_name, j[i].volume_name); DEBUG(5,("init_reply_dfs_info_1: %d) initing entrypath: %s\n",i,str)); - init_unistr2(&dfs1[i].entrypath,str,strlen(str)+1); + init_unistr2(&dfs1[i].entrypath,str,UNI_STR_TERMINATE); } return True; } @@ -212,7 +212,7 @@ static BOOL init_reply_dfs_info_2(struct junction_map* j, DFS_INFO_2* dfs2, int dfs2[i].ptr_entrypath = 1; slprintf(str, sizeof(pstring)-1, "\\\\%s\\%s\\%s", global_myname(), j[i].service_name, j[i].volume_name); - init_unistr2(&dfs2[i].entrypath, str, strlen(str)+1); + init_unistr2(&dfs2[i].entrypath, str, UNI_STR_TERMINATE); dfs2[i].ptr_comment = 0; dfs2[i].state = 1; /* set up state of dfs junction as OK */ dfs2[i].num_storages = j[i].referral_count; @@ -234,9 +234,9 @@ static BOOL init_reply_dfs_info_3(TALLOC_CTX *ctx, struct junction_map* j, DFS_I slprintf(str, sizeof(pstring)-1, "\\\\%s\\%s\\%s", global_myname(), j[i].service_name, j[i].volume_name); - init_unistr2(&dfs3[i].entrypath, str, strlen(str)+1); + init_unistr2(&dfs3[i].entrypath, str, UNI_STR_TERMINATE); dfs3[i].ptr_comment = 1; - init_unistr2(&dfs3[i].comment, "", 1); + init_unistr2(&dfs3[i].comment, "", UNI_STR_TERMINATE); dfs3[i].state = 1; dfs3[i].num_storages = dfs3[i].num_storage_infos = j[i].referral_count; dfs3[i].ptr_storages = 1; @@ -267,8 +267,8 @@ static BOOL init_reply_dfs_info_3(TALLOC_CTX *ctx, struct junction_map* j, DFS_I *p = '\0'; DEBUG(5,("storage %d: %s.%s\n",ii,path,p+1)); stor->state = 2; /* set all storages as ONLINE */ - init_unistr2(&stor->servername, path, strlen(path)+1); - init_unistr2(&stor->sharename, p+1, strlen(p+1)+1); + init_unistr2(&stor->servername, path, UNI_STR_TERMINATE); + init_unistr2(&stor->sharename, p+1, UNI_STR_TERMINATE); stor->ptr_servername = stor->ptr_sharename = 1; } } diff --git a/source3/rpc_server/srv_lsa_ds_nt.c b/source3/rpc_server/srv_lsa_ds_nt.c index 37540a9668..97e9dc361d 100644 --- a/source3/rpc_server/srv_lsa_ds_nt.c +++ b/source3/rpc_server/srv_lsa_ds_nt.c @@ -77,12 +77,12 @@ static NTSTATUS fill_dsrole_dominfo_basic(TALLOC_CTX *ctx, DSROLE_PRIMARY_DOMAIN basic->netbios_ptr = 1; netbios_domain = get_global_sam_name(); - init_unistr2( &basic->netbios_domain, netbios_domain, strlen(netbios_domain) ); + init_unistr2( &basic->netbios_domain, netbios_domain, UNI_FLAGS_NONE); basic->dnsname_ptr = 1; - init_unistr2( &basic->dns_domain, dnsdomain, strlen(dnsdomain) ); + init_unistr2( &basic->dns_domain, dnsdomain, UNI_FLAGS_NONE); basic->forestname_ptr = 1; - init_unistr2( &basic->forest_domain, dnsdomain, strlen(dnsdomain) ); + init_unistr2( &basic->forest_domain, dnsdomain, UNI_FLAGS_NONE); /* fill in some additional fields if we are a member of an AD domain */ diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c index 686a3069bb..0921824cad 100644 --- a/source3/rpc_server/srv_lsa_nt.c +++ b/source3/rpc_server/srv_lsa_nt.c @@ -61,7 +61,12 @@ Init dom_query static void init_dom_query(DOM_QUERY *d_q, const char *dom_name, DOM_SID *dom_sid) { - int domlen = (dom_name != NULL) ? strlen(dom_name) : 0; + d_q->buffer_dom_name = (dom_name != NULL) ? 1 : 0; /* domain buffer pointer */ + d_q->buffer_dom_sid = (dom_sid != NULL) ? 1 : 0; /* domain sid pointer */ + + /* this string is supposed to be non-null terminated. */ + /* But the maxlen in this UNISTR2 must include the terminating null. */ + init_unistr2(&d_q->uni_domain_name, dom_name, UNI_MAXLEN_TERMINATE); /* * I'm not sure why this really odd combination of length @@ -71,14 +76,15 @@ static void init_dom_query(DOM_QUERY *d_q, const char *dom_name, DOM_SID *dom_si * a domain with both odd and even length names... JRA. */ - d_q->uni_dom_str_len = domlen ? ((domlen + 1) * 2) : 0; - d_q->uni_dom_max_len = domlen * 2; - d_q->buffer_dom_name = domlen != 0 ? 1 : 0; /* domain buffer pointer */ - d_q->buffer_dom_sid = dom_sid != NULL ? 1 : 0; /* domain sid pointer */ + /* + * IMPORTANT NOTE !!!! + * The two fields below probably are reversed in meaning, ie. + * the first field is probably the str_len, the second the max + * len. Both are measured in bytes anyway. + */ - /* this string is supposed to be character short */ - init_unistr2(&d_q->uni_domain_name, dom_name, domlen); - d_q->uni_domain_name.uni_max_len++; + d_q->uni_dom_str_len = d_q->uni_domain_name.uni_max_len * 2; + d_q->uni_dom_max_len = d_q->uni_domain_name.uni_str_len * 2; if (dom_sid != NULL) init_dom_sid2(&d_q->dom_sid, dom_sid); @@ -91,7 +97,6 @@ static void init_dom_query(DOM_QUERY *d_q, const char *dom_name, DOM_SID *dom_si static int init_dom_ref(DOM_R_REF *ref, char *dom_name, DOM_SID *dom_sid) { int num = 0; - int len; if (dom_name != NULL) { for (num = 0; num < ref->num_ref_doms_1; num++) { @@ -114,14 +119,11 @@ static int init_dom_ref(DOM_R_REF *ref, char *dom_name, DOM_SID *dom_sid) ref->max_entries = MAX_REF_DOMAINS; ref->num_ref_doms_2 = num+1; - len = (dom_name != NULL) ? strlen(dom_name) : 0; - if(dom_name != NULL && len == 0) - len = 1; - - init_uni_hdr(&ref->hdr_ref_dom[num].hdr_dom_name, len); ref->hdr_ref_dom[num].ptr_dom_sid = dom_sid != NULL ? 1 : 0; - init_unistr2(&ref->ref_dom[num].uni_dom_name, dom_name, len); + init_unistr2(&ref->ref_dom[num].uni_dom_name, dom_name, UNI_FLAGS_NONE); + init_uni_hdr(&ref->hdr_ref_dom[num].hdr_dom_name, &ref->ref_dom[num].uni_dom_name); + init_dom_sid2(&ref->ref_dom[num].ref_dom, dom_sid ); return num; @@ -349,25 +351,22 @@ static void init_dns_dom_info(LSA_DNS_DOM_INFO *r_l, const char *nb_name, GUID *dom_guid, DOM_SID *dom_sid) { if (nb_name && *nb_name) { - init_uni_hdr(&r_l->hdr_nb_dom_name, strlen(nb_name)); - init_unistr2(&r_l->uni_nb_dom_name, nb_name, - strlen(nb_name)); + init_unistr2(&r_l->uni_nb_dom_name, nb_name, UNI_FLAGS_NONE); + init_uni_hdr(&r_l->hdr_nb_dom_name, &r_l->uni_nb_dom_name); r_l->hdr_nb_dom_name.uni_max_len += 2; r_l->uni_nb_dom_name.uni_max_len += 1; } if (dns_name && *dns_name) { - init_uni_hdr(&r_l->hdr_dns_dom_name, strlen(dns_name)); - init_unistr2(&r_l->uni_dns_dom_name, dns_name, - strlen(dns_name)); + init_unistr2(&r_l->uni_dns_dom_name, dns_name, UNI_FLAGS_NONE); + init_uni_hdr(&r_l->hdr_dns_dom_name, &r_l->uni_dns_dom_name); r_l->hdr_dns_dom_name.uni_max_len += 2; r_l->uni_dns_dom_name.uni_max_len += 1; } if (forest_name && *forest_name) { - init_uni_hdr(&r_l->hdr_forest_name, strlen(forest_name)); - init_unistr2(&r_l->uni_forest_name, forest_name, - strlen(forest_name)); + init_unistr2(&r_l->uni_forest_name, forest_name, UNI_FLAGS_NONE); + init_uni_hdr(&r_l->hdr_forest_name, &r_l->uni_forest_name); r_l->hdr_forest_name.uni_max_len += 2; r_l->uni_forest_name.uni_max_len += 1; } @@ -774,13 +773,13 @@ NTSTATUS _lsa_enum_privs(pipes_struct *p, LSA_Q_ENUM_PRIVS *q_u, LSA_R_ENUM_PRIV for (i = 0; i < PRIV_ALL_INDEX; i++, entry++) { if( ihdr_name, 0); - init_unistr2(&entry->name, NULL, 0 ); + init_unistr2(&entry->name, NULL, UNI_FLAGS_NONE); + init_uni_hdr(&entry->hdr_name, &entry->name); entry->luid_low = 0; entry->luid_high = 0; } else { - init_uni_hdr(&entry->hdr_name, strlen(privs[i+1].priv)); - init_unistr2(&entry->name, privs[i+1].priv, strlen(privs[i+1].priv) ); + init_unistr2(&entry->name, privs[i+1].priv, UNI_FLAGS_NONE); + init_uni_hdr(&entry->hdr_name, &entry->name); entry->luid_low = privs[i+1].se_priv; entry->luid_high = 0; } @@ -822,8 +821,8 @@ NTSTATUS _lsa_priv_get_dispname(pipes_struct *p, LSA_Q_PRIV_GET_DISPNAME *q_u, L if (privs[i].se_priv!=SE_PRIV_ALL) { DEBUG(10,(": %s\n", privs[i].description)); - init_uni_hdr(&r_u->hdr_desc, strlen(privs[i].description)); - init_unistr2(&r_u->desc, privs[i].description, strlen(privs[i].description) ); + init_unistr2(&r_u->desc, privs[i].description, UNI_FLAGS_NONE); + init_uni_hdr(&r_u->hdr_desc, &r_u->desc); r_u->ptr_info=0xdeadbeef; r_u->lang_id=q_u->lang_id; @@ -890,7 +889,6 @@ NTSTATUS _lsa_enum_accounts(pipes_struct *p, LSA_Q_ENUM_ACCOUNTS *q_u, LSA_R_ENU NTSTATUS _lsa_unk_get_connuser(pipes_struct *p, LSA_Q_UNK_GET_CONNUSER *q_u, LSA_R_UNK_GET_CONNUSER *r_u) { fstring username, domname; - int ulen, dlen; user_struct *vuser = get_valid_user_struct(p->vuid); if (vuser == NULL) @@ -899,18 +897,15 @@ NTSTATUS _lsa_unk_get_connuser(pipes_struct *p, LSA_Q_UNK_GET_CONNUSER *q_u, LSA fstrcpy(username, vuser->user.smb_name); fstrcpy(domname, vuser->user.domain); - ulen = strlen(username) + 1; - dlen = strlen(domname) + 1; - - init_uni_hdr(&r_u->hdr_user_name, ulen); r_u->ptr_user_name = 1; - init_unistr2(&r_u->uni2_user_name, username, ulen); + init_unistr2(&r_u->uni2_user_name, username, UNI_STR_TERMINATE); + init_uni_hdr(&r_u->hdr_user_name, &r_u->uni2_user_name); r_u->unk1 = 1; - init_uni_hdr(&r_u->hdr_dom_name, dlen); r_u->ptr_dom_name = 1; - init_unistr2(&r_u->uni2_dom_name, domname, dlen); + init_unistr2(&r_u->uni2_dom_name, domname, UNI_STR_TERMINATE); + init_uni_hdr(&r_u->hdr_dom_name, &r_u->uni2_dom_name); r_u->status = NT_STATUS_OK; diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c index 828e07c1ad..71e5bc7d70 100644 --- a/source3/rpc_server/srv_samr_nt.c +++ b/source3/rpc_server/srv_samr_nt.c @@ -719,7 +719,7 @@ static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp, UN for (i = 0; i < num_entries; i++) { pwd = &disp_user_info[i+start_idx]; temp_name = pdb_get_username(pwd); - init_unistr2(&uni_temp_name, temp_name, strlen(temp_name)+1); + init_unistr2(&uni_temp_name, temp_name, UNI_STR_TERMINATE); user_sid = pdb_get_user_sid(pwd); if (!sid_peek_check_rid(domain_sid, user_sid, &user_rid)) { @@ -731,7 +731,7 @@ static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp, UN return NT_STATUS_UNSUCCESSFUL; } - init_sam_entry(&sam[i], uni_temp_name.uni_str_len, user_rid); + init_sam_entry(&sam[i], &uni_temp_name, user_rid); copy_unistr2(&uni_name[i], &uni_temp_name); } @@ -865,10 +865,8 @@ static void make_group_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp, UNIST /* * JRA. I think this should include the null. TNG does not. */ - int len = strlen(grp[i].name)+1; - - init_sam_entry(&sam[i], len, grp[i].rid); - init_unistr2(&uni_name[i], grp[i].name, len); + init_unistr2(&uni_name[i], grp[i].name, UNI_STR_TERMINATE); + init_sam_entry(&sam[i], &uni_name[i], grp[i].rid); } *sam_pp = sam; @@ -1580,10 +1578,9 @@ static BOOL make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names, fstring nam } for (i = 0; i < num_names; i++) { - int len = names[i] != NULL ? strlen(names[i]) : 0; - DEBUG(10, ("names[%d]:%s\n", i, names[i])); - init_uni_hdr(&hdr_name[i], len); - init_unistr2(&uni_name[i], names[i], len); + DEBUG(10, ("names[%d]:%s\n", i, names[i] ? names[i] : "")); + init_unistr2(&uni_name[i], names[i], UNI_FLAGS_NONE); + init_uni_hdr(&hdr_name[i], &uni_name[i]); } *pp_uni_name = uni_name; @@ -2570,10 +2567,8 @@ static BOOL make_enum_domains(TALLOC_CTX *ctx, SAM_ENTRY **pp_sam, return False; for (i = 0; i < num_sam_entries; i++) { - int len = doms[i] != NULL ? strlen(doms[i]) : 0; - - init_sam_entry(&sam[i], len, 0); - init_unistr2(&uni_name[i], doms[i], len); + init_unistr2(&uni_name[i], doms[i], UNI_FLAGS_NONE); + init_sam_entry(&sam[i], &uni_name[i], 0); } *pp_sam = sam; diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c index 7159527a7d..493f58f8a8 100644 --- a/source3/rpc_server/srv_spoolss_nt.c +++ b/source3/rpc_server/srv_spoolss_nt.c @@ -690,7 +690,7 @@ static void notify_string(struct spoolss_notify_msg *msg, /* The length of the message includes the trailing \0 */ - init_unistr2(&unistr, msg->notify.data, msg->len); + init_unistr2(&unistr, msg->notify.data, UNI_STR_TERMINATE); data->notify_data.data.length = msg->len * 2; data->notify_data.data.string = (uint16 *)talloc(mem_ctx, msg->len * 2); @@ -6121,7 +6121,7 @@ static WERROR update_printer(pipes_struct *p, POLICY_HND *handle, uint32 level, */ if (!strequal(printer->info_2->comment, old_printer->info_2->comment)) { - init_unistr2( &buffer, printer->info_2->comment, strlen(printer->info_2->comment)+1 ); + init_unistr2( &buffer, printer->info_2->comment, UNI_STR_TERMINATE); set_printer_dataex( printer, SPOOL_DSSPOOLER_KEY, "description", REG_SZ, (uint8*)buffer.buffer, buffer.uni_str_len*2 ); @@ -6129,7 +6129,7 @@ static WERROR update_printer(pipes_struct *p, POLICY_HND *handle, uint32 level, } if (!strequal(printer->info_2->sharename, old_printer->info_2->sharename)) { - init_unistr2( &buffer, printer->info_2->sharename, strlen(printer->info_2->sharename)+1 ); + init_unistr2( &buffer, printer->info_2->sharename, UNI_STR_TERMINATE); set_printer_dataex( printer, SPOOL_DSSPOOLER_KEY, "printerName", REG_SZ, (uint8*)buffer.buffer, buffer.uni_str_len*2 ); set_printer_dataex( printer, SPOOL_DSSPOOLER_KEY, "shareName", @@ -6139,7 +6139,7 @@ static WERROR update_printer(pipes_struct *p, POLICY_HND *handle, uint32 level, } if (!strequal(printer->info_2->portname, old_printer->info_2->portname)) { - init_unistr2( &buffer, printer->info_2->portname, strlen(printer->info_2->portname)+1 ); + init_unistr2( &buffer, printer->info_2->portname, UNI_STR_TERMINATE); set_printer_dataex( printer, SPOOL_DSSPOOLER_KEY, "portName", REG_SZ, (uint8*)buffer.buffer, buffer.uni_str_len*2 ); @@ -6147,7 +6147,7 @@ static WERROR update_printer(pipes_struct *p, POLICY_HND *handle, uint32 level, } if (!strequal(printer->info_2->location, old_printer->info_2->location)) { - init_unistr2( &buffer, printer->info_2->location, strlen(printer->info_2->location)+1 ); + init_unistr2( &buffer, printer->info_2->location, UNI_STR_TERMINATE); set_printer_dataex( printer, SPOOL_DSSPOOLER_KEY, "location", REG_SZ, (uint8*)buffer.buffer, buffer.uni_str_len*2 ); @@ -6157,7 +6157,7 @@ static WERROR update_printer(pipes_struct *p, POLICY_HND *handle, uint32 level, /* here we need to update some more DsSpooler keys */ /* uNCName, serverName, shortServerName */ - init_unistr2( &buffer, global_myname(), strlen(global_myname())+1 ); + init_unistr2( &buffer, global_myname(), UNI_STR_TERMINATE); set_printer_dataex( printer, SPOOL_DSSPOOLER_KEY, "serverName", REG_SZ, (uint8*)buffer.buffer, buffer.uni_str_len*2 ); set_printer_dataex( printer, SPOOL_DSSPOOLER_KEY, "shortServerName", @@ -6165,7 +6165,7 @@ static WERROR update_printer(pipes_struct *p, POLICY_HND *handle, uint32 level, slprintf( asc_buffer, sizeof(asc_buffer)-1, "\\\\%s\\%s", global_myname(), printer->info_2->sharename ); - init_unistr2( &buffer, asc_buffer, strlen(asc_buffer)+1 ); + init_unistr2( &buffer, asc_buffer, UNI_STR_TERMINATE); set_printer_dataex( printer, SPOOL_DSSPOOLER_KEY, "uNCName", REG_SZ, (uint8*)buffer.buffer, buffer.uni_str_len*2 ); diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c index 61e100c03b..05bfb2a0dc 100644 --- a/source3/rpcclient/cmd_spoolss.c +++ b/source3/rpcclient/cmd_spoolss.c @@ -1568,7 +1568,7 @@ static WERROR cmd_spoolss_addform(struct cli_state *cli, TALLOC_CTX *mem_ctx, form.right = 20; form.bottom = 30; - init_unistr2(&form.name, argv[2], strlen(argv[2]) + 1); + init_unistr2(&form.name, argv[2], UNI_STR_TERMINATE); /* Add the form */ @@ -1627,7 +1627,7 @@ static WERROR cmd_spoolss_setform(struct cli_state *cli, TALLOC_CTX *mem_ctx, form.right = 2000; form.bottom = 3000; - init_unistr2(&form.name, argv[2], strlen(argv[2]) + 1); + init_unistr2(&form.name, argv[2], UNI_STR_TERMINATE); /* Set the form */ -- cgit From 3f5f051d0086507280f820d9423009619357612e Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 29 Sep 2003 06:18:00 +0000 Subject: Merge from 3.0: >Fix for valid users = %S in homes share. >Jeremy. (This used to be commit 799da7092c5b56914512f843789adbedec5ac8f5) --- source3/smbd/password.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/source3/smbd/password.c b/source3/smbd/password.c index 32c24b3d67..958ed663e6 100644 --- a/source3/smbd/password.c +++ b/source3/smbd/password.c @@ -291,7 +291,9 @@ BOOL user_ok(const char *user,int snum, gid_t *groups, size_t n_groups) if (lp_invalid_users(snum)) { str_list_copy(&invalid, lp_invalid_users(snum)); if (invalid && str_list_substitute(invalid, "%S", lp_servicename(snum))) { - ret = !user_in_list(user, (const char **)invalid, groups, n_groups); + if ( invalid && str_list_sub_basic(invalid, current_user_info.smb_name) ) { + ret = !user_in_list(user, (const char **)invalid, groups, n_groups); + } } } if (invalid) @@ -299,8 +301,10 @@ BOOL user_ok(const char *user,int snum, gid_t *groups, size_t n_groups) if (ret && lp_valid_users(snum)) { str_list_copy(&valid, lp_valid_users(snum)); - if ( valid && str_list_sub_basic(valid, current_user_info.smb_name) ) { - ret = user_in_list(user, (const char **)valid, groups, n_groups); + if ( valid && str_list_substitute(valid, "%S", lp_servicename(snum)) ) { + if ( valid && str_list_sub_basic(valid, current_user_info.smb_name) ) { + ret = user_in_list(user, (const char **)valid, groups, n_groups); + } } } if (valid) -- cgit From a21e1f781f0bbf783cda6237fa4103deb8a43474 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 29 Sep 2003 06:18:42 +0000 Subject: Merge from 3.0: >Ensure %S gets expanded in read/write lists. >Jeremy. (This used to be commit 424acd6ee92c46c565886c3305c3492737538d3d) --- source3/smbd/service.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/source3/smbd/service.c b/source3/smbd/service.c index 44d73b2ab2..e4c3890f86 100644 --- a/source3/smbd/service.c +++ b/source3/smbd/service.c @@ -259,23 +259,27 @@ static NTSTATUS share_sanity_checks(int snum, fstring dev) return NT_STATUS_OK; } - /**************************************************************************** readonly share? ****************************************************************************/ + static void set_read_only(connection_struct *conn, gid_t *groups, size_t n_groups) { char **list; - char *service = lp_servicename(conn->service); + const char *service = lp_servicename(conn->service); conn->read_only = lp_readonly(conn->service); - if (!service) return; + if (!service) + return; str_list_copy(&list, lp_readlist(conn->service)); if (list) { - if ( !str_list_sub_basic(list, current_user_info.smb_name) ) { + if (!str_list_sub_basic(list, current_user_info.smb_name) ) { DEBUG(0, ("ERROR: read list substitution failed\n")); } + if (!str_list_substitute(list, "%S", service)) { + DEBUG(0, ("ERROR: read list service substitution failed\n")); + } if (user_in_list(conn->user, (const char **)list, groups, n_groups)) conn->read_only = True; str_list_free(&list); @@ -283,19 +287,22 @@ static void set_read_only(connection_struct *conn, gid_t *groups, size_t n_group str_list_copy(&list, lp_writelist(conn->service)); if (list) { - if ( !str_list_sub_basic(list, current_user_info.smb_name) ) { + if (!str_list_sub_basic(list, current_user_info.smb_name) ) { DEBUG(0, ("ERROR: write list substitution failed\n")); } + if (!str_list_substitute(list, "%S", service)) { + DEBUG(0, ("ERROR: write list service substitution failed\n")); + } if (user_in_list(conn->user, (const char **)list, groups, n_groups)) conn->read_only = False; str_list_free(&list); } } - /**************************************************************************** admin user check ****************************************************************************/ + static void set_admin_user(connection_struct *conn, gid_t *groups, size_t n_groups) { /* admin user check */ -- cgit From 4663c471a35079cdea8b97559c02f865ec6dffd8 Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Mon, 29 Sep 2003 06:20:11 +0000 Subject: Merge from 3.0: >More bug #413. Fix bad html table row termination in SWAT wizard code found by >Monyo. Also remove debugging d_printf() which snuck in the last commit. >Change title of SWAT globals page from 'Global Variables' to 'Global >Parameters' to be more consistent with the other pages. (This used to be commit 1ab70b41a9eba59272c0af5a8036c32366734177) --- source3/web/swat.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/source3/web/swat.c b/source3/web/swat.c index 1c892559dd..2b2686cc5a 100644 --- a/source3/web/swat.c +++ b/source3/web/swat.c @@ -737,8 +737,10 @@ static void wizard_page(void) d_printf("
    		 Not Used  Server for client use  Client of another WINS server 
    Remote WINS Server Error: WINS Server Mode and WINS Support both set in smb.conf
    Please Select desired WINS mode above.
    %s Yes No

    Chapter 4. Specific client application problems

    Table of Contents

    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"
    How to use a Samba share as an administrative share for MS Office, etc.
    Microsoft Access database opening errors

    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"

    +Chapter 3. Specific client application problems

    Chapter 3. Specific client application problems
    Prev   Next

    Chapter 3. Specific client application problems

    Table of Contents

    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"
    How to use a Samba share as an administrative share for MS Office, etc.
    Microsoft Access database opening errors

    MS Office Setup reports "Cannot change properties of '\\MSOFFICE\\SETUP.INI'"

    When installing MS Office on a Samba drive for which you have admin user permissions, ie. admin users = username, you will find the setup program unable to complete the installation. @@ -11,14 +10,14 @@ rdonly by trying to open it for writing. Admin users can always open a file for writing, as they run as root. You just have to install as a non-admin user and then use "chown -R" to fix the owner. -

    How to use a Samba share as an administrative share for MS Office, etc.

    +

    How to use a Samba share as an administrative share for MS Office, etc.

    Microsoft Office products can be installed as an administrative installation from which the application can either be run off the administratively installed product that resides on a shared resource, or from which that product can be installed onto workstation clients.

    The general mechanism for implementing an adminstrative installation involves -running X:\setup /A, where X is the drive letter of either CDROM or floppy. +running X:\setup /A, where X is the drive letter of either CDROM or floppy.

    This installation process will NOT install the product for use per se, but rather results in unpacking of the compressed distribution files into a target @@ -45,8 +44,8 @@ set the following parameters on the share containing it: browseable = yes public = yes

  • Now you are ready to run the setup program from the Microsoft Windows -workstation as follows: \\"Server_Name"\MSOP95\msoffice\setup -

    • Microsoft Access database opening errors

    +workstation as follows: \\"Server_Name"\MSOP95\msoffice\setup +

    Microsoft Access database opening errors

    Here are some notes on running MS-Access on a Samba drive from Stefan Kjellberg

    Opening a database in 'exclusive' mode does NOT work. Samba ignores r/w/share modes on file open.
    Make sure that you open the database as 'shared' and to 'lock modified records'
    Of course locking must be enabled for the particular share (smb.conf)

    -

    SAx‘~˜\p¹yN.|À^Ç’3ªý¢bœÍEÜ#)ã¨Ç–3æ>å¼\Gqö‚ÃÂkS,Û}Ü^(zår˜¼úåàUƒ¦ÒëD­/ÅÄ¥—ë¾øa~¤qZ‡GïÒ‘È"KUgÃØËeZ eÖ”Bu<äL^ÑHz±_pXøíXHu\O§tRjjJ¦DoZ>Š²^ˆép7ˆââÎ ? oÙ d’m ¶óDEš…‰Îtra}M¦¬Ôž»]ÜÙaá‡ÓÛöÂr†ý°´ƒW.Š…k-/¨\Šrȇ²)³18'^›Hâ'ˇu¤…$œ3!S LpŸíØ ¸_Æu,kÛÏ‘ ªïûÒaáÏÑgkÿÃ%–t!a’y!FÜRÓ´ei¸„ÓL¡‹/8,üút½ó†#Ád¤Ðf!¨v à8&p»>Û ¯·þÂ9Õ®†“ Б0ñèñ‡Œ$×ÉaáçÊ…§°@F2>õþ’ ®öÿORAòq{! hÎ"ò …Ëi\¸ø‚ÃÂϦgò‘b•-rm ü#d5˜áB¼!Ö}íê.šèQnVâÿGóL|Á‘NÂ1è"2z>$‰‡?Žý0Õ¹h\øÁXP:yð®ÈæÀ¤ñ2qÑë’ˆ².W½½ìU&)ÓA˜¥YBœ\øIXP9i{˜·šŒVM}h²Dø‰×&êñw“ÓN™\3 1Œ)"¿L1¦'jyÆ¢èuÒdÒea±0$M '*š¦ŒA[Úü õÚ + ?Œ¢a“¾á¼—ø8ù’JNulJ-uZJÊun`º’´ZDǹϤZþð•Úä}öq{au ªÆ1,„êyAFÇo§ú'ÆB©µøÃX‡&BN†ÜL½ªAG&MÚ!¯C–ÚÕ­iúԈشҘtHÆ¡-ÔÆÂôS1)£›\  ¥ª˜ÝÉáêâÎ?G.»Ï²à«” uB†Rµ™=o{Ma¢115`K˜OjÏúñXøäú cÈEQû½)8U“ÌãÀÔTŽ£[á‡b¡6×r)t² ~+3b!d‚•x£“:B¹ dOi™/¿ Ÿ]! †>b‚0´èHCŸs^På‚…N.ü@©Â^é)]Õ%í ¿zA,TC7ZÓÅÁŒÌLú¤¢Éô«±ðt>RèQÞOáÔó>Ž%ëýpikòí…?^û²-µWhS*Íý`(;‰zQc’¡œéÀ!q-2#DjsM¦á§‡*Æx÷9 ù<m‚Ky¢½Ážqßdøù‘ÏKþ2tIX>e¾‡þËë”ñºÆ˜€±8Š›±d,iA38fBCZb~/½£Ÿêfàÿ5[Éóæy.¾ðsìß=‹Ú ¡è¨ŸZß¹ÀyD˜jRãt„kë#ü­Fu¶³&‡†\;þIx¬^;·žl;\àN…—qX¸‡…Ä1ÿGí… 0„ÏÕ/ôøÓ×!†ù[c-1Äðk2$XE€q†ŽþV,rÔG•¼*¾T’ÙÁ€¹c<¹Ö†Î1Æ îôq ¶êpr‰#VqX¸Gʯó\Gz®–ç\.Xí“´5..î!Ó»š¼„¿—rÁ(©g ez- &-}›Î»Òî[Ó¯• Uÿ1óu:×’Tß}h˜Æ»‹ÌÂÕ;;,ÜÓ‘H*E›~ —ra¦·°àW ™pã=9û7´ýêïÄ­¿ðw±p¿ÆT`qZŽ‰§O¡á){!×\Hf:É%?c ´4&0‘iû~#ùÕu¤æ½¤ö?ï¢úòç=Tœÿ¼ƒÂ'Èr&ÁמÆ]¯¹|ø¹A©}õðÜù”^‘?lȽ•rÀ !Kÿg{aÔsC$kdgFáÝQôŸDr*t íkÞ;NÍø÷ÌÐlO‘Ü^»|ÿ}žôúϾ®~¶—ý÷YNÿìëâçðßöz%bù_åB…IÁ=o˜¦ #%qV]3l÷›R¢aˆFí•ßæyÅ»—Ò1}ŠzüÁ×*ñuñ³½ž¥_ðƒ¯+êÖW¯»~Þ ,³ÿ2û7g4ÏÙlÿ[©ºEþ\Päçm/ø¹AÞádzÿn²|»²˜Ô]:~\Hâë ;Æð[ÉŠÅ YúÚß›œ—5ñeHÕxe˜}àâ×®²&öœ†ìèYê‡eÕÜŠET멽PÊë ÛB¬¨RYcRÁ¨„oúšyCNä}Q•RN1íÛÆ=NGŸ  æW¿þZ?R±ÜÒÔYVj°˜É'[]/7²)J¹®" 1¹{’Ž¾ ã”M5ù'qgÊ)cÆgB”Ÿ˜Ê.©ÔQ-yÉÞïj¦iZÜãÿs”€ÝÅÂ)îLþIÜy)Aobèã­ïzy¼'š-j.S™©gýŸêšœt7¾ küÉø§ëÚ>$Âézâ/¸ \Œ}MýÅ$>ÞÒ‘B“ ÇQ´º‹…ïŠ/8zY,ü¿yª­¸1õ×qÙ½O=QâÆí.…üpG·o‹;;úv,Ð……3¹z_âÛi¼›EX‰7~xÈÐɅצæÿÃÂgû`|‰½pVßÖxê…í…èkÚ—îb;á {Ju£ÊTØÞð:¤ÝÔ=6ûrŒéaŒ”´Þë#ÒÙ'9µÊÏà²aGŽì­QÀw–“†m'*þ_xc朷Ÿ²ˆMù´)¾ ‡•w šF§Œ,¹|®·¯Úwï¦Iï5+~ }É8;0SÃ’[‚ÑS2\Ä ¦¯†ü '5×ÀRšã~ã™Ò³}žºÁPê$¥R,0Óâ»üÏtèeiþýÒ’O­E²xQžç>y·\¸˜÷ÛKÖ¯îø‹ZÞ<’—e 5¿Í>ê^—zjêfýÈJ©¦S¶~Û¨ªF6R¯F˜îÕ„kܾX÷XB®@¨µåD‚mÙ¸)–a$J¦hµÖŒÛâs{œ§}¬††«Á{°9ûòív—IRÀÂ6ÛPn1RšX4J +¼ªd†^©¡µ½=¬NW‡Ûƒ{!Í9L3_N/ˆ’ +LÏ(ëwË…nÇÓ~_uçð¦‰óHš ÕÊPîò5Ô¹PWûüŠšÑÙ/Þ°_eݶ@±²ÄîÑýÀæŸJæ†ÂÇŪ;t\Ê°“Ró@"$_à;…}æ²H€ºbÌÚ‚M vÝ›™ži3SRŽÑAÚ9g‚¿iz®_±r!Œ“š&Z¬ßóDCº˜VjÆsÌ ÇÁíÍÚo%)X{n77pÅNüã™ì{L0õÔ’ÖŸ°j s|…Àý0™$ž&0yá_øµ¶ð€¦-Ãè šäLº!Vœ+qÔFGD÷‹§#øjëLŒ? Ø9$Õ!ÌþcÎí×¥T˜Ì07s˜Üýa)‘_EK/ò¸0Û¤j>‡›ª6˜ŸÛ ›Ê‹+‰¬³®(uH™ÑËd¤´raÒc€œ+²hM>Þ‡•å Ìž¯æuxÉØmrБ̤Ì’”1 +3R+A¤eWX`øvq¦$/VÌWÂdö“´ÁPÞ,ê +äÿл!L§”|JGÒ¼Ê>"ööЄùÊFˆ¾/‡ÖÀ4â±çíîbz]ö _ ¹k󮜧CEýÐx²ö‡IIoFiÂÔEž>L2ÍÝmf,¿"(6¾á9‹iWv–·U©C,DXüá[o;‰zG©ä¼‰`.‡4¦•‘ã ¶iN·a!_‚C +ì\H Ì‘U[úðÑ<~mG×C·¢MÃ[ŠA¤*Ùu$xÀ~bEò¼wÔ‘Òµ b)Wµå`!fëu:1È_®ÿ,´ŸŒ/ì…ârÁ~i+(-°Ž=ØÓs¥s«!j¥åÑÖŠ{îe;ññس +¦íÁ3/$üoÏЖCâ£î}×A^5¾Ðã¤ÚõÂo9°0NÔí(ìuËÈ:än|ÿ€˜=êxÈíÄž‘¬\˜ðW¹ÀËK½4FÊÚ Ó 1JêÍ^áÄP˜Ï0nØjämEÆ¥ðkÛ° +›šûØÚX442د ø0›Ý¶–({Óñ‚8ËÂSïÓѤì†>Téÿ¡…Ógã ã’x’úO6\Êï˜GâüßÓõ[Œƒ«ÀX™ º¿Éi†_KîÝñ©6í|ü,b“ 0Õ‘¤Á'ЙB{¶B¨òlû°„¼íS}Ù ˱é o€™™³Á×Ø÷}"’ÂÓŒê^4ÓÐÕÌØ›Žä Y ˜ E+à ý¥߬Jð0Õm/뢪&Ñ^¨ ­S¤ÙŽMRÝÙ¢Ç!P¹<!˜XhOœç`Ö`¡C&¼Û–}ªÙÐ/ "¸,Á©ŽOa‚êB%.ÂÌCW´ ôé?ß+Ǧ>F#îOˆŸÄýT|!$¢Tˆ/T'««‡§_µ¯i,ä‚ ôì<”é²ÕqÃEL‡ùží|ªý/d[”O +Îà˜Qj… ÂÁs«ÀÔ‹ŸqÆÕËÆÚúˆ”DGNÀœ#— XöÀ€BÒДXú‰í€¥”¥RbM¹j:-e l{#ÃPqkC©>ärõæHMëI€lFå*Q¼˜$ÉÈ95Õl_öê YʹMŸüHèŠâ7´Æ¨Eº–i⬾%ÊdØÎg…HäøÐmáæI:ãMfZÀ'Ë$|¢È&%ˆÀy(PÙfø«&õø‘>Ÿ4.¢¯?wn2ÖÏðõ$”—xŒéªb­ÎbcÉéSE‘”LXGœäÓöð½'BêV5íÙ£{`C¡Ö÷’Ƴµ0…ÂÖiܤ0Á #ßZL¡oŠÂ_pݹƒrúÖe°øÅzº*°b*µ:÷²iÞ)~cµ?ÁiðcŠþWð \k\íݘye‚óÕ蟅¦S¯‹pj4[!Xs ­îðÚ·÷¨ð½íÐÃ]†›!WZ•ož°¡%ÞGQŸ>P"óoåÂsX ¸NÛ?웧hŠ…¯ì·ž¦Væàc·ßŸòW‹mÿèîg…×”}Oß¼·%–¸3'ˆµx»~™9öŽéB)â^žž^¤ËXòÿÕ«Ù=º½†þ/qg’$Éô {a• Åçó‘ž·öù—¨ŠJüÀ¸³ îȵ­x;z¾ŸAõžÖKÏÎr5rÆÊÿ×ÁŸ<º=Õýó8iÿ¿Ê?ÿOGçµËMþ±~ÕGÆÑϤo(^Þ^(¾ª~á#ó;uÌáè5°ðQ¹pžW”ÆSw ‡ñþ-/N¦èn±Gÿ ÿÎ^Ȇl8(-þÙt(ßdT4ooªš]Ñg[´bD÷øÿyeYßb/\…Úf0*b×ê!ÅÊý¸ée'÷œ™?ìuTëîvÿGÆ»³X¥*ïºiklÅèXãÏÑ×Ä>"ÆtÏÓ> QÐ23©¦3‰‹^Ê^å}rÖ‘;;ïÏÝøg£6"£}˜`AŽõL7>ÁU9“¢dÕYs2Åî†\íÿßÅÂ÷ÄÚ3ÖÄò 9)‡t0ä_*“DSƒ%š‹¾ymZ%é›Nûˆ'OF\p1D~5=ëD-×ÆÉ…i/øÑ•®“äg& å¦)EouCj¢EŠTæCl¨h0ÛµVïÑÿ\pXøN{aeÂ^H®½ ×öìDú‰e†ùÐb¶WbñÔ0ñ®Þyµ“ ’2!Dù-öÂ-ðÉ`*t4aŠp)4¦§àRz¤ÏÄÈz» ./sÌø/õ 7ù]¤)/Ê]î?H¸VË·Ø 7òŠ83ª¢i(•¯ÛFЂ𫌋øBŒÝª[tB%ã˜W‹[\ÿŠë/8zY{!É›4Š^=qXñvܹÒ\0‘˜yLL/•×5™}/nõÍACb24F“¬Ê²k8ÔÊ=aGÏR?ø7W·º$чOEæs¹Ýh¤M¢ÉÔuSlÍð/yó&›òÚ70e^aPûmØ.=îq:ú”\Чչ¼ž;L_“³ýŒÞ·ý¯øOkÜR$ŽÞf›¢¾Û(ÈkÛÓª]^š¿} Ó_sÇÏÙ +þÈiu¿~Ë®kü9ê46‡ú‰j…vüÙ#½öãêAýÂëÖµ9ú?éQ|ái,|¨*&ÿ`-Qû_Φ îúT]ÜÙaáƒÔ| ™ÆBnWžÊ»ùØ9=éìË[–èè‘Ý=ÜIºKOlÃuŠ™vx^Ž²EOuG°æO¶}YS\ò|!ö×ÓëìßÛ4¸øÂWaAŒë|wcÜÍ“Èδ묻#˜¢ýQrùó6í厕CÏÑ^ÌEÈÊJ+8¯)ÀŸKªÖŸ#Íç”UÙl2œ‰8l÷ïÿ=CéïÂÂ÷õÙæÜ8ú6j?Ÿƒñëèût$‡…勞èôÛ¨fœS‡…?G)èS¾û^„9rXpäÈaÁ‘#‡G¯N úãþ%eÛæîk8#¬ñtñ…¿GΧz .¾ðg±àbm×XprÁÉGN.8,8rXøÛTqæý¾ TÕ÷ø„›–þ&ùysp pí4taF¸¢T2ÃßaGV¸ò ‡ )ÒŽçŽÌ¯FšÜ³ƒÁS¥“ W¢òð ÏSór8Ù®÷¶Ì/¹Ò¹“ U=Àá¾D¶—(šl>\¯s} L[H\¥"wt87²ë²]× )Aí`ð_& <™ãÂ:vyª —•up8¹ÅsM½Ž*‚µ¥MiìZË5þ]‡Í¶³ ;þ­Âã‘ê}}<îtÈn§Ìî´#ªú°óõÈéHŽÞCQ÷%lÜ”/ØL8¹ð“3Ò7]ùcçµ¢ùŠq”¼[™Z—}ÿ=e«N.|'ÅRÊò[®ÜñÍïê|…ç†pÉÍâ.†°®mpXø{ì·Åüà’¾²Ð$%ÍžœïïÆÎ¥¥y4™´¤Ýû;Þ|_ÜÙaáobá&¥šQ9¤¾¦TÓënDr*t ë{÷0ß·þ‚ÃÂwcá…ò‘(E'èRêÂ$ímŠ<‘NÝKeü!šäbHYß‘Kä‘Žä°àäÂ7[ò¢2fÒ>šwF1~#&Þ>agØ6ú¼j˜}mz~æxd;Ãu™ô?'-{GÿµoêiUÉ·ð}Æš Z¡žäÐAeOç«cÆóÈsÃn˜þypÕx¥”SLû2Æ;ùïiøŽ‹þ^xiÖ¼¼1¿÷ ÝwC/çÃS¡á¦¼Ñú´ÔÄxCäÃ0ãð±Ô¢lHÉòo‰L‚‡‹£ÿF’럶L1‘lçÅXù£÷D\R©£Zò’ñ}±NÃñß%û××ü+FºøaXPaWb®OéÓù2¾p'v0—©ŒÌÔ³¾xw|á€ò¯ç®Qòðf/UGŸ%ÀÂO“ %h5­|È¥Ýy +=¯M4LÍôû©êØBüßc„D²:tXø_°¿-<°°çoaûè–½0 )„÷8F]Ø Ù U‹K!³ÇvFp·]`!µÿ dbŒk;G.|ŸOµ·¦ÿ"ñÞ§×5òVx¤ñ½ñÃwfëÚþ5F²-¾Ð ß#¾ ÏèýÏPýå©…6îüÏu$’X(ȉ8Îý>¹ðqg•\à¶ö>ÄäÉr!!¼ð#rAþs,ŒE,t…cÜ?'.ô…™àËÛ¶oð0/µ¹4‰×2·Ø£ÁkÉ……øp]±8±ð]r¡âü›jÿýèÌvV »]jjN;vû½óÛmò}ؼ1Wî¡¥Þ¿}úµ½k¢+\æï|ª(2'¾M.|£ûTž8Óc¼,=ç‘ñzPŽªréC“2ÎRcfÎË{ +“’'±‡·ˆ…ŽóØŒtÁð°÷·qMÂ8Þkû×3t ÚY 1¾@Ò#¦¡Ÿù*çNGfMð2–F°€ê0ÓÝ,ÙÐ[“N'ýˆU|ˆM©³LÆJÄÆP¡t®¸œû!ñuY±§ ˆ¾ #a¥ Q.ìˆ +˜Ó‡d’~Ó0½/&úºˆÆÞ«&ÞÎ Ìêú1â¦i¥Éx3꼑‘7Œ +@*Ô*”Áëba!éâü©Q.\¤X×2™m–¦®=­zf|Úž. ÙÝÕÁQt74hûÇð8.ëP§³ÛÙCHÁ>ØÈjmâäå°°…o” ª(Šoªý?ÝvFªµH\ Øo”ÈA¿¹`±àO"ƒýþÖÝ…Û«¨O™ˆ+À‚‡Ç7†·´AáeX°™¦’.é”.ÇŒøîÅqœ} }§\hµÖý·`¡=Å[=™`Hj¬^`´1±Ä$:ôäbR0àþêèa½è{±¶ +Û¼°¾I†¸ÆT‚aPi± O5ØÄ­VfÇÌ õ°öÿ‘OõŸ¦Ï¹\½?_°-$7¶d’ 0ºqt­.CÍó&0¦™ìá7ÁtÏvÞÕþ÷šI›Hs†}òÍЀÈÁ˜f‚‡!L>óYä`BB2Žø?¹²|‘Æ[&1ÒÙç4Þ3¥ñ*·/vï*OíäÂëÆUÕ¥NºÌNÿŽŒ”QA‡¶î’ÅÞS¹IQçû0ÀǶ(:I1îL0&‘&¥².F¬ïÄÝ|/ªy®ªÀóó÷Ç)AºN¬SûÆöÇ’\‘Ÿ"¾nðvUתòÈ‹­·Ë_Œì/ä ó^²ˆúQqç§iúš’Ôƛީ#…“7—ñœ࿸¬’ýtÎ}Û¶¥5ƒ1¾A×7H‚ì©,ûvνK³9œ¢¬ËÊÙ{ó²m¯†.ã`ô5,<’égоvžêÇíŒ/é!ù¨öŸsÎ.±@–$Žç<¶Ÿ<Ÿ»`wH8ÇQžgþ»„1¼•É†…ŽÚSEÁŸ7ôc)$Mú œºQ—>U2eq•–/#‹ 9NÈ °7¾– €xã„{æ9ÁûU–&þq©b¸ÎzµíbyWfxÍÛH»Ÿõï9þ¼Gl$~œe? /_ðÚ¯éÜ>SŠÔ¼Ûo|Ž`…Ù2g5Ç {tóXV=á]XØÏÝ0{Û]ó|” $ÈVöí(Ž³õb0ø^Ü°ÍûŸ±ùV2 8ç<ûåráUÈg)³Ë‡ ¿Hõœ¡Íœq–RÔOŠ¸Œ°Ùa­Uu¬‰A…`¾Q4*ãa `ynãÜ£Ô‹ªÖ²kpdþ§±ÁYå‰zPê+Ë´Y¯f‹"Ï‹òª]/ßùä!òxkûHsÛ®³OÚ ã„7àä¿¡hˆ†{#aÚq?d¦Únˆ g¥ÞMëMó —£Ó5¶sÁ5I çeI‡Ò˜Dó8ã:UCÇÙ3ã\b¤±Õ7âÀ[ÂÕY&À»¸/ÛfówÈ…<ËRÿD‰êÏNÈŒ‹ýsÎ IY-ˆïZ¯¦0$Ç™’ FÈæq~ ða\øG”èT{¦S“djs”Ð(aCã½¹ß7õ{Vñ£o´36lëj7œY±c\Qñ»"¢Y–i<“ رAÕ%;ß' = Ðâß… ÜBâgÖüX‡"^‡ÇÌËÉVÃqÞÇÜbœŽ~ÙÔJ”*þ\¢`Fùír!ù6Û9ÉösXÖåØ´^/¶ì ÀBƒEüÌä¿7½snâS/°(›@µJ†…"x ªÍ¢§-ç£KçãÁÍý]ëóøÉ­>{áÅ×ÛÝëqïÄÂrk¨ÌNûa`§ø 7–‡GTw•M.¤—oò›o8¹ðB>ÕŽß²gû5Îä¨1™Lê· +~*ì¹ñ`t.(“CbùNÃù"îLüÖ²S^úV*œ‹³•??……qɪÇ¢Š”dÄŽ©ç +‡¹g1Ü” ö Ô’.ÙØv&#øÿ­ˆÚõ[÷ä‚mp6ŽwçãË„ç^;î|;ˆ®X˜µíè’FŒ«wŽÓˆÞ÷%èB`8Ç1ç*z/.âΡõêTÕ’¤E§çªÄ + ð¨æƒ +4¦íÞ>Mlo¸ëJº'àîQ0ÌÑî¼1Ó,øo¹ÌîÃe}kÓ:X,V.$Eî70HàX<ôLZ©Æ +Ææ|¼ÀèäÂi• h2¯™þà¿×W;h Ù¬öÂ4x¡\2ž^çí¼ÞyD>¢ö’(ë-› $ÂÙ;ÎX¸>„x-\¬‹Þ-’ ,1­º,Þ(K÷hûâðNÖÓÊÇ$éºÖš0e×uG˃ŒÞ6LÖE;–‡…Ã’pZ߬^£$ã'Æ­\0³ÎÔ,ŸK,Týcžf f¯IÏ+–!2k&+“çõÕ´z.cÕ¸ƒ[Ö'ð&&}Äv¾ɳgÇáæF:ù§NiM3zXÓñ“rø•Ÿoa<`Ö½¿ ÿÞÞ›ãlX‡9ð|e£q·ëá#ñð€õPØ#…a‡wQšá»9\ì%ÊVŸ‘ çü{Ök›¼[ú`(˜Ñª# Ù4»éÁA“ ä °®r¡ +¶sV]¤ãÁ•ÂûzwåBØ©úÄëN@@3(ÏŽQ @}¶{ðh‰CçkÔ.Ï£õã’cdüp,`*;°<e.Ÿ½y^ìÕL~Š\ø>ºÝ7/†9À˜ÄM/}ë\öÍ«¸Í­ˆxXÚQ°vÇãBðw¦ô°0’Y³MÈí€ìr0naaõÙ³­O&z>ëúI?Œm3>f«ÛÌ6«¤Š†0ºŽóÊê6™}+C¥Dñ<[¹€*a‡_Ë8Zi³kãÛ 6;°€AIÄv”¿Œóéµã átO×9í¢·^3-·O>½~w“¾#¬ %hßÊÑüœ)íløÀ^d$vNEõ"N¦ë%žÂ ¹ökl'çMÃ'ËÂY%~ê{ù‰ÛØu€qÉë{Ù +HЭˆªŽõ˜E ¬¨ÈW½1öàX¯²øÊrÂBÖæpѲ̂OzsÿbÜùåèˆ;±ÎÕ[³Ûg°0««jËHÚd¨¤ÄG<<'¦³^¸x[Ü9Úd\†þ ®Â€6ÖMöº³åb̳€#ƒ1´^U6ûni$áêGò +’c°ôÆõØ0‰íÅ×ø bÁ;ó’Äëº×p$ý¤¸ó;üDñ×äô½b<`Á*7´šÏa¡8 ;/ÕÊ[‡L Ðdªƒ‚^aíµU—Æ'°àír;`jãMÕ!;±0ÏÇ¡(€8£<² Bv&ÌÑ<8µäö¼óþU’Ú¸ù*ÖV, ˜ÀÏ6½HÕø3r¡AúžþèeË‹úõ±qêûK¼«¶-ã3,sþ•X˜3ßO?^Ó°‹`[g϶ËÂ!@ÃÏz™ÖLög˜')@)no`ÁºiA‚ìý¨ès]¥ÅÂÑö*Á¶§üHBˆïñ#Ŭ>DÊšºÁÿÔáïÛ;ëug}^wаþü¸¦>œlêËÁšÝÆâ)Ÿêš4:G_¦#Ù<ÕþøSvÙ1ÿ;Ü9úóCåÐ +ˆË}×/œ'ƒ½AU\P¢ÎÕfáÞP›‹ú Öâ8\d\².J§qçÕ5Õí|¥#9ÅÊÑ„z×k­<÷Úñ…DS³õq‰t‚M€Ñj£‹ÉÃô‹Ñö3²Ù¥¶oF*/?QÓ¦õ‡ÁfQã`>F ñdŠ­ò"½àb¹îŒo—« y…ü í… ˆ¢(ß^‡Rà<ïn$Kt(]ØðPÅÞýYöª–)ÊgÑ Bã¦îÉ#6¢m}Ä‚UAd­“ðèÃ=“ ö Ii}Âk>Õ*²èÅ°ðÚqç™rFvõ±Í©ê‘SKŒ€yØ=5í±€´xd€;ÇþÊ!Ò£6} Ë6lÇZ÷#Ø¢`{¿ ‘{”h'Tå³qçÍvοT.\•µq—Œ—> eJò¹íæjóîq5Ž‡t¢=°€Òø²æF^–AîïU«5éðKH¦ÝE+ÖÔÇb°NÂûùH+hâ¤T˜³µzn-5­?N.¼Äú ¯äí®±ð•¶sŸbV0y·ùè¬e×ÔËã2;T¶åd›Ý÷´³« ^q‹hˆ[¯¾Ö«ÐZŸP@ UŽÎ¢ [„!Ç]4-d/OvrÁš Q‰ GŠË>Ú>ý*ÊttráP!¤ä§ø‚õ#U_‰… Îv4W—Þ­ëG‡f–i·Ü¼°k÷²úX˳ÖñŒI•Yq\¦Ž’FA•e›mŸ°08g5:Й;cáÒxC.„ÖëU›é¶üÈÞÝêGê^¬gÆ3rÁ–t;ö¿L}UjkC]½»Usš;-‡n$AØiô̧:/)ÌÌÛk!o„ÐÛ?Y *Ô’Ðv=uȈV<;[| çs0)omù`bŸ°€5®ŽÙXëÞH®å‚÷YÍö6КCbcmŸ-rñ…WŒµ-½&÷ +oÚ’ˆ-ÇÉ®Õä¢;š§»XÛ…ºÁùᕘÃ-3c7?ÎÑÚˆ7¹pw^SœòìÌÒÁvù±«ÛO7‡ w°#8¸¯ò ›r%ìÚ²òÎ)žÃÍôzXpqç/ÀÂ6áßJ«ý©mƒÈÊ‚57úFöÍ–îå#íÇô¢<˜¯ÅPXR– '?TtS.XŸèšÊ±ïjPXÛdè`EÈ÷÷Xغ@Åó¦®å˘–[¹Ï8ùg4·óTWQ<|ˆ ïwŽ½tíZ<îcm›wu_MI·Á±õƹɳOÎüºÇºÐŸ+¼²,Çþ÷ýHø5ÚIñ: Ãf³Ô'd—[óáVW¶qÿ3:ÒVä%üòç0^7Ó¾™§æñ.3oK'©²ÓÊ6Ø8tàúË6áè­Ÿn=\Ç.КN› àçÊçS}#¾p¨ý®;1n…Ð[â¾µh¯ëÂø<•çM,,X+p£^bËù¹ã·¿Y¿0N]päçC–E¶oçn¶3Hˆ% +ª¶?}H°Öиs5ï_$é»*ÈqçŸ)Þˆ;/[KG,V9gÏ0Y‹6±:’ªl¼ðanµ4ÏbaCÀjä½d5ølßQ¿° +%¸õ}«Ž3ûÚÆÚÐá;¦Øsï#ÓQ[;“ ãÚZãLi$xîÜmqç,\ÜùA>ÒQ0äY5í¦Â1ôm—ùPϵiL]t^L?ϻұg°°»ÚÙ@Ö§ZUï냱vfÝ´¤ëpà¦DY,ØŒýlo3±Ž:Ò^¸Ùâìl>¡>LZ 1ÌËâäÂïÃÂÙú +3Æž–â¬îÉk‘­ +aNÃí¨[Ÿu~ ƒY-«AŠæAšY¦î’÷õÁØêÚVo3]Ž†v¶·:”UȈMÁ8eòaÉç¡ÖnKÇ‹BkĪqX‘½3e§®~?W.dRÈÒ±ÿ¹)Êso›°fêäÖq8MÑ–‘œ¨+àF'Öǘb¦éª£„ÏËÛ8l»Ú6ÐäuÛ@YÞ%¾$[º¶šåØÿo­!8¯í;ì<Xô†Ä|Õ ÉxìÍ·“Ú¹¡ÝPOì±¾uÞVkÇ‹Ÿ+¥TãØÿA|aeÏ-o­²yÔØ ~-<Ëöù>‡i³y2›ñcó{Nµ4Ïaá¸èA³¡{}0Ö‚þµ&Ìç«Æ4GžgKˆ°ó Ñ®r³”¢¯m‹¶™Ö1€qj[ø½©^˜²‡Î[c³Ð]|áWcØ(Øjsìê¾…e+Ð +.úÁ!U'8$éäYv +"?……­9Ë~ UNäqýÂ-/±¾¤ÜjI0õWkú“’ðÞ0©.ßÔ¦p“~ˆöµp¢:h€+NðV¬º7® `J–Ζ¢pqç_Žûô³cÝÍ¡æà2"†KKÓy¶wâÖú…·«§É2[_Í®ÂØvߨk»éqEó#l›–Tå[2’ÍGš ØÎŵ‡vËbá¼ ÂaB‡Ýmû™ÙÅIª}êyvì¼lû#9¹ð‹±`'kÐPÈíkÙ©vr? Ïǃ0Õm‡3wPRb¹BðV¡‹]°ÍVµ­¢”¥äázmq5¯NÍ+- «{æÊ–9ƒjÏ•] 3’<z˜ò±5È$c€µ×ÄÜ’]HŒ!ø\¶Ô‚Œ[~Ðáٮ+yŒŸ{Y~œ\P˜oà8ÿü;©²9¸^Ç“4ɫή¦Ófy2ݪ9À@ð ¾´«hzþr±ò-fÓåþÛE_dL½|> ”ŽÏS›§wk6&)¾V‡?ˆ1‹©­¶’7›âwLT¼ k1Í© ¢³V«ã’ÏgUp(4%‹ŸW‡CýÓ¡ÄǽñçÉ…NJÙ;öìSÝ%®‘É·K2áý%Êñ ltaWW¾ÌÈŸ[º|«jÛßn6Z—΃·ŽÐpÁ$¦Ã¢ÒÛ›»c»hÐtyIôìþ×Þµ(ÆÉ*aPQX.º +¸°ïÿ–g7Ýlú7—¦MÛMò­—AšÌç {›î«½Ýúl^ø·¤Æþ.ÜT¿¦™áÛD¡Ÿ+ŸVÑ‹JÃHø_×_ü·Ãç·®Æÿ¤ò°ÿB-ÿ@©váSææÕòÛKÈ[™””8ì3Éñí0ÜË­Sç©þR)§å®\ø‚û- e"@õ—laòǧì ãO´ yýÂTÕÿa ɘsåÂ:4ŒëÅ0šÅå¼Ê-É8Qè®ð¸m2ï»å>à +Ù7Z†_øÌøB-¿ÍCJj¼:7(÷öº”wÌ…÷ÛÉžn-› C$¥:í)þ´žu¦…ºÆ+þþ¢Gg§TK)Ròà‚S'ä°EvÕZïSbYËBÀc‹Æ•Øãm!a:­Ï Fµ • £YÐÄêÙ GæÙrî€ iS‹èh’‹l¶h‡¾ï÷eC½Š 0'yY½t™/B¡zãĪ]øP9ÃkGW.|YÇyP#ÕN¶jÃ’w]³]`œ$‘À]Êý› ™È¹ñ‹¹Hè_4Wä/£Gg-Ü\rr¼Ï.4cÍ›÷b)F/+¾nÉw™ ›šNŠv!ŽLéÅ%àB´=BeCSMd>hA®VbŒ!^¡Ä‹Ð~/ü‚¸s-¿ §ÌÐpË ?ìÂÚÄ“h·Ì…ÕÐc*ÈÌ%Ö§ˆâå¼È°s!²ue§òwþ8jÜù }¤8ÑÙI:FÙš›]X Wr.Ð’es&Jã „Üfè6œ{?eWéº0ZãΟå#U»ð•}gÊí ZŽSTxÀ…<ºœ™çs›ä?Häi·Úz’4ó‹†þ·’ã$¤å±5V¼©r¡ÎÁøãÆT™Hô²ÌŬÕMÉvtpÝì–,ÙKæB€ƒ¤QDT/À›' +ZΥ̾éëökûƒÃÎÓ8¶• _ç$A¯y¡Qºç3N¾ƒi.¥äjÒ: Žh°Šêì7M¿k{Ë>žæ\×þ×øŸUè(Þ3é.‚‰»°ýhº^/T.ü¥–¡{ó¶>a;íÙ†þ‡ô©qçÊ…ß®Å4½\Ó ?ü¤ßùýÞß½cY\(õ<(¼hCµ • ¿› +¨£¨{ÜÇ!míËÌMÓwö˜@Ýþó¹îãÑ÷Û…¼1é\5ÿyß™-+«\xý¼ë|(q­’5SsaœÈëožN&zq´‰¾»OŧöÌ8yˆ#2°æV«ú¸ýÛõ'Ž=Õ~û‰™£áÛèE<üõÞb–ècµÕ1Õ¼ŠqvEòN ÙÊ‘` +Ê,ir&ÙÛef"tê†p¸OåFxQËmŸkðÓ…d.”3xßj"Ü‹\! …ó:ìÏÐ{>Áçpˆ`¨’ +«?w®ñ…:ãT¸!&Ý“Qˆ•bk¹p ì‚fS&¤K´çô¤¢kH¯{.E«7Ǹ$ ÂÄ]Æ®³R\(n¸t… x RL³µ÷dh¬¢¥ê$eóÝÁZ9a'$è@„\4‹ÑÒ† ôf™\æV†wÇ*jÜùcT˜<Il:¯ÖÅZx;*b¸<©WoYäI‰Ñúqjl|×Àñ-f¬Ñi,/ßФ.££ˆCbä~ÑÙÉ‘nE\PÚú¦÷òâ"jã2*±ç¥i¢rˆÇ•Á‰áñ½’í¦Ä…¨+EFšdG?bªT}¤pa1¦ñ'ä™1` „ÔgôˆÀÊÓÚÆ&3sw%Â4-q›àXÙó•H:¨&Ám£¤Ì7×ÞwÈ÷&©l2Lr'¨^ç ŠÈhé\oƼ™{ž°tK5‹ BPsBPñÕùÁPå´rWp–¤›«]ø» êœí7 eNœsàüžô"“ 3uæâLÄ™NÔhD8W¸ ûˆˆ A[¹I¦g'gËiŽ rfj£½oG•‚!™ z•`ÌYp° q@"å~HÕtýŽÙº©ãÁrpºè$œ ‚¡AŠ`™·w„Šç÷Ú…~]׺~á!Ÿ—ÎV.¼BIÛÇ6sa¶ ¢uç"ÍÎ…èÛv» ›Â A*\ bÑÄãd˜.ะ^Uއܪ³]™ à5VÅ“#¼®†nRÚ8‰{2 ~¡5›œv.p]ã 5¾ð{¸ øÕŒ¾EÞj*9øHi†÷ünà˜ÂñéÚD—="° kìõ& V,OÈÞÀŸš(™S]d»piü47ÑÎCöå4ѵië[=¨…‰tE¾5Zë؃üåJ¹ +\.!³]X<2À4èˆäŒòù@R;W.ü:.,Qpôl…„÷´ðB¨ úÎ`ò’}/}”\HJÊûxÂàÃ( „¸ Ú<ã:«ÖÅ.\f…TËyQ lW" UÇ¡ +œ¡Ýc®xŽ7`àNRAåj[á¹ñbœç˜D.å2ð ŸGíª]¨\øudÀ­]‡SßÅÓº >.Hct¢èh³,ˆâ~mØF¶åMì.–m4µ ø?Ú÷©†Ó!4SþgÛ¥í{ÚOyO0¸S´¬M›ì,§©Yíxd-o·€f[ÇÝþ¨°n8š´´æÁø”À3”Ê…W-ƒÖzߊ–Üì鉎¸™.¹Š4Þãm4Gãv2 Ó2a(”ƒò®çeÊåðIžÒN%­Ã~tè÷>»)bøp»•Þ=š³èwÇÆXí;?Œ#Õ’$öMo1qô×äÛÆ=ßÞ[3eäaÖê[ã ²òˆR;µÛ4ofy੺óŽmF +§{¸m;p˜Úi»Ã0eñ©-ÕLm/ˆA ¸‹ßaG€©TÓê"–ÑâZ‘©‹áôñô‹ø s5ÄÛC¼-¿!ˆO}©fjŽj²X³ã_Ø4­åõ‚ð(éñÄŒÞ_ð>¯lã€ë nFœsv.¨ hÙ`.€Ëfq·ßÄ£9b¹‡¸¼«f9ÐO€—û"¶c^Ž?”p¹»»¿¯æTnÏ‹Á³vçÆßð(®s¤Ñ•FXæ`ø¼#S-¯•izŽ¿î ?%ÓÚ·Ù…oJü.¬wZ¸ÜaÖÂÄ%ÞÅæ¢Ô»ƒ ݸ0Ø\hŽ-LAqþ¦ÄöÙR?pA?p¡=¸Ðþ'Ôèkù§Šú » ?Ï.Ì?oî(õš]`ï· Ï©dNÊG]v¯_ÿÌ×ùo¶ >’)ø=»àÞfô›ìBuáÿ®¬QÁ¿ü÷'€ã }FÀ…¬ÌRŬ¼`¯â¾àa<â7$ vÉâQ©¾`/˜ÅùîsG;nOï +ª¦ˆeÔ€"S +Z‘©ƒñõNür‡¹”gAk†‚¹ñ7Dp97â àt‡<ŠÿE> +stream +xÚ`ŸÿÁÁÁéééÒÒÒ±±±fffîîº›››ËËËVVVÙÙÙ£££FFF666µµµ&&&ñññùùù‚‚‚­­­õõõýýýŒŒŒ“““uuuçççÞÞÞ©©©åååÿÿÿ >Œendstream endobj -2211 0 obj -1049 -endobj -2197 0 obj << -/D [2195 0 R /XYZ 85.039 786.531 null] +5263 0 obj << +/D [5261 0 R /XYZ 85.039 781.388 null] >> endobj -122 0 obj << -/D [2195 0 R /XYZ 85.039 686.185 null] +5264 0 obj << +/D [5261 0 R /XYZ 85.039 758.673 null] >> endobj -2198 0 obj << -/D [2195 0 R /XYZ 85.039 662.868 null] +5265 0 obj << +/D [5261 0 R /XYZ 85.039 758.673 null] >> endobj -126 0 obj << -/D [2195 0 R /XYZ 85.039 231.018 null] +5266 0 obj << +/D [5261 0 R /XYZ 244.345 359.014 null] >> endobj -2208 0 obj << -/D [2195 0 R /XYZ 85.039 213.279 null] +1446 0 obj << +/D [5261 0 R /XYZ 85.039 221.947 null] >> endobj -2194 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R /F20 1617 0 R /F70 2201 0 R /F71 2204 0 R /F18 2207 0 R /F41 2104 0 R >> -/XObject << /Im1 2193 0 R >> +5267 0 obj << +/D [5261 0 R /XYZ 85.039 200.751 null] +>> endobj +1450 0 obj << +/D [5261 0 R /XYZ 85.039 117.943 null] +>> endobj +5268 0 obj << +/D [5261 0 R /XYZ 85.039 96.082 null] +>> endobj +5260 0 obj << +/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R /F20 2865 0 R >> +/XObject << /Im12 5249 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] +>> endobj +5273 0 obj << +/Length 4410 +/Filter /FlateDecode +>> +stream +xÚÍ[[oãÆ’~÷¯0ŒDû›‹Ý™d’8'›xÇìÃÙZ¢GŠ)Q‡”ãñ¿ßº5Í<,c’ÝÕÕÕÕ_WUw—ÔeÿÔeúI/ãDù&I.×û‹àò3Ôüp¡„b)$ËÍûû‹Õ÷‘½TŸéåýcË'ômh.ï7ó¾ýñÝíý‡‹¥1ÆS©¿XÆqâ}ûév¡¼;.½ýxóËýÍ/?à—…Bå}ºÅê_?.ãÝ3ÑÍ/mõ»ÿ|ÿŽ¿Œ,þ~ÿÓŇûFÒF*E1ÿyñ·¿—ÒOoÒäòÞ_AõþäôCk仸¸»ø¯†×ÙKn5¥•Ð$~˜˜±ZTØQ‹RÚ7J_Æaà‡%½TY}Ê«S¹XêÄËëÅRyëã78ª€ë°¤‚ÁžÊíŠuêe‡ÔCqFMˆÅ>«Ýa$m3P´µÆû®<üåÄ­^ÐSYaå+—ìùùJ5ÏÜË6ïßñOÎÕ1­kü‚.¡ý6;pÕi _»ú_q@#K… +Ki€u¹ÇfÐÖ&Ö+ùI ˜Õ„^V ŒJiTYQ8² VïåyeÂ5–—û}3V*Øe“f›Í²^Øê›æî˜â‚0(vO2D¬hüôŒÏš›r91¸#Ö£ÊïÜN\yåi›W¨§8t‚%•Ì™Z…oå±ÚÁƒY5" OnäŽï¦BÄ¡wÌ m[¾!ð”UmqãÒ¢<îsîƒëi ˜0ò~Ë×N,=&ÑëçõBÇÞ¶;øÆžÕ¼ö~@¹iŽ€K|¹í Q†K÷eÜ;õ3—ãÄ £5/Àñd§œë]‡ë¢¬©¶xe\a¼#·¯I½ØÃC!M_v8xÓÞ·XÇVÇŸ1QªüìÙ9óס¡u®¡Vù)ª¦]çØžÈò:“úÐ+Z¾0 …ð@4Qì½ÏÖO XS05õzN0áwV°–fÞEQàáû-b?Ò^á`I_8—ˆ.ú U Ož¼Wþu!J•-Z8»¹E"ð8PÉ®^ø0ÞÕV¯‘Bö +´”€BÞ#C¬M<·‚pŽ˜ Y àSóä3†Q03ëµü\eûšMÙ¡ ‡™h6:(|"H1PÜ]äË*Ï6¯\ŽÃ†šBÈؾè¶ÖXúÞä¿ïÖ4] ê+¡Ý‰<™H’»õ”UˆÿñH&µ‚O©]E£äïGtÅïÍé²ÆØ>6óÇuWǪ$·‹¡-®˜CùÈuÛ-™ìÏÒyG[¿aǵ´Ã9n” Éùý“%#QVOPóÍØäÐ TÔÞ;Ö­z墢#6*ˆ~ñ1k¦ÂÂ`>ô90¶ñ­ëTÿùœ?ç\|ÈÅ+±±T1[1¨øM¨ÉúOŽŠ±ÃÖ°#À×fbyâ©wq$È´™6 },]’é¹v.¿@1QA³QÐì ÃÞÃ”Õ +õ»SÍ/›¼ñž»CFŽ¤< QÕÖû¥"¨y’6ܹQåä¨@?– ¾<× šQ¬–Ô`&·yÍ‚²ÇîÉÏ…ÕÔ_yQd_0JˆÒ1LÁžuü5pZKä„5NTãQPC¾Mó!v™T·Q\$c¥(-’užçLöHFbÏ\ðòXRÈEkõ¥Ux‡]H !Øû+ ˜¹ˆÆcÝï :U­Õ)0Y885ƒFšéµ‰ Gw5î`±Õï‹£Fc©+ŸÉ,n™ä‘ˆo{4$Ž_P¬&j‘Ð54ƒL+ʬøë×;XäAý”§±ú™íß3T¹:sD~&—¡ }¥âIoîh–¢&ιsG„]?×£uê+ìl‡B3ê°?À6'êuw¿%Ëa€Ú÷ã½õÁ‚?l„²1©4‹­9rVÈ>ݽ§5º.·*ÖlLÏU#BÁä¼#À‡s3íÉ BŸ&ÐO“°b1ØXN­Êå§ø¼éÆ°†MFœ»š&~õ½é+0†=$ì$Ý\]¯À\¯àeUƒY¤‰¨ô ¤´Dg"Dl‚«I½>AÂ$ÔçûšQŸ}°ØØWQÚëSàÚùøêê^˜g`™{ +ˆ6s©pxWO!ÛÚÐí‘ÍA¶6¹t0ž fð„f<ЕÄ›e ÛÃMãÊŒÄÐØõ÷AÏ.$˹|G“p +#_%ZàÄ +`DN¯wÁ¿?dÏ›S* f¡eñxD«óÐêÍCËQ˜-èø¢ 1ÈÁØœí\hF«¡´ +{3ÆtjÏ™$¬“„¯s&I§|n SØ]v7è•4œÆÖ¸fäZ©òU€Ð¼p.)N¡6;ïØ“.UäG¦ëNò/HÚ˜ÞuŒ¶ö8­d +Äl³\F(³äôf:ö£  ÁHh µ3† έß@WKt]BD8_×h†§Ü\dÌùN…fÔéÀÍ¥>ì){2ªl f-Öõ-–tQÓX.¬ í†‰€ˆv·§w¶Í7ýVÎÆ …Ò±¾ÜpýÎáô‘×Î3À,²‰ƒYà+Z×nýƒÌóŽ!VWjb:òcm߀XKtbB„]Üâ¾a„±Øâè|¯B3êu€±È·¦ß«xÇÀx‡"PÞ9¡àmg`ÆøjÎU¹žœ +´üùöãêçÛïøcÆ3BÍpN…Ý-}N~ÒÂL’Ÿ„ò/¼‰5@š ²ýq¤µæp _pµ6âµV#a­€_» B&g•ê™°Ÿ@a;ÔÔßcèØNlHulÆ– '¯äjwî¨Ùˆ"áÐ÷b?Î÷b=G‘ðÒ¹¿à6ÍNb|󷦶»3­ËõS~Û õJA¤à+sªù}„ ?“7PÝAµ¡;˜Ð l¬9ß¡ÐŒ:Tý¸Š“^‡.ÊÓ“˜"¼ž¶ïعhê]Èvs{Ë/ˆ@Ts­0Ú¦ÃóKêbFV(évE÷0›à ǧ: d(•œ|×pD¥Š½€Æcw:TâÂñêªÁP½u¼Š$´‚'P‡tq3&¡Ÿ(ç¿aþ¯„)à/5>/SGÒÙ ©ÔA¸¼ &: +}XjÂÕÕ,,­ùâ2#Õ¾r ˜z¢YÿPÁ;ÿaà¡ÁYØ®às‡IaÏ_ô.qú§<”°ZvxZà‚G„ò­Ÿ£KF«&ò«æx—Œb_Nº’ÕȼZÉ? ÖgtÂÎ çôkÈêx—5 ÁˆAœÒ•U„ — 3¬?%œð:/\(?€Ø£+ÜÙD§3oë†æŒ­f +dO§±­6€‚ØœíNH†Ý NhÈv»“C“ΆX×%ôàvrh¬±žì<¼¿¿å··£­M2µ-RœTBwqØxK•'´¥`¸Œ 0`1Ò?t«k1K§æc¢ò gœø‘q™ò×}AqÒ—‘30£xßQäatñî³™‹MN`pö)ý“ ¶ÂÕŒc~pB t#XwW‡åt>–ÏîìÀÀ°p‚n]× à:2jÆ ¨DûÚ&neiÜ@â4ë¢BØâB0ͦý¼íÂî¡ >çt ÆÁhxªOÌŸ²Ž×²Ãll9 ‚ôã(izœsì‰ìבLx—ÌŸª';šä7„ Q¤è«Èëx—— ;swÆAXk¤¾ŽlÌê ÑÒÄlÔíœ{Ð,¦·üC‡hÞA8"š¼=åÒ|„¨É} +ͨϑ—¢¨×§¸‰$'*@9æuŸ÷À†5ãÙˆëˆ+]{W´9LÚì=|Ïøñßt»¾))à—–xDÔ7†‰»ÂÌöKç2lÒß¡‹ö@MNÙÔ D×ݼ‚¾=¦ƒ¶’i†§l”1cŒãŒ‹ì÷`Ò^`×û¹*Ÿ«A ·Fnƒ9[:FÝý:_‡›®;êðw£¢Ä•‘Ö3ñ»¯Âþ€`¯R!ÃëcV×0ºÍü߆˜†´3èqN …΋ðÇ;ÖQ +ûÛTøQtb9KH[ƒ«–ÃC˜ØÞ¡óÒmµl±·t È”“|Ã6n9½ºlЂVÒWÑ!>ÝÝ(´ºãøBÄȸAxÚQ #©­42X×]WQ²B£©ú¸ñ°ÿª°°ŒtÇõošD^܇¿,øˆÈ‚ò™\ ÉVð&Žì”±äæQ4‘w¤âÉ{`\ÎM€v]=”‰ñõPb +¢Æ˜2wA+'éb!¥N’.\2 +~Iþ%¼MžU`ΖóÑÁBY½.ë}U°ýîg©YÚýrÚ%bAÕèh*Å‘ÉçJľʛ4]š:1awÚ i÷áÞ€¬0nY ”ðhŸðècÕ²›Z)qâÇiجŽû¢SúU䇆‡npB¬„â&7«_¹„bZ‹Éõâ v¨¤éëHØâóC¤9·ƒ‘.²š[Ý5ùeE!|*n~Û´Ã~¥’HPíÐO0¯ÉF1åùce“!f)ñ²9ˆ‚*w"¢¤¡^b—dîœö»ÎN»Ç‹@ðd—Õ$V4¦ !)+nsæl<ðXXÙõÄ\Ò˜ùÉÃÓhÃÈûõвÖr¹EmÖås±á×—VŽt.-m¼ei•cå·Y#Dg¢»¨Çyºª;iëë]†Ù²H7Ø*0ñË–óˆ(7šç«·Û³ÝX5RÛ5Þg;™|´pÔ\ÕçíÄq×ÆÞ5AÛp½ºâ¢Éllùe„`¸n ¥‡ÃÀFpÏÍI;ðÄyüî{®eiÈš 4T–ñãêØä–>~Î"E4³"x›…õåT~å×Øž,E,"ÔXÉ%W«^׊3ô(_èŠ)QP¾Aç¬Na&≛ß0 Á¦—à‹]ПŽÇ¥Hëeç’gq¬ùc†‚·aÓÜXÀdz3ñ “–ípƒjL1ßëv~>ƒ™Çœ¤rJ2'"7™ŠEAúÇòiý_£Á „¹Jús;v|ÿ­ Om_’7 Õû6ñ\…^g­”MºŠ&sÊ‘·€~<éä›YØi*~V¸óOp—ÿê˜Ù  ±§é@ño‹R›Æ|J;wGEËÏUs¨éendstream +endobj +5272 0 obj << +/Type /Page +/Contents 5273 0 R +/Resources 5271 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5257 0 R +>> endobj +5274 0 obj << +/D [5272 0 R /XYZ 85.039 781.388 null] +>> endobj +1454 0 obj << +/D [5272 0 R /XYZ 85.039 691.864 null] +>> endobj +5275 0 obj << +/D [5272 0 R /XYZ 85.039 673.598 null] +>> endobj +5271 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2214 0 obj << -/Length 2999 +5278 0 obj << +/Length 3109 /Filter /FlateDecode >> stream -xÚ¥ÙnãFòÝ_!̬Í+À>Ø™É&ÁØ“=™]$Á -QaŠTxŒí¿ßºšlJÔÌð٬ª®îª®³iáÁ¿H#× ³E’Ænú‹õáÊ[ìó¯+_(¼…r½8BÔÍÃÕw?ÆÁÂ÷ÜÌË["yØüáüðÓõ¯ï~[®Â0t”»\%IêÜ/}çúöæ¡Ê¹¾ÇgàÜ?,Óй¾{»º~ÿáîOAR˜îû¾ó;<ÿzøåê݃µ…•rUâþ¾úã/o±mþrå¹a–.žaì¹~–-W* -ÝH…ò^^Ý_ý{àÂ8µàY3’®T»AƒÐsÓTÍÑø±ÆÀcP‡ògÔñ§ç'§BD®Šdâ)SDEO?šáù°ÏAWIàuÛ.W¾ó¼ R§n6õ¢eìQu…¸/ø'oº\HºšIú#hû¸\Vfib™ÿ^SßÑ•™²Ï+YæèÍþæH)øZæw úµîl¤YÏW¨ ¾'uÝêŠQ{Ýî]b¹OZ‘y1¾E©½ÄùDKoHZÐÕ3i>u²ˆÑÇ&_±¹6_ -£‚œiŽ|b0뉉}4i?y£¦ o< 4>ž{÷À$ì7¤×%!aF]-ºÐ}aBv“aFÓ" dŠ”ìǶúŽ1úUË«|Á= R$!¸8à¿…üx.Ê’G½Ù–Ô¸kàCMþ½ -´pbŒê¡©-›a#Æ 8Ý/ÅáabW€3³Ô`Q ñM]6ðU % -—;7:ÔƒÓQŠKëŽGä3ei(ÂÌ~ˆ9C, ƒªægI[ÙÉþÔZ1dî˜ BK]T¼3Ž^/²‹y]µ<l?s^g¤Üä[RdÙ±Û`YyŒVN‘„¥D¶qʦ\FV> -Á¡4nÄhÚÂ=RÎtÚE575I>ÄPW¹‡P¨'†ôñHÞ±“åD€ã^ …qœ?d›—l½À-”@¤T¾‡ÏØ9áT¨ÊžÂˆRt<„œœ"V©r>QÈG&Æà¸oÍQã<Ýñ1P–N˜b4F$‘@ì Çm%Ä ó$Õ"ðù)¯ëªÊ×û{¦x;¤,xÙ‹á„YDjJ5(t6¨òúhå+\ ”ò²a_8w]âŒÌwŒìÆ´Qí>—ÕÆÙj(`ÝœS˜ìÖŠƒUd˜6fÄäPº§\ -á{ Æ„1ŸßÈÌ0Þ›`?õ*NÎ@XÚF¾RQàÜë¦nk„lÙA¡`sx}ä[íèl¢p<»HYîƸKqCLD]C -A¡nd6í§ëÑ{FÓ"ÎèMÞèLÒ'èVžãù@¦ÂxÊ¡19…•wã0†üLÕÐãäºj [-“Ÿ¹&:YªÉwÔQ¯f*k˜Ô5ö¹s„¢eâså‡qÀu à 5ˆ~,s†N2S,&³,a‘Çgã`N`YŸãYèØþ©AòF;ŒaªO<ç±—T϶™!ùœ™Ïy$t¹*Œ5Yw<õy@b¸ÞÏN¢]²!”T\8kCµ2’²[JŠú-éK^Š-?‡3Ò&§¬»¹ð¤{SÛ©œäG‘¬ì 0ÊA¤Û–IªZNf6kü¤ø„Áë±32°¸BÏ0ÙKv×½0Ïv6½Bo¥**—óRoš;–GÜaÅкŸ 2m¦âhj…2) –½3 皯0´%Á„V”ÉDß“¶È8’±½½"©WPMNê¡íMy1ú±>ä]†!1 ÖÛHóhLZAÝ::熱”aŠóÄPÝÔ=×ßLdvQ˜ém/ôn$9­d—½œGHŽ.“´&Õ¬í{Ó–tð0l\ÛAØ -D7µ#Ö®¦)»Ð£&¤¼l¤2¦Î ‘kt›®0ë衪ðÂâöfÆ@‡’Þt×ah¢2Œú–™“°5ZMÓà å8ÙÊw?†öŸ¸~, ¶»^r‹*hŸIö(ˆÀ¨¿ä%ÿÉ¢êòÝ\è7¬ÛoN<¹§XáÝI8ÙÆ úg’9ƒëQTëK:x¾‚4Çò¨bZœÔ1Å¿©¼ÖC XÅŒÏló‡žQ¨¦?òyK„,ëa} -!O=;6Âðð/e}Ô~ ÈíU U ÒShÑ&1"\¨dµ.N4¯ÆÓh—æKˆuÝ1c•ø±sC¢­5—µp<ï~þϽ©Ætß2òì’¨Z›‚´ºÄ0«0²UfdÍï4y(ÂgOm ×¼Çlön+²È7:K-3$¶’<‘mÉ Ê2ŽuŸš…«{κX{̵jUžoòËêOõÐ%åÓ†wë_,\°Þ£",–ãÀÑÙ¹Êm— ñA?™þ*“¦f¬]¼PŠ…áz0%z£´rrWå^´TIÂPq³ò´éÛ©²¦$ 89T²dƒÂ1ñMOP*…‡ek2¥šàå>gìta©ì…q“lI}‰p¨¶Ì²ëœ°½—àA}ñ·#q€mfkœ=€zB°ÄX’âÛ¥«8ø òØL‘Á¥ny”–Ñ” ¢íÊ’µ†… yÏ‚Aqéi–;è—â€LûÃœ9¸‹V& uh×ðúW’­ÀGïħ̻nÌ[;+‡ûx’uâØMý@.§×K0‹º/IüóÜ$nš ©6Ë›ÌWÈý¡Ôeç:•H)åÜÕìs,íô¤ºeÈ”›xÚ>àLY†KuDle”X*ƒMA¡u¥Kž3\ÏÂxͷnÐÈ7PüO/òà—®$Ó˜ìå;¹èÔˆl¦)?LÊŒÆëV2,fëÙ¦ÞD ö€¤Í«„4 !p>²1o)˜†.|ÛR«|à—¹û=„[Q‚nûÓ ’ÅÀ‘. ]Í€¹‚(£‹¨’”}RȈ˜e½ã~zႼœsÌ=>>)„¤\Ð5—¹ùªÀ‰Ž:º¾ËÍ­˜ØHœ_QØ+;-¶"\¸ûM¦3ΫS €€wNÖEÞ/Ï|Yh^ÕÍÄÃ+q¹¤q]™¦‘‹‰iå¤c"åèN¼}â–%tärRwæ2­Ù\ùë²47DCL.*[¡2=-zÀ×{žÐ Íý¢‰”ª¹Zã;v©Éá©ÉÚŽBĈ VMú:x=ïÔ€–ó ò -]Wá¯Gᥜ ¨o„inrÌ…Žgbe‘©RÂ8¶[2ê‘3T±:mÝ~ðŒ—{ØïM34ùÊ´ìm[<ü…ªÈeE¹½".óý½„xZêàK‘scDýXašdùþôÓç*R0!†gê»q2÷ 2u¾ïB!7| ¼™/¡ÊûñÐ Pg*s>Rò7º•ÐÌ·ëPp„þø‰„¿Ãñhi ºÇ„ß™>Þ™ wri5(òD8Ùº÷5±ϲè[xÍÇM©jñ -g¸ÃÀï“ÅX±×x¬cn0_EÙ{<ö‰!u|樶ĥ#õÐl{ÞY…-L(ô -“ó^ê 7S"P{xt¡ŒÛÎ -šÄ4¿–«Òø÷3\ѦÝ Èj.Ù8;nKÉ ñ¦iÒ¬þ7oÏÛš6_÷MѽN(±n˜Í"†ñ„Ìžùæ.ïn~þpÿÛ•Ïõöó¯oxsÉF 6Än\ø? Yöÿû'¸1(o52»lqAtºQ¡™Øòÿû}ªendstream -endobj -2213 0 obj << +xÚ¥YK“Û6¾Ï¯Ðê°¡¶,šß¹l=±=©¬­ŒåJm%9P"%1æC!©Qf÷Ïo¿R#NöryˆGhÝ_ ¹3þ¹³8°/™E±k{q<ÛV7Îl=ïo\‘XŠÈr$óf}óú]èÏ\ÇNœd¶Þ ó¶x³uö³õöÃíjýÝÃbéyžå&öbE±õöËjáZŸ¹uõpÿq}ÿñ=Ö|ht­/+ìþô°ˆ=kÍB÷‡îÛ½¹åšg;‹_×ßß|·6š@«Õüýæç_Y[úþƱ½$ž¡ìØ.tW7 §øžÔË›Ï7?š©¸ÏŸñ¨©S ¼ØbïúXÜ`t,®òl¥ÜY8vàøt.›¶8VZ–Pð«ÙqC€-æXv­ +¾®U/TbõESç‹l@"Ý.Td}]¨ØÊë¬ãŽ*ÅÆ'žp³Xb'÷[žÕµºÑœÜ×Ôü}ÂÉš¶ÜСäÔ©Ðç•ÈK÷©K7å ì/Nàdz•%ÞËl)‡°tñ$ÚùÔŠ,Qµ²ÿîa +7fMà{© 4RÔ?;c{ÚæܸÅ9þ‹ãúûŠ¤xNÔ¸`l¾—XŸj‘ïyÿ=×v ÕÈô| XÀAh¥E™â9—2ø-Ž5f Ï/Ál¨£­;›.à}׃ÍÖZ¤0g•aŸ‚ áJžXNŒ& G¶”€)EÒ¤å±Xàš0m†Å/LÏsm*‘?õ U”Eë?-bß‚ +ce}éÆzœ XJÚQ£åã°ƒ´MÙ2û¼}…‡¬,Ô¤g‰²0#»NÑJJ)O0ÛŠòÁ=Ÿ[@oð€ã«þ–wêwØ‘Šf ‹z¡>žz×,– +PûiœÁ7ã úSÌÉs+èuíuçv•í¹j: «+Î6h +ÚÁòà)ÛÓ±k*6Ïíëw ok‰+hv0e/Œ¬ÿòçРę+Y9–C¼¨äO\C«ïY¨¨û†Ký!çŠæíÁ+pÈ?_Ú¿Ú‰úóí‘ h“Ýq_†¶9ï·ŠKÏq£)‹—ÍNز‰xn8Â,ÚhpÀÞ +´Vtì¸!اñ´«'n=i£#„AŒ%ÆšÏ\"¤aÃÄ«(K ÔFh[ÿÆ Ð# ƒá`ák6šª(a$*s)¨ŠpgGuÚÊí3HéIMi Ð(|ÆsÉ[©¡žMÏe³ÿGrŒ²ajÆÓmØÇ/¦Æ¡|Ø:ÓèøÀ_ÖX6É<¼×‘b§oÍׇ‚0š«+Fj†š9·¥¨w¶Ä‹Á*Z,~I%Zkëð¤Uàÿ¡›•q]hÓŒpn †ÚÞCý¦BWºm±ûØsW–?[>a£ÀõvZˆ¦zßxqdý†G¿é¸²k¤u¤6Ô~:ä5—ú–צ̻CC!¸!¯÷•* Mp#éNts*åô õkM1â̵”#9MÛË"tqL¦P€oyÆ­ N’åöxŒªȨüp° ,Ÿ&¥´\Ì–å­ŽÔØ' õ’3í¸£/*ÖÔ2Œ„oÄÁZÚº>ÝÓH8–Àq)‚Ô]‘I÷ó‹Ä{5¾.M%.èCŒÁaÄ}š#CŠøãû‘59Lć5çQtǾð1cKŸ¶û¼ç2mVVÈ(Zd´Bó´RúPöÔ寇Ìau×qóùPP`;ˆ–“ŽµÏë¼}3fÀ»¶©¸Ä¸ôwþƒ¸­:玕V1±4ÞÒÈ¿óç¤x4QUzïRÂÅMÚÉüˆMØñïöô&“Ü=¿Ý´{¶² ¶7À)̳ÅkÁB›3wÛ×äܲìK¯L žVvt•Æ 岨‡ +ÍÈLÃPÊAþšI©0²=Çn4ŠY×,*m‚"‰ WÙYz*±ÄFÑÐà*ï +ˆí·ÌKæéñX[ +D¯ëÌF‰åímÎßVm9ò´œO©i»±º @€ÉDÁâá¨|7{ªTBVpsõB¨ xÕÔû®ç +;ƒµC(¥6ßá/y|»Æ¬Kàr‚ã»Ñ0_ò0g™#Më~ÇZÏ—R‰ƒIæxVw"F~ÀšÂЄŸÕêŽ #À†"“0È b♊Pø9O0 5®rîX\_OOß!ƒóž¥ ÐÉQ}cFðô1qLÂy׶{ @r;×fáû¶çë æ~ĸ s'Ce£uèБ´ÒåHÌÄ é­š?‚¶‡³¥\]ñt%׺­v2s£A*•öDñ€ï^¶0Šaïé$˸˜Š.ÓÇèYÐuBÅI†ÄvŠeÆ¡êXš @ hò!â[Cü³J‰ Ž£›ãÀ i•Sß,·MÝõíiKÈ­;Š•ÕÄÁŒÉkÉÈhP_û–QÆÑip–†N”ìÜ#Zñ˜u]‘ã(VüÖlèV_óÂJЂÇуý©À„!¨ ¾†Õ`%ËÒÞø RO_Y÷=I"&Jãã[àˆ·n LÜ9P:_Pá@a›DS¼®—à„^`”QñŠöåICAJ|]!ZPúò¨µPò±à¾ÆSçÂ7 ®òÈhVœRçU÷—z à-ñ©áIG ÉiÑ’c‰ÄÀ::V×âk#¬Šý`ˆÍ=-;É8±Få?±x¤_Ë®nO%­£i5šû™¨0Ê q*}û$…†å2ÆQažxe“ŠÏÁyU2¿F@Ûœ¤Sý¦þícÄFæS&YñOä#/G°ÆZ9Ä3 +€‡Ý²°œrϯ^ˆçAWÕ´’^™u‰CŒ\aw*YbÑ@g1U—Ô4üRxþ¦üð}’¹útSæ×Tþ ?äKgVL€Á ZÈYˆh{¾Ï +â#%~y|Ü0°ƒ$‘€2>K‚’ã5‰ìØeZ$¤¢k²H^Ÿ©7Å@h—´Ë†:½1ú Ï +-7½‡+åÙÀ¼/ìA’¶WŒÆ>±RçôL­ó󒀈’+wŸ\`ŠÜŒÒ×N‡q褈ơGx¤:~QÁ•hô„¼“Pn“ױω¡rŸüiêyýö—y箑ۀ¾ÿÇ<#ažDò9,C02Ù¤ñ–”á{M羨epÚs—N@ ó1/–;¤”×™’úڜݠzD$ô„L¥ŠçƒÅ¡Ä¡ÈôŒ‚Œ<±¤(3 8?pAÓ‚£Žc}ªõG±Ž„ Q¦kœÝÊ“r.<ÿhÔL‘[Óý±’סdGíPéÁeÊ.áh?ѳš~_¦¶rDJA¾ ¢p~À©–Ï:¹ëÜy¨&Q h"‰mS6Ús@bßò®º¿ôӂ·)m›cp€ÏÜ*™h‡LSåRøÁ¦œJË!lÈ«?ÌíÓNΆ0´9áS8zÉ”ÇyŽÁs`ðÖ¼ú`íY:Âæ`èh‹6É€?R|ym588{ãë ‚IÌià­(›¨Œ7éT$¥ù ²lÝŠ±$ðâY¥«¨¿>‡Lê x•f±G#ëIð±}Óò½TúÂØ3Üçï’zljË ¾1P έ°Äá',lO]ÏÞºìô³âUX½8 `À èÊžkdH€¬ôœFÍ i:òy5­Œ#‹ÄÆ RéG ì?+-/hÝ>q½ÓŽþ–c“ê˜Ú÷–@ytJõQ(ò·^1WóùN# ܽâ)Vw?êTÉáøñÀÓä½ ?ÿn)Ó<ÿ­PòGgí/§“–ô€7b ãäï4ýÎÖÈC ßZ!µë€û·~Lò[%S¿%ÁÖò/ýo~‘ž{Éô/RR¶rµ.x* +â3}õïöW +ÿÞîÏendstream +endobj +5277 0 obj << /Type /Page -/Contents 2214 0 R -/Resources 2212 0 R +/Contents 5278 0 R +/Resources 5276 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2217 0 R +/Parent 5257 0 R >> endobj -2215 0 obj << -/D [2213 0 R /XYZ 85.039 786.531 null] +5279 0 obj << +/D [5277 0 R /XYZ 85.039 781.388 null] >> endobj -130 0 obj << -/D [2213 0 R /XYZ 85.039 173.977 null] +1458 0 obj << +/D [5277 0 R /XYZ 85.039 623.857 null] >> endobj -2216 0 obj << -/D [2213 0 R /XYZ 85.039 155.503 null] +5280 0 obj << +/D [5277 0 R /XYZ 85.039 599.875 null] >> endobj -2212 0 obj << -/Font << /F62 1689 0 R /F41 2104 0 R /F15 1628 0 R /F35 1632 0 R /F65 2099 0 R /F20 1617 0 R >> +5276 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2220 0 obj << -/Length 2987 +5283 0 obj << +/Length 3225 /Filter /FlateDecode >> stream -xÚåZmoÛFþî_!8€**†Ëåk€~Pë´MÛ½Z9ãÐö-QŠTIÊŽÿ}çmÉ•E98p]îÎÎÎÎÎ˳#«‰ÿÔ$ ]O§“8‰ÜP«ÉrwáM60óÓ… -o¸^âÔ÷‹‹×?FþDyn꥓ŚH«ß~žÿºxûÛt¦µvw:‹ãĹ*g~õýGg~‹­ïÜ.¦‰væ×—³ùû›ë·¼Ia¹RÊù´.~¹x»°D˜ni”ᯋßÿô&+ó— ÏÕi2y„¾çª4ì.‚P»a å»¼¸½øgÏ…ç‚ ¯9é,P¡«á|3í¹IôGVáÈ‘ۼɧ3_+'k@|éwS?qñ¿<ìÇN†O-“ÔkhýÔ)Vy…ã]Ë×OEÍÆ,š)gË\‘'|ä OÕÒVuÇŒ›µH7U¶Ëe®Zqg³M·$P"›¹ hlq[¼‚ÉLN=S¨¹”Žý0 #'+ X«ƒ¤Á¤[Ϲ©rŠ,Zè¶2Ó˜ƒ¡Tås(ª5|ÕÍ.늺â±=RÖ(Ñt@_²k&÷¤ùŽ?P­8Ù‰Þp,;t½]/ñ“·ÁczGÜqK’g$¯6l¤û¯4æå9+ó[žâ£•×ý]áð¡ef<÷¦mÇSYÅ-4tNYDìy§Uî’„#÷° ã.‘T”°Í  ÍhÏb%jR xd·-øRppgïsL·¬«?< =š ÄWS…¬îµ ýu¶ìÌ™ôÖtè° -–c7àpÖô£EÃ=ÐxÅ=²f`™•è–Òº‚Ås4´½„lÏ4GÅ4ƒû›À(Vh9,ÑÚ!M£"Ë!­08ùžs×GƒF¶ÍxI[t20ø,ŽŸªGK}‰ƒŸDüG"â¹&-4#‡Î,Ï›.+*ΊtÞ›:ñ6!„\Ú5é’d[I¡-·ùh`cŠ®¿ŽÝ¾kM¬*¤GƒØ–<ÐpTC¾¥Ä©¢: -e"U9åÐA:ˆA¨‡œZ‹Ä”c¶Gº/4!ÙÔ"{vÔ¥¹l?rV¼(MþÒt¿´§i\'B‹Žc³IÆ”m‡Þ‰Ù|ÅЊÏ"Á’ã22g)ÎE,Š|´ß6çDotÉÂR¹œÈˆç²>ÇÔ‘|¾Ì*ž„„Ñ{¼“#³#·bkðiµ2#P“?ô"/‘ÑÍm0à -[{⩺cáKt7r\ÝòyîŠê8Ù´#¾, ¹¥Ál,7Ó‰«ÀX*ôÜ8ŒÇ€˜»~¬‰m$= óaN¹)ªy€a«\ -1gzÎe½#GA«bç}þ£mG‘sËqs0]FAþ -*x:Ñìï»Ú^0öe˜xgá˜i0¡ÅtŸŽhGr2vë½8Öäk -*€½íTò¾ì&bšÅ«/:¸ÑŽö7+TŠ°82hßs°âq@™¢¡vyVI—í¢39ÞRNEŽáëÈÕ¢mã?2XšÊ%<—¦S5ÁŽi,a|i¢S3 ‰”»ad_'N…ƒx¡'Ü™19Ñ–0w.›Ÿx8,RÂÓdEè Þ2#ϦÅèW¥í € |¸8ØR¤âlÓ F¤ ®µI<% å+Á /6[ù®Í¸œÉs¶©yû¦.ûÒ˜Üèž5ÿ]Iø¢ý+7ðôÄzUè¢þÑš‹b¾wðMùÜå; ¼G(Áæc”ÿT<ú -(n¹‹ñ¨žje‚±ºÆþ‚ ZT"OIsâîD·¢»ÞMÙÆÎGå«/D€ þâKÑ$\2½¼Û -êî3,\ùD]²kˆ1dè«‚B±ƒäÅÀ .KÉæ‰K „6?fŠG…EmË ÐMâԕݽ Ƴ Aêa tÓJcËoFØâcÌU!†ÿÔõBM«òjÙ<íÁAC?$€ÕòçwÜü;Ë1-^*9‹trϨë§MSöGä¯ÐcUŠíõÂæôêÔ™ŒLÖG+µ˜~3¢¨YÄ–bœßn@Ïá×·«o½]aìÕ7¯x0kèM²;ÊåD]ó~ad§…‚ºRr3:ÐCcö‘8 áqŒAêó´™9Š…ƒ„;Ø΄;í8‰‰,4c#C£ÃäpœÂÐ’øè¢ú•xCÈBveIцÍtÆU[‘ñ*+ݘ'\¢X.˜a[#x¹ËÊ?Tƀǂ1ªìŒ`_¯/ƒ!¶—ë…˾¶0åœÂòCñMé`eˆÞt‡R*0#@pKR?t¼æ,Æ~‡’z‘\7?r#yC‡òɧ )jnåÍóIFùy¿È#gx"€S¶ªÌ‰òU{ÌúcMúôÂ-)Ú;Rö˜nÇÊQ賨¢v€êŨ0ÏAB Á÷ìkhÕó…ã£I1°šòÓcûf¤(©Rˆþáh†T~" &3j$3@ÜŒŸó %®Ž0 i7ïålsCˆÉ”CRÍŠ…v\±4EZLõàé9Ð@¬mA5±Ô‚i@0ðŒ1À¢+ðÍ ƒ>-™Mú§Ž³ËèYIÕªJÜcä&ù¯9E?¶ÂÔ1î¯óÏÝ·ˆ³=Æ© iè¼gì€*ùÌ#íSËÇßtðÏ}èÐåoÆrF É)û¬™áRF©G¸&83k¸ýõò‡çGô“ØÕaÊ'y¹@¯!³£åy™é•q$`¯ŒùÕ[ç#·—73É(©°¦¢ÃÕüÝõéeC‚ <ÕþWdPÚõÒÞnBϤT1YßÅ[£Èé}Í=Ž~zšAE•£C$‰­Ð›}À½mWv(ZJ¨ø€SœþAex¹é)âK€7§Âúl˜DcâδT«RxŸ£ŠÝÐ þ*>bgƒTb•WS»b3t'ŠkˆÊ±g¸h›˜šq±ÊLØÐ/²¸Z -sŠ^­ôÒåx4[Ê_Ê*Áv†åñÏ!)*ÖFiRùEmIU‰y(¼»l¹ghž[Ž?“ÏÚìÊŸ6ð5•èáÒûFÃä'?®qqwîûŸXZË›ìêüéSÛÎBÊw#¸“™ò7Ñ>fžj6îüöÓKUÅ‚6¼/L] -v¹ÙŠüñùv ¼Öý3(Dƒ$ñ—Pˆ˜)Øý¾3?M•¼ ”þù¥¸[ܘÒ<ÞÈÍ(~–›÷eιD–5ù:o„UÍC=K“_ÅœxÙ¶Ö}Æ}³ +óÕHQZ§n”šÒVú°*¾r‚£¶âv~yËKóì€>Ö÷r^ö"RaŸdüïU¾×½øÇ":h`ƒÄówëG'î 4êØÝþnJâendstream -endobj -2219 0 obj << +xÚ¥ÛrÛ6öÝ_¡ÑËR3M/}ÙIsiiºÞÔyØéö–h‹ŠTHÈ®ûõ{nà%–ÜÙídçΨEÔ"7a”‹,Wa’ç‹Íþ"ZÜÃÊJ0Ö‚²žà|sqù>Õ …ET,nîF:&Ô&YÜl ÞüøúúæݧÕ:I’@ájeyðæóõJ¿0ôúÓÕÏ7W?ÿ€3 @|¾Æå|ZåIpÃHW?˯?~ÿšgI­~»ùpñîfàtà¸*ͯ¿þ-¶p¥Q˜ùâÆQ¨`y|†F'2¯/~¹øç@Š×ô‚w’ŠÇXÃ͊ؼ,¹T…:MÉÅ°ªÂ”œRq˜¨x‘™(4‘&ÑMÂukµ6& +nv%\;Í‚7íþPÃJép]mܱ+ÏÉBç¡ÊŠ—¹qˆ;e&ï:p î®îàè8 +žVq´G˜¨"x\ÅY`›U\Ž—]Ë¿=p + ó0è·Å½øOÙ=Tåã3(îéd^¸¢»•ÐRÁ¿#¥qÅ ² +z^€CT°å ˆOdyÍÁ|W>ñbWÖÖ•sv‰˜Ýà–pååC^¡¬A„k…À"ØÍÜ ¢&;Y8€^kÄmïXǽ/ GXüwýQ NÕó’u<ŸžU6[^ á!=¯néîk¸ ñ„¤÷ÄQƒ·sá¥I‹<,2ý¢ÒLpΫtšg¡ÒÙ\¥cQé=2º/¶i›‡þ3BãEfFœóœ¦ih¼kú| HG:°G×®ùÅV V‘î¸q=¢¤ƒúéÈÀ¢4Û¾¯nñy„Zˆ£VÍ=/±Ùªá³–^GÈÞáãtŒhéAžxr_±4<ýxWßñÄr‘å)E´¨:ÍCÂILú×Ul¢Þ¾^¼é­ër‹^ZGÁ÷^_£ì¼ ádË:UâE@å*ÁÙz}ßT2¤Õ†ù¹³ƒm·r®ÿµ÷(¢Aø ãŸ^®ÊdQÔ›é¥ ß<@‡¬«Fçñ÷Õ:×<‰nFûE®ÀkîÉȽÐÐÞ98 oùv8ñì¾úW µ‘ +we'KnVò¬0´²Ý!ùžj#Hh¢Hß±(a½•³;FØ·ìÇ¿yRAKÒA½óÖ_L`G¼GðälkÏ ¯l8ýGÎ"·{¡‡Šo»ûRÞ!I²àÀ +Mþ¢ì@˜‘´É‚_ª‰‡ûaÉ$ $߈;;õîxzÓ:’:ë|jÁ7½÷Ž“ý<@Iqq˜‹XÒm²ikrxìïDN²Èg”i½òˆe¾ˆØìǃ‡kÂÕSÓ Ž•zbš]yÙóN–c!yÀ:w´µgŽ•½?eÂ=­U÷§‡&å¡t4w^ßTt""—Y¼[©Y(Uì_Š3útš–¸²bîÊ@}«ºæ…þ¸çÁñ0çÒ +³­³‚ºœèë‰{{™,Qô'AmêYJ‰m£FÑSƒõ$—¤åïÿÑôâ–Œ‚÷k®|}Ä0& ³Tÿy&™nEz2“Ä;Æžâü,Úyô9µçj­!K“tˆvY< ½Y˜À»NÂTq6ySž_‘Ñt†¿ÄÚâëB…‘.Š„q&cb|¼.¯özñ¶3&™îzB˜Cr> É ØâµQy˜šœ™ƒŠx¥Ò9Ò>áÆiðž õç'ÊhêGEQ„£ Ý\÷ò}2KL g`“tíxè·hëwŒ:c/Â(O“5@slå0ˆ•œWf²§)|ÃceI6Óor%³\56)™Kl $ìÌp<æ#œ·!zW6®~âu·³‚é¹3˜C)–LÔ +ÛQ‚±Ñƒ”RpIH–\Òs[œñ +§Ñ:&*ÿîsL›€5™;ü<̼ ¬—@*¥kTpFâZÁG_Ïäzöª´‚¦MK­å¤¡JñІz–¼ù pJñ +-Þ¸{(;žßúƒ #k¨i>fù!üðp ‡ÅçæQe9/b· —8~ÏjYí+·dð@ðwGð1ëö¾>!jÚè…Fûá}’ˆ_ "HL–ø2ˆu®gP×¢ÖÜïH1`®xËÚ[X¡eyê*Nÿ_¡DËT˜ÄNÞû`èYš˜]ú9û¾ð`Å¢:¥®9[O="Á¯öPtÕO¼jx²Ìqݸ—Üï|¶Äq"æäñür£g>\g +ªéb1q–Á÷¢ƒW˜óÐøÿÄ£0ÎøBpÝ/Õ5NCð‘/Y^„q<¯±©±–Ÿì +rïGÑ’ûtþEò±§+¯¤Hüx¹³1Á9_y%¸ù˜-ó_ØØÁQƒ;ß Ó Ï 5†ö¹~Åá¡ãdóP†`b?dH§~Âü”W¹ñäQ‡$N%"[)h@0èÖÀ™ °Ð¶–¼i_Ú¦ça%G‚·•R&Mëø¾^8ãEg¥¡¤s”¤å&ó…hùŒ*Ãì‘j¸,ç—©Ù µ#w9]Ÿgé [ÚžU¿äÁcåv­/ê`~ˉ Ö1ƒÿCü»‘ú‰j䛣â4¥ƒnYŸLâ„üâm«ûÒw„‘DÇq𹟅CÀnJŸñ""Ó€_ûE2YÄÙØΟ1dá{ÎjÎðz¿låD7M×Àèœãv©AQÕ°¾W¶–J¤iM¾Lj¬¶Ÿ–ë€ +¤4ø4Ô?¾”UxV®QOŒ +$¬Ð¹ÅP +¬•ß¡C€“¯G›ãXÊUw¼(Ép,×”Fð¤cN–Â*ä*O¼:U†ôÂÈÆK•°ÄâÊÄÌ–Qr6íž½¶o½Œ¢yƒ±ÏDZ¾æâÑ­°uï¹4Ê'~ŒsdaàP ,p RæäáÏÁ!V|¨%Þ<cIJw¶“æYe'¦GßB-ìë·<@ëâ…J)b†ZÑ÷ä@P¤¯Ø¨ÁÂùy¦j ,@¨ÁrSìv¥—Dh}Í¿}jÈ þÀ¿}»ùRºï./!T€†K)ý]¡0:Ú;ÉxçGª<–#¹]'‰QÏAk;üµüó\ÿRN-Ñ[F[ŽÏ6´žÈk,!I²ižÛ°š¹IÅ‹Ppr¨ó-ðåôiâ—¡ÊuCƒãZ'8mÍPŒ6ü‚Ò†œ§‹¦O¿üñ¹Ëƒ¥{[u#cKŽ.IVp¯8ó] *q¼ñ ïŒS0D½ªv»¥l¾÷Ê +8üR¸C|-”NuOõn’¶cǾ·àƒ¢ae]‹ZòY1t`žkôÎnÙö-ž¿¥7J +öeE€A—Y‚"éðŽUŤ³ ®Ã$Ϥ:BeLŠ(¸ÄÞæ¥k/¯¯q÷Û:¦"ÈÒX6’±å4ÚFá;çdÄJ] …¢§ßˆSšÔ‚=k0I¼ž¿ï¤ÕÈõ pcZ¹lHÖìÑi9vð}õë±,'u y8V›©w:â¾4C µQQ;•H§þ+ÙÔ7Ãèy7+Cßg0ƒdYÀÛÁ›ñ‰q\â?œºSæÚ·âX­•<å–ÑøÖÛ]¢’Yc\CÆ_ª8HÛ£÷ì%ïõ^ãíݸØ31ð™ìײ,„Jûl•ƒÎ!¢L§ñ2“ ‰~5ëŽN¹ +Ü,ªÔñl;µ_{¬öcŠ|Œmˆ4Ôš´ŸÚO·\_=1lþ9!DÓw¼»ªl6ƒ—EÞv‚vg7î\É…ñI#ƒ¿,œ¿ô¿*ÆÆFæÉK5qÆÊó‚+ó-¿&ÉC“'Ïþ/îÞDendstream +endobj +5282 0 obj << /Type /Page -/Contents 2220 0 R -/Resources 2218 0 R +/Contents 5283 0 R +/Resources 5281 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2217 0 R -/Annots [ 2224 0 R ] +/Parent 5257 0 R >> endobj -2224 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [191.71 117.821 283.127 129.511] -/Subtype /Link -/A << /S /GoTo /D (winbind) >> +5284 0 obj << +/D [5282 0 R /XYZ 85.039 781.388 null] >> endobj -2221 0 obj << -/D [2219 0 R /XYZ 85.039 786.531 null] +1462 0 obj << +/D [5282 0 R /XYZ 85.039 761.463 null] >> endobj -134 0 obj << -/D [2219 0 R /XYZ 85.039 604.89 null] +5285 0 obj << +/D [5282 0 R /XYZ 85.039 741.134 null] >> endobj -2222 0 obj << -/D [2219 0 R /XYZ 85.039 581.572 null] +1466 0 obj << +/D [5282 0 R /XYZ 85.039 698.974 null] >> endobj -138 0 obj << -/D [2219 0 R /XYZ 85.039 525.863 null] +5286 0 obj << +/D [5282 0 R /XYZ 85.039 680.102 null] >> endobj -2223 0 obj << -/D [2219 0 R /XYZ 85.039 505.269 null] +1470 0 obj << +/D [5282 0 R /XYZ 85.039 408.518 null] >> endobj -142 0 obj << -/D [2219 0 R /XYZ 85.039 103.552 null] +5287 0 obj << +/D [5282 0 R /XYZ 85.039 389.85 null] +>> endobj +1474 0 obj << +/D [5282 0 R /XYZ 85.039 124.319 null] >> endobj -2225 0 obj << -/D [2219 0 R /XYZ 85.039 82.356 null] +5288 0 obj << +/D [5282 0 R /XYZ 85.039 103.064 null] >> endobj -2218 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F65 2099 0 R /F35 1632 0 R /F56 1642 0 R /F41 2104 0 R >> +5281 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F56 2890 0 R /F66 3242 0 R >> +/XObject << /Im4 4878 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2229 0 obj << -/Length 1834 +5291 0 obj << +/Length 2632 /Filter /FlateDecode >> stream -xÚÕXIoÛ8¾ûWè(cF$µö–e:hÍd:@Ûƒ"+¶-®$;Í¿Ÿ·²Ûé¡sHaÀÜÉ·|o¡¤ãÁO:q <8QŠ@K'«&ž³„•?&ÒPøïCÿÈâÌ®ÎB%»˜Î‚ÀsoÓj*Ý»t:Óa䦶¡›Ö<¾žÎ¤;÷y²™jÏmyáS»jõÀ£´HŠ³U:Õ0|š~¿‡Ë˜›.½jª´¨ù´Ë¦îiOS¦2o‘~òû|'ñž8á1ñt-4½  ‰D«±6¤/´îkC¢>üĽisâ*ÿ¶Aaº¢ÏYÆ0Êq%]ìËÓüŠ(yÑÕ ß&Ÿ¿zÎØy?ñ„NbçúžIâT EM„f\Nn'S <ãàô1´Éƒc¸g¨÷O „Ž*/D`AŠóõHôË.ø“žˆHQñå|s$¼:“Dóê¨O|î6ÑÄÙ»J:W pä옂ªàv M4ª›âãÀš’îGY†±_T# -¸h1’£:ÃfϦø×>ðk¨g"2¥}@ì -hx¹in-¶iå ž¨óþHéÃõ mIJë%E¬ácb]›r=¯bŒFÉ -[ÓöWzžxÀs²f{Pœ#Q—¯™.žqå/ö.S|ž[7;ö2ÙTæ?ÈÞJi,rg~¶Ó?…ÉÂ^&‘3Ãm?é&23àÏSáŠð|Wù5eÉñˆ[\f½ÎE¿ -¬[ò±_çܱh¿Ú->«bµ-®Úœs}Êu훃bÅQ¼W?‘.XkÏËGRV%o5õ¨rûvÓõ¿V8_,¦ãBÐ^—ÀÌ)Rƒ€‘åÿé†ç=V†¤Þ¶f®eð™[?~ºþpsýág¬h”Á—ØýÏOëL7,týaê~õþõ+®i­ÿ¸ùåâíÍhéhX•£™^üþG´ÚÂ’~¹ˆ„γÕ”#!¡ûpvŠØh[¯/>_ükTÅ}fÅ£–¼ëLÄ™>w‹Œ=·H©„–j•Æ‘ˆ#C~ö°bX‡FÅÁÊ]Õ¬U PüO{Ûc‡ Ú®ÚA;JÒgÇòw(߸ò+Tªf ÛµJƒ‡ž›7uU²F«ë{Ë®änÔÖ>>è–*Ã’YðÛ:3N¬â€*}äZêýŠ%î8&”è·œÖyceæÑ. ~U@³tÚÐq©.{üÛ»’··²â¨½=YQ95*ØÑÛPÝ“!?¢%Wï´¿ ±HUº +‰Nɶ/Mq[ÃT1ø`hù»i›¯e7på®rÝÑ\êî¦Áwmw(†±ÌØE¶Bέ™²V$dÅ FyËö“_h¿I76 {ë —ªfǽí/ ì>ÖÕ"¥E W \±AT¤z{W﨡8\²‚GÒÔeÿÏUn«5ŠQ¥÷¼5¥kÍ´)Ü€£Aªf©ŸžIw­…„µt”œLè ñQòFªL$i2jBÂäéٌک¿=!‹œÍ7 ©s8àñl¾«rØ\mNÇþêPJÓ?»b€¼8_Xñ$ô[¡—Vü­ ÝŠŸÌ·¼bo¾'+e¿Û¡L„† ¿€Œ4ôu Hánðdxª±Á¢@UÚCl(˜âˆ# £Ÿ„ÝÉØrŸ8¶Ž!¤û#}ÉQ1l‰ú)ÆÝQèaÉ:°Žzª bÙ‹ˆe/{dHôô§N!Û¦%è + ûBë Öt î`C¥Á ~‹ºá›[>½ZK)Û©và³¼-¹ÚÚUv-üJÍ„<¤Îbü%G<…„ÁaÁЕY`o¢4¸npScÔ ¢…PàU;Z6‡Ìs1¢•P©¶ÊŽÝòóÉBÓÄ;œÛ©ïm“ò]…rG\çäyä[º jÜ×‱™%˱© ð’d94G\>cc†Y  /Ž‚=±¸ rSÕÛ7¹P‘ñ|Üu{ß}ƒm¼m¡ŒÓxÖýµÙ +\Hض;²ßð/§ÊÐÍxfT¦&ð!°é¹ñ 682ŽòIð=õnؾä)ÁÏžM&ÒÜyþà "/Í>yð®Â†²[²(»qãð°lYÌHGx +käex Û¤rEÄ´…" b`@ä4ÑŽã¼=HA]Ó‰¡=Tpݦñ ¤Úfiip‰i‡P¼+ëXatÛ+¥%k!naÅn±\âŸEôÀ3FM!g’ ¸0^e”Hëšî2(wå‡õÀME¿d-˜›¨øesǘB€%K-Í è,Å7@’s4ñ9HÀ9ÐíÃA]ô-0gëpÊŽhGM<‘ ® ?°Y]i7žªuµÛ|³"6;§`Û,Z±“|´AÝûrëð’'–£ +€`⫤ƒž,ôy¢ÜCMZÌô¬™Ô¿oF p]ÞdË„ÌDX,Ã&„#5ŽŸØ%šo™´¯Ï–{AÙ§T_6DÒÝK ì‹À2/ž£¦p[ ™š—ŸÈ:F&˜,>‘Ái.2x@?§†E †K$­žh™¨°R1œ>9RÓT½"ÇóŠÁ™Š$W+@)Î/|hù¡"ùõ9_¨7‰PLwW®$àOžk–ñÊdÿ´,j¸º>ÈÕO-XºšËzCO1óöÌ?Iq"r“®T –ßn+~º)»^¸:`uÚ賫̟6&Ë3+,;fÝKŠuB–xŠ}–v¦xi|‚^1þ2ùì¹yR粕9)›; +ÊnS.LÄ îc\ÿT]vB‘{|Ž¤‚Ž úð‡'QßÔ vÈȈLº•x¼k—%97EG"Ks+\ g'ǤRÄ êéßy> endobj -2230 0 obj << -/D [2228 0 R /XYZ 85.039 786.531 null] +5292 0 obj << +/D [5290 0 R /XYZ 85.039 781.388 null] >> endobj -146 0 obj << -/D [2228 0 R /XYZ 85.039 766.606 null] +5289 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R /F56 2890 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2231 0 obj << -/D [2228 0 R /XYZ 85.039 651.298 null] +5296 0 obj << +/Length 3466 +/Filter /FlateDecode +>> +stream +xÚÍZÝsÛ6÷_¡ñ}S1$ÁÏÞÜCš8©;Mâ‹Ý‡›¶´DKL(R!)»É_ûEjÚ›»¹É8vñÃb±Ø…»pàŸ»ˆÛQÉ"Š][Åñbµ»phy{á +ÅRH–Í÷/Þ„þÂuìÄI÷ý8íjq¿þÕzõãËÛûëWK¥”å&öÕ2ŠbëÕ/·W®uǵ·oÞßß¼‹_>TºÖ/·ØüáãU¬¬{&ºyß7¿|÷ÃKþR¶sõûýO×÷¤ U‚b~¹øõwg±†)ýtáØ*‰ÏPvlšw §øJ¾‹‹»‹vCq›¿à^§PÑK˜YâóÈ…®í‡ªC΃V×N‚‘s]ÏV®·ˆÇŸ ƒ1¦ëÂÿË p¬Û+åZUÓÞ­ê|ßad!PõÕÒµr(”-–²š›^g Bõk[,UeÃm¿9ƒ]o_c[%¨q¹í±B>2HY•H±DÚ;aY›¼š©ð#;pÏ@ÒÓ$Pì•©ƒÄK¸ + ùPç|“—i…âëÕÒKœÉë?\ëùÊ‹­ e«3nÞ‘ i‰ -Wµÿ>ÀQãÇ¡¡nkþzD¸ja€]5ðP/£ì þ€Iª Ëæ+Çú1«³ï°1±Ú-4½û.öˆ#À³tQ¥xº$fÀúà J”,ˆ­uö”¯¨Ó’`y½ÈÊV¤¿9®c‡:Öª¢ÉïRè‹ËL•)J¸6GnÛë6B Ù¶ÛŒ oì–Ù?oóNyËmûº"þÄ>£ñÇæhOÕƒWdö‰É‚M ƒXÛµT…ŒÌ8•HîlÍme.„ÄvUíõrb- éÚi õ®ø—¤®p:O¤75W—´W–²î´}îUøÒöƒAG* ÇŽ¸þgÝoóæÄ|IQq¦^ì3CT+P‘5$ö¬5.i¸:-é§uv•’¾bç\Túæ ÿ¦Ü™EçOkÔü[§äÐŽ R° +b¯ÇªÞ¥-Š zS†q#(k,–Æ<”UT›|›sB—”ïqôX¯¶[€Å+ôN@÷ÔžÃjÔdêvhLêt¶ÓÇ›[. Ùƒê¼ÝQc.§˜?‡µiO)¶9¯€§%;Øwý†= ÂúÜcÙ «J´\¾«,Zè£Ø–fåJHòp +'†„¦&âÉÙÏ©±XçZ ¹m"l4%$ °õလ‹v™—ß¡•RÚÞ®êVÍgqKZ fG/ÔWü{bSôb`ù-–e6Íñ¦R²\P¨QÊRÀƒH) +Vƒ0¹X;DãŒÙÈÈbΨ·aÜÙy<ÙR9ód÷Óy§£a€úmÚÛ £?I„Ï\]PÿL©ßi-]È4ÿrORBø¥mBŠ„_÷[i¦y‚ +Ó —'¦˜ïxyªºí>Z¢2ãB!Ûñ³ Û仼HõWò«m¬k}¬^¼Qæ Ø‘¤ìPEÄöo«Ã¾yz•Õ ¿ú»ß`Ú¼*_<•k –uÚžº°­0„B׶à]b31t‡ Ý؆!1¼¡øÛ+{`©VÚ#¹^••´Ã†á>а•:6KH¯M£^r¢Ü0)Ø·otlëAi«Çlë™;/º°ÈŠ¢“pÄ +­@Êúä‚îPý}‡×Æw|ëÀ:Ͼi»ã/“Áä[®Ð&‰-4]ÖigHxrXªN¨¹k]⼂çÅüôˆýp¶nÕ¡XsÕƒ6 HÝtƒ=u®™Ði™ÉûØÈ  PŠ3ëu ×,FŠB³VáñaëãGÙ“L¢f—Ø;´ÞA=¹1X¸æ:6dì!³hXkŠ´®±gxV§¤(¿Â:}›ÁŠf[¡Új9>6Và‰·õa…k;´hð3¥sÐÄ.WJHÅÜ1š4@½e¢uçMb×îZÖ.vr Í[)»¾HöV–‚jX_¡ÐH+}Û@iÑÃÆw7ï®OúÇ'¹DJ¶‰R‘%j…EàTŠ•~îd—*íæ%›÷¡'gB4-$R]’Bh@Ú¡Æ£žàÆva_>¶Ú/lO»rÕñAßCê¹æn/>–=ðëè¢ñ¯†'^é×g®@å²îÇ$i÷Z^òø¹ ”òÏ[œaw*.Ù—Þ KèSÖØ 7„~o¸BXd'@¥/øVçƦ’3Ÿ]ðããÿ!%m6׺~Ç}ë~vWQŸüÎá!%GZuh{ÝPÆ5iÒÐ&8‹ÅŽ­ïÁ.ÊSÚÂ-7[òµXßï¨)åŸÇì™ ›n:ý^q?¾m7„*:ñ,(v\ +iTm_ ÛFÎiÚBkaWÕ,5ƒ3Üçâ|Ÿ:C¶HH.ÂY÷–Ø?éã`=;$ÂÀ¸tî-\ÿ…w]0}}MðÁ-«– Æ¡Ûù¼dþà#-@£HÔUÁ#÷X<lÛ§bVjþnkæJÃ>ú²lu¿’}`ýØi)Q©6™h ø@›LÜ ž ‚ºÉËFk[ZrIÖ¹Ås—q䱳 §ãªóÕÜxßGT\'´ã ^¨<®Ð;RÑ4Kƒ¨ 3b*šAYgÍgâGl/Úã-VàX–0±åÏË"4#Y†ñ(¶C/ÈR룻Ær õüüI·¶ú¦Agäð¦¡ãt% ýÝíÉåÎøXŸ‚7ölÏUgàí‰fà¢1¼ÞY|£€ñFhF ñ}Æצ̌ðØÀˆÚ_˜Ý±‡bÝ–;ôÏ ÛÍ +D„î×]eËRî)uum©yîB3â~¤®ŽíC£É½Hz×FvõÞ8^ çk +•î4QÒ•žh!B¹²}S•‰½ŸÜÃ1ì8wž¹ÐŒ˜ˆCæ×{}>è»çïó²ßÆ;’®þk[Ùwí <kO4«u°zþ4®‘ϸÎqš÷£½«Wƒûÿ®^l;nxמhW!"«ÿ9§e›ŠÎžÚÈQC¨y „f$Á¶$þ@‚ŒI"À‚g>ê)\\QãQˆ,{˜—è ²=Ñ ²B4@VkíId#›—@hF!Ú4š#‹:{%·:õ¿C×!Ýø º=Ñ ºBD·žvUtÅkPϘÛÈöæE Š‘G¦ÀMÜcw隢•À{Ç÷ïâÐßž^UEUQ>‘ÇÓ¸xqd«0™ÇÎ šÆN±óflª²½yˆb$Á‘fzž)Á _èO¡wdW§Ðéâ3.{O3ƒÓ0tûmÕV3Ú³0ƒs¬…ä˜õh®í€¡4Xÿ…Ã{/ŠûçP Û;c {šÔ˜Æ@Í›-fØfx É1ï#Ø"†­ç=©jæi~ +; +«öØ Ó*SØù¡yîðz¢ô„ˆ]]|$@A{ë\§÷«c{ó2ÅH‚ÑÝЉ’i¶çy¤Qvý™¿Çwƒ‘;'²Þ`d‚nèƒvǽ Üï3ÖIò”cgøIч¦ *s0ÇåB"Lváoƒñ C¤"^uÄ TÎÓ¼à`DûUlû‰?ˆÔìu„,­tÓçØ|«9P¶7Å›U`²é Jeæ(–¦£ ­DÓ0àeO<Øð\¸‡Çáìƒ ƒfú ‹ç(¨J†oXByÃòšã9]02ž˜Òz }’»§ÂÜ~RDZ1mTíRzIJzñXÑî*–˜ å|y!fð)G@ÀgF.­ %>¢{:ú'-TÚL€„›;Œ£Y šéW-#ñ]6ïAÎ.ˆ«dæ(jÆ­óofúC/t6ÖQR-Ų>•ujá*3ÒƒN´À³ãhâ°š¥AÄ“4ß¹àZ‡à.j"œ$,{4â¨|ÛUó ™dÌoª5‹ƒ¿7y­wF #Cã‘$±p¹oÚj€-Ñ#ÀðÁÄOèr‚hMÖpc×}ïC@ƒºjæ—\Õ›O¹ÎTe<nà}Y$»Ælïí‰û™”99´Ïþ'¹‹•ëì;«brÑ=ÜÙgÖ¼£™Yr¦9·â3Üô‚1;¹Þ=³»lUáÞ÷ý@ßhµÙôý°ÏbøÇi ‘q¾äAô>Á‹±ètîM¬ŒüD6ºÎ+iñýÈXì.]™ ÞjQÚã@:OÔü}&ÃÄa{Å)Cž}»ƒ\EHô4L±Tt‰âç­dfb¾@Õü*_÷㉇˜B0Ü—%òVGÎuÎrxKƒÞÝ« +Ê ê$Ÿ`ÅlO{ˆ/q§rJü4”™Nñ:Ëú ÕcËÇ6¾<â<†dºñxÔF§-|™=^¼§TβÞE:v#0JìjdmZ½Š}I,Áõ .>ýŠÕñãñjm©ó½Z±,Ð:{ FL±åÌ#tÿr '=ô?âì"9A(ïæ ¡åëuZwÍšÓ5+-»’à_Ð¢È (-*¥9€¸âçõôË–tÛϨ™r1x~'Í<üñ€ÿÑ{Ýîöá¢&ΊÀÃp¸–'àÍ,#5øßÀ“¡endstream +endobj +5295 0 obj << +/Type /Page +/Contents 5296 0 R +/Resources 5294 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5300 0 R >> endobj -150 0 obj << -/D [2228 0 R /XYZ 85.039 651.298 null] +5297 0 obj << +/D [5295 0 R /XYZ 85.039 781.388 null] +>> endobj +1478 0 obj << +/D [5295 0 R /XYZ 85.039 761.463 null] >> endobj -2232 0 obj << -/D [2228 0 R /XYZ 85.039 619.773 null] +5298 0 obj << +/D [5295 0 R /XYZ 85.039 740.47 null] >> endobj -154 0 obj << -/D [2228 0 R /XYZ 85.039 549.805 null] +1482 0 obj << +/D [5295 0 R /XYZ 85.039 215.786 null] +>> endobj +5299 0 obj << +/D [5295 0 R /XYZ 85.039 180.641 null] +>> endobj +5294 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5303 0 obj << +/Length 3771 +/Filter /FlateDecode +>> +stream +xÚíÛnÛFöÝ_!øei ¤Éá=HÒ4M±M½±ûÔî-R7”¨’T÷ë÷Üf8”(¹Àîã"ˆ9—33gÎýœQ°ðá_°ÈbÏóEš^˜e‹åöÊ_¬aæÃU ®€¸ÌÛ‡«Û’hø^î狇ոOìEq¸x(sÞýøæîáýç7 C'Ƚ7M3çݯw7sÏ£wŸ?~zøøéö" œ_ïpú—Ï7Yè<0ÐÇOãô›Ÿß¾á^èù7ÿzøéêýƒÁÔàXåˆæW¿ýË_”p¥Ÿ®|/̳Å´}/€éíàéÅQ(ýæêþêŸf+ž‹¼jŽ*q˜yqž’%ˆ-²*ô” +iì{±]~ÙÁE*¸E–;í°©:nn«aÓÞ¸*sJÈœºç‰aCðpY y2Ù<òü |pÛåaß·Ûb¨—·+XÐÞÄðú7nàÔ0°t;üìy£#,}/ CÙèép(nTê<ßd‘|KßùÔ•Æ7E —¸÷7…“± §ãI øŸâìª8öâÄ)@ +çtâ®æ°Ê½\ NÛ¢„Ó#8ˆÝ3¶}M¹ºçÑ’ç+‚VM»ª¦<ÔÁ\ ”F?v>b{àuHoÜ©ØI`wf3kä_YípwYJ„heN©áïa¨[Ùjhù»Çók†«q›5ÞhAWµIRVû­ª€ô¯`Ÿ r€hr„yj£wœF`Vx*2;ÿàã‘kßNÑñÚnÍ›ýîÇ>Qª’]Š¦o5.Ä“4Z¤ æ‘Ÿ°¢àD·ˆÏ–Êhh×'• m¶ï‰ÔØ ÃþõííÓÓ“‡bî1ÕB?õÂDè  ‹.Ð)q6U³÷6ö9Æ[±†ÂϽ,NfÕ›!\ äT¹§»àñ@´€$+DuÔ²ÆZi ™O2$BÑ´Dz‘O¤Ò¼C£äéb'm!Ü+HXiv,HB„µhä‘ÀLMõa@P™Ýºê¸Ûµf‰j»¡*Ñ ¤©óq`˜MÑsöž°£@IE`aÈw:Ñ8¥XR»ä…(ÐÏ3&B­L ¬ù+cÈê¥Kº5gÁâÔË¢L–ª öLbÀN¯;µ\¡Ðâ”y Øh›BK¶kZ›RoTˆ0¥­hÌ}êj2Žaâ´+üÆÆ4ÑXSòàÄ^²Là|]VÅ+n²Ýà6ó¾{æµ[4Ȳ®ÐØð`½%nqˆÁå$’l¬«]ÕKWô'w«ÿÔìUD& +¿­Æœ„GÐìHFÝw8ÌEçûÑ< +¹³¨ªEà·w KJ±îØ|©˜ÈÙrÓfûd‘L{.Ú‚Ü"À÷šˆ.žøÌã*Ï׺—ËΫ™»Wý‘M_ÖE£7èÏ[qøñŒtmÜ)ºŠˆ‹k$~QŠ%§q"#ò§«èÆYà3jâÈQà‹r,BóÄ ¤aÓ'‚o¾·È77ŒÒQò¢lVà`9JL*…‹°Œ%Œ&D$ uQp †fõÓ¸;,ÂCšž'Vy!hóB®6Vãý´´Zþ) +XØ?qŸÐ¦†0…B‘vW4<üz›¶hÍ­;~˜²à‘ßý •g€–$…yI;ôŒúã.Ø’ýÔª)‡Ÿ‡=[“aLÄêLÅv]“׆ùÞ27lP—ÂœL0XŠZ­Z±Fa`¦¦Ö­ž—˜áÙ ë¼RE–µÜéxzi¯}DŠ×ÍàÖ´I¬)Öòôb7#Ýkú +Æ›jæ²à†ES¨»9Û;èïÃD¢|ø7)°¦NÍÛb‡¬á$9HR§'K*(!ƒ ]ìtX˜LÅ›¸‹Pz3-)²šÂAâôã/V~2Õ šŸXÑh +i]œÍÔ¶ÕôƒN,à$?ÔW-É©ýŠþ²B²GŠ£huìгúj4ã¨ØqçÐWZ˜HÖÐâøéá$àyê²âÖ£]qƒµÜ‡dGöowãXÿÜ3·¼RQGkØ·L‡¬^±¨ã6ÕYã8eñ+&^=çÀúj°•(l`òBºp7qVª[<â2“–k¤­¥Õm²öiSOâ•S˶ûÒó&.Š¥#º®5*Ö–/d×_ +%¢RìûkŽ¢ØAæ‘eßqa±2ÒÝéðm.áVòÒLç¤Å~ßÀѱBgëkàÜí×]éq‚DÆøµØ”²ï™Mw!uð!üäÍ{²—¦‘—äñäêœ@44f +5Ùm±#ˆ„êa†MG„\ot¿bÊ™!¼"¾ÉAoI,ŽÀÿÛ²ŠÐOZ¸#•œu§*fOÍ<¥íš‚áÀy}jÀZ’óª8é4± f³ôüjôT&©Ã¾è{íy±¬¼6™×@v«àvÕ¡HÝØJ¢‹@ÿääV%2éuâk9^qþøSCo“x‚‹[’<žƒQèŠ~0ƒC+YäVqðq-éfîGΛ]WŸcMfâš]­odB§ üÞ (]=ç»þ$~‚Ä ¦çK@جMA”ž{,wÐSÚþÓ`³1V#hYC=4ϲƒdÍöfRø¥ ¹ùBT¥C> ¯ó!Kþª2m©`“n`)/Ä%à¬æTxŦ9ôC×3¬hUrjN—2ñÈIü Ú‰2¨ÍŽ)gc|!®>Y8ë <ÙÄg„ð¬ãÉ­ng +䟭ˆClðL­5 +Á6…êbÝØ‚¡Š‚ÙÀËÑ€Õ“jaµ'Ý ÷b R`^ûÎ{LŠí¾!]K, +„>Ùê$530½)–C w›¢ÞõçW`m³ô2â#ÌLeW#î+/ ¸üóc…†,JrΩÁŸ•I“¸_™ë`³>üJµaKÖ’d'ÇÔcyè؉!Û“Ì2# +¸ÊÞ\ô.õÖÀl RkŒ#ÆHä1pf^r´ÃæÄm·+ªÝ_òÏozSIÚêL-±"±( ¤Ølr¯$àZ)|²²$`Z*uâûxȶ0¥× +äwÜý©¾¯þ,W×k±f¶dƒ\2è!×÷Æpþå˜+òƒ±~“¥VÜé=q„§,£Ì®«'3Ú â,„=7C7–SRù‹V'µÈ€¢Ë$;´¿ŠÇÔßÎe,ÆUlY +®•KvÿZ +; ÿ®Ñ^ö&AúvýúXµî„¡ò *žUB ãZ@¬…Ñäå"ó’41;‰QOON„—dÓó&Z‚mÊâÉyB_ô¾iv,¶0Òî%þ!uÌ)àØSþ‡=NRéáL!ðFp)aX¢ï "G¹ÆùÒHì0éM±òÛ„í¼_'Gbäb\nJ)ü™À…ãyÉÌL­˜¯-û÷¦6e ïÎòÚ½àÌ[ÚÈëè¯è%^_:Póúø¼Y^[çe]®‹²!ÙZõáJ²a|ÝD+¥$“nH¾ý$ÓâÊa4M€VŠ¹V2¾ÐÔÜ;›Êà†*x9U¡ô¤\Í$$)x¿\ïp–¯*¼$Ê/óÕ:ÏW ô_/(|=9oŽ¯öyš¯JM"Pì’¢LºÑ‹Â˜Âò<$ ýÀ{é÷<=ŸOI ù¤~¶N í¾ŸáF{úId?¾<˜ØÇÄÒ` TÉÚ†#<νò3cDw0Å=œ·§mБ÷S>?q[‰Ûφù÷Xš@0-•éìCu Vñ_”EÌ\–\ðŸM“AýTMåÆa$ÊW¼¹¶pjCa¶(ê¦\¸)y¤j¬…Rs£Ÿ²°WèañÀ*Wøp4DžŠãYÿHRW¯É™bñY[6ÅçõˆÒÿà=.葽¤G—Ôzt|Þ¬Yç*¾­GØô'~n+‰©3ûù9U”!6ÖhߟÓ*é˜*¾ð!{9í5Ê£(”Fl,D¨!Fíd;½1ô¯±öRZ¨ÆD$L¦ÕýcW¥ú t ö`LQ°‡?£HyŽ=4(蓹å$ƒæ\W›êÀ×[y›ãj…Œ6—.)txìZ Șµ!Ešq€gϽYl8®Ñ¶Äælð@@ª~,côt…)ήŽ^°½\áßí£x8¹ëT}ô¯q‚ÈÛ‹tL¼P…º¼ËKŒêÍ K:4žÚh**êÆälËÔÑÛ´~J2ÕÌ×L®ÉωLê®r/K­½DYn¬bÇuÿÎ q*ÓÁ¾=Æ™mgë¾õ’)bœ×<`„ëþX ÈÍÌFvé‹­´NHfvˆsþñ|E3ñ–bÄe»Ûµ“øÅ™ó~ß·O®‹~óféП-{ÜÑ{‰…¯&E;E÷H3ý9€~ªéG +¾ÅÉ—2Ò)ã‚,÷ò47ï!û œª¼ý¾œáF’y©JÆßÿD ,|pÅëh»°³B{Çž†Î,”Ã/¤½ÿB›úG/0¨Ê®*ºæYKª ’ \±?[þHB/M¢ËFp„9oæxé4±€Ç‡Í@ë°ÿ>.>¤ŠúžšMVá?ú_ýPÙª²{Yx&ã•òT qÁKª ;ÆWÿ ùáÿ…©§endstream +endobj +5302 0 obj << +/Type /Page +/Contents 5303 0 R +/Resources 5301 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5300 0 R +/Annots [ 5305 0 R 5306 0 R ] +>> endobj +5305 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [418.678 719.682 512.306 732.584] +/Subtype/Link/A<> +>> endobj +5306 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 706.133 216.896 719.034] +/Subtype/Link/A<> +>> endobj +5304 0 obj << +/D [5302 0 R /XYZ 85.039 781.388 null] +>> endobj +1486 0 obj << +/D [5302 0 R /XYZ 85.039 434.632 null] >> endobj -2233 0 obj << -/D [2228 0 R /XYZ 85.039 520.401 null] +5307 0 obj << +/D [5302 0 R /XYZ 85.039 414.041 null] >> endobj -2227 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F41 2104 0 R /F70 2201 0 R /F18 2207 0 R >> -/XObject << /Im1 2193 0 R >> +5301 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2236 0 obj << -/Length 1982 +5310 0 obj << +/Length 3752 /Filter /FlateDecode >> stream -xÚ­ioÛÆò»~…¾ €ˆá-©E¡8mí´–ýíC+rm±!¹ -8ú÷‹eQîë æììììÜ3+wìÀ?w<mÇ_ŒgóÈ}wç#gü;?Œ\¡pÆíD!n½Z^~yc×±Îb¼¾'’uòκ¸\Þ®¿»›L}ß·B{2ÍæÖÛ‰k-¯_-XË·øõ¬åŠ×«uÀä7wŒøȯ&S×Zy?òÎ-`î®®—w“¹oýq¯o®—W+†/nV뻉7³n€ð§Ÿàþë7£ïÖ=Ù§D> -ÿiôîƒ3N@¿7#Çöóñ#ÀŽí.ã|„¾¾¬³ÑÛÑ;.¼ŒùÔ€‰¦Ú>fê;ö|t¶rÃ[Ýf ­FEUt+L-P½…MUóâ—E jùX1zñ¿žõ’—×rô%c½åï¥ÉñÙŒ³TonÕÂD•“n®—ÛW6‚ÍuŽ·n&SøKòâ:Xæm=žŠzSM´ ýÔd ‹Ä&©Ø¹uoJJ­*Ü43Å#¦©3¢Õ #ºƒ m› -¡*q™ÆÈ ³&FݱÖ[]j¸F÷Î ¼CLm@£¹›Œ±÷ˆ,®š¬vD`º&5#A÷©Dà”=1hVòM0ßLI­‘{‘ 7“+ §ƒ™y0EÅp*I“ï:ují™$Iß;®Z±™¥.Ѿ¸à\Ò—¼fɼŒ¬ÑûN/= R'dJÐ -i©HIÞÚ*AJP rÌ€QœªŒÄØrGd†¼E´Â§59‘±âš×i®m -M?yúq’È×XO\òBb‘IÅJø^ÃJOB¸>­SÊ&ÛûÃwu³F ´Ô&“#(¾;³~oH8"N1Ig7€U‘ðDÜ¥…1' w„Å ÊÓúlöÔ¬~8·*ጯ¾g¸»ÈOÈ|Eê‹ÝÜsv“® È4×( -–ö†b7`éV’þn‹Ärüú‚áX‰Û7ªJãƒÓ»jDIúÓ4ÑâöT˜Ì‰¾¢¼TI/ j½c}úåXÛÞÌG»Eö êô@-v#¨ÄP«Ÿ¯ÁîSÖ¡@\9CqëO^˜â?@C6%ʼn”ýù'&=§§çÙ¡ý}5½]M(Û/¢[®bÔgË5[}ÙTµ„•µØ4‡ÞƒØB\M™•ýäšž¶ãè\-aÓÖtŠ±§mæY[†ß–þ¿mËe‚²t?.µ¬"ÔCgð¾²ST&°5‹½¹4“ƒé¤Ú{¡:\:©Eb¢Ý€°X-„ÛÓ˜t I¥÷j$¦,Åk8˜VÉfÃtTîhƒ;/fH¦«؆"«ÚW51Î…†»nÖuö.øD(bĶ ­>ðq¨õ¢úó„Z›L)/ž©¯Wœ -œ„ð¸RÆ2ݯI…J•)V7Ü Äî0Å©$}̬0@‘“âÏIÊ#òK(U|(GÉ›ÿnû;ÖŽ½`ZK©ºm¥(\yÚÎO&š·ù[tþãá¤ó±_²ân.c3ìêRìÏmwï̵Ý(J‚®X‡öÜu»\ð`/°a.éçŒÏàS¿-¤PE»Ž‹bE3©¤¼UùF1øû¡teXÂáº4Yaw¶ @ãxNZϵC~0œÏÜ5 ”Nd¡¤eUó¢í[¼Âü œMXvÝj„4Š?Ààª²Õ ¡j»oàÌÈ,ƒr‘ÕÇ5HCÕQÝèëàðüJ•ËhYVQaωAšPe ®>·¸ØÌXEŠ×›Ç8LEF.uOOß_p`i>®jIô]Í|¸K¾~ÁÉ4ëÜè6G‘Ï©àÅaL,)Cp‡£oç’PJ¶œêÛ¼r O~ßß¾K-ƒ^å¢óé,¤Þ#]ÞNF;õÀ£,$‰O裻/u) ,íš"Ù&ª} œJµìÈŸýE©îM×!꣖SÍ}d_Ü -iBÖ/lx"Çw™Ù¨ìiÍõi¡ýä³Z¯p>d°Òågl ×8G ‡a½IMÅty¡oøs{óÃÍÀ¡GÈŸ‡ÒÀó­O¼ZÞ­®–]œÙÎâH¸Ÿ«VJ®U¼M ¹sãèR·šÄu‘ ‰,ì.¶&µHù5Cu²©Tþ¢¿ø­h” Àƒ;UUÉÓu&KÔîÀBV½}숃RÍüбò}õ);ÿ’÷®†Þ¸(B²aš +~dÙc‰Ž¸œšùQÌYmM“ ˆCÄ^TÞhß8GnÉ <2ÌÌ â¶Mi+®öOéÂ6ÓŸuv$z é[ê{]–:9½CŽíuõÌÃù/:£Ìé™SSV:†÷E½’E´zï„NN£7®šêký3߶á€; ÞYú#±æ}±t—û]ݚؔÉ!àO©?5i©sݦU§Á-¿‰Z¹xj•;o8cº#ñ÷ü)â$Èäç˜çÛþfóÿ:ê‘glŠl#Ô¦Eœ³+Í} -Cñ·ƒqBO{ÖºTÿò÷®àÿ¯Vø·åB˜æìð„ g ÿÌ+ÿ³ŸJšSÐiñüëtþTP¤qŸTþendstream -endobj -2235 0 obj << +xÚ¥koÛ8ò{~EÐ/k5#ê­.p@ßÍnÓøš8`w?(¶’h+[®$× öÏß¼(Q¶,_q(RSäˆ3œ÷ ¥Ïø§Ïã@9^rÅZyq|¾X9ç°òþL ÄL@fÌ«Û³‹w¡®•8Éùí}·O üÀ;¿]þ1yýáåüöíçéÌó¼‰NÔtEñäõ—ùTOnxvþùòÓíå§÷øääž|™ãòõçiìMnèòS·üòêÕK~ò”3ýëö·³··-¥- @U‚d~;ûã/ç| GúíÌQ^Ÿï`ì( Ë«3 S¾'ÏÅÙÍÙ¿Û­xÍ?ç·†¸â»¡r#xŽŠcFkWyÚÖŽ +¿e¶Y§ÝX…Qxn€w::Ú?žö|¥½sk¯C„ rˆ/°ñy‰ +â ‡¯yæfÌÙ?ÀYLgzR®60[d8n2˜Ö"µ7ïxTú/æ5ÿÖÙzêÆ“†š’g{‚O×Kla²)|ái3ÁOf–jäèYhïÆpBŒd§›M‘/¦;I‰È6+q´¾ØL=YÞó½óGZ9‰Ùá×.‹Ì"/TIœk4"W:%×1„F®ûøåjá3ru]–VÑ=6Y•Ý—Ukâ%ι“ +f[7 úÒrÍË°É€t¨<³X$Ñ”›z@^ B(´èÉÌÐÚÐ#Î?„~0Ùá@än4yd¦ª$ÍYÂp»È,úæH~)í[T9Â7HÈùÌuØ£ÁÚ"âêò +ÞÂë µŒ&C @Ânð?*cY75à‡ÙM3Àí'<Ù m0e:®|Ç£ÓhÇK(Aí!%ÚR±ä™ºÉ‹B†%žC^JÍô&}ÈM‰;)ï™!:ô• ªC æ¾ïMHá€ÿ‘áÅEr.È}˜É65Çœ=ü!ðU·[?cOáPBÊQ #?Þ´©y‰36Äó•'(å3P”SdÉ)ï +:çë%­vnn?üRK>çzàjÛsø@Ï‹µ‡Ž&KÛh€ä}q@™u»çŒLL4™ô=¿»`ð +'‡w=8|Ú¤¼Âù ³üŽ·Y.)gyhÁÐXøím®glÛ…Äå~\ý·Ï?ë’)L‰ 0T“>JFÛ1árÕ'‘áÇ…C—άŽ¸ekÜx: ã SÆ3†ÐÏ>¾Aã±ðõÛ’æJà9£µÊzÉ¡ +q•›Úh[ß Å2ð®¡ñ}wéEôuj‘Ò÷B{÷Cª†b€MÕ[ì³Ï¥Ö´Âã›lXT¢2=’–7ÈØ»Õh…jeýD Ý)Ф ÛÕRœ./¨òÛ;º‡*çµ€ŒÊK¥ÃhÕ#J½Êª…Ñý´Àø)Õš4•w˜5VÜEž7µ¤#Ü5ľyìöÓ¼@CE¿1YƒvZD£Ô0¥ Ï!…Ž™ãàÁž£¥zV#•õ‰_Þ-½E,ÞN¥!}Ï6&n ßí¬ÏÊmÃ#ªycßTJýJ34ª–¥åáÂÙиA0ùÈ~÷þyd¤'Wé‚a®oæ?Ïù÷òb¿2ü}yi>Ìg_ÌøfK¸)‹´’¦÷|#M?ï/g—Ÿq®}ûµå£¾ 8€[¼BªÂÐGWã…“7ܾlÈ#&Yç?xd2T×RËáShÄ£VL·Ôˆ!¾¬)[7ž§PñréT´jDÃÙ&o,eõñŸ:Ø—ŠœŠƒŸZîë;eLEiŠLÜëÐÐnO®8.X–¹Š…½ò†éÂI:~Z˜Ç¬Ø0P[Y­ñ„¼½ Hß*ÓNã +`Ä•¹:<…wðÐtB’½\™Œî‰gî3c^”RμͷúÝDz½Î@K>îÞñ7ðN¸÷hĽ Ð)÷>†P’÷|ƒŽÛÂו¸=ŒA¬œpåñ°!Ð'°ïí‰Øßçt[H&>· +ÇÞDpQÕ±# +ZÊ" +Ùikß33°6Ul¦hßÕÂJ¥2µÎšÁヮľ¯ÂS·²Ј Ð)%>Žðg•xŸªA%¶¨ºÆÔóÓ¥¹E uMP]_ÀüÅ)ënGÎA»>Ö0ùÝJI¶w1šfMµÝÇ%á^”œ‚_­ÂS–|!žœ`¶hxµÎM!p"¥“Q9 È8C'Q¡öÄ8Ѿ‡PÅ7 +‘£¯§µ½HǤ J<¾ „ß”(ù¦HÞ¯~¼ÄŸ¬ÒeÆP&«Åñå«+ôï‰Ûõ9pšïOÚàžæëö~2ñºB§w¿ òỷ:Ž¸®BØ*›Ã G–É–¶ZIGϧÍ+Ô«£HöG^ä Õ ©¬ló5=\ß\¸<ú]NLšö¡==u¡åTÕü -²ÂU#áÕ®ÂL œ×¸¿ý±Õ0û<‘&þŠO‘®7‘Ÿ5)wüùÒ‹ÜUc¹'.rÄ÷Œ~¢¡÷õ¸«é`Ž{9áhŽcûI?³OÒ›±Hú0¿üí†+·Ãt#À†4çëßY£êrÛÖò ÷ T×5ØzŒFYj@Fé÷|­böX8¯nÞÌjIÍø{,T ©hÛŽ{fŠs¬©ý„ÏŸ"ì5õLóÄq•ëúýò.—õ"w¢‡dOðûaþK-3ty¿æ‡þõAxm!¹™+ê’Gò­劭“‰†*b±¼Ï|ƒ–Êvvk‡æÙy6±È…1Àª’½9e`«b[G×™éõ=%e#…dÉßótïƒÒùÆd•6ùB¬3¥„cÜ$ýDEቯ, £ SVyáÏšå>UƒviQE +jØÄmþÀ +ãï‚ôT:>ÌÃñ¤ÖŠêس[›¬L +JÐaÛM€¶ å½?¥ïh•DÉï­˜Ngà,Öø“6™u'÷Ôpô1ç®'[frOú–9rFÞêUúØš_{› —445ëö£ÍtÑ°Èž¨…%+Ùªdê=†\ü|’R¶ŸÏ’â; ~ú*_øÄÜ]+M[3’®˜¶=%êÙµÁ½ØÚGB»¼6½ j÷I¹Š5æì°¸lýŒ9DéEÉ ”ç(wðŠ +þøÿ×wíÝE—§bïÈEWà‚Ö†d<$¨^ ¦æü_ÄÉ:àendstream +endobj +5309 0 obj << /Type /Page -/Contents 2236 0 R -/Resources 2234 0 R +/Contents 5310 0 R +/Resources 5308 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2217 0 R +/Parent 5300 0 R +/Annots [ 5313 0 R 5314 0 R 5315 0 R 5316 0 R 5317 0 R 5318 0 R ] >> endobj -2237 0 obj << -/D [2235 0 R /XYZ 85.039 786.531 null] +5313 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 389.924 387.717 402.826] +/Subtype/Link/A<> >> endobj -2238 0 obj << -/D [2235 0 R /XYZ 85.039 664.759 null] +5314 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [157.067 308.629 429.341 321.531] +/Subtype/Link/A<> >> endobj -2239 0 obj << -/D [2235 0 R /XYZ 85.039 642.243 null] +5315 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 267.982 343.884 280.883] +/Subtype/Link/A<> +>> endobj +5316 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 240.883 508.187 253.785] +/Subtype/Link/A<> >> endobj -2240 0 obj << -/D [2235 0 R /XYZ 85.039 619.728 null] +5317 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 186.686 338.269 199.588] +/Subtype/Link/A<> >> endobj -158 0 obj << -/D [2235 0 R /XYZ 85.039 532.653 null] +5318 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 146.039 400.551 158.94] +/Subtype/Link/A<> >> endobj -2241 0 obj << -/D [2235 0 R /XYZ 85.039 503.249 null] +5311 0 obj << +/D [5309 0 R /XYZ 85.039 781.388 null] >> endobj -2234 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F65 2099 0 R /F20 1617 0 R /F35 1632 0 R >> +1490 0 obj << +/D [5309 0 R /XYZ 85.039 471.827 null] +>> endobj +5312 0 obj << +/D [5309 0 R /XYZ 85.039 447.845 null] +>> endobj +5308 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2244 0 obj << -/Length 1910 +5322 0 obj << +/Length 3267 /Filter /FlateDecode >> stream -xÚÍXÝoã6÷_¡—âäE­ˆ¢>ïP¼mÓv½Ä‹E±»²$ÛêJ¢—’“æþú›’’l+)z})‚@$g†þæ“f– ÌŠÇå‰Å¡pfeõ̵v@ùaÆ4‡kùŽHz¹ž]}zsÄM¬õ–XÖùGûÕËwë7·óçÜœù"ŠbûnÎìåÛ—K\õíå~={¹RóÕÚWì7·já°_ÏÌ^y?+Ê;X¹½~»¼ÇÜþU­½¾y»¼^©ñ«›ÕúvîEö 0þò œÿyýÓìÍz¤ûÂwü£ò_g?»V÷ûiæ:<‰­»K«žùwŸëy5»›ý§ßEÑ|KIM@´ð]îpfáÃqœ÷Xñ`«ÍØûBjX¶ê›ªÏ±-ä?ôÒ^Ôš)/e‘uB>jÞ&¿Ø§Ý‹c¥—ËN}7šV‹cÓš˜vÿF¨†wKH±JìD£“å½üN}~üçóƒ¢Zàã>þ#.t_Hœ}s4Ûx‘ã&É‘öPdåöñ‹]ѲÌÔdt\›Éò ¯¸RËTÕ€`;¡¯>¨ÛÄÏ—E•výÍ_¼x}s÷â…šÒn¯¥…ÙEó}lŠŽTûlÌ‚EžEk¬þw£Ë9Y“äÂóÈo&`jŠ¬hÛÔ8‚:íˆ\Ôi©ÊDÓIQU…œPi¤:Í¡#ŽáÞZÏ«c+¯*‘¥ÕU›Ö›ôª*7Wf›‰#d‘j¯Mõx²Õc1e¤YvúBUÙž‚Ôti^—ÍA4…I ±S6»ÁA´]¥Ø–Õ¤" íO€Sü~²»jkÀ¤Óò”FLðg `@©Óöˉ„ºîX& ‘³|q))©q¾ì!ånä0?þã¼ÉƒÄ ’p2ob3ωÝèÉ}HÊ…}ÔÈ°Ÿî8<¶€ì„AÔ§Ö(ÌIð²Cj] (Öb¢07v¢€*™õÕbŽë' WäјT¤háêºfÖk:YƒZqB‡*¦’'IìÇ gÌ‹O.óT&âJP[Ús=Ö/\©]5xH¥È³Å(]»+!÷_† °ÒŒx#È[t׊\{«K]û{ªÉ ¤ƒ‚tm‹¦+ÓJÃËiIŒ¸™M﬈3ˆ‹+>8ª¯Ò•_vR'ѵZÞ®®—SàR3¥ÌöDî×ÉLÔÙ²âi¢xߪ”~æs‹K{÷ #;ESä%ŽVjõ0göóNL„n%°çzhp5´KýUÈ ¸Ã슋*3»)² jp°ô:/p^Þ|p|m">ò~˜¤êS“J#;g‚.q¨Œ1;c÷æ¾”dcu˦sÎSg¾žˆHúN䲿–½˜"YY‹¾üÿSª6ó4t½!²`2éPcH^=B&5Ñè•^¥¨ 1(#[€Q!ø;Øñ ‘€¬”)ÈÊÿjqrhîûðJ7j#4Õ½I]tlƒÉcw„=$ôZèMÍ…æžs<–LõÜ,„ŽÛWé™0ðÙpVt¾yàø<ßIÁhÏI\ß ód&6¡Ó.Ýg>d¨–ÀyÀk ™«òY+èç0 l…P¡HEˆ)s0Ê– Ã8±¿ŸÇ`©$j! 5Ê‹.-«VM°©Ä¯MÈ–jŽf#fýEE¡óýv²Ù:¢:q1ð=?€£(r§+äíÏÀÕ×°þ{] ôS.íÒMÚÏ@Í÷é§<׃A£ÇÝ3Ó=}ð„W%ÜažGnåÆñßË­Ö&tð±Ôç< Õà98#1‚:\¥&˜â‚cÕ… ǹIš—…Íó¸IÊxœ)â(Öœý[ç´Œ/âçèoˆ³Ï œõõíîó@ÆõîŒc7‰¨ŒØz‹ì e;Þš*¡Bn0Ü[¡ˆž«0nÕ1YU .LH -rž€¹©¤fôLÀJÅ80M]Rª5TÖ÷©yÄéëWŽ¼ësÅ%²HÛ!07îO*5¥8¶jm¥Š¯ÊJ”¿(ÂKÙß±o.ß0‚ ÏŒ¿ë’MX˜â¡\ºl²ê˜21V£³7¾Ò(·íË!"rèM$Î7GÝšþB]¿äZÄ…TuÔÛSû¯)P¨ì]Jn³¡†<°¹ãª/æ§ívhk&º™¨u[H(Í5½)êáƤ£§Ë5þ<¢O\R=;JJŒõâPVa,~L{ê}>”M>ª¦‡îëïÈÑVkI<8¨yhÕ -ýÅf¿ÇsËߟâûäî`X(õ·¾‚q¯h ú)¦C,JåÛʺ £r&¼º±ÑS¹Hæ›*r»’†ÖÒŒöÝØeÁ ôCk‘ÀÔ÷¦ªâ_ø…zõŸ”ا˜—\FÅs’ÿÍC¡endstream -endobj -2243 0 obj << +xÚ¥ksÛ6ò»…Æ®ÔLEÁGîSšWI_¬\î¦íZ¤,Ö¡ÿþöP”D93×éÔ‹Åû^ELøOLRå2›$©ðešNë³`r+΄ŘY”Ùç—ùÙÅû8šˆÀÏ‚l2_îè(?Rr2/~÷ÞüúúzþîËt&¥ôDæOgI’zo¾^O…wÃÐë/—WóË«8‹(¼¯×¸üùË4•Þœ‘.¯v˯ûå5ϤLÿœ<{7ï9íy®2dóûÙï“®ôñ,ðe–Naø–×gÀ§¯"içõÙÍÙ¿zR¼Mx×Ø«Daì‡ BÀ £'Uæ«,=. WNÕi®iSdxd±÷©Ì„})ÂÉ,N”ªUN„ð3¥PTB$~œ…“$JüLD$«+ k¦3ᕇ¯Ú£¡/ÒiN¾O„DY&g0&þw×"ÀÅåZLÞjàt²Ç,Ó ³"è•P±ŸEÉ$ (VJÌÎWSäs&…òÛM§×¹©ï§aâéé,L=†0†i'»GHä-Ðê5/ÂÕfû´™Â>BmLÕÀ÷Î׺ãML!÷ƒŠ +)ÍðÁP‚U&#—e[6¦~¼ÎãÃ`dVÈv < £–aE[•zû¶+‰¤ÕުꃿÊ+ŸiKuN,–8/©¬;š>a{àØSñZÝOEløZ‰Go³]Óv$küCˆá+È@¯þ-ECY2™á¶ìï°V(É +‘½è¿bùAšôz{FÁ¦G‘Ÿ¤¬gà³”ïA¾K©À»&Q5d'4B݈ﱂ'¦ÑecÊv™/JžÞ,ÚjcºŽ*ŽB?Š£—™Þá°q¨¡q8¦ÃÞ†-üë Ú@ìåuGÖxÝv³!Ië˜!±6„ãm—ßÑ gÉ{ÏAwÂÌ3¤h|'DéWƒ¿NÏ™Rn©ß£‘±<²RÑÞîåæ¹3¥ÿ›?¯Ééÿc>bP¶L¤hÜËG*ó:¤‚G¬ÑrÒ0çPvìÇ!o§ýX/MÙà0…+;ÛÁ2¦[_¿ùÄØhgíá3éŸ!ͬYãž|³©{'“ã£Tºé˜ =4ÀŽŒï®lÊ6GÒŽÀ¨‡'K¸á†ÕŒ.Ë¿ô­;D‚¢Ñò|Òž|:ÞŸ“K€AÇu¶.ª?î‚7íXؽ79*¬Ù·àiˆ ‰oýÌktIô¸¥‘`›#åuÕÚYO ²!X«k«ŒQÌ*@ÊÞv t¢[ô_¯)퀾þ‡!ä~r³Ôíºc2( ¶N˜8'ˆãµníH£U+õ#÷ÊRà¹aìý%¦·(ƒÔÞ¬á iT˜¦Ñˆ’̦Jxæ=gR îsÙ¿UÉ+{ïÌ Ýð·/pb8_ÑÄWâ}„•mgõÎàƒ_¤ò*èá±àlè†2à +P.Þ«xe#éÇ2}ˆ?«ã û2ColxŘrˆ9‹2?¯ј6Ô›¼X£*¨Py³ 7‹xoÈùü¿^Ü—æÕÅœ Ñn"¢W™‹Vñ÷b“›Õ…Ñ•KHfä÷Ì÷ +²ïÐr”G—£’’шE@V´®îVÎråÖÙ*NØ÷Àà|‹šp?Ôÿ µ^jͶ2¥,‚6iþ®­ª‘f +¢Ø3P›Xà)6ÜXóEǧ¤“i”q2„BŸÙëE﬎Mö‘kŽbÀW¬«Èš׺sž6”y7Øþˆ¼P´ºÒ­·l8!›‡ï3…±m˳ݳÀ„óqçØŒ^Ïûn(…A, ܵqWhû|–öíéXé)בèvõ9.Ìcd6ˆ?¸ª›’Áõ£ ¹ñè¯ Ã.oû¾-·vã + :+uãX›¡y#r~ËõÚ–-ÑœXhÜæÝ7’_Æe¯IÌÙ+D´Íä¯Iìò#Ä¡üa?6ÙÇ(ïÖÆwš,5©oÁ3Îæ† ½õJ¡:•iâ». +ÂÛ;‹ðeÚ;äÙ›Rû=Gq@/º2f†¿©óç»*ünÛø ½¾ OQ5wV׳^'Þ{¥B/ Âk ½ýÎ+ø+³®o&¡'Ñ‚½/¥­OÎl€t\ RBN@)„¢"’ +œÑ*¢N_Æu¸ï "’2ƒÊ®/ãb,àÀ\‘+3S uòT`vð§Å¶@CÊ€|IRŸ›,, o¶-é’‹èPÜ}#¼¡š(vxµS7“±/“ðå›ípN×zR(?8r\ÁUÀÝãÑt ï—JsÇBÈJ8+7Haó +«®è»¡^°ËkrþŒíºšówXê2¤+ÛýÐzÊbÃó—õz€sºñ*ÈŒ25°Xá ÛwyæÕ’¡­Ù$¿õ6Z°í¹¬ÖÞP-¾®c;¥0 pLZqNN`ÎcL.Û¾clצ$Ð'Œc—¶¼¾xéÎiceê'£ +0*Ôa!ØÇ{i uÃ_”+TØ3à … +L)ë,iS'ì–a«Üz +’?llÆ•’€¦Ô»>+å|ÏNŸ™+­:Êöö!$°ñ¸îô­ì¿ãðW¦_âžÇ‘(#H•_>QŽÏÛ“„•ª½óÊ'nl©•»jÆ9ã¡)aûÓ9Œƒ*18#.xÜEi·rF ËÞ^2Do JckxŠÑêÝoxOáˆpwR×Ç<ôzF'ò?T„>¥³za5sæÊ*Ô°ÈYº¤ +þ„^ˆ lèDÐëÅé´^8¤èÅ‹Z½8:oL/†çu;Ù¡‰Ø¢4‚,äv¶.yÌ™ïÆå¿€v(?ÚªÛ•"8îzß|TEIr8]4ä×0QO<ΦÈÁѼ=KÇšÒ–”2ôª¾+«ü—s6ÃŽ$+Ø #‰5x ßæ·&Á#ãWIÎñ~Ñ.Üí$ɉëC¹ê^¹ŠïÑ*.•g2´føÀÚ5³Éháõ;[ç—m~QïôüT¸Qâ«L¼98§Ã¥ÊO¬¦¹pÚpù¶­èy!–½{*AhToa Ô6Z/’@°DaC°<Å°=çE†w8§C˜¶g®¿pà…اôvÃ닼oíÅbû % +¸ãæ@K”PR£ˆw +g,¬7Ö!RemÇÔ$…Ϲyùxþ3¿ÿZÆ þ( ´”NXé-úôW+À iµÕ$J6¹cv…ýg}K,¸¾3”ɘfZûlšWºk~Ãkœ&'¤ÓøÍ›¾Ó°.»†lD½{óçÔ©ç¾ö÷ š×ãþJÏð4»ÍÝÏ*/ÿ‚ƒÙtp”z„1¶z^¤Ÿ&Q(VFÿÄêã#.S1õ¿qj vc­AÓ˜:Ô‘\÷b뱶AŠ£>“ä·XЄNm™QA¹VHQtZúQÀ][б²¯‰ç¾½×ÆË!`×pÂÙ 7kàZ·ÜøG u«Þt¨¡ctKS¶úùˆ/1û@\¤þÞºª+ü)†Î¯(ÄXþ>7£¿äS[m¢ŽÿýÏ¿JÊL?Y¤+ÍvÃ@¢(_`&Þùˆ]r-GnÒ·úùœ‘œ<@ŽòX€±¬­Î#`ךßqiÐIl,¿ËS¥|‰ý˜C„ÿù•þÖ?=éÝj$ýTfã^UA +Ç J% þ= GÈJä1Ãÿzù‘éendstream +endobj +5321 0 obj << /Type /Page -/Contents 2244 0 R -/Resources 2242 0 R +/Contents 5322 0 R +/Resources 5320 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2217 0 R -/Annots [ 2246 0 R ] +/Parent 5300 0 R +/Annots [ 5325 0 R 5326 0 R ] >> endobj -2246 0 obj << +5325 0 obj << /Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [177.134 169.832 306.43 181.522] -/Subtype /Link -/A << /S /GoTo /D (passdb) >> +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [309.861 384.459 512.306 396.452] +/Subtype/Link/A<> >> endobj -2245 0 obj << -/D [2243 0 R /XYZ 85.039 786.531 null] +5326 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 370.607 273.67 383.509] +/Subtype/Link/A<> >> endobj -2242 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F70 2201 0 R /F18 2207 0 R /F15 1628 0 R /F41 2104 0 R >> -/XObject << /Im1 2193 0 R >> -/ProcSet [ /PDF /Text ] +5323 0 obj << +/D [5321 0 R /XYZ 85.039 781.388 null] >> endobj -2250 0 obj << -/Length 3101 -/Filter /FlateDecode ->> -stream -xÚÍZ[sÔÊ~÷¯ØâI®beFWÞŒ!NÀ³'$Åáav%Û -ÚÕ"i±9¿>}“4ZÉ@rªŠ*v.=3Ý=Ý_w¬üS‹$t=.â$rC­›í‰·¸™_N”Px‹Àõ¢§ž®NÎþù 幩—.V×D²Ê>8/Îß®ž_.µÖNèž.ã8qÞ*çüõÓs œówøë;ç—Ü¿\LþæŠÞùËÓ¥r.ý¿òÌ[¹zùúüê4ÑÎ?yìÙ›×ç//¹}ñæruuêÇÎ |õ -Îÿ¸úõäùÊâ}¸A¤‘ùÏ'>z‹ äûõÄsuš,î í¹*MÛ“ Ônhé—'ïNþÖïÂsÁ‚WͨhÙQ,Uê¦~8GãÇ®k Ý…i¯MæW‘­ÍÐ @…a:unÚbwòF±óÚln u—suš*§>4-wÏ7›ê°kî™]Æ_«bG«d—‹:EŽ„ .Ô‘ŠÝTk:º­˜¨½•3žU[S쎻ìÅá¥ßØñB¿X…3æ&x‘³ÅÛ7›S?qnáLåä8ÌÔè48Û2¥Ùl°Wáøée¼hx…áî;³ÅɵéVá"TÒ©Ÿò”ö0GëMžñ*„vÄ£@+|ê“63m>:qSBÒ+M#%1·([ì w„Îï^èÕÄÁm^ãP§˜· ÿ7x’¹â…tSDÍŠÂ1K^œ"åõëwË -À9_Ê þ«·»FvÏëm±«ÐTª›¯èqBÔUUÑÌHùi×o¶c?5ü²£?º¨¶ûCËl#S4y>¹R÷í.æb±Bë ßÙ›†„¼ÃUw–À×ük˜hÖ¬`¼e×Áæ¬=Ñ8ºµèW;Èvw:MæS“¹à‰´©sÙສ™¾‹Í¡ÎI¨¥-UHBm*b”nð€lbaxC¨ÒOS简  Vïž×9)_T,ÞuU–yú]Ýâ­!ݬ2Ü–5žÓâÚ¯y›÷¾¿âÑÄ3\! ¬ùºŠ‘·1ŽXë7†B‡ä+HY_2Ý𫎧ÑPIUóF( Oκjè™RNM•jÉJ‚”q” NÎ µ9âfskêîîe©…±ÓÛØÐl@ÈéÝÆ7S€| Ì`Zwsl)Aä;oŸ]ð¤H¸Öé‡óNUîqÄ›B‘œÜDj>%A“‚áØ{' ßÀžÅÂ]áMÑ´5ðÀq§gSÇ1åë˜@Ä@,5!¾ ¨Ø6%qYq¯¿/h·2ÆRTraÒŒ.å!6s¡ÆyÎZq×#L„AÈÃvפÒ-D? }<& ä¬Å+³.ó3X³¦?Y1ŠìÇ×!ùi w`7GV¢LŠ¯`2ïDH¼Ä4cž–óZŽÏ;ïÝghé‘¡-ö¥€©f€d|Z滬aj–•Û}~…b·)Ñ -22˜›'3õï)7‚Òc&W‘«#([úÜ;P3¹÷÷…$”…Ç›âThíÍåóÍv½? Ñ>š;ŠªGyU\/Ñ«= ÊÐØ—âª)ÙØFQð °€J"T|uO ÑLÖ’È`;7õÒ5oý/!¯%d6¼#-,°<[hQˆ‘’‰¶Í!{eçØâŒ0|s¨‡,wªöˆE×­óÏÈQç /5<þe-÷g¯ -ò ¤¹çõkùVÖm,?BºÎ²°ýüïϱžæZzê1’V@!ãQ]RäO  S±í -]ç8©g:<@ð>"9€À›¸ëPsD’¨2 PYsW”%öŽ†Ã%…tm>—¾¡!:%ã"3™«Ön¢1Ã=å¿_ +tÆhu 6ê ‰ë|3ê-`½e]ÀBõÓ†(iÙ24•sÖ+w8ë…)ÏšˆÏÈr×g{<¯ørFRsÂN¤cü)Ë‚2Ã=›h¬\ê‘>Îò–Xî÷GY÷UøqäÆÊÿÉñe´¹r/á-¾ýè£](bgŸ|4=É|‡‹ÝÁ̘‰ïÃZ ÛðbĤ¡eAv»aád3û!?£˜eúÇ -Í™` ‰ÿ00ËÄL ¬¹5ãu’ı«<=­°ýTñÛƒŸút´Ÿ"N‹ãà(žÙaVV{ -\¹zrEŸÊ5LÓXw…(hRú*‹aíѮۛËå{žIŸ¦ÀPŠ¨ÄË#ŒȯäK¨¦BÔçeËï–"5eÒÆŒ)›!oÇLj».OÅMvÒ`ìÂV]¸MÉY.z¼<% }!\ô¨¥Ç¨_l}1³xµì­Ú`¶ L½?ñ]ÏËH»*Ò?—÷·Ùák¡¥P®‡jØ(ÖŒ5Žd®MgÝ–!Sʸ#î_±C—‹Äëä]—œ_ö¶Ü'¿½HÖΛÍE!?Œ ƒK8 …nª¿†È¥µŸY< †k\Í%ãl*,Ëý)«1¶:ìÂÌp¤5zÔö«îÉ,g&XÛ_™…õú¨!\¶LÁ Úè29º[œ¾&UlåùŠ†FÒ&½7ÉpÅHV´R%ùž›xÑè}Ž^e|)ïäæšsƒIv+ éɉkTzŒ×RíÒ:6ê o ¦„¶ ™iíXÇ‚‰UãbêfÈÅLÉt˜K“ýM°Íï[Æ!¤¨å H¦å=œ&üÜ@aïŠY_þùü ü/óåú~—t–EW¡j¨‡Û„ò¶ÏÏú7îI¦£à:Sýƒ©ÞÒ¼(4óí4}ýa˜SŒ•š±k¤@@–ù¹ëq'9)´lÿÓø–pJÉ»õfq¬ }ûªvâXpyÊvHƒŠŽš쿃€DK¢¢hœxÓ¯0ÉlEÂôœ„-/æGžÏø€AÉ ? '˜•!™|eÂ}è…$ñz7Ÿú£É2ÛÉzÒ*”¢{¾6­<Ò–}Ro{o&_ŠTl{/%‚”Ñ(~µÁÇ>îõqK„ÃZ”OϹñ½\­«h‘–®E¸•7Lª\áÊç¡ÉK N5mWÏØíÞõì÷¾7eE!½l>òH#A²èŽ&µ~(Éò|ñ ©7\(ç¯çƒƒÔÑ €šIªT YXþdo6eföóiUU[iUœ8ç˜ÒıóêÞÕ9¾ÜÇ‘Ãù§>qü@u€Vè‡Î[‰z[Љxˆeض·åÁW¾cÖƒºAÉûŽîoù! -`ñ ßCñrWï'6‰QM]¨ÿ_­ÜØWÖã!À+ÚKLöB ;˜!w%±W=äæ]$èóyþÒ¨úï‰Oñ£'ŠÇà”( 3åýn;þF…Q0ÕC”'Û‹×÷’‘íI°á÷4Ø»zXõ'¾ÿŸüÀ1RØbfë.¸N#ŽÝ4ùߧ$•ƒ$ÎðÉͲ‡œhé‡nèqúpÅßh2æ`þBcöÇŸÐíhGáfŠñnâó@¡MQ6óñËbW…>aà¦Q8ÿçb?j¡ßü“«ÀBÛÜC{_aš‘fþ øj=Iendstream -endobj -2249 0 obj << -/Type /Page -/Contents 2250 0 R -/Resources 2248 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2217 0 R -/Annots [ 2253 0 R ] +1494 0 obj << +/D [5321 0 R /XYZ 85.039 654.087 null] >> endobj -2253 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [258.165 167.281 329.551 178.97] -/Subtype /Link -/A << /S /GoTo /D (passdb) >> +5324 0 obj << +/D [5321 0 R /XYZ 85.039 635.418 null] >> endobj -2251 0 obj << -/D [2249 0 R /XYZ 85.039 786.531 null] +1498 0 obj << +/D [5321 0 R /XYZ 85.039 355.164 null] >> endobj -162 0 obj << -/D [2249 0 R /XYZ 85.039 766.606 null] +5327 0 obj << +/D [5321 0 R /XYZ 85.039 325.569 null] +>> endobj +1502 0 obj << +/D [5321 0 R /XYZ 85.039 271.122 null] >> endobj -2252 0 obj << -/D [2249 0 R /XYZ 85.039 726.911 null] +5328 0 obj << +/D [5321 0 R /XYZ 85.039 252.25 null] >> endobj -2248 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F41 2104 0 R /F65 2099 0 R /F35 1632 0 R >> +1506 0 obj << +/D [5321 0 R /XYZ 85.039 147.591 null] +>> endobj +5329 0 obj << +/D [5321 0 R /XYZ 85.039 128.719 null] +>> endobj +5320 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2256 0 obj << -/Length 3364 +5334 0 obj << +/Length 3540 /Filter /FlateDecode >> stream -xÚÍZYoÛV~÷¯<B!Í»qñ›“´t»»(m1 %Úb-‘*IÙñüú9˽\$:uŠTw9w;ËwZÌBøOÌ„*ÅI%f‹ÍQ8»…™Ž„¥g:#ƒS¯®ŽN¾äL„A¦³«"¹Zþê½þçÙOWß}˜ûJ)Ïs?Žïr.¼³÷¯ÎpT{g—ø+½³sîŸ_i&¿øÀ¿ùÛ¹/¼sù/žù F>¼}öaž(ï?<öæâýÙÛsn¿¾8¿ú0—±w„ïÞÁù¿_ýxôÝÕàî¾t¤ðòýú{8[Âû~< -•&³h‡HÓÙæH­l}tyôïnžÓ3^5Á"_Ë(14$ÐÈg§L˜4š<.-œ§OîC«B؇[Ž|¼ T¢ --“Nz1̈ 5f(½ó -ø×"ëó ÂU…&Õ˜ý9A¨ÓTñì M7íÑÀÉÛ˜½©àJ³þV* $œ®t ’^©D2¡TW«9ÞÈ—qì•ù6"¾æ&®›lÃCY¹Ä†ñÖË &¶v"ö°·@úEµ+ù‰8| Ílq7— î.¼·kx®i+¯í±÷OÁÚõ#Ÿ¶qÀ)’*GJ.Ê çù .ÂÕmQ•s_§‰×â{2Ûi6×ÛnóæaÉ£Eÿ ·šh®×9W7`Z©J:Öÿ½’›Â{`¢ëîÙüDxÞáU‰SmvÝ]vP°YQ.Ö»¥Ûo†Þ"ÛËŠ7|äA`­ Õ[ä—Ó©2ÁÙq®™|×hšmÛ¢¼mxä†9ÈMV>NÜø"S¯Î6¼:¯›—@'V÷¼¹_ø Ø®Jïv]Ñc×Üå+¸S‰ à•%w ûÛ2§á'ß+3ÐR©D`’Ôê*ˆ3XT "©³Nƒ0Œ,Ýo¡Ðë< ù2  ?ÌÐ|~{ -œÓ ËÕ-ê ¾£.î󗌓kÔ±nrU‘¦ñ¤.#ÕiWv‚ù´ö \ Àt?6Žå—AŽ¸&ÒxæãºôËpÐrЇ †2ê¡ÂL@ø©y0~P95  yóú%wV¤XáßS«ÆY“¢é×9*ƒ–^ž-p—öBmyԫšRµ5´wMË»g=Ô€jÚAR#ÐãN®x`›áâ–ôÐ^ kxê¦Z¯Gbï¡9Ý—˜ï#e`D4åD¨H3 -Ó´˜`èb¼¿9(± ÷7Å)3Øó)A(± ði|2 -G³s µ2rЊ­sv 4Ä5ümW9¯$:2vì­‘‡’™[MK'4ü»k:ÌmÞeå{ ½DTÚcίx`›5t€?4,³ñYhœhWCŒ„™ßB’ ÀÕuÎÏ\?N ‡ÀJ%{äÀó–:†” F›N\ÐûQyWƒhaöô¯¬Fš -oÃWáq䊽ߟ¡°á2ToûتÆ+EAÇ#þTåšáA†åEÁà ޾ç"aÖˆ‹7„hJAX•‘Ð_Ÿ‚ƒ˜»h„ÎVeçtêgäfñ‘;{øð’ý»Ôm±ÈÖa !Ñ’Û` ®GC¸&öF'y»8yR…"eÉPuBEzúý<é¢áìÐìðœ:gåšÒÞC¯ó¬S”îCE’Ì©L ”jkÀj‚‚À­3lTŠuŽ¤¶‘Ú§âyO‹‚H9Çj ®.ò&@K±6Ši;‡•Væµ½%a°»±Eèسw¤vFâi†·×îöÔÞ8Ob·onkr -Ä ÐÂ*âäé“:ÉGé×¥óï3RÙ]†ÁS,Yùk'ø¬EÉW%(˜–Ú{Uµ+&k»ø]y—Yç pʆìÂÙQ·Y³%h¯†p_Šß`ÅÏ%Ú­€6¯íY,ž©¨÷ÚƯ•Ë§ÑGE.ïýz$q|ŒñÉïuȇ“ ‚ð1†ÀV= b!ÊD™.]ÀÙ$àÓ_âµ%éãì ¼6/Á$…&PmµÃzÁìX9¦\* ÀO¢ŒƒÌZþu¥v±q­•m,ÖEÞ݃w¶3•*ïÔ͢ˑè`a“—ñ¾KxIa™É°GʪæEŒ½“w鼜x&íM å™í•q ãЂø äiÈ$²IÍŠ‚@4t*Œj~dÄØý#ËÁ€¦¼üï–):G„Ûªšô ËíP.>ÅȇZÔÖæ‡ Eœ³ºÐ§°ëAt@|„_&"yá*Ràá¡%HMt¿IªÉ8ÀÙªA2ÈäT• ,€ã0†2&DP#@SQä½v=`ß ÿR̸X1¬CÿjJ`¡‘m󈄟º´äìï“Åúb(q¬»b5m¾åÌ:DoÄlíøŽ“Ìžâ`Æ?ûî Çzó'Â=Fç°:²#ÚƉ4Ý?{ÏUäO -ò8֤ʟô*h³Šåáýpp2lqÄ:}^l!ƒ4MûÐ Rd!zJ%âÞPhtInÐvºàÙš!a¢áu¤ ¢Øq_lçJBÌqx™‰qQ؇iIÊÇa(Þ»J|„÷5xIÙNØçD8NÓìG7›… \˜rj$Õ—ªzcÞˆA^à–UƒýF¦aªÝaƒ}8®x",Bw•Æ¤ô‡ji1ÖolïóI%”õIÑÙâGþ1Ûl×6»qÈ“ñÏ»¢Ÿ¼ìºËHr hC7 ]Ë;[18Ò.W®èj9uUµÿ˜¼LqëÉ®AŽ4×E í^€VrZJö÷·Üaˆ åùvòd™ßŸ”¨<;ŒÊiŠ˜ËÓÇhá0 Þg£eƒÂ»+»<=?¶gÙ\O¥”zp‚W¼aXo(oàð6"ÜÃ@*È1¤Áì¢gƒ‚£ª‰Ré rÄN•e¶É¿™ŒŸFàÆͳDCÉ+ä®K~ªÎ"ÑÝ“ƒ,O÷kjlèÞ6¿ðáê3>8_BÉÑË/¬|ûêòUíÇ® -Cª·q5)ÎèmCy³®kWÖÅÑeUöYÔ®)œIv°Ã/:/ã*/˜ˆÂ†b]PuHç69Úbøùâcµçó¤1ž¹‡‰¼ã¹è*zd‡ôÈÂù“Ïß/ÀS¼Ò·§"Ô;?¥Fxžþ2O Wîšý8âvÉÏúku” à‹ÝWš¿ù!té(ñšÒ5ßð¤¬ÖÕ-·aôxJwU !]” ñÔº…ƒ:| Bó<§J˜½‚¥¦÷(TÚH#*³.ÚB -›mD‡)?Œ•œ½¸)‘÷P`Œë28þæØö·ƒ¯"ÛäË—Xqse²òEkëm¡”LGª¿¢8ýÞÖ°¥!§& Vöœ k\µ ëÊQŠåûá¨÷×k^¯¼Î%®-e³Ê]“ÓuŒ*»Kµ±§/‹>“i«ÚFòðšÄë’'¤#Š—ð¶ëñöØz vYïübYá[ÊY^tõxõn=,2ßjà ϭ1Óÿ‚š“ÍoÅ«bTðÙwLRÈ Â¯%àlC£ùÃ\µÝ>~súñÔ„þ‰Ó § ÿ—}GöŶ…vÅ™œñáM]|'‰åçD_Æ{fŽ ºvÚK‘÷®Í)ÐÚ£2Ínâ`hÓ3Úç\Îxõöâ’)Ç2…ʸµ«CƒDGö4d%ƒ"¾:Ì?$ k§ Øùc\õ¶tQ_˜„6%m,Ò~ª˜Éþorã–ülúÞgO‹Í¨3™»½ #vàÀˆ8€ìpK&J0Ãb× ¬r9®žqžŸ -ñ•¥¯¹„UÝRý?'ŠØ -[éÎ\:5¬Ø àyP6¯Gz@%ïýú,î&Hö)ç.™Ãš'ŸX‹²E2ý—…-mSJ\4QÕÒàín\÷ÒÉK[5ÛÏVÉ Ë¾²Šõ‹N…>Î…Ût.o‡>Ò1ë»^»W;ã7÷U¼AÆÉï™ø‚öÅŒ'M†Êy /"_²¢ìË@ãèƒø|ÿ®d¹”¼œW´VËtø G½§‰>ŽJ ¥üÁ¥^2 š4é‹›¤‹‰þd`¦Ï< ã2h"ƒW‡ù¨Òà»Gù(OÔ·–â߈m› †³ø­vΰ#¨BŒ—Kܧáq1äfº¨›£¿ÂaWæâ òÐeæ* ÒD °Yu£Ð'¯óÃ/L -bÈ ç‡éôßú=×É|òïå4„5Ê =ÖÓÏTâ°n@4#Îý Ûendstream -endobj -2255 0 obj << +xÚ¥ÛnÛFöÝ_aôaKÍápxY iš´.Ú4;›Ò<ÐmqC‘ +I%1úó{nC%J.°bÎåÌÌ™s?g¤.ø§.Sã:»LRåë4½\m/‚˘ùùB ÄR@–Ì·W¯âèR~d—·÷ã>ÆŒ¾¼]ð^üòüÍíË·‹¥ÖÚS™¿X&Iê½x÷f¡¼}óöúõíõ럱Á òÞ½Áé?Þ.RíÝ2Ðõëqúùï?>çžöƒÅÇÛ_/^Þ˜8V¢ùùâÃÇàr Wúõ"ðu–^~…và+˜Þ^ž¾‰´ô«‹›‹ [ñ\tÉ«æ¨btê›T“E‡,J…¾VáebßÑ¥nàaâ­[¸Pùe¦^±X*»&è° Å`÷MËw5ÂÃNêå]H·ø²0ÆËK­ò»Jf°ÛK³ão·ÿ3Pñª¤#ëE˜Y€^ÐÚÈvŒÍl¤ñ¨×ð·YäWÙrU•Eð²´r±¶C.É– +)š,Â1 ŒØÊU€«9ìNLGÌë®Ï«ª‘¦æ/cÞ *y1Ý1PÑÏ?%¡òã켜 ÄÏ&•Ÿ3ágøIÒm@´cÎÕ áÆÞOp÷y'ÞËoÅjß—„{ó`˜ïæ<ŸÀW:‹ðsZã4ñU”Æ·ÌÐÈkú% ™öv9 Q«Ôqb2D /²k°½k‰QDzw›‰ÈY5O¹Ë‰UE+p@¿(R#v£\Ù“Û¼¶ ¾0s±™;ü¨²Ë`I¤A-jü£~Å T7åm$ï¦'ç&â†#Ì“æ¼{¤3¯s5œŽØw.Öo®éú›]c×?ƒñ8òÐ ¾À¿=\oìÈÕ›™k6"{̧G†HëcÐá¦Õ¾í'bšz/a‘ŠhedªôNvø í(âÑ.‰h»ÅlËV)›­¼"ö>ìó‡u)J¼kÁ„¬@à|3Ç[Þµ¡ºÒš”( Ø~FIöÉúGñÞ8¸–/s&º|[°Y¦àƒ^ ø·­Èaõh¡]é“•ˆ#~kÙ’.ß<´ù–Ç-¼?md/yÓfæ^¾Ø‘(X{üDÞû©2É05k¿MùŸºæFCê½Û»’žÂ¶²;Pí·NH4N ‹Ä™f[ôÂìa‚íÄb´î\x_‰ÅG¤ÈÛðQà è¢dÚ­…siõ “]S1%سÁu´âhH `ÈâJ,ÈeêÊ-ø§–!$̪€}-Éf 7¨›>÷ÞÒ®ùè¿`Æ?å˜ Øç0;oè˜Á5E¾Žb×ЛDùQj=SBŠ”y¯É^õ ­€@„ÿ´ŸØ-½i˺/ëîa 2EÀbøabÅU÷ÎØ_¬Ÿï^_ÿçê&ßÞåG?ÓÒöÖß¡¯ë(º9A‡(ó³X§ÃsÚá™0ƒÀŽ…ê†dnU ºB[ Œä¦l„#S»NÁ Dº±»ˆñ^‘¸. °¸FWìtÐÑ‘ ,xT„‚€ àìA¤8¶Ò¡ƒ˜Øì¯ÄRÈBÔÑ0%.ÛqE•÷è›vûŒØ°TÆøàêjÉ`Ÿ!üÚ•«~ߎ}Ò +øv¢_7è5D–¨†h­5ë”ØC.<¡x±;»ùz0|ìëïÅøÀI9ßr|$ÇH†˜‘iv=N7µìQ"OÐ9ùœØ"r{r5ã²’&°öZ€~ð݃3„pïðˆ¹ùb= `± 8òÈ{Ð鸿%æü!êL€ÉÑÑ Ëí®*hÓ!œÆáAHa„äøA"•"˜‡úx|鯛r…ËÄ:åÖø‰Ì†%ú5k ÙâýZ²Rœ²\õ„Æ:0§ƒêÈd¾ÖÆ1]ÊST¿BcÔ²±fËóžýÈ’\ߥzþ‚G +‡('&]4Ób­Fûç¨S751YÛ³7aNÛ&2ˆØÙi±¤¡Ä! LŠ>fËá;œ˜½*%ŠâqâÏfHˬ Ã)Eí¤þ(ÀpÄ*¯¹Ñ矬Ä"kÎÍXä c æž¿yÚ,Ä3ÒÙí¿G…«f“DÅzÈ+@9ÑÕN†Bxdž¢.0R‘EDð;µ 0p ¡¬ƒÓ³Æ‰BûO<îš~v}˜RŽÇ?e`à]ú±Ñ³B`a–KA4ñ 0™ÄÃN’›$G'‚ïPúü r|ÞDêtæ›ÔLÎû­è™.±Y¥¦ô›&aÚ†Dh)â8yËN¬6r±9>€â#Ž»fƒÉ™¼Ý’BH_Ñy²;@§Énž ûÙ…ìGçÍ‘Ý=o–ìOQ…¦Ú1–Êí¤‚I"2§ý gT¼Q¹~L5X2DÖ_J»@6ë낦5o%Hä]ï"%ÑFÞûo€í‹#úJ­ü>D(mñuµl 0o<9›°ÈB’$øîmî/krþåÍ<|X‚€!Œlpíå={‹Ë4kå±Rr§ÔØcɉÖK¹øq6rB-ȨۼOn[q8E†^ôÕU×Í ä3€ìKÇÛ³!ó~j©sPÅÓL-˜øn®ìøx|*±…£TYÉ ê‡){íWekyÔWNèFœ†a< +qŽ ›G…a"§!Ì]Κ°æ®ËëÜp)QÛì6 .aЭӴÈWHUÔª:r8áÆ’Ø})桧˜{g„ÔEr+«f.7ZN ´kâ 4#IA·½ó!Þ¼ŸI ˉL$pNñ +ÏüðP5H;“®]^Q±Qy'Ý—¦ôå 3:Àœ±¢ ó”=sšµ¡‡ÍšÐñ°‰,H4ŒôþA2p'89E ñS­ž Át†ôÎh©pxÞ,œó\:¬òÝ”¨H§ òûÍhd!ä5N1«+8Þåm>–D¤ú"´Í¡í–óFWaW¬%ýK"ÉÏà(Θ(èÚç[ÞJN#¨I—¦×ì7V%Ç|ucт܇ dé‡õà9U^5„Õ–žB0u?`‘†p¦ª]4­Ð†ïrªÝ†5[{¶SH~ŸJ<üv)âϱú‡Aæ«èo¨ +¼´ßyǧpž$ÅžE»ƒß.§T÷Ž ,bJ™4Û¨êáäq‰ö*+ŽÏᮉoæm\ˆ¹)Z̺i‹µÏW»®%È×–Xfb€!A¦Ý¡e¼u9Dû+ª¢âààb1ŒÈm ±¢†0â4Š)ÕSÙØãêþûŽ¡sbM5D19ÙÀ£Ê¢[ÕqvâxœAj?Gr-Ïp0¶äOÞñ·j¸\6Ž`Ô%´Ï¹X½±S’Ä5wEâë’Ÿ·â”ÓWbÕ†¡Ä÷bYœÒr[Œ˜{×ÙçsVûuÂ"‰¡t1€ÚI¶Öbñ& Rïúž!Þa—ÂÐ{ýÇ-8·Àñ]YOÌÉýyÀÑ5Èy£Âl>i©)R‡Ú²½H7,ïH㤒Æ43ï‡JOF[^&:¬ý=ŽÏ“ÍV*ÄÓwù…ýô«·Š#·äláÊ9]¢SFûqšLJt¡”蜂êŠU4þ" ‰÷ksGQlac‰ZxÊ1G× ñœ}{¤Z0Îr/~=râš K:>ÿ†âÀœ®Ï)­ý ãçýÑ.Îh:øÌLTwK|›{ÀhQ[s@„ûbݲ¡×‘yLîDØPV<¸s¿Uß´> endobj -2259 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [369.053 65.818 448.095 78.72] -/Subtype/Link/A<> +5335 0 obj << +/D [5333 0 R /XYZ 85.039 781.388 null] >> endobj -2257 0 obj << -/D [2255 0 R /XYZ 85.039 786.531 null] +1510 0 obj << +/D [5333 0 R /XYZ 85.039 721.69 null] >> endobj -166 0 obj << -/D [2255 0 R /XYZ 85.039 410.406 null] +5336 0 obj << +/D [5333 0 R /XYZ 85.039 700.697 null] >> endobj -2258 0 obj << -/D [2255 0 R /XYZ 85.039 391.534 null] +1514 0 obj << +/D [5333 0 R /XYZ 85.039 587.292 null] >> endobj -2254 0 obj << -/Font << /F62 1689 0 R /F70 2201 0 R /F18 2207 0 R /F35 1632 0 R /F15 1628 0 R /F41 2104 0 R /F20 1617 0 R /F56 1642 0 R >> -/XObject << /Im1 2193 0 R >> +5337 0 obj << +/D [5333 0 R /XYZ 85.039 539.158 null] +>> endobj +1518 0 obj << +/D [5333 0 R /XYZ 85.039 471.161 null] +>> endobj +5338 0 obj << +/D [5333 0 R /XYZ 85.039 449.301 null] +>> endobj +1522 0 obj << +/D [5333 0 R /XYZ 85.039 164.907 null] +>> endobj +5339 0 obj << +/D [5333 0 R /XYZ 85.039 144.317 null] +>> endobj +5332 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F14 2895 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2264 0 obj << -/Length 3104 +5342 0 obj << +/Length 3794 /Filter /FlateDecode >> stream -xÚÍûoÛÆùwÿZŠaÒ¼ãñ…n§i6Ng«Š4?Ð-q•H…¤¬ø¿ß÷:’’h§Ø†a0à{}w÷½G©‰j’„ž¤“8‰¼0P“ùæÌŸ,aåû3%þÄx~âÒ«ÙÙù›HO”ï¥~:™ÝÈlñѹüáâçÙw7S7'ô¦n'ÎíT9ï^]à¬q.n±ÕÎÅ5¯g†ÁßßðÄ¿šºÊ¹Ö?òÊÏ0ssõîâfšί<÷úý»‹«kî_¾¿žÝLuì¼ÀŸ~‚û?ÍÞž}7àîÏD"ÿùìã'²úÞžù^&“=ô}O¥édsfÂÀ M ãõÙíÙ?ºSxÍLx׋\£B/Ƹï%‰éx„#¼ª«ªý1=£†ë:ñ¢  fƒtÝm°¬A¦4ûíâ(“þ†Y·Éæ¾è¢Ì¹ BãG_eCàéxœ ²Ò‘¦ÆH+³ Ý>qU{aj ƒ¼Kiu¿Ê뎃¯ ì‚V&qÔmþŸ Mx ·- ¶:µ€¹2ÿ‹@\ç(„{…«÷¨Þ±vJ”اr0ƒ0ÒÎ ©”³nö5ƒV÷ܶ|ìÍ÷r%ÉØeV3Ò>°Žô0„ ójWNuHÑ$Ñí’0- åÔYk»¢Q÷0®+Q¥Öb ý_S€ L¡eL¡C÷UumOj¶SªÊqiÉP¿”Å‹ ïØá*áè è4Úóþ"SP°hTè`ö* -½( Ÿ<‡vùp÷,øá9`Ô XöB¿·éV”—ð@ƒÞV$”^jå™8óu‘—-÷ÛJZ»¸Ž“!Û‰Sl@I,0—M£Èióõ4ŠÇÇìR1ÙÆä3p!UÝþ úD~¿‰&ί6zòº:';I= $E¾§uÐ[K2b-ï2Ô¥]¶†ÿëGÀ6Qx¸”:û¢]1ÐH`¥áà §\³º#h¾¢ø¨ÁÇ‘vñÑèȹÀ…”Õ;E¹êtÜ'ºœ:‰†§øúGñ'¯eW[WŒô¶BÒSÙÛ²ûb½ŠRã4yýs·ÚµÜA^¥³Î¦:uê¥,/òe[Ð{n;|I6°§(ïÉ;‰¹mz‡Bþ¶¬²±ÚÐ)w*A½îjÃÞ¿NDšÃï*{.|’hq’‘Æ–ùâOÇ¡ü“bn«4¤t&ùÏBª‹q[¥ñÄí²é?Î)”Þ¹öq,[¯9€‚kQFÂ"ÄÛ[Îʱ¤â¤ '›Aœ„=2â·ÇÔÉqmç¡6 ‡5.”¹D±>ÃÆe¨|J‹‘„Uf{.,¬ÍݬóÄ›g±CòNy >^9ìD)‘í–û=#ø¦lŽ—¯p&pn‘S‰s—ñp3°¨àÆC1"äPŒ)Ošž{Ÿ¼¨1j⼜.•– G•iÍ’¡¸’à;Ž+ ±¼c&…ç€\a«t{êØPÝ7S?ÛµÀ¶¶˜ƒ=òÔœ,›0ˆ{Áé8l·/²ó„è˜å‡‡°ÓÝ춤ÊE¾ø–±oW¼ø…)i_X¬ø7_™%ž Õ\Át‘?×!‡Èåm {ä^RãÅPÕ¸QìÅ&b÷‚óõRn¾ÆŸd‹_²k0¨á5DÞ¼F,¶íñmQŠ%”?êż8Q_«Ì«-RAîï*J~79xW1oîŠòÁº=®´ç‹üá¼Üa¢IÓKn•ïËD#pxÂ=4—ùwÜþyw’7(0m#µ -R¦0x6u¼Ôü±|(|è-Vät]VL|žXuÕXä\r(³%%M•…“<è5'è Ù–ŸÌ|Ì#óÑIêlëΤ笃;±[\½§@ÝÄaÖšæ‡ mß6†i·m)bm#ðÄÔçz’­KØ…Sp Y]pôKÑŠ¸¤nWGGp—Ž4ìûArë°ø°\ØBbßx#C:ðÀÇX¨"/ˆÌÀï5Â=ˆ/ññ± ¡÷å¸ÎŒÆ$ò°®öTî&ŽöAÓO}4ZúOÅ;V}näšPÞ ‡›­Á(_söŠÎÇ”A 2Ê^Óï}BžÃ7œIA~asÊw†ÙÖ¼1¤3 -¡õ€#ÞÑIFžlñ›‘cøôOo -u¿FÊ’É&ÊÁ¤x(Ö–iËÜ‚WÜÚl’`~$–J°ò$¥ÊĤ€cþoæҴ˜}Xe b$9ãy¬6 -Ïâå½äçÎŒéæsgt4ã`•5Ü©+Ž™2ßñ ç×™XñS[”>‘,/‡|@Êu ÐRþ(|iÀÅ/z©-¢y3’ùA¥°àãìµ}A‡mÕÖÂÛl »äýz÷Y!½â^^j¦ª9IÈêGž>6œ¼eñÔø¢:Ð.‹ÞåpåàFaÜ}¹0~8xÛªQ«ü€]'v8wÅsNraœlºgÙÝZ¶viI·ž 0©ªÏ }Ng0eÂë9¢‡ßÛ•MM†Ÿ4Ä¢$”&Ê€ÿôq\çy;?§ #.+ŠŸíÁšÒ©—òyÅfBRƒïHG[[KÂ<‚6U)O9®öS/ Rñ†}@3Æ~1¤38ù;Éï‘*°íŠM£F*`˜ÌP‰ÀšÙ”ÉtDhuLkŒ/R–*m‹Èi¯G]ùü¸å2¥<ÕÍsJ;^±R´Ã4X¾>6®SF-·©LÿíÓâ‘Ú5Âá =*…%”ÕkÉÛÉs‡LåMgÄGŽ91zk“°O~˜ K-§ "ðÍ!~£~É :úzàñ©¼‡¢¸ -»YùsâÜïöðœ;¬ÂT~á™—ÂÜšñÜ%gþ[ºˆcÔÞ…h‹ Už2áøQþèÏžý1‡Ñà¯Íð·O>ù-~]=Ôàgpoendstream -endobj -2263 0 obj << +xÚ­ÛrÛ6öÝ_áñËR;M¼&OiÒdÝm]mâL3Óö–h‰ŠTI*®g~Ï $QNfv'—àœƒs‡ÂËþ…—Yì:¿L³Ð×Yv¹Ü^—k˜yw +Ä\@æÌ÷w×o“è2 ü<È/ïÆ}b?ŠõåÝê7ïõ?^-î~x?›k­½0÷gó4ͼ׳ÐûÀ£‹÷7·w7·ï°Á`è}\àô/ïg™öîèævœ~õó÷¯¸§ý`öÇÝ?ÜYL-€UŽhþyñÛÁå +Húñ"ðuž]>B;ðC˜Þ^ž~ié×.þe·â¹è’WMq%Ö™gú”-aì°% •¯Cu™Æñ¥o·³y蕳¹J#oŸÌ+Û]-›–›bÅ=ÞÓ(ø³ä¶mÃýž÷¢å^[W ¬[c'†©bYróFÛŽW|(¶3Xq/  ½×¸/_Ôwf +:rüã ö/»ù̘‡È«œiºýz]lÕ¬ùúð0l<âQ%Ññ¹çK|¬Ýðü°©zn]íºö&ê’¼òé$áª{ÊàòkÀ€;†¨=ö<¼ïé4<^%^±§³ÊѪe1ЬÀ¶H_ýÄ¡å%ÄžÔCT +žù=ˆƒ{Üà‰!7°ÍK˜µ¥±Œ¶Ï¼jl.Ûæ÷ ŒðnöÝ,ä…ˆ;ì2¥s—Ô˜(½y˜Í#•¡éÀëP<šž;( +6lJ ¹)¶ÒÛ´ýÀ­B€:¢^}ǽ'¤¤ÝómƒüÀVS +’¼w+[Ôµå8\ñ +á’ÎÅ>žyÅó°òTdvI ÝŠp «ƒ ©@>¹‡0û†G[ù®*ࣾ a@×l‹%â¶!á(‰@¦õH&‚5f-jÚšõŸåbuŒ4—…–$st»d6ðvkÚ|è'H/–Ä&ÆMTb`bsÍN8CDˆFà+w矱ƒIeKŸµé /³‘¯£Ä5^I”…Ke°ãÜPàÝîÃL‡pÿ({ø§û ¸%‰·Àa¸ùËÁý2$I½÷7ÐY¼`8¢†ß"L=”]Ï}¢¾ÊîKÙqû?–‰©Ÿkv3K²6e3È:ÒzA!À«æ@–3RÐCdÞøàÈ«Á0 †i3"8'§ô†oé ³Uê3ŸgösÞS$Aâ‡AH¤ñ±HØíe A³x´,HR[ó8ê#5vDÐȪüR-Åé`¿Ý UÛ·‚÷ 4ß±¶ÁQ…uhïû=+ºÌ‘P¶¸÷—j5š/ÚöµOଊ@{[4ó ñߣ+*–¬+ ß]Ù½UdíRס_ƒ? Ï<¶ ³ +1xØÕœ²Cãêf!•C| +û™Æ91ϵñ< $OtoiLOµ«…ÃyÙS’ß°®láz4ûhU²‘íØ®ÉËäkzÃO*÷¿Ý±›oJ{ÑÒ>0Ì_pÚòŒ¤w_®c{Šµ…ïϵAóW2Øân34þ¢†XvYè÷£(ñ^ív5E¼Þ9¶á=£(õú§ž1Úöx#Y,âˆsEWrãrb“"þ†‡ñ¾jd,v¬v‰EÕ˜ §Æ8ª›ó·.YúŠ{¹o;PŸÓ+ÝAúáæP®‚È£¥@ÖJ,‡ÚìGàËSÈÒ–·¦ÈCçáÁ-‘M’¯â¥:Á…óG“ëßt=ïd‚::—ÔE·.‡¯¸Ü²#§›Ë.ÜtrA–ñ ¾áw¨ßˆèàVEÝ®{žº¢ék&»–x麆W_QgN—°1Öd?AïŠF¼ZÞåorà +¦œ*±Z+@¾Ý™Í…Uü'9ŽÞ˜ñ¿6\5øà ø3*¾™CËÚ ¼ÎƨâáT(\)ZÖ+ŒFTľöƒ 0F‹dké +º^Ä—Yüj±xÃkIÆñ‡Sl±ÍБx™Òó¸Û;nWý¹0´+øI¸¬-WbÂ}*Ñ<|j_`XÉUÁ¤fœVaN+–ÿÄÚ4ä=ûã#³‚-%[X³f<ÏL$ŽM6a˜@ç¹G9+Š<*bs2“{ÆÉÊEž+É/håç«ÍI9ÌŒ¢"„Æ.¡J'~š4·dF"°_;¤Änn8;²>8?ì'ˆ×p…–]ÉìÁ¦–Tq†ƒcƒ¤¬£QâÁzgõ‘Њ$M›ýŸ¬ÅeÏi/„}ñ½†Ý) FÝ·Ü«(Ø#/„é »÷1&‚ß«bþ0½.{È(ˆÓ³¢B>ÓÞOì&÷ÁÔõÇÛ›OxéViXx7ÜeÓžEìZËÑÀØ„æLŒ‰m´3¾ê“yÉ¢±fáÄæyBÀÂ.5æð4æâP ,aCÁBw ¢ÀüÙšãƒ0”È£e¤`JØ—Yœ¯÷&XáÜŸ@Ù‹Ðr‰ð)b9µû©ÞÃè(®MZj°È²ª¨yæ4jýzì2Žé<÷•<›Ž906÷ ý99¦c-Dž;¹o衸Æqà¹Y!劜s +Ù´ÍÜ”:J šÓäö#Ür@zŸÎ#8·ý$ˆ°$ +‰(ríSÿÛÀsuµ­¤Y âË07 b‘áœk¼bP{6I…"9ºÁžw;-ñ˜×‹uÉSíƒ`cR$ј-L‹™d˜“µª[ Òéà$7Ö,µÖ Ë¿ÄXÙO2‘[˜í9ÚYµ1Â̲ %´!ˆ[ÒN$Ô`AbPâL²IÃÖªìGnÝ3š*Φ´ª‹{‰öÓX-¥Í¥Üd*µ£aLj¼­ +[É=Qh›H 鎑NÆt¿Þð6\9!ÃÕŸŽï¨è«@mÌR‰ÊÈMQcù9ær¥2åʹRäKˆÌÔªˆ‚?8HÆÊbp‹­48‘#¶²ÂÉ¥M—q%zë÷7 ñ\8BdœÄÌB#€âerxªÀ¹Ü½E$£È‡¾ï04ëݪ‚ÏŇ›–b©Ã%[ÙáÈîT†%˜çEäÐ)ê3ŽYm­7C-XU’òšJЩ¦mmÖ;nA :n:Å”(2¯Ûb ååÄÁ¨¬´e ˆ ŃS1 …ÌiB8©yÎ!ãéy„ë«…{»QĉîEŽðPž¿ÍµôÎ9Õ¶B¬E{æ+ boŽž Gk.:K„È¡8л‚p‰Qå)Û úlµô‰KÚnÅ',P¤wýÛª¦üP>¤Æ¸‰ ÂI~€™0CY×=ç<œÈ@Ãyìá·zÆ#cu†ûnôs´k+bb—¦ØŠ2°ä,̈—Ä âw,ÎpŸópÂÓäwÚ©Xã³Ý,(ïš(Õ QŽ¤"EpÀžj1 ^+ž9 ”7ðäÂQÐì}ÏKÅ•Àšºd¬`©d"Íàî Žb wÖ[¬ÒF…L~‹l²mÇ™Èv¦ÆcaÌÑt0a>†uXy ¸’Ö ü¥ˆÅRFüòG°2Áº[a…Y²iØ0ŽÛÃøø!§©Ôwç´îØŽ…ž)Üq)Fê0g-=&OÔ`˜˜x±’mÄI)§`8©ÐItÀc]Ѧ}”ïóË&²s!¨Sõüó‹s>U  êÿ€J-—Ö=ž{Ü` ž%Ä@œ>C|'wƒO)ÍI„ò‚µm’JhÐÓa/W‡c’Ú—]Tb,*6üý•dfåÔxæ¯M•®r²1óéÔ®ðæqk²0Pp÷jÙvå·¿IOp ´NÈ¥6ÎK)Ž‚,Õ‚ÃpSéXâ¡D¼4®$ø¹ÉÐ%ñÞLÄzM¦ ".ÜÞ]«^Â;¸z9AŽóRŽáv$GËÝ‹u_E•÷jÕÚÓ”ü±3”›!Ë%Þƒ®ÒŒÂ}“2U­½¹'šÃsËFê÷Rý{í:3ã_8Ë™(‹.—òþJ<¤—có+…Æ<ÉjØ`³ç€žaøwµ™…eèöűZY•P‘Ÿ)Å2 ó†UËýÑM¨2?I³’þ5=9Nô~ö4†89ì@uîÇYìF®C©ˆÃsSð­¢ñI}`U¤Pæ³>EŸOi6Óš•æ`»èM &o¶”ÒNÛv÷%½í¤<§ ܸ…¸5/rÝÒÑkß©„ph+΂YµëoÅ=ÔÅ Ámo½ ͈„ÑÏ4*‘Ÿ¿àz~â{yNFòÔTø¼ŒŒ0çeD`¾"#Ï&2r|Ø”Œ8‡‘Œào&Š^¾ü; ¾/æ 2#gšæßD´{ëlm$€³’šà÷ôƒÚ‹g‡o™ô»È ûŽ{¢’Ó­0d;B+ËBh]â@OGÈBÚ;ñ„`‚ׄ£dãVš8z'¡ÔÇsv‚†²ìJ4âv+z@Z¯-&IÀÒ–„'CH¥ßÃG‚$ö3•Iíw‡Útü r?àLûQª¾þk:ÓÉäoéæf«ù¸×é³ä1~%æûFr,"þ“Ï4ù#„U‰À¸¨—ûò\å1ðÕdàÿy¿ÿéW–6|Œ´Ÿé3ñc W¨Bƒ ⯔:Æ×üóáÿ_^3endstream +endobj +5341 0 obj << /Type /Page -/Contents 2264 0 R -/Resources 2262 0 R +/Contents 5342 0 R +/Resources 5340 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2260 0 R -/Annots [ 2267 0 R ] +/Parent 5300 0 R +/Annots [ 5345 0 R ] >> endobj -2261 0 obj << -/Type /XObject -/Subtype /Form -/FormType 1 -/PTEX.FileName (./xslt/figures/warning.pdf) -/PTEX.PageNumber 1 -/Matrix [1 0 0 1 0 0] -/BBox [0 0 31 31] -/Resources << -/ProcSet [ /PDF ] ->> -/Length 557 -/Filter [/FlateDecode] ->> -stream -xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù -ä -6\>RgÈbÏWÖ¹j[†› -WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream -endobj -2267 0 obj << +5345 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [206.053 412.867 277.427 424.557] -/Subtype/Link/A<> +/Rect [277.578 480.435 451.387 493.336] +/Subtype/Link/A<> >> endobj -2265 0 obj << -/D [2263 0 R /XYZ 85.039 786.531 null] +5343 0 obj << +/D [5341 0 R /XYZ 85.039 781.388 null] >> endobj -170 0 obj << -/D [2263 0 R /XYZ 85.039 513.624 null] +1526 0 obj << +/D [5341 0 R /XYZ 85.039 664.197 null] >> endobj -2266 0 obj << -/D [2263 0 R /XYZ 85.039 494.956 null] +5344 0 obj << +/D [5341 0 R /XYZ 85.039 616.861 null] >> endobj -174 0 obj << -/D [2263 0 R /XYZ 85.039 296.432 null] +1530 0 obj << +/D [5341 0 R /XYZ 85.039 399.026 null] >> endobj -2268 0 obj << -/D [2263 0 R /XYZ 85.039 273.114 null] +5346 0 obj << +/D [5341 0 R /XYZ 85.039 380.154 null] >> endobj -2262 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F70 2201 0 R /F18 2207 0 R /F20 1617 0 R /F41 2104 0 R /F65 2099 0 R >> -/XObject << /Im2 2261 0 R >> +1534 0 obj << +/D [5341 0 R /XYZ 85.039 213.727 null] +>> endobj +5347 0 obj << +/D [5341 0 R /XYZ 85.039 194.855 null] +>> endobj +5340 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2271 0 obj << -/Length 3087 +5350 0 obj << +/Length 3607 /Filter /FlateDecode >> stream -xÚ­koÛFò»…Î`ê1\¾yîàØiO¹ÄvmEÑöÚ¤$6¤è’TTýû›Çî’’(§À] „û˜Ý™÷JLø“8°/™Dqhž˜¤Õ…3YÁÌ÷BA8ßv§Þ/.Þ}ºá؉“LKYd¿X7ÿ¾~X|xœÎ<ϳ{:‹¢Øzš -ëúóûkõ­ë'üºÖõ÷ï>ƒß?òÀO>ŸÎ„uçþ‡g`äqþùúq{ÖÏhRc¼è.«+IXÛ漄եóæKŠE¿ vOÈ¢ùfÛvÜ4ô1‰¥‘}¸–€þót[¨ Ó&—]Ž‹¶Ø±êͬ[ç3ùÕ´GÑž{‰ ³'uø<Ë™q@ûMÈ)àÖ¢µ¤[¢#1‰¢[¥m¶8BÔš Q½†a53\À)Ã3ˆ4…ûÊJKˆ ØÊMÆû¦ÑVÔûÂ3D®F®ÄVgþÉ#—7Š7Ø‘ü¹!öV/(H]ÞŒHɘè{ ‹¾—ôR‹c'¢s¦½¦ûK4g["UÀ¬IzŠÍJë™5¼¹Ú qnj¢2¥=òLm,õ—%£Fö|EÔóú–5ÞDä‘-+6t.ØáeF¾å:ŽÃ¿:SØšé6ÞI€4!›· RÑ£ôâÒv‹8¾”{ž”üy’õ¬º2«˜fÖcTi6….m3¦Ô¸r·Î7#½4†Wx|—g€¸°í,laÃ.°Ô‰m7ñÇŒ¤m/#jŒ£/FŒ#(Jt¼{`ûZx¼)Nƒ=Ã1ƒ LzžÀ -ÜøÄ(­ÊÇÈøAˆ\öƒÈj‘ËhÐ#iYäÆ& š—ÜU¦‹Ú(¿-ÏfJ¶•Öa°CÚ¾hXµ ¥õˆnâØ®ÁHæ‰f5áÆã÷¯xÛJŸsEÙºæøœXØŒ3|æEÂŽ`VKÉ«®Î˜ùáTlö‰¤ >Œ`v,„9Í…9ßö`íà´ÀÆȲnêªb;óÂÈzhêç2¯P“à h@å=²žxEgdÚŠ@ÔíØñ^ÅÙ³?>ÀYØ Úú#œ…%ñ€ì¢˜ÊͦîËb“–hQ³œû’?W0öæJ°Ø f‘z™®Ù B#«ü¬Ò:vú¯’؉'¾Õ ÑÖÕ±w÷çsÅ`$‰Ž 3Ø¡íѸ©,Ë=ZÖTox[„ê´wy—¾{‘m»ËF”:Œl/Šh½ä£LDä¸Ö7ä;l#¬¤©H|£ˆ/32™3×Åè9:´œ:´s–gpÅ>\ÅwÓØ·šœfÞ?ÝÂýøñå:5è~ƒMâ¹oÙRTí¿8ü&Ñ~;ò”‡ŽaS ”o!/Ã’?[¶GÂÒgì -$VD 6´\ù=÷xpÌ·£ˆq¤¦.b8¹ ß+"åPP¹Oþ¾õ=›'BŽD¨ÜµY²j¤Z²mMH&Øòâh%¿(7‡=³XYéf\Çðë~£C±\¯Í0*ò\Ç*:b®6_8Ö4¸`Dp™ÓŽ]ÙŸ[7G· |â±ðŽnðÈ+wÜWø½¢ãª] |Þ ñI $þkñ2…Dk7¢nb»Ž†cÖy–b§PÄ›³½£P³1Á.0Hâ‚Lg#ÛJ7üЇAî=«‘ ®Ý8®1D"uÙ÷Ž²ÙóB–W7‰PÀmÇãÅ’¿}ܪВA¡¡›„aÁ3ÚmÓx°º¿%îK†¡à©ø­²Zõc›+²æ·;kh!Ùì¹ÏZZaÇnô—\†{è2V¹ò]]f´ØÊ•S±ÆÅdKá«ŽhײÉûm1-ÄöüáæM¿†Ž•á„§ažqJçÃ-LÜ°üPµ„½*4–uYRv¾3ÙóΊKCäV“W¬ßC&Á*R±’Û†MÛYö‰¼9ÝÕ§|UÖócáÜ©G½Qp‰!Ø?Nñ(ÆÙHg‡8ÿÓüîn1²‰Û¡mm¢ù爃®-\¡7 S ^žÜÕz<ëï<ôn,…-Kaà¶éã*”a¬\©¦ïön z'5;p‰TûƒïˆÐ0®ªƒtOÕ‹p -{@s¿ AMMõ†+ž!Ddwx*‰-6Z6Ÿ„J‰ ™;TL‰u¨ÃRŒ -6aÚ˜$ì°"Å}AQ—tb®¢<ËŒ«uE–K¥\f²ÁŸüÞ@@wendstream -endobj -2270 0 obj << +xÚ¥ZYsÛF~ׯPô¨Jă{÷!%ÛÙDI¬h-º”ª$‰°p0(Yµ~ûšÁ•‡-—Œ9ƒžžî¯¡êÁ?ÿ4\/ÈN“Ôwƒ4=]5'Þé#Ìüpâ ÅBHÍ»åÉ?þ‡§¾çf^vº|˜Ö‰Ü0 +N—ÅïÎû/o–ß:_Aàø™{¾H’ÔyÿùæÜwnyôæÓÕõòêúì…0è;Ÿopú×Oçià,™èêzš¾üøî’{ëÿ¹üéäû¥áÔð\eÈæ_'¿ÿé°¥ŸN<7ÈÒÓh{®ÓÍ ðéFa ýúäöä?f)ž Où­9©„*vUÀsÓ4œ¥ñ}å¾ÑEžy¡o‹ÎW©'ñ©&BÙýáùÉþöü týàÔZëðƒLrø½Èþ^¹Qí|¯lóûä[‚pãÔY/|ûU‰­ö\eÎ8ðÜØá3aš®¢ZuÍ"e ˜gìäܪöÑúÀ͹’a¼]õÕ†G^³èq‘gœ¤÷0žDÜáá–)ºžMÞâø«,€£ ¥õ>ãŽàõ(B•F}ŽB‡”÷ÃÀÃ$xÞÑâÈYw®çE¦YÆËD¿D1ôjš”WƵ¦J¦¢Ã€ëÃÀ5ù®æ7òºf{‹<õ¥»ç©V²UÖ[tc…§ü8°á}Ùjáˆôr™È¹ûùúê7nÍï§ò–E'ÇOT ÷ˆQÇiê^ò&@Y4¤õ +fC7cÒz±Å8Qn˜Å´1%„%Ø'R ¬¾ó¢å º»<Ï€÷¾aÑÁx^óÄmÙ?—½Eù‡ywË[xø¬ˆ¹LLpƒïYíÈoÙiœÒ ¼¹Ó‰fƾõNÃÔõCÆâ庆à/\9n7Ümr±ìÜÓ”ØÉœîA^ J>ÂU…ÀÑJ¬¥/µ*à("<7¼P·“Çõh¯²X_•íŠ H˜X€2AÅí™A¡ï& h‡ïÒ+w0³Ä‰Û[gC®ÈÚÆÒ¾Ž;NÎê|ú¡Ó–eÁ­îaDpÁfŽÈið•-na¬ÆmÁ[Á  ½Lë/ÌXÀÑ„iHŒïõƒW?ð)Ô0‚uꯃä÷ÑoYñÐËÉö+D¾À{ @|ç[~ëùäš÷†hÔX s¸ \§¨ÀÛ÷,Ägºt¤÷Â:Ï¢¬.aˆ¶ñ7H¨Ø¬>{TIŠ^—ܦ3¯VÒö%Ò ‚¢TVØX3v{«žxËÍ +^£B!ßã|]ÉÖ!®8†1Q¡ÀßXžEc0Æw³(²-/JRW¥…1¾ã#ÐDžsÃÒ$(Ň}ý ÝÀN¿m[v-ÐäÁæÙÏŒ8m) ô¡Ž6|&N9ßÚË’o¿ˆ Dowìæ›cè%ìæí@Т9Ž>Q”¸È‚>È8}™â© çƒ{FíG-ÈG&ªdòN7®—LÅúÁªiæ¢ñ¢ðŠ± ?0²„&Ê’åç¬Æ)ˆò ?akÓÜMêß  lW¥Añ=%EGÎß{\s§—õ|ç ”00c,ÚŒ!äø+£±DNÆŠÔä¸_–CÃsÕÓŽz¹‚¾j †æi_0ÝvãÄ[OÚñzÀL- æmÁK¼ ù•u=iâÊC~ ¾Ä·Âã—­4 À?Ê7©Ø©‘l¼ù}^ðÀ„"ÑV¨'`4Ûø†¿ûý ~ˆOö÷Êot]_uÎ #Õ —,ç¼Êל o£â{|,^6 ŒÝ¼ÿ…gÆw¶£ß'í‡Ö7 Šð‰äE…jRu-E 0:tÛVK)5_(Š-î±åØíBìlÎË `ÔüÊ°nÂ;F$r"0ó,›/YU±Êû‚GI h–ëR{'ð)!}X—Bõ…ü¹í(>tTÃwÄæLÐ=“!…~N–C›TV²ˆ!Êä@I !ðMNcpÔÌVgV{9A+X=‚­rR88H€D©ó@Za^m :£OÂ1ŠjÒ¼âJ„gã:Içsð(;[›¼N†v&£_7ܹ,º{(`]ÅñA¤ 6„uhh}¬V}7@ÐHø8ïºq-Ée?½¸«ý¯L0)4ö&…–×Qgu»—utâºï謩W’Ñ–;–ö<ÂgÝBMÕ䄼²Ew4X°õLHJˆ”;õ±9.¯0X”ú¬ +ž›Å°žX0²ÕU‹ƒC/tSÿÍp"9™r³4܉‚•DÁw˜jC¾ žê ›9þ×£ Ñ±Hî\5çˆ $$¤ý±ÌŸ%¦ýeC¹ù˜Ú<»öXd@äGoG÷ÍñÈ6Hà™²>_I@Ùˆ"€|eW»’Ld ×›ÚÑg®Ÿ£„o‰|©šOÒåò‰#íï¶Z‰uĬÔƒdY¢XR0ŠJY§hª¶2õ\5‡ H–J´Í$¤lVÄÚh|u¤¤eE’ÃHÁÏJ׉ö]pSâAÐje‘cq|î%̸W×Ô~^ #”ÛÛL1Ð@ƒ'LöTðø&×5) dz 6ÓØy¡8³–@ÈÒ8Ϊ©ÊS>W:#¤•9‘º˜ +A©,í–1pð~ª³Æ¾QᢒªÓ¾S¢Õ½ §À}Í¢@n1"àØ~§>gyß cŠ*iÎ#ªJc@Ë·…EsÜS¨$rÃÝrI ŽâýgèÜÜþSªªìÎGLÛÁÉ®LMvì¨F[ž}wŒß$p}/~›ß‰æ¸Px¿ ¶ïTHá¾ +•s¼ˆDsüš©¿[ò/x±— +# låü>]6øÎi0R¸ùpÁóm²=LKÑ,|PÿC¦Ià™óš+øˆÛ?@3Ò¾v3©Ë†X¦EÂÔÀœÂ„«:@8%j¡fºŸ’CËWrqÊô¹¬–óc.û†áOW7Ü0|TãÀ;‘ ’ôå_ÛjŠ¸ç®K8šŠ#ç=2ûÛ¡Ÿ.?rƒëï-w^ÖSµ€ÐζÃ(/¯´¥É%E(w| 3}¹@(~_J±|]ÔÕ,˜3ž3PN…F>+tÿˆ…µ1® ŽôèXw*Z#ˆKI²dÈ\éµÒy}ëÿ¢@Qêúß(!yY\H¯¶JMDaeÔXâì÷.Ãô^ʱ&'›zVjsÓÐ=1ùl)ƒÓ¹¦ÂÈâXŽî«Ìõ¢·c‹æxìåû‰«T¶|…ú®Š²tÑÑq殊[mÇQX“á´ž‡7œ×5’Ôÿ—'ÊgýKëŠËºášN8 ùiºî:"/pÕß”-,šãÑ]ªÜ8M䛦ìdÑV{W¤ž@ˆI°øZu¿Ž†uò–ëäwêg0u)üífz±k)K‚ÑéØã›1ÃÛ«©‚MC;—±ºyT2¨«']U„á»] û¹^òo†}ÆgÁ£1 ©ƒ3/›c;– 3)†RùWétŽ•L¥³n° ß…à ÆŸ³ËxŠ••C¯ñ¹+lá¡·o@fjt¤uÁ4ã`’¦)#°¡@§‚`˜œ–:=%{kÂ’±„Š‘P+sc 6Ñ §z87¿(±Jwqx¬èSz$/dàÞp]õ\‹;Æ–#e1ÏU³E1øcõø¿~H7U H™ŽTÖ"¥\åk^ðl” +öù‚ÔÒàáÿˆÒÓ!endstream +endobj +5349 0 obj << /Type /Page -/Contents 2271 0 R -/Resources 2269 0 R +/Contents 5350 0 R +/Resources 5348 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2260 0 R -/Annots [ 2273 0 R ] +/Parent 5357 0 R >> endobj -2273 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [428.788 626.203 512.306 637.893] -/Subtype /Link -/A << /S /GoTo /D (domain-member) >> +5351 0 obj << +/D [5349 0 R /XYZ 85.039 781.388 null] >> endobj -2272 0 obj << -/D [2270 0 R /XYZ 85.039 786.531 null] +1538 0 obj << +/D [5349 0 R /XYZ 85.039 688.307 null] >> endobj -178 0 obj << -/D [2270 0 R /XYZ 85.039 597.211 null] +5352 0 obj << +/D [5349 0 R /XYZ 85.039 658.106 null] >> endobj -2274 0 obj << -/D [2270 0 R /XYZ 85.039 570.597 null] +1542 0 obj << +/D [5349 0 R /XYZ 85.039 590.109 null] >> endobj -182 0 obj << -/D [2270 0 R /XYZ 85.039 570.597 null] +5353 0 obj << +/D [5349 0 R /XYZ 85.039 568.913 null] >> endobj -2275 0 obj << -/D [2270 0 R /XYZ 85.039 548.939 null] +1546 0 obj << +/D [5349 0 R /XYZ 85.039 404.81 null] >> endobj -186 0 obj << -/D [2270 0 R /XYZ 85.039 450.922 null] +5354 0 obj << +/D [5349 0 R /XYZ 85.039 383.613 null] >> endobj -2276 0 obj << -/D [2270 0 R /XYZ 85.039 401.83 null] +1550 0 obj << +/D [5349 0 R /XYZ 85.039 286.651 null] >> endobj -190 0 obj << -/D [2270 0 R /XYZ 85.039 278.375 null] +5355 0 obj << +/D [5349 0 R /XYZ 85.039 266.06 null] +>> endobj +1554 0 obj << +/D [5349 0 R /XYZ 85.039 129.056 null] >> endobj -2277 0 obj << -/D [2270 0 R /XYZ 85.039 256.514 null] +5356 0 obj << +/D [5349 0 R /XYZ 85.039 96.236 null] >> endobj -2269 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F41 2104 0 R /F65 2099 0 R /F20 1617 0 R /F35 1632 0 R /F56 1642 0 R /F38 2158 0 R >> +5348 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2281 0 obj << -/Length 3613 +5360 0 obj << +/Length 3205 /Filter /FlateDecode >> stream -xÚ¥ZëoãÆÿî¿Â„Î4ßÛ…ïÑÖIìKÏ*®Eš”DIŒ%R!©Óù¿ïüff—¤N€¹;;»;;;ï•íÑŸ=‰]/L¯Ç“ÄCÿz¾½ò®W4ò·+_1¼ëÈõ’Co§W·M‚kßsS/½ž.eºøÅy÷÷»Ÿ§>nÂ0tbwt3Oœ§‘ïÜ=¼½4rîžð œ»Gé?N#AÿøIŸ ý~tã;Á2ò3A>Ý?Ü}MBçß{ÿñáîþQÚï>>N?‚±ó‘ú‰öÿuúÃÕ‡iö›È’Äÿ~õ˯Þõ‚Î÷Õç†éäú@mÏõÓôz{Å¡G¡ö7WOWÿ°«ÈXt-³Î°èÆ`Üø©›ñ9œ`ìã0ˆwqj¹ИO¸ÏÍØ%úND|ŒcÏ™®s:o”8Ûl¾.h Ô~[ƒ]û†@­@²ù¼Ú—ÚYV£ÐsjÅ] Z±3¯¶»}›+IÁä>€úµh´Y)jqŒ£ä陊­»á-¾qA[$|ÎÚïuâ¡®J¬þÂôêµô‰ž²Qêìj‘Da+}ç 3ðƒ7Íž9/hOäšüùý;i`SÐŒö:ê—‚ P&Ÿf_´™9rÃsà¯ðR¦6º`Æ$A¥FAê´8¹Ÿˆ‘Zò9oúùœ/X“n•8OúXçÒØ7E¹’¦‘›`Bš±Xè¸=u-€†·®!1»V@[‘>L—‹Õ¹m%_™a¤?kuëþ! e¼6'f–=’ -ä]evÿs³ì©D¶" " -…Ú#j2øX´dƒúŸ|¡âô¡4+À6Ì1¼B{Qm3¨+K'Ô”ïP•À}“ ¸×¼4-÷·C 7»‹”¸—ÄõnCšUò©Š/L)ÖÚ¢HÞ­Xâ;îÝ7復q|LæJ‘Îh>à¹têJ€)C›m6/²§ÞÜxbdÉbŽ³(ÑÁ¸§$„0› òDˆ‰©•p³ü¦Σ®s&¿^g†›"Ãõ€ŸuWØÿám&IOJ¨cù†e×’-®¶•V¨ Œ8ÓÁ¬uq’ÍVàK6hÔ`KÉÆöBÂK³¸ÑòSI>w9aJâ!K§Ùb5˜’]Öð  ùçG0/À®Ûž‚`O™š ñÍûw®tî—2¥ã uÈ>ä ³”®s‰BkBŒ¬1rÙ?£X¨|Q´ìa|Š2qÿ‘¯–%+¥Ó­¦ÖT0ri4¢X´ùl§*NÀƒ - -Þ·„[o“74@ñÈÖÊHä;÷unÖ†dp‹}˜ŒK@cÜ£ï³(gânÏÜ+yŸY'·OƒbGßÞ|€¬©3)óåóý·ßk·ƒ -‘ž.úZí*ù­…ØSˆkPéš“À?ñÝGÁPH‘d ’ (,Œþ‡È5äÐè\ܪ#¯‡K%ü[99Qí@(…0FJ0>òá9ë2;Pâ„­m H€Æ¬½H·(û¸_¶L¸Í[–ìÛ¾H-;+µ!7 —~^ E~%õœ§Š/–\»^^µÛœ“œ¡ -èêê|'$ÂX´æºƒÔ(Šž€¢œWeS¨ÃK%‹X8+ èÈ6kži*ÛXU8•±Îº›ô$¢Sg2¤CçŸj3·s§çâÈM‘[ b¼õÀðLTwªù!à¶êª ·ìÑã#@ˆç½»‰:OÖèpfðŽ˜«ô†6TÎŒo·bÝ¥¡ÞÑNìŸÈR ÙWŸ&&á$t'ôMRJ"ƒW³:›ºüaVkV÷™}8Ò£{qJYÛæÛ¦LlQè Z­ŠrÍdÆ_ÍÒ•ÉÀ{#Q{YÃÔðÊ  üèö3å×ý nÂä,š4Îwž9Ó£À¥*ßÈ*Jæ*o{DŒ)*Eþ)YƒgœDV{EÛJȤy f§ 4—sM무(°H ÁáÅd1áïkw2¡ïëÆïÎS²Õ¨ûöŒ`"T¹tTüŽ£Tákécd³2@õcüSÞþÁ8pšHG¿ýkœôè"ßõÃ@©' HB<#ó72–rì;7Øm8ßq] 7qèw²Ü€ ~¸ãt¬Ëᚃ¸Ë@Ž¦Ÿt;$(Á0D,Ù0JŒŠÛBp*Y§5uo4àQ§VÜ@G‡1&«¼‰ï¯Kb®ï¿*1©°?ÐÌÈ £d¨™ Ç°©óžo"kÕè4K!m]mDºÊ -!|– ‰A‡F`é×[˜¿—évãÉ•:ÆIüGâËÙÀiÉÐ ·°Ð6>‰ø$^ÐÕÕ~'PÍYHοfó¶K14K¥v#v&7#6Á¦^QÊ*Ël5m©–*{eåY¦ÌØaÈz™˜wo/ñb‡óOÒÐPÔ'/ç:A¼DbF ˜áÁœP25ãHË&ÿ<¾o{E"X1·’Xà²yOvNÙ,k{Å&4‘|^PF¼ ±uvêu4}e¥ˆHÔ8S‰‚Ä‘¬u¾×l1"nmÄäG¤Žª âæ -VÀvŸ^d!ìæüEXÒà»±:•nŒs}^šè:HŽª>«‹ÕÚ˜(ôçš•2y&â;½»U oMä¥T‘ØT]vÑtš1Öù‹à4û1KØJ΀1È §Á ¬˜sµƒVÄeÔo"‘{|Låëkù‚±¥¡@™xxNÞ(hÍn³µµÎjr¥C…›ë¥ ˜:3×)”­HdZåâÅŒ0cÞÓ|­™ÁÒ©¡ß?º—+n\Š9p|x+í~ÌL"ðc¥¥©ˆí¾RQbEB×ðmSÑáa…ImXãk)HÅ£2aì¤w(;Cã®Ý[Q4‡qÙÅs6îj aœl!«õâ¢×´0È9G[G+4&»äÞ‘œuU06˜Ë×"‘è–Áp%~JYfßú= rÏô1Y7§vÂæÛ±¸ûrΛÁËšlš6³øÊí42ÃX} ô /Ì=2%Å*ÌÈmN×0˜rÅXb#N†mž.Q -î…j5kÊXø¶7ƒnjøèKù¢K¬kÚ‹ñ)Âï3Ά4À­±ëkÅšr$"áĹoe±cAðûžÏÊ|Å÷Rì|tkæŠ0vöÈmÕf­J•½]³ÝáPIÌA%*,~¥F†–Zj ‰Õû^º‡ ŠÒH a›‘–~å -SÙ ãö½"ásWÃëc ™}ö¸+Ñ2oLnq‘od5ŽÐ /;ß767¨ÐÅZ~ðhtK­Ó‰,»µÚZZLƒ@~i¹ÑÔZôT-zC÷Ó]Ÿ÷…2©c5/lK´Å®5Ó­è§I¯œŒÞ®®!pÁDLº—Z¬ô‰&f9é,väõæx“WüÂçT,K†Ç+s„sº…™ ð_j2¤3ïŠrXòÊ!]¹6¯‹ï,QÍô”#ÕòR±ßøºÞµ^”ÔÁ“\zâ8Pœåo¥T17Ò[Q|‰11M>ÖQûP4k.—£ØQÉWÅÃE+ß³8[̳Ɩ`(€Ïßç -WšÍq™ÝÍW©a ¸\.WQ±•®tNMñ…SËFë>U©P!—ëLtÓ^ú¾¨e![¼ù«+°LžßÅõ4ðe'p ª -È$›laLMkBæ)Šäó¾›^´<8‰øde1²u_~Tò¨qT— Çb[tø\mϸä ô5‡Ô(l2ÝJ©V‹k¥ˆ4ï[EÔ Zkš‚ók€Pi•_ú½˜‚zM˶”ùÃÕM!¼:ÕÕã\Ô“ª }N³«¡¾ñ%yï¡èRŸ$ŒÞk’ ^Y“ à±þx‰}šA»Ygu¿²ìŃê[´\=(c E¯aÿE*ãr4Œ‡/D˜pz×¹Í$€+a1‡ÝÃ\΄20 Ù8S ài¡ý¶hlX°äleÂFQ˜Lçqý—&Í‹<À•+ÙE’¢‰$>i—RÏ9v Ç[òmݽiéøÚ„ëèœ&’†bò€òûž6ònõ³é-9pØJLj)–cW5ýGEàlö˜)Õ¦cÿâÌùô©È‘„6òÜpÁÿSÔ?œð1ëRw™gí¾æŒfÒ‡¢¡9f&¦Üc«ºßàÕŠØ÷?XF% Xj44 z ru¢m4¿™¥Oƒ§³ ïîC=ø3ê0Qï±)Œãó.¦‘±z¯ÊG¬ùô™e­qèò³‚ÉbSÔŠ£# ‹#{–XÃ<ÆÑi—ÞWM;ÚêèË y­K>Xx¨ïÝ\†Ï—\‘´ù¾›[qn«Ö×ÌNˆ9[Ò5iöBóýèz›ËO ËpÉBãNÊUº_T°Îz,Ò-Y˜ßÙPc®•Ë:ÑŠË©F×0‹¹å[QƒTYwñF~)S´ŠÛ ÊLb Ý«5ÐÅFwÔ¡‹'y–‘¬½èØ×ýT>ë~¨VpªRq¬¬‘PŠôèöáÃÉ„^— jÍuN6Lþt¹^8&š¼èüô”ÞÿïGnQà&adÿjá1ŒŽ Ž/o†¾ÿü–õJendstream -endobj -2280 0 obj << +xÚ¥ZÝoÛÈ÷_aŽ,†äò3Erqî’K㪱Ҥðå’h‹ŠTI*>÷¯ï|ír%QÊCa\ÎÎ~ÌìÌof‡ò/=øó/ÓÈõTv™¤¾«Òôr¹¹ð.¡ç× _8¦Â2µx~ž_¼ø%/}Ïͼìrþ0̹a¤.ç«{çõÛW³ù›“©RÊñ3w2M’Ôyýi6ñ;¦Î>¾»¿»ýßB úΧvÿãã$UÎœ™ÞÝݯ>üüŠß”ëM¾Î»x37;5{€]e¸Íÿ\Üõ.W Òož«²ôò ÚžëC÷æöéF¡’÷êâîâŸf*î /yÔ˜V"•ºQªŽÕâG–Z|?p•\&‘çF^Hz¹ +®&Ó0Ȝ柩sõY_ÒX¨y[p㪩V ²f®‹îw/òQ +Ñ1ùi$N./]^®¸µ˜L^<4mq ”(púµLûjÕH¯¬‡ƒ•‡3¥Hój‚ÿC'ˆz±ssóž`_ÞMñ½\ +´£hPyÒ9)»ç1ïAÁ>Žôy ŠLÛ€¾ÏeÍÛù°ÀÓº\âø5“vQ¼á)ãÓX(N™#û÷I;yYåúô¨§91°›i+¶°C| if¤V$›[½vÌ….‰\ÿ*»]^qû®Gk[• ‰¤²^VD,dy6ºf×.¥Í€vJ¶Sì/a†{v¹Ëõˆ´yª Ã3‚©0¢Uñ©Ã6j¿Ã­• SÈUŠ& `D„)VÌÐ #1ârÒ¹YQž‡g¦•=?Yà$뢔¦qq|±EnGD]‰9‚)nDT„&ÞHñ»ç+R8ÎÒkÇSl¾œˆ"Ç4c xÐSr™Ãx(´_c§‰U°»- W4[m0 fëäs‘+öf^YhLJ#¼m!E§û3ê¼Ò§1 ,,!$BÃOtÒ"_Uvë}^l‘›J(dŽ\´• ¼]Êf‘¼”ó%é­ß6hCÜ“»Fß ¬->ãðÐYïi*Èb²iqË4YxuÁ®È¾ôi_a6(BfH°¬’á¡ýëìï×ÌÞòŸÏ¨vÒÛÊ1Iž+fÇr^óû•N ÝÜ@û=·Cû3Ú±ð#ôÁ6¯¹goIeõÈi/Q±F—ß8"ÔÀüç0AŸLÞ«Ü9R )Šçùgó=‹‡›zC¬ÖNl¢,tý”w 9 ™LA +ç®è) +ãYÕ°¿8qv[~JHcXˆÊ-“W N!íêxª«&_!Ê|7<+€á8—Eqæ¦*¡íSJ•ÆxÜ>rð0Mtš•FC˜òåü©ùò‰0E—åI(뀰ژ¬¥zæñvŽ¯]ÉzÅÕdK”üö-¶¹x ÒÉ‚ªRŠŽËÌJª'Ê8šÚh‹ˆ)‡‰H í»|ƒ<‹œ_;ìØ]¤ÐX‰TtzD1af¸âqØÞO„z³–½)W̹lêA÷uYÔKÙ9%<ÙѦcÒñ(wÊ£šö[×ç}Ùc{½ÅQbç£ÐÊ“”,5I jWŸMƒ[è!ÆD‡A8¿!æÛë[Y]¦à€,Ù2£/SÖÇÀg%QG&…4ΪrìêÍ!¡;Æžó6Á1¹ÉˆÓÐAT‚0Õ¯)ÉLG?sfßîZ½fÀ†8 r ¢`sו5+ “ÙgatS#®?3ï€õy_È*`ÖÇ'7€w8ØÞ N%UpÊäÿÚæÆž¦îÖ喤ǎ0KÜ8<ݵx üùn†‡1à8¡‰ ¾ƒw´(‚«ÊnÛå«U·Úâ%ºe&ø`X£óC}b1?h–‘°G|>%C +Èë©ó2 <§10Œ#À@5\Â4À½k°ÊÑVQ +:|ÊkÐêúRö(×+„é½E7ívϲÃÔcqiàšç˜”˜’ŽöÐ|ñAœÂžÎx³¾ƒ kÙñ~òšäÕàu>½É´C/Ýóa $Œ¿øls³Üƒ¹¨q¹¤à×A×!Ôâ©'£Ç p±ëÞFò¿|e¢Q1âÔGN }NZïG MÈÝco:¦èž§u¡IK©•Vò-lDùSN›Ñ'c¼õ—¡‚ñ*äaMWöco¸¿¢çäÁ“ ƒ3ë ƒŸ ã0È; T•Ž¨:#ïÐÄ e¥ø››H:z’oaÃR‘ŽH¦ŽX ¢4­tT•&¼”5-¯_1U,Z[+Š¥¨åÉEÞqj (îŽeŒ=ÚXÙ¢`h¨LÚI/t‘ C¹Ábc¯>ïv9‡b “òO$Q±žV%©âUtY¤.ž(‚>ºÕ%t«³ÁDzñK[x5Z—ñg†›£<™´‡õ&$ß°ÓQFéÇb7>%nç/‚÷/¾Ìx‘=P `‰4Î`1\ÄEHÛ†-ó¯%â¬xg ÐO%ŽÜ»ß‹ä‡ PšÊjuÓìÈOÝPsè,…Bhäf¼Újáœ%ôÀZ*€d³±¡“…Ô;°;¦ð\ÒBú]ìÄ€"½,0¬/v,t@ÌLD¢âÏ|9&uºq Ó~af§û_ˆa’ý£IÞk¹ Q¹¾ŠlЫó U2”’û<  ±Ñn/x¦ùcÁEœMvf«z®CùPÒ†~¨J¤×rˆ¬Kñ^‰ËdC¥ p +ª$ÆÖývï2ŶÆ5>_É¿¡±•nfvŒÎfém.÷Ë("‘Iw#â¢îÐc#Œ t`Ê>°0pÃL¢Ï´Ë7‹|zˆQú«Ûç­ûøß1 20ñtð¹$É“y1znMR`^LhWÜßØ·4Ž¼àD¨¨F“ìiVöí¨QòÝrÒR²Íu.†“3Ž|G5Ò!ËÍœ‹Àºâ3fómw|_<Èðtf¦ŒN¤xšgj1qŽg–ñÑ’ØÌ„²€ë$G+*HÕù™åx½½£TZ´·žVX·“t°iµùÚD{ v¦0¬ý±i‡Ë@NkIW’¼¢qT‹£ÙqnRÖ=©ZÏsƒ(üj¦3ª¦©öÜ‚Zµ‡ëªÖZï¼j” ÕÚ·ÚޮŹPÌa»­dŠFð’t ŒGYnwRÍÜïj¶˜N«Y3ý@Íg5­7¦f{=R³Ÿî©¹cßçü ST48¦’¿Ã3çCƒÎÁtÅÎâû¡{ÁmÂg (3™£ï «8Þšš>ô`šÙéK“” yHÇ{âi§’švïâœ2¢Lp²¿o(Àd ŠMçÀ”ÙrÀˆ]‡ôŒTJó½µ>~ǘª@Ù>ù¤„Y„ +t>­Ï%'*¦šÎíœ&ðÀó<™Ë$þ@þ2ã±|™ $mÁ…†ã+„wHñÌmVÉÉO…ÂÃûi€ õoülMå]1Oe%Zjí)‡ŸQ ýå8ô·è:ùä°n§ØO×öûßu^­Ä„4_4’À™µQ<}«áŽ¡6[.¬½ŽÜ¢lÀ!#ùL—Të =²H &K1çÃ&,«Rξ3ÉÖH±#¬ðUp¶Øañœ.؀ɸʋ÷ 6lfX^ÅšL« z1~%PUÕ)[âbŽ»lêIÌ€/¦â³8!‡Ÿ%[œ¯»[<§‹6~’¹‰ï“3ñoùBÐH5 ¾®M^Y7r7¼Þû†À/bög*sëoQ¥ž˜‹Â½Tûåô¹jqœ)*h†©NAW¬Íã¼0ŒÜÔ×iáË‘™¦ +VÁa +÷¨Xñ©Þ?VÍ"¯¾’ÕʶérRT"¯ùšoãÇ3_Ô±YI\‹Oû¸°B¬Ë|Ë<œ5 šê½‰ëe ™÷zK'w¿l6›¢î÷¦|…8ƒ™hÜø$Ù˜éÁ?¯ðýff¨:Bqû‚À |½”(ÂÃýêßÖmøPÂÑhendstream +endobj +5359 0 obj << /Type /Page -/Contents 2281 0 R -/Resources 2279 0 R +/Contents 5360 0 R +/Resources 5358 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2260 0 R +/Parent 5357 0 R >> endobj -2282 0 obj << -/D [2280 0 R /XYZ 85.039 786.531 null] +5361 0 obj << +/D [5359 0 R /XYZ 85.039 781.388 null] >> endobj -194 0 obj << -/D [2280 0 R /XYZ 85.039 766.606 null] +1558 0 obj << +/D [5359 0 R /XYZ 85.039 610.001 null] >> endobj -2283 0 obj << -/D [2280 0 R /XYZ 85.039 734.654 null] +5362 0 obj << +/D [5359 0 R /XYZ 85.039 580.597 null] >> endobj -198 0 obj << -/D [2280 0 R /XYZ 85.039 529.7 null] +1562 0 obj << +/D [5359 0 R /XYZ 85.039 497.648 null] >> endobj -2284 0 obj << -/D [2280 0 R /XYZ 85.039 492.435 null] +5363 0 obj << +/D [5359 0 R /XYZ 85.039 477.057 null] >> endobj -202 0 obj << -/D [2280 0 R /XYZ 85.039 449.1 null] +1566 0 obj << +/D [5359 0 R /XYZ 85.039 212.132 null] >> endobj -2285 0 obj << -/D [2280 0 R /XYZ 85.039 418.899 null] +5364 0 obj << +/D [5359 0 R /XYZ 85.039 190.936 null] >> endobj -2279 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F56 1642 0 R >> +5358 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F35 2880 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2288 0 obj << -/Length 2244 +5367 0 obj << +/Length 1666 /Filter /FlateDecode >> stream -xÚÍY[oÛÆ~ׯÐÃJÃåòzppÛqrÔÆ—ÚêI‹¶ŒDÅD$Ò!©8þ÷Û’+šv‚ -æ^fggçòÍìJM=øSÓ$t=Nã$rC­¦«ÝÄ›~€™7%Þ4p½(Ä©ãåäåëÈŸ*ÏM½tºÜÉrý»sò¿£ËåéÕl®µvBw6ãĹž)çèìøGç迾stÎýóeÀäW<ðȳ¹rÎýŸxæF®gGW³D;¿ñØ«‹³£Å9·O.ΗW3?v.€ðí[ØÿÏå“Ó¥%ûE œ)¥œÿŸ^=€P “žÎ#í*ÿ‡Nþó “¢Çü §À -¥Ue‡+,Ĭy"›‰Z¡ÃAnLôS±¢,#c!áÝ8!÷Å©L¦®Ï`… ³kØð-BØí¯ŒP¸Y†B­Ÿð:<YûátйŽx›æ$ˆ¹ïä_LÑÜduïE(ñ¾)ÑÉ„=&ܳãÖărHÈÇýAG&³ÿ=ÐÏä*=ÈVØgl.¹ƒéÆ2Œdüˆ{÷±i³_$DM’P $‰OûvZô_9wØ£$Á`fHÛº0´‚<"…φŒ‡vïñ£·Ú¾é0ö1üÖ‚”U]ÜÎ(s=—±‚g2º5oÑ;»Ø U 9UBÀwzç,sjsè‡a 8¥­eIAÑ^ iV®E´†¢E,jL.ŒžS[Ö)š.„0†i¢Øð>ŒÚ–ËÄrt'Ú76Ä¢ -ŠG輧ì&õB—Ò¨êBL‚Ž¹\ξ¶æ¡N"hç_XW¸eKLÖfÊàœû»ò%xÄ"”ÞÃ(rŽ6-%.³ª€ÌútÒ| ŸajMj´ízoªw‚uFFÊÃ]‡–ŒË÷þ u#õ©+|&ï k+“¯b%…B‰ -j˜6ãÝ@Ô›¼]”4œêÜĆ+a,$]bP‹WBuàUfé^…t€¦š0)N(`ª¾ÌMØ.Ä7ƒË8NÈ9Yœ5O°ÉHPÒô†·ä!X(n»#££ÂÔ5¥¹•%OøÄ\9ì"’Hª§œY²ŒZAYõ'ß*:+(í¬+ÕlUÅwƒJ¦Å(îðØ{ûü8X|)m¨$†U‡Ö0µZaišmÇÁ”¯Ÿïâ?øƒìïû4€;Æj#„œ‘À×VAd‘ã„«þDaIó¾U$úVåðp£Êl˜?ý ·›ôàýŠb [yïùHl½¾ †¹\†¯bç¯o\¼À^¼}1¸8ÝÒµ­ÚrØ`Wè@`A‘ÇIËM©[F7^_„KÀku¹„˜"ß.ÁåÞ`Uý»[pÈÃrYBN$ª0 '“^òFüÈ8¯RnâG;ù0§Ük/»<…„¥ðùw†žsR•¨‡û:k ² -@ù‚P¸­÷d×½¦±þ ôù7( *´s~¡˜nÞá¿jYä¤@n 2ßÕþÓIàû-a‘øÎŽkŸýŽ¢óºC쮚²÷}-Õ¢ÒïºÇÈ\–gLxù -ßC¸ÍÎØϽ+ŒT˜ ïN¿ð×z¼ƒ^Ÿr?[ŸÄne´ŽÊŠäþgn2Y;ò‹ƒN]/«ÈÕ‘ V0nt2ÄC¶ˆIßW—xÖŒ°HÇU-nŸ—«úžž -s+äF^V?øvRп,êJÉL*J*Ó¡2FŠ‚Hý0g¿r$ÄÇáÞ÷!¡Eÿ, Žñ%>ž>õ -Ò==¬«Vo­—óþIwY÷xQ”yïoõ¾‘µÙŠ~oï"0îÊZšû¡z Ì:³™ûAÆ\¯¹ôÍð§Dä~uÂí»Ãg+‹¶´Ked€Ì¼¡g püº3ÔŸ?=<†±~ìÁA¢ñ_'%6¿ï¾Àw#vþô«g8´«ú,ÿ4Ûá2endstream -endobj -2287 0 obj << +xÚ¥XÛnÛF}×WnÈ \qwy Ї\ÜÔ⪶ŒHò@Kk‰0E*$%ÙùúÎì,iŠ¢…as/3Ù33g—æ–?ÜŠæÉÄŠbÎd[‹ÍijV°óa„kDÜžÌÛùdúGè[Üc‰—Xó»';óiÍ—Ÿíw¾™ÍϯWJió„9nÅö»›™ÃíkZ]]\Î/.?à̇EnßÌpû¯+'–öœ„..Ÿ¶ß|zû†f’yÎ×ùÇÉù¼ó´ó¼JÐÍo“Ï_=k !}œxL&±u€±Ç8lo&à' |iæùäzòwgŠö|‹´ÆP dÌ‚XžÂ"ƒ,<”,"+ +<x¾Æe›6kÇ D`ÿNé>­¦õ¶,óinnSŒ ^ârô!Ñ:·Uy¨Uz›«#Í¢‘Ýînólq$÷¨ê¾` åV;U7´_ÞŸˆ»Aö/´P«¦ÉŠM–j«Šem4 £Rî*UêÛ.«ÔFM=âÝ¡ÊšŸŒ£ÊŠSÑA(}YeŒëßö|íV D%§)x›n” ÍèõckJP—pº•ÜÕJ$K\Ì pG…Ì¡y9–««‰ÝÕ(±&­ †§¹Á“Óp7°o¶Ð‘>Mñ}»Â ¤¯r§0äöwÍPXBnËUÅ +ðñ±øÒ9´;yN •Úc(:ö47ÝãÅŒü8òu‹.Þ­Ž`«_ćö¡ v0·ð—ûïw4À þ„‹Å#ÆcaÎâx#ËŠºIóüô ëÉÀ=Gµ9·zBxæm~(³)÷?©ë‘lº!‘> endobj -2289 0 obj << -/D [2287 0 R /XYZ 85.039 786.531 null] ->> endobj -2290 0 obj << -/D [2287 0 R /XYZ 85.039 766.606 null] ->> endobj -2291 0 obj << -/D [2287 0 R /XYZ 85.039 707.789 null] ->> endobj -2292 0 obj << -/D [2287 0 R /XYZ 85.039 671.724 null] +/Parent 5357 0 R +/Annots [ 5370 0 R 5371 0 R ] >> endobj -2293 0 obj << -/D [2287 0 R /XYZ 85.039 636.266 null] ->> endobj -2294 0 obj << -/D [2287 0 R /XYZ 85.039 586.652 null] +5370 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [354.8 480.691 512.306 492.684] +/Subtype/Link/A<> >> endobj -2295 0 obj << -/D [2287 0 R /XYZ 85.039 523.489 null] +5371 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 467.445 136.217 479.134] +/Subtype/Link/A<> >> endobj -2296 0 obj << -/D [2287 0 R /XYZ 85.039 460.325 null] +5368 0 obj << +/D [5366 0 R /XYZ 85.039 781.388 null] >> endobj -206 0 obj << -/D [2287 0 R /XYZ 85.039 399.93 null] +1570 0 obj << +/D [5366 0 R /XYZ 85.039 518.654 null] >> endobj -2297 0 obj << -/D [2287 0 R /XYZ 85.039 378.733 null] +5369 0 obj << +/D [5366 0 R /XYZ 85.039 494.672 null] >> endobj -2286 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F38 2158 0 R /F41 2104 0 R /F20 1617 0 R >> +5365 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2300 0 obj << -/Length 2322 +5374 0 obj << +/Length 2137 /Filter /FlateDecode >> stream -xÚ¥ÙnãFòÝ_!Ìb -q؇ ð1³qÛY[›AÍMÒ×9ÃÃZÿýÖÑMR³0ÐCwWUw×]Õ”Xð‹ØøJQúF‰E¶? ÀüãLXŠ`¡ý 4ˆºXŸ}øÊ…ü$Hë'"Yç¿{—?œÿ²þx¿\)¥<ã/WQ{Káß\œ#T{ç8Jïü–×·kÍäw÷ ø ä×Ë•ðnåOŒù ÷×7ç÷ËXy¿1ìêîæüú–ç—w·ëû¥Œ¼; üùg¸ÿõg×ÞWÚסBæ¿žýþG°ÈA¾Ï_%ñâóÀI²ØŸi£|£•]ïÎÎþ9œÂ8½à]3*Ziú2‚‰ù®S&ñMÎ^‡L‡±¯ãðOÏ¡]œÃ3G~|ŽñU ¼G¾ -Å`½0ÂOŒ™Z¯-²¾);Ôý+hL·…ÖyÁ‹´BLn1iÛ Ï›¥”^½”Ê;À†¶hÚ Hùa! ‹¯ q"4*“9‰:î"À‡ë½\\Õ ÓbK%¾ö¥~hFÁD<ã–ë-°U ÷ OÐÏÒ¥Œ×ä—OÅ×Y½Ç{ÚW]×2¢«Ùíöé3a·—K¤"DM'ç¤X:ú®´¤=~aXË—¼Ú%l­Ûõ‡Jèr QTy e¢À[ÃÛ¢!»„ -—"o‘ñé€ÂòL }Ÿmy–)Êa÷Õ/V%°©¶\¶mï(žw@ºA‡ÝD›t.Ë;eÙÇU ¾$é•4 -8š×õ3¨3<¬Fÿ;zÓ£d@vIA(#Öº) Wõ>-+¾â²®º¦Þí&,ÒÍ“‚‹#´G»W3^gT½g;äÜ£è”ÓàÔ€ð)6}ø¤ÌÄÙ uFÚ:Ü¿8 ½ñG)a[Ÿt¾I÷TÈ÷+/æX¥w¼ŒSfecÓ‚%ʶÕGFO …++¼`^j’µ-Q‹îh2Y}Z²º»ÒÌ©^;Ôä±éQ$ ùš‹—ÆÊ`DÈmG ¤jlúoqþ7ñ8Ãð-w×@w‡SxEhHœ¨Ã”[4pø8ˆ¹7Bõic\ŠÅ)݈“jH00]ä|è£ D~.«|ð*dœ8Áغ;¿žaÛ6t%.­ËL®0@5¤òã óö‚¥«–éóšÉlY§ù‘¢Û÷e»e”µ!ÕƒmWAÒŠ›äØ“ Eê ¡`¡øårBàÕÍ…Ï Oc>s4¨}$:ªjíÐãaÄ -n˜;&t^Šæ•g‡²µ7Q÷ ã˜ClËŽ¸í\£|šáñ½xéº|Î-Êu¼ˆCZ(žb¶êÝÖ¬;ÈÞàiöŒ3Ã|Iw -\ß Sê›wÒ×I ˆR¦y ~´+bsr:•ò õž3,õoÍfÅšUÍ:>Û´PÞ»±霃ÍwŒíÇ\ü,ÆÆ»~bTÊÃD­‚§×.Ü@a'fä¦Èz>HXƘݤ²ì«8° M”Øèl^‚,Ò0Ž«Ã)§3žóv>>SWˆâ…Ê[™§.º -†j ø\å|8[Í°ÎMvëMñµ/ZÔ÷zz†E–¤ŸÈê'dB9H3‹`CÙ¼ ž ¦Œ ZgÛ²rOî€ðŒùvMO1­X¶ÃW`(,¦î‡±øî ½!IÏ”%ì–©[TýàX­þ\ ‰ —Ö7qcÁÔ.·uß1hzë˜x› 2­Ns§M‰/B - ÍÙ¶fuãW&xIòw„+ ->íš7t%4‹žô«Dl5 Góy8+-Ò^tÜ4œj9³O΢Á”†”1bÊÚõÁÑGXR€ú¨³#'(Ž÷ ­'̧/‹¡}:y½çÖéÿzÆ»#Ÿ€œÔ` -ÖECĹ!Çb9iz]µ§¦œqlÑ}™š$&Ž“f/ê6.(]º(°°iYœiÖœ¹å(öéö¤~–éî¨üä¯ ÞÒ—¥\]˜ž½ývðžá¤ßͶûž\ÿ´Bœ|^‚.•:0ÊR²xüŸUÍìh%'ÕW6vP ÿeHÚ‘c¹Àqxj oz]Qû6Óæ¢ÄͱªL2´AøŒÈ`ÈzUºÇg2~|¢”Aø¹vÈÊÆVwBÛp&–6Œ_I°õ÷îAA‘m çÔ[O:sŒìS¡^)a‹›ÄÜâ.í3f)ø Ô2ø虂îRa2ó!*æÎ7‰íƒuG[]sA$ƒ°ô2îÚÓLgýѶ"ÓO¨1}ÊZÒ×ù¶¯Â¨n@G‹îK¾íS5d0_F -?­?Næÿ>°¶ù¶OðZú¡?Ý _}ÍÌW_¾U¡¥ ¦ þßtþÊendstream -endobj -2299 0 obj << +xÚ¥XÝsÛ6÷_ÁÉ=5BÀϼ¥q’º­]×VÚ›Éåi‹s©’”5º¿þö HKŽ;×x2‹Åîâ· t|ø“N +_§NœH¡“ÄYm.|çV>_HÃáoÄóÃâbþ) +é‹ÔOÅÃQN(‚P;‹ü«ûáÇ÷·‹w3OkíÊT̼8NÜ_ngÒ½gêíÝÕÍâêæ3Î J÷Ë-.ÿz7K´»`¦«›ãòûëÞóL ömñÓÅÇÅ é h•¢š^|ýæ;9˜ôÓ…/tš8{ûBÂòæôa Í¼º¸¿ømÅkûÎy%Ô‰}êŽÜ"¥Z*'}úùå3/T¡+æ«Ý¶óºl³ÌDYw}VUh‘#c!åx*>Ž[¾ +ø÷V}Ç“ [Hô+ÞVÖ,³kú}ÖÀ=fRâþ²Í³~à}(«‚Gۢݔ]W6uw~ãÝ®®‡}Û¦ë=«/QVÍf“Õù ›ŽprS3Ù û¶UÑ´kþIŽçEBÅàÝ@‹HÇ$h±}•R.l—îª-·ˆIÚíÖÍfUÎNúf‡®9«pñÀ‹Ûݧܞej7Z[>ÍTâ-¯ýÛ—n+PBÇ´²FŽ¾±»a½`í'×®âX(„)>ßuí¼[ýЕÏs8¨h»ù9³U’ª‰ó•+È’¾iarÀðÏñoÁ°ƒ¯€S¦ÑÙÀ;Dâ—‰vù ‡G–}*dzJyA”Š4”CœÄ +¶%ä8‰E”‚ê1ˆÙì?f@u³¶F»~'æš= FiÒÓùŒIe@®÷'c²âhæWå\6 ®3јåz#Á¤±LÆ‘F" b' ã)ŽìË`%d#@ð7ßÀ]îßμÓÔ†®“pU÷ÌiñžG-aÊCàeá¶%Ò/"/J„åy7ŽIÏ.Œ²ÇºÚŽ ÓR$Ijä¨  †°:H(.((pRÖ`ë©ŠS•žâÿô'U 8’÷`‚)²ÜœÒ<œ9ÃSdÞ`+¯ÄÚä@S­â¡<…Q5' \¸=kw?S1Œ!àÛÿ0%£ ¸¤ÙÕ9“úuÙÁåjH +Ðf‹<‡ù¦y*Øóöœ±š”w´gò8ô³¼iëo,tí®ç_œ Fׯü‰}á'ÒÚ4_ß7l;a±®7QœÏùÇ×àÞÈÈêV¬ÀaÛƒ¦’u†ÄØ„08ƒk T<µ¶áJ>RM+׬Î0W‡ÅIn b 4uFYäo$%Ì|2%‡úþÿgÊi† 9ñžéT*‚4p ‹ä\m¹ž Š\ Ðç ¯Vs…+®0×6·ìq¹p<4d@¸Eð6T`{¤b•íyɤ[!QÖ%#™Ð±k©PqÄr‹û–ÈUgíHRs1†ˆyË›—&½áøD _Áˆ}’³B©à‚Gè¼ PîMcâ‹m: ýP¾{6²9wÔ-´+s ’WXÓê †¿[ +x<ý©Ì ì0tB±z _P0 JR›ö I<ë°ëÁV¥î’´x–¥ìÆžq-3ŒKR¨(jžæV$_A‰ZD&¥ö%?íÀzrP€ÖbJ+iüÊ®Y›\E#$ÅZH?1áJ®ÚY±Ë„½Aì^šò€x"÷²x"½€É’~.û3 …ÒThd£///Q&¯`‡ ÉYÃÑmBÏjˆd+®‘>d'oCiÔf¤Âvš/»$>¸´È½ï yÙà4v#¸Ë( À¶#Ø‘þ=ÿ·L _a>£ MÏÛ±[&ÅXW’áÞPƒ¾9QÁ×–KÌÞ}Á‹T2p°_7Õñ ¼F’Áw8}tÍ®]Y€“_HçÜ,Ò>aÑk C½7γšâ{‚áý#EÁQ}ãˆbÆÓd‚pÌ‹§•Œß2¢ÛîY`§C¡hpl‹Loòj¤~cbs 3™8F!&ŽO‘oƒÁ/—*iNЄÙ0þ|û æ"°±3nÂqF™ì°$§Q^2ðƒ­ªÒ4t …A2…¬ÿÎËÅ’—ðAÛïèÒ#Ë¢ÞÊbƒÆû²ªXšÉ gLΖձÀÚÂËw¿Ù–£µ‡¦åEÊG›ùî…o¯_¼ð¸V)4©üÕAìPF>WK'"áú$¡û ° }÷®X55Þõ­'£Èt4‰ùM„À(°Þx\>€é’ÂѤ$àûTR è^2'ŽÀsÑ÷Í9òð3àÜ_…Ð^ÇÑñ¡$±iêƒ$š>/;^EZSÿ³gŽ[Î+Mkz+íMS 9Qÿ†É”M#: çi2¿þ o™Â©„%65Öf+û$i<ˆ`¹YÌ•ïûóÝŽ…`* è¶wgšôPÄØ R7ÂÞù +òófo¾Ü,ÞòÅ›a†½5ð4"´æKE·ÛnÁ1…Y_ÞñGxƒ%лNBß6Pg²,åíS+róÅeb>®îJ»ö¼» +|2dlÐû¼YÚR€ ˸Q\"Ch@íÄ,Û µÅ±ÿiLeJ3·A'.è„N.~Íý£9Á¹Ÿ¤àjºxì |nëË{±§zUiú¾ŽûwhÑŽ\æŒØó„R"üòÛÇ,Í/¥C +lë;‹°Ä5ûá“b]üå}üÀèè +µx²ñȦ¡Áiš<ìuñ×{&ižççòüçKø[4‡lf%ãoË•JZ]Ðr¥¢çúÚŸ' +ÿàÄYÏendstream +endobj +5373 0 obj << /Type /Page -/Contents 2300 0 R -/Resources 2298 0 R +/Contents 5374 0 R +/Resources 5372 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2260 0 R +/Parent 5357 0 R >> endobj -2301 0 obj << -/D [2299 0 R /XYZ 85.039 786.531 null] +5375 0 obj << +/D [5373 0 R /XYZ 85.039 781.388 null] >> endobj -2298 0 obj << -/Font << /F62 1689 0 R /F70 2201 0 R /F18 2207 0 R /F35 1632 0 R /F15 1628 0 R >> -/XObject << /Im2 2261 0 R >> +1574 0 obj << +/D [5373 0 R /XYZ 85.039 290.091 null] +>> endobj +5376 0 obj << +/D [5373 0 R /XYZ 85.039 269.5 null] +>> endobj +5372 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F66 3242 0 R >> +/XObject << /Im2 4150 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2304 0 obj << -/Length 2491 +5379 0 obj << +/Length 2819 /Filter /FlateDecode >> stream -xÚµYÝoÛHï_à^d V¥Ñ‡¥‹$ÝÝë· 6r@·[±…Ø’+É›ö¿?þHŽ>b;}8D‡CÎðs^ô^d‰DùÅ"Ký$ -/–»wÁÅšf~{*EœD~ÇŸ˜œ»Ùyjü ^œ¢1 ß,¢‹¹‰ý<`Šëûwï5Á… ü4.ò~õÙKýÙnå\£(ö^Ên(‚za¼æÍzh -åaÈ@i‹G@‚¼%ðÃÀÐß•»µvÙ”3º#®„³B»MñúFMš« ‰À|§˜hÖJñçooÜ!\ˆNåÑÎo?Ð>7Øwþ¯OÀ=Üz½Y¤ä‹‹©—Ÿgî™_D¾ !mFöõ¦G$~þÐ#Œzĵ…àKÒàyÝÔ‡jõ–ágÿ³å?lp£0«(ôÊV¾|Ã{`mœª:Œ…"QÑü<›Çqì}ì„fÂ%$£^Âr°›[Ÿáå›~cõ¬zÜQ\c~¶j_Àã·õºVq¶®¯´úP°»tí «‚ËA“/¼væ¹ílWÖ•lŒ x¯ÉSˆÏCYÁšk¿°I þ{!ç¨ZÑ¥Å$ê樊¿ÕwáâcN‡vŒ„ÖëaOœdý£u‚ql¼‡YOաا;S¼V˜!<¾r¾º¤CcJÈI+CÑPP7zç|’X5¶N/^~+…ù.žålÁjSîÆ:$¬Â˦ !±kIÚÂ%¯>s )^Üàâ­8¤ÚG+ØËãu,a=_Z -ŸÊþîêßœd\Œ‹s/'g9%{½f‚;‰dÑpÜ,óžÙ\V­ŒØ†èÛû1Áç ”¦œ'h…?ÇÆòaƒ¨w{‹Ë*9L+û!Kü4›/’Ø»bMæcUÄço!~¹³ÍwØe>Š1ù4Æ ¯ú¯ †ŒN£PðCÀÉ)# -è¢×q1UÖ×’~ŒPRO7͆„–ó¡laÆÇö®?Ü`sµV(ñ "_ëË ‚]™hËÊ€f¸w‚w;NeaxÏqIF¸°häÊXAfAÝt”fGZ:6\‹™pÔŒéS±­Ö sa´^DÙ{Å7»Ûs¦9z%•¼\  l˜&’á[™¡y+Õ¬Tz­Œ¹Ü,V§9ý«¾Œ’cu**II°Ð‰2½_W2yÍ–ÊKƒ-zk|Æ=0%!!“ª†JõÓf(k2W£÷âUS£p\2î æu…;Ÿº­Þ<â0Ó!Ò‡ ®Ì8xâÞõ˜á“·3nx¶Ô\Piì£ ÿ4è$µì#4g]ÏÕ}µüŠÃ„Äÿ:Ô]Ó‘8pªÖÂaèÕ°G¹ÓªZe`;ïmt ”Ãz-˜xa(=Ùñ}JùQ³Zméz1 -è‡Ñ‰)08;Ú4uñ8¤”zh¦$‰°9hïÖ(rUWCæ71“läB˜¦*ãY¤L,½–/¢›–r tE{+Ähí+p &[ÃCÏd½;ö%'öÜWךâ¹2yæQïzFèF½ª•Y”#)‹_Ú­4ð}½×{iºVx¬TZ)ó˜XÊöºR -3 S—l]M¡/=SÏÏO¨|³-ui{ ™b2Ôåö°r½­IpDàL¹Äh’ÜûÏí,‹`_ôñTòñ­“) ×8 Ö»pT\”0>)°Œ;šíc4R A„#/—lÆQø -‘9¤D -k¥ª-d `(} cø;´2ieH†t)ÔV;]‹f)v‹NcŒÑ3Jµ„û¼ÞÖü¾±ý2—ȳ”Š„œ›ÃðŒÍ·bp¾ qìqOâ% HÎoâÞm‡ÌæJ¢û Üßÿ{õpᇙ¹˜G¹$‘ÔàÔÐáy€,71‰÷OùÐñ^_o¥)4T‚pù1Zö½h¯j¼f«–¼æÕ«Â<•—‡‘¤w®`±ˆ)T†×®Ö—ÔŠ:VÞЃ` ëÂrnŽðù¼émP’ÎYÎ9‡¥ƒ} ­$LÎ1©q<·m-Ðκ,2z%nA-xÎwÝsY +×uòpÙJLí«¬ÈUmÑë^ dl¯ÝærB8ik”ßè0„vÕ`¿ÁÎŒLN\qΉ”áK©q +ªZ_fœKÙDz†ÉëÝžì‘ÊÑ£`Íl–Ó#‘Î?ûÀ©.²¾6G?z[‹ômíAŠ³tá}=X63>}5¨(M½7žÌÙ¯¥,Ô‡wŽ ´¨cëÒ‡k²¼Y„—ZÏÿšçŸÿ¿Ox¿è% ­™xúÞVNªR@Ü®èñyõÄÔ¨î ”F¦ú¬Ç,•· €¥þ Ä#nEŒI\µ°/-×¥Ä!ÇëÄWÑq¦øøéŽÈâÔÓ€P¨s[þ¤áÈ…¤Y.x7‚i xøøÇ@Ã+ÃôᎦ$ƒ¾¯uø¨B`¼zÚU_̶Lp-¢;ë²Uà Dl%}óž¹<µ¯ FÏës…!yM–7ßÈ¡AÖ'3‚P¡üz0“㌣gˆ©é>ÊÏÎnbü,ŽÇ–{dÁdºTËûyãG?DÆ7æÕ˼ûþ52Â9endstream -endobj -2303 0 obj << +xÚ¥ÛnÛ8ö=_a ¬ ÔŒ(’5ûä6I'ƒ&ñ&îv>(¶l •%×’ëóó{.ÔűÓYì (Lû…‘þÉ5ÂWñ ²R(k³õ™?XÂÉû3é0FeÔÃy;=»¸õ@ú"öãÁtÑÑ1B5˜Î?{ï~O¦WÑRÊ“±Ž¢Èzï>N†Ò{dèäáænzs÷w€Òû8Áãû‡¡UÞ”‘nîºãñíÛ1ï”ð‡_¦¿]M[N[€«Ùüvöù‹?˜ƒH¿ùBÅv°‡µ/$¯Ï€Oa´rûüìñìŸ-)>Ó¾uJ+FYa¬:V‹2=µÈP k¢Ad|a|Mz_^ßßMÅíõ-JäF¿»Óû·W“G-.þõ³ã_?LúdžN/¯®'Ó‡@L&—'.ß¼»¿ûpóV\~øpâtòx{מ´VÚÁ(ˆ„:@ŒÏŸ²b^î«áÈÆ»›¾áEàû¾[&Åœÿž8À6åEµÛlÊmºó§ç_¾ÐwšÏtB8Í+lºãvìÔw)¡d00&Zî"ÊÄÂÄáIÁÏ‚ndðº«Ñ-èðŠÑí :£†«‘b¡|ÕzRÇ"Fµ€'ÉH„1𮕬$YïJ‰z8’^z,*£ë(* ‘æàÛ@ +_DZbœÞšè#ÀÅÍZ.KàtpÀ,Óõ³`Þۃ‚c Œ´BlÖ›n¬½§!¸”WÖ+píÇÌÿjˆ2À¹ñÆsX—ˆeB¶Ù÷tË~÷¥ÆK9_’^Åh ìÑÿ§^¥¼€|óÈ«ÿ‘Ê??„;¼ÇÞ†^ÍòÐ ÀUÒ÷JDû„W³îÞáj +‹‹àëÆ¢%à ö0>p³!iEÖ,!¸K„ÞàVªJB6„å¼d…:PYôÅû,ÏyÕàK‘- æ£Sù„1RƵMºÂÚ)0¿Gî;pÔ™À»!aî +€†Ä}c>Qs;Þ8,È>°ÿƒ ˜¿³B3×£b¤ßéCˆh| •T%êÏH¢ ºäí®Jy1nµ7«$TþÌgó-lÀ]ð`[¡ŒñÖåww5Ažö(™Ñ]b·ƒ…âŸwèì(SP\“Cæ¬RPU(9 û±ïAêÍEl/n¯0Ë3ð“Š7,,êÿ(Œü6ø›ÎáÉÉŽuIðÌ¥v–TtG¼L2:’PÕâA/qý…<ˆÉVÆÑ`ÔÝÿ?9cÕ +"¨Î/¢à§mö­Ö´‰,ð².çfø¶°6"Õ@+™ÔcÀLÜj<û¶Ë¶Y±u…¡‹Ò”7cÜ—)Ž"€]’\& +#ï:C·ƒÐ?ÝϨ8&ü¹=ÎÆMH#DdE¹›Ê$ñŒ>Hl›Øv\ÃzÜÏ*Æ6žƒ.Ïáqúd¶ …]$]7))–üÛ#y»"ý±iÒ›AGÀzó ˆ†3cÚÈk¾AÀ}u ~ L<;ZmrÙVâ„OW)bÆ·!¸(ÊÚAÎ÷!|6Éòä‰DÁåQÒˆ›XÔmÂ~È1%½§†´`펓Š¯Umö_6¤”†¨Mžôös¬ÉŦ¬”þ¨ÑP )¦f‚'#­tAšŠ½ä‹] ]`­ËÙâ€ò‰Žæ”]÷„1J Qàeÿ²¾"—ë“ê™wdZ8ÎKR ±–Ôînš55¼†bÄz“m‰ÊJžrGá¿J¹6EJÈóbá—´rN+ÙÖ#\gÅ,G'˜cáB¬"©›ò>+*:G§Å-µ§«î®`HãõL­Õ²šç@¬txŒ€’²éŒstÅ—„¦ "ŒR3rQ'þ²˜¥˜Þ# î‰ZÖm‘ÆnÈ1ìZ#â Î]µhýÎeo<úÝ7>‹ÊÂ]xŸé6›ñfBª®êÇÙ6ÛpǨ¥)c>Ó-БL$wbÏŒYžª¬Eä±Yct';V ÒͧUw¤c¯ógP|â¢1Øü R†´²J¶ÝwH!ˆöÞQ“>PZÄéK àMÍ76´k¤uŒ.n©·œePî_X…A#°³òß]1…ƒÏNªÿÛ:ŸÂÛœ†mUb(ÎÝ¥>åƒd{î +ˆö ¡õø…rÍÇûUÚÐì" +>ÉYðf™Ö‡’^sCõD[»ÆÆæ©‹í#Û‚²$eæ-r‚géšÄÀú eU£¦Ê˜ÏÖ%: ’’¶±–åÁˆ1gYãQ"­„[™rÇÌ_ÌXñH/«˜9ü–¨7õ 1nZ½«vNPê .Èg–x6C½%7äE§+v` ðßVìÎëmG }Úð°í]ÛqÅï(Ð_r[1¦kî(ð eK­;bò›ôëòS²Lø='„²BÝ>öÕÏÇ/–E‰T¶=­Æš_>qúÝ”Gó×t(éøç:êp^ïj?RóÓÊÇʵë`zÍâ:t¾€+|Cš0pÒK|:ir<¬«rQ»ߺìÐnñ”»Uí.1—» Þ†ZÆÆ@à9~?áøºO ³rÙöVÕ9#nÀXø:„™­uTF\ç-•jÈp;L š¬ÏNˆEéÐ(}ÿkîéG¢ç!­·mˆ7uï·]¡õºÀÈÍ,ýIÐÚ¬€us¹ .nä w]GqjŽËË“A@úF¡@ †°)К€/L`»Ac#­{¦DŠ®š Yë—¾©üHØ È(¾6ìœx°]:Œ‡ž›6Ø£úñàKš(᪮7¿\\ì÷{Sêsµ³r}ŒîAd±ª×ùKÖ Œ)03pöòI’QŽØ9›tnññCÄ¡=0ÅðkŠ¦©íÒh‡Žo käNÓ¶éYÁ¦×ªZV|å‹yòÔõÿ¹k¼[²çã[€½EÐøœaɺΗ®?#šÎ9û‹ë0ìër$XP ½Š–{ª\Ì)Îîø-sÆL·N|w§/þ%9ä=l¶ 5§¨Óи_=Nxá’./‡&@UàF‹Ì×aÎ2‘ˆUäøbïÖ¶éK{aA¬"›šJ™k-­¤â”PúJ³Ë›Ikµw_ÌRFïµP$XóѾ`]¯` tz/¨ò¥îR,¾æ6Ö5GÑ §öX»ig½ÉÝ»Sy^®òl¹Â'’š8hë® »jwÒËŠcÜÉI\ã¡Ã$‡©„=Ô³åaî=þmá†×ÝÔå7cRÊÃÕ W’¾…Mv³«ÁDF=´ágœ-f!N˜Ü*zåë]ëwÑë5?û¡>wÜ7‡2ôîÜmÛQ—/tŒý®NT4žÁïÊM¹”Ï٬ѡ/l¶Íõ ·¨èv0]?&® ¤’¥aˆsq Q®%j7è#;ݱ©M¢¡!­#㓇Vo¤¡Ë‡åÿ>UPáž F³N²‚†¸Á%¿Þqí#V§9?÷û:Xbs®¥zÑœS—­UàzÓZÂâ¨æ8—º­> endobj -2308 0 obj << +5383 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [380.589 592.347 489.248 604.036] -/Subtype/Link/A<> +/Rect [306.831 175.625 509.276 187.617] +/Subtype/Link/A<> >> endobj -2305 0 obj << -/D [2303 0 R /XYZ 85.039 786.531 null] +5380 0 obj << +/D [5378 0 R /XYZ 85.039 781.388 null] >> endobj -210 0 obj << -/D [2303 0 R /XYZ 85.039 766.606 null] +1578 0 obj << +/D [5378 0 R /XYZ 85.039 408.185 null] >> endobj -2306 0 obj << -/D [2303 0 R /XYZ 85.039 651.298 null] +5381 0 obj << +/D [5378 0 R /XYZ 85.039 389.517 null] >> endobj -214 0 obj << -/D [2303 0 R /XYZ 85.039 651.298 null] +1582 0 obj << +/D [5378 0 R /XYZ 85.039 251.906 null] >> endobj -2307 0 obj << -/D [2303 0 R /XYZ 85.039 619.773 null] +5382 0 obj << +/D [5378 0 R /XYZ 85.039 216.704 null] >> endobj -218 0 obj << -/D [2303 0 R /XYZ 85.039 576.904 null] +5377 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5386 0 obj << +/Length 1554 +/Filter /FlateDecode +>> +stream +xÚ¥WÛnÛF}×WA®€rµî’lŸr¯ÔqcN‘äi‹ˆD*¤dÁýúÎì,)Ò’ƒs/³³3gÏ\$2H : âDr$Ár3Áì¼H/z‘p ób>™½±Q OEÌoz ŒæùgöòÏçWóצ¡ÖšÉ”OÃ8NØËWSÉ®iõêÃÅåüâò-Î"X”ìãn¿ÿ0M4›“ÐÅåqûù_/žÓLs1ý:7y=ï-ím«R4óûäóWäàÒ»‰à:M‚Œ—°½™€ÜDÚÏדëÉß½*Ú‹:u•N"ÏRe~Œœ•<²ºGNÁ®ä©1ˆœ”Šk©‚ØnDä -øjÆö2»/²] ®[Ëv5~c¶€dM– ]WÓP²Fe^4Eþ@þ¦š|”q&K3xìÞd•Ò˜ü¾‚k—x?¤â”=LUÂê=N¶Êpvÿp;¬ñ}E»»•?S¢’•ì²5 ×´Ü:½M +Û-}Fd(“Š-jeuë— <û@;\QØÞÃr¶mÔG»rÒ¼[MÑ€nöF½ÖÚ:¦çïr¿mùj½%Á ­1ìÌÍØ‘NX^Ów·BþD:ŠÀ©ZmöSåÀº£íg@à.ÈÃò–ˆòŒŽà{»Í‹"Á\"h)VÝfœœá¶ÉIÄüUYŽwh¦:žÆ<±ã·uC5gT¥(§ #]~ÃÕ¦XS˜´U$É%¦li+þ8÷v9ÓÂC+ù?ÊÐ âž-Oü… +™øI=>UmüˆÄ“GzÂΪÐhÃc«ú|«Q‰ŒS°IXy^nO]$1ž&ÎÅà{ ¹ˆÒT“Ì`ì ?:äf›(xUƒ…ÁÈHÒSQJ†k,O£8°âBR TˆªV-:fZÅ* +Êœf˜·P¤Ëh8nj͵Ÿ– )J¤¸Ôº +‚µf›µí'^ŸKú^j1¸µ‡;b"6½bœ7SÔ:åÈâƒð‘ÓÚ-{öþ½dYWÀ\4Û)Š·Î%çú²„JH ÞÉm|Ek›+­;¿u‹_s,è¸Ø®jÄjÓ:æ.¸¼îMútXÕ•j‡»{w-VŽ*/qK¦àÄxÌa‘mú&Áo–î! +(tF[Öµ¸åž¼Óˆëî9a|ÀœSwF|ÃqÊʬœþMŒ3¿¨î˦®6E…EOIðÇPJ +J±â¾_y(P+ +–¾X€TôánßW,-JôþºG†J0ÈâÒBTw¯|í2Ñݺ Õ×å]E +ÞWgCVÒÝQªŽPl’˜Þ&£¬vSV¹3äÐRV{US…œª|r¬+W×êõº÷ö$ßEp³‰å'ò&C „xî'“ç8ééA_>î”æJÉÀ(Ác}ÚãjáWœë©Dìó@K2ÔÒˆ”JI§Às–wGN ë„ð¼kB@k¿RV¨j‘\þë©$™k÷t¯™Z8wýñªÓO$=;<Cr,º¼Œðü¨0{ÔYÞs +,™¨õi#?”ê2" +‚ õf@°ËùL}›}º¢Ùr]Ôu9…ü‰_5Zp•žûM#ïÉOý"ìEš':=Ï w²‘S*yl¯Ñ 7‰>5ø?qFendstream +endobj +5385 0 obj << +/Type /Page +/Contents 5386 0 R +/Resources 5384 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5357 0 R >> endobj -2309 0 obj << -/D [2303 0 R /XYZ 85.039 547.5 null] +5387 0 obj << +/D [5385 0 R /XYZ 85.039 781.388 null] >> endobj -222 0 obj << -/D [2303 0 R /XYZ 85.039 130.562 null] +1586 0 obj << +/D [5385 0 R /XYZ 85.039 761.463 null] >> endobj -2310 0 obj << -/D [2303 0 R /XYZ 85.039 99.037 null] +5388 0 obj << +/D [5385 0 R /XYZ 85.039 743.459 null] >> endobj -2302 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R >> +5384 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R >> +/XObject << /Im4 4878 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2314 0 obj << -/Length 3243 +5391 0 obj << +/Length 3617 /Filter /FlateDecode >> stream -xÚÍZYoÛH~÷¯0¡€ˆáÑÍc^[În<“ØÙ‘Ábf(‰¶ˆH¢BRq¼¿~ëêfK¦• ,uWW_Õu|Ut8 -à¿p”i?ˆóQš%¾ŽÃÑr{Œ`äï¡pÀ¿ÈW)]Í/Þü-‰FaàçA>šßÏ|õ‡7}ùiþî·ñ$Žc/ñÇ“4ͼÙ8ô.?^]"UyðeÞô×ß?1×õÝG¿OBï–IÓ»ÛùoÈu÷áƒYl~ÇÓ»†ÞÝÇË›Ûñ_ó_à “0öµÊù,¼JêÝÓd¸x7wî3 3?#¼Ð׋?þ -F+¸ô/çÙèÚæùh{¡4.Ks1»ø‡]†ÇÔHÃÿå6QQâG ·IøY¦¬üB= ¿n g-ánIâ}¾¹aK{m‰Âi`èJÅö@¾ZÞ|-3v@+¶Òéõi?ž€„ôS¸à«–wu³-6›'ì)¯¡…‡6[1Ã}Ýð<÷˜+hÖ[ä*ªóq¯íÊfàY¸tK?o÷&«Ü+ðG{M½‘=Üe]tL^-“ð®u·®àg÷Àc]ÍCt"n>VpT,v$‚I8ù9Þ%ôp»¢³×µëÁÔƒ¹/ì5Žr¯«–tèU½£ƒgÞ​ÜØJ+Ì=ÔõjÙÔ-.PßÓ ȼëzËò S¯Úî7fí³mÑÁnÌÒ”_xwy3^£ß(óVÎzÎ{ÐØ'òÐ9 ½Á‹Ñ84lzæV`†´ -kô¶ÅÍÇ«ÐèÙÀŒ»µ>ÁèõÔ?5Kج%M´ös6ÎS‹2p–\eÖž" ý\kמ?öa£-EÞûz¨wq’‚„à7ð¬A— ù<ŽQ1ê% ~Z+|ÿ3ÕnÅm|„®5+‚ÌQ!¹»¬w¨±}ÊæíK· ÎÝ3 -|ëó~Üa¤µw;çßG|ÛºùbOiåUòk.ÒÇÆËÇé½Åñ£ýٕٖðÖH*øgâê²Øp­Áj­Ãڅͱ–2Ÿìf]ò¢ÕÒás#ëRE¦ Âá—“ÅÙ\ ÚÆ̵f#¡#6fx]ŸÛ7YÀØ]Ä®_IgÁ…yñn:"\¡`âmÙ]áä›»ÓÙ?“L.÷õ`è“ãrc8@yhjdÜsoÇV-¸iÃËŸBº1\H©á…£hé=p6Õ6p™Jc¼Ôu¼û±mË•¸1<]TcÀñãÔ ¬ ì?ôîÔ;l‰KˆNPYÃŒYæÈRð«-û7z^¤d¤ÈPì ¥}ÄóŽMýPËzT³ÛµF~ - Ç8‹É/ÂÎvÜÛiº\½ï•…Ì?“ȶ<4,V–8ÉIxõ¦÷;¹xÛšbUâøq¢ã‚)kB‹Óm‰•¯HsdBk£ï߇4àú3ÐÁüîÑÏÌþÞ„bìTc{$»Þõtà-­p +w°p—Èuowж磰/¦—'ÃVt\V•5Sê>ü -êQð—÷¯¥ «uÐÉá‹‘Çknå­@6í¹ð^òЃ”W-“–M¹2g/6DÔ$Ýu%±Làå7ÒíŒÎÒŠ‡^±Üpйے6‚C{i„H¨hs„™\ô 9dELQ¯b¿·qÿÛϵy9ü†€ö£ølø ý,Jÿ£ðIøýŒÏm£¦MQ´”^ljÐ,jˆyõ¿‹›Ÿ`' F½ Y*ÈÐßà(€H© -v5-’rz8b•-[–­DTƒ¢ŸØt¼–ñH¦ð!ó@vP6½GÛ­L1×¥ Œ˜Œ—Œ—ŘxµgÐMˆ÷„v:I‰XæùŒ5“!V’;§æ•L<À¶•x¬LL°€ÓqéU».Å„9}€†Dµ–ßÞ9Dˆþ¹d0ü7¤€@q8öƒ×xËÈI¾‚ÞïófÖqõ‹“ÂéáX |qqèX–¤¸…qdÈRðO{¨ºb!j„‚ós «M±ÀwßT’¡Á¡±lFÞÍ=ϲ!>¢ |ºu§„Ý­“ÃTV¬ˆ«”2§jK“Ñ“ÚUR*ÏÏý‹2ä¥DÏ$±z)Ç•¢JÑÇÔ¢7lËߨɵ¢ÛT8~ž -ã¢&J׈çêÞ'¬ÆO(”pT쵺úBÎû*Ð?D ÑЂ´ðžŒu<·ä¿7ŒZŽX©Å ‚(f\΄Ã. žàÄäåÈùi–Ÿ ü¡¯“ø|àŸ‰|¬¡I\ Ô:±uÀ†aû®êX$Iøyà«G¤}¨¡£†®%Š“*:¤ - Î!=]VûJ«ál ‡´³æàÅÙ3èØÉy9¸¹æ6»b-·ÕîmµÁ±:vëÐÀCꬣ~˜¬’‘Û!rÉ>ÍM6†dHüVvã’VÿuÅ|Je¬ŸÖ¹Ç€30yn@Þu#í}S±êÊ7ùÃØû›Ûw>ßÝg¦9®f’ÜIüóF6fr°ãÆÒDkv«Ý! Ì7-ð™{i«ÝÃ&ØÍŒë”Ö1#À ¹IUS•ºùòŽGÊ¢¡0~T¬ ïV|&Ï+£ÅOÖTÞc•»Å=\Ò¨¶©ô -¿,êÚ^qÅçá)RR@>õó‡#LaEK¼Ü”]ëw«E_hš#Ô'.-%´Ø’ªORzb|ü ´,ºf¹o¤ôå©S¶’2ÈTè’ZKs-,Wƒ5¹“zuœæ=`L3·ˆ¸%V¦¦tìŒKÒ\àÛa#©"ð<#„Æ|,Cî‚Yvå#÷gdµ@1y=¶+.©–›{îÛ<Úµ›ZÀâô8«ò¬¯ˆ_Š! ºF”Yå€ç’“\Æ_”éëóµERòqXR¾¾þë|.ìúuï瀉s@-2â=aÉí)wÿîHgÔ®9…~ù½j;ûÕW†S°§>ñ>8Tuò;NÞ}À{Iaæ–ߥ ÝIäyµ3£Ù›Œ“o6[ÀE^1£A¶ò `ò (€À™©øÿ0^© õ~ßUß¹uô¹ «‚s.% ÿšK{™”öR·´níiǘ±!TXýË87ä´Šƒ®ÍÁ£5D¬O‹ǵg¾~ÎVP¼,v­I Ìg ,<ú"‘™àô7e·|cËE+e%„Ž’3} ïF° -ÈÏq nWó`C3ó9›ü,Õ¬†>ZÏ+À¡Á±)ôÕ>ìG®ŒmO囎ÇTàâÄsÇ£ý™TÜ\‘m+lQNÕ6ùPðX…RB³5avÌÀ]4CÞm[¬JL¦óˆC¬ÉÓ0»¦û!…b ,ÈÇŽ|Äf!ã³ßÞ̸¿Å?£á€(«-wÓ“S»;_ñÎ'+GfeYisòƧö¬\3M’Äϲô…¿0bQüw£"?‰••ëY;Ž³Ós"Oxìþ óâÿendstream -endobj -2313 0 obj << +xÚ¥ioãÆõ»…j ¬hÎÁ+(x¯ÄA²ëƶE ´DÛÄʤ–¤Ö1úçû®¡F%§ ƒs¼yóæÝoFjÁŸšdq™|’f*4Y6™?œD“;˜ùöD ÄL@fÌË듳·‰¨(Ì£|r}»Á‡66“ëÅ/Á«ïÎ/¯ßü4c•‡ÓYšfÁ«Ÿ/§*¸âÑËŸ.Þ]_¼û{Uðó%N¿ÿiš™àš.Þm¦Ï|yÎ=FÓß®¿?ys=P:ÐTåH槓_~‹& 8Ò÷'Qhòlòí(T0ýpt†±5Ò_ž\üs@Åsv«Ƹbuê`´}~;çaœ'£ÛE€/OÂ8VñЪðpËoã™)¥C£4P•Ø0VfVª'J…y£°”JÃ$דԦa®,Ië]ìí§3”»|uà6OC¥ˆsòi¢ÂÈæ¹a¯MØŒÎ.Ôäu”N6Äš<Ôq2Ñ* u>Êc'an3P=‡qš§Q™§z*€,5q@xî"ÍÂ4I&ªýýæ™ý2j½µÝ‡ªžÎldƒü÷³ßpsŽ¼\S«[µcoÇÓSMýeïw§: Zü(ƒUÏ­þ¾äÆ«ŸaúòŠ;—´¨ë¯æmµ"üphT&…Ú›i ÄW}&° fh• +ÞâV ®o§3 V;t%6mðDh×_ô‚';¢¼‚å’Gê’0Ò¼ú†G×Ð-ŠtöÖÄ>órÆ5‰;ýþ囯¯p‹Ë6 Ábn÷vÊà ÌÃ?oѱ×XÑÙÊÏU³î–OèNöUBÔ+I²PeUAè° +: $DTÁ£û9<¾« ¿Ýˆ(KQß»/ˆ·k” ÀÝâ7Baƒ"¬¹ÓõÕr9¬Qr<õaqj N-‰·Å)‘)_8c‚óÜ™‰‚_#e—eG=Ü"Dó =_Ê2TÕ¤ € /Ha‹¾jܘ0b4ªý#Í„ Ÿî³uמu÷E[žÍ׫îlÑmw6vkÑÉqª–ÄÌ{¶6QEÀ®mpÍ|%0S;ÈGÆšk‡I” Z a&L¶ž°"tÅbá8ðp3fY†ãAÿÅÑ-€·ÈRÅà9á/aåZþ’©ëž$@í¾š»æ `X,î@·®Ñ2ÊÓªïŽXòèÜã)ŸIè;æÄ:ÎP‡ÑÖ«ž¿¨)õBÀ x"pcýýA»s&Æ·{è°Ý; ¤Õ´û£û9»?¾Û½¿ÝªP³^‚'¶&Ì™™m# M0Ãñ¨*kb>ÌàÂyJBp¤‘PŽ|þ;Nž÷ßq&Z8-cfu¨Ò-ùÞºHd›%4 ÙÃÔ Ó@†$â‘uc>8wQ­z^ͦÉíªîúb¹,/°;7F˜¬{õ²Á“#4jp½ ¡Œõ›]ÉLç:hnñ«˜Zß~ `Ht±ã"5ÎïÓ;žQ\Áy£ÜøîúL<û×%¦Îf—Ü»-*¶^gAÑó%Òv=f`+ÿžf–‚N )<@Ѿd M•2Ì'ÏAS$S€Áícì:¸o­cÁ æJ8íeép´’Ùº‘am³¾»ç!"¾§‹rYrv{*3noöUUÝ—í ŸàxH'l,äˆúØÅ…LýL[a%w)À<’pj;¹A«±óqÊ\ÅxF[1 >q»÷vÞ¶c½¥Úr6ÂtHËPÇã˜=&|%ÅãNA‰ ‹Ð[3é…NPdŸqº8É̺çѵ“.–qˆˆDYÈš—§PH¬—ìíxœS¹pÄÅùŠMý«ì¡œñKŸ”#>Ž{S³©NvܹMR91÷ˆÌJ¦vƒ `"—$û²ìz:â¶(l`yŒ‘‚¼ ¶%ÇÁYÊsr<¤á¤ ¦9—ÐPµn§g0u¾x¨êªë[ªÆä‰fD\ÎP(ÿ ¥we·Ÿê…@2¸ïòTÝÁÊÀ7ÖÏ”PÐáÊ!%ö` ut?WBßK(»÷õœî9ÿ2$öo@ÛÚeîsöÏÝíz)ö‡0^I1$ ÆEŽaÜýÝ÷W˜D çj7úgT&N-‡xD]I ‚Ô=†?­¼l`çEÍÐCbÖ %þƒÐÀcÕÏïzÉþ”¯Su?–kb(@ ɤ§F<ÁÎ7hëOÜf´ ÅA:†3j´Ò;ÆT‚Á…w&IZ(‰${Ü®|ô²vå.$Å.—±Ú+<1Ýp`Ð*¸Ìùî=jLJë÷Ü}Õ@e9û¦>ýìÖ…ñª÷¶%ø9éSɯ‰"FšíÆ1¤ôÃYqNQl„Í¿»9j:¯e;î¥3TÓR:SûË8Cc×iÑâÃYÊ)¯rŒ#äõ½\S Ô‘£0Sî‚«]¡²ó9ׄu?v¹4•oÊ1›x¼…ݪ&¸+{¹%Ū3—³të›ÙœoºŠzAyÇ1YHf¡ä™xï-áù߈TAyxwúóoJ «PCR‚T©>ú²§­Ô›»fd÷XÄOJÚØ0‚½èyÈŒBàG†_AJÁ¡”’= ±#À>ìeK€€*ø^ðç®ì¹±Aožxçªl¶ŒzxÆÃùÛ¶yøæ˃âffê9ql€ŽˆC€žDZ 8v÷‡·ß†;Ѷ>B‹?Ýæ’äí¶ü²‘K?ò*s·%ƒ·{>ž./_KÂÞu y¿¹‹—EïÊœ˜rq®èÅçßûd3LÇrÎÕš¯StÌ9qŒï*øþnšS,üÔ7æWüòC#ÓÍ#ôŠ‚×ë²ñðË¢Ä(œ<þèƒ+ÎÒ%/e4j<© ^Û}H+¹tß’â«,È…¦ë÷±*aÅW„ ÑHu­“Ø=?·rÃŒCNpÔý+Ñܽ”ý]&}åÊB›¹ëVõrdµJÂ(ݾO=ˆà ºUÍÅÿBʬDž”‰ “,ùƒD±™îyhäŽ: +“$ùÓ$â œS-¦MÂêà‹¿]¢F úºŸ˜ âömÞ5Ýž™Hƒ€Š…4)‹6o+Ø~…{ ™'  &´ó™fÝußÌ(zZ‘’Þíã©j)|OG°K‰fd¨v<ÕÌ嚺Ý2§§ÜÒÝÈûxøÙ‡ÆÛ©šô­*†êG þ¬(HhwÉÕÊ›Yªåe ¯ÐV]߬°¾ÃžÛmð8‹>‹ÞØ Û¤HL÷G†!F4rÚ°”ìxSÍ |‚\näñÞõ!T‘ô`ßOÊo¤ø"‹llA)º–ä]§žëMåµiH•ZÎÎ`* ~„æþ^ 7‘ú* ë½|+êÄœÅjµ¬æSz~£JE;nt¶šÆT­tóV*•}uW‘mìŒþ“sC¿¬=ÉxIV5þË9øg5ùK?‚ê(3s òÅZ‡Z9Zè‡O:ߥ7£Œ3³Oðÿ@t²endstream +endobj +5390 0 obj << /Type /Page -/Contents 2314 0 R -/Resources 2312 0 R +/Contents 5391 0 R +/Resources 5389 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2311 0 R +/Parent 5398 0 R >> endobj -2315 0 obj << -/D [2313 0 R /XYZ 85.039 786.531 null] +5392 0 obj << +/D [5390 0 R /XYZ 85.039 781.388 null] >> endobj -226 0 obj << -/D [2313 0 R /XYZ 85.039 699.735 null] +5393 0 obj << +/D [5390 0 R /XYZ 156.947 730.534 null] >> endobj -2316 0 obj << -/D [2313 0 R /XYZ 85.039 678.741 null] +5394 0 obj << +/D [5390 0 R /XYZ 156.947 686.358 null] >> endobj -230 0 obj << -/D [2313 0 R /XYZ 85.039 552.962 null] +5395 0 obj << +/D [5390 0 R /XYZ 156.947 613.958 null] >> endobj -2317 0 obj << -/D [2313 0 R /XYZ 85.039 534.09 null] +5396 0 obj << +/D [5390 0 R /XYZ 156.947 376.847 null] >> endobj -234 0 obj << -/D [2313 0 R /XYZ 85.039 461.332 null] +1590 0 obj << +/D [5390 0 R /XYZ 85.039 243.395 null] >> endobj -2318 0 obj << -/D [2313 0 R /XYZ 85.039 416.785 null] +5397 0 obj << +/D [5390 0 R /XYZ 85.039 210.114 null] >> endobj -238 0 obj << -/D [2313 0 R /XYZ 85.039 289.831 null] +5389 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F73 3992 0 R /F11 2898 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2319 0 obj << -/D [2313 0 R /XYZ 85.039 260.427 null] +5401 0 obj << +/Length 3637 +/Filter /FlateDecode +>> +stream +xÚµZmoܸþî_±p D[de‰Ôëý¤¹;_‘œ;¸iPpWòZYÚHÚøÒ_ßy#¥Ý•Ú"ˆE‘Cr8œ—gF.ø.²Øt¾H³Ð×Y¶ØÜŸ‹-Œüp +ÅJHVš—7gß'Ñ" ü<È7·ã:±ÅzqS|ð^ýøâêæõ»åJkí…¹¿\¥iæ½zµ ½kî½zwùöæòíøAg轿ÂáŸß-3íÝ0ÑåÛqøÅ›—/øMûÁòãÍOg¯o§Žà*G6?Ÿ}ø, +8ÒOg¯ólñíÀaøþ øôãHË{}v}öw·E ž5'•Xg~œéS±„ñD,¡Î*^¤qàÇADr¹o»r¹R ‹~ÏÌ+7•©±'õÞ\¾yÍ­a #_áÈBƒ‡™'ÓÅA¨y˜?¸¬Ùíêj³Œ•g–«Ð*˜Ûb«¹Øìw½¯_š;V´j Ãý€ï=¼oºj7ð‡ˆR_ëLöøg‡Ï‘ŸÌ{¸ƒÍ€±;a÷®ìÊ[9YꙺoqµÅJ%©¯âx± +Q¢9-S—¦èáCí ­<ïJnìÌVZfƒÌmÚ}³T9œ§Ùr?¬™Gú!ìĬ^|1ÝEÝâ1· @ùOùˆ3_Eé dÞZå~†cÖb”6,Þâ}û7kÜ´®†¯3,‚÷NÂlÂ#ä‰ëÇWrÓ-ÚN]pOM>[äÞáùê=M"ÿÄÄ»‚î}cÖ¸PÉAÞNGÓµÙÏõ=TÓæÇ>íiku4O+Ó|ËVŸØÍšêÑf³–:nfM$Êò7E™³RlìÅèÍ×Ah.ðj+Qjî¢ëvû‘ˆÍ‚žµ…í_èRŠ»zžA÷\WÖŒyªŒáEá< +7ØaÙ}ÄÕvŽ;•)ÿd!©Y.vo÷¦3üiRYp?¹xŽŽ À¢¡³µ+– ždÇÃ2ÉÔØkh¨—9½l$ +­Ïñm˜ä ´/±¯eÿéò3¦©£ÈÏ“pŠËVb–225Ë at¤¿”¥ )¹Rå!ꊄPR ôa* Äö½èýPȘ;R‰íݤ«ä6\Ý5O>ßõC»ëϹ_Oj6£ÛeK´nEÂh‡)?ïÛÁp“ì¿cÅeïQöúÎ ô£DÃyŽDOxO!ú–û|jCë?÷›u “ýœÊå÷ +l½¨—:Eâ>‘®@!U•³I:áuCÏ#äðpVï|Hán"à +t¦ Ü,Ò=\w@û…î +î@sI)°kG°gGÎɹí0?a‘ +F7cèÆ©ñö¹»PŸ€îâWÜ9ïÐ1O´wÇÝ ¿cjS §•l†'ÀÝ(2Ÿðƒ ¼~LW~wsïâ¾JÝ=aûàžÀšŽ|1Ê ƒ +Bëq×äQ›¦$¼£8׫ïçðMäGá˜Ý„‘T"yp³Ùƒ¼çvÛ”ÄËs~¥62Þî ù¨Ô†M¡c=fïtøÔ¡ûŸdN¦èC¶øé€@ѧº—êŽÇûÀEî¦nIñ$oBˆ=¡`^µäÆTâ§Â…lßÏlZme¹B^)“^cÉ¡¬gd±‹ã‰ ÈeÛ<—P¨3ðªê@ª»`Å°Ç)GøóÔç_ÛõŠ­¢¥äa`韲'~”Z(Ëq+Šf÷qŸnœb ±·ßÜ1²ß×Kò¹B`\J!äÅï: TR›¡Öl¢¯´¸ðŽJùP wÌ-»`щS4+ápGáVÀóŒóâS‹&ι…®½t¡G¢Æ¯¨ìk™= $õ5/ ”óéÿ“Aãvüî»UÑ,èÄìÂ${:èLˆ:–èAçÉ %èœì7t¦û9g¦-˜‚h?m´ŒWpRÏGœ " Øs°w°¯’æ£Ö1µå%ðÚàaÎÄsH3kQÂzáOíú†pð§r‚®ì”‰Oß´\á±Ñ$§ô@'šü˜NÔÈMrné(5A¤$þfÌIH—RÂHm°–Iz +]ñÎÉ$aÀÑs²:K[–3÷–ÔÜV1T–…ËÀKqó-ØÜ;ÄÓãºDC5Ý!—€°üm(›¾¢øI 4üdÓ‡†Åç°YU”ÿqyPÙ0‰ÝÔSYþpïv˜9a“Þ•Á:´r#’”: ¼´cxëdïëÎf!öL?-'ØêÊ-ÁlS=—³Óù•!îýýAª*\ñÍ)‘xuŒÔ_gVméÌ]i+uBQ¬ J«§Ð„èq'd‰¾á„žÜPœÐÉ~sNhºŸ3ÖASY„V”ÛÚÁµÕ>WvCŠ#¬! ~°9$ÝÐŒ¦”IT†»mC1&’#‰$˜Ø&Sª©Ê ˜¸,¶˜§ã 8Ì £ÎKF'ÐqSW¥œp£Ö±ý ¡ã‚>} ’¨„Coo.ÔßûJa*’:y^$qÙh]šÞV"B[vÄ Ó¢§A™u-šžYãqÔÔd[VËBp›Žq+è:gy+_2$1üÖ•ŽÖ`{^®«]IA-ô¥ ¡ç?ò], +ðSNøä7¾ ©™‚Ñ?NÜ:Ñ9d¸!±æëâ§%ü¼Ç÷nO^4Á*/è@=¡õ9¤$¸Ïûªøõ ¢ƒâO‹yšε>b$–û ÍŒ‘XîÓØC.°ÝOÅ áÂmϨ¨wß*ÖB~ˆ4Û¦ÖÔ·sÙSÏ]ƒ]Ñ9ù²(…ÜPJ¢Õ”ÆåR4Wà 1ºí©àz¦‰Õ?r§K8 §ò1» +½œW +\Íh˜AKÃÂ@‘FE˜««¿J5Vî¥ÂZ™Á}OAAŸ@OF\IÙeš‰r‘&÷ì +†N í[ªÝÞÏÔeT7áêdå°¡/•»]q192€ÅA"Ô$5X}”SŽròm-ƒ•Ó©×¸Á”bûâ‹°=½|À¨i$ˆ´âŠ 66-uDjxÃSO¤N«¦X¯iª’þº6rc=÷~© 7ãˆXŸ!(yv59¡?sÁ/^§ &ì=“ØÞˆÖ Ý=5’IF™:ÜF9öûÍXf·©&9_ñ³<&’*bIÉ +e—å[~Žî5HFLkÙ$&8Ç=âÙ›f?§Ò#ªÒ— c¤¸ +qÿx™]1â x†¿1´ (ô.oyŠØ¿cÓëž v ÆâwöA¶„UºO3kšN˜#Ëi9w¦Ð±tðH²sn‚Už½.G ¤XlKO¦Õ`ñ  «åÈáü[w@ð~àV ‰V#¼+Ó„±,t'aäsäs }‡†WûiMÝ•¦- ?® ;Sy=ú¶?§Ö?OÁf8">ÐóÉ·'Øm(ÇÔsàfs„~L”¸øD^&>ü­X@Ôƒ\ï –âû‡¹xIè»Òìw3n¥ ž*,ƒGÚO4~ýìëãÚ¸0¤˜±·2üìÚY|þ¶|àñë7/¹A“Û®øŽ_? _w%7±ê7¥à·g}¹éÊáÙÇ™Õß•ãìæ»ÓqÆ3%òà ücé°y/¥©ÈoîwõÒ¡NlµgŽŠ›ñGS¯ÅY©½, Aƪ—e{û«=ôþÜ­NÏpx§ð¬åRßO.U$vÛåæ_—×*PéÌU\ˆ’ÂÏá +] ð©+…=-> ¸l<8¶ëvcê;ú„¯\èBñçSÿŸK¼ÁÈ€P.:„)sÕ»ÈÏB[Þ¬7FO6S‹ýÈ}h?D¨'‘ÓÀ(œ©£#hù‘”µp’KŒ M_ /°£‡ºû’ öV㡃ô/g¡ ìk g¬FRüYR2Å"×Tm@eÕAö ì©!ž³!Œ• sîç¼ –˜‚ —žÁA&×3-•aÌydP¨8N«ÚÁä÷88¿¥ _¨Æ¿·kJ ŸÉ¾%§iL,È éJ†·6¡ù¼·N?AÖ> endobj +5402 0 obj << +/D [5400 0 R /XYZ 85.039 781.388 null] +>> endobj +1594 0 obj << +/D [5400 0 R /XYZ 85.039 407.331 null] +>> endobj +5403 0 obj << +/D [5400 0 R /XYZ 85.039 386.076 null] >> endobj -2312 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F41 2104 0 R >> +5399 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R /F35 2880 0 R /F20 2865 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2322 0 obj << -/Length 2480 +5406 0 obj << +/Length 1921 /Filter /FlateDecode >> stream -xÚÕY[oÛÈ~÷¯ЇP‹ˆáp†·‡EáØI×ÛÄvcE‘æ’(‰/ -I­Wýõ=·!)›öèS8œË™3gÎõ›‘šyðOÍâÀõt2‹båê8ž­Ë o¶ƒ™¿\(¡€¿È •Á¹÷Ë‹wC¦<7ñ’ÙrK4ËÍWçê—Ëûå‡/ó…ÖÚ Ýù"Šbça®œËÏï/qÔ8ðõcç꯿gªë»Ï83_(ç–‡®în—_êîÓ'ËlyÇËÏ™]CïîóåÍíüÛòWa¡´˜„ea.‘sDŸàâÃrtž…Š]Oùx _¿y³ ú× ÏÕI<{„¶çª$™•&@¦ZúÅÅÃÅßz6GÉižx¥­LÔ[Ù˜?÷,­v¶).)ŽÍ\ñ¹Ý§~ŠqýHƒ¹C× ƒ)—P¡«Cp™ÞŒšp…y*zÊ×,¶Z Ѹó~6…´0Üä¿ÍƒÐI»ì­.‘óêÐskñÙh/ÃÄ´æïàeÐiHݸºÈµ†},?4 -P—ƒÓìŲ÷ж¾G14Þ#‡ë+WRÎ>Ÿ‹g«ÈW«2ÉÈ<‡Í‰Wć]79:&åàBçF:r ÒDµË6àFAj&ÖIÂÒÅ(ÝTöL”KÖØ ¼3ùÉ:÷.³šƒX`{ÌaH|~ðÇ–3V›6#>a¼÷giHaù¿yolŠï‚„ìŽ ?pϤóÊ*“ÃúarܱYÛh`üöúðCCa]‘åÆÎBÁ:ÉŠž­-+Í÷¶K1¸l5@¡Š*.šËf½üÐï¨Ùv«˜·òmîèt;<ý»z'¡„nâzkâ¤Ù5õñ€E=p~æO›–Ÿ[xS—)úÒ”iÛ¡ë–Uõ¬¡xlÏÖœ²–= èÅsI‘‡ # -HÎ_wèWõ*-¾ÁwAÉ{H\LŒól‘8•k“Œ°å¹X";LlüÂìÒZ;ìãß)üd¨ß‚@ñ«ØñÙ ùlcÍ4Ù.o;ÆWÃξ&ì’–RàŒï÷óO8¦Ö<È¡s¾ÖwþqsûÀ£‚6èy §""´ßŠ 6 iµÈJî§B2˜ª´Äpõ”ó@²¡\Úó[£ ™òümÖQTÝ ð}à1ô{„Ò41¿Á| Îý’ ö敤ú7<´­›5ù“‘ò ö'#(ÝYœΤMŒÖ¤s°Ë ->ï{T°g2Â7†9|(å?Ž’‡ G÷ k8 :7 äÂ¥ÉÎÍÉÄbT!åŠjZ‹2#†¨¨ï?¿¶|WûæÕsÄð}}aÕ5ן…Ž4ß*"_ðf$åõe\ ¤=¨j²|å:«Ú¼ËÙî¨*¨w7ÓÔÂl4¾GEzv€Í×X_† ÙaSªk߬&B—n£C&ÔMš<Î(P’½7Ãmia4}$yb·?Ê­÷d2`v¦ ¨n¸ä#Ï3TÅC¹,Ã(“Ð`%BÚHÔ™ÂÁ=zMƒ¢égážV”ÒÅj/–\T òÇ5Ã×1ÛÚ“bE*ÀÞƒÜcíÊÿ -¤8_üŽâEƒ£õبŒ=¬¹]VqsWÙšíÝŽòD¬9ègEõÓ§²Ó0Ò¨°©Ö’\ Û -NÞ@Ë™õwFÇ4M†"'vÙ#* ®—@Kë\̶E˜­#'—Õ¤´c+=NìÀÂÚî%ÄÐŽX¢ÒBºTYµnN„õ‡b‚!}«ô†GÄp!g¶é@r÷z1¸\Ù0’öå3êŸ< ÉR:pó÷ñ¬kr‚{9~¡&S~H†›r$ÞY‡ŒÄ›±ÁIi  `ÆåcV(j—|å‘“mÓžª5&0isྫEñè‡û|²=wRÙ;J -í”J)£sŸt+Ô…V>>eÅ–ÛÃ5L.Zé‘ÞaÆê]ù|h˜·OQ!ù‰òlqú‰»ÍøE ¬¨[r éý¤ÛP똮GXò†ž^v²ù^¤;ëROQ‹5-)þÐkxËxúôóòK„‚›]¿Z•ÊãkUÞ—*E*‡š}3.ô!ªÌdá-LP¨<9èË?]#^¸¼±º{¯‰î{n˜ÿâÍÃúÆý˾ÔË X•²ƒOcñ¹1óψë\›iŸ.Ó7-Ó²çb[==‚ï)×Ó1áõ÷jÍgx­Öƒ^>cû§–h]³HöØÇ{`r´áu,Ò¶~!9=Òr4üôÞl¡§_ß3®VêÌ[Á”°Å%ýFà=y˃\˜ æE!CE[sk[Ó[H*~ä¡&ƒhkȉè-O zÁø2Ú¿5€´Ç· $Ë·òíøûSÁHeÙg›öy>¢$+J¹åb/ ¾\ëÞ-r¬¤#¬@Ý„ÇõC›ÌØ¥«´íKA@x·uSÊû–O©¼•=EØn²tÃóör Xà-ϵãÝrY V ðœ@öMŸÏ±^å5Š ¤&ï¾Vnãs’‚[†ï¿ð«ïó¿ýˆc|7ÔA/ô«á¡“§’ -ÍYrù­vŠ"endstream +xÚÅXmoã6þž_¡¦WDjZ$E½x‘yÛÖ‹Ävc§{‡tÈ–’‘%¯$'Í¿ï G–eÇÎfs킘äpøpžáÌ67,øㆧ˜%}Ãõ8“žgLg{–q3¿ìñJ£]©´:Çã½ÎGÇ6¸Å|Ë7Æ·+Ål%qxmžüz4Ÿ]¶ÚRJ“û¬Õv]Ï<¹¶¸9"éð²×÷ú¿àÈ!7¯†8=¸lyÒ“R¯¿š>º8>¢‘dVëËøÓÞÙ¸¶´¶¬òÑ̯{×_,#JŸö,&}Ïx‚¾Å8LÏöÀN¦lY“½ÑÞo5ÍÙ­Úæ•¥F˜ùB½î9‡3Û‘µçÌræ+…žã\0É…á*‹)ËÖ®Lp-ðÅ϶R–y¹H·ã˜û­67§‹y„a1•É>N¸æNÄ (±sOÚQŽ£ Œ,3+"R,´Îš.´=Æ]ÿuR+MŠ«F8Ô¤„O" 5ÌÁ¸lL Iž[mÛöÌç–ðÌlAƒ')~–$)3jÑpnF•Ú}PFCß¼ËâFw4™¥gžg^%å}Õi?R;И`¦uJžãŒ[oy§…•5³,Ðcàˆ6Çã'bhq”ƒ“… N®ö•ŽBf€1ןxÒ3Ç÷­Æt9‡ž†tl“ô¾I†˜O¤F~)h…q…´à6Ë×V–5æ´Ð ‘ë$N ‰K{î‚1–k(JH}™Á16³Z*Å„t‘fZ)4ϳݮæ÷ '(ÉÐ’ˆ¢»`l1W'ËÊkQŠ,|af·ÔÔ$qŠîñ¥æm§šF‘Fy¯÷€^¯RL)`¿œœƒpiÕæ%ýaq{Éú&ÂœäQð@Ýy² ÄÔpÙ,jìF›Agé–8¸ò¨»™QËLpÐÎÊ’T>S¾³µ,Á~žÃîî„Ñ‹,€¡žÖv6PÚK›ÚʵW¢ÎaW¬&—9>XnCË=Mñs ¤àÒT›ôî%ÛjÅ™çs6¾ŸÛXiñ¯Ñ×$VÜ´ Ó› ã4s5‹ ·Ý¦ªã5«Žr˜o»†#SÂÑÿ§åÙºÂH ™' õꊂ]¤ttÊ@þcM*ij,C«€4„ôÆ@µæo+A…Så6@t}™4ƒ(:ˆ§Ù"¥Jó–ðÍ+ªq@¾¼º[ö„‡IŠ…€˜d³Y†]¡iGi…ÕéÔà9ý\Úÿªö—ÔÐÚŸŠhšGpË“pJíÁì!Œ+NŸ¥ø·ç|˜ë—Œr•‰`Ú<ßeÒk6vƒ¼S̳,é ¯;ålÞ‘‘ïMnE/̉jbvšNfóyH›(·¹IåEð‹àïƒ<"ø0áÝUèA˜?æ,ĬiìÐœ tGZÖ ô¥õ¯À/â­à$&hÏ~4»Oæ/€Qx@wú?C/c kZ~`­ÑÃù!¤‡;PqæX$œLƒ¢lÈ…ª"ÅáÀLJþôÖß0þ4›qzx ß(FmýMâ -Œ¯¯ÒøÏj8Šr ux=¢rŒ"Ásƒ//²?¾ÆW£›Áñ§³“ñMÿèâìædp~ÞõU΂‡:âóˆ*,ö!8£i™åÏ4DŸ“ë¶GSÖ ·qRA¼1Rƒbs‹Q[)XÊRxÌ£ñäS€Œ¯–kÛ ¦â·¶¦¸2¿w•i[at$lY½‹Þ›3e ×Jh£/a{¹Éœ`}=%,¸*¾EO½—]3Qwpkª y·\&6™IþÝÌ|®ÌîàV…b±•Ú&m¾An Çï¥å-÷5ZÂe–ï}ë–ÊçÓæ-µq¾íb‚ÂG¡ñþç8 ³§Êý1µzÎþk—ÅÖ~3‘»Í˜ïn¦xw5Ý¥Ÿ»ý«óóîæ6WöÑg­¶¿»’OgU9¬NöíõüûHlT¥mv­Ñ¬‰ìä1ÔëÊêÓƒµ—½Vút»H’ç¥NQI…léDQÿßwO¯o[t±ƒéÖßòìAÈõûc8<ý@“»ß>ßxB~ôÇ#vññ¢¹MCL,\ï=؃ã³áÈf§—¿¯ƒ¯äÕ»Êßûj«A~=nù+àß0ýôìãðr|)ÐÅMô¦üý轓Aÿ¼wÌNÏÏw¦í×Ь޷¯TùáèbÐ×  ‹kᇃ-þž‚êx V þö§ zmÇï­ÒŸٶüÚ +ÿdÑõkvý›­-™'wüd«ø‚/mAÉ7íUÒcÊ“/ þ 1G6øendstream endobj -2321 0 obj << +5405 0 obj << /Type /Page -/Contents 2322 0 R -/Resources 2320 0 R +/Contents 5406 0 R +/Resources 5404 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2311 0 R ->> endobj -2323 0 obj << -/D [2321 0 R /XYZ 85.039 781.388 null] ->> endobj -242 0 obj << -/D [2321 0 R /XYZ 85.039 437.555 null] +/Parent 5398 0 R >> endobj -2324 0 obj << -/D [2321 0 R /XYZ 85.039 414.237 null] +5407 0 obj << +/D [5405 0 R /XYZ 85.039 781.388 null] >> endobj -246 0 obj << -/D [2321 0 R /XYZ 85.039 277.233 null] +1598 0 obj << +/D [5405 0 R /XYZ 85.039 761.463 null] >> endobj -2325 0 obj << -/D [2321 0 R /XYZ 85.039 258.361 null] +5408 0 obj << +/D [5405 0 R /XYZ 85.039 741.134 null] >> endobj -2320 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F41 2104 0 R /F35 1632 0 R /F20 1617 0 R >> +5404 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R >> +/XObject << /Im2 4150 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2328 0 obj << -/Length 1614 +5411 0 obj << +/Length 2520 /Filter /FlateDecode >> stream -xÚ¥X[oÛ6~÷¯ÐÛä¢bHQÔ¥@¥K:´][,qQ]h[µËR*ÉÉŒaÿ}çBÅò¥^""y¿s?Žò$ü)/5BêÌKR%tšz³õHz  ü>RŽ#2Z˜(‚õ bÐSƒ82JNñ„‰ía$2I/&£‹—¡ôB)âX{“¯Ä9™ö1Œ‘þ­]•?µã@ljo[üƾÛ^^åßòf^#§-*Þâ&_Oaßfüeòzt=ÙÁuXä9œ:Y¨q*ã) ȳ!Îɲ@L‘öû/b‹B¿©7‹%/›ÀÌs¦w5ÛÁw@éŠjÁœ›;þ¢ÖaÊj«À%yýPtNì -YHHƒ&¸mêÆøÓ«q˜Á+3ÛuÅ—í,ÕvhÐ$Pà ‘œÇ*ab}ÞÍŸÆ©†gYòÍŒG» :RëÈ·î $›ÛžÞ-ý+`­Ë’MJæ]0A3c}×aœÔUËÇÉ:ôÉú¬©òŸ¡¶/õ*˜U¥!Dm&¤Ñ„ºÉm¹3†ÆΟOï?܈7×7/®oÞߊ›ëË?Þ‡@›Ï6MÑm÷n^^Ý9£ŒXójÖlï:f¹³mûP7óvïâ6oížaƒØåØí+Ð7Ì”?³¤qλS!¡T`bõ ¦ ïþ’*Zl`ß8îzã([´WM$>°‹’ð枲ǑÎ{· D‹¤@J9F_ÀIè#+€CiOñ$ãP@’K=RÛĵu"…LBUˆ mè8RµïÌêû1—¯BqŠ3åAè3'7Dhq\ˆw¡]ï²æ@pdDªz¾S(¥D–í;Ïö^Ü÷hÖa€Å*o¦X„c8HW‰y¨D*cLÄo£Ï_¤7‡”}=’Bg©÷k)T–yë‘6™0YìöåèvôçPŽ‚r¢Ró]9tK‚^õìûr tAÐYAS4¥! -¨ŽÚ•†w5Ç£søR5‚®¼oH‹ÐpD¬ éî\¼Z+ïªHÞ<„×µ)¤úcÅJOW¬ˆ*VK¬ãô}RÕÝ^V9ôv&ê‡-…óô#r¹g -fZ‰qAx[ WŽP—ó¾Í4|2+‹¼êZÜ((teÉÇØ ¶ÑA±˜~T&%t*Ê5\ö µ’ÜýÄ9\äbóxT=M„Ñ}J¸"6Ö˜ÈÔòžã{ÚÚö ²g¹ \Òß~Š/Nwò-&´ë耤èÉ•ˆê·EKÔ¼$m9»U’‚®{Ù½´Ø’›5Z?ÙÙÓÄ´î›>Üòq_Ïhƒ#~—ö>ç\Àö?³%ï ZÞ8ày^`[!!Kw×DùÐqS¥ýW§êüß(ìι–3R9)–MÄ›œöq ©ïÝQ“CPE“ÏùÛ]]1NÜ“¶iϳ¥¥jì:5! :‡W–y¿âYèø"︛NwØ»®W,–ˆ•â­++Í%‘šm_V»|Ѿ€ühÒPHL 81"JôÏÕŸ‹œÊ/à{?UƒÁ¨“fÑÙáL‰ÄÄÿ7œ…?2œ]äÝìbÕLÍùù |•žÿ¹ E›óóÙ»ºËŸA8Gf—)8;íøpWöx6ãÚ…²¢)Ú0ágŽOVwu ö©‹œç‡Òímå$–øØ´Ÿà0¯ÛΖ%=Ʀ> ÐI?®)‹µ-yFâ‹°A ýðÐ$Ùœš£DĺoÞ{¶?0œ1t}µ+ÚÓ}>‹¦q}>"ÖÏ4S¶_H0ÃÊÏG–Æi”QçÍìhüε–)3Ìæk:Ž°5˜Å·¿œOg—wÑRÊ°1yžo¼}˜-ãž¡Ó»«Éìjò3ÎlZÆ×o2fŒt5Y/Ÿß¼9ç™æðÓìýÑ嬕´•¤ +PÌß>~21¨ôþÈ*ðÏ06…Ë‹#S8¶Òóìèþèß-)^³¼kŸUå ÇW»fQNÇ,–TÂs½ç˜Â1m²ËrU×iþy8r¤cÌÓ,áÑøkXŽ«eQdãhµ¬Æõb9VIà?Îe fxt-¬øû›¥ìWÛ§ù¼¨“è¿Ò21^èuÓ1¥’¾ðyþåq\̎ͤíh¿g“ÃF*€¸5üš”ág-Ú^:¸y´gwŸz« +Ô{ +Ë„Õ‹ËXTãó‹w·“Ù½¸ywÓ§à + +(ׇØÒMºzçŽnÎ~Õ\Û „û£T»}s9½·ÅÅÝúuÛÆ!åÇrÇqŽç|›ã|Û´…úÁÚýr=}U»Eô•m ç;h¹ùºïœ¿¢ÜÅå»éÝìN®óiW¹]Ê9+pDð”“ÎsÝÕÛÛÉõÕqq}ݧÜ +9Nª`W·þœ; ›úQI7½¿¹Òl …s¥”»éf{ßXK|Ë÷wâzC-é ÎÜ}·ÊóV­¨X,Â<>ãY¹Œ¢,Mòš§Y…ÙSQééh¢¿'eQÔ¯’¨Lê Œø{Æ1[„çÇÒ<.žµ1laÃ)juÏÀÊ•–?îž,gÝJu¶}æœM®¯Ïºéκt˜´[/œÝØ }ºMû´Kö´Ýxºy› :‡Æi7SO;‘}|Âîéêξ1›êŸ:Œ^7'Á¿ÕbÛFÚã… £þe³mû=Þ8ýSfÛµZC§Lóº1ÒEÇ`]áR­¢(©ªù*Ë^œª³,‰E#!¥KðƒÒÅ‚^µc Ê­«ì uÚlª’:>¨M¢ƒjÁí°ú&º{üv¿cD ØG«.øÛÇ‘Ì>~guû×´­¶;ÙP¯•G<¯æX:lãe(}£XQ£C6zFñ…§QV@nXFbù¶qŠÐ Ýa'YÆDâ´Š±À¥¯øJ†$ÖÈPm„К!K€„ħz"wD‰yí·ã¢²\£F*a^Í“2ÑëH8Oò¨|A*u‚Tbí8Ö¾kçŽxˆÉ@õS‚e<§e‚:š kCàG²IB²…(mþœ, +n2Ù°ÁÖ[SÌygk[œdkÅ¿0dUY?5$µ·i›äb8r¥eÌž’DV—-ÊŠh… d›]´®šLMtð Jo#šdT¶ E 3‰XFuQ¦Mšb5²ƒÚPÆ s]±¬ä¯¾Ëã0kËEˆ‰ûÂ`üA‰Lê%z+©nÛ\ðq‰û JÔ?}b ‚ÒßYQ)xγ"Œ÷d8µ×üƒÍî¼,< ù fIz~M m!„ÅÄy£Vâ4Ÿïa¨6vÇàäž!b[Í^4m$úD“®f­55C¨z‰èy +’®/|çà«Ö…¢N¢©âP®ZR(K¤ãÁñG&±Q 2X(¼ÄCý£†~„úåB<Á…:Æ +e~ìÍq„2_‘m³§4Â)è’·­Ј!>”O@‡Ë%çEžÄÿÂ(dÆô `c€àM¬SÜÅÕ¯GVè3´9›Áo¦eÃŽÆñâ …D QÌ™‡)(~øh‹È§£=A¯8›¶+w£¾éBEØÿF×àŒ:H{ )áB“Ó ‘›w" +úDa©Ãìånp…v àºÜ aÅ~Hzë2"»/¥°PµGôfjI×øš†Œs…øS·•Æm-ù}Õ&O½Ëo»>À²vjFĆªC›*r$ŒéÑöb½'ÓplT £ØujË8ºý‚©4–T0¹tµJÿ£Ïý–ôexëý5N¿ó5Ê&û|ˆ—výAVÚóVd*«ã kmöæÔ¦¶Å‚³¸(C²vý¸H"µ>±:m#Ÿb£Ì.~3½¸ºã9½bT¼%nÂC ÓÃôén°ñ¶­LOX>èO! %/Q‘Ï÷Ü" |JhÞÌæÙÄêw§ë +õŠ7”Î$d¦z}ÙϨqå>'[> xžD5:Çä„ÄA[=±ÇÀ+*5¯Õ…þj¿ãø>Ô,£¡À “ò„‹³ô,8á)[bÀ'@zC@êMÈ}!p¸!i1øµ¡í€dºà{ãåœüÁ—¥UìöÇÌ©ÞÛv.å1»˜™.ˆ£Ð×6(Ö®M_Gqã5)j|¸±]~#¢†Üöý«P¤)Ѥ\éYqÛ覞¿iŸHá‘1(ôÓ,¥ëè oF¤”˜2Ò’®8!Û#“Áè üÑåúj¥s¾âb‘'½OWe²(Ȭ>m~˜CWû&_|}ð€¼!Oùõ”çá˜?|†Óරløl쯘3ô²ØÈz­áÍÉ·ËjÙ¹fSÒ;&nLç=÷&e +ìKøa­ÿ¯_ü·w/[ _ûÎÁ_Y,Ô3*¹-oó;ÿ0Å endstream +endobj +5410 0 obj << /Type /Page -/Contents 2328 0 R -/Resources 2326 0 R +/Contents 5411 0 R +/Resources 5409 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2311 0 R +/Parent 5398 0 R >> endobj -2329 0 obj << -/D [2327 0 R /XYZ 85.039 781.388 null] +5412 0 obj << +/D [5410 0 R /XYZ 85.039 781.388 null] >> endobj -250 0 obj << -/D [2327 0 R /XYZ 85.039 761.463 null] +1602 0 obj << +/D [5410 0 R /XYZ 85.039 268.85 null] >> endobj -2330 0 obj << -/D [2327 0 R /XYZ 85.039 671.062 null] +5413 0 obj << +/D [5410 0 R /XYZ 85.039 248.26 null] >> endobj -254 0 obj << -/D [2327 0 R /XYZ 85.039 627.524 null] +5414 0 obj << +/D [5410 0 R /XYZ 85.039 220.497 null] >> endobj -2331 0 obj << -/D [2327 0 R /XYZ 85.039 595.999 null] +5415 0 obj << +/D [5410 0 R /XYZ 85.039 191.278 null] >> endobj -258 0 obj << -/D [2327 0 R /XYZ 85.039 236.956 null] +5416 0 obj << +/D [5410 0 R /XYZ 85.039 177.122 null] >> endobj -2332 0 obj << -/D [2327 0 R /XYZ 85.039 210.81 null] +5417 0 obj << +/D [5410 0 R /XYZ 85.039 137.081 null] >> endobj -2326 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R /F70 2201 0 R /F18 2207 0 R >> -/XObject << /Im1 2193 0 R >> +5418 0 obj << +/D [5410 0 R /XYZ 85.039 109.982 null] +>> endobj +5409 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2335 0 obj << -/Length 2615 +5421 0 obj << +/Length 2757 /Filter /FlateDecode >> stream -xÚÍYKsã6¾ûW¨\•Zªjó¾rZídY;ÉØsØJr %ÚbF"=$5*ï¯ßþº’’hOïaËU&€n4º¯€¼‰KÞ$ •¤“8ñT$“ÅæÄ<åûÏp¸­Ü(éÝÝÉÙw‘?ñ\•ºéäîYî–¿8çÿœÿtwùa: ‚À‰Õtljs;õœùõ»9Fµ3¿Å×wl÷âV¸/ˆëÇëùÕt¯/¯iàÝtæ9—Ôø0ýí˻:3­t@ŸÏ'¿üæN–¤ò'® -Òd²£¶«¼4lNt¨P¦¿>¹=ù¹“"4=‘Y#VÏ´)?F#T‰Ÿ|}¹ LU˜F£Ë‘Òqªí¿(†'¹$FZ†{_JHG4‰"¥^w1<•†áð4n*Ú¹[˜m_¨b1hòyâ)W§i ÔA›õì'ñÀÙÕÆ›\T¤Ñ¤W*H•O«{J"¿SËKF@r·šB£Y…Ngë šÚÙ@Ñ-‘4Z¼ŸÎüD˜µ³}z¢nŒ®çÔĹ@#³S W5%–ZÚÏSš]m¥³+Öki=æƒ%Nϳ’D”•éÿêzº\Jûýϱ{Ø2²;L6ÉÜFÚؘF"§­xŸ*¡?Røi…§ÍÑ3Z‰o‚sè›è¿ä›G¢xmW¹iØ°§‡8°¤~A'cÈË…!|7âìf´ÅQRÔbˆW_ ac…—Û6g•Ô‹ñASb ƒ7yÑÿ4>ÏH?×ï½Ò GàßaJ»“­› --˜O‚ƒyÙlMÖnhöÎкü9’MJé,ÈL>] ÿÂhª# UËÍ­ðVŸ¶O"£*…ЮìòÚ¹‚ŸŒâKœ{-Õ0vfÝ.ôŽPB‰Û)ëqÞ¡÷çJZsÁ_õwø‚O–“? "ÕaxÛ¬—V!{¾:ÓlníRjÐ{ŽqœOXÿIæ³Ôì©—ïÂÁ9`0/ÈŒæ] áY«üØoʼ½‡ST$Bû©Sf›\ZØM³Ù£0ðžø.Î¥QسBýIcÝöS{U5m/jG*¡•ð.UÒ\V›¬(¥µm¶À¶¬ò%‡­jù­|-pFbغÍk>¶è·Ûù,ÎÛ×7pk{lÔ.­ý6Øáþ4IÀCµ^W]4Ö÷S²ðùXr_“¬7&#˜»7Õ½†³)ò.Ð ¯•áŸ1àJXµÜ¥=xëv~ì÷žö®þÂ>Ä9°aFñ¸³! Åë–€Ó° ºŸ} ãƒ&*ñ<%Îòvq†o„u/”D®òýÔpæ%¯X?Ë›ì ¨Fôg§ üT¥z‡,ªü4îœÚ§<”Á§—äÔÐW|÷¼ŒïYPØ2(Z3؈+ÛgÀ2ž‘P¯„¿ßRê,+lûßZ™Au¥ “‹!;Ë´¼Ü×íÀ¦f&8±Hà'“þéZ"Â"3 ]䨫Ú©;^­¾G -¬­2+iþŽfQäKsC0™l«)°›œ¡ˆ› Ö¢QjiÌƧTú~êà G5{™ç:ÍöI¢Âymç•òm8ºÉ”źȇ²eKÑ(ÑîHQR˜0 -mõ'BÄaÖŽbª4ÃÉ,¥ª^sq(¤úÑ•¾%_Þ!_ZHljŠ}p؇AîÛhCVa¼!õP?¨­lRµy‚7¶·B_ s®zxÚU!•üî_¶0£Ëå¡qžŠbïÏgj¼–+>c¢ž1¨ëlÕr¸p¨Ô‹ß` ;S9}ÖÏ[V?Šö°UæT,›Ìdkâ½ pà¨4ò’ƒR¨è”³±Ô4þ€bnå¼5È$»”w§¬4ZìŠRˆô´Õ1ªÉÝ E tí’O¦Æ™râ±›åM3b›«€B8툠’ß+PÇt‘³*[.“ˆDp¬¶å±³ÙE}§¯)E¸ -‡¯1c'8çÚM\#Ñ}Õ&¥šîÊEÍ÷ÇÌpïêÂøzÏ2r iš0fگ͙˜s+• ‡OV‡ ’@•RHyT„Óݨè*–E[!Ec…^§+þ ©6uxËÛqN«Ù»¿)¼Xy žN"~ê4u(™:¿sjBköQ¾ó冮…ˆÞ¤Ö7OYÓìªzùâaQÀ¥šóU ‘7êxCGïŒ!Ïñ¤Ð¥¢#@ÐÄ÷k"Ò0huw·SjÔñ 5‰—0æÃpŒ!T:F(z„«Ó9Væ×]BrÃowK¹žþqJ¥Qóæ3ìùU€C pD;= -¾TÞ…/„«X%qúµpu›I@ÀÛ‚ïKtØ6¨‡ü`ðºá^îU‰6u·5ÔÃD ¯ã»¹-ï1ÙÌyTÝå@_Ù0éÈéï‡J‰P~D¥MT²7¶¸'ë—’—#yWi“TD4^t%y›!“¯å.Rö ц/TÆ;I H­ï÷›Ã/ÖÐçÞtøõt)": ¹ -Þ%™³ÎGÜñH9cçÈÛÅÌ‹É!\ªZtª"Oÿep²WgâÕh=±·Ð^£ -ÇÀƒõt¶É\Œá2T¾ë½LhìþÁ ßÜýnZnqøþ‡£ÝM„Úöò -ú¶á­å¬T*βh…öñ–U™YRö -ü½c¹™_ƒå.çÿºæÃà›»™ÈT{×7>d/ö‰}iÈä³mú+•À•©ú‰º’”BAÁÖÀ¦oø‡™ÙðÕa6‚¤ÎÉŠÒ>¶UÇ÷_ «!¼%#(K]Eõ1¡ŒdÉ«!›N7ð¿–öµIûwÓ”NŠ÷*Âý ñpkpÕðë«m·Tà¼)ë¯ã/M™|Ë^&ð²î“,Ç£…üÐÑbeËŠÖ’ËNl?ŒHPÄš$h”VùõÛÇ)JÅO[. sôÌôô|}R$üS£Ô +i²Q’*aÒt4YžÈÑ Ìür¢}‘£)\é×)L–Žî -…‚éå ð)ld|qryòïn+ž‹F¼jH*֤¦æ¡X”í‰E)-ŒÒ£ÄJaeDr¹ë4(7p wcn5ÖYÐàˆ š’gnòq¨x0 +ÏMA4œ¯Ç!ì’W<½YÁÄ4¯êÆ­¦XÝ<…%ƒÂoPÔ¼ƒó›—´žÿN=I·»'jª{?ãYst ÕÄFÎË{¯Ç öÝ~6ïñ½@x¡BÙf$‹»¹Ã½cÉ Æ +8+€vuã势Ÿ¥•Í„s¿ÀOUÝ) X3Ïl·,ëVŒ0…RK˜º\ÑÂSÝ ¿x>ÆëÑ-¾’Ÿn`pž“‚/¹ÕÉÚ—n‰Ë®iýËÖthÅ»V5#»Ú¬¸Qú/įaÃï3ó²n@êî}úÚôAfE¢“QKE§ý0­†Wجk7ÖËkî‡oø [_»:¯n?41ß.Ø¿åïº*VM^­Ü2? t±ID”Ø£¤GCš¢aV‰ÌÚ¾¦Ä„¦Sº ¸%Èæ€+ƒ7åØHPyšß*Ÿ”7«âÏœ»ˆŸ7;`7&år½È›|ʳ5nPÆhLòºžmP‡î¨•ÐÒ¿ã–æ°5ˆ¥™a+ù;Z:6=k÷¨µ +¬Q-ùuÃT;{ê˜Îc2·¸C€9üsO2@XÎ[%™àÔWži%ã !ÔAcÓ(ÐxÜÂïÐB!?¤äÚ¶¦AÔ»V„DJ: +_GêÏREù -€WŒíd@$«ÎÆùó\MúF©MØÑ*ÇÊAŠBf£X"ß›%«PÓ]»öJeü‚Óî&¯yÒ-ËÕMÝøµ=U$»Ó¬éï³}p´j-ÒT ¢£¥ {DðÐVÄQÜíD* œg"ÄÅÑã˜äÁi;ðR&fwN»`=‡WÉLð²B‘Þr7bùÎÊ&[|ú=®4¼ŽŒû\w¾F˜ÈºÞÐouœ{m•ˆä®¬´’–y­žÖÿ!ÕFsF„ÝÒ=_±XÇdW‚uYÐݦb@ÍPZÈ«lík”*òJ³å“ÊlQªƒÐ4úc3ÝO?1‚‘i©wü¡@¼Ÿ_ê~¼`tºŠ´t^4ù„¨U• ¦ÀAFà +Ró·DG è‰H¬!x츂{§ C°wZA¥ÁÛ¶ýþ2¡cÕçé;È{g^[ þvOT„@xÛGxß»^A`h{´‘G ìRVÜo­¶?œG›²@ ±ê³ÿž¾}…èÓŒ>ö@2ñ ²^ål±á¿8 +B•Š8µ€pKt„žÙ4Ax츄{§ ƒ°wÚåfçéÐOnü¡g³;äè'l|Z“™\‘¢æŒ~ÄæÅ_xž‚øN·ÖÔ/£8–|üüñeèÑC ‰~­d]Íóº ãhÈ—Á(m_^;ŒG‰gÇ.n玭³†¡.î¢)Ük›ÎÆ!9ç'·®8üF?Ž \Ó_ŒÚLœÍxj›ùÄü(ýmû ôq[&S¿ö¡zëëÊôÖQC;l³ \;¼¢ÈÏ ÒÜÍ RPB:ùUÁÂÓ>°ÔÁºƒ=¶\•EiùQé0ïbô@ ¡®§›4Å6ÃÐ]N¡ œC8‘„ŒT`§võvJt½|BÇù"£9O,ñnwø>‹ÒMQc1%„±í+å²€| +Ïj»$p¿_ ú&§–·”'nè¹)5èóë17wS¿¥Z^wÙáÒ€ÔæMd8…s 6 F¦~^:W1ÎÓˆcÊ8x“W9Ó:Žb«|Zl!Þ”sÁx9ão‡#™î|<ÛÁŽ#Y@M¾Xs«—Ï'œºÅýŸ~'Xãñ]ܼhjž,V7®ò¦*ëÞÕzPA:`v#H– ¤ù ŽÏ‚½ËâAׇœH)äám|´ô-O½ç@;3o©xë@½“ñ%"΀s 6.Òtùó’EŽÏôà¢Ln¬Y㞣o#¨¢,3LÓkÿÛkÑÀéÙR^–Àéh‡YÞ7ìmÌ>)ÝÑÞXdQ22T퉉Ù3Ć²\ºÀï’_KuqMååK:ð­©^¢ ¥AmºçAR*wCÆ™^Lx,)â|Óƒ@UQo~u¹úÑ“ ¾©¦ (—‡^8T‹è›V2«™·ð8¨V›®¹BD™S"©Äƒµ¢œ2q^¨Êg%òBŠk©–åÉkñê¦õ.0€I:Ùâeç7¦<3¨÷+tT‘ÒÁˆ”aMÂÆ4Ÿ9J4îÃN‘û^ŸÏBñ3¿+0j/öæm± —ÎÞs{M*¯}qˆ­NÌÈ¡.û¬Ú½r„ît +…Nnqº F¶ñ•ânB³›j< ÐQ¢ÀÕg£žîü}MDeWY2 +qYö}Æ -tá”–(ÅGË :ƒd=I—ztš ¹_é1¾Ò³-Ý(vý`ƒ öù »ø„jn4ë~\¼Ä΋Æ"±Ç‹T=šÃ§"ò±bW¼ÐiLÜêG¶`:M!Djx˜°‹ ïÉýŸLýºÖ7 Æ=E¹\b—÷,ù[m8üÄvé¿Ž?T“„|÷âå‹rk‡g×ì) «¿vNgŠ*ÀåÊv•jµ‘c$Ž%kª=••§žT~­w¹\ã.Ü‚§ÝÂ7È„lœßßÝ8VSo5ÝӘ܎u‰7p³#%œü.œí—ž¹æ :ÙÅÅXöqíµI[?Ke|qÈ+0ð BŒ"\a´A%rªà¶µ¢§QM/J‡áÛ±³O9€ÃØ£þ¾Bî{þ¾üííó³óóço_}†\ÿW%ÞäHívO +TŠ/ñ—€ópn¯†þ…"öžj[¡R½#{LαÞð HÅQF;PÕŸ’‰¯õÂÕþéŸ!N"F°øYÕÍ` +ÖvlVù·MÑåS$ÆÞtâz¡áÿ³A{#Ž• õ°|Æÿâ€YT¬¯ÎŽšÅÍaƒž% Í}ƒ6è¯åØ`Jg`zîðS5˜Ì ÍJ££ï»~4î€F$5Ù0­ÖB«–*³Ïoûãò†ÿË&tÎendstream +endobj +5420 0 obj << /Type /Page -/Contents 2335 0 R -/Resources 2333 0 R +/Contents 5421 0 R +/Resources 5419 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2311 0 R -/Annots [ 2337 0 R 2338 0 R 2339 0 R 2340 0 R ] ->> endobj -2337 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [489.95 435.981 512.306 447.67] -/Subtype /Link -/A << /S /GoTo /D (ads-test-smbclient) >> +/Parent 5398 0 R >> endobj -2338 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 422.432 183.828 434.121] -/Subtype /Link -/A << /S /GoTo /D (ads-test-smbclient) >> +5422 0 obj << +/D [5420 0 R /XYZ 85.039 781.388 null] >> endobj -2339 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [214.276 422.432 356.796 434.121] -/Subtype /Link -/A << /S /GoTo /D (ads-create-machine-account) >> +1606 0 obj << +/D [5420 0 R /XYZ 85.039 637.475 null] >> endobj -2340 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [380.57 422.432 476.48 434.121] -/Subtype /Link -/A << /S /GoTo /D (ads-test-server) >> +5423 0 obj << +/D [5420 0 R /XYZ 85.039 614.157 null] >> endobj -2336 0 obj << -/D [2334 0 R /XYZ 85.039 781.388 null] +5424 0 obj << +/D [5420 0 R /XYZ 85.039 584.309 null] >> endobj -262 0 obj << -/D [2334 0 R /XYZ 85.039 393.439 null] +5425 0 obj << +/D [5420 0 R /XYZ 85.039 556.605 null] >> endobj -2341 0 obj << -/D [2334 0 R /XYZ 85.039 364.035 null] +5426 0 obj << +/D [5420 0 R /XYZ 85.039 529.507 null] >> endobj -266 0 obj << -/D [2334 0 R /XYZ 85.039 274.847 null] +1610 0 obj << +/D [5420 0 R /XYZ 85.039 298.378 null] >> endobj -2342 0 obj << -/D [2334 0 R /XYZ 85.039 253.854 null] +5427 0 obj << +/D [5420 0 R /XYZ 85.039 279.71 null] >> endobj -270 0 obj << -/D [2334 0 R /XYZ 85.039 135.198 null] +1614 0 obj << +/D [5420 0 R /XYZ 85.039 109.129 null] >> endobj -2343 0 obj << -/D [2334 0 R /XYZ 85.039 103.673 null] +5428 0 obj << +/D [5420 0 R /XYZ 85.039 88.538 null] >> endobj -2333 0 obj << -/Font << /F62 1689 0 R /F70 2201 0 R /F18 2207 0 R /F15 1628 0 R /F35 1632 0 R /F20 1617 0 R >> -/XObject << /Im1 2193 0 R >> +5419 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2347 0 obj << -/Length 1224 +5431 0 obj << +/Length 3698 /Filter /FlateDecode >> stream -xÚ½WKoÛF¾ëWðÖUQnöÉÇ)°-§M;m¤¢(Òh‰’K¤JRqõï;³³”)‹¶‹-tàìÌî<¿™]É@ÀO‰åB§AœH®“$˜oG"XäÇ‘ô;D`¸ˆ,Š.g£7ï"HÁS‘³¥Û2[|fW?]ü<»þ4µÖ,æã0Ž6Kvqsy\Ã.¦øU¬[N¦´{»>Þ\¼¿¥åÍõ 0.Ç¡d×@|™}]Ïz›H£?Ž>Á\þ0\§Ið´à2MƒíÈXÍ­Ñ~½MG¿µÌtj êÐHË5ÄjÁ“Ä×v ü%8o4Ëèó[Q‚ë‹j¬öÐ Ï0%„ j¾)òE-ínë6fx(ÇÀ½`ßätâ{L›wFöLËÔr¥½ý²¤'ÎyŠv4Nqýíæõ€>•tºTYn¬í4­³:‡ -›Ø°ßljfÕžÜmÐÂb¨ö Ÿ¸wãMR ȯV+ç‹—Î^*+¸:%V&u¦Šv Ç£ˆÝ“ߨ,¦Õ¨ -‰†v< ]³]ƒC.‡*êå4_¸¢¬ˆÝÒi$ïKGc©ˆ‘ÑgìÌÅÔ< ´ªµRìý’L¶lÑÐö%n/6~åDÎnI{Ñݽ§ï7ègã+í4ó1FQ¶ w)'¹˜ ÜkÙÁ9³§Å*÷2Z;E‰Wt4`Ù²ªýïžqä&ÞRp“Š -æÓZxë w}õzÅ’$>JÉæHT®B½\Cpxè°ëJ‡¬jIg'ØâÓð -O^^…øÁîŸØ~¬‹ÿíÓAê„ËÔÆ\$ñP«˜«!óTëc +®MÔoá˜[(/d›ÍÆ)¤¥i±H%Ä ¡ž=t£ÙÂà¨%ö3æ´lÏ<ìì+'éK*Ém¤ÿÁŒÑIWÿšVÓl‹ë»Œ–§%E^ -óÜ;xº¢}›jUx}ÄJ™×³ËªgÔUõ¿ôcßÞƒããTÀ5¹Ce–æ&\Y‰³CÛ'S¡®œvlR¨â¯nxêèTiô‚ìoüî›}¶ùè;ìT/ovÔ ó®üË º6BÚÁöžè -§F[T%yJ¹µÌu÷ÚÏÈ¥g s®jèbÌöý¡‚1]ÓeŽ¬Jþ, ˜ÐÉ«=¢^ë‘È÷È­ëõ¦Ä3Å‹pÍö¸¯#5s%Ü÷†&2)©™SŽ,@Æb[”ßµXžôìn!w°¥ï¦ËpÖxNume›{“+ò¤(›6Û €  -‹ŽÒywM‘Âv¨Þ82¬.Vë±J;”çåœÐ²8"T~:L1RÔêówry*À¤‚gÅâq¢Ó þ®%¡0ßâŠærÏÝvìv?­µ´ WV»š zF½ü"Ó÷˜~ÍólŽ3Ì#Ô…×õŸº³_@’v”IOýP\¨èðcƒ~d»³D@—©T~»ê5Ú¹Ï^)„•>Eí1Ø1Ü3ɽÛ†p7¹ú ü‘‘9½èƒ­¿sƒÝ°÷9Q€½ò‡æ¯ÎÄ‚:Åu ‘ÝmTôZ¹‰@/¯fà}!nt  ³QÉá?GÞÙoû7X‰´=Fþb¶:ëÃî¡ßsðoÉË(Ýendstream -endobj -2346 0 obj << +xÚ¥ZYsÛF~ׯ`éÅPUc.ΓbçPj-s%¹²[I ”“M€Òjýö13Hrm*s0ÓstO_÷HL"øOLRF*›$©UšNæë³hò#?Ÿ K1µ$ÓÍwgoŠõDDae“»e·Ž µQ“»ÅïÁû_.gw?Þ\L•RÈ‹i’¤Áûϳ ÜrïìæêúîêúgüÒÐ)‚Ï3þts‘ªàŽ‰®®»áË?\ò— +£‹?ï~=ûñΟԟN•á1¿žýþg4YK¿žE¡ÊÒÉ3´£PÀðú έì÷êìöìŸ~)Óž5&G1Î2iNK.¡Ž•—œ„QfÆ ä„¡r’˜(4‘&ÑÁš ZàW›1QpUÓæ«4Êê„'AûXpcv¡DP7íí|[nZîû°-ŸŠ-·ëŠsþy‹¬Jø¦Ãºí1Iê4Ivš·Ž†x¦§ž7™qðv¹lÝÆp8™é`¾Û@Oƒ=ùZ‹f}!“àGU0Çþz½Y¹Ym±ø؈Dðr!Ó Þm™p±EŽž°¯¿zÉkË̸ͶØäÛbÁcKè¨-]ûÈ á|U.Ô6v°æß;h÷¢Aæ¿ðVÃÊ(JÐT z0ÇneebžÜ›†?-øa‚5~ìš–‡6°dâ8Á²Þ®™ Ï‚(ªõ\¡ljç•m”•;-é ÷µüûTæÜ8ŸÑJf&¼©Þ  n±' ÚsT@!‚ŸÐ"ñ õš·ÏG8ý¶\Ô¸ÖsÆÚÉò;¶çû­?xS0 ±C¬ÏÐa½Ä[´ùœµ!g’†%Â×¼ý~_sÆÅiÊDª®£™öˆXwûMÈ4Œ“د„üý‰ä`G¥C¡NoÈ$‡û lEe¡IÍ`¿º§•)ÒO‘ˆþE]=~W‰ ©_¹«ŽèÄ]Y¢×îêÔ†î®ö÷½«Þ~ä}X 픜yØ9 +ÓÊ©®j®‚ Mbëp>‹$~áïûë®hÚ²®ŽKÏ@°HÌ+ÒëˆNHϽ&½S:éíï7*½Þ~KïZ2Ñ9Lh“ €©WäZ¸s^[™ý§®­u ïÄÑȺ/æ툵°2£­\QdE?G³Â0³›8Lýð #kª0KcKñ¾®ªâÂàöãëáÞQÿ™há<0zp§}Îqt»þ$Àv¾feÀ–Çüp?0Ú°P²BÊ^Û±üàH"äÍDªXÓ¯QéHW‘&gqH¥îgþæÅàÂnW +Þ¹¤Ánr»Æ®H‘'¡ãö–®ö–Þl ±&ØS¯‚ù4À¯Î;eißЯQèŠRçIW5]â…‘x Të”pñÚ]åùlp¬æÜ^˜¤’A¸\Ö¨n‹bûŽ±ñ'8¼‰"¸>´ÿ.¾7Ø-‚ÍsdÅp${.1ªc‹Zñ}3qÎ#U¾vꃽÖpXøˆ¤H +`LÜ}< +×9¢¯Ž–¬Ï’{”]~[lˆÊ `qä•Ðd Wp"©¢lK‰[Bo§p_ÎXŒ¿Phv lø÷œ¹¬½®Î÷}šR"L#1‰#äé7d Š‚óXÎ0ukM{‹z?¥@½íwDÞ¥ˆ Ÿ¸¶¬!Řâ™1—móXoÎÙ&AN-™Ð›.Φ°œw"ˆ¬è‚¤„HË!.-"v¤Uø›“ëàvÓ9!îp»Yt^BhïOì +¡âÞsÛûu™I\~£ ßš/É,s¼RB¤'#ýb]Îùqè3B‹!ø—YÆA§TÅ3“nz°µËÚÉ…5Ü=¼ +a_›Tšê(q‘WGàî…ÊX‡&s[UL¡Á[‘7¡úž9Ò±µ0—6#¦7bII¨¥[ÊÚÈö…ùè±D2ÃÆ‚®eã±™Í#pÐÀ`‚dˆ Yä40¹ÀÕVùýÊ¡PP-u¸‹†ž¹ a£Œêô¬ ‚ÉâQ»£+Maëøè:4+‚u¸åÈ÷ì×£%•éÊÛo"ùzÆ0hÀåÅGÃëš}•ÉU&×'G1±:ù:Çž\1M¯M tŒQÇÛ«µ˜|¨á¤“ÁayÝioav6i_M ¡)™hà(Ñ’ évãólò/À0úD”'fè‡V/Ø‚œ¯X•9ú ×Á¦ˆwKøßOB_»Ýrëi n@¿á?ëñB#¶ùˆ9Eb$¨†©}‹kçsîìPd’2”¡Æì5ao‰”þÂï¢î0VS½±½Î¨¤ Û†=j¿]ªu ¥àírôŠm=í³ÂÖ°Î[tuJ§à¢pq²dîXÏzò\êÄÁ¶jÅ=ôPz Äœ7@Ã♢Âú-ÃiVayžf7'ª‚–^XvL‡õ%>Gÿ¬M4ÄYú +{R`ƒÀ._Y=À¾~y¡Gêp(¶}±Wu¼£˜¿Ø?›}àFm·oÑ1QÇÒvt¢><õåÂ…Ž© ft¶fQAª¼¬·LE!~÷ÁaÛ`ˆ…î;ÀH”,j¸>þæÔ-÷ñ¦q¤³t c*þuç6ØÙò×vŒ½i3¦æÆìitxMŽzkç.c·Tvöçë÷v{ñÙN¡" qÑ­ªº +Œ÷ݾoÓ‰€&›ôüåßp¿èãEÙ]ÿÿ˜Ð÷å*L³.k@îIœL”IB`ŸqðZ΃°±Ú´â7ÿ€ÿo0°7ØñscË-\MA·0{û®jóâïÀ LH¦Z…1d\‹ô‡¡–=`‡>7lJÜ»PUð—Ž©…ì O8¬EDìpÁÆâ§/>´Í0ÕlÈ·T±°N›*ÉHqs5ãÅ–»Ê´h0u…¶Cê‚°ýºn-$°|AsrNÚ¥˜[þ:gÈÆ¢Á9öš.Û+ Ó±Ô¶ÊT0YÎ}N >¬Jò˜Š‹X) u¿lk·|æh…‹Â»UM†#‚¯èéÊ­Ûޮȥš§rU<ðEø3ÀJëzOعEŠCx„ZƒÈžý³åÒÎäZgÆ0ÞÖÃ#S \`ƒÀH0ß·eî.+7¿;\»%pP\Ùj$+²ûÊòªù˜¢ƒ‚ ),2åü„Ü×Pmp—ºuµ~Û€æGÔEJ€n0ˆ¼Ô$F+¤Á¼êôcEæøCŒ„#§&Û{ˆ‰íCÌåS].,¤æªLg Äc ¿^{Œ¹-ÚØlúO3OüñžãQÅYÕ†5x_¥O3ÜÑ‘àeÌUÌ[FýÚmý?èÝÆ9_îŠ;˜ŠÝï\Ø•®ÐƒÍÜ5ïB6PÀ$èv¿*Ö4fCðǺ±«üUßÛ‡ˆäþ(œç¦‚ý[±ZÙý›zí*0wAšü¦1Õ¾)‚è!±&.4_­èî«ÆrŽùC(¡]¼M|e )èdõ½/>®îvˆŠütPp¶oLˆÌä_¡ÃR®a<ÇYÙËøŸOÄ/¦xøõ°_k§“§ôdê$qÈ»çFƒ +Bƒk[æ6©§[Õ€¢]iG~–+x6],6E¾˜6¾E'ÁÒÖÇ a /<Ÿ°6Þõp±ÁŸÄivp™ âyÞùãÈ{ì¼Ey¿Œ°¸-;±ðÑOˈüð·è*¢÷Ìñ™±h}ùøÅz€H¢¤ •·]Í‚rÉ”]̆ºá•…–„ßh¤xæÆa?¼ð´OU8#H ¿aM*ü«hïYð»Ãtƒ“È^ ¿öîzÅS9GA&þ‘/¹ª[nœÂÓ¢Ê;%·Ù…‰Òžkî¸Të£iNFÞûå$ìø£1Ø<íêÑû὞6©"aƒš´¯,RÇ›˜É#¹ì³@@ª.z£YíÆ:±Þb[¦; )]=9s„TY)íó$w1Øi-ç wn¶ìi{úŽ0zGÏ®Enãci»{w¬²"¤ µ§_…zDÇ_…Ñ+¯B'7´¯Bû½ +õ÷»|âÇi„>1—üÁ@¹šÜ¬æäb¯C°Xqø„˜.´÷¹éP,Ý!!üdoh]þ×¾C-Ñm`ãvƒp§ðÿ,Æd MÿÈ:¸Â:¸É1.bé êÁS[QKR¸ 1öGc/Yaâߥ>mÚrŒÓ±!_:þ(„d»Þ¶ù}¹*]bú2r|¬-¥Â¶ž­T‘°¸írQwH\éWòœ5°Q,çT3¨W^ï;šãÊki^ÑÝS»YÕÝßlLs{›}pˆƒþN…ÒÉã—Cþ©œ¾ÌòòCipU- +V7B‚‹¢šÓ×;ןŽ]ž‰÷uhXvïF#±§ƒ{ÇËbÈRÕ7Ïjq*ÂTêÂÿþ‘lsÌbL(“¬÷jµRß Wzzå)¡:¢]‰¥zåï :šãÚei^Ñ®S»YíÚßlL»z›ÝØ7Õ5C»jÑÏU ?)£OøŒ¿ª¾»H’`»s¥Ì˜;^¬Ÿ£žŸ°§®lôy¬PRæ·àœ Ðý`hª³8¸Î}ñ©¿ðv7؆ü­ñçVIÜAûž°î^0ù²ù“š,‘Ù»¼ÀbŽów5WcGÞãU˜%.ŒàßP,+Cá†?ù%ùOòÆί $¿Î¬¿±Äq#ÊAÍ>ï@–”pc]äb3À¹gcâȽÆ Õ9îÊvoÆŽ•…Jöÿô`XCO7UÊÑì:šØËù[qéSV̾Ց·S7 …; ½œ*½^ƒåÅTø? Xendstream +endobj +5430 0 obj << /Type /Page -/Contents 2347 0 R -/Resources 2345 0 R +/Contents 5431 0 R +/Resources 5429 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2311 0 R +/Parent 5398 0 R >> endobj -2348 0 obj << -/D [2346 0 R /XYZ 85.039 781.388 null] +5432 0 obj << +/D [5430 0 R /XYZ 85.039 781.388 null] >> endobj -274 0 obj << -/D [2346 0 R /XYZ 85.039 693.417 null] +1618 0 obj << +/D [5430 0 R /XYZ 85.039 761.463 null] >> endobj -2344 0 obj << -/D [2346 0 R /XYZ 85.039 661.892 null] +5433 0 obj << +/D [5430 0 R /XYZ 85.039 741.134 null] >> endobj -278 0 obj << -/D [2346 0 R /XYZ 85.039 607.594 null] +1622 0 obj << +/D [5430 0 R /XYZ 85.039 255.079 null] >> endobj -2349 0 obj << -/D [2346 0 R /XYZ 85.039 578.859 null] +5434 0 obj << +/D [5430 0 R /XYZ 85.039 234.489 null] >> endobj -2345 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F41 2104 0 R /F20 1617 0 R >> +5429 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2352 0 obj << -/Length 2458 +5437 0 obj << +/Length 3335 /Filter /FlateDecode >> stream -xÚÍYIoÜF¾ûWfÒ4‹UÜø Gv`ÏX ,ÍA&‡R7Õ͘‹@²£èßÏÛŠ‹šmɘˠ¬åUÕ[¿÷ªZðSgiä:;KRåë4=ÛT/‚³ÌüôB …‰´í…ɵ›]Ç¡˜d‰&Lü0ÑgëÐøY@o®_¼zgaàDZ>»¾%Êëío^ê¯ÖQxW¶Z)ïÆ®Ö:N<Ûá7ö¤{y½Z+ÏðX³Ò×òÄçÕážÙ"UƒûØ¢^ý~ýÎ`&b:«Êé V^Þ"Á‹·×£d3¶ã%Áp;ík úŠÔ*ñ3­§R+ãkÏ¥V(·É¼Ä3‰QÔ;‘¾fy.qîšÇ.š -…¢ñ{Ç%=6ööyX¥ÚóiÈ0µá{‹'îp÷8q¢ !1žÝ¢æ`DñœÓ³òŽðA©Ìˆ!e"?p¦Ý ɧŸ8ZÔR´<æ:ȇ×Oå£Ä‹ø«ý,‰yêôQeQ‹¹@$F ãõûqì·]ÙÜ ÑÊßy’µ¿!—CþYÔÜò÷k>Ǿ ÒgùT’9Ÿ'"óê4ó5iu´W›Û­JOO:6m—ƒBÑ÷‰ó•I©à ¯ñcØ“p®^`hé—ù_è±Z{4ÎÄg4*/?ÂÒ’YAF„¯K„Ïw‡{Òhûe×’»ÝñÑG¾YÖ¤Ñ)_ˆuò|_1Èà˜†ö2¾€¿a_€IqTÄu¡nø{Ê. ±2‰Ñ{´Eƒ¦! ïfVÈþª9¨Ðⶅtø«É4P3òtÀ 9ìH¡‡¬mÒ¹¬´­4þ@é‹šRðÎ_H¿"¸ö‚[L°z¶¤Ài¸··8ù§;>CÌAûYm…Ùþ¸þx1a"î”~«;åõ¦}¸Ôu§sÝ=º3™bÛ=>ÀÕœô®( Ÿò.öÑÇôã* ðC(‡˜ü!ï Ua9²ÕÀpÞr﶑ƈ=@iY:GC—·ÎwÄqíÁ Ìãêl?††£\ Ë€ºàdfyGÁeËñ¾—Ó¶[n ‰ÚlœSž¾}szâ²(PZFT®Ù7ûÂíœÑ‰“Pà½e×lùØ× ¾šðÿjB•úD&HƒÒ®#àldpE†ay?ŠkBåâ F”›†ö©zm ×ûÜÕ-&KS°AN„;JN•m„¢f±M ˜rÍÉ8êðÊd±GNڰǶMY’c#Þ–À”Xma÷¾@½–rDßç2‚ÄdÛÞàþ€Tv#‘lÒŒ‡_p Ô6Ñ2&}:– hp¬çÚî9i¦§%"¶x/à»”ÝIA©–cÂQô”¸Ã÷K"ƒ(ò˜ÍbcÇ ++e«†.˜'Wtw^óå™Pcj‡=ð 9ÏKHj‡}ár :¥âê´k¸ µŒµ‹+ËÞ„#¼â*€€.F<¦,zWQ‚B!òÒìR*ëMy•»×9/q‹í²èz^Ò+£ØO áh!2â˜;Ìü:½uèÏH×rb†:^ -)Ø ²“Ôxó•ò‰[Ü¢ "aÇÕ~!H„—2&N8ˆxØ©\ùF©ó“úvÖ{lßó TÎ=®¬6\; E¿’;m6¹ÁfK¸:ÿÈ-go,W[rÁ ò)øâ#+Ðà}Šú×{Ùø|;ËÚ¡[»^¨i("/¶ ™HÓAaį54P6;Ò'4g/H4˜ &ÂŒF;AÛÊ6¢®æà‚ï÷ ˆ\”âÈÞ:V$ °=8õ†s g¬–àîXX¾:üY ¨ŒµdhRBËÐ$|ÏÄ›dƒ íÇÈéæÔ¬“>Ê0&TLÂtCH[È—8=8П²::”¼taì R”¥ì‘Ù¨dƒˆ&vùú.¸öˆÏ|{ü¯8˜¿€Ì*ˆý$tÐÜ,>bj_ïÝÓí_Ò_/¹ƒºÄ/áe%óýôöüŸ_.½í«îñsÖ]2›>4sNZ(_m)ïVå&÷dÎ6ƒZöÊÙ:Ÿ¼•?TFcÚ0~¤Í·>'@.C0J) íf  úÞ *+ -¹³î­Õ…?›¸gº¡f€ìPºDéÿÁ…ÿ:øŠñgÿnýÑ*_«'ù3úHdúa˜ÌevßÿaMpendstream -endobj -2351 0 obj << +xÚ­ZmoÛFþî_!”*–äò5w(à:i“žãèl½CÛ´HID(R%©¸þ÷7oK®,ŠNp¹;»3;;/Ï íÎøsgq`;*™E±k«8ž­vÎl3?]¸B±’…AóÃýÅw?†þÌuìÄIf÷ëaŸÀö5»Ï~³®Þ].ïßÞÎJ)ËMìù"Šbëê—åܵîxtyûþæþýÍOøæàký²Äé·óXY÷Lôþf˜¾üðÃ%¿)Û™ÿqÿóÅÛû^Ò^*A1ÿ¼øíg–Á‘~¾pl•Ä³Gxvl¦w §øJÞË‹»‹õ[ñœ?ãUcZ Tl±:U‹jqUTÁ, +;p|ÒËrîÅVÝvw«¦ØÙ:>曦øŒ3yó»¸ÏÏ溞­\o©ÐN‚`T$M³0ˆX$ó¦\/¶Ã(ìwB‘~wÜè„£òmWM3d’S~£*0ø]mëù‚´#[°¥ÐXšáÉ!ÒûyYÍô”Ͼryài?ú‘q¤®@®õz¾ÐzS?VøZºIÓ i=+myÍ]½îÖ´ߊª«y~Ù°„÷Êîè8^€u"]7Æ׆+ØÄõ¬n‹’¹ÊÊòuŠ¢—ÝÈ1^âÃA}Ô#[BÞÒ¹öeº’*/²žø÷Mþ¹Æãáà§b¢-Ä¡H å¬Q Ÿr`ù_u‡Ç\ñ+èOÐÁHË#Od¢|q¬ž,Å‘'¨ò<ã'ÔÒ¯pv›V›œÇ‹Žà ÷'“Ú±6¤+’š%°q¤ì{¾ ’¬>ˆ“¤ú·,ÉKèw™áùȪò) +“ÐVN4í@ÑyÒD/8Ð$Cq ~cdò»«wyWìH‘xg^`Ü™ç[«´’Ôÿ–¼à¼Ã¹^bûž¶–%Ä&Üâ¬+ö¨òÀ±®ÉªÍ!¥[Ö#ùç¼³?/¡cÙ¼Ò÷Á,H(…v[µ9 ^¯YÔ}CWXæ;9Q×<º x ã»7"Bb»¡8“¢Àìr ÊKïéî~b'‘+«Ô »¢áu[MJ9V™v93ao1Ó-ùù'xÞ‚fiÞˆü0µ×^„+öÂmÓ +­ºn9±®é…#NÉCŠ$­û;vn H|ƒäjaLöcêM2Î;Ò#Š‘¿èZöYß‚›mN»VO3áYLó’cMpÓ~õŒÙ¨[ Ìî$Êš…çØVäÚÿ3B .z$98˜ Â݈«)ô:åi1˜Ü\ƒFA;ˆ¬wä4`‹m¢9ãt* + ë|1, +f +!9û‰šÄ iÓƒYßV~¨ó ™€çÚ¨Ì炱,Àج÷UÛ¥˜KŽêp– œ+ Án!3ÂQœ&E„ïH8ò9oxèÇ¢DÃ…»´:@˜»”—`|hQ“Õ†,ÞKˆìD1mö@~±Â%E^uú’ÄŽÂi”`‘›L«Æ :¯MD¸ñœj&Ù‰j¦¹‰jLnTW ‚g ÅÑPC'?BŸƒ1ÈVs(x; ŸYÆ¡Žá%LŒ# ¸’ÀóÆêJ¥Ø6Ó>ëÀ°Ê¥¸›çR±èòDE1ï!ûiššaQßk{ØÃ)`¶n0‡ ÍŸ¿ØØ þÒÅD+Dx`ÿìÅN±Ó;ÉM_¬Áíÿr±mÞeØY¢µG® “­,§B;Pìm¦|û¼©©ŠÚð5L üeµŽœE+Qõ(‹Aà Ãp[Óvª}¸¾†J°£HŒè…£9@’eäšåž‚ìj4w¾:Hwè%•&ŸöyâîQáM>=J¶ªØº®Ùà°ƒÜ~BŽ?¡/fú‚¿a¶É±"Ìø¥ÕiéaAǨwphIîÏï ¦ëë:‚¯ó°Ûãþx±y3V{Džźrývd×ÈvïÙž ÖœÀv<÷HAƒÕŒqS‘É·jtõüX©¢÷Ží@uá†_­ÏŽý—öôežå ö„úŠh‘}à ÀIvH7Úš¼@Œ'wTæá“H® ž²ýPïó=œ ¢þØvžo®N±«ºBWÞŒì§<»oM~?†ÙÁÌûÏioÿêoò€yH% [k[—Y¶4`L+G_&iý-H4Ä}(ø$‰Ùlç–Ÿ€0@(!”sc%²ùGJÇ8/òŽZ0Æ0qY×Í.í +ÄŠ8¦9õFˆ~õ!ŒõÒ}ë¦îæ$Â;\5H5Zz#‡¾ð$.8AYØÀù´ìó{šQî:µÔü¯‚€Š,iŠz*Ùá!+ú-V]=zmòŽúdåx0zÖdž„`°þlÌ:·>5CoÚæO™òU¡Õ=”‡R¤/Ć$&RbM‰æ:è2°È™ªW.<Ӷ؄a ãy¶›£Pü^ë%w<ñë½1§„ÁÈÒ \~ÍÁ¡¨ UïiºŸŠ÷fógá{º”$¼QQù‰îHƒŒ•RZ—wyãEË¿%a¾/xMex]“o˜@¢•:ªÎ\ß·UJQPôÅüõïºÆ +#0¶‡!†ørš|ý;”›§à]X“a }b(þMÚ¥_CUWëbó5+Þååþkè¯ûHù¡®Š®þ‚“ã'ø²cºáP÷Oû‰£žd²;ì s ‡¯%9l -µèíh£„³Œqk—•ÑÁÊwºåÙ÷Áû ¡hŸ/u;Æ–#.~ 4+ÝÃü¸CI]–ö¨ë»Æì+¾ºùåúú•=rtBr1õ\U¢¤!MP·L|.î;ž­òþ«AâIôÖ¥á#Q†óÐS¾—Z%øÏîä¬1䢹½"´Å°SƒÖx­«²¸c¥ºG½—O"ŸK>ë*-ù}oȃe0 >rÒêés#Ï2ÖM\ù¯‰O’7pŠKxÐÇMùas±8Šö)I‹QÒ?ñKßoCfª#I€œúG…VV*ÛbH‹cüï*NZ¼ý˜Œ/'óšÜø:X¼hó¡m>V<˜òOˆ]MðÂO¨ôÂ)³+‹#þóFˆ%Là߶býß8=ÔÃÏŽí¢gg&êøŸþ¬Çྲcu‚¸> endobj -2355 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [230.917 454.294 282.431 467.195] -/Subtype/Link/A<> +/Parent 5448 0 R >> endobj -2356 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [203.74 413.646 268.218 426.548] -/Subtype/Link/A<> +5438 0 obj << +/D [5436 0 R /XYZ 85.039 781.388 null] >> endobj -2357 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [289.289 373.301 378.732 385.294] -/Subtype/Link/A<> +1626 0 obj << +/D [5436 0 R /XYZ 85.039 636.493 null] >> endobj -2358 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [250.286 345.9 339.521 358.802] -/Subtype/Link/A<> +5439 0 obj << +/D [5436 0 R /XYZ 85.039 588.965 null] >> endobj -2359 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [285.619 61.367 316.703 74.268] -/Subtype/Link/A<> +5440 0 obj << +/D [5436 0 R /XYZ 85.039 548.915 null] >> endobj -2353 0 obj << -/D [2351 0 R /XYZ 85.039 781.388 null] +5441 0 obj << +/D [5436 0 R /XYZ 85.039 519.09 null] >> endobj -282 0 obj << -/D [2351 0 R /XYZ 85.039 761.463 null] +5442 0 obj << +/D [5436 0 R /XYZ 85.039 505.541 null] >> endobj -2278 0 obj << -/D [2351 0 R /XYZ 85.039 646.155 null] +5443 0 obj << +/D [5436 0 R /XYZ 85.039 491.991 null] >> endobj -286 0 obj << -/D [2351 0 R /XYZ 85.039 646.155 null] +1630 0 obj << +/D [5436 0 R /XYZ 85.039 368.071 null] >> endobj -2354 0 obj << -/D [2351 0 R /XYZ 85.039 614.63 null] +5444 0 obj << +/D [5436 0 R /XYZ 85.039 344.753 null] >> endobj -2350 0 obj << -/Font << /F20 1617 0 R /F65 2099 0 R /F35 1632 0 R /F15 1628 0 R /F56 1642 0 R >> +5435 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F20 2865 0 R /F56 2890 0 R /F76 5447 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2363 0 obj << -/Length 3269 +5451 0 obj << +/Length 3169 /Filter /FlateDecode >> stream -xÚ¥ZëoÛÈÿî¿BýTˆhîrù*p(’8wõ]í¤±.pw(‘–ØJ¢BRqÜ¿¾óÚ%)Rîã Zîwfgg~ó Õ̇j–„ž¤³8Q^$³Õaå‡ %þÌx~âÒ»‡‹«ï#=S¾—úéìá‰Hò_æïÿòöÓÇϗ‹ æ‰w¹ˆãd~©æooß½ÅY3{¿z.w†©?~æ‰G ¾¹\¨ùþ‰W®?ÂÔíÛ›;~¼ýp Ïïä >_þöðã҇ž  ã™(@I¿\üò›?Ëá0?^ø^&³gûžJÓÙî„š@ž·÷s»ðš™ñ[úXzhaø^’§N(æaS6 ¾燺º\èx¾Â þO+ÑüpšªÜ ]»)xº)¦†Å¯—:™ËÓTÚpžW»¬Üóø¹l7Õ^kùy“áë_aYÍ×¼µ}e9ÐæY[œˆ°ËV— ò(Ê} -Ÿ-äŒ …zJémìèH-ßU¶¢­IŒ=²—ùjÏ¿ÌŸ®ßó` ÊC>UNäšísØNpeÕê4ácT»PóÄšU]ˆ’qªÝÔ$ÍzcŸ™NSwÌ¥-x=£MWÕÑŠ“‰¯îß as+„h*Û¯e_$¯«¶wïÕö ×{TÏH­!ï¹.[´“@¡ZA¨2僄Ï<ù«ú5+ -h‡»Áœb²“»£9w-p¨”î&YCGzƃVuŽ¦s¼Z&IɈáá>Û!Õ2ãGz¯¨Ù>…¾ä½+áÈ?¿úÊlÙ€üÁ%–Î XˆMFG‘'<[Y«¶ª_˜Ö¾óL&§d³“•f‡“KXu‡Ëy…éXñ-¢]lóÎc' 0-daÁSèEUMf¸ÑV„úîêû F{ulê«mµÊ¶WpÌevu¨Ë¯àxWM±ª‹¶ñÚ|É;ÀÉØòƒØ Ž‡s;=òëœç³=Û+Ž+¼´ç½]Zâã ñÍŠü±jí‹D‡Õ ‹u‘å*{+b,Ñ^Ënãª3ûšgp5D0Šæ7íYœAæÆâþé€ñEV*KÁ| €XçaàbKo°Ñn™ž±vu¬KÂM–È pðBÞâÊDÃl-îļۘ˜ÕEDg\øèŒ åBŸ®å‚¬V„0¦ç* «Œ‰Ÿ€öØ·<$´ÌLlv“щézyêl9‡(΂ì÷¤²l ÌƒÇ áje5mVƒ˜$µú©ù CÆN˜ñLž±†ª=«Ì¤¾¨ ×EË3Íâ^xò‰\Ž)ɲ·ežβ]Ëf‹Ãe‡ÿk„ |Õ™šDÂsVæb)IA éÚK¶‹?œæ‹ ñTù€ -!S -ƒ©¤AÇžŽ$ñ¥\Ê aÍx‰ú)Câit“Î7xÅQöš.ûÓ"çý!&€h“±8¾þóâÞT°åÇ3V¨úb8\¨×Bñù‡Wí,ÓïúB¹Lø„yâ{qð«çy½á-Ÿ7E]ðð~hª%®6G ’6¡ÚR‡ÌMÛLk®;£bq#vÃ95e%%•kpiÎ̾»Ð/vS1IÆdR9gb wbCÑk¥pà‚Ð ’c¸&ɬºa"“=-;Bî~¾ƒ:6°4”ú³æßGÊòþK4Ÿ&’D©½±ê`ØÁ l¢6elü´uy î$ñ¼KÞÜf‰âIl¯ã4$+ ©d ã{‘IþW£}äZlYÚ´8Q.xèÒ£‘­ÆÚ3ÚªkŽxZóÊy¦\8ÂÙˆ+<í¬!ÁœýÍX˜ T!mˆVØ0Õ{†¹ÝRrÈ úV¬·-5_¹–,îç»›¿ó舛ä6aÞwiðºÌňypδˆ„ H®{™¢þѾà‡{ÀWZT ‡œö~½ #©›Úl-+\P ÓPÃt†¹å•ÉD -¸xÇ¢ˆê=²<ö{˜ª•«NátaŠ“±Ž=VQÌY^´ÅÔ¹œz>uÌz‘‚±ÅgqÍ=SÙöŽA^z´ZQ’Æ]xïó'X|Ï”½ŽÌÞ -ºe2Jtà·øÆ}ž–-Š™ÙÎŒ;4§9Ò¬ÌÄu¨ÈT4d§œ³H’3)¥´0M*ÂЪ …³0Ò,ö39xì…FÜbÀÅ"˜î­ãÃê6çO%aåºÈ~oÅ‘|s (ǦW¥u±e÷æ$ë.5¶é…Ž#–”uMpú D bQLëÔ±òâøDy²y.M -b#¬ôì{Xd$q/ñ‡­Ø¤E˜,Ïy0.-Û L5ÓM+Ê°X€ ¡7ƒ~]\‘®¬í‰Sg 휔 -$qQwqöã“м(ÅMlg«½x>á\‘J+Xb3C®V²÷°/2>å§kv%„4Å®ÁÖïŽr#Q:u')8wx±)yûnèR ] -ÝaD½l®¨k¨Qq©™`÷Ÿ͸Rj¦¸æÅY[Ò ¢Vz1Ô'¼SSë–jÂBB:hFd»J¤·¿ÿŒÜæ6YïsCØH÷JÒw f)}† ‰3Û<ÙsOÂÁ3®V.‡-^V§P¦nöq̉JËXËxpÉö_}Þm[ÉçÚº±ì¨¨ŒÕXC€¼YÓ6¶jÐW ].4Ü»vFäÇ’úPCU–¯$¯€õç­¨RôÙ%p5ãGü|TºÖhÅ.ñ$J`º»Ú¾¸,VÙ±YÊV„«Dˆ£ð“¯/c—n¶ÆÖç1ÌCe´´\“œ½æµ ö8í -JJ«×<Âø>zþŒ<ÿÄ)”¯(§êÊ‘‘½BG °Õw"ðm -¦¶XD#… À‚6Á@ExÁŪ•-+)®ik˜ÀèŽ_ŒÔüê}9‚9Ò5Cýl¥wë`¨ëáL)¿À†M†î;«_ú…|zš +£ÂYnÆÇ΃ÞL&¹­Î -AÆ\úìèþv‰‘tl劫BúP²%]õ[ªd´î3lcµ5½%m0²^ÏVßî¥äÄÖÀI{kÓ¬3\Ò} ä“µ‘@ ¾ñ€I@†Fž(ig+ 5¾$Ûša|P‹ù¯ä®¶£‡;qðòm錟Ï|rÛ’&pª¯—3Ç,̨å3äÍÊ‚,‰ÖHS‡NGºÿA/~T›€ Y­HÞ6sà½2/ö‹©æJ‰÷Ô«êmZŸøœ¡ñ7×]§8»Ú¹óÆO¤€¤gôIÏèAœÎïo®ßðˆ¥‚mI‘¶`‰îž×ü=ö0ÚU Þ‘ÃèËSùX[‰síÊYî°¶U¢/Ñéþ L½0&ÿF¸Ã~ÊDg·¡—|؆GDžìB¨ŸE‘—¦ÝWÄ° ¼ͱ«¨ï*ŽQü›È`4µf_fÊóMš¼Ú“œÝK4qu³S³ë -$šuB©§»2žŠzÚLú·ÇÕFâì“B[ü ¹-¾µ}ŠÄ~½ðÛÀ_w…má ­”ì‚° ZoÝÈâmc Vµ¡—…÷vëŽñ£Šå„¹ì²uö¯îOúú4‘çC:h©_é·Li䯾ÇoÔœCjjr°—ét‹§a¿Ç2ň\‘ïNá„pÈg;:Y¤ÁËó¿?ÓuÅ8ª­S#$ßÜ_‘Ãä}f±ƒƒýiÛUû^¨ôTësŠÛÈsp©€?:%‰þ]þ¶@—ÆÖïÂýmÏÿîkY -©Ò™¿›êŒèwü9’Ñ^4´Èó­7cFêgšöÿ Â@)endstream -endobj -2362 0 obj << +xÚ¥ZmoÛÈþî_a(LÜåkP´ð9Î%A⸶ܴ¸Üš¢-Ö©©SŒþùÎÛ.I›JŠA¢åîìp_fžyfÿ؃?þqºžNãÄwu’çë#ïøF~9òEb."óÌÏ‹£ŸÞFÁ±ï¹©—/î{=¡„úx±üÕ9wvµ¸¸žÍµÖŽŸº³y'ÎùíÕÌwn¸÷êúýåâýå/ø@§ïÜ^áðçëY¢ ½¿ì‡Ï>ý|ÆOÚõf¿->],ìJí`U).ó÷£_óŽ—°¥Gž«ÓäxmÏõax}ëtÃ@Ësutsô7«ŠÇ‚cž5u*¡NÜ0Ñ/ÅÇâûÊÕ¾:ŽCÏ ½€ÎåSSÃNÊ®ÙòþîM#ãŸå¶„ñ?f*qŠÙÜwdt=S±³ƒ‘;;™Rm¡‡Ä²%´žøpîfs.ø¡¬í¤¬‚fEâKV°ŽmiVÐ5¢v‰ÊÊúAºW¢jIÒ¼4™ÂS§¨ZBi¸8¦¹§˜Ò®¯¯Îy¾¬*ÙxVV(ùÓÛ0ž·†“Û¢[âFK\ù3­ðõ43Î }ׇæüyBuêÆa,ã›- hêŠm­‹ uQ w'Ò £I¥ +®ØÓ"·Äã¡õRª\/ÑV+ ŒMF¹~¢Dà⛹Þ|×Á¯R +Ìäå‚Ä…•I7Ewe6‡S <º¯^èÁ_âQê*Éy³Æ9ë¬^Ò-Î5¸BÇ|!É3ÙmÈΖYg¯ž—‹í ]X¶Òc±¦[ûÉÈ2[Ђy ªÄ2÷Øâ ”%k±gè«[°åʈnH­yM„ÎÂ-›8Œ¦N7t(¶(cÌ/-ö¿w8M—˜çÍÖ +å]%"ßuÆö¦zO³‹NÌ›[Yû|Ç¥¥O8ÍMºR֌ǫ“TÔCWAšqstÛ£·ÉÊ·-ÏAC †ÌY@ e}C«¡]bç=4 `rs×et *¨—ª²íX¼¹Çž$ælyS@0¾ö¡…µ|p¾dyIåÜ¡#I”þnÈÞ+õÝ]£ÇûH§ƒ"Z3„>€W+°Ì0ôœÛz Ëíà¬ø0¢X.[p) f“£‰”EÝq÷žÈþ¡}5ì¡8´»Qì½Ìá˜ÁÂϧ=,V‚eÑ3äSù8ŠoYÞM ‹ŠÝ85BëÄæ2Üšòœ’noí”zЊ–·:†…†%s¬Šl˃wèÑO"¸*ÌÜšhÒxH0åö€•u.ROhÍŽ³2ôuc(æÍø»´Þ^ñ"†°DV +‘ÝK¢±•²7À¼@'¼’-F‚‘{:æM5Öõ2£¾&oy`í&Ë ±Üy qè]±í¥èÉøÑF~~•<±{isã å¦Ã—!ü Ql”ÝLÞ;_fI`öòü¬^¢fEë¦×Ìï)šGëø–À£…á}?xƒÀ J‘že™sD yfé-²Ç–÷%†”8û2S•D®¯R1ÀzÂB‘²†2~‚›ŽBç–N牵[«Á‡=?T%Uê FGÑ¡ÈÓfÈņ’o~Í[—a‚ªÈä6 +sv݈—éá¡óÙÅ>¸{Í›ÖãMÇ +‚z ]Z.>d/˜C:'gÛ|UvEÞí¶Å ÷}õu@û cWÅj´Û“Mý€¼°ø¬ýõRö¶¬ ™u5Λú¾| æ»¢ÚPÃ*ÒǬ~Ø]F®lõ,ž6Åë5>ßc_ûêÏpÞp2°•“‰†Å»Ih·ŒÊ_È”á ¯X$¶ AT ¤å!ë@xÚMWHwf~y^k\؆ÖJÀÓ÷‡0›¯JÆdu´è†CËÊꯞuÂ7C³hœ¼&Áx(f1xH ïŸX¾ ~ƒ9íƒ=rGÙñoVó‚‘T˜°ý=MrÙŒÓ4¤( àÑ!pèf0ÉtŽ&Û4¦8tud.6QÚJ­*ã¼ šœ^QS ò%ô½ØMchÀcC0/úgHeÇu1A¾I=ù;§a&¡C—¸žJMɃ8qÞÒQÓ:%çÌaÈOrËÜ`L££cÀˆOçÏô7ðG&gò,~OClúÖÚYû£Ôø`·À­mwÖ^Ï ÷Ðd4DÑÚúTš Ákƒ`D£dÌWhÜ{apÄŸ±ÕÓKþÈ Úë)®¯È +Lqå]<X… H;,î±nPÏž;÷«2_qá¤B×ÆXA¨Äç*H]¥Â1—x#DÒ ¢<îëÄܘ§`ˆŽ¦“£ç&Z”@òaF >Oø‰¸6N>Î S +Âë""Óð¤pÚKw*‰æ"œ„hŒ+~"WÈÚâ¯fk× L¨ÿ7^ˆB»¦ãŒ›Ø™YÓݳÃîÁM¢{ P<ñ‰e&Œ ,&68²¢¨h¢)矪! +´{;‘oPt?ýBæ‚~Ðà;÷-ߨlgx&—XËM"IOHÕ7ì Ÿ•y #cÉv•m x¡ëE)ÉôqJ†£-²‚–qx”Á†Çv}5`yžsMøÈ@NÄ@¢Â&Eø§ Fê `‚šýª©¦P•(e-!6h‘O©4åD +5xœ5ÜmëHø`é&ßRÕlúäÍ4Å% +%K%<Ἆ3 z—ñ! 3¹µy'ÏØn†–À¼QÂD"±è%ËÝfp²QÎy¶keQƒc`è¼³ÜËs¾PY²!µ†€¬7»qÍ $©KƇ}¹-ˆ€„˜ŽjæilëV}&*÷v'TfãÎŽŸ*()[@LÉö¡u=3Tªy|Šûjh =|Ý-2i0Äk¾|OÉðš;3|ÿnõ„üÑ2®¬+›Ã¼×$á8y_ÊÆpâï»bûÄMó&J'êÔià†^Ôh*4Ñ‚+*¬R2žÈ¡e ç\” „O˜5¡sp½8€|:ÒcH$ÇÁZ{UµÜÜѯîëu8Œ;¡{Žïèn¬ô5Ôá]üéêìææËçë7§¬šâgÊa‘(+…8™íF¼lw倊ã µ«Þc¡{P¼Îm år©úCr +Jì¢QYkGr<Ò"øÄ;1D‹dÜSü">#ÓGéC ÖB®©^k?DR¤6·6~ÚsU:…}ð—uÿ_ÿ[Á"(\F¢Ói ñkoÖ‚{Q:z¾^ó¿^,ø?9=Vvendstream +endobj +5450 0 obj << /Type /Page -/Contents 2363 0 R -/Resources 2361 0 R +/Contents 5451 0 R +/Resources 5449 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2360 0 R -/Annots [ 2366 0 R 2367 0 R 2368 0 R 2369 0 R ] ->> endobj -2366 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [262.823 498.973 345.582 510.663] -/Subtype/Link/A<> ->> endobj -2367 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [215.436 458.326 289.861 470.015] -/Subtype/Link/A<> +/Parent 5448 0 R >> endobj -2368 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [201.985 140.627 255.917 153.528] -/Subtype/Link/A<> +5452 0 obj << +/D [5450 0 R /XYZ 85.039 781.388 null] >> endobj -2369 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [319.668 140.627 442.172 153.528] -/Subtype/Link/A<> +1634 0 obj << +/D [5450 0 R /XYZ 85.039 651.823 null] >> endobj -2364 0 obj << -/D [2362 0 R /XYZ 85.039 781.388 null] +5453 0 obj << +/D [5450 0 R /XYZ 85.039 630.626 null] >> endobj -290 0 obj << -/D [2362 0 R /XYZ 85.039 596.451 null] +1638 0 obj << +/D [5450 0 R /XYZ 85.039 245.88 null] >> endobj -2365 0 obj << -/D [2362 0 R /XYZ 85.039 567.047 null] +5454 0 obj << +/D [5450 0 R /XYZ 85.039 222.562 null] >> endobj -2361 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F20 1617 0 R /F41 2104 0 R /F56 1642 0 R /F70 2201 0 R /F18 2207 0 R >> -/XObject << /Im1 2193 0 R >> +5449 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F76 5447 0 R /F20 2865 0 R /F66 3242 0 R /F14 2895 0 R /F35 2880 0 R /F11 2898 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2372 0 obj << -/Length 234 +5457 0 obj << +/Length 2911 /Filter /FlateDecode >> stream -xÚmP±N1 Ýï+2&CŒí$g&†lÀpê•Š«T¾çJ ­N‘bËïùÙÏdPI€¡˜,AĬ>;4E:úeÄ Ũùè¨ç P⢉€ä^9¹QnjwuÏh´Ò÷ÁÔ÷™ZÇûìÙÁ´»½ó¡ÏöQž~²àÞêÓ¡;B–ܺ}à\tŸBaVº¿‡Éy²+mZ·dl‚½½ÝN¯HqóÕj»aÿ¡øvjªÝ]ý³vZ;‰ŽY2†:/0$>C/YÌz[ʇÎÆ)B(XþérVmæ|~ùcüÞ\¥endstream -endobj -2371 0 obj << +xÚÍksÛ6ò»…N—S3C|ææ>¸vܸu%'7ãø-Q6'©T÷þüíàâåtê×NK`±Ø]ì°ìÿÚƒÀ5-üÀ6e ëkp +¿Ø +c¬PÆ-œ_æoN=g`[fh…ƒùª¡ãšŽ+óå•qüþh:w1K) ;4GcߌãËéÈ6f ^œMæg“_qæÐ6.§¸üñbHcÎHg“fùèÃ/G<“¦5ºžÿvðn^KZËR…(æ·ƒ«kk°„#ýv`™2 ÷0¶L–× §é:RÍÓƒÙÁ¿kR¼æ xWŸV\˜n wÕ"Ý–Zl[˜ÒßµL×rH/]áÅf±H“8«x:¾<<‰²¯Ñ?~À?‡ û,~Ÿ½»ø„:$”Åám\-‹ä{\0dxr4ùýˆÇgÙ*ŸUE­yþ))ªm”òdZ$YCžÉCTÝÀ5}áÆ65$Ñë%cü‹?/ÄŽ¸Yƒ±ðM+dNWŸ“l™ß—Œ1™ó÷Gà]kä–XŠ㜴B!·´ÏqÍÀ:›?ÅE™äÙ[Æ»} Ú4'Ñ:ÖȽçí#pT,î’*^TÛ¢ÞüS'twøO£êN“8~ûÅ–Îç³ÉdŽƒÙCYÅk)p\nò<ÅÁÉÅxÈŒ¥øOàáˆP¦³ã‹³éÜ<9?ï=tTE«$_†ÙÙäôãl~ñÁœNOú¸çÙ*¹}9~x¸éüòì©Ó½ÓÍËrCU¾?Ÿ^÷xóI¼‰³%Ä2r,5Ë^¥ÿ¿cº/K’”æ‡mŸåë*D›"Š‘D`T²á¾±$øw„3¸dü4)+EË%`$¤ øbRCèËvR˜Ó&µg›-5DQ¯îû4º‘‡Ú>M1 ÙÂ…FE„ãC<®+‘ +ÍcRÐX¹­¦{”?ߦ°¥ ™:ǯo4G&€§äAÑñ`„übØH +õ¼v¹’–é‹XœƒB>®€àiBç._Ã'G¹Ö0XGãŽä‚† +ú?h>ËCÙ`(Ûv]解À1òB‹É:Á3@‹0ãSMée5[É*V‡ð¡šz²£e&c«’E- uäQ/É–‡Ï2mô'ÂЈHi¼úÅr-Ä á˜éz„§k Šò +Ñ« GËm_óÞ=‹ÃB‹ œ\žŸyÜòºâõo>ÑDIhX|×ÞÛ¶p¨ó°j›!¦¦ó‘Ð'…‚³ +4€pLtsËø|¡¬ûmÉÃ"þ¶M +4 ΠÀK.˜``ÂT×a‡+á{F - ÁE-WÊÆv±ˆãåS—žéí?¶Æ CÛ}íž´SrL^^äÐ%I×iÌã5Ê¡Ÿm¢[CÏ#žòÀ +½ºÙ¬°¾p›W±BÊ·zÕ¶RÓUOd '4}OGàb»)A—åú¦'X]Îé)Ì×H2"ç²}•ý•¥I”GðözÛXPF£RÈJ :³n¯™Ò:䎱ã)Í 78ž qHÇ+X%Ôœ±hG#„YTQ’1ö"ÏÚÙ¼d4½šíÞPóD_[dI÷8Xs¦ØªÂ€ oÆ=Ášæ±ÎnA=N¨œIÆE)*ïäN ă° Zã-V'¿i¿Ì°ÖE PÑÁI D 0ã†p¡ºSÄ*$ÃYņ,ÇûH()²-p*·l]BÉ×÷.Ëž££#³o¹m7tL7.BäC!¥ï#)ÀlýîèhoDî¶iºhaüÿU4ðÕåËg2­3˜Y\Ce­ [}Û´#pdÂ`•§)ÕHPÔ}mRXØñ˜w“ÊÀöˆ–¡Å@ÄŠë*!nƪèC1~·êoꤊ9£S›°Õ²-؈•{Kâ<¼}œìt¢Žoºa¾Ó8㧼öÅßéù^M‰õiû;¥cÚr?CFÙå×I±2„{·ÛáW§ bu~“V*­´¥B)c¸!Oil‰@ +Yònꥆõ¸·È9V<¥VR±Âª¨ áBu§JšººõdåÚc[Ðéë|Ó]…¢3N©àj®rçZÛ1+h÷ó7Mf.(ÑæE =€zqK5f‹® ÄˆßÉü5n¶œßqŒ~ÞÓ5Bˆz¾­DÔm7ù(*- Ó5ÐÝ=›˜"jãmA‘µA¾^ÀFñ–1測mB“yh¡ó +Ã-Ío¢ôZõ‰Â1ÃG}bÉÕ‰ª.—w¨–^¨Ó”IœiÕ—Fø½¡I#ÿ|2Ò,Ï à™HköDšBz.Òö1Ô‘ö˜_o¤µø-òê“…PS`ˆ‘D]zª‚ëjEq!1Á²N;çt UPd=æQ#ežh}•qñ½Nômj^]=tð±Òiü6«^õP]Ég©è½—âGàõx +4~]pê:Öa$,Ó²ì—:7(1 Rê¿vv­A(xŽÕ{M‡;€åvÛ¿ˆîh‹7Ø»9ý?;$Ý]ìUãžnŸ)Obj¡,ÇÀ|…_ÌWø­{%@ZCq©îÜ\ÚB +±®¢Üã,“Bç›dÊ$V¦QÅÊ~Ôíü—3ßáœåÜ`íæJLµÂèNj ¼•îjMfÝÕl:IX˶®`«¬ ã‡C +K—CgE¬h[åë¨Jµ Úr…R·`ÌõXKåún¯e²ÇŸkáÆx +|¿]‘·“x3üÛhì9’Êj‚]p6Õ'[Ìß\ž‡%kÖø˜ô˜N•|ȨÔȦ֎±¸Sú:êp·£FÔΫ +ÑQ6À1 Bw´Â®s`Yg×ôCÕ H?h À;®Rë ü ´ˆêúÍDÔ`øjø¶ÇHÐ ›–Ôå JÂî2%S¢¨ë¤H{ó2 ¡P6QV´7˜Xø$í[࢛:BxмêõWª1ñ0]ˆŽvÆ—ø<&©¯^½-£:höVY¢Æsåþ*ÛBzºÊj¤gªì^†ªÊîð뫲m~u.óÝVŒ¢úNí7¶qXÄ ÂN·ÉW|Ýô%§X AA²¥×?¿uGÇIt“ª;œcÜSûV)îúbâë×\mtßÐú«k†—w‘H=aìÆ¢àKÕ¼buRo@×Uè#ê´kO; ™8ûmÝऻ#•-pÛgºì,ëûiÉà&q–XDÀ|Yór pˆ |kçÁI’i߬è5$ûLž¨>»ó‡ß(-âhùð¤i}Å3×ÒçiÓ*œgL»›2ícf}¦m1«ëƒç¨çlÇ“Æf÷ÂFð&@qVWmœ|U­DÆS~œ’Æ,âʽƗÒ&ô÷IëÇ´ÞÚ ¾]÷Ÿ{(q¥é8º)…¢­'¤k›žçtƒ;§k󚟹@¼U”¤˜ƒà¼÷úB š!@”ñw2lhcLÏò®2øÏÿ_B¡éÿ+þX“7´vÍ'Ànj~ôG¤9¾ÚÑ.gÄûuíì ¨Ií»'!í¶€—“Ùåññ;üIÄì6qÎ/VqQä…zðsðp‚œ½À˜¯[Gš}å4ËŠ‡ÊqúÞÅ-¸ª÷…üÇ.ð—~pQ¿®;Ò dدWSØZÔƒ;1­˜±#ðÿýÌmáendstream +endobj +5456 0 obj << /Type /Page -/Contents 2372 0 R -/Resources 2370 0 R +/Contents 5457 0 R +/Resources 5455 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2360 0 R +/Parent 5448 0 R >> endobj -2373 0 obj << -/D [2371 0 R /XYZ 85.039 781.388 null] +5458 0 obj << +/D [5456 0 R /XYZ 85.039 781.388 null] >> endobj -294 0 obj << -/D [2371 0 R /XYZ 85.039 542.44 null] +1642 0 obj << +/D [5456 0 R /XYZ 85.039 350.751 null] >> endobj -2370 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R >> +5459 0 obj << +/D [5456 0 R /XYZ 85.039 329.555 null] +>> endobj +5455 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F56 2890 0 R /F14 2895 0 R /F74 4586 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2376 0 obj << -/Length 2209 +5462 0 obj << +/Length 2498 /Filter /FlateDecode >> stream -xÚÍYÝoã6÷_¡·“ZI}îKqÛ½)Ðìb mh[±…H¢+ÉIóßw>HI¶µ ®EÑK€h8$‡œáÌð7ŒðBø^¡Ê½4Ê2o[/Bo=?,„Å*ˆ£è™Î•ë]%2£tnŒL™*o%£ iÄÇõâæ{z2 ’DyëG¹ÞýìçÁrÇ¡¯ë¥ð7z¹RIêßðç'`Ý3ùP6;³TÂY®„ß!3ñï -lôÌV¡OZä=-]ÿKðZê#õ°®lö,ãdžJXiWà¤ÅÖ£²ƒ&YËè-]•„u¢AW{"N>Õu}(qãQìƒ* ÛßÒÚ°tDÑ,eÚЈ­á–.›%ë%°ChWÐ&½w<·Þ<ÂÓÖº/a±µ]êe UuÎÕüyÔ]¯oõG>a3ò÷§rÇëຽ±KÕÇaõ•³°@ÈIÁšz¬Âg§™¿i ò^:ì¦ýRGîëmkºŽéÎcÓ¸5zÛ¥‘³cY7Ì2-75Ù°Eõ;çÐý‚ë™öißy´ì_Â8t3w¦Œ+°G +f¡ÿ¼[äÝÝÏèˆGE°·CÁĆŽ’ö‹Æ¤>>^Sq󗌢Ðo ZË O|TÈ6üµîüñöó=3ÍíF±È¦Í}aZïÈsYw j¤1·wVŒÛòÝçõT¡˜õ¡ãz&{ᾈüK)>/&Ïα`^U’ ©È?À@Ýà~*²ëžÙÅï[w\ -ߎÜ,eî¿2M'¥ñÏ+ Dkà—•Ç!ä~ÀÑ;nØq_ë|¥3Õ‰œÎ4ÁeƒÂIˆH`|þ¶øù×ÐÛA$ÿ¸•gÞ Ða òÜ«*΃8Ol»ZÜ/þ;2™©¯Ê¡Y!ÈaÊ ?—Cæõä¡Ô1RèAŽ§2fŒ;ÃFC¯uJ!çä$ÁûͱE½šv:N"ÆÍm-¼O¶ä»Ry aõ(ƒûaLÚ"›Id?¡c ‘‚ñLÁ98F$”/Ã0dÊE.Ò•Fe -ŽWšO±«Ù¿°¡D·éÓàü_BíOm±ãQ=§q¢Í‘§´Nv$À¥Êþ0¹wŸÑer3’ðÃ#M)pýç¢ejýÝ—›Û%ÆW¦ü€y÷èÙõF¯·‡|t¥{7UWaª;œÐ,-å1X¹Çh¼ -ÂÚ;tøDpà÷8æÖ¼{“lpÞš„lËT‰¤t:ëD°Ë4ƒ °MÔú;Ôÿæö 7š¤\t’ù -»]Ùé f€!ƒà®®¶9lÓZ¨t— e êWîæH>ÒñäG¶)7 `Üó­—„VÁ<Byâ¡s÷ÕèµæÔz{(í݃íF7³Q²9‘|.á -•°Â'̲HÐwLÿhòß¾|¶Ò>•CªÚBBñ–ìe‘ ý5´ñRA¦ªxssû¦‹5 -aC|ñ“Ajg({±@·îºs„ñâÝ¥9¯`ã•Rÿ©å)]IQ -¾5àÛâô¦q)Y—îƒÍ3­ÐÎlwô'Rö"‘)q"aF¨‘¦-·â©Cwê­p^þ×þˆÿDåoâ?L’q>ź `§s¬K#·<èžqmi¡ì%8ýöëX4H³üMØ-Àžê(ŠG9CÌn¡XÚm#Ó²—¥8G.tÞÃÇPLë~Ò 9¯<˜3}à Æ)ÅùÐÒ•Åû8æáòZîá2I¸^€ý`®Ñ3.ÇK´ fZ ŸK º!o”’ êøäøåþ€=œáL{°€Ž³ô78*#¬c!öe*¦E~œoê#wù˜v#qð¼¼æž€nûr{ªˆzWML1y”Œ[Á -Àš:჊@p÷<ØÝŸD`™»4'³Øïcš„!N1¤;§¹&T†¬an¿etÙÓP/ƒM¤Êj¸)° Ó¦â{ÝîáˆÞÓ›RŠsòé°ç“J¾ibÝMXÆÒXÜL—¶¿x8\hXYš?výWná)WÅïÃT[ÙÛ{ËiYFŒpq žG àFñ¡þþ¾ r hLeöå€sYÛÕTÝØ–—/ÍDú×ÞÕ_ÅAcMäœ@6‡uo=~×aad<¨g¨£Ú®<°µA­Ÿ¸ÞC NåæË;à3"~¨Í†ùö®¬Nc)óaîæ -êlâƒì 8uö½""0Oøv6$´{y ¢uç®Ôá©Á™ES@ áºÙC1T´N碴äq¬RlŠ°*ÛŠ œhÌ@E°MQl³¯Þ -2ˆEò÷Xg^m÷ U×Ͷ8ß?GGHw^Ç0Mû®YçF¶äŸ·Éßã1Ÿ›ñ¤†È1­åÔzˆ¼²q£œ2彡Û/Xa8 º™Δºùf­Ü‰P°‡"Æ'™_Sþï²ÜGã % 6½/.‰ˆaô[VåyWáÚJ¤l9ÍÚ‘®Ð~ú®QÙ”$܆\²:?½îŸp¯ÿÉhåh,½©.RÊô}Ä=í\¦š9¡ •¼®h˜F/•…W¯16nÿßìM[mMÓŒ5ÚyŸ¶MÝ·™ñK¾ “@%¨qM·*ý΢W’ -³„¶Ë­{¿Ubpk9<¯ÈÜ7µnôžOFžÁóbÖ¹]qM§º·‰a´•œ¼hÈéÑ_C ‹¬f^2eØSÓ…>yA7ß«éùeyJ{†M½±CÎŽXJ¢x VÉ"cÒ¦±ébjµ}ú³Ð“NÉêà^œ¸t“·_< Aó‹’­2 û_VÆÙË ¥\œ­%dÈ3dèøÃŒDˆ -_•a¬ìÿ(Œ-±b‰èÅvfðêòç*ôb(«¡þ\áCctzW!1¨Dú^ EÉåRÉ@Êôž -1Ó"³‘Ì/ó³Ë7Ž;ñd¾ÜêñmÏ—“yö`]z{;7I)-ÛÓYFÖõ×Û©°îyôöîæËüæËGìy0(¬¯·8ý÷»i$­9 Ý|ÙN¿ýõ—·Ü“¶3}œ>{?,l«b4ó÷³‡Gg’Á–>Ÿ9¶Œ£É3´[ÀtyvÚ¾'u¿8»?ûÇ Šç¼ ¿uÈ+¾Œl?’ûnþÈ-BÆ åOBß±}Ç#¿4-l$¯¦ndõª…Ý„¾•wø ¬§ +æê©ZÏÏ,Pî…Û÷I‰½EÂÝìÔî”Ó™°’‘ð¦S¬³_+ôÔå?YæŠÈv6ƒ6©j*]kS6mN-0¬ã—v¶vFún³˜ÎÀÒW®Ë2Á'ÚŸ±}&37öm~ž ôiLï¶ ¿Jï9¼¤ømt +DJ'Œ‡VQ£ÎÕ ç»>¡râùÅfÛ&×’¦ï¨Ii'g<‹n‹ªyur>Œ£‰Àrða~‹Á³K–ï׬Çh¢‹ÜØêi–eŠ¼ëi·ÎÎ67,™ YÖ¾àPdu%6;2c)ÚDMö{TG[gy´%Ñ‚-éKUÎ*±£gÆŒ¹ùø 2ŽFë–‡ŸQ<Ñ +[Vß'¸j¯• ÎÀƒÜ»SWjd%xm´QŸöI.¢Žc O³bw¥ )×ÎÓñúfjœÀòi«³0,½Xq?:ØqÎÀì¿ahn§­ƒVÔm_¼èó^Õ<™TZ³2!Ê1»™šÛÝ”>=>ˆE¡JÒ~.ñ<«Ç£C\b ¢²í‡„ÊSôœ•}¥‚0²cWœDÜ‘ A‹ ³ÂŽÑé-µ¥p'AÚNÌÐ( °¬ççûŽõkRmˆ>Ö5ä(ZTeE^¡‡ƒÐz×æßɟоAoÀ^Š‚²w†GYW§Ð‡er^´Ô³›’÷ÜOkšTzxÓ|Iǵˆê“9°•²~/ üE¾ÎzA‘[ò–Qg$BW3\‰ÎÚ[¸Ózƒ&᯿‚8ðáøQd{Apr'#Ú‰<”ξçڑƯ¿€õ®oM’•ˆ7Ø™5ü,_ºrÑw}Óš‰ïüìêôIõW—— [àa )®bá8Zð½~Þòór]—êòiÓö—iRÕÕÍÜ4Ù£[pÚ ÈÆ9%› +ƒ&ºÔi|Ðس‰-p c£JJÍÊ‚1+A`‡Q¬Vù‚‰5ìzß¼2(´t_¿ZãW7tº$%^ï®{Qƒñ;¤†‰›'lNf”¨Œ3.dHÊWßïXy ý ÉZ“Døõ4𔞾9¾“`ä>Ù F.LVý»¼UiÏ Õ-K¾C†áÑËóëÛË›[P!¸ŸÖU5 -&¯Öø/¼%ˆ&ƒP¥Žâ,úóyAØ£¡ e$ªu®/ÉhlƒRs$M</4y2MF2ÇÞƒ”žÿ:á]ð÷¼m}_3|ÃýÉ-v5Î6£‹=)Ð{Žu½VéÈ‚²|ÉocÔ2.CçVÇ7PËcäxÂÁÔ«*ÿCéeSé.£ I ËïxŽˆÓeçHæˆD$%¡Æ|w "m“¦E®ª^'ÿ׶®û¿ý€=òóª¸îÁšç :MŠuÝéwÿÃU«4Í®Ý}Pˆ[Œw‘“EdβHVÝÕƒó#rðçqÿöC,¸zø&¤‡ÿŸ25[ä}·®ìŽVx<´™êÒ6o0ÜFÅÅÅŸè.P‚Ï®^˽Bˆ“#Èè…kâÖE†]9"çTÙò Á +ï0˜Dðß B=Æq³ä¹ªFºá;šü÷XÕá8±}l }6.qXŸaØÓuF>ûÛ3ÊUbfyNL©´S·a] ¢r…2UÃ8ðƒŠ1mÎWW*sCL‡¦2Ââ)6˜ +;á÷CÇú­É)Ïë%÷Á "D3øývè*s#Û—žV‹56^ôŒÌlä*¡$·Ù Ò ìÀøAÈ¿Ì´t¼‹b¨€Ö[˜Ü=Å…µJ´ß·%W^Œ‚ccj2s­ÐYÖ—ºWûvÎt   éß9ëA"ªLÄi #Õç¡£Êèò-#ÆŸâÞtïEº2%* œgƒ0§LÏM‰4\HÓ¡õIµúE^rSdF¡©¡"+#¤Ýõš—e ¤Ñ0’V›òKnbµ³¯"aÝßYÍ% ,Pg/xIž¼0¡çð £OC9„½á’|ÓñÀøCt›¤ëÈ’ºÕzèâ×\¢3‚ÑBoå@†HÚqhX’Ž|XÙÒsv­ôÇë*æ^,øŽÇ­O‹¡¼à^b2ÚeÝé `ò1v4r‘:*¨ú†pÐh¤Õv±­·€a•ô»¡@µeìl?ý¡¢TW {K²aê„ãÒ΃Â]ïy®UëøÄ12Ü3†{øm?RsI5YÉAàü¹ÍÆBÓ!˜>g=‰~7S˜™RÎ5ݹƥô‰ä˜]Ø@æ–Ò.àhăbœ®Ëpçt†Ouœ}> endobj -2377 0 obj << -/D [2375 0 R /XYZ 85.039 781.388 null] +5463 0 obj << +/D [5461 0 R /XYZ 85.039 781.388 null] >> endobj -2378 0 obj << -/D [2375 0 R /XYZ 85.039 761.463 null] +1646 0 obj << +/D [5461 0 R /XYZ 85.039 678.921 null] >> endobj -298 0 obj << -/D [2375 0 R /XYZ 85.039 761.463 null] +5464 0 obj << +/D [5461 0 R /XYZ 85.039 657.724 null] >> endobj -2379 0 obj << -/D [2375 0 R /XYZ 85.039 642.137 null] +1650 0 obj << +/D [5461 0 R /XYZ 85.039 602.015 null] >> endobj -302 0 obj << -/D [2375 0 R /XYZ 85.039 399.889 null] +5465 0 obj << +/D [5461 0 R /XYZ 85.039 581.42 null] >> endobj -2380 0 obj << -/D [2375 0 R /XYZ 85.039 375.338 null] +1654 0 obj << +/D [5461 0 R /XYZ 85.039 454.773 null] >> endobj -2374 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F70 2201 0 R /F18 2207 0 R /F35 1632 0 R >> -/XObject << /Im1 2193 0 R >> +5466 0 obj << +/D [5461 0 R /XYZ 85.039 433.572 null] +>> endobj +1658 0 obj << +/D [5461 0 R /XYZ 85.039 171.433 null] +>> endobj +5467 0 obj << +/D [5461 0 R /XYZ 85.039 140.016 null] +>> endobj +5460 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2383 0 obj << -/Length 2630 +5470 0 obj << +/Length 2016 /Filter /FlateDecode >> stream -xÚ¥Ùrã6òÝ_¡·¡R‡xaßÆs­“²Çkiʵ•ä–h‰1-IYñßo‰šMÕÚF£o´Ä̃1‹×SzÅÂUq<[WÞl +_¯„Áðf¾ë….]¯®Þ åLx®öôlõL(«ÍoÎÇ~¸_}~˜/”RŽvç‹(Šå\8n¯? ÔwÞóâí¿Òy¼¹ûôm.cçqÉ wŸW8ÿöð+®hÊ87w_úõûͧÏó?V¿\}^ x\ø®*dò?W¿ýáÍ6p_®§unxZ$ l› kÐój $ÿê¦*’¬<øÕS]›Ô5íÍ´Ü%p_Ã%mÈÊ-ßMÆn¨BøF®§ý.) ½‡´©òC›U†“Û´ÝU›L±˜þc¦#WÄbê–ewR'½šIUoÌ}vï€=0ê¥ÁÛ#kÍÿä‡ÖíEH›²±z¬þz› rÌÎ1:0×éÑ°ž©w€yØ﫺=ÓnpÂÀ®ª^éý1ôƒ…òi^ãzHE>©pj¼¢“›¬*ðƒ £=Âj¿ç³ý~"w1&5SR˜#Ò9´ˆ–äù#¤­‘rÀC“Ù£½ÚŒLH8 â@à -ÂÐYáxÀŠ )Ó)’ú¥ãscη+¦ÝÁ†X(ñë9ï~zguʃvgUI\âhÌ‹ -$`á=Z^§;TEAD²o?Ìcßù7OÊÔpG·CŸ@b|i˜0‚l€Lö»'|« € |;ŸYP%oÊž‡ÃPV-‡db'å(_=3 nØО4”йiÛé¼áÕÌ|›´å=FÄuDWzÇ,ÏyÔ´ÝpSñ7kßõÿ¬žè')b -v2åKWøÑT|O–‘‚;n,dÝ%¬ù®òÃat×®Dkñµó o”!ëCÓ HA §§ÒÞŽ•pHÐ+¦’Ê—¬¶ÆÚ¢E¿Ícåü 7š<$çX¡Èy²•Z¡@ ƒK5èö8'7z!¤-/eå)i:C‚dŒN{{Íãß½À[B,!3©v›gM²EÝ ß¹ÎÙÒÖˆõ[Ä)ýó8TÐJC”’- -¶Ü‚¨Ã8èÎ÷Û“=/C³Ùâ -:*žöƶ¢”'Y±Ï­­ó1å\j§µwEº+_>™w„Ñ^ß|[2 ªù‹Þ^á–v„¸˜¸nvñúÚY&©žž"[iÇOì´ ÃG§"àÉ\ Çi¹NöÍ!OZË(‘B/’*Þîû›{´ÃË­¡=2´ì¹×ïëy>ðÞ—Zã~ˆÖõbÉÎ ß<ã¨yìÜ„‡Î£åÉ}hy0-­º¬ÉÆh²VÛ*è+mED²±œA}ÂÐb`*[¦ áñ\K ÄCE'®a§ ‰|ÉÐçJ†VŠ¤KgCdÅað”ÂyÜY¶KÄ”N}@ŽK«)Ü<º9âv*C”ÕÇ{Ô) {" £;#àû§û‰» ,MüœòdÖh/•äcöBÞÍ¢,yÒyF[Œµ(ïuÂ1Éd„š¿ºt·fÂòl"kÞUuA)L™ԲÏr2†Ì“¬W©ý}ÿ°{^?½ß–ÁdˆÛ1“g4ášâå¦ J Ñ­ḮmW£4¤ØÈYíR®t‚pœ•¯!a„&D×iQµ\Á/T蹑WdÃÿ$ʾ)eèœäM´‰XSN—Ús“#A¦ë®&xfœ]šïÙBÓîØ“ªÀíçÏÔ¸-¡?Õ}†HxDIPGV>$ ûk^¬X\tos‘aµ0J:€ù©…Íx{BsÄ+zKÂãC¢h·`-.Ï–Y‘å$±Îˆ0'¶;ËԉΤŠ]­£±ÎP_VàÇÆ6Åá[¹žPš0µñ­±àÈ‘TÏLlôx„u®£)žÜuU>O -ç¾Á»”ÖLEt¢_q ë\»Ês*5é5e—“ ´Ê7JGVå÷z`Í p…xtÑe -—Ø « øø„”‘` u…¶Œä„© ÁÁ«à¸>R.YÜè S¤(I®²qÀU6.-±z@P3ýö †8ú#xG^WÛ7ÞuÜ¥õâb城IÊ1O®e2tÖêq-iCI—Åâ¡HqFŽS™«9 ëóHDÛ/Eu®ê4ªC,ÿAÖÕ¡ -¿©ó€Ì\<Ûrê4;Ìȱ]ÎAÄØN“‡ à­yç¾Qù{¨'BˆöÝ°Ëf7o !v‰ÃÄo¡ ùãLE^M-6áeh:Ø-y?¯Òs¾}½ºaW`<¦ºRZçl³ÚæfNNÏ›YЉÉÖô×ÚaŽGX€«ëyºЩ™aÚ5v ÀlNÌÀ÷‚¾vš66Z O¸`l>7£ÏOáÂ{X¥ ôGUŠtãðRmi:NƒÄ‚\Ý}[ÙN¬tuèÝ{ø (¹ LÍ«½~ë+‚¡\9þ}ÀÓtÄâ…ï ƒ›Š€Š?ƾ`T[]b›C-hªmÌLG¶ÏÅ<˜wÖ€Ð9´äWÑ~Eq7¢1ä/C¶BÓ¤ÀÚšK-UCÂSÓ¿]Ùü¿ úÒ…pÑ ú‡ Z?:eÔàŒZ¿ÿJ7¦endstream -endobj -2382 0 obj << +xÚ­X[sÛ6~ׯÐx»cj¦¤‚W÷Ém’ÖíÖõÚJ»3N&C‰°Å E* Åÿ~ϼH¦<é¤qlçàœS~Ä4W&Ó(ŽŒãéj3q§0óóDÛ°Øž“ù›ÐŸ +×IÜdºxèõŽÈé"»·~úåòfñúvfK)-‘83;Šb맷73aÝ1õæöêzquý3Ž| +ëí Nÿq;‹¥µ`¦«ë~úò÷/y$wö~ñëäõ¢ó´ó¼JÐÍO“û÷î4ƒ~¸ŽLâéÞ]GÀôf~:/͸˜ÜMþÛ©â9ÊRcY dì±|ž Ò"‚Ør®¸>¥¥Vú³ÒeºQ÷ï„ôñ÷c¦ìeÞÔëjû£¶@Ùê¼l^Ááæ©Þ,›ºÙêrLE½Nµb§8¶Ué†ùîÒÍ2ÙX7ì€ǘ‰Lç]`có«j³QesÚÃWT«´É«r\K­¶yql"èó´ÕÕJÕu¥/î÷yI$fµýÀ‰E<µ½ÈqaUQâ_3[¸kéíjUäà‡h¿å§®ªæß_àŸ!¯øyþ¨Ž–ǃ€Î™‚1ëªnÈràD^t…Võ®0ÆöiÍ/½¾½ýðöú·ë?þºþ@Gãõí‡W·WÂ!5ó7b¸µGÄå9q‘Òk•7kôI†žµQͺšÙ^leHVõÀO`aŽf J+3‚Ѐg³Iˬf +쬈ïK–K—¤hŸñ¬QUU»Â˜j%™!åG†Ör–ÔFœX‹u^óÚ˜¸‹Y7 +5og¶Ÿ„ Ë‹,L”ŸD¤ª**Í,R¶;4‚ R‘{fS€œ™ÚP´%ðÑ|ƒ°éðȼÍ:çY?‰aë–h3Çm Oð>‘uY²º´aW7Ûªbñjô”¥Z‡Œäà'æs…Ö–rTÎ 5¬3òÁ€7¯yÀž§Š‡û¼(˜N@ë + Ž ©¬I®K‹ÊD}ìL¶JEì¸^‘u¶]cg’|5kËU{‹…/eÕð û/šØ?ú]®Ùž ] +s£úÁîaR^ÖMZ*;sNt‚ÀŽç¿ÜÕl>ž?cE\tÅ _è‚ñ ëvJ7ʸEÍ_úp3hô$Š¢Á®ûtÌQWeíÀÊ +¨o’š¸YHa2ܨ­Il/ñ†…>ÜÂa°®„æXô,@Kga‰Ä§BJ6’°;Ü6XŽcq£¾‰¹1¬Ã—†©¼€DåÓ5®îÚY)³¨½û2´®æߤ©íÔF|mô·$PùÎ~Ñ2b+[ãìS·íxí ¬ìO=“æk¶5kÊKÎ \b_lº.¼ †r¯©K“$T| FŒõ±7Áªýbñ©ù†oQµ&ñš¥‰·?|AÔC$F@áž Ï%8“.‹Þ3Êrµ]š­ë€•È¼´T*N̮ۡ#¥ +®#èæ2eA€,ÜõÈlÀËS«!4ýþm)½3L Ã)9^X˜ê–vGèãò8}­Ž9Ux@ukL¿5µùÁRyBÐ#ðªáÄK9È·Dœ×!úkü8Tûœ` ¼¥ü8Ã:À˜Ìç²d`”ÁmJ«3žlñ"aE |Ox>`…ðe”5à9²<8¡Œ²‚e倵5¨ÖŸy”ΞíéF¢´bn“z@Y”oN?•Áiá^W@¥„ŸŒDYͤ}'—°F"y9ðžç4€¶ÿHæRhÀR㕼ëÍŒ{æ'®˜MËʲa˜Û3Û¨?ø +£GXû«>w,Ö¦ŽÜ ©^ïOÀFu¯ý.ãT«ö"ytAåƒÕUMî—+ì‹tÿfä¹jè3ƒñáLWü½¡1Å“¾5÷¸CŸ*¢Ò 4VIà—ý›¾gö;Àè²/G‡)† “'Z_0ÅžLŽým¿{>søÿ˜•"endstream +endobj +5469 0 obj << /Type /Page -/Contents 2383 0 R -/Resources 2381 0 R +/Contents 5470 0 R +/Resources 5468 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2360 0 R +/Parent 5448 0 R >> endobj -2384 0 obj << -/D [2382 0 R /XYZ 85.039 781.388 null] +5471 0 obj << +/D [5469 0 R /XYZ 85.039 781.388 null] >> endobj -306 0 obj << -/D [2382 0 R /XYZ 85.039 408.357 null] +1662 0 obj << +/D [5469 0 R /XYZ 85.039 501.248 null] +>> endobj +5472 0 obj << +/D [5469 0 R /XYZ 85.039 480.047 null] >> endobj -2385 0 obj << -/D [2382 0 R /XYZ 85.039 381.742 null] +1666 0 obj << +/D [5469 0 R /XYZ 85.039 247.068 null] +>> endobj +5473 0 obj << +/D [5469 0 R /XYZ 85.039 226.473 null] >> endobj -2381 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F20 1617 0 R /F56 1642 0 R >> +5468 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2388 0 obj << -/Length 3839 +5476 0 obj << +/Length 1928 /Filter /FlateDecode >> stream -xÚ¥ZKsÛF¾ëWð°Ê‚ ž{³c'Q6–³‘R>$9 IÄ -´¬¿ýšÁ€U©ÚR•0ïé™~}ÝÃpÀ_¸È?PÅ"ËC_åùb}¸ ;èùñ&”Á"öƒ4Á®÷7oH£EøEP,·4äqó‡÷ýOï~}üøÛòV)åþò6Ërïazï>½‡­±÷–;?=à7ò¾ÜÝø¼ŒrïËwÜ|ü‚õÏ¿ý›ÞÿFUswÿ#·þøû݇˿¾ùøèÐxûqªÈ¿oþø+Xlà?ß¾*òÅ3”?,ŠÅá&N”ŸÄJêõÍÃÍì*Ü/xÖÌUÜÆQêGTàçylï$LfîdÛv@ry]¹9ÁU4ø§›õ ¶*ïÏ ÚšJ¬Ç^_v_ñ¬P =™y\ÞFÙ¤¥Ç2®¶’©¡7ÀJ!÷j؃ -þl¸têiЯìíI꥙d©Û•‡v€±qy«®]ža‹žšàûÒ¬yÉaÃ0öUlÖÀý/÷¹U ]q-nC¼àb²RLkÚS³.gÖ/R?±$-ÜGžyúÏ Tt¬õÀ-+ h†ë{Æf$›ëª—klnkVë¡‚{‡ÖÔÓk¾Z袋íeýºæB_îØ— K=vÞ=QŽ†½– Xd_õx„Å­Píž÷@ôjäì¢ÒÂ[וY„ô -I¬¹¡mà®teÏg0R‚5݈·Ö2—×L2~ÍY*r‘fÞa òtb@rxÒÊHQÕ6p»1 Ù:#b2ï'Láà÷¶ð‘ápo/Ýб×h¾‹ž«È‹8P^;ìÍv·ô'GÈ—vBe&t›RF"aØe îÇkÂvP.ÜýÊ4êâ(ìÍ])[YÎ gݽìz÷ŒÂÖ‘hdS”² é†+¼:^\pÛÈwrPvyÐÐCY‹#ï…Šæ11rïÈóLOÓ\°ç_·$‡’ŒŽðÅŽ²Â5dŠYƒyÂòˆ2Ø6å†{ôܹ5[ãc§×CÅâUֲơڌ…Ka½Ãqhû*Ó÷/~ùôÓgԸǮ 6nŸ í2¶á-â—ie·Pn €32+"Áï轗Ŷ¦ó¾DëX»‰Ö—$˜`ÞyýËSTbœKwÂ9ÃÚà9ør'nÕH-zF%÷ÑÜ» ËúdÛ(CßmXȱ‰Ùƒ¥)ît@pL¼>˜E)2]ØG€£7ô `˜‰ÚÙRìÔUürÆ<^9ŒÊ„ -DÕÄÎÐjS7ýýï<‚Ý»ƒ¢u¨QǸb±‚&ŸŒ5—6ZÅr”03#XñÝØMŠ„…I$õ1P¿½TΦÞ0¸&X[ëß3°GQÆì Š²Šéé¹16O˜ ø2fÁ³ -N˜EíLÁˆ8r·6ð’Bå-JÆ£kGE"Äø¹ánC >h‘ÇØÐe'™'}|Ý ÿ’ÑÊb—hki±Õ*¬ÑkŠi‘Ùšç÷puó)‰¹D{jg'öÒ‹Ú.ž­Z˜ƒªæ¿6ÂƼʹ‚³Ñï‘%bm¡ÀÀ~š¦È ÷°DáA“Á„jW”@¬5t!¯êXkè™—1ÈÃN=ÙöÝHËeŠF‰ŸÑY*H…ék¹™[3ë¡Š -«z5 ûrn«â !t±7[#ÊœY#J˜|@â*ÅÌÏ„cüþIV¸€_з¶—ùòðI"ÇR d\¨`ᦈ í¥E3ÙÑ© Œc5ì¹ÄF$ †¦©ƒD¼ bù0QBudTÆðÒHº„† c^'CKxr1Îf“@ûãr.!‡}µ#²3ò.Z¥¦ù—“…9èÛÈPÁw{jÌ¥MúgET“­ƒòTÀaäSU°>àa:#÷1øh õ ,˜‘B)ŠØâÜ;r0H6ÜDL^,v¤ÕŸt@pZsɉaâ†CZ·v$^¢ Ú‰{]O‚õƒHˆþ5o9cWHÌ’ 9Þr±E€Ÿœ jÁ£ËÆnBRXÐuWêÍ WÊo · €EœzŸÌS3Qe„[Q,Bk]‰<'dL" ¹àD®6R£,Ç §ºd "Iþ/BéB o"ŽhY„aÃAWÒy`@6%R—IdÔ» @g)ΧŸ§DÚ.œýž‰Èñ~m°·ãL²8 ìÝÈ—Í–LüEæèš2²Õ`šeÊlö  DôCíÎdÈ,bîIJ3þV=€(wÍ3á þ‘ØÅq:}Îè¹¹…®­©Äù°8N&´cJÑjnæ„ž8µ¶¢Ë–·ææƒvÂå8½ÌíH;:Äm+Ï12’(*k"öé’“Æ_±O‚hÃün;Ì´b‰0Û#¢6icå$”\ù·5’´×ÍŽ<øŽ»VçY(˜Šç¬LúÙ2©9‹2 fËTaD•o¢Ü"l(]8NcF› 5BéH˜õ[ÐÈJ‰%j5Cˆ°&´ÝíjÐþ«€Ñ^ òöp´ÙQBÐ?91ÍßòW›ýÆæÀNR&8`´Lå0!¤{^I~\ºô´Yî}Ç‹'jÞR.ŠFw Øí¡n>Ú&NMqc%ƒöeM.WžR ÃyуMÉ3è7ËfoAeÅ\’Ôèé˜ÉŒŽj o£"›QŸ…çý‹ÌÆ[–•(VN¬GØ3fö˜g×ÖÿU i•æFûPÉÏÁóq¯3WAmd)/SÂ&8(Îjíö¥•ª‚‘Û3ÅhùÂÀãWZÉÁ†Ü½ çk ¨Ç#cˆe(ïíX¡¶æ5 ë9 >Û¤åü®²îøô8"(ŒVAÇsÕ¼’ª¢ÌÁ!%©òïÌ_£€ÐëØrª¯Î9}L}?y¨Ì‡ÊÞ -(%i¡‹ä:ÏçdU^XñÁòÕätŽì6H -GŽŸ{É0àf{18È5|ïA4¾tÁh]÷BÜÆ}!Œ‹6¯?¦ÈÝkÎ(â‹EzEjg2^,ÑgŸÃº%g]øµšì˜KBÊÖVX¤O6…aG†k£2Ùg`ÅÏšÄÿI -í­©2œåÏU.¿klv3¼x–·;ì²/KXY(ö©ç¦FÒžá\ê›Ù)¾%ZS)´^±°ÏPŒâ¹wM{DS7kAÌj€ žÌÿiL -Pø—›È °˜½…L -Öh¯Ç\2/aÀ ;ŠœÑ^Gž`µ„ð"ðÉ”€+4ÑÙÎEˆ(…g(ûG~LÞx.òôý«F7i£ð]úÈJÒv¤ú*åwߌa%x9‰ˆaó胹mËYš3&U8¤“äý avcÝÛÆû`,P@%H ûä!·¸Œ"¯©t׎|Ãüš·Gý,2%f,%‡y–N ÃótJœf2#>£œBš¾öËš<”%γ*"=lÛÏIQî2yê©’eúÃÊÕÞÎl—~›q¨ûÖ¿°´€Œü Ê'·h#ðfTLÊŽaÕÆ81šƒð¥Ï†ñ4î…úÒφg<ÎÆzü±9³qeRÌq14¼ÙÌ€"óøŸ,jÀ††™¦ñ¹VÆ3E”;B•È2g;¦ƒ¬™‹“8Úù=“<œÔ/²/Á¤ÍŽïv”ÍÌJ¯Km4Úê™ßo°ÊšäÚ‘~>!?Pјƒ…2å`:úíSŒ±°LœPBã¦oS6™Káí¬Î¿%2¿ò¨¦¿QÑeŸ[u5ý*(ÈgPqìÝ&Ø9ËQÕ¬PÌ&´(ɘZh+Uòí÷dVê WǤE@Ñ)í£ ò+ Ù`þÇr¹:·  –×-H䇯˜ú•ë¯ã¯u„O3¿ÀfykPòŠ÷ÒؤdÇö»·†;òn˜H Ì‚c„ÉVZÈu¾õ«âÔ&â#ò?yce|Jäa&ÁäÆômû&hë §ú >NB ΓÐñ¤›^nMˆëZ³nZQÔ&Ä]O ÍþF!Qœ7›ÿí­ÜÅÿ÷»Ö8òSp -·ãb×ìçç„ʘÀ%ð¨<ý.endstream +xÚ­koÛFì»…Ñm¨ LŠî¡—÷)}.Å–e­»HL‘äX¨¬ó¤sÃ~üÈãI–ãG·®iŸGòx$%6öáÇç‹dÅÌq<Ζ#|”×#f9\ËâxžÍF'¯B9f¾—øÉx6ßè <ˆñ,¿tžÿxz1{ùvâ +!–x7Šbçùû‹ sÞöâíÙùììü5BÌyä_ÞNbá̈éì|C>ýùÙ)AÂó'W³7£—³ÞÒÞ°*A3ÿ]^ùã\z3ò=‘Äã;Xûòrvz®FïF¿öªˆ&Ç$µ/*‡ ž%<8¹y2}ä¸?ˆcÜŒ£À÷_šÐNÆ<ð7ðBˆ[ ç]y¯àz9ït±šN\'¢„9EœÒB ,sÒ% ®SâÖ‹Tw«©- ¤á;^4åmÑÐúU‰*‹–”~ô?Íó¥¤ÜE àÙ¡C‘EÑñ°lxLXD°/,>÷bÆLX¾]Á§YeYU5øðÀqß7JéïîáÇ"2zþF[¯~ò¡¬su×t>£ç}>±ôå±×鲘î#}sé›tq|b ÊÖ«6on/¯ªéò¡]^ëV¯šÚ»¸xò‰c{þŽèº4‚¸ôÕjzþþ§Ÿ¦oO?˜ØÆC¬|`Ä+•¥ÕBµÚ\.$D)„Eäù±ÈrÑ”µî\1ÃÐK´ë,+Úv¾®ª”u«Óª*r78yņgx,æp„ŠÐìu®´É"æhH›q¾ó0á±£Ö AYZ×@U–Ø«‰ ô¢ãÖ‹²¥U‹é¥‘ŽP9‡g8¥å›§%f¼aòÈÜ3KÊÔºÊ-° £Š[´ÄdmM˜Ôn•vƘ«±FÅš¹Ó&[”ºÈôºée}7ùܾ©^t:ð;þ~Ê ÷ºÔíB­\a¾Åõ2\qü3¬ÚWGøß›6ðKý¯¯€›Hx±ØäÞv5åÜ㬳#ÀåΧÉ@Ä^‹]ƒÿ;\AZendstream endobj -2387 0 obj << +5475 0 obj << /Type /Page -/Contents 2388 0 R -/Resources 2386 0 R +/Contents 5476 0 R +/Resources 5474 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2360 0 R +/Parent 5448 0 R >> endobj -2389 0 obj << -/D [2387 0 R /XYZ 85.039 781.388 null] +5477 0 obj << +/D [5475 0 R /XYZ 85.039 781.388 null] >> endobj -310 0 obj << -/D [2387 0 R /XYZ 85.039 610.001 null] +1670 0 obj << +/D [5475 0 R /XYZ 85.039 761.463 null] >> endobj -2390 0 obj << -/D [2387 0 R /XYZ 85.039 580.597 null] +5478 0 obj << +/D [5475 0 R /XYZ 85.039 740.731 null] >> endobj -2386 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R /F20 1617 0 R /F35 1632 0 R >> +1674 0 obj << +/D [5475 0 R /XYZ 85.039 492.747 null] +>> endobj +5479 0 obj << +/D [5475 0 R /XYZ 85.039 472.152 null] +>> endobj +1678 0 obj << +/D [5475 0 R /XYZ 85.039 196.464 null] +>> endobj +5480 0 obj << +/D [5475 0 R /XYZ 85.039 175.263 null] +>> endobj +5474 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F35 2880 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2393 0 obj << -/Length 2682 +5483 0 obj << +/Length 1570 /Filter /FlateDecode >> stream -xÚÅ]oã6ò=¿Âo'"Q¢> -ÜÃn³ÝK‹Íî%.rÀvd[Ž…•ÍT’“æßß|‘’byÛà -DäÌp8ä|Óá,€¿p–i?ˆòYš…~”e³Õî,˜ÝæýY(Á,öƒD#êíâìâ§DÍÂÀσ|¶ØÉbýÙûñ_o>-ÞÝÌÏ£(òr~ž¦™w;½7Þ¾Ahì]0òÃ-~•wwu}ùq®2ïî–×ïw8ÿxó ÞÞДi®®ß3ôý¯W—ïæ_?Ÿ½[ d<ý8‰PÈßÏ> fk8ÇÏgåÙì ÆæùlwëÈ×q$óúìöìߎ ã⯚¸ŠóX%¾Ja~–ÅîNB=q'A‰Sos€{دºÊì°2MS®æç¡×Õ€zFhæU0ìúaËÃÉÚÿ—{¼Š‘EÍØn‹“ŽÙ Û#hG Îrd^±̺)[a #¤25Ê×K·£-W¸×¶@f‘í»œŸ+” -€·âåt܇h .{¬Öål Žco±u‡‰=– -X§ ¾¯ÚcVæ€W±fÛMhòX<¸¼¾ý÷½ø)^·R¡¯B%—~Qv«‹­i»–IGšÑ)h/Êï™k±—M[Ã_³÷_š×¹â…¨ö8§LÃR„¡Ÿ©Ô†\èçZ #÷#Âix·e×Uû{Ø=I½ÃïæQH®Þû›¿~bðÛÆ ä©Å[…5§U~¤âoÊ™ù1'íw1Ïà6`ßXyl€OHFø®C¶GŒG;Z¢Å ñRÌ"E¡é”$[ƒoÁŸ=p…?!•Aú¯ÌueØä :m…¬ï³+œUûR„¨„+Ê!"v"oQ0©ÜîÇVìB|Þs‚»Ïb2•{{Óñ Øó÷zÁßKCÖÍ¢2è—›ƒ,,éVÖ<ëèRÀÞ¯u·pºZ\µ/{ËÞ¬ÐóBvq»/êq®$F4ÂØðœz¤ێVÓIAà‚n" ¼EÛ• ßZÞ¢4Çp¿:@-˜9gá áÆ[Œ8±nÃï®?.¾c( ÁÚb'£B¨ -¦øÔàJ¾ËF¢#`/qW¹áý„Þ~Si Æ‘Ú]¨Måàåu·5h÷[´¶üòE5*PóxBѱJF·.²âld…s~¨ ”å¹åõl{¦“éjYÀî£@ øŶgÐ þøŒfw°×Q¯@±Ämç”ôž‡Ž…› q¤%àAæ §ÕuAJE ˆ‚ãeÃZ›PV‹nAãÂf€¯Ð†¼¢$ ¯2méä²lÚ©“âÕçó(“Çd:8˜Š5­¥A[Ty ©‹2‘¸‡Ê¼5$G†=¥uÕªz(:fA&ÜÜÞ¢¾"IcÀ[Cõ‡õ 2#ë˜øølV -x£@ î· Œ‘롱‡ÂP{“à—?k«õ<ß,Ì—¤†ÆNì -Né 9¯óÄA«¦Ý‡©E}«Ö°µ G…94_ñ‚0c䌵w ÂdY—¬92Kæ( HPÜä?ºrbJ¬ç Bþ‹®&@k¹lç6o–tÕj*½«NÒ…°â˜ƒwõì+{kæ‚'ÿÃ='´êÔÒXµ eðr*¨ªagß_]HoO•¢¤Z hc 8[½»L ä”Lˈe-® ˜ -ž[½lO*¥Áð¸WT,j¶ˆ(‘´ +npΞ4ƒ½Lõ Ðq ûX‘Àû\3%D»Ð¥æšB1ß* vÃð[Ÿ o€£„ypQJôUe™T{·ÃÜŠg=Ÿ8¬°æ`Ò 9šëF•£úʆ¢C.Û¶Ï j¡~æIŸƒ€12^—ÄiàÙ¼Üy¶„M†?X¶ttgPD± º‡tK*²eݱ ÷…H’¹*aóH²‰J€"Œ\з£uÎ3 |=JS›p JÛQšŽE²yÇÈWn™3w@˜j(<ÀÔnü¢’¾¯ ¦þ"=÷>¶—\J<î>Â@ûY˜IÉÜî–>ÄòÍDïç~¬c¡Ã`o=ºŸ&ƒœ™†AË©’QÑJ³;4<þ'žË©¦ç<‘Þùp„^p–Œ\,Ó½zž»LÝ×€~9ÇQ‚È0ESãÌ0`4å¦lšb)–OLœÛeÚÖ‰ÇÚ;·áj…Lœe´S^ÊáLCv¢ªD'ðlZ¿›”¶up ´iÖÃp JPðÔ ¥­'{ç:[˜ô†Š+mĆëÑþÒ¸ñ¦ÖX… éAK¹d T}9é°¯±Ö$õ“(ù‹Æª_a¬yÎúxµ±¾8Rm¨l|Õš6ºrýÊu˜[—e=¢Oôkü(qªÈó±%Ãüt5Ž´¶ˆ^}¦m¿é—`4U!œÂîpÉÝÕõ-óŸî9ʆšLrÃklËzäd|à¦ü}¿jÊ“•ÁuùGG½r0èÃd6B,ÚCC‚¦Ø©BĸVYu˜Øƒ¥èÊ\е<ïŸ È‘BÎî€xYëmƱg/‹VÝÉàÂMj`›ÔQ‹óQ!ž“éáØ'™Æ¶Â¢;ènû’ l[¡¡|ãê[lÓQŸiîÝ‘Þ×nÄazêÀ\üçÓ… -‚è/t* 8‰oigTÒƒrE%X´KKÄñ»6L a°Å&;åN韪ºfäKA›ÿÁ¸“å=rLJèÙQWæ@=;m5¬Ï‘WWîׇì$#ÝÓ‹ šRšp.†;×_Ù¤g«Œí 9Û*-~+evôTû–Éù=„íA ŽS£HaÜޙݴZ—‚µ²ZÉŒ`æl3ò8@ËìžâÏ÷f»„Ç=ÕµÐì‰GešbSV!›r:ÈÂ*×0_Ù²ãÙ1W›©¼–”ÇO~@Ž¹ÎHG…TÜ, Ü`ãzL¡žù™WžxùVº‹†/Ãgm–D~œÅ£\ð'énoþ_ÙNÿMÉî’꡼·w¯F ~ZÛ¾=ÜP„'<Ym64´PŸ|Ò¤%LRιtÞ'ôÏD{vÓ>H<órWuaPB - -¶ÅéBò©Â§:4¬ÁŽÑÑëBú7&<ÙPZ W~éÌÄOœÙ;UG/^Ðpñt-ñ~}±ÿÐÉè§?tþQÓËñ`cí?i‘ë›J’û)Œ˜ ¿¤É#©¼øaÐ7k-ƒÝ$=gÊÍ ñª“ü9 -TA<ñì9õF¯>q`ʧ_DŽ| µ½Æ×YçfǧÏ?v?)­ŠCë^np6qø±‰5ŒÚPÆYÙ×%€ü™|%JÄ#êÒVûIîz\÷ØT4ÝÁöì{»ß´âóЇ»± Ç Ìf~š¦Ã°ÁïÔs0 ÇÇW°"9©{E-<=ÎÂhôÖBrÊî©~\Ô¦s/d8©:A¾¨ZôDïµ0p¯‚89UyÓ¦õ ÃÈsÑéŸÿµ©é_ÉÅ~þ·_ c švÆøÍßçâü¥ B ü/„üÑendstream -endobj -2392 0 obj << +xÚÕX[oÛ6~÷¯° ¥‰Eê`iÓ®)°ÌKÜvƒ›E’caºU—¤öãwIÙL,§[ƒaX‹Däá¹ñã¹a–ÿ™zÔá‘„Œò0´’ræX×°òãŒi[³ØÏ‹åìùk_XÌ¡‘YËõNG…Ç­eº"/ß/–¯Îç6眰ˆÎí ÉËw‹9#Šº8?=[žžýˆ3DFÞ-pùçóyÈÉR1ží–zq¬fœ:óËåÛÙ«åÖÓ­àU„n~š­.+…-½9”G¡u c‡2X.gà'õ×óbv1ûe«J­ KIM¡âñz!߇…{,Ì )ãVà9Ôs„„å$îãu^dGsÛs=²úȸÀŸßÓ̾ÊûnS78mÚ¼ê¿ÅÑîþú8rñWyוW}×7mE‹“KD\²z)äëj_?ÅH24ÝÓ´(¦ô¿ÉŠæ©Úé¦h¤î篙‰˜Í…Ú‚Sá+Èγ¹ÍH™•s7 Ws~KJ ñ=L#Ÿô›&L€$¸X—%~â +è)Ò}rÝffY×­¢õXϱŠK=º›»!©5I#×*tEjœ“ºCZhä­ZMLÑÉüõe­"å•âéz¹‹F"lkLœ/pOŸ!q„˜ LZÎ;•I-7XŽ;Ä\‘ + FzE”c$J\’LZÕšÊýL)߀L ˜ƒXZµóDÊd)=…¾ˆ(ó£G+ŠÁ#SÇuÌÔa.å̵|Ð@0 TÆ(8áQ¬'€9C7§ªWÙÜ÷É…œd D¨CÀ.‚YQ蟼ŠqÛMžh‘F+Ò!„‡"U ªêT”àm§‡'íhýf”|ÈÚM¤ÍGÇs´8›´ÍAhì‚.ƒ ðGpÇ3Q|4‚^àS)¾Ûài›$)ò AöߵuÝ÷þiB¢¾ÏºL{ªæFõ jsç™"u›ºë% ÜÀ‚(£”RÖC’d]·ŠâNI€‘êûZ}ïû°39QA<ÊB÷^ýyTaÄ +ÇÛ…¶p¸J oœ\å:•„#|wjJª@J¯ K&<Ò™âjñÓ0ðv XjÁÍŠm¬}w+GRK;vÜ·ô• r‹¥"ÖŽ ¡WU ‡ªªõCƒS¬* +$7y'¶ÙiµQ¨t£¦ƒLÔ¾É Ý@œ¥Xc[Xíx@~à €¬?`?­«gs6:^í +“˜îgÔù]]‹Q´Å2ÿa \ …*gÙM^"@Enôp,æ8FdF™Ng¯yjJíTבæj- a/qÅ¢i{‘G–º÷àj]a2 ¿ 'iÅ6·æ›"b}^W®Oâ±LÏ7Ò ¨ï‡ bpòÜ%C‰‰ƒ£¬í&2'p©ë0-²×J¤ÞG‡‰*Uc #:ð ÅIŸ€iß%æÂí0xè^pÔp* Â ÿ†S2¸çÒ ðîEÃØⱯ™¹šµ‡š—€KˆÇ‚GK¯Ás¸y î©aô°y£ê^ª1UýF5‹ñF —ºÁ“Ž YD‘ý,"ïçܬóõâÌ×Z~ìl>ÙÄÝØ®ä…HÇ]‡¡è${ "(S¹“Ô×UþG–Ça¿ žÃ}‰ûŒ†"øº¾tõÍر';‡»×äôOõ¹–%Âè,„p G13Ývæhe¶u+¶G£¹ýw±_ŠÝŽöö£O·ËÚí†&®íS·}íÝA™’Ëý¢Õm F N3Ž¶ê¶WŒ'u•Mq<~"΃.X–p_´ŠÈbš­¦œÏÔ[gu›¦­ñ>S·G«Û¼’¤¯ˆõ}$J\ûtž®>äUZßvŠûl©¾ŸCj[ 3 O »§ÕZ_ȸì9A·,¯÷PÆKý6t§ô›*Ïð(5ó—ô¸M6yŸ%ýÐneþɾL»‹¸ß<囶7í¡ò¿ùÆ÷þOü‰&ÂêN>áGyñ¤¿ß]š†|÷¼ÿPpá¾ÃF_p×®Ø{ŒçÙsø/GKúHendstream +endobj +5482 0 obj << /Type /Page -/Contents 2393 0 R -/Resources 2391 0 R +/Contents 5483 0 R +/Resources 5481 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2396 0 R +/Parent 5487 0 R >> endobj -2394 0 obj << -/D [2392 0 R /XYZ 85.039 781.388 null] +5484 0 obj << +/D [5482 0 R /XYZ 85.039 781.388 null] >> endobj -314 0 obj << -/D [2392 0 R /XYZ 85.039 720.013 null] +1682 0 obj << +/D [5482 0 R /XYZ 85.039 649.169 null] >> endobj -2395 0 obj << -/D [2392 0 R /XYZ 85.039 698.816 null] +5485 0 obj << +/D [5482 0 R /XYZ 85.039 614.419 null] >> endobj -2391 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F20 1617 0 R /F56 1642 0 R >> +1686 0 obj << +/D [5482 0 R /XYZ 85.039 434.517 null] +>> endobj +5486 0 obj << +/D [5482 0 R /XYZ 85.039 400.373 null] +>> endobj +5481 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2399 0 obj << -/Length 2431 +5490 0 obj << +/Length 2424 /Filter /FlateDecode >> stream -xÚÕY[sÛº~÷¯Ð#51$.¼tÚÎÄ'NêÓ‰“Æîø!'”DÙj(Ò%¥xüï»7@¤DÙîœöáŒgL`w,»v¡xÁ_<Élé|’fq¨³l²ØœE“;à|<‹E"š˜0J,²ÎoÎÞ~HÔ$ŽÂ<Ê'7+¹Y~ ~ùÛ»/7_§3­u‡ÓYšfÁõ4Þ}:‡T¼eæ§küªàöòêýç©Ê‚Ûkf\]ÜÜbÿó׿3áü+uYæòê#S?þóòýÅôûͯg7=g&4‰F%ÿ}öí{4YÂ>~=‹Bg“GhGaœç“Í™±:´FK¿:»>û‡Ÿ…yf£FL13± 5`¦£0ËŒ·IlGlr¹s<ášvtp_`ï'þ+‘bƒ¢fÎÕ ÷7ÅbªÒàŒ·®Kž¢©ù»EªŒëvsèÔåÖ±ŠíÈzÓÌ‚6îEú Ï2ŸÎ`±ÒÍ! -¸0É¢¨¸¿ÁÁE·-[´üd&›Åh°œv;oiREKv%þoa“ã¼°e£½nØYB]z ÜSU"9&ÿ)6hŒyÁ‚+ ´Í†Ù¢úÇ5›u ¼;æˆ4í" Hw‚´MAëàN¨?§{j{:ž¸M#ÊíV–@ Dƒ½ûc7_5UÅ–HƒG§2šho×MÍ{EÒºfŸ–ñ0ñÛ6é¹R¬M˜D‰8Ô·»Šö:/ªï,<ð;£Ã8ËE–í¿ õhfu¼–îOÒ0Ñ©¾™‡‹¦^-“‡Æ‘û-ŠMµßüŸFæ…#HÃ424yÁH·l6îÞ*txr,jÿ…?u3båª!üo†<´åªlÛrùÊa–F5óªògY ¤£Cà™é Œ®p´ “ØŒ¡†JC•jZ 7™Ç ¼8ÌqÍ=fä¡Áœ -Ô‚ç]“ס%i°{à/À&í'Wl\BãŠ9çsÍTÇâÍWõÝ‘ÒN#jõ¼Ê|_r©ê¡N -ÑÖ–L-–KѺ×Î…3vHŇᑂ«62 ni¦¥®ŽÉ„› ý^\ -×gÀ9R‹°dç°fË´%ÒG< ¯2CПkÁ¥)ƒMfOì…Çt,"’Î÷‘5€#èÏ‹X‘ÜÀ@÷ü‰¹ËrUì0ܶo€7ã-áÌÒEš¿_Z48j÷tìïÞr‰ ~!„©§ -P»e(s[Aöª‘žIbCëbS2uÝñ·¨h óùv9Ô»Yˆ×Ãc±Óùi„c§„*¼A›åp­BЛ¿,Ç^}÷ ËR RÖ°Ë™‰r0~Yü`±õŠIw{~‹]ÑŒºeZ[Þ­a=ÆÉÝÍ€m·mœ÷àB^u•R–TnÏ/?KÊ$àý-²àÀ»Ë+ᬑ$™ÄëŸG = Mf…Ÿ ׄr,ñ×f]bÖïq½½çd{¢óºöñWËÑ»‰vôå=´ÉCÉ92%£–ú0…¨ ·ˆ&Dµs×mÇ´ÆMɤ¡„‹Z¥ÕÒX4ä*Û‚”dà²W+FräN‡é„BðujëX÷°VÛOÜq8CCZN%U=¿S,C¿Ã@Ç £opÖAi›OxLØ`€§’è‹vísCÀ–)ž– -nÈæ,Ë“ÿÀ£YøÓKÝ"‘>l¼ü á<‚§>F¢ñ\xàÐ?Ùδ^„UÅ–ÊâäF÷×=—8Δ²ažéWfaŠnù±, ^¹…NeaI˜ÇæUY˜ŠõQFŽ¤±¨³ÙÀ“Æ2³8åÜ…ò2ýÊËžÀŽŽôå¼ì`˜,u:3K숑f §1½ Rºbm/6­ÇðÕô(푃RÍ’³â§ŸÅØc·FžÞ1÷„'Lóni“ ¬¸nÏ +íaØ1‘ņ“tÅ_y lå Bðfù~Û&Ë$zÝåÜ®/zº(Q:LSç£t$‰ -((ÊŸS(íËjÌaÓÐøòâRQŸŽžVlø+ÑŠFp,8pŸUU Q±}.j/—c²ÞRMš|_o²…Ò‚&xÕ ‡íè  ¨ -Žðbä£#ÅÞŠÙÇÇL—’P‡3 -”í!è¢ÙÈ´Ãâ:bïw8FƒKRYd½r -ºS}b¦ÛÇÁÒb¦[ËM&KŒê]˜¹$!´IÌP"¨ÃK¸ú*±ôùÙA\ ‘DFøüÆ3ì*¸·Á)jT™iž`IÁ¼ön¯Ÿ)2Dí…{Ì ÅøÍ`9;~çdäÒm@tìÙš\Â+örúuTDEI˜&Æ)£4TÔX¼?[@õ|D_•‡FôUCôRI/ŒU’à²ê Q=¸Ìs,΃KÉbÉH8)Up^¾”«œ4mE¸Y¹A< ¶}mƒüZ¦ª*nÐi¡SÎërÛ½9[œ¹÷w‰RȤàf;ç±)ú_ùÄ-IãQ²zÄ ls½7`Çï$0ø}F¦ªGÖådJ8#U8´_¤ûWª‘‡¢â‡s_•)Á-w¸$T£Ò˪_|b™FÍ0;c‰ƒÊSz"ËWŽz4iÌâaÒˆóŒ¤\(ç_É2õò+ÙªÁÕª}dùHÆàáÄÓÖk£·PlÃ,ÎþàOc: -UöGx{1;~C«å) OT˜Æêô4¦åiì¾r5S á¼ GÂC¥—2JŒè:€æÖ?@$ šÏ#IÝkDJåWÏ=“ÙßùLv{/‘¦•#‰JL!ÔsÀÍ+å}ãK¹ÔE%Ìøˆ[àæ6L•«Ö+÷¼¨ØøHD_`õ$¨5ŸÒàCœ‡v\5Ê»Îc NØ63—†vö0 ãS;cãàbÊ—TJI¹¶r?ºëʯ ¼ä~[f Ëy–„rxøg7•7Aw³1ñ@¦né…Dfx¤l¨¯ÜÒgÙe»q—*‰rYqâµê¡õûñE65p†…dYÚäôºƒ×š­$,†ž§´‹¼é¶LèÜ‚Í®Z -sXÆ€a«Ù_ÜØfûº¢'¨ñ(ò˜²l” ÇGpYê¨ÄGâ®sé„W/?xÜ}0¹)Ñì-kR.Ëz!Jiþr¸¥¢j×1hWMçÜ¥ŽoI¤RRÂÿ<þ¡à“ov®/o…˜P=4):Êð$@@]aì‰O÷ÙáïøaÒ(¸€©æi¤±GHŒ21§¡N¿ÿYBendstream +xÚ­koÛFò»… »ƒW€Ép¹¤H怮ã´.P×+èœ| )J"̇J®â½óX>dQNÑžgw‡³³óÞ™µœ8ðONBßvT4 Bi«0œ$Å™3Y×ΤÁ° Š5Àù~qöæýÜ›HÇŽœh²Xõt|ÛóÕd±|W?^Þ-®?Ì,¥”‘=³‚ WïfRÜ3ôîÃÍíâæö\y”âã~þåÃ,TbÁH7·ýçËŸ¿¿ä•²ÙçÅOg׋ŽÓŽà*B6;{øìL– ÒOgŽ­¢pò sÇ–ð¹8>mßSfŸÝŸý«#Åß¼ ïÓŠ¯BÛÕ±Z”?P‹ô]ÛsÔ$ðÛw<ÒËÏU™éª.ã"};³|ןQ kI<6"´wé*ÞåzëXï·ê‡Ë_Ç°¿EÔÿC4-ϱ¤sCÚó·™%ßõ6Iò,-5o²>ÖU¥ÿñ~ áñ<-wŶÎJÖÍ9Ãò*‰óMÕ˜½ÿåa]§[žû¦xÔÞÖ%ñѲ1${ø$•‡¿OËÔzÌt³©¶¸ìSÎ2m’:Ûê¬*ÿ‰‹b¿¬³/)ióâmÖhRèäíÃK´7ïåÐ,7²e肆•­æ&@ªt+¶à×q‚[‡®ÐX¥n¢DÝÀr0oüœ*Ìd··Wej¾¯XãntÚžd>»¼7.—‘2A\Û—Ñ«é€CyÎu†yNº¶’îò)E. +)_JXði´@pq§_ \Ðsç¸×˜pö 2LE£é`)!9ya$(Dò„ÆTó9Jm±Ø°xG²b¤2òF]ñ"æ!©fà"uMÛ=ؘ~É’ÖŽ²)àߥ§ôÑì{îëúêqH_îÒéË íÈ èÐÿàWí@là̘Ö:&çÎ÷ Ä.Z¿ñæ¡Øð:àu Px!ç9“$ǘÜÈ«j^£G BAy14˜-ô|qS2&q7m(-ÔÁJ,ê¥nctK%»œf$Tä‰U\dy׼⼆³_Iˆ%‹K²\€·oR:+ò)àóB"•Ôš!uJ,gàf $¼ðã±îÔÖJ,;LnSÍú…¯â=ˆr›fë ¢=ÝjW³!,TýyìŠ5ÚÄwÙ68Â': æ÷q=rÞBHñn D$@U†ôâH±ªjCÊäÚØ +O–ë£ígàV¾hh—/ ”ˆ(AÑ—_sͨâ†À¥:ìmn)Y±Ó¤m +"ÒÈÆÜï€)óÔB xX‚¸O¼›<0ÈPžëæL›P~Ûu©ÓÅÌ Å‚t +ÃÛ¢fСØÇö\§è/P伈sRkÌ 2×#÷ÚwDyà6(d;ò=â±d?DÓg$,liÚCw[–"‡½,ykLw=k²¤‹¸»ÿpË3Îcs÷ºb»'Ýû÷[Ø…šõ +·óÃZÛ +à Mkp^bÀSLLÛ ø”b¤gßÒL3òX)CÂ’óˆ`,¼ÿ|ÐNÿ?QËOg7+v–L›·’ª/›šòÜ@©J¦j|ˆË÷•qKãr]¦U|[(,I-j Š¬á—..3°Ó©éu©`|ó÷âEæa˜;þþ™†%Í)÷–NhêU#ö(§Ý; +y·z7]±ä£:ýÖ£ ùæQæŽK}ðÒ²˜AŽ‚2Q +݆€2ÏqëS)šV¾*mrÚc}Çv¥ÿvûçýuD2,>¨9“ÿÒ(:õ@P„*e‚üziyAí¸žû’ßöG ÿM³qœendstream endobj -2398 0 obj << +5489 0 obj << /Type /Page -/Contents 2399 0 R -/Resources 2397 0 R +/Contents 5490 0 R +/Resources 5488 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2396 0 R -/Annots [ 2402 0 R 2403 0 R ] +/Parent 5487 0 R >> endobj -2402 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [354.867 309.434 512.306 321.124] -/Subtype /Link -/A << /S /GoTo /D (browse-force-master) >> +5491 0 obj << +/D [5489 0 R /XYZ 85.039 781.388 null] >> endobj -2403 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [111.316 298.006 150.096 307.575] -/Subtype /Link -/A << /S /GoTo /D (browse-force-master) >> +1690 0 obj << +/D [5489 0 R /XYZ 85.039 554.519 null] >> endobj -2400 0 obj << -/D [2398 0 R /XYZ 85.039 781.388 null] +5492 0 obj << +/D [5489 0 R /XYZ 85.039 522.496 null] >> endobj -318 0 obj << -/D [2398 0 R /XYZ 85.039 614.89 null] +1694 0 obj << +/D [5489 0 R /XYZ 85.039 228.95 null] >> endobj -2401 0 obj << -/D [2398 0 R /XYZ 85.039 591.572 null] +5493 0 obj << +/D [5489 0 R /XYZ 85.039 207.75 null] >> endobj -322 0 obj << -/D [2398 0 R /XYZ 85.039 136.291 null] +1698 0 obj << +/D [5489 0 R /XYZ 85.039 108.73 null] >> endobj -2404 0 obj << -/D [2398 0 R /XYZ 85.039 112.973 null] +5494 0 obj << +/D [5489 0 R /XYZ 85.039 88.135 null] >> endobj -2397 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R /F20 1617 0 R /F38 2158 0 R >> +5488 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R /F66 3242 0 R /F11 2898 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2407 0 obj << -/Length 3603 -/Filter /FlateDecode ->> -stream -xÚÍZ[sã¶~÷¯póRzÆâ’xËLÖÍ&uÚõ¶±2žNšZ¢%v)Ñ!©uüï{nA‰r;M:ž1ƒƒÛÁÁw.P|Á_|™'a¤‹Ë,Cç—«ÝEt¹–ï.báˆ.M¥ 6Ý,/Þ}›ªË8 -‹¨¸\>ËrýSðÇ?½ÿëòÃW ­uP„W‹,˃û«8xÿñæ=RMðŽ?ÞãW·wß|ºRyðpÏ w–Xÿôß™póU™çöî;¦~÷ãí7®~^~ñaé­qaB“j\ä/?ý]®aß_D¡.òË(Ga\—» “è01ZêÍÅýÅßÜ(Üf.¹×Œ(&NB Xè(Ìsãd'32¹}ºZe‚WÜA{àÊ VÊ=þ˜r_î°öXruh-ã"jàžëÖ›j5Ôí¾Öm%ÿ<c2h_yàC½û6I½eª>“Ŷ8fžÃ _®àtª†{L6f’°wØ4í#LZ6Æ, -U19Å»å;%ˆu_uÓc -yLA@9†¦f7!ätƒœèªq»CB)T:çVxÛ¦±Šq`8è¹ÆZÇ£6LÒ*<9]ÙÞÀƒÖ´+ÅÙHY;Ñ&Yz㩧 YËl*Ihèh2*b£ÊÕˆX™b#R¦º©rM[k¹ˆ—¸íV× uKE’p±­í·Ên@MzP… -ÆÛ`9*™ú hi˜Y=}ªÃ#ª@Á´J@Fpsºýƒ‘…©žŠÖƒP ;°ŠåsšG! ¬Ìÿtš",À¾Ð‰ƒ~õê©ÿ -T3)&ÖYœÕidQlc°´-}`Ò¹ ¤OßË¡a½\¹JRw°Át86ºR±ÆMiS¦(Á3¡z;Tîݸ…1ŸÍ Ç[ <Éuæë,,T<MaÏ(è¨G7¬0a¡Sÿ†EG7 1*ø‘¢ƒÛæI6ÕÏ[AëÄ;_ã$CÿÍ=²+ÒK<‰#¸¯Ù*‘»ye–AήuMt®Œ¸)c³ï_ŠÞÉ·íÖ}Q¼]øŠÅå¥ìd@w¬PöòTMv%{¬ÖJ=v„í¨Å½gAç½r®Aº£såÇÎ54[R2yy@v>¢¿¤œu`àx³nw`iÙH ã 0ÏN¯Xõœ¢ ¼e…U6t=`jqÝ#ñaih/±Þ±OØî"öëH‰T–†)¬Ì—$‰¼f”žncƒ– özœn9‡;‘w'œ«<^ tâÎZ¸"•Ø ³ß“ž¾*É3ÁUûÅ -Ûœúf~WÒ7$–bEò4Œ35‘ jqªGGmKÍœ¶ßS+ NÓ$ ìl©¡Š¬"iáÿËû;.´2x›1ÀB­¥ž7Õ{þî[!”MßJ‰?¿õò°‡&Þ!ÊàG/¢Ï‹ƒ=+×qúaôàpפ[Ö$RÄp@+»¯†³N#\*f¥ƒ)Ö›ìëÇÆ`%ánìà CØlì;ËÂËŘwê"K?ç,÷ÌÍ3(¼Ïwσß; c¯ÚÍ‹V‘˾Ë-h>³mÿPŒ¬°¥Ý[:éJþðè02:àF.yÚœdcô3ŠKÛì,”ØË•Š9²E_ý¿éÔµãÕYD¼ÜÚ3Ég6ùÐ;Q½8½!^\Èï{ò ¡|9æLCM¤ÌF9ªÄ™g·€· ²¥8*`qŠ -r€Äco0”ÀŠ<(8½Xö"¹3³~_$€(ÂeR‚ðÅþ6Ñ'L“ò•YÒ"Öp -I£Ø;=`)÷GŽoO(4 5‰Î&†iºª\¿Ú ª™]:q‘;OßÈÑYA`›sD ÌûÂÒSIÇ…;‰/·q@fùR;[& åa€u õ -«|ðŒ3xýÉò•ûÕëÄh;¬›HXŒù—Óm¹”[Y§±ë*ëPôl·®§Ñ¡èIôÀt·³£¼#D5aœc>§f.i¨²PeÝ&w)Cm1XÜÄO¡aƒÁ(ÏÇò3¹v4t}(NKÉà»&ŒäPÝ{­“ÕÚ¥¨‚Õ7× -Æ<{;»I¥2¼°šNÐë¨Èæ·cÀöG´·ðØTÜ…à «¶i@=kÔÁÎzrRÜÞÔó ZiZ]̆òÏv -/¢¨l0¿g4 -ï§NŠ“IíÊt’‹íÜsE,÷Š|ƒd’“´ÖL®n%=æBÄ$.‚¿ã  Àç±sPŒuý½XHåÊJXéy Ö¨aù,ÎÏúô8ºdÅ´‡3ãN¦ažÍøÏ:wi*ÿ?¯”ìçüg…‰¶9—z.+«03ÿIV$ sç£Rn®n^ysëꩤãÀur˜¸(%댲4äLµN­Š9õ"Mæ¡vŠ7çC›»v¨ØW•oô6±ÏÖ%D±z÷iÉL.ïÔ{Î4ˆ[ -ÜR¸y³Hyô˜Õôø¡.ž± -d0vÉp'Ÿ7] nÆ9·hÜ(•ÅõáÚËhÎ˔Ζ¡”tb)’¼[2ý^ðœ4eö‡“Ÿ½*“Ä"áTnÜÁ²m¹žB[>†ãŠódóLçÌ(®¤˜‡ KMírª½Ÿæ”Á§žËœ°Ë=)éaoýùj'›G(~æƒvåºâZGº´ÙRÞ,÷‘›ƒ,G¨Õ¸Ä´YßÇž^r=ÐöÔ Æ`e’ÖÁŽ~HϹ˴Üã‚™,ÓéK†Ä%Ö›-£ô?¶O’½÷ø9”r5X.û~B·Å½«àÐ+Tš--å[÷NCõ$)H9q6Eo§0T’x9p¨Ð¥ÂFA9ðäØiF -® yq+…Ó×ä=Nc"mšüÂ-œ-Úlø<‡™…B¸*iêbq‡ÇKk“{I7ŒU¡Ñ·ƒ7†ÐP…¹žœü¶&u•‡1ëG´K²ç6>À:9©ZNz|bMßZç™\;Üãß³9{ŒM1ŸXÌÍÙ“$LÝ[¬]ÿI6‘÷ƹD£Ã,O§ï •`ìé“ž — (é?Os-¦Êóè„ÍzI„ñùä,ÚŠñ2¾ñ2ŠÒ˜Tðr&F½þÁSµ²g^Û'Yê>“`ÆÉö6GÚÔÕˆ{¶ƒ‹\3³ùʃïÚYJnÃÇÃ[l»»? ¾²Ÿ1>Oäe9ÁÄ^ß:Ü4iÜUà øIžɳ{‚‹\ÅœíL -Ozƺœd1¦œ”ÅÇB»GXÇÒÉæÈæ©\¯ÄlY—VV~ -»]5¦…¾x×ëÎÁî n?ÉK§¿£ëQùY ÚÏî0þòúäNZçK{Nõ×3¿ÿP± #UÌE5°zMä›M|Ýå¡Éîv‡ÑOEâ$u:§ü"I̹b›Õ˃"7ás$—øa)ò-Ûö§†k¦ÔÂ>Õ{ ŒJ•Ã¾DÅhì+¨,d¦L,jf"‹W7 T@˜†@hŸNsŸ'¡ ç´%¾ˆñg,4Ò„Úˆ“'†{ëòó´ÏÞ]W%#¯öÌÏr|ăüéÇÄÎ!k7V‡žHZó@z'à<µWקnr|}öºeI˜eùÿ'àbô懊³^d–ÌÿTl8Ö a^"2ÄiŽsòØÊGE¿1áÐUå)¬Ç&²CæšæmNômK|õyS{¹û£0N _6 Sm¿#šC XÀG~ð±mîéé/µ<«cÅ*Ž){‡¡¦{Çý&± Ü@M»˜ >\.ª˜}5Aº ”œhjïŽã|þÕù}Ï]êgþÒ;×zLFŠxKË6HaX>˜*Î…ôsùáÄÀ~ÁK78'fþçµ"“ßöÓU£ €0NÀo^þ)Ÿ¿N䉧ï_ªº²endstream -endobj -2406 0 obj << +5497 0 obj << +/Length 2087 +/Filter /FlateDecode +>> +stream +xÚµXëoÛ6ÿî¿ÂÍ0DjVÔÃ’ú¡Eâ¦kŠÎËbçC‘cѶZYrõ¨g`üîAÉJm†¥(DÇã=~w´ìÛðOöC_ØnÔB)Ü0ìÏ×=»¿„•ßzÒp Ë°Ãs9ë½x;òúÒ‘õg‹½_x¾ÛŸÅ÷ÖøÝÅÍìêv0t]×’‘ ƒ ´Æw7iM™zs{=™]O~ÙDiÝÝàò·ƒÐµfÌt=Ù/_ü~yÁ3W؃O³÷½«Y«i«h¡šßz÷Ÿì~ Wzß³……ý-Œm!ayÝ=…ï¹fžö¦½?[Q¼æõy×1«øn(üÐ=4‹ô;f‘Ž+GöÇ^’]f+ †žçZ«¤âÁýlzÖÅå`(­OLòùS%kÔò9Ìi݃®&`VÃV œÐÚ&säÑžð‘À<2ó1Ae±9ý +V&3\ÂQ#Z-U’íYÁØý¡¹ÙP¢y"ºÎZóX+öVrvQµÐa8Þ0q m¥ qÂu£0#[>†²·cwí-áJ§? +B!ŽC=)ï éA‚âÖÛk[y]Tš¬›U¨ý(°¦•Þðè/Û· =Ï×k¼š +>1PåK°IkMÄòð²lZœÌŒËŠEÝ \ ÖÔ§.@ÎxþÓ—Þó ²æÒ~ |dï@oÐg-Þní9Žõ†5j倎_Ñ!qLnY>Ci]îpÍ·²œÂŠw8ÎkœxÖ×Î’o‘ñ¾#A;r7Èâ%õßöU<ßÀba€Ãæ¼”`d–H¨T +ÃTUInh¨@}ö£¸Û«©ƒ×ȳs< â>c¯Æ¼f"‡ÑUÌlŠ‰[ŒÞã3&;…ÖûºUˆYPùÚŒ“AKÆôÀ¯´À+*ÌW'à Œ +Æi³Ï|+£V“(¸m‹×RijtK0®PÙj¥a¥UŒ +¡Õ1ÍÎ~ÿˆ\Z×xƒÛ)¡ooÆã×CZšL[ øðáê K H¾º=ãÙ7nW¨ÕŽiY^ñà Ågza¢£¢O&ã‚âu0vÏNdƒaz;OfC‡ç4ø!B€w~ɲ?#/Íþüƒ1Y*p“KÁ +ÉŽT€ȺʾÐÚó]0.@ð`âÓF0×X£ ý€˜S¨Jó;Aæèz>×%…Ý »`eõ‚§í²ç!»¸ÇPÂ÷ …’ìò ˜Â4ž¯rWÿŠ$§¿gLfíJ“3&¼zÅßßUñ"Í—/Jµ~P8åú!>q/B—Œž¼C‡§õ­FÓþ^èAY ûv„Žõm_‡½•×äB. 0À[‚·òŠP +Í^èï˜>eRé“JC}l÷i¥÷<§áÙ¹bäºMÀ™U’rULèh”W¨ô ZÁ<Û"F|@&„•¤Ïy†+‹ý0ã!f¹Zcæ=àè¼dòº‘•ÅM¾ÕÑꦀƒ@³­Í~•>»vo¡Å€úˆð‚(€0§bSC·JÚR!0H¶ÖD*±n’ûEI ö „éht¬~‰gÿñ¾œœÚ F7P*40Æî0x3¾¸ó äH_ÔiºcJ’•P–R >B>>B†Î£#Ô¢[Þ<Р»çŒ¬3E7.ðÎìnæ”Ös`©QEUò,_Ê`Ë‘æ¦Î§ +ýl¬áX¨pO[ q¢ +m)Ù5營¦| UþÄI©6Ó-߆˙©æ{¯¹T]Ï¡‡Ò䫹)5ˆ«Ä83Ï —GiU­^ÿ”# ]ÖXMÑA[Uò`2û<]Ìï&Ó»ñøj:}{÷᧼vÁ­3©_Žr,ÙÐ9i3MgËO«•ªøѨ›ö®#|PÛæn¶*¯‚4`–¹ÊX qJ#Ý ¾ÕºÖGÎvØ ¥‘‰ ð‡¯¬!>³Ï„[;vhøŸ³ìú ÍÉ´ÝïçûÂãíérƒÂ-°†Ž×,ŽnÀ$Eèo×Ç”i.sFƒ5¶{TM| \†ÖCÍzy2¢;"¸slAZ4YÇ9aMb|œg|Ϧ¿Ä­”dðý(™¸i³lvîÓÒæ7çÔ0‡‘=øŠ]kÔMpv^d³aÄîFÂè8@Á5`H:½Ù`ÍŸòì×xRj€Â ú­Ž\/0øÎ.0Ñ_yâÐÛ]ß®Ÿ#¹g êë¦îskB?49y¬zÛÚtªÅf>Oè¯ +••k])ž'æ{w^äyõk©ç…®Î qÎßsÕë 7¦pØçÿð`Yà@Bóß,©P>Na³?ƒ×ÞË{fýtÞÀd\<;7¹ÈL+“¢Â€Ö_X ÷0Øô}.ÿlCE'5”‡g¸ûj[¨c–lKøÿcÏ¥®6ݾŠÍq~¢vmáDÇšiøÏöýO?Üí[rW„nt¼#÷G8²ÑÍáxîú6?ð(ü/¦þÍendstream +endobj +5496 0 obj << /Type /Page -/Contents 2407 0 R -/Resources 2405 0 R +/Contents 5497 0 R +/Resources 5495 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2396 0 R +/Parent 5487 0 R >> endobj -2408 0 obj << -/D [2406 0 R /XYZ 85.039 781.388 null] +5498 0 obj << +/D [5496 0 R /XYZ 85.039 781.388 null] >> endobj -326 0 obj << -/D [2406 0 R /XYZ 85.039 437.34 null] +1702 0 obj << +/D [5496 0 R /XYZ 85.039 689.601 null] >> endobj -2409 0 obj << -/D [2406 0 R /XYZ 85.039 414.022 null] +5499 0 obj << +/D [5496 0 R /XYZ 85.039 668.4 null] >> endobj -2410 0 obj << -/D [2406 0 R /XYZ 85.039 204.486 null] +1706 0 obj << +/D [5496 0 R /XYZ 85.039 599.602 null] >> endobj -2411 0 obj << -/D [2406 0 R /XYZ 85.039 168.809 null] +5500 0 obj << +/D [5496 0 R /XYZ 85.039 578.401 null] +>> endobj +1710 0 obj << +/D [5496 0 R /XYZ 85.039 498.176 null] >> endobj -2412 0 obj << -/D [2406 0 R /XYZ 85.039 93.031 null] +5501 0 obj << +/D [5496 0 R /XYZ 85.039 474.858 null] >> endobj -2405 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R /F20 1617 0 R >> +5495 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2415 0 obj << -/Length 2742 +5504 0 obj << +/Length 3238 /Filter /FlateDecode >> stream -xÚµkoÛ8ò{~…±_*5+¾ôXà>4·Ý^¶MÒKR‹n?(¶b ±%Ÿ$_šó eÙ–“ì.E*rÈ!‡óž±…ðOŽ+BŽâD -$£éê$Íaåã‰t;‘adqéôæäݯ‘ÉP¤a:º¹§-7³oÁ?ÿõþË͇«ñDk¤b<‰ã$¸Ëàýùé{„šà/ž_ãW·g¿\ŽUÜ^óÂŇ›[œ_^}bÀéMyÏÙÅG†~üzöˇñ÷›ßN>Üôhœa"DþçäÛ÷p4ƒwüv -&£G‡B¦éhub¬Öh7_ž\Ÿü»;…×̈±X11**†E’˜¡=R x- =¿¤à—ûOH„IÚþ‘Vk_:ñq‘—ã‰ŠÓ ãÏtY˜×ò¼Î§ã‰ òâ¿Ì€&¡ß<«VYQ‚¼&¸ç±˜Á0çw0¬+ÄylèÆXMû†)œˆ³Ë7MŽ{kœ%AÖ¶4]­acënn+‡1eºèðÙ‚â”(Š”^G À­hS‹€$zi¡……EÖòdYŒñÜÔ™Èp‹ÅrɸteÅìɦn¹]ð«q êyÍ[ùÑ5s­v;+þÖŒ7VKÞàOrƒ‹¼=Åõ³KØy=ð¸2[ÁV­â ºÇ¯\|‹VQ°¨šLÉd ƒ–U9çCb&ºáF~½#qËë|ÆëEë֑³Ëk†n©y,ˆ­}Š-완&M¬a˜1ËÐF½ðeà™Â³·¼LÜAŒ—òWX@8ºCåð÷dwËí¥È{º„=™àžšØØÄ`|ßXDfÐ|U ®áÁR$*êLNÁš)ò`kr©Ðn³ #kÃà¢B-×Q ôÂÈØ´<¿k²e³)H†4’vÎfµÓ~`EÞPìè Ÿ£U…¦öy÷p†Ú•DÁ -¤Ú ¿“8(½r´dß´V?ðNg ïÌøóSøÐ+d,‚ï¿«áq%ÓÊHA³Ú[7ÁþmxbrTä?²Õz™ó¤p„-‰r0ÍE!œ& Ëë)"OtlüËyâ FM[NKq¾®+|Û2_Å(Û€Šßž0&O¨ct¯ÄÛq¢q"ƒ‡y]¡j¯Ý.F›xKhxYµŽ¯Èà B*ˆÍæšPéävØ=";Â7—øÓ3v–:±à£g<`6àʆŽ0rOk{bÀ¡4ηãÉ[WÓ]Ãjƒ¢è1w¢ñ—9bZv<¨èUŽÚGdg…¸o†çUR3 °âéN¿¡¦ Ÿξð—Ê&Ÿâ8ªîVc-°ÖÛ&]fìc•ÊƒaèðK! ;~æäwâ­CãTHsŽ•³U1z{½_¥*pý fŽ™*!£DH!Cj©¤ôOÁ@Ê?›QèïhŽ}GS‚%µbb -œyÁòܵ}JבqXÛ«•µ "må!SxïŠË‰>»h\ó¦i¸”€Ãç\¸ÎÍd—eÞrWøâ,*"üwÌ]%ƒÛ~M§"ÙiâîȨ³ñÿ)gAÛ~¬îÎU6ÛBtGjçàƒÂö5Q¬D±W¢XuþÇû -D;‰H×gzb7tƒ³[„í5òÜm›šW{Q‰Ã ¿¹!ŒÅP­ r ùU4O<̺ÊO}Óv.})*’9ë,²¨3®¡ûnã U¸®.p×lÓ¼>ï÷³Úí)8ûÆá£/ÕáVWW#øâò†¥+–žm\¡Á¼/7\ë—ö ¬ û0K>̦e ™Ä8P"Mô_vç·Ø*ºDr®>áâ N¾1_öo-¤Ç·|­ë†z9\•Þg]Ï…ç¬ù%O:“ö^Ÿš¢x Õ#nLB(yÒs“ØYó9•Ûºmß"Þýž·‰0©éËq›‚…GòK,B`‘Z^qÒoü¤½–#Ï;­?§8t"ºëaÀ^ÒŒx›ëx7#ÅùÑŽZ‡W%¡h½ðÎÝül/Sé>Ì¥T"¶êxUdÒ£¥rœ¼®TŽTϽá[“Gš•Jä^áé3„í¬Uäܸ@¶¡ˆM¼£÷œÓYÿ“ Ž -÷]atï.vÀ™‚†\Sóh¨+†­î7 ïØ-¯°c¸wélª;ô±àžžíü/Žwšˆ–cÎZ>ÇÛls(//>¡¼ý‘†Ü‡oç(SI?ìfôD¼W‡ñ¯šúŸf`ÓÂýf SÙs˜o¯·¶ŽWºöpŠ©DÇÉe›uεêXKm $ÏûdÆ…sœºãK¦„ø<ðÜ@ÛsûÓ¼ŸE‘ÛðêÖ?ãÆg -ÍS×ÁÌ~ &‡¦•$ô«Ôa‡ÁõØѼ¼IÌ æ¥ÂøµM‡A!‡ûéáÈ=øïýÈŽJm:î=늬è¤r7åùwæÙ*endstream -endobj -2414 0 obj << +xÚ­ZmsÛ6þî_¡Ë—R‹&${Óé8I_Ü»¦¾Ø™ô&ÉL!‰–8I•¤âxîÏß¾iQŠ¯×d‚ `±X,vŸ]JLø+&Iä2ĉðe’LÅY0YAÏgÂŽ˜Ù!³Þ˜ç·g?h5ŸéäönÏ'òU$'·ËwÞ‹Ÿ.¯o¿=I)=‘úÓY'Þ‹7×SáÝ0õúõÕ«Û«W?⛢ðÞ\c÷¯¯§‰ônyÐÕ«}÷å/Ï/ùMúÁôÃíÏgßßv’v2€T)ŠùÇÙ»Ád [úù,ðešLî¡øº‹3Ó”´ï›³›³u¬¸OMxÖ˜V"™øQ"Õ"£žZD”øBNâ(ð£@‘ZÅr:‹ÂÈû–«¬ÝÖyÙf5¿çuݸ7Xh&PŽ”&Þm̪ùæ]ð9 ðχ‘!¥)²oÞ½Rῶ6eSd­Áf;˜ÑœeÖ,ê|ÛæUyrê¹}¼¼~9¶ô¢*Š¬l¿y|Ã;¹®šö†xÏnë,Ÿ»ÞU¶ñ6/_Ý^„ÿ¸øíšX^ü úÊ›IEÍ™’¾–š–yF!¼·` +çh‰÷0 ¯ÚáKì-°Ó”ü²k2l¤^ £×Yƒ}O¢q °)—ÐG=ço×Ø’^»¶LØêê<£¹ xµÉ,Ã{”ÃFyºBÃÃG‹–2Ÿ´-˜¤±ý™y˜íDˆùx ž/©D-G®hÖ3ØR˜ÆÞ)67üjÍÔ´(LUÂq)Úãr—ÀÎ4uÆWvèïâÀ# ³O(Ëlž¥¡#=¼âpJiØáç# µ/;v[k%GxéÄCýD^ÍÚn oU*NýPÆ“Hk?QÉ—Cˆôø¥±2s¼f=f‡ñA%¡¯cÕ­ˆ¢åå]å³W N©ÃÁ)Žonc‰“›¡Áýe»ÿ¾çˆ&cEAüiÌveöy §œ-1è'ù’hÎæõ¦Z|0ex8ZE1 +Xš`P…ñA’Tàó}×Z0P´ð.°G{7CpA´!ÛZF-N6 äý‘)a0á!$²à’ŒL.ݹgK +°0 vÙ¨êÖ'&m3ò–h-{@k +‘B'üÏÔK¤ šJ„â6¹[—wì,Qzs„V–IÐ’ÌÉVLvó‚qÌGb^Úµ­%cûÈÿg¯³UÞ1®žáµP÷b“gVšûÇÎIHC­±Íc„›É(„‹ÚÜãd5*)s§’($& !–B ¤® +~!Ž!§àIî³Vvµ6ƒAGCÖD^¤¿Eë-6ûs—œûŒ¥#³PúŠ†èë¯@LZÇQR"!|‹§áLXVF_Â^¡ÿ”¿?–qè!µ„Ä"= =zcŽ#%ðè¾´Eœ)…)=ÏK3•œ–š@E@ÇD‹?§«½1#Å9'š~ ø¤ƒ~Òå Cù° BA@°¥j™¸F³Þu>®dê0àšù&#ü+ñR<ô¸aã¾ÎÛ6³szR] +_çäDMmçtÊr{övmƒöZ±=ófú—âòæÅÕ3®¾{†=Ô½Ê`“Ât + }ŽÏ.ï¨pITTÉÆN¾Ä@ãXr?×ÈJ®c¨¡u ÷p…ÇJ%–¤Ô +"øXUŒî‰íÒv¹  <¶µ­lu%»åXX©éØð"bÏ=ß¼ºúÍÆíÿð£ï²•HÀ/qùÇMa­s»]S‰HpXçä+;°#-ò¦[ØÁžm—8ŒÑ@¤X“™Þò1¼W˜¼Ü*›É8özÅ¡úQ°E•Ñq åE±3À Ì²eÃM‚D±†ÞÃ|¹3Mûwh‚Eæ-“ê…8É0ƒõÖÔèÈéfAâÖ¿Y´s§M1•Oá8½åx V*í|/¥-T†£E»ò]åòDS‰fP3†Šab\Ó{Uv‰•®¸Ô Å †4\"ŒSg~ÊIŽ²8ÈpLaJwÈqÂ9@µk áµØfC®ƒp& Pnºe× ‘`;€RÛ”„Ëytòtv@/òÕÚeZôÓ*&ÐÙjчÅÙŒÌdÑÓªvI€¶PÑc7T<ƒ/­ÐâøÀ›Ò@­õD?éB1ʲÐÄa3*¤æN ÇÁ<‰zu†4àÃÖׄWo`=?¤] AÔ¦³Á¾júÕÔf^‘Eøº3Ó S}$¦àz€¬»ÑÊ€£™v£Ðé‘:ÏF {Õ`_¿Lé¾;7#ð†Ñ5'av‡÷ˆíÊ}›ë葯¡ê8¦-š‚”=e}>×{Ú ‹A]Å¡ø²ÅàAè +™“][{r¾›µøÃ"ûô¼áþ{uôÑ6ÓVE–ÖãJà +ž[Js±èßéIÈd¤(e¿Þ<Š@ÂÙc(, °ˆxêôÆGa"E£! +“…ý­ ùŸaD +€â´tû!Ç«S"F½‘lWtãì'Ù|˜>Ä µ°U¾º5ïŠ €/kdáÈhúË%O¹œ]’sx9£=ŠÃ°ËëCìh áîxhµ/IÔ<’sfhàÕÉ,B4úø +Žèkô ¸³\U—ªª0ð~âJ­×+Ñ£Î" +Õ¡{D‡/kƒy9¡M-öÚä—  uøX‡N;Ä Ýåe5¢]áòŽUf`tXãÞwÛ. ^²#Ã]a~9‚È.çà?‚¡RÚP\x³”!ùïHC¦9ñ´á?®“áוþø}Ì.b?P.ź_çÎ%ŒwàqOÖçÄ4WÝN¸°!m]ðªŒ[€K²à†,+~ÚðLjÒ0 [eÜgìL.÷ÑçÕصؗu…P mD¤íõU²OÎyàþˆ Ðœ3àÊÚ…oëø÷ +w¥m4±eö‹¹f~uµcOz¾Œ0¤Cʛ̦:Ìc¼6K&ö?}ƒÿšq¹i,Cv_ÔN_þÑo JZ8íR#0¹=@`‚FÕár|ÙR¡Ã~^UÞ¿±> endobj -2416 0 obj << -/D [2414 0 R /XYZ 85.039 781.388 null] +5505 0 obj << +/D [5503 0 R /XYZ 85.039 781.388 null] >> endobj -2417 0 obj << -/D [2414 0 R /XYZ 85.039 761.463 null] ->> endobj -330 0 obj << -/D [2414 0 R /XYZ 85.039 692.86 null] +1714 0 obj << +/D [5503 0 R /XYZ 85.039 620.561 null] >> endobj -2418 0 obj << -/D [2414 0 R /XYZ 85.039 673.988 null] +5506 0 obj << +/D [5503 0 R /XYZ 85.039 591.157 null] >> endobj -334 0 obj << -/D [2414 0 R /XYZ 85.039 604.917 null] +1718 0 obj << +/D [5503 0 R /XYZ 85.039 508.814 null] >> endobj -2419 0 obj << -/D [2414 0 R /XYZ 85.039 581.599 null] +5507 0 obj << +/D [5503 0 R /XYZ 85.039 489.942 null] >> endobj -338 0 obj << -/D [2414 0 R /XYZ 85.039 528.401 null] +1722 0 obj << +/D [5503 0 R /XYZ 85.039 363.859 null] >> endobj -2420 0 obj << -/D [2414 0 R /XYZ 85.039 505.084 null] +5508 0 obj << +/D [5503 0 R /XYZ 85.039 342.966 null] >> endobj -342 0 obj << -/D [2414 0 R /XYZ 85.039 136.833 null] +1726 0 obj << +/D [5503 0 R /XYZ 85.039 205.961 null] >> endobj -2421 0 obj << -/D [2414 0 R /XYZ 85.039 115.636 null] +5509 0 obj << +/D [5503 0 R /XYZ 85.039 184.765 null] >> endobj -2413 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F56 1642 0 R /F35 1632 0 R >> +5502 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2425 0 obj << -/Length 3528 +5512 0 obj << +/Length 2305 /Filter /FlateDecode >> stream -xÚÅZYsÛF~ׯàæÅ`ÕÆàÆVåÁŠDÙXÎZJ\[‰ ¢°&­èßoÝ=8HÈImj“R•8ÓsõôÝ=0 þÌ"\/ÈIjÜ Mëý™·ØÒÈ7gFgx‹ÐõâCç×gÏ¿Žý…ñÜÌË×·<åzó³óÕ·/~¸~õv¹ -‚ÀÉÜå*IRçjiœ¯Ï_:Ïeðõ~}çÝÅåË7K?uÞ]ÉÀå«ëwè¿yûOœ¿å®Ì¹¸üF ßüxñòÕòýõwg¯®G8®B7Œ ùñìç÷ÞbC÷øîÌsƒ,]¡Í Rÿ»Æ3¿uôk&Vʇ`‹ˆƒZ—×B «ŠÆù„Ycš2ù (n ò;Çön÷(à^Ö+U02é1‹±†Õû=¦ŒÏFƒä6ŒçÕÑñÆy„&‘ä1 ;¿xs%€}¾“Áþ²buK‡ó·ÀK¸hZ¨{¦J¤dÅóèêm1µRtÆÄ‹[¹üTÿc^¦é®ßßñÿ-MlÊï‰â‰S™ƒ$u½T Yij>-£ØÉw\ÏKœ[0¿‘va)G½XÌXÿ›¨É4ùN§gª ¤Év1“š,B¹ÖóÊN~AÑ\'ç8Uð*w€ßì -°=ˆ”iÿ@Ç8ºöinòÏ´5f%¨áM¤mS²áf¿ÔAN“FF¸J?‡ -“>2­¨ Ã"F:ÃÍY&ò~õQô |‹LǶ;F¶–^Sl˶ëå™NÿЩĬÒ[YWên¥"ÛpÓªÄÿíÌM­ôúdÏ™¼Õ>¯ò-ìºGκÞßç] £¸+$¬n”×€…'­3×¹ ÊÁ²¡ØÈä®–Á}þAu–·eW ++ç@\Þ7ìUØ)Ž)Ãó%1‰Fb2wÝZÝ0±ª‘æ¡ïeíFn˜‹Ò>âGɾýøR­Á@KŒbÉGbA ïWßN–®õ™@ãźERsYtç˜yñ†Î¿˜]ÝJ— „žÜ ŒïO I¿·†y“¯§âF³HjxÖÎê”HG8Ä,pì;×wzΑNMÜ{¹!÷'nBáÇŸkî;±!M™[aæ¶j ),ö‰-”èM]Í*ˆŒ/ò5v£FO“ôÙ°ñŠ(8ò4¸8Í!U9X7išR€\æ›X~gYÅx R³Š-.¡8åмǜ ±xF´XUx’˜ ]Öq´!çƒÈh˜È.šœn¥P «ÇÀ–yƒ(õIOÀä™»z£YÜDiBÚzÐg¦÷€¹¹¬`õTËI1ñ®ÞJ£–a«MH%kLd‡ºù @&’~°k¬™èS/‚¶ó5†úx ;É:`Ù'@ëVÇÙSD“ Õ^åԈɻS/*dž^vìöe°Ç4³¿¯·u%£}”@èÙˆ3?'þ¦qðW‰?ÛÏ8ñÈŸYCf<§Dí[ÆYb# '®ÉñL¼–^^mTiŒïfá4—ÙÂÒsöƒvýU<4Ù”½D#´É $TÅä{>–'®e -³^’mŽ'%)#+TÈâ`i£2Fûˆºa\«5-Öyž ÓµžÕîgÉ…Ž†N›;›¯›ºíSÆd®˜Âp±ÛýXEu‘ŠXi;õ„’õ’á'½á¢ÿ,]d¿Ø4Ë(ëO¯v’¢3Ü…¶WÒ‚ÙåØoù5|*sY1_ LÎO¸‚áeXlý¿¦.° -²ÈMFÖý³80A‚Ô¼#B¯ÉÖüòSý¾cbÔB1„Z(–¾‰ëésmiÁÕˆn|·ÒÖp|¡¼ÑgŠÛq9µÏ-×'EªhTÊÐ"cªÆc}à ‡ ZñûTŠ¶M­”+ïÊÝr¨hÞiãåkžk…ô½Ö@í²a‹‰¾ìø8F`·³à>˜¥ö©¾Ÿ²Y•ŸÌkYÉÚ½5W(è€Tä…Òàéâ‰< dú,¦öY€R†‡RMwúؽuÝ4ÅZâµ4ëâN©½ú %è·8ýߺjW–Êè_õÃs¼Zaö}S«Ìùê‹êŒˆŠäœ éñP„'Ÿ†Øµ¨zb«ÑØà€…;*áÔä+A=Ç2ï ìr©eòiïyËuö”+ ZK'7ìE ׎¨/JæugY̸ªøñ)ruÉ2û˜á©€’%mìP -é‹ÀúÖ:~|Z‡ƒua3‰Q{*Ûd[O<ØÝž8…Lé£,Ÿy곯F}•iÝÇ·ÝFdöD›Û¾¶Ä$Œü>#´­%= ]BÚ~âÇjêqNÌkuUoS ñëƒNd¡Õ¢‹JÉ«Ñz¹âïè¿š´Ç˜2ã¥LÏù)óX -ðô3_—Ê°õêh_àø‘蘧2e Fÿ³DnØéʦôá½7JlðPV-ž )>äÕj -m›@Ã_„ˆdXÌ% ÆÄnØÝ:½–š¸Óa¡ëùfBvã!nçr‘Ì £ð4µÞîjÖþ]û~ü|¿Öš†ÊAJE³ðƒø„€8€n§Sg*_2 ÚDŽ®Pí¡Ö5% õ¼B¼â¾è%Œá-Ž`_êªéWÆùâÔcE“ç—G–샾‘´ýû;¸„[[S}ŠÚ˜ù^78¥øÑ·5”W»Aò{žY£Ì²x6G¦}Òˆ®òôó/òhiéìé.%ë B'ô†/’0n* IöÅš@ªãA1&:WÝÜgCÈÛlµøHhg&ÄÇAøµáaž_ìƒÅËšP[ŒJ™ë†¨ ø™t¦ E¿O’VeY${ú/l¢Iøæ¤_›„®Oª5ÖzÔyIë¡òüõK¦‘J-‹XhËfPýtò‘qÃØôª¿•RääQ>ѽœÅ)&†Ù)N“oUH„Èb…Gåo`燽ô_@ŒhYb¯|Ÿ£ÖÐtR…¶ïر7Z– -ÒXC&jZÉæÓÈ>\pH@*âo¡h ‡»û9”3)a¿Ò -'Ÿ(I(¶å;)n§1%P0üØïUZ·µÎ5~”w ö•²@(ø諦ۥqú5v´íäÒÝߎå90!ÞC®…ä0øCŠ†Z7&‹Uÿ9Üÿ®ûý÷IAà&q2ÿ™áïý–㳟ð…¾¿³3µ@ÌñÆþódÖ…endstream -endobj -2424 0 obj << +xÚ½X[Û6~Ÿ_a´/rÑ’¨ë`±@Ú¦Íd“ì4qX¤A![´­IÔRÒxæßï¹P¶ìñL +lƒŽÉÃÃÃsçGù3þù³4žÌfIê ™¦³u}åͶ°òë•o9\ËâNx~\^-~‰Ã™ï‰ÌËfËÍQN$ÂHΖÅW秷¯o—o>Í])¥ãgbî&Iêüôåvî;Ÿ™zûéæãòæã¯8 è;_nqùŸŸæ©t–Ìtóñ¸üúïy&…7ÿ¶|wõfyÐô h•¡šÿ½úúÍ›`Ò»+OÈ,íaì –ë+ÐSD¡´óêêóÕoQ¼Îx×%¯Œ.X–ÑËž‹}Æòà¹V}‘EzÎ÷!ý`–Džˆ¼\2 +ö†àµ(òœ/LÊf ¶Ç‰Ó«U¾¾Úç<¦ÂO²—u:òN~4‰æA§ cèô9¯çAê¬rÐÁ œnîúεjáO‡Déì‘X¼ß1WÎô +ùú¾R<£¬ˆq$Î#3ïwHY#Ånß©j"½ß)&=wAÝótèžkx¦7üûˆÚj<ÊL4~ìzU[qšWÀ’Ó©wVùÜåúc6ߊ3¸´øEN½„"OzÄ÷ƒ€è0Ó‰Ke ‚$°L¿{~ˆ>!½;ˆq†Î N6œó£ò0s‡†©ì0Jÿ}ÙÏ}rÐÍ¿¹Ù¢½5 +R Šè_Ù=ÿ¶†òˆ–:–”ó +GƒCÔÝžÙZJ­hÞÁw®/8ÂáGXP~L¦~ D§);‹D$'îý‚r¯ÏyiúU·}©›îOÿ¶iòZ !þ>F)H„UŠbþ¥L¼×p~NËPg!ÔÙô(¼Kσ|*;–IyF#°’,œ$@Ä»,k7l6åä_ŒÕ[•15q0Uܲ>Í%÷Þjp¯L¹y´'ëÂÊøÝ‹<£º^K(7ü»ÖÆ mëþ… scÈ0yâü·ÊØ蕇y§1ö{&Þ0m5f?¬¨‚iÿ–‡õX¢gùƒ Ól!ÝáwÅË”×êbjØ!kMS£êÎs‚—±õ% ¸Ôè}§D‘÷Ôý`ƒ^ß•tòÊÆ¡é S‚3;¦ùpµ¦lú#›îîv¹Q”ÍFEz!H%<Ý4jMigEBLÆäè&"›~£MÝMt™ž{×ÚC£Z¨ŠgN^´jrÖ¶ÖÐØ&h!ä|Uv½(ÔjØZž¦§ÃŽv#±%Aïòä¤I‰ÜÊ]•}·Óíõâ>7 Ý_P±²:¹ÕS~¸Twfïò6z¾ÕDãUBÑãaÀbèe±Ç òGëÝ€ ž¼×Ýðÿ:“rHði”ÈqÀ„ç€MB!ÃxŠ¤—‰øM$–I˜!–C ÇÎ-*Äàäg3‚(Hº1˜ectÍ漢 í\zŽ¡6Ò{À&=—tgûÎö9»¼X¤pϼhבçy|wrÒYc sL  êžÄxÛîxmk¡ý-&üÔ0¡V WjÓó¶ дáñÛ[f~Ÿ»2ï”åê±›>òVìÖIâ è1¶ÍŽ0ÁtÔç߈ €¸5ÝÑ O`‡½µûáEeØ© ‰¹U Ü>k¾ +:ðžncÁ„ÅM¢Æ{¸Ôß½“{§jó¢m¸:m©òN™ÿ¨>l«a,Ü{›Ï¹É«JU׋BÝ/ªÖ–€ûÆþÖ§DÛ.À“+†Yâ½úÒqQóšÇä!éMÚ1m_VÌèðžî:ÅNÁµa-.>5ßbh|±…w¢g"E ¥åÝà)º>‘Oã®Ï KnŠ3Ål–u% „G^³™†QvƒÐ1tÒi°yDN h©z·làpzáÒ“ëgòÊ+¼n|Dâç2åÒC9æ*ãt̼ +“ã‘Ù8óHe É0s’£ÃCgt;/ÖCÛ- U—"x-Ø^™E"‹Oí}]Á­ˆÕ÷å@ßa]¡z^=AÙsr²ÍŸÎâ&rÙ-ãðE›S€½^ŒÏq,û‚õ³p¢ e¡Œ’IÍÁµ›% C.ÛW¢˜ZFðµ' Žv^/ôØ3¸É‚L4™žE0DmìÓè'‚(xÄÍŒj]æStKÏ4Ýðim}²Ÿ¢05›t:fzw¨(—’F×àH¬­½6²”_,l ^ :Îœ›žyϱµ•=½ñ9"³ŒÞ/ÀEkÜyaF@øýîðÊÊ;»T¨FCoÊ{òÉw,„ùÊgâºÜ3kÛ÷UEÍØ› ;ëÐêÑ•š_`<3Šƒ<ú±´a D¥äá"ÜNŽ¢j”LÒtBÄàä#2?S`l#(~ÍÊÔʬÇ;Œ´›(åïç U^Vîƒó•u`è¥Î›Ï·8HœÛñzÊPU\"ŠæñÉ]ÒaG âãó™à;ÁÊ4›¤í¸ 0 z¤*˜iÅIÊk½fâY‚¿Õ‹É–½ ¤ËW”–´p˾qAæ‰4¶¸ éfk>MÆÈì¹ iÈKHÃò Ow}°v±ßïEE0hsÚlÐÿAX½-Ï5”‰ø&9Ñð ,çz~Ž8•cß[aè;ïw Ø<ñsLJBîà›Ù¶/ ÑUesÈ ¢^s§ÏîÊ~‘€P7þmbâ_” ñÁÓàÉÅ,9ûP@šÜK8=G-@*íæÕ¤5Ú͇OTkþžÁXå‡ïN0k' ~htèjKöÐ7_{øÓ'é’EöaÝRÿ 9[é³”9zè«ñúÉBû¥ ¶’GÌáòb{¬Øýœ°&ï˜ÀM,t–%w±ÐùG^ÛËIõ‡›è*ך·}ÈÉû((¿;´vüÚª7øý(ô=p<ÝEÄ_v—EÕi¾1Ç’ÃñèG‹èS!]/ˆ/jSÚÂMm¿|±é0ØX¤]CZ¬Ý1¥ý(1ÐR• HæiÈhàâcA?…Âÿ¬ÿ_úR|xpêLå3ßS£ ?ê‚þ +Âè\ßH¦"JåS…ÿ@Þ–endstream +endobj +5511 0 obj << /Type /Page -/Contents 2425 0 R -/Resources 2423 0 R +/Contents 5512 0 R +/Resources 5510 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2396 0 R +/Parent 5487 0 R +/Annots [ 5516 0 R ] >> endobj -2422 0 obj << -/Type /XObject -/Subtype /Form -/FormType 1 -/PTEX.FileName (./xslt/figures/important.pdf) -/PTEX.PageNumber 1 -/Matrix [1 0 0 1 0 0] -/BBox [0 0 31 31] -/Resources << -/ProcSet [ /PDF ] ->> -/Length 557 -/Filter [/FlateDecode] ->> -stream -xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù -ä -6\>RgÈbÏWÖ¹j[†› -WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream -endobj -2426 0 obj << -/D [2424 0 R /XYZ 85.039 781.388 null] +5516 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 87.442 371.033 99.435] +/Subtype/Link/A<> >> endobj -346 0 obj << -/D [2424 0 R /XYZ 85.039 665.791 null] +5513 0 obj << +/D [5511 0 R /XYZ 85.039 781.388 null] >> endobj -2427 0 obj << -/D [2424 0 R /XYZ 85.039 636.387 null] +1730 0 obj << +/D [5511 0 R /XYZ 85.039 761.463 null] >> endobj -2423 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F20 1617 0 R /F56 1642 0 R /F70 2201 0 R /F18 2207 0 R >> -/XObject << /Im3 2422 0 R >> +5514 0 obj << +/D [5511 0 R /XYZ 85.039 741.134 null] +>> endobj +1734 0 obj << +/D [5511 0 R /XYZ 85.039 327.573 null] +>> endobj +5515 0 obj << +/D [5511 0 R /XYZ 85.039 296.048 null] +>> endobj +5510 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2430 0 obj << -/Length 3395 +5519 0 obj << +/Length 3894 /Filter /FlateDecode >> stream -xÚ¥ZÝoã6Ï_ô¥ -P«E}mÝn®—šÝÛ¸zû ØrbT¶|’Ü\þû›ßÌP’m9»@áŠÃáp8œ/^ô /³Ø¢ü2ÍB?ʲËÅæ"¸|¤‘Ÿ/BÅ.­$1†ÞÎ/¾ý[b.ÃÀσür¾b”ùòw刺¿ù0¿þx5‹¢ÈËý«YšfÞÝUè½ùõí@­÷­ þz‡Öx÷7·ïÞ_™Ì»¿“Ûëù=úï?þCo?rWpnnèϿݼ»¾ú4ÿåâz>âqf}›D`ò¿¿ -.—´_.?ʳËgúü0Ï/76ŽüØFÚ¯.î.þÙS‘1{)³&D1s³0÷sOá˜Ô7iD$£8ï¥fh,$H<–Zî[Ÿd’¼â8ðîÊ®[oiŸIêíwÒhˆëNmÙüY6ǘ¹u}†±ŒÚž¯0ž8Íë5qÕ=Ñ*D6 hpœÅæʤÞ¾¸¹šÑ÷‡ô´Þ¼Üz5Ï5ížÇ–5ðž[A¹tKièãO`h œ[`Sô"$и‘–§w2bd>tQǺI•$  -q´9ï_(4ÂKC§“„™7¿Ê"¯¦3ÈC¯ÅxÙI'”›Sñ¸ç©÷Dõ¶ü®–±žit -ÓcÆÓ"ÁÐ õ^:tö­ãe¹ÔEžDT ½ª+êT58yf>NlºÞuà²Þ[yÌ\šÜB €üíߢ±¦$ÖÏTYÚ̓¿¨·+Á:Ð'›“s±Š÷Ÿ ´•ž_žx²ŽíLö\9}XtÜ,щº¹-…Éï®fÖÄ$ÚW†ÿþXÕ| -UûI ­R\»uYR£ ’,HYd„R©ÊJ Lý03—³(ör‰@&Ù’bÄÄP»ßíꦓÎÒ¼”턈f‰X%“‰˜Ì¿ heÓ«-LžŒi…vÂ1¸£Ïf { -+AC8–ÜSéBÈÅRQžÖí0µhŠL8h¡-ËU±‡Þt‡”YûJ¶ø­(ön”½A/©Ã+‚UU_±ì{,ábëì8ϽºZŽ¸DmÐ #X9·2èXéélÉZá{€_êþ ìé†O]ƒw×­Þ>VÊ\»|”}wåòpîì!ÎǦÐ-€ÉìÔИÕØkÊ{Þ'°‘©cÇDèCv§@(‘5= -'ŸWeѪóC·÷„2Åñ•x;>õ®?î@ìí×XµþZ:'/[Uýºâû¤Û;gçâÜéµ>o|â¼=òå"söLÄ!HœŒ $5~bSõ!baQ*†yr˜ØbšÀÒ¢4¥S!ø¤µ…AîÇYÔSãm™„”ÁÉ½Ü 7…4ðEë^¤„ɦˆq7õVdüöæý¶jOº­¦|\·3Uÿ<òÃèP]Ù@›Ú˜3f¤K4ÆɉuãE0Þß^ TO©ŸtÄØqXzïj™pû~®ø}\¥Ž*ì©J˜Ìø&±‡:‘äS:ŠN¯èÙ. -gF“ÁÂsí¦nJ‘83Wôà -=õI‘å„íh÷gl£O1l<uXÞÔÒÜs ²©È&œMaìέÖèwS%Á°ñÙƒ†GNÞNYM­z -;ö.=‡‚±Þq†5åûû<‹D½P·bmæͤ‘a…xtkSÞ0–HT2o±ß¨+-$Ègu%®“ñÜ>ºâ«\K3¢UwºŒœk'{öi˜(¹S+`·òëIäpœz¦Þê‚Æq‚€Q­EWÊç\Ô–Î¥R\2ño°ÉŒÝŽãÆùÌÅdO² gXš-gÜ•ø(WÎƹr¢¹r"éTšH®L|×›]Uþo¼Eqíþ¡WH,Òo>>Ô†yØŒâåÞˆ·Áþè9Øò™Ô«+¥gÈ{®öW.ß„„v©[’£×us7q¨˜Î‰ÈEGˆå]S‹Ü=森کÃ,8Ï~(Äa1f½mënbõlt«Õ‹ŒH–Õ­ë]¡IܤŒáqH5g8mÙa޺ƵúW>0XÃçT'Ô‡W{,¿oʉ zsTAsäÍfšgãèøiæ<ñÞ5ómëøHˆ66êŠðÕ”» -6)bÕ£‰¤¶r:tÊt‹a¨$š5ðÀã¥0Ý›9î|UX’íØLDô秵¤ Ò•E[ÍPÓœBË¡—R§&j[Q«Ç'ÐX1¨{rß#˜¨§ÒK™Ý3ŒáÁÑSX;ùdÇŠãû@è"ÃÈËÓèÃ^#ÖÛ7½irIK¿È $u&îÄ¢ƒ-Q÷d9Ã&)EÐäEóý¬&%§âw˜Ðe':Êé2PEfáBx'@ÄïÌ~&§ËrG2[ÑZê¿e'wF¹ƒŸ˜ø`÷oVãûµF"™µ‡µ9 -è ãí·2AW€‡é‚¬úø¸ç|À>Ì¢ÃvÆ÷xôt®z>v+Ê é âp -*SOK$˜yv㑈Ôq& ’gzyJGWòÜ9x¹>Zó‡àsh¢h8P±ÉGaw)cœÖŸåKÒ²WS80æ`%-£®(š -‡ªè‹kç£YM(´Š—UÀQÁשBçâP©-¤™Èãò£òròÈ\Õ¨„0ûÜ(ÓdÆ–”:uËpêd*\ënàkDòt‡_}€×›‚ïY¿IÊhίü–l³™ˆÈÂ0¾úIO´ÃôºÅ¶/ÎL“ME_ nqOuš¦i#?IÒÏtK²(F±‚¥8I•f™ø ÿôaŠ])Œf‡ñ9Rz6&8_ð”S2!±uQÕ­ôYådòq%Ãy,c|ù;ƒs;÷e°¿dÐwןi%ÍoNõߧv®x&;ËjmQ;Pµvvn¹E£…Ïe7¸‡Ç aTÆé¬U=‘c ruBžQk«.ß\#,0ù“J„àÃqYˆ€Nk€‡Ùð«uPOÔAÕÌ­÷Ýq’¯oÒ³Fy¿—Ê>kÁ ¥3 ¿Òþø¹¤®B÷rBë#úÊrÝÆ÷ŸQwaÆ@×P‚£ü Ì =õý§Kå¡dÙ+F†~œ¸µ8R hºv,u¿Ì A‡†¹JàvHÀq'Ó˜TŽùýX›ˆ¹nãÈ¢ä0³Ò,dÝiÕ†CÖ©ØàhÆað•ò€ÜRûZ^_ „9pCЩ=:¸]ýv7—Îí{êé÷[TjëÝ]05=(»(¤1©Ÿ'_VöG•ëDÝ#µ)YEeÜsµ IÞ²ÌÂdly\ãg3yçA+ôÓ?œ™³$ÄɈ'\]iU;Ôªöøµ%WÁ÷€SsµKŠ[š¨WÅ©oƒÃz•åÌÿ(ßð4¯Ö0IõM*µ¡PÅÒ‰’ÌOòø¨Â¾U›ÎÆm0™ˆ„N—3tüLW¦Ì„‡ná`…ÜOãtìNi˜œ½Ð+öùQnO6íʤۡȩº„£quU©óÒתXë±p3èèj®÷‚0 ýèÈvçì åmÍ}Œ^pæî -}6_4kÔ80"•ÚÜ…Õn(ïæZ_¥±ES÷Ù ¨íغõ±ï¡*SdüN™Àœån¦¯zïhèjq®·,;†×1q¯åÃå ÝÍŸàÊaaäˆ#òµ"æÜÝ©—¦ZkùŽÑÏž¨ÁœÇ¨ˆ%©äØÎyL<¶@ùIédRkoeˆ¢‰Æa‚ß -Pî[@“ë*üµB&ï=îÉÒÈ-ݸt#¥50uü,nÒž›wõFDáŸVÞæìÝøÅtà_~c=ÌÖ»§=u‘¹–j©Õcd´±b%,̦gJo+2ÆF—[9Æ!…o…¦H‹©Ž“´¯Óã‘MʃÄäß’Àú1ùÎ×þÐù¹Í¾èŸFÿiqC[líNþ^ñ¨…\‡Å—žýs…ý‹®è/…³H’¿+È’Ð7š#Øþ¾jÏÕ.ûWˆ¦Þ?F2°oùCã­ŽL„ôŒÒ¨ÀùîgÔá–Î7¢¸ÀÏEÄuµî¤—YyÍII)×Ê»ÞÂêJƒR˜Ó*5ÆÌÔ”¢,ž*ŸêËa-Š]ñà’º¯Ê½5JÙ#ͤˆÖö/™–Ò¨]ëbnuyØã×€J1¶‚”¢/d|Y9ß7v›Q} ž7¹¨Ý“Ul§|?É »'gkF2ã®nM¬{xPDµG—ã]èEò²[ ­Üdð'™øìöÃßúÔXé —ZËÄ8¬Â•N¢µ+øÑ0I$l8T§ž¸®O7gŠÊN)®WüjÖ«¦ž,!-G•øýÑÓA¯÷F£·þ÷ÕŸëå@eßÓúPê<#8gßö…fgÞ‡Î;&?N£é?Ì©þڟѬñ“hÈä^õ)±=æSq‚1ƒÿ„2´Dendstream -endobj -2429 0 obj << +xÚ¥koÛFò»…*à +(i’»|¥ŸÒ¤IÜK_¢ Úâ@K´Ì õIÙñýú›×.—’lP—³³³³³ó¦¢IÑ$O‚P“,•ç“Åú,œ¬`æÍY$¾ øÎÏó³óשžDaP„Åd~=ÐI¨É|ù‡÷òí‹Ëù/g¾RÊ‹Š`ægYî½ü|9‹¼O ½üxñ~~ñþ ¾iFÞçKœþðq–+oÎHï‡é¿ýü‚ßTÎþšÿzöËÜrjy® +dóÛÙ…“%é׳0PE>¹ƒqD0½>>ƒD+yoÎ>ýË’â9=áU§¤¢ã4ˆ3$AçOo§’"HŠôäváÄ +ä™~­ + ú˜ŽEq ¢xâ': Ò<µ—•Å“( +Š$ÁËŠ¢,H‹x’Åq ñþà¶ÞoA¼ý̼êP®=ô4ŽæäÛ$ +B]Šqœ1`8Î/ÖÑäÕ8Œ˜eº¾C˜˜rG³¢$ +MÒ"ÕÒÄìüf†|úI’x×0ÜÎâÜk×Ä}‹`íMûÌtۮ˾^Lyb±Ý,q×3 îø¹!*wür5óãÌlÑòn‘·k`T.h¼Ä9ˆ°èž‘ø˜5!Ý*¨QB,oª;œý1#XÝæ‚—øI˜{k` 3›%aáíˆ ‚Þá6´/Î_ï^2åÓû0¹%š%ÞbMTý¶†—Ý ¯H ïÚ ¡,`nÇèôð<Í»fåèö –‰³cqÏ|]¤ÞöšŸ4(rÜl®¢câf´'>7Ì<›-¾¬ä„Dq]Ö£“x¬zS-ƒ̽åE(³Tn3M¼þ¦â ŸÆÇwŒÕo –HƯg$lGHHW€2Æ’¤[^ᣣ]ŸÚŠÆÀ NRÐÚä^¥yƒ¥Zq’t|ÇwŽ­ö²Ú Uè]€ÆÄEFƒ’ÞóË~·BÅ.—¾ÇxA|4ôZa6:iræ*<jcM¤ÛdiJk0Sбͳß"\Šª»ªäVnyŒ”šÎ6¯ÚrÉ:¢4±5¬»à d¤-]/îH ³——¯ºcpmÌÙCÞ³ê%Ê n_6Œ¾cBh"½õt¹Î¼§½"U7 ¿‘y¢ TÂþÇú§¯¬Á~Ž ’Žë«Xƒ=oªÖÞPµD¨2;£³Ã»1B\±miðt†Èú|Äg꣸3ﾩxÍ°qi$rÊ›Eaø ‰›°«Ú552¹éŠ—LOt!8xAJtElŃnÇ`"UÿFzL“7ÃŒ'R–qÔxZâ0ïà²Ù?Áh/— Á†d—°ãRv„îÍu3Ö”pÓ¦r >‹f蜂EçC”5iù²#õ¸âù}_75] +YÖ7Ý-+)Œ‰ŽYfUÜÞÖÆh@xŶHˆ;–c)t†Aûm¨aý—z³ä -˜‹¦¶"êV66ýpä³(€À:q²£¿‘laFà›p]ñ÷2@phN*x†A&â $ÓI:$âq8Êí8LÀÇ©(<ðIq, +0ýɃ‚'6aŽB.{Pti敤#0x=C<Á©W}ß5%âoDíN§âI˜Aî–<~š‡ÃˆúÌit^i–˜L•ò4PJRZ2§ûc‚†Š®¾Ç7å½Ó‚I´ï YBäk·‚ló:T™{†åb Ô;„íÉ]65Âj£©„Œ¡,‹í>ßQ‚-ËÞ{²lŠ¼BtËÏg,e/ôÖEÔtG±bÇÞ‰"ùÚ xЪ"K~é¶×½ˆ&÷ʶbèŸaÞÝÀÅðM7UÞÏó/?ò,ûõökǯxz•¤`D >¿¿ø½¢I IžhŒø[¹`À‡OüüáÛö„sxU¶w5.„„¯— ì¡V¦*ó.0Ö9É ãá†â •ì\V—2OZP³´–E‰ÒÛ=…Ù¼žȬXöe?^‰nŽ!4+tK~ÜR.ÞÞ3êà£O¹ð}‡ÞN§±wMz1`7÷ Ç[-¼!n_S}¡á–ì­1"܉u~8MnRˆÃÕГ¨”Þs±,{ 6°Šòu˜_ÌGŠæ‚qžêðWT¡Í~Çg$eŠÊ„”,moκä©5§KkqRÍ•³˜ +,©x(Ui€±C¬­„Û¶´v`ßw}µëD 91˜Õ;*ßPg¾ÎP˱ހšü!JžS£¾;qD4"Guå¾³Á͉ ÂUÝ9éÓ¦×:ïå¼Ð–^V|ÜJ–]9<Ò|9DEÚçŽÁ÷¶",tY÷é¸ÌuÅ„4/DßžëQÁÃàTw07Öé±²,yÒøGBdŸKIOmŽc¬9±´pe-èãaÆn@¤&:Ì•O•P‚í;èÇq䦤!ó€åÐq Ó™$ #>»@‚óÄîCq2ÚÝõè[FÖ Á³8šg §j: Þ*ý¿‚‚÷+]÷-Ä£B KéQÃ6ñx½¶¦[2=ƹfu¤˜:a[ØîiGÎdäÈ(ÎH­2ê]—¢2ctÝù'sIaˆ ‡Â•8Má®(è,A·;ÉÄÉ´B6”JÆÈÔ-yº)Ñè™1~7°8#“À·{a`I¯ÎÏOŠ¦¥Ô@Ì«úÔi7ä¥_$‡J|²C5äò0ãŠì,ÈTü„…lßA?‘iÐD–F‚#‹ø€Ÿ8ÖAec~,Åà<ÎEçµê¾Ê«’[.hyâ½Dµi[Ç¥¡°Ø+‘'Î#s߇MŽ, +gÇ¥g°çû&òë„™:mG^¯€ÄÿqœÇyÑJù/F™Œ×FéPîÜ“\Ÿ‹ÿ‰¡fnÛzQýð@q¤bÄ:{´8rpl©wT)¨þòè¨Ô£bO^Z„\ËM±¸Ãƒ^s:`ú2Sž¾të@ÓHêb>„‚¬xüƒ‘ƒópeQ¾˜aâ¤ÕäG¹ß\ÙxT¤Ø óÆ$ݸsó!a`3Ì[vUÒµ¦)tW’Æ-™\)sTHÚ~­©¸‚¹énÈø(3g±¡³¡Qù{Q1…©)=©˜4ÓEzÂÕOwÄz_cbŠÈØóLmú‰§Sµ¦—TÕ™ôwø€·µº! uSÓóƒkþçúéDHÝ>×õFö±Õn'¶Eâd·]5b(•ôöT$#NÔ§wb{nBÙ¯ûÅÄú\„÷Étq¹-)KmP¥d©c q‚4JªÏÇ +‡”éÜ3òiŒ² +š:r\¶p!ŸBèø”/?_~Âô±à~azænl¦¾ÀôHBÜwt#8<¬ü h>D‘ÓÂg¸w2 +UëïZZq[›N!ùBùàÐ/‹<Ÿkº Èí%ѧŠ9N©3*Šãˆ +Ë#nÙô52±ß,$½*ÆXV·õ‚z±Øw£Qü¶/ñ¸šlÐJyš>„)Üô„@4œø)‘&æ’v¨¥¸Ì~ÖŸ,X±º×¹¨Å‚ªç\º^:—YÛ„ +ž’Ò8çnzùÇûu8-¯}óþó¹Ûwz>ó³$v.Z6#} Ëmˇ¥L·{£¾¸=VLuw#â9ŠPn©6È}-ûa.ŠÍhPçùmz¡õ˜°5ª#µ‚€U©vê[ÚC‘*ˆ#mûq¿PÛëm[:$eˆŒI¢M$’¾#h(ièõd—;QZ§ãªg5•:¹µ‹aP¯+ó]ƒ˜Û<eÁ61§wN¤^7rBCûÛžô¼6ßw(ú÷ã‚_ZZKNI +ûƒE¡œÎÃa?‚ü.IÓðKØËîVqà %…ó¥ÜK=Š—,GûùŒ`¾ý€]ß/s„ì ëK¤E d4Ƈce8MýDØÁy8Uˆ4$ÙY$©dp „ä;NëX‹Ë¶ãWTßâ©@*™¥òDÑ$ؾƒ~‚³šÈÙúŽiS`rŽ?f)ù# +˜4k÷¨~J@ a>fí°~œÇŠ“<ȲdÄÜœ”ÐÀK-<Áuaž%ý®bk¥Ø£>`a€Ï~èÞÙs<Q¿ãbwÿÝ ÒœtNÙ]ß:77$™íÃaÈæ‹0ú<„)h\ÿÆAšÃ*?]ÿ2¶ï ŸªÇ4‘½ƒÏÀÜåQ¿…y‹Зù‡£«- Nô˜ÕëœÇTaäñ˜A§CŒÜÉqBt³m‡&ld¾¾¿è‡]mã—O-)úa„÷Ÿ!â2i@Ú¨ÅWZ„ô9ͽÒ%;Á…É·ÖN5^^¸\«,—_R´¶»ˆ0§ê„7«bü:|î$sÏŠáËÌ–Ëumz>'g^í9;â7P²ºå!ª™íKõÂR?j› yâû¬ áqž9ß’M +Ë_fâ<å@‡H|ëö1ÙGÕS›&1fKKézl~R‹üêEˆÉ·kkÆs#¾ä8œ–æô«¥{.Òa,$…d9®{+I–‰ZúSX¨Çì๬­ìˆTeZí=dëÔÏrÔ›¯hùÉ}c›(„Ö¶}½høÓ“òÌ®4cÒBÙÌþ +N¢í¸¤…Ãœ¿†èèþ$¥ …t¶Ÿ|I‚ó àYX¢|(~…Í“ :ðdƒ“Í2Ñ9È­š>=e)÷`Zòƒ?­÷ÔuÌ2S4‘ W­ûE<£/8Ô¢äF»¬ __Ј?ú†ao +÷s›µY6¤5™|Ýj—ö‹áCõ$Ç­ÿw¨êðÔ*5…ƒÂ_pÙ_på°c¸kÏj¬Ì¦ZE8iŒJLB—RB‡n n}n¾Ï‹H¥¦!´(×É=ÔÔâ“}~øg‰ü­•ÚlG« W|+Hâ8ˆ#à ÷ÓC~•I®Žþ¢ccendstream +endobj +5518 0 obj << /Type /Page -/Contents 2430 0 R -/Resources 2428 0 R +/Contents 5519 0 R +/Resources 5517 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2396 0 R +/Parent 5487 0 R +/Annots [ 5521 0 R 5522 0 R 5524 0 R 5525 0 R 5526 0 R 5529 0 R 5530 0 R ] >> endobj -2431 0 obj << -/D [2429 0 R /XYZ 85.039 781.388 null] +5521 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [412.789 653.385 454.872 665.378] +/Subtype/Link/A<> >> endobj -350 0 obj << -/D [2429 0 R /XYZ 85.039 761.463 null] +5522 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [155.951 639.836 369.851 651.829] +/Subtype/Link/A<> +>> endobj +5524 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [421.617 405.262 475.382 416.951] +/Subtype/Link/A<> >> endobj -2432 0 obj << -/D [2429 0 R /XYZ 85.039 741.134 null] +5525 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [179.03 364.614 225.113 376.304] +/Subtype/Link/A<> >> endobj -354 0 obj << -/D [2429 0 R /XYZ 85.039 125.405 null] +5526 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [375.968 364.614 430.714 376.304] +/Subtype/Link/A<> +>> endobj +5529 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [191.321 143.854 256.005 155.543] +/Subtype/Link/A<> +>> endobj +5530 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [181.685 130.305 300.65 141.994] +/Subtype/Link/A<> >> endobj -2436 0 obj << -/D [2429 0 R /XYZ 85.039 102.087 null] +5520 0 obj << +/D [5518 0 R /XYZ 85.039 781.388 null] >> endobj -2428 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R /F38 2158 0 R /F72 2435 0 R >> +1738 0 obj << +/D [5518 0 R /XYZ 85.039 519.568 null] +>> endobj +5523 0 obj << +/D [5518 0 R /XYZ 85.039 500.899 null] +>> endobj +1742 0 obj << +/D [5518 0 R /XYZ 85.039 323.247 null] +>> endobj +5527 0 obj << +/D [5518 0 R /XYZ 85.039 302.652 null] +>> endobj +1746 0 obj << +/D [5518 0 R /XYZ 85.039 178.994 null] +>> endobj +5528 0 obj << +/D [5518 0 R /XYZ 85.039 158.399 null] +>> endobj +5517 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2439 0 obj << -/Length 3067 -/Filter /FlateDecode ->> -stream -xÚµÙrÛFò]_ÁäeÁªÆ`pæͲ[‰-i-¦ä­8#Q…-ëï·¯Á!‚rj·R*ƒîž™ž¾{`5óàOÍ’Ðõt:‹åê$™­¶'Þì0ïN”Px³Àõ¢Q§Ë“W¿DþLynꥳåšH–ÙΛ÷¯¯–gŸæ ­µ“ºóE'Îõ\9¯?ž¾Fhà¼bäÇk|úÎÍùÅÛ˹Ÿ87׌¸8[Þàûå§ßpú‰^™æüâCßý~þölþçòד³å€ÇEà‘F&ÿ:ùãOo–Á9~=ñ\&³G{®JÓÙö$µZÞË“ë“w«0.˜ñ¬ Q,,ÅB¥nê‡S4~ìú± -Q˜vR󧥖º 2Ò ¯0ôœëÖ´Å -ŽE(”K;gU»+òæù‘²‘÷¾ç†i¯:N¨î"œ/:mÍOT›ÙÎýع5 °À)Æ™žÔR—Œ]™²Ì3äðÕ/z¸‡Š”ûZvz,ª&ÏŠ– GÌ„ ó@ÈÚ 2ÐòN[ƒŒ<ñ>·°kìäŒÙ70PNÆ(˼Éæ¬A<Ê@+F“Xa{òÁ¬QQ¨Ò”vÎ+46÷Bû­ªýYÊ&šhF|š[Óä Á ðå¦hdF/!|]™ŠÝp)8BÆ`S6õxË-/€{ë'†uü17Ê‘Íhü ¡|䢂áÓ°¨Ø‰ºó€_Êy:8.ãÒ¢£á*Ë Nõb'Ë¿"CD]Ö0}Kcf“iê5>á\vYkŽ&TCqñ#*Ý4ŒÛ"1é•VHœÊÅBhÌîIÚ÷T- ë~h·§ÕŠ»µ¨«ŽK²Š‰ÓeU—Y¾ca5-&œ\x07ÛEÀO<ê‡%Só†áÝqE9Ù-nQ@•AVŸbV¸ë=I½ÊFj¶Èê]Ó=7±ïFñË!,t¥F!,7Æ!,Äè¤Î{Ü./aã‡5÷%G²÷EÕ^ ßÓ#˜rCÈ8/F0¶ÇÈwÖ¨ò²¬Q<â„Ø$Iö CšM¶R¢ #5pKÀ­ÌŽd‡Ëíñ@åS­ZWÖÏŠÌJ¹·,G¦ O0z™JKÒÆí~‹ŒÜ–dwŒ~`óïM¤œh7ô䎼5D&fQåÏL©%àO½»k˶$’‚M„ Þ5Ç-D{nê-D¹‰/É…˜ä”$¹:cVϵç<6œâ.ò–^ñ Ïû‚%9W»º%±££:«º|É–ôË9Yk×WÁ÷‹Ói4Y$€âÔõ’ãËÐ$–á‘PW ¡ÚšE¡›ê “^<%½›¹R -w\u7Uù„cI ³¿€åTXßàß`LÌö“ðê|ëÏÞÖÀÖ¬çL§®,@v Ò^³*™ð»·˜s}¨Ü.—8ð9%#’¸“xÚ!Ó&²ºè/ôü(†? ½‚º9¬¨º r~båˆÏæyötÉ„ˆã\¨ÅDö[mŠê°ÒÔ0Ä@&ucïÿSë-GÜ] ù¿[Z—‹ þ8ÙdÄÊNÇ” ±,«I[JrøNÂÙÛð•óJÐT\ß ÚÅO y@UÖ·e¾m°Ëi -¡­ÀÖD´åÈ…-T…]Œƒ ˆ›™ŒB8C‹8–yï¡Q`4«¥’1Õ°­Ð}xÁs4·œ59 äGËš³ôtˆAéôüòš_ÆK0¬5œ‡i—ÈÁòÇìZÆq¡pŠGùÕ”`H,º†1$}xæ%W4m'vÜa#[}øxÊôÉ?pÞ~<%ç9&¹AuF‡ -SG…U=gËÙõ×r…áÙÈßä-ˆ?x+®-犅ÀÕ®h»ˆÃp*‚áÙ—è¸7•=í²f›ï8%å6[Ú1ì»ãJ æYPÀœ˜WÅ”{gyµÊÙ -$mR£É…@ÕËÕ‡ˆCqéÚÕ“RjŸ7›“*“j|–¶‘f…RÜt‡€­w(ÓŠm%Û *‘-{7ÃHÖH+¼<ÌøEY";Ü‘Zý$äÑ°?gŒo$]â\¬µ#™±­¹ïQwPø—–䙵#¬ßÿaPíÁ -'>1 -eMÃméžw'skx­nÖÀ„‰6¥ý×\<$-”ùË­Hûÿ¡t+‰¬Av;̱v¤OÂád(û»4,8¯Þ·?òÈ -קþÒÂlµÚ¼—Y¸ÂÀßJã>¬ è‚ΡUn‹µ˜£ãýQ‡–¶s9äÞðáðÊú˜sÊ•½+aN\îƒÞ„OÉ—$*`à±apúŸÖˆ*·kSs#jÔ%ór]ÃÆ„Z¾¹zu~…cÏ¡€…ƒsäã -&}žîMmÿjJi›8væ»ñ†ªkðDŒÐHs~ Èk†å•¹¥ÉBL§ 0„ݧ¦žç°¯·ƒU&¡º„KL —bŸ°‹Æ–0ãPٷ١;Ú‹ŽôPˆø:`ŒRip‰×_Ô¥ßÏ <ˆ}VÍOñ±] soȹGŠGT<¢G!À†å@"{0Z‰"n‘t—ÉǺ},øHþø„þ³ä΢×G~7yÅtœ ôá# OyÜÝ õ ;“Ì­»5ì9ôØ ‰®•Š,‘§µY é3 fÏx~õXHý­aÞÐê0 -•Zè\\S_ŽŒ£²Æìé§ým Ž©@4†E¡; êy&Aª“ö)ì½›õ÷E‚‘ç}5—x&•õ„>7˜Ë•'zQª×‹Â“Ž;׆[]ÃÄâ.<­âG/Ó¤ª»¸QÒWÖ〜\FÞ‡Ûr]D«ÛÚF¨ow½™Ë&eÑ´«¡}xE4¬8K)Amˆ¤ø¼L•’ÎôXãT«˜¢tùJ4Ýâ?Ç PpV“£&‘“†èÜ ®4é¼ ìG(ŠÅàÜìæ¡o_x¼Îw 9¶&rûÏ»¼Êw”Ý ñxr„G„ n„ NãzξÑ/÷2HEQdq4¯ÁÜ®‡ßÄñ¦?aÅå9><Ï“×Ï”V²¾ë…ßó4öM}Øñ„Ø’l¹…¤Ò%äx*A–H Ga‚ 72³“¾ð,(D;”á¡A‘@Ó„O |¬”4F…Êaéum¶›‘rð¬¸Î¾åy…<‡÷Vðz‹ûæ<îá“áÏ]U4~i{ºœLS˜'¬U‚üLéù‹’6­ZvX¸ž,¹÷+aÀO#¶¼Šòá0S¢f²ü[›WÜbJ/AªGK‡JÖ4æYÜ¯æ ¸±•QÍOÀÆ|Š¬øâ)ÓæyÕRa - ¯ù 2›EŸä?²ÞÃó],J¹‰óŽÂú‚J"ƒ ¶‘ÍÐÔ¹áòš¼ç+e xÍH -Ô)ÂÝ—èD;ÍR5J†ÚF[¤ã@DiçS³@t„¨²Þi§­šLè êhÙÀuˆ÷£Ö©ámoôJb5«{¦%#ÆçF&ƒ\xðÀr•ºÑö;ñçèרj³Î¹:ßÑÕ«½u_s«ÔE^¾@Æ÷½Œ"?¡/…ÜÓþ~}ÆïX,^|˜ƒ4ÿ#€ Á\ñÇåå›Ë?Ü2êÄU‰?ÃIÝXE/^‹j7 þÞµ¨/×¢f›óeè§>aàéö’¢8GgľøŸúø‰7†]±°äVJ:ðÕ.wË”r±î¾fxÌcð†&ú$˜Bµ? L–um{ÓØDˆ|U1™½KáE°‚*©Ã·îÂʶð8Ûðƒo1¸ÊfnËö¡Kó**©ä ›mì;C%óºÊ¥•Ø °•½uzè -‹¯˜â2¹W—xAÚ}¦4?@!AÇÜ÷ï -YÇ7…º×þqÝR—ùÔÕ7ôE -º®wÛA™cºæüç 3‹Ý$Ša¸Ó_È}å&*™6ÄÐ À¾Ã%}ĽYä¶ÍÐÁP¿MÛÇújøÃño¾«õ°úáã{j<—×?Kìi†ßàä[>ÝQÊ—:êÎvÙ0ˆa#m½!u~Ž ÁN‚è¥ÿsÿþ¦ ½øßßôÈ > Ÿó‰4j,Îÿ*L(°endstream -endobj -2438 0 obj << +5533 0 obj << +/Length 4219 +/Filter /FlateDecode +>> +stream +xÚ¥ksÛ6ò»…G_JÝX,Á7{nÒ¦MÒ&©›8Óδý@‹´Å %:$•Ôwþö|ÈêÌM&¸X‹Ýž€¨Kþ¨Ë4r½ »LRåiz¹Ý_x—÷ÐóâB ÆFP6η7_ÿ‡—Ês3/»¼¹æ‰Ü0 +.oŠßï^>»¾ùþÝz£2w½I’ÔùîÃõZ9ïzýîÕÛ›Wo_àW@å|¸ÆîŸß­ÓÀ¹a¤Wo‡îgo¾}Æ_ë­ÿ¼ùñâûC©¡¨ÊÌO¿ÿé]°¥/<7ÈÒË/Ðö\Ýû  ÓÂ@¾ë‹÷¿˜©¸/¼äQK\‰‚ÔÒ`ÎYlQÊwå_&‘çF^H|Ù6m {H´öërÖ?qšCyXû©ÓcŸç4wüÛ7Л:l>_Ú#4¾êxüÈ¥†GÓLy_A÷VfGHS .±¹í«æ°09 ®eÂüPp-×ç ³(ŠW2¬ßXhßÓœ9“Œ«%Ê´QÈ¿Œö[õ,Ç]Þqƒ0øÿ) #1(ÙW |ç·7¯¹£-™K +Z­Â«òniO€E{Âiv%ÏcöpBM@%£øŒÊ8$[ß[’­—º*T´WÀ‡Ã ȼ0! + ÿÝÉÛ¯ 9'𣜾eFÞ— {›ïËS${±ë©ìi’œÓê§ ˆ'&’W¿î›ë (½q…ÎÝÚ‡ƒÕ{@–² ÿµºèß#ö7GFÈI>aë©:¿Êd0 w£*ào[æu­WüÈ‹6x*©ó¶! +ÆìZøáž?}Ïó®ô , ˜?Ëœ/Hi§œ;¤½Å¶çÔš®®cÀ²uìX#'^6zæ¨9³¨»ÂŽ”S0Ò¾¡ý÷<žÚ,m–{¡ä¨A¨ùˆøúúù•n½Ãía³ZK>$ÌÅùn¯ŸÃl¿°Æó +áEFÎw8Þ6½Dn°z`ûC+ÈQüRÁÞ©•óÌwša_|/ô´Õf'ˆœž»¶bªÛnÅüáEÞ½HZ MtGÛ´*¿pƒ”R¤¯Äöþ#Ú~+£Ê?ÛÁ„z °·Ç²e˜ØeY€4ˆÈ¨ vnvbc¿¨pùÃW2ewDmÁé{kZ4†X~®¶Dõ¦Œ<â +…cª]„6‡Nh ž‹:¯; *„ƒÖ€/h¼ãcŠ†E%b"B:ø¸.ù¢ÊXpß-)rƢʵbaƒlî7­t 6à 6Š-«„©›E1ì‹Üÿ:B§f?"÷ Ü!{TÁÁ§±#‹½ÑƒÇŠP£¢õ–†#ŒŒ +®ãï~‡üjŽ÷;þîúœŽTÞFФ>ÐGþ?ôÉr‚RÕõ¦(Qò›3€·BC–‡>D™k>7+ Œ¼kò ]ÿ~ÛVDÔ’ùÑŽÏþscž·Fc$zÀ€t±4g—,\è Iõ±»bsÂ&[fœÆ< '¼?L[}Dñ£Ì &z*Ä#’þÂëÇ8·´} +4´è,õ¢]›@ WðA~à‹Gþ 'Sp¤ÁÕ®êP@ƒ³çÚ&Ñpþ‘`È6,Œ\^0„—xÞ‡` Çb°„¿ä·|¶dò[6nG6nÖz#‡[ÝØ{yî9¸ÍÒ‰õ%Réôef‰„j€kŸqÍU£4„±*h:íUDÓd’GÆiÉ]0ô‹^¿C$ÎKä)¢UE™%â0t_Ê6ï—¢WÊGžãYŠ’F£õ^QLËñ,´N&â% g{l)„2.,ŠÅÒCUôØ%ÆÂq/ më—œBDžG4n“EV7{YªB8ÕÃUÁi …=t>ÚyTGÖ[9ÿ<%¹sœ…tZréŒäž\P$7[oIröz$9Söy!Ë NQýÔDhÀ ŽÜ'GŽþO +E5“È—V + |0;†“å1CLDæ‰Ã,ÁAoÎ~¡$g‘)̱kîz+ïó“˜ ½Ÿ$Ϊ'gXTñæõŠ1NGyÔMæFR/°‹1Õ!ÔW”7ÔŽ×Ó6ÛÍ¡ÖƒZâ7†§/ +]ßWgo@zBñéœâ=µ V¼éz‹Šg­Gv‚îû|(Â0„lFñ>»f„®“ÉØÍ…¼÷Ü‚ü…c‹Ž‡ ¶ à–‘DL¬YCØQ¢»É<2:^ñxÛÕ‹Á¶ÍABÍûc›oBDQLÊê¬ð.˜¨5Æx¬*–þ R¯“R÷–E…íû鬡•Ì3œ]³·êiÁtšØ±íN•¥BßýxºÆcáœ.K…J¹i”LËR¡”¥¶Ç‡ŽëQk +Ì°ôô@Uªâ9ç=•Ïª-õÅN-çÇtNJ+yN)H”§Ù˜‚‰4Ιu'3ẨNXl>š:@ÃGâ²Ì ’ÄöëL;€¨ŽvŸ- Bl§erJîqRBB9,Œ™Ç¿ÐûÚˆ®§<€“>µ0Ä c{}›/AD”à¹â "°ßDz3·w`Ga_SÁ³HêgK)­²÷Tl‘»DØÙ¾@pí{§HRr„ër$EX1ÆÌáèPÝJÝ–nÄùTšÛ¾é©]L‘´/¦èÒÎDapLOÕ·Ám„RM#§&g†­î¸g …J(T²H#¹VíùƒX[æíÕTÊ~š¸¨ÿ¡?ä¿'õM7ö\Þ“‘ô›Šjd@ÜOùÞ¾íÙõŒ­Dà†^8¦h¢wçiB‚8uãL(éú¼e#Ž’²14DžØ*¸Hñè¦rT°ñ£ïq]¾ W•ß朣ÊCÙdà¨ÈïyúDWo°ïPRµ°GF*/ÔpQÆΠ`È-C§,ôC7R äœ ä…½ÀÊñŒ¸Ó7\.§¸jÈìÐÿc]jJd2QŒIš +UpÎP’E®F#R(~=™Ù W†[,m3ïìÛ{É_X¬`¯² W¸õÛÎ\¬‚}+©Sÿ]I.t×CÀ#ô…¶Y[ÈKOÕÍxznäÃÎUä*ÿ\†«±7ú7's’y†æ úi~837SÙ˜†Ùádœ3+Of•7úØ̳{/„Œøon]Ÿ^2#.ÿýéº~â&êÉí +Ê™ÕßU^2Z`Î%9lðÅ—„šCø,VعcÃ¥$“+@{üöhI6ýc¶<<ÁˆÂÈyIãR©m“›…|,ç±ü.D?–Ê÷ÍÑ<ùˆ¹,Œðƒý^¾éÝÑ}••ÿ“Ž“á Ïxä"ÈÔz mÅ$øZ‡FL+ôfÓ§ze¨¯ÔKJ•áKC…ÂvFšÀ,•pë ãw}®æÖÂubà¹þbA þ2_ÿ¯ÿú1\Inœ(ªE>¤îJÓ‚›òÃÙ¾þ/"3‚ÿ‡Ó¨endstream +endobj +5532 0 obj << /Type /Page -/Contents 2439 0 R -/Resources 2437 0 R +/Contents 5533 0 R +/Resources 5531 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2445 0 R +/Parent 5548 0 R +/Annots [ 5537 0 R 5538 0 R 5539 0 R 5540 0 R 5541 0 R 5542 0 R 5543 0 R 5544 0 R 5545 0 R 5546 0 R 5547 0 R ] +>> endobj +5537 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [417.299 388.145 472.685 399.835] +/Subtype/Link/A<> >> endobj -2440 0 obj << -/D [2438 0 R /XYZ 85.039 781.388 null] +5538 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [365.076 279.146 434.644 292.047] +/Subtype/Link/A<> >> endobj -358 0 obj << -/D [2438 0 R /XYZ 85.039 761.463 null] +5539 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 265.596 179.218 278.498] +/Subtype/Link/A<> >> endobj -2441 0 obj << -/D [2438 0 R /XYZ 85.039 743.459 null] +5540 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [286.484 239.104 364.4 250.793] +/Subtype/Link/A<> >> endobj -362 0 obj << -/D [2438 0 R /XYZ 85.039 657.234 null] +5541 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [323.843 225.555 392.533 237.244] +/Subtype/Link/A<> >> endobj -2442 0 obj << -/D [2438 0 R /XYZ 85.039 627.83 null] +5542 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [339.529 211.4 370.915 224.301] +/Subtype/Link/A<> >> endobj -366 0 obj << -/D [2438 0 R /XYZ 85.039 586.218 null] +5543 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [403.684 211.4 428.706 224.301] +/Subtype/Link/A<> +>> endobj +5544 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [407.442 184.301 432.313 197.203] +/Subtype/Link/A<> +>> endobj +5545 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 170.752 151.596 183.654] +/Subtype/Link/A<> +>> endobj +5546 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [176.334 170.752 212.114 183.654] +/Subtype/Link/A<> +>> endobj +5547 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [115.558 157.203 176.975 170.104] +/Subtype/Link/A<> +>> endobj +5534 0 obj << +/D [5532 0 R /XYZ 85.039 781.388 null] +>> endobj +1750 0 obj << +/D [5532 0 R /XYZ 85.039 719.568 null] >> endobj -2443 0 obj << -/D [2438 0 R /XYZ 85.039 565.021 null] +5535 0 obj << +/D [5532 0 R /XYZ 85.039 698.974 null] >> endobj -370 0 obj << -/D [2438 0 R /XYZ 85.039 145.627 null] +1754 0 obj << +/D [5532 0 R /XYZ 85.039 422.679 null] >> endobj -2444 0 obj << -/D [2438 0 R /XYZ 85.039 124.634 null] +5536 0 obj << +/D [5532 0 R /XYZ 85.039 402.691 null] >> endobj -2437 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F70 2201 0 R /F18 2207 0 R /F65 2099 0 R >> -/XObject << /Im2 2261 0 R >> +5531 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F66 3242 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2448 0 obj << -/Length 2464 +5551 0 obj << +/Length 3972 /Filter /FlateDecode >> stream -xÚÅYYoÛH~÷¯ü2QìnžöÁŽ3YϬ‰øaf(Š–ˆH¢—¤£ñ¿ßººE]Þ‚ì€ÙGuu×õuUK øSƒ4ò“ ’Tù&MÅê,ÌaæÓ™Š`úAáÔåälüs¬*ð³ Lžˆd2ûÝûðÏ‹ûÉÇÏÑ1ÆËüá(IRïa¨¼‹›Ë  ½1OÞ<àW{×·WwCz+ò¶{?…aä½€ÛáHyeËŠüruϪÈ×05ãv0@º]×6%­¬—ßP‹%®óU‰£Â./šº•vS®ê®ävKDs¦]uæuÄÌGåF*öMF:ò£ ¤“_,»²Á3å]µÝ0ô˜Vö©Ÿä(H¼"áäCja½DÁ»ª^3i…´$%MÌX²÷ûž0Ò XÈ F‘òPì°Ð¸ìè 㤦st-Y+ô*‘°í@ Å;î ]Þˆ¥ºš¿«D%uyÓëwÖ¦B¶Ä5ÅP'ÞWaÙWÖžÔ:Ö`Ã; ©ç˜ûËÌÛ²wxä×ç!èÙÚŒ,óTZ"3~fЀé臘âêAæ½dë`9+qº†óò)pt²\UˆSr5nê½l9üØZU¾<ôÝ}sèÐÓèÿj S†¾ÑZâ4¢E79…ó+ЫÔk«Žš;g9q$ag…¯I‡ñY‘ó €KQõW xyny½ŽsÆ SÇ9ÇÝ-êJˆ§¸ ƒ`o'†-\jQm$HÄZ)DïŒ$ìcG`øØùŠq]×SŠš,Jž>Ö`ÛK¨›æœIŸófköŽªÁÍ´AÞ”yÇ‹åòYZÞÎퟅ${eEå‘€ÁŽh:;á…&·˜}jwz›žóè3!’\€Ú‚±-áéøg³ëk#S -€ûóV‘Žd+éÀ6È›ÿàϦZ·ÜZ®uÛIgŠW7qô5BãÇq2C%Æüð ïhLª¾/z1Þ4@ÛÈd~wsìߣS%‘÷Gå²ZU뜂yOцVã@«ØÊ;ê°QDçåûœ¼ÅyкÍ˲{Ë]F;œLO@§üo’Oô$Ü—›¥ú[Çß,ʦDPŠ¼sduŽmŒ+‰ Š–©ºEi<‹íu/™Áþªìö>q+_8YšñSenoYÅÞDæê/žà@·¹]W®dëš¿x—Ê`¤.‰ûJn “¨ç AÞœ#»—¡@‹†Æ@‡!G bTƋ˯:Ü› Se’W⥸D¨ -ð -{ÏÂÊJ¾¸¸nVùrù*ëj>lS/3žšòåsè9FE~’&½,kŒvó×Ó“§w¦Hýî˜'š,ò³8ÝQ±]·í¦êŠÅ)Ö*ˆýDÇÂÃç;ä.ZéþaÙµOñÌ”ËÒ?™·ªè‚£å‡#Iü@o!EÃ\òa܇”ÌÁ^ ´7fàÅb]”ºÄ±w÷ £NyßÐ’å¾Xà;ˆÒzhÜÚ˜‰Sz:?y`í'Ù[§=E±yƒn`KÌb àJJj(c¨L'*ئàÖ‚ca¶PÙ@'1¦z8ÇW²Kîr®Z`q»b¾.*¡½!bZΕEeQA"6)°´Bºœ ®QZæ–ógY!\a Ué΄Édê-(-“ºëðV¯$Ürþìê~Åò@kš‡pk!÷Ác@¼•â›QÜ÷_0ÛØà|Š ª¨®C;/‘CuL£Ôuè\Už”Éû³¨j§.R;9ŒP®rg’j]Ê ÁeGÐÉ›-jAÎ4éjÁ¹$¡\z'‚Tθä  ýP`Æ A¨0×2‹ÚT.­Mlm‹« -W Ãe¥hÁ®—ªÁˆ9iKZ¶±bw ²$r‚ÞBÎãÈ­USôlŒO°(úRå#u%‡œ‘ÕF|õw*ôCJú )‹±9µ“)Pí¡‰Áë9{g¯ÇeyS®dIäÑ4»Q€þÊló©h;¨+üÎjfÀUR×e#4yûµÅç "Q)ùp0oZWBí ÇN º]—†³  •=Lm_If¼Æ†;¶!L¸ÅâÍ%·F<Ø}¨×èSsÒGΕD¨$‰‘å"±S›–p -ykAæ“ z"r.ýL‹§Ër…œk=ÑMÊ —96µ€²yJm 9GCòr°ØJ"yi+û(±õ¨â¥ÿ®Ãµâ‘Œ‚ë”ö)|g[QqØx:&BOsùܹðz'Ež,€KÂIIž„\!çÃTî] ù2#,ƹ©+{•q@¤¼­áJaµ&—ìõéü‰²¸PÅÞmÙ]^ß=`'òjW ’SÃÈäÃýøú~IœÏ‹rÍ­‚ýö™¿¸0BT¡Ø©¸¶ª8Ûë¤Ùòz  HÉJ襣HÞ-rY¸÷±Lî%S=ög \0|aÇÕà üœ2þ×îpq?¾¸z …b¢ˆóS GØa7¤hN1ùÓ6´NhçÉ[E}J8Rl€o¡[Œ Ô‘mSa|°ÇíÝQÿæäê‰)¤RN£­Fzo@ðD1¹ÂNìðéw!•ÇúO©’¼ã÷úžyå³i‡6jû”Û1~÷³sû"ZÔ[¤.P÷äû‘ÌHó¸ÿò`RnN ÙÕMª÷\G&ä‚…’‡X]®å6˜ñ8ENP"™r®’ÒC¿°ïݺC+¹ìcK -XN -ž/¨€™­ˆ59÷éGŸ•C¿]QÌWT±V1¢ÐÞÊ8xü­Iå#Æ$`,ˆ¸Î¶¹ª $D?h™+o“à×ú'ŒüïNU¯qth¸´œó›,Æ·yò×N ˜% Ðùª÷4ÉtŲ’¾,$¯ÌȦ]NÙ ´·’·¦c9|ÌL?P¨ê$ö•Éþçošp´jý$¦¸f‘[ö·~ðL`“L晴aBÆáv\51ëÁþ|bSùeÛ¬Ð>•½ñ›Æî[Ü‹”Ó‡Ÿ ¨Œ0³ Ô½êøo"Æ÷ý°j¨=·9ô›êâ#ïaH³óJÿá€Á€endstream -endobj -2447 0 obj << +xÚ¥]sÛÆñ]¿‚õL'PÇ„>Ý';v'µ£Zòô!ÉD@l дš?ßýºÃ©d: ݽ»½½ý>ø þüE¹žÊIê»*M«Í…·XæÍ…/K!YZ4/o.žý‡ ßs3/[ÜÜóDn©ÅMñ«óý/®n^¸\*¥?s/—I’:ß¼ºôk†^}xûþæíû7øÐw>^!ú——©rn˜èíûýâÝËü¦\ïò÷›Ÿ.^ßN ÀU†l~¹øõwoQÀ–~ºð\•¥‹=<{®èÍðéF¡’÷úâúâßf*Æ… 5'M±„eAt^r±ï†±2’ “9ñÃî-adfÆ°Oª&J`&òšã &ÁÈX^0öêêO&ŠÓ-Ï{£f€n»j 4yÍÈ+d¹í‡kK›L*QñÖËNH1L¾’uÈ™zɶ"ÚÕ¿x4îüNÜÉl´úÚmq5é xŸ²Ë‡’Üc„žI6Ø£g} +køžvê!)0’åüÓïðØŠ²(ùÚÊQuƒž²àIN#[å2Š-G‡Ê^ræäŒdUbfÒ="©©˜ NE–ô˜ü«'YwLVTZUdÂÞ¸ÒEš8»ÞègÏK“ÄÈda‚¦ÔÅ·¡å…¶8ÁnÍ/Ol[B³[ê «í&¡S¢ójÏì›ÙV©ô¡JRbŽþ˜EdWÔ;¤‹,«$q”£%>ROyñ ‹ØjÇ@¥OÜ°iWtF<Jý#”C²æ°Åõ»UÉ뀂rÒÇEì(×ÕÍl¾¯þKk÷œjCÀ´qèrr2%¦ŠÏ’T¨DÚ2|Õ6èÑvƲ9üK¤°×~Q÷-„JÅÏû‰óž†ìùå Û»{_´àk´l»¢œ¬qÍt¨¤W¤¥ðR°Ž”=»Aßùn`„É äU£‡R.QËX<˜!‡o턽C?t»Õ@§Á¦£bò*â¤áeÓvèKSÌÇïô@Þj‡/ˆ·”QüST0k+c‘-a,1¶\<Ú6Á²m ;Y %¹AtœQ +*’M\’pØ4ïØžØ,“{z¸! Úä¬ÂôBN$7ÁEËs®+Ã4¼±ÀCSîµ;HÎ?½6%:ìç˜a Á LPÃßÉ9H ‡9ÃG­É¢£îè°QÓ£”Ì1"v–cJI4#Ø} üBÞ<2z÷«iˆL¢Ïç5«íS2â XQœ@Y=’Ajê¥E~œœÎy6P·:ç)¯ÇI.&˜ñGõÓœçìp&äìoàjÁÚß6”ÃPWì hpnún +²} ê¨¬Aš9ŸŒOÆ<>M­‚oCËd:Jó[Î?=ûZ ¤‚øÀÁNhį´mp&H8=¹PÐÚ¸a{)4ªf†$;’/Ô‹)Hjä$y¬ˆâåH='çÉŒ¬”^Hn›µìž%ÏžºA2y?”Úû£¢BÅ®—,¢ÐsƒàDMÁ$K‹f¦¤ dd&ÂuÛrVƒ¤H(L󣱯4˜-‚‘d7Pl¬0cD‡rϹ£x…á›á·c¶_›ºsÈYnî%­Á…,C¦EÉ>¢n·›I…A̲·…©ÝÌWv"iÆÓ|“SX–€v*€žÏµUé*–šü#ìñ«Ie/8Fí/ÜZ¥ óŽ’îD£äaÑàÃÉ"h‡ ƒßÜC–.õ7ejƒ,ZažO+[Ùu!f§8ó*uTQ1”4ü–{Ê‹š2h†¸¥û!š˜ ¦nzn@ ‡ZQžƒ8K® W”—ˆx}‰ÇÏHŸ¢ìl­‰3¢Û¨t[s%ÅøHÒ¬²ŒÕÍ¡ ¥<*oÖvzÀ¼°gÕ»X3˜ø‡iJ8/,RŽË8†XÚÐ[Âõ'¯Œ®„~¬ñ`]IÅLs¼_í_± —Ó=ódœl>Œ:•%IX§“‰òeWî¤Åg|Úã„w ¸˜:¦¨“JO¨¹·2q²j;R'ô‘4¸eÊQûS +EÇå#g 5G *õAéPÌqæÜP2Å9È9¨J G¿Ìå¯Xu±ÞvcrN—üà{Þß'TT4U9õÆÂD’é$GpÊGéÝÉ3£ KV‹á_B³D¼(ZãHƒtR©² BX;Ó­Ö#$•©Ñâ39ÁF +§ËM“2"ú®Ì‡±ØèH¿f&!aÒtA,”.+Òæ²Å}EE{»Øu¬.x¬*œÖÏGC@Zk ¥UÇbµëdgÚ’¿å£“qV…œÐ2j#VJûÀm7ÖºvaMõ¶ +3± ¬¸=‚SÔg˜©í¦Ã2 §¦ÆÑ á)—€ßˆ¡¢ª1Ÿ¹’ܳ$º;*†7BrÊI…é¡Dp¬U˜"¹bŠ±¤Ï·\¼}M<Þ 6˜¨oÅ«Õh¢ZÖêuÓ©†‰%eÐ^÷6mW¯ÔØ PÒ Àf†TÉóš ¬³U8ïõH#-|ùɽà¼æZÞZ=yX@8,xº#ot/0ã(66&ŒÞ`×êÔÕ‡J”ë§ÉÙ«‹æôÕŠá7Ž¯nb¹ºyÅ}ú¯œš$Ϋò+çW¸{È +{*ÊSœÆB†ç/i,šÓ—4X~$ ç¢ï ‡áÒñʤOd©KMÉ»8­Þúša`ßQËe…Õ¨ k‘vÐ%:kc)>â·õ@œ†UY{GZ²ïªaS"Ô]gÍyS”–7o¤w9îŽÔè’òj¬²1þa/ôOµVq:ŸBòNËü(y陈ïzÔØ G`Õ°mmrÉÚžÎ8òØ$Ü•='/œÑDºÎ@t5®È‡‹eNZ¸½“BÝÊdyA~ ÄþH–È\€©û–g°z‚UaÅ°ÐJªñù8$x]ïFšÙæ¦ÎŠdêu—úªD»J/>$)(Xþ gx¥û¨ô6v¸p’ƒ +·£Kšˆ|,¥£@S—kÎ¥øžaö¡ëô +áý×ñØ…En?›4`ß0ÅÙv.{gr¯ÝŠ“UÔµ¨pþ¹âê7’ô!¶Ò‡äd%t‡ö/ ©ýo&CÖ\Am)´àÚ±k ’Î!`O­µî3¿ÑÝi*i6õ.xÐNµ+ })"âè§8Þt¥@ÉÀyBºõIϼb?…f ùÃÍ}Ù—º3\>?ꈿ Båfj>Dhš¥EÄž7œ\,¦t±¨‰8lûÉq×!„ÀqnAü²"‚§óí_eÜN9âj„Êæê—MSqÇn="¡ydÅÄs“PMVü]h@­Q_zt„øvÝÞQŠGê Ü`„øœƒ³eœ¹Vô}çíËw Üßsgoã5tùG@’+€ß•}¯3™õàbï$¦)·™|×Òi©oe%ûÁN>Ÿ ÔeeBÇ ^Ö­ +ÝÌlëïí9¿\? øi¨Lí„ãF߆o9Ók<ôl艰g(ãõ¨}“w¥V‡‰²ù\n}°·0ˆøŠeüêa£ÑÕ ’po 9lfÎîÛ³(‘êƒÑÙ²#Áèb öÇx¡ë§`¿º ¢ÇüÑß/ÉàP%3ÛÓr)ëÞ=åü4•öÏ;‹è´sÐD8‡3 þEçpÄÕœs°¹úñêíO×Gl¡MgÉyAÍ#K&¡›úédÉ?09θI’r +aŽ·dœqrÏk.ù·%'9ŸtÛ‚¦ÑŸ¼bJÓäËtà »(ЯBæ[$Ù‰ò¦#Ýæ†JYÉ#[z£¿kq5i›væ3(ü‰oÓ½ã^{Ïp4«ÿ‰”¹\Û=µ>9(oÍ·UÔÅ×Q¡+] +‘üÚíÒ;ÛÃÒ÷Rú†•g³¿™œ¦ÛGÝ·|媜/;ºN¯è ÄÀ9@Wrs»"¢3Ýcžµgú00ÎøáøÊBjÂÓf®—©G z$:cÐBô˜AŸ^ð¯ô!W³mqõ¦Úlul¹²SØCN³Ð3ÿ¼l„æ.2@Ù„ ´ñŒ¯)¡À8¶qÀõí6pÉZrqï+þž„>LÁÊ'ïäÛ•d4u Ç­2J 6ê+,$»Þ›˜_L††du/Ñéjj#Úh”|¯en†3WÐX5›ÎÔŠºA‚Ïò¬õUd)>%xÕÖg¾#Ød9ðü8”.%u¹`äϾQçÖ&uàpˆ¸û{K4}ÁHŸõUÓ/‘*oæJÎÉE0{ §1‰ªDå@Þç&ÓG¨ÝìcÈ—I]œÃð,6¦PCÈkª;°c‡oÓXÒóu–æ!ïxñá>—e¨>µ^Õ÷¬Û´aà + [ÚxAÀOTå¦qÕ +ɉ®’nµã¤¦CÁ@ÓŸ€±¯·zc­,s×vë½3Wf¶˜š#"/RÓå Üô¦6û%+zT+‹ú³¾6 +¦0ifB)Ó¬—Õ½,Ï f¯ÜáŸÙú¿¾Ü6ý0¨3RuâÚøv_ó‚bÂôßH¥à5Õ1ÃÿÍ]M¥endstream +endobj +5550 0 obj << /Type /Page -/Contents 2448 0 R -/Resources 2446 0 R +/Contents 5551 0 R +/Resources 5549 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2445 0 R +/Parent 5548 0 R +/Annots [ 5554 0 R 5555 0 R 5556 0 R 5557 0 R 5558 0 R 5560 0 R 5561 0 R 5562 0 R ] >> endobj -2449 0 obj << -/D [2447 0 R /XYZ 85.039 781.388 null] +5554 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [465.465 713.243 512.306 725.538] +/Subtype/Link/A<> >> endobj -374 0 obj << -/D [2447 0 R /XYZ 85.039 351.586 null] +5555 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 699.694 126.672 711.383] +/Subtype/Link/A<> >> endobj -2450 0 obj << -/D [2447 0 R /XYZ 85.039 320.97 null] +5556 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [362.259 564.202 455.161 575.891] +/Subtype/Link/A<> >> endobj -2446 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F20 1617 0 R /F56 1642 0 R >> -/ProcSet [ /PDF /Text ] +5557 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [449.589 550.652 512.306 562.342] +/Subtype/Link/A<> >> endobj -2453 0 obj << -/Length 3684 -/Filter /FlateDecode ->> -stream -xÚ¥ioã6ö{~…QH4"%êè·¹:›.&xw -´ý ÛŠ#Œ,y$yÒüû})úH:@ âñH>¾û=ZÍ"øS³Ü„Q\̲\…qžÏVÛ‹h¶™÷J ¢YF©Á©×‹‹—?§z¦¢°ˆŠÙâŽ@ë߃7ÿzõqñîÓü*Žã çWY–·s¼úðúŽ&ÁKžüp‹_|¾¾yûë\çÁç[ž¸y·øŒý_?ý›^¢.Ã\ß¼çÑ÷ÿ½~ûnþçâ—‹w Ç«$LÒ‘üzñûŸÑl ÷øå" -ã"Ÿ=@; -UQ̶‰‰C“ÄÒo.n/þãvá¹dÆ«ÎâÊB\©",´9£³Pg1@LᨦaNÁˆñ©V„i4R@/c¢àußÍã(xjlçW*ØÀÓ4ö»´Tó*èqf䙺Åo °¢Ü.ËcÂ\Yttÿ ¾9|ºÊœaòm¹EfÀ)WZëà®\ÕM=–c5à@,˜üÛ \)‰²`q_Ù¹9¢¯3žæjY8àö€×®«µ¬›ë"xävËLjL—-¬’6R6L‚²á6Is«®ÅµcßáLSáÔ‰…¢£©]q‰Pp\’»±îZÞ(qFZãøw‚•/Ž}"*ÔJ ¥†í2„#ïF Ø‘JB(–Ãî‘ñÐUÙr£\Òt ™ó%w›’>½+*‚m9ŒtRÏ w4Hj€ ‰u¢èñ€¸tý—MßXËvÍÆèßå:(BBšïø{†Á<±î¶%É0´é&›®d?a­[¿ê‘ûQæ…ÝØlYîd¶¿ÍM”uCH5UH7&ø÷ó© ç0µñ†ÍÐIk%êFA¾øI;À˜/€£Û’ð«žûxvoQdí8Þn{DÆýö;4ŸI ºSËq[\^•@fÔé=Æ{4HÔ¾:x¨›†[«®iJd>N7µU"%ŒÜ¢[™>(Üâä2 =ÝYöbÛ…ºÖñÂ’Çê5K:vʾ’áÖŠÿÈ[“pÀØ^L›Wý7œòy -kèÞM=Œhjò4¸F1Jdùi=¢uœ¤“q¢y’.ˆ÷­ …m Ñ$ô¦¯ØŽ £!ó÷rh·å¶²Ëî«G^¸-­"@5”&›d¼C-ëi!.a¼qÀêáŒê+½Ûns¼²UÊûR´‹Me±¡°g$ì¬Å“‚=’î{î­šºbŠ‚í­ÄX]g8ðáâ¼1,¸÷¤âÝt$Žiì‰nêðÀ0ÿžŒN³æîͯ *ç5Þ½`„8—jº=³Ëž"mgtÈ×Yì³¼¤,¶ðñ$màî;40/jÜÉ@æ9°ÜV<ܺ–DÛçYp³àþ[Bó'Œ ’ ky“ -ì`tϽI©p=+î}¬Td^.Ñ%kÄ°Y¿ý0ž±®E™DùM#ÞÍj!Ü‹µ$VA×Z+ÄÑßÁ¾gID½y|Çü’ÞáÑò_r¬ÓÛÛmJRõ†5tàuÝ]c÷!ÐQÉÖõxjHj‘ô›Å%Kô‘\ÁH×;½™<\7º3zëq–ýœ¨ á„ÞŽü‰„x±µîH£þX-R;G±oÄp - Ôš€ü†CdØíÅÉ*Ã"7)ǦM‘ž”q“„Z§OîC«"؇[ žíc 阩B¢,u±gv.T¾éæ¤òHëÓKeDÿt§Ù×ì–E̳^›0ÑÀËë­š½í¥Ù„U\„NŒM4Eð*?ßó¦}-±“Ù« Ï ¹É®Ew°A™î+Y…F@èBŸŽ¬+NzÖÕµPL#EÊ´ymÍ$¢æÀ+Ûn”; QÒÝþñŒÖ£ñ„˃h#­ªßUÙ4<黦ԃš¥áÐ|$ ¦[ò_ -ú7ØÀ»™Ij«ý¸Ê)AÄ ‚®ÉGyaït³H.Ouø¶Âm0¦5úJûîñÜaÍãïbè(ŠNWÃhÌ-Ÿ³ØwœM²3 æª3Or -Sä”ÒžËÍô)mpp˜¤üÀ€Cºѱ‹‚‰`ý¹èÒ €z‰÷yÉèÇYìï&Ëa'Y4ØäñɪýV÷]»­ZŒ€ yøFºÂ‡™$Nç_‘Â)£)¡«’Ì‘Ê9ºA( -qòZÖ®}*Å'‰Èv}?ˆ÷a— µåyß ÝÝ\¢e#Xd#Lë“wøo‰ M] H|m8ÆL#"¦Ú8ÊÇçIwÉéÝY¹Ì›=Ýq5]›d&\8wËDÅ|ËDço‚22œ%d¸eÃꌦàÝÄt)ÍPB’‰ '=¦°Ï§ãÐ68ñ:±Kšbb©Òrää2®Ð/©"›]áºâŸù1Ç%a¤Óç«‹yND!Iظ:6Õ¶&Šl9èˆcQ€±1÷&©…N[Y9ÇÞÈÙ®í÷¢êtXúÀ!fJý¾l.•½à$©ŸöbÁÊž (±¶ Ž¶žaRïÚ1®‘b@¬cá#b¥:Ô‘Šu;¼MM¡+ç=§e“$ ‹$ûû²I‚LLŽs³ÔzSJÛ°²Cƒ>aë(¯æQ/°ÙO2¡¬µA•'¼äÏ®ìG‰ýMfGe’îî»* Yd Ѓ ñgÏŠ„FjEœ´°(jKµÆŸ\Òeå¼ÜSìÜìX ÞÜp ‹@?•ù†kƒas…Ÿå”“`y#‚|›æð¿Îo®8DÞZk¨ÅúKËÂw }t䶨Ae ¤+]`^ìm‘‚”:/Îð™<)X1©†Ÿpƒ®Ú’HM!…ÍÃmÒEl¦œ)Š¦$·©Nâìg[Qî´!Vè¢`‚üUnw~™0‘ô¤ráð‘îBö,mé«-'Û‰AÄëUuFÊ4̳BÖ°®Î0›„ùÌ·r‰SUV yþ]ªœ«ÊÛR² ]¹9ÍWàüPå kE¦¹~¶~­ÂÜ3áÏÕÛµÔÛ?öÝÒÑuËõ¾ºf?"wºö©jzô":Kež÷%טbà,¶†ó8Êê`tí*p®£”½yÎs$Лô ©Aó}'‰çÝž -݇p±I¥Ì:‚ó¹J]œ¹b%'î˜fÇçL wGáåºÄÿÖ#¶çò ‹Qn‚ðNߊ€›"cwÛ#þ9כ೮–û 7›j*45‘O¥’ÕU™DíÈQ‘ š6+F雌ëÔ\ÎJå·iðu_õò°åðÁ2&Qò ‹P©â  ÿÖ)Xê -+`¬øM.†o­£ Êráf ôбož¨œƒs_gä¾kùr‚L0d£hˆì“ÉD‘‘-³%—WU“9E•íç®cOXrÝà ãCÅ/=wYŸ¬hOºcŸ€<Î ¦_ -ÅQqü¢ÁÁµÔ`–ŸÂÓ6>õÞ8~dua„¨žÓˆ -ñµ=¯ïʵÍìËA`hhíBî< -ºcæ.É_x‹N¶Oö¤ÙZ¯éÈ=`z~}ç -‰ ™2÷&Cï1ö¹ÿ¡¶ïû.§øjÝqræ~(Ê+Îá©çJGaZ|Ou΄¹ÊݯšÀŒ>ù;´@Ÿø¡æŸý†Ãäx -ežMÃMvŒ§ ¡=ÿl­õ> >> endobj -2454 0 obj << -/D [2452 0 R /XYZ 85.039 781.388 null] +5560 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 240.82 167.248 252.509] +/Subtype/Link/A<> >> endobj -378 0 obj << -/D [2452 0 R /XYZ 85.039 761.463 null] +5561 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 186.623 171.793 198.313] +/Subtype/Link/A<> >> endobj -2455 0 obj << -/D [2452 0 R /XYZ 85.039 741.134 null] +5562 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 145.369 195.687 158.271] +/Subtype/Link/A<> >> endobj -382 0 obj << -/D [2452 0 R /XYZ 85.039 298.591 null] +5552 0 obj << +/D [5550 0 R /XYZ 85.039 781.388 null] +>> endobj +1758 0 obj << +/D [5550 0 R /XYZ 85.039 761.463 null] >> endobj -2456 0 obj << -/D [2452 0 R /XYZ 85.039 279.719 null] +5553 0 obj << +/D [5550 0 R /XYZ 85.039 743.459 null] >> endobj -2451 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F70 2201 0 R /F18 2207 0 R /F56 1642 0 R /F41 2104 0 R /F65 2099 0 R >> -/XObject << /Im1 2193 0 R >> +1762 0 obj << +/D [5550 0 R /XYZ 85.039 373.187 null] +>> endobj +5559 0 obj << +/D [5550 0 R /XYZ 85.039 353.199 null] +>> endobj +5549 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2459 0 obj << -/Length 2905 +5565 0 obj << +/Length 4092 /Filter /FlateDecode >> stream -xÚ¥YÝoÛF÷_¡·£Ð˜árùy/‡ØN·°ã³Uä¡-´$ÛD$Ñ%©úÇßüffW”D'‡k „»3³;»ó=+3‰èÏLŠ4Œl9É Ú¢˜Ì×'Ñä‘0NŒRD“$Œ²¨³ÙÉÛ³xb¢°ŒÊÉìIf‹_ƒóïnfïo§§ÖÚ  §§y^wS¼»:{h¼äÕ¾qðùòúâÓ4.‚Ïw‚¸~?ûŒù§ÛŸpvËS¡¹¼þ п\^¼Ÿþ>ûéäýlpÆÓ$L2‹CþqòëïÑdA÷øé$ -mYL^h…¦,'ë“$µašX¯NîNþíw\2‘U#¢8u§¦ Ë8£‰ó0Î-QŒÒÒK-&œ!H:”Zf!ÉÈ’¼Ò4 -ÎÚfj£à¥« ¸™žšà‘îœeA5o›®“q·½ß,ë»C)œ:Þqh¿s¸‚¾þl&ÑèbN¬lžý’ eÞ+Âñ ê” y—¨¡øž“26 -„ø:GàÉ“­[Ó9ÁÄ©•†r¬–{,DK (áÜ …ܺëmIFYœ3òùc3’E â.oë ¬š{ÏrŽWü•Ï…[ù+hx½ìÏ.?)bS­ÅÜßPüȽV+±±:·B®k‚3 v‹%ljÐ!BöB\ŠµßEüº•ˆµPÊlº•F6›”Céë„ ‘cÊ–Q²e¤âÇ;-•,]Ô>rÎ{Áü±u t=g °„èþª'‚\ÆûÁô£î/fHëã„b]]aÀšÁ|ïtË…¹¸"v=t_˜q/xHGУ±ƒbŒÍÁÀÁ¼Ëà3 ùB@tþþ.rbÆk×[9ë.qW#6É ÛeÅZ£CŒ„:—5% ?6ÂÔ,G‚ïÛ;ˆ"‘^l¡'8}<Ñ0ßj»êßÃH…¦ì-lÄœyÓFH8\ÅÈ(´Ç‚,Ï1m«‹+b|ñ¡6Ó}eZ**ýyŒà´W:Á<´ÍZFNÿ±]¶_½¹`=Èh,õ”€3o] `ÙU›n°[åPž »¤;Œ•š/EDð±ºc¯°žÏÒ¥0M/‚Ý9"”ì룮J_oÏ]³r¦Åø§­6€]Ï߸­á Q%Çybë¡ùx #7蟸€éGn¼í¼ð)%W’jÕß‘tÇÜãÕ´{ËøõRKG_<`=ÙjêñÅPvuš?á*_‚4>2º$1’b ÅR§¯æÓ/˜ÅZ“µƒÐ²ú:-wñZµos̆IrW‡)“§å×ãŒëÒ_`áodÓ,(SxhfF‘׳72`‰¤Zu³AƵ:A÷#…®¤_ši™{èíŒÆìô´—K7,SÝŠ8™#Õ‘×&\kâà±–éF¦bþVÓÇZ&>@A%  ÂÔ*Šá»ãÀ`¬ÉE:„÷9Î@_\ª• ç‹¹|L·í †)Á\ÒÇœR¦z Ñ*]4&:Ê”´mF­Ë`ˆý3«ÍÎÎo¤$¤ñ ›øó¾ôµ70Kô– ƒ…I+®÷ªÂ/²÷Há«U­ð—Ê’‘¶MN>–9˜’Çk_ _ï¥Üzû£6ŸI&Eªh·¾çÍæAèöšÔ¤ “4Q:èÀ7¤áëMq’†Yd¾ÙË‘‡=ûQ_ì{vƒtAþ£ôbT'¿@9ËŸÃcp)×ö]8b“—œÀc*~8Y“EV_|l!øUíªŠ]jh¦šø]²ÒèÄqÛ²¬Z·e#àÇ¥2ÓgÌŽõ W›À!*%vÙ»(å¶D¨«;·Ë0ÝÀÉ‹×BÌ]µ ôTn®*ø¶M -—t$÷/ËõjÃyÕî^|PœÅH µî*fùûz…¶‘z?ðâ.>Û{.{{=ÒAß\CõXöòÄG+‚)PH,朳 £)™AÒªIJ>®)$åœ7›®–øh­«O¸yÎ& “¾TÑÇ‚ÁÛB¥‘î¡Á­WƒKþŸ#AÏ%?IRÚ£ÔjLK£‹«3½RÄiX–ÅÞ¯Íð¶j¨ ¢!ãIñðœƒJŠáÅʯ¦“4Ìã|xé¿(ŒÅ´¾9-:žóâø¨ -9ýÿþ‰ð Eðto;ǘ_8{ž”xLíN1²ìÚò"+KZ+“cóøëÖȆÂ$¸å' Ï£LhíÓ†)ØÞÆnÝQò -ãñ›ÅqÄ29m\›˜æöf½^Xé~Îú¶>Ôþgí0ÎDvîËFGß¼‹aÃ7W,çÈâ®cØ-_š†g»á¹J†ºÇµ-³¥á™3w Z1lK´âÎEX˜|ïäp#ôÎò1¶aFÎ8t=]/AÇè}->f«:™ƒ…áò‘ÔÆß$°Z2šâÒfÿ±{íjÔ(Dà¹Í¿•t—[Çæ6Þíª›<-Ý4 ü.#Cm$_ë$Ü ]é›é¹tÑüx˜Ù2¸;îóÊ"0ò‘ìIƒT69jn亘hê^[3ºÃ0äI¬Û¹g%z¥?=ÚæÈ=-šªHN˜Dûa¾ÿÐâ/š¤Á;II[ä<,ðïvQ¤¿pݬ5Éc± õ~¿Êÿ,€µ‡Âazͬö¾Ëè\\P2Û½Ú"®E ,ó—‡B»$öÈ¿¢€˜û®ë± ¦"Í×>¬²Ú ~C)•`†¨‚Ë,¸Ú»›^›Ã2•¬7Œ#ÊbT „Qi¾ÿ{å(7ökb¾SÉÊIØqøÕÑԨиZe±( óíÒ"I"yìMLpшjÍÔ•¼Õq.ÁüÌ‘{?ðÓð½ë_Ns*ðë©ÖÙFß„@8oV+~¥صÜý•˜áoP®7ò ‚­úÑ×îyðγê7¡*üêÀãû¨ 1eæ&ã~$’QÿŽ~ãïé÷Õkéú Jµ…&`ËÚŠ©V­¹÷4 -Äk/²X³q‹!pñïº4ÖÇ0 ÝZë5Fv/íUò[”}>Øýö¢m}Ûå#%"w&ÆðCG­3ýi@~PàRu÷›€Ö¡xŽÓ_½`QÇÝ1eÓÐâ—mJ„E:þûÿ®-þ¿­SkÏ™ö ÇÕjZžSi¢áÿ ÐÍendstream -endobj -2458 0 obj << +xÚ¥ÙrÛFò]_ÁÒK -08ýæX¾ZKÞuU’Ú‚HB šVöç·¯$H¥²å²0GOOOOßCoæÂ?o–„Ž«ÒYœxŽJ’Ù|}æÎV0óæÌ[@ìÌ·g—¯£`æ¹N꦳Ûe't‚PÍn¿X/ß¾¸¾}õùÂVJY^ê\ØqœX/¿\_xÖ ^~÷ñöÝÇ7Ø `г¾\ãô§Ï‰²nèÝÇ~úŇ_pO9îÅo·?½º5”€ªÉüãì—ßÜÙŽôÓ™ë¨4™í í:L¯Ï€N' ”ô˳›³T<ÌxÕW4„ 'Kýð4ç"Ï "e8ç»Îyžï(ÏŸÅ¡ë„n@¬œžr༞ß µ^_(ת/”g5¶gm×0Û>^D‘u…#4·ÃVUÂ\-ôôíE + º14Ìe¥žzKƒ»®n±[ÿåa¨¹µ4¨†øÍyæÎÜpû+ÏeŽ-ð^€¶‡Jé@ózçDûœià¥_ªâû±‹T‘“†O°¶‡!Özák½ÈQò¾¨.üÄÚß7ð§á~‡$U+§n໺°}8 0̆©{áÇÖ#GVÑÊô=ˆÛu•Ûx²¶«7 uÞbAê͹,À75nºÓцœÔêr\Ý0ªÒT|Ã2 a$#ð}ë="Íq6w°!<|\¼Ðeè2ø:늺â1¸E¹Äáø +Ä3Jf±ë;‰çñ¥àD³ˆÏƒëÑÐöüð~öq"•^MW7Èà ±ëDa:¦aO04Ì;Ç“¤áhçZxB¼­ñj4ÏU’Ž¸WT,%4Ž·VßÁß’ngÝò8 ”0¹k5,]ÔXfÍþñ‚8tb°ªÅúôA÷qâA—$åÛõC7qüä${äô¦{xpO‡ÒViè¤(¹üqÛ »1ðéíÀM¬ª–Ñß‘ÖV:H:5ÞÀèÇ/—Cu~†2õv¨%ˆJšÖe‹5ÝžLÕË}¨D9žÌ¢$uüÈâ4´=?äÇ>N±ˆ$.†Ø96 +4‹ fñã;ìeªÛǶÓÒµgxeoLîþ1Èiµ­ŒP`<öàYƒÂ¦Ú@kU³¥äš´û¼!ÒÈ£ÀìΖÜËâ†í$Š|7¶d¨c Ti ÝÁ…ø†®'îƒíôÄuŒ1âIÙ«Ÿn˜ú¯üyCÙZ¨ªÃÚdLÕ~„ 0§‰ àr"¼À5÷YÛówÛÞgk2‘!÷rG¦%g-óÓî2e- Ù¸U9GS ñôåë‰a +†aºƒ&ÿc›‹ŸX0›ŒŒa2b‚«ò‘[™Àæ;†Û™‹ÎZ6rî¡úÿeì±lù‘ËÄãÈkŒÙO×èÃæ<ð-#Ê¥u¯EkÍ¢è®ÐˆÄŠºÆÉKÏ\Ì›*Ϻ{Ü,­ßâ• +7©0æ`N Å€çÑL&æ×®kºÙ4Œ‹¤S¢$_dÈß}&B{GœÉeÑÅb¨L0LÚm©œ8ë¯nèîî‘5¾B¹Ž™áH¢Ññ÷»Ò•sXì¡uôCV¶Œb¼GYŠ- +÷º¢¨¶ gP oP'îHç1Fc¾ÀJ‚ÉÐ`oÙ CÁV^­ˆE|ðF w\öà`lníÍ« 6߉k}ÞxÖÛ¬Ã1ð¨/ëʘ yj‚0ÊÜU~GÑ|ÅËÙúÇ©UƒŠ6(xaZÿB-ÍI#êÆ®òm×dÈé¢Ó̇¥I‚ +0ô’ÝñċëYÕÄ´‘icjñJ' KŒ…¡õ{>gÙò8BÚxíþqøtB vØ Óh2¡š“ȉ¼ø(Zän ô‹­i²ƒÜEØ'ã±ôR&D¾d(ï(^¨ÝM½ëKÆ_’¿c\Žr†ßü;£²CaÖý^ß1H! ÷dQ'd°Ýd¸-…K^zºfFs͆ºŸ‘Zvlùaâ=Ùû-x=\K1ü¹™fÅp¬TžaFÃ3f2ì‰uS3`±ä/ÙQˆ ¥à  sêƒÎtyõL”Â$1ÈO IÆ7'ž¬úzàï}ŒÔ5è½vžeÂDm×ëmÃðˆ|ÃgÎç%žÎa*ä9!ÈÇ@Ìÿ¾Ò ^zi<³M5çïë1ÈãÇ +¾®û'KA8y,ú€[v\ȇöŠ>ɸècã_m½t½üÝ]F—Iÿ*¯ò&ãp º××Wí‘¢J ©ÛIÊ{˜ã‰Bà…NsÀzKáH„'‘P¦åzγè£1SÎZ­0Hv¾d÷#ÈÖxÝŸ&‚¹M‘c´ b—|„• œîCˆíÈŸD}.MëòrI¦l?ä˜bâxÔs,Ð^_aQ TûW× J´«šÎa:ŒTˆ¹ž,ËMfHÖuÐE¿Ž@_?¼·b³àQ&Nõ»aAÌó ôDÆ”²7GËZâp„0eÇ9Î|IŠÈé,Ð3,x˜Âø@ /µÎ¼ cŽ*ðLÈŸ¹×pŠ/~‹Jd{£ÓœMÇ ×ƒdˆD%Àpk”˜xгÎU*¡_µv„|FR!Ìå^éä^«Ë‘F£ ¢B§f!`ñAcü‡Ž{ +r)©=MSÄ®³~ÜöšüAÛÝ ²,œíåpϹl)+\˜âC ׺sÞoÍ! 8ï¶ÿÀô‡s¡P(•’Djq*ЕSI&'l…H:Y„TVTù3ÎbqM9ÎpÝâ[Ñf+cÓÄdyØfåXblµ-—(s^ æj½fÜÒû¦Ób‚ä +yÉ£`Ð>ÿ­G^mÚ×E9eYA¹‘3±·òHf»nXе P f;-“j ¯J§á1(Z–¯Y€¿<ÁR¢ JÊÕ$✳ªøœR«Ó˜šó„gÞt 6ÔÖC+3ð >xQ4KTR_Ø’Ìã} ž23à˜+ÈuÜî—¯£hœ¤+ h¨ÆºÝ´7è¸H:Iª!5¹ƒ‡—Ø™ZôÉîzßiQBÚò<ñÁt!.tÈ÷G×-ÖE_DW_ôçh’C<¦I]Öèÿ…Ix)›©ÓÅN$æt¡GªêB¤VèÊJtxj,·´½QÖI!æ ß_;öW8M¢ß>ýŽ¬Á +ÁþØj—-u'®¡)âüýš‹ÁÎ’ËÌô’(É ’C +ëMÁå•Ž‘±/–8n®p|9-òˆAIU|©¯•hè·í-:ÝÕ„Ä(B(°”ç¾>.´MYÖ-,÷‡Öƒ”[~ `™“Ê!ˆm*).ÀZ¾&\ÐÖù·•qIÄd¬-êøÛ?YnKz. $äzàyª ãaÑ‘j)§^€«±it¢=°˜qªŽ’aˆ_áÐÍqô•è¡š{7Y+Å‚Ô2Ïœ2¥/‘ÊoC˜C’ÀÚ¯rYhnÿ›ä5Ð¥wØU«L¹É©„ƒ?,q³†ƒò,ŒMƒ| ]}À’hÓœà£ò 8À\Ñ M!ñ¬Í(„”‰j¦w× +m~{îo¨¯ÃóÓ°g¶A:L¾8"ˆÓ@àú7žÚTÝO‘çŸdËÔíï*Ó‰è+|ùrÚGô!KÛ—wŒ9?ò ;"çÈ3ìIöð ÏŽ?Ãò3D 27?}xuP+LR'qÁ7¥‰%ѼÒÐö|¢¢°‡“xµêÐ5m¸ãû¡ãï°ÿ9½ë掭<×:§w(üÙ²«oÄ‘[0q/ñæÌ/™Üá[׌~È–%cc!~ š<[ŒXšˆ”EÌ{*ØSÂm¦ArXÕó¬BˆwÇP…LæñÀC€÷iP#Æé—7]·y~y¹Û휒žæz“ãR(uòæ?%èµ3_q$œÛu£S¬QAWŒ GM›eøÏòüý€yð–ã$*= úzéL¹ŽÏúãéA4ª¸)%@‚ÿ°å[endstream +endobj +5564 0 obj << /Type /Page -/Contents 2459 0 R -/Resources 2457 0 R +/Contents 5565 0 R +/Resources 5563 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2445 0 R +/Parent 5548 0 R +/Annots [ 5568 0 R 5569 0 R 5570 0 R 5571 0 R 5573 0 R 5574 0 R 5576 0 R ] >> endobj -2460 0 obj << -/D [2458 0 R /XYZ 85.039 781.388 null] +5568 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [229.571 699.694 271.655 711.383] +/Subtype/Link/A<> >> endobj -386 0 obj << -/D [2458 0 R /XYZ 85.039 761.463 null] +5569 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [474.768 699.694 509.276 711.383] +/Subtype/Link/A<> >> endobj -2461 0 obj << -/D [2458 0 R /XYZ 85.039 741.134 null] +5570 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [382.128 685.538 512.306 698.44] +/Subtype/Link/A<> >> endobj -390 0 obj << -/D [2458 0 R /XYZ 85.039 484.308 null] +5571 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [323.743 672.595 408.715 684.285] +/Subtype/Link/A<> >> endobj -2462 0 obj << -/D [2458 0 R /XYZ 85.039 461.592 null] +5573 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [458.132 208.512 509.276 221.413] +/Subtype/Link/A<> >> endobj -2457 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +5574 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [188.809 194.963 226.257 207.864] +/Subtype/Link/A<> >> endobj -2465 0 obj << -/Length 3030 -/Filter /FlateDecode ->> -stream -xÚÍ]oܸñÝ¿bß"YE")‰*Švœ¤¾6N;ÈÃÝ!½²-dWr$m\߯ï|‘’vå$@sA "‡äp8œon¼ˆà_¼°Ié|‘Ù8ÔÖ.®6ÑâF^Ä2#Z˜0J:¾8xö2U‹8 -ó(_\\Ó”‹Õ¯Áó½½xñîp©µòðp™e68?Œƒ£×ÇG5Á3|}Ž_|8=;ys¨lðáœÎ^\|Àþ›wÿdÀñ;êòœÓ³W }õþôäÅá¸Ѹ4¡I5ùùà×ߣŠ-ÎñËAêÜ.î¡…qž/6&Ñab´ô×çÿöXxÌ,xÕ +–&NB Xê(´ÖxžÄÉ OŽ: Xé XÖØVA[v%ƒ7ÅÕ¡Ê‚Û -FëÒÍm¡'.—0ÞÀÿ6húrŶw0ã)¶ NDÌ17®úª©;žuݴ؈ƒ Ž]_¶Ø®Ž×»2q‰?'â}ШáªqIû{‘=15¢[z¨9Xi*Ný!gB“Öw;d‹!§£V£¨úœ¾¿¥ëÕÁ©\÷Ê[ëGc!¯UFç>6ÚŸ1L+Û -¥nÆì†Æ‡Ó³snòhï[BWw8+Lqfʈuù Õ]ôL“¿ÇñiNßò— -‰+‰.;qGÄ«*èaî+`à9^:r¥¦ŠZöT™;}ƒ<Ë,yÜÂ=R˜,üC|^ñ3Öû·â±ìØb&I¨éAñþmƦÚÐØDÆãã9:Œ­Ãð÷G0q²ip†„îQNî¸Ñ¶¼©|y”JõB•9–P*™Ì3›„‰ÒžmvJ›3ïPGÛ¯M/s¦qêÝן^œfC‚FÊè |É Ö* -K „óœi‰—3Ž¶êùJ1…hxéƒ1Ìg|RÅ^ci³0Îv+¾®ð7afÕÓèÐjýÓ_Ž™Ñ›HÇ–wµòÙB'ƒè@qÌ9P„¹ú8Â'¶ØD³„p²øˆ§\¯5]Ÿ€G!S*y6H²0‰ó±ÛŠxzpEüÚJ¼‰85/ÎƽÃBcüè8•«J±@ä`pß¾ à‚g¾.FŠxD¯Ͷ¾*7¯H¶3ï8¼á ]¶+æ<bÎãàýÉ[nHÖ2³t®‚X[â4|(ã3Rƒ¥uÅŒ<e„5æ"W7›[œV z~ä,õ 'Ä9Wya˜Þs¯h/\ž·Ý¨™óaʉec\Å µ×ÑH™\·£ÒÃ{Œòi=Äì? )~ÛГ‹ã§×þáΙ ®¾9îàãÑ¡^úTOý¹›ôE¬°™ŒÂU9}ÏÄöÊ.M§¿ H³½xŠ€óo YPÊ+·`{ò|uT“îcÈZóÚ0I¢{XpÇO#QÝ?鲕W–¥rµ]^aÍ)~ƒˆ™BŒíIëêÁ8Úòó¶ìzžK1~å´žUi5*öà:²KT1*„šYmÈ!<;ºîw‹5‡[Ø/[îjGáJMò3p>©öª©‡Îw”À»Ñ£§”2@šÖ•ÿe þõÿ,‹–u?,~ʹ–µa.nÄ|Ì™1Ôø :úQò<{>;ñ0ñÈ?4_ŸøpkÂ,W˜ãØ0Ñzþ—Zßëà¿ú+(£ÂT'ãháqWŸäû?# 9јÀÿ,6Úendstream -endobj -2464 0 obj << -/Type /Page -/Contents 2465 0 R -/Resources 2463 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2445 0 R +5576 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [175.286 61.174 435.003 73.167] +/Subtype/Link/A<> >> endobj -2466 0 obj << -/D [2464 0 R /XYZ 85.039 781.388 null] +5566 0 obj << +/D [5564 0 R /XYZ 85.039 781.388 null] >> endobj -2463 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F38 2158 0 R >> -/ProcSet [ /PDF /Text ] +1766 0 obj << +/D [5564 0 R /XYZ 85.039 761.463 null] >> endobj -2469 0 obj << -/Length 1658 -/Filter /FlateDecode ->> -stream -xÚíYÛrÛ6}×Wð‘ê˜./}“l'MZ+m¬Ž’L†–h‹‰lHÊ÷뻋/²¨¤™Ôn;gÆwÀâ`±8ë‡Ã?áDšq;a$˜Š"g±qç4/FÂZpÇg<ШšÎGÏžÒœÅ~?5:Ÿ÷|ô|æ -ü4zûž;KØÇ«g*Žœô9qìlF¾VLûÊ~¯G—£ßÚYHç;4j -OªÉP9žâ,Šü¥0™‰“w\óà—8{Zj”Md§²³Ùy+COD‹ÁWO†ŒC‹Ë^n¯ó´Vf wgêÃÙØ 7ÝI3•ú0íº§]÷ÌÌËí„1M˜–wiY‘Í.«WÔK¨é<"éM–Ô­WéÆ -Ë”:y‘{ɶ^eV'uv׈“MZ1\úÙsчÒö<3®•ñf‚ñPC,4Â]e}ü1§Ý"Ë[ín+ã8ª×è#·øc²ü–ô`lZØ“pÁP•$ÉAÓíðWQ~´º4»]¡äš–,q´Þü^’]ag¯pž-Ø\w³V¤ä\aW•ô¹ËÖ`¸¶gl1œÚ@P™)R´ånB¦žÒ1"NBØö:h K0¨Hn<Cëx½:iq:bYm¯AEŸŠ´ƒdb6Ô—ùúÞêZW¿Æ½ÞqŒÑÀÆ$"àSLæTrJ CøšhrúØÙ‘stBêÀ­ èlÏøøi›æ +)n°ÕnÚ¹iÃÊøŠ&õ*©ÉˆÎ|±h¼(Ó%)nðX±3“–æp˜S,¢dóù¼¥LÞÊZ¨‘Ðkr‘ÊESr:7 -G¿;âºÝ\ëys(´7hgt•TxßM J_²Hê=´¯KZ¯X7aæù>]l{!æû†J1¯ÌÔCÜYÛÕ6ïöcÈ‚p±|ŽÔ”/Y6C‡öDI ì¡™¼n»†Â™ú¥™"µ·¯Ž¯‘ÎçÃèßg ´?åT¡iX>Bò„Úkô¹&½aì5ÉÕÑ¢æy†vÕý8ò]Cp‚Ö]d5&²B×}äïH„ö(#|åê »A•íÊIá˜%LFþé$2\ó±)ÅÔrLph×”’ëuo ÷Xu,ŸäÙ5è¢Î¸O@‰GŠ)!ö_3RIhÝ€†ßÌÄÊpp$<ÒOWÚœ@èñ.èؽ²9ÛEÖVÁJñî@Ó@e¶WQÊ’ñ‘«mT‡„ÝWªÂÆг™E,Tjsò*PÃo¡2M¨±è'X2Ý7¢¤N©‹¨g740/¨¥ºŠj·,ïÕfV Òa‡ÆÆœg·-ë‰IŽÚ¦“w›;ŒMxÇdÍ0r-â:hK<ì7ÊòÊŠˆ½š¥û‰v~ŽÂbêøñ?Fbí¸Çd±ú;‰ý—xßax>PßB÷pà3ÎቒR± †ÿ7äïfçÏþOƒ/Y t?ÕÏÓ?¨ËɆ÷ü "ÿ1endstream -endobj -2468 0 obj << -/Type /Page -/Contents 2469 0 R -/Resources 2467 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2445 0 R +5567 0 obj << +/D [5564 0 R /XYZ 85.039 729.909 null] >> endobj -2470 0 obj << -/D [2468 0 R /XYZ 85.039 781.388 null] +1770 0 obj << +/D [5564 0 R /XYZ 85.039 444.64 null] >> endobj -2467 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R >> +5572 0 obj << +/D [5564 0 R /XYZ 85.039 426.901 null] +>> endobj +1774 0 obj << +/D [5564 0 R /XYZ 85.039 156.323 null] +>> endobj +5575 0 obj << +/D [5564 0 R /XYZ 85.039 133.005 null] +>> endobj +5563 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F66 3242 0 R /F14 2895 0 R /F35 2880 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2473 0 obj << -/Length 1215 +5579 0 obj << +/Length 4353 /Filter /FlateDecode >> stream -xÚ­W_sÛ6 ÷§Ð£¼«R”lioI“fé®Î{—‡¶·“m:æU:‰v.ýôJ–må¶k{¹3A@àP‡?á%1ã2õ¦‰`2I¼U1âÞHnGÂip/b|£èj1ºx7 =ÁYÊSo±±*‹õGÿío—,nÆ”ÒOÙ8˜N>þ凫KäFþ ?Ìq ýÇ»Ùõý8LüÇ9 f7‹GÜß?üNŒ«»%»Ù-qoÿº»¾^¼Ý,z1‹&ƒügôñ3÷Öp÷#ÎdšxÏ@s&ÒÔ+FQ,YI·ÏGóÑŸ’EHEÊ) §Ò $gIu9‘ñ@NfâïËO<æ¿Àx3â0FÞÕïíïz€wÓãA -ðÞcNÉa8à0p8 {­í@$ K!A8e<%sUïUÝЙgm¶De´ wcTM¤ÙªÂ1kEDY•A¶3ÛªÖ&3zß²³B5 #¸x'úiuT SÆcIѼÂÊÕ8œú[ êª„_ým,]•ªœJ9†[ø -%õŒ?v«JÒ0hA½®ŠL;~‘5Æ*Ö¸ýevÑåsÓçg嚈¼_‰¿Êòιþ±Êb…˜Rʹ»d¯ªÏ:Ï ú+¸1Ú.;/´–©HÁy^¡I×oˆ¿Äqº@nuC›f[¡(_;½6K(ˈGÁ«lýâöP,§Ñhƒ§!ÕUi+æõÃmôw:¦+¤këôU`=wƒv’‹ Ú×yÓ‹]$UžSuùDçÉ:Ëů§Cãp!C&y4ÔòpðdÛêb¨Õ;5ž°(qÇNMÆ,‚äü‡Å´†Ž7ç‘_a9@yUñ•X·Ò’¤öDæúÁr½VÇ:œóØÇ)3Ê‘²…nô2oå‘_*cŽ9®ê/d`ƒ =®y. —|N@Âþ:ŸQ¶±ð ®®#Öô"lÚâg®Ü¹íç'dž„rBûâІbw`·+{•î"¶ë§1á!Ré§-JùÕe[‚ýºØrÝëä¬Ð8éI˜´Ïä÷a(ü麴‰6Ê–ê+& -s˜¤4/`…Òaeú²'6&bÛje)«3¨¤Lµ ¤®&ä‚@†¬¸v†JE<<Œ%tÛV è²Ãþ9~ ŽUn¨ ®º½Ra‡Ã‹®Ü„ÛØg¢pã仲µóÿ!ÒÇ[ênÒÿ¬üÀ¼‘?+vN‡¿r€xYÇëò¼Wº´ì›«q¦>q!‰ÜPέ-E|ÿ͉rÏèÞ>ÉöÉ+Úqõn#Ë_hs(8,YDØ~{¨¡GèxÄÑìk: î»oÚÉhžF„cØ7}JÓ×¾ë lÚ—eÙõÁà‡èÀâ ©ízœ^9è¦ÊáE]“£¥Åg¶†…œ5†3e®qw¢ù@cPÓD8¯ÀäÎ}ÿÀ§xùZlPaQ\Ã7IJ_dH4ºÐyVã†Û9€L[üÌÐBÌwe¯£Ýˆ¶†NÒlS·X1-×À™ ÝàçÍG :UÄ þ_þ_ÅÙû±ÿ¢Mà“>8{½q&â4P§sÔ‹ÿf:*´endstream -endobj -2472 0 obj << +xÚ­;ko䶵ßý+ŒùÐZõL\lv{7¤‰»ë|(Ú"gdºšÑTÒÄëûëïyQ¢žc´E°Š<ä!Ï›Çîµÿ¹×q \G±«t_oWÎõŒ|¸rb#  æûû«Ûÿ ýk×Q‰“\ß?vëÊôõýîoëw?¼½»ÿÓ§›Özí&êfEñúݯw7îú3÷Þ}úøóýÇŸ?à—îú×;þåÓM¬×÷ ôñçnø퟿Ë_Z97ÿ¸ÿñêO÷íNÛ=À®Üæ¿®þöçzGúñÊQ:‰¯Ÿ¡í(†W°OøZ¾‹«ÏWi—â1ÿšgMQÅ÷BåEÐÐŽŠcÆu=¥]H8*pü–t®M:׋U…×i÷wdžÇsµ¯\}m­5FÈ c|O'*ˆƒ¾wûl{ãEë/7ÏóÖÍha[¯·åáfã®OÐSdØj2*òºáVùÈ¿§ +€òãPUóüúŽfY™ºK›ôúÓ̾UG‰¸þYq zˆOÖ© ôèØÚ>öpM<ö¾iNßÞÞ>??«"?ž¿žªüØäÇ'…ºÞx@©PGHWà†„¦”ÕÓ-eÕoHµ}Êÿç~ɾ{{|)Ùè(ž§ânW‡* ‚Ékó`—ÈmÏ2/yZùNx—è/ukÍóÒß$/Yøî÷Y•±ÖÄ03“»Þ6,Ñ/È!å¹â¯C L¯wYÁßéqÇm‘oò /VñW¸; +â¶/jt8!Uä$Dúerv@ ä Kä\BhÈ9Ä7IN ß_Q–g8ë›(ä%ñ:­HÐ~Gâ D%É:mdˆ?QZÓ'C6©t×O‹„+¸½ƒf%+‘ÄBß3]Oõ…$÷‰×}ÆûÃP ÔÑìñKf†ÀkŒø±ïïNàÄcYÉÎÌîm-±!AszFûp×ß0UÛäÞüs^f)h·)þï¥æÑÚI"X©Ð¦¯+ vËaQ> +Lï<Ðù¡ +Ô"íp - w™°ç®w ¼?0r¾€åŠýuõbN ”b&–#ùHûºB¹³<ÆžŠ‚x™‡- y6@xx¡ððßÛø>Š 6®¸M„Mk±2È-«îxè'è®~Ìò¹ý‚â\¯\Àžï#£Â=³XDZYÌÌs‡Ìã®Ç¶&Ž(çþÁçm@hз5ƒ5_cküX¹;²5õ¾|þM Ù`ÉãùðÝw൰¥Õoþow@žáé|–ƒ½…!X?gÚ´x‰ –Q¿Îü„A Â êR`.qZ»Ò<£ MòY‡ìÞX†ö¶Áy!Ý”w¦ËH¯­ø¸+]ÿ4À 4üÕ¼túžrÝ kaÆ0—¶€Íl€l’`2cª€…GÚì• mRÔ´X[2!_j!%^"Äï9kDé¤-CE¨4^>J= Ó²Sž š¡ar7< +fý [) +Tþ®C瑇ÅgàÔì·T6Fä1=ää¤r¹Ï9Z.ÖÇ7~b#„:é«m”ØV*>a•Ù }ouž\@àw™: ~ K ±„ÐpÄß$KXø„'Œë.^|j|~bqçKCêìe +Š:÷­bï<ø`gÀsM$ AÖ`üŸYã¯&‚€XyÁ€¬ AC<úk¾*€; £iż"z™›ßx˜¹ t\åƒs1uafcoLCØé€c€p7¿ uM„±½Ä_ïZÅöÆøh ±p (VŽ×ÊRëR¶îºÞø‰7/aúReÅŽÚÆCåGIMÊbk{!xï7¬c¡½Ëš4/lÅ äU>¢ÜV„„+'秳óVže¹=«™PüFžÃß3ò—†~b¾T Ç.t¶óš¹‹•Lùý&å——l>& ètäYl-/Ò‡¢sBk‹>Á”íQ«zVI¡£b7XVм’0@”Ä"BQ#|SJÂÆ÷öX²Ô#…Ø„bø­)^Ø Yºã–¥Á#¾G'nÝ{lïKö²[•å£LØKÇÐpÃXz¦eJù,ÍÕÓ´nýi‡}îžüHyá…àÑZ¸'ºtOKÍ= ñMÞ“…ïãáĬ‰gíÕïÙsßXT,ªQæØIÁ +)üzÞs8¾çO¼¥ÊxLdœ¿ï쨙g‡ŽØÁYõω{h+µq¸ªó¶A… ˜ƒ5k‹ +ÿî×»ÏlP(Ú6 +T”Àh­"7º`@ ôÆáš‹ÍÄö|ªÙSß•[µoÅÈEwC먿Ía¶Q`F›ëqÀp%æ¸6\º{ÿ—ybùA¤ÂØ%± ô2±†kˆÅ&ECLî$}“2&ãi÷¯e*j×U1,@üî†Óñ«ÙX@&v°Ò€Š?ݽÿFÂT I?Q†£O²@Ý?ÿZœª%J»Êà°·ÓJ3ôhÏJ÷ל¡4ø &Ä f]œv¯$´ªÐ½DèhÐd-ôÏó¹Õ×mœ_KF€èßåF;M´Ò±îïtÞè {¬I„&m× Bdzãf¦+.·8‰†ÄÁò•$îIÃŽ3k”0Q€,Y7“W%z õ^ ±^û°W'œ‰çfcM˜”d3jb×—‰¿ªÅ²°T´uÓKùÖ¤ÕWã÷6! ý“—6Ö‹½þ!æ/O GÇé{ÿƒ5/*ï]^eÛ¦“q‚#O…I?"˜’7ô”Ÿø×à0«`&JM3q aˆÖ_@Œ”Ìz.~¨$º•°€æ=tÁsYD(žËß”çbã3ioR£œ+”$âïÈDÄ\σg%Rï¹ t÷Ö€ =°ÇòÌ‘|e½vUåùio‚Ӽߎ³j¡Òþ€Ôó*\ GDè«ðÁš¯ M1¢`â}ÊèðpÈ›|; +Rÿ YŹTâ0Âýnõ0ãA¤GÓŒ®_™^ô=XËÓøR€.ñe·Ö<_ñMò¥…¯åKßM:¾ô=guÉ-ÔgŠBð…{ò)?¼x1 +`@fǬJñu•VCw;“h{6/E™Ê˜‰np:3ÿ˜U#WynÒ'Æ<« +ôˆ.}V¬i±ªxÚU¡ö{Œ9­aÿSV +lî™Ïõ©H@'±ò¼™¨ØqUäE¯cXûÄ“‹ k€.0¬µÖ,ÃŽðM1¬“âŽÓjGló«Ö‘|‰4?ÖÜKOtØè¢f·—¯INÔÈÑXøLÒ¿ŽÄôù;¬`ù›µïÄ3!áä”Sb|g2LÿãÄ=Ó&QSû¬þùDó¸Í¤«TÂÙ²À´œâƒøH†*=Ö§´}9`Ú€ˆÒ(%. Ì„ÇÚ>g…Å-®šîÁ‰à©6ì¢È)ÖcF”Œ$Ë¿T“±«%iuuYàâx/˜Ü‹Ãõ)=Éû§dA`:ÿ?™˜5ìFÞl‚HS`]a}™£a»sº±LcÃé\NáÁr‡ŒýZÂqÞ%‚0—š¹'ə٠$×szŽ.ŸàÖ}´ÞKÉßw[Õ~oI©O9¤ôÄÃ;ã3Î8HZ;”Ä\–ëhA®è’\/!4r=Ä7)×¾Ïò’ÂéV” 6Á†¯ì{I\v%ýl„9Ÿø·<”², ¨PðûRøFžûOmiÁ¤çÆ£CÏ;î <:~ßoï¯øÏ.(ðƒÿJÒ^»¡J.äì;˜©”}o+àûº»4ßösù“m’Z®ÉÊó› žÛŽ½4V¨ÞïÞo~iSõš Ô,üø Y‰|9w+ÒÄ‹ð8$FùÉï©J³’åʼnŠõ…ÐÚ—,tA²ŠdðMI–ïsVpÙG3¶†$ _Ó­ µóÒRî$†MBÈÜ¢oKì°+ËÉž;ëÕŽ¼#yv|5ŽÉgã0ºSÁU.CkîšÇ›"“‰‚z¬Š¹¢Š÷@wÏ¿«Õ3æËX2b +ƒ««[\ó\Am¤õ.耸@€.qÁBÃC|“\`áûˆg=[bî{šAØu ºÛH(óZØöËžÐÆ£­µz.Álz‘‘Æ…(8¾i¶çkÁ÷Š—\‚7x™oNiݬ&X5w“³¤#p–p½P"òWè‰>LÖ¸p"µÇ:E8²KüLó[»‹¥a«æn.ì Ñå|0ÛÆFÛ?Ç¢Âp‡ô Q™æ»–ƒÒ²ÿø\EÎsh“®Ï®”ËoøIôQs{GÄâ+×hfíÆëzƒ„%ø­@WŸûW]i­”Z1½-º¾]Þ_ƒ+–Yœ+•)äJQ½DL·ò}V僋 +0œcä0òÆþP§LQÒÑó'ñÝÁM}GJwµ”ìð=ˆ¦çk…nÒ6ÜOYÝ8`rÖ­çpfȾn™“‹Ì„¨Ø½÷-•uê}–5+nsEqy3.B"¿m“€çXÙ)o Ô7–:ë8Y?s ´cL¾‹¥Pz«lÃǺ©ÎƉo(e˜§²}’‰Í|S¿ÜcÂØTldüÁÜؘ;bËôÀ¼IC½Ç® In…%@"x´õg‰ö·í6ÞHO•±< ú™ ÝÕ–¡1ÊÄïÆÚ›ÞHúµ+ºþ£y|š|ëãÂfÃäBž4o¡ Ð µˆP,Ôß”…²ñ}¦JtH›Ü´È©ŒÂKN[jˆ¸A—)€$n­:£Ö½O’ÿ ?áò×Öµ¼^³4«Kô—Ïäj*Ê&¸å„L˜nÅ}õÀ­£LDh§Í* å_íȧ¬¿à|ìYÞø Û±~©†v•& Ùí)mö·My{xÙ˜rêÓi7aÿðVÂÐÌC,ìïŠ>¨þ…XõÑÊùáÕEÂo¢š¶ŸuÏVgÖýÄzüÇS:öMÕjl<5èÚgʼn»¨4*¶¼?h¿Ã}´bk©‘àÑœ³š­ºL·™ñ“®9ꮹ·tÐ¥p7¥Ï&(ß¿åÛs]ÝÖû´Ê¨æöP‚=¹"¼‡náOd÷ƒ¿ jŸ6d*D)ÀêF±ïÄ•Ÿ/ïJ”Ÿ\ªÂkaŠ»æRm×6SÚ5@6YÙÕ!»ßg¼[iîÔüUÌ\Ê5C§üS›¨1çج¸”\Ýž©'õíÌßajGy“9Oø×>¬üû¢Ùþ]ª¯U¬g§çÑKï ç–ß?Öã ÿ?ËlÀÆendstream +endobj +5578 0 obj << /Type /Page -/Contents 2473 0 R -/Resources 2471 0 R +/Contents 5579 0 R +/Resources 5577 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2478 0 R ->> endobj -2474 0 obj << -/D [2472 0 R /XYZ 85.039 781.388 null] +/Parent 5548 0 R +/Annots [ 5581 0 R 5582 0 R 5583 0 R 5584 0 R 5585 0 R 5586 0 R 5587 0 R 5588 0 R 5589 0 R 5590 0 R 5591 0 R 5592 0 R 5593 0 R 5594 0 R 5595 0 R 5596 0 R 5597 0 R 5598 0 R 5599 0 R 5600 0 R 5601 0 R 5602 0 R 5603 0 R ] >> endobj -2475 0 obj << -/D [2472 0 R /XYZ 85.039 634.111 null] +5581 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [378.225 747.083 512.306 759.076] +/Subtype/Link/A<> >> endobj -2476 0 obj << -/D [2472 0 R /XYZ 85.039 598.046 null] +5582 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 733.534 323.852 745.527] +/Subtype/Link/A<> >> endobj -2477 0 obj << -/D [2472 0 R /XYZ 85.039 561.982 null] +5583 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [386.739 679.034 512.306 691.936] +/Subtype/Link/A<> >> endobj -2471 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R >> -/ProcSet [ /PDF /Text ] +5584 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 665.788 404.531 677.781] +/Subtype/Link/A<> >> endobj -2481 0 obj << -/Length 2581 -/Filter /FlateDecode ->> -stream -xÚ•YKÛȾûW ö²0¢IvSA°“ÄÛI`-A6‡–È‘ˆ¡H™Ñ¿OU}Ý$5¢ì:°ÕÕÕÕ_½Zá]@¿ðnûJï’uè«õúnw|Üíiæ¯ïBK¡cåÇZS{fréf—«Èt2G%~”¨»e¤ý4Š‡Í»÷¢à. -üÕJÝmž„r“ýÛ ±ŒãÀûuzmÞ,–j•xEõT/Tè5GÓu…ÁÌtfkÚ|ñŸÍßÞýe3Šd÷›•7 iå«$úž aâ§JM µ¯ôê !‹ªSïcÕ55ÉzY¿ùþ‰&ÚQq4lÆw´E¤ÓMÿ^f‹e”FÞKQ‘~²z­½—–Ç´·+‹¼âN”GŸÐË+»äD JCë¤×å<ùJcˆO¦úæP7«3´IâýÎÃ|<Òh6Gû…ÔorR‡&%|5G&ÞìŒÝrÇ|¹|ž­‡B²ÆønBS*ge^˜vf½ò¶ÌúŒö®9ÓÄ©]ì1æD ½#Œ(Ê.¨<Ú0ÍwWu5cÓ0$wuãVdÅÊ -«›uâõÔ¬X7¯`Ò3 ''å „cH Lü|¡°w?UÈ—\Ô!— X/r;H½M @½¼r*ËíÈ['V¿qÐÖKžÜ™²t >‰>Er¯44h˜Ú_6ø²ºpµÄ'”-gŽ$ø´˜–­=ÒPºŠb:b“ßssEêmY“¨~Â÷L˺üµÃB¹aÙÞAˆEl :ò6Žåîðe¡µ.4)²8œ—%j^]žÑÁÕYEð@^-g0MêgÑ:E ˜¿òŃbAi€Û5zÞŽ):€Œ7-LKÖ€(†æ¬b°™ÓŠlÖ’zux½7ÖÚE‡¼h°ªÉ÷`Ïbœ1O#×ìÄ! Lͳ(5»Æ3`¿l©’äJ -†wi¡÷s‡‘-Û’[%Óu5¨hó›0åhÅ+:8|˜G×°‹Ë‹a‰n‚(NVÞƒÈñzÜ™óc³H'¸êPÃ=ÁKç,gíѹ<)È5ëpô)Ün;#vo) 'óÊ…%bH<%tÝàYø®•`u%ÁÁLÍQ¤­Ý¦uã†sΚÜ‘ýRj„-µÙ(Úó0èrð´-fÚú<ä¼åå=!ã9ŠpɹƒnÆú[*¹ŒÆZ0) 6ºƒŽÊÎÞ2CQZ¤××—v3¥PXÞÆK´ËÝf‚/‘ræ‚ÖSÝLd3‘7AÔ#! -ˆ×1Ä­Âú‹ òªÚŽÉueã|…¦Ág4î еœ%«nKÜo@</^y£9<9ãiX¹e;àP‘wA¸°‘›§Ëz,é Œž˜'‚4ƒ5\ƒ£¦Ã•¬fç:>ç?9wž±ST$(#hí=áL@û_[y´u%!|Äàc2 ¢”kgåðÌÖØ<9U./ 1=·?ý™§ùÇb­é¾fR¸1 -¥+—rvèÉM8ÝÜCÀÏç¯4òÏOL‘Œ~„¨«¢=•VùvÈO|à}Ù€˜ú(Š[3Š”Xm7®--Kl¯Þ­´þøœþÍñÌVÖÔ}gg]ãûñj’»Ç.yC'ÚrüT¢a‘†Uäâ¶öþÉD~¦>˜|]Þø·Š r+¡Ÿ¤éw Ø_‡á È:GN¥Ò¡r,ðŠEŠ±/ì{B±µZy¿lAÕÛé¯ù®oŠŽo Lâ~·B -ýxõƒ -Ir;Mô.ñ挒Œ¯Ïh_y|ß [aˆ¯¡Y`XŒì nô[/†OGlsW@0sá\ɪ¬‡•uhŽ‚¡ÖpJgd»Ü¿v›{•R¶üˆqçœ) ’Ä…x¿zLÀ&yµdy©ÃWT+¶Ï°JÊ 6';lV´d3 ÓÌŒ¼Ðž?ùÑÒA&fTÀK—.AN/d{š]™›f.…D²è[™qÏÕ Ò$¦¨ò1E¤ ‹ --ŠA{çSy…J p1éÜ:f™h±`k2 -šrpâéÙìbÞq´¶Í‘Kª.# ' ߪ,tá•»ùB3䬶’çÉk\+Çe/Üh‰cx©®g,Ùö#ÓÂ~Qr.‡rÉŠŠüðBÆp5sr”ïMgƒÕ\b(ñSsXŠ!˜#âf‹ö™Á§Ö:´½&þŽY÷$tg–øñà2ÿ?ÒÀ*ð`Ιv0>p›`YD)Éœ£w¸’öú”ˆ¨%äÖcÌ”68tÏV˜Ì¿õ…åaC‡ð„ -¾-(rH¾®§µ‘d~¼2Ë%-rxÚp8µ'ÙÞÏ-VÌxAe—ÔP"6Ÿ²ÀìÙ©Äz@‰&ßN—FkW÷üV¥Iu'KÝÙ£ƒ_`:„Ð/G£xfÙI1 ƒîÑ¥Ûœés1… ‘‰BÊ!/Ã~V2à–›{ÉH¸ev;´dc!´TfÎnám¬IV•ŽîR94Ù—öU„p×Ⱥo åÂ¥ODèŠW{h–›îÏlË‘ä*Þ8Ï*|Ÿ«ÑãóÉGuW³$$Z[6DûO«í¯\Ô0]7ÍûæÜóà´†g¤ïÉ]"üÞÊb©»”Vm[lKy$¤òy2´‡A]ÌŽ0F—Ù[æ]“›ÎMähØ™9f*NÛJTÝo|¬H>X!åe3§M¨ym2ÖÎÜÁ“ YŽ¼›!àGÐ 3_k-xK©¯bjdæ„•{Rtœ.¾• ûŒ&˜_±ÄºßÀQ´ž¼ˆ¤RpævC«º5®ÄØÿåÉUQ) /mŠ¿|©ñà¼*«½1?×ä¼?ÊÛ™ºx¥é&¯j4#'̾Ãàà¸3ªþ´(Úññe,Èî1'¹7†t@­G}OÖCe†Ó¹g¥+‡ÂÑ"^—ø‘C6ßAQEµ'¬Sú~óÅâc–“ú$²åsŽ|Ê9‹ S⼞'óã31Ý=ðÃ9äG÷–ÆLFAVå]ƒ¹A_î—ê‹’M{›EÕ6ʱ¼ùFqñ~§Åýðw¸Œ¹&›K¢l(ߟ‘ŽÆ”WÿZq0ª›NºÈˆEŽ¥¸ Ä&i4ˆ7Dß(m™ÔXÒËâžG³¶ë­Ù_ÛÈ éØŽ^OrÇ=†öã õû›üOâ–×öN¨ùõ3?Ø÷°3L!?Ú2v(’¨~ÙÜcè‘ìãþ«e÷4FÏ>`°¿¸]àý8Š§ÅÖUÑEÕ– -ügu»ÞZEo7‰TäGQrùg—ûþÆR¾endstream -endobj -2480 0 obj << -/Type /Page -/Contents 2481 0 R -/Resources 2479 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2478 0 R +5585 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [377.256 611.592 512.306 623.584] +/Subtype/Link/A<> >> endobj -2482 0 obj << -/D [2480 0 R /XYZ 85.039 781.388 null] +5586 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 598.042 323.852 610.035] +/Subtype/Link/A<> >> endobj -394 0 obj << -/D [2480 0 R /XYZ 85.039 761.463 null] +5587 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [174.8 529.993 417.833 542.895] +/Subtype/Link/A<> >> endobj -2247 0 obj << -/D [2480 0 R /XYZ 85.039 671.062 null] +5588 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [456.688 529.993 512.306 542.895] +/Subtype/Link/A<> >> endobj -398 0 obj << -/D [2480 0 R /XYZ 85.039 671.062 null] +5589 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 516.444 312.896 529.346] +/Subtype/Link/A<> >> endobj -2483 0 obj << -/D [2480 0 R /XYZ 85.039 642.326 null] +5590 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [450.04 516.444 512.306 529.346] +/Subtype/Link/A<> >> endobj -402 0 obj << -/D [2480 0 R /XYZ 85.039 406.978 null] +5591 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 502.895 312.896 515.797] +/Subtype/Link/A<> >> endobj -2484 0 obj << -/D [2480 0 R /XYZ 85.039 377.574 null] +5592 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [392.387 502.895 512.306 515.797] +/Subtype/Link/A<> >> endobj -2479 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F56 1642 0 R >> -/ProcSet [ /PDF /Text ] +5593 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 489.346 186.642 502.247] +/Subtype/Link/A<> >> endobj -2487 0 obj << -/Length 2038 -/Filter /FlateDecode ->> -stream -xÚÍÛn£JòÝ_Á#–„¦¹>fn{æH“ÌN¼;+æàv@ƒÁØNþ~ëÒ ØÁsVÊjE -MuuQ÷®* ˃?a%¡ëÉÔŠáÊ$±òí³`ç ¡1<+p½(Ä­7«ÅՇȷ„ç¦^j­6„²Z³ßþyýyõþËÒ‘RÚ°½tâ8±ÿu·¶~¼ù°ôûö˧ëe"íÕÇÛÞx‡`†á¿ë7×wï—ßW-Þ¯&L8D¹ø¹øöݳÖÀè_ Ï•ibaí¹"M­í"¥R¿W‹»Å?*¼X|jFV'ð#×aáŽüýçd˜ºaÍ~˜eè&Qt‘ò€¯ ú)Lc…¾ïÆ"ÌÃŽpÓ0œšáëRˆØÎÚz黬fÔèÇžë'dNë'°Šµ…“5ñ;ž"ÀÕÇ­o½k€1käM¦®<ø0é§w"™q’›¦G¾Ô˜v_€sd=¿|-ë5¼6K?¶ÃnVøôlp? 7)¤ÐÂâPæb» @øÁ‡$Ãó7ê:¶æ­¾Ð‡Ö†Þ9ÙWð_³³iÐ'[TêL Û¤$Ã4Û²ëHÑ÷p²X < C‚FÍÃp—M!MÍGº†Ÿ}¡·ñeWáKY÷êñê¥ g×QIÌàºÓ]ú©Ý*äÄ">>aÈž¸†‚Y" ¥Œ—)>ì:€™ï·'FˆÆ›•‹ïÚ÷žój"„2øZõYYñ¥ ȱ^°BˆÒ²~¢¸†²N·Hù–}ÀûS™·M×lPë´›1¬Ú“(‚,GÈÝ«VmI <CèL$«0ÜpO=¹dTxg·ÄÕ=y‘Ê‹‰ ¬ój?dnFÕ0Š CÚ‡!{qÞhê¥æ4´›–ùŽßÇŒ˜°Ÿj<Ò²n4çDm;ÖfšÓ np¯ª4f›‘ÞøµS¤}Ëš¹ŸfÓRlzí2MÕýV%´ª/šýCaÙï‰[Î{pLªæMM>!p›ÄZÍkUÊ–´å`èÁ‘Û·›¹Ð)T§¯ƒr[WO¼BuÂ¥öÐ鶃k c$¼p‡â5õÎ>T8‘?ñ[·ÓøVÏPº ¶¦Ø¤tŠ¸Ê™IGù¾ÅœÏ©DÛQ9Mó\A\R{œ¸Â‹Ú±@µ÷¯Â CØŸ¼†ðð=ÏcŽ>·Íf¨=º±ÝȪW¡8`ô‘½SíX]]¯ԭ如'”¡é;¨öUèÙÄÿgdºÙpáQLµÐ9‹~,&)$á -ñ²A€ƒÓ‘B‹6L0^4ÝÈ4|1áyn$ÿç!‡AŸr€®‚$üõŒã¦1Õ¿š)£B߸Š²~ZÂõ‚4å‰Æt}aº!.N7b“æ.»É5Õס‡9µ=ø!{8Á*•Q? -]ó§Øç˜ hÈ›(|õA €Oo®Þ~üp§?õYÝw¼ w–¡“²¿g¬ ¯ -*Ò˜¹ôß—y¦ÛsðëC™ñ‚;DêO3ð- ' @©ÔÕN-ú³µih£òµ¨›.¸†ê¡ïÝ2ݱmÊÛò~,µ×3Þ£0Õœ6OnRºÊÏêD泜£×(º!Þ±Àg¹;­ y_Õy;o è¹p3·µF¾åDK¾|Y˜ž¦ ôe¹CG‘ zþ8Ú„D~¡‡I¡‘£ÞõdX(Ó€ƒõ×kÀ±Ä€Äöu(N¨¬ãïø–güEµÆ0‡ÎŸÊfƒË¹$«õë84ÖáSŒ)¨©1³ŸéUÆxÔ°á Àhø‡f¥©»æ=Õå燄Š7X -× ƒùßK´e_öSE™ 7ùelDòœOħEÏ3ó -endstream -endobj -2486 0 obj << -/Type /Page -/Contents 2487 0 R -/Resources 2485 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2478 0 R +5594 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [311.286 489.346 512.306 502.247] +/Subtype/Link/A<> >> endobj -2488 0 obj << -/D [2486 0 R /XYZ 85.039 781.388 null] +5595 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 475.797 163.49 488.698] +/Subtype/Link/A<> >> endobj -2485 0 obj << -/Font << /F62 1689 0 R /F70 2201 0 R /F18 2207 0 R /F71 2204 0 R /F15 1628 0 R >> -/XObject << /Im2 2261 0 R /Im1 2193 0 R >> -/ProcSet [ /PDF /Text ] +5596 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [405.345 462.55 512.306 474.543] +/Subtype/Link/A<> >> endobj -2491 0 obj << -/Length 3153 -/Filter /FlateDecode ->> -stream -xÚÍkoãÆñ»…>D,—ËgQðÝùRïzÖ5-’| %JfM‘ -Iâßy-¹”hÝÍ…s9;;»;ïJÍ<øS³$t=ÎâD¹:If«Ý•7ÛÂÌwWJ0¼YàzQˆS¯–W|ù3幩—ΖBY®r^ÿõúýòæÃ|¡µv`z¾ˆãÄùx?WŽÞÞ½û‰óîÃ×óD;ËÛww<ñÁ Ãׯ®ïoæ¿,¿¿ºYZ‡Xni<ůW?ýâÍÖpÐﯔpÃ5Þ#qæ ?vòÕ|¡œz—3p]´ ¨±âÉ.§±ó³zMý„ È+xS ¯«ò™GÝ£ÐYe«9P*9Ò°(Ð;’'â ž÷Ý€§C8qöYÛ"ôˆ;Ö9eÉ#¼¹,WÈ®”ï*»Àt¸žvºZžtD49Ñ®°eCg‘ çÍ'ºfc¯œìgOia Ïdò8tõ¢ÉÏ™ºèÀ¹Ý˜íç²QprNí¾®YV8Õ2nQwS7?ì÷„]7xÂ$Q­šçýÜ g|e²I4ÆæJµX5\ˆ€VòË&£76g«ŸŸh7Ò‰(!ظ¦x¡óî-?ov÷|˜Ç‘ó/|}¿œ+žxC·\:tÙˆ½Gìëûûß}xtu˜8·ò¼_~˜û°¹C"ßÁàoBç¯ßàô?nïoÞ¸§Ö Ü«Ò³Eº©ÒS–g0à,i÷vçÃœrS<Þ`wÀ -ß…í¨BzÎõúSVux¨l‹ £È©Q=¢Ø¹ÿán߈³BåÀXIšõÒY}WûáÅ£&ðœDPn¢P>s¡Àe¼ËŽå=Š>+à¸A >ÀØòoPõ2Ò·Ö(\Ë3Y“ó ª 7ê55•0VMÝvÒë&Ž+³I‡…ì08‰CÝ8y41EYs`5WNÀ­l0aBUn¨¢î{þÖBA^€Ýͬ²Š®€ã¡¥—€Ü!®Ä}évÈÈÄßÖ -~˨äuŠ,eÏÐåHI`ÜæÆ…²»0o/k´ŽLpüݵàGbëÝ–’#¯Ù=÷lû¦c·^Or\|ë²òÉH„Þk~fL¨5¾°g7†™LHzF‰ ’SO¨ÛZAÉèÜbBz…EÕ·{‹zj‰AAè; ‘ÚÐQÑ€n€Hhº5©R+ñÁppêêVl˜ì4’ðŠ–7ËJ£Ö²+Ù! Ú];¥QD&T¾3W‡U,£:ÎŽ¹ÎÑÁ;2Aƒíɘ0”ŒHbl ´5Á"Æ1öÄ’¸2#qË°uœFJ±VnjpàŽ'³‚~QÌ>È>Î/¹ª+cèI¿|8GܼlBkjή•'ÌjžyŒœ´9ST[Šì‘³ä„"5iŒÈ^ù†Bè™ÎzàiðO®èu>˜ÐùóXEÎî$ù±*H± >©¨~[ŸcÈ­(õØÉUj!7ä“šŽª½¤üx(¶ƒõqØ-_v—ÚwÈï’ã A!ü‘» \ kÇîR£§ RgIN>gØŠ“’5;Ì×TìP~/»Ãøâ¡@KÃÈ¿¬ˆœ$wv(°;À­yö€ÚS”EŸZÌäPBg‚EaÛÆ)»¢ÌPôd̉¨â#»âÖ±û©œÎðe͘£ÚUI ˆ ç´°ÀûeŒç=›ó•Î‰…NÄ¡Ù®Þ6ÙŽïr ¯CåF^0ÒòÛÎr¼»lÛd&›$Ã1åUïñ2íóÄó‹s{ca’[-úä)óÒ”Z–3ë©[R[?ð¢ŽÒôZMŽ1›xd%hínŽ«/1, -ÝH1™Ózßç,ÞW¨ø \¥,Œ¡1‡Óõ-ØIEG_çLòø˜72,:‹,Q2ÎŒ›;²_løäü••üWócé®™($ RÊÐOÆ· ¸YµÍÏëY+áÿ¦=“Â8Ô™p_t°¤øHEÐò s,„У✸nvõa¼°ÊQ' µÅ8‚bd«­”óó’7…Ôˆ>p•ŠEô¸£OæÌL÷Á¬²}ö0v¾X>¢žpAi‚‘i¸êóµ)_Ž -q+v|Š2IÉ#“'M-Â]ÏÆaªBî?c+ÏïÕ˜¥JÇuÙSRÓ¨ÏÄ=ô9yÇ8…¬7piu=¢Â­D}äŠ]Ö<3üM½ãfŒ_×L¢AZ¹í´á§)ÍÎãoŸ>2³3 -¤…iÎd¢ŒÜñи­åÁ†âŒ ´×mÛ+q¯›}ã¹¡Ï âåšÃ@õ4ÊûÚ£•Îf­¨%nvYyrªóvkÚÞôTô'Ö^=|6›þ0 õw1ŽˆçD¼Æ¦ü®„ …~ÈmQû€uæT‰E ]iÙôχJÜ 1ñéì¦P¿—Òú4Cî«dÊÊ+•A_Ȫ†{Kd$ÒgjòŽ*ÌŠ_‹t¶¦ÈÁ°ÀR¨ð³?ʸ7%ÄØ0žlQMpÄ×ÀÞÿ2ÅsåS¦mÓ»Ë'LÿÕ˜º‰»á˜ÓÙ!œï+*·.]%æ£Xô!ßçØ)ÄKüw×RBá—Þ«Éê8¦{ù&EÆuv»\ä„nªÇq’¾ÒùÓ%È°˜àVkÕT4í‹dï²®Ï×mŠ+ÒÊƸÖÔü“ Ú®nrÙ›ë"’ ¶±±ê€ˆË8ViŒ5¾óy œþP®Åûõ½uûbðšgö[=¶¯oí\ãB¢wÖ2ß­}l•…Þõ¹÷¶å©"Ìä€ÓVë§>M[óäÎ=ó˜ -<92UÖpXE˜å³‘äœkSŽ{°¸ÚDc"iÒ|‡¼ ÆãF+àRMÏÓ| @œPÑÑ`1õêE ßg¨²¡ÓcE¿Ïð.žê|³UH‚f[ QÁ”Í©`:öÐ k›f֕™ìZ›6*EOd͵³òê$'N»¾E¬ŠÍ3 q;øŒGì¤àÀTÕÅdÂÜìI¤¹Žb¨Í·„öÕzMµƒ:tšáåXH+”?î2³ÎHÈ7CQæÜÕìBzBæžDÃAäÆD¾dLÁ Vd1ñyaZ¾wò­Hûjpf0Ë•$‰k/zPöKJâ/¸—“K±F ÞÁ˜)’›,.|ïÌ¡T¹òûo‡ˆgÙ[É&>sÓ±gq¾Ðú*Þ¾AcªL… /üi>ÄX¸­»Î˜Õ5‚#7S-xó•ëw,pâÈÄGrúFQ[l+»HKž}AoÔ8;‰,m¶3Áøñ`ÇéL¶Ó¸˜ãuä,‹¬oûñîöŸŒ9â·©y¢xÜ´èEБžó/òÜ(Š‡fÌ‹, |7Òê3͘!Ÿûl3Æ÷}A]±ùP#L.' )7CÛ½'ÑSXRS ”ªAvÿÔ£e0•ä©:û¸>qx?qµ—EÁ´GüDõ)Ö†Üdê±ÈR5èDêãÕxrŸmåÀÇÇÂî[ÂœömØR‘²ïnŽ}÷%y€´„ºôC€®LÏúڿ鑼Zå>Ç©›ÄÓ?c“cüo¿ #T÷b3 -Nω8jÜ¡ÿó}€­endstream -endobj -2490 0 obj << -/Type /Page -/Contents 2491 0 R -/Resources 2489 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2478 0 R +5597 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 449.001 512.306 460.994] +/Subtype/Link/A<> >> endobj -2492 0 obj << -/D [2490 0 R /XYZ 85.039 781.388 null] +5598 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 437.876 146.308 446.535] +/Subtype/Link/A<> >> endobj -406 0 obj << -/D [2490 0 R /XYZ 85.039 694.591 null] +5599 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [470.223 421.6 512.306 434.501] +/Subtype/Link/A<> >> endobj -2493 0 obj << -/D [2490 0 R /XYZ 85.039 671.274 null] +5600 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 408.354 512.306 420.346] +/Subtype/Link/A<> >> endobj -410 0 obj << -/D [2490 0 R /XYZ 85.039 529.279 null] +5601 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 396.191 215.035 405.888] +/Subtype/Link/A<> >> endobj -2494 0 obj << -/D [2490 0 R /XYZ 85.039 508.689 null] +5602 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [367.133 326.755 512.306 339.657] +/Subtype/Link/A<> >> endobj -414 0 obj << -/D [2490 0 R /XYZ 85.039 420.324 null] +5603 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 313.206 323.852 326.108] +/Subtype/Link/A<> >> endobj -2495 0 obj << -/D [2490 0 R /XYZ 85.039 390.919 null] +5580 0 obj << +/D [5578 0 R /XYZ 85.039 781.388 null] >> endobj -2489 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F65 2099 0 R /F20 1617 0 R /F56 1642 0 R /F35 1632 0 R /F38 2158 0 R >> +5577 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2498 0 obj << -/Length 3201 +5606 0 obj << +/Length 3715 /Filter /FlateDecode >> stream -xÚÍZ[oÛF~÷¯ò -ˆh’Ãáe}pâ$uÑ&^GEhû0i‰ˆD*$Eÿ¾ç23$%ÚÞt± #ˆIÎ}Î|ç;—‘?ñàŸ?I¤ë‰t'¾+’d²Ü^x“Ô¼¿ðu oº^$±êõüâò]L|ÏM½t2¿§&óìwçÍOW·ó·wÓ™Âêé,Žç·OSß1¥7ÞMƒÄùx÷ëÕ4Îüæ㮸Æb.Ã?W¯¯>½þ9ÿùâí¼·ˆY膑ÀU|½øýOo’ÁB¾ð\‘&“¼{®Ÿ¦“íE(…+C¡¿7Ÿ.þeGáºp½Fö:3-f~ê¦kÄn hB©Ku¡+¨/h‚,d˜:·U€4JØs;mþ½=ÝãLì=6ksÈÀÎêË‘Ãø¸É`¦|:ó¦óçŠ8¯,ÂUTeƒ©SÝsªQ[l¶P\U›1Z|+è•ÇɸϾéOQ”÷8p½UmQ•\v=«-×®s~Ù—8Þ÷±A2ÕªÔ*Zn¯Ê E…ðñtRÚdÎkÁv%¾µ{ì·Ù§³ œ§¥!ð«‚Ék~ýÃóÃœÔ`è‰ízª; j _›g¿|'ú¢ö“Ô•q¤~™·ËËFmê²Ù.vªiwœïGn¥ºSU¸¾ôÃ>2` OLk—„4d»I³¬$Õ|^›£,YãvVÄÍaĸßɸN·ó%Ÿ‹ïw-c†:(‚q³ 1e¯¸AYñçáÖÜK0ÐÚÊ‚KÏ -Mù¹Ù@ûj€~ºÁj)ÝÄžTK©ÕrŽ‹¸~ý?ÓÅOR…qê,UÉ/jÓTüÆ!݉„‰gAˆï{*|×ÜÅZÂ…/æׯ_ðëžôˆNëâ”ÚpùõPà™’H’Àù­)ðØWÜ®]ÉkÝB-q;_zºGg¤“Á†LTÜ”/[.­ó¯¸‡7¤p ­©säJ•e-d \ -«R+Þj_Ó^¡– -k­q‡ƒÑN–a^Q©—Âõ89¡¸Ú2”Y»ó½ÝWµ°iuЈ/Í!´ŒOZ“t»6ØÍŒ†`óJâö vÔƒ_ØÚÝN“ðÿóHæùÁ´?‚sŒ\â‰G"Ü4Œ ñÁ0Êó…øBMJϹACØ¿ Wxˆ ßÙ/ Ïü-eNåãÊ8GP¼%c5q–û­± y¬Š‹‘Æ2`±è!›[! -+Þl+.ïô•¿Yßewî<=kĈðÈ%>|i ¬SÄÈA -9$f°ëYš¼A°Z2Ü÷ScqÝá™mÆ2²ê*+yHýØG®!i†ýêmì$®›0Ëõ K†$‘`¸KgNgÈð³0³À†‡CGH˜â€(Ĭ7jG¶l"¤è<5ð$ð n®ÎUväïµ^'öR\Ô‘bÁÆëH½Á, í™cÂîäHÁ³;g!µ ­¬5Íwm£„L…-ÖÊ”ðã€Ý«ú‹»·a¶åÄ—šÖø„pK^hŒ„öô¸LoÛŠD7íñûLyF:ïÐb z‚OÀ€@x’ÏÿžJ¨Nu~ŒÊOÑ—.¡¦Í|×Äô´˜e»·gÕèv£NÞuaÛ¡®yóŠitGHêÜD(²-ïû‡ ]¦îhø¾"¼³Ûs4þIÑæ £ô< ‰Á‡ ý1&ïND!³q4;ç PƒøtXé†2§7¬’½1Çþ]ÇO¸—ÞÀ–f§ÓE±ë¾™Kê•®º{ÏÓˆ±iÖm»ûÇååápp«]^n2µs«zuy:¾/bXõ|= „ï&`1foûùH²¸E`©2×æûº0ºFzäÒO}=“°VÉKÿ¾ˆ‹­Á…ÿÍRírwYm/3k1Nf ÐâzñòR‚4wàÆÚ>ºÿUKQ—d¿æd¢‚ž4}tWãø|y—ÆÀàà·H¬‹Maxˆ|ºru:_* ˆG Eôäq6<_å|±ÊŧJâ^x¬ÈQÍŒ*~ö” ¾Øò;šæ£åÑœÍ Õ\e[šgÆ1™/AãD< ¶¢ikÅ ®ªÃº çzÍ bËåJmäy–åIädio@‡}i®#Ó„‘ªÍ@i³ßn­UÓ‘[ày‡‘Z”=Ã3gê0-#†¼ ´ Z-z r}ëÔlÿºZ«Àm· -{;rÇ00y .54n}1,\ç›É^/A±8NH{€à$ žçÌ×g U÷èÇÍžÀìöñ…>3žýô_>Ï?žÑUè¹±LR´èiEÛª‚NUœt¡ã=Êbùªä¨Íä¢ø$ßNvä–çjùiHœÊv#z~gHɪs~nÍöVu/!F -±¬ D8¹‚GŒRWÛ³3À¹â‡1psýöê—ŸQwà&qú •&OmÐxàœ‘«õnWì[²9°M¦N-ò•¶ÄÝöòÍ0½ìɀ%Wµ…ÄÙIÛ÷‰Rg˜N¥N2t„®+‚)½¿©¯”üX[òÎaÇp… ‚>¿Ñ¬” 7àÁºÒ  “Áé ¢ÿ,Lt˜ü–ã-dJrf)GÙ×(vn§Â§x ÓBWø§Ö•×ªåÄœjFùÐÍ®x"ÍÀó èS–I Âæˆ 0+aJi6ñ&Êt˜ç¡Èbu®˜/\^äå²>’’Ád‘çìt`©£+ýÅšòãH††Ú¼8wgº x€<ÿi¯RïÙÒóËf$÷+åÀ.ÍvNÄíçY_ŒL]¨'(Ê‘0ZsÏï¥Öƒ4ÄÜ@µ·ITG£ÑÖ’Š‘y¦¤åÓd_{KV7|§ù ôýŠ.‘±éC9f|më,*=Èy·±¸P¯ É…ˆ–ˆ¿­ñ2XIÊìƒZ'ÚæôÄ€… 9IÕð8k5p< ¤—üÉKî„Iš\Zè²v=vQÄ!Ä‹½Såd~—9?ߨšŒÑÙÁ"/À‚ÀØÔ¹Îö‡±§CÏR³³I t÷$µñÕ|jTöm*)IE¶{•7}ßó.ÚE'/yÇŽ™²Ž´èüa˜¯hmHŸc[Ýv¸’#nT½Ò7eáö¬"ìÔzj¾¦ -‡Öã,7‚Bµ§›gC›øXW’²wûF•™ág< >FVõ?G—CD&±V7-›#ƒW“œ–t±B/Î|V_ÐkÞuMÉrî»Ä5îùÚ‘ñÍjKì|<é0Ó|Å!saŠ`0¹æì}Á(¹O·¶Ö²€†õàT Î!¢W»«MÚæ»UxeÃ/¼ýÑÁòa"°`Áp× ¨³&5et ¨˜«±ÇªÒ¯ˆ«ªÔ«0€Ç -ÅEeD7\Ãiz®c,V•%DôÚ;Œ›ûì,â4¥CÌԿăŠ-ë#†Íܘº°›¯¿p!î­.,©ù±ÖÙˆc­‚óßV5Q^±¿ÖšëìdžÊôµÄX³-™ìr«Ê%!(ÖpªÚv“ÃÆùÚ† eYÞ !-.mØ„óUY´kü–¹d?úº:¦<<}wéÜïL`u܆Ó7s$ÓÞ ¯5µ­5œ3µW­'7ÚãiEëÅØ\ï©aØ¿‡Ã!^¤Èþ}‚Ù¤{†YoŸ8´´é"[ÚÏuøò<ûn’Ny­;lòûv˜X"Ì`£Ñ’X]öìt«‰kÓhŽx“äLȨÿƒáŠÔ85FÇr‰„æ?à}„ XºDwбÙɘ€~`\sý؈"r¥½A1öHçLžji读ßOÎÜÂÎŒÓX±ô0‘Õ]ÓíÚæ‘;ÕÄž› ¿"i£j0–½ÈI~weA5;Ûƒ»=,f×(¶î|÷û›xQÄŸè_.íXîÉè^ ¢mؤ[ö~mÃÜ97ùÀf*€®ø£|Öü#<Ù!d¬)Z•³¤"•¶üû£Å¾³\sf.Cm.q`ÅmÖE9dÃ%¦Šä¡ˆeä§Gßw…ýi‚ö. {e©áj~LÐûÝT9ÈWÜå Ëp -ç&3Γ†Cߦ †ÝÝ\û©2„ÅE€ñØõ1~—¯7ðßý€. ÜH„V‚;’g‘4´ñ‡êòµ †Oendstream -endobj -2497 0 obj << +xÚ¥ZyÛÆÿ?… 5…®(Þ¤…“8ŽƒÔÞÚE \‘»bL‰4+Û~ù¾k†#‘’P ¬æxs½ù½sèÎøsgIh;þz'®í'Él³»qfOÐóæÆŠ¥, šoîoVßGÁÌuìµ³žÝ?ó„vú³ûìëÛ^ÝÝ¿þ°Xú¾o¹k{±ŒãÄúöç»…k}äÖ»oßÝ¿}÷k4ºÖÏwØýþÃ"ñ­{&zûnè~õ·o^qÍ·Åo÷?Þ¼¾×;Õ{€]­q›Ÿo~ùÍ™ep¤oÛ_'³”Û…îÝ ìÓ_êåÍÇ›¿ë©¸/˜ñ¨)®„~b‡‰?f‹lqý5P…³ØóíÀ‰ˆ/ef»b¿X†^h-kþ-Ó6o~Ï» .ûVº¾ðo6iYæåËU–Y•µ#ݯå÷N‘uÛUW­vÏ˺)ö]ÞØuòÈu=Ûw½Y¯í8ZOMÑ, ":škÞ¸ë%vGz&<Ú¯ŽVôÛõ//È$ãõ¦Xi®÷®êòÅÒó"+}J‘¥X추˜èZ/+kÇz¬¡*¡«Td2tŸvÙv /±žKjŽ­ù÷‹$°*¨$VµK»b³D2„çÝwíœÇ>6P­v<â'Ø·¶ú?jhl°’XîeÿdWHøt‹Ì3É^|†g$«úÅ2ˆCØ`[a vô9.˜gÒÅ?t. ¬GÝ›E=s­\„{ð¤‚ù0]º£2ßü·.ÇÃö”öº!^4”ë¹ý&¸…!ÓŽ&†ó“7´Mœ¤Â[ñá÷XvÄRdMQϹÿ±©v/O1ä%±½†¢Ð̹ "ìhž„âƒ'E½4ÈÇ¢y:'n~ÛuõËÕêp8Øe±‡‹DAâë{Z=V¼gϦc/Ý ±}P‚æé׫¬:ìË*ÍìÍSñ×Ç¢Ì÷Àö¯ÕX8o6ê?·ÛêðõH…ùIdû ?#»ëy“ÒâÅí.¯^‘`/´ÃØ»"ÁBtM‚‡¹ÎKðéz“l¬wORÆÁ"ÖPDè(("ÚÃ$U¶›4w]Kˆ,¹Îb„ÓîÒO4ŒðÊM-¯!ë²Ì2 %s-^:OÕäiV ô<1ý¯N8ºµ vmÏ]sè,<õˆYGð<Ó€'ÃÏ÷];òáw ¸ÿ#<'ÄÛ# já:±ƒ8˜F‡Ð, ¢ xœÌÄp Ý[Ô¾õ`è¼´Çûöb€" vHßc]ÔÏ3·8¤,¹–1Ä>=Ü(ÀÕ4jY¤y Àå{¥ÃÊò…Lµ}IÿeF«VÆ’Ð"Rò/}{žtO:qy§Û2It¥¡{ñ»·é ?Q·ì +<zHež6{.~ƃg$I¹ñ7ÜIó±ê‡&m®`ï„{#ŒÀ2ÉžYúŠÎ¶Á ‚Àúj‰WtÎËÄ>h˜‹:Ê :¯£ÑuqAÑQ£õ¦t”¹ÞÇy¡nÒwëºédº¼ gDnšb‹ÙäDÛ•ÏÜ̇óœúŽlZÚĪo›UY<¬6}Ý®@rÁ¶kÉ&%I3fíÙAäË à‚°âˆ\ðe?°K©ÄÃ6oÐÎGkÜü&Ú=¡`ßîÐ/zEúÜ„HO÷W2ø‹Žkìø¤©«øwPÍ´žô’ÈÒ 2[æ°¼÷ÀZr›=¡–^‘ûçZ·ÈO”t¬à|'°ÚçÔ÷-ÜPžoªšª/hL¶]>²^fèYê\5ž¼!,¤5 OU“9"¿›AvƒÞ'ZÈ à}a4cîk|¦´)›³Äiõ’À^XQ~©u' ¢äÂ%Ƹ=l:ðû¬°º±íÆWBƒè‚° +Ñ5a½´ ÖÓõ&…ÕXï-ºž7¸ÕXi$Øóükî†çZNx?±Ñï#ú6?Ü2Õtd's§²è3M^R€pxÉ"F¦C1 Ýdìs¬o(î8^áJ-~ôîËŽoûX¬e&A_Ï*‰ÿþ ‡`äT¸æ[nF–ø9ædøP«p°á í‚ö<Þ;ÙßúÙC€_ž,¡ÌãoV°÷V ÷!´Ý¶ »æ‘Ï{DJЭ+(úx(s¦ÂV°â–ó¶ õ–v, $]ŠLëúZt®ìs%a7Ž&piŽfù¡IZ&w-DD ¾ÚÀû½Âj»À1‚>mÕd2$\¤nR‘Гr•µ Ïd:mܳýÁâíͤtO¸Ö¥Àö–É%”„{X*öK9 CÀD»ß ò|d­èÂdRCB³r›Ðl°Gƒ´hCpíTñ™¥{ˆ¨+n0×iòV1¥ì”ÃŽäiUm÷qÖYöø{õ à“OY”Ë +"ðØå <…G,ѵy.ùKÒ‡QåMÇ…žÃwŒŒi”v˜‹˜(sâ cb}«"œiˆl¨6‘)@ùyž8m¾ßðZ¥@{@ÂÍ,½;ÃuJnÙ#Ìw(¯â­g2«S>mÎ3Á,X„ñ–1J[êõrò<¤’62VŽi¶O´©öm×ôÄó€]Üi“îÛ:Õž>zbHG\o¸<¸>·œûà½C¬ßßKµA¶ÅŸºÔ—•Rl±õ´«6xìDz0>HYˆBôØ3ÜIÈ™-,hQ"3ý”KFâ7h\hÚ²[Àcò?žäŽžL6-Wت˜u¢^„rC)÷CIƒ2î+Ež>™G å„ÊDMËJ +‡-óFm¹ÅÔƒ¹88 +ƒ"Ŭ´¶øG@ÿ@HÎ3í+y‰¦ÒÇ…‘ïEb¼cÄ-Oh½’±SvcHؽ<çbù‘g»W¡漃%4Wü«K«‰{uºØ”we,†¹÷d}’Ãû‹R;Ý–ƒÄ9SQ&ÿ;ÎÀþ‡›PâɧNØáÇ_1üPÚWÒ$¢ ÷Ú?m…ªâߣÔ*µ°Ã’zZËJ!N»poûò™½šÈtÈBÇv"W…Lû|Âññ0ð*ª*v¢Í›.ÕÛp©T½X²KÁ²ï‡°´wÑxÑ5|\ZPät½I„ëQB%é(¿<Îõ"Hùë8Fú$½Çt¡£²d3Póâì7ŠÏ8Ë*oWgÙï¹vG¾Ìþèû…èû/-¨ØºÞ$ûõ4›Ž¼Wv L-{. /ÞnOŒ=Ç)'¶×Ñ5N D8%D×8uiAÅ©Óõ&9e¬÷µ~Åì4¥ .bNœ6ãf +!¤Ì#x,”÷à´1´*›‚=»TÅ’ò(šO4‚«Ä:‚oMEΙòkZç"q> ×d>öÔWcù+¾!)4XÃJ ú(ð[7l¦³ÞX0C¥m$”L‘è”Vd˜}¨ ¼u\dç +G9$œÁÌ8ê´æŽCZ>§Œ+’¢×ïêNÞ’Î@ÒK;‰®<†Dç!©ˆ®@òâ‚ÉÑzS4×;É ;Û‰§;g7e« †’£Í`¦@fD¤èG/äG;/0P|âA®v*\(DH­á †.ÕŒíÚ¬µ©äy— 8c"ä`H9:[&>02:Bô<Ë¿›|Ž¡û:žlRì«Š­œU_v‰¤òRò¯äBë<#@ÊáæܨB,#†ósR ­±]¥8Øl¤’A¢iͧvB`—Ûù%Á Ûsã+8ˆ.à\ˆ®áüÒ‚ +ç§ëMâÜXïrlí΄a—>pé)#pù± ÃÃJÓˆW†ÌØ)ô\aïÌ‘4J((® _Æk&|ª)u+2: N±Œ(~©±Ëê_IC²§cŸùÌÅ[:ÞÅOv ºzÛ"ºÁ ¾xkvðݵ ‹%˜èÞ0uïG1ºþ¸7|ðê÷$<úEzê©Œ ”@šÞ¸›"œøâÆ š H©Gø‚Ï…ïµIÉ‚ÄH«pÖ`m©°?ðë3F"¬.º‚^ Z&jhÈÑjˆóãЗøÜW]ŠŸ‚`?½²øÇ”ílÊ}ƒïÐÈ2”Ø’á䆢ú8ä´ƒL'ðý,bY¨¼˜ð82tNO·|òA”õã)N>ˆ§²üqt[ŸŒqEýI. ûRþ164„ÌUoä3‘Žä2æÌDú¤RVÔÓŒó=§!뜀¥µÂ ÷˜tÂ&Ãra¦Æñ`+Ö$ Tç²Àq8þ i8)¿;±P[ÊØ.£0€˜E¾ÂÙlRÎ=å¦{Ð9JöôLZˆ€ýo­ŠþB »~GAxPÍñ8q$åSÞÌu7zš1ØkÐz‚‰J¿Ì’åﶷ*ï9@ÝHÜÖÔ¼7ÁÃi&ù4£+v¹úŠƒNšE|™‰×-Ò‹’¨:çYøà©M¾Ê:39Òÿõm­6ò¨æi7ô<úü‰÷‚,ôÆ^±úw´áÿuv¦îendstream +endobj +5605 0 obj << /Type /Page -/Contents 2498 0 R -/Resources 2496 0 R +/Contents 5606 0 R +/Resources 5604 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2478 0 R -/Annots [ 2504 0 R 2505 0 R 2506 0 R 2507 0 R 2508 0 R 2510 0 R ] +/Parent 5548 0 R +/Annots [ 5608 0 R 5609 0 R 5610 0 R 5611 0 R 5612 0 R ] >> endobj -2504 0 obj << +5608 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [205.71 454.02 345.156 466.012] -/Subtype/Link/A<> +/Rect [286.952 649.25 512.306 661.243] +/Subtype/Link/A<> >> endobj -2505 0 obj << +5609 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [265.68 432.424 479.579 444.417] -/Subtype/Link/A<> +/Rect [138.589 635.701 387.349 647.694] +/Subtype/Link/A<> >> endobj -2506 0 obj << +5610 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [171.824 409.983 267.01 421.673] -/Subtype/Link/A<> +/Rect [470.223 621.849 512.306 634.751] +/Subtype/Link/A<> >> endobj -2507 0 obj << +5611 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [161.013 360.141 303.763 371.83] -/Subtype/Link/A<> +/Rect [138.589 608.603 512.306 620.595] +/Subtype/Link/A<> >> endobj -2508 0 obj << +5612 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [290.138 338.546 335.01 350.235] -/Subtype/Link/A<> +/Rect [138.589 594.751 146.308 607.652] +/Subtype/Link/A<> >> endobj -2510 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [268.283 275.623 403.2 287.312] -/Subtype/Link/A<> +5607 0 obj << +/D [5605 0 R /XYZ 85.039 781.388 null] >> endobj -2499 0 obj << -/D [2497 0 R /XYZ 85.039 781.388 null] +1778 0 obj << +/D [5605 0 R /XYZ 85.039 207.502 null] >> endobj -418 0 obj << -/D [2497 0 R /XYZ 85.039 761.463 null] +5613 0 obj << +/D [5605 0 R /XYZ 85.039 178.704 null] >> endobj -2500 0 obj << -/D [2497 0 R /XYZ 85.039 739.701 null] +5604 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F14 2895 0 R /F15 2876 0 R /F56 2890 0 R /F66 3242 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -422 0 obj << -/D [2497 0 R /XYZ 85.039 680.927 null] +5616 0 obj << +/Length 3359 +/Filter /FlateDecode +>> +stream +xÚ¥ZëÛÆÿ~ÅU_J&»|È?âÔNã^|g¤E<‘'1¦H…¤|¾þõ×’”DJ +#Ñ>fgggfg~;©x*ßó*ÐZ¸Ö]ÞuEµ†£‡‘µßñïÏûºKÛ9-ø±£¢ä¼\ É¥‚‘E{¹tÂC ×ý¦hao_Yü«­´â~þ-ÝîÊœ;«¥­¬z»M«Œ6p”z©#ë‰ûM½´¡WwÌäi©c«Þ—@% ZäwÜI™jÓMQ-ubÉÄŸ¨‘Gä÷z!+[b´‡¡-6€JYkÔ(ÂVhA>|-ÿV´¢hèíš%­麼á±*Ýæ7´ÿX¬7ÁE‹—¸ÉÍ;ïP£p7pÏ ½ö-wi¶EÙXöŽ™-ð¤Mi¦æß?ê›fí]Þuö]èú±ëž}±Ëb[tß)Wû§³»t÷.Kz`{\ÑEÒhdzí‡h-0ê´Ìx ‡Ü¸GJøŠJË›gjA¥H”c7"{°…žïjþ+œGP>ž™[^^ÓªÀâÃáä¯eæ‘g²ýg~s÷iS,Ñ)AìM.‚‘Ørâ±'¬jòÜ ÃÌo®ò#nÜÛþ©è6Kq;èR'ç%eÚvÜë¼€q²ö[Rͪ†kAyƒÀeßI¤äqºDŸÁm™{$ÙêÜ=ÑÌÇŸ ÙAüÑÞÔK<»áÀDÇ!ˆo84ŠjÅ$tò•Ì¿Z­ê}E7jFüØw\W ™SA8‘§HüwËØ'/ñ¢#fH=èe8‚"‰‹á0G+4²¯+Ÿ‘ÆÄÓ漬¿è¸R‘g”2Uå´Ò˜FÌ^; +A4bø -vmWïÚCTmE^LDªÚ¸<-E\PÇ¿ÃÍ¢øs쌬Š¶ßnñ:.ê"·Èƒ»³P 0¿Ö]½• ,õÔF`¦åù¬ÆûWá„*KÛÑ´‘½>_¿î†¤€û=>.;âá|ýtà[{öAl +©p/czÑA`¥Dhok¾Ä¸žy©pÃØ­?0Q=´ÜIé˜ÏtSÖ¸ªDÅY×´MÙÖ¼fK‚¤Õ0Gâ¥"+¸š•H”IøpÈÚwÜW/\Â{À[€N¼Cîs-PŸ>1’Y›Óm•— CÉüU4ÁÙÑž¼þp¢Y ŧÀ2Ôöˆœ–7…° ]±®Û½¼¹yzzrÊ¢Ú£× +$§nÖ7òtùw o)gµ.Ž…ô"€]t(äö34'¢€¿cN æÁ²GÑÀòˆf,û®r\‚eOÀò« oŽÇ‚1H~CŽ;îÜ"\6¡PàòÛ¦øJ;Pc痢ʨÿdÐTZoJÂUÇcÓgö’؉. ìÍ<Âöb×ña¿&÷ã ‚©YÇ k•e+þ…8™ðÔpâ%^ê캂‡¼()›kŽ6H0@Y‡þFÚ¯(dõÉ%~^®]ÇoG€ªD$Õ|G-ÿB1!ëK¤ü€7 —¯¹Ô %AÊcùJY=Ÿ#F@ŠØE” +|-„éD"Dš^AHC0GÓ’Ç ¥Êäq |‘M({ï×ÓÏ'NÍï£w„SnÐÇt +O8@VsÜcopç”c È­‰¾YŽhJ{v$VysäQ°†wË_Ðà×›I¨Â`UC\&‹tå žF`2ˆŒ=ÖÇK2Ž÷xÝw]z¯àoýØå +P2ËwìxäàRÊ¡9,[ÜÞ¾]p“³DΠúû6ψ!xTSwƒ\©Yúáï {âHœd +ߣòƒïkÁf=^‡ô.üíOìûCJKž¼E=Îß x"çDL#«%ç6¿dQº´0B¼(‰îx ÷¦Þ±P’Þö@±®OŸ}YA¯q1èó€yk-ä±MÚŽ*oRjé2÷©` +!S‘ !@rô¢Ð…E×ÇX¡ì… ‚©°hÜYÉ[:{zs† AcÁúÑatZKØ—²-4ÀCKàçЛØ?Wºúx£¼ùç-,LÎŧHiÌ<Æpˆpið>]¯Íõ¢ñ%?®qJÂ0¶3–ªÂ]êThÓFžZÔ£ŠünÈ7)n@’'gµïýá3¯o¦Š³$ÕœB{Ѳ]k“ZF!‡Ø”ŠØ^ÿ§?| O~rê/Ë ´zO°áYï;¦Èå-×GÃp”µAâôAN‚Úu7QCU±ĉxɬɸÐø…¢Gòíæ§ïy`ôœbÇÅg‚jï@!¯kz\NßõžÊ©àH.½œ‡ÚG<3zH8"bH0þÚ£tì„QØs’RMt²£ç;Ê;¿!“œîw K/eû™pÀéŸ×MÑÉ“Ú”ó!†Ú/çt'ñÝKºˆÎèBˆ.éâ܆FÇûMêb´c&ŒzTbÀ&¾¯¸5i€`¿“ +KÓÉ,^^YƒêB\Fɤå1üÞa­–Œ£GÉ_‡•*á„Pà-·û‡W·á¢k§ +›KØp\ƒO«vÖnÀ=×»`·èŒÝ„è’ÝÎmhìv¼ß¤ÝFûõXSÖ8¯Òô1 ¯I=Ù7T› TG™±O‹}Ú¥zc»8dÛ#p¡O«ß ‡!5¶R¦c@ÙŒ> LFÅ‘þyÃŒˆæ cˆ.æì†b˜“ý¦ 3ÞÏúRÆmöý—Gñ¦AS«¡lróápªJÎy;t€Ó/<ku\¦Å.,ÑÆÖ–±¥ƒZƒdCm +y}Öò¶ÐÁèm‹ñË–dÈ¢Jå–3]Qèe¯m_Èæò8Žõ e`{’´i–µý¶è…Ê;ù&Ç£RN÷”?<qœªF¹T*MåDÉ8hióAZEÕû}Z–G%\O™§8PÖ¿ˆÕjßœgÂj„‡HA[œÀT~êRIÌôû[éÐQþ@`D3_sPÊý} ó¥æp¿‘bÃN¾£Œ%Ñ*pT0p¸ø§ž“øÁäF؆—=bv*³]`:–¹¬×ü ~W”˾8r÷\±½¾Í鎜ÿË”d¾z‘øŽÔ.@U¦®@X¡ÉOã/ ‰­)´ÍèyËp ÃOÃï„<íÓ_œ°,ÿƒt4ýç)¶ád÷¬&Šc:rbNRË÷ƒÇZ‚>®5ð…ðäÇ/Û2ŸÀ¿Iì$J ínô‡=’„Ô°Žé(&¡¾ù«Ëð˜K#ÄâHŸÏ"Í|š 9äÜn’BŽ7›Ê £Íngþtdî¼!¨J_€3Íüy…æÂyÏí&ç=Þlê¼£Í>·cHQq è\…:pAÞ 0a ™?°Ð\8ð¹ÝäÀÇ›Mx´Ùªñâ{ñí\áÕuôdqþã ùý‰ÚP°öœx®@hí@,YPnècy‡Àé¼Sÿ ò:aendstream +endobj +5615 0 obj << +/Type /Page +/Contents 5616 0 R +/Resources 5614 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5548 0 R +/Annots [ 5620 0 R ] >> endobj -2501 0 obj << -/D [2497 0 R /XYZ 85.039 654.312 null] +5620 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 426.515 371.033 439.417] +/Subtype/Link/A<> >> endobj -426 0 obj << -/D [2497 0 R /XYZ 85.039 595.538 null] +5617 0 obj << +/D [5615 0 R /XYZ 85.039 781.388 null] >> endobj -2502 0 obj << -/D [2497 0 R /XYZ 85.039 568.923 null] +1782 0 obj << +/D [5615 0 R /XYZ 85.039 761.463 null] >> endobj -430 0 obj << -/D [2497 0 R /XYZ 85.039 568.923 null] +5618 0 obj << +/D [5615 0 R /XYZ 85.039 741.134 null] >> endobj -2503 0 obj << -/D [2497 0 R /XYZ 85.039 547.93 null] +1786 0 obj << +/D [5615 0 R /XYZ 85.039 597.546 null] >> endobj -434 0 obj << -/D [2497 0 R /XYZ 85.039 311.161 null] +5619 0 obj << +/D [5615 0 R /XYZ 85.039 576.955 null] +>> endobj +1790 0 obj << +/D [5615 0 R /XYZ 85.039 412.246 null] >> endobj -2509 0 obj << -/D [2497 0 R /XYZ 85.039 289.965 null] +5621 0 obj << +/D [5615 0 R /XYZ 85.039 391.656 null] >> endobj -2496 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F41 2104 0 R /F56 1642 0 R >> +1794 0 obj << +/D [5615 0 R /XYZ 85.039 126.125 null] +>> endobj +5622 0 obj << +/D [5615 0 R /XYZ 85.039 105.535 null] +>> endobj +5614 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2513 0 obj << -/Length 3342 +5625 0 obj << +/Length 3106 /Filter /FlateDecode >> stream -xÚÍioãÆõ»…X -XÑ$‡gú%Š½‡S¯×µä&A’´HIìR¢JR«õ¿ï»fHIôv´@±XqŽ7oæó®±;ràŸ;ŠÛQÉ(Š][Åñh±¹pF+˜ywá -„3òm' pêÇùÅåÛйŽ8Éh¾$yö›uõ~z?ó0ž(¥,˜O¢(¶gc×Ò£7woÇ^l}|ø0ÇÊšß|¼ã‰kæ1ü™þ8½ÿ1ÿéâͼwˆ‰oû¡ÂSüëâ·?œQýé±UÐvl7IF› ?Pvà+é—³‹¿,<çxÕ­ß lN”cDZoˆvƒ¢§ 'VŠŸØªóñĵš} D·Ò–Ë>é‚X˜7Láj+þ~å5cI vQí·x¨VÀ ¦ß9¢|Qw7Õ… „+ß¹9"kdÎá¦øE(_Œ€ŒœÛMºÉžxšC»çõ2]ÀïNàìÛç¢2Ç.e[BU4Ü9 WRé=iYêe½‚ѦÌ8CЀ5ûþæ5_Îõ1ã6m¦|P¥ÓPSñB¥¬yxË_³+@]ýc&ƒµ>‹(um:Æ€º6Æ'¡•š–ù‘ÅzTF„8K̇oÓÖFh1+(±´PÔ­Ôtd—2KwšíHŽ¡ÎU´>ï¡ÜV²–äUá)>F=A­Cå‘Z¿t§nÙ -Þ [÷;¡¨ny¤Î—y]÷%Šl¬^æ5Q¤%Öšt ga1¿Ò°,™×t¢%ê Mzº(÷†²ïO µ¡-Q¶ ÙX7 6ØØVß°­p££SÜí²ð)N=œÃöˆpk#Æšd]¸ÛÖÜ2¤uÅSGfĦÖ0Ûxm±Å«_Õà"±Æ–dš7²pËߟQ [ˆö gðÇáUSÚ -Ø8žßÊëÂ(À¬ù³èŠ±:²{ö™\¼Èö"Ž-ÔÞüÿK0@IßsA—„Cª¿+ÓEAŽ º—yK|ºìÙ°CfËÍb&^`Ž¯ÍXt`/K“…(V ‡‹6ß`+°()zÒ^ÉïÉ}ƒû•E³Î3 %ÎÚF[´ -á`w§±w7›aMjÆ{ -w>p‡ˆ¯hãloLwcŸ[ V†Ûw÷t‹.ÌÉ× (`Ã#Èߥ'»5›§÷ÕÉØ®ëâó ä¢.vÀ Ãú§ª«%„ýñÝs^Mù^oñ¾ÉëŸ!ÒkZ±–ǘ‹MZ?¿««ýîæúh*«6˜Ÿ%Њpri!¨°c7>º’8¨×ÙHm]nu’â:‡«~/úWçÑ¿'±[¶¶¥Z‰ŒÒŠas† `Î0ÄöUw¼7ׯd'Œ€^ªR¹õ°¥½"¯«Ë@Ûä‘¢H¶g¤€žœr]àÅÎ"!2Âb,›kž.þ–´h•– Ìñ®g‚?êTšRy-À±ºŽ§Ò$Ôë®ÂÂïc` ˆHŸÇTGŠ™k -U·Sžæy‘){^ø‚« uä‰Ms\ìð»¶j²ç™DCïµHwý×3ŽÎ±½3E«´‘Ã4{äô¦he_ã'#kÓ¥£*˜Þù\ωï¹Jt©¸‘”]† VMü$Vˆ•­¬"Ê$ùÓq+ -ï›Ã·®l`Ù"îW¢^Þù§þSVÖR)â-@[Í¡v)G©ÝÛ¤&WÈÊM.õ?I}Ñd˜ÂC }RåB°¡9—.ÐVôŸd¯ô¥R&ZÀWÍP ¡fì -õX÷½DšÙ€™ C;=îð¾ùrIKéçIJ %àºJ›‚¸ÄDáì˜uàP:pérj×åêh+PÀOw ¼'±"‰è©º¯Ûw7¿àsoxòN C8N à‘Ùå×|uc2e¨#S?ý -*”–Yé€<¼´5Ö\žÍ¯æÓÛ!y¸v˜ÄÙ…~Ú˜ô"@s¸J"R¥l?>b -|µ¤=6º”Ö÷YQ3ž =+>#!TŽ€öÙLñ3èZÖ‘í©s.‘€¢PçGÌÉp¿Æ!e?ìÕgu* È8C÷Å¥ž,D'Áº`èʬéžwsm8Vö€¡Û\xS*²G÷M©]ßñf%šhœã¢9^nÔ]Eâƒ!¿ú2¤ q®öLëÚ³Šäý´ú“\é×ßSi2y‚¶ï ˜ÞßÀ9½0Pº¿»yów»Ï^Õ…J #OÆÐP¾—$A'ÒSBt¡ï…~`¡.tB&^GC„Øýá‹øòzBžPg¯k†LrÍ/tù©Ô “ðŒßc±Ï×rͨ+€»8ÜÊdÖÐæB +PLZœzqôo„0!¨;€ÍÍ^sg³k¹©@y"L,G¼ô®ÜðAaTx ASj(È +N5И)#êÈŸ­QXÕ>k,` !FXb¬ "Ô)ˆ®Ì­O–E““QÕw¸öåå;½D$„•©Hï³.›|ùÏû÷Ò—ñí<”áìó©j¸ø‚¤|ùêX½”¾¯î„'“»@ñÔ_|áû¹­©õÌwû¬úœ7dÊ4 ˆG<Á0èf>_)üœDþG'±àþ7¢þŽ|ËQ^›â·¬nò*Âç%‹²®ÍQd÷Q”º“²WU‚@ï´.øŸù*?žŸ²gź|f‚sð¯Ødef×ù¸%#Ñ]‚KÉtç9A)g÷¯y` +¸M_`;dKÓ‘šC‚«“)ü?Hÿt²è…ØE1S‚XëGFå$v[J,ð¬”Æ!Ú#ÌJ‹¨ÙrÆcOE£“KJ%˜¿@çT6™³ñ³I !åøk_Nˆ|ÕHNîõçä†h$'d¨sò+~]9¹ËÏ&jàsŒ±0Ú€ü!Û[ÝFÛgå/Q(&F2ÌÀŸªò°Acxæ1È7t¥´7•Úfµa»æÑcEÞ-»â¥[r˜«'d™Bc”Vù‹ûÏÚÞzO©Ô‡ ”ËÎ!ê—!‘Ý C-»+~]²sù!œAÙ®hØ'Á ÜuÀ{Q0µ5$ãàu²×8œX À6I +imà$]°dhžØɪvöˆl~†“ÿÒiyz‹ûl¶\<¾0€/'z™eNÙ‹œ ‰»Õ.‘Xµý -íµ¨RKw° ny<£Ðzd”hÃþðØ[´…ÍKÄHAß!êW C4¢@ƒ µ]ñëR —ß¡äüžsò%õyÒn™~ +¡7—Øk/@Vj—˜ç.[’eºèh²Vãxðup2f¾šŸèAÀöóBl*ìgÕu9[ž*ršÝ€öôÉ2Jàñ0R€wˆd©‰Æd9ÄÐÈò’_§,~&‘ûÖ„ÞVGû‚•î¡p3Mñ7Oœó3¯æqÄz[$h­{O…v´¶q{ö‹v²…®“b§)yOøAÆ3l»©o‡LõÛD¼°1à*Žºeñ>É‹D2"ù–h@òšhLòC ä/ùuJÞá‡XøÁ¬5 JÊÔeŠ4«Ö6±`c^2@œñ?Lôbý5k™‘Îàz²9CÍ¡y§Å*hs4]¢p\6ò-ÛíêÃ÷ ÓlHJ~`˜stÊ|âõ‰4©ã9SUÆOïužhë\êÀÁ=Sèo è/γVã¿L ™ÚèQ85§9J»VóCÙÌüâ«k¬ô-$ˆ,Jä`=À¡é/Zˆ4±ßØlÕ"ÒU‹7XšÀäþ¥ì(Šg¯ó¯ù®<îóCÓW¬)~¾ƒ‡shú‹"N< ·‹Ÿ%j[h8«ÕNñ¨~®¹ÐªÅNü"n˜—³R\óøz†³Œ’ ¡§Lþë6T[ìà¼~£{ÅþX9ouÖ7ûôCŠí×™„À£V¸—ŸâÜ ´U9áÉ»>ß#‚ÄñÈŠpˆú}!ñ=ƒ µï¹â×å{\~\A üë·´}ýú ƈSmJþÕO ݳI*ÐN}õä’ðae¼Ú”Ií“–-_/j²ÝgžGú¢Êé4F‡ˆ¢ƒÕYá´KäT „ä‘诧UžÕ6›vjо„‚÷ ÚüÚzÚaÉä\…Ã)w“Œ¯€™}¶ãé®w%’vînçåܤÿ&›‡];nɯX´šæÌpx§noõ4¦n¨áÀÎî\8‡n½*U ?öB9Rftˆ,GYÎCc9—ü:-Çágdm!ݵÞ2¶ÿ)€ÜÎ|òÝ—U~Vvb\éB,U^ÖÒôã¥iFàâ¦ÑºdÖ–ÃŒ¿\p +‰AÁÖÛûÒQG_:ðA§¦—„Ù•~¹À¸u×°Ñù“gI}45RÁ|ˆe¡MÙ<—剣€qQ¼Œéó ‡-û?ïQâ{ÉD[š~iš qÓ"ºdÖ%"‡Ù•ˆ.¿48ãLÃ;Eä¾ÅëÒT-¨øcª‹mÇ.ßÙoô|7Ÿ¯›š€*–=Y‘ò=ÙYŽ†¿ì,¿é¿K¶Ÿ”—¨žšv(¥'…9 â*CuyÞP%€¾º>ð¿¦ü¼-endstream +endobj +5624 0 obj << /Type /Page -/Contents 2513 0 R -/Resources 2511 0 R +/Contents 5625 0 R +/Resources 5623 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2478 0 R -/Annots [ 2515 0 R 2516 0 R 2518 0 R 2519 0 R 2520 0 R 2522 0 R ] +/Parent 5629 0 R >> endobj -2515 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [470.223 578.412 512.306 591.313] -/Subtype/Link/A<> +5626 0 obj << +/D [5624 0 R /XYZ 85.039 781.388 null] >> endobj -2516 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 564.863 187.762 577.764] -/Subtype/Link/A<> +1798 0 obj << +/D [5624 0 R /XYZ 85.039 466.717 null] >> endobj -2518 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [476.617 434.366 512.306 446.056] -/Subtype/Link/A<> +5627 0 obj << +/D [5624 0 R /XYZ 85.039 445.52 null] >> endobj -2519 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 420.817 205.581 432.506] -/Subtype/Link/A<> +1802 0 obj << +/D [5624 0 R /XYZ 85.039 210.682 null] >> endobj -2520 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [228.437 420.817 309.672 432.506] -/Subtype/Link/A<> +5628 0 obj << +/D [5624 0 R /XYZ 85.039 189.486 null] >> endobj -2522 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [194.71 157.41 275.945 169.1] -/Subtype/Link/A<> +5623 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2514 0 obj << -/D [2512 0 R /XYZ 85.039 781.388 null] +5632 0 obj << +/Length 2824 +/Filter /FlateDecode +>> +stream +xÚ¥YY“ÛF~Ÿ_¡ÕËR.‹â}øm’ØÞñú˜Ë•‡$-‘#±†"e²åñì¯_\Íâì$[.û@whàÐrgüsgIh;~:‹×ö“d¶=\9³̼¾r…b)$ËÍOë«Õ«(˜¹Ž:él}ßïÚAèÏÖÙoÖÏÿº¾]¿¼[,}ß·ÜÔ^,ã8±~þt»p­³= 1놃kî˜õRfo8±¨^béë +Úª|úoŽìâÄs¾®ãÂK­§×Z=ç[=Â\#«6¸AYöÔoëÝ]~\,a²ÆM´}I Уü@ ž¦Ó~#ÑP ( íÐ;퇨ø µ®QŽ,+‰¢®TÉ +§4KX¼¸3›~»ÍeuG±k»IHÜ]#c®uhÍÇ>Ÿ`Œø’FxÖc¶üÃF£­Áƒbà÷¬j¦Û‘ë ¹å/|Œjñˆ¶¦ûÙ ŠŒ'tÍßBË·ewçBvç—%P•l¥ÐJnÿî¸A™“Mƒ»ùŽ%>6ÀÿØÑx–¡“X»š¿nÝä[dTãVO<®÷yƒzqR’‡„*/¾ '$ +Œn°Ó-mªV¬þÆàk™ƒ¹¤Qj­÷9¯¡‰¯0Á›ÑxÈ1ùì¦ß‘¤ë»š>Òþ´ Ë팞«#úOYl•l¼’Û s½¤+Ò±u¥{XþØâ {îV9Mg؃ :ÊÕ’ÄM}Úíyâ>WúÔä²-!Gß”y’NlÍïºËõ<ßú Ó§ü”¸gΈá¢¸ôðëÃÍàщîôKP‡SJ ½Á‹0ìoÈ5ìž‘qGÓ¥Àš¡ª¡›~¶º|âA½ $¥¦Y×Å,ì X)Ðal=ÁT]ÿù%­÷hÿAN-ñÀ2óMnÌJläÅ5h^8 H Œœ8Hd|:)çë{žC!öB—)­du-³ƒ]²üK±•öïNè(a üRŅìÏ,ó¼Ðútw3çr/&ù‚1ÅÿÐ"ßÀNyÌ^¬Vx‡°¸­·¹ô›¾S}g¯õ wT*—²ý×2/_t{æM¡úî©…#¦¢[|3—¹&¯²A=®9&±c/«d{:¶õ„'êùêÕ" ,öJ3„qý @öÀú°Cd=Á˜çØ„f!QxÍ[¼9êGlù€Ì5-¸bcä.†º®Ð%±×î‹#·LìI£²“1ìÒi}xÙz´© H‹3ŠûkœÛ0gÑ"+Ù²®àŠßAûùÀjÅLh5oóƒHj¾s + ÌÕΦôa,F1ó–¶&D’Oî GÎ`JÿHžMÃi ¥|(ÏïîN”äxð=?˜ í$ÌaûÀÆ’™cË–W¡[f”hôª¨„…Ns®õ­÷ Šl›u"|mbEh¨Ñ:ÎÝóÝÐ…âÒœþÄccÝ%Y1êò2Ubv€” Êá¸÷÷RÜëy.tawŒêé(_ÒC]ìê.£¶èÀºáï†Øýsé9¤D¤âBlì\RCËxU a½€uP”ž›Ü|õ¥Êl$YI‰à£š³‡?½aÍ'"þ2‚ˆïËñ ¯Dû¤ÐSåÜ” M{R]ÚþÝ:„)˜I‘¡`«ƒ\q•2RFÖ°‰y×ÕV(јðKî.‡-âóCƒhѧ’+3N0Xä1h‘3ôøØt%rÆ|&æÿµ|aj½»A{x)㪠+çá’ДI‡lŠ”3ÐabD^J¼chO@o=ê9>¸ Þ +SãÞ“œs^3çÃ,d”Bs{Uq\ñÕØxSoxC,µ(£„¸ÎPâüJ8…B…,zÜ}þCK(½¡ÆI×˳2Ô”ˆŠ5×E«NsR„b:!e«›\Qš P~)n/7‡žÏðQ7\Ûp8Á ®\UµËWŠjÊGS‡œ”³ä¤ï+ô±Õ¡8ä¶~:rMzöÒ’À"WQ2 T¥b»åc˜ ©öT +=Žó”8g9…yhƒ1®ìNTÍ<ÃÞR½æ_¥æ{Î&›²=¤jòjºz7 g):2˜ +ÁHrଡ ÄUÑìs—“·¥ªÏy¼Äï³·r:RT{‰'i€h} (Xm¡OŒÀ¦ŒÅQÞâTš• ÿ1G~Ÿ<¿{5t™¼[Ø‘´ÿ—îviV ï,ç@ÛÆ–”|™ê²ì¼åB!{† ?ÂúêéɈШG‰Ž|§Üæ‡Á„Vþ•þlŒñ‚èÛû  ànF¦éᛑšbÛ·´¬c%¯7ÏyD×t6=ÜtYd0JÝòÌ …¢žÂ=Ì,#_2Æ'a›5%3—Mü<.Q¶är¢L};MS‚ŸðÝ‘ÓuSNM('æ%5ËÙɺ8æ9¡5§,eŽ %ž×Õñ%P ’VwPQÀjɬx¦Ï¬îO|18J1i9kvFñ]ÒÜÊá7÷¬4½Ðq¨´'6 Ø$u$5Æà§\óâÌ‘2FSãŒÉC`rk2¼®ìE‚ºâÙŠdëÒ¶çc+®D³ 4ºF~è*34\§É6ª¥À>üyǯ1—¤Òæ† ñF$É¿N•TÃtC¯Ô¿>=fÒwà"Í“L]€Žo£ÛõX‰Ó§n²\ü @b'~¶zö7Ðç{à @GaË÷¾-¡ŒÀà ¾R¶•"|Û=gS/`^b'yÞRƵ&‚uhûy)<ê²H½QKsXleôêJ tAEsÿžbµæòS6«î‘=ç—rÆ)PƒÀvÓqœy Å ˆMržÞo|Ì ²bo¿åþž~Ú‹!Œ”„ohiìÄÍÓ‹ ?IùŽíMþ\ÿ™éÿëwÓîg-0—Ä¿ð#bèy¶ç^PI^|Ëoè'v yÆðÿ¼‘©endstream +endobj +5631 0 obj << +/Type /Page +/Contents 5632 0 R +/Resources 5630 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5629 0 R >> endobj -438 0 obj << -/D [2512 0 R /XYZ 85.039 524.101 null] +5633 0 obj << +/D [5631 0 R /XYZ 85.039 781.388 null] +>> endobj +1806 0 obj << +/D [5631 0 R /XYZ 85.039 761.463 null] >> endobj -2517 0 obj << -/D [2512 0 R /XYZ 85.039 502.905 null] +5634 0 obj << +/D [5631 0 R /XYZ 85.039 741.134 null] >> endobj -442 0 obj << -/D [2512 0 R /XYZ 85.039 406.548 null] +1810 0 obj << +/D [5631 0 R /XYZ 85.039 711.349 null] >> endobj -2521 0 obj << -/D [2512 0 R /XYZ 85.039 385.351 null] +5635 0 obj << +/D [5631 0 R /XYZ 85.039 684.734 null] >> endobj -2511 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F41 2104 0 R /F35 1632 0 R /F20 1617 0 R >> +5630 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2525 0 obj << -/Length 2074 +5638 0 obj << +/Length 3694 /Filter /FlateDecode >> stream -xÚ¥X[›8~ϯˆÔ‡©a †ÓûTÝL·“J•ÚjEÀÉ°%réLþýž‹MÈ@"UÛjûøØçþù8ÎTÀgú¶Ñ4[†á4ÙMÄt +ï&ŽæSÏ —^®&WoîÔv$¢éjC,«ô›õêýõ§Õ›Ï³¹”Ò‚åÙ<BëËÝ̱ õfùvæ†Öíç¿®g¡´V7·K^xd¦áÇõËë»7³«“7«žsÏöµø5ùöCLSPôÃDØ2 -§0¶EÓÝÄó¥í{RÏóÉÝäïî^ó¦¼kÄÖ¹ç.l7€vzÑŽ?bôû5˜¹¥~ãPÍæŽUÍ/fs׬z‡kk˜V -Ÿ2°²<çQÌM܆R®›8+xÜÜÂÂqhµuwðóšI_–7_y'IÙ(½áY±ƲÚÅMVêÓ~£˜˜7ôOfâ(i\¥èutµƒnŠ8°£…gåÙxª¸:ð<‰ó¼æáwá eo!ä>HÚªfO^)â®ÀŸÞÃÞiˆoaŹKp¨Þ¸ºGéLßÚ/é¥)¤uÜ°Èæ^ñà.Þ¡°uÌÓ£Ÿúá %âkëfÄÄ8¯KpGäZ$Cf¶#±óŒ?r®~âÙÓûÇ:å’ƒpžu>R)OãB6-p …¹¶LNPÕO¨Hë¤É³ÐCçxÒç sÍbÓì·žÁ'†º`z¹éç“mJÙ“AJ®@ßþ$ѻҵ2t,ÈÙSª–ttM!Ïs4%sÔMYiRœã:“)˜ê”fH‰É¤^n"ѨŸ¬Ec ЫôÝyð‚IktÛXðê† -JÚì°xP‘ ¬”ò•×¡RÈË£Ð>BñÐpysǃ‡û,çTA¤sÈ…j:(«ŸÇýµf¬L;ègø( ¹1‡Ý,Ù‰ž…•Üvnözù‡L¤ä†ÒŽ ‡mÒ´ÕLW›ýG!¼€or:]@3o  hya‡€.¬9v„yuD@ÀÄ… Â|,b_X¯Êâ»p¼m[QfËE@™áè -ø3I UE°R,:§¨kK׿—æ-<ÿ¢ Žíºþ‰ ?Úà ^dÝ¢’P - y±øËFOÒ:éìDHêÊð¼ Žë\Ô3´½@^¾mèrÄôptÊR6ç˜Í©b2eöº«†°ä`è¬5¬=¯Me@YD–ÞS®1¦Ö¿ŠÖšN0<¿eA즙ÓOPXM³.Àƒ­ª§·å·Ð»•©š†Ó=)éf9ðŒ-š¨{Ðc× ŽïÕNžÓ¡˜×•WǨ8h¨ïT\ÔAÅʤ¸R¥2šõ !h­¯ÞÊ~¬ô¨_ÑUY6Ϙõ$¬nh/äBÇ6Ùk½úQ1Æ›®T“\•¬¿*rº»÷Wæ+òê\Ëé«´T àªȱDò]Ÿœ;´.ríZ0VÜN*’¯‡æЮA,EM ¾»@¡ÃÃ%l#s8Ä'µ! ›‘£},WsBÉ:ÂpCjÕÇ»ùÈT®çÚ;‹ÈŽ ïí»2Ø<àæÍz#œ -—:/ôŸ qCà›ñ=¥ˆ-ƒÜK!¾ÔÄG× ¶ Z]°³•MÈŠȬa> s/Ç¡`°õ"ùWŸ·%¹Ñs>vëT¨§ÖEHí…' mUx|ad¢ºâLÁ=³Né²Î -u!AB;Œ 3µGx0U5Ê}žf¦ü÷h\L¥¿Œ¹3|ÎLO¼ÎDÖ¼çjíŸB¥š¡àØ;AdÃ+¥;Úí#¶¶&B7U -@`»WU]ç-t`“:àž× \ëeI× G½}㎽¬ô¤EàÖö¡ØÖ\üÌAm@’·i/H†IC3¿4ÿY#]¸Ž¼…Ràì*è E¼ÓÎëœÝ27y(p¬ðgËÀ£ Ïžqyj„p#d;L]ÐSDÑÉ­ 7YŽˆC|‚$`¹Ý_Ïôb¥~µY…i³õ¿Sµ‰Û¼¡×É°T2ò4X´‡Š’Œ«¾¼¾Âá‰Â…R©M×3Y>¿¦]3ÖÌÙRˆs²ŸTÝYõÏq.»ÿü¤§WÄŸŸPdõ˜'y¿ ÿÆÊNßÁ½¼ºAv³Ç±6^aEzÊJ½>:è]E̺m‹µÐ‡®­Í1v!c°'NAKÿ¦ÀœÑÈ„ŽÆoÌ5ʳaõ±[(¤¯±Ç™k‹14IÕ£i‡°çI´ýÀ·Ô¯ ÐU·û==-p²_ÿ³U ”ú¾ÿ“Ïh¹wò°%öäì+U¿8 -±ïTXj¤­ãýC•¥còæU¸‹fµEp Š¦ëkÝSfþ> à ®L· PIåCÚé\"ôf¾"½`ñc&íy¢«Ì¤–¬iÅù^‚(ëW­ùTžÊ8õ÷²Ý­Ü2îÂí»á诓 Û‹ÆD$…Æqf}û!<„ù™;|Ìëƒÿßﻞ mŠßiyñ=½ž*ªyD_Áÿ*Ï7endstream -endobj -2524 0 obj << +xÚ­kÛ6òûþŠ…¿œ ÔZ‘õ8 Ò´i4é^v\Ñ­lk×jeÉ•älößw$EÛ²SÜAVÔp4çM‹ëþ‰ëL‡‘ʯÓL„*Ë®WÛ«èúf¾½caPÎW÷W7¯’øZDaå×÷#ÆZ]߯ +^~÷âöþ›÷ó…R*y8_¤i¼üp;ÁCoß¿~wÿúÝ·øPnqú‡÷óL÷ŒôúÝ8ýâíW/øM…Ñü—û7WßÜ;NÀUŽlþyõÓ/Ñõ¶ôæ* +Už]?Á8 +Lo¯€ÏPÇʼ×WwWÿq¤x.¾æ¯¦¤¢UêLŠEiO,BæaœÇשTa%$—b·««U1Tmsó±Y‡«ý®_ìÚ~èW]µæ éh«+žÌtdžÛç_oß|ÿk?À§»ªyüõ¡ª‡²CÑܼ>+‹$”)ð«0Q)qò#J¹ÝÏRË)ȸ® ‚¦,´æé¡eèSW % ^%Iü \’ƒŒpíóñI-Â$M¯“4Óäoœ’ +U¬'Ïhai-GRƒZHéVD¾@d'Œ¥:LñÏ0fh}†1˜Œ@'|Æðáv(øŽ=3«$蜎ÿf-­ËÌ*‡ |ì3ûs$â3ÊعÔF ~E]µûÚhÒYàtˆ=nsû%•  B‹€ñ$c›bàN]O_ôÈ^¥¡òzZ3—ƒ!+uÜÎae°´»‹™(é hæFÏuÐY&¶-"œ3¯ÄΛ’ûf.s°™â÷€5”D"Fí +ç׮̗„ +Öû3k5v­ÒØÈâ`…À§ÚnëÏit w´Ûè`›t(*"ØnšÂžÌ}õØ (¡ÃØ"¨¨~ý<Ïâà <’,èwUVv׶ÐÛ}ÏP'UóA[úô¡Á]ER²L>4³âïj—‹jmÞ÷öàË1¿˜Øèïí·Y µÝ|«(Xµ»ªìÍË®cëÁsˆ€eH‘Àöün÷…ãr ŠAKWK– ÌD|܈båK+â§I±DÍ„ÓN@´¯ÍJ‡TœÊã41ÖE]—fù¢÷÷©i›O¤ªSÈyÙO%)RŠ¥á&–@’¥Ü²%F ( ©Œ)Þìû–7Nn8Vô7,TáÍ|U4†‹§ +ƒC,yG)/±ºµÁ^âž…´– ÕƒyÖfóPFêàŒËü…1*T' øgo_¿…e¾á—VØYé"h%?ÆN<æþ8ÙA %ÿj´öØáÌBâÎÄçw"“$X Ð@F¼ÿÓ˜˜%¡P6$.ÐŒóÕx±iñ“õbß Uý%ºŠf]¢¢56¤cSç#3H(¬‡ QÈÜMÅûIüáÝMOS-ýÁS¿é‹í’°'Ó ª…!jüoÐ%ûŸg-MÂ$J ‘ŸL4Œÿ…ãüeªíA6̵WzãQ†+ÔðÓÄUCÛ¼µß.ÃUÛþ–oÈ–ßU=äv`ïìhÒàÇy>É%5”ÅE¦,Î S‡-:¨»±Mè3$vG ?ªÔs¤,ùm]}™)ôŠøtÅAå¶êA¸Wz¯ÿ5b@ÔÅVäë#©mRRƒ>±í<÷®üðÁ¬¹âˆÔ);P#.©„T±¦2¦g+|MfŒy"ºWÈSýäg*£d\ïx*™ðþM5ÊŠ_óÄz¬ý8RpG —}ÚT+dwc0Û3E$”7}µ­êME$ ÐÍâ,óƒ¶Fºx(úMÕ6~½ Ø_Ý}½øþök~±NÖÔÕ± ü-Û<BM:¶«2Ï1s| €¤gtsÀ ýljK‡=›uùPP;lÏ™ÌÓŠ–ËFæ!72‹4ad.=¶&§, ü3V9²8'Z˜Ô{-L¥ù±…©,uƬ€w ¡„ÄùA_ÖÍiœs†üÐäÌ4g¹kK×79„X“ËÌM‘w 6§­‘À`†:9Ú[²vö5Ç´9}ÜJ5¤8ñô¢ÀŒéi}ÆôôQÞ`RuÐÌ0K@Z’Ä~Ò਌šö¤ßŠËkj"¾kg<²šÌ[ÀA +öw•[Câ,ÒÏ(÷ˆtA¹ r?{[|2ŠÝsù§£hvÂC…©—y08'<fàŠ!™;àÕYfG½’ñfNýù„ 1p¾ú©¢ÔÎx¿excÛJ]ú:˜)ì ž ;2KXƒèŽf +jb”xg4\ça*³îÊØÍÖ\þ°GõÇT)–\}ùVÊr½wÀ’¢ZMynÏ^ºrìmù¦ëS­! hH¹0Š@vü¦‰Â U»ÝÕåP®Ï\“„•ÐqmùÅ1˜C*ðlú8v®åµ˜¸õl8Ó™¢jËÚV}dÎ8n¨'™c_° 'vóúëù‚Òa2‘Ùûp§kø5<åÄŽÓ¤8è‡ÊÒð:¿ämÑIZÐSf„ÃzÍÑÊ.?™uQò8xr+ÙûŸÔ•¿—®£[ºúh¾HÀ‹ÝYØ0pÒÄ”“Ž·`5l2\öÑ|Ë϶ÕKŠ4ic|,b: ê왺‹’ì¢æ‹ jM É$þÃÝÐ"¡ÑíMWÄ6úIël#>ß„P…!žZeî¢øž»¼RJÌ„m„K ¾¸î[3³¦ÍÀöÌjR•Ï±ç¨v†ÙÞÇ• kà²ûл®ÿ̬`ï: Ý+©Ð­‹³ˆ{ëu¸Ên6Æš3V›*¾ÜmôpÎב"V¡‡e¤4e$d:‹•)’;c¾ë<ӺȒC9_ +)C-¹ÿù +•…l[™Ôí¦{6¶›Kwv&Æò-) +ôÃP[4dÊ£b–x;Œ¶éB/MInÊQŒm¼´çÀí’sÁÁ¬‚ˆà´ê³[‹t˜ŸùE”ÅYxH,¤øèŠ.IGÉÜÒ§'+ª8„ +çâ‚ŒrºÞá•mêL¬‡MYåµ$={m¯ÖŒàÕ)øJA]™º ‚Lå_íJ(ŠÇ¢j0 !Ö¬®˜˜—sÎx +-ú妤ˆ÷ƒPCñù½³¢ý'†,Í­Ž;sãÀäÔÃÌ(øÍ/³”ù5‰¿ÉßfSöi1ÍÂ,Ë/Ÿôˆsþ  ÎgÎùÒj昛:eo1Se‡<щcþÝÔ<Œulñ¬7W¡¤Sd¿Ñ?"ÄÔ£†y¯å7;'øDƒÓ»,w‡r^ìŒò©_XÊýh¥)™+MËa¸ódŸÒæ¤øSÆÙÿ,~/Šzâ»Ì+¼éC¨•½o‡gº‚äòSò€ÿleÿ×ï'Ç© +3uF•5D),/¸c©õ1¿öw–' ÿF£&endstream +endobj +5637 0 obj << /Type /Page -/Contents 2525 0 R -/Resources 2523 0 R +/Contents 5638 0 R +/Resources 5636 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2529 0 R +/Parent 5629 0 R >> endobj -2526 0 obj << -/D [2524 0 R /XYZ 85.039 781.388 null] +5639 0 obj << +/D [5637 0 R /XYZ 85.039 781.388 null] >> endobj -446 0 obj << -/D [2524 0 R /XYZ 85.039 667.6 null] +1814 0 obj << +/D [5637 0 R /XYZ 85.039 511.561 null] >> endobj -2527 0 obj << -/D [2524 0 R /XYZ 85.039 644.282 null] +5640 0 obj << +/D [5637 0 R /XYZ 85.039 482.763 null] >> endobj -450 0 obj << -/D [2524 0 R /XYZ 85.039 644.282 null] +1818 0 obj << +/D [5637 0 R /XYZ 85.039 400.118 null] >> endobj -2528 0 obj << -/D [2524 0 R /XYZ 85.039 623.891 null] +5641 0 obj << +/D [5637 0 R /XYZ 85.039 379.224 null] >> endobj -2523 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F35 1632 0 R >> +1822 0 obj << +/D [5637 0 R /XYZ 85.039 154.341 null] +>> endobj +5642 0 obj << +/D [5637 0 R /XYZ 85.039 136.075 null] +>> endobj +5636 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2532 0 obj << -/Length 1594 +5645 0 obj << +/Length 1956 /Filter /FlateDecode >> stream -xÚÕXKoÛ8¾ûWé!23z? -ä6iš¢Mº±{Js %ÚJK*%Ç5vüÎðá§ì.v/kˆ)r8œùf8:]þœnÛKºQì/Ž»é¬cw'°r×q4…Ýõ‰¸ônعüº]Ç&‰t‡cI2Ìž­÷¯¿oŸz}Ïó,Xîõ£(¶¾ zŽefï>ôÜØz|úrÝ‹=kxÿø npZÍá¿ëw׃ÛÞËðSçv¸!Dß'~è¡?;Ï/v7A?ulâ%qwc›8IÒuüÀ#ïéoÞtþXqQk~Wíjѵï»!q#x6‰c¥´´(ýæM^dìW¯¸5c³ßò¬×wCøf?Q܈ ÇÉŠö»Ø£²™ª¯1kÒ)ËÔÇkNÕ€g´ªé¨·†™’—>Û ¢ÀªD>£by'Êyu“pÀ†¸ÉOövey]qº| 3¦…®«/Ô¾MôQ7òºý$$AØœ!Ð'Ø\»6˜ 8F@\ð ·Þ—ÅwÛñ's’Y9¬ð0²t6¢Åq‰ãºGʼn‰y+qœ6+§ ½€àÜ’óÝq‘£~à[0Og(k˜¨1L­ÓžY¯½ ´hΑrÄ5?©‡"ªq÷ HZc5[@Á—êcaTG·À‰?y3íó yV5 -€Lx­[- ”)ráseèQx½SV¨‘\,gžÂ%9¢ìùÖ@iœG8"-·ÏKˆømX;!ñB¸S+”}§e°o´Ë6  §Ú¸Ë—³„b¢WžîŽØ²¢u”¶R••úÀ3TuÖ°Iƒcšã LÈp$öÔ>v¯#omïÓÒ~ ¢•˜H›=•}Dá!•Cz;E—YóOlMe®e*×Östú=‡O –‰Ý08Žº§hûy­]]Ýüví#÷ˆ$ÉÉ:AÆ8ÔŒÊðÙ~tŽdµØ'®5nUGðÛV†T,㡃’µ)2hêTÙ*L¨Ž $’³ØªÄ.Žò·Bx·æv(vþ -µª&‰)Ie©;ƾ'ÀvfÏ ßHxÄŽýß•L3Z(•±€£D¡U”è”j¼*´9WT(ZÙ¨ñ -üL.F›M¼¦«ðÍd¥ ÷RqèF[åøGÕG ìuU€¢ .tî×ñ@ÕŸ(77!bUŠëfÁdŽ šq©oÔÜT¬L—û›}„±~Ñ@çT|óz[2ó]”Ú85œfôεŒÆGˆ~Éx¢  f™7-æÖâÌæµæ:bF3±4ˆ¬”?‡c¤ÜúôþÂìIkªÅù6FRÐ5\…@–ÕTP½Qj…±â_“;U WΙQõ~¼C}¶öÝ-H;gú½ˆò9«K“Ni1a»æض×"ÇX(ÍÂŒ-ŒÚIÁKÒrÐù¶îÁYZ\©§ùù…£ÅE9¿ªXYqv‘¥W2Dà “³-¿ßRè¦ÍïƒÏjPVM^»>¾T€[ÿ·?$æ®ór<>¿0ÞÓP¡«áµ™6ž^çëpYéœ7˜úLú;ˆb]ó-ì¶ÏÙ s¡-€ð ut )¨õwý*÷ÞN}"r°÷ÄךŽÃx¯’P4[þoI¥1!endstream -endobj -2531 0 obj << +xÚ¥XëÛ6 ÿž¿ÂË6Ìfõ°l¯†>×°ë­Í°]8±/1Û©íÜí€ýñ#EùuMÒvCq•DSÅÇT¸ãÃ?îDóeì„g2Šœu1ó |ùyÆ-‡gY¼Ï“åìâ…V÷YìÇÎòf0Hg™¾uŸ¾||½|þzáI)]³…†‘ûô÷ëwßõúõåÕòòêg\) r÷÷küüêõ"’î’˜.¯†Ï}ò˜V’ù‹wË_fÏ—½¦½ UŒj~˜½}ç;)\é—™Ïd9w0÷‡ÏÅ ôd’v½›½™ýÖ‹¢oÊ¡]Ǭ¢„f"ÄIÀ"}ú8Ä,ˆõÑã|Çã¾Ï´Ô'å˜]>È¡YÇ>•ãq.˜äÂñ´T,ªwV(ÎYè,ÎC¦cá„B0…þo]U`Þváq7{h׎]똅F¤óÁáÌWq,‰e47ú÷2„‹Ë‚;Ï*PÔ™èJb½A®Q•G£¸âf± +kÁˆª^– ODÛnAå¼Á…v×I“9ÙíhRµÛ¬¦i‘”`†O÷D@fs_\ì"rkV¶y¹ñêl—ôÖH‰g]¸Að%mˆø§ø»ü=n7V3ŽÄÈ!›ÎIp^’0Åå1óï*…;ßíQ û™Äˆ)®1Š+JzÀ´GÝÍ1…ìLâÚ­"„Û›ù|t:&k­VPTCˆÌÏ(Ó9€ÓΤ³¡eÌ7e5"Áe;>ÜHsðÏ=ÍÌYèÎê°K(neè[îÞlQÖmF à0h‘—ú<8t§¢™×þÀvg6µ’šÊ3<·%¸·*i¼G‹T(Ã~èüØWnØà Q!gì(ëþG#Rð8t¼}þ;²x"˜’0ú 0à¾k°wäë>…? í+¸idœ˜Î5ƒHÀö ðÝ_!ËH>©µû´BG¨Í¡NLåèÜòdk_0Éóê <Á&¬zA$YÌ©þ\Þ@Jˆ½¡7aþG×Bò‰Ød$|n+S;¶ è–üÜ E›d=€DÊÅlS˜${ŒÇ/¸Îìþ­Ì÷)¸×}ø‘†õa4ùs¢¬õž…Ýh²c»?NU“ÎM}Uîr›•¨œìî]Óª»DŸAJ©‘c + q ìž8îŒÄú=­ü¶&ío –ßYA-AG‹ÐiÖÛ¼»(âÚ.ôÉh‰+9 + #R*Žµ4„i@•€^‡5@ûöÚŽæìG´¨ Ñ ¾íŒt kä$¤Q2Ú(’pQv“¥ìDX2b"PgÃzÄÓgbRéIXc¡V¢ÏºNÅîÆÙR‡-M0œqÄ`&o’4]%ÓÏû…ô]Š°¡A{sê>p¶Χéˆçtšª8b¶ïx»|Eö|òœÆg¯®ž¿;¡€ +£_O*0â9mP¥% ùc‘5è¥5çSÌêÎ‚Õ ËE,ܺ2eq…Y”1†ðÇNù¿;嬺Ï{ɘ¨°™9Àš +Lé¥"MDW¶#a_W+XíLØID,n–»¦%&ÓUÙ Õ¡EŒ:´tdu3eá@bJ,´#ì°È:‘¨‡ößÈ«ä<Æ+ÜÁ,¦e’ï:øÃœÝÙžð¥!Ä¡5¢”éLU5}É—ȸµ²)K}@¾Æc¶ÄCüÖ.ÄQTµPú®»óí"Ðn2Ƥ¶šàCß4@ÿP­ú}‚ßxã‹râåú`%¡ w•"àÞ»¥ñ¯¯i¼ÈÚõ”ŽÆü—²uUÞЗh8²õ›#fþÄ MR¬’‹¦X}æçæ=šÓÅ'áíiêMÌÅ)ºÑ™ ÆP²7õY3&í¶¡UbÇúf)ËŸCù›„&pv¡ià½kÞñÃ.›f *é‚wE\¸™Ù·7 |Wœa™u:a)Â]¨tº1¹gï:6ü]ÞbÐE~¯™mT1ž0'eÜÅŽQ/OÍaÚCÁAÕ*zw¤´îJ9ÇnaÓ̉š—´-¡¥=јtmK?ÒMa·µÞ†Qè>3 óå¹Áìª7™]BÌ‚* .=Á»m› œ˜j3EVÂÉ(Á‘ƒì_7yU6Dé‘Íl«­¤C÷úŠ ½Üæ–·1ý É°¤yù.OM+GÄÄv8/¬å?MSã¦ÂW#`}–4]ëj˜-¹Î’4A dê¢éþ¿ SiSKˆ(b‚*²p ׄ]X&{×}ç÷ѧ±XÄQ17 tåszÞn¶&Ê~:réGžyË/d"ÝÓàd!ñœ~>¥(×]îrû|€n¦Î¦Í>!L£§1ñ­ms‘•mÒæ'_Ý!gµxN—]!ð—$þå}Š€·JŸ/ü#žÓöâ1gaMí%¬½^VØÄÝM-!ËÝ÷4¿zÃÂâ¥AKzßךG±ùñîœÖ#žÓvãðƧÚÛÞ°ü¼Ï»{ãpj6ùyaö2Û4´aZOƒÏ Îd¨¿Ü@Òg">v>üQ.ÿ¯Ÿ=‡®T²HÆÇ/Á;]ð +"ÐõÅg <Æ?Vø_¿3$¬endstream +endobj +5644 0 obj << /Type /Page -/Contents 2532 0 R -/Resources 2530 0 R +/Contents 5645 0 R +/Resources 5643 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2529 0 R -/Annots [ 2535 0 R 2536 0 R 2537 0 R 2538 0 R 2539 0 R 2540 0 R 2541 0 R 2542 0 R 2543 0 R 2544 0 R ] +/Parent 5629 0 R >> endobj -2535 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 577.023 352.054 589.924] -/Subtype/Link/A<> +5646 0 obj << +/D [5644 0 R /XYZ 85.039 781.388 null] >> endobj -2536 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 555.113 176.46 566.803] -/Subtype/Link/A<> +1826 0 obj << +/D [5644 0 R /XYZ 85.039 613.806 null] >> endobj -2537 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 532.598 210.278 544.287] -/Subtype/Link/A<> +5647 0 obj << +/D [5644 0 R /XYZ 85.039 595.137 null] >> endobj -2538 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 510.082 190.036 521.772] -/Subtype/Link/A<> +1830 0 obj << +/D [5644 0 R /XYZ 85.039 538.254 null] >> endobj -2539 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 487.567 187.278 499.256] -/Subtype/Link/A<> +5648 0 obj << +/D [5644 0 R /XYZ 85.039 508.85 null] >> endobj -2540 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 465.051 185.157 476.74] -/Subtype/Link/A<> +1834 0 obj << +/D [5644 0 R /XYZ 85.039 478.924 null] >> endobj -2541 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 442.535 232.763 454.225] -/Subtype/Link/A<> +5649 0 obj << +/D [5644 0 R /XYZ 85.039 452.915 null] >> endobj -2542 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 420.02 213.157 431.709] -/Subtype/Link/A<> +1838 0 obj << +/D [5644 0 R /XYZ 85.039 252.806 null] >> endobj -2543 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 397.504 208.46 409.194] -/Subtype/Link/A<> +5650 0 obj << +/D [5644 0 R /XYZ 85.039 234.54 null] >> endobj -2544 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [249.04 371.394 306.851 384.295] -/Subtype/Link/A<> +1842 0 obj << +/D [5644 0 R /XYZ 85.039 202.998 null] >> endobj -2533 0 obj << -/D [2531 0 R /XYZ 85.039 781.388 null] +5651 0 obj << +/D [5644 0 R /XYZ 85.039 182.408 null] >> endobj -454 0 obj << -/D [2531 0 R /XYZ 85.039 653.944 null] +1846 0 obj << +/D [5644 0 R /XYZ 85.039 153.191 null] >> endobj -2534 0 obj << -/D [2531 0 R /XYZ 85.039 631.228 null] +5652 0 obj << +/D [5644 0 R /XYZ 85.039 132.6 null] >> endobj -2530 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F20 1617 0 R /F15 1628 0 R /F41 2104 0 R >> +5643 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2547 0 obj << -/Length 2685 +5655 0 obj << +/Length 2594 /Filter /FlateDecode >> stream -xÚÕÛn£Hö=_ae´»XŠ P€¡¥ –ÉOþ¦:×æq³–.š¬’qZL`Z=Ì.pb$àIZð÷Š?Eyš¤ö¾M²\g…LÃè®Ö•Ð¾{|Ì„à$Mµ4åžERë½=šý¸õSU‚¿ÜÌßßžóäûÖk›'wŸoo]†èt-×<¶“]Þ ÜÒ‰f˜ N¹»zÐå6×/ wO8ÃHfÏu£7õiI¥-ŠVZÛ²jö¹3âËŠØÛ××B®ë¬”ý?œÀ)Ôû¨BŠ¤×º8­‡óŽÏºÎ÷ù*νû¢t;äŠâ=)ì]Voõ2{|>i4¯ïNˆƒxî“ -Õ±:@’‚¿,›rßMŽÈÐÞ9¨oK6p‘.¯Èq®|~Z+]è*ÉóCVŒA¶q¢O4³¼1™‰ÎÊoÇö÷Ë!’þAC;ªÿŸøo—¥WÿØ¡ºpV.¾‚0–9„æèz¹,wE#ûîùaž…?`Õ³C/Šž oªˆÄØŸ¶±Óƒ=׎‘ê.vB4 mÈ!:ràXr?°«Â)¼«ÊÝV7ž€’áÿJãDã¸hŽH5tx¶úB#ø¶tºC1þ.–­ÜWã}º¢ b‰S¤zìÅV#p eÜÞ$™ò¤YÃñj×›hÙ½©µ@Ö®{#«aàóK`}5ì²ÒpT_äËg„.7í þr—ù~S"¨•NL?{¸gÎÄ‚ªâ™þ™ºÈp1I7y\«Ûª’†‚ î¢[;eŽ*S>Íq=ÕIΣ'<–I -´@xP -‘EVˆÓ¥m¤@·6M…‡»Æ22#ësô4G×D'ÃUjì»Ù ¥Á`CÄà9ÐŽQ€`O’‹#rdý[ºh@{øAÕô”¶ýµµ/9‰ Ù7DE÷ r>`}C×óÃÈz_¢­= R×úA£ -HP¾²²æ_|…òá¶-~]V Ì[#ë[zá>”‚5ë²Ö‚"Ù7gY͈2:žðJŠK8®bæt«w¼©Ò‚¹|Ü'ä(Þrù€ÒR©´©‰ÊíØ8¬~ÂpüžÛx½&‘å)O;Yó3À»Š¼jk¶.RÆ+ló„8ûÊ !(]6r’@,’DƒÀ·V‘±­ü”Câ4Fbæê¡Uc‰4qr¢Q’hpìóºMUt˜T9‡ªƒʤà͆?ŒË]>ìꆖeZòWx»9Ô €ün6ãÒzÌÁÃ8ò­ëâÑbUÊÑ%—D©ÊЀÊ¡pð‚÷3i$ˆb”¹Ô†Bz™#ÎdkÅ -´Ãòj‡öB–¬ç„Sßɸr'|X3ãõ<­ ²NŒµø*´æ5ç}Îåx`¨Û-7ý³á,F9„Ï×X*Òƒc¨Åu¬‚R^*…”-鸬±b1—Ù'CÄ|Ip曉®×IãûIMr ùÖœØÕÄÉC I§™Ž¾Ö}Hè&.jR×!&PùõûÀRÒ´'€ãéÂ`‡qìý†§‚ ÏÝÍã$o£(.Š(ñôÄŒó£Ø¿Ñý„†¹ÊË…Id™ò8g_[š=¾EŒ˜*ddíT™âªØŽÂë×ö¼ÿ¬žšJ=5ÓË]•5cÅɽ_SaÍ©”Ø•²ëZBÍIe/ v8nH­hb%Gl#æ‚@MÒ -¶d#ë§5Â!G+ͱ^,–B°¥'S‰ŸÑ"zib §b®q0H¢Ï‽ºCyÂåϼIöŽ@œg†j+SV÷ÌHlªÊ´XlÐà‚µ¸ ‘W‰s8žÑ#ìWÙÁÔÒÚ*ôah”ã»Êð7=DØ~ ‘âVÐÃ)üNÿéÒƒPží@_À@•æ’®W‰ó±éÃK -¥:‰T½`Öc|Y¨§á°~D™.Pàÿ1†”à-;RF 1 OIYÄ@Øp ª¨tÁZž'}]/«ç­ oãBW“PÀáÀY› -¸,NÇ…ÝVð¢VˆNA,@®9^ÏžËñ¸˜p×+ÎA#…0äÄ°ó#ÓrªM!0Î7¢VÇ‹JB/" €ï‹û‡ÀjdÊûj£‰nS(Ëê3ÛñÐL¾WpÇvੵNjSØÛ°ã%WIÅ`l/?ÇTø+“]¿£QfB‹îBrWÈKÉW4Yp±Ç RÊ ‹7jÃ+Ƚ,#‚~…ÀÜáûŽÛ…0“.³xÃóTW@£4‡¸ÀÅŽƒZÉVÔ~aFÄn{t"˜ýSpp!Z1|Õ ýó¿OšEˆ •¨H a|,«”otÓÐËUk?1„zÝ$Y.5N,a;Ž¬Û°v‰E®n»ŽlßÄrÝîµiÛ6ßõ©’Ì2Å ‘8Dqø çŶçx£IØᔞ³y«ZxðéÝ ©ôsÝÝY¯L ½ŽÜ3ulwØÕ}[áëøË)Û©/ȃ’ÐDB‡ÝhOüïïÑ`¿Ìï'¿•y.i 5&UÐPqMOÿ(·0¶*#ÏرÔ0q—$aŒ…{Õëšt¸§6lò“E½ÓXJN§’hÓ¹4 <«ëü\F-·6·Õd¼GS%›¶õh7Ñ#6üžEmשz¼ÒßwœîÑ =òh4v]f\­µÔ*¥€aYÊ19{Št}°¯ÐäZ~"ôC³¾-ÐøŠ?ìA†0…hçzm2 -VâøºÛ ^_žoù¨j­ ¿ôàŒƒöÁyâyP·N÷%ÍŒ ˜½ ò Tn­endstream -endobj -2546 0 obj << +xÚ½kÛÆñûý +õú!`Q»ËåëP°]'q;WßA‘%Q{©p©Ê‡þù΋©ãÝ^Qø`îÎÎî^ãòO¦IàÝ2ÒÛ÷§å—ï^½äYà«éo·?^¼¹í8íx®Rdó‹_~S“ˆôã…òƒ4™a¬| Ë» àÓm óíÅÍÅߺ£xÍNxטVZŒH–šðiÍEÚ·QÐiÎÀªõ¡æ´6~ Í$•*Kªƒ3Ia¡M=W{û=H­¼¼ÄɪM|~Lzû±¶cü(`Vù‰ +žf6ˆüTë³ÚOÃpÀ¬ ýXì,ÌjO#Ç¡ò®kd°lW}æ£Ø[×ÕŽG¯?øú†'MÅߟ w…»ªi ½£cxÖ4Ùr“¯x‡—M^»ÇÄ7oMú´„'’P‡=Gî$T¡¯Ã”$ünšX˜·*õšb—ÃH+âܪ¤Ù€ 9ãýqÈ +Ó \UÉÀ¬†IAðܽ˜I¼M5…ÿŒpãêÀ//+y²§­%®7(=ÜÀ¨Ç¸I"?cYÖe([àÃFȘœ(9pÂ#*|jbO„ÃÃ&àÊW:7ßé˜>Sy=ÂzS” +Ñu= Š|È›î;¼›l‡'.2ð¨(Ž½÷U½Ë¶ÛûVɤmímAÿ€¶Ì¶<'u¦A¢|9T=¬^þ\àROVmHÄŠÍ$Lé>S1Üpæê/#l'¾MBYÿ×È ­¬;fÓSÏP™—¢t*LXé–òÈN²Å;‘DÞÔ£¥p²ªÊ¼Ö=?bô|…ãØ«j†í”Õ ×ÖÌ[†/³Å6ß ÒÔ[¦¨‚7t\¦AŠÏ]ù¬íÀir9—.4|VTÁé¡\j Ð&¯‘é0`ó¡¥q‚®€Çܼî6bäJÐÊV|å™XïICHbÏÜ—S @†A:¿ÛT®Á²ü«ka¨: ÝøN¿Ž‚ªÎ„Ñù…Xèíð²Ú3v,ã®KZÙÁòÕ%cüª´í(#cV'ÞK¡ÓÅĤHäŸÍ¸%UQ@"M0Qv—,û äCã»}ÃðŽÑÜÝ÷ÞŸ ^LC ±¼ËË•ñþY‹=P™Â’U²íLÄ>Cõ9^ÌJ1dÕt!«fˆã Ë];²^™¤-™ ýÿŒ „Š9f×݆ô%AñqŽ:í#F™÷‚¨êGÏVÔƒ#¯ Û÷ã¡ZCíG¡­ºÝb,‚ß@’Á(¿ªP¹CW¼.ÝæHyŽˆ-mÄËÄàçh®(õÞ6¼ä6^Uz$bKñ„î>®e‚r¿ÛÒ£x'§U#š1ðFÅQ|ò=·¯ªíˆ.,dªÅ;nŠ%ÚwÃ'‹°-Û"óÏ…“aF/5Û@ÈꉌÅC7É?“–‡&[«) _5¹XH‚ˆ¶ýÔe :þζü}Üôçw#m1a0öWõñs=Ã?@+åŒ]W†ø¨Py±Q¼ü + èôJYú_C&zŠ ø+/ÿ¯/ßøJ ‡þÙ9ýkpQE©a„ïò…PÎŒ¾2Bt™•Uùÿ"–ïÝr‹´èï ´¢àdÄÎJ::æ*ƒmšf/>õ- ¨ßž-d´2=EüB*´¼±€›(ټݯžE +ŠH/‰ÂèË”ö”¦æÛg“3:Gy—µ×L6˜àJËÝدÖ+E¬Ÿá/acløòµÞw‘¤uBT6s·(Ê9bÌ0 =[‘Iì—î–®!õŸ‰Þz'Òx¢{ªn í#’£Èý‡æYÇ©6_!q¾y6±T} ±ƒ[ðs&¯’‰}•¦O½J¿ã{ºétFšùÎ#þŽƒ¬F±ç‚I„g{eÓ' s–„¾NÌà‘}»æ&^WaïÒ.71q¾cN·%E¼ üF +OÀ§Äàã-9¹—¤'krÍØ£?“!s\Š‚ÝS +~"#OÂ#ɘ(ys{ÊcXÆŠ:R˜Q+¢«âI.jYXïXPVˤ­ÍpÖÃÅs¸Ëûã”ö7Œ²F%QÏ +–)WÏy+9Á09ž+ƃ“åØAoŒ î°p÷®!¶wÂÉ°ÅHsø RÅ8ÕÞUˆ]>ž¶ý/.«²oW¶^ÃkYÙ6á¨^AÇÖHuÏm¡»Ñ¸â bR§ D¤ÛMË ßvÚB—;+ÇŽëW³0m«Ù‡Ò‚X¬\“h2~— ª[iMAXç½¹„ÀXŸ† ýÐvé%sdàмbR«¢»ÝËf{ÏÀLN!k†¢{eü^àhŽ{º_ÌAZ0¨ZÕcѪ&]-ºÆ.(ùjÚßcL¬¼="Õò,µ½§»zØþ+ä{¤«áN=F˜tŸûÒ&J!ÒQ]ƒèš3 á]!Í¢°æs8$ …}&þ‡“ªÅØäCÙN~`™3Á]ˆ S&ŠY(ñÚyU¯Nј¼Óˆ¾ÝC!hýãISd܈#"à}øÌCº¸VÂ[LÓPÓÚ,‡KVž<¢ fö<;4=¢è‚¨~þˆpÆð +”?þs—šˆG<ë‡ÐîG3Hh’à‘ßÌBl=ê–´† ãs~à ñÃ$xÈð¿OnŽendstream +endobj +5654 0 obj << /Type /Page -/Contents 2547 0 R -/Resources 2545 0 R +/Contents 5655 0 R +/Resources 5653 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2529 0 R -/Annots [ 2551 0 R ] ->> endobj -2551 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [367.79 127.787 439.883 140.688] -/Subtype /Link -/A << /S /GoTo /D (passdb) >> +/Parent 5629 0 R >> endobj -2548 0 obj << -/D [2546 0 R /XYZ 85.039 781.388 null] +5656 0 obj << +/D [5654 0 R /XYZ 85.039 781.388 null] >> endobj -458 0 obj << -/D [2546 0 R /XYZ 85.039 477.879 null] +1850 0 obj << +/D [5654 0 R /XYZ 85.039 761.463 null] >> endobj -2549 0 obj << -/D [2546 0 R /XYZ 85.039 454.562 null] +5657 0 obj << +/D [5654 0 R /XYZ 85.039 736.911 null] >> endobj -462 0 obj << -/D [2546 0 R /XYZ 85.039 303.477 null] +1854 0 obj << +/D [5654 0 R /XYZ 85.039 736.911 null] >> endobj -2550 0 obj << -/D [2546 0 R /XYZ 85.039 282.887 null] +5658 0 obj << +/D [5654 0 R /XYZ 85.039 716.383 null] >> endobj -2545 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F20 1617 0 R /F15 1628 0 R /F41 2104 0 R /F65 2099 0 R /F56 1642 0 R >> +5653 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F11 2898 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2554 0 obj << -/Length 2542 +5661 0 obj << +/Length 2118 /Filter /FlateDecode >> stream -xÚåÛnÛ8ö=_adF^ÄQZ*Ð7Mw:HÓnãb tú K²­©,i$:nþ~Ï…”eGN³,6‹E€ˆ—ÃÃsçá¡ÅÈ?1 -Ûñ¢Ñ4¶†£dsæŒV0ó÷3¡!œ‘o;2À©Wó³_ÞHw$;r¢Ñ|I óô‹uùëìÃüêãxâyžÓãÉtZŸnÇÂ2£ooÞŒÝÐzÿñÝlzÖüíûžxÃ<†ÿf¯f·Wã¯óßήæ="&¾íK©øóìËWg”¡¿9¶…£´[DÑhsæžøžîg·gÿè°ðœ?âU¼N|Øp8ñ; ýŽi 0}S©l<ñÇRk`4V½Žž¸fæ>Ü«QdÕ0ÓTªO`4© -Êa´åfšÕM–ĈWX)/ÊKþ.q±;µîgÕðhµäïЮwÏݪ¸Y5G¬×·(ÜÑDó3(“ˆʾóÆ%§nïK«ª‰Ú¬‰U^á (×}ë× -iÙáN´ˆ¨Êš \…ädؘZïqùÔêðÚx¶€‘|ÄÅÍ=µ*ÇÑ‚{,1\r—§Ì! ‹ ±½…Áš÷¨Å$/I8Ð@*Yç€Íªè05l‚ê(]³nR'á·¥ùd‹„æ劓jƒ£$n‹¬å öcDƒ’"  O!Жez†€‹ÜPR"„bKð<ߊ˴¿7î|×ɺa8Ô²×We@,ÎIü‘†Êh/R^ª‡û q÷3ˆsIÚÞp‡|ª™œ´VFE *Úb…Ö/ˆ°˜†[’xÕ0ßèë¸]gäk½ÍpÑÞ}6'ÖHª»k£—`PóuÞ2P—ŒRkX/Eù”º³5ZêS×ßhY‘¥³#i ‡æ:C>/¯Ù, - ~yãõ’Ú‘¯ƒR[Äuj'U¹dÀƒÈLmwêjȘ&‘´]ñ/²À'¸Ÿ~O7°â¢¨vÜ$ïÆÆy‘ƵžN7©°™–çz,I²¶½àÎb«ôtVÞs+»Ëš{’õŠvÈ]‰Þ¸Òˆ•jÚ—ÅæCܶ»ªI/Ješ„Á méÉ4‹{CÜËó¤|yo1Ìò‹jû²ÎªºÈ.Òäe]ÄyùGEíªYivvM®†(4¨ÿÆŸ9::À& #‚`Å$,ÅÐéã¢v<Âùawö¸0'ì={ö€Ê¤ ‚a„|h¿{X FW)­TClÉèƒqÑò Ê/…táTbÔ{%ÄVÏ,Iªm©ÚÌJ]ÛsƒGY áûø)Ê¡ -L¶DGX ûÎ(báî&ª@µ@^­?º¥8†îý]ûÈ>ŠràÛèóƒáQl7‰ààE¸žCË ú 2Âòb Cq;pü!q Yz¨‘„/$ñ»#¦ÇhÛôÂc¤8ôpzCÒÝ»ÈÃÁÄ—á^í®g7ïf˜¥ùÁɨŠsBNpbººWzñº[°ÆŸC¡ªºF/Ž[ýåO‚È×”¯Ä¤=•5<Ódµ> 4Ý}lX-£pÐP >ÔtÌŸ5íþý!å“17'U\è3´MÚ·Oš¾'MVü|”}¨l¿§lߺ™ã׳ê¸%Qî8ËLyôH›nOç˜; š´–AÙ^ĪõYµ˜ñ,¨6NT—|¦sÞíV³Ê•ê²R}km¬ê{NÉ+ëuÓ)Ôäwÿ“z­wéuܪ[H#Ÿ WásLvȲY¨ÙÊÈ AŽQòˆÎ«2åè‰s­qŽ2ÑÐ"š:ÜÚ­3½R'ÙG´» Hé¹O CÒ±]?И÷ä%^àÛÂ?L5w‰­Ð …ðM7­¶Ôî€àûK£ãRîL¦~`'Ï,ØC¦¤Þñª2r zfâÊ}˜EFSr)7’–ÜçPLY¸Åݵ©eˆ–.MµínŒ8Ê瀆øsëˆïF!îˆ „þ­»9(íËWÞÿA@0ñ€Yè]s:êWŸœ2àM -J9@y@tºå¤á[þ~âÏïNàô.$зºp"þ§t4üÖ*s îA|Fˆ²bD§JœË¾×t·8Ä1òòåϵ^#æ4oãE±?6yÝiÓô#[Šç–‡T«ªœcÔy‚i‘ñö8j¡SÞH]‹í>aKL  i´­÷ »5‘”šžN`];òù‰j¹<%«ãhÿÿ-«oyòí´°¤kGQôo+ë•fþª¤ž_q——ë¸\ Š*´§®Jc•ýE%Ÿ¨Þm[uRVS_oð_òÁgfYëj“½nò»§…öª¦"œä@‘ŸQ2&¹K’ -¬´É{%Oœ-2ÅwAë@øÝ­ss¦÷‡7X”¢îr/­O7—×#4FƒéQ|ÈÓ¦sÌa¯¬šÎÇøódw|fw*p™e^d'üñ8ù ðÅtð°CK %UÒB_û¶(憽3Ú½+òÏ-…ãÉEøL¦kð€÷( -ƒž‘Ã.{#¹ ¶u~&ÕÌôµÜ/.ø.æÝ -ý¸N•?äjÑV=t`˜#wÅ%d†s“ „üè €x 9ƒR(»—PßËgº?“p3Fsn¶ž Ø*žOªŸ3ÒÁí¹ú£îUÄÞ?ã.Ï£c“÷ô#ø ½wån]&höÊÑ$œÚ"ò†¢¹øk¿Èð][zû ëÑ—¢©sL§†9p¡;;?àendstream -endobj -2553 0 obj << +xÚµX[sÛ¶~ׯP§¡fJ˜ xýrj;v¢Ö–TKiÚ>À"-±¥H…¤ì¦Óß½€YrOfÎI2‰€Åb±7|» :ðWǾpT4 ÇR¨ñx¸ÚœáVÞ ¤á° ‹Ýã¹\Îno(9ÑpùØÉñ…ç«á2þźz1_^ßl¥”%#1²Ãpl]}˜¤µ`êü~2]N¦ïpæQZæ¸<»•µd¦É´[¾¸»¼à™Îè·åƒëe«i«h¡šŸ¿üæ c0é‡#T4>ÃØ–·ÐSøž2ól°üÔŠâ5oÈ»NyÅWcáÕ±[¤ßs‹”®PÒ†¾#|Ç#¿ÔÛUo|Lól+FîØzÙÒª˜¾)ªú;&H®WMnÄÛuŒHæýeä¦yUë,ã‰æŸ] ¤9žP'%Óè¨èõæ…B®l‘ù z…³?ð?R†×*rf¸B"GÖh¼I–“p¼j˜oÒŠ'«b»Å55>G«ÎnTßqvc¤§„çºdä·#Ûw}+Ûéx ¶ÐÄÞñïsšïÊ4'ãˆþÄ¿Õöáüììãdúvöq1½^^Nf‹éÅÝõ™á®6ºLr½M̶9ÿžít½9«‹³ùü-kwÖcå–à%Ï …ãø† vî«ÁcÂ@°ïUàYú!±cŸ[0=NK¦KkU3 ®Û‚%Ô†iäI©k#Šcƒ~†ð†Xך×ñˆ²ÙÐ;Zã¦5''¥¦8"åAnn Ò=N2€Ï[7”¬%§ÂO„D_¬Êt7b{•oá°l¶bâï@ÜW†c_%<0ië[˜~.N·6|ÏtÀ=3}ZIOŒYò ø2ôìTõ‘\c“…Îm1_ZÐÏõ#kºÄßñM°uW39&?µ—§èY—8ß³ùÈJw5І°2×&¡õ™M2R9þx>öÈTr +^Þ|¤¥ÿyö™GzE$å\ú{²„…’Kz–ûd8áŠCaÒ´§zÆ´-ð´ø?geÍJfJA'åF=—Ê.¾@nñ¦â |f«¡ì(Ó ±0òt^4"q?ÑŒ`^–Å!m<¸ èˆê…Ü’ø”ÆœøD”ɬs¼­ó•ãtaÁIŠhF” C£©Žì̆q™|Úw—4æ}äÄR"&&Ûö+þv¶Ã„l‡=u7¨éB- +¥4@ÂØwnT(,|œÂÉSºJlðû‰`ñ·Mm0Ow[AW¾wàšºñ*úçX!_„nx€“g÷?¾»Ÿ}˜4G„¥ÀÝ-‘á|§«ê¹(ãï¿šÜ/“öÂϾc÷ÀúiÙî9>;ow;1 t¨ ñ`ÚsŠõÜs¼»ü”ViS +pŽE™èò#nÃ/‹Äû YZ™£1¡xO'g¡¹øk^â2^2p•œ 'z_ßIÄ2(ˆüÁ¸_@˜ XR±MŠO’aƒ¾ÏÚ¤öû5Tz¾ˆ‚¦:î7Œ,[ïÿ<áràmë-tÔÈhìVðø"çsnxö‚ÊúO…¬&›h¸¶p{³Soc›>¶Œ¤ð!çûž Uà¾×WÈT:§6,ý«EØÛFZšúk¸AÏÌÑ^š<—i]£ê81x_ðÌÔxeeÅš)¿:ÒË’ +BåC·hùR£ZÊÝõù1øÐmÈ{:&#}B&s²¬šzÆZ`RmO‹Ïôë½évÑÄ~EdAï.UH26`ÍÂÚdN„<"y!tUà¢üMÍtî p»!P +z•'Ôè®å Ñcǘ@´¨Û¶Êƒºaä”<; 3,”1ú6„öâ’cT÷Êî@Ô0÷MuÇ/ë5rÓ½†_Í?¬÷ˆj¸ÙÁQÓ Vùv%JnËÎ'l£ÒÞùú”Õ}œ³(ô,¢µXM[FzbBɨ{KлÃuza’mQ¦rB«XèÂDälò9õ‘ʲ5¯æI­JZTfN<ŽÊ„±†*1æˆàØT¾®(Ÿç8Dpà­ZGs/ó²•Ð¼ð˜èz_6ŽiVà·÷îuÌ»‡7t>hâÇi KyÒïÊ45“äSàÌ›h&FÎÉÜÝPš´…¾¶¢çƒKÌOµ¾Ùk&!–£g÷µy+nŠæÑû4÷mU¯Õ6m–o۪╷¹ò¡#ø/ßz<ô vaUŠ±§{P+Ï~0&#¡-ÁÏ Òr |Ǻ+Fªž°} {t«8YÉZäØhšV¯ií¹Â…†é_µîx^ÿ  \%¢PµFò¡{–1 ¶ÀLHõÚBã沇“Ú¼î7½ÏÈcL5+š>+dIï“ÂŽr¨…< ü^›ƒ£æ¹OWx­h¡®’ÌŒ7ˆÁ8àˉ#Ìc~ðf˜–L|L³ö;Á +BŸw¼WóÉòâöu•²¤æ´)Ígƒ›Éíµ}3»¿»X… #ÿnrwm”ú¼KªïÌ*”³ò… Öª§wgEZ½®P]îÍ™»2±¥€¿þ¡¯î Å“'8 `±:dé<Þzúza¾‰Ì±á—:òü¤B'bK;³»ëåûé;ýÄn:m’p{ÿþ—µŸO¯¹~êÆ|–¯ëbW}©|ÿKÄ£ óùíäêb9™MÏæ³Årqu?™ 3vÕW×ÿçé[‘¶ 9…|Žp£S¸ÿøˆÿé3k‹žðD«è4xú. «ltA“\üRßæsì‘ÂÿO‰˜Bendstream +endobj +5660 0 obj << /Type /Page -/Contents 2554 0 R -/Resources 2552 0 R +/Contents 5661 0 R +/Resources 5659 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2529 0 R +/Parent 5629 0 R >> endobj -2555 0 obj << -/D [2553 0 R /XYZ 85.039 781.388 null] +5662 0 obj << +/D [5660 0 R /XYZ 85.039 781.388 null] >> endobj -466 0 obj << -/D [2553 0 R /XYZ 85.039 574.243 null] +1858 0 obj << +/D [5660 0 R /XYZ 85.039 355.788 null] >> endobj -2556 0 obj << -/D [2553 0 R /XYZ 85.039 550.925 null] +5663 0 obj << +/D [5660 0 R /XYZ 85.039 335.198 null] >> endobj -2552 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F20 1617 0 R /F41 2104 0 R >> +5659 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2559 0 obj << -/Length 2684 +5666 0 obj << +/Length 958 /Filter /FlateDecode >> stream -xÚÕY[oÛ:~ϯ0,VjR¤nòÄI›ƒ¶É¦.º‹ž>(¶l«‘%¯$Ÿ4ÿ~çBÊ’­ô؇í¢@M ÉápæãÜ"GþÉQä»BÅ£0’®Š¢Ñ|s"F+˜ys"Í -1Ò®|œº˜üvx#)ÜXÄ£Ù’–Ì_œË·çw³«ûñD)åÀôx†‘óéãX:–zóázìEÎíýûóq¤œÙÍ힘"™iøßùÅùÇ«ñ×Ùï'W³Žíê@¡ÿ>ùòUŒ èï'ÂUq4z‚±pe6'ÚW®¯•ùÎO>žü£åÂszÄ»î:Ñ^àz! ”p£H­‘«àÑ*DË…ü!dxx ßÕ¾ÙxȧüOåð¬7oËMŠl»–ÝZ¸0àU¯Ç-èr"5è?O¼ pÖ¸HÓ¬b¢tæMY=ã¬ïl‘Xná#rÒªA‹<󾉡ÙÁµtZóL³6¬·°7iÖüQ.™c;‹2”Ün dU:GH_Ïx%P>Ýb"ÑH1Ýe ÓånÊœ]M’à.™/½ÞE•:uSeðU¬xÃ<)xð`ï‹ -¼á–å¹as³ä“Z=áÙŸ¸ÎìA®µ9ƒ–4Ìp)k ·$¼/_Y¶xkÑ»pž6MZ½*M¢L5ÆÕ(ß¹Üå|8RÛjéãyHûôá’[´)-ˆ‚žÒpukB\º!åÔÍžkÄë´åZ¤‘§1œGr=vïâÓUèdOuá¡ <Ô@S…Î/Rm×½×$¸') ²‹búfd^ƒƒÕ[ 0ô"Ëk€•}ŸÄiTéíÆú'y,1Uç©Eõ¯´xý¬fü9Ü%hÈ]ʲ8UÕšu•0ñ›çüU3YˆÅ•ËïI†±Q`÷$ÎÒº|^1<åCóÌ`pš—«²àIû"NyŠÌY%L°2•žœebcËBˆ< ðèN%Ê·üCø‡ÿ$oØ$æ¤m²2çóÃǹ²z'tOX´IšŒxº‡Îtž\&Q ¶‘¿–'/V}.«Çºaùqq9QÇ¥k ¨]®YýskòÖŒIÑõðS#®À;å;c ÌwUëý BÈ!æÝ»Ö)žÒÅË:õ&”©<$“»)œy‰gNÞÞ"íóìöð,)7Âa\+WGa׃çqP‚›´@l’,7Y!h¡4Ú ÄŒó#ú&Àï¼,²h‰ª -iËáˆÕïÉÈ Øéé­Edµ(tîel“âì´Ü$YÁK.Kö+„óV»6Ò.Ž«nâi uÕw"¶U`¼%¼7ÊÍ—{pÄ‘=tOtHm{%ø:ãìNR§]á¥zµô({â{7ÀC”ç½í½$³{7VzÒ•M+ŸèEm,RÔ\ÑÅ!á(QYS3·^6‹ucí[o.„ïåPÅ/\åùûgªs{ŒIUäfúeøçõ>—…š„Û5šÚ[ -N ¨cÊ©•Ï§¼‘lTó -L4è×vv`¼ Œ;J¡I†‘j-«mà ‰ü\©ï…‰’LÏKkÄúd ŠoU(#Ôô(ÁqÏÄ÷Ý#`¼ÜÃé>è -FonØÒ µ÷½k˜Î³š#2Ÿñ|Ó~L½?_˜Â¯Aš`7Dqˆz>*!Œóã•Äñ{f+?@‘Z=Žº¥2íN©8Û §ÎÓ²ZœõM£WåîÌ4Kt9˜Æc8«;ùã«Åü¬¬V§ho:Þ´™T,Û±û²‚ûƒÒwÞ–m/µ5WB†3¥]±èŸ4Cá~ìž‹ZÓ -N*¹©XógQ¢ÓUâH›x˜OZ,xX^)Xeáo ~[˜ÃNs n)^™·E ,¤Z¤Ãp_eáÆÌ00^¢ïn·T§’Rl$«x_•€N²_ìÒAPÅÐøÌ£'«Ì ¢l·^»ê„Z.0 ;܇“Ùº8êì#5݆B¦ ôþÌ6õj´™º6M@¶75×± ²/i«NžöÃäÝÝàŠÜL½È^’Û•‡_ˆCBý|ç÷ý-ð»@~ÿ঴«~ºm{ì*†[0¾-áó…¨x( ³ÙŸ”®çÉ6ó`bbhŸ0 —ˆG¾ ¿ÇéZ)tÞa(G¡n`pÍ´«ÐBU`bYŽ¦Ï$Lß@‰T¹+š—sS`ú‡âGðûã\’ -J%  „j’ë_¬ül7RpGB j;à'Åç²zlÿV´wÓ›k3‹5#ŒlK÷ó|WsèÔ€Ñ~žcIŽ#û\ÏéYâÕm «ÊîÒì_ʼm7ÑV.ÿŽ:[¶EA}ýâ5&|¾³Ëg+H2ïÐG÷|KçÍe’™E‡ ?à V2 ÙVK³ùc¹\vþ¡“ù¼¹Î“•à˧b~£¯/Üé'xû¶‹mõ  +ô2)z/?mº~ÿ]ß0ýïþ¤®=p~~+áD(›rƇwü|„Àwendstream +xÚµW[s›8~çW0î ž]T„,:“×Å)Ʀ†æ¥Û‚©aÊmÔã™þø= !S;É6%ÒÑá;ß¹èËüaÙ H#¦<30"†!©¤É;X¹–0—P¹ˆÚ“yëI¯—Ó‰Œ5dj¦ì};ê¡hB‰ìm¿(‹÷sdz6c•¢`ÕÙÌPŸ1V\6ëlì•g¯®›· Lbå³Ó,¯7cƒ(²WÇåùÍÛ9{#Hõ>H–' + €Êl`þ+}ùªÉ[0郤!bòÆ°œJ€Ñ áï‰äJŸ„*¶6‘Ù®!V(15ÈCZíÑ‚±ŽÖåÕÕ&-/¯ÀL5ågƒ”©¸ù–ùËÚíðš>Õ©RTu^úU–cÓm(Ìû{VQ\á–½ìã:b# Þý› ãl!ܲšM|+ó”+ÉlpåU]qQ÷¡Ð T:;ˆ³ªö“įã> endobj -2561 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [220.025 574.596 328.684 587.497] -/Subtype/Link/A<> +/Parent 5668 0 R >> endobj -2560 0 obj << -/D [2558 0 R /XYZ 85.039 781.388 null] +5667 0 obj << +/D [5665 0 R /XYZ 85.039 781.388 null] >> endobj -470 0 obj << -/D [2558 0 R /XYZ 85.039 309.692 null] ->> endobj -2565 0 obj << -/D [2558 0 R /XYZ 85.039 289.101 null] ->> endobj -2557 0 obj << -/Font << /F62 1689 0 R /F41 2104 0 R /F35 1632 0 R /F15 1628 0 R /F56 1642 0 R /F73 2564 0 R /F20 1617 0 R >> +5664 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2568 0 obj << -/Length 1980 +5671 0 obj << +/Length 1039 /Filter /FlateDecode >> stream -xÚÅXëoÛ8ÿž¿Â÷©2PÉ¢HêQ 8¯^mw·q;tóA–[,ªzlÖ{¸ÿýf8¤b'Jº‹ÃÝ!ˆùšÎ œŠÍ|øc³Xz>OfQÌ<dzlwâÏ6°òî„ -&u |vë¢5„‰ïO\Vÿ©S›²¾ÞUe¸ë²^¬Ónû pno0‰˜‡"š Þ<Ò—«KFÝ•ÙÝŸÙÜçïÓ®¿.úQ(üEIÀ§\ÑŽNeÏ8k«vÅyÙ&T»·ÀÉE.è‹ZLœÇƒ2gi}¶MëÍäU’–êÃÐõGd/ÚX÷ Gñyì3úáÙù2HÂ(Z -w‰qÉ/Ï¢ÇáÞå±Çb Ãaä±@LÅê ò‚ˆÃ¾‘—p>FêÖ„ÇEx©!"E“@?çÃþúg WïŸìi^”L'BŒ±Ï_Ô†yLÆGÚ0/AG>Ö†9 U’¾sÖi_ÖéybÐff°ÝÉÓ>(/(Ëù¢B1´/ç±`Ú…<à ÄTÎ1؉àô2¾0Òÿ5áÐP»ÇÜ¡†–F”k€îUA¬iÓ\×èLF©÷¹ÝŘҠÿ `¥¨r`ö‚g&UÔR2Ë×½Ã!{û Ž¾[.pí¥©bÁ¬¼ì:y÷  Nß*²ñ_ú”=”½ —2,=PdˆG ÝxäXO´Ôy𠇤®s.L »š–kÈmzØÑ”å¬N…•dÄäsS|`­‘UoÖS¬ª )üJ›‡ñ0*=|šàƒ(ô„ÆÅoérx·hòõb·ï¾Uôë‘Ý–ø(K»†ä²c¹pÿc#6STŸ¤º «xÂÉ žTŠ€ÙPEi»²žæ¿ ÖÒ¶´=Ë«‹5ÝÍðîV$Ña¿-4?ÖœÄ!–G1à¥0`ÎgëaM°5¬™Úi´š²Ë˜®í9´ÜÔK2<0{¢öÚÍ¡jC'ÂaÈÐqÌÐX²™+ÓÒquЀé­êz„…¡n¬Ñ‹#6r¢¶QEj-¢Ã¢žc€Jì¡þuâØYúY‚E“öÛE¯ºY|œ /Éa~±8Ρï…<š¹ðBjë;1WüÅÜÀÆ\U#®7C‹÷¿]W[|àC§©RP­Ð°J3„õ^…À¨ìâh£¨P×#'†œæ4àQÑ›»Ñ—j¦ãåkâX#YO·ãu˜»”{›™ÎIµ=ÉЗîVi¸Nt™kõà™AÆ[}xaT±±¾Nt £¸f˜ë|7q¸õ¡A1Dz¨ À,ðlx‡?EOÄ8ö>~ÃMHÛÒD8cyMJÙë)È£l n·ö ÝNì%¤³ÈÐM½‚\.ó28z ¡Ih–G`ÏÚ¡oM™®0»€LwC“ú"½)ó¢îËÛóóéSí±éýùÃãUàùæBx6:ñ¶´™ zFŽf8 {ZшéTº„ANãTZ¯Ê;I!c'툦R–ÚΔ=µ9y:‹çWf-ƒ—viRjr_â‹·é B“ï×rLzã‹»$Kÿ!T-·Ørý¾o‰ži3½Ã |-OûQõiIg܃^à±6òIÝHˆd%°Az/ÿ÷å s0>ré\ŒG‰ƒ®±(€4[bᆳ;$B͆Ào@>:ŠòÏknÀ¥Jfiÿ6뮢°dnC[Ýq¨xÕ˜ïtv`M ×·`Í_™ðûà<„yÕ™ê¢ 1aUl¸mnPʃöˆ` -ÍÏãú/æ2 |þ$^]_*]XW$J5f­k~m!ÝDlÊ_,Õ^é·í`{6‡Œß£<*Ît! ÅäoùQÒø²©”þ˜UÝÐ"y%C½'è‰ÆPS⧽é§ü“õÿÙ·C@=òP´¿ˆ±(x¬'Ò˜‰Õïß²;=¤endstream +xÚµW[wÚ8~çWø°/°„eÙ`r¶”Bâž\póÒíƒÁ|bl¯-JÙ“¿’%››MK7qNºŒf¾ùfF¤¨ì)¦UÜU:&‚Ø4•ùº¦*K6sWCRHp óÁ©µ†m]A*ìª]ÅYìõP7°âx_ýûží &M€1n .l‚NÇlô¿ØMÔ˜ŠQ{bktÇ{:D/6ŸOš&n8BÈí§{z¢‡¡Úüæ|ª œi¡êr˜ÿÔ¾~S¹ô©¦BÜ5•-k«±éuᄆŽe?¨MkŸ UbNWĪ2V lBÃÄç´`〄4ˆ‘¦t ªžñòsj㥠4dhFcî„ðoÕ@Ü%¦ n¾{$þÄÄ55[W*¤!Um$nJIB£4ZºòÃe ½£òÕ‹ŒsL„ÙWß7GTzDÇKüï$©gð€Öf#ï@Õ÷î‚/9–¡÷n¥4'~LÅ€+·QòÌø€¢÷r™“B%bž¬þLíAßZý&Ð;lþÏßõª$,Æõ¡›¹ógzë_à¾Ë°.±V¹Yi²ê-qªlu%룈’Ѥ«<ÂóMÌ2Ô¥þ\æÛ³ï…nœÖsA"qâ‡tá²ë.Š¤ä"•6ë=Û~°ú=ÇZO£m:S`§Î´?±i%¥î2Wœóî‘ï¾KI*z¾„»\UÛ*°f6Ȇ0téqºce´Þú©Hy?d(‚€1…rÍl»iš•îÏS‰Z•N1² +ŽxA³å YDIîhF•fön•@T~ZšØÛÄÁvS¿9!tÅZé‰ ±Êÿ—xf9ãù ™Ó`'D%تÉÄ7Ž«2ô4}‰7ŒdÖn¿Ù® Qž9$ˆbF—Ü·,z¬Î ó{$f8IH/`ŠBšø³ Ï‹c2²’(Â&­®™²›*°1‰âœàE­+Ãùà‡›¹~%K¸Ï£”œeЊÒø¶ÕÚn·SÈ´x¬HÃ]•'Zõn1v·²Vüu lŽæ$¥x²‰Vij[4qâÛMè ³ +H÷ÐÿYÊ;›de*Åa&y-ß)ÛÃðÖS[n\äa 6KàËXmyÑæúÑ|’cÄûi¾Ê(½Ö—«Ö1lãöÛèþµp÷rV5é13«h{¼ ó[œcûÙÅ`dYžµtˆo+óýýõßup ­‡Ápendstream endobj -2567 0 obj << +5670 0 obj << /Type /Page -/Contents 2568 0 R -/Resources 2566 0 R +/Contents 5671 0 R +/Resources 5669 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2529 0 R +/Parent 5668 0 R >> endobj -2569 0 obj << -/D [2567 0 R /XYZ 85.039 781.388 null] +5672 0 obj << +/D [5670 0 R /XYZ 85.039 781.388 null] >> endobj -474 0 obj << -/D [2567 0 R /XYZ 85.039 383.38 null] +5669 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2570 0 obj << -/D [2567 0 R /XYZ 85.039 351.854 null] +5675 0 obj << +/Length 903 +/Filter /FlateDecode +>> +stream +xÚµWQ“š0~çW0ö§“4!D¡3÷`-^¹é)z/m8¤Ê +ìMgîÇw!³´í]q”„Ý,ß~»É®T%ð¡ªÉ1a–:6)f¦©†[…¨k\*Tj ©‚tÞøÊ«ÙÈP)Á±Tÿ룎 ÎTõI›¾›¸¾½"ƘF-´¦„ÌPŪ.V8317Ùï´0~@ ¥:fTWÇœ`NŒš—C¤t®­‹<Î*À ¢Õû¬FÎ('ÚÃQ÷Ïðs1D– ²´(‹0ÎJ1we”gy¿P£'¬ÝÊx#ªŒL\÷½3øÎbþêfþC„<´œxUìN¡ûÃw=Êj¯ó ´eZ¤Û¨ÜÄ»õ—^cé2ÞfÈÍÁ?1ÿ'°ª“mðC n#qÏ’ýz­NÄ}åÑN*†ù˜ÿ°À'&«<þÞÁ,ÿg«õÞâÚößA~£·ö3µ‘çÚSgæLÿ¯·AxíV]8{ñ;ýº›ð`'é¬â$Fi¹iˆaù +¹A^þ@³ÃÀT<&ñÔ÷÷ùmZ›¬ ¬Ÿ•i{#C•xGo·=W j;nž>5¾¯"-†ÉU§„Ä·KËh…;t<{®«±m0> endobj -478 0 obj << -/D [2567 0 R /XYZ 85.039 351.854 null] +5676 0 obj << +/D [5674 0 R /XYZ 85.039 781.388 null] >> endobj -2571 0 obj << -/D [2567 0 R /XYZ 85.039 331.326 null] +5673 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -482 0 obj << -/D [2567 0 R /XYZ 85.039 234.666 null] +5679 0 obj << +/Length 808 +/Filter /FlateDecode +>> +stream +xÚµVQSâ0~ï¯èx/í9‰IÓÐÖ9o¦bÑ: +=}ñ|@@é´×V™›ñÇ_Ò´€Z@,„.…cl¨E"³ˆË7PƒjaçÒcgÜypâ]ûM„×ô[~S¦ÅùßÁª±/ç( J)Ái/:0 TLV ]× +ÑJÆÀiw½þãp:X€Œõ°Ö¡©å(Ø™'™Â“©N´Î±§ÝaÞ¡œžF“i4ÍåºWy–Å“¡œÅùh˜Ê)I è¥ù_ЊÆù0Í$ù7Ù8z,åÙSz*9KZ¯ð³aQ‘ùáë^”î =AËU2~zÑT.fVi2íeM Ðù(š>HrTâ›Æùp7…¨¢íjTºMÄúÝ›|‘þ»UXyl²×¡ų’P&À,NKÞ}\ûâ€îÓx"gò®6z´ÕØÎ!Y"x…hù^«Ó½tYm²úŠ5ÊP$S'Ù.®ð«;èÁ…ßt™ßi…Í®°W +áF’mƒŸ~Dï[ü×í(r,YWø“«Þ_'Ÿ?UF m/e5ÅYžõÓ(áÙŒ““^6ïê-¥>„PìtVÆey£¨{³(‰WƒZ²µ2ùªõŸ’lOVHÜ°Ú´›[ØìNñ@ +XG¥¹¤Hâ–OyLÒ!ÿ/m7ìÍZkLÓ¯9̵g¶2íºnXôSBàç=ºÚgfMÑX¤ÄòYÈír1H£çê ¶³¾KÚe¥*Ü®:žú®’ h8u ÿI3ÿÕpλlþŒÚÄ™w“x¹›¤† \aØ9ð·x«ÆôàH¦²½endstream +endobj +5678 0 obj << +/Type /Page +/Contents 5679 0 R +/Resources 5677 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5668 0 R >> endobj -2572 0 obj << -/D [2567 0 R /XYZ 85.039 213.773 null] +5680 0 obj << +/D [5678 0 R /XYZ 85.039 781.388 null] >> endobj -2566 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F20 1617 0 R /F56 1642 0 R /F72 2435 0 R >> +5677 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2575 0 obj << -/Length 1515 +5683 0 obj << +/Length 1211 /Filter /FlateDecode >> stream -xÚ­XKs›H¾ëWp3T-„a¾¤œ8Ù(•u²‘R9$9 @e2+þ÷Û=Ã)Ö–ªìffúëwOQLøÅe†I=Åq‰A]W ¶SYÃÎßRŸ0Û0§ ·Þ,&¯ÞO-…˜†gzÊbÅ,ÂêÛ7_ï¾j:¥T…mMwWý6׈*Wgwï5ËU?ýçFs©º˜}¾·¸,ÖðÏÍ››ù;í×âãäÝ¢£„nö”¢“¿L%E?NLƒz®²Ú4ˆç)ۉͨÁlZ?'“ùäßEìÙŠà°U·­©a9H€8J£)0:£´ŒWq”_oŸŠ‡DÓ™ÅÔMV”šNˆ ´Þ]B*õ·Ñ_‚ £•_%e!žÊLü¿J²ÀOá -}€†TÚ‘¸ó‹bŸåa—œ¯Š(?Ððˆ2…¿]úç+ú¥¿ô‹HÓ]ïÿÆÞeyy–Ò”šÓqTP2 2SbÝA`•­j¼M½PG2ÈÒÒÓ8]·ž,r•XÄp ÑNf+ežÁ¼é`¶Žç@ιGa8“ 0‚â§QÔµâÚ†ÃÜ&›Ø †‡IÒfówGõó<£¢…}³4 sŠ0Ê¨ì š+Û2ñ…W³­¥Üf –ÒjF=àâhÛ]ˆ;PhóúH bÛœŠà ±óa«Àb¯YŽša3R€M¦®Ä“dÑjvG…¼B–XIÄn…YKÄY¦Æ…8W”! -Å©8ícÛ¥y±ȹŸ&±¬wÛ"ê"e2QµØdUÂA-u‹‚ÑŒ{<ÁQmi •„ÝÊáËZÐyä‡È¿” Yš<ÕÜY‹Òë¢ЩÛÈ_Š‡¼J Añ… hçŒu±‰ë ùô) °rî»×\°DðF<^Uüq‰–=‰eµ"§¡ ÷q’ 8p©éÓï ››ü›ç@(.ŽŒCŸ¦Æa®Rb .*ÊË5­‹ -HÇ%ž£èÈæ]VÓunë ß”ZmÖ]/¢%ñì¶<Ñ—,¯Î \²¤òôIµúä(ºUœ(ä1ãþÓCþ4™ 3¤¯€x¬3ÏùaˆFQ<‚YªmÉ#IÔ÷}$ÁáÆ’j ¦¾jLÔ)–O~ ·Þ8¤ÉJHE–ÉÀS^” 7¹FÆÞ¬C71=lõI¶ÎÒºÇÛ¦‹'Üž©ÛÞ%qŠà¦‡Æo„\­ŽbRÓ<…Ù»›ïãà~“9Î ôÄ©@ð$¾?Š¨<&ÄšZ üÚÏÁÆO×Ñ11„]f˶’¶œc2óÏå`GLýC,Çmu~ôsœ#\^‘¯×ÛUÿnG5ø0Ûúqú\Zwt:!ínQBÑÔ¹Ù…ó²mFÍOËݦö™Š 9¡/vU%ÉE^í|ý|Œãþ¿É$Oç/Öá[yÄkv>Ì -£â›£a?ú€²A— éÝZºó((³ü©‡Å5à²Fëëzþþp}u²1uÚgäñ®<Þ˜܃È‹Ž=³½fxã—A­Ø*–¶âa©Ã(«#‰#™ž8rj¿‰ê}ÐtÝŒåÀÄ/—áݦ’g­àÖKg×ý—†Yfļ¥|“)‚ó"? }ÞäïÍüílÖ¯Àöål\x‡¼/J¿Œ³´¸(Ьçï=ÔV§æÒèÞÓY›­Y}îîÛ§OuªÈ%?IÙ']¥÷i¶—y\æMžHólÇ:¿Á÷±Æ_a+¸¥BÙ_üäÅ=õõé««)w±~ÚÌg·ã‚×yVíŽI>?‹¥äÜ)ɉŸneu‘?wm”ùÓ®”a:Ä=ùmE6¦¾®ýR%º˜ûðÄx”4×ÿ€ܳ“›ã”Ñïò¸íc] ¿ŽäYræðÚÜ<ÎíVÏ*‘Ï»£B%ÀÉi?•ÕûXœùq´nYø¨r9¦Gé ¬xý^b—y©û†­S× .¼aÛ1<×þr\ëtÙG[ÛzÖÜGß™z¨h}Æì*øÔ°û¦endstream +xÚµX[sÚ8~çWx؇%ÓX±, ¸;ÙšJ§/8yéöÁ±E¬­±\Ëa&?~eK² B'­˜Œu=úÎw.’5ƒÿ 6°€l­?€ š¿jÚ· œ¡Ë)zmηuuÛëjжakî²’c®…47øÚ¹ù4tÜÑüBGu  .ô~й¹w.`g!zùdêN¦ã¼Õå°sïäóùÅu\1i2­†‡w†¢…€qñÍýܹ%ÒGeç0´¾~3´€«ô¹ed´g^7äëÇ ¬.’í¨µhýSŠc]M¬jbÅB` Ð!-ȪÑ¡ 4µ¾eËè¼ü‘ãæBt˜ïaŸèÓ-ÓêLgî轨2ûXT78e„Æ¢ÿY¢Îù]ˆZ›®3Fשƒ¶èÉB¹:aM=–áT¶SêcÆä,Zc),¨×·:㲌ù)I2 f§÷²R ‰Žã Y|Õþ^æ‡8Ø ½8ˆp…´‘‘E¥cŠ¬IŠW8Îþ=£…sOè)4!‘µÇ5‰2KU&’N/ÞŠŠï1|yGûIÊÑÃöQYHŸEmHùÒ>þ:ar]€7ÄÇ Ù: +m¬y'0ù^‘øIi"¿ ·p’/“üVÈÙÇÑÃäftƒH<>]­rsïjÐ{—þõ}TœJòŸI‰÷Êd-{ÛXD|/ã®|µ‰ÀQèBõö¥\?¬É8êšÊ·–$ælw[¹ÚãvÇ5?ªÑ¤d£êm1QFW˜ûMüÔ>¡ÿ”fx/Ò²\â—q«x,ŒOW\sÿ˜¦ÒæÙm§ƒBrw©¼;ÛQ·`¦!}Ðå~zHIœ-I„/U”yÁö ’Ca<w§ïŠÆ©ôŽŠ 4b¥Ÿaÿ)¥¬Ù>­2vŽCµ¢\@⃬°ÏU¾~À‡yŒq7êÁšËÎ#4¹ä9Ù|LV‰îä|¨`•^šûšDÂ!HODi ;^šmõ[ž³¸ùD÷¿†eD仜ï®ÓGZˆäý°)ͤåîe-ä8©4H­ŸtÅâ3‡…ë‘S ýœ•áœ{âýª¢dwè¡þï‘}Þé=T´V‡Žú–çQ9’¦ßåØ’¦û)j™ÒUý¸WYƒdas0ñËB´pðþ8ºë_T^ãĪoº˜ÝÜOÓ±~;ù2ºÍï†î…–Ñy91öв +ø=Äq1…òfeœ#¦½s+k‹\­~vûÆ«R bœ=[A¯’ Ëøyà¥Øº H¯Ê'V©¦> endobj -2576 0 obj << -/D [2574 0 R /XYZ 85.039 781.388 null] +5684 0 obj << +/D [5682 0 R /XYZ 85.039 781.388 null] >> endobj -2573 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F70 2201 0 R /F18 2207 0 R /F15 1628 0 R >> -/XObject << /Im2 2261 0 R >> +5681 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2580 0 obj << -/Length 1873 +5687 0 obj << +/Length 3363 /Filter /FlateDecode >> stream -xÚ½XÛnÛ8}÷WøÍ2©IÝò–v“n‹4Ù6.vmK‰…ÈRbKuò÷;RßÒÅ‹1=’3‡3g†öÆ.üyãÈw\ÃÈsdçË‘;¾‡™÷#Ok¸cå¸Sog£7{®»ñxvG*³ô›õî÷³?fç_¦¶”҂驆‘õõfêYFúáêb*"ëú˧³i$­Ù‡ë+žø Å,ÃgoÏnΧ?fG糞¶rT ÑŠ§Ñ·î8C?Ž\GÆÑxc×ñâx¼)_:¾’ú{1º}nwá95æU{|µ•Â@ºN©Öiéïq:O³²ÎïòluÚ”eµ)§¶/|+àyU4K…Òw-›eyYw}7†Kô„Ùü~sáõOÓ#[ÆŽë+:øü'B–•ø¿nã¤(^¦‘²NQ_Z/8Q5ðEÅÖ|jƒB‰_"뱩Yšèɪ¨J¢]§l— -+¹«aã ¯X¡^°Ý)“¥Uw¼3i&ó©­Kè`ÀV-qXÂ@¸Yäs´qÁ;¯qw¯š"EƶñÚËÉëõãÔF·iß´ï^P,2Ä-â$¬ø³ÁU¡•&µVÚ,Œ_Z ä­S„²ÎËûÁ¾0Hn‹ bZ‰Øúc±Å‰[ü’°œ\ÑGÓ˜§óæùh¼°ˆFU/rü¼'ŸÝ··Ý:48/Sμ´KJÕÞˆm–Ô}ç¤ìΰo kß­ª¥ÞÎÌw=eÖ¢#ú¸»(XPV5Zqu‡²ÙÏs¶Ót ½äØŽÀQ¹7†ç9‘Û0ç9±ï÷‚$tà wãC,~]Rp}2­Gt#ŒËžk-IÖëÍTBÐN%„uºf1ãqVÎW/è@¥Ý*ØÉ,taáA¿„#…:êVäô¼òöÑÊÆ—¢§^a˜”÷Þ$LscóªÁ¹ä>37Ÿ±J³ÖÊLˆ- ”¢W6º…\Xœ°|Q¡€¤tL5+=Û1 |™'åÖ‘`Äò”‚¹Ÿ¿>»…æ@Vt[D¡>³ž¾ùƒ>XêÆOÞE‚þkOкgøZëÉ-‡ P`¹raLúZw‚q’jÍû¡˜žIiH‹\ŒtÀˆI¦Oi“ƒ„•PÎú¡5ÉÓ.-ñH<O…Ê‚˜Ìò Ò7L6áå„LO®¾^^NxŒl½Ék&M½¼#èØz‚aSÕAÀ¬Ž*äXª·C, €9È…Ë.#ië˜wgÑw¾öʉ6dºBôâ°?k˜šÂ¨bâBNߎ™ä‘[‡1¶ÉÉ5_¼¹Ätíì¢v„"1vû‘ë ‹=Þ>+eÝs8c”«8ʲšõØj ï<îÆa:Vƒ{½+1!Š»ð•Š°(èãö4¼¤c[)ßšQ=ÑWi>ûe¥5ËUÒõ÷ÚÇã<.įѸÒ4þ>«kSv ™—UiBÕ7›„GºœÁˆÇ–ì£4íÿWšÖx¹V#ù-Þr6LE‚‘óÓ0& 5<¦ö¡ØS¬ór7Ð÷Û6$µ°MnP^&ºµ ©uµl¥5áÖ¬4Y'¢“ƒ)sÝe5RÁ±ñœ,©°dšc…R]B¡U´Ì‹_¦ös AÀÌ!„ð .¦žä§Ü&ûAïZD9nì™÷È5¬ºzw6!Þ1K.0æ‰ÖD[‘!Õúüê3C:a ö>2ôL<+Mð 'hŽÎmÄŽ€#ú˜OHáÊüvK%þ¯Æ…ì>Nl/v‚Hì¾^éFã.ÓÑýJÅÝ໡ÂáG$wâU¹Ö5bÏ[b¢Ó¢âö £0Ö~—²Ë}nÅ^¿r“eÞÇŸ^ðIûùRwcÔè[óf©#“u‹©½ÒÉX­ôzî,mƒâ·®Wè¹X¯w¹ÖÞ߶òÀ?ε¾yC²UŽTÁÙFȳðìú Oüd ÙG”î±Óìí‹ã$9[äú—æaÄÝ¢«ì©A¢_Q0håøð|6×]ˆþ]o½=r@ÀíÃã ‰ÍLk ñék]¯Ü¾o·1‰Àïÿ›¤#÷&E/éö"÷¼,¶ë‹©&ô£ˆ:¤ûáåeTBÕ}Å¿®èdÉžu¹Zé*Æ/·äd  Œ»y; -×Ò“~ñõÞ©[^·ïѶÜáðë]¶L,ËÓŠ‡j +­öpÍ7îÖSXù°Íœ¬i²¹Mxz‹Ó(1Dݲ6öB¢äx»N7Õ)ÎèP±¦…!Þè!ŸäÅ¡rÚr~Jà¹ÑÄ~þTxª{8FQÖ<²d>éIµÀÿKäǶÆÿ‹œ!Š~ÃÉ}1…Þž‘S´<½Ýð÷¶´W´Ls´+»y*Ïl“ª"g‹c´bÙ‰”Õá$O!Tr`]vwZ Æí!O¼À(ê³<±0G<éZ¨•ã÷Xò¦¯Ýn+I²#‰¼·ãçEßv9j1“ïù³kbMù#$ü5õ÷0aØѸaíªt9ྴ©ÈÑû˜B̸ݒ„ªýrÀ€cy‹»+˜˜»¬ÝG) º :Q#aŠJ‹‘áý(>jìêžñý &x7ö8¹Lrî,q¯ØŸ¸ü!«†‹G…ï­b“qE’÷B7ÕM%‡H^¯6ˆÒÚ9¶Óo"•:Š¡£œÈ?ÅJr<™%üEÁtQpxfuY@¬Æ¼‹(M$ÙD´Ú ¥Œyfb¹SÓê¢Éä!%ßÉ:¾{à|j} Mõ· œiIUJA+®SH$g Ìoʪð¦°øêdM9ø̇›êû’×Ü–V6É)vµ4V=ü†lm+K­•ÀéA]7–C—Ð~Ç%;D‚š¸Ï‚ +3Gbƒn÷«ËY?pÉ›Ø2-CÇ›ð‡Âñª²ÌÂ\ò¤/vcGEÆœ÷Å Ó¾Ø ûâ;JEmÚŽvüÎzZè\_¿d8Þ:mݳ¶îY.øÈ™šºƒü”_U%w©ÅC99\ŒÛ;ÎO5¾ŽÙ/tä*Ï;RZ˜ÓE` (çv“xr¸ÙP8élvE…§&†PY +ò9j—„QÌ/©ž7fPºL•)™kݤý8Ã^hÀ€|šºïe´˜RÎu¬cþûó¢žÃ«™:ªµ;tÏÃîשïO(‘Ì–Í\:Ö;!Ëæï8•Éy­Â»N¤‚¨×Ø—Y&öÅãቄMû>„}>aëNØ,‰ä¨ + ~7O¶ÃUõ¼î>Ñð›æ‹U›¡å ÝGªkpûØ?K½…9¢¾'!£c†aúÕàÅÈQAàöïE]kÑŸÕ»jHþ‘rB¯{Ïtü¶hË•ï ÏtC—Ý’[½{¶ Xc·_LNl²¹¢ÒÖ8ƒè°Æù¤âaNô‹¬)¡brºâõ_³t—ÏŸ¼±´a*#›ìŠÌÈ1}ͽ»KeO+ã=—Rm‹éE‹é8×útP/ûÃg¾`ø¸†kOñ#¯  3.@Ã㥶ŠtyÈ—i¿BDÎ#ÝËØ/¾µ•% 2À' ÷/Oÿq}Tîñ|å¡œ9£…9:c¿Ü®Ê€ªvÏø>ŸÊ+•{: vPåš4+ŒâÃ4 Ya ˆEÒ5Ò‹Âæ"îEऻÕØ1ujB<€w¯•}~ú-ÙlׂÁbçôÉšMÉÚòaLùƒT$é& ¦Gô«:ͥɉ-‚ÍŽ+;z\ñL“èxV`§_öEH~fÙòtÍ $ŽßíRÌþ°ù=OÞbusã-h÷‚%žŸ6„ŒËohë¢$yøÖ‰µVlÑC"6’ãÓXѤ6$"hÈU(/tÀ‡5µèͶæ1ŠSð%l’’KÔ”5wIf—W‚Ž»˜#e>Rj ÎíÚ·Qð5Dºyï*eLôÐSØtÊ ±l(©÷ñ¹†"§1a|⽉ޚˆâ7~›¬Øg¥]ËÒÃæ?¥º”ÃOÑ5£¨8£°Õï0²ŠòÄÖ¿-P*èþT5Ê› IiYŠÆcocKâ"ÑŸG —{‘0æú±Uó³ϨȜ(û®«\miAA¸w\íàeüo(•/2endstream +endobj +5686 0 obj << /Type /Page -/Contents 2580 0 R -/Resources 2578 0 R +/Contents 5687 0 R +/Resources 5685 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2577 0 R ->> endobj -2581 0 obj << -/D [2579 0 R /XYZ 85.039 781.388 null] +/Parent 5668 0 R >> endobj -486 0 obj << -/D [2579 0 R /XYZ 85.039 666.966 null] +5688 0 obj << +/D [5686 0 R /XYZ 85.039 781.388 null] >> endobj -2582 0 obj << -/D [2579 0 R /XYZ 85.039 645.769 null] +1862 0 obj << +/D [5686 0 R /XYZ 85.039 545.55 null] >> endobj -490 0 obj << -/D [2579 0 R /XYZ 85.039 548.806 null] +5689 0 obj << +/D [5686 0 R /XYZ 85.039 510.609 null] >> endobj -2583 0 obj << -/D [2579 0 R /XYZ 85.039 528.216 null] +5685 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F14 2895 0 R /F11 2898 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -494 0 obj << -/D [2579 0 R /XYZ 85.039 444.234 null] +5692 0 obj << +/Length 4718 +/Filter /FlateDecode +>> +stream +xÚ¥[ësÛÈ‘ÿî¿BÅJ] ÊÆ`/oÝ¥¼–½qv-+–\»©$ "ƒ­èîŸO¿f œª«­5çјGO?~Ý3Rü§.ÒÈtv‘¤Ê×iz±Ú½.6Ðóã %K!YŽh~¸{ñò]l.TàgAvq÷0Œù&Òwë¿yoþôúæîí§Ë¥ÖÚS™¹L’Ô{óùæRy·ÜzóéýõÝûë±f QyŸo°ûã§ËT{wLôþzè~ýá‡×\Ó~pù»?¿x{çVêÖ«Êp™¿½øÛ?‚‹5léÏ/_géÅ#”_A÷î¬ÓŒ–zõâöÅ_ÜPÜg.ø«9®D:õ£TŸ²EE#¶(Ut‘D†øÒå›âri‚À{Ü–«Ë0õ¶°¥,óvù¬A§ò:¦x†æ€ý©×oËxð…©ûmÞs “ï.ÃĻǹŢŒ²†2ŠŸ—TZóù +++ž²Ãá˜bç@•Yüò]¶¤UìgI +\ Íì.uèÝw}Þ:¦ž0`iÉ— +9šÑG}ëÊo…kÞô󅛚– ùª/¿ +;Lkl꺀¶¦î`‰™Š½ŸÊ +¶Sqw¿å=bùæý•¥ù+Êò‡ìú²ªdæ¼þ}ÏŶX`|˦U;Ž×À³0ÑÞ¦è±`ÜœX^·öãÜq{ÍüÐc~d±ŸªL˜÷W\YFv9Tä}r屄9¨”óOW@ÿZšV«æP åCÛì¸ÔoéÔ.–2í!ÉÛL´ËW LÅÌ%Ê% ܤö;Øk¤I¬BPÁŽųÆêÐìd–…/ØÑ·O(õæÀyÊLñ™|±nðXc1”ò Ÿ¤ª.EFA yÝã»'êž p¬mK¨}%5ÚH*‘ë‚”z÷9WÿDAW°PCÕlh-ßC5 ¼C'c. +`x[äÕ>QL[Ö(%éVÞóž¹GFo‹ºxD©/ÖÜ@¤´q8|,/g$…È£Œíiy»}ÿG<ÓлÝâØ#T(íXxû¯=jJÓ-7üBX7øÁ£U{ãEº„Çö›~¡Íàîø[Ûc‚æ’f`™ÚÉÍiR‰šªÁDÁÄ«\ŒÁšû`ð­ìŠñåé‰iì·í ÏÑúUeçƘª´XŽ$Hy—b‰Ò)ïòä z7×Ìl­lAÉÚÐ ‚ŒN‚Å·…yŽ½¨ÖI?í§ 1X‘ÖÜNì‡_´’Óq¸žóÏÕGt¢°–܈ë¨óŠ‰Ç-Ÿ×b—â©UOü7ëýßeÚ®Ÿ1aè«Ô÷Ô?(ã§i,uÁRa|&ckÄ*d"ï_ñ0ÉPèÈOãÈSÏMÂAXŠ[FÊûÓG„w3#‚ŸNThGœ0 b9°G~–,"`¡úßñR_¢ÛW-žLè5s ÊB?Îì(tîÚ{3ø8n­úÌôÆ•ùýj”úAh§éGªœ†}†ÑDPÇÎ$ë89µ;=Y$ B©«+kåSþY£ŒŒh–R$Œ(À3]† ÃhWŒö®¤Í}¦S@³Ó¢¾¿¶ä`“ø/x‚‡­þLÙ©B¢Õ&$ƒr‚Šœ $lìÜð_™kù[Ò!;L1£. +Ä3Háÿ5Ú=å=6í§×E¹ÙÞ_F +™£n*ã?ë™ÃTJJtº©ïЦ„À4(ÀF(£Å/è°oy¹x…Ý@Íšأd¤ßöT;ñ(è§ÉNp™Meíßéî3ãëØJê,¸³Uïûþ1&W Ø[”&~Ò=¥-ÍrDDP: &L +}`Š ç~ýµ)×,8÷¸q¯`O‹’Í8ªn2¦q2ø{òõPì-nö+ñšòŽ…mKrimSoÜ€†àx³F'¤•ÏmÖÒœlv"Æ(ªÉf– C5ÂE¡öFúÔΖ(‚³§†e)Æ"À̆xÎä€Èëc‹H,Ã7p/mÁ…yÓB$ÿ¬B-õusOûgˆXqñ=¶€f,©Š™ùFå#{±æáðÀ±ÿžF“/­@VÄO k/q[cÁD'¡·`'`5‹€ýàb»â1d‚Ø€CÐɆ,Í}õÄ øí¡`¢ž=>wùžûI>áws4ÃÕÿækÍåÃ`·ÐL¤á(Œ<µˆp7À+‰gÎ… ¬N’‘ŸÂC-v–j¬ @³™ná@„&¡%|^ξÃד79Ö¬ÑÅÐnï¨õéÞÊ2¶ß Þǯò³¸xU®eÁc’ú%ü³rȱu Îêp 19©ØûD:µkP¢ÜꀌΜ +-’tÂÜuyåÓ¼m‚ò™JàÒOMÑÞ¡NžLhÎÀÌR`ú9û +¿±J¿a_¢gì«áÌŸ÷{gSíÊßP¢æ–+붳)öò­äŽk¯×Äx1Í'ä …ŽHxtw/ß^þz#滢TEÝ å†·BjûKMv§p×3&2˜×ÑÏ2ÆÒœ0fêÑ'ñ…É´Ä|$ïJK(`†KUô”‡€ÐÒå'Œ·hªõ‚‹¯×bè8ñàà=Y• ÓL-e3àƒ;V¹Ø%ƒx¹¨ +«ÆnâѬdé¨ù5ÅmVÁÈøí˦A3%2$óÒÚÐÐD$´KüÈÇ•²C:!“TJÄTU’ö ôÕ°Ò‚ĸoƒ_6A@0x¢ÅÍ” î¶pl5"ºê|þfq[´²-I>Ò¬{öm_à—Åw‚ä,1ƒˆ£K(€S¸jwÜ7ÆNxxþØŽy´Hg•ÖD¡ìóJ;":¯´–7úžuJrJlçÄ¿ ¡7¾#ϲæ8ÜÛý¢Ë™á¤xÒ~¢„üΖ»Ên $ÞÍÕ›l¤b_©øÙ=[š“=O±Q¨ý,‹&{¾B¿Ž3IPΓ\¾Ê <³Q~c=‚05¾QcHD¨!AԆ̌p‹´Wçœ%äú¢´ö‰)9„Çœ×Ëžëý–ƒ|#îµñΫ¹P `àBîÕaßÁyu;ÇÀ[~Æ_å]}ü€éq\È{(A½~ýá­à¸q¬š89 +­§sr‰)Z»4.ÄÔ0‚™¨×ò+ ýÞêdY÷ì]ç’ŒÀá$žO£é%Á!‘ :C +bÃ}ÎPWåÝÄv¯ûá(èË(‰.ßá© eÜSŒó,)`‚ße;$mejÆh@·`D¶ÊG0[DEö1›Â) ߸ÄF4õófAg©Bÿ¬Y7 –hdØ@­':>¸S²Ï=‡õS &?üé{.ßİȘ˜XgWçÂ)±6e/†aí†ÿz7Ô£œÑs·4'ŸÆ(iêFO6~e¤s°šoIàgêg¹ wŒ¿r’G§¾‰¦·»ÌG[$Unêßs[Ž0AH¥Ø âIyœ|1"1 +×P;¨>¿ƒ_=<‰ã “Lò,´Ç©üŽ2ô”e&ãm×tΟúPrË&„< +f]44?à@„èP£‘CµÚÃ,n]~iðÌÐ~ì™–ËØÎá 3+N· ΀V’Úã…^ó»[Œ÷ÈÒÂidÖO@Mº¶…˾FâPÈäc ñ ~r–<–œ„†@›Ûb)^D¾Ü5w Ñ4÷äI"åìQ„¬†ÝŽšsÛ‘Ÿžß$²u5Jãmì k5§È°¯!¬|•þÈ- ++ã›?¦ =øEËVr÷Å´/çñâƒê§ÒO8ó¥ÇXG±«fä7'›5EÚ †³ÆDÞÕh<—ñ"óOÖ˜"cmÓ( pWÒm‚rŠì43©‘ÏðÚG¾'à,2Ðz„?daßี5e=E Î;¼KÕßð Žæ·À4ȵ_‘#š‡ÒË_±xÃ6› âϲet€·ß«C PF›CË :m¬Vã „YìGÚ<·Kr¼é-î2Öã üìÐÉ +ÿÁ5š8„5RÓô¢âÆ\"Y“n6 ‹iM‹JvÊ@€b¯Fè‡Ð;›É6&îZÃTù±™æY)F’«)r¹fdH!$£,{WnjòÈÐ0ŒûbвÅÏìø€Êž€dG`ÀRPÜ^á’åYäIR…+ ²¸<ÚVíF&¦ðìPü¬ÎHº>µ¨ÿéV$Tê%Ý\Ug¥« +Ìš’ÖÕƒÏƃ"E~;M‰jzðAáÔ@%%bZào^’ZrŒ¿£4Hu¼ñ£ä:¡ÇÓ­Ž>M½½âªóû)·pB{Ë î¸g8iF‡u öKºÎÂ÷x½wÃå1~¦z¾'ìUVåòqšüe-欓ÏM”ÕZŸZ/z¥O>´  +,:"“ºáØr柉’£ ‚ ™o{Š›ö¯Ð¾$Np¨£´ ÿ*ÖŠ:ö.>î^îÛçå0ÈȯØëd¹´Iý8›ªä-=3!;€§ro +š/î± ´Ë®¹¼2V>¡ý‹Sï$o8¯c@?«fÃÐ:òº•‹ô÷ý‚û9ÔÅm.ªœÞ£4;pü†”çÉ-Ç%Q)$c$_ÍÈå©õ§£uEPW7½6>ëgøl£¿‘2÷3–ˆÒŒ7x ’'ßæõF"áë¦/žäòðáPóƒ¶ñ6åÆiðå(÷}(ƒ1Özvé–ædéG—y‰%ÑdéïP«èý9ºüâ&¾d¢à‹^0Ä°140 ¦z L³÷ªcž+ +&± µôYdn¼ö`“Ì6`ã(ÔœF‹ñ7„¡öÝVqKØz ¯…PkgLOßÌ>ðµ»?}WÚè"J½ÿŸ͢˜qÇí6Ú6ÜÆöÈ?ÜrÃuÑ?òýÖ—YT›¦>ù2o)|ùõƹç´Ã~’}C9Í3ºÁ4ÇlÉ€Ñ(O," —ѳ‹’ãEm^ûJM×€²óßòÄdñä¹IkŸaßZÙàÜPšlî8†¾Þ4thÂfz'Š…›ÖfÓ°ö ã‘¢ëÛrÅ(Ú¤Š¼áìÅÓÜá*Szô2$°6[°Yæ§&žhW[8ƒê¦ +ÁM®ysEG·Ø’ï÷b‹CôÜÖe ^ïˆM%,P/ê~€’‡¿ 6\r¶hù»Ïƒå]p‹¤“öWÑ‹ã#ôÕ9!<2øïQRöǶ‘¬‚†nð 0ÌyâúGðR€ƒþ9z¹Kíoé&,ýöGÞ¦áÑæ5 °u±Ÿ; ]r6$­h躗2á!ÉÿÉ‘©Iê\ùöQÚÿÌMú™±og^Ó‹ †cD!ÅG6M*g„¾2Ó\ûÝe\ßí+y„!ˆãæV–>u2tfIIÏyzÎøW6²D·]Õù~dôÎpcƒ¡™'&èT8<ž‹À9ÞñúY ×™è§ñ›‹ç |ÜîU…™—‚¥Ê2°”“Óoéü-¾>óz ŒKìžâ‘öãÍå=>šÈ÷ÀÅ@¥/BÆ@5¿µm¨\IÐbd°ÈÓÄêØiÄJ.é•}â-£Û‹×˜˜€AKy)ñ§ÇòÔ´l¡.Ý›¯)ÅÌz ¾DÝ3%|M1QsÏOsŸ¸­.\âSI€¿üü× ­b¾-ƒ_6M3RG K6asUvß:(P½ÀTÓÎûh•±™%½¡Íšá<Œ},ˆÑw/ç.ð&ÒÂðä Ðw<é¸(aN/ ’TtäÃéAËÚ&!m :<Ú>É+JZ† w]5ô i¥ù݆ü¥Íô¹$_ìÍdGgðµüøÇpÖu‰ÿ×_è¸?K2ÌÛÿïCe×‚Ì ãè䥈ü%ÏÉ‚ÿ ‚ÉBendstream +endobj +5691 0 obj << +/Type /Page +/Contents 5692 0 R +/Resources 5690 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5694 0 R >> endobj -2584 0 obj << -/D [2579 0 R /XYZ 85.039 417.619 null] +5693 0 obj << +/D [5691 0 R /XYZ 85.039 781.388 null] >> endobj -2578 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F20 1617 0 R /F56 1642 0 R >> +5690 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R /F74 4586 0 R /F20 2865 0 R /F14 2895 0 R /F11 2898 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2587 0 obj << -/Length 2773 +5697 0 obj << +/Length 4731 /Filter /FlateDecode >> stream -xÚµYYoÛH~÷¯òDÃîfóØ·$›Ìf8Ù±3 0;´DKÄR¤CRVô燐æ!Ñv fÕÝÕÕU_R‹þÔ"±~`ÒEœ(ß$Éb½¿ -[˜ùåJ EhoÃÚ3“+7»Š´„ñŽ}›ÅJ‡~ś۫Wïu°ÐEfq{O”·›?<¥üåÊÚÀû²TÞõr¥¼Ðø¶\™(ö>/Màå;€¡¶…E]ñÌ›¢k±yYµá¡¯H…åÕK£¼c»üóöW8†ùˆè¸ë[&~dë5¬È±…{·<óšuÕáhS—|ÆGb £ ¯ÞݘÜ4š“o|DÏJÅ~jÌXP*ôM ŠD¦ÞïȲ”]«Ú§ÖŠ4lä­wYµÏ|™(àðõ›=ÊÖI¸å‡v¼¼Û!a΢ˆ–8×Ä`›¯MÑ¡èO,ÊM‘•(Íí3‚ üXëg•Hù6d£ìB ìt,›¯Eçlê¥NðÙWaÒKãw|#]µZêÔCÝ Uà­³ -‰¸kÎ#îò¢áµ¸kÖ¸oÎC-‰o -sÝRÇxYÜ‚'ºŽXÙ -½¸{·\ÁNÄæ^ÕÕ<óXà[b _Ð --¥îkZºÁSïQ¼ÆÀ“äÜ8ÀQäå‰yàÉ/×pâ÷àÑåžtïô‡¸oññ}:]du)”wƒ O,ÎJ™wlbû_ -KiËû4"– nJ«a |Ú˜©è*±‡‘ÍhQ¶Ù“jm×d]Ý°N`CTØ?·VØ$Ñ~”¤h…߯þø3XlÀ^½ -|“&‹#´_¥ébelêÛ4’~yusõÏñ6 -¬:6öÉ}hUûp‹Éó},8®…„´IØãB 3ÊO­ãÂuMZBªty§(òµ¢;-¾/8³45<;j§Ã"xõa¯¯¥ÅÀ•I} §‡àáìàóT2W¯I @à°Gø´Î[÷²hØ5¿TÅWñ½ªÃjO¬kùûá ;0÷XdܸÁçßßI¯]×àÕÀ£•ùFïf4„0%ŒµWŸ!EÖ9PÁÙ ÐïÙ€öèRt§–‡åxì "?Òd -±‰÷;;buxîiìápÎ%ÛxþöÐ Úxõ­B¤í9¶`øMªïÊ|ï&ŠŽ7+¤ÿXt„ååIæ÷š7n_ɱô~¸t“W]p=bØb6‰’È`„€, pnƒgÃC+¯Bt™Œ"¿Ø/¤Ïc½‚3ðÕqø®?*@´@%¡]žVM¡Þ”4€î›85ˆB±5 8oéPxÚ„p‹•…ñ¨¸Ï1oeÓ4±Óû´à´ r#^}Ï΂;Ý B—7¹Éœ³ch$¸+kq‘x%°r\@ A¸‰4aê°ü÷¶B”Ti¼Xñºÿ UW£@)IÃgÃL@"›þ4ÌÔfþc¥9ž#_ _V°å^ƒä>þ 8þ‹<¬güqꆴ» éšüéÀÐÓŸ†…úù°ðý2 YA þöÈˬ\߆¯t¯¾}Æ=!¾D» +ªm¯«rnöß¼þX`pŒ[³ÍÂPSlwhhw÷õÁÅXBpwÀH³# !ÚÊ7£ÃOÜá^j39n’…MN\ávus≷³†ÝQ€ƒ]à¦bæsBê U.ØÅ8¿„x6—ÃÜ¡_®ßrã¼Â•%ˆ¼¯côÆÝXx#n{à)“'“Õ%@8Ò -ÃØ[—(îÅèJ¢loì¯ÞGãç‡Ì6NŒèÀçfižÿó¦+ò–WLÆ‚¶éTV0«]#8Ÿu“ã m§ê®cð  §DûA›ˆ…*,Œb<´„FÍ1À*ÊÃùQ2€?J_8=ÑMbâÐùÌmw… ÁÎ9}È÷Âh’Žø@jïí k¤ ½ #I‹¤ qþ¥ÐuøqlE†79ÊðïÚfDj_‰sÖZÐ|dèÀ]@6¹*±Ó¸ -ñБTDör†¿•¶Ÿ$f"ÁÏ}mÒÞÅøÖJ¸œÛÒßØÍ¿^Êûm\Ì1Óvîî˜ôÆý®XRqéÄå &ðµv‚út¬ò¦Ýs¼‚ßÐB‡ú¸};ñ‰ç‡~§ÿ1ïÖÇû®è:¶ÈÄë«ßjɽ³1öáhx‰¨rEú­!Oìôuò¦á\·ÄÇÙ–R;õoòï‡\BÑ ‘EŸ.ñ—¦jJê9ûD.eY5Ê!5‚‚ÌÕ<ž=°¡:cË„Ó‚òP¾™I´ÆL\â9%ÃÚŠÿÐVSñBƒV¼Fˆ‡œ6‚xÐ%ÇH™ñ‡\[6v;6ãwñêôâþP6ØÈùµlZ–qJ·âï”æ@äVMkj} ÎúäÁ!z}8ò;ZmÑ8öÓêŒ ,‹:É‹ÌË£â,UBx¦¯«Vä°`”Þ¾ ”mïæ€%Â4ܶu«snPm¶àköyG[ i/ï¶nGo€])}`(K*W­î©¢°î -ª#d%Óqø€ØŸñ§oCOƒ­3å¬qÑv'ïàP Sìsr›)ÝçeÊéKä FI\•37¬›\±tSüÁ‚¦@iãÈÉf3ƒ¹Ñ%p`H_rk0ÎPÜG#æWJÕ K(–‚xŽ2Â䥈A±©) ™ÑU›V®QóLŸoà Ûi^ùOƤ -€ÛχØÖO”úiˆm~RÉ= ­k –•ÜaWôü?#ç> (ˆcÙjŒD] ˆ#?ìc¨ŸŽx8fTÙ{1£±Äç”â<62& f2þŒ£cÏŠ«Äk^–C)4E0yܑуGø†ÊO]¤àòuçBo+õàjHËç0;\¢•s©´UÙ^&Ÿè SÙñy÷5¦¿8ú·±ÏÔ3_ܼƒÕ¿-œýû»ßx¼üÈZ#?5î­ª™]#Rž?´Cqr"¼± >¢¡\!ÅÂkÁ š{áUd|}¸¹‚À?dׄzÀ¬R -˜&þa˜Ë/øí%ík. ¼ùðéØ¥g{—^)1}˜¯šÔFi¤íypI÷ìTì\ 2!Ul‘0 cž*3SŽŠ¿ S+åil 1Õ<Ûk'õúå¬xX6ò».¦Ç©¹`m…/Úˆ‹~'WƒŽ†bK»vR(ºq>ˆTà Åž.½E±@ 2ŠûÓ¤rǵŠ»ò¡ ù›=Àû‰ï)i¦{źpQÐmò êË[ÔW€tç—&%ÏÃå®RQ)êfîG— …\Ù]Öö;g|ä -€‘Íö)÷¨È/$=ºÖm>c+ÆøÊšyé\VÃEJÒ‰>Uwž¹ÿÖG"Ïø²0ÀN~•¼pà)À¸æý´¯ˆíù!ÚhÈYâéÈîû/ÀRendstream -endobj -2586 0 obj << +xÚí[ÝoÜ8’Ï_aøe»4-Rß'™™dwÆñÆfsó ·d·.êV¤Ž×÷×_}‘’Üjy°»À½‚¸%±Ä*‹U¿*Rú̃ú, •ç§gq¢•Ÿ$gëí+ïìZ~|¥…b%$«ÍÛÛW?DÁ™öTê¥g·÷}?¡ +Bÿì6ÿuñîÃåõí÷Ÿ—+ß÷:UËU'‹w_®—zqÃO¯?¼ºýxõ#ÞðP/¾\có§ÏËÄ_Ü2ÑÇ«¾ùòç·—|ç+oùÛí_^}ë$u2€T)Šùû«_óÎrÒ_^yÊO“³G¸ö”†æí+S…/÷Õ«›Ws]q[pÆoMi%ðµŠMx¶ò=•$Á$ö"•„ ¨.ôTèNuƨNk£|mÎ,êî# 2Šël÷§/ãE £/ä:Ûåò0ûVðU^Üg‡JÚ÷K_/šr'·õ¾+ë]Ë]Þ×Kß[4ÒQ½VÜpX®4siøŠžÖ;¦ü¥„–ùëÅß±ñú¹êƒ0ÛHÏ=Ö˜ÐiC‡m‘Q&JFÚøP/M²x\®ŒñYƒ2òõ>¯( L„1*J|P;Î]Joæ5ÉýÀ–Tvß-WA’záþz‰±/½èøI·áÎÑ›ھøˆ|²%?ñƒÿòB{î˜/[¾ÜÕÒÕ7|§häb’µr×Õ¶Ð\ú†Ñ½Q6ÀEÃ¥b¡oE6˜Ú‚F솚5$w²ðù'êøòÊå!ÙbOŒãIO-S³D ¨„,þ>ð«b¦BÁø2.8ô¬ª…šDÏ:D4˜WãÇ*@f”µ-–!ŒeÛ2áÈ`]yž%´bµý$É„YõGõ&‹Ëªbƒ3–k)äþº¡ЄR¯@;!tä“ÇcYª…®¿NÈl´ +#ßÊ,ódR0ŠlK¼P4XvŸPÎê‰9×»ž®¾‡ß$…w‹í„Ú•Ö0ÈIbJyÆWÆ·Ê{ÜÀL+7‰È£dK(v¹Øöô·–`W‚rÑbJðôÈÖpZ­i%8¼¹Ì·4eKsÕ%Ô 7Úß놧‹mqâ5œŸþ5Ë(—_žío ¸2¢ò`ú*n>°4¼itÄœESð+e;±r6Ö½P´áeœ[KçŽãÆZ~ÿ~ýæ¹Ô~ªÂ$<‹¢H3„dÕÓû?¤*Á„å»<â&Jû³¬˜bžX÷@bät»߇Ž g¢gvþhõ +>ñÜ9EëDŽµaûÁ'ÇzZF¡Y ˆ&¤Œ!ÒÇ‘ë ÅÔGìâDê˜åÆ$/0K|•ÄFfŸö}”ر«†U:±HPybdí]cø-š©5•hëTîk ÁyѨ“*«Ñ§¦Ù©°'šQ¡!_sJ…sܬ +g™Y˜}.6´âWëª\£Ù|E& ¯§$!…ÂE +È…ÃW(K™0ÞNúEaÚ:Þ†ƒ +iG^wÏΆoÐWxÌ2ðÒÅúmûÖ¾Àžnbª´ U…Ò?…c‡\—)ªbmÃ<ñÙq†± +ãd~Öµø^$ÿg¶S!èȪJB%è®yÀ÷ŒÙðr·æÈ ¹öS€Ó3þ ÕÍX”¡lþ)‹šãf-j–™µ¨³ŸjŠ<õWvE™ƒo$Æ‘5KŒJ°XW5‰J°X†Á'çë¦àp½EtØXo ‚nLòoeE¶È¬üºä¸85 Â4QAÌGŠÑ„b"žïzBż=+f¹I°˜g&†1dæÂEË  ¨ò_a¨òªYã6NK41f¹‰qÎ3ã2û¿Ža ‰:(`^…=ÑŒ +…h.bÌr³*œefU8`öÿc˜°È*³kÌ õŸâ‚¶bjÐ0B’H¥±³2Jbö4ð¦+9‹˜´¢ P&Ž_°¢žhÆŠ„h.JÌr³V4ËÌZÑ€Ù;²„lôWÏ.ÆHÙÅCª±ñcbMz* +µMù²»“jô=›ä5öD3j"dœRã7«ÆYfVf3j¤X38t]½›ÐjŠýGáK¨c¥ãôöD3"”-<¥Ñ9nV£³Ì¬FÌ.1-7h?òE^f£˜ÔÇåId×Rz®-Š=S:„ƒtTâáâ ¶Õ㸃ur;ØöPó/ÎUf*uXÛŽm5Â'Ÿš¹ŠÑqÂìj&'ÁMzÊKæ±MO3 mLhl?d…'Í+6³œÄbœÖ8vRv“¿ÆÂ’v* +ÀÏž¯ë¦±õ¸uwÎ/ŒäI\(„¡£Ê™Èc ¦Âü«–›ï 3m­"ŠTZ¨T²ãz×뉩ù}HlXg­A’’q´]±Àª©¾Œ€°‘š#.Î…Á‡º¦žµ½Œ±s \¨£HxbAcÉ7M^ÈpD§´%šƒ|³ÜdAÏ3“=d6p‘&¡ÒŒ?¥jÖt°c -ò»D¯—ý£-‘ ÄГOEXùi:ˆ:\Á5£¡}Øn·œsÀz-Ê{eT4E;ØØ*/ +l +\žÿØð\mÎo:àPÎÙâVÚ‹,ˆqIÐU§¥F6(÷EûQ…ÈC!FTÊ[™eƷΚGiUÞ7ƒÂúN +æüˆ!á7tŽUñ@-ÚßɈøáé=g€=ÑŒ +Ñ`žåf p–™5À³ꌃò{ŠÇ„zÈguƒ`üL íÆšâ¹€§ulŒÉ^ÐqO4£c!šƒ“³Ü¬Žg™Y˜}Ú¹ŠD€'Ñôý34Ôq1_ìÝ. ©0òme§gm«}Ž3¨2Ë’šHb ƒè%÷Ñ{‚ãÉ SeüðÏž—¨8y!+Í̞͡ØYnvöf™ÙÙ0#Ìæ’©À›¨~!€ù}Wo÷në1µ›ÞÚ žÖ¶µVƒi48ḹ\PU¹Î$ƒ«ÉNåqL¯wĽ Åçoíì†çb‡â /•®ØMC&àô€¾ؼG‹„Hß»æÀ—­µ‚[²»~j!˜‡;ˆì€ž)î¡Æ¼‡ +oä4|ڥė},hÈþ¿a·qQʼnP-î2WÂÓå»Ðu•9 àª(„úqþn3¡«ÁÐŽ: $’ѳŽKŠ pe¡P¨îÒ¨ÔòðêœK»SH +O1ò›”ù¤÷ +–¤è:Ž±ÒûÀºP0 +ÕÙ®›˜×WÒ× ‚Øm±µ‡£1eÔ yï¸mŽþxK»d&âl/&vÉb£qBñ} ‡5Tëöìà o¸AW몃†´a¿E'ÁFn+”ï輘×sÓhÒ%4x•õp‡u'm›¢uÛ»@aœà 7âö®u‚„<Œwº-w„‰:ÖVºš¯)xíû}ÍÇsE)¬õ7,IFûœtÉ;ŠÔŽÑèÀVjÚíZ×»û)â·EÖχ§6T`C° ¼ã„»¦ñS{ïž +R; Í5¡)îí“Ÿå¼’wUå‚{´K×ù`å5ü*¦'I$ø ìÇ=Ì>Çà:û²;€7½¡üŒÚM\§Ú‘:|Ϩ8´pEÊ_«%m7r~Ä÷)çeºt¬£ãäQ…T%±ƒ@Ös¢£ÆeWU,RiO‘D€ÚÔä +ÖlÔw&aÒJý@¥‘år9Ìu¨¼ÔÖ¢êf²åGöüÀÛÉ>YD1¾ƒ9ÞAŽö!f@ ˆN²D(Ä/tzN)Ñq&¥¢hA‹r#7Ûººu•Ü­=²t‡óv T”c]¨KiÌÁ8‹f|´ +f™cp+ç¦ìÙ'ª çtpêQÚÖK¶Ý®ýîè,T +HÇ gÕbiŽÔ2iž-óGjyoã-Û,@y“&#›E÷>a±JÝÉOû®D]•ÿƒk1á°!î’À›½àHù3•‹&Уužo°DnN°6¡‚Ôâ$ëZx^×6*u”Ü•¤c®YhXZF –ol]:ÈÖF +¹ès.óÚô2!ð¹á¶÷ öýÍíÔ5„vؙⱗHQ0ÒìûëxɉÁ)döv¥]g´ä-íò‚u +RçD¥A¨¿¢(69:ÈÓܺ~Ã8”ë³ó[^8ª‚ï ÞL”c!r8…ý!éþ±Œ£é³F ÌHÅQ<Œ0¨ïŸQ­k·ûG’Õ÷RzJÓ…=ÿ™B¶IÛ-Ã) Ç®•ÒyQ"Ž×s/ÅlGØþ ÂÕížV¼–-xþñžÇè´`¡²É3u´TßUxRme`Ù3j4‘ + ]oäô‘+VL­?€#´nü}Í‘Š²T7,Œ"£¤"DõZÓ–›„Àýƒ d¤}Ã)û‰àÒàX +v÷+ÆB+~‡šmœË?À®â4©æ‡eœˆ50ÐÄôv q¼AÍtù$ŽŒÔC-ì*7||òIŽªN ÆYpDéò†ƒHqr)B]äÏNUób…|/ÑõìÈ-ÍÑÈÇÐÒõØKF#¿y²Ù"æ]½XVR«Tc¢ÜÙ•ƒ ûã3GôêV‡èUÈôÃQIШÄw« ôh«€è1@£K÷ŽŽ—Lì©Ð­±¼î3ÜV¦)BöUÑɵ‡5›OÛZÇv¨*á› ±t(Ϲ°õ–¶PôâÏøc¸ÑbÌɸ¹Ä ’ZHoð“…48öé%ç X·+š]†è~Ÿj›BËš­\ §œœÏBOÚ“ÝòÍÕísƒñ &$€Ê`ùG/«™I<ý¥ÂÊvµêû:6+?Ä2¦¶üȪnу_Ò‡_nŽ¤èÿˆ|ÜÓ¼xiBG÷â}¹ºùòîÝ÷èeo~ÀC~B]êÑ>ƒš€ñ?ƒÀ\iaGÝ–w²ºM(jx±o8 wÇñ…†q?qÐ/ï+tü“óëòà¼ßÿ«v„gy¹œs»Mñú&ÛâÝ]†QEö,sfWJg­=^æ>uS2¨=·—“I-Dh/¶ñŠs˜•dÒ6TË£CØ_ù¤÷UQ>l¨*Pðñ†¡h(¦P€!YÃÇR 8^2^#A'ó€2ÛÑôÑr‡¬H ž›=Î8›uE«²àeÉPiS;GÍ+®Öø›,þĤ‡-Â#yÉéF'ˆ%ÆA3DÀöSk=U®Rþ;žÏì⺬AYÀ§¶ƒƒ9?B¼E© 6³ðÒ’M9:<7äò³¯e%Â÷¢Åê×ë©~¨B‡V FR™Ã‹qW‚Ô¨½*ÛN,–îÅZ'$ƒˆd܉&‰0ôî0™øOÎ09ÑÙèì!#PsBàc¬_øªj@tBX"äç'ŽHlXE³-qÎÛþã¨zª*‡û\®Jxñ-k.Ú}]Wm¶½Ë.ø…1k¢ŽûäÁ~µQÂ}ÀußÙâC‘­7¶ýŽäªùow2 #Õ€ÂçtciŽtó¬~(MŸïõºù0*h_j° zóÀ)T§cÌÊQ½ÌÇål\.MNùF +ÂdvÔ.þš±|Åi÷¡‘sruÃ.œ:¨ŸuÄõømÁµéÊe\KÄ’#Ì0¬ÜXó6ùçâ÷ƒ³í> Û©ƒ.ß–a´ g"–æžY²O¿Àz‚q.zd[!ÇÈ®¢ÁÝaÖJM£oÒðACç;è«ž7S’À¬i£í¥º˜Ìï"ëH!”$Q?£xC0'‰ùØkxh¿šI¢~Oh~–Æ݈Úߤ[9NSRÃè*òüÁ·oÓ&«(´¾p{àÊýÄçQ1ÄDã +¶VQ.÷µœÝë"‰»YÜØ‘²ßÿ1k±²ð#P±I‡þnhS+x …¼Å–3¶wœ[:¸à7Ní`18v_ÇÍÚ$ÿI`§›]°×ÇWþc²á¶ …6ÊH¶ÿöÛÓáú˜pQÞ™˜Ó¿õ}®û(9ð!lžÈ¥Bc”ÑV:’EÏå ýD…=þ_`/tendstream +endobj +5696 0 obj << /Type /Page -/Contents 2587 0 R -/Resources 2585 0 R +/Contents 5697 0 R +/Resources 5695 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2577 0 R +/Parent 5694 0 R >> endobj -2588 0 obj << -/D [2586 0 R /XYZ 85.039 781.388 null] +5698 0 obj << +/D [5696 0 R /XYZ 85.039 781.388 null] >> endobj -498 0 obj << -/D [2586 0 R /XYZ 85.039 761.463 null] +5699 0 obj << +/D [5696 0 R /XYZ 85.039 679.769 null] >> endobj -2589 0 obj << -/D [2586 0 R /XYZ 85.039 646.155 null] +5700 0 obj << +/D [5696 0 R /XYZ 85.039 664.099 null] >> endobj -502 0 obj << -/D [2586 0 R /XYZ 85.039 646.155 null] +5701 0 obj << +/D [5696 0 R /XYZ 85.039 650.55 null] >> endobj -2590 0 obj << -/D [2586 0 R /XYZ 85.039 596.697 null] +5702 0 obj << +/D [5696 0 R /XYZ 85.039 623.451 null] >> endobj -506 0 obj << -/D [2586 0 R /XYZ 85.039 353.221 null] +5703 0 obj << +/D [5696 0 R /XYZ 85.039 609.902 null] >> endobj -2591 0 obj << -/D [2586 0 R /XYZ 85.039 328.669 null] +5704 0 obj << +/D [5696 0 R /XYZ 85.039 596.353 null] >> endobj -510 0 obj << -/D [2586 0 R /XYZ 85.039 177.406 null] +5705 0 obj << +/D [5696 0 R /XYZ 85.039 582.804 null] +>> endobj +5706 0 obj << +/D [5696 0 R /XYZ 85.039 555.705 null] +>> endobj +5707 0 obj << +/D [5696 0 R /XYZ 85.039 544.277 null] +>> endobj +5708 0 obj << +/D [5696 0 R /XYZ 85.039 528.607 null] +>> endobj +5709 0 obj << +/D [5696 0 R /XYZ 85.039 501.508 null] +>> endobj +5710 0 obj << +/D [5696 0 R /XYZ 85.039 473.804 null] +>> endobj +5711 0 obj << +/D [5696 0 R /XYZ 85.039 446.706 null] >> endobj -2592 0 obj << -/D [2586 0 R /XYZ 85.039 148.002 null] +5712 0 obj << +/D [5696 0 R /XYZ 85.039 433.762 null] >> endobj -2585 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F70 2201 0 R /F18 2207 0 R /F65 2099 0 R /F56 1642 0 R /F73 2564 0 R >> -/XObject << /Im1 2193 0 R >> +5713 0 obj << +/D [5696 0 R /XYZ 85.039 420.213 null] +>> endobj +5695 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2595 0 obj << -/Length 3914 +5717 0 obj << +/Length 3357 /Filter /FlateDecode >> stream -xÚ¥ZYsÛF~ׯPéÅ`• c\û²å3«T"{-m²UI Q -kýö5À€ålm¹dÌ===}|ÝCuÁ?užÅadòó4S¡É²óÕî,:¿ƒžΔŒ€¿4L”ž77g¯>$ú\Eaåç7s³þ-xûןnÞ^,1Ráb™¦Yð¯«ËsÓ§÷ |þùòú¾—¯¸õÍb µ›k®½¾zÇ…_/¯Þ}\è,øUz®ndÄB§ÁÛ·ïqézûñêæ36„¶ŸÜü-• c›e?]^ÃÐ~öþÆ;ÔRea¤4žêϳßþˆÎ×pòÏ¢ÐäÙù”£PåùùîÌƸ–‘z}v}öÏaî³çb¹9ðD¸xj\¡Ö ÿŠý]ÉM;u>ÞÑF3›¬°‰FÄaë˜ÈÄ+¯y ú‰»Y8°Ðve½á–ߣ8ZÕ‘ñ²¿ã0£m=鶜¤å®€š‚Mkn"1*Ì°d, -#KãÌÊé^ΫÇ|—$cPy Q¨yÒ¾ä1¡ç‹/!lÓ*°7y;{‹%ö8¤hë¶bŸÈ5Uì³ÙeˆH9Œ–X|Á°Ðž¿|“ñh¢,2|©+ B;¸¬´¼•4M۠üp @•†ÖÄOýˆ¶qp”¢Ø9,4PÙñ¸‰HèÍ2‹kô;$÷lÅõh N©‚Ù†Hê¢b¥u°p¢àŠÄEZ•°YfÒãŠãŽ—\5<áòÉ -Î(ÅÐ0@gÁ9e<}—HêZ €ÚL’Ðïó 1’ã1Šâëv<Ï·*BþÎ)<‰U’„V«g¡¯ -3N ¯ -s”ÿcè«ιEÁ‡Ê¥´Ù~ZL,æ9ѳ¨5 -ãÜþÔª3îïó‘xËY"æ»<õ|u×’¾õ@I̶–Ñ=ûZVòØå¶X5m[v¬z¤oë!g½mY¬/^rÒà‹¹Jh|’V¹(¿1<;@?§"=f9t ‰Þ=Èœv-yGDè!dþšÛ‡Ê~Õjpy’€-\.t@’\-k΢yùªH’N -_¤œÏ½;IÎ(IÅ`%Yð¢}!h%Mƒ/¨” |¦!ß ü‚Ë·”®Á³&y°+ÄË”2²b­o¸6ìA*J´-%SN¾‰ä‚#EäÃ÷$&§À#¶™{Ö8:œ sí'™PŠ°eXsÎîá¾6m®ML€¬2Í÷i—ïƒÂ]Ý&¬¹JGÁfêûÏc"À³F‰ª¼·Cù^ö<3Ž'ŽÀá:o…·¤“`ƒ¢2dÅø"Èú™Ø„9˜Šið$‚‰ê˜( êªë¹Dp7Jž‘ößp©“ýh2ÒrYî!Âç §Ê3&pub6£ÌèG9ѨäX¾£ŒEŒqË™û"/h#œ™ÆòLÐäòzP–.‹9ß™Q -w&PŠ!ˆ.Î=Ã'Øã0·.ð©VÍ~XX6s›ØùMR¬RwÓ5‰šdè@¹~̾ -Æ4÷l‡XÈrÕWc¬Â¯ ,4`×;y8Û4sŽíÖs,LPa2’7úa2~>×» -J9iòiÁ!òv?Áþ”³ÚËdÇ “›Þ9@y0W͇ÐÚEQXš£™:º²—©k:Æ‹žÛÉ€Šu6¼á.¶|»[‚’è°€ëÉ’Ýß>xãÜc«aSPjíëøz†‚=‡UM -š&ãéŠK“ƒ¬&Ó$ËÅ -=ÂÌ-[ø7s¸ÖÊ3·íÅæ@/¥EP"ñ!`ëÜÂiš8ž}ÁÏ£ñÂ~²ñ¥—ÐQß1ô0rúD-©!†â9¿Jµ%¢¶o$é¹ç¯eF—p‘USçÊÖn={u*›ïXrMo× ˆi5Ø×$(«’pÙsðžŒ{³ŸËñ¸_¹A/‡ ! ž^ø›>1ãc?6ƒ4n}àB)è®6ÜÉ°¨Ö=ÚÓ@yõçæ“;‹#×ENùi€[qU_­„²¥“4ö ÖGËŒ-p¸#§œ­ŠŽ<ÏDÍ¢¦–Œ¨ -†þv³Qp¹w+¬ýL–¸'¿oˆ‚ á–Ÿ‰&.x„[d”Fí-€½ÐÊÍx>~Å¡<*ÞI)Çâ,‘L}úä¢äòXU7dH:™Ëm~ÂæQ ~ðâèG$I2ùÉœ<«(Uâ̈C¬|Æž1?gœ… -Líl)tN'€Xd#[ìÇĸgŠ„ƒNiamD½Éè6‡DŠ,^ðgÅò"‡Ÿ±‚îx€Úq°o†÷ƒï†à´¾|·ü s2S6þ0FÏ_’ÉB=º‹s× “0rˆá¶’g2Ϙ}Èr?üfƒ’¨ÐEªSHe| î$fÉ…ÃwÕÚÁQó Ý@q#¿ÑüËœCO’Àï/R­üA7þ‡¹Ø 6g& ÷Ã’ŽÄ‚ÅŠ‡›ÅFñû×A°ÁÏM[Ž¶µt‘|QÕ‚cšs< ]Už¶;ìD6‘æjŸKÌð4šº5ï¶íú€v:¹ Ú©ü»É…ä¯%´$Þ¹—²( 7M?Å€¬ì\Êäô™Ññ³T §ÏgÞMßT(edb-/ß$ÃÛ6¶»×h5ý% ý㦑÷VjÞrf'RØØØ~«¯)ÿÅ tt!ñsutÉkýÉT!Kù©8©´Š¹îB*͆¿Ïæ°0úàœ°q‰;Úa¬tœ%fùæa.–²ìk\ª®iå§JÇÈ=¸Þ¼”ø8áö7=tNÒce-¦?¢ÂSòcLhS{â'Â̲ÿïÇ´V‡ à®å¸ØiAL“c:qŒšæÒþ Øâãendstream -endobj -2594 0 obj << +xÚ¥ZësÛÆÿ®¿‚Õt&`Æ;͇VvœD™ZVcyœN’ ‘H@€@Éjÿùîëð )5Žg ànoooo¿]ÊŸyðÏŸÅÆõt2‹bßÕq<[ï.¼Ùf¾½ð…b!$‹Í뻋å7a0ó=7ñ’ÙÝýÀǸѳ»ì'çÍwW·wo˜/´ÖŽŸ¸óEÅΛ·sßùÀ£·?\ßÜ]ß|‹_ úÎÇ[œ~ÿÃ<ÖÎ]ß ÓWï^_ñ—v½ù/wß_¼½ë%íe©ó÷‹Ÿ~ñféû ÏÕI<{„wÏõazwrº&Ðò]^|¸øGϊ炯:§£c×ÄúT-¾©Å× P™Yd<×xéå§=¤)ª¹Š^óù¾Û_æ •xNKŸë®¨+¨ïñœËoô˜o¸Q˜€$È°Ý­Üu] ÝdÿÀ¸± Ü@ =ç=nºÍ›Ç¢Å­rÞfï˜Ù·<e)2¥U3]ñ¯Ñ‚=³k®A{ì˜h蔾sOˆï[öÇÁÙôPvTh<‹¦^Qd9s”û´Ýr6•‡¾vÞlÓj.÷ŠrkÈ0©\°†,³-6¤½„%H;nÙ6r<—mΫ‰¬åQ´'|Šcñ+›Î’1ë_*¹jÔ´;>ˆ¡süAL}àLÈf*¾)²7Ðun ÏÆ•¨ÞÂð½W8®£»¢¬L‡ã/Œ8(ºDÃ5üÐ[ÎTÊC¶Å\Éá$(âŽ7p%Ÿ–œ±N¼!̺° Lø&kÎà š'’ÀÌ¡ákO*š†–> Y,± +\ô^…E˜|M„¬ ž@¹­›î–µÌü¦¦X¥œëÑÊþü¥H"ä¢väô¤CüÖÑoX‰qœLž—S£ÂƒümĶuÛ]2%DÞê¿nŠ‡Ísßöâ™1?VŒÍ:6T¹•÷hcESeŸžâq› +êƒ5~ÐEï÷6d£ûÒ8{2c-†çh.i³Éù«êÓ:݃EW¸{6Br …è¯Æ%»‘ªŸE])ÝÄ^F]#¢çQ—%B|W# yüQóóšË%ƒn½ˆ´œò!Ý­R8yóÀ7þ×cÁU’¸!„ˆ—·4'‚OŠö"×è`"øt”DLÊ—`ÛÆ,’>–ߤX™È u$…B—H‡foBgqÏÏåÃ< àR—e½Y¶‰´€ƒ_.yÀñ1´œ–" ƒüŽ#äÏžñzû ¢ˆ¬¼?ªÜÆß +Ñ°¨©8@8˜O²¼ø#­ÛSØsŸ0úá“ý?ç”ea£.ro{ìP—¥õ2$ÃÜI«0кZfvÚtÃAÈ=£Ý©s5…Ž vÌ@aÎG»ó|xÍrLɈÂx€\ùTÉ~è‘%È=æeI(;E ,¶îÁ…·ü9…®;ê¶èl ƒX¸á,— 7 i5OJ]£NHçT°°¢ý!MèȜю‚&ù¢ÀÑçPüÛŠW2J @´Ç0ð>:3#Ðñ‘V@œ"ÃÃÇïxE'ë)‘êPÆ)%"Ë’‡&–Ö¥f)ǺéÊ@ìD„Ý ’ Lzü ƒÆ®Š|#>@y¾ç¡Õc«%ÐÎÝVÊdcƒnË+.±½€Kèòp|Ê<ý%¤™ÀÄ I}.ÏhO¦ø>òLdQŸÉ ¶§<€¹Ä˜á šÀÕ«HÐÆÓèÚ)ÃG‚~ÆKœ¯)|! ­¬ÞÕMny~3h4@^[tz*@–¯¤Êlxv€I_ ‡uYÓC%ZŒJÍ딨øv³ñ˜b`¹ÒÔãpp.o‰v½0y9oˆžÏ[–ˆ +T>î:­¾"™:ùQ‚Šœ{²)Ê^C¡ý‰ÿ# +~ËŒ¾#¤¶X°3RÿùUNÊ ]Cm!µý°É)çÛ†ÔvÔÇ…hŒ)eà™QëåHJ\ß÷_Ô£¥9ÑãQÌP®‘ J\£Ž²hŸÀ[F«j#œ­©¦©Ë¼bÃhÿ„a[éѼ>õNoâËj€RØTA*ÆÆÓVÈ“Ýüˆ!~­l1|Þ¡Í/8¸(7™ÖòX¡Ó{.n„Q 2ýniŸI‘;Wª€`t¥Kóì0ùƒ31'ÂשµlCY_Ø«0G ßԲlj›;þÊê]Jû7Øn9,°‘4ê"®Œ¨ÊÀï'þj Ç–+1òŽ--{ì( (=°ÔJF‘ ò|¢È_æÌƶ äU˜ï%£)+ëšOO¢’Þ§aFì‡2–$W#¨ÓÖ‡f\ sÖvhû$Þ¯ï£'pئèç‘KîÜΡ#Áš¶ØT Z‡ ð!Ø­ŸxYç ½+./ñÙöµË¾÷Ù£Û!›Jz±4bÀl)w‘%MÉèQPŸgè—{O¼ÆÖ– ¦m!3¡mËðåÃCR{2+^äü½Þ`~D¢{éd|g¦Nw}S™ +»û±%&È9?j3ÕEÓtyFJ¸Ó4ëq¢™X$sÅ-P×òIÛín¯mHáLÎþ¯¨•v®IVIVA<,*~^¶Û!\,vœ³œ'Yľˆm,ª¢~2LÀùy4”ÝP½5 ÷±$óVر*™æÞÙc¯†sg戗IË€Õš˜e/ß½5v”ðJž[[hñ•#þz&çëÈw}õ_~!=Ÿó- ¼Í›ül¥J¿dGÝÿ+Šò5&rÏ&í[̾uÛ}X7¶ë±ü5Ńý`°g`.{TC$ÀŒOE¹\~OXömšeínuyR +cZÖžyQ/–æD/“n<˜ŒõD/Ûs•.Hå»æ|O +‘²|ŒØöLaB׋}[c¡Æ a€>,®;³!^‡¶@k°0²n†È%Æ¢þÌ#Ò6³``ìzÏÜRȤ»+ö’Lr®÷„‰ûŒBä<P c"g¹|ĈH•7æÛ18„Ñå´1ö#Ï BÑbuF®ÐU‘’ù?ó¶‹ø Í!oÏÝ Ü¬FÃÏqP.ˆGÑ?*·Å&•Žb.­°Ïyåô§×…Ò‘%É4fhõc.Õ¹Ÿ`“Qg¥=HÅS {‰ÔNG'"Ð,Ùmr¬À<ÍŽûõû×oA²/Ïìc7ÈjTZúTÁñnór…Øœ'…‘× 2ý™9q•o9~º¾ ¼¥wÞÆÁ?×ã^‘àz +T§¦è´•ß4ðºŒrþ g@{Å‘ŸDÇïš,›~ÇO[ØFüó‰GEXÈá¯øÓ[04‘O§Tàz½~éæŸó3gÓÚŒ¢=c‘ßæ`ƒRàÑ.ñQ¤¡d§ýåðÊœÚÍÅaÆÚVéÄwesA̼o«œùƒÇPå˜ÿxcDÓ'ßMuI¾ë‡1Iæ'.þ͆ïX‰Ã=^UÐßS6€ Ž‚åÜùáRÛ& ùù +>Þ|¼ý é…‘HgÏC(‰ÆkŠëÛâ©OÔµ…àúÜA!…«âºyfVtþýQH¯L°÷X?SL¥Àg’™ö\Åw¬Âè¤v•?a¢‘Àÿ2†&endstream +endobj +5716 0 obj << /Type /Page -/Contents 2595 0 R -/Resources 2593 0 R +/Contents 5717 0 R +/Resources 5715 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2577 0 R ->> endobj -2596 0 obj << -/D [2594 0 R /XYZ 85.039 781.388 null] ->> endobj -514 0 obj << -/D [2594 0 R /XYZ 85.039 555.81 null] +/Parent 5694 0 R >> endobj -2597 0 obj << -/D [2594 0 R /XYZ 85.039 526.406 null] +5718 0 obj << +/D [5716 0 R /XYZ 85.039 781.388 null] >> endobj -518 0 obj << -/D [2594 0 R /XYZ 85.039 349.225 null] ->> endobj -2598 0 obj << -/D [2594 0 R /XYZ 85.039 330.353 null] ->> endobj -522 0 obj << -/D [2594 0 R /XYZ 85.039 96.185 null] +1866 0 obj << +/D [5716 0 R /XYZ 85.039 288.115 null] >> endobj -2599 0 obj << -/D [2594 0 R /XYZ 85.039 74.989 null] +5719 0 obj << +/D [5716 0 R /XYZ 85.039 264.798 null] >> endobj -2593 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R /F65 2099 0 R /F20 1617 0 R /F73 2564 0 R >> +5715 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F56 2890 0 R /F74 4586 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2602 0 obj << -/Length 3356 +5722 0 obj << +/Length 513 /Filter /FlateDecode >> stream -xÚ¥ÛrÛ6öÝ_áÑ5³f€×}K“të6»‰vÒ™¶ŒD[S¢JRuü÷=7€DÉÙÝÉÄÄåààààÜ!uÁ?u'adŠë,W¡Éóëåæ*º~€™])€ÿY˜ªç¾[\½ú>Õ×* -‹¨¸^ÜÌbõ[ðæ‡×¿,Þ}œßc¥ÂùM–åÁ>ÜþÊC¿¼›«àãÏ·Ÿ>Á÷öî~7¿Þâ÷^xËÏ·ÞÞÍu|–™ ˜ë,xóæ"‘©7wqøÆÞÏÿXüÝ(&qA”½¿ýÀøÕ»…w¨•‡‘Òxª?¯~û#º^ÁɼŠBSä×OÐŽBU×›«8A\FúÍÕ§«;4<_óª æÝÄ: u …y>2Q%L¬·ó›87Á°®°¿G*†cuýÀý¾B†I§½gè@”ÍlçºÀÕ=vð/Â`ݶ,Ù LÙ g^}Ÿ¤9Z'aÅBÔìã\ÖÏ3†< Üa¬Œâ%‘^ÝsSäE,Ö5lGÄ$—NdðDx7:Ã\e׸›ßÀ%´£¾îûºÝf£SèðwiA¶ªŽ'Á¢ŠaP~Ê JÍ—’g‘I8S}-—C#`€!Ó°M,-7Ò{µ¥‡±”ÝyK¨ñȬ›<sþÐaN%.÷,ì+¾ÙeWaD+/±›-ôþ± Ê­@wCÝï!áìô–¿ÃšgLìŸzO. áªB¢S$ˆMˆÖñKÙ‹]¶D€2ãEc§Åö=·W°cÝUtmqï™1¯ºMí¸Ãœ2* Nâ¹ByfL¬Ävèm¸‡kêíÑ1•¨.5î6}37,—þqånDu!2Ñv ,Zñq_‰P†ŠÚ‰nn‘“ƒ¬DrNÕPÅi¨ò̪a½]W] â<¥ˆiæQ* U…÷+K¡È0vD7QVu‘”U =¸XNñdy2¬‘¬©`ê‹Â°„dˆå-y£CÛÛ}f1#aj÷Â*ÀµUY¤¹NLÐBÅÍIqu^ý3³Ò-ïkµžç5äîÉ>¨8á3 $®·g¦E ®ÐéM~­MÁvW {<ëW¡Àá`)‹ÏÐÏy!ô_ãÂ7ïÏŠ•ÓC¸‘Ñ"½p±<¿iÉ ¬*î¼iì”üÙVOŒÕ»lg«Y‰¹„g.‹s‰-´›Ž× XûuÙ”Ûk^ùF턈DU³¹ -4ü& -–_`Ì”su YX0¹V sqhâÔw­ § ø#àoð3™ –Ìûg¶ )3¤Ú¡ÛÎM\¦¶1´91…ó0öÌ;ˆ¦ --FoåæÜ™t˜åÅ¥i 65—ƒ<†FÚP0áð÷uÉ? ¨ ™@R3 ÐÎ3.­:ê˲ï{R¾}½±È›Z¢˜àm|¢FÏ"Nˆ$ `=?Ä”@¯»™pƒ'~ V7jtÕ8F¥lÚžbWÙâ^_aZì”øÉ‚=›ÄŽ{ÛJ¬;æpÛ YÀ7†u“TÁøª Š<4‰MîÕT&6ÑØLbtæ[¡É†)ԆʙŸÉ [z«ÁÒ¶´äCàÄœÞEþ_ä×h²î Ð—u#Ñ É0‡ÛSqœÉÀÞç6Ž{½\ŠØ°è@0ý¶ÚÖN§Â»"sb1ðݱ•.Øu™´Óì0gâ`¼à„R.ì k'ä…È&|·í`·äR…“ijÑìÄéÒNç¢Ô׫Éø4Æì7=±‡„zd¬A Nq·äOSÛSrÂwoµ¼êzË ðž¹>´Šè&"å› ìþ%QM¦Qd`硶V{¥¬®º®í¸yt Çùë±·ˆ -F\6Mw§šST³v¡]'J®ƒeµÚw2¼,$+5 =5)gµ’£ -nÏZ° †PsUKƒXŠêkµÜÕÔý(™¼¶. ØBð9cò™¬—RÉ H¬cvã`’¨³$ŽAƒ|¦ÓØÙŒ Ù¯­¡ôg¸4ø–ûŽB-1H mþ}îûª{õБ ܽâ8³kðÀ&¾ÎĆ¥¨Zq›5‚ö -\òÀ]/¿þŠœ‰s3à±Ë%IkɦSŽl‰€»ÇòOhî!í˜ðiOÎ 4TÅÝØ<†|@7xlܼÝ6’`}CA¢2RphÙR]Lg)í!pj]öL òŠ -õ-û24øP;Æ°&QU^fFPûÞ!Â#ɼñÝØ%eté$gÞ(»¼¼îy¶-‹#+¸ïÚ ƒŒ7oÄÄ`Ë–£&Ž}Ñ[Ä*’¸41+Å2;ˆO£©ø”«x‚âɵÎaCþo½çìî§ÉZ] -&Xš`¢ÖÔEŠÞ&ÿç‘™Djê¦㓃ÏVÊ7>.^4¨ˆjGA«EDâÕóôlk#šä;=Å1 ù OU± ’‹€¿zU«ze7e!ç£8ÈxVŠV Æ¿OÇ[ü¯e»‡¥@Çk¨N"8tË—1ÎЫëbº†CÎSa§Üy¨ÊŽ÷£²C¢Ü° Ò7!8i¦®YÉ™„&ÒÎ5¨¤|Õi*ÛD§eI[4BRNJ“6`ÉHÛ–šÊ6iÀ¨å”ÃVsÒñþ`5….ø-W+n|‹ÕC,TÅàlÏÇDE-EjI q”«>éa¥’ªAÏ ßn—Õ })gÁã¹yðÔ1³Någ´‡›1è$“E®Al?U±v6 çÄ`#Áú¶z!=xÝsàÂÆ[¿À€sáÚ,vØaCcÖÍÐ`©<˜Ñ=Í8<’Lú_g ø… -‡„ËðÓñ$YFøÚ²˜ìáe]˪óãSÓœ¸W]¸úóž«|®Êc*¬Ð¡@4Ô ¸=·Ô/`ÐHõ.fo+ëØ%oTœˆUl©f²¨«<”U#òBuƈ]—–4*4tœ -a§~ +Ù’'1`† 2lI¿u%}‘ ?eÆÍ,ƒÝYù|p © ¶‡ÁÕIRý‚;L5ƒ‹Kîž–¡pr°¡±ÿvàm)¨îyðr”€ÜoGÔgKøþnUŒ»%9ï–dÙ(P GAG’»ò)Ž­ªû’â]Á9ጊ.8móh{–ˆ=t"%Å.ã÷9æjË;Mt³¥ñX¹ÓD¾±d Ðxb¼©Ú§±€˜¼Ò›6U‰÷½¬ÜoG²”‰ÙuTgÜR§Þ dPíòphiò!„«Â€‘€„U@ÞÏ„ê+ÄyN™p.eÓªŸrY‰ÍqOΓ1œ÷¢¦­úÅî ÛË,pØó˜÷VÕq|ÙÔŒZôl*±Ô¡Jô QŸ!zñ¼&Razh5)>*<ÿEåûº_K¿åp^tFë¸pŒ’Óã׉Ó*2@ÞSz»‘eü9›È¹G‰oÆ }ïpN³Go\DÁ¦tN@¢ªÃŒŸkÖõÚŒ(|x+vQTfBJOG$ñ#¼%—”-šIQOÒPEæ@Ô%Béù ÿLfìIæY>QaÆج(8h]]Î; K‚ø+?L«ÏÎd¹”Øò1ÀÎú ¾1Y1†ÍÐ¿´¢0ùs•%^ía¶˜ãkÕ#œ“è»'ÌÑ«®_[ ßMÖ0¢4LÒüÅGP¦½ÃJ쟼dxÏâ6_É2 Ni†c)àÞ¡¸ Ÿu˜d©WY‘¤Úµ"\ýïüS˜)rúµÉ¥§°$ÔQòâSX*Oa·[*ËÌ•4³¥Ì4»~¹.éµËr%Å'AúqVÂK†³ÏÅØÞ”ý£s<ü:GwRÒ£Z¹©©ÖM?µÖæÅ÷1}ù}l!(FB2lÜ“él­â°.årÃJ·,ý]ÛH=a|Ç\%CÞ/¬¡m`å/øyÇO^Qc°û¿V9­ÿ»G ©ìQMnÇua‚+IãŸçb;#SlnKì°âàþFø{úyÆÒ•¡lyZf§Éñ9úÕÑïÄ¢˜3q;a#}#]SZwÞì˜Rk'ŲȈ…nâ'rLÌÿ÷c²XC.»“]”î,;¦a°íÑ÷7瓹¨endstream +xÚ¥SMoÛ0 ½ûWðh¬ˆúÖniÚt.°,MÝS×CЦAzAÝlûû£¬Äölc‡ lS|$É'N‚ÓŒKÖ!“ÎÁS•pØ“ç:Á"?Aòæ¢LfK£9óÜCùÒåÑLi åóCºø<_—W›,—R¦èY–[ëÒÅý:Ãô.ž®7Ū,V×ÁRtˆéý:¸¿n2'Ó2‚ŠUçž¹˜GK2ž=–7ÉUÙ2m9+h¾'ž©¥›„3éü¢ÎÜUB<™Vòd¿%wÉm›*úĨ©©œ¹Fƽ—³tËÉA99*Ç!Gâ,¦* AcGKÿ=çˆÎ•kš‚× gx‡® ­õTÈŠæD[ vÏŠ +%\ˆÜŽ€J0©°€Õà˜7&ì_Ë j@tÌÅýãšoé…Ã=¡LhÎÑäpª­Q{缋i(hÓÓà oà°|Ýÿ¨w¤×HÐ*³eàÙFQ´–ÿiÈUHÒÖÆ\»ÑŸ CnTä µŠj»ßE1¿êj{Œr?âw‘åá:„Ë’×Û㮎ç}ìSÀ¾gÂ¥?ÃkW¼’9èAÒ†q™wÛ‹´†IA»Ö '»%¥’b–¿^”ESÄt qÿy[Í*IrôÓ;Ñ‚ô‚h5ÔrX‰0n8<-Ó¤èêþ ÿ-;endstream endobj -2601 0 obj << +5721 0 obj << /Type /Page -/Contents 2602 0 R -/Resources 2600 0 R +/Contents 5722 0 R +/Resources 5720 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2577 0 R +/Parent 5694 0 R >> endobj -2603 0 obj << -/D [2601 0 R /XYZ 85.039 781.388 null] ->> endobj -526 0 obj << -/D [2601 0 R /XYZ 85.039 625.671 null] +5259 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 575 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5727 0 R] +/Length 36251 +/Filter /FlateDecode +>> +stream +xÚì]‡‚£8 Ó;¦0üÿ_®$ ™š™ÍÌX{»—B èùI²,ͳ-Ìóüa‰ .XàÒÈn °Á‚°ËÈ. 6Xࡹ UBß`á"9çÌÜ…?‹à †Œ¨§oxÁð‚‘Ïa!¼yñ;xÁ`á/GN>²[ëÙ0Šz ¼<÷_ÅC53k±’’Z‚Mkõ^?µH§Žþ߸åZn6‡ÉભÛÙQ/ݳ½¼ÂO\+méµ¥phŸúÿ8yQŸä׿0."ï¤Î—Âp%3¼`äó¼àñ,d9g6[ÒÙïó%N8 –è­z z-ÔN-WJz–#÷;¸že뎤¥Xî\¾m)úðD§a½ú&ÈöÐT—"hÓ€ç—3ðÒð‚‘Oc¡-´øÉ÷¸5ϾÏöX°g&üIJêG ¤KÑÛ)…aÜâd·M!x…Ozßaƒ…³ +ö¶p¤BíØl°ÐÃC/D !’΄Wò¡«ì^ÛËi„Œìj´^Ɇ¿x¢£&¡á#[³ÿC6R€E’2H:Æé ¹è•I#ü°PnTSa^Ð|w g½W,„>¼Ú0Ì•8¤ÒÈ =üå2Z±Ë^YGņFPûm}>@ð`û¡ñŒ<ˆ*ž’zõ>Ø‹O!Íù ýŠ›³ ™-o·¼ð2”YT”Ù÷Ò^°‰rqe’Ëö¶¬õ«º×X˜_ˆ›^0Xx§Xmò“?G¤ÊƒÈïð³Ì/ãî^½iŒ:é!7(ÝE,dâp´/d;ïX‚xÁÄ‘Œ<*Žä‘Æ°|Ιòì,Dm;±']ô"Ï‹àO6Þy‹ûF‹êmyÁëñO‹GŠz|íl±pnàÀ©¦ x°ÀV",ØÊ\ÊèÈTDSFŸ–ÚFòáÄ /ù,/\¬¥®±°Ä‘\Š#Jìy”„…„";6 æ‹i¿å•>Û¡AÅée2ßÄ‘Å‘¼9 À;@,8 + ³Õ† )ísZãH*?—^0òi,ˆàê}qGÎçÁê”~–ÔÍâDQÄa³t5‚îø ö­äÁݤš€“D6:I×t‚#Kq±‹<ž ŸúèRkÉø FGÊï`!$“ië/¨±ùâ/À¨Ÿl½‡Q[íôv!ÙøÅí9¹€…\,1æ‚…ózˆ‰° âHì“þB† þí1¼^¬¥T6RG˜ˆd³Æ‘æ+^&.X1#Bœ.ËÞGº`a.„q$—ì1Û7XȸŽáÂ÷ÅâH¬mœ8M’Ä‚¿iì4Ù<‘$Cü6¬Þ=öÙp쪣W¥ÁÂ^¢½ÆØZgG Š× +Y]c!ßZPj*K„lFk³‰á|Ý}^È»ì>Ð7QÓÛn•{RŒãª¢–ôé p¾7ØH¯ðBéXÓ0¸(uÿÃwù~„åTãÕŒ¯o°å¿÷=Þ7"^÷Li/ƒ(÷o³EëyOó_WXðõ†æ|Ѓ· ¦9¥ÃÒ/hd¿Ï ©ìïc@X°…^ Éãô2û—ƒ7ôž/¥—-q¤ûúþ"/´ñ˜öJh5áÿÇB]liÍiìöíP“h /ìdñž&´2´ÆAËùÆ_ˆ–"š. Œ1‰îé™B?9¦] +ðB Ö‡Ú/¾s¼bÁézÜFZùÊ<걋3Z”9 ¡}„˜]×@Pâºiö±€˜|\¼Ü÷bÁ÷ñrŽÑŽ9( ®XÓßk¦jØv*ZXn ‡¼,ÕY¨mî®#^iµ]ß6-i`Y†úŸeÇE1×'ÀÊ‹®†Ëëà/„œ¼²Ä Ýv±˜ ¶ÒD«zýoŠ$a¡L‡ÅJívëlä øÓµB‰óÿ°ð•¼‰ýZ­H¶¿ \û¿Î4ýª)§C^ȬABÉ\Æ ƒýô¼P¶m[µïsô;™îÞLúüq^øµ#Ãb ×9†½=\«ü_Xx+/|Dœ+Ýﯰa°ð6Îxq ±”¾Û©ô"¹KÎØó®†a`¾Ä@!Å>Nau=ñ›ñgÁBŽ,ÍDPV È;¾h3|n±0ÁAŽN‡%ÓHb†¬#JÍ ·ÄsÄ mý6O r­t·–Á>ci¾ÃPƒ‹ÉKî0X묳ܿur¦'WÔƒGpÏ8²tæ‰×à¿SHs—rÛhC:ä09WhOé¢n\ü6¡‹¡¤[Üϲw7ÁÚDŽlÿ^,<<ŽTc*ï3ZÎÀhìšбãô_}ØrXSûZبëµXž;ß±‘/ðµ_¨ëà‰¿ $V2¡óp¦x!€ñØíÅÑœÑ /t4‘VO¯M°±¼³b”U‹ +EµåsÒ]÷9Mä´clª©Ý}–¸ÃŽya“5¥'­=†ç™=]]  a÷k‚KÂMð{30¾b~¡Lû€K¿ƒŸ«¢‘BH1/°Æ†?0&‹(„ôÆyÅB$q³J¿À综@XHt +1Žáëžm± ‚E €Œñ|0É€8œÄ?Ïoà5uðh©Â¸LÔM[w¢[”oŸïz5¯­±; +Ž´€H(ix¡ÍThwÚdкVöÚdIEß\Ëþ í:äSg°ðvL—û|Yè_ÚNÓƒ‘XÀ¨0€3å;W>ÙA•ŠuŽíp™­ þ‘Ý`!<öø=!C¯° èJ8M¡ü…°,Ëü8õ + jTÿÈ,a¡ ¦%IÃÖʇºµ,ÁZüÒ[,Ä/S;©¥éÄÝÙlŠ¦X!ÌИZô{?~€…Vã°F³\[ý›•þ{âH ×<’hä°FZª¢/úÓGJU=Ô5ĸ¬V,œ¯WP]âHÞUIÜ‹#Q™>Ä‚v’£xA¼KxÍ •J¯˜Êaaý¤øÖ‡ +Ü£Ò|×Mì ÉÊÖNµTOÕjKå:¥r¸µÅå¦á/L*GЭÓflÛÆY¨g—•z‹…ÒZÐwc¬²õ:Ý¥ü,<–ÆeZ €!>Yç³4®âHÌ'ÿÕZœg¦xaQãñ­q¤»1U@¤KX`üäÁVÅ6Žô^èÈhp“ðƒXPj–8¶Nƒ +ª1¥}®µ …­NÿÛæ÷©I>¼€Å’k‹f; ^nWØ-[fé uº| ¡2«À±Xo¶¶ÉþÛ,ú/ò;Y±êI?»Œ•ºÙ + +É~ØÕ¶þv†¢YŽ0lçù˜£æ¸7ö掬˜–§RËR8«§ç0ž£ :“=(zÍd´ÁBUÔ´ˆÆFx¾ÔØ}2g­6iÑAΔdÝngŒ{{fçøͼ~Øu^°p“È­ÔïÀê"Í­7.«Æ­á_]Ô ×Ùƒ*}ĵò»XpŽ£d*3÷#–¡ÁÂ×I½Ï@K>I8ÂÂGR}ì[@k8Nk0rÓ7ú|7)P9ß—ÏËcÒ¬¶ÅÒ5´aÖ„ë¿æ=³gîi›Ÿß¥…qÿÙjW¼ FÖCËY•îÞÉò=n'é*ÛI­)¹èªs ×Xpo7ͯ†íò^–, û[ª¹Â‚>Ð †ÀÜÚJÆ¿†…gæ…w®ïa®°àÞÃÂXo‹%Õ‹ŒW^÷a0†•Ë,5ì+,YíJÇW7»ÔÖXxÌM›aÿ + ê7-Ìhì®Íÿ\½X³Æóu^¨±p k–…ÖÃwøŸ!áî õQiHJ ¹ TñÂA°K_Ã],h;®4ÏýkâH?ÝbÜc᾿°ç…•öXx»§Á²ñ§¼Ê½«\Nw`×¼‚rþž‹ü¼ðü7ý0Ž4Å‘Þ„…eªù•“¶cMêx×XØF® ºêt9Ý1u÷E,h«Ì1 ø4bêCnQð³YBœÎÂ=^–Ì.jTyÍìœÝuŸnÙÊË÷²Oh©‡çê u²¤e²¸÷—õ@c¯å©þ굪ôk«QêBå.êP¹S>—EùV^Xæì×m¤c^°^tæüê쳌†å7¼p´¯ÊG:0¦^ÁBym•«à£XX&Å°—ç uövÉ…ž!ÆÌ—šz®ÏvûÔRçNà>%_ÞjÙ3¦•F›i·}ÓòN.«,Õð<ä[úb-ÕÞÞô²ZÖ¹Ô²Ç/ÞÊ Kþ`Fbt÷RaáÞB7TD\>C©Jî–anx!9:ÂÞ¸¹»Þù,¨(îÐ|š¨ùäz˜`ç.ͽ( zõG±ÁBëǸOŸ¨}ºy’:©ŒöI—}¦YUêŽè 爒7,)z»'Ž‡l( %PXhàSŽ]Ò§6ÇÌ#8‘5xf/=ÑCŸöšîW»ºæ…Û©Û5Ý^´gqÍ ÇfaÖ9´–g·*áØF:´æ•N[;^ø(\ƒ…Ïc!Ò ¥€ ãUNªâ…HåNdÂ+<¾]Ã}&)Ô…„ˆ@åÌ•°b[¹Ešl +ìôÕ>«^'ôÕ"éF¨…¤p^Êr)½É‚]ÔÇ [DêâRP+·àn)‡{yª¯›ýé1ŽNÚ“;ì#²‹ôÐw>Ê*ºZþQ^ 5{ÿ­ªÓ¯Š#-z} ¤–…/š•úHfd¿Lb)®Ó’²šÂUþ“Œ¸Tû„°Oqü&}j ªmœÉ^ËôÔ`ï7ò¬:M%b@,„~péÓ†‰Ú ØÍ–– åXlÜ@’7òÂ’TÚ| î/äéjñg=%MÉcªÇXx /¨õ« ä…TÏ•çI¡æ°U'ïV©ÖŶ¼pdÀ/”¢Hhut$FY“ý9®Ú7-ïä¤Ê3QŠŠÝbÒÆó7¼àÂÿméPAÜLx m2Jï¼ ´gzCiêc,Xûe2l‹×OVjØrâx®í©þ¬¿ÐéþB’X`ûûè/œH¿5/!gå­Xpùýe0x°±fn†â…>ä.ÚýçQã ÷(ƒ­Á_Ю W+=‡Í¦wÍ}'F,Ä`ûä\º°ù À +8‘•œ=̵¥mÓF²SX¸îO}Ÿ–E¯ÏGÝá…ƒ +½x‹tc¶®¯»‡…Ã8ÒŽ2>Ê Ù4™8ÒcãHØ… ›d‘*Í y‰¨ª %§EÛ} ¹J¬x¡§}`ø/‘Sk £N + ‰^ÑßÁ6Ø á3ñÂ9¸”Qu‰#ñãHņ̃g¬-RÖèžÃp[C/è>„…¡YòW¯[cá8¦ªÌ)gþ/èt$3¿ð^À¶ã5Eÿ©a¬¦‡ö` ç"ÛeÁ‚ +³ª}TÁj¸lÓ>Ä  ¨ãTÀ“L$ÀB[« +%-R°£ÈÃ5Ìtç|ù + Þ‰°PÀæªdJA'RkT ØT+:-Xð{#/èaüõÕA×[:ÈöS ´™Ö rƒAsÞ—s}”´ÛqÄðîz_*aŸˆ6;ÝÎZ‰|Á}ŸPàzþ3œÀ®8Î1/¸ ·ÖæDö"é‚Ì®˜6qõû/Ì•¥—ÇÕ4„™.Ãøª¿ ±p;êN¡·þ­=å­wþî¯ñtÿd!ŒoËÙ>½£‡EÈî}~XJ½ÏÇËiz!ôª7ñ¦¤E}ÜÑ×ò¤®åd—UØa>ÆÓZÛºÞ»3¿ bªWþjØYîZYì ûq»Ñk~6ø8/,õ,‡Mãˆ9TadwÊÿ¾o][5èwy5ËÚ¯ÀÙ-I»‰0Ý]¿Pnzò,ˤ× —%—Î à#ÛW=|Üaߊäs¼0çqíÖ×?èo&r??ÆÞ÷¹ß¿ìf½îw^Üãöö-a¬ü,ÌùˆíÐê+Fw:oÝL—ó®wf]²ÅÀniƒK»”WX˜«më)wW¬^cÁÅË8À^C½™¹ŽñƒëÅaå¸û šœöOææ=}}¤–KE\Fá˺ôQ®z¤o ~ñ–”/ñ©][®ò¨;à€nía¼¥™,ìÏyx´<Ö ñµÕèØ´Ëê³®X˜™m¡AEUrÓïs.i7k¼s ›^‡1~0ÝN'— Ø¥Ùü7åéyAw*9᪆±@„›Ê;³ø¥Róoã}¦ÑŽÓÄÂî¯èýÞ <2%w)Æ¡c$qÓ²«]½ï¬ÖêØ7Iñ¸Môv¿¾¸Qy§~ü¤ìÏÖ{z,*oˆùŒ_4(fM8çMØÆi^caî:y“¦iQé$1¾pe„Þ-¾­h€ÏÚÍîoå…ÕyIÑßÊÈìåç^X6ÿZ% ûêS˜8Òçdgz@yŽùt¨Ç“(g›Ÿ±ÍÉj8­X° `WI!±ÇÈÕ‹QP +mçãÛ˜h‚S”wó·ɖŒ^˜©Þ/tóíHc!£4Ø.ækA †%5XÈl?*¤›µ'Ì™ D“wˆ“ZF#®4MËчMc)ƒ³ûnáÛ±P,,l,}\Ç,¨4•³˜]ä2ÿ—´oÂG2Èq•ÏL•Áª™ +5YQ§ü…Š*¥Òƒ·bü˜¿`xÁÄ‘þ#\ÇôI¬š¤° x#ƒ(¸>¬Õ†\ö§S ôB¶ÎÙÃõ … <ŠRƘ3Ð*è“¡#£Ä‘ /^øXÕîÜÈE»ã[cÚbIçE6PäøQxBGaPq¤¥R†¥s\"Éð‚ÁÂóJéë•qžL5äáh,L}Ñ÷ͬ|gµ2¶ó¬þExd)DM¼†”ÝŽc›UŠ& /ùIq¤œ løK5'å–öq¤³•Z:ç¾óM) "ò"ª_œOé=,^0¼ðÄbIh2»@åí¥—çƒù†öX€MŠ™J굑”ŒóÎÓ°©ß‚üv±ÀŸá#? L×Ú‹@I;¶¾ô8úÎμL^±là`9@øø׎@¿!ȱö 8‰>ÇC^ø>麙åË,˱'"ÍS²KýL|ß(ùÐøÈÌgn³™Ù¦o»G²‹(ˆÔ*«¶<;;çs{¢‚Å’gº…ž8³ûtΊ 8³±‹ªñ‚`¢ÖA.pn›µ<†¾ú–ú~ˆåmOêm@}j|]ÿV¥ &Ø~¦úŽP‚^?‚‘¿£(ÍùX8Eìd‰Ô½Â`á‰yÁ¨ùÕOÇ5 (ÀR¥´²,Ö ‚+7ô`aWêMÝñÅÕ"‚”`:G6 S³®íyy¡Kcøóã¨1§§ÆYxŠSªgà›ž‚.Þ¬{DX¼Ñ¾d†Yà$4|$°R¸Þ`áYyáwˆ%*R÷‰f>¯X(E1bÊp."l¹Xðz½ö(O%"uØ«Ä°àÛ¬Š¤5w\8yyÆ-ÎÙ^±Α šì,EÒfÌIömÙöpÞJD]Þø˜wñ8Ë'JpÆÚ@å¨<&€ªÐØH†¾P<®œ+Å¡ºÕÖF"u´¥S*A‹µõN8oZKù¡á$}ÌBž©ðúöQ/ /^IJÇ„=â³ê¾aÏ%bÚ€Ýöëbg‹;¯,2Ø-4¼`xá % +¦ûG‚ƒ]x¡ŸÏ"Ÿ'Î2Å ic£,å4 ü ä`!¦$ÊHzg±ó//”Øé#¢až¶n¦žæ›è©–"TavæœÒ]kãLú¡±‘ /|i¬fÁhjfƒÎïxÌ Ùó¨åƽ8R »Õ;!Õ }9úK†esÍ Øné‚…²°b!¢þ| °pZÈg vj)…`ÆF2¼ð¥¼à+,ÔØŽÒåž*U¼¡6¹Ê4ÞbrÎbYPËÖDå’ ‘G2ÉÛª[vÅ jw¾bkgdØq §žd|3I öͪ1ÏÅn|+yhl$à _)=Ï5B?”¹ò‚‡-b<Ÿ-¼PñBèû´ +!/!}>Ó´Då7þbá ªø 3qG.|Ó('Áã],ã=ð"ã;^øRQ]„ÉÝûÄž÷¼€œ"Õ~¦ärJ•d‹;[`¦AyÓ öej9X<-M×V”^ó lZ|%·²‰N¤š¸ê{\"iüà _)-ÍœP;ôžU;§@Í/P»¾c¦&Uªt$)´OËà“¿¤ €îsŽGs|dá•x°%Tøà;#•4‘‘Šx¶„|¿àg _pÞìÜ7hf¾_؈=   /|­óìc^j·5,ñÞæø/5™é-+CõMX–YVUUVfË#È›_¢2ÓHŸÇ¶N:S‡Èƒ]¶EWA‹Òìðà¬I;/áLaYéÖPacU –¶{wÁ›dxákÅ•Ÿlû–ŠVa!ýø!pËÚTðø$ÉÁ0¼ðå·ôS=h’ž,«Ïa¡~bŸÉâº#ž7,^øjqøgˆÁ“\aÀñ?q˜ëE÷ÐQOK“§jxá«oêgš]…ùÒ¿èSõ-CrSîùlxÁð‚‘ËÓ7X0¼`D‘‡±‘ /1¼`xÁˆÁ‚á# ¯ñB•ù£RaÇ ¸¦Öüù£$7Ø°¤4*ñ‡ÿ,l¢jUkäKf `Ĉ#FŒ1bĈ#FŒ1bĈ#FŒ1bĈ‘? éùt>Îñó]YrÂ+bóŒŒ|Drm±ñ\>í•ù¥Ⱦ﩯Æó]YÐ÷žÁ‚‘oÓ8¬:<'¬¥Îµ# ¥á#߇…ržÏOŒà F¾Íwæ¾ÏŸqô ¤À+ëÍ32ò=ÒûØz‰O{e'óŒŒ|0ÖIцì¯l”¢b¦’ˆ‘w(ÍqqÏ|©Ê^®@ZIñ¤‹áÊJóx¼C¦µ‡ñ!œçsvjæùä¿8¶¶RTÏùÃZ!Ì’a#ïêY‹/bð•ƒÍÇ^Æ‚Oªq­á#À‚þ +°PðügÚH­4¼`ä2ºOØ‚;¯“pÎÓÞ+TëÖ*¼35˦ÞK,d”Çã<‡VZKé¥À ÛIùãxÁø F6RÊ3)…ÎŒú›„µ\½ +¼Gð™/䤜eì\úØŒ²“ÞÌEyæÒ?Ï')¸'dp_ã~‚¿ÀòШÃßÆ‚@,dÒ§öÙØV›Í%ê²™-ì:ÖHjHŸsTz6á"W6ÒIzá\q9ÞÁ‚ضO¬çQ¹¿à½ÐíŽØã7Œ ýü,œ/|$³ûºÒóuÈ+ö,¤bœÈø¢ +W,Ô Ü“Í[x!ì™°pá…èÞõßG¼qíÃI´FÓž_r©y!DSÇ÷Üà!?ð}øFÝ3-¾3ãç¹ïiaáü‚RïBÚǧÈv¼§Ïà ;!kß Òä­ýo#ixáÇØHä/Ìc/$J%@‚Ä ’5ŽÔ¡?äÒsÁvb,ð—±pã/„áÌ2tÒó¥ùw^•ËÄ|Òë0ûj—{ç/Øi97IžôC6çVaQl¬9÷ELWSÖ½U¥øC§(¸îÑ“EŠÿ?õ.ŽûMÂ’ØYÍПbú]vÑOðMãËÚVo-üÜŽói0Lñt’‘4"üçD åbIWc!²‰©NÂéìóÆÓ /ôü¼ÐGáõM ʼn„ôÑ0iÁó–>î^ð‘Ó£MfùLûûü´‘zH)ƒÑÇáG%W¾Áχ´$©ôè3¼-m¬ßr0-{Yà*¹„VË9Þü&›=µý‰VÑÁQ#Ÿ¸F÷žM)¾þ‚%\R žUNÎA +þdFZ2-c§DÏXxóŽò·óB Bð4€zை<éçóÈ¥WDÒg3 ¤_p‘ªNÒK1²+,𸂟çÛ6‡ŸÓȨËáU2ç¾L¼ŠÐ/ŠÚìÎT~’Ó$oX"àâáj½“‰ Á}&øË-YÌU ã +nUP•Fç<)Šb4º÷tÒËÞ*|ÀÂÈÅ)|^ÍŽäç¤à(g>RÄ^ȸh$"€x!‘Aý>^@wÜGh¤ß¢^8ó‰r\ò‘èy3(©Œ$ŸO Í],d;,„¾ìp¶¢§½’SEY‰Êw’¨/%`!–1v/@ÝB”/òäµd#[¤Ý Þ;)8èt@?®¤2rÏç!‚ëK½´2£ƒ}zÚöi’lŒ`î4cÁ`0I8ŸÝ@ÉÎèÝs‚ÁŽ[Õì>ìâFù²¬qF¥~Ìv²ð’§ÊÈÙ-iëÝ]ÖµKú2| /øœ1Á‘“§‚X˜³!@ô¥šaB^€êH ”pŸó¯YpÓÞòBƒÎS´`ýá|š<ÉàåÐÕZ€K­j dÐYj€H‡ÃŒß),œ—ýÎpã8ÿÙPÕÞFÊÁ_Øa!"ðNÈ y °PK¯)Nmêƒ|ÍR ^Øaa’Á3T÷€Â§#aáœãØŽùž"…DFç˜áÇ@fÍ9ð“/x¸ßØeðÖ`á¯bAn§š|²‘Ê R†ž ã ˜Ø )Ö Þ¥Ó´¾22ÿ2/¤š °lŒE*Ÿ’¿@qf×WþB&èÇ%ÒÕXPÓ“=lY›¼†°ÐIŽç*¸mxáOóBû/¤9iIWÎ)›YX`Ü'ßY~e¼å5^À3¼€YgeÆ‘È›cœyIdÑÂÊyăÂM_[Du1›G"å·2‚ÔÜ^^ø»’í± ØÌQKQh)A:ù,i÷8¾uâõôÅ5ªWü…gàE/U`A¨ù…ŽKîÓ„B#‘ñ<|+pš…°Ð¨}©ì@8¯Ìe@Ú³Á‚ñ”X ñÓ #Gg4Áã¾›«Ú ¼iÀYeñ©Ÿœ giD}̾ —W“–s—‚¿’Çh¨U1\ôh S3;qX湓66A3w¦)!mn’¤œÃfrd¯.¥ƒá>ãlÕ3{r- 1Çr0 Q× Þ‰&6k¬ôšØjIó]ñ÷ìÍë\ ++'‡‹]üx “¤¶îƺUP?OúH¥Ñ\mM»Oï–ºØó‹’ u”GoÍy{(/¼(Icqnrì~'|ðöî¬Ðœ0’csÚ&ºÝ†‰Ý š÷Ãçy|e?à”ô\¼ 2“¸™#û­XŽm;Ž'ƒCÕëÐRiOº¶£|›ëýÓdû™%OŸç…¹JϧÚù.sú=+îòÆn +üRa¾*_ªJ™ÈÙ’?­Ò©•Õk ×f |…¸ ak¶ØQyÅ^ÆB.ž5n’™µÿF/(,€­Æ€ €˜¨z!…×a*ðKG5šf”¸A;³ÈÂüÒ(`³¹BrŒÂÃæwL›R<ë²®ç]‰mä¿ðB#d‡Ñü¢ð(u$¼Âíu"é÷yÆ{ÒdjmM/ƒ“rÁ/ÃϺ6à FÁJ,ë„i˜¶ôÑ@iqiÂœD6ø @Ìp!Šðc²‚<‚N:s^éõ Î/³Ø/û ,Œ_¼>ç]¼ ÌâK#ó&ŽT0ž? þ¾ìí‹ïŒ±Ó-O8¯Š%V…ŒÓ”“âTó3ìþV¡ÿ®€éÛl$à FˆÎç3Α.j> ÏæŸÇ PgAÙ9z£ì â»îÐÊ•·cÁð‚‘'õ”‚Ò2ßçÌ©}¬ˆDX°<µ fhê¢/Œrª^ ½õv,€íÆmïûAbxÁÈ“ðÂ¥ ª«V¤x`ýO8ŸƒêÎÚ¢‰)?ˆÜŸæ /HE+Ö‹Xãp…sÏï—i5¼`ä[±À/¼0 +,‡«6sò\¢ˆ¥bÉ ˜PRiÌë¿ðB€„Raiën³'à…ñÊFÂÈæA7ÿ †Œ\óŒÿÜš|TìHFÓK?”‚{#¶*÷{ +@Àë )à•ò`¸G,ˆsBM)zöFßy”óüÏý¡ª§­zlä{±Poçì"(€ÔN^ø*ö¢qfÎ9ò²ŒY +_«9Š¢âÍ8^0ò8ñß0°Þò‚¶§À•àú_éü†ŒöHH#¼WH뉱`Öþy ›C¬œÈ +Éwv¨õs‰ÖT.«Jã‡läi.;J©¸»`^0òC±€¶OC-˜pá'b!¦®“QBÁPäØa#ži Â(x:$ØÂá#/HÀ1ƒ:è~µb—c¦`8Q‘ÚG œ8öiÛ»ïÍ^0òCy–ÙÄ –ÆñÂYØ +½÷â%Out})E÷,PŸs]t/¯rà Fž ´š¿íOîñ‚%×Uûb Y8‡¶w¯}÷ }sÉ©ƒ§ +Ò^0ò¬þrÀYŒ;^H.¼P€k¢Ëˆ7ÊFjhÍg§j,½†…@ïá¡"ÞŸú;… /y,È>°DÞÖ_Xm¤cª‰ô-‹úG©î´¾Œ’‰¿-ŽDÕæB”-ñÈàýÇJ†Œ¼l#Á+F MhÐL°©¦@ý DZY±@;' m¨‘±˜Þä;c´—:Ç3n÷k«^0ò2/°V¥S³RýËèï¬ÿ-;ü8sú6W ÎÃÖ±ïºÁ{,øÔ6“5–J’ÜúŸÞ³á#¯ûÎÇòdM®¶ Ö¾ùܦà8ðÿXRÒð‚‘—$©-¹Š³ØH%ù]K•\Oû”pà FžG\ï‘Qε˜÷Zø% ’yŸ|ñë…^0ò’.X(VÞÞàcüÕƒ'áÿÇ¥ž†Œ|§ô + +|Y(ð®×ùÝVÖÿŒ$^0òÒ ÂÂÚð6àÏÓô>3¼`äۉᲶÁ",´ F¾SbÄÂeî©xáûl$vø«Ã<\^0£)@|©Ê§j›©{¢>žßÇ Etè°`;àÒ çŽ{FQþ€¤ò×M}¾+ŠåùÇFš5ç¾O%Ç¢ü bxÒµ<ßÈ ÇX`M9WƒFFFOþ‚Øç'½°ñB“ ¢²Sv“¢HÉô“¾ˆ•Â§Å.X°\¹‘â$|gµ,®°Í|Òu2jϽeœ#ÿ,£©·Ôˆ§Ø+\ݱD’[Lâõ}my˜‹ÒQ®^6¥LfìÆR´ÒÇÿG F~4/(,8ÂƪeæáÂŽHžñ5ÀóÊÆ_ü sN&‰IYŸ+‘`=‘¦l¤ôÆÖ{VÇʈá…÷ò€:Þz¶¢›1ǃÏ#½…ÆB‹o=)â™ñÞ%‹¿€¨´¥‰&ù%¼Ð Q=^õù|æ²qÔ2ðhñ#´Œ +Ï›ؾ^hðûÑxÐF~¿Õß(¿2ÕSª25 YÇÒ©Å|ògâ…öG2X0ò;xŠ¬…ÝIHVДc[–sª|€Þ_ñõ’¥² ŠyË  F~/ º»Ø Ón™/[Õµ—MÓâëüB$ü`kÈ /ù]¼`I¿ X°äζ9à!Á/\°Q`)¨u^ÙÁiøœSi5ä…Lr;7X0ò+x!÷¥0ÐÛH <€AÃñ.Têà3!ü•T; +¦Zd_ʾSѦaÁ +Œüy9= /ÌåD1ÃÒxŠµP©,à)S=;ží\2u­P`÷èR—'$‡"J²"¡}’œ½‚ùÛòyƒâA¼ðŸ¥bFþ°„™ž…þ?Œüi)€…_à Fþ´äÁBe°`äð§ý…Êð‚à †Œᑼ0Ãp¦ôîQ-înŠ(:­íËëî`sƒ#?RݹNÜ™êˆ#¬; Á¹ýí¹Ú½;^n°`ägú ©tçCŽ”——©6 FžÑ_°ƒÄÒ'5N¹~§ôÏŽ/ÅÅ’Iu´;Øe=˜K° „äµ/â`AÕHRPø&ƒÉ +çÉw¸,Ê ž?†{f|U,ùO¼p è|’pÐcÉ"N"L)e’þÒ¤qáKÖ3óÅ×\¦³-¼4>Ëb¶¹<;sÇEtrÔˆ? +ߊ=a‘W$¨q,E§heŘœ¿€…°lÛql«24jüü‡ÌWbÏw:ç °ƒºê,x©•¸Ö‹µè;6ÂbÐþfªAô¸Ô§ ¢•¬N”˜Úªµÿ M6ÒâHáx$m[eOQ§2ÌìÔ²¦º®§iJbû+&x–~sfxáQ¼0ͪw©§t Ì~&9šGXë(DY»K W4“ªFz?­.¾3(z\pÚ(T¥"³ +ø¬ãHŽ¢ƒV?Â_`–[ß +(ÞdY©Ó•ÿ÷¡ÙÉäºëºÃ0¥ÍÃ/‰%.ûÝÏ~a}±¿àùƒ½KZ¼9÷2 %¹¿€…e=ÀBäžÏ5i¾¯hÊŒJ‹ñ øxOú3ŪÀxxe#Ñ‚è“Èã;3k¨”pp§Ôù†¹vfM§´±5¸Ë‹ÀUY郯(Lð| YÜý,,|9/(,x,ÄLuÚ,T}ß{Óê/Ì{,ÌMRø2`„…1Òú–­ÆBÈ´+‰ŽQÀ~â…+m»Ö½¡þò'=Zç[E íz8¼4¸"û¡æðö£X;ëÜá ½ +Erd+/\Å‘+Ô¸:äþl»%moÚ%1|’•v5ÎÜ>Ñá•Dø‚ùQ¼àN/K]mïÔÐv ”fp× pIêõ>Ò* ?ƒ…,…+3¼pŒpnKÄ?—+/\Å‘fÚt ˆ’§ëbD²S”âÉt#À3ðƒŒËVcx·³êäXˆò‚{-õEõ\ç Ýè¬õEl&}z×Ï%z…Ç`? Ÿá…Îà¾Å_Hq²ø$ƒáÄysÁBxÀ  üÑàáŒ8§sO!ÉÏsIy9Ø¥/ŠÁ½/4/X¼õO½àã<×28…ŸÇ‚Ò¯$ÝýͳêÅX¯‡øëX•éVm}n·N»–±0 YÈZ;©]}EÎ/}çù Œ®ÞðÂÞÏ+Ðf{TšÖ ‚3pC~šPUÓzDŠaÆ.{Æz‚Ÿm^G˜a÷Y.ÉÝÀïá¤1…Xq½30BDTb»Ýäav[Xµ-üW~ ®á…_„……¥Q¶Jm}ÕDá±®rŒ@+xϼù©¼ðÿ×/< î÷ñžÏÕÎêwòB6½4ôÇ +(ÏЊÅðÂýMõ`,¼È ‹oí&_4·zÈ ûÒÈ?’áVOÕ3`áïú ãüãå¼0ÛÊ‹¾ÈH:ä"£zº“!”«K®ÇgÀ‚á…ß„…—ya.iƒú«fŸy!~Ån#ÏÚmž ×_øꡈ±ïÇÂ+¼ ý؃%ÌÇƱ»ì%ŠU›5‡›òBúò5u8àž]˜0ëðlvÓæ/Zš°ÑË—½n:Úê7^ØÁéËy!Šv§¿ ¯ð‚vUoœgÖ¤V=¸SâÜ1¡Âʶ&WmVO‰]m_ƒ(ÚIb’v{Ê{6Ò\am’h`f§ëÙnrøl:Bd´Ôe«üà¾HÇýu©„»6¶àx.mÜíîQèàFÓæêퟒ®ú#üæûÛûÙñä°ð +/Ìñp€…¬I×½di –ÓÞ"Óz“j +›Méxù…ñÙ]Ž¡RŽ–$7Ç}qR#l³œ…á-îâiwMõ^}ñŠ‡ºœ™½Ì^»N`„Ö€ç¶÷×…ïsÛêM†lö7÷š. ,CòS°ð^_Î Ýn¬‹åw`á^Ó[‰9“ë^gºÉ57ä©{s–{ÆÙ¤ÙGŠÞµ¼&Këë³~²+ËkÊYzÉÒ#—%ÖïÇiŸ) h¨®í·ÉÏá…GØHæ…ÖjǾˆqlJÇ®HCÛA± “bÀV ½ì1I£zŠVIeõó©H²Çaá^P`©w6±s-ë5‡¯’½‰ž'Ãf£5ÕoXçíîb!×ÜøîS¹$Œ`^ëz27ÍwX¨§¼6'\…jIVns§ñ`á)ý…Dz\ +œIf^ñ {D¶21­ñáù+ ´„‡°€­Ù­òNb$×ÁÒõh=5;¥ßÄ ÊtßjŠ=è¥Í˜ÇîÅþÞiÔÔílBwG óÝÅΰÚ赕6¯F?cÍAg]deº5;¡F(8UΪ&Qƒü1/І“—©!À¹½{f~áX …üÌ'ÚB,t¡‘l ¡Ï‡3ˆ,ÖõB’Ÿ?qóßÇ :£žÚ+;Ù½ÊÖS&Ê&¹»$ÛêjB¬R×fß;‹ÊX:L›em“åŒ/Í´‹žî~†R~7ݽEîè–ÀSxŸnƒg + ;kñ/Ï/< z=h +oÁB(|(,0®‹g H‹cð¤ß< /ò‚NÍs/ã}§Ê«ç_&{Åà ±’2ê¡{ÐñÞÆppí3ÐýjÊ:î‡G®ÎòÛ46¸¾s ®§ÍÅøçóÂÎ/h^ˆd©Ë¿\°­Xˆ2*XT.ËþÁn)>Ñ}î¼Ð:Éâ%¯?|Iºyü šÕ”"cýz¼Oþ8¯ñ‚ŠÛ´Ú3uŽjÂèX—u]S9~‹ªjiº~ˆ÷xá&Œ*³o³°Éð±€Åx0³{¼0{ŸpÅŠXáû^”‚â…*ÛJÕŽ“¬ë‹7ûŠHº‹>ÛZ)ÜXü·‹Cm+všÍº™g7Óh. V|c-´ÝíºOTÕz]¡ze2½Æ îíš åWŸ9öºG`á¸F} ªOÛ)¦Ô½»æS}µX Ä ·CõuÆÕKE(Â&©o&Ð,;?ð´¦æœ3üK{éĪ;¼p°¤ºT·æB¢†G\`‘yÅ áÅwF^(9ˆéÁY2 +)–4#,ø1VPŠ…ú°ÌæS×jç+ø0Š¥Gg{ëW é+« ^.BÁZ;µ¦kz4ìæÔ1Ž.ªBb;¬Þ.”>æ…úHÓ«D©?ë/|/œìÈÃa&TÑÈ |鄼 (anú¾YÚG=)£*¹ž×ã˜åˆ‡`á•úHõ΃ìvø‘Õ¾ØSËÜñä¼}½8Q˜5‰å;zpw¶¼¶Î^ 'hÞªÞÆ ‡ d!nVN^x ŠOìÝðìXx¥nÞ´+Rg÷3H•N¹V¾1\è‰}o*N–£ƒÕ‘ê BSvå"¿ºÎMÇ‘Ê·ñÂú;|¢Æø O†…äC™{wx᨜*ë–]Þ/ïÍFìÞqÍr‡)qÚðƒ¼°šKM‚€kZS¼hmåoÁÂÁfá,\pyUvÀð“`ácSþwxÁº–$Ic»Ë‡þ—å¯KwÙÚnb7Uþ1^¸XKq²DZk·½Ò]ö,lv‡âûf cü…‡c¡´¿Ñèù…’±|ó‡JÕ½æÜDm†3:»Än¬o]-ˆy1Ó°Š—\¥4Ü)ù«©qéßÉS=ÆÂ&†~´¼{]Û»±pña;kïòâô@Ò°òÂêÔ{bÐa¤7b!|#/8÷-ºØø ²ÆѸxGí÷zM~OÓUw°ÚOðùKÊèÎp{5[ñî­_¸0¼ðý¼PA¯”4„ÿµC÷Xx8/l¯2Ì[\‚¼ƒƒ;5¯òB²™aÚDzÂ/á…c,X¿ƒžÐ_x ¿¾ðÚ Ô’ÏOòÂKX¸3Gæ]j¹Ã6 Ú¼À ¬±8µ^š; “íìwø>á­¼àÜýýƒcxựЬõ"±ÇáWaá=¼ Mó±0Ý$Z[³:›TŸ[^`Ó0¼¶’^EQëîe§øsþÂsk_’û/û øѹêˆN=Ë—)¨¥9ú;TomiéÀ銅{»|/¼\¹(^,w7:kK‡ËÈzÀ VýêQBøê™8Û~ÂûxáÐÿÈ(ÅÌ/<„FOQ”˜xÚastÒ —KmÒß|ø"ÆT’« lØ y†]zf1~’= ïâ…—æÕøú’N²ÊVív.ç;ð^Hÿ[oc½UfÄá¼s;VìµÐë|¤£ßÑ]YÙ_øìN$ŸÒ³ðC°¸—LØë|îÅ)ýO×m¢4Ž¤ÇâBz*æRÒÇöT¢O,jíÉ>N#á< ïâ…ý€üž Ó¢œÓ¾ÜËAÉv聾ïçuVï~>R˜ “•è2`ïã…à +²:!¶5¼ðy^M)  ÁvV³% °pAO'uçò\6û¨Yû»Ù¸uLëqµgJëF< ï╧zܳJ Ö«ùòѾ]^eÈð‚^°ùRu$뤵U•|=v¯^Ë€½“¦öómRšŒ¿ðQÍÎsµª9çè9ª$.ç/dÊÊ2×½pAí'Å=ù ;ßyé§ÞƒS]æ%ÿHšÏñ‚Žàêi¼Í‰nR¬ËrÓs5´ð²¢:}¥ÞñE­ÓáN¿‚çr²÷ñÂÏ(wasˆŸ‰…ÿÌ u;ϱCáLK4u@Ç{°wð;.ôjK53GÞh®±€ZŒìé]„ý,¼‹–¤íô®ù¤Å¨hu Õ},èsLw;×êR~e½·®mm}/¦šëŒu}÷þ^çÏð‚ía·ó ~47dì;„…¤íÆ.Ërí.$‹Ut `Áj»nÌ*ö,¼‹–ío‡B½^a‰±¨Š‰ WÆøSä^35¿½É8]BOå±Õf$Žt âù͸¡ç~žÂ_`ÜW*4/8 Øg"‚Pë/¨ XMžÄ”4ЃH…÷ñ‚Ž$¹×‹7Ãx7¼•nˆA¯A[ϧ†î«!}ÔGõacéν.Ù¤+Ò\ë$Û/C{'/Ü\|x[qü3­¡ÿ¬¿ %"EË ºÆ4X› Q•ÞÔÍ[Œú]õ˜,®ûê$¦¤ C–/gËÊÓz¨»ÕSaÙ:Kª_½·`tÜ!½$×åËÖtÖ÷ò®”ð\]Àܹi‰Wÿ‡ê©–˜w“(ðð®W'¼Ím“3áÃehi‹ 8ã¯.½Ñ»Þk·ýÔ³ÞN>Ë XÅ·ÖÝÕ˜fK)#w‡ìôÏ)Ö%ïÂÜžn ih¹µ•Xµ}èÝKb+|ÇN'ÓZU¾¾²ªsÈ¥’¹­u÷²á»y­´xdômëЇÑs®•$Ö34ýA¼ðòi^˜ódYMS[©ãàR³úÀ¦`º<6ñH•*ë!}§Çí¥Éö‹Ñ¶e‘°Â˜{©ÎQ×]ÐKkY^ ÀÁÜ>UÛ©.EÞí/_ìÂáÖRQ7uõ»u•ûeíŸÑ_(’ôtXx//`Õ^÷²”ymÏÊ^òø²â™¶;Öãø¢ôÛé2¬v¯"Á`Ý>ˆr):Ië´—kš6+‡Þ9ïL¹uAùåpõue¦M‘úÇL3ä â4 ¦ë8WeZ”’-Í vÛMW}Íò‹:íò7ÂÎrkt¸uz4ÕîûMo“SñÞyç|ÜW±Ü¹ïÒä秄“žÄ_x>,LØvl˜Þiëfq=,6KM6Lzd?b“ÀÕ´¡íŠ‡µmr5OÍkØ›FH0nrÏRÕg[7‡|œŽ»ªÝök[¦@²d9ýÄä`š?´ÝõêÓ¢†î`!NÓ8ãwû}mŒYª˜èwè”MœXÚFš°4pwp¢ÊI±•Ž‡¹:JÞáWt²T¬;GX®x6eÔÀÁºýÑlü¡©s‹oAÚ]ÛH؃Êöѵ'Nwü['ÑWÿSyá Ÿ‰‰±ll@6iÑ÷6ëp»6»¿cyοõþ¶ÝtUþ*düU'ûD„s;5²ªkì®}é'†Œ•Œ±ŸR}Z^`ìÇbá×J|§ÀÞo‘gõ¢÷W ³Gƒ…¯ÇÂQÚë/‘gåß{ïõ‡Êk,|ÌFú¼ð[°àIÇ`Á`áéy!tŠ“ +ÉÄEOB;aî©ÃéÕÞÝ„äXÒŸH¥ýˆv;´r¥‰Y\ Ùœ •÷ÒÖý€&Qž¶íÐ'lf±/‹NŸ,éYý… +Û +ʈa**HÐâ(^HÙÏ“À†åKªÝÜùø½Ç/”Ô¾Üoq¹?¾ô;<^o²ìÖ +_9ÔÇð¼ìa°`xá)yÁ“^Ûb^¶+½*dÂG¢85äIóeÿÆöŒ6$,ô2êª*ÿ ¶«")‚®ñEŽ]Ÿ“ÒÆ­^Ór˜ÇHNÌ–Ež»Ò3Xø2,LÆ_ø rj4UöN%h1.KöhÁ~A ËGqV¦ªXätß³È@Q\—€}ÏSxYcÛsÀA4·z‘C¤ü —>ç‰c°`l¤çä…qYo¨;ÕõhÕZ$°_ùYè|ýp>»(Ñ_eäžÏêxí9[釸x¡YwóçŠV²Qå Ü®âÒï?–þb°`âHßà/ØK´sR=Fp5šŠúºa¹ÆÂY¿ò‚½¼‹ 9bak {Ý ±€LÒ-X˜É£ƒƒ…çä…NñBצ /x ü¶Ƕk^ˆ+x;v!b¡“µ3ïʕȲçˆ/»µ{,„aØ ‘ä­Á‚±‘žÒ_`Ä=Œ÷¹ å`CaáDÅ*>-þ‰\íHû DY“ŸmyÁ^˜Ôn°Í/œ~}dÖÍ`ÁðÂwÄ‘"piYè±^ŒËù=]ïÂï0âªÕ°X5x@K +ç"Y0\õ̶¼`/d‚wsû½á…vKd‚+.*ƒ…¯Àæp»Æ_øl.9xµåÌÀ~ñ%.ç׳ÄýB˪¨Tà† èSm¸¾DëŠбÀÝ*ølX°`I2½¸/.ó ”¶éº®éØoý}ß3ïŒ=™TxæÔnŠ/½«K\kS±¤J'+ÆQÝFc'w¬šV¨t8iÇ6*ÛìÆbš}¦ol gÚ÷z2X0òLþƒ…?/f]›Á‚‘‡ù ¹Á‚à †ŒÁð‚à †Œáí¼0§ Â:63÷~Æ\î ^àÑŠžê¬+5X8Õ:¡œUŒ´Lû(*ÒKoáT€œ,:wê²yNhûÁª Œ</x2ÒXðD§9ÝÛ=ó¥<_r³ötw¶úR5æÁ2ô°".ýEÑ3!|.©­[„“q¤¦CÑ»ð™$ ž~ÇÝ} /l°PªQ9/t?rÀBFXÈ—ÖQlÛDªZý1ii‡…s¶ßWçh1;,PgOÀC,ÐÕ‡ê~?/¬ð}tP\ÀuŽ'ø§9ôï´O5˜¡ÓIÉ¥"ÿø°^ Í9Ÿ»Ó ý.ͺ[(’/,­²¬Çã¼|áég§øöÒ{öþB˜D‚ó¢›-0i|Z¤Ö`‡r{ý‰ ~Æš‚!ã¯m¤¦%©Ôg¸Ç‚¯°À|éRèhl­æ…|ÅBÉ?×zZ,`Æ{&¤®ò‘sd=jÞ[KM’a€ÙŽ¹\µn\~ÈY<¬€%KøëÜ!öF×j8V?þBdÅ÷Ž…–¿ ÑÍ~ý>Šâ+ü…Ô¾>¼AömyZmH”ÛKõó,4¸¶ÇDœÍ8‡X`!c'É«=/Ø+wü +,œ}j¦ZúÂÆõ¬)þ3I¹Ü ‰‹À…7ç,ßmŒ×Ãn¯ìã ÕˆàÞ=U„ߊêáw—¤œqïÔâ¨yV·ñÁþ‚GëP+Æ‹‹¿€¾3ø êh©±^_T Ø [AX‰e|bKdðb¥ið¹ÏtD¼úÎÜ9qE!¿ ¡o!ð¹.å‰ /½Pã$ð&.ÍP/Ï•TWZe9 aÙ–kW+UWuSª3,«V™·lÎÔ×ðm®v±äRÎ>Ì+uؾÊÕiÖ!SÁéàe¦ÎÕ÷³Þ!ÏÃ< ³J—tÍaÛàÒZŽ‡_((c[.ØŽ§¾Ï·fu¨®p5¸óå7e¸Cžå¬ßáçžvÊ3:ófwOb‚gÅíÇû úqнb)ß¹ -9.jceözœ›õàÈ z)gA[„qÏ¥Òü ð^’Ù¥x!ÒkBO¿)¦Z#ÊKé'dð4"æW8jô½ž†›=J', YsÎü€EACG€o-_€™£uµRhƒŸ ¯‚ý" -0¢Yõð*è/¤¨2i€»bÓ<|Á½2ÇÓLs¤J9ÀGш#mó +¦p<ˆ´á§HÀY@%;xÁ=¾ò€çìÙ"ÅœÀÐsxÀéAO*žµð–q°â^!¥„ópþµ^ØDaIŸulÀ1w?ñÕÛ£ ¨å¨vïC´aŒÐû÷2¥àŒ÷{,ä:Ž„Xp¥P‘ÒÓBSšyó‘m¬‘q–-ò¶p²ñ„4€…£%–A(“Œ ‰ˆ²ù °½ã|(eûi±@†ðBFwð$Ó¿‘”ó¸ [Uc7ŽË‚Ù° dZŽôH,¸Û¸n„¥ø¸ÉÓ€à—Û Vµá…2ÃaÞó h†òÞC9ï°àbÓl„Ž/+Òöaæ}2´vNqæ¬X€‘?Ö¥àñ_°p¢”-‡§=.Xˆ•ßù H áÀ‹¿€¼P¨_|Öõà$äVÒ(»¯§S¶¢‡2õ\ªŽ©– ¼›p°X.ø‚Oï~……ÇòÂœ[Q@óžá°Nð•ç(ž©;n笂~ëà6ðAdiÿ!ö¢À£¾•á4l—™w°•·NÑÍù2Yž‹qNðÀÖôûx¡[ý¼BÏÝŽ"øÊ;ˆ#-ó  ÔüLQìŽÓDîÌjv‘vG{_`k—:ôÎɧl@á!RŸøGŠomy¡Uã¸g¸`Á´!<áQ/XhI}ÙGÒ¾¡å‡ÊÀ÷ˆT”Œ‡N¢ÂðÍâ/Ð^g™•*fÀ +§XÍofuJw-w…°È{ƒ…e÷ šÌú…çÆ£çC¼ÐH„W¼0Ÿ£â…ˆÚÄ5M»ê7–LèÇÂãàXyXñÔË¢œËZóNÊ–mA{€² h[4`Àƒuëes‹¬²Ä‘ü$óDæ!ùg‚ª>Ü AíD·b!V5>ñ%9,€òÛs~FµdIC5vÙ<úèO!ά"/ÀQ¬kp?ØÜúË4z+$Œ’6ZឈYØrŽÆ3úòô³V`ÅÝF‡Töå\\·XC¨v聾s–¢—Ü`á¹cª½š_@ÛÄèa¢g.©ÄOñ‚Ž#­©‰“*ÎÙ“­Y¿à ÆäX²ä.ÀX[.:éû"ƒŠQ.Öé 9ìÂÉ[°€)ÁÃÜØ^zX,šNƒX`>Uô‰ç Π¢•¨¾ç !æm‚ºÃÁ‘*ü0ðÀàú`v!<8ELàÅœÎj­q$š[B·»åËn •ò‘*¥mz‡ã^_°²‘TL•ŽP0•[Å’ø}~è2Xø:±1ÈŸp}†ÝwhaZh/&˜‘ºÂ·s|bà.JúEgB+²Öˆ!ø ¶ç{ô¤ÂÔ #é7a!\rl /<;>7m’ƒ ­ÒêÞŠ…|‹…üò#VŸÅÂÞ-8‹nL}¤'ÇÂø©j¾N²xÇÍÛ –°Y2ð÷îò5R6w2ËXó©\ôëÝ“x6¼ðC°`ä»Àgüƒ#† ŒìxÁÌ/h,¤F /^ ,Dç“‘¿,…4¼@r’Fþ¼˜˜*Ie7FþºŒ†Œy”Ëa°`Ĉá#F /1rƒn°`Ĉá#FŒ¿`Ĉ±‘Œ16’#†Œ1¼`ÄÈ;xÁ6wÁÈ{‹¸Aä¿ Â`ÁÈû%ÆŠeª™á# §9Ì~—mxÁÈÇ°pþuÊcxÁȇ±À~دç…òÜ÷ü1á²Çb!šê³á…Ÿ%™.am~$Ô]ýU¾sùë±P Y ƒg°ðPiúˆKîõ&¦ú“¤X‹4–“QàÇJ/O¿ëý~©’ØÆ`á °P,ü8©Ãè  ÝF,pß  ž2/ð¥"Çh¯Á‹Rþ…¹6[Fu Œô?°¾ñ³¿„žgQ›¡ÔU̓Ú{x ®«®+™åE}ÊÞt“}Gsà «‡Ç”zðt+OOwWÞ{m4Lj“_ƒ…2P“sx©:o9Ò¿ÔÂÅ–§Ëž÷–ûÓÛ O[$³ÝÔܱÂÙã4•û>{ßAt#ò lΓ®Sl¦¾Á<—³ŒmÛv,γ™qm7½¥—‚ýð9oã/|’Dø„¹"[ZdœÞÜÜãÞÃRY*#$Ì2öi,2Ö»áõ&‘ÖÜéì€@Ž— a^[¯‚©ŽVܼbÚbbŸl\jxáá’q°BGÈ3*“B·KoͲZô+owµ™Ö4›x!¬ô.a©v†‡¾hé†T"Ç2ÀK·Á¸áÓ'±`K®~%«ã^P-JyžGÌ~ESiÊ. |\0ž¸EƦÂkñî—sÕÃÛnLÙ\º†ž 'Ž:ëù§ˆÙcs×V`ß ÛãœG8âÅ‘àüܪGËy±Ž‚ù‰ Å3ƒ'Î]8Èä Ñw¤’ðÍjcùƒøòN&„_Bij#ø©ø×Þu06‹ó`0Ëì `øÿÿò$Ù2›6Iß^kÝw÷¥ Ã`=Ö°F ç°0ž˜gr¡Ð‡$ØÇÚ‹›=Ò x=Áañ¤—ç>HÔ^Â|F Þ—"ìBl½`‹Òž‹93ráÕ”•x3>÷<¡uÜ÷ù2"<&Q:E„­”zéÛé(ËjiAA†ïÄ +†PÎE_Ên™BiµÀe< ²d0Õ¾Íbég°ŽŠ.w a&†.a°óኟ ƒ^ðϱ@raŽcë@ Vt`ï°€†V#†Eõv¶¨oô<àAƒŠ¸7¨6Ï÷"1ráÕÔœyA‘-!Þ?¡â jT À5š›×ÆàŽdA04”½€“Ã|Ù.¡(ˆ¥f8-|ÿCj›>”­+}åîäD_” §q|$ÚT*‹j:øðǬïÁ›ðŒ-œE06hD“žT{ᥟ±Œ¥"‡?­çW1ƒ…×RrÖñ~”ÙR" +Pm¨8¨ü ÍH_6YÁz\ùÕRKºB@a¾åÄ„ŸÁ)ààðá¡ù>Ñha°R ÐÚ·ôK¿ÿ¢\èN^Ê™\ÈÇÃaŽ²íçvÆM/ïWdBÙIèƒÅ(l€º¢#ì…•R Á›läÓF.¼š¬3±`âKâ„V<¿kP/‘¤sIŸ„¶,=ån:€^BXP>UON­Ô§ð£ûþ‡HE´ð‘lè.VéûþôE¹I_‹ëÀܽv…G{8^¯í€Ž· 2……*”~8Œ4ý!¨+¢\ÈÊ“‡<•éi,¹ðn,̲âB¯Š•ëKÑfr¨ú¾ŸÒ W¢ >¦ßc¡ƒ5nçS¹PÉ`êáŸ"Eýú;t¤‘l9E´GìÉô){aY­oÔùáÙjý¸‡£IÁ«×ïpØ@9Ó­:Ò>ý¥'Q¢ä‚O‚“Å=̱ÁÂב:É”KµigôÚ’4þª¶Epò‹9âË*ˆqú3¹À}šà”o‚Ÿâ£0–D=Oat}Ô'Ù-V›Ì ý_·ÃB/q‡qaën*k3½”5`á@o×Æ·ñ^Æ,\ø‘X˜Îl[Ôùi}¯Évn`Þ:ZÃ]x—nO®¹_W©’'ùžÙ`žŒ‘­Ñþ›§•ùLÜ¿D÷o°pÀ fËc ÿ#,Üá%÷r︒¢Iù=,œ<ƒs­:‡Ó¢§W? ïbXƒ…w¼Ô4#¹Ð­yê 0[Š:ü8*,°ê(é=ƬZ³šÙ1垥<Õ¿êÛHc¡¨²@ + \'C3ßN¥îCY†ÎÂêÀ÷½æåXàVà±…j˜ãùjï=ö¢Ð÷Tõø ·ÍáQ{ÏÉýgüÖ|ÉKé(#jià¼Ãhí¡÷n Ò`áßb¡Æìt†ëª%TÂúâ– u kdt²ôJ)B˜^8.Ôi |UF Ïá»ÐÐøV(ƒbû±<Ð3LžJwàpZœ@­àðƒß+,Ę#+Ùó\q¥Iaþ›òZE›ç°ËrðV i„ «CïÀóéAéç!òÙ²”ÁäðìãÒrÁÏ£0¾X”Î++ƒ…†…\]STà$zÔ(†™…iË1[‘üåÀexœÞ‹®!êüAÈ ¨Bs …|!ðz!½g¬ñ¥ï±\+?Ú pØ J!öÏæ‚’Ždá``üõ‹±0ɲÅK„:™/-e z”]Ö,”ÙMp¶¥ŒAÎ +Àëk)/¼? O‰bI¤_,¹Àüµþ!ú‘t¹¤p¨g•$Ú K;ç숅L¬X¨ìce™Ô ÄB„$pÈ),¨Ëîå¬0+ö‰ŸÄÚ7jD¹ÈXU¥éËt$K9€AylÞá£\(EµÍ]NŠgžb˜2[íΔJ„o96rágÚ JGj #¹€:0vŠ³&Ò îREíÂìa5ø.t¤p¹¢#@Š¦æ¨ÑÅâpUHbÅ‚ Øä*M:|rfI. +µeøbÛž/ÃD§‹©!Ü:ÑlXˆu=%[¬r¡£×æJ‘­rƒÈR¯Ò¹0¹ðí…˜ÖÆ$¹€:ÒL °ØzR;ÅÇU‘°0KUõÁuh“ •ÀE2&Šp†Õ"y€£©Ô\)«Õvæª_(D¥O²†ðsaÒ‰kîÊg}ªÂ $>A$Ë1ÐqtÄBæK/KÀ‡Â¬f‰3H\M,éäG²¤8ÄTnïErÁ`á ‚!î µ½€raeì6QTXˆ¥è +ä²+­/Ê Ì87—å¼~\‰ç“ùTá¼Câ!ÚR ‘y4‚ÙorÎ?æ\O:‡»*kÚ%WUþ§öAe,“Ÿ²Æ¦ ^»n)çh礞.¥×(U«ë•6®Y Ë¥C3&.ñ<@iBUü¬É`áå”á4 à Ý† ÄÁÂM TÊgJÁÚpíÍAr› ;v„­®Í¾N÷¨Lk„Ó5‹á +ÒÆ¿DŽn%¬ ƒ~zÜ«“XT`•1O¹¦/4E [^…¬XXFN üÃvHî0Ú2gÝ®¼;×»ïSdê'Ö·x.Ùœœ—2ƒ…©ùV,,¼m&¦Š€bLN[Ú÷0“)DGHT_xÕL[†:nam£êLû‰­švý}êU0«Z¶\Á˪>ðUª&ÖsŠõá9{a`¨ìÿ¤Ô׿‚¾ü1²O"õ~À)Ã’*’,üb¹ð#({5îçì…â”~÷“ `äÂ/¥Â›~6–Òæ Œ\x‘Í’-? ‹Á‚‘ ¿ƒÞŠn°`äÂO’-ìŸaÁ]·Í²ùª®Çã‘,¹ð}æ÷ø¯°àl¾Ööz?æËÔ`Á`á»è£|ç7bÁ? \0ämä‚ÁÂË5!¾Ð¾K×ìkVц`!RÛáO­Âó“¾ÒïÃÂ$Tlx–.• ,°oÍ™î¾ÎÖqë^sVe  ÏjBîAúíbûBŠ¸ž¹˜]ê,½/…-|Æäì¾cÂ?V߆…œ"©ÒAˆ B‰[0$l¼žS2Q„™‡Á­•'D‰Š\DÇ  ž¢P”yÇFéEQ‡ï)”]û"ÍfÄmêËþ,'Œ{õó}õ°·aAr5¥£\ ŽäI/‰Y/ Ù®<,h/D¢´’\ŽØ¶Í\Q6  ÏõKäFe3õ×í½IÙ Bå€!ܧÛãY#ë[Î*³£,T”,ËJQïBYð_ kõ|¢ ~zïÏ`á¯ËÕ +ƒ {,FáËP+]sÿYV,^¹æÚƒ\°(95¤^·`!‘‡1`ÿÄQùË ­ªTS¤KPY‘µ"0X0Xx + jïeòü’R!J™nt^[ èê`20&†å{ä‚êfª2­ °] #À1¤äbíE‚YålKý£Žç0Ji°`°ðƒ8˜Å+¢ÓžC5Y(ßYZ1Päð+XÞ‰…@Pg;ÀÂ(g5† ¡ÔÜäBæ(Þ眗eL¹°êHM]¼D*üÜÆf¢ƒŒ„KÕF²Š,›ÅòÓ`ì'«,,,ÔŠœ!û‰ª}c¥†&«+±˜Ù$½åûä‚My‚óȨ€`KÿÅz‚ŽÞw¦Ây`,PÁ¨`ó¯`¦¿g/ ë´Îƒ8/—~wðEƒko˜3ún.Ê^™{rß%TægÊp¤- ©+U=æ@b†8a¡ñe~žôFOŸª‘ Ï‘ê!Íæ ú~m¤‚ §.ç^àŸ~ˆ}ÄÙ!ú&,,³*Pf‡A^¹Èà=IUÔl*Ycfªº6Ç.Ù1_ Œ\ø'ô>,"ùdä‚¡‡UàÉ`Áȃ…¥ƒ#þ?T¿ ‹mqƒ# þ¹`È`ÁÈCOÑü(ú}ãiMéøi¶ãñÍS8_ªç   ½ ó•¦(Íç… +/oísÏ2²e°`°ðÓ±à„—Bý ±0ѵÑ,,üp,h-f­«LyÌ k7jlg½USÎR¶²õÇNù¢±p<…Sm}­I ÀØ€ýè°÷P–Q{ÛŽw"j\”±ŒºM&ÄâŽìt€J ô/œ‚Ý¡sY-ª1º²Uq€§ƒ_üv,”f¯íµÔi(<²‰©°`³je'þ×vÕñ’°(—[—óˆr…°wa¨úJƒ½`¯§DË@sŠ p5–à©YÎüG±mä‚¡=µ¥ÂÂ#-¤ðÈ„°€-a!Píª… °fu9Ïéà T`8@Q¢Oé ì OͲ…Ï.¿ Æ^x1 ;¹€ìíÑÎúA•©†ÞÑœ2–PŸŽŠÎ *é÷&]t3ŸÏ±ÀýçVX²C#‚{ >©"£ÜË…Û¢R-0Vbƒsæ•Å ­ZÍ«gë#`¸ÖÇÚèH†> ï1'’ÆB´Ét!%¹ÀsØ:@éæǟЙ„-®)šÐÏ +ßá'8e´èÀ# +ЫZeŒ<§÷‰g;Dÿ¨7rá ®$)u9ì(†¥Þ¡zÙÄ®ín* XèŽÂȱ´1j² ª*~³îP¯s†m«»t…npžÓúFÑ]2y;ùlf¨'Ò_?mF.¼G0<¨“`+raÁT“ê)šõ »œ£É‘ Þ::žˆ5Q¯NSý±™:¥Egê²oŒNQSëjb ´=˜ßX¿ÖŒ\x¥âu¬Ó‰§'è 3'ÙÎfáõ½n[* þ`fÄÈ…_@ñðìM^a^ãcX0/á—3«‘ † } Æ^0dÈÈC†Œ\0dÈÈC†Œ\0dÈÈC†Œ\0dÈÈC†  2X0dÈ`Á¡†…ª7dèGÑÄÿÚ õöUÄ?‡…úBAÚ í÷N|µk°ðu,d߀…"Ö|_ul7ýÔNSß8›¨8WGž’ õ5{aåîù”y¤qG+qš¦ïû¦qbw®ý9,Xñ9YÖQû¶¾B} ƒ0XøÙX(¬<íM»Ì¶¶Ø‹äpûÔOýñÀÝvÏ›X:éŒÐ(¦¯]kï8â­c­¸š>…ºîÏ|«Œ±¬j"Ë­¿A2Ð+1XøÑX` +õŸ»f²H«®ý"¹PÏW äv•L§KF¥TÙçwª4Jïâñ Ó-¿Á*~¬Â`á/c!ÒlU_Û/ˆôÊ\·¯’ íu‹ÅÑì¸?¥˜ëK ®º·;ßúí&nK‘fÖw· þ0&Å„n|ÕóÍý³•¾Q.гjulׯÉ!~w£æ>ÔJÇB}[£j•Öå& ? Óû±ÀÕ[»·xT1ä¼÷8¾A.ËèLëY!wý4ˆWòäÂj]?ªs,üF,4šÕonÂ1 –9{¯\XZ²MvT¤¸Ü™º…›ð‡±pG.,½~ÊÔ`á¯b!ÓºA|›¯[¥Kïé=rA]u>î1ô¨žy–ö/§V£ÈÆÂ=¹é»÷  ŽÖºïùOÔÆÀn}~\ÐjÊQkÆ «ý„{çúá•üc¹°>åu•‹3V¤iš±ûœÌñ¨âÆAaNÎÐÑx‘þ–`Ÿ„½ŽwÃW±®Ç±>*#ï‘ ë9щúv[.0kÄ­è¹z ww#¢›XÈ&;±fKmÖEý­Éz·îè &=aÖ¬ªª”–ÚªˆÎ/RôŽ¥î4ÕFOé,üÙÞÂiÿŠ·baÕ’ïòS;cé.¬úMr¡O]9¤#ÝÆ)·#Çnú–=Œ…»rAù¥.±:…É*kƒø’kÚ‰`ø +Ð÷üÂ(ÛE›œ›¤ÑìêиÜT—ŽZ¿ð4†ÁÔ%ì¤ ï• ŠÜûQi¼MÙÍþír¡˜ëÎx˜>– \N§LšÙñ<º¡»Éù…Šèì0àÖø¸C،Ǹ'ŠÂ:¹Í”Ì'‘¸5 ©áçÞ>8 ^x³îÐÏõ˜ü5,¼U.ðä|Ho’ δ»÷~ÎåB«VåÓáñd¼/Ža[§Š[j]FÓŸ°‰·ÇÓî|Ûu¯œÛœc^xZu›?†ñV¹ Ãzž>‹…wÈÍú;-E³±×`áž\P@<óJ9[˜”;"¹[ˆì¼_£Š-< +9†nOr¡ÞÉ…Ý‹™ôúkhTm_¼×âö +VöÇ°ð^I/ð™Ÿo— Ú/´[2W; Í{‹\л(§¾e0ŽÚd9ñ<_ ákØÔƒÓàaëf½FL3kÛcúg{ÈI{¬1£ON,×½Œ_×rvÇk…7Z ^ˆµuði%ä=rA™Ê'Ë3Ut§)žÅÂm¹P$õå–ã~M…ÖÞyÖ긩ýn¸¶ùã-mšöìî7Y–eLûT‹ iÓžô–½ú&0¥•…Ú¹™IÀ%†ÖV ïÕ‘š7Ú¾O.l+ó^TÄã1í̵»eÏ`á¦\˜V%g¯ú0mMŸ¹´š²_׬ÕB®={%gû kôa\]¾¼zÇík¤ ‹†Èz‡ý5,¼W.œ{nþ¡\àѵ`Ô÷œ±¶œ¾à¯ÅOm‘Ö'ã]cBÒk×ÚS]ç³Í®aAu¦úë(úÝ%5\Îzþ¯ØmûArA{nœOcáÕrMkÖÛÙïErâe«Ô%»ÿ¬|Pü[;§yD¦ÉE«vZ ¿äÓ‹ ‡ê,ž–¬šËû·F‹ßÂ’…õ|¾XÐ÷»lŠ ®ó»B8~\ˆÜ/í¿V.ðl²ã•ã/…¼9÷Wâ~–nbŸÆ•üÒ}‚éÙw‚÷½¦?ÒÅŽ?:tù20'ÏJ¢ììû{Kz–¸êHÖ/kMóƒäBtɱo– 3Á{ÂZx¸¯»–¸¢®Î|áåÇ׸ú4ÎêœnpI†N£ñ`ßx¶ãÓS8í%ÆÓfJÙãŸ`éåŸÝRê¶_Ö­–dù“XÀ÷تCt<Úç±ðD å©ßˆŠQ|à3¯"kv/ðàÎQñY,Ü®TÇçÆËÚÞŽ®®9Å‚²?Ž¿Ä‚²H®UÂQ»GÓ{Ý{qþ&š |)ñ¿Ö›åÂçu¤wÔGº–p½Ý±êÑkïž.åãÜðç±€Õ2cûõìΰ°:À’ö³XpÜ›¶j¹Ùx• ýßÄBV®m|Dÿã°ðL}¤›ãGŠ#EXöX!µÕ|Â;ßQȻͶ-ÚCL¯F\_Ç‚z7ö““üÖ{°ù XHV±0½ ö#aªïµÐb€«YΣ~!žÚ1FÇ—ÚãÙâ'¦è~ß.£Ê"Õnü@ ,ç`>4NlÕ«öXYy·#¨áÀ‚r¹±}TbÉ*V1ñW±° + óûüH½2Þ>›wøTmaçdÊ ~j?·Æ ¬¦K­ì’ZóÅ?›ƒþê^[‹_Ì÷”3^5vűE{ß›lÛ?}–Œ'vølENÏ>Ä‚ŽÊ«Çkt6«±ð¿Š…V|ªéç°~-‰+,ÌÙW°ð¢|¬Ì©O£äªÙ=ó˜Öî\Ü” ê +0ÔÇèê‹Û4ɬ¼]õ¼š^D’oÕ6ïèZçñSXè?,x¼¡wÅÂòW±°äˆoyÖ8ÕOF½éíÒ{AÃ:úSù Ÿ$]`reê ++mh½ƒÑêè‹ñÆŠÛXã%—ŸÛ t๓ µ¥Sqs…æc,¬Ž#ƒ… +]IÉ;±?ÄŸ¼=u´hKî„"÷íXàkvAº“q§¬d} 0*¯¾Qáß´ ¡ÜML4îµ+ôT”Mdí ‚¸©À‚;Þ¦ƒÁÂJó+HËíÏ6ÛÚzŽOúà|ÈÖ*aî4ªá“Xcµjû掑Ÿl^• ÅraST®ÁޒȨ¿EIßübḲTM| +wŸÿvCGªû69©Áºr¼poá*´*ócÒ‘¬cEvUÒáNš˜N˜;a¾ObÁã·v÷`Úï7c+÷¢ÕX(Ö²+«ê-[ ¤AÓnN)ÅÔ×·pd¿‘¾K“º‚…úÑTMƒ…eñ½å­XèÇ2Š×€äže|frj,´_Ç‚Cùòw÷‹yçΚKÚœ9wb¶+­[¹ñÙ¬hÌÏ[Ãéx¤[“˜‚¶´Eüíö?.° rFƒ…íß‹m<ßßÛ×…óÆ~g¶~ NR]¢zB.|¼÷¡Ø¹—×ÖÔõµ2šÕÕ4›#îyѲƉµ»éÈûX(î×È4Xx+]ÖͳÝóÈ£‹ì7U›ûŸ*×ùéÚùI,¬%"ù=,¸ŸÂ¼6{Õ’Ò+¦ÔS4~äE;^u—×p¹ïüøšÁÂ7`A'ÞSEt®ãþ'}{®¹¢{} ºŽö½ãu”¿ý(n8|ÝON´ëSMÆBö›‡ƒ7ïç;÷:Ÿ% ÷ä–•²ù¨XÕ8‘uÅâRªÔñž—XhÆ›íTx'Øž,|ÖBÛ7« 7«Þ|±ÆßïŠIÏÊ ­Ö¸o†¢¦‡‚<$¶\ë}¡(]ÀÒ¾©R­Xh)4ã + U™ðù +ו^ƒ'•KJŒ\øF,l nô°ìëúJ—ÀÆïT Hçs»ñ+XXóo—º,ÑCçÔÁ8bÊŽÌx#„W?ÜQ.X7HsV{ª/–çVí…µæso°ðXH畯³ÛP8Ÿ/-Mê«ò½Ð.û±_žÁÂÚ=«¾á×Âç¡VžökÏûµiÓ=¹e\Õ|eJ_>Wt–æÐ\nKèRã…PqÎ\ ß‚…µ$Ö×­²Ä|ÒºhâújðÚW°p¬ +äZö>¬›Mq½F5?TàÃzªl}tf²imU3êó\äSPÕaWI³_!ªUájøå„ìXß`á›°°YƒX«1š +†]À‹iK8«¡uêò«c»iÛªm;Ú’Î.ÿbóú#ç¹sìôm›¦Õ„ÍÉ×»<˜üqm{<»`¿vÞAÕ§©Ïê¾Úë‘G¹ÊúK—Ķy×ôÝžX pµc_]šh è™f·b/éJt ªÐÊÙ³'1ž¨·ècû*óÔ»‚Ek£Ž]Œ&{ °Bº'e‘Ô¥ÝãLÕþ¸Îö…ù¼*Q©S\*›ê–Õ£eÆNkãu8tª­öZ x¿ ¬;)µ•ša뫇U¨A¤÷ѼªŸ ÿcXÈËiéîfWL¡W¶oÄBíj5Rpr½‹<¶®®½Ü¶Ü“”å}øþµT±/ÅlOñ¾RØYU#w~´šÍ}yú5.iu¨M›„ƒÕóÚ‹À³ªÛÔn×½]ß„»²±{m|ѸÅÏO΢cÍùúx l=Ÿ- žœË¿“â!òX@Á|­éÍMr³AY4Ö7Š»\Û­øZþ‹Ü)/Ÿ©ö@¿¶ÕO|N­ÁFÈ˽Œx9|Ñørh U¯t•ÆªÞ‚êMV»ºÿu‰Óá~+ s×wçÀú]¯»õå¼6Þ'”ýurëS­û‘ WB1Òx}!.ÙDº˜ŽƒŠNÆoCÄ-càeö?o¬Z7ø9y ØšÓÝ[_ô^ùíra +„ç•°Ëx9È@Hoeé…2€ÙhD9À§"ÒO i#Cœ‡²L߃˜“tjì(¶, íg ‚~¬ÃTpNÇꜨéoÖ´¨Z¢¯”2àYÕë‘a Nú¹Ë¤Þzºï¿cj€íTíž®o°†~kt>ì4|^žC/"Žá5\¯ ÃÚ¦¡êgC¡r•úÜ«UÄéåMéoÅ‚']X‹ŽXM–fÂ-Ô„ßO±,ÌpÔ‘,‰1ËÃò.,¬³Ê€>綢SsɸKö顽à¶üñ›~æØk/‘ÿ¶ª/a!ôÆÂH«~"I?òý¥A¤,ímgKöˆ þÝX0dè{±àó“í¬ä®÷¹ò|ÈKŒŸœû‘Š2_x. †~UùhØ°àÒ_žzž×œˆÎ±°t"k„m°`è—a¡‘þ©\@,truZ[£º˜•ì°È(÷ƒC¿ ¬¤z/Á "…€ \zÒ™0G,LÒósƒC¿ °òvs'X`¾˜mÇà +aƒ˜LJ_@oêõ^[ ed°`è×aa±})ýP¨x$WÕÓnC¬2ïòEUSõÁ:è}°²CÑÒ©Ïõo3X0ô3±°Ž±‚/¬`ô/Qå¬ImdÓwY_-í`ÙO–”4X0ôC±ði¢m7ƒC ƒ/»Å`ÁÁÂÒ•OBÁ`ÁÐoÑ‘žîÐc°`è·Ø  †   ýf,pf°`È`µÿü`°`È`aÁH»Ü`ÁÁP¬±UÌ`ÁÐ_ÆB.¤ÙÒ‡B–f°`èïbaöe™sæË0‡™Á‚¡?®#嘧ƺo2  ýX,°’= ,úÛX(T´÷}f°`èOc!UÕŽxésƒC ºÄK+ÃÅ`ÁПÅB‚IjâÎáÙăCÿg,ØR ¼(E‡Ò¯  ý],ðK¦FAYúC»,ü_(³¦¥lmàõŽÃn÷Ë’:‘žFf;ÅÂœ•¶Úô¯«ÛFÕ’F·ÚUsÖÍ{EwJ©´ö‹íÖ+Ìãæ jЮúmõd ^@ƒHO +5¡¬”¢]2áam+©=ã–î©„Ô´úË3ïeKÞAÎ`o^/‘u)Îô­Þõ4Ö›×ÅKßUâ]¹^.ÚK,|;,ß-µ#{¡AT”øÎ¥}RáXÃuªEU¯.… ¼ám éÁùå*<¸JŠ`J#êatY)„—K-m)=¸ð¦¢ù¤cIß(}”˜ÀBØðÃT9˜@‚ÅÀ ~ƒåLR?”êD\þQ.X Nt#ëXÙΞ¢U!ˆáŒŠ:ÐØÀGä`CF´Ó:#o9k¿CVbTNv·‡›i)àaü%ÊÜŸšÚ #˜"àxÝí…ÊXŽEJ‰-‘=eUYÁ •lk—¿²±â;dW£4¦1ù²-²üX`tpãÝ› Ó¬$æ +áýx>©q¬ðWQ ‘Âk’Ç\m9žY”}ˆÄ«¦¹ÚgÌ`áûÍ…P½Èö€ÌËN.Ì‹è *ëÄdoŠ<9x\ô`¨ž,Ù¾Š‰Ýöñ™¬¶I~øÈÂA¥,tĦކ…‘¾é{©… m/„’·„¸îA+v Þ'õ­&`j^–œ´z@ꀰbA©€ñPrÂÐÞŒÒcØBîˆ ¶ž­ÕúöpI`}¡ì‹zM1_¦Lè°;G6§X°Hbˆò†;`q<,Ñ&„åû´-I3sƒ…·+õ"û +Ø£>ÛÉ…šZêùá‚XhA˜ˆØÞÔN–|ºS˜Ú>(í0Ï'vk2€úê!¿Ây`§¯Õ+3b!<Ö]‡0(•\@È f«DV†p²C\v‹’hÓ°ñ—Q¨\ùTà+maW;¹pP†ïÈA +¼˜-Qä øÀ_¦Ü @]*t­à0iÛyP'dÃÖpì‰Ð¿Ã‚+kžÇPÊëÝëC|7‘,ã¦éÄzòŽúð¤s[¹ð X hÀœÓ^.¸T1½Œ–«ö‚ö#…²‘);ú¸eU¦†|¯z ¾¸:®ðÁhÉÅ&DÆÐS@›“KëûÙ&âýçXHPè KÌ—AžôLÙ ºÉ`†ƒÊd… d8êÔãƒhjà V”ýU=„-ƒ…·ÓHúbV½ì 1uN"¹ ”ž ÿ´ëÄÓ&‚¥¶§RÉ€¼œðÉ-…­½9H0±–3H¥cˆ. Yr<…±ùTé%#HƒI”±Š ȸMG>ÕNŒ©ÇÓ*âE©xˆà|ÙÉ… ð$j«DYÖ Â‡»‹£{(ûäG*-K´)I'w~¤ +G,»hÛv‚wX…Çl~t…ñ(€Ë7¹àùË%8g6ºª"ÄóV9˜¢…"„9<Ÿ¬Jij>P‰¾ç¾àh;·Sã°ŒŽô-¤:êQ—í„Ô P`e婾šPMA,¬Ž$1mkZÏ•JV9ˆ ÿHÚwiÓ­va‡_E5¬Ó^‰<€;l8Å£½6KÕ×bxœŸª.N¥}(S!¢ ‡PK¦ S”9xqG$öªœ´sGÙÎÈQ)e—„†»kpîÀÕ÷¾S"B4JP$$%Þu:jó¹Œa˜C²² æR8b€Î¬þ,É jD~á—%\ÀÏ´/«ž C1(Ý-Æ’9B•l†CX8Ðu ÝêJ3XøJ‰“±›’n¥„“xSÅ·?Õ/¹Ìñ?«©—5`hóUó*ÒZo¢†¤–n~òÖq2¸&G=†¥’¦QƒWcpSÇN‘|Âéx–rìãÔrÕlj5*tV Ö‘èës5¨‚NU#d¶Í蹊LŸK·Z2Ûñ×Ýb«NQøcôè«›ÁãE©º$¯0R—^WOŒ5êF™v©&X( o,´ÞF¦÷A’Z=ù‘tÙÕÖòJ˜ts@¤LH„ו,|u7Ü~ϲA¹A Õ*>aÁú‡ŽXx‘ÍU¦Ëu{nh^ j%&×Y¹Ø®¶DPÕªÊÁ7©=|] ßµÛöL†¶”Z ÊÆBùS°ð¢ÂEó‘ ¯`A×ÁPþ9ôW•ð¢P.$«,8€E¯>;s6ÐÅ”ŽDÒ&(¹ÁÂwQ_>ÑW˜å X;ñŒÄ™‡ qhÿK, ñk®åË,€Ö£ZÖú°Ä÷Äú-É…ªTÌÎ̸©‰ؤ°àíŒ× Ò ßÆOÕïaýõñÝpÜw>b! Ê.Épw,}+îÐGçÉÐZ°†Ü£0Ŧôç$„O d/ÀA‡­†Az±Á‚¡ÿmñHû‘=¹¿&횢úª‘@¥¨E›ôI:Ø赚‘ííEÅ#MbÀ†é ‰î Ë,ú‘X`é^\²fMåÎì¨W¯&%7’£ÿ¦ŸÐ¹–‘‹ Ýbh/غNÕ¤ †þ—XxMâSöŒÁ‚¡_‹…V,2X ›Û³?‡…$K ú!”Eÿ2ÇÓ¡Eeñ°Ðù† ý( +ÿÙ~ 7*ª¡ÿõiz3ŒkèRZܯϙy'†þ¨\ˆOJÏz¾‘ †þq¾°4[?Û—:ŸÃS¡Á:Ñ(2óÒ ýJêLŸÃ:µoûòPöR„v'd/ [ wËâ:iì,)zóÖ ýFòdéž îÒ÷çVFX.Ç÷¼RÆKW +ÏÂr™CNå›QakÞš¡ß‰ŒÙ¨ÖF˜ö", fDå5°V@/ªÞYr8&2¯ÌЯÅ•¬¤zh¨)õ((—Ÿ²9 X.&˨œÌ +óÊ ýZ,¨\¶@×CC¹bz‚ªµ€¥-‰ÅTÖÜJãb5ô[)¤âaX0§’ ¢Þ°@¥1Ãa¼¼¹P«¡ß+P¸”³™¬ö‚œ÷XˆTW°>f †~5¼EU#ÜË… ¨MØÍdáØ"l(Í3ô{± †˜š® Ê^(ÜÕve€egEgùhZ{ÁÐoÆÂè!•Sp-«€u˜ÆŸå€¢,,Nƒ…•\£#ú½X0 —† ,2d°`ÈÐý³endstream +endobj +5727 0 obj << +/Length 107 +/Filter /FlateDecode +>> +stream +xÚ`Ÿÿ£££ÊÊÊùùù•••fff:::GGGýýýVVV»»»¬¬¬³³³ìììõõõ}}}ððð&&&éé阘˜ÑÑÑää䃃ƒÙÙÙ‹‹‹rrr’’’ÞÞÞ™™™ÿÿÿ¹¡<Žendstream +endobj +5723 0 obj << +/D [5721 0 R /XYZ 85.039 781.388 null] >> endobj -2604 0 obj << -/D [2601 0 R /XYZ 85.039 594.146 null] +5724 0 obj << +/D [5721 0 R /XYZ 85.039 728.299 null] >> endobj -530 0 obj << -/D [2601 0 R /XYZ 85.039 184.842 null] +5725 0 obj << +/D [5721 0 R /XYZ 85.039 728.299 null] >> endobj -2605 0 obj << -/D [2601 0 R /XYZ 85.039 138.111 null] +5726 0 obj << +/D [5721 0 R /XYZ 230.943 101.64 null] >> endobj -2600 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R /F20 1617 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +5720 0 obj << +/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> +/XObject << /Im13 5259 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -2608 0 obj << -/Length 3479 +5730 0 obj << +/Length 515 /Filter /FlateDecode >> stream -xÚ¥ZYoä6~÷¯0æeºiY©k}H&“ìd³vvÆAÈæîË´%GRÇñþú­‹å–ìÁÀ#Åb‘,V}UluÃ?u^¤Q¬Ëó¼P‘.ŠóõÝY|¾‡žïΔPÀ_eÊ`ß××gßfɹŠ£2.ϯwDs½ùeñþ_ýxýáÓr¥µ^(-Wy^,~ºüønúñÃR->ýëãçÏðýxuÉ­_/WP»þ̵¯.¿áÂÏ/¿¹Z&Åâgé¹¼Še’/Þ¿ÿ€L¤ëýÕåõ'l¾‚¶–¿^­”ŽRS’d?|ü @ûÙ‡ë`Q+UD±JpU¿ýòk|¾•Gº,ΠGª,ÏïÎLŠ¼´ÔgŸÏþíÙpŸ9çQ›·2*4ìØJÇQQ ›¨Ò‰M¼ªa kÜ“íG.,ŽÝ[®­Õ7çK‡«ºø6ÍVeq!üÞ\ýó ÓŒ¦ÓYTê\húF¦º¿‡É\ëo—"D¶¸_®`{·í]Õ¡]Õ ˜w~¶w(ËHzgï;ÇAÖ°¯~GŠmÍUáÆëQ‹ØJ™8ÊR3:¸“ù´)UÌPhmrÜü¸ý¹Ø#Ëæˆ+¹x@¥h°á°a²öâáâ.ömEËÝ2Wß¿ƒZ/l-Ü.¨EÍ ÕGqeÜnéóe<yr·EÙ÷Äc3¡œOvã U‡KÆõ¦åb‡ j±\ÐjáóßXºíÞV@Qw=×½P¾bÕ Y!s¨jþ -õ“»‘$ ê ±IÅN«±½Ý Á§ïžÑažh}lQ®ë‘%¸³Ý—§Sei”æ'®Ž&Îñó7æÞâ¶YÚ·m¿mÁ\|Uû‰A7I’ŽMÇq”*Q´”oî‚¥­I¤«í–k|†Ø]ï·¨© ÉÍÂ:J<æFxt[)ôØÈÅ·PTo¹L'æ˜U¢ÛÐþt1O¦88eÜ-å$áÖbcSo'o¹ Úò*Õ‹ˆ\v;ó¡ëä:à%ÄéìLFaxub³øÉÞ¢“2ƒïyuIY8á°„KÊ|PRU93ìeÁž/Lÿ´†§ò(S¸UਾÝÚ^îõÚŽ;,W;ÞYnkvNHVæp»ƒtºx°2-ûœJ,o6²ª®‹½¬AN /¸œÒÙ]ظÌ -'2#s§4Ú,ÈÌߢî½ã>¶LP “¸e*¿¬°¶ ›Û¦Öhüˆ¬‚™’ÀN:)þŽnëÅÊ$‘J“ÑÞ|„Í4@‰ë†B1Øã”ì`r®«êQg™Œ. -‚Ð{'ãÔ»<`à(üqØÉžÆõ¬ý¾LAG©ÚÎÍxbðÐ÷”Ùù*Ë£Üd¯5xë–$µ"³I¦M] -Ì‹bÚÔ­=D%ØZ±J¯5yF«Åõ²Ð ºwIp¢PÕ¬ýZôK}Ãß;ü xp»G?– rI­§ºo'½+Òß/‚ tÞm#¦‰‚F‰Üï» Ã4¸*Rcg A‘Ÿ,=ÐåàÒÄyžÏ°ËíÈ8ÏCà‚U¯çl‘اóÄy1¸Õ¼8õ 0úy7;òá9#øUx¢—Ýâ•çùhÎÁ•çÁÕB*gòó|J³acQ¹MþZ¥ÞÑÑ:(ªu6mª±#P¢“ù–sÞ=TüzïnRxw[£Ñ±cÖ©³V„ 醻BZ#­–ïqÇgÙÔŽ²ÏC°Ì¢4KžÑZ±žoÉ壭­:‹½›PgQe±àF ßz䄯÷zH'FñTçÓ?á³uúR°‹Œ¨sç<Š•(f t8•:4hÚÃuäÆýˆ`A%]æ±Q• ÈÉŠ#½ Ä̹lôñ¼_^I<€—ú€,F8_ŸFø¿ÞsÏÌš Y8:>þx ‡äï‚×CÀÄ­u®û@X€·EÚ&µê†-­¨XS#¶œµx虓Ìx€ŠåA%tÎFo‚“,õgÉr‘C’ª›`L^&øA½¢\ÿ,øõ(-Væ˜ KT – {j ÿ‹ §[;s-ª&Í$cCú¸9¢H¢¼LþŒ‡í½/¼×’n\C¨m¹5qŠ7;Ÿºrϯx@xtnfÛ’7ǃ¿ ÅkZ -”‡ý4âG¤èœ›ÀÏl|ñPÁ´¤¢õàœývw¯û±”ç5~_®D aÝÜ ¸& fæ\˜É¯Q‰Âõ —ûKƒirÒܳ6`Ž žÉN.I'Ì[é·÷þºyãfÄÕI Ýjœ9¶ïíö·ã°«¼aÐFZÙÒ¦Ý °ú‹ñ-ú†¦åüŽåéUËË'¬Õ>Jþ‡äD+ÔjžËö (ä½¼ãî!¹”£MRã´ÎöA†‰M¾é/nu3த±¸©A‰~—Ð -GKeÎQ 2g&´Ú:4l6îq#3Äì2-G¤§v[ݶõ´_8`^ “œu1“CìXÝí†)С£fT­— •Ñëœ^J 4‡kqE£³%+ùèœÏ”œ{kgÈãíÖº°ÅW*¼Zþâ>5:;ù—®8XìÊ[·é&ŸqÚÐl8ÔfÌŒAð7ŒÙlw·äÐs½êF9DI6§ ÁÁýaÏØýa?á3“ƒà»¾©*}2$&ž–Hãl–ñ“[†òÏhÔ´F$sjGóN -[8˜÷»ˆbÝøq¸‹§ZZyô#öÌ™ùA Ñ>Ö\´?ôÛî9HýÞÜP­ŸøÿIŸ[4WTHÇ '·u(™ õÈ{ÊÓ4í–ïyS?Ôå(+ µÝøд¦(¤SKq©Îyf œ3^»“"áh¾–?Á’¤¥»µþ¾ãôÀÃ-åλ€MדŸ NJd"’nÏíìt\%H ßðŒªègárÅt2Z¦$…⓪žÐ¾`ófË\¨…X[g( ©#W(µ}q is–÷üµÒçwkâÄ35`ÂŽ{‚äLÇ.·ãèž)€bÝðÜms`ÙeÃE›²{t»ÎÓ S»\ͪÆX-“" (ã…kÞRª–[‚ Ÿ”⟙ jL'8 ʆ—(eÇ1œZ¼í¹O»ð<ºô~£ì’üîôUÒø6²%ÀLl?@!”€§cKãl2«E7Þâšh²1æ0:‡ûnk)²2:[Øe¾°(!Xïb\$|v{Àyp,{µw"WQ‘™t#Tž„?¼áöþ7-øÊìÏkL’Ï<ˆ­|žFy‘Íüx׿Eý…Ÿ¹š”:ýs[yñTP¡=šýߎendstream +xÚ¥SMoÛ0 ½ûWèḧ¢>wK?Ò¥À²4qOmAššeM3ìï²;³½] +†¤÷H>RO($(¼IA8@Þ‹õ.‘â•‘›kF^Sò3ÎE‘Œ&V ”dÅK›Ç€6$Šç‡ôòëx^\/²œˆR åÎùôò~žaº¬Nç‹é¬˜ÎnâNó!¦÷ó_džÒ¢"Mg-<þv1®v2{*n“ë¢QÚh`U!Ê|Ož¤xæ–n ¼øÍk Èð.a`4Õû·d™Ü5©*L‹*jh*'FŽFƒ ¶_ÏW×£N=êÕ“œ‡EÓP)¥xîèx}öôœX9¹Á”¢Å»h ÈJ¡‹ppªzÛâPÇlWÅ.ÆÏ=²hz†UÃ50†~ò!7ÞÕžþq5F)PI¨«lèÎÏÃó«Hg‚ÿ'½endstream endobj -2607 0 obj << +5729 0 obj << /Type /Page -/Contents 2608 0 R -/Resources 2606 0 R +/Contents 5730 0 R +/Resources 5728 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2577 0 R -/Annots [ 2610 0 R 2611 0 R 2612 0 R 2613 0 R ] +/Parent 5694 0 R >> endobj -2610 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [342.345 720.288 409.913 731.978] -/Subtype/Link/A<> +5270 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 369 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5735 0 R] +/Length 24902 +/Filter /FlateDecode +>> +stream +xÚì]‡b«: e˜a¦3Ãÿÿå•l d6IÉêÅ}ﶥ Öñ‘dI†©…ÂbûûÿýŸÎP2¹µ­ýÇï±PJjv[ÛÚÚ8_òB2x[ÛÚÙŒ˜`!7v[ÛÚÙÈnÃÂÖ¶¦°ÐoXØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ>üO{ßßÆsk¯åß'ÄóbýÏôÇví*Ç'øÛòIìÅ1ü£zä߇ ÿáoí¿æ?Ž{+¨:[[VOâs"Ó[ØúË:=A9h=~õ»Ø#äò#x¾e9™êÝU{t©Yg›º3Ü8&/¡´M¿¼¾lI’ äá·Î®N•DI×vmköFÙ·l<¡Kœé³ÄQ9úR­mÛȺ$”žŸ:4ö¨ÜÝŒ†Ø´»3÷m§—Ö Ð@6,|/øį’ÜîÌeëìúh0ã,Wl­ £L¬T†{,4æùÖ¨§iœ“o²+Ó¼=ú€ç%¹Q‚cÛ6Í+7ÎSÛ‰Ÿ+ª~æý††¯âB,;mÏÈŒ–$>”°ò',ù RóJë’´ìÉ 8ƒäì§Ú4ëã_caÂzä“g"¡¯ÒÆÚ°ðM¼@‚ö¢ÜØvDÎc\â… ÎX€–Ø!9‚By¥G%Y Ã6xK§K7,|/ÄVn¨`:/&âÜñîáß:á…0ýQ(sç@&Éx—éÏÝö–8ñ:X€ÇHú'6<Æ…¯â0mÛY2l´‹¡uvbÏàXÊé ¼^Ò‘Ðþ]4{!¬]²d†8œþAcþo÷=j‡ÜŽ…£»êÖîYÆz +à5àí7,|/Äa2Nº]šGè %„ô½åtéÝ ò”ņÑa°aá‹x¬æn²“+?Þ/F/J“iNxÁƒ*—1ÙYU2)CI8ß„´Éd'ô`;õ¨‹oÆB‡à>l±·«òéƹó bÂÐë(tpÔåø±iúº†çË· \ü0(Êßåê3QL¢4QQyZ’M¢ŸÊ ÞszÅ«èe4·³ ŸhúñH—±pð÷É^Èͳ3?©º2rœ ßý ½^Z±—:’÷í´®²Q4­øÐû$GÁŒyÚíÆçó£?2`± ~lµ©}xñöÀ›­µÀÌŽŠ/Ý#ÓŸÜoÇ~ãö)&QöI–Ÿ¬¼c,´å2{£í7‰~&/L‹ vrÇœó?Ò®=ôóϱ|mÚYýÃ^”Ÿ°@¦E¾ÅTG£¨‚šž€Y}·Dœ)ÔýTÙÓ絛žcxãgÕŸljÁŸL#³SÁXpù)ðj2aa©IÞÚóxaôߘÞ#XXk}a‚äÞ±KÌdÖZ»²ÈCpø q?º‹Û,^@a\oË(t EU6Éä¼ 1­@Ú ºœÀ‰"süœ­–ÊIX–Õh¥ð#|i¸Úºq•ÍãDe¢?ÙíÒ')Õ‰|išØYZmæÂsyaœÞÒð)¼p«½`˜ÇôÉÞøìl†Òé½{«`\Á‚Šó ¦{,ìÚi%:)‰7…ñ‘`TÛÛvìÀì÷ +°dˆ>i:¤]R$Ž½i}¡÷p…@Ca"<°–Çë{}9…¹LÉdÒ+nHª02|¶LÑçòB<CUyá®x$2…-}¨di6ªÉ1o#ËÚy÷ðçí“Þ²æé¾ÍgT“qM;9ÐHbkÔ¥:‹,“/æjß«’åÚùÙug¿30’EMß3GM—Ûc¡K*txÄܼHOæ…ÉsW˜ÀÊqª^ÍaØ䀲ì#ë2Áò̧wbÁÌíöàËÆ\¥ÙYd'Á"w\o8tøÇÑØýÈ#´íäÀJ´Í0ž‰G"ÙWxðIm£tÉ8»ì±;:HÌ7'Ò“yatw´w•jø]þB¼l0=‡öìË?Ì/‹­3®M°TóÌ"7’Ä…69I§ëÉ¥‹Ûúzúx‘o"‚ ¹öćN© â4‰/ñ‚ß·ÝA âÌ ÙÁzÊŒ…¤ÝØàU¼0baŸ8ðl?R«Âæ¯ M½sžu¿kûŒÛ2/Ã~­Ü €…Ü“ ÅìO»=6LÆ+%X8ä<ŠÙ±fè_âß²ÏGŽªY7*k3ž?»ñÂy,ØÉýIŽ¿Éw£æÖ-…rw¬@Å}˜¤g¼ýmÞÞ†Ÿ±€õe–WžÊ€{Êc·š§“&’ÉÌÃÜ}Ëêɾß)/ŒæÙreoú¤6HFgѼžx›¿Œ~‡…5ë`œÍÀ÷cßé€:NVxíÄŠ…ÎNóð8“Ä9)éž® ãrµ™Dþ2Ìô°Jë)/Lìr:Û1†NXÈÍ ¯·vO±n¯ælpV¸}[¡²tKúÙyH~ƒ…¹Zås÷º_'GÏÛÚ+çÖ µžðÂl59VpôeEºÈf§œ3‚Í\xùúBúœõ…3öÂaSÑ`TþuÏKË1A&Ûno_h…%:>¤Ÿg_Æš¤ÎÉòÑIL—nêÇž*Ñ­Œ‡4Ÿ1˜LbgöA ̼ ­>>Äó /LžÙd†æ¾5ùbcÄB—lq¯ã…yÝÙyQ<Ò‘Î’ee…‰27ø~ØaÈB²÷;áÇâ$=©6& ,j¨D1µ¹Ä.Œ°åùš±Uµm§ +|ªfóJ„ïwöa)J\ü#¯y!Î’K–ˬºY ^hÛm­ùu¼0Å#ýHÿ7Ô¾¼î¼(v4¦9rûR2Êr`§ær™úœQbá@¦ü9 ×Ï¥Wöå9sý€°’NÞ¨zù²Dÿ /ŒÎ¨«ÚâºmÔ×ñ‚oÑ7×Ó%ûÞ‹÷ÃWùrö&,„ç°ð“Ztáê^4­SG`ï‘¢%ù©ÛJ ~²W ‰_ž®~tiÎW<á…Ó@î Ä ½.Ù{}á9.S»²âiû"FHÿ„nÑÅü·Ì¹¼ï7Q±ÙýX@G×Ä Ç„HvÇ«Ýh1$Žò‚â§Msû¸n·sq}aÂBw²øJ6,¼‹vS^ÛÕà<ÏÎq}8Çt.Žz azd‘ÿ”×vÐÊÄB.ï[àé ¹5/ðBöæº| –G™Æ}»¨v¬’6 +H¡Å89xMêZ‚Ý|èíÝG›žð‚Ö‘Ú4¹Øì~ÛxaN첯xë‰^8ƒ•¦ä~Fƒ¢Ûkwñqš<±í®¹hЙNINlŸØÎvó@Ï›ô¬ì@KŠ'ý«KT_; šqJ??tgX’|Q¶;ïvÊ úe·öO*nXx /ŒrÝ^1ž'[ÙÏ™Y’K‚=­à™ä! d(»¾ê:-Z©ðÿÄY_ýî:|Òõ¢ ¦UB3I«1 B?ÃŒrÆ»EzËÉò}ˆáXøòÔ¤u»®ëɆ…Ïã…½ þb€ïÊõ”ûî“q¶ó®~ÀÞãë.,Ì˳ƒ4'§­eóÉ%™º’׆t§E¶gšL¬øÀ¸?ŒÍ_Ã"ö‚Ä»Ð.æ9ã˜æ<çŒ3rXcÃÂËyafv±@Ҕõ—¨‰ë/Ü“q°¨3s—½°›rÚ~*_ñ£ÿýZŽç¼ÙI·'†)D®56qówÞ“ZˆÞà]p¨0‘xÜÑ>íŸå…éòɹÈ+«G‡Ù°ð>^ØÅ£²Ð\ØõÉßµÇÅ…çºèìG&7úBðïó#MJÙŽwÆR~vöC¸Î5,Ìåp±pýžW%G,øV”ÙIs|{o4cFƒáLœêè:M]Ž# +Jþ†…·ñŒ¿}µ ª×žÃðSR&…aÏBù¸Æ u_µòÄç:ú‘Ê_`aG¢tNñ<ªš|² ?ÕÑÔXð­ã2l“œUî¦Ð‰3qªÙH¨Ç2ŽÁ~Êu–l~¤7ò‚ïO;œ/Š«)|'# Çãxì1Ä3¸öÁ¯÷ñÂŽL ÀöYWÕÌ?…ª^¯ƒ1]fïù™ÔÁKim|ól‰ËQÒî­s¼0ÕûÈeòñÚ]¼aá}¼0ÏyfÒZ'5n½É0—Í ¨‰s¼gƒOF鲎û½X°ò}šÂɾÏq`›·E×^ǾÖÆ´9Ö%,ÌÜ8jmcVô±ó`,ra³ÆˆsQ-|šDŽ‚±§ÏipÃÂ{xa¡8'öQpƨM[¹-Gov´yÕ/Ñ@â>š‚¢—–õXØW²“ÊZFVcìjôåçÙ/k “ÀžwM$‡ªœw8!Load"2b#?àÅi®ýHéñ:æ\Kæ iÊý$›½ðN^Àzˆs’´ôqiIÎy ×Ó’jrèfò&.1í¼´boÜ0¶²<9^~½ß^8¨c§]¸›ªy$0§¨»ýíUs)Ç~òævË;âwsÞ¸¤2ØØÏdòLªÛlpgXðÀÓÚÕä"cjÖœ¼)~56?Ò[yaék7»<7Œê-ÇLçê¹ÇVìžK`TS;‹œÀq* Ôœ?q`×ÞË ó†9zÝ+oKÇ kfíåòç]™¬!9Õ=š|Iñ¨üÙ¹3VòŠã`Q7•¶›ê‚wyfy$ƯØ5›â{+£­ª¬Ur>ïÕÛ6%ÖÆTìò£w¶aá]¼€EÜ÷!5-î¸ÜuvÚì“îíîØ¡CúEN’ãXépQýó@Rïå……Í>…Ç¥ÍÁÚ¤º}çË{TM!­ÖNÈÞ<*£0tB, ™ì3/& ÁŸÂ¾»4)«*Š@ØÇr»½Caoäi>–/Ž'ÓÃÌá“|M„>ÕÍÛ°ðz^Pµˆ–n]Û.ÃÍÒ“ +ʼ½’Wog‡Ÿ¸›”v”BÕ³ö…WŽ7}þ^5óŠO + §úJs æÅ\`)z§›TÏ^ Õ‰qQa¯^vöÁídQGiûx¹;O.fÉ—çr‘Ip1±¾ËÛ£uÛ°°ó£tÿe®sÜ’ÿ3æäÓqo¸¹ÈãqAx_w¥™“¬£ü\¶O—d±âŠ]*@>)óî‡: ÞÈ ˆ›Ð>³¹˜™s>“ôU’œE»dw wvˆ­ÊN»³»‚TÁ=µÂºîr¬©& EÛÄ*“s¯ Öów2û®bÇ<}ú¼ —t5%^.’û±Óžà]ËÝÞt¾³¹Û°ðz^À!ÚUùQj#¦å_.Pჹˆ¶ÅÁ'ì4-ýð°Q¥Áò{°€Ù2']ÂãLëÆ’ª^’â]Ǭ€ çع.[–Ž¾$/J—7¼‚ & ïè' ûœŒ¸<ÈäéÀÒ2vŒ|ûyA£™p£·nY§IÝcUç2±7^x/(Ñó£1å†AWò wפŽ\€ÀÚEúK•Úyç6¶ÎÛº³&" !j»éÐ%¸AfÅ·J©t)áìŠL«U=kÁÆ™òLÌHï×éz•~ê½Ý.VÂa.(§×…ùmiìOúÒîÐüêZsHßë³ý'ÕK;Ú»0S;–Þ Z—õ–B Ç ¬[*¼“8îǨO\(›…i›ñ¼ Á]Ï@âÝÔ%o@î¹Æ¸‡2¹Ž·øè,_„ ôM+}çžú¢Ÿ>ÀSýs=ºÅSà]üÕWUïƒé§DOK[{/èAÒëlD/¸Ý4wO¸ùw¶û»´Ê-oºßܷ˧^*tðã·öN^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^Ø°°µ6,lmÃÂÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ [ÛÚÆ ÿoó·nß{kã…¿9—‘ïc•™ØðàˆAv;Ï+ÀÕãùIî¼;\œþ%‘óør·/^ÓóŸ+÷$Þxá/6¯lãÞëÆÆUžùÄI¸ï]CÌßuøk;íäëL[Kö«@!Lœ8<¿MXLz$%¹PÉÿâÆÜı­Õj{œyN×ØñÆ ,f” ÆøDHA•iVI7öA*ÍÌŒ,nñz—'™Í…O‚ î™52A£ÃÍJ![ø -Ì1Ð^hei„L˜™ ÂcÃ…ÍF¶^Édî„’êk&œYE#y“å¨Ïy”¥¹žWcÁEkº¼ô,ÁÚ @4nþÃ;CHÄ‚„g„SÍÒå‘ÑÈ´é},à19KÓ>•9<¨m%§Ð?i÷6wM+`¬5á‰ñ­ˆ¼qqùÙ7^øfËäÿm+™y^+â=/H‡Á€÷Ì.GóA5¦eÀ eTÄ(žC’ñÀ0zîl†b(%L­ý¤ˆSZõú=`!,Œ€ P¼Xo‘lê°ÐÉÊ p=¯g.qimÔ£†áÊÀ,TÚÚ+*i)XÒÜX4ð"Œøx¦aÉth¥Y{ž;bÁf+<jŸ‹ì‡7%Oõ¹»ã|7 & u‘[¢ï/ÒÁBx†F†ÃàÐÎë9j¤OeË`'d2€®Ý=ë:Øxá«Í…Rñ‚mÁ$‹´#aâ…>—Ìׂg m(mÆí´ãJF1œ0;Ç;Ö( ‹÷T¦UVf2õö\û]–-ˆ9°ªä”÷êp[FF,€h‹€ŽÞë³9 ˆ4@Žì4–E‘"r=ø=¶X…·J61ÀO¤“F:ù‘ÓP§ßå‚E¨ÿ>bƒJaVV¸ƒW๠;Ü÷AT¦²)2)ì20<´ +˜ìË2+[ÙÅ î Ïe¤@\/ü-,”8¿/$5Ì­Œ…ŽdDJk…¦öbËãDÈŸpAo‰<Ÿ%ˆ*!%Ç/º¯éM@ì$S<¼åȲx" ÷ØX°4áÄhJ¨³©7a0m¯a^ +†¾~h”Ì›&ho'¨¦/X¹êTi{“*«<%JéH¬÷ˆ§vQÉ#Yn˜ÈvùÏíïâûÏ@7ô"$BêxO‹€ë‡5Þ +ÑŒ“/ü5,Œ¼¥æÇ=/ž 1³km/PcYÈ[ñŠhè`R2”0Þ@ÈÌ«Â +fŸ*B„Ú!qElqàÑpÀ‚RÍ8' ,øðÇôÚ†8ÓOX0”€0CcÕ™½;FÎ-¦‰/(Y`!®8 ÜŸAëáRÖÄ éØÓbè3©í4Ð*Øú½MT`£x5‰ÀΧ1ò‚%<<•¢®¬mèI²ñ³ 4òH{ÊP÷¼³A šyÁ‹½i·à…ÈÀõˆœÙž:ûLÀœm×±aáæÓžŽ„ˆCÐãÁ˜`h%p ˆ…1¡E@Ð]cÄ(A ±Ám ©ŽXPöhF¥áƒ±A뙢žBrÂmô/€AQ~‘"|QÃz¼¨Õ-ˆAB{A ;Œ1+i‰01X FŒê”×s£.fn€g¯eZÙqá$`i^€>˜ÞÆ Ë´#y!1@uƒ,y&EÉ|Oó‚(3læè¢ eîôLj/5Ÿö=¢çp˜“´n­FïÀp£pW"dJ@.sô(å>üèSmeU˜²Ùù9h%’’T-dXš=òBÀ™Cà3 ”½!+áš¹;˜ÏÁ.G,P^áÄ õ8êöð ®åg`¡ƒãC¯”í¬{ +à³ IÑ°M‹Ø²K ™Â_î“R¢½/˜"€ãxAZj}Þ=¿ò¼ñÂ7ÐÂAïF,€t3P­ÅÞæ¦+so^†ÖÍö´ú³Cbt4‚"8¨ø(W^©~{Ö‘z +õáærø4#ø#“n cxZç© àÏ`90ã©Âe–aKÙ8¨¯TR_ÝP³1œá¤ZáG¼ýÞ^Ч +z¾,ï\ÔþÝÞˆÔÜeh/0è\ )¼¡;­ /ø>•Lpë]øIrP Á‚(ë\ÂQi¾æB˜8&µñÂ7c!“™ç÷(}‰ZvT4à×¾ÊzŸDBýªYšæŸ„¦iùF‹ÞS0‚› µ+ÜbØsºÄ¬z߷ʲ#J;)wAX`QkG>ªî©c·¸6çÀø&eÛ.quz:ÛßUfde!˜´xÍL‚0 |ü×ÊLe¨O ªäúÖoW)-x¤²™Ú$é%™˜VTî|Ö8m[BOã ƒŽ;Øù~ׄñ +ÝŠ{èFh"ŽiÂ;¨ÚÄÄÍS«²W¬È«ókm/|±’ÔsPvh¨p‡]?ÅÊ3ÿ!Ž½xa/àŸ<}ýè +,`Møãqý“7¹’üà&}À<&OÑüØé;¨ uÙŸI@„,®©ºÓÃßâ9ž\klzÍc<5ÆÍöüxºèt,šXé„cÿðÐ>¸;·WÅ?Æúóó'‰þ ?¥® +æ¿{>,|ã…¯&†NFñ£8ÊA÷÷ è ƒ®~ýñ§æ-R‚Xø}rCa¼ÇÆ Ž ;÷Åe­ +õÞ¥Ý xòÁžÕ¦žfñ{°Úño±€+é.²ñÂwƒÁ·ÿh?…­Þ–/°Ï‹×IzÀ‹¼Ffƒué*/|;ÿè ŸûÓÞ¶Ãî*7&[¾óÖ¶öH6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖ6^ØÚÖâk[û/ñ7^ØÚÖÎñ[ÛÚÿÚä ã[ÛÚÛ˜Øc¡.¶¶µÿ·Å°µ­mmk[ÛÚÖ¶¶µ­mmk[ÛÚÖ¶¶µ­mmk[û¬Ø«_ÒI½õûY'åËßM¾{t¼4ødá)òèA¡ârms¸4×ïh"ù‹%³†[Zo†•Âø\áÁ*äÏ@A•´\•Š„sÁ»•ûºÒ•ì¥ï}7|9þ[ǤÍÇ +O$`P\ão PÉœ@Jgř̕<ˆ¹¬Ví¨Å%fp_øn&]¿‘âÓI™®l?U»ÆAI?«wQ@a‡ÚÇŠØ¢Ò^—Ú-ÜÔe¨LëW½¼e= ‰õ¡ôº[{^Yª™L‹¡`Ò®ÿ@dk5ìíŠÈ5e¬©%Áüœkáp^õjˆ+øV*h¿§9LÝÔ¶ž*åºQþˆ¡†#LRM®ƒ!¤XU·7˜ãçéë”Ó˜ÉrÈpGò÷ù5$w`¾âågJOŒn˜,’¿D +Ú}î®;ÛŽ—\™×3À|©½Ü†·|§½P€¹‚›Ÿ}ªô˜’Á¢Ãiw‡”tU†ás•òµêÉ¥peúb}nùVIÌáUr^}ªô”ð†˜Ò%ÿD«˜‰6éºz®Y¸«¿!›ë…ö¶Ô5@Sz§$Ö4G£îc¥'¡à!ø+`èGm|ÝKzbm ¦6™Òí_©£€½w½ Œ¯‘ù§jähKÙÒý;ëmÊí³6¶{þ í7P}¹R,¼7OóÙ:y¶²£äÝš’dþêoèËóôõb‘®lNÝß,þ¹ö36÷¬·Í’ËÖVÅ+ÎÖW$ý7³€¿73ƒÃdøÁÂÓ»Ï@{_£ë;,;ÉÖ÷̓!’½z¨ÙÛ‡Úá>C1Yý!,Äëǽxî3Üm¡|¹ÑaüÝÓ²)YüÁÒIþ!0Ôtuï½AŸ†òõqÂýûc‚Ò϶Ÿ«ÞC°¾÷ž¬Ÿ1('Þ«Ùäí>þÂýlû9ý;ëÏZ¿ww«OÏÜjdób‡ûøøA'Ï>XxP­øKÅíªõ³e2)Ö×s öú˜þ÷ûøCùÑö³÷ÙX½»=!<8—týé"àÜyñ«±¸|wjï¬ú]Å*çÁÂÂî žúŒ…ë™Ã÷;“Z)>YÚþ§œI±XÝØ}ŽïÙ–òÕÁÎûuñÙjþÁQ„L¸ruíÃy†Bóð ÷îš»Ï^Ó2>Ü×u¿±»ú¢NõŒ µHeóbÉôèÛãnzÁ?9ÚÁ{eFú Z²~(Ús|ÏâåI$õûkR8R~²3É’[µã¡¶¾÷¾hä•£×;“vL¾;÷8‘î'cdŸ8u7Ñ=!Í}FÜó<«àã7?º’zVÿœõÅ@íÑ3Ä‚ÿŸ$~¸3É–â­?¯=á–ü ®qÃUe“^ÚÀöys—ó~EíZ‹Åßr&Ù’¯í½wž™TÓ—ƒ¡~ÿ´Ü3ùÉÕ­ ÷OÙÏż÷Í3ªÅü™=ï–Dç³#“|þ§2{ŒtugRÜ5û.,8ÏÀVä…ä¦ÖçðB|MØ®C~-,8Œ…¬ÉÄ‚E«ÔMÃB4ðrëÖ…vCĤH€jøÍÂ}zÃT$õ­XˆòºÕR!\»Àå!h[9—.|ªsá0œV5¦ëFËx–Š4JDZlj«û8˜ðù&À ÁD Ã}¤pU£é7Y›l»t]g¨àÞ— ð™h…+Úœ’Áƒ>¹H31]Ú?ŒÔÁ§ês|x¼ö$í‡ÌUd5úÄ´LD^¿ZGrh” +{ˆa|qD†Â†÷‘CCcë¡Iwê!à´úÃu¤H2ÎiíJš dýRŠëó†êaB.›”3k0ƒ±?âç +©p.«Hò4e8×7xY Ü+Àt T­%ØpÏ~Ä‚Ááæ®!¤›»Xã8”~x#:LºoÎvƒ'¥äÍÚ¼àB¹ÓÁkip Û`%®xžÝH†í6poÖ?Á^ððᬺïL8@9•Ì¨àH¢öƒžCãè¾Ü^(ñ¶ M¯Á­•øàŽ0 >n‹ MƒÛ_ꇨ?œ")#Ã+•CœBÿTbN†EÝÅp|­‡Óâ›u$SŠž /áK6ìÐÙMxŽ’…¢Û‚& PÚ’Ïø™˜,ØQ}tA-¢¨©çÜÓ:RŽ}ÜP=ÎCÃ8‡…ß,¶QÙ»˜ó—KaŽÀgrÀJGªÆ>õC*S!&Bê¡ñ–ì\|&/`ïûÐê]ÊDÎSxR+ãÇÆ0 ˜üúZM¸5¶[xÁT!9œ`œ&p‹§•‡NZpÑ^‘­ÖÖö½È 8®$,†š4+èc¤úˆXð`¾1Œ‚J«PÃÐÇt$óÄŠþ1 Ðí,b„ÏÅQ'ð(&j£Ègº÷Š¼`¨7ïPqï‹Ê4¬ñát„§œåÃ;¯ÂÞÆ‚ÞÕ}Hy +àôk…=4@~¡v14Ê Z«È(–÷píôPO;vuŽµ#9ê÷9clÞêù:”¿ÏJWW-A}¡¨V ÀpºúbÚW0Á˜y é¾²EŸRB†YƒºÕ D¸ÜávÔ¿åu10œ¸Ú†¢" ®To~l "|”h]^ˆ¹ +ê,ZõðÕ` )YGPÚCœ–õÃ[»cP耰^Š=4¶«ÅÇAñéÔP:û¡ +ŽÇÒýÐ|(/ ÁírvÏ„—ï±Ðƒ’Ú¤i’ì +…… ì;°`KF›NÅj89ålo’F¦ØS;Þ¸¨È~ƂŸhìã}c³a¨†"è#´Ü¶ …°â5Vä4´^ššê¼±QÚäv X€/ÂG ׶ > P“äŠGM*$ /T`y©‡'ª;Åô/ÇBS$5SÔ# ŠÛXPC“ؾ¡B Mñá¼P ¥Ó$0–èK²à QN=mŠ†eapûÔ§ú@µ/87z“(yò@HjБ”lfΉú*ôýRij…Ír¥#)בSÆ…Äßñ‚‚ž1,Ô‘µ˜=DëHxJŸYš?´&rUí©”e½ÖÌŽ’6õÈV…ÓÖ¡ƒç…X¨™šúR× †¦.e¢°`hyTñqäný±¼Æ©£ª ICàaZ„‡Àã½äqñÔ@zT„*¦5‡ÇwaîèU¸w÷¸ ^SíòÆ0I°Ã!A›œbˆ»Œ…ßñ‚²šqT±dª©žš2\k«ÕC Ú”i^žâGjÕ­ µ_EYs¹CËØB¬PIóq×uQïÞˆµk†ÆÀƒr€À*Üмðéë ‘ ŒsêŠÞn(™ërc>­Awr)gáPœ†S_÷©‚ÜÖ¸·ë +Ô ¨`£ë‘U舣‚§†za·`AëqR÷±íû(_È 9—,ǘ\)›þ *-¨Ä ð8áò(|ñ!,ØRE%¹ðí|YË'ò‚Ã$ÆEõ ¼§è:R 7†w˜ ‰ÒŸ†…z—`Z‡ä$óݼ`2I;ÜÒ#¡’Y+a¡N%§½'¤HŽ*¨>„ÊÒ¨Ì=‹ž­#äîi*’+YcXð–òƒÍŠ^Æ ¥n…µzÓæ°DéG`¡ƒcÎÐî¿Þ^à¶o9:~¹ÝÃ:’y¥¦’æ`»«Çì…TɨOüÜvŸ‡m/PŒžloБ2xxÂhŒ¡¬ôãt$ÌøTGõ_i/`å…LoqKÜ=\ÌÝC,¨"jÈö} ¼pL*ƒ0˲ªx/ ½0L‰])ËùQ^k;—…Tî–ùÎâ#°PÃð¨Hh ÑZä;!/ 2-ô)/0ßy.ìÿK,¸îhF;pÑ1ßùQ?RÓŽ¥aáP.visŸŒO§c;2 ñQ¢—caLldH±¯Ìwþ …ªÙ¡Íèt‘.ÿ¥~¤ F†É½Å¯±ï±Ðƒ)ÃÑ/yÁÑ{á¸Ò2v>!õ+yÁ3aeÀ“¤Î»°Bgc~1ù^hTz»3þhÂëIŠ‰È·aA+|Ê=#ŽjÁý’Råz>T#åkL}‹Ïî áÊþ©X¨™Ð¯Þ`/`6m¨'‚ƒ°†Ï±r½cõí,¿Žl’˜ñwʇµ°À¹S‡Òµêž¬?†[Ò ·Ï,MÁ«³~¤çaÁ‚§€Ñnæ^’^5Ò™l½ÚeUa´»|/ä2Œ-ÆÃÐCá7Æ#…r¬ÕÈ%õÖÂBíb¡Ÿ.-y4ü ;!E]'h'œõl=“ +&e`PÉÅÁÍ_Ç !.®\2~øî> –Žr8ŠÏaØÍ7òÂPbÚ*I]z2ã>Ž…$˜15ªí¯±0ÔÎÈ~äœÀgòÂ`¥Xz¹¤n¾ô‹¼Žj³1¡¹KÍáó°0d­ÅçhkÓ?§Ú­¿A¦ý¤ü…þÕïæòÄ' ÏWòÂ5«mÃÂe,x®coXxÄÆ /lXØxás±`lXØì… Ã[6W]ÏFýD,´·ì¾èÂ3°€;\¾QüôáBc!~â| +jãç¬î §ü^pXõT,ÜÀ sîÅ‚uÇÙ%ã—sF{v¬Ö8}2/„‡ÑÏáùäŒ`m,ô§èXòÓ§;O5œ?Ä á>Cà]¼Ý{ßû°`JÖ\<ߺPÊ{jå¢~2/T]Ìñ\ ³ÎÜãÇá:Üù×ôñ¢·ðÂÓ±`_Ñ +v?É¸ËžÍ ÅAäavA\›Â3ÉÁ Ãuð»|/„–a¦¥ÒøŠ,µ­‡y!Ìs œ(É+5”ÄÌ;Å Ê´3nåË΃R:V¦&C«Â-áÊܬ‡ IÔ¡ÚLíþ×XˆKZ–˜„’§&ƹFVŸ”^娾§-^2(ñVžÕ›¹h,¬m/x%éó/N¢Â´wqd Ne”9>hÐH¼o]åXä:neêÔµy!HeaYã½Â¡Žz'™ºg0mÞ!Zœ*ÎÒ 4 H’á «+·yi u&EéMXø2^ .f#– þÀ³ÇxÁ£S.2æ&KÜD©âð#C#sܹͺ &vBÈÀ‘JÆm\¼¶]b0æv <Ãü5TbÌ™a¨®óh¨’‡ø2zÜ8 árõ20}b§©Ú´Ž´âHƒ&Â8¾û!â”mC%ÕÝÊÕ‹õð±1C0”ðS>òB½¢$à}˜Áp2Ç$ †›„…RíÒfŽ#£Ò8 2S*\è nipµÕ <;øR^ ²éˆçC̘ãY …Á#X Òôc5’§~ð¸ëx`u*™cœù·èH=§–WáB*?$”%ŒµúTŠj‡‘å=˜½˜õÜþ + æîTÅMøl““ï„L£í…žaßS`Å=\·÷,·äZ_G +@þ=‚©Ü¡dUG 5’:÷Ðôlyp»Šø™:ƒWaÿ,x&ýBLX¨™LBz–y;ìàÕò =³¼ˆc‚Š¤a„Ûœ›–•Â°Òí‹oåµY"ëRM6Aj9`aÜõÉ¢TaÅJ%žN^¤êH;^ê^hÕ\Òªí_2„˜5¤XO>P–(Uö´ÇÅoí/”`NŸâLP`˜oa©x•nÈè Bà†tÖl/4rM,`&B¯ö–Δµlé³Õ½0߹׃"È$ÝÛ kba@Öl6÷ ßIõM‘`rz‰D—âÁ´­B*Á½õ–ö—åxº–Ž>™RôÑ‘p7Ð4O™´bW²´êu¬j©’Óéª?`Am¤ ïGÓ Ë&Å£@õ°Ði©w³Žà ®]`5œÁ¨ºœâ˜³iÜ©¾\Ã`’˜°:5Ã¥½°žà¨ÈLRû¬ƒziy“ˆïLsxÁ\z{ÏÎÚXÀ»jçÆU÷À7Ts·Ð®fÜmZn g¢xÀƒ—E¾ØvÖXÈd€f>Œ˜>š†6MŽv¦#Û Hã@éWçŒPû ®Ð>Åÿñ#¼Š +T„KáóJ×¢¿Ã‚­0ÚW8¯u ûÒLñ„…ñr9_`ŒzPŽqiAŒö‚·"/´#"¥l£OµQ} #LIáýÒ4,¤ÏÂ&Î:’1bÁÖ¬Y³tœô g»AÏNêM OÕSû^âVžä‹yºZBcµaæ`˜ý#:ÒnN¸2`ZñmÎTIÜ ÖKÕTWŽPû ºtF‰Xð¸Ù!·¤lXð‚ÞdSÏH¿âÜ$“2ÜÐœ;õ¨#ÍúÀXuB š-qŽ©#ŠÝ˜ì…5± Ëݸ0i,ô#7M¼0­1ÔpÆÓxu$%ÀZOJíÝ÷L¸úžtD)"G°aÉ ñ—óUbs€Ö s.lçìV,Ôª4掇Z¯Õ3J# T½-­Ýu,88CÖ“®,PyÁ‘nÒÜü~}2žO±)—X•fPI,‚•«]vƒZèF«‰šUyÔ˜&’ JGÚó‚³´ëáζÍð<IÝ[½I[îu$tcÏ25™% ªà•¹ñ ^HF^øf{Jn› D6e"Yý/€Ìp3ÀgmIq¼\™f I%\xÎ…ý êS®TX°¥šz›^œPè&~ëGBÁÆÛÄ\Úa.ÉöX€>7Y +ï‡Û­,Àë¡YÇXñ^¬l¥ÚÂwšs÷¼PJQ(ŠÎ0q=àz)N +f*Ñ^PuÉà¹Ø³­jÏgžÃXÛÃd/ Í &z”¦5ýïãѨU…yЇû!äåݼ JQj74fÅDy]þ´A¹ÂªªöpðS,UáB½^KÊqÄ-E7hÜ9˜#n0üžÆ`Øau Ú*|ÀRºúö]¥ÛÁ_©‰ÐÃC ïû ^ pu +/-D‚«ìõ…{ù «•ácãÈ„üYöB ’@j^¡æ¬Œå€'îXÇÕÁ,³ÜàÊ·ëq¥…(ãÂVÞ½ 7‚ž Ïo´vÖèô|æÚ3îçt7ZÞôÃøvÁNÙ¨ŽgùÃX@w¼zôßáõ<Õ©b4Fð²ý)›<ƒ¡/7Øón©|,M¬±â’w«Uˆe ?Òª>Õ|°Ôè;ð¯¡~R_øøB=ý‚÷ó6ÆhŠ]«7cè·Q–5Œ¯!V¬ÇZ¿@ìxW|«éZlx¤æ £»%6O½WïŽ@ì»u$ãa)ª ÁÖæ硤Žõ±pë€7÷†Í’Öð#= écX¥µž…&‚G'czoݵ¶±P¼ ÖXø2©·žÿ ŽËÍX°Ì;Äõ>,xŽã?Ž£âVä#Ø=†…·ðB7báëjH> Çsró„ŽÞ‡…•fÇwGÛ¼‹nm_Ç Æ»Ñúð|g÷ÏÔÁH(m„t)|[kÐMuIÖPš®'G\”rÕQçE¯¦Ç[2 w<ªd÷ºVA\Éqt>qò ðÝpõ†‚?€…FNmµ‰<š/¹b- CLåþ‹^Áç)ߦMÖ(<1›ºÇþ7ì¦ÇëM<îtÉ5U퀯Ù[8OoDsêBø‘Ò3¿¡ìO(IæúS_;^r]ÍbB˜óºwCG&Ú½mtŠqªbj>lÍÿ†+ÉÐo›­8‡OÔ¹®¡›ŒÊÂëU”üÃCŸ1­¬×òWsõ+xnÕ2wÕú—ÆT`Ö¿|¨Ù;ÍV‡¬µ€¨iý™•e¿îNŸÁ›Ê&o_+‰¯f¢Ó–b>×K“ýkaR>’u/Y>Cjkúrz¯xôÖÑÁZ¬‚îºúõû-†µW6á’l}Zßñ—KE ŸR$ùžÖ½Ô]pw³ÞkO­Ïs«ûÏÛ§H­x½TÐ×—ö>ãgÏ»B …½úË6šgHmùúÈz».\§ÕGKi[ÛÚÖ¶¶µ­mmk[ÛÚÖ¶¶µ­mmk[ÛÚÖ¶¶µ­mmk[ûúVxVÞªá[ŽÔoÃø›þ6óoÆü~3ô™ûƒµqî”ËÍ;hã=›qá ^|ƒÆïæðSÅIWês‹ ë³k‹MD_ÖZÎy…å9ï0&ŠcXݾåX3R+ öp0…A†ßL}0Åøcõm K6áA +éªãÁ«izøáE+1︥úƇ­Ñ÷8984w¼Pk| +Å<韣¶ò=jÙ…ƒá¹ƒÞÉã•‹ƒí&¢/k‰NÏ‹ô–r˜®\a¹V^g™Ê‹±tþ fÁ\fïƤwþ8Xú ø!“ȃf.s•åÖÉAŠ>Ø];èòŸ±°ÿÖÿ©Nºb;o«Â:›ÊŠe¬Þ‡ÍzÇOÿŸÛ ¾ã8ÏÍý¿ü*ÄÐ)rľ^ŒPÉ]= ‹’=tÊÑ‹X(¥°·Cåý¶î=ˆÍSì„\-W¡ÆB ° @kÒ´}½0¥JÚe9{î6¬`ò=ÄN¡’*çÝxAè2<<ü5òïÀB¨bÚzø—E U#îêmªýHÆIá†7ž‡¡SÉ-Ï´/dªò½Ã­š;´R1ô + .÷`ìt÷xA°>A²ž„[ùÔ Ná§V±PiP`_ˆÆB9ñÂu©ÍšmF +»udSšªŸKÛ¸×^(Ü)W@Z´ð]Ùỹܨ^¡i˜AUA8–F·ð‚+ÍÌlvÎa!„G=ã $¶ï Û_?:`õúÆûز.»×Ðæƈj–÷ÌèxÌ’ š Lpi‚C”5â¦iâG{6iq#JÕ½Îa@^3±SñÌ ’U +ýKÚbì^õ$,xŒõν7’®W¤èC†`°%)2ÀG!xP8\ÙÎG!ä§bp9ç—ã“pÚ0)üK¾»«ö¼n[åJšÁ è1¨\õ|™äf´\í÷`ÆgNjs®=+?ñïÃý)¤¾ÃW¬b5ÇÏÖ±÷¨›wKVï`Ž2mÔ>óÆút¶ä«äþz;ÊR +"’²Ý!/ Ž¤„? ëÊTçß`[Ý°_Û~$­# ‰h¼=±K^0`VD•9u–©óÝ'a#‰â&.NJ̼Væ Ü®ÁXÊtÊn÷©®‘ïìq[Oð½‡Çš5cWaÁÂé§@页RÔã[ÿ Á9½Ž…×Úv:Ũ”¼®B–¼[V²©÷o» ¾íÝúZ¤d«0iÓ-¼–*µ‡FXic«±›¦-Z Ú>Iƒ±0ÎEÉ à±À®óÂ\1¢Ç'¥ÞÚ(× µS±Ðð³ä}Ë.#ð^µë6Ì)cT¤‡ÆänÞhÞ¹‚…]xÖ§ŒƒÕ°³ŒÈ)è¡Ao„žnQîÄ7ba8U×ÕÝ‚tLÍ–Úv®Š)‡„cI. ‰Ín*æiú¿Æ‚¢'t΀‰lƒ¿0Å ¸¯-tÍiÕ½~(¡Ÿ‰¸IGª=/^Íß݈[fÀKX htª»€êÆE^(nâ ¤†¹\ªÑË2òÂØy! ‘Â'"œ-F‚Š5Þ«/ÔóæG?Ò9Ÿª3bÁ,À‚}cM.4])ÐI"ùMÚ ˜#—½‡÷¬;gZÉ0,L£÷¥R#cÂŒŽÂ¿Aêº8 $wÝd·‚øܱî\©ƒºEÛ«L‡Y‚ßÁØx6­T÷¨êñú™Äëe¿ÀBÀÄ–9yç±pÕ^(@ES©’ œÈUArºÄOÁ*¼Šgqõä#/à¦Çv÷ñSI† +0,íF˜Ö^îõ©N¼@a +ÎA1±q­€í†…nô w~Í|/X¯Ív¼—ê”™×63y ŒSJ]&Óø®ÿ ?Ù :UR9$ú2U`¼Öò%; êªuJt»%Þ¼€:àÊêÑœi‘kB­?0`æJ§ñÉð€™Ã}e;c­Æ~Ôus¶ÂðܧšÜ˜a}G+J“uxaÈy¿ºø0o®ò‹6·CÃ`ËxÌ^8ô=Õ}‚Â×,DtÈ…¨ÄNìlwÛú¿¦lÕ®Áš&¡š? ¹3›_ÇB•¥qŽ4¶p¥B[ËVH”:½q1±.®T5¹/Aе‡þ–Üÿ[ãT Ö¬.šûopw5ÓÖÔq_?h/ÌX;oœßËi3`P+Skp1¾@Ì´?òB12&”sž3º p1S#Ç]¸4ïó#yÓ;Hœ/àOžÆÂmFÉý/Ìiˆýí§ÁñÑõ…[xa¾eð£5\Ÿïj±’Oµ¼g`a?|æT‹rï{aéGÊG\áÂL(]ý˜´,\*ÄÁLû/¸²Œª,<õœv8â…:Ü©ãtør‚…ÓOcá1^¸ÛäPÔ(i£[©Ë˜‹°;£ÍDt¬ÕtA#˜pÑ ¯su š«Y¨A5^ó8Déü[ÝæZ­Ì(ܳñUWN Ì&Hå©©ž½Ÿ*©½©)UýM¼ß`Á¼7Žõ ®õÀCݳè?Ù doþa*Å°C½«P hŸçÀDñB}/Œ1Õ8¿*óÁÖöB>òXêŒK׸ŽƒR_ö#i,x3/à¶Åè*Ïo__`wñB5ÒÆG#ðMÃ%Ⱥuæ:Z„ /TPÊñÕl¹NXqÞ®™ýšÜñÒB?w!™…’xêÃcï˜*IË]*ÔŠ­|ªTûГaZ×ÆãXð¹HoBÈxù†³¶Šàm–ø"ìšIî°¸d:W$9æJrµld¹R¤)“QèÆïà…,ÉóÜ®¦Žh]ÕÁ™¦Oðd-¦ðåÓôz rÿs¼ u$¯’Hó&[±¢Êƒv;/T2ÁЬPpð]žÕ8³0¬3y¦LÁÓ ¡Z«ªfŽ"j8ØkN´]˜$røÝsŽŸô^p@Eß@¿akvª"†ÛŸZö‚{ºw5<)†©âBj®õ×o”»Þ‘AÍ%Ó€ÃóDZàÜU–ÊêfÛy©â‚ÐBKwJO:wÕ^¨»dÌ•Äqñ;*܉ +F lju€’ÙÝa/ËOuãûºÝ§º˜qÑÅ8U8\vOñ#Uãè›ð—tü«Ï“KX8vŸW,ÂÉiôsâãÒ °0.rõù^ã¥)¨‘£ÍD¹]9‡…bÿTª§†4Ê·@Îî°¦®EÕ#ï,T¹L2o¨«&EŸ}‘0¼’8)¨s†­¢á¬Æ°–=&ºÕUš¢Û¤®fçÉ9JÑÝE‘ž=Õ⸾Ý^¸ÅÕrîàù !0 Y õâèútø¯çͯ'ž³¾°ÄŸz°°!¶ÔöF=»! +Äa;ä…½×í·¼0«åtw/.ðÂbu„ùØ}¬ÚÑLZ³zi:Ä\+Ùýqyþ;°¸ÒmbG°†JÒÏç®#a¶eU.\ü"èË™$Œ»ú ƒ>)–¦.Êå´¾0JÈ ÉAµÉßñÂ`P¸eâªh‚LªŽˆLGÎd ;':½DS½(ºŠzªF[öÊ4A7} ºfÇoÆÂ^à“½àJ;Ê9¯•Ìô9·3Š†ÃŠ>Õï¶ÂĶ/y=D %RæɹZaÕA"@„¾!Ž™‰:û1ÑYa•®Ð¥å¶Q»µ‰ùígêÔ–'óYwðBEOj…Ñ¥¦V¤xK¡‹ÆžØÐiêp§Þ¥ª¯èåÒK^*ê²ñ€"”lær¸#ä=X\ìFé2†aÞ…ªÞg¹*í™b97,Ê„Û9pâ® b +ùÔ%›½ð£CTöu]xí/nzWîq¸ÐY[Q¨¢ÞjolõPM¥­Š8žâåÂHKº1¿;+8¼¦á𿻆¤q8,±3Þ²PÝ0¼b¨óY[šº¬ƒh_ÄžJåÁ…ÞáEé /ܳ}U¥-ŒÉ¯âdO"x·zªW° ' Ê ¿$esx`§æ=,qÕ´{h/’:}<¿%K}­Üÿ%™¸§({î‚ŠúûH—' +ȳ +Ã3ê°àò¡” h¹¨êÞW¡ìûµ¿Ûà0Xeö^ÆÂÝ‘&Ö/Òï ëØwá_……ï¶:°Žû‹XØŽä£éYJi†AÅËsÄöæþì~m?µwï×öò¶­/\ô#%oΔ@”Ê¥éªS¹ÒÜWx¡®Rš‡¿¾Cýk,œç…¢L×l_ß½OÄŸ]_Htl@àZf3¹ç†§ë¼ú˼êd¥æw³rH¯Xµmõ/„Lû‡~§ÀDô‡ÇÛu]ë|¾Ú^p:Óô.bÁòFkBÕ6óÆ â;ÒÜkãÊî}y!à¬ì‰“þò]y]ØnÉý?÷nB.ªžÍ/ó]þƒ|@îÿe/ÜâGš°PkGxÁoïGǽß^ãN"TSÙM¾Ài[¾ÁWhëÅ2ôdêPM¥J5©É°í×V³q=ÀÕï‡è•f¸U±ïÞ¼} ¹Ô=¬ˆ¥rˆq ßµ×ù_^_ð°½Â¡NÞ®È?äGr樷– EF9c)€ÌpÁ¹‰©u c Ãú·¤œøE.gnY‰ÚÊKg y g`TÉq9Ði½ÁË°’:Æ­¦mwÂX£Ø†îaÊbèV§Ý«°{U=¤j;¡¥éÿ +¾Ú^ðú¾¯oÅ‚'xRÒ{¶x~¨žª½ÌYM%Ýù)Þ“J˜Ä\¸<ó#ÆÉa•ò GÇ”ÔRÉ6–+#>oÇ?8þà>žé2X;•¿kÔ7RTÞײ$—zßl+â߶l¬–# cx(“”Ü­ÿ /|±½`K~1NÕÞozVi½Hm¤AïØ53ns7/,…­vÕÔ¬·²tµ^=1[*æS(Ujó©=êôǘî Àë<œãB=üV{6{âÚ³1£) ·y;½ë)æö©\X)oaSÅp°qo³G.øÞâ6ŽJð³C°fccŸ¹õù„çÓY0;‚x$ZÐ3¯" î S‚rŠ&¼8äbÄÖÖšªïÍ=Õäý#°˜ÍxJG`h×t/q!G÷47ÚÖšÎÆ Ù³1h{;ÂGƒµý¸×Úóš8Ã~â·¶/;‚¸Ð¡]q¼Ä…üòl=a¹Ü›¸ §¸0Õ.¤z6÷Ä{6m5Å…ý&‡ýê Šžì@"ª­§bˆpÍ):‡þ,ÅÙ„Br’_=‘Zšž£WÚ~ÜRP•D!.<ÈKM/ÓãÛoe·øý·Âµ 0è†h xS=s ^Êý/Æ»w8ßQc>ÍÙ(¦z&“àèðbe{ÝUüÊ8zhendstream +endobj +5735 0 obj << +/Length 107 +/Filter /FlateDecode +>> +stream +xÚ`ŸÿõõõšššÛÛÛ‹‹‹éééËËËIIIñññçççXXXÓÓÓºººíí탃ƒsss'''¤¤¤{{{ùùù«««³³³üüüiii‘‘‘•••999áááåååÿÿÿ=Œ=±endstream +endobj +5731 0 obj << +/D [5729 0 R /XYZ 85.039 781.388 null] >> endobj -2611 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [452.526 652.542 512.306 664.232] -/Subtype/Link/A<> +5732 0 obj << +/D [5729 0 R /XYZ 85.039 625.299 null] >> endobj -2612 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 598.345 206.209 610.035] -/Subtype/Link/A<> +5733 0 obj << +/D [5729 0 R /XYZ 85.039 625.299 null] >> endobj -2613 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [427.522 544.149 512.306 555.838] -/Subtype/Link/A<> +5734 0 obj << +/D [5729 0 R /XYZ 265.428 204.64 null] >> endobj -2609 0 obj << -/D [2607 0 R /XYZ 85.039 781.388 null] +5728 0 obj << +/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> +/XObject << /Im14 5270 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -534 0 obj << -/D [2607 0 R /XYZ 85.039 244.172 null] +5738 0 obj << +/Length 524 +/Filter /FlateDecode +>> +stream +xÚ¥TMoÚ@½ûWìÑ>xØÙÝÙÞHR"•âœÒ"Ò ¤R(íßï¬b[½DHhçó½Ùyk’(<ÔA8 ½ËM&ÅŠ#×3ÊcJy–sQe£‰5%DõrêC`H‹êù!¿ü2žWW‹¢ÔZç (óùåý¼Àü.yç‹é¬šÎ®£e؉ùý<†¿- +¯ó*%Mg§ðøëÅ8YdñXÝdWUË´åÀ¬B¤ù–=o™˜¸íïÉ1®Ý¿#á!X×o¬ËŨ5mëý—$Ÿø»{Bã€È±zPººî\½ùššò¬¨fAöL…ÝΑÆd½:ì~°h|­B¬e3šD²mõ 1R,øÔå«wÃ0Ä÷ìþSNß;œn§·<¼î·›§ßëåèe[”ÊçÉJ2eÑï’{ÉC`¾ß¯­ÒÃøS°·vî8k‡tˆ•3nÒdD»yxጳ -ýoí: HeYdàÐÝ Y±¾ñc¯OÖ¯ +ƒ†ÀXùÁÞªÚhð: ¯‹x]Š×¥%Ë£^–r½¯iäõ1éŒð?f[kendstream +endobj +5737 0 obj << +/Type /Page +/Contents 5738 0 R +/Resources 5736 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5694 0 R >> endobj -2614 0 obj << -/D [2607 0 R /XYZ 85.039 196.836 null] +5293 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 546 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5743 0 R] +/Length 38179 +/Filter /FlateDecode +>> +stream +xÚì]‰b²0 .¥å,g¹ûþoù§otþÓmD7  æë—4iªõ&I¨Ó%Zg!l¾¨±ž—»»ûçŸ3óaœL‡¹¢Ú´ão‰lUŠ ÚVýiÛ¶3Š0?¦ðhô¨ƒGÔLÀc8ín3»“Åa <6óaå|Ÿvß= +ªµ?fv3 +Wχ™Ý£ãÃÄââüÅî»G¸(íÀc<ŸÅ;ÞÝÑÓã°Ø/ƒÝY;=J8ŒÀÙâé³PÒ*Ù£M>IäÿÅkb:¹€…jVê––3@K³YKwXØié õ ır[,äÇXfíŒæG~Pj¶PîR°0+µy4»Ç3âyw¼ÀB9†¦ÖÍ£œ?ËŒØKÀj»ÐÝùϼ`ºÃæÓa»Ý/f. +Ëi÷f>‹ù ËÃøâÑvÏÌa 0qtØÄ >JŠÿŒ…]w¸ÉñðÚÆ ŸÈ ÿWQ™PÊÙ°p*ÙÐuņ…¿Å y’eÙö5_” Æ bû6,lò¾ó&6^ØdÃÂÆ §þÂæ:Ÿ-œsoÃÂßâF„ê60œŠ nXø[¼°Å.ca‹/ü=^söÎ&g¼°Å7^ØäŒòcù† Hd<!ùµàÏ7]íÆ ¿ b‰…Üâ#ñ}îõô¿iYÒ‡¥ë ®[úèy8ôæºûVþè5ÆÁÂ8ëO¥t…¤l‚æ FIPÓÈ{ÍGCztn»— (ýg;+d.­E ÿ6/lr]Xˆ÷‚ML_;¯t—Íä~Ì ˜Ÿ¸AôäŒ. +±ÐG͇3Èwþ,K^˜Õ5b_6Rc ˜…”Å–·Œ@J×¾ +ÊçÔ5k±…nà~:6^ø,øáb’U\N*}5±Ñ‡vJzüt?ì3ã÷‚ç`ÏÝDO1·ÚF2¨q7^øŠ¥[] ß ‹ÖKi’‚ÿ‘ÆðJ6U•^¤vvëgååüycÜ ‘™gÆ/Ùò‚íÆ77 Ù‰u]Z%å_ætÑIÀ5 ÎΟ›Ö.ž ¶ÜúIó —aý”žæ…ð TSÊQ÷5tèV'Kû¼"°[ †¼aðl‘ ŠOÉ„kPvjÆ‚4¬·ª-¬à’Ì”Lˆë·8ÌÌÚWæ3Ådhæ)Ѓ°É¸bå—³J.ðÂ, +â…:f(ŒÜÒ-c~æ½çÒ‹KØTúžÜ‘ „ ·¸<é÷X8gšŽ;¾Íú02­ÅÛŸ?7µåà¼c [BsjÞ™¯[ÂSãsHn Ñá +{„BƒnvÏÿ,/PNî“š3 +Ï~“¾Æ­éÙ‚V²6N˜INðmÜjSÓ: 8×~['ÂÏ7ºÞufC cí ÖÐÎFRFÅ91¾³K(1%H­KÒ‚©å‚²—µxlm·ì©~ÂÐ Rýױᢨïù §¶ õKvƒ q#ï ^ä6¦sÌC4Óu÷Ñ´ ±˜’¶Å³«‡~>Y&Íg +L<ÎÙ>—«=]ƒoFJ¡a´# |ŽÌww–|×bÜì/#p“?Ë Æ}úÓ;¶üî@  7¿|%€ffcw°õþ°3ñtMa¬¥è€,/”ægσ=jx+Hí|çAÙn²ê,J‘˜z¿‰(=_Ó´e×a¨)n=|ÁkO¡ ðÊW‰KþØjI/Ù^§ƒ»‹/FÃYÛvÛÂ|ÆÂ>ˆ=a!+Íæ{.ˆ<>“‹¦”K½¹MC/t{çÜóüï,jf•·W8Mñ"¬^&–¾$Q; †¡kN„Ãûì•q‡¿íÂ1P¥U5ä=xÃ`öc‘å ¾0J¡N°ÖM›ÏXB”}XµéŒp-À¯V¬Qž®jÀþÂ*Á%¤B;^Pà=`=.ØH ^‡ñäÎñb°„l´¸9XOV?cè”4Þ„…EBÇ´÷uoºþ½Át&ÓÚ œ¸DVÙåqÜ.6ðýÆæ7%7-’S,åæ…¯A€{`ŠÒy÷i¼°ëÓbÒ*ÓiOãHB : ¥`Ñ-xÊJˆP»¦ 5<êºç˜8®³iR Y@ƒ¬…"0åâs +s5úºj,” \gðà0$ âÑQpÖ•ü,Lø ;f´ ìŽÌŠ|«ü»ÀÝæÚM C¶1;nšôýhõõ}?]±œ”¼ +–_e…éL=´F=ä˜8Ë`ÁŒ‘ÇQëã|$\“ýG!—Ü=¸é²'.£Ï7^xÒÂò<:»Ó“ü³÷ö2¾âÌø €={”!ÉL|À¬ÿÀ»ðŽÑ£ý—g½;3â‘Åéí òéŽùüL#/FŒ£˜äL{PŸ¼ Ù%ZØ™NÉxÛ_½·P5m‘Ž‡bùÅq¤™B\ëUðËiá&Kã­—EûÖ,€Œ[‡í„,ý$Ë+tÙ6Žtpê(¥¿¦VXB‚WµäǾÛ_È'uŸM$Ïâ‚Œ·NÇäpørè•Ù£ŽšövN„IÜŽ½>;ÁÃ蟉•;DZ,¸wâÐ,±,ò§ø2‚·ÅÌH¾jM É< _ÔÒåøÂaf[2ò9[Ì%Wžvß“ª= +1Da~™Àb‰‚ànhé-ô§^ ÚóÂòDg¼°D«Í÷ØY~[Üy›×v â Q¼¿™\j«¯;o¡?Ï’8 NvüâKfòÐÙÇgë2r›…;Û”á,IyÓ°#»å .Ò×yá8¤½ ìm¼°Íw~€‚…ì†ãwCôVѼã6l·Ëö°yl蜬SÍã9V1y%:Roï:rò+&,мpœ<••Ûmã…à…óim‡xšu /¸Öè`ª—>ºà _à…Š‡±»›ìG¾öåQ2KGiKgþÂQì:·nP²ñÂÆ 7±@”pN°Ð,§<ƒE<9怓ÞíY³¡±É|/ì/Ãó£]D -Ƥèu,[A'¼p<ðçÞxÁüÌeoX8óÂ3,ð… t”p´ìa‡‹ø<Ö³·ªLa‹d /ìÎÍx¹ðÒ½u-f}ô£(ã /œæºúÁž*6^Øä–ÜÍG:ÂB¼iÌñ]žÝrl¨ "Ÿ­ã…™üÃ̶‹¨»Ž…Ó¸óNúAXØæ;nvÞ6‚pÒk%ËÔ¢ù gxŠ‡­â † aᘚKX/lò(/Ð{¼_µ‘vp8Œ•î³—¼›byü‚¢Oá öe^8™kñÓl¤Þ"&}÷1,œiè¸ÏÁ;ìǸœœá]¸lÉ Ð È¥A"¯ª/÷èÆ »Çmšh£ž³¯…Ñ­÷.Žîx—‹e½?%]ðü aŠi¯½ª.úò=Â’•¼pW÷˜ëŽl¼°Å®¹«kæ;ŸZÞ'ªä_-9ÌÿcÁ .MwÞµ?^9SXƾ‰Lßå…-CØ?“xåÞ= +z +ï¬ò +ºÔÿË-¾p «æ;/8 8›§œïÉ„¢Ð?ª»3µ—œóBïºA·H:Ÿm¦³5n¶†ŽiJ.ü–É ½Ñý£¦¹Ç]ÊÁÛxa-/ÜÄÂ…¹™6Õv?¼išãP±5N²è?Áy¼&“Ú!«£j}ý.#ï>/sŽ¥§ñp†Ç ±™¦’ϵ稙ð‘çÚ¤]3ûýd¦`FbM͇ÌvBrpiŸÃ¾'“Ò7^XÍ 7ƒ¶Æ?1@fÍìOëÞMÃNÉ9¦î¹9-´c8:S¸ëðïóÂQűqáµØäB}8Nx‘ÖáI¡D餪CšãZ þàsÄÐnEä×:„ª¦Ÿbá„XÇua&ƒ-¿æÎq† gC2i]7ø “u³P¦< ö&§ÑþÄ¢ò*:[OA´œ‹”÷Ó<¡ù-vÒÚx”{Ç_XÌ6²eÿöW<ºW¼öOæ…@…IGWXm$G‡m…º¶@£}S¬"M6RÙÆ£ìQC‹£ÈÑQ‹“Z›®¯’l¤]·» Èi +q¿ð|@ñ&Ó%by’Íš>MŽÂ>ÙM”°³Gx™ÏtÔX¿nÉÀs>ïX¥™Û©×%Ê“äƒçxžú ¾J™T·\ÙšA1oGk9q’ÈܬibýC&Y–™‚à/hS,eW“n“—b!™*L€3†|[¨boÉØy˜AsØÖs “}¬mœËO”óÈÆ8‡lÑùx7Q"XPN2ÕˆùHåܘmLõ”Œøˆ1o×=pÝœŠ[–%ý\,œò‚/¿íÓ[ÚšNjÊ×Åðç‘$ÁDXðuPib«P”Jˆ¾Ìl|ítÕ¦æÏ`áÎTXóÄÌùŸ{PKYî·MºÝì—ÚÉç|ð}MÆÍ~Ež]Óbþ‚–¿?É”¹±¼`ÝšùïxõwÖϵ.ñ‚gªùÊW®åS¾.V`A×$=àÇ·¼PC7!è^ƒà |ù¢ØÔü1,䦗{¯Ã̹Û,V–Š–JÅ¢ÅD5“dÑwÏ[ö%¿x¹ÜÙ(ýÉ< <\ži9;¸z‚€Ó #ß—d +ŽÇ«¦ÊI_¯•ü­¼ ¨©DÁQ(D¯‘û{^ÐU¡ H!©ÁRW¶Z—î&^ˆÚxbé"™ºƒýw>·xÀhYð‚©þx¿DÂè—võ³–?þRÏ–Fšf>øG!/•'rfÊ<ºû‰~ùL¶µ2–‡‹vK÷ `ô¸K,HÝGîtñ‰Ò³xºŒÏu ÏyAdš BÒÒƒ(Ò>¡ö]Ühå8HE›F•f°]LvéP˜U t¤ˆ#ŽBuLmcª— žãõMvÒ*§2‘Èãž×_àœšUj¹‡ÎK­Ò±ïåñœ·Lš9÷zvù×ÉÆéLË­gW™/Þ™± f¼Tn&“}?²TÉ–Ê<[v*”À;¹ý35Hû©ØµãÈ›;³lªFTv?NýÚæµ]ÆÂñúοAøõÉ¡?D^›tŒÞâÎkxaÃÂGòÂ×¾³T¦6^x·H·Æup,÷;òTI¶)ÿ)Bº ßte­JÝ¿Âäÿ^GŽ×oºþ½€lXø.,ø:lqÐ- }&¥£ìòÅuç/Hy|»/‘•òäö”ħ·§Ä2õãÅí) 7þ¬ ¸aáû°ÀÁ$]Ü.ŠjÅmQö>?¨Ãm¾?'íµÛÅûÙÆýFÔã÷öìåêvN¯Æü£> NѵÞ4r=K¾¸Í¢ 2?˦ÛN¨•ý«ýÝ=·/èaÿévYØ©Ðév¾ß­Èù·ù¾³QŽ»Wã8ÝODöóÝ ²÷ýسŠ˜çû{oöê{trG'÷+Ò7-Û°ðÑXè;ðΪû¹ÑN^û™ãg°xÿ.,„)â?|Lõÿxf5ÆAþ›±=³F‰/ß…ä‡aHò'(¾¡žê§ÅÚ^Œ…gxÁ¤¦ü²øÂÏ—o‰/ün,<Ë jçÙH¯Îö«yá,´/üI^/l¼°ñ‚¦CUá_…ø^Hâ(ò7,ü-^¸Gq<êÌÎÈ›y'~¦û8fšÅq¯ß,MÃc?×(Ž©Ù]j:ínßœw‡×~ä½ Ñ_Øxá«’S +jiÔ¶µND —‚Û¶×nkHÚÀxƒÖ í¦mËAï`wÏ잉VdûÝSct ?ÈFÚ°°ñÂR¸R `!H@íqÒƤOÐø¶Ô ¨}E™Ó*”Ô¤l[w¿»@fw/”੶c+ë|€´aaã…¥ø Ã(¸Dnã³¾l¢Qú‹$oOzAÊÞmb9ÆiÙÏ[æÝaKÙÌo²°±¯ÝšˆxÃÂ&Ë ç¡wn¨êJJ©%¥¬áß8²ùõüoÿæô¯ß¿ivŸßÜ홓¸oÁÂþB¤©»aáoñÂÍX[vžI÷¼0ßqüw`Aý‚øBþ)C}ù·›)Ãú¿Çnå`°ñ¥"Wþ `#}Z|ÁuuÑÙ™_5<¤‘öœÔr·ièc@¦Âpz|Æ ô±v‡ÓÕæfÝÙ\³Ÿ“l‚ýç?˜wáz¼Üì6ßÅ ôzÜ™;Ä¥¯„ÂÚr#Ÿ€…Ïâ)¸m94Ô] Îœ2¿šÛbݨÛâ?ô¸rôZ¤ ]'?NZiVÍx«s]IHðôcâÂõx¹Ùè»xázÜÙøÎô•6R×…?Å_ø0^( +ejÆŽ +uUëX˜:W‰#°N¿_غÌÖ â Qñ1µ-M5±d®”ó(f:GÔ‡Ý^šæ’\¢ÜD‹ŒÚyQ§ÊòBì`tÅÁÀ ,$UKb£šðDç'Ó#±ãØT-1)”£œŒôâÏ·¿ ‰á…D„UÀf^ :Å}§m$‹í¸ÐÏ"3”ìOuCUÔ;3qìT‡`ÁßBÑ +0±ÅmkÛÿ ŠÔd‡…Â|µ“˜ýAïpf愶¿Bj´Û‹…j2ëg,¸¦˜{h¿k•ÀûâÖì'EWMôX‹¶Ê be­Z8Ÿu˜sVðBawv©µì÷í¼`|çìqSˆöŒÉ‘±^;,Ę¯ä…|ÃÂÑGÔ`AwÉö¼ý‡/b!u*“Df»òÌôèý¾Fx-ÀÚ¯¨,»D§<‹í€þ…86-À'Ÿ°Šî*=cÁˆ()º|‡°®L µ¡ˆ‚;ƒ5r[Á„‡:Ã$a’YËÌ3׌ZV•të+¯wsø 3£T½áà Ä,Çæ1s1 ‰ÞÎ ¡jkúÄh‘3ÔewSÊç|ç×Îñ~ÊFÊ‘ç¡Á‚±Ñ ¢vÐc;c!É <Å…nTÚ4Mjó[2UôÚk,ˆ0SÈUqè€cŒí·*Ÿmª•ˆcpX‡Öåð)‹…XEœTa¡|Zø`i!Uð¼kcSa§'Æé0ÇÏX@@^þBŒAϱ7(VƒÉ%ìjh¼Ьϫ))³nk^¬WT(öåe +sU{©ê{UÙáh»nSîtà*Àe£Ý" ÿ=¾PuÝ•ù 9EûΉŽcÀÁ(U!³¥`f”Ê•6ÒÛy~Ô|焸:©\u¾–&ÖVj^ä:í¨.]0â‰ãRÏ¡ÐZÐ"Ð L̈R]¯é7cqÒ:ÍEå˜*R‘é¸Ðå@_NŠ4Žà¨Ð£S2A&è–“úç²ö›)îħÀíÂö¢ÄUäOËJte­K΄t­UrÖäʼc[ŒÝg†wy¸®Ú2±6,*ó +ÁEßñÞ[çµ%» ,RˆR3‚ùÈM#t€‰²•¼ðXø ø‚ë¬þFò\÷Æ¢A-×óÒUG?¯}e†’ÌcWè£õ²|Þ#ßg[,³?.%`LÇ,žæ6iÂíNÏ&ÖœN1=äóC¾k"?´tØþué7Ån¬ï<µÿ(hCF™aœD¢˜a¥Ú1ƒ\[ÂøżðŒôaqçýPÊI•cíªðVÀb2Á»á¿¡÷ì»Ã·/vŽ÷xsÜùQß™º¢§ÉPPpê6à®[ö{^ˆý•¼ðþq¤OËGòHùñSc”ÐèÆ—ÌÁàÿ¯ FgHäá‡/vöùÿ±â…g° =ð‰Ü¶–¤¤H¥‰ÍÜ>øÎïðüg°°ÕGú@ùß¼@qQ¤—±Àâ2”gZåœcE„ƒäsãH¯åõDM}³¤#Ú°ðaXxkÜùaßYzñˆhWSÆ#_!IrŒ½•Xx­ïüìúþ/ÜB‚ôÐÃXàªæ©Ÿ[2ö!qgµaaã…/ +oŸˆµÉ¨#]$¯ä#%+±°ñÂ&Å ÏÍ_`1z9OU­ÍSÝxa“7ðBÇQxeî?®Väæ)>¥×Âpë}ç·ó‚)ÅŸ’îÚâ-›¼A̺<ÿ 7×ñ\á;3¿>-Yé^>Š…kçµ}/Lñ…VmòAÒ:o‹/äÉx/IÊ,m½Ý +T’§7Fy<’´rú‚®__x &î–›|”øú¿ó•¸3'êÎO)½±i‘dÈëÙˆìâk½ ëy£Yï¡%äJÿÜ<µYèKØâÎ Ð"…hª”(³® uJž•B©B.ê#ÿXPÏò¦ D¨îÊÜÿîNMÖ‹V–*Å]eÔ¿¯ºÎÊS5 +ž‰õqçú¥ BMÒ¶¯DEmAE“w]Ru£ŠÖ#W•QÜul?¦jÓÔWñÂÛ±°É&a OÒR!G™#i28PÐUHÅld€ÞÇ‹`ÛJ5/ŒÛ/¹É×Ä뜛68%MjàBeŸú”‹Î‘xœ®BŒÅ‡´¤«}ç6ù(¹ë;ÓAX!j#–¶1c][S +fž':¤ŠÑWéN2¬†uñ…6ù0 Û¶¾=ŽäuJTÂŒ# °‘/T´ï”r„PU/‹;S¼À2ù28øOå`PJ³w|é9ãØ—›ö½Ã%¸>÷?ó|ï^îQÈGÔKÊ}ϺÈ&mã a(YO‘Ïsÿcµf.Ûš¡ý–¼Füwm… ôè×"”"ïø=§m×ÎyÚäµÂÚ/ÍýŸ ]˜ŠH»ú`‹7Žó¶{ÄVtö£2Ê°rôõ¾Ï3µFíãß_HD!=ÑlŠù±qçË>-‹Üð•E$Wš=…Q^ñ*+¡xYo‹;'ïŠomò^x~¾³<É8ºµ]zi€V¢³^õù¸‚óðaoä…ŠûÊÝó]¼\óïaõ·Ë‰¡¾GçlãÖ¬‘û*Z³øîÏá…Áü ñ¦˜ïðÓºvŸ´‘$¸(è­$WìQ,01U¹}‘Ǽ÷xÑù$ôÿ_½”ÛgÎÈ “M1?MîøΩ¢2IiƦ9=t””íÖö¤’9îöñÏÖnbA_ø!êŸ6*c*UoòY’y¡wÛw–]ÚÔYïا¾;ÊÞE¨‰0ö%óqQ£dÀîašèêé0 +w膅M¾&áݹÿ’#±A¸SÒ3$<Þ«“ºt:éy觞÷ï_%LoX¸)#zI3YrÇø3÷,û‘XX9Ž„„Ÿ°Ú`A"âym™$ŽOú¨_Ž#±x‹!}(¾‘sÂÒ $Y¼f¾Xµ÷òz÷,ð Ón^räC]‚Òuã˾sŸâxÍ„gÑË1ËkƒàÅMY)2ð'×_øû°¨ü3±ÀÕn>Tç,éV¯¹n´÷£K“‹ÎT Fœ(y#¾°®nžÅ ½ZŒ¬Ÿ°Ô”&ê 2 +þS°ðÎymcE¼6Ky)v™Æmë›Èý8w®±ÏQŠSiÖø`:„7rÍ㛈fî¸: +õô‡Â¸NØ·æ:+ú6ëΆ..A¹Q]ªeM?#œÓ¬1\AXðëˆ7ð*ÄD ²1”ƒ NXCr»`*y5ö£Oʼº_X· A™»™¹ ¼m²ÑIKGjÞÓŠÌrýc°ðÆùÎäQBòZ"¤ªŽ'uש(]…uÑ)RCŒ•§:®HÒ´Aâ +·X7­c­©x¤pt¦:³´xÑ©'ê¨h= +ͦ*ÒN[Ǥ†ýpÜ‘„Ãa&ÝØWAï–ª)UZRðkÒ6‘(u!"óS¢ˆ¢k•¢›±ÐºRµ«hGNË/pÕ¦+j…ÑTu!"À_Ž ="¢Ãñú…}Ÿœ€!Šgw&~ª•!ú-¼€L0±è<³`ll$¦€J•›…¤ú 1Ë&"ÔYœsEµY'R¬™Í%,2›ªˆ]ÁäÚ+íj%´íÚif•ŸPQ³N'‘7«oÝöqíp£Ò3Ö/¨¹0¯ˆŽ§ÃèdÎÌ¢å)9`îæug–‡k½ŸÁ kë汸n“^šzþÈUÙH2/¨Ýãü 0¦Nã©ŽÉH}üÖÄL=×ÌðkxÁ,ÙÙ¬k  HÁ í¢Ðfmg=âέ ë–F§©"¼ã5sº˜…ණj¯èHSãx”"s£&a':§kS»>¨ùÖ‰"ižLÓv­bx!2Ïåì/sî‹Ûuj…ª1 ŒfÂ5?ÿ0,\áϹ3÷ÿP:ÏL•&¸ÆB&ó«“¢âÎÐf}ð¦ÓS,´åÍ$Î-—ÑpMýž_$˜<3C#%yÖDP®zn–"„˜•a¹¨Ÿ”: kG à… l“2Š²tÎI7XÐEêøCEBÛ[Ç¢B5aÁ‰“Úu˜;'.£Úžè$Ïb,:j´Ÿ¢ Å 3/,$\V`žás,˜U +ÇÂBn´ôšÿøêÎ’;!»æd;ŽÿŠ÷„XYûTúŽSéÏñ(/ “³Ò&¨è)䵈‚Í®ka—\6Ý¿×ƨ£Ð džB ïÄà:ÌXHUfF~D™NÑ`ÁpCØF™5|: >ˆ±žŒfK'Üa¡îŒÏÀÌþ¸ã`.‰Á¬¨kZ·?”0,™Å²:qŠÀ`?åMIžHÙîo#ò—Œ'¼@ŸËjýT,ääq,ˆt Œ‰.èH.•“DªÆ*ÐÆF—7蔫‰ãÂ>½rFpZSp¬w¼`Ü =¶ ¦žV,wUÚ8­›@³•¯»-jkO8.!t‡®ªÀ)°1B;©ÅTßSƒ ©Q§ È8NYˆs,0ââ£ü…[_q±¦¶ð™Æß°¥^ƒ…_Î ¹xÜ_ðˬx5‘«,™ö´Ó3_ʱ÷4š’š£Fnêv]²±òéÜL-åö¦”xà±mÖ©ÃƳC·MœiêÏu_6~nâj4îÃy9JH›óê°´!½,Ja8sGÁùà—ä‡ôaN³Ð¿ ù$yf½¶Û« w÷m¤„Q³Šj"¯nëx!“ÙÔýý¼à}Íêö¯”Ößódµã”ˆ Ǭ%ýY_}ž_Ѻð™µHn­ävÉw>å"G‰¡ÐˆUÑ/ðÊ©°6ÕŠg°`×kû)¼€œ¯]*¾œƒÁæf‹Õ +žT04Ꜯû(‰:˜tW¼…£5ª¾:Ý“Åât-’s,t»Ôä® «EöVðÂ(Rp+-Rí;ãX0cªoŠ/<Î :ÿZ3¡7›} õÇ.„²Ï +¾Þˆ/ç`ô|7ÁÿYéûÓÀó(AfäC×*ðÀÐä!Ïžâ…ÈÌ€¨:MHÙç…œçcáMñ…Çya“aázÜytSŸŠ§’‚3ö,œÏ_8ÂLëØÑ ­ÓûJ]ò­Vð‚kà;ÝW¢­|±Æm,¼/î¼aá]ÂnÇ›–mS¯IÛv!} ’˜ßÁBfªÒƒC÷Z:N.å¥%VðBlþœ./iî WËKžøÇò|+l!ôÖí?ËÍhåÿ‘äúí?I>ßô8UÚ¿·Y¦ŒÞÊhæ&Àžªòž6”Øß¹/dÐ¥Qbg™›ª?ÆêÂ,˜Â%ŽU0)Wa! Òô7,]7XŸ!-Z?†¨‹eW€œPOXp˜SC1 hÙXUŽk÷¨vy0 !E1T‘öïõ@<ÙURqØh%<ÚU °HìeW\Áñ s“¥¿ÃwfaW…±@ÛÆø I¥ÀAµ® +£½µ“›µš’!Wæþûm‚ï ®²[E¯vCâ·Ø56“êÅšk×Ç‘ +ÕàÖ~(Jb¸ 2åw†œÇ´V¤¬”÷ç°ÀUƒœÖ÷ák*+9]FÖÊñ£Z€Y*›ejºŠºµµ¾Ì8CѺ’ ’䢲™©{g`H:ÀÜ8oÀ Êc¤ ð[™j’u ¾¦ÔQ:h?ǻʒ+þ*]WCÒ¤°ª{±ˆ[qg¿«J7Ñv +Ó¡š™º"ðW9M¢eíTQ¾b)q»"ž³esyš˜2Ñð¾Ó^zì |Ý8RÇ‘ÿ[ÀwU +xêtÝ]QÕuÍÚ'1ú+Ûñ`xÎjâé¼°›}OB±ÓU½Ž§(|-œÁ1*á ©Î;l +¤S`ûÌá?ç{bDˆ+ãHyÒ÷+“+Ü·ž¼Ï ñ,<$ß‘ôKâ “‰Íecò£øN>§Åï;™ËQòÝÐJ~R1%Éöÿ3ðí«ü4‚Tv?É=þêú vÁþ˜w?FèW`á[ò‘~G|a¢U»â¿êd¦®”PÊè}Q7âÎ}½f]Ë i\´Þ½}Ï×_Øxá›l¤.ý¯«ä&W*,±û“’ó^w¦±™ÿ)îñ‚ä©‹6^øSòkòTõ9=r[÷î>·s¶sSè`÷ü(‘Ðä˜Pnó4C/ýÐÌñûŸZ+l“· #Åq^Fo†Bo]ž*Û˜Ž_Â%¾Ø­gû¼óœgT8ØQˆ*5T*4Ë] mšsê?à/ .=݉±Gˆ«WE×â<ܯ°aa“ÿŠ¶Æ_¸S+ ¥Œ¥ˆšœ³†K Ñ<3ŽDÉ J”Éð3 G†Ç‘n”âßä· +ŸH/ÿê,~ÄFú¢ï<›efÍÉ(³K²ŠñÊôÄUë/ØU:‡Ú&âëÎIÄué6íø[bâ _žûÏü¼ y܉/øª +be­Å‚4Kì¼ZüšøB#Hí‘ÐW£ —¦énñ…MNzâëkÚfÜ_9¦º + +jÎ"ר-3½êÌœž_Ü +^ð7ªžQ˜ ŒË0ü¸ó&ëy\Ÿû¿Î_«°Ðó>»…¨ÅA×™u +ÌÆÊ}Â_`bÐÈ) +€ j\çI/lrÎ 7Ö_ ¯ãp*îÖÙæn‰üƒ-ð…­+ÞœvGHNoš×°ç…¹<ùÃX8å…èJ3·Zß°°ÉzñÍâ##«Z²ºUqæ«g½h+6v-éiÑ*–à$aÛt$m'íî n•O9ìž ³{¯y涧sÿ–ýäëÒšÃ:q.ßí-üeXxc|Á©tv_’{·ïÜÜrûw_’å³ãÃôíšq““/ïGåà´ýûòÿšXÛkå¯óÂVÄì=rc-’?…÷òÂ&ï ý<,ŒmúJ,<3¯-ª®Ø°ð·$Aê?mÅJ™½ò²6)gÃÂ&›lXØd“¥t[a¦M6Ù°°ÉÇIN¥þ–Ðι¶váŸþZ”jɆ…¿%챶„>%'Ë°åÙsÍÜúÔÙã ÕV€ã=òšùÎÏþêJ‰gn'k>Õ†Rø&/¼/î\m¼ðyt<|Xxq¶ŽgýD3!¹¹ÖùÆ /|/þïúηåæ0þ;×åÙ°ð&É‚4-ó……õë;?…œsîmXØdã…·Ê°aaÃÂñ†…M> &™¬¶äZ†ÞZ^ ÌNÉ®äæ}, +²iƆ+ÜQCißQ$þ +/DBU¨K¢¾aa“û’Deé’ï,UJË6ЄX¡çy!>­[?T^^tc!º·Í_Ø°ð&1ñ…S˜F]ªIåiš'4Ëžã…®2#£1o1Khžegaæ›X`oSÝ°ð&±ñ…Oâ…Ætâ8Õ¾hEª±RNò/ ¤G"]*°µ"ÎÂÌwã *‹roò?¾Úû¼@>‘PÎS¡(>³àVòÂ`4:¢(ó !ý(âaÁÐeAŽj|×]µo9íï¿;ã +^ø$,HU³²uá_«@¶Ú_`à/ÄÊÓ\°GýË Duóí÷N´ï8í¯¿Ã÷Úßáõa¼J¬:ÒèZ9¢Ê¾0ŽÔ(á¨XwÊQéã¾sç8q(û~É Á6y½$u{§@dnr ?iL•Iž;@’£ü ñ…8Ö S¡ÎG.ŸŒ/‡ÉñÛ%)Äø†ÓþzÉð=^ø¸øBßâ°P·®z/”Ê ;çã­ÂÂ[~3ÑoXø/X@? ÚªáfEÊ•qg·ªŠ[úL,H–`!)Ûаñ +ù¶|¤w`soPaè£My¿ŸLuØÁBvjÑdÉS¼pzXžåb!G oÀ«Z+ÂÛˆáÛy9DT2Ž4œ„ÃrÇ}Šºàd€ôâÀòý¹<ïÀB¨,jº)ï·óÂ'ÅN3€rÿ¹|$r2†šøÉsñ…7ØH´°´€6Zø~^Ÿw. ×—.¢$)᪙+ ¹_`/Ò¡¡kx¥El°8ÔÔeZ÷eæg:q‹E¸(“µqç·øÎÈC³ÑÂæ¬p×bª«ZW5€CPÒèTð‡`âä+x¡˜´.UQ©8¥Öõ“^ð¾È84/ÒOæ…‘b8óæ-¼Å_ø ^0 D' +Û:Y\$1ÉLBq³\\.ô¨‚û¼fvL¼US^…?!Œ+®‘o’Wùœ þ‘þCOÚb£…wðBEeüþ<ÕØ`ü"ºÎQa"|T–¸¡²–QÑv]×÷y›ù‘NãµN×E‘B±È2BKË}™0ÍÏ»ßGêû~|O¬bå±Muÿn|Áb¡,QÅRw¸­ž±èA˜·ù}^(vXàp™¦¨€&,äRØæÇŽ;3oPxO|á3°0ªXçðÒ¸Ï Sí À®4x]Pådˆîó‚6UU>VƒÜ ¹2éæšò6ÒˆÚ5M£x¦”¯z ÑÏÇÂÏ™ï,³qÔ’Ùü ÛÅ›~L¡oÏP‚’u¼ÀúPã +]‚”.rSâëRíÜ>ß•² Víƒæh°‡õÍÔONï#¼Pk•dží÷Ó©ûfÖ3©Cº<Ù„F|m(g…ÓQ`4Q̇€6^xÃ8Ò ©íîy§pöè8’Él2s^‚WÃUÙcãH§X`amYá$ƒÌúÀ*-{˜NµŠY*h\»O?QÀñ.,6×Ð\óvX8ÛÌb;¼°îüà ÈGa!›°Pï4)÷ÑøBØ’ªSø ©Î¡¥>žx!¡k±ð0ä ,ô¶oMÏôÐjˆÛ_å3†jOa£Òvå鉉/{«ìå£X˜NØ4§1jf¹f˜`›Ù´ÜoM¼@ÙÓ®ðÓ;Œ~Nu›5ãHDtÉçñBmÿsã1ü(/Ô +c\ÁG·sØdë÷“¿PWÄcªsä 9׳ÑXñ%¶jû%^YšîM 4™H' ±&-á\W¼ç«X [¯qNȇϓñIìÜF»y ›JŽF¶‡!ËÆ´>ö¨_4Ó{Qcw=F²{±>nÀ¿ú`õŠ/,y·\g™NÕü´Û¿Ë ‰üŸ©J_¾Ocå™IÑ“qçÉ[¸Eb¨›»vË—xa¤AmÉà*/€±/ÇÂhCÁþ8)yИ˜´ L7î2œ-eØ4»hxOh0¦``ÿàÉîk`¨œš¿€T^†°[Ò°±çp?#XýãΆ2¥ˆéNtªÈä_ØpZª$QBà YÕ:¤-žŒ;Oê\Š‘^ùsŽÃ×xºõŽ &µ‚ÓZ’È7#¬ã£6²}kŒ»iz;?¼%šŠ§¨DíZOHzÅ"â‡'¾’Ðë׋°y¹÷¥¬c“ú|›¤éÆ Ob! ™ÉžàF5Øãg]îò‚7ÅåXÌxǾÍý&àÏæ#±øj—kRIÙñ… 6’Ýi²‘¤‘5åI:Þ”xú(&¿?MÙ>PÒœ¼Ù¾ô$ïÃÓÊÉv“²LO’H8[`¡‰ƒ9‚ø!÷–ôl>’f:`!ºh³œ)ÝWx<ã`ç;Ïê ú룞­´·¯a”6XœPz¶»nÒ´ Lì{—H2}k î¶M±E¸ À¼§ ’[¸Ê~Š6µI¢b/ÍüÉ'^À¶©à²iù‘¼@ÁÚs·ù gáxÊ=ØHÆo¼>²¿ îª1Õ9”6Ѥãõã<\Ä‚™51õßÍ.cÜB®v9yþ;ï§P—f¤Šßñ 9ˆsϼjJsÞÛ ´—[Çfvâöó9&^HMŒÞmpšö?Ä_xo|¿‘ºõñ…Þ=tÙÿ‡äIÛq(ölÈuÝ4%ïÍ´ž5Xˆ—ë§È…s‡>Ÿ,$»×nÑî¼hoš5å<ˆI{ v“”4ZŽ©Nµ1¡ÇiçxÁœS ÄœŠýá½X¸xX09Á7SÎÍj5$šúè~|!/Ä‹\ Æ̤E†É Ò…›6eö7Çêç|¤4ŠÊÃÍM§ Ât7¢Ê"Ó½§‡„ØÙ›8¸ìøàó¥‚Ïñ…Ý0mc¾‘ý”œ¨¦Ï>c! ÍõÊO‰Î}8/`ò”tÇø¦ÝsÍ4ë±ÐB¯â…Ô?Ê ›3ï}¨™¿ÐÍB¨±{X°ù¯Í|Û;ÉÍnI¢"=Évµ¼ÆºÈv(÷@R‚…4Ó°ÑQÜyÊ—Z6#mc +FÎòò³bÔÎ .,Ó€ò‚{’YmÇišòÈÔçAz4äc&ó\w®Ï_€æw<`¦E€[¼°àå”ïáËEFÓî$ÒÌ=ÊGšÒ:š¥#ÀÌð€¿“,ò±¼”åûêæ}®d•Ó ÇXx-/\žqsìe2‰Â¨ÆM³@C9ʇ°Š#oq5• qsºà…)Õ·›}½¨pÄ vÇô¨²Dû!a‹…Ø|Ð/|®Åf,ã+yáLiÓ::p_…±‹Ó=ÀëÎu,,¤6œlì$û +GáÉ<êq—rÎl‘ ßúÖ–L}j¢iB4—ÞXò‚ô&—Gö 9ÄÊ'^(<ùÃxá­ñ…ÆÂQÜÙŽ#5zá8’ÑÙ½˜$7â]c£´ž•Íì=L“rú¸\ÌŠâ~ïÕ¡?IdѺáy³¦š÷ã(2³¬§WkÐÈiÀlº:7÷D^ÌS§#÷ys§ð`¼ÇB6^ø}¼0ö+ÇTùªym`úì}Ü&önV|1£M½¿‹‹™à2ÿB<S•¬Ÿ u$OyÇ™5š +L¼`qÍÁºªë(Ü-yaú î +»ó ÷itã…ŸÈ SÜù,oô±ËI«o`á|^ÛNn$=fªu;õ ‚#Qlž(z/—}¹tAÜÙFÚE¥›eõ °–8»À þU7=ÚcÁ•ãOã‡jÃÂÙ.p}’ty`„…Qˆ&CÆÂyªkƒ•×ò‘ŽÔÕË;¯ÏYJgõ_.baœæœ$AH^§å\`câ–úÀ „±MÁ8ŒAÍçˆâi’ß¹Ô&ñ±X¸_ÈA>LCÿ…åÑÓ–“<Õ‹æ²7vSö-wÏWi¦ÈÔJ,0ߌ{6ç¡=ZÎÉ×ÆFJ/ÛHËvçèu¬;æ¥s¸"-°I±í{÷ç¬?½šSî–¼0OçˆâsñäÏå…O[æe££Âý:zk4—ºp[ùkÊÄ™Ò9Ó”žáe9&» Sÿ‰vIý2¸•ßù8‰ñé›EdÍ¢»±ï!ã‡,â g£WÁ"Þ~4Ž4Ū{v.ûøÂOä…”á•XHDðe,ÌÚy©®ŠÍiØ»íišó‘ÿt¡¥«xÁìîªÏý±ɵ1Õ“Ü<æ/K +ì^7 ·0XÕg^»â«°™Ç³óÊ‹ãH§ŽÛù8/üb^˜Ô›ô,ê;;±õ"OáSt¬{u»‹é¥'Wïü–˃•—s¶§y ·;«bvÔ9¾`†ZÑ‚¢ý8é1/ظZz²ÚhzÓ|ÎŸÊ ¹)M¾ñÂÙQqùË:Qºt--øtaƒLã+gê(Óå Ѿ³-œajÒäÀ혿0©ú¾n^oF‰ÒF^ª™¨†ñ’üäìIï(î<ý±OŽ‹Úå?Ø_`êóâ À §õT¥·K½<±¦âœ-:ôÓ(Ó”îéîÒ\W`¹aéI*Þä÷^«ize.Ïb$v0^z4P§¸@]»åѽͼ`>êIæ÷‘Ÿîšá©‚³ŸË 6¾o¼p3¾°÷¦Äÿý{óô³E-»ô´¢°î4ï7uÙj,ì:óÀ“ˆ¦É™×ò|®Îk›F„¬eµ3nŸ+<Äw±Bvâèø ,Ðå.Àºïe?Ø_øĸóò‚ šÒ}\·Óøžáä[.Œ™ÙUmšÈ³ó ëy4ŸDr5vÈkÒÒœm*3N ]-u} 3-Y5"軙ɒMspv}ÿd›3’w‘ëyR‚µ‘š~+š¦+î”7b(Î÷£y!Ùxá/˜ýfžgù!ç~ì +m/—`˜'ħØÍÄ„hšö»ƒZƒ…yjŒ™ÅS—vŠƒñwõ*×ca¤‹ðóœ=‘†v ªÝt9?2ù‚4öFFå<%nöáç³ ŽK“2N55qäõŒàñ¢–ÚÆ ¿‹ˆÎqÍùô˦1«¹5Í…5丫ѤvbÂ.×í0(´ ‹“™à0´³oµ¸ÆdMã[`ÜØv± ”E©É÷ ps8l.–ŒÍ츹¨þ.@ÔÔî²$ñ:,˜vuÝŸ Ç7ÖšºQ7oŠ*LƸéòø¬_Ä +–ßÔå¡ÚŸ³Æ瑦ã²b@û™H3~\žêw^»v¡-›XÛI©y2­:Ú©‰üãr¼Ð37ÁŠµAXï—®mb>[|;i¼7óFÓK „ff§YxÔÎ5s›Órˆà›ÀÖ]1š1.§É@pʦ —Îxi?UíîÑZ6ó®iSòåZ]ApJìÆ ?˜¦Ìi„¢iŠrxmÎÙÉ‹'‡Á7køœìÕÛ›ïÿzf +¾¥Í\é÷ŽvÙìÖ‰¯=šu¸÷l]a×$Z^mmaSÉ“bKÈ3ÁåþuÑ{¥ù”ƃ^îjÜxáwð‚]ºëòZç£)³nfܪß%GF/ÏLfß…ƒ)ênZU=ïV…ÉåI¥„ [”ƒ— +É_<å´|úÉ®>å'.±~Ÿ2p}Ê|ã…óq$å\ÁÂ&?R¶øÂËâ ›ü|,Üá¹ÅVÅ7Ùxá-¼@^‰ån¼°ÉOå…È}¥”ò6Yà ´êœb›û† ·iÊß6Îã=Sù°ñø¥üâp/†å¥Q®uï=y?8¾ð)òÛ± G¿Ÿ—"4&ü0GL˜!ys¼â©Å8¡½þ4Ê`ç‘É/DŸP_lÏt|áOcÒŒÒï9/Å­Z3%!«Û(ÇŽô1¡‘P9’++…Í_uúxë%‘®:Vréa„ÈÙt£±:+=%¥SÓç~¼&+æ™K/ü8,Dõñ<ËÿH œ„´k+SzÌ,ðXÑS-(M[1†Êd²Fv]) +MY?JjV…ÎŒn±Ì>˜wMSÔ¾œ72Ê2*i©z^ÂA°IÎ{dA;Ž¥'Í+6ïÛx7Ú6™„#ÍIJ0Ý5m"—æÜ©í(æ³ÛÍ4³ÍÍç`µe¶?)\H,¦Ù/ü0,ȱk•jŸìì¸ë"“QœÑR(Wcèè:6²Š1c63+[â!¨YêE>JÐM¿¨)ûiÎl¨†r”Ql6²8r«e®@ÜE”×ð‚õÍ0#êÚº/9ëÓ +ûL–QZ¥½„ ]S¥¬äQ<¾i·jÎæ¦1§Q)¥çJî–æŒÅEL Kwa÷Á53Lª"¤AÛ…”ch˜†e4„Y5Ðu¼ ÏC[Íù³¯¥tÝè-X ëç.ñ?Ÿª'%eNGJ«J¸À €…F æu5ð‚ðù¼6 Z;¥‘ðU m“øÊ)Ä@1ˆDD]ë&UÛ +çEë`Ò/ȦEž ƒê(ìݵ¸'mD™TjpTLÕU-f¬kbPsp¬H%„G+U8­Å«ìŠ‡²˜ŒQK0} ¡¬éC›–Ø1×Y% +Gy)Nj.¯TŠDI líºøÂÛÆTNŽ¯7÷žk¥ÿÀø(h¥ǪÁÿCò­þU˜0.ü ‚ƒòà"#o­¿`×eÖ%éé€3Sp4%²+’Üoc†¦zõ¨))’®JrWEë垊"1m‰Ìy Œ¢ó$‘ˆ|Á“¬£C˜†íˆøÚõI·~îµ~ØúzTæK`¿dļp€ ˆŒÚ0—ã–kî›™¯`tÅÕH'•–\’•ØH¹ãP¸‚8‚#38?~^›'WßÏÖk{®™âã À Cßú ¼:âIà®xàôÊ`aäbÄ8sÜÀø ~ÒÛõkU‘‹ P*Ç¥Òú ÇSn^äáÎi ¿Û(.À'`95FiÝ9ÊOõ"® xeËŠÒ4œŒY#ØÐ%‘B )¿n{¸2ó%d€Tøš>ñtñIáxB‘š¡Î!Ûš´ysz8B€yäµ.#Â\^)¸|ÆÛˆ}~Ü™TÈãÞƒwtú™X›>ÑŒGªOäð@ÒïÀB¤@@UIZÕRͼÐGÄ(56¢sMHiúh°£J1JƒN¸*ÌlÐp^Ô3TG¤È»†ÛxÃŒ1‚¦,È9G¡©BÈba,xh…)ãÊ'M ‹@ŒÅ‚”YALá&MÒc æX_TUd°€Á1ðBÖ¤zÀ‚èÌì% eFÅÚ’~>/<»Ö9:óë×w~_ÜyÄAß±Œh°o°`A¼=/ cûç ûÉx²ëük|mÒ%fðµ+rÍ;OzÈ:áŠé^ I×eæИ0Ê·¼Ðc1æ¡S*V`¡í{…"LhGä„䘱«Â?ÁðØ6~Ñð‡< ž÷$„æ…Á×HÕi‘h€R’eIÓÂQ­§%!}k*ðØyG¨F/…ÁÂÁFºÃ o­ö,N×wþXèx•ïÀ‚¤Ð“ÊïqM ‡“¡þ ð¢]çµñ[e£Çt­à÷i‡¡-Áwî°pÆ^Õ¶Æ|[ÕN[Ѫ­Š65¾s-†¬´6¸±µ<á¤"2n;|çAaG'Á`Pg¦ÀWf¢¬Dð5°­vŠÚ®Æ_ 5! ^ab#Ô`«®6W +€o¡bsRBÆÒðmö¾ó^ÈÍ ¤üGa!8Á7ýX0µøßwþ›Bmõ@eã²1Y_û4J%ª{cÄüzDvÍì!"•Kkú8wÆ!õ«®8Ṧ^Õù~Ê:»‘¤qjÉÂzô1¢^{2^u.ǽLÏBH»3Ù˜ØÆ캉£ÔÌlÐŒ™X–‰cIót̬Ìuò2ÖÇ*,:Ÿb”™`V6×”¤ÔLpëR³1…׶=Û³/(e™ «Ë)fOjsãTJ “c/í8©´ š+Êl0m~g8Ûm¶Ü »L/›"qÌ^š=Áô1ÀÊš,Î;_ÄB_9¸ôÁu:þ^𧮹y¨ú Wr0Øú}m€ztn¸õ¬šÆü 2þ#EâaOŠ)(/$ĉ‡6ÐöÁ€}žzc0}‘ +üË#FŠ)¿ &7o=‰Lõhø-e´ž4ìÊÿÛÀÒ%eù²+u7%ûB|Áó¸ß+_³¨‰3ý/¼é[éº-gþ-B‹ªª?ËF*ÍÔÀ/ÇÁe-Ø“qçÄ÷}¾aa“÷ÚH©Ä},é/äàƒ:üùŒ÷Ɇ… û>™Þ橵ùHwÚÙ°°ÉÇcឬÎGº-6ù\,ÄáÉö’?Å ÑÉaII7,lrW’0ôù‡älw'4‘wåS¼@Òã×Y'ÿµw%Š­ª@TTÜpCÜ"ÿÿ—oLbö¤M_Û[¦ï¾´Qq›Ã™†áeß¹êûÀaáoÉ_¡Å ݘ @†¦S¥xŽDØj=Ìæ ÙvDh"«uÙ<ƒ_p1Õ?&?e|aéÔŠ”ónnºDëxòÚ\‡>ç ÚU‡ Ð]^È(oáÖ*^5%Ô$;Ö–Ú›…ݪºò,àcqXp¼ð Xhè®NF_÷ëôè*B¥Ö¼kZ%*ÓÉ(óBÈsà°®ZQO¤Ñ‘‚Æ-g%¡Âçž–kêîÅ‚ã…¿íNÿáɪ ô<™i9ç‡õ8ïÆ‘Î'€ÐB¸š2d`!‹Ž(çR šÏ´Ã‚“ŒÍâP M?ÇÆ„©ÑpÄ"aË€—Ña¼ìþø‹kl§ö<ãÕíÀsÁMkó N~.ž—ÿ# kwÇ K‰Ýïª!ùÔÍûα6‡…o’ò§Íýÿ¼ðã  ß$ì÷ÕÙþ /4â,ŒŽþ/üœùÎ~Qõð!|ÌµÈ ñÁË&Ò×:ë¼.~Ž¤Ÿìj4ý0ÛøÄl;J;O‹6iÇ NnÙH?ƒZMHíÆõ½—œhÆw’w:WÙ˜=Ç -‘8T+šz”Ußâ¸D¤¦\RU +žî Í<æ…$ø‘”ËÀÉW<ÙƒÊuïûÕϘ¿°“íN{„`¾éQ—d×èd\î)ï9^è§SJ¦”J¬›‡iÕ5DZ\FM²) ")Š„Ú%Ëþo¿ç´ÿ¼Œ¿¨žjç…Î*Xhpd!Q3Ö‹÷9[zÖ³çx!‘sŽ0 +±žªÅ(}báS×ZŠ"~ öò¦úŠ6®âãwÔüAX8˜êÖ gíæ˜\xÆOÄ‘|ªc>ƒÄ;\#Uª~-Ž´bÁù ÿT¿ µÅ‚Ç RAùUåSü´¿`×wþ,ì/\5V.Þ‡¼°_Žê$뢩_ÊÁø&^~×rµëZæt÷ç…ðÏä#ËÏä…Ö.›Ñ:Õýÿy!¤`;¸<Õ CÍßíüïÀ.Žõx'_Á Zñ]PÐÔÿ©¼`/oú–7Ò;Íý^øV¡´÷_–žœó‚š>ÒŒú™X(9Ђç4÷;xá;Åç(ôÅÿ89½'F>ÔÊù°ÅÁ‚ƱsŠûçx¡¸¹xñ¿‹UË›µÒüL,>:Zø{¼ðƒQÊ@¾i|¡ß¹çÿ-¼À:BÚÆ=¨óÇÂGEÏ°PƧâyÞò`9--<ØqyíÜaxådx¾yaîM}!/|ëøÂÆ•ñ…¨JÏ$‚<*ïég i•<}Öãš)ÙÅÉÖÓ½m. /œ…-¾sÜùcáʸs4\™7˜A>ßÃìò,â »2l,HÞRþ¶‰‚ø½SÇ o䣞›n:Ý«çíg\Ë ²çNY¤Ã9† b€ïŠ7J^ž Ž>Î W± ó£HXxÈå6/¤éð/ÔrÒ3,äY²‘BZô=Í3wÞ:´”:^8CUIç‘]šY]Á™åßÖQfÕ3ÍoÙ-u˜‰žB_p ædgÚÚ̉çc® ¶âxÁÉÓr g*œ£zÞ¶7žÈØc!½ãRè5 _À N>‡Í°˜QZ|údOð Aè°ð'xov_’ø+± c$)ޅǼ òЧ$Ç ¿CÚ7'ï# ¿ ̸ Þ;°ð/èäúU8,|žê òŸä;˱µ+ê¼Gjlùë¹nõ®ëÚç°Ðéáû:dfý/J"ýi“˱:Ö7¿xq–dÑ|6«3ê™À/v(û&²áü¥û’Ÿðo¾…ô Íœàˆßš“ù4ðTØ1Š! äaÄúP&N–^=‹°³kîmGHd­—¯6ýüðÃÆœœRZ¿¯3È Ñ—ç‰Ýw¾†…bƒ…8±cÆîÚ öã àXÀW”à ò/ÇÎþ Þ} ý…hã]¥évX:Ž=½H¶ÛRé[8|·õ±Ü|›áÖpÁ¤I’ß‹…_Ç UYûÆy]ÙÈ#¢^žøö/yP`ÄBïÓ'p_3î¼ÁB± Î™þ×Y[¥ËªaÕ5»X¨g3†¿ÑQ«òƒýÿ¡Ú•ÈÛÖÿÙöŠÊî‰'[±Ðdæ«ãþÁ²9a*Y±cw¼ð?ŠèFÞŽþ›Z+!#ÝK|Œ¡oË™ס0IJø¯´ùH{‹N2žIìʼnD^q2gQ˜Ô;ø%¼‡kM±­ßžIIŠ¶¾Ãñ°ù€…íÈQÞ@(®`Á eŸ:^zØ^ïÿ^~q>’¨ÆÏ,<-Çé³Y;×r¶M¤g•U?Óƒ¦,œtÔç¼p“ÄÝ¥¸Í —‡Ò`;±­á|ê ÅG,èÞÐá,Ì—ÊÎŽ©áÖ_(ÿ,<æ…gó(¿Aò‘,=Ö?5‹»‰¢(~f^¨‘<„ô­Þá…ÓÄ0°Ry‡ÒèìØX‘Äðm¼àyã;^Ø<ÀB6l½˜JWƪÿé1/0Bi÷Sï4áücäîÆáS7ޚ˃öúáGievì¨ÍøÂÉl Á;ÃBÜá…"³’Øhir7È!Ø'‹Í˜>Ú-âRÜÂ\„¨? Žn[ë ïà i¸¿~ö¼6F>TÒã*ûä‰oÎw–GÉó"óNjy#/œdw]ø ó9ö†úÝ8Rc£¥òêËlêpö¢$‡¬“1ïÃCé:ŒäÑ\ß‚õ··÷rŒxÕï™I÷x¡üÙóÙô:âê³¾Þqgq”‹¢eÈ Å]^˜_à…mLU`聯/³\'{%­ ÷̇¼ +`YÄâeŽ?Ç1fà ÿ~ÿ|çׇݪñóFß+ùHw±pΠˇxÁ`ò˜ÎÏϲ5õá +ŸoxΞw{‡cbÝ «-u)öôˆ~~ ð Ùk·Ü~þ~nÍý ç¼°|lÐÿÜáXä>³`Dž0q¤Í.ÌËòàŽ=$î]b¡¸"óá² yAäR?;J½2ì6OŸ–Xµzö¼ùGñ‚9> o®“­e‘E‹5Ø éY÷Ç¢BÚTÀC‹þÂíyyˆ~ƒ¼0ì^óûÞÛÏâ…}œuß´Ù×Q}¶Ëe÷'âÄì(®`Á‚oæÜý!^ø"vcõÔhAöŽ4¦·bá¼°Ow:\“FS6ÜšoÊLáz¶Ó˜jzo0ÍñÂÏÃôî §AŽô·ûÓxA‡Fùå~¼ ÖN#K6>jçR4õmGæšäˆ“,\d5¡©é•ÂŽÁ:^øq’¨‡j.Ú±ëúOã…½•TlHàtrMxŒ…ÎRž•‰Œ4N°^Ž,c¿ÕüC¼PW}ü†L܇ãgåÇÆån<–‰îÇñÂ>þ?Å‚ÅŠ·W÷Óì§øh -'áÙ‹,*Ã8Cñ×ü…ßSOužFygsLßè5ÃøÂYÿ{c^ÛlRÄ /lÕtÞŒ‘YØ,§8Úwÿå L v; +¸l†¯Ý¸óôo^i1ÒwNIz¥Æ{x§M&“Ý™ã9m©ùl¶„·Ž6ÄG“èà[h“b´¿;çmÿ0ëüdV§·Óã/üÔ»¹5¢ü† íoæ$’IRÜ­ ³ZIö­ÚÑ·ØN9óŠ5wb½Fa'%¥YÍÎËÓÍà„°y¯I’ë“ÛœÖw-“`»«wþ¡©«óøÙ{ؾ•³wì)nÖ„ñ6éæÀÎ)-@©1•uñ¦mu Ï‹\š©û§`Ídzõ ŒQdgÌÉbž”³ˆBBùô{²Ó=>^jcýN¯yßqƒü_yaß9¯»ßÄ‚Pj+¿ÄëŠ ¦ÄW¡6NÁzvzt°Ÿ7lÒ\½=‡Ä{³h­(³ŽO×úKã WÒ-²„»1=ƒnöÑYäb½¶a¨îc!‡=N`É@»öëµáñÃiž*–E:Œøι™*gã7ÙÍ“ ‰Ó{ªx=Æ¢ ݯ•Wû +K¨Ç‰ìB°]&[+2–&ÿî°–\áÙ×I2«¯ÞÁ?Î ¿Oü±«Ï¼æ/šx†…%¹?Ñ΃=N¸Àcöó ðwv¾û&“ZÄIæŽÑòw¾~_fÓþ4MœàAy‘ͦKcÑÉ%°Èl†íç‹ŠO–yÛ³›–òäd×íüë¼ðûä$‹»ùܬèW°ðS¥Ajo>ºù|WñÏ.ÒôO®Ë³IÀ+ɘ~Ùy~ œ¼‰šº®ÝÄ Ë[ض–Z  ‹BªÔôëÀÀv〦â_´ Æµñ'ÿ8/üÒõ…?¶"ÉWyC×Æœüã¼ðk×w.”z[5nÇ Ž~//hœÝ}]ãŽ/ü"‰Þ¸bÉ%¸©ÃÂßâ‘IÖ8,œ‰Y±ïOaAdz¶#ÓsRê%Ö,3U3š(‚_M©ïµ°þG´…E¢Ž.ÊIAã—c—Ñ•pˆ÷ñ‘ãiÿÉñ…ÿ F¾ ü†R¾•'çôn tJàù*„Æ2rü•s®ìZÃÅG +JF*ôÎácU-èÅ”A®DÉ»ÝÇ{µ.{–~:ðT¬Nþ¯Rò”=GÁÇT§P·Œ‹hŒÄamÞn8éÚ·û/›‹‘*E|üÎìÁÙâòüèh™ÝÀÂÕ³ŸW@/üR,âyÄÿßOÛvZû;š îÐAÀ ¼E"˜bá¨E…âyUàÂÙÑŒ¶ÔoûørG(|[å-i….ªžLb¡¬„ž'²›µð Ù11©ë3hˆÚÍ}ÚAÇ=ìbœ±Uôž' +[âKI!ìšÀ&­ã¶‰aûÛs8»Í:œ‡žF ì㋸‡Sw¥ŽzpýrÇ Ÿ3ŸA¾  ”ÓÿŽc¬ø~'ž*Àò‚Ê9(1•¼‰Æ‹c[ï>¦ÓÜÄ„GÆ¡à¾N”ŸL:ïʶ4%R zý„úz§¤ãa¬Â˜Š· ¡MÇóœ÷ºW’Ñ@O<”Mõ%‡Þ¡ÊtCýh$¹¯bMhÞŽ­5ŸhîÑ@±„ÈFZôjŽ©,¸¥ OQß›h§t†Mt¶Ó“¼ÀüvWýÒ8Òj #œ’ïÁM +ú¿c¡Ä +~Ÿ]Òxåj¦«]‚X „j ùÝš8ë©5¼)¹ ªa¶Ú&,ÈLÆo RÅÀê +<ôtÀk=÷%.ïO:"¢á9œºlŠ_`c:s ÅL•¨rÈ‹LSƒ…~m†¸" ɘ!þ2ž5^bV‰¡)À>tˆÖTõ‰eXÇ ž_p1ÕK,|ÛøÂý…àÿ>«‡éûš.èxeyaö‰¦Ibü…cÞø ‚÷LEM!DŒ¢àX¦mÌ>¥ãN“ +W±ˆ´Ö‰?,øÖt/+ÂÕ„þBCs‰ÚW("|pá-J%Á ³}g:þ´õ†š ]ûªÓí¨ür¦\É]²'NßO默Ã>9¯Ÿã…RýÖ±¶¯å…ow®™˜øÿ±,t~ŸknyaœcPTÐLmâœè;é+S3ïKÏ;,ä©)¯w“FO¢T±ÅBoyÁ§8b¦4`©ÅZK Á`!çº÷Ñ{ϧ\g£Á‚Ñdë;¸kÌ*k#% +üî~‡Ðâ<öý6ÂHãD² D?œB ñúy^ Ž~/€ñ §e3,H=éÞ_ðÐèG,œðÂû¬ÀÂsN zw”é˜Çz6pÈAEþ4HÆZJÍ ÜñÂÏá…ïÁ‚1i@çqÒÍÊ  ‹=¨OŽXà(6Ÿ¹Â>¨8f$ôByÚ§­—³pº#ˆE&p"†6¶8¾¾³ná0âyÞ‡`œ¢G2¨‰Roµ‘ÖÝ1F'×O<ËŒ4uüÄÃp÷~s˜<6Qäÿtw6K×Ýñ3€‹ÂÃp÷xý’×ÃÂõ^"Ø=8îþ—° “ziÓ1vÕ}Z “í—õ…ä©L•ºÝ{õOðB¶zÏ|Næq¬ÖOIœà3ZWmbÇϾîÖÝ:ƒ:›:@à3·»«í'ÕÇÃp÷tý ÖÃâõ°õÝÜc|î6»ûyìíaÞ12¼÷~ö»û›O¸—wÏÖOïX@s^ok»ÿ),èúùœ»†ÙR}÷ŽhýpŸOɳõ )Oð [¥îÏ°ÀJŸ×°®»o°®Ú‰Ÿàñ›Ã¶J}Ž…ñø¹Wê-ü+Xˆmëx{åÞ*õF¹õöA´eÅBþ#°Ðíä äY^åN7¼0\òBý$/L·ya…/ä…ñ./œca?¸âxá/ȼ¬úSÝç…Z]ç…þL¹W)Üca\-Šu÷mÿy^`kÞç…[6’ãÇ F–¡ªPçãªÂüCÁg´~âÁEU %V­*¬ƒ»ÿœ‡ãîÛà +{î¶?L®‡a¤b†Íɺ;z±Qo?ñ,ázØú)»ûzXŸlvϪÁÇ8R¾îžÚ³ÔëaÞz–l=,[ƒÝ«Å~Àmujwg©½‡Ía¸ûwaÁñÂwñÂï©~yÎ6,üßÄDjö çýךÞ/| £ú–Ÿñ›Îû¯ÿü˼ðÕXÈr™ƒPš;y¿È¼¨~™8ßى‡‡'  Nœ8,8,8qXpXpònYŠ¤§¬ˆœüqñptvhá°àäOËd  f‡']bC ©vXpòçëQóð_¼³Ã‚“—=†àßD¹Ã‚“פ5SM/8q’¸ñ'NŒ4²ü7oÌñ‚'«ñGÝ3pòÃdè¾Cv\í:'N~HMGú¢uâäÉ8}WMg#9ùYBœ8qXpâÄaÁ‰“‚…¦ßµ\µ]ËÜpòÇy¡µó2Z÷œüu,à2ã¨<÷œüy¡Z«é;qò×± ¨£' F¤]uʼn“?…†ŽŽœ8, ¤.ˆäÄaÁ+ÝÓwâ°àĉÂ' Nœü;XhDÓü_×…çjÜëqò±°DIKãY,Î`äš#\â†}³Ú;‘y^Â[Ъãõ\Iæ‰G&ÎÚ]˜x†Ì}ýB€!žF8UüXQ ©•!•Ùi¿xÒ!¹rX‚²õ/MƒíˆÌ‹è²$`™Èý¹àdyö •u ÎÛ•Eòžú³xcéׂdpšÀ%ìþ +,°”3ØÈDõ©Ê·° Ñ çÚ$§hh~»Ë #ñ çÍAá½ A:ÿX~–Ü {i«xC¾Ñà8½…Üpà…຤wE³ÍÉVô »‹…«­¦ñ°€çÿx!uXøXðŒv¦`ydQe‰´ËðDeÒ›Xˆî`a°`8v½,·'CW!K’\8\Úm,X½Á¸17æxágÊ]¯Ð .T&ö>kÚ¤É,¾jŽï.ÍÅxA–a¸þW–‹—Éô´©Â¨qV®_4l=Yv i±o·\f/Î-Ÿ”ïÀ‚ã…Ÿ)Qw'¨Á8ÍÏ¿›úÏbaY͘-ëÂègò^ÈÏÀÌlSGŸwŠO÷0ß…°pZ2¤“9^øwEò}ºF®ŸøÿØÌ8R–l³Oó,›%•gú £ŸÞ˼žca=ÁþkÔûs¨óô®•t «Kñ,8^ø™Ò4¶¬êi/ªiš +íUÕD­óiꢲ§HôÓ䇠ƒ]û>M‚B÷iGZ¦Y?u_¾Š…#)r9ÿº–[ ~ž.± gcÎX° ‰f”¸¶Çm½¾Š‘¿C/ü\éy$8ïs_eKÇ›´¿#oÌYG„TyݪÌã­NÇÌFÒG“¯¹Êh8$R×& ÜÅ‚Q©áÊ"¢ÑÖpù /è&?š3ìšZ[„ÜÖ•«X0 ¢7`ÁñÂOµ‘š†ƒ PD BcñP׿Ž¶Úá“"7x!4‰!‰Ø$׃Nô`78wæŒÐæ9’Ã$7×bÆÏxa)C 7óï/Ð}MHfŠ!`£™¯JO•Ñ˜…Ké]Åh[1ίa! n†pX)ôëq¤X°ÖЋƒd7l$Ô¯Ÿ³Áfì¡x8í9B¹aFœÊ°}F ÞN耯‰óŠøÁ¤‹Yu ÑÀ× ¥ Ä(Oö™¦V]õIïa!žz!Inf EœÛ4Ô-Ü…W¤Ãv&Bž•O`á\òe†vNPˆÖßÞ÷Îó>€›ÒÊlÜ󂥊 ì–OŠÉ£©ŸÛùá&«8Y‹7XHÒÓ½$‹þ‡™u¿ÁW3=—ºÑ"lÌ ®ñKØV °%͘1…tÉK=36b¢^¸æ3/Ï_Ä3!Îú¼`ŒŸõëÖ¹g§ðÀÝć «ca3]ÎÊf>œ`^vJ“¨+¿Oö¤›ðŠ$2Ò•. ¤+ +mãa’Hv XRJº4EÙÑuv•~yiÒÚ¯ˆšf-*®x¤s‹…¾TêÊŸTÜÍ̇½.ÔèÃA¹_Ô€…r§xeß  ¾|™j“ôV^¸6éæÊL'ypŒ³9{ˆyøYäOûß H§Cë‡,Fƒ…Y˜´ñ(XÝn.‚«?Ÿ»¼¨îëþËe +ú&¦j (1ç"œK1æl$¢òLuºWkù ÝXÔ Çþ¸ b‹‘DéX4„ÌO4€B½lOý¨®§zÞõ‚7û —“1OƨN²ž£|–s™){GbG)çxtý †ÅÉ1 Ъéí bçNÚ\f;•Gk/>w&š#¼Ë§ÍX[9.O\1€³w¡Â‚ ðž>‡hX+låxæ¸ú:Œ{".¬«=š(8&nÈ"*µ´ÇB´ÇðÂD’0Rå ¼Un°€¼°;òB’QYÆÆÎƽüE,$›8á½Èï]éQ>ÒC±s æZ«í w°pËaY°ª«Qa)¼°·½Õ=òàlfP6œ„?à ò’ôb2†w®›7™SpÅ…Kæ¶ÝÏ–÷µØ€ó”;p…[j†ÝðBKë=ò˜LawoìŒ{ Æ“»aK{q(¶^ã5-G^9`é,4âšÉT½X#OamÂ¥\CVeãQn5rnã=^Í#qž¯k° /%ØØHâi,Ìg¡ëÅöp‹ªø S¯'èÏS¢S“…ÔúΊRkŸ`ÀÔc$Ô Iu>îBÂ=BºP`TYjW]¡äkX`·gÔJY„Çwyeâ™MùžŸÆ‚WòjÄÈD½×xaëìÌûRIì•&·£8Ä‘ÚHˆòtÙÚHž¨/~ÄC^€Cӳ؜w1ŒŽM&ƒ}¡ËÎÓ6ÅŒj“RT£é¼ÀïÂ>µ©cè[Õ̤5kö‘KsК‡¢a47º¯aAßNHš ƒ—›~›ÝˆC±§±Uéõ2u‡eSžˆ¸ƒ3_Ϊocs~¶¶÷q|ãý·ªGÔlÆ.ÛbáN¢Ö=^ˆ‡‹ +ÞÕymÂÄÑ‚ÛÌìd/è/¼CÎk»ž(™ļ:¸žižðżpË÷îØô·±î/j>ØX‡G^Ø„þQ¨ÅVzMœMvƒ» ¼÷xÁ»L·‹nÍwKž>ÖþSR 'FC­‡àÚnYwPܲü<ÌhÛµp9Éô,®çvÛ”8ý4 ¿\›QÝË—½…Mš‘Atvi@‰c°ìDC°¦d¬OòT½< yy/k%?æ…+óX7s<žD™MV_àæóܦ\Ý +.DþþIÖ4û<¬¥ž××;݃ÚZ»¹f±ÍÇX°þEr#¶[¾†ï8BV\¤ÎÔMô.âbž>¿Pd‘^¨(ì,sï!/ £uJµ›Œ%—gÍ>°Æ~½Gœg našz9/y¦Ë4f.ç<‚§ý+Kò¨ÑõÌ +370Îç®Ã5=Ìá—2_]W³õÂ,ªgh²ÄdcÊ´Hðí0σíY5/cÁtÕ'éÎö Öâ*ƒk6Cœž¯{"Ž_ò7q*ýLU%ûµn}náí¿ºˆ7gb;¯ÍÄ·l˜ê$-O˜®À¹Ç Öºô.îÚbáb–v4ü˼0(¢vMH(å‰øDU ÿ*íSøðáŸÔ¥¾‰ñ€á;Ø—pbfòð‘̧”Î.ùD()õDÔ”sRBÇVïFh¾ãDå:á\I~m_Æ‚uõÒÓèŽHlÅ_q2°ÉÉ?Z%{ 6dšFWÂïÁku0B›…1®îDûlE›5šsQJéXBãd¾³õ:¶“N´vë@Ýã…Õ‹ +7fÐ f?YžAúŸõ•iit X0:3ÝSèìácŒº(Tí{ª(U¢cÐnè¥5Ú_©zV½Ö;3¼Œ“IP%|Ñ€…aŒu2Æ Îƒ×LÅœ$QžŽÚðe,4‰¸ÑÏÒNÉݾ2IJ7åãYf¿š_ÁÂ> ¿­*&Áý-[ˆÅVm™mÖuäëbÚ¶w:­Ò;- ¸ÈNë`ÃfÄÍô×Øô'ónñÂjm±ƒ¶Apš§º±6£ôAeåßíc‚P=ãô‚rÌå‚Ö3Ôa_ -ym2ˆDTM*ô8X9T&ª6þ¤ºlO-¢À/ ã7”#<¬€ +Š•“¸®¡ŠjiJ«¾ó v[¸j½×ý…ûò,žË°ôâb Ö{—J<È"ŠÍÌ„Ânmí¦§Æm¦y²o(¸Þ57^nò‚ÀæN²[-RW Š%Ùçv—'¬–™øÐÌ.ÚäØ¥óI¾÷ÁmMÙÀ–\Æ6ƒÍdŸ»¼°rJn¦%ÔÞéO{ŽÜ3‰ªbÉÞS#ù§ +&MáBW­ë1 ¦·X àÜ„”êœNí°@kpóš*X0­CgƒÒfô91˜ÐzD,ä{,d ~Ûö1bA/XXóëX8LB¶©<V¶z7+êìkMœ¸Ïå`Dk;¦~Ö­°»£Ëšñz˜Õ¶*×æ ËmAÇq–§lJ¶ŽÉZ{"È“¬0™±Ãª¶gõ‘Œ;¾7¶öÕñe±/ì‘qŸìi*8O—Ÿ‘”I½HÕýÿÝé ¨{3KUŒq`°,ð=j^a¾v‰X^ˆæ v:]à¯aå…¬)štŒr„/ÁÈ:Å‚‰´hƒ— €-r_w^_dv¾òMšÊÉáî"#Ïæ#Åò|ýPÒ{=ãr}VÄ6‘‡YnKm¡œ1±œŒ6³b_2Æ~›þ}[7Ï`j?h¼¤{àÃm÷yÍ°õzl=ý“qç57ïПÿðÌž™wQ¯<©òˆ0îÙÁFZ±0€µ3ŽØðB ',› +þ”åÜØŽù8„M +nJÊ—à%ç\jj±Ð[,h¾+•FZ8A4úQª²`ÁVÅJÓséG5e`§ýDék秳Úòù.€æáLLW{ºœÈöóFÍÕcQ".°ñ„þú0XÃNÃÐ!¦ÉV{ó]xùñ ÍQ8€Ÿ`AÂqùözö33Ðu|2éáZ–ãíÃ/Å?€±øS XOº)­á© x\/ t(:íùSŸ s<Û€ÁúiÈs=÷]g½AQí¼&˜vö¯Rùm/Hf¨p:“¸Ã¬3ø.k'6'Ðœ6ÒÆe“}*P-âáN29¯1ªÎ8ˆŸÉSK”?>ÛI»[‰½9]À—{V‡8§â­~ìvžNÜzŒæZÜÔ¶—± þ,8qòãEDÌaÁ‰“O‹Ã‚',„ĉ•É=‚¿+c§iv“##wâï¾|g#mƒŸÔwÁù N ÜaÁaÁ‰ã‡‡Ç NœüoX(GòÅ ‹fiDðµEF¾Jî•®©è‹Xȉ®§/ðø/ù ¢2ýPqÌȼ•7U|dæ\Ét‘;,| ë‚Ðu‰ýºñ¯aÅ‚MŸÙÔˆ†a–©hj{ÀzœÀ=­µY¡Ñ¤Ðíwåû–+ø—l¤p4+nL‡jB ½QŽrÚ½Þ:£‘ö[‡…×± :¥p¹uÉ9ÏuD” ðï„Æ•VrŸ+RjGqáÝ+ÎÍ´=Ž‹PŒ›ü¡@e›®ãŠz:£Jù W°«±XhLß“)‹\âš~MÝèz±=Jhj¶×õ¶Ï¥é„é‚ìÃl‡d+„@0³JL1GÛ4ìb¶Ù¿îa!àqè+«¡ÔÒMu=Ñ íÂHUŘ×RÅñH¼H¥šðh†ëTÇÖ‘ +˜äµOF™§VÀ› 4öx¯y«cþ¶É_ÿ/ô*°Xh§1£#õw85žé ƒÇª¸Ô¢mG¹ÛéŒÛy^=Ǿ'‚þŒÑ~‚nªÐC×™î&Á>¨Á¥ÂUǦ‘gU«üA<Lð™j±ƒî)sX¸‡A%öS)ÎÝIèÍ^6© N׎c²CXTÎ]=®¿B§,½‡ß´Èð Fë«ÀKÅ™°¦ü‡ôÞf$ýKþB8Êž-`¡§³ðiX¨È£Àc¦i•Œ²Æ…“¤ìÚˆÛé¿J˜? Ò†ØùcvTWc_Êq´1OõDË…ôX¤e7é‰xáçgeÅuV™ï;,ÜÃBhÈ‚^ɲDÆ9¡{,dÊLc¤^Œïá_‡:û5å˜3ùö +qA*Ìæ†v­ÆÓÉÙHW°hBô”j¾‹’bLbx¶D.œ¦Í‹!­¦àÿv|\oWaF±°ÄX¶­SÀƒ7çùP«Y+¸Àz7Rb×3=’–øb<åa„3èÖˆ«[©"ef€,t3’:S¼ÀB¨ ªxî°p]:šE¡S‹V1^8@Èà7 ‚Nü…d̵ÁWØòpo¢SUFpÜÀEÀ=ðæqÐÆ_°Xà]Ãhïü…«XÀ…7S¢–¸¨“Nhç3Tº#†©5bajW˜Ê)Ë.Á•mäÈZ‹…Êb¡À¡’dÆåò>4¼PãœJ@)¾BY\hÖ+æ°pUÚqT#ôGè½EXËŒcIQð9 vEžY¾nŠ8ðÂqýx¼7x#´ßSÜ#¡i¤Ò LÙ¨6µÎ_¸…f‚ÿ÷<†° ‰Ïøk:.:ƒï pÎ,À"2Ãúž– +ÒÕ ßáJ˜h#Y^ˆ9±ê¡{ Cê p•Ñ_às=,I„6ôsp2á°pUêTu¶…!B,ü æWXiÖDx¦Q‰u)ĺ¨J:ܾġ=?Ø‚Á@ÆèbàÔx³Kì¹ñ…«1UiLPø¿=J¦EšîƒªNÈMx[´‘€ &k%UëÑE”ó–™Z¦9EFÖ!ÐÍS;p&Ž•y»1÷;vŠ“Åå"¬¹8Ò?"ÿSGÃü¿ñL¥1 3& êCßcÆ.Mdz–Ÿ™ÍìyÛ¿˜}™éŸL3ulJU5f¹'133¾àÅë²Q¸ T3Ç¿¸²Ã¿ê/8qXpþ‚‡g#9qXpXpâ°àl$'ïÄ‚jw‘jØþWEñw´òžkù¦“ü—þSÎz">éG„¿vQ/žfT/îÏ ý´Œê àµÐ¯>þžVƒLôÃ6R6¾¶Öê«’äµÕÜ™ +Þ@“ﱑ–O•>Vòñ+²²ñ;V? ¨ø6’Û}çðÿÁ—dþDß‚…A9,ü›X(3/¨ïÀBÅk‡…7bA¾áq8^ø©r¼ðãxá=þÂç–‡q¼à°ðïØH‹ã…7óBnH?9Î +1°®àë¹÷û +þÙ""˜Ù°Öû¨"‡ç/¼ÊáÊÚà xÝRœ¤ª6˜Ú<ÒÊG¼0ŸZð J-zéûÝØö½]ñ”ñb³õWïÏbÁù _Ç Áxeê ›ÔDÆó'fæ}¡Ðz¶˜Òçxaù¼bÍ [Ä·½ë&ÓÚy§ÌÖ*YTfr̳NÿY,8áËxAÐŽâÛn43et}¿Ä ¹ÖX (Á×ÅN‰À?@i¡¹‚|Ö_ »‰X,ød"NÌáª2iÆ%"8¥ðIG;Qó¢#ݵB§©Ã‚óÞÎ ‰Z8hÖ<õœãÔZŸr¿ÖbA±f­R}­›€«®,LÕTꜫ)ÖíH ÝUŸõˆ?«±P`Ñ3¬ß!éÚëDpÊ ,¢ž;OJ•uX"°ËÞ…†5Í¡QS ‡…?ç/´“náõy#™‹1×TE3<©…ªV¢LtŽ”¯å˜/tgËÇ@;Ûñ:æ9kÈ­y¡Õ©ª „$Ex$jH8ÓnÅB#–, þ‚"h3yœ½ ÷ÊCe:F“wc¡± XÜÿv~Ô?â/ˆççnŸóÂCÍÃj®ípñÝ5^`зcåS×  käã¬Y¾Sc'<0ÐÁVŠñáÍÑ¢¦ÑN¢ `ÂLŸ~0}È ­=ÅS¿õýHãŠ+…çB,”à¼ô€•”#åpòesç ,Ä*>úCì` +ßÇB{õò +ßA11àWJ±ßH°úN;_ÅB'ùQÁëLЯñÍ-—z1ív‘ÙTvöQëó¨w·ÎuÊ 9<_h±›Ì3ô§¹ÆfM¼Å¼ƒšGWï"°ßMã:¥-{È ùïhÜBSƒ+öÄ*Âê¬u1ö ÀB/ªP©%E…·OÇ"¸ˆ…'Jé=ä5^MM1#/´¼ YÉ}‹…ŠÃƒSmü…bÌtÛ µÌoðÙ¶y£“¤š¹jýx´½‡1«§°P%ÛÛ¸ÀBÇ ýꉲ%Ÿ}ßSÒ\ÁBH;) eZ^åýØëš);…5dØ,pRAcñì¿:€sÇF’\ÌãTõ>':ÛªoGÿƒþBdŸœ x™œ‡ÞèiE°,¶œÂG‡”—µêà\ª÷y¡à¾ 8B™èc©Æ˜pd‡½XIg1Ñ!÷Ç +žS®{|Ö}  °q‚µNØ=^ &=gÚ=t@˜'Sg»›bÁÆ|ˆy)Âz/ÏçXØ™:aÕÚE{4ÀoئJð &‰Q\KSE½Re†åõðÅ×±`­ºžW@QLÏÜ‹ó/ʦ›9L<]'ùü rĪY2ÆV_ü±ü˜¿°–žXž;hO¼7òvU³Ç‚ŸñåææaËû¼` +F©¡  :à»É<ÅŒ +¯{mGiÐWÍ. +ÁegߊcaÁÒR;"€Bñœ<®¤«áU%3ò‚Wà ½¾Æ MK t +MÇ <©P•O< ø%»Á +€ãÚY =›Òºi2Z^ÁB¦dÙh`äÉ4Õ„X³j1õM¶¼pЖš§fˆ'R"átÌ#œMÀ@T×<¦å„ªïv‚k.žð$ožÆÂ!³Xh •/¦94È¡ßó±X¨,ìŸwxÁçƒg÷Ž•Át[©¸Ä²ð Kªõízcðè /ÀÓÇäEhì}^ðíCö©§(å;´@!gÝô +¤G Âß¼xNyÂù8u§(ÖöÜä ì…|$S"kë/6×çhVˆ×œŽXÀ†€¨@EzÝ¡&zíDÇ Õ8MàžˆkXÀŽ.ñÍ3ƒ~^Œ©¨ie\},„}•¸y M19µrÄy$ÃUAª‘ï<óêGA·wƒpFŽ;‰d šÃ~‹¥C' ‚TtYhÒÓ©ÆÚoðæâÇþðÂ2îrYq +pèsyÇFzà/l¤ ›ÃÒšŸ-Ø*Ðﲉær06’¹éŽÜç…¦íÚ°¤Ò1ÍTÄpFшP‰COíW#%¨Ì¢‡ƒüð‘¿ÀêU»<{ >¥!\K¿y¶RÛ¿±"œ)¥†º±eÞÄ’­ötîøªcð¯>|ÿ(\`!¤´Êv8Ä=€p±0÷<—²ˆ®úÎ%ç>ü‡ö½’‚‡¦nvS>Ÿîóô¬,«8€/P”톯·q¤%ñ•Š~4XG·ü… ìïÂb­É¶»Yt~I‰¿€%¼ ET«Í>æOù ån¡jÀ|Ò¡þ¨¿°òÅfã±ÚUdD’€|£7‚½v;ò ŽÔxìÚ²æÙ0étòÐFòk@Ô]-O§6þÂ0 =çíxº\Ͻ|$oáû#¹y!¯,T¢>†”‹ÒÈî»O`¡D`š°ìµ€Þya¢ÆVœÑ_ˆsã7åWyA—=Q;}qÛö1ÃÒ´ð¸|ÚùäZsïþ(b³€a¥¬¿`-Øs,äÆ\…¿;ÓëçHš®ß÷ °tè®mý$Ÿ$­ˆöÙù `w +n¯ùI!0•+ ™¸·æÃC!¶—ÙÛæÐ÷l|,ß¾KôÁwîlW¸b¶wyAžÑÕ|Ç”|(4y9€˜b·?¾®Â¿`ZÔð(ŽT™±² g™€Âª>;Dì7Z絉}M-Ÿ_]½*«?Î >ç—+lõ‡"N"²‹“U#Ói“ºô!^PýĽPMC§&à éèC%ÁFB‹vRÕ¤(&VÁÔS­zÄ våŸÂeøÁàs“j>l‘9ñ í9¼÷âÚ@3¥ÿ(/Z`ê‘XƒE´Ð‰¢ÂÇ}+ Ž:¸*Qømê´ÃMM| ²Åð~´ëŠyhr|öy×ÆyRW%«JLJl=-ïš¿PŽb`FǾòÞ3¼QƺAyP´c¢k¢‚¼R-ØHÕ0L*»‚pÙdÞÂ&AUô`M””F¯ÚHû7X(„& ê +Ž’Œ³öUµ¸RŽã+MjyÂ_P ò‚ `>ÀÂCÁO‡ª,˜æâ1Mvˆ£lÌ«>2ÕC{ÍB8ñäØæ9á3öUƒ +^hS£¸Xî·!õrÊ9´Sƒ‹“ Û¬±%ÒëÒ 92ža€íe`¬Í„sâ=wž¦¦® ¹yçþ ©ö°†„ÇøØ­..åCtM×¹"x†¼¥IôQ^FÇÕKì„ÞMèD ÀÖæœzÝì¤1œ SõjÊö ñDZ ë·Ÿó ø«¹™ƒ!öûŠZ<ÎÁ8îÜœ}s‰…++.ÿ>„âêæ™ñ…WäƒùHMýRñüó|¤[¡“ý÷âZó]ã…ÝÈAìHW.ýc ±@wfi=‰ã¦“µ ü¦°-¤ °K›)¨o­©û˜fEÛÀV¢u™óšTÚ,DÀß›&b7òB#» L‘ CzüxF3‹O`á qóÞ,ÿ_žªY])#h#)¥ø B)ß-x0]ßwcmü‹…«‰ º'~_QÙ,îOø ¾ò}¿=†@•\ JÄBÍÛBæÅl± &î¾åž«/ÈSý-XpóÞ‚…›þ‚XˆF·G:Ÿ¶ÒÅu¼àü…‡¼ðõòd}¤’;,8á[yáÀÂs¼ Ö`gÉœ¿ð·yákÅù Î_ø=¼à°àüÇ ÿ¨ü€àäÙ—öŸp‚ ÂiþÊîN´ù´¨é ÈalßÑ̃ÚŽé´ê½üßåeåøá“îÔÇ„íþ_Üü6ò¶f¾å,ÿϵÿHiõ킹Fendstream +endobj +5743 0 obj << +/Length 107 +/Filter /FlateDecode +>> +stream +xÚ`ŸÿÛÛÛDDDwww™™™555ñññíííËËËÓÓÓ'''»»»•••ÃÃꪪ³³³ùùùèèè‹‹‹õõõýýýkkk¡¡¡]]]ƒƒƒ’’’QQQááácccåååÿÿÿzÔ;¹endstream +endobj +5739 0 obj << +/D [5737 0 R /XYZ 85.039 781.388 null] >> endobj -2606 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R /F65 2099 0 R /F35 1632 0 R /F20 1617 0 R >> -/ProcSet [ /PDF /Text ] +5740 0 obj << +/D [5737 0 R /XYZ 85.039 714.405 null] >> endobj -2617 0 obj << -/Length 479 +5741 0 obj << +/D [5737 0 R /XYZ 85.039 714.405 null] +>> endobj +5742 0 obj << +/D [5737 0 R /XYZ 222.519 116.14 null] +>> endobj +5736 0 obj << +/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> +/XObject << /Im15 5293 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] +>> endobj +5746 0 obj << +/Length 510 /Filter /FlateDecode >> stream -xÚ¥SMoœ0½ó+¬œÌÇ€Í1!›–4…t¡J¥(ºl—•¨»l£üûÌ`g»‰P/<3™÷ž .ALĸJˆ6‚)cÈêÉãd•Ožp¸5‹EˆµËÊ;¿Ž%œ%x²³³ŸÜB 4HMM0'àPAJ#Qhûó;k;v°Ý^%{çó½¿E!ùAá H +Âyò^K@oæ FSc?'×ÉUÛªŽiQWmå‘£ ƒâ¹à<êáÑOr&McPJñÞÑñù(8àsÈÊI¦"-ÞD k†Îq88UyTðløpO[´âì•™‰«¡o–4¶ +pFp½µQÚ:°h„2¼ +•ßù…ý?…Þæ:¥,ïnl®Á|‡’¼«©8{¤Â^ßÈa¾yzß­Y3¾!V\&sfÚ•Y*Ɖ'}²Ê*ÐÊí–ߤôÉ}@éõ‰XÅŽ5½yÉ”O÷µØÏvvýŠ&é®v¯ÿTÖÃû>¼¾ÔÞÃwÿ“½ëú^Ìž7ë¦aoMÐüoéí> endobj -2618 0 obj << -/D [2616 0 R /XYZ 85.039 781.388 null] +5319 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 299 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5752 0 R] +/Length 22110 +/Filter /FlateDecode +>> +stream +xÚì]‰bã( åò>1¶ñÿÿ—+á$M;m·¹ÚtÆt&q|ëñ$!Dgör¿¢…¿¡Äú‰wÿË w{¹_Q7a©g~6þ×cÁÀ ÜË}Šs$¾ ÏûlæÀ‚*c¶—ÛK,ÉíX°Ïù.âZýXˆý^îRùIM l—â{É a7bÁ>é³ÅjÇÂ^¾^š{èHOúll煽켰óÂ^v^Øya/;/ì¼°—v^ØËÎ ;/ìXØyaç… ;/ì¼°cá_á…æ^ò»óÂ^ž†mŒž£W»›îí^Ñrþ‹Î„ëeç… /TŽhî”<ß]·ov*_ϸ³Ö¹hç… /Tnò~v,Ê,š&×ËB›/³$¡h?“|êŒ÷™Ùˆ!*ŠmÍ¢ +V5iÖà™Âgã´Ýxš¦Ûyáúæ0És8E™çôPoù0$/åðÞèÙ¶G¿”ïžHæýeW®s(ÉÛÛOrö‘âÜDù_èCyar•Ú¥(ÖêT:ž×)®\µ5Þ®8«OîLuÀFî @ò|ÒºÅ.Ã7¤ìî˜ç}8ï¼ð5àkyt‡IÃP¹Ó;XöÑÞÛÚ.¼¸wTâóù•’…ñVä ÿÔ +šÅ†‡Ê=Ê  +³ã"?¡(¹Û}üÉÝÌ=XG5T®ÃKP2&d«4CY8Ìz®êPï3¬6iÈX³óÂMX˜Q/R;=µêE 54>+ˆ¬¸¤ˆ»÷UØür,n曀œ­íþ ¡Ôö]´âqUù`^ ZwP#·Ù ',Œð€vÛr~¼`‚SVIÞáJ 4ªÅa§€ZÑ¥ƒS‡ÒW]šWýíUù`{áD¦É&ÂçXˆßÃBŠ˜IÂ*éH5hdYš»dƒ™žª"ߤAî~¤Û°`\’8}x"£ç&ñZM®eÈ /:’® 7GÓáHßRXv$Ùp4Áù4иƟ#ñB ‘ zâ¦u$PžagØæTt¦#A# ÛtsЪq8ïðô~¤¢ø‰¶ᙓ³Š+b0ÛqÚ- ™ý9ر"КŠMÓäaaç…/bAn]vx‘Ìb:‡e$‘ XÉ7«-¼ ©ÜfÛt°ÿ¨°[ k]H¯R; ¯ŒCï°¥Ù ûvV0Kºd}…Á ²±:R@¤1Ù|p6NÔ¦½=³½ ¦/¨­ÍJÆ›œ®Ï»Rl6K‰Â{&á• [€ +ƒm7­v^¸‘"eŒYN/rMGuh»6ᜡÅæd<¬;b3¨´[³5 @lgŠËñá¶+Ž«”fãx·Ë¹íLˆžâC£œ¼²Ô ´Ë7!Ûé(ÿŠŒÞ8bD˜Ù{`᡼ÊÿÛÅFn)|ö úêeŠ>9ÊvÓÓí(Üýxž£tËä /2Öì¼pÐaÑåÛ‹,µv°ö/:š +Ða’×XÉ9aÁž°Ðã¡ìp[`שÛƒŒ,`”¿ˆm$/^ÜUô 4Êø†…ƒv-÷ í žO?=/üpÙyá«X¨AÝφÔZ³î,£,P´6êH‚¨Dd‡ª¯Qåç.¨H^tVijk_Ù /ò'XPJ6¯xá ©ÓrQOÏ ?\v^øª¬ (çû5°E =o/Á„]Ý‘*æ£í Wî6 êìQ¯ª5›­îÏ`65Ú­}ñ3êó‹Ðãùfò`2ð©òí[nv¸_xpÆÃýî¼°óÂb0¦‘‰bŒéx0ÅòÎèñÌ‘ä³%rjšþ29ÇB—}\é.?:XÓÙ´Gî@ÛÙEfM÷â)IÆïOs²©‡1(¿õ˜áòæ+MµÅU!¶ܶ¬ŸÆè í…)•Eïûz£"Yªÿí*i†ÁçÅÞ⨨w^øKÎ[ä†;D°Ý•¨K#×vîý0SP-õÿw¡7„ñ^òñêØyá_(`‘€=nïÐ}W^°JPW.i„G¿ƒ·$‚_.Wn°›{Ø3ô ÁNb{1{ñ55œ{šJ~¦ È°R%χUÿQŒKMÜ,$q¼9šþ¡ÒgE±Ü#4ãž¼ÀTçÅE¶Y¸VUÄ 14%‘·¤nL×[:´(›ræ„MÄ5W ®V)ƒÝþD‘Q *y£µâ¹ïµ2ö½5ð™Ñ’ùÈÂó–¼6,øÖàtmì3X?ì¼°—å…Å{ÄGƤ0IîÚÞuÒ¹i7{nREŠÎ½8&"çÌ´†®¡H±Ðºt[B:Ž¼€=öpÖÚéXŒyÁÂä5œÉ€°GpvX¡íæƒ+à+B mÎìÊöòS¼Pœdv€¥¦S¦,Jó´¥3©L4Ø;+†ø +BBŸJ¶„j¼ÀŽ™€…FY_¾ƒ…ì€6*37šÍy¶3uã踶6Ýya/?É Ã)X±€b\€lâÎT$µ£%rššÃˆ¢µqtrÃŽÈ#/ÌÔ-> ‘&¯±€Á“=2ÊaHÂÉÆ#hT f-…Üya/?É õi,GÚ’†ƒ0ÆÄMsg±¨‘RZ0ÐCêS ‹½08Æ©÷„€âXÐ ëÜq9Ûl‚ +°8ðÜ•ÏŒP¹S” QŽ¬¼ñxç…½ü$/4Ü• ì¶,[›öépÜya/?Æ ë›ï ÊÎ {ù9^ð)è=ÂêÌ7vÎ_t H˜ÒhJ´ÑZ›ùƒÆ|Ô1&žL|«A'Êt\ë‘Y-½Ÿu²þópÄI';/ìå9x!r3ÚF¨ÍÕiäêõÌÙÓ(¢›Þ+C|ñÏÙ:F÷Öµ8èã0bðótó+Czç…½ü /4Ê`’‚½blè}D×*mp|  y/„@é -DlyŸgxúˆ…0(°€½i€Öá8 +°0„=óbÀ$|Y…< †Q§¬–×áâ;/ìå'í­¼%ëg—`8Ç :òHiȇtˆÚŽÅy† H_aA9"Æ ~Q§^ëÉa¾Þ‡ã|‡¹Ñ×Æ9’ûˆ`ßݲóÂ^žƒ@Ô#¥s7j'WáØÕXbq…"ý D†$LÎ&…›SÈû‚Òº¬8`{’Ì.+ЕúÖ~ÌVëÊÉUõ4 bDo4|‘öò4¼9íF¦8È=bsŒ^ˆ@îOXˆ !(´8´HmISQèå Œ{ÀB¾¥Á‘ ÄÀIZÍ]’À½wŽ.·Dõ¯£øv^ø¼ô¬‰¡¼TOü¾?ƒõ!´Kľ‰o/óéѧÜA‚5ŸìÔ|v¼8=KÓ_ٸߛ0ÝÅ4„Ù†eƒXXॅ4#ˆ¡5Þ½ô±ãLÂ(,Ó,àÀ¸ +X€Ö½Pjõ£6ÆlKg–Â%‚f ,Qãƪ˜$bÁî¼ðµ’)¥oƒÄ?shˆá¡–Ê)Lˆ«yCÕ;.è«ÃŒ#U|v7/˨>î~mÕ‡3Ô`¹Ž¬G‘Öú:ÔÞ½A;ÒŠD€3^X 6Ü[{!sz™]Û±9žUJÕpˆ l¼0„Æ-#!fžZ¬R×Rà… ´"ãè覄t°_£~Äœî¼ð¿o]aŠSÅ¡á:xcìKUÙC, ØsÄ(Ç%¾•Ø?*3ýrfíˆOo,Ž)“*’¸“ý؇؅a-§|ÕI1îž©U3¶°EMÞ`@âSÄt«ºý—¦Dt þÌBCšœø#WI˘õJSEjX±5“ÒÊé80*[á šëHê{Ž+sö’äjç… +´"€+šÈ¹ºŽX”³$ñ,’2a³k8¤ð”h„‹(ÊŒBð<¥°ÐãûjOÁ12’9œ ~÷QìÜ£Æe‘à!,ïa¹¡[ì= W= $í'7ÂåÒ¯ë#PÊêù$EI¡I¼ÐD¾ ‰Ò_m’âÆ6d0î)\."…ºîµß6Ý3E +o#õÙaT¿ óðÈs«#@ó1™d¨ÐPEìð[¶ýÅ!õ$ó ÖE“ôá4dN£ ê)šyÜyáÿ¢>¤OÊ•˜x.!Öôú5<Ÿ®MqD`¡¡P™ÂnY‡5sNE Ç·Æ_Æ‘ ¼ÓÓã„Â2‹ÊpÄ!,Û°,0­ªÙÔÙ¦ Ë#¨Å%æ!U*ÎåÔâ¥PÃÖ[¼>bâ­Yá%:ív;жv rD–2 ‘èó?È ?]Ê—®ç>T‘€wAò³É‚F‹òŒŒpXãªT¹~PnÆJdî¤w,pЉl®A&µ3 «ÚÚÀ9^° ìœ3`€6‹éÒ; ìŽÄi3:§†),ã÷†…—1Ἣ.iݲÂaÚÔÁ™Ü†á*d›ý°Ðpg'‚?‡±ñKOLR`Ú #I¢ó~OÁ ?î$»éÿJ½eÅD €‹™J AÏ]°C¥z‹ÎÇâØBÌ>\œ W !é 8MFä¿ò=ˆwtXF·H0¼–»€…ćÄXÖ- ¬Ô®Hð”ú˜Pº4Á´’½ã!ßd QLF¼éH«­:ÇkLL¢õ¯ñÂîGú‚CuËŠ­ó(‰q xTÁ· CZÐ1)¯íëÔõ,€Òª A,Ä ã™Ð…§É /0ŸùÏÂøÄè°,8Ù.xÈ”rW kH^ùpq¼”9¦€Œ„DµŽlS1õF*vÄBì¾Ù¥“e}/4L|î$†ŸîsTvÂá47bÆfE™¼NIë.¿óÂGºóï-ôÆ ¯±2jbßcÞÞ/ ”'Ã:EOX8ôR,à0ô0i‡=¦ ÿÓ/lXÀæ^ºE+¼ °P#/ h¥ ÷ù€€Â£î¼@1Ç1hB1¦ŒŒ4(Z3œ|>ù‘@¿ +U¹ééxAº·“9W*yý“Ò÷ÇTÛø#‘*0¸,Ž6Ô¯anÃó|«íG`ÞyáÃÞù í+^ètðmJŽy±1.’oXX/x° }ÜmlH}ÂHCíÆ ¼þÄ’°€ËpéÐeŽièÁüžµ{ÁBŠ.Q¤£Ô‘†·}ªv|F`D´³yf঻/ ~ño»\Ÿƒââ­»x|máÃOY¼ç ä·üßî‹B;ÝX7ö,W92~¶óÂeõýEœÏ#Ξ$Є-´VÕ1·HÎœ¹F¿xC•iš#Àb¯áš¹Òèo%5ß2³M +¾  cÀ öÈTá;hÆzÀöµµ°Üphڭ惎䰲[ØHpÃ]çµ"r;“\ꀅ¶Iô:áÝb`ÜI³!ð ÛÊ5Ì‚,Ãã­OÇ ¬©± ò%ÖXŠ¢]ÛÉÇvÀ©"[P 묷b06Á¡ z˜³:q +C=mX@M+n%ÂÜ…Uu.ã‡I;/|¹,Ðò +v8N_7( aMðaçCÁÜ4Pôo·v&MŠAsE—9¯²Isæl*l ¢ §`‡=b†‰qY¸H,·»Q;Å/vƒkáÆ  ú!½.£(ÑìèƒGÃéå¹¢ »Ùàaaóâ×Ä>/Ô@›{슦Ð^À[+ÅÜ`Ž)€þ´‡}Dä°+Ín W~F$$[i +çÌ› €çRì¼ðaáænó$ÇúRfJ®FßçKn¶ù¯¦+Ð?”jœòU;£l†QÐ@U¢2¦/é¿JL–±½ÅFd#ug8-ý+ŸYõAŸûÎ ¡÷º¦¾üê–®¿{UDÄ ,Û]wüƒy¡E2Ø2Lom÷¸aSé‹àujœ@ï8µóÆ MÎŽöB¼ÐµULÝø({q|cÉ>èZÙyá“÷.~ô®zùkÛö‡óm²s1F.]xAK"/Ä€ ¸Ø#/LÛÙ€âÀ¥f,E{as¬8¥s—¢)™—e³ó‚ßË]úp{!„œb‚ùV¹šy8 à[ìéìp¾y´Â"ÂàºÓäó`B6°3àu¯Þ^yç”%NƒÝà䩘q»û üdç…½<Éd~¶ÂO†ùÁ“ûLSŸr>ÙÊ‹–èJ÷½)|§…/L~¤/x1r¢Ñë–kB0Äh<¥7'|–p>*Íè[#½ÞýH{yv^xs©þKoåtÐËNÝs'•R¼Ù¯y£lÆ Ùya/Oà —ú0á6¿Ø¿0ªÒï¼°—ßÄ ÿ_äR½\X†ÆBí¼°—ßÊ ÷.;/ìå×òÂËÎ {Ùya煽켰óÂ^v^Øya/;/ì¼°—v^ر°óÂÎ ;v^ØyaÇÂÎ ;/ìXØyaç… ;/ì¼°caç…Ÿç9UO_² ;/|/DN)EžûŸÚ±°óÂ7ðBäR?uaÓŽ…¾‡òg}ÙŽ…¾ƒ’ëÒrîXØyaç… ;/üå¼ ØÊ8ž¿Ù±°óÂóó‚Ì’G•;‰(IòeÇÂÎ ÏÏ ýð¸–(L‹– Þv,ì¼ðü¼°> 숅zر°óÂóóÂñ1FïÉ ÍãzEÎò¶‰Y?ªØäGäåQ¼Ð[ý­¥ø½¼Ð ‡{aqò¨Žnò2³sŠ?¨œåŠ¦éÃJô]¼9¿±`ûßÊ ·”÷±àxUUEˆWºïg{ÖãÂ\÷ ZéÏ®2º‡ý]¼ð;yË//< í£î÷LJ…›…õ ­J—‡üåœ/ü<þ]^è¾AJ¿‡Z"Sbmv^øxá;¤ô›xôåúˆÂþÄÂãxaùq,ü^h(ÏýïÀÂðB_? +%Ó|照ㅻûTw^¸+/ôy¡¹ú ÉÎ _Æ|”ÃïÀÂßÄ _µÆÍád«‰ñ~ç¾Ä _ó#ÅMXâØÏŸ[HåŸó…þ%ö‚l>ä…ºz\lö÷Äy’ä;/<%/ˆŠ[m}Õò±XÒ¶ñ½•²ã&óñÜñüïäZø dòQ%4-xz±ó¼PÖð·Ö¡”ÇU°ZN#e½&KbŠZE¾0±Œš¥qs^þöB5?ý À‚ˆ›@èMõTE7‡]ßnøsPż׀£cþ‰·'þ‚ª_È =…¿•Ò„Ò^0””ž¶Êú^~¤†Op Ú5x]x=zQWe™î¼JþZ{!êú…”D +^gÆ•Rü}dK¾æocÒ‘¤*:í+ Y"ê䣤üâSÌóe¼ 5ðŠbBÆÀ ñ¬åaÇ:ËäxApÐ]+ÀB°0ðU‹\u]×æ1¹ ¿Ì$¢¿‘•» +^F—Ô‰}Jx¦¶§LÞ>l¤èyAºÖÛKùrüúŧÐú2^©ËÈHݼ¤ÃìÉê˜-C:'«KÉ[í>,"E0V^o/4f¤ž° 8Åj‰.ÃÂoó#ýI /ä¤'‘7[»ËÉPŸÎ¼È(É»,`aêàA)6ÃŒÍúZÌSü.Þç…† £ÝúT“Ë<4p|RtxŠ~œ3áã”U]ðL3"ªçÐüdsdõe¼P'jáSâ*!YO +9ä]-2_rÛör &­efG*ë<* +Z^ïGJUU9*aѹÁ7– •ZØ×u¤ß׿G!/ÈA¤‚!~­bíHgÔà[e:¢á­]æGî™!™›TéYiŸ|™|.“° (ð2ˆÑ”NÌUÜ„§½âÚ¸ÔSÎg5û…« +k2e/ã…²Ÿh–D®C…ªªWĵ³-\A™²P¤`³²œD°J©HÞпÚ.K}7”|ÐQ¢oIÛÁ‹¢ü‹ûþ †¿€[í}$´,и' ãÆúNõ v™P¨p_pÐøkTl‡Ê¾ø:/l¥p=o(œŒùI5‰› ©mƒ‚‘;Ù»1\Ör &By kà&è[,ü¿‰•ŒEÎNÕÈ]ÊRϬiZ—‹Ü- N v’Z‹ŽDt-Q<Ò¨1öÐ,/öäˆ`ÑwòŸ—û xa«RMبoÐFš>ë`AU½A{aT¾0Á]âY5QX_À ± dÒ~%sÕV¡íœ«"o %6Z¸«w!/¨0t ^—°à‚Ž$•RîòÕEá= *Ë5a3r­Ö^Íùèìu¼P°Í«ä€,of^"bÎÓ•è%s¶±ó^(Ë ã‘¾Ù^Ðs-£Kcg$ˈ5RP•5ÀßßÊ o;Ÿÿ^ðõÌ × ‹(ë¢å¦ËЪqÓÀ¾™õ”\ ŸzhóU×ñÂ`°ðÑ·À+‰½† Ÿr®3;0 Ð¨à˜ +~S¼‹pG‘á¶(®à…:1CðÕTç5+º¸šqya×r1œw++ª×¼ å“ó‚vDAËåk‡]¤€à…·ßl/¼%†¿†‹o–PÕÿl·5=ñ^Í]„'=;]³]äy!>CÜgqªåù4ø¡Í‡ÿríWY†èŒòÕÁ’å]*ŸÛ^(¤Ä¨™s ž_øæX¸|üÂë>†¿‡Þ¯3sñåž+Nõ$èo°Ê:|–çHHZåö ~¤&ªjŠ®¶ XÓÙý°pÅø…|ý[yáÏ’N7Ié/¿°!Á¹AÖˆ)þäÏoä…æ„Œÿ:ÕOt/°à^caæõ7óÂëÁø9/Ü(¥?Ì çñÚðë=Àl‘ÝæÈX¥KÖ—užrl¹#lðrüX`!O°YðƒÂÇbÀ´ÄûòÙá#¤÷e +* P¯É@þû¥ÁP¬‘Å'ïØEöÂJôh?Rì ‹Aq ®×–ˆ†n”Ò?x!Þî£aï¾4Á$†tc H,^VŠw²í‰BÀöÊN¿Ê"»ËÚC†°¡é^¬Ó€O´kƒÝêˆÐè]ÀNñ˜g¸äYcì-#ðè1;K°£$ŠiÔ«&%±ß¹nàðt-ú‘OX¸¤M=ÖM¨EÁ¶JÅåºl¾™|Ÿÿ­¼[cŒþS/Zõz^hŒ + +r¡^g/µÙ…$”ÆÛÎÛˆR½îù^({ƒÎ,„žÞà GÅó„èí>ÐÃC@7xr3Cc!R6ˆ«xa%-5ËT’‚êUé.U‘ŒGRJk•5#hPÓÐ/QýÚàN+ž´áã"¾Í^ËQ¢htë30§‚®tóÊfÆb ç6¼aѵ©6ÓA]vfƒ[¦y·5‘f]?„Âõ+塽d©Ê#×ÃÛ›JE™j׈ ‘ÊdDÒ«y¡Õ­ox +Xàz31AGjmˆFòV™- {F8àûJT~µ x± S·,®ê{332³•t½*Ðd¡…KÁ².ß}>­xþ¼yiûÚªã­N„¥ßÀ ž¯"rq3/¨Z$j{£¨9½ØôG¡Èïv涅áÁ™SÜmN³Ö}½uºœ2ÕØ™IÉgÏ;ÐbUkæà9“l¶×Ú ¤ˆHˆ{Õi ÈÎ<É0å X)‘×£•ê 3¸CquÿÂTÂðiFOrg»Îº´"¥,u>Õñ•HWjÈm¾"‘·û‘šüd1D7òB­!î ÛÚÙMq¬X .õ£7׎ YcÔºùá0rNE¥/ ›pyõ¶ ³Lćñ»eGB5i…ëÛ«y¡kHÞµž«Û²ðÂ`ôÜ!Þ¥€…ØØaŒnå…¸R°P×f‘ZfÎBi“‚ÞG÷ö‡Nw7ô—«x²h‰}9,!R%r<’Š‹U…­¨×>Çö› +•ÎqˆM«xð‹^Å |£AÃT4k°ëÄ+j0b;óã¡«a¬|[à–±}5/ô3Ž­¶ƒ\Óºî +V÷f”´gŽ3»–WçGJÆ¢ÉÉÛ1!CäÅ ÓhŸHhц˜¶…gl²vø?,|Ö¦â’ÁeéÒ©¸ëR©<Œ)84S Æk‡z0P-˜|#Å]ÛÏæn½G¿³8Y ué†þ…wxáп-áÙçú0âÚS(Ûà³á¢iQ/ÀBƒ©*»Òe#YyìAeKÌrI®î_xS™â¤]‡víÏâ/!îÓ|ª%öªE¦âžµ¤TÊÿ èûÌ);+î_inà}jLœFø¬U½pàTØè&ÝLß‘N«å^èPp臎{M¸VùÍ¥Ÿ@vmµRÏVä…¤:ìúX^8s%mÄpu¿óX¼ðè0ΡÂD5ÆÐðl•'Ûy»DÒÙj;†Žéc°pòDqª%–óˆíc€vBöÊÿÃ'¼€Jš©‚HÍƤF%‘eá nŸ«"äRQ/É öŽˆÍp Œ„&èæ^èÆ OÍ|¸Ë3^»6å…?ˆaS½žî…¸È³Ý R#1ðŽªÕ…åÔ ünxšs†ÛkEYeµjsôÁÙìÄS],µDûxvèpˆ)áA¯=¨–òÂì….N{°½ðGçúļð™œåˆOüH|9üŸ‹ÞÊ e}/€vRKË…¶wŠ#N{”C¼àG¾ÆÖ0h²{2ÇdbÑ-öÂ¥çA/¯,)–Ó02VëX04ì¶ÀØ<î_ZÑ‘B€¿ƒ˜~ íß˜Æ 7ï{ªÛ*koà…jÚÀƒþ±pÑH§> ëtO­x /°LÓò ¼ð¡½ÀZ°`u³‚!kk^~ª*Ï 1nÌ’w°}õ1ÖZŸ@ ®o°>)Ѭ®ˆW»Óø…æÔ£‡3ÕÝ Óÿ  Œ«L| ¤;Ì +>¾iMú¾C‚Û™\Ï /='Øe2Ro¶ýZWa +¬*ÊÆŽ7òB,äÍsT†n›õŒ¿ãÖõ².OfôyóhZåMgít³ V`"ŒOØÜïk"<ÉÆâCgô½ó©¦äšéšî5®íÌ•ÔÜ ô£X›S©Š¿ ¨,M‰Õˆ³…YÂY¹@ŸnSâ—i s=/`BÖÓ ­ð%HMkèßÒñi Üx¡¯iÒË>¡r­kQYo#ØpB6* +pÞž$YåožßùªÙï5®M$Ç¢þ^˜ßíSm^‰(ñ߆…nÖJ~ÄA)!dlül áŽt¢#DYækM”†gæ„Xé‹!-®æ…0C9†’FhÊ bá8‚‘·ðB¹Z͕ɸ"£pãÊÖ…)KVh À‚!ª•2‡æ‘üUyóîPî7Þ¹>Y 7mzÊ-#º¤dö[òø+y!C׊!ólçNx3â`b;›°`»¹K7wù ¼P®\ WYbx\‘œf.…g`½ +ƒF7ÓÉe @HÍGqIߘ7ï mêò?JËòý¼àe~"y=/  ÷ƒ³¡eÂmë w¾rPŸB…×[ìöâ'üÖÍc± 1^hñªð‰YŒãÞ5B6CÕ7ŽÔРüõyªhWNÞäGÚrg+mà°P¤ÄׄrÄf¥G½l"ÍM¼@f!´‰EAê(‘}ª&Æuƒaz ”ÅFG®ªûÜ òùy!æÿ#iZ#/œÒ1$G9ˆ“äj^Àù[z§¢0 ÇÂÿ!õ¥RMäZPTªMD]ê§á$ REÅB·%r,´t$ÂÓ"'/FN •­·ûSØJèMý ñç:Òˆ½¥¦ X¨OÔßÆ c̬fñÈ×ÞâLMA˜58fa\žèx +Ï‚óDZç·Z{Ò¡›wÒ@­â«&Äíã¨Oò¥êZ^° ç%8GZ‹jeË‚¨Øl¦D ÐyR½rZ×> ó6/b×e/±À\Â6PA²Ÿ•f™¢e âv^8ÙÎp!=Û¿ÂÂDÄM¼À[Æ´– xÁò!¢ªŠAù#AîÁ^èe¬uî2šDSR?ýü ØLõmfMYÝI/[ ·ï'4ªÆÃÈÜY[|C³ÖEü`^xI+œÓB4ÓÕ:ö£÷Þ÷ XèÜÔÕJÅÐîjÓ‡$ú‘˜R«rm;ùC±€™¯QÚÁH¥¡éIºþ%ð‚1^€ ncf hÜ H‰¸‰‚ÄM”À_!Ü Êýì„…í…°ÒÎ +ïÄÚ¹Š±ÎñàX©ƒ›$çTv*ªŸ~þ…La¨6Y2G¦Þ:š4¸ºßÚãÙ½U½à†æ¤{´½pJ+,—æ¤õ_«#áøÆò F:FN O•;Ä­‚½Ð­•›‡«Œ–= @ØÏÏHî[e}E81e[ÃÀ^XvûÁ„Y>íáÿ/DaâJ…’J‡äo•*~¤ö6?êH¬à ª€kR0¹¸-I„sÕI™£ò”ý?ÒŒ£¿A­sS˜Ñ½'%$Ô^»(æ¾mÔ˜:‹È÷P?Ò1Ô7ûÂ"h‹{”}é;ƒÀh®€‹æ$ºµsþ%!ÛšÓÃömù°0×a¹õóŸ%Á’ØíÏB×>Ö@¼|ÒÃÿ5^½X†"Â…âÐMåOIò"UßÖ¿€½ =¨s=]ë$ËeOë8?ÌRXRÚ¹¬{°©*¯×ö­ö‚>¤JÃý@§Œ+ FCÃë0´jËëgÇ`ΩèÑ~¤SZá1\ïGjÀ8ecÕøt¬ý2F  Ú<Âñ½óÑ2ˆÇŒv3JeÒÚéJ7Ò“Æ©.ü =zƒ_èwaÙõö¿–Øá– æ8ÛyY×Û< ¥”õ•ãÚ¾•°ÕG,àLÈ †} +¯5'Ë!#`ÁÌ£Jè4~tÿÂËÔ…GWÒ }$ãûóŠ÷)¹ÖcôXøb®ìüÆÕ’Ÿ©Râ±¼àå‘LA)/,$N a1Yö ~ÃKs®ëÓÕ*DƒŽUL¯=:û@嵎+çŠwN‹…й‰ b3ζ«› ‘‹þâÔŸæ…É)Œ=Í·BÆFS§—•®=/âZ¦-qª–ÔR¦IK€%€3H%dâÒE½é~ŽþŽÉμµ#£Nà¤.Ú¼Q2æ—\0ÙüX^‰{^Î |¶rZ8OŽÀ÷('KWífê§kA=U*n$C¾aA-©rthÄÅBŽÉ-1ú¥é ž“Rä\jÍÓóÂ4d)e=ã5ny=€0µýJ +F{ÉÖȪDkV®Âw¼¬ T#°'²E½ŽW}{0-â(Dñ7¯üJØÇPWxu([O–Ù<˜Ή!¾‚°èºáع¬]>8eÆõ0­£§S˜(2äU]kà…“G"FŒÍ˜wùäãbaA,L‡‘–<òf8Ú _ÀÂÛ =“².kÒŠ:¶|-ë|tå®5°E$.ÒœÕrÈ[†5òBÃ÷ð/îÓ #jUFc¶mÕ6åßœæ´b¸œlQuJq<Ïä3Ð{Ô€‘ª`AD8»Š‹ŽSp„ï ;ŠÇc!A–Üö8i±J‚í,R¼‘ #ýïè©Ÿç…ÐKPÊV-õàªHeŒª‚‘~Íy’[Ufn¨sU^P†ö–ÐÔ¥ýú‘¸nDœ«8ˈÒÆ3Q¼°ï§ lbŽw™Eu¦-˜M†§Ícyáe†&WÙ x¨Ò[Ë”ô­Ó•ã´© NRÒYØ»:bA aÜ;ÐiΈ…üš¨Ó»„Sœ+57Û á~j^Ó¡— ^­â¤“õŒ™Á)ëœ'¢ÀšH%kCñÖÈ( á„,ŒU°ç³ŒãpÛ†Õ(j‘[ 0èXïS¼7:æB„¼®Q%Q¸@½ pH:ý`{!@àøFúKya<Ê`®œ&ð£r¤@\Œ`ÓIîÀXv8ØqX3î¡Kõe×¼Ô§ºez™Õ-Îe_´]W×ö”fí~f^({Úƒ.¢,Âþ…dX°/-ŠJÙ/Y¾²Öe9Ø4Ä(Q2EC/׺Ýñü$~$ÎÇs?wí©­z€æåpíºÙFóHÔ³;²M]Êì…X¸†Έ!Ê/ä…ÁÛÕ\ÌzÒTœðQ€jÍn—;¨kK|g˜´?Ò8¹µÕ–‰ó¤Ré#±°’OÿÂSðBÝC–¥Qˆ@Í«Lá2IÏ-á²Oa!K×Ó®¥Œª"Kd0³a‰N’ô-Ø7ôºýÖx¤Qýßwäç7w>«ßš§ø`4”a¦ç&¿ ?Á 2Rèu¶”Ô ÞÀQ¹óT/u‚{p¢×㮵•Ñ˜£.AÑ°„dŒUÎ2ìt˜Ø“k»Èqÿ¿p½'/xÝï(z½• sôbÇÛØ€y¬ÅoÅÂOð‚ŒÜ°ö}áfT.ãHi1¹óÁÍu⦚ö´¯»¦‰+ëµêÙìSërËÙ O5Þù¢kôÍ5X¸’N®¤{<uÊZâKÜur@ŒüZ,ü/äja ë«*wY\–ljå[,¨ACál×A0}¢ +Q®²WVDóZžxaϳ}+é.¼àp +:m“³åÎÀiùÎ —ð +¸d“K+ºÁ~ƒ…HQžçÉi× (DO  …=ÅLXE"Wˆ/üp/£7ÁiÄU„‰^çt®132üõ?Ê WÒ}xAÍÖ8·f§jÚyáb^ÐÝÜf}\¨Ðñ°ðFG:ñ¶k½‚µ°T\­`eË0q‘@‰sJžÂ^dŒòeË\›¬‹šAixÕϺº.Ç"î…«yÁÇáîÁ }ˆã&)˜ /XØyáB{!Gw\)—â\#™¡Jxy˜¥ y!Ø 5êH¨|X準"B#:‹±k›¸ =[\KžÂ“<4('¡M©¸ÏÕ,BzÄBÛ³,s…XM:@£¾+ØãyÁÓún¼@òÓj¤AYs¶óÂå~¤TnÙŽïcQ‚:&l}k;¶]ÁLâ8^\. ‰bÁ +@ `¡f­sßÍ ïÚ Ûô#ÒtˤØÄÀ ô5*!p $SdƉ¾:ÒqИ*¥54®™âZñúá¼€3TÝÓ^À'SP28Ò±ÐÄñ¯ÃÂÙ ›€¯˜9ÛÎœçMå¸6ºc…F x„Y€’#lÊ{4±¥Làs6¤`2ôe]÷ö±EÑrRg'üÁ $dƒ‚š.pl Nà[Ú« “òÖ»ôñ¼Ð`*£;ñÂá…¡Ù*‡Ó†©šŠZñÛ°ð#¼´GC¹îG­»^Öy7[k 9„ 5mg +æ„w-Yjµ°¯ZfZ· +ëeàÔILŸŽGŠ9Jz·ú3,¼å…Œ …Âi#©Š;§³ÚWŽ¡XõÎ}I²ÇóBHA^Xõ|Êe¯ ÑfÖ5ªad†ü:,üLNõUºà:J>‰è>íú^ŠáŸ¶Ä žõ u"WýX€ãG^V!¿!EoÓ DF ßÁ h1<8Ÿj¯oO4üOðÂ'ÙõµƒžÀt¬ÊH™,Åô¹ëªª˜|:Ë­t…¥É351¥óTeÞð%%6Ìöu,ÜÄ >—î;¿CöùN(oç­úLòåÓÍ¿ ì©%Œ4Ø ìÐ9Y-©Ão5ÊrœŸöÃQ’ ~µ °`óïàÏèߘgûoá…:_^çG­?ݖʧžßYįmÌ×)…¥ŠÃ#ãÓøÇOÊxá–9mÿZ,ü4/”ÇÿÐ8–Ûæ0;IM[º Ü9XÛ¶{Y÷z‘O<_Û›²¼q”Öê"ýä¼àÅcUU–ö|džn¾¶ 17ÂKº†~Ò— ŸD¨ .áÕÆ–Ãö¦–A©>xTYvodü[xÁÄ1ã˱†Rg{èÐ}ìTÈÅͦ-'÷Î _ã…’Ye¤æ$–Ô€ýRÂ2"²TPÍ¥ÎeÏ9éAGé)&à†Cyxÿdó/Ä–RùXke&–G¥9ñ ï1Š,^´„(cLgœpBL-0Λñ\à¡©¯~oñçä…CR´ã¶3g…Œ&âF¯ÃjóˆÁ~ºMÎ6P•Œ,¸!Rz´DQJt4(Û“Ô²s ‚·V¥’€ŽTJ£Ù“Íï<’\f.ʤ’©Äw 8Ϧá8­÷9Yb@;³œ®¤«kk¤$q¦æìB½Ðb)#續¸eTE2,º@@’2ÄÂÎ ðF\/²os)³;Ør¶X%m"'»Ä¹Õ-ì^Ãïz•´Õv‘k‘ÊÇ»ÉçŠGj0ù´·:>TiÃ[Á­<ó¸%#  +É(S&š\º,•[#E=¯<·ù²¸.~¿î)yAmý Iä8wjúÃi{À`ÀéÜæت^P;/|Ö:–kÍä€]Æu "1$[2ÙË- vØ>%îþF–OÄñ!GÎÈac¡sžJ‚´#äŒ#×&ĤB¤RâIFA^ÆüëJªä·ø‘ÂÔçP°D,ä>ß å:lj·B/Ãå9?þe^x7ÚèýSÌöŸ1?n/l¼ µ8úD¤µ1±¶ ¸U"<Ùxß1Ë…oÍa‡Æç}­¢ß §’;ý ©ù‡ãT/)uòGlÞÏÇ#u„ŠÅ Í 1}g3ˆ…‰€L‹fr€B{ÕÆq7'ŽêœI/R·È °ðüðrž0Ú_…ß6ÿ‡1Û?ïGª5á¤!=n,Ô +øÆL8“g*¤y º¶ªœj {e5ÞaoW­¯É×u¤gá…0sõÎ ?Ç ïÏ¿ðãñHÉ‚ó:3qÒ©·ÿaJQäø®©ð"¶Î…øphyöįㅫà³óÂyá ǵ=®<)/$ã4‰¯­Æ6{F,ì¼p7{á{±ðó¼0½©j¾‰×̪Þy᡼°çÙ~/j0n„DS€‰¸Á9G2×máÙ>®Îëé2ÔqY„ñz1®ÅŸ¨¾r¯&_µ®ç…g˜¯íoã…œ;gϸæ!™&½ïHæ2 ÎpL¦êG✮sç\ëîTç#Œž¡¤ÃÃ1 %#Vñø¼‘úJö¤v^x"^H”gGJ¡·Ø…6"4šÚõƒsUëH“83X×RíôÒ+UÍ® +Á“àvi}`)Îï¶ûJëÎ »½ðD¼0bJ' Š§ói{@¡tÜg[Tv)è*;¨§ `Òºî ·µž(1a°*W‹7r…‹ž »iç…Ï.yÌFWxu¼BZ§I¢ï:¬áÞ\a=ÀþŠEšÞñ`Ñ…Ÿˆ…î­Ý½<v^Øí…OJ‡ˆ¥Ç«cåÎ Þ‰"ЮgÛ ~2,¤°µËó4o`AŒFgó|ÉAGzŠ^}‰;/ìöÂñÂâø’)—4ÇáÍ8¦söÜñæ•ÍfWë0#ZGaÿ5Ça|°hU‰#”ò.`Atš k}®'L°IŸ »i·>ó¨V*L¼“£Âêÿà;r”Á‡àJF\­t“`eJ)…»0Tq"G1MjÄ—Q3E ÏÕîGÚyáwñÆ$ F‡œê1f} ¡ç‡yÆyâ™Ä`í:Ä™„Û:Ä“ÄQ$ÜØ݇{únµî¼°Û OÌ *“Kž »iç…o/Â|©ÕÝyaï_øëy¡ùÚp·v{á¯ç…/–p^YîñHÿ˜½ðœXxŸ*…¸·¼PÒ¨¾ 5–çÌ›'å·`án¼ 过…ÓÄâk¼`øt B–„øK¼ S¥sv)(–þ)í…”ÌýuõÕü/àLYÿ¨Á˜Õ[^xy«ñÙU´s· a ØårzŒõ/”õya˜™SG¡'{†Ò±W'z‡øX€Æw¾”ðyº Ñ°px’\‚¡œ¹åÑNÏÏèž ÃBäæ©r³xU¨KOËìl£Á̺¯œ˜t$–ûáU^ý°9›| uO:Ï Ñs"ò¶ÀiÉ-îM½»Z}zL@Cq Pžñ½µ7>ÛéŽõ¯ë CS+^Åxú+Zg¿‹ÑñÓòRÕ×b!nZ×¾w³åá<•Ñ^Åðõ~ÀÂ÷„Œ¯NDÈù£…?xáãXÜð§^êä¬Öæ—çùóïð<6º !Ý'åêµ- ¤¸áѺÓå60ðAüKXPœ¼•ç<Ï6ꀄõÚk'pçš4?ƒ ‹Ïÿš< !•ì/RÏ<‹g牛?íÔq[¥½o/ÐÏF¢„癓ËÞ:Ô—ú0.a~Ï^Š¿É^xyÄ‚y>$< eÕu]›Ñt w\ª/WùÄ´lH¸Ä‘TöÓlm—{U?ò©~¿éb$€~„õ5ößéS=ù‘¤zN$Qƒ<ˆ™4ˆtžƒ Íņ…¾™U’«ö¤O…¿‰þ­qm?È a:® »n´íqþ”ÞE©k¨ëY¹Àõ~Ʀ‰LBE‚´¾ââé±°óÂn/\\bœŠw +š^0$Ž˜¸"ƒ-ÇÈÄÖ/•û‚ Þî~¤Ý^ø+y!;ð‚é/PÜ[×'Â'†yAL5‘õù±°û‘v{á +{¡C{¡e™‹¼á}mxS¨D´ªÖ¦ۼՋجdˆ¿™¿”fç…~Ÿi4èGÒgœëáKS/­"(€b¨·Ö·ÆЖ$‰pLÇò °°Û »½pÅÁ¤û@Ðm8+Ý\D}‚uÝPÌ-Æb +Ó–3,ãÍ/ÀÂîGÚyኆñD¾ê¢íEƒ9v^Øû~/øÚʨý*"҉߀…Ý^Øyá*WÒ%Ò}å}î¼°Ç#ý^ø–²óÂÎ Ï Íôv—dxuIšú¨º„ „{¾ÎR¢Ùí…Ý^¸üóÖä­È«KNÆgü‚ +žZ€0}ôËöŸŽ)ŒÍ²û‘¾òwd#Ê¢äèyüMö4¢ðwÈÿPCÛ[ñ& ý R Ú7­mh/ã“i¦y~9ºÁ£­EÌWQögòLÜŒ…óñÓ`F†;ñÂOd>K}šþüð‰½ë?_m¤te}gï‹…o°ôäÛÊ(Mmn ¾!6ñ½UÆjpÈmKTBÝ)>ék!*BHÑ4öptÊI˜GYÉ ®téä°k®i+g›[±Ðä*Ó%öµ…{óý°Àk(ûdaTä¶Bð›ãÏ°p /4ðF›ÑÛ;Ùw{á–T‡ºÞ.z̬>r4bÕXó‹xAΕ%„7Œ´uá’‰‡›<œÓTi_8Ÿ:T€¬YÑEmó6Ona•£žàÑ€7ÊÉEµ1”’çÊÂå3V¨¤ádÌî 7\±(Õú”pnJ_ErXÍÕâ{XC8wã2žL‹Xˆë§â…'ˆGZxã‹Â’YBÃÉM¨øœ¨9* ¬ã&ý=¼€±Öh2 NTx EXÀ»˜'‘(Œ¯`Ú]5Æø’§ ùâU¹'U0*ÂpOc12C44ó,b"|©›y!siƒ)ÀÚ¶)Uå…Aœ.L:Ë„1*ë©üýxá`¢´b¡"ÔÉÎ çe„&¨%·¡u?(¬y6ó>7¨#YS.*ÿE¼ü­vª˜ÝÔ€ʵàÉ€ (H Z1Q¥? Ù,'Ð8z0 AÁšCôjÌa‡‚C%aÊ>ë?k.â… ùJ¾m}å†%íBÞà‚2'Ñ癫ü½x¡á:†AˆkߪTZR>/<½€œ D‚)ÐÁÒš@" X.‹"Þý*^À hS,а0)Iq"ÎT »Ž=æ:Ë/4êòò€…ÌxŽ• ‚³0Ĝƌ˜+½lør'^ÀáBˆ…ÎcwAÂd[ÒPM¸vÓýx!€y©E +Á¤šnå…²¼K&Œçð#™þƒb`»%5ŒwAD,$hnééWñ‚ X)‘Þ54¾-Hg®’^e¾± ±Ð6ÄŠØ,hð',Œp4mHëæÈ … ÇdžßŽXAQC†XØxhÙÄ®¸/> +!âfSýâ WU7ò‚”}/å—Äýó´ôOÑ¿ ¡ +uµñ‚½ ¨£9òBðX~/ –ÚÏL4Ñh6Ph_ ‰@PáK¿`¡ÃÑÿ`¦^•Öšg,4 Žåšòbú$皘µ¹ ò‚…ÑôŒXIáÞÎt$7Ïf7ÞÑ^8øn/••kMåm¼À͉Ž¾LµìsZ>»½Ph׸ÕÚÍ8踂‚Б¬p˯á…&§>Ù®—Ø‹´J…ïá˜~šúj5©†>ñý›ÜUH™Fƒ õÝ,ÕÀ(õ8ás5x4öX‹e`4N=´ l¨ÒØ7‘¼G_¨¥™Æ÷]øHñ&â`É–áe0’‡´ï9á|´V|‚½ëüH›½À5²/7ñ›œ®&¢"¹â%˜7¸ “Oáÿ>¶_¸6®øzü [êòã‘""|ozX¼,ô¼‰[žù5óKêEeí=Ö¿# YD}ÇÜ’_Ç…‹mß¾^šIèR`‡á¸À’çý¸gï^p­t| /ÈÈÍqSee-iÒƒ®DÃwOÃTn}-“°¶_“º%$¥\û¾OÞNø¼ÐØÉß½I ¹Ï¾¨ü~È ¬PTb®í¥^-Q$c o‰âQÏ3&Sž¬~-°V+/¿O´‚­,Å4Tìã‘"ž/NµÎ£»fþ·âTã™]GJ9«”v.J_r5ÙÊxælV µŠ&Î yG"©IB5‘ƒ³Ã›i|ž%)ù.,}~çŸä…kˇ¼[ŽÕ^²žŒBÖj¦®B‘©¨WÅ꺞FjJÔ ÄÈY..M].ê}¼óðBÚ¿ ?Ë ¬%+ü’ù¨Œ­RkzR-kR ¤œÑZØšJ6ò2u/©ûcr·ß6~!.Þ¨Öyú;x!"É/ÁÂzYýü0/ÈÔe¢–±!”±\ ð +ÖHÖÐljY¿¦@ €…–ËÜer¥i¬QÿòüHìmøJdä¯à…ÜE¿ Ã…sx}d¾`ùÿ0¼ær^(k­²$išDuá–Ä^¨eB\ÎÀ>ˆdáòÀ …ŠJÎûºSÉà¢'å…xÁMq¾0ßô"‚/Šwk +2$Ö>MµÙP™9HY/è”h»_Á ùa^¹&íæ‰ù2‹ÚO•w]2H1 ,³¨‘ùD6W¼ýº˜+ö@,àhˆfó— +¬Rìð )\q1 ±€F‘ý×ÞÙ°7ª2aDEbŒ(*ÿÿ_¾3¤{v÷=Ûm³Ö»ezõjjÓø7ÃPìäBußüô­V¤äã\Xjp×rÝ47§Ñô‘šÆ›æÒ€ .„£j‚£KÓ,JIÁS3É…ø ”98æ_g´wÆ1ÖX‡ÉZÃÎÍ’Ö3ÃdAD?GêØÁû°±X^K¿{2.¨Ä…Þ*Rð5óPQm>¦¹ucð×@CäI0›‹+q¹æ0-ŒŒ¸¶÷Žjc”œ +¥H›[EB:µŠT#T~ÆM`o­(m~“Tü7ó΀z¤Åe½^Áih.7z»\(ÅÉœbø~^ËöÖܪ‘¾ü~Âx¤Þ˜¾qÂxðÿ}óþD¯ð`ÓÀ#(I}….à¢.Q×\‰VÉ~Tk· Ž[¬¯=ÁSrû1Æií’cT6Å¢N TŠñ±Ó˜e•R<‹sÑâ-ù(-`ob Q“>RE=[)™JKd˜¤ÌôËæeØœ˜7º“ w'ïV-VÆÖ†7_‘ÖÒuà¿Ë:+{½ú8°›}„ôâþó>­œdðíèË44èæòò®ËõœñH«’8ЂóþÒXö&`x[¥µf檮ñJ˜–Øv`Œ@d&é­qUÀk±2çâ‚øæ/ˆÙ2Å*˜ +…zxE-`T«¬'³Qá¬ÚEF,4Íþ(-´Û|éWßg}yÅhXªZ^¶]O×]ü.bþ\¨ o~½qÁ|™£2à$ñŽ¸Ç ‚‡»¶××2|™õ +oP 7W`6jbgZRŽjÃTQ,[>95—ŠNI #F•Í÷¤ÔŸ‰ A™Áo\`Së†já¢dÒô‘ ûnï·s=#!„©:J Ѫ´¹<œØQ0Etƒ€í†Ý{%p‰•PÍ=Ro6µ©>·Æ0uLK¼.¶.âÂ%ô i+~ÓGú2ù‘ +\Èåj\ Ö™T· 4ŠP(Üv…WvJŽÐZÝ”Ä5c¨…F‰ÏÁúÏ3°[™¸àB¯&L½}ï#ßc…–X pÌ}PåQZàœ×NU¬ñ¼—ƒ2ȸJo²¬O%°Ÿ õ²TÐ;‚ËJÉöK¥eÒ|.ë"_º‰lâ—çB¬IgYS“©#÷õ„Äí¡”zÏ:‹ó‡ Àcµ”JÌtÌcû•´ ^ÓíÙ¸ »WSÄH¶k’ñPqu ¾38IË´¯äÄâ@.†ÍÓf òØÖ>ª¾÷k¡&+4ëc,1÷´&‚[•i‘))*Æá®À…»¿°ÀeIÔB¡: ¯Q =hÁ8=N¤_•ü¯¹p†x$9×Pz´ž¡†´¸¤ã¶Z¬´í\¯±Ä œ®u n)"¯0F0ã÷ä?ÅüÂm²Ð÷ï¢ð^K½^ 7ë +ú “®r0õ2Æ›5VÌ"òÚŽ¸ºÛGç%ˆSe¸@ŠºÃš6*g€ÉËæÊV£t¬RiÝÍ…ñÅ÷F-”¸t¸'^¸Zhðj'Õ_þl)çÙþ§Á`ôSÌ/üÚîÃJÿª¹7Ja˜ 硨ºG:«”ü[Ö ÂØ·u mS/¯¢ÅÂ#o›]\_æV– >G+;§$ üW¢9ñcPªh”_… ‡Ä#Õ¯æeÿqªVy£þåüs†ƒ,ôp-¼œíÆv„½ƒ tzÙq"eΟ7 ÃiEÐ_ëúkßfa‡½.ÚϧºLúaQOÝŸ¤…J‘f‡ržíõŽ°œgûZ(Äž–/çÙ> ÕÂÂÌü°Ã©Çjag-Íy¶Ïâ/| +.´ß;!e÷vdùyv›êÌZÈy¶30Ì‘÷MLêíGëþ/éuË.'ÖBæBöqUGÑ…º/Ãfe”6Ìe¼Žb¨d5ºˆ|líWô+â0AR€7F!:{MyÔ2²¿ð7paQמã7]åE«ÌÀL)a]·9Ë\Á‰bÓ¸Áaëb Á¨6jÅÜ-ZÆÏ«…<Ž”ý…GúHªIÑÙƒ>8œÏUE7SO \TÕòc\ö‘$íY§TíFÏ«…Ì…Ì…G¹P§ìÀB5\ Ŷ)©wÝXû{¹À¿6“ícLíç9ë½m_C Ù>.~¯Nl쯻!D‘üýAßnW³`g¾=ó×sá1£ºendstream +endobj +5752 0 obj << +/Length 105 +/Filter /FlateDecode +>> +stream +xÚÁ¡@P[˜Àª¬ K¢(Š¢(þª‰¢*Jw‚ ‚óßC•RÖZãsNJiïsöÞ;çæœÂ£Öº÷nŒcÜ{)¥RJBˆ¢Öú}cL)e­åœ‡Zk€÷Þð<Ùendstream +endobj +5747 0 obj << +/D [5745 0 R /XYZ 85.039 781.388 null] >> endobj -2615 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R >> -/ProcSet [ /PDF /Text ] +5748 0 obj << +/D [5745 0 R /XYZ 85.039 590.299 null] >> endobj -2622 0 obj << -/Length 2838 +5749 0 obj << +/D [5745 0 R /XYZ 85.039 590.299 null] +>> endobj +5750 0 obj << +/D [5745 0 R /XYZ 262.428 239.639 null] +>> endobj +5744 0 obj << +/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> +/XObject << /Im16 5319 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] +>> endobj +5755 0 obj << +/Length 511 /Filter /FlateDecode >> stream -xÚ­]Û¸ñ=¿b›>¬ ¬‰”,)@Pä’Ë5í]ph¶H^¸¶ÖV"K>IÎnþ}ç‹e˹àXÑäp8œï&¾Šà_|•§a¤‹«,CçWëý“èj +?=‰"Iu˜& Œg—vu¹Ra”ds0* U¦¯–* ‹ˆ ~¸}ò슮T®Vúêöž o7ÿ b.–i¯qÐ6¿Eq²=.–qÐU0ÑlK½Ê‚Ÿ:œjü¹ -~1‡Ckÿ»ýÇ“oGÚìÁIÅ_¥L«0O GYœ^ÅÐZø”½€Ó U_ #‰Tð€d aÃŽ'Þ#Ì~¡²àÎðŒa*Ⱪ;à_ê¾q4åNè`Û-äRI{Äm0uð¼?"ÖCÕ6¦†a5,T|áŪ—ƒ‚Ï‹t˜ -Ì]]òÊÐ"—àJËä–ÒÍÖ]IgáKäh˜¾'/€‡Ášni†ŠDÒ³î`)J:ý+ IÃù@$oZZ•ïß¾–‘i6 öïwoÿÃSÛ/t,ª@’·8ÞD9þŒÌ!,´Ùr·ô/—|»–€÷|¨Ö$¯f]7ŒÈäù‡ -¥¨50iW"¢goÒ•§±^…E&ÚÐÀÍ d¢+*•Ndh‰EmÍèצáÁ1邏àØû$ Z^zÍV€pzWÒ5efV>¨ Ÿ˜°ŒPîb5áÅí÷ç«íªëþQí÷B¡!,è,{Lß6 ˆ7Â/M‹†éœÞ"„Åaøó­$'+ÁŸ¿àëW¸ó†± &#Ì WbFû7¬~$ÑÏÂ6$cœUÞX}ñ&‘^¤e¨}ÆJ…I.2ì÷wáºmîgdá*V·3=#vªè,`$ýÚ“-|Æ?ŽÙ çIžƒT*Ö|¼Ä¼Œa‰ eÇ8ÈÂìžÎÀ’Xô2ÎÀjÂmeDGcy…ãºê‡rƒc‡¯c"p•ØU²ã u½5ÆêÀ»@¸ôõ±>}Ýî]x¹Ù“ÐΧ¡º¨B³§W…rBîQçu¼ks‡Ga@¯_Ž&‹ƒª/Û®¿qø‚¥!•â­[äØhdByâý:x '×™†bEõ™B(áÛ"t„惊bU0m ÇæWk™u”³ë„¯(5RMÞ—v²oC*g‘È­¢Ú lÛMÑ}ªêšG¯ -{Ú¡ó"ŽžWP-’uÝö—®nƒª-J, -º#RÔ8•Ô1«!,9ƒØYsCs$O\3»å5rdGB-%ÐgzÅa ú’§ÃDò0¾fˆ£U`ôŒ8!®6ÞQSç%äÞ[rËs¯ò•£é<8_g£³BÝ+FÝÃ¥¼Ì‘Wð¨½Î®I“†k YŽ@ä&+g—)+;‚ŒI!îœ×HΘr¼ÅñýŒ81Ì‚/¸þè¤S^ó+(äÂwMÆî²›®éÌnkk5´EÐsÐâÀ>‚v¼¹¯=DôØQM/Í[|C×ÅõwÏo[>R¾ÙôE¼ýN‚EoFÊ!>Øà ˜r+þ~M¿Í“댜,~¬÷ÆñÞ8/P5%Ïó3ÐavÃÓdç#– ‡WÉ’â‘—°ÓÅ^<#ý)Ï3G/9n2•2¯iæd8 Â¾fãgÍÛòŠóp³9 —¤ªŽ(¼D~ó€rj»O%°¢ûP*øñóòܞˎj¢ìT)sv+$~åà¯_{9$z·hõ5ÅíJòšn·+;²ôSÜ'©N1 ’G#¼—Éœ«õ·¸(­=6R^³+%e©ÛíÖeä~ä 2™åñMçZÀïÛš’pÀ‚K4HRÝiÅŽãóÚùF‘ ïÜq‚È?Èà»7.àŽ^ÊlÎcp”^ŒèeëYHð^ÄFÎIeâ%*B»¼h'bgÀ»IŽ{Âÿ¿ö#@š*Wa®Ws½À»¹Ër¹ Á9¤5‡j%oΤa’¦„ñ´úG(µ©÷üÛ EpMÌ$§qùªøZ`ÉL]ùo¤åÐgå°~æœÑ e)vele… È(p9\‹o‘\¿’]ãf±DE]üçù®¾;ßÑ•.uš±~§’BRH Ÿ×©3aE²k·SZü±çìcà£9¥ùEf3(ÂÞ,ò„³ËTrçGne‰åÖrzuÏD!Gq<÷»äA0ŘJ’ù(!ûæc»“ -\ëÀµcö<5.BÄR••Œ¨³q<‘"~F½ò4ÌÁ>¿A¿V8²þCe5©æœ¹ý$E%Jã“+%žÏœ¹T: u„ Ä"Œ¢˜²">|žFêùÇ–®ÝÜÐ-/)g÷ôŸWNýÝ•óê­E+O)!:‰ÑØSÐH:C^¼Ã1&$.j -¤“ðE9‰P‰Wúg[ÆdPr e Ôùµ‘×$‰üÔé›Âåa3`׶Ã_çºxy¸=6ú&n}o¶Ë ÜØÒæ«/Æ\ŒbĤšµí\¢’ªzô›/F?†Ñ‚ñiæR)Jƒß‘˜v°e.N¦ +‰¯k3¼ç-‚®)ýZÑpò”›£Í_XÆ87Xzë8Û–Y>19­²lGjÌñ8Uú\˜ÈA­ó²¶]M\ã}’xMÞN&ãæŤ'„ËÍBAâHý5aÕÁ¬Ï0:¾‰¢!Z¾% hÛïàæÚË® ïÌz /~çg¯B½J@°`„â.Þ¹T|ŽWàØ^(:PœÝ9¿¹píb6¯n,rHœˆh¦jûb3qà/3÷z;H}Ýó÷ÀΑõ£â÷Í -~É*pàúô£»£º·³Dâ$7ýqä)ƒ‡ŠƒÇ®ÕφPç¿»Û.•à$_óB1]=ÊKeš¢+ÌDW‹^Ç]±æÔ+檫FÞl¤Ì5ü‘÷ñfÞŠzZ†[lÌ%‰ØòzàÆ $8ÁñþÕÏü£®6b±Z ­˜^º«HKcu›i¸yUØ|E…<´y¤"hïÍQŠ!˜ä•¹8SÏ|¯@H…ÜæEE‘ýðöô%ëW{d {9Z]<‰†Î° ‡ÅΟŸH:ûd»½:ñÚ$0KïÈž?8‡£.&'< «5À]Ü®¶ÿj Z1(;:†¯Ä>·ü|{¤ô;P¼‘‚¦u˜š»U—ŠN(É»Až´~úAFËÒßÛñ!vìË3€N7Ø+yAê*y<òŠ˜nZAÜòû1WMbÆ7(~M²ÑO⦽}-Tõ=°‡:W‰Tí;y³êlGa’§ Ür…étêbòŸÎ^ìUê8û£ü5NQZ…JeÓœØ~ÿh€¿endstream +xÚ¥SKOÛ@¾ûWìÑ>x²³ã}õ¡Ajj‚9)Ô€°BÛŸßY¯©N(’³óü¾™ý…ä +§A’Ö!sâq—HñÌ‘‹ÛŒ¼MÉrNªd¶0…@ ^zQýúh(4‰êé6=ý:/«óu–QŠ²ÜZ—žÞ”¦×Ñ[®—«j¹ºVÁNLoÊþ¾Î¥ULZ®†ðüÛÉÐ|Knï¥xâ‘. äøÃg Èá]ÂM´£6é€ð?M¼iendstream endobj -2621 0 obj << +5754 0 obj << /Type /Page -/Contents 2622 0 R -/Resources 2620 0 R +/Contents 5755 0 R +/Resources 5753 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2619 0 R ->> endobj -2623 0 obj << -/D [2621 0 R /XYZ 85.039 781.388 null] +/Parent 5751 0 R >> endobj -538 0 obj << -/D [2621 0 R /XYZ 85.039 761.463 null] +5330 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 299 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5760 0 R] +/Length 23606 +/Filter /FlateDecode +>> +stream +xÚì]‰bã( c0¾ÀøÂ'üÿ_®„4í´³IštÚ³;ãø¶O¹:Úûmõ÷µéßzL”û¿¥ w´÷¹ó‰Òë11ó×`A9'ökûþ¥Ç$ø_„YµG{Ûr'Ç»±ðï<ÑUþeXhýÑÞ¶â3¼ðï<ÑöÀÂ…ßcaþWÓð·aa>DÿÀÂ…ƒ>ÄÂgì… /¼p`áà… ^8°p`áà…Ã^8°pðÂÁ ^8°p`áà… Ï™ÑÁ­ †yþÞVó0¿YÏç_]ã^­1k§,¼ðcì…Q*íÍ"ðML›Ó[óëV)®gù«×•Ë·’ÞÔ—ßx¿Ò®^ø!¼0:Wx.B¯Õµc}ÿÎÙ'úR¸ìD ø'+O¢¸C„;uI°ygáà»ltaÞ.^ˆ4ÿw±pðŸÆBçœë¼›XgßÝ*qÿ`¿ÏiinS|{†–…´.åNÚéäL¦ÜOÉβô–BY@À´Ø•"†Bª d=-Xsð‡­MÓžIґ׬É^ÈyM@ŸÒtÀÅ°ºKßX—7ö˜)4òËåtïl«†tüyX n‘ªl{hƒ[>ÀÂ¥Ö5AÆ eÔá5ÌYö2 Ü]Fš•ÎÉ< +‹‘ÔÁO9,4nò™+¶U.Ú/_E/üFŸuDcq;Agšº³"뇋=u)¾áºw´„Ÿoh6ÄNQýFt~ ¦êx¿õóì…ÎŹëÕΠÉHgk7í ØÔ¼é>d?Ù°}m½ RÉåkRixWývKͺ„ÝNÏÈ0ÆmXCœ"©ËƒrVÂ^ø@Ÿ…'4ÃS ì EM_žÂÌàBOjÑŸ=ˆm¯ÂÂ’S¹½¥sÓùô j·ÙŒ$Ôs´‹ßðBzöm +öÂT'f×}ø%3|à/IEg•ç±TÛ£Œ±(`žî2Û “: ¿íXþa,\Á Ž•fn7ÜÆðò½tõÐÿx©b#Ž8@b­Ó&¯wXTuÞœ°`²¢ÈÂî&îoêÁ“:üTõy‘]bÐoýXUwq‰r1ÇYˆ´&qÁ#‹³ ®¬â]9®I_4;dҲ貾ýÆX¨á&‘]_ñÂ8M1©§º½°Nv{ƒ¾ca~……Ñ©:(µ yäÓ¤½ÄÂ*Ùé.¦ÊȶÙücáÿï8 =e;¶ ­–ÙE÷‘û” ±VÙþw)ƒîF:Þe%0 xÃBâã–ŒrD#‹oÇæÊ y÷Ø°`¦  Š9—l:ßÁš|;hü‚ÿmømòû N]}k,@‡"O¼ >°ì…Mü °À6Iæ/§7ð( &<1Iñ + ø”ÂkU©´ÛË¥/ü/XêFµ›ŽäÌžÁ’Ë·”º¾qý®©€€Ÿ°PiéÆð>îXhœXWµm;¹&‹ Ý^%*®$/° ¬Ø^0ùš`““ýäÐëâ€?/\9l-ûŽtŽ·e°^b^;§oÂÂWÚ d1ì–Ýè—ò}Ä,Ó t߶^æ0ŽD±›€OB\Üèœ &Ší 7ŠY²#æ ’eÔš2Q›íˆíÁ ¿Åí]!ËédW™1¦=gËäâ4­¡óåg,X<Ã>>Ñàrº q†EÂ[¶”Jì +ìéØ…±aQ‘¥Ùk³ø ½_÷år·^°ùhÛawöyá¡ííÌô•æžÜ.ÿ&/hP2² ½ŠÃ;ï/lb;JIè¤/xá ñ»X€}ÅÒK»[sláù¶/Xˆ[~®²o±ãrû1–ÝÔר;ü#XøÊöOò‚Ťb¤Üt¤ÆÉ´%âbL(wØ­nWDßã…ÚYCv Œáv¶› ?¸b<圊lï‰|Qg¬{™÷ù ›í0¹mö^©náÚ,Xx/,¨­ø“½`“îrv4 “ ÛÃ&}ѶzA;:,¯,X³ÁÈÐpV¶ÛÔ å¸ÔÈE°•Rn1/„_`a9aád;÷çe8w ˆdW¤ph+ÝGµ‰6¼\o¿pðÂ{M—Oá_RnÂcªl|!^â`çZ–{ßÛo ¤ÄÑrBR,}SlËsom}¯è¡GoÊ}®“Lv©_Œ¿¦|™´[Ëæt9}K?êr3ùødó`|—ñ¾#v ¥ÓDضóŸå…òeê×Ä=GUœ^Ð9×yqV£é÷·A¦ñÀÂM¼ð³›¡*pÿ9Xˆ/æí “¼²±ï_ì³Çñd|Åþo9võ…›xᇷ:¨tÿ9X`6ørƒã@i‚"kzóá$áµÎ‚¶Ã6TÔn ­ñC ߣ! +—´áj¸ß[½m·hàë,üC¼šB_ö‘¿ Ò^H¸ õ›|Ã:j+,иEí¡¥³I#3Œ-Ä—b‘Vľ]¬…µO„•t»EÀNfbŒÑ¡¢B°Ò 9c*õÚJ±Xø·xáŽögy!É:]8e”äL¶¹³$v"*¶±·])µ©¥2Ô‰2sÊ'.×n!Ôu™“y³Ý‡HKW´ŠêÇÄk]X^»id 貌؅ñ°w÷Ê©zM.%è<Dšõ_®ž$ï™°×ÎóŒ·ú|ÿL, óhã²E²ÈQ/$|‰ƒjŸž¼*@ +­«cæ*Š£s¹[s§GÑå5xYdÖf%Ø F.~ÈJáúÌ9Õ¯pø>^±ðæë á½” +ŽÄ§ÀÃú£t®wW^¿ëÖgð6í;z{”W_mòo`aEçkVJXèbìùñ÷¶×-ÎZJup”O™oœ‚UI‚.]“s%bÁ³eUè.V<Ðûž:»P:.’_ä>à èÞ«¥TžfÒüeØ";y€åŽN šü×È%¯=cŸ“¯ÂŸ´(ºpYÇfá˜ß°0ñÄvÇÂâʵn(u›G›÷Jã#èž’rÍ |n¡¢3 îW»:)(TI Û÷u°«{á1¼°âÜ—Âþ3‡GeI‘¾óYOê"æ+h±Ágz Îy‰ÈÒ¶Oò2An’åÓê)Ï£à„ ­xärœvWT›ÑÑ5`¡>Ðð l![¿… +vι> äùû#U"9°ð“x!ß°q³ÀíûXH‚÷\Çò IêDYL5A;ïÿ°Pâš6)ìX¨p9†e{ ;ðÈ '­5ò%lëÇò«¨ƒ ߟvi< ýŠ¾ëòTÚÌÎ !†±(AG:cA›±îv,h§vß°€SM+zt¿ð†áú9ßu$ ¬ÐRÂú…ê–Lß ŸoæÀÂòBƒ²|Îþ‚iIÂü‚XX0…I°qÔë“mçÂ1á“l¶w‚îàY¿)ùmK³X18Ö 6^PÈ lÏzbo +ˆHO%Ðp_øߎžšõƒHЭ‘Eo‡ý^BDýšXx(/ ãã“›v<ÁC‰Ê$øhÏeãÛi)¶ç´Ö‹Ål8h~Ö<^l?Ã×÷'>²¶EÀ¯K¸œ¶·4ßÁá` Ð1÷lJÒ–5‡:ãS㶬¦†“§8$RM‹ðv¾yü¢<‘ô·×Ÿ¿%Ç‹£Ê žÊÇ=‡õVkÑØ%9Íçv­uë[­g>p>hóy,üA^Xkc’¯³.d· fWaæÂþ ‘éE˜[ä‰&õiR%ª3ãA%Mp.Ÿ$sÖkØ€$ îÐECÜ3¹eÜL’*,|–¶T&jÙ͇šp*!ä¾òQñÒJü7üd,$ Q.z”lÄ +·ÙcÒœ\+᪨K1®0V^ÑfÂü †08Y£t ãpÂ9F@¯„';(œ…±N@gB Jøi:°ði^ðMó'/=­Ë~ëÒ çfo°Ä9ÿɼ «²à„‰WT‹Óµ+ÇEìXˆˆj¨Ôõ˜Pƒ“]¼1dâhVV…ƒ á6,KlÀ¹O ZW®_…cX ÖÞªä\º%Ó>Í qûƒöBä¥hŠYoY¥Â%t®+ὤBk­Åxîgóž!lfØÄl·®y,L¿lXÐÙ©ƒ&pànrŸéÏ^8iì§l-ç…÷Fü _Ní>%oåžæ¶‘ÿ}‹V©öoÁ‚ÐåpM¤å¹œ #p²6?ztLe +z8G"©×`ÿ²ÆYún1-`;;À^;/8VUa6í¶X$`AŽš9<¸”½)å…ÏòB•u˜ë¶Š†$š#ÒF+(=]g€É1ç©î†45 (ì°2<²1 ik†ƒ…$`aÒ¸kí¢WEÚ·öusCŠap$À”·°û®)‘Žûw$Yš´‰"Ï#Ý&á÷5ëLT} p~c à€Ø×ðg¨ mTq ªeDÌ€gYSøk†6üÛLïe¸÷.YqèuØ·š?ínEóšk~`ás¼1çÈòä§RGƒcæ©K·)æÖ‡,àŸ"¡ €cc4„Õê0ewr^®§XhÀ·Œ­L*‡Å0n ±PcxÜöè·ztÒÏpJ;7 Wp8lNM¸êÊË lùÜQ^ø³Y¸¼a 2OpäÚºsš¶ Ý)0ò@ÒÚïXèÃÒ%X%©)@š©H‰ÂK‘<Ö쳧àMÌ49WþËá):¡«(ËiP~§ý²W¾Ù 0¬v8 6Ò­3suÃ,`Ëèx`áɼ°nU© tKtšº¼Äñ펹5>õó}ˆ‰>Ý]cÉêÍM ›½0¹fØ“QJ”t=zßajlËŽèë»Tnª€•êdÀTÚ€‚€£m(²8°ðüvð‚ßêï$ åžôW1 j‹1œA0Ÿd±€%¬0çü´wþ“TÊö„…AÚø¥’q”)Õ5ÀÒÃýw,`yƶj@'^XsЛD·ñ‚g‰BÚÕøÓ¼ð•ö©bù{•Ë?Üårè͹Å?œçc„ÔbpL>ÌÐBùt3ÿ^tá÷aü‡±pG/¦QL뀅iÇÂä˜$!87©éO²¸ñBл”[¢ØIG‚í¬r5[¢7T¿\W†âo`;_b«ÿ 9Û %œ+Ɇ런`]DCã'éHý¼Ú]q™_F¾YØ?“Lƒ©ÔЗ §ø¸”ð4±Jú6ˆ!§ÿÐ-ôUÉ)^xyúNQ òZž±Ða ?WäN]b¡@—¢¡Mdøœ%ë©súÄ è¢½øU.§²K ý±ãmLõ„æxçdy’ñÜÙœñ2“Â,„ضÔX'”üQ:R½;¾GåÕ¹Àíåk£`TåX½¨vi6 //IÌ8””N@sÓ„~Úãÿôú'ÊÌ?‹…{´ÛÕ:YHê'œJKqlÛØПèÖ=ÝÞÿĸÐ`Y5xE õiké–\6+ìVãÏ+æ”!rŸ.K%¢† Å3„ý±S°œ±s&&ÂÀ—¹”sp 3c|ÄAtÜ´-¤-~ /˜iÉKG:ÚØ2)Ö:ç~ ¬*[Ÿå™=MF¦v)_ѤXŠn´¢p‹E&É Gb˜u‡º¡)†•6ƒ(Ö(P1=—€]^*xeC©–’ûˆ*‹I¨Ê+,~±4S÷d/ÜÔˆöðe²åalÛlý'$¨ªü¤³†$¹dÏ5?†Ï6Ñ-x‡íF ×4µÚ»#\5åwÞ„#â82î[rî7[2o¸8÷° ¢Ã¦šN릻ý{¡tbqnmp˜yr] Ýã(™ ~©ò4oŸJ)œâ˜ÝE`>ÉQO,‚ŸÒ —ÈQ!f)@{$‘“–Áq,hFk‰XX÷J˜QD)x6À«KÈÂP2Ùi6šÀ1¹–\#{ðÂc§øüªî>ƒÈXç¢Obá‹x¡’lÆœ‘™³Ú0"Ð2Žj¡•éâÔ©(‰ÎI5FÏ®È SšmXÍYºhrIÜ^·9 +ˆݱÍÐE#(’† Æ£Äd®®œÊº´½‹Cz"?xáË›¡¢DXuÀµ`Ì~X_†…`ñ÷ˆ…Ç"Ôò@4•"Ì´œ‚19[pŒø± Xà ³Ñnau_cP‘¶I0ùÞÎ &ņsêüHA§ªÑÈVOp2!3Ìkb`7΄ùW±ðÇGÃþ4ͧøu¼€Ú ½ÀBÆã¬ë£º6è—ÊCò(#Bʃr9À2BÛ¹”Ë^x«Áq70»äºñ †leÁ/²œºë­’EqÈêêØå]\V4”¸ËOµÑ^ø´¶Ü´¿úWŸÝºƒÿõËã{oD=ørÏüÒ›_îþ!¤^ý¶®ülZ|g{GÄÜŽ…hÀ(´s·Ôrñˆ…æ\ï1wLc>çU!9§œjæÍí£qì…rÂCø %|ªü‹»P +Š—”±u‘¢É] Ȩ•Ôc%ƒÝÖÃ^x‚ÂaBÿºz1Í(Â/5kKö«ûüȬïe_üÔŸ\»Kùq‡\¾(F­}ÉKIdr¾ji¦l©—*ÅrçÍBNõÇ{Å–ÎÇ°"Ý/¿ÌŽ~]Ï—ÉO8ç¨NÁ<_€ 2<*M`¬g^â6ùa±È|ë'Ö¥·,ç>¢ %–?%÷©b +ŽÔVSLÚÚü³Xx(/';÷«õº—Û 9a苃5}'Ï3Nj—®¸L‡~rCò¥øØ&..Ò4N'a6B´ß f2:ÉQãûšŸŽä]Qüt0<ñË/.¥¼>¥Ã¿Ê < ÞØè&q|S5TY˜&ê²]F'xEUdÆ S4çàh’ž“dÞ¦…ÆÈ„£iÔ’G’ŠjW7§î)ÊVôJêÈš¬k:æà#v1#™“p’¦#&Í*ºoè¯Á—·WmøFþHIöñ5ÖOˆJ^?ýòÖdvbÝ*‹¨Ógƒ­6±P×m,lhïó “¨:'‘µ8o¬1=˜:`a‘\/˜Ä‚†Û…£wãT,t¶#–lôïÃƘ«K/p¦6Ì´b¾UÁö‚ÐpŽÈBõŽÎÛ8¨Çô ^èúøI­5FÙ2fíòeÿ…Âóba>‡‹tÃóÂgÚ»¼08ÕI+܇×_°/Ò…ØSu$Lí÷¤¶¼âV~% ÅòwX0ɉªä‹yáÓXø…>Y÷ïêÖÉß`Á|Ìs±¥É3Z¤–×¼0},ø!2o‡’~./ä_óH£oÀ  ƒ<È^Èô3·êò‚þí8Rºž-óÓyá«°ððÂX­ÏhÃk,´ßIGÂ,èþÍPÒñ‚!]בO`áŸæ…gÛ _ƒ…oÆ ¿ÃWÍ/Dóü©1Õƒ^x,/ø¡{C _5¿ðèyçƒÞÚ ]x¼sÞ«ž†ƒþ‡|R½Jz>/œ}0ô#ç^xà f î^:Ô÷«Õ/ü/\ÃpÁ º’g^×Eh£ðdìÒƒžh/ÄÖ`A¬Q’YÑLB)ê`-XªÖ”¼ð 1œç‚WÒ)~áy. [ÒÐö´pðÂsxAÅžSQ©&DÂV ÀŸ·ʼê>RÌî`Ôþêâô^0q—4>™B;kók|m?¥÷Ù 3‹|ÆVŸ9»Ž9ֹƎÉ*Z~*Rfu¢û²(¦¬ +¿ë¬¾ +ߟ.†’ˆÿ¹qm`¡g=„Ñ[iy¥cÛ o‹eKûy^಴Â[2xœ629\y³ ½VIü¢§ÙÃæDêˆù^ù\PKݘÓíºœ-ƒ‘nAÙ¯ZÊÂ'üjŠ»TÕo‘ñíyáÅbàÉð×ñBí&‰å;Ë®JÓï+=¢·@÷n…åy‹š*oŽm+ŠŠéK5bóúó퇥÷Ù  <¶ö±P/µÏi7ÙLó[±¹’M+²6®´®ôØ­|VÃÊ©Ò+|ÂÿÛªÊ /^I˜æ/ã…”eŒW2ü¶²ÄG¤Ž½oòä?"Iž H%ÆGñ¡Æ5¾+òìC,Üh/ج, û·)Ë•}šE•°u½¨%õk‘X5Áû:¤xQ9|#vÉU~/l:RåS§{xó{)f_ƒŽÙ–ÞÊ Õ*’%Ö¬à êÌ®´EŸë¦˜”êۆɼ"T©I=a¢&/¼X &™ÿ6^h3Ýøfïùgî-“J+¦cË •¥ï¤X„ŒP^G¦(঑ÔJú^ðdÖ«·Š`3^É< +k‰ö<é\öft¢®]ìW4ðk/ëFQèÒmCßs9¼Æ^0›íl•W>v)7¥\s¶¶ÕSì…Z†"¨Ã+3û¸²z/xòB ü/ã…,P)]ív³œÄTÖÃÃf×ìL—Ü[ë:Æè¤XÜ0>„6EiãîÅ„eFL°ŠËŸ,‚ñq¿êuN-Ëâ‹Ò|¯½à[qKa•ëæ "§y=£›Z°‡RMg§N©E¸(úIãH%KÒ$Þ_ôßNê†GñÂE†$²v!/d(¾+!¢ðªÄñ¡…À Ë„Ã<ª(ˆÀ =¤ Ÿ”Í©Ôä…³½ 6,¤¡Ô-ˆÈㄵº(õpQžG©+›¸it؉Þ9ŽwÝ< ë +âÛ¶CUr8ðbaܱ ëºîë5WúIãH¥—*yÕSÕð¡!hØ Ô•ü³¼°ò_ˆ^ÄßÇ Sø¢ +‚,æØ­²É/Ðï;àDeX5°vë#yá„…/àVQz×àíœye%“§ÁV¡lÎòûì…Ûµ¼ÀŠ9,€üÏ/Œ;/˜Æe@ÁJ窪žÄ  íVÐD®D*º¸lX\Þ~–Vr&†SGSÅ2ùëxÁ§ŒÕÍÄdx¡”I]‰·®N* <ÐÔA^{Ù¤VÀ»æH÷@^p[ïšÌ$Èê9b*„Gt‚Kè˜-Aø3IK,]hY¹¸»yá XXW™·bA…^û¾tt¥2Ï]ûÓxA–S‰Õ±´}*õŠ ðØ©ýgyá%ß<9÷'ý_È pT0AAP +èˆ5j*Kà*¨öÝÖŠÞOðf&!,ñ™6¡Ýš?Œ²"Ç–xŒ~×½!5 &^´Ðq¤'¸„ºÕ5·¨¦EÔÖHdí›äÿÏÿ S¦·Yè"Ñ:.uVàr6œ®Umm£‡¦~Ö¼ó$•RZR‘¬Ö͆åL®Ÿ·Æ_‰!ù í… ýñ‹¾ ´íøùï}ü·óGóøyXæ¶/láá´ÜjüqÕ-N@뵚Aw†yxí¥ôX^(ĉf)¾P΢ î:,üvéÂh>C÷Wò»MÜåÍ÷ÍüTÇ\ž«R?Ü^¨Öº(Š2ÑßÃOµ|… ^xÄ8RGÞ¢"úKyá½áê»ò¹~+^@$¸ ,|†Ú,½uï m’IW´ß#~á|ß8ê9M܆…ÈMŸGzE äŸã…ûÚ7â…qÏdÔû¯)[œìz`ÞƒÎÀãu÷‡ðO×ã¢?Ãyt58ÓÇcxñ¼'Jbè_HߤJRé¤<Įքå;ªÐ΃Jï—[<šâÓ8B‰£qv®À¶ÃeNÕzØüÏü™Ú×ñÎ!/ðùbÿÕú›zó{xÁÌÛåò÷C6Zô-ZßrÿâI —õÑ…íç1™Ü°{Û‡wç"Ñ`Áhÿ“à`rãa=þAg$O§ýÇæVAß×.̱T¬èέ ¬«†zY+M]ãõ „Œ#Yõɉ›¼'ïd}ýsý‘¸ùY$‰·y‰GòB抙+kÀ!)ÃÞËúei9<Ÿ^`Iôº'#ؤÍFÓuqmç4Zmô^˜/°|Ì ¹+6Å݉ڢ%¾„R,`gƒÔ+±àxep×Ni‹^Ú +D$†ÿ‹»‹–Ì·Ëä ÙÖÛÉQ¦‹Xš¼Ùf‚qÿ}ÇM)ÄòÛéz^hOSjç£}(3©ùN{‘+›j.¤Òõ4¬:§@Ba= d«Gó\Õ*Ë$ËdÏŽaDßvؽf{%¿)Ê÷Mïç…—B$>Õw#Iö2£KOAµ ·Û +°‘³m å`Wåœ,ö[.žÏ ¯º¤_µOƒ»Ï˜_xÿäðÐ1e߯rmþÇxºÞ^(cOà/¤Ju.êïÁýú|ªƒ~ãÿB´~†ŸjÆ03‹À*œÙKaq +¿e)ï3“ˆ…À ³Ü6ý/¼Ã<ÞïlΓx½Ÿ‹›p ƒñ\ï‚6FÛ‚ÓêõfOå…µU„Å©±v„°zX }æ{!ÔWaár®áMŽŒªº"‘äí¼Ð0ä…ú‹HO²ãÞn¼P FŸ²¼½`!lZ}‚|u&†(“‡Ÿê“yáX¸Ö^X +V§‰鈲0)ã'ñ^øÒø… ” £–ŠÇ²Ã©ÑÄYoÕÚR I·Òž^É®#yÜ´qÑgxᥦ-ÿ)1ž/\à Ka@³ž·ŽAÃŽßÀ¾Êvþ}«ž¿¡wí(˜’“˜X»˜UÁº§$n1êÀªÞæì÷M?à ~M_F[þ)^07ç½ÿ,/´Õ–ÿ ýÇÛÍ+Û€M<Êa]«¯Á‚¿ -b!é°_,‘”¹ UG~/éä ¼°yæ˜(¤9mÓÔx\EÁÐÊX{ÒÏŸÛ(}ßô3¼ðb1ü}ñ ľz¬ob>baß÷X¤ÙT>‡(˜³’¡“v,Ÿm7Tú$øm³t¦ÃyAå4†%žeœŠgö¼ÍïБt¢~«9át´~r\Ûë×Zܸûµ¼à«>¿Ð÷ÿ×'ö1®ç…ĽJ2úJäEþîÌ“oå´¨§ðB&ÐjÑG;­Œp6\…£¾q ®Óûøƒì…81ÓêyM|OüÁ ôÝ7a^aá#-7òB +—•ÛE² ®5~bŒMž[+…r¢Ö6|÷‘‘䠄‡ñyWÇÏà…0Sª¨Á=ô„DUZ…X˜ƒß6Àpzœ½ðžúg;fªtK™°rQ‹TÕj%²Yå4±5b-‹ì[0_)SïZÒß¿þ‰æOòB+•×tjÔ’% ¾ã¶PŠN)¹J;`¡YÂTH³¨‚ / Cö"3be»²ind6d8mɲ´éP°QÇn5Œ’‘Õ£¬u'b@°yJ~¤ AlÑ ,#ú|Á + €… g”Âä0]žÊ ¼ó·c¡Zm[ê2_»Ò4Ž`üi+¨§¬,²ŽDgNåZ°Õ¯,Ç ¤7ÿó{ûX^8Ãý¼¹É¯Î1TV€uJ8 ¨OÁæ×ÒáO‰ïñÓ~/„ Wy …eignËÇ·Ú«oIp+ßu%›‡vROG¢xèEõÐcDM$HÈ S]×xè÷†ÿïµnàôßbAw®ngÊÖ!q)<.Ð…ÆžJÊ—t²Ù°Ð :’™eE^0ñž–t'/ØßÇ%€©µ>˜ü6|?/ä®A,t! ‡b¢’̯R‚,bºÍp?€…drk±óÔE_Ç í†±€ ¼c®ˆ +3J2!I½¹SÑð«âÏš_Òp²¸¨½ÈzêÅ…½X0Ïä…{±Ð豉Œ€eE\¡EÙoUÛˆL4baÔZZ?Î^Øs3˜}ûÍÛi^.Ý<†vb¸ŸA+4(zŽnµbNrÃ䬶±° \Š$Ò-–¹âëx!`°„Õ«N;¾aAs¡2Z|†ÝiV0»Ä<‹BŽï³í,&Ÿ£:°pz¡å'xáYXI/v^ɜȮ–É`„m‡‰-ABÛ™óØuvñÜÄÍÃ샣 5(“yT,6ò¦·v©y‚Ï0-LPH +‹>—¼¶6_ &Ãý¼€XX1(gÇ‚Q²h¤ä Mr‹"Ödxvl•®(Ë)ý^8ëHÀ eÛKtov^и/\Ô²‚W¢ˆ\côò;~ŽBêO%jl V"N†€çs¯BR¾/¬ZÙ± 3—Ήëzק¹[´& -gÄØ‚ hM+’ÒM³4&M]\HYFBÁÒTµK;Ô*»=St¹Ê|)¢Tû^ØjÚÞÏ ¥‹‘NXˆµ[Yk…¹=(0¯½£FÀYJ:| /0p¦²h2T*¶ðàÄ<«Ê×rQø¢aó¼×ð!Ö§Ù s” +Ìd¤€.Üè°MkŸÚýŽV™ÞÏ O‹wž'ÐJ +ŒºDCºt覗–èaÙJTÄæBеҽbz\½¶PfUÐçãçy’zŒ§ÃU!·0b+¹,³,8'‹ï-¼°¥ ¿Ÿ:W/€Dƒ1ª°cR²Qn¯&«Á´†ÿ;2¾-í—ðÎã‡éyô•%p!$CУ/ÈL·ÂWü½M“­’Îø§ñ‚ÏÿoÄ WþòB5²fx5÷¶7íyå|±ªÂºnçÜzà…»s,-†Cn tµLÆ _oÚ$9ÀrjhËæ!¼’‹ÜÏ † 3”µñYYù¤ŒüšÓ(‚O.FÙ–1ɱ ‚sÚßëÈö£ýTµHÿgø?ó÷óÂóâçRUgÇìS]óªê;vVëîÑ]=´.O(4r —E:°ø3S{@ +y©ˆ‹ YÉð^éa>1ï\¾˜H2vïˆÑCxáÑXø¤?Rÿ~£÷W`áëó`T$'‚S—K¦ïõÙ¾ŽF¬ewÆ‚˜q§(„a0Ví6X‚µ¼8†Êvb| /`Þ°OÌ;ïG§ÕÎåæáXø[ã®yR_k/ì<Õ»2¯ýÌøÔeÑÂÂR85KžË²T¨h¤§ ªÆ‰B ÐE¤-¥mà ˜#á3~ªé»0Zãè±Òø9^؃9ùG¿<›о– zxÇ[Ýð~ÅÈ…‚ô¶nÛ}ó èVƒd%@¨cmÌDs’Ř\d7 Æ:¡9öù¥ýcæ‚ý»ŽyüBƒÏ?[„°ºf/JY,dÑÒÔÇÓUXøÎqmÇ‚ŽÌ™P·"O°r!D­_!Ö'»Š¢êó΄‘wGD +q«ØÜÄ Þ¤é¼aÊ·FÔG-ßÞÊ:]›»°p'/¬hºŽ6ñ"Sà_Z–Ô©voþ׬ý'yA'ÎuKõÚ6è2h+Ët}²—@ª¼¶¸èŠˆxx„?RY¼s»+»5ùV^…æÆS”!]ûU>V¬H~};`ž]z"õô>,ÜÉ Ó‚“n\aÚÉz”9<ÐJ‹k2Óü¨xçG`A&¦5½K´&šâÈú²h&ìlrF@OêFø‰¬#F·‘Št+¬’ý#xá"×e¯‘›Åæ6^@K÷V,,Mlßñ³C/ŒÎ±,*{-¸Õ…¡ðwaá>^0X‚n§$‰á,À´d¦ÅqéU]1ãñ¯ñB겡jóšI–¯:’Ñ¡v²\%]u;&ëÐà:]/Jöt¬L$zq¬~Rý…_†soÆÜЊýôJU¨<Ò,Âf>cNÄ© •‘¦ÖóR©’û†6 íhì3›ä*ŸñÐõ,ÜÇ ƒÐžKz2žç Œº¢šá¿f/$2^I·H’¸ž4®Ö¬Ð‹+¥ˆž[Š±Õ‘¤$“q ºgoUȆXFR9‘ê¼ÕÓTgú}å;£4~Ý#èþeÓ÷îoç…[Ç‘J—sÞÀÁ Ã9åñs‰+ÎåsÒ–:ÆEw +u¤ÜaHËa—›K“|‚"x·012·a! c¼ð–0:[Æ<ZsÊV¦’j$³µs5'¥p²æµ\µnºÚu\«¼e”lVÖÌŸ± +œH–¿D6‚°$ôþºÇŸt- KÑ +)ˆj‘åü ^(#“ +‰G´<18Éi=£¸’¢ 7)3Eƒ¿û‘ækƲ/âOÄÇ='×\Æ¿çôÂ[bùJG#Š;›ÓQøiŸ{,ð}mõy{ål·åt­äÈ 4¼ìLjvh7œ±@ÐgO÷Âü ^¸÷uº‹ä™XoƽþHõÇæM~]gñOÙ ··jµ¥~„Ÿê ‹V,Í`o–<`aB)å93xÄU&tÃB…TøþÏŒ#ÝÙÊK,ô·9²~ÎOõã©åùª^ýŸã…§åœÿ?^ÈOÎØÌúQªÒ2Í™H8u eÀ„-%C>Ô&•d¨$ÎêŸÃ zîÞ÷¨¿ð|{¡šÛyžƒ§v5 zF h~°æVÝ6E*À-Ã0ê¶|¶ú¥˜Ï¼œ°GJk€?…{Å¢b ¢ µ¡ÔY•[ø©Áú$“^eL±ò3ïßqfø¶¼ð™vÔ_x:/è±Ì¡M`kÒS›ƒeÜ•—tQ‘°EžwÛÂÔ胀Ò ½Â>´©* NõWø#I~'6‚ öíö¾8t ¸ªåÅÂÁ ÏÄÂ:Uä¹Ý1QÖVNmæR}™ +œçy1FÛ¦r¨,êBæZ‚¡3÷BÚÉa˜4VÈúŠ|ª„u¿›?Á „áø½BPõèpTß1ËŠ…ƒžÊ ‘ëýÌá/WŒ´ske•ÉWXèdú¼Ó¦²¯ääg_J2SµÏ\é'éŠYñÏ |å߈sÔ2„Õ;—çìäȱÇbáà…gÚ À ý\þ=×·˜C²Ñ™L^ñ–(èó¦šY¢[’U+`Ÿ¤kV¸dXÅ×ðÂÿˆÍá Jh…k´Ä£ßšîÊÓ¼ð]xaZ )]š¹€=è_xAQ0 +¦ó¦É܃2PD|È6·¹v]ÍV%nç¾ÕðÚ†Yº`¿Q²Ïu¾n›?à 82¬\“lÞF¤ˆ‰ƒ~½mžÚSÛoVB¥å†Ð¹Þ7Í«jNKx3eÛ¸3iˆ]T³*u…¾•(Öëb%Ž¡¿Œ"Þ,¯³mç[M¯ä±ù3¼ )]œ«bGχ=xáñÂJÚÄM4èÄ…Œò$zÇ^hµÖ•Þ7E =ë.wIꂳö\:RƒµQºìV^À*^ɺõÊD´F‚­^¼Þتt«éõÝyA†è Ìû,,¼ðl{Á`î£je9¯ª6–V]1ýzç…¸ ébN›±ì†j&®ØÒêUk¡Ú‰¡ë*»•¶üÊ‹òE¸¬ó£¿ÎRrr¯7éçØ}wy7¯Kü¦“¹Î£ïÁ ,°2ht$NsðÂã·§vÑ…ë«*ebH\B ­c´©ö+~¯N›j° Ƶš\Êc—•P—ñ DÎõ7òBx™bÁ ä›±`Þ`ÁZnà?Ï[rYû˜Q+{Ÿ0EeîS)õ&µêŸ´|È«Ý„¼füd;›¶} ^x®½ ÷°ýª*À.`¶›) ©µÆ 6L6Ìð»ÈºÓ¦ºL…|Iºb*Öl ŒQËXßÄ ‹˜¦r‘I{.‡ù TbÞ&[ŒoD«0ÃdÏYŽ Õ³}£—å{ðÂÞqeÒ)…ÜÐ5`=²IKÅ‚…ƒž‰…j%§ÒåÕ@š¾C7ԱöºEôo_;ò²é Ó¸!Cȧ—Åé:¬›÷éãz^X$:à­`í…$MM¨`DK6u{zUv[ºáoÀ ërN ÚYÆôÓ^`(Ń…ƒži/T—© «=ijHVéd÷BݾV—Y#+­w7íÓÒþÛöq«½ªþ†Ï)yk/œBÓ¸H}G…+^a¡P߀^µ×™Kù¤ÌC°pðÂsyáãF¾ÀOõ\›(=Oêb/ê÷mg,¼²µ1¢­’1¬’q‡r_|^ø-e|>ÑðÁ ß:~áy¶Å ­’}VË…{¡°®×ªóú,ïSg„ŒSAÍÂ’Ô*“Ë,µ¬JßÅÂwóS}@ÏyðÂâ­o éÑŸà…üL¼L`)ðgöT’}z¬‹‰u¾Tã…]­|e•°€„A5‡»‰óïÍ S=xá¹öÂ{Ò&ÿ'í—>Ý̓ê;óWÙ§C¦°Ëï"Þ‹ð« ü^0íÖ̳±pð—óÂLÅk[˜§ŒêM„çéSõÃCê;¿Q²ßdŽä¬¿Zl¾˜Rüµ™~6^ø*,„ð4zL 9T§$Zë]•´Þ~Ü6„_Ãð«ÎØX=‚þ§óMÈÕbóż¡+´áÙX8xá«°@³ØzÐuME©T¯+BA7VëTƳEÙnîsIYð‹j†¡.¬ê1Íç…ψÍóBâöÉ>ÝRâ$ø:!‰™ÉŠ+ÈÆ$*šƒ~Š½PU‚šÌ) P(ÜÒS—T‚õ=Sk)ó1“4^DÕË7„ˆ ê–|l©ÐçÎï›/æ…Ä tR0h9G¡uÖùS‰)âc'ä'‹¼ð•¼0l˜$[¹Â¼bÓZŒÞÔlídÊ•j9‘e% K‚‰¶¹ Lé=/ºêá¼ð&§ÏPêëÅæËy!´°àêT¸¬t½ž(1ÖÑ4Òˆ‹2éôg±pðÂaAG2µ”%¥jAÄõ*J®K«#‘L*Ƶ`‚DÑ.ø@©…±*̯÷:@úA¼PÒ7ò6c^`%4Ì +Ž%H]Þ;¹vg  Lƒ! ìîwvðÂWó(I¹è,]rOŪ‰˜ˆ`E\°° ™íë:N†D&¬1V·>C,¬ÿ…ßòB’× ¯Q×àÇœ ¾m0L7å]^·aƒ<õ_áCbAó™5 Pf“Œ™²p=p~ºÈ‰'­ý´' &ÕØE~PÖSFÂTÕBA–Ÿ0SKr”˜œ„l‘\öbÑO›Œðb ï¯åê( Uûgy!çÆI ð€ÇÒ-Óâb_;F™«}¼aáà…Ÿb/@+³aÍc­ãi­Ö)›j§®H‡˜6mGmŽ9µIÑ¡sëdm2è¸qo'Û®çÌ écæé®e4²¥93…õÅϳ: +äMs‰‰š€5Å"c +ŠBˆ—¦?Æ [eì€[0])Xp1lSXGe©½¡KuðÂOáèá¡—oq~mÞ¾èaª¶Â”‘°n¹%ñ{ȉkØxè©î_^¨ˆ{Ú4±+‹E°0³ÌXf‹À €……Ò¼L|Ã*rJ‹Æ‹üO#[ +ýÿöÆÌÉŸäQAž/ü¤³m‹x¾Û)— 3`œ°DAá¶YÆ‘)ÖI† 2×úPª¤^½f¬—P±8K¾/üjD?¾¼ðòlWcü ?ÕUÒ´ÍÚž„¨†×›¡H,Ȭ“Mj7ˆë¤kקVVxÿ1¦ž§)¬y ŠH? /|o,¬•®>á§a¸´÷Ói ½dž`ùð¦Æd©Ÿ„¢m9‘¯•a1Ý‚C2)ìÚ_º}ÿq^xb;xá_¨¿ð®ÎÁÃleÍß8f¼¿ëÏŠ_07`áà…ïm/< .ÏûЯ煮|ƒ&~­ÃEK›«±pðÂ_Î OÀÂ×óBï^[-d¹Ú-•J}-^øñXøkxoµ`[Ã5S€qÐÓL‹IÓ¶u¾ÅmLíÐg;lÏC²äžº »ƒž7_VIë®èƒ^øN¼ +ç–ѷŠPœÙ²Õç,ö ë§&Sõ%sr©édá3ádî#f±RIîSfÊ1ñŸíeOqMö¤ƒ{áñÂ(]I«¸t*”‰Ë ”#ëHã\]8f:§ê +²¸%[¥¬©«ƒóEíøœ +WÀ¢³¯R@å×8*¼pðÂ7â…g5,ü‘¬Ýw+ˆtKå„ÑC•¹ª%ëšÃrì°´y ·.À–(ŒM +#ØEî½M× ñà…Ã^øF¼@Ñ9·t“—§» äž­€A ›'ê$¤¡ï]ƒš1ÉÌêD +°È·òðÓ®¯AâÁ /|#^È1¹«_°€ÒÞ1æ¢ÍU8 ~×,dðkž¦Yj`a~µt4M’D¿x‹…ƒ{ágñBæDK7ò³×QŠÁÍ ÆTê&nA ‚Ο$N¬)VVÍ Së#£Èxnn©Omo“\‰…ƒ^ø¼`jéœÈàvN +?˜ÏeçRGBŠE.&B›z’RŠú‚Eâèñk%ÂLp‚|Œ’Ç8Òa/ü,^ð~N;8žÎOþáLÂr:÷6áÓû5]áÒè¼ö izÞ1 a_⨿ /¼ð=xáI­wݵX8xá°¾ /<£ñ…úk±pðÂÁ 3/˜Á_…ƒ{áoæ…«oêà…oƒ…[j2¼ð,|o^ ä¹Xø6öB•&¡!$Û®®ã…qü +±¹›xÔ~g,|/´d á·òB)éÃÞî +—0®ß”æÒ-éð.:,´Ù]Ç “³VGVBF¢Ä 5ÿ¾Xø"^Ȥà õ+± NK%ìõ(4X×`ß?Ï/XXïÇ9 ÑÕ•­àN1%Ò¯y0¬ÃŸ†—CéÙ¾Êa.±·=ð½™_\þ.Z‰SÂWaáÄ 8›V·ß _Ä k²Ü%ÃKK\:|Ðr¦÷¥,? Bd™=ùõyÞœßÉh¸«iÀÂúr˜úÔñªÿ×2Ü©Mª_s¨¦Š\l½.êÕIeyZÜŽB»‡½7ŽOm±g›ëÓ®€}ÍSI]¶ïÁðú¾#¾’è.'/š{õM¾ÿ“Û[ó,XôÓºæÜo®íÚå®añê{+~Å‚õ†^núË…ÿú¼¦‡ñ>µÉ}x¶+Ê›ëSäßæ…µ]Ÿ[S^~{ÝvÚȆGÇúêXXÚ¶ïžçuk÷ñµýOƒ'ÚŸïÊúÚÖïw:EÕ¯XX«­òìÖ¦ºâòœ½´oŸy/ÀSË_.wõ¶PK8ÓÏ^uqºÒp}6áÿ4/„®áòu’ü¿½€ú/‹R´Î,`°ÈWFgùñü½àƒÜ\Ø íµÊ•©ºö­ÁPU +mç—ùk{aKxEÖ,ògàììµtsºC:ÒUÝÉ„AÉ~ÇɆ¯ä…µ‡­¹|Ié5ãHô<z³&Á.51_7ŽTÜ6ŽÄ¦q~o ©ÁBÙucª ÍLÕ?ð©Õuô q$°¶í÷œvûó qýÌB¦ßh~a¨ón~‚A·óüz|éc,ô%ù±¹{~aÈïA‚1_„…cÞù[Ì/Ü4ñüñüÂWèáŸà…»^+¡¿/ŸULЄ¥ùþÇÃéðGúZ^¸KK³ÿswuïéö<ôýç9xáðSýZ^¸KNXëõª³ æC–!ç ‹Îù5|[+Om׌xAip,¨Öû°pð·°^ø¨å«©¨…Q¸Š¥ž¥d榽¥>—°¢öZv>Œr>xáà…¿Ž wv½eãœ23A–çXKËÓ ËÌå’˜Þ‘Vv©\=‘ä>,¼pØ ß™8dëqc¡+vŸÄE™+’³Ou¸B9:sq–ûZ˜û°pðÂÁ ß™Zûöx¿tIÐerŽè…d7Ã<ÖzŠqœb2k«`ñу{á/ä¼€/Jådç²úÕºµã¾Sí䎼‚*³õN,¼pðÂ÷¶r´ŠKU+±VJ™I^H½¨ª¥*Ø .j©Ô`Þõwbáà…Ã^øÖãH¥Âq$Ë@)òëÂØB¼†o(@1¦òB¡×,ÅbŸÉ½X8xáà…oÍ ¨<½àãÀ=èwí°7d4¡dIËuÈ26ßF˜{±pðÂa/|k^ð9{áZç’±“¿ /¼ð­yÁWTGŵXèXÎïÆÂÁ ‡½ð½yám¥Ýß7sïM¼pð·ç…/º©ƒ{á{ð‚éßnÒ5¯:ª1óÝMùd¸çÍpnæ~mŸm~_qþà…ƒ.„E½5yë×/§W>7äϨ x.ä6,ÜÊ ³È^îñ·p_EtØ ß‚ºwîFÇQ4Ï¿ Ï° ‹…ÿö#c)çZ˜Ðf¶Íâ Ç/z>mr +¯Âëioƒ{›ÅòV¬|[Åõv¤™?”ù’ŸEýv†ü¾7x /ÄeQEìãÄ7ÉíXø'xa]~ÍdÀ•Š—.eÃ=Xx/ØÞ—Ó"Eªt¸µðˆ"§£'T*j}¶ø„– M眉Ú_ ^ Æ&Ø®ÞöÎ \¤¤ZMBâF±`*ñ¦¨5äÄѺI±À´%¨×¥pR¥éLL’áco“(Èäé¼`˜\ 軫èãx᯲ŠðF·ËâûÕ¹úÙ$ØÅóöð—…W2î„0+ªÉu½ðT ?RÊ• ™\üä|æl‡u9)¶uX½Ët ‹ öfÖ§®¬jUjéZÆ’TRèuk]ÊÎVÆå…°@—EÈëe•ðgù¯½3ÑrUÂ0ÐB‹Ñ¼ÿ[Þ*ìîÉd:é¸m˾8ÇqKVl-õóUIEÁ¬°BŒ‚DIX„P° D–ç£ï÷Ý0q%Œ]âÂÏX`.”M# ã2½-šïfÁ¨jR²ãªñù\` …3 Ÿ‡å6C-(Ô”nêB/A pad;bñ¸Ó¹ÐgYŽÝ.Æ "÷„n8¸ó-| åã(š Ú;Ç Èê žûÙj*ŸÁîÖ i2NžŽ3\—ZqØiî~ß܉ -Ô'ÔïÛݸðâ…A0±–ZV˜Ñ DÈf–eÒœXæ®#êc¸ZØs¬»;ÓsÍÛþM Ë€sŸö¬åc'ÙýS`k°‚¡rRÔ¸|´ÑGâÐáÇÜÔ³}:lpBìn.Z€Î€®ò Â… µ`ѹ+ópÖ‰ZTÃ!Ï|¤»pOÊÈMÔt i8¼(°ÒVAÒÝý¸°îoZà¢xˆZ˜#F .Ó´òWáÂý)eVì6Bü¢U,úHCäB Ÿ(ˆIQ ¦•Öî"Ó‚¶ð¿íz¯j¾F a™ræ!\°Q SPªË|¿¦øA `ŸDùé.¼Å Q ÚŸ ï%óí\x„æÌ +±WóŸÌÒSýÖ»ºŽ •ˆ:=ƒ+Þççâ«DêQf¥ÙŒšgsÁ”$d`Ûºƒ©ú‚·"O'7Á¯Mý@¦àŠóÇ%áz®²ÁÇý0EŸÏ„„Bˆ.3Ãÿ†ÃáÅ0ã,@ø5ÛЃm2}o.°}±0±õ*&$poâd8¸úX¥VvÒò.ü£ Ò~Þ±Wä‚®¤ê{%¾RKhÇ÷î\Nû}m×Í•ÌôËÝM\Ðl +ÓÉ„ ^µgjê•›Þ9BeiÿüûH×5¤WöŽÙ _â‚™9ŽžˆïÁáXìøTs{[…ŸiÐò¸™ÙË…:, høçI»GÆ c{7Ž‡)j2°u‚ï³#ø1µ .Á_‹;ù²ÓÝ29—IwÓó…–ÞÕ_aOènÙ]'qøyªååK2@,Øo—÷WtAGraÎ=ºG:«œ£L²U;ÚÀûÐíùÜ1Œ°Vœ¶EíÒ +Ï +²Ãò0V°ÜÎ7=wÖ–ÜW /§ªËéÎOyª‡ia¬ý¤c=÷²"½4ŤÄX[½µ’¬¬"­,‰ß‡²÷•¦¬$µtƒ·U©oËGrî¾f“æw~I.ܨ…ã¸0R]nÖªåzTV‹•óžu…Ì6Qo‚:2IJäÀÇ\.[)ýZøbìþÖñ î¡S$.<)^˜{Ý{7 „f·YåD>Ï+sŽõ™,„:»U-‘•žs™¦vXîÏaôAã~No\òçr¡ðÙ‘Z¸ÈõÂÿ˸ÐÙðNóZµò.r´Ð326‚ªÙ±¢‚*›¢üâØ ©–Áª…ûq¡ý©(¯VÙS¹P¾÷—3æ™ÆóoÏ3fl›p™¨dìÎû¡M\Çõ×´p.P{$ÈÚ`¦ö§öªùëÄ N×¾_–Õ×|eY7ø\_¸ éO›®Y¦sŸ#ôñÂ.H,ÎaÆM\( ´  sˆ»ÍU.Ìxx® ¼Äûõn.]˜*Xç°„{öÏÝ\  òý©\xÓBW3ÌÇžl/dkoë­›w wÛ†q«ë+÷¶ŽYÛªüŠ®çÂV Kàø#L.,C±·«%–ÃÇû¬²°UŸÍÕx*¯0Sû3~¡_‡ ®ëjœ¾±î4Ù¥€w§rˆ£Áⵕ¸¡•ø¤fb…î“Ã$˜Íø>ÒgϬPb1µP¬²Še ë‚…ÆüÍ÷5­ØYhr†Õ݉ØywÔc< —þ’ïlqBÀ¢*¡»­,æ‰Fj·aõÅL½3B¹Ü«PÊV7×:¹_ã‚ÃŒì~ÃN–9S‚¹®q¨¤ª µÚA¼®«yª÷½Žc˜€‹#Žr·w™È@ uÝä1“;œv¶sÛV¨…´Ð…e¿ÐÂÑ\ÐB¬¤÷mŒ®Ã¯#-€DY“Á"l‡+‹)Úî.@Ÿ"åʹ¨qþ“Ž2Q Å,Bô>÷¹ç\Èì3-Ü/0&ØeʺFQãèê^AA•al¨q /Å…çŒ_Àž³§8Zl’®>k!ÔÐWð”B9 ¶Æç m–˜_IE.¨æ¹\È°@‰õc†—EРзÃixªÐIÊq*öÞgNæ ðXØ9Eû.,]èZ0¼“Z„Ðà–3…ÝG2^x2Öö,×¢î¡ÏxÓB‰ÝF%á““-pasªFZƒ·Ý×Ì‘‹4˞ˈáBõîì#Ñ01K\¢µ–QàBßâüm«¤.»`™ŒÁ…FNGv::䌎pá ºŽÙM3½a-ØGrá²×ïäæÑáZX@ \UDÖE×¢æļۑŸ@Ú[~»^¦s3ÇIž9å—àOŒÕ©‚þ ‡‹Æ‚Ãú9Ž}"æ¢g¸:?U¼Ôs=w¶­«¢‚Hy¬ú‰L1K{Îȸ¹àÜ….ò|a¦› jŒU +pVv‡÷¤³.ÔX/_qï¹p>Ôz¯”øJàB…ÄŸª1ÕSý¬q;<õùÂ/ö +ŽíêçŸv¬ øâ©øêsç8¼â-¬—h63ÁÄ?ãÍ_æq\˜/wΙ±žÇ¹0@¨E•\K–'.ÜÒ +ú¡Ù<;OµdBˆÿz±-tҔߠ…¯>w.è—}꛹н=ÇÃPcLتÏðÒÁdœ‚¾ %$_R¼pKû° +è ä©Îå‡ÿÈ×¹oÊG:±á¶ãIõTS=Õ×i·å#Ýj®©žjª³ý{Ûn11¾\¯…4~!qá5¹P²÷[âãŒc(þ]å‚ïÕq\¸Y iþ…Ä…ßß!yv¼ÈÏë¿ýüT°ݵZH\H\xM.T ¹aêëÜ̵o¦0µô4†nÈêjª†ºŸÊvn¥« SÀæ5l¦lmuP}âBŠ¾ +ÙƬõëf=ÍJik±óL2µö^ÕBÍœIÑ:¦j%æ\Š>ÔŒZY†U +EB#ø•ZH\H\xU.ÌX"3¢ɱHc0²"~ `ì:Œ2²61ç'¨<ì-üN7oc™ÌB’+µ¸â…æB«@f ÀBÓÈBC«Îàà¬ÍÀbëëºÙeh£ w²¼R ‰ ‰ //ü …Qî”Ò6›0¢ÆÒá8bµ EMiS¢›ÔýE îj-$.¤xáU¹ 9>Ð]Q cœk$ä$jaÅ ÇN¨ÀÛN8T/VX]†ËDD™_®ÔBâBâ‹rÁk1>ñͲÊSYûi‘œ½o +Ê\ü¸’m¹‚ج¸Ú‹AÒÐÄ4ª^nWjái\˜ä/ÇîãøÑC´ð‹Ky·xŒó#ÿ™ ë‘Zâi¹éá:”§`rŠã±m³·ÎˆŠÞ¶.pü8dµ­AkKݘyµ47¡ˆÒSm¸R ÿåÂ^TG´õ7>’R«þ@JW çù˜ ÒÔ~í#µGí‚z¨šÇíø¿ÊQqámoGø¼<ÕösÇÁЫǹÀ§ì¨ö˪ÿî¨=X;?ð0þµ{fÉm“y6–Ï¿çs¸• ©Ý-^øîí +.d¯~,ÃG\Hín\HZxçí_¼ÙÄ…¤…C´ ýË7‘¸´p€8ù?h‰ )^8@ ÿ-q!q!iá] ‰ I I ‰ I I ‰ )^HZH\H\HZH\HZHZH\HZHZH\HñBÒBâBâBÒBâBÒBÒBÒÂkhá¯9£ÛwÓO¦çxá¯9£ã7Ó‚ßmj?7v þ¢3ê¿™Rû°Ý …¿©}#-XÉRû°}U ÍßuF÷ÿ{ÇØèendstream +endobj +5760 0 obj << +/Length 107 +/Filter /FlateDecode +>> +stream +xÚ`ŸÿÛÛÛeeeÊÊÊ%%%¢¢¢ùùù444¼¼¼ÃÃó³³sssyyy„„„AAAìììèèèýýý“““ªªªõõõÑÑÑ›››TTTðððÕÕÕ‹‹‹òòòKKKåååÿÿÿ +<endstream +endobj +5756 0 obj << +/D [5754 0 R /XYZ 85.039 781.388 null] >> endobj -2624 0 obj << -/D [2621 0 R /XYZ 85.039 667.089 null] +5757 0 obj << +/D [5754 0 R /XYZ 85.039 590.299 null] >> endobj -2625 0 obj << -/D [2621 0 R /XYZ 85.039 390.616 null] +5758 0 obj << +/D [5754 0 R /XYZ 85.039 590.299 null] >> endobj -2626 0 obj << -/D [2621 0 R /XYZ 85.039 367.529 null] +5759 0 obj << +/D [5754 0 R /XYZ 261.943 239.639 null] >> endobj -2627 0 obj << -/D [2621 0 R /XYZ 85.039 278.703 null] +5753 0 obj << +/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> +/XObject << /Im17 5330 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -2620 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +5763 0 obj << +/Length 514 +/Filter /FlateDecode +>> +stream +xÚ¥SMsÚ0½ûWèh¼hµúìÐ’™R‡8§4ÚP†™ÒNH›þý®,cãö’a­öã½Ý}B!ùƒÂ„óä½øºÏ¤Ø²ç*Ã6¢lCÊ“˜‹:›Ì­(!È êo}Ú¨ïóÙ‡iU_®Š’ˆr P”Îù|vW˜ß¦ÛjµXÖ‹åU´4_b~WE÷§Uá)¯SÐbÙ»§/¦É"ÅC}]ÖÓŽ³ +‘æSvÿ Å#·tI àÅ>K@vï3æ FSkÏn³›®Tòi‘²Æ¦rŒ(QqË#p.¸Žpt'¹ s¦1$¥xìèø|â<£sŒ*5¦á,žD Cç9ÕÜh¥Ùðúèž,öèÅûŸÌLÜœ @¡ƒ ]'g„‡`mÜ¿¶,AShðY¹æ. +ƒÃJBË[ c}õwL)ûœ†ƒ±'"Ôæ»íïÆ%ã "E.“ydÚ¥Y*Ɖ ï†d•“¼·0B¶~2$÷ +eP'bU–ôîG¡|þ‹ÿ0ß&Å¿ìÖé0+Êø$⃙<¯÷…rù6Öé > endobj -2630 0 obj << -/Length 893 +5331 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 425 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5768 0 R] +/Length 23871 +/Filter /FlateDecode +>> +stream +xÚì]‹b«(EAQA|?€ÿÿ—;ƒ&}Ü>’4mÓ¬ìÞ$MŒåpæ ÃŒ÷{ÛÛ÷´d®÷‹°·½a+†ýìmo¦ýìmo¡Mb¿{Û6žî×`o{Û‰ao{{N ÅîJÚÛÞBkø~ ö¶7lÙkWR}·m¿Y{ûÞV¼T -½Û6î7koß«^ƒQý}¶ÖEûÍÚÛ÷¶©|{§§™¨ {û涌 ËŽ…½}{;d Âåû­ÚÛw¸ÅŸÀÂÎ {ûŽÆB}˜¾¡ا‹i“ {»ËÆ›×XHÒ,¹}ãhå4c’¼°Êv½°·ûiIQ¾ÆBñÇ)1°™¼Ÿ¯À®öö­>B`™ÿÁBýmX(²l¼ ;/ìí±PlÁHõTÿøÂa× {»7¡pœsn¦õm× {ûVb8òÁSß¿[,ìzaoßÚ†ÃñÅx÷XPQTííÊv‹qäðw~s–)9J‡äþ±@ÝÞ®læ·üÝŸ_D bø)í|å\è»÷éßÄBûwþYR³Ë—Šá|ªåu>U—[§ŠÃÞ.n…¼¢¿øó«3±pâß4/°ðê$ X˜¯œkC^»Ä»¦Ý + êOæ–KÏÅÂiÎyó)mXÈ—EÜü¿&‡C4©XŠ«±Pîû +wáÍx¡ù‹??? aœmž°à‹8º}‹ÑYÅáE~…ô‚Ìöž}ß Ãccá4Ç¥µ¿ïõ ;/ü2/¨ç…ü–æž×/ì¼ðÛ¼ðèX(>£r¬ï ;/ìzá±ð¤Šå¾×;ï¼ð˼ æGÇB™žˆa× ;/ü¯yÁ/Ëöâ0ìzaç…°0<<N³ÌÉ´ë…>°‘ŸüxÄûœízaç…/ÚHIÄtV‰•}´=x?µmÛç§ úå´}W‡»J³x U›Û-´öЦeÕ†¸Î(ìd¹§6º’扶³)v½°óÂ×°PÃm¢NâðÊñ¸b=xå”t.t{â¨qê˜Ç·¦d{e¥Î¬}’9µ¢¥r®óslÝBJå¶í™sâfXðÓñ·MÇÌó³ÝõÂÎ ïÚHçø‘"G’šÑâˆ~ÄBš Já°O¥ð=†¼ejc€°!1JèòÕ Äë ÆÍðkÖ¨4ØŠo‡…Óœ3?žXBW/Ô~».Ë#.˳þ’ÕÛC]®wã͸òº¼$|ŽUþó…äÝßÿçy…ø',è` ¹´,”a Ù?%. u¶ÛŽP¹H®_å(­¥Vú¨S}ؤw©”ÉÍ°ðT¢j:v û¸z¡UŒN&庤(Ê6Çå>ÆåÔZýö +ïÓ°^ü×­ÕGœ¤RŠV/o˜VËëíæÕ«]©ê[.ÝÏú‘Ì“åòœº`#uaXÓÊ9}4E:{¼>#.PY/¥€˜|½(Dª’ …û¦E|Ý §Ú…ü8ÇðÀz8×úDmW&‡Á‰=yF + a®œ¬ázc_åæÍ~™ºþ‚#N2s²o·Ö›×VîA­]52ß³¤ûgýH³LØÁ³¼ Û>t·š—Y¡OWE·Û‹’× Üc4QF§ ]͢ʊ6,¤ËlÃiÌ°‰uì†~¤ÌüÞ±ðe^ põü¤Ô:Þ0*{ œ…®«à>J‰ÃBÖ…O’j,Hµ]¤œTñ†…:&ͧU ÿ2ø,°ˆøØ»ÁÁ)<ë¹Û÷œváG¤]Ó“µo'WWK|s5w$ZǦ$&yQ}Ñcð³~¤FD +¹X{=ôécŸ—ÀùŠ¸ð2=õÙoRðd­UŠ‡ï5ÆQ®Nzî\Î79§Cœ‹…ì8µp¬UõÀó ÄQåcgW,À2ñ3·Ï*—yXoÒöăã–+'8RÀB¢‘¬‹u¯¹§ âh…­£Òéú9`Œ+Waí‘vµ4 ìÙá­Å®êl¾Ü¯#¨$‹ãtçê#F….ò'í¼ú¹=ȉÈËírÜÄd—aaR+ÈÿÅ‚ €þ"½þ‰umõ=`áT¢*¤‡¹ ù:šöÁ&>ÈÍG¨Ôrõ¶ §}³>˜S4¾ü_× sšðtÄDkI»øy¨!=`þÀíÓ2 |Y§púcºvî9ÎEº™ cÜÑðñ´mÛtO;åéSÁà%ݶ?¤áGLðt|ï‡x³aÝù’6pÜ¿lGÀÝ#O~eýBn¬5/&cûzÊf>]žƒÙUþ:Nµ k¼Ÿ×a!ZGúÍs´‘4 Ûk㢚ñ5cÀÿ2‰+UµŠ~qÌü•um½£F¾˜™,M÷JªžR§ %™qä÷±p +Fæk±P¬c>Y9¿Ú.jç8`¡¦ŽZºZNÌ×kçÿ[œjD•²ãwò+¼PaÉUÊÓãP’ÈùØva^R;vdYì%lUjK߯t‘§Q•­s“C·ÎB¶ýŠÆhÝãí±pR u‘]‰.Ñ_äz±ŽX0 dÕy9­©#‰;\sˆÿëú…ìëðÿ?Æ¥N+¨ N•l5¤NGö«ÐRéñæ:Ý­;¤’+ÿ€ Ãû“0ëTó¨¤ òg'é÷`©OÌ×ú‘"çÚVn>˜ØÙà Ýq^§t Jc×aa_¿ð·üHNÒ¯n +ªš5:iÃÂ!9zŒOÖrƒÎˆ~*ç-.ÒªàæÇð â÷´xÝJ¤\Î/ÂBýׯñLüª[§+´^ØIèY縈š®·‘öõ ÅTbñ0è40ÜÚ+˜Ëà:ÈËèä·(›H†X댦k°Ê–=—©|ÝÐ*c¨?è’^zÙO1ÃÕóÎuÓœíl}YfµOxr$Ÿ­—¼¾ ;/ü½pìTõ¶&¦<ò¿XˆÑéb‚¿ ÿ,Zm¤Íg0«m)ƒQ<ɧ€ómXðÓ±$ÉÁîëw^¸锫]yá„…5C´NzÁØu2&uzsÁP¹ švÓŸc$x*7ë{°pJ&è¾Þyç…[ðÂØžf˻՗š¬ë÷ó6ÙÞáÄ]dMkM·Zê£6k€îè‚-Ú-Ò/×:IJ×Uô}X¨O•röõÎ;/ÜÄt?íB,øåèÛ¹T/¼½¢·þ.,ì¼ðWüH þP^……’J¥hûr¸&ÿÚ•"újøö®î€þXX†«°)G©z‚.ýçšÉ/W—ÚõÂßÒ  õ1v9h,2¬è]¢¹ëpø׬i‡XDdµ½"§Ö¼uG6÷B‘Ïí%“n»^ø}^¸ÄĘO O‘w‚Œïg°_c/Íìd[“Ûùû±pt%]Ž…{}4u[ì1[]Ëa²=„_ÕÖ…Eª^XØf]WiÜ1¯×ÝÕq>Z{mVžØ6ÂÕûøÕ¡š×ÔXø‚ÏøN².jÞÜËm'ü áƒ:áÊþ"/œ÷žãØu~!Lt±¯×Â< ÑQ;ú‚¨}Ä*|§_üŒõµhuÇڸ地%†!6gl-Á³´,ª"U}BÄ_Œ^ù²×d:…íÝ ~,Ÿª‹5¤Z®-‘v6•ïhLK€ÍÃê¢!˜o K‘„­<˜­ +X,†Í”.SµeõÀ~I[Å +š{A ü[ÌœÞÚNÂöµ6`w0\-À–JõveÌŽe]R`v½Âæi駀![³.ˆMÐ_Øp¨ºS˜ _°ð´bA0“ø‰VpŽËïñÂÿ$i@¦Çʧšà vÕKwHœ3=ú#ˆ£½ui!;Éi€…¸˜8‚Ó"­“•qÑD>Ú%˜R1vÎ:˜­½×ÀàˆB¯N¯÷,8 Mµ­íãÊuÌ)\««ÜÅ3­‘ÅÖƒ€MÀò ©R-ú§*'ØÌ„zÅB³2­Ka?ù/òÂÿ ~æU!$ü]õ‚©ƒ_w +XȃåÎÖ!6wö  Ó28J#yÆj +j®}rþ†”“G,TÁ5Іiè‘Øá‰G4áBïü˜&‡àâw̼~Õ8Ž¹AÐ&¢ªf›‚½Ÿ<—²”*ñiœðC™+Wæ &rµª\*w¬ YñPzaX±Àú*OÖú0+F¸>UÈî4Î}dq³a¡qÊZ*L’Ž}ýYގбŸx!Ý°°& Vˆ…8|d]½¦9A|…Õ‹&á«Ð·µD"=¶¡›ÖTy\õl’ Ðõ˜¬XÈ)g2Ø÷_ºßˆGz¿×›e¾Ê÷' à£2ù,øá¡êµ^ÐÛbÃì_,)˜…Ô~Uø±ÀÍ’bªû¦ãŠŒ ìæ,¬01á­W¼°a¡”ú4ÎQ&ã|šeÉ ø-ø4Ã*dq»€Yçå‘8f¢GÒ_áBß»U¹üw¢¸¶Á}W§ÿŠ!.[O_Ÿþ8þî·váUzAšc‰ÿ//0g¶ü–¸ØVžô#ðtìë`¾‘ÚêiPTб9i·tö€4̼]GG¡~Ƴ +9b!QË1 +[´Ž2'…t=q.;baQÁ–‹Üå3 ¿±®M»÷Æòø­_°&¶ˆÞˆËÁñ¬‹_¿×þ¬^›‘˜Rd½öMŒIaøäÁ窭º±#&³*Â$LÍÃsvñ½*|¡zL)\mII:Lp“@Ÿha_ìw„Ï™j|¤",ì)°‘ð0±¤ív¿RèˆZÕ9~ +;æ1 |yxƒ°š"X@ @ÆÎ:¿Q‡öi1s³ ;lÿ‚)¶Dƒ¶™´m½Ð£÷m±ÈèC@3g– ¾Î%\PKBb‹™bb­ÔsM‚ÁÞ×À„“X•Õ“oX¤M£•Œa:ý¿bášù…ÌŸSÌ@Wó2¼‘`•hŽé?šð*áu‚«†¡Áæð'o’aÍã˜ð€ÅAà4Ãúù¶;Ø.ËÂ^ñ­ˆ¤åi^78žº&ÈÙâ·†Á?Kf²­JÒ2ã&¿˜ÔÛ®—`"•ïÅ@ß“)vV+U§Jjg„B_B‘¹–¾Ë"WªŒ’â ,žÎœ6á'ÀÂa…«péREµëØ~4FöIŽ)ª•* •­¥Ùÿ —Î;ß(•AÄ.ZÁÝÁÀ~Ñ—³:¢¾ÒDúq½@±–‘ª--æÒÎ-RU±Ë0Õ‹qCîF4“RWÕs)SÂ+ÕV÷v*•Ç_’^‘­ÿ§ýHXyÙk•Q ±ëÀh¤­ãRµ@ôÐ××ÎFy#PIÉ#žjt•«6@,$RQK+ô¢UnB, ˜nuøba_¿p=’˜¬Êjª°ŒBÙ8úä‚C.`x!‚Î ÿ0˜Hš 8a9ÖC?ÔJe Ý*Û,^ĵèsnÚ¡8a¡ì‹…¸øŠ…}ýµí§ýH ¬r~”Ê:Vb@X­X@Õ¸ÌM5küÐŽ°;ú-ö½&ç)²]/ìí×üHwÖv½°·_Ó ;v½ðð¼p[7ñŽ…]/<./î}6¼¹^1ûØ·d¾Î²P+ÙžÏl°í'5zv½°·oÐ û‘=QN™çÀ2õq‘Ë7œ²3ìA9ÉνÑ8­Mì®ööüð‰‰Q¬î½Uœ–R°Öb`£îµÓW9I×Ý-¬/>^ô¼ë…½}/|ˆ…D,ô]ú*ò³&ò«ŒN‰mëÌfúÒçCì°¥Ú’Á§¬ ÁÂF­á%rÍžQ¸)&Gâðà‰Mè±µlö |ÓÄ°c ¿ìzao÷¤fcj]Ç +_E¨[:ŒÆÀø(QJS×ÕŠ’5ËAá”v´ìÁ,:±ÐŽ1ŒòÌå…~”½(ÚZš, +#úÊA…oŽN1éf8 ªÜõÂÞ~”>ö#å8°'u`ñ&¶nŠ]½ $¾1Øbêפì`ѹ®ÚŒ!Ø*Ç¥¸rZ×äêçé-Ї€GpQÇ‚ËO&W*1-Æ/5»^ØÛñB=?…žÙH™I bá€KH0W^À³™Q†,`Ò¼Ô‘n[½³òB:r\“¥¯ìÿ ó´gø•Ò1­°3 X±Ðv!¦o× {»#?R +=³wí2J*œ©«#ÂrGÅÖæNUkÖ©8c®8V¾ XX{, ‰Ñ¦¨^"Q†ê¶K›ÎÌM•‹yëÒ¾I\zFA,`Ö¤êÃN»^ØÛOû‘è‚¢…{©¬tÅÆ ˆ¥¤Sc£¤Q¡ãÎÔ)Èý[XXVèéCÐ ¸ôGJ^cñíK¾Y¬¼TjZïzaowäGòºe–w°ÇGCº,)÷PÒéìÓ¦ˆ\O’â›Ð²4½ÒõŽR/¶…ÿS¨5ç^ä<ÉÓ¼Š2,ØãJ¦2Åä†6)¯ÁžâªûŸù‘v½pçzÁW¿t{¢×€ïzao?íGò5å÷UÏiïzao?Î —¯…½Ñïóÿ3,ìzáôÂðþ®öv{^Pûú…óŸ]/<>/ìX8§ö‰¾1Ë-°°óÂ]ë… hÍ–þYõ:îzá÷ya_×vNëAVåÅÐÆ~XëÍõø”çÞgQ±baªú0¹N*~Ív½°óŸÀ–•©qš«R»Ö– ¹£•1˜£ÎÉÙÇð ½Æ\ÚõÂè…Ýôy›ÁºµÕ¤\8H +]4ÔeX®†­?˜3Sët)å\(½ë…?É »錆ñ‡™t™—ŽÃ?á•VnÁÔ€[±Ví¾q´p´ï•ºÂéô¶^HÊohOgW2ó ý0¢ïÎı^°‡L©]‘ËvÖ[çBÃm4Œ¡%.g«& ¦7Áæ.l­á.M,Œ×F¸:®ÔÅqë7ŒÖ¢Å¿€à… F ÿ0;`gÁ@"®ßD5cMmÛ>¾ oê…Œ*©nþ¿=%sÒZzãÿŸª5{‘GßÐÆ{× Í3±˜*œ‘LdD ‘ÅfáY‡‘m8mÁù`ãLÝÆ:l͸ÈZܺ3ç©8?„­i”ÁÖð nMpÞð_±‘ZÄß° ðvS°. ç”Ø° ëØ™LQ@wwÅ!ÞÔ \‘êæM«S_ÍTtûazz*Šž:€Þÿû·ãß €-<,/_-ï~"^oùÆWÖ‡§m’ß°‘Ji|¢€`ž[G-¦“-¥Û´q”:U`¥Øó“|ª¸ZnßW£§¾ÊU|ûýÏOXK]147nË?·ðÞx¡~»_‹–+¶þ,ÀuuÕ&ð¯Ä¾×ñÜN­ßGýB^Êü”:öz‡š‹Ÿ°}žñB®\ܸ•ÚÞ¹)¦Í›Ýûæm-zôÓXÞL…Ÿ’£‰ôõö¦^àß1ûÿ/äîpó^‘éoã…<‡~ø ,ðBŽ¿oÞºÚ…›ÙÛâAyá°pw~¤äGXAÌýò+X‡·|gãíÌùwôÂÎ ×óÂZ´:) |ù™ö+ó ?ЖnÍ ,ÔAìôÙX¸™釰Pþ.Ò0™„ê˜3Kq¾$Õ7Yù·ë…›ó‚ Eà—é§y!7ÃÏhçäw±PaN@ +ONMp oÒŸþzaue ‹/òBItkÓ¹e,‡6ñœ” cdñ11é7û‘Rö#X£~ cKÃ\º¹KYW.º>ç…:ù^H0¬“,ãðßimvÞß²>†yž›åµ5Íßè8Csºãü*^èíÔ»1u,nm¦ +N 'ÖUMßìGú)í<±æ—±@0IG륂Œ™ïoà Ÿè®G”ßhKWêÿשµ^דÞ9ˆ‰¨¯T˜Ù=v–Ižå¨_Ž´ïñ‚XŒ‚ýÓèeïy÷ÖÌZ{œˆmÈ$.ç…’‚kÒT“[¯‰×i®º¸w&»v¾(ÓÊ¥µ£ÇèF¼ð±^X\,[蜶‹˜{“äéz“ÛWÈŒÿɹö6/0Û)OäX@;~~8sÚ›æçð‚X¨MóȪ‘ó¬Ä8^–|)öK†¯ÞÆO‹hY7⣛ùå¼.KSš F3ˤ“„‘vÑí£øT];wA/š«',ü„^Èd +|@ vìÖx>Lyæ§(‡n7”)>ÙvŠ0¬QÀ×rL×–ÅÙú,^ˆuª=Ù~Ô„`„O æÊ:Fyѳã, ÁÄn=«`G¢g¹=“¨Ix2»*)ˆîADŒÅY.i¼tŒ¥ zÝŽ<ŠHŸF"ŠáËÀy¤p/Ô&FnØ°àµÖp.%œsmÚo÷#䇴sýÛXÐã8àõÇœøëðþŒ^è–8›Üê²â>’R¥•Ä4œÞkí⤬C|¯(_,µX=ÃžÇ |â3`LõEøBQmU6)É,ÀQKàÂÂS©5fùT¨)³–4kc™TÅ™¼`JÎ#Í +¾¤9ìH«.R²"’•fL2*£(#”kgˆ"‹q¯”èyz!•Sã ½+|blg7ßÏ ‘ýí|Ðóïë…`S¸–sÒÇv缞Æ/e’:g~¡u0èƒmêÈÙL'€dä©­m¼µYæ†%Àui¢@)¸1Éù~$¡i?º{l\ªÑtðË,ó”Áõc^ö`„kÜ$‚Þ¶Èü<^°ÊXªtÆL™L*jÁKóvImVFS®Æä¡"A,Pž¤rUïð#ù©+fΤîckÚMÍX¸Ñº6þCÚ™ü®v®ŽÕ…„EŸªx ÑËÚ< Ûÿ®ù…€ C$4KcÙBOŒem±€‹^ø¥¤ôÙÔUŸË «€–MÓÌ ðBæKYÌEI|Òj¤ZÁ Ë•˜2ƨˆa/´çê4Ùã…Û*B¶“T¶âÜè$VÊäu+a›23ºD,VŠE¦…úT;ßݺ¶ÿ‰v>´GÛ¸¬ŒÁÕþEÛBZ^©¯aá ^(€êý2¤jŽ5B[°% ð&ümÛ€ÛáKuj cŸ`á5/õB¿%`að5%Üš>E^¨Ðò® ÃÌhGѲbá\½ “2ãBؾD,dS¦ôýD*£ªJB `!kW, rLÕ5~¤ë°°k絊%_ÇÂ'ó Ô`7]“Ö* X´4<°‡I© köFF—ò ‹@kÄB¶aA’Q¡vg/„ +b–u*ñÜÎ…\€ÒsõB13b—,UykOÔbtf{ŸPª´e„X 43t);)R5òŸâ…aaªþÚù}'{õµèí³â‘ÀÊРf¥O]™P¦oQÙ’PuŒúJöDˆŠzé4è/Ð [:y¡A,”ÔjKõÆ ~Äu¡M¢¥–M" }©?ò#ñu΀‚ê'Y®¬‘UB땵2ÍZe¤–!¸VÔ¨®ýÞ¼XÃò¼p#?RLÿÚùÛÚyñH¢Ã(Ç¡§ö5Œ Q‘‚ZÖ¸„ X¤±Çr1¹Ä¢Ÿ›ÎŸÏ CšcY‘øºà%–Í(f¿tU³ýgÓ[uâ>ªr€YWÓÄÏ›wÎÓãZ×FBð±os.†8æißÃðÏ£6xZ1æü†6ì¤bg‡NëÚÄò˜#=<(®Gªí…Wâ÷â‘øÑÚYÆOOÞæYX#Ìño¾¾gL6Bˆì@̶X,»ûum?§šýš”EZ¤éüX¸&NÕÆWcáŽãT!Gäðln•S«á!þÅ‚¿7?Rg*F)µ9Hí\ç©Ó߃…ë×/ˆòj,Üóú…áÄ&3Ã4…r8ÙHA3>=”ˆ…—ï½ÚâÕÃÛïo6Òg›}¾EÐ΢Q¶%®ËÒ§Z8ŠÙyŠoâ…ÿ×ú^–eÆ_ÛNÿf‚€Öª0Qb@b°Ökjà¬4 3Ì–5RåtIŸZD !‚%1f¤7 û-Ç-b‡átiˆKÒVÑ<`F£±0¡Ö‚}T8àµ=îäV‚±‡ðPb+ÛÖâ4SH¾®ádJœaÉеÌm†1kƒÈ:WùF}#ÄÔ¿‡…mš­'©ÅßYªá:Ö½µ†FŒ²«}ž¯Š–´môÚSZw‡/óB÷ÁU'ßSvê×3–*‰'åR ¸†DG!Ñ®Íóîö‘ `]£m%šVп“þ€p& ‘NÏm‚ÉHðçÅèÔ‹ðCè½e;cèT‰3C°ÅØ'ë¾ÃùÁ +{/ö(Ñ.ˆ\šUÕø€WsÚá¡jŒò^{µf|€}ä蒈Ž0GæD  ‹È xîZQ|'/€v 8mÊf}Ö(UÄ0#EmµN'…SÚ:òýz8k¬Ò¯`“˜è˼"w‚™ þÝkç¬Åü,÷²8]’T®à%-u-Êd‘ULݦëZŸK~²lD4HQ +ù zåþ@R.ÎR;c’<Ÿro\ æÈ¡êo„uéJ"»þ¦œ¯Âäð¢¤2CTÀOYg•!¸¸Žª4ŒŠÂó(q_\v°[‡éäJY’àx5«éߤâgð`%‚GÐU17ða<,¼™0ühX¦á…ÿ©`Gíüæ×þUUÕMßéUM~ &Ëʲ,$¾VtÀˆ$ÆcŒÙ&® +y&ÕÕ»?_/¬­ãžHV¬Ë °FðœJYùRKi—ëxÁà:c ±”2ÆÉ·h±RÁÛ\7Ò¹,¤p¨ÞsÆûì:^`å"8Õ1Jw¬±#ÏZSVp¨ªœ¨Uí‹•g)yקzoó Ùa;çlõ?¤vÞô‚k–(êyÑK§˜]˜¹x,ð/`á2^€+ФrÌ:™õ´öÄ&2.UËs99mëkxAP>‚V29ÈOŠ &sÚîÆuoù‘°Y÷ eÕ.Ð ªªZI¬R0µ ôƒcWK]ôj¨T”Rz•^€uÀx‘J„$°¯ÉK=ªöP:ê6,PÐ #¨ì¢{g¡÷y¼@û–9͹E^°œ§`fòI²”¨br×ó·oGo¤Ï^¦6¸™ÄÇwŒ *«–P9 Á Ú:3º^¤r#|†|а‘ãvB4ª/ï6f;&Éwaá^ˆqta8öv–Ü Õµ¯YêCíè}O©WÍ;ëÎ6õ£.}a)Îìv C,e‘NR½þjRx6ûU}aÞ™XJm &‰9‰ƒé²…ç”Ò®œÌ(®ã…šsœcβµ8=ÒuRû2Ãùd¤íuþ0áË7a¡’ï䜧º.ë çߢ +ú=Ÿºê¨=Œ.…s¶$ãsÏ|žÒ¸‡¦»®‰coîO4cöëXø–vUÕ\*â$ÄuùTÚ.D]Î+ë‰+j9ÚäJĺ6dIå!5¼4¬”ÕÂÜ÷ðÂ;zm¤–0j—–I¤R"…¯ªÄ脧VIg‚Âk]E.Z&À¡ W½¹Ã_æ…êå +.ÑŸ—·6UŸo·×_øzžíI Ÿ™ãFrs¥±d4˜$Qc¬t-ÖQOYªÿ¯ô­~$Ì‚Öm÷õÞŒûi†¹x§ֺjQXË0ëP:©4’ƒH[Þ júU½ÐºXèÝy)¶ë5Ç×ôÂcð s Ÿxa„ÞžŽñ©©MlebÓw¸ ×ðBfCB(5äÏU&å|Ä‚Ihì3šjí½Õ™Jaƒï±‘º·çðÌUO +º:…Ñpè¼,M›š±°¼’Á/²\•|ô­Xè1ÏøÓ!œ†Îl–”Zjy"i<ÆTx+ËI}[^àiû"Ïò?Rd™1Éb´6œG1S^&§Hƒ”fF×%ÄÂ…?¤ø,ÌÝ;Ä m¶Î(HÓRÃ;ÅZJJ¦Z¡•aVæe% “)€‰O.Í%– é·µó÷×kŠ.‰vQæä+1.³Fö®õ‘ë}%±# Íòš>cn˜0Fñ +>¬\W;9-ϺËr eúŠ^O9…û—¿¢UoûÔá®Óëx!‘0lRÌ@ŸÁF¡Xiç,Ÿ9¼•Ðô2^àae3üCß‘XcÖð‰‡IUÎË^‹l]ÿœ•‰Õå¶.:l¿~ýŒù‘–Iíë"ä0E^,|‰¾µ,Å˹¤‹‡3Šäe®üÛÕåyoï·Œâ|b¦å‚çÚTB „iælÉ"£Ó²è1¿øÉJ“‹‚EoúÖ†CùÝXqBá?.çËHi…ór€‡…(Ý»20NR'cUÛkøK:]¿ + +È>_ú¹^@ëiQ‘Ø/FƾŽIßø$JIeUViGÞqá +f¨×Õ[šÎá…ÔÖ!éÊGx”‹XؾJ>@oð‚ˆ‰yÓæ|è‹ljY;A¨à‰Ç…ài´Õ/ð¹hzVY W•[¬ùTE„åâÏÄ#½›7/{Ê}ÀCžñ ûŽÂù–ý ðn™ÅjÈÖÍÄoiç ñÈ‘SJªQJ—RÀBÏ¥ªÒ€…`¡í{蔕³íXß·éëu üs^ø\/  Ër-sø%Q+ÇDIV Å¢VžÙ˜¨%R}L‰‡K<\Ç lºŠNó4 €"³ ba†Û|àû—²JÂiW SK«¦…êXÓEPu°}–͵긦1SEihÇàê#l)§ÂÙJ«Bü™x¤Û¬÷ç‘œÅ/¯_€KÛÒÍâ4˜§Àh’. Í®oàÚW ­hÁ"bä¤ÃÕÜ餥S‰7§Õ57ÏÍä×~]/,ˆE‚m–XV+èµ­ÝŽ}Ôàíìxº¼¸Ú”`¶à +=€–`rŸ„D—|ƒ\À–2:Ÿ0Š€ó¥54ª‰lÄ ûØ’†Œ&`Á÷4+T*5£œ!CkOE¹Èö¦(hÈì¯äSn”+l?öµ ó÷kçô1!ëÒ±uZAÃ?èÎ=(ûBU K1†Íõ™vJ¡”$Ø+}0žÊL¡³B%¨ª€ŸOÏVœÇ $ÄÉõ8$¥T:ôZ"í¥ò|]|F~8^=¿ ð»•E?T‚Ù´cZ›°ªSL¢—¸:Ÿ0Ö(œO9ùÈu8sЈBˆ„#/À¨ÑRÞ‡÷ @`2Õe)(hnôAøB«ì¯äS-È{9\øùÙèUŸÄl»Ÿ˜wž°4M} +:ÅW5ÇšTðPsèn‡±Æ×n×ë̃ù†Ê :j¶Ì×ðŒÛµJœ‡…Oy° ¦a˜—<•HP:2JQE­–¦™Ê«yAàœâI/¨¢‘©ö1b‡âê|^à…ŠŘY¯è\;cÑ€Á$D:/”±†Ô8ŽÅÔùTÚ ¬ܲSª~€…»Ó õ;ã8yòMŸaaž?ƒ‹˜Ûß©uþµyHõ©‰tŽ^p˜/2ä®hÝÀ¨m_oX¨$êý˜«Ü/2e£êÊ«y¡Æüc-3ø¯Æ}2øˆ·aºTùù¼ Êʲ5Ç©ÀPæè°4늯7 4ßñ#½S£ +±hJ©ÊGÐE"–Tš¥¡ úp%ÊëÖ*:ee‹¢*Z l¾¥Š7áÅÿ Îiwd>œ(hsÙ¼óf5áºjq}ÂG±®tDka}ç´mò\lÞ¿)×ïb¡60:[¶TLªs¶ÊN³UE©%o]¾DÀÀ£ÊÁd. HDrâ¢éÿ•g{¹¯8ÕáÃõJñGÿ÷âTïÅFÊÞµ‘j«“„вµeï!ÒªK¸e ŸBq–„`‚ G¢ÝHè;96ç~yL,ÜÛú…ú#»îõBÇ#‰§¬yWaáé¿ZA,§µf]#ãLض3`• “Lk@Èg,%ÎHCì{Q»Q;Ÿo#ý×/ˆl<$Ë[þI¦òF +ˆ?àGª?à–a®Ö&1Æ.ƒŒR1çÖ”Iä&¶4ñIU *åR?÷œYñ×êµý¬^Hз<µŒUð<¶-i»3Û||8 w°~A,UÊàºß"¥¯êù¿9ïŸFòž^`žb1:ÉcU-Ôæ•ëÕe¸6’ ‹¤Šƒb)q9aªT•[™1ú/<*.Ô ÁêÍ:à.̯pð‹ë}NË;æ‘•kÄj¹N +¡U5V6“K›x×;Vü\è˜ý½üHïiçDY,õð’ Ckt,†¶àÂêÖT "¾ð‚VÀF:Ê"mÈ”EÕ{y¶í£Ö¨ºH/,´Áäþ8(ZwçÄ …TþƒÊö¿Ï bn59ð¡‹‹Ö©'"kL:©´é~ zEG³Úà ÉŽÔ·j烊p…Y4ô‘á+D¾e5zÌ‚Fæ|›qÿñSž½W5Š…‹x¡£Þ÷k";ÎCžaœvæ±Éú^yAK¥C£¤¦! RÖË-Õür5“´Lš¤rTKºe"þ÷üHçÆ©žÒX’]’=òÿ¡Ïå¦C[Ÿ`žö “:dˆ¬Ê|§¼U²©¹$ƒj=;µžW[‰˜ea’ûT:WÀ—'q–TÿõZ碸Îõ¼ël—„AGƒTÊnX˜Õx«â^y!3†‹’ÙFE™ 8f-]ª+/ÌX£Äº¨’Óÿ ´ÏT°Kc¶_ŠcÁÿï¼p‘^@,ôªöI3ôÔ÷ © ¸¬ýNy¡4&[ ƒŠøŠž»Íg]^H ´«º®©äÀÓ€þ÷xáŒ3Wð,⟠îÂÏ`Øç°<ȆU;û£v^Ôx·¼ÐÉC½H$˜- b‘vHxåÒ€°‘2 S%AU«t‘éô#}XßY¼õdzœÚ]\÷¸H|*Äh§]/ø5 v¬tk…ëëHßZ9Ÿª/¿W^‹¡­¥Ksƒ¢Ì¸¶ za˜¤é%åÈ …+8¥ñô#½o㾦˜ǧ5j;ü¦¹í“)=¾·º›î°FÕ=é…"l9µÚCÈçDNºe¸ü¿µ÷;¿ †¸í>D³Xò50obR\À{3³Vm´p0D5|¬þÉ·þüHÉûËo´µE™›¹,Ì”uÖ!²ÈZ6ÌzKcEã”,¼‚– Ór›÷sŽ?ì¼óEz!Ñﮥ²¸ßùL³¾ …§ø +‘•«c}UͲmÔÛº–?§B­ó·W¶QY JÏ”•fh`Y$I'õ,¸¨j”fj%ïUÛQ0Ç:ún8Ò´]oûÞò ö³”›OõNüHïÖkã‘.¤Ú§ŠRÎ)ãI{0ù «ÚT¾¥%>ÉÝÄ(¯Ó÷ö&¦‡S½pýBþ^A¶"; w›OõOÇ©ÖïžzÒ° ü<Ö Å  ò2Ó×-iÊÅìbb9é;ÕÄ(ÇÇIJçÙþýõ ßìGÊ*y˜¦qâ“”–/²mÓð!,d‹¬J‹¼ÐÈ(ËF—2ÀBAßÍÀëÇÄÂÿ­þÂ=òÂëµý£ux¡ªìƒ?µ£ì-N¨ rÚNª«òV +M'Á$Xx¯ÊÏãú‘öú ³®mÉ×R!ýøºf'o•vé䔀t˜­¤ ¡ffJRÚÕ½"å*%f ö„…Pô{´s=Üv^x½°ÖkƒRíôr1’È&L{0ÃçðÀEÍzx5ðTD¦Ú/&L… RxO !ëÁéë ¶guyr~3,$–5wƒ…]/<ŒÉYY– —Î)Ö¼ä±f<Ú–´ò*ëç[ɺ§^ìƒVJÉ<ènø/UX¿ÞÄF¢NééN°°ë…?Ä )i?ü`%x¦–á`é.¤©ˆkű¥Eç\Õ\Ó,}z=Óõ\w½°óÂE~$®Ðúis¡©Š¿ˆHåâ¢5 +â9z?(÷­­ªï ;/ü?Räæúƒ–MÙj ’ÌËüL<‡±A˧y;XéßÖ<}ÚH2N÷í±U¡1çtuM“òù·dÙõÂÎ —ØHš~ø1–˜´3pÂœ¤Jž"Šx+Áäg<‹í¿Ì Šöà Õ6½sy•ëbÍòPÀ{·Ð NVÂßEÛõÂŸÑ \uKçhuó˜vÊ–1Ï0+ëU˜"ÅÊŽòr«ÇµVÞ)³%!6_s"„ ð­rŠø&l$Ù¤•$Ñ)3ÈMëµÕTöw‚„]/ü!?R+“7(ŸÕ¤, "Š±Í³ª.’NóŽÆŒ\4­F¿kŠ¹}f Ò"b,Né+²4&í¡[Ò¸cí ZÅ&NóD¼.RuŸjÄ÷ù….æúYñ½ì™ì,4‹ Z:Õ„i- u +sˆRFå|†©¾¡ +³$i•D1£­£:V <i¢tºÐ©öõ ;/ü®)ýÌ<¯_Ŧ6"TÅæe/—Vk2*’ID͸Ì/w£Ÿò¤¥žÉ%I‹n‹ E«†2Âw³],èÌú¢ºmý XØõÂ_ñ#ùI$pü¼^[ÀBËclêÔ,ÑÖÍ1]xC',Ý›i³G ô‚˜¬´ý’b!¢²†¿3Ä‚£I1!'ÀÂ3^Í’¼Ç#í¼ðK~$®>«[ßÄ/±0,ÌXcL1b^4^§jÆB\ =“‰ÒÎ'")Æé Q0¥1~[ó ”óA‘…¾Â& +yd,ì¼p÷z!ÿ|«ä¥4£„Aœ©tYↀ9÷®(gP fñ‘åL—žQÐØå"û–¢jéÕXæ.äøÒFMÄ »^ø#~$ûi©îë‚tšCÆ`T%ãlå…‘ki@Ï’Ù–±3¹´>®¤¡vÙx¡WÒ¨6[¨ìÄKíìw½°óÂ/òÂÁ—ÐB°‘øÓÜqZµñœ‰)_ÄBÄm¼1U-–n‹*1öm +’·ÕÀGØhŽxKó>çBŒUÁÿ~¤]/ü ?R«’Ï6鞯¾,tÏåCHm°†[ðS*Lx°¬I‡¯²cLQ¿½7ÄòezÙ䑱°ó½û‘>\x•C’§”ü+¿·Ò[¼Æ«]=ºvÞyáÎýHÅ9£ÓËüH¸@çFíÅ®À~_Ãå÷Ùf·óÂÐ g¥üƒÄÁ×,\xoW_Ôθ4èN[ºóÂÝû‘²5‡í'­\~¦}Q;‹fnî´e;/Ü=/äêAü¾XëüžÛÎ wïG2úŒäG° Fyxd,ì¼p×~¤éóÉ…pB? +bj‡v^ø%?ù|rá_íü}í‹Úyç…®ÆB¦ôY{ú)í\>4v^¸g?RìΚòŸÒÎÉCcaç…{æCýaAÌôÈXØyáŽýHg?c#‰ƒžw^ØyáWüHŸ®ùÿiíüÅ5ž;/ì¼p¥TKvæžê];ï¼ðÐzargfÉiçÇö©î¼p¿~$r®‰ôbíÿw屇žkÛyányA|’-ïÇõ‚8¬%v^Øyá‡ýH‘[î û¼óÎ ¿ãGJ,={OÉ®w^x`?ÒèξT/ò#í¼°ó£é"Ï®Òѽ_ys× ;/ü}?ÒÙ“ p>ð/dñÈXØyáNy!½dTÊ~F. _¬u¾óÂÎ ×ø‘ì%Gø)í¼Ç©î¼ðó~$îºówÚy÷©î¼ð¨~¤ &¼¯ÔÏÌ;Ï•xd,ì¼p—z¡¶ì‚ñâgæ|íÿÎ wéG:œ·æÿØ~jçcç„Ùyá.y–÷£~¤×Î;/Ü£I¸KL¤Ÿš_Øçw^øy?Ò™kþO›ËŸÑÎÕåI†¿†…îÑtarv>þмóE9ç§rç…¾Š…Eå—íégô‚†Kj‘ ÅÃÂÎ wèGº ,o;¡PFçô ²ð€W"<𧇷6䯶~µÍ³­/ÒÎõXþ-,ì¼p¼PKvÙŽ²8‚žšâCÃCÑ ‹˜ªyY† +®ÇðÐÁçbQ„%w:œ0¨`Ã1[O ÂÖaÃ(ÇáC‡­/ó©.ãÎ ;/|Í4¹ ­‹H鲬[Äfe]IQ&©šËrPyRrÚ%¥]]f”Ôe¢M[S^&‘Zà.¸u‘”MØZVIYZ†ZØ°¢n•I,Åe~¤C¶óÂÎ _ò#š\¶£’ãmLð¡ÄK]Ÿ|†ÖV°mÂCÂÖ§m¶Wõ‹­ËÓ“ÓÖ ¿Ð§Ê›?……îÎÄUwßÝæl,Ôiö—°°óÂÝé…ø’°¼»Æ‚^õ&1Ük[v^¸C?RM­,ÔÓ ‡Xm•»ÓÿäÎ wÈ ÅÝ8\ƒÑL/¯›Nï³µóÂú‘ˆòƒ…¤¨_`¡½ÓŸ«îÐ$ÉaÁÓ‹ëFî ;/|/”É™XxÃFÊÕòHX¨‹dç…ÿ3/°êøjì.Å‚5þ‘°àÅð//$Ùw´u°Í²äZ,ì¼ð ¼p8]Df.ô#]´æÿ/`!yF /”Åô ­ÀÉúæ0Mcr%v^¸/dqJÈâKx*³ç–ä~¢2¾Œ"5<üÔ¼æ…lþŽ³xN'>eWbaç…ñÂà(1táNÚ˜õ^Qm\>JÙ_äGª)ó†…zzÍ Ùôgµ| ;/܈—{OÛ3ëÊã"Mc<1—ù‘ +wx,$â8T-¯yá±°dÙaç…ßæ÷^ëLM¨k4ûA,Àÿ½±¤>×F"*y,眳ÓÃ÷óáÐø+±°óÂxa@_¨f™: /Ôê„…˜4ÎÄÂâˆ,øùhÎÍñ—|ª;/ÜL/D>“݆â…ú?Rç–ÇÁBv¬¼X¦õOñ—°°óÂÍxªKñ’:§“ üH`ráíÜûÒ v^øé…¼ŠjŸ`È>¨Å „ùàË<¯Ï÷# =ÊãÔByø1^(˲¾ ;/ÜŠÜÅWî?‘þ‘°à‡£Å7.?Ä Ãaš×εí¼p#^XÌp9^ÚH‰$……rÜÆèrú!^Øçî"érj~…Ñ…?LJµþÀüÂ>ïü>/ñ ñHçÛH/Fž‹×üß=’c¯és^¿#4oþò\ÛïñBr3÷á¼ Š&?à ×`á/,ß1Nü.üÄŸÃÆ Éw„æMä œk›ë+±ps^ÀxÜWRþm^H,i¾r§ØÜxkš/ gðŸøum‡~œcà³ÿÿ­_ J)™¿:Pù„…§«HÒW¢!—p”S[ó„…ÔM\r¡]5½T)ø÷´W÷ìP/-ÕzvVÑ8WŽEñóY™¿l‘t4ÿzœvÏþ’õbÁÏGÅPðÿ/X&©»çÁ(¾5èh§·dϯÂB#˜:î¨Uýñ%qmÿ¢Ñ€7s^q?1»ÞŸWÿÿ“Nç·®ùïÅnóˆ…“•Oÿ;^`x[_ê…H=xÏhÀ‚)eWž:åd¹ OΩš_,¦MÚacH™~Ž^p¶e®ŸŠ±(Æq{œ m^¶Y:Û|½§ÒÓÃ…%Úþ +|q´§ÄÿÏxaNó<]Îð#ÕRuצÛ)ezËôʧÊÓEÆÏô"£½pñì¿ä-½p{?ÒÁʼn…1 £ßó`¼=¿PG·ZÙû|~áµOµ‹8?Û£*†-÷YüÆüBbécaáh kUÕc¹çGúÉyç×1œ_4ÕƱ‰ß™wŽþÄâ…³±PÎO|°u®†Þ5-IýÝ|ª™ªŠNµ AuªîÚFzt^øKùT[ùPñHKñúÅ v½°óÂ{6Ò‹‘gréu;J-µô'þ7ó%ÚyÌ^îv^8ËFº¼fá±UŽýHÓî’úÎ^眵ªö|ªÿ/^ˆtû9º WIÕ¥©.ªuþ´’ NùÎ ÿ?^H#²®èyXx5ò\;RT?”Ui¾ŒÖàÔ ¦þ¼ÐK_7¾Ão”âS,¼Îƒaè•Xø™ªâó…¼PÛÙjUí¼ðâ…H*뀅ˆJ³\äG²…ÍuX¸O^À¤µ­éav^ø?ñ'´ÉU XHUÊ[Ê/ñ#áåÑ×aá>y!Ä ­£GH¿óÂÿJ/€R(ò‚f^)~j#]™OõnyÁ7ÇTÉ˲óÂÿM/œ°`©6Ú¤baº*Æýò©Ix±óÂÿŠz +ÖQà…Ö×'íx¦ šÕWaá^yá©v!.ÍßyáÿåGB^@½«´¬>.²óV]žÔÍ×`á^yÁûñ¥ +Ä°óÂÿK/X_Hœ8“2½Ð„7 º wË Oµ çyç…ÿ/$¥¯3Ÿà^>Kàöf}gc‹’âH ÓÎ {<Ò%6XXóX¸_^xÊÕµU_Ž…;æ…§ZUƒø˜JªœRNÖýúK#éœz·6Wÿ9FÝÎ Ž—W;¿k^xª]˜Œc!SŠ1ëìûcA&évhߪwg23Ò¾ÆBñq%¼îl]ÛÖ.Ïpß¼à›æ¤…ÈÇXÀ_.]v²¹á²Š‘u +2v²âá@5šõ,ʘ´ë’ê¢;ÄGGOQt }¸Ä™vö°óÂßY×vÂss1&Ÿkõ /Ð$™Tè-µsɵ›éDèzDíV³rVNêí2èÅj]HÜúáÖ B’NâÕÄpíÎ Ì„†@ÿX¼°#ùOçÁFÂÌ¢a›ÑéLÐdq4×Bƒ£Yñ:· W/r¤u±bÁ,<`aã-œgòÖ#ÉÎ M/`×Î.ÅÂ]óÃ&>ö#• œÍ6Üw˜9¬éÓHHˆëC'_oERú,²k‚çöi•8Ù¤ßú5U(ìj]ízáïù‘pøM/ÅÂ}ó‚‡óxáI)Å®Â|¤hý×Iʨ³I ˆõV´*E’¥{8™$V,¬çuâèéz«âM¤î•ü¥9ª>™w~Žèèiä‚kt’&›Ö—Ü©œ»Hõ]‡úÂÑ´uýs,l¼P[gÆU«%ešþœéò¾}÷¼€¯?ç…Rڧ߃r ápI«”Ú^‚¢F—QÒc’òµvG]ÁëuR‚¨|ëÅëü‚UV9ì³E~h$í¼pŸ~$ô·TbáÎyÁó´þœ<>2'ãá8Ñã$Å6‹]O ¬y±†'ǺeÙZ6”Êd<^aQˆþœ }‡ôB,Ü;/¬%I~:NUž=Fì¼p¯z¬Ûñ±xaÍ<ÿÓqª=I.ÁÂÎ ÷çGº8Ày¼ÐV'›âÝ(‡6ÿ&^¨G±¯kÛyá +^ðýES çñB~ôÔæm¿‰|vØ×;ï¼p¹éÒ4ÃñÂXTýৢ‹³Š¾Z<£8úgiÔû¡êá@YÜVp&EßÙj†¿—¨¾5/„ZU—òÂÒ·m_M¯zSõÏ-—›`aç…;ô#¡z6aá}^02êmÒ+⎵­IpPÎÊTƒìsÕ”åŒúˆÆ•‹S™xbnÏ ¨.å…b­ôú²ËØ~ìüõ';/Ü­)m¿ /Š±äví5ñjô™äAŒ4p«+{˜zšå¼]Ø:Z•Ð"“ÅÍõÞ¦òR^(œYšÖ§ÚrÈÒàOMWÒj_¬)‹ëÞéõ:fé1‰ñ´4©¸ ;/Ü¥^ðå%e;>â 6&•õ b!2+¸o¥±Æ”µVr +\÷¾jsú z!”$¹˜4Fé…‰³Ögví³Fjw ÌpkhÆ`“Ó:äRùqž¶þŠÉ_–àC^¨/,Ô +”`!ðÂ, Ì{1ÐÅ ™^èÁâ0ííýHá>ñ‹yFÝ‚GœZ×3Øõn[gRTU¦ çcÀÂS/™r†”—baç…ûäP‡Ûð‚êˆ-[ê «áîŽ*)´öWmQ$¢ÕìºÔ:žÊ®Ç¸+³oáÏ/5ìÇ 4_±@^èãÊk\jºÆÝeJƱtÙŠqaÝyá^ýHþ¢ñ‚f„L¾€N¥¾ç^TIÝcßá=ô©‘°>ñ!y5øˆµÕèßUÎ_æ…‹kÎŽÇ Šc<ö ø´a!Za†|³ Î>î¼pÇ~$ŒKÎÎÇÂ~¤ /x9ÒÈ/xq1žÆr,ÂBvÄB¾b!‘²öq¾ÚHò +,ì¼pŸ~$œb¨ÎÇÂû¼@.ì¶ÔÉ7ñÂ>Uó/¨ÛÖofð^µšR*£¶Î²=™»p9ÔÎ ÷¬ÐSr ^H.Í0“}t¡¿Š…ËxahŸŽ“¶›“9^ÓÂÄmâ‹6hªº2mø•¹1!5€OÚª¾ ;/Ü©é’4×Ʃ&y4.Éxq¦Ÿæ…Ÿk;/Ü7/”g¢—¯ýaºZ$¿üBÿ,/ü0v^¸W?ÖAÌÎíÛñB¢Y•8¿°-zÙyaç…»ö#ášßè\,\Ä RQ2+5½h¤Þyaç…_ñ#ùó§.ä…Ì°Ò´‹LZ› {AÆÊv^ø½p~¢¤Kõ‚&Þô‹,­é{k/¹Ð;/ì¼ð~$ ЫÎÄBr ¸1„‘ nÈÎ ;/ü/œ›àb^` µ¬½ÄFÚyaç…ßñ#áÏ)ÎÃÂe¼Àˆ×•Él3¬“Øyaç…_ò#è”9 —ñBYú2ñYí뢨/ºÐ;/ì¼ð;~¤ssüüH;/ì¼ðE, g­Îúù‘v^ØyáK~$”¹ö,,ì¼°ó£ó‚/ÎÉð/$é…¡wå臗ÇÅÎ ;/Ü‹éÌoñBÌ.Ä êþe®{n;/ì¼p'~$ÞüèÁ×5O|¶da "cEŒàøW'Kø&çˆ^â}Z“]‹¶É_•ÔÜyaç…ßó#á+ÎÀÂ?¼k_kc‹Þ0L‚y’ +][0¦Yx|n´éü µ!É ’Žxx›Æ~1šéÔ—tÚyaç…{Ñ Þ[sþáC±Œ ;ûT.²É”ÅÐ ¬ñQ{²t®¨*¯sÅ™I2ÚsUãeŸÄÖVNx§HµóÂÎ ÷âG:+À¼`+Ÿà"~žwLÖ$Š åý³“4Ýð_{ç¢Ø¨ +„aD¼ˆðþoyí¶Ý=»Í¥iš¶ówÓ­1ÆÎïÇŒ1—T¨<ÝEê3>úUÇÞ/¢t’¦á0Øv\@.<ΘÉð/\/4´Š+eù xElÎFºýDÎtÕº4óør—§¹õXÆFðÂê„:î^{äráQêH){væ¤ø_ÛHU,`Í¡´ÈöµÒ`ªždúh›TŽX™å¥ï¥ædãÂê ak­³ÿ·‘ È…O¬#3Ìð_¸0ØÈ}…ìXMiDÊã6ëDºw^¾¯1SŽ¦Q#=µfU¦gÆ¥6’)òÐÂú_îŒ\@.|b)³þ¤þÇ…‚º4išñ%õÃσ½k“šD[¯<¹ÍhfˆyS¦)ÄÁT¦‰ÇÕDT¡¹€\xœ|! ‰*.æBìß »ñí«-%Ž–«"r¹ð8u$8‘Ÿ +½¿]wù[}”owù39i×(óÿ¥ñÈä§ráäØO¹ð3êH§ÇørýTxD/ ¾ŽÛÓã÷â‚P¤|{q­â//4:¨þðh^@.||¢¯~ãcÉQO7ÿÔÛN­3ØŽÌC®ÙžœÙ~O.:ÍÏÙËÇòráñëHpØTÐñ•¾ém¢Ùë~ýÕO U# r!vÕ[b:«î¡V÷U•U°ßäº7Ðvÿ?ßÌ@+\@.\VG:¥áNù´çÎïÏ xÁ½y„¿>2 ÿýÿ´¾ù½“¬2åËS¯¾%šóÞ–säÂÕ‘N×\ïTGzgMõy~g©éÛo {u»)÷ÞÄe†–âó“Æ©î÷¸e1ÓUäyùùå^8Í…•>·ê¦·:‰±¹ðam¤S^¸Óõ…›ÕT³ç×ùõX8ÆÙØiÅËQ7ô÷I‹%q€½bûdn± Ùå^8Í…õ¥ÿ|ÿÖeCÏnÀ…ÁyP&Ü´~þŸèÛç Á…î^}0ŒÓ|¿³2.¹¬ +΂¯Ë`;’ï.¢¡Û2š*ãqÎ¥ÉkðBuÔaoyMy‹zíÇò/œÁ]ÄléYïóØ´l‘Yê¥O³DòŒ0ØowŽNqÁê~ìûYuQg{áûב¾N›ÎÁÑÉ¢môzUtÕiÎs­©é¦íĪ] ñÑ…¢ 6y„°Ÿ²0Dª=¼Dœï…s¸PG­¬ õLi[:J<å¥R¾°ÊºG¢™Õcº{äý\°{ŒñŽ/4MÅ ? Y`irçF§‡‹ŠÆ<°²„üªÑÛ9ÒøÐ7$¨^{!+i˜¢áÜl^ycOßxÀ àgÚ§6RŠëRUFû]éÎE›cþF\ØîÓËòH”×ÃwæÂêHߎ 9Dy£h®)Íál ^Hó™oùÂ>Õ9pa‰SppV*#<ß½°Mþl«Í 2¶gÁy6&]U¥#Ú9§[“Øãljf°Ìën‘/0M=uæ¼`*%Áõ7æ‚F.üà }:<ÊZ)nÀ x¡|ñBL^Áñä….l^ éòÇæq™ÎàB/d»z8Uçyžu峜±¾¯¬» ˜jÛ67>hì!$Œïá‚,Ku¤/Ç… +ÚHñ1½Bš‡;qÁ®"ØW\ ëÞFš;õš u,…h²'/Œ7çáBž»«›_^`Žk½÷7₊‘PÆX?_ÏYÛ¶§I!1_x(.LéøÂQN=D®<¨ >ng~ +*ÕER§à‚äi±ÛÁÒn©Dÿa\t_:?:%K*ŸÛHÞ·LÝ6_8l\SÀåÝÕ\k NMR¨Ë¿EýÓ‚Õ(^-bé³¹`|Êë~Š¾ùy^øW¾à¼c±Ö2uö3tx²¼5m9|ì¨Ãl¼œ x_ÛçÂ//˜á«¸P¤#7Ä5(ðŠƒzÞ G“¼àÀ#uÖT›æ0Þœ U'ïàƒXÊ#äêÊ"pAAÄò*ŽyA¼ÕFÊ©I‡qÈ~¶·#é¢6ÖžRØØ¿½€\ø¾\8<µ‘ÜF‚{l^Ð6ÝÿéÀ °’±ÀÀ3€@‰Öb÷BuÁ^žË¦ŠÂo©9?˜Êv½Îj°Èøtž¼P¤?)ñ&a@v{#Ýÿ=¹€u¤«v}]šƒºU³ +¢.~IGŽPEXŸŠšL)|pªUqΩu/8ºçrJ™H7^Â{wŽÒ1MÜ’Ç‘R;Å,õ§D ù»¹ ôXNzŒ¿{¡«)àÀ¼øv\À:Ò¹¿iâë‹Ï}8¾.9>­àÏßö±¸¾°6>Ý—ÿ\ç4üÜ Êžö:l{nÒ<Äiøx?p¦(òÚ~?.`é*‘púÎßì’ƒ{Ùugé¯,í4š_{Á—„µt¥!Ùo›pÝaë¶(%æ ?• þųÓ}€ê<^è…³û#5cßï7ëH(g¹ðE¹ð1^Àq¶±Ž„\@.` ¹€\À:r¹€ùr¹€u$är¹€\@.` ¹€\À:r¹€u$äróärëHÈär¹€\À:r¹€u$ärëHÈäæ ÈäÖ‘ ŸÄ…õ‚ÐÕíßE. >‚ ³¸¹ÚW\ž°[ÙW^‡F”·ý2XGú¡\Ðᾞ½ÐXúrÏŸ¢m~keþñëH÷‰˜õGqÁTÙ¨0÷úLŇXÙ=z)ػȅŸÄ…¯.¾~€&ñàùBEÕ}D—ÄÔYŽ{°:’á÷¯ù•”!PÊ…; ¹€zØ:Ò×ñr¹ð±u$äráësá§y¹€\@/  o·‘?Ì Èär¹€\xÛ XGB. "Ö‘Í #û +ÝŒ ëWüôÅ÷ä‚®gÔŪoæ…ìøõ>ýqüž\@]©yá«ê;r…^¸§— sºRÇü¦¯ûñ×oÇL‚Q÷­¿ô +…\@¡ (r…B. PÈ +¹€B!P(ä +…\@¡ (r…B. PÈ +¹€B!P(ä +…\@¡Ð 1C/ îì—?¦,zu_9ý˜RÚÿDz‘> stream -xÚ¥U[Ó<}ϯˆÄ‹#ãk.< -—]@–Ý‚„€‡´MKôåö%ÐÏŒíM»KÒ¢Jõmæ̙㇇ ~<Ì4e2ÓŒS™eᦠX¸‡“‹€{ *ÊGOWÁ£óD„œÑœåájgMVÛÏäÙ˳ËÕ‹«(–R.h§iFž½{{qò*Š9¹€É‡+;}{áìpë*)y‡g—nóÍÙå%ú€Ñ×ÕëàÅê„H¬¨J$2ù?øü•…[ û:`TæYøæŒò<›@iIµ’~]×ÁûÅ©Ðy-ä+‘P‘ÂD2šejNœë…Ä?F™$åPí€ó¡jáy0M L¿U#.q£&Û-J¿€iõ…qY¢(CÙF"#¦F £=ë£T*[ëÑî&@ÝÍ·#tÓbD×q»vÇkÜÚ Úÿa³û\u“[Ãc]:ïÅç(\n³>2E&3EÈÌyJ¾[T›ÉXÙ41gØ;“#?Ø3ͨ«½MS ÷Á!ùl‡]‡lïrþÊK¨6…©¬¨˜L×ÀzSÔõ‰>„}ÁÈéØÖ¸íìÇBŽ3_©œë°-[W£•;?ÞhȉË—‰EÓì– ª,'¤^´¸ﻲWeÜÆM\!$dª!Ÿ¡²Ø£ÛÛvÕμjwkŠ¾¯`‰¥‚gÛÂë¹$J·¹ö’ã¼üiåÜLÆ»AÎurRðRH -Rø²oKd äöxÝÔà ÚBÅôQ2* ÿNå¬+[ŽÆAßê%žÐ4O=2<J)òr¾_¶…`,¼æåÏ¢éëò±Ã“§x±‚T3ea‡®3¢X í¸ã•â½[Õ•#w§ ®£)gr¶mª̆ÂtÃèö¾0Í®cëXp¨RÐS2s'BèœÃâ*Õœ1ßî|ã'ncЧá]Ý<‡JÆž£ß+ªæ A·}7¨Ïù4ꇱîT.ð/1/¦r4÷ ªƒîq©ô|§Êœ2-o›} Êl«vXhÆ×áü(›{¥öeÙµ =ù†¯Ì­ž‘~ì™~RšÐ\ßø> endobj -2631 0 obj << -/D [2629 0 R /XYZ 85.039 781.388 null] +5765 0 obj << +/D [5762 0 R /XYZ 85.039 653.905 null] >> endobj -2628 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +5766 0 obj << +/D [5762 0 R /XYZ 85.039 653.905 null] >> endobj -2634 0 obj << -/Length 2762 +5767 0 obj << +/D [5762 0 R /XYZ 270.549 176.64 null] +>> endobj +5761 0 obj << +/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> +/XObject << /Im18 5331 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] +>> endobj +5771 0 obj << +/Length 496 /Filter /FlateDecode >> stream -xÚÍYÍsÛ¶¿û¯Ð!j¦‚€Ÿ½9IÛç¾|¸•;>¤9Ð"e±•D…¤¬¦ýÛ/P¤D'oÚKÆ3&¸X‹ÝÅîoWzâßž$¡òm:‰­l’L–Û+ò3?]iáB«Â €ñÈäÌÍÎ"£ü ã1±2±ÌL RŸ8^Þ]Í4þÄø*ŠìänEœwùO[5…¡ïÝNµWOgÚ+a°kËÝãtf£Ø[ö{i¯šÂ¿º~¼ûùꇻ“@n·@ùzTx|§É—d9RöeÕ²At&«FiƒÔ»ÙµuEbå‡e[V»çÄò¿¢ šnSØ_û ²´¿éË•òXîP-¤TL˜xG§¬vÍxj¯ÀqêÖar]lŠ¬Aæâ;Tiè-€/ÛNMì=àˆÙˆãï¨n˜ªê¶áµúë¢Y[>MMâH÷$T>E ÁwGùêݯ»¯a¤‡Z:Ä#ª -¢Ñ‘R:ä–¹D¦uF§$q¶¸VÑ)·HØÃ`C¼Û‚—,rd ½§2ãÁ[`YÌ~½}ů¿û¡_*>€öÐzž¨àÙzÝû÷oP# &íX9¨.Y7-Y)´,©e!rZ">!SuhFÇʪg¯j‡Ç²W­ðiGì“(Èæ3sŒ‡¤ƒ©72¾…ÿô:¢n¢/q…l³qªU$¨¸[_Ú;Ò ¡Isr0ðïlÃë¬àý°c—ÇË·úÜÛ¼BÂS™;z +Áú»âÈ<þíû÷ðÿÍb!ç= Òñ¬ œE`Vrµåæ;ƒ6ߟ_<Ð}ä+cƒ±‹§#e#‰ltå=rå~‡@r¾l¨‚ð™ˆSaoÍÑk¼Zž&òVp6䤴ãnS‘Ö)øàD-ÔhMðY:¯ã'+»[Ø‘Að`Ó©†—h+~Þ“7ÈF2—†ó4™ãMÕÞÜø¾Ï˯lJ·;Ó˜gä<â{U¶Åõl¬¶¬SómYè·=ª Ð]ߧ+jÒôdЄ;eÍS—¶ Ýã×”‡Pîɺ¹»&G1N¡÷:ÏypÛÛ³ÍîË¿³Zæ1´]#Ó=F¤ó wߺ›.Ž:¿’`D~·MîyCgiùwª‹UáÖ«Îu¯ÃD&èv'àDý(¿þĪ·cª_·íþûù¼ÜîA¨¶QMu¨—ÜŽÇB튋”¯ãø üÅ6s5lÂæšéT…Iì04ÝØ0ò0õf hÙB¢B¯©¶ú.fIº ¼ ¤eE[ -søIƈZf:Ò.ò‚ Ÿ)í—²7ÇLÒ¹P£ßq]€†k~qqh¤2ØU¸T=%>cß“:ÍÆ\´À ×BŸPà²îÐ`/\ó‡ä8È¿džÌÉ™NEÒœàóÁUa´ý®iá°d$X‹ôde1¬¨`b]5=Á…›bi^Ô#.C›úvÜÿqbPk¹˜ -ô—A3 -ÒH8ÇÞÖ¼å¦,²æÊ4À€%³™l e@ùT¾ûr²Ä{žœ½µ/q'2Œ®Ú“EÀÌò:rAz0–Ô§'8t¶seÖø8ÎzRÖ+õ)MÓF]à…É‘ æ\Mèê—¢Ó\t¸I²EF7 -Òõ¦ü»ÿe¯P)©&ßÈg})FñNêÿr)lY¬HÒÍ ²wh*DÄ…Oíý÷%¿`BMråˆ`)J 0q±sfø†"Z(檶²ñºØì™^®˜òyÊwŸˆ¤¤æTâR¶àû±Ä¦²Ü_V÷›á×]¯à¼þs®D÷üǨŸ?JÛ4$òŸê(}£Š;@×S#Ïùå>;X‹2]ë|ð[ÃÑ(ñn¨HžTOQ·Üx ¹Rž÷â¥xÁ¸ù”ðYÎ3o¨u «ÿ!lû=D€3D(ÔùŸs°¹/žÿ¢“t®ç~¨®·çÒ@¬U>¤‹ñ&«M¡8‰Ð<1 0ûÅÆe¨B?ýjãÒHãÐÞ²ÇC=ÀÏ¢'é—¶·lOm×OW>ú“8¾òÁ’Éõ«tšN¶Wà*L#yß\-®~6h -@èçÖ¡¯|X‡GŽ}¸N¨l2Ñ ”¢Üë%…Ä0£UŠN~RÈ(4ɵ[öf£{L6T톜/˜a°J¨’ÐÊüGL#˜èjqÜJCïCWe“‡£Ëì”øàˆÉÿ½Óe§KûVé˜*›É'ÐmªƒÀÒtLJ=}E„ùÍÖL^W ½ÉI6U6ŽeôÉ¥t2rnëâ‰ú¶àøýÎ6Bg6¥ÈØÒ–«Z0s!¥.–ííò^:ÀU»ôåB3~4k -¥2pŸ]·> ‚ËüöaïøÑNܱÕ!ÄzA3„îüÂÉŽf …dv*;#Éö[f–â;w¸ ÞÛç8×OåR¶XÖÅlD䌛¼€o»,ãû.õ¤Êô/žÇÌÆâinîÀ@¼ÏfüQÐ}<,¤ZÁuðáPÍÚËÅÅ!—Èqy -qÍ`¿šiå~ƒ´lÓÃB[£éºï&-‡`iÒÚc5W<ÜgÎaÒ#©…»u>¥+drÄ~Qs÷ žƒÆ7q¶²ö™‘–רþ'Iý–^Sѧàþ5Ì+ÉzêðÿŒA}ØÙ“#Ðh‰ ®°‘÷í~SÈuí—j#þqál½œçV|aäuö„Ì‘|º¸ísg\nŠ¸â:º”…¼nŠ Hâb"é)––²°cËÜ>Ý?²$Ý ®uðKª0ª³âTz£gžÕ°A9Ü•XÏ}f§àÊgb"‰a’žx¡wn“¤˜ ¬ ódMÓƒßd¶Ö?8ýhˆƒµÛ!c -®ànx™9ʵ«/´·îûðРÛÎ’43´žéÝßÖ±äb³Ód%¿!!%ã/áŠX#?¡Ñç…SÅŽ®ð¥à¥ëxµî."ƒez÷‰H=ÉåkŠî—-ç@ÍP¸9wÕ{­÷®"èÅç6F+Êoþ*B,ÓñdÆßý+¨ÖCÄÐŒ×2¼@ˆF+«ã¯õœsѵµFsÝóU’Åúendstream +xÚ¥“MSÛ0†ïþ{´Þhµúì-|„†™¦!˜pHJ;Ó Êð÷»Šlsb<£ñjwõ>’^(ù‚EÅ| ä`³ËÜKæ,£¦¢lJʃš£*›ÌœRU„êg·ŽEcªíu~üuº¬NWEÉÌ9E,JïC~|µ,(¿¬g—«ù¢š/ÎRdd’ò«eJ_óª.š/ºôôÛÑ´ŽUq[g§UKÚ2UL˜Ùõ­‚­lé¢n¨ç£oô¸§Ç=%ë4Ii-çN^þ’ž·ª’uÀh÷Ðð€ª ½àÆèõ~F$;mÒ“ùÎÁɃ€ÁÅÐÚ+ †Zx "å\ºã<:² GÖqo€eÕZê_Tb šœœÜØ®Fw'eײ'°îÀ‚ïWM³ß÷/Owâ—°7 ™2™ f×åêhE%5|F'÷¨GP;´¦¤ÏöN¥·NÒÚ¼ü}^o·bê碤|Wèÿ¨£È>¤ø5 ›Bûü—Ô­ŸþõùŒ¢øœ,%^žfi‘hl'âA-֤Ͻœäd*ŽkPjýäëliXnüƒ#·Z£¦¬°ñ£ö¦~–Z1M]tüŠÇ +¿endstream endobj -2633 0 obj << +5770 0 obj << /Type /Page -/Contents 2634 0 R -/Resources 2632 0 R +/Contents 5771 0 R +/Resources 5769 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2619 0 R -/Annots [ 2638 0 R 2639 0 R 2640 0 R ] +/Parent 5751 0 R >> endobj -2638 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [297.013 519.753 476.549 532.655] -/Subtype/Link/A<> +5772 0 obj << +/D [5770 0 R /XYZ 85.039 781.388 null] >> endobj -2639 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [343.406 485.661 494.306 498.563] -/Subtype/Link/A<> +5773 0 obj << +/D [5770 0 R /XYZ 85.039 599.799 null] >> endobj -2640 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 316.898 479.305 328.89] -/Subtype/Link/A<> +5774 0 obj << +/D [5770 0 R /XYZ 85.039 599.799 null] >> endobj -2635 0 obj << -/D [2633 0 R /XYZ 85.039 781.388 null] +5775 0 obj << +/D [5770 0 R /XYZ 296.792 230.14 null] >> endobj -542 0 obj << -/D [2633 0 R /XYZ 85.039 761.463 null] +5769 0 obj << +/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> +/XObject << /Im6 5155 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -2636 0 obj << -/D [2633 0 R /XYZ 85.039 669.619 null] +5778 0 obj << +/Length 495 +/Filter /FlateDecode +>> +stream +xÚ¥”MoÛ0 †ïþ:Ú3¢(ZÒni×t)°ÔMS×ðfA€¥Cƒ­ýû£lÇNmc—€!ñC|H¿2*-*Ï )(çÈ{õãhµÏu‚mDÞ†äg1U2[V¡† ƒª~öç0X&U==¤—_æeuµÎr"J1@–;çÓËM™azßXËõrU-W×qgň馌îÛuæ)­š åªwÏ¿^̛Ϋ›äªêH;¡ +ó%yxÔêIZºI4PðêMÖP܇D8-µû_É}r×Õø¬j²¦¦rŠÈg̸œ ®-Gƒr4*§UŽÂLS•Œ‘±£“õ™s„sŠÊ-Cà"F«ÕWÐ ¢sA*9ÓØ‘¬ì8œü³åƒúü[ØÔÝHäO+¡(¢lá @–Á`ìk |Ó¬¿Ë ‡ŸÊ E +‰¶Lvª·qmÒYN!ÍöB9ûÝßãV„ãk%"GžÙBpûăl]'|{é”ý$pØ ßÕTß•Myº¢òãþ93>ý#Ëýó®±ß¾FÓöøºß¾ á¬Pþï4;H2Ø*g@œjCÄhD£ø±¤•¥‘PM–À˜ùÁKÚý™,§0=n6Œhš´|ÞzÖÆñp€L^fBmÐð?u + 0endstream +endobj +5777 0 obj << +/Type /Page +/Contents 5778 0 R +/Resources 5776 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5751 0 R >> endobj -546 0 obj << -/D [2633 0 R /XYZ 85.039 669.619 null] +5714 0 obj << +/Type /XObject +/Subtype /Image +/Width 780 +/Height 1135 +/BitsPerComponent 8 +/ColorSpace [/Indexed /DeviceRGB 31 5783 0 R] +/Length 95337 +/Filter /FlateDecode +>> +stream +xÚì]‡bë* Å6¼·ñÀðÿù$°3šÑ$¯í5w4õÖáHBÆ<Ý|¶·µÊìí´A Áö¿¯þzÜe说N§†|ÿûÒ_CEý›Þv1£…¯a!ß„×ÿeX`Bý PÙ÷a¡ Ü‰}ÿPºƒáØâðÉÀ§Èž\Düž¬Ñë÷xàÆ;®<îkæ¯kuõ}X ÂÝÌ'ü½Cs6?´ŒSÑá§~„—â›AÌx 1Ý9»ïÍ Þn B“0¾cá…Çe;> ‘ìÏ°-Þ;4QÜùZ:ɹÔ>)ÊÌ"©î~©Ú$o¿W!Zã ;>›øÊÐôç¦Áä^w1y›Ô¬G_ÊÓ-Øô¿a¡=íDx¬â(›EqüFöÖˆ Thäke±`2@Æ(¢ƒÚ³vôz%ÎÖ¯~T6R:ôGÁýÂùñ¶Ïüø\‡.ÄSÜiœÿîñ ­–½rµCÒZjMø41­eïJ$Žnð¾ò±'ѼÝ4ËããôÕ‘V,ÄPC&XáCoÁ#Šg*2 YŸ•ÄæÀ ‘èehy¡@,L2^/Y ¸ŒáOÄH×ù‚• >Ü*›oBÀe-}¯çp Áàìªês7 †LXù#ô^/Òœ; ±i}Fh@„ +S• ieOƒ3êyçµ´U<3Í®aèõDˆ."â Z%€ +‚½ ¾ô±'yµ¼ŸŽ{—ÿ•¤ë‰Œ™D³’H–Õ2Zd`L©y£KCVK‚²é”bÅèL(åæžÏt•0L±M¨E2è±ÐãÉ1aÄT2K3±$M"@»bq TëºîõÅpV¦cÓK¦šQúŒtž«}C4'¡àª±õè ¡|¸X(«äoò/ñÂ(ìè>Z,lÞ‘bS~J«ÞÎðÂx/À"Â!&ԉɎҸ’ì)/s~¢>œRùÆËoõÎÏ8žŸ`á”ö7Ê÷äÿÊ ›Žd±Ð@”ð¼Aj± #Ó _¯Oâh/P4Ðu/il‡™qp¼‡ÃL,i‡!f Êô ú\¤ +BPØ,džœÀ!ðRb9,À«Œp3<r†¤= v`óÃ5Œa­©ñá¹M;¼tËw^€Ž#̇WK`8WtŽT•cM¦Vú.äv3%k§Õ¬Ù\˜ñ0 ¹ÓF™4W–ÙÏDÖy¦Ë «†úƒ’ZŒpódŠAˆÞ©É±'àà󦃃і„npXhº’¡Ü”ƒbÁ8E}È@‡ˆˆ¾@øÿ„…RPÀ¸ËØaAG&g¸™¦Ù áG^€^¬7^X„Þº0Ôëxì,ÃÍŸ­XÀ>áiQQ ¤ÅBĘ́Ü(…Cƒý‰€÷ŽØñq´¦"-*cBnÂç ( Oi%Å%Ö$þ€þ—x¡V#|™˜ôÂä‚$-êJÈh-¬o*Ô“ar8Ñ*y00|ÊZä\H¥"’88Ô])`Œ’Tžì“^2Ñ}%EíËF+ß_• Bb”€Af¾¬@¦B0†…ºõ¥¶öB EYÁ%[ÍÆ@z‘m¥;ЙÛéØ ˆwQsí° XŽ@£œh-xíƒ$Ú'ëE:Œ×~¿ñBÍz¹ZE3‘’üqdˆt€*03#b¯ãNä‚RË ­ô›z<Фõ´0áVÖM$b‚7'™3Z!ô³êa¿Àçžß¡‡w{yA…ðîƪ&`ПªÞm$j| Ö3ØÎ,;±¹7›/“À¨µäŽú¼`¼ +È3`ú¼Ðpèm„—‚W6û*Jës‡wexÕp™à@–{€Cj;n%N}°›àݶð˜ CDÎ^oþgIž`Z,¤2Α<3àï±Ê2¦hž²Îq)œ½Ö ¶ò¨4«‹°xF,!/,2€mŒ¿bÁHä…&,ÌC­¼P+KÀFbZ0"2T›"à…aå… Ç­Ê£¤;Á (iLô´óò!¡µø\ÂW[ Ùb >`Áð ºÛdb²*¤è|œFBîÚ Þ…c 8@þS+KËѵ}G¦Òu°jL¶3Ú~&:i`œ²ã`…Ôc± V ä@¬>ƒfŽèý϶ó‘ü• ®,ÔÄ[ýC3‹Œó›RèW„>ؼäŽ*h©íÛ¡ÐC€ ÀˆÝ"ïÙ^u¶3Š}#K¤_/´Î^à¶GO±€² /±àÙ£eÚƒö;K°¡{qÏqÄÂÒ¢2'Ãl_’*´,´@ ¢¶‚¸zT7 ºÍi>ÈUOjE¦Ã, Ä:½íPÕÈ@$è@,àψ±P9oy&y1€öàÐЀ"¡x©%4í7¨_t*EšH7,P4-ÀœvC/òÂÿìGb]×w©ïx!°XH cž/Àð ÔÂ: ªÑró3¥pÚ`ÝR£ŽfÝf/˜u:ŽF^€ã{«à¥RœÇS£/2­¼€&\µàÆÛx!=ðÂüb¡ˆlã<²SÁET¸»ÜËMÄsH"ë(›œ»,j }ç´¦66çn0Y§ïS/……¨hÃÑ`˧ÙjgùgÏ\¼/–ÜN@çÞ²^ ÀZÒQ3[`o°‹ƒ”U{k +›à¾öèxŒ'Øy¡@ö,ø2Ì{­VBvïiÔC\I0ª)Ñ?Hgè%£š}]/œ1H'áæÒúúL¬XPbšˆv~ Ë ¨"†;pÛ•dapSÒó]^è ( +Ìù‘<K:/ÑÊ ³›ÿ _÷²Ä:¡}Íx¦%â2,¦‡+•ºù²çýCóÎ +'g8Ž¼TiÙW„¯„ì|‡-hvŠ~©ñSêûý'i-éLÀy!Ài¢ÀÑèã2}C&!e¥:ËÑÀøÆï´Þtd=R“*­É œ:’‡–£Xu$°7@>Z…—ò"äŸ JÛ¿Œ…ðÓ°0 Étev,¼Ë [â?àÔÂ’íì»4õVe¤˜·Oâ€Ñ -FwÚ_†Ÿˆ…³CŒÖÒ7”´Ì>u"5¶«2ÜO¬Ž”Ã×e)ÔõÐH-¦®°¦hV„HŒyˆ”XfÖâ©ÐÒFÓf;+Z(åΰ‹Pƒ¡¨!+YK]s )–b²ñ³˜èìÚTZ+{¸¢¦áA’þýÝya;-9laŠ™'x×±ðÆïÉ™íå‚]Ç KÊCœÂ®tÀ£vMí²ÁÙåÎß³4]&%(º©"Ý-M3èàb!YUÄIJŒ2ÙBû‹’”Š.ò1ºÇéE"Á¼„Z43apŠ—+7¯ßÊÀm]ùtG™Á3U¡'ç0âÉÑ`|*Ø ƒöÓ¯­ÒD»ì¢"OV6‚,…§ÙÈÎŒ`ÔÛà—JP6D¡Œ9«ÓBŒi *¼ü¬t?·zÞyᶳ‚bÊ‘¬ü¿.aîÂc¹`÷cP¤™ÇOኖPb­ŒiKǧ̎ñ³ÀÈ1PìQ4X)9uq°ŸlEÅjÕõ²Iå:Tõ–0$ yÁRG*»ˆ…–Á8¸ DÖisÌæ?Ù¸¢…rÀ#R&9 þÏ!wö¥Òn f{ÕÁE9Ï8–´ÄÚ ˜Ç`ƒÃ—u®~`Á°¼ÆæGÄ‚{8ªT2²e D%­Áx€`F{!Fs¼¦ƒ+`ön*½n¶†õ ½P“¡cr6«0ÚÉc"ûÅ—Žã1Àq-¢Aõö+Ü°Åø‰V‘ʤ ”GìZÙÁÏw‰#l0 +„ÉœoJ™ê=ÅB¨Ç (åTö? tMßXÔj”ÊFPÌ î˜ ²Ú £Ž¼ÌšÔµÒá"e½¾_ò™ãx-°ŒÍÕèmtä© °@ÚC¿3µ*½t^p¢à}Ë:9ú>|½åDÀ¸EQÀàµx!ÔåO´½QëŽ 1ŽuŸØdLÀ‚ÍiW,ny!n´ÇL¯N© ×q<ÀÁºpƒ-Y± V,x6$ÃÖ ê «—4ÿrã—ê~ Ð°(˜Ù´ó!@^è4<ä8˜îÛ íîa!±™…‡ ¶syl +†; 0Ÿq‚œMRg/D…­Žè’¹Hà½Qæ±Ê”¾ÀÆÃn÷­E]¯óÔøÓƒ—&ý£µ~-Ш¶&%ò‚ìFVü@,ä©É™2ë¥á*ôny[^°ÙÐETD¹É3g$ŽdžºÙL5Ãþ>Ãs:’²[ 6þ®²Q¤¼˜áØí%èH8¿Pê‰F&íõ'Ô½)fÎ0ã 6v"’Þä0q&”6®"ƒ _m)¬íŒl±@5Cª@s"åf;Ã+EA·j³)D ¯%d¶Ê’-ÏÙqh\ëÊ({윰Cæ4èg›g£q¬ì°ey° ª÷r¯þ, :Ä<ÚµŠÅÔØÀÝñŒ›<›È EqqbXJ0h³ÅTWÀ««ßbó–:R3kßäÂ(¾ŸÊUÂèeá²ÅŽWpŸ΃›æ˜C¤j$ôßÑ(,bî¼ðˆú ÌÍ*™ÃH3t²êSI€êûؤƒµ-6,fÍw¶™þ"èLYð¥Ví:P®Öæ*|0˜%³u7­½èªÚ&[QÄ"¬Sãì…‡*hÿ/X5éÙf‹ÍE®eOœ K!/@ŸøZõz„Þ‚Sœa„žŸT§Õ-êO  Þ`aÖÂ뎄9V•&L:?ÒZhC¾®•DÛYŒDbú›ê±g@Fɾ†á¦µ¬–c šf¿óÂ#XÀ¹ŸDXÅuA^(/yãèSä] M´¿êH‘ýä¦Z áÕªÓ:E‡.‘)Æ·’dÎA›8u,6΃äÈÄ`¡ŒhMr¶slý(›½ð3±`bº¾U/úÆð +¤7ªRC[Ö–Žï¼ª(üÆ`|[áÜa½#¹"«'Ü껑¢>Sp…Ó½«(B* ð¨ LLŸrØTÄ]Òº>£Ã9<^±Þó‹Ù‰­\™k.[¾Ž¸ÞÒ÷ŽÃ1œ2µΞw^¸c/¸boxaÊßxa´Ê Î €#rþQ„nÍ]18ä… + OPð;íÙt´un¢FÏIŽnWeK’¬Ù+V…NV…Éù‘Ü¢úáX°‘sŸÔ¬½ðîx£ËCáIh<òþ[~$ ,XçÞ‚¶3N‰"’2Aà y8ÔɬZÀ\Ê9xh™ßýÊa¼Ÿ±î èHL Š”zPVõ4eZ)‰€hÀä Ò:VmR5>«ËçrÊV¶{ûã±`> T.Ÿt7eÄÇãçdü³öB¢9HÌ´ + (ò5¡JÒŒ`}$þ fÈoS‹q5¾Ä¡X?¯ÌïžèfY7ûø;S›všgÀáöÐi`ë'.†i°C\º e&ðáI‚ ÕC ŒÄnÆæýþоٱð1{᷶߅žJ›‡Êås±cá¼°cao;/8{A,ÿ¢]¢w^¸ây Å¿‡…‘ ûŸÿü®µÎ÷¼¶{-{ûPkÿ(/üƒX(8çôÓ4¥/]"‡/6Fi=z‰ÜÞùÞ_x¶}¹Gþ¿‹öµÎ¿¬EB¾É€'^–Ƶ~­'aW[ ¥Ø¡ó‘¯#ÿFû?è/—Ç@ó§O¼LáVZ?j‹r¦ß‰Ó +µ–;öö}¼ _«ØŽ'^ãý/è÷xA‹Ýa¼·okiß¼¦1ÏêZõ°ñq· oß)“ZxÝ…Ÿ7zNÓòW¿Ûðâ7£ã5ý¥ï¿Bõ^™œeØEïǵLkRìXxƒ…|ÇÂ?Ø*ýn†æŽ… ÿDó±RÕŽ… {3&¨ÌŽ… {ƒæe;v,ìÍbaç… {ÛyaÇÂÞv^ر°·v,ìmç… {ÛyaÇÂÞv^ر°·Œiÿ?,Lïa¡Ý%oç…okyÇê—ªUϽèç`¶DÅwÀšn{ÐöÎ ßÖjýZÊ4£â…NËûJÒ,t½‹ÞÎ ß÷Í^] ³¼Zõ ,Lï¦ÀuÚÛEoç…ïk¯n§ÃGí…ì=IŸ«]òv^øÆöjQ”âjág°P¼v‹½í¼ð+Ú3XØÛÎ ßÛŠèñv1RÓÇÏåXÈÃ8ü7/ÞöëÚNJŽ"KŠ>ÔÄ…éP?zêVYæ ~¢uçFóhl[ …—“ ²,óqw/ÃVÙoôce p;I”…IaÅÞ>“ÅÂìVú}ƒ…‡ßæ^ð柂Ë v…ûVó‡tî/¦ ñ/dX°5kS]Q9`Aeà…fAy/¶ÅåÃpÅÂhÜyá%,|„ØðS°päË+6žçåÀí&bÓ/ sÓL…éX-:ðB¬ƒ\ÆÀ ‰|;UyBÎ^(§Æûk®í¼ð’Žô^xØTù&{¡m[Òš9“615V ÀðÇÕÞ óÖv†oЭG¢˜×UÛkÝÎr@^(Jœ~è#»kIÊrã…ÍFßyaç\ëØΊm&;§ §hMÌ ÿ&, /tZÁ2,¡X&Ðf3¢ÖTk Qï(ìÀ uéû `AøÐf‹ §‹í¦VÒvÅ‚§«3,„€¸°å…Á÷³¸ ÏÎ ÿ/ø +†Ö¸”>è1­È•/u­JSôR“ô»°€öBÄíb€Õf/ :ÅIÁ”UžJV^X®Ø 26öìº)•]Å@è06òb<4kpyTdøåw{aç…3^ð5 ”dñ ÃHÊÏv"Ú7ƒL<¦¾ tô,F±n>`Ásè/ ¬1Y Xü–i[ïÅv“/Ĭdr8È÷Ñ_ya÷#í¼p €¹Hļ†a´g¦yI¥o@mùâ‘sÅÜ-_çG:Å‚!d¶0 +œ@ Hø5?Mï€즈áŒÛ`íéY(S¬±/‰=1ªw^°Ó÷™ò¯ÂÂOã…Læpa˜áâsœ f¾æSÙûY&“¯×‘”¬„Huఠƺ®Gp¡ûJi¶´ð재;äƒ+X¨É^€AöD êcWb¹*{&U‡ˆó#ýã¼P±›aãÜkÅû+sÿ ^È`°@¯¦"”DÍWCüY +ÆØ—®p·ba&’Á×Èú aØH„K ÉZàô…fBö0Á甬©«™ëø"µŽ +©Â.á#êGt`Rô)šBÛär [ðТOàœæ‡bá›x¡“·ˆ +÷âCݽ×GñYòå¯æ…qtòÀi8Ë"P¦ žÒ¯Ç‚)hq‡Æq·C¿5Š…7ûp]P·èÿùѱßÅ ·±­Xð廈«¼mUµmu~~‘?×^°X@)ôÑkC„Á™*”\¢ÜûRë2ÓÓ']è=MÎëÌojßÇ œûÞH|nâ°dÝl¸ß 9è©8ÊLv5I +Ó”%ñb¯b/‰%Ûž)$W9ðt°õ-Bÿˆ…A +‰^òóeÖÊñ^(ÊPT© ~ˆOø©mýâ./Ðmhå”Ò5….M­Ù3óã¨û/ á(Í«`¡Òm"ý Xx÷!ùïÊ”ø>^਌D'ð‘u𶠴+ ÕV ­¦L×5XX‰"©%QR1Â4 Ö/LÖT‰ŽÉ†Ñ# Ë+½íøN=b/p†(Ò„¤®áã'!¿Ã ^LPRø¥” ãÛ(›"Z#Ó-Žî®ðBç›n“ª ôëôqÑj1“b%#,Zõ¥ +Ÿ†…?ÖŠ 2Å÷`¡ 8åBF["¥qX(6{!”ŠÊÂ#Æ"¨QðÚ‰»@zGБŠE†&Ó2ÊÏì… ½!EÅÜä1(©Sæ=À nIM7Äé`^â3Â'ꦀoòB“ØäΫd=Ž ],30S¦I–С&‡¡ ^ 7FÏØ3έ´êê;¾»•BŽü{°¼B?*t¦ƒ¤w ‚oöB&‹e¬ÇßaF†vDTEê±í…H°0º´qJÓ´ˆìÚäbˆ¥‹÷y¡–Aü]ÈÜÚ kßµšÒ +u +JMkÄ žì3œrJnðÂõ6H/äwD¬íX¸ÞRqfþżáËHLŠ¼ªW^àG^0%N÷€¢_š öhÐA"„¬Ð–0®EVü Hh V§VS‰üdrô./X¿~ö¬ÃšgXxŸ¬·­ájlÛq?ÝäÓC¼°"›hù¥Ó +—X³Ì[¢Ä·#Ì8¨æAÁ\l‡ÙÍMmJÛÂ…Ñö ¥nÛÖ×x¼‡WB;Í@ƒÆnL&A¿ ü€TäÕh±ÐÊ^)N­5Æ°_ÒnXà`F$´®M‰6%Oˆn¯ñæ‘Ø™%0”þA{t$NÄ"FJ?óówxaÎÓ¨9ðB 0f†n:?É &á÷Ô•Ü°àc&çPØORÚ˜¨L;1 5nqÝ<àG•›‚œd—kê´?Ãß}ž&yšàÍíñÞyï¢2B­ {לÐI ß4x ¨Õ6ØÅG•¤Àù¦Uœ±cahoì|å ”ô(´µµ†ÈNx^á…QF0»Ê³¹·Ýƒ¼ ±„Xƒ#´ÜN¹Å «0/B3ùˆÍ²@1C3“;ïa^ø¾¶ba’]D+Dl©GßÑYé|<ÂyòFœTnõóD—³Ú c"ìKd² Â'‘3Ù¡AÑ`§ÍµØf$JÆì‹Á ­ÅB “ÿ´–¼@ÑkŽXЭdJõ +:’«³‹~FFæ™10eÏx*–F•®A¦Cxƒy#:f¼P‹®ï»•%äGýHl{Ÿš )Àmgº°7x!‘´þ÷§Çà+v˜! #ßô¬½ðíXpñGÐÜ¥adõ‘&Ë™-|™ÊñÀìTÇFocz` iÊÖ/u>-RØTQÖF‰âD B Ãä_Æ€f/òe ¼À4*1 ù‹”íÚ…¹ø0dN¿Ü@¢g^ªS`00L+çg¡§Dg>Õ•,L ˆ·°<Ê b›`qXH´Ê£½öU­}xXŒ0¥m;Êf¹m/ð˜Ïáìô"PؽôófU±©SËWÅܪרaßö,=˜ 7ð<ûcÂoËaxKlv9b=[in1öúÔV,äÝ::Œã…Õ°8›‚,B,u·&ŒR€YõˆJÿ_Æ\Ô"¥`ÔR' i<Œ˜à™ê'ãµ@$^ËAUáÌ/lXp¯º/à%¯ðBc':=A+E4ë.IÊ8¿ä…˜a–¤õžaðb!Ö˜¶TòÅÞDÅà›§È™EÄ)+F´Á¨·5?€rÚD@¯VŽSö˧ÅF¸M¢@ve 7Oæ¦çm®ÿ¢_a]˜©L’(Ôã ¬Ø[,(ØY‚í„ÉxÒOxAú¾Ÿy€…®ô³¸8ÚÎa©À0Tõ,çTPË ˜ZßÑëPØá½E—C%z¹Ðn¸ã´ŒÖ÷Ö^ÙÁoí°5[«» T¬<|¶ƒ¾ÙQ­î3{m¶;ËÖÌmoÛ!ÖÕº#8½Ô¥f–Ÿ…ûí^<’¿é¸å0 ™UÛýà‘ùÚ"‘ÜÆÄÒÐk/{–¶zÜ|É jÀñ‡Jˆ´*Y"••¹^4—XÑfš1Je®{¦±4ØU2CqlÐÅ0ö¶ÖUùLZŠà·ŽYÌ¿mpÀŒÍFRßaÁ¤–Î$ QÏ‘é_¢›ì¥ý+EF hüŽ. ¹à…ƒ½pÅvF^¬køR1«ŽtZ¤ªŒ8`¿Gá°®Úb ¬d«dΉ|q.òù•«¼öÚ¸ãÈ+ܽÙåzÆŠ… `;ƒY‘/ΰp¸Ô×YIÿoþ‚}£0T²”¦5ä#ãÔîÊ¡EöBQ Ûöl°Õíj/ÈR.&g>òB?yž×ÊèéÕ†:a Q‚L>Ø#™0êUé*–²m +D§š[xºN†°‰R8°Äñ]%&ô°Ø)AézƒôÎW¯3!Æb!ÏA÷/,YÛr/N•ôW,t슽ÀoÚΫM­L[·#z3¢w§¬({¥¯§KdåµIÓe©ŒŠBFÒ4Ö Š|Gßì˜Ò4e×w,‘r;"=rÂk'yšãŽáΚ­;f¼v ÚõÚá¶ϨÖ*M£øtG–†A3ýÏXøIù ˜¡Xhà™ú6Û°0ÎT°¹WÛùtke%ã,H;Øå³UÐbÖsªqÎÔ&F…JV5¾,b¼ ¨éËár+W,¸µ0ÝYÙ%µ<ÙýHvK²]0[‰8–+/Ìrt^Ž«¼`õ§Âòv¼àÁx +XIG,Ш¸Í ÷°YÉžÓô€…Uä;Â팳Ë*¯Mºä7°pÜaE~>îH7d§’}Š…øîŽyÃþ&þ/<ê?{Ë 6V°ÀÁà#ᆫÖÔ„Õq’$±™àÿeÃB&y³z{#ø2Ë|7UÁ £+ÞˆÓòÜK:]5X´1¦r‚Íw˜Ö ÕŠ…\è®Â¸a@ŠÍéýìèSE,«‰‡±Å01ÖJJtyGÖ[zÄÂÆ ®H·S• +{<‚ô¿ #ÀB¾U§½és¼ Œ‰*ZÒSíP²|ˆA^Kø9.€;@ú–ŽÌ"·£?Ý1º‘ow,©ÇÜŽtXÏH܆Å^;„ÝÉ…X°; °ƒœ‘Î5|ð×kwpfðvGfw,v‡šÖçO~~/€pM.Ù¿§"¯6^ £Ì³¼PmþMWŽËba‘ Η`"(•~¦1s¤vôíì-ÎJ +“-ˆÎ<”V°`¬MvÌå m²Ž s-¤õŽ˜¼ƒO]„.Çž‹÷­m‚‡UܾoÌ lêf£ðÿY6Ö ÈÙ%oN®ÄvD0³­·ð®üÁÐ5'´º‰äí€.[›í¯ë®ùðáÍŽåüøË+Àérµì¸qÓË óÛ[]ì8<`Tî¼p†[¢0ŠWÊlXÐ@¢ £ˆ“ͱ…Š{tÐëI¥2çáJuœ±¢(h¾º‚X`¦žá²²Ü‚Y¼8íñ/˜Óèð‚^Ÿ·ûù›Õ¾x?¸nx¤Xú[óï Æ¿ÒM,·o~ÂŽ¯¼öµ? ?Ð^ Dd,ÈÔ,’$¯ø‘zg²‚”h/€†b¿ðúT7 ö˜ÐŠ ˜Ú‰w°ðÀäl>Z´~ùјíwR7§þý8ÿ¦K¥ÈÓ¦™—?Ùv^¸ð#ù– D­~¤R/¦¤¨f×µ +ÏŸt™Âè¡£¡L$­Î`ä÷̪# NGdRè—D÷£””»›cÎhtð#½ÞÞIÝ| üÏ]¿j‘¦ +`=ô}Wí¼pœ_¨a‹ß&SÔ$ð¯/M r’tðÙt¶4 ;D¯ Ùa~xA 4f%ðwô©ö¾é2œÁ•¥ŠT –€^úRÙ€îÀøø ¡äþÏå)–?ÛRúEaÊ¿µ>R ^ÈS h¢uíLzkl¶;"?Eš ëï'ùØÿø¼¶?Œ@ÃÿŽ…Å y:b¹ðzTsŠGËÕS¡ò†ÕWv°à),¤^Ø{õŒ(Jw,ü¼`ƒEŸæžâáeL0–]‰úñÇCœªWµm‹«oN• Ð.= Îêg+û¾‰±TŽoã5æ¬&ºM“ÖUÞkѨÉÂÆ–ÐM½$Ñ´öq¹Ÿa¢Éso5)3ú£`HÓhç…S^0Eð´ÖØ4÷5£Ëû†Þµc½ù€… +ßàŠƒ‰…+f¶ÚÆÜÎr‹â«mͬ6ÜMˆD/qI›žS6Wö°ã}wÉ.i/4iYÌì9ÌÍ;ÿQ,Ì^3§?=7ÕtÏLÏœs& wt°aa½X—™ +@1S +ØÈ3g,Q€«ºuFbÁc¦e”XW;Ã*U©ML´×6-cŸCý:×ö7}ª@×_äSíiúHƒG¸ÄÂøع¹w•²5áìÝžv”Kú?7ZmXH­¸Î±Äåk ƒD¯©ÙŠ…º¹¯×9ÂÄ)†Àh –c°,î+•+º`*±c”Ìv«Íu°Tnš—¾¿â‹›.”–å$‚‰©€:Šzy ®|yyé£>Á/uX ïÝ;aìk‹(F-ËÞ›àö6Þm*”|^y&¬¸ à߶ Ëx–ɉÚ9ÖÖÃìÇî_ÛeBÿ ûÛnšõ_Ü*ï ÿŸ*ÝÚç=Ì<ÍQÛ®’N.C(ËÍz $ ¤–IÁ[ðБÇG­ëÈ„pTŸ­ß®›R´¨ÕÌëÀüSøq 7ªÞ5ɘdðª˜Dz 3ã|*ólçZ +¡;P‹ b6‘‚ɤÎy?ܯr~õÊ`ùøA` û„ˆ0 ï^dÅûX Æé ûÇFðyèÜŸ.ü,0ä  + v•JÝxšõž¯Ë‰¹n*é§ÄÚ 5 ù= EŒ@±¬Oz6ÅòCªè5K"&:Á +*ꌥÌÆ‚UVT¦¹Q@ã¤ÃãÇ°0êÔ¸bÒÄPÌ®´Ó ß°pÿÞñ—c¡þŒ¤þ ëLG¸_óø÷ý /ÌÍÔ¬ç‰pÚªè+ç=VíJ3V™ÅH“®+’x S`,X{¡°ë—r QóÇÈÒ¸¼¢#aþV*1ã1Dåö0Íù/x¶0–—@ªRvjõ1,(‚çG>¨Çøt³>òŸÀ‚)Û_"|Òý¡x$,Š$צû™àétÄýR,زš}j‹ìP9úY&},D-*‡,Ðég• BôúUš$BŠÓ›ŠLÍŒ5G-–'±cI­ mÄ\¶téÃX¨¸yƒ³Ið|HFT”‹î.‡þ(·<©f}(NÕ–æÚšø1|/ÈÐ¥£”G CA ì„æ„P7Â;žÅĶBÒ9/Ø¡3-äNÆ'°a¤ÅB$žä…qÅBj¿…vXøc¼ð?´ü#¹%×i&˜¸L,êä'cáMzˆý,^¸ƒ1oÓ`ž²ËÓAÖ lèÓ•†Ö†Z!êŽÊñõ +qé5ïá}µv ™„GèR“Çu¤¸Æ‚ŸfëÆŸM>Ž…xl©8 º'Ðñ¸ŸM`ÎTÍoÁ‚uÎ5òzéªÞÎ ·ÓÅù7¬:ørœjê½ÉîRùÛY;õEÇ(Ë=é=^°‡úŒŒÇüEq^„íZA6»ÍœL+{c‘Ñi~ צ€ÃÂáÜ%†êìr¿ ƒX»p÷`ÄɃ,(N±`%¿ñí֥Ě¡îfÃÃ,,LáÍIX|ú“SÏ‹Ã×b0"ÿMŸØlðùÐÒhŽ³ÊÓ ‡=Kž†~•Åst“òhŠý¬ÊÊ`yÕ¤ùž%¼/_öc¶óÇ°à­òŸÉ¬dÄü",ÄÚÇðnWÁ™B„Ø–ŽqXð€:Bœ_ÏLÄ$Fí)\¨—LöÀÁLA%ƒäµÙõÜJskË"7Ä»R„ öM©ïÌkØ]y+Ö]Yº¼_VÚQÿ’Ò(è¶m,›¢/â…ÿ J?Š…¹v—àÕæ~@®Ep·Ò,àbqj•î^Æq˜Ù)ÎQØ"ñ(pQ®TAœ#e2h>Ÿ^ŸkKièdY’žñÒ«IßÖãz´0Úä ûC~òy8ãœäyjÀÕ$È1¾9˜Œ-!‘ÞP‰?y£·¤'…~îv}ÄŸÅÂõë>……£þv6©ô°À3†ë(x“8K—¹€ëŒ¢¾ †ªŸ¾.*<·Z“õÛ©Úˆñ+žüõx$šmr:d¿IϱpRòAù)ˆ<·¹ßòB>½-Ñ> †óùμBœ¯zù!²ËIJ}nž•Ç凣,º7ÈÓW±ù±Àëð™{ÿ”ù… ×™F,ˆ… «ªå~=ö¼“ókLŽòz>ÄŸ6stµ0‰]ÿáœN®®_ö/c¡ªa꼞ömP³/©ÉtIçú\‹÷†Ã€‹;XHÄ˼PÊba‘¿ ‰ukWº8ð‚XH!XÔáDŽÂQkÒ ÀQË4£¸ˆ"]ßwI!†Å v=6§¾¤Ã©¼ß‚ŽóX@)à '3Ú‡í2Î?€N â<¼™Q;á6I¡Âõ8\2 `S(Ÿsç@š'+î·EŒv"æf)ýæy,dÖžþ2b=̆ÆÙæXùXpI:‰æ "T®¼ SÃAYµ¶ó²ÍtêáB?:Ããìò»Sc¾ i;tÃ+1v¹@꟎ð—¾Ö­rUt lNÏy!jV;Åâi¯b=Ôbט@_í¸É}m0_¡ÆÈíÂüA©ÉbT§I)ÀÂq‘7Sd< q: )Ù=c¯;=®öø"8ÁtáZ³mvê`Á‡ñ®˜™‚3ü‹W)=ñ# ºÁ9J4EêKYè +¼ˆ _„›¹õ’ŠÄæŽòNoó‚XÒXÐA~Î Çã†"2Ù ³<:¶ó–'ˆ%\Z&–fd¬)%f4lM[BPJíè Ê’'”azôKÉcÍšPb†äö+.ámÀÒa‰È‡±ÀáÖE/cOØå._á… èKÆÕø×Ø ðz.Þ I„8ò ‘T“XÍ,Ä¿£‘#f;½ðê¼óIˆjqÁÒ3Õ_¶^)NHã $ &Añ И"ꈺ§«éÁMƒIT¨ªí¤ !š ­ŒpcRZ{Áàƒ²À-Ò’»ÛbtÛŠ™ð^ +tÉ bfÚRŸ±(þ¶@ñ«ö‚õ–)õ{lçdTŠ~3ŽSÙßÖŸ§ëÚwQÚ©«{4#Á}S_‚é@†ÜYø“°pTèEJM{ê-:ëŽç4<1ŽXsÍâ81qÆ ·˜…,éËsm×'˜» &L¢±u +3Ѓrg;c=ö^j W¿‡ª—àÃõVEßÃB"LˆÇqÙ>‹_r›i‡«Û¿Ž{ߵЧú,¼’y¢*J¿ìâÚG§ö"caG9b•©HPÁ)/íò »âå¹6\«G`»Ž@ÏŒ+?V?ˆbÁ†b 8· G×ò¢&”4¼çG* zx v +ë뾌…†ö¬Eâv,¼Œ„‚Ï/„`DÉBÊ $ˆµ],÷:8 Ú‡™¸–žñÂ-,ˆ` fõ#³ñ‚‡õÁ„@´…©Nƒ>Ñ 8Þ'`C¿£#ÙeÄ—5lú^(^æ,ec—7éw,|¬M*Ѥ¯«Hoç +À >b¡åitd‰S‰¥y~DÉ^8a°ˆréžÄB_ ýÓ Ö^¨dÞ'8¡F‘˜Õ¶Yg $”Ó†Œ—lÑ^¸;¿J¿–{Ö^ˆlÎëöBªƒ¾ÉyUÐv,|d~áù¹¶7Y<§­?kY.;ñØÎý4'3ÏçöÂÑ’HhšFœsJ£üÙ‰g»¦í–BÞ±ÂäЃìŒ2œA=-5É|\÷¸’I#jÃJ‹…P³&‘™ ôp;¶)Ð$M´êA÷coÝÁSöª‰ +é/‚u‚E;þ‡yç7Y£ZqâcbÍNCó¢SÝŠÉÓhìËü…Ì”-a6Œc?øá«ÉÿVÙçÁdC,¢I‚rê{凩39i‚.èsEžC(Z¤!^ dÔÑ­\s¿™AȘ Þ³Xx£—òÚ¸»ß±ð`áZ¡ù“õêO°@qîLŠt¹ÀBj÷ãů]3ÀÁÓ_- +“º¹Ùƒž“`äÂô#(_fHM"S)¦CI)ÄUÈÃÊ®‰5 +5º2ª–.n®´Óé:&¨Ú%dËo{ •ßŸÃèi,C&X‚UŸ„ðw,|¬MŠ0Ò|êZ$énÌK|¬ñ£ObW"!lYOsÑ¥,ͨ³´×‹ajiVûê“™Õó òÜ:fíç™ “ñl˨ªÑ,Ý-Ë“&`ÀÒ4<—¿Pë:dŒ§¢‰õW=…´ÏNzF±xXѺcáÕö¡šóÀû,¤ÞÐV~ŠC{¥©]r$¦é^dc#âJYTz6ÜŸ0Û’R"ìšy¤³Ë +û¸~Øpo9È^adÝ°€MCŸ´”ÈÍ, TM‡±âz—\—¦hw,|¬5ÿ¦¯Ç‚›_°!ÑžÌ{]×µƒô"éùZÕ5ÑsesšV‰ .|ºw?mæauo™àq­6ƒBÕ>‡[D•eTn0z †ÏÂã)9L»½ð XПŒï‡èH 1b¡‘ù(ÆìðsÙ"Lã©á÷¶81€EQ#b‹Ô¼;Æ]u†å=,ÔÈ Õ4ŸÌkS˜v@ £®x ¨ÂùÂ`Ù5ïXØu¤»X°ÊP¢#;qQ›ì™ Ï–¦â‘iÁÞm¤_ µêHµ Ë#ì¼óÝåãñº³ŒƒšÛŸŸâ<—ÉŠ‚ÞÂè,€àeˆ¢©ô¸cáCm~-áWØÎ Çl¢#»Ð/QÆñB`Ë¿ ×fsé DSÌã,ô"´dkÕmGeŠœßô#µhw{zH³­8ô£¼À–qL¨á⥼6KzJ¥X+|Øsao~Õ5öTÚLÍóíX¸Ë ËFV´ S"?²Z0)Í;ó ¯cá¼½æS}êÞ;îaáþª7éÛvsß»g^WƼÁ{‡ÞŽÁð„Íç|¹än½ù¦Ù±ðGüH£Rõ?Rz óqwór\1ê$w¤ôUssÑ®YéooÒƒŒÏÓù™óÛg¹_`^ë`D®Žð«-}>èôA,xÓG±zÅŽ…Ïœ_¸7×uÇølhB1YƒFóXêÓªçÙ¤ÃÙ™m×`¸¬Ëúæ}°®ï–Nb;ӮѕçWLeÓ4¤_ÆáÿÑ«ÿgÌv»cáÅö^ í¯¤êg–òËza¢;®%E¯”P +ó;5ŠlÊ[»g©@ Äá±ÝíĆ«kC‹âÚŸ^91MTy‘RZxJyÅã÷ïß{ÇÂ]^x ZXØ4¿V;OdÛ@} ÁCXØV´z ˜ð–ÿ0,`øæ%1Z\¦WÃx¼¬tñÞ½w,Üåý4ljç:’ýªî?È »Z ŒÅÂípŽÿ &Ö/®'Öê+’:ËgêĺÞu¤±€Šwó4p)„üFMÕÑá#¼ 5 XRæga×Þk'¦jþ¨½ðÞ½w,ÜæÔ(Ÿ¦{ËïÜÀ‚Êo×v²ù!^Ð:ÉÆ­ئÿ &zqf¯¸ºušâ½w,Üëÿ»nú[Xù»Å XPû5^8­«„é¡bA'ùó#ýàö-X8)ƒð»°pw²ê ¬«OjéM^p «`dkE±Keì„dèÅêôw° úþC=}¿ÎöÞ¾ “xDI¤åÝ×zß…ôA,´&šÔIiì^`U«ÞÔ'X€3]»¼Õ /È9?YªG,÷° (MÛŠK¦»ðÿXXúù#³{kZ*âÿÁbˆÃh-' NUÑ /(Nsï õ(þI¯Ík±0¥'uTA »ƒ`üX’L¥;~VÉâîZô«ÒÄWÝÉV°i-¶b6Ü~.ÜÑh÷ˆÐŠæNüʶtý8NécXHir‚…^aL󔜹9Ou¤ªµ-¸Ï SšFädm¶{XÈÓ|z —µÂòfÂNÿÌßù*(ÿj^¨ç¨™¨%FnŠJØÊ5¼ƒc„lXˆqb$@ˆŽ¯$.©bkã”LÉŒÀÀÇÆðÁäëÕÝ'æÚ€„Ý*‰MízÂ1Çe‘F R¾CzS n×óMôèØÊÕ)e„•¦0ù¼&n…SQË\ÛK1VË §µæ“XÀÈÓãß;ó Ï̵Ýò©¾©³í°™¨u⎽€*øVÂ’µøígj±PУîrÄ#XÁÇ5;bŠ"òZ{Ëha(X0vÀ$ÀŸpX0êy’¬äÎ^`µ†¸†^ö½å½ˆ…:Z.xád ’ø:hx¶ª–ôÖ¼³Á@—Óã¼ÿKXÄU^¨2 †AÙ,À ÐÙ9Ö–~癢¢2¼Æ•ßAgQ³¡}z?µG¨ù1,ØmXmm f"R +bî8H4Úpc‹…7q‘H“’ÉÉ$6åÕbÁjz]0ìxA¾„Œ¾~Ë '¥èñŠ×°Àã·K—_çeãíÅBõx Æ%ŠâòÓÁR\|úe¼p]GR£éu ‚M|†zŠJZ€\¥Ð¡é¥ŸIßdºKC݃êN¹ÐCzJz¿ Ï`yA"Â)ŽÕÞî¼ l!7Ë ³) S{LÖ:( ¶Jd+U}}ãóäyóÓóÎ(~oyV§ °=‚…ôz<[dy 7=ª·°¥Tm‡šfdLÙ*ó [³q6³²”†¶Œ»0 ¯àSŒow°­Qƒñ”» +­Ý]ñkxÁba1­öL(gO̶TÁUyu@%|ÕJP +:©Ý¢Õ¨÷‡’b!&¯*žã…NåDyÒ — FÝò +«y¶©$p(H!ðBîŠ}Î~]ØU&ElÜ·K#Êoê°çc0¤Ÿ/g~#•§=ú€ìˆ‚¡ì*Í$¦áC¼Ðåq,ô7+-¥^–ùÉ%ÖeP2$lw¿í‹šÍif\)§£Ýœã ¤b;1ÐXØýB×­ŒÿD^àW±Ð›‘¹Z±3H|Ág_Và"„º _zˆ+ƒ¬Ò±è0Ð$yñ—¼À‰<]Ù˪“šæ •Ð‹¥né(O(„$ÈÿHc©›@WK‹7W3®$<`É›oÂÂÃ1‡a»u©6'¼@–9®OœLCt6×6ðÕ”ßåùfe¶° úøNºöe †Å‚¯Iœ( £Ñ$sM¢7»oBï+‰;Í’rZ´ˆ›^ +B/K8Hð>$ èÑ`eØÌðʼn;Â_Å X½Ã—ˆ…Æ´´ùÖ P¬Éƒ€…ÆMýrÐÛÉÌÖ€òÁ‚h°è8@(éRd@¥|Фƒ›ŒnR¦=®$H‘b¥gÉ_Ø» ºÂ…†ácñã° ²ª‚q6˜×ùãÓùq¶ºš ?ÅE€?ù=^õ1ìû½¼6fŸ¥54-’K,t8êÉC`żÌ`1Ð °Ï]@¨AZ"BRØUbšHS|ô¼IÀòBÎ=ã)~fàÓ^8`aJtëQÒ\ˆx!Ñ V+rév=lØ…¼b7¤1‘óûX("^Dź00Å´ì~ÒsÔ¾pù`›ŽK MSØbž+LEöðÙÃ÷VÌ‘;ó‹'O±@iú*UtP©nÇ©öoâT¥$óKÛùdÞùd¹Â÷òÚ·K&æïU¸‹…¹u cˆ=0ÀV ,F€hsëi³•¸—t$üä âxÁ*Óˆ…ù§bá^˜z,Ç*zk/Ä:˜Q¹ IŽó ¨ï〬Q«Ïý-Á£13p%ÊzóS[Ú]÷X FK¯¸ï¯&šÙë]ÃB0!Çô|ÞyéÎŒï»Xx¬¨ÓE Ʀ#…¥ùí]J7ÎHš/`j%àƒ‚V» ®‹¶eëu¿Ú ,Æ«p‹…è×òÂ\é0¾w_¡‰Ï“ÊPY§¥ög%—”Ç´úDûi/óW±Æ:“bú±Xxb~á-nñºøì5,,Ë|ÚÞÆ©žÈ~}æfŽ¢kXXáQû+¨ijKM^04û×pô&P©tÕ@áµ¼°²åïã…º3}³€Ñp0:DM)d&B³¤lc{Tw5;d°(Ê{Ñ£÷ry‚¬üÁÑ’OÄ`<È 2Ž–ÛX¸ˆÁ8S¥ÃY>ÐG±'`²kX°l +ú+GVÚ§RXFX±€nnøòSl‡~œ¡]à» 6µÞñ‚Ä«óûxtrTË9¨ô¨ÖÓf*Šœ)79N6ó¦±ßx¶ª;–á”oP‹É{w®òŸ¨ƒñ/°€.w°p7N5?¦/ ¢õQ,Üš_ðõª³f.v­³¡Æa¯±ã»Ó‘2[³:Ž¬Í™r´F êu°Ù ®ý6^¸Þˆ2¶Üþe£Ûº´¢>Ò#¼ «9ZžÂÂYþÂÉtÃÂZc,_ßN-ÄÝßh/´H”á<,Vµˆ1ÕHK\·ä0¿ N°ð«xᆃÞÀm:föø¿‡ùyX$óŽ©k'Xèã…´&vÉw‚…ê+x~Õ¤–špÔ„|ª:ldZ¦HxPmR;ü·ZÞ_äÓø¾Çœ—Èקî¢"˜þ,PÏ ã;1iÒwk‹ó·ÓºÛža*¿Œ›ô4‰3?œÙÇw&æêp•9=9©ëËtn·_ºýJÁaŸÿ9Xཋ‰…~P.uôèG²Óèv…û t¨Åÿ‹Ð™÷yÁ¹=ÃU_ò^ýF¿¼Îö=ÁÊéÖÒ+Ë'Ú•læã™ù½•¢Ãaç'QÌ=¿ùñ†-eâÖ´½ÄÂ*Ëžï‡ö­Ó>Ù·˜Æ.p¿)ýÒ‡s™á.Ú¹å&ö"8$=^…†Añ+ya«W±†bãŠs n)Ó-"±(þ,üáÕèÕŒ§Ýà…Z7&f6§2¯m¦ñóªFE¯Eg<"˜‡3’îXøk‘üËX¸5ïŒK™JŠ>&•%’ø Ôƒ/´5J¡ÂIDÉc¶êè_ÁÒ ÿ/¬XðädÒ! +qƤ&¸^»)p‰kt¯rÖžÓÿ~/ò²Ì²é¯‚á¢úâÎ "éE’e ·½ à—)³Á¨á†»øt¿®výO`á½ù…ßݦùM„ãÎ '¼`B¡egzm×”™0(•Š/à즕œTÿ +Þ[—ç7·<âMJâ],¤“¡ô >ŒR°¿b‰P·L¯Û`?FÏ—¨„‹^¯5z-*¹y*v‡Ÿ=Ì<¿Ã N DA¯ƒN¤é’¦ÔåòxÁòA'þ!,üe^ÈŸÌý}£\èf]-ĒKvD¥n½,aÏŸÖêO/³Ðˆ%¿¨5JKZËNnÔE¦É5iŽë‰6‰‰Õ^¨fs6!¡†‹2Æ°ó¬.0f;8Ú #Ú °ýS¼ðW±ðdŒ†-†hmPëÖÌ0pŽÚÒJ WIu]ú~æ[áŠà“$eötïFNô¢Ö(Ö.³rqcåµäj:ir”Ù±6…MÕ¾Á ™.¡½Ivi‚ Sß;ÑeÃ6,dÆ“ÝÒb~åa¡øÄ)™Ï)ÍÐüaéI,ôH`—ÉV,ÔÌ&¾µš™EŸgNSyX8ª8ÎVÌ(Þl²?¹F3¸N_ª¶Ž³úD&Q'gó“úD%Î^L“ÜL_eê6/ðZËŠx6ƒ²:.ú[iÙ» KSå ?Hö©XÖÝ¥íéG[ZBÔpéÛ]à zD`¢ÉÙ]z~vÈC- +Ã$™— €ÆÃ5˜€±ô À¨3m)}aÑç9·±ôË×M]ŠL`+šr,LãŠ%C‡µCMë×¢Na°h=™h¨‡pL z“&sgSLˆdÓûL pݱ5ƒ¯D OœÃñkÝÃ5Í$$ápyœ£¶–ÑÔù2+[S¶=Nž%Z¨ÝžwæÍl×,Y<ËQ¼™ìqs³U ³?^˯| ¥{Tÿ‰ OZÌ¡xûuPÍó¤h{}¾â|"Éã÷)ÞIþÅÕ ï»êQ,4¶DO…Ã`ß©Áò‚êÇkie (= +†å…SÖÕoʽÞʘŠ[F(KZ]ÁXKâÑÎXõ±Pxtà(Q:ˆd :¤JfèЄÃ}9bfQÖi0[T gu±€AŽÇ¥Ü2Yfr £ô)#q—Å +¥:i$HÖ@à +$$ `è³ÕŸŽGú /ý;XvpÏŸ«P9i—‰ž¼½|ÁŽÙ@ûð†#!cû¼ó³1¨©€ÍØÁC²òB_ÂÖlLD± á,åxÆ X03a|ëÀLO0¾Õ742”ŒÊTXŽµvÆÊ“Í„X€ÿáÅ‘*dð0 ŽW‚£±Š#¨›_8œ±É0[—hÐç;À$>€jÔMVqëëïÞÊö”¦WEé/pô‚Ý’Ø+ù:OQb!Íà<[X×(£i§*¼F¨*ßb!t홹SX}Û÷z+㉫–Zímª8ðênÙ°€¾ŠÁö±êQÏ„+fV²5 +)!Â+M=Œp¹ÎŸJ3%pzjf"+¾cá¹yçžY›Ñ“y$f²òˆwå'È u–UUl¢išøf/€ô'X4EZŽ„ +€ÕΆ(–ˆ Eã{$=“T$ “9Ãèžås/PX°+a ¹’؈œþ‚M%Št i¦ÇÀªÚ²1‰1>–r[l®#X®Ñàô1¿Š™õ‚]®«îÁÕg¢µÏrâVm’G°ÐàÁÓ„’€ë,D-UúaÒUR`ZÄ°YÍ á‡•]s­V.Ðc1kðB +f­€ŠñÊñjzŠ•Ùá|¿L.b)@³,ÀR|בžÃÂHœÿD¥2/Œ Ž¹ˆ6{¡Ò6ÍÓòÆcEÆo¡ŽÖJHXP«—¤š3–S$§JòuZ¨¦Âúq€,£ˆ‡ ®†Xè:ÃIi±à3ç‚âÖ þ b€)P#ÜÞ +­‡Ø‚ç†@F +"0nðè[¾ß^®2ODdú|®¹ŠO]TO`+ À¿$z’1–ÕàÌéHXeC1,>åa‘ûV”œ@°Ó™•xW!(ŒÁŠ…Ìд×ÓdÍybjxø‡]‘-k|Â~•l¦¥­ k²&{8†$ò‚8žÿ,žˆÁ-/T }…²hy¡ $&0ýHMY&ÑÆ ³LÚ ŽÑ©ì¢yvµ7BÝz84[^Êq¼P:,dxüœgºò( ÎêHåäx!±®&تJëæwX(Pà±úL){`_„8Ȧ©ÃqS ¤~—ZM·¾Xëh;¯Œ¹`é¬À^sQÕc¾:†üÓâ8|%k#TöÞpŸ¦@÷‡{ʵg1 +ˆ³Â/•hÚÁˆÕÊŠ¢,à(-m®„+hØ®ˆJ‚Er„ÉVX‡v„ãÌ–=…¿ƒ1§o¼Øw°0n±P1æðB êµ’«~$‹`̳*>t»].@ÙY³‹º_¡Cã?ö®±qR…"Õ»¨Jþÿ—‡e§lv/mÓÖºbG݆(„,XNdýx!€P_. é„zù$õ†©,ƒàÔ t5È„"³2o©ã¥D¤ʨô;öneGB\ôÂ@j  †õ&Ô~«RŽè¬œµÝƒáîvkÉ)g,¬aŒLn»hœM6äBTÏ× dÃèYÆÐùɾÃÏÈ®¾³âÜ'0Tžn/2 À×$xYG~òùd¦kÁ—áÊNîà@`«½@ÿ(ö©/!*ÂB|Eý?1U:ÁfÓÌNAJF¶™|µ¸›_Øéî2¨‡z¡GT¸&õ÷ ÍE^i#Aú¾„ÀЧªNèŠÀÔNeJï/€P>»ý¦îæ*Å‹lëºõníñ»=†3Oö¥Y=î’ô’e¾—”»Ìîz!K¢­vÜ@ ã7’1HÐM²•.ö8ÍŸ¹„¨ èÿxüÏ\Ûh¢h‰•HíZµžŒ,H<…ÔžƒXèµ^hPOú ] CØAî_ôáx—¤HèT;‰d ¸SÐä ó7r·Mm¼^Ȍّç‘XýÌ<}ô´ú8 '©°®L°ôG,ÈÏÁB€y¼?û Á=ì8Ä<]®ä!57_.T“z~¹O„…d™Æô°·{Þ7È>Ú·m#ÂÛÑ>~æ+ÆôÈ:a«jÏdņ0‘¶˜ªÙxÙØVz‚…j¸NSÓÆž§í0»æši£cºŽ:Ösm-íÚ—¤£nD¤,œžŸûþck<«LKýlß™N,¬EùÛ´ƒèüÑÜæÿoÐB¯0ydç ~è/€´Ä¥†RŽv?Æ‚<0ÍDzaÔ\ŠÿEl¤)eíâ’ ¢$t}Wäæ×íX¹¬ÛɸOhYúbYÝk°€*!M>xç~GC±äOÎÜ\/·ÉãSôÂmÞùXãÉûÄü÷±PjðÍËÉV©o/XèX/ÀFòz!±+s~,üÅ 0;‚Ÿ\§§s$.5ýtðzÇoª›^øjXPörÛ Ív ½iÓÐô™A¡däv¹FæN/ä&‰¯6Rà¤Ú/GZþ6:¯ :¨Ç#l¨|êuš—‰r‘ ¤{À‹s„™‚#˪ VQÑ„…«›?áDlaHCJÑÓ>ÛÝ)9ä3ÁãìL.ɓ˪ç/Û.„èoXøƒ¿àÙ£Ì$ÙƒùP©€Î`%2V/Â% †îÈÙÖf%#Î'èÁzi„ü"XhË¿Œ…Ê·ú‚Wj­QFQ õºäIÚ¸X“oÈÉŽ™FN6r¸3³Áœ¢Ð EûÕ†â#2-4çá”ætG/Ò¡á´HoVòªfþÜyç4'Y}»d’j—$÷Iz{öŠ·e¼bÍY_TÙVǾ÷'\âW'ÝXºb¥ÿý?‰ÄÇ`á¯.Ì!i¯ÌÜ¡m}‚‡Þ\ ¾¿•妡ࢋÈ=ŸM±Û¤ÌV„íü šXŠº¦W‘€*p5ZÏšå`£§kb¶Ä 9¼¼aáÌÁÖ7Ï<+Œk4®ƒáÑ´ç_b‹¢*E·ÿ0ËôÝÞyÚ:„Ú3ú{Ù +¿!*Žª%\¶ÿ·<ób›ü¹±AÌ$ªÁSºèƒ ÙyŠ ç|›E1йKÚŸ‚Óû/fqoÃá7ìë[_mýNXø*ËÇô.œ¼ÏX¨™ÿþlõB­j¿xió6’Ç“Ë«ˆu-DmŽÊ8¤’ ¬*¶—ÌoÝŽà$Qmz¤#ø0k –õ¼ÚÒ‰>;2Ë@úü†#]ès¡Ïðþ†ì²!õ D涤8ÕN`‰ÎisÃÝ5’3ÆËBÚP‚ºj;ŠÈøÛïºèT— ÁyÿÅ£ þâ­™[u¹8P7,¼ ½«Š3-¯Xð¤Ú}nWò›¸LÂmRp7vEQ°@6"_ ±¿†‘R”ŠŽgÔmédL§ääÁ„ÔNoó<îÀú:º íõK¢ç‰ÒTþ¶Œ˜±POÃåiO,Ù‡(åvnÈ~·!©Š cÁUqxÉöGìiQA²IäÏ tQ…âIu·§GQñDHD{°ÈÇþÜOn`,Ðý32í{Ô³—u_hÑò=ßåèÓ²[ðEl“œ þXú (Ð4ÆÊÀ—0hô›Ö½ŒZšÅÈ +½YOÂbC{ñ°ckä<>‘!›!A¤ñ¶a¡7tä9UÒd§’?ØoP»]p¦Î;ûf|ÀBèjæB\–»oD´à˜øVHÈÔuƒ{z´ÒtnÈqnÜŽä.þTËå² iÆü<Õeƒ¹ÛPó)àm87DkaGSH¿aÅ\£»·»òO{ÏV>i#eÆŒ‚n¶±ÝtMËÞݡ多éLR§ÿ(Ü1t Œõ ¬I·&˜r»™r»_² 7­ÉѪ„¾µéf²$J.ŸžG"n‘Û#…»É8å»y¿TXÀ‚¹¿¡¹·á]°Ð ÓÖu#.œôW,ÐãRrᔆ̨ˆLÝ‚@0 Í¦AûZ·‰þ_ÅÂ+—Í|Þ[…¤E‰#}ÁIHŸTUØÉ.ézDŸ‹:7ôOl(h¿ý–V”çAΚèKr1œ—Eó¥úþœj{¼!¡Ï©>Ͻ±›äÏ}ÙÀG¿Ùð¸_Û«–@“¡ÚÚn?b\ë «[Y+oäîq11[¿Ê%5"ú‚~ÅÇÂú‰Xð^ººúìü©¼ß~ñßi÷3ÅŽ¿Ûp=B§`²÷» wç¾ìp^´~´á—»¹wî§ïæzª_6\}«¿ ¹ÅCÞÇÂÙ)²ÑÆÇ2J_º 4+è24=ˆ©Þ- ½ñCÿ2’”í¿‡…>¤Mé_nb"'²Q ù9Yi !Þ;ªϾÍfÏî˜wã¤ûFZ÷ ú>²•É×{:ËöÊ“w§3·Ãí²’61¥ºýaN/»3Ã0¼0–ѯß +®˜Å‡ · á?N¢‹Éú4Ri:#ÑÁýu§:þW°Ð˜² '£H/Y– " +!QÝy,:¤UZíÓYþÊ·¤ø£sX™­¦YÍ–¥·¤Ú+Ož÷}IÓâG­<äÆL³à¢¢ŒãH´Ë ûeGÁ7‚KÆÏ@à‰…5|¨“ªy~kŽn«‹tñ`!´~š“° ä¹[ðVΚ±Ðñª]aÕ=, “RÓ=,H¸Öyħó…¹ç8?ÒÃxØ©A½Pó”ÒÊùìÇ(XNõŽgî}çX½´@rb!å÷oOh¼à,õG6H¦OÄ‹Ñ’§ÿÏ`bÀ‚è\ò5(…bñ\:¨f¸‡…šÃIÝ~ßFH/€Šµ®~ê/ Éjå< Í†w>„W)‰)®q¤ÀNîžïüBÛøÄÂ2üR{"”àéF4ëSÓŠý=f› ¾aá\dé¾ÄòA5ž(sà/€¥X!ÁúªÒ)jä\õ‚÷¨vQ3Ïi#¥W½Ð8аõÆ×P ˜¡›ÞÉ:BT¢$×䊅ááÉ`ϵó9¿Ð½‚ƒ8ðò½ÁO\ì^–’|–èI¶%Ÿr û»Ñ/øëišŸ‹…u’;f¢NÂ\Ê8{/V‚/´º'Ïvcdr´ê£Sü’}ßZ¹LÄ€IÑŸ «°×Y=·sôöyÆ âß#Ž´“K@f{+ÝjD¶Ø€•Œ—Èlµ”Ùló«^:óŠ.CÚŠ+¢AØN³m3y:ÍÑe ¦n’|Q.Èè¼b¡’vjÁÕíõ¤o3;{û+ú4œþÂ8ùå%òÑžêÞN÷ýÞZÅ×µ¿œúWùõé™Þ_XIÅw&~8ËÐ&U+) ˆZÖ­Õydö…ÆDô e4Y-hô[î:›¤Âîë·ÇÂïy¶U]‘¹URœ"Rîâš=¶ûmûî‡ôBï;ä@ŠÇÔý`”Ð9YCê(߇ö*Š#®N½ÀÜA~,ü„Åû hFZ¡“V½mÛAÕÀU+‹dG> ۇܴÅT +i²–-Át"[* ,Ày§±1ùþÂx¶ëFZmçÊg)EÞŽät´Þ¬áE/ÌW,@/@ðIÊqH¬O,T˜R½¶vT¨q ¯{Y;ǧ^È)ßޜ솅—ú ¿ÉÜ—Všƒ_θ{Î ±?‚2üÚ’kâ iìö x™VÑðþÀ³Û.IåÃ*R7׋c×À¨y‘•çÙ¾è¦r€”g`–<1T ’º:éìXŒÓ\öš§%‹/zçmßÞ—ú à÷cΪ³»Æ½à°ÖOÌ#6¢ÒÝZÑ«³}KÇägU}@vÂOÐ àÙò+2Ÿðã#`èhdÿ6÷¼@½ý^@q_rú öE¨!•Šò«<X´`IÚåxÝÛ«ônXx©¿Àq-ÙÎÂÆq¤qO9s!U)mÂ]™\?Ƀg½]°Àí}ó#ôÂx¶G½¥#™ƒ­ +òŸ;¹®r‰õ^ôº#%oùÀ,ˆ½ÊLê¥|t¥m"MXhB²?»"!"÷ã8Ÿxr ä/™ï¼ Aü†…÷FÌL”>Ä—Ù‹^à6£©ÖA±í@CfÈeC1æÍMŒ…‚«[B}1¡¿¹¿ð[žm²ðÍB?9&ݨJ'q !ÙŠ+ božíÖ.ô8¤#ïàæ6f& iìDÎY£ÒÇ ÙÜÚÏ,¿’NŽNjg‚ø í/äÙka‡(¬Œ½^.4I:“š°aŠ}Z¤ƒ Ð.;3YJøÊ ÜlVn=a%0Múݱð'ží* j¦Õ®_‰8{ïLâÃ_ñ…g»v(J‰ýÞ±ª×8VÈ,XGDþ™§Yß 9ÆwdÞE#Ax‚³þ¬®M‘^NÅ\¶OYæÙÄÂSP?ßvÑ!ºMÖQ‰N•*+slXÃæðzA%èYɽ+`&õ ßÐ_x$¦Éų°~…MwO=Ýó÷ c!ÓR¡Pш:çÑH°m'Fkôécr 6Ÿ-,³Ìß°ðýü…,ÉET$»ñ¶½û—rÏ€…õ)Å5;ÛEy#9?Û׳€ ¼‘ÞÐs+Ú˜9Â]îGþA¯È,ˆK:{‚‹Ñ¾‡× 8¾>Iÿ<ìèV´åkÝf‚kž‚XONÉKLÂ%‰“Y (j_@-Ü°ðbaÒ²Óº¢×Í)ÙƒÕ¾]"êMr×YÙá³-¹ÒêYK…V)]*õr¡#Ø­\ÌäF”Àž…pgBNa̲“¼L)à +ýì»w¤ƒâçv¼üT,pŠÐ ÕÊ¥õjʸ.|EzÎå\ÄÞu)ꬊVM7á[ú “í]ObŠæ ¹ÙÔi#a¨[·“\7Zõ&åìlzÉ%íOccäPÓFô +:õCjE³Òíäæ…üÓ) +x »p`ƒBÚéø%-IS, u”d>´vAb5s')´Q¥pÝͯî¹ùÎßÖ_˜tíRDè,RÑ@Vs.n!wÚŠ 238zJ£ GMö%0ɺvÐ7®ÖÉ׬’N|ú½ïªù’­Ær2¸d›É×52Ïç<ú|,„ô¤¢Î`â,ßíƒö‘0"¸“dÜ°ð­ý¼·X' >„úÔ «´v*P‘HRLz¡G&jdêÉÄãž õ€±7¸ßOß¹ßG‰’ˆÓÞAÛD:¡ÀŒkdŠib 9`Ç›ä›`SÁ³ˆåj! +ú(ôÄõŠ¾3gX¯ý)«›ô=ý… 9ºì¢8áZå-vç8cü… +‘“š •§=Í÷Vy)÷° C: ðÅ+±ã4J­*(•Œ°Ðù½uØd[×B},d6i$ô¦[vÒ‰„ù©€™8±¿ÐŽ£2v¥©à1õ¤ò¢ÕÕÉqÃÂ÷Ò Ùõ¾^*\<{Ú›Ýc!€¿°ƒf?%G&e_g®¿JÏ [ç õJ.’³ rn»–Ù ÅÞ³æ +0êŒ×lsñM°`L§IÎÛ rw:»H’þÐîH5"«1fѺ@1xGº¡±&K9]ñç5ì¹aá¥þ‰·è¾Xt]ë2!·¢÷ôÂ%;»´mÜ’ ¹»¦e|éû lF"€þ×gú}'½v”E`Zòio³Öt=/Lê¾EL5—‘X0×VJ„†ãA3ÕA ˜å\hE\»Ä9Ib™0qÒ _~ñÜ 9™¾—çÄÝ7]Ľ”ïù «‘ÜÛ³$/dõ=w;G6·ÕçüÂ.ïú™yòBv²ëÍ ì%&½@{”Œ½Õ_ï›ÄTõ7|ëÉ Ï·‘|G´ðŽhL;šûÄ5~ ëKü Ý‘&*MÜj‚ù­èKÎ0ØBÞ_%eßûì`‹J>8ðÙ«*ñ&PŸåÄ/;Ì×[ýñCù•±°|_,d»ë^â;?[‹œÙÙÏiÌ5=.\/Î ½'‚Sþu±°Ír`‹1“ß ö= +EoXxzO…ÿ<,¨ì ϵÚú €úŽ/]˜í†…ùÎnÝàÇæô·Œ¶kW­gºÚ_ã …rí©sˆ.€šO›ë§‡¿ ¹Ÿa#…6ü¾ï7ûÛm‚þ ªþVXèõv™+ÌïD5¸cßîÅ/ÅY­Ú›Ðúší¯‚…cùÆ#_­> ƒyŽ•¶ªzüuÎuþÐQÈÛHhçpôÔéïžè.£Í¯¬`Xõ3±ð}¶ÏXþ éž‘WK¥ä¯ÍÕÄôáXP‹ 1$ûX¸¸\]:ïƒö>ï»ñ@žu;l¡ªÂcî2úýf.²¤Ù[îôk±*Ý—ˆ÷ö?oGVwѪ“Ú}ÿu,Sw[þ´D‰…Ü<‡@nÖµû•DûŽ(çãl¤TZÙwFK+˜bX˜Îø†™™Ñ¦1V'˜bRÛ¤ ý·ÅÈAŠÅvÒfç*#ìɇ;Û$&ÀÈZéLìoMX{znmw[~·Øé±;®.X€4l΄Œ,Èh º9ÅŒå>wÍ U޻ˎ0šòd ²ÄåçûaþÛH$¹™ÙR›€>ð=¦3ÛºT„… L¼ÚÎ)Ù9d¤u´WZuºyѹ„WõtªÈ«ÆÆÅ´çd#̺ٓ¡cÃÀBþÛòärå +ý,äÚÊ ³ýZÐøÉÈÃÑè*í(QñRcØ5k ­ØH6C;&§Íml»O$S4äg#q‡{Øf›Ib“mV× HL$zòÔ3ntÌ.þ¼©)kÐQ/w«ÎÒÍÙ(Ÿ í³ÁQ¬@ÞÄjúÀBânËï—Å‚kL¬Pþ;š8£sèÙud! "l0 +Éj)zèþnm÷¦ÂUJ2¹4‰>> ôÂÀXH zNÛ“¤ÂçìË“E8†Æ ЊùÝëBfÓîWuW,pwÆÞlÈ\F[:ú74jx#‰ú ﰈƂê1±T˜ˆ³ØGÍC&X³hè"7躖â\Oä$Ô¾3°Ð9nþõ6ÒÁX8 H–ƒA{:ëW.Xè1ssÑ çwF·Át®Z®#v ÂÂîWÑ¿•Nö7F»oXø†z¡ÎìÁý91zÒß)>Áf +Áh§‘´”Ì7svÆ‘ºÍ ,ˆñ®Nìãü…«^ØZEcùäFÊÂÿ ¬vìŸq“¦î\µ\õ€KÃU¿'œ˜etÃÂ?ˆnÛ¢s{,°Ô%V” J Y/>3!ßw‘x,øæ¸êc°àm$wb~á0ù sàXm3Y:-kª{XˆÀp”M–Oêèñª{za3¥C{¿åN/¸öÍ,)7,|Gµï(~GûfÔ;úÞÏÐ UÇÕÁl#‘⨠S£ø²—S/ø!·ù8,TÚF§^ˆÁj ôŒ©J´ð{¤c“ÅhM÷¸-d'yUw§<‹Ðq­ŒŽ7ÇnXø†þBêä®\§Uds&Õwz¡#2´- “bŒB¨K;Ù ü[}ă9ó‘‚æ6N°®“ÂÅYÛT§ïÜ—M|IÛ®c´ X >}Sì‹OÎÞÊr+"E«6¤ms*6Ÿ’Ùå.ÙàXë䆅O/ ¿% ›ˆ@Òø(â³:ë…ˆÆZJ]`M hÚ±€…ݹˆ…ß-ÈÙß——^+3¼oXøvX8P粆ÜòÒE-H8ƒ•ÖDèpcĬ֨vQ^`0¦ϼÚ] ØÝÁGUþOÎvö,¼ð‘Æ}sÎä ß o¶è–{0š“#sý¥‰—°*<Óòø@Ì.Àþ˜Õ)ý&Zב·§ýY@—g/g¹é…ÃBž} ,lÉ}¡ëžÂB\;mF®Je¦ý žNFRÙU‡ÿ[ƒõR,ì ÉwŠYvøk;…HA »ÅX±LùsáÚ]¶;•VOĺ…þºœ%èèƒ6$7,|$>p9m¤ºÏHc1hÖGIzª÷' ÿ/]Œ2~Æ‚Š‚ÓœÁ «þ£5líŒÚ­f]}“Ê>aI_“ Û’Žô=0i KŠ›žÔqÝ£fb‚wÆB€¡}@N˜BFí‚ÝžèÓup.˜ç3’z™v„¨ ,/¬Vƒ@U·»xøã°´íû€ºZ~Ôn ºxC ä’ŒcMæ2ÉXhi›H‘}ÞÀB¯y –y‰ wötJ{Ëîˆ7ö”›«'2šr$Ÿ 'æbmH² …×dnYŒ‰dËÎWјýÔª¯ÀÂ@"-y ¿?è^•[{uÅÂn÷ÍAE·µäÛ‰…á>B6/P?À_(aö¹(G"5קÀ]e8=“£$1H2°œÐsÊ‘#D­{ß–ŽkuqdýàQn%1ßeNÁ£Z[@?â5«¯ìÛ߯BÓº0B=˹_B_µ´_ŽýàÑE´¦âÝÀßÃòó€6BÈž†ìyõGHÿÎÞyõ6Òl¢¢´+óæu]­÷m‚ýí"ÛT YÉ“ «lÛ«“b륗üqw¥Ž0øoöZí¼ZÑG¦$ÙIŠÑ¬…ÉÓÒ¬›žÝ r°ÝåtÎÉmóÕŠŒ«•66&Sï‹…ÈU’nËëИ9`ñ¬èöXÈÉGx—â~*­ÈšÁ\m¤Þ‚“þ^h á„øF ò‚Ò©ÍYÁ[$°ÆT¢Ê©“Â#ö#™ièIläºVªs¿ïû:mmæa´ä8_Ü‘ì´ß±“°Ï¹¿‚Â~Íè‹â]Ùžûå3¨©h¿mç¡}pd@W¨Gº“d&, gHŽ<º…$°ißXû㱬"³ºÛÁ_·¾é!ÓußÔÜtg‘ÈÑÈ7sD°ëïILû%îÊ\ëjž¦±Ø V‚Æã3ì%æàU’Ö²¡“Ô E<6Š]ÂwîSèŽÒ¨÷÷4\[ÃJl·[ÙU.ï°@¦dI]±pñ=üY~Œ^`,äÍ1ê·W¯~)ay3Úé/¤áC¢Ñ^²ûa×Òë‚a6 Ø ' ¦Èm·wÂç”>C••AÃvˆµçî“ãt `¢Û|çȆ®MJFŽ#Å4X`þB‰î!5¶ðÂýÁ>ëï°àÖP :$ïé91-à‰–Ÿ¥êúŠ¸¿ŽêíXHÈ^oÉ€'§wÞ¹ÍÆÔ]ôÂø +²ì`O¸hL·tËX=Ô È…ë4îÍ2 .Zr‡8RÐaÀ•¿H$½ëžiöÞ_/äë3@¹ª›>‚1à’Öü‚U ɥ†Ö ñ’ô9ü…ñâý…ŒÏò³ü…[éw6’ìR‡"'&ÓÈæ5øµ½¿ÐBRÉ;àŒSÓ’Ä,qzñN½À½w8´z‡…Ð üæTfB`¡JÉϱ7,iû}ôX€ËœÛêýõ—ÚÙÚo¬Q3ǃö;,Ä;EV’ ï¼éŒ# üéõÂõ®~^ø™XHÕ›±À=lC” ‡-¦È¼®…özÁ!Ó¶'Z4*‘ÖÕl+".­Võ‚ ,yX.]lÏ¥œ¤P®×›„Žb’y²†Ð› 2Á>Ÿ6’o^üoè+±XÛådµ´ÍŽÙhyÃ%Ž$óF“cÊ0_üüÂȼÊÙ]Éý ½ðs±Pïo +%y©3ã¢1åÚûø»„Ñµ× ¹]F©w2œÄd:Ž©ÒèÚù×£¸#K¢W–¸ ¡C„Šµêm“Ø}4»;´é\§¿ Œévnb¥ƒwÄ‚ºbÁ ì ïˆv\ÜâKà(à)i½2÷¨e7á2¿ nXøfz¡ˆßŽ…b”SßÀ|æ˜h—åÚÆkéÖ²V¥Ü“ tY3È!&Û¿r*”âD`–Ó>ÍŒRΨmE“çÁ.*^½ƒ¯» ].xMßÉ!åtÜ©n¹Ù­kö÷ÄBÞu9I&Ù!÷Ü©¦£o|ÃÍÌîI? +1³¸“èÕ ˜Ám†*{WwããOÈú»ù ô>w©žÝ½ð]òT  Ôÿ/Þ¶‘ÞÁ_ølçc±ð¯/? ±xÓ›?ë$&ÉïGκ xžþÞäN/¨ëÛûéÛ©nX¸aáôB¡ÞŽ…‡ÔŽ¿TéÔó+±Ü#V‚³éˆ| 5áC‡?®oX¸ù _Ä_ŒéAð‹A],ÌOaáEœÈ‰|‚oX¸é…¿§<`ÅQ¤®Q¬â„c++Z¯Ì[¶e}Ím…ºø¦Ûø1´9=J1==ÿ\”EÂWQ® â4PJf7,Ü°ðÎK%ßäýz‰ÄyÕÖh¯–ÉBrÛh)çë,©Êc!ÝýÞ¹±RœzAk«3Ÿ÷íá"™I„ØÉì±;¤5rCTÕ6®oX¸aá½õBZ¿ ä/t{µjqñFÛ“®“¤³Ž{ÛÖ }mlä<ft›™Óò¬ðÜmV,fyfíóJóW9¤‰Éœë&‘¯ÝåëeÚú†…›¿ðÅü…eg¾Þë…®ãíÀT`¼D7[“sñFJ¶°08dM Á-$ZžzAø\UÙ"%Écô‚¤C_`ȉ̖ñlpò*êänzá‹ÚêwÀ‚pÕÓz#!/0[¬-&˜¹‡[Ü,žX(¬ìºÝ†¥tƒˆ*R3F'v©½^X,&™+pL”q)hÿ*öùnXøò‰wÈÙFL5gžë…ÝW6³±B¥6wh1“ïÀXØ̾tË 0ªæÓwž‘õ9ƒ +`÷¹JI5ä)ô™åLï#³˜[XMðÙXècïâû +oå.ÅôWŠ%ö6(}¡ÿ^4âà¿ðk&Õÿ: ¿ç,øƒ>¼Ûqóž……ŠœÛÝ÷ÖÚ¯X¨ç6¬I/tòp©õX˜Sˆ[]¸ +à^Lµ";–¡ôÂÚa¤ÀnJõzbMP§g¯èÓõBß¹Ky9˜ðíɾ)m°ðÈ°Òwüû’7®Dëõ—ÝýB'›ýJþ“ÊײÄmO$i–â"iã‚®¾ù Ïñ$'hô‘kÔ5”nÀ‚Üçöôà#8G4ºÆ?[!ùÅ$†‹ö¼ÄÚÛ(”ô¾èH‚G‘³Ô˜â“±°”$ý€qŒLT6åpö”þŠÍ˜dyÎB™fYkš,y‰«ËÌ•Õ#xäOÌÌ¿’-=þW¹âõ6,„dÎîùÏÖ qÿ>þBk»ÉˆGþBaä(uᤠ[;.’†JÃóÎ ¸’½'qÆ‘V˜+»T¼¤Zr&øn&´$¢+€g¥±•{mÃwÄB*{7IV£èTG.~'$*Í!,<bÂ-,'úŸRqÏ@/úø´gâ•<6ú¶m¼b=<®;Ñ¢Ò“JõÛPÅ +pífvHµÓqœ4[lÕ [¯ØÄ©cw¹ªêOçð¼Î]ø}Q/”«W>/_E©•ª@ûÑÒv? ýž¾ÝFF#e{’kgÌàìì¾Ó 1ˆöP ² ’Ü•‘+I֟βM<É|“’³·¹@Ž—h®Õ,öÉ…,ã³­­h? %jYwÜ×2ëz¡[ÚÕ ½Æû½£Éû†ê¾vL„4` Œ!,ÁéÉÈ€ê\AãùJ>¦:–‰’+ùK(ÈhÈÚZÜlMBZ`“ãEב÷UfV Õá~ˆÎ`! î +=QU²+ˆ:ÂrÝ]ŠÁŠIz]| ](0vIw:*¥Û »pC§%ýÊyùÿ¡á÷±áöƒý…øü…w]ý‹ùóË-ºÿd,thÇ»L#¬`Ô×¼ÀÛ)u›½l‡v»‡„É”Ì3ÛÖ£t‰IÒIºª=bÉ“$¶2LT‘„'¨ ÍfZšxä0Å™ +Ùâ’b?ÐáTê>ÐdÀﮣ_´·±]¶ä9Mºû¤P›œ3òÇ­2;¨YºVTgR’—43Ùªƒ˜ìÚQT<62E¥ØÈzm´ÒM6‹‘°ëgûoþÂm¤÷´ÙÊç4^ÇûŽX!°I·ŠÕë…}h«é׺]OÃXhi›®rŠ6³ìNmìN(à'†Œ. Ï¡tä|%±.F2·¼â2's‚Â\ý(x.’4ã0 @–V¦¤`ÈQ(IôϹD"‚íò"Æî0}IÝqx,ÐÝ]€QgêzºxºâCú%GÁ Û¬`öéص‹qn'Ê­Ò þRXHÞþ0"ød,ÔÖQW뵕9õ¸Má/„¥º^HÜ(c†grNn3”wFŠ“O©@ºJk’Ñvß œ¥L f;ÓL¶I $°0lÀOnR\|'EÑÐÉ‚D×y,±Œ&îkä9;xæ>g½PçkÂB[:0“r) VËȄ˼X=§ty0£¡K²õNàÄXX$Wð».‚îj<ßsÙž RkýéXh€·‡KÎX(ÑFL4]R˜Ãû ÛÒ-ý‰…X6]ËX¨tN~P“ƒ–þ ‡I—)@0¸6°  u]Ñžx½°{,4:H/h{IvÚAë Sw‰©2jwÑ Â¯©aàëÁ]VIÔÉd¾¸4ßm ê‚DrS³…¬~6ê·¤©ÖÀÂ7ªp|O©d,Ì»XSG",,‹(ó”ïŒ@ŒÜFâÞ°‘ŽkA’o#íW«’q½PÌ`3ïpÚH~÷$œ× 1š[4‚€ÂX’O mš)“1]Aå¼¾ošËdÛHÓr±‘Zz +"A‰`§bj¦ Úî9N`éæ/<½´F7îŸÄøh–Ý­v'ɺè…ÄN:öÛ!€…!¹È&ß¹‰;­Šå ‡Y¶UVVé+r¡DÐ › cÑå&ˆ¹v1aa—Eßz¡ÌG<ÓÙ½^ˆÈá;—%RÁªr¿7i¥Ž;òõZxg,6úÈwrsÑ^pèÉÝnL’¨ Y»~b|ç‚Éjó3ÖûsõBñ&!±6ú7±’d ó6Uz…+½Ì$Ûôª|ÿ‘ËœmÀ}æ_Bö0rug¸´'qœŒž§)ÕASS|„tÒDÑ9scdá:Úa/]iÃqp…ÀtvPnÎì g|¡¡"˜YÈF"w·žé”›­&)Ïèªt>DL}=Õ»6tô*‘RO#½½‘ñbÐ<µ¢«´Žl/üÊEHCòZ抟S­³®xËñgñÁ¿‡…ŠduG±â4ú¸÷WZñ?—gÌi.lôF¤~®íRÏ» ú³ZfÅäùœô+>æÀæ½èÔõ‘ªø:צðßÆgÂ÷úRõTõœ…)¶“¨õºÖñõªqß{‹¸ÒÑe®ãJ[´¦…«ý|œ….Ù͊ץǽû±XHŒ}“4'Á?Š…—r2÷“`mò´>|zÕöªLôÿ]òDZ©y~*î]ÕT-xrâÇú JØïdð!,¬/›°‡Í½ð4¼õA6ÒöW° a!ÖÏ·l—kuzä'u~®¿ð»·sÃÂÿî÷¢—X°°Ç¿ÁO]Ô÷>Þ}À{œ–_WϦןyF»p½sànXxþÕåÖ»ð†…Ûr†KnX¸aá¶|š^÷®Û}jrI_»Q]Öv › e#.Ã×¢mÁWžç)ø+ûÆñ„¯ú¨çîÁ‰÷Ô§èØw‹ð­ãÈÆÊ_}U +ŸåDñÙ8ª æë5êöî6ù†&þ™ÑÝmw'î»ëÙîݱš÷.¸aᆅ_"˜¯ñj‰9þù _ÏNÈ<£Ã>™oÀåeçã¯üþSNä_¡ä݉¹}½¸Í¼³Oø½K³Œø+Ëéa®mûbs¶àÎMÜÖXð·Égkù6ÓëÙ|ËœœÏÆJìõlwwœî—‹Ý°pÃÂc,ìw"ë±°<‚²öi,˜+ª§±Ð=‰…æI,ø³ñ5R@{w6¾†ºÙÇX°÷°pïÄ¥¾óŽcaoX¸ù ¿ÃÂYM7à.Oê…æÅzá%X8î°p_/ÜaáW½?©~‹…Æ~,F‹ÛòûÅ.Ÿ……ã‘´üŸÔßaa5¯ÃBø<½pÏFú_½ð,,„_ DzïâöÏoÿÙ“OÅBg9EvÂW_9[0l^ôèÛ©°ÒËéÆ_ÇSzéërŠ¬¹d^,øêg%>[ïõ¾&wgc ¿à¯^/ðÙNézZÜÝfÉ·_Îfýmfæzâèîlý县nËG.ÏÃÂA°dÅi…:)þZUæ)úJx‚*þÊûÖüõä©Â÷ eÕå«»÷g»ûJ‹º;N=:±Kï¾Ò ×piqw6ܦÿªînS¥w_ißâ—_ïø†…¿³Äã4nß ÿÞòÕ° )~´|a¾njý ¿Ñ„MNËñe°@¦àˆ) Á ·å-zá‡`!.™Œê†…Ûòj,Ô¡þ²vöË~ÈüG(ÔÅ +<©² +…h9Sf«µú|,l-½ºIð'úÎÝú#~w=þ Gg­ÎQ=ÁNŸ¸Xcô"ILJø³±0ÝÍ$Ü–ÏÂBÿó±ph3„Âæ— ÷N¸Øˆe錬Ül§r²ógcáÞüÂ?² äZUꆅÅž2·k·z‚IÆ‚y‘͘ÜܵvûXø—ô‚Ÿ•ËnXøH,~ÔµÚ;,à[¬K§1zL_ Û?„…¯7×ö`!²—ßØ?Ò ‡iÜnš¿k™Ül¤¾ 2s©Á¾ï/´A”Ó»UZ»gê³±ó<é ? iù¯*ƒÇB~ÅÂ=‰.Y9¨|7vrñQêó°ðï-? ÿßo16í‡c!ñ)Ī¸`aßÁñ%ÇÚ Í6h/5X7,|ÌuÝÒ}zç'bA}ֳ̱O¡—Ýé;Ã6AÛ-Wë0Z¦©¿aá-Ÿ…( ¹I^æ$c*)sîφL™‡½>±°…!ÖiT5áö—±àvβŸMì4ê[6ÛÞµ XKW‘@ú½±P…ûÒS=¼AÚdnk‡ah™‰?ïöá7³§ñ^‹F±äôÀ’§IõÔ¯YÃ;ó2U7,@ÊŒÔZ÷ î•(™4¢v‘¡µ«S•Lø ¤5&q‘¦5ïA¥÷G,vúÕ(¡%—Y˜ÃÝ‘æï¶ô«> ÕºÑò "µƒž¬°"¾4=&%—YH“1 ¹N“|Zõ?%0ñŠyÓ  ¤Ws­‚ iÔMaÚØä»9¸ pá±À/¦0ILk1ÿm,¸8º$ÊoyÄYz÷4ùšGóõ½ïüÂê#/ô,ïé”%f‹˜< Ü/I‡9¢vkT“±ºfvØœÊÊ„þ +¶<)¢4g»¨hÊ,½bAHßî}p“ئòæ,4÷âl¡)S”Má-a4(£“U«‚"¤µñ¨³çÑ„Öè¬êŸŠ…cVDo´owM:{¤Ñ¸w9)n2…V9!I¼½†v”lz|Šñ¯cá3—÷wn-ÿÐ6*äBXˆyDßV;Çw¨ +I&jNTB{$»5¡[Èv],ÉÈÊÐ0§­¥Ý/XˆMxñ +F2xaèÂÂ5‘ß/wÒê §ó’a› +£éüdQÉ\×™VFªÞXù<#)§jü\,ˆ×¤‰Ñ]‰§ŠÐ==ºišÆ¶jÙz£¢º ðyÂ{~>Ò¢/:ì¾^(ê¸è4:³˜1»øÈ£®Ü@†ü.b²R‘‹ÕL'6rZG[n;UÐÈ´è‚àÔ ý%5Ó`–Y´6Rõ®éLÊ-’vè½ÃT‡n —7j%M´e„Û94Ejô3' üüB¼ÇäÀR‰r•ž¨ð*BXߥ>¦º¢m[ª“€õ‹m¤&™ÑÞEû¥ûük±Æ_ + ÿ¯:ù ¤˜ƒ#Ç9y?ggp~Ôd©Òà$dÅf)Þºå¡ |Ž9ø}áþ"œ:ÆB£<3鶜¼ªÕƒŠ‚¿ —ÊUJ¡ØÚ*0« x•­|¾¿ðñ°“gL<ÚrÃãKŠÞU£¦Qi¥7Àþ‚‚ŽL½J/Ô¤âGzŸ½Ù'³¿ ꪽŸ‡…f™¦eüÿ!u4Oa¡[–éü%EiH »eŒF_á0%b|‰“„ +av¥`@ÛÆ` åÝ× í¤ÝHžƒÒY£,Ö9ú7)ë…ÒÚ%¢ÁÎ󪄅¡¤FÃ]¼a‡{=¬¥“z¢ÁnÁŸ ¢€!êg:}Æ‘2+vZ½Î_4öä&é#éÔ°P™¯‚…ç.¥Ï.Oæ¸g¶EÙû €Gî±cÐZf§iN@36ûp…Ö´fÌÙiËÁ;FX­ìrÔý…ÑpLUÉ<3 ®˜¥>ŽuÆ6©—ãZÏ prñžé.üt,Tå6aV½Ř&S¥@ûgX¦ßJç=jÎèeÀ«¶6…Åób,Œx·YdçK_Êç`aë£1ò4ˆä¦¬\œ—tS*Øšèëca3<ïZ¥LßuÐÿ¯É‡-É0tιùõ8&ØèäèÛ½Ë ئBŽ§T½ÌFJ„Ø…ˆ~*>h©eé3›&keôl, Úؾ±RÛÌ¥ÒHÒñÂj’úJZ Q“¯·À~o ç»îëx$Ù¼b!²SQWö¦ÛIzyoô/ QÒΫœ× ôæ»…¿ÏöŠ…Àv[ædgXp°È2[$éÙµh9¿q”©+uuÁ‚è©.¤¾JÆ¿‘³-ÉÞåÜ¢äûx.Z®+J’ ÄWF]Ã1œI@B³ÖFÛ7ÀB%­Ö–aÀÜŽÃý¤ô–<çk­Xotg@ε4‹‘Š$½^èÈ€ZvIÊæ2ùØfš\y®­Ö Fp}¬Ñ ¹ƒ±¶IiwAãɪõN/A_° w­+£YoX€ã–‡ e4ÍÝ™ûä*eUâÍš>yC¾9QQ‹¹§äùz¡vUC‚9HòÛ£ZU¤ûD¹‰µ?Ó_ˆÓô½øþ~¹wÞÊÞÆ®ƒ÷íÕ,‰–}¼>÷uÚËÚ…dTÕeãú%‡•:WtR-=HtòÜ©vŸS²ËËaÛÜù|¤Æ.{Ü÷$Xö«rw^³Mè)RÒ XK—è ›ðši»aæ·5VÃ,}+¯£•¹„­{m˜¦¹´F¿þÊÒ$ÕN¦©IÒÐBÏÁ (n&¸€•¶2L =9”BJ^uö™XÕ߸Þ9Ñ_­éS±Ù}­{IæGbÛ¸OZÇÌäñî#m©îTN +70òÕd% ܽâZ÷,ĈÚ?qe‚Z Lês±ðíësÃÂ}å\–•|Òßbío3<½ðÆ0x,ƒ[ÄsŠþGJ3° ßÜ‹°CôHZˆbº õñWÀÂûëõ§¨NãßgïþÇ%X^è%bßwñCky‚3àLŽBÉÁ„€Ï]™Üç#È:Áð!NÁx=~y«ÏÄBc*whé&R^½ b²ÝrøºÇŸ©~éïŠ;ñk¤Ëäu8W‘ªÅ_Œ÷?Z~ôüÂ]]1N´Á)«É…>sÙ„9àª:'_[â¦^…ÍèQJ­6­³ƒO6OµîŒP_B/¼EÖ=ÆÂ|—Ò]®/­¡ñ¡»aá}~¦?צiÒ"=k£í-¥¾tI’á»$| \˜¸8P/ÅB=Ôw{r´¤Ñ"£ É£hS§Êþ3±À=m—êdp|„…ë5[ý¡U8? °PÚ³#R?êK{½åÌùB!JE£ºPò Ažç¯ðºJñb½ðIËçÖ;÷¡ëóH`’¿d¡¢0tÅ E™ÒèÅzaåž¹MعÂ8– Ñ(·…Q‹iŽ^®Ž¹(¡ªÉ1ðüjÁòÊ¥÷•/^[;lz‰é{ãÀ¼âZyó$N’íª;Iïf1£0kdÌ „™v;œ6R¬å$l´iÓm4H…v_h[`uGk]ò·[dËÍÁ8¹Ý(jA +9Z Ý«ò:‚CüƒQHÓŽ½ uAðraé…iëº"{-ªØåÑ?…Ìfî0­2¹K÷6R€¹Nz½ 2½q]I«UMX@kc·€†0d[ÄÅ_*ú«ýò3±àfžQ[õî&°ýl7/¸µX¨áAÂûL(IÞ2Wh3¹Öv»ç{y9 +±¾KÑWÇBCzl9:-3øÓNbèª~×ÀBnRÈ""¿PËSñ¨[èñù1Oè'b¡¶kKˆè™[q¶ü‰Ì˜ƒŒEì„™-„‡C/¹~Se²‘6à`ðß‹±€Šº¢ú:Xø[ƒ$l$<"9¹H[3ÄÀ‚K„ÕF_ü…\ZmO½ÐpI‰’ïWrøobÁÅ3=a–Ê~7F^r±s­;šFäøî4:á>¥îÞ$‰­ðwŸ±;± ’2Øz01!#[EqÆœ•´:«]*u|o6øøaºn—úxTÙçÆ‘ZMƳx§çR]ÃÅæùnG`!°äæb#Ù=‹ÉjõzÅ:ÈO}·Rô îÞÄ¥ºGqpor³Žý*~Û ˆLy¼ãÂ?žX¬Ô`ÅF’³~èNkËÅ,e‚Æ¿x²(\W¨aßg®·%Ù’öŒ> k~6Jä¨ðˆF ,”xr»ñ6RÜ ?aÁ@/(¤¹®&¸é…o³^`,læ^ž*f¾3Û¹’ÞchŽÊÊtMXÉ3¨ROLDÇŒ\!IcáB~ckWeDzIùL,l ÚcÁtÕ*òÕÖÐqh/zžA:ÛÁ…6‹ÉwÞe_í‚S/¬ó_Š©#–þÁBýÌ‚€×hÒ \ð›ùNƒ"·Rë6Fåí8Á‡ïvNõîsÚ…ða°€I¿šþ‡j±E|:Š¿‚Tš‘Tƒ1M‚ôBnÂêÂP+ùû¾»MÛ@4 æCâc„4ÒœÉßjœýoõ_Pú93˪}M<©Ô‘’b[¥¸Gb¡Ÿ÷ØW½OLšZJ'¸ä]ø4¦£\4© {„Ö*À}NòÓ±ðþzAÅNa*3¦›(²Ãζ¹8‰”KmQiíÒ$àϪg VI|²©á¨%¸aá\i„ªÿwÙ^3ÕF²lT¯i ÛžÀ‚¨qOPÆKXPBO\ò,ôFï¥¸ê… Ìgc¡”BˆýC[/[¶®ºaËÑÇܹêù}¦ýU‰×7#V+˜4Uoê²Êù=+è…á²#yÏ ÿ•ßã<­+ð˜W)áá¢(zPûÏ6Ò¾×׎ 0ÈìY/`f£&erêäÊ¢|úÓõ—]ª¿U±ùÍ°Pr•Z,Íão¢í…ž:ž¬•;vk—Øåûn7Òª+™1HG%IaíáÑÛJñ`¬\]ŠÓŠBIkÞN$øÐw¹î6¯N,4 J$X@E{b¶!bÔÇÇß uíŠàOÎÖv•ãÕWÙªˆÙd]‘ü.ŽïrÖ×Z﬎9C¹Æò]8$Û®»9jmÂŒDi5Ë6œ8ƒÉÓ¹]G‰YÀ˜:ö­É¹ŸÌ´ “™&ï1 [ŒV†!IkkËUÈ46&ÏÍ N‡ê°àk´îÈ ÔÝ]qú ±0‹Ñ)W©&$mÇÆ&ûè+ÚG—šïˆ…&Á¯ûƒ@Ë‹šû*[Õ‘Ïœò¬½ýsu÷=:íé•!…àá*ó¨\¥Žãø­‘õÂäpLèPG9j’•úBø˜Â +ɦÀ2ÇP Þ)N;Š¼÷7K4éK¶9F샄òˆUà|Ç û¥O´ý µ‹†méP¿·±Ká•aMšhÇöƒP¶/k?¤.[‚<áúõ¦vªÜ|±ûwÂBAJº”¿&5ÙKã3¨‰ŒÃÐ+ jJîuùç ˜wÀÂ,Ýíßk÷ò÷±à“çÄèð9èZÈ° }ܦ÷ê#ü½é1³Ø9 oÿaÏFˆZ·›ðµMO áü<1ÒÛËÒ”\HF&ËúR,¬O8 ùDr¯g÷¥–×aAÅn=ȳZ½W¶^½2wõÊ@VJµzëgíÓÓ-»0Î sÁB(i=)I‰!‚ÑsOòKV1X¯Ç=°^ h¨§F¨™nàâ +VýqΘ*TˆÖ|yEgaåîQ*ÝCêò7ýŽ­²ù7Æ‚ï×±/,´À‚A’íX;ŸÍÃϘg»"D°#‹­œ7ZKÞsVº\y­ÌzSñ8F¯£÷«ruÚè/ÆBÿD¡ôÅ_óî‰Àdýõ±€Zžn¹+äÈwr´È†„.e¯, ÉÓdN¯L kËF’ãF:úÜP%ä‹-þç&²¿ÄñF `räsdSÛ žxrš…ÕëÄ>üÁõ‰™Á´GçœôBJ7pƸ°OKÖÓ®ÒõF¶Ün ý\pSLw*,!Q Ñ ÷€)-Y©ù·Ö Í© JLä­U•GüðUô}m<§š«ÕÁXt$~iL¾óFr[×½ÔczW©ôYz!ÉÊ}­K!@¨ QÆõd÷ˆl9N…Q7Üór©ŸÈˆo|bwôøe0ûÏÁÂãŒÜŠ¨³2@|§£ÌL`>{8j§W–¡ö†vÉBÝuH‰)iOW@ù8–Ü‘KÇl «Y¹ö£´ü&;;'Út‘Ô4¨uë`3BI–:§AFØ ,LtvÃêVÉekO&â\à \sR÷³«Ž„AèwÚX9G üß9ie/¿µ^`ú̓ám$ŽÎ81y•1Â+8P£™C“Ù´Oîg$Ö§¿02­ôkIRÓH *ôU/läØÉF³t4@&f_è*;‰H¥å¤iÀÒôë;,<™æ´Êãnt|`‡èæ‹a¡¸‡…€{ðÄ:ãÐpn‹†V)L”ŸŠ-ÀBµÞFB&êH£zb6†C…Þöëö”G }‘Úb1V½p!šqÉ} +qb²y|Òãý)*Dcý½±ðØä¸$\ó&uÆ!Ä>îö|jíÝ*õhÎè÷X€Ÿ×w XŒÉ¸µ¢GÉB­¹Í¢ÎvÂ7É(‘̽:´$9Pÿ­®HßpsÝžD>OÄ—Å=, :ã†^ôBŒ:44ñý˜*¹e•™*Èäo°€Q Ö³ÂÐœhå‡míîc!2Té…â¢zu\°ïŒqÉcTáâÆxÂÍz¡b£z¡¾ê…‚1AëPä[ÇUýôÂXÐ&Õ²¬Zfœ™‰Q¾c¦b]‹8~À˜Ñ›Ò¡¡XC‡æ¦ç~£ÈÀÈ1ñ\ËÓJ.Ÿˆ…ºV÷+>®z¡Öy +“¨4)ô‹÷™µ‚µ× %{£y iLR[ø‰öΓÒ×ôÌ›œ—½¶°Åȵ@äµµ÷:9ýîãs¸“ìܸ-£æLxÌÁÊZmÂ!•–üÆü…ˆýIÌ7EÅþ§aa ϨM‘‡h G¬xשBQTç¶ä"E%QÄ9L´qÅNýkË1|1=údU“³ß%^ʺ͞£à&pÀ‹ŽaÙœz{¤]0c&púš¿Óðüuó MO!'¯,„sbdní@þ—òq>@êbÓ’Ï•Ð0¡ŒÓ÷°0ã ¾È01”™¶D”©ÓYwRßÙH[ .ÙØ6Ô›"g½mÑä*÷]£k)³–°IÛ&,èUîƒíø´ºE%n°5e½ÃŸÄìþ’ÿG"³Ž3u~6mýXš`{'wÖÿà IlG¾M€½hÿÆ‚ÝßþÇÞu(ƪQPPPì+þÿ_¾ÔmÙdÝ’Mî‹Ü²tugC•Ø½`jû¥AÞà¬DìÁ®4•¥V£©d`Bé˜0Ù€ k-6ƒ/4'\ãΗ,ÔÒçáâÐ-qÛ]nŠßƒ®¦Ì»)©½É¯À8ó§`Àfûk¾˜"óàJ&m8BänÞ¡Y6ek¦¼ß¦˜w‘aÙA°S$,U¨áàz.á:-\ãAM”Ì p#ÁÓ¶‡Ãƒ1èOQW÷` +ÂHÈ(CˆK¨átбÁs{€¸µj4ëIdkíI\ÒÛÔ©G¾­²ïÿ_°,|P?F ÑzÅVHÒŽë…Xs›‹$y™«A»ŽÖ@­Ê–2õ\'’/üHH·­Ñ<ƒa )Å î2i`ªdâ6†Y1À€¯¹Ý° I¡mQ/V,`Vw©~.B=þUîÄÐÂM¿°»ÖN‹•—°«2xX€ë_öxÐÅÖ›¿ +<Õ‘ì„Û™PÙW9s,&0ÏŽXhÌó•û¿ÀêGXG»Û9™/ð„•š@Gt Da¾`þ=»ilÃBДe“É K•î&ÿ³Xèæh=è±vGªcÕ¯þ‚pƒ¼Ö´ÁÁ(u„bRaæö ä¹Ò_`!@øq‡v‚š7,Ce>Ç„;Eó¦d¿'¾ðo4ÙU‹±?‹»w*|8o€rºÛ¹ÊÊË Ç-ËGÛw¯ªý ºÌÊ—$ª|…Ic“38˜7Cc™ `þ¼î †iþMkÜÿȾ<ø SøÓÿëX@üd÷#Nlg\U#jëT•Á]²Ãógª†Øä±Ùßá¯X6ðUFÕþè=ÿÙ:¿·ýOâ 6ï1+/Ð9I‰±šKçÄÆs¬ïAÙ„¦‹ð^££ßЖ˜u$v`ú,PÎþ,ô;þ9^@·AÄW^`ÚÕ5®oóƒ0‚뮙سµ ñ)-æWRÓ‰½ðÝX˜ªóÒ4ñÕ5£û£XÀ|\!v^øç°axs8Ø SfWA ½«Aá±àZ?Ò‰˜‘‘¼ ?s–^ß}Uñî'±à3Æ$›v,ükX·ÙÛéÌ èž)#ë‡ñŒÈƒËÜ+tÀ€Îê%>½úTOâ÷aFɹcéªë²m~ ¯a +‚1ÿ~FAlö¶[/¥¬vÀ…ÎG,´½ê¾>ßn–/z­}’òŽ tʪ·`ÁN»Éº.XÚ¤u qr(ùD¿ICÙ±p½É¢+Š‚ýóXøÄ?ØÀ×ÂûWÞzñä/±’yù0n”Ñ/¨Á.̆\¯)M>w,üŸÚŸ©³}Ÿ½`—ã¹F»Ö>®öt9e†¨lÝlhv,ìXø Xè'Â[(FÚï1IÊÑIdºµäÓ×Ùö²(Šœ5;¾ ©-£Úز?žh”ŽÓè.Éå÷ìoüÎÁرð/bݪ¢)0²ë +\ò‰Ë†Ç a€KY°eúDZð—â }@S;ÞvÊ ©Q¸[àœX•/¼Ðü<ö¸óŽ…·ð‚Ï«s³íw˜ka‘ ¾Ø ¿`/’=î¼cá=¼ ª©Ôž‹~$"¨+°ðÏÐ7šN)–eü¦úv^رð‹°@æ=Ë€üÖèp…?Aþ3=Ø-%23NìGã EàyçïXرð4š/°€Û’¡<âŠÜH øVŽÎļXפPñ=³²jZ­FmzÿÖ?'e8»ôžŽ'‰ý=ýN¨6ÑKÞ‹…êObAµ|xd‹½ìÄÚ~ŠÔýÐ湧VÜ»¯#}´ã1•ÑÛÚç,ù¨‹lj¾O+t‰(“?ˆ…)7-V>ÁBÌ¿éJ fx¤[eh±µu©9\qôÝ“jv© ºÍƒ“#z›:v®yëÎÔ˜;•¤ÿ è\~àÞÖ»‡™£ÿ®Ãñ¿Ð>Ä.°àgCàa½ó¡.îâ…$BÚ}ê®ðSüÒÁ¡XŒ8¿V¡Ð¿ ‰ÿG±ð¯·ùHXô &ÖâŠFò/ÔØc˜B3ð+{Á %v$X4‡\YqsÎ ÝXð™„?¿É‹¼cáŸà…À¸“ XàÎäóè^À­“ +°ÞqkÒÞÁ ¸/k/ø„;” í×¼ á…Pkñ­µ…w,üÓXè?Âͥ%ÍÄI%K“ •ðs^À{°^U.\»ñæEÇÏyw¿ÂE¸­ð®u|Þ^p>ºYw,ìí¶ŽdóC† + š-PÁÏwîýœl¥Ó kô‘Mç¢ÜÆ 6{·äS'Œh¤OÄyÇçí…oµ½ ÉÞÞÞ&šB;õ8]`¡ž±0u7QŸçC´ì¶ó¸/J‰©ú|œm¼Paè{«t0ƒ__t|Þ^X±ð“Wý’šïí'9¿çX¨a–öy3á¾—­H¶Û ¶Âø@’’Ú}‰·Û ¸pʹ-¶¹ìùùZ{aÆ‚øÉKÜÀ‚ÏEÛæûŸ7ÿöp“-ܨw>#Ã~¤N7 äù„»æT<ÙîGb¢õC&Bü©ü¾{Þ^(ʬ©ëŸ“µv¸ŒÏ~Äh¢’íÞÿ'ù S¤5jì¡âJû‹øB`4ôàæŒWœ6_Ä\<"±;‡šô{â þO^nŸnÀBÅƽ½»)¥ü/°à'E q A9Ýt/øSÈzÀŽÑ•XÛç¼à'} Ð}ÕEÙ•ŽÏÛ xôþ'¯¸{ ÉŽ…Ÿh]Q¨X&Ÿa!M%égbö9/„MR|š÷9/P~²äoú†øÂ?€…~¢Å-îé(ÆÏí^ ®¶aá”zèÈ?ß¹ú {‹Š.ä/ÉGb£Úyao—XÈ?‹/ø©õáÐœW‹3Ç 7ñ‚ŸÚ[[´|Í`*Âd/V'êj¾f0õ 7=o/ø¾w}¿óÂÞ®báJÜ™‰K‹·â›xéìâ[ÎÇ(®ò¿ì|\ˆý¼½ +Á…ãöv Wò‘ä,Po/0}™·Ô{ÛxáÆ€}W|Á‘[.îâ+­Nÿ+¬Ð?¿Šá³UÕRÖC¤v^øòBRP‹Ÿºþ²/c¶.sïÙ¹xôÆë¼ÐѱP¾/×ÕÞ˜s7wìçŽy¡wA,îsrD¹±e>Ò,(•æy+åfÈy¹2(Ë2K •Økó²ŸÅ_yðv¹ñÇv^øw\ª!ÜÛ(ºÌÁ‹z,ŒÜÞO$ÂP¨‡ÅþJ°´,õgììÿc|£E1å-î#ćO êN <”×x!3š‹hòs°ä©í8 –ãáˆÆ9lÿ—å#mÀ‚êt,ä=‹ JèD WÇÎi,që3#Š™0Êy]usÕµTí¼ðÏ»ksŒ7ãM„÷=ìÖ-®Á^ðL¤RC]íHCo—¼èPÖÆ™jQŒ·QݧD¸éé<¢¥ù’¨Žd2ÒhWµÂÁšgÂsµ’ºR¡öðó 3¿*ibø%}™,™±Ðjã¹nÀÅHuÛõέô³FàêÀ\ã×b«9)Ô«bOÓxU±”ŠÕÎ ¿¼}Œµavj¡=†‹p\ÝSÝaò6`c`~Im*®J¸ÄB123”tèU€Bï $¦Œ'kŠÓ8pUÂ%/ Üð®‘íÌR +5ó4sÀ–ñ³bί^a/¸mÝæ¹wÓvVT—¾RŒé,XȦZ÷2öCÝIå—ÂjI€tB.U  +¥”v1¢ÀᆨTu½Gw^ø×° Dâ´lH> À"E!,,eò‰Î‡\Xà5vt:è˜&Ř@x¡&ó=ØØâ’ln8Ø šcGñ´œ;N;âÖ“¯‰/Èø¶+3D@Âc§¼ÐÃŒ×5YÌâÎ^«°àøž½*’(‰:íà…#1„ã0Ê[C0®±ó¯5®ä`øhfÜóÌжmÕúƒFXà僩µu>bSø|îPIhµ;edÅxÁîÌ=1ÍÛ6¯3ÿ/,XH4™;FBòT.¹æ'³å#mò!±V[‹”ž3^©¯tç†W®”+Š¢ó8tàœÒAÈHxEÎGG§c¤Ó:Fd¡Úyá·¾ëä™É€::7 +4 ‰».bl¡æ³È¦!Á}¶qÉð%ð¦;úXfŸclx¡±»‡È“dí»s7pñˆÉ¤„£{ä… +ó½À½KïËG’¹XÜDòÈ •á„SŪo´1¤P1zYKÜшPö%¦š •‰ÎïBåê"æ9\ +upr·~³é\_îïŒXÈA‹ Q7ÊÐÓ ×ðPêxR:r„œbä€K?Ö@Ã…E;o' ÒÎû1ÜéÔÖHC@\òóÃ1/œ¢™2臈©¡¨uÍgѼ(iSð‚Å‚’'¼Pṃ¦±ìÂÚØæŒKí¤¹ ý^ù´!BŒ®6C*Ñvî´È–öj®ï¼ð´*³úªñaý7ë8ø϶õã‹­ñ…‹ŒN“—Çg&o­ åƵX‚W\øJ`ÎP÷‘”ീ[š¡Fí~*ñ ÷1ËHpÌRª8îSwÉ >~=C*MvL #€Ž¨˜="}‰½lãÖô˜Æ^3¦ÆW©C€iœÂ#sLÑb¨²á`<Ÿ5Fç¹è¤ ï瀅¢3LÜ)tº ;/|«,Æ®ŸÞðØwãØujÖqðåÜV¥Ç6Ðs;Óœ˜£ncn ÿ ®w-oáý¾æö~ˆ/Àç!–ÿ Ï0 ]dþ¼ÏõXñº·ŸçôZ|FtRœ;p[®¹/ñÛpظ9‘¾$¾psûíŒØ‹wý\wTrŒ)œsm:;Í°JÀ£tµ×QJe#úQz¦ö]SöI*º®`] ¶.zÝLÀ!#½ ;/|…‚žæ8MÉʤ~„~·è»JÍäjö~ØW:UN§¶báÓ:7ÚO×ÍûÞøÑTÊÀT²Ã«ÖP¿ÖóECÓ¨8® +ÀdhÞšVp—(–Å¿~ÎUBÁ^Ði¼óÂóM¶µÄü4Q’‰[¸ñ`ê)Óe–eåâ¥(£^—E +¦ßÜ +Ö¸¾óµŽô îè?Š…7æ#ŮЄÞ©83,æF2ä…ùB¶ö­rµi»fë "Zwž±¹îæ$WóVˆ¾0;/¼‚z°@ë ˆ:Ð ]÷ $› +݂Ū˜”l™vXêžI-X˜ÿõèQUg5§#TZWMYÊëXðçÝ\Üö¶[²ÛڻŠcfo. ]Çúkûh´[çFQ·…ûÒ-ì,(~íú…íùH1­9/;Œ§ƒ÷°ZSƈˆa™êã ³ï9òÑІʈ–*å”Á[-»ÆU¯à;³½Â•þÂ5¯9§m´b-C͉Yɵå…^Q¨8EGM†R´–ãTJ¹Â iVCÐÒÜá¢Æ("•Ê#îúå^²/Ö;SCðÃÚJ†znæô /yá‚ÿiÔår×[Áò9a'ÝÀ nX§¡ ØУ°‰M¯¯´)OUÉ5B.Ïbvü,—ðL4óÉÆ8†ï10%bLk…oÄc,á­^­i¬Ïð‚Mðè×<å˜ØäÇWóÓ¥ÆÑö{vÅf:ëu’\>”ÉžÓx8§³!ÖãÛlŸo^¼ßôùÈ¡e@‘¦±"•žyA×¼ÎÎ9b¡@‹yuŽH±P :Ãô Y“BƒÒ¤+FO[ ƒÚÖW9‡Š0DP+ËEW4èþ×¾熽àá7pK®w§pM8EQôÃQûœ@ú!œp†+Éó—Ú '`<ñÆouá©í.¼•9NG9õƒ<Ì 0Õhø“¼,VÉËê +þdý‡WQmŸÛ?eÐÐi‹ƒð¡r¥ºÔ@Êc§ªÊ¼î D‘ý vN{É~Ž ë9xùS§0'_¾]ƒÁ§'ïVeJox|ÔÈK‡Úãs…·òBY‘¸ç!ba6—©,®$òÂÈbZôÕÕS€)?Ô¦öºíÍ M¡i4(>ÛÎ`,Çf¬¼` @Æcª]{Ú# ƒÃ½*N¡ï{æûױЈ þS­'ãƒÿ±`ö§~¤ÈÌ;2öº"‹ŠSŸì´ö9/ø@@á +E|âåÚ}u}¤;ê`È&g…½û('iRë‡Øz·sæÀ4-…<ËjSeå1ö$>zP•åy)Lu´s^Èø€S!€ƒ+ƒ|‰Ӯ߈‡£d¯ç^#þÂ;± ÝøK, / +rÀƒÎ83/T>¯òF.¶³ýžEá /ô˜BCj†¡"L ¤À4û3Ÿj%8äzÍyžÁ]‰VÛ¹†7ª­ñ°ºÏA1Û[â +|N| ¡³šØ/ÉGÚÎ k)\?0¶Æ8lÓèÂaS׃ïès\e_®î;÷cl¬O=Å 2Ô—RSÊ{xÁˆî€MÚUÝ:3œ®aÁ,²‰î|s®$­ÇƒáVõ©{NG²‘_Þk/¸ +l”±[y¡šJàîØb!f¸2,zŸðB¬X%„+ Óø`/¨JH–4ù© |_PºSJØÎE‘jg®4¼‰ÚU‚Õ²‘ß™†ô¥iÁB’Ï<Â@Ïê^l/°Í9*2…¤‚€¬É<“©E^à‹ãÌEÀBwšñ‚w)Û2U…U-xe#D‹«äæ`Äc¼p”mMøQ¸oò†š†ƒjÇžŸÅReG¶ø€d7œ+-¸’ïBIŠ½e™Ÿ”ý"Ô»2¬À(+ê(˪O¼W_@[‹ÖšAì…* WÊÚ ¶.j³¦Uμà€yÆû˜†ºežiiÌäOmˆ;Ûß®—…6Vm_4wÌ©øšã ÜŸÓ´ç%•î¦»x¡6ôðÝð•ö‚wƒ~$Ö‚AuÂ?òH Ž—¾%5Ü[¸€…3ZuJÖ6‚ÈðtÐËL™éVö"ç…xUnêFà+1Üä«>/û×LÎû‹*ÉGÉ[±À±”Á*§ »P‘JÒ:œŒU¼°F+§ÁÕßË1Ei_„jÅ‚ÇT¼ü¯ÇÉ|wa¾â ,ÈÒªþ. MÄ +íø þô¢a®åÈëdì!Å8µlH¹ñd§s© +=h3ô*NÁ°ka¨#1~^L×t‰^G Z±Jmu¨›ý /H1ÀGÙ,ÈÍG i/”vïZ+%ÉÓº}o/€pŠ¡\ó̧›yaÔu“‰râ§Ö\6%›o­eoø¯@/^d\Õˆ ¼á-UtOØ ²]¥Ä\v|ö%Å7yE~ÀÒw^“±dÎP7e–^Å‚õ¸§XXT¤™”ô¼Œ{µ¦q8™ ØNÆàßÏÇ$ÀP ±Õ!:·b!´ºäBeT}•ŽÓ:óÆnõä#úE;ø]§ú¢èàow°‡‹ùäiætü®½U…ç©ôG¯ß¼°LÝ,$h× ¦C,oØ ’@eGeÚ®<@ étç[¼@A#ƒoû˜ú#ùH‹z*áúyù”C¯^¨=ÑSÑY^q*Ë ž]x0{Ã.t6µ$)9(©5ñt†‘ ×8ÒC¼°Jù¢¼ƒÍ>da¡nÛ vZ,V,ØE %U¾r*¯ù‘8úYzP{Ž*RÔž(IÇáò¬ˆ}Ü odÕ‚?²jä+\_ÎÍ~õ€0}bÅ6ÇJÒаñO¡Î‚>‡€O|Œƒ/l¶R`¢†NÙ’ˆÏ4Ò“²aÈóöZF4KšcŠÊ!4*çüjbˆÿµ½@íæâ½MÚfö9ÝÆuÙV^ÈñËÖõ™(¿·>æi3ÄB¨»!ÃM©qQƒn{¦$Èl;ô‡2Ä1ȼs8éD”” ^ÉŠ„ª×úà*|ˆVÕ/÷¶/”%ßæ…^JßYmÕûîHíÆñx5¾ÀÑ¢â8gT$w†D>/K*ôÉp = Ý­‘õ­ C½´6S§X€)zQ«†/Õ×ØãÅ-c¸¢ï>^À,îÔ!]øÐÜ †>‰/„‘ý@–…W5U3çÑš““¡ë¼`3¼AT1ÍÉÏP×éʦ‚Aê`/ø¼L8dÚ¬qÇÿ¡|$+j òBЋ”ýâGÒm2´Uë$qæõ>cŸFQxÀ‚#Àäf%Wp¯I ôÞuOù‘VѪå1Ÿh7Ät襵>L¾çŽYMD/®ß“”ª[9KD¥â‚]T9 ²;†çH‚Kvš¾ÿUÍùߧjÛÇHN¤í^!/„£ï¼0EBxÌú‘FëÂgžµ@Ä@M‘)Ñv`8ù.9Î>ñ=³cOÁº9¾ züÆpîÌâCnºîSÁ‹Šæ +?™K°„ÔÙp‡¨ñ§¼pÚ¸âSn9¼ÏGÔYö¬2a˜Ù³1ðc² ŸÈ"wÑkpÖ£§Ðzþõ  $«[y'©`í­À¯@Ãè¼à»F¨YG².¼ª?x{P¡—9XÓ23­µËjº\ôýÐ<îGRî×XØ_(m9ÌñBúRùu|!Z¢ ÃÖž(IС¾(Û W±@º{*ÝÆj‰ÝÄ6[Ù„lZ³¯l|'3;F†¶5«ÑžùQFéïàßåýí9«‘TÌ›«aRa|¡f=Ïã8üÔœ™{ #á,Ã"x™ XaOu9H§ &E.Ÿà}Ž… i/ «Éèåú,'KÔPð¯+/° «C M/¦ûjÖKp‡;åø^?`8ã]Pp‰mÏ¢ªÜ“]qÑÂå*È{I ÖŽ4TY¨MKWv-Ø¡J¦U)0w[æg—úæ…oÏÁ€‰2”˜Ë¨ºþdyíhÓõ:4Ñ.\x–pX¦ˆXïvzr½>>¤ô=g/,ï÷t´îͼ ×èæX»N{„CÊ°°†‘›ÅËÂæÈ¥TâÌrí:Gt­ÑOy¡Š²¥…'~$½ @è]y“…àNeš©1$%¢ï´n"]û€ÃÂt˜Ü‚ ÇÕtÖ˜Æ ÏZ$Er°Î dˆO±0úlc›“QXP›;úãh²¹cq†…-ýþ™ÍºWÖɲ¬ ‹j‹ß8zïã…EH—ô!å¢Û—WŒäJž*?±‡<ÏëÆ™}<Ê®IP1‹‹`‘Ëä€oÅï¼ ¹:U‘D £éƒGkNÊ"½ˆRÊ î"$ç>ÕtÕµ´wÇ͉Ñ%SN’F~§³Ñ ~ÆB$¤#FÞìEá2MñAÙuMèû%|»` vÜý*ÞøþëODZoï©ObwvìN°°í$?lÈâxsB=^¬k xàÒö(cÇÊ‹dUxOÇ–L æX/f jñ¬¾/åkºu2>älˆ^ÆXÂi†PÑÔí@8fJ¶„h«kXPþ:ˆØÉÀ§Í‹UQÙá‹îW‡$£/yá<à𩲕ǾÌÀ¸ÂÛ4įÐ C¯›xqà\s®fw+“M5‰©ö4%ð+ȤN‚ãñ>ÆitGËNÖ{v÷tŒ‚äÁŽ'Gìm]Â3-Ðmqr󶪥*ü ¢ #í…c² .Ðà"Ÿ£´žóçâÎ.‹;¾ÎÍ«WӾσ‡þ4ÖöÁê°š–Z”S,Ä+z%‡Ué‰?dz/JÒêܲÃG©?çOª“5OǸó!å5»ƒT‰sÝXˆ1]¦³‘e8¨#Å5;–E3"`¡â°ñrA„ÜIÚ©®Ùçqçÿ}»+ú*ÎÜwgu@u©ý&‹¾=»Ö­¡ŸVV:ÍÙŽó’=žä­^Ë8Ž;²Šãšd@ +âØ]8Îu,t«=‡ ¢Œ‹ꈅõ€8Ø_É·ãÇL>Ž§‘¹/xAõ‡vŠ…5c­ã¿Í³aª@Õ–F9`b€Œ]íF iWéÈ-t ¼€%|¬‹ ¾²ò9.—ø˜§ºcá“)(îgGÝê“C‡EÍ0x‹Îþ:¼þoí¡Ô¼ÓÏ¡OÔS]EE“|G;õúÕd úäýkX×,=R¨Ch@Ä–eÒê ‡ÂYŸÆ—O•¤u¸†£üìxŸò‚àkØç˜t †hó­aðýXxY¯›ÑÔ>†|"§BE¢cŠ·¼|ìëŠàâO{Ì4|ˆ—¨–'‹}ãϨ 7>×Bp·Ä: +2¬áÊ¥y¡Îâ8bèã.‚Ðq0 á;GG__GD7ŽÕôÁõ Xå¢Ymܘkï_ÇBì2&ˆ¸²˜ç «Å±UEÊçì ²¦ ¸†ÓçË|6ÄðÜNó‘V‹At›=Þ™N‹Ö»¥ƒè:­O狩Э´› êrSM ð°'^_ɬŽTwgë{–$ÓŽ…[šR­Kø‘j•ºBŸœƒ{xžWG:—ƒÈ"MTir·äÀÄÄ!šŽB·™Æ8ôð¸édN?ŠR¡NôžÓu›ê3,àþ*—³ûµX›EíúxµÃmŒÝ/ž¤Ãœ ñüòižêªî™të½QÝ`4LN0£Ô :ñ8å „ÑÅQ”ùÀ<-<°.—ý +b¡‰Nm½ëÿ÷-µÎìô>,¨« „š&ó“ Øx>pŒXhXâpÊi‚9 L¸©á²Êï|…`ÑåžÕõSu¶/O/ì{ñ±@ŽŸbAuä«ÕÅçXX•–´×§sþ!g68¤ŒŸû^H-•ñ{]IJy.hp²"½×áâ§Ã„ì%7/î<*çÿá¥*(Šbå._A' ½ÈmúcX)ë(½wgÌŽC©vm…fEVq°ÞöH36"W¤¹#ôKÞFFø +†©A}íÆE5}¼†ŠNÔ$Ð×V §òÍç‰þx¸P8âî4L|Yuâ ¥…/îR‡û´ry1qå‡<Õ/° Ï±p,.pƒ´O•:kÁU¶éÐ@¼›Á½„ƒÖ.K2’ºLÔýcX¸k牺Î1XA Ћú#¬?½^(t(ÁÄÑÚêQiÒðI³¿Â$¨¯.ïžÝ¯Q‹!Íëô$W!ÆØ÷Ev«9Xá¨./çX{%Yé.…®Ï*ìÍ_ phåü°Î¡Ê«ߊ•¸–WáÉ9©®:É^Àe°cƒsSa}Zóêðë»ó!™ ±€ÂÞݶ»/jàx…úË:Ò]9'& ±r°­)`8§_x»·‚ê\ª‡°©_x>:ÁÂè,SäSuó¤ì J‹þb NÌÖûÆ÷/ +ê]¾<KõIÝ<¹~sÛv¬ÌxZ?ÏWÐb¼¨§wYcïcÝ憿}j¼3·ÞÞ·£úLž]“öÛû~HÁû„äP#­½øÎ[)òt©£À"A°jgÏ+ŸÏÖX`.n@ „'+SGdŒqvøŠh€¸».MÜ÷_¸£É,ïGå]q‘w +&QÎXPc%DÓ*Õ2+ðÄ܉缰jA7_QF€(7Üc êbÚ¦b8]ÿö1é:îÊã¾ÀÂ}™v·rïé[gÜ9¦^w` ¸ÔUJf¼G‡ÍÍëpM¹‡œK½>.:Œü[Ÿ^áóW°Ôªû̺¶¿Ú°Œp¬H;j]5&ó=ÝFbñ:5º,M‰n,à +<¢».æÄqV1¸ƒˆ2=0Gg‘úV7]h*˜É¤«5©ï½øN^x ñ=Ëœs^¸ íwbavÍaª#ÖÅ“™cµÖÚ>ºïf¿:¸ïÔQi½cíÿÎ '>‹×PõºIBØÀ¥Ø›\“øqX >|  1µ]ʉo±B„É +kÅý)(e· +ýºÚ£¦eÊÖ*>Æ!5ÿ}¼¤ƒS„Xê4wïægÈ:ÇŸh;wóB0÷íëÁI®àè[yá`CÛyÄ.#´kw¾ÀÎyGWí¼ð€’4àœ^t:•¬åŠ7 ÄožÌ &Uõ |[§%½ÐM›ÐS7.…5 Š”‹ì»Pùh/¦ ÂÔ4Ôr.ús\ˆJ˜LîÂBc¡ÉàNÚý’“ ¡ýBóá¢|Øm^€ßƒ}•¹©ßÎ Ëõ +ç²³O6ÃgF¸r϶)Pkxaç…û°êàÐé0,Œ"ÃR8•³Í`ÅV^(q§žŠƒ½€Åû0*È0K$ÄÝl¸-8#j–Ø6µeF~¼Ô›â çX :œzÀîOžç÷ñö•\O5™ì¿{x‰wšžR »T°á…%…[-³þ乌ˆÚâîùY·ÕîGz€ˆAAâX-2ˆYÎq'’•J¬5ÙG^­¨æ±ßGÄd^Û¶´´µ|ž¿ñÝñÙŽéx3B]H†{±C+È$ ,õuç'9ap¦Žî™4ÒêH¸”aç…ïÃC#õåÞ…[ì…<¬µûP>ö-¯«·Ù ú†?•d«HhcÔ+¯ub(œ¹Œ„B^ˆQ­©à'®hýVàâžÂònVGÊÉûµííûí +Ö-ümXH¨•kL‹]DRÑd#/$´_û.òÎ(ÛÊ …í‹u“—Ï}7~?/€’”ƒµfyAP€)@†¥v#î: vBžãž ˜ÀÍÃmNý†Ø¨Nùxí½½ q¼=ÖÆÄ<£'lE@ø1â{ÁÍÒw=^¯éV^ ÍÅq•~" }s³{+*)UÝÑï§ +ÇU}7Æ4}}îwøTÙno©—²óÂ/nÛ± Å¥ÒÌßÈ +N¿·òùP)»)å…"Š²²tZ’x’ƒ=Úd‹ó=^d<\³¯/^ŸÚÊ¡ÍâÉÞyစ¾Ÿ±ÐƒJ•HìåϤÀ +ë“‹øS{AuÌbûÎILþïögõgâ*/ÄEb±  +vÑ·ë’“!¶Çî_ãù‚ðéZ­pç…ß«#mÍÁÈŒ® ~ƒ1î)ÇI8¯<Â& +zr:{ÿ½Ox!Õ&,,}kôUy,Š Cãåd‡p>áO˜7˜‚¡¡ƒí›’QxÚý­?õÄñíqç'¯³Wîë~9<' oCF`XD2í8™R¨½@øJ]iº½‰¨¸b/PSv¬í+œIxà¼pLà‹¡‹°Û^"ïj蘬°/:Vs öB«Ý@78D¨£ïÏGzÚé7Ž;/üj¯ìæ¸3pÊÇ]ì).4*ÀpžaÓ“Øà•¸›9¯¯òBÆ“©yƾX0E¤ôWº³iØUh·zÃåWxÁ“C[ƒÔóÖÏÐwÔÔÞˆæ³ÓxèÆÜ•§ªÔÏM?;/üj,ÜŒ;³‰ãÔ+Ì{2\MSiôÙ)ÜÁ ô‡E­»¥#íí'Z…§ûÖµÝÀ‚û]¼´èŽUz`…ȧÀ„~ÎÙC¼ðËÚŽ…ßÑÚûë`$=&Xb›2½æjoá†N+?–VÇ‘v·`éoä…7ÿ@7Јe–¦lÀÊáýý¼0{+ÙŽ…½]ÅÂ=u0–©O µ69CÅho£½€¥…§<Ç +GSʬñrVmû+^p % #a‚XðÑ#åÚV^Hm™å`ÇÂÞžæ…L‡E®ýØèÀƒ©¸0ußžð¥½óÉ3.ÃÓ¡ViÖ祴¿à–ø|5: æ@É×Ø s|!ܱ°·§y¡Ìp~ÆzQWáÉ4ºÑ^èt…‰¤±ù× ý‹r»)Y±à`| )}À´cao×[PfY™ÝUO•¹in:…¶³«%æcO§•M¿ö#EFŒX†uÑõ gÛýH+‚¹ZŸï;§‡Úyaooq6È3š X葺EþŽ/¸«?vº³‹5£‹’ª›xÁ=nØÉóööcXð9ïqa›ÂüPO³ó±ƒb+/bRYET_lSµ…¼YæC´~‡á~^p[lôßÅBŸ•‘ÿÔ‹ò¦*ð¡yeù´¿ +2>9œ‡·õ»aYºß‰…QÓÔÐØ4v;…È.|N7Ú !:‘j"Š‰ñË®6ð‚ó:ºì¥›ûyá÷µ;±€'Ÿ:`x;¤tEÌÓ×WicèÓ²¸ý<†¹*Äwò‚ ã)-¢pÑë! §•ç¿â… çXØÅo‡­²² îã…Ò6Ï+ø¬†ãªûyá…øi,ôÿ.6ßgrTÑA»'ƒrA¼:emÊ1eÚ¾.6Ú Q¸½•œ|áÞ>¸<³ÜÎ u€Ëv°×àO—>àGúç±Ðµ¼yRGDs/³„?¯#U¼îŸãžó9ñîºÆÕ¿wÆ1wÚéò¯·ñÂ’| Ú¸:?Ü•§êËG÷åù·±0O¿ûÀ¥ +çiR©§Ç¸ç<¢»Ì…öþ:Û·®óí|¤„¶üê +¢yª_O:yÁgØ’ Í_ÆBz¼û± ^ˆ… yªŒozš>àhÛ qsííX¸ Ñ?È `¡ÿN,\±óŠî3yþ~^ø÷ã ;/|'nêH1ÛÚ5é×’)¹Ú7Ö¶ŠÞ|ÜøÏÄw^ø,„uUÕ•¼…±½éóXrxO_qž?êÞ×7Û±°óÂXØvò{ÚùüAÛ;ºÍY8´¿§o^± ;/|7þWÍ°Ñ ;/ìí×µv^ØÛÎ ¿‰pË1¥’] w,üy^ÀÅËvyÍÞv,üq^Ø_ØÛŽ…=îü?l'ÐÜ €œò~,¨?„…=¾ðs¼à¿™Xžî¼ð¿ÆBÿïòBý^^˜âáŽENž·y+w,üCX`OG +Š¦æùAîÃd?ì!†ÿ3¦‚x?€…ð(-O’Þ7Bq×Äá†a˜Î¶¤›ÂóÀF(> íʵÂ>µÜÑÙ§6ãZâ³ÔÞFfŸÚcúÁáiⶣyÉq4›ÈÝã³ÐÒflŸZ]ÍǘG+Ž£Í¿«8ŽfO(ð£ÙÓ+{nÇ32°ù?m;Ãå| ?Æ “¼Kƒ&:l¿¼ Áyr..1àÓy¯Ø£zÞ®ÀŠS6oðdaŸZÕµ×øÔ^_iŸÚR-óŽóÀv‹DnE¶´ý¬P§ö©½­îq¶Vú°Gø´<Ž6/Q¨Ž§iOhÙéùxš}¶£öi…kLUpñúHÝsÔ_ ýa4ø')Ùmï,gãnÿ± ß„…9û Å ÌòËobaFVzyÄÛ†m±~…fúmí‘ZaÝð³äîcºõkj“«áÉѽ' [ˆ|É ã‘Š;xáQ,ÜÅ þ ì8Ú^ø?`¦ö§Àà ݽ]ÊÊÉÏŸCVßy"i¾=ÏóB÷<®ëH¯å…îÄ ÷…¯ÃkT˧};w£Òi·ùV^ø`/è“þ/X£ð)0÷Û Mó0tσáÎÉ6jÔs]o¾>¥³ƒŸºþúÔµûN=>÷ ”.~Ã^OfŸÎžŸ“Ñ®l‡˜7>Töñq4KC¾}:G³ÇHèáó G[VÇÓŒ/§Ùÿ_°0QR¼ Õ‹J2>ií<€Êæ÷M{{!&÷~=çÌ34¨ŸCñ,ª;eÛ¯£]ÐþÏXxDé?·)ïCRg/y2v^•÷1{:°±·_Cÿî-Rì¿ ü9›!©ëûÀ ‡pµÿ3@éjí‰sw*šß¾HÙÉÓôÜS“þßX0<•úÝÅXë¼ + î{Áð´Åþ]ME‘Ãv<°€ã7ƒ!úgm†{CÅð;w£l Ñ·a”þ§RîïŽâ^¤ywO‚!¹×­åýŽ…ÿ3¦(ª{u·ë]’iÞ”tÏ!¿Óx Éo,ùÒ1ÈG,<áº/Ÿ +$=à'-^UwðIkgŠïõ”F¿rÃUíU™N°à‹Çgw¿~Ê™ô€kˆ’à5¿½yÒöP÷êkeµcá×óB**¯ÀöÀe)ŸSƒp Ñá5`ˆžµÃÇ;ÃIUîXøíXÀó° öv,<”}ÑB⧱p÷‰°_˜±cá }תë»îý¼€ lîÖ²^ã­ @Qw _ Ù±ð]Xér2Fò'<…ä_~TÎîíîXøÕXƒ6z$šþ ºï—Áß‚«VÍ{¥mo;Þˆ…V©VŠü„½ðÇ°úݱå§n¶nÇÂ÷cÁéj5Q]ìXøöó`ýØ#üëçvÚüx½ø·€ÿswÇ°À³)Ðã一ñTÉÕpŽß#\¸€sæ {º;Þ ü:Lþji6ц¡Ža +¯A*’[öÓÃ4¥$™|]ú:eÌ{Þ†™ÕÑ,ÄBç:R¡KÈ%<É&À@¹¨#õ0q›L¥-“~ zœzßÌøT0"БžôDu×áI7± +8à€ÙZa÷³u¤«©ç`ܽÎ^pŒ;ùqẊ í3Б8ºá¤ëiבޅO”î•5ž¡Qñ–nn5$õg{¡å®çæd"ùt %Žàw™)'®›~¶\íx^¨‹°€]&¿‹€8ˆ®ºÙ^pLè¹™V¥-òKK€)VÁ´ +òeWŸÂïMãz¡qúyƒ[¼⩳¢6â¢g{¡Öžç¶:qDòJ,`©Dzƒ–®!¸U!Ú ¼v=8[¤»íüF{áêÏPÃ-¢\kQªŽ&©]Ð0X¨7`!B£FÖÍÔc…XHiÐwrù€\Ù`— L ƒj>`¡œÏ°/7É`I¬ôà ¸ÈPí … ¤˜¬Ÿ·Ç¸……Wcãy„pŒÉ¥ÅÂ|Ìá¯Ä^ã±¼0 EJÀ‚˜OwÁŽ…·aAÙÔaø{Á pg|N<åâ–C0kê/ DŽ£Éh7`ä-ÒNÁhI‘™±ªF5¾>ÁBd¢‚Y‚("Ð ™é0Õ Ìi# +ݺI„›ÐŒ!À}~g‚Æð‹ÍX¨uÚIœ–}Zš±Ðr̶VSôZ,08ÞàÉwà‰b:Ô‘D&û~dlÇ»°PŒÓ¸äÊ_`!^°zziƨE)@ͬ¡¸|äT{A=‰±8WMPš•†»ëù)È€ÂXN¸®¹åS;€šO±ÜÖ´BÔ¦Za‹?yÚ{ÁrÂê‘ÝV,X}­×©ÂS'ÕDPgà÷fÃä¼ 0îT…ÛøHíùð{q²ñó`ᎅw`¡óÁFÌ—$Œ:’‚ÛR³P›Þ3ÑØè"-L;FÆÙÆ Ø•î@ש&Á{VšÌ„KA}ù µ¦j@ƒ¸Ò‘Ouu~/xÆa™á`G‡ý6ŠiXdÂŽ¹Ñܤ“ú(n¤ ÍðZ^@Ç„Ò=T…&R•î}ÉÆÚÐdç…wñB§¦ŽÎ«§.’0´0X…=Å™k€YµXœ(obA€¼õ g LíBªM'c8ºû¯`8XÛè8¤`bHè¢Õ8[å&ÌÐ^¨Œû9Ø îÄ  ²O ímÀüæ©FDCeqíƒnÇí¯hãÉ!¯äœ„ƒÚ›¸Ð¨žÁlÁÓp>“ ï±r}o³z +Ê,ÃGt¥ø=àCRc7±Øì_÷eݬ£*ÑM„OñÍqg¶vað)›ñþä¿ô– ÚyÒþ$í±ð%ëÙ”ô…\Ïêæ/IøÑ ºÄs²Ø8pjÝz„WaÁ^‡©‡Ó”öB+{¡áéˆO—Óݱð,ð'J¬ìyªoj;ÞâG* ÏÛºmÙQ|ÇÂŽ…ÿ† „­wvôŸÅSwcá4[üQdÝóXèåÛ°œ:öv,¼ ˜‡)Ùækâö$’!½ ‹—ý9¬Ú§± 8}²vç…·c!âèQÍ6^•P<Ë ¾ïÅBÝ oÁŸ¥ÂÛX7/É$@J ?¬#E¦˜ +mÅ‚´™P¨+eOéH. ¦)=¦#º˜¸P®Iß¡#Å£š|ÏÙ~—ŽŠ¦“½#ê®(Ø,€DP›©ó çt¦œLÓv{Á¦°ùSXÈP®\¬û(:\P§=¼ )fëÙÓݱð,´Æh¡çÄmw<¤›ëö /¤ó"\¹²l"KžÂ.íÁä·'°àã\=•üX¨0=Þ·`aìl%g[Õy/¸3ÊG}ª #Y,T nmçk×<3¿ Ìb¡!ïÀNvÕÈŽ…÷`áÎXèP˜:Ì!{\GBÿ&æsoå…À®¤³yÔO`!¤oï9 —âÛ“ù~,„˜#îí:ÒïÅBo­ÏùûA þ{@/éöXÛл6‰¹x\Á<)L„ ”õ#Ù9È&.ÿn,ÀÆEPóéîXøX(Œî:!pñã£9¹É¦Vs=ø›s0èâhcÃÏÊ`„+ vÓ•Ç°à øƒá¦ž¾ ¡q Å|º;Þ‚…µ¦V¼ñ²ÐTM½Íqº‡° R:ùAøÛó‘Li<=!ƒ,ÕλsèƒùHEÚO,ȼäû±x!›Šåtw,|?@—-–±’ÊÝmÏS}SÛ±ðýXH9ׂŽûþ ;þ2T”‰!Š²(rîkZ³oÃBÜ!ƒÝ`£p—-ø$¿J¤Ýw._cêY,¨øìe—ºãERyçÇݱð{Á}Lžñ}Xø¤”ßutõÕý"~ý6³Œ`xd#†ú85gOb!æç[hÓÏ3ÀÖÄ|:„;Þ……©¯AGj»»± ¿ ÉÕ‰þ3¤:¾*NŸ +ªsØq”§kÎw»…yÝ÷üÌúÎv,¼ MVrÜÛ°È+AÞPwwðÂ’àݵóžt¨ÔDC:Tñ5,°2wI4f ¯,Ã.ʃ)p v=Wšj)38?£SQe&ßùp¤JÀ|L¸^s*nos½?êH“rCÚ©èÑ”îb\gXÀo,\¹`!µgÜÄ´ôsâ ž6?°Ð€hÂsy¯‡°PZ,¤¯¦¹2f#$&â¯C¡wõ™ØÚÎxl·ÞˆJ ×Fp~áè¸ÄNP¼I¹É5 æ“&ÄhP²qEÎd·F˜7¬ºÄið¿ W͸ZMèOÁbf÷?ËÙF^ˆu8¢d9øC:… +VFpÎELø3|6ŸÁm^pl^y¦.PSÞÎ9ã¶Î6•íÑ:ÛG,8ÖÇß'Ó[a‡‰›´)]dpa-"‹…Þˆ/MÇICüÿ«Ð³ÏSDeÿ'Û± 0 ½qb^kÄŒ…d^Ts ÕŒ8Z=ÀáX`üS,€h×mÈÀºMCÐ>lR6` ²¨Kf,°ù Øm,D'X¨mÉ€ ­€Ÿ¸ÖS]u¤xXÇb¡;Ũ‹è žîý o‚¿ýZ æóVêÚB«ÕV,t¸ýŽÊ”ÂGM‘YÉM·?èH8D˜² ó³Ä0Ò•k>Õ·ù$±Ð+5TÍX°:¦>#&"‘ÌgànÒ‘”ðNy!ž±Ð`õn/{ È Í¡lÑ‘jÁPè}ø…>02ƒ¹fç…·c¡›5sna7mç~Q–º™FÑl¶1Á»Á}®F¸µã¨4!RPéÑþ`;{„>Ë÷ ™¦Ws¥-/ŒX’7cÔÏ ]x }×®L?æ`½Ã<ìÁ ·mç.ŠìNyF³¥Ã Y ÈhÎWÈ µ\È d°ÕÁ@×ÜOx>eç¼`'† ß…Éq'Ï™[z«†$GÿfŠs×<Ù_(´à Ü1tÂ¥ÂôÆ]§×íµøB…YÕVK!Ó „õé¢K÷z¬-·§c8´#,ø­=àK@äz7±€ÎÌÀ®óÇc¯öBcˆ=yñ¨Ž4q“1¡Ñ+/À/%ÅÜ”ðƒµ@kyÆ ã4˜}ïÂwÙ e´íÛ »{‘½%4JãI¹ÉÆXÛèdvËAÇfiOn2˜üŠ(¼Z) ¢ýAvêL0AK[w.æ\_Í•¶¼0ux›N‹ÄSX°_G³'Äpº*µgp ™›Á•a³Ç¦ðÜwÕÄ‚ ‘;öCXS +#Uî8a­réöNŠç.ÓÎNŠ ˆFü©É”Àçø瀽v,¼ ¾È·bá#hÎÁÈ–¬ØÏóT{ý™Sk[Æçí¦½m¤×æ©JñEäÇÂ[x!Õµ}<¿ úk,$•6Ê 5üžük™‹ ;®cá“}<¯Ì§ôuX ‘ÿ5/”C¿QǬî82kªèëœí”þXÔíXøa,Œ}¤@/÷.ÜÔöµt­ýg/%Þýl$úç{ý<ž^rOw{áXp‰6š„?sUèýÑnŸ¾àTÇçåø%ç±±¹ñŽ…7`!0ÄñœÜdûùsmÇÂ>k½¸ŸÚÞv,üe,°¥ž*ÕÅ~Ev,üm‰pô ²A°ýŠìXøÛX脪\kº_  “ d(¿/lTDÎÆ9galêlïxŽdéb[’²¯äÙ«Õ/ÓÛW+%vÞ¹o9¡\£Þƒ¯'Ô¥É4ÚQ;×õ'溅í/'ß>Uø~Í>í§¤ð œJ·ô¸¸,xX†_ÄO%kþb¼ Ò¯ãù8Þh{àa=èaÏdzKæcíXxFºªÛÜú³ûžÍûÁmiælC”òŽŽüìžÁ¶úäCûÊ={åŽmERmô™\1m¤&_Ð"3;*|mœ +ƒŸe8poOÜ1ÆÁp*pŒfJ8ö€S©m¶Êåe0¥À/N9žÔw¬ðÔ˜ÀAJ< ¢å”aôÎŽÚˆydL8ÅöXé!ô 'XP-HB½ÉÇßšííÌ?[Š˜mk d§§Ò˜ÎßØÑ9_•7cÁ¹Š…Ô¾ +®b\$XI+ä lÅ‚c%Û +å`û{ "ü zp6cÁ,È ùG,c:ä ƒÝIr>Ö‚DÇ,Ì=f,¤öX;^„¬!YͶœ†AG›Ãù96/hŒúôÕ—-<Ϧ*Zhù*ý4Ç—«S|Ñ®N³À~Öåó„¼4msÁ0oéä7yãO^Ž£¦CO}Ÿ ·9 ßÅÏX•— 1§$*N%&q†ú|#Þ4­òZÁ CŸæ0«€Y8À©ùv×&e=a< ²ÌöhÀ1œ…˱‚·a!^T½äÐ/YUÑË‘dàX·šÚ ?ÂOAm”ZϽôœp½Ðòjʃÿy"DÑ} YÍàzT“ÙÓIæ‡iؾ¡[#ÆÂøé«Xx‰½CÎt$r¡1=Õ4ãéO{a²m‡ðMXH‘¤`bpŠ#uÎÇ/’à a€¶:Ð-íL ¤±EsUpeÍšG¯æ:Ÿûr†ú[°àc=U þ«Hcs¹a¦ç`ÜÀ7|.ýïÀBú*,˜þ³WO6P´Š3,„/ÚjdïÁBQùL ¿IUz6Ëøy¢â(8\Á§dÅB"MKÝ`€ËPi×É2ÑÜ…ö[°À¾Â‚_¥óCøû±¾&jž¡òsX“É—]ìæŒd¼ª|]h3ÐZ çXP…ý¹=.ËHØ4vþãsæ3ø$éæéF‰pr­ïÁº]äŒfE^ë””ÙÉ)+í vÜÚ5”ñB(€…%9¬Ÿ{ûEŸÌXˆÙ:$KXaïŒ,’oÃBä+¿4TÆ*¾1Eü^øÆÆâø»ìT_)ö,¤ÚÀƪ6Œ—ÚTT"§¶!Ft­Ñîˆô‡£-è†ÿ‘nÐEà‚^4«J¾°¹øÒ‰Oyr_דý0qÇ ­6M2%µ1zV L(ÀB$¨ÞÄS€ÃOxB¼þ&,}?úãõÜwYãþX¿#›*ñýïB ý<8§XpMÙÁ2“R.Ó"ÈŒˆRîÜ4žÐ­Ë9ú(\Ý(Çd1|ÒÕzd3/zè{wål–fTœó…ÿCÒb½¶˜‚ÆØè°Ëᎂ†ÚaºpÁ´uÛ—‚Á4.~"†î{–äÝäDü‰ðçÃ/ ¹æ‹‘óïðBâ³—q-øëئ§§ž‘HpïeCÇ”ŽÏc!' ÂCÁ3«¾$€_€Ô‘ÆÞùÚ(¸È,Ôí…fm§Ä%Q[T°"¼Ñ­u±tsè $++-Øäg0sºb!°oRT¸¨Òpaš 41Q¢†$ÕDª‚*@=S| /|­²âF%)œhNþ1^P\¿D¥|©©2úƒí¼FOÎ(âáýO¿ðÛ9á6(£(NðÍ‚ÂW‰dòt ¼`mgŒÈ0š¶&ðg^ÀtçvÀYÉÞíþè<Á‚ÖBˆÁ^ß«µ)ü0 {ú{W¢ØºŠCÁƒ÷Ýx üÿ_Žv–6iÓ6ékæÂ,7Ml X‡# psU“n#t¤— | +_éÊë¢DšY-½|šéc, ¿ªÈK¼/,oÖ¯¿=>Jî XòuÅ8"¿‰Ž¬îº®Ž6áJ’3uþ½©Vx /€.áç.%qÅ?*V¼p]9 +° âQXÕì‹èضº#¼(ÌøêRS©øªÚÊ­@A$*eÐ £eÀ÷:M¿…Bå‘îÌ,§ã…GaA°]«iÁd# +æ†XÝ U@5L{j—J;Gný·úmµ6ÙyÕ1 J´N«^O‹‚N&ßG«’S£¶>槪S»õ„®kõc,ÞátÝ‚¤[Ž¡ƒòÂè°`yህUÎ ±é9/à¨ÒVéV£÷ î/v"r^T€N Š£å…Z1Bf9¡›FEkø®)M\ 8‘¬Ê´þX€ÉV‘,V|y1{a~N…ãÑæL‚.ì6R#Ê~S«²S{ÈGœ>¿×u,âï~©øÏ £ {—КI U‘8çÀÂ`yáh/è°DÇh¢ ©kv0€N¯©‰µ¡G%l`Ë ÆÍùH ±¬OöiJÄT Cæi³ª-j:|¯d2/„À­â©öÂœTIûÞ­QÎL^¢mÛWãý],,í|ÖVšlÁ›R·™)…wMcC³0oM›Göú<;Bk4V‚.Á¼´fžáG¼JÞÏ9s9°´x—Õ¼¢Ê„I¾R^$‡:³Žï;E˜ÅBÉGDkf®èJÌ$3ŠGaª!ͼÒcŠ1‚Ô/ Ž$ è2%ô&HÚÈ$à:/7Ë`UI&y2l»ËFîàð¬T×I0–ŽX0¹æ5|µì~¤j„§åp1ɪÖIŒ>UÝ2I’ªD8b/ÂÓé9~$gÆôLÝ\îÃ(³b‘‘( òb¼P4ä›úó=ë(@É 'RɆ¬-XíôЮ”¶:¥’ëqḧÃ:á6:|yQ¾-þ¸îl±ÀÐ`…™·-+!šL 5%QßÌm‡…X欋n” eÈ•hºÀím×G?Ç‚IÀ°]PÉ‘ëÁ0Žr€)º ÌOÔÅü:€¥“ˆ~—›Õ[Óõ _íÖÃî["ka¼ö’¤'>SjÝg⦖~¡\’°O ð¾¢™hC‰Äƒ—¸ì{€ÖVÙŒùӰЫŠ1©7Š& †Røÿõ?³¾p¹Oõ¸ã´ºƒÓ¥”‡BS€"èÀDÛLˆ¼ â^eT¯ó2¬Ðü„x»»×ç«û—Xˆ¥ÃB wÜØ·Upy¹=XÈž†Q£i‰ÀÕ;ÂÝá |• ›ô¨=¥óU}ºô±ý^¢ÿët)n×+ÏÙGÏvÉØÇK7®Âc}§JÊíÛó6>g]ÆbÁé¢Gƒæ4Li%ë$MÓ]}ú÷ö#åCïÈ”SŽë:g&çEϹó¨“f·aê©´15ÖÜD_Ù°p>ÀÉ4Ð +ÄBXˆ C% gïN±,;0 /Sî§÷È …µ=.̯îGú¿-o°ðV«-› ‹‰®ùLqzçÚš”MÉÕb¡Fõ±'í45Ѭ×i"ÉØú‘z‚Ê2EÓM‘ðê.ä ^À‘ ìÓµ·Ýš-¼äFI +íVË þhšŠoŸlóXx§#-ñ!‘ëû‘ +º®Ç©ûGyá4P®L%y¡;b!G,Œ$Õ¸š÷•VP‘ÖÍÞûÈïqâ…#R ‹…@ÆaJÌ6_Á÷‰å…dÃBð@?’Ç‚î&oÞoÉ$Š(I”~=â…`φ¡[§ìÌAˆk²–NX¨yiu•²§}Ì‘,,ðˆSú‹‹“¯)iÎt$ŒuŽãk±€®FP­z»¡ŸÙÎæ /¬;/°e.‚…WFùh,Ì1‹ª¤(ÞNŸU‚Þ匿Ú~¤G•“ÆDTÂD»êð /`BÓÍ +¦ûIÑpÓ‘†×uÓv¼É0å<ŽTÉU˜q?tq´­(°[¼ª¤D¨>Æ^HO+vÉÉ1%nï[§×—øR{s¼]–Aº;–w›ß¢kÇ9˜[å‡ú¸¨ßU™û.hÝ#æ±| ÐeZƒõ/Dÿî@%Fë$3Ý«íGzTYXÀƒX +÷#[?R†Ùì¸/àŽßÍ^ÀMl#žc~ãGêô¶uÁiV•Ò¼Yf˜„ØMÓ i=¹‘;®¿1ÜÑ7/ðØîE˜%êt²9€œ|øõíà¢õu‘p’oÅT?òÓ]º-¯­n[(ÔjɹԼ0™ŠJ8½SäXÈçµ$"Þ5½¶“]/_l?R™e9ƒÃâx•²j\õbr˜ïtˆ`;'k½õîÐm­]p¥ .Àk²:Ci +øzfŠ°¢Ø»G,I&<2³[âË’#xâÝ;‰ïBOe[ŸCƒ`!8Ç3,|°V_?놅·ŒJÙwüdR]¶$»Š…hÇ.ê[Wr†³Q°µ¯"Ä‚ˆR>¡ç4 ß{9rÝ¡Í°m#y^8<|Æ'Æ—)X ; ¢¼EË%yXš–ã¢ÍÓO݇iA‹$Xܲû¡5K{*´V²*GèŠ(Ÿw,Œ4Çÿøõl9s­q/Õ$ šTsdF`耒–v ‰Óœ¾ç—7§G^0<Úü9‹l‡¬ïöÚ¶†uë6DÿÞ>Õ–ÒOZž ‡ …Ü$°Ö\ª¾¹®Q›0ŠÂnDêt%·ìZ¢Õ…” ­I‰¦Ï7» CŒãWnË¿à–\Ò÷àÎmà…ÿ îó(dˆJçjsø§ºÂ h7u õ\Eïøë!~¤Û%ži;ÏóáÅxáQXøüüBzÿ«ë ¸b;?¢Ìyþ ÉVgQXã£éÀ\Lqyçâäµ3ƒ®h&9[äJ h ¸ò¾r^aÜh—ºCBªÙ ÒT`ržŸï9bìÜËMVk(TJ€}•kÜ‚tèåÁänàÏy!¢d…+2u¾ß¤#¿„…ÜÅ­Û ³oŸêƒÏòüñ8½ÛlÛ§­2b÷pì öB0¥™àMb¸ˆ’oËîÈ ÌÄ*8 ÔRµä¼³`Ó‘ëYà'üú8Q¥8u ëjˆÔ!ÄS2úÐõŒD±?ñµÇÑ£y‰…Ÿ.°Ü‹…EMó‚%~5^øö>Õöbq¸Þ×Þڀ巰p¾°Ÿ®Íµ˜'ow„ß·ûæ1XØ=9ö_°¤$œ@Å€…AsªÃ}!v‰ƒ¯G,€02™·šÃ%:ía›ÆaµÐvHs¾Üh)"ºpwP#Sü/TíÅ +žËu~Î èHQ‘ÚàD—X¨äï`¡½ Qó:¼Í7“ ÝÅñÛ8Ìq~د}PhP}êÜšÉÛš95˧aâ–* Ã‚=ÒÛH? }h± øX—M³-qœ°€3¾P9U\ÒÍèG6Cã¼FJs—œÒq„ †;únØáiÄBí¼—øÜ‘ºÏéf1[Û9@.½ÄBú¨L ŸéHÃ0ÇXØ‹ñ´¢ÏVë; Mý#nzë…ŒIkÈ“‡caØÔ~;noE“ ö”ïšæ/”È ‹]>cíl}—©¬Ï4™×ðÉB¤É8d ÎX-êHè»)ªG¥ f`×à±úÍv&2{«#Éòw°)k0è5n^5vW¦rÁßjúbÛûÿ œ-VàÐöWÒW=„ŸcAìÓÕ°°‡g¦ ˜Ì Mxr &fèY æ´ Ä*?ñ{,à 5ÜΖ«,DÙßmgζ8ê|G‡icv‹#ù·^#ÀBóY¤Ûn ·}ð¢%ët_ ÜúÂa;gŠ¸Ì ô_â…å3–Èe‰ûUL£óÒ†iFÙÂÉÑ ÿTË•®]݃q^jbæ:6q=›2˜“pœ– K@-³gÜXÍ×+§v7oÙUâ^7*̤lŠ3_£^¹v¼pŽ…ÚéHLu ¬|E«eRt¢/¸‚¯*ëƒ9_¦Š%c ’DìÏ+.ȃ†&¸l Šž«×®Yjiçâm}¨%¾À™~ /k/\ZŸ¶` ÄâvDZó+ñÂuë¬Öþ£è +Wa-•JT[ááµ½ð DÓ:Î?´¯btVÝJqö“tR’SE JêU‚ÞNtø$ÛY×Ú’â~¤¢'FGz!b1Mq?îqËî´‚ÿ{WâÛÆ 5I"+ú"»Õ~J.•zÚô—æ£Æ;¬K·÷+ÔfæaÍ÷÷“«"¾Ôöý¶}+곡=¨ðw°P®x,Üä…TZ¿ð„†©ÖµZŽV†«6rÚågZÑ|m­ h1P +*=¡ XëjnÝ!…Yçæ¿ò&Ïñ=ð³Gèûµ6<¹€;00\%E°ÄHŠ #%8+òÑàV‹é=†".óŸcÁt듬’þY›”ˆ_ÂLed]×m¾xM^4&Xhr¤ü®æ [L‘iZÿæ–%WOp*‚ÇFÐp2,ØO0 ÉL|íTã'fž=Å°f%ÜLƒ ('àÁ†dÛ.“„§×ºùý€”XˆùSRöµƒJž……æa~…O° ºÞ¦íØ‚ï¼&/代ÁfhÀ·±}5áùo’m9²@³.àŒÔ²œ&ƒõ &œH‰[¨›ÏÎâóü-6LW cžÈæ W rÌêƒ\&¨mè‘{7.÷l×Á3ä5|J ÷.ö[X¸Ì$ø:¼ æv99ݶ‡WViMë ìµâª½Ð"¨ŒøAV<±XØrvÖ ªn ¶ç» ‹i|a/¼Ã¢µ +3¨5æ·{,/€Ž´’Ãã…•„vFñb¼pŽ…@sÉ¥ ^ª:õcÕÑ0âw,ª|}¯ž ›H£×T½š#/€vj ÏúŒ¼üÐTq¾·‘ª&˜:”í#/¬Ù¢ú8„çò&[øt ½ÇÂS±€‘H^e­í&/€ÀbAÁ[F®A qiþoÏ¡oÄ·gb<9ââ@ÖŒ^7>Â#‰~Ç:—±Â®¿ó +W–pïA3¢3ŸÚš+hóZàB‚=òöVm+Ìcá?u%œ_ŒÎ÷©í«[¶œãÊPÑïkš¶;Kw0ª,}Q/&kÜ1¡âž®ßˬaUq´¶OCï®ìJ ir&kI_‘¼Œk}çÒñÖùûù½$ßÛÇý ŸªÇÂe!6Òj÷±Â.÷©ŽCðŽz{Äþü wå´­›ï öåZÛõó Á÷¥´Öæ±ð‘ERÁX®_`­íæúB ª4­ªÈPM¨aó#ÝÂÂ9mÍw\üwìÁ0¢ûÖCïGz:öýHƒó‰¼æº3È ùàžºansÙ]¼UéUíü[I§Î÷(Ѫz`u©j…_ÁÂvøï5yAÄq\ÀÐ/¦(e,>ÂÂü¤ÁŒ=KîJöÝ\ wbq{Ì*R/sþyñTÃ<σÈmp ¦¾µöQ‚Xc ÆGšº-g÷8¹$émžáï7(€âÎV/+wû,zœ¨\ͱ«oË\26Îœ_êÂÖüCäz,Ük/`69Îuóñ¹¶ò½Êð²ç+ÕÇçãZÛàN/6i›R¸pЕ.A¶*0 ·Òvo}¥µÔöXN>µ.wvðö,OÀIÛÙŸðÂŒcÍ5æ‰:9¶šg{¤Êf!Ç´&Ò-0¤ëâ~¯Í£Îòx,Ü®I˜ùäuN·á:ÃB9(nÛsÀ¥’~ž~ò¡X!ú\½¸Å ¶´ß&æ¨?µdþ\|¬õ0ɹ°¹KÎÛ2ž4,›sÐÝÒB) á‹8ø%Ô}¸±óY¥sÛNкwgy¢Nѹð@‘!ñ ÷X ùV3_bæPs¢ÇØP…Φ±u ¿÷¸›û1gy<n»=±tŽôò].Á!\ãÒР×#ëÅç¯ã„=7muFÛM +á“»¬ÍðwÔy¯`A\û&í÷xAÈcKÍEÔ*³û°à²[ +¦{œš Y›³ã»‡}9³‘"z7N))ãs«·ÄUï÷#… *Úiæ2ûàÁˆ ,$çRPÞ\²°Å2ëˆÂD™Þôd,„JrŒç +E¾³\*E +o ±²0¨L|„3º@K5:ø÷­ü`îw‹6AÂÞîIî@0Þa!–MÔJ.÷óBÉŽ:é¥î‡“6¤>wŒfóRnjK¯ÅÖz8ç…lÇ“¸êÀZøÆDL™¡¼t‡q—cµNg}‹çÅô µŽi·]®b1‚{oË›€šÉìAS`ÏhóÍE:…ûì…¶ÊU_Uäô:ð´£›ªZNÅù.åwX˜$ž›†Š"ÝD!ê # mr¾BÆ þ>é¨~o}Vû̇/÷SlŒ·m»—ñT¥Zßµ4hû ­L›}Öèþ> ÃbñÕðãÜ{Á C’¦<в-îŽËÒÕºßô5×b¡$rOreÞØ =ÖL‘9doÙåt 1!À©¥‹è'à±p§í,.Q½ÃBÉæ&A ý!/#Šl¡”#x}áŸÒfK +LÖî*§¤0ÌåhÆ®+)Ó–cg1Jim€[ûT]KoЩ¸I%¥1×üó(! ŒÚ8r[‡ÎìgÁ®8ZLlÜWw¬wìu´w+ÕK–#ÖŒY\O©Ïx¹š'®¸Zéã)…z‚NÊjþY…{ýH8£t“ ,L`Òֺʎ«§ñǼpÄ‚FÕ$Â}.ÍDb£9, r¼Å  ­r¡ñ +Åë­X•ç6ê­}ªÇ–Å—°@;1Dmr‡ãÉÚ  8ãßà…®¥”ÎNyÉ•dÇ”$0åG6èYÑ9•L}öÆ^Àsp˜àíÌá‚r¬yq5ƒ’Xœñ”/H¨9Ç:)¦±òXx6ÆSÐ ÛÙælh@Þ_Âg¼ 0úF¸á.|\sš[I²óBÓÝÄÕ-æFITþ¨î / níS=¶4F%«’PAl¤ê^Ûyï6qzW•^µ–ÔîƒÕ9sáY×.<>%ëyO5êö„“[ÌLƒ«öÂ\aÍT%[9V/1_6É)ˆÞvþ± è÷¡€ÜÅ ƒVŒcfÊJi›øš·¡Å|6+Ø õú½`"P¼áSÓØ|®¯VÈš¢|@“òV¯dn1åm{ÓÊ& +²cšÌEE AÀ ƒ´­/ û4œxa½Å Wö#TøTˆãY¶·²ËÞ ° 0å†L@”A·¦î¤I#?dבF~ÍŸØ Ü[be9z–besvÈ Wû\³BÍ +¦aD?­ÃBý“HÓ ÷`¡ÌûA­cßÃ?Ím,´Šd†Jö€ˤìc,n’´¨œ›&„tg‰ñ/PÜSâjlË +”ÄÇíuçK,È#/œ9e.°p¾©[§Â$§áÄW4 èØýb¶0VÃÁ(a.‰»ƒƒU„Ô0 X¨]‡Rr¹7/]×6¬O+po…6Væt>Q#>gÆsð«]§ ï[Sxl»so/Nñ{óžË ˜…s'r›¯ëpý®›íö0ÂOxÛåÞA:[t}Яé'X ý°*Ž÷5hžì¼€qœ'Q»Ûák¼XÈ”Š>ӑ޳ĥä„Ó­_ñÓE„:tË…ýÛó oj®?zîEÍË +#â÷l?{}¡[n¬/”áéÎ¥ª1ð,Å ÛY!Á ˜üHÖÁ„u®›ð–¡·åC,pÜÀæÆ*´äÑ^X@u(ygŠÌäÌÜæ…cKËhÁ,i&ÃìxãW‡;°ðájwuÿ:WŽwœå9–/äœJRo;ÿ‚í\2ÃØó/à4ˆ¥AI¶F²qù‹ùlrœ¸›æ&ÊSS£3S°íp<~[ÎnOÓƒö©†§wæOr~!?OyG<Õóièþ&C#üÏçÛÎ\It…þüüB)ŠcR1ïRPÐ#J,ÆÅ|¸…³ödüæ+Ðù…'ëzRÕþìÿ³±P†”d”ÑO±ð˜ó •¾½Aï#^qÛöúÝkqVÕeÉ.0ÄqßÏ×Õˆõd/´ý”í¼Ì[¸ŒÖã©Îû!¸o×lÚÎÇ +û%,L¯vÞùp™ÓÖ†…Í×ýð'?Rm”}å´¾èߘ¿7â©öÐÚW–ÊÊþ­7ØÛÎÏ÷#¢_í¼óò 6¶b4I‡Å´Ózç,Zãú‚¶.T}%.Òá­ËözNÛP‚û‚HÆïœÁ Ï·WÊiªWËãy 2¹ÒºM@cúª¾ä¶Õ8±gf€L„­=IACa][m¸w²´_Ív#Ý›EƒôŠçˆØm~)žy("¼ áÜÀ7ŒcÍ'g–{Øb7*eщ¥sÞcáníù%ã©Z,dŒá’\®“※{ê¯E~9lDA(;eá„hÌV¹pw²€4ðH7eˆBmŠã±ü ó{÷3U  f>›~ZmÔì–Û?S²k†‡)~ÀµñѪVÈIã±p7˜aŒ_ ·ö©:ÛY9 ®ÁðÁ]®û~¿÷å2F>õ…Sdöi—ª<£²1îµnaZŸÂM¤É’ndÓÈv!Ä„*‘®Šqé¥ã3q1`NšÔAun4éugkæ¤9Ƙ fgf2ϼ6 ®,ê£Îå}ªÏÇB­IW÷{¼·×áVåçg[•Az06·MÏSòú¦µ|eÝ99n\oq ÑHl†“L¥¸¤~¶[¢ÜŽê5ª2LC<”¶­W㩶Ç¡‡Ú«TŒ‰Ûlîp¨9µY 룩EÀOx‚‚õ{«üZÛÓ±¹³æŒ7/Æ oÊ1¼pM¶På­E»ëñTóS8QO0i!¸Ã)Ħ±ªì¿kã®%MCt„.>ó#[Øa¿‚Ú5p¤­Èn)ßÿuXòiÖU‡B†˜ÜÛο‰…vÓªGùÂñT¶³q¼âTËô^ØOöܱV/ŒkÙ­ˆ<QÙóˆ ü×a!QÍÔL}›½ÅÂe|¤ÙÅòg[h‹z6«–#Ÿ,—*(C,À¿¤vIûya½À‚ô|‰4h*´@Àmâ…yx!–$6ý­=w×㩺¨,¨*u¨£|ÇE‚¢Ê/`¢°3>J¬7-ˆÅמ‘í\ ¶UL ¶šBÑÍÇ 6¨@#Bl6 Sˆ 7ï¹X(A2AXÐñÿ /€#ùÍ=¢—¼p/ýx¦…osÚvZ}f¤Gó¹"oºvN2훜¶VŸ…ÊÎsÎ/%8ñXø-,L¯¶‰¥é7ý*7²›îÍg²sŠ/ø…tóòÁ0\n0ºZÎö’K¯[æÂcá©Xx¥3žZ_¸ÜƒQ¾ñ©2›Ž$‹ðD› Ì,!ƒ/PË6Yp…ºÁ“m²Ký|¿9r ,Êâ_s[23‡b¯™â6ûð­æàQn2…{mç•þ"g<–ßù ƒä—™‰´&%ž?k„©‰Ôï@‹lÛ nM%×z`Vx.”çÖÒócB’ŸŸZž´’,u5“Ô!™”^+3ãö Û u‡-@ëíMâÅ‚†‹Ç¯èH»$ü¼ ?ˆ!9ó¡ ª;DªÇtsÉAIi™´r‚NÒ¢S,æ+KáãÄ…9(za;CòÀ§Ã¢ú,R9à¢KŠÓH©„Âßl³^gÙ—¹l ÂßËó¶ó/`!ÂÓÿÃá°ð^Xß'#µ™ÐnÍ¥ õž– '6Ùë˜ &±9„¥M…uËÔ½±•×Þt¸%µÇ\Âf‹ÀØÉh¡à¹þpö€¡d#a.OF z…çb!פÎ;%_`ƃxaÙSN;%1ŽË·X (u‘2ÙT¡±<ÂE0q<=¡K×E¹Ø¨¯Ï·‰¸d×çV¹)›¨ ÿeâß­PÅ!o°fø³Ujµ^æ"VØs±»E¶—8ãù;ñT9`çúP• 8·£À"À¨,Ì<€âBƧû iÄÃÎ6Yz3ažŠèˆ…J«µu OôÐIcÊ’ÝÍímçßÂÝÜÑÉò¿·O5 +*ö–ìéµD:^@ ™8,È•Ù„Tðgœ™¸Öt?w}lƒËõÀ‚M†(†XˆÏ° {„@‘âÂ9å ǯbÁ&B³É‘_ŒXP'Ÿwù 6´ÒJ6iç…5ƈ09&¦jld|Ì?[\ÄFªÖóm×o×Á^H¬¯æ’zƒ€ëµå<èƒ2Þ Œ6$õXxº½0Œ“T/æwö#8 +.¢"k"X^Øt¤Uõû¡×#U¤—\XSúÂvžocÍ¢z2ºFÑØy¨®á ­:±fÂlZ"ïGúe?Ò %é^Îô¨ýHI\îS Àp=ô-ã“uv˜)¸!ªìA³9ˆÌ2u&Zå°`F,q…shÐ:¿€¦ø‰;¾R—þ]À¯eàþX&Þ/ð¹mj›¡(¹X¹ðXø ,˜óLaþüÂW‡w¼tQQö¨šûK£<¦Ô¯µýÌ«`á ¼ð³2Ëójæ:ûà±ð—±Ýüëc,èâ¼7ÃY=  ýÀS[_z‘Xq¾¢p~»æáI>>ÒË`!‹‹»þS:¾ÀBËî»QêìFFßœ8?Þƒñµ²°70WØÎ_ã…7õqóþ0Fy1AbœëûŠ¾XCê¾pã›Æ•LœòÃGvþ×íßÞîÁ°+,öj¨Ð¦C`ûG÷ÿÛGV/sÙ~Ÿ +×^÷#‰Óâ¼÷,Q^ÔÇÞ]æ>zÛù÷± É½E]ˆô\Ý_.æáö 7^v%WRJ²‹øÈf{ë‚à_dŸ´ük7E¿Àë4î…h/0Ÿx5)¾˜…ã •”)Ü Wa©r¼ *¥CéŠÇ˜A¡ÇÅ3ÙâCµNgöƒ { &Ch‘‚J Éð¬U‰”û³Z¬Úô*‰m}½cÅ„6Åy¯HÔ¬~}áW±¯+¹ó?kø÷Ìæ“>:Wük? Æ$þµ«T%Á¿vÔyy–§Ö:0%$ù·¶:Ô¼¥wÈñ·i›—×26‘MQÒàÔæ³î´¦fÖï ˜Ørà€) ¡EP \Xa%ª0Õö,PªBÜ© õA%…ÂúàŽÛ Kì–¼ïð¶óïbá•J-ïä…ò‚`¾åçΟ@Z^–ì\I²;yAJË œš—o·&17ËK˜åÁJ‚ë¼À-/(nyaÜî8çhóXðX¸YÐìÌ&8 û%ÄÛß.l‰·Õ„3íû¢¼0 ì#Üy5§ÎŸÛ ì+m»ðX‰5ŽÏ²'çØ™½Pn¶ÉÙ¥8Ù  ¾ü¨x,x,øâ±ðX,ˆ|üaô7¨¡ûª ?ëÆZü´ëÉØ?ľë±~úɉt©ÇÂßƺdª×ðÕ#Yôäú~™ôw—§.Ë¢.Žn>§¬Zç  ñ‚…öX¾½<å±à±pMéùôC©–Ó—u¤AŽ?ב8ŒŽÔ˾xö{ª8ñ:ÒŸ·ë凔Í×£÷fÓ6?çÕcÆP< +Æô©ñXøëXèþ,4ÀBð˜1dÃ/`aôXðXðXð¼à±à±àyÁcÁcÁó‚Ç‚Ç‚çÏ   ž<<?ÁN‹·^ìó¡bè´íÍe§Ý0m-vf{§—6[§íÝù0¹N‹«ŽO^¶N·XÛÙ0ÁhÚ7]ßèô²ñ®ÓÙMÙ07d;]žwºýP6rlfw9LËþÛE§ï” c:Ý•†kU˜J£Ÿžh=ªõhL£55±Ò]݉L,5pƒ®Œ€;bhümÄËf­‰]±ªL¦ð2¨­3Â.ƒ%}î+ÞÚ;z­ÛÓ]a[L„wÀeX›Òƒ1>”)¼¬ÇÕ%¨M1w¶ø€×ظlQ¸8àŠÜ!…Im8ÞOXÜ[í!>ƒàÚÖf;Ýî±Ó«ítb˜ÄÚÎ:]ÙU9h±¦ÎÞQ™âÓN_Sj‡É¶xï4ta:ët‰w¸NÇ®™‚œ:½Ú!܇©>uº·m‹·N8°íÞé}˜rìBl[l‡©ä§N÷o:]Þ'¸ÆhGzØ:M¿,̈í4ãÇNA6NÖ·:ý‘llM„¯3¼âì%_ëï%ìû»KVjÅ¢¼-“m=ˆžúK,ì/yÑ[í"æ(PÛÙ9±¨±m¸LlX€f²í%-ãí ½Å¢ϱð®Ógbñ®Óv˜`¼Ï°Ÿ½d¾uÚ‰Eq‹v¦#Ì&d¶Ó‡K,œuz ;œ Ó¼“í´,·—LN/yØšy.‡)°-f·±¿;}‡lœwº¹ÚéOeƒÉ‹ €¹f~.gód¸Oó†…w²¡nÉÆby:¦ PyšÎ?2')P2M“ˆ$¥ö#Pb”† ¤)P¢½cIñ·6Mb¼hgNÓÞ—-¶¶(J“¥[mÂÉû;–í¡™½ƒâoìò¡xTìj›OÏwwÌx³µ-ø<.;؇ºËöÚlǨ½Ãvl¿ãøÛe§á¡™)ß>ôl˜ŠíŽËN—o;]tš^¦·.ßvz¹5Lîùóön²­ÓÑõN_St1Lwwúºl”÷¼éeýÛéÒvaù¢l|½Ó§;B\XqÂè‹/ÿrÉÒ€úQðųi”,Ëüº»/ ÓfÇùâË?]–±ÖvöÅ_L%¹ß²îË?^J&ÀR(¡ø±ðåß.TÊ΂/¾ì¶süð¸¾/¾¼| ¥ê¼íì‹/h/0á±à‹/GvèºÖ‚/ÿvÉì&+_|ñÅÙÎ%Þ§ê‹Ç`!2ñcáË¿]æ~H½íì‹/{ ”ç_|Áâ<«¾øò/—v%_|9žåYìÏ7u©§¡BúZr·a$Ì3sÈ¡ikÝ`¢¦SR 6¸Éu´ú˜Euõ°ß]³®yc{±üv°å²šjzµ¡"hïhúÿ–±‰RjŠœ^©¤éœK½Û®óÙ°”AôåQü°0¼ÄYžrÔZjÍ1BÎÖØQSl¿-äÂϵV§ +¾)úúL] ¸=¯w,Å`Ȇ7ç3â[–šÖM­®5´¸îÎj<û+˜ RÈÞ´úÝ.˲ÑCs<²Þ¶K ŸØšL'!H†¿ªŽQÔ¾„©×ã¡d‘’Ù ½ÅB½´-­1öQ!c‡fϨc¡Öw`až}3ñ‰ôö‘òU23'פ#ÖW•×2j/n/Í èÇo¯`!‚×éà¹XÈ>“‘œ÷{)+iš?€nskÉ î3Qð’ì%ó> ª8DNcmB¼"LÁÕ)‡¼ñäF›à%e,Ê6r‰H²hqXXÜMlfßé°4¬\BRFK‰÷•,tU³ÐÞO1êVb¿L„ j"†iÇeÿ4ŒË­Î˜&ðzØËh2—g¼ÀÜØeLPÐOJ|jlŸ*ˆ, < Ü° htʧ’Âs,@˜{†½Ê5:â×{g¶ÇÁ¿I+¶Dn^Y¢,S•¶véV¥ÙãÃXéêØäÒ6Ù¸&›F¥mæÁ5`Û ºù¿GÈ«xzítnA‹7¼à>JÄŠgVî·ôP¹è+0ƉTJK¨ [áŸ-/„j* åp è±Wø”[ÎPj,ˆ¾À›öGƒ" 30‡Js3ÂEzÍL+{TÜ0¥ÔJ &Á›˜¶{k²j¹€Ò”ðî ‹Õ䔜¤•­nVU +Ü@Vx¾ ±5VÍS¨M†× Z­@éd£ÕÌ;CÝSg Ö% >êßZ,DØŒ£KÉSúÖoã¿jøÈôʆÂÿÁؼ‡ÄþµàaG¼šFz|ŒsÙc Ù +Ê(wÓ'…'’RLpÉÞb3MÌ#pÉ®ªÝ@ Ðãþt¯~Rº;€^©É~j ”úçŸ-DŸÏvïxbì´ +^Jwœ®€B$Íj]ƒù)¸¢Qi‡Nª3Éi–‘ÄJmKô wu HC¢ŸÄ­”Üy“$ÆLé:]rÐÌ–&\ +¢¼$ -jÍàa•ÚhY•ÍD žFHX‰–éÀ…LB«ríô7ÑrNEÈ$ ‘Ëê]ªûe© ÕG^ zÊ@øZ%I«,ûTlöÂ%…‹ó…möB«Èœ¥ëJ´^gJ^~h¹¡^çC—cEµ–9T2â ähZ u×fVͼD êƒ=2¶ ¼c…Ú5¨°%q³S "dí¤7Ë¡y"›…Ñäi«ØIb“W€‘¤lQ¼-ð‘ g;ɶˆPËý ~¤¨™þ¸ŽDÎ4üK^+!0ÕâÜÂ<©epÄBd5j³ÔËÍ >¡U›t0ÃF +sàÖÛ5VðªA#Cx‰ÐÊáíÂoí¹*_Ãó˜ÂW–Ô¨c)˜¡­Øét8–`HÇl†Áê£312‹¸°ä>`«†Ý®çMúŠª8¨4è÷)åt²&‘+àa=ÞÊä¸?ZŠö D‹±0b7Ì$·V!¢ù²m6s6,í™c¥I•3¾üã,b¿þ%pÎ0²1­õÈY–‡{­ÂAJÍŠ‘GiT ˆÌΨñø½Àï'àÄÕítÜjB{¡¶‘KGUÚgŽÔEÃÿZÆ(áõ+ØΫ.Îð{Î ’pÒÔ›A™E@Åõn/0'è`CÔQ.Nv©V¶Ž^7kÓp +䘼"ƒG›@àj ÍÇ ÞÎAbå Ôp„Û éfOÊÔ" ƒz8Ô»Â{îðé ‘_×S©­;ƒŒÂWˆ ¨•4Ú5Àg¼°n é¶Œm?Vx@ºÃ‚D,ÔH/ðd¾ V¤×¸×A(é¦Øwç~J¸ÎÍ%ä +¯­ ž†ˆoqÔ¤(eogÊ,:c…›â]vô¤ûÈöÊpµ˜€Þæš9,8«e€&OyÃûr°³S +„^ÿ½Yooýç±0h÷>EÁ˯¶ïÚ#.Ðhv‹1ßfÅÜ&¹ 4‹Wk˜¼“Mó‡þ6çÆIOÓÔ }Ëìüd±€H€h¸ {‹…Üj–Z5µå”P'RTÞ+p‰&Pï4TvÊß°ÚyqsaUê-/ ôPù ·Ö0/í>l‚ÕëÅùTé/° \M th,ŽÓ3ƒI`ËNJ·Y"¶Ü8ÏøųXÈïKØQƒÁtè,ÄvÜ †ŽRï¹J3«Zçݸ±·Ãôa¾a¡Ú|HƒDªsã~pX0a¯´þ#çî—(Êþ6Âí=† xdÛ°­`Cœa¡Úœ©û ìì8*aLƒ:’›œh/j%,iÊ9Š`vXHœ€~¤¢0å<èäRG²s'h4TÀEã‰ÄRš"ýb¶l€)3’_žc:ÀɪŠoðªCfgé/‹ÎaÃHæ‰PO:בV¾uÈNs•›LîB»ØË@9wÐfí BmX°ë%_Ñæa(µ'^(w U"ÀX»nÓòÂ6=!Mm(pTs 4j²Ó4Ó6©žj\­œoDzç æ<³¼v¶ ÛÂ×k¾ûi@ÞãâTBxÎhì…_1UúhO¨VÙ «ó™¥ƒ«#_Ã$—NœÔpOÒo[œÊ` ¦I2qÎÁ®Në2³ J¡º"'|Âév ­Æ9ÞkĺÄÌÖ+“Z­ëÃzw‹•»ÿ5Â&P"|h£Ž¹'Y¥„p}4¢‹)\;Mš—ð´•ð~kŸÌàöéè‘9tÐ…ƒ©v·yÛs‚VU…~w æqyjok‚fÁpÀ¨M”vc¿¡#t`øÔ⶧¨á$Ø—õ£fvÜhm:ÒÖdŠýujûžlrGx™n´âë.ÓÚõŸïˆËRÜëõ‚gy^õL*æs¯ç=Ú!y¹NZ{áEKÅ}<Õß2Ð@«™û¯8M÷XøéUØ…òÿ÷Rñû»Ž×þ³¼@Ôtä:­53e dÕ1¦k¡/:›Žpí0\A[5Ôb!wE ~ „•–Õ&r¬ÂehrL§ÄÝ:Úl‘á´ööC\¯5s£×´DÂ6tXÇ Ó#†¨‘ãÛ›uü{Á¬ÝŒxYØ/`!$R68Ë$%Á—0p)§ÃŠ~A;>‡_:ø²Ë+.9|“®‘Ü&ïà‹à +/2‘Ô²7]¿ý‚ùŸú:põ°Qºoþa,Ô5ÂÀòB§y£äb­H€I–t#& ùþ¢(¨5\麂o*=m/eÒdÕ„ÁÅ®I0…Œ*æ´—Ä&®5Ÿ¤ŠàyR5RW^ʈÔAß»"+¸Iâó‚íY nFú|,Dš§fU>H™§\͆¨:10æ*vÆ…†_àEŒzH;L Žù‰s ×vZ Gâô˜˜‹8×MÒéqw•Ø“îá—ÞæDÎs%…éT zü·±`¸Ì,/XerÁÔâ #Yed¼4£tÙÇ\Æ¥ÔÑAºMu¿½· +ƒÛ3ÕµLd x¢¦Ç‹0©¹­™Y"gS®Ò&¡ÆGØè—%“˜ãzR sŸ›Yý9_~EísýHG,œrÃ[ˬÕù¢pl¯Ä‘”õLÖår`Gð²BÇï5J¡F€”M›­B6øA±u$À‚}!Ðjð…œÜð½‹úW¶â’¿‹…Èõ÷^ņ™ZvæeyP«,„œà”vø#cÍÝ@÷ê8Ø—#¢¢³Ff-·¯4‹Ýb.ó>,Ps¢ÃÙN‡óÍzë5 ~i îæ ÙçéUK‰:µÀtIª«¦e> Œ³Å@ õq ¶ädW•ÐAòùjAXÈ\ÍRçt×0pôQGš,Ê°HŠx©þÜ{—£êWlç'v )ä.5 (‰XØüHdËÞk4Û˜+~SÀ;êp +*a +›´Â¢#œ˜ŒÙmg˜éF[ËÞ¢£Cx-ñ¨´&á¿Ž…‚Ë +d“È4M«$ŒíeªÎ¹áC Eé°€³‹tX¨ó]¨K+ù¦Ü°P¨Üa…ÝbAˆÂšÓ(s<ò‚KëNáåoX€×X$ýÜïàrþ +¨KðÝH—½»lãôüHôÄ 3ëN¼€Céx¡u¼zj¶²ÌyíLÑn¼ÀücûBv,Àïa§¤øDZc!a´F;@aÍÜ+8LÇyƒoEX¥4ÜyaÓ3ÝK ˆ5À_¾ºaáŒPGJî3šk&♵@ük}°ªQxä…¸­ +ð׎R:?Ò¯èHÌê‹0ˆ­ + &AŽ#iøäÔZÁa¿äøÉTŸ™}m^v{!±–DïhÃB"â¯ÖÅ/ %ùËX- †-Ô`ýΊ£V \‚„&Öo’è±4­äBX^@‹®E×…£ÝÎZrð 0æÀË ŸUµ¦ Ò>y¡Õ«Àš ;b}Râže§_)gû¹¶³zøO€Nº…rEñmЖè9Ñ}<7Zt¤BÊp™¬Éœg•âìÄ ÝÎ Paup<{]gŒp«yŠ¢XdÆ´X@º^upˆ$ÿ×u$Pó­ .Ð`.HŠÂ.¦ ƒ¶óP‡¿ð{Ç|µiIøN÷‘Rîî÷¼`*÷£¿uj” +44ÄSûÌö„˜êï퀳Qžz®¸h•0*hù'~@„–‘=¨þC¥¢M©D–%ÚæE‰á'ÝÀ@7yAUðz @êæÐl¿‰*œ€ö-KÅ m‰fõ‚ç_ î6—_vÛ9zêÇÂcáß.¡T½·½½à‹1¢ÀÅYÏ ¾lš’ב<þù‡¡Ïië±à‹9æ´õÅÛ  [Ü^ˆô3@õœ Ž©zfœB>=¯n6·ÙÏýHÿ9~úbÿ(ÂÄB¥ŠÅ‚+IÓ„/Ï ž~Î m{øy-žÌÖ=/ü.‡ìÁð¼àyáõya‹§: ô¥±àíÏ ?ŸÑW’ÿØΞÃÂLm|i_Þh|ŽB[¶ÈGt1óvx%âšíœµ­çÏ Oà…pOhòæ}i¥õ»`D‡KM]Ô µ‚‡Ÿaa²ã”%tHm=Î%Ëx°w–÷¦ÙZD9»†o/x{á9¼Ð)ήÉK³îÐôEÂÕEµ˜Ú¤ø ƒÅÛJ›[(“.n#:É( +Å;,ë›z²$m½Éó“xÉQ¢d±2nfÊ,gTyr›Û“[n­¬—ó\:^`˜nÆœ¥;Ÿ>µ&›Èaဉ%æŒKxà2ÜԘδœ° ŠÒô׳~§„¼ö o/üM^UÖàô»\óÙP2*ÌU)›É§ÅV`‚&Ã&­WQ/P˜ŒhÝ—ŒkÌØTŠ…f]AÚ lTø˜AcF­~•µ…;Ì —+…_:,dñNäE–Å?ï¿çÏ Wy¡æ¦’1æ)Ëœ€œÈ6_¤êBf»ØÍ £WQ¨†XW6=«Tm*ÄæÍAü«Xh¨ª,]µ„¡¬³ËCmÕ¡Zb†Ýz®1©¥ÅìÌü­à‡êÿb†·þ$/=›‘sIR5[9é8Ú­Z£ò4Ìâ=Ä + …ª?¨ ó¢UÔÎn°˜\îàÓÈ8†»0d ˜@{( t1aYš¤/m¾QÄÂ4Ê u¡÷ã¶3íêöŽn¶Ó›&(ó¼àyáC^ :§!æòähñ*h‘#R›7t%„5rGB•Ý z=&A'S½šÑvNÞ¸7°°¨œ):ë)r=Œ—ÝÉ:ÚíAÓ^[,LÊf6íÞ‰å÷ç´-ynÈQ};(êyá^,ˆð`2ts£iWàßѨ+¼‡®§³­M`ÞÉ0 +7Ç|¸Ìíö<|¦:¥·žõnÈ–4À›%uO8D™{ÈVõŒÉ?ƒ'}tèS뵧x}Î7x!Ð +Äd…Œ©ºE¤2v3jÃ3…i¼kº{2-%AiäPÈ‚XÆ»°J°Ihoäb‚ÛgO›ŽT-W@ `a€« ëû7^bRÛún,ðïbaÉ3w”Ü……h .²e™Ld´£Áü*M>çQ[I¢UiÊí>–w]—Ó±tXj‘$ÄB¦1½5~ÀìâPdû-^ˆT»9±4±µBg=¶Ÿñy]7w¤uª§¦°dô9"¬Z'¤ƒ`MvÁªèí3ˆ—mvª‡ËTL°!êBzÎyüàØ‚‚B_µ˜a½’‚X=>•…uøô¤E[z‰ÌÐæ\¦€DèêZÝ‚‰Á'IQ+˃@Ÿ*UÉ2gØR«# ­˜ºÚÚ (Kyc2š“d?ÅP²r™Ý²µ‰€ÅRX‡|·ó‚³[ö5,D§g÷ä,TZi9€LŠ@`¿‚7EšÏy!ÖãîDÀû0ýv'Ç•Š>ÂB㎮³©y¤½éÚ3x®V–$ ùiÞû«¼i‡…IBm°>̈Ë”&ÊË z Ô¨Ó®ÚÏ°+²ˆP5¦”:·¯°€IV¼¹™à’–­„÷ØÃÌáÞ(¢hà²bÒí5^hí¨– $¡½¨Œâ`#t¶=7=ǪGÙÒkŽ>ÕF–Öý“«x¡äí}¼€Ó9Ø ¸  ä…Úš +! +Š&ünõ†S«8$ïfÏC\xÁ{¥{¸n„y¢6bíüÁær¼ÐÁü±|•Ø||õýzN%‘(É)q_ ‚=›>ç…Ø­k‚¥+wŸ•HQÀ‡°Â$&ËË €ûvrBÁìüyø/èù8ÂÿKLfY&Ðj5fûBf—V°3¹~†…ÈŠp®³’K¯ê Áž¸E V d_5ζ»‚`Èdp¶G€ä=¦²A?R5‚x.R 91§ªIV0k䪎 3¨M +xg±jRÂîãÔ‰(hWcÂAdˆL ªp:R§ª”èa÷©ª>hÌuÛ™e;Š¤ C®«y€ÞK5UG‡”åü…óòC^Ȫ!VF9nú À;è˜"Ê+x“Ã=Xˆmô²„g[÷+¹0;£§2»‹Ø ³_bý×p­dcÁIÓlÚ9¬b3ÁÁjé%jÎt1Yš§1¨ÉK +ÍqüR%ŸMð_å…mŠo¸Sd`ÎÂî(°coŽ¼nÔhíDö ¨¥à"Œ÷¨Õ+¼m‹&q2ï6e™.f€žÈ ò}y¶ëèŒòÞÑ¡„91Ê\Úµ·y•Šc#.q“…1?TŒÔn*Ù å­9©ÍçX¨í‹N j`p´˜UdÝ|±ùTšt{a•¼ªFÓ¦†:Ó©n`¡ÖGYÈpP{iê×ï"ƒsq€)0I/àŒÉ(þ WH±0gq¤-Â5O`Ìø^å]:’M†éä`ÆKî/er_}‘ +Õ¶‚Ìbaü˜šÝimPÈ(Å€<3 뀬Â+†}[…àÐ)Eè`ù,ÀÐ:^¨?5÷oðB{š KÐËz•±ø€ZJ óB¨æžäýæÑ7X0k¦7Çs5'€ öñ„» VP<ò#±«&Ø¥m[ $*®ú‘Êòdiö†Y~l¶/+wÜ=ÿØL ¸ýµÿø1.lÚ½ÚãǹQœýq¥fܧZG~¤ çD-†…Õs…e¿’V½²X€RSç*``!à…0‚¯Ce¢¢%‘¯ÊäpŸŽª‘žÒ _èñ99~…³Î—x¡Nà½î{®œhv^XÒY³üs‡…ås74«ˆ&BÈ$•eÈcÔ‘d%ŒMˆß¼°VAPYѦƒóq¼÷# ûV€É ðLÌô¤ª q9ÃÏå­ ûS,´×ÔÍøHWÂmÛŽ¶«ee_ãËå‘ϬêÃÊgБ‹… ¾c À)t\Ú  ÌY˜UÀ±’Ž:RL&×á>,àË‘*£Š¾ùêpŸIýHøh’ÌÚ΢?G^Ø %‹á}pQ4€´¡6•ñȹéqa“È!tŽpEîÕ‘ +—@¬f!îXüÄ^NzЩ#¬Ç¼žÌ‰*«j7>ñ'XXlµ v,²F³Û fåh‰”[Â×pv¼à4ù’" ļ¹Ê ƒ}­ aŒÀ#WzR›ÖÓÂAFwàwÞ!wó« ŒËü˜¼Æ7ôØça¶`‹µd×”ƒPªËÕŒ Ù 3Ôqœzøˆ©£½Ðcíò‚‰kS ‘ý0ô•½yAª5}ü.{ÚõˆƒJ˜›ÇÙ¸Ð@ØŽ%wñS–—Á:h«Ò:ø@yÆ©í ë;lgÄŠjÙ]è`:qJ*’‚ªÄ›j›$李Ê/Ø  ÷- ~l/ðã$ć}js²¶þl¼ÐðÏüHnÎ@;@Nj°ŽX˜dÙX¡ÖŽë/t›Z¶˜øõõ…Õ¡C”` O<ÍBå™P Œ&Ð>`þ%W] +$ÿ ‰’Wü˜'…Œ…Q$ èÇXp¶s›ó *¨QÜdRImG”…*å0ÚŽ*=¦\ÆñB"è€Ò1·/8g¹SG +¬j„ïÆÍ9•žÝW1|u/l/þ¿²ÞËÃŽ…ån,X§øŒk½¢$/› ^\ˆkhïMîÅBr§Öü1/#°ë«:<3—~¤#R†…Ô¾Â^*¼ñžó刅X6'ëÐŽ^ :÷#´¬ÅÙû;çךT2ë‡Võ×”Ð?‡/¼mCñ°Ð Í`­caƒ}1a7ˆ[^û¦!‰W” îß±P¼y .×ù…íÜsÄúL$ÆÔ ð>Š4Óº6}bútw\ë| 5(D`s¤0²h,;^°ª;žsº …ZÁpQ¦Òy í$ö«’ ÷ðLé‘ ò¬È¡d½ŒAaˆ—e¸²ðt“¾Ä„w€÷XË–ÒîYq„hìàxŸŽ”ïÊòyL ¨jg¼À,ëuçíUÁ¯k’°Àa>Ökùs»‡·Ã þ-A˜t3­JÑÅîéôLv7´:­/„ZŽµ<›¯ð‚ŒK+Š;kíB=¨…RVÎÃgF•y&‚„TøãXX_)I`›A{ B¦Êý85 +7uL Ѽµ¼°íôÛ6i´-˜’’kö¨G#¦<ó@¹ÈÞÚ7o±°(9©Õ¢&%3+é‘¡&`’;×S­¥¶CÔkÉquw1¸¯îâ…ÆAY)ØïËÔî¹rÉ î„àà¤p‹·özZ9(’ÖOn;¸|Ž…Þg2mx ö}^ =«©÷)6hlµÝj½ù5þ*+¶n·²¯®Åç{0âA*ÙÇFL‘MjĘ÷­ÔTöae ö8ØþðÈÒ û€…D*B¯û‘V‚+Wð¤Ò*¬±œÎ±0K>À)UoX *dŠ–`ZÔ…ýQÀø¯Nr%«›XÕ\ \’³ÆlÕufwndžó¶²{ž¬N6ª¤]ei±ÎêúYZ÷©fê›#ßÙ óDjjV“X+LÏ ÿGkÓ¶¹‰Ò»lç¶_·fI³v–ÏÚÁ}Uݱ ŸÞ4N—ßîcõ8Žyk>ÂBšÿMìðGÍÙÊf#p”ÊœŒq™ë®ƒŸbá[åkûTKöµ­ºï§qÓ…³ÿ ®=¦Ssu}áxØX‚½°Ò0ÎÄdsÄS0OOͶòÌæ!ÔÃpöFUô# 59T=zÙkQYm¥ª Q;Α/-/àúZ¨˜ÅBún>Å3ž—^ÈG`áËnc~áN^xXùó «û~$`/ØåÕqÈljÙ,m ÿ^`A \[ÚT(œš³â#,>µí +OµþÉš2ØM±³*•çÁ„æ™°7ÆaÎj)”|ïMtù;N e\¾ üù…?ƒ…÷öBŠ~$B#ôéƒæ»mý›ŒÚvUƒ]¶a¡Õ¡ÅB¸o¹î¨Ùò,´XÖ‘™ð·°0¢ 1Î +LF«P²B¥8qXÐRN×ýHÁU§”ç…ÿ /Ï ›í¼ù‘ìºÜ0„ µž'Õgóœ±3^¨õ9,”²ƒ å´¸]î#,غ <Àº-;Ç ±Ê‘@Ñ*E†³;ˆ¾ä€ÇÝfëGJÞ¹Pf›¯­Ó:xi,x^ø˼pô#í~ŸÞ®þ Æ.ºäÄ ³ZAˆ©¸µ`@cLéÄî,ü nÇ X¯ÖFFeìiªDˆ–=Ö†ß[Gs®‡»üÚ¸HÏ Þ^x/(Æαvq˜ƒNS©4Îíð¶ÐSRåÀ_(Š!M «8€ YZ9ª–X˜k4Ôa§×djÕ}*WëG"²ªí9ayG5vi`«›d ¹47°ëÈMÒóAâ2!«lbÓ6Ìd”#Šv9äxÖI’°I²5‹WjÊéS•’ÿ¼ÿž¼½pœ·—£.±EbC š9±–ñ2—q\d±Ø|7öÃþ# 1æ‹1v §e/°ì6/P¯N]»x0¶¤,¯Üzf;Ïiºx^ð¼ðh^x|ùhÏö°-Å“oîëíáMŸÇÓÛ Ïà…ßž·gí¿W÷»=žt;& µµå+‚Dœ÷"óðQõÄÀÁ©Z³ôËa îâHq‹róœ¾iXrÀ1Ë:BAÇä|ú Îð¶w›£äM&ÒO;¼-G@0¨#”"Ìȱ+Ÿh0û\*¡)ô´zì› ‘Ò4«šÖá`úEP“º@Þy›ƒ¥‘»Ðt£¦ë°ïj‚:@ ‘º«°´ÚÆ]ګК݅†Òr¹3fUÓwB7B÷¼k™½ª)Âà^öÐÒBÿÓ6Âõ‰ +EP) +;Bå™ ‘¬ôÁ6ºolãú‰ò ¡wÛ†šxø„š"-±þ]¶‘UžÂãò¨šÊ‚¼å11!Ë‘ûFÊäâ³,>D]Àê´«FšE‡UxôÜÍ,ri½™Ò¬žP¥¥(ü&›%“Ú e#ÏR{òeF°[˜j ëð%ÇD=AI™-[¯ÆÛF©–yy-ªŒ óJ#µ'3u Ç= +6ÊÖËUbÁ]…®P„G¡oj¢[5m„Ž¥Ð²4Ye2BoÔä¢bA 7¡Gü­°;¦…–íBläUM +YÑ]M¶ÚÁ߂ЖZKŪ&&±ð¨¦G¡Ukºûl£’–-m±ÃJèþ£mLß؆î2P7Ÿ„¦wÛH?ýh«ÐÐ6Jèa+tW}oj}!Å# IS¼Œ3y;ÀKº^R‘É“ƒåv©žXo . Þ&ÖÛðĆ8½—–Ê:Ö'Æ1M×JÓ‡JêßœbVø•ãiÜ2´å *Û‚‰Üo "l8–O< +M> ­/ÓµŽ4þÄñ§úåoÿz#Mö…дìô^šVúwjÚjZèßâ/…&Kà·$ý &ú¥Ð¶‘~cXÁ³ +7-²å±~²,„ÆdY¡³¶¡ŠÐl~ú߶±ê?† 7d–žDFÆ 2dÈ!C† 2dÈ!C† 2dÈ!C† 2dÈ!CÿmÊ‚`÷&4vo!AúÊ^´#“4 Ç…¦—«•^Ð×Ñq-þž†ž¶Âc4u]·7ÁdÔ}uJÞ×4sþJ&×öËs×¾Ö×ݶ0ÞU—¶4Ö°wÛÚM°ü5ð%ñð7+ <Þ=µÉ5”ï‚_ƒÞíM¡”s|#|Yòþ§iØÿ8a‡SÝ“íp¤¾7÷ÈÈy7ý9<Îõ%QÒñç6|Gr3ÌUX˜ösað Å lò ü ýBwÄ/ð·ð üWýaÏú~•_c¹¿OŠ†Ý‘­Ã—î÷GX¤·žÓ<^ÜÔiSífjþ +€ÞÒÿÝ +cëÉî(,ÉUÖî/Ù?Û%y-)„=ÅეéÕMÝ,—4Áu4Ø¿[_6?Ù¸íeýÁUXx-ãIqà„¹b|C,ô ?DôM±,,ü¶_Œ_0X0XxçÉøƒ…`aø_Âñ  f¼`ü‚Á‚/¿`°`Æ Æ/,˜ñ‚ñ  f¼`ü‚Á‚/¿`°`Æ Æ/,˜ñ‚ñ  f¼`ü‚Á‚/¿`°`Æ Æ/,˜ñ‚ñ  f¼`ü‚ÁÂ=F +þóX˜þëX  o€R•ãÞ– ùîÜÐOƒ:zåÔDÒ{ûJ÷îÁªè8WךZ{¯ÄÆ?C—á¯2A'Ë~.WXTÆå„aœÅ;ï åAÖ;{™×ÒíôûSe3ž&|,.dWg$"Þþ¬3ØÚª…'Šÿ"¡†žJFâ°Â£®q~»ÌÛÿJ¸¯%tšögóˆZG‹o^Jd¶‡ò 6¼”bð$Š.³°Pg•?ãÁ¬Ë9UÞþ2?`t³óD÷+µëfòª‹[:õìMðù‘2ë—ÏV>¢¡GÔ^•* â¶ãìN-~mn$Ž÷ß»ãB_žÌ÷€üô  ˆüåɬìÙARP C† 2dÈ!C† 2dÈ!C† 2dÈ!C† ý¯P¼3wopŽì?‰’÷åwnUú¦6çËãû²÷´¹ŠÉïÉÜ`‘·Õ\ãÑ·Õ›5{Ns‹}:m_nª:wÌØ–ú29öbõt>sÕFCcÈÖ4ÛO0G«óyÛög…:Ä´W/rŽÅ‘ž˜TÕ¥¼9êßDm¨™êƒ^b<¿Y·o®EêåWgM½Ô»½ÄÀywòŸÍ{¿1cøÎÙĘÜC|Mº<Ÿ¹Í.Ì’ªR‹WJ…‡˜»ÓyÛîöX”÷x^wà=Eawg+îá¤jŸª5å?Ô:¸ >[uýFxe€>/e#ÏûO.ž™.¹–w—ZY±?vg{-ñ|æf~ÇB£ÞÔþ»›17òÁ=—¹¨»ïiu7`u™êí±±y}.on´Ù/Pu2zƒÖ”¼µG·Pvºæ6Û Fæ* ‘Þª?°löNs½ÏÖæk'qp‡ñlÍ\ÃoþÒ¨jÐà™½ ·µ¯´ÂB~x>¹ ¹w&…«¥¿Ç‚VÓêÀZ~øPyët¿Ð®~B"¢”•m\×›øÍÜ›@é/±0ÞüBû!²´ïÆ¡¬¾ :$ÒÉ(ý9´šôP¼ÃqÛ¹Î/èhRÁåêºÞÄ/è¨Qí:uÖÑùò ýÂÍ×K§£‘åU~A;'íA5“k ôçXX´µuÊÚògvyŸÏœö :$"*yŠ¹ëü­A¥É‡Óu\ç}=9ö^êtH¤™¤*^ú{,h5AÈ;*å•Oìlµ.;›HÇ"k ô~As³â:Pz¿ò_<²¼t¼0ªhÛšŸµàX嬩ÉV,ÄÕëd«ã + JM™¶6›{ûü¼cÍ7æÄÌ)¿ çŽúÕÑïc.¸ém¶¢ ÙxsãÝ/Œ*$Ò—k ô-wÞfÅ­Îàmºû»“sGãÑÈ2Ýh.¼ù…éÍe7,èH$Âá?C®fó$±ù†…¦÷ÃWÉoÊÕÚdKŽ;­M2§‰Aï¨ýBÓ‡g1'ý‚ž;Ò«§k ôs‹z«â<æ¬Xˆ­èuæ¢9Xý‚‰5q¹«A¥]­¼Aã†+FëuÖÂ| «_X˜7Þ§-E´;²Œ4§ýB6;'°7¤ëxáÃb–^üž²ŒÂ_¤ì#5g8Õ$Z±p›°¬Õœ/ÛVjή`.\ý‚«âµUYû×±²ìÆ^¶ba™OȺHÊXûªB"½$~`ÆRó– hÝ Uy‚ÞTÒcô ÚÊô´å-P:¬9ížÎ¥ú@2e­ô ‹YÕ\—`!eÖvv·|63áêÎc×Ú,é¤Öu¬þà:Ö‡ñÂIXHµ_È•#m×9Aë©BÏÇú…DY™žåÚïëÿ1^8 M¬±à*ª’EûÕ¿Ç‚°ãûPæðªé'æÚsýB5ŠÛ{yk ôX@¿È\»zþ9x¦A¯Áú…Ø~ðõÏeB½Ï#Œ"ó8¿4Áu ¶³»ùöÅ©?ô áfé…u¬ký‚Øâk ô.~a;m)ŽÎW^ìÚUðY¿#õÌ×eXXgw-ƒ_È\xŸGº—ã“AÈe~A6¨~K°}zfô¿ ¢¶W}ýU~AÏÊ)¤„;â°p³6ïù=PWŒ¥¬BêŸN;™_Xn úôÆe~adO¾!uýxa3#îžà +¦åFÙXH—ïÅ‚ž LZÛ–¹ŸÆ Û{w0·ñ Ï­ce÷š¦à,Њ[èN¿°¾%zé>ðö=²O¼‘~ O¼òöXcúƒ_Èâéw[,ܳæ½qo»ÙIÿ€ë㮋oS}o° ',éÑUÓ-sé~¡9ÆÜ}¼ ßËÛ»Žu³ŠÍ™ö,ØŸv›ø;ý‚ž<¸bì¶ûZ¾ÇBúi§O´Ï/dó“¾~ÙÔ8üàö‘»|çx¡Öïoi¿ºËFáú'¤?`Á½ß+ÿDî>,Ø·UÓƒá͹(üÉiUŸ˜ÛçÖ­ + ?ö.ÅU1]•ýR`Ë[ïó On§ ·ú¢¨ú 9ô#Ë>¿Ð*cKG–äAsßû…ÏÜMûü‚ž£9°˜õ;ã…öتéïŽú§ß¼¿~¼v2Ô¥OÍ ^<^»âµé­KÇ „½òŽÔ…XXö/ƒï`îäõ…tT3"y/,H¿ N;|¡A¯›GÊìg"Ë_›Gå6»â… ®ëÖžZ¿Ð/<®/¤Ï®c]>$žÚNñ;óH'øúK×^Y̺t­íUk»r}áeGáúÂs{=®÷ â_åúÂK‹YW®µ½lm®/¼°Žu½_xj;Å/ù…×}ý…ë ·cö„ý$׌ÄsNË/LÌ{5âe~¡zÝ×_èR½qìU,D ^ü#Š ’3¶}i¿ÐFô,æ”_ˆ^ B¶XH_æÄs|ó ôù—Þ>aa^çmî~!`¯ûú__玴÷ñ}á©-œÞq’ÿ8½}ÂÿÚ„åeÌI¿p4-ØwXÚäuÞ’žÜüÂÓ/¸ÆBÜœÀ[Qd7¿`ugxhí²ºx½Y™¿Rù…þÕ ®u¿3¥”¼úWE¹ˆ…—ÞBúäNdýBzBÏ{ß³˜“~áõiš;ÎáMEâXbýâôÖ£_8±Y%—»ßköþgXÛUyóòÎçaá<’ûÚ¼3bükòæ¬9¥¬kò`dÖË£ú™9çRî“S  ¬Ó™³º@ÐIœ‚…9?—¹—‰¦à,´çò–׈®18 çkPÇ/w”ÝéTž†÷ö|æ¼ô¬ž’ÏÜY½yu>oÌ?­U©u¾æNñ4$8›N<³…\ÀÝYhd§3G=·÷ÕÛ5ÍJ…!C† 2dÈ!C† 2dÈ!C† 2dÈ!C† 2dÈ!C† 2dÈ!Cÿ‰¸»cö¼Ý[¹@úlÍϤ¶<úNn~7v·ßeÛÊRW–š®\9¹+wúŸ6ïL®Ú–2Ba“|ªRO¥9>±„úQQÙ¥¡®"_ž]fçùš)5«"'Ô©\WÝf/%­NP-¹•ãf™­¯È‰m’}j–¯hòÝÍþœeýD\_1žÙ~•½ÈÆ'Õïóá¦éTÅ\LãC²2φݒKò¾L«ánŸñ®ãÖ§æŒøfÏM¶Û½CUh'7_ªçñàI÷óâZo°/y ×ê)™¥`TТÃGòf±hŒ;u?f¥ +J¼±“<ă¼–¥P–Lú®fmÇj}¸ø$sOËzƒŒé+û¼&Yê@T?’àà&[­!~B„Wˆ‚‚7/ì p‹O`èùŽm…¯þñáÝ)Ý&0ÊØžãgº~XtÝ9r(î«;Ï%©Ã?mbµ›MOV=˜yÈ{èvs ÷J†Üs)É; ÿ',$®:L¦0µzLf:W”D ÓûzìccÆÜ‚J\ýBË”Ø>™zWiξ–4• +B²IÿØåG:?·Dªq<~ö ®rn ¦ho§ºÈ/¾ð ÷4…ºñŸZm·O>àx`ˆú¨˜mDeÑ–X˜n6Fº ê4¤»Ê·:†¯Ç[]X8baÔ_Å•º5A5­ðnºU¨]k‹FZ–C…²C_v+F¡ˆbC6VËØ2#ÙÊ|#ËGÈçá~8m x0üxøÕa»ÇmD|©w2c΀@ Þ`‘È\‰og=NÛ ·=·xæKATäaåàþêÂ뺔AÀÕóª¬ç–3‹c¤ β“qäóªÞÀ+àçfñ¤wø·ë0ÙQÐòÎ*ÑüCB,ŒXFýŽ;9 ãób3ÊYSàx!â]á¶`u>óü¬‚§*AË.ï†v´˜;É\•>øh¡AO Ê7«ñB#Õ zu1-s*s3;ÎÃx¡/êÞ‚†"Ý ãŒBuLN%`«Ä-l„Ǻ·8Z¬jÍ0 õ¤¾n!y/”E]ƒw©d¤o°Pðû)]5੽YæA«È‰åyѯüÂ:Fo’CÍ-ëØLøŒ ¥EÝ>žÿô€]Έ=‹$ÿg,Ô:#¡ W%K1ã¤Pƒž'™+×><å ª[FɜȞ¢2íÌÊ…))x’iÞ¤–'f)sÏãZF*¶¡ÇOc?芅D=QI_™ðx”]‚ Ü©Ç u—ª»”²nX˜¥gUáX!kø¸È2gP‹¹*ø˜!Ë´ðß TÚomÐtTÍ#¡¦Á–@vftÌI’Üê@-‰ìþ½Â'cçŽ1æõÁ¯Â“5g5ÞEuN*ê6DK +#·ð<]ª”­³÷ ²ÐÒÆŽ?øÞ/DË4Nà˜ ò©aÂÌu6´Q+G= +(_ù‚Š"åá¦dî O°·Zk o¥²9ÿ‚ί`L'¯îžì6˺’r~ âÏEsÁÚ”ÿJ8A³„â{r¢Ô¥b¤™aÒáo<þè@ sèt`U oà®S›÷1µ¸W3·<ì*ÀÃÓ›_h9ËsÚ^8Ã&‰Ö~ú>Ñ0y|N 4k°·aCY–³«Põ ý ¶ÊˆìwÜ*jK®_[¼ÄG9Q ± K+ˆâ €ªÓÝx:«Ò<œ‹tgˆæg°È‚ë&…Ž¡9Zκs_{¥³ú2bkVÓrçÊ®ƒo¤H.êV©¾Q§£[ðqiIÖÇx“ˆ`¬á{Ìk+à(ÂÕ†¬]Qèâ#(}ƒËû¨æû*ÒÀ׶@1/Ú¶“‡GžXÑBŒäx²ÊŠ·%ó¤ð Ãõ‹\NÕO¡˜´-fP:–zÕ€à´-ñû¶VuÊ›Dâ±Ù™'Í‹Š¤yo¹¾@ÁÓ2–ejáqûöý.Wh¶þ¸^¨'³{…‰–eÙúü;|=×–}b‘Xö÷«é÷G?åœ+Q“ÙG•×µÃ#—dû‘>ªŸˆ¯^”Ë“ßÞp+8Û¶Ûýƒú9¯*¯0Tý؆«zl’Â|Ý씼gÎTÒ•ZÿÀ¶ŸÜr¯–òçO«˜Ê'O£C(þŸR®GÝ^ ûß"ʆ?­¿ñ:½ÝÆ ] %¿ýàûS´¾Qs ÿ)#ÛÀ„CoÐ%®Í™œï† 2dÈ!C† 2dÈ!C† 2dÈ!C† 2dÈ!C† 2dÈ!C† 2dÈ!C† ý!eF† !¹¸ÔÆd q(bGo fÕ6)Új„)y_7bŒ„;ùEƒÇ@$‰ÈæÚ«ü6¾oõo7…Ü<Í•°[á´‘ˆœvr“%O‹Væàαb¿)D +×õ¢ +.ǦEßTa÷MUøUI…rD”†Iï·ádõŽ("AÊÔ´‹¡_§±I&Šùzæ‘7¢¯<ÇÅdpMë÷­_Tmк­?Ûƒ;L…LÌ©XZ; ¬ÑÊ“£±‹´(Š4’)‡#€J y5؉hÂ2i‚Ò {HØ> "¬]k*ê<$-|…Æž3áb}-¤ø¢õË ]“!C¿NÈ8Ãÿˆ +ì²Ék§l"°ïFÄ2Ña9æ­Ó»Nè¸I5äCœ§˜ØÕZZæ} )í!Â2œ ÌÌš4Vµ9|•ÏE¡Uغ¥EÀ¸´gßrŠ©FKåŒ-ûÈrò$Eâm]‡Poá˜v1ôûÊØøYö=Âh¹ +«>´íIØ5±< ""éIeÛUeC—=e˜_:„H'6 ¦ÝJDp£_ù½oC}“À¨ÁiFáöþ84jmá71<ìO0Ò.|Û§S(By¶“ˆû6öÃ8{ñ£ü_‹iC¿O•L]È-<ä}ÆœÑÙ=µpvOûü˜31ˆ7ùû²‰Ê¤Æ*ò¼4ãfCCÄG»t$ûÌŒ5‰„H‹lûQÑÔoï -«Ñúc¾ÓÔfblå7´X|R¦Q ý'(«R’‘‰Ž#ôü# Œ¥I,&9¢^â&xÖyµˆ`ãB)™0à±½…–v)4˜Jì.ª GìHŠ ˜¦˜.áL&b|ƒ¡ÿÀ¼“5þ<¥åŽeÙˆ.òÈåa+óìMÅÜÒ°´ªÈ±­²q­vŸSÃhx™êÊf‘—m;µs+ŠFÂÒOA96néYn3xa ÷>6Š6ôî4 ¢.ŠF8cî8½(mkÌó:*G;ijf+h6Žm;yIÂ2šE¿ˆl@çþ,’°ÉÇ¡Êãv´ì'O ?êÇRÙŠ<„ÿ|Ršüì†ÞžòD8yãŠbðòÚCØ‹>j"y@[P’¸¨½¶´G«EÞŠ°vòl€h¨„ÐÈv›¼ŽÓfa_ à9JáàÝ©›@Q÷€“dqÂ"¶K£hCoO`õe8¤a 0(ý¥Í1¸ƒ ¦_‰` ‰Sç"¯B1‡m8ˆÆI¦±ÌäKJ~™I/Z4‹]†%á;x>7“»s&j»%…=dEkmèí‰ -ËÇóË_3€Ú6xbÓXa5´)‹6l³¦µÜž¸ÙV3WQT”mâBÿo'uÛæz\02¾±EÔ/VÔ¤mmåFцޞÜqð±i̦~ñ41’QØ83Kª S•ÁÇ€ÒÊŽ‡˜êE…ØÅy£a¬ð3€)¥”ªu ü?¡ñ2¥DÄ ie2ô_/ÌóºHàþ°>çZeñqà}d®ôÿ–<á"endstream +endobj +5783 0 obj << +/Length 107 +/Filter /FlateDecode +>> +stream +xÚ`ŸÿFFFÌÌÌšššÂÂÂõõõ666»»»úúú%%%ñññ³³³«««ééé“““íííýýý¢¢¢ŠŠŠ[[[ÕÕÕ‚‚‚ssskkk{{{bbbÚÚÚáááRRRåååÿÿÿ¡ò;Pendstream +endobj +5779 0 obj << +/D [5777 0 R /XYZ 85.039 781.388 null] >> endobj -2637 0 obj << -/D [2633 0 R /XYZ 85.039 644.901 null] +5780 0 obj << +/D [5777 0 R /XYZ 85.039 758.673 null] >> endobj -550 0 obj << -/D [2633 0 R /XYZ 85.039 302.385 null] +5781 0 obj << +/D [5777 0 R /XYZ 85.039 758.673 null] >> endobj -2641 0 obj << -/D [2633 0 R /XYZ 85.039 273.284 null] +5782 0 obj << +/D [5777 0 R /XYZ 288.958 -427.984 null] >> endobj -2632 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F41 2104 0 R /F35 1632 0 R /F65 2099 0 R /F70 2201 0 R /F21 1620 0 R /F18 2207 0 R >> -/XObject << /Im2 2261 0 R >> -/ProcSet [ /PDF /Text ] +5776 0 obj << +/Font << /F64 3112 0 R /F75 5171 0 R /F56 2890 0 R /F15 2876 0 R >> +/XObject << /Im19 5714 0 R >> +/ProcSet [ /PDF /Text /ImageC /ImageI ] >> endobj -2644 0 obj << -/Length 2829 +5786 0 obj << +/Length 1844 /Filter /FlateDecode >> stream -xÚ¥]ÛÆñý~… -°x$—Ÿ-4qÇê¸öAáøaERcŠ”IÊW!>óµKJäÙ¨ =h9;Ü™ïú+~þ*\Oe«$õ]•¦«üpã­v°óâÆ oº^áÖw7÷?ÆÁÊ÷ÜÌËV[By(Þ9ÏúöõÃoîÖJ)ÇWîÝ:IRçõï¼yùêání;/_½àÝ·üõõë_pï.UÎÃÝû‡Ÿo~x˜\‡n+¤øñæÝ{oUS?ßx®ÊÒÕ#¬=×ϲÕá&Œ”…Jžë›·7ÿ¶§ð^¸â·îµ6k?s³ Z 7H`À…£ÌŠ €= ÑTpëÀ…Kùpù(òœç]©‡ªÙÁ­ãØyw¼SžÓUÍð·÷×^2›¥ÙgùHÜØ‹-~´ Š—ÍÝ:ˆ#§íŠ²Ãeì ÀVËËuq‚çã ` Œ>ìKÆ8a·nuQÁ?²ÀvËXÇ€Us¤Î`N/ÔUŸÆ ÈùÝóú$ZÏLæœq»=ñöá(#„1Œït°ØÉÛÁÝpXL=¥‚ÒD›ñQ›‰ ßëPUè9>”/߉Q`>s@  ¦0‡ýW>]V)@Úãe{â™Ì>UÌ(.IwB#G1§$’ïQðI@”¶Ñö5Ý~ƒ«ÛžÁV  BkC±]¸ñ„LøÀ1Ÿ¶f€—Y®`OÔqÆÔ©Gâ«Å+ šÉñ;¿{‘w!9ªçÿ)½¾ì>U¹Ð:õö‚@`ƒ' -±ß*d¬hô(ì` À·¦”ÂÇtÂo¿tå–Ù^‹Âû„z):=ìô~Œ¾…‡ñ½‰Í"¬ %úf -À7q‘K—x‡›2ø chÛJ%l¾(´öT“öSç0Eµ=3ÌÊUY`Êïyà>[ —÷ZdlËçŒG±¬RGŜήnÉìjÞ:’A‹ ({ÂÒ¤=y›Mp=½tDwÎ;bS╉oIáz‹¨k–%Á ññåZF—Â'4D3™\#DÇÂÁ(’,ÜöPòq„ ÿSÂGòFre_BT‚ÞÅpï“qËžÎS`;9r¸g,Ýó·hOšN½]°GŽ-`-ºÛ Ç &?Cˆ•š‚/Á+vÛf(Þjºr)ˆPçɸ»–Ljß7w*{~¶önB­µjâ„8%zhÎÇ{Ýÿ¨.ÈZ%n–Ð%ß¡±èšrÕ*f6ÿHrDòò°!ËÁÔþS*ÁE3è‱v] žJË~Ï2ÁõFpõæ2”GS2hÖ„TÈ[$KW7íËGL´¨|~he7TåRp]ÛÊ«• -!³®òj¨ÏB„ÿn/Ž¦ë-ÙÈ‹—ßðß?dÈ»Œx!Ë{P«øc©°$~2Ïé‰÷§¾»¯Û\×÷½>lô½pÐÏeº“‘˶.9/ŠhÓµ}Iúù22=¢Œ¶1¢ûì ¢€¾jòÒ˜Ñäñ©Z "ØVP ”BE ü’î3kˆ"÷Gc‘%¼ø$FÇ]5È uÕ·P*ø–tû2ÿpeãÛÊÈ¥?÷Cy›+»CÕ÷UÛô—|О6óþÔÍd ó¼=5¢¯\7F ÇóHÿŠ†åäg˜¹ý¤¬èËÁx«u>aÛ¬Gwöf¯†¹«Ce#G•ÿ±~Fý×øÜ•ÖîqN±ï¢x^ûD?ŸÎªðªJWД€º ú¡@q™ŽÝN0Þ¼øLY.Ü…*fî®N•«– Õè&QÂ[OŸŠÃÃǺ,T¬;„j“‹ñ -h¬E@ÀHG9Å–B¸[—üT_œØÉI9Ö¸ÜCpM%„ ©½Fèô<¸:'Švià¦az™QsÎ~”¨0Á»T2SƒBm ‚¨¸ÁÎ[—B£@qcRÙ÷ÛF^2¬9%k›y±çmYÜ™Öý8vÓ$°ìþZ_.Ý°Ô‰¨ª$²-w=êÝœ/‚6Y¶ à)ù¢epaÇÚNt ¢Ô³ðB TµîºVTüLxGQs/Æ­- Mª:ªÇ1èô,Þ' -fî¹"ŒÚÑŽª®ä*Ô6&×3³F9„FR¤I•Ok#Š$!™/„&3_è%BÛS¸%ç§)ÁÔw“ì)ѧqö%ÑåÑ”|ÜN=_\L˜ä wÝçĽËú-ÂÜ8ˆ¼*y]úâ!•…+UzRÁ55Fý0˜819H´«ºæ½ µ'%ƒéL¨ Eâ)˜n•œ°¨éåVl|Í‘8'ˆ*ÐÊ%&ļêƒÇ3[îþŸ¡cf’NøÍjä¼’=O¤ éºâHr*Ý™ Y!E‘eÁ—‡L*Ê1^2!m°‘0JŸ<‡Þòà^ôËsÀÅS5©ë'ã -Yš2}‹­ó ‹?ìTQ¡qÌb’:¯Zg¯j™rÁ^ðèÕÇ•ïza–)Þ¬é -ãK¸yðWß·ÀëjdWenl¿ßœ= ]ð€ ¿¡ïåP7ÒƒrJÚô±‹ÓܼpË@‘™ÂZü¢ã§ßLSÓŒ“|' ¸ß ˆR7ò±;i”b§™…‰ƒµyéÒNèn‚@}bf¹Å³þ=T*µm¶ -ó®ÌG𼽜ñÑ(ðm´Œ|ÆI€K„ÜÛÁ]ÎDiC÷ ?íÁP—ÞâÂ9¸)>È=°5ÎÔÉ ¸§ÂÏ‹ÿvngN XÐóZ×6¹"Å™Á›1 -¢G#詶*´‘cYÜã1­'žkéû‹ÛR?ÿ¼m†ŽGö2&3á%Í…‡£h::u»k3 ì]¼M÷‡Üd´%Åî‘làÌ“<©¨KÌòÏçxÚbß&%X^×A«ä¿i©1ιÜéÙ¼Ï8„‚‚&…ûý‚Þ{‹c”tZ iÍh(ºS÷aGâƒô4g¹l>U]ÛʆFw¡ó¸/iKöM6Q(çéxDueÞ&·‚ÿq(ÐeJ¹æE‚¡œ#±V5ö$TÄÀ£à -ÓÝ.ùtw&Ýá$*D:œñ}|î!že+ÅÖ`qK@r‡Ð¸K~‚jž]¤ŽÃ¤ØgKaC Õ¼d*ù$¶'$il›õ'Ð-ëaá»Siå‰IÖ„cRÌša¤ïÜbàDT–Ïþ6xM^êCR»XQÌÊPÈ qC& ¡|?SyáÇ‘Y8è#V.2 „±z\~ƒ©ó9saJ!7F¯_! Ï³y ,³x‹ÍSÓ:m)K‘Cø¢œÐxüE³Ò÷¼Ã/§È@å1µÔ$ð‰³¬kÐBœ¦Î¿p냩`߆ïNöƒ>­ADê™ ò\‹Üà²ÇÝkoó„€æÛl@6™”Ã|¤M_…ÿ¥Ùâ©·%}50Hœl·'ã -?ÿ(;|ã|­ˆ MÜ0Ƭƒ?¥}}1„FÛpšýv÷õší>°iO¾üå,ŒþŠ@ùŸ¨}²Ñ2˜}ÞcŽÿ¸g?opéÛLi¿Ž!Ñð¿ôå‚öÉ -a!Düq'Ég'ü«X{¾JVQ,<Ç«´z寞`çý+a9­<°^Ø\»ëPz~-òØ;Ö‘H<äy»}õð(ý•ô½0T«í~%„ô”«0 ¼@«möÉ]w­µïlz“~s•pÌ®t…“»kFÎÇÇ /ª~}'s׈¡s¿l}õn;)auO_PÓ_­¥òT$_´!Œ„ç‡òÚ€UáÌpŠÉhƒ@+‚ÄytAÉÜôC›£¦*:¦ÎØŠ·yöE€{ý]ìÑ/êxá!…^ ßKüd¦£Œ½(ŠHÇM>«SÐ* 7ða*WFÎWkÔG½†=-þ£òLœ¢cön8ÛÑ]ËØiZXö¼¿‡XÄh'MêÂú›«5¸J{ ñ³¯ý¨BÛ¦d¡ÇbdØœ]aÏÈ+üvÁLôÙÐÍ™;†ž\ë¡û0¤Ó“#±A£bggÀÝR:¨µ¡s»)@¦5*9¤€VùßCÎ +0Kßð¯IS¤òžñb¨Ñ¢üa-íqŸ;2FIhù0ŠÛô†²1ÙhPÆÛ°áue __›ªÉÒ™#Ö±9[<—"þ§H̱¹0P:pÒ7¾ã–Lf¡ˆ)KæA4×7îÏ;Ët0ýx$1YSöY×RµÓ]%ï’‹šý’Z&¬’Û¶ùò‘2—# GGÁ!ÓÕH%Ž‹k¼­ä½ÉŽÈÉ›šc-” _®À Ë}ÐP¥‘ŽF$~Á»1uºtè:ŒZSßSÄžð¢&žûX eâ>ç·=b©ïÔMÏ +×8¦U1å#ìq@quƬi†–¿»4ýžðóÜ‘¢ëÛ£<ôh˜Et¤ŽöÌ”gÄÄã ™OU_Ž·ò¥•Á/{Æ$á›Î·¹sDÝš]™W`¡†ÁÄÑ~8æ,Ú@ D{”öM(¤TóÄÍÊt|q’mž1©$Û[ÓNN´¼¦µGÂÅG¸ÑòôÉ$‹ߦÊ\ª`YqD8Š=¯Qªç½®É-Tƒ8¦@ Kqs©„¥À­X!œ$'ù™…©RÛ±¶øBÌ•3ËÛX\ ‰;ª7È­| Ü•ñ·y2EÝõ·øöþ÷?~+HÅá×0wQ%xÆþâ`sýÚO[7Va„v†.çÃ6,x¦€EõØ„óšwÒz8±‡”œ@êDZÕXÁ¥iíéÍx‹EwlêËúÊè¶tW€ÛQ³¢{,&£±aE#× V)Ï C`Ÿƒ"R+Æ^¢Å üð¨Ã+DˆO& +¼g|ß#oâC•¸ë0p¾’†)Ï&Ï $ÓVnùîÓáÒnhÄ©€% ”K`}”ÅÔö™ÐÔV¦i™P5­¥PИ4{G%à5sÏn‚ŠÀ©M•£³ÁÇnÐùHç–aªãÔM1„ÏᆲyâuGZ ¶a?òõÄM3ÀÔ—yo¬qÜ?<;!}êû“ÅtLnå‹ÚÞË?mN÷cmÓ‚F ï>ÞpØÔuØ ¬”ïù1·¡OfÈŠþ ¹-Ð^,âëªxªò4ÔR;?ñÏÏ(@ˆ™é /³té@ôà5Ø4®a¹[FÊ?dhv_sL»k!R•—pÕ9-—0þÔ‚vðfÈg¢g›sÞ]Ûœº»ÌÏÒ}­.9ò^ÌÀ•ÜB-@(ÆŽºâŠ¬íà2ÊS×ÌòÖrØíÓ¡àÁmâ>[èk­\w¼àHŠ`äÙ¿ Â2‰¡‰c–•üazL=`êÊ$âI”(7¦!qßbÇ$®qòWx+ž~0mX€ ÚÞ-¸¦¤Àòdô à„îÉ#g¾ýJ‘»ÐòèÖX¥Ÿ ž™»Ù3È®bæ–% Ý„8WþA›ŠÇ>bJlp&£=|º ãö@3ey^¨3„žJFÛ†®}€yàFßyÀ<_ð…¯=-FðÀ©ÒZÎmRSÚcñ‚;G«Èƒ‡»Ä÷§ÉZ%ð÷ƒy¶4¶l_݉h0M w&¿P?‡Ý½z»c:> €u]¯µ\KìÌôvðål¢Â% v¨]1*²¨D6öYÒ¨+ê'f2w;gÚÔX:O4ÔUy¬¡ù‚ô(ªÂ6wE£¡}r\ú{Àí +÷wä´¼¤ÇÕÉ[ay~Â÷êónƒ'ínA˜Ú.¶ï6Ûÿ¸ÿ\Îçµ<§›¿±¿bF³ glÜ$°ž)4Ê¿aB ¯Óôqu™X°d< Õ|GP/¢:(¥£{×Ew^nÐ5æùû~›8o_oÊW^(ÇÃè…Ï/Ô*öt¬îßø­ûåendstream endobj -2643 0 obj << +5785 0 obj << /Type /Page -/Contents 2644 0 R -/Resources 2642 0 R +/Contents 5786 0 R +/Resources 5784 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2619 0 R -/Annots [ 2647 0 R 2648 0 R 2649 0 R 2650 0 R 2651 0 R ] ->> endobj -2647 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [145.77 354.89 191.399 364.458] -/Subtype/Link/A<> +/Parent 5751 0 R >> endobj -2648 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [361.036 338.614 468.425 351.515] -/Subtype/Link/A<> +5787 0 obj << +/D [5785 0 R /XYZ 85.039 781.388 null] >> endobj -2649 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [222.711 312.121 306.494 323.811] -/Subtype/Link/A<> +1870 0 obj << +/D [5785 0 R /XYZ 85.039 761.463 null] >> endobj -2650 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [349.617 123.446 454.872 135.136] -/Subtype/Link/A<> +3022 0 obj << +/D [5785 0 R /XYZ 85.039 671.062 null] >> endobj -2651 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [155.951 109.291 180.514 122.192] -/Subtype/Link/A<> +1874 0 obj << +/D [5785 0 R /XYZ 85.039 671.062 null] >> endobj -2645 0 obj << -/D [2643 0 R /XYZ 85.039 781.388 null] +5788 0 obj << +/D [5785 0 R /XYZ 85.039 642.326 null] >> endobj -554 0 obj << -/D [2643 0 R /XYZ 85.039 761.463 null] +1878 0 obj << +/D [5785 0 R /XYZ 85.039 571.69 null] >> endobj -2646 0 obj << -/D [2643 0 R /XYZ 85.039 740.47 null] +5789 0 obj << +/D [5785 0 R /XYZ 85.039 542.954 null] >> endobj -2642 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R /F70 2201 0 R /F18 2207 0 R >> -/XObject << /Im1 2193 0 R >> +5784 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2654 0 obj << -/Length 2984 +5792 0 obj << +/Length 2737 /Filter /FlateDecode >> stream -xÚÍkoÛFò»…N(P -ˆh’»ËGïÃÁ—¸©ŠDV-é!ÍZ¤-â(R!)+.îÇß}vF êç ÇQ8:ÀرÝ(m/¤¶’B¿çË‹_Z*<'G¼jà^Séù¶À@8vÊö‚®¸`â%ªG8u¶Æ!¼{2´†xµAH`­ËªJkDÙ °Ê"ቦä'QŠaIh–”÷c£©Öû^\5—Wh*ëíàÍwŸ§øo2Už²þ3ý(¼_CŸßþÎñǬHÊCÍohmøüúãvÑl.ÖDê2 -ǽ-®Þ-~º:¿¢>Ø‹û^å»M|jÒ®ÙÊ‘£©Øô¿mٖ´kœ `d¬U YëÕ¯‹þuÞÏË?À²[é8NÝbñúlÙT³ÅõìHºG|9§¸(iµx=>åG·\z¶#½?ÀŒ†Yë¹ÒB=K‡V9@‡Gý˜Ž‚0ò×v”Ûò7€׎P½{ü„¡En}u =_ÍnæuŸ{ý Â?xv{ý†®oßÏà±ÄÙ%Žnp4_¸T©ˆ+£/påÈ•èåñ§7¦»v«p9Ûz£7%\jÔS™Èöàü!D•ÈïÜ|8 8³‚–|b•¤è"„jm™yƒ*-šü‰gcxO3&ÄÂ8ƒ\“=ra¦©Z‡B/ì¤ï4•MY7¯x¢,R=¸rÒìÂ1`°ó¡ƒ–xŠ$k²²¨¼¥óOÐÓ£§eà¦Ìí²ª½9÷CQYÙ¡7K]ß¾ìY¥t˜û›ã§dZñÂS¢8Õ§9(°ÕF»fW’èâër_àå\aík<…ëá]b̬ˢH× /m4cz‚0nR¶<Àv_ë•8ƒ`Ï…3S÷–5ƒ1ÐãÓaùþæ('³ Ë1NKi–U%' £ß ºg>Å Îø&_û ŠÉSçbò$Š)áI“Fƒ‹. -ëy#B÷¨.‘,é÷J„Ѐxt®ùl“ >Ö¹·´õöŽ‚7;ƒNˆ¨+'l - “t»`IÜBxõ nß¾À¤9T—¢é<…`ÿ²…|æd7ßµ=ˆƒR¶ôe©äYÍɜ؇€€òx D|ùÌJ£ÅT±¡/rL¢å8 F>.´±À‚ºÉòœ:!ª™r]3B·¼#2)…žO{.(ÐY™§„­íHŸÓ‹|–9 -Ÿyœm2Óy­¯1Ò’Ô Sù¤Å‚šÙZ©ð¬Û”4*Õ×&¥•ÙÚ0͘ï¬ô)Ž™)m’ÖÆڽȢ\È´ç¬M$úžbPlüJ‘?}ÏÃ;$ôÄã$½Çcìs–òQF¦\È'¼Ñ4tl_‰?—8L1;qQ}ÚjëÏfÚ„S‚ -‹—«²›Âè ±Ó ¦nÄ®øKc¬YJÚ«@)’02+5 ´s_uYÕ«¿¯+."T^S§Õc¶ÖâB£ÆuÍõí‰v7}Rõž'é6YCõ“µ•Û«gSð:Ûr… e[B—8ö±ð)L÷Bð‹¿Š?„“MÀ±5kHsÞúHRxM2æGEÙmÃŒ`¥^¹£‡7O+½01^™ÜÅ-žX³ƒÇíL9‹p,̪r;N¥ò­t®„‹Öa¥Û8'mçÒû7צDÌèvm1öB¿Ùu6[ðŠñ<íåQxMjNXÙÃe΂Î]mtŒf¯2flb’{ÿd–Ÿ‘íÝŽËÆž4fM&î9BÅ…N0ZUmÁ[ë˜Õ–± Sômb ¥qk½°³²›#QØÀ‹­{&rnu?= zÅsÓËPÝ’UtaÒéÈÁx¼à¸ÇÊcHלÁ{Ìxtáòr¼‘/¬a‰î“õ†ÄÂÙl¤5\oü$í”8Î C Ñtœ§àϾ•÷Ï#¤Kj´‰FÜÆn«}®‰¢Ýù©™ £¦£’»ª4 í¿1b}DΞŸF†mžÐ<åõõ¹ßŸŠÐvCôûÊv…7”:˜<ʾРZì ‚pG¿¦J9Ö2m€ÈK?°ÞTPñT5¿Ü—Á'…—ë¯(íºC]ð-´›Ð¯ŸMq=ôñų‡vï胱cEŽÑñ@Ô8#•À÷)Lm:1)®ä¾ìŸ=éL4¼7ÿŽÆn´íB@I ^!†4ÄØNóq'~Ì?¼{Ç#f óAojpó£–δ.Dr¥‡ƒá -Ù`âØ»¡<ë*ÑŽÆ‹^û8°x ßiEÕa’)Âs¾ºôÇá—®C‹­Wå»Ö½5év×ù@¤{Áó1KB>»¾;¬îC‚,wº0iºœëÓ60@Ñócwîaîrç÷¨‹ØäŒjS™Â˹L ?!žuJ„û¶J”êò›UG]wº¥€¶ƒçÑ%¸:ß⹺¬¦ â‡ôn¨úßh¨¾I!I›(ÚY“ë´é¬G5ORL ‚2ój³x@b—ÇO)BÌ)©= -ΫÉbáõžR#^„Ô;¦¿Öúx¦Ã“ZP\Vé•YÍsxœg:ÏYQ7¨ÍŠÓ¦ˆs’ÂdCO à”ô‹°+†ƒZ)Ò+E0—ËmÒ®š1`¶"(pÇ#óRØÌ×Ä¡ö(±ëMÉX8AiÆÄê†ßqt!žÙ˜-ZŸëFQÒÿÁ:á~C'^çõû!Õó”‚°óÕÑS:­B@ë–+'B¨ŽŒ)ïÆW“«á¸Í¯DDzœgÛzÑC–S%ÇÉŠ¶NMäQ Ú?Ä©ÿ&©—ÏÒ7£¬—Œ U‡¬HØ›ê?ºýDJŒéå«q¯šlÊ=ÁÉ -ˤ_O­âÇ ¸Ž¹]cT0ú ³aAŸv‰e`KùèGÊç]ªßRÊ*>Ô:Ík Çó®,('b'iÛ˜8{Vû¦áÔÎk«|âZAÞcâiwY ¦”çâàþ 6·«ç+ÏV®úk±t™æºWƒ]*FñqqtOckZ0Ì%ë©»½þ¸˜ø󈾾“B3§1}m?»FÃì¬Ù@b;k“H¬Ç‘\5õn½@dŠ/ºã4àÉÒ¶ÆoØ ¡ÖiÛu$ °[9ìÿg÷Ümê\OÔóֺ ÷ÇŒƒÍùå̳DÁ1‹usÍd8>ú 4Ú|$n3gD«Ÿj¶õ­¦Qv¹c¥DùFÁÓcJ¶Ú/m羫Wýû>Wÿ>ñ —Q÷‘–à:a†Qk7èa@Mx¶MTÃ7z0^nb‹ŽõT|‡VÆèu¾µ;ÉqþÛîùXê”\`T9¯Ý”,4øOÿX£k=ÿ‰¿ží Õïc?ož¡<ÿÚK8Gÿ_®Ï%¾endstream -endobj -2653 0 obj << +xÚµZIsÛF¾ëWðØB£÷ÜÇžq&){lffª’ ’P& ZÒüúy¯ì[)W‰î×ï-ý6˜®bøGWZ˜™•Ò”0­W»ãU¼ºƒ•¿]QO±ñ$›Í÷Û«ë·’¯hLLlVÛÛöA¸`«íþ×èõß_}ؾù¸Þ0Æ¢$&ëR:ú´¦Ñv­YôjèèõzC£ÀÔ«ïqôÓGý¯·0õÉ~ÿÃ/0Ï¿o¼z³m5ïaý÷ê×ßãÕXøñ*&ÌèÕ#ŒcBaùx¸ˆàÌ?®>]ý³9Ê­ñ•Û5%…@±¡†˜D,KJRÂ%k$•À*'ŒK”¥ a4Y)s+*ùn¢w§Ý˜=ïQüeRFÇ~i´?ãR†+Õœ0ü©ðbÀ³eìÌÓvJŒ=ì‰ Ê«Ùa§ED¥ç}^Ï¡óû´43kÄ‚Pa,€W Î@" –üøPNq+60²ý¹3WŽ`Â, µO¿Å”{Ù"QºÃÃvNÒUc}ßÒÙw>¯©Š;Gr›îòCÓ5Úø3Z;‡+mïýÎ[X-‡ ó“ßX<`å4\EZçÅɪÚj,PX–Ó2s—^yg©‘™ï†RÒ’J“XNI=¡DS Ã)PÆ e«M»}B!`.B‹ð +WÝ#¼9(’Aé×ci÷/€ñDˆfWœNÙ®¾Þç•UjqIÁ ŽëY”p‹ŒL¾e»¥'B”{´–Ò£*PõϨ`ÞXÄ©º¶‹e–ÖÙu™-/h=_ðϼ¼™"œ²¯ç¤Ý¿À‰'BNº7©ƒá¢ä‡¢²3×eðg¸–Z¦²ë3>rüûèa;^9Ï1ž¶Ÿq/|3O½KK2ïÝd¬IÒóm‰÷mÙS=z7…ð#¤ð».F!F “1hNÚ4GM`ÔhÚˆKî¶9g^½7MºZ¡‘±ó;Ûû½aÌ׊¡ÊºV˜ kù¾Õjb¢:·:O¸š€·jGõ½5[È$d÷½,“€³ÇÞ]¢H¢´'ùy‘Þعî±óÙ“E“=ÔDêG6EÕäÞ3”âÁûÜÓÏu.((wž™»hdÄÔѵÔÂò +Õ³ èöÑÙK¥•[zD Ï÷fk)p'î;"7^ä0­|°u{á²ëÊçÛ°YàßlgmÜ)Ã+rºÍH†@û5'‘ÚOžºñ(p}ß^ù`Þ÷ÖE*„i&v»×d÷ -kw>$ªÈº[ë­€¸¶^Ü®zíÁè1·„ÑMð8v:„Ò¼®³°©›=Ñ”ˆGPŒ”=$›h -¸§.!‹ß `øÏÞJ:¬Š‘´œ1”ÛýNa7õ–­[¬}V`WP'w-XïÒ&’Єú{Q½Æ÷‡ ïü‘“’6™œà;½&Ž6+qs õµ³-xpÂóg4ž}W”ûV:YŠ÷E‚j"˜{Pe”÷ ldz‘E«„b`ÒéQðuF)È0‰P½lhøÛzdÃILåj#p¯T§=å©‘5æµ‘àƒ¬ÉhŽ„NhAH¨Œ×ÂH0‰Pä&«ÎËGÍaß[NÂ×½yµõu¶Ö-¾ò‰±U÷SæOÁHßœñ60Ì¡BNgýÄ`©€Æ]¢Å’’¯8DN•|[™×:­¹c즎q#O=Ô!zr¨ˆ 33ñS (ùØŠkIb_ç5rü©wÙbdî%DÞÎñ_5¶ –QE Ôö“`pî?E§s¨œElÜÖéùÁ_ùÔÚ‘ß“C6 ™ì³{|?[ØtLHp^†q´ +©Ö¦©é¿ÙnÄ ™a›¹Æ@ù ‡r•X¸Š*žµö¤—°%\…tp½Æj¤‰×]ki¢ ×ÎËÌ©û%¸xauC~›?l–ZÏê›Ç„~Aß„k+W:«ïö¤¯‡Õê{ W£ï.«oÙg´Ý_ýØ©íº+<ú€ Rãl†“W•)ƒäòõ½õ,wӯƊ^B6…é²"¨ÇŒÑ¬ˆÅV·¶xµ¢ö¤—°¢%\upý•V„“sq¤£öÙû^S¨’pàkÛ™˜³°—[ÏÂÌ7[$EZÌt{¡~_𪆓å&S’¶ÜTš•P%{mæÛ*·éç5£M,8˜µ[¿©·âŽÚtΚj®0’HÑÃú`;ïYyœë¸3ɉ$ÔÒÌ7Z—Dè¤ÓháPÏwÛ^¡ýÏAf¶kz¢¶5¸wXââoª8·éc‘m=‡kðΡ°Å7®mz²gA5œ·µdty ïhêmœ¬\­:¾s¿Å"ÆLÃ-³…7g"ú”ºª;uUs•Û¾E鶜]R:Â_N˜U<Á™ÔMXAÀ/È`ïF¶Ï{½w|lñ8¬¼sO<)Z&Û¢‰ò[ ?U5H3k_è‚ ® °D™ñm$qí{£;å3,—ÙƒkY•k×l1¾UaB«»Cž¹®CX° (6’cTÔA¡Û,Ý([罶s]ö}ü—e^§7¾—³ Ck $o®Kc‡Ks.4r‚ñ.xþ¼Ó1tKîzi Àâ|wßyôçtXnÞÓŠN„;µtG´Í" )ðNùeàÕPw_ŸVZ_sÌ`Ÿ'¤Áw•‹jŹößÓñæ[ε¯²ökßä Ìx¡DqˆMfÑ uhæýt"!>©~û›{? –ò¼se…Œ‰æjEK3ï ž¡Tó}OÉðu¿¶91g››£DtÈ?‡¯RƒÞ4bW,ú·µ•“;ë\ÙnŒÒ“ûD禱«f?Ü>»™]j»ŠJ†þ"ŒZ“w¹FÞÇÆw…þrçîÂÁx`¥ck:vlЗÒÖàï½ÿèW:_ ªÈZ3ÉÇ_˜uZÖ#Z;»íµéºý¦AwÈöl‡ö +èÁ%OEY€Å^D,èÇ_ c OC~ª!6ÓéOMžfÓ!jìsdñ8{̾[Û0BÇ}TT9È ¢vù<»5SËx<ÍO¿¥Cf›èž·ïþóó›YÀ`ÓÉŽZ¢x¢|匯ÌÆÙ”I¥rˆ§ðNIËeÞ…;Ï.ðÞ-ðq·¯òv8þFç’‹8<ÍÇ ÐÒ$îpt™u¨Ÿs‰õ–huO4`½¶YÌyw?ΞQ"YFàiFúLki™í"Xfšs¢8¿ÀtK´À´'0}LŸ*t½ÿ³æ>¥nÿ=i †§Á¨[ ² c™sF¡ü8o‰8÷Dέ¡?í0ˆœ÷œK¢Ð¿-Áð4#£Ž‚NtÆ2çPêK./pÞ-pî‰þ$çøAua\*åÜgxwÒ°†‚#P=°X) ¿áĜĉ\”N ½°ït!Aï…Ë +Ácº –hA!žh “õ<_²²rŸd«1ó #½Œ$ÐŒ ˜U)ÓC2É|(ÊcpTÓm‘ €þP[¤mÊ1Hf¾©ˆ$! Xl>­ÔToIh6üì‹,jendstream +endobj +5791 0 obj << /Type /Page -/Contents 2654 0 R -/Resources 2652 0 R +/Contents 5792 0 R +/Resources 5790 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2619 0 R -/Annots [ 2656 0 R ] +/Parent 5801 0 R >> endobj -2656 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [254.042 503.917 317.277 515.606] -/Subtype/Link/A<> +5793 0 obj << +/D [5791 0 R /XYZ 85.039 781.388 null] >> endobj -2655 0 obj << -/D [2653 0 R /XYZ 85.039 781.388 null] +1882 0 obj << +/D [5791 0 R /XYZ 85.039 761.463 null] >> endobj -558 0 obj << -/D [2653 0 R /XYZ 85.039 326.218 null] +5794 0 obj << +/D [5791 0 R /XYZ 85.039 739.701 null] >> endobj -2657 0 obj << -/D [2653 0 R /XYZ 85.039 305.021 null] +1886 0 obj << +/D [5791 0 R /XYZ 85.039 739.701 null] >> endobj -2652 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F70 2201 0 R /F18 2207 0 R /F41 2104 0 R /F20 1617 0 R /F65 2099 0 R >> -/XObject << /Im2 2261 0 R >> -/ProcSet [ /PDF /Text ] +5795 0 obj << +/D [5791 0 R /XYZ 85.039 718.708 null] >> endobj -2660 0 obj << -/Length 2270 -/Filter /FlateDecode ->> -stream -xÚ½mo›Hó{~…=§ÃRMYX0Dê·—¶©ÒÄOì^OòålP1ø×é¿æe°MOϽ¶J˜Ù÷ˆYð_Œ|×´œ`4õ…éøþ(Ú^X£ ì¼»ŠÂIÓò\Üz½¼xùÖ³GÂ2+-×D²ŒWÆ›÷³ùòúa¿Ç½±ïËñãòÃÅõ²wáDšÒsðÆß.VÖ(¡>\X¦ø£À–)‚`´½®cºÒQëübqñßöÞ“#æÐk"…k: ÍıLß—­‚ÂPpVרŤÞ"m@#ß2¾mß(÷°˜F -ø_ñW²”ÈR$7IÌ䇬I -ùQ•ã ×(,‘Gå¾ÛѼl ŽoCêßÎùô¡%‰u÷¤Äîó€½çnÙN.,y ‹ µm¯Ë•€ #?¼˜<Ìߘ¼^êôÃæ>¡µUš9aTxÒkÅÒ¤!]ç³ýÕ×®uçU^SP´Ç(æB«q˜Ñ­äœo™ÈW}Ír͵¡“is²ã®’-…&Âl&„ÚJŒBc“rU,áf¿¹¶NÓ¹–˦K:¿Ó&ÕpŸëØ‘ª£´µ—•º†²¥$U–Í6­êñ€¦O(†Xú´÷8®E©ƒ{o’'ôÅüL¹Ét‡áx’½ - -ðe¿u\êÓH—j›©ÉJ g©®O5û50wT<µ*^29Ñ$Ï')8ä§Æ¡àR¸¡©f¿3O§S(Õ¦ðajžgÚž-í©iO±Â Ó·§í`iÞ0Lžn°)lî™Ùã.ö;PÝAqàW…žõhÀGr“ð²ØoŸˆ–Ôh<èBcè¡à jA§ -hélÓ±åïŠï›=éÇâ{eeiaÿjÓVa8a%įÎ?ĆUV«A -ÖPp÷•Î$Õ¤qÒ¹5§1³?‚1=†]ÖŠ-€Ø^oÅ¥mÚ dµ­»¥H¾› -kžk´šíÔÔÆŽád¬²v´"'KA‡qÍ.у"RËú±f=vZ¦k iŸŽj*ÒqÐp–˜p%&ìÍæŸ8)Ô4XrQ=p5u|œ1 ð¿𨰊Ùp´À¨CUp¡ ‡po*¥°›5só[FÕ‘B(¼¥±§Í‰¤©ÔæyOqtå'¡¶ -Š¹0wù?ÆÆ:àK–ü$ È]ÒYZ¦'Õ‹"â«"xxÇñïzñ_q®òK˜ [ŒaàjÈÁ®/.1à¸ýúíÛ¾öœJ³‘À[ëP^:¦Úø~>ò¸Žè^a±¯U€ÃJpL–‘B¦Šö4 ¥ºÙ<8†ü+Ï4§j ò¡|HïxŠUU•b–&ÌÕ Ë¥^þÚ›1ž¤„¾§ÆÚu™çëí›7§ãö=“NzÆ2C±·S§ã圑¶E^¿:öøÙ)s¹’§3!NÜ‘òÚ® ú´k¢Â¸“&Âÿ É®9…:ÛZ™në 1üöM¥gS²H“OŒn¿ü Þ9«¤Q?/ù˜ý¶Ÿ*UÍÍñ\lhm¦ç€©\5~*·aV¼ZÝÍînfPžl׸_¼Z}*²gµ\$Õפzµ‚Ú‹uQPwMkæ»4tuNB±6Ç -ÇÍëRcýÂç³ï=$ðœ;Óü¡¢á›b]2$È #ÛgzÌ}ú;¨W ®Þϸ…R}@ËáJZ–Õ*•%J¾ùâQ½Â¨óIÿ/çþ ÙlñïÈöç ·È^ÂÏÇ_N¤S -ò~HýÁTÐÉö÷fÄIßý×ÓaÀàë<ÜÔW+ëÙ·ðßãy /Ð «_…#ñg~ÿîŸén²CG¥NœÔQ•íð ÆÕJ3 1¿¸»Waòpó3~ÐExöóìævöúöš—oï~ùþf¡üŒŸy¯^ Ýᇳ¢¹Z„‚+èíß -8@±Ë)`¢P€g¥ÆŽêÏ‘Úþ‡ô?/™¦9ª”¼•bO™œ~p{ùVŠþ—WB”ÜÅ ^Ò•jÿ“¥¿ ù^N$¼+B‹öeª÷m•S}ꙎÜ`æ‹©`_úîÿ+ÔpøfàÿXOè‚{±¢¤®×û¿k C­‹‹R^5ªtŽõǪùùË-¤é -PSúíÎÿ ¢Ìý×þ>!mÈ|·õÝïŽu¾{6(2ÍÑœø?šÌWTendstream -endobj -2659 0 obj << -/Type /Page -/Contents 2660 0 R -/Resources 2658 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2664 0 R -/Annots [ 2663 0 R ] +1890 0 obj << +/D [5791 0 R /XYZ 85.039 619.42 null] >> endobj -2663 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [129.868 508.057 297.154 519.746] -/Subtype/Link/A<> +5796 0 obj << +/D [5791 0 R /XYZ 85.039 601.154 null] >> endobj -2661 0 obj << -/D [2659 0 R /XYZ 85.039 781.388 null] +5797 0 obj << +/D [5791 0 R /XYZ 85.039 516.543 null] >> endobj -562 0 obj << -/D [2659 0 R /XYZ 85.039 584.243 null] +5798 0 obj << +/D [5791 0 R /XYZ 257.152 522.516 null] >> endobj -2662 0 obj << -/D [2659 0 R /XYZ 85.039 563.046 null] +1894 0 obj << +/D [5791 0 R /XYZ 85.039 379.003 null] >> endobj -2658 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F20 1617 0 R /F56 1642 0 R /F41 2104 0 R >> +5799 0 obj << +/D [5791 0 R /XYZ 85.039 357.806 null] +>> endobj +1898 0 obj << +/D [5791 0 R /XYZ 85.039 274.999 null] +>> endobj +5800 0 obj << +/D [5791 0 R /XYZ 85.039 253.802 null] +>> endobj +5790 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2667 0 obj << -/Length 2459 +5804 0 obj << +/Length 2666 /Filter /FlateDecode >> stream -xÚÅYkoÛFýî_¡um”ÂF#gø -àn›&鶩×ÑÂX4J‹”E„"U’ò£Ø¿÷1CQ'Ý‹"å<ïÜç™3²¹ðŸE¾pU< -#)Tæ«wt3¯O¤YᎴp§¾L¼‘tEìÆ£Ù‚–ÌÒ_ïÞ\^Í^]'J)G*1ž„aä\¥sýöÝl<‘ÎÛw¯yö= þëêêœGÊ™›ýxòjÖ;p¢…žøÇɯ¿¹£”úñÄ*ŽFÐv…ŒãÑêDûJøZ™~qòþ䟞Ó#Þ5`×Ä®˜ÈXÄž?´Æ …*Xûqçæ$Œø}€Õž£4ïû®s™¦yy6¡ó.{àÆU—mV£C œû<áF»ÄÑŒ;7y™Vc%‡ÞÒwØž± Ë«›}¿M¬¶žPϘÁ·³Fúýö Ïñ4[$›Ìj_À@áKVc/rnž¯>¸R‘âuÃ#IQpc]ç°¯ÄÕd2Ž5¸t ÃIu–á) F—c²_:)æ%š8ýAõôüHDJ5›Õ­˜Wå‚îX¢c¹Ê¬Q$²]Ž;ŸbzB<Œ‚¾S5š(7ÂäÀ$‰IÈ¢BG¤Y Öžv. 2§ƒç•“=æMKLj_:0o°£·¸‹î13í2ãÆ ./Ó1Š½løq -ëEBbqcW»ÉÿLj3ŸƒgŒª3v¹;aQM>ä¨ÆMiçw““ Ó,­Ø«0DÅoÊ•ë{•áPòÉ@¨ê±Ë;-òò Üë í›ûBqÊïÉÌå97ÒΜ…6”µÛ ] ´i(ñjîQ¼"Hå[4×ln+þRÌ70AæœÆÍ‚Š]ƒk²GžoZN7V²ð_ÖÖ¿X!a[&¬„t^=~p}—³zÇOÊ‹„Ú´.ËÄ7-S ,òÅg5•&¿U,täq:ø´ô!GÂÈ&˜+ÜHªA^×I›³ ^Áµ}ŸÙ]WÇ0ŒJç"äÓÚ©ÉcNÕòdUÛ½”ã[\ WyIÚIG6å‹èÿ’[”*‰eFâ ñð„ûû7N_žYB×Wè`a'ÆJvNw‹.> d¦eÝIL鹑ÐP0–øKS…õ×±³î!¹½kžbÌZ­¸öÓÀõE¬Ž¤„Ì}ɾ† ùÄe‚zØj×@eþ¤V5¼¬ DSž¸ûÜû;ô/VŒ»8OæUw5øžúË1ßš€ mª…BêÝ((Ø÷,ú*/ÞִѨ¶êç+–ÛÚEtÀSwj¶âáÙ†‰'´òŒK§Y;Ÿ®‘æÍ“õ:‡‘pµYKˆ‡'kR­b“6³í -z;NA×ÖÏ !&(§Çžj:PÝŸÅ•‰+-XdGǬ—“ú »A‡Áx7b7K»aBFPíDˆ´Œ·õî¹Ûz‡ñE]­¸•ðg^äF†‹O»¤Ó¾Ô/¡[ŠòPî–Õ?Œ5K¢šØL«íÍÛðP‰—6ˆ½½`×øAÏ5;øàGŽ¢o1vN:àM(¶Þj¼ -rä :5A#R#P€SóŠ¬%(€阆G”V®‰Z7æ%á\¦/Ã×~îBÝ…KþT† í0ˬȤ¥òàS[“³°Þ';iA5| èÊžŠ71ö)Ýãå°¬¤Ç4êUk -gftè;o1_µñ¥]cš†bã@Î-ÉÅCP—–Û¯éàcGÄÙP4GjÔèQ™CO/çdŒ¹ŸHö÷Y™gé)¦™OÌ¿uÖnêþ{GKf˜8I†`ƒ$ù¶¨Ð`uÅ몥Uû.i÷öòÝ.¡âŽ_nÇ-(wª˜¦s ²­QïЪMi_2ìzhX†M!{´ÄoaWm Ç!ï?þ`qütY"yLL0YìÛ$áÏM8VÕf¼u&š6@àî¢ò£.‡ ™ð -q]d«^Pèô§!â*c|DÂkRÅêKùAšYk´ØÇ6å‡;€°Ï ¤žwŒ!Fqô5XTæ®ÜVÄkïstÿ+•±>äúî{Ô±e`\ïv—~|èpôôj§Àñ~Êê½´Ç–BÚÂÒ‚ w§$±™45 ³Ç£vÈá@zäq°Üø¯q8%õá϶€‘7OÄ6 ‡ÒêÙ5$N]#*ÀçmË£VººCo¬¹î9:ªw‘¢hÇÅ6¸9b›òè* Vé‘QTó¤z Jþ…jû™#Õ#+ï2s˜E5åIÃÒ<çaiGèe…L2ë€Û0"X›”–Ê-ÜKþ”~™¥ ®ØûÁÇ××ßWæ|mÞmËœH(éÍ?‡˜7pO™>ž-ìå±…K Rp´0=Ž _²á™OE8Žž^‡ˆ¨Û½CPù¯þ6½ÍËi³´èMùñÜxâ{¾ó~^çë–Ûx~ó²Éj3–ð‡.dl¬í¯—ØÉÊø ÙcwÆ~ïÞøª?æ÷•9“/N)“UfÆá阽£3úiÖ)ù}¶Ý6x:呆)|þAºq‹À?ååæñ+kce}üŒ¦ÚlHk°­þ¬-¾Ù‚!hóª<°ªÓ¶ç¿û|nmÉ ÓÂô´þhs`qü¸«Å`5âçä£9³ÙØ=d!{zug˜áÄøö:KßØ6ìjöÌç=Œkš-†ˆÜþ)ã»Ë«‹#(·Ïû.g¯.~ObIêßÏÿ}¾:O'çoÎ>ÿû¡ºº(Ö‚®_½Ÿ]^Ï.N¡0·a*Ö&šuÖýhO—ù?²l½SÐójý4pÐܬ:³–îuÅÚt4úô»ôñj±±•~¨A6_šU§À$Ü ®óÍ7_´ïÌûÏ™|ùA*ÿ@JÁá …ðÙÎË&½˜Þ'õ´YWU1—Oϼ¾lxÿeÙ«Ç ÷媀ÿ5˾L?|N_ÿ˜Èb}1Ý4õ”RrÚ$«Û„Ô§8LÏ|±®Ë—°Ú“ÇüºË^#¸ZüK™‚Wb(‡ÿ:h¬üßþX§=À]6Ù -;Î{¢àK™_¼{ -þmûendstream -endobj -2666 0 obj << +xÚ¥Y[sÛÆ~ׯ`ýRpF\Xüâ‘m¹ã4©¥x:“ä"@50¸ˆfúÛ{n‹ I°v4ìåìî·ç~–Î̆?gúÊÖÑl:J‡álµ»±g˜ùË# !Y hÞ>ÝÜ}¼™c«ÈŽfOë~_y¾ž=%¿XïþzÿÓÓÃçùBkm¹¶š/–ËÐzœ;ÖÓ<ÔÖýÜ ­wó…c}C÷o±õé©¿|€¡GnÿðãûŸaû¿=}¼yxêugŠaý~óËoö,+|¼±•ŽÂÙÚ¶r`zw¸”ïiéç77ï¶â9oÆ«.qÁP,œHE®S£¼@wœraÖQ‘ï#§ÇUÚqgKßV¾í«€;ZÁ}`’ïÛV‘6qç_§n,K¯bèiƒã¤Õap# ÷ó…§GSoWÎ ¦¤pyŠ"º… ß³š-ŒÄ R9Ö!Ëqž;i\#]ʬ°].hé7 Êh²™cÐXuä@¹æeu¼›»Këá™I“KµOà!!@èª ×l‰À›…ƒä»Ötxõ‚€øøZ™°hH{Ÿ¼ÌýÏF4 vMkTOÏZ•;ìïéÀ4amJùnS¦*sFƒ=zì9üúTâFRA)7p/‰ÜuTè„м¤Žö”£g‹Áú ê #å‡~w^;k_‚ø–,­ºø³Œ®à®|³ø™æËÖÌTiÜdņ{(Oüª{dÐ>Oß—xÑç\V¯¡SV_ë[&û'NŠ†ÐÀWdzš Ï­;n„áëòš#kÓ—¾Z:úç`¿þ +…ˆ8HwP_´Ø·qÅj=8ï>èá.­‚È…cIGwÏjUk¦æÁan(täÝ•¬¯1s(B ìIÅ@Ïb.¤³Å¯¤ðEÊ’”;eÅß’ ¨ä‘<ëDvK&´p¨ë² ù#]?‘sëÙ`&Jƒ!aq’‰¡.4å´içùqžV­¯úÂMç=¥½`è w©–‘cü±‡®Ø‹¬/åÆ¢ c“´¹\óDü“ŒY³¸vëô°%÷Ö2_N½ +¿§™våp?åivYO[t³¤trÕdeÁC½`ôžk44ùg¶a}2ËÞ÷-Òá¬leÿL±âf³¡}6„¾ ØÙÆŨµÐ@§îi§²nD?Îù3) +o‰ŠTöF`Ô¨ªR¾6^ñȤUZ‹z;Î<Á‚‰Ê( +!á»/BY¥²vml£,R³3‡À²O\”æ â±_mßNÕ”Í5C9¿_&^v=½æ(Äh‹ÂŠÕH¼i5ŽE'܆m¶"o +PB=‡éw([#€2¼3<ÿ†ŠÑ“µ*nRB)¨qnÙG#6a[–¢2r6 ÊäÈû"lü"GÚ‚õ¸#áC´æ/‡p$ ì:;sîŽÃãË6O˜´sV8Ÿíöd'u\ /Î4_Øl5ÂkôÃUÊYR±2¡&œ„¯!@ùÁU'1 ™Î9}pl¶¸8Çr$å|#Q…j„þa*Û–-®BéH¦Ý•E஘Y?þtž÷x®²a‰¡£óp¢ÚÅçaŒêÅ€œÎ…×Ó=ñìmÓì_ßݵªkÕÄǼ¬Z•&íÝ¿Rhf»´ºK7q®ë»¬HÒoj¿ÝŸö‚rþ1ÞÓ‚IÎ@Žäjˆž°p3 ùöxΨ<·£úOìaêÅ€üÂÉ'{âÉ•¤È¨¢Ÿ€s‡-¼Ë $׆òÊ«¤šë@NwB ìa UÎ8·øÌ2ˆN¼›»´95I…„èÂqÜÄ)\u§pþ°Í(“ß2˜|ÇvßÄ1S¬c\SåGîj‚xób@®{×R<&ïWB"e¶7)©lu!äð&±øym»ìCm ž7+qæÀ#xBµD­®°¤jŸ\±æ…fË>µ=««?¨’ƒµŸAí7Ç•\ð$Ìr¼û¦è2W˜èB3ì\"šM\dp.Ó?ü¤ë ÷m‰+±!Ç¢+U骃 -ŒÕ&•1Š©}“†õêOj²º!²ÛW<ýê±ä˜vø>=p-¡Jj&ò­´Y±ZÁ?†;B“ÂJÕF9òlX²#YÌuEFƒS/æ0ÈlÏæb>uÓ&IE()¯LžWaß>WN$êkŠm %å¢$üÈ) ¤ýKH…eU’uºŒ=òœ\àL»jZ¡ð@P˜1Ò’ªzlc–ˆ‹0å:¿"`¥ ®%¢C¼§ã’”Áq!NŸµx \¸‹¹ì•t¡ü!®ëv·—§¾\}#óæPªÝÒæ²­ ·Õè.ìSŸûŠòˆHÊ¢½èž4š¾ÜÑìnv|þ÷ïÙ^Ó!ÂQL?»˜d̓bjŠ9Ös¼Â |ûŸNŽ¢låuG:ì؉éÕLÉkëõ|•ºñÕ¿No\¾QD¹Ùð÷5MʃOÃÖ˜šA®ŒW +-)ô´$”ý”K‡zå•+Äi^›g6½,÷½,(ÉÍM l¡º¾»ÎqòÊ…3ûªY0œÐ»¸u˯vHÈU 4jæGÊÕL G*\}Ø–<|Èê-i( 62¶¹`äõ¹™Ä,ý—¬"õ‹åA@bá‘u4ÝM¥Â@ 9Üòjþ9 ™N…µë('tF¹°+¹ð ¦À«¸˜Â K¯bèi¦“`mÛÊ—çZlèþË$x@>Ï$Áå>-â¢É@>m­Êjsw +JÛ¡²£p ê„ †æ ÊÅT× —À´%¿zIÉ/^jR§s‹ˆ f%‘Oi|(õa÷Y¢i,(íèZ«’j+¶Ô†79ËLR'íÇÆ#N$¾åx}’ E[g†Œ¿Åö|%BÌèi¹jZÊ&i½Ôž^(¯˜µdzÅpÝ_Ü'>Ú ¹ª…É2w]åªowôk‚Í„qŽØÆÿPLñ£,ä§yzé|ŽºWÜa+!Ûhëøí‹bèðV»}Öe‰—jYC‰‹fVa£nÉC³)‰¡Äý@â|1n í’×÷¼gYVT`C +ÂöT¬ðKŽQ†nznAJ+4¹)nžÉØŽ^Tº³éG(‰VèË>håå|òj®»T¡]õ(šéGL¾¶³4^Í—GÌwån7—)ðÓ؆’¤žÂ#Û\ÅÓÓL{8L;|y•Lͤ±mÝôÁÝ£ÄimJ ¯¢}8Fì0é_j(§èR¼²Jδ¤ñ'È  úø˜æRɾyófÊÓÛê²TàŸeÿýêØñÒÓ*ÔÑeVú.˜´c°`—á)^_‡àgõ9àa÷ +=endstream +endobj +5803 0 obj << /Type /Page -/Contents 2667 0 R -/Resources 2665 0 R +/Contents 5804 0 R +/Resources 5802 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2664 0 R -/Annots [ 2670 0 R 2671 0 R 2672 0 R 2673 0 R ] +/Parent 5801 0 R +/Annots [ 5809 0 R 5810 0 R 5812 0 R ] >> endobj -2670 0 obj << +5809 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 638.298 286.854 651.2] -/Subtype/Link/A<> +/Rect [141.013 496.014 469.456 508.007] +/Subtype/Link/A<> >> endobj -2671 0 obj << +5810 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [167.627 600.436 275.552 612.125] -/Subtype/Link/A<> +/Rect [139.346 482.768 202.339 494.336] +/Subtype/Link/A<> >> endobj -2672 0 obj << +5812 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [251.271 492.042 367.484 503.732] -/Subtype/Link/A<> +/Rect [141.013 297.166 309.095 309.158] +/Subtype/Link/A<> >> endobj -2673 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [258.568 464.944 363.558 476.633] -/Subtype/Link/A<> +5805 0 obj << +/D [5803 0 R /XYZ 85.039 781.388 null] +>> endobj +1902 0 obj << +/D [5803 0 R /XYZ 85.039 761.463 null] >> endobj -2668 0 obj << -/D [2666 0 R /XYZ 85.039 781.388 null] +5806 0 obj << +/D [5803 0 R /XYZ 85.039 743.459 null] >> endobj -566 0 obj << -/D [2666 0 R /XYZ 85.039 761.463 null] +1906 0 obj << +/D [5803 0 R /XYZ 85.039 643.603 null] +>> endobj +5807 0 obj << +/D [5803 0 R /XYZ 85.039 616.988 null] +>> endobj +1910 0 obj << +/D [5803 0 R /XYZ 85.039 531.856 null] +>> endobj +5808 0 obj << +/D [5803 0 R /XYZ 85.039 512.984 null] +>> endobj +1914 0 obj << +/D [5803 0 R /XYZ 85.039 333.007 null] +>> endobj +5811 0 obj << +/D [5803 0 R /XYZ 85.039 314.135 null] >> endobj -2669 0 obj << -/D [2666 0 R /XYZ 85.039 741.134 null] +1918 0 obj << +/D [5803 0 R /XYZ 85.039 227.829 null] +>> endobj +5813 0 obj << +/D [5803 0 R /XYZ 85.039 201.214 null] >> endobj -2665 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F41 2104 0 R /F56 1642 0 R >> +5802 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2676 0 obj << -/Length 2310 +5816 0 obj << +/Length 2888 /Filter /FlateDecode >> stream -xÚÕY[oÛF~÷¯\cA1ÅËð–‡,Òn’ºÈºZ[EvÑí-Ž$"¼($×ûë{nCQå¦hØ…aÏý̹ŸohwâÀ;‰Ûñ“I»¶Ç“eyáLÖ°òî•ÎDÙNàÒ·‹‹ÙÛЛ¸Ž8Éd±¢-‹ìgë»ï_Ïoî¦×¾ï[®oO¯£(¶æS׺»¹]L¯]ëæö¯ÞÃäOóù¸6}k1ýeñÃÅ›ÅàÂke«ÐÇ?]üü‹3É€©.ÛOâÉ#ôÛM’Iy¡ß”/ãââþâ=^S>5"×µòBÛ‹ ã;v«^@?°«wËÍô:ðër¶k›YQ/ÓbÖ¦åC:ûœ6³m“WÝì*°·MuÉ_½âvÖ•[^O³Ì¾ºâYïÕ_\åu‘ׄ.ZnêÇŠw\½Ÿÿ×nô"ÛIøÆòc–7ré¶Ûº.fÅ6›]y£ –uÆÛ#Çù#çNû’sßh8)çÜC1¿D/ÏôþÁà„žÿµT_›`ðµ †_ƒàÕÝ›ûÅë»Å×0Ÿ½­;î´»Fs/_qÛmòVf¤­´Ît6Â× ìOx)ò‡Y[>Ø˺ZéhtŽHý«ÞíïžDîv„IÊÍç´ØéÜ؉T7²¥B§Ò>nR™Ë¥-uZµö²º·ðåßêJ(Zÿj;Ç)Ó‹ùÐB}‰ãh,ÿš-@0QQŸ}=XsíïØg_ØãÙP0(,AàX÷h('ah¥U†Èš£[èFSßµê©ïXMמãÎyŽ-ϱƒd_õܱ¢ð!¯€©¬žz±õ®äC{»˜yæElaØšz‰ÕñL«±60ÿOõ#9¶8Ñ‚æa°ÌÓNË<6ÐÃù½Ç¼ÛðšN—Sh6fçþæþОRPq7ЧÉVÈWD²Ä©´( û4 éGaÙwP×ÚHýº)qÜ!•ö#ëý|á¾×õ]ßúîÇ¿»/a£ ßÞ¼c–t·´mdÎ €Wƒda Xâ­»¶ãQZŠjµ;ôH-GÜA|.IÚ-­Ÿ -V·Î´‡ãÙû9òÇ*Íø˜˜z)êuƒî’Ë·¾}âÅÌè•–îŠî«ªFW*d ´PkðJCÍÜ> œšÃ+ ¨jaêò^”ˆ+§±;G!óÑ8„˜!éQu—@Wñ–Tƒ´-å†óÄž úÒ%È:jh?ºšÎ¢Ð¬C-Ô(a!FƒÇ=î¥ãa.“a2Ã-&L$4tô#ÆmÒ®w÷†h.~â+ê¶ÜM¹iÌæOÐÙåý°¤¿}(ÃNr ÷TÉ"bD’ÇðyL‘¬oIÁ’N†¼BÍÒ¢”(LÞJ…Ù1¦`À…CMâ i;c±À´ø~ìCä]ÔÓ[¹eÁõËùiÞ  ìL›ªÖ—|dà&ÏTÃ$r="¨†áÈ=NGX‰}åpë'P½tŽ”›¢^çP{yp½eãžJÚ¶&V×…"–œs‡ÑÖ娱Bó¡Þí„…ÔãáÊäHœcÛ#WélxHQþ´ZæÕš=¡ß[¥ÈT!„phN‚#õnò@KOd€šSõB_¼7ŒÉˆ;ŽRN=زžé;®"•!”™:mÍÙ…wõA‘¶uEAwôjòâØv‚HÊä$URÛaìÉ>1@k*ü¥¾NÓ‘—¢ëXP>WrœkÖ²x÷î™Ê­ÉwvåÐæ^(QQ—%¢Š£Ë’Äöà%9ìX ž8çã&_â­¼Êá«ÒŠ#€M[“Éq ÝgûÂBï—݆­ýŠ†Æ!¯m›zÝHÀ3ÆQk-‰ÉÝC©n­‰^Ïv•{àÞ)ûrÅaïà’ £HqÙð=“^Û§–É—ö ,s½ÄV®‚¹kGêyаÒõ@£²}FüL[ô‚ð Æ°ºOYŽx´¸˜&! -°=n«»óˆÖŽâäYàèÚ¼8ï -‹äàeÊ$át&ÏrŽaoè$I5¦Î|Î3=ÈPÐüt{óOîéO»œ fO„â°ü0Q2Þe€ôOà,ÌáÇl_g’Eç‡pä4÷}Èÿ“6™ MÀ&oñ#åÏ,V$VhtÏó-ºRM™v9Õ&@žRֶЌ¿4nôJ R¶¡ŠÜCš–W1 ê´¹¹/=±.xx^ÐËñ³É†.íPª—³Y~ÈŠÝÖ»fÙC¾ºYk»ÒÝì˜7ð!‹œI0×ã؇žç‡*WŒPÄ<1 -):˜Ì¢Øߣ -ÊJ;óà4Ù]¦®ÀˆÍÅÈfGˆ,ãyÁÁqt@:7´†¨X@ #y$B -2œä )I‰¸*nA3„àÉÛSDËcI[)=æE!©©‡Ö˜Ÿ‰b}ý ÒZ™°ÚôªÉvFns‰'˜Bí%†þª¯Ž‰¦ÛC¼xs¨Ž„ÔÒK9>®§h#œfóp fŠc&(€88 'œùD3š—'OÑüùôäEkÿk!‚Ÿ*n©ˆqáǪñ}X[¹î±’#/zz¤ö_Ø×<šIe?|=t)}«€Eþ*y|a˜}À:ñ¡=Z¡[V»F—ô­óÖà eLºúø»„,l§€…eeêážÉ™ä‚Íž‰±Ú(ˆêâ.;øí¡ÊŸø7žòìÐW_†{â?Â=î¡ýiÛ endstream -endobj -2675 0 obj << +xÚ…ÉŽÛÈõî¯æD!‡¬âšÛLâq=@flŠ’sQHÊmÍ×çmU$%RF­Z^Õ[êíô7üù›$t=nâÄwu’lòú·9ÂÎ?Þø„Ú ƒÆ ›;³»‹”ëñ"ŒàØÅ~êêÀG˜_ŸÞüüNyå¹Q¤7O‡ï+Wûj¥è`ó´ÿ¯£|w» CÏy¿õf(ŽÝvç;ÙPì·;Åο`¹=¶ Ͼ\ÎgÁÒþè€;‘séËæ¸ýãéŸ@ÏNnêEtÿs‰÷"à öóæïO–t¡<ŠR7T‹ÒÁ óåMËyÄn8åÛ@ÑŒo8¢ØðMœ©ón«=§È†KW =3”5"_‹¦øÝób¶_#_®~HáC4úáÆ÷@PéŒF/tì ï›­J|“l(Í´þýÏÇ÷¿á(JA°Bì‡2ïÚ¾= <}.i¯Å{^‰±ÔùøÄ{é÷½O<Ïø¶ ¾RI û D®®F58ÁVÖ3üËv—ÙðQcSb"o›¾Ü)” + +œŸNmuå!°WV?ñ¸lø÷T t#‘x”Ë…žIDì*‚Ûë3NÔ>:)°@Ó7X/»ÏÕ¸X°8{¦ãÐv| ãyE€Gž e]¸SføAž· !P‘vÎ- +##üÏï¢hòª!<&\g_Ëæ¥dõ¿yz¹qš +Ø[¸=Ž()d1œqÑiƒˆöPT¬Ÿ +^ø’Õ¸ý"gû Ü äè3K´Ëêž7²žÁÍ)’p@Ö9BÑòæp¢7@¹ìRßMêéS_P‚·ª£´v*ëDpÆ$¼TE ø>i©JÁAˆ"#Ð¥/0Mïƒ ¬ï8*ë3œßy@mbµpªÕÔpùߟÿƃ<«ªþ킦~&®Çì~«ýœçü‚hHÃN"}”jÎN’ÒK-½Ðþ"'A)Þâù@Ü€Ð3᳚F¾óň ò­Ì'˯åoZnùl†$VlμòŒ:…þ˜—Ð0î93&O¤Q™¸evÝL„8>Â…þ5üÌÖu3§9-«¤¥>C=£SýÜ=ÅŽX+°ÚÉ^+ˆ3þPÜþguÆŒ¹èÀy:•K|3!ÉUÙ„(ïÊ^G„:ÙIˆYGK‘ˆD[ýµçp&oR¿å³Åw”C•‘r²—h{ãüeŽª@Sxó•7ËϽÏ7Ä'4¾å“}K¿s9eÏ{àFÅ°Ž—n4/{‘  á“KµÐ aŠ.~•+Kk=üŒxØÆœ»ç‚T¹* ƹ Ìz,âÈ ›ƒ(‰Å#]["¡®Ñ!ÇÒ1¬ÇÛ T®¯Ç[U“‚ô<$©U…³ÈùÚ°dž§là‘h;°ï㨹 cìZ[Ι`ÿ™4JÌ7æ Ëd­©DYdhƒ¼¸Gÿª­Ý/˜š;ë–,v_Trâƒg¿S¬®8Û úÉ5¤âA[·À3²|;Š¿gœ%YÅÔªŸˆøÞ5ÂÀñèx¾—X!¼ØІ88ö‹ÂZ ¥ÉÏð¼ðÅT@D0¼ìüÄM°`CL +¢”/ñcô2LdÂýY>ðè”ÉRí •üˆ84|DDò¥wБ"–r’ÆÉy ¤<¦·G–À±jÁ‹I^”-°ÖƒÄI¬(,7.¬í®löü* 9ÓŽS1‚é-Ÿ$¹Ò¡9"/ &y—àb)¿¤$ʇAôŽu6&û$;ÜãEÑÈR|æ3}æ`Ëå~®âlL¯ BN‹Ó»ý„$Ò[œ±HX)v œçíŦ…*ˆˆk„’Ö¶ðP45¦ÚØè7ŽgÆlc1m™ÐRPÎijsS»ÀùÓf÷BråÛ.å °”êu_ŽDoìÓCŸ“V‰E{óäÊ‘ÈR‰p”áž;+Þêoòv”°1yßùgŸežÛ·Œ!¤Å0Øn÷mu!Cmåìdô¼ãå±SÞ(UéFgòaÁ^Ll4Ô±oí ŠP‘¥ïɬ¥" ëÊ:×ÂøI…úÖÉ1ö{J„AʃSÚ`€øküeŽøO¥-nHÄIÊÛÖãåéÀçÚ®Xà‘}µ[1ÇäZ¼dJ ̈ø=K98$KØ‹„Ô3³ÄqWüïBEU±ç“SFí…1+ÿ‰£'±¸š‹+¢ gÉ™!ÔЇ‹×f;qþPÀáëÿ9fÜ y ­($µYÐF˜’&‚O´É›„m­Eå¡jXȧ €)Ç\ÛÅyÒ ÚÁÚ² ‚¸Á…&–4“DxÕ›S›9j 圗J-H±l•Cð +\ÉÔ|† l¶K«:ˆ›\•‘ë Ô¶àúzôÆ£ËÌk,ø\vF•È𯷹ÉÉT»ÞJ3ÅÀì&@œÝÓìN%nGö&D Šï0겿Çäß,›Ô©&á ß'þuùÐ#ëÀ]C´ˆò=øèÇL)µsäNÍY2úµœkMœ1ˆÞO~ Îè8èGâ|„Јóߢ8'ø~¡ˆ`‹ð<“–ÏC¡êIq»&0uÓ(ýtF Ò IçB#[|‹Ò™àûŒ¼g=©ÇÕÎø%2nòTG+1ë“ž¥ž– ÒÛš¬bçG®Žúõ”æ²i_˜²‹Ñ4¡Â>¡²·Ÿô  ž³•L.ä•p„¼M2æ[8¾¡¯£VÆ~Î8©y±@ÍË,†Kµç›{6t›6_¾2dFõ]ÂUýZ¢˜I¬C160&.·è$x¾–Éʥç(è Õ*’ÊÚ,wM<6^K‡‰B«À°ð˜ý8ŽÖs ŒàÜu¼‰™HyªVB'ï +4)Éx`Ar "Ü<¬‚ˆ8QøÚ3­Â`lIƒñ˜òšËjn ôTA|"p^Ñœi¿ÎÆnºL¦ã.5¹V:æÞAZÿØó”d¿EiÔˆËØ4¸ ã{¦➈ê4¼kMPŒEÏ9ÈI&]šv¬G™Ò%ù3™­Þ± 5K|1Ui%ŠRîbˤÂt†jN}Ûf^-‰-Óƒ1ëÑ“Ü¡a’­ïi­äÇ>x½Ç˜ Ìz'ÈC7‰”éié=ss…?bŒ:˜îZ–ù +arßCÂF˜õÖ¯}ˆ>òkÞ¡6ázþ¡¤Ÿg•á$? {ZÍsûmÃ\°_gMv,¦ß/L†kÚŒ¤ûl{2›Pr¯zOö{m¢f¾žæÍyËmj¾ ö(»%5ô¥­PHij[°>W7ø+‡ˆ=¸cÚyF¡`Õ§ç5OÏ`K@˜”ýä`S™'[Š‰ýï¼÷ZRFºÔ+1f(¦,Pcù¦&5,›6—Ùêy¹<ðïèX®¼0V”¦^‚S ™°áB™Ï‚xŒ­ëø±2 8FÕ¹÷ŽÂ m+E¬XAÅjK¾•ÆTfE“gÆɘvîyA> àzà ǹâ$Çzéºð Ô´™ºZó±m÷?¾Ç^Æ_A¿ˆYþwÀ(vÏ +o×6•è=Ä·’\qsÓäëÙÁß–YGØãÇð*T*Ç1T6½ùÒS ¼DdƉ´yqãUñmòÒ´š5b‹8¿¯ñaŠEq<> ¬> endobj -2679 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 305.015 212.606 316.704] -/Subtype/Link/A<> +5817 0 obj << +/D [5815 0 R /XYZ 85.039 781.388 null] >> endobj -2681 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [457.73 218.948 613.572 231.85] -/Subtype/Link/A<> +1922 0 obj << +/D [5815 0 R /XYZ 85.039 761.463 null] >> endobj -2677 0 obj << -/D [2675 0 R /XYZ 85.039 781.388 null] +3023 0 obj << +/D [5815 0 R /XYZ 85.039 647.5 null] >> endobj -570 0 obj << -/D [2675 0 R /XYZ 85.039 464.617 null] +1926 0 obj << +/D [5815 0 R /XYZ 85.039 647.5 null] >> endobj -2678 0 obj << -/D [2675 0 R /XYZ 85.039 443.624 null] +5818 0 obj << +/D [5815 0 R /XYZ 85.039 618.764 null] >> endobj -574 0 obj << -/D [2675 0 R /XYZ 85.039 276.385 null] +1930 0 obj << +/D [5815 0 R /XYZ 85.039 492.295 null] >> endobj -2680 0 obj << -/D [2675 0 R /XYZ 85.039 246.981 null] +5819 0 obj << +/D [5815 0 R /XYZ 85.039 465.681 null] >> endobj -578 0 obj << -/D [2675 0 R /XYZ 85.039 178.549 null] +1934 0 obj << +/D [5815 0 R /XYZ 85.039 171.674 null] >> endobj -2682 0 obj << -/D [2675 0 R /XYZ 85.039 157.353 null] +5820 0 obj << +/D [5815 0 R /XYZ 85.039 145.059 null] >> endobj -2674 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F20 1617 0 R /F15 1628 0 R /F41 2104 0 R >> +5814 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2685 0 obj << -/Length 2940 +5823 0 obj << +/Length 3465 /Filter /FlateDecode >> stream -xÚÍËrÛÈñ®¯`ùV–ƒWnŽÖ–µë‡bÑ¥Tmö0" µ @ dn*ÿž~Í$ 9©ì!Å==3Ý=ýý™?–F®f³$õÝ0Mg«í…7[ÃÌÕ…/ÞL¹^áÔ_—~3ßs3/›-e™ÿâ\¾{}³|óy¾ÃÐñCw¾H’Ô¹™ûÎçëËùÂw®?^ñì-¿ÜÜ|¹y:Ëù¯ËŸ.Þ,.”«âOüzñ˯Þ,¢~ºðÜ0KgO0ö\?ËfÛ …n¤By¯.n/þfwá95ãU|- ÆÂÏÜ,ˆ¦p‚Ä ’0€á(³"`ÎH4p |ûNÌG‘ç\¶…îËz \DZsÓ–u_´ø’8?¢@ÚòѼßÌCßÑ«ßè±.ºs‰, ~‡Ðž–N?š¸ªå¦˜/‚,tv@lÛÀ8uVRÔu<Ñ<à3pVD&`Ñ,0Cäçv-½Íaq_0Áó9q†ðB@;½š‰óÛ<Š™;:¤”ç=<>ါšvÈyeoH툔fgp‡Tö¤DvË…Ÿý¶`ÚP”¨Q>ÞuFø‡ymñ@ÂO#@yx½ÅcH.¥,§}Çí¿Á°g4]u² Db‰¶jd9ßÊ~ƒ#Ô±üÂ4&Í×[”Å=Ž5/Í=‰ô7êK­h„ÌmÓƒCî;D¯^L0I;øÈ«ú¨ÂعƽØé6MÛÿc–,Æw¸0Ý10'_¥Ü0®§ëLíu"0u„ jF[ÿŽkJæŽî„d½n‰ýªâcV Ÿª‰/6DÛc2ÚÉëôUe”´ûL[Tšõ2gÀõÇ·<@tÀ®NÐu-hš†¦¶©F«ÂP9uQð]‡¨À€yà1 ƒ²îzàm†îw%EAnèp«aî³ö%n¿hï¾› þEÇŠc"€nÔ/'ôPÝéÖÁQuEûÈr~Ö©?© «;V6ëBT ÈYà¸Ôª:0L3Žîõ½îŠç×÷Ýóˆ-F® ÖÿàÚ¯û¢-ñbqæ±Ô<`ëÔä˜t›u0"†Þ-—7(=1È‚ü¾®ËnËd‡¾aãÙ0ö{Ž¢ÆÊ@û *k~Z_§l#`£;ÆÒ‚­éÜNb90‡Øs¾|Æ—÷Œù€::eZöÀL´·ß“é2('Ï »?1Í Üέƒ<ÑGã“í– ;8 "¥ü¡p`Íî×£"˜£Ëu 6†§x1\®kã r?"®æuW&hí17¹šàùiSZ* ¯Hœ0°z†³ïØúA ?‡nŽ{8È4¼îáËÑsFÂs–`Œ€ô̾Ä(œ¤W"òÊìhî&›Z6¡pÖÚµõKw îë,Îeìòa"G•šÝ)è^½çYvò°5$C»öÃÈãD¬»nzÆ9±}p Yœ J[p<ßn £9Öö"®).…2¶êÕž¤Û\.ÛZ!º"Ù^•ÄWâ¬ÍxÉë&¾«ü?Ê몑׭;N%È€¢A€éË -ߊºŽ<ï%ÊÏ2õ²ûýÐHN¡M&¶šsŽ @mBâÖÑrBÀ¤/0ù ®a;L”:ž°q¯‰÷ƒ<²*M6ÆHŸMnø‘컬ìíUD Hº £Ìo-ì`Áðµ¸ÄcúÅ»OwËOt¹³…Á®›RO(ƒ2_vd¤öSI¨™$yFS öv˜ímHqiÁ{ÎÝÊõÓ`aX{ÈtÏ351ÌçŽr~Œ*tœáp¨ê,Ì »sÌÀªÑ¹%ä•“•ˆ»a¬XKIÁ”Æ:"NÎ7\©iõÆ©h°ç¤^KîÆ®Kؤd$þÆ&zUYïì†sÉõ:[÷”»þ…Z,p}•þ_ŠàjùóŸÄên˜¯‘+½#ǺÄùêy1NA¯D<}s’Ý*TΣ¤V tw,êp«J¬`(XK@ËY\‹ª~Ϫ{À¶'ù—q–Däq:±vTâ•'»é% “BcYĘdM‚˼0A—´@÷Ÿ_©âÁ8G„ ³øÇKe^ùʆþ('g)™\Ø S&E£±æxlŽ}Dz\Á-t=¸–ï¿Ì᩽,%˜zñôçómò`潑U *T=s +lgòÚI7x¬Õ ´'úú©6†“Kǧ‰48æøu_±ûëXÔ+0iŠ‡ÅI—Œ>‚·¨³4MÄeß[19t&¶Ÿ8™ûRѶâWc½œˆÎX?í -ŸÞʨ3”i“9#Ôt¬7ºgŸf²WP’À¬'%yöf/+Àì­/¤zȶGpÅ°bÁwð -¦¥ƒÎÁvBÚÂ4wdoç©¢(Kh»o6ŒNõhw¶m‰mÈ$vî(øH[%¡àJpÂ'E…UµÏm·“áš+ÇœêŽÓ~-€Qœ9#¾zML›Ú ï¥Òoïö¶´Ÿ(®I2׆€¿óà»É¾“¾’ƒë|‚­;Òœc|ÅÔ/‹y8¶~%¥‚ÊÃ1&–¦z1¹ûIàìûÎW»Aoö½¤¼x©wø‰Äb?RP3Ø2/ÀÜ«QPV]^vbeøNÔø)„é€á»ù–(¿ÕvÞž¸«£¡jáûyRƒ°TÆ|“7Z}vR`i¸ÙßK勬Ñü>ñ¥ÆÖ™–ø3¢[@ýž’©ÔökN™"Œ©×‡;R -H“ì5$ß$þ4m;`ô²‘﬚K÷°c8åapúÍÀ½˜“ Ö˜t§/V€K¨%¨«fÍØ uÔú9ªçÉMzŸ?´ÀÀãfBξfgÂÌüD fþš÷ùºç2ŒWˆWqîÖÈkYó³ßÈÉç–…0”>•ëMðÚ8Ÿ&Åã°‘` …B+-4ÝOdOªñîç÷ó¤ • 'Ý¿‰­LéŠó·‡‰ï*¨ÃïìbrÉË}ÛB ¿ljüDs[ôfɳ!ï4±ò¡ïqGyÔˆ8KùÏhyS?–mSo‹z*í]‘›©¡Ÿz*ùcZ|¼_ÖA]™iì~âQñƒ_Ø(¾Àœ®¨ó£Q#æƒ^âìM¼-`+]»6ùeØnPCÒ'ÈÈ¡?Xo«Êã)¨ôD„¼s,\<_6Xˆ…ŒhÀBêº3™°ÁµEg„BßPd¡<¹?¬;y=²ãÚàÜÓö?ˆ 8æq%~¾×èË?tž´"¬C¢«BêžlúŸ"Ÿÿí*8ê—Ê^n8¥é9¡ˆãŸ¶°þ ¯7lúendstream -endobj -2684 0 obj << +xÚ¥ZÝoÛ8Ï_Ü“ l´ú¶ô˜M{Ý..i®qÑv÷A¶Gˆlee¹ÙÜ_3óR´-w8ÈápHç›/ú^æ©ÄÅå<ý8Ï/W›‹àrM#.BŸR”+ç§ÅÅÿÌ’Ë0ð‹ ¸\<ŽtR?IãËEõ›wóóõýâýçÙUÇ^ú³«ù<÷>Þ-Þ˜…ÞçëY{‹÷ï0þ¯O>ôŽ{‰÷@Í/÷÷ô÷ÓgAø Ã?Þ}À”¯ï~š]1àÝìÅ/ïvÏv7´¿‚7üçÅo—î—‹À‹üò•ÚÒðæ‚vì§I¬ýöâáâß–Æ’KÌšâOç~šÇ§ +S‡Aaùq]ÎÓÀOƒD8Tîž›íšNÞðDg«¹M\XVu›²Ù¢½ê¶³(÷†¾k ±­ùäýì** +ï±ëOiì^h0÷ê#6¿a‚±Ð«0Ë%>tº át˜ïÒj ͽîyÿB@ºÈ„Ø/¼ùrOàôù&ˆ-W!s­S~¥U¢Â[Ò‹g©÷d(y@ámpϬÍíîE0õ¼´Ö ,c"»·Ý ð úå€)%º´kbÀ«vñCê ßƒ4øÖ(²»äÝÃ7o[nÔ×r<áý~hè.NϹé„ãÕ^îgǬK=p8!ú57è·Í’Ðú²£m„‡@NìëªéÍ•­dI uG!,‰sŸ‰+,­¡ÑcÈÐ_u›—¶ÿçÍ=Q*úrk.–/¾ìkõWeÛeÁ—–¢)IN×»åïxŸ ûr÷ñW´6åjF7+‡ÞŽ¨£™¡§GÒ›OÏßÞ±ÜVh¬™‹I®ôøJuw¥~‰“8üÕĉ^ùÀݾ%bñ<5+^à Ý¡·KLcâ ÌOlœuu9zÑ©5À–Qãù¬£áCê꬟º®„Á¢œ!_äÛŒÌÐðú_ÁIÑM²$™÷ÒwÐs±ÊDÉ\ü–{×S1G³ 5Œ5Z˜o KSÀåóèâ‡î§çAH”„EId0Æí~}uªÔ°Sër©÷žÄ™wÍ<§¹ÓûJˆ›·¸B\Dx!Ò=³æúa +cËõ½÷¸.ï’¿)VUã.Ê¿Ý…p¶ýo:•A㨒úÅ_ˆñ:ºct¬LOXäû…7ÙªyfÇ<§€˜¬„Ö4ÒÍIÔ³lZ»»â>P±åf¸Ã/-7wS®êm ÝèE +›ÿ ȈJ †à£¯X²Øè þ]–7‘O:¹µ³º³2 AIæǵ^™"­£jÇýâ톮MÍ –ºXéÒfðº +ý[ˆ´qƒ¬Û,RÆž±E/sÖ)Ë–;$lÍêžåÐ?“ï¥aêÏ£ä»Y¬ƒ#IZD£¡_°æŒI%h6I£Ì5öiG¡ÄoäLfŸ?¼~]³ÝÎæ÷îÎí)ˆüp^|O#ÎùÄ1Éc€&Rª8]ù»A¬ôºíl#b$¼®_—7H? cPI§RÔ×xi!"$ÿj¬”Y›L8HD +q€%‚dÝÚÄÝò†yîco±¯&nS/Ë"v #÷^% ÔÐR ŒŒÈ˜‡”Ê2‚Ù¹/b—ÐÖ@S¦ˆF<Ûƒ–ê…wYÄ&å«z¶$Y4Ý Q1$íÄ1m(Áhîd=;É?Ù0ŸË­^šzˆL}M©Ì ±lÚ*Á¡¸¥æäy7ym„_Ý^h½s¹²%]GL/³^L0²ísQ8rÆr 'Ä´yoÜ븰ȑƒ›ûÕ°·.݇Ù^Øü8æ´®.Ácò°CXuΛjŲi¯_mší(º´1&g¥œ0:WìÉÛk(«‰C’Q·Ì1ëaÊc+Rñ߈@uˆdƱÉVD­¨»,mÀÝS‰8—µ\o;¨çAft§Öš†pA CLh<é›B‡Ô PgŒYÿe*NÇñ0OMc6¬K7w¯tQõÃ&éÔtø¦Ñ­„ng Uy^€»*rº©Š–ÂÒ +M”Û•ÍÖ³$ò®á@×Z/½ÉÛ¿ñA« Úä]›Õ‚+b£"‰+P—;•»[‹Öw»îQtö@<¸k³›vE5.¢Vg™{ú™‰[ +ŸT<$:>µmLÈ OD …rcªM6KçA#ë¾tU‰ºªÄ­©3Ô>©-\ìvð¦#)`öu #Ȉ楲w²+†«@˜é„!O'‰TŒQýDê§Ú0ñ>åÙÔÛ ¸\S¨U»¯L,åü‚ˆƒ¨•ú¶FPبýåÒg‘¾¢1£ºfÁ¥_”ífú¾"XbÝs­ýé[.VTqÑÒf wæO󺕕ºýú‰÷¢‡$;ÁÎ¥ˆÆ'RîhFEg ÈE“¹SuÊ¥H³}þ–Mêö½·@]kc8pMùbŠ·…H±|Ej›¼pÿÝèÚOOu3ýjÏPj«ïnôù—Œ'‹à~»²Ei[qäAq +4Kìù–’-Ò<岤Œ?© ‹)/[y*$è[S·ÊwsعÚÕtp–Á¢Âôum€Ô Žò¾Û‚WÌÑ3¼¦©K³ÚÅ‰ë ™(7¥öÒ«„ìLâž÷Ü'?% ”NWÚ¡wl³ø—lŒ>sÑü€É”ŽA0rGÂ÷ç·õáo%d½QG”FéìƼ‰²endstream +endobj +5822 0 obj << /Type /Page -/Contents 2685 0 R -/Resources 2683 0 R +/Contents 5823 0 R +/Resources 5821 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2664 0 R +/Parent 5801 0 R >> endobj -2686 0 obj << -/D [2684 0 R /XYZ 85.039 781.388 null] +5824 0 obj << +/D [5822 0 R /XYZ 85.039 781.388 null] >> endobj -582 0 obj << -/D [2684 0 R /XYZ 85.039 761.463 null] +1938 0 obj << +/D [5822 0 R /XYZ 85.039 515.724 null] >> endobj -2687 0 obj << -/D [2684 0 R /XYZ 85.039 741.134 null] +5825 0 obj << +/D [5822 0 R /XYZ 85.039 495.134 null] >> endobj -586 0 obj << -/D [2684 0 R /XYZ 85.039 672.049 null] +1942 0 obj << +/D [5822 0 R /XYZ 85.039 356.955 null] >> endobj -2688 0 obj << -/D [2684 0 R /XYZ 85.039 650.852 null] +5826 0 obj << +/D [5822 0 R /XYZ 85.039 330.341 null] >> endobj -590 0 obj << -/D [2684 0 R /XYZ 85.039 568.218 null] +1946 0 obj << +/D [5822 0 R /XYZ 85.039 258.758 null] >> endobj -2689 0 obj << -/D [2684 0 R /XYZ 85.039 549.346 null] +5827 0 obj << +/D [5822 0 R /XYZ 85.039 239.886 null] >> endobj -2683 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F65 2099 0 R /F35 1632 0 R /F41 2104 0 R /F56 1642 0 R >> +5821 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2692 0 obj << -/Length 2286 +5830 0 obj << +/Length 3646 /Filter /FlateDecode >> stream -xÚ­koÛFò»…P 8 -ˆh¾E8Ú\Ò¸@[_£"Ü| DÊbBr.GÿþæÅ%)JNÐ;0wggggç=+wáÀŸ»ˆCÛñ“Å:vm?Ž»êÆY<ÂÊÏ7®`8‹Àv¢—~ÚÜܾŽ¼…ë؉“,6{BÙdÖË7?Þo^ý±\ù¾o¹¾½\­×±u¿t­?î~Û,W®u÷Ûϼú€ÞßÿŽkËØ·6Ë÷›_n^mF®;ˆ|<ñÓÍÃ{g‘S¿Ü8¶ŸÄ‹';¶›$‹ê&}; |™—7ooþc¨ðZ°à]îµ -¼ÈöÖ0ð;ŽsA7¼pÁB/aƒcà;Ç iú_/½Äjñ¾N`½QK/¶ž–ÞÚÊ?ãPpÇ Øxt÷´Âõ-Ž˜d¦–+Ä•jÕòà@(€Û“B`{àó Ó Ÿ`ÐM^õ,ÅÒp«àIÞÔH¬,OË8°„ÛÍÁ°Gƒ= T“¿@} \`B·?ÈÅH;DNkžœpAu<适ÆÕœçí…&€€ +Æ¢!pÍb6{ùjÞO¢1ÉÓÒ°žf0:1xËÒQÈ)è.Ÿgÿ¢»‰vÇ$Yxa‚Ê‹Qê1’C€Úã7¶t‘åt·¶?ôƒc¼?2*éYÆIYTE›¶ -µfýR«ø;èú“e˜Ò–÷Û<¸CÄŠÌO”*Ô¦`;ì…ŠƲnèÞ«ñÅCº÷1Ý!ÂÇeYé#Û5lOB ¯we—1“BÉ®-ׄi`L—îÄÎJ^zGbÉØj„ Ú~SZb¼$¼MbŽo–7 ››‹aoL¥ei%dgsã -bbWÄ&k-êÈé/Ç P¶Üû,D tø ð#;ò£Ká¥Çp×vâû&¸x°Ø~ƒ 0€SÃÖ¿‘”}úX+ |^;Ù³×qr9^£žcÇ–+×vÃd•k'hç\¹–‹¬…X XDKzö”Ä]oãW8užãÃsì0ùJèÝ8øÆVÿMùCŠ;PÔj’™à¼ëí¥8¢?胈ˆ†@tHÚžo;vgœ-²wsWÛ2¯Ä]øT [ å·àck›b˜…±Á*s᥷5À[{o8XÐ\ 3G÷È‹ÇFát`1Œ =9ò䈄Á¾QORÆ}ûëO< ÆЊQŽcTfÇå-µqÖó$8ÇÌû`‚^©ú‰I}T^÷A>%t5JÅÆÜX¯±˜PÍœ\“Ï"ˆYÓ¹ $UùŒö%­Ž&èÛK–€›2Û»>-¨æ„LØײÌï±aj48ײgà$\7¤CövØ.ákBül%å±9žò ò¶'‰UÓsIÀ¸zÿÒæ%BD¢Ÿœx0>0"0K+rÓ:Ï18Gì[øí(`çÉ¡i-”“Ã8ŒæV%$ì¡RB⧻¶KQ_剙ÊÒà8Qõ£Þê¼Ü¿@º K¡÷]LâÄñ%¦’$ˆC?­ªÝYfŒ§¢B)è“gηç*Ql2 ‘ióû—ü½â‹t¬äÀùæ?kdã £ÍîºÛê“æ‚¡BÝÇbE½Ìç·CÏ%•j.BÉqp SÊtOÑ…KVá•PK5j¶Õ¯ãm*föQSÕòÚwg^x;U‰Ðx¾³çñçU–-»óXP •T»¦,˜V¼ZâW8JRlûÙÂÓ_;ÖÓA‰Ñøkvq8Íë…|IŠ™lµgè4ë†ê()¹ßZ3œDÍózO tEÞ˜©”¸)íkò’$þ™ªÄ^À|Òêjh %ÕÊç/'tž‹é÷‚,õAuå ç’]}z ‘mQσüøn;UKÿPõmÊ‘**ºpâöI$ÿÙ¿}íëê3è>W~b;a@wyx,Õ6-ß³];óß²,VF¡’ÉHhƒÙŠ:GŽRþì )ŽÐPF ú¨T)õúÔýÊ㧳ühmNxÌÛ~êòNNþ§íôEªMuNÖ…bOÈBO©>ç?@ÉÁ:ŸËáAþº¤R¬“Î?ùsû9mn‰éÛò˜Ýê´Ú¦¬”I1A‹-l¤•Mß^RçZ–\6±°z¥½,v}–¯üXS2C”ž6å -ŒRb{Å(Î'ñS -ºá ݪãD|"!ž¨f+m®(‚7¹îªÙqΠ/ÐsÓþ½óž¸O<¼úbõ#Eço”Ô%÷›@§›ÛmQƒ«þ{ÿ½Hï{ýM.A¢Ÿ“4Ïuœ¯Ó›9 ÷ŸU¯æâ‡kZ»d#ç××Lww~o²ŸYÚú?E;ù6­OŠKwÔuue& )khÒä©6™%ÝR -wGý :kÚ•ø|p~uâ­þûâ|²å8ÔN”ˆ©¥yd$jìæ%-t!¦¼á9U]'!õâjÚ¢Ò׃ôí»<ýÜ•iÁ%¶â"ÓëëM| á”»év?òˆ€0UÄœ„«JÕ lMAÚœÈs`lš*¤G-š•”)&ÍÈ ±öÔ\rëj§™mAö$cþÖp“Ø黂Ð3ìrE…* 9qc8ȇ*qnfH0šÁ‡ óÙÓ.¬Ùq¦GZÞXæB’w{½jì£b -pÄÀºqî|ºâ×ꯩ ÙHKÐ?<ªvôÆ8~n¼`îTcžëvÒ³Þc³÷#¾¨Ò ÷†r•Tv¦}¼Zû½3m.*?ë;Þ—¹ Š©KG8æ_îá;òÏì N&¯kHÏO|6ïu%} ¾5" 9 g‹C±¦T“6'†ï H‰TYí¯z™¬ùu‘‡,bÕõÝ´jäEôY `ë¿Ö%…DNŠÂ$¶–ÓéÀ{ÞȧrÙ Fù!7¨Dºñ1D>\„œÄcIÜìdYÑ»9?1ž®>é…qdû—ŸôD„ÿÛ/"gýŒ>ž}t‹“s6gòœ÷_žrLendstream -endobj -2691 0 obj << +xÚ¥]sÛ6òÝ¿ÂÓ—R3Cüì››¤¹Ü5Ž/v'7Óë,R2'”¨’TtýHJ”;NÆ!°X,‹Å~AáuÿÂë,ö_§Yèë,»^m¯‚ë Œ¼¿ +c)(ËÎW¯J¢ë0ðó ¿~Xtb?ŠõõCñ«÷æ7wï>/–ZkO…þb™¦™÷áöáÝûEè}¾YdÚ{x÷–Çþôþ@o±y÷Ðüåîþÿô™Ðü Â?ܾç)_>Üþ¸X"àíâ·‡^½{p<;n€¿þýê×ß‚ë6÷Ï«À×yv}„và‡0¼½Žý8ÒÒ¯¯î¯þíHñXtͳæäc1–aîç*~Y†IèG‰v2T0úy£ ÃPù:T×iøq‘An‘»V ¾8¼tVmÓ5ëĤÞͪ¯¾•Ü~[µåªo:ðÚg% JQÙ~«V0±ÄNwIZQæ‡iþ2ÿñÆ#pü«œAÀÿ=ò»[!¹öjÓSKy*ÂW‹e¤tØf»P©÷ˆ-276¦Ú•·û'Þ’2ˆ\ÕU¿P™÷,ãj¸YíÞ—­YážQVyè±%Bcq"Ô‰ _ô® j@åè¤ÂX†xÚ¼9ØD3²Ä;tÕnÃM"Ìg©÷ý­é±ÿ É” ûÂ^‹ò{Æß·MÏ â£©»WÈEîµÆî¸c\Üà“ÙIÇJˆÞ>D ü|÷†œ;n…—5JåýBRèmf6öó[døæU(ó ¢Üþ×ÀQçµÄ}èå4¥Ã$’ÜŽ»[š°E’´Q·%PÙö€Ôw +áùðå¶@;‡NI㇭c„Õ*ɽÃ"´;ï,óÅÌ7mƒ¨{DŠb8"fìHµ¦~fxÿT2bŠºd©Cïˆl«€0BÏðç íJ}åÞª®˜ñ~4»9Ô(\”_”³´ eˆöÒ0>IÕÉ  9HâjXQÚ•Ï7Kwë@Š'¶žÛ¦-¹E›þo&´ç0Æ iå45ÐäX•»L–{•U˜Ym÷uÉ'Ä *oÕìü æ'‰3_«äEó3¹l>“(ñã‰ñÔbä6þ ýH'³/KKk9"Fuž kmû‰ÖnE2[(y¿kfäå@SÉFÖ͸$‚ȉ+Få~êÉÅx´î:ÌF'’óíâòÍιÓÐÏqŸ&?¥€ƒü4Jÿ–ü,­åˆØ¹üTúÔ¹©¼Äê:/Á8õUª‹YÁƒ½Ò"“7ü9ÕÒ0³Z +­â™3J²ÞZ‚Í0³ÊŠ‹5b8KÊ_ëpr4dzÔ8)F»©Äi9Æ]tˆáX„yÅÛ;žK6Vþa뼊$‰1N^S¸¹²©˜ÂŽg;ÜBO%9]9eɲ°)Q7m¨9·\sE,b;ŒR Cz<¸>íFi…Ž[WÕÉ~Gn†ÀmmÇß“bSa) ‹½aÐ$VÁ‰–vOU´]7YÛ¶… +k.…¸Rñžæ÷/È-ë˜ãKl°ë ·©i¦©t"%ÎÓ +rÂ4zÅéw'i+¬TWwÊ2ãl £¿–5¥~†2…ß/F—<õÆ‹·oNöä=9áŒVJfX ‡XIY² ù‰]€>x¼Ã¢Ä™öµŠÇöm*" Í8ÇŸŒe1¼y‘B‚u˜³×Ÿà³I.÷F¥Hy´— +3ÑÁËOf#œËOfaÀE™¼™EòfvG¥‚ÍÆ<Öòvvs ‹b¡Jþ +O‰M#ï³øÄ­ é¤ÎX^úÍA˜d¾N^~[á\~] cˆ[s>¸eR*äš<¡¤ îÙßñb÷0Šÿ¯x®©Ý;,øůh@9TÛ1„ê§ð½Ã'™›¯¸çj‹ü°Qyžú.aD.Pn‡è‹E$s ßØíØ¢¾qWeÚêÑ0sÀ‘ÌŽ*#ͦ~„ Ýøó¢À¯G²/îL#y“Ç*´ÌØgGÑt®ð÷XϽ:õiŒ²A‹¾~擇±á>Êû ˜ÏBwùù‹‚Yïx*yGÄ(xvR+'ÆΟ3ñ ˆmPí²rû¤%tG×L=º9ÐÛUä=vô¶¾ŠGƒoË¢h¶ûÊÖÒä$ªDÈEFðò¦Ápp¸^%ïhôüêVÌÒš‚ †rÉç]H»ÇŒÏýì`Oe[ÐÍCmZ.ØrÅ¢¸‰^Õp -'IOfÕ¼û“0Eùðâ‰Ø’¼âªaàä‚!ÉÂV (ꩺb—F˜Á¸”Ÿ2QföÏÜ´Ú=Uk8û“ç­ÆžÂŠæ¦ÚÙK¯‡'^zx˜þ0±J5-E²Ð·V¥$4…ƤF +}Lë¹P׫•™î”—BCB:Cv[Ô™ìä„¥ó}Ï…÷ÎÓ {Ó‘}q£g=ltnæ‘Øý" ˆv¯ãhwœÔŒëLj|þÔzÉê2ï9_¼±¿õS@ç‘"ígúÂàb¥|Z^È£fá)¿±Îü8Óç ÿÕ’,þendstream +endobj +5829 0 obj << /Type /Page -/Contents 2692 0 R -/Resources 2690 0 R +/Contents 5830 0 R +/Resources 5828 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2664 0 R +/Parent 5801 0 R >> endobj -2693 0 obj << -/D [2691 0 R /XYZ 85.039 781.388 null] +5831 0 obj << +/D [5829 0 R /XYZ 85.039 781.388 null] >> endobj -594 0 obj << -/D [2691 0 R /XYZ 85.039 679.868 null] +1950 0 obj << +/D [5829 0 R /XYZ 85.039 761.463 null] >> endobj -2694 0 obj << -/D [2691 0 R /XYZ 85.039 648.343 null] +5832 0 obj << +/D [5829 0 R /XYZ 85.039 741.134 null] >> endobj -598 0 obj << -/D [2691 0 R /XYZ 85.039 648.343 null] +1954 0 obj << +/D [5829 0 R /XYZ 85.039 658.326 null] >> endobj -2695 0 obj << -/D [2691 0 R /XYZ 85.039 630.139 null] +5833 0 obj << +/D [5829 0 R /XYZ 85.039 639.454 null] >> endobj -2690 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F35 1632 0 R >> +1958 0 obj << +/D [5829 0 R /XYZ 85.039 182.516 null] +>> endobj +5834 0 obj << +/D [5829 0 R /XYZ 85.039 161.32 null] +>> endobj +5828 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2698 0 obj << -/Length 2253 +5837 0 obj << +/Length 3600 /Filter /FlateDecode >> stream -xÚ­ksÛÆñ;ëÄ 8S‚x€[iÆmœÔþ«ó¡#ûÑ<’°ð Ð²&“ÿÞ}Ý$!OfÒÑP¸ÛÝÛÛÝÛ×?öàϧ±ë…Ù8I}7LÓñªyã-`~ùBá#כLjúçb4ûiŒ}Ïͼl¼ØÉb}çüë߯oo>L¦a:~èN¦I’:7ßùðö—Ådê;où™±·üõææ=â&iè,&ŸïFo½ §‘ÍCÜñat÷ɯA¨w#Ï ³tücÏõ³l\Ž¢8tã(”y1ºýÇra\4æUzM£`î BÏMÓÈ*èÇ -® -Z¨ -ĦÑ´I=§>t}ã4q;Pß)ölxð2’$ßîh)ã?z~„Ö\ó´Ð›®'js$*¬‰–Wf+”™\`ÜèUW7O“4rþb{!œ×šÈ»mÛ]}(D„0#ë¥d½Ècë&¯ JüWª(ž˜v…ZUZ[GÏunU‰Z,ã­u™Pä–] -Þæ¡Ç´.KëifEÍÔkc‰Î š2¯ŽÜÐazZƤä‹ÏõÙë%cU›“ª%ûæÛ÷í _9̆gäÝ≜ÏámBà-‰ë®@Óö|˜¶¯ ݸ$°Ä[ÿl8–¼Ôy‰³ŸÂ´•¡ïµ84¯™à$lS7JcÁºg?ãÄ=ª pñ}7 jD |>«¦n_0DBF[-<ª§J•Ögf£íW(:mrÀ=æ`*%ŽÚ“ykEÕÉ®_&qì(ôÖ)™lš&nI²o³ƒÆhˆÛÎl…±'ö8o@‰0H î¹Æ æÏÅê€i.&¥dt®uX!ÄsÉ[@ŽÞ¤J™Ô›SQ6àL„q[­QC!|idS+%¯åÈ8‰¦„ËË=D?€4zî  E1»k+H«³ †‰©“’(z8¤„À¡"Ø#zùÙlNÝè6 Mh¥ 4¡ðP"Ö€QS L? òb…˪.mr… Ýï•<Á4³“èígªP²Ý^rÞY:(¬èš~qêUß#‰›s[{ƒ.ÃÔu¬½`’È…tÒØs~ÔËŠ¼Ýr‰‘æ ¸QHŽ ÖX8ª´¤„ö/ÛgÜ0ˆ¿)n -ßow -ïMBÎ &ÐÐÊäÃlÎù¾kT4`²~>åº -$ÿõ²@y‰*—¯áÑšJ šŽ!ËÞNè&œ\ñgÖ•ûY«¾è&4úr6‰ÝœÛƒy~÷—Ù2¯zË.mð³xÔü-Õ½ŒÚC##.w}*uDÉ Õ…ÊKsÙ–ÌmCÂä¢×T„¿&ÍàçþA›Cu¶ù‰½ìµ>#ÔM¾ÊŠê¶U[Ý>¿G”þÖ^œœOðuel´ßcQ犎€Ùú‰+ñ©Å^ÿRk­b/¤Só½ùÞçÑ÷ƒëë¿^Úð,[MýSo[PßÌÓcߎ“þ}€!Š?WBõqÐÉÅÇ'·Ž -FäVÄ tþ‹}ºÙ¨T˜*ŸŽÌ1¶&Åð„vÍΚP„<ä ‚·­¬^ó¡NºLÓß[˜pb­qƒ=Ã%ÒéæOùM7ýú[-)Ãæ–†ê[f•I¶W){—Ÿ36XÞ}g(m€“Ä;÷BRf½bø- -~—L ~¾ÚÕ<Úåý(ƒÙ¥¯õØ„§lÚr¹*rmÒÍlVÔÐÞî궛Ñ+µ^k pCÝllüäû+Pÿ",Wªí ,ˆc†V¥jï¯`ꚟ7°ÍjÛǺY¿ÀýX—*¯®î^ß.^X|b¶ïo¯î~­ò¯2½ÕÍÝ\ÝA3‰$H‘|ºL[`±ÎG?Œ®yØKÁÏ›š%.îûy¡OpŽhÍ)Mý$Å4½Ø«ðä~9kàQÖµv—t}HöÕKbß‹2 ( 'ÓyèyGéþ 땪Vºà1±»°ê›cfâÂZŠz[»’F¯Læ]¥ÿ’Ⱥw—û‰HàÉÒ–ƒÄúk>” M²:ÍÑxwˆ psdß&ãý€ßˆšz°èlsŽ^-2é öî@nX…ü™ÜäÓ†˜Ä“ô(ÓJÞ-´í¾€mHûûµ½Ë ¥^ð\ŠÆž+ȸðÀg™w<(ó¶ÐjmK €ðy ¿¶Wc1ÃkMȵ;_y_¡I½äÇ™Æ¨Ç d°ªI®ðD~è°.DÓ·Ê¢êZÔ|½½Jh¦Dš…0™s2èèþ&m¨{Z‘Ú”^\€´5Y ?'Úh² Ö¡‚:o€Aë†Ýqâë1‚Wh\O/”|c¼/äÝð½T5RuŒÊ7ª1"o6TÐ -ìpŽ'…_îž"/î=7á¬ßÕ›ÂIì˜èŒ@‹ùÜwð]yÓáIðRªß5öû´E@ߛϢ`9•æxwÊéY÷²—ÕùÔìäþ!1ªö\ÅûOx¯°oiòdË+~(mÛ¼®¤U 7cpa~"o¨‚»|ˆ3=8ÿsÝ8‰Ýx ¿÷˱ý¹ç÷úèU¦GfÏ_™3ï\P¡ñúþºuòendstream -endobj -2697 0 obj << +xÚ¥ZY“Û6~Ÿ_¡·¥ª"IðÒÛŽ=Ž3©Äãu”òVeóÀ9c +Iy2ÿ>}%JNÕ–kL  ôñuCþƒþ"\O­Iê»*MÛúÆ[ì çý/+!YY4o67·ßÇáÂ÷ܵ·^lžÇy"7ŒÔb“ÿæ¼ýáîãæݧåJ)å¾»\%Iê<|ؼ{¿ôOwËT9›w÷ÜÿÓãûGhý€µÐùŠ¿~üÿ?~"2nþÛ>¼ç!Ÿ>¼Y®°á~ùûæÇ›wóáø[#ÃÞüö»·Èas?Þx®Z§‹({®Ýõ pìF¡’zuóËÍÌTÜ.xÔÜùD*u£TYäÊ ‘Džy!Ðç²Ykç >¾“/Wa:ǾÀMõX‹œa=–c';ByØ0&u†*[¤Ì†²mxl5Ù®¨i¦âö¬‘ÉYß¿,ƒÄi»üúË4tî~ƃ]¬d+bM¬—BLÜùN÷ ¥Œøºò”3´ø Þâ@T»©†‚{>ó¶[œè¥ç¶þâV{š­ë'óȬ/ò뇇ÿrCÿÚó5ÈY²²Ù—22«`²Š—‘£Å±°|v;nÖ›lù Sï„lANð[µ;($kd;hR*füa.±TÃÁé㥖M!Dúò¡ü´\A·î8êÛ7WÃä΋œWÍvYÙôÃd½þˆÂ1dOUao)¢}Ä;(ë¬{…c#ç¾­3dËo[^§kéÈøf¡äò¼¬–PNUŸ^´l3™/«ú–K¼mÚêNÆ›+;&: tÐT(¤) +i/¡cÇd8×W$(fnŒ¦¥«!0§5´,4 ÙJ6„ÖÿŸç+*lnÍËNó¶ªWnD%ïæ'›&ô™Ã„òåÃD¦gTJ«Ü*ŒcÚA'¬â-žpîð°;š*gº'\ã•Ë‡ŽåOØÊQ +šÌ£¹A’ŠÛpFÚ¬GR·ƒm“ãha¯°Ûï•mÝ”»k•Â]àNn‹a{{Èj7¿eÚ‰%ŒS +LùÜvlb˜ìµJ&Rhm…öœö-ÓzäL± ò©~-·f@LDÙÀ•®ø“4¢+¸~®X¶1ÅjÐYÁý~¶èhñL¿=Ÿ¶Ñ˜aF^颓LC^pé Ý+—i½l?êÆ¡š[¨Ð0ìeô(E0Œ¥‡ŒŠž½”Í1BÛ[þ œ–Od£»W¦ªp0hâá÷rÐhÖOdëÌä œU¢4QÂ6<Š\ŸËèEjr B÷¢ï‰kk'ÇÊœ(wê«6C;EãòÕ'„åtwHh¬‹>’~‘)Y‡”¾/Ú4fswŒÞVo‘Íi´Ž´‡J§> ž3fì¡m‹Åâ,ÏÉ}ì°ªÈBk£x‘æ´IØëVPiøg²8΀l«+l¾Îlµ`þŠRøìÓC/€ö&ñ-¥„JSˆcMö¨ ;Á”EáA£å4pJ‹Øž @ÑŒM +üÄSmiÀ¢D&nš,bТ|&*7Tñ,H\ÉT+k.‚€S#>ôb³ ²õR6p¹ ŽrÆRnè ÿ5kb~‹û.å0¶í¡Ô—ó!í̉îñÝÀ§}c·UùtÛÛcW¯sö:U.€Waƒ$?ˆG3Àb££ÍÁŽ­å÷¨ÁRº>A‚†]Q_—ºxÒîžµëØ‘u²¤"<)iïÄZË_Dg¡ œEhš"@¬=Þ²'bì ðž.¥=¸ú4÷\¼ÃÙ+…v†•ÓwÄÔ\ØK»*‰¯ïe¤™ ªô^ óA³(¨šøì8 T+XuÜØvÜJ! m [unì +Ø8Ma^È€ÏFi½ôÜL|K©—ÑøA`ëkkêÈIHJRXÍVPm€Ã˜6×¢+XnÜ¢zyŸîჱ7¶°ÇÑc¥Øë»+w{š«zejˆÜ&<Œ%úÁÚ@Ë˾$¹çê>“é3®wŒÀ±€Üùöxû°`§jâ 6=ÀÞ >„Åd°i >r ˜[î(sËûI(Ÿ_™`®øè¤Â0£°` Xî³Z‚Z¬u&” 5ž¶N¾U°ªÍ…}EÏ\æT +­Y =Ð&%4_§è_ÒñJÖóŠc¼{¶œµÌÒ Cu +E¹B\0ç/>Ö¼(ùâN†§”ˆeÆV^¨ë3÷ûM´Q¥1ïfmà +vTJ@Räxwì,5!šÁ¦è‚L{È:!À8¿òÁÄ’'€ÖÑ +@ÄA;ÆV’„Ã$…‘j”‡³ÆÕs×D¯K &Z/°Iß.×hAtpç ¢?o¸—o©J±;ÇA ¶4cβ(ÐFYø{[…°…·d±Õ“Å¡“d3»;]"€“Ã%‚”ÒU—Jé1×·_QÎìóSŧ„-xÙ&/°2”uʬCºëqÊ9YP¶ÊD®'iŠ¿„œê%1êkëKi‚‚÷Ü™¼có(K9vÓ™gµÔ4%sÃÛìåäÆÍÄ&BØÃC!µ}Q_ôMo#pm  )Ž˜+•œÙ„óý½”ˆºƒÔ?K™P#Ç¢øT}ÆêXnm7¤\û©daÔ%ë0¶K}s9m¹«Ì/NÃý(}ýyÞ„-̆Mu’f%€<ôÜÆI‰Ki¬³ÃÁäF žu:ÉšBŒ@L,ܽû‰Rs=ˆ='7i¼@,©€E÷f<^ÒY(φìÉ$¹Š‹ÉÕ}Q! !Ç—øE/Š93<©'.3îÍž²^’Xäæ8/qó@S4ýhH¥M¼(L*î ´N ŒgE©ÉÃ@¿ø (ÉðØâò\Á¦÷åäàV£Xeœ½M½wÁh¹qrîZ4—ᮊÖn¸ ÜýT Þ=V£Ù·Ùv/òq©(q£àúk‰Es·*µvƒ(%¦î´m-˜g4f¶¹ŸQ¤@¸V+»@±‰5ÓWíÀÖ…xª,¹|,0 5œ•ÌNfAxPUð]̹`P›£N1ÌäÁõ£‘ßÃ3ÊõbjÅèݲ°`M±cõC+YLigh1 ±áäFmÅxÑム+Rd²Š¤µvb[ÏMô‚\Zšš3Em¾80lÀ÷(y$™J=¯9¦þšñdHáíÛ‹;úãU¯*Yí’1Á e +2à›KšuÏ>“€«Àb‘%ˆ1ŽÓ÷&óÀw„$X£#/UsX:y dDrqdXÂrÆ|ª»ËeòÚqlÎØrÄVöè7FýYÕ¢aæn¸wnäÞΟǢAß‹‹Ì`UaŒÞ°Dü7#ç;Ô,©$´€Þ•Ë’®ƒ’æbîr±ör±COPš]q’07 M"Ëç0/˜R¿/šbŠ’P*sc6„„M’dRQ"7‰à¶žGè4”Ća‘£ dunæò±W\½—$ G‰H^üuà }Ž'M5’N¯iÒ™¹D¤ÄŠ’ò…ø¤œ»ž&R§€44bMÕFHYãjBïÝ¢üg`‚Ìf¢u"½Ø2/)©š‘MÊ \Öœr…©u¾äSW¡ÏÐû1‡ë«Æ ûçã?ìÁt:NÕ OÁBmRÌÎw¬rôJ=]ôÃß´>ú)’Þ=;¿ŽÂêœß‹R:%Hotí8ˆß›Uh–Zjø;æÁ•2ëLlÌõª`þUð™ln}š D«1tý^x;X4Є® +c;øëØ ×ÐPêÎù¡é~ñÖÚÇc +ï-GØ^Û'0Ϫ¿VnâWYµh.Ã? \Ÿòð³6K ›˜¸§ÐëK/Õ–¿?¶{z~  +a :eÑØê”ÝïZ™eˆ]lïvBðÉb\¯FêsÆOfDÆÿ(ðÓ<ü»o²Ã¤$ânÛóW†î)L'ܦ&¹ÊĉnèMxâˆƒÒ /¿~u¡¬yàüðˆ|b +“ÞòÇd<…"`Ö“PdòœÞ‹ð—ø@z)£ØËõZ›G¬F ¯tTÛ®»Ldlôo0p…ðÝ @¤Á/:›Â;ìÒ`ž·ôÄâxòó,tG·ÆÖz3˜s¡Y¶5‹0¦LSí’Ó_èlÙôÅI"&]Ëó[Š€ –žõ™ô'Îÿâ~6Àt@Òrìåí/µœËYF€Hpêß±y®ÔI¦¹¸M'>ñæ‰áZlÝ~¹ûùÍ•ë]2t¾@Tv=H²h.Gniê&Ê2s¾ãK܆/ÍÀ¯ø£´Ôžl¯›5žï[†â²I‹S×W±%òÊómýÀoVè•ŒƒDw͇Q&d¸qNþ ”?*6ž>ÐFï4ž'â …Ž^2ózì‰÷ó<þ=•p¾:‡U?Ð#< ðÄõ¹Ào¼àk3SÉäÍX³ èÅ7“W &A[Äá]¬à HÂI‰s“!Š×êÖK]Ïz®jâìÂMž á=7˜Í*À+Áÿõ«A#J¡rSµž—¥(ÜÀ×¼€§Á)¿ú×…g ÿ ´ä!Ïendstream +endobj +5836 0 obj << /Type /Page -/Contents 2698 0 R -/Resources 2696 0 R +/Contents 5837 0 R +/Resources 5835 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2664 0 R +/Parent 5801 0 R +/Annots [ 5842 0 R ] >> endobj -2699 0 obj << -/D [2697 0 R /XYZ 85.039 781.388 null] +5842 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [250.936 169.022 367.444 180.712] +/Subtype/Link/A<> >> endobj -602 0 obj << -/D [2697 0 R /XYZ 85.039 638.273 null] +5838 0 obj << +/D [5836 0 R /XYZ 85.039 781.388 null] >> endobj -2700 0 obj << -/D [2697 0 R /XYZ 85.039 617.077 null] +1962 0 obj << +/D [5836 0 R /XYZ 85.039 572.649 null] >> endobj -2696 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F38 2158 0 R /F20 1617 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +5839 0 obj << +/D [5836 0 R /XYZ 85.039 549.331 null] >> endobj -2703 0 obj << -/Length 2252 -/Filter /FlateDecode ->> -stream -xÚÍYYãÆ~ׯЛ(Àâðh^xwÇ°É®Œ °ýÀ‘(‰YZ’š#ðO]M5%jfâxc€aÕÕuõWÕ-wêÀŸ;Ûñ“i»¶ÇÓU9q¦[˜y?q…™*Û œúërrõ.ô¦®c'N2]nˆd¹þÙúÛ‡on—ß~œ/|ß·\ßž/¢(¶nç®õñæÇå|áZ7?¾çÙO0øÓííßqnûÖrþëò»É·KcÃ…²UèãŽ_&?ÿêL× ÔwÇö“xúmÇv“dZNTàÛò¥_L>MþÑsá95åU#z-4ÅÂMìÄ Æh¼Èö"(@á éMàÁœ #iÐZÙ *ŽõÏ]ÚÆadíç¾k5yÕe Z¢ÅÑÐZ×<{ÃÝ]zŸýåÔ -€gû/H÷Ð F|ô/´v}€íœØZ¡$i…Ä:ÌI*×ʸßí¤1ë2ïö@ÑT팇÷ tëm“–Bª¸0õbk—Á'²>Sðm3ÍèrX¾Ñ[Íûab›WÈ„L…óUZÊìŽkñÓFF{ÑakmÑ€@.º6!µs´·¯¬†7r­U½­P‚ÿDkŽÊ;äþ$ -zAï.O*¥¬wd¸†'³Ç´Üš×WíqU>à`”¨.Š5y @½¶BXó—Ã\VpœÃ(hYÒi…v½9gM†{ìPåtÅF”ð¹d«ßãûEúšÀ(‡Ãï$¯f1ûíê.¯®V¨h? ÜfQÇM|ÛñÔ³¸ãÛ‰Š_‡ŒJñSÖu99àï°?IÔFÒjmNõTm³æ^ês°©þ8Ø ¬2Õ8á„V¥ƒ€@fìB»ŽIAø¶uÙClh æúÔí[¥n˜^0Ezæ™ÆžÚŽ6)¹ñ(› ê vAäÞ’ä²KÛ5uµÅƒúdâe@ê6x]–Äu\£~*°ÆðÁNyØ13SJc“®òÝÖå™$?æãyâ1¿ß`9y˜yGZ°)îÿ#8óĹÁ©˜|@$$Ðö#‰áËAû¯oHªHIk>ÙææšÆqÐÈklÛÄ© ¿yq`5´ÍXqÈcW@/ËAã†ÛB~¶9ÎÕ1)YÇQsü®5_ôp~‹µ.ò¤ƒÅÑÇ:aøÅr—·Qø5¦¡1 -›Vc®Ø&`ŽA%`‰ -” •Xü–yÚºüñlÛ¾®÷¸Ù×÷iqÈ®a`,I: w`²‚´®È˜*‚ý‹²n;Ý.°á R£ÔD@±õ¤C¾ËÊVjA@DB“A¤Àx†ÌRƃ“R˜´wÙÂE䞣½ÕˆƒS|Å“t6]•8»”D9h£g$ÞJò8ÍV} 5íªn$Kž% -×Ol/†Ü¼ðå‚Ý'Ô+×eæy(ž±„T_RLA6ÖvgPÉ%\]ŠÐ€”ƒ„]¶<žmÍìÒcÍ€Ý!<™+«ZûÅ œÙbWÖèS¡<N`ë‡þÄÅœ% -ë: P¹òiH¤8M¸§Y„Ê^¥ -‘>ÀHÆa# {,6ŽTrRC¥¹¯…ý¨<2Ο–«@ Xé”…²R(AÞ]*´#… hÍ­TFRþÌVUˆ!ˇîŒÀw æxSöEÁ1S&†a°’€KÓ’ -8XpE‘QÕA½§TWda<1$jŸ¶zI 9”kDŸŸÈ-“h [4ÉàÈuºŽ”H<æÓa¡YäÕIþÑÅjöØeÕú¼^½¨ÄÓq 8ÊõE™Ûœ§+Nþ²F¨S}è[]?2j¡5‹LÄÕŠŒŠeÜ `ãë³R­?AQd+?+Ö@>àô8¸ö)ïØVqÀËNYW‚—8îåÊ÷oL×m§•4 ]è’z±uí(t¿^Þ[èåZœ=%žÎëuÌRš:{y+­ý7Òú¹8Þž¾5œÄïÀµÇ‹¾ œJ—Úë>'ÐèIýLUë[™I½™®ÛÝõzP;Ñ3@˜À}Ô•ùO©A˜k©iʯºú ‰M¢sIÜб=×¥(úKÞÊÁ›9£—ºdÑ›RëœV®Ø°îâ,—0¡í‡Pc{P‚©³÷#åÎÒ5§K_¹Çt¤ÜÓ»,¯âÅèëÌ>@mÅ-̸žðúì©´éë µ®¡ëfÕÈñ¹ ”ég]!)ר «m&²æ#Iœï^LªùàR4`C² -§¯œ~û»®ë‘窚ÊCº?pä__ MwÇÿ3åÆ£Õ½ -ƃ vúW/ŽzqÂŒ¾vJ¡I÷. ¾GTMzô^H¥9P¤ÆXrÐw—ég$>õ>GÞc±Ý‹Yßß~ÄÓMã)弦„oOÞ -g ¼’ge(™ÒõLž~kbTöyRekyŸÑ༵/úÚlÿOU/˜',@_S 5¡Wõ:ÎßfПL@/Ù!Óe_…Œ)Ýʦ.\vóVرù A®Ä½ï ØJ'ZŒ -y´’å{}yæ»ÁOÞ¶p€¥ðüt+ÔùoqÄœìcìœ$üåç“wŒ„Á[-“c ÍÝ0Ο2XÇ“|ÈÏcçÏç^  MH^ ’püXA¤ÿïQ¸h…¾êáíY&îÙ[Ó ‚â¿b*Ûendstream -endobj -2702 0 obj << -/Type /Page -/Contents 2703 0 R -/Resources 2701 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2715 0 R +1966 0 obj << +/D [5836 0 R /XYZ 85.039 371.679 null] >> endobj -2704 0 obj << -/D [2702 0 R /XYZ 85.039 781.388 null] +5840 0 obj << +/D [5836 0 R /XYZ 85.039 350.482 null] >> endobj -606 0 obj << -/D [2702 0 R /XYZ 85.039 761.463 null] +1970 0 obj << +/D [5836 0 R /XYZ 85.039 212.304 null] >> endobj -2705 0 obj << -/D [2702 0 R /XYZ 85.039 741.134 null] +5841 0 obj << +/D [5836 0 R /XYZ 85.039 182.899 null] >> endobj -610 0 obj << -/D [2702 0 R /XYZ 85.039 536.885 null] +1974 0 obj << +/D [5836 0 R /XYZ 85.039 102.678 null] >> endobj -2706 0 obj << -/D [2702 0 R /XYZ 85.039 513.567 null] +5843 0 obj << +/D [5836 0 R /XYZ 85.039 81.685 null] >> endobj -2707 0 obj << -/D [2702 0 R /XYZ 85.039 299.114 null] +5835 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +5846 0 obj << +/Length 3787 +/Filter /FlateDecode +>> +stream +xÚ¥ZKsÛ8¾ûWxO¡ª"†ßµ‡­¼“ÉŽíM4åÃì(‘–X¡H IÅã¿ýJ”3U[©˜Ð~|Ý”íÁ?ÿ:\/È®“Ôwƒ4½Þ쯼ë-Œ|¼ò…b)$K‹æÍêêÕ‡8¼ö=7ó²ëÕøNä†Qp½*~wÞ~z}·zÿu± ‚ÀQ¾»X&Iê|¾Y½ÿ¸ð¯¯ià¬Þ¿ãñß~¼…Þl…Î7xýíîþÞ~%2îþ û?ß|ä)÷ŸoÞ,–ØñnñÇê—«÷+óáøËá?¯~ÿû.àp¿\yn¥×ðî¹> ﯀c7 +i×Wß®þc–â±ðšgÍÉ' +R7Jƒsù‘% ßWnà«ë$òÜÈ IBm·X†ïÜWp°¦€?íB%ÎcÝÊy×îóªa’# öxܲ“Ña]]{Üî˜"Ê›?yqåÜYÕ¨/Ü‹B}÷–G#Õ \¬Ä ¶¸Uw/xBOôý¨6ôÞ¿DyÃá—>Ê&£³ôÇ ²¾ã»É{~4¡ÆÓÑÛ Ãü€Óù/§Sq¹²®…ùÄT׿¾yÍ1ÃœK̉àmW» +—öçÓíB¥Îýê–›»\ú׋%ô—´Nƒ]1p!ëWÃP6Lö€ív”Ž}/¾–ŧ|XnèŠ\ iÔñ‚‰°~‚xàhlÀ»ÿh_”‚¯œ¾ååqðg?!M{äFw…ç\ÚèœÇt®öÈ2Њ–E}©STýÐUkè=Òîmƒ»zn‘ÐHµÏ±õÄ]Ž»k6qá¡åçnédE…7ù$ã;!$nHuI"ÇÍPµMÏc}KÓËÇ]>L—ý¯ç‡¨3ª¦Ïƒ +@ZB¼=±~ˆ”D[Фìöx… í4­í¾kÎÜS¢Í5N27‰³YÃ×4K‹ˆ ßöŒ¾JÝ8‰ÍJx8\r¶cº~ðü†Lr¶_Ûû¸£h²ßý¥%N¿k5Z]ž˜»PàØÀ<þ…L8.oƈ«®[”59«Ø3·‚e±¯¼¸cq8_4>»²~â7¼±VÊÑ*±EU›œïÉö%{œåŒŠäM¥¯vß‹;$÷hñI®òÕ=©'{GϹc×èi× ä0ºòKÌY FªÌ)ŒËö€Aډųtâ¦ÌN¹€#G·†ÌÃ̆B Öm³-;~o´a—w B„gœX,.«p®¢dÊœœÐ¦=ò¡zî¥cázúôðþnÔbŸÝðÊu— žž +~bH#Ñ3†$D?3¤ç6Ô†t²ß¼!YûÝïÄZÈ@8bKëEÄ. Þ»E¤à:ò¢j¶£uñ[ÑâÐæ¸_P @·øwÍ.¥²c4uwQ’²£Öo›²àNš •4öÔ%-Tdô‹{=Al³íFo¸ ÃÀùüÀËŒ–ÂÀÃ;ïu¹·Â-µÑoP"¬A©˜ÔK‘㦇øúºä¦ÀÑ(¡lXØøþXõ;~Ø,xÈ{È+<úì*s#“ú Æ}î&>‰ãrËv@ÄHú—ñú44fèùñÀZ»žåú@ˆl?[Ç-»vEŠ`@I$úMãïĨ^jBa׸ ‚“ÆK3·¹ÂÉ/ 3FœWìz>……Ž§HçÁW–ø¤-€än‘†àæ¹Qþ% ¦h!åØòè¨BÐ ¥11;åû—û¥­y›5£¥aÐÐÇôÞúnKiOq@Jžp&,lÈÛµ ºæ¦±Ž ©h1äý÷Þ½ZD*vÓÌ6a²hÈ»(õÝ E>æ‘Ô1ç$E.ª\YyÎ×òÏ#òÙ‘Aì5ƒ xé \Á¢Iøÿ®M2d˜ª)óN›IH‘›\k+|­k‘^è눊du+Ìãg©¦NÅ(MõíX­}.µ,<”à^V{^P® ØN;ëq:7±‘³qsÞE"/¯ÙsL‡SIE[]m ~´äè;wTcü……ÆHyÂ~%e $œÔ<ÞÕ‚ú¬ú çU{Ö½BÆ5€Á¡Ž5‚—Œ ’VÑ©RªKÖ;QÀØwýDû¶5ž#¥COò¼qÓ¶«¶tʼ–üø"PDsvåS>2‘¢€"wªäUÃ&¦ëíá±µË?T@9è,¥¤ "8Íî±ÂÂe3R—‘€ÑÐÙ¶l]„uBçŸKÜ ßi1(9ìؘ$37õà™Æ®y¡è¶BñÕÂ'šzi‘Ÿ#”Ó5ñÈœp# ‘[Ö×57(åÝž1Æ ~sÊà lÒ4ϳ¢…¦é„­a»Ê’Ñkþe'Q/‚ 4™ÚL‰ðYÅ¡$ÂÄÙÔ-稬Ø1*#¶L.×u-͈QzºÔ‹ï r!'þø”Z´hN¨[Š²¬RabìT… ·¥¸ø) [eÁòrM«ûè˜2,(qó—sÖZêšÖE‚LÎ"À@™^5èÀ’IhÈ|]å` Ê\«’œ™\ÀgŸ"`l-øÅ䨽TiC/âZu¦DÛÈNk™×_4Q ¾ƒ”™1Upvä8a€%uüªó`]ÙÆÞ”¹#Aý¨ +mÏXë£'“B(´¦98ö°t)Bì*SHÂT®äï…ÀH§Ã]ëãv›¯%QGVòãò<•©±,À0…kͺ¸î+"Q E°œ¦Ó º}U1rø… ÁÚ0 Í{X6‡Ñàt9[ÙÕ nsŽUR糶]aù;ì!…‚Å6¬¸aU—Ï©UCp£k·‹}ÑéÙÑè“lŒ™è°Æ„üÜ<)ÁÃT3‡g-ÙðÀ„\y‡þ§cLS­ HvåÐ#(dT"ÖE$?0õBÈå3úNæ +¯—„0…Å>y£èbÌ{ì#اþjÂï=&Jºb‹¨w‰‹1ˆ3ãÁpÄò`x¦† D¢(É$Pï˼égpUÙ8x/AK©–û„n怕r³,R<¤ˆ±·Ú¡'!,–L„ay~tÛU»{ÁÖƒv%¼.fÆÕ‡Rn3|ò{/o–òZSI½6ˆ=ÇÜ+«LÝtÑo¼˜rÐ(1Š0Hö<™½îŒÌÏU‰oɬ(”5HNÄ ã¶.Éë¹Ald:_ÒP”ö>ÿeÚ¢¹\h›ÖE ]g ¤Î²ZdJ® “&.ÚÆ V]j‚ ßÒµ —¸ c×£ç¹i.—^Y§ {Ò7qµ])A}È;ÁŒÒF¤7Hq “ë|- ö‰ä„Û`è;ÅÌš-¹€Çsݧ5 +ßO +¹!úš1<6Šœ¿ÅÄ)ݱ¡ +3ç¾çþ‚ñ†?A;“oÎ&²vRÊôCçËÈ´?2­4ÓúÃþð„„厑ò”éF›j +ž7uÔÒ)½õ ¤d +!O*úfš²Øu>Zò!-Ks‚ ‚d~Ì'¹m*CÐJíÜÊ÷ü±<;Í ƒTjÍÓçôG€R!"ÎÏο$áDãf‚L{ ’UêŠ Ã¼ä‰“™9;Õ﵋÷‰ @ ÝUŒUx¸?âµp× #ß Ò™$:h%+‰†0 bS[˜ÐÅ û“p0tG mƒt%^Žòì¬ û Søù£wØ_Òi?vüɈ¢4<8jÌz1CSÄ„ñ£ŸÔ‡#:äCtÎLc]\®×0_ôo{„JÃÍ©Áa]€–Å5ñ¥¦/éÀ#x™NF„ì »9ùQàú¦†qì»WE»™­®2áôkn1³¢R®ç){Å}Þ̬ADÂðþiF¥eÊzùˆà^âXÿ`†½¾L°>ؤÅÆM-D_}a`ê$±§zà'á2$•°9& ¬‰F§)áh71Ù Õ]Ù¼{V6ÁZí4”î + ªˆ‡áL2' >èŠØ¸²7[oÀ~£µŠs¤Ò.º +6ÎìÏxfë 5•z|A2Êû9„F1ÙJ\JÑçp¨öêï ?Ôø~äÆ?‰ÌÁg‘Ù÷àù§Öü:o¹`‹ÕZñÙ€òFçfЀã*]iùs:+ÉÆ=Ðïì'Œ4—!E¸±RcÙ ÓÓ‰Óšë±ÆLY¯øq$µ¯ÉÐð/pü$³Ì¸ÄŽÏƒ)ØvNŽu¿j»£d¬µ¹=ýTs©´BuýÅ_q®Ž!66”‡ž_Ç8 ú„9ð»ä4  ×ÁóŽè•S”VÙØ'Iº‰!²aúÇ]9ý‰U¤¸Öφ7VVf“TVeõ£jMìg w~öÑVL¿å {ôW✒¾K‚€}öçFðŸwü¿~?it5 Ü4ÈæU5_®|Í YXœò«gyÆðÿT™AÄendstream +endobj +5845 0 obj << +/Type /Page +/Contents 5846 0 R +/Resources 5844 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5852 0 R +/Annots [ 5849 0 R ] >> endobj -2708 0 obj << -/D [2702 0 R /XYZ 85.039 277.353 null] +5849 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [348.805 382.959 464.335 394.648] +/Subtype/Link/A<> >> endobj -2709 0 obj << -/D [2702 0 R /XYZ 85.039 255.592 null] +5847 0 obj << +/D [5845 0 R /XYZ 85.039 781.388 null] >> endobj -2710 0 obj << -/D [2702 0 R /XYZ 85.039 233.831 null] +1978 0 obj << +/D [5845 0 R /XYZ 85.039 526.891 null] >> endobj -2711 0 obj << -/D [2702 0 R /XYZ 85.039 211.464 null] +5848 0 obj << +/D [5845 0 R /XYZ 85.039 505.694 null] >> endobj -2712 0 obj << -/D [2702 0 R /XYZ 85.039 152.04 null] +1982 0 obj << +/D [5845 0 R /XYZ 85.039 262.418 null] >> endobj -2713 0 obj << -/D [2702 0 R /XYZ 85.039 116.73 null] +5850 0 obj << +/D [5845 0 R /XYZ 85.039 239.1 null] >> endobj -2714 0 obj << -/D [2702 0 R /XYZ 85.039 81.419 null] +1986 0 obj << +/D [5845 0 R /XYZ 85.039 115.645 null] +>> endobj +5851 0 obj << +/D [5845 0 R /XYZ 85.039 95.05 null] >> endobj -2701 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F41 2104 0 R >> +5844 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F20 2865 0 R /F69 5128 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2718 0 obj << -/Length 2637 +5855 0 obj << +/Length 2273 /Filter /FlateDecode >> stream -xÚ¥YKsÛF¾ëW°j‚ªLOðÍÙµ³v9¶Ö–+I%9@$(Â& --ëßoÝ=À€•CJUÂLOOÏô»{èÏ<úógiìza6KRß Ót¶Ü]x³{ZùùÂW o¹Þ"ÆÒO·×oÁÌ÷ÜÌËf·kF¹]ýáüû¿¯nn_ºš‡aèø¡{5O’Ô¹¹òOo?Ü^Í}ç퇟eõ3¿ÜÜ|ÄÚU:·Wݾ»x}k8Ühâć‹?þòf+ºÔ» Ï ³töHcÏõ³l¶»ˆâУPçÛ‹Ïÿë©ÈZ4“]|Í ÆÜÏÜ,ˆ§p‚Ä ’0ˆá8ëEКOØq¹ÄTLÌDZ缫ïˆáEâ´EÕ½ÀpáTµ€êC·‡PÝ1óssdà†s§”¾ý•üxB+·›²½šG^ä˜o·¡2ÞáuÛÉlM Í¡íš¼+iXÝ xOã¼QœzoÈÀ¦¬®‚ÔQdâyÇÎïPh},¦ŸéIž|Ç?½B ”B^ð+IÐwHtQ趦üÓó#Añ¤{ñ¡ÉŒyf9Q ƒ„&… ¾²2‚…óxE³¼èºnY@­ŠEµL_©hi/Ã\>M¾ MµÑu©ˆ™+ÈmAuYïD(öz-_9ñÌFez[¼˜àø÷ëĹˆá{Âl¥Â)MØðBÖ áîûª÷z'“Ž&Ýo+Ù¼qù|µ4ûoJpÎú„±)q ¹nÌÖ%}ƒÀ„ç€âÃ.ÿ¦Æ€Y{h -]ß@2Òůë?½~õþýU‘¹ñŒð{QZo¿öQFš7@¸ß¨ÕkÏ ª‡¤ÎÍÅ¡†ç¿%g‌›vÁæ1É™…8d›aiô—Áª¬ýôù?2'óãïû›OPü½,Ïë- as«AuÛkD<$Xdã‹,ÉÆxÐ1ÚNLµnrætû¤„Y`õ^QŒp 6..—³,/f À¨D7-Å€(Š9î1ï0"¾pä$>{+;æ©°–!³»]Ùuâ†À›ö“Œ\ ©ªîš‰c Øb¡Xñí"ç‹„œ—àæúMhGM -éq63׋Cæp»_R0bg~C&RuE#Ó2c -£¸;÷È:J!b -jœÿ^3²p°'Þ‘ èHÙ´À¡Š14`LÌW2: P`çåVtú Sº¡!•©ÒÁÿ¥¬²Ðná^)”랸z'KÕ©€T$5\Úv—sþñp06Ú%¢='òx a±¡d,L­Èt0}P•F£>ÎðD#ÆvZæ{¡Rï»’”rŽ}.ÐüxdFÈ€Óv…Z#Ñí>U»u¥¡êþÐ K¼kmÈâ û ˜‘5z£ô ò‡Jhƒ@iïÑË-çò±»âó…)L5­ð=õ ­žûËv#ªþÓ‹=+Oõ\´ÚˆoŠ|ÅùŒÆ&‚Z -åJ -%2¾"í¹[¯+më‡\kÚõ ?umõÅ -gœÄ”0=)­k®gj˜ÈãÐERR1B™H -ãÜìNµð‰ë§Á¨…׊祮ëÊ‚›(0&=ô5ôzvô¤ÉXŸ¡ïY•MzÙ 6»Ån© Ü -L\LEAKj^¬/3‘yB?²Â«)f|¯?7—=C×Rsè$8§Ý =ÛJIµª•pÒ±—(Ò÷·‘gä>°*†€:&‡D>"´òCWSIP.©rÑè=³…]êÍo% ãr/’(óÌûp”£FÓ£'O‰|7¡" ¹è/ÛüŽË*¬N0î{>Ð:Ljtáá]~ Ø¿bÀ\˜Ðy?C–ƒ7 íCk,FN 'u¬ñÚ¢3ÏÙR¯ùy#0ïfáåAÅpVìæ6£·;®Ù¶åð‚¾T{Ô!-ESµ#ìä)¤Öè~š¢y6o…‰Õ‡I -_’#‰vœ?À25VúD&™¼H$É(I¿°Z66ìļ}wA¡ß¦ÉJ¸0æç°û¡hhå¬G¼_ØWndfúÁ)_<în_È&›[ -ÀZ†Vúö5}ɃLÛú=‡Ön±í>/›r¯ÏZ„©o|9tµ¤ò¬ýéd«š)$¾Ù‡K¦%ÀÈö§"ùŠ­SÒQk«Ž¬ä ,çÔŸÕLåY™¬LÈë³î„ -c°¢õ|·ï›y}NÆ«•9ñWv¢,>ùå¤TÃÎM&ä7€ºzy¾^OnêûÓ?Ÿ*ßÿì×Ì(p”êæ±ó•_Tq<û‚ÿÐyYendstream -endobj -2717 0 obj << +xÚÅYYãÆ~Ÿ_! ¡³E²Ù<ȃÖ{d {v³#à ØF@Q”D E*$µã üã])J¢f'q€Àðªêî:¿ªâ¸þs'‘QŽŽ'aä*E“twãL6°óþÆ +[HìÍëÅÍì]àO\GÅNâ„L²Ì;”O£€SíX($/“½á÷{"?°ºh¥¿ú+ 9 £æš†šœ¯àû€†4äŽÁ— <¸¾D+ººñAxz 6B3“EÞ(; g«l…Kš<·öPÊZw¹KlvÐäÄ*ÉvUÉí¡BÏÛlo4ô&Ú#aËçŸ>½¤H“')àª}ÏùjÄ‹9šˆÏ¼æážøØÑ•ÉZQÑ4åp®¾á=šKäqNÀoŸé^Y1ÍšêP§Ù¬s¶x Œÿ úBOR’Hë/CÚ[f ¢™äçÙš[Jä¡Q[È^•)[·Iê'Q‰% I0Ø%ˆ—·2F¨® +ÐlÏÑ žy"¬{°Uª"OùLA˜ñÿ¾WÝEæ¹\{Ê ;d/J~Önø»­ü€:ÏcÇ}yA<ñC£´ï}½ŽÐüÚHawwÙƒË.£ ÒÈäõ/ŽB¨šì(Ä’ þB Õ‰v£ÿ‰Ý]Ï ¡}@ÎØýš•ò$ºpëI.œ‰DN^vÁÇNˆ¦£ M™Uk¦¸HéÆUY£ó{$"ᇞ‚¿è)VTäË«awu_¹Ï×IÿõKÿŸg¼—˺TeIÃePÍðXµ<í+œœbµ/XíK¡€Þ·c¥›Ž•„]é–µi‘ª«¦/Ø5*Äz¾Gv|&éÀ‰§‡†Þ­eSÊo8ùìÜq†ù³7»´1*ò†.MÅz{`ò%oòe!“5e”O8#  œœ™ù€u&ô<äF,Ö †À*óiDKžk” ‰ý?ÒÔÄQWãbÕS°…¼˜‘YlùÀÜuà$¬¹hCC)å¦ 3Y·É%{f«¼%)7cë† ‚wâeû„X½"'3Ö:/2ñnqØ‘h¶Éªz<=rI…6Þ‘vsåÞ3uÙ&s Š£ ¼RÁÆyqecßçÀv—?q|ŸDÛ—E´OÝOŽ.ì+wP@?S<ñÁÎi¡Yý»]˜Ñ>¿E 3©ëgïL0 µ«T +ä ùŠ |d‚^”ê4ÄïXZ&”Ùo­,¡¤»®Ì†A ô•xP9РÍvLT“RHØ4€B¾s·"·çÝ/ß cÃͤÜVóî/ŽqúNäÈs°¢ +ï¯-{¸H7ÔF™e«a‰äõ|Ê <ãJ¦“<6èí8Ð%×Û}­EVB¡È²ãUÒˆ•®•J^MmÐaDÃ%ø¬·)Ü,†ý…¹ø6¬ô½ô‰}‡Ã¨Åê“ž—ò"í~à÷AéaÎ1 à°C0NZÕ¢œ™x€ï±yQ㣼£Å_eîºü ƒe‹‰‚þA)s® „¯©rb”õËÔ@Ÿ˜ɲ‡VúŠUr®JJ„þ昑€.ãXªD“ˆ^¼ð‰¸ãŽ‘œtþv­»†Ô¡L`ží4×»k7×áYw­¥»¾Cyïï±· ­ŸNºäPÚáКßÂúçkŒÊýÏ2z¤¹Þäºànø=sŸqÀO)Àÿ $2ª@ ¥*©8sÙ'`(žºŽªT¯UÓ!¬Ô$,)D¤!šÓçÌÏ„3#áKiE{—)A{hç3ò•|9Ê%v¹`¦üJüÂ; Ä—C!—n²¶á‘|Üiù¾DV¯v¾ãƒZ!CøžŠcÿOuÝ]öà²K[ùN¨×û¯uÌ85^pl"€ìøáÀ„ŠÁIâ“NdøI! ¸­Æ¯° Æ lA¼p´a ;õµ “p׆j­¹‹Æª ª +A8 ¶*ä|š”|rÉ_dµÚçT.À0¬Í(56Yi6pTzÒU‘OßK£ˆ>%|íètDâQR¬$»’6¼ +É¡¬Ãn.+8&‚€?LV‡B’h@†€q~tÉŒ×ÛmÒòÊr°ÒlIY…ì«â&Ùu Á¿ÜâüîÍ”ôJP1VÿµIùïdð}áäƒÅ6낶àW âóÕW¿ÞwoˆpâCù}òàé}]mêD¾Éÿí¬Íj²ôöyšÉ-W¿!ÄcðÿóKêO=HB²Št<wÆó”çv¼”Gþ9¿ÝŸD.þkÎendstream +endobj +5854 0 obj << /Type /Page -/Contents 2718 0 R -/Resources 2716 0 R +/Contents 5855 0 R +/Resources 5853 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2715 0 R +/Parent 5852 0 R >> endobj -2719 0 obj << -/D [2717 0 R /XYZ 85.039 781.388 null] +5856 0 obj << +/D [5854 0 R /XYZ 85.039 781.388 null] >> endobj -614 0 obj << -/D [2717 0 R /XYZ 85.039 761.463 null] +1990 0 obj << +/D [5854 0 R /XYZ 85.039 596.758 null] >> endobj -2720 0 obj << -/D [2717 0 R /XYZ 85.039 741.134 null] +5857 0 obj << +/D [5854 0 R /XYZ 85.039 574.042 null] >> endobj -618 0 obj << -/D [2717 0 R /XYZ 85.039 339.522 null] +1994 0 obj << +/D [5854 0 R /XYZ 85.039 188.565 null] >> endobj -2721 0 obj << -/D [2717 0 R /XYZ 85.039 318.325 null] +5858 0 obj << +/D [5854 0 R /XYZ 85.039 170.092 null] >> endobj -2716 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R >> +5853 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2724 0 obj << -/Length 1502 +5861 0 obj << +/Length 2891 /Filter /FlateDecode >> stream -xÚµÙŽÛ6ðÝ_!(B±"‰:Ól’¦[w×y(’ %­WuT¤³q±ß9(YÞuM`ÀÎ ‡s8>ü'‹=_æNšžÌ2§h¾³Ê›E`9|'òü$FÒÏëÅó×Iè¾—û¹³¾!–uù^¼üåÅjýêÊ]J)E =w™¦™X¹¸z{¹v—x{ù†©×€|·Zý†47“bí~\ÿºxµž]¸Œ¼(‘xãß‹÷}§¥~]øžÌ3ç`ß òÜiQ,½8’v¿[\/~Ÿ¤0-røÔ»–QyY×I9(ã3®†º5Õ ï-à.ã0—ª©î?ø±Uoo ã^îêâà‚ÕÐõÕ`ê -uÚèb¨{sÿ¢ü¬Ú¢*ïÑì篃ùeKT…dîùqD÷š[ð“Ñ2I…Úí:7ÌÄæý7Ý7‰0# 7Lž‚=’u…øLÔ€º±røÄK3ì–ŒBª•ªúN¦¢Â°µ€/«’)|E‚z0ðW·Ñkð³XßÖöü¸Ú[>£’$k80f£J4ÞYZË—†*?Ú[·[à ¾ÖÍy†p$”f\Óijx§{¶–4ïv5êm…ÛA›ªAÀž¾«É€ÔÞÅ‹ˆ¨ ú¡ èpÌò”èÐ'›`ÿçÅ©~æ¶b jKº>€´Õ?±üä Ÿ‚‚ ±«æ“h3¹ÍT/%3(Ë°¢èks=ª< ´Þ@@"™ ªº[‚ì æÚº3u‹Å“- ¶Q(ïÀÈBíµ¥«Ö^‹ -•5y¨kÕŽ±½ÚZ>°ø±¡ÝÞ Nôï=,ô¥Ì¼4Ìœežzþùæ¦^˜JxY˜L%-ðò8ž—(\ypOŠûâJ¹ÍɸBEUȸޕ>;­5謪|¤áxèÉ0þ¦‚¬“~Á¹b+’c\m6õ¤¤Á}8«ùï^ïOR’“tïÚü®lÞmÜ0Y({jtý-6¬“Díª3 ù« TÓgoŒeyu"ÜtCõÔµ(Ð'{p% „5XË /&íDÃ<Ö9ÈרOÔ]4nÁqdª13­ç³¤Ù'æ˜sOâmDiʪ¾˜36~ðƒh7–(´¦ZS÷D~<öe»{¨Iä'B×M¿;0½äFF ©íŒåÙ£¸wƒENE_«=IBñ‡›E4 -i*e’7*‰)‚óÁ©Å«Íî\Ÿzúâ¤9¢NñH¼ÆÑÝ¡e#†ûE5v+ | ž2“×£cpwe«äà}µã ž*Ñ÷ê™íã<¶m§;ŽŸÙ.;ƒU(cHHv\<å°)¨çPr¨¤ì:˜°ë*cÆ– ‡­`È4ÎRÍ ›ó^Oõ-ã“°Ä¢n@ -%W/âîjF??О<è'IÄ ªkÕ¢O‹·bGѸ@sŠUv7]Ðw;rô외è&C@ü”Q9k U°˜Ç¬ÝœzõÄ|•ÒÞÙ6úØÐ^iÍÏ“lì¦Y(~zLj®çñÈe(ŸŸuäxà§,8ñ!ômE&g¶ñâÄB¯¡ÅY~¬ôãašêö4ÙÁo®–1c“d=ÎÇïZò>r ½)ÉÏ’(̘ÌcVS¢MHDÑsWê'=ý3f.›f•æäÕõ?6×çšX _=ÞÚMr¯¨i§‚2'ÖÆŒ­¾ÑpÒÀ‹3ù½N>>K*e_ÏeµÙo·?ºÛ¼E×Ç9w*0Æ;ëáo|Ÿ#~ -.¾Gö[{ÒO9ºqj<5Ì ‹,Ïì‡ÈT¹-“í8ÚL rŽýÚŠú/ÞÕ1yc ™+u;ZQ1°Ùeì‹-U·~v&±õ¿èé‚í c¯(¹Y<¾–áó庪˜aƒmP…¥š/v²Õv„qSÕ̌ި;ñhðø×S -*ÐKòôüw¶Uûÿ}öFpLÉåQØ×S#—E„gúý råèendstream -endobj -2723 0 obj << +xÚÅkoÛÈñ»…êà +‰(.ß ÚNìË9='i¬à +äòi‰9RTøˆêßy-EJ”>€&H8»;;;3;¯©‰Õ$ôLˉ&A¨L' 'ËâÌš¬`å홌™ Ìz8¯góŸ}w¢,3²¢Éâ~OÇ3]Ï™,’/Æ›_.>.®>MgŽã¶2§³ ë÷‹«·Se|º˜†Ž±¸ºäõ_?¼ý³ïqä·~þøþÿð‰Ðxú3Î_¿Ë[~»~ÿz:ÉËé×Å»³«EÇsÇ ð!ÃßϾ|µ& ÷îÌ2(œì¶LËÅplz®#ãüìöìï)^s'¼kL?žš^è+Èñz +R^h*gx–éY.)¨Ü6Y¹©§3ÏöŒ¿ð'n›u¹ÉP¢ùϪOaæ¸Î˴€H,ã (Ãõf +t7Ù¡‘â 0â4–¤‰ •LvȘ噡‚,HpÞÖÕ<Ïîæuºl«¬y˜)p”Ôæò~5”ò}`&’ÝpÇnè‹5œšÕÌBQCI s¹°Âèu»…Á ‰OÓnüÉL¡Ú#¢º°§j¢òŒ,Yd“Á¾ß-å.cTäK\ ;<¨aÌIÑH*å8ãþSQ”b­FJ¸¨Hå5ÂHl‰À’–ja¡J·$U‰t™/ŸpiòµY Y@˜¸2¸“w&<¿ËHž;ÔÚ&!EX¬ ØÀ2 +$P«>Ý@÷+„ƒ¤¥Þ«‰dˆ ,7pM¡çŸkÙ΋¤7Ð#“Y–T-Ì­ÚŠ[ñB^’QÅw|øS½žr&Ü‹qòšaŽ€(ö̳÷tì&a»Žåüó¿uαÑPλ¯`üÏ&ÝÔŸŽåŠ‰V—é =ÉívÛ9+#|¬Êê(&%¤5ôŒÈ2Þ”vª­ö¡hoɈJ9uÚ6D[ß³M?P‘q¡Z Ƨ^lÖس:ÅæA;¤IÙk_=H‚ø Â_ÁbmLÈöEÛ a~dF@e`{ÈÌŽ"°-ql1oÇR^-j0. +r@DzŒk&‘V¨«˜¨¤GZ‚|@õÈT¶=š·4ά‡4¢siØQê®Y.ÈQ +y|y…¶WàUË'|õ™øS%!’¦l3°ý~Äë¢&dý± GÁ˜DWa`Ú¶šøÀ¸ØOˆÆžõЕpHY<¿}ÐñâssC±=^‡…d)®VÞ¶¥âWH\ÏÀb‡SHZ¾´[âíCÍFWð˜} íkpèù¡ÐuMLJBÜ·Æy\ÔCJœÖÇë+ß‚š&ô­{8t˜mõõ +7ï({âE¾x!Vé™ ÇtÁÛÀ0P`*Â<4c«ð}£.î ÒÔý î¼È5}'x”»ÎÈ­kîßT>×l·)W UŒ¡,ƒD þ™Ša×<“c°áš"Ñþ—…˜>èK©ñj¾r,LŠ–Qn .¸&(D2-Œ¬¥0ÒQêB¿Ò¥N¥øÇÕÈ(…8”³ãbã.ã\¬¢þ9PJt¤Š }¨´=)ñnôÅšÄFˆ´Œ·X§µ¾ÒÐÐ)«^êÚ-“²–òŽbõ¦ þž&Îò>’ÍÎAþnyVÿ)ŽDÊ1‚pX«`JumpWðk|ÄX¡qó0¢‚ „$b?­x¸Ê¼þÛÀ!^Bx`?ðerÚ†p ˆ’÷QYr‡,œì)’ðˆ}_æ9mr;p#ÝÛR¦C+nÈDn‰Å¬ ;4ýhXžYå%ª4οr ª‰Ê³À«=Yƒ íÆ­H©;Cê6Mó¯ÇVúŒŸKuºçÃx‰£¤,bäšR6hë´Úâh—8=ñü%Cyö‡¬^~¸¹¸~ÿ¢Ûr\ù€æî2MZNG¿ê=á^Œl{Öñ"@–È»ï¾* †”D?ǯ½Ÿº×§ô…DFÇê³,) zÑ' ¸£SfLøi>Wÿ>WUÙnëã[ìñ¹úOøŒó¼Ü1˜nÚ‚Ri)gb”ãïÝ+lh ÇÌÝ5Ò?¢!¼>¤ÿÆv9îéýÏ´b~¤OHŸ*ÅœDv¹Ns1ÀQ?FŒ¨€p&ú!«ëXŸÔ¤ù&m„úr™Öu#÷…Ï6ïÜo]i’ aŽ“sà|Ó̺œÿôyì•4 Òc^Ó©çwq½>‘è¡Ð4ÝÀ{4Ñ÷pN—!6f1(D‡eˆ'eÈ; +Ç”± $¯p{K7°B © ž­»çÕ´’åÁN¬ï/ç W5 Q`4Í6'ÄÕ\>&nçt]cû¾é8üܹâǦ~í¸v¨3GÄo2ð4L;î´dV ò#Â/}ÿÇQGåö¢¯ ÜÀ¹¿’‚Š±¾áYœyzšÞ0,qE/Ç|nÒݵ –†s:·`Z¿,æ´€ Äz@^èµ\ñÄotT² Ùp›9 _ 9H„“Cÿü˜‡˜¡KndctoΦ;]È•üÆ šN¿~º }]C ¶mé‰õ#ËÓÕþ½äpM_¶@Xs´1Èíƽ»WeÙ<©h$m÷;ˆÌ¯6“8Ÿ×q• +s®1çc‰o%óeÃz†šÕ·Ž’Î>óé8ë^ÔZ@Kóð¨|Xœ ÷-ÕÊúÉÅsUWgJ×bS¶bGutQ ¨kÇ•º»–6—©^ᯙ8©±»ß§Ð.8ÈSõÌÐç_Ê0ŠHus]Pˆ +ZÚ OlF¸¤qº|ù½í2'5î}nÜÓ³øºÍ½D¢ëô¥Žò8lk&+ªè~5ÓX„~ZFîFâJÙÆ2Ï$£ÿGñw…‹ƒˆC6éÙ¢;R”‰°ãB\j4ú@ž¢×.!É9oÓêAï¥å€Ð0,ðœ.ëw,‚Ûº9ùÜ1íÑ ÿX1ÿÕÞ]6t3t¢ñlèÙ¶i+Í eùÐ;äWÿ0~Äð¿ŠüäÌendstream +endobj +5860 0 obj << /Type /Page -/Contents 2724 0 R -/Resources 2722 0 R +/Contents 5861 0 R +/Resources 5859 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2715 0 R +/Parent 5852 0 R +/Annots [ 5863 0 R 5864 0 R 5865 0 R ] >> endobj -2725 0 obj << -/D [2723 0 R /XYZ 85.039 781.388 null] +5863 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [381.287 649.553 512.306 661.243] +/Subtype/Link/A<> >> endobj -622 0 obj << -/D [2723 0 R /XYZ 85.039 639.867 null] +5864 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 636.004 322.762 647.694] +/Subtype/Link/A<> >> endobj -2726 0 obj << -/D [2723 0 R /XYZ 85.039 618.671 null] +5865 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [186.225 622.455 485.324 634.144] +/Subtype/Link/A<> >> endobj -626 0 obj << -/D [2723 0 R /XYZ 85.039 549.412 null] +5862 0 obj << +/D [5860 0 R /XYZ 85.039 781.388 null] >> endobj -2727 0 obj << -/D [2723 0 R /XYZ 85.039 528.216 null] +1998 0 obj << +/D [5860 0 R /XYZ 85.039 608.186 null] >> endobj -630 0 obj << -/D [2723 0 R /XYZ 85.039 445.408 null] +5866 0 obj << +/D [5860 0 R /XYZ 85.039 587.591 null] +>> endobj +2002 0 obj << +/D [5860 0 R /XYZ 85.039 300.475 null] >> endobj -2728 0 obj << -/D [2723 0 R /XYZ 85.039 424.212 null] +5867 0 obj << +/D [5860 0 R /XYZ 85.039 279.88 null] >> endobj -2722 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F20 1617 0 R >> +2006 0 obj << +/D [5860 0 R /XYZ 85.039 181.199 null] +>> endobj +5868 0 obj << +/D [5860 0 R /XYZ 85.039 160.604 null] +>> endobj +5859 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2731 0 obj << -/Length 2950 +5871 0 obj << +/Length 2297 /Filter /FlateDecode >> stream -xÚkoܸñ{~…ýP-•%RÏW I›;Íň^¶ÀiµÚµ.zìéÛÿ¾ó"%ÙZ§ `‘Cr8œ÷Ìúü÷/’Ðõtz'¾«“ä"¯_yGXùé•/;‚P»aÀxeqkV·‘r½ ^Û£bWÅúb«7õhÇ»ÛW—”w¡<7ŠôÅívÞîÿíø»Ù†¡ç¼ßøΗë›ÍVG±s “n³õÍP6G†ßŒ§Œ|§ÝÀŸnØü÷öï¯þv;Qg®\Ï_¥Íƒ=ÚÕ°çÂ}í¦~8'ÈÔAô„pIR窺–ÈÚùP¶Í9²¼ïpK‡Ê^ -÷ûð/_z{Wl¶—·€9m]Ã]4ÿÒ §xrÝÛ6*q†Ü< Ç3CQ#(uþã…Þû/Èèú¼ï.ëy°ÛÍN'ò¶Æ\ü ±¼ƒ£ ™´=d¬2\x €`7ÂXhZþÖžêR8ŒB‘ø¨S)=±„íÀj§ìñ;OŸÝ‹Àzw<öC™gCð$¥Ñ‰vnñÄÝÆŸŽŒö úcWdCöf·ÁÙø‹oir‹hÈJa1ü‚ºâ˜uˆ€5 ïY§a”5ûùsCzí]‹§ïa‡ŽIÙÞ#¸í¾öøŽ0`ÁãBWôcE›„E뉦¢™°4¼!c‹ä(ˆè±Æ¿;bVÑñnz'l8‘ìÛ^ÌWß`¨è3býÐÊuVVÀ¸fE¦UÙHkªâáÔ÷¤‘rŠVh÷£ÕUÜ™‘AÁªB6Í„)À¨Á<üµl÷†¥„±¢^v%iÜ`Å'kÙé4©zÖ1¢¦x€ê„»Œ8„Žr¸ãQ¶òX‘¸ÖÌžõoܲ”D—Ή}ÏßÞ‘P}®Ï - -ÓcËR!‰í6”uÁ›z6 EzF7ic+fˆãIã`Bn„ò¬áuˆÓJ¤›Q—aN"É})ß};±•”X§Ì|øvååøÞœiÝvÂÛðäwô-ýÀ“ ?àv:²4ãçBDžfœjRÒ¹|QTó|˱;ö‹rv³§Ê(Ý ´Y•‚«Ñ~p3¹É ¯ËŽ|K!´=3{ Ä:c+yêÀ“/,­‘0Pt.öŸoo¯yÄR€ÁJP€Ä”Vü Ó_ñQ¨Mœ+s ÎLÂè³gÈ%Ölë–™X‘#~nßÊŒõ_>÷hÅNl¢[Z¨Ø#ïÇK÷<&=‚o.ÔÀDÁÛæ —Ç^œ”-DðpZÁ…Òø©kÅXÖØsÆ*Ù¤ƒ¬±ª˜xÔ“$å –&Œä¨p†žw~»ñ}ßù•¡Kéˆa¸,Þl¶1xù_> ÀæªàKÐ+¶]ú«CGë èb‰á° !üœÝÛ ZalK"Ü _HÏÇ·Ÿ72u/¨µñ³ç5KtúO|H”ù[öÙ{pÃAƒã¼¥+–á½7©y~d»\ÜŒï¬bÂ0<=Wǹ—(:ä˜Ax¶¡[ò­ÂsGilF“F-™®tèˆão¤Õ²¼àú².1ì:Öadh¶+QbåP‚‹/0%w0þxÃçVâÙËÏÃ$9ä÷´ ÝÓ²ÅPúÍüe®Êù‹^ËÛѲ¾x&8å1>Røy’!óñDƉw¸²'1ŠmeƒA³8N¼¥€Tíåر‹ç>ÒúÄ 4—aÈ:Œæêrýa³MÀÔH¦°kgˆA;*5© -A*a-1)šøŒKÌùf"´ì$4˜C2S‘mÊúÝEÛ´fMZ‘]ŽvëÇQTZëÀyoM ´ƒU]Ø“ìååÖñIh€ÑÇö“«‰9¿§þ“Ts -6¼$»­¿É8[Ìܧ…ñ1ÊÓ®ÒRMâBw”Ÿz¡œ1 Á¥J=Ñz©ºÚS¼t))HBê‰>¸1o#çgŠ™Ž÷” É*ñÀ—_®þÅй 4f„pÒ¦¼hP¡B*§KJôîx©nÏøŒ‡£D$7Y’¿B7ã¥mO:NÅ:P•¤¸Rs5øQäa­ùÓœ>—XÅà,«lÏö¹èr™ös‹´OÑu¾ƒç)H~%=B$Tâ€Ýð ôd t(lµð58æü-Ë‹}‰4A¥rŒdr¨ÖyœhFZKNû´Èµëi’c¦/¶B7ñÕwÛ JÚ ï—˜:"Òék˜ì\аÜáÉšuÙ‰rãäE"•ï†‘~ÙÔ®×X‡6Y MpÀXÒ0ĘšŽÁZ£¯¸²ËzP øòƒžßæ'©ûJîìky0m\¤nêûf‡1Äo(À\gV¿RY¦y‰¢fõÈ“¦,C’ðˆK}®Ùf•NÝHé…jÊÅÂþ FsBµ›À= à@f%{`ªV$â?â\ôxêW›Dn˜ -i-<¹Ey®OoÉ³Ó ½:‹>^üè&|+d¥ä„t<*…­ˆŸ]x¾ÌùYø õÈèµ)„™‘ ólvÔ§‰ îhÉhÔ^h2¿§Šã%®N ð¡ûsªyn¨"³s–³Á$¢x5‰0þÚØR@¥éB9@} ® —?Hʘآw`m˜ñÍÊÌ5¥ÙúQ2Y°çz!U ¶Y ùå$lÉ<Ÿ?ØW hnü=Š­=ͯú°I#S‘à¥ïnþºv…¹ÊžÇÄ=>DÄû;tõ »úXª0[itmÅpÌ>ñÛS`ˆ9ÖÄ,bëNSæ5ö];V\^`z]8 ¹\+d…’, Ü] æ±Ìš)CÊÕxtˆÄ,¸(ÉïLK!Ø`Â+§2 [!”àص2ÑБ•˜<åÀç˵¤_|ÌØxœˆ±&SÜCVV=‡8é ®È6…`•ÙÔT`°ôv`&¶†X³–„qRJ:)È2 ³rhÛ³šˆ“Ú`4­.šMé½õcÈR‹·^£#çæíÇwoqÈ-Ξ‡¦CSZÛÙóö옕Í,#BXUrÕfŸzjT“iÖ,L@DZõ¡(jvgÖè‚(AWŠŸ3®4 ÀÒŒoûBZì6çôâYgL+t¼K¼½¾B¶™îvLýTkmJv¹êˆA®6™ƒû½Ý-ö…RH唦ΧaÑ3¿/{ù €ìr`jj[Öö¼`È3‡•4f]7\þ'ÉMí¦ýš¦K*‘hnáý*dmì–)k(Eñ–2:ÓßD£8 SÁ”S‰^Éì1×J瓹„ÏÿÃÖKã/˜Îm†a>O5.lÊ ­c_0" 굨w«ý~Ey@ÚÀDܪ¥ý*ýi_“74 /˜¶ãÀû[Ò+n¶‡^G8XæG X¥ZXX¯‰“Yç¾°¿áÈFb±O©ö¤9ùdºË€€ÛU’§Ñ¯¹Ã öãüÜeª/õèa´”¤ì’Ñ/ õ¬ .°LoÖ=/g®‚÷Og³ï×FqA -Ôu³áZ/sä-˜rèÜÌ貦¯Á5¿¹¼këâòëA‚ŠÇ?ñ‡Äƒß0:ÞñrÝýoĘK†äÉ*»¾¯Ü¾uáN7â?þ…¿—cß]ÂŽËÕ](ï!ð<µ÷<±ö£Í.ïOCû\±ºÑÞf+·„öðšxR½€~¹Å ö•~‘ü}µ†Wp.-Æ"ycìô×Q.W'œù‹8OYMŒ[ǹ\58üQpx&ZÇ8_›ðíΊˆÏí·UÙŒgú|ÝŠŸþܫŨöR7€9+GŸ•¥P‚£ø^ó' žõ“´r•Š— %óýmjoendstream -endobj -2730 0 obj << +xÚµYÝoÛF×_!àL¡%E.¿órHlÇuÑÚn¢ (z} DJâY$U~TpüÍ)R¢’îqLrvvgvvæ73kkjÂ?k¸†i‡S?° ;¦«lbN70ò0±„C½Çón1™¿÷œ©e¡NëÓ:®á¸ötÿ®Ýþðöeqÿa¦Û¶­)˘é¾hO‹û‡™¥}x; lmqÇã?=?<õ ¿í#¼~zyßψɟþøôÀS~}|z7Ó‘p7ûcñãä~ÑéÜiú…¨ðŸ“ßÿ0§1lîljiØa0=À»iX0œM@cÃulùÞM>N~é–â1gʳÆìãÚáö¥,·g ËR†m©©ïš†k:d¡2©pû™®|­Èasqƒ<ÏÒÞÆðù×Ìuµ(Ÿ©P«£M2ÓÓÓŠ5>]­Þ¦SR`•×zÕ<|¶x•à—pUu4Svä¯hµÂ±V)£Z¤D¤/•B\GU”¢áox2Eƒ¶CèÚ)¤}­`2ÉÄ…¢å.aRÜD;yC:qd…ðgh€øs)Jâ{#šoPÞü½=°m +Ϥëï˜eh~ðˆÐŽºà5ë­¢ýY†ÞøŽ„%oF¤éÊ´ G¹ƒ-—EQÿmD® + ÏöDÊ9®ÌÛ$©Ñn^EÙ Îh‰ö˜/ñ0óù!ÍqóKR#æ£@Mys ¯K*¸´øãMÆQ¡„®È‡\1yË—´»"•Õ¢\^h»¯Èž0wk¢,êS«ÎOZ¶-|È{%ÝA¦"´äaÜ&Š8ž¨ *’§ø{cƈÍÿÜÀûJ¬D"åpÿÅB7e²gˆm/l*RÛ´ºæ"L¯¶E³;}îËîxc4MH¨÷ô[Ì>´93­¾ç/ôƒõ™Ÿ¢‰IÖÌødS\6ÏÉ{ÆbD—WÝ6 3ðiw¶©Ü™î*Wû;Ä·2MÍ4ßÐSÁPK°P<O—«=¸—¦î€rë¢Õ`QV^Jq!3@Õ¸_D®ò(tt=Ü"©™P±é&§ùM\fQ’€#Z2Ê5õ@"û*MOÊŠ)í”#*K'"Z¾ÜÝ^wB÷ÿäKòÿµÄšÞ|ÍCŸü æìÐßBOKV¸ê¶à¯e´Âm½2kÄÄ]ZÕü†™Ÿ '2 ’s~ŠIJþú•t‹ùPEx;QÜ.ô¯Ì}¹Ž[d5˜ð~€ÿ—¼¿ÖwzûK>Gg+ØZò=ÛãQ—üà lÈv;Ö³͸Èycømù†¨ëÞÞ?÷6ÎÒL)Pò,›2NÉz£n7øÐ$`èñ‰ÿ¬õ(¾2öZ.ë͵‰‹ê1‡”›'õ§*)G|O÷ åÛƒÝdäAª¸ùW5FìÐŒÃmmsˆ; ¡ÐWQ +Ô–JÁ_zÚ¹°nJ +1É¢'¼AhCØ(²:;Ö«w·o¾ +¾ALg2ŠÃÄñÁ‘tBôÎsÏ|äNN9É‹«+ÎÔgDwú>òêoa¼-²}SŸ-ê^aÍë¢÷º· žò¾4K°íuÖ«m’Eß°û{ ¤}™"†}•ù|`/»tuÍË„=?ž¹¨õ¥˜ ÀÑI\S[Sá³bwÃÍ™~0'å2Vû7L]I¹1j9£ŽXg๤¬U n[á•DFy¾¹h}$cŽzSqÆ=ƒˆ ™UDcà8ÐÜAx—§êDæW%‹,¢êmã/5ú¦äÝ;„ …*œIáêÀøx-Kw@¥‚A¢ÆÏað#âgfŒJ‘|œŠ‡âµRW(âÚ9†½¬”$I½šï£ª:Œ•ržgXZ•|€¼+nvátŽ8¸D'=ötOø]È·¨s¾â‡´Þö ™VO¥bž˜¯Ab\IM°I»×mÑ¢|Lóª¢LÛåF0NÖKÝËI|ÜðN|“·çFn/Ž1³t9úp.ºO}B›£NAŠZ¢5ó¾c—Ã|sÕ0Híûüÿ¤Wsõt/ìXû+×*–ž÷åˢ݅(sä.ÄrèÛI¾b€LÛð`#Úûô3(åù’_á…̜֥Ǘ6455ŽW+:ú½ÀÚåpw+S^ù ÛV`8¾3º½VsÝfÏq¿²?a þDÚ7ŸÏÕ²ìÂoÚ[ïR(³\È<»à€dã D²¯*¥ÚØâ¾—k2´¢²†-%ðæm,$qÅJ'ðätAÕ[Í2<<#ôæZZžÓb¸‚“ÆC!– mD¢ÀŒ›qj™/t &4±}ÃWÁÀÍéZJAR.°ûTœUEà½à‚ã;•˜‡!O.Ñp‘š1þ•ÚQ§ëi¬ga.øÉjŠî`ãõQÆ[Léà§à£ì˜8FbÀUQ™ºb̾8ÖïJ/ “êÈgd”:é^´‡^˜?–#¾œ‘Äí "Õ”úq¸Ë`ÞÀõûù"¥P›WÙrI‚.1™:XùƒdKû!ªY9èK¾±æŒÉÃx¬¦‚æÐkx높Tbw$™.t¢mcC3#›Ç§O¼K¤yí¥xÊï¸ø–ˆš¤¢Ë¾Ê¼æ³KL™G‹n!ï„öä%ÐÃé?›ö캢0!õCíg*ˆ.Jé3Ù!`^Û§{Ü¥ â´b®fßêâ ´gW®O1x +QK#rÐ…).1¸4üÀ%×´9ˆå˜mØ_· + qÁÉ°ß;òvVÿÈÏrý©l¤øk0ΈmÙÞ Ýô­s#Ý]­Ní]ÛêúÊ¡¡éö®-ÒN·pý =›ÀåÍ•<½ÍBðŸwû_ýÙ¢KÄŽmv8ž3\¥ eµºP¼s}Û?o\(üoèl«endstream +endobj +5870 0 obj << /Type /Page -/Contents 2731 0 R -/Resources 2729 0 R +/Contents 5871 0 R +/Resources 5869 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2715 0 R -/Annots [ 2735 0 R ] +/Parent 5852 0 R >> endobj -2735 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 422.421 153.763 434.111] -/Subtype/Link/A<> +5872 0 obj << +/D [5870 0 R /XYZ 85.039 781.388 null] >> endobj -2732 0 obj << -/D [2730 0 R /XYZ 85.039 781.388 null] +2010 0 obj << +/D [5870 0 R /XYZ 85.039 159.668 null] >> endobj -634 0 obj << -/D [2730 0 R /XYZ 85.039 761.463 null] +5873 0 obj << +/D [5870 0 R /XYZ 85.039 139.073 null] >> endobj -2733 0 obj << -/D [2730 0 R /XYZ 85.039 667.044 null] +5874 0 obj << +/D [5870 0 R /XYZ 85.039 139.073 null] >> endobj -638 0 obj << -/D [2730 0 R /XYZ 85.039 667.044 null] +5875 0 obj << +/D [5870 0 R /XYZ 85.039 139.073 null] >> endobj -2734 0 obj << -/D [2730 0 R /XYZ 85.039 642.326 null] +5869 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -642 0 obj << -/D [2730 0 R /XYZ 85.039 379.88 null] +5878 0 obj << +/Length 926 +/Filter /FlateDecode +>> +stream +xÚÍWÛnÓ@}÷WX[›½x±„PKC —¤4JÛ%V»ØNCü;»;›4nL(EBU•zç>gv2ã‹?búa˜žOó}3žØü"$‡ÑŽVq6töC£ÿò‰kŒ˜áÙµŽ\ÎÌ09±^¼Ú; +Ƕó(A¶ãy¾5…ƒC›XÇ{¶Ï¬ppò·ãñàŽ$åZqüpt$þ•°?Hþpt&Ÿ†£}Û‘Œû4|m ÂuÎëlD~Lø«qrŠÍD€{m`Äß\Š3FDˆç†Èq—i:7&Æûµ+¹&XuÕ‡3qŸmˆñB#ÔôØp®*T7QÕ|Æ‹±N¹õ]BA‘O|Ó!2v tߘÏz“wû=¥A~ÒxV‚¹SÀóAo"}gÅMKs8Öiu™ÅiýÈ–;+‰Òy©=õuÕÏË8Êûu4ŸFýiVôëù4ÑŽEFã£p8M:<Â{oŸ=xÞ!SYo³èè~-®Žn”Þ駬‘’û€v ©$¿ÅÇþ +߉Nl5’ô+°¦£–½•ëÖ:…ÇÇðüL˜«²rC‰·rkÊE<Ó¥¸ŒT)ÎûõbZ_Õ²»Aòãç*R +h[ƒ¹­‡pp‡Æ¼Q<§åª·ÖÌìuré·HẬ\ó"qÏÔ³JYšËB.3eùtWö×wuûì¡k÷»P¬ZEù…ª h7Ý=ª"cf=ª%¢¦”˜ëLÝ}ÜdêþC‰jyx—U•ÖP …¿·«†Š§ªUšê +Hy«%Ø×3)‘%ªtKªYå¥|Ëy$4¡AV ²õ0µrèªò¼ÖßÐm”ùFoKßYÝu¸uµ¨ÅŸö)ß±N7çÙÍÁ;[4׃7)—Å]Fðy–çUk¹]þmiò;ó?£)v¡¡§k1þgHw]ˆ÷fóqäQ¯µ«æÚÃÙŽå'M7,·ŠÞëýæ…›aDƒ®—dñGÿô.¾þ)â2ä³`ý¢Ý¥œRDÉ*™8õ½›ù®ÞÙ·þEÃ6°endstream +endobj +5877 0 obj << +/Type /Page +/Contents 5878 0 R +/Resources 5876 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 5852 0 R >> endobj -2736 0 obj << -/D [2730 0 R /XYZ 85.039 350.476 null] +5879 0 obj << +/D [5877 0 R /XYZ 85.039 781.388 null] >> endobj -2729 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R >> +5876 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2739 0 obj << -/Length 2934 -/Filter /FlateDecode ->> -stream -xÚÕÛŽÛ6ö}¾ÂðÃVb )’ºèiÚ´t“ÙÄÝ<¤}ÐØòX[[r$9³ó÷{.$%y4I/~y~½úéíb©” -¤Ë$Iƒ¿]/dðŽW¯ß^½^]½þgeðÛ5n¿y»HU°Zü±zuñÓjpíR‡:VxïÇ‹ˆÙH{u!B•¥³;‹PfÙìp¡ -Vv¾¿xwñO…÷ôŒOMp·ÔÒ„ -xZ*¦©ölJ3ÁæjW,–Qû²²£ù¾¼Q¬Kœ€¡c¶uñö÷È×åK•°I)ÃL[”g€ÑuvÄ—§¶¹ÜÞòær_Â/^—ëÓÆ-^:¸îwa„ø2RB˜É9o´»z§îZœª ÛÁá7–Òî8U³¥T*LLŠcFô´§ã‘®›n±ÔÂëú€˜žr_lx±¬ð¾®æY·Cü8ú„Ë|s[Ö/Ö[þE«È @~“ƒ ű®¶c qP2ß8ìP8Xç$‰â)L‰¼Ú°XM<«Ò`ÂX¹ QEAWâÉ -ÞÂá8a•=Xè!ï ôvB_Q§.’cš-ñØAQ†Ô®Ç@ -àžê®ÝÍ]ÉäóêaЖòýþžÏ1@Ç(j$?Ê»bup@Î vÙòÆ„‚>³È’ÚnÂu]m'8Ò)X¨>c©¼E)ÕM± Ͻu©ÒP¦àEÚ„1ÈbÂÓ@Hp=ˆÓ„©”ÞÏ"ØÓ¡ÒñÐÏpôbG{ÄÇÁ’àíó…{}Ï‹× †Ž7V»EPŸnw¼÷0>%ƒMñ€ZGKÒø­*H¾‚”ÉÀâÉ,ÉÂTG¢¡CÐðÈB±@JgqÆYäE—ÀDc†¢{]ƒŽ:¶¦‰jÂ$¢@8û8“¡ÐY¦xw0&:ûC´pyu³k hÖ¥²0‚ÛÁAҸרL'"çû]Án~¥‚{ÇgM•V›œB/qŒ6NÜ(m8f5V½q¨)n8’!*îÜ!òr¿ç‡g R¹¸·¦ÿÛ–îlîÃþ"}ÄÈû)Ú`òbÚ0ÜU]ÑpzûÄü!5i›ïZÞ¯~*;'ná@‘¯w‘tâàŽûòaò ©XY&AÞF ÖÕïBj â§Æ¡Ú0ªmÝ04F))r¨q ]R¬¶ö…Hv ãL¬ài}¤iÑ䪫®x¹ììok³¦c|h:ÖJUF,Ï&Ѫ-oÙ°pb@~0!â¯5¹l”-ˈ…ê+7NLf [ä…2Κ¢Úø¬ïÐ÷dA>\šÔ¡ù7òxÃXX „÷Ö¼Å9ŸÚRŽ8äÝЃL/…±gš~ÛSÙå7HhÁ „À™)r ²)ˆßÎ.û’ ò\X!–á°çÆCŽ,×P,AY™àª²ð˜€)®Šà™Í<€üŽc Œ^¿Yñ&ûùÃáÓ;:öÐfye Btg4MHÚxin!À’~P&¹2¯79 hA¬üIa6asT¬*;F¤ ¬ì‹–wº] ;Uá]f$MøåRÓ¢Y×w­uGV ¾.AÖ=o¼Å ô8ÎÕ°{°aeRCŽ¶šïp·nþd¬àñϤsÇ|‡‰Œ¦ºŒ¡ÈלÊ( -i9…@<É9rjcž#Å-3À©¦"ÛeÑ­/±n¼<”‡"ìîEûx=…FÆß4`ŸŸ¦j॥Ðñ€G¨;›âÈykŽQ¹Ï€¬ø¦,lÂëãìR°;µvÖ["LN˜åœÇb*6¼ÏñOaõÌ •éÇ¥0íIl™ÄÔ 05L÷Y¨S×4Œ‚%„º¢è½ƒH g–#w|YzOî0ÜcÛ ílëQ–>Ýç7.J1Î…v“ûú §ÃLVV·¼¸ÅÛ°)@ ï0u¤”:p² -ÕNB¥m€ºF„ÈPËP½&èr«‰ÇR]Qyâm -V\ÜððžÜ’ôÃî4‹ø/4'™5ikòÈúáv_ßPãD’þƒ/mmÐb%={ÔÿJ™þÏüo²4:r¡INr¼ež¾çŸ¡q|£aå‹l­óã˜'LXl_.¨hÄôD©‹Á[ªYÅ28æM~(Æ%Ž wX;‰­]g¶QÚÜèÍv€[nD1ªKP3}ÎnbºOÓ0Šþš™'&ò*0"·hïü=T–¡yëÞ,Ò0M“‘?b´ÕPžµ¶|Dçà•²c¿Øoñ¹ÎVt¸ÁõŽ|嵐²ëûÿ³M_N-Bß“!:,:øЦ<+"4—(W¯°m¾.ÜYL!ãâaIé›Â”"MG­—΂•v¤G³5×Xôâ¤4TÿM}ÛpMM ÓàJþùõ•­wáŠ%¯·5O÷5y$Œr{í Vg!à"¥6 0\QñYû~³œ()¥-ŽÙ.Mdû[*]qAuK°€’ÀY<jFüŒxþ\iY3X‹“Ä(ÂSuÙá+ŒÐÁBo÷XÁ¸²#Æà<—ÇƧkâθô8çD±z²ìJï„ý”È<:⿨A?:ª²}€ÌR_µ'üÜ€KÜNÁàÝ}Û¨zHhÿb çô ý·¸ê‚ÞÓúlx·dÇɗ7«:ˆ1#ÑFzÃ/)¾0ºŠÏ ÏÏ‘/ßlZÌæ¼¢âwhÒ\§#VŠx'©ÕX¿#-}.\rß*`XWE7ôLáÄ#¿1Ì_.R°Öî‘Žs†A9\ÿøtð˜a_/®_ýÊ_å£×ŸLûª†O¾†²92Sö…znTWÓã¸ç3ìd‹™æ—‰3&là!³øÊÉfMßJÅ(í•¥†°r,(xónXF©AŸ)·ËŠZº**¸õ‘Î'ý¼ómÕ#ŠuÐvïÖMyä(†Ë:”óÄ~zQT*ÔõÆ`앵JD0§—GJµ¹—ÒœYãH`EnKƒpĤ×1@õÈ™a?œám…¬ÆXÜÁ/ΆyƵɠ(N7_Ž•Ü”í|Ê…mOE§{Dï“Iÿ&©ü—,úVy{ÏGiñ&_ãþŸ>Ô!àÄg)ß)Jõ}É‘ÿ—_r^¿A’V@ÛOÏðƒiäò–¤Tàu±´_hcÌñõˆ¾VÓ ÒœÁȼ7<¶ €Rt´à‡“à~Э¹ãÖþZ9JÒ7c`oÔ»ØÏ(OŠŠ_™¦ñUÎÞœ÷Þ8ø½‡ƒöSû-ǾNÕ•+ΞP°Üæ»Öb,"¿ðñF;o¼çÈÿVaòïB¬¼¿î4tƪÿÊþÙ7ƒÌœËÏÿ¥Ä€ÀÿÌ3 -endstream +5882 0 obj << +/Length 1329 +/Filter /FlateDecode +>> +stream +xÚ¥Wms›Fþ®_AíLèÄq  ™|pjÅu&µ][i>ØîIHbŒ@áUO›ÿÞÝÛC »õt<òÝííËóìîÀ þ¸x̡ᜉ 0&ËŽmÌaç¤ÃµFO«ôj:ïGþ‡kp›…vhŒf~<æzÂM¯ÍŸ9º /­žÂt8³z¾˜§g£á‰ÅÍË#+æhxLûŸÎOÎAz†+×¼‚éç‹ ø~©ÔHüå§g'dòåôì½ÕCÁ±u;úØŽ¶˜·h_ˆ€¿u®omc +ä>vl&ÂÀØÀÜf¶—@Ì¢¾9%Ý(ÓLÌþö=ëhr‘ã*­ rÌ릅ä„2ÜקHÛ`²ÁyñÀ ÍÓYWBÂvƒé"­{ü‡‡'´‰o´T¾#©’Ú™§ªÀxrƒ7[êÇ}æC]¿µ,úi>‰R*_\5kÇ]º†•6— gy¡qÝØÜM©¹DÈÍI¾N5UÔ\eO~”d²F%_R£ã ˆÌu› ‡9¡hd#MîªLÀ!)‰ü©µ9 a qlèQ4<ø$]u«u·UÞ9­2åm8MÊm UÁÒ$«Àã5¨ ®+½‡|]TH jšFe’ë󃽶ŠÊ…|Cë ¼uÌ‹|½ÒëE.Ë`Œ'‹¼–â$›ëÕ¯ïŸhæ¶ ²/—ãª×Žõ¨éÝpá>Õ¤u/àMòlÖlZ¥ž‚zÖõ©(ˆ5ÛÇš¾ ë}„ëy“èK=Ÿ|xçœãq/óìE7d?m¡òöí“hºx¼º­·˜6®nL}b÷#4•äQúW¼-ŸRð> endobj -2740 0 obj << -/D [2738 0 R /XYZ 85.039 781.388 null] +5886 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [362.947 691.474 416.333 703.163] +/Subtype /Link +/A << /S /GoTo /D (winbind-solaris9) >> >> endobj -646 0 obj << -/D [2738 0 R /XYZ 85.039 704.845 null] +5883 0 obj << +/D [5881 0 R /XYZ 85.039 781.388 null] +>> endobj +5884 0 obj << +/D [5881 0 R /XYZ 85.039 708.141 null] >> endobj -2741 0 obj << -/D [2738 0 R /XYZ 85.039 675.441 null] +5885 0 obj << +/D [5881 0 R /XYZ 85.039 708.141 null] >> endobj -2737 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F38 2158 0 R /F56 1642 0 R /F35 1632 0 R /F20 1617 0 R /F70 2201 0 R /F18 2207 0 R /F41 2104 0 R /F65 2099 0 R >> -/XObject << /Im1 2193 0 R >> +5880 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2744 0 obj << -/Length 2702 +5890 0 obj << +/Length 2650 /Filter /FlateDecode >> stream -xÚÍYmoÛÈþî_¡8” -"šË%)2h øœ—:ÍåT[î¸ÞZ¢%6²¨”unÿ|çmÉ¥D'WäË!@´œÝ—gfÖjäÃ?5J"Ï×éhš(O'ÉhñpæV0óîL ‡? -=?ŽpêûùÙùÛ8)ßKýt4¿'–ùòg÷ò¯³ù›ëñDkíªÐO¦ÓĽ¼•{ÃÔÙõÕÇùÕÇwøQ¹·3œþñzœhw>þeþþìÍÜÚvza¬qßÏg?ÿâ–p´÷g¾§Ódt€±ï©4=œ…‘ö¢PË÷æìæìï­ž G¼jàv“PEž†;M´ï%IØ^SEלUpàb;·O‚8uÿå«p“×ð1õÝf 9«ªX‘3ÇIåÞÃwU>0ç¬þD"—ð9¦îAdí]¶BQÛÓ3wA%9’}£CѬ³¢ŽMTe«SO ¦^0…åaêÅ*ü={¢Õ‰'ŽQ¡ÆÞ:ì™3þ™¡s–„M½0ËŠ]ÃÓK -cvÓJâËn”–ç²KÖï˜Ä”»¨ -aÜYHÞîRådÂ#oÜ£ˆrÂÂ,›/٢˿ᬄáÅvÅärk\ˆüfitÕØwÎs`úª÷E“ݯAÅü$¼öÄ]œ¾|ž³'–uc$à ÔZ)‚ÀÊHo˜¶*;üª™Ô¬«=Ž|I¬@rvuSîjKΦé"^ˆ‘XÛ0@kƒÎÿa¼ËV"‘4PîÛ$29-Cø’¦nÝ¢@/ŽEØœMö‰à£æORS¶ £ÁAä‰ÐŸBù“³°rß,JJB8PÝ‚«6L¸ãö{þýáJB?ŽB·0Ð#„×s€SÈéùC!LqAÌG×±¢«1_ÙÑ@¸/[ÜšΔt±â¬¯cßÝ×­ùc)Ôzéõ@h[E,~´¦…ñlöš¥µbI'¯šzà–°o5Áz÷ˆ›,MÞ#Øq':«ñ[¬.ñ«ó*œ9û›èqÖ(#Í%~à^ˆ¼Œ±uGý¼7ºÚš@Í_kp8Ø"A¿ù’Åp0pÉE¹ß¾«ÒFAûϬ3Òf„â’=Z÷>à™ä+“^¡Úž½ÿ 2òl™WTNŒªùÿ ,° )Ðõ5¸ZëúHÎ µí{ˆÙ„ U9ÈÆLŽ ñÇ Œ³¢%·>+ÛÖ{ÿÊeÅbH<ÕM ìÖÏaÅ€ë¶E(¤É8AA ‰X¬²Ec·$Pxšæ‹“zn7;âßýÁ‘)YáHy›Xy!µ§Sɨc/L"™÷Ã2bŽ?}EÂwûܾÇÓ¯yÂ*=ë…ÁE«¬ææÄ€§m. ª6ÐÐ3éÞ7 ³A*SC!ÉùpññÝí®y÷&þLï7ó›Ëë«ÙÜy¶uÅd„ö!‰q´=›Lã(CØ #õ| TÍÁý´ÑL²aQt§ µ µÚ¦øQ(æ¨EœŒIi‘ -˜‹kå†ÛjDí·I©Â£VÔ©ŽE§zê:¨0Dü¨÷ý–9Ùnæ&wiéï¹8XæÓNÄ Væ28©‚„'å2¶sÐ’È ‘DyA’üÆQß…ˆöTüÖ¡ÂK:Œþ阚J”Œ“°«ažØÅ bñ°§óMÁ@8,@\ƒÜÒUðAÚæ¥ÆJHAž† оØE¡,Ì¿øûSûR”°ÇŠ€½q©¶ -bÆ?—·³‘RÉ/X°âItÙë—üq ön3àb}h Ÿ3±J»ô€Ä ÏÑëꓱy©ƒûü-´9.v¦¾v/X€¥8”c^¢–û6QËNG¡œR®ÇßåÛ¼T²îÇ™cÀTÔÚ?˜ÖKr„Ñ¿ñ©–צ;»ƒÞ~e:»/&_¾±àë³ùûÇ®Áw”°­€p,Õ‹±¼…¯ñÉö爾_lDš^â°8¬ýÊê!kÐ[¦‚#Ecý¼›U’’#ó8¯žâs¸í€OÔ%ìP,nÉ{…8LeÏ_¥í•œ´CŸ0f¨+‡)ªcC«t ƒÞ³¡-¦+ Q¿«=G%Û>Ô\_à›Äà›§õ*Ô¦öMäè}€ÞÃ_3½0`mµ-ÇÝ/Ðè­(ˆB/㯿•ë(õ¢4|+Ç3FÐßêôY9´Ê9<2ì}9‘‡°„ç¦OžÂŒòRŒ·®OþXr¬¡Nß+ßó§ -%Œ>”ç‡iªyÖÓI»ED8¿zP£×%iÔJ§^Ý?(*òÓ®}OÚ÷ FÉZ £1XɯÉ&d0ÞÒHžöÿŶ|! ŠÍ!pï‡ fåF¾d""'þ’ŠÚ‚kˆŸŠ°öà0Õœ5%>6ðFe½eV´tUzK<åSçO®[´¥Í¢Ù<™ð€ÖFÄÉê*çþ¹xÌe#ûeÏŽ§ZP„nÓfغn®‡Z¥üWò«ï‹Tjtÿœ? Ðḗc„Ù¡blg­èŸ1¨!”ã×d‡—ÖÅbÃÈÝæ§+O-»Ì€Zݬñ2å~µf¼o›k4Ѿ¢j áqÛ>ßq1‰÷Ǧè:C¨9H׃¬'ŽÅ3KºÄóÅ¿¸Óö‰ÇüÓ*yè9AÐ/–WÒ»8°”ƒ¯Eð'ž^wî4µ,+õÞ+!%ý×Øh¤x¤ñZ_Þb©qÃÔ»lñ©…myƒ&;tçò>>š™IX¼’ÿhpø@^©¸lçÛÖÅݦË÷¦h’$ÕeO-ÿvÙ–N˜¤îY8—º@X’u3¡šâ¸Ç‘?]‚Ö”…Øk†,ÂÆãÅ0pøí$!qQY×WâÛ²an­_3׆o»|u~ŽI9I\ƒ7Ÿ°õÊk‚þðu÷ -c‚i©Ké}G<%_ÓìZnz¿àPd|É7¯ U0YGÝ×¼g¶¼!Õx¦9:B{­–cü3œŠ½i[š`–SÐoOp]úmY±ý{Œšú^Ã"½}Ûߪ!eÆ:jðÅ'æ4>ÖaûB`ðœ–endstream -endobj -2743 0 obj << +xÚ­kÛ6òûþ +£÷E>D´HŠz´(Ióèm’ÛlPÚâ µ´¶nmË•äÝw÷ßo¤–v ‡`#r8Î çIËEÿä"1"Ðé"N¤ÐI²Xï/‚ÅVÞ\H‹á[€óâúbõ: +2i.®o{:F„F/®ó_¼ï¾þþúÕÕÒ×Z{JŠ¥ljwùöúÕ›¥ô®ž/í]¿zÉë?¾{ó oqz`øñý{øÿÝ¡1ø#Â/ß¾á-?_¾}±ôðrùÛõ¯®;ž;n€¿þýâ—ß‚EÂýp&‹BÂòþ8&Ôv¾»øpñ÷Ž¯… Þ5§£a=U6I•Š0 ± „ BÒÐ_ ŒDÞ22ZKi±Xo«¥o”ñ¾úØd›âkž¬Šv½*e+òU“ío2Ñõ}Qóê¿ùÓ´YÝòð?Ryô߯èÄ`tØ7ßÐòa˜&[ãÚ굊ãGBÅ ³DÄ„ù|“•¸ g|=å-?-UâU'ž<,UŒéír†ìJ˜Ü!NÁ—ÜV¼PŸ8P^ƒ—œíå&³´üÍ‘R¶³“¬Ø#je÷@öä€R ÜòU»ù¹á|œ“„£ ³ªXpñ(àêÔÔ«]µÎv¬ùÕMyX=”øäù:"¬gÇx»e.Pà†X¨QÇ–—³`…ÚºïtƒêLDl·_?ÎòàNžf™ìÁqî=R*¡¥Z0}©Ô¬Ñ;€DF¯‚¡ÑŸQB–® +°Î¥‰['Ía3a!ÒBëøi,΄…Ñ%È8*ŒF,\‚i†AÔ›&Nê‚ <õ‹°¸»&Ó*[agW`R!¨­~wÅ×–[p†ðœ©ƒÎi+‰›;xLT22Ç}uh–µ¼‡N/-ðH‡V´)µÏØc#)RŽœ¹÷¸¬k[v|N™w4§Ô ™ Ø ù`¬­Á9[†»õvk74™•$°õçŒg´+kì‘<Í«}F¾ã}1Òl<Ú÷/ôðfÀ†#áeÆÌ™àj::_Ëøƒ +áè@ºÒUÔâ‘”b‚DD`tO%ÊÎã.¦±P_$G#àl-È’pÞwÕá×@†›SÍáÉ×QäýÌ~‹07x¿L•÷ü§Gø Sø~&±pfüÇñG"’aç?J›^ß8Ùf8s¯täí³ÜŽÊ–qÚmÉ*FàmVƒ£(sFç-¯BÈã‘d-Oœ¡g8?Â]¤Œ­·dµå‚,¢ªïlÈaŽª Ùˆót¶1“"IèX˜“ÌØ!yÝWNè „2öü¦ šd½/mžBpvêÙaÚ¸™M•†˜âñÇ5«&[ç;xÊÀË5TxvùÎ82n]d9eïÍœì×äóqàA»4裄³Sâr/,#b zkŒ¡¤Èy…Â|;WÇål׵ลh, CØÿ‹#:‡ ¸ ^–9cõ>ˆ5WÅ cedÏʵφ•Ç 0»;ÙHV«˜šgŠ[nHa<¦™X†˜óÑÓ( cͪsUBÄ#ÆD½íÜÕ7ƒÐ²<<O«Z[Æä¶L*mÉ`]Ft%¥/Sæa(ð?°š&ãMЗð¨Nb"ΑójÆpÔ^:Ž]Eu²iadÊ€Îö€YÅÓúÚ…HÝpŸµßšgXÔ:£˜NS0B›‡¬øVVVâ œ¬U¢ (e¤{«C0ÛðþXZq˜UÀâ$KCÌv3׫"¨Ø^š«Lc]¬MóP¶ëíÌ5ËÀˆ4ÒvKŽGÔ6¿’5}bžn–*uã.×SP­îØ?yÍ’£"«ßc œòê+H/ÁYsQWUû—.f®È29ö OAùº]YË8Ë; +,?LÔr4ä/h¾4­s­—ïhùbÓ ¥ £ŠM؈¬OŒP󕵨ÈÖ#Üâ% "TN»Se† ´·áù½Ï(Ò@#¥ä· ~vÆ16·`ø§PÞ%–Îqªn –z¡¡÷Œã/Ñvˆ÷;§mGÊïiMÛXÍ ÇêËÑTsÑM‰$L¦Ñ µŒ¥©í”½oâÚº:–…]°¡üZçØŒ®Íù RogK:›‡  £ðß>|´¥8ƒCJh¸™“åšÄT…{haÐFžv±ðâ õ¼³‡P¶ùÄã+G¤÷=–,Dù“­_m€Ý?Ã4¦8¿Ms—Xõ§O"t3©sÔÕ®¼Y50_¶Ÿf.Œ(éRÌÆ(c’)LïCµ£F¨Ä’Áhf«€0•¬4pü&Rx“u§8$ÁÍ8wD§>©ñNÛmÙªÇz¥A`†A¼x.øŠ¸‹½Üà>->äAÝE^1"ÓtòüòEr}ää‹‘ÀÖÅW®QJ°a“`€òXäÔÒˆÎÒ $þ™ÈéhùbÓÈ Ñ’ +‡ôHä¬8¬è©5m=…’9_ø#/*M 4§O¿ o—²ø#%ÆÓ«×K5_AÏ€^ú ^GYb¤ Pijû#Äø‰ëQoÕÔ“À +¹GË'Ep8ÆZÖ‰€}(ÁõlUy:6ɤfä—›9»!^›il« òÐµÒ ƒ¸|d_Ó!¨õ¬6´5:¾NÙïktÕfýì°)r,ÈÂлdìq‹ŽOzÅm;xæ*m)=àZq vl÷¤7÷¶E/“jô¸Em’¯d€Fðû©¤"T0EÔâ?›6[ß‘)Ók(W—ßBhn‹½O„&¯ Ùz]öõÿsÀçQ©ÓR±q9 +‡öIâ¾k ºÑag X— ¤+ò*çcc[Nh”w»®¹F°;Ïö«¥LP H¡oµ¯X´ÙœQÿ~¦Qe§çÖÖlkz\®ÝGšðûpQÓ,í_IaLÖ[ï驦ô‚³á'¤„Ÿ|á;ÜÐw¨\úíú%l «š·dvg×+ï»WI>+±Ìr/mÏk$>òÉÐnÜuíSË{vÀÒhžÍ¤x~»à¶=òÀ]q¯ìuí]¢d;μ  -䤰b•¿q"špðžÑXÈ°£ÂÒ$ƒÞè‘Ü™ÍßHØöðuÓòâƒí‘†ÇsJÃ㛂A¶g:º`©K²Þ4²íÍLi‰D›aü£<m>Û=DZˆâ>Ò½ÎtH‘ B&¸¡™@§ô5«ÁŸ® Ì{WÜSa§RãQôï†V´®;ƒñ¡x`,+y׳>"8hsš¶>­[ª¥ºß,ÀÏøI$rO"Q EnÓ½ ƃ‹Œ"Ç#îÍr~G¸´µƒ%úÂ’-¸ñq2w#«¶ØÁh®ß• ÿnÖYüLÝ…]D¨ÔÈNÆôN>:É<}¬Ù‚Q÷6s¤‘B…4Œ²Åœ¥àPý-Õ—hnFf^ZGÍ– ðÇÒý©ß!û×Z îñH©a”J:^èi9IÏùu¿WNþ&ž>Ûendstream +endobj +5889 0 obj << /Type /Page -/Contents 2744 0 R -/Resources 2742 0 R +/Contents 5890 0 R +/Resources 5888 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2715 0 R +/Parent 5897 0 R >> endobj -2745 0 obj << -/D [2743 0 R /XYZ 85.039 781.388 null] +5891 0 obj << +/D [5889 0 R /XYZ 85.039 781.388 null] >> endobj -2742 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F41 2104 0 R /F35 1632 0 R /F56 1642 0 R /F38 2158 0 R /F70 2201 0 R /F18 2207 0 R >> -/XObject << /Im1 2193 0 R >> +5892 0 obj << +/D [5889 0 R /XYZ 85.039 566.671 null] +>> endobj +5893 0 obj << +/D [5889 0 R /XYZ 85.039 566.671 null] +>> endobj +2014 0 obj << +/D [5889 0 R /XYZ 85.039 508.637 null] +>> endobj +5894 0 obj << +/D [5889 0 R /XYZ 85.039 488.042 null] +>> endobj +5895 0 obj << +/D [5889 0 R /XYZ 85.039 309.581 null] +>> endobj +5896 0 obj << +/D [5889 0 R /XYZ 85.039 309.581 null] +>> endobj +5888 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2748 0 obj << -/Length 2489 +5900 0 obj << +/Length 2208 /Filter /FlateDecode >> stream -xÚµY[oÛØ~÷¯PõRÊ0)Þ/û–f“ÔF’uE±»h’–S¤BRVôï;ßÌ9eq7iÓ"@t.sæÌ™ùæF;3›þ9³8°l/™E±cyq<Ë6ölE;o.EaÏ|Ëlýíîbù:tgŽm%v2»{`’»üWãåß_ÜÞ½ú°0=Ï3ßZ˜Q/?Ý.㣬Þ~¸~wýþ f>-:Ƨ[lÿòa{ÆÝâ÷»›‹Ww£kMßòC÷~¹øõw{–“h7¶å%ñlOcÛr’d¶¹ðÏ -|OÍ«‹ÿ¸Èž?“S¯3}7´Üˆ.Ѹþ·¯ó‚Ä -’pò:Ú Òhô‡|ø”M|d$äñ3>cæÇÑ øˆv+ ‚±âß7¤Â~a:F1¡A'-á0û2s,ÛOOvGc–ôxˆ–×gösC"ÍŽRy‰åÒíNHX±ãA.'žÄ<Ûm»fÁRHXfΗ¯nl4 ÿŸîÒsiBëm!“˺é/eXQÚ—Oj‡pP¾‘·´ÃëŽa‡å™Ö¹ôkÞ=@=¬ "a!óŒÿJêó\gc ~[YØ—ýZF/?ÑòíGKfw4Y™Eæ‰0—¸tnáF KŒ¶1ôXÆ<§ÿLÜË’\a‡Å?U³eEùXö€EO{l¹ÆÛw_·,Oú²^Y ÏW$±O·¿è@íÝ.[Ó%nâB-Y”,€ 5gÎ÷±ªJÖ¦ºofBÖ7²2Xñ4ªšÐ÷F Ÿì%Æov`MXc9–«2~³nº¾cô´%Qn{9 -͵t¬í–¿ÙŽýjp…¶“Ã¥bØ·)è˾lê´’µN” ‘"£©Ì y‰Iè½íò«®‘É^` =b…ÌU¦2PAïJf -C4bâl—nÔÏ_)D3B*Œe|Ï’ÿÏY|Š¥_v,M9àIÉ×M<:p)âöÞ¬é†ò£QîÑ -ÑH)ôE -‚ò\¶À`?i6äÙ\˜”bVÙ¤òóT¬Ë¬âÛBÁ -_ùÒlךø\ð[žéZrI¶­ëF&÷oÒ:g%Ô…¬§j¿_s´Iק+µÏŠðOu‰&ت~&äGêÆuÊÓ«s?ܯrN¤)ø`ŸÇâàUu˜ƒÀV@ A=„4[‡4?1æÛ®Ž§ÝQu\„˜ËŠ€qWå2}„¬¬¤ÇI8E—µÛJÀÔƤӡ­|cÒ–`ŠÊ/ô‚Ñt˜-FÆœïÏë”±2—s½Ò·ðàÀÂA…£ÖðHJ -ç2«ðKH T¸â'§ -ý²*ãVƒÜÌËaœJ>år¦ñ»R¿,bÛìVkÌ]xøh¹íIi±í ’œË˜f¬òbË÷¸#˜•iÆ÷#R-GóLCb'ôÝ@Á ÎN<0+Ӿȅ#De‹_Ìw°˜‰t é”—&D»½ýYJ°N¬Šx#:)¡‰?áàòµŒ’¹YNìRD…ˆ3¯Käõ×%yIû£fÌÓí¶*³ÁuùTçHÌ-‡mrÜ^àf¨ëtìà OªóäF‘^’)‰R²©8Ã2½¤ÕŠC„JóB‘À c†,ÿ®5Vxq}ä§Áˆ±&…½Q½‚Ì»W*oêŒÅNÄpÃïZÙcJÙö*Z|ØI|ͬ©)«‰ÛçX - -sÆ Þ]¿{¥–„ƒÖȹ@d$`%‹ì±™ü³¬s>»WGö”xÖãÓ…š@Ý}3å)’O‡ªKâÙ¹æ”sJÜëÙ#»¾-ÒÍ10 -(< œùCe.°R1B^˜ë ƒÊ0ü.ñEY£—ž¥›ù²`ðeË0— ÌrSX§(«¹x>Bô»­R ÛÂzÞ0xÔ¸ÔÞ%z¡àÇz’“D3ç’k¬Tˆ0IBÛ ­G0Õ‹ªîÀå¨áQhß—TrdLîÅõ"){ÇöžóRˆt ‚âky¯,`Ñ€Ðð¤ª[)R‰ª-Vi›s[ ŒûNºuâ¤F,H6wa&®Rê²Û°èiú‰ƒ±_ÀsÐj 8 ¹è¤`ßr©f‰óåR»¡#å Q©8U¨™UýNÃÅZè«WÉINq¢Ú‘~:NÉ-èäø%ýuÙÃxŒŸãq¢Ì®AÖ·%WT…¦êþÝTÕàÕŽñgYÊ‹­(ˆ$2ÒI"ŠÈ9'ÓU›îU:³ÕïT|øf¦ã“ÿÉÏ0lâc„wò–;Ž¶ndŸZ,áZ¬•V‘ $Z”=ô_|摯‘í$  ¤<Åÿc)F÷b1)€5A1ûh\p{J¡ uúÀ~è-rh¯Á eáV‡6úu»;ǼÁºRôlê©ZA.Z6zÜœŸ¸«Ðeh‘à\i К!{z\+jX íÜœ£•Bgã{Яúp@7fªŒ†¢kn|t æ¢Íahî*Yb˜¶2Ö¼h¸•‚­ÂÔ9ž®ˆÔ HclYL|qóT[ÛpGü²ÅÁ1Ñ;éè7Óý£èŽ -äaì°>jS}Š#–JhÓZ6•ùbºé REõܱ}-DÓDy¯[¤¨ÞüNŸ½\^þúmÿ‘°îéðɵV.Ù°®Úñ¤&§nŒ‰íŽry”¢¿$·º”!Ãoh¦%\±™ßÞ¼ýLµW¹ÝR°úüÀÉ÷áâ_дâ;‰ªV}×6jmTé»lééwÏžÓs§†6€çéAŸURõ/ŽïÓ}d–Ø‹¿£øaù¦Jµóç5Ïí Éöö¹®m¶§?ñþ¯g  PµÎ39|Ïr¢Ãý–Ú)O¾™ÀLÈWRzk÷Çê®0QíN¾’q¦9ù¥¾ÁëTúÓuþ#Ã8²oÓ¡%-Tª¾ûx'9ù£.LJ´ŒÚr(E‡Ï›fì¨êC÷(ÔÐxW¿Œ¨¯¸“X2’b‚kbUL¨X@+'È1Ç3)™%ÅmžÖtƒÐ¢F-ƒåGþôß”Z~ì9¾k…[Ì#³?ÆA9¤ÐØcÿ ?à™–endstream -endobj -2747 0 obj << +xÚÝYYoÜF~ׯÄ/@Óbwó ‡U°>bO°XÄA‘œ![as¬Õþú­£yŒ†²ìÄv†‡}VWUW}UÕ’ þÉE +_§‹8‘B'É"ßø‹-̼8‘nÅÊ-YMÖü°>9{ é‹ÔOëÍH'A¨ëâWïÇ¿}ÿfýìír¥µö”ËU'ÞÅ«õ³Ké½ý~™hoýì)Ïÿýõ‹×0ú +{÷š¿¼y¿¯ßÒ2þÇ/^½à-ÿ¸xõÃr…O—¿­:y¶x¸þRdø÷“_ó÷Ó‰/tš,n¡í Ó»àX„výúäÝÉÏ)ž ¼kN?¡ND˜ècép¢ ©R¤Á"Ö‘HÃ4T6Ùe].W¡ +½sþÜ•…9{.§›W‘P1œ }á'1í}¾LÏ´ËU+ozén¸mËöc•—¨Ë#Á¯ôn—*Æ-Ò»æ‰h¶öÁ8mhk¹CŸ;~m•xfïöWuÍ­¬¶¸ÜÑmJÚ\pOS^YuW@éòÔU†ä>âOÉ‹ª–ÕGø­Šý)£ø‹•“}%Aû¬¬¢BnËéu$EÕ ©cM*@u`»?Û…Ùep +´•··ÌÛ’ÕmÏ`Và4LZ)IÀ²A^;7ŽÊH=ðAè¥â¨Oƒ™!åå¨yÜ–5Û²çÑ5pØìè4Ýg¡ƒô©‘Ë(ö::kwƒ7–aGG é'3þl˦lA£ÔA + T‰Ae¸£ž,cv2<ºáQÐ\K/ƒÐ[_9ñtž¹u—½-!7eFk*6ªcÙXy{óÞ’-lÙÓŽÉÜ( +„àñ™ÀîRä¦ÙÌxLÞö붵¹dÛ¢£èX¾Ù^¡ÁœB+³+‹ +W‰Þ.Õh˜NPÆ §J 凎ƒ³²ËÏn²(Î6à¨Çü&@ð…W¿÷eP;#“G—O–Š4œðŒvv•‘âzÄEd°3C*µAQoyä¶"ÁQì{L™¢F–;è°¼ž\Çù³ËšftjÖˆŒD,ÕáÍVdAh@uÖ²Ö‰'Ý>èÖf;dŸn†GPnÜR‚•`e/{ù¥|—_ ÛDÆ3º…# ÑN‘µYuj§NX šDó6×¼¼®®Ó&[Ùogø])?Q9Oˆ‘l;ÐiBðïß÷àšpšŠ œÕÕå™-ó}[uw(Ù‡º²Ý¦½XÃa¢êÊÝ9:%wmÙØò¼(›;î¿—: ÛQÇÖŠtÎIg -ç׸ÇV´çvœÐÕÎìžpm÷›M•We,ÃxŽo°¶Ëª)íc÷ÿØ.˯é]ˆ;·wô°"B’þUY×ö>óÜìQH%}ÿKÎûK䶥µ«¯xÄãùÈ ¨…ö“cG­Íå˜p 9ÀöÄUŽ0 0@û-ŽP•!‚×wy„¹é ƒÙÜG@Nh GËÏ®‹¦wQ +áÏsÎ^ËSî^ð’¬(zP铃Yà›)`ØIè‰Ý„êq³¹'Á”ô5Ö¹\&sb\ŽÕÝÆ õÎ)/ÂÜkïp¨é\šCÅPQc¾öˆ|Ž‰ñêQ¨9pz\Œù5ˆèC¡˜BÚaEêÒH(* 5Ë€Ê0Òºì¬ã.‡.‚ÓÐ3céÙò‚¾ŽÃÙA{Dho¯!¤*«R=-zÓ©’¨ÇÒ…ÑD:­¡ñ£¾VÁê"Z„4ðî—h;úö¡EŒõÔÌËǪ§µš£‡1•Ä˜'"ó„þlŒ¬0_÷¶<â7ŽEì‡_‡_Gë~)‚(9à3yíîó§ýÂsðUøëi}š?íÇ" ùëÃæ=ÿQPyÅÊØ:H½lÓ¡™csZJ…@¿ßu!ØÔà)álÎœEÕ|·Î“–³#þµ•«7Á‹ÍÆ•“äíwT’ny¼0h.ô8†Ý›ÖìðY¦s ¶1®¨ÄAÆi;¾nVÜ¿F‰¦ EªŒ¡U<ûŽ×¯YMÑõ(ŠY÷(¡dïL-5:§]¡•S- N[±Ë9¿AXÂÞvßRâÙá´iŽ<" „>Íj¿æˆÕ{æ +ÊV×T} $ãt[œÓ# + @X–Gøz“ÉÃt´ +,ד”B$Ï%˜oû2R†PGêCœC- ï´&‡.Å!øÒš à ìŽm„ÚOû7=hïâasë¨ñcGz³KûrÁPÝš³÷"ˆ#™¹Í·Ã3=NveÝ”`¦h†õj&[qQ‰Y¦\}àå‡ÐeyawEÒJV%|vYQŠb9‚o°Z&Ó· ×Й]õï™cÈGvüx'yÁkÞðSåÃêÌñrÃ×Ýr¯î_}ü£Àϯ‹»É«©=½Ü¤0‡£ù¨8‚`èT‚Ä\Ñ]ë†4ƒ“,&Ïöý2´Þ9Rs±Ûº§Eœî39·©ç)Âm¾dìÔC±8}¤Æ™„gTƒÄ•ŽBÑšŽkNÄ©jÇú4ÖöcÜ á9&k®´ìÄçU‹OfnäIUŒUÉ7ß½÷Cÿ üÈÑÙ% yRÈÀ5ÓôÌOÏ0=ÁäíÝË‹oæÈÎŽÑŽÍÍ][m¯\J‹'æx"w!F+øIOý}×UÞNþ­›»hrñÀt@j•Î!"ügŽþÔßz†?uZ$:GÕveÏ j@¥þ}~û¿ 1üããkendstream +endobj +5899 0 obj << /Type /Page -/Contents 2748 0 R -/Resources 2746 0 R +/Contents 5900 0 R +/Resources 5898 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2750 0 R +/Parent 5897 0 R >> endobj -2749 0 obj << -/D [2747 0 R /XYZ 85.039 781.388 null] +5901 0 obj << +/D [5899 0 R /XYZ 85.039 781.388 null] >> endobj -2746 0 obj << -/Font << /F62 1689 0 R /F70 2201 0 R /F18 2207 0 R /F35 1632 0 R /F15 1628 0 R >> -/XObject << /Im1 2193 0 R >> +5902 0 obj << +/D [5899 0 R /XYZ 85.039 189.755 null] +>> endobj +5903 0 obj << +/D [5899 0 R /XYZ 85.039 189.755 null] +>> endobj +5898 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2753 0 obj << -/Length 3836 +5906 0 obj << +/Length 788 /Filter /FlateDecode >> stream -xÚÍZYÛÈ~Ÿ_1ÐK¨Àâð>äÁ™µY¬½ŠGÆØì%Q#ÆÉåáÙAþ|êêfS¢ì< »««¯êꪯªåÞ:ðçÞ&¡íøémœ¸¶Ÿ$·»Ósû-ïo\ápnÛ‰BlúÛææî]äݺŽ:éíæ@,›ý¯Öýß߬7o?-W¾ï[n`/WqœX÷Ÿ×K×zdêúÓÃÇÍÃÇ÷X €èZŸ×Øüó§eâ[›åo›oÞnŒiWD>Îûûͯ¿9·{XÚ7Ží§Éí3”ÛMÓÛÓMúvøR/ooþ¡Gá¶à–{Íìnx‘íÅPð;I½M7œÙf_/¡C8n,ðë_Ž”}ÞrmŸwË•kO•j SVTÀ_¾àN_=ˆ­6ßåÄøué%VÎãfȶçrÅŒÆê˜Ðá(ŒMÖbó ›s˜[X¤Â\0"«ì”Ól‰õo ×Û -%ë¢TRÚR±‡&äŠ]kèhI8öÅ2µ8Ö¿ë-û¢/sáÝÕMÁ[–¦-°Í“VÝPŸ7Õ1)«pw»[y±UóþŠ-K‡ZzÚcÀrE:­£¢íR$ê’‚ÖƒÌôŒ³ÖC¹ŸÙà–f‚ž~²Á%v}V–ù)‰¿\r›ïÏÚumÈxSKÅß®>ÑÀ‰…ÃOL=e»¥Ó.Š -°ïzÖó1oeU}1. -ì -ª#ò,.µê¸ Uó¢® r)ïäE‘µ/h'"}bʨ²cGС²x¹¼ÍQ:‰”zÕ‡>¯¸XåZ»¡¦æ.ëLQäØp(ÒW­ ÜÞdj|æa¦/‰ô”Ûu¨Û|æP[:¦Š$û$¦P[‚À‚î8Ó>} Žö¯„N)¥Ú¶¨{‡åSÖ²ÙéÉJ=ñ8§U³ÊàJ^Î+1ê= ÚFßG·ò -ÁöÅø°­Àµ]°G3PG³„¶çDèxÐØ~™@(â@BÊBƒÉUFtÛ±Z1øX‚yx^ú¨üƒ-RãÉu×?îZ°ÿÜïÓ,}}uéž'ß\¸çÚ!ÂëM™øˆõÞW× -»ºHñ4z"WF¼ê—rH™šVàY+ƒe­Ò ºE±EFò‹èMd©åJçWÒYyœqÎ$©å^ªè›}½5ýòͽxÚGå› €5ödÜ¿ê›.*ö\ŒäÊ=60”]ÿA Ë©±ÿsE÷qªÙ~à»+ ±ÛÝ÷œ<€;8, 2xï1*¨ô/Ì1â-¨Ðdð×qÍëxh[j‘2 Z¢5;ÖD%`_pU è?ðEFµ W;ƒ8”y»KÀ&t‡0&ÓÔä›û¶.™ˆ†˜ -Úͧ„˜C ¾!Ɇ0M]¡YMÀ€ƒI}‘Úœ C.¿|1†£ûZ˜§1¶CȧlNrb< b[>#ô~‘R(õ?øñ¬âÀÕÆßLáJÆ}™j -@ë\–ÐÂ1®BÊ!uô¡cÛ$FèdJ’JrtäÇ^¨ÑWëÙÕ'AQsû­rYÂÀ#_ÙÃÙSûAŽs@Qé…AZ äÿðÈß_¨ÛžÝ³ÀÅÚ2Ë›¦‘}"õž~¦D>/Kñ$7qº)QŸ$UJ­7÷$…®ÓBý@Ì»š7±«rYØb@ŒK¹¿úÒâh¡ÛPE}/ž2X†Íè¯÷ÌL6.µa­ž;%–vÖ 2-;š ¡Òúþ'Y­âw­…Æ÷ô·AÁ´³E#Êë³ö)ï¹<=hÂÈáÔ¢È$sV}ÿùáx¼ÊÊú —ไµ¸JÞ&RµÓè„2 -®Cø±¹Vp¨á ÆŸÞ$n…Úv@ùôº#çØ@:[7«½¾ÊH-‹®N–Ðæ½ÕÐå­é%‹ Ú<ïúïøŠÀqÇ€+è0Ñ–A\X= b9žÄ>/\1,®)uãT23b 4,Ž+WÇ<î<1“ŽYëŽ7'·{ ßù¸¹ */È&lçq*Ãj³»Q^î[†9&FFü'&˜3”Æ,–u‚†{L.¦×Êk ìq†üõ–+[íixÓ0çLl8_ÛÑÅ(M®å«Våi‰µ[­‘ë(Ú mâ& -¹ú;¼¾»+k¬E%…â,Â×PŒ|÷®¹D¢w¬Üú>Ð’!¿ÈÊä^ÔU~y™÷&Ú¤€;!kµÙX 1o!óPd6¬Ô1%Ø£B 1sèPWiKZ`%SéY&bÇ–Q€´ì»wadàhؘí¦O”Ž*Ü*[¾_()ê=Aá+énêš -/ûÙ2¸Ã2âüjÜ€<"3æ¼\\âÙ¾/k+›c^rràr~dû^(œ$Yc2²ÂH`§©½ÏO -åq39Ü¡3x)0÷ÎBp¼¾‰ÞDtx îf?Ð}™Þ:²ŽÛy…‘õŸÚð‡X7±#Ð'SšŸ?>ü³~:†…dˆJØ Mk: -Z\Ê‹!òÕdR:n#ôGˈ4#1¬XàúçÃh/„]T¤„åªnOœ~xaÂ)ÏD3`³V¡3‚]}R6üHþuB ZàgBl3l7q?Ùf t…Q(U8\óÆÀ[Ë sPôj1=øþøvàã°Æp‹ã <þ?õÜÆꇉ ¬eB]´yV.¸<· _³`¾“rÎxÈtmè$y•J*Q‘ A˜ÈÚ¥™~%º ….h©S1èõüä,c„΢÷Ï ”#‡\ĹÓù¾tÄ¡6fe'¥½ŽÐtH€Êä¨E9Qê QrUso&LäbÂUÊÓ¨$MEZ¾º¢^W„ÒÇ$†'~Ÿ‡Þ’Ø™Ó$Îkx¾c©/Å1+_¢Mù5YñäY?´fʈ3;¥uœùw깎¥±'ºšOk œ‘¢óÈs°XQ¡{xIhm³N/Èd&áûþ«™¼/Pâ1á{b<%`…³†¤©¬]ŒNq8ô†'/r2éÜî¡nMåsh0ÔpBð¨6ÊØÍ&~Ä2¸íÅkW°‹Ó‚§¬ïF§„lìJNÌ4ɽ¬bpo(·|¤€þט¦ ÊÛ5óté¹­æ±®ªõµÀK?ÂeÉ$\BÌO9øÝ“·”ÛDv¨¥$±A':ˆ¬z|¥ôôŠ_êú#Ø<Ãèœ?}‘·º=·þÙxr{W”AÌ,¹@àådê Lëó²$ã¨|Œ¬&Ï1Dét¨Íõç#úà„òjg0F;¹Sû³Þ!«¯]"FÝ|'©. BjÅ |œÃÏg¶¦;È™Í˃«ââ)9(`(.–œY;iÜ'æ¹Ðqþ†øìÔ1çDpHн¾r«½’\ÉI›™ÈZ¤»²°9ÃN¦_r?œTðôäH3®$ž¶cjr—ð¡>’ŒâÔ&—vBɺ¹L×$ Áf[ÉÄaA¥ý±ÜÁ‰ÌvvÃ^]»„çfmÌÓLž®¸o œ¼¸zø¸&Ya>£zò||þ(Cï!Y׫òYD”Ùµoc&ÌCLã<ëÊ}ã8ôøa`¼žÏ 2¼ê$Lç·êûɹûa¢™ˆ…œ÷CBÆŸ99…gù½k ½E« ìiÄÿê -Füúf//L §DTÿbù]¸@Ò6\:!hýkŠ-¥ú6þž _Ê3{ «qÔôLJˤ=K,¬áM%À]œÅò±šÖåøÜÁ*ƯýøÌðzîç?¾kÏÿhÇ…ð. U=îÌS˜Öø|ØÐBéx>(6…Ƙ³ÏKtë=/`#äq$U}0=gEÈ?}Ñ8ÂûÞ‹ r0üñ|†M™¥-7>œºÓH­‘ٗ׺•ì€„:ã£lv2-ÊYÒüÂ)ê|}Yž?ôÈÅ.³^PJ§íµˆºÐ«j!,Ìaäãÿrõ‚wù½ÙÿÙ¹Sú¯“¯‘n4·@ ÉÝùOotöœˆ ¾€s[”¥B>X¿x6Ä¥ž²,UvQ¥é‘ÚJöÒø½˜Æw -.´´ˆ;fÂm69—É7±Ý8–ý7û04õs‰?±W¥fÞÑãõ ÄãÓ'•[ùõ'þ8 ªü!2@dó”ïÍß‹Äc6‚VøÈkðÍ5xN`ûžÊ]ÑKý™ž·]Woÿ»¿,ômŠgW(-Ziü9¥}̈Êm7ñ„…—ˆÝîÞE>دäÿñçÍÛ×srmGo™d¤â+p¶“L½ƒ—˜ÍUÝs™Ònñ K<ôR|äÒ¢åÌ óSÎ~ë«ŸC†rRÀÃfZ -{\¼ÅŘþæì%E$º2&¦÷ X¿·3¯&üc/#ĸ´,~àÙNêÝ®ÂØNCþW®ÿ«R|óç¦0Q䇦†]·)ir¾Pᙘ©ÿ_¥º¬endstream +xÚÅXß“š0~ç¯`æú€FBÈ ^ÏZ¯­g•k®7j¦H¼z½ÿ¾Aã‰âùc:Ž’ì·»_v“PÕŪ:²Õ¦²,Õ›+º:#æ3êù”º4çÆQŸ®MêÀÖmÕ™¬q001RÿQûø¹ÕwÚƒZ!¤Ôêͦ¥u{N»SƒÚ U³æ´o³ñ¯÷{ÑÛKßLm(šý¾ø½,§eÝi·×ÉD~v{7µzÚq[{rSØ\X#ì³SƒŸ•Ç']õ…swŠm©/¢­(†çŠ°`åï¡2T¾PÙ˜©fReü`dl¡m‚–‚† LÛT›XX7— ]ÕêØÀZ+ ³Æ€Lg1ÏÛØŸÀ©oBQ¦vع\YßR¬ßú–5<MÈ4anLh$ÏÇU­$žQL¼LtÙ7w#wÌE÷æ„tJ„,ÄM¬¹0ƒaÁsBXà焳FHÆ x #ñkcáÎG/$“ÈœîÆMÁJau¬—À~è[Kì$"0€™`Ì^GÂx> endobj -2754 0 obj << -/D [2752 0 R /XYZ 85.039 781.388 null] ->> endobj -650 0 obj << -/D [2752 0 R /XYZ 85.039 609.395 null] +/Parent 5897 0 R >> endobj -2755 0 obj << -/D [2752 0 R /XYZ 85.039 580.597 null] +5907 0 obj << +/D [5905 0 R /XYZ 85.039 781.388 null] >> endobj -2751 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F56 1642 0 R /F41 2104 0 R /F35 1632 0 R /F65 2099 0 R >> +5904 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2758 0 obj << -/Length 2415 +5910 0 obj << +/Length 2299 /Filter /FlateDecode >> stream -xÚ¥YoÛÈùÝ¿B]X -ˆhÃk>¤Ù+‹v«Æ -òÍÃH¤äÙðÐ’#{þù~×P”M;)Šáß}.ø.òÄâb‘å¡çùb×\‹Üüt -D°P~&xõ÷ÍÕõi´¿ŠÅfO ›ò£÷æç×ëÍï–«8Ž½PùËU–åÞ›÷ëeèÝðéúÝÛ_7oý w -Cïý¯ÿõn™ÇÞfùióËÕ› Û•òU#ß?®>~ -%ˆöËUàÇE¾¸‡uà‡E±h®Tû‰Še__Ý\ý{¤ÂwjÁX3Ú­T”úQ‹8ðó\ÍÁ„©§@c4 -gLð[f•H|•âc¢x•Lh†É ͪÕÛlTÑÒÜÛ-W¡‡{Sáª]F…g¾³~3†éZhUX–Ú - ¸oêiÞ¦=L¬—€ öf×›#[¦YöHä/‰qÿ -γ„7|Ü2ä¾ëyÑèÏ„ʼ_¡yб!:¥ ÷U_¤å(±º?T²>[¾e¾N+ÿ±¡W‰’)x1òÃpÎÞQnŽwâç AfàNù1 NÌ' „0Èè}0mÙ-ãлG¾o³,Àd}ÃâÁ¹®ùâ¦êïª~ù[67ð ÙZ.Ω>#'U­eÌǺ9ÑÁjyö’nQàg“L ©Í­"ÈN²deOGÞ6Z†›-|ÈÙQVxÝ^’½¾3¨3žqP_A˧Žø=2¡î(Q†ôˆÀŸB¬7U»ƒ(…X%©÷;c$!4Æaßmáÿš›Ï/¡|€› ^ÜLÃ+‘üAÙî N×6.k@¼ü›æ™ÎY®T¨¼¶ªJ^u{‹áŒKŸÄkå„XcO%k‚hB&ú+I6tÎ"F¼ÞpºôŸQ V×µã†{š%ý‰#-†@´·Ì2 -s-¤,w,é$©ò-cÝ-Á¬º¬ËN¸C-Ni †Åc¦Mj ÃÍä#á5ThÈeUK‚®”Š%ؘ—¦a׳¡*ˆHàÛŠ×är³“ˆ÷Ô"à’ÌC«ìpqËô»¾ÒL¶ä>cÆJh5Æ©¨ž+–2óÞ¶ŒNzhÒø±É²z e‡W#EújÁҖѸ‚+.ÆðíP8ñø®#ú•@Ü,Ž0,Æ϶®šW3ª 9uÙ˜Ö ¶×–dàã[Ê\Wž•Rg÷ ]o)² …R*òz¾±äÍä,Hd«ºîà=jà(<‰`_¸®ß’Ya·™R)àû%9ãB¤ µâÅ¡j¡Hìx³~ó¯t[2Â8Ó¼ð¸Dc˜IóZRxf©’ðD ”œu?‰š|6(˜mgËBÀ>©9PÌ¥£¡wƒ”&HF#à™æœ9ùÄÇ”‰Ê À¹7fœwGt¼éZ!-ŽÇÔ6µv5o¸O¸†Þxó!% I Õßítû­D1츣X':œÉ®~g6Bt0¤â‘dú“¦j‰û¾kD VHA9l1Òt_Š5ô¤ñ8µÐ#=F™Œ¹B“¾5õÙÈ —𲺣zÂ)‡švTÏKÞ•äþ¯¬2[ÆžgW`¹g˜ÇA×:TW[bšÀ‰F£sݽ†æB÷/$¦ôõ©¬ïê¢*-¨4©,ð^“^[g<•…˜$…kQ7.ÿ‰ÍÑ2òSP0 £c.üÞ€ë™+Þà%O7+ð¿Å\—ÇŽR²Ãw""d6i¸šQQR ˜,ÝXqz´ÜQ»¨"÷›–JPª2FKŽ3\- c(r5Üvh˳uC%ïàú\áGó‡Kï<<—¢ÑÂGnjឨMæ!öiQùÜŽ -C)JX¡(•urE¸âSne \âýN• ¢¼ºì€t*ãÕhGtMŒÝYøPaF@e«Ëˆ†k³çÛ³%p\ È£¶ -w2hŒÁþ4ñ8pœ›qP ™ÆïË2[€Ë 9°˜D«b!Q_ÔE49Rfó"$ï~Rvr([= -2¢D½\à…<ËbѬtàs,hO•ìΑ†ä“ØãIà -.Ψ˜v?Ïw&¬:IîM‰°uÅñ”Ћtwã½ÕÔŽ’XdÝ ÷‹DZµCç)Þë¾ms¡¦ðí‚1‘DâñþÊ@@óHÁI2£5½€\ý‹¾PâÝÛ5/öò*Àµ±27¾0ü"—¾ú]dúJ¤e&*Œ³÷¼§‰‚¾þ§µyÈ‹èArD žî"§©l†9]1Þ•÷ GÍ=ï~‰ik¨ÚßàE¤ë;Ý_Ç®«¯Ýlõ ζïî‡JoëK Ú¹GËñ´­ñ½ü¼)Ù=‡S5ˆôX¦¿hùûÞد”•ú‚?±ª"ýÀqÔw2?þOZOù}OýëœTÙ»çº|ë7Íkþ¼ý/ÊÞê+—,]‹Mü«Ü%bÔf°³Vÿ™9‹|ó ÿßeTä§P>VgbÏ÷½¢x,¨À\üUå¿?Š”wendstream -endobj -2757 0 obj << +xÚµYmoÛFþî_! ÷"šäòõ¾¹Ž“ºhŸ­ ôŠ`MÒQTù×ÿ¾ó¶$J2î®Ep_fgggžyvVqgüqgq`;*™E±k«8ž¥å…3[ÃÌû W$"²Éü¸º¸|ú3×±'™­ž=íj¶Ê~µ®ºº[ÝÜÏJ)Ësíù"Šbëv¹ºy?w­û«y¬¬ÕÍ[žÿåãû0ºÄžo=@óÓÝüûñžÄxøŽß.ßó’Ï·Ëç x;ÿmõóÅͪ·¹·ìKÐàß/~ýÍ™ep¸Ÿ/[%ñìÚŽíÂtyÛ¯¤¿½x¸øW¯Šçü¯:æŸ@Åv«©ƒT0rë%¶Ÿø³(pìÀñÉC?Tí&¯á AX:M«n×ÎXÕ¾-ªÞrï²kêËmñxÙäiWíËå?n®.÷ºüòµ~ 즲]tسpÑÜdª¾É›Tþ]ê÷ºiž«:ûŸõ“d[¿|y*ê¦ý‚úpÏËwîØ‹‹Ðö"pµrl@fVu ð¸•-€9öèÛªD öÐj~ªjæÔd`ó<÷"«Bù¬±iñÊx‡%ò<_øžoÕ9-luÝ′^p²êjžFÒÒ%jEghÔà’EDÒHZíÄ'®•¶rDši75h½á¾¨‡ÙA£ùûm‘ê–Rœônt{(Îîšž6Fô­I!å 8ö§o»9Q—6?a0O0nàrݳ×È B¨ó`Ò·•IºÀÍ›…nl{ ›7GwXk]W»tÛ5)8æ déY™)ò @?ñ#²a…¨ö|Š8lŽH$pS+ã©æ¥i)xåvDÃæùôEI×P#!lÌ,5ATzyý wHÇcÏE›âÞÙåQÞ­×ÁµÅWKк[Œy; ³´=LTìZ ÷™Y'«Ço0ñ#Eô~O¡ ‡T±g}À0i”[œÝˆ–çïñú¾ævª·Û†›ÊØòžBtyo%§`.—­;YD }Nc^ »gù‘k©¡Sèr›s>Cø¡ÅlÔæëÚäˆÿqòÜQpþ3ecÆö‘ÂÈZ®x.ë‰E3.h´3Tž×b@%3š?Ÿ–·ÿæà†8?/í#§!ä)Bf’Å©å¡‚X,¢» ºëÚЇ~ìR‰º +%»謤3l .?õ!‚MÒª­ÄȨm!Î*vkQß²øƒyDÎ9=ƒKyäFä–p¿‰>‘ï×Sxx%ÍïAä4ÅN`«(6õS–QtPY7u]ÍÜHÍ)kDÍYs™ÓtãCñèxœ¢ˆ7/zÙÉ=è…œ7 ·5Ò]É×,fqΆIÆ6 +af¥¡­–ÑOàT°B ‹‚E; C™F—.#SZ–©ómÎ×d.f1Dj.-q_¾w°Å™,Ö{,†.äó”^rœŠ”“U)÷¹“03»¶ q¦:šÇ,öÏïÖ; +ðD˜‘YŒ„8dþA)Ûaöš¤~‹&;âM§ÎoÈ"Óý ¢x`ûM tF|ßÔE]çL{Ûž¡Ð›Žf€§bÛ_&ä`ªŒ|CÐø…)õþW^F¢K×¼qÈ5šs{G›bè$€=„Ûúi÷$H_Ô5 ] í¦/~”‡åÛ‚(¢G«Ë·|+S¬H8Ö€:ÆX@TS´ÏK_qç¥\¨H ž°Í—oÝê¢÷¬æ#Uð¤zÜæ6¹c½›Ç>ºíÈéºsË7‘µµÔ¡~Lùß`Hc|êéw17øRR˜\±ìÑÿ;&FQ笌"‡kþÀ 1¡©àŒåö‹ýA +X*Áiò¿ +¬I>|û‹j?‹$>~b©#­‡!h®õ­HGÃ}¹Õö5fØÆ"c;.pðªÀ ЗQ|®뢾ê]MÁ1Hi D Ú18hµ)æ"Â×&Š>²Ó„¶úfhm%‘Â%) %Õ  EÅòáAÌ)¡}‡ÐºúÀµÇp6ö8R¥ýknrÅlÉK²ªnìSD©ÂÄ}už(GB§‰Ò½B”g7¢œìwŒ(Çûq.¹Žhx€oÈhRÝ)àU*K ûV¤™dbãFhÑ#Uf ù•rE˜‰ËÖU].K®5¹è}9UùPÜgùˆÀv²Ÿu ¡&49BQVg#îébÇ3Ï®n%B.Nw䎅ÔÚftT²’Nþ®ùù¹—aMF4¹ØEû=ÒÓüÈi¦¿À7¶nÁU^àA`жîô èÊÊÐŘÞÄÝV`(ðËõI:©XHõp0è‘ÌdÖð8½¿P‘üÞ0(7é‚#…ÌL´L9¤xš¾šñmmîVEÏ|b$¸OD‹¬:áB‡oàÒ<ÔðA>L§=—Ôýš!5>Ôæ,JùŠŒÊN§»Øðy%Ý¡3é.B¯¥û¹ Mº¿ßÑtíw=©\éÊv’!&Ð>ñŒWNŒT«ˆj±SVDèýë×f<†îÅ.g<ê×_Ís z\ži@O§ŒÔ®/¦að †0vQeðuqŒÜ¥v§¾æ_x4¯ÍX[”„ww(š¶.Ò¡â÷Gêsl•š3–:£¼ë¯±|Ç]®¨[Þ…~2ÃÆgNfóCX¿R'~Ç|òæÈy(…A¼ùb$äw-?E÷H–T&[$›ðú{ÍívÎ?/B3—JIÑ©—¤rlïèEð—íü¿þç ÿùÊŽÕ‰_›ϳ=×ØBÑÄûÞ^ó? ƒÿF3 endstream +endobj +5909 0 obj << /Type /Page -/Contents 2758 0 R -/Resources 2756 0 R +/Contents 5910 0 R +/Resources 5908 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2750 0 R +/Parent 5897 0 R >> endobj -2759 0 obj << -/D [2757 0 R /XYZ 85.039 781.388 null] +5911 0 obj << +/D [5909 0 R /XYZ 85.039 781.388 null] >> endobj -654 0 obj << -/D [2757 0 R /XYZ 85.039 718.394 null] +2018 0 obj << +/D [5909 0 R /XYZ 85.039 634.11 null] >> endobj -2760 0 obj << -/D [2757 0 R /XYZ 85.039 688.193 null] +5912 0 obj << +/D [5909 0 R /XYZ 85.039 607.496 null] >> endobj -658 0 obj << -/D [2757 0 R /XYZ 85.039 442.883 null] +2022 0 obj << +/D [5909 0 R /XYZ 85.039 523.31 null] >> endobj -2761 0 obj << -/D [2757 0 R /XYZ 85.039 413.479 null] +5913 0 obj << +/D [5909 0 R /XYZ 85.039 494.575 null] >> endobj -2756 0 obj << -/Font << /F62 1689 0 R /F41 2104 0 R /F15 1628 0 R /F20 1617 0 R /F56 1642 0 R /F35 1632 0 R >> +5908 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2764 0 obj << -/Length 2971 +5916 0 obj << +/Length 2735 /Filter /FlateDecode >> stream -xÚÕZÛr›J}÷W¨ò2¨Ê´ in™§8¾f[cÉs©3çKXæ(²ÿ~ö¥…=™:s¦Re5ÝM_×^{íMÜ‘ÿÜQä Ç‹Gaä -/ŠF‹õ‘3ZAËÅ‘«{8#%œÀǦ“ùÑä<#×±æÔe¾üÅú|ùi:?»ÛžçY®c; #ëóýtìZ3®Þ]Ý̯n.ðIA¥kÝO±ùönyÖ|üëüËÑÙ¼3­­„ -<œ÷ûÑ/¿:£%,íË‘#¼8í ì7ŽGë#å{ÂWž~ÎfGmGá65â·vg+×ìÉöEªÝ¦ëló|)«¬` ®oåÙ"Û®UÀ&j,dXZqc•&TWêVÏ ¬æ Ê)—‹tÍiM½’ê«•õ/ÇUyªû—-á¡|Û2â¡|k:†rY74Ò¢Ê6Уá¦eåìǘ;»–^ù")¸€‹+u_3&ÜÃÈÖ[·]<¾˜ö¾ÌÌ>õa‹óаKA…Ö.ƒR‰j3³_žªgÉ—òàcÄ ÕŸ± CEpÍ?å–Š´;ISòˡÚy™˜–vº5wy¡ƒÙVfÝiþÈ PS•kÚªÓÛd{EááQ‡¾µkOò¡½ô&…EûAlÝâiò­rïô¹©’E“.á9‚c¯èÕ¤ÙÏ‘à&ç^lR:"•†Ü²Ê~¤UÍýz TJ¸‘é…—S1¦šwüÂkÈð¦CÓ‹›œqÕ2i¾m(ùŠOÂgÀ8„úÎÖl Iž¿ ì"Š…zy“m]MꧤJ'‹í¦ž ì&vEp˜Ä…S ”c}.7xè4{¤·Ëx}9´2WAeN‡\s]»RÜN±âJ‚Úô þÜ%Àï’Ñ™>¡tÝ(È( ¶ð’Æd»ø÷˜Ù`‰¿ ¬f’>DhHjîýXæ8p‰ËØÕŽÑSÀN°S,ߣå|:=¿½™ÏÄ×ó¯]ûºñöäl:Sâôîoøn›/¯§o7ûâôúúíæûÿÔ<<øéÙùôn~'Åtzz¸ð«Ï·7×W'fèWè°¥'"´s÷5s œ¥òbK¥âÖ„±î ovÊõÓŠ0€`j¸uJ4À­LÖDxØ-©ô0Iµ2yÈu©Ñ¯fEÝ€ôgT\óaƈQ‘ø°ê´Òœ\ÕÞäÛM²À>ßÆ>ÐÄ*eà<g¾Æ2þ¶Ú€1„àtWÍÆзÐØÜÐ~Z(¯Åk§ 4œÎPú±þ Ç”¡! üfäÊÖ_Jh¬ª ë/¡&Dv„=ψÑA‘w ´w ÀüîñŽfü`ØŽ&ÜàR,Ô¬Î+ -Þ[&iï»u`nÛ—!³‹‡ž1LÒª0gÕpƒv)Üì:Ñï"I`ï%w,Ø=ñÃ:)4‡á]]¹­“B÷Õ2É&9tÊu=ΩMïð­¶Ã¤†Ûªƒ[”ÄSxíI‘±•ç´#7Ú3k‚DÊ=F`+òØs­÷ÇKÇš‚| •ä\‘'ÅŠœÀŠJ#øV½ÅI7ÄÎÄ{M†äÛZƒò é)Ñó¹Âq®$aRØ›2jgÖQ:€m–&\šsÉÍÞÄ€¸ô¥o9n”‹î×`F¹˜c _ëG9Cƒb“oš°¢Zé–»‹wi ¥Ñ"XfŠ¼…ª 1ñD`mð4>N&»ny— s IýB§°ˆÉ¦Cƒ¼†r‚Wÿz+R…ÂõüáÍ«°s@ƒKÇ•i®Ója€šäè1Ý,/ÙÆz’Õ˪2r¢ãL¨ra„[Êž³pÉ!DþÈŽ!÷A­o³‘Þà«QÝH¨0úïiù"[oŒµ´»ìëJ ­ßÌù-œ.c#l6ÀØd<­«¶M¡3¨`yJᤳÑ*EÚ x·”ù{ò§üwr}Ì+ßÓ´çDåcck†Ž¥p¢°g[{mh]F±ÅN)îïÍEÆ(²iHØÍ•׳*ÒpM .´Ô­H ²À7Š4© ¥²çè·i¶VÎ!ÁK#ûÊ_èfJŠ¡Ä€ÑÐ$ÞøIYß‘ø“<3aƒ¶-&ü ýÕºª#î£V¢õ©6Å$'Ǹâ°U‹¶Ý}ùMÒ:Ƈ’‰‰qï>Tûn ö8²U,Wýѵy!2í&û/c[1ª!’B;Ñtß芡ÅÉ°õ8\}øÖúƒ ú뙑ڨÒb#i™}/Ä5Zãj«"¤l&¸•¾„n:ZÈ•B”]t²é¬žò—>#Tj­Ð™‡5[Y-$IÚÃáÌãXÓg漓ÙñAàžÑ¢&!lWQˆ L.ùŒ´Û¯°ERz}LAýdBbz·#ãs¥” ]·xj㮲­6Ü"4/ýF6>)YENò–ªð8Ÿ'š)É‹¤‹Fw^Ù d!b†ˆæ Å.…’þÏ@öÙäâšUžíq¼ÔºpÕZ3e"à7á -9Éé½JaÄ -‚áeʽÚÄž‡*–Ä·ÜGÎX½Ð9t퓬h“ìÐÚæ ;Z­eÖ›XâHçPà9þÐW`´nRbÚ™ƒ°Í ÓCkmP¦NOi•5I/ Mœðp«\¸E~˜HnýKÁn‘¶îZ—í)@Çn ݪ6L¡`IzÇg]w@eÜ‚ït²î\9|šž¾\üÕ\ðÏ í­Ilþ(Ð樒¦“nâ´@ʇŠxðBq(\ùÝ©I:S26†ô=:g“b•\ÈÞ•±>䮋Éú3Ñ·Iý Ç‘e\׌Klã'&þûlŽë¯°)DÈæ÷£$îÔ:ÍÙ:¨/¦p‘{'Ÿûqýî…¹¿ci°økYpöâ :òMd© ¯ú¹*W¸‚beCî{?A+J[SD”å2é@cr°ìüŽsUÉ!0á«ŠS1øCÆãÇâÌp¼ÝÁ·‰Lñb¤&™˜©LNvÄË­ûý»Û[øïïÊcŠ¿jv·KèTåã­¤*ôcCÑòóÇOŸï–·_î~ÿ¾ôï~¿;½®²žéž PgßÒÑ,&DgS_ƒgÓqäG¡–(ªÀ¨Ëx¿îŒÈ¡cKŽç¬pç8æ"€”‘pá[÷j¸ú¿ï8@š=ÕwkF?œdew›ßð ËZ±³áãðœ7§ZÛEdg«µÔ¥4hSÆÉPCeEùL%3ëV*3øñÚià.”fgBŽncÏãnémÔ‘ñU ÿª:NÈ/ë£#ú?)äòÛ¯_¿~>¯“؆‰i ðžºàrhCè>Ûäj`†ûéà„‘È­J” #Í™0òCÑ=õ˜G\(»ræq>€ÔxLz½4¡¹\R`ƒ‰vI +㜥Šn¨NwÌsÁàI”wh+…׆³ÖòÑ9@¹† žoŽ‹rNwžPQ8¶›Ú´8ÈÓ\¼Ämc:R»Ú¬Þœ«H†aÒˆÔ¾- +þè·4uØlñ;ôVM×c]ÃP]ÿÐ0!žG¹U[àj¤ÃqtOa÷_(S<ðGƒU4ÜÎÞ²á‹QrÀeŒÎq"!#ôw+I OôUQ(üúvTû`\#‰@2F-–¦ +7ÄáÕÑVÍI¡}Ä)à;†ØôSÍÄ\‰~‘}(Ïé +Œ¼íäÒ8÷\V÷†ð‘RKäªá6o3)™à—¬nùk,¦Ô¯+3«: k;)KÐç²ü¡ˆ^º™RÔùP'î]ØxR"É5mŒyfd¿®ÕFåýq¦du)ƒU+qz=ƒÐ Уü%31iR)ñ2ô(OÉ@€?¢ÊRPŠ$ÜáÏ<„DkJ`É^`öKsŸ­¶e]t¸Íϯ„ãÑÈ^¯¡Oh®Rø&¶£¿7 ;«¦ªX/J¬A IÅquÇø“Ž—í9+€Ô!çÉ-©ë,ú'55¿^¹ân[AºÅ3dð0ò~ßrÇð¸6ï€Þ˜wapÆJA|‡ÅÆ©§ƒ!IÀ°z"“…vßNS3)}ön -(¦œ‹Ún(YmXã-±Œˆ;y9ä…²nÝH1×&ÄŸÀ§b[¡ßK¶¼.#Ûb„ƒkò¢Iwü³W²/ÖÙ)8²¢úo[r¨²zá±Vê=c=ø@ÝŒl¯Tð/Éš£*Zñìr&$媚†¥¢‰ž†rQÎdc±®šV`ê¹ì·Üëø~ÂÄŠ­`wT—;[&æ**2•_²mn:µ‹62P¾¶ áÁ)ÉfdÝ©9=2vÌåÿ ήTcendstream +endobj +5915 0 obj << /Type /Page -/Contents 2764 0 R -/Resources 2762 0 R +/Contents 5916 0 R +/Resources 5914 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2750 0 R -/Annots [ 2767 0 R 2768 0 R 2769 0 R 2770 0 R 2771 0 R 2772 0 R ] +/Parent 5897 0 R +/Annots [ 5920 0 R 5921 0 R 5922 0 R 5923 0 R ] >> endobj -2767 0 obj << +5920 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 394.756 387.717 407.658] -/Subtype/Link/A<> +/Rect [327.043 300.33 512.306 312.322] +/Subtype/Link/A<> >> endobj -2768 0 obj << +5921 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [157.067 304.494 429.341 317.396] -/Subtype/Link/A<> +/Rect [111.316 288.296 216.398 298.773] +/Subtype/Link/A<> >> endobj -2769 0 obj << +5922 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 254.88 347.128 267.782] -/Subtype/Link/A<> +/Rect [327.043 259.682 512.306 271.674] +/Subtype/Link/A<> >> endobj -2770 0 obj << +5923 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 218.816 508.187 231.717] -/Subtype/Link/A<> +/Rect [111.316 247.648 233.58 258.125] +/Subtype/Link/A<> >> endobj -2771 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 155.652 336.156 168.554] -/Subtype/Link/A<> +5917 0 obj << +/D [5915 0 R /XYZ 85.039 781.388 null] >> endobj -2772 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 119.588 400.551 132.489] -/Subtype/Link/A<> +2026 0 obj << +/D [5915 0 R /XYZ 85.039 761.463 null] >> endobj -2765 0 obj << -/D [2763 0 R /XYZ 85.039 781.388 null] +3024 0 obj << +/D [5915 0 R /XYZ 85.039 667.044 null] >> endobj -662 0 obj << -/D [2763 0 R /XYZ 85.039 491.246 null] +2030 0 obj << +/D [5915 0 R /XYZ 85.039 611.854 null] >> endobj -2766 0 obj << -/D [2763 0 R /XYZ 85.039 461.045 null] +5918 0 obj << +/D [5915 0 R /XYZ 85.039 585.239 null] >> endobj -2762 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F20 1617 0 R /F41 2104 0 R /F65 2099 0 R >> -/ProcSet [ /PDF /Text ] +2034 0 obj << +/D [5915 0 R /XYZ 85.039 458.285 null] >> endobj -2775 0 obj << -/Length 2593 -/Filter /FlateDecode ->> -stream -xÚÝY[oÛF~÷¯²]˜*ŠwR]äÁIÇk«–„pŒ`DÒ×É’”Uwÿ|ÏeÓNƒÅ¾,‚Ds9snóË0æÀ€?æ puÞ üÀÔí „›#c°‚³#S(Œ£ž‹[ïæGãž50 }bLó;"™G7ÚûO'ÓùéõpdÛ¶f:úpäûö~1šÚŒW§×ç—óóË3œ9°hj‹)n_][›oçŸNç±#Gw<åþ~tsk "Píó‘¡Û“`°ƒ±¡›“É`s丶î:¶ÌÓ£ÙÑ/-Þs|ªÇº‘cyºåÃÀ6ô pZ3M·ÏÌÅ?Ž€±–­@Ûe<)`½ŽL­ÎK*Ç%ïN‡ÖDËy 9„8Bº¤¨™âúñÅpMž#ü­×qBL,-ÉPȶþ¦Å<¶°RTùǪN˜µã:Ú›{äe¨KQ½i™¡ŸÑ¹&:fBVMÑŽ¼ªga™ „š/,ɪ$Šùºä&äåpdùZŒ2ï`9/… -l¨C¶Ê(~HTW¼Ÿç:ç¹ÊxÿŽ"MSÞ8ƒñ4"‡=ÕjÔcBU«4ûóŒ€Ý=AÕ5¯¢ˆç;ž£“#ó ké’“hæð}°®Vhຌ ‡Ø4`©BܺV$†J‰göa!|8€ yÖ`äà¾\²õ í,UO€dJ8à¨/†é ›„(ñ éÁÃÓ±µÿ0!šŽ²Uen&wÈÑ…S‡?.²Žx Ž'œ‡Š@¥)ïáÍ•(IÄ:8``ÝêƒÄeÏ’ªˆ³íX EÌ×¼Œa"FB -`A­T’1ARÀ SÅ?Õ#pG6£Ví†äŒÐwèÜ='[ Eºëi¥Ú›ˆ¸>aM‡ 1âᛎ3J>Í E¿añÝù¶xÏèpðÜ«kºþùï÷ñzGq¦–H”d+^í°ç5h„ö9 ƒn>òB›Óƒ m³!„4Èèeœ¸—(Ù™$x•Qu¹¸Ï.<ÈåäÉGŒ¥ Ùí܃S¥½§f9ÈyniÈI´hÕGÛž¥ÎežùbbRZb®P­ˆ %Š8*À'É>èÓ} -)1Yz]°Û%B(3Ëk°C(òV¢ç*„Û¶åH„áó¼¡ -FÎPkNKùÿ®¶º¸Õ“LólÕIm.¦fÚ”·Ê˜ :W¯KNŠ\»VëF˜xÛö:ˆn㯵پèCMMí, fUF¼sЕìЧ‚ãÀÑt]'ÆRú»Ü¯:9@åÃÌH[œxÄG¼¢ø§ë¼òíÊI8=¨ ¸°Ã(¡‘‰×…kdʦzxã,ÚçyÚßÄõš3ըǦœ -`Äȱ}‚«Ñ^ÌÓBáî†2©oh0v)â60´î]‹ê%ŸX¶`W10x=—”w7£–E.Ý´vÇk]QtkCHG-ÓýæÙâ¼!»äO€A…A‰º;ÁþmÇÕB ¶M,Qùt½N3hžî»i !ð*òQTm†P—|â }ô Ýjè©÷mUVÔ=9M¼9‡ñÆåÏ…ê©x0SÜX*½O5×ÕË騆¢WTƒ °tÇ·»‰¢(¬ßacähQyØ•MÓÅq»ï‹í.—MI¯Ü/Ö\$¿„iÒIÀ^ë4WQÛ(¢©‰ìÖ–”*EÛöAÄ*ÔL¿Ýe ÊeËSB˜³2*}8)©`úOÄ4ʦãÉ>²‘¨Z«ÖúÓg ¨Ï p·eøºá»}o’†Ä4õÀòÛ‰{¦>ÁKÚ¿Hà­åë ÍÄ -ãÇï}³|Y¸n[Ϋ¢½#¹÷-4_÷‡eêVð¡áMtÃô›ŒÊ.# î Ì‹Ñg¡å2qœÅm/Û$;$o(G|Ì'ãdÑ –ãtHû+•™ˆ_7²Â¦‹OäF”¤:ÁÐö_z‹0‹‰K°/Ñ:œŠbˆà‘”·)'}ÄW\@øE¼ÐÖ-œDªV2BÅ¥ ðÛS`¦Á_Iq%Ïnº°ýá–»ÉHÞ9œD$DLë¨VRײ¿ÛÃg®©M?p·ÂÝjÅ%&ÄW ÜnJHÁ¨^'R~<»?¤¼}SÄ姠ˋx©ñ,AËîBË-¶ÆqŽ‘㢈ƽ™PèZŠœcú¦à6„P^“È~"œfž]›Î–y^ÿ6:a 1  «ü‹4—$"±èJHÓ|Gï" -í$“ è>d¸Œc‰Ú] ¿&5T’jðÛ>÷”é£hA2FÖ$—²F qhŒIðí÷ð¹Î²žãã’ñh IîyÈ^o³¬ujÈq=ØE€ð[æchسú‹i;?ˆÅ—åǨí?%KÊb(¹ss%bÓ¯¶õ[àý«Øò'Ó×ÍÀê†ÚøA•ãªÈó”kX½)Æv™aèy¶ï…F—Ïøпútú¡e}hîx[[èWcf ýdÓqéɇ«w§Ó™«¸¸8ÖÝ 1ìž8 õ©ûòC¦‹ïdúébÚ§mKœv|+2´ ˆàáEªÂ¦êo!(MÿêŽ+aªªnÖmèw]ÙÈ6ªº Sþ:†nô|…yUØÄ®j¨›Ò:/Ƀ¿FG_è#_Ý2Œ'òöëß)îC¾QIööf¾ømty:¿å³W³·7‹,ùC¦³¸„‹{{Ù¥„$Ø¥Û -%Z†cy\7|¨n{$\οÎæ'óÅìëջϧïç_/O~>ýúþêââ|v~%¡·Q÷m—ñ&¯Åæ[eh“yŠAËXéû½­ë–É]’ -‹¿‹ÐÿR,›§‹€½Ìž@µ Ÿš¾=qtî—ãŠÿ/¢Ù†,_Ò7F\@Z¸’'´Œ÷ŽüoØõztu"ŸMë}Y:¡ûæ ÿ‘(:üwÿ£gc·ö¼úD5 ó©¢jÛÃ$ÿ·|X endstream -endobj -2774 0 obj << -/Type /Page -/Contents 2775 0 R -/Resources 2773 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2750 0 R +5919 0 obj << +/D [5915 0 R /XYZ 85.039 431.67 null] >> endobj -2776 0 obj << -/D [2774 0 R /XYZ 85.039 781.388 null] +2038 0 obj << +/D [5915 0 R /XYZ 85.039 232.205 null] >> endobj -666 0 obj << -/D [2774 0 R /XYZ 85.039 543.429 null] +5924 0 obj << +/D [5915 0 R /XYZ 85.039 201.589 null] >> endobj -2777 0 obj << -/D [2774 0 R /XYZ 85.039 522.232 null] +2042 0 obj << +/D [5915 0 R /XYZ 85.039 132.795 null] +>> endobj +5925 0 obj << +/D [5915 0 R /XYZ 85.039 111.599 null] >> endobj -2773 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R /F20 1617 0 R /F35 1632 0 R >> +5914 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2780 0 obj << -/Length 1210 +5928 0 obj << +/Length 3553 /Filter /FlateDecode >> stream -xÚµXmoâ8þίˆª;¤Åñ[‡ÚBw©hàH¸®Ô­ª4¤]T\º»ÿþœ8„@x ]*„bí™yfÆ3“ ŠR¸ 1#@8W\¿•±ò¥‚ÒP¡2-^º´+ê5à -‚À€†b?'[ìÑ}õêëEßnjuBHQP«ë:¯^ û5Tµ$µ?è˜vÇüϨ ¢ê°/÷5NªvíÁ¾©´íœØ:”‘Xî•û¨Œ„j7ˆÁ•Ÿb 2 ůP’t>©X•2.r*òÔtub †‹œÓ &ѶÀüŽ½#øgêE«wÙî[hu»µº†µêw¨A¹®* ¯Oj(ˆhµì¼yóâIÌ€{…”:B€jTêxú<‹<÷±ca(°õû­Œ5Ì;p·§®{¦mÛëÛ<Ûy“ßRËý®§ 5øwãŠþ^–YXl°ô#Y¶Ú×ý=À±Áò,óô#Yv®zf·s¹ºŽ’cŽ|œgúÖmÏÜä–?ŸïL?Îhää!ª^ðì¸éõÏ›"Q"ÿÅ1I|r0ZÒ XK¦¾¾6Å$ -E,šc¿4 ¶ Ž—×2—[Ø%Pü¨Ç|†pCÞŠ~¤¸ÖÌwÆÓæ½=üV7Ûöƒ<Û³š÷ÃéøW:µ¼@ø¬yo9þ“#I N,CŠ™¸šû>l‘`Ú–}a­ÇÞåMûÊ~4/nÛW½n·cuzizñ×,Wž/´â¹Ñ,øfÄ8™Æ‘RŒ³])¼\¶9¿wä¢UšµFTo­T÷bÀ?ªÚn$¼2È -‡’aŠ+Ù@p„ñ¡ D.ånÁ¤ mJ01&îyIL”é Œ©lQ¨kŽ½sYP˜ãôD ŠU§ ¨â©¤+¤äuBØ ôpóú®F¯PôÊ*Jœd`ÌJv®ˆ fZÂ9i£î–´q$Ãc…Vt,öêÛVãPÛÌÝ|Ûš5­û;Õž—â5xYï* -®´œŸÝ§£ÙÏPÎL[>qv¶¥¶­×„FþU¬Q¬üKMCš@:ækLó¯ s(v.î’ÁÙî®ÈõÓ¦¡™úõ(Tyûh'BË‚J1]Ô’HêÚÊ¡Y—Ÿ¾Ó,\× ÃçÅdò{¹+ŒœÉÄ¥>åÞŽNfÚQ&Ò×Ñ•Ô´m>HÌz ª’ÚÑÈntâ©D® ø”ÏÉŸrùìT˜–ô}w¥¦]Ø÷aÜ’%ï*$'Íüצ:MaJ]Ç¢™Gtû‡°ÆŸ}‘"q¸f&Y~nBÛ>7!ˆ7ï„Q1Ì)ø?»¢-¬endstream -endobj -2779 0 obj << +xÚ¥ksÛÆñ»~«/¦fDo€éL3Še'JbÕ•ÕX$ âDbàÍôÏw_wøp§ÓñX÷ÚÛÛÛÛ7èM\øçMÒÈqƒù$I='HÓÉ¢:s'KXùþ̈™€Ì0ß=œ]½Ã‰ç:sw>yxîñDN“‡ü×éÛ®?>¼»¿˜A0õ}çb–$éôúæÂO§¿\xž7½¾{ûîÂ›Þ H8½ÃþÃg\þûýO<÷á¡®qîûw8xw÷pñûÃgï,öh fŽÔýqöëïî$‡›üxæ:Á2l]¾¾î':ß0Å ¤ãÌxØ29dq¼¦K ‰@âPféWG¬D…°!RŠÒžK×5ÆIb> £AFÄî:Ö3ø³ä@m‡Ó ÁTeă ^…ó«^‡–aZÅòÔÑ;ò ÷ÅV7ð}|öÀˆc-wÁ)óRm¿åq&ó¾;vþÍá0nÞÒ= ÐŽ{9Ø.èd"§ +ƒÚ^ ö¶›sº%Cƒ‚¼)KÁ0 0òÔVÎD­9d[€n1ˆc‘ÄjÝX™¢£ +]ó:IDbS Ö å½õ}?d‚·ÈS-˜Ñï#øm—ðÀÄ%{Ê=v¤,HXê,W¹l¶¦DT ñv'ͲHoè`kÑქæYÏy ó€vSáß'äkV”¼ÒKã«Õ ž‚4–ËDÓŸ0Å{Ç})]ÿ±1À¸_7¼¸],µ‚› îÚÚ^CÄì‡2TT•å1†0$.Ðôc¨šÛóJoØÚÌôÐ.1%礆 êï/ÒP‚‹_…“ìwÆHàßܺ#xäGÇn;TS¼§Ðp+Ë]ÖP¨…ƒŒ›¡Ç˜¹%å-AË,£-«ÄÈt»˜˜XîâÓFG"Ìg‘œ•_)ò)ÄÅ}cqD>€H<  jÞ<Ð +Ɉâë¾GH¸5°ð,bð çóØþ£æ§ _±D‚‚”°xá4«¸e¿A¹ðr¡´Š‡³ ¢p7ð¢éj(pŠá8;Á^eüôÛ…n€£Ä–qà%‘kÎÅëÂK²YÄg—¼s?£I2=ðLC-ÆùGGˆë¸-Z>iä©Õó9k;eÃ&3q““·—$nÊš@Öæ’.ý2X<àï(N³©Œ:O3ÀSÖ=Ó-¾æC/†85Ï,1¸ÂçR¤^9Ï ´Ú<[è¥}Š†0<କ#Žäpê‘A2±õ®¹í%;Ù“ìDØ ⋽Ø%[ŠÌÐFB/ýìTÅÜj^ õþ|>=_€”à•ÞàM߬û(GaR æ‘Å{øÔØ¢c»56¿Î‰÷>EY¸B>ƒxW›Špó:Jìõ0_HË‚ 1\ÑìV}@9–ÏúÏ¢D{šIŽ¼âAR—"G¨:d¯Ðî†!8 ™, ä—x]˃Œ¬¦‘[Õta.% È5±c9ˆæ´Ø˜_ s £¿ùZØ溽0-4ip¥ð݉š!ÀouÜË ±ä`Ÿ‹`„q’ݹ2³c(Ž'´¹à`Δ…°o[ë:Ÿp>´9§c4›co:aÑ^À‹cÇü œçsÿ¿, ôl~¤|½‡Ó,ŽÕ%¿9ÈÊY¯ÖûÔA\ê¤i<¦n¯Ha`h)ö1 Š~ì:q<.Rühý­4™JÔScÄÌ3$wh€R±TJä ÓD2ã ¥f)K‹²*[ýÜ[[ÒœE—¬7Š1X–pº? ý1Ê .±êO?!éŸðcÈå)su£ž +ò.¦Ú„©‰î¬½i%ýÓFæäj×#NЋUÇp`˺U!gFŒ *(ˆØPhˆxñ>úÜñ~›ˆ)!‚4Ú–“þüˆ¡²å„‚4<â–Üñl|‡À%f]†¶? +%ÊØ,WÄCš²‡­Wž`Ûè~>˜ÍÄì.ë¾hÉÜ°''£ÖÈ›/²•Ëìœd)Žó}ibÖ¥ o—8佫ý¤ž×l…ªêƒ”ÓÅ/_8¸À‘ùº4õˆ+ÝØÒ‡“áDðÇ{á/ÎI¬L¥v„îËA~ääŠÎÚ`˜$Qõ•¤XdçR–F2ß–Ç"zÊtRØ>çÔšEÙŠÐæüÁ!˜Â#6Ô(3î\”äËî±¹/~îˆqCJÇCº3´t=ÜxÄ¡ã|i_ˆTJÎýGT0-ª²¯oæO{Ìä$"ñM&`îXF©OYJV·kÐ~TIq‘¬Ef-O°,JÊ&î~¬˜pL»©yUK;ÎLyŽÒžÄ=šA×?Õ¦¯9tŠk^’úÅÑÀ¾ÅœÑâJ&Ú¬’I´V(È6Å!ÂÓ‚2 Ôtœ¢¯<˜MÁ¬h—g=ÙÛq›-+Ç°RGãÏ;¸nuŠi;UªÅ/xlÕÅsdF)q8®i“ìî| €.V=[ +†‘!è˜Âe"Úg¼GY¶œ•(U .ʧsAõÌêƒ]ÆÔšÐP7‚Gr4XPˆßcÃâö•”#¥ÉŽ +YòÐFV1 à +(F¯²/#F ÷;n÷…ÄA-#°ïJ!£YâB'Z÷Ž[¨€}Î +Ã@jË´Üãë¿Œ&˸Æ$à1$ÕÐY k2B§ÿìjMÖcYH‘öD´À‘y4ȼJ•õR%S²¨9=,€õ¦>~ÿú?sŸéŠ’éñ؆@Znû±¡ +L4=Ì@émð²-ñ¬ûÞ°•ªõ)Òê /ŒçPˆÈ|TÒMf-´$³:ãd&IÇŒ•È í°CnŽÞSrEÔ‘t¤ÓC €TÝÄxús#®œÎ[ J¢ûšYÎs%ÆÂÄQ_n{ï‰j¾Ÿzɯ|âÄqãähnc@f= §6ÃßNy~êÄIl𠱿¹^rp\:^ðÕÓâà°QnÌ(†‡ý‹8#ßîÈÓÔo䳘úð=_PY¼›gk\ý§‡ÊV@²rø‘ÏsåI*?ãWB©®à‰÷72ÙnÖj6‰oÁmeOàœøIXà:þü§à? Æÿõk1û˸RÓ`~œß‘ï;¾ghAvûópŸ^󫲂ÿ1Lº endstream +endobj +5927 0 obj << /Type /Page -/Contents 2780 0 R -/Resources 2778 0 R +/Contents 5928 0 R +/Resources 5926 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2750 0 R +/Parent 5897 0 R +/Annots [ 5930 0 R 5931 0 R 5932 0 R ] >> endobj -2781 0 obj << -/D [2779 0 R /XYZ 85.039 781.388 null] +5930 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [481.678 567.955 512.306 579.948] +/Subtype/Link/A<> >> endobj -2778 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R >> +5931 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 555.921 227.853 566.398] +/Subtype/Link/A<> +>> endobj +5932 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [165.255 296.971 384.882 308.964] +/Subtype/Link/A<> +>> endobj +5929 0 obj << +/D [5927 0 R /XYZ 85.039 781.388 null] +>> endobj +5926 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2784 0 obj << -/Length 2269 +5935 0 obj << +/Length 2778 /Filter /FlateDecode >> stream -xÚÅYëoÛÈÿ®¿BuZ˜B†äò tªSàÈ:‹i -¤AAS+‹5EêH*®þñ7åCí&ÍM`“»;;;ÏßÌÒÖØ„ÿÖ8p S„c?° ãd72Çw°ònd) -sì¦çâÒOÑèÍ¥g-ÓÍpmˆ$ZÖf?O—ÑÅÍDBh–cLtß´ÙÇåÄÒV<»¼™/¢ù⎘´´K\¾¾™B‹&_¢÷£‹¨w¬îŽ'ðÜ_GŸ¿˜ã5ˆö~d" ÆðnVŽw#džë5ÎF«Ñ/-^sƼk@;Ý1…!@']˜F8­šÂPóæçi~7Ñ]ÛÕ’b·‹óõ[•û$ÉR™×<ÌŠ$ζE¥†úB=?ž—EQÿ©’I)ësTzlù†€ŠÒ9zÂä畬×eúU–Y‹&1*C¦°5ù¯´ªà,eR«§¸­}Þã>X‹ÕüÂÈŠE‡½0EñgELÜL*ä—Š×ßM×Übì” Aa—Ø»’})¿¦G7&k’£;hÒ¼ªã,‹k´y‘{ ]î8àrùÈ4|8ìgIvû¦ê&È$׸>s-]°b@ïÙ Hâùž¥õMC2Eª$†WPaßaøš÷l -µ¹52PRXemä0GÅ«3ÒSXRL»v¨]bD;M¬Ø`ŸC{1®½@»-Yx.¬Çü°=W» ?Ä>ðÍ*ÞáþÛóÃeÊRùà5fTÐ}—<9Ó5ªÙ¾§-ŒTñtµí,£ÝÝ–uP%Ád¾gŽEŸsZ1=Eag~$ÀtaY‰uÖœ‘ÔÕèlÎd V ™°-ücÛÚ٬ȩà“sjƒˆÎx û¹gðÉ °ÿ$9?©Ö#ù'Z]SMÐ8­ìX¥Í†¶„ã@ù» j³‰¶­u•<¥~çT»j[2ÕÝ8¢Ã8ÄüÈUò×CêÅò³zÍ}Ñ?ŠlžÔ>˜ëj*r 8U+I‘ç]%L)—éÚçt]‹5ŸÙ»IrãË9‘–OÅóµCƒáJʶò‡ûüTݼתÓíû¾uÉZ}ÂÁêU©ä=ò%PÜÌ—ü²¡;y£RÅ ÒS|÷0•õn˜€›lŸp[·\ºƒ6èmÃôøŽ×Go˜ ° ÇGd;ê«pž¯]¢Ã3ÕúÚlC£z"•:Ó|INwí—«I´U .×ÏŒñƒ›¡îðñ]ïTË }ukp*Î@´¨þÓ(]ÔJL­‹jœ›î¼ jžùgq[7S} $ì«ßëßé7¯W±öŠ?f±:üY‹ŸT0ð…êJfê}‹­}Û¦ê »Ž;™Ë2ΨÁ ÉMÊN¦oŽèäŽv6]ΣéÕó"e²ÆnXIƒõ_.çWúåõ͇i¤.ÿs¸“³P{Y½V«õ¶ åÁRõäî´H«çªËCà9î/:”c*È}[á<&¾r[“to-}±ZòËp«^–òí @¾¥«ëÑÏ‹w:Ú‰Í4¬°xÿý_®ýuxÍöð;j±“`Ïü*Rõ­üÝ=uŸ.—WóÙ4š_/Þ,¯WÑj ø»¨ï~³öûê{Ôþ^“¡#TPèÍOÿþ¡8ýØ"~‘o¥zj-S<Ôò á9Ç(þµé'Yendstream -endobj -2783 0 obj << +xÚ¥koÛFò»…E +ˆÖ\¾à>ä’Ôy8¶/VÚÚ~ %Jâ…•¤bùó7¯%)‰’¯-Šx—»³3³óžUõȆÿô(ò•íNGa¤•E£y~fV°sq¦b" “Ì¿fgç?ÞHÛjjOG³e‡ÇWžïŽf‹_­×ï^ÝÌÞ~O\×µG'aY¯ÞŒÈúi¬µ¶^]½~;ÖÖñ¬+œÏ~ÆíëÏyíÓ¡^áÚÅ[üx{5ÿ>ûpövÖ2Ø’f¦ÈÝg¿þnp“g¶r§Ñèæ¶Ò°Ÿ{Ê÷\ùÎÎnÏþÝ¢â=oħ†„á9rB˜¸¶Š"oFkG¹Ú‰ù¶òm¯•˜îKL;‘ +Â`d€Pd¿Ù:Ü¿žv=¥ÝQ×!A9¤ç÷é¹SåGþ½«_@Ìah¥5Ž‘•ÐÚ‚˜ç8Yó¦Ìµ•Œ'ÚŠ7ã |Ó¼b€7ã‚?^§M•>ðü;q±0˜àP™o¼Šï2Ɖ„S9È#+©–°UVy\̉РØ"kSáò]|Cöˆ‚‚ûÃíAgSºÏ2®›¤: è#t\åÙÁ:ë€NèL€žÒÙ)‚FgûôuÖ£÷ŸqäZå–Ýj)žÃ߆¦0zJ Ñ”<®cÒãWþúå†Çï<¤ ÿ…ÓÛZPݣוÕ×ú¨<í©Šü§äÙ§=%ÏS<÷é ʳG¯“ç¬ +å¹Â¹ƒ6 hp…qœ“áÀl‰¼²$#ͬJòµÑt'›*F%ո̞@úbS««&$¿Ù¾ÍnïyhÖ)€_ÍWR Fò^X*Ê—(²O³%xäÛ˜2±B žƒÎ Ô…ªoÛ,ƼƞŒ(Š„æMJ_訞k%ßFRð™tɇbŒ,À7Ë5Çtˆ¶è +ˆ~§àá=b1ø2>f•A0UŽ==m•= ãVi€ž°Ê“Å*è YeŸÞlªñÑ0ÎËJVÒk±(ÙbSZ« 6q–áÄ·®{A»à¥ÛµQÍ c4|-øXebH–ÄuKà̶X˜­ŠWÃæÅ ì\òüû€ú)˜ —iךS²Ðœ`±ÆðÈËÛ±j”ßè lQLZÀ´˜—dMbo©ØÙ“BOÔVÎ÷ËR‰ˆœì©o”õT¢)lÅ2Êf_7hæ:´îÈ û·õ÷.ëšË„ ysˆî8Û5œ×ÞÂ;cx¨JÊziÒÄÕ£Ü YÀxñå=Ã/ ¶ Y¢jÖ)À-ËŠ'yY$G},ßô¾ÓðzÊwN4¾³OoÐwzô®ÊO1»‡Q·zì8iEÃÚ$7ˆWºPŒ¼NiXw[£K‹/¯Ù;Æšê8 I§×··ðqþ#f•Ö‘„2î”ËY»ÇdW{inB–Ð4)&~ÔÄiÁbp@Ò«ã{V½55~Ų{Ü(pÛ° Æú¹°¢ Þˆ ƒ7 ŸÉ¹ +ì±ÐVumˆiÈ…(¸ãQòr +†‡œÐÆ‘‡5X$-¬9„ÂÂÀýï«´é]Lz*%Δñs&›´ª›7²Ò%¥C O.Qc³Û›qäQƒ¥oÞò¤Ž0¿¸º†O²ÓDFž•{å1€@ÂÊ$¯Þ'Kë¦JgÒÕøA¤B/<Ù˜õ`ÈAØõ”ëä â¶>µ6…f̃v x°®ÈÔš±«Á$]ÌþTXcuY®(A¡u;¯ð›†??Ã̱ Fè;§Yî`|Ú°ìL•ŽL>$ÅF¶U‹R¹v§XáàÊ‚-AȹJt®¯xMPèO¨Õ2Ûr•Å>Y1°d†<œ#: LyY›â(Þ$“¨î›q/S +ìÀ >fÒZÄ¡lâ¦m¸’šƒ¹ Ö[¶&ÊM›â]pöäïè)L_û*F—«•ìî)B`'ð¡vñ!¯Jt1Ég3t˜68nj(l8Š冻,íY„9ÍÉ.dE‘(':p•CêKt&¥q ŵ8b5ì¤Uœñn¹1!Óï·}—‰îÔ:1\ ©»Ù2):WB«½gž‰\„/»ëÙÄAÔ\Ö|K9œçRå¨ciÜ e¿8ZE:‚é©ŒÛ;<ã θ̧ 0Å€±1åÑ “~¤<(˜þ2“ÝùL +2y‹âëeYö$TB‘ŠaÔdÇ.ÒzÞ:–~9ÞªÔø­i¶¹ðv¥’e9ÚF{žlÿ AtçOB€P_¨¼¶¨Ep´Éží~S·H)…—ɶŒû"÷{v!|‚øÙ%›¸Šó¤;+^x¯’—O)×è ›SjäRn³©N2øñÏCÕ O»,'Ê–fær}9SXQdB luYVùqt1 ó£ã¿üsühÜ%þ’±ƒ±³H±š´µ@±àóoquâ9¯ãü.>/Žs +þÊÏ8Bï6iöèݼ~.&Ö¤y²K©ºL‹íƒ0©¾»øLt¿NçbKÆjñ‡€þ%‹aQ8 +ÈEœâo*ƒ„¯(©Å¢—÷EݤÍÖ8/f{ºTW s‘WPñ¤sãOåüë¡'çN*©:®> endobj -2785 0 obj << -/D [2783 0 R /XYZ 85.039 781.388 null] +5938 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [218.134 512.523 287.369 524.212] +/Subtype/Link/A<> >> endobj -670 0 obj << -/D [2783 0 R /XYZ 85.039 421.906 null] +5936 0 obj << +/D [5934 0 R /XYZ 85.039 781.388 null] >> endobj -2786 0 obj << -/D [2783 0 R /XYZ 85.039 395.291 null] +2046 0 obj << +/D [5934 0 R /XYZ 85.039 568.747 null] >> endobj -2782 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F65 2099 0 R /F56 1642 0 R /F20 1617 0 R >> +5937 0 obj << +/D [5934 0 R /XYZ 85.039 539.949 null] +>> endobj +5933 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2790 0 obj << -/Length 823 +5942 0 obj << +/Length 1121 /Filter /FlateDecode >> stream -xÚ½VKo›@¾ó+{ÁRÙì²<#åà:8!Jljˆ/iÄ&Å< -$–¥þø.삉‹7ucKì°Ùoæ›ñü¯+bƒ×t°®óóˆƒüY¹àÛy@U)—¾¹ÜÉH•x Þ}¬¶¸‹;ax9°]sÚ1Æ’A_Ô4]ÞÚ}$8tÖžZc×_”o2™D­].O¦} nÿÞ½âL·u­(YÅå½?¹»{È/´+lèüŠÈ Ãà#NV0PdÌÞ—œÃ}o´Ð5™§§:¬eI’F ®Ë™Xé0óK_T$EØöµ5¸Öd|2Ÿb§#ÚÇu†SË®L)ñ£òn£>ˆ‘…_‡®)o–fÝÇ$•€Ió"ɼ¼ð³¾ˆM©Az9ó LSA_VaP©Äü•Ša¼ðSŸ<â‚NÝNg‡þþ.Ji1"µhd]›£Éôfà~^B -M4IšZó±ýe»«()ôJ†Í”ÚšaHHs:rZƒb†,¦È…9صfÿ¨%A˜Š)Ù³=:héšd{·õîûÎض®²¦iuU ¹Ý6ê^C5ê7 a½3ìZ Xï±)­úµílxtuÁe— 6«Ãd§ëXC»1µÏk–ÌMS0&C÷µv;U$zr^S€fÒ=m+ÒáeÂzKý 6©}ÈUñ±–ÄW•‘¡kÐ m— M/°U´Ì–ÔÖ +­”Ž_²®êõ#À¿]†È%¼³JP,'rý™ïr‘ûk”ðö Ǽᢘ8~ø°(Œ +M† ¹Y´Ô.³"rã/¼Å~HŠJÔ6PÌ-%<¦…B‰Ë5ú8,³þIÑ•ý¹‡ûK?<Ü_àUL›ž³¡¿˜ +6È¡‚ûT°IýÄK]¹úßø'À®‰˜Bñ…'%ÿsƒ8B"ƒÑé!oí½{×\;q3Àófâ,ïœ&¥švpèï^™š”þ\Pà 7SôÍ8§N3ÿŽ™§\(óÏ5Í1«suzs«L3wæsäñ65„‹sàôÔZá6,=Eå8A9ª“­Ô0Š©1!N,àÏQˆb‡øá<7C‰ûyŽÄÑ0§±™,œy9}ÍÌ+pç +<Ž†Bóðw«û~Äû£~ŸIâGŽï¦üV½¤`D~^%õÊwÁž‘{:“÷zh-ó‚™Çx• ÷g|<Í`.A_…“QßîY7{¼ûí[Y¤óÉ …á¡õ^šÚ»æþNe°  «08´l‘b‹7.`JbñŸãQ§Y2º¾êZ;|Ë%¶¿¿m$lä.BŸ²Ì*Šp–¦ qf³W†áz<]ÙÃÀþ{a˜T Gýó8è%a0^o;nV~BضïOðö<ÿÞåÙ°û³\{ýeÔ*RŸ.Ûp^ï‹ŠF//ì³áé+Ên+ÞC|¿uÎóÎ8¿,ÈÆ©þQÞ ½=NzËàìêB1B…‹ o:â¼ð ¡:vÎ"Èóg3ÓÝ4؈câ¹N^údDÒå;0‰¬øËEËÀ$pH†{-æx(ùBpôôM*»' ²cklÃã­“Ø Ä®ƒ©ýøÁÙ±r.8ÉÎâåÀ¡³ÎÙ6À†ŸÄD¬Q *ífKä೿> endobj -2791 0 obj << -/D [2789 0 R /XYZ 85.039 781.388 null] +5943 0 obj << +/D [5941 0 R /XYZ 85.039 781.388 null] >> endobj -2788 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R >> +5940 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2794 0 obj << -/Length 1130 +5946 0 obj << +/Length 1399 /Filter /FlateDecode >> stream -xÚµW]sÚ8}çWxØØDŠål2Óa)Iè¤à7/Ý>8¶žØ–k‰ÒìäǯdÉæ#Èt×™ ’uuïѽGGÒtþ‡4׆ºÙ×AÓuµ0méڂܶ²Ð5 ê=[ ýé·®nz††tØ×ûšÿTšøÑ×Îðnàù£Y˜¦ÙAìÇq;Ã/^uæò­7OüñäVô,þu¾xbx:ëºfÇï~ó?µFþVX`A«gŠ¸ß[_¿éZÄ¡}jéÐì»Úš·uˆú}-mY¶ mËTý¤5oýU{‘c–&gX°Œ4Þ0uèºV½LÓ>°Ìß8xdëWV@DÂ}gìáð˜mØç݇<\=L>BžŸ9ð¦s>œ=_½çbÛŸ½†~Omôp40ˆ®rJÒ€Åáakéz'§Œe¸èä¸|þß<@H2ÊŠUȨ\HHÒ<‰Ã€áè8<¤+äÄvN(£aœ3Ù3)/0ÿßæf¨ z&Gq»,ÍŠÚŽLƒ,Jâ ÏY¹RF䬫él‰eã)NT럓³¼ !¦”/SNz‘¿Á;‰0ÌË-$Ò¡wÚ€~=Œ‡£²%lŸ¨°,^$Â2Ggâµ9K'˜UÒ@R€NÌ–q¶àØÍÞ ¦½ªÉÛõ®¸$:Qÿ¨ëlôø› Ðô\œà•åèeCø}Ö@ý®IñÌ“eïøÎÞ¸D&j¶ŽæÓÏ#ÿŽëeso4ߌ‡]`9|ü÷óVõ+þÄZNø1Ÿq¦hý8ã9^‘#ëz·ž–ý»‘W.|ó2=ñÎÞ®Ú„0|YÉAÅ-M”|}Ž£,Èi{O7ò‚+ÕF<‚§šÔ¤‘)ícÇ‚ç«(”‹ÊqU’ÿˆ¹¼*½k+Èj±lX.áŸf$jÙô…ïÅtG¸aßÄ\å¹Îðtì²R¼< ´€Ó«ÝíZnëD UàÓ üDÔ› ¡¤1ÊfÒ#êA„#Zí˽¬.y‹îųâ*ßT9Š ²Di~u¨ì€kd›Ú_B|Î%îABÆ -nFTÒ *_uíªØƒ’ót)í³]wAVU<Â9lj3vÉX?®-vsQn‹ºl*jÊ]6Í1É«ü>$mŽzg«ŸUHŠÜðˆb¼O¡%cùõÕÕz½†"‡b•h€%Nr¸di²vÚ§j1™ú£kµUâ4ž³Ç(Á5Ù"‚ܲið‚‚½€›rÐ ò$~Vöþªx$¥Ky ª¼VËž³]Þ:úhî)‘~¼¢*K²Z€XÕj-öÜ6ÕwNõ=Žáèl¾þWOåÛêþáþ?¾ÏÛ{ƒ*­<7t75K²ÞUbñi¡Æj=k¨FIó²eAóº9ü‡÷?ülá_-7ãûÑÍtöyðæf ‡ß˜L 8† d¾4*׿v{3ˆÜfu5C‡®fü«y(êA³Çï~Ûÿ/§ªÐendstream -endobj -2793 0 obj << +xÚµWÛŽÛ6}÷WèQjZ¼é’ H·‰›6E¶ÛÄmÒ<0’l +‰®D¯»ß’Òzmï(†É™!9·sHÓ † 2IbžiF ϲ hgq°ÍÛõso2?²ùq5[ü”ˆ€Æ$ó`µ~ØG!y°*?…¯¾ºY-?DsÎyȉæiš…Wo"–…F”Òðêúõ2¢á4á5ŽW¡ú·¿:Ùû­®Pöv‰“åõ*ú¼z7[®&§£Á™½ûgöés”É»YLxžÇ„‚º{D +îçÍìãì÷i+§[u)’gDfü<Teƒ2N£A*c"caÓ±Úê¡‚¨ò<<ÔÃ¶î š γÐh'߃hˆæ4¬œ¼Å±î#/ÈêQ_¢9$à +•ñb˜YûBí@OÃÆËëîœv‡k´]^ØCìQÃ#y8ܸ'Å“q‰µØâ²}SbÞƒ¹rN1S¹¬ˆXj­ìÒ‹u몮÷Æ Ì¶r]ãfM£Ñè0 Š¡6Ρ§õ¥”NY²˜š^* £$£ /è°!å¨BA¿ñšGu¥<‡ºJ¨ëÃ)¶®üQ]½Õh„ÑoÙ½X,‡)zUo FŶ®ˆî7‹~«Šª_t¦±e8 ŒCÇR–=Øœ%)„–LùþÆÁÇ É’ì+Á{£“àoëê Æ}(K$¬ÁÑögR€K™ T~ã8“œCK}%ÎÑè(Îa¿Ûiˆ±­‹^zmH¡ÛEY­Õ¾1D »WCQ—ßß~yYuóh.’p?¼¤YNcyš‘åD ¹r– _p<%I–?ËÎI*IÂò)$ZJrÈ +†ä!”$‚Ð8±!# ø£@ÌRÆáUYÖ‚1IÃ]ÄiØשzË(MÂŽkXb¶Ø`¹ÐGÖú®êÐÈ ÕyÃ{_“„ ÏçÃy°¹@¯c8z…RÎ ² +ð +øÇqØ*œß» 2gj™&ªó²*A¼§öF·ÊÔ…jš{'*‘Œû‰¡`‰Ã°U–@í‰;ãD;4÷ìjypÆtu~ãm¯qãÍÖ­r¼º#êGš¬^[R<íӔРÃRçΰßweÓpej²¯ ˆ¾»Áñ¿,;Óß;íâ•ÛóQfç €û=]ë¬ïTœæã;Å··y>ªÓ0*ò´¤L ÆxZG6SÂEr -)ày“ó‘)$’„ÈÃ׺m´-æ—=´/kêq‰Ášåqx­¦nwV9zË3?F,”ºÜËϣح±/Køb/të­J…|æ Ž»Ç1¹.ÕÇ”W#UN#ˆNkéµL¯Œ¶œÍNßœ ò4£;—lãÌ€RêÞ Ž;7±§ÜE2 U³·dç"Ú­Ývª1“S²¥¹‹Æ¥Ö ¸lRÜ:Õ_"åª+ô¾Wì1ËqÚý–½ò¼â™Ïº‰áÉM˜øFnj&þw7çðÀyLØŇ|§âÿÿ4nÖŒç—1)}± ‘§§þŽ”Îþ<ƒ]Oendstream +endobj +5945 0 obj << /Type /Page -/Contents 2794 0 R -/Resources 2792 0 R +/Contents 5946 0 R +/Resources 5944 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2787 0 R +/Parent 5939 0 R +/Annots [ 5948 0 R 5949 0 R 5950 0 R 5952 0 R ] >> endobj -2795 0 obj << -/D [2793 0 R /XYZ 85.039 781.388 null] +5948 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 716.996 381.124 728.989] +/Subtype/Link/A<> +>> endobj +5949 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 703.447 266.58 715.44] +/Subtype/Link/A<> +>> endobj +5950 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 689.898 490.439 701.89] +/Subtype/Link/A<> +>> endobj +5952 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [266.468 572.648 475.915 584.337] +/Subtype/Link/A<> +>> endobj +5947 0 obj << +/D [5945 0 R /XYZ 85.039 781.388 null] +>> endobj +2050 0 obj << +/D [5945 0 R /XYZ 85.039 675.629 null] +>> endobj +5951 0 obj << +/D [5945 0 R /XYZ 85.039 654.736 null] +>> endobj +2054 0 obj << +/D [5945 0 R /XYZ 85.039 557.204 null] +>> endobj +5953 0 obj << +/D [5945 0 R /XYZ 85.039 530.59 null] >> endobj -2792 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R >> +5944 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2798 0 obj << -/Length 694 +5956 0 obj << +/Length 3338 /Filter /FlateDecode >> stream -xÚ½VMs›0½ó+˜ô‚R$„øÈL.Á ™Ä¦Fñ%ÍÁ1Äfb -¸žÌôÇW $ƒ·±‹g–«·ûžðbñ–M -±dÃʦ<[IHžsÏ¥„«HÖ ÒiáúʤӮÊA Y2{*—°à^±¯úsÆ=@Q°{À0LžózXñÅSoì™;¼,,?ÄÊW¸GãžIÖ{`×’ÃZÛ j:)öý!Ý? 9àЮ%‰eÊ[>G[–¼’4J ÕHe/%_úÖD>Moud4U‡ªÁ'AÓÔš4 íHó )R~h ˆ¸oíí›´}´v©ºJ•,^…ù"ZÏó8Éþ1üÞ[¿ú(ߺïy7®Ýgîhxê|æÛc×cP¡L?Éþ&ozè´'à ÈÕêƒîüÁÁ[úçY% 0âãw~;øO’8˳Y”äÂŽÖy˜&iÈï'|>®PšŠû~qòÿ«ZÒiƳÌãæдªóC(à^F«x)¯‹°Ÿ¢%+Æjú"&¡“åf>ƒº–b\„iøa-¦}ÃŒÀ'Œ ~v0r û£[‡]ñ*¸p&®íßslwàÚ‡/Ý›ŽÇéì9\+vbŽ˜sÖMÔt]ÑPð+fq¾¨ JÒxÓ4ƒ6¡Eý—ÑsµžmÒǸ Y¾|–Ç;R×9}…–ßíîøž˜”q¼4~ -¨²-"¦¢,¥Tá[ÇyÀ®w€:ÔUÇÖ,h©Æqb¶Ùf‹ºõ¸ˆ·Õi™m^³iÍNª¢Æ›eÅÁ¬Q§ ! >»Û(_ìàêl·òÎ?yí­óÎ-?¶÷ƌƷýÏüݶÛ& ¼!20TU¬uwtU¤ÏµVÄ€ØlPÕ}îê›0ÒßÅ:$:oÌÚQQrIendstream -endobj -2797 0 obj << +xÚZYoãÈ~Ÿ_áìK(`Ä!›Í+ æ6ë#v0Ù<´EZbL‘Z’²Çÿ>uu³uÁfÕWuõW_•&¾Šà_|U¤a””Wy‡IQ\­¶o¢«5ô|}‹„N“0ÕÊg:—¶w™©0ÒùYYc™Çe˜èe>ܽy÷EEW* +³,¹º{¸Šc&±ºÊJêD_ÝUÿT.–i·/ã"¦z±Œƒíb™dY`º + yð~µê÷ÝÄ•›E}Û€ôª©ÇÅî~}óùÎmEv’•Q¨ã×7ëÉÐfãô*ŽÂ2*6›æa'´Ù»M3Â&"¬*6fG[¸mÄ­ï´}øcÜ"5Ö4* ¦Mm‡‹è0ÔÝBÁ$SLfªY¶à¦ÇÄz”yÆA-ÔHGÖ"[Õ´ÖJI'}Àú- íKØs=Œ}gZîß `h3KÔ#¨gÃe§tÚ©YÁdºÀ‹XÐœºHÝ~ò๭«uÍ­8®„â£Ùbÿ½á¾­i趺5×Ûfœ¸ä4v?Ò&p’æž÷IõŒ£Œ¢àUñ8ý +Ô´£ˆ‚²_MMß±(Ð;’.éL¬„žžj8’JŠ éxæ­áÑØF³ÿÅI?Lܲ1#ÊÀÛ`-Òtã¦â»Q:‚ûD%‘øÓ" ¶ öÒíb#YTçÃáÚr(8ÓSSù÷ ÚÐqüØÔpúÓÙ +…šÖÂKN’“ÓaÛ3NŽçIìQšôÏk’ ¨6tµûõÆÖq zx67}3ÉwäïΞÍÈNlZº…>¼ð‚Ó²“H¿ú‚= 7±Êüœ*Ôebá&FÀÑeðe‘DAm¦=[Òx„9ꮆû×d)—PÆNýêg™Ë(“¦Enâlì£%ç*¸†ú-ÐCªFlK‚ow`ÜíîÛF–AL^ÈÞ^4ÞÊO²Šc±Ÿ¸ÜÙ<‹\6Ù¬¸÷` +sß´d(ðb‡ž"K³Ý9ÛÊIUI æýuèq£;®Ýà\÷(Ù˜ÆZЀ…ö#à7[¬ÂæµÌ„ï&ɾñ½b‡i鉬yÈÊà&°t}‹_T3ÍâÔŒ}ßîô¹7‡ö¢˜?jT™(o&Ü)ɆÌàü› ÕðЊÔ;±4Bù¬¬ÌÎÜ£J[«ÔB# äQüÝz¬ø–±ø,nË/DS›éo<þË'oxöÓ’Jc[s™ k¿Å¿÷dY䡃…£ànîmç +üaÑߣ4êeØ<‚ytÞk„¾˜{S ]éF@n0S?°cMRÎ¥’MñË…Å'¾æ”ý ÍøÇÞ–F{§'ÝÔíN0®çïP½uº³s%À²oØŸš”ù¬*,7öµ×iÐÔËŒí ¾ÇÏUEÜË'ƒÂ{pov(ò U2Ôô.X+²ƒß¡â´ÐÖ†éHõ‰í6;ÿå™#)¼Èƒ5bD^žÉ øt#MmÖõ_˜Ïy¯dοb˜ÎÈî¨Ì²ëÞ³<98óiC÷¿þÓb™——üÂÂ4›éXJnšÁ}Í`w +@¦Úzö4ëTÃ!#WY÷àÑ™&áííMÛ¾pã¼:Tduôþ½ÌeI ©Ÿ©4#bšÝ®±³ò#ÛÙR£#ÚO² v³:>Ïp,'ŠYÈ°'l+-õ™„p6Äâ‚ß,|ûŠ3ØW¢-þäÒ BýSãη;yá9XkPøÊäaÇ5k+û~¶üW,xZ· F&%½;õÛòà+ÈÜZ@€Oáž"íÀÅ%«ž ÃÀ‰„‚6QßÔ¸cJrü9•`%‰£À#ˆCl÷/Çü-b•Ã°­éœNd£@£ãd6œˆ£À=W³“¨º”8ï ¥˜‘ŠìT;é®ñü;2¼)‰„KñQdÍâWì4´ÜtÆ2Wˆë:.-ÅA²{ÓWÜK$¾´úOV Æ?ØÖïÄü‡iOû$ø¶ûD‰„1,˜ýÔÛ†>ðwÕ{,¾å=øaK9¤ZUÀØÇKt5ITÐÕÅðdÃ#¿…UÛÌéqó°ô£Z6ìq¼ÈÞ#ó*H+déXÍaµç¹¿·†Ù£Y&ÜÀÈeí%-¬5s\JÖœìjá „U¬qN9r6ƒT˜Œæb¾Ðð€—ñž€VZúp +bï«3|ˆß=°—Ô¡+AnDµ? Ì8ï]w¦E×Ù +NøîKšù¡Ÿ‚/UpA8s]¡Ñ¢®Yü RÔ1•XÚW¯gW5-½l¥²)€3±{Åì|uµ’ë¿“ÃS +•~=&÷d.ÇäªLB(“+‰É?³'æãbñkÓ™µM!aÃí ðøíA>œQªKÁº*£0Ó¯ëžÌå`]ee´÷u•ÏR¡Q)Ѩê s7²É‘»2¦|Æ·œs«uäo£5C+/aÚôø¼“,bâÓ +ã`=¥åÌ @â€ìK?»µ2øAîöëð *¥ˆ— +äj—‰€6žääˆØU¦LÕpA!´É³Ñ*s”€=>¼¶f!ˆS0àš\9­-] ;ëâ°‰ –À,›Aàœ* nûö\°çœ%1ÀÖ¬fæ'¤¾3ÙÊ‚oŸ¡|÷Û÷¯ß¿q'mŸ–³D’ô =†«º‰aŒ½ä7èŒ!"Ìy c &hûõ踨*ΦUÜváŽ]gâÛq0Oea*V{«ÒÆ>×TŒŸX{@j’çúźé‘6dÊLÆ Øõ†¸ÇÚùhϸi b@ör +ßg¼³§ ôèëƒV³L ÿÆnÊ䉡AÕØ7$Ý3ñèÖµ´‘1Fùl)´ŒŸèõ¥˜ZŒBâ°E^µÌFÆesº ÚXÍëCòr)¦£œRbÌJKÄÄ°~8¾åf›ýç@ú¼,Mñ|­"é&ëñÕ„ÇÌFá@Øè¢tasîW‚‘»ËŸï®k.:ûà +ÙŸ$ÎS ¾”Zˆ;î±Â¿õ~!/™ø­y‘‰›üØwÍ:¼ùþÛ‡š–aYh‘$ÇÝo-9Y~][NÉú#.ä%“Àw¤a™jh?ÚAòþxÞ«+8S}î0à”Ê"–îú9BXÿ¬Ï&SaYZvð7œ[Þ:•Æ…Ž~JÂ_`ñ"ÔœµBI?PÇúgþa¨ "0ê;++p> »Ÿ+h3)]ÀQ4㥨ÒK¿x@_±wé1ÈŸæËtPümºqZªÊ?½åºJ¨@™ö8šÝnœÌp´ºY3†ƒøs3m¸ñ’$©í¢Æ3?H%Sú¤7\œI´”9Øš‹˜ù€Úu3[|Gè*d eÐ'U$…Ðé"ðATó“œ3(0†à_$0Gn}pý°¡SÌ9ÞŽ³‹NEÇ©—R;&ÇØËQ*œJÆYõ›&ÊŽrIæõ½Gƒ}~x@é{”1ÜgãZj{=I–H΀ïĦí®Šÿd×ÕSøà‚uèøYúEŒ¼¾å íDŸJY‚œªæxê»s?Ú+Q~º ¥4D-¿&Ø(#ó£ •$aá@ÄòfÁKmÓËŦϕ}²ÇÌ7ÊÃØ¢*ý^XÙ­Š*OÑ 3ða™(ãv¢è,ØYÊ2±ãDaTÚ½þõÌœH¨Ø†L7C¿Ìv¼<_š‡*Wÿï|ïÑ‚mF¸æYïú¾Ï)DE¡è%ö0 S ¤eÂÊ2Ïù9¢ŸLãØrh,™{ ¨å>²™gÃàjqÙ+w‘G„ ód¡Xñ|-V)ðu !31N´u¹Âœ.¸Ül£°ºøv÷ªÓÍŠ0W¹È†râüÐH¾q² ´€k«ÐÉ×qÖGîä"±Âæ>q!ç‹üh +Ê×ÍjèÇþA2 +×tf]ûpz1}Š{¢ÖYÊô*cD¹þrEòÃYêþ¿€ÄôÐçz\p—ü,‹2„¦fα”MïfZ¨5$‰fªËôåuyLMáiW+³³y/'¥âþ›åÅÜ@¨J?¸~%C ’§!v%a¦ìd”¿~´`šaZ$—WüF qendstream +endobj +5955 0 obj << /Type /Page -/Contents 2798 0 R -/Resources 2796 0 R +/Contents 5956 0 R +/Resources 5954 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2787 0 R +/Parent 5939 0 R >> endobj -2799 0 obj << -/D [2797 0 R /XYZ 85.039 781.388 null] +5957 0 obj << +/D [5955 0 R /XYZ 85.039 781.388 null] +>> endobj +2058 0 obj << +/D [5955 0 R /XYZ 85.039 761.463 null] +>> endobj +3025 0 obj << +/D [5955 0 R /XYZ 85.039 667.044 null] +>> endobj +2062 0 obj << +/D [5955 0 R /XYZ 85.039 598.304 null] +>> endobj +5958 0 obj << +/D [5955 0 R /XYZ 85.039 571.69 null] +>> endobj +2066 0 obj << +/D [5955 0 R /XYZ 85.039 309.244 null] +>> endobj +5959 0 obj << +/D [5955 0 R /XYZ 85.039 279.84 null] >> endobj -2796 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R >> +5954 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F66 3242 0 R /F11 2898 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2802 0 obj << -/Length 874 +5962 0 obj << +/Length 4283 /Filter /FlateDecode >> stream -xÚµVßs›8~ç¯`Ò|©âggr3>'tZ›ê—^&1l(Ëtæþø®ì8.6vz'ÏI»Z}»ûi%ªøQÕ11a®j;3ÇQ“•BÔ{\+TjÕÀÄ2¹è¯Hy;¶t•ìWîZ•hñUÝ ƒÈ› cL£ Ûv´Ñ—`@µPÌ3ù“k>2`’j_.žÎÓ¢Á·èƒâE;Û"ãû~W¾~#ê }Pf®£>AŸ`êºêJ1L†MƒÉq®„Êç­!3T±ªÃ;dèÖmè0‚ÇغÉÌ7ßxjmÎÑrˆ”›w72¢ÕÅ*m–Ùú¾)ʺ[¯µñï®Ì<,Ú[v`kS7µa|ôGÃÈŸNÞÓ0 -G3?ˆN…p:¼cÞ—õ9nŸ!›wâÙw{>yu!Úñ¿UB{íò( ¤ë¤«Tš QáÛ'%ð"n²äHìîë*+¡O ÛÔþÛI±®›ê1ijáDR¬Ê±Åúüzý»÷òç¯_ºXh­=¥ý‹EšfÞç‹ÐûíóõëKqõJ*ó^¾üðëÕ5DÞGüðþÝË‹Eè½{ Ï^ÿröúÚbf¿ XäˆÖÿÎ~ÿ38_ ¿œ¾Î³ó[h~Óû3ÀË#-ýúìóÙìV<óª¹SˆuæÇ™~| aìC*_‡ê<?":‡U×öHD»"†‹…ÒÊÛã@9ìZè¦ÞºÇQí!@Û DÑÛ’á<Y »Ðo°%Î8y‹ÿµÝWž+V8±*é³²w Ö<ßÓÂÕ±«.dýýE¦=àPÞëo8Rv÷ò¡ò–w¸àŠvîO—&` œÒ"ÄC̉èÁÀÂÌ[¡¹bT:OˆDÇÞÀhà×vM[ã‚í=ƒÐæ%Íï{Ja1mˆÍöæ"dZÅÇPòÊa'¶^s£Ãï×¥lcÎ`[þ­ø€çP–Íð€QeÇÝ¢YÏмo;’Ø[µûC]Þa'¢¯ wêžû¸ú‘Àùg:õ®‘-Ã^V(=ífxÆÓæ¼Fv ò‰¢~ÜîžCß­¿|ɵ¥­d¡pÐ ûâp <Ê¢c¤ÓE¼áaî<×3;åì<ÈâK¢Xtëç<ˆ¬:Ü®ö"° ÙZVây7«¡j‘;E]‰PÒ$ñ¡ÝÙ¬àî¶+ÍmÎZúD (¦Ë¤ŸcFiR9Ó°Ç/Þ¸ÅתÙâ ð¬á_*e\É?‚0Ú"Ú]Ah3ü†›ÒheŠÒ[òr+|ÐîïûA¾L}>ý¶®V‘ +CÈ^úeækxÈèj»C±¿'34ëoFL*nHú]=83£0k4fÍ‚H4"e®ñ"/B>”ûvC«ª'_ÀƒíÚ=w.+£F!Æ)V§F‡­DœHeËma ͺÂCÛ>4þÆÒ&Iî« g›ÝV >9ÖÛ@/ðÓÖÛáY¾CMvOBÐY(¥¼]‹r`ì‹Ršµ[©ü)½°§`%­ú‚ÌiÖFn{FLJ`‘ð€=KÝ]€ ÃáG\.o¡Û[?oýUK(/ZÅÖ´»¾|ìZ–ëQ•––´o@ãEC_­Ë%+òæ!WÒ$ñÓ,r¹ò´SÖ¾Jç]òÂìõ4ÏÒ4ðƒ8ðÌU%²v~ÑE’d°ÕD€†>óÅ&Žý$a œ*ˆx)dÞ†nÏkÞÑõêL?`»3¼èÆUEgø“+pr+ƒÄ£#[0¶ñƒ‘=‚ߧ4»ç=P8´X“Ρ±Yƒ12ø»«f9Ú(ˆÁ: × Ðý IÆ¡ÞÔ TQ³ rïÆø$\Çf [ÆPb›|ƒЮ7þ”½&œ\’(vš²Ø¯‚ãÐÂ(,î…1†¼_Tý­¸†¼!r#ž°Ä5šè Gÿõ¶koñŒÆsXqhö¯“^ê âG~-ʽM[³J¢¥Ðq`ý4 ùfÑêÈ3Ðà Åwâïh„b†ÞŠLJÌf˜½­àX •Ilµ/ùV k´ä«k^Ñ´S‚ò›‡ù%Dñè7m·gyÊ_™¨Tl‹Ä£”=H@›JPp˜Æ0»`à{:ñ£„ +LJlbcg<ÿDZg`ˆÓôÉ”È!³ `6ôsTŒÑ,Ä©ò« +˜åÃ7C8¯ÎçKE²Ý^€g'æ&©—ß-/Ý$±q +qÁ’!Îý)\Ñ<%áÓ¸Ž0§MX‡~"zýÅ¡x„1 Y_beUÛ_ˆyƽ·ÄÆãWXÿwϳ¯­]!%ÁZ†duf7¡úXàÀLÉD¥ƒÞëP1ìzኜáÑÖ#ÒÀ{‡ŸMoU ¤±íÂè¦ãCS­€Øˆsn+Ž[e†¼uÍÀrâœUàøJ>ÈA@Ñzª‹š\­X_˜{ùŠ-Á@ØòvÙ7%sh!×Xveÿµ–Šë}Õ,m]®«WO™Ž6ÈrØWcžžGÞ»¦T€ˆä”(FýÃα§øØŽ£¼ DZüÄk³X%…Pi‹gUìGî,Ì—]ì7ŪªÄ”ƒ~8c^²+É @º0‚úÊÝV†mL Ÿý\¸˜àÐ+}& („=iŒÅ|YgéÈxh;ršÅSaÏv–t˜&I‡á•ãÖѾ—<\ðÏAòDëîy5‹?ðkÅÑ^2/–V°ˆ•„¢’à ¸¬«YWF®`ˆ£·©AfÍ?ö¤VQ*–yÔ?ð ÌŠ%‘ñ d&~œ¤"R—@H¬bïU»:îËfèg„ŒdjYP+ãU€Òkf8 ÓcêÈ#ƒuÄ$ô]ì(_i¶=ƒU²AÁ?6hç%+ôr=CÆ"ÌrЉ4¼l›Mµõ?~x?CEœûy ƒqâ +ä¿)­Çéy„âøµ;‡ºX àB‡¥œ~ #æ¤xŠ*BŽ2bû÷«××ï?¼ÅÚÕŸ<ÔïŠÎ1~Q˜xï6¼ƒ5ã$BƒK3»^ ÛFŽn{ìF' +s’[j”´-7ZŽ/[^juÚŸ ɶðU»/ªæ9ϱæSó¶"# +Å‘üÆžµÆê›Ê{†áªHa°1 7rÙ­ÓÕ›#ëÒúÂ(¦ŽD}ÀBÀ åw˜y]ÊŒ¥~[õC'• -äÆÆiNmÑ+ âÃÁòaé±14&D"!=k­Ùö™{[j2W8ÛIqlƨÌW9ãiúô%µsº"£Ò ¤9”dÔ%™+ªkE\”ù<àÔ}=S£¹ç¡7U}²R£ÒÄWZ=MÃsºR£âÔÏE4˜C¼4˜I1q˜®•á×½:|¬…x.‘µÃŠSPĹ„-ôC£¯Öûâ'(¶?öß[ŒÌçYr`îuÇg·ÜíÊß°à†¸6„v«HÏ«8q';¢AD ÚÑv’¯õË»r†LÁ5LsžÛ«+*€TýHs§úX©³æq.žF ^]G<ôÙ^¹pÿæhŠÊË7‰‹´ +4Áœ;ƾ]Wø•k®¬~ákD¹Â ÞÊ8ɹi¬2hãk9Ä€$ÒÌã6¢3â›û‘]êËä1èTö½´+ôžsöTÔÃŽ,ÙvÇc¼§çnù$ùwR1ÒjR1Ò"aT“Ô¡c¸9eK…õ$ — ZÄL~‰AØ0 Z̘taÚò¤&ÁXã#.b…ÕØØ1éZ4y‡!Ím£ÐïxuÁÆ°@¢y{K‰ÕGü¹µ¯ZܤMаeG´µ)ìØ˵È\Úc¾ú(uu¹ej šŸ‹HZ¼+00>Tµ\ª€ï*‡ãcͱ_9pd?Úd8 Ë,¹A?ç;õöÜõâ3vÌœÃ46Û?M_ægàV†?äF»r5¦ë÷Lû­¹Å«l¦.Îãvz1—¦Èx7;ÙǦáЩmŠ(!tè'A:­ü›ÛS.àïYá(Ø­í[6 +-ɲËu@ Ÿïn«Þ6£È»jMJ„¶ÈC•.–Úò,‘›3‡AQöýôÖ‘¬\·—ªL<£Z¯ÇSè=;©Ü×ö¤áìã¦h( fïp¼߀m öqÙx™N3± Žsl‚-[#†µh«•tÈÙŽh^ñGöí ôëb°^æ“ >;pX1¡ØÞÎÑùøVä­Ä1¹Á»¡+ðš,JE¶Ä}gƒ}¾…z*•û±ÕF¼ÈïQñ{ȾðkSàÕv Yãòn.Œ‚¦Õ’ç˜{E^å—„¡¼˜*†gýÌÇA0r?‹'—)WCÔ’¢òÉšßᇓÎ#?É”|˜Ï/K%³ì¾95*çšMaj6˜ð<ÈXØÄ© !Ç +OÄÏ*+Ÿé¿?'¸d±ãè[®ƒì?¸S(z+ºT V¨Ð øm¾AäG¤Ç‰ãæu’“LþàÓK•=É †‰0“°Tä)ñ 4hlñNFø‡ª)ïâ]áK\ÆÆ©C"€b~”ó…Ä\@Ýa,噘¿• êq¦vŠ±ã‹B9sÕ3„˜ªd|¢ƒ£ÿµ&§åºlÞ›ð²Á*´$*‰ù‚÷ëB~†…|¿1˜Ø3L’‘EÀŸòÆ[:rŸ4:…†'Þ‘h0&³¯Ëà?ò^®ÛªA¤ýLŸx¡+å«ÐàBe<ˆ¯yáþáÿ|Ëbendstream +endobj +5961 0 obj << /Type /Page -/Contents 2802 0 R -/Resources 2800 0 R +/Contents 5962 0 R +/Resources 5960 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2787 0 R +/Parent 5939 0 R +/Annots [ 5964 0 R ] >> endobj -2803 0 obj << -/D [2801 0 R /XYZ 85.039 781.388 null] +5964 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 665.485 824.811 678.387] +/Subtype/Link/A<> >> endobj -2800 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R >> +5963 0 obj << +/D [5961 0 R /XYZ 85.039 781.388 null] +>> endobj +2070 0 obj << +/D [5961 0 R /XYZ 85.039 584.077 null] +>> endobj +5965 0 obj << +/D [5961 0 R /XYZ 85.039 562.216 null] +>> endobj +2074 0 obj << +/D [5961 0 R /XYZ 85.039 289.778 null] +>> endobj +5966 0 obj << +/D [5961 0 R /XYZ 85.039 269.187 null] +>> endobj +5960 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F14 2895 0 R /F56 2890 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2806 0 obj << -/Length 977 +5969 0 obj << +/Length 3942 /Filter /FlateDecode >> stream -xÚµW[s£6~çW0îCíMPwÚÙΤ^o–Ö¦†äe»ä .ád2³?~68@Ü6‹g‚tÎù¾sSE™þ hé@VmÑ´ P-K w‚,ÞÓ•ò²¨ÙЫ¥ß}á꽡ˆP¶l‹þ¶ÞâGŸ¦ó×®¿XÏ$UU§P3É4­éüÖÁ©Çfݵ³ôåMõ¥ÑI8½u«åÕzf©SöÙÿ(,ü–YIš¡Vv¿ -Ÿ>ËbD¡}d Ú–øHÇ2€¶-îMW®©ü;<ᯃ¶¦‰Lª‡¤)PL:Pe`YÚ¦ª÷Ðü‰‚‡º<ýV¡­ ÂJ½ÝY»ë_S EŸ’l‡Ê§÷e–“ö>ýlõÿÁ´N-_»îÎüÚwVË+wåùÞ|í¸þ¹vôWaŸ“SÚÿ‚Ûž3iß-ßš‘žtä/UÏE¿8´5ª`’­Q»Ò³çA}.F´}cˆo⌔$,p^žƒK%{?fÅ@%i:­-ø·¬Ë¸ŒiˆÝ<ËÖD"ïwÎ|ñ6ÜçdB5@jÏ°dù%ijáe:šÉa½åæòÚ!µ?ªoœ–¨È DÿrÛ†õ²ÖÓú æhÌFv}íÕ͵ÚðÛ¸õU»E@¨ÃËìÐÁFÍK°Ê¥v™<ûˆ -üÐïµ Þ[ý¹ð?ÐcFb9*yîbî¼wæ¯ÑvÆü¥wܵ Â/(z…Ï«ù,Wþâ6$8 R÷œ¥ìúÓÙ¸Jîñl_’l_„(š°™2æÒUnÇ#/²ÂweŒ ³ÓœoWËÛž¾UM¤EGõ{ÓÊ0FQw1Ò(AG¨Ã(Ž$ ôu ´Ciù+›Yxîž8hÐĘ6{œ”8åTîÏ }bƒ0 è²? +“{®FŠ'ƒ”Iœ=²Ñ>çêy|êæÉ =àþè4`ÓFQ0âš0H’ª89þÎi„ó%wïy»“Ósƒã ³Ý®ŠNQ—M4–‡üú'Û4.mŽ%œ$lD³2ßóÙ –à0(i*_=¤ ($F}rÉcÆ-ÃÖ›ÜÚâ”úà©“ÙMªmž:!håѳîÔi[­¶7°ÌJtRjÞnQ…Û8²Ž~¶£ÔÃ!ªõèMš•o:žLÇú¤`x/›ô.;|k×ô4l{Ú -zÈnq‚.›2 ¢§g¥<ìBë±»½«_Açañû꧳«•ÁÌœ XdˆÖg¿þîoà +?yn¥ç¯Ðö\¦wg€—…ô«³‡³˜­x.<çUsTÐK?s3½O©ØwÃ80”RžE)ßWnà«ó$òÜÈ ‰T@å•뙢0s~.¶e#=^¿}’Ä1P:{h{NSV0[ÖÛSD Sx¬à}4BÓæÐTš_Ë}^,C?sð|'äN×ãó½Ut•ç´Và4\¢GìæóG‹ ÀUTâ4U¹õúÏy [Zß}€‰Öñ|•·2…§Ôxæv¸ì‘6£U-C7Oø›:|fßµ:žÉ[³…ï4=ÒH³ôñ‰ùªù¯ÚìpiÞ—Ð^S³ªÕ,®ø ±(ÚŽ:žÄk†YâôÏ …íCgpˆªÙ +Ló›ç£pd e­O*¦; ÷@"˜#òž·|%Dø ³`i².fny»ºlj8?Ü"÷Ýß}`@G*Ù$ñÉ[É`2ßï‰õÌ}åô Cl¡½®Ê‚^¨çuLÊ5Ž<Ó ®- “àîµÞ’ïÅt%pÔô•pó…~x¡öÓãÇ¿_ýr,2 +XÝ÷ãó8Í\«?×$ ­É¼Yê½–ÖfSáR~DªTá¾Ü]^|™ …®móAMöúԢĪP»aåüãçÛ+¦bÞôÞÛrçË3×Z:  ,t”ßéiËuÙWò@§äÊw\zø¥F®ŸÆ£÷_=ƒ²\ð»ü¾d#ã¾Ö8Â2DpxÞ“hÚ)¨Ñz‹לÏ=¯\ç²à9G 4'áÒÎܲlrк©yøÃpg-óip“×zIÜ›+æ;ž'¦Ç#¤4bU´Ù‘¼ ”ä} +$H=Ôy üºž{t›‚;´÷w4mAÏQ qqf ŠïéPqGtµQ€ñ·b²”¾ðPsÐ0"dA +˜£2/«’Õþx]^çÛB¯™S;»œ=Jj]°¹GiG? çŸ*ï‹–›hº'Ì\nfïš9 ÆXcßͺƒ™‹Á¬‡ž?²Æ¨•£ÈsnØü~-kxI0¾¯(ÏûŽ­ÄùÈ?ÿ¾ç_ô]Z¤|óT ïʦÎ+^t¿|´yÈ$%Ìž¸˜»¡ÿ¾ý¶`NÛï(KÝÔKÄ~ã› 7ÂTæf;蜽u=1ÐŽ‡Í_–!4&CcóÄch‚ñwâ¨Ìsö¤FrfÑÞÈm§œÎR,ëMÒš÷B>ÃßÃBŸÙ‚›0å²mÛ È¾ÓB¶ {…rFÒÙìö8?:ó"Ï6^8F¶µi_:Ðð–údõµäâUZ«Glóíl¥•s6Zè©až;¬*X¼@EZ“,§ +b——µ‹~RHx`ábá¹XÁض£Ø½–UÅdåÄüEȦ½ìEr¿_In7öûãV |ä’ø%j>Ð5szY”W]Ê]Xw䞀ˆ®# +;SF"LƼ,Œ‰ó‚Bâ‰ký¸MÇòÈ>5ΗòÀ0ÏZoCÄÓ~ ’3dÍx¤ö£h†ìg"´f8†S4‹°›Þ,É3GÌj0V| lj™Ãžgé`^çûA!k2ËFköaÑ΂òßðà«vä±s» +¹a9ñص%Ÿð@užÙÝ#ÛE¶‚`ZÒÐ7=HN©û^lmÅ@ƒÜndUÿ떭b/¤MõЂa«…æÛè5³ð‹  +™ØRÜo(Ûì ++²(;Ùò‰liœ9¥!Q%SÜÑdr5I7gÒpÿþAøØٵ™͔Õ#q``^Åh6h÷°Iï‚ ë]°ÛŠ"Õd$âçs‡¨Ø›UÞ±Ïá6^jñLdœn‘}l;„q¾*\ñ¼XD°9ø#¨Æ‘"•Çó­`µ¼Z$ äv{´à²ßÈ0F©«Ò1ïc˜‚ê€UL8±TA@ÖÖûÈ:%t®I¦{+ þ%!‹‚åvþ£­ÎšÕMDºýš2 F“æLùÄx‘3Dc(í‡M!»ä}‹zžçø0Ž#­Øù¶@/´-€œXZk;f U3£‡[\ÒŽLÏö¾‹5ZÓ¢Ú ?3ç­ñÀåtÌ |ßW±ÄˆÆ¡óØ"£0𦸂æ9ë*|Ž¾>Åã©o,lŽ¨\Ü +ùy£Û®ã»àR +ÕÓAhq̶ïáé +¢—¾MBv|ϲ^W»aqýa±L‚l a'òj‰à‰ˆ´%ö lö Ò„3Aùðë.õ¨MOÍú°+ê~ŽÉ£ÈUž’M,“Ë:LqS¶ƒ6íyô²Èî¹°=‡õl¥#3Z²mKÃåZ¦È*Pؾôçá¹ÅæÇ  Mdv`ÐR\>}$±·>qo=X®%ƒB9"\ÕRfšô +tÅCOÎP=ϱ”ëa1ˆŸŸ85CäzI2cì3ã¨aæWî?yh‡S0êÃqr¥p@›C:“y üb—¿HdGðlÒP@ËŠW2Ƴ/ׇŠZ3¢Ð5O=»!ÊòýfµX¨³åÚ’f'#ˆf$R•KtèFž*îENØÇFŒÃ{Ò¡ú™Ÿ¹˜&Ì|ä&98¡A*^GS„Þx|ÊÑ’SÃF=8õ›ó3ßM3-”z*·.&Ÿ¦r”(7T¾À²i‡ã CŒcÃnMŠIÅ£TZ|ÉðAxU©IHZ¼tˆn½Ì¹½Z}¹»¾ƒ[èžùv‡Êƒáx3ä Y*hZëoTÆdªª +Ô2;ÈׯüJܱ§“?æ¥VÆ{â“Œx ó†„…mï +Ô$J‘/©<ædR„3H6̆êȹœ/(²š~&w…ƦÁXƒÛÖ3 TÃç¼>3»ˆägƒ+³6nÙDÂD¢ï ã†õÓ ‡v÷”Ó¹ ¼€}¶œ}v—ó‰ŸÈV× —ðS)Lºòó)gßš¯î:Þqàƒ ¯ŸËfâ’¶È7Ýѱ,R—ƒ5w¹¶1órvæŒó';ì ˜áÄ-šsÚö ²éõÝ-à £Pdèb5Z™SÌû¬=\TCB*ZÏöVroäcDÎn(/:ÞÊkX¨G ±§·R¼¨¦XÍV‡Bk±5 K;Øð±J4Oc“8™¯Ú,e1%=~R«çlõwVƒ×÷wâ¥Q<·¬….oÜ#+$N‚µß;¦~~¥Ö“²Ê<¬¸½ãgĶVd#Š$Ô‰ ~µZž ¢ZÔÆpÿÀ®!øÏäà…ž¶jÜ!ç 58w%¼Ècœéâ•vÍ ¹R#a 6ÍJß(òˆr±îKÉ°NÙæÓ‘$´éY-VOBOíuêT +RªéŸm?¦öÚ %K<¡¹<—©çÜL¡³Æ… è´Å~°‡:Vå 5§ƒpõ7H:!>“ÖQ©è5l?üòð/\MÅ õ„„¶‡uT…ñŠ¦4(%Š8rÄ%t=€Ù·ì/u|ºš'1ƒG¬ëñN¦l?@}±˜¡(míê¹°@Û¼¦ªl¬u! ë--Ó*˜1P©•HƒɲÊ#¯ÄÈ«DÔ+ þù€‘?bZÚ›¹g8!ÕÕ=ad6‡ö!è[ígî{T G†AT¢WñÃ!ö¼4©CãüPÊ^¾UAó#KHi"—–~w€èôË5­)ÇÎ!V>Úìˆm 9Ï2~4C…é?aÞ°(ê]­rŠ.˜Í×Þ­ö ½µB÷™¥„"„mÞZ™ íV3œÔè:¯k,OÖ®FJ6`㎓¤‘Ü/²ØùF;àâ9A»ø.±|_ÈÈ·k„M]É ¹lYävÂÈòø†jÄuÏÚC8Œ2g±•ëŠº‚NçbÞ.Qœ[I¢iT’˜J´fRF8Ìþ/4¸îdNÐ=Ðs:­n$ÿ;C,ñ'q®©Ælm8#Nsn™|0ày"&Ø@ÙØÛê~Ͽ챕“ê£çMŠN¡‡ +äKž aÍfëÔžè …é˜R,ßšçÅÀˆ ð¬tl<ŽÅëwJØ* -6PI Ÿ +àxÃhÃ={ÅôÑFƒvò)¼ñ$cÝP(J¥ d·Êÿ¬ÔU„‰'½¡/u¨9)7%!3ÚL-QºÄÝ#>ÄØٌʊ»‘=ÃñÂz/ 9~iÜŽƒBe9¢®‘ävL5;&9ÅØÎ)òOS7Q̵Ÿë®/´åç$«¥H8U.ÞŽv,zÉ?I*U»ücê \s׎œ.½ãÌ=j{«ªqeR£MûAvlv;S)о…þRmMì"‰°”ýl"òLâ!Huª à☴dŸ?V2lg‚(…Ùõ#?ÜÌ×$ôú`å¼²‹nÓLþ> endobj -2807 0 obj << -/D [2805 0 R /XYZ 85.039 781.388 null] +5970 0 obj << +/D [5968 0 R /XYZ 85.039 781.388 null] +>> endobj +2078 0 obj << +/D [5968 0 R /XYZ 85.039 761.463 null] +>> endobj +5971 0 obj << +/D [5968 0 R /XYZ 85.039 741.337 null] +>> endobj +2082 0 obj << +/D [5968 0 R /XYZ 85.039 633.349 null] >> endobj -2804 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R >> +5972 0 obj << +/D [5968 0 R /XYZ 85.039 609.367 null] +>> endobj +2086 0 obj << +/D [5968 0 R /XYZ 85.039 120.748 null] +>> endobj +5973 0 obj << +/D [5968 0 R /XYZ 85.039 99.547 null] +>> endobj +5967 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F35 2880 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2810 0 obj << -/Length 873 +5976 0 obj << +/Length 3874 /Filter /FlateDecode >> stream -xÚµWÛnâ0}ÏWDÝ— ®];Žs©Ô•X(U YHyéö’P¢a“Z‰_'v¥áÒÒu$âËdæÌ̱=`±Ë&…ˆX²abHLSL$$¿°•†„…’5ˆtš.ýt¥‹º®ÊA Y²;ÌD\ïQ©ÝT×îT!DÁ¬Ã0•ÚƒSÁJ—Ï:fËm¶éHc“XypÒåv§bÅ­<¹·’ín˜Ôt’Úý#=>!ÙcÐn%‰eÊKÖG[–<‘4J Õˆ¥®ôk­…¯i2ÿªÄ; ©:T Ö!š¦¶v“Ð7¿1ðºAÏ_z~P•*Á”¿£0NâAÌ’ï|æyžðN8²á¿“‘˜Œûq úc>,tǵ4.i0pêˆ%P”Íe·Ú®})°“p¢`*ô§ïÄá$‡Â0D¼K"8ý(ù êÁ8ñ£˜OÿFƒW!ïΣç0SÉæ±p#ÜDCß„‰å¿»eÜî:¼“©q¢fãù È£¸d¨„Ũ30I˜bNFÁôEÄ[À›†‰ï¢¯j¹nÍ‚–jüÝ›ÁÜ™íjUšømdFáRLˆô/ÃèU¬ C‘ô"?Ã(œð†ì¡‚½Ë  ’Îg,ý$䌌çžï]îFwõEíc; Û¾·Ý›VÔ›wv½Ý¹¯ºåÅ)«r=×zåkª.¶WFÕ$œÅÇꧧšÎèà8wÍZÕm¶[N»ëvk¦ã~ÒÅ=ðöy?‹?âöé!ßö»×º†)­A¶óRw°¥±ïw˜µ4fö¼k °·ïѶzwMTØ„K²ssc÷f·P1B{¯J¿dv 6‚ű^ìí3_Û½f;bcàǨ/4„føu€Å0Á3áT9…6µ–ÓóåŒß*˜P¬‡]Å :Z:G^|q®¦~äqÓYp¡`\*X{ëïë!qSW"$³- -°kÒf‘Ï~E€Þ爞€á0ÃÇ1<ßLœ«„vnêNµ›U™©À5š]Ûç)P‰¾{§/Ô; ”%EËÞ4äæ3âoR+ea,Ö À*ÚIÏ:³Y|Õ`E1‘¡"¨b­üPyZN ˆÍ5¼¼úÆeÕ7FÖ6P¬C¢³ò~à?÷Àendstream -endobj -2809 0 obj << +xÚ¥]sÛ6òÝ¿Bo¥f*š$À¯—›q]7—^bûjår¶°DIl(Q%©&ýHI”3sŒC`±X‹ý†ÂIÿÂIûÊ'iú*Ë&‹íU0YÃÈ›«P0f‚2à|7¿ºþ!Ñ“0ðó ŸÌW=Ø×±šÌ—¿x·ÿ¼yœßý4)¥¼HùÓYšfÞÓ4ô~~šß½gøÍý÷Ò˜F™w{ûðá~Ží=âû··ÓYè½½ƒÎÓô·ùWws·3·&ì"ÇmýqõËoÁd Gøñ*ðUžM>C;ðCÞ^Á¾üX+éWWOWÿv¤xLOxÖt”øQ + øY¦GqÂ0òU«âÀíXÆV…Qì':™X$äUèŸ.TÚÕd@é|9FùÊj*÷ã,>ZíM=E*÷:ûÝ{ hëÀûÍr·„ÿëi”zŸ[F‰‚à ·®ùóßGþn‹ÞÜ÷ýC —Nq›ÅEŸ:3U×t3F Ãj”ù¹ÄŒÊ|ÙñǦ^7fێщC?N¿B'–ñ›å¶Ü•pжkL‡b†?‘‰òæÓY×íÕU+K  X¹Ÿ© ïd''š8Òy-Ò+ª?‹ŽE¼ÛÜxÿþ–„µƒUÍ~Vî¶0UU,GÙø:²\¸Yt%îU%©÷}Ù ¸Ldï ƒ>๊¦åo ·õö:.ŸJHp +úªƒä+RÞ#½"å‚„{Ž.JùkËY)u5+åƒÕž€ý <'±?´ì<î-Ž¼ñCë†ÑêfmðJÊ¿£Ãf½3h¨ã)¿qðýÐDªddü5£>ðÌÏ%ÝöF6Só—·A"°&aùVèdªü6ˆÅtª·¼Þ eX%ÊbÎX!xû‰¡¤ÛYâÕ{ø¦b02á‹šô¶+¾™mÁÂHÊLò©±óŒàÕÏÓY{¿ƒÄÁ^£€Ù†>sž&¦Â ¡Q¯F÷« Ï‚pe&Gâk¹¤(†"Ü A¿‹í¾¶µ ”IyóMáÖ :äE¥etr^8}HÃà'ö|³Üò,pÅ®.€Ñ*ñžy·Ý†1Á/ò¡§¹cZžûíIAü‡ž…–GŽNNô±D6/Y¦1 # CUbŠC3&a߉‰€ t-ˆ°q‘¬É2¨AŠ÷¢¥Â$ÅÁÌ÷™õÜqüBLÙ’ñÄöýÃœ§—â\²ŸÄÖݺ0ÏU1rP³hêÖR£|?×ØÈ8.X2ðŒ0ŽÜ@k §˜sl!v9óðÒž‰{¿¡€€‚ŸÃÂP·†6ûÂØG–ú+°œ§²C#S{ž’¥å‘ó¢ÀØH—T\Á- ä&‡S¤`\˜=ù²¢à äEñŒyæ½í )1¯N+ô™ã ö;YĹ*@oYC­G"*œÃ³t—5¡úa*1§9ƒ³¨ŒÂ9ih¿_ÐJT†z€ $úŒ›z{2 +˜ÊpßG)YJçXÒ¾e»a2D ïH&’$i¨V‘h6 +<%‘ó¥½=]ÙFã@Ëáë#Nîó½s» ¸õJÒ›L$üöOlnj2¤ qæÿ*e†sõÖm£­gÿNZÕ•î*##¢¼-‹ è +1©z’mœ&°]~¬àE_¯@ëÇy2Z9@Î kÒËšnYôc:}¡ÃÌOµrn?`ŠŸ£¤{S 9$º¹á”uûw‹K<>*£ë$ðæäIè:Ïã Út€þ`¸~» 'ß×°ÓÉÑf™îl@˜c”lKÄ ¤õéDçÚBÎÊ梑IÑ•%A‚¶í¨à)Ú¶€[g2„SI†p´÷Ø)Å/#‚aÒœapÌØ.¹>Ößµx\÷² +­ýâ‹D³8#»!JÓ!YìÒ&Œä’Ðv6&…lªuš%3ñ»-Aóû{#˜‘éì¨qKG›(!(þãÃ;tšºh-°]î(~‚–áÏG[ݨ§V±¸SÄàŒüS‰½7€ÿA'ÀÿðqÂ:ÉéÁÉ4άª‘-o\"”çƒP:Ä#ltÌbhIˆÏ3¬›i„6`d̺ZB% p 2|¬ +ci5'FNfÕv%‡v"_hj?•ÝÈÀU"–©Ä¼­Xj3k¶ˆs0`#K¼–#»`¯}-¶°Üõ4¶v}Ì™ÕÒ<Å Wóð7¬ š´0O'3WñüÿM ×RˆÀ£ÐÏrýjYA^¬ãÞ^`î¡}i76à‘Áº°fFÊÇÒ1Ü€÷Þì̺ܭ±”•x7ÄàE}Øu×Z +v’ãT¸ì£–ñʱÊBò×7ÜãŒ$avÃ`•æ²÷ãô83¥r‡Š¤NC*¹è§à!ßVj$ «®Vz`L¬Hó K‘Š!J»µ¬B.5ê 0CD²qe1 ïhmS-.+„<+.í²”C1ÌææÇq”¦X‘È]wd‹×XKuª,ÎÖ>r°;Ì ¸2‡…¢4p•l»HeÁ Êdw,*³è€8j0DÄ,íy°~•Á„| £Š)mŠ3Y?tR1=± +®æ§s[tÐk9'€àCK‚‹pÎþru’åÀñ¸œG‘÷T@d¤JN´Ÿ1({ I6þ-S¡s#´0’}Popx8#Ä>îÜÒ…içg;9>›9N®¤,Sw§måíX„YZ×DI’I]ߢœ%zàq*R¶Q Ki¢Ç ?‰–ú$¶¤ê“¸Œ@æ£Xvõx dš¸Ã]USäìu¶½ÁÓãì?§1d«U¹¤›„Ó/'ä[N »« 4Ó«(0[›ÅÕ‡JR¿S2.…Y_ 9I¨lö™J½¨w"GÀçÏÃ7-Û—–Ó±-÷9êœËP0Ît¼ßn€ùÇ°V Õ[äi/y6æ´—Ïä]óp?ýD;pp`-pœ“cä"D{Ï}ÞVÝoðÅÚ!&/[;K¦Þý|,Êz†h-A–qé¢n>YKÑq¹…Ê QžzT*k¤ +îÌ_–÷æ+ËÏõ )s4 ‘"ŸyIBOvÚ3pdÕÈ#Ž†Ù·ªàc”Âà½!¶ú#§ûyš)ºMâÃn4¿pÓåÅØy–2"Ó%–ö¾(¸B°ÔŲzáyT|ÜÐ}±ûFL¶‚0ÚÖ’#˜l×ÉZh;™›nKW•ð1¹—æóóúb”<´UͺÁ tpî²°“Ä.Bëv+GéÍ Ì2ü©¥z2¼ž sÖ.#P,—] ǶÒ#‘•6F6ZvcÎH ðȱ‡‰N +XXUÐÊ{Æ×@Vü5ŒËKóµ "I€ïŽ£Û}'p'‚Mò¹Ø°G  ¥hër¨ß¯$E2™† xÈ-ÇϬÒÖ,mPk®Äj­ñÙHŠž-ØRa „–rý5÷ÈÀ÷=ýZ‡š§º«ÐOìàÐÏè*(êx¹,¾lv ?JIÑ:ˆHª@ƒ-À{áŽY.]Yl°æ[.Ò›ÅöÙLe,MA"gÙ…ÂÂ:õ†Šø¬ƒóßð+Ïžgù?<…øš.¿´Ápé¥åŸD*³Ïï*åØñ\¼*6}GqŠê_ °ÝK-œt(ÜH„2x*Bzp –âf½02:zÝ_ñË.úã9)§ÂE®¸SGŒóŽÛŽa ­çgíÝy^ìæ ¿÷†bÕ–%}­oä–ÝÜ Ê­87ûž…À]Í_§ôn™$ÃwË(æ_±Dí§ø°]VœC¼sªÌÏûîŽgS´óŠc?”ýÞÉ?Gùð-±µqî²hÌsÕ¿]F‰öu _ƒ–œl¸|ÁØZÜîÍQµžº)ÂP6›Šã*ùE{J£({òlgÒ¢@†\Y)Çå0>ˆZÛKFç-Z”M”Úe)3øV™ Ë ‚¼f‘ s¹½hUˤ2Ò~E$9ù>˜%£P¼‰jµ?¶Ïû³4ŒÔǘc¦ÉPûšj*`ÒÖlöÜ;KZ¹&¤ù­1  |ÞBBâBh¹EæHYëˆý~p®T~±$sY4 å<‹l mՑˤŒT§ÖµŒÕË?ýÉü1+þÖ0]ÍM+?S~÷G‘…v/ôcž <Ýo¬ðG ê|ÃÿáyVçendstream +endobj +5975 0 obj << /Type /Page -/Contents 2810 0 R -/Resources 2808 0 R +/Contents 5976 0 R +/Resources 5974 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2812 0 R +/Parent 5983 0 R >> endobj -2811 0 obj << -/D [2809 0 R /XYZ 85.039 781.388 null] +5977 0 obj << +/D [5975 0 R /XYZ 85.039 781.388 null] +>> endobj +5978 0 obj << +/D [5975 0 R /XYZ 85.039 761.463 null] >> endobj -2808 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R >> +5979 0 obj << +/D [5975 0 R /XYZ 85.039 734.834 null] +>> endobj +5980 0 obj << +/D [5975 0 R /XYZ 85.039 707.735 null] +>> endobj +5981 0 obj << +/D [5975 0 R /XYZ 85.039 680.637 null] +>> endobj +2090 0 obj << +/D [5975 0 R /XYZ 85.039 396.451 null] +>> endobj +5982 0 obj << +/D [5975 0 R /XYZ 85.039 370.305 null] +>> endobj +5974 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F11 2898 0 R /F72 3966 0 R /F18 3969 0 R /F66 3242 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2815 0 obj << -/Length 2725 +5986 0 obj << +/Length 3253 /Filter /FlateDecode >> stream -xÚµYëoãÆÿî¿BP?˜JÏåK.Òâêóù|hîÔ³’¢H‚€–h‹1)2äÊŠšüñ)J¢ M}Ài³»³óøÍÌÒ9ðÏÅå¨é(Š]KÅñhQœ9£˜¹>s…Âù–8õ÷ù™ý>ôF®cMéh~O$óå÷Æ凷³ùÕ—‰©”2\ßš˜Q—ßÎ&®qË£³/7Ÿæ7Ÿ®±çàk|;ÃéÏ_&±2æ“çÏ®æ½cMßòC…çþröýÎh ¬}SDbzž¸¡Ü?pæ+Ô´£Œ±‰k‹1÷H}`l Ô̊ǶYžs«NuµÌ±òpÂó(¶Ç'ü aŠ¹ºÆ˜©Ð2ë²à}õJÖ6:A#Z&õRNlOÃn2]Ö;žãæ[²BúÈ0t»±ª á€\%™ad…Nô"Ú»–wö®5E`9{×pµ Ox?Q€ëžЫ‰r 2hŒŒý q®X= õ¦g)/x‘Å~_FŒ·ù…Úh0gNÞ”ÜZ”ëf“kìDìØX&:¹C™3„3i¹æÉœøÇí6¿öñ¼EúÀômPÀ5hÌÔ¨S2î²(hçõ’ ©L'æî8ò] ¤=BxêC<à g{ÜãýÒFswÓ†tɤ÷¥¬I“FÙø46ÁÀIœh4â´¹/Ž×Bðåú…Lw¥uuaÛÛíÖʳ5Èó$HѦNZÿ”g¶ÙñÑ^Y‘ G³mE÷¢‘Ì9kSñTD“³žPdqÜ:uÍ=R]ÉN–漊ñ”Û‹œôÈ]´\6¾]q¼-î0Ÿ ]§‹ô®qNH“šÜ¥ƒþ©F"S¼)!ƒÌ!PfDR¢IŠ2¹£ýéÍOjw15*”w€ÜS“ð×M•tpÇ2“ i:ÈñB î3=™ùÇ\gÊu¾ãV§rJq»’WqÒ)¦ÔÈuJHÃy웋W‰¼{ 'tÙRnuÅ: AØ zekЫz¡½Å5½3ï øEþeH&M 9 à÷^¶h+ßÀß'µ8µDÕ&yùÀ×øb|Ãíý>(ÝŽ›w–6ü$~ò¬¢…%W“¾˜çûû áûÞa¼:o˜@ðÎÇŠ…RôRêtI+h“’7Øk]ÆWÒ³ßQ©þÙü&Ñ]­=fÒ0/ô­›bûýò«@E"{¨“4;Žq›²­/@ì>¤jû ÄIJô ˆ“Ä"U]t÷Gž_ïá€+䔆ÌÏÞ1íA]=ŽþµÚo@çt¥;.i’û”[zÃ)³Ó¤n}5x‹_.qÓš¾áaþJ/ÙSb¥Ãá7øÖ0D‚? -B-\4^´ïúœª¤Ñãv›ÀÁìé2YÈ•%ÒçK©zVÒdÐÍ÷Ĩ¥zS=SivvìGJjUÈÐ$£V=˜á$w$©X7#0# ]Q,©Dq4i,Ë3):Ü­g0zG8@Ð.@v.Çx=áFBÜ9:Ã#á»úÔkÇvÃ~›ÚUB(c—k»,ìm5»®Æ’wƾ"ÝÕ:°[A•ÙiRаyOrçA¦¨êîQa_kw/Œãçð«ÔEjƒ}óÙ÷ÒúbàÙÌõð½ËrŲÉ+yfÅoøÌŠ¿øæXcXåùŒ¯ªô„žTÓüBR™¾’1®¢äq¤|K…êà¦|VAu°*H`ö}–§ôVÐ$¿~;s ²D9š -ªbI<%©Ørc¿ ¸– yÜ—ÿÃ'@ÁA¯+_\×9yF齨· þÞ.˜endstream -endobj -2814 0 obj << +xÚ¥ZYsÛF~ׯ`å ¬2aƒËoZJqœ²d­E—w+ÉH@Ö À då×o_€$§”JÅ zfúšî¯²gügÏBÏ´Üh„¶é†ál³»°f[xóþŠ…,z4ÿZ]¼ýÙW3Û2#+š­º}~Xζñáîç¬~½¸^µœµg²õçÅoX³DøõÂ2Ý(œ=ÃØ2mx½»¾LO¹òœ_Ü_ü»ÝŠß©¯҂熦ºçj°½žlÛ1]Û™žez–"=ê´š/74v(K\€,ñ6ÅñŽþ-æNd4L¢'Bã)ºª,v)=Êû®Nô†7÷üûi‹þ)çN`<×8·+õÖ±¬ïoÿs‡çy‰›i‚=ü|¦ìH{0ŸY +é6*'"abXé:¾ñŒç¤yŽO^;‹û Ï‚à²3ÑlðaS´¸¸ Jkœm*86Û4YYÈNMÉ«Ö¼#OÆ{ Ûç(,íŒÌ‚[)åKfzW¼îxcâ²nÿG´‚pW逨•>çOÄ ù û«—à“cdÅ&?$š¾~wꪭ_X¾úƒæØfh‡0ò>ÛU¦Î×­p>7õÚCPˆå–TÿRУê1ÞüÈ…ß×óÖ[?Λ&BÞîP¡qM†zÆqY% ¶äÐÛQVƒÈ üèõ¬vë'X¢–Õ´ÚeM“ +=Í’§ bÜÚ°Ó7s¾BD°ç‡ûòHR¡g"aY€/ èû¦ã¼^¾vù„xLƒÒ]nè†è`ƒl7Èô Þ¹öÂìï–g},i†–Å9Ï—ÿ¾‡y¹Žs ´GôÓì×KØ­ŸQˆPÆ/]0?gÛGnëH^ñ]Ït`—©œØ£!6xk›‘çõ“ÉOyìó0„Lh6Ä-ϳŒûx·Ž'ß7®“¬©Ò->Æja0_¸–Qæµ,Í« 3Ûu§YíhÆó–o9:8_qÝTÙZ§ t[öi’s„n.Ð< +,(Òß-[5Úßû·?{~ÿ`/2­™Å#SP[ Þ2ùŸÊ¦SÇ…DßGNj| e ‰áÆQ›‡h%&ÕÖ£·°¸¦ïÙGvÄÂ’›Ë9˜ó.Z1Žmprã-°Lßw¦yëhÆMê´±@çÈÛ + ä(›”„7¯åùs!Žv1êò…Úì‹]Æs”Å;À,GD%hë-¥ZàpŽå„¨gxï6 Ô< žA{ê½ðbRHÍ…à ÐNó* úQ¨a }È äFŸdóT@í[ì:œE   ™}Ljb%Ü»`7RLõ…®œÈ¸Aç/ËÉó…@Ø3)wûë7¼ºÚ qð c”t',?Ãà=‰{؈A‰¨$DÚB4âØâc¸;% +§:Šn&ÝGÇ1ZÙ¶YÝT´Æê ­£m0´CJ“ÆuÌô{Šœ–e|)’T¨nŒÓT'· k'Ò„ÿà(pºç©ñî +åZŽq#›LrÓÑŒ‡JÙܳ8û}ÍHÝp¾ç1ÿGh µ<^Ñ-Ç1Ô:tTež§^C/œÔEŠ Êã‹Ù ¿8…MwÐC¬þ,ð—&0:âïA{[*”ñlÃyð«³+'>FF_( K>ucÙ¥çôuC<$)W2§9[A™8’…ëÝRðz#J©Ÿ“¬íÛ¦eë¬ýf`ÇÀô-_Þï1pÉš~ ÀÀuá6 ä}‘ma¦…s‹ +™Íl ør¬qc¹À =- ø2N¼¨á8Ùe„.&Xÿ8¦@Ôˆ9G›ÃayÈå2[VÍã„É8ìÀðì»CÍ3ÚÅp|œ˜i¦çøÌ©¶^w‚ —Øi·_Lè«y Ë”€õÝ9>Œ€ÅX qƒÐT¶?yµ{4m Q¦«üþÕv}ËT¡«Â£ ¿Ôœ~”Ý7ñÜ¥ +béaÏ“¬|DýqÅOwU)¡‰ÎO·–Ò,‡­O8~J«§ îþˆ€øY4Ü{4ã±Ëu}€÷vó0ÃÑuχ,f©¸i8_¢— :GRô|™”dqru ,ljµKr°„R¡œÆ0…¿ûªo´ W5…–­,Òµ¯3V Ô2›a™ölª¾KJ—ÜùÒÇ ðù}݇Y0Ý^ömñ|)y¥¦p¹¥¿û¸’W‡©ÊÑpNIogstŽÑ¾kAúQÃfÖ4‹Ñ€Ïô!j"Tˆ}vm¤<ž•ÖQf þ´Ýú i…ˆ›„ÒÊ¡Ô ˜‡J @H›²À†fãCEšéWt”Û‹eûJùaû.f-f›xåTÒux7_¶Ý¹PN™Çâ­²¶–YnÃPŒ8¿Èeµ¥„‘ýE¬é°OÅTּ᧴¡H`2`wŽ±ú­xvÂçvû£ÏC•¾¿T¶Ñð!Þèæ¤x7µxI0ú;ÃAò ªã¤Íksâ+çÞ#0¾ïw{Î[¤G†S|zbŽe%;„T`ÙÓY©G4ž•4jÑËJ“ÇIVš>M.Eÿ´ëïmÔ8ÈÁãØÃ険ÍBƒ`1jÍ(\¶×]mÌXìPîOÒâFÖ/ÅíðÈ}Çò |Ý‹îIú3Bá~Û˜ú °óõwDê"TˆUÿÔqZý“§iõ÷N»d‰¿µüE\8®t’”µÚ.Ò-!w‡€âJÄ?7Ö±óîëZhÙTùâ2oWi>­d¨µ,ëGJîˆ&”,D(¶7ªä©ã´’'OÓJîÖ}êR⪅J½¿6Èb.õöñ㧹¡7'_Ž›#ˆåø½æ7îËuÆø<å™Lv<>ø +mÐÎIÀ/’š_r÷)ÇÍmœ— 9Ô‚m¸Þ#ƦíêD 2õ»vDv"<ÞµëÔqÚ®“§i»öN»D‡Vv[w·ØRi¤Koø·÷©ž:Ĩœ®â§—5•"º=S0$…DÜ~þ¢nóM¯ÍÙÿ„Òî—¤½¿)¡zLT0£-Š›¡–ºDÕSôÐÁhWʲ +êÞ‘›6Œâa¿qZþ«1Roý8FÒD(Ô긫¡¬:ú››N6n¼ìöIö®Þ´ Pú¡«9j§ŽË—cü½ç0™µ<®48í«Œh.ŒLÇ{½âºåãzþÓŽTÖ\`ÓÁw tòÁR¾ßœÂ )é!ùÝ×GåS—¢‘!Ìã×ùéI¡>i0$Á¼.ì9ÐnSž-‡º›ŸSÝjËcZƒ¡ÿdÁ1A]¯Vq·|\ÅBÓSñ&nÎj°~—ë²W±ãóYíÅ÷²iý;kwZP' Iÿ³ÊþÑŸñuŸ{\3tGþ¾ÇsÓ±5/A-ç”_ýç~g ÿÒð„3endstream +endobj +5985 0 obj << /Type /Page -/Contents 2815 0 R -/Resources 2813 0 R +/Contents 5986 0 R +/Resources 5984 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2812 0 R -/Annots [ 2819 0 R 2820 0 R 2821 0 R ] +/Parent 5983 0 R >> endobj -2819 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 376.733 381.942 388.726] -/Subtype/Link/A<> +5987 0 obj << +/D [5985 0 R /XYZ 85.039 781.388 null] >> endobj -2820 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 322.537 456.396 334.529] -/Subtype/Link/A<> +2094 0 obj << +/D [5985 0 R /XYZ 85.039 635.285 null] >> endobj -2821 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 281.889 450.669 293.882] -/Subtype/Link/A<> +5988 0 obj << +/D [5985 0 R /XYZ 85.039 614.088 null] >> endobj -2816 0 obj << -/D [2814 0 R /XYZ 85.039 781.388 null] +2098 0 obj << +/D [5985 0 R /XYZ 85.039 585.477 null] >> endobj -674 0 obj << -/D [2814 0 R /XYZ 85.039 585.023 null] +5989 0 obj << +/D [5985 0 R /XYZ 85.039 563.616 null] >> endobj -2817 0 obj << -/D [2814 0 R /XYZ 85.039 556.288 null] +2102 0 obj << +/D [5985 0 R /XYZ 85.039 470.045 null] >> endobj -678 0 obj << -/D [2814 0 R /XYZ 85.039 439.067 null] +5990 0 obj << +/D [5985 0 R /XYZ 85.039 449.052 null] >> endobj -2818 0 obj << -/D [2814 0 R /XYZ 85.039 418.477 null] +2106 0 obj << +/D [5985 0 R /XYZ 85.039 378.416 null] +>> endobj +5991 0 obj << +/D [5985 0 R /XYZ 85.039 346.89 null] +>> endobj +5992 0 obj << +/D [5985 0 R /XYZ 85.039 317.471 null] +>> endobj +5993 0 obj << +/D [5985 0 R /XYZ 85.039 289.767 null] +>> endobj +5994 0 obj << +/D [5985 0 R /XYZ 85.039 195.529 null] +>> endobj +5995 0 obj << +/D [5985 0 R /XYZ 85.039 181.373 null] +>> endobj +5996 0 obj << +/D [5985 0 R /XYZ 85.039 167.824 null] +>> endobj +5997 0 obj << +/D [5985 0 R /XYZ 85.039 140.726 null] >> endobj -2813 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F20 1617 0 R /F15 1628 0 R /F41 2104 0 R /F65 2099 0 R >> +5984 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2824 0 obj << -/Length 2935 +6000 0 obj << +/Length 2003 /Filter /FlateDecode >> stream -xÚÅÙrÛFò]_ÁâC -´MÇàrUj+k;Z%ŽW±ä‡­$ ’°A€@Ñگ߾f’ âÚ8»¥*aŽž™îž¾‡îÈ?w¶ã'£(vm?ŽG‹í•3ZÃÌõ•+ÎHÙNàÔßï¯f߇ÞÈuìÄIF÷+¹_þb½úÇw·÷oÞO¦¾ï[®²'Ó(Š­Wn'®uÇ£·ïoÞÝß¼»Æž‚A×úp‹Óÿ|?‰}ë~òÛýWoî{ÇN•­BÏýýê—ßœÑPûáʱý$ íØn’Œ¶W*ðí@ùÒ/®î®~6»ðœñªê¦Ê lhšúŽÇÊéd¾«Úì‡V»ÜÓ:Qh­ ]Õج´(¸Ñn2nŒ¿G -«ÉÔ‹­j›¶ùbz{û–4“©khUW[n½ÍË @îàó®†ÿÜoáãZk»ª×„B`=âpµ×Ç6#ƒ`îœ-e -y;š -9SY’=ÍŽÊž#Aˆ{àYãîê×úÕqUÝ–¶E”Æ †G¥[s€Žû¦Œiƒ0¨$¶®iqË`ĽŒ7)Ò6kZn? IYÝäUÉ€Õêâ¾D•sDÏ -q«¡—CåØ¡1À¡z-sï¯ùÒý¡Kß´íîålv8ì"/÷p'y —A71´Æçô<ÏóA°°7$vzVcÿ¤ØÝor \ÅIÿne¤­ø;‡›ŒpN%Žµ¨v9ÞˆŠcÌNhs¾ãËþ³}SÏŠ|NÔÌVyÑfõ e'˜¹±gÇQ$ëÓRÎ:Bb›.3–õYS·Ø·é:õ@€‚0@.° L£H"`ŠÊêÍõ˜”ÉömÅPµžJe‚P§Æ¢eýŽˆ Ä•¬ÅªÓ•4ü±‡5G -ľÔG,,2–€ðhQÁa¹¯ô.Û­lëÁí’À£¾+Ïʶ@ÌðØ¥£˜Då • ¯Q-ØDuB;h%Îz;ˆ¥ Üvs² šŸZ:iqcßȹ Sñ—Ñ.µz¶Èä=°óœü_À¡é´lv°+cFÜ À’ BcØÏÐ뙋ˆì"“Õ°Ë+ú æ,š‹"_¤­AŽXoª†yº¨s„hy½æ<‹‚¦gêûj,i­á=Íq£Gn¯+0é²IÅCf3–úñ† Æo>³ÏÜk–Ñð2kÓ¼hÆ/DŸ÷(x)=º}¡·=±"£æ¼Mã€?f-Nx–âù[Tí}Ãã|<¹àÈЀ4|"£ §îðß¡(T8à‘3“ŒË4¸&Õ •Ý -÷AÇÁÀ¼Ö”cM-~I -ybÇ@GÎqÀ³vé:òæ®çÚ‰ò¿ª;Ïà^÷x¡öbÿm ò’ÕßÀlõ ÁA/ -\G}c_Ž©öómÞ~{·©ÏÍvÏ…_§d¸A`»q? -8‹ÎAž -2æГ•y%¶²ã1sÞf£a¥Öï™X€]¦ì~S¶³ý%¾õ‰îg'ËûÚøTÖK ÷”²nVz߬>Ù!åî±|Ð9}æ&êò%Þ¢½Sx©-Y‚ªoõ@uzX0œ„‹4~`Dh¹l£iVŽ‹4#ÅsÑ1p<Êz!v’K3®O Ö•æ‘Y[­I7Vóì¿­‰q%° 8 C숀¼ÊDC¨!fn•¥í¾Î¦5êuL.oœ~Çq4Úªb›ò•¢ þŒ:v" äØl'W¶Ì´Ó”ðc)W)>«»ûTÄÍ=‚‰÷Çùœ$æsÀ¤8‚X2¼¸ -r`ntt² d|ñ(òíÄ>E0ö=z?ßãÙ2NvœPb<ú}äÚŽJŸg{m³[D³›­;z]F£)?±=8Ýnù=5‡ÔܘTÏ·~L·»]r@ìy:¡„ÖO(0 )«î]µ’ÀV“NÌ’Ý6QÉð›}&¿‘EV -4:ÕjÎÓ㋲ùÃ"‡D9T’è¹$|¬‘Ü—¸ºÚ‘|Ã3u¿s@ KQ±yسˆL À=£o¼#çESÈœ/~Äuœ!KðJ-ÏV«6+)—v,85ÿ’ßgŠšAvt+šÈZ€³Ukl¥ÏÚÓùSÎÜyIçíÙý;¦·KÂÑc '?Ó%ßUv€Å -Û\Ïø¯u`Šjæ&ÑhŠË’?§–ÆTCžç…_â£"Îû‘äF¤DR1àT™Ôè"7ý¹éKJp%6YÔp®v†òxW»ñ°Êд\‡ñé=dµ¾œÓ5w•OopÑgé؇ÌkÕ¹T5Ί¿V˜šõz££MÑõªny"oÏóÎJƽ ^°õ}ã„—¬“‹}ßkšT 6šûÆ¿ÿK*SŒ2Ç…½i·ÅYiE¡…½XZ‘Ù/Š˜~ªêÎéWÛxqßVµ©!Ë•˜ئ=çÊ.Q,ÁªÚÛ<…d0”í…_‰‹Ÿv«,_Ùì-NýX• UMã9Ž7»'ZÒbvf^"ÏöÂä_õìñU*¥^èHŒé)Ïz†ºàZϸÇ9%4ÎÊ£<ÜO–{Êá)²sSlÀH¡11›ÿ‚ê)ãÓ(ÙB“©ÀmS²u•²æ‰œ)v N'|›¶ùVºTUYoPã’Ë/{“áG]T“Tß„/ˆ¬ãp“« ÐÐá#ny1‰&ȳ¤QAœãâMÒ+œÑÆYÙ~ ÂÔ^´¿—ãË‹ánÚnà iä­1ÄuƒZØ -äËyZ¹¾ëèE_õ•æyÃ%˜¬Ýp~?f(zdyÍm*#{ž X°•”&®7 BÅï¸tÈ#&ýiôÕ‡Û;n¡2ÍÉHÊ9­9ï¬Xö¬*³grÛ¾@§Æ…we1™/SLîS¾{‘íE>˜©P?W}u¾Kz­_#mÒV×öz‚»k5@àÜr ªeA¨Ñ'ÐŒž(Ñ7³‹Lð<;pÿ„ {Q½Š¿¬7Ÿ&ç3Ú·kt©›‹ÍÄÁzOÒõ$þÍ%öMÏi!3ŒE”™^¤”6€ß#¡¦oÃß}ò>ÐÖÕ6ÜA—ÃQ˜kN´5˜.8bÛ”^¡Íϳ!–-ä°ªWü¯l³¶…©®¼u…‰£‹B m/V«;7&~«Ÿ6°¾YÌν2ßö~öÿC;Ÿ¸XCðA'Ø>?xNç4{I4ݦ©’¢å/y. Çþ`p2;f•ìoÄ®œœ#.ïܹ„ò8¨3l§W¼à“Ú¾—/³‡œ'ƅѾ³ÙpxSž—€Æk™nÆÚžÂi¡í‡ -®+°‡íõM©Ÿlå½–_éñ­wô¢;Þìyy&bÖ‹ã§óœÜ½\Ã@ÊG_÷_m´1=~-–íN´`í†xHåˆÏÅ,m r#ÏùyÛpãäšø51ìDæAï8#¤¥¥¼ù¯eØ‹e -Hkoʣ߄`@L2I$ˆ+‘‘»ü£ÔçXÎè;ú±ü!åu ;-ò¡çÆõÀkÖV~­YÒ+YÙå@)™Àð²Ëg"=]g©Q œ,òÎæ+ˆEœÂÑ4 …†fÒ¥â÷~ôÅÅr×= "DülÐ:}hendstream -endobj -2823 0 obj << +xÚ¥XKsãF¾ëWè¶TUÄa³Ùd3—-¯í8“±X)o*›-Ñ23©%©õèßï IqlJ9lMÙ4€ÆãZjàŸšZã:&VùÚÚér; ¦kìÜL”£˜;’ù€æ‹É‡âhª? ÒéâùÈÇø‘ÑÓÅêwïòÇ‹ûÅõ/³¹ÖÚ µ?›'‰õfÊûíaqýYÖ/n¯Ü`Zïòòî×Û-DÞ=ï>}¼œÍ•÷ñ“‡Ù‹Ÿ&׋^³^&´HI­ÿL~ÿ#˜®p…Ÿ&¯S;}Å8ð¶·èå›H»ùfò0ù¹g%{ÑTNYëb1|k£1eÁÃ`8v^ë+ +šÀ7AÔ[Q™U 5¬™vDdƳF Ò¾À¹Œ7EӊݪgùÞ°½ér&‘gå:_ÁòQy·•Pîj °¿$Ëæ ýmŠr-›E#ß2Ïic%"i Û,-ôÊʉIY ºuÂë)¥B_«pšèØO7£™ˆF,?ŽâžY(y/OGdì³â„ä/¤éTü1ökÃ÷¬É†)¢a[mŠeÁ«°^h/«s7ØÁ»M‘¯dþŒi]mer±l‹ÿÒy&VÞ6‹:g¿´UÙafµGî c¸¯eßcªoñ’÷Bºû2ïX’Žˆ€ìµ´zرçEÕÓ^B²FAü^:ñ’#"»Ù“^:'®óÒYi—Ò>U몄¥bë5ËÎÅ®mdMFƒz_rÀÎm”z·ù+­¦0–ò*>Ò¹2ü'ÍäÓJÎ }Gó«Ç}7››@y›“ªÀ¸&.é»ØÚf”NëÄ{ê|i„ØS›8WR$ñnÖt‰IS–€ï 1¯ö;™uщ5–ì8W`mŒ÷§ÓxÆqKRþ˜à¥ ^厡܃ü+Ë[îÛ&ÐFs(çëD)ߥǠº*Y§fsÕ¡Ñ"¬j$27²-Œà…#zY”F­7öm¶/¹#«÷dQî›9 «ê-å_‹rÅž…ÀWâ|2bú‰±çS`@t::"2Iz*Ίs)p^šK¡4 ™: V¡––tý6¯ ‹2)BG…†¾=èƒh[HÄáà3‡ÖVhÚŽù ïïÜÉÂ}É]µ”–܉£*” ŸÆaqÌš0ãl$z²-{"/šÔ[UÛŒ‹1é¦øâ’OÇÄ(mIPaåJè+YÚf}DâN²F¬šCÓe_z{<"h)èNÁ³Úa»£{2¸¿¿@Ö"¸åcí|¿ûNV.áŠüFÎ0È!„R¢8VáÐñîs…vʱ²ë¤X'~ ÒÉæn@ÃÑb7ò5˜¢«ËŠPù¡•èÖ¸×õ.«í–4!ÿ#¯k4:ðêæ”>ŽÍY}Ž4#Ñîô1)ʲè:mDá&k{ÛaC³zÚôî&ƒ+‡²Rˆzè¥A=uLWG–Š‰W+´m%_J¡"[—RG€¯Ž—‹ÔdX¥ÌmU;¢·ì[!ï÷aV1¼xFÕ‰<‡¯ ZtŒÏ©¹9bW“u×Åa¡ÚôFAq븃mU6m cºeTß„ +Õ¨XÊzÑpÈï»sÍ©°4q|6Ü~ŽJZ°û 1уpT•c„ƒV]8$.¯È7Òñêýß¹•½G&§?5-9¥2Ê…ójiÎD®†¾‰¸ð磩Øì®Å  ÜI­]l¤™'üêÆm~ÍDzaEc.Œt?èodG‰oÓÚry®ÊçbíïLúš1ÞHF9JDbä"ƒ4á^% +P2¡àqÑŠp‚iš»ç +3‡'Ì‘´qâxß^“Ú P~º»¹ÃçvL›6ë´i^RxŠ%ÊBûMB|$&îõC®Æ›s›­rY-)’)†[é¼Î;ììê qã[‘cj?®ÃÀø_÷Âä¾–ô¦µ-;bIÎyáÂ#%¸·–Óó%?éŸ{i¸4H™ªü›ƒlKÕtª-Åsb¼‹÷Ýâ+C^ý¥G–4`‡q«HS…®®àþ§VvŸöNt*o7zZI¬È;ä¯{ÜÚ~‘ŒëúAv7ÕñXËž”ËN™ÓT`a·æ‡É*wú²½±÷ýG8¶6 æžÛ¡ÛE/;dð0åþPy‰87r½àôx¤ß'(áÞGI]œŽ5Òp³ô¦{ûÑš<-u·Ï » +_·Ù“£§UWfZ²;3ï +1’—‡kXAàø§_åûAx|–X£¡´ê¨Ï’±õbxïGΕ”~­ ¹VD41Ä–Ö ø*£²Nn é“Ë+H]ÉΖzI4Ú4Õx¯Zï7z!…˜¦Ì…:fgÓʾáGkâr£Ó$’ÁMÍÉ·Úþ‘}‰k®µôìh¦ÌŸ¾ÀF.üQÐS€–Èr·Íùz¬x«QÀ }t€y»¸ȼ¿û4.‰öCôO¤*ÌH݉,ºo#›”‘²®•îtªêúX…eý™ž0DZø6T±¯3ă›iïšÊÏü“ß:ÊtŸVˆÑÏFèe¥]?Y´u€kŽÕ?üŸü_¿ÃõU4Ò¾Õ'Š¨ C?T.tsè·úmñ"Òïþ¿ÛâSendstream +endobj +5999 0 obj << /Type /Page -/Contents 2824 0 R -/Resources 2822 0 R +/Contents 6000 0 R +/Resources 5998 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2812 0 R -/Annots [ 2826 0 R 2827 0 R 2828 0 R 2829 0 R 2830 0 R ] +/Parent 5983 0 R >> endobj -2826 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 706.436 347.579 718.428] -/Subtype/Link/A<> +6001 0 obj << +/D [5999 0 R /XYZ 85.039 781.388 null] >> endobj -2827 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 570.944 512.306 582.936] -/Subtype/Link/A<> +6002 0 obj << +/D [5999 0 R /XYZ 85.039 748.383 null] >> endobj -2828 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 559.819 279.398 568.478] -/Subtype/Link/A<> +6003 0 obj << +/D [5999 0 R /XYZ 85.039 734.834 null] >> endobj -2829 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 346.095 365.259 358.087] -/Subtype/Link/A<> +6004 0 obj << +/D [5999 0 R /XYZ 85.039 693.58 null] >> endobj -2830 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [122.225 318.996 496.486 330.989] -/Subtype/Link/A<> +2110 0 obj << +/D [5999 0 R /XYZ 85.039 637.099 null] >> endobj -2825 0 obj << -/D [2823 0 R /XYZ 85.039 781.388 null] +6005 0 obj << +/D [5999 0 R /XYZ 85.039 610.485 null] >> endobj -2822 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F70 2201 0 R /F18 2207 0 R >> -/XObject << /Im1 2193 0 R >> +2114 0 obj << +/D [5999 0 R /XYZ 85.039 566 null] +>> endobj +6006 0 obj << +/D [5999 0 R /XYZ 85.039 544.803 null] +>> endobj +5998 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2833 0 obj << -/Length 3056 +6009 0 obj << +/Length 2369 /Filter /FlateDecode >> stream -xÚÅZßoÛH~Ï_aø¥ò^-ë·ìE‘&i6{MêÖÉ‹í>(¶b«•%W’“æöo?~äŒ$ÛJ÷pEq(Ïpf8’ó‘ÕîYôÏî}Ór'½pl›îxÜ›¯¬Þ’FÎl5Ãêy¦øz}}4z8=Û2'Ö¤w}ÇS®'¿O¯Ï> †®ë¶g†a86Nn¦Û˜ uúáâêúâê=ˆ¶q3Å𻃱k\þ¼þíè캵íÐ3½Àž_þøÓê-H´ßŽ,ÓŒ{Ô¶L{2é­<ß5}ÏUýôhvô¾æ"c^OVuœnèŽÓÓf´›ëÖ§týŽS.ËÁÐw|cøUý.^_Ÿüª;ÓãÇWï.NgÇo  -!¾¿¹8»Ö«wÓã›Ù™ê–§gÿº89{™|&¾núÆ'Ûõ ˆžë™.}hCü o>,/>—³¸¸‹—« ­™FËx–ü;ÖÌO·›4þöR~„x™/ât0ôËjx[Â֮ҸÌÓm•äÙóéìÅe¼H¢i^& ¼¼È6Ûj–æ•ÞƒD¸)ãwÛŠèoN…ºÏ¸–WMKÒøåP1Ø·òгLkB¿‡ü½±]bú“ ÓؼÿÄ´ÉCŸâë,â#-=}—OW¡g;iÙNí!Øæjkâ*'&åØFÜá¿!Í—ê}íÙ¦åM&®Œ¶Ú,i³ˆ £‹µÝ;ÍI¤^#‰êøAÏ L7´k±Èuýô*¯bõwÍ7ªUTIë!©VÒ:¹!ɧ3éDuzrŒF`ôWD$?£¿%˜ýãŽZù`èŒ|Uɼ/óp‡§§ÒþdùÖ†úé¶nÓq‘vø‡ÞÔqc¾Ý”ù»DPh2G“˜Ù2ü8À¦[é, Fö¬’^ÇŠG•ËoÁG_ÇÌî–h$š…š†c%|"B)Ï¿Æ^Í}®…ÈT¥Ž\Ægeyc#ºœ;ºMp"NŒ Ä.@Ï*™–op­JéT«b‹VHû1á6¹öáZ–,_×ZÊB‡Î±iòKÔÖýeºéÞö»Ê[m\ãl6}&ÆEo.ú_‹®æ ¶HÓG,·°êF4Á’UP»8Æ´H`ÈjZäB`Õæw|1H÷˜ñšþLÀ!„90ûŸ§gÏÊÍö¿ˆp°¬R´>±ð`.¾çWï0| FDðèðÕ—÷¥ßLöÄü1Ú¾Á‚/b9Vœ-b¨š|ããöÅ[,žô±·Ésqbr¹[!Cøʈæ<Ñ7î“H† ÉveÃ"ŽàÔ-ßñ[j3\ðÎ8`&ìY¿q³?À:¤+f[}wÍ}tr)Fûá®mY¦çÿ^Êö$ì ë0û¿ƒ¸B³! ´â±Ý/îÈ:¶Óàƒg»F}èXúý3ä S™y¾Ê˪œkwJ6U_p‹¢T|W([ñŽB¸Ô~CíóéÛç2gÃV‚½ïÁmKú-z”ÙØ>bÆ28Û¿…@Ë°>zcÈiQƒî£ë’Žç‰:Žc6¥Ðh3þ…>—æB„®ÝŠ.z.(I}fè´ `ØóÇ›¯”Ó*Ћ¥šðáü;YÔªª6/F£‡‡¸oæÅrTæwÕ)ÂM8ägcoW«j¤ŽH" ÞÓ^CZ t‘oÈ€ . Tj‚¾e×D[ÛÞ·Dw|¹îYËi¾iG¶ ¦AëXš2‚cêö ¥¨û£Ï§Ì(¡jOö)cƒc0·%L‘,Œy³…Ò”sà3„>™yŨ{¯¢‚Oæ”Íyp[*Z}8j¯óRüK¦@àJ9¨à~h±‹l—ÃO–í}‹ ªÇ8EÙ\‰ÇŸ˜//ÔlÎq -iÿåZ–Lo¶àÍâÁl«˜ð[ñݤâEÂà~à¤$åÌ@É{uÓ×çPRþÎa¤t -MË—VηõQ:+Þ–Š©¿(¿—›Ó!IÈV» Š‹­Ÿ) gî°zÃVGT Ã¥Z°¡òƒu¶Ò -Z¢ -í&҂枉á%*Ö¶„ªÒ fBWØæñI¬„«B-IôÙˆ‰š$à ô)ÕU±vy^ªÎDÍD¯mC.V¤M¢å6ùÚH•ó[YÆ'×öÉvA£)¥i–óÅ!²©‹=Saät•®ŽmŽ)ý·ºÆ| -ê¾ = „'Q&’4ZîT_¿Ô* E^ôeäs~Û(¦ñ‚=½¨Ôˆæ¯I›¤NÁ³øÕá¡CÓ ]ÀºúÁO9ôq¡‚e5é*VÖ'@ìû¸ç- Ý'5ZµÃd¢ë…×xՀ룣Ôïú<‡ç¬ ÏÒB&B³V¼‚"%µG£T`x¥À»k5þFƒþj0èÒàeð‹Ï½Þ |`fe\³'ïé~왶åªå9L€ÅÇ/‰ªd<Šw~kpš:óçqΉ“vè`2‡I¬kÒ@¢nK °25ƒÊæaϺŒ)JÌ6¦ÌÓ$Û±Õ_)ð¡< ¬Ã±ÌÀxâï07_!ËUE$.—åñ½)U;—ße¬A‡:‘ü¬sœ­ELÑ*å‹{·ˆTË¥>kùâqwŠÛ-4¥vÌ·ªÚ“ûoóåÛ¸Ñ[*R‚ñ²/Ë’L̶“°uì(®æ#¤mügaRx½ë°¸úïn:ãrI=…†Áa(:ÖqPqù!`!ÍúQ"Ô¬•Í %KÊH:Ķ}Ït]Gí=º -º>K:.Š¼8(†|› Oå‹š¡íýõ‹é¹ÝÕ‹ùþ3"IÓ¡2Rnf°S¯ç*V@W+§’qÜJ1רãþ´áœoûPFÈ‹dÉZW!í«Wƒ»ºÔ;8S ëfz?ªøÝÊ <ˆ^gÙ€âÀ¯ Úýh[åÊSö Çø5¦IÖL+åé³^Àl)€V’Ôq\âE -äe½Å¥¼ÍØg2QïX˦v=¹AGeN»n¢:QÈE€©iØT½ËùLa%§­“3\©F]á ®F¬–·êÆÖôœ dÄ-ìÐï `÷K¿È<~±ã p†úuAÍ×t¥yxøUó¤©ÿòÝ´CCR®¡I}MààÙªœjwÝæµVÓ÷YŒ÷dÕþNÅòy¾-Zš泦´¢áT Ìßk¤¾úÒoK—-K]ÿr¡_âg:oà@’µ„ÉF%êñxOU¯·•\>ït!u1U¹ˆáNÔ'‹\ÝÖ› ªù&S§íg÷hÒ¬önØŒÁÃkñ-·­wõƒ`÷+6¯¢²o>HBõfÀT -C<+h¾q'*µy–¯jÚ•¿µòvèJµ¢½[ õ›ÉZUoê P®žà@ÑfãkƒTÂÄWs6œ¯NŠ±R¿ïZ¦ÜDY6З^¥™zÍd§` nù“ŠE¢Ÿúˆêì¾ Èͯíd>‰´¶e›ŽÓýßš7Úøžï†üµ¾áõ4bÛ¶³/§*ÜvÂý¡ß-endstream -endobj -2832 0 obj << +xÚ¥XYÛ8~ï_¡—Ed`­IìÃff“É`d'ô™<°mڢÑätæßo¤DuÛ`¶x‹Åb_Q1ü‰ H£X•A^ˆHE°mnâà3¯o„¥HR¥Ií “k7»Îd'ùE»Ç:e¤4/77·¯dÈ8Ê2lö2RBY™D‰J‚Íîc(“hµNÓ8üÉ ŸW"»Ój­²<|ßwÆ"© wßÂœnõÁ4¦WŸ6¿Üüg3mowÏÊ8JÄEã`-U¤rõ¬ôY–à _z‘Ày²…ô !K'½@ù“2|µRqhôxîAb(v"ïXþ—¦5xœ‡k°¬Ÿ•q¦!Eˆ8*ãr!£,¢<ÏIÆß:ÝTíaµ–e¾5ZÅBËIŠ3åÆÆÞh>H.‹2¼_É"ü‹ç†®ÁóOìáQfÇ3¬Ð8$½ÛáÁ’×}ÅŸk4ºå^‘„´ +¸µ+&E!ùóºÃ•0HÒÃ. eÐ(Þ²@[åËÙw=è^)”­H%¡Þ*`UEËÆjìú!¢åVÄ#]êNÅ™§;hÔÓ-ÃŒ®Q›pº<|°#-~ÓÇ"Ü'ÇŽ‰ýÙêDÅ9œ‘””“ªÖ÷v/bÊŸ-²êZwøÊ5FCº™ê<)§çÝtáŸ×tܵ^«3r¿D¨PøMHä£áö‚%‘1x—j×ìQ¯h)Ø!A-¢×[¤=VÞ8*‚6m»ñèÄD&à[XÂûG«F\À,ôiœ‰‰Á‰®ˆªvNœûç-ÞÎñ‚™ `+«®e‹é߃ÆæŽhlCÇ•=ó÷éaÍ|-h"TVïÌΚ0’±p‚OÏVóïIyú.Ø¥úŽ´†‘¨lf¨tÉ€ç›êp´¦t‡ +ˆÑ GÐ|+g„¸¢E«êÙ +[ÍDtK0Çî$Ð?“LX ù‹ç´Õµù3éR×ÌG[o½h¤™CuOG‹‹ðD§nÃ}¾`(ýbv¾iq0OºGi*º +<_­{”R‚; “Q¡Râ2ìö¼ˆø~Ò'0ç«lNÈbtwïv%uõ@lÁÝA +ãÇn?Y&ŠVªpi׸OéüÁ†?¤ûçÆ=ì“;2ÍŸá<ŒÚ¹ Ù-qý‘mÅë?óÜl’­ÙºF§`jç‘s‡¡ÃÇ´7Â8’›ãƦ÷ƒöSºŸŽP’ ž§;¯íè¯h;ÙŒ]ÊEp¡e"ÃÍÑFµ4ŽCë¹°ðdE*­YxŽŽ„¸¦Å£ÌÎŒ´d2ðn Æùh¤À3tƒ{  è Ç›ƒøè¢7hÏùýÎà°õàÂ1\6“»ÁúøPgÊ6 Ö`£Bíâi] U¦Ïæ:hIr%™t EZÐBµvxº®!”$+£,——’y$_Ÿ(3¤øróñSì€ò—”± G¢,ƒæF¥e”–™í×7nþëõ°\R\eC‹b`Ã-K½ä²v§_«TF¹(&Á „ˆJôVÔQe%èj,ØïV0 +ÒÒ•‚z©Ã­Q9(“AuðŽRŠ$QDã·éóÙhàöM#ƒŸ:7XHÌ|×c†y…óÒ,*‰œ„5R¸J¸È†ååˆ%ÓÜ|dÊdý>ðK1¬ Ëž8°õˆŠ’- p¨`µâÔø›æ÷LÍ;gûmù—ÝòÄ[Ã]mÓ WíŽSèpÁÝÞm’[Çßž8E’ 0­2ðnóïÛšŸ(ó`ÍËþ/s]š’WÀ9T RŠ@©"’¥¢³¾¤›à˜…ŠR9«{˜Rˆàendstream +endobj +6008 0 obj << /Type /Page -/Contents 2833 0 R -/Resources 2831 0 R +/Contents 6009 0 R +/Resources 6007 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2812 0 R -/Annots [ 2835 0 R 2836 0 R ] +/Parent 5983 0 R >> endobj -2835 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [351.165 473.426 512.306 485.419] -/Subtype/Link/A<> +6010 0 obj << +/D [6008 0 R /XYZ 85.039 781.388 null] >> endobj -2836 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 459.574 136.217 472.476] -/Subtype/Link/A<> +2118 0 obj << +/D [6008 0 R /XYZ 85.039 761.463 null] >> endobj -2834 0 obj << -/D [2832 0 R /XYZ 85.039 781.388 null] +3026 0 obj << +/D [6008 0 R /XYZ 85.039 667.044 null] >> endobj -682 0 obj << -/D [2832 0 R /XYZ 85.039 171.068 null] +2122 0 obj << +/D [6008 0 R /XYZ 85.039 667.044 null] >> endobj -2837 0 obj << -/D [2832 0 R /XYZ 85.039 142.27 null] +6011 0 obj << +/D [6008 0 R /XYZ 85.039 642.326 null] >> endobj -2831 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F70 2201 0 R /F18 2207 0 R /F15 1628 0 R /F65 2099 0 R /F20 1617 0 R >> -/XObject << /Im1 2193 0 R >> -/ProcSet [ /PDF /Text ] +2126 0 obj << +/D [6008 0 R /XYZ 85.039 490.395 null] >> endobj -2840 0 obj << -/Length 2772 -/Filter /FlateDecode ->> -stream -xÚÍYÝÛÆ¿¿BÕK)âH.? ø!þJí¤ÎÕ'#-â à‰<Š1%Ê$ùŠ"{çk—ä‰r -7ÅÇÝ™ÝÙÙÙÙß̬ܙî,lG%³(vmdzÍîÊ™ÀùöÊ•ÎÌ·0@Ö³õÕêUèÍ\ÇNœd¶¾£!ëì'ëù_¾¹^¿|·X*¥,×·Ë(Š­çﯮuÃÔëw¯ß®_¿ý{>]ëý5²x·ˆ•µ^ü¼~sõr=XvéÛ~¨pÝOW?ýìÌ2PíÍ•c«$ž íØn’ÌvW~ ìÀWÒ¯®n®þf¤0ÏŸñ¬‰Ý-}7°ìi©;Ž}³M7˜Øæz[¶‹¥9–þ¦{ø†‰•/–®õ9Ý`GUŽ<×ÚÔ»’aŒke<~ ÍzáÅÖ‰ûM ßت;îžU«~BK’;^%eÚ¡~¹Ç±2ïÓåvÂ/E)°?Úù±¨Ú¶( -G’Z%ªU ÝgKÙêÒEs%´WÜž[þ¹l»r_po¸tÞ0mŸîòŒ›óOGÐÐà áR8iþ—Z½RCú®í?¶UÓºÕ!Ív¸ƒÀ ¬å¿,dҢĩùûK}»$îò7e= ?vœóA—U¹+»§®ãùLýà*Ÿ¶ïÅv¨ÂÑî‡3i‘›ÉïbäK/±ÝØmC\ÅñL#8StŒŒ)x¼(Ž{d¡_Ñ¢ysϤìƒÐ‘üˆŽŒÎ7ü®æïG -*È,Pºåé5Í -,Þ92¿{&œ;æd)¹p>8sÚ– vƒjosQ좛€““f-ßëŽë7Zݤ¹ì§²Û²®Ô¥NÎSª´í¸GgŽûìû›zŸ±D^ pXÆSA¦ÓÍ¡ñùG\Ö&'~µˆ}2‰r<ë9N0(´,~7È CÓÖí©¸¿&§vWÝ£¸ÇȆQۜǧš™h‘Jèûœ4ÔÛq”Yï@·“(Ú4Ц LüùÁµ6Í9óh õwíñùq´ùZK‡q§í«À ÐÕÈÏP?F¼Aú>˜GÜ/x] OØH|J'ÍÝ9„?¬›z' ÙE+Ó2?«“þ,’pŸi;`k=Ñòâ Hð"Æ9íÙõx ñÆ8¶nq?·{‹ oÆj¶Iiì˜Ü¡Ì{&‰DÒµ a‰õ -¸me2m÷žü3¥&Æ;0MèD‚4¬jkY$7AƒVçò—ïzÍ7žcBÚçÛÎhÜ\ °îŸ)ªÜ&¾ï!ºã0$Q™½ ¢Ö{-M`*­MUæ‹€Çþ±;G¾)ú¤ûŒGIZݤ;œ{›Švƒc9ßa{à°Éÿ O)B…ÉäÞahyÐÒ–GÏ›T¢1»5лJ[‡ƒ -|b:ûub™Ž¼uºŒz@Æ1XE¾µ§0­×µÀÌt%ŒÔœÜ™\ÕÌ:•¨~5a‡[ íHÞG”SιK¡¬içܧ(öOgPÉ`ñtTçá‘æ ¯h6|[9$ÎX€pM9 _ÖMSâí §PÖ‚'Æ ’Á¾¨®Ó2‡!GqcíƒÄIG«t#ñÞÈõÙãd!{ºÁh€LT©¾á¶ròú˜T<_ žu cö›\x5ÍÅÂNºÙÔâ C9ŒwÚÏü ¶^#zªHB 9O¸bJ>I*ö$e9´û 9¡l·ÊüaÒµtmø ™®]Ž¶ƒòk4uˆ&%ìr<¥Ä `?ñ•u䌦Ggl“Q8&ˈàä„Å#ð5.aƒ^LJjëÇ’òÔÚÄ“–él_Šô%™B›í8@ -å¿‚0¥HÈè¸u&N|**Rá먂í´dÂÇäR_`#¼9êÎÔµ˜Úq¢éûþY¢ID<ßW|åýññ®‡RÊ1®#·- ô`by¦¢bg#9>u¶<¹‹Ô˜sHE¦1¹ éÚòÈ}1Àœ¨o ò&鎽]¯¼ïV¿ÆHò2•)4Ø7LÅð+]†@®IKZ}–Z\é1 šœ`‰GêìQ|ÊX*°$̇ìðÝÒmî…(*ᓽ9X²i³ÅŠ%§S®ÒWÓ`ÔÁÔ%ý×%‡„!›K"»øUÖP¦äÓ¨c‘³o@:Z¯;QêR>¶1 ?b¿ú ‡™<Éœ@ãGˆäóê¯ÐxÉ´Q¤8ßË3*YÁ‹ËîÉÃçRs¨~ÚÊó¦Þ:=׎Ýš¼€Þáœ/?–²~q¤Ò3¸5uÖäpÔ4µ¾ÎÓvR¨è§EDƒ7ß_©‡{ô"Û‹|=Ûã§Ú¯²EŒÅ‘\áá)FÕÉm¤4# -ऄB(ŒŠüäŠnwàb«‘ÒJ& Œ@·ƒGG¸tgÂ6È*÷ã éãËÝ(58÷4ò§³Ön«ýHNMî$SGï—Ž@v¬ÔW;/q/y™—ôå¶Õ=v‹šâ( -è¶T7êNÎ Îl°Ö³ñù¹ô°‘¸³6õD‘˜'Ùñ/{«ú?¸æ -àoâíäL¾ož=ØšêC^ñø'->¡{öíØIƯÊ ¬ ]}hðUÁÖŽë–«¨š`ÎÓé4ØÐÝñÀ]Š^ÐçÈ8ß¡1Í$XM©Ê®e­r?/kõ?ÌøÙh:vâØùFÿVrX^Œšmše­YvΖÂØXïµÝÈVò5´ôÙ]”Z)þ]†Á%­äç¤þ ôÒ¡˜4òM‡p[’ûŠäQæ…/æ쾘è@…b@=Bm9¯æ@‡t×2¹ÿ­ÏãÜ¡.ZDæ×ožËoÙò`;¼1nâÛQå#(–8Ñïÿò§è‚Mýî‡ï÷nOUsV£24üƒ¤VŸÔ¾¨d7é“Ø'JaàƒÏµœc‚ØÊñÌù p}á'º?"œ¾oM½Zp5¨$þ×hù†Þ¢@×/þ[¬Ë(9˃SåYð¡^wšLìÄ ¦Ÿ—{ûßýP®"v·ìe]ވ몳«Ë¸?2Π‘¾\endstream -endobj -2839 0 obj << -/Type /Page -/Contents 2840 0 R -/Resources 2838 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2812 0 R +6012 0 obj << +/D [6008 0 R /XYZ 85.039 458.869 null] >> endobj -2841 0 obj << -/D [2839 0 R /XYZ 85.039 781.388 null] +2130 0 obj << +/D [6008 0 R /XYZ 85.039 226.062 null] >> endobj -2838 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R >> +6013 0 obj << +/D [6008 0 R /XYZ 85.039 204.866 null] +>> endobj +2134 0 obj << +/D [6008 0 R /XYZ 85.039 162.706 null] +>> endobj +6014 0 obj << +/D [6008 0 R /XYZ 85.039 141.505 null] +>> endobj +6007 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R >> +/XObject << /Im2 4150 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2844 0 obj << -/Length 2785 +6017 0 obj << +/Length 2860 /Filter /FlateDecode >> stream -xÚÍZ[“ÓF~Ÿ_ár³XÓݺÏË„ U!,˜Ên4ÙcKF’q†üù=·ÖelC–Ý-ªèÛQ÷éÓçòãÑ#ÿô(\å%£(֮ǣùæL–°òôL …ù® -\z<;;ÿ)4#­ÜD%£Ù‚Hf×oœ'??z1ûñådêyž£}w2¢ØyòúÅD;¯xöÅËËç³ËçOqääv^¿Àå__NbÏ™MÞΞý8ë;õ]?ôðÜ÷goÞªÑ5°öìL¹^öÐW®N’ÑæÌ<7ð=¯Ï^ý£Ý…×üuävSß„®‰ ã)7Žýc4F»±Ž¡{d-pý à%’ŽŽH§YÁ=3¾ø6]J¯˜˜ÄÙm&&v®&Sø?«î -aj"`΃ָžIî¹™éXŠp^;?`¹àv^nó¬þ¬¦ÌÀU¾–×y±äq^ÀpQò FŽ˜¨ÚõßU Ê-L5yY¤ø-Ìh¼ÀhªC× }àÚwÐ<åç¬Bq‰“×ܦ·ÙM•Î8‚ØiEÎ-÷Aá_qØȪzײ=þÁÊ©tËÂgõÝ#9Óv\1Ÿâº\23¿+í£å²M)—&áîj¸jc—¬Š„ÊY@·¬6iÓŠF;×,Kƒ&ä‡ T4º„N£·™£0Ö;¤Ì®åÍšlƒ³õ~{þ“×gUzÃ}e“Í´NG‰«ƒ„ÔO±‰Nz¾ž­´ÒóŽIïò•Q&šL87»ªáž¯¸}cÌùóòÃ9¼©¹ÐÞ…Ž/”ÇKSZ©·Ü×Ün¾Û¤ÕMÖºâ8/¦,Ï pµñX ~\&pcKõ_Þ?ú*÷7Ÿ¹ÿÑkzQì†±Ç ~7¦7ð!˜ÅÑP¿øÞÞ—Ü{A€Š;«úêNrð|ã*3”Ãx{ÿ‹nïÁ¹àÔ¾ÙíÿÂ;³€€A/ñêß>ø¢Ûk?tCý¯®ïæÍ15R®ÑCQ„§®OÞ_Ÿòþìöf+ŠÄ±qölSxγòŠg/àvì«ñCè&³ª ᙆb,—…´1Š5„n„"ð!)¢$÷Yäcfí -¾åþ®Î*¾èøØÅ×Ðß/ (4ᯀ؆a%¿©p86 -L'<öÒ¼'†OÔw¸#Á%Dy ÓBH¯pv½f4€qŸf^ãï(¤§xÆ Âb–c×u‰¯#Áý7Ä„(à0€%qƒ=AŸUà­…4ó’Nä,³„Þ­¹¿FK+–<‹oîS—…c‘n¬ÌSFü%^’1â·ÀÓWÃÈ©²t½¾å>+À®5ä>Œ{ 0&#Z´².9 ¿O}OêVÒíšÑãÕu«=°©´´T¢a6üôhé•Uµï™¡ü²ddÃf…;Ò+5P)Ë­ï+güò·ÀdsLÈê{‰ðv…†ýf…Ÿz@´’ïÐVduNìCî@Dõ*cÕ®™°ÞÍçß ÿÇ;ìÈJny½5RêVD¸Ôç³oœä½–G.v}Èñ0Ï÷?±^pk÷ÂŒŸ -hÈsÂbÊÃwhZîïWùº#œn‘v‚€dÓ­ÒqYóåÎv„#ˆ JŽ'ÒcÒ2#ÞJõý=òlÝZ y>«3¸p…©ó-öMûbØßrÞGwheñ׺$éÆœ…ãVwµ}ÌÓäyðài‚óʃrD⪈›Þ)˜`-qçJ&P,ø%‹{œMÒ_ë;9õÞOÆ—õµç¼G. ½‰[ÃÄ~«ÂЯSrÈ´@ŸJºe§]ݪ¨l†F]°£à!¢úuòŠ¤ž7q“¦äv™‹÷äÙ•°ÁÅ‹²¶Üòò -÷Y®²cò~¿#D²ÀI§ÒÂƑΙs&ÛªÖ­%Hõ„îÐ)Ür»eVª†6Œ-É5 )¤uQ|/ÏZ Oög“¥ÚZ H¢8ÕzÜmÍÙ¨q¥Um žÛûU-½X‘"NH×i1r¼4î5ÞYׯi+¢1ÄÅ'˜ ŠÊ°þ„ëd=~Ü?;ëÚ>á·©LAŽÖé6VâîÙ•÷ ®e„·çn’` B ÎÓ¥¡Õä1€ STís±,¤ÕÎô„ˆƒôJª=8 ç¶ßd…0$Õê÷ôƒ‘ZœvÙÅ{GcÂç}×=*9r¨|²TãpÂ;*@sÝ)1Â^‹N‡Må à‘E-ç)½&~OñÎR“ó×"lQöÝ–)z~Ï-»íêâAÃ4K’òíáìRÓ‚9^ìè}_$«*ë\6‚FÚZó‚¼Í†ûS÷!Cçì¬ç·î.·&n`ʤ«iQ6Ó-‡éºÎ¯ÖÙØ=YY}Lø@E| -!K ÐP‘} ©äÒT}[s¶¶áq9Øi€yT|Ú;1&ƒ$ÉE 8•œÚ†3 X]YÏ´”•|#È¿‘Ì,€ÃDgGö•‰¬ʵYrVn7}Oª‹O…ü$ŽîÅlùê0hq+H`Ÿ2ªeÉ­À.µ hÇWé%Å9aqm r̤þ;ù×òQ“®oxéó*#n‹ªÕñ£ùí±8Ï8TrìåÅÒŸZp‹§CÑDèÌË08d‡HÝú¶˜soŸ7+Þ¨ý,e^wNpªLm@hç%CjS\øS¶âæav7ŸHvиâݱ$<”ûBo¥wwA=uSn‡%ô±²`öíO(GÕÓO\ßÜzZ*9uw­Ö3ãôŠ#ÙÝJŦ¬²A•¡2!ýýÀýÈÇfLÀ•æÂvMßqÐÝõnkÑÂ+ñ”Æf´Ñjã*½¸B!9æ|™ËGcÖ^~î„€™*ÆmŠ6ùaŒ8·ÿ¿Ÿ­û´Ú!âóü¡‚_Ÿ×¥Íd¨ˆÃYfÕÙ ~·nKN„å¹J†9`^[Âm>?FßÈô¢oÔ¥’^äżHS7â#ɹï|&‘f[„Ã!g±†7z(5T¡+‹" Ý6·ÅÝÒBÒn\*íï¬6Ÿ:ïÀ¯^ßZ¬ß”SL˜`Y Šs"<@AB¼×-ž ±G~qÞ­'­sX*lɯû¡ûdñ_öqC߀nw®Ë¶Ìˆ®Kt¸ÐÃè°’D³âeBxˆP|ãµàêŽþãO“a ¸P-…âåÓO”âWM³½8?ßï÷îÒD·¬–çu¹höKÜU³YœÇn’DCk:m:Ó¼$p“0ÈêŸ.ž‹ã0\o6‚ñ³-)<ÿ;77çÿ|#J„Uhîʃ:¤&Ó\Û€þ%Ë£_?âýÌ ý¤•»üøõC;:17.OÃÀwfT¦<Ò¬ óÆ‘š³\H¤àDíã@wܺ‡mM¦†eÊ¡AÆ4¡]èjìQ't‘ADsÉ»#c`•¯¥XQð¶òK«é9>æÛé¶Å/ÂEÃ] ÅIf߉+•9TÛÙL)ëþ`BÀ¼\^3ò]mÌñ?Oú«?}òÈÕqÿg¶Ó†£áÑîš;÷åý"W­µendstream -endobj -2843 0 obj << +xÚ­ZëoÛFÿî¿B÷!( D4÷ÅÇÅ!¹$ÛØñÅ +ÒC ”DÙD$R!©8þï;]>$Ê5šÀ°¹ÜÇo–“~Ä$6~ ’I _Åñd±9 &70òˉ°SK2íÑ<Ÿœ½ +õD~$“Ùªãc|mÔd¶üèý÷õ³«ÙËw§S¥”'µ:¢Ø{ñòTx׿ÁŸÙéTxo¡qÅ$WïNeì½}uþæ%w\<»|†]¿ÍË œw9;ý4ûõä嬕®]$IP´/'?“%lãדÀWI<¹ƒvà Þœ€l¾Ñʾ¯O®Oþײâ1=áYcš0*öM¬U¡LOB‡~™I¤B?1†t±.oÊâtj¤ñ¶isË­Ÿùñ‡PŸ¼Á¿WU¹Ê×YM=;ÜîÙ+Ñg?UÚW!¡?ˆ#bw›U(M„Þ“7ül*ÐWZÔë´ÉjÛUÚç- Yò"ÝØV¹Â§QÛq 6§2òæØâÎ:ÃS«¾â¹dÏH‹%7@^fQYø8Ãî@³SŠg=‘8Øk÷KC:¡±N•RzËl•îÖÀ«Áwå­ YV•(_Fã‰dêxM{Ì(O ÎVÆÊÚ´+âÖ)ܶzjö…TAëé"¤ãõ° +ÎEGCÓϤÿ±Ø³Á#°ç ¦²Å'k‘ãadK¦Í‹Ã#³)RFšS$Y‡ „/L<09f¶E¸£se£ÇµF[ ÃÀ»jO=Åa„^•­Ðbt`(ÑÓ®ŽÃ›´àÎmz“q ëÐe% ™8i]r3÷e±q]øR9ºœ¸k=t ˜†WÃôËBÙå—¨1y½À­6V‘ñ… +û)“÷ò#Y¾Àœ«4§sQ„à=EŸ[ھ˧ÜH-ñš]¶^{!"ñ{áæíü}‹BúJȉI"?ˆÀ”I|“„£6 P 6qx” M +€ ·ˆ:Ú·l'ÓÔ  BÕZv$1$&ÃàAâÉÁ ɦuY2ª@³8ب% (<'_&Â4®@4½6Éßm‹:ÎÎ7bò¢I'a™ï´Ç˜Ý0îçXüИÀƒ¾‹k hÂû@!/–ì˜bé]bÿ úÏäoÜCñz;ß(K™Z,Í&·áž_—äjÔ,ʆ×[æ51*Ñ¢ŠlÁ‘Š†R»NYn‘Å´ò¬ 3&S!û">S~¸OÐÞçÈÐË´Ï;u€ÀN¦QƒÏxç wb6T!8|+g>Þy†!Zœ¶ÁíË·3n09Ä¥ ŠÁ'0d0¿Ìz ómP‡Ó.áê_Û,Îc‘6º"ÇwlnSÜTÅúï»m‹Ñ‘ˆh8›Ù®ú&&N˜3ûíwêHøà“ž#üs·BÏ€”§8í;=e&ð>xåCe§ŽcH¦_È`€°ØÕ5dÜÖ³‚-}PˆÀ˜Fâ}ÈÑ5”° ƒí#ù†ÏÈ;ãÇ…Õ74ß×l~‘wµ!Ž”Ÿ:÷ “‡÷ÑѦÙv¨ã@2.=Z'ìÍ«wxÄ[ò†Òš ö (Õù=öáÆðyÆ»1ÞbÛl‚`@Ô’ Ö®¶¬w”9¡Á 6Ck¨âbç6­¸:DkZÛ÷G¼þºsZVÀ<£F›ÌñeÞ¥FtsìÂ#–ßÐmñ½.ùI>’6–If-zÊøýÌʺ¿…“²úl…p¸T +ÒJ´i‡rÄÎÔ/)naùô0VT¨Ùeábà΄Lد—D¯ˆ° +V±f‚Š0ôM *¬ê95YekÌ(HÔWýó{Ü‚>€àÔÙâ h»3ʱÐû ¹3&Uèž Á$8§ ¿uSµµBÃG¨‚!g*Mš¾4(•‘áw^dvo‡×[‚ƒQëZÚRZب­û6Qýdizœ;0Õå•Mgäc÷è€XÝ„‰÷|×0O²”Lá_èÔn«•e•Û¯å5”¤‚\júÌ­Êpl‘ûRÚEÏWCòC—âdÓ8#³©fU®×Œ‘!k:Ý¢9’jÄšŠ¼›u9§rð“M/V œ¦ÁÜ]Z²’Œc㫶b~ë¤WÂë¿GØN¥sŽÌྫwÆVzô:íÉ{üëÛ[‚zì>-äLDìc›í[ˆ^õD»mxCÀ…þ³V!<„f‹Ï3~ØØ+CÙ½—ÀkwÄÙ ú[èÀëÊáAéqµ^VYM0qv›6L#šRaŒ:Ö|®™•\îÒ;ºøÚÛ<}çÝö¦äð>u$U µÿº«~€¿¢ô@Ý¡ëQâ¹q¸ÇÝúG€³Ô!VÍçÍñ@â5¾{€²ÀEþk¾È¹ +”!æ±R ãnÌËl ð2ZCp‰­Ïd|sµÚÍ^ù«¤~œè‡·ßѯ¤Ð~ ¹þù?Õ „Ç Ã.ºÛ‚—Ñ*ÂÏ„Â.:OœÃ¡©ÄoVøÊGò;S‘Ãp7"‹Ëwò’Ýí²n¿ 5t]ܸqò·Hs›xõºgVƒPÛ¿¢êÙ¢¸÷RÙ/!€•ñÖ@kã½:°íl—¿µPwKWŠc ¶ˆå?…$»H2¾ÓG|-Ü|-±2!c0ŽèA+ëÑw2Ÿ#¢hÏÉ´u².~Õéœ"ž.ºÁ»ôiO{àìD×;R6˜%¸$ùeÕÛ +b‡wÒÑ÷—DùqÌŸ©Ÿáukì}Ùu Á^€E®*Ba<­?·ébÉ£xÓ¤ƒÄûf¾f°Í´›_î™êœûÚ„žµÈxâ T¾Ž9†’ß¹5ÄiËz#«¤iÿù ¯»É—iÞŸ¯ÛÞ–%?ÏG,l™»¥íÅ9)<)>&ü?Œ +´Üþ§Yã¾ ¹›¨6o,k¡AÖÞ3ƒ&)ì]Svi—n¿âÚš`ÄÀõähÞ€_Þçwý3@wm–¢ŽÜÚ)})œ,¨ ˜}yÝ? ürÁæ™endstream +endobj +6016 0 obj << /Type /Page -/Contents 2844 0 R -/Resources 2842 0 R +/Contents 6017 0 R +/Resources 6015 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2812 0 R -/Annots [ 2846 0 R ] +/Parent 5983 0 R >> endobj -2846 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [318.285 100.991 509.276 112.984] -/Subtype/Link/A<> +6018 0 obj << +/D [6016 0 R /XYZ 85.039 781.388 null] +>> endobj +2138 0 obj << +/D [6016 0 R /XYZ 85.039 488.874 null] +>> endobj +6019 0 obj << +/D [6016 0 R /XYZ 85.039 469.924 null] +>> endobj +2142 0 obj << +/D [6016 0 R /XYZ 85.039 246.049 null] >> endobj -2845 0 obj << -/D [2843 0 R /XYZ 85.039 781.388 null] +6020 0 obj << +/D [6016 0 R /XYZ 85.039 224.848 null] >> endobj -2842 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R >> +2146 0 obj << +/D [6016 0 R /XYZ 85.039 128.027 null] +>> endobj +6021 0 obj << +/D [6016 0 R /XYZ 85.039 105.311 null] +>> endobj +6015 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F14 2895 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F56 2890 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2850 0 obj << -/Length 2574 +6024 0 obj << +/Length 3177 /Filter /FlateDecode >> stream -xÚÍYmoÛ8þž_aT.Ö”(êµßv›¶›Ýk›k¼Ûzý [J,T–¼¢”\þýÍ )˶Ò] ûá "‡äpHÎ<ó–3þä, …§ÒYœH¡’d¶Ù]x³;hyw!Mo/ -±é§Õ…û6ògÒ©—ÎV·Ôe•q^ÿüãõêͧÅR)åÈ@,–qœ8¯»^H熥ן®>¬®>¼ÃZBéüvÍ?-å¬_W¿\¼Y¦]"ˆÎûÇÅ—¯Þ,Ó~¹ð„J“Ù”=!Ót¶»B%Â@™zuqsñ¯A ·35±ºe C¡`MKå‰$ †eªpb™›~¯—:Û­3Qֺ˪j± ýp,¯ÊMQëâLÞY¾›ïšû?[šù–mNO'Ô{¹oåØ°‰!«m¡KéÀ\~ -lq¶ðçÿá>P)j¬zÎ>Û,üØù¶#'»+r–> –†w[t[3ü žê5 wE—±t3)B-wÓÍm‡<࿬5Šæ¨éúýü% -MgùKò²^žïKHk4[«†®9—_ŠvA —ή9Z34þÇ“A…[ã‡)XÀ±v«Üí++J½-¬~½iK\Y÷ÔcåL)¹=«sî¿ï;žTÁf—ææ ên`5©ÓÑ&rÑvãZÃ^xpÀ"…â q{ݺz ‡ì¢ûºy[Þ­v§ÜWÅBÔ D/ˆçªÓ|î*N„çq@4¼Û'ö¢S!Ð(®ãyÃ"+ê©_M˜ýD¼åí}+òqh÷åq]l«ý)^¼ÔKEÌPú}ÜRa*Â4šÄ-:ö@„ ð)=4Ê=\²Ýõ¶%3鸇Ém1´H‘b,@Âw†Íêʆ¼ú‘£TD^„Šf€Ý© wñoT&ƒƒHà^í‚Ùe–ÍÆ©Tø`DˆQz‘Éî^öxŠ‘'Ñÿ°à¡ËÓw ¦öw¦ÒÔ¶ßkÊ/zd˜&NKNPYpÈlPfă6ÅåÁçã9‹u…ãHÄ‘õ벞Œ•ˆ0‘çAs/cµÒߊä WwUÀàÔ‡µßṈôU(¤wC ÉY€‡ !@W˜°áÂ!‚ amû%”l^›žàD€hàSÁ0Ƙ=î#ÝQú3sM¥”ÈÀ 7—³[Äc›]0q´="f]Öw\†Í…Ë)Ôû k, BYjè°^Us£7¬ oß±h—ÕôtǨÌÉ]qgä9@my‡µŽk˜CªlCV¿²J|ˆf_±3íY‹‹zkZáj«˜·=„Ðw@»ì‡¨ßê0lº›C>sÜ -H[ˆ4(DàùÏC%B›LãÙǥφBį4|¶~É_]›í>¨~ -®šþ ¢~høô ”œ@© cÅK¥ð‚4eü—ŸÀRù–Jå‹Øÿ>˜®ˆ ãHbbäX€²##»áÊ5:P£»ä@Ërho­¡(tmzô±¶¨;ê¼.ë C½}\65F¥¡³îyspÜ-*&øN¡ÆÀIõÆ’mâ°¹©¢ øÝ“Ï7÷en†t‰×£¡ƒ03’"„3nb8(ºnjînõ!t½H‘'±hkÒ¤T"Ò1«,ê‰äïT7ôÌ‘çD†_#¹¢x`AÄ°ÀHF)€úYëûrÓ6ħ©é’ÐÛ”Éû!ÛѬ°dÓü+Ïxa¸9——ÔÌl1 R šsyÓp"ˆ•Ua„l<”À$‹V ¡UsËÇ‹¿—º'€åêM×ãÙÇ j„wÅÈw®Ìࡆc±nº‰]ÝT&S¦!FË œ2ò#™µ~jÚá hoŽ¢µ$æ¼Æ?ZNí3q æL ¢17ž¦5³•œKg×}W˜G|âd!Û†’šòù¤áË© -èóSæ¬ÉoA)Kc°Ã[4 -cˆj7G—-^n3ú3k²´ °I•x=M.13£š‡Hï¹ÑUù†R§ò{ä -›ùÖ˜úÎœ6 ¹ÂÖ9·–Ä4©ÈŽƒ¸@ëÆ!£ ÇH(¤3@OzÄÖhÀ;D¯þ`6üÍêGŽS£íqê$È—•Ò] ->Ã=^y -§c«øˆÞŒkh¸£™AQà\RPþÊ2ÚR*™+¸éº67ÔA>Âã˜;ÚÛfðålKKnÜ-p¹¢º$ãcM; BP› •ížÄàB½9Â#䧎`¬‚Ä×b!€ 7ña˜ö›o¾%­î‘[vÖGj…AÞp€æ‹BÂWÎ|Ät¬Á…eà…ÐŒGÝü'%þC”joýÒ A»s„;tþ ´ÓøNnÊ¥žp|ËY˜0‰yZø'Š•}o0fþO%t|Ìya#7q¾n¡Ï?¾¢$rNéµ[®B„ãë w/íÜNö$ÜNz÷„ã$îqF·›4硇¶(T[Ÿ°è£{±¼l¹sÇ°Pp³ /å|¾ú€òÀ›°÷ð–“:Ÿ±—òÿ ’$bÑšöƒ,ÚŒâ,6§èÇwz业¾®ÉÜ;Í7–_ïu–çv¹»õœÛq›uAŽ¨_ÙöÆŒ†‹ÀT>êQÚ®y_sŠ•YaE -ø‹ ‰¥ï|ÆKóþ"{ò-! B;>ñ!²ë냟A¹m8êLÕ^;'‚IEpbl*½Úiý`©Rtˆ)¶åã[j˜ëÝz?À½~ÈçFó–P¼Ê¹:@ VøH¸Ü"úd^D -i­Œù_ÞÛÇ;h¶+ÃË[Ó"ovöE“–^ 8¾õˆ[²S8º4±»9üf— äÊp¥¬G3=•õ¿ðš(õQÔ«$qìuÍú4‚’'-IgÜŒõvȶ¹éAឌ€…9'ûºj¨+Òfâ:±ø^Ù&säp²57ÛÏeÍYçÃÊõ¿¹£×ܲ©J ÿZ²N<ö¬G g‘ä#q$©”µúû­£›‡Ä‘ƒÍÂÀ¨êê꺫h9óៜÅðu2‹b)tÏV»¶o¤…XXÅæ‡åÍË·¡™I_$~2[>õxa=[®õ^ýãö~ùæÓ|¡µö”óEÅÞë7sé=ü –ó…ô>ÂàžAî?ÍUì}|ûîý^¸»ýp‹K?Ì›;<÷a9ÿ}ùÓÍ›eG]w/P’ iÜüú»?[Ã3~ºñ…NâÙƾ°½»ÚD`´77ÿìPñž™ñ©)N-E¤‚ÙBû"ŽÍ$ŒôC1°+ðEà›Ž]Ê°KJ%´T3„üzWâã^¾ÕÁPàFˆf÷(VUùtÎI¸3š ®¼¤ËÂ\Ð%G׌iFtÝþæK¡°V-&¼v›á ôž@&UQT(¥c^Âlà Á·-¬äå¦áci¹æÁíû÷á¨Æ(ïëìkV¶<ùT¥ðîÍ…åÜ6-7vüTW»dŸn€Gî Êœ~·ö!«¿MÏxAãKÕu/8zÞ : ’¹¥½ØýÞ³õ:ï?çàËyN\eÖéäÈ9B`s•XsAì™sLDè‰};Áò¡ +l +-Y‡ã¦Më‡ÚÛõaóÀ+5ïfk½ ®·(p™Ï^E{ÃßvËOFÄwìspù±d‡Î…­sH:^°FJ¬PFCæX_d+ödÀ#‘(x¤Žmƒ¼…»ë6guÁº@„‰ËY…}˜:ËP:¶®¸l²Q»œR‡Kaá"–êˆ2bÿ&EæÝpym=U5c²2°³=+œÆ^¤µ½+~¦”dM‘øÃ÷‡ÞWÄ”¹œ„s—ªt–AïŠ(P1ÄþªFS‹5§°¾K9ôánÊynuhæ¸åÔ‡dOµÍÓxÿ QqjxÖVü»ÂUjB6޲΂.v/· ”yàý"^UQDÁÑ W¾Œ¶'J¡ÇIH#.œ»uɼ\šoWi:HD„“U’!Á·ñ³xè”xxäÀÇxŽ*`}(Œv:RpD$èÝ0œD Ì@{dD$¹°ýPqjµüT jj8gÌ$¸’$Ñ 3Óú‡ÑÂËw;9{]¥³±Œw1@Ìá$ƾ ‰‰fÚ$" +8UZ:?Y…µž” GÉ­Þ% €ôqË&Ç‹¤Bð ÂvË“”IA"›•r‡»{<Þ9Br–= ŸEQWx2xçî¢@/|©Œƒƒ¶†„~¦Ã2#î<´Š#k$ÝÁa…ˆóª´Äè×”ŽŸìÕŠœÒ¹¦„W:ògt(«kêáY&nú"M¡Óéj¡Þë)ðz§9yJk2Þ¬H` ÷c.eïUq·‹ò0¾{®š¢MGCÞ_~I駌R郥¸Jïçq$š:9$º#Zò‚ñ¾žùM$£ä-Ò<8ó¹×Úé Arç‹-þfOrê1æ¥RvN5ÑÙ^ø%Au–3pÁŸ Ó’öx.ùkN~iøõÁë$WÛr*  GÙðÀ}±“S&IÌBTF(ÝÀƒ4“Êð‰—‚ +b.^ç‚¿(¿ÑQ*1g\È“XÕºÚé0ô’ÿð›^òÏ]ÏûÞàô!kûç§<.ºþ€f¢-çàÁ¹Óç­sˆdC 5 |Ÿã¹µ¹„ŠùÎâZ†(*êÇÁ(·GIn0·M¢QÒËÉ//xÐeº>· lÈ^‹}¦w;‡œbiﱈ:÷“±ÎdkB >­a¤iÝ_À­Å58ω–ÀØ+=p]„Õå]V¦J +4'Õ•—Cêzòþë¬ùÒVû 4jŸAe2F÷…ΦNwSµ„g:8ìŠ^bR'(wÕ‡¬ÝVÕú[aÐqßþát ù)CˆPçWmUçÔãunÊJJÀóš‡$¨Š;j¶±ÖØ4ÒY·Œûµ¼GׯŠ·åêM¶æù1Ç>ÁF¯%΀­r‹†³lŠš ¯4@±Ã“OµÉ±6“àʶ‘¤ÙÐb +~¹ìþ}Á±™@Cÿ“XöƒžË9š@Ä2þG-&Ûeº›ªµ ìhˆõ8š³sk\óÈÆùÇ¡w(„Blú6ç L! kH¿¸¤ A¸% ƒ]å â¯Y™úΫµZªNqÂfÎu èfh"ïßØÜÀT÷­âª2sm}œa +…ûö¾£ã2'ùuSTXž§ÅïXàcWÑ|>®ýRÎ]²ÚqËz×ØÙ÷üCõb梃ÈÕëø¢e˜ÿ#C%ÚÚB[HcÛ +å0=jó!â©O ¥-ìóÒ6T)u•—ýÆÛ¥9KÛ%ˆ‡Óß_»’½‡™È• É ![´0H†¼¼L‘úÚ] qý*ˆ:A ¯úXºÏX6ÆIsÑÉÂ5Ì+î¥ý˜•ñt7p™yÙ×¼ù´·©,îj²] c\× Òó¶®Ð»RÇSc1+&âGd„ߥ" –ëÐîÿ}â^I’8¾©iŽøKE½žlñbk6'@Ê€åfl$gÍeHµ;#¸¤ò*۸㛄}¦þLŸ·K ¸Ï‹å€ +½Çý¢Ï›ð~ÙõäqÜ%U]sÊRÆ"ë{…/ñ—Ÿ ðtÔšÀå Ä~CbícF<¹ï.mš)MˆE»ÔâãÏo–Ñ »ŠõxàFŽ×Õå·àHÄ`PQô'êZª\§«Z‹iÑ¡šú$"…„„†A8ȵ$™HZþ?H²˜®’z "è)JÝyE=áh·?XÿÈ߆_=ëì‘:œðV­x¦XÔ¾PÉtluà/ý/—®à„‚;ÖÏ|´ UÒÑ‚O†@tNo cð~ú’àÿö×™Ìendstream +endobj +6023 0 obj << /Type /Page -/Contents 2850 0 R -/Resources 2848 0 R +/Contents 6024 0 R +/Resources 6022 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2852 0 R +/Parent 5983 0 R >> endobj -2847 0 obj << -/Type /XObject -/Subtype /Form -/FormType 1 -/PTEX.FileName (./xslt/figures/caution.pdf) -/PTEX.PageNumber 1 -/Matrix [1 0 0 1 0 0] -/BBox [0 0 31 31] -/Resources << -/ProcSet [ /PDF ] ->> -/Length 557 -/Filter [/FlateDecode] ->> -stream -xÚm”In1 EOPw¨u€$ÅIg0²Êľÿ6¤¤êV5 oʯÅésÀóή¯ƒÖ×O²Î Ž¢‘ÿ¨#h8Çùø:„5?ùÆ [ÄIÚL’~”F Ø PÈùYÌÀ¹dˆÐzZ8å±Ýƒ²ÙËò‘–Œ€f¾Å(ÌÀE#@x˜oL Û¹[ƒ±ñðù -ä -6\>RgÈbÏWÖ¹j[†› -WŒÏ¢®{6;»²þFÃÇñ÷ø]š¨)Õ/Ô¬Mu;pk;Ì©Ëdh<åE–ñ¬AÏw³ð¬±±Nê¦ó¡Ä½t•‹ùD„™Â²]°Ä(‡;„ ·åŽ°Š­r²ÂÙÄLûˆ T¥Í¡誋ŠŽt’¹w_ =Î]ˆ‹=¦uSä÷—ä"ï±yl±‡µÃ-ËkHsŠöreOÚ³êvg›<7ºt,‡Ýe—;ãÒèЭ/I…B÷&ê(ýê³ö󻉨YÙ¹Ç,çkRÔšÚ'^ m" ^˜h±ÎW9AVªy­Â©/fýÆ"•œãûFy-Sng \Çdª¼˜©Æ¥†Í}B©•µŒÎ$âw1.¶&Øíþ²C¶O–ÃVç X×9g¹E{îÇ< •ãóP)!ÍZÜÅŸLÞª~ÑÔ'¯UâXLµüc“ÅXsЖõÚ¯½˜Ó’~òBL–§èªÆ¹O¦ºNZ_[Èü.øšŠû*]3QôçÇñ!Ö-žendstream -endobj -2851 0 obj << -/D [2849 0 R /XYZ 85.039 781.388 null] +6025 0 obj << +/D [6023 0 R /XYZ 85.039 781.388 null] +>> endobj +2150 0 obj << +/D [6023 0 R /XYZ 85.039 255.288 null] +>> endobj +6026 0 obj << +/D [6023 0 R /XYZ 85.039 236.619 null] +>> endobj +2154 0 obj << +/D [6023 0 R /XYZ 85.039 236.619 null] +>> endobj +6027 0 obj << +/D [6023 0 R /XYZ 85.039 215.622 null] >> endobj -2848 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F70 2201 0 R /F18 2207 0 R >> -/XObject << /Im4 2847 0 R /Im1 2193 0 R >> +6028 0 obj << +/D [6023 0 R /XYZ 85.039 93.418 null] +>> endobj +6022 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F35 2880 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R /F11 2898 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2855 0 obj << -/Length 2865 +6031 0 obj << +/Length 4226 /Filter /FlateDecode >> stream -xÚÍZmÛ6þ¾¿Â' 8oPˤD½¡Àò²m7h³nÖA -ôúAkɶ°²äXòú‚þù›’’mí6è¶Àax8’Cræ™*r$àOŽâÀ~2Šbéúq5âQ»›(/t½d<õÇËùAâI8¸(-¥Çõ¸Ú4JÀK“À>áõ‘‰.Àp r óŒ= mÃÝâƒæá%.yã[<éÎÌ^Ÿ6fu¾}‘=¹6ß1‚O¢8€4âeÍvº.nwÅ—¡EŠŒ ´R¥B3=§YmO Y§©„ê§ÐæÏs<n |N1×[³3¥„QFŒo´qøÚ—è÷eÆVÀ‘}K(P7MqÇ;ã‡"ÕÃo[›‹hKýU›~ç÷ñÐ WJ£â¿Xâ1a^œØÌÛ mÔŽ] xšÚ¢Z¡'ªdp)@=öžZÉs=Â|*.ꪥĥäghE’yùø‘tãð–0»ÔTíqbæ e!&˜ÊjÝNÆÛ8#ºçåA¿š)F9 –ˆþÚþv|LÒ‹ÜÀKŽÌá.5 }¿¢-î+BÖФ›üÈÉåÜk·B'aÄlgìiײÁ5¸H }°l’`†YPÍ"-ëóì°ùvEX›|¡ÉWÊì;;o9¾8ÜlÓ;˜þ[œZƒÓ$f@—EÓ›†è¼?õ±t¦±e-–`ã`MÂŒª4ï „0Á5‘ “ç²»ÒDëŠÙíZË:oõ¶ÙFæÞQŠÜÖn(#rÅ9ðÖ”ˆ‚'Õ”ë2£®Ð?¹ =Çë»g&TAƒ ‡¯º¢p}5ÿ6àheÎt™QæË–©ƒÁ¤Â$ÒJœÃsÐ=ÜJõ m‡…­-JÍ$‰SHÖïúë’!ÊÃ3I?¶Ðqð÷8L"ñŸ½­3ÿôb;0%$¶ÈT -Ýu¢ÎĉœwT ¨óˆûŸ§\àÖh2¶F1É‚ÒºTO=VMx*r;ú1~2ú¼/ô´¬b,i9øÙ¦˜hú±¶ŠÝžÙöf¡ÃÙÚƒ®·]íCrf/TR2,¦fºáG§<½çö¦æï2&ûXàÙ­+ûù&-Iyð€¡\µÐ@¯©H؃YÑ)g쮜íá¯þàæé'½ª®X¯b×O×?]´À‹Üv(Oq»[(üS¬MÍ3ZÛô_ÎoøWûçZœaƒ>‰(æÃÔ†NS)>D‘Q ¨N5z0 TCÝŒjøñÐÜŒûÀ/Cr<éæÖ銑1a°âdl¾£áWX½.>+,QÕóÛHKJå{Æl5Ë åœp±+ÝH´Gúz˜c¿ðÂ0Ê­}°­éÃ%~GÀ‹š–õŠ?nq–“PåÅÒ¼p4I”«¯©Q)² %—ºçé°Ê8¬«ñ/¤w|syñ ÃÐi@õ! -@=Hô\…Ãÿ‹Bîóþ;ƒ¹—'Ý\ïEÊðTQBe¬ŽÃúÿ)¸þ”endstream -endobj -2854 0 obj << +xÚµÛrÛ6öÝ_áíKä‹&ðÖ‡ÝI“ô;ÞÆÝL'›F¢%®%Q%©8þû=7€ DÉ;ÓîtÀÁpîçVç!ü§Î³8u~žf*ÐYv>[Ÿ…ç ùáL ÄT@¦ÌwwgWß'æ\…Aæçw÷=ž80±>¿›œ¼úñåíÝ›_/¦ZëId‚‹išf“×o.Ôäý/ðÏÝÅTMÞAã–An½ˆ²É»ïzû†;®_޼ĮæÍ5λ¹»øt÷óÙ›;·;·.ì$Ç­ýqöñSx>‡cü|:ÏΡ +†×g°· 6Z¾WgïÏþéPñ˜9çYc”0QD)4td™…Q* +´Š€\qÄ¡qäR±G.ÅAb’s „ôŠ‚ýÃ)m¥Ï=L‡Ë1È3«é<ˆ³x°Ú»ÍÅ4ÊÒId]–ØÎ&*øØÌáŸú"J'-wç_ôŠ®Kþ]#ÿŠrhYm`R‰—0˜'“E-èk<ÔÕ÷Qèï'ƒÍbRoº¦^ËU¢ ç¦\ñ¬Á)R¨4’YSP€ÈøßÇ–UA¢r¸¡Ýv¸Þã…áÄÐj°ïadmc‚4ŽÿìÚ™=ò +¨U•›Aš ˆLš 3As¹¯qSP¼š5u‹l¹çMSï ¶ËÁ `ÆC;²}¥@póçö¯ÀmSÞ—D«r3+ÇŒÓ ±dpÐ|…“÷媜ñþñë,Ð&• oë±Þ°vµwä;î{]¯ ’×±ó†Yé½õï–åæR(®Q> x¹iw …Ž“I·,:i‰zè8á ©ÖEó„ß1n7ˆ`U;F³¤Fð|ªó¨ç¯Î•ð·¾—±djè‹å8SMè0é«YÓ"‘Æö£Ó ‰­ü¿ûe ¥å€¥S’I3b)À>ý" šìtW­‘BÚLŠÕªF{ðÈŸÝ’­¶g5Ù‹-ôì:šYóoS~F¦Njþ‰ð@p5.þÆ:£üFŠÔÑ„Ñä’ÖÚ-Z @Ch»ð÷ +À¥È† yÛ ü¿CeVeË]EÓÏÕÙVórÎxîiÖšaÜù,:+HÂ’gÿéžûže½““1Õ}\ðÿA¬QÔ¯!kQÜÙêâbOÜm¥0‚î–»^¼Z¤!šŽîë†7µ¿‚š¬VÒ"‡Ÿ6Ø<\ýÔäÅ%ãAKY¢[Ên¶{äƒ. ZÑ–ð”áà|-©?cKú•O+$ðŠ?PR:nNz7„¾eey`÷¨‡Äøšâùâlü|Ðÿ¾l¸³A=-K`€§#èŽ;öx+ð‘¡1Ôÿ\(xLbƒI'/>[I’NšDtCÇ^´b0šôü6©JöP‚ˆ¶bxV›’»‘FrÎ㽸Â8„iÚ¬Xñ÷½x:Y’ Ì” +þùŒCÝØY²ÇDZMë@ƒØ]ã0µÊ­ #µ¯‹5Í^°èOŒç_2h%Sq£ B0>çž–àJÒ‹¿Ñ}Íb£õûE¦qÖ4J2¡¶6Ö\DI>Áe‰]üIœ@/à>0ìIC2! 2Ò–^£H +ì¨*áDà<û+cY§ |åžYÍ*늓>î,qËC« T§h©CV@–_5)sô’ˆïL6È_Ǭ²À£šØcÿAÛÜvü±¿0ÈûÈŸÐÂ) >ó´µú++v’ì ¹Å'.¤Ëª¥%ç‹–dÛ„`S¬ C,ŠC¤y3&ˆD<Ð̈<ÈÒsØCÖd]`eô>l<#C=iàŽ¾Vm‡ç6ÀªpwÎ +WÚJ¦±Ï‡(ïãkh{$eHEÁˤ¸‚\Š ¯fE':ý¼þëvÑ9ËÁ‰ô¸YCvÚÑ7qÞohRpÈY_ü¨Fd£º÷Ö.:‹e-‹ñ ´¾@ ò˜ŸØmY”ê¦ã³iZ ø¯ÄìZC°xPô±“àÑùE?D|ƒ#öâ]o³ÐsgbÒ ±kûÀ##‹IÖ>ôœFÅ<ÜîfŒ„C²{2[«'ürqc±Biœƒçx0åÇùäÀ@44YÐäΊ“|KŸu¯ÇÌ-ÑÁ¯Pèò’ÂD=ÈÄ ÉÏl6t‡¤‰£XX‚­%Òå¨Ü_ ûÆ6Šþ~.aáòï¨Ñ>Èä'Ü6P¶U»ä#ÉNü#¡#P[|‘uþ_ö-å0”¿üc,Î 'Ëm¶y:uQA¬,5ž0^/½|ˆ5¢‚ƒâ3Ø”c’G¡ƒ¡•'å^Âc6~@3*Q6[¥(~ýsþ†`g]MZn&í–­öÌš4yMÂq„É=­½ÂéÛ¢[rËöô€ ÈÙÕ#¤bÌ–±½°Æ<=`gh‰4)&¾â.:‡Î*¡ŠT&J„éuI,+]„A˜+?¯ÛC”`V­ wE#*{]nvã™}äª0Ï¡»mêES¬ÇTÁ@féljÿ!¦( Œ1®^Ó-ëz>†) +òØ*Õ}o^6-“oÎKµEs®7÷û¦Û†®´Ï‡¾B8 °µªªbòõŠw€ß¬+ã)‡ٖꙋ؈òMÏ ‚ì÷Ï!ñSžøY<äE¬†d$@äNr'j8mÇN•¼ ÷¢0+Ò®L“Ÿ„ùk«lÐ ¾³è*6®é°æAsŽù²áj³bÚRl$ögL]¤â²üŒµ&íý¢šs€fäQ{3IB!Òa*i}„.œ9ŸÊW®vp]ã[:”3¾ Õ ^Z[ªÞÕ|åÚöQ¤E­j#»è#'éëå²æ†5%a´ +E¼ÞÓXѨaô¼²n°!úæžklÃZ.2¬±Þo|Ôä›Ã+k¹þŽ2dñ3WäÐñ+r „WÇ®ÈO.'Wä§W“+rµýZ©_ºfÊÙÒuO¼Ý†Ó=ê}Üõú':»_Ž’n¿^‡Fí“5 h‹aU;´bôŽOÃþÝEsÙÎ +ÌñC›AÎ  Q2¨FŒr2 ÆÏp²:ÁI:ùØáär–“'W³œôVkv’ä Oˆq2¼îÉÖ”‹r^AL†fëëéíÕ|Ø +b¢+Ìq…H1FõƒT0qߎdº`€ZûäÇ_Þü~@#XWeê<Šzðì{¼µyí2µ¸¦2¢æ°Ê$A¢R·"]Ï¿{õòíÁÖèMÇ_´5ÁõÌÖò<Ðépk×/_ýøÓÍá˜Ù/ƒÃ6#,ÀwK–¡FÖí1,ê4îeË®iÊM÷/ˆªz3‚- ‰ÿÛ¦n›ú¾Z•o«¶Èi¤Él`çû4JÃSËYž\ÍÒÐ[íXÅ"óJ#ý‘²w‡A¾vò l;É°"4zĶ”{7 çV RLšûçZ’iÎyrá=^é« Ö7D‰-—”šA7º’ß±½Ù2yÄñ¦ë—7Ç0%ÎÇ9²á6ÉFYm€Ãt.ÊÕd]<Ø| +žó™oxè꾱̥ù1Ö?{L“ 4ùàÝ#ÕdrzdÉ Ǹ맜¯ŸŠjE*ävï2«PW!²Ö/PKzí²p— ¼Ôªü2ˆœÚ^âJØÔ?|*Ý£6˜¬eß\:3^²Ü¹ž+¹^mË3ÃÎà› üá:;Ž/:î&^Ø»s È÷<¿µÕyÃ"Ò–KpBMI +qê„j*F Àal¥eSvk÷ÌíTÆA«¿†š,•‡8°zŸ©"öÔa£lK*ºéôŠë0ìw‹×¹NVõLìâMîUõp˜©7s˜±9McþùS쾡?ê0WQ~eôw&³u0ve%œíê|øÚr“ÂÂÈ,:v¬Š·ÿ*UG½_¾âk°\ܱÝs‰«¨ö+€<¶ ›;{:ºö«ª² à…Ôuñથ½¥„ŸížÔÒcjOj/ü‹ƒh4îƒÿ™êÏ_Üßù@”é#ÁcEŒÙ½P ¦ûûƒNnø¿u+“"endstream +endobj +6030 0 obj << /Type /Page -/Contents 2855 0 R -/Resources 2853 0 R +/Contents 6031 0 R +/Resources 6029 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2852 0 R +/Parent 6039 0 R >> endobj -2856 0 obj << -/D [2854 0 R /XYZ 85.039 781.388 null] +6032 0 obj << +/D [6030 0 R /XYZ 85.039 781.388 null] >> endobj -2853 0 obj << -/Font << /F62 1689 0 R /F70 2201 0 R /F18 2207 0 R /F38 2158 0 R /F15 1628 0 R >> -/XObject << /Im1 2193 0 R >> -/ProcSet [ /PDF /Text ] +6033 0 obj << +/D [6030 0 R /XYZ 85.039 761.463 null] >> endobj -2859 0 obj << -/Length 3166 -/Filter /FlateDecode ->> -stream -xÚµËrÛ8òî¯PéD¥"šð¡ÝSâd3É$oìT¶jf4IKL(R!©(Ù¯ß~$%Ê9l¹\6F£4ú »3~ÜYØŽ¿šE±kûqÝ,\ë–¡7ß^ß½½~ƒ=@×útƒÃ|\ľu·øûîÝÅë»Á²Ke«ÐÇu¿]üù·3Ë`kï.Û_ų´Û]­fÛ øv |é—·ÿ6TxLÍxÖÄé–·W0¶ô;Ž•9¦L³ÛÀ†s8Røq­IÚa×·¶ /²ö0LûÅþJÃãõw€’¬i¤ý'‚b«¨ÚŽIÆ8àld™ Úû-ý)h:¶ª…à þÅc+?ZlîΙJTZn–õzgÈn䱋üYÑኊ/*áOÛ%.ž4™hžq÷—¸Ç7'¶½ÈN†Z`Ž¹í¹vìÆÐœ l<ôë ðÂÈz‘Õ†Í^ZYƒ§üŽÜÐŒG0ÎHZž²­A®w]QWÌéj†Ï·E»ÄÙi]ýå¸ -0Öû†u­9# wqƒëÕmw›Òò»ŽQÖy•7I7Éè{œ—é¾Utü†:eñU6ïJ³hvEµcU’Ш…ðRˆÓ¡€Ôü‘ÙÿâuÃ(·;f¡™;Ž¥˜Ã[0â‰sPºð; ‹ÃùÄQiÒþ…·²ê¦KîaJQÂA¸Ž6È»…|ôޗ"wåp}à±ð æElË@ݲ Á{iÙ©,JDC´.[ÇÀdxõ’Ùƒ‡‰–I¨úDWÎáö -S¤<ôáí‡×LyDA ; 2{W ->ÈÓrâœbL.w´50mjVÙu$掇WŒ[+©é*`—@–nbÍànƒÓ÷º“sƒ…Þ[ÁÎvmWïÚ9ÃÑX•ò{ Ý(·ÑàéNijZ7Mž2I[*½×)‡æ‹ñÇ!Ú‘o‰:‡(GZåFží{ ]ʱCýÚÓû¤„S~^F×0`oÌX¥$¥“°ÌiFáž5ó¢Ô]Ò[ò -ú¾åø'fÃñì8Œ áÙ>±Kt­+܆¶^èLÚŽŽ‡Ž No÷»þLäRZ`éC £E™)“Gšä•²¢C»QWIÉÐyFm}ŸGï€]m&TKK‘Ë– -¡u}wé}½üÏ ÷¦*çÀ¡Rìo˜ê~É3lɱ": Âŧhÿàžä¡¢ 0Grºmtè$f¸}ðé´vËðºÊéjžóP»!A$¿7˜åRà'1^¤éKae™ ~Ò®ÎYZ¤®0}xíZ›ÌÖ¿*kºCt‚Ï'Nµ7JÅ®v®pMÅ¥ž-Ë2˜ ´ sFÇà‹$+‰ y× i'üù‚x÷K¡º‘¸×Âû¡ÆÔü#+°;â#ψÏĸ8ÔLFLŠƒ‘Ä‹˜x©et™®ùŒ`óPÍßSÅbx’!³ ÑÔ„îYËÐÈè-êôÍÄ…|ÁØוt]S`pµïrÎLØa"J1|C‹P´ãZöÙˆgåØ žOk¹<Ëyž'‘"›¬[Š -{GÊȳf`¹Dè”™°ó†H³å6]Ð(ª´ñÅ«Á.™,O›6ÏïCƒ#ÌŸ¥û]û®FžÞé;'ùùj”§›ŸÊXŠÚ ^S›¢ÇMNH -ª%jã:aï\k†âÎMB˜:‘e ªd(e®»"žŽV8œFZi­„Ö!}Aâ2n¡Ìè=N„óSê|ÈÁ| µÄ6eÉ º -ç fÇÁ0Š0ì–3Ð5‰PÈty…—Õ -Š¿|[± ƒp±"ËŸsdÃâÏàqJABï¯"_>q¾¬0I©È=GŽGr§†=ˆÑLv¨Öe‘&¢òž8²Â`“ÆÁ&_³;vÑ'$ü1â£ý%éHÄcYlwœçM¤ñk:^“å4çU< -íÈõŸTÅ}¾2©ÅꌖkÙöcÓy£âØ7v—˜«;ŒE§°aœfÒ!6ꪯª@›¹Ä1@ƒ<[³?P:€³f7-‹¼hœ^  ý•Bö©ãP¶xÁJÒóU¯Šˆbj ež´’•VË+itQ×w Y'Èp$PV’/Y·š]™îãD‡t®i§4à%Û5©59î‚“{ã>tðܧ߮íMKX €p~Ndº"$2è¶çôEFÆ”íÃÜ0Ä…E€êÊzAœùžT)Ýb|%ŠŒr„Š£]mŠªc§¾dw‚ñjÈPm¹÷á–Qåþê…ï`:|Nk<;Z=v"Ð ôW÷y'qÚ fûeãÚ û.¥j°ôO}_˜ÜõCHdáû U£à ?yÁî¼Þ—bq1)Q÷°E‘6†Ì= RL'SøfªÌ@Ép@Á]Lt-J‹ÎpÖ‡D3@E±ÄÐøT|nì 9m‚c€›pé¾ý)µç­Ð©ù îS§Mؽ]Œï´§’“°b„õr€mŽÜ3­iGõÊ~çxÄåÄiÏœ¢oMî£pHja¦ˆ¾Ó–a,¢Á@DÁÿƒ¿Ö{Á>{ô¨>ºM„*gNj@!$Jšu®e†‡¼Î›Vï#2(“Ùõ±×©(Ü\½—ŠTW~ÒI÷Ü¡R6R3›Ç†Dù¿ÝH=f´I b5¼ÖÆSy - Ò”Û/‰„ -æØx@ºI‘q—˜âNÑrk|V„ @ÊË -mrÜ1öŒV›R‚"ÙÂý<{ÓëæQÉεž1ª‘‚“øGÇFq)HIàÃÊç*Ÿ8ÖmH( ¥_ø­55q+›•ùËW”Ž@‹'°²”Rb3é/¾ÈP‹{¨jÆÝ%R‚ldÙ&Ñ(mbZ PpùZÈÜsÁ÷T¨z‚L¢VUЗ¶¨ùÛÇWD©÷’g 1$ï椸𠎭;Œ°% z ÚׂgGò…áp¡£ŠAÙÊú:ô¥7l|Gêc¤¬ðÕgF±9åÈ‘®þc9ñúèªÈV*~’°øºîtñ”ë‡ma^)ÆõLß›ä¤Jà‹cïÌTʾx)ÃhÜ·gJ“:LÁÊäÓ<Ö½Üwl-wÃâ1ØQ -¿½`*yçšVhž)°-ñ¦¶ª½ƒÂÁ}ÛýКÓËò«9÷È-PQÄ‹Ä„TDà)½ïØ@ôy${_O–ÌY‚šºœ(xÕ æºêÕžÆÒçßxŽ Ñ =w<^)Aä,ÿ6BÖKôû¢mÛbCÛÈ@`;a²ƒñ4¬ðŠÔ*f7€m´ùjžÙœH„8o4KS¾Z¢¬Ø‰¦cZ ×çQ8ljžÁ¡@†Ï¼Ø?õýçlûÈ´üÖnʲ*<³ÇV•¸! PÑdGÕ'™›„ögâŒ6¢÷4cæ÷;d~œ'ý«ÑÙ•¼¹Á]O•]åðॶÒ>‰ fë Li¼Öô% «ûjL^6ù#'ƒ”0†÷Â&cMÍlè ¥/z¦@:U3×»d²LxËš%j…÷‡‚yõ~©] ¿F¹º¼YŠ¦ýB«–¦ò91¼(OG]¢TMþm_˜jj¦K©áÖ[)CôÞ˜ŠR^ZqIXIÉXY›d1JSUcõXmMHëBˆ)ÑcU&­÷ÆHÁ†ø±p- i»ƒí´¯!ŽŠsÚ×KÚDº¯œâÈ€M¼V`t,ÿÎâk®ÈV;xÂ<Š”´ü 8Õ™ 瀶:·™èPóu•?^ìpUl‡Óõ4øeýÿÔäG68æeOë¼vÝèäÙ•­þȯÿ×Ú1×endstream -endobj -2858 0 obj << -/Type /Page -/Contents 2859 0 R -/Resources 2857 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2852 0 R +6034 0 obj << +/D [6030 0 R /XYZ 85.039 295.282 null] >> endobj -2860 0 obj << -/D [2858 0 R /XYZ 85.039 781.388 null] +6035 0 obj << +/D [6030 0 R /XYZ 85.039 281.126 null] >> endobj -686 0 obj << -/D [2858 0 R /XYZ 85.039 388.423 null] +6036 0 obj << +/D [6030 0 R /XYZ 85.039 199.831 null] >> endobj -2861 0 obj << -/D [2858 0 R /XYZ 85.039 359.625 null] +6037 0 obj << +/D [6030 0 R /XYZ 85.039 175.46 null] +>> endobj +6038 0 obj << +/D [6030 0 R /XYZ 85.039 159.184 null] >> endobj -2857 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R >> +6029 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F11 2898 0 R /F35 2880 0 R /F56 2890 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2864 0 obj << -/Length 3193 +6042 0 obj << +/Length 3667 /Filter /FlateDecode >> stream -xÚÕZYÛÈ~Ÿ_!(B‡Í›‚ÀÇzwŒØ;™NàõG䌸æ!“”ÇÂþùÔÕMJ¢fìK‚¬¾X]Õ]õÕÑV3þÔ,lÇKfQ¬l/Žg«êÌ™=ÀÌgJV83ßv§^Þœ¿ Ý™rìÄIf7÷´ä&ûh½úéÅåÍW‹¥çy–òíÅ2ŠbëÕíåBY×@ìÈóŽN’¡ Ã-Y½O,(žÁ.‰ŠŒýD0¡ì$Æöóa¡ØJ[ãIõÔÑv䒩ξˉòÑ´ñoÔ&f‡hàü¢rg¯`k6pæ%¶ ,D¶¬©x´?¬S¹/RŽõ8”‹NñÒÚ\w`¾'Ý‚é‡17¼Ð¿Šå"ˆ1®²Ý(üCg½ÄëTI4[Lûï¯ßX=@¼=}7ëœÌ(Õ :ª¦"É B'¶^nûg€ Ž²D¯k^kl*NÀØs†=ìFÖ+l£/¸å¥bE„ƒDòÚzaá*âˆdÛ·kÆÐX€o$ÅÖÄ°ðxÄ8p™<¨„Aì_b²«¦b4ÃxÓånû~ç6` «–ÀœõŸÓþÛ@*D“àà:tCQhÐÛàkѧžJ2´§<Ó™¬tFgÂuŠ"hDäÐmEµ!çd l4C²«ÛñŒÁ4X›“ÃåÂÀá‘zêÀ·Ñ YÝÄ.Û]`«!©îJBso;u.öG½žtš¾vDV=œúÅ œG¼Íb…G¼æQRldÞ)îÓ7 øŠGJpåcG¼w)á|½âc -] ìZŠÝ%ýâ(¿ÕºÛóXSkÀA­ÁdÊ-/ñBöF°(ÓkŒ3’Í=ÿ¢'O‹r9Viž©r–1ÅŠŽnäW ÔçX¯šzО¶gmæ/‘ïcJ+V f5º¤îúëU[ .õ<ü+žå]‡Ây£ ú˜·#LOÃsþdy*0Á¨\ÝÔË[½²¹{­„¸ ­š­®&B…Ñ$àë¡NƒD>ó6þ¦ü3¿º¸œsê*5  u §.ªô†Œ-)–µ¢%Ã.nWÂdM- €,ôÛ5÷½À A6tèa`‡ Úü˶0§9%\Õh¤uyËðC -‘qûêÅ;nôkâh8tðaƒ1R“š·ŒÈÈ{²H²8¹²à+Ei÷yõ…ðjÛ¶C|+q7ÊõQn7–SRuMù•uµTö‚`ε0ì¢F–³ ’@`B6âR\`œYäY‚£Ü0Iö Ç)îƒÅB+ý,]­m‚.ƒÃÝH„˺u³-å «ÝÓ±¨–ƒ÷!7ÅF•ùqléŶŠ]$ šÊ˜Üb–Dvây&fpaη=?Ç 0¢\Û-ÓèM@Óðìü@óç<Œ¸]´9¡eOfΩG'ƒâüL–Úi2…µ„#`§‰í¦ =­Ao3Æ…;dqÇms 4¹ìGÅùÃs¸_0> ;Âìqþ&G'«¢ÈV¾ï&E?çÃ%ÿ"ëüë"ôÙ‚ÎéÞ]ºwø·<ï€ hÁ]Õ½ûR>hª Ù AK[h»£âÀh»€BDcüqÐLî>qÈ(Á‚F™¢©yT—8óÆœ%±í;‰0ÖUw6÷@ÆCJÂëÄdž>仼Q#€‹û0r.ÚÄ“Ž˜I›J^„nïº]Çþ²BCë ÖqûmÄÐ*zùEAI›¶ Ýñèî=áÞÏG¶@2€ŒjçsôƦBÆ(!RÑ‹&(Ž%à`™9þÕŸVÊæ¯èº¿l‹ì¯„=Iæ'.a_€9çH'Bý :p@º(fiè¶í8ÐSï1úŒ1úÄäõñBOØ«Öà€È‡$V Åàïé;®På餼„ÃtÆ‹ø–[u9Ô‚=9ymÏÜKÞñ¯p_ôO–›ÐKUT×Á]>ßW²“'Ów,•Äýœ ˆÛþø¼ÙÊß KºvÓkJ¢³€4øöÏA§Jµ¢Aç î7r° iݶìŸO”7”Šm.Ú9'%001Ø>pî<í±Ö„Y=Šþüü¼d§B˜–x« šÏ¡zŠU6­lþ¬*ÿt9„‚‘Ç[J¾ÞåS~×¥bòÿ«p?&oÚÝ“Rúÿ“B¾K¿½åÄI¬,´½ÐŽ}Û‰‚qÇWq°Á©K¬Ý[ߛℲÈn¥®¸¢côL€ÀT ÅÆŽÒÁ$j°CÅöM (Œˆ¤€fÒj¤Ã¾锲E©Ë¹Ô[;Y¶á(hc°«ªsdŸœ]r›ÂÉ\°‡JGbÌ"#é°0ÃxÕÔøN!Ëü;­G @u­™*úùä#tơΔ›°—å=$ï2EN‚å_ñöi„"oß þEæ Ïx–ŠÆ–<úN‹ÃÐ'ܱ[`òByhP®çè²1î†Â9/Êû•” £`äg„3QŽ§“ß NÄ;°|*Þ_%LLh™‡Y3›N¥‰ÓÈZŠ¾" ñt±p’Dƒ¿L0€G–øѽIÖ'bl^^¿^þý’S ìë-˜¼jÉ㢖:ýã¼ç -Ù{)ÑÁï|_ŸpHó:%d–ßS±ªìOÆ&óïw >ú‡ -íx¤Ð01¡90:IJ¾1LüÈæxàóP22ÍÁ½{¬ê@Ç\"i¼ãj<—qâ?Rz|Tžà ÍŒÎã‹wQß=È} -iµ÷5Bø%ðüX‚øD‚hu‡ÊŽƒQœm{aªt~â¢Ê Ì’Ö 9ùãb¤Ž^æïy"Å9ˆ†ÝïQðH R‘Žß ÇAA~ãŸ^³ˆ³'²7,|i3X«mó\9,ü°J¿”§n+ž©¥ƒ©ëà«Zž$¨„_)2jZÂú\*û=Øô ti „¬âÑZ]÷)K_弌ÌÕÃf7:` éP ë cØió”+ïÈ•EUÐc‹©"Ø;åYnêÅ°\âfp_Ç0À¸!{!y@º•òµ¤j0µ!§NU\A¯ÀM¥ÓÉ +¤ms=Ñðïè)\ù:À»uü’ªÜR?JfSç”{Äüü®tŽ“ž'o],ÁbÂIµF¼+×-tø! ]_0Í„Ÿ,~Ýfçƒ\G†V£ÑÅc§ç-XÁ|Ãó;ñ™&ò(Ž­á æ ªþª«q|±ô}Ǻ6ÑØ„½Ž–øum­ Ýb%ÛKJœáŹèÒ;ó|á¥në><£+‹žžéç¬F/§Ç´F#4“8,‘©ëº|-® ZXv eĸaŒGVüˆT gçïpé7DŸK~¨¸Ø\vê -¯7hu9ª¸*ë²?@Ìœ=Êd -!âö<;Œ“éÿO#‚ÿ±ÿØâE6äËÖé´rÎCF%3ØKUþ L{¥ endstream -endobj -2863 0 obj << +xÚ­]SãFò_áÊKä*¬Õhô™7H–da¹ÅW{WI´F€neË‘äÿþúk¤±-‰½ÜUXšé™îéïî‘šyð§fIèz:ʼnru’ÌVëoö3?(XÈ‚ùÛòäÝQ0Sž›zélùÐïºA¨gËû_ó÷g·ËËOó…ÖÚñw¾ˆãŸœ+çîø·œ/”ónäöÓÜOœ?^}¸äë³›3ú `.¯qÝÍrþûòç“ËeG]‡(I‘´?N~ýÝ›ÝÃ1~>ñ\&³gxö\Óë Í -ïåÉÝÉß»­x.˜ñª!N„:qÃD³B…+”ò]­üYznèÄ‹ªž/|8}þ’­ñØf“ãXê´ðü$Ï8¿-sÞf«¹;_‘yËcm­rÜ¡˜ºÂé?qÃûüžŸ Šö‰>œ'Ðç†QÝ,ƒw¾ç½0DƒKòúOÂUŸÂ`’:Ùæù ‡_(äMJgiŽ2 +œç'Ø8kù¥Å™¸Gü¿yJóÆù¦#E›Õf}4â½8ÿc‡Ëÿœ‡¡“•ù©j¬S¾d²ªFü+BâŽ)‡JÝ0zC¹{’¨ï IÔK\(â(´ïnÀd2pX+f?4Šœ|^ø;Ÿq–@jþ +Ë›6k‹j3F¹ œ¤¼‡×Å(‰A~QþY d/‘•Àà ¶æA]€¼%Åh¢„÷êOæ§N!«ÛŠ'e—ÏŒ@H”ÓsÃÃ`¹2h´8½ìŒê8åù-¶S!eÞmk;*•ã^ ^œá¨ì^4úºªiEÖšc#q ³À÷%^:[«ƒá`Y¡8+ iZ&/_Ðv8r6|d²>\LÇÛå¬ +ܽ§v ¥¯«Ýã“õ.2·1˜µ¶ÍHíÉ•ämÏ:½Hßf“ .ô‘Eô‹â +ÕáN5O’K"«³bcNÇËÑëÌÃÈÉŠ2ûð¥ x@²eŸQ œ·ÚsL8@j€·–´iÁ ŸÄ ¥Vì ø  û¤¡”¨õ=F‹Ü¬vå=uâÒ¾/Öò è0løîG½g;^àz*mÂßÿÀ ûæ¸)°Øë|1;Úá¼Í½…ç‹;ž â_äLŠâ#ƒ½ D +2x³EÕXieS´;“HÊØI ·DŽ°…d†ë¢hŸ(~¡Øó˱š¸pj5楮€ÂÀëÃqà… ÎÞ£ª¶¨£IàœrBq˜iãJòaø`„ź ;Û¬êIÇqYÊF"Ô í¾ðÜ»ãˆ(g¹F›uä\õÃ4†(i¢^ì»QJH;Ûnˤ?¡:Y› ÄÁ4t#ÏDJV¥Hc샃 Äà¢ÆüŒÖ“fÂ[Ö ÞØýD¶»È›¯mµÀx®—*;:‹ë%æ(7yûTU÷cÛ¼±K$ówmV·Ìjƒ“Žü^ov|`Obqç‡{䶮ëlÝ ÑºI—’¸ì¬8‡ ƒ Å‘¢å4§|ÀwMñÇ›>.uÙ(Nox:ãŸÞg È(Š\/꘻„´¼v/Ζ4‡1„.¿§·¾á¼¨Ø< +FtH[¶Ø¬–p¢UèªdŸÃä÷­{à88\ˆŸášÝ6Œ{Ú‹5¢¡’8•Õ¤d¸OÛðz$rW³k®ã~drµ«)æs¨+_y-¥c_%uÞ§EìMÿEUÑN¹Lr6*u0‚t.žï^»H’¯yè¼’\ +Å_òØíÜÇú=—W +¦ü¸[êóÓŒKžÇb‡dɳ}Òeb‡O!È—d6´Kó„Ks3ÔµFýFŸ¾¥H©˜¤Î{N9’˜ƒ^²_š*!D½myžD‘PŠPñ«lÛ'0S=ð¯©nIq`Çú‡·q}Uwé‘rPÖ O¡šgò +`ÓN^(¬v¸ÅW¾R\ćW¯v©ÀnRåI†’¤Ä¤ cR G*e–€O]úéä^Ijå^ðR÷í“ÉK*slöûg›4ûˆŸD»`"û.äúìfl/ã)3¨7bvÒ:.Ð4{ME“–4A*x0ïÌØ=MT†Ä SbbŸ'P5 DÃUÖå,ðFºå¦…1ÐSÀA®O¥=P<">j ¬¸llÑ©ªÇ±g|á@2 ƒVˆD•e>c¨ø¾Åa·¥»ª–Òب¯ÐG& #ß·=Ù:£ÞOFiKÆ2Ú¡ðš*7‰ÓoÑ‚ƒ@2Ü2 ü ‚É–™3Þì  ¸O¤eÖ7ûôT³Ï÷<ïÝ?qà– ’?äMÉ;8Õ’£Ré4É=Ìx—O§@g¨ŽC +ùå]Ó²?níyìö+ò¦(å5í‘'qýƒñà¡®$‰ãï|d9±ª­¬5ÜÝ©Ö™ifl‡¢Î>-×wÞö0E¦3yÑú«iµ²3IÒê²ì`L9RÇÝÊìPŠÉÀ,, 9a"*e€bu¤ÈJ.˜ß$:y›NÝò_Û‡êQœÝ$è‘ÑE‘í Jc1ºÏì Ùôa(;U®I”‡™ŽRîï?Š¦­Å»£L5”ÁLï&˜.@dÏ£LŸBg˜>‰Í0ÝÂöi¿0]AIÅ÷:{’°%°çÐmkã ¯_ù*áœìe»k9³: "Ö®ŠŒÐ®Œm+“ÜrÔ*MbsŒ2Œ¬ œfF˜Ëµ׌ƒ’Â: +¢À´¤z  I "×£’šBg$5‰ÍHÊÂvN¢IX4SYÄ1“"\Ê0é õÎA2Ø¡ë>òUr`”~W¼¶¤Ž±bUè½ÅÖh‚­„ƒQ¶N¡3lÄfØja»ëuí¨etpÏ#’õ2ë»>žôÅy½dt+N¤­€5•¦^ôtls¦uTÉí¤é +~Ó0zC=Є YŽ +b +Ä$6# Û„~Ó–J»¶åûÈuOc7Œ{?— 9s•_ÎS,G秩xñ4ã, qÆ ¤ cÜ$:aÜ46aœíê-'­}7ðã1çä-Q£Ö˜ß·Ô–FN‘æÂ/–öÇ><}×E㜞îP_zÏ=­ÎÃ~*ñ-g~þ”móá.XÒu ¾`…Az0š}ÈM“0yC®=Є\QÇ£rBgä:‰ÍÈÕÂfD˜ÈÝFbÝ@%Î÷8­†R—ïø9ë[ʲ°û^JHp3.»­ù›Ž'óŽm2®ÒO¹mºßè&ŠbË)‚Õ>Õ}S|¨A>ê·çcQÉ/•u¿°ášn·å©ÌªO󒯮%…“R3á{î)UÏI'QÏ;D ²@òõˆ3|2 ÉòC©€´'>Ï¿öí®x¨vˆûræèZ¢¯„±5@Ö²âVQS|)÷jû}Õ4ÄôðnãÀÞµ?|%0ŒoC‹<؆ŸúàVÏдP¤’½¯‚ +X)ðè!_@ná*ñˆypSqGµwNW üjÚsöÇL¹^¦ša¬g"¿? ¼»Z«ÙE„ÎlZeß…µ1`b Lú@=øUåuUj UªB •Šq“óív_&–T¸Xu`ñpPsò%5ŒtžTTÖHg™zFx‡¾%ÕõœËÇøzïʪ.¾ ©6›½&kp]8×W—8~,ÿ´|/~58¨ÍÃ.Ñ“ÀºÇübÎ4Ò늉o?ÖVÆ7€\Uá¿ú^(X¿òw&C—+2¤äA¬ #Kg½>ýuåÔxÓ ñnÑ},÷×íLwÛ E®ç¿‘'¨ uýàL×!G“±xbí4O¦±‰ÚØè¥Ên4~÷÷]žuìÕð{ÕV÷’ú‰rÕ!®º»bÖ݇P÷Hzú|wá›æñ¦ßO®‚ò•dÈßãg•Òàüû±`¯4°6}#ûµ€&„#@È®tT8SèŒp&±áXØú`œ$ö]È¿ }ëc]»!——F˜w&¬tñeÕ·<œ}ñhâ0ʼ¬š‘dïû`€oYE4Äx´:ÕíD]'o”óSø ç'ÑÎ[ènºOÇèÌÿE‘€¯Ò¦êøøuH.‰u Ü'®û…âáõÿ·Øca61É fæË«PÕΦZ“uÊÿý¼¿B +­4墲î!lÜÂH[_ÚEewû‹D|ëéÃâ9Â#Qö O|ÙW¥‘î?€,¤&AG·`‘U˜ +ó¡-¢_à*ízØ÷Xa´÷uQ↾1«yKYÈPûW¨®ttt¹‹,-‡Êé„C¢ã¶Ê½™ìô?}Þ7Ü!Ô#ýöTÛW†jSyÉ!½æcñ#‚ÿZÐú7endstream +endobj +6041 0 obj << /Type /Page -/Contents 2864 0 R -/Resources 2862 0 R +/Contents 6042 0 R +/Resources 6040 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2852 0 R +/Parent 6039 0 R >> endobj -2865 0 obj << -/D [2863 0 R /XYZ 85.039 781.388 null] +6043 0 obj << +/D [6041 0 R /XYZ 85.039 781.388 null] >> endobj -690 0 obj << -/D [2863 0 R /XYZ 85.039 469.263 null] +2158 0 obj << +/D [6041 0 R /XYZ 85.039 719.568 null] >> endobj -2866 0 obj << -/D [2863 0 R /XYZ 85.039 437.737 null] +6044 0 obj << +/D [6041 0 R /XYZ 85.039 701.095 null] >> endobj -2862 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F70 2201 0 R /F18 2207 0 R /F20 1617 0 R /F56 1642 0 R /F35 1632 0 R >> -/XObject << /Im2 2261 0 R >> +2162 0 obj << +/D [6041 0 R /XYZ 85.039 426.274 null] +>> endobj +6045 0 obj << +/D [6041 0 R /XYZ 85.039 405.073 null] +>> endobj +6046 0 obj << +/D [6041 0 R /XYZ 85.039 380.702 null] +>> endobj +6047 0 obj << +/D [6041 0 R /XYZ 85.039 365.032 null] +>> endobj +6048 0 obj << +/D [6041 0 R /XYZ 85.039 351.483 null] +>> endobj +6049 0 obj << +/D [6041 0 R /XYZ 85.039 340.055 null] +>> endobj +6050 0 obj << +/D [6041 0 R /XYZ 85.039 323.778 null] +>> endobj +6051 0 obj << +/D [6041 0 R /XYZ 85.039 310.835 null] +>> endobj +6052 0 obj << +/D [6041 0 R /XYZ 85.039 297.286 null] +>> endobj +6053 0 obj << +/D [6041 0 R /XYZ 85.039 157.817 null] +>> endobj +6054 0 obj << +/D [6041 0 R /XYZ 85.039 147.124 null] +>> endobj +6055 0 obj << +/D [6041 0 R /XYZ 85.039 135.696 null] +>> endobj +6040 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F66 3242 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R /F56 2890 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2869 0 obj << -/Length 1879 +6058 0 obj << +/Length 575 /Filter /FlateDecode >> stream -xÚµXmÛ6 þž_adæ³Ïò»[ôÃÖµÝÃõÖ¦†¾ ¾Ø—Ml×vîvCüø²ã\’XQˆ$Š¢(Š|HYý”¶ã%F+Û‹cc±™8Æ’fžM”æp ßvÂS¿Í'gOC×PŽ8‰1¿f–yöÆ|üǯ—ó'/g–çy¦òí™E±ùøõåL™¯„zùòüb~~ñ #ŸˆÊ|}‰é/g±gÎgïæÏ'Oæ£m-ßöCû~š¼yç©ö|âØ^·Ôwl•$Æfâžøž¯'¯& RdÎ7dÕ‘ÓY¾ -lÎdyŽÇþpL9æÓYì›U#Êg–2ofnlæÍ]·¢£åR¦ºJÚÛ™_™…¶rü´,‰Xmñ¿€œ<ûE8î °ÚÊ Ìól,Ñ7±M -ÙXˆÝ -[°>¹f_½lA{p߶–>™åvàøÇìâ*;V1u̶2uÚTéÌr½Ø|•n èUj±*2 ©ÈÌ„ávU,@\É°h¥e£T›ºX÷'cþÈL—iQ¶pM×…cö-±ÖíT¦Þ:óx•/p…T•ÒþYc‰M·ÿåjæ&dyî7|)%ó,a9¸¢"7 -ø\ëlƺÀÊFÊc|pĤ…:°¾Ùnä‘Ç…}`}ëC¡õ¡ÄÙSoÌëû^Ðn®ìEU^ ßžL?¡ýžï¢ëĽd—J¯ -ÂñªØv”¼ª†XYÎ<×ìtW$PH=’f±­‰Öž4˜ëÚ -¿Áʪ£½Wy3²\D÷HávÌxIÿ·ñÄ·¾bâUÇ7GíÆ×øð¥ôtE®¹HqÏè¥D]¯…¥êØ·ÐÝ@æÊ­pÜ á#×¢knÃaÆöŸ±V ˜v,FN—Ö!`mÒ2ã¨"tó×ÅG<@™îïÒ¢bõÊ)ŽãºfTû&·ßqw˜L]f„ÈÍ mŸi¤¢Ÿ°Ž´‘Ÿna9Hp(\&*–Œ¾7ì“·=úot -<.ga@æùTÖÊ X–"ùVfyÅ¡ªtwrLÞuÅi| ‰“:p£™®Y.˜¦WÝh™¿’–ÿÖQÁ6ï‘q1b»íwJ;I£••ß0g# œÙ…â!Bñ0Lè»Åa:ëÈi¨b±ïšGõ[€ŠyßúðE%‘aa]òmxÔ—-¤ ã†_ôókºHßÙÕSÜbrêï„‚º -m¦Û¾Žk1äà:¶Ç5’g“û!Ýp^sö÷nÉ ÒŸÂ¡UTYt\Bü#i€ÜSé^Aþô§’'E?aqgC½6º9ä€Ð3¯ÚlJÕv@Uà|•—BÔgndÔŸ!…¾pE¬Á`/T°m†25ôi©Ö\ûÅ,ÍKpâ½zT¼÷g-Y0ªí¸Œ ¹.m‚(v£~3™JáÂØ ’/ÇØÄ„GÒœ<‚%Kƒ"h?]ê–OûP:4Q7 }*t®ú¼DÈú"žáþ°6JîŒCÈ_’@ïßxÙ0¿«Ìk`C³¬:rAïºæFÛŒÝqÌ“ð"tcrxE¹jdæf¦3Æ°ªWÌßä"};0qú°ÅϘÝDž͈+“¾.Tzedq«EÖBNÛ“¾™å-»JaR9“ÜÉ“s(°-öÙ;™R§Krd‘„9îóâѨë²T¦x¤¥Š÷©Ö2A`ê¯!ëÚA´x†Rœk™Y¾ÎûLªLˆ¤¼`Ì|[´CIr@#J"%â8V£ èq‰Rœi¸ -\@Gæ‹Rˆ|2töÈr ŒLéPMõrª992œZä‰ÚØwPB£XñE›‰ÑM1Zp,ñ¥WÚÌô'^xèöš•ýë~¼h%¢½—ë¦jô‹µn*Ûëœã°Õ¯áZ.µíúg­æ®¶]½•‚EÑý|;z÷¸FXÑ>8¬Œ–„áÀÇ´n¤}ÿƒ´gâÿ‹³Ñ»rÜϤÜGr3?Ë’#Â~<9ÃÛ(Ú¦c¡gíèµq6zEÚ}!Pm®OÜg9¯Þ‰z–|›à>ëAíg1ùrøVÐój¾éû‡ÓS7 -¨O i1L(\ÙÙZ)?áM –ùJCxÏqå!Eõ÷îÑýìDµC*ºâß\ˆ}fE¡ÍžÒï­“È Q;Æä'Òé# ÄÅjæb¸?eÖu1€|«¿ßôYg͘˜ëÏ9·E·ÚOO#TïAMü™¥’PÌö¾õž=-S©Î³Ñ7…¼p ”uÚÛ¹Š’nô Jç5»ƒrž’ô¢rª;Œ¢ãßµU¾ícœÑNƒ…¿X¾)•ÜWT…6UûoüÿReÙ endstream +xÚ¥TMSÛ0½ûWèh,´ú°¤cZš÷D9¤±òÓòï»+¹ŽÉ¤Ó™2™$ëÕ{OO»+øæ Ê3ë€+çØ|•v+ç ´ˆ¼…ä=̇299+4Á½ð¬\ìu ×F±²ºM?~LÊáM–+¥R©y–[ëÒÓaéô +Ê,‡ôƒI„Ln2éÒ볋ÏØ ÆJ#f8"Þ¸ÌîÊËdXvîº}щ'kOÉí`ã2\yÇ~b,8àò*AoÜhÕ>/“iò¥“ŠkšEÖ±JhYpi1ˆ‘úßÛ)ã¹ñÅÑíD¨¬3wHebԢߪä’+,/¬áR˜®=V2î¡öX^xɬ¶Üƒýo°¢;jB}XÕ.$W&{bÀ…ö^EL/þ÷Ç +‰“‹°Ó :eoÌFݼ'Ì‚ë͘‚{m™•€Ãä‚Ù¯k4[ÕÏ8àÒ1¹.1s"¯(ãÓÝCƒ—¦ 6‹ˆ]ÍÖ"g» ÍÒókÌnÃÃ曽¬›ÈXDļ&õ&âB}2ªÑqùÑ”ŠGÝÜÍo†Äõ=2¤²i´âdèOž”è5û±¤¨H«ÙŽ˜xc4È´ 2»z$z0Xo›˜ªê懩m¤ž@/Íìû2ƒ„ú­-pƒÅïÍÐÿO$ =xËr¢ù÷]’\Z¼q +§[kn 8v-ñ+ÿ®Ûß½æ´âNùýdšÞd)¹Ï”à2vZ XL£7Nµ žáßa)endstream endobj -2868 0 obj << +6057 0 obj << /Type /Page -/Contents 2869 0 R -/Resources 2867 0 R +/Contents 6058 0 R +/Resources 6056 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2852 0 R +/Parent 6039 0 R >> endobj -2870 0 obj << -/D [2868 0 R /XYZ 85.039 781.388 null] +6059 0 obj << +/D [6057 0 R /XYZ 85.039 781.388 null] >> endobj -2867 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R /F70 2201 0 R /F18 2207 0 R >> -/XObject << /Im1 2193 0 R >> +6056 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F15 2876 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2873 0 obj << -/Length 2539 +6062 0 obj << +/Length 2861 /Filter /FlateDecode >> stream -xÚÍÉŽãÆõ>_Ñð‰F4YÅ57'ˆƒ 2 2m´;Š¤$b¸($5íö×çmU,IT$€Ñ@³–WUoß>ð>d±èü!ÍB_gÙCÙ½ °ó·7¡@D±öã(‚ñÊæÖìnåQº£R_¥úa«"?âÏo¾ÿQ*ð“D?<î ò±úÅ c³ãÀûizýfz ~ ¨®6[¤Þ?†ÃÐO8N¼|B¯ž7ðÿy£¯®{†zjújàe¸CÀ?û®ß¨Ì›ëÃXÌÍ Ìö—Ë€‰€ðñ}SŽÃ4ìg+ ÜðžgDŽ‚ ½ù8ÂÞp>y^ðmgdxƒB‡A$ÊÕ-Êž‡GØ*&†5€Ëk‚ìˆCÔËœˆ(AašªI…TLϨÈûî8´/<òšö;7=õL7Š¹\ðE|]%p{wÂéÌ'púŠŠ4x®ÃÅšÙ91ûaäÏ[<ðdnºÚ_!æi“Ñ *ÑÞ ÀGzm’›ñÀ÷?&®(ãØW"ÍçÆêñ•¼uâ§y.`oáö4A¬T¢>|á„‹ÞЛ‡h5A%@û±æ…ÏE‡Û;9;ÑxfA×@Ÿ˜¥cÑM¼QL nN‹[:³ÒÑoÎG2f›‡~X»ì9# ¯uGiíµô&Ý3Fa×ÖU†¤¦*÷vh2§Ó$ \`…ÇQÓàì"èÕQÕB©V®-àò??ý…eѶÓ[Wº1aÿ‰ˆ>Š|ÛÝ[ÀöNvæ#SK2}1Ê ÷Þ$ ê,'A'ÞâùH<€”ðÆEG£Ðûl¸„üøÚ”Îòs3—…–Ƈ>[ Š-›3¯ ¯EnÊÆ­Ú“'HR¨¢až8MHˆ£¦·Ð ‚ŸØº‹‘÷Ä_'ÞÀi±/PÍèÔtãÐÙZÔQöy¸à€âöÏ<ë -&œ¬ÉëFÞã±Y£ëTˆhJUÓCåØìxÔ±ðžMP#QîhTñÖôBgg#“î-Ÿ­C>´é&{€¶7îÉ_–¨ -$œfÆ›_x³™ù{I>_ñ=Áñ-ï­,ü–ÆfâMð£bX‡ó¸˜—½ÉFÐpçV-Hh˜¢ Á£_äÊÆZËoÛxA'çß·! ñ«15ö³0üfLUSßõóH -DœüÿETäEž’ -L<$¶Ôm‹³ÄûÒ3ëzžÎÇbæ‘è3°Œ†ñ{”xiûÎ=z Þ"M9Ã2Ùc.q”CZ/Vè@µµ,ãærsg7MVu+·á{ ×6Ö'{Áä\CJE©5|ž‘mãà0R„=á,óHï÷¤7x=|¯ç]à /†ÎóJ‚Ðbc¾Áѽĕc?pxhjIñ°Å(€¿7„lWLä*0}1f85¡ j–…):Æ0Šá~LÜht,d©+ªšG K‡†ˆ„ð=·ËúI|¥q²49/a’Ç$xx SßÉ»˜óàEÅ -i°›xŠü(J㡆ñ…šEÒ“¯9c­woù(¹“ŽCÌ(è9a0¾iÀ™ïq±‘/iˆ†Š`¥c…MÉÁÁ>ñ÷wK8 *ÖÓ°¼PfŽ°ÜT—úÍ–Ä1î…AÈ%qöV9(‘ÒâŒYÂJ±]¡¼Î6ëSQBT«(–¬uAÑÔLE&r!°Qn_X² µ´u9&¾È=îÚÎÝ?3À¿±—/=7³ÀR>HB9Œ–Ó­ÁSäŽCÎL%âTFòÊ“ðÑŠ"p,ŸFgÞš®²v–°áˆyf6°ß2R-aøà2`¢—;&ˆÛÓОÉ^9ë쑺¼¼'r:C%$ãÞp»\ š&ìØ¿Ž*#¨€Èà#È|+²nÉûiź3…¶6¾R¡ÚrŒ}Ÿfá”™6 =~ÏdG×ØF€„¤ÃC·ìP2Ž|nëÙ_©esJ&È\L`F˜À÷$E¼±¤åÈköX0럩tª+>éj/LÙŽ9UÅÕR<M8. ¢?\|é)V¡LCéÿ¾äÕ+Ùž-$YÑÆTºàmŠ&¡[kQy( V²f`ÌÀ?wvñ2³‚,lomÙBÜàrë'ݽëM©M˜\ 5Js ÐkõäQ¶‡!s…ºdÜe|"›¸ÀÒ]UÄM®Àȃ¶¸T¦nñÍ‹NÄ×ìV<0û¤VXù§ëœe›FÀ‘d-© _'Òö¢t. -WÒ9àLz}oìGñ~nÅΫ)âGdã é>9Å õ¦jAI|_h™öÜ`9I~/‘ºÛØR~þÁ¸óyl[ -—…4^^å‘vJÌW‰ÿXÄ~BRŠ‰„Ëal4n€ŒˆÃÁ2Àº€'©+ݬ…Ä·BâVÅ~D\©Tµ)Å°ÀË3ª–3ª%'§ø†zÉY|Û½Á#dÕÙ’åàøÜ_ôvaeéÑàLìÚæÝ/3ÎmÅ7O¬Èè¥l–ú•T—ÊwœC!‘¹d¨À´Þõ’PõÜÌG*Pfž#ŸÏT Hþhs -Ü5ÑÏX_'] -dÃ*Ícv—8º¹1^r#ï*B!jdòT"Ä^9Öh ’_À‚d„ySXqXþ21-}`lQƒ±É3Ñ£òe7%¦J>yÏhœ´ßâÔÑ™1·(›¼&_ÒÝ(­ëšxJœ‚oÝâ²1®B&äy9<ùH8çñMÃÅyb©ƒx.Œ³ÖÚà$°K Ș®q¿æÀt(lµŒmH2©?l5ziÒOÊleR›VKÇiæÐ_(bÈÔ‚_2 íÄéZ„ ÐZßZÒmk%æ8¸Í3_%êÐYÑÒYyâþÿ°´»`þi˜Íÿu«E¿î<¯{º&T^þ¶0]¦h±“lE¯ûQ-Kûs€­^`¿+úâP»-“.šÎIŸ•íè&·ºå8ªß°S%zj7 -îìòe°G©"éY(¥z-užíZ†\*àWyp‡Û¬E¦` ¥3ï#õåÙÖS0i&ç`_ šG[Œ‰|¡…­”r»µ„±H1v‘RW]]ܱîvM ÉlM¼Üìù»8‘^X*5S‡À©žÛú60(ó½ïÑûïcÅÅKßsÙò$v63Çkk+Ùš™-ÑË©)+þ÷Û€¤mòV* ºñ¡ÑÝhPN|ø''I(|NâD +$“ÅæÄŸÜCÏÇi(f†dÖ£ùe~rzé‹ÔO'ó»nžP¡žÌ—xïÿuv5?¿žÎ´Öž +Ätlj÷á|*½›ßàÏ|:“Þ(\1ÉÕõT%Þ—‹O¿ŸsÃç³Ë3lú4çŸqÜå|ú×üדóy+]Ë$IQ´¿OþøËŸ,a¿žøB§Éäe_HèÞœ€l" ´©¯OnNþÝNÅ}Á„G !¨H¨ + +hTpœS¦Ñ ;2‹”2ˆGç¡Q>ÌÃ%&O^Ì3“R -t,R·«‰”" CÜ )c¥jHÐ]V€iƒÛ¿ÄÕ’Z‹4!d'O¤ðƒ4ÕLÓ+Óº…QÃ駜|¨@ÒI'¬N… +£‰U +GÔM†‘Ha•³X†"Œ»åȤ§o2öÌ2±D¸)^­"NDE“ÞT¯ùš#ü’@(õŒÝ|èõt¦Ýþfø£¼š@]àß=PíŠù‰i¨çXX"Pú-H´6ô:øË. aò¦ç°°sKí‘„†uE2·6½6U9€iž-Vhæ#pY‹UQæä:”÷ FÞqG+¾JCpˆ07¹’†{É5â/ê R æƒöuìXV– ç!wÕ="ùê×â¡_½¿€P:” ü(˜¨üKX{(ÙubMƒÌ4a‚Ž{ëý.çR³Ê[2Á8 5h4ö[Гµr¦‡mÎ5¸°¢kͺ]Û"…ÐËj“ÑŒºçS©öBŸÑƒ¿{>™P,ÔJD`ìáZh<\³D(¾ לül¸ææÇáZŸÝ<qظ8¢P*ˆFÒlCÝ°[¦0E<ª(-%žÉfŵ̴v>xÊ&‚2¢XÌvnQíËFŒÁ¤°ÄÔvG3¶¡A†zk3 µ“#ÝãõtêÁDKÊï‡ V`C†›&›B¸¸kÜ\SŸfŠ`WcÓ½/G„°7’‘JC„ ƒq,]üZ0ü š=vó)x­'6¹ù;¶õdÐ7‹Ñu‡ \œ×‘c݆ Ç×íâ×®ÛÉϬ»Çîmjôå·Q ÎMä±cÔ9@0DÈ/ÁůÁÉÏ€Ðcwf2!ÅbWÕÕ]cªY‰†æž<ÝÆø;vN`úáâaï,ÕÚ8h~lâ<8ÉÖhVÆLzãfIÂÅ! Ú95D¸ÂxP¿P'?hÝÛ´ê¢`àâú¸w#9fšÎ–Kýô'ÛT#ë(önÊl;+J¼1Ę„2ü?˜Œì˜Nc!céÞ±ÑøŽY"d˜Œî˜“ŸÝ17?Þ±>»Õþvm¯³Ñý‹BXŽä㎔ŸB(ò®ÐÑÐQÀ€u «8IÁª#r`eˆP’t+¿+'?ƒUÝ[µ»¤¬ÆjÈõ¦ÂOŽ©ž½Ö¾§PºÎG1…ßó¤L;¢5FHàzk‰(ÍçƒêbØ‚êdh@íñûQG¤u$Ô ,‰"¡õç9¬ÚÕ;X™µ·œ>™›Ýž°ðø–ºZrÍ™ƒªù‰{mJqô&¡e(’øHDÖ#ràaˆ‘ñ«„“a‹‰“¡A¥Çïüû–®ñË!­”P±=A¿Wx+õÙš)ïñÀP–3¬Ôö ]5¥YŸýA t›¶:”`-ý ËB¢[§Ô3%#‰oUþéËà~O–1³‰ÉH‹8~žïè2’ÏDH…–éÍ߆ÐÂ`RÒf­÷›OSô†VF4!½Lå3¦*&¹ÞæŸe*ûÓ€:ËH¾QvÊT’œWSÚ ØDŽå‹x$kc?|‘ppã´KÚ Eé}WÁ__H®ašaQ€Þî5¨Ð÷n@?´‰&Ðϱۊ­ÛZ“N05ê+ÞWø'Ç.¤ü +£Òï”LøÜ98zPÄÂ%}Kœ*ßÿ~úíª§Å¨BüV€wàVŠŠÎ(Ñ]|R“*‘ù"¨#aeyö4np‰!Nù"uC‡bWàQEdL®^ËÈ[æõCSm¹²5Þ_¥j¦3V ¿ºàkž}åÁ_ Ôîsñ8å®Ö|0ô•M–²Âü^~™s¡ûX â,k^.[¯IU‰÷jõà]£U€íÛÒsKo}X»1¿YÉ49IY­[L sÛ~RÒm¡+–íhôà†Ës¬ ›Þº±¿Øq£A¸†Š"T§nB%+ø£…}@×9xNà?/ÿ‡¾¾j•*ÐpŽÒa¥ +h“´²ÐÆô_ÊêD„‰~-ðÿ'wÉIendstream +endobj +6061 0 obj << /Type /Page -/Contents 2873 0 R -/Resources 2871 0 R +/Contents 6062 0 R +/Resources 6060 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2852 0 R +/Parent 6039 0 R >> endobj -2874 0 obj << -/D [2872 0 R /XYZ 85.039 781.388 null] +6063 0 obj << +/D [6061 0 R /XYZ 85.039 781.388 null] >> endobj -694 0 obj << -/D [2872 0 R /XYZ 85.039 761.463 null] +6064 0 obj << +/D [6061 0 R /XYZ 156.947 730.534 null] >> endobj -2226 0 obj << -/D [2872 0 R /XYZ 85.039 642.137 null] +6065 0 obj << +/D [6061 0 R /XYZ 156.947 550.26 null] >> endobj -698 0 obj << -/D [2872 0 R /XYZ 85.039 642.137 null] +6066 0 obj << +/D [6061 0 R /XYZ 156.947 519.114 null] >> endobj -2875 0 obj << -/D [2872 0 R /XYZ 85.039 617.419 null] +6067 0 obj << +/D [6061 0 R /XYZ 156.947 497.426 null] >> endobj -702 0 obj << -/D [2872 0 R /XYZ 85.039 490.465 null] +6068 0 obj << +/D [6061 0 R /XYZ 156.947 476.345 null] >> endobj -2876 0 obj << -/D [2872 0 R /XYZ 85.039 463.851 null] +6069 0 obj << +/D [6061 0 R /XYZ 156.947 458.143 null] >> endobj -706 0 obj << -/D [2872 0 R /XYZ 85.039 132.463 null] +6070 0 obj << +/D [6061 0 R /XYZ 156.947 435.697 null] >> endobj -2877 0 obj << -/D [2872 0 R /XYZ 85.039 105.849 null] +6071 0 obj << +/D [6061 0 R /XYZ 156.947 414.768 null] >> endobj -2871 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F65 2099 0 R /F41 2104 0 R >> +6072 0 obj << +/D [6061 0 R /XYZ 156.947 395.05 null] +>> endobj +6073 0 obj << +/D [6061 0 R /XYZ 156.947 375.484 null] +>> endobj +6074 0 obj << +/D [6061 0 R /XYZ 156.947 356.524 null] +>> endobj +6075 0 obj << +/D [6061 0 R /XYZ 156.947 336.2 null] +>> endobj +6076 0 obj << +/D [6061 0 R /XYZ 156.947 300.206 null] +>> endobj +6077 0 obj << +/D [6061 0 R /XYZ 156.947 266.333 null] +>> endobj +6078 0 obj << +/D [6061 0 R /XYZ 156.947 248.13 null] +>> endobj +6079 0 obj << +/D [6061 0 R /XYZ 156.947 227.806 null] +>> endobj +6080 0 obj << +/D [6061 0 R /XYZ 156.947 177.657 null] +>> endobj +2166 0 obj << +/D [6061 0 R /XYZ 85.039 116.799 null] +>> endobj +6081 0 obj << +/D [6061 0 R /XYZ 85.039 85.843 null] +>> endobj +6060 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F14 2895 0 R /F20 2865 0 R /F15 2876 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2880 0 obj << -/Length 3544 +6084 0 obj << +/Length 3250 /Filter /FlateDecode >> stream -xÚ¥ZYsÛF~ׯPå ¬ ÜeÙIœZÉ^K)§*ÉÀH”ABA+Ü_¿ýu÷ ÀKÞÚ-—Œ9z®žî¯axпð:Oý .®gyèÇy~½X_×Kêùé*T -ú›ùY˜ ïÍãÕ?fÑuøEP\?>1Ícù»wûóÍÇÇwŸ&Ó8Ž½0õ'ÓÙ,÷~½ÿãûw“Ð{+ÿüðÓ‡û)¿y÷ø]ïî¥þùýýÛ“(÷>+Áý£|oîu4ÍöJ‰÷ë |ÿÓäÏÇ_hÓ0öÓ¤àÐ4oh&ô\½{bæ~F8Æ_W¿ÿ\—tÔ_®?.òë*~X×ë«$Ål±Ö›«‡«¹i¤/¹–Qg¸5M¢ÌfTˆ?Ï®…é®õ+:G5™&YÂÇM²È+Ûµ©7Rî[|co>™F3!Œ½ÙN¦4°”†štÀzBt»ظÒ)V:lkÖ½ ÜØ´Ý4{¹Àjƒ}­;ÑnÖ¼87õvbŸ'QFgzäcHU¬=›y]Å#°§¦—&Þ'Ñô+£-/«jS}Åî¤ÔjxѽTžy7ËìÁàv#íînDŽ1ü7éY›ؼb¾+…Ù~q‹W|ˆéø)¢}¶÷ˆ­€ÙõfI£R:ý~ÛsûZê|óôm°9Eûú‚£>K³‘Ïp!4´ü ¼e×¸1ëê{*æÊ‘ýµsw¿ª—ºi¤o5ª(“ÛFxXZ’¨ öÞ7qOã_„¢ÊÔfeåE+Wßµ8ccï'* -ï Ç8žcûÌl¨Væþ„G•2j<9ØÇ -û0~lȇûD›X%”,.àЛ@$êh¤ 65Œ$©Ù Ð÷Pµ‰Ð0ðQaÉ€ÅêM5\©îÎè—8¹?… eÁ ÎÛîš,ž…Ë£þ݆äqb ßI‡_*‰Ñ0Ò›4ÍÍ{éYà”\°|hQxÑV(¬¥Yäm[ù:âÞÍF—#;‰2Nw~„X~òxŸ<òv[§oX»åô¢ÕZš¹^|gÞÍŽCŽêüÆbçÜ¡º.¬èé#xss'~ -¨ùþöÃE®…–}púÂS°¼*‡]˜oî‚Ykdýq:Bòÿ!F¡ŠîX*N(ˆ'Ö#7ÏØd£ð Ë<#øqe5tsìõÌ놥ŭ[¬.¾Rk¨éáçŽkinŸÆçäÝî7¢Kaýo‰(N|6bÀÄùèJèÂÖölßyuëaÐɭ設Ӆu\¨Õ ~±k½`FZGÕÝÒmû¶cMgŒ2ã¹Ñ¼lιþˆ´µ‚ÐmH”Å3 [™‹F™·ÜJp4«:ˆ¡œ® ¾øÑ,¦ožûÅì\¦ÁR„¡E¡Ë3DÔú®dÈ3„©û´‰]6²“GŽ¯[V€êlWw{y~%¯î"§ïëÉŽã°)óE6­g$^V–¹x…D×vK#2%.­ƒãH••a µ?`KÌ“ð”×N’î9ãrh9sØ0Æ>uŽzzªbÄÒ!ºbÉ+âö¡öÂ>£zÜbq~Ñm‘WaŠÈ}f䑲ú’<„…þ‹;§QC»•~6ƒEl£ -áT¬È¢³þOÊPÑœ‹õ›Q<:6[1¡ç`³Ùè©ÈþiHiG0vµŠFè‘C¡¤ˆñeÛMòR3¿ÚÆÈzýönyKºƒ+XÏ +õ%G[¢BÓ³áBv7q™*ngÄ Gq·èwÎjûÌ.Ž¹U¦—dXªP³Üæ\†R¹Hë—ëz3H.m Ó9!'Šv,õÕîLyæÛÎG9f½ õ(Ïú ‘"ŒsŽKfۀĦnçƹù¨žJÄe‡fÓŠ>Àý2«<•æ-˜ KPŸø}Ö˜ 1}SQ¢=“VÍoeõ·Í*õÒpìób›dê2cÁì(d.† 48oƒ˜)õ`Ù=»èç¨;Šq\Vì#&5/˜§¥­Õ7›…‹È³$ònŽÛ…\Ýr*IÎ|øŠƒ–•,èt©:¿×Ž¨ -P‹…çø°ë ¹·L¼sT]»mŸXgÄUÀô‚+ªùâÄJ‚2'Ã9Ef=ЈÂ'I v€O± Yò3þšeÉš»¨c«Û±ò¸ìÌ…ì™UµA“Ñ…½—sŠtѸì*„QæIþª•Ný\ž@œ¯øq’ù - Ü„¤ð~fì›ÄpÜØG 혫1É ,ý 7‚‰pW6¼¶«ˆöF¯;œ¨ˆÃѓÑ­¢®qúu†Ý0’à†-RH!€¾ÝYŤϢ©UYÐøFM¥Ru›àâxZó™‡Èϼ!oZëmP¥ãå6j¤8äO³ƒÓ¤êˆ.Žà0•å¹ü±-È”?¥©Öì‚RXÕÔĆèDR–qÂñªŠíDu¦&j’$râ~qf¥—1‚´õàAQ›$ë©à0¼.l{ÝE¯yxD˜ ëÔ† þOõ(#À ûv^'ÃȪà€2Ù*)/«MÓ]ʘ¹u(âÂFšwg­iäŒjç¯b¯Ð:\¿]ÂÆ̱NŽF‰9»¤T†ó¡¡ É_ÏÄAá{—Ʊ™ÅM«)Iæqrh19j¤ÁÞÖÄ”'sFìF #“/l@_ÏÅ0êì6“Q ÁiÔÎ ­:„—!*Íý Ê¿ÍäQöÍh&G3b\¬aN}¢žî©wñaæ}ìÀ$ÇJRÕ¡ýÖpJéD®ÀO‹ôuäú0 G*®SÀÙ ¾£ô‰ƒT¤ç‡]ƒ{À_·µ…>3UâWo„=‘íèÑlÑoÇþ‘*7îØÕ#A`{<)’‡¶W¢#ý§:í½•<ÍŠ¸þhñéã-§ŠÎ„ {›šæÏ"›—MâC[”¨-JÆyo´ºìdIµÝöBwÞÊ®jå@hŸ»Q|„v•;œ(ø}#á´®<‹Jð¦²è¯ÁòìÜû†D`¹Æ@‹fWZ_<ÊñʇWÃТÏ¡ï_ôŸD÷kÅW¤'‹ôð¥ så ¤g%³6Ñ7¦bôÎ5=§ï­²¢J‹¦±Vþ™ ¼ix¥v·\a/zH²o -0E4ñÝzôƒ€êð ¼Þ $:‡íÆ>éÒhìܯQæbÃùm2Å‹Ž©›±‡L’çhÝ+Ï ‚è5z­ÈÁ0µ¼JL¹“H—;ŽŸ_3}~M‡#t%üý0¨~'o©wŽ‰'L¼ Iò€Êè•Qß®ð=JÜ/˜áIÉÛ;¸||1Tî%r4¥È)÷,u²Ã|¢9N‚¿yšÎ‚Ü{³¿Ù%äe—~'Løÿ~ÖÏü0w }ÕŸ £ðx£aæÇYrè*ýÍõYendstream -endobj -2879 0 obj << +xÚ¥ÛnÛÆòÝ_!ô%2­I.¯}Kc§MS;>±Š¢èé-ÑRTH*NþþÌmÉ•DÒÅ)ŠÔ{™™;åÎøÏÅrt2‹bWé8ž­Ê g¶Ÿ/\XÈ‚ùiyqõ.ôg®£'™-Ÿz<ò=[®ÿš¿ýåÍýòæÓåBk=÷|u¹ˆ¢x~}séÎ>Àÿ–— wþ÷ rÿéÒ‹çß½ÿí†nßܽÁ¥ŸææÏÝ-/ÿ^þzq³ì¨ëîJ$íËÅ_;³5°ñë…£tÏžaì(¶Ë  M¾–yqñpñŸïù3>5$‰@Ç*ˆõ¹(ÜÀ…ëzJ»Þ, +8>Éb]!#ÏÍåÂw½ù +9/€Ÿ<ÃÑ÷Z˜Ò¶ž§k¯ô †”"À¡ÎE»…•)ÿΓüÒ £C5LŸ²:ãÍç¼ÝâÈ`¬{j^ÿŠG³ºÁ%DUíäºê‰ÿÞâãñð<¼CR™7<Óàó€¬.Š2!ÖWEž1I„Vñéûºz„£éc”{:!þ·@‹ç;ó²B’q•Ž¤G¢BPÚ«™‹¦Ú †ŠÿÞ}\ò Ì¿ñ`r¨þë¸~òÃ+r7A($^šb30 «•eðß#Œ@qñ$®Èfì½hÈwÄ\X…Úm&zKÏŠ¢z5øÛlÓ:“¥­ Ø(K™=´)š—œ»íEwà•+þsÍïøÕ Ú˵, !'É·«Ûì5?ŸE'‚¡(ˆ·Ås»,o©ã©†¿Íž5q•?¡zǨ:mç­Ê’$ +ó}FÄËF«t„Ì3¹ða¡ãq3¯Gó¦ÄW@·¦@‘žÃ>­AT½;nÖèϹ +7¨!kÇ#Ñ(ª²ªÈtËN·ê^@óÌòžÐ‹ª¥;Áˆr¬6$‚óæÛªÌØ-ŸjN0¦8>ñœ"¯Æ·±zˆOE§Co‰Nä¹WU]3Zµàøc>òÞÄ~‰|T<:J¬Õ){¨«wÚŽ½^è(ÈA@¤H<Øe­®ß,ð(Hû‰ru$p(Ÿ\ŽŠƒên9l¡}WE^xôŽ¤+†Ý†ˆÃ³˜ÆËšÂÖ3Þ_ç–Ъš¤¦FÒ Ðu•“iœC¹‹»®Jð½ûÜ%H¥ý˜ÔÍS@fpAà`è¶xÓa4¿Í7µ±ž0„œuõgÚ ®i×d´x‡ã¥å9Î7ÆñÕ_ÉÿÁ˜×Òò1a5HB¥ÃIN{ñ$-ˆbœ¤-·œ*9±Ip¸«(r™ÐƒKäÃxØ´èÌ|'êU'ä€"y5tBè¨7¼Ç~ö;O:;ÅIT³…üTþYL ·0)DÕ‘uòfñ|%oÛ2Î] ª2©Ý+sžæG”¤…:tIG†.Q&¯9…ëm6Z +ÎZqÖù_ÁÈ '‡ÝU(‰â5,öŽq"®¶§bÍ´“ÒÁv*Piç„Óó Fâ´ÄWä#tX’`zý»À¤û¤õò]w~û¤ oJÞó(‰: |è‘Ô_í¼7›ÃžU¦ªM% Ãy¶[ÕßQ4­°|þ–û´i(y¨ê5tGÝC.-ò¦m¦éœÃ¹Í8‰òïÄ9¸èüdÒÞÙ¬ï/‰m£r–Iwé&+³]ËóåeB†¦á‘ŠfŒ)'æNsÕÃŒ»?ŽU˜DÄÖï;¶±óÎÄš.Zy¡ønÏçŸØ¹WÔJRvÙøS=€Õ3"“3ÓZÃ@ G3Òq¶ÑÿïSAƒÅNfœdå<^Õ韟àqZÚÔ2²çÙÑy %Ñ‘E b Zð\þU1Ë°ÔÙÊYúêæk'Žï”¸uÝ°W˜õÁ(ÄͶ¥$ûš¸Ì¸±I„™”ݸkÙd”>b IÇÌ=zۼÌMù áDŸóÔwÏ…ùÌilXuIˆ+zÀ5Ï:ñÂx]½f‘4ùs9J´qÖ xÏ ÇDlcéEƒ¡çå¾E)=Çú¸C&«­I^²‚R°†Ú{ã¡PeM›¤¥8£PJß%®ßžy?r¤Á3ËÌÿ…×Ð\ƒçÏݧ‡ÿß•AüS^¤Ñº•ãEÓqȃê×qôt2@(t=‡,L£qhú6ñœömoíhà›òy\÷C†&®¿×.µµûb €&™hþˆ:Ù¶d‰£‘Ý }H=ü$ÚMHT€ðjT¢S׉NÞf$jÝö~wÞ|f ¢RáÛyÕÕ'2O Òá Ìï{§+ÝœsñG‰ÂOmÜ~[K}pl€Øçž÷H^Kí°ùq Yçºrc“Š®Äõ@H ±ÀŸ.F´Y¹Àáy4šÆaîxªªÇ´U§½PX@ê$@xg0ªNS×uš¼Í¨“uÛ‰š¦²ô6}jÃÈ®(WØ)Ð6Ým²!3uTìÇ•kï9Nð£kpÞ£Jf”Ø—ôÚ–ëVƒôù•18 ãLØèëÊ·Iß ¡ +³šxLÂÛÃÑÇœºÎ<æämæ1­ÛìÇt~L'±¾Û9V‚„;¯ð“¼ÕÉb󵳄JwÒD\òÅ)9¯2ªK0i'1&ýñÃÀS¹QWŽÖå–Ú@骨š®ón¾S +¯ˆÍm—mòj—Âfõ+©5!Ì"Vòöõhô‚—¢o4¡„·G£ú0uчÉÛŒ>X·Ý™î5ƒ:å¿vYýÒ;‘dc­œð¸ˆG™uQØ—ÚQ*µDß}vÒÚê)iâI‰jšÊ§%êùÇ6»4鷺¿´7ÝJµ`Æ{©.”UqâŸôR=é¥>äk ¢&k.½aBÝÔªÍÆZ¢é$u=ÌxKÔõ!™LøþÄ’ åæ™fü–?ƒÈÇù5î€dÑç·Ò{ŠûÞe’P#ý=Â_ è#³[X±iaÅR`sBŠu»8èm–oè¿Àb[œ~` dQ/‘2ÍÜr)¤j îë¦ë“pV¦æëjºÉF{”äälЫø ¹{L òÊáÅ´Øó'Tš­¤jò˜:rG¡¥¦Bà /û¯‚ªàÁ<×.00U®ø¦C÷¡†¯ê‹wþ~1ö½ÿAJ†Cwcóù²ù¾[ñBÉŸ~E9)Å3–¦ôÄóÜê~Û_€åqPg¬J6„ü&>ýVjˆÉZùˆ\•6¼É?±àO˱¬&üã¢â¼L?ÎE­àÐŒù ®3²9øÇBüW?Oë,××*ÖÉ°á z®¡…*6×=¥×üŒíŒàÿ.X˜endstream +endobj +6083 0 obj << /Type /Page -/Contents 2880 0 R -/Resources 2878 0 R +/Contents 6084 0 R +/Resources 6082 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2885 0 R +/Parent 6039 0 R >> endobj -2881 0 obj << -/D [2879 0 R /XYZ 85.039 781.388 null] +6085 0 obj << +/D [6083 0 R /XYZ 85.039 781.388 null] >> endobj -710 0 obj << -/D [2879 0 R /XYZ 85.039 461.534 null] +2170 0 obj << +/D [6083 0 R /XYZ 85.039 611.175 null] >> endobj -2882 0 obj << -/D [2879 0 R /XYZ 85.039 440.943 null] +6086 0 obj << +/D [6083 0 R /XYZ 85.039 589.314 null] >> endobj -714 0 obj << -/D [2879 0 R /XYZ 85.039 302.771 null] +2174 0 obj << +/D [6083 0 R /XYZ 85.039 520.72 null] >> endobj -2883 0 obj << -/D [2879 0 R /XYZ 85.039 276.156 null] +6087 0 obj << +/D [6083 0 R /XYZ 85.039 500.125 null] >> endobj -718 0 obj << -/D [2879 0 R /XYZ 85.039 204.579 null] +6088 0 obj << +/D [6083 0 R /XYZ 85.039 459.478 null] >> endobj -2884 0 obj << -/D [2879 0 R /XYZ 85.039 185.707 null] +6089 0 obj << +/D [6083 0 R /XYZ 85.039 434.501 null] >> endobj -2878 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F41 2104 0 R /F20 1617 0 R /F56 1642 0 R >> +6090 0 obj << +/D [6083 0 R /XYZ 85.039 286.575 null] +>> endobj +6091 0 obj << +/D [6083 0 R /XYZ 85.039 275.882 null] +>> endobj +6092 0 obj << +/D [6083 0 R /XYZ 85.039 261.727 null] +>> endobj +6093 0 obj << +/D [6083 0 R /XYZ 85.039 248.784 null] +>> endobj +6094 0 obj << +/D [6083 0 R /XYZ 85.039 223.806 null] +>> endobj +2178 0 obj << +/D [6083 0 R /XYZ 85.039 179.322 null] +>> endobj +6095 0 obj << +/D [6083 0 R /XYZ 85.039 160.848 null] +>> endobj +6082 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2888 0 obj << -/Length 3665 -/Filter /FlateDecode ->> -stream -xÚµkoÛFò»…Ñ/¥ˆárùì7×Iz¾kœ\í"zý°)‰%*$ûëo^»$%Ú½- ƒûœ™§Ôeê2‹ý@ç—i¦|e—ËíEp¹†™.”¬€ÿÔOT„sß?\¼~—„—*ðó ¿|XÑš‡âWïæ×ÞþtµÐZ{*ö¯išy?ßݾ»}{¥¼7<ñã‡>ÜÝsûû·Ÿpêí÷?ÝÞ½ùpfÞ'Yp÷Àßë;Ù Ð~ÁVäý|oï~¸úíៀÀBi?ŽrBÀ|pæâíÃè •ù -ñ_.~ý-¸,àªÿ¼|g—Gh¾ÊóËíE#4-ýúâþâß ÏE—¼k†Z‹(Lü0…†ü,¨¦âªÜ£-—W åõõÓÕ"R±÷åP¶O8±[ã@âþ|ªv0X4H£c‡c©÷i{Ãó«¦åÆ;YÊ€¡Ü^· Îï¹G q£ò¶¸Ãôxp³{Ó:ñŽ8F¨à¡ÕÎÖì»ò÷XR2—˜‘g–tA:—õÌÏj·ÂÃÚ-œÚìx¬‘0.¬¦kïЕ¦åž½¶‡;aog¶´°óO…`¦ÀM¼Éu2Ç?»B)? ǽ攟Çñ˜{ æ‘ç† íqxï‘R˶éšÞ0I½ëe_}-¹ý¦F÷Í•¼ö ‡ïž™ôµZ2ÑmÏ¡ú:Œ_Ä8ƒïËâvO¬\"B¹öjÓS+ô PÈñ õða™íU˜zØâù鸱6Õ®,¸í8   .®êªGæ=ɼðš3µl K:ŽªA¸-cú- aô‚Þ %ß‘éDòàìÈ@þ» -Ÿ6 <"Ÿ¥Þ·w,Ý_LÉcïC¸kQ~Ëë÷mÓó‹lݽB,r¯5ö¾,°/¸1;éXjл‡ˆúxà y_ñ*¸¤›$½Ÿ©Ck=s±ß Â×Qf²Aî¡ý¯#üZཀtˆršó`Qn Œãî¶îâ%Ýu@>ÛBÞ ´öÈŒ{Ð2BŸn ’æ[‡‹T’uPg/f.gŸ..Šb°Œ"Fì¿pÐ8ÞoJ^ØÒWÒ;"Æ - gøê3ü̽e]•NÙÝÍ¡FÂ"í¢”¥-Bt—†×E`¤A|Eé*J{òùe‰òrhlX]m›¶ä]ú?JèÎ#IÝ‘® Ý"M Ô/VœAYÃòAQ“–Ýîë’9Ä -.(ÜçÕcªü8Ó•zÔ¢ïH/£ØÜ“Î+GJðXõËÍsø/a~œÇ/ë½’š<¶(@k@;x<ÒfƒZPZRƒ»G}øŠWU Ï­JÓZ@ÏßôÓ…{2îü -/sr€°5;§/ÉÐáÊ_¸×ì3´w‚—‰T>Ù§Ö—[±{‹8O¼Ûžìz¬}L!ê Kþ^HÍBŒ´ FÕ¼†èQÒ3 -W7´ŠF”9-e?eguJmÝóZß»Û{^Z˜ž5Ó‰éÄYŠpvp¯±wê›ã¬<¿¢a+óƆuÎÕ!g„Çè l ò¢.vìhŠ ?Ð;ÂÓD›duž¤ž:Î=³§WX-í³±=ÑyÝšívä^ѾÊ|å•s4°©™1 NÇŽ‡¬/D.tÁG làÜ~Ð9ÖÎæ¤ìñ¬žÇàJ  Hv37ìš©ž( -è F:ŸÓ×8MøLy…«›RZ#TXó(kl9¾ô7ƒva#¬r~Fö‰¯|qþÖ….dÃû†è¼UWÒ!#ˆDrg¯ÌÒ*Qœ6ÄYcÍcoˆŸöñãà ÖB¶Ñpâ|ì@Sœ†Ñ¹¼Â˜s^ŸõÉߣ_@î}G¨Çꎛ¤.b}æâœáCüÈ}d¶ |d%ò¡°P.›ƒ•(œœqºíƒç%³á„$è„žYiÚ‚á÷ÏoUW¨Zƒ@)D•«Q@!Z¦´ãhoøó0Àúë‰KYÇSÌá£wäÏa?L5ÛðG,e‚“x È<[Î/uÄäœ Æªä€_=ž A¨‹º`Ÿ‚E6WâÍì*–«ó4sÁÔÿAÖœ¾ÀëÛ˜B¶ˆ£ÏD©^ÿlš¥9¬%†¬Âi´ÁÅØ䎳)Ý$¾¸Ñ«ßx¤}ÁŸ#÷¶ÚÊfd!ˆ)«UPó2n³€«íL¡£ g¼~§ÇN»JµŸ€Ï®ûë²_¾Þu>±â-?_Ú‡ï ïWyŸÆ†O5üaÂ1¬Ä€8œæ“y°'8›ÁßèxÈð§-¿JëGàÙ…XBïÉRáBóÙæ«pµM€E¹‘eö!>¶kó¹ãe,ç´ƒÍìÏÐna÷Œïͬ -ø§æ×@„¹á†Ä0ŠÙ=JGœ ® J–#.œ¤7°·~;IþÂÙiBÂ:¨½({6¤±]`$œ3^‡²îÆ7{çôtG ä›™W%Ob”¦Aœ‚SlC]úyŽ‚ײáÅÖ$ ‹|‡t%öÐè -0ÓÊNLlüBðö¢ã‹kJqÛàâs[ ’Á¶Û3q—Uù\ú츩8FÛω3REÞlGA¬57¯$ÿ$J†;ƒežÓ±ÞªÑ«ˆâQà¥äÙ´EkÑ(g-Èì¸yŸÒ´Å8†® ¼ëÛGþŸ¹'{ÓY u¯B"5§Pjg[Ð'%œ¿ãg'•sæ´!hØ|,¾ ¤”Ó}ï‚’€–3p>‡Îª+ȇ§RÃBó‘l-) Xu¬È~A On]V€ÇêÆÜ2üÙ²Œ‰_*Zû²˜S,ZûafUìkÐOøºå4g£ƒÔϲÕiäÇZÿq¹Eû‘Nf‹-2ãr;z.·³ª Pò»f†ªQ@C»®§APê8PEOÜ•žpàÑšh5RÏ*ç!)ã«šsZ¥ŠŠ Hª…Jc?ÉÍûw“JäožX1æÓÂÁ†¢Óÿ`_¬\ÿ†?§²§2+{Ð*ž8²«l@ D—E"‚JŒ¨}ÃAPžøZ« H³„ã˜ÕJ&NvÑ­¢D¢·a˜AîôŽ÷’_ƒ%ywØ:OIÜ‹›WäM.m¤š®ã]£j…;hSòœ‹S”lŽ -›âTÓ…šsÅ4—_ÀL´¿(G£Gî€:ù°E :Jlr|”û‚Ø ® ªÒŽ¿'y¤ÂB»á¡‰+‚-ìžd»nr¶ló4×üA¡p¾¿÷“ÕÕ1{ØpµÉÓ@2Ô‰d8 +ÈÆj*¦âÆ1ã‰/8ÈbÙI´„Ki›*‡•“tSìßõÖGFP&9FlòÒ}6ðdÓ»Èù4ó®é±EÑ(í öÎÅ•e!Õ[‚*`¸H.’luÄØ#Ìý’_36@)PWÖ1Ÿ×i -Ô’%—‹$õÓ(ùÛUwÕÍ«´Dù–…Õœ»¬B?‹²±¦ž¢C@:’ESÓ Ô2Å•My‚gžøQ<µ$ßœ„ŸèxRnÜIÅŒ‡\E.JýH)ÙÂuˆÑkÎAŽñ…íÛ†ƒ6©ü&™Jê “ÜàóH±$!Ÿ(胪ÇÇ*ÒšiªKÙ”Dèbq\?ñÓb¨PõRêŸSÌ8>q¤gƒU)ü)E)¯ž”€N1ÄxQäGYüWU¸"©p}¤8½6µTº®ôÞ”‚_"kØŒ4RBÅ -´Ð “$aù÷þ`ÀÑú}!¢I†M|W†w)·ØÊCšþï5µ«‚™ûŒú¬P¶¾±xrýþ÷\&K02J¤Sß…wãÑy³íP~6åcT›·×±Q£d¶ ±óâ#VkXÓÔ.†¶Å';ò£f²ÇͪL‘·1l·m6 _ù½T³ÝWV„ÓäÄIÄuàUÌ`O5 ®áa•”»È[uÒ ͳ"‡†G9;‚û¨´> -ÇèÎý`O©UÈCmZNªrV¡ç‡*|á ÷ÐþQI«úïa‹÷ qò¡"‰«Å¿ÅÉ5Óg… Ù“ëRu=8 ƒ²”KH¬š\£™÷U»r²ŽŸ” ›ƒ 1븮vö©ë¡KÅéOD RÓN2û¡ ÿ±Én&4&éLèSðM9u|[­ìtµJ>µ LÙÛQçäB‡ÖùÝçütgɆûéÈVƨü†‚xg©Ž Øî‘xÀ^Gâ?ŽNÆy^\|^}þ -ì€Rù3?ïü?£Ï©S_M"Ùç- -Ã3·‚¿$šþÐã46w> +stream +xÚ­]sÛ6òÝ¿BÓ—P3MàWß|±º‰_¬\®Óö–h™‰TH*±ÿ}÷‹$(QNæzÓ‰.‹Åb¿QâÁþ$\O'“(ö]Ç“ÅæÄ›¬`æ͉/3A™Y8ÿšŸœ^†fâ{nâ%“ùCO'pM 'óåÎë_Ïnç¦3­µ£Œ;EQìœ_L}çî-ü™Og¾ó·ŒrûaªbçýåÕ» \ŸÝœ!è à\\㺛ùô¯ùo'óŽ»n_à$AÖ¾œüñ—7YÂ1~;ñ\Ä“o0ö\¦7'À›-ßë“»“w¤xÎLxÕ˜$ZŒ™Ÿ¸‰ +^–Vè»&Ô´”gIË÷•«}5‰Ï V@§¥ëQ +|IðùÄ?½Ô¶²¡«!z´î×·¿ïk¥Ÿ(WE M UQ`¾©@ét8§f-­™EŒôwÀ’ŸnäÅÝŽÈÙ»÷¯ÏÞí³¦šÃÿ‡µ–Öˬ)Cl²v}öú׫› –­o§ÆsaÀ¢-ÆdG ówï/çŸÎ>Œ’ ÀùÄß¡Ó^áu¾¨Êº|hF>è}ðƒ ¡‰–h(§/ûä"ºÌãëõ®ª²¢ùOVa¡yû?ÈÜ-„õ|½3R6&Ä™È5*XúÇbÙ;•™öÃÎ!i?‚}ü$ª»™ÆÆÁ ¤<ÇŠ‘S!÷…Ƽ^3àžœ‚Эw÷0õ¹ó`ϵpŠã8¡“mµ&ìK>s-³V¬œúÛ#ÆÂ0æ0Øg( \—«UÇÄ%òMðÛÈ":m^ó¹Ôr³Å}H0®EΟ^àÍ)¸0–x¾B(2·ïýâZ¤&ì1Q±\#,z xo¯ÆœkÄåÃé0AÒIľ8b&Ó5îî3 Ò¥Ýq“`/iBäg†Iüø†kRŽŒ !¹Àf›Ò–¤Êa|ŸÎNáD°…êÝÕ9ø¨{³]²È›æ”äô8‡§~“5@ÑmC‘8¡{É×’(F©­ ÷ãCýßWEÝÆ{D§R‰ŒnùŽèož6YQ³W5ƒ•š Ä~/A¤ý-G£ÀShw2MEqeŸ‘Ø×iÂ5î2;µcÁb½µcÁL6)kò-^WÚ<K÷ºÆ¼\/Z8]ºÅ íì*k !šHº×–>׶¦ 'Ús(€ƒo§š®·Õ5¼ƒú{à¹bórògáOþLº*æu¦abd •¸«Ø<x;¤2l”5SÆÚ BšÇ´iG¬Rˆ>HÉqrÉFÙ–9ºy?g䇄@›ZzO^5o«Ú­äß=ûCþ¾µƒ¼á\ÏjÎw¤×¬p3í±@oPJ¼ÿ P†Ðßš]T@yÿTñ¥Âz¯K·tìRÖÞ·™ '¥ üîUv–Yý¹3$º}vþ5¯Jħ­3.¯0*y‰sO¶?rh¬_Ao…¶8ƒ ìŠ"´Xªz'¥HfÂÑRá|xñ%¸ì|Ê°áøµ3ë²†ä› +Ü«žÏûr!¸d1ç•í ?’Ì“ÒkmÍÐëðÐ, Z+rÞ|CÊG}Z“zt0®~ñwÿ:”Uk´ð÷9§‹ßÀל|Q±±ª(!ýØ×V´ÓVÒH}ƒ‹wµàö"ÃͨXïHTånõxè!EÅÖùâ™"«kÓ@Ò_£Äqî2)ˆ·`¿¢Ê]Íp9ö–"z_øïW­Kñ`÷äGÒì ÄñDÛ#?Ç[^´È2<ìýJBxÂLÈtÐ9CHH}ßMPJè #7LÔD'8tv†7%ë +äà ‚nŒù!Òœ|™ø®g’D3Ž5&þûcàôjãOÎKàt2`–éÎ,Âì¹cÛsC)–€[×!Ôöq,I+zlîp$`ü»È«ÅnCÞ¤˜B-:ë„Ùú‘Œy½äÏ.Ë5( ègÕg<0½ìnÑP—K‚NbrGöF Ä`;¯dN‘»Ù¡n6¢öÀ1É9ˆJt¯èø!>ÈîÉdVëg†¦Óç£ø±iÝ//¤÷*Q|Çmÿ¬ˆÒn{HW¬‚Ý~9X´áöej34h ½ ºßõ3ƒeL3Ý:{ÿ}3ÿ(y‹{ŽœŸá‰æz5rÈýSk-[0îg’WïshDÜ< &ÖuX) B‚Òiµ¹†g7GnÞ)|'Á~BF›‚8•<á¯ÂV0-ÊøWò +¦œï°wàƒuÍ…ØÀ??›tLìê®É`«Lœr^`dƒêNÁá½Oë„´”å+Ú¸¾Ú¼\ŸÝŒu1t ]ˆƒËy§À›&/¹)žØPùAeæs{©½¾+Š¾¡˜ðŪÃÂ9^)ù:h‹¢¶ùýÍ“S(AÒµ%urO¼bË +£¶Y-Ž'øNífá/Žü8q£˜û®KºÈE¶"}Ïk¶>J•Šš'S N<¨¬Œo:ôÈHu"P" ZWZ5vrX˳‘Qø¶’µTIƒCEWȱ3_d »ï‹¨¢¥,v*œ£}#b +»é¢9 ÌuN©‚Öؼßñk©‰'OX”—õ€U3>»õ̃½Mq¶±«žâ¢GUöÃk^Éžýó M7]‹Þ;L°q'êG@‚K¡z¬ºÁ.“ <éaRÅ‘—2êïAê)ÄXKÖÀ] +Ø_w“˜B ’Ú@:ƒø‡D¤¯ø{/bˆÜ=sök—cíœ>¼á ou%ð ÖðbÖqdž§Š +~Sþ9ìºR²£/³´‘–Ý=ÐÆEUËÓ6Ô«ïØÕÒý~M¶Ù®Çãæ’ÙS +óçƒøj?”Ng1äc`…Ìíïƒ@¾éx?V*›œµô ¹”"‰?‘ƒ¾+úìÅn&ôÜuW›CI"0ÕÊš¹^ƒjœöBòtªzSåP؉OÀon{«ô4ûÏœ0¹‡I/jt‹,2ÙHjti4mWãÆYå|Ì¢eˆÒþSí:é´ûÖŸûae,ØÓ{¼‚B½Èž±:e[þêzMPv¤öû3€J0y¤~UÃÅ6m™$Pr}JúýìE{®}¿‡¼õ?ú¿kºÔÂh7ÖÉxf(å*¿å +yÆ>¿ŽÝÒŽ†ÿ> endobj -2889 0 obj << -/D [2887 0 R /XYZ 85.039 781.388 null] +6099 0 obj << +/D [6097 0 R /XYZ 85.039 781.388 null] >> endobj -722 0 obj << -/D [2887 0 R /XYZ 85.039 719.568 null] +2182 0 obj << +/D [6097 0 R /XYZ 85.039 761.463 null] >> endobj -2890 0 obj << -/D [2887 0 R /XYZ 85.039 698.372 null] +6100 0 obj << +/D [6097 0 R /XYZ 85.039 743.459 null] >> endobj -726 0 obj << -/D [2887 0 R /XYZ 85.039 615.564 null] +2186 0 obj << +/D [6097 0 R /XYZ 85.039 684.819 null] >> endobj -2891 0 obj << -/D [2887 0 R /XYZ 85.039 596.692 null] +6101 0 obj << +/D [6097 0 R /XYZ 85.039 666.951 null] >> endobj -730 0 obj << -/D [2887 0 R /XYZ 85.039 172.83 null] +2190 0 obj << +/D [6097 0 R /XYZ 85.039 526.448 null] >> endobj -2892 0 obj << -/D [2887 0 R /XYZ 85.039 151.634 null] +6102 0 obj << +/D [6097 0 R /XYZ 85.039 497.044 null] >> endobj -2886 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F35 1632 0 R /F56 1642 0 R >> +2194 0 obj << +/D [6097 0 R /XYZ 85.039 229.946 null] +>> endobj +6103 0 obj << +/D [6097 0 R /XYZ 85.039 199.745 null] +>> endobj +6096 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F72 3966 0 R /F18 3969 0 R /F66 3242 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2895 0 obj << -/Length 3513 +6106 0 obj << +/Length 3490 /Filter /FlateDecode >> stream -xÚ¥ZYoãF~÷¯ðÛR@D“ìæõ¶ž3ÏìŒ/Í-Ò3"©Ô8þ÷[W7I‰Ò 00ŒnöY]]ÇWÕò¯=øó¯“ÐõTz'¾«’äz]]y×èyåËøÝÈ×Ø÷juuó. -®}ÏM½ôzõDcVùÎëŸo?®Þ~Z,•RŽº‹e'Îï÷wïîÞ.|ç wüúáý‡ûÏ\õvõ€]oïùûáîþ͇E82à~Ååí½Ì†Õþ‹5íüþ&ÞÝ¿_ü¹úXúÊ uJ„À2¯`%ì¹z»bé'®çxŒ¿¯þøÓ»Îᨿ\y®J“ëg¨{®Ÿ¦×Õ•q5%ß»«ÏWÿ±ËpŸ¾æY3ÜZj8¼-•ç&ÉÀ5?œáÚCY/‚Ôy„ÂwòÅRÚ9tÅbé;~…N¿…žë‘“ Þo‹¹Ô—ð±Æ‘Y_65Ï­²:Û-À£¸=«eñ}ÖuÏ‹ vš6¿<åã"ÑÎíoÄá¥P>æs)ƒ‰:ßiŸ –=ð­<åô –Úá#ö4jÓ⨾àž>vƒ =wÜF—%µ£ÕÚn²Ž¬šñ&"Ðнt¼G²§AFVÛRff;XlÇÛkq.lŸCǸýTœxGô` R‚å®Ù@%N‘@î E©šqÁTb­÷ñR˺Aæò¡þ¸XB·é8˜Û·WÓä΋œwÍ6YYwýd¿î€ÂÑg»b|¤Nôï ¬²öØ CçMSeH:Ö_7¼OÛËøf¡æòº+ü¶$¡œ*_´¬3Y/Ûu ×øØtÔÌW¶5-›ž(Uñ„!…ÑPhÏižÐ2¥eŠe¹úµ\ÛcÀ`”õüÑ“F´Ÿ*Öؘ"ƒjt`p¿£q´yfÊo/1ìm5¦Ÿ‘Wºè8Ó\{DC÷ÂuÚ/Ûº±ßÍm£Ð0leö E0¥‡ŒŠY½”-¡í5(§å#Ùèö…Gíp2hâ¡ϲ7 ÒdëÄä œíDi˜mx9¹áËàE*r 2îÙÜ!®F'9ì,G¹Ó¬¸k2´a8ì!¥áÖ¿ëîp µ,ú8ô‹,QË>¤ìP>Ó˜ÍÝ1z[sD6§a•L}$xÊP˜±‡Ž-KgyNîcƒŸŠ´eÿ2gœåú2H̃h°¹lF‘ÁŽõÈÉQÃH×é®pIv¶Å®øºÑŸ“Às÷¬ÇŽ¬•-Åê G €¤³i — eåÈŸÈ9Æg• + ê°àŒ¾úk™qå™qí#iX.ÐGkçsaàÃVƒeÆ|0s}¨¦€m´ kTª¦•Uò¢ÏÊ]ç‹&)rƒü¡ žPs±F»AÌGLub%/€>ßMÑö’Q‰vŒÌ i‡w„äD±X3¨¼§‹h{þ¼“È ª·Ø#8z©Ð°öùŽØ’ú…8 >/RŸ@ù0iâ…£€pn¤L¨ÔrcÓr+tleH°-4ãD4ny!ìevz ?”¥|—=—hÎìm³=«ã@‰ˆC ¢¶›1•  Ƥêˆy™ùt6Ñå -½Owo ð]nabæJµ3—Un¶´Öî…G"D´Ëp½°_$ñ L–`Zž·%ù¼-n3Y>ãï–15¶4;=6¬«6²aMï8¤í·dÂ!Ð%]Ǧ!œÈ%n¸£ÌGþ ô¾|záÓÄG·£u2ÄUFËê]VIŒŠ_­ hƒšùÉU -ô´$€··—ótÆým@{ÐXu aÍ;:^ÌB„ÖéؾüK:þB™zäÁ¼Ý€ýá´#Ç++‚ÈTp‰¹<Ü0ç’f*Þ”üj+ÓþÄbx±•7j»Ì=Åq=TIħIÇ•( ÞÚ‘‚И^J¾9¾E•÷Y+cöci –°Z[I ö“ŒDb@Vì&Ïá5Üý*m¥À&sÁüE¢ ;Ý=vͽdK#PŠö0Bª…s’6JŠ@yèÆúƒ-|¤YÙw;9A6—";Ú"ÎáABÙ§–k¥ôØ»ëš_QÎØ«'Š¹„-xß-æ"ð£/«41H5]÷°¤fWMæ“M2 7‹ÔÅ?2œ™NÍ–Ä5Õ¹¨¿à3·6ÍÀP; ÀLÝÄó¬’¯=-ÉÔð1;áÜqÙP`ûp¨0B_”Ç}ÓÛœ¢UÜ‹œ;¥â“pz¶çtø'Ùjäao!sÔgØ¡tìß‚$+?–*ìaØ—°Tí‡v‚Z‰o/&›^î*ó³Ëp?J^wša³b3ƒk¤U þö·qü/Án)U¶ßÛ4|g­É—&nÌ·g÷â4T÷bÎÉ?ZI”èÝÙKz#åYŸ=Ú|Uq6Oº-vH‚æPKtŸ˜þBN=rQmö˜u’"ÿ¿Ä¿Ã˜¢î;*mâ>aQñzÄÍŠŽ&ýâ. &Ó£•§‚&½+'ŒÐŒu’K -ûܳ`ÐP«í…ƒ¾›ŒðàE0 ˜ýT š=ìzƪ¯³õVdâ*Õ?ˆJo°¬G x0d¢¹Ÿ1¢`‹¸ÏQ6€Â’]¿kz®°ÀGS%cñ̹2‚ºð…«’]ÃÅlâ9#pD9+ ZOnLJ`&Ol-ªôöaQnS!>ë†%¿{N_’»”&†K[Fn4¶O,-1<€àˆLv‘T Ñul븉/Ê‘:æ<‚/_<6໑b„÷šëä£È²z„٠Ƴ\õg»/†»áú¹‘øTŠ},n2K…0z2ÀÑ_TœžÐ¤b=æT.wH– j†Š¹;ÆþÙ;Ƴ@ig´ÅQ”oÑm¬mþë§p.8¿-êbœQ£VNÌÅŒÍ2‰ã EÁ@|Ô´•I9ıžØ„’€ºÈÑvŠd|pÜÌåc¯˜{zæˆcqxñÏžë9‚™$1ˆ9¹¤P'¦æB¤‹R(Ê¥ârîzB8HVmÅš¡µ eÅ«¥·C4ðš…²š6Ô‘ôb˼¤$j>¶É3pUsÊ¥“É.µÏûëô¢ÂþùP{0 ŽKÕèZ°RÙ¼“ó«Ü8e<Ýû Ýßk‹Ì{e®;öˆ-%;r†|KJ™T=´5Ã$~4VznG“ÌVÊî3}u±—­‚ù§½'2Ä•ÉðÞ÷ÐŒœE3ADÈäŒÝÄ÷'hF»JGGh†²rÀ建ëùµÚ¨p Ù¹×Qc8=>øyŒ§—h |7Œ‚Ëç7c`UL³Sdõ¥“φË_ší‚%>a;EQwÇú*ua_iÖv#]ŸÞ_ å¯žB5³ì¿»:ÛÈH",wÝœ¤ù}àyèGfÇ#nÀêQÞ~vku1Z<óÂ˜× JXÎÏüK–…Ïoæ†<8Å A»GqÂäÙºù,ñ!ò\¨D™½Vð3•"Ž¬ÛR ) cÕ5¿uÀi@¹`G“ñ¶Û÷#³¢Á$ž¼Ïc¥= „Ô6$³…3ÀçlД­íF’ JŒ³fÓ#ŽÒ#I*o\– ò¤·sú+'®ÿp?›K⎴:y`KF®à$V§¡VÍ3 -¡Ø¾ šÔÏ\DeÒ‘x퀛p/¶IŸo{uËUåz3V(Ñô0°ŒRW³ÿàAˆ1•/1æþëžßð÷2h?!’XÃêx-Žç†é7~%rx¹ŽÓS¹6qpâ oÙ‰šÐA÷1œñ÷<Ýð~–Úßòl -ù!Íñ=ã -³ð7¦¡¥g„Ú<Æ⼩ócM­80îC¤šÿL/ÚP]Ÿ+ò`jsø ¦¤“ß%¦ñQ$F"2o¹gð‡>ÔFá”'vJ2ØÇ)ÊQ²+ -ŒùÖO#.x» øµù²ÀÿØ/ï`?±ÊsQ†ü@ø€”EOÅóÿbú±endstream -endobj -2894 0 obj << +xÚµ]sÜ6îÝ¿b§3ÓÎdeQ%±wã&n“6v|‰s¹›¶ŠW»ÖD+¹’ܵÿ}ñAJ”VëdšÞdR$ àŠEÿÄ"U~ õ"I…/Ótq³; [˜ùñDˆ•Y90ß_ŸœþG ø:ЋëÍ€Gù‘’‹ëõ/Þó—gW×ço—+)¥Fþr•$©÷â|)¼w?Ã×Ë•ðÞ@çŠA®Þ.ÃÔ{óë×ç>Õ¾áìZ^ó´µ=âí¾O20À°ñ)×ø J>Èé¿x·—"!@"Ђ ´D 1úçN±ÑÞEÎmV­yü’¼|tÁ,>ýï°"Ø£Êxfm••ÅN +g@Tf›MÝ0’¬B¢y”¬ùP8€½É¾wð!x×à7L¬Ù °€ 1\UwÜÉÊ&ÏÖü‘?mG'Ò;C«ÛÑ9¯Í~äŸh7Ÿ* &²/óõÖlˆ–éà‚Œ¡ ‰x—5j’ +•ˆ #21. Ú²&¯uƒX³‰Cøºâ–íÀ¦§ŒclÎHʧ¶Ë:pÏŒ»#XÆð©â5´~kÞ78xË ±´-–$OØQ>ÎœÕ'\”?P¨/Ž$Iô¦ã‘ÎÈûwŠ7Ô1iLƒ‹ÃÎÖ8GüáøT¿:ž¿ëki •Ø%™ÁyƒÔñ ¢ICKa€îH¼uKœÍ µ5ï±3nÀÖÅæë–5§s´¢˜œqÌ;`[Wv±d˜+&ñœ{‹/‹Ø«ïºbW´4¶æ!2s¥ðº¶èrò`Ê»¾-Ú Ö¶ØV(¤é†-±›a,[ïH5ÀTС?–æú;#CFÿXªØr—ms£ÄÍ©@ù‰|:^u`z?íDìæ"-}-„㧅'UßC18`ýpz‘¡,¿©?〘ãîGhc¢ìz™JRœ0æÓC9fI¿`ˆ|€q”ah5Cœ%KÃŽÚ´<B0ðüªÁèq];Îrsa°<" D44ˆÇ=PEFq{°/›^È‚dÏg¼\;£&:å€âÝcÛå;Ö+Ú³,nyîÑé)Æ ¦½A7EŠ_móIXÒÇB[Ô?ƒ‡Ð49™wW’A‚ Ié쉸¤Ùc˜\q úHŽ¿îÛ>^¤9ᬘ| Îà‘`{à‡ƒŽçN¹¹èã¿ ñJÚ»22€!ºwÈ{\+†£p$‹L¯f¸„Í{)icMh˜©Òˆq°¡õê¬Q›1˜CT?äØHë!îŠ!£b°•€ôc›ùÎìVBàÆo0Ø6>.¼·¹9ôÃ}1 ¥YÖs·ìÏ—˜¼)ù*ùÄŸµ6p3< ?çkÒ0”’iyN±ÇÝ='^Í I)x¤ÐrRÜà]KG#1gJ¢ÑÙ0e QJÎû„š(¯cYdC'gO1æÞjÜ6dyÐË;¤Lд#-©>¯2ö£84‹Þs¦»\Ù̬Ù)†ãNäx£C^i¸¿/%x¡*³÷.NqŠCô>=ŠRïEÍSÇ‘TÃHø–º!Õ†T}›3CìFjnɆ(u¯¯ð3¹ë`Fi¸Ñžt.*L¬S»Ðwö‚Eë¢÷q7] ž,âÔ0p\Gb*2®pm8±Íž¯É•“_…OLýøTìÚ,¦Úž,“¯ Œ‚ˆ‡9‡ü+M¬cùŒ3QÚ>/ åFÙcp‰žŒÀö°kCÚIº;E¡/dbvzùóùÿ +Iê‘ZÈÑð ’G?’GRG‹kå £k}DdŒ~Y£"ßðæùÙë)i!¬Iƒ¿‡4‹ëiÒBH_Á F¤]œ=ùêòÜœb4q'Úz·jFøŠŠ6<™wûºùôµh^×[ëÚÆ·FêÜ +háiŠe-/$˜{¶^›6 äß`¨Î +ôöORÉâñ®/ˆD©M@øƒ8öxO›˜UËÄœüá@à}ó~¸öc NoÈ2ÚoPÿÍÎ`]ïŸ÷£•CÀ@Á°Ýtüû­YÉ‘tyo>-~²·$í¿Éµ´&~á çòf73jÙɵ®o,&>28´Ã¤¯¹Þy44v`ú ý 4–a¾ZO‚vaj,/Ùyòå†ù‰½s÷Ρ@rusTðAë²j]RjsXÙ ÅÇf“úP@í)£¸ÈÿuŒwÎO>80ÇÓÚ|óEõÁ Tª”ØÜÛüšCqLý·ÔKº5A‰9%…o³ÂògËšS€S€Ð¤!_O_'¥Ú84Œ†Ë×J%/vy¤QúAüª'œy”‚h´ìEó5ÓâZ9È=&Ð'5:‹Y_®„ò…ú{(³¸ž¦L‰ÔW©‘ö•¾ÜŠþ]½éöY“Ïáqˆä ñ\7MݲD +ÂñH}á­@yù¾ýÚËåù}ÓäU÷Ÿ¼±•ï ¶4 zï—q.fS”ùkÌæâÚÐ×z éNI\¿“¸¾0Ž–m,7q/^Ikv²›óf·T‚ìKo°4çJŠD1„´kºÛÌøltùßD¤¬6¯6æzâW’`ìVp†+@0CDÀ€ÝÓD’0S˜ºž +~˜‹ĸ<‰'Áé¦Õ ÄAž–òç…¹ƒ¡Ë1·•g70ÌK´y¢™ËtK¹!W+‰|È9²>‚ï+d0Ì'ë ðó «Óx"+€poQ¬Cz~ÈVÌlø)79·Ùðd„T¹Zaö÷ÿxóÌ•Xnë•”õ¸B‚m‘RÈOõrè×S¦‘ÖÄJ7¶êƒ|Q¹&)whL4ß#ÄÁ wIHØéåMÇMC¤RØ1ÏSöv‹D2.ŸšÒ‰9áñ‹ò4ûz5¤h D/ÍÞ8¼‚|p0x”Q¾ ®œ’ †›Jx¯¸Ú¡B3˜æ=É 6µæ“#¯ô„ =Ì‚:/¦/*º¢‘™èYɵ®¹ûã d«MÉVSW9tø«!f ª÷úç5-úYâ­Æ(ºèKs@mÆPU¾§; FœÇ+ž#–k2f˜ç‹Q‹#Žr‡-GÆؤSË”uCÔƯ>+ 8¾Û=ã~ÿB‹ë§e±‰Â9Ö,åä*•(»un6¦³o +¼¾º¾j+DŽãߌj x:½´ñq™:±ê¤§ä¥ÌWË“5u¶+ª­AzXúÆÐ¥zFD€­æ‘ãέSK“Øcëàù\,0ñxRNýF4½/¿Ê‰ …üE?™ä:0Ç_åtìÇ"å÷áçå.‘ºëÈä똤ÓtC! ?Z!ÛìöÕÈñÌ<‰ý@¤üþ€Y¶RD,¶ÐZ'éµ’‘\ìØà ûî+®Ê@ø5y¦xûL Ýúc— Ž|Í+†Gq5„6ØG_3‰·’÷˜\å[~X™ê,O¹zô¶®»og’§Q‰î “§¹(…$ɹoû¡2¯˜Š‹j,Aš†ó/Ë¥Í+h€‚=JW²ª-³Î¼S‚ÒŠØOÒ>iün†WPä—/È^ùçŒÿ/aNžöµÑ#e©Àgíþøl¿ê'•Ã‹·ôSÇèÇÏaè‡ÂÒ‚ÔJ!*)ëòà? $Rendstream +endobj +6105 0 obj << /Type /Page -/Contents 2895 0 R -/Resources 2893 0 R +/Contents 6106 0 R +/Resources 6104 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2885 0 R -/Annots [ 2900 0 R ] ->> endobj -2900 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [250.936 169.022 367.444 180.712] -/Subtype/Link/A<> +/Parent 6112 0 R >> endobj -2896 0 obj << -/D [2894 0 R /XYZ 85.039 781.388 null] +6107 0 obj << +/D [6105 0 R /XYZ 85.039 781.388 null] >> endobj -734 0 obj << -/D [2894 0 R /XYZ 85.039 572.649 null] +2198 0 obj << +/D [6105 0 R /XYZ 85.039 626.181 null] >> endobj -2897 0 obj << -/D [2894 0 R /XYZ 85.039 549.331 null] +6108 0 obj << +/D [6105 0 R /XYZ 85.039 604.419 null] >> endobj -738 0 obj << -/D [2894 0 R /XYZ 85.039 371.679 null] +2202 0 obj << +/D [6105 0 R /XYZ 85.039 505.738 null] >> endobj -2898 0 obj << -/D [2894 0 R /XYZ 85.039 350.482 null] +6109 0 obj << +/D [6105 0 R /XYZ 85.039 483.877 null] >> endobj -742 0 obj << -/D [2894 0 R /XYZ 85.039 212.304 null] +2206 0 obj << +/D [6105 0 R /XYZ 85.039 333.987 null] >> endobj -2899 0 obj << -/D [2894 0 R /XYZ 85.039 182.899 null] +6110 0 obj << +/D [6105 0 R /XYZ 85.039 312.787 null] >> endobj -746 0 obj << -/D [2894 0 R /XYZ 85.039 102.678 null] +2210 0 obj << +/D [6105 0 R /XYZ 85.039 108.439 null] >> endobj -2901 0 obj << -/D [2894 0 R /XYZ 85.039 81.685 null] +6111 0 obj << +/D [6105 0 R /XYZ 85.039 89.567 null] >> endobj -2893 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F20 1617 0 R >> +6104 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F11 2898 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2904 0 obj << -/Length 3660 +6115 0 obj << +/Length 3968 /Filter /FlateDecode >> stream -xÚÍZYoãF~÷¯ð> Œ8ìnžØ‡Å\™8Ù±½3 -fì>Ð"-¦H…¤Æñ¿ßººII´ /‹ ã>ª«»«ëøª(uÀê2üÀd—Iª|“¦—ëÝEp¹™OJ(àÿÄUˆsïVo~ˆõ¥ -ü,È.W÷D³*~õÞÿøövõñËbiŒñTä/–I’z¿\_ýpõq¡¼<ñÏ›O7×_¹ýîãêN}¼æþ·«ë7 zß„àzÅß^Ëjàöol…Þ/_aáÕõ§ÅW?Á–ÊøQ˜ÑA€Í;à„3W“[,UêJã5~»øõ¿ÁeWýé"ðM–^>B;ðU–]î.¹é×_/þåØð\xÉ«f¤µ uìë&ðÓt”šŠf¤¶n¼ñеõb‚ÀîÛŽߪ®X´8ýØÃX€•×îKåå0Kdêq¤ì(ɼaÛ!Ùa³eŠ\(Qš8ÏdÞ7 ªý3ÏÞ~xr€W]¹9Ô92{5#æ¾Ä]»ïÈeMè_óÛô‡5zËo–÷<:”uS2ÆCtA¹öÐy}¼äÙÐ6u-dx³ŽÛ_ß~~÷–›"€ïLËYð_ŸŽ-BŸž}µ­p‹ ñ~d…[Ýpw›ËøÝb‰{Óæ Åp¼/^wʆÉî;y¤t+{õ¥,~̇%Dž×Iéí‚o¶çhnÀów—Fi(íõ-³ÇÉ{^ý„4í;yWÒ=—Ó‹FtÏCOJ´=² ¡¶Ðå‡Ã±Ô+ª~èª;=Ðîmƒ»n‘ÐHµË±÷ÄmŽ»Ûc"ã¡å¿¤™-ݬ¨ð©žd~+„tz’Èa=TmÓó\ÏŠ]>nóá˜íõ0£„ö>¢- <Ök…HIÔ¥À'˜\¶Å'4š—µÝƒ=™?ã8’ÌO5gí*öM ÞÀYy¨f¬nœ²ü0’…§Lq*šðŒç<Ç·-^3J¼~Ûj4£(õ®x%‡Ýôü¸ñ™÷!_hÌÄÂ4¤®GN¼ØF‡ËG”Å®jªñ5áÍØ2q·Ç¿]Y?q …M3†9º.P ¶jó› Ùì^e»œyò|Üv‡Ç4Š¹›Éqaìzõ†=(98˜d vpH³[!î0@Ö‚Ñ…:W¼c¯ c;²¡‹§èzæ°Ç§€+ÄmòBX‰³-OÖm³);n7ÖPË‚!Â;Y 2a®èBsxŠ’)sr*ëöÀ—êy”®…üìí¡Í®ôO7<³ 0tˆtær ØAeñÿ›}ˆ}H¤‰ð½"vÐ6 äEÕlF£á_˜Zv rä¨è/Y“žÆP’il®.88¡oš²àARJZFsOýPbPAÅD¿µ³ ô`ùÐv£·Z†¡ñ®î™Í€Þy·¯ËÝ$«Í̃ƒ"ÀÔ;$C×:&uÑäXéøâºä® ¼¬ B)aÛU¿åÖÀjÎ<¢à>¯ðèp¨ÌLê'˜W¤­vŒÝÐ…¶=ûÊ;k‚± «[93œÿ,ß³ùÒj=j¿`‡œ3òÊ€"M04¯ðÚx[ëšG>¬fì¸ÙÊyÚn'þŸäwµH:SŠTrCÒšÁK¼&ªÆ`«Í$,v<½cb -­ðYœÀVÀr$½7CîíX ÁªàTÇÚÁØJæIÃÌ™‚êç,ùHc@lj¶ƒŸâá4Q7m»jCWÌkIðè\hͶ|bJ®Øôà¬ðUÃæf+cNÌ ©‚Ø$•2/K)ʈqLB®«ÊØ‚€›‘÷â:!Ü´P×BïïKÜÀÝiY&äŒéøÝŽÐÜ\åà!¥/0NYYj¦i)Œ"´´+8ã<›÷ÇkJÃÁIy‡'|æ7œ3!Í’µ£žÎ÷g­ò•¸¡bK -•0åĽãz_Ásè!sN2ÛÆçô¶vþN1ÃÆîý´¨‹©p‚9M¡ˆ6‰¦x¼ õM&`gº|ùôúà™ ÆS°Þq‡’ÐÍÙÆ -åA‘oþ_¨‚—O‹àZgÉèm@w‡²“è`O`RöA®ŽÃ)"o]·ŒÜQÑp`T$칌«ëZZ³V”„­DbûÙ²VÈé6þ-œkyu\P·-YÂÄÙ˜!geßÍ%D9ð¤¸V>_Ù\€^£SÉÔXÍáî[9^pI3S'Õ“éÑСßQ>ÑKB¦ØaeÊÖX‚²v” Rô.´°’ö²°)¸1ŸTë ƒˆ+¿™>­üâºþYó’Ð9H±CHwÇ' °‚Ž›®L¼v'JBRØŽõ½*¬%¼âÎ^=9*'&æ$SÆ‘ù@‹ !<É-¾ %`@‰^ -w­›MîB=%?,Ͼ1Ý“wŒGl‰ZiÞP E°œLÓ$ºlt Õ›Iä†kÀ4{aÙìGƒsÀ&[Ùu"5FiRí]—I½+!m»bâ«p„ -˜­Û-aUuùB©WÇ1&zfq™8Þ>ÉÆx‡+Axþ‚»'…làA•gø[KÎ:0!ׯaœ|ÛNhª»Ž´»¢œFAŒJĺȓ䎽žˆòû&såÎ 7˜s³ȼQt1æ/ÓO 8¦=þöÀí['ÅÔ»ÄÇ †0Ò}K‰õÔƒá6‰€B±Zhïʼég0‘¤¼—øk€CKÈaB&s HûY– )ÞÎx»$éHÌ’#aL)®†è1jFÛØ)r6õVô—t‡†ª¾œ±ž{.ægǹœVî—‰QÞÏÞªf -9-~ÍÈy˜4)Š§IŽ‰ý µ©K¿[Êäàß¹ XÃW0­­"ŸëáèìbÿT¹Ãpƒ™'×¹3ˆMŒ¬”!JpIx[F4ˆÐyô=¡$ -°H9Ø’Úq&ž^¥.‡V’¸šÚÂÅPÎúŸxÈcêÊ×|£ªY×íÎ —:Jý,Žæ [¸jIØ8g8Hàc¿÷‘×UC¯ñ g(¯Ýšø Ï¢™$*ÊñwSj9 l×Tfê¨UM8D®.‚›Ì ýøùßúîMÑ®gDBšX‘£>óÒÐ7BÇj—7ÄÊþ°‚Ñ—ጆa|L(2úÍRÄLû@ sÞ$›ÄxåiJ´¦æé—1˜¼—/[äßy×¥$)*öãäØò"øæ‡â—5ç×øãlÑIz$eW‹Ã ã©T/ݯÙJE0&ya`¼íQ-×^¿.M¾¸m&_¥IO5ÿõæÍc¥Þ©àÜ©.ÛZ!xµý¾v¿“±ÅÖ^¾‰Yl”˜p£oZ“Y’k¶ËtÀöë¤ý–Ši¥—îÍñ×03H,>EG V0˜Ìü f4á”ÕÀ²Ò3ˆï9ž*&˜ùËígû‰1<Ŭ.‰ù9‹ÃX* ü8ŸùÅ_ñ¯ýTÎ@²1Á‹`Méð¬b4ùé€=àÿM&Ï©endstream -endobj -2903 0 obj << +xÚÕkoÛFò»…P ˆ D,—»|¸¾Äy´¶“³•+Š¶(‰¶‰H¢KQqüïo^»\J”â^Šâ®AErwvvvvÞ»V£þ©Q¡ÎGi¦e£Ùò(Ý@Ïë#%™x0ÿœ}ÿ*1#y˜¦×ž80±Mç¿Œ_¼9y?=½<žh­Ç‘ Ž'iš_ž«ñÕð3=ž¨ñ;xyÏ ï/£lüîÕÛ³Sn8?¹8Á¦×szŽã.¦Ç¿M8::êܼ@IŽ¤ýqôËoáhËøá( tžîá= t/€¶ 6Z¾GWGÿr¨¸ÏŒxÔ'bq¦wY¡bJEVÑ(à  ñâÃjä—¸âgô¸½…†jf<¯Û=këæAê? š- ÖjCÖØÒ x]0ᕉèïñ»B úx<‰RÛKC#-¿†q¨áGñTóÊ y•aý·ãûWÚ_¾6ª †ë>™/«Uµž Üh"]…ŒÎ  m +ÀÈhz\Ô&Љ4ÏæI‚$Ií4¸®8ŠÇÖe³À+˜1~$¶—åu±Y´Æ„I¤Q"^žŠÓ ŒóÞú¦·åÀlQ’¡M|D€–¡e/f´ñ5î1I ì ˆ (K[XÁÀÆ%ítäã ¶„,1eÛÔ€µ·EËÝESZtË%‚²BǬ©×^°²B'Û›eÀDY~Ì»[Ž(Sã - @Á +˜(ÙÖÔqò'6!UœCŒÁ¹wƒ}ÆDY8¶ ‰ˆªR ™7A¼ÁšcãÔ¯^Vëâã¢)0I AÖ|)¸³êÆê¶Í.¥a^"P6.ÉRT«n&ökíÔZk3¾ÃÅÕ¿†Ê,JîÝÝT›Ãœ8¬æîÕ÷³¦,Z¢ç`©núÔþäLNž'd€òt¼*ïñ%Û"zdóƒ-j"ÀkÇÕšÁÉ„ÁóüŠA"ºç5‚ÝË ‹©a eÁ Áí]•‚€aV–Î{n¾C˜1Â-ªÖ²/» ±M+Z‹gÎì¼&<ËçÛÎÆZöì˜6C."RAFÆoÈ}(°i +¼G7|Àyè\Ll§pöÉ-°v]¶x{ß÷Ñ HÓü¿§× ?@/Ã8ÍE_ÓZ²}9Uô73±6 ‘¨ªk+÷"ôÎâæ€e8fAƒž‹©eL/QˆNŽ3ñã&Ù\”äÏX@C!zƒdÉÌÇ1‰<6k§µð…³²XljëZàeÉ4<"y“ЃøÞË kè'㊢h‹ #€˜b€ àÀR’ˆÅZâ€}s0õuêójr@èÙÔ×ÌÂ(IǼÈÙE«jqŠî ú—h9á3áÝÀöëšBÖX\ Í"lmy·æW6™8-ì¤~Î(-ê¦$ªØDƒ—ÉÃtØÜVIÜ>èäBäÃqžçä: NN€púh¯“;4urg³NΛ M” =“f^ †=`ÈÓeäéBNqŠ5ƒÜ´eäC–]°óÏ0ýŒÇ7l‚iˆ ©Ð(=<[–ŒæÔÛJ€àóº [îTÝîZÓòKµFÃźãQD‰>(ÑŠ"2Y +6’:™#ÊèæÜP –ýzžçÿƒ*~Œšhe¨ºèkÇp=â~Iâ8D¯—ZïgS”{$?ªyÅ*ßÖìÕU“¨@kuXW= ýºjpj½OWN'ºzx6ÑU6 +'¢NŒ5DŸ§¶²{†¥Ý×ï.ÆF¸…"- ÅÆשTžÓ¥³¸Êæ3ÂPpOÌ %<Õ #}©dZî'™»Á@!E2”æ0 [é$~Æ4ïóÐAèâbú¢^]W7ÁûwgûJ‰VÑ„TmlToUûÔ¦üqo}V 3_ÐzÜ-ª^qÃpªÍ!+‰G<Ê|ðòdúXô² T³JrüAr´sHAŒsûo~<ýy[Æ£4!IF9Òúë§:0:<˜X\iC¿~›æ +#7#w|¸¼<Ý= Ð +ŒIö—Ð&¨“¦# Æ#鑆Fu`÷"ˆ×Œ­·Þ-©hŽÚýê‹;ž¸©\Ù“mm¦÷$& +ƒ$ûJÖíí3r‰Ã„”š½FîÐtÖÈœÍ9o¶~a(íXtJÕ¡†ßºÊ|ÔJM2PÝëÝA[±(ôV2N‚bRs£—r}úšºXrÅCPî¤:ÐX ¢þáOjd¶÷©·~Lb$ßjù“#e“£h79²é;¼¶Ð6]ˆ|JKÊ14{‹}ÚQÊÙ¢Í~[çð¦õ’”H2›)â[SN¨h"ñ'0© BÕ7f]zEž£‹\Y£äî`ÄKÆg{;lʲ ™?`Êð`1×#øŸ$ñ›L™àšxÈLYf iÍÝŒ‡L*#$'q×aâ ¢B£{Äí7fƱÖmŽ;äiÝé“ 1«¼S ÔÕHw!J½Y sŠBW(]I0?‰°jÜÏÐ(¦0•q_¥‚€/§Ó³wxˆMÁJ·ƒ!V Ö’4HÜØW¢AUfa©2ã“°*¿HI²h¯âD” 5šLÐÌ® bf¢ÞbI«skòˆíqú3•F6ë¡£=€Ó|äR ´*_¡ÕÂùØéTrÔ;ËåzìÌ4Ì€¢©Ûv’EB‡¾"HêC~t¥hhíÖîN• ½QYïÐÓ<ŸP¸à-‡x…pâ ÏneôÆËmqçФÆð#²„V~à|<&Å[Ð +Ï×ûìt‘D»gl‰Æë€Ý0ÀváT`°B™q…R;Žï®B¥a¹ ñŒèÇŸþ‹!…Í‚0³ù£½ÐÇ©Á [‘¾t(Ñõ qÄ(°ª«_ÅÀñ^Û™ï£CëÅÕ±¬áÛ2Içè­·¢µÙcæ5Ⱥàÿ»2 $xin)Ú­=M’,G¶âò9 ¹áíÂz,üľbÁGNÂQ¯b£zmJ>erG„TToüLÁšÖ..Ðb)Q*À¥¢Á×39j_u2½îå>\'Øw”Åuƒ›Êv©ñe•.'´)Žö+2C7cT +Ú ÆœšQ¹‹~?{÷âäì÷ó“oÞ^œþ +‘êÕÏWÓÓsz«¯Û{ðø~^áÑ4à¨ó¼F=ƪÄÅ›^lš¦\µÿ.›5l¶ÜW+2÷ø>í}÷²\”myÉ»ø¢˜Ý–ßýc~_7óç!ÿ§†r¾„ÊļŠŒ ¤!d~œ-Ó½ƒ‰ sÑ8®ßQíMò}„öQð{V߉©Á/L¬«a¯¨ƒý}Uö¨—íëXW€e~t>Ñžl¼hÓœ^DîŠnõ¦Ý{«cë +Z¢Ä5¨=®AÜÂÜ?͇ï—:{g!kîºæ®¨w(Qöl—2‰fÖy—ˆË6•(Ô€%5pËšÒó÷—õl3p£Œ½ïT`¨´®U;IpÇn`ÜÃá#R{wñø”:æÄ'¡ü îâÉÖ¹ö­o‹ÆžO'€Ü¦>ògöÍ+,O>ØŽ¦¸À -ܵ‚ŒQÛ<ð3ía-¾_Ö·u÷lm/õåaw¨XÝ”tËFyÞºLz +/ø¡£Gø\üÒÍñ7¥=ð¤s=i#Åä+ ôýž¸DõWOƒf¬R ·%éÉYó)ù…÷¹½4$×äÝ’½kÓšò$®¢À:N™"¾Q‘À$aÃö2BÙ¹O‘óíE:ÄS.ùzh‚Au¹ZóY' ¢;½Æ!÷9øB¬{öÀ îþUÕ:àšŸ…» ±»°îhÓ«áu;¦cæÕªô<\Sonnwï½þð6à·>¥¸åË9ÍlµÓNd÷Áb¶„ØçG7Fóõ‰­&axиò‘ï2­:r-hOYV©¾9RÊ¿Ÿ£Ôîy ç9*¶ÕT€¹§3yŠùš³›o%G‚`‹ k ”»©zçÑ‚³ÙÈPL꘣´éˆ1ë¶V­Åes­Èjïîù¯§•‚÷z¯9Ÿ²žåãK©Ë±eÀooªÏ¡˜0t30‘@+‚ÂË÷Ö Ü»9spK[ù¹rê‘Ë©><ùVOçWÖvž"ã‘Ñù[ÓúÃ3>^SšoÝ"ó6¾v6š*ÌMé •”¾xTJé ª”nøª' ªxÒ¡»[tÑÌØxo0¼Û]ÄP‰ï‡f*åa%ßV¶¨&®ÝŠŠ!3ƒØD`ÔwT®‚P«¿„2Au˜²Ü&É|ʼâŽéß—îr䯅_6fþÖ0ÎÅÛˆz÷É¿WÚX}€ž0øê²,–~x?€,ƒÈÔ#wúånéUó­¶ö@tZ®‚Șžü_Ý–öšÆ+°ÝE Ó¿õÝѵÌ84qÛ³’S{0Q°•"·i­¶““ò:3ˆW£Ý4Tt{@%a4×ò¼SbÓÖx2•…˜Že±*n¬Má rîÝp7ÆR¨}C¶ÏÖí¢ÂyÄç{þàEƒR^½G‚ø›þÆýÑÑA¦÷Ü߈A-#ei¡óge¶éµ3³Cð^]•%endstream +endobj +6114 0 obj << /Type /Page -/Contents 2904 0 R -/Resources 2902 0 R +/Contents 6115 0 R +/Resources 6113 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2885 0 R -/Annots [ 2910 0 R ] ->> endobj -2910 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [348.805 356.06 464.335 367.749] -/Subtype/Link/A<> +/Parent 6112 0 R >> endobj -2905 0 obj << -/D [2903 0 R /XYZ 85.039 781.388 null] +6116 0 obj << +/D [6114 0 R /XYZ 85.039 781.388 null] >> endobj -750 0 obj << -/D [2903 0 R /XYZ 85.039 499.992 null] +6117 0 obj << +/D [6114 0 R /XYZ 85.039 608.251 null] >> endobj -2906 0 obj << -/D [2903 0 R /XYZ 85.039 478.795 null] +6118 0 obj << +/D [6114 0 R /XYZ 85.039 515.528 null] >> endobj -754 0 obj << -/D [2903 0 R /XYZ 85.039 235.518 null] +6119 0 obj << +/D [6114 0 R /XYZ 85.039 472.759 null] >> endobj -2911 0 obj << -/D [2903 0 R /XYZ 85.039 212.201 null] +6120 0 obj << +/D [6114 0 R /XYZ 85.039 432.111 null] >> endobj -2902 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F41 2104 0 R /F65 2099 0 R /F20 1617 0 R /F68 2909 0 R /F35 1632 0 R /F56 1642 0 R >> +6113 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2914 0 obj << -/Length 2607 +6123 0 obj << +/Length 3060 /Filter /FlateDecode >> stream -xÚÅÛnÛFöÝ_!`–"Š3ÃkÞœÆɺhví"Ú>P"%¦D/IÅu±¿ç6iQªƒjçrfæ̹Ÿ3Vþ©I¸žI&Q¬\Ç“åö›¬aæã…ø¹¡òqîÝÝÅüC¨'Ês/™Ü­æ.ûÕùî_—?Ý]ý{:3Æ8*p§³(Š_n®?\_M•óž'~øôñÓÍ-·ß]Ý}Æ©«î¾¾yÿiªcç³ÜÜñ÷òFVÃn_°å;¿ÜÂÂë›Óßï¾fʸŸ"°Í;Ø g.®îz·˜©Øõ”Æküçâ×ß½IWýþÂsMO¡í¹*I&Û ?ÀÝŒôË‹Û‹Ÿ»mxΟðªjÍ,ÄL%n¢ƒ1¹:2T ’Ž®Ú¡+ˆ©ã* )\Òù®Úýæ)½¯§3åä@0tÒv2î,«íCQNe2rn/|‡Ó—ω2³˜hWiuÕØõ£ƒ¨`Õ» ž—(g‰‡U;@À"ªœ´-`„¦SœÉ´Ú"ðŒeã9ÕŠçu˜ìi¤høûPó•Ó¶(5O<Ü´uZ¬7S8íªªq*­3€ò…*¶Xj †ë¦‘¢vƒS¹PX6ÎnnS9;x™ªåö>‘]°Ë‰yƒ¿MZ¼v²üÁB)Zœø»æEû)cÛ#%þq“2_óX%߬\±çΆÐûŠ?‚ÊV_‹ - œPBžFî¾Ø7ZV:{8ªÝmºÅ])O-ó´.òÆÅ}æÌP.€Î®ø´k]Uí?@‚uà¤û¶ZV»ÕÈÙ=¨mzŸskYæ 3g뭀¶ÅÚ]¦K`óÙîœa÷uþ+-Ù[”"ãñvTº ºÁ!w™9Ð:æËÊå¾M¤¥êÌ!@–ÎÔ•·ÖàŒ:ïZ«º}Úµ@Ñæ±h—%­‡“ñt‹ }ıaQX¼“ÁKMçàÅx˜x ß|Ï$¢‘në[ò#¨²–,×ÿçÃÌ |˜„=NX¾5<±Ësvµ2œáp@2ˆÓõž4Ú¨­,(óAØ×›JÎD±A Še#›<«±Yšo+»=ù(²çàð9à•eA»DEÙ0zÖd­¿b=U¡ë{~ßÈ-«‡"Ñd%C57É­Tì®r++ê.Y‹ÅÓ¼á9Ð¥‹$–ñÈø“Íhb$Sb çšØ Mߎö‹ˆ˜Î›ŠŽe>'j 1fD ˜ÞÌKê-v͘,i»‰JH¦¼$ùëPѸQèŠ2ÓIÛà"Þ1ç]1 '_k^#1ÓFEõ4»fƒÁ"¥áÞŠ„c'$¡`›³ëŒ‹6‡'}6“­Lï%ˆÀ5"ÍÔFwT•Àk˜†K¬…¿¸æ‰Ì9ˆ WUK^S’Y¼‡ß·ãÁ·J@‰$öYcIƼµ_òÇöBá9Jxÿ­m¤G=@ oÞï¬](S1î³³Ò<ŽzÆwµô„#P, - Ô±û£q˜³y—Ï))Ѿ}ƒ) ÉeËìYÇs;°œÅ¼3¯#’º1dõÞ+¡É–rÔ#CäÑ:¾oe$¹)…® â r;e•BAZŒ±T{¡Åq?8zÚhmN°tg¥”óJŒtG9Eá_qP¹^Øc Öš4ñôå­&ŽË3V©¢øUÈpº$º\N ü‘ ÍO«æÌx«‚W•BŠPC5_”RnvÃŽ]2Í´áÔ®æÐŽjÐ=Ô|s(0\ÄŒ#ðÛËE;üA>¬ÂȦ£y»œw醭eÒaŽë4rLjƒîî›®\‚“’aa{ÍóC;N%)3á@"îxH -˜=E1 D¾§¯Ë*l>‡Ã+ŠŠ·ÜiÇãh*’ç—Äÿ>Ĥjÿc) ÒµŸÆô3rM"½¢$FöL¥vˆx¾ºg”…„„¬À¾Ä˜¾s&ÏO5:LmWm¯rE©pV´”ð­ÇܼŠ\…”ïUIRÀ>{K’8«¢Äük-@5Ê1Óðf“fÕãpÉQýåà` öNlû<ú 9”p°þF;Èñò6[ĉž^f„᡾Ó6¦Æö3E%X›îñ‹´' OHél$5+³¥ÔF(Ña¬´ÍÏRÎ?©Ú*¥"lìò?Z›nm¥Ä¢ ¨$½l‚m¾e .ÊJr!©yƒÒ™p‘Fv/ì—w0IÀE4Ù­æÙß¼À;Ô£ý^¥ 0È(ƒý'ׇgr»>5 «dÇþÎCá%²Ä¿½’–!û(yWÑöó/â^Š8;÷¹¼<{š7 ›ïæ=¶R‚2£Z1·ÿËŸuKÆݳWcj"§ôé$¥Î$ÄZ©¤”âŸ]&"w†cÜã˜òHcŽîy ˆ/ñŸ¾ OøOšéü§9á?OÜÔ7®QW©¹¡“eº ªÖñŠo(‘¦S+CL‚ƒ“¸œU§¢!£X›îy å%¢`‡®ì „ˆ×q Qd VcÁOÄáÙz™r}¿´†h¤†xƒw¼½å—§ÏƒZ`$E¿È¹¼†ñ/§JyÞ9¬ )’à|̃Z 2'šjIJÏï1du*É<­£"E/ŸlÕ¤îe±Uc-ŒÔ{ÜÙz¼Æù/¤áh'FŒ&?9écotë¿p£È¤^ÈË'Îä. _Ø`Ëíž”M×yÛp«÷pû¥2z2ÇÕ‰‚8Çå|Q¤²e;„Ð3 ËH’èYŽ«rê(ä8³>ð¹¢G7˜ÀªƒŽzþÚX1D¢¥ ÂQ1R°æ¢> -@@ ¶ [JY¿Ä7W\Ù…4*%Sœ e„±ñŒ§'“tj!Ϙ±OOŽ+ ù,ß#†:¤±éDÓ’xÀËWDL†q?š ÒUªÛÐ$)_å“)ŠÎþ¿è„PCxõ±YCÈãó!t«jì !‚¼vÍ”ýÐ1ЬÜά­­Q¾Ã 5# ¡>~k y ß#†dÞ +¦!dñ—5 ßEý‘P 5Ó:n$˜/‹ùª{kHŸ>køxÞ#|ÎmÌ\¸]ØÛÄiÛB@cÂàªÚe»Hk!Ò‡¼Ê€iô£Pqf¸°"{o㨅ýJˆÇe'ÊC€±ÏŒ£÷ÆJäÍ:‘3Äüðb($ÓQÔÀx”Ð=OÖ6o‹©·NÌ4D‡ÀL‹5f<ïÓõM¿†ÌÓÀKž‰#x}KÅ% ¸iõúµÓÙvÈaõò[Ècø²¶!i9 ¼lÉ°J}ß…%×» I¡`\÷O&ŠD·;ÒÛvf‘<ŠßÎ^ƒœ>þ*äø þ7ÝÀž®« NçØ£'ž‚E,Âo‹§öHiÃB~%ÓÛÎ´× +â +ôjÚ +X &¾o„þf2èÈ©˜”((¡+9¦ÙUB,¯Æ5Á|´öK]tS^ͯYäèÌaûf?A:%T㌶q~†;¿¬HÐ`¶p¶WH¹¶Pù ¹T¯Cµ—éz¹¡n©åð)Eù³ä;~õóÉ¿ö"4ZI82"fQO V‹^Ùx­Uð­©GÌJ~‡'a8“` U'äìÍ»gÇoX cئ Äš£u k‘b\¨ÖÞ?{õúô¤ÍT9‹Ø5UÕeõçï^Ì>¿?i7ù?¥ºLþmº(òM~Y¶më¨ÚÜ‘¡éú"ÿ²ùÞy=ÛE².IŠ BûZúˆÄgwò÷u–IÑ%¥ðŽt>lˆø.°8;vpNEn#ÍøEž]ë-~ÖµÜn`Ç=tÔ·ÝV§H›·í>¯ÝÉÓŽ³Ðé|âwŸvmžUpØó©Ž;w;î¼aß©9D +aÇq׫êÔ}ÜAvw;O;舅&xãžxp}˜Ü=õ°Gi·fí´Tùc¬EäsÇllR–Ö¹/ÝEÒzbÿP¬Ä\mÓ8<Ô`"¦Y%Xœ‚Û5à >¨í‹Ö¸ ö—´-ûÖä+üºr.qÝåLo”¶0½MîÓ*Ä·"m}E5¦?ñ=ˆ¢0ÖU„u/Óuˆ°8[±Ž' +Ë[ó1R½Ñ€}/ï5ì=æ §.¹”€q´b<“øÖ´Gq(Ä*]i6Di÷a%ÑTÀÁÄûãFÌÕklv†3Þ C ¿å +ù>ÏÿGþòÍ›ïH?V¾ì]ÊÞ_V(PYÌ›T³„·°[FUÃ&Vh…p Å@°c5 ¤­Ødj ¿=sJ›LÙÐÉùßO~¥Œtûî^qÀVкEÆ1|Q²¯äØ$¸LÌLtnã´`2RwŽ¼]÷ýT™“˜BÀ„jdÊ™…,€ÈGÚ$+í©Osôu´íßÏå¹î<¦¤c˜£?G˜›ÆßgØ>^ÛN ™˜}ðäõJŒžçÀéh‡Y¢;õ“Ï‹vRŽ }Ø'KÃÔ¨ômʹU((þ³:åbü«ûÉ ¼~…ÓÉW ½8¹H«)bÃúxètAN3qŸo«¤qâ^ûi]¸¿¦ÞÝmëß`È8†wðª¨s¾@è±õP»™ÜO[bCóx¼˜¯±×¹{rmN#2]¤×sì›Ð«tMW;eëðçtäÈR ¦ø(Ò©Ü`9ö1ô –åKz’¯ËœZóu ˧³'ÇÏQæJŽ7D7sÙñ}fS¯9&[.¨]^m7Ô²`#ÿT©¢šuL¨±'HûÅ:»¡ÖeACzl’ÓOKÒF†©=0}-!W)R`ô@½pM0¥ˆðþ)uàˆ˜T‡ȕ” î<]/©Y^¥›šXóiHBœÊÖIݾô}–o\w@î¡xÉ/ÁwÃFŒ­³:¹.Ýs[o°U ¸yíãSjN`„Œ…·ÂßYéúj^µAñ¹k:YÛiد)Q°¡…Ó9æÕ²ÆÞBã”ùÅ*]{5 Ýœ$M=sº.ŠZ\–Ç0€6\ôx™åŸðqFÑöP¦ÖöàþºR[ƒ û-Hè¢âéd}Il,\F0-«òM‘£­,¯ª{×ÁšµŸX|i÷ý°t»,FYYºpéÃw8Dô¿Éþª´äïÜpxúòìÝš‚¤CûvL£ÔÎú;|?.0B¼»®ü} ’¿@£L!NHÁ§xôãU [ÀT£nñ²N¾ Ƹça zƒÊ,À­Ø·™ ¸6tãêr9õC¯×©Õxm1Ø“Vò3ê°š/¡WÖµ$ôŒ z¶ðýN¹ÎÕ‘›"‚CZ?ÈÜ—«ZBˆ½8¿DNi¯´)²ª¸> endobj -2915 0 obj << -/D [2913 0 R /XYZ 85.039 781.388 null] +6124 0 obj << +/D [6122 0 R /XYZ 85.039 781.388 null] >> endobj -758 0 obj << -/D [2913 0 R /XYZ 85.039 761.463 null] +6125 0 obj << +/D [6122 0 R /XYZ 85.039 758.673 null] >> endobj -2916 0 obj << -/D [2913 0 R /XYZ 85.039 741.337 null] +6126 0 obj << +/D [6122 0 R /XYZ 236 764.647 null] >> endobj -762 0 obj << -/D [2913 0 R /XYZ 85.039 514.594 null] +6127 0 obj << +/D [6122 0 R /XYZ 85.039 477.993 null] >> endobj -2917 0 obj << -/D [2913 0 R /XYZ 85.039 491.879 null] +6128 0 obj << +/D [6122 0 R /XYZ 248.712 483.966 null] >> endobj -766 0 obj << -/D [2913 0 R /XYZ 85.039 154.621 null] +2214 0 obj << +/D [6122 0 R /XYZ 85.039 326.904 null] >> endobj -2918 0 obj << -/D [2913 0 R /XYZ 85.039 136.147 null] +6129 0 obj << +/D [6122 0 R /XYZ 85.039 302.922 null] >> endobj -2912 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R >> +6121 0 obj << +/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F14 2895 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2921 0 obj << -/Length 2442 +6132 0 obj << +/Length 3695 /Filter /FlateDecode >> stream -xÚ­YësÛ¸ÿî¿Buææ¨ID|‰Ì´ÍȤN/¶[ɓ̤þ@‰”Ä;>T’²Nÿýí‹”hQv¦×d.€Åbw±øíR=þªžçè†å÷FžÒ-ÏëÍÓ3£·„‘OgJ8àßHw•cÓ³áG×ì)C÷ ¿7]Ï4ü®]þc|?½þw`Y–¦½?<íáöæãÍu_iW<ðËݧ»Û Ó×Ó¯8t}Ëí¯7·Ww}ÓÓ¾ -Ã픿ã[™ Ò¾!ek˜xsû©ÿ8ý - ”¥;¶OŠ€˜ „#g×Ó+ÊÓ e¢ÿ=ûþhôB0õó™¡[¾×ÛmèÊ÷{é™í 4KÚÉÙäì_³{<«Ã[Ûtus„„­Û–ÕxÍr:¼&ʾ';lG÷”×2f]äË"HûÇt´¿ñg¸)‹aφe4ßqµ˜\;áéùºŠó¬lM6Õ*Ï’r?ªC­–MäÀòuñHÄ<ÈÀ嶫U«H¨Y»ac¤!ìD…”³Ø–±ÊÃ\OL>V?@£°Ôç‹e‡RÊuuÃóe6Ä•íÙÚt«Æ%«æ¤P¸¾DÔ ¡µãF¹YCc@þN´qÛn0§¨P¢r´8[AdüÿÊžèÈw8êi3\¨bÎ -5•V0a)Wþç?õÅQŠ½6Ò"âEG*[+‘Fas$æ4TŠ -E´&«r”Ëz¹ÄK“P¯lÙVi¬`Ë`Oœrÿ6&{fèµ,<”5Ƙ=2´ä¤jãO{¤´Р -ñ`ÕVïÝD6Dæl“ç8ÚC)Óyü~d1ó¾ÁoçïÁû é[Q+Œgá&üþár ®TbM‚Ó¡ÿ/ÑÁ>2|mÜv;lNüÌçÈE»ßÆ6ì¾G;ð€Ðž€9x„xè†÷0*ÃɇG$x3dJ%¢|¦‚Áé©cDš˜0=äeâ²jöŒÏ«‰ŒâL³9t0¸áC¸áÈõ­ˆà5û€Î1ƒïD\ʬhoˈ æÙŸÐË°.4ïúõ© -Ð=p„j“]—ŠÄ¡ö–GáC¬çõçÅDät dû¦îX‰¿a1tÏ4›´oiê#¨”fé6tp6†"‚!"!²åºZ™Î €rqR#SW¦zQO·GûâMu•!“ˆ3Uà1 ì,‚pÂüå\P'9 ³:~#Îþ0+Îø‹0´¶2íÃáÁØ×ÉbÜg ""/0Жã*¹hR­„IªŽ'ÖXòŽä .÷À4käè–¡ÄÀmƒºÿ0ÊgÃŽÒšص÷•‡cXõFqÖŠ:ªüíZ2 w°Þ¾gÂm_w›¢hºâàC[ ü,DÈÝó"H ¹Ÿ<혂Êõ®86½ˆ‹tQÒfggBǶ)"¨, * ©Øq þSì-• í;íÔ(¬á¤bž2 Oí:<1òt(¶^÷„c趪݌ÎM$1$l1z(o›ª•ƒbÙ26 b¼Äyqƒì(lî% -Z!î%”˜q…m¢Àí£0暌'ÄYw$dzºë·«ÉïË$Ç€’Gš’¤ÌcßwøÉ‚ÛÞÏÆ©(¥[méÕuýïPý†Ëû2‚³ ¬b+ÌÓÕ¦ÂÓ&›2*² –m öõóÛŸß1•Ä¿ÉèÕÝ—ñÍíÛfÊñºà:!­‘"ŒÆÙ)—l3 Ýñ_)|®¹ø®+xqŸóƒÏW^8J˜ ¶RìzœSò4¥ƒBü9³§ûë!Š¬¥LƇÞÀ œè ©¸˜ëW\‹óËä“K¦;”ö®ãP­",LÛ¼„lhb_rw}Û@š¡)äÚ¡*tK+¸ã+­²é"¢/¯«h¤ÇÍÕ ¾ÁJ8\?à&¦áœ¯ªq×uÏ/§L*PVœÏ±n§'•Rjøýe¡­ydië£ò)N¢e¹±›êør´ÁÆèUüv U‘çÕ›®Ó” ”g-4}˜HbÕ·èdXB wüY@G–0ÄòlíW8AòäYÚ`Âß{ÜpêÀÁ¦ÑÇÄË&ƒw»ïÌÖ™–²_À 𠺲¾1q_sŸ-媜•ÄÍ/–%AŒ¬­ Ç‘²ÙžM"]Í_ixcvFÚùgÆ~Ü!.Á‘@…CWФJã\ʪã] Ç8rlÆ}Ùh»Žd ¢Ÿ%‘“ˆé9ºâ'Û“€©t8¢? -˜®æ¤¢PèCPãÝfý ÷%9_G¨3 ¢4eç㔨”HhÄÕ_þäÝÐz"ù|qM¼¡²2'Ä/¾†Bé_ƒ4 ÀIÌRp¿ÂÂÝCœà+<öPTÁ·~%@[;îk!v”ü,@o–ÜQ-¿–ö¼y‡X?[€ßóƒ'19‰x!’ù=”LË·`µMHGÏPý\§Ù ¤·ôBŽm*9P“|¥¦W&GÐ ½ø -2þr1æ–<ßã;­ˆ/x8×ßRDv¾[’¹|ù€W'CÄvõ‘3:ñ³OSü‰ßK¬‘~ð›Æ‹‘¦L÷¹žÊ•ø‚RM‘Õendstream -endobj -2920 0 obj << +xÚ­Z[sÛ¶~÷¯Ðt&Si&b¼å-'QÒ´ñåØJÓž¶ŒD[œP¤KRuüïÏ^”(Û“f2±p],€½|» ˜øðOL’Ðóe:‰áÉ$™¬¶'þäzÞ=b®‡Ì1ÿYž¼x©‰ð½ÔO'ËëžNè©PN–ë?¦¯zu±\\ÎæRÊi ¼Ù<Ž“é›ÅLL¯~?ËÙ\LÏ¡pÁC..gA2=ûþÂN_½Â¦w0fqŠóΖ³¿–?Ÿ,––;».p’"kŸüñ—?YÃ6~>ñ=™&“;(ûž€îí ðæ…Jêzyruò_KŠûÔ„gD(/LäáQˆÐ9 +H/Ä$}/ôŧ pŸã†+Ø›§§Wüû©¨ÖÐUã>ï°¿Åöhøþ׿]ð Û¬1]±*n³.ç…&”qu]o3ÓÔ"|…w0¯):¤~ÏWu…µ.ÿÚ=Ç–tšU0h­©^3‰n“ãIOæz[sg“Ò^Öùu†tËƦjºkic ×n‘ÕúO_¨9MÃi1ã]A±ªõœë)Tk`Aù).Wq.LCWe‘3§ÜqW”%—x{Y³šñt£éᢚƒŒ ¬Í‰c_¶3ÜŽðWÑVýÁ&;}a2Š§g #­P\ߟa{4m7Y“s±¾æßú7º-ÛuέãNð$èZ2*V7šŸß?8&o@OBL‹ü%àlÞ©‰´ÔD$5xg,5-sy‹ÛlJºMZÀ¾^¼•®pê]†´ÉgÎa3W‹Ë_—Ïx°p•:V Ì 4¸¡:ýg‹%‘¡£B/É#tBÝÿÅ o+ ÂéÇ6o4ÁpȘz| +4WZή¹XW9¢iþµèZnÉjt+(5±LaiUßjá¡,³¤zRˆ¡tÔúº­”D ½ Ž5J×’Ð.Ca(ꪗ ;+9À)¤æ^¿9G!žpöëÕn›W¸}Ïæhæ¹BSšNH÷fÿvf¢^¢©iZ­»ëëQ—Å×!xf=¢£]óˆí®í¸ù‰§zÈ*+K`eÄ8Ép–3ÑM}]”ùÈ‘ƒ~¤¾±&ª«bð(8jòíJ‡j-R°*¼}»j°ïÇü`£ŒYƒß|b?cšÑS7 A´û Wj#* ˜ Ž¬ÕE†yŠmd¡–”ë¥ÃEÉb6€ŠP¿åmcKN1¡|^¡H¦è4nÈ—Ü QtkúvIl5è³ý‘ëöÌÛ/8u¢4Ä|8Š=?öY}Ä涫TE,wæB|ömX ýÅÃÕšÓö–‰P;B\ÊÐ1Žod§v¡-½FĆ„!ôÕÔØmÐ<`é–•¶éó!Ù=&ç‚9-FL’‰ã*=n”å³ÂÔëÒÂÕ"o¹ÇÚƪÜh-ì¥bê+²iØ‚×ñÜ5VŒ<«##ÐJæª%M¸ú5Ê+ãK +ƒ¦ÓiÇ]kq´œÐD3 QÇŒ¤ß,¥Í芤åŽ?ýÐϨk§„Hî3m•—¨ûê9€í!à‚ˆ æ=^(ž?F0±†I*Žú¨ILD¢qìØRn4zH“zç•;ìº}ò5÷Ùe\Äú6ã°‰F©«òž§ï*«>Í¿ynŽÇz»ÇQkøÄ(â›QkúÄž}„xçìÕéâÙ¼ c/˜æx,Ø^ª¼8û\nj2Æ€ïlXa¹Ë@~(n±“Åh] 7¸×CŒñ„2Ë’! Ö½ÒzƒÞaH±CÌmíPÅ•u¿Z«WÃænÓP¬}³±õ¸ –ÃõÆäÐ]ÏÈ!âxŒoà>ß‘d9›¬ã«®×”cÖÁi×'ty'˜WDF»‘Ø’÷~–Èésk(ß–Ù*w¨êò“-'Ç'ƒä°dËÉ$uC/Ni£8 y2RôJ“$¡s:½øˆF§?Ù=*ß7ž†[¥ÄJÜHNèS&Ów”µn•äêžI¹4ø¥ÜxÙ»Ö¬ÂK$S¶÷@ŒSÈ;=yúS‡ó€§¹g) ÑèƒdßÁæŽRÔõÙ¼W@Y?4Ë"7ŒŸ +ÎgP sªQr mÇJr:°ÎX*ÜÝG%?ý²øý@¥Tä%"žH{~ô„Ì‚§ä±¼‚&5ïi‘ê ¹ +}/´ªÇæ}¼¼\>}‰TPNæ{p¦I=Ìa%.gˆ¥GyPéi€üª¾îîP*¾ñÝÀÐ9-VMݱB¡‘ Ÿ˜8ÇôH}7i(ß{t[6¿kˆc~Í›ó‡Ä¸‰D"|`dÄï^(âïrH†ÖÇðÌKC98¤Åo¯ÎÞð‡îûòûð¦i=Â\ ز§ÝŸæw‚±µ(ë{jßf_f{yÚß`;åUœü=ÆKÒ¦õ,¶!-&åëarž¾×¸u2¨kî'A”š niœØ×ÔÙÖ­;¨K 1lË è—qbŸ¤UÈak eõ e“"—qÈP,æoPàg¯/Ì ‘œ9„ûs«¼ãçûˆÎíúá×ù6"öÁp™oJ0£™ëÜŠmé­"(ºÜoÒÿ>'3‚XôÑl}аÊ99Qb>öUŠ˜Íu« a.&SvÞuý…` t¥Wr1VkŽ›iýÝ;v.Øn>xÁrÞçB´ÆÖþÍ}¸÷¬Ò ¨wÝá3 ó%†Yµóž˜wÆÌÙà­8âÑ+D½÷4M÷8bøq”âûÔ?ˆºô÷=eÉOVVö%¾‹eÛÛ2? +ò‡{ÿ.¼„Ç2ÉêX&ùѤ·ûž:D^`%TàErYñu`€K‡Êgéó9vµu>ã j'%tœë›ûï8‡²·šÀðÑÛàœØÂ) ü9:ÚdNYpàáQ™¨'Y’:ÀÿwiGêLò@(6øÚdì-cƒ³_5øz¥:\ê¿s¸+6 +àí× ‰ oój3,=™Ìƒ/ c1©½) 7FüÂiÃæ?»Ã¾=”” Š{+e73€#¯÷2DÏärÉGÎóR°o±Qd9pWzîç‰8ßÕ½×¼++Ñ®Á4 <þH›Úìa˜X`Žå·³D±6]QÌŒáo‰9¨eücT¡«ù±7q’°P!o[õºod®Nt†Iï* ŒÏûA=ïz]›ë,M¦a*Ÿ§ý^€¼}ÆZâ6)¿ûúâ#2V|å!î †Þ½Ñ¦.ßÚ\ýXxtQé`qJ‡1®ØôbÊií¢*l°þ+N2ZK4®&Þ¹éì4 KI‡*`}ï‹Ôý¦¦¡/“|1\õº>’‹‡Ê¶¸iLv{L¦²½t™±±j$‰ÏÓûy¶ºqrhÖbAÔ‹ïÐCçŒ×ÕyG>›–¾¤cibøÏÜþ«/ªí§ãJz‰LÇsÍax0¼àéHíók¾¼>`øÿÌ•&Öendstream +endobj +6131 0 obj << /Type /Page -/Contents 2921 0 R -/Resources 2919 0 R +/Contents 6132 0 R +/Resources 6130 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2885 0 R +/Parent 6112 0 R >> endobj -2922 0 obj << -/D [2920 0 R /XYZ 85.039 781.388 null] +6133 0 obj << +/D [6131 0 R /XYZ 85.039 781.388 null] >> endobj -770 0 obj << -/D [2920 0 R /XYZ 85.039 544.417 null] +6130 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2923 0 obj << -/D [2920 0 R /XYZ 85.039 524.428 null] +6136 0 obj << +/Length 3472 +/Filter /FlateDecode +>> +stream +xÚÍ\YoãF~÷¯+Q›}ñ°XxÇžÌ$cw¬$$y -ZÖFŠŠ3ÿ~«ºšÍ–xؙЉÀ"û¨®®úêèƒÃGüÏG±fLFQÌ™ŒãÑÍýQ0Z@ÍWGܶ˜Ú&S¯Í¿gGǯC5âK‚d4»­éh¦´Íæ?Ž_½9¹œ}˜L¥”c¡ØdEñøôlÂÇWßÀŸÙdÊÇïáá’š\~˜ˆxüþõÛwgTp~rq‚E_A›³sìw1›ü<ûúèlæ¸sã' ²öëÑ?£9Lã룀É$=ÂsÀ8TßoL+ißWGWGÿq¤¨N¨W›$ªS°HˆæpQÙáäÞp²1\0šràY¶i "g:Ò~ƒý_ǃF¦‘æ,Hj-éÐÓRÕªj„jšM’pœ^¯P>6Ê’(èã×\{½uÈT˜ÀxØíË}MQÓmÖ7¸Û¡ïSÀ!N³Ût Z_•„ç·ŒùÄ°ÊÇ·ðnW%o7YAOEþSÀöͨë¶,ï,¡¢"°XnÊâ#uú±–}ÜìOL…‚E:n›\c’ =Æ# ú†Aoc´0! ÎÅŸ„.b k»É˜N¡'Ûz—Jmé€ jWR™‚‚HÄŒKmôt‘ÞgûB“œ³‹QMêÓÙªhõò%yÄðN>c5€HÃßMÜéjk´¿Ç°–Ð/Vƒ0Œªâ +ì—ìþ T ã人uˈ"2"çÚŠ¤DqÀ[%ZGÕúW:ÒL”2ÛmhTÌòÆ8ܨ,º•ÞC8Å>~š<†_M( `YŒOs³saÄÒ0»ÙG*Û\_¹ž”Ï…¼k3òM˜Ë%ŒÖ«ã!´ðù¥È*ÉÕŸ^j³€ÓY@V¾±;æï¼¼5Ý!x<_)ŸÚ#¥4‹Dô™ÞvžÌ¢°CÎÌx J~"3‚ÅqóŠ¯Ò²{·Ö#=„—ìcÔa½æô¡þ!8ü !„ó3 ²ÒmWÖÑ}1þçFð°%X Ú5Æ…dBXbù+y§ó+;ZŽ¿7KxÌcr¼õðˆwص‹ øÊŽÿ{IÍü;ﶉÑIŠšþHm®Í@F + w¾ pK^ù”w£i܇?´·[1&l‡¼h£ B‰«ÍøŽdz¿\/Z*4¯êØ’M`)¬Æ'4‘"ÇNxšDÝ+þPø¸\­ÈÝ +9*Âw·ÕÔÍG³»†WSãñ]6§è¾r'X+»‡ÛoëÝXÚPQyg)à—ù +ú@—Gœ©.²– +¨ž'l¼ÑÝ'`.ó/IrôäÏáÍ7g?ì[Wh«Ñ$Àý o*™’a;R+ZS˜Áê.cÓåF4€yÿêä]ƒµ(a:ˆ5Kë ÖbÉ.wX;?yõæíÅY[l šçä²+Ì^ýp5;;o¡"! Õs©ä·åcZd푺ás;éœ/oŠ|ÄÚvc8F?A¨ªÿ;ÍVY™}0^dñ*½¹Ë>ûçü1/æ_ôoñG&ÎÕ¹ mÕ¾µ7$ï–ä=è•üÉÆØó•§ Gƒ_y{úÕù»_SÈ*_C ;3O;®Ë}û„3²®«º·ÂÚbÇ:>““‚³Dõæçµ1&  ®Bc`Ã$äw %Å)¡XˆîZ%ãWùý=:Fä'ŒÆgE‘Od0.6]üX2½üÔmZâ¦åG@ÜŒbZÎú}4ZŸy0~=¿·K#úwø^é)+L~]˜ÖÇx®mÔáãûÍñ¯[ŠåÒÌÜúx£þÔ.ïL 6×íhN¥æl‡ø¢›±¦Ñ¼K"”,JD¯À¼6N RD°'0-ÀŸrO|ÌQ‹:¿1J{$λð–UA0 a’ÕmÌ'ð SS‘¦÷&cYPÝÃDr[{…øÝPÕmnëðåÛ¥æèÿèÀo’ÚnÙ#Ô“µùb¯â€Ç–¸ßqQäÛ‡ãÍ¿º¤*5 ¥î—jݦ†Þ"±ž-„}o@& pN +I¥`¿c¹Í'„É Ð›äËûþÑÜmÝR«]ü`õrC¿eN-ì. Ç9mHÉL:Œ¥ÁVZá«ý”JH?¥ZUÆŽ±ÙbÝ£¡1”Ì}•›¼EåÅužc.隟̯Aá>ÜÚäWðDþ²4†³^ ø Öký&ôœûßïíÒƉã¯13wØ~¿Js[ÐË~^ŒŒ­çTW¶ÖœÝCj•i<3²¼TÚ¥ŽeæY?9ˆ:û[ï¤æsU“þ£Î ïœ;2Z+2º’Óg;À0IÞO m\Â/c#=ž/7ø)¯|N…‹•ñX6±…`aMOë|JÖ…UÀÒ=…&[E»žšÓDÊá¸,L¯—+s'›‚™áz +¾Æ1™­›<¢JìVI#íu¶ ¤áƒ²S{ +`J–æWšû’9=¦t©ñ#½åkïÅke„›ejµƒe÷6,–m ˜+{ú\Ó˜¹ý-ïrÔ¢éé­)ŒŒ*²,XˆÛašPÛ1L5×:XØ´I,É/@ýÅû<"?V\•¼…ÖFh~oD® wvå“âz‹³ß6$|Œ‹¦Ö¦Ü`$k™î]Šs¯\Èi-×ÍjwiU} žUꢈ¾õßvUÙ´µç§a²d´ ®ët +é ¨CÙ)·'èF¥\©` ÒY@ÂI=››XešÔ@†~”eX"»‡Rêâ9O|m€›nÜuáÒˆ.×Ms"W±¡HĪûmÆ:nk7ü(ÀÕ|R…½§Ön¸ÁÙ¾v³´¦±–B’%nDs9ùâ´ÁX1)‡á‹H=ÁV¢˜ +å[N¸§âôˆ/yŠŠif0·»åÝÒîÊ\{2dÁж +TLÈ©oК~ÛoZDÓÚ<Ÿæ䀖–“o+‚±`\ïÞp<7†—.ܸ`2ˆòt³åJkOf? +~¿7,ìîG^ÌÔqÕÀÚ¯øw¨ÿÖ‡ *PuQèh"H†¬é|ÒñÌÞ¤kÛ(_[;Xl1¥Ç2çéÝ‹­Øý!L‰•> endobj -774 0 obj << -/D [2920 0 R /XYZ 85.039 228.345 null] +6137 0 obj << +/D [6135 0 R /XYZ 85.039 781.388 null] >> endobj -2924 0 obj << -/D [2920 0 R /XYZ 85.039 207.751 null] +6138 0 obj << +/D [6135 0 R /XYZ 85.039 758.673 null] >> endobj -778 0 obj << -/D [2920 0 R /XYZ 85.039 109.069 null] +6139 0 obj << +/D [6135 0 R /XYZ 224 764.647 null] >> endobj -2925 0 obj << -/D [2920 0 R /XYZ 85.039 88.475 null] +2218 0 obj << +/D [6135 0 R /XYZ 85.039 321.948 null] >> endobj -2919 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F20 1617 0 R /F56 1642 0 R >> +6140 0 obj << +/D [6135 0 R /XYZ 85.039 295.333 null] +>> endobj +2222 0 obj << +/D [6135 0 R /XYZ 85.039 263.792 null] +>> endobj +6141 0 obj << +/D [6135 0 R /XYZ 85.039 228.589 null] +>> endobj +6134 0 obj << +/Font << /F64 3112 0 R /F56 2890 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F35 2880 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2928 0 obj << -/Length 2044 +6144 0 obj << +/Length 3332 /Filter /FlateDecode >> stream -xÚ½XYoÛF~ׯГhDó–˜—"±×Aa»‚´Hó°)‰ …GTýñk)J¦ Š¦Ö³»3³ß|3KglÃÎxX¶§3Çòf³ñ2Ùã5Ì\‘€ÿ§Vèø8÷r>:ºcǶ";ÏW$3ß?¿¸Ÿ_ýfN<Ï3œÀ2'ÓéÌx{{óêæÊtŒKžøåîúîö ·_^ÍßáÔÕ-÷ßÝÜ^Þ™îÌx'·sþ}q+«a·ß±åoßÀ›ÛkóÃü5(0q<+ð#R¶y ;áÌèjÞ³bâÌ,Ûqьϣ÷ìq ¦¾Ù–ÍÆ;hÛ–Eã|丛'ýlôfôk· Ïùc^5୉;…†g[³ÙÞkN0൲mÀ ß6>¶5µ£Ù€i ¶]c—èŒ@Ë1bÙšwj”U“–/ÿÓvü -js;€óýpjÌÍ™g”¼¤nT%´&í€Íû× nS}Áá%6“úÎxMÀšÈhX†o6 ¯\•Y«JôÛÑ–ë+Z–9.ÎUóŪš+Ðô)›ç¸êü•×÷™´úUeÙüÀ¢AØõ\¸O||ÞÖ Gužá™èÇ £Tv^«Üô\c¡ÎiqŽ -c/e#Á1ï}puÙœôr)¹d‘Ê¢‰ÆRÜ(:‡p_e5j…ÞX+R©‰gRó,Æ+R÷b•·èª#ßÈÅ ðSÌHqŒ3hÀ¥‡ž —}„PZó!»oD6£Åê^z"ç6ü[µ²¿’u.]ÜdÀëÛÊÔ,éøºfà_P#pcNˆB&ºŸ‘‰c6ª”qK´;щ1…SZ¦ÒV~nu«njÞ}…[#š°ÓEN¨ox‰›n/ÄÌC·­y[qù}-'± ^‡A=à­\c™¥ EêãFé£ÄTѵÂhÄ‹Aࢢ¥â&;Â|h¬‘j´ø%<´*e=¢?·Iõ ×¢ÍÑF‡ÁcÑuÿˆhzlî‘_äIŒxG¿@~1ƒïyA­á<ßr…¿(€PÄ‘”OÇf³Aýpú„ÓI -X í~àžZ’/ù‰…·p+UÉàJÕMR‰† ¶C;Ïv^ô„«¶ýœþñàAQ“=½=ü·%Šìðâ€\=fDÏÖ•ˆmB$‰â0“Lƒ!û SÒ8ÂÌ$ ÔìÛ„‡Ó ½¬r%¥H¨3UۜȸäDˆÉGô’T–\.ZÞ_^|À==¾áϪ”n¿ rÑ” …ìsm,1¼7RÆ,8;}bQŃYJmÄy[)+¥¾àz&ÔΩ¸÷Žk(¾^9\/„EÓkï/AâBŠxe‚µ€ŒS…Lò—Ê9÷€iT%”nÄŒˆ#Š!4dk×qü£ 6HàSË™¹àæȲŸŸLWw?¾ˆó´WABEQ€2‹¶Šà¯áÙë6LÚ8÷±™¨øÄܧjѬ›Ç¡…sóú¦€Z$ÍÛ:©†Ð2XÈÖÝQ¤7CÙÖÙú^øã†ý´Q,±§J¹9Ý®VÞK¥q™«Tèå Ô2%ú¬—#q…ÏOŽ}!.¬H!¹UÕDĽqö#îj øH— L¹ºRˆ™SA‡%Ô++aÕrÕKø`tr['º(ÆNUê—ꇬzÌãy½bwOľq¯ë‹!ÈuïaŽY…Jtà ŽrÉ\qÄ(0aòÖÈ=ÂÏ¥ÜJŠë@ë "œž"G ®‡ÁÙ—»(ómÛgDVÞ—”À[*EÐGRç Ÿ·5§Þ#†X“[åh,|Ÿ¿Tû’P¿¤N³|ÿ£…c|ÇÁ†ÓóVaN¯wO- ;¢rg‰»Ã`Gñgfw6뽡“uÕbù©–¡®&Äu&•=TÅ ù–Eº.Išå92lEZŽŠ¨Vgzøñ¨û –,¡=½nK’ H¸S‡>ÎÀÄ.m6‡ï/‡ÊVI E²c¹ãZêuÚ57¥fø˜Ö%Qe•v&£/NVŠ®¤éå£î|ú6#À$²}Œê¹ÆeÝ%xRëÏú= Ô>DQMtgчuu˜lNz†^¦=Ä—jõékz¡@l}« åS׶\þò<ðUšOÿoŸs=Ln%ÿú­Öq§ÇŠ:¡å…>4{ -þlØÆ endstream -endobj -2927 0 obj << +xÚ¥ÙrÛFò]_Á}2XÂfpåÍv¯bëX[Ùl*IU "±í(_¿}Í fË)—Œ9zfzúîú3þù³$t=•ÎâÄwU’Ì–Û o¶†™·¾@,d1€y}ñòûHÏ|ÏM½tvÿØïº:T³ûÕ/Λ¾º»¿ü0_(¥œ@»óE'Îw—sßùøþ»Ÿ/|çw r÷a$Îí÷Wï/yàúÕÍ+z 0—׸îæ~þÛý—÷;{.`’"jŸ.~ùÍ›­à?\x®J“Ùh{®ÓÛ ÀÍ µ’~yññâ_v+žÓ3^uŠ:ˆÜ ††òÜ$ѧ`ßMüš§ÖûJ»¾J†žzÚRÒ”ôUê†I83@HÊWLuSïwØ œ]SÿêùhRæ8¢_½Ðk Ÿ#Y³²„æ3Ï´›z€+Þåa¾bGVm³jsYW7Ï<]äßî+ZÎjƒsÕ:{(ÍÎpŒ?Ÿ¡œ¢†®À¬ï¦aHW÷WÁd T RŸ®‚¹pxò†žó&«Ï(rnH|î±;û6çƇ:ÛtQ­¹Çt²è·S¸û‰›FñyÜ{˜l3¸{ž¥1áþûÕ|¡#å …ë +E¹ã/ØÎú‘Àù€Èî’~ÍP;d'£ŸóHWóײ;ÅvWæ[ºì(wÅc¿˜4t‘ÿ¢´8'Ç~A&1G¬‹Ï8*g}›–›%ÀÄ2+‘”@!kùbܲ8Õx¡òyž(8¨µv›®´ï,c2â ,Øä¥ÈøVF®¸ Œ¥nWw ÞÏ<ˆëks#øRtnu(¼… Ag vMÝðô#udÏÊùp›/OÔ©y`•áÈs;¼´NéÖW‚WSä«ÁiL¿æù±1|EË°-k¦f½.ÍÚ¬!m­¤û Úû¢uÍŒ +ÃÍ:iï¥Q?òw¯|c¨‹dÚMÑ\[š+‡åYô‚n*>¼îÏÈK±á5ÖRÔÅW3ëÙ&ÿöPÝ|/r“0™E6ôýÓfR` k,ŽÎ!jïñÞÉ&ÙˆÝzÈC\â[ŸÇE`Žp+»qäpA©Hç‰ÙAÒDÄ&ø6AÓšíuÑvd‡SßyõC3NJ«REº½É:^ö¥@N–Üa‹_#+ä  YÔÕ‹U^Ò6]Áfh€…＿}óê=qz¡×£«ôYóÀt:Mš„¡›dµ¹ÜÞyV÷@gX-@ˆÚ¡¡V“@|ç$‡‡(¥!8ðè,JaöQ‹ÜPŒÀ „:œòñaB>>LS7‰Ã y‰ùx„ZfBÙ½ÑÊlܳ*œ#`YP¯…ò¬ÿ»®€©Ã+K8&‘«‚ðëïÓ¯?sÂû4ù'D®h¬9`4‘t뉚>Ra™>0+€ÜœügÝ<Ù=2#Ü$ɶìûû‹c¶‚Ã@§gúÌ 6| Dìe6o8.AôÙnA3—``ýÿر JÜ8 Ïâh`Žñ1@k‘\ +á8ˆ ‡A$Ìí€Çì`Ùç q ¾˜Ôk4tSl­cþlí]ÃSr°áõ‚yëûÚÕÉÈJµÈþºB&F ø-ŸÊ,›i×LZ “[ˆvs +diEƶŸÛpÍ –õŽ ¶Û ÕYò `¦Ég€çkHÇ #ª=Û$ !ŸŠuts„Θ„’®2 Ôñ°Ó Ö½ÞƒÔ¤ÃL +Añ>’—b¬ß5Åûï±àÕK³ç fqfD_Ž˜ÿ¡òæ0Çv&æ€Ä,v#¸Ë y0*‹|§‘¡+ÝâRô†Z˜öJðY4v”tÇÎOºßÜë—Á»—ÿ¹ãÁc}V‰ñà1˜²0gòÌ=:›mñ'‹õ‰*[^ì+ïÝkïjþâþJ†6²†h ñmŽÁ|:·ûŽ2€~y±ß}är‹òç ¦± }26¶}*åj]^ñåGMÇŠa¾Ûª<5 ˆ)IྔÄxþÀÒA§w°nËÉç3O½}Í %lŠ?é² ª·2œ¡hHz•­O™JÜ$Ðw:äd./Kî-%'””|á0»§ÏECb”C Iá¹ìN´ms¾f!]RÙDT¾×ø¨ÀÍË?Ɖã??æ’­HRø€ùBâ@žAöƒ)˜½Æ‘A¢ÝmLU±0‰#Fï ·f/ö¢¶¤ÎÏLQ÷cýèùœ|ÚQpâú ǤA—sÙÎ’|Ñ‘ÇÙ«TN”Ÿºiðõ/ƒõÓ/ˆª_h "ˆ¾k²H{2Ù­4ÌØšÏMî–8ÙF(ËyÝ‚?pÄ‹ƒ35jêƒö<1ÊV¶– *£Ä9§É:3Þâ/¼Ï̓4p“ újšÖOÓÜ!V—¦âŒQ’2ïOÕ¡eïãi1ÍÞˆüÞ{Ýòxa_jØdfÆ/’Ú¦lzð,å1“¼pm$Ì ò~AœÂ Ž}±<"%ƒlÐø’eõ¾¨Ä/v})ü`š­B$A¿åmetÜÄõàK{kß µZM«m3xÊÁ-&üÜé’`E'u7Щë§_/Fvù)b˜ÞËÊV9ÌSWÜS) +*M*ÅÕ5“pY/‹™u-™õå¿ñ!÷–ä~–ÍZÅl.¹ª¶Ç¬=1G‘ðY5ý3•xdjòÕÞøgÄ€UàÉKÆXábá +™ž³q|LAºo^q=QugkÏ1>Ö‹lÑ w¬ÆaN¬Ž‹”Óå—W'|\Y[×µ7õªƒ”:õø@i²ºu'~há+å¦çgуLÿDÄ××zôe~"½/™·A)ÃÇÎ*$±Ü—Ís}µ/QO! ‘mrÚ÷X÷0Ó¿ñ=ßÊÚï?Yj!¹õ€!Z³5§˨–‚S”²ÖZhÑbÍ/‚f¯Z¦(/áöÝwÐyÃm*qhËâúI¶2u#Å•3ÿexž}‘¨³°Þœ|»èË[îûgŠÁï4´cí â|꾕lwò +߶ݱƒ`Cbµg2{“§eRPóÍë¤èú(3¬rkÀ,«ýÕÒ–¾Ç5½5Ú÷™ñûçªÞrÅ #$Sƒ¨K{¯fJs”ç'EþøòëçoVµr5!Ç!¨]à\ØÊOñ÷ÎY#ü?£¬~endstream +endobj +6143 0 obj << /Type /Page -/Contents 2928 0 R -/Resources 2926 0 R +/Contents 6144 0 R +/Resources 6142 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2930 0 R +/Parent 6112 0 R >> endobj -2929 0 obj << -/D [2927 0 R /XYZ 85.039 781.388 null] +6145 0 obj << +/D [6143 0 R /XYZ 85.039 781.388 null] >> endobj -2926 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R >> +2226 0 obj << +/D [6143 0 R /XYZ 85.039 732.512 null] +>> endobj +6146 0 obj << +/D [6143 0 R /XYZ 85.039 711.921 null] +>> endobj +2230 0 obj << +/D [6143 0 R /XYZ 85.039 133.97 null] +>> endobj +6147 0 obj << +/D [6143 0 R /XYZ 85.039 112.774 null] +>> endobj +6142 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2933 0 obj << -/Length 1561 +6150 0 obj << +/Length 1583 /Filter /FlateDecode >> stream -xÚÍXmoÓHþž_!D©ÙxwýŠ„Nôh¡¼¤\®'\Û%V;Ø›†è¸ÿ~3;ëÄN]ðáNUºo³³3Ï<;³ ïÛðÇûËlöý€3ýxÞ³ûŸ`åy øøÌã®Mz£Oô¹ÍB;ìO®µÌ$yoýþâéÛÉñù`(¥´¸ËC߬wãÓ“Óã·žÑÂë³çgã êO.qéxLãËÓñ³³¬K#0žPûtlvƒ¶¿°çXï.`ãéøùàãä%0ä’¹N¨ 5G  WzÇ“†C0› tãsïýG»Ÿ€«/{6“aÐ_Aßf< ûóžã¢6iƳÞEïZsú´«­a-1ä! …Û%#|&| €¢npv®%€É-É|Àœ´N²/‚ç[jšR'ƒõÕ(&4RFùZJ2ÄyÝЪó(*u<`­Š)pì‚x¾“Šk´ë³KiËÖ°KwT:?ЦÕ|X“ Aœ$ÃâH¥ ÍDŠ —n+î>$×ûQªâQ¦ï騚_u„*™/#žåtè¹A†[/"eÃh$ú ½;Ç™€;œùÂká†Dó«¨ÃÇao™zÄ Wx¹£pò -·`'IAh£$¡0DS„LGRÀ -úuáZ·:.7ø?5"ÓŒƒƒÍ]…µM>Àúm(:6iInGš^WÚ‡ÏËÚ4I»‚C¡+¬7k$ºhñK5×Ë y®pJ’HE}’ì¸þ!äMØö¹þ"drs_;ÔÁ½õ}/?TuOn”Aýp[ìi)–ØÊ÷Ì¡ž®¥${­qŸ -›Øb&ÞW&¸¤@¸ÄÐeUŽfE͈†#8¬ã(e'jZ'ȇ2ÕñREiCˆY¢¬«Ùz8–ægù -æ64 ­ƒÍUp‹: ׿p®õ·>Áquùl ø -;O\¼9zБðÒxZÐöaNíè;Ë?™1î§n•–·Yœ‚yzØ¥¯¾¸Þ>Ll‰Q &=;{;9Åß]MçÇ“?Ÿ¾~òð·û¬¾;MžŽw&¦¦?Ó'uÕéo¡¶xÎs¼aKŸ»}Éè,<Ø—~‰¶¯W3A …pð¶ä*Ó;Ëúm¬ö·žX{ÔåEM•Fu ]MŽ‡&d(ÂTß -ô逦Úå &Ð|•Kü¥©¸(Ë´"0´ÿ9FW'\N5UT‰žCšU°ü0½4UäÛÊœ£j£´bLF›÷V}zžÆ;å´á¢û Å´X|¯–¶ïÅþ%fºTÛ¤›«ügÒïM6›-Ê"6°²ì~G÷\fÛ؆!óxxÏï4¤ò×~à>k€òͯâ\»†rœNûëý¿A~)endstream -endobj -2932 0 obj << +xÚ¥WYoÛF~ׯàK +7\îò +‡4q®&¶«(Ú$ŒHI„)®CRÔ_ß9viÊVÑaq¹vfö›Yé…ð'½,¡Ê½4“Be™·ÚÍBo;ogÒR–$˜Ðü²œ={“hO†"so¹¾— +oY~ñ_½{¹X^|žJ)?Òb¤i濾˜KÿúWøYÎé_Á`Á$‹Ïó(ó¯Þ¼ÿxÁ Ÿ^^¾Ä¥·@sñ ù.—óo˳‹åhݨ,ÉÑ´³/ßB¯„c|˜…Bå™w€q($lïf`›ˆµ²ófv=ûmÅ{Úc®sžˆU&âL=v…Š'®Q.t®½T%"còE_uwU7â(ö_ðgkx/i”zDí9Q›žIšê®jN˜TÄ߯a+ogº +æ’„i¬º4»¢n­@³1m"ñϪGÆgoäô A"¢ªBf)ÉY4€}¡Iý#ÆÅìq’ømUa(Kž †¿Ûiîð§b¦‚7¾´Õ@†|ãy¿-:K1€Šm1ðzmuæQêÃa¥ßX]U”Åw´‡CféXûïðüÙ€=(~3gc]V»ËyêýHs¿(çt(ó‡ÌÆaæ÷¨yÕÕ@s;ð®c¼…µ® + 'f¹%ê=2ÐzÇëE[ò $ç²(ý•i[wÌÕPœôîÌQî/·Vt5Sà°hzsbþöŠ2Ôè¼z@MGrDxâ‚5æ–Á´ýé3Ô«¢iŽ¸”ûýXaP¶¨×´õß5.m`_†ÊÇJ“îÆY=€(baQC½³„«†ã³B†Þ=ÔÃÖÒmÑð'f=Y´ì—Çç`÷wìÑŽQ¯Nö Zk·6lÄ$U«©Ûþ–oœxˆFRFBÉÈK ­’(ûoíÑR/lÕHr¨ñ´Ì.·60Jéñh8]Nˆ+ "ÚÿNcÉ‚ y°hæP +pÒ²ÀÁÖ!ÜíÝ.•ÛÎÒt¶è <-k*I\E8dÇy¦üG¦Áq1¸p‚?<ˆn2‡nùòŸCÃ)Še"èá´ùR"‚,Ñ™©N(4W螧˜³Ýs%'œÁäî8ùã± àø@­$W0lR3KS;ôà:n÷Æ"MÁ“6Æ ç;EµâÅ‘ìÑ®w–ŸÍÒ´mÜ°ÐCó†‹+é¦3ûÛÇÝ §á®àÊLFe®´UëòjéÊ!•è„ÜaÝð"¶¶ODæ`’gÆÕÄêè¸n…º"d?8EÜ|âøv£ö"é¾®+èyJ´2ô){M ö$ꢩ±}‡"¤œx^ºïRa2 Ñsh}ãÔus +[¶!G/,šL7Q’ŠÚ}†“¶=Ó0ÛS<¹<#ê¶ÔVÆørruâ«3”†güŸÂžüÎÀòAXH¹£âH„š'ý’ÙÙàé0òû=µcÔ„Iv‘+,¸m݇{n]íR7_ðÆ»çüEÕÙ1‚$’Œ ŒËj]ì1èýü–ƒ=Ã&ÎÇh¢ûB†³‚?“äõ¹nÐ=40ƒù•¡Fȶ­jcÁ÷@ ?œ¼2Î?=á‰åçž‹ðϺêU:>¿µ™ÊÏ£´@"’Î<«’ùC{Ýëõ‘Áÿ7ƒÅrendstream +endobj +6149 0 obj << /Type /Page -/Contents 2933 0 R -/Resources 2931 0 R +/Contents 6150 0 R +/Resources 6148 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2930 0 R +/Parent 6152 0 R >> endobj -2934 0 obj << -/D [2932 0 R /XYZ 85.039 781.388 null] ->> endobj -782 0 obj << -/D [2932 0 R /XYZ 85.039 761.463 null] ->> endobj -2935 0 obj << -/D [2932 0 R /XYZ 85.039 741.337 null] ->> endobj -2936 0 obj << -/D [2932 0 R /XYZ 85.039 741.337 null] ->> endobj -2937 0 obj << -/D [2932 0 R /XYZ 85.039 741.337 null] +6151 0 obj << +/D [6149 0 R /XYZ 85.039 781.388 null] >> endobj -2931 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R >> +6148 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F14 2895 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2940 0 obj << -/Length 1369 +6155 0 obj << +/Length 3086 /Filter /FlateDecode >> stream -xÚÅWmoÛ6þî_á9E#5EŠ’% †fq³t­ÓÅî2 ÉPÙ’m!²äŠR½`ëß‘GÙ–¬tÃöay/¼çîxÇ°.…ÖõB¹ßu=F¸çuçëí.sÙaZ~]2d¶äO;æ«¡Õe”øÔïNJf~0~øñå»éè¦?àœÌ!ýëzÆûñÕ««QŸÈxs}y=ž }>šÞJÖhŒëÛ«ñÅußòŒ[-0žâ÷åXkƒµ_%eï' x5¾ìßO_ƒƉcûÊ0s–$§3š 0PfIŸ:îi7¨¯;”pßën¦„ù~wݱiëuÒ™t~Þ™AžÝE­–h ¸G HA‰çí£Æ–¨ÝŒ¦¿¼|söìû Ñ|•µlÿàÎzã·ç½C¦³W8–c Rü>ëMVeQÄé×a¶­8Ò’"Ê?ÇóH|‡Ë^Ë©q’lòlŽéz¶!ë_À¹ÓYœ†ÿ#¤-zð4,Þëƒ>…´§Ñ'$¨^5!ëIñv©{ü<Žß;ÆmåÕÀ!®åÖ\Ë×ÚÄ¿æç 7“lþ`Šr&…)Ö3¥{ Ú z¯-ryT”yZ®|°â1¯&û¥ywB”:‡—H]‹¶\”I–}ÎŒ<MƒÜ"–ïÙrµ!º»…¬íBõõ-߀üCW ±×„èE‘HO ÜÙÊÞ”å¸ÊRüŠþ€YŠôMu'ÿ…æE’á¢XEMÏ-:$áv7óe‰›Ë¯8ü]C‹`ËÃãBn=6Op «ûv{l8r÷ïB3ï[®±’è6E”#’E¦‰°¯ÐI/b  ‚¥`ùœø¾S«…kˆ™m ÉÌ¥†R€`Ù¶¾KL%J¤‘²âªÈð»Æœ„ñt5ÃÚè¯ÌéifTÌÍ8 š"XÏ"ÛÀQŠ5Ü̶ƒ¢DEQyQÂaí¸tjžÇy ”[>ñ-«ô -JƦ–QV%$‰ô™B¹¤‰2ê ¡éµ ÷ Pº -;È©&dm³gÒ²>M¬2¹J*…LFt{p -îo¥C2ú©äë¢×:2Ò`<ƒñ=„œ\-P»ÊÍQw^’óYþ‘eîS„¬•é·Ô ëDOªÜrÏ—Ì–ôÁ‹Ãµý*}¥P}+H0{æ¬Rª§ŽÙ8š•’¬*j«òPNÜQf'X¯Ü‡$fe¢=˜«¬‚QÈ4Å©8€’­±Â³R@–º¾UÛáµ´'ñC uác?mµI˜õÂb9¨xrÒÒeaGY£bÅô¦å -¹ë–¯§Ó7z„zÈ€Ê ê‰r”Vˆ0áPjœìuôðÏ -$ÖY™NLŠÕþïДT¬Z˜‹¸Åëj"ßÁÁðËð˜? ùÞ)„”Ê­ò(XGšT„"¡l4½C„›8<ûXÅÁ܈jØâ÷O¥eyÐ!‡5·wË<Úh­„ìP—¶«‰ÊÏê¤Saþ†‘6¾5ÍÓ#&Dò>êÂ;öJg¹÷ PõtÆÏvó»íÙ°¢Ôy2K_jIÒõ†zÙPLQd›Zà#É<úTÆy…VMŒ]-ï_hû‚>¨‚y ¢ -Óîã…ožª¦vºËr­„[o…q±« ê¬$N+ß ýöe%÷˜•yåš$AgúúÈRÛÅJ¼ÐIx",ó¬Üèõ*EÓÅ?O<“÷Þ½r'oÏ/žºim R>îªZÓoâh¼k;2ÈüIãÖ„€Ãmx‹Ã‚Ã!¡D<`Ô)ás —º,:!w[6eA9]Í°:F§(Š‚}ÑÛÒ7:^¿'5·¬ÈŠâf RAÍFù3Œ hË|Ä×A8ÔôÄ«£dð˜3CxœÕxYG6ÉT཮¾ˆóâ¹{VôIʲi¤b­±IUšD˜þ¼úíp±ÜõÃU¨ÀÙð*ç‹ý•QQjä­¾ú|õ/ ®•‡ì<¹Ù4VifÇQ²=àýè5½¿$=˜Ä(@쇥yC&|XƱä—Ôƒ¨Ô)Ë.»ÚÑù7°C®Î“Y¦ÁÅÒ\eö²äèPhøI ODçhÂP©²4Eœk­räë‚T%9Pž 6ÊŸ[Ì"d†çŒ +¸IàN*™.4”XynÆ{&ú'¶háúÃ^/Þµ@éâˆXÆ»ò³ž3¿ˆ‰•C1gãP¥a$E ¯‰£½š#$¾ƒyßáoÉmE¾¬=ïŽ1ü‰'ªNÀÉóÈúÝÊ°+(.ЋWIhÑ œQì¤4‹W5™ÉLN˘ی±pË])–6´§’Ž¢êM”tªtlP ¼ÕmE˜ÿõj@½òÀÏåwŠ“,'Ô@3Õ7³w”¸êNÉ3P!‡`/Þ}g…©ƒy™¨SLH”:)ZÅïÙòÿïè|:O+<öÎ +‘™¢×*Ò*Ë틺ÉÁ2ë÷ÚBç‘øºGL¢Äõ+P›ï—& Êb8tö±Ç(i6ÞBŽ¡ì +zú „Cû"}ÌåÂÄ1LÅÖa çÍÕKÑXw¼‡.ˆµÚ/MõÄOä X`ï¥0A°ßÃ8,·¯¡ÆÒ!Õ‡†¡?·œÀª@4~&¥€Ž§§º¹fp·CVOð¼E ÄûŽ—ï8saX@üϼŠ"=wÙŸª‘Á§WìÍXìò;•ÝU]}_ÂÜÊ~eÀãqw»•ÒVÞw79VêÜÚ ÿQ$¨\ÝmÔ°ˆ¬pe%±e‹ÄÐzd¨\IÌÁ…~ï;Gö‚lÊÙê%¦3-ž9jÁPQ‚ÈnÛáêW Æ ÑH¼µ!DU‡¯o)l®%TãÞºåK *åƒÇ»‡±ñãBËp°ùO‰ªcXê9‰£Ø†ùTÐʹ6ŠäJˆ'©§)§ øõj=x+øgS²„ûœD›JÛgÒ,(d£¨½Ø ”SÛƒ`R|Ñ£K`ð 'Q„¾ï^õòˆzk;É^HL1^O0Ã" +._¿7GÕ’Š,æg¹.‡õõ}Ñ÷†<òù$R9ÅSÁ¦±3 ·K±ò»Üð +fÒjl^Ò‘'|†'E©Ò’rlÀß‹²êÃêy¬-^×n»bß{wrãvYï«B´=*÷*)y¡s÷y ûýfÜ@’ª5.˜ŸÍRŽPkÝ!(œà¥– ñý‘ËIBq;A¼µõhç<Å$ÆeÅy=”]ÃÑaô|ÔYÒ{9ι)ð"-ŒPEÿš'¾Âc•˜T^·ÛŠ½ÿÜ2°È¬¾šÃ¤ÀMeí ®Ÿ51“‰Å߈h½4ÔÄÀÿsT „‘QÐ+‹¯§’l¥)7çZ1k3±VÈØõ¼Wð÷iÓ䬩 å€|²DÛŒv!n, ×CïÁ2ö’Wz2Ô¡Ža|¢Itˆw´°ç]Ìx—ºÌᲫŸ©Àƒ>ÙbO37,º–UŠ4ÕWÉœ*ç»nŒ8CGN€ xE¦CO‚Þóï…Æ›“Bl™÷Šf77bØ—‡í]/\ymó0ÖK ~'Q.3*âã0·W ƒ»Ã:1s]ˆÞÖ^Ù£ÏvL­S +< +È hË”ñH¬¢Ð»œÏ üD²Oö85ÐK¦~ت¹M•R¤WÍ ëÐáˆ÷„õ9xu|‹oäÐc%Çöóo ØYâM+²“™æ†×¨ÊÓÁµ_2áŽ?Ríy¡øH%ïEã¡-úg~ã Ý08‰u¼Ìc‰ôx®$)'K¹ú;¾õ¢o¸âˆ3¸ñÆ£ô2Sª¹nÏÈLŽBEš Eˆ^0sG¸„Ǭoæ&mºy¦d¸¯Ü€rß³CI£ *)Ï]¦®®®è¸²@i{¶2ÅšòjæF}Å5!ž«Z&ä ‚!†²/@U8µ€ÅµÜp[PÎû2¦%7Œ‚¬<7MÊ µ<<ÊÌdÌ5cró¨l>s»àb(TF¯x<é¨ÚËçb˜æòF&Ÿê(†ÕÕ4b‰:ÊÀ²+÷í G]%J,vçSËøä;ï]¿—Ù]7ð†ÓÃYQOº c ¤sª Üa]¼>É„‰Êbè¨!•Ú|þK—ƒYy@Ô♹Ï͈G§1€ë—/˜³‹{ËÌ*_,µ›µ*sAPôz‰‚r%Z°$ëÔ4ÕG¬eÞór»9÷„vœ°›ùN8¤I ÍÇjØñÓ°“Ä>Þ=p¯SHŽ@ÒõZã¦æ’܆Š»Â}öPÜÖÜìdκç¡~I6Ýï%©Âš70p%ˆÄÐD› ª…óÁ¬ÄåP\iýƒËƒY‡kå!;W¬‰¡"ƒdâ€Æb¤zRN -:4Èp†`«Aû‘ý[v¸^&ØêL…žˆ<‚#Õ¿D*˜pþ=²u¸þ‚Ô,U6ÍŽH½§ùþ£Æ4í¶)hÊwù<ä‹æ8ÑY¤Bˆ9‹¿‹‡i5¢šs}F.#i÷e' u¨Kñ„dBýr¸›`ÆÛY´¼ûDzƒ¤aÐIÛ³A ŸÕ—îÓ{9N&Ö¿Wb6UéQR¡€%âü—Œ›yji¨ÒX§®ÕjÂ5§¬ :éÔ݇~Áhw£µ¡ÇÁ•×p¦ä}K^Ù¦Ê hV˜yßsñåÇ1Kõ€ª!ð5¿å/åò†w¼Æ}JRÞÚ Êè$¡`ŠŸâÇÏ]üê–ýú2óßÓ¬¸öñà ?Ì‘µab‚•îƒãÞ5Eý—§ØeãÔ} \ßæ +à sßPE¹o¬—§¿r&Œ‡F%‘C†"3Qxza É;ÎÌåÿendstream +endobj +6154 0 obj << /Type /Page -/Contents 2940 0 R -/Resources 2938 0 R +/Contents 6155 0 R +/Resources 6153 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2930 0 R -/Annots [ 2944 0 R ] +/Parent 6152 0 R +/Annots [ 6157 0 R ] >> endobj -2944 0 obj << +6157 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[1 0 0] -/Rect [361.189 502.381 414.575 514.071] +/Rect [225.436 434.035 321.065 445.725] /Subtype /Link -/A << /S /GoTo /D (winbind-solaris9) >> +/A << /S /GoTo /D (winbind) >> +>> endobj +6156 0 obj << +/D [6154 0 R /XYZ 85.039 781.388 null] +>> endobj +2234 0 obj << +/D [6154 0 R /XYZ 85.039 761.463 null] +>> endobj +3027 0 obj << +/D [6154 0 R /XYZ 85.039 646.155 null] +>> endobj +2238 0 obj << +/D [6154 0 R /XYZ 85.039 393.584 null] +>> endobj +6158 0 obj << +/D [6154 0 R /XYZ 85.039 371.823 null] +>> endobj +6153 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F56 2890 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] +>> endobj +6161 0 obj << +/Length 3645 +/Filter /FlateDecode +>> +stream +xÚ­ZÝoÜ6÷_aà*YY¤¾Û''N¯).‰/Þ mj%ÙÖU»ÚJ²ÿ÷7_¤¤•v{‡³9ÉùøÍPê܃ê< ]ÏOÏãD¹~’œçÛ3ïüzþy¦„b%$«ÍëõÙåQp®<7õÒóõÝÀ'tƒÐ?_¿8o~ººY¿ýt±ò}ßÑ¡{±ŠãĹ¹Hçê=·¾¾º}{¡œk| àG9ï.Vʹ…‡õ'z|ýyýöš‰¯.tâ|^ÿôöÃúÝì»BVk"û#>\ü¶þùìíÚJne)Sûϳ_~óÎ XâÏgžë§Éù3<{®‚îíÈí†/ïõÙíÙ¿-+î ÎyÔÒ.…~↉?ß&Ž¶Iù)P…çq蹡Ð>½¯@øWÑ6]s×Ëjó¾z—²9HÕ–H–÷MûÂT¿z¡‡wüJÝ;xÏ6uY@§‚g÷p_”¹I˜œÇ~ä¦a¸¸C³Ñr´7^ŽÒ®¯´å„Ëù×õ…g’ÜÌf´Ñé™…f6ót#CåÆ~<™y…ÓíªPÃ/YJ=ëØ™ ÒÎ>ÛÎdJ7Ša Úw/úk=ñ]/kÉÊðZ˜-ÈžÄn„vF”°.ðÔön×° [ø…Ã/¡¹ᳺnP#ž;|÷þ:K~Fº÷\h›;ü–;ñÂp4ðruÃ]OZH[þ}>?’66Û}ÖC[ºÄ;$®ñÆòŽo²9þ!zʺW€.FžÓQC O¶»%u\…:pÞ4[lÙ6»_xÌ° +a2Hì‡éÿ?]Ç}ÕÎXÎõX”ßÃ2ÓØù¸‡MŽVv6\­7Ñ 'ízÀ e»‚ I½FÊwnQð7üð–ªka¬S§¯z9Ð&µî ± œt¼ÜU×L[^W-ó`øÀœwIØ´2þ=žV^„ŽïÞú…¥Ì=ËÁàUúŒ(J]í¥§}ƈè¸Ï0D(Òš½ÿ‚ž#»ð=rt~;¯+ÞX8æ$;*M]¥¢ÓB ÍL¨‰Ij/Îh"”¸“(q#­ÜIs'£0t£ow&Ài5°Zv%‰g§CávùþP&íATÖñß!”auR*ÜÍx,SöˆŽä½ìÛÌ»AÛÄ»…ŒAý}(ÉõUžõU³CÒÄi~õ”/£¬ƒ— êÿ®0ÚܲcÁžq`4Ý…œ/êG8öjJÐÄÄw2± 4’7M+O7‡›žW75GÞMÖ Sz=îüŽÙ•ø©¿°«è„] ®äöýk¶£²¬®{Æ߆,¬˜knLøç¤(B3eª•iäF~0E¬)Œ]¬hjMyêYµ@']—¯0P$ì·A9†cƒ8´hz:òÝXÁ^*~°ߤçÂk5b¶ è TÙq9ÝöbÊfÊFŽ¸µ§µ¤Îs…˨yµ¼¦©ŸyMFmè ŒæÁ,Z‚ˆ5è6FœÀJ ô‰ QŒ·wÇ^lDKQ¨gœÇPE&èO ÌÜ?Z J#4FVYòÃ- pÞd(Ðåþd·|ÐP6\öiãæÍîŽ 'Û¤D„B‡ÛÃ?j?!b*œ¶ŸÑqû1Dû¹…P+gs(@ìƒFŸžŸIfÓxr€¾šL/6€8 &¸‹N#‡´l!iÞ”8À|cÒ²y³%é#–^ˆF†°ŒR@î‡p†×iá  »z*Û8 á>$lCÀ_c…øÜ´Õ=A’¬Æ†ÐyË¿_c6‚!ñ®$Ð÷ŒÛдPpºgò©m+‹5RÀáÄ|£÷=ˆ‡ !Ö¦@0Z#2Vož3`Ûƒ¸!|ÞPwY +/F‰[’á™èz¦k(òþ­±Ã€°(ˆˆô_¤¡ÙWÆ›xÊŠ³ZÀ ÿƒEûèã¿°èè„E NüÅÊ =Í£ dú1¸Ð“Ó Ílú©MDÚÓx2½œ3$~Z-¤¨>àžc& ¹"8Pƒ!DÉ7š4óZ˜-›t¬R;# +ù\ñ1[œE„RÏt/œ¸Ž›nyqè2hd†¿Í¦Ï(š ¨[†~ØuGèk+øc/ƒ +Æ^mÓ×ÞÌ6}­ëfËÓiØŽ'"Öu]¶h\ç¼ë¹?Ï„ð?6?•²,-šœuUýÂ3Š¥qç〠¡‹Ö‹C§Ñ§¯ìôå’É@ÖØ1ÅMÀ¬nFCrâÓI?Í}ãˤð6- õU¯–í>j—Aœº¡>m–Íq«\Ú§«k”çLÿùvn¡«C}r^!9œ÷ÀÁýtÍk¬1pc”zjˆsÀ„8 Ào†?zØF|ùDeH[·ü|ËÍX•ƒ6ê-·M/œ®ä¨rÛu•Õäÿqý;þÙÂ@|»µéÌ“Õ’J{Ô=×#[NÌè”{®LSs}@5ßQ·ÕñÔ°b‘P¿R=8xΊmµ«¬]´GH9¡Óâ]|Ù1IáRfØQK.…zÀ2©æ±5 ’î\„ŸX ›üάMÖDy…†D®'7„c0]Ãn*âàCÎe(ÔüŠBfCæŠýä:xi™¬I*ª­0s»ý[Þ¤šS¾½<€r¿#ÅnûƒÜQä3‰&>ƒ™ ¶Yòvb×-‡k›bŠà2Bó²ÝÒ*2IU§¥£Îa˜/"€„¿¡Ïÿã©5Raøn gX|´3 ¢ã¥R=«*ÊŽ-—…ìÍW‰›jð/X´:¢¢£Èîzp\5‘Žé8/·T™ ÙûB­Qž+ó”µò0MC€önß°:/ÁsàBfA´Q…®J ·/(¦;ˆT£RX•›(‚ì«ÓÝ`±B*¼0‡½@añ›ZnÅ[­q¸ñ|Ò@Û¿âÝéMj¤Cò}Ê‘ú"‹0 6ÍY”{ ]_àbÄ°vŸïWð7—Ö–Áî ·nå˜à¿{þ´h=0Í›ú’šÀXV¢~¢=¾>†‰±Ë`âù9f#O1ྖ*æpÓ2Å‘Í#Ÿ$SÑ¥TŸ™â¦{ä†Õ“ú'/‹ŽEcD¨SßUŠãŽD‡7E ë‹Ïöa‹F+‡³½†saù(áo: ⾧äÑ,@G#`žUJÚœV gà +!IWÝÓIâáø„BA6*eˆR2 ÅKÎ}Ya´ŽtõAP•B]¥aÿÜ[7I)<üVó9E C§h(¿"ã á3ãçúƒÎ)¯›7»¡þga%†%¾h ‡* ¶íۊ̽.ï¥å¾ÍpŠE G=Jz˜kwȶ¬Z~¼(F¢PŒ•rFÓZYÏ­ûpd;qÀv‡“Ðq$¶A’ÑB87~º©%±…C×­ç…yŒR…P҈Ȏͪݨ¼‚¢P$J·Ljd3î;¡0sÕ¯ÎÄ™~¿pn%hˆ1l[š]ð®˜Â«ùœ@TxÇ—K¾”Ë/¬q¥V9?ð8“|Z†¶Ë²§íºd4ä—LS~¸°t½h,lNéè´¥4Ö•(þ`°T•‚»ñ‘+QŽBñâær²\‚oD•-\1µ,ú¾ìúìëQñŽ#LÔIQG4ÇŠŠˆ)¾$y'\6váËHÍXÌѼd‚¦_ùc×ñ…—5G ©MÛ–y?âöÂNÇ÷iwükñ-<ß—»²EÓ$‚=ÍL³ Gëoº=W:rzìM[XPO1ŸŠ0f¤ÙSF3`éiõSªÐ÷F¾7’… ~$1*è”yOï:dJ‚‘óÀoØC y<Ž|œÂÀNü£5C2óÉ…p41u×U«„!×îT»M¥ânyV;Ø‘Ñ^»W\9zh,Œ+gŸPI©‚ËH4 /ãÕsL}`âùæ|4l8Ž$\H«$SÐ䔾“`¸ã¬ˆØ-@óE[VÏmÉ!–3I“Qíß•±¶ W¼“ì#eM&ä­÷‚Òd8Bª´ ~ÏÊÈ'ñd:»rVö`{Žmãï9쬋+m)êŒ1¤Ü®q.˜Öéè~ái¤²œóO®FyX5dûnb0Ž(8h\'d@@ßÏ<KÊ8ÈpÕóƒáNßÎÜZ/eT1ò†+E5'èé0á¡"^Ç-—Ârĺd¿·o†Ïr³£†+Še­pËÌCϨ±aîH <¹zñã%øc±¿éÛU GßMü#@…X SF\D”CyÍ7®3ÿ hendstream +endobj +6160 0 obj << +/Type /Page +/Contents 6161 0 R +/Resources 6159 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6152 0 R >> endobj -2941 0 obj << -/D [2939 0 R /XYZ 85.039 781.388 null] +6162 0 obj << +/D [6160 0 R /XYZ 85.039 781.388 null] >> endobj -2942 0 obj << -/D [2939 0 R /XYZ 85.039 519.048 null] +2242 0 obj << +/D [6160 0 R /XYZ 85.039 308.93 null] >> endobj -2943 0 obj << -/D [2939 0 R /XYZ 85.039 519.048 null] +6163 0 obj << +/D [6160 0 R /XYZ 85.039 282.315 null] >> endobj -2938 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F20 1617 0 R /F15 1628 0 R >> +2246 0 obj << +/D [6160 0 R /XYZ 85.039 210.126 null] +>> endobj +6164 0 obj << +/D [6160 0 R /XYZ 85.039 189.535 null] +>> endobj +6159 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2948 0 obj << -/Length 2188 +6167 0 obj << +/Length 3589 /Filter /FlateDecode >> stream -xÚ¥Y[sÛÆ~ׯà¤;æ{°ÎCÇŠlG™XN-zÜNœ€DT$Á UM“ÿÞsY€ ÑJ3›{9{ö\¾sYXŽBø#G‰¡v£8‘B'Éh±> G·°óöLz -ø‹HÜ;ŸMßDj$CáB7šÝÍ,û%øþ‡W?Ï^O´Ö´b<‰ã$øxuùæòõX¼ñÓû·ï¯®y|þzö ·^_ñüÓåÕÅû±J‚OžàjÆ¿¯®üiàö™àã5¼¼z;þuö#0‘ZXãH`sœpçìõ¬§ÅD&"” -Õø÷Ù/¿†£ Týñ,Ú%£{‡B:7ZŸ‹Ü´Ÿ¯Î®ÏþÞ±á=3âSÖš˜Ð‰0q£‰E’ì­¦í€ÕòŲO¬²Áu“VM±¹åÙÕ»sÒM/y àtWWÓU¹HWÓ:]ÏÓé¼ØL7ëyÆG'þwÅ¿Ÿ¥6f:âò%Ź¿RóïU½ž‹E¹¹!Ž“V:‹Ð¹“}*6 §—ñ"Í×åæ)xÏç³U¾ûîIi¾­›rûíçÐʧ.»+V«mU.X02ãñ ‡Dõsˆþ?yÿzJÔ½i¿ùX§·ùKYL‹MшŒí%ê¼ú’W¼û_/3:ƒ‡¿µ+å–G¿ó !ûrÔé7§odÓ“H¨XîÿÖå«Û´Ø@¤¾àø-nø÷£¼Üñä~¬bœÈ`•ñʪ€ÉÒäíMÉÕnƒ:e®‘džzÞþÍSºòÀ’–~s ŒàL$9®{¹ªv¾E)@¹ ÎIèmŒDÙçAõ)! ¶Q+x³d)PášD¨ÐÛ†·Ó9ˆ†Bk}élƒæJ$l–/Oˆ¼÷Éi‘9úÏgO†‚즔p:êg>Ên*Ènr€ÝXƒ&M+%¤ƒG¬­¡²0H¦žeØ%Q9”D/oЫñV8é|ê‘kÍÒ{ÕF=6 ;Š=¯z=|­áß!*'´QžøÅ70xdýþæ+Ì4ÔÜHwÌ&ÊEAºÉ¸ªH¸¸e Î"¾O` *TØbÚŒ2mú'AÚÙŒSøÅ-ã -x‚õšõÊi!}Ô3Ò÷1ëŸËr·OçUHg¨D~B‘  …€œÆ ¯·ûè:PcTÇòHý -yÝÙÂgt*­ý•<ÍÊuJÑã5Ñq† ûçþ…9¢î‰Ñ2*n2áãlÕÉÐ…kÊ?hN0¤b›„ºËòJÅUâ„ -cˆ+#Lb‡bª…°”¨¤‹„Á€ƒ¾ :/h‘@ -ß—›Ï¡4·»Š“džh_‹uàhðóØ©àÕ»#[”Jž”0&6ψUm{± -“eŠ³Ö½JGÁ:Íü¨h˜¦YlG\¼I+ ûˆÏâ«Ä•{¦# êarÏGh¡ò„^°°âN!÷ ªîÞc½Öi¿C™CÓ³»Ý–AŠkåa·Sñ¬Du‹[2dˆãŠ- ¶ƒÒÇ 5w`:1”飶<"%ÚmÕ½¿!¥XBÞŠ·•ow2ßN¾µð!#ºÞs"ËÐËÿÿ'ÚW %¼iÅÕdÓ^Š^ÀÝ”×Ñès·×ÎתB%“3Üaa0@ñ¶}‹Ã P-jŸÎðœ‡oÅ3l~[Ì‚×r€Á®ÞíE™xUÙ†}×î¼UdPST3Ò{Ôá2cx½-¼>,+PQ¨ò°ë6Ý ¥V®³mR-ï8>y¯M¤GI¨_w]Ǭ¥ 9{ÔýWeÙüe EÑŠª@ØE´(3 ÿgÜ£Hêî-Ö‹´ŠI"…röëou-bìu^긣{­ã°áq+%1TÂúvi¬HÔ!NnÐøh@+UkÕc#¨ŠÖ<ö÷PßS}ÚË€ ¤‹ã`†ËO];èÐÏgÀÆpµºÓä&6Ðð›˜vNâðO QÙ5R"1ÉqC‹b“é_…VÊ}üáޢܹßðé‚:±ÓsQ‹uº`å{3_kl˜PŠÆß}Š¦Õ†’ ©háa.ˆ *V7ž¡Þ“r·â´„N‚òòÞ_BåÇ|®ÁØ–ç߉ú,º~¥Jq ëÕNÃÜ5À ãNaºwµ%dU̧u²ÍÀ/IWENàNƤ’qap]®R²vV³ôXè“l3pŽ&VèȪ³²àw9ù4Ûí러ؾ±á<­´ÃCï›Á+â.¿òc÷´þPëö¯01”;úò¬,¸Øbþ#ë*ð¹MÉ&¥€m§ýçäEÍUÊplügÓ¢ù#i±.Y‰éŠ\Ò™ Ž Ú -ƒ±(þbüõ¯?Q±Úýgúf¬±ËÏñ¢ë‹Iæ Af†¾¥ Å;^X¼pº&÷‘` -žFRº?ó™a6XÏ¡BÆ69êÖøÛÊÚŒˆB{œñ5Ô˜µOÕš—¸qãÐF£qè»cü~TúV´ëŽ5ö)qËts›c}3Æ—L}øÆnùMÓûUø&ö «Lý"õb<ìò‘ ^ƒÁj¡Cü&U]Ú'þsá™eèäWyŸ§ú%íi7JEWÀbãÃvZendstream -endobj -2947 0 obj << +xÚ¥ZÛ’Û6}Ÿ¯Ð›©ªE¼ˆ~³“ñÚ©];k+OIÊæH”†‰TxñØ¿}^$oÕ–ËCh  ûôé¦ü…ÿüÅ&r=•.’ïªÍf±;ßy‹#ôüãΉ•ˆ¬,™×Û»õ›8\øž›zéb{èljÜ0R‹íþw秷¯~Ý>|\®”RN¹ËU’lœ_—›Ðyõ/n}ýêÓÃÒw~Ƨ.¾ón¹òOp³ýH·¯Û>ü̯–ÁÆùmûöáýöÝOØ÷ +‡Ú’ØxãýòÏí/w[£¹Ñ ´LQí¿ï~ÿÓ[ìa‰¿Üy®J7‹g¸÷\ºÏw ·…JžOwŸîþm†â¾pÁoÍíR¤6n´QÓmò#k›ü@¹Aà/’Ès#/¤}zwX®Âhã´°†§œïa—íR%NÖqW‰Ð»¬-ª’»Î¸øj¹‚Ž=Èt'øCC¤Î^äác•í³G«o‹ò/~ÿT<ÖðœÕßyÞ??dŽÚÂAnk$Z6µO¬ ïHC!²8;^ËJÊ|‡byƒRœ¨øJÍ?áávÅF&¡~‡ñþ‚ËnŸÀ*c/vÞ=¤{—ÑH97W¾þ³ 3è¾ÁË÷´^o°R½ ¦t¤*u´øP¶1qh°x@%÷ÀRaÄõ50Í +¦Áá×p\ë&ßuuÑ~gáu%!8_(°²‚Ö…£Ûªm‹ÉÍìÔG&ÃçÃ*êe챶¢k›bŸëAåÆ:b¶‚ß ys¢ÁÞðƒ?Àõ/px€EÃîtMË2¤IÎÓ³s5úPÖ¼œÙF8¦ u˜ÀŸ`2üé󿻢Î÷ò¸®`EõgÔf}ÉΟ›¶ÎÊcþù\ía£Ü¦º1qÀ5¹ Ÿ– áBàÙÇì®òƒE (nR 3pau¾ëÃY‚‰àáîemuFƒŽc¶Ë8qÖy»C…Ý=·?”m²h^ysMi¹I|[g#2eZe?q7)ïì–íA9µ>•s.ƒ€sÄŽnЪú¬ŸÚøJîÉv‡Ý=Â#;!Y"öšWžÑJ²FÞËþZ²•°mANRWgª7}åì-÷Cƒ%dµT‚µ¼{hÀA  @Ë·•k@vçRà QäüG´F7ôç ƪªF°ñª–qhsU­5éåôUbæ=?59#ÓèTU +öµcõBVÊçŠõQ$>Z'¬¥W–øôŒÇcâ6<Ñ^µˆŸ/×kÜèöâòÔ¥>ö“K§|\_p‹¸–x6;È4Øñ"¢#l0\Ä8ÒŠÌmÕµy¢t’†–yÜ ]ìˆE²CÇü¡bž|u6XuÌ]2™X÷Š_8Š1ÊvPŒ=ñ뻪Ø:vÔ.VoŠ²‡DòíL¢ŸãxkŠ^d1.Œw`èÄaO"‰/‘À½=¡B€‡  }ÖAÎ S!žçÐÓõC›¼þZìòU™á¶øQ9 ’«öûE·€jm]V‡Sv +1ÞSKV›™X6˜Ò§9_³i±îà ¡JÈóC?uòo—SƆÏ}ÈÃ>ÒÒÉ‹pï¹79ô%žd;ì‰_Ö=4 1+k D¤6/ÔªÊ=?#ÃóÐÏäÿ×ØR-‡1éÄì%áõ}…ÇÞæ{&gØFËÏð¡ÚAè1ÀU%ÛyxD›®õÂQî +€Á›À(ñw2ã{Šóxk"µD»f8©À‘õk œ@8ŒU¼ºsÀ×sö»‘ïË {Ô­fÐVÀá6*r>à"wúÄâ°·¸¢­újµ Íð:Å „±â%£ÄÀrŽÜIÆa eVªñð³æ‚¦›ÆÅž‹ÓI,‚×9äÏ -¨FŒ¨åp©PËö©guîW}/v7À#Ã؇pÍ⪖YYB×™ŠêÁ@ƒÝ +·aa¬CKKÒÛ:ˆÌD‡¡-?‰“ ++Þ½0†x v½‹¡ +w»?¾¥1ŽªõW<æÞ|”Ãy@#”¸€ìG Ä '"™²%´+vË4Cä3úÙ·öòïÿ“BÓ„ƒ×¤FÉ’¸{¸oeƒ”ì‘0b¼¤_&™„Âè¡ëXè×è1C蹜tòI˜%^ÏkP(ÿ–/§ü“¥Èùrh™¬£E¾˜K—¾Ô‹ŽEI"BàKaò_´¿t/(Ý¢FÚ”v‡¬* Ù·, ŽAE|xÍøÒ RÚ üŒÕÌ´—rd¥u“«s-C²ç÷´h¸Ù爰=É…&™p÷bsgç@t« ï›n㇦¬,ô¦œ1脹¶H0}ðñžaÉ,†¾ óÙbÃ[,¼||ÁÍ„nhמ'ÃWyIxGñßÌäŬ¡­áã¬÷ÜY‰te#?õpTÌÊf.8`û¼Óù¬±Ëüý“‘=Xq=! |@&µVhÛe%Op¬3ž@?VÝ…o9꟱ó±7Ǻy*8D¢ ¢YQ®¦hŸ[&L¡Ýâ™ø¦^ ìÊ4gK•l;e#ÝæõH 3*Aˆ 2te×ññhúÔ'L‰ðSÁ`ÔN˜UÅ oÉ,Š¯ÅIïù‘Ëš˜/y®ï©iô=>1òdÝÕ&`Z!ÀԀ̉Øu6JMLZÇî54Bˆ”*¾Æ–Ðu4ÖB?@ã› +ç›Ec{> Wh¦ø§êÊv˜!à†J9ˆ‚þ›T‚ä@j¦àqb“µUî”7J⾫?Æcé¿AR ÐcÖèz?>2Üšô†¨•Ù1ï©j:åÔâzœËx¢Ò軜7D&š YËNì;Aús"SÅWIÚÚP»v­|.dàl·cÔÖTÒÎc˜TĪ``÷£P{í=á|¢`‚O #”ØI®‹×=U9@ƒR‰ß—ÁëÚFL{Ù1# ´ät}dÀ†£†ŽZù™›e*ªišOt؃0ÅI–~ þÀÀªÒ¹uÔ*HWOVé‡l¾ šž0p/°ƒ7J=Q⊚xªÿþrãžo&iµLŸô”¶u §/5›zվХ‰O”+Ó¦zþŽ ÁÉTíx3 Ü]Å$ÎQznz™ëh#2?›[³ ÖŒ&›…k²&oýÉCHîh|wãéPÄqàœÕEmñ !†¡?“Àé>oTÍÑÙ\ÿIež þ™:ûÊ;*‚rŽ/CµOD¸à®Ìåu†ÖwpÄ8_œö‘öU)wDe‚X>§b‹ÅGoú’næëìÐêÞ›ÃvR²¤“¿£¨UÖÁÇÞ°"µì0PDn:]7sÐ꯰> endobj -2949 0 obj << -/D [2947 0 R /XYZ 85.039 781.388 null] +6170 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [391.093 600.62 591.389 613.522] +/Subtype/Link/A<> >> endobj -2950 0 obj << -/D [2947 0 R /XYZ 85.039 341.117 null] +6168 0 obj << +/D [6166 0 R /XYZ 85.039 781.388 null] >> endobj -2951 0 obj << -/D [2947 0 R /XYZ 85.039 341.117 null] +2250 0 obj << +/D [6166 0 R /XYZ 85.039 652.037 null] >> endobj -786 0 obj << -/D [2947 0 R /XYZ 85.039 283.083 null] +6169 0 obj << +/D [6166 0 R /XYZ 85.039 628.715 null] >> endobj -2952 0 obj << -/D [2947 0 R /XYZ 85.039 262.488 null] +6165 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R /F66 3242 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2953 0 obj << -/D [2947 0 R /XYZ 85.039 84.027 null] +6173 0 obj << +/Length 4515 +/Filter /FlateDecode +>> +stream +xÚ­[Y“ܶ~ß_±oáVyh/¹ò 'r¬Tb'öæÉqU¸3Ü–fÈÉ‘´ÿ>}™MES.kHl4}|ÝÀÆ·üßæIéâ6ËãPçùíöxÝ>AÏ_nb±‘!oÌ÷÷7ßþšÛ8 +‹¨¸½é$¡Iôíýî·àO?¾ýÇý»_î6Zë@%áÝ&Ëòàw¹ Þþ[¿ûë»»8ø3¾ø‰ƒ÷w›8øî¡ÇïÿuÿîÏ<øíʃÝÿøî§û÷¾·HꞆý _üt÷ûý_oÞÝ;ÎOÀel¼ùí÷èvKüëMê"¿ý ÏQC÷ñø£åýpóëÍ?)î3·üÕš”‡I®—bŠOL±.`Tr›%Q˜D†äÔåöNeÁ\_µ»Û˜XÿŽ’èØÞm iw‚Ū;tÐ>âo ûŠGö¸þò(oRzžé[i­pÌh¥‡íiöºabD£êꊾFm#£ÊÇ¡êä±"-Ì݃± DV@ô ‡MŒb*hYÛ¶Á ]{Øü;Šø°|ú:SÁ®ˆ“øP7Ìvûñ¹«åPºã¥`K}Ä•eAÛ ÄÌ–Xç>”Îà•ºç·©A “¤î÷òMùŒÂ:À?5‘*7+kjXÌF«$¨q* švàb¿Ü ËÐSâÔŸ‘㲓&â ÆÒža-wë‚Y‰¯òÀýiË ¢¹ÚŽ?,ëž“%Z’Êît°»,ê~@¥¢i¡¯ñ——ðêXàÐþíz¢­y¨ŒÅAßVÃöÛçò¾>ò؉fgY˜¨XÃ~ÇHÜkïqÍ´¬¡*w :ª€Õ¸7¸$^¶lu­°7ÜI¬ªËîEÚ°d< + +;@P¸×–4}/ZÓô¬«›" 3OvùÕ±…IT;-Äç¿Õ¤ÊÈ— 80ML¥Q@zó€ß!WЋA½pJBÛí¬8:þ7«/¼t$Îjæ÷Z.`±Biá°±î=¦ËÁÑXÑdk\&eº°²Œ”LYGà1±v=S +ðªY’ÿ¯ZkZñÌ‘ ©v‡Ú Î[‰ã@Ù:U†v¶'dÜ—@7&x`§÷Øvã*Á€÷¢=SY6x¹7ÍDÁ[2¾†Mœl;Î2Æ.èý…iô ~!.«–ÏWŸt• ?<6Vü²«P2•ÂŽé®‡=?µÖ9z¼ ÎË´+»Ü¿0 åVþpiôì" ¨­u=“ZuÜ…AˆœìŽß÷µ3a’°xLÜS ½Ò"f›Ѷ„®SBÒÂþ‰y&4+×Rè×ÍÓAxçùòùŽÂȨ3¶5g>¶JSXþæ¬ý»ÚÆ•r «ËØs〾²ÁÔÇ øúÂlµ)ÛŽÑ©k˜JÙ÷ÖUçÁ¶.É1cï5OdF¾ 8€|üúÁ€Ú׬E¦óÀs€ j”³§u±ŒÜÇý~4KÞ-É&´§N蟶(…=;€4„,Ô€Ù|€½‚€Ýïú78MÐ[…ÿ|<¡<ÇwŒ:Õآ܈žd^Q—…€µ¤[ò! ©¦ØºL<Gƒú‘ÀF=VëÛFtxé¼’€œ ilBió©²%~ý[mµþ„Xkæ2Áê\!0|wãG4ôÜY©=S aÏ* óŒZŸc`é…Xÿ 2àá±= e¶ä)q<ñ÷G²é¦êÞ̳…§I¦Âàîеc6Þ º~>'*L³ÔQÃË3&yëËòÅ|S=×îsŽóYUR¨8£íÞ¬ìµÉCY¬ãܹÉÓ— ´1lMž8»ÅŽ…ÝâÂí³ÖîP‹÷×2¾«Ä¬›2 HØH …ݵÈnN zÃf~Ê9…6\n­!jëÊŒ2äñ×a/·­„BuYœ? ~£+êÆÙi©J4—Ö/k ®AKi§ü,|Í¥=?ÚË‚¹Å_‘AEÄ´ä5Üyb¨Søµ<ȱ[ä’QACW1¨§·†ƒg6vb°dRS>úòȶ»\ËkÛ$AL–p²K…ÀÀEHã É&z>:Ú…g<ÎÂÜä¯ù8肑ˠ׌üÒ„ÖÈgó­¹7ßÄÈ9:¸Ïy\X#?Ô\Z³¹u#* ,<=I¾u`‹zy:±ßÍâIÚÊž¢÷Zt8Ì3¨1E-%S]Ñ/΂²¯¦wÖë˜Gú(g“¶ÀŒµGqPÆ€*b¿SKæ5àt/Ü>† ¢3¦ð9ýR ñ’B×Û’Îøt*q }ÿé.lùpª–à”ò™툒xZ‡N¹…ÉÂE Çê" Ѻ>ê9õ#JÍJ%Ð2hØÜV>•uÓËˈ" ›ør,"R®~D­eÛ㔿=UÃ`] S^sdí³+Ê „š 0.8šà¯8môÈøZò9tæo‚䱯ÅÄàä#”S¡Ñ‹5•vã%ÌT»šÊ´%*x?ð$}3‡ç5kâá:·o¤…Æ,WIÒ Îz_«5é’ÑR×BÉí%Rá`’%„ñ#¿Òb`p9LŠ€÷ÒÎÀ¯XJ-bÁïa´'‡ {ù¤‘Âð §kV¯áÊï)H#.žéÊà€~OSGilRˆƒ¬Ÿö•ô’JºŒÛ¬Ó€N. ÁÃ8„„Õx¹ Ë¿]¦UýÒuP‚ Á±úâ/Ƈ¿%è%nÚÉœ~ ¯ –âs,Îö1;=–cln˜ëƒ|κþ‰|MÛ½bËÙˆl¢"4É+°Ût>"ÛA¯Dä‹JDžÏ·‘ýùzÊÈp—êªÖâp‡¹+!¹¸™Æ ´IzØsm¬-‰ÕÒ8‰˜„¢¸Ýö»B@%Žiü‡ytØ×nNN[øþ–â\*rYcŠ±/–©&ÊŠ|«š 9 T‰™ ¡IÛ@GOä¦`Ø4æl–•}´߉ÏkÒ«v(Îéwáèv V0Á¶wÕÚ˜ªµ—Š‡‰„œ‚Ãá…àSÓòï˜Ñ~¢|û$Õ¼1Öž‡H o +Šyì¾ì¹cmE…“qÂÀŽ-× l-YbI‰³íh__ƒàTiÒRXGà&/lœ%PØ$~/‘'´Ói©ºH²ˆÁ|b6Îçðp#¼õ§—Ã|Ô Ž!WàJ•ì‹à-”rºMñE¦<óP 4.ARæúlr‡m;NYŽ á2Öß\ÀëÀ¥˜¹æµâ´Ù]’lÑwîNEÑÑSªèp©TG,×ÖÖðé8‚KÏÞd¿]ÂÅj”]†æuÖk4).»soÐywn½âÎ/N(î|>ߪ;÷çkŸQz%.×j^•†&ÍÄŸ³Œ2ö3XÄÝ¡óI.>=q]dè¿á¦Ñ¡ÃˬŒ@™êÀ@ðXv„¶Ô¸²¥³–TtN—˜=_ŸÆb¨Óž쯫¿® Jòeó½rHTÛ†Q6³EÓH܉OÀ+MüA>_C¶8ID-uùê“+GUk€î}ÃGnOâ¸úbyÀCÛäÜ™~U?‘±Ò¹™Qùôâ ’ûæòǶÏûJæ_?æ­›'™è‘g9Åšã 4ž”Ãk +ÀÌ–®ÜÀœnmäãƶãecÀµ¥üH‰ÅZNot&çâéXSƒïˇ1ÚCglçùT ê ¿ð‘ÎÚéçF”Øëé &+6Óng±Í,O]ÕûÜŠBw'|ƒ8¦fJ>Tg#vÍo`ãÔs÷¶lQ÷¯FLTËÙN`ƒÃ]ëëF†9çqð.‡ÑL21{JÃg'·nEB¬]µ•ˆ±Xë$’àçf-ë¾”ÞÑ;9ZO/:C‚| –wT ý[Î[)¨gF`'Èc?‚J¡c {ÿ´3MVLµR1¡}Ë(–¹3Z.Æ«jAÀ²v= *ÊÃB§·JëPƒ'õjŒU¶~1fcimÖ|_š[¡“p#áò¹  Σ<—6->ì3Ê+¸*CïØŒv¬–üÚ;å‘;!BÍå*] óåÖا›þÍÊý mBS1ÇLæ·OH#"1Š8 ¨MI›â¶0 _Á_› M®‹ÿXq€À‹6À¤ãÍ@©?üÒ%/z@Do¡6<¶èïV{Xpº±séŸð[˜$áë'vÝo@ Ez6­§[ X£l=ëjæÞÊÀêR¥oã8 ‹4þ*oeimîFó-˜í°°X¼g“×àÓ’ºÈ(¨N˜¦Êg´úò<½— ,KÁ@¬TC~Ín¶öH…Â"ŒÀµe¤aæë¬SHmFZ+Ö™*@¦±oô‘ Vè#yQ‹ô’DˆW`Ò’ºÈ¤ŠR…>ç<qí]‰\c>ÅÒ©º +óBê2óàÿŒJ&^Q™‘óe\‚œànz –-©‹,k€×qZ¬+E³ˆ(:-B€9×àŽ)]fPjXÛcnVñšûˆ¢T|éYR41øˆÑ„ '•Ci÷¸•S9—`ˆ*¯Â¥ºÌeŠaìï±Äë»øi1ù‹”eĈ!aœO5Þ¯ó\Lj3ÒZñ\ÒŠ4³óy)`RÀ¸(±ÜV°ÌUXµ¤.²ªâ"ŒAmT^øOˆ:½ +{Bê2{º€ÇÜçïÁÕó^Øß³PÏJÔD`žÀÄX¶¤.²Œž-7ݹB\ù°îX¢4ì< +©Ë<š„:Çò‰OE C÷²VæÉ#u&…Ôe& Hç33e’¯Yy…“Ó:³=ÒûN*Ͷ†>|ÇY.£ueÒ0D¡úÚã!µi­¸ +S@ÔÈí|g1÷çprç`QÅs1]qKê"ãZtâ1.™—Q7*|¹Äaà=PÀkp+¤.rk"€ŽZûÜÖCu´:bÿð ÿd¢z,éBòò÷û}u毭5[½ÿ³B~Õb»¿F74u±¾°D)ú³Cæ×¥•žókÿ`{Áð,à¦)endstream +endobj +6172 0 obj << +/Type /Page +/Contents 6173 0 R +/Resources 6171 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6152 0 R >> endobj -2954 0 obj << -/D [2947 0 R /XYZ 85.039 84.027 null] +6174 0 obj << +/D [6172 0 R /XYZ 85.039 781.388 null] >> endobj -2946 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F20 1617 0 R /F56 1642 0 R >> +6171 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2957 0 obj << -/Length 1800 +6177 0 obj << +/Length 4278 /Filter /FlateDecode >> stream -xÚÝX[oÓH~ϯȣ#aÇãßúK E»e‚X rãIcÕ±»‡’¿ç2vœÆÕÒÂ>ì -Ïíœ9×˜úðOL“Ðóe:áÉ$™.7z;/'ž€¿Ø‹„½ç‹Éü, -¦Â÷R?.Vtf‘t~yõì÷ÅéÛ™+¥tDèÍÜ8Nœ÷çgç§3á¼à_ß¼|sñŽÇÏOpëô‚çÎ/^¼™‰óÁ¸Xð÷Ù…¥nâH9ïßáùÅËÙçÅkÀÒ UJ‚›çÀ w&§‹®H<_¨Æ_“Ÿýiª¾žøžL“é-Œ}O¤ét3Q!r“v^NÞMþèÙðžš2Õˆµ\姞Ÿ¤0Pž’²·š G¬–mÛõÌ „ï;þk[4:Ÿ¹*€é¼,.çF/·MÑîæ7Ùæ‹i³åµgꙡctóµXê³3­Þ¸ÄèØÙrYo«–I~Î ó31Ôļ –SWF^Ätéb­A§8têv­š™+d~[ÒØàFäSád-Ÿ:çµ HqÃNñÉ -EÆí¶æoV–5Ê­]îîÛÍ ê/ÜÕ,HKøÇ2ÉìÅY…_E.вk{Ჶ¨+2§k5oNóÅc] (S'ˆAGš¥¬˜ãõu³ÉJž–8½¡ˆ¬¶ß!±­‘Œ W—û­O~è× “d–’‚3 ß•Xa ±)ˆ#0O „²„eÅÜ…Ó2M Â!ód,¤*0¤ gÕÞð óíÞý¡/sÔ,” zÞÝÐ0 zwh ¯Ï.;CÕ[Bô¸bc‘–žàRâìÐeõ–ù‘Þ®ì˜1† 0iLËóJq~xý=FX]i^Â`(’Î6>š‚¢6ØÄœ y­"/‘‘Mî¹n—óoE¥ÛÜËGR'X•=lÝzÌÀW¤CŽÌpYW«žç8êy -p…’ÂyËê¿¢LKC'ö@ÁÊl»0ë´ëìã>6n™õEViê¨q7CÚf»l‘oC´è2H5ŠøùG±³ÌL—@0Û»Çr^&oÁÊ]oáÖÚ0z@2˶óM^'cΙ·º„ш= Âû>ö»Š§ -‚ò¿Ýº˜.ãüE",ÿæp½»J„—B9­® m4£õ ªúŸ0:"Ò¶¹äÊGnØ‘¿ëŠ³Y¢D*X€bˆ8&3¯ ‡U,Ak4Â5oÜ`Õ7ˆÔ?ÐÑ»Y"1¦B?ÚÇ ÑeÉ£¬dàäÙ>ûqÆ·Ž.ö@ÓðÖš0ä+þ§ù—Ž‚À-Lj`=* ŒyAOØ’E§¤Œ%™€€;–{¬‡q^o2Ê ¸mkk‹%Éʦ0ËIqZ&«hÎF&^¯-—=wÕ+Xè´â¦d"­@ÁQnÅÒæ Ö””§ÇõàXëÍMºksSR§·†báŠ;Pkã‘$RžŒ:À0›ËûZ¥ž -»sWe}ɱEWÙ²H5§m~FÃk|/ê+ ôgHqS²!ïÖõFçE3ro{!,0¡g1<ž¨¾X)^à‡C…¾ðmÜ`—&}1ª«ñÐzpŸ…N9%á®(gdë¾h [´2C.}ˆ+Ôæ%Î%Õ€™%¶AtÁ}„ç)Ûp?›¬ªö8ÀÉ-ÇÄ!¢›¢ï®Ê¬aG‘L²Ë “mP|r&¯ØN¤Ä¦HA`þ¶wèaW^bâ¶MDŠÕ¶*¾õQ0óeUÀ#óËMfÌ&ëCrâáXSÕœÿ0@{ßâï -,àpýwxC}ƒ?;axÏ ÐIšš«å_7éÇF`êÆ~9¼çw\ÖíÇ~•˜×½º_7Åد›BŠ»‚B_ÅÝñ@À¿)sùtendstream -endobj -2956 0 obj << +xÚÍ[Ysã¸~÷¯ðÛRU‡ xnjf7“d¦’Í1ÞÊÃdªBK´Ä˜½$µÿûô¤(*ÉîCÊå" 4Ð8¾>Ðh©ÛþÔmûÎoÓLù:Ën7‡›àv5¿¿QB±’µCóÝýÍ›ß%Ñ­ +ü<Èoï‡~b?Šõíýö³÷ýÞýåþýßVk­µÆþj¦™÷—Uyïþĥ߽ûô~¥¼ßâWå}X­•÷ ^îÿF¯ßýxÿþ·LünfÞ÷xÿÃý‡ï±îvuOd†?¬¾Ü¼yoGnÇ£ÌqØ?Ý|þÜnaŠo_çÙí ¼¾‚êà ŒÛ#-ßõͧ›¿Ú®¸.ºåVs«ëÌ3}¾L*v–Ié¨âÛ4ü8ˆhê¢ëWë0˽摟ý¾ìpV%þ#ˆƒmùXœ`’u_ŠË7HSñ#óðaZœºë¶Ò]ÃO.ì 3ȯØôUsäòG(nZCÓtBÒ–ý©…*¡úy'^QŸpœXM½=î,ÇZájå4»¢-yûŽMÏ/4Š¯@ÿ\W›ª¯_¹xËãQ0]!§rëÏôw¿ÇþòT­øcƒË ódX"áÇ3”¥^CKZAÏ}õój ªŽøÑ—;bÞr7MË•°*ÊâîàÓ¬ W«®ìâ¥Bâ5OÂ×LyÄüÛÕ:Na »#-rùw~1M¯yú …!-Gs,åë¡ÀoSU™ââ[Źךœ=aË þך¨†™GI@k!“ÇF»²½ƒ +ØÍwÜîe_ù†ÏÝ”»JvÉà,Š3¯è¸_€ïh¿ g$tuО¥´¢òNf±Ê-×"zñYq ªMÑ e¿/z!1; l¾JéG~ýÞ–¤‡×ˆ+h?.½Ð ¬mK^éˤÓËzfŽ=¶z}¶ó @E]ã[ìLŠ»§êYèæë( +½G¦ëžê¤9öXP·«L{w\ÊC†‚Å¡:V]ß=¡z`i€+S¼íuóÌå?܉•Ð¾Y<ŸT×<ï+³+=¾ñîõ´CI(ÅyÁmQ{ÂÔD@è° >ÆŽtúHæ­V!Þ,­á …`ÕìÖ¥ÿ¢(Åièp¼X%‡è²(¢+¢´ÈPDiÊoV”\~à—Ί‘òS8+²•?*9£$è¿£4rÙ‹uØ÷B„kŒT]µ•·½Ú¥MÏ%d5‘¸lÁ1b­vÜq5¶ð>õ ©ß‘A`iâÑ<Ù#!"ij¬¶gÙʘúƒøÄ0vv©¨Úʽ=%ŒTø A)“ ¡°6Çˉ"?’+ˆ #D× ³ÄÐ@fÂo2¿æi1 +Œã™ÞÕ¬WY×ò:Ä"mŽ‘C¨gÏغ^ŽƒÉzWÇ'Ñ Ø3k°7Êh²ßXä(i¤íX ƒ‚&„ðh]€X›]!œOh°£(aH´|~êQí¼r9¢€ž‚|ŸŒ"Šb6/Æ[g*RýØ5’”=ÒØjþ°ª‡»0ôWdzwƒáðbár®\32:G:æcIÓn;tŠ^ãG®bK/ /¥ÐH&¨eèD>”Mý1f'WYn*©ËBÞhÝ4fð1]2%`r>ƒœ)̳ÌÏ5ˆCùá/Ò~˜ÎG‹Ö¦¯µÓÙL0(ý^ îÓßÿã_ŸÐ”©á| •^ð8‘r +\(šø~J:•|M ipÙ)hÉÇÜ +åp …ï1<ÑЩ÷CÓ—w¢'3? #7”Q=:~ù/¡D—JP&Zj›™.‚¡jß༷T6!³)Ó;^Æe ÏÝ4|µÑ‡y1™³Ó*jp9È“hË;£Å«ÁÕø¦yú†‹Çk'NG= Š]¾C+ÃF"ò(ÈdvŠÎ‚ÖŸGS¸Yç¢ñˆ@'±Z6Ñeãaˆ®E†b<¦üf‡ËoÛ炸$KþF$1Ñœç'þû‘óB| xs| H$h‹ fü€2±öØÞzqpÉÓcå žOŠ4›ÿ;ÿô5º¾¡hBBt BK „&üæ!äðãhB‡³ï9B;'å«Øàiì‚¢R9  +9…ý,yG[6ëXD'xãŒïÆ–I"`£n&N©ÓƆנˆäÎ ©í¥jWTGAÜQəL¡ôìÀeBظ ¨5aµ5€ØÏê{4²Ìs‰Ÿg2Ù\®l̕˘å«õ/(dŽ¶ä¸âÍ `D¶ì§ù‰‹!Õ‚(P ¬Eü¥†WFÓ4ÿÂÞ[÷Ê]_Wl¡ìÞzf"çö¾¥0fª©kZh˜ÑK÷í%yÖiê§êÊyÂ!º,φèŠãÏȳËqÂ^6ž!£Ôo£Ô…ɹEHÙ"€oü¹;m1ìwoÙD$ &/Ó©è8õƒ,qçò?ûŒ¦¯åIë:óѤ‹ÇÑq.ÍÓÙóÔÏ3ýëŒQúZc(?Œ“éÆ ÔÊbò¾`4·|koÃD…èP4>O —Ÿo9>ðå"ŠãÀOTzÅÑŠ…芗OùÍ¢ØágP<ÜX¢kÛ‹%¡ÑÉ L(ÀgzÊPqÊa>šÐ/‚2öµát¥ƒv.WîÀÇî='‹Ðj›"º¯@NYè‘ô{QC¨Á*'{ÊÎÍI1¡÷¶°éhÃP¨-TN”ˆšk¨³}édEe–ÌÔ…l¯Mm þ¾Dm%r‰Q +Ì<àü?'+é9ë8ÑFBbšÞ§¡°²˜.ŽÉ|Æ“|äÑQ™:ȽŸ1ü–½q¢iòxD÷eîö õGh>æ.‡†nNáØ9ʱÎð¾ÙÁ3?‹ôøîn¾ƒKÈ Õ€œ0àЂʧ©+8%!N9‰XÈû…Kˆë;Š¨ÐŵiÏ€ªz.àXeûÊý2ŒåÑU:ŒÒdkÍìõ@\W…ÅH( R4']Ë$Óè0ò8¡ßµ 3ôvmÁbüH!&¹(CŠGÊ}ª™Ì½¸àÉä”n8žõ™=ŽÃþØ'XÀýX5Mîšã¹v=8‚nf@So]~Çڛŧ!Øôw6”6ry‚ÄÏâìVe±Ÿœ¡Y;Dd_Ã`„ìÐ×*´=™©èï“Êõ3æ¼M¹§±€«´È]hθå*¿ì³Ë“(×QäǹšÉóÅäÕ‚6hm2i ŒoÃÙ‘íKlâ‰@¹}åz#ð¼‰@@Q7t-\<ÔÒ¤!Šcï_6¢…’šRc–-ë ‘Õ$0kW<˜mL®Sg$¤ê»ÒˆÂ#Þ´ªÀû€fäŽÁ¶%šF“¤£xHMúà—²lÏæAL^îôH>à<–èDìΛºzxÓ•›S[õ¯3V*Íü 7Iø N5pâø¥{=hBýMo®/ ¾rtn9ù>V&˜(?…³ì¹T¢jwy3Eü¨mäªg{ÂYfM‰?JÃáÚÒí…ö¥Rٷ܉±aCzXp9[ Œ•£Ó©}%| ²B5¤¿Óì÷²c>OøO|ºã4aô8êêÉþ Æ;!Pñ§ƒëå2³<1ÂCtü0¹â”Ó^sÙÙ¥=}åþm6 +šKE¶ÅQüÜ:ú½…¬µ> ù^ѽãô@9¼V[î¥hçØqøÆû”(žTÉï ¹rDÖ0N¹ˆ FT;ò3qH6LÇ®0y9œFhü9¾óYM} u.Z*˘\Õc¡+L³á§[þ~Àn_ù½àÇX™ßñï]ööÅ¢D\;þùÍËh«0%<5rÜ4'ù…EkóЕT‚?Þ™ÿbëÏ¡$|&Þv<“ž€³XR¦bç‚ŒBÎç=5ü|iéæ [ãEœÂ)S±0ÝCuƘ5;T=šµÆ:‚¡ÿ!Ç"‚:4«„H.ºà¹+°0¦²ðšÛAVsÍLÈÞaÒ×föòZ~¦?œtÂ?³üE?³¿˜‹´Ÿé Q¸8 ýP™±àÁžŽ×ü¨ìlÀÿ”Ö.eendstream +endobj +6176 0 obj << /Type /Page -/Contents 2957 0 R -/Resources 2955 0 R +/Contents 6177 0 R +/Resources 6175 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2930 0 R +/Parent 6152 0 R >> endobj -2958 0 obj << -/D [2956 0 R /XYZ 85.039 781.388 null] +6178 0 obj << +/D [6176 0 R /XYZ 85.039 781.388 null] >> endobj -2955 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F56 1642 0 R >> +6175 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F66 3242 0 R /F20 2865 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2961 0 obj << -/Length 1676 +6181 0 obj << +/Length 2259 /Filter /FlateDecode >> stream -xÚ½XmoÛ6þî_a4û 5-Šzý¶´M;«ÛÕ.º¡-E’a²äŠR3ï×ïŽGÙr,;^ëA,’GÞËs/<‰÷Møã}ßa¦úžÏ™ðý~´ì™ýP^õ¸Þÿs¹´g³Þè¥kõ¹É3èÏæjÏ,þd<ÿíòÝìêý`(„0¸ÃCÏó“ñËñÕ€/ˆðûÛWo'S?»š}DÒÕ„æÇ“o–o|Ô&3z^Nôiàö'ŽlãÃŽ'¯_f¯A!̱¥°yœÒ»šµ¬rŸ™ÜB3¾ö>}1û1˜úºg2øý;›ŒAÙ³ä&ô<ëM{lØÍîÓ©´†6/¢¡0™ïoQãNjãì±£º{R‰Æ™F€ÉSšŽiKÇ°'AJÜ:” ¡£—ŽÛâÎyÀ,ÇÑ2Â6…öןMî"“(Mò°ŒŠh£,ÅÕ›nJ"×0*Ój ¸±­Âå}H…É!ó ¤‚y®Ý (R±P0íÒÀt—*UoÒä@Bƒ,P¬Q¥òo8ƒ%È0}NžS£X¹M ;¥”y6$–€R9ÎP®@‰°Br‘ï'd¯öôý«Y‹6_É3¬(ŠÃˆŽ0HŸÓòæRIbI+è|Þ¨r¦OGè¼ Ã|‘à­eS-Ò4߸U¼c±@;Èo[‚ÀQ8d$§XÊð©ö„xƒ¶±$—«ñ‹b¦9kªŸp¸ÔÜ¢P“ ¼j(´ò…j`šQmŽ dk–¡>|§K=ÄÆÒ.±J2(ÄŒ0„õy‘ ;z4} ¨Ø„ÛÎKm›e6]o’´±ºUÖr‚Ë0NØ_ˆ¢ÆÃ#oM6TÅ2ý·CŒŠí%î`0Rg -tóœd´Á‡Ý¡ÖeEî.i¶VI¡ê‡Áxñ£;ËD‰kvWòé ®ªÞÂÙ†å¹pïhHp¢RÛCwR/í ƒ ­þ% -ëfÆÜrÓé+›:â9›ŽSjt‚½©v2N²&òÃí5L”ãÆË5ÉBÛ±yßdr»Š/(0é’-¤ÚJÜ`¥Â•ªhjØ4­Œj¨h'2¼­pûoš`Òà¢C«‹4NrìzàɯŸMǼ€¾ÍvKÜ׶ÁÈ FØ -8–cLߌŸ´Ù:‡%ÑçÅj]¦‹ÛŠ¦(0B4…âëbžjöuNƒ7iT!À'5mœGì°œË,£Á{&õ8‘Iù Q×¹ƒ¼Þ]¾¡"’Bí…ºKE÷d³/áõ€N#:ªÖ–a.’%âš:Ô’¯è}ÙlÛiEÕ²„ž ú1ljÓJu`×PeZ÷m7_dÖÉݾÏö—ñôRñVí•,˜öaU®¯çi)«ë¦•8¯¸8 ³kÎ<3”˜xð#&‘r=OÂH¸2Š&iyæMaä_gÂHÌŒÈl ózqvñnL„çÆ^g þ, ȹçÐ>ЧѡQ”½ÝD I¬x rGg®+c(\«æ'%£ä«ue±ú(%ôˆˆWljMŒ¾‘Ým((ù”¦¶h@pˆUB…nHµËÌØLð t„ ñç”8¬É¢˜âð-7šv¸`|C~Ñ~P†Ðcƒ”îÛN—<©¨ÎþÜ ÷qÆVbp%c‘OF³»·qšñ”$“óxÕÄ@ùþ‹å“J> +7ÆÅ¡P¾+…? B¶3Ô¾ ËÁ¿™Ržƒe#¥:üйݷh$"4Á|î¼AÀHh’Î\]µ§ð†swª—?ÉŒ”v±ŠÜÀc .èxÞª.Šjg}ÚŸG¶¨Ã&&*Ô°)ö:³cJRº¡ž»Ð]zE‹›]À¹äc´pžÂȧÖ&†Ø­ieì/4ú«ïðÜÓƒ" ß×IFžBÔèG‡E:p`½ÁàÎÑÚð>w–äíÚT‚$²í ׺,mÐCS3cŠxBe±Ätµ$ꀎž@wŸ<’¥ñsìMÌÊyÇ3ÚÎÔ•¦¿Lzö…Q0KFA–yåüL†¸ + MžŸ*v¶Û”öÅÞ®`ÁCikHÓÏŠŸLB €†¦s¤î!¹ 4Rj“Ü10_nø¦ðiàÜS»c'¥" ã|I+™œå-Ø[gvÈ ÚiMjs~¿õA]@U?¥Ým7¬×í‘ëéæK“Q1í‰tÕ#ÞïÇÀ6Ƀß?fð]Wøð¡ªðÇ—>ér>zå›Y]³2 +ûD0“‚A+DÀvÙ/ÇÁ@úm0ž¤N¤æ/_Æ2=yQ\CÁZò +¤Ð †›xìcb·_˜1ë©Ä¬ þ—Ü3ðG Ë'pËhîF?àü̱-{Ü*pØCï§W7WfÂõFÂò'¾œËbã¿+`€®r"~ +5ºQå…½[a‚ÅFgç}!î4÷#{Ï[nä’KI¸F o’TâU²Õé¶Ñ]·7Þð?M®j‚õlªîœÀÑŒ*È€ ¶›ñ¥gƒ±ðà{e’¹õ¶'dŒzÇí2S/`IÓz[uF©msÊXV£Þ./õ qŽÝÔMkØÿýDú¡-—ô=ä¢0õƢ˗\MoãkÇuÏÈ—W¨†z , "  +­>ØVÝÆÆš!„¼Ì»vœˆùÓÍ2,Íž™Õ¬ë¶kGÚ®1kžÈËpÍŠÇ| þxáÿëÛøSM"ÝHÆ㎪ ˜ò…Å‚•þÓØoèG€ÿ š§endstream +endobj +6180 0 obj << /Type /Page -/Contents 2961 0 R -/Resources 2959 0 R +/Contents 6181 0 R +/Resources 6179 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2930 0 R +/Parent 6186 0 R >> endobj -2962 0 obj << -/D [2960 0 R /XYZ 85.039 781.388 null] +6182 0 obj << +/D [6180 0 R /XYZ 85.039 781.388 null] >> endobj -2963 0 obj << -/D [2960 0 R /XYZ 85.039 679.517 null] +2254 0 obj << +/D [6180 0 R /XYZ 85.039 490.22 null] >> endobj -2964 0 obj << -/D [2960 0 R /XYZ 85.039 679.517 null] +6183 0 obj << +/D [6180 0 R /XYZ 85.039 469.63 null] >> endobj -2959 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R /F20 1617 0 R /F35 1632 0 R >> +2258 0 obj << +/D [6180 0 R /XYZ 85.039 400.068 null] +>> endobj +6184 0 obj << +/D [6180 0 R /XYZ 85.039 379.777 null] +>> endobj +2262 0 obj << +/D [6180 0 R /XYZ 85.039 149.846 null] +>> endobj +6185 0 obj << +/D [6180 0 R /XYZ 85.039 127.13 null] +>> endobj +6179 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F14 2895 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2967 0 obj << -/Length 2390 +6189 0 obj << +/Length 2296 /Filter /FlateDecode >> stream -xÚÍYYoÛH~÷¯°û@ÍûØ7Ç9Ö3‰â4ëfAK¤$"<qôï·®&%‹¶ƒÙÉbÄì®nVUW}u4eO,øgO"ß´ÜxF¶éFÑd]\X“-¬¼½°eüÍÀöpíåòâòMàLlËŒ­x²ÜОeò«qýÏ«Ûåëә뺆í›ÓYFÆ/ó›77¯§¶ñŠÞ}xûa¾àñË×Ë;\z=çùÝÍüÕ‡©w²a¾äçÕ\ÞnÿÁ‘gü²€oæo§¿/f¶kú^LŠ›—À W.^/N1³#Ó²<Æ—‹_·& õ§ ËtãhrcË´ãxR\x>rsež_,.þÕ³á5oÂoXkæY±iEñdæZf Vsý«ýmäU»KëéÌw|£I›&«JžÔé—.«Ód:³-ß2.»¦¾Ì³Õe“®»:k—¿Y\]îUñ©+³ofS™ö÷‰¾ˆÿ­jšûªNxV¨RmÓ"-Ûç˜hšèmû¡oìOx5Ýf“­3ä5s œëŽjßgå*+Ðüi«œ2Ìârþ.«$퉩U×îþ îþãÖb†‹n¿¯ê–'›JøsZ¯ÒºjxöoP -L˜­UÛ+ú ¡+×UAŽ"R[ñ³kÒSn°×þ^_ÖyµÍJAÚ`j¢Uþ<?×+ŸÍÁJÕ‡O›¬nÚOè¼1‰Z ¢ç‡ -Ÿ$­H<õ÷<áq|ü_žq½®:‘Aè3¨d>w Ëþ$:ÿ|ö§åðÄ#—oìã¬? L't¡2x¦¹¤Æ Ô³B,‡zñn• $˜wÜ(6AÀòe; ÃÉÌ ¡¸ÑóÅÍ%ÆJ›¬ôË+X¿Y¶Wk]Û‡Úرé»Â㇪A&›äpÛHÅj›}J¶êNÈPX°¯X ê ü5{SƒqO8´bÿmÚò ÎÐ<®6â|¡¬ç^ÞÀf¶ƒÍTtZYª6¬r½ËíW¨ÁFmÃdÊþØå Q‘‚ÍýÔ -÷'I2ÄG™lNzÜOgžãA¹¢÷Z…5Ås\》UWó2vMª@¦h ÅD&¡½/¢¬«RLbëVNH+í®¦ólw<ö@ -µßç}‘"¾;ÕžngkEŒ‚`[bHà{`Ã'dÌÁ†ª0aó}ù„ÒŽéÚ0ð#Óƒ>n¤KsBŽDhT#Ø©±æÀšgº^pŒ5Ø@; :ï EÖÂáЇ%ûL¾0·žì€ß}äwÛØX‘ÐN`ì8Vü lw#„³ßL˜Ë6¼ ñ—æPó–½CaìÂH+ycÖdÈwä|TiyOæ)#4µ¾¢ô´ærÙç8" §¢}µ×â´môóãs)Z ñ½Æ:¿k;ÑWj ZT#á#÷J¿Î˜wìÀtï(ùxöx ²õMÏ÷Æ]ŽKþs íÌמod ?éøtÎ:%g·ùWȇz¢Øp>#ËxŽvñ²e“òà'Eäûí’"cQ!LTÍ‚Îs¢ÌÍGº{¡Pô!z›£ ÜžwWÍëCZÐÙC "×îúâ:˜g”âzÔÙœ‚áYé€0[Æ€Æ(Òi‰äú”šÄH .pL¶LëV‘êd:x[´ wšl•§ïžgo¦‘‡–;GiÓ­טa [„5¦s/"lÃÓB‰} …Rôä¶.J¤7öHþ‚ Ïê”™‘óppÍhKŠwÄÑŽúôû P%£Å§ü¦uìçÅ|™Àg£!¸ÆÄG^sUÈh18Î6¾fë#ò}Ÿƒz4ß"r»í¶‡0¯º ™N }2>?ÎûŠ´MºÞÖä —FãÜ…–»l*[lŠ>ܺb«Iê‹!¬Ð»•¸ -_YsU/¨ðÁ%,æ‹…ô1a|‹ØºzÏ“-ãqhÇ&Ǽ§€ÿöáN˜ÔÜTuc>V“à˜fàF­Ü·¤”új¿§mÛ0«WHÙ Ç­Åüuæo^ÉnN‘¶ -Œ¨w“ÕLžeÕ2SòõÙ"^åÛ -üÕx†VÎùõ,ÁqÏøТå¤RÄyAHÍnàP ¯C:Ã¥¬ä•{”˜õጴ’¬A¼“ÊU·n4O~n¹+Û YQ¾%šTô"y+jXG0vÞà vdÜà÷ß¿ nžô Íñ]#A &j»\^@Oà³–°yXÒy“4òa_Pïȹ©a:€I>0×àGJ&+g\FΚmλIì9u¹t©ý¥ £²RØÈ’¸ á¢ZHŸKê°¼îSCÝQ“O§†Ö1t£Ÿ¤œlé>ÀF%Go`Ã9þZÁ{}Ö#RQµâÁÂ0î³>Fh +Â<èRÄIQQ¶M:íx7a §¿È_}HáŒû'J0Säü$¡ÛV J•æ -¯õ¢ºýy6–y¥K†^=æ€ÇA^m5­Í -‚¯=”릭³õÐ[;¾%0Ž -ÅH“£0êkLZò”{×–¥Ð½w›úº× ÀDˆÏãôðbä<äLãW?Ñ ÃSÉ…‹R‰`¾ÒØ—ØÀâüêšÇí”ïÐ0L%ÖÄèÀ¾jhªÌ(~þFæ<{# åFv]•ë¼kðdÜü±›˜óÊñ¢ÇpŒKÍAÌX¼À¯ÜÒAbÆV×ñB¶!î¤/³èQÊnÇ+ÐA‘y¶Hë¯}—£i÷6N‘±)·X¢Ž»%d|ÕQ§–c¸¾ »Ð³ô-’¼Âv=vò¸…«r]ÑßLá)ÝÈ1ÞsÕ’.¯âO*ƒ–×?"V®y¼VyÞðn°˜ítA@"Z¶”<ÝÉK„C˜ïû\ù¥'éXÜ2˜‹œÓ+ÖD¸Ëp‰kÓm­¿LxÒ/ÃâSGÁõ‡ý‡Nðõ¤ÿš#=QÔj T²¢øÁÕ GCÏmž7ܹxçî{ð¼eÇpHß\lúÛ…lè ¨c·Ö•*+´¾ A%ÜÙfCE3õ!몮Ԕ!wêRJnØ„ ?Šì¼‘cžûˆ±µãóŒn)ÚùT7??^C¸¿;Î#?U²Œÿí7>74íá+Þ“™Ávݳ GµX+ø_ÏÂhendstream -endobj -2966 0 obj << +xÚÍY[oÛÆ~÷¯P¥Ã÷ÆË£Ó:mŠ“ž´VžÚ¢¥ÄµE„U’²ìff—)QŠs|PA å^¾ùffÍgüã³X³@&³(æLÆñlU^³ùþŠ»¾›âæ¼Y\Í߆jÆ–ÉlqÀÑLi9[d¿zßþpóaqû˵/¥ô„f×~ÅÞ‡ëXy7ïmï››»Ûkî}‡_ +~¸÷îÚçÞ4¿PóÍÇÅíwvò͵ˆ½‹nZ¼ûÇnjAÓþ+~ºþ}ñãÕí¢—¼— ¤LPì¿®~ý=˜epį&“x¶‡vÀ8 —W 7ÓJºïâêîêçÊŽ©™]5¥%-c¦cyª&©jâ\0ÉÅ,ÒÓ"=mÓòU®>ù’5'Ðõ>ÔÕnK]J¶«È›ö>/ öÂqaoŸ£hIµ©Šê!ßX$iꬫª­>QŸ ]_›ÅóyœÌlžíîÄÉ›fgÆâ”i^Aèakê2oiànAcV»Ú´íó¸»ÍË GÊò´pŠèWiÓÂAÇ–ŸÖUi²¼>µÝgËñ¢fmŠ¢ëf·ÉŸÎc˜Íãxz‘¥îž"a{ʪÍÎÔi–ïš#Í”ËmÚ4cÙPŽ?ÒÕª=«äýÚ˜Â"…BíÚõxêÆ-ö$Û5¦v +êîÓz3>A5¦iòjã°æoùÈÐmË— âˆàk<òî«ܵ¨ÐŸ÷è½9|nì yJËmÑϬ±zm·–lÛömkXV=Ôii‡j³-Ò•ið+†0jl{Í7r Õý•Dù¨Oæ*å8¥óŠŠ&d4ÓIÌT¤>Ï,’)NòŠßaù°SÚP±`! v“H04dºE_F°g(F—9}+ÀÎw'+ñŽc/Cí Âe˜x{ÔZ¾º‘·Æž¡î;¥S,¶›ç¦58XÚÉh]ø¹Ç«­êÌöf° mÓeÚ¸e¿ÁM(^¨ˆI:ñæ¦]Í­¹Nœ$”nÚ¿&€"¸?>„iÖiVí¿Æ—‰fIôJxDÌp:b"Nɯ} ªÜç 4juÊÓ ŸNÿг+¦ /[GçíP@€K8l +' +_e†Ê`Z¡ˆ&UØoHfv`­)í²@tޯѮbÏibdW¨Ž¡jîà°ð³LíÜ¡‘Á ´ªpá^iå­ª ~µ)°m¤´öZh‘À„÷ùª®šê¾uŸ˜†(Û&‹Æe+l Ë¥B­zR’þ÷ìÕòH2†RÎ(ªK•`>ýº;uPþkâN!Ä P„›sùNï ÑÈ‘Æ®Œ,cðýèIi“ »€tŽ‹J†-ÇZCÁÉ…D)Ï¥ï> endobj -2968 0 obj << -/D [2966 0 R /XYZ 85.039 781.388 null] ->> endobj -790 0 obj << -/D [2966 0 R /XYZ 85.039 413.993 null] ->> endobj -2969 0 obj << -/D [2966 0 R /XYZ 85.039 387.379 null] ->> endobj -794 0 obj << -/D [2966 0 R /XYZ 85.039 144.576 null] +/Parent 6186 0 R >> endobj -2970 0 obj << -/D [2966 0 R /XYZ 85.039 117.961 null] +6190 0 obj << +/D [6188 0 R /XYZ 85.039 781.388 null] >> endobj -2965 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F20 1617 0 R /F41 2104 0 R >> +6187 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2974 0 obj << -/Length 2952 -/Filter /FlateDecode ->> -stream -xÚ­]oã¸ñ=¿Âo•³"RÔWßöÒÛbÝ\z °-îîA±dGˆd¥lþýÍ%Ù–½‹¶X &9Cr8ß3ZµàŸZ¤‘„Ù"I•¦ébÝ\‹-@þ~¥ÃD¡ãàÊAW±ö“ÌáèÄ×I¸XiãgaüøpuýQ øq.6„ùPüæ©Ø_®¢(ð>¯ùn]ËU'Þmi—aà½áŸv*¯{fÀç¥òò]¾[®”·-˜•4¶Ë?~¾úéa$ÔQaü@]$3Ô@¦ÈTÑB°’MÉ|xªúåÊ(ãõx[¹¶U»ã…ÜÚ²y±¶-ÿð«So½oJÜ°[ê h$Ð AÊ®zêŸÊ.¯y½êû}IÇDž}ÂwòÃø–ŸÊÀvƒ¿¡·íèì\P*Àhp/H¼¶³À&å­‰`d¼e¥@z= ) Màí€Õ€þ¶¢Zb3,æ…;¬Â3ªÞv¹m»ž¡o@ -éÅ{á2økà -dBÈ°EŒWüS2˜îNq?Ò (ϼ.U^ßî»ñ Ë×<#Aô¼¶nùrÄmëpQ# “G›Œ^ï-â4Ì8<2 Û40Þ~©DÀCFá½V]»s¯)ùº‰Ø\ÈQ-ÿòÏî­p6‰”ÎC¦ÈùuÅìè'w«ÖÖå„‚¼¯ÊÎ?¯â‘GÙ%W‘Ÿ*=5EeüÐÄG¦¨ÐMæÝ´»ße¶À|¡w·eû»Ï›Ç\†O9YfÉÓˆºFa±ä˜•¹AŽï,®vmMëç^¢ý$½ø­ü<Èw«ÎB¯'RÄXu¦½¢Ìk½U ±&“Òeˆ¿¤g$tfÆ’‹ `n@Và”-•†n}ÊÞ±²Ò±NYDTÇ`ÒÞŠðmE,ëý þñ¸š Â‰:mÐUìk´¼$`õ©CLæ‚$ÚÛ‰é&j¸ßV£z Çð<§¶¸6ÎFËÖR# äÈï׳¯9>¸òˆ]§­,Ž/ À¢ãÇÁ#3œ'LƒåI+(îyø)Ù,eðt=/ß>˜k_¯ÿu'ç Ï¢à5&ŒE—ÎÝ‘ÅÉàÔ€‹ï¼BЛ°ʉf牄áÎ(e¿uÕT–‡7Ê„Œ*º“{ÏÈŸXŒòÑ÷I¶‚xþØ‹§›øZXÇHƒ¸ý‹{3À+´†5#Œü²¢>¢eCŸJµ(79ZRm9˜‰ð,Å™-®Å^å¢`Ëó¼®á¹øX2hKGŽ¡‘·çwtxñõÇxêtþ-NÅGüôZvïí®dÄ7bR?Ê´à}\¦j9þfjº¸ð{Uù×å*]\|w–+?‰xróD!d+‘"ßI0ùµÌ ¸A± -§?HÈÕ)²»ZŠ㪚’G÷Kv è-¥ˆ+ÙI)Ø·¿èÇ“@]‰‹ÁeÙhy#y®4õ6mÇëkøˆ}çâN "‹ÒŽ¬áuñSNˆ[3& ÇT‹ŸÈ.gè6ê ™ozúzĘ¼§Ʀi‰Ó.¬ó—|]QŽò. 1B§¹¶uVXp˜­ ¶¦7BV°©È½3l8qKˆ¥=$&Ðô–=žž&BkŠŽ5ï'‡NÑZ¬‡œ‘©&ÅÁË{gö€än%¿¹íy±’_wÒ˜+ñ¼„xJiâPfËcp³<¸/;fr7ã>“ä[1_Rÿ¶sé™ ¶ñ…”£àp-Y:qÆüŒ^ÿ†W1$¹nˆÕÍ Òl§WH9•Ä˜Ö5·iÔO%îBtå Þ)Kõy’¤Ù$º°]/=´‹ƒÄ`”Ír@,R†‹QŠåÕrôÜ%ÔQäØ©c ÁšT‰gÂî4ƒ”ÐO&Œa䛌2Æÿ\ýöG°( %ûù*ðÃ,]¼Á8ðU–-š«Ð‡0)³úêþêŸãYI¸Š¤\-œËժݦõmñ8ç‡1guþše² -³ÈÏÀ‰O¥ò@± ˆ½Zj®\Š³@J%‘ -QX ò«–=Œƒ™ [ÛsfŽ ýû ^’BÃËoÅ ù×$6J!0 ÞÅe–t¨ø¢\#+ªÖ¢£Uí.(©:µzp™ä\ -ùäpi0LO'ñ/=¯Y<ê‘q™=¨äwOO+»µÒ&ñ³ÐÌë}ß]×-(áuµÂõkÞÍWAýÁM–î*ÖÚû´a -ÄàO¯‚rBûÆEO©c‹Çbß¼Ì)öcG•}U=ørbÌ@“ -5età—D„[·CÙZ¡5ž+ôpLfØ[¶5Zie«¨RÇ3Ò¢wç+-:D'±ã‘Ó<¾6—ÕòkÞTœž@}G™ªÀÔ%q$ß&…8'b€@YùÑj\tF€€Gb -d1Æä')4jò•0z—€ÎøŒ•2L=Z@én ùŸµÜ¼Ï ÈåúŽB¹ TÚ™²8Œ}#a‰¦ñźXù©>hQÁJ†šu\+OI§ÊÕ½.öűw‡}ª²kˆ¿ýXî +Š¹Ò¯"Ù %p¨ÍEšSBò™ -Ý›Ñc­‚:.©i -‡SJáh]T -·ÙœþÌò›°ŠÆPç–}IÃkEyìþrDWIœBj+×õîè#Òz×äº@ÚÔ9ŸºCŽÚ¯åP»F¼õÈ癜Bl‰.r™/˜jÆ ›GÍpHO -êW¾¹îhÇ-Ž) }ø‚ÐvP gÔKžú¤±|9×Ñ›™ òiü=Új®¯°óVótðD €$K"†Z²š;›ˆu÷MÖÊ£xá·²xL,\ÏÆé*Cify2:£F.›h‘¿_i jôAÉÈ rݺF*R¦B "-\¸#µ™$G•ñgEdóGÖ>)æ|¿²“2pÈäB \T_êxLÛånéâ,Ý2tcçcJ¾èvh¤ê‰éà„ª|(°ŠÅèÜ „¼ÀÐ¥Ä:{§/:hg=lfI³S¼ú;}D™@õs,5£´P bñ‘šo$ùF§ß›ÊéK©/À…»‹9Zú¿æh¿ õ'‘ûŒÃƒÄµ’È%ô-ès®såÙsəħ-§$>j9Á¦zດV(qö…kî WBíV÷ ˆæC“ ÑäÃÌ©nì{×ÞÛåÃçšu6<Ãük¿Ï©¯þΛN>â†J†öW#iËA¼Ai‚©7OØ>˜V>ø纔«(ÏI¨ÆF#¬!‡¡JŽíQ“{ûÄQæœ&@ªø««S…•Pø±á›Á=4ÇwèÐ@zôŸ4ÜïŸr‘#©endstream -endobj -2973 0 obj << +6193 0 obj << +/Length 3626 +/Filter /FlateDecode +>> +stream +xÚ¥ZI“Ûƾϯà-d•h4–¤|Ðf[®Xq4Tù`»RMÃAÎhòëó¶n\&®¨TôÞ¯ßúõk†‹þ…‹LûÊiú*ËÛýM°ØAÏ7¡Œðdˆ7óz}óòû$^„Ÿùb}7®£ýX«ÅºømùæÇW¿¬ß}\yJ©e¤ý•—¦Ùò—U/_ýÌ­¯_ݾ[…Ë·X‹á.߯¼py …õG*¾þ´~÷–¿ZEÙòÓúÇwÖïß`ß+\jMÃþ3>¬þXÿtóní(w4•9’ýåæ·?‚EGüé&ðUž-¡ø!tïo€n_ÇJêõÍíÍ?ÝRÜ/xÖ%.i•ù:SçlRz¦0Œ|F‹T¾bâ“ÙnÛc3¬¼( ‚eW~9V]Y@5‰ôò`öÿ:<¿oWž†s,ª‹M[”µyÂc ^ˆ$æ´d_ö}Õ6rÉëëLß?¶Ì uª/-Ôï78èl-ª@ç¶mî¾{YÛ—½ÙoŒ_¼„F[O¥eY“¤™¯ÒøËKéÜ×yrQ^pŒ(Èü8RWסY¬Ã%;|¾Žg©òâ$÷s:±¦P -šÅšúI´'Ú"ë‡tr@å,ÏÊõÎü$¡5_¡Äy®x̤LF /ßïÃÅÛ(]̈åu½ÉÂDl˜MuP'~§‹$ü(ɈX°J4°p †ƒU™ºnÑÜ{¬ƒ$é l±ð +U³ã±íÌ9÷+<- hìÙ+;ÅL[P5qÊžØCý8Õ4U¿ï±Î"ËÓåûÇUB.RÓ€ö’¶‚^¦Ë–úûjS—8 vmù‹zÊ¥ª¹£Óu{3TLK°l7ƒ©{€‚G>VÃ=ÜpµmdMæ×Ï\ÙðZqDêÊ „ ÷]‹»{˜%L~…_1ívþ:pçɪÔV5v¢48oŠ•~0ÛÏèf£:x3¾g5¤Q]yWvŽŽ ±Zh…qJ+àrIØYNÍ@B$Ž)-…‰\yÂr{”Ú¥I½Cµ=Öf2°be*÷¼Oµ?ÔåžµæÊç-Jj‚JB8ÑŽ7(¬Zb+ +ýNÁjVý„ñ–;œ^ðϦª«¡*eMTjüN ë(^½b¾ª$Îþ` öãG©Bxì§Ñ³÷½8ÎüL)gÍQ0C¼Œ‹c{)¶f¸ãE>°DwÒ ë=òIÀ>¨ +Ê,øî•7„­gÛ;ö¯—ïp±²ÃçÉuCò^ºvÅaЗˆ]ƒØɲ¥‹ä¤zD\{H’:Û!ƒÜ£ +ÇJGÔõˆOm®ýD§v{:¶w;ðqr;ØGŸèdEHÃù Úqð­˜]2Ïbj†„+•a>%˜Ùæs ³‘ÐáØD„Œ) áNÈB’"ß3aÖÖ8A­=KpD|$ * ÀóaÀŽö&Ã/¸Û“5ñøe³íž"t „Ì—Ùýˆl#>ƒïøOïžE†p{ècFöIh°cž'öt% !¦æÂn®€*›¡õ®äCpr ï$®Š4# ¦4`Œ&W†c=>t²DÑC³¯&ð¸’Bê¤ÅÊ‹î'až"•^v¬Î2»™™kp’» R×r²åxØs¼j¨·,ÊÂbS‰räJ9(ä0ÍÖË; x?Cïkˆ9^Ö‹‚â;‘w8™àÿ,8 +Áoû+_M[ñpr;íF#8b÷p¨„†|'§l¯€Á(Œ>'c®ƒ×¬'Íæà5ðúœhÏàä˜,ß¼ÿþ–ë+Ê 0åx3BÅcO¾A à›MÕ…߯$gyé< ܈“çã†\·Qœàç[!Å_€4ía ŽÙ çÇBÎÃq†‰\/{“9(•B–jøël¦:rÂÄ—ãÈ;þŽa«“-¶‚¬Wµ,l7¤ÛÒ¦¾³©Ç](èÐÎåy¾òPÓ±îZw+“Àñ©©¾r¸àd̼ÌU³@AeŒbd2óÓdr k\=ʉ$ºãÐE&\:ˆÔ>½‹°J–MÇìÉ †Úß]×ú;w U1÷#+IhRæ ËiÇð6õ¹€7âœ(O$ÇÇ2æÓQ–I +ÂòÐæq~Å{•;{6>Ppuš‚ãhØ‘áÛ>Š{œ‹ÆŠéd|»Aú Üî n˜âþ“ˆnC5⟸+Å0`‹ì³ã«Õ[Ì©ïžk¦¿”-S‰ŽG`0½V‘W,. æ$òsº´sôâÜR–QJkJò'Æ–ÄÐF#EyHÒEŸ*]”VÊÊÐçWºÍcÖAК¿¢{ 7;™FüÄ-z'Ã]ã[ãÂ]Y UyF5Ò„šÓ‘z±ºb÷#],÷pTÕËÏÀ©®¾Åœ4Þó(ãŸØ'ˆÂíÞP¬‚ÆGr ØêLP£÷tcxFˆÿÀ­øµ€]gÏf( ´ü00hSµ¤–³|Þp¾1p½°¾ìÑá ¹«A)(Ný70ÁŒÎÀÚMË53ÎeÇmÓÓ“UX=ð*¦5O0cY`!¹õ L0ÝÝFSh%Œ§CAï¸ßÉæ—ò^r7ŠÄ1¾°‹)~ŠÃ6~ ScNÚB¹êd=žMQÈôÿoäÜFfŒN)–Feï›jbÚ'Á ξ^A)”-ͳ³5±„kæ£ÊHk·X¶âµ]”?Ê)µÒÖ£†ÉBw<ôÐXþÌ탺ÎÕéÊž¼fULö¾f‰”rFÆl­] ÆÖνB³ÄÔ6“t…Йââ³"(ÍÚ +×௳–ü 6R¦Ui»®×¹T6·m%_çOxK$­—î“„J³¿¸x×8€o«p¢<0s\õƒK/ßÂÁ?˜0:˜ø×ûXÕò¤K—dÀ´E®Ëd +ßðí9 MÐaÒlø³­«1‡¤Ô׆_7ïÌ‘Õz‘¦œ|§Îk¥DáRÒ©Ô( ßóyÑNÃœóq¸‘gJŸ›ñIݱuX¡èÐËœN&÷CË?‘w®ˆÞ¹èS˜²[öZ|.<”|=ú +!EéRvÒ<ɳхŸëñuš#?¿ö vv¬Í±S®âÕ”KM©‰DñV"/Ð3ô‚åŠ#aæE‘n „5)~¾!3@$&Èci Yxˆê?rÃÀ®;²O,¹÷e\‘3Ü,ZQªÂ”ª1ƒý]ãäà ÊQQŽ)Ùë¾i—þÕßöÚË yn¥ O½i ÷™D6£·!ù!‘Üÿf…:¾üÔ;¿üø±¶O½/x€N¦xÍWî)³ÍÙèFv)øîŃoO`[Â0*e“—9,n¬ìÝÀIÂ¥ØpÓ)Fm +Ú@±³;Ò=ج„&ãV5îeB‹óGØ5}·æId/ØÅ—~¶=ïÊ•S~”_ºqÂæø7ý\nò(ãg*¿|oÕQäG¡¥™®¢ô”^û³º3‚ÿ ŠÔqendstream +endobj +6192 0 obj << /Type /Page -/Contents 2974 0 R -/Resources 2972 0 R +/Contents 6193 0 R +/Resources 6191 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2971 0 R +/Parent 6186 0 R +/Annots [ 6196 0 R 6197 0 R ] >> endobj -2975 0 obj << -/D [2973 0 R /XYZ 85.039 781.388 null] +6196 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [294.66 415.822 400.604 427.512] +/Subtype/Link/A<> >> endobj -798 0 obj << -/D [2973 0 R /XYZ 85.039 761.463 null] +6197 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [366.309 334.527 485.694 346.217] +/Subtype/Link/A<> >> endobj -2976 0 obj << -/D [2973 0 R /XYZ 85.039 667.044 null] +6194 0 obj << +/D [6192 0 R /XYZ 85.039 781.388 null] >> endobj -802 0 obj << -/D [2973 0 R /XYZ 85.039 611.854 null] +2266 0 obj << +/D [6192 0 R /XYZ 85.039 448.833 null] >> endobj -2977 0 obj << -/D [2973 0 R /XYZ 85.039 582.45 null] +6195 0 obj << +/D [6192 0 R /XYZ 85.039 430.164 null] >> endobj -806 0 obj << -/D [2973 0 R /XYZ 85.039 364.615 null] +2270 0 obj << +/D [6192 0 R /XYZ 85.039 279.611 null] >> endobj -2978 0 obj << -/D [2973 0 R /XYZ 85.039 343.418 null] +6198 0 obj << +/D [6192 0 R /XYZ 85.039 258.414 null] >> endobj -810 0 obj << -/D [2973 0 R /XYZ 85.039 303.379 null] +6191 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -2979 0 obj << -/D [2973 0 R /XYZ 85.039 280.058 null] +6201 0 obj << +/Length 3747 +/Filter /FlateDecode +>> +stream +xÚÍ[Ksã6¾ûW¨ö*1$ð‘Ô<™ÙÍdw’ÙXSÙª$Z¢%–%R!¥qœÃþöíRâÃS6S®2A<šFwãëäÏ<øóg±r=‘Ì¢ØwEÏVû+o¶–^ùºÇBwY´ú¼Z^}ýPÎ|ÏM¼d¶¼kè(W*1[®u¾ûþúýòÍÏó… ”;_DQ켟ÇÒ¹~ǵ¯®oÞÌ}ç5¾IxøÎÛùÂwn °ü™Š¯>,ß¼æÎ×ó v>,¿óãòíwØv¤–Ôí'ñãü÷åWo––sËp™ Û\ýú»7[øò\‘ij({®Íû+àÛURè÷ÝÕÍÕ,)n“3Õ'%%bWÅ¢+&_µÄäû+ü`)ÏUž$9íòz»Ï +œÝfùNyÇÏ”+ÝX¥»Ìó‘k÷i‘n²õWð{Î:¯U­·'øwÌP(kìè9§šÞ*¨ÿúÖX®`Y­™ÔšÒcz›bOÀ‡ïlSÍÍ*-4;»ºDÄ>Ê#!þoç‹ r2üš­ñMAS ¿XFæ© Hðå7OyÙæ›ùBúÊùwNÅü ¾8òÄpZ鯠GUnpJéž&ÄõÀ©ývzÀ^»|•ó²¨Aýd œå…dºWØÏv ºSdˆØÙâ±×Gü—qå!­ŽHu…Tù]Zíp•Dœ¢pJ^ÅqäAéúã\ÇôM Ë\Ôܼ*i^8˜õš+òã–É‘ýy9Hm ñ]¾ªÊº¼Ó_º^sÍnkfŠ&ö:¯˜p,+dZ†d¬3¡”Ó¼2nÂõº~}ëƒ9JF*‡ôªäº»´âj>+­ ž®×¿0ôQ€kúH36 ¤Ü³ÈŽ8Ô„ï5ýÓq«WÍ.-wÏ‚ùüæùáʽtÆ&Ã0rc_>í(„J\•„½Ž¿éyàwÉÐ ÈpI÷>§²0<-0ÅÒz“(~Ý—½Iä† p®¤†ìu™C-H° ¡›îlõ/pƒ$B³?`*‰/Ñ÷á_«L“hæF_¿Ý³×%°;;ã˜é.Z„ÙÿÅmÿ§B7‘Ñ, 7òbâx©u9ˆ„Såd½àJ®@s*ò?ùÅ4…ZÌk~‚Bp¡,´³Ä—’«bå "[볋¡`Q—Rüüºk7›ªDÎè|CpÅäk@Ú5W‹Ð”E95LkÈ¡ýß¹ü·4xÓ7tÞ¢iÄ +XÊ5IÐ]¹Ë¸lêÖÙŽæp4tù+}¬DÓAŽª²z$“æÍCâÄ+òüŠIÃÝbÉEv½†c¨¸£6ú¼Km¿8âf1פ5ÄþëìhE½·}õ¶ùjËÅ{fhꛂñíPü.æë¹vš²=ˬf÷IÞ·ÐÈ!xþb™X—ìWŒã€" ¼ÄrÐìœÔ¢uÁ2 ×_ÖÖ·"#¶ødÖ²àçût9>ÕÂç»(‰ º OÏw2ù” Á±„Ö–ïÌû°R"rEȶ 0/pA0ˆö”ò`¯h£5T=Ì…jÿv„‘sóX¬¶UYäi³ÄÊSžü½`{¿«P1ø—Ð~öiY€ÇQý’0´-b݉Š<š<Ÿh½Gu?Іƒ³«qÖ z ¨ð”b\ÖMŸaܨüÐ"öô=²ñØ 4›nŸ Ô„^ÙZ‹±ÆDèÆ2åRÁKe­¶«ªpÃ@­ÞOÏ1c¡±¥–Ù†Œù/ÆíÜd£„¶¸è¹ÆÁ#†:ÊŒÕîÈóíZø›ô3(uå"eyŠ‹ šè ŒÝ$éÅ@>ˆOz€n#¹j÷¸|6ë“W‚ä1Ã劸Y¶×G÷2È×Íðη;³uÄ”œôqî« ±ª ›ã°ŽphVq0k1ÐáÒôépyöKJýjÀá 5èÃË1æÂoóùl«0´ÆçŠâl>=˜ð2^ðÉ(ì“gG®Ó§ ªAèÁ©±Î˜–3"™$_–nüì§sÜûBŠñ ) žðû…˜ø®„ +!#W!ÉpQr·“Òª„´è=Ÿ9Clœ;áG ÎøŒ½]¹a%Ü—•v:±¡7lB2â€3=¡0óãàâ7ô¦Xü1îìâ·ØÛå÷&#tÖAò îóÀ³“00=G™³€s@Å=þk6¦‚;µ°c‘î³zPs¦Ä™æÄ/Öœ r½ä“5‡zǃšãÁFê‡ãšã'®>†Ã$Ö%Pò"7À ‡{½'iR‹†V_öܵ:ã +ãϪÕ$ç¹jØ jRã +v6-)r²µfž¿œ­­§µµ†³5E_€!© ÑGaû½Æœ Àú³H +LÐcu3õ·óEo‘ÝwNŒ. ÊådØ÷›Ã½KÉ% 6wOÁtü—MkÑ"ÖœôHUÙ/"ë¹ÎüÐîp<]ú)Vø3ö!A$ÁO$£>$Hè,ôáÙc׉„.lÒ¶Û˼ÓZ´ˆõX©—€Åœ3ö„­À½„GMë E€(8ãqÌ•´bW2º¬Æ•\®+g³Lø9›ìh2\lÇÞÀZk÷AÌé®8Òù†y©ÝÖ™lbO²ê,Nýªq'tW€b›”RY÷íóÙø<{T ôé¶^#õ™÷$RŸØ¼•¤žOdI÷2oØ-â@Ž›wˆ)îð)Œ`ºMZĆQB›±ôDWQ(=WÞQ3ÝçË®1¢1áY#j1Ù`ß(T}®R(›ƒxYZã²!ý36Ç]¥ˆ!’r5­'xŒ…yÑèiÀÄ‘´ÑÊôKr +ùîK~Å´)‰z«e^dœP •ùIïaÆå|1¾[ 0G/›¯¦µhë™/¦¢¶êNÈœ¹Ó¶4—Øþ…çÿÒÙ":ÃBÙØÐ'}3}@U›R¥£‡òTïõéU :r~zÅùõ#^ƒ|í*çëHö€‚³±^ؤǡ\S:6¹·®Ö>X¶sŸ^÷x}}1ƒ„†üóýÃ/¶`DãþÐN"¸¢ôøç}ŠîöRÿ“OiˆõùgßõÏØÒ:ÕE]ŠQ׬iZO° +O¨«ÅÜêjÉÔ5ºšvÃh±ÖDp2öøJŒ‰· Æ +ϸ±¹a)醓¿X¶gØm¯Ó+h‹èIws¿7œÓ·ñ*b¾Ã´¸>P•ö¶L‰×ƒtfÏÀÀwÆûtï¾;žDΟ³ÃÖçðü)µ³è²¾N5¤ž–ìÚ9£QÎ6“rŠ„âd{xIUÊùŸÏMŒ±›sÊ5WÛÙÕÜŽ “Îav‚'ɤù‹¾$ƒ¾M ½óŸ(°V´ $6±žM™,ö2ÄO)ì‚xµ’Í\VØí†Qs‹èãQ­žõóhή.¢L{¯/5ç iûÈïÿ¬‡5bŠÙM|~ õn×æŒÇ³À¾…dp'ô.4Ô¦p9c¼Y]0̵õ ˆ/““¤ +5·ðý(ÐíÔ£®¤E”öGöª9ÝøOœµ9,ÅÞ6Ï‘ðÖÖõŒ>?TÙké¸!n›Íñ&åÛ_)ëîª,0¼Ú›â»9ú¿W7§öĺ)=7”Ÿ¼SSïAÝ„ÝDŒ'|”±Ç9¨}¾‘eCªi‰=Ÿ/«˜#ŒYµlqÖ\!—J߬¢Ka|ŒywB…•t’IÏT?ÿ¦·º¿ñÀU©/záø?qý–¯wµ~+# nuõïÄ7—ø»þ FûîaÛTô/~¤j.÷ñý³©øçª'Ÿ‡µMÞ¬çÂû]©!`}Zé;vÔ÷Ž±%ß,ádÍÙO¶0h¬íg|ÄÆ0,µƒp—ŠÚ7$h½Pu÷÷f1 ¤ùÌÛøÏÆDÚL8-±27RïÈZ<¶Þù˜U…Q_l9¤¨ØF×¥gü*]ÀgaŒÝXð´€n]º×Û½©ý0ßäÙ<—MUo +©M¬{¤«úî!tbþË¿à›p¬û‰'4ÿ“>aU_ +€ãç*ÜÀOfÂsör"ˆû– NÉZ ÿØmßendstream +endobj +6200 0 obj << +/Type /Page +/Contents 6201 0 R +/Resources 6199 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6186 0 R >> endobj -2980 0 obj << -/D [2973 0 R /XYZ 85.039 210.556 null] +6202 0 obj << +/D [6200 0 R /XYZ 85.039 781.388 null] >> endobj -2981 0 obj << -/D [2973 0 R /XYZ 85.039 158.82 null] +2274 0 obj << +/D [6200 0 R /XYZ 85.039 546.666 null] >> endobj -814 0 obj << -/D [2973 0 R /XYZ 85.039 98.425 null] +6203 0 obj << +/D [6200 0 R /XYZ 85.039 527.998 null] >> endobj -2982 0 obj << -/D [2973 0 R /XYZ 85.039 77.224 null] +6204 0 obj << +/D [6200 0 R /XYZ 85.039 377.964 null] >> endobj -2972 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F65 2099 0 R /F35 1632 0 R /F70 2201 0 R >> +6205 0 obj << +/D [6200 0 R /XYZ 256.582 383.938 null] +>> endobj +6199 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F56 2890 0 R /F35 2880 0 R >> +/XObject << /Im2 4150 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2985 0 obj << -/Length 3051 +6208 0 obj << +/Length 2299 /Filter /FlateDecode >> stream -xÚÍZ[sÛ¶~÷¯Ð›¨9M€÷<œ3®­´nc''R’Τy %Jâ„"]’²ãö’’è¤ÓtÎtàðë·¿rßÍ©.nšakv»˜|Zür6[ôv2õl/pq+œ}üäŒV°Û_ÎÛ£Ñ#´[Åñhwæù®í{®¼çgó³ÿ¶«ð˜7âYžz:°u ×±£ÈkO®ü“/ól9Ñ¡õy‚ó¬²Àgh5[8CÊíz2U¾'Uºâ®5¼•ù*­~€wßiÉ•Uð:4'ÍÓ%>îÏy‘¬€ÇfüÜTš’gÐÛm,”Á"oPèiµËjâteQñÊ´o-¶)Še­PN1r•®“=æ ßðÚªĥk¹Ò…w®ç SÜO¦‡l?$9®Ã3q Fv U}ÙjíÚˆ„giõT)\‚ÚA -ÝËIäYû—Àx4Iš·höÐ@œ“úæ؆‹±éØS ^x§¿™›Sm±ÂQ°æàÝ¡¤Fž4ieÎ+¢k)w)šf>f´~Ido%I®4³ºM”Í\ž`|Yîî÷Ñá{“à%ê›òáDpt6ŸŽ¶ÅAIùæ‚ÝÖEr?ÁY¢w“Òâò!êwÊh«Ù’Ã0]v‰”M7ž°i´°¢5.‰·É³r>ÎúÝñ››Kx(›‰Û¬Ö= Á+wG¨Sؽѳ NÕø™?™¯N¬„ -Ç4î‰tÍíëZR*ƒweÑT¸læMR¤ÒœÊĨ7 [<ñß++ÏÖJ ÁÅj—YÝTI“=¤¼ê¢,óúyJÀ²?ÉÕõ¼¡ËqÐvàûBÛ¥E3`zZ÷Ne3Aèô¦êpë5ÑÚÚ/›Œî5«yå¸v¤Ô6Ãz òÐü*&+ûxÕÈö"™v¼¤o{` ßXñb}`_‘&¾/Œò gņØ2¢€4ÿæ’Û`é[3,Z…|h*ý… w× ¬rb—àÀ‰ >.ÄZ|d­_Š½¾ñï±G[YƒfŠcctÆì|22Qt7>àJ@¢Æ}Sì"Åq'Z*>“¢ì¼TŬÎ\ÀÚcíY×k¦zÂÍ•{Y¦òM°6œ76ô¯Øð/ù ¡5ˆ,Bn‚¡Ä  ¶,ðåш–P:îØñ(ü -öÜ6Ì 2°F˜ÿ-~°ÍLš{}0ñô`Ùªsì‚ÏÙïŽò‹çxìm¨Áû¤®ñþË -g‚$pÓˆ“žãƒ*âÙhÉ~+›Ï9‘¤“:P5ä憎Uh¯Ê]B˜)|®‘Þšã¶ó{gbwó¸M+ñZTt¼·û$ž/±ut ‘â²Å€Ð¡"5I•Ø¨œÈ5aìQ¡¸²œ$¸†¾Ô¬r÷L”‹­ -e6‰Py¢ÊÛèØu¬<¬iá_¯MÛí&QÇùõN®JØרۚÛ¶àÁd?î`/€½S)%%xUº¦â•ˆÇ暢ģDxi’Ïâ>q^‚C±h")7÷r\ôm}è@Mpxͱ6¿acöÐÚ³gÄ=µö}Ma2èFŽå¾á—6–Û•”±ag³• x sý˜\Fûõ5WÚmt¸ä4á%?û› ƒCëN ôtËŽ\åÑ1¹ G-ªó¥ñ­‚·à;²yÿ DÖL¨Ì3áG{úz•<ì¢P x¶n_ó“¹^big ™s´Å•¥D<Ò6= ¤ŽÒÈêé×M?n•´$ð¼gâ†ßDµêw­­ äÓí œéSIþ³Y¡7ý'è }éCë^AÖßBVŸb?+B~/•ÙdÝ"¦_î!Í$ëA¿g-M5‹°ÙÜ– #N€×Užíc•(ŠmG«ïÌ)¢²ŠÃÑçÅ߇â­KÐÊŽâÁHÒP¨CÔÉ\/8¨#¶ÆÐË­·é®lRNÛç+˜Tÿ‚Âã€àfúNôŒ ×ÕŸóYÎ׶¦a#¾î>¸ ¦?—öÄX„‡g„ù7ÆQ”ãàûøëôq‰¯ó©‘‚-ˆŽô—»©`Kz#“”£¬ÿ TûÕd1¥9Õ9PqŠ®ùAeb,\¤&£ p•âÝí;M -~ÞR´éñ˼ÍSéËÇ$ PL°Ø¾$ -¯— -aÅbªP@zPl“>)sŸTÌåŒWTø¨ó,ªÄÏû©ôq¾â;~ #qŽNËñ7™1¾ª¬Ëµ„}+¬qàÈ]W,“@4á‡0­ù+‹â ˜ÕÖyÕiºRõÜD½IžsÈ[múò³u!àØLE\náô?j’·ü -&þ@†0}Vx‡ŸŒbùnr.Ò1ÖORžÙ7 -œ=ú2uø…ÄÔrHåûŠe¾oÃîúÅ@PÆvè —Û úI¦§,<x¼,æ’ß“f~Což |µ¶}ü³ŽÒÙ×ÀAØõ˜ÏHÐcúú ýÖ g|UmaŽñ>K)ÚM lðæ¦Ú·}‡Mû’ª@}Ž\‹ ¡Ø¢"9<Å4 -´¬2YÉ .H€(]æôˆê›m¹Šh5U§8óíŸVE×ì…NÕF(Þþću‡»nî_œŸÃ{—-”ìe¹;ŸC#ÏîÎå«©òíP‡G_M_½¼~5›ŸßÎ~{7·g¿ÍNnY)mn7mèc|¬m©>Éó7Czsò}Z‡ùól‡ýzŸ›8m¦È8ì®×@—ù®ÍpôXÁu(Ù,^™¹)’a'MXq{<ïW ¸8%ÝÏ£©8h¹•ŒLÂõ0ñ¡+Ë»”sPÉ÷|9õ4¸ÊCÆÎ_ËOš{î7S.P;žAypÿWÝš¿}¿xýúÕ°zÅlÎ_Ó.å…0æÐDŽ?üû—nþwüêÄ…à7úsj¬\ÿÄŠ{hg6ø?©øpàendstream -endobj -2984 0 obj << +xÚµYëoÛ¶ÿž¿Â@qqm bDRÏûvéÖ¡ÙímÜOÛ(²bëF–<=êä¿¿çAʲ#»é²¢hM‘‡‡çý;dåÄ…?rùÂÕñ$Œ¤ÐQ4I×gîd +?ŸICág@óf~vþ.ð&Ò±Oæw;>¾ð|=™/~Ÿ¾ýåâãüòÓÌÑZO•/fNFӳț^\ñ웋ëË™œþ„_üÈéû™#§×0˜¢á›ÏóËŸ˜øb¦¢éçù/—¿Í߿ŵ d5'²ÿÀŽßfÎ=»œ÷’÷2”1Šý×Ùﺓ¨øë™+tM¶0v…„åõÈ-|O›ïâìúì¿=+^ó&¼kÌJ¾Ž„é§f’þÀLRi¡”œ„¾+|×#;ÍWI âß7l…eÅ궷°¶Êx|ãª(*´Ä6/—L¹™9*œfh‡j 84‡”Jh©&¡DìûcZ()"Ápd ëÛ%œ¨—fåÓÀ RÇ`Ì°;eÄ †Ê¡.ÊÈ^g[Ð&p§W¨j½Ó¨¡d <éRñ4§¥8ä„R¼F[‚¡«~Ž¥9-Ž‚‰c¹'•cOƒ¸RÙ*ìA¨õy–Ò¿è¥6ÿ2Ô³™…ƒ|‘%y^àqÎ"csBÔud]Q§Äœ=ŸWì_¦]räïâß1‹C°êe‚8ÞÕ™©Æiµ¶Ò cGË+É-çM×Úšž™ôr|ú¿Œ$B~ÿ6Á×´IÛ™1)˜ÍÖ‹ Ò†gÖY!í½µ&…qÉd9ÃNýÃ?\_Ú<¦ ê&hÅx|ÓØàYw׳˜£(‚Æs8Î’õ¦Èþ"8 £zÀ°Jö7 ™ Âzj ™™Ž5ˆÃàÅGÈ2t9€`.Æ.Ó: +©[²’¾ 㘗3`6‚q±+¢=ËŒ"\l~×äH£Ô¥Z[<‹„E{¹Ný ¹=eX."~0­xhHr{Ü7-v¤w¨Çïr îp¿þÉ5oB™hú¹¤ÒmqiºTØD>ÏÚ•cºhð½/6O¹¹9$E@ÀÁ­}¾Ånð^p¤,û®³©‘ܶö° ²ï|aÿ·[ÊìKå† _ß §­E-\iwÌ®¹YB—%¼®Î~`†k<Š™H¼îß lvÓÅáùœr«v +¹mê™yGµ†Ë¼|Í4ˆE3ê>xGÿHÞôIôš÷šç©ÍàÀϵÁû$/vÔЦüMüí‘u€×}ÅÁêç‚0¡ÃWA¸?º‡ žÈÍoš&Žß¿ÛcÑ7°Ö¥i–-ñí’ÀøÝÆjƒ–Àg•VΆoèúz…^ü¤WxbŒïØ+<ÔߩW1÷ÚºB‚-üåC^ôu=d{ZDúdûJ %­,¨”Vñ¡¼ö?ôžü`_endstream +endobj +6207 0 obj << /Type /Page -/Contents 2985 0 R -/Resources 2983 0 R +/Contents 6208 0 R +/Resources 6206 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2971 0 R -/Annots [ 2991 0 R 2992 0 R 2993 0 R 2994 0 R ] ->> endobj -2991 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [327.043 103.871 512.306 115.863] -/Subtype/Link/A<> +/Parent 6186 0 R +/Annots [ 6210 0 R 6211 0 R 6212 0 R ] >> endobj -2992 0 obj << +6210 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 91.837 216.398 102.314] -/Subtype/Link/A<> +/Rect [138.589 733.837 217.411 745.527] +/Subtype/Link/A<> >> endobj -2993 0 obj << +6211 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [327.043 63.223 512.306 75.216] -/Subtype/Link/A<> +/Rect [138.589 706.739 221.713 718.428] +/Subtype/Link/A<> >> endobj -2994 0 obj << +6212 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 51.189 233.58 61.667] -/Subtype/Link/A<> +/Rect [138.589 679.641 210.209 691.33] +/Subtype/Link/A<> >> endobj -2986 0 obj << -/D [2984 0 R /XYZ 85.039 781.388 null] ->> endobj -2987 0 obj << -/D [2984 0 R /XYZ 85.039 664.726 null] +6209 0 obj << +/D [6207 0 R /XYZ 85.039 781.388 null] >> endobj -2988 0 obj << -/D [2984 0 R /XYZ 85.039 585.892 null] +2278 0 obj << +/D [6207 0 R /XYZ 85.039 597.626 null] >> endobj -2989 0 obj << -/D [2984 0 R /XYZ 85.039 535.672 null] +6213 0 obj << +/D [6207 0 R /XYZ 85.039 577.031 null] >> endobj -818 0 obj << -/D [2984 0 R /XYZ 85.039 292.839 null] +2282 0 obj << +/D [6207 0 R /XYZ 85.039 357.66 null] >> endobj -2990 0 obj << -/D [2984 0 R /XYZ 85.039 271.077 null] +6214 0 obj << +/D [6207 0 R /XYZ 85.039 334.945 null] >> endobj -2983 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F65 2099 0 R /F35 1632 0 R /F38 2158 0 R /F70 2201 0 R /F18 2207 0 R /F20 1617 0 R /F41 2104 0 R >> -/XObject << /Im2 2261 0 R >> +6206 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -2997 0 obj << -/Length 1931 +6217 0 obj << +/Length 1634 /Filter /FlateDecode >> stream -xÚÅXÛrÛ6}×W¨m2¥f"ˆàM¢;팛ºNÓÔqc¥}Hò@“°Ä EªeYß]삺˜Rz™´ã±‹½œ=»%û.üÉþ$®÷Ç)üɤŸ.zn+—=Én?nâÒ÷ÓÞèÇÈëKWÄnÜŸÞ‘iöÎyþâüzzñf0ô}ß‘‘ Çã‰sþÃÀ›8¿ ¤”ÎùÕó‹t~@‘À¹Âñôw\~ýægšûe€RçW—8º¸š>L_ö.¦;ž D>ºòGïÝ·Ÿ·/{®ðãI cWÈ8î/zAè‹0ðù{Ñ»éýÚj¡µ O»:Z‰¡ŒEì…]2ÞXxc$‰0n±ñ`-~íbpøHÄÎÕ`(Õ |鬾ëTøQ„ø£ÈyUͪ‡cç&­sÀ`ÙÐ×_’Yž¢1´>xbŸòÑ“"„¤YeØ‘¿é<×`kâ:Z¡i“_ƱS*3“?,²xc§ªaâ#Æ5 ÅðQ«ràÅNcäUMÂ)è,7(žß®àU³¦E¥Q¶!KF¯*Òja°îkØR¨Ä*öьˌ¶mP…škÄi"1±‰l™4°’¢ê¹ÒÄ´ª&¢âžå`Û1º„gÜUb.ÝHLä¤5`PÇ…zÆo.O ü²šƒÖ’ŒOß1š¥nêäÐ\Dïf÷¸va¢ÊÈ2ôÈdz«j„.‚ iàqžï;U'­VKFóÛ@:!gMn`ƒ-wIM’i­’&/g¬•'WºÁä¡0îU”\0±69"¦ÄMÚÉ”ÙW•ï]ÌL“!ÇAîæ’I à)Cª{,’º*ôµjDŽ±yÁ ”"î.w(L©ÛµŠ tO×ÎUE>Ùú…!Ö/BÙ/ZOø2ü,þÜ *¦„–¦tˆÏˆm™s¾µIø1Ÿ[þÏ“†Ö’¥Q•Ûj8ä¤`=+Ý2YŸŽ9ø,1¿Eû¾ë9Õ>]ÃHx¤èU…\Ì€ÈÈßÒ„K6tW:7¦C°ÿ¹éº ÐPø¨l7|×ö Óá`µÝ|«ø¹/3««Õ’•5Æ‘šz!·œÿ 2dðD’6Ê[}­iúº¶•¬TJs‰é½rÍëZSV¥°_˜b°5ÅKí–¤ 1k)ÁÀk†]°ÖÌÙCº- È«×—0|}ÕÑèõœz°‘èP“bþ'´dÌ­ÈðÉt«uàs¨¨tnó=ÈÀAÚ¬•¼£Ù\ú¡˜Ðååóä’(Ž™„¢ë[40K\ªzE‡!Ëhzþœ?`þ±1ÛcDøܼ@ÄöÁlD‡<ÁÉà¤C8µ'5LSýµG,kh¶”"±¼L‹Uf'5MÚƒcìT4Qp’ÐÜA¹ÂÔL•p1ËF„\ñÑ!ƒ-Z=hnàÎk£ý]´á:èÇC®’ŲPšäö²Ä3+—™b'¦4æÒ´éPD"G¼"¡P?¡©ùXÉ“‹”ÍQM¾{cÓ«[sègy›™œ…†Çyr'{ !€ôæ^P•ÉÝ €QEÞVYŽ)™ñÙÑVé]m« -3®/Ùæ&œÚà]St4¾ÃÂŽÜS\²8>P-ðöÁwš8ë€4j 8„»Úúê‹ÑJ×£Û¼-U]txóUçÜ0ôÂ6¿b¹·1üÔ¾k´dF{TCcä3kEþ+ú‡RM#Fr»MÓ;iÀÇÁ]±yF£õ\•[5ú¸Gpq+UÊŽP>q”Ðã÷¼Ìª5›Káø,¡;B¹….çê0=¯VEFã[ö*…;†Ê-èÅ­ãwÇ][çýýŸ¾åøž^²Ÿ%+~úŠžË¤Nª˜Mü$ÔÙ§’kó†¯j!\G+ŽfY+:"ðË·SÏ>í»žü-.Mmp»8Z*dŠ‚­Wïªzq\Ý– XÐXÌ=|Ü&78On ɤÉ[2G÷I=tF:YÜ&£RQïðyÜa Þ¨æÀàõó¯™bM¾Pû¦Z¡Wy¹z`U}o]Üîxl]Ïó”¹dY»Hò²•u»æI¸éeI^lŽ¾2'UÂyù©ÔMÞ¬lñân‚j€¡IÙ@Îá¾’§¶žªôããJ>î 8¬jUÓg0Ÿï–õ^­'óÊ”Õùýº/ζؽ°tbd_ÀF˜—'¼º¼H«ÅÂÆiLÚÜšK:ŽdoS•[gµ8JÓ°Ë„¹£õR¥ùEy×TCªjÌý!¯Í~}"°¨Ë*îÿGFOYwY‚ܯÍ+85'Ç­¸¥ºð‚¼£¤­ajÝŠ÷1¸˜ð'Z¥Ïž,òòÙèæ5 ³dŸLlTk3±1Ÿ¹Îtƒ|Øë’@í¤ÀD…ü”ßt„ûŸ¬–öd„7>M¾üî»­ëË.5ýV«A—GÆû‘qœ¦MPgßFJ“Cz¼m¹÷äüÍåoïÜí‘?³Í U»2òÃ{ée§[ÐS´jÝúf{üº1ï »g¹öu^7½…Œà zC7îþÍyûÛ¿ø¥×‹ý뎿AI?zôc½í½•ý Æçendstream -endobj -2996 0 obj << +xÚ­XYoÛ8~÷¯0P,*+F¼t,Ð7M·ÚÍ6îS·dIŽ…èp%9nþýÎ’,Û’ãñÎÅá÷‘¦SþèÔ“ÄæþÔõ(áž7 ³‰=½ƒ™¿'´‘°«'ór>¹xíˆ)µ‰oûÓùr§G!ùt}1.ßÌ®çWŸL‹sn0ILËu=ãÚô„1û G_În®Lj¼Âž€5Þš5n 1ÿ¤š/?ϯ^iá™É<ãóüÍÕÇùÛKœ›¡ª¹ûV|4¿ÎßM®æçOà¥n›|ùjO#ñÝÄ&Ü÷¦[hÛ„Ât6¿‰¼é§“›É¿*='¦zÕP–Z ‹úÄgòt&J„ûL2»—IJá”M]ii •JÈ#¢$Ò(…o|êM‰‘ÇÇ´rÛ*©¶Ø,LN %iË"ÿϦâN¯ +êD‹|,eƒ­æ§ƒØɨ ¨ +‚ùz‚˜™c̨”ýl öÓ‡ø®&p>l²óSM-‹R7ýyž©,¨$Pãy£?3™k,`tTÊØ6Ò3¨*¯ê MA-è¤$SØ®±.qêÁ”Óª»h¡£ÒS"ȤÁ¢¸Ù:¬æ„ÆNÓGÝ[ƒI×(Öj0¨ãèOwASi-VsŒm‰!WIÔ.µºTëfëo\–…šåF²ÔCõJ/C5Ñ£ê.À#°¨Æ1öçòø{R5MP~_T¨P”kUŽ«ð0BæC´¶ÒÝÖ <ÆŸQ{ò]Otž`¸E©¤ƒ‘‹×¼_/`’ÛÄö\eòÙ׳%ö€;Ï þ™Tz· ÏR%÷e#w¼6ØÔè¯ãJ£Œ¿m’*©±©mƒ¾ì6/Òâ.ÉIUœ±¶Œ±ªåJv»É“ï#ë°Øäuc懖¶1BþäˆËa„÷i²@*/e\—/øq>ÎPÖz¢U« *¶ºER76U|‹‰¨‹{=Æn—IYÕ·j£Ï‹a?þ*[ PgøÈœ´QÅU•(Œx:Å`'%¾ãž»žÌ8bKÛ#‚zˆ-Ä~+ä]@Ù†nUÞˆ1ˆÞ-xC +¸]`D8¯µ‚ú»R—¿TÀˆP‰s€ëzn$FÛ!ÌwNǸ“tá¹Äc¼tÇ6ª C:@‡!t®]úF¨BEPØÃuµa0]¯‚Z·P¬T²l+­ 6ð0(Î"lÞ9ó$µsÂÜab·Z]VOÙqøxÌq½ðùA; õéV]ÜÅõ +÷{ÛIx®ô·„Ôê:’ðâr±Ò=’éB*„†Ô¸‚ÆöÎÚ|…|‡È®·Uñ[¤G-Q @P` ó›TÏ«Ê…o ?7 …EÓ½~uÙrIÐLk*HU~‹½åªèâ†ò”á²1³ìÉ ã}Ç«­˜:v0SÆAšý$É>ÝG¡µŽÂA¶:—…<þ0 ¬½/aóžZX¬ñðiù18KjXu”ÍZMãŒPçþ9l6¬íŒ˜òMšö)åwñØaä?i`”Ä2;ðÌõˆkŸøžLGb‚páôŠ¸.oI¬}o\YÖÜÄ‘|®à&ªHªó§QsÒŸÌ8á0ø̨òg÷vžÆ¼cg=àk ?ê†]>j äžGîÓV ¯â8¥‘ + JÁŒºx'Íý%ë¢g²Çdˆ–-#Ãô]šàëAß‹õEžo¼i.ö´Õ¸5wî¦ú‚•¢Üªµ¶` H–ñVCWh§$C”-‹Lwúwq|I#[Ø ’4Áît?…Û?ÛD®/ÞEµ“éŠ +îJˆ»M¤>'Žô{EE Š•%ù‹ÁÓ²]vúB“a«Ëê)pÔ„1oÏÑm’/’¼¹…­»÷t±HME<Ã9£>%ù“9ëÉŒ>u9±ýþ«÷j`Qv•y°×Ë"M»ËÓn‹ÅþO.ÍóÚl®ŒøT+ò¿ž$AÍ“[hÂÞÀõE‡›2©/îb'®ëÇSD¤^›å2 “édXU³¿®hïesðžè“Ã)+OÆ]yížOqù„ñ‹ê±ªãÌRjŽÙôlå§/-)ÿv7ÆÀþ¦ œ¨*æø×6é§ºî” N<î2Éa´õcäÜ>ôWrH€Ž#‡ÿ-^±endstream +endobj +6216 0 obj << /Type /Page -/Contents 2997 0 R -/Resources 2995 0 R +/Contents 6217 0 R +/Resources 6215 0 R /MediaBox [0 0 595.276 841.89] -/Parent 2971 0 R -/Annots [ 3000 0 R ] +/Parent 6186 0 R >> endobj -3000 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [218.134 709.485 287.369 721.175] -/Subtype/Link/A<> +6218 0 obj << +/D [6216 0 R /XYZ 85.039 781.388 null] >> endobj -2998 0 obj << -/D [2996 0 R /XYZ 85.039 781.388 null] +2286 0 obj << +/D [6216 0 R /XYZ 85.039 761.463 null] >> endobj -822 0 obj << -/D [2996 0 R /XYZ 85.039 761.463 null] +6219 0 obj << +/D [6216 0 R /XYZ 85.039 741.337 null] >> endobj -2999 0 obj << -/D [2996 0 R /XYZ 85.039 736.911 null] +2290 0 obj << +/D [6216 0 R /XYZ 85.039 521.967 null] >> endobj -2995 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +6220 0 obj << +/D [6216 0 R /XYZ 85.039 499.251 null] >> endobj -3003 0 obj << -/Length 1391 -/Filter /FlateDecode ->> -stream -xÚÝXmSÛFþî_¡ÒÎ ÏÔg^l‰L_\0¶JÒ™„B:[ -²¤Hg&éïîÝÉÛqMÚäC‡­öövŸ}ÕT3à‡j®C ËÓº.%–ëjá´ahX9iP%ah61:.ýá7ÚÇS£ñ OóÇBÄÞê‡Ï{#¿ÙlY–¥Ói¶º]Wï5MWݤ”ê½Áa¿Iõ#±õÒþ\^¾¼‹&Jõ'}¤ú¿yíŸ5úþ’–M쎅P>4Þ^ZhϱOª8Éàà=‘ïÈ\’3 ¡õ©.D]}Š4 DÅð ‚›f Îò‚pÅÆ™‰òaPÀ:ÕSÅOQõÇ®¥´ÛCaD˜ª–±T÷ê¤h·‰·ÍÒHEÞXkß°iv…”Øâ]ãV^PrŒ&"Äx÷£²4ÍQh¾0 UÂ% ƒÕÛˆL¶©µÏ!ØÞp•0)q© ä†5‡ØG(¤Ie¨D´‘H°p3 „£qˆHƤ]ÆAÈjév&ŠÉšCP¡¢@µát¾¯?·ÉG B¸'Û¡9ßœ}(ªš“iéEìsQùX, n>mGuÅ!;˜¥Ý „$ªüMTwXëŠ~¹ÅÖxƲ֬zF]%kÞ;6uGTœelö^ŇRbš ?MX¢ÄÃñà'ÜÎ-„DáäÀ¨EI†ÕÞé@ <§¹}^ƒå±ìÄ󀤄ô^‚A¥¶U±Ìíø]xnÏÓ#ŸÈ:‡Ë0ôi€ï÷ògQWÌ&x 0ëM˜$ÁŒçS8ÊÃÅ*½—¬Ç[¹èyØ"»C,V‹\'—,Lb©æ•ÈsUÕñÉ”œ1Ü•Qe,wÉIkKÃtýK•¾;Ë"v×Þü¥âßý_ÄÂy¶€³5Ôê®âIJêØûïo yendstream -endobj -3002 0 obj << -/Type /Page -/Contents 3003 0 R -/Resources 3001 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 2971 0 R +2294 0 obj << +/D [6216 0 R /XYZ 85.039 278.706 null] >> endobj -3004 0 obj << -/D [3002 0 R /XYZ 85.039 781.388 null] +6221 0 obj << +/D [6216 0 R /XYZ 85.039 249.97 null] >> endobj -826 0 obj << -/D [3002 0 R /XYZ 85.039 95.579 null] +2298 0 obj << +/D [6216 0 R /XYZ 85.039 205.486 null] >> endobj -3005 0 obj << -/D [3002 0 R /XYZ 85.039 74.989 null] +6222 0 obj << +/D [6216 0 R /XYZ 85.039 184.289 null] >> endobj -3001 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F20 1617 0 R >> +6215 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3008 0 obj << -/Length 440 +6225 0 obj << +/Length 1180 /Filter /FlateDecode >> stream -xÚ¥RMOÜ0½ûWøhKØë‰cÇî¥Z ÐR±¥¶ÄaÙdiÔlÒ†,ˆ'«Ý[)y™Ï÷f¨ -Pg¤Òžf¤vŽ®6Dчà9'0E(šJe ºŽ 2;³ %½ò´X!EyËN>ͯŠüš ­5+¹È2Ç槀ÐNërm(ï·mÙ4:áÂ$†ýéëvØÖ2˜Ž®ÿœ·Cÿ½³(ivû…d\B…¶ãœ±èMU…™x`ï ”IÆV\Ûnª'7,‡ºkѯX=}w —õªï»õí¿ÛSž› -+”aÀ#ºhùˆhÊ[öC0Õc£†O愵v‚ «8ÊÄð>†[¿´ôS— ·8q?*ºx#Ëû Ç±‘Ô¾*ù~Ýãø¡"SVÚxÿçTûÿNBã -v<ßö ‡ö Ú½'î]ÛpPû_ÐsÀ¤endstream +xÚ¥VßoÛ8 ~Ï_aôe6nV,ɲ¥î!ÝÚ[l·­î¡W\Çi:vf; òß)Êù±dCQ„’HŠüø‘2÷"øãžV,’ÆK5gRk¯XN"ïNþœp§:•ð@ç2›L¯“Øã3‘ñ²ÅÞb±’^6¿óß¼›}Ê®¾¡”ÒŠašjÿS cöv/g·W÷ßâ*†îß!÷oAȾXñòkvõ–”gÐþ×ìÝÕÇìæ žÍÐUfÕþ‹Á}ö~r•í"ßÅQ ûÛäî>òæâûIĤÑÞäˆq8^N n¦béÖõävòyçŠÎb¬Î¡¤¤fJËS˜¤:€‰sÁ$^ª"¦¢Øâ´Êû~Óvó TBù]ùm]u¥[Mëêaڗź«†ít•/ÿ퇼xf}Kç}Ù½TEùG¿í‡ræëá Q˜^ó£[I +eÄ"ÚKÿ~ÄJ„® Â8Ò|Ì#¿]¡HýÒî?§Ÿ¦ÜÐqÑ6}[—´»Aó +üÀ¥v㮺Ö÷wy=܃pwÍï_Ãn8w!ظ•7XÛvÐCûH÷¡wʦ¯Y¢ò–ä5 €{á˜$ÇJ›äÅÊFW•@¾8VþÍ«´-‰PCW!Î(’s”Ö`ÑcLà×n\ØUQ•MaÃG…ßVÕPù\^^÷-³¡F¢l ³¦ß¸‹¹ßýZû.*BHb×>Ô£ß%n ü€\ʸQW{Šw·¨ÑbpmTMQï’©ÚwØ\E@ºå÷í11&^b$pTÿ¼a$éùv G_á3Û G¼”F0µ•*äw $Žc"®/˜¶e жcrÈ| ÒÚr‘Š,6LËôˆÙS$“àþŸˆÇÈc‰¨-Ðnä&žÍ-!óª¡KP-§KÏagiõ) 8Xƒ_Ig–ð¹S\ŽÄűÚuUäƒ b3²a4ÙôUçtr¼»+óù–®·6¾GÊ8:N5ÐÒï°KR€­µ,Zº…¦hé¬]$ OØש°D<¥‡P†™XxI’0!~‰£«pïë”"<ï;â\WMÙSÈ‹¶£=;IBhæN¶¼)ÚõnÎXwJsÉW‹ 0z7]&Ž ¶-ÝvÏ0\”6þ ’A[±>ZØB·0ÿ¤‰ýÙ êϤU¶súøu€WR›@B÷Ór(pä³ùô'ãæ:O„3³iáÌrG:ˆ¥E8ê-“M劉=mÆ Ó‘ZI%,Rú(ùE‡É-Ñ"¡GEYˆ[ZN¥Ó|á6ŠŸ¦[·àæ4Qð€Ò·> endobj -3009 0 obj << -/D [3007 0 R /XYZ 85.039 781.388 null] +6226 0 obj << +/D [6224 0 R /XYZ 85.039 781.388 null] >> endobj -3006 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R >> +6223 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3012 0 obj << -/Length 3611 -/Filter /FlateDecode ->> -stream -xÚZYÛF~Ÿ_1ÈK8€E‘lžû°€c½N"Ûk+0Žz(JC …¤<ֿߺºI ôÀ¾»ººŽ¯ªåßzðóoÓÈõTv›¤¾«Òô6¯o¼Û ô¼½ñeD)7 -C(Ÿéœ™ÞY¸^˜œ$n¨ÛYº™G#~YÞÌßÞmà¹q¬n—k¹\}uüĽ›E‘ç|Þ÷w¾3w3ß©ïf*Žݬ°8/ó¼Ý5W>Þ)ßi«FçeÑß}[þzs¿ 4»‡®çŸ%σ1ÊU0æ -í¾r3?šÒ -ã#Ú}¤>ÌœW]¡‡²Ù0‰–ð…nô)5=pÊ¡¨½eŽc®œ%p“4»ÊjßbeÉÊ}˜ŸMÉý¨‚]ÁP¥Îâ3¿”ÔÕÞ©óŒý=¶gΉÓúíêþßÉ[º¸#wP¨tWíy¥á±í é9k\±ªxQf ,9<2 8¢3äT…6³Úõ”´Ìù‚ìifȼ8…/£ã¬xe 5 "çý2äñ> Bg3?s/rrDìÊ¢?½ÈçåÀmx8êÆãÂ8mßã”ò[ð ¡åoŽ7/mZºp“=O•<nñ§ç‡v…Gâ.WžqN»«VÓ“Ftг -#¸ÏPÂB ¹á¯åk;ïüýÃÛ﹓¨§Ý:Y†Ø =š««¶Öf%ºÖ¶¹ à²:¸@+3 êa’:/{ž3<ÊZyU ’?ðU»‘!-7·gnÏÒ wܘ-¾äD÷d -ï®çŠá–M[G35²#2š¦ús!‚†ñ©DºI/KeºAlËqì£FŠ6…Õ:ƒS˜m7e?t"ö,µ¼ëéY§ -½Ä©5l“Ð…”MlãÐY>≰Oi ªÚètÛ¹ºÙÒFÂ_+*´0Æ7 fñ´%¡ÑjY„Õ‹ía³y#ªW…Ê»¿t±(ÕJxÁYT‘óÝB‹rv½ Yç7oº-ɶç*ñóòè¶ã¯a$ÝdA#\"IŒß”®7wiH0×h]‚ Î˱;û1_\´ò‡’?æI.«ÆkÙõwZÞc…Ž¬Gå!µž¿QS»àŠÓX¬ó«¶Y—÷ã‡ßyè 27KCI2ŽÔך Í™í7"íFuá>¦„€¿È"7K²©™Ùõ%‰=¬†OóEÕ±âjG*ÎPE–úBඅAåà?Š3gÜe™ }ô²Ü¦N1 EÇ=5ƺÁV°¯xpJ< *"ŽüHæ¢*ó=×ïñ6Ë¡E™A‹åe Z2V¬ù8XX"ˆ3~˜ÂQD‡,î­âÀÙv†²ïåª ?Oæ’¼›høB¼]ÎÌRî£.V"–@¼€ï¼zý‚ èjv—W"‚0KoÅ­èÎzØWoØ|ÃàçDÖsªŸ¥X" -¾[\}—3 ¡W_ã?¡x|šPÅÔ]p<¨·@MáhJÔãš;Эض úY¸‡t±kk^N] ÍÔÉ6kb·¬j{z âüø¢G }¢UM3ÊÑŽi¸ýž{ øäARݬdÞÈznõ`J²î=Qì½dƒ€gÄ1šû¶w¸ ø~ÅM‚1%HVOŒÖ([*4·ÅOì·Ú]g0štüFr~Ñ@.,y§ü ƒ®@ Šî;v žb]´ähgö#?ˆ SK…}«‚›E.çoâk¨”›Zbpr¨RçcKKNÞsÓýÊ(ì‘qñ=ÀäƤîè †Taå©íÏí»Y4µ…Ÿð†€ìÁæÌdF:™z®—Rÿ}fIˆ?»vÓ麿¼^„(>ø§ë½DFðvã{Á«.Û¶êÏñ".;q¢a;˜æ{ EÍ^s–% ê%;×È÷þcñHâ؃„EwS"1!¿Oœgq­4Yu,æö"ИB+Ø+G‹Õ•qg­&/6Âb+°é‚¿Åx-5Ìx¿¼êqãÔM‚Dƺrä$:󲦄VØzð(’* Ž3äYÖÄ`Ëï„‚³És6«>×[F<œ˜Šô—ç‚Fä¹›5Þ@Œ“ ˆ\I Vˆ1@¼(|íd†ñ¬)Èc;î…ßKîû4‰fÎèTÖ6êýŒpó]WÞÉü=j!BPÐ{aÅ^6B‰Ãd 6>8ÓIüxÞF—²˜o;‹$<â觡œD»ÙóŽX’ðª³ÄÛ£–­»Le±\*î‚> 9ÔB–±V"c¯‰_Qšs$ËbÈTüŽ«ˆ†Oï¹n… &y[o«âVÂÑ7÷\çdA¬NdØŸªÄY’Aä±VÅ~tSð?"HÙ‚‚«Ýæ€\h˜@󯸰²g“ó”ü¬ÆŽØvîÀèiî£(Ìßr#‹/Û‹nõ˜L•P.kƒdÑ7±×kdxÃf -mj)B9Zð¶.ÄNkYLsuc3:¦ƒö`A-."_h -SŒG¯ i@Øø0Ò'ðîþ²p™ÍWøä56H}gu F¾Ma”3q(8xâéV¡Ü#ê0 H¨ñBI'†&¼fúgåq¿y¬l@|ÎÆêÕw‹9µÉ#‚A€­*Htƒå ¤MµMm`-zÀÖ5‚RYì°&Tsea3wÂŒ]¬VL'¼îFeîŠ ’à£<%¯ò}7Vç(±­ÛH秷Wr’ïP9§‡2ÉÒP''› ¡ÈOIì hΆ}¥é*žu쓘ž , ],[°õ‘ È°ý4Îçä|ŸŸÝú¼‰uó–Hž[ä\×õ¢¼0ת›Ï7ÿµ‹HÏõ\ñTòÉH¹ºß“)7‰Ò ï Dä)«W·;^ý¼tŒÿ°bM°Ë‘ãÒä5m–Hfqž øI0C-=ldÌÖ…ípÇÃÈVÀ÷šÖõ¼…Û˜[QŒ‹bÁ&GòlôEÔtjÜɆ¦G “h£HÒ‹ÆL-¥‚©IW,z\{0Žç±ÍÀ’±bXÞ™œs¥7N]¥öl+ì®àkØÿ…kQRà(ÈØ£»:¦I¢àAÜT9ˆß2Ð -[z+™?®µ6FªdÜôÓEßñŦÃÌY·“\©ŠxTÃÈ;:}Tó_Þmì ž–3i‰ÉÏâ{ÔGlÿ§hÙõG4Ø:öâë–ê„‘QÑ$ÁJ—“,< -%ý ö–îl·å‰Ó¤%öÞ[#Bz+µ<’Us8»ÕøM¤ç¦kÌ|`íL\yª¯ÈSsd}â9ïpÛ³¾(÷I4AŸÐºnÅÐPW+C,`Ä´éJf!­*¼=‰y»pbŒ:È—’£S }¯^ó×ø4ì?J¨a¢dÞýS9ÌR6p.ës ”8v½4³‰€Y’…릧Ôí,Œ¼Iò*˜DßLÚÑd ¼$/1ÿÄ° Â8”2DȤz¼™Ùy¢øk—Õ$N<ɵ(n¨ƒp!üy’i¶Ø&þüŸÃˆš^[Œú¥Ÿ%3Chò¢þƒžnÓd¼z(O$5Å=µya’õ”ŸR±9Ÿxqó&—R²?[“u0ÅžgÛGÁÔ8Rlí%byÅ¿ -”´¯z© P¡P±æF²R›Ž=‡åw=kV"÷YÔs I½œ#…¯5d/òé[IyüVÓ12jeeN ù£ª@ùëû{|O‡–ï¿qSÿ¨»Ñ^²À áf¦—h¨°¤wƒ`iÂðԞnj¯éAšX¶BGÉY~rÇÇÚ;£q+màÅôýB¢øn˜@oè“Ç䃧ßÁ˜©ƒ×òɶÞH¦Aþu-” ¸þ¼ë†Çéa`¾̃¦§,“á0p*?²Üãû› -X¦F¢•9+I¹åã?ršÝø,£œßÌ þ&ÖŸË;‘1•¤ —d&É„EzJ¸<è'£÷É$ƒœòŸqÊÍ£ùG"Øv(¶ôן‰ä±!IÒƒ\í~2§å2Äi…Œvd?0´^ÈÎ,•ØÅ—[Xg•¤öáòœí“êü‡„îÀf"?™ÏþzògLMÒŽÊБ0†ÏË)(è*ÇÜHxƈµdU̽CáAS õ4#× y»=!.0'< Sý8s•Lê `õS°¶Ãû*;Þ$P!àí£¿ö™ïÿ«ÃÙàendstream -endobj -3011 0 obj << +6230 0 obj << +/Length 2408 +/Filter /FlateDecode +>> +stream +xÚÍYKoã8¾çWè¶20VK"©Çq“îYxN÷"r˜™ƒb+±[ÊXr§ûßO}U¤±]ììa *‹d±‹tä…ôy™ B•{i*˼Õî"ôž¨ç_‘•ÐFFk¢OtÎ]ï<‰ƒP§'eìó4Ê¥#È\./>ü‡^I¢¼å£Eq ¢ØKrh¥½åúW?N‚ÙܘÐ_Ì"¿îʧýlùEW¡ù4›«$õ?ßÊ÷žxU½nf*ô_[ð¿†xÙÍTä¿‚Ïûg’lg¿/!íæ±ò0áÕ^«n#sÝ»‡Ÿ–ý6ì.’$Lœ½»Ñ‘ o42^Ò:ùd£JYñÒËME*ë('Å òª«šZkÒ¶ämo­ˆè ê¦ì._n¥ÑÌâÌÿ†å^8Ë«¯_…®išbÇ“ £käë +,´Þ»ÕZ,“µÊ¶ÙØâMMÞHȼA΂ çmüÀêÍ–W™ÏÐ÷žÝµfýØ3™ñW˜b —ñjõ,&l_ŽUí›/K;¨© #ýt ¾}¹fÍ„<´nOjmF¶‘É™»¼Bã+MÀfâÙ6Îõ‰ýq/{ʤÎS¼Øì0“ø´Ñ9²buÓ ¿xy!±íi±ù©ÛšlÆJÁÆj»b»-«g‘ö2r02ZUÍÑ % +Ø£œ&›•·Ýl‡Ý[Ån`yb§ Ël„Aè Iß +ïؘ:Ëü%è«Þ˜SÔ–HÏò‰ýd£Âß³váF?öö"Ï•ÈŒhÞÀ°1f|Xì"ïcCšzeeÞùhbÉl ’& r:N ùF'“}VÏŽsŽÇ8Q~ó €'”Ð3„ Çšž¢šÒ“ÇÚˆ|× WA¹•¨ï¨;"ëë.?Ý-Nä ;N'£€À³:¦Ê¿nžª¥*³¯Y¥gé¹jênßl¥ñ[hÂkt_"þ¥–NÆqhúëÒ¡¥í«'ÑžJ¶¢ÿ¹=Ž÷Š|¯rͪ«ÜPr"/6)°‹õ·ªe ÍÅb8&Æþ «‚¾‘“–-#C%°0ävK[HH›¦+-{Û6væMÑDÛrY€b+ß"¦ÛÃj#ÔàY´ +Á5e²ÞWÔHȬã^¤F¡‚ι pˆºü^µ’õêD*¥œDòya‹7œ+xlÞƒÒNjÕ°ùL—•®§¥ºŽVÖçU;Ç1B¨¾ç1#€µ`ð?\:C©5Bˆ¿8@µ(O½¹ŒûK(HAPÜÒ—ð$MÞ­«t”P] HRPéd\WéÐ5¥Èr™ÿ3j¿²èû²•*¯`+qYÖ% + öB{¦îsÓ¾«ß s¾îSTjÇ‘àïç‚hJ·8Ž¹`Â÷mÁÇêÌ9&ò\ºI|Ô\ tû¢kö­ônŠñy=™«¯!÷ÀxRJÄ «üþÂ1Ü0€ÃA ᢭V2›­2¤.G(Äd]ŠçYÑÞ‚ðm…_¹½Hfì¬>4QÇHÑZ¾…|îxÓß?\W,Tú.=ÍË°'2IÔÕþ¢©ÜQ|hM¸\=³5^ÙŽ}mô“hÅj8gÁè]]ÙEÃRTH }-%Ø»òÖ»ªîçî`ë(O׎ø %¥«¥ÀšúÒ Ð!jX;\ìÁËБÕVUÚŽèûYê:rƒšŸðä¨vWº¿V•ìK–²uÊëOÒ…3­·Žƒ4Þôa¼±­UÛêž:×¥œ»({$±s7D‰·«¡ö„¼œ¡Ø˜ÍÇñîäò䯰ò¦@äu®¶é°xªD'+VȧÝ4ûN¬¥QÅ ê##öΛÑÚæGÚp d7¼g¶áx¹É Žµ-ìäýöÁ=UÃâØüüÄî «î­P ¹ h™^ aõÇÆI%ÅT }¹å’mÈsD[îFî©ÅÏð&ŸWã,Îpœ› ð? À#™óDL…gn˜ˆØ—+DìÓ¾9¸ÃaQ?ʳÁŽ³Õ¡CSŸS3Mƒ(ŽÞWs9NĆ“±š·|"¬áz¸Wå¸<àßôVª´¾.߉¼g7r›¦‹Ã0”^Æe|mx·i% lÙÂêØÕr ;ÔÿÕJÃv +qÞ\Ô(²µß#s·á 3çž<lJ¡GwZ")%E;ØRuâ 1‹l™öƒÿeÓƒ +­èt÷ñÔáhÍ Q*ñ#•‚H]r%G7oðêbWŠØ^À°Ù²!ÄË*±% -0€TâháÜ. /ökßOˆÑö !u¼‘ØsN¯daä•Êýû Ê •˜á¹ +és8ý¹’Ø ñÖU[Ðu|-ÜÆN$o~ú8®¨ÏF0Q¶¾Óx¡5Žu^m+‹9­+ÿYU‚Ô¦æ;. +WÍÔxÔÔÚÈÀ×j»V_E}NFãêM"ÇÓe6Æ’â5êz³0¼vT…X%”xMwöõ"¢r\Eùßîõ‘Òï?^Dš*z÷ðŸ/²„Žóÿ»æ=ÿtAOu¾ÜCî7®t3éèåÍ¡›I#å-‚üŒXObCì-ži g&å•¢¸k©PMÁõ£ô¸ 9ç›IG×ßã +‡ÉSvfŒÅ§”möhcèX×bÕ +ëªØpÞÚbºp//î©b—‡.™$™¸j£/±O>;ô©ýw{u ¥´ž¼:œ­ÚTÄùéšM…*H¨SD`S*žßè,0™òúyÞ®ø'Ôçuendstream +endobj +6229 0 obj << /Type /Page -/Contents 3012 0 R -/Resources 3010 0 R +/Contents 6230 0 R +/Resources 6228 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3018 0 R -/Annots [ 3016 0 R ] +/Parent 6227 0 R >> endobj -3016 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 313.422 824.811 326.323] -/Subtype/Link/A<> +6231 0 obj << +/D [6229 0 R /XYZ 85.039 781.388 null] >> endobj -3013 0 obj << -/D [3011 0 R /XYZ 85.039 781.388 null] ->> endobj -830 0 obj << -/D [3011 0 R /XYZ 85.039 761.463 null] +2302 0 obj << +/D [6229 0 R /XYZ 85.039 761.463 null] >> endobj -3014 0 obj << -/D [3011 0 R /XYZ 85.039 667.044 null] +3028 0 obj << +/D [6229 0 R /XYZ 85.039 648.42 null] >> endobj -834 0 obj << -/D [3011 0 R /XYZ 85.039 667.044 null] +2306 0 obj << +/D [6229 0 R /XYZ 85.039 416.522 null] >> endobj -3015 0 obj << -/D [3011 0 R /XYZ 85.039 639.536 null] +6232 0 obj << +/D [6229 0 R /XYZ 85.039 394.76 null] >> endobj -838 0 obj << -/D [3011 0 R /XYZ 85.039 232.013 null] +2310 0 obj << +/D [6229 0 R /XYZ 85.039 295.722 null] >> endobj -3017 0 obj << -/D [3011 0 R /XYZ 85.039 210.152 null] +6233 0 obj << +/D [6229 0 R /XYZ 85.039 266.318 null] >> endobj -3010 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F65 2099 0 R /F38 2158 0 R >> +6228 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3021 0 obj << -/Length 4053 -/Filter /FlateDecode ->> -stream -xÚ¥ZIwÛF¾ëWèf0O„Ð@cËÍc˱'–­‰”çÉ$9@Db FÒ¿ŸÚº’”yy< —ꥺkùªšêÔƒŸ:MB× ÒÓ8Qn$§ùæÄ;]AÏ'J(¼SízQˆ]ÿ¸99ÿù§ÊsS/=½¹#’›âWçÝÇ·W7?-–A8*vË8Nœë…r~¹¾¹¸äö·_ÞKaá'λw_þrƒ Ú¹¯Ÿ?½[,•óé*׋ßoþyrq3ÙÅR»: -pœüú»wZÀNÿyâ¹Ašœ>@ÙsUšžnNt¸¡¤^Ÿ\ŸüËÎÂ}ú”GÍ0»Ô~äú1ÏMm¹Vá ×]¹ªú¡{&ÒØ©þöÈÅÐvÀF‰Å›§m¸»Ìò…;k®}«€¬IÏ/™)78 -©g]5f8Ó(ˆœTÁÖ åÙb©•vžºÝñ¤U ýµ¬»XÂrDœg´·ªÅáY]ËÆ›v€zÅóáÁãi+<©”ØÖØݬz¾,ÞX†s¬ •¯ô–÷{ϵ¡eRYr¹í*‘ÕLÔ'Ã@'°ê]ZYyºü§¦`³0HÅ0cÉ…U×î¶\܇m]åOÜ›+ðÊŽëw­¾Ñq¦XKäºåⶢ…iî™Ò̽ê˜H9;(-Xñ ÃÝè u>ãYÉËtã²gäm9e.$ÞdC Œ‹@%Þó—N‡œÐj"wQ²Šð A0ÌÐÕ¡–þ¡më~f?qAŽ^™$´Þ߃\Ïh7mük³4å›jŽ%º‰Šÿâ<Û¶. ³=Ôž ¦ÂËðýQlðDùñRýhæþ˜ï »3®~#©a¡»óá̦R™×U٠ȣÖûÚ¹Å2ÊŸ8E‹Âr[Õ]’jÕ¬d(c,ò3Ü*•¸©oø%¦Ýª¹›a:JÜØ'\k"¸âý´¿y*à"©jÁ[#™Ä¶UÆRÆ5î¤mÒÞ·u)ÓÜq×PmÊÞLWˆ8'±…þÞ±°Rãà0pª;þŠ‘K¸¶­ØTàt¡¶z=ã-Ýä–z±€¡8?ÃaY7ìÈŒ %Ù10¬q™ÖÚͲ襻åï-)©l±h…ÇÐá@cùç‚)”ƒ;zš±‰Æ’œ_–lÍæŒ6›Àl`ŠozÄâõ -óA0gT| ôƒþ§Ë4uýygm(”r}ß:/º”›¢ÍxiåÂò>kèÉ%í"ðœÜ!húgåh¬DÎõ€]O$P½ÂZËBýÄMªºìŸÝµï~øâ¦ø¾ìqoI@ <7÷CÇrÀÍhëñK­èŒÁØS´8«´VpÈÛæ®Z¹ k3z+W•´~—Ø`e×X›Þ/÷’«Âž"\›½â¦§"FTW ?5N ë^àˆ3ÞRMíD -v"0%GãH.Õ-Ë>–FÛî òÚÕðˆŽS§êåkF|eÁíÕ@” p¥¹éºì˜™Žë·8@Î<š®ï{€»ë4u,u -ǃ«Ü`Y9ß6Ýã‘â•"R9æCÁ<Ú‹F×$0ÁºìÊ ‰‡V «“ƒ%³Àð8ØÇ,((;Zùd´R4ƒ -„Uhÿ¶HÈÀþxoÔx Cw—+óíùËLB¡ßU7²[Tl¸3kå] “o°w`ŠÜ00ý}»É*\ôîŠ,5+_UösB›ºÚu…ó4tÓ(Ùãü²´ë Rcá |¶ó±]˜ÙˆBH¶aŽ§7®ÑªRåŽä†+d_°«N˜f`9UJ¼-àH`w·¿åu¶EDÜ>±S*›É ^€o&_9p¼~´Äpö²ȷͳ8þ±c<1qÏ3ÖY°ˆP58ŸÐ¼Ýl`!À”sÖ!”l!£€•ƒù}°èž!y¨šfxf²PÁöÃ}ˆõi`*ÁCŒšèŽG¡j.ŸI ‚ÀÐ-›HnãËfE.˜¬ýèK$%¦XÌÚwèµq»T³ò$¨ð“'Ç!¸ô7ÄÆiäßÏÀq€ ØþJ„A÷w#Œyh ø‰#ìÊ|Œ«Ÿ˜wÒ¿µ…Õkf¾’ÃxMZÉôí¾É60k6çüqÎÒAÑ* šFO;•[Ò#–ÍlxÓÏ,r‘ºI¸ó_Ýo£¬rÉ,?âÊÑ3+§Ú_VæLb‰ýÀïŒÉ$hOô1™I® a”Á©—°°1É$…ƒ$ìô_@À¾6< þ?…®—L]­5µÀAÄû9ë­è‚g¯@¬P¡#pÀ%}È 6Žö8JI&¿×’A"éÙjwuÁÖˆ€"q \|lÈŽY1ëùKî ¬k Ýt –3á/AßZ¦Eíû궖À £¤‚¥¾An3VÉ4’( -³ -åfËìcͲ隣Ãq:w|…žˆ¥"¹‰. «rþ°GÝJF[0 ᧡ÙÍ$…c ‰ŠùQy÷Y|Ë™Î5‚¢Iˆï·ºó=õ$kj€ öDdf‘BLU¦ -ZÿcMNË oéî Nl0],¡ƒ…Î8qŽ /ôϨmF¾ˆãœÀž!PÙ+‚û9†|¢¸´C­,Áwƒ9˜ùðÐ ^ Ñù0§‰…£}L,(’ÏÔù óäŒx`?’,¸Y¤x¶ƒqyîòùÜòÕ+¹¿’®ÿF!Bu•Ž© ¬ô²(µ¡}oL*˜ô>Ò xpþœbahÙ7ZÐÀ(„3ãŒÎ2fÜ_gtá*”=Ü‘xølb›@j”y­Ä\”ÃÀxìÉ:;…&Ç’ží#¿,Ê -4è‰eQ¢„ÞDY؉lê4ã(ïz»7 ¨Û•ÐPžÍ9 ëѯ—Ç3Œ|à!Ø%²§|Ø Èd Å»b…Ž¹üró®mÐâ¬PÞ®¾~Æà8`$s€*°±¤#Ã@f»3äÃÚ–)ínñ•c’ßÕÏä÷n|¢Ù3%óÅ ¢a‚YÓ;žN> N±ážÊO|¼øåPIRpåž>]jÏtüúY@3÷<†=èÕ_Ô¢Ï_ß½ý|¸‡ q“ æ¡gõàµÕ/ùíðã§/|"Y7žÝvªCbv³fĽr›(Í S¯jn)險¼j9ìçtÄ8—¥Ò!`è?cÇ|ï‹¡)¿Ìú„ ÆÌò…žôí¥ -ÙŸÃÈ<“ë w`¤‡ö–˪ÝÉByÛpó»)ÖÏmÎhŒ YrÐ>¦O7ÜOŒKÎk?ãÀ¢äÇ( ‚ĩRpe± TË íï-q¶zr°bw»šc6Ê“QˆÖîEaöQšÚ¡1Y¨%óü2™c“5ÙjúyÌ<Å’k6q˜]ÙH°W@ñØyªØ‡htº©zÍy¦:þkYù@²ò—×ì-¿U{©ùÈñ=ã9þ}Å_|KïØÝ—èt{@ôäÊ9{e@Sõbª>MÒY‰!(Ž^s·±À"T£×Å -æãžzŽÒ6Ü4÷2—’ßÚ‹CSuàM¸Q¢:öß~ -+YŠŒ…p i:ßé'¶#¯Ðƒä< -~Çì~ןÍh†yÌéIà8»á¤Ïta$Äaï-1Œm–Ѥ™ee‰ Âh’G ˆeæn -(:Y‡òD¯©0¾í@…­ë£`6séTÌBKúopgs/{X’|˜øbÔ®1 É-Êö›†I2HôózxhÖ¨œó‡ žM¾r–¥oSl ¾”°…@§öYÑt|$ËH&@*MÁ¶¤ø ¿’Ë…~6k›MlkzsFʆ÷L/ÄŸfHˆÔ“—C}f Ä% -K&¬™ôs*ˆóïÌ_VÖFîÇÿå •gó|ºƒ‚ãaÅwƒ…ÉÝ`µcjsý’ƒÅ¾Û̆~äÍÿµBqÄ‚…ûFˆ´÷sï„Qì65övÂì;Ж/BŸìßП%ï›E Ëiˆ¹·0ØRB/æm§T9Ê×ü=Òð€|¬wÎfE;?ŒN ¬MŸ·BSð×ÎçÉÙâ„dß ÿ·YNÆS’_Hb1F8MŒ¢‰(J™%»¥´€9óR¯£Ð±Z‹N(tU+J 0A¾ë&Ó±yÆàæ -‡t{îçŒAv)¿@ó…~bé-; ´euJ‘nkóÿ©n|}ƒníÜvö¬¿Û7ÿ ›s´"òˆì)’F)¢¨ ¤¯+÷Þ -¤wÏ·=·RtMÞÚ"5ƸÂñžµ`ƒt?´[nÀ;=¼)þ‹Ü÷‹e”¦“I}§¶?·ö†ßŽy3Ͼ EeäÿÒ<[Këô,Þ·¨ùn³ +‚<ÏÉ?@Sü/#Ï7ñÈlãfHNŽ _XXÏøá5J“yäši8¸ñù¶Ê{y´¥ÿ¥Î?Ñ〉ÝÛÉmìR¢ævµ­\dÖÙeéh„¿¹Ú‡ó¹"aª-> +stream +xÚ¥ZÝsÛ6÷_¡éËQ31Cà‡|ONœ¶îŸ­\n®í%ѧé’Tÿ÷·_)‰R:sÓi `w±ØýíÂjÀj’F~ g“$U¾NÓÉr{LÖ0òÓ…ŠK!¹м›_¼ý16ø³`6™?÷ëD¾‰ôd¾úÕ{ÿóõÃüÃãôRkí…±?½L’Ô»½Ÿøiª¼Çëiª½ùíýOLp÷Ä¿Ÿoïo>NÃÔû,÷€zþ»>>þÃQÍæÖÓõÝ»ëéïó_.>ÌÏŽào† ÿyñëïÁdÂýrøz–N¾B;ð o/€c?2Z¾Ë‹§‹¹¥xÌLxÖ˜~"úQª¤¢‚T¨ý0T“$ +ü(0¤¡Ï-Ÿ^*¯a‚ػϻw·Ÿø£F‘¿à?DÒpïüýÃÛÛn0½Åfâ­Š6[”v¹w²>ì˜Ö}×Ïøy7÷²]!+åDÕ +[áÌ늬„Ã3:òîê¶êªí²ò?¹)/ªjF¢•Y‡ÜÕ® +YÇ+h¿9÷bÇјØÐëĆvWO/aWÉî•WÙ“ÈîdÁëeWØõî¦h¬ž–]ݼ2ÕSÞ|A¶–¼ÊìIô[×7O@- +ÑÆxØ í5ùŸ¸Ñ úpäæµÊ¶¸}Ü Ù×A-Ü5´´Ù#ë¾Æ•šýúª‘ñ•l€ü 7S¥ïß¼êã#2ÇYµŠ‘=·Õ²É·ö˜SŽ“þ[WS·óoi“UV·ÏVuMËÔÈÆí~|tJÑÞ§vÀ:ÙtÞüüþáPN{Ö¾Q·ÂÚª·éã3É`’ 5˜ý s»¦s·ªÁîÐ㕬 HˆLáï6+Dvä *dÍCËfPí¨ê¯û¾ZúŽM·]–EδLõÛuó\œ®€Uˆ¨Ê;솱„÷1aÏßeÖd©'±[‰šJŽvÔ`úü†Lr´ŸÞÓ²žALŒöö{›wË·ˆ í)9£™ög&9/ç€è´œ–è;ržÝPä<ÜoTÎá~$gƒ—â‹7÷ù¤´)bŠïIÛ‘Vˆ¾'í¹ ­´ûK;ØÏêyYãØOMúY{¢3² +Ñ÷d=·¡•õ`¿qYû‘¬UÛB[nFåÈ‹sÖK hœVþ ãtï¥"ø±Ž>Xyfaò™ûd¹9cs> hNûÊH%~`£úÚFL‰§èÍ2öa÷;F~K) BŒšc.þŠƒßë†ö†ü`ËîЮ†+‹óÅCˆ@ÐÇš<åá%¾JÁŠtà)Û¦ +oø‘Š’È+ëeVnÃFáàÓ§Öª&8p™Ô,ôUœú +×Áy‹b½¨¿ù8%o2°ƒ­¬Ïò‘•EÖü&^÷{ûa¢÷x¥dƒ!Ä!ˆ[·Ô¡òŽ%Nf~Ë#Þõ`¿Xùqª„Cn„0š6l8já©­d¿Œ‡ð ²­ 9ìh¡– Å@÷@˜ \Ñny‘¶æß:7€ý9W˜Ñ¾Ùµ6ˆ®j9öZ¬¦Êmíj&qà}›oqÓh*és……eh`+`™ñ(ýK¨i2’°Ü#KHCõk8ŸDcdÊ…~PŠC™°ƒ½¼…|8z ±×Tœó²Á뵵ЉPbM$¬¬¨#Xë ü…TP7²k)YÑÁ¶`§¤°AÝÓ©Û2ë9Óþx¡‰Ø<2n£‚CÌ0V+w½’‘bAöÁmMCDŽw­…ÚHÐmrnÜõX´!›]/—ýñÉòÖ 5ˆÀ…r&Lô:cxšﮑøýñÍÞŸ…&ŠÄzbôO#Âi Tã1F¸°‘cGüʃ:äß*®“©Œ¯ìPåC¸°s|‰3,­S>þ×JO³²” ^zÞe÷ÜÎmG’ˆgN+-x#©"|®8é*¶”âµÃõþøŠ97Í—€±«åÕ^‚ê"Cr®|A–¾0Vb`Ø…,ÕÂtÞ}¦/ùå0ÐyfôÐO\okT⸶Ž+TøH*$&åß꽓êˆã2ˆ½ØŽãétÎVD­AB8Q²Å@ÏÈIÂ0ÁçÐyö³Ù تšOѼ˛ü[æ2è¥=_Ã…Ý—ZŠóf/1!Ç7ïÏŽë,˜Õe]µcga‚«4¿ +²+^iskDñ©ù YÒ+޺फÃ1ÉÑóæ™Ý±„£ˆ¬Î ã9~mlAÈz\ìÌ*^ÄuîE¬LÎÀÑ°9°É-­CîmWáÚ¶²ýe`ÌÃ`š‹î?ç$X{Zû–îošŽçê0ØndFmçÞâ\ªˆ…Û8Ààq…A¹'¬uÿ‘¿{+3´^ˆæí¦xáÅ*úâD.îj¤S¡›qT@Í ”FÊyµµ†¤î0˜þÈw'/&hwŒ.xnƇV¬+rOýmie9—@°(¸zƒv†f|sh¡e“#!ê×ñÐe‡:b,ÔíœÒð(å]#k“¸Àác[3æ‘EÖb-œëg+-¹×É‹;Aèd”)_¹J¥;9^¿²?\ä—^¼Íe¶Î0ø®yÑ‘ÈhuïP8ZƒÄ1È'*Ú,ö÷*0öèÃ&D >¬bL00x¤X—õ‚Jmèq”¥Ê*-ø‹fûU_ç pGÞCCòíh W™oÃ"9,öLW‹Vµ> €uNÉ;ÒŸõÞ4úû #\¼e¡"g*;²O¦4ˆw£_‚¡Sv³‡à•.‰-íRѳã8F7XPMNzV oë +£ÙZ0µãÕ$. @&[PÇ; ö®¶&u V¯+é"¡ãÈÂØÒR‹Çá^{ÉÑì* +BvFvÞƒXJÏÚûhj0–˜ÈÊOÁ€!ø ŒŠó(JC ¥wƒ@Î/ÆMÿ}‡)dþUƒ—å´âŽÝŽKÊ´/é×¢,mL¶±³¢œ]S5Zu¢ëGÉŒšüî œÜI¼´÷4EÛ"÷!Ž·[1“DžŽ;™]ÖûiÃYaÍÍs¾-· ˆ9tÙRÄôb›I @•÷ÛØü‚ή–ç#€1'aS±})û4³ ³å_ð‚pûXÐrŸ â¨:Š½ÙB[×ø?ÉEÆû«#…ìá2ð©d–+Ù–uŠ»f#• ²U¥Ž.ˆV!Û‹¢?·Y®•»D,$ôM[ïßBJ2=ö@ÚNJ÷ox°æᓆ}5À•‡ÉÒ"¡;ŽÖ¹®€ïŠò#åü¥R ·úR .ëd‡F´™·œyºœ§ï6e˜|3á¨ï7Ú=¹èb0Sk»¢(L^φA‰{7™,#~bÈÈ*Òm!ž5äPiä_¸˜»àÜ0‰Ð©¼}$Ï&†4&ÃÇX!£Uá—«LÌnñÌé2Ó%M¢6Ä"ÚAÄÀ>T Ï÷ÛußÖ¹…\²Ñ¾V8„èYùdžÔv½8¶üÞMØÀ+±ÏxìåêrçN»”ˆ˜%š fÑŒÂqíŒÉ䓲Õ2£4­)ùö°# ymBLý§£„­¨¥Þ§›. +`æú©íëd‰wC6[7XâCÚ‡ÿh ‰ß‹=läí›•Ó '¤×Jñcÿ8¤(RKQ„c,VG„ƒ¬<öa#¦dx,Ùº0Ø鬌aͽÝ„šØОú[Ë=ó3#"°žûÑ’ÚþˆÅɪ®L˜P”\7®°º=ù¸M*L±:ÐJ5Ø–‡ Óî— £GBi|¢@‡#uU¾þ3˜Þ+±–çuÅe¤Ñ×i²—çÑ÷½Íëc•ë+÷R]ñ£ëq”ئàó§îO=ÏPrû‚Á6õú¨ãþgº–[¦'Ì[@2á¼ Ì‚ÖrðàAÝ`ã^Û¸ê÷åz­¥›}49Vºv×DK¢<ë#=„&®:÷,’S ?}?‡ÿ™Õÿëï¥ÜË’Ñ~ªO<ÂGaè‡Êò‚ªIùµWuÄðÿ]ÁX8endstream +endobj +6235 0 obj << /Type /Page -/Contents 3021 0 R -/Resources 3019 0 R +/Contents 6236 0 R +/Resources 6234 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3018 0 R ->> endobj -3022 0 obj << -/D [3020 0 R /XYZ 85.039 781.388 null] ->> endobj -842 0 obj << -/D [3020 0 R /XYZ 85.039 651.216 null] +/Parent 6227 0 R >> endobj -3023 0 obj << -/D [3020 0 R /XYZ 85.039 630.626 null] +6237 0 obj << +/D [6235 0 R /XYZ 85.039 781.388 null] >> endobj -846 0 obj << -/D [3020 0 R /XYZ 85.039 400.898 null] +2314 0 obj << +/D [6235 0 R /XYZ 85.039 664.197 null] >> endobj -3024 0 obj << -/D [3020 0 R /XYZ 85.039 378.183 null] +6238 0 obj << +/D [6235 0 R /XYZ 85.039 633.996 null] >> endobj -850 0 obj << -/D [3020 0 R /XYZ 85.039 270.194 null] +2318 0 obj << +/D [6235 0 R /XYZ 85.039 550.674 null] >> endobj -3025 0 obj << -/D [3020 0 R /XYZ 85.039 246.212 null] +6239 0 obj << +/D [6235 0 R /XYZ 85.039 527.601 null] >> endobj -3019 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F41 2104 0 R /F35 1632 0 R /F20 1617 0 R /F56 1642 0 R /F65 2099 0 R >> +6234 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3028 0 obj << -/Length 3344 +6242 0 obj << +/Length 2106 /Filter /FlateDecode >> stream -xÚµÛrÛ6öÝ_¡É5ÑïêÃθŽëM_6V6ÛiûK”Ä %ª$Çýú=7€Äxwšîd&€sùÁjÀ?5Ê?ˆ¦£,W~”ç£ùæ,­`æúL F0Šý MpêûÙÙùi8R? ¦£Ù’Pf‹_¼Ë¿_ÜÏ®Þ'Qy*óÇ“,˽‡±ò~~˜]Ý0üâö Æaî]^Þ}¸! öîñîÝÛËñDyo¯àãaüÛìdz«™CÅ$öã4B2~?ûå·`´J< ühšž`øj:mÎâ$ò“8’ïêìáìvž‹G¼j€ÙI¬?'Qàçyl¹VÉ×ï $xSlÆaæ=Ž'ð?Aàà»ñ$N9T^ŒlæÞPr¯®`ºœ#ü™á¿*F -n6õtSð` zƒ3Å¥rþCäÒ¢¦Êϧ¡Pt;»¬·Ëråßß½cä³ÐC%¸z»àãuÃgGqàµ]Ý/·üÛ­…”¦&ë·Á0ñÃd¥PªSÚ´^j€kdÏ`êÝ^ÍÞÝ]ßà–íš¹¼zkðyh5±«KÊ4I pA|R[WUÑ´`fq”‚9ÑÊ(Ö-­G}<µrú,æ=ö­(‡¾ -ÞÌêK°5±ð ›­Þ¯% ~P&Ø’Æžp«ºA±)Ø5&cš/ª‚èïZ2¯0XÔMBVj¬šÏyZ³¹Kk™m³h6õªÆu´Qî=áEWUBO×´1Rܹü%Ä„^§?!¤‡ˆ+='ùœcïÍ`M‰”®d k-ô* aËÃé‡,W·-ïØ›DÄú¤{P0é!²EëY÷s$eMgÉ’¦Ð‹öèX¾]`ò€†—ìž<É€;§±·DVÐÎÀ§XÊpâÝmû-öúî–qÐf{,d6NÕŤ±a•sÝQÑzRmó™DÜ€)ÅÓÄÛ°œÐfK$°hy+£a\X‰,u5ÀUS¬Ê¶kžÙ¯~'©§«}Ѳ[Õs¾7HøÂê &Hå‘£€1-;° ÄR€H)ZGáEâ^\²>Ò&‹™Å{'™þÄñúþŽ¯ÉÄ@µÈ噿–…îÈØ -Fkœ+@昫ț­Ë”UVA°âönÆ@ãÐp,‡Vqˆ{5›°G`¥÷\1ºG<—á¨Ã4õ :oxš|BÓñºÂ=9~¤Ó™, ‚/f%yÖªœ?3À -?ùB·<´–ᆖ#@¹˜w%Kôôº¿)#·9ì$²+;öŽÕRd)NŒe%‚ª;+ò†§v$óŽ§KQêÈEÞZ¦ÐóËÔ¯AP ¦ØõaQwæ˜]ìDñjb©®Ð2ÄSžÞ¸'öAÇ??ü—ƒs€ïÌ[ÖÕ¢g†Œ*ƒéÙÚH<Ò’"Í‚´ -€³k -¾,|Óy’<|jt»¸`ŸL‰*hÄ/Ñ€®å3Cݨ·âÊÄ>|.Õ­qÏqÈNË\h ÞcdD¡åƒ.2`Ø`J°²Ù·@è·ÄGLü‘íÐÒÎPR ùô'HÜÖ•2‡E÷USïwü^$c’iEÅdF×èö){$cQÞkžc󂵕8—”&´ŒŒÞ£5š«Cu ‡lùh³#»-ä<'ZÒ©N9û„yk¢èt¿ý´µ9¸c-36€ñŠâ.H“0HœsU¢Vw…ñä"»ÊíÔ'âÍé^â$´ •ª”K@%AÉ1 ±‚q¾”5Ö¤ôB–I `\|akÛw…@ðöK"-Ò¨·•œ eËBÛ| æÄp Ui¿êíÅÂ0 6¸lo©Î070slû¬:Zü…1&ø“y×¾¿s6¸NC9“8äšàïÆ”j¾;þåt­4ç[¿S5E"´÷#Ü/Ñâ ™ ¥u„Ë™)ÕNtL)‘oÎóa$ÀF&ØøÉqyHÖ)ç殆YìØA˜El¯9ý¬ùË]qªtÁà]­ó“]ŽÈvŽpÁŽœb–B€ˆÝ¦Ã ŽGq˜xo·ŒzCE1 w C;å¾íògq·I²S!À< -ü_røøS¨ë†W–Ü^kú·Îý¼pŽ3a[*z€¸Aø¦çÀÆý |:"z‰’ä™S%¢­@:Êc <9 ¡[…@j3 ¨¢˜Zšú’L3ï­I‚‘Øž™: ØEoå «L@oùvÚ!¨Œ7xfßÿ¹…í]mœG'öýNÌ… à:‘ñ©˜ØÚVPü͸9=ÎùùëL6¸üØà^³Ó0É "Pü¢,-—¡za.mH^Z:SˆÌ|f½]Ú§­¦¯®RÓcÿúbuzüàŠö={Jš¹DÝŸJYac²‰¯òh™.tiuQéƼ¹Ó5nKû±”âøAÈ8þ³”ÓØœÄÀJŠ1béppFÂï·ýýS”ù*·²{¹ ŽÕ1¡»BýŽHG"endstream -endobj -3027 0 obj << +xÚ¥X[s£Æ~ׯPU^PåÃØ7'Ùlœ‹ãì*µIÆ€,Ž(€¬õ¿O߸IHNUjË ôôt÷|}›–;wàŸ;µí¨h„®­ÂpïfÎü V>Ì\áX +ËrÀóÍzvóýÊŸ»Ž9Ñ|½éåhÛ×j¾Nþ°¾ýáöaýþãb©”²¼•½XAhÝݯßX¸ÖÇÛE¨¬õÝýføå??ßÝ÷ë ­ÏB¸ÜëÏHúõãO×ú~ûtûË7·‹¿Ö?ÎÞ¯;›;kÀ¾ þ{öÇ_Î<Ãý8sl…ó#¼;¶ Ë»Xlk_Éw>û4û­ÅkþœwMá£UhëPäê@®§lÏsçvlíø„Ðz›¢å7ß«!§çÙ+­A6²Ü¤M|³-ë¦fΑ̕k»*Î?×ϪpÑÚÊj~n€TŠ¦ÉÊŸ9/5¸Ä¯&'šoýŽ Ù—›Ÿ³?À×^Y/–®õínîðõÉŠº ¢Ø ¤­ž/#ßo¾tˈÌ5Àæ{¾e𡬊$YÙŽïxù˜á™rfŠ‘©$ÃCÌLoGâÎùD°N¬¿WÖ¾Bí$:e +{L@8ìöL­KÙ‡n3  Óº=IÌÄ<}AKÉÆœÙË ?ÍJñP™cLS&96ò’~É(PH× N7e•Nzu¾rù)›m RÅö ‘ÛD87ü†„ Ã,FàR\öa¡0e@êËB6Yn˜<µ/”ÀUÙ +JÛµÂ>ࡺåÁªkGèR¨[®g+×›¯V­Ý!Å\Ù Öƒ¸ÐÚá"Ç(ó$Çe±¹dÎÊ·µw½Ï x&ÊhkŽ¿²#Ï“2Ja ˜IXÒ;çlž/:Ü8èÑ”fHê°Ç0ì±ÇÏìóÝT³¼;=Qg‰rìP¹“Gjy–&>“?j ¡½ +V$©æÁ™FåC½¿®YÎõ0T4,=Ò·Þ +"]Â6f;ä’rg2 ³ŸÇmÆõbÄë[;#• +°”J‚äGJŠ4§VôT_„Õ l/ôÞ€µgº«0½ë5…-¬§ú&aè#X=„U*ûŸŽvjøÏe2ŒO¬)TêñC@¦¸õ”æZ‚å붔‡ÎGW·µÊ…ÎV1…ç9"̶‘å‰.Áßaôp£§\v}ë¾ïH°õSZ±G+‘ÙE ®î Ñ+t] +ÙLýLÛ’+1³ç`­è^Zí†1è‰ÌíOžÃ¥2’.Õj3(Ý%YT>ø"2݇´ŽÀÅWÛPÏr¹)j?°Cß5E5lŠóvL×b´õR[„ÃAôU{z2HMµEíAíÄHC>‰»PÙ+Ï—ñ!ºZü9¸·Qõxe2gnë¤<¶7"x?Ž/©®ˆ  5ME…8ú4XJW&ºCtíø…Í… bö0¸ú( !f WÅ Mš G"H `:é¨!øˆ«¬‘;¥ÌFa?jp {«YÕFY¨†ÃÝŽQ<\CÚÝDPŒ,UÙ^FB¾¶ÂPVÉðªÐPßüÏ“kp¡éRî“2ɽ”Ž7¸ºÒü!×ÚB@ù¾ß_fw­}Æl#5¨ç7‡J6ë/I§¡@Qƒ’ëA:q¦ÀqS8§ö4õ„úY1U2v‡N@|pˆóø]®l/PCÉͨ‹­BixI§ÏÉY V"«ÞB?åñ?»€ò§Ç´¡0(úöÉ“ ]0˜út×fà[4kê ‹¾ìLÁ/èó$û¹@òõ{¾Kf€Š‘B¶)¥mâîCE3_*¤$…¡9¯/M +* +íèú Ð³\.‰Ïv$·Ÿ¶$úÃ’X@w3) 8Û7悢ȿn]ÏsynP0\ào4ƒ¹Aë>[á½û‘!¢Œ¾ÕâÏq íï(’}ÐiÇÙ‡)KÙ‡ûMõ”65á:’`'Š9ÙöíÍ \Ùšú\°´æ‰„)gëÿRø$_¥ãÆ*‹©ˆÉ¸d¤n¨0åü£iùw‰ü'gëÖcÖ€#»øÛöÕ$öß~ø†,n?H¿£ÐìéЖ`$m2™zÇ¿@tz :;zoÀ¸äæÉÚíá.sќۼI«4½ˆ!iÑðHjK)]$+7}Áµ{ |Y<°ÐTé»Ëj:£\tFu'mE&/yböüvÌŠ õ²Þš¤<^>&ôT•‡ý;ê«Î Ó2*Ì-×”AIQÿgy" ±]Ðχ bkæ lhÜØ\xùZ¶¤uVŠ×’Ç6¼zôGH×çøin®[Ïu*NôŸcšb-®[ÿœì;?â¾*›2† +„š`l|{Gµß–Χ¨9Ó.âBvl/šªÁðÇVü§ŸÚ»Jî+;TÑt!מg{nk *Ø©½íOògÿl 3endstream +endobj +6241 0 obj << /Type /Page -/Contents 3028 0 R -/Resources 3026 0 R +/Contents 6242 0 R +/Resources 6240 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3018 0 R +/Parent 6227 0 R >> endobj -3029 0 obj << -/D [3027 0 R /XYZ 85.039 781.388 null] +6243 0 obj << +/D [6241 0 R /XYZ 85.039 781.388 null] >> endobj -854 0 obj << -/D [3027 0 R /XYZ 85.039 462.134 null] +2322 0 obj << +/D [6241 0 R /XYZ 85.039 679.343 null] >> endobj -3030 0 obj << -/D [3027 0 R /XYZ 85.039 440.933 null] +6244 0 obj << +/D [6241 0 R /XYZ 85.039 657.482 null] >> endobj -3031 0 obj << -/D [3027 0 R /XYZ 85.039 395.802 null] +2326 0 obj << +/D [6241 0 R /XYZ 85.039 559.67 null] >> endobj -3032 0 obj << -/D [3027 0 R /XYZ 85.039 346.794 null] +6245 0 obj << +/D [6241 0 R /XYZ 85.039 537.81 null] >> endobj -3033 0 obj << -/D [3027 0 R /XYZ 85.039 310.73 null] +2330 0 obj << +/D [6241 0 R /XYZ 85.039 398.93 null] >> endobj -3034 0 obj << -/D [3027 0 R /XYZ 85.039 274.665 null] +6246 0 obj << +/D [6241 0 R /XYZ 85.039 374.948 null] >> endobj -3026 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F20 1617 0 R /F38 2158 0 R >> +6240 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3037 0 obj << -/Length 3162 +6249 0 obj << +/Length 3257 /Filter /FlateDecode >> stream -xÚÅZYsÛF~ׯà[ÀªÂ1¸ò¦(Žã¬-y-z½©l ¢à Ðÿýö×Ý€‡œ­M¥Rª"sôôôt}@þÌ£?–F®f³$õÝ0Mg«ú›mhäå…¯3¼™q½8ÂзˋËïã`æ{næe³åOY®v®¸z»|ñn¾ÃÐñw¾H’Ô¹›ûÎOwËo¤ÿêæ;m̃Թ¾¾}³D‡qÞÒÄÛׯ®ç ßyõ‚^îæ¿,¼x±œp±0®‰C°ññâç_¼Ùš8ýñÂsÃ,}¦¶çúY6«/Lº‘ õ½º¸»øç@EÆÌLV9ì±$ÔhN`þx»0ÊÜ(‹ÏnGLû>í˜dÏÒáUÑ‘–~H'¢»!¡{® ²áñÝ,Š¦÷pÓ’ðzˆ±8#AbÕ7>(Ì>Î|×3YÊè¤ÍœŽ‹¸ãòUíϾk‰¥ÙÈU˜¹í×OGõðÓ3ê±|œƒ£Eì¥Î›;ø[·°8HÙ„¤ü»Ì`÷Û •ÈyIóßÞº2þ­vþ‹:_`î;X´ŒééƒÌÙòIhhWMYŽ˜ãGÙ›Ž–eÎmºT~a¡Ñ‹„©õ$–ôÔ·Jšf¤"¹Vî­"6cCüVEniÌÈZ]ÕÚ†iGúe<ÏùôëTäuÞ`V^uV¢µ)Ó&4cBOöî}gUâVV2y'Ê)z²)¤³lFµì˶q6ôâ.’È5Iøç`d¬ò³d¶ðïÿÇ6:.eHOßM3sLí ‚©$Š„h̸¡‰§A>#€½™Ìy“7ù¦l6$«8&_‘®Ú]Ó_¾ï -Èìô{Uڻ7ðHÒHã/±HhŸÄ#‹~tÄÞ²îVØŽu¿„ -…A¤–+Œ³.pûM!C¹<:Ñëbe-Òj)Pl¿M ƒØ‘ž¾ÇñšîÒnåÙ+–N'²‘Û‰vf.m¶íîIšíƒîiµ²Øv0uÊgt_Íó«ž‘–®%ˆC•À”½ôã`˜\È«jšKH .;Šçàl°E´·ö7¥å«ß2½T¹ìuo]Ì'Ä(»ìc…h× ö|=úa_NnGxkk±\:_O‚8s|–uNc²Ðù\b7“#У{×±®¢ŸÑ}êWªrµ—ŽA,$í,œ»â)ßæ½Üdf\aµk/$à;¡ÂçFo‘¯à6åmrx:cùõ•–ÀòÑéÊò­"¤ÝöÇíÐiD…E+ºœn)5£–5˜©ø^AÝb3AýXýƶÈ{l‹–ÆfP¨©Ðß?Bþh‰üѺkÒõPξ­ó¾„£×eêñšªÍ×V½Ö2ìÝâôXýiŤFåš/ZQËÅù.ÎœªFȱýø@»™(ÅÛîkؘ794ÍdyA™ÚLœø K6¯q?,|ëjæ>Á¶Q5B@×® _uòìö]Ï­åO^A@Ùõ¤r­¨É©®üzÄHŽ·Oê‚C/aÇ#}z‚³’™ )Ô7±jØu#Ããò#ëÀà40žƒÄb¤î†Î«%þZ—¸Â½…#!¯¬}àÞ1Þ½›å¹HêžB AÊ¡ñ³ým@ŸœµmYBâvEõGL³ÅÒìÔ @Y"FŠåÌkÖz°Ë„‘H´0šK_­†%¡ˆt?å,V÷Ôºš§!_¦ñCŠ4H«9êà&/DÔ…—{Že2ßai¯‹(t׺{µ¬ö²n…®G¾.qؘ) H£Ûb•Sº ]G{:E˜K¼6âÌqÔæÓË;öÅPŒbT¾)Òq†dƒK{Ê`’¥ÅÓF‡é)EÓµg„Z•Ë£’SVV2o$88I ËèTä²[äÓ±ZßØDt§Ç\-ûs¾HäCþãÐÁ&Ä°oLèÜï๒Àƒ1·M­îFÆ™×µ%¯…§ú“é' ×a¸…«ªª1 ³iåU)®5"IÀ§8•k™Ó¾‚‹ -¨–i¯–궇Õ9³’D|g‹Z#ã -@¹‚Cê¦a@4É'Æ¡-zˆi®…éš/ÖYÂÛÁméÝv“ð"W.à>Nú0 ÇGä¥z 6nž|£)hVÕn€¬î›3BB® <_ìõÝÔOåsÑñXäš(’¡çË«¯Û œøúAÊòÏ×sƒÀüø/aƒ{Þ±äÕòt¯6,ÿ]\ÛºìûBÙ™Èk(°Ó……ªHä†Gé¦~Çh›jÿå³DÉY®×ùŽ-,°“èη8º§×R÷“ïPê x¾äþ>¯Øý Wó~Dbç]I1£ÖOõ72d™pü‰~ùƒ„ïsˆ0ýfrò±W¾™øŽ'‘'Êx'üyµÅW’Ïê>ñ1åmÔçeåfiöEÞ7öþàc‰„’Æ¿™vú.¯ñG_—#ñ2âR`<¡`ü‰·ã f§ñ}`‚IôØÙ¡=(S'Ýœ†Íiå–§Ò CqXxU†ØGoòÍ:µr=ÅÜB]ÓmêIÞ ¤Îœ1šûÆ~zÑ41ôô#0Íz?ÄBx{Ã5ò¸ú®ßxRÍØwÓêþ%©¥±û(jeA2ÚlLlþ·[€ÏÀÁi™¿* •ë ˜~Ë‘ÚJუãuLfMIm±îÃßÛa½ì=ç}³.t–¦›hžvi³!.À&\uzN§ÉðâÌ?ÿï-zæ?÷%aâŠ,FZÏ›†o‚c>ýØ%×zBÿ¨—Œùendstream -endobj -3036 0 obj << +xÚ¥ÙnãFòÝ_!øe)`D“lžƒlÏ“øX[’<Ð"-qM‘’ÿ~ëê&)Ñ,‚Áˆ}TWw]WÛ9ðÏÅí¨dÅ®­âx¶Ú9³5Ìœ¹±ÅæÃòèä—П¹Ž8ÉlùÐã l?P³eö§õñËéõòóÍ|¡”²¼Ðž/¢(¶Î/—ŸÏæ®us:•µ<¿o·0 Cë´,hùñúäüšÛ«z‹€|àʈ,%¹×•ÆÏô!Ý[-Qg$¬9ժإ²ê,gÇâH D¾&Êœ‘ë ++ÂFì›þø4XéþJx6/hH^U[Tï´édÏ…Š]ÆŒDÐÀ7$9oÚ¢®xÀ³=æî±@‰/÷)‘꠮Ğõ{A¼EŽ|—O;è0½$œŽÇ Cü{—W´aG,]ÍSŒc82—ÿ+ìv=>ôsäk ‚ÃHvõÐÈña;l>­º'QißUV[3,Ûl•$T¢ò;Ž¸|iËb¬]-C?¤^Ð2êŽô¾”V'Ô÷]JânÃF­ÆÝž:ä΄Š€6)Ïgß;Zv¨F*Ÿ‘›^`]æÝÄu~3·<ÆÜÔ Gˆç€o~O³ÌX¡–ÛÂñ}.&h™€¯Ó¢â «ldCV‹5ƒ‰LyaÈ[Ô4I03$Kßæ Ø$ëKé»ZKÉÑôf&˜@ºZ JÝw˜R\[?álÆ£ÀñŠ[½‡‚ìÜ¥e™gº«¡çrÿO~QÃã{IbûIãÁOÊâžF4.TÚN<¶YAjN"îÈ@½ÈEaãõÖV(«ö˜‡v¤Vbšº¼áQcœI™‡}lè–i-¦Ýj½«ÞrS·]û^v#3SÉTQõ°‡<«áIÞ­NP‹nµ±!šx˜àë„ Z‰°ã ã3Q @9¥kÒp$Z¢‘U³e$eòe#ˆ­þ&÷Kø +÷²a®|gtÊÁkî%dC s!¶ €î(«)hµs`B†ØJø¨98¨tl–°Mô_-w.‰èîÃùìâ'Éäê +L(+ØDô8TÖrb줂LœbÑal ˜DG‡5ªå&û© ÉVˆlÇ6òyNÞôqÝP‡ŒDP²üÔ|Þ&VNt¨Uw›Â\hï9to@*9:K+¾³´\[ Mä€Ãw/î'æÈ¢cÔÌÃ1¹ïÂ0û•¼%;†á­llC†ÍƒYßV~H*íz¶r½Y H€–Pû4àBü>V#=ÄË9Ì·ym +:"i¾Ù¸ºVs†È"ý‚CÃqpG«Ð/òÊT65žÚÇ:N!np`Êx‘ìñ;ô«¾u¼Çƒi + :q¬ã±ˆiˆÈ’a`׃ëÃwrhp tîf/>ô“ÇÀôØs%C +bC†¤;‚‡±¤•Àl¦ŽßêÐ$Ρ"k•Òq›R~Aƒ0~缃8¹ŽŠ³~ü" 5ˆÓP#HÉÆ–`^é#b‡ÃCX§%Ún:V=:†sL„ß‘£``•)ÊÙñ4å9C0²ì´íˆF9š¦u]@P% l®¥6þÇŒŸƒShgõ6¥‹}Ì‹0 >p!MñÕ šbßú¯¹XI+åqN›·š[83d °ôÚ$©×ã›;á%á„cá›N[r.]“§"qaàžQØ!*ˆèF~*“ÆJˆóŽï)WR°ã†ø 5¢&åðÒ^áÀ*„ü¢Z“³ÄZl¶ÜäG·y ‹¾m ‚Sbå¼a‹– ÊóN¶dø.gÏ ›1 +P̉+Ñ*ñÐeqA +YiVc”‰±R'`÷€Ã”KʈԼÊeÁä+àvËk[sÍ¿+ÁWæ|ìR/z@-n¶)_MìeôŒ»?&Ÿ"+÷÷iPƒòÄ`¼ œ7¬ ¾‚ ”æFº ”;]! ö1ê[Öëz$œöí]²=áÖtA_aqû¦¸ò1ªó +–cԹǴL–ôÁö«-ž²ýÀÝOrv^2Q ÂѾ2iÑøÂGƒÆY4’Lphœ¥{{©ëà‰縖¹.L¬Cµ/xªñà8w€vhðZ>§Xò×ß}L +Á±ÎȬ“MÆX¼ÿ’ë('0ô•Ð0ˆÄ{Ó³ L@RBæ}P·f0.bÆæÇ +ScìÈý—i×WÚƒxïa¡éOÚ5)Æ©…©àR¸Œ»LÇ÷/ÂR°öÊîd:I ÀÍjÒŽ¼¦ër´2,˜m9ëƒUšf·/Q`KWˆê„4†7jyJ£¤¡Ûg`8÷éòVvIéáã>meÆP Ó©–yš8*wã³±‡éMÚ? æôò'‡¢8˜ÊYîÇñËi~:Z¼@š;9 q¾œÃTÊŸab?õ^'þóÙö0&_D*f óxAèR—ñúÇ5ì˜è ;}ÅJ¿@ƒž±á›Ê#^«©‡1b»¢¤Ñ&-ôì«ñ¤rŽ‰ËcÝ+Kpø^2U¯„ÿÌôg(¦ê Ö!VÉtÕ3ð<ÛsõYûJûçÕ®rpàÿ¥…ê;endstream +endobj +6248 0 obj << /Type /Page -/Contents 3037 0 R -/Resources 3035 0 R +/Contents 6249 0 R +/Resources 6247 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3018 0 R ->> endobj -3038 0 obj << -/D [3036 0 R /XYZ 85.039 781.388 null] ->> endobj -858 0 obj << -/D [3036 0 R /XYZ 85.039 625.193 null] +/Parent 6227 0 R >> endobj -3039 0 obj << -/D [3036 0 R /XYZ 85.039 599.048 null] +6250 0 obj << +/D [6248 0 R /XYZ 85.039 781.388 null] >> endobj -862 0 obj << -/D [3036 0 R /XYZ 85.039 117.402 null] +2334 0 obj << +/D [6248 0 R /XYZ 85.039 555.804 null] >> endobj -3040 0 obj << -/D [3036 0 R /XYZ 85.039 95.541 null] +6251 0 obj << +/D [6248 0 R /XYZ 85.039 508.467 null] >> endobj -3035 0 obj << -/Font << /F62 1689 0 R /F70 2201 0 R /F18 2207 0 R /F20 1617 0 R /F15 1628 0 R /F65 2099 0 R >> -/XObject << /Im1 2193 0 R >> +6247 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3043 0 obj << -/Length 2713 +6254 0 obj << +/Length 3659 /Filter /FlateDecode >> stream -xÚ½ZYoÛH~÷¯æ‰"æ•7¯ìÉd6q¼±Œ`13´Hɽ¡H.IÅ£ýõ[Wódï"q‚Qß]]çWE»3þ¹³8°?™E±kûq<[mÏœÙfÞœ¹²Â™)Û œúÛòìç_Boæ:vâ$³åš–,³ß­Å¯7Ë«çsß÷-7²ÏçQ[·ç®õÏÛåÕ{¿¸¾”ƹ[‹Å‡»ë%(ë~x÷vq>w­·Wй=ÿsùÛÙÕrDÅ\Ù*ô‘ŒŸýþ§3Ë€ÒßÎÛOâÙ#´ÛM’ÙöL¾(_úÅÙíÙ?úSxNÍx׉ÇΕÚ^ ß±ãXõ¯vƒ¯Ö-{VWeÎ]«Kèo¸×=Èð{Ó+|`ƒ«[lUkhvÃ|Z¦›mŽ3%rˆf\kQ•mUÈ18óþý~\ž}ÔÝ·Òº†3š*­ñv²å§–OÄsä+2ÓEF$ü -œ¢5?½:Ÿ«(a¢U‡åÝvÍ{ŽE”á[uWá¸:v€êŒçëó¹YU—3õ:- -Xµç£Ò¢­¸ÕÁ ¹àz©¸ª²'"pšnÚÊF$OnxÓT;èÕY3}OL§µ«Š¸œç¥4€Œ.t*´>Ò¨Þô2\Øœì®ÍŸ¶Í ²8zÖ6#;ñý‰m*ÛWámúh–*±n÷m—oÅ»ôÜG¢Ðãìj1Uz;4Þ!Ë6¨OØ»i€G°xÕóÕ™´ {¶êØþ’7_4XËSoòì(Nžµo×Bÿyû^’Ðc‘lQTh@½wÚÑ+]R…®å¥(fœÌ*+YßΘOnLppþ°…Ì+C‹Åa4eü¥àÂ:C‡ä¤¢}Ì£²´E~OŽ„Q €ˆ½yÖ̵Ñ_D ëŠâ¼2ÂWJlÔò|+qƒD Ãk°èwÇ‹YÄØÓë´‘)rVðkÔÏ"Ji´@}x}–ø‰í'C< v²?Zšî‘ĶŠƒÓa ÿü¯¯óŽx…B­šÏÈsàRmÑ‹91ʸäá¬* - -û¤ëFAò U¤¡)e-0žÓ¢Q°Î·ÓW!åÇ4fM§‹Ã›bs“ñú\TyÏã&¥d?µÉy´:Uøø˜¥+R†”éœb¦ïÚNìOfžÊ Æ%‘‹ÕFbÿ(s`›êz-Ö?wÿšŽ35¡Ódzë&IÝ4S4Ñ€ØzR1/©9hÁ8e> nÆ»¬”¦5Üd\Ú¦ßø4¼üÖÐ}ÇÐîEÉÙkä‡ß£0Šxø¨Ï¾¹¿&p½åÎXp×%F܃ªDìs1=pˆxÍ5HãûKLƒ•nZ/Âüç8O”öûáÏøÅþŽa!FÒ¶ÿ’¨k±4&Ìœov%iÓƒ5hd7DõƒzMY5[“•?ê2ãyÌhè™ï‰ºêë•:yq¥æ€çFˆ@á[ÉóúÚ´2ŸŸ`úvüíý,,ÚjV ظnášÎþo>ÈN-¿§Ê -ø— `ègÀÇ„!QB§Çz=ù¨š˜Š -µQå -mRE?túïØØf-Æ¥)ÂHi3túj¨ìÅÓ†¯)ÃÚ1C5 -Ý>…¢+¥N”Ÿªµ§'ÒÐù®¨x7)ÑÞ3VW¸„,qRxí¦Z"¬) $œÍC×vUtúïN„Øoû‹?²Ý¸øó_b”H§Ú>€û‰zÿ ÚB¹endstream -endobj -3042 0 obj << +xÚ¥ksÛÆñ»~…ÆùvBïG¦ÓYQm¦–ìJLÕN’'"‘ €–õﻯ;HPN§ã‘qØÛÛÛÛÛ7èŸ{ðÏ?Ïb× óó4óÝ0ËÎÛ3ï|3ïÎ|Á˜ +ÊÔÂy;?ûáïItî{nîåçóÇžNìFqx>_þê\¾¿ø4¿ºLÃ0t‚ÄLÓ4sf7ó«wß¹½˜d¡3ŸÝ¼c„ë;~ÞÏn~ú8 2ç^7W€=¿GÐÇÛ¬ù{Ý]\¿½˜ü>ÿùìjnx6Ü92üùì×ß½ó%îç3Ï óìüÆžëÃôö 8vã(”÷ÍÙÝÙ? )ž‹ÎyÕ˜|â0sã,<[òýÀ ýà<=7ö"’ÐêÏ‘8»É4Hb2õüX7Û²‚Á +§SG1Ö¦&´Ñž`v¿cøo^ì}÷R ÐoŠî-¢Î>ÂÜÚZ-áuªí`©Ï3°'Š +ÛÒ‘ŠFue]ñ\ýˆÏØQ› E-pÅš8¦3´x% Ÿ©âËé¸ÝfUÇ®®ø‚ÿ iŠUÙvF4XòÝZp¾b¦БðôܤïÛÒO7…¡GŒüU0ìûÉÜ(‹eÞ_Œ‘ ðBÁøÛ7(€²Gqä\0G›z¥Åן÷E‹èP¶ruQñ¨eñ‹œºZîD‹DÇÙ'’ñ4ðB7Ï‚¨Õ¯¸áp/€Hö0*ÒÌèQSÙ"÷@“*½ªàMg¹³ßšKR]¿&p6¨æp e'°JD-sµ-!-Š*ŒœûuIJ)çà µràVÙêó#{…­a1ú7Ï~/ßθ#¶ +- €iY‡úPpšŠHéw<·CR5ii¹D檕YÎs¯!oY4_JmY,z—˜±/hÎ42ÑhyyóŒç«qã§US3oXØ6SçͲÞ*²³7¼ÆTá97/ŒÆÖ-J÷æ!f–9‹ºzÄo{÷’9ð²y²R––@Èl‡Öš‘HýFÇÚ§5#È€T¹ÂÝJ¼¡…¢½‚Œõ§‰•e¹?ƒBFÐ3i+M¶Œ¬Ã1‹›‰BjÊN\).Px£®Xtû¦`¨Þ‹ni`ÄAÀ=©ÓR_öó)÷UÏ›+Õ1ˆá +a.Ì<§÷a[œºV˜"½Z­{j…[kš‹ºhG'ݪæ…'*ÕÑáešŒÍÆ?fxäTìl¾”¤ìÕV[9ûŸ(%‘¥(³ü7Ài·ˆ# óI;ï ×æ¨FDEÓ2äy]3¸H²€¦ÞèEšnÙ0„]EÅ/§R š$‚l„Ÿ~Kaé…w®w¤X4îè"h(Ž7ÕŽwÄ'avZÐÒŽ½†rZ„l®€€¦ÃA:(@Ê-h¾¢¶|؈+ƒ™Nèdk0óËæå·üÒkÅk¼Ð5; Ø:‘>ÐÜÿ?õ½ŽÊ”›H7Qñ3ÞsÙØñ{Ï-’\6älYàì­àí Õ ÙÎ-t¾õΘ´½Å¡¡çìž(åù‰DSäÅS£Ë„¸â)Îã<‡mSvP¤(–Å ±VèIpqW󓥋ƴᖠ„<æuÃË«uÎ¥ ¤†œÌ ÈS¦ z5òA^8ôç볨V­ÐÁ”è)¥/ Ñ ø~J§p'mð‚ö‹P¹YÙ+V7äW=Ÿ¼œÖ ñÄÙëaÒŠìkè[-<Êfµ9¹V,½®ßr™…0EÉ»µÄ×(¾ˆ¾$•@!ØÆeéÔI<¸aÇ÷vöñŽ¤CYK7Ç™ÍQ±¨Æ\m[‚›=:HyÏþ*L<ç#mÈÝ‹‰>| :;yŸ8ˆ4ŸÚ Ó8‡ë`›¦—SÑAW9GÚµûÍ°öˆs;Ÿ…>\òOû¡^•¨–ºä_fŒzâžGô–™¤ †ši|íŠÊNáþK~›‰fš~…Zúªñž½˜˜’Ë ­z^Ô¦­y³þšá¥ÙK€€qÝÇ›†!PCúοyŒgÓ4ã1zœ 1§™ó Ñ”˜*îÒ1üê«ñçd§+s*ž·®GŠ,º"˜¡|)EŒæŠ#ÓÞñu ¬ÝcL™`…¡,ë="•bWifÉ0M­šfŒä`<ÜñmÏ/?ý@åxž9K$Or°¹×â+ÆJ|Üy ¾nŒøùðå0±EØZÉ^àpë±mq9u»5D=€|hi¨û±aˆ$…ž•0w<ã{S?æ9üÀ }~¶+ìŦàg‚Ë ) Ö+àFr8¥éR#œÛÀÉC§ä’ñUÉSüëQD>lS™Ü?Eä\€4(=DŠÞ#W¡Sp)4¿è[ùŠ*ž.;y¶2©ëoÏYÕzÚo¿Zã»èF¿5îaœv8Wº-‡®j¤h—~¯U¥¶õ|:•¶VqYÆÁ³·Û×;Ê3êoF,¶h4&YŒMŽV†[`Ä-ÖˆìŸr®È.êx‰]#ÂÂÚFˆ­Eåp,YJ!t[Î#´Ò1pÙ÷R²H¯x¬›žç×zÍ"Ì(»¢~V¬“ÊB—¢1¦v»rðm ¦Ø?Àn.¦ÆøºÈ#éÒ6©;ŒGÆŒ-Ê­Q¥©Ê³ƒh×õTj_­»] e5æ êNˆ‡m²5Œ·Á—ñ;‡â¤$…Mó>kDtS<`ðrþàNžÐâl žå¶ †nm®Ìƒè½ád¥Ï2 Ÿs ÷Gú)Û{7›ö¦y¢i\7Ò¬>>´6YoŠæ¡“tÃÖLr`G”z’%¡VàúIØØ #‡«7‹®;ŽKÙ›YLjœç†_¢¶P²gU úAóy9Ñæ;p‚sNŠB»H‚—¾4GAoßvø%Öj3ÉÛ𠙉+¦BE×å*­akµ²">6j±®l;ª­™Q€¨ßøÄ%7%ðK<|WnÝÂÄ|¸[“nã‚â«‚ÐE7¹gùø‘x}ÂpULš¨¿~ü¸‹Ä? )Û“^F·ŠPo(ð=tm§º7ÔQôç<î–+ŠÞÔ¼%`ÁMÈ/“¿aôR»)¯åû©¾¬VßÎaDŸãÄÊü‚$wƒTž®¶“0p6d·˜£8þlÀ(‹Ìwëñ¼47 _O-œÓ¹sg¾?HžƒÃäùöÛÞÓÍÝQ•&94ÆVnNŸàRˆ¿Êes:ösÏ üÄ2O8o_ð˜a–áíÍלÞX NÜhQÅÏkÖG•“@ófÎs‘ëñ€2"xžçJt“¡Í=øU7Ê´\þ(— èF±¾ì1øóý#†ûÙ °rL$Èàž“?Iäî?wó«ë0¡Åp韤óÓíì_W·wcd<×ü²ã[T® (=6ÌQÝð¸Uú‘ÉìÐ\UYQêK €±sÁEEÿƒ ?îiìÑ»Ÿ4@ä¶",Pí¥¤áNX•æ‡ô +n>Œ3j!¸~u7&h ¡·7ñüýO”øÀ¶ÕÝ–Îêå‚»éS\þýJȂˆ#)¿Îjg«v;þ®q:»ít$¢ßû`?—êšßD= 5Š$O¦…ÿãˆTò•Ó4'K‰þwØ›ŽËz÷Ò”«uǯØg\pó_ý<Ïxt].šº­;½¬ÙDöïFRÙˆ½ +ŽôSñ£UØâ±¾.zy,5˜;Œ8zxá')Ø_÷¤°Äá +6ëTº9{’Áú Ö’Ä*u {)@Ü[< Ouc6ZÖÏ-ˆgŒàŸBºE]‰¡ N†: +"` ™øD­"á-ÑöÚB¯ªù‰ž”inw{*ã·E{"x€2ùXè€?füÿúaß¿ Ý,ÌÇãO !4ð5/(¨0LùÕ¿7> endobj -3044 0 obj << -/D [3042 0 R /XYZ 85.039 781.388 null] +6255 0 obj << +/D [6253 0 R /XYZ 85.039 781.388 null] >> endobj -866 0 obj << -/D [3042 0 R /XYZ 85.039 708.141 null] +2338 0 obj << +/D [6253 0 R /XYZ 85.039 420.88 null] >> endobj -3045 0 obj << -/D [3042 0 R /XYZ 85.039 687.147 null] +6256 0 obj << +/D [6253 0 R /XYZ 85.039 402.614 null] >> endobj -870 0 obj << -/D [3042 0 R /XYZ 85.039 616.511 null] +2342 0 obj << +/D [6253 0 R /XYZ 85.039 222.638 null] >> endobj -3046 0 obj << -/D [3042 0 R /XYZ 85.039 584.986 null] +6257 0 obj << +/D [6253 0 R /XYZ 85.039 203.766 null] >> endobj -3047 0 obj << -/D [3042 0 R /XYZ 85.039 551.084 null] +6252 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F11 2898 0 R /F20 2865 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -3048 0 obj << -/D [3042 0 R /XYZ 85.039 514.413 null] +6260 0 obj << +/Length 1746 +/Filter /FlateDecode +>> +stream +xÚ¥XmoÚ:þί@ôÃ¥RÉ+LÓ$ÚÒŽÝ–ö¦êj»º2‰«ÆfqRÊýõ÷8±ÄlÕ´U1‰_ŸóœçÛkºðÏkúŽë›çÏñƒf°i¸Í|¹ixªGGuéú\Ìï®ß÷šžë Ýas¾Ìçé;½¾ßœ‡ßÚ—ŸGóñãiÇ÷ýv÷½sÚ9?´'ÓùøæÔk?ŽN~{>™ÞdîfÙói2½º?íÚOêÅt ½çOòÕý㟦×üsÖšî.F§ÿÌ¿4ÆsƒÙ |C øGãÛ?n3„Í}i¸Ž?4wÐv>o€Øé÷|õ›6f¿ÌTÙ·^3uÌ>}àôþ¡ü~Á@^wèô†½æyßuún/µÐÉi§ßí·¿»}wŠã‹Éý š^ö’¡ `3>¶Ç(Xg¯1‹£}ÖkžÐ0k/pö|ÆÛ8kq–=‘z’&ˆf¿)aØ‘vƒMt<¹ÇaÓ|­fœ<¨yÂ0ÂBT/½¥(À¡^,{Æz–%‰„pšlÔ÷%§”ïô¨Å>U ,ààØrØ[éW›mãHšÌ±à—`#Z¸ŠC‹kö‹KÛ­À[¡Ø†ŽÔ&)FÂ8BÙ‚Ô»Há@ p뤥 ­a°UÛ‚¨}­0âTH„†óìbÆclí]Ä(Ò— +¾±Êˆ–³S`{0~ €j„3Q oÁ¹’ÑÇyVÃ=½±%¡¸¼Ué0“…~¿#±ŠŒ;D\ð¥‚};šª÷ˆ¡Vï:¯jˇwšÚt³æ"•þ—(lñåGÂfyJgÃKüc&¤>üº|âýäáq\÷ùêþîÃÇoaŸêúM¦—·_¯Æœr’蟎î4q1¾™LÿÝ‚pOGóZãéÕ/uüîù=÷•±œNŒ³Î6",ÎCØ=£f²Ýò(NÕðMÔ¹.{±ýlѦC2å¡ žàš–îN•˜b®U59 šF>#ˆæ +ª;˜Á©F©å‚µVº‹½ñ%Jh|–/D i£jm]°ÖW3,’8õ@‘δؠ¥ñZ¸ˆ$°Ñ‚þ‚äK­PöF„ +ç7ýz`Ï#¾k•â¤¥%we{ Á‚ŠY ¤~Ål)-÷8 Kbg DZµ¢±ú±æ»_³ˆøNhëi¢|¥M _H y°Àkô‚ËQPÔAÌ^HÄ™”~¡áñ;*id, •Ô&€±ohN:¨`WE=—5ŸaØ‚@vä *¸Iò:UÚ*•ÔÒxƒ9+…Êiبk ¢;´GÑÊ„Õº¼…œd2Ðj2¥©4vÊ1»5fõP†öB0Ro «YÊѽ‰«VUÆ8P¼%»&x¼¾Ìª˜-T·s[Ëˤíí ¨:žíš¥T…”VŽT«Ê®@ÊPdi¹G5!Fy€¨s|µŠòKQ_§—2Š)Çiª”´¬¦Ö•Q(ùOO¢++oÙ¹D27†¿\­KȤ*ਦøŸX8º}ý=« ÆmÄátKëlÐvk¶¹45oíÉBW¢µº—m@/LÌÌv`k6hm Ù&Ñ’•›Ò¹j„$y&/åCS‰Åf6Dòt—swmÞÚ& J‚VEE‚_Ñf«›VÑ6Ò>Zi®[Ä žŒF‰°*ÿÖ4¡tnÜ3 TXàxêÑÆ•%昰IÆ ãŠŸŠZØü0²hŒI i¸Ðûï>ã}™¿ ëŽQ²@UðeSìEŒ7²$pÖdqÀ! 98N?«œ*Û± båoy&Ü`Y-Ê_ Љ̤©ïkŽJˆð +|éÍÍboe»2‹Ž¤5íä%O +'ßè8…~ –ÔZçíFôN3˜ÆÄPÛd›êH¡lH ’ãJ·Šx²ÍO»+,÷§l6ÒÅ¿€P?$Ž6|@“°&xì"¿lãt}+kÉÞœ‰¯ “äL •$}Ö%°¶Þ,pÚ0Jè„©A«Ï¸æ‚Fë%aÌÚf·¥¼žW#z± wI¶Ÿ™L+ki¶ÚPÌÏŠLÍg8+ZJ©fÕ¹þÑ[2…~jÔ7_PTø º ¼¹–wDyä8ß|UPr›çv¡—3„ÿç§î{© c`©Þy)}¥G!†cËçoz¯xo +DþC!½º¬Þ{¾"´`IÏuÛ-`YF‡tÖ̉^¯•ý†eR—é›Gè\JãÇïn}×éÝ·Â_ê·®uÍ­vÏwþÐÜÙzÅ;Û~·ët=EÁ÷Ïm¼úú÷ðÿj2endstream +endobj +6259 0 obj << +/Type /Page +/Contents 6260 0 R +/Resources 6258 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6262 0 R >> endobj -3049 0 obj << -/D [3042 0 R /XYZ 85.039 385.306 null] +6261 0 obj << +/D [6259 0 R /XYZ 85.039 781.388 null] >> endobj -3050 0 obj << -/D [3042 0 R /XYZ 85.039 362.184 null] +6258 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -3051 0 obj << -/D [3042 0 R /XYZ 85.039 339.668 null] +6265 0 obj << +/Length 2628 +/Filter /FlateDecode +>> +stream +xÚ¥Y[sÚH~÷¯ ’¨ +².-SµvÌ&Ì8ØkȺ¦&S[£IØÉ¿ßsëäMj*å¨Õ}úôw®}Žð:.üó:Qè¸Á¨3Œ<'ˆ¢Îr{ávž`åÃ…'}!éÑ\Ï/.ÿ9PÏuFî¨3_ø„Ž +ƒÎ|õG÷ýÇ«ûùø¡×‚ ëœ^8Œº“é|ü¡çu®zQÐO¦˜àÓŒŸ“éÍ]Ϻ21õü§î~³Tó<š]}º¾êý9ÿõb<·˜-À7BÀ]üñ§ÛYp¿^¸N0Š:/0v–·€Ø U ïéÅìâ_–¯©ïjÒODNç + +Â#yþÈQ#Õ†®ºŠ4ô¶×ý°ë¹>ጔãùA¯ï{®ÛÝå»}½þ €··÷cF@ü¶Ì÷ÅRóÎRϺ@éJßC¤£ÎÞP8§ù2NËâ(†Ã°Æ:Óz¥W¼u<¨6rX’-ÓýJ7žv4x{=þ0™þçêaz5·C};™¾¿ý|3æ·/^ ðÏ€Åñn¿H“%Ín7yY•?ˬØ$Yþ³œÆÓ›ÿ¿MöIv¢Àx‘?ËP‹·»T¿;¡xïvY¼Õojæ¥ñ2Ϫ8ÉJa%;½Lâ´þrñ²2L”TÂ;!¾' âL<â1F:äc ºÏ®Ðiƒ“½;a~8¬Ôr„ /¤_'ÆcËÜ'²Ç"íBöíK m…VÉö4¶êª»‘è|©³ªˆÓô;¿nÁ(hƒÂxQ’ÌëS9Úl…T~/+½­ ½Ïâç8IãEª&×ke6Í+m0ÄÕ š—Mna–#wqQñ8 $Ù“ñÊíô!„¹(\ÇËh#Ï¿îwï^Q´þUëåjaeûíÂ#_7i¬&ÆÙ&Y²Ý‹Ê^’4ÔÛ]aco§ HnÛ8[Ö5X6ßèB®;•ÑI–ËD¼zNJ´FO G‰W¯û:T¢­ ÔB+}×u-'PÁIUàCÉ  vp¹bú…IñJeÕ ._wR‡¨8Lˆ?ªˆã­Et%?-­åÀ£!7ÿ×xÁR6rfuf{°O¤¬a“±ø¯8`saµÎ÷Tûˆ2F죢šzÏ©ØŸrÅ 1‡ï@I DkªҒߪÍ!ðˆöf:ƒ™w¼ +u·-»18¸Å›ýãÝa¡0(†4¡øJ6^@‘ä&¸òqêî©·!Bp6Œ* ê@ ‡VÁG-îpâ3ê=1ŽÅsÍIÔè‘çÛØq½q”µÂW°Ý¢çF >ªR¦³ó|4Ó… bxª“ØÏPq\"fw¶ÞenX’‚»Kœ8˜^ÀTøÅs&¯Gæ³$yÁÌOãOš1ñ©;¦LÊ–àk«|¨¯=õúá#šöÊÁ÷BÇ¯Õ ¡Ô xùéÚÁ¾ÑðõŽñˆ¦½vðFÊH {%­Ýd:3cè>R+•ðPz=é¸ô„W]ñâÔ¦|³ÞbèØ!q‰rñœ,5·’rpÈ5'ñm‹Ú°u§½Ê|Nûø´5'ì-ÖÆ<×õ.á?¿Áò¥'&r3Q&@3{=%ƒ°0‘ÈwÒ Ž¥Dú™ i”ðH^– +óšƒ+&¦èbþ}ß«].À»¬rjepsëâ"¦(Û ðW˜=5])¬ Û9ñT8ÅßÔ ×j/r† øß5OSWë:þ¨é^‚?ö·~‰<| œ(5_n¡ï;¾g° ô ˆNñš_,ÏÿQüG£endstream +endobj +6264 0 obj << +/Type /Page +/Contents 6265 0 R +/Resources 6263 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6262 0 R >> endobj -3052 0 obj << -/D [3042 0 R /XYZ 85.039 303.604 null] +6266 0 obj << +/D [6264 0 R /XYZ 85.039 781.388 null] +>> endobj +2346 0 obj << +/D [6264 0 R /XYZ 85.039 491.353 null] +>> endobj +6267 0 obj << +/D [6264 0 R /XYZ 85.039 470.36 null] +>> endobj +2350 0 obj << +/D [6264 0 R /XYZ 85.039 386.44 null] >> endobj -3053 0 obj << -/D [3042 0 R /XYZ 85.039 179.477 null] +6268 0 obj << +/D [6264 0 R /XYZ 85.039 364.031 null] >> endobj -3054 0 obj << -/D [3042 0 R /XYZ 85.039 156.962 null] +2354 0 obj << +/D [6264 0 R /XYZ 85.039 229.148 null] >> endobj -3055 0 obj << -/D [3042 0 R /XYZ 85.039 106.742 null] +6269 0 obj << +/D [6264 0 R /XYZ 85.039 205.83 null] >> endobj -3041 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F35 1632 0 R >> +6263 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3058 0 obj << -/Length 2181 +6272 0 obj << +/Length 2697 /Filter /FlateDecode >> stream -xÚ­Y[o7~ׯЋÑ°os)°ÛvÛ¦HŒl­ÀÒ<Œ%Ê2efÇÿ~Ï…¤‘ín5$yxxÎw.dÄ4‚bšš0RÙ4IE¨Òtº,'Ñô(¿L„›¡ -ÖÐ!Î=uË0ÒÉØ™„2QÓ¹ÔaÑŒ“ëŸe4•QÇjºXÓÌÅêc Òp67& -~²í発z7›«8 Þ7õŸ‘Ð…åî; åUþ`K[u³O‹ß&ÿ^„ò;ê0£"E0G… -æ<#¯Pa&ÌP^¡C¥ãyJ¬³à÷:/· Võp"q{Q>&iöœ* «ìËäã§hº‚™¿M¢PeéôÚQ(²lZN”ÉB“Å®_Ln'ÿž5B­Ó‹lhQl¸åfs1i be &@afÌP#w3!’ oªÙ\[PÆÉá#ÄL˜Hb3ý"gBkEÔa›„=,¢ë7¥œþTƒXÓƒd* %ˆÖJcÑË&Ò©vQ6” L*Y2h¥¤ÑÁn&Ó > ©t,6ZžÑîw0P„‰5Íî ‚­›°òV+\d%Ñ×<›;w´1B$ûÆË®™ðÎr¥«Vnò¶ZÑâGÂêM «et’›…¾–Qô-hÒy¯“ƒaJ)D~J2®+»;çFã7 ì0.xdYlm…Óº–Ùl=üwýqK7ƒWtÛºƒ`wmó×̦#âÞ‘õ@Ä>|¯ùCG€ï±00À!ÞaŸoH¨˜~`zó‹íÞT„žÑØ/{ÛvÜéÜ`·aUÆ›ýù+nçz´‰Ÿþ`ýú=7…¡£í[Û|2ha0F¤,ìCØÌ;Tq]ANˆÓ$øÕÅÓ` ܘè aŽ_XÜZæ½bÆÖm…š®;nãqsdè¹â`Ãóë’»ì?¼CÎC­ÝåMÞÙ‘ˆ²ë`A¦p6w08T]án „œÁHÒ"’žxšÎíýÁ ß9~›ºtD2-¡± ª4˂ņ<œé„Q›W®KÖÍ;îÜqýãúÝ+ŽA¾Ó8l(Ô4mÝáЖ,ÖYçV„ øÞ“ì0IàʶƒXä¦Â¸ó–çCx ÔàE¥ÒÑWÛÆCg ¬žf ÍW»•Ž²÷ÖQzìQ8åàQHÎÝ:ÛÝþ 륷õ™Æ~ý¹íü 1‰»mX3 ‚Û™ÂB™]¾­.‡®2'ažX7)MYeËU´ê4g#eGp@pÍÅdëÓ±Sý}ªû "¹^¿ÊDcñÿ,§ÎTy)äT!d(9©^,E˜Êø¨h<+‘¸hpµîm^Þ£*â8ø‘ÖÞ|ÇŸPH¨ˆÂØi1¿Rä©V…+?/—›Jšg…O×Róbƒ>ªdä4É>ÄAÇ]ÔZîËA¸—â(Gã<ò7?ÊÑÎX0 JÁÕ¤˜Ív‡"ù–›G^â!Œ“L¤ 2hŸß€tÈq«ÖW»ùXDá¨ÜtáEÅ*P“2/À¼ëgª=ÀÂ_)nP°EŸÑÁò¾å†!ÓgK l~Éæ³Tqöͺêõ„£2Œ\±³©8ê‹Už¸ô½õÖÉ#”RTl8ºÂÄÞuÅÇJ´÷yñÉÉá");ˆIÙá½€ T¦^XNè¶ó[Œåu›\õ×:Šk&êƒý–—»Â˜ø]ÿ¬† -åRÜ€+Jd4ñ.8 EE'¤Ö?ùó§PÿvM½Þ‚UmóÕ6à ¤ËA`÷êþ–ŸçÈžóØÁÅQCwV|“ÁˆØQ ßõù1/\‚§IxZNÎìU>#ÛÏTˆŒinÚNÿWµpõß»£ÓÈ~ìP -.åññ©7K*%âàê-)ãCAQ@‚iÝPí¾gЮòÒµO‚+D¸E%bûžŠ/tEWa ¯È©¤…ÈË,š¼ò©glW5a‹Î!"¹%©.” - \*¥ VvïÑXxoÊÌ—Hë|q…„ËŽƒ´mËZÕbˆ\Ðj 7?U5¢x×âW7cL8Æ8#,àŠ -'t>\â _ÉaXúáNkgN7O#üF™xõ)[gÿ]sp·8glÒ0ŠÅ ‚kGG£{ŸðÑ:Ìô+Ù ÏÏ•%øD¦É9`Î7'RýjMÜ\ýì âi_}íŽåqŠGð]òå(ï|:GçÊTﻺ„i™2¬Ü]ù™éƒSg&øˆV3ÚOnÛÃ%q»¤6^Ùd¼Y3³'dVïÝf»&šª8Òç¾õ%­Ö´ŽHqÝñ+)’ú[´ùB¨Å¥g IßËu’ñ%hrÑÃÃ,~Å[ Ûjä¥ÆQž¯ èx}A}ö+uéÔ?ãýor€ %ñ‹räŸý ôæ]0™Ôòë]néf²âyXk°æ .dc©ñé,>2²KXÊ$|OÁœ…ûÆÝѤ÷½¹°‚ƒxþ¾°yk¹Biìú𑸷ˆdðt‘ò½7nôà(\rÀhÛ§ ð¤¶I\å”ø[.Wh®DgJ½ö›Úó4³Â:gøˆ9x"†OþùˆozTö/û(í.]2¸Â±·¼³!4®nÜU0w³{W(ø=®„®!NY àÆÊp(s1-¨·†ÅîYÑ %¶É^‚”Ðú Î3sò þû_9¾ü¾endstream -endobj -3057 0 obj << +xÚ¥Z[sÛ6~÷¯Ðöe©‹!^3»Ýq'u›Øi¬®š>Ðmq,‘*IÇö¿ßs/)ÍN’±IÀÁw®8´;qà¿;‰|ÛÑñ$Œ\[GÑd±9q&0òñÄŠ™Ì:4ïæ'o>ÞÄuì؉'óûvßö|=™/ÿ´Î9û2¿ø:i­-ØÓYFÖåÕüâãÔµ¾žM#mÍ/¯>2Áç~Þ^^½¿žªÈº•Ž«  žßb×õ×ߪù/üvsöùÝÙô¯ù¯'ó†ç†à/F†ÿ>ùó/g²„ÃýzâØ:Ž&ÏðîØ. oN€cÛ÷´´×'7'¿7Kñ˜7áYCøø:²ýHï¤ý@®Šm/ö&¡ìØ÷ ¡ç,¯¦3_ùVõ´ÝeÍóãªÀcÁ3Yˆw§¤å÷´ìÍxyy±;?8ýÍ·ËÅ,°U¬jÇv€SZq•–)béY/€4MÅ'­àZô ¤³ŠŸõJÈ/¿pG²ºe ¿`ÀµªŠ‡‹{CÏ#ØÒ VD[~G¹¦¥="Á ì(Œêe‡†`W0êÙÚ vWÙÚU“Àì»àÄ ‹>h#@j› pWäÀTZeYLµc•Õ?²ÌA~Zâ§'€†íÙ>¨ò3?ÿò±ô#oA`½½,6À5  óvªÑJÿYsÌV| +4hN²€ŽÇ±#„>0s8ºuhÆ­Ö÷C;¿y;<‘DI9âUXeš¬ùmÊé’‰®“ T8å¡‘*É–2ï§K!FÅW±om3T•îÝLA_y J¨u—H“ôÄøQ&¿'o°áÆ--´,Ȇã–è-žj^Åì.¦·¯õyQ³öà12 4 _’É(—ä( ÷Y4t’抦‰öÞsX¢ùr2´¬Nos8û'bLÄÒåŽ< +¶!&°{— ì#o—A‚8„ +qp­/ü~¶ÖÔ•í‘íÚŠéž3ˆpô–§õ&!ž¹Cù¾m~`ç”08 ’JAJƒ8D,a¥v"%÷}s|çëÒÓ 4\înϤäLЉ¡Ÿrž”¬¸¯=Œ«Yƒ£zÑ" ¨zä¡îÁ\Ù37iBüM{nÝW›$P4F_ÊuA>löDÎ0­I¶M´ÂN暆9T‘w|©ÓÛf*ûWìÉSz§*aÁÞÓ.ÎÒÞ?µ¢© >–C0® 4¦ìÔŦ• £ƒòüž”EU»Ä¾==e™†"SEÐhR±CŒ´¬p=y:o”7®nÏ«LÜ¿ö•X!¼ÜL#Dð}wϽ`_ÃN!aùî G8n8"gªòFù<0ãǺx@ Øó'}åa`™A£Ó²4Ž·@φòdÑŽ±ÄÒóBÛ?’XvhÆ£š§µh·Õ”Dµÿb.IÉÆ©›5i&t=sÇ@F-ŒvàJq Ï‹tõs,õ4\7œððZšñ¨éP‡t„³®¡l6Æw3µ¿Z³sï *•¸ž­¤•˜;9Ú`,™êíî© ·:à"5,9C3ëñ¹½ÞU,²áÒЬ„ç% ÷v„ÝÕ‡7d’ýýz8ë.ˆ~o¿óu–R6[÷º^ŽŸJ.YKú÷d {onQ Åv~?|µê¯/¡‘d…ö4r¤às ä–èÈBt äCw÷¹³_d0*è„ÄúòmÂÆkxön% +ó9ºWµ´mx©šðõ½Ì0ËÂ(.Y­a\V»Œ°Ò8³ßé4Üæ ·"ÆeĶwDR†ä€œˆä˜”Æ·22êï4(¡f§3‚¤)Ý e‹rujðçlÓ”:²i“ƒ˜ËÕ^mbG¤cðC +ùî´DD DÇ„phC#†ÝýÑÙoLW×óÝÔiÇfÑx}›1 œ7%—kÆW +g×<ÃäI½´Ð°”ü˜¸†\^ßðÒdaƒ\;‹E>Ë$@¤_%¨FˈÔn•ß¸¿­Iÿ˜t.±¶j•®×§ýoÅl´où vÿ;zh»‘’/Ø\³:û ºN7[|þœßÕÿù“øŒE90 _…¶#R* +É>T^¦Ï͓;ù8 ´Ìe)3M#Ñë–É!U…]Ÿ X!oØköþPÖ›Ogç¿áGTDZþåèŸ(ˆÞÖW—¿ÿqºÐøš>`]/g# ¯c«Áà?¼ÕýÁD§öhGz$ÂúJS1¼àÑ´Žwù5X±Çðÿä’9endstream +endobj +6271 0 obj << /Type /Page -/Contents 3058 0 R -/Resources 3056 0 R +/Contents 6272 0 R +/Resources 6270 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3018 0 R +/Parent 6262 0 R >> endobj -3059 0 obj << -/D [3057 0 R /XYZ 85.039 781.388 null] +6273 0 obj << +/D [6271 0 R /XYZ 85.039 781.388 null] >> endobj -874 0 obj << -/D [3057 0 R /XYZ 85.039 761.463 null] +2358 0 obj << +/D [6271 0 R /XYZ 85.039 676.879 null] >> endobj -3060 0 obj << -/D [3057 0 R /XYZ 85.039 667.044 null] +6274 0 obj << +/D [6271 0 R /XYZ 85.039 648.143 null] >> endobj -878 0 obj << -/D [3057 0 R /XYZ 85.039 667.044 null] +2362 0 obj << +/D [6271 0 R /XYZ 85.039 590.109 null] >> endobj -3061 0 obj << -/D [3057 0 R /XYZ 85.039 639.536 null] +6275 0 obj << +/D [6271 0 R /XYZ 85.039 568.913 null] >> endobj -882 0 obj << -/D [3057 0 R /XYZ 85.039 406.729 null] +2366 0 obj << +/D [6271 0 R /XYZ 85.039 447.579 null] >> endobj -3062 0 obj << -/D [3057 0 R /XYZ 85.039 385.533 null] +6276 0 obj << +/D [6271 0 R /XYZ 85.039 424.261 null] >> endobj -886 0 obj << -/D [3057 0 R /XYZ 85.039 343.373 null] +2370 0 obj << +/D [6271 0 R /XYZ 85.039 324.915 null] >> endobj -3063 0 obj << -/D [3057 0 R /XYZ 85.039 322.172 null] +6277 0 obj << +/D [6271 0 R /XYZ 85.039 303.719 null] >> endobj -3056 0 obj << -/Font << /F20 1617 0 R /F70 2201 0 R /F18 2207 0 R /F15 1628 0 R /F35 1632 0 R /F41 2104 0 R >> -/XObject << /Im2 2261 0 R >> +6270 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3066 0 obj << -/Length 2349 -/Filter /FlateDecode ->> -stream -xÚµYëoÛ8ÿž¿ÂW`q2P3âK‡EzMw³›¤½ÆE÷Ðí%–!²åJr“ü÷;R–m9×ÝÅ¡¨I©ápæ72rÂ?9J¬u:Š)t’ŒnGáèf~:’nE82"Œ,N½ž¿ÔH†" ÓÑtNK¦³ÏÁ¿>y?=ý0žh­™ˆñ$Ž“àÍéXW¿ÂÏt<‘Á;è¼ç%ï?ŒU¼{{v~Ê„‹“Ë$ýkN/ð»ËéøËô—£ÓiO’‰&Ò(Ê×£Ï_ÂÑ ¤ýå(:MFÐ…LÓÑâÈX-¬Ñn\]ý§ãÂsfÄ_ xbT$TŒ+•üïí´M…M£Áí@è$adC…À†{nõ6 ÖÅZ¤:ê Ä©µ}C\V ºµ©”ä0ú:’"4iªy¶×'97áøl!Go*h´J§BÁî -N¢U'–Lðqq5ž¨DŸP²D\Î*4÷Cƒt\"} -ôcõ+SnRâÒ{ËÖ­Ìø|Øm‹͹™ÌTÜ]V-ï7+bT-qÏœún*sûTË¥ßäf‚:CEIÄHJ¢·|<Ñ‘ ÚŠÛŒ›†´\Ëk_#à oÇ*ðpÄ3w—ÕmµlÀ1¬ ƒ³–‰EƒmÔÕ>Ê5Ëgns:÷/ßM¹³nò!‰ïˆzüV…=SÈz±³Ç]µÈ^´e/m…ÒÆ-b)ÚlÒP…üVÜ0¶&Z…$`¶p4LÃÝU6ViPã!eTsnQ,žFå ·ê÷PšÒQ›»ÌÓóŽ l'v¬¥ÂÐÄ$BÇæo9Ö}W¦ñhÒŃ¿îëCàÐІ"VC±Å/€=ã¤s™-;y—(*(@ -E¨IƒOz–€.F=B'}Ä6Ž¹¹pêƒîdž‘ïkÖ´GY³«Ñà wüœà€¢$ÚH.í€äÓq¢ª&Ôì$kØxµ÷ˆƒ -Qp„wLhè,8wÌÍEÎ䛲/‚u-q{ T@ÇRª5/] Ó­äáHìÆŽO{7îú/Èy’+û ¦¬2„aÆ®ØvèÎv•-PkXl¤ î2<‹ÄD'ãÁ5½‹HBƒËGôo7·$dÖ:&¹ëlÆÇw$ðÞFwªúÞ á…y@õäe‰ªüd¤zž*Ú1«T+ -ph£—ç¬s°bN›€"$m§P -#6ê!!’Ôc88MëÄPØqQ§œ(ò/wº§8º¯Yé ÈÃE}™^?áÌF;„©[&vÖ†¾7¶ÔWœÙÝÈ™tazð‚²Ú}Óꦭ17qBajÒqFÚ¶/Í'JzpÉâEîÎÆšèmÕ‹¨u£ðpÐJGMõ?݆²ц“bQ»ÄW!Ó'ôNˆ(&Jƒ×ë–y@2ÂÂ?`*ƒé?jíX.ÀM%©!€šîyA§2œ»É–»RºMÏæÛË{X³tvN7­ÇXÎyU–”á1½zÕ"I³›Åûh”ÀZ§>«}¾-)•^gå—,-dâ¡Ë’ܸ6 \­—!C\DßdXÚŹœ$K"«¹ß÷› —;ÛàOVß.Œì°Tp •j¸« DnØ=5ìÖóøbŒ ÞŽAår)õ±[‡ê/BRC!Û¿Z­÷ -¡íú³ÇŠx˜•çÁlÂ55"¢gñÊûN5ÎAßø*¨É®é© q‚.ô¡=:Ül¹;àÕš”¼ÂOíü°¯I%Ÿ•=†_aûÚ âE_±ŽËùŽÎ5u¢0ááÊùR²æ¾{?›1‰^ʀËŸ}^ÇÑ"óùgÜäKäWÕ79¹H\!í&QbÉJÞa˹t$_=´µ{mä÷ï¬ðEQvíÀŒõ†­‚àÛáD?¾ N…Êô.¯‹Ì¿Q¹×•ŽB¬Ywõ+ ÜíMÕçéWÅV‰(|Á‚¦#ïÂdï­ün.3ñ.[ë.;L}Võ> +stream +xÚ¥V[SÛ:~÷¯ð£}.Ç…ç+¥XqÏã„ey9>ó$+F^¢X™åg¸œÒ8Ëò“‰$lfùÐå U“âÓUž“4]¼Ûò£3.w6ï¬ûR4ø›s}+Üœûè®ÒÄÝ€,¸„å¥óP+;r¦Î—­i—v½ŸP%> endobj -3067 0 obj << -/D [3065 0 R /XYZ 85.039 781.388 null] ->> endobj -890 0 obj << -/D [3065 0 R /XYZ 85.039 627.355 null] ->> endobj -3068 0 obj << -/D [3065 0 R /XYZ 85.039 608.404 null] ->> endobj -894 0 obj << -/D [3065 0 R /XYZ 85.039 366.597 null] ->> endobj -3069 0 obj << -/D [3065 0 R /XYZ 85.039 345.396 null] ->> endobj -898 0 obj << -/D [3065 0 R /XYZ 85.039 239.608 null] +/Parent 6262 0 R >> endobj -3070 0 obj << -/D [3065 0 R /XYZ 85.039 216.892 null] +6281 0 obj << +/D [6279 0 R /XYZ 85.039 781.388 null] >> endobj -3064 0 obj << -/Font << /F62 1689 0 R /F70 2201 0 R /F18 2207 0 R /F20 1617 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R /F41 2104 0 R >> -/XObject << /Im1 2193 0 R >> +6278 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3074 0 obj << -/Length 3062 +6284 0 obj << +/Length 3210 /Filter /FlateDecode >> stream -xÚÍZYoÛH~÷¯ü -°öÁk€]Àk'³™Ä¶6ÖÂ3Èä–(‰0E*$eÿýÖÑMRí,°`õQ]]Ý]õÕÁˆ‘ÿÄ(ò]OÅ£0®Š¢Ñ|sâV0óë‰0ÞH»^àãÔ?f'oßr$<7öâÑlI$³ÅçâŸçÓÙ»Ïã‰RÊ‘;ž„aä\¾ çö#ü™'¹ƔI¦ŸÇ2rnÞøôŽ®Î¯ÏqèW yw…ë®g㯳ßNÞÍz’L´«…¢|;ùòÕ-@ÚßNMx GJ:ÀEIržÝâö%¼³†FN÷º¯C5žö©™´\ÒY½½CÎË]EÛ*íl˜?ÝrLk¯àUùü¸Ù3Û ¤MÃUÛµvfë”I–;:çÎ6iÖÜ¢ã⯥+·MïméðFFqÔžâ„®ˆ$ØDäFRðŸÊ9Þƒ/}xðÍvפ÷¦ežÍŸÿJÓ‘i©Ø;÷>=¨Ë2[íªÙ_&÷–/6Y‘zåcÊ‹géf›'MZ¿¶ßísݤ›×Xÿ»n¥¯Êe–÷øM‚È e0šÈÐõb&¿Ìêä>Oá%7EþÌ­ógÐ?'xx­|sL¸+XVnñoZ5+âÁÍèÈž2+ÌNs°hÔ…Ž¿ "Ð8Ø9®ï‡†›€dœ¢¨ ‡äGkO0$J€Â[Mrß;:½užÎ4æ‚uäl;­Hù‚eè¹¾Ú·zëDŸ²ú#ÙY¯[”^ß wZ»¤EäLÑË…Ž!¶|>í»>Ìw·z|{2®²Õ}£ø~ª úý \ø‡® ¢9e_Ðåã+Ó4 àk#ÃE½Ëñö”oBÀŽTùÇŽT…Neum•í¹åg^ºÚáðÂ0Z–s2×lz[0(¶Xž'•ÙãEnÞ!E± · ÊûÎ#rJYƒl¼ÊÈÄçï¿/I #püe…qH¤8ž€ñMÂngA±ðÕÊ]Ã4Oä¸M¨@ä„ô¾8ÿ@R<×ÜkJþ¥§ì´¥?e€ƒ6¶'7$v`ñ ·*É™`+7j*sì.vlPèÛ"Ú}×½\YôýZùàâ`0‚F9„Ä_äC«<àÃ-&øørŒâÈU^ØÂÁô€ÿº“e?È üÈõÀ݇ѷ‘p=ÇŠg{m´[Do?lÄ貉FP`%M”r…ì’ ø£™ÈXíÓëfø$óšgéiúÖlK&´üÙ,˜ÏÉêQÎ,ŽZvœ”ࢴª Ãñ5eKˆ&$-!J gR!Š’Ù3Qb¯&åÉj‡°?†ÖBtp‰³ÖÙ`ûŠ]3]+g=KÖXš´2dÝæ=I}ôsÊë(Ÿ™#ÛØw>fÈ"§Ó>C¬Z™hçñÇ$Ð)¬¹k_kaU¨‰¹ÅXÿ6‰ZO™0+ )ˆ²±š‰ z„7Jh×ÀÕ†Êgýs01A,q8šàºøç°«EB鹆bQK@À»È!`)¹p Ä÷=ë´ /÷Øc¡sö•Q(Ý©1© ä<0²B÷wÚØ÷ù<½¢—F“ÃéÞ¿„òÒUR×r&¼~l8¥äÕí¹¯;·À“ëØ–#D«Y*œø/>Å[þ¹êÎ<퀻·i³Û¾rã²^9t£ ó!{¡ùnmaŽL#¦ÄÞóØýSŠ)ïn ©aŠ¼Äü[™YJ¯ý;*#ìÇ(0ÿ~Æ6õ8£7º¿-Þâ%ZÔùB€™ÙÇ0jA%eÍHĪf¦IÕm@¶™/pðô‹œÈhá\¥î¹;=ãêÆé%ÃÏt¹m‡9µZU WkNyuG††çœ^“`tLÆvS€þ)bfuuMLÍ)²Êïe©UœnÑÞ «|5XA¡£4½TÍE¨§,ϹôtocrÞ´hÉÕ«½¥ÒÔú ôµç¶ ÿBÊx -Ôp tÁ´¤1ð;7è^®,ƒÈ„­Åq¼Í˜qþ©Õ´¾YjÏ$ç?±Ÿ" 1SñƒÌ0-’ɵ‚àïáÐh4(um£þ{6o»Î09“Ö Í`t]áï Ý/xÜäÁHB„MiÍùWœ -³†nK*Óm¸ÃÆÄÁ:(i‰ã˜ýc€ó¬7ȪH­†`Ãœo ¥i'DZ^~Yå%¦«IþT9l™u<†Œy[õ­‚µÉê¸4P¸Ú´þÆ(‹bC=¥+‘ÎimÍ«$Ûªm•~³™Ùâôò%/ ž=åè³6kx}18k5™ÝL ’ß«(O¹V€¿dè L[è9K¦Þ$™y+ØÍ’òÞX^Í4<ËÓ¦éÛ.¶ôõš˜7mNÙ$…©u“ K#‚$<*x™dÎÂsv5H6¹ò -¸ÙiHåZp×î0Ùú=h[ðJ(n0µê$7ÅeS\‘­³xc´GcΗ.Ó*-æ6ã›èP:–¼ +k@ç)3J²Wí~!#%˜Â”˜skcÏKv†T'a,GæU_B",ì9D\½î{>w"ÑÑwö®šWç×gÆ¥£Û@®‹Ô¾6­[§^ùTÂi Ë`I[4=xó®TnŠX³á÷sQ¡wø“ðäzÌ«!Š8b¹:ò¬b:Èñ•¿çFµVCA‹†×ÆX Ißr÷*å_ûÁ„4EÔ bgUò$Y°¦¼ˆÔ¸*s˜b7)Òœé&æ{B?‰†üÍ¡u~,кª-C2Çšžê‰´»Z@eØb×ãypk²¯ª¦LÚÕ -#ã=T$±0i@žöj)øàXá²#ƹ±çÜZ~[•’?Ë(À6»f€Ìy”j×:%[@ŒdÏ’:³>VÊiç6ŒFÞ|ì*Š(ê®aµå7>T©È•ªý”ñý\Š"ì¡LÊ̼®€EÙ - WSYó'öhŸïì 8jƒ¥Þ÷.  ‹ßžì%Vûß*½oYðÍq)Mh WÙ¨„4+øï­]þO¬] SQàÞî*8F9™àœLt9ùáþ·QÔ'é‘©+㬑÷…ù‘™;NN±ËæŽÝAs!yVò5sm£Íkð;Nlé¼÷_ ("Õ²½È32VÀ[Æ*<.S1ºûä•o“ë°F±X¦&>$—€œÔóü×ƒä¹ Õ;£^vŠ)œC—j?óúAˆz_Hœ7ŸÊ·ø«®y<<úU9—%Å\Âyc˜AäRœiº¯áRüràêð…z‚¹¸Ÿû -?ǶðºÔÁ ´$­€ÿ+A²endstream -endobj -3073 0 obj << +xÚ…Z[Û6~ϯð[åE­H$uëbQ´EÓM‹mÛ)Z íÇæØBdi Éqæß﹑–lyŠcŠ<$ÏõãaÒUÿÒU™Å‰®VE™Æº,WÛã›dµ‡‘Þ¤Ba2gÆ@{apãG7¹ŠS,ÒÈ›"­bmR¤ùöáÍÛw*Y©$Îs½zxZ¥©ŠuªVyeb£Íêa÷G¤Šx½É²$úuFíz“F54¶Ýz£“h‡ßîíwÐsÀ¦]ë4ê7ë¿~|óýC`@öÏË*VyµÄb²Ú(ëB¿ÊžgqYåSþS'Êgüƒ@RUyþS<©¢wk`ÙÙñÔ;dv€#äydÛ6Šè[׺?“ÔàØýÈÒ¯òx¡!Ól•&q•T3UEA<~ÿi­ÊÈõ/ÀHQEu òÜÖÄ"ðÒCK†ˆq¦nñïˆT¶idøˆ‡ƒ>»TчÖñh÷Ä¿ãA:ö=HšeÙ0Ísê#uŽ0|êíˆÊïZásà¹5[†_‡ÊLÑ(YO`-ªˆ¶¸’Kçp°ÃšV¦jËÀ#‘;bΓh›ðÁ'½vˆð¸‡Ïg;ŒÜÚ9ÚØîø„´sÇCGûQ–ÄÞZ&<Óö ¨aZ#OxzÙÉ’^ðO׺Yßf*ƒŒDp>8´:iÞ~OƒtXþ!.»ã3Jzt=j/ÑÑû‘Gƒ| ÝvÒi›3nhiWDá•áej"h‡…ÌX—&ú{Ë C ÀCZbf¤Áâ²ß ¬7šè^˜Øw :'ajÚ®dƵñG<’Áà SãÂO#25I +ÈIRZ{{àÎs_£»^À}Þ6§¡ö‚„Á“Ô2‡MD{ŸèäèKäÐO–¿èõ¾nc:Ÿøðôžx+ð@ld~팭¢‰îúÑy%ÀÇ%’mµò‰[v§ý’‰Ý…¤`{þìd +ÚKÏŽP£‰×ížZÚo"’zr?0÷é4+(X$ŸUy˜Ú¸²ùö]žO²ªNÒ8ÍùÝ®3ÐþÙ¹gü{xÖ,›,Nùð$P°IŠÉYÙ! þÅJ™™<´‰j»qǺu;‰2“ØÚ‘Ðd…wj^&_¶6H¸oºGJí<†¸¤‘°Å€äù5©óô`{Šå{¡iì(6ß4¦,cõ7°kBsv™BÅ&Wv)]¿8ǽrD·À‘)”å›ÐäD~}ï²ý«ç¸Ð܇fÆ”qšÒ1¾›‡6äÎä!¡…Rú þ'9&¡d¿ ˆ…lRl =â2SBf'’L<çóšP'´0é‚Øœ "Òòe"ÄÜä\£—5ü!ÛðÇØSħu›µðGnJ;wLebä¶ë{7 ]’‹BàFÆ(&-£‰í*3⼶õFˆÄ#Y¶€Ó†[á8É +ÖÚ“û(IŠ±lå¸ #‹¢Å! t‘æRÁñà–Ï—!BÖÃm¼ìÚ |\ˆ.&Îtéƒ xÅ”-;hìöÏ$Kp„›éB°I“2N²JV™aßZp¯äLd}˜þ†ÙbK ŒÎIB&nm;CÌüÁ$N†<¨¶}íÐŽâ› òÀÀ¨8«Š™-_r”D55·+6zè½c¤Ã|nC½cÈáThMÆD?ÚBAU +Æó隣ChÂtë€ó{ µjYtÐ + ”ßÚ>P“›…É2ò ìv$’B~>¢2°‹mÒ{Üi$TÑö™¤Æ¹ÂñJ—4×£EÍ"óܸE›B¢‹è×€ÙøÞ‡;Ú{ì.:6g [‹5³ÊrŽ:3v¼ž.HNƒ/žq¸¾§JÐ’ ë%Þ®`Œ¯° ¥))AŸe¢Å£‹[tÀ‘ìc¸ÿÉ6î³0ÙÐyéµÎ§a¼ðŒîãpxàû™ø«0µ¼ò(ÖS‘ƒ{© < Á Ęh‚•±ÇÍn¬Øsìx›™²äŽD¬ä=’µ3Ýxèá¦udá]˜ê­ é,áËé=?çE'Ì +ú¢8‘d¹ï)¨® ^…|kÒÁçDfÜ¡ã"õi€ךhXä6ð +[1þIW1 +Ù4þªªŒ‹Ä£;¶UÐþ?ø'|ÿ‹ò,ÓùBÞøefÞðºûe)Ú;§wˆ) +Š×ÒY™„ÊÎÃ}IÅêç…„ærQðÖDIDVëÚÉxwBê_¼ç#ïÞ=a$(0íº—ûÑ+!7îyµ¬ŠliÆšÝBB«ÉÓe3Ç4°IPßÚÓ S9¡=C¯È†sjË­pBÊXŒ^ü¶˜bÃ4t݅赬/ŽË® 94KS€ÚÙž€ Ht%ˆ°W"ÆpÖÔ‚}úÀ~¹pbóÔrÃ⢟Ö /Bnö±‘íìx nÊãB›•›¥RxÄ~/ÿ›–‚…z3!¿º×kRŠ/‡1"Ý žå[@R1…˜ý5@UÎY¼àBò:_Wëð­ŒoaUWy93ÄFbe½ç†Ý±H%˜P°2RÇ4å¥TûÚ•d"SÞÑÿU>ô.A3²™j‚ãàƒ‹'¦ c§»|\"w¢ŽbÈÊ –v¼FrB<.U×&…Km.UœP8 µ´N +oËÊxe&JÖ³Gç‹vóÀe½ƒkçЋkÔx?ígõµé5ikG–þýŠZƒQ*QØÈ[©°uƔȂè0µ/ÏT”Qp,`gš=²@i`RÄïIQ"6ø ø¨3¼Ç8,ÕØãt/î8 %Æ=çÁ/˜TÂ,µÿSß/µm{N^ÙG¼ä:úw´9)ÿ÷cJ¬¡pa¹zDåaþ½­Ñp¨b#­ÛwcÍu}‚gÅLz>RÞ(¦¥Ùbª](¾êúM€ƒòà/m&ûnœ<t œ<_xÀ¯Ý ÑAp1%ùÞå €uH©/.‚_3ÁŽÙBòÍìÅ‹„ìép!È ¦æ<sf¦Sµnw´ÍLJ…cüe<¤áü;nl›ZžyaÁÕˆÖ¼˜BM7p&ëßjº±‹ñf†±Ÿ|‘>ÔOki›è÷ÿJ"®KjI‚3 xõô’è;o?çºw÷*Oiab¥óW+6šû•§4Ëc`ÁWž´Tž~±ÇG;+(x}ÿ»GJ¿Ú«l]hî’RÆUÆ•¤oPüiÎé(Íè–JÀ7sèÑq‚š#¿Ëå¢D¨YÆ1ü}ö–Ú4¢:èÕAKÂî,BS¯a;J³‹ã§¹è ¬®ÄB•}êhñbŽá¾ÔÑÇ·Fð‘Pœ%ïð •€ä™äp»aþóÊ…T®ûr±øêZ›i’ÇeVÂo—¹YT§§ÙLˆ‚™ÝêSˆ¨&ÒÖŸ¹DI•EÝ°P¨XUéë,Í s“*±,SÎXx8ÐEÄd‘ÿ½<²ä ¹Œi¸˜C³8ÎôúÂ5˜° -‘²ç¯Nž/zŸÊy­á…o‰îFSÀ æA¢XPœ¤zûwîÉ2Ø +utº­éF-âÜž¯|ßüòÝû÷ W:UNˆ¾ôȤæ£Ï‹ôô²gc 9Høgnè/œDÑï˜Ä¥"Ï^·ª Í}£ 0›bÉ#ÔË$^ݱ. F…~•!¹ædn[•1SNØ´ˆGþ—^å°±„ˆ±´°g›¸ƒð-Öñï3¿UÈc'ö0Ââ« ôæTžUåÔñ‹ˆ¶½ •]¹,d&N²ù5ÿýT¹zcmäeïZ0f‰hÓ'¥ñv+¸xRYÔáQ;ÔŒg5 ”|UˆiJ°(1œjÅ+Y£WÊÈ‹Xåyx“ZÎP:‰çÿånž +”·j‡ôçÊ/FïZ&½¹Úé2ÎJ}ÇÿDÎÛ>endstream +endobj +6283 0 obj << /Type /Page -/Contents 3074 0 R -/Resources 3072 0 R +/Contents 6284 0 R +/Resources 6282 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3071 0 R +/Parent 6262 0 R +/Annots [ 6288 0 R ] >> endobj -3075 0 obj << -/D [3073 0 R /XYZ 85.039 781.388 null] +6288 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [425.738 282.402 509.276 294.091] +/Subtype/Link/A<> >> endobj -902 0 obj << -/D [3073 0 R /XYZ 85.039 310.691 null] +6285 0 obj << +/D [6283 0 R /XYZ 85.039 781.388 null] >> endobj -3076 0 obj << -/D [3073 0 R /XYZ 85.039 292.022 null] +2374 0 obj << +/D [6283 0 R /XYZ 85.039 761.463 null] >> endobj -906 0 obj << -/D [3073 0 R /XYZ 85.039 292.022 null] +3029 0 obj << +/D [6283 0 R /XYZ 85.039 665.896 null] >> endobj -3077 0 obj << -/D [3073 0 R /XYZ 85.039 271.025 null] +2378 0 obj << +/D [6283 0 R /XYZ 85.039 665.896 null] >> endobj -3078 0 obj << -/D [3073 0 R /XYZ 85.039 131.177 null] +6286 0 obj << +/D [6283 0 R /XYZ 85.039 642.326 null] >> endobj -3079 0 obj << -/D [3073 0 R /XYZ 85.039 79.598 null] +2382 0 obj << +/D [6283 0 R /XYZ 85.039 488.273 null] >> endobj -3072 0 obj << -/Font << /F62 1689 0 R /F41 2104 0 R /F56 1642 0 R /F15 1628 0 R /F35 1632 0 R /F65 2099 0 R /F70 2201 0 R /F18 2207 0 R /F20 1617 0 R /F38 2158 0 R >> -/XObject << /Im1 2193 0 R >> +6287 0 obj << +/D [6283 0 R /XYZ 85.039 461.659 null] +>> endobj +2386 0 obj << +/D [6283 0 R /XYZ 85.039 174.236 null] +>> endobj +6289 0 obj << +/D [6283 0 R /XYZ 85.039 145.5 null] +>> endobj +6282 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R /F56 2890 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3082 0 obj << -/Length 3723 +6292 0 obj << +/Length 2415 /Filter /FlateDecode >> stream -xÚµZYsÛF~ׯàêEd•ã\yÙòÚJâD’µ±²®”×0 ’X‘€‘ôï·¯ @ÐV%»¥*qΞ™îžî¯{àM\øó&Iè¸A:‰Ï ’d²Ø¹“5ôüpæÉw¢7 -±ë÷g¯¾ü‰ç:©›NîW4ä~ùiúæÇ×w÷W¿ÌæAL½Ä™Íã8™¾½šyÓ?ÿûÙÜ›¾‡Â¹ûeæ'Ó÷ß¿»¾â†›×·¯±ésuƒónïgŸï:»º·v2WŽŠÜÊïgŸ>»“%ìö§3× Òdòe×ñÒt²;Saà„*úöìÃÙ? îSž5rà9´;)ôÍ×IeNî…#'ÏËæPçpˆÈ¶ØwÖZ鸫¡\ì Ÿ¹ùºZW%ÃtZ4Üt½opÜgäX*g~:¢+h­j.ßàˆŽ@’Uƒ¥ -ÈØÛ¼EŽ>ÎüçxÓr }´Ô95ÉÚ(ŸŸ/‘ëÈjÙ”Ò³r‰RòáL´OW[ìðlšfÛmÅëPÕÊ‹ŠŽ¼‡–C›×2³âß:ÿ2›Ã¼Šÿ·0È¡µç^ä‘šÌýÐñvð+ì€ÈâaA.þô#žžZõê|èJŸø÷þħœ‹$‡êß®§¶yÃM$é^2©y_eË|ÉtV4kÇcÌù4¹b—ÕÏ<ä ìUpöw+n{F’ÕANÆêcóv“á€?ðRõýn(ßÕTúŠãûFq|hn¸éâͶÈK$ÓrÇŠô -·•½hÖVÚQ?bÔØ`ý0#þ~\b74—% Äkììƒ&V ´¥-ëNÊÇØ·¬ë2xËT‚Xß'lªÄZ0 õº&@ExŠç “ñóAû‡¼æÆš4Þc‘@‡ Ñ¢+‹K@#Ÿ -tI´„¡~=dc9 l!{"4¡úPZö…ZÐáoþT4-XŒ"VÜ2߶LèiB¬ÀK¡at†ü´7¥£CÙâ%ºÌ3—Ñ‚±ÞÅ"kåBÛ™ÁÝSÚá¢[VA(&–ã^\²ÐêÄEãã÷ú滌ÝÅJ,RˆVVÖÚY«©ìdQ%Þ€Öˆ)ó‡=«PU·|¶€Ö¹{bF¬„;J±›/ºù#jëœ2ï;k…N;» …CÓaŽ„}áËoÁ¤’»›Ã‚‰0¨Z‘ÁÚ>sç³0¬„¶` ^âÉ<N¤Ó#çmŒeÆ2I‡eRcÂɺH›ö¬§ì-Àäé§iç±ÒnH‡¡tqo6åZÀ®ŽpC+Â^£ŸÆ2J-ö0fÍ/¸ƒÄF…æAõ¶ªå§I¿‘Ð]¡å¼‘ WüÛØîûX½lßdÃ6Ǹ³OÓ-.Z«­ûwPh¥WðåYˆwº ­æ\u,Q1ßÕ Ê=–: ’:ô½â-uèYôPž«!6Ã1Öž 2Dz©n¾¹ßÍC[í/Äu€F7›ÎÓBµÃgPɾló“ÊEÀ€#‘š‘Õ±‘~úVpà+ãøä8 ·J ,ÃpÃE/ÚŠ0Ðoöl”š:š4‰ÐY”½v+o5\›QϹ¬VVkÐS1øÉÆL뇶e`ß|m_}ÑÀºX1NW±} ŒkÀòù[Ö—l¬öçdWãéù‡–`¾Ì¸éH£TÌ@ŽdÖu¶#:烽œßæì"`ÉÊ -³–töロ*4˼–[qŒŠa;â z…¦E£1;iYï7|N¤à…l -¶² ÔÖzÊR3h&É¢y“K‚…6ŠÉÄR/ºgî#1z–zidn;¶š Í;pœv`÷Cf™[9ö26IËxäâš“wÝl€æÂ%øBþRY–Ni/ò+/Z±ƒ‡K “;.—óªÄÓbõ æžÍ ý$y·y…z/¡\á/ï‚Ü>ë‡6öØZib|V¥<ö¸GøcÁ–2k^$ ÉõP÷àWÄ}q' g. L ¹ú9™ÑC‹x_¹ž•?I’ŽóIrB˜DKTJ;c¼×¹&!…úlD‡FèøjŒ$”BÕ… ’?èØöhöwÛð€juò,•AN%òåZa‰OQN³ë†›_1 KW$?æë{¨ ´á‰<+×çìîC`´@Q¢ó+ý½ûß„pë¼å,†áu]ÑÞ¡©ãcØE"Øñq,Sí„3BF—àUn$ëÑËÈÉBÆv8L»S˜hÌ(”IíÖÕ¡¥*ƉÐ^ȆÉjph³Û÷¯Zhˆpx‘ý¨; ôöRP— ” .¢ÂíªVæÙ· ãWˆ,ÿ‘5CÈMÙÒµJr@§X1m !…#Α¶!‘(Êúëœa ebG<ïM%íòÊ=F‰ØFÒƒq¯¸zÓîÇh]½hjdÊv)=ðpƒL ü+®SeNõqYPW½+8¼)*‰Dq ñ?K0ù›b?r>J®7òÂI$;ÓȽËÂÈTcAÄÚ~wv'qãi ñ2ÛÀ m+'ñusÄ–>ÑÐÜ@7oÀòN_6h$¬T°UûÉšs*–ôW[d%O¨s1Ž\íΤbâᄯMÜy$µÔ ´ÚŸ´7 Q%Ô¢À%úóч³¨±êÙñÞÖ$Y†±ÙÒ¡¢ñûëõkWÛB×ë|Ì“ß Çsb/x¡<ƒñ•ré üeûï²ÇÄ>Ç{!1Œü9ËŽQ¥.­l¿Îþ ?Lðd"¥–8¥:Déuü§ÊWä­ÿÁtǃä”ö3: €Í4øû3„KóT =Ãq匿§BÀD Æi¬áŽhH™/‹–@úçc÷⹡&þdÅN¨“þå›Ö)õ/áËüK4Fñã,Ž§¯ñ0¿Ü¾»ýaLÈ)ìY+éŤ鹽“lÞêÇZl7!‰w¹Ž´Ãßœöhxå:¼HBs¹¤)•|Ï€[yÂòº¬É’çÒƒ’õfë6g}‘SY0®ºßáž2I†cæï|÷d†á©l#Ø‚u•ŒŒ%#v\"ž6O=å;®«MÿbÌ6xžu¹Ê¶áFÛP=ž0PxuWŸ)P¡“xñ éhS@f`D¡<¸¢z,Úˆ$ÁWá1;n€Pšðüw2úFÃp>6_eXQUâRˆêÅÎ<f&§ScZžÔ€¢‘mˆãÔZ®¨¹"!Š‚¨»’F»1ejô8ÖQ£ÇÁ»~‚Þq3oåÁHtÛOâî™8‰FïDZ8’\ZÒ%¢qÆq,Œ#l§/j¿áÔù]ö@! Ö3&C¯Ý=àÖ÷Ü* a,†c¥ÛH>êJù2ÌþÕ]Ô]æù2_¢"9#€õžãÂD™t®S+åœsìP§—¸Dà·Îwçg0d\s£=u$C$ñÉJ¶ë]K -vJniž%VÚq®¯È€-xƒœ·x€×–îñÛš`*„`ÑRŇÃÐxœ®Vƒ‡0X#Rüé‘’œ,%H«•ø€c‡Vþô\gP§ù) -éž›Hœh="]ÇÏç Ü …wò0®ß­t>XÒ…Oïž°Nd’åVzžÐ+ðÿ¼'VÅRd’ÕcŠ·ûnÓN{GÒ‘g¯õñš?ˆFÏó…Ù[w¹jASX-tRZ#È;\ý8vÜÈ{a\ñ8–GŽ¼QÇN±Ç Ä.^4þIéRÇ\óu,ìPÁ<˜@Ô«ñ”…ö_û48ˆ¯óL_Ïèx¸Oùnµ§9ÿvÝø“endstream -endobj -3081 0 obj << +xÚ¥Y[oã6~ϯðf D^T²(ŠºL‘‡©'ÓI°m²“ º‹é+Ûr¬,¹’'@|Ï…”e[v +,Cyxîçã¡".ü‰A¤Wƃ0ŽŒ¢Átyæaå§3¡)lMbwh~|8} üpØó-åøJf_­ñ§÷wWŸ‡¶”ÒòBgh‡ad}ùåz|ûáj(¬Àª°îáåêá~øíáæìê¡ܲ!1Jýýìë7w0 oÎ\GÆÑ`c×°¼<±Žò¥~ÏÏîÏþÕ²â5À»úŒô¥pBO lé:Qä÷Ò7p"'”ë(×o=á¹Oá9RxC„®˜•5¸!¬é"Jתê´Ù7W‘£¼hÐa~¨¦9Ð@¨®aä~´£ÁÃ"|/²Ì³Y€ÛSO‡^h-’ +fjŒhGóu²Ä• Ì'<³®S$Ð<6‹´ÀQ`¶\ùÈ‹lš4Y£GMš@"ýp{σ¤˜¡Àç±ãÌÃ(ŤﯴwVq+J b+~áç4Ï@,šPCREJX× ¯l²våüÒ$ùŽ@iä•MË¡ ›f©^.ù™t¶éù’‰ï%Ã$£Y [ÉI$ÛÏj†³tž é9…Öµg–®@zhi&`f„+­²À§€p¤<1E "šägÊ5¾x°‚oÏZMœÉŠLÍÓ¿2C¯ÝE–à)ýZ7éRkïKßúLÁB…GUÐI"é†N)0ÕoÒºY%ì”~dÙÏ:nš† UDøPDÒz¬Ð^sîGh˜ôÈ0Ì»æœeî&®'/Ì’¡ƒ3}7‹¤ái“¿8Ûq=­aŽã<ùBÊ=_ž_ôCO Ç‹ƒ“¨Ø¡i±Àw¤t± #®D@Bœ‰aËâ9­êŒÔt˜SÞ•K~+sŒhZT!˜ZÓR3?©å–¦/Œ–J8Bz¤å”¨Ó„êÝ‘µªØÝrŠ¡\cQŠ=¹ 0ûÜ)#)h%p›eXL[” f0WòzBuöÊ/¦"vÐIÌ)¶õ@®ü{»)™60ÏŒ²¢§2s…ŸÛPÅ„r"¥¬ ¬¤Jy°6âqõöŠÓŠµÇkƒJV)õ|Vð³ÍWäU ý/üÒ)xž@?®õî²0‚æeuÈ(gL›ˆi%€üÐbˆéŒË`‚¢_M=ébú›oïG¿¢ŠÇ˜ntIí€/òÖyÔÀè HhØçŒâYAGkÕäž +ù¯žšSÖãè¾IMò ‡&ÅcÂgÎLw"ÞÔLáe '"AO8I#t ËÖøœ·Ø¤u­aDëâLV—Q¤b9 +Å~c—£ J»Üah“;5v西÷  ‚&ÄàZRè2ñCk´JH•QSŽHËD?!$7Êöñ^æ¼ÑN_¸˜™’ªT3àu½p1¾»„5ÌÝî΃:R+6ìÃn1Åùp®o]›öîöò¿¦ÄZ•Zó‚Õ8ÿn|wÎSp,à(p —ÙqZֆߖ·ì9>%ß +˜b@õbGFý¢×ï¾2gÝ0ïÝ`£þ`•„´ÁÄ3ÍWº#Õ¹þvÉÏóï®É~=ýX¸mRaŠÐçcÜËí¹Þ«3ü¢ÇN)”Äê/úÑEAߧð©ódKrüÐS„ÊzJz7t`¬’"ŲÞkŠqJz OÖiKsüŒSÎ8Á”{<¶  ,ä›MÄÒ´..žÙ`PÒŸp:ϲjÁiCÈ,Mk‹£´Ëy¸©´@}Œ¹+A¸€öѵ>¥•ÞTqbkE:•„ÅŒº<_ÎYbÒ4iawA^£VfzŸÍNªaïÃJ4xŒ#$Sä§5Öлƒ«‰vž7@×ë‚¡±;D§Ãƒ«I´œ4Î…¥­ÈiLr(o'ì\ +:Ô®¼ÿ ¡¥v± ¶0Ÿíø†_–pöääyí%>IšEI(«·\òc‘Ô‹£~ óÃà ¿m‰NøM½å·Sßöåõú­#Nu:m„9v„ˆ¥°EB'éŽ/Z¦/‹­çß\åÂOè¥å*O—æ"ÙŒU©Z¾åÚyøÚë.ÑÅ“/d9/`%às ©KžèVïa”þ¾ÆžAP“éS­ëŽ•xã׊(´ þ +6Ùä]èèY K }Ââ8áÇ´ÊtmÂf O_èt³{̸¹Fþám¬-# õÂø2Ú(#MôVhÊh_^ouäýeøá‹sÛaîÞ:ÈÓ6 êïyŠãƒ{ÌÅl~ð± º!hü®…§¿®!Yÿ·5Ûð:í +8èZ†®+n®ïµÂØ#Á›ã ÅñøË8v@‰“áßÒ¾¦y#ø§¤éØï ë }GØxÍ·Ãíw$ì ¼0°èjL/±«?Ÿ½àŠê¹]ðŽK~ŒuÜùmCUM# ü†ðt“uÃL‰á‘¡7å…] À•-HñG/ŠaÝaýN¶Ÿ¸ô—‰Æa«R[ü3¼°¶¸I$¡^§æóš +âÎU9Tý•ó—ü¸ú2¶ChÜ'âZ\høÛñRî!?ONx+ãu{õO{ŒæNLn1ºc}ŠƒHƒãy­bÇÞJì-щÌÖDo¥ö)&·÷åõ&wGÞ‘ìö¼nŸ¯Òqy0+·ùRóÚ/-+¾Ò–•^ØV¼l?hÜÄÉK~|yøÙ?¿GŠñhüþnôéêߣØÝ^Jÿ¡¯ü\}z*‘-?—ºÇÆœ¾DÏi† +#¡ÊÁöÚW1¥0ܪ§ý§ L˜éÞ!À†ò[§,OÌ!K+Í»C¨öß…,ñ=È9Ý ãBõ¨)>ÿÔc¦¶;ä?¹ Æ»<ÑæEÓ¬ÞF›ÍÆIšeR=e3-ÿ­Fú6W¾Ý/#ó<+Ö/£z•N³$ÕÉr’HýHœE³ÌlqC¸«… ùÇý}½¡±;D=ÇÉ'ÔçØg\é:^ï!?®ãÿëŸKíÔ—N$ÊóO]P[ðý¾¾~PVòPá?ÜvbFendstream +endobj +6291 0 obj << /Type /Page -/Contents 3082 0 R -/Resources 3080 0 R +/Contents 6292 0 R +/Resources 6290 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3071 0 R +/Parent 6262 0 R +/Annots [ 6296 0 R 6297 0 R ] >> endobj -3083 0 obj << -/D [3081 0 R /XYZ 85.039 781.388 null] +6296 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [361.406 338.821 512.306 351.723] +/Subtype/Link/A<> >> endobj -3084 0 obj << -/D [3081 0 R /XYZ 85.039 309.34 null] +6297 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 325.575 308.034 337.567] +/Subtype/Link/A<> >> endobj -3085 0 obj << -/D [3081 0 R /XYZ 85.039 286.293 null] +6293 0 obj << +/D [6291 0 R /XYZ 85.039 781.388 null] >> endobj -3086 0 obj << -/D [3081 0 R /XYZ 85.039 200.764 null] +2390 0 obj << +/D [6291 0 R /XYZ 85.039 691.296 null] >> endobj -3087 0 obj << -/D [3081 0 R /XYZ 85.039 79.638 null] +6294 0 obj << +/D [6291 0 R /XYZ 85.039 664.681 null] >> endobj -3080 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F41 2104 0 R /F65 2099 0 R /F35 1632 0 R >> +2394 0 obj << +/D [6291 0 R /XYZ 85.039 550.67 null] +>> endobj +6295 0 obj << +/D [6291 0 R /XYZ 85.039 521.872 null] +>> endobj +6290 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3090 0 obj << -/Length 3146 -/Filter /FlateDecode ->> -stream -xÚÝÙrãÆñ]_¡â‹ ª`—ßi×»öJˬ˜Ú¤l?@$$"#íߧ¯ÁENÙ®J6¥*aŽž™îž¾‡î©îiäÛŽŠOÃȵU.7'ÎéÌ|â -„sªm'ðqê/‹“Ëwwê:vìħ‹GY¬~²®ß_Ío?Ÿ_(¥,7²Ï/Â0²nÞž»Öýðoq~áZŸ 1gùçs/²>½ûðñ-Ü^Ý]áÐ÷óö×Ý-ÎYüpòvÑÃäBÛ:PˆÊ¯'?ý✮ÛN[ÅÑé ´ÛãÓ͉ö•ík%ýüäþä¯í.<§OyÕÁÚ l/„†rì(ÒS0®²•‚=Z®¸þW|{LBdëH–·ômíû¿µc^>1¿ÊŸWaS[͸•rû%+VÐ+‘•/ÈóšÁãWž¿n§ü]"Hžñz×*pY½=¼/¼X¢àëÙ¾ûû9üéYž{¡µ6,‘‚g Î €/)7ˆÊˆ‹­ÆÐ Md ¬-ñëwàÛŠ8pÀc íÜL$Àj‚ýÙñ!Ò”7™å¸æ 1Ð_ϸ·JkB¡BF?œ_ŠéŠ§ì†|_ÿÂ)Ÿë»ox㤀5+dŠ?08‚d¯Ò("±y·Ñ£>°ûD\[›ä9+ž2áÏC·°Ûr©~äf•þºË*sY+#i@X`«@ƒxÁƒB -?àÀ=ÉsnÐÄ9ƒ6v­$ËkD'ÖtV±¬Ò¤S'’=«yl•>ì ÿÄ=¾=i§ÝEÈi8Ü”üå KÜñ…E¤G%8ƒRÃu±ÞÈ%ˆ»ð­v…p€%›®XÇÄà§rÉø3ÖðXS%K=W‹¸>U@$õë±Í€È%$I(ÓŠÚIΈ~ s+ͦ,lÓyMQÝñG¸œ•N(ŸyäÑl‘V•inhu]'OÜàkž oYû®õq.wØq¬uÒלNH–²+áÐ\Áß/tùbþàrìŽ|¾ôç•·gÙ¨xÿ -Ô*QZð4*BU7¼ºÆQ%fËMb:²Üµ²‚iïYQùzH¹R2Æžð—ü!¦)À=mr²!­Ù&{3l›ô ¶bû.@w CBtÚ‰1):à­µu›<Ë0aŸ= ƒ±1ÛAzöG.Ž||ú*\@æ£Â…±È·q~›§ <>ÇD”YѦbkˆ®ÐNâà‹9-0ŒGuŒ@ˆ½[ö¢˜X¿O ó̸P´wI³ï[Wx>»]Ü8-Z´ñ’ªuÁä%`¨¿ ݉ïƒê¥âi ̘§DVõ¿ï‡} X€½§m7˜Œ_Œ«v][{Që==gÂ{B¨æ¢²{¶ü@ÆWAæÚð!¬;l/4vBë ÎH…ÃÏ(®MÒdeq(jpŽ¡é9¶ûÇü—u¢\hG¡àâ§õGÔ#Å5þ¡á1P(´ŽF5¥2f ½'H8†&ƒæÎÁà—Õ³!¼žöDb cUÙ‹dy¤zâ}ñËðØXâ”Ö;&Mº‚;‰At\ Œ äl‹—Œ o“HC\w -b‡8´5Ó`X3!Aü2a@T•ä#׼Ȉ³Žñá•Ðäl‚¸mBòL6"–ê 'X°gòÀg¢Ð w‘É ø76Åi%Ff4Ü"p€+z‘/öÅ‹ Æ¡îåɃ‰o"ß„ á+.þÎ{WK,ûÈu‘z&aÐßT[™™}З/ÖÅ›â}[å._ñP{QÊëyœa…/ß©¾V¸ddn(ºñþ;(Ž«íNvZS›%du¾r§lZ’é>%}*}þGxïÚÈLf³‚¿Ë²ø'Ìíp/ño£”Ù¾egæMŠƒ`À½¾%-Òn˜[@£Ix±€Ìxd$w‹Ÿo¤Öùž%¦¹B6ù.Å—Ä?˜2n Ûwd ¡ÑY.¤»öÑ¿Ž,¢‚Á¢. ßöØêÏdЉR’B«y˜ëˆVGœ è–IZHÊe–€­M¯Ü,H÷èôäÙ„«½‚ÒHsYÕ»XaXâ%ÇVš¢Ð8¥B/ì°ÏNN[RuÚ)É:9SŠÁ°ÜKª›2%*!àXf‡œÄNI-=’?ìnܦ¢é6Ãf=R†ÑKÎg,\¸~wJK´I#vuýÎA#2IžSªíÃŒÕÄX8¹”¢· -”I -ŽÕm1: j[~‘¡"&î©5oÜÝZhÂÅM¼Çø±íiË'¡í@ü§‚Ô±Bç8Îåßq`Î"?¦uÍ‘"Ø­ƒïFvè¯V…v„Ç3ˆî]­çîÕ~È’wï>½Z¨É¬×bO'ìcUŠukÚZžüȪ¦ì­á÷r“˜LX›Ùœ³‹MÖP!¬Ý‹bfýòy¥×7Ç š)´¢†^sAâ)=ð—û›Rɾä`DYð·++GÖÙÇÞÛº„¾ÅŒÛIWM’…íK%tò¬nj3.»mø¹umÞfq¬w e‡5®‚ÃáÎÀ‚åë®6•o‘r{õ’aüžs§ìÕ þ þ6„~ÿÂÝ¡bOÃ}‰±¹pm~–Ñ žPŒ~ó2?á1á—/Á ¶ÎÚHxA/¹§‚º^ -±Om÷þ‰”üDh©3óÖ4õc*óˆ«!t÷Ôôîä˜?öS7ÚnÔ¢|T8]í=Vô4Å øo•v;endstream +6300 0 obj << +/Length 881 +/Filter /FlateDecode +>> +stream +xÚ}UÉnÛ0½ç+t¤€Šm§š"=ôR-æ@Ët¤Z¶T-5ú÷á"Ëmä`‘³¾Ç7ÄðÇ‚<¡±(‚,gTäyPîïâà ,Ÿï˜ó‰ ‰”ð}Áyk”rË좫e¬ B2ôy\ÝÝ?ñ8à1MS¬¶cœ +ƃ´T +¬6/„ç4Œ’$&ßÔ>dd­ÂH¤yTånêì÷*,8Ñeu¨Oz_W_î>­æÒ®rZÄT²‹ÍÅAÄ™¸Ùyšf€N.;g°¤gŒ¾s†½Ë‚| #FÚQ_ëÍEÝ,ò1åY°˜qqVjfYfʯªz#^d¤ yN*ÕÀŸÆNz¼OɦÞØCˆÝYç½Ú¡»¶§ÚÝÖ‡dlíi¬ Àgïuc’ªÁüb)8ymjïÕ5 +«´+¹m]cåJu`žÖËÌHå»uXG‹¡_¡î,Ùí´ä§ÖDR@$à‚è(€¸ Ž{“à€G|Vgú/ÛÉ0 +yFþ86ðÒTo÷¦+$³ªÓ›-†ä SÙÚì}rFk¿ëÐrVŽ5+²°à}´éYaºf‰<1Àñ…„¶<üþèõöyóÎö Û4ý|`€Ð‘Ѷ{x½¿¢Ç$ç49ÝÒãÂçú8$03"Ný8p7O¡ˆ‰VãÔ¤ÈEšuظÙÖý3fÒÐ|mž}ê›=ž|®ÏL"9-»l¾‡¹4 <´WŸà W¯F½1–HåÎÙúvo¿:#6Ývudz!ÿÚÃ0•&™oÝØØ{ûc–Ü#™ªn°hï cÛ×ÚÅÕ5)[Ó Ë6TʇkX,4º€´«ÅîGçWÐýà^oÞKpXJ¼×ð°™f…;ªë}²V£ÞÐ+c*bzþíê°ÎžïGUÄ‚¦Ü'C@BŠÿ &"§I.®Wü©ÿžendstream endobj -3089 0 obj << +6299 0 obj << /Type /Page -/Contents 3090 0 R -/Resources 3088 0 R +/Contents 6300 0 R +/Resources 6298 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3071 0 R +/Parent 6304 0 R >> endobj -3091 0 obj << -/D [3089 0 R /XYZ 85.039 781.388 null] +6301 0 obj << +/D [6299 0 R /XYZ 85.039 781.388 null] >> endobj -3092 0 obj << -/D [3089 0 R /XYZ 85.039 761.463 null] +2398 0 obj << +/D [6299 0 R /XYZ 85.039 761.463 null] >> endobj -3093 0 obj << -/D [3089 0 R /XYZ 85.039 743.296 null] +3030 0 obj << +/D [6299 0 R /XYZ 85.039 667.044 null] >> endobj -910 0 obj << -/D [3089 0 R /XYZ 85.039 603.826 null] +2402 0 obj << +/D [6299 0 R /XYZ 85.039 667.044 null] >> endobj -3094 0 obj << -/D [3089 0 R /XYZ 85.039 585.353 null] +6302 0 obj << +/D [6299 0 R /XYZ 85.039 642.326 null] >> endobj -914 0 obj << -/D [3089 0 R /XYZ 85.039 283.436 null] +2406 0 obj << +/D [6299 0 R /XYZ 85.039 582.512 null] >> endobj -3095 0 obj << -/D [3089 0 R /XYZ 85.039 262.235 null] +6303 0 obj << +/D [6299 0 R /XYZ 85.039 556.503 null] >> endobj -3088 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F35 1632 0 R /F41 2104 0 R >> +6298 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3098 0 obj << -/Length 1139 +6307 0 obj << +/Length 410 /Filter /FlateDecode >> stream -xÚÍWKsÛ8 ¾ûWèjfÅð¥{Ë6N›fóØD{Øéö ØŠë‰,¹–Ü$ÿ~‚rd›f&—Lf"Ið〖€?d1Úi&¹Î²`²‰`–O#é=D`¸Hb4ý™OHÁ­°A~ç\òéWöñóÑU>¾#­5“£4ÍØñ8”ìæ þåa$Ù%WäruªŒ]žœþ5&ÅùÑŪ>Ïøç]äá·üËhœ"‰ 7‰ÆP~Œ¾~Á¢ý2\Û,xYpim°™XóØh?®F7£¿7«Í4kÏ#Ðs ¶ÈÄOrŠÃÓ… Žˆ(xJ[®`wi¸ðCf{øño˜֬ᮕdóª"©.Ë)I]Cߪ™‘ÐÔøl~Gゆ`'‹d·a¤RÖ kýœ%¨2VÖ-×K ¢1‚g@Ð;õ«vß<ˆ‰:Ä.ÈIS×å±ëˆ”E‹ÓŒaç§@eи×ùgœzxbäà R*[é[“Ç17°ÙW Åî.êÚl km‹š<“;Øjê#X<¡Áû€=íí|÷šU–r•Y 1ì¨å›hÔ "œfß– pb®R _Å‘k{RO&\'†(çÈ´…qO¦ÿ„LwOèú‰»‹öÀoïY33ͺ‰B]Ü#¾%i. w«0 T^9)–ÅmJæÇÍÍ"‚–¸Ú¼óŒÔëÖ©¦½lóäùVÓo¿~^ü«rÒÑøkäOÞÊ;—»€ ÑŽeü¾ÐþXÍ'ø=Ã' òêÀœr`t¹¿¶Á QYãr+h4täN…]&nPÓ`“†èº‰sÞuØ{ÐaÝÎë‰ôk‹n[Dš þ‚Jº^6 -øÔ}ˆën^•­¯ýCG¨ÅšC74¼%D² -_"j’Â[%}EÝ-´Ÿä—/xÈÄöÕ­€¼÷¼@RÅSaßß >©zùò’oZ®€¸2…Çå¡:#‘òÌ¢–âvcWÆeâÛkä õlj¾0|"ߥ;^"œîŽœ&Žrí+7;¿¾KŒu±].wAÌ¡:eív E¯Ç•ð»(æJ ›]RÒI¶  B§¾ÉAË–TÓ²½GrâkÃMß=:­ÛMÇÛC_ OÂ~'D&ûÑoâ]„Ô–6}ýä…TØä•Šg6Ýÿ{Ç#ÿ¶_:Ý$¼±/W~iì.‚Ã6Ôø?êvendstream +xÚ}RMoÛ0 ½çWè(̉¢¬ãlmwØ.¾ ;¸SKì Q ìß²åvْ€õÁG¾÷H¡Ðü¡5hŠÂ +A<6Zl”ß²ú)u×´•¬wéß03=Ö5DÏèMïýLßôÃIU&zù L}{LÜ°.+yÊ÷Nn‡í²UV·€í¯ ï–ÓPn‡Q™(Ó´œRÏ kõ§n?mOóÂŽ-y—–Ò+ê¸o3ËØÊÝTD¤¾P9ü|¿/•Qö«Ú’‘yÚ92·1O ó\š=íø½I#²œÉ¾8;p 8¹À˜-&¸2Òp>Œ«CyEþ?ÒάŲD²ö_šÔ®3þ%΀endstream endobj -3097 0 obj << +6306 0 obj << /Type /Page -/Contents 3098 0 R -/Resources 3096 0 R +/Contents 6307 0 R +/Resources 6305 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3071 0 R +/Parent 6304 0 R >> endobj -3099 0 obj << -/D [3097 0 R /XYZ 85.039 781.388 null] +6308 0 obj << +/D [6306 0 R /XYZ 85.039 781.388 null] >> endobj -3096 0 obj << -/Font << /F62 1689 0 R /F70 2201 0 R /F18 2207 0 R /F41 2104 0 R /F15 1628 0 R /F35 1632 0 R >> -/XObject << /Im1 2193 0 R >> -/ProcSet [ /PDF /Text ] +2410 0 obj << +/D [6306 0 R /XYZ 85.039 761.463 null] >> endobj -3102 0 obj << -/Length 1930 -/Filter /FlateDecode ->> -stream -xÚíkoâFð;¿ÂâKö¼öú•/—Ç5÷JšpêUwýà€VÀæ°9Ê¿ï >ôp.>à¾ÃÞ_÷‹aƒ“¾*ð•o/9Ö¸}Ûq„GÖÆŽqlÍ;Ê÷„¯<=Ÿuî:¿×TxMY¼«åÂ}å aàŽ«~|œçǃÖã€éÐs…òÂgéÐ.èðˆÑ£=:>èÇ -e,Ü(¬uŠ±ï7uñ±éU(ð´E‚^ Ÿ(Xß,)ǯ6ÆÄév^]Í¥u^KÖ–+øÓ=å Çi•¦ „(&A<+Ùb?_î3ë ¤6¢¸Ô¤)£šÃ)È!+{}7òêg‚×.I<#ü_Ö2«Ðø6ŒC`Üœâ`ôÈÐÜÖ<¯ -~þ‘åãw¯õŸoøŒ¯ŽïÀBh/y>OèŒ{œ!%Ä-òÝàÕQ9M3&îwÉÆÊþÌÞãÆž]K|ÇAƒë›–‰<2@+|RyŽ}U1ŒÖ1ç9²2eIrÉý,óê÷ »$?˜Oððbµh2îß ¢SÌ2:`ÃÞåüŒªì{ŠceŸgKV@E×\nz dR) ·%¸a@VžÖÇF½\:·{VÌ«*%a‡®}V ÂÀ®ÔdµÄ{V@`ßžJ0]7µÍhŒ{2vˆë”Ìœ„žkëÊ(Œ„oFg{‘b[™÷‰Õ¾T‘]wG˱Exe g…¶?ǘÒëw›’)Í[(A@ Ýè…”>•(C鸮}CZFΞå2€¢^(½óB΋ŠFÚL§©±V‚=°AèÙÊX»¤#ü(Ø$» "Õ>ŠŒ—Ƴ[_ñÀÏÛ"™gùDg¢e}Aœ^öÈØÆé²ìîX™GG !P×9¸…§€rÅÏrZ¬fV;’§\í© #»È'yW >ˆH2Jƨ¦z3è òwàMÛò^ÌÀ * S&óû„‡xÿ S¹±qw„Øõ2^Ȧ—uЫ’V“·ÎŠÉ*ýR;†sTqY6{Û8Û µbÅ2žsèဋ€:$âä”Ð×Idð,ÓJ¦mA{aX«É”ªifŒ@´Ä ¼€ç Î`² Šd¡âLA“Â^ébÁ³mdÊ´{Ð -v°P&&VÜãè¡^ ¯Oë“çµ<hLèIpMîQ d¡6§ ic±œ –ÚŠ>cK%3μ¶Ž¤hK‘£e„¸c³¯…È‘f³­Ëg^ÄŒ‹•#ñùºÇÌÂî+C,ÿ…K#D~Ä”Ÿ×¼lÂÎSÎËÕ25ÚK*3ÊJ­3%H£Då‘!ƪFIá'‚‡êˬV>Œ5Ù„ãbž0•¨5ëšd²›v1áŸîT€u­Oé -éø‡U®]£ÊC¿$* ¨”R¡ÚlY%”ÊiBïÊrƒ‰64h–hè` ?++.LQF£~‹4GÅ*¯Ä³òóóFt8â;Õ?žrùÔ½«¶eímÝŽ‰Ý[€¬òîó–á -_ØͨšÚpäÞ?à"õ‘ði0&›{ú’KúüÆY˘[ò¸šš¦(MÒ¶V2êÑBØii“êïGI>IÇüíå9›Q±¤wX6s›rCÖTCûôݘb¤RHùsŸ5ÑD`9´ú¸/þ¹o­Fª.Äw·ý[¶ÖëÏ}AöB‚ëoi±,ýYJßÙ_S±†Á!å nendstream -endobj -3101 0 obj << -/Type /Page -/Contents 3102 0 R -/Resources 3100 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3071 0 R +3031 0 obj << +/D [6306 0 R /XYZ 85.039 667.044 null] >> endobj -3103 0 obj << -/D [3101 0 R /XYZ 85.039 781.388 null] +2414 0 obj << +/D [6306 0 R /XYZ 85.039 667.044 null] >> endobj -3100 0 obj << -/Font << /F62 1689 0 R /F70 2201 0 R /F41 2104 0 R /F18 2207 0 R /F15 1628 0 R >> -/XObject << /Im1 2193 0 R >> +6309 0 obj << +/D [6306 0 R /XYZ 85.039 642.326 null] +>> endobj +6305 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3106 0 obj << -/Length 2902 +6312 0 obj << +/Length 243 /Filter /FlateDecode >> stream -xÚÕZKsÛF¾ëW°|XeBƒGnŽ$'ŽW²ÖdÊ»•Í"!% P²þýök€! Ñ©ÍÅ[®óhLwýZ<ø§F‰v½ ʼnrƒ$Í×gÞh 3¿œ)YáB׋4Ný<;»xù#幩—Žf´d¶øùüõÝÝìúóx£w<‰ãĹº+gúþÌÆå|⎗Ü}û‰óéý‡\óÀÍ»Ûw8ô ¬¹¾Á}·³ñŸ³ßήgÖI&¡FåëÙz£œö·3Ï Òdô ´çª4­ÏB¸: ä½<›žý³ãÂsáˆw <1+&*uS_­ñc×XšÐi§æŒh[7 å‚@hEkÏ™®²q œURÀøf *ˆbç®®þã©°Ì|œ{x('oÇç<ãŸ<ßðÊ/°+ý†û/n€Ìy4Û,˜¸%m‡¾ç}»øתu§7 :±«ºS<“¦ÍÚ¢Ú4‡JŸt¢òöÊð=W§a§ ¥€2]Á·²ºØÀåV±S=à3ryóØV[~Ù²2`ëÖ>  øû<öcÐ~þ*ÍÊŽ'|¡E5JhŽRÒ|!ÏÛO3&jÖ¦ræÕët*CH€à u®h yœXªE›ƒ|,€NAü’ePÄÎ…ØðšœX•O:`r»2_ÄÁjÝ“›n7žF¾²¯&˜~¨jž+³6¯yŒQ7‹#¤tX„ø™ò¢ªØìɦ$T¯ÕPùÎTâb9̵¬ßPN¶àãáÒ#J† vu.,Ú µÎpû ¿ ‰]g´‡•†“ÏE»BÊp¬û#Ôò!ñäà©UÃø£QŽ‡Þ€.x‹-ÀQüéteã-BçÙ†fÜ8ø²k: à Ó0UÉâl™B²vrf¿É9$ ‡cW~’î§üÜsÀã’H’7lË}„¼PÈÜ1„ÚU.¸%+d‹h„ŒÏfÅq‡VB°c®åmÚfèb²ï¦WÝŽG.øqÅf|DP”Çϲ2€âœ|q“¿eëYçÄeJ’m2 Ü&Ï1 'ŸžÍ–8/Þ‰¨ÓEßj½&Â{‰q#æajXÍY Ñ"s퇈c‘çsYf¬˜ÄN³F+`hsHÌa›Õ ªÖΣ¸ÖàçØÉDDHÅ踧3 -TLní°ÅYø@qi× Ji7L´T ¨Ï¡]:ïÐøùïÛ«5´r“(’mX³ö•ë+˜ó -sîWÐe Ã"ªrU¢Ž€êÇi|Ye}pBÃJÜÆ_XyËkw[~²¥Q9uNt‹ z'óSoÿ€±’)´±ÔøÊÌ·¤æ¬•Ïw¦¾B6ïïŒ'3k7“Iðêò×M03§a»sv—È‘3a9"¬°!Êó‹¢/ÉÚªáCÖýp‰E®F' vÀ†ýµ‚=”‚Ýæ}©}S,kãlP©?nÖø™pAµõ³o‘žqMÎ<¦yýÄõYÌ~‚cÙú>{U<ßM“ô¤p±yÑé|¶âŠÊKL䦢Üf’Q˜c²¡ª6ôâqøB1*ë`œÂX¾ä9Å/ü²³«ÒK—w³ÅBYñ(‚SX;bëöÈ8¼Ä™‹þq²ÊqÈrþ9ݦÑaEµ\hPHW—äU··\éõa<… [íJ©½Ó¸Ñ&ÉQ¤N- »„Mš dtìc#ò$?ïO±à³Ð`:“UY§³ÉÅW%£ Xð£*ÁÇzÃÀKŽHãêbåÜüÌô ƒ¬áI)øÅ JA,§=“Úî¿h²Ùm3Um:† ròͼ~AÝ´"óQU³Íš†ê‹ª^˜Nîõ0 Á ´ÿ(úÉ^8r”> -(ŒazÒ±¥…KG}0²M¶Ì¡lù}6NÉ»° /›¯|uRÄ ãï´Ü¿oØ•Z,@7J -£˜C" Å~9Ÿ9VW;aZ&>˜˜B ÎÍŒLñLc /"“H<`‡˜ÏyžÚ|Š;øa¼_(#3¬q‘ôi8ôå¯4i·X±; C q¦Ò¨MêätÒùŠ9—U…’£$]Õù×]AÉ×8bàKYœòlŽx”Jx[’ÇsøXwèªc¥ðKß’;ãׯhž‚¸>òÄ’FùOaÚsU<ˆq¹Ai@ªP€uâC¶PmiÙxȧ´ÅshŸ0«¾D—Æ|᳿›øWŠ1Ò,0\To™\p.í:RT µ3D.$ìåÖ †(ÿÁvì=ˆ¥´0§¿V”–t„Q„·´¨”]3t Qç%×)R/R¿½5HJö–ghÐ:;¼Ý¢¾BŽFwW—GáæúÐŽMbˆ qð÷¢|â‚Ž&ݯRÿ{ë«G(“àÇÊ$—v<ûU Ï/;£èÞ¡:ç—{Já-YóõÔé+7ö¢Kà›ãËR¾d¦šöÛAAQ–æîì@wû#êÎ(Çüâr bë’šStFÇx+5,Î,â»®`ïz,Å)æ²dOgØBis7·àaG!#_ox@‘:ÍÃ|㡪î³ú´íõ v.^|sûZ¨fÐOJò„…ƒÝÇ-ss™õÏÑ]Z輹Ô( ¹h[û¡+µ¨h{cßÊ2 ÿ¿œÊV¬öX±Ú3¹Øër:4팹ÍdÏ°21­ìLõ̯ @Í÷ùúè21£´J+L%Õ ýø -uAçå@Ÿ‹UÕÈ»u‡:TtÖˆ!(|·A,ƒÜšÚî}Øãûø(ærB¨à\/ærâ=Xeis°ƒef)Æ\(!ŽûVܺfz9lE¬x¹×Št88ü©ÂîD†¬ C°X4‚Frø?ˈEÿÞQ bÈÜ:Nj^iuxFæ€ÿVSlêendstream +xÚuAK1 …ïó+rlMÓtÒ« ¢ x½ˆ‡ÅÁÁƒ£,ûÿ1uÆ—‘x/ßKBí¨`ä +½²*¼~t&Sn:ZY%g«wÄð«†ÄŠ5ïÂ$'4¯Y.‡îâ:EHKaÞ õŒ +’¥* ã³{ðLîà9ºãÉ.½»õäž| ‡þe¸[{í TE-–’+*ñâþÝ:¦ck9œZý9/¤Ã<.Åã—ýäÆEž›sjðîjØæ_ÇÏ%xwÃh©œPÒõß;pÄT·3E¬±¶-82KÛ³œ$vkQ†sžø ¿[bendstream endobj -3105 0 obj << +6311 0 obj << /Type /Page -/Contents 3106 0 R -/Resources 3104 0 R +/Contents 6312 0 R +/Resources 6310 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3111 0 R ->> endobj -3107 0 obj << -/D [3105 0 R /XYZ 85.039 781.388 null] ->> endobj -918 0 obj << -/D [3105 0 R /XYZ 85.039 761.463 null] ->> endobj -3108 0 obj << -/D [3105 0 R /XYZ 85.039 729.511 null] +/Parent 6304 0 R >> endobj -922 0 obj << -/D [3105 0 R /XYZ 85.039 549.916 null] ->> endobj -3109 0 obj << -/D [3105 0 R /XYZ 85.039 528.055 null] ->> endobj -926 0 obj << -/D [3105 0 R /XYZ 85.039 459.843 null] +6313 0 obj << +/D [6311 0 R /XYZ 85.039 781.388 null] >> endobj -3110 0 obj << -/D [3105 0 R /XYZ 85.039 439.248 null] +2418 0 obj << +/D [6311 0 R /XYZ 85.039 542.44 null] >> endobj -3104 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F65 2099 0 R /F41 2104 0 R /F70 2201 0 R /F18 2207 0 R /F35 1632 0 R >> -/XObject << /Im1 2193 0 R >> +6310 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3114 0 obj << -/Length 2998 +6316 0 obj << +/Length 1661 /Filter /FlateDecode >> stream -xÚµÙrÛFò]_Á7ƒU„9pí›Ö’mÅ–¬µèõ¦’<@$D¡L4JÖßo38H訤Rª"=====}CbæߘÅç«dÅÂSq<[Gþl 3ï„ÁðgÚóçþ½8:~Ê™ð½ÄOf‹[BY¬~wÞ~8¹Zœ}™»J)GÄÞÜ¢Ø9=› çú#ü,æ®p>ÃàŠQ®¾Ìeì|~wþéŒ'—'z8g¸îr1ÿsñëÑÙbÀ‰«=*dåÇÑïú³pûë‘ï©$ž=ÀØ÷D’ÌŠ#(/ÐʼoŽ®þÓQá9=ãUv-†+/‘ÁŽŒ<)ÀII'éOÈÄ!<8ö$È%Љs¯28v97é\ §æ—KRÕfÍþÁ]³ÿ+Ò÷‚¤¿&L°òÛZ£x(ºÂÐY°¼yý2âÏ#/ëù÷Íã ÎX•†¬óØָǾЛlÀLÖ¶|³UÚðäêFFò‚·ÔÎnPy't ×J¼ñ^ÓjÖ˜)s#á±zÖè…§eüZ£WÆè‹ê>Û5Yíe?³¿nàúy_ šëX:ßäG€Õ`¢tåpø&¯JMÔYê„7°4ˆK¿çhý<¾Cã ¨Pò÷(Ïþ°Ç +L…³ -B´G£ŸsC_Á^€q—Òõ2[¼šèà -:ÓYîjfŠuMû’öÉñu¬GÁS×Ua°KèЩ²²¶aøž»aàƒDs^¢}eÎù`9Gf!ŽSå²Ú±y2qkÂ8† u‰Ò%R®³_X]Ó]ÉqÅ ˆœ’qd£“àd™f -Ï„Õ§5^CˆÂ\,åk5^Ï–ÌÁíú|ŽAãlZ v=ZK'_Ù…Û€h‘ß>2…ÄÆ3œ¸±*ã]“—kF{oé´´à”ÕgnYÇô@ `ü-/9J 5àÔtÛvšÆ&c®7†„ëÉ€ÖŒ ¯ùcÞ>ÈÐÎV̺KøÔx]>›¶"‡€cŽ•2@MGç¿D—[2)424ƒŒ´ÁmUi Þ…æžhhˆ…tR:Á:oÚú‘g)Ž­Hƒ{ÜÈmÜ'C˜±?º)Á_‘øÿKÁ}øˆÉãoûŠ'žL0·ó½PG/gŠÕr"T½Â>­ŽŸ>¿=ù´ÏƒŠ½X…¼ôÝý‚Ré·Î/χãwZ ° »Õq`PKF‘ <h3Iû»Å·¹Â9ù2E/Tžˆå ôì~¹UÞºjªÛv‚žÖ^%Éëèíë·”ÊTû\ÊWpiOý–l¬xŽÿ¢¼R,´ìrbHzA¾’ó«AÄú&Áú®uäA”)ü×rÕ» Êöº,ND‡tjŒbkÉôAt3ééƒ= çŸ!8?—=Rhv˜ƒï|Ó#ÇœâHb7tòÖdÊlÀ€Á^Ò c¨f®Íì0;4süwŽ»´O+ƒX¯»ýƒ¼<)ì…±- -ø…óåb‹{¶·`hŠœ?üÀ_PÈ`,ãÓJC‘9xïñ6FâaÂÞ Ó‹ÓƒEà÷Vc¢4áÈáh˜Ö((›ÈÃFÌ$–‚Ré$4.€wÇM‚ý”9ÖIÈ)rÊZË’ lVTCI -T V”Ȉ ¶Õ­ƒö)ù´ÁlÛ%y¼oW2œÃƒ¿ÏZ èÙóP•\¶ùÆdxXK‚ÖzpEbîFð~^66#:e~҈閯‰~ó´5Zö¦aСN³}è@ôBDÚ9ÚŽ˜‚ÝÉiëA™5>ãý<á*wÙ0)cábßc?‚‚™)kó^YÚÞ&j"^¢Ã™‡žò£g3µÀ‹…ejP‚ÀÚq¦f;d¦ Êw($ƒönMGÂê -þÉŽ„+½(y6wƒjŠ;6O‡«°#/¨…ÀNÍv€À«‘´¤fëkx˜2ÎØ ÒÞ¥­™Þ 2fœ\±õÙ"A—ŸŒÌÅýÀ^8¤–ÞëÌmQB»UüÜ34äïÁò6›jWœRQlÔ -ªZmìÌeúoŒ(Cè·aJÞò“ê±¾4W×KMÿÁ¬½±Éœo*xîÕh#vVYó½c#º}ˆ¼Ïë -ñ¹wÀÕÏ/\Ÿß…Oš -xm]Š¹ù'Õÿà¯+¦@8Ü.Ñád!‰ðÂ4~Øiè¸I@€{ïH{S5­Ç%èù-Ïçýn¹!ºbQçõÐ$1˜'Å1ìÙ´ßíðà ,KòÔ|KR NmHE:¨øÜ¿9(aÚð÷9§ËßÂ}NN§,éŒ!}×—G´k‹]¤NM¯]cp{‘áfTOw$êj·¾›8¥Ñ³M¾|d÷7îíЕ¡äµv®3S»n;ߣ$ª]Ãpsü-…ñ¾F?lÇÒ ãä9v@YNfÙHiø$Zã!r°O$ðTŒ)aä÷ â&À—cŽÓû¿ËŠÕ Ï=Ñò¼ˆ»M³3áù:IÏÆÄg¿ˆÇç…˜VÀÑlP?@» xD}A/â ·ü•Ü1wÐo~.óz¹+è"Û¡egz0ÛÜU¶‘Œ¯].¡}PP¼ºÏ[`zÕ[Ó²¥“ñü8‰)1ƒQ¼1›pJ‡Ü¹J×…ÔÅôó™¨^…ñÅxHIÄí å›>–¾ÿóøWŒgê¸ ¾ÁA+’áìÙÈÚ<-ä$ºä—ÞÁ -g ¹X€.댲G¢iÖbFòt/rR×h”„4¬±é†;¬èâ‚Èéê ˜ZVeŸ"ÐwEÙ%>ÖDi·=¤k ]x5ZTp·024êÔ(ÓYÏmˆFOºyä™QÒN¬Î’Á_.¾štÄ;ÅœàÁìá{F•“›/-õl»¸wž™œxŸQmÄγ`[]_“²$hú›F.`ÅÉåa,«_e(ª_Åê~ë €Ê4ùÉsÇ5ã'nLφŸ¤‘8øjòš›Yàä lDÚ$†ÔP¢\]b×ò®]’†öà$ œ5ã)5²qqr9”HøPÙÒìCe~ U¼Kº)V)‡E‰Š©¡âb„ ^®Iä‹5‰ýPò­0/×ÇP¤kjó©0änrÍvF¶0ØŸ"ôT¨Çuþf‰$Kendstream -endobj -3113 0 obj << +xÚ¥XYÛ6~÷¯Ð£ DŒxé(Їæ*hšlŠ$²%ˆ-¹’ïþûÎpHIöJJ²E€,E‡ß|œ‹æ^ÿ¸—hÊÔ‹Îd’xëã"ô¶°òû‚[ ¥%ÓJÁxd1p«A$X¨âQ{Fó”IÅQæÅÝâùz"dQ$½»Ç¹`’ /JSRywù'_†lhú—Ü?-îoaPã Ë÷0,·Ë@F±¿©«#>dG˜_‘F‚ÝãBä·8U-¿Ü½PP, #sìXeY²¯ï:ð{¥L‹Q~P›d2–³¶G*b\ë¡í\Ñ•í"aBg;GëUê¿ÜeKúu 4£m¦`Z³Hzƒ„k‡ÀFz…$”,‰ –‰ô«ó2Paä÷ÛÝR$È&~÷p+ðYÔ{‡­„ÁŠÄpmpcÕêàÖ Í_ö펔4V‡Ù…z²‰¬ñ¤]Vg붨ݶ]QÒ6#^Kûgô…½;9k÷ˆb;8È^;GgMYÕ!‡u.üW} Áú°Ýh\ÄG`õËÊ Ëv´%Û¢a\ú ÎàÁ'ÄûUÝÒÂ¥¯™(·ENsÆq­ŽÌÀ_¡ÍHšÃ…ÿ¾Èì†vGz…"RnÝÀ]ŸŽ#ÇæŽi©Þz4x?ð' ħ] !y{²¯(’RùÍy@È-¾”3•ª!¾G~êd¾ƒ*ÕŒË+P›ªF²¿¯6C˜sSl"d´†pà|6d2ÓÁ«•`]Ú6tÿ£W¸Õ¡h ÊQëªürµ=×Ö[q¹¤µêÔî«r*¾µLYô¬ÈÌUò’ubÀþQiàxÏhäÜ /sS0r+ôº‹‹*¢»Ç gŠ±¤²Ú*ã Æó  ¼äþg5¯Œ˜k*즺8’Gu¢9›ôð3=Ê„à,áÉD¹âR¡Ûýö–€Ahw’tBóö” +çefΙdÊNuXÆ![›qNë+Üð@ãÒÉ]fUR +5qæTAæéiàH>Å“Jb–FOæ©ß>Í“•ùiž¸Bv¬;ŒÑf|ã‡hÃúQÚŠy¾bh?øÓk°†1+ô“”Q${n‡ó»â„Þ6FYq!ž‘ƒÚªv<’b[µs,i@~Ì…,‰ÄÓ‰ê÷Ïe…¨sc]ÉÙUÍã&¨ƒ¦bø+Ÿ­ß?Í +™;¤z×Po¶¦+ƒ<µ“¥dq¤ž±ß?Ñ +!ľ¹æïÛÚ}2ÝÍ;]'¯Ô¹T^5´Éµi ÕÜåwüZ~Áÿ‡åýþË­Zþmˆgõ‚£ÀÂÞ"úéÀúý3À¬Ð-0,û&˜§*?<ÎõléÈL·)2L¤Ò5*Ò6*ï–»Öæ‚/ +?êœ:’Ùú+~SwŸOá³jgñõ2Ó½‰„¸JåÆ×P$$½ ÚaŠ‰{?ˆ$2·³³] éÞYc—ª ‰{nxö™5TÞÒò¾¡©ri;‘‹9žúŽÅv;C<Ef•¸ +N†UÓç8£ýUfBæk—߉՛J× QŒa¸Ö&5hàCŸÓ Êצ¦–®ìmmh:‹Yß·mLoånÀœL~yɵ ¤ðÜ«©ÌàK[$Ð"|lãò•¨Ú^îß“äÅ=çèž øræJÝ}kgªå0m)šx\¡xY9Zºó›50FC«,ŸÔ½þ‚ëÏßDÑÀõ4îà \®M äÀ¿Ô ‡ßë¯E™Óįø'ö·ç¢iIÙÃPÇV³pðx¦ ñXš¥Œ-ͦ0íuäoLïr¤å+šé ¡ÀQQ®ëzv¹Z‹³£Ä¢’fW‘Æœ>³Ünh«IF­[±î)hÜj„`¥¡‘Ö?Ips\9ÑKþŒ–tª#¼G ä uÍ»WAÿù +ùøí(TÀDÓ=j”ð? Ãd”#dš‡Æ¶î ”^g% 8ãѯéq£sAR-5m8¬e+c¯Rñþí³ão/Õý΂ÇÕ& } ½2þÛ”’4ñ.0OSï¸Pz´ý:,>,þî+‚Ó ”™’p—Š³8é4m b®ŽdJÛy’64ÚC—«\Ð*¤Ãº5]¿œäãê%ÁÑ"á”™Úª¢Û5X­9}âåºè¡endstream +endobj +6315 0 obj << /Type /Page -/Contents 3114 0 R -/Resources 3112 0 R +/Contents 6316 0 R +/Resources 6314 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3111 0 R +/Parent 6304 0 R +/Annots [ 6320 0 R ] >> endobj -3115 0 obj << -/D [3113 0 R /XYZ 85.039 781.388 null] +6320 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [111.316 573.654 192.49 585.344] +/Subtype /Link +/A << /S /GoTo /D (unicode) >> >> endobj -930 0 obj << -/D [3113 0 R /XYZ 85.039 761.463 null] +6317 0 obj << +/D [6315 0 R /XYZ 85.039 781.388 null] >> endobj -3116 0 obj << -/D [3113 0 R /XYZ 85.039 743.459 null] +6318 0 obj << +/D [6315 0 R /XYZ 85.039 761.463 null] >> endobj -934 0 obj << -/D [3113 0 R /XYZ 85.039 658.326 null] +2422 0 obj << +/D [6315 0 R /XYZ 85.039 761.463 null] >> endobj -3117 0 obj << -/D [3113 0 R /XYZ 85.039 639.853 null] +3032 0 obj << +/D [6315 0 R /XYZ 85.039 646.155 null] >> endobj -938 0 obj << -/D [3113 0 R /XYZ 85.039 581.213 null] +2426 0 obj << +/D [6315 0 R /XYZ 85.039 646.155 null] >> endobj -3118 0 obj << -/D [3113 0 R /XYZ 85.039 563.346 null] +6319 0 obj << +/D [6315 0 R /XYZ 85.039 617.419 null] >> endobj -942 0 obj << -/D [3113 0 R /XYZ 85.039 422.842 null] +2430 0 obj << +/D [6315 0 R /XYZ 85.039 558.211 null] >> endobj -3119 0 obj << -/D [3113 0 R /XYZ 85.039 393.438 null] +6321 0 obj << +/D [6315 0 R /XYZ 85.039 528.807 null] >> endobj -946 0 obj << -/D [3113 0 R /XYZ 85.039 126.341 null] +2434 0 obj << +/D [6315 0 R /XYZ 85.039 388.105 null] >> endobj -3120 0 obj << -/D [3113 0 R /XYZ 85.039 96.139 null] +6322 0 obj << +/D [6315 0 R /XYZ 85.039 361.49 null] >> endobj -3112 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F41 2104 0 R /F70 2201 0 R /F18 2207 0 R >> -/XObject << /Im1 2193 0 R >> +6314 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3123 0 obj << -/Length 3431 +6325 0 obj << +/Length 2776 /Filter /FlateDecode >> stream -xÚÅZYoÜF~ׯø%@¢HvóÊÃ.[Ž•hd­-¯w‘Í=Ãæ’Š¬Ÿºš·ÆÆ‹…‘ì®î®®®ã«êqü¹‹È·/ÂȵU-Öûg±ƒžŸO\¡pÚv»~º;9x ×±c'^Üm‰änó›õòÍÅíÝå»å™RÊr#{y†‘õêréZï…wË3×z /·LrûnéEÖÛ×W×—Ü°º¸¹À¦Ÿær…ãnî–¿ßýrry×ãäLÛ:PÈÊ'¿ýî,6Àí/'Ž­âhñïŽíÆñb¢}eûZÉw~òþäí,ܧAh•Kø÷'j[jÄõ–-ÝÎ’$--pSA$5 2Ûf'(g­¬d½æ#ÇóÐÚª²ÝýÒ‹­F¾·eÅ„x´Oh|à󃙤sW±:iÏœ24©,ć ãpÓØÃ{“Évï¯0 á !Sf º]¯·MŸ»' ›ºÅú¢¸£I<äïKÃou“²2À—ǺìiR€–¬˜(ÛøHª&)ãµC;ÖíõåÅ{ôLwóÖ8t ?rãUk$þ ;„§9Ô¢U(ìàG·Ë³™}ŒN>R,&x®ùu+Kp%Ö^Ò,ݺ“„¯U‚]ÉŽgƒvÒÛÈ#Ö"m½8˜#DC¡³ê ð §áÅêS1T£B0Á®óA@Œ"h˜|+M߮ƪ§`­ØGvóÈ}d€%ñ»ÉÄ8ûcShÏøs׉íãÎq®üØöã`֣ûAÔp~µw¯JàhÑ1¥bÛƒÕ=ÐTˆÒm ŠfÑO)«Ì:A;ªÒ-:”œÛ3poðæ’úKØöz¥ªÕwp¤U ([&gçÀŠXqÓ#ÒÝ“:PY¶QbðÌ4ÏþÓH•]6Px&3*Øã*p€¯EÁàà­{Ôyî¡ï¹ù´ªË"‘MBçömì‡çF)qWA€»)˜–÷/m”¬ò†›³<çu>ñ:ÝÚð؈T`ºÓm SàýW;Z”¸&e<-Sƒœ>¢5•£P®¶}ÀXg:²ãè»4÷½áâ ‡ÅßgdpœŠ<]Pp5œ ê¦ßi«}ÚV:èk+`Dm£÷Œ­WdJÛDÀP5>A„4—Š• >>fžá°jóô³ËÒðìãÖÞ|uä­ÞCTò#\‚•ñü`e -á¾s|ÄÖ*ågRl¸ý†Â–>÷!Òù¿n™€Õ )ÈÉkV1ìÙD]±°»ÁžÃÀ¥b A œ„Ãç·’µNõ“‰X›ì|¸vyUg27tlØÈÙo ]Q6ü’äDß'þH¿d5Æî „‹FE'­Gþ‡ñãsOòt³“ÑP´u.&íY$@ šnkƒÊƒ|£þ„îh'*Ïœ#Öº‹žÂphœÛØ\‘—ÏuC˜óTüÑò Ÿ ÓBxŸ­±ñžI*ÚÓ.3h¯Á)Ÿfvõ™Üy˜ÀŽ‰tÝp‹¬ø~HP¾À-ÅÝ=7÷–Æ>Ú¶¬áþ!øABáÒksŠ¥†w4ã ¡"s(>É ·%¯1À Ûg¶Þbñ šãí}tƯ€Ï²0 ÷„5ùCBHhõƒÀ*M¶Ïê¾@#ô 0"´ê¬IÉaùv³z4k è å<­ÉÎA­ÍžTlóÆèÜèŸK?Kn.Ö³°©õÄ»»Ê;ê‰ÁW{ÁÀOà {b×rqw¾C¾w>q±ñ—óUú,3D«ø(/¡8Áq?{·DT 'ä&5Ĭ”šÈÐÅzžQ7&ØKn”š{ºQsHh>â!ec:pì;çÇJfyB€%ÔˆgÚqEš?Y—íËcѱ_6»ãˆQÁû§š’mT‚[Z3ÏÖOÜw‰Ód )# y®Ñ‘v»t„-Z@³C%“yhš*%nr²:ôóÙœf¾£cÀ¦¿¥ áµ™þ|öÎy«Cé='ÎÖñèH°ïœ«Ä9¡•ÓÚ…È€ó~®xfŒOmuƒ‘(OÑ“ì$÷ã<·“5/G­â$X’M‰ ¹íuÆ©¢ÏÅ’óתÎ]7¶µöE¿ÿÆÝw=;ˆã; Ø1îCSîøGS€ß/øf¨`„ãÝÐ)¿·×€8~\o)ZÏ’•R…²Û¤2i%/{š¶>©D"ÏÏõÃôVV+:JH¤;Ró¿9É|ß/ýT˜²•òÑ„ÍõÕ˜O7°U ‡—ÇÚLÓzendstream -endobj -3122 0 obj << +xÚ¥YKoã8¾÷¯ðme`¬EJ–ç²èíÞnôbÒilôag´-ۚȒ!ÉÉäßO½HI‰åid â£HÖ‹_UÑjÁŸšeIéÕl™©PgÙls|Íö0óù +“è01Ú&nv‘Æad–iäŒÅR­BmÒüëþÝÏŸâhGašêÙýn¦TjÏÒ• 6³ûíÿ­Âù"I¢àf®‚bßØ®¨«ùB§i°›/TÐÔGî}ÅÞ½ÁÎ2øÄqàOvõüÿ÷ÿV± WQJ[ßÙãÚ.4S|ûøIÞýûÞ3-<§é*LâìªXK%3ÁA«‘X:S9ûþP´pp2É×â'yÎû7÷çÄØæ<"0]Û¢`8EN¦¡¨["Žƒ§¢= Eµ.Ž‚£[ŠŠ”w ôI‹°ð+iF·4h‹Š»PzœÑ–N™ + ¿"è­Q©H(ŠÕ&XÏ‘g<7ß2ÉÖí íñ¾á” "ÐœºîYçYÊ€¯¥C$™ Ó,qžE¾eVÁ·ÒV•×ø­¶Üøœ“Ž;šÄæžÝå®ÃŽkðÀ»ÌwW*[%WùÐL»N’F¡Ö1ñýUë ;O9·¿ósû Z7%JÇ@–7BE®ßz×岉åOkqÑ3X…%¤ím'4eÉ[ÈJxµÌÉ›dOë!…á>lÔgRšØØ2Éz¾ˆ—L¸±gòÙØWÜêD¤p&ɧ]ªÂ3Šj&4*‚ ÅÚˆµ;™]ª´ø}æ•è¤H@—µƒ-[r(?ó´b5£*p°ª¥A:!fæˆAë’OWÁQ–mlÅ^Xµ¬ŠÂ©§8Ñæ´r{A|öØ)Yf!¦áÊØ  + ª€­ +Üíá‚ýÄÊÞ׺Ý`+´KooÁfŽ®0‰tÇÚÃN,Ê;[À!OƒÁ®Æe':6ox¢C¢ç~ø‚ÄmÑ-]W-á»CªûÔ9Š1Ü©ÜQ¨ðbÀ²êÝÜ1ýwÚdëÅi_‚âÉÉ@U+@¯º3˜«¢$‹ ¢ø=á +x4¤ý` §þcAÌVG¹[x$Î'r×Ï|× ƒö`†èÑ5K$ö.Mƒ©hÜ2ÙÖyYg‹räq&8r &~xDœ‰œ0]l„´ +͇A—?q_®záТåáNd‚æÁñR"¿:ûîÙ°œÀŽû¼czÂ/Ló¤¾îóLS!Ǥ*Luº4>ä¨p…"÷ÐmÌ*ÌâaÈQËin׿3 +ÎéB±¯>æíOf^&žb:”˜xÆZnœn@éä ÏÜ©×È\ð{¾é +ç&8¾Cü5qÊZ¯ÛNÈQû{[-›€"‚a0`WpÀ#!vÐñ{´ƒ3:ÇÑØÍèø¹${Ø û:¾œmkÜ®.HÁW71ìúðEÿÄ[¹t) +Œù+˜èþZgäy|ƶü=Y:¥$»µrŠŸd&@j‹>( ¹£4¸­r¦ƒPÇL¹{lðȃ-$+ójŸÓ}@¯¥+1…83 Ðq0ySäÕ&çeœp¥ny3XïòA¹@©ó@IêÈ[è5ŒAœ(Ÿ°SàÐc§®\cÇ_·ÇÂ'~^ÅÑVvÏÙE.–`(p¡Øwèˆ$ðaQ d6e#=ˆZ 0ÔðyV=ÜÅå¨p›œà- n88>3ÅÓaNdwaxý%[¸“š¶g§L‹â4"vy&É*hÁRhAœî*ÐM*Êmê}‘‹e€´ƒqLà`þÇ`צpŠª^NyŒúÜH.•rDCN0qn„9š‚¥–?T m\ åKPïÙ^kam[W€z;ÎcŽ¬·¶.Q7= [1¡6~‹”iÚ¡1ɇ…œN£¦qŸu™Oæ_:Nj83v»Í¾|æA‹!ä±h‡‰—ËŽ•sz@GIl×±/HŸbqV€Ô8bÅ’6ÄÊ 0 +[ ÜLóÔ0Cp(´Ì-*ˆ„†s‡Ós¬Ö…{lÑì/Í3]1pEÄ {]7²|-yuøm{zÂxøîÝ­B*Èœ`‚jaÈ=‹nœàô[°é_áÄå"¯x„ šAÁö ½|Œ—™à'Þ•€î ¸i–cF–&x¨‰,œw_6b~ØØøùSšBk¬²0ƒÒ3"®XqÝ(Ç:ŒWZÈ~™e2„FÄ)Ôœx™¥é¬×qP^rš$:ZÄ&•yBÝì)K“(Mhf‚o¤—þAa] +tkŒýIøT\@Wªü>jûLθFï!Ðá ]émþËËÔÆ¥%ñ* +—Àì…ì&†YeOJ›Pi¹_!÷Ñ«0²ßÑÕ?žšú%dû@âî VNfŒJv]”Å\ž'¥Y.Ãøí²¸ÕW$!”ã1¢ó*ƒÚºë^¤¾PjK«ÜûRòpÊ–7èïDñ¦z*?þ1ûõW¤"”ó¿‚up‡7?`­ÚUžìÁTj‡5m×NÊ•D¡Šþ†íúõWä¢ ¹\Ìf >Sd–+ÆÏ%†ÈÚ.Ñ×â¯>rË»žÖXl9œœ4»ÐŠçŸ<úLêM§ËCoýú+z"ÔÛ{òÞºØöÒßqó×bãs~xdå¥<]O¥ÛèñmJ.í(Òo—«_E.!šð‡àý¹$ãXÈ‹›÷e®G\q —D±{4¯ò²…JCú&:óiÆ +Bð},:ôlúœæåÛWvæÂËR49ß¼=Ëá|˜vÄÈåv¤Ô‡ÞÑúWä!'_oï¹O6Æh,úä½&cw„÷&œÌ‹ÆÔ Ô˜Õ0T¶<‚ÏwôE!ºÜ]«ÊöE1Nc®*y\”¹¬Z”P*÷úWw&GV‹þ¬ÞfR›ÀÊÿ¢Äô*#¯êZدèÔs!Tš}¥-‡Â‰çÀ¦m}̹Åé-{æÃî]U«7õñdùé6J‡ ÂÓÔÆtªAʦèeyC¶lk^ЉpvŸ_g\DKÏþk Ç–Ë4ù˜¥üé¡å‘c_¢e‚iYÜ—‹>9ÙîLÅöÄhø H÷£ÞI÷`…âäÞ +áG<âŸLöÍ´»UR¾ãõt`Ä×…îè•#6J¬ œ4|é8M ªÂ€èÆ»W/ÿ†‰dqEL@N‚AªÀ ²ää8÷[”DO{ôònð¸;PMuÉ4ïïEˆM‹Þº]ݵަ[8KMVh߇5¿uj¦ú?wˆhÍ¡¶ÇO~“¢ÇyŠt'T„J.È¿¸ýs*¨( Sýö(7X? Ñ+õÎ'zRÊMñ¿JÂ({{0ë—Os/4Èügº7ç3ÉÅFé³áýVž{±Ä„è‚þ5Fƒ&(Ó£Ò¹{fÒ¨-ôNÜ<£3MIŸ)ˆpæÍÒ÷˧¥”þÆrATT½ÓŠŠ—1Ú?¹:I&ó‘t®²·ËÐ/Ÿ–AhP†_ë½ËîÏôˆtrVš´ÐÐesöÕ ‘üµ?y³Hýòi‘„†"ˆä>>ù`ÊûýÎVl¿&XAÅ^ÂMÿö k>Œ~ÁnÇO‡¯¯/%󬨚™¼üÖ¯£0UÓoþžòµø:‚ú)v›Ñ/fùò@Hú@GzúÄ?TˆÑendstream +endobj +6324 0 obj << /Type /Page -/Contents 3123 0 R -/Resources 3121 0 R +/Contents 6325 0 R +/Resources 6323 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3111 0 R +/Parent 6304 0 R >> endobj -3124 0 obj << -/D [3122 0 R /XYZ 85.039 781.388 null] +6326 0 obj << +/D [6324 0 R /XYZ 85.039 781.388 null] >> endobj -950 0 obj << -/D [3122 0 R /XYZ 85.039 531.337 null] +2438 0 obj << +/D [6324 0 R /XYZ 85.039 761.463 null] >> endobj -3125 0 obj << -/D [3122 0 R /XYZ 85.039 509.575 null] +3033 0 obj << +/D [6324 0 R /XYZ 85.039 646.155 null] >> endobj -954 0 obj << -/D [3122 0 R /XYZ 85.039 410.893 null] +2442 0 obj << +/D [6324 0 R /XYZ 85.039 602.617 null] >> endobj -3126 0 obj << -/D [3122 0 R /XYZ 85.039 389.032 null] +6327 0 obj << +/D [6324 0 R /XYZ 85.039 571.092 null] >> endobj -958 0 obj << -/D [3122 0 R /XYZ 85.039 239.143 null] +2446 0 obj << +/D [6324 0 R /XYZ 85.039 461.651 null] >> endobj -3127 0 obj << -/D [3122 0 R /XYZ 85.039 217.942 null] +6328 0 obj << +/D [6324 0 R /XYZ 85.039 440.454 null] >> endobj -3121 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F70 2201 0 R /F18 2207 0 R /F20 1617 0 R /F38 2158 0 R /F35 1632 0 R /F41 2104 0 R >> -/XObject << /Im1 2193 0 R >> +6323 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3130 0 obj << -/Length 3180 +6331 0 obj << +/Length 3618 /Filter /FlateDecode >> stream -xÚíkoÛFò»…Q ˆ D[÷Áç(mZ?r¶rAÑ-Q6QIô‘t]ÿû›×R¤D9nÚ÷áÀZîÎîÎÎ{fWð_&¡ -lz'ZÙ$9œ­‚Ãùî@ DpèT…8ôÏéÁ·o#s¨•éátA ÓùÏ£“ïßO'—GckíH'êhÇÉèÍäH®~„?Ó£±]@ã=ƒ¼¿<2Éèâí»Ó wœŸc×w39ÃyçÓ£_¦?L¦LÆN¹È"*ÿ9øù—àpØþp(›&‡Ð”NÓÃÕ ­ -•ïåÁÕÁ¿ÚUxÌò¬‰”‰¡a•$®=¹N¾,Æ€÷,[âA’Ñ]¸—Ÿí–9Á…éè݇âQs›c#ÝHÉ+žt Y̓wUe¶*Ö7²(ŒW´(4–9N}ÅÐ N•egG&æ¥Ö7¹_­ÚŒ?TEÓð§­y妔ßÎ:ô^ÖȤ¼Fª¥täî™{åšå„nTçÕïÈNÚ -ÁÕ63Ç&"["rj£!Fx­Ub¢– Æ´JðË9§`4Ã`tvˆDÑèc±ž—G6=ÔÜqŽM~Ä£GN‚ÃÕoxè&k -8ËTƒ§4 -ÓðiY¹2™0$äð÷#ì ø!5‘uˆ¢ EDÈ,¤(¶çù"CÆ,ž{_ mé«Ï„/˜‰Ø,¯›¬X{ÆÏyÆ‚Dj% ÷±Ý -´'Å·om÷0ôG'r¢Wu“¯Æ$%cêÊÊeY6/x§;«˜DEÀu^eh›P9à0¿¯ÊE±Ìkë‘Ö%@~÷p[ÌPêná&ÒòoÆ?= -Ò0ð{¹D}¡£RçC=Ôj*Ò¤z™5H¡®ìâit¤b0b_œ¤us–}gõ+€À²åûZ UÒ²O ßÒP¥QŸqH.½ŒYgYH -T#çFó¢ò󦬄ìüf 4cS•I/É  ;2‚¡¼ð±¡È¹ó¿Q†—u <ˆý(M©hŽô| -ÂÀÂÍ[Í‹Ñ+üõëÏIôñÌnQï—è¦Ê`E0¿!É1¢‡`ñjé|ƒ‚†Ræؠ㘽P—:Š€Éao»)€©3* ´G¹‡ÄÀfa¨L˜ -´fF|(‘äÄ< p”GlEÍ+qÝô⚆ n¬¹ÍΪÜ/·Z!(Ë ̪²ðŒ¹ -‹=ÒrBídÝS³‹íÇÛn”‘FdÒx´Î°‘l!#Ú0‹ž´, /‰Ìª,™ø%Ÿ’‹‡©àåáð2ƒ\(­2>òvË ÓzÄîÞYK!µ0e÷”3¶/YÓñ¬HKñ¬¯ÂWm­J†£N£Å.ŒyÓþdpAV÷ÿP·ÆT¹ÍÝ}¡Z~ìÞtœ/#Ù•ÝAñC“> ‚ìõ«·ÂÌÖE!ÍAÛXx`ä|êÉ€Qá”ã£Äb"ÂkK(M.CŒ¯²‘"„`ZÃ9)’°½Ø ¿pWUŒµØ”/óHT1à#1ì|Ö|8N3ãÆGl–â32¯Aþ×c‰Zá„뾉˜rÑÃú¬?!ˬãå‚Ih 8æCÎîQŠ·xä•QxEÌ ì_”äÕY½ÿF;D«5ù]ÍM6ƒ8Zú ˆýœ—ôKW9aÕ±~3Aφ;J‹ƒ·ÑxÉâôz¯¼Gà.ÂAmÒ€ }N¨õNVYHþ5A·6vq´ñw/ñ;D¡ÀÓ—÷¬ Dç[”ÕJXìÄÀRóoyŒž!‰nÎ|Eöàgã7«ë—b7ÁÙ)(!4”îxH§7©©ÓI›T´“ñ…d¤Óqº—€Ö/¬Õôú·¦¼ã)w”‚Ì5ÓO'½1éÉš[ž·ÊPÖùãšæÀ¡z™}”’W/¥IÞ½)¥¯¬ø·kD`²£:Šjã€G—6È„"¿q9>×yCÉ\B²JD#Jø«œò^͵†óù¼|ˆlHì(õȆ.ãhl+.À M¢:>04úÙ!• ÈÌŒß5sWXв+)n úaňlðq€%ê•Ÿ•¯;»Gîºl§½Ëޖ났‹‹É:Ó/.—ì2Y7˜üê¸qýìw_Ž%*6ñ3ó¾~ÊÖ[§—²}n®&—çÇg“C‰€/dpÒ -€‘´)±kN]ÂÄ'Ïa’E¦KXÒx¶¢!ϤETBÝqê72T¬=->@^ª¸…"¯±±'ð–ð>g»}}föp[0Ò 65¤UOUËHµþrŸeþvŸ…&Ç $ G@­Éq%丂¸­w"hÆ][;`Y›ý -¾pt}Ï攦È2™—²Î–erAÄK5vÎËMP!+ åËfÀxä5Z"V†NLˆU¡Œ(·1&Þ­Õb'é@‘}¡$jÎ…¬²_% )NÓôÐâ„ϱ8c«ÀÚ=‡K–·EIŒò%½êe³ûÉdÒÊÏÊý ÄûvÀxìW>—ªH»/×=ûUtÏšNù‚Ãó‰¿p9Å—ï.Φ-pypš-Ù}W¼¥’Qtœ"ñÁ¯åkü÷a¾&Ñ£‘ïƒHiλØnJ·«o™”)H¡)©`·’7ü iß!ãnUÐò÷|zR®Åzq: ¤7¾p$¨Zç£hÍ˶("è3q:¤¦.à•¡%¸[½ò€“Z|PÝŠZŸDYl¥ÞOŸ«Zðõ¥ðH áb—§ÔJ‘P\üû'?mK°¶‘ -V’€KOßÍYå°Ž=p3'#­ÄÛ!‰?ùpy9Ù½tŠc)P|ÕýÑØ 0Ã@`ä<îèÖM*[³)Z´…óð*ÕãQâ†ü½Ö*œÔd¢/·9îo·9ýªH¼)àÛ˜J#·6eø(ï)’‡£‹ÝI[¡Œ2ÈF¦”ÜÙI ¸¸c|]Šé¾,¹“@g! õ/b÷D¸}gjœ¤' ·9—Ð>—0»¹„OviæÂCûèÚìbÊ5nmÙ†ïÓLʯuk'î÷Û‰0…–i['´7÷ûü -[U>¦JC§ÒË¡ìT M8›ÄΘŽ 2m= ßXFçÇß=–O'Êhó”©qZ%AòS£\K§–ÒímDÓ^“@¶ Éé”ÛQÝDåý= Úz°g-10Ø ãÝHÀtÂÅ=lú‡ Ð8ŸLO/ð Å:ÞŽ9`Z6˜VG±ŠÚ››Ï8kÜtâa©@ÑEaÿ!]‹È¡;…@"5°ŸÌüY-ÄÎt‹"¤¬‰{LêË#HÐß‹ò¾º‚ÉÚ=ó ̉ÕåÚvãM!÷£¸mkîðã6GŽaKèÍÖœ’½¢˜³ÅpŒ„.¡7ïHçL7•¹„_è~ª/Á>•XsÑV.—2!FÔ³; µø€ 2 -©ùx)¨£±Þ¥‹UªÃ­‹Q×°‰ç ñ ³{ýY|;«;èR„ÆÕã®ÇÙ–¾»'Ðq LäUí”pÇ?3ü“-‡t3`È#_VCkZµ—í’üØgàº^w”k|@íc>×i×Í,wÏʧcÉÂ1¹k¬roÑ#§ìVøXPUv_pj­2©þ©è—½WøJůH«8·Ÿmµ—qºpÌÇo_áÇv)Ù?Á±lÉ×&BQ|äúJSå|SÒ^sQ¹ÚDáfTô_O \¶’x‘j¾R@†ê•Üÿ®Û§`uí3ŠÍïÞ»άo¤ÜæÞ´Ú¿×zìæ¶[³z=¡cPMƒHTºÖyÿzzqr|úëÙñÉ÷ïÎ'Ÿ´uW?]M'gÔ*ÍxlŸx÷øA¯µP‰1o?Ÿb×É}UåëæßyU§°ç¡X“iÇö@ÄöÍ›|™7ù%³ð$›ÝæßücþPVó×ÿӻѶsm¡Ša¡Áw²É_{}hã§¯—B·ñ%e/xÿ/*ųendstream -endobj -3129 0 obj << +xÚ¥ËrÛFò®¯à¬2¼ú&[vÖ[vìµ”Ê!ÉaH€$Ê Á eí×o¿æAP¶”R©8ÓÓ3ÓÝÓÓ¯A8 à/œ©ÄËY^„~\³õþ&˜maäç›P0‚²ppÞ<Üüô>Kfaà/ƒåìac×Iý$gåïÞÛÝ~yx÷u¾ˆãØ‹C¾ÈóÂû4½?½±÷ðáó/<üþë<ʽÏ0ö‰¿<Ì¡—pç ÀïÞb;ñ>3ìþöÓ›ÛEÌ@Aøóáß7ï å†& r‰dÿuóûŸÁ¬ÿ}øñ²˜=B;ðCÞßÝ~šÄÒonîoþc–â±dƳƤ”Æ…Ÿñµ˜ÂÔSÅ~…³< ü4HHN» +¸SoS©áÔ+òÞ3pØ@ ܹWûyTx+EŒàîó;¾ÇNâ»G¿×*eMu(ypØñ"‰·ÇÕb>1`5_@G&´®«Ýy¬ipÑÖqêÃ)2%[–̹4ˆrÃJ3&šKªKÆ3‹«*j“òLñ¿á2{9vþ3ü ò÷¾©~ÔÈV¦Aä‚@nëµPŽŠž,—”¹ÿ¶ Ad«d…FqØUd¶†Z»z¹+8u¨Ì⇶i·µá +htŒ +V=ÛnУ4áh¡TG¶Îh×_XÁ=.ý¤qþj,ös†1Åàq<Ôû¿äíÌŸ–·FB2oWäÏTHÇMõþØ°-!jgN?›òÔ8¶‘qS‘Ùéëía¡­’êHü(lºS$嵎:§d‘‡ Í ;ÿYÒ¨,À¼,àÕ Æ`uóD$@ÕÉZWNëµ6Æ0 N’YÝ÷ Ø´hÉ +’!¨•Ö‰¶qÝׇšâíÓžu©÷[?¢k‡j0‘"¹þo,ö‹æSÀÀ’”‡$vG iÿ²yCt³©Ä̓èÚvj0y&ÀÀA‹@SÑv÷Q6HN»gÄO˜1±÷[}()„#tI:Ùf_H~Ï“X…­²iöÜü^mâL“»\±–Nå`ùÊóåDj)=ɼZm×sG99GæÞº=ôp*]UB~™Ä…÷+ͯ4¾\àñÔ”œ½8éNÆâBœ@_¤Ã‰£µ'ap‘R‡mÕóþVí„Ú½2~êB9ª: «­ªŠ1$ˆrÛ +:‚qFƒë¦áÖŠât‹ë X ªFÒ9™ÂÑ'4ÄãÉËqíÞ!ÝL7büFAMžYyµtâ4rÕ1 9®ž¸s¨ŒäÓ€õ-åSiñT—¹äÈÜ´MÛãdçx@u‚Ñ[’¡Ga˜ÙOÖ0 +…œ§_2< m…Iw¥7vïûÓš‘„ÒoNÖ s®±íæâñ^OT)’<ð£0y¶ãà!׊µNÒÂÏ vâqè‡>ìL?à2—ÞëRSãif¹÷‘â8Á§yŒ÷d˜¢0Íü,û +-Έ©×Æ„œ‘HÓ$68pÇhb²ŒðªCÜœà‘Ÿà¾3†êyPq·l÷Ä­Ô²³ìȪ7&ÏÂàïm¡Ã“í>³j^Ó@|­£`$Òµ+ŠÐíhY¸—©Ä,Z¢JçHŽ²ý²Áa©º'Fа3R0ˆy%–(ÅÐËãL¾ =ÌA?ˆ“PŽôë1°kZ¨íňֳH9oíPÁ°>G·,KÀ· ƒ*Ù·ô õYìòŒGÐYσú$°­O¢ú1ðŠýŽ,4Ùv·Çô…þ/-/(lòpS–çÑPymÁœã³>î‡d:Þ(ȾÐý&ƒpZ§:CN¢ ¾À’ˆ‚)0ñØUÙóÂdf’ÂñR<Ò}-y„1–Ö¸B»i ÝÄ<€F–ÑwcgwDé×{Ö­<8S®a tü +-¢lIúþåN@(”&8)Rj¿ÓðB Ìm;Û¨ô’6iÈo#".ÿæîm¯G±F±÷aàaçØq-¬‘ˆ¬´ˆ·­_Å9¨ï¤8U -…"dÇ€³jñ¾ Ørå;’ñÂU(8#³¤zž¿éP²ØúT¯»¶o7²»Î{ÈùBÞ£·îyµ3Jë¥øšM›œqÔÒëô)Ê9€‹òØ;!êÀ€wÈõíî]ÄйڜΉés¸»(s¼MtçžpCI¸¤W[j¥4=ÆæÓêúÆáÈ©¿¾˜ÂòʘˆTìÇyÁŽ‚Ð,»<“sy:[˜Þç¬òaW÷<•ï7YAH´Q œ~H t4×ä·Ý–æ×½¾šÖô+²#8OvãϘ2Ùűh‡m#FÏ0§3$[©¸2£X"häsG‘pB=ðX³áþš¢º,9ßÓ,òd)VWåØŠæøŒ)—´©!«x yÐ}íuÿéÚÒžy;AtχZKË)âøTb.Ê:á²æ óݦ—ú´S"§õ ‘\û2¯,Ùê ™#ÙÊJj"&RF­Dö¶B~'pEøŠö<¢fŸ= cçÇ7uZ|“Š‹‹œy!YBs +|âÈÊ‘aAr +ð ÷ªÒÏö Á~¢þj2y£(, å‰>ö4”È®a%7‘“PJI€Ä]ß)nK J=^M3¡Z\æ{²Ad‰ÓWM%ƒjͧ֕:Ÿ&Š[M°ãž¯¯¨dOÑU–IšgŠ + °_‘Ò¾5påæœiž£Žj}V2%ÒÉ\Ë tíJÖòa7©Å·!°ÑÚÑ}­cSÆõ$Ùîr œ?- +;{í+™;eª“ð*é_ñI¥´ãÅ59°eÛÕ¦˜Å#WÛó…óz¦¸©­ ^ ^ÆG¸aœ½-/‘Éo;÷íHÖÇ"“JªŽ« +&*Ƀëãü»ZK4TKŸŸœä!öBUËïÆ¢+]ÖÅH óª¥8jIY‰Tr±=TúÑ“zÚÁÃT÷Rž•õqbe*çI(t´$X“«¸Qòd£eÆ +ôÀš­Ë\3ÊÚQM‚‰k‚gŽë–qÞŠT;Õ4Rv¨ ©É‚'ÖÎÄñXàÊ8ÖÊ'|.ø+6Ø”+p-˦ OqaŽîEuI˜(k_ùÆìR·â8¨JfWט•|jnêX¼hÕ£3§¶ÆvÉÿdÿ —µqx2üBuo¯‹¸à†ÉOTºÊñzÖ|R)'åuïä}–9{ Ç\À®¦TšB0\ïëÖóì;^ȪH%µvžÁu£Ä븄ܲW_m/Šò©~ÃJ§ö•z:QÂ6)üî1—¯˜Qù#J¼0°‘RÙš,MæÞ‡ûz8鬓łP“¬¸¶Ø G©3œEÛÕ²Ä`óPÅ|#b ¬íž»z»“’btR½Ø‹f•VÅG©[¶ñÎuãçrÅpòeœoHu¡NbÚ¸~†$s”Nb³Ãe€ %¯ú6•N˜Üsa|ù„eÓìØØGjŸUÇÒ4'Ÿ§?jù¸?1J³g pÎt‰0Œ;È/J„‘”ïENdҲܻß), vú–e)(s ;”0ÆäèOR]¤ÉOX_œ.-†QäEúŽ|uÆæ}ôq¤OPäÁ<ç§yy‘Í0=æã%è™åÌg>ÊÄt0ÜýÜ¢¿‹™0JªÏòž1êop[uPÛËwÌí¢f>usR]›W×&¾f›Ö€Xã›q²x è tpÃÍ'ÙL%¾¨¬RfÖP‚€CÄLîFxÇwâôdµ#½W ¼+ÉH‡4Bd—']Q!ÓÝ ‚ñåæX–ùXMK‚V#eâ¡-³ bì剰°_ï¹åˆ 'ããuo¦ËŒ-~½b³À\?+N ›®ƒ~H!ív_0 Ä ¦.ÑQÍ‘RX6¯ñƒ¦ŠËëSW]$>^žÌÙ8?ÕLÍ8ð£ÑáŸwûG†Ú—Ø/â‰O +S0]Q¨i!«›—ôêH¯þv#|²endstream +endobj +6330 0 obj << /Type /Page -/Contents 3130 0 R -/Resources 3128 0 R +/Contents 6331 0 R +/Resources 6329 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3111 0 R ->> endobj -3131 0 obj << -/D [3129 0 R /XYZ 85.039 781.388 null] +/Parent 6304 0 R >> endobj -962 0 obj << -/D [3129 0 R /XYZ 85.039 719.568 null] ->> endobj -3132 0 obj << -/D [3129 0 R /XYZ 85.039 700.697 null] +6332 0 obj << +/D [6330 0 R /XYZ 85.039 781.388 null] >> endobj -3133 0 obj << -/D [3129 0 R /XYZ 85.039 482.087 null] +2450 0 obj << +/D [6330 0 R /XYZ 85.039 470.214 null] >> endobj -3134 0 obj << -/D [3129 0 R /XYZ 85.039 380.398 null] +6333 0 obj << +/D [6330 0 R /XYZ 85.039 449.619 null] >> endobj -3135 0 obj << -/D [3129 0 R /XYZ 85.039 328.662 null] +2454 0 obj << +/D [6330 0 R /XYZ 85.039 138.556 null] >> endobj -3136 0 obj << -/D [3129 0 R /XYZ 85.039 279.048 null] +6334 0 obj << +/D [6330 0 R /XYZ 85.039 115.84 null] >> endobj -3128 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F35 1632 0 R /F41 2104 0 R /F65 2099 0 R >> +6329 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3139 0 obj << -/Length 1713 +6337 0 obj << +/Length 3679 /Filter /FlateDecode >> stream -xÚ¥ÛnÚHô¯à¥H‹ëñøºolBš´%Éiµj«Ê5¬›¤ùûžËØ1Á¤•–HñÌœû}lÑ·áOôCϲeÔBaÉ0ì'ÛžÝ_äMO »ïZ¶ï!èŸEïõ…ïô…mEvÔ_¬e±ü48»ß.&³áHJ9¡5A88Ÿ Å`þþ-†#1¸Å-£ÜΆN8¸¹¸z?áƒéøzŒGog2EºëÅðËâmo²hi2r-×—¨ÊÞ§/v Ú¾íÙ–ŒÂþ¬mKDQÛs=iy®4û¼7ïýÛpa˜ÛgªƒG®ð, fŽ¤m…¡ÛX.¼˯Š!؃‡ èœ%C'làÄŽ Ú—)>þ‚#°®Ú¤Œ«áöIœó>Q;´þ‘wŸmÏÎ -4ÿõ…l ¾´¢È7¢_ÍË*ÝΔª^1²+ZÈ~hNÛÅͳ\Ï3ð[­VYž–|\Ï -Eø>n­ÓÝ|2»O'F£ŸyåŽÁ#…q]–çì²oä•IÁû€Á ŒWD4Ë4O+rèÓƨ‚Ó'Wkµ¯,"4òÚtwÅ¢C„|1˜Îùùü Üzÿ¡Ä3 ™çâÂq«xà¼â=E-0­2€¨¢dÐJi^$j»E8i4ø·ÈG'¤‚!Á(çÙ÷amñ3¯J×o ã­)¤†çxƒs•ìGµ¤q!;=BÚ¦EUvø] -Ëk2acŽ;Çw‡ÃÆU—™®ý”Té’+ÅϘEQ‘ÏðŸÒßVnbÃÀñ}`Î)‚Ø'ä¾e¶œGrüÚˆØV -Rï¡¡ÓuVVú‘wì´ÇÒ2ž`ûÚ_lØïÀWFP_\—¶b ré‡ßHµ”!ñg[È–á>‹yl³V+~Vp¾1gT˜ˆ³åý-y)ÇŒ¡ä1B±Í-ñ°¢ì‰¸òÑ߸^’#hYïáºV-·lÖéT.Ó¨…°F1æ®çª°çM¢Ó¸2X5€K€ìü‚Í$>)Eo‡•Ð¥?«´(3Js Â*À¢‰‹9ìNùÀ”.èX5ÈŠŸqžsvVQoEm¤ËÒmELzì«"5ˆ®Õ~½áæ@{{sweñjŒ*ÐUóž2¹I‰– :5çZ‘úù­¡‘È$8`BÙÈ(W×™SñYÂýÈ”4Î÷cû1ó„8lG°ß—MG­P¢ÔSG -ª®‚q6™Jíl½¦ôHF6Šâ¸ÃYÅɃ’šœ×†§ÞM’€f›t˜3¹è ¡T5/€šêmÊý‹í©¨³ëòd;_pEƒ 7æùà2»ç† -óÄn$2©@Á†Jœ,J er­"®Mrm(”÷YS@ÉõqÆçOs¥¬¥°È%m˜adb]µÉù*@ͫþƒ@C¢´ »£@cž‘°&© *ñ¶¡IÅœb  v¢¦#KMדô#9Ù4aæ™ð¬ü»cX™;XfÙp@#.ßMþûzv7›M®_ñV@æbp`íg!ݹZUhCƒáL³D«_B‚y¾TåK(g{­aP~H5µ¯´šüÜåJCƒxÎÍkPîJì8™ç›¯1¸¼€¼îï˜Æp­Œ€•g¼%[)äÔ£^X§2žSçi<å6lñ˜¢gb›»”¯êfï+µ…~×ÏÜäÃ6.âu(0…q2¥šjú¥ëºµ†²§ø(»â¦Íýaö\Ç[@÷%”Ï9ÊÃR@×~ˆó}ÚÑ"G?ƒôÙá ¿†ãÝî<®À…nbéZ{;£–WWÃXbÝÐÅ ‘:ÚyZ~¯àn‚K >ß+Uä??è }B8&¾N«K¥–§¤ÖàcÂ[†´[êB±Zëx‹ÝÔ°ÑÎ+j‚è¬iZì™!9rÜ,M F »ƒ•ë0O‹åB"3вCÕhÄýÞ‚SŒö'ãý‚ ð~×Ù3\.²V‰4-£©­uÖÜ0´©ëV—õlÂ)Ñô‹úžG·›´~›2o§œÞíÖѾK=S;š78˜ê©d:Þp3èõ9Õ|xá>é[¶ß"ïoÎÆï¿NÇg—W×¾ðæ#ž÷âùÍÅâãxÖBq~3DN µ‡H[ÔËC䳃!ÒÆù³!Ò• ˆô=ÕdCs#Á -7΃_ƒ»;sû{ËH†¬màØ–#Üî¯CÆÜÿ÷MFVkR¿øÁExÞsE…îÀ/-u~· endstream -endobj -3138 0 obj << +xÚ¥]oÛ8ò=¿ÂØ—“Z•DI–î-m·½î6i¯qq8ìîƒb)6/²å•ä¤ù÷;_¤([îpñcHç{†gü…³,ñ•Ï–Yè«,›­wWÁl3®BXÈÂy³ºzý>gaàçA>[= û$~œ¨ÙªüÍ{ûë/«Ÿ¿ÎJ)O…þ|±\fÞÍ<ô>~øz=Ï”·úøù–§ßGKï3ÌÝðÀíj¾½˜;_`üÝ[lÇÞê3Ý]ß¼¹^(€?V¿\ý¼²˜[œËÑþóê·?‚Y Wüå*ðUžÍž¡ø!Lï®o?‰•ôë«»«Ú­x.žñª)*%*ó“L“)L2…‘ò£(œ-“ÀO‚˜è´ÚVóE'ÞnQôÇ>2Ò<à7özRHaF‹ž[;¤Þæ:¤š ÞÃgivâ‰Föa#‚Ù›~Uv Ø7«±“y´zÏÓZ¾;½—­ž·•Œ•ÕZ—·Þ Kf ¹ÿ"D"ætém3‡Ÿç‹8Ƚ]±ÇÞ ÷Õ-^´­ ‡Þ/óŽ]ÏŒMÅ5BÛk}U‚ ¥ËÉŠ‡-o.ÔÑë¢æ $¦¦±G9ùP¬eQ]ð" Aƒ„•£»ms¬çD>ìu׌qÂû£›öÅ#nEÄÉO a€ ÅzÝy,!sæ6]«Ó$§ÞoĨrn+\ÚñÈøØh>¡ãÁg]×¼ÓÀfž¤e¬Bï׊F¼†xŸ ï '|_:î¢r‚NÍm+»*¼}%bH\Ái¤ÎXîR§X# ˜‚%!;¯ìK<,ÊA2d ! ¶;½c”áüªå•¤FØ(u÷È-ËgïcÆdè´Y¯û þ2-ã0vä2d=Â/£^d©kîD‹PÅqæ™”GΔùlo¢J&[‹6#ÐñÀ_>¾ÅÁ]úËGÂ[ú=Õ¢Öbâ0õ:°ÅfJ’w–eú¸CÉÈ—ÞuýŒXˆ³¨˜J"&;h5tà¾{ÖlëÝ¡6Æû푃=Ï> Š*A…GM%™gÝß1ƒÉxÆšÚ‚Ö§Šøú$B” +n.v‰v:ß’˜³µ[Ò{ÆJÄdŽJBeÅ&…´óŽ>³J5ãóa»º€ˆ 3^ܶ¤)NWßrCòßÙ"'H‡Þßàm߸k´Ø—Üè«®5A€§y’¶šõµb[=Yak_ØŸ¢ôŠ‡×­XÑEX\ð‡ímÁbM:àmEVÇ!—ÙÿÀ¤"A‡ôcÊ*ãq^Ë—d²i;Ÿîçú6Rß:¾ +ÚÃ4$³Ž‹®, eùMÛõÄ!DAH¯›¶$YÜ0(™t˜-ÙE§HfGGE°‚åÍ@S3ŒëƒQ|£À{¯k9®N{"ñ„XìÇ_.:W8•ö#JãÉÀ#-_kða¦ç!fëaÛÔµ#D©÷¤ †ÛÖhdpXÒîtÇJÐìçö4F 8rAƒÖIƒbšhiu»üÔõšMÚ‹Á6ì’{Þ 9q˜ÒXCÔÜÕÒ#ö°@®jÚ:TœÎ ð`»E°t dõ}×s@Òkö_/ =(e£e0Ÿ±œ©|ÌnXÁ”“ç˜,™zh›·º‚,>©“ŒlÑ}Ÿ_hØvlåNÅZ n +b#jPàHVÏÁ+Ï(PàÁu×·¤« n3ÏÛF@$ ­ªgnô2i}-´7Ùeé±CThIßW»C/ ÄäA“d„Ò¯sq.Ó¬°-[¢Í;rŽÒlÃ_"SÕsG´ÕêŽY¡·ÚØ¡‹‰B o)z e4‰‘ƒH *³ŠxæBtPÈd¯ˆ$ˆŠŒ²<0ª¸]Vˆ]³·ÊÅó ©P )º +R¢÷VÆF¬+%e|+|â8ýýÆ€ ÁÜi§(wìŸ%J ‘EMû·Ž§»ãÈ5²È„ç·Ý“ ÀÕS´‚Þ³Ù‡!+k +¬Qªï8‰ÃÀRè9øåì ;^#6O‚Ú’p‡0H› 7õ¾V,Å¢´¤Ef†Ç…e¼Xà˜ÿ4÷—aï²>’Áé%·Q¹ fl³Å~æÜ&ÏOÂ}šg@â&’EŽ›˜c‰M[C†re½Þ½Õ/9~]°êA³nÐHÅ ¥`ÏoÐ?A1+ž…äBÙxN¼p'ærW1i!ÌŠÁ¢Eòµ¼„6œ$cD^õ‚mÉ lRWE+Ò?Ú[ˆ@ñ\-;ºÚD¨nc4¶ÀöôtÈmT’YSa¬¸Jò)Sà“»!šÅ®DVrFÖâ®õÉåDzΔõ@­ Hd-›0AaäÙ‹L ì+£ág9™uú.I*Xµx—#ŠUo\&‡u"®ÊI¨`Y׬.E¦—:~,ËZä=‹ÙMMTdâe⧙úaµÉ¡2J¸e”0òUÍâ4ö#¹£ +ýÐÔB_!gãÜûÔlH?Ò¥w·&U<;ºKh¥‘ªøÇh 0ÕƒV¬ü4%¬¾ !=@‰ì‡ÁzÃDÄá#~År#pgDˆ‚ ˆø)|B ­_„’tè¾>Ú¬Š +IÈñ,¹.9´Gaã\òÄmEü†> ´Ù碅 ý"£ +9ÜÎX&ˆxÛjS´¥)^à§×©ºžÀ’Í°¨`+šÂ Ø¥9ôÈQ6J©#LÜ”1Þ ’L+Ñx£n*–äœCêƒ(AÃ_›kŽÕ”ãx”¢<ÇÎZÏŽá6…–ÝÙç3ü(¹±Êitj¿¯ÖÖö¢FV/¼™“6\ åæQ–ŸÞœÆh¨ €ÌIz²©ªS²0[-ÄÒ%ìcè Nç¨m ƒ" mÞéÛáÍ9ϯúÎ’~tíâ%•,°¶ŽKZkŒÖ3 ª€PÈBõ¼”/¾ÙšçˆðØ8Ð䓶ªº¡ºc€ÇÓ!ÚÓî-EtxåÇËÃìaBåÝJ,î¶>u0¸pTnL¦ŠŒlû +r6”ZÚ¥ñ(ÜÀ¾“˦ Än¨ãÈ*–ZÀº†¿3¡3Þ‰¼6›£û8LÊ„ç: u⸲R6nÊò_ŠÕ»)ý¼X]p,*£Õ®Ý²>² b-’ê[ÍF@F±8â¾øI†ÓŸª´1¸#`ûú½rB”ç~˜DpÄýöçÕ§Ï>ß2àÈsĹ'±À‘q`†½—~š/G4¸kÐÆÇ`‰9ñîGmõ@>ñ)qR‰”å‹a/_3ˆ5kRLbÐŽ±MR×ÏåK™f‚î£þ±zÛO] rcT"I úc°ZwÛNN.oãÝÒ\AˆO„‰’Ô‡4gDŽ‹Ÿ(Ekö®#¥Ì!<ü¸çòàðÞuai“ÛR0Oí +Î\¢!4H—‚o)ß‚?!-¦¸-ãN¢dÉ pâJ d`œ ð¹"¨ŠÏ·Ñj…SÑ*>½rûˆkâÀ/mÂ21¦:q9ˆ¤k‰ÏÚÞ^²müßÑÔæ‰)Ž†@%îaƒ +Þ¸ÖÌà‹ ¶§aÿñpzm6tT-¥`¥®ÊMuOQ•‚X/´®¥óë›0Ëà ážDÑÄIUA±{Üì·<°KòYV5²qYòbvÆ?›mt¿5DØÇŒg:2¢xÌXÿ'y¢¬iÎ!šªµ9ê0k²aRÅ“|øRà-—~¤~x;0—o0Û~œÞ±Þ_Ú† +cß7xà ‘Bòfÿúm[¹ýKø¦Ê–?~–v`.GäQœøQ8*ýÊ'ØÊû`‹›Ø“˜òÂ×.WÆy¨Â·0¼`%›W“Fæ±cmåÉË}ß–:nXv¡`qô¬‹ãr‚‰÷FÝ»UP‘wU÷Ø7Î~¡‹ZþÀÈM±/6ÕØ\^(ÝÅxçƒTi&¢Ø¨“šT—Þi6±tié”:5ØÒ áeÒÒîÜE‘eËPœÌa`œèùWR¹Ÿ¤Æ)‹È®L:…ç÷¬QèùR5†N|2DÅјꦚ > Ú6ï_”•f9g[+žëlêóR‹»! nM*Màº4öB.è†"˜æý$ÁÝÇw|C"¶Ä¼£Ÿï›–3?Øtßér8|Èg¼Øàš/ùC[T†ñ®ê{PôŽ{”“ìd‰dø7wü=U„~ e³ã,:U'ï·|£“ôâ‹76ójL]&ÌÏz¶AI&¯©¹1æRyüE’ Õ»!¢ Ïn.U:-õ;KàLCÈÕû¯øùöô?¡Þü{šå“-²“wQ‚¦y]r“tæCFçÈÓ’èFf´&“·4IcÜÒ9¾b™×hìûY7¼Àúf²!1¾g „MnWñÔûs’ìsêZtü%Ud úõ-þnÂŒGK?‹”“\`= &Ãó. wà†Î†”GC:R ßèeãûëOšÒÿ£<7ØP÷)&õÞc­³1N‚¥É«åm¢3±Žó«ö&)ä1q<ÅôµyT£m·Ú œšj•Ã¿xøÑ ´ =*7E"<ÖÓû )û±¯$µµ…[ƒ°çš€NŒ3%z!­©XüUåSV þ™ÿ×/õ†J­ò3•O›Â$Š 4¸ÝŽóS|Í/úÎþ ÝÓ'fendstream +endobj +6336 0 obj << /Type /Page -/Contents 3139 0 R -/Resources 3137 0 R +/Contents 6337 0 R +/Resources 6335 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3111 0 R +/Parent 6342 0 R >> endobj -3140 0 obj << -/D [3138 0 R /XYZ 85.039 781.388 null] +6338 0 obj << +/D [6336 0 R /XYZ 85.039 781.388 null] >> endobj -3137 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F41 2104 0 R >> -/ProcSet [ /PDF /Text ] +2458 0 obj << +/D [6336 0 R /XYZ 85.039 475.683 null] >> endobj -3143 0 obj << -/Length 2900 -/Filter /FlateDecode ->> -stream -xÚÅZ[sÛ¶~÷¯Ð‹§ÔŒÅxË›O­¦iãKcµéL’š¢$žP„JRÇñ¿?{HJ¢Ó´9g:™1Àb,öòa1ñàŸ˜ÄëÉdÅ•q<ɶgÞd #¯Î„áð&Êõ‡þµ8{ñCèO„ç&^2Y¬ˆe±|ï|ÿãåÝbþv:“R:"v§³(Š«ùT8÷?ßÅt&œ[ î˜åîíÔÛ^¿™sÇõåÍ%v½žù5λYL?.~:›/;™)W…·òÇÙûÞd »ýéÌseOö\‘$“í™ -¤(iÚåÙýÙ/Sž5rà™ò׋ `9)»“Ë`ìäz»ÕÕtøs•7ŸZ½›Î|áyÎùýSÓæÛ·Z·ç„Twµ^eÞ }Y–<å×&¯©ÇÎ…3ãAn29Yd¬ëtÛ€ÒDðW—è&ÖN–¸oÓºeò:¯öLýµ…ŽE|ùLĽÿ{Z;ZÉžÙîwÇvD÷ -'Ÿ…‰+U4f~äú‘¤-'*î,À‡1á&¨µÞÀÜ• +Á긔ë{¸0tÞÕRO¥ç<6Üá{Þç¿£'ÜlÉ.è» XÞv$}¼´?õ$n„£€W¡„ëÇÏ{Íò@S–ýPN!c"üØ'‰ÆTt£A?-ž<qê„Éáz -[4: i§ý$êxñz+&W¶4éw%ׇÕU -ê¶%âߥ››Ã›‚ ê©ñeyÂùÝ+þ7®·9Ì—…= hÅÈW=ƒø•›é{jøÀ<œ¯Rì+[næ־ɑZ~’À Õúƒ'TIýÍň =ìy­œ,­ˆJ›ž ¦$§-²b—"oÎCEÅ_:òåãha$ð¦3ü‹ ÔE‹Rž¦±t.€4tºX©×Ü£«V3<§[¾Y¼¸¼BKßiX.ãÿñf.˜ Ä#ºÝì¦hHè{ö̘3q¤HšQ•OL­j^ò$-ßF¹ði%ÀB6JðÁ›AzmHVð”.Û|©UŽ+¶ wâ®|Ô­‹jÍd»)šNX?5rr{”½Ñ:镦Ö{ª^80l8ÝbYð…Sµ¦¿Ý u´Üøè˦ÁN`42o2"4#íhèÛÔÒpñÚF×t š“%5y3²Ó´DWèý- -Ì¥‘.·EUX÷ik2]ÍšfNÍ߬îÔE{ŒB á£œu©°»dFô=Ô)ù´wöÚzË ¹ ¡e·Äé¦ójÅÛÈÈ– -Ûn»©5úÊzcÛ†Ü ¼AAt¼;‚Pš.‹ì‰Û·x´è³ÿÑuÁì^àAï«»ÛHá‡P)”,› Oº"Š¾-ªÏ0uˆ$šÌ:„ô÷S‰¹oÜp$Ä’z·é ¬(Lð6ñSåhUÞ ¦Ö<‚×WC ¡Q4)½n¸V ºEKA>Œóø}WÐw>‚œœ”ï˜a›fh“ -&9÷±‹çÒnãBJք㻡%¡Õ̺C÷¶ƒþ.!´ë‡ÇBkKbˆD†Žf,ÝnÕÀÌ—Ì¡Ä€­ -”á¨FD„sxüJgûmN1áRŠ¶Nð+o[ˆL͘|?€ÌœüÉvW˜âʶGhÌp×aìF~d&@l •ï,È]@9ÇžOÑG׬TH“nˆ­š<à9[N¾Ë¯æ‰ûÐktÍt†7¾I«uÎmã¡G*4–„bš’äx¸-°ƒT -ÙØ(y­,m m–ï³”A>Úuöñäu¶†ŒÁÓü³.S45ÌS~ l-æ$¶à,‚]æK†Y÷4Ú5؆ÐÒÛb‹VŽ‚ÍxZ×t†5鬄¼‡Çš¢Êº¥ù [/‘R˜€ó?ÈècX3MQö‰´°Kóȹ1ÈxŽïã4FWÍr»œ Xnb(©¾Ç®Ž3ê—NVÝ1±ýHg¨?5-],ÙɈ'D)x„ñŠðíA$¬H©ûÃÁªÀ´Kkº„d”´€¡0‚RnvùºžcĘ™ —n-‰¤·C”ºbxõÏE¥Pš¨ ÅÖ‘êñþÙ‘$ì‡\+J}Õò‚¡ ,WñûšÂPÓ0ÀÖƒ/­MÐey¸¨ÙAÊÆLc|c ³5&Ãȹ™ÛZÄ,F¼º½á—Y³IëœIòyø’Ï›¾tßnO‚š kI‰D`GrXl™5¾!¾ùK @7¯­Õ„ÆjÂà4LÀ. vÕ%Ý&C©—#¡÷ fœ¿¹…ÃÜÏßþ6{>É#õ™ÂŽßÌ$nDŽ -ÜžR_™q¾"!ÀÆ„4ü”’”±³“Ó°JB'ÿ\`XVÍjÓkžbH²Y©Aì±Ül¶ä¾Vq˜E( àw†b4ˆÐ …ó‰“QŠöÀßG7+QfNXüŸOÞGwu ûÄUÊ.°'3¤÷hhÁ8×0ŽÌ3DÐo `QäÆ*:Pg•nPoçJ‰{ w‚cûJ7‰¿½Êƒµ†_‹†‘9HÆJ‘ïF^ò-p›ÈÿÇŸÈÿr…cAP/·'ZÚn8Q´6kRŒ¡û(í;ŠÊ À/ɹ*žzŸ2Xà÷IjåÑk‘fV¨h¦Ïò5sunåƒäíƒ ikÅ#ï±Ê‹œo€œo C±Fñ.7]Y#'B47ÆåÅ”(ŠÚ<žø­öd&oô¾ÄÌè…ö•ÎÄ[猗ÜAÏbø² Q3ÞÓ¦ŸŒšÆY³§{†dÂ;dë'_Eb»o Öèw‘¥eÙ?FB‰ˆ\OŠ±˜jj£Æµ‡÷Æœxq‡³Ÿ{0ª,I~“‡ücÏÅ×p$ˆqüÝ;‚ÁŒ -ÚÞjÊ@ Õ4†d ¦/h¿pü*ä3¨pˆE…:x -Œá´®ŽÐù’ì¢4´!˜#äLÇÆžüY4{k€&Åô5#GtR²@o‡ M¼øΨ’5È?{Â=DeÂ&f¤º"—à’ð´Ë X¥, K„§Zxµë«dYkX6!Ñê |r W‹AÁ|ƒÖZÊìU,b@Ê,VÓ‹z×S`DÂ*…ª„™$òU†¯1UÞÌ‹qËo…¥ë²C’EÞðHãº÷T ‡õÁ¼bé…-¹8}H"ŒFdDxÒTã–ÜEeÚ¤W8Ò\-De ^Â<´ä׿åx¢…–ÃyÂ.efÆ–Ñð¾ÆS¢#ç÷COP“Lh ÝŸÐÌØ o!x,A„|"íââ Ÿwak‰*:0ÚïPh ywZ¤I]tÆÆ#¼¹ÚcñšÇºe†®ˆm[F"Å.<ãô}ÕŪúh¿”¡Ÿ…úö·³gÑd𵕚ÿw)èüWxŠÜ\^ÏÏG`gnä&8^¢!ç\p¹[ÚÈÙU†¸<·æ! ÅÜÔªï+AÈÒ!˜£dÉX Û¿2~ß!Ôß#¶Ål*4¡Ü~µ¦Ã8Ña˜Ûy>ØTÞn̾š—Ï£^t¡ýIZ„® CBʈwc3"ut,ÝÞʈPû¾øb–½>Ò§R&'¨À³?}À¹MTÅÑOµžfÁЭTÜÏ)»ÜËŠ-yÖqå•úŒæ!í)P¯-r ½Ciifªc(ÞÞ5Ò]õq$h Ó¥RÇ…&ì¡_Ä”ìE*5Z@@S@@r€±9ãÏÍí s6Ð[6Œ>Б| -Ô¸RaæBLªQí§T ̯S[¤01Ëx ö÷%³ÓÇW˜P…€ núrü‚˜-|Ûÿ¿‘ V>ëe=o}"÷9t»Áÿ`ÿl -endstream -endobj -3142 0 obj << -/Type /Page -/Contents 3143 0 R -/Resources 3141 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3111 0 R +6339 0 obj << +/D [6336 0 R /XYZ 85.039 455.088 null] >> endobj -3144 0 obj << -/D [3142 0 R /XYZ 85.039 781.388 null] +2462 0 obj << +/D [6336 0 R /XYZ 85.039 277.233 null] >> endobj -966 0 obj << -/D [3142 0 R /XYZ 85.039 667.608 null] +6340 0 obj << +/D [6336 0 R /XYZ 85.039 256.032 null] >> endobj -3145 0 obj << -/D [3142 0 R /XYZ 85.039 643.626 null] +2466 0 obj << +/D [6336 0 R /XYZ 85.039 173.627 null] >> endobj -3141 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F20 1617 0 R /F70 2201 0 R /F18 2207 0 R /F15 1628 0 R /F41 2104 0 R >> -/XObject << /Im1 2193 0 R >> +6341 0 obj << +/D [6336 0 R /XYZ 85.039 153.033 null] +>> endobj +6335 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R /F56 2890 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3148 0 obj << -/Length 1851 +6345 0 obj << +/Length 3267 /Filter /FlateDecode >> stream -xÚÍioÛ6ô»…Q`€ ̪¨Ã–÷-Kœ¤kãd±»«Öfl!²èITÜüû½ƒ’ÉIaÀ "ù¾‹ïQt=øÝ8r½`ÔÆ â¸;_w¼î Wa1¼nèzƒA?Î:o/~WxîÈug„2[|rίÏîfãû^?GÄn¯?ÆΟ'œé{ø7ëõ…s ƒ;F¹»ïù±s{ùîØnÎ&g¸t8㤛ÌzÎ~êŒg{’ôC7(ÊßOzÝHûSÇsƒQÜÝÂØsÅhÔ]wÂ(p£0°ó´3íü\saXØeª…û¡?pý! Ïã° G Ü`vmÄz™Ëõ)sL ]¬»QYÉÜ,E“Ù½šƒŒ‡D[@XhÃvS•-fú•…67;íT£`Tž<˜/˜ —mç³K*_8·;„–«k`Kꃋ‹ªás*°´/´eüU»Òä™Wðê¡ëÆo.êå ¯ìŠ6˜¬¤å›qƒÃ§^4pè* )—Joª`ho*ÑÚ6BTõ‘DIqò:«îMîñ6UË…Ûýøê¸7B¸Ý‡Ý~4 ÝA½Þ7dÔ¶®!þk½ÄôïíµŽõÇaÉ%^5±Å*âåì%½€ª¡š@/åÙÆç?Uj 5g:g“‹c¡"ç+Bðº]m/âƒ#=?:‰wK!ÔM¶&NÁK’?+\Ǩ^R4FØ̶®»ÎŽ{:¦3Ú~+'i±Ùµù|j¬óDǃú¶4ÁÏ’a¹–ëýù^/!³‚7À²ñÁŠOQ$‚ö^Ū¿_!ÃA]ßá/i² 5ð•üY¨ER© )Æ"¥üŒ`W¦ i±‹n±A¡Fø‘שFU9—Æ9¤€hèA -À}¬pkRžÌdWvù$-Ù› |à4¹á@ì^Z zwðœ©SP¹†hƾ²Àp‹å]­^5€äJc•ÖŒ€ÍÿÔî´×åáTó›©·Ûce¡mfÁujT-¾zªcÔ&<\Mõ2ÉZnz0ÂG@Ð¥áCÐ3|;жu''˜*ýÔ/ú iu!v(öYªr>,=#"4àÜÞê2µ­IÉN¬_$LÕ7qcžRß´­cê«„ MíZ׃G"Èü®ï ¹)׆ַX«õ¿{ °Ë©-øb꛹™zwoU•€ÿЋƒºendstream -endobj -3147 0 obj << +xÚÍ]oã6ò=¿"÷P@j®HŠú8îý¼ÍÇ­½(m[IÔ³­Ô–7Ý3R¢m‘ZlóPäÁ”8â ç“3Ãðóþøy®X,‹ó,çLæùùb}Ÿ?À̇3n ¦dêÀ¼žŸ½zŸ&ç^LrÍ/o®iúýljȢ˜»¢×óÉ”G =ÜÂû·opœDóz7»¸z}1•ôÒü:ÿáìݼ£¼£ ¨,ìßÏ~þ5>_Â8‹™,òógÇŒÃôú èf*‘æyu6;ûO·Í%çôÕ—,Ä”¬*ÌÉ”³$•'ÌrV(…œä\0ÉÅy¦b¦âD³¸üã‘&*G³¶zÚÁÖÓ,º„×^Õ0~Ø"ãÊÇ™¸Ý60àÑ¢ÚÁÛOIÎxV„)ïa4å\9:ÐQ. +z”Ï+Qù¨Ÿ¶HŠúÔk"†H¿ ]À4ù jüw r½ƒ)nAƒ×“n¸¤‰Å¶¾À,ª–ôíþ¬ZÒë á2ÆDe¤ä ÚØ ý@»ÝÕæd:y çÆI½½A|}qõÎÌ}"F’AÕ›o²$•%,/xXÅ ¿%Y 1K +b4*FhTÌE8ªb>U‚ÄK&#Ç|( L©I¼ÚBgÕ)ˆÍŠÍÁv¬P+RéäHŸV6tÕ~-7‘bD z € Q-a´ZDhµÀA8ªæ›DJ;sm[ð¼Àÿh=ÐgþgU¥ao¹ZÙWè *:—RíáòíìÈ‹™tgÛÚijÜж+u$¬þæUPÐ +‘Œd/P@A 2Jy4„Î*h›Õ([§ öÔ@{ÿ­©Íyß::ÍC]㜠Sä™j˜kÞ\Y(Žks¢Ðf€’@wøÝS¹ÓožýEÄ,-Æ"J`²Âm§^&‡ÐY&±Y&;ؘR‹ã­| HS–#¹ `€B’ +/Bè,‚Ø,lýùÃTüÖ¥)G­Àux D V$#)œ04j !ŒÖ@‚­8¯N9…>Lø]aôè\°­Íx[ãi|¼‘E1¢1=ÐÆ`Cƒw+éZWìU™>«2AtV຿X°JÀ†òdŒ§=P€§HóÔ[@ â³< ¢³@¢Mâ·ÏÄŸðeÛÐo§ÿøY·5|À‚ØŒ€~Ò[[’e+hð¶ÑÒ€oªRk«Y¹;£#¯¶:ŒË}õ 4žÛ—w]T±Ùý®Yíû;¼@ó1¾·&„ÍAõÀø¬»rW›è·0¶ô mÌ4I}F%ŠœÅJ^bÈàTF—äÑ%yr‰÷ÍŠbÐs™±L‚ßʘʲŠãßÎh„,ËÀ ¬v:í•:Vc¡,îN +üw+[RÉõýN=Æ›SpîÌ~õ÷cÞ`Â9øO‰40'D 9^éàæ‚éÀ^•x÷"úÍ6àf:ܘ¹6ä§>˜œx¡$Žuì ö„h)ÀÝa(D‚Åë6 ¤±,K²?wÅ¥·wß2ú£–¡‘>\¥s¥ï¸(+-`^ˆT1%¨ q½§.…YÃãæž~?íœ}ÄX ¯ܲƒðÛ©·‹…É—Ô¹LíW£—ØûåZDÆââ«ÕHCç^5‚ ‚jØ@ÔJEnµÄ¦>È=К~åo'³×šÖ8„jM ÈŸip_•í¾ë)àUª4-र¡éµ¾Ac­=ÍÚ<Õ›¡CÛcÓ—êl²¤¿²ú 8}PÃóί¢½»^XÑàž&ù×’d =ŠÆ³œiöWð†KjÀýsÌ_TÏÁõí„wªwBù ê9¤Ïü^G'½ºìj/«ŠS¤•&KPJDWŸðœ3ÇãÝ%^Sê$'ù~@ƒBë&…nÈQGm¹Ã¼êÛ7FËêI_DkˆZѧˮmWw™Û#Üæ²)]ÕöÔ¥¶IýhfJS8LgZ]—ÓwLm²ßìlA¡3Ðrç³™‘ó ÛŒuì ã†ÅøK¸!™?OVd#WŸ¹ÄgNæÏñzž¾ú|«Ë› ÝfK³è¾™Hº´³ýbQí|%.á .D˜ÀÆ_À_°›'`áRd)ÕvqÐ>ꌇ&ãYfêÅM½èòb˜¿Ç|Bdj(mÖ+éœFÔ=EK¨6K3i†TìéëQˆ¯ÏàjFhNgÄÄùÔ~lëÜEõÞŸÎKÒ‘ö_ã¿sk`F®Ü†°™zê1²¡rªƒlVÛ[jÖU¡¥›Ú¹G¹«ûd_ÅmÓZ×±­t<¥+›Žt°,Ú]Tf»ÄÚÁ„®)k˜Ñ[Ê~lÝ%åCdÃw”;dŸžHÛ–¶&rÀ­¡C®ÐŒ£#LVÎýî~w³©s?SN©ì¿ð(ÄU¥ø‘>tãçªáj›mC!ìB÷ÈÞ¸ÓV>vÕDr õƒ£ˆ <ÎUm‡¿Ø{ߦK唪†g«£1ÅppÉ ¿*8tî5‘,—ž´Z Á·´hçz’«ryJðÿk€ðendstream +endobj +6344 0 obj << /Type /Page -/Contents 3148 0 R -/Resources 3146 0 R +/Contents 6345 0 R +/Resources 6343 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3150 0 R ->> endobj -3149 0 obj << -/D [3147 0 R /XYZ 85.039 781.388 null] +/Parent 6342 0 R >> endobj -3146 0 obj << -/Font << /F62 1689 0 R /F41 2104 0 R /F15 1628 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +6346 0 obj << +/D [6344 0 R /XYZ 85.039 781.388 null] >> endobj -3153 0 obj << -/Length 1254 -/Filter /FlateDecode ->> -stream -xÚ¥VmoÛ8 þž_a(ÎW²ü:à>äºôeKÒ^ânWlÃàÆnbœuŽ³4ÿþHQvœœ{_®A‘")‘I‘ >Ü=›‰ÈBn‹04æ«3°sÝãZ‚®Í|·þˆ{W¾cpfG,2âg%§_ÍË›Á}<œZ}!„ÉCÛêAh~ZÜœ}‚¯Øêsó÷$r?µœÐ¼»º ‰1LȺ™áõ&±õ=þØÆ­›ô]Ûõ^ågïëwf¤pÛ=f‹(4v°f6"cÕs=a{®ÐtÑ›õþl¬ÐžkV‡Ã}—E6 #XÀqB4ž ¯ÃóóÑÝõÝd6œ~NÏ¿qáž?1Œ‡Šú='Û¢²úžã™W²H³rƒ~]\ñ¶µ¾o;0úÂW±FÃñ2ß`l¸¹ÃÀÈm‘"ÉÌ Æ²’%Ä(CŽcVËÃú–ú¥œ¯I«ZfÄØn24€ê¿mHÕåJHÈËl~8e¯×°ÃD%ôó¦´â$0 -u^Š^}írŸ#‘rôLÅ+Ê…++è9EWUNŸ)&•Æ–Ôç*¼)QI¡T%QÛÚTöžP8´à÷\e!ÄÿY²zJfYù++‘$ gˤ̎!ÿ/hѪPVÇÌÝ2Ÿ#¶K fκQ -0\4q@h)™­n‚´!ö./ -²þ?ammàd)­ëã›ñË"¤”Ì:Yàƒâo{&ÀO* åÁí(DQð…A¹±Ú• "Œ`? ()ëëTv| ÒfâÌ“¢Èº®xvÖ毬 0„ð^YÇ<ÀÉ´Ê!·Ÿanãi¹ûÕ2©hµDÈP¶}oŠ®äs­pØψ÷%WgJŒøn£«C¸vă£Ü†z-u*«ruu+XÖT³OhdORºÐ]s”[(;Û׋<,%‘oŒ»EÝ2´½}]U¶²ßª³û¢N·sƉ\íÊJ›ê·æuFcO}Œ…«åMÊ!s^’ñª>36r °¶Ò/ˆ‰TÞhí”yÞ1~|ê¶f1«|Q&UöfcJtÏ8m˜îÉÁR¥'}LjÜT šÎSÉs –$ƒUõfØ1e„'Ì/ˆáÓRbävxÏ5Æ^wñ×=‰½”êjªõj‘• -k% ƒÍ!¨ë⨔x£wuaŒ°|$~ÍU•äv:ZA–]6Á—Ph‰ic2YåëE‡A—Û.çZf ¹æ€)%*k ¢_`Ùr—˜ª*T˜ophu˜Úswz¥¨ gúÅ(¤jœØkö‡Wc­b©0<ª2jÕ1º£¶Ël‘oªRëÿ­R|€zÓ:½lJªÊÒ®W‰6‡ð¶›OÃÇ£»ËÁèÇxpys;ªGêqÇj%Ÿ«~œÆù¼”` M'•˜78ŽLbd]nË2[WŸabÈå9àF!´Vad§ïu‘UÙT!±¸LæËìì÷t'Ëô=£?Þõ ¹A¯ëíšâÓz›zóŽ¢t˜n\Â&h† Güs™µ´åK«#Ò“ˆ«#웧½ÑØËu ¹Å.dŸ¡j(„TêÌ·}š‹ÿ=2ëpý¿AU`ÄšÐ×S(ïšB¹ž^”û¶ð±Œ[ü®Áçéendstream -endobj -3152 0 obj << -/Type /Page -/Contents 3153 0 R -/Resources 3151 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3150 0 R +2470 0 obj << +/D [6344 0 R /XYZ 85.039 761.463 null] >> endobj -3154 0 obj << -/D [3152 0 R /XYZ 85.039 781.388 null] +6347 0 obj << +/D [6344 0 R /XYZ 85.039 741.134 null] >> endobj -3151 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F65 2099 0 R >> -/ProcSet [ /PDF /Text ] +6348 0 obj << +/D [6344 0 R /XYZ 85.039 669.735 null] >> endobj -3157 0 obj << -/Length 3106 -/Filter /FlateDecode ->> -stream -xÚ•ZKsãÈ ¾Ï¯ðm©*‹Ã§Dææ‰g';Nj¬Ô’hª-u EzIjlÿûÅ IJ¦¦’òÝú àrxÐ_x•¥~çWë,ôã,»*‚«qþò!T‰$ý4I¨=Ã\:îrùA²ž“‰Ö~´Ž¯–QâçK|Ú|øøk\E¿ZÅW›'–Ülÿí…¹¿X¦iàÝ-B¯îM»X†Þ¶9P¯°õb¯ÖÞf‘G3ŽÑ{¡~5UÑ[ê7u··ÏÝâ¿›¿}ø¼w궑øAøÓ}Æí3ö¦Wa@”|ºÏ‡â°ˆ2ï±XÆ´|ºò:Þ-ÿü¼ ¥¼¦í;áÜoÀJT¬Ç°·ÊH—N&Ç¢vß.øDK9Q@0èW8~oådÔf!\Ty<ûžˆVדïÚ{r£‹ûjû=O&²æ׋(÷ÞpatºeH -Mùíyš0ÊWÞ Ú¸áªr:(FgØ1(}#ßcgÐX{ö ß”V5oÂâ%í®å]¨”vr«`à -iŸ¹FÖDÙJÿ~“ˆÔäRAw—ÊcjÞÂ2¦GLr>ãý?èã,“óõ»Â·Ø6ÏjgÔ»)YC¸‡Xך…Þ­´UöMû& ™i¼Î1/÷»Å›JïwÀº4[]êØmoäNmÉJŸ—Øäw!˜gògδÙâUæuFw‹Y"òóú\‰/9‰æ`¤õèf½á<ÍÑÝ7µ5ÔÑ´‡bœ¯5»¢Ýâ2êPúöØõŽyn¼ð]šy¿õ}ƒ“¿À¥3Q}K·5g£ì½9À ’Ü»ë…Ķ¿ÊÙJÆ™rO}²ã˶¸Jö@âÈ‘dô©SO6À–ihGÎò‚4`þü°¥N)fÑvñÃë™CBçqœÀä²ÑÁ+! -3–ͬEí±x;$òÚ7qøÑ+8\‚¿,ñÃlõ3ü ×~GSœ?NVg8êÝ—B8<Zл°?± -K"|ßµd^Û‹üuþÓpú)ŸÂô—‡Å2 "ï›e;“è@‹—cŸ¯)(U DìÅI<´<¶–Q€o2« d$ž9Ezª:Þ„ú`Úà -,s| ÒÍíƒD< ú p,¥ïßMû8®Îá·“‰ -…IjH!²Ø“ಜö$Ä°K|Ä‹Z©¬_ú–œ´”Îê8¤ÈQ5“ÅȈØRhDevŠ+q¬ÖÂB UѪáf[å -h0Ø°ÏUÍΗÉ& rÓË"æTéoºévÎaNõ.ÿGn«¹}ÇÄa«“¥™„|ʆ_lU¹ìt±©ª@²V¼•˜¤H_Ø¿ -d¼Ày•PÊfô¸šÉsïuž¢[£Ã‘\ÌA½ÍTÂ||+„Ùl¸`ÆsÑò1íî £bPó÷#G®Øšß. kq:Ô÷Bˆ]cúc'=‰;cØã™tSj4­©9‘fšËóèÐ@WS‚ËÈ«5hâBÁ¤;lUκÀ»¢+_>9yg?vo¬Ô72ñ®qó1Àâ"v{!"±̪ågÝIÆ99$»ænœýÝ#jòz Lc:(½“÷GȺå}*!@Ƨ:–¡ òbéÜB\ÅW⪼y ME§bT?è«Zgé÷…Ž éq4 Ó%L2q®Cy£[‰Rð{†g‘ûœÃ"®Ž™2_•–¹H¥™·áERc³ˆ‚Þqµ‚‹¸c•IØ8²sÂ8;É"0Í“ÈZêtGu Ç5êN•î¢?^uý\io¯Ö®/“|uA!±«ÆyÊVa'€ ªe -gWè±t¿ˆˆìöÌ §i”ŽÅó™¿:ç`FÈź -—íj%•evOŽªvèí]’ÑKˆÆ{Kò <="¼:¤;¯úîZ¸¢ÍX¼_£EÁ~‹Ù¡èPêDó˜;ø¢æ…I¨Õ3´¶ÍµZµû(ð¾PóAæÒZ0ÎõkNµzâOj_¼2ã5ê¦^Òu87'Àúš#ÇZáiýcÆ·Ò¥$f°Q–J…›0d’9kõ„˜¼4$Ï4ÚƒvbѺçÖR•éÑnɧ•¥ÌAh_?ß^ íÛ_ï6Ÿµ=<©Íõ¶ßþõ™«nÁ΢ß{ M«sopjð´Òù¡ˆ7E:<-úVFBZí’H8oÌ"wÍCÁlùm•˜ÓßV‰~7T#ÄF‡Ýˆô$Cúì7>{6…+¹¶EÏéq¡ KB'òjÎÈd¯Òâ[JèÑ4ŸIᬞƒPEÔaü.Zኺž3!6›orñ…`æÝôwýQïmþ11Ž§é+óCù¥ŸÇÒ ð×i4ý…ìÝ/ea槹üãÆåßÈÂ4?_„@ÑÏÓ³ùpß?úúƒïendstream -endobj -3156 0 obj << -/Type /Page -/Contents 3157 0 R -/Resources 3155 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3150 0 R +6349 0 obj << +/D [6344 0 R /XYZ 85.039 654.065 null] >> endobj -3158 0 obj << -/D [3156 0 R /XYZ 85.039 781.388 null] +6350 0 obj << +/D [6344 0 R /XYZ 85.039 639.909 null] >> endobj -970 0 obj << -/D [3156 0 R /XYZ 85.039 761.463 null] +6351 0 obj << +/D [6344 0 R /XYZ 85.039 626.966 null] >> endobj -3159 0 obj << -/D [3156 0 R /XYZ 85.039 667.044 null] +6352 0 obj << +/D [6344 0 R /XYZ 85.039 612.811 null] >> endobj -974 0 obj << -/D [3156 0 R /XYZ 85.039 573.327 null] +6353 0 obj << +/D [6344 0 R /XYZ 85.039 599.262 null] >> endobj -3160 0 obj << -/D [3156 0 R /XYZ 85.039 541.802 null] +6354 0 obj << +/D [6344 0 R /XYZ 85.039 586.319 null] >> endobj -3155 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F65 2099 0 R >> -/ProcSet [ /PDF /Text ] +6355 0 obj << +/D [6344 0 R /XYZ 85.039 572.163 null] >> endobj -3163 0 obj << -/Length 3027 -/Filter /FlateDecode ->> -stream -xÚµZ[oÛF~÷¯¼ „"–Ã;ûæÄÉÖÅÆÍÚ -º@ÛZ¤-n(RKRQüï÷܆3”dy/Ø0çzæ̹~s5óà5K#× ²Y’*7HÓÙjsáÍž`æ/JVx³Ðõâ§Þ-/~øû3å¹™—Í–´dYüæ¼ÿéêóòÃÝ|£2w¾H’Ô¹¹…±ë_æÊùtusË“ËùB9ws?u¾Ü/yèîÃ_¯æ)LÝür{‹ºù|?ÿcùóŇ¥ÅÅ"tÃ8@6þyñÛÞ¬N¾ðÜ Kg{h{®Ê²Ùæ"Œ7 -é×÷©ð\8ã]'.»Ð+p‰ÌN­ñ×OXRˆ²Q.>Ì…nƶ\€ŠˆÂ̹ŋçCüVÂÅãÄùtÏß_q°)Úyà9ûžÇnIP!vbZ¦œn×=÷ß·Íïž -Ÿv¸¦¢ms(°…fÓw“ìÜ5|åF S} Pïr]vÈs:y¼J{@5îç~â´¬Éùxr¶Ðèe¥,XÃ%pÜÀä“lðë;0ô†²+ÚM^5¼cÀóàæÜëˆp='I¶M¿FÉmÝ/¯b7MÕY-*7õ“‰è5:Ö¢rª2ò¦ºÉEaÃZ´ -ÊòWìú9ŠZ¤à'ž¿Ö·ƒÍ¿{‘W•@6LSgÅ·cÑ«G²Ãɲàñ|#«v×ì :c -YzÖTâÆ^tÞ>ÎÓÐi;<< Œ£A@BRøZ‰çäuÍËFÅÆÅÆ/)V(6íÕhúhHïÞõ£=Á’am–_· ƞьü¿ôtnǽOx|“?•ù,+¼«ÈŽ Ê[8kž?S/€=äøçYVt;v…qkWÖ¬fºê#§’ÉJ,ªÑŽ´¢¿}ŸwBð‘åñ4X¾¶ïftÑQÞ`‘yä6£1VýƒèÀ$ú,rŸ œ¯ÈzÉ=ºÆ·y·­êü¡É šî£Þ?Þ¯äþƒ¾=, ¯ßÑ|EæÀE^óœ0ª²_¢\ozî°šV»Å‰Kv´E†Sf‰µ»Nd -!/Ñ4P¾¡çß‚ôPrçíªÝpG[¶µÛâ _ø®÷>±Ípç3Þ¼­«UU -ybB[v ¶BûøB½#¹./sÈ0L ; ±(Oâ4ƃŸ¹¿1çîÐUR¬YŽ/YbÖÚ&ŒÞ‘m¶&‘muH¡• /­ô»ì§X_˜`æر[TùÈêøÖó¹üù›B”~Ž$C¶´„0tÀiaY×äý0{ù™‰nªaÐcÄ„öàŽÃ ký#©kmt—<™SŽÃU† UÃ`d‚R#çò -m§Ðû›â8Ö\Þ‘p6-;{‰éylxl#µB¸I#çõBgRw_Q…V»e°za(¤H¶¿JYWéK%FÐȨ²²èy§öh>hêØ)uJ&¹ÂÖÓÛ•›v -ž‰9IÆâ&%Bg¯c]ð$4ÐØ"F^ qô½Þô$$w&bCÝ¢zZ“½loyê™üÒ0cÙSß¹r9‰¼Òêà^‘CßãHá«ãˆLá™xæÂ;6µè„[$“óg+×"_h»‚GGYáf1xlö ¥F•¯*̤Q>RÎM›:crÅÞ§I‡"JâÅïN\Ùd'@ 5%Q!£ ÄÇ¿‹Ñ˜ðYø-d!û“hr¥ó¬Æ$CœG@àD$ÐÂŒ-gv:…é{`º8ƒþ‚Ì ƒWПï«ýùÿ5úc˜;×t°Â9{.,'ˆê! ˜!Dp¬ÁF.ôåaJ4ºÊÂdÔÕ- -^ôŒèŠ³HpqįBÁø<¼Æü€¹äæiÇsSÿ§2®¯Ü#%×ÏÖÚµ6ÛFÎѱÒPïxEh#,FÏ$| tú6¸á„⇪ùöÀآٵô·Ê)ÌyâP LºÄ©}5` õ,Ú0ª]’]Ç’BðÊÆ-o4fOwÂËmÆ£§T'é¶g·´°=q­‘ äê—Á¡—êÔ8„Hî;Àè˜è¡}ݲj‡! c1KHäiÄ€(IÈ¡¨ÉB¡TPfm€8Œièsê #]¿ÅH «„¾’#R8Æh ž@üU8ú‘À!$°†²ùÊ]Fz1ß0É_rÓ  -Y’  LáP¦:¡8Œø*3è²ÇˆžRDOã,Q„Q„È@jm*˜‚Tê\²àm#Rê5vI½^ñ¤AØccAj„SR‡ƒ,°EК "Á‘ i¸^Ä…’/Œ9hL‚ée-³M¾‘Vûx05"hÛå…\ -‹J²s¬Hè²ÅÚ;Ž³¶Þb©žK–vrÔj8¡FÛu1¿¬3øú¯½Û³ xµH)j,u‡µ‰û|óëÔô´©K«paR—U”úÿÖžØx=z§±7¯tð¨¶x…^Éa#çG±ÓxÆœ°“óç1¯:I>Øí×mÇ©›hÊÓ­%kFvïÁE¶Ò0áLÙ°nîØÇö¥Ìñ„E€ôq+i Qòèí¾É“‰Ç(1pÛB×>?—¹ 0¡«¶y‡æU­´®·œHŸ_‰w¢ð–°MJbOÔKõ‚DÙ4jÅàîteÀ·Û2B §’;€Ûh;ƒ%¶T [‰oj¦‹ËX™w„ ìR¤¤š·2,nY·RQ4‘¹¢*R¯ÃöÞÈ: ¬@å@>«mÖÖä¬É¤ÝøŒP™p‚mtoÄW´zž.JºÀª«¬€]09;„›w5MU²}@iïÉû) übQr/ªîW†tǸ|Ã9 dTƒ×]œ¸ï¯$9Sÿ } !7îõ‘Æ”1“ Ñ·äueS`fñåG‚1»%½Éî³’÷SÇá˜GOÂ7+””üÄr\Ò´ ºsθ`OlÕ¨\~UÝ <¾’XeÞ´ãLFÉ/DcÐ!yŒÌÒOàñ8 Xph®ÐÕLìÿ˜6—ÝFÞ–²™Êg`Q5BäÜÍzIÑclÀ´)­wèY>Zþ#÷pÖvd\´çâÛ aºïÇZµƒ¸ëN„2e'Fœ1/U_ÔƒŽ5`ʲá™Â‚ ¸¿’Ó¶ì6ÚžÃÏAü`Ù}£ˆß6ÀÎ<$½ ^CáÙŒ±ôÕ—d`ÿŽ@Ùv¼ðz]Q^¢6¿ýð‹Ÿ7“ß(L¾œ~ƒW~ÂJ]ë·“é— -%AÆÁ¹ 4=F7™Xó ƒ-…ù|ÎƘóìg¹~?Ýn*@ýØ8@ 8&Ö¨ËÊÈîÔl{9ÍdŽ”Lºñ¡˜ѱƒ4%‹¸Å8#ñÛGNCEl˜à:™ï沆o½Ø`•yŽFüÉeõÁû8²¤Ã/ Þ¯füÅçÒTŒ*TæE‰ÇR¦xá˜c(Á:»– UÒVT¹OÕ´ºŸ*sh¿¡ ö0bƒñ¾xÃDvCUS…Íf.Jc罩t¤ºŒªãg²]RÄ’àŠßÆ»¹v[ÞWõ'.'ù†Š -ðÞ«6U]åȱåQ«â‚)A ùÀaj£gÁàZÊò#nHô¾s#[N§-ËEL2°ë’Ùäዯæ†'Œƒ¼Ñ(ʯyG·+üÕêÎ^½5ÅPíü‰}[ tVªôYö›§ïðÎ_Ì.Û:H}ã`¢Qà–WOM;Uv‘ÙüøÄZDëÙ•/YªF+–؆ï -a}üÝg§2ÆÙ|,¿óp¥ƒý°Áx܃i\‘›)ÿ’VVÃóŸÀrÁûÍÕF î.rùVüívø†"`˜¸*õ'—¸-÷¼êþÓ;n)xOþÈÝ¿Ë'pWÏÛò?ßΆrU¥p¼ë1Ž¼þùå¼—$nâŧÿYˆpö¿ýƒŒE4Þòl&R±wȨŠÝ ¡i1ø/Œò† endstream -endobj -3162 0 obj << -/Type /Page -/Contents 3163 0 R -/Resources 3161 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3150 0 R +6356 0 obj << +/D [6344 0 R /XYZ 85.039 559.22 null] >> endobj -3164 0 obj << -/D [3162 0 R /XYZ 85.039 781.388 null] +6357 0 obj << +/D [6344 0 R /XYZ 85.039 545.065 null] >> endobj -978 0 obj << -/D [3162 0 R /XYZ 85.039 761.463 null] +6358 0 obj << +/D [6344 0 R /XYZ 85.039 532.122 null] >> endobj -3165 0 obj << -/D [3162 0 R /XYZ 85.039 736.911 null] +6359 0 obj << +/D [6344 0 R /XYZ 85.039 518.573 null] >> endobj -982 0 obj << -/D [3162 0 R /XYZ 85.039 709.271 null] +6360 0 obj << +/D [6344 0 R /XYZ 85.039 505.023 null] >> endobj -3166 0 obj << -/D [3162 0 R /XYZ 85.039 687.41 null] +6361 0 obj << +/D [6344 0 R /XYZ 85.039 490.868 null] >> endobj -986 0 obj << -/D [3162 0 R /XYZ 85.039 537.42 null] +6362 0 obj << +/D [6344 0 R /XYZ 85.039 477.925 null] >> endobj -3167 0 obj << -/D [3162 0 R /XYZ 85.039 502.217 null] +6363 0 obj << +/D [6344 0 R /XYZ 85.039 464.376 null] >> endobj -990 0 obj << -/D [3162 0 R /XYZ 85.039 394.428 null] +6364 0 obj << +/D [6344 0 R /XYZ 85.039 450.221 null] >> endobj -3168 0 obj << -/D [3162 0 R /XYZ 85.039 362.902 null] +6365 0 obj << +/D [6344 0 R /XYZ 85.039 437.277 null] >> endobj -994 0 obj << -/D [3162 0 R /XYZ 85.039 242.539 null] +6366 0 obj << +/D [6344 0 R /XYZ 85.039 423.728 null] >> endobj -3169 0 obj << -/D [3162 0 R /XYZ 85.039 219.221 null] +2474 0 obj << +/D [6344 0 R /XYZ 85.039 380.191 null] >> endobj -3161 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +6367 0 obj << +/D [6344 0 R /XYZ 85.039 350.786 null] >> endobj -3172 0 obj << -/Length 3177 -/Filter /FlateDecode ->> -stream -xÚ½Z[sÛ¶~÷¯ÐééŒè™ˆ!xçySâ^Ü&¶O$O§ÓÓZ¤%6éT\ÿû³7€¤D5ÉLÇ `ìåÛ¥ÕÌ?5‹Ûñ’Y+Û‹ãÙfá̶0òÃ…gæÛNàЛõÅëïCw¦;q’Ùú‘XÖÙoÖÛ—wëï>\.<ϳTb_.¢(¶®o€vu{©¬÷Ëë\_.”õáÒ­ûÕšI¾{·¼ŒaèúöfÌ?^ß­._ÿtñÝz Å·ýÐC1>]üö»3Ë@ÒŸ.ÛKâÙ3´[%ÉlážøžôË‹ÕÅÍ*<æÏxÖÄa¾ -lŽ¸ð;Ž}sjLœúy—7ùåÂ÷ck‘òï>Çó¥£eJWóoš-“6þDV•?K³ÁiõX*¼›Žét³B·ƒaÙï)m[œ‚‹>0 ›i—>¤­ð¤UÆû, -þÝãŒ<­ÚÿàõÎr¢…Â[IèHßl>AÇ{yžû|ì¤$é¦>h9ñŸ Z8m'ó®™%o®ê} -Ga†8­LüŸ£‚tû ‰3!ÍZ/4Þ±J÷2ô\”%ÓàÜH =§}ö8å!ýv®· }‹ÈÔ¯R?ŠxƒÑ&ß×´3>‚Â%‰ë°¤ º|”ûRVœÈ*èyÚMÚ"M<'+Üï®dÌð‚â’ÌéP°*&‰`<¥E?"W.Spßš›´½\ÒX˜n' hµy¦šŒ‡ëc¾á+ƒÚgõåW4\n>´6pjPÝ(Âùx,¢žnŽT}fêÐOê^áÉá™ç¥…‘¸¡Õä<ÞíRáü….=«‰§å 7kþeuA.ä©;¦nu—VÛ|ø¶rÆþÙb8Z¿-m_7ò|q`õæ[”L‰ø‡L¹_Ä`¡Gܾ,YÈ¢Ú2ç”'@:˜eÚuž5H’c}£¸°ô‰jÁx“w¸fSµ'l¼mÎ{Dβ|¹Œ} ^Áüþ•|?àwÆHÚYänÚñoï¨Â#¥l^˜ƒ4î˜UÜaxÆd¾E¥'æÜ ‘»”ž!m2&²±î7ËŸ´.)RƒL[©ï„V]ñooŒ X(vÊßÒ=Šv ÄÅ^×Ár”’,‹¼³°Œ­kÞ2®CÉÿ¼ðîøÔæ°ùþÍòÛSÄÛ&ž…¾÷I|k'ºŠíùõœÇÑå"}ËtºÏÄ•û‚oMßÏKÔ`Ð½Ä ¬VYx, -…°œñ -`ð;¾Àf/£zç>4`ïïfêõryñTÒ¢Ý nZM´¯¦Þsç´à*#_ÉÂK@óÈ1 Ë*o>“cmìsáèv¤6 .c~ßj+Äîû´J·9uÄÂ¥Í!°sO&qá©QN–Þç¤ïšÃÈ]pYl ->·¬À»–Ú l:™±FÜØÍ°"€XHËtqÖ‹Ó$rwO­mÛø¬ð꾺‡W»Ýi—$‘I.£-2ñ>;Pj£ír 1™¢›@zY DíW¥Wú“)èqñLL™/ K‰€,jáëè"ò¯è¿Ðgáðû¨/úÔÆ0áÍêý Ææ±mÀ ¶—¬yÉT6kz&©zaÔûlظÑOYô‚çÍ~b> œlÄ€wkroOCéÁNÃjùæ¼Á¥—RÑ'¸qÒ67ŽÍ¯Xtì‚{hdp\(‰Œã¨> .<’:ØDZeî,…ìX-S쥅ŒXN£Áé#a«„ÉÀ³îÌ­"òð"Ǻý™YòWØ£?21ðÂC1n•®>7Ñ ï¢H¾÷¶-£,mâ&/ÃÅV^‡­8çŽØ.ûÀœÁýDì`é^g_ UÇsù²ñæ8䘻P¤Ø‡²d/«ñøÕÞ&wzƒŒ ýä^LüþÚÇ™  [ÅA¹®c‡®?•f¹‘íFœKÙ±™$Ë…1e'¨¸}’Ù¤‡vîÒ›:Ö*Ý?€#S–ÇÆzæ…!>¶Îl#QèÉg ¬+Ò¤=^ÛÊHrËù+‘áPAò…¼p½#´)Ñf/rA‹»âsÑF!…,oˆí–}GþL@§7¢‘aŒéÐMÄÖrË) ªZ,°:ç¡U̘áAËa€ö¶Ž½¡ûšp$›š5»©Ë²×‹…§0ób”ï)¿wjІ·BÛy`õDÊÝ´ßb;°tV©Q–%½Nò@÷ØY*ŒÓ FM"Ãg=i,;M 7€!Òü”¼ÿY«2ÈÊþB*êXãya"á™a$E‹œ8𚟅±Ù}ïQ`Œ„ÅI5ÿ¦ PZ a*1º‰O8Ù$¯jx‹0Ò{ Ø9`®a.Ùþ¬rõÖØùÔżKùxèÝ%PzP¯4ðaú=ëoý÷äƒÅ4˜gxë…¹ÇE*Œ@Rb—ùFc Í1¡'Üh‡Ë&7ÅÀ`äiO/ƒÕýCïY;v©Ð|j )—P0  - „¦.b ó¸ÜãzѤ7§+]IÐp‰œåkÔƒ”§Q袕)Dz °–™¸d$ ± 4ˆÌ°T§3Ï'©%œê?…ø ìƒ8,ÁÅlQ$>í4ºÃƒ IÚspf„#F¦`²hT»94Ÿ¶zWÙr‘AâÜ_è&-øƉºGìˆg¨¸ÓÃÀÝ2ÞiA^&m -LÀx*yÝæ0¶\w¼>WD¼´}á³™FÇßÊ}º>-œ2ùËYÄnÀ#ûØÕ†Ž‡Nj˜ö æ•(=@ é¤&[ÇCº>ˆŽ38ãÞBGŠGÐ8-‘d<{”Q#çß‚v…ø"óü:µDÐÂ¥+hÚÜæÜßä§H.:íÊŽîH“¥*rªBìî[†°Ô Xâƺ¤ó¹?T1(šŽñç\¯$lY -›hÙ¤¬·[Ši(»À¼tpRp!x‰,­xSÅZ¾Ýý‚(•|_ïñʸ*Rt/ÿf¶¬ñ|Û =Á6U.؆3l;H‡t,Fúq².s‘y ¯¤ã²Ídu«×\¹Ã–1Uß?ÊØpTjK‘.ÅÓér ªZ±õ‡©>`­}˜\IÕž -CƒYœõÃÀ¨ºQÉÉ7kÿ¬õ®†énŸöFÈòbBoÍ£Ö)±Ñ—©’Ì]ð·?J ¥'H‚¨XyÓÔ²ÛÃ#O_ž‚ŽF&¦$@«ðL,#6Uÿ&21VÑL\ÖÁÔoÖÇp;ðí8ŽQ{6D±/ÙñO|×ñzÜ~•¯ÖXà/M÷'˜|Ïv¢„×ø1Ü/‰qsûîö¸ÀÛ›“ ‰ì8p¿^„/Þ„|—ÃßåŽÄˆñ9þ)ÖP™ïWT.:’rHˆ’ÿ€KÔô·„pñ;åýÍšÁ.é,E÷P?ê‘E»‰gGI0ŒÃbÎDD£a- ¶¶TÖÉZa§M6n€-—¤šÆ:Ö²¡Ù«þ{€å(ÄÖr-¼eÞ¾Ž•Lçal¤iò4{•Â&Ñãè£N8*9z2g‚699lpL‡—»Š*Õ™V`þWõUÏB×ûB@ã,%C -`ßIÐ`öÃù>õ -ød=‰>e%€jÒr™ØK¹¾õlʤ¥ êe§:¨oŠTX‡ëh À×F R1 bÐ`Uù¨£(Âfª² jH8ÙàŠúPfBÒU$’Wcô„ë«ÉâÏœgr½I 쉋x[W[BÁÝ¡‡Ýÿb¤%ÖæôË®¾ž œú»òý1œ$]Ø©*u °úqR·ÑÖ»v˜ü Ÿ$v„“^NÅvÎçÜ24Ée¸%ÜãUp_³0°COÿMU·¬*.]åSÿòØ‘K‘qöi¦lÇOGm’³ŸD„××{5»ªA¢ÙÀ!&6äS3åÚ€-z·O)úðí‡Î$C‘ð+~ιCŸxà·a?Â4 E}“9ÈwIäAPð'mš¨‘-“Åj7š¾(ûƒ|å¤<µ7Z´Ã Ÿõ¿*×ÿDpj ]kýé?ŸÀÈ -n-ð¹—6ßjí.{ <¼½0„…¤2?QVOùvb™Ôµ#Çÿ*-ä -F£Ù§}¥â/LQÖqm'œþW q _÷O8^dõ-úµÎ‡gªã T!¤ þ¸HûdhÖendstream -endobj -3171 0 obj << -/Type /Page -/Contents 3172 0 R -/Resources 3170 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3150 0 R +6368 0 obj << +/D [6344 0 R /XYZ 85.039 296.062 null] >> endobj -3173 0 obj << -/D [3171 0 R /XYZ 85.039 781.388 null] +6369 0 obj << +/D [6344 0 R /XYZ 285.909 302.036 null] >> endobj -998 0 obj << -/D [3171 0 R /XYZ 85.039 529.88 null] +2478 0 obj << +/D [6344 0 R /XYZ 85.039 144.973 null] >> endobj -3174 0 obj << -/D [3171 0 R /XYZ 85.039 511.008 null] +6370 0 obj << +/D [6344 0 R /XYZ 85.039 123.777 null] >> endobj -3170 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F35 1632 0 R /F70 2201 0 R /F18 2207 0 R >> -/XObject << /Im1 2193 0 R >> +6343 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F72 3966 0 R /F56 2890 0 R /F11 2898 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3177 0 obj << -/Length 2331 -/Filter /FlateDecode ->> -stream -xÚ¥YYÛF~Ÿ_! –,Šd7Λs-ÄÁ,Ü­ ¼Eà¹Q¤;¦|ØþæÐÌr†žs¿4óöýr¥¢Èù®®~÷|½ï›åÊwÒ._úN]a-vvõRyN#ßÑBVu jÒ‚>ŠÓò‡Ÿˆ¹œñ!ïÓ*Ýg[Ùò¶ïž² -;˜í†¸kÚt÷ÃÃYÍQ‡Ä5žÓG(WÑ+&ð•küpj_»JGW&ðamœiù˜Š˜ieå ó ½ÿâãñ$‰ï‘UÌôø·Ë•ö#§Z‰Ó“AÊe;Kâïd¬Õ;ü†Î¯Uþ"£ö;µ]VbÐ -Ùï^èeûo–«È÷œĪ¯„úC פMÞ‰ÿ†&)hwqp6E!äà -ùI/ô‡| "ðý^¦w`Êäà’YΆ€P5¬åÏù¨à  ”")¨ ìQ¾±ÖåEþ9÷v:ú~Êdí¾Àê~Ÿ>va„àÃñÄÚÐÖ+Íæ¬Dõ¾fCn±»È¬­°[Ý/Mž…Md’ÚŒ -åD>ÉZWËï¡Ä~É6›Q6eKzdãK!ÖiS’ -Þ"PBݺÁìgK-˜ LµÅ8qš_[÷3³LÖ6µÒÔö|“¬yÎGBž¡hÙ ›ªZ(&ƒÄÚ3ö ,W3Š²]™ñÙêqÌñŠ_kà7ò•ÊÏ6 ·#9›–~û¾è+;à…Žµ…¨™äÙF+È:ö„ ­Ð·'V’sßx•§Ú#üV7bM&íÒÇqý—!kˆ8ÁìúG5M^íZÙ^gÝf}HÛö¸Ê‹4'˜6ÆXR µÀpÖ‘$–[™i²O=ìÝdøŽG•0>45ôf?²¤l;ì‚©ñûESµÂa7„…e‹ãê}“–íäLʠɪ¸}¢éàÂùÏùÖ]“ÑùèMÏñ;æ͸™žó.…ŸNbA¨ HŸ@*B;dªfj|3@Õ=쪜³•«‹1ˆnÈLØÉ—¶±æE—5• Ãóy­l" òB¤˜Dºv9Àš •¶ßˆÇÃhêñÐTl=^Ôû\²ÿ64‚ÈÕ‰¶„oæ8Qµ!ÀèøÙST$Møm–* óâßãœTJ»~èÌô²!Å7>ÅDd.cÂf<9X'6€Ä!Û¶d-•®™µ8…^•·%VÌ9A¶Ÿ ®XmºvB+Ü3™id_Íãg™¬A¹ã‰RVQñD71ÇTµžA8k¨Ã¡ªö´#¤ZÉU P2—nfmgiòÏ’y&»fDœ®á$èú&£¬H|obA·òËÊÔØ+m™… ) -¡Ýs)˜Í-ˆ±}šºß?!óŒp‚¥ŒÇ ‹¥Å¾+”K¨{ -ÂK˜+]rÁn&nbãÆ #ÐyÈﺘt!R¶ŸÐØj Ø>{‘Œ‹{^§O ¡?‹l㉈ÏáBi3¸1RnìÇ~,Ð$è;¹#¥èΫÝCj•©}½Ò}.ûB4{ƒâîuŸè‰&á.ôÓÝox‹-5Œ?Ýy®2ÉâHcj@©D”w*4nh"û]Ü}¸û×ò‡¢å/ñá]ñ‘Ñ@~É'¤kÇÂ=‚ós_ÓŠï„˹1ý¥f(êâ•RFÓõÀÃâÓÂÇØ(YŒYÒó&žX¿+ýÅ÷5‰´8K¥ŒÐéQBˆ˜œûåd¦_~@÷´t§PÆ(¹¹ÐGŠ@A>¹(Ó¥8}ÛÛ¸Q^È1ZÔ)B‹ÚÊó|‘WÊ®"ç0åtåÁIæ99úlïHsHUÞsÙ(I"Ølº ÿ² -åû6Û±àE'ßç•B/´•,J…•a+¿Um'ÎØ(ÉÑŽrcµ«…CÏA®LœïNö|>-¯Z¡¡þ¥Œj(ß¾vÞAL·Ð·&¡[)éMè÷gÌ}ùçƆˆÇ²À­7{§“Mƒ ¸æ›[‚VHéÛt |ãj=Ó5ynM5€Ú‘îdSvK±v 6§)Kw5£Ü„iª1Çš1ö&äyR¯l,±Ãì<5ýNÀÅúÛë¾kqS`’‘œÎ `7.TW$Öâöì^JÆŒg_¢+¹õ.âu»±g¹0Ÿ»~àuÁM‚D.1¸»àJkÚ0?ôœuM6i÷PüØvMZí³eMù•¹m} Š.Ýa„NAk7JôßC°`Ò7„êØgþ¬Ž…žà,ˆ^¿©?0âDtO¬‹‚ûšãP¯0Ëi¹½Dÿ%-_*¯>ú¶0¹©1k4s­™ I±ÞhPÛ§O4ÊâÞ4(nƒlËc«#UWGz -TO) *ä -‹A}°W;@M Î¡†‡!áÎHZ”²´ è†2Ë+·[¥~°=É?t2î‡&¯dH-̦vwn©Ú.å~ñO¡B÷´²íŽ;7KÜÊ>šló/(Ûaéü¼±©ÙsåÐȺãfì®K¡%8›\ ^Æ·…ƒî†Wï¢XÚg®@3Øm¨÷Ðã=§¼†ÀPž6QG¦“¿î®VóÉnWÆ,WsY~8n-†]¥ à™iѸâ@FtwR40®Gõ„_}}ÿöýŠš¢'}…ž8\Áà] h±ó}ßØú©]^X*¾ÊcÐ ûþÍ€ñùhñÞ³Éf›yªb”¢`Šò`ÃÀŽ -šuÝÉÚãÙ[Õ,ÔÕÎpª·­0()·û·õýaþàÛý„Rd)\†ýešÿ‡Øƒ÷Å”‡õQÆå6|E’ͦîñ ~V¦Í¹cáÛåå\e\) -ªÐG×û®/hxM¾yUöÂÿIüÎV)? -nˆîô&¼ú…á÷?æ7 endstream -endobj -3176 0 obj << +6373 0 obj << +/Length 2568 +/Filter /FlateDecode +>> +stream +xÚ­Z[oÛ¸~ϯ𣠬UQ¤n}9HÓnOMÚӸ؇ÝÅ#ɶKòJrÓüû’ºX’S`±HŽ†3ß\I•-øÇ¡g;ÃÚš¸_/WÌjðæßßà³°ÖŸÕÜÃõÝ»ëW“šà¯õoWÖ­ä­L e„bÿ}õÇ_Î"»rl…‹gxvlËùÈm{‚ëñþêáê-+µ&ê­)”<Ú^ÈÇ01¯s¹íºlxŽí9‚pº/A‰À±rÙ4i¥žŸw²QOñÒ ­]™Å©¿à¸<šWžp˜"V¿àTh5;M¸)÷€Ê¾D‚g$È`XlÕbuĵ´Æ³ž3"Õ<³)sz¥ÖÌŦXÕ8ÝT@@›ÊA_¬´†+†0E¤Ö‰ÊÇ}šÓ;oO­Ã˜ksæ.×± &A54«‘U @ m?ð[N¸ûŸ F;ra3~~CE2Þo`D©½Á~kôçÖè“õdðãŒp*–nd5j¡iáMg1q|;ôÃW0éˆÎ`¢‰^Ãä܆“Óý&1éíwý|5KL²Èâ9­ýˆÃï+Z÷ˆæµ6D¯h}vC­õh¿)­ûû‘'¤*N”âן>©I³õ1?”E= EÙ½EGt +Môç64Pœî7 Eo¿1Ê;{5¨T†Záz‰ šèP•[L27y &³fbœÀ—Ž üÉ(›ÁÚ3_yªÙde¡æ“ô€Ä%.¿´AW W63ÅÂ÷hŒ«EºZð“jÁGÕÂÌ ä¸Sh2&ìÈÇðµ=0Oâô·ÅßuÛqàÁ÷Àò¼3€ç÷ `¨ ‘2@ä[r0à +,Â.ê}b:Ï·XÌ¡WFyÚõ9X?Xô6K¨iFö9åDÅO6hùJ'Ír£,×ìT…Á¹›’,FÉ$­jSÊŒ‘opÉU„ø:Õ@@Ñõ]wJƒ‘&\ðƒÞ±]q–[9ÚaÄþ]Ñ6Y¾¸B6 `Älˆà…v‘ª;m19PEY{väAXº-¸;+%É䀔êI×ñ! ³UÛ„™ÂÌb~;¨ˆNÒäTB¶ îw ³órH×¾ð~%ßILcSgÛb.Ek‡‹K¼ã6op´mÕ]×d8…±S«V‚Æ?ŽM&È\îÕüç5_–+H†¤âŠZ7gдÅÔ«ÀÛ´]^ƒ)·Jë9ïò¢ÈŽ¸÷³¶C•aaλzÜÎxWª3•, ˜ôe¢aÐ$‚з6)äT„–šr‚"}VêSNé/‘»“O¾­'ŸE£õäïS*“YëËog9{<¸#÷¸Í:²Aò\•¹ŽTÐÁŸ–+á–ľ@øP°Hþ¸<ªJ]«å 'r„`T1aºL—v,ùdÂÕEÀøDŸubyý¬Ù QûâŒwÜæ¸ÇMy@é_t«Xè®yß«²«„“–m]ðºt.xNã‚}]®h„nµ²X÷dn$|h·ÃCЉ!ÿt<'¡ –Ï ,`ϲ+àg¸ÁœÂiü¾ŒÉ…TëY76 ™¸Xñîq›A›æŸæòÀÇ⹶nÔ°;Jä¿mÞ®Ô:¥úÀ³Ê¡’Vr*¡TÀU·Üo;Ê”Ûéf©¨{V!ã³}…nÓ™ øÐq Y÷d®4AK +‡+«·Ë•9–*¦ÜŽK‹2ž|DÅ[­C·V> 2r/±ÍöÝsÑ…”!cÖƒjÙé&dÀd!×ß— ÌZ~ÓHkGh„w©þ¦Çm>^<׎|u¦¾U(§*C{Äú¹Ä¯78gzEäÙ¾šÀoæº'Ûë™c›3h(+šw!o6:^§p47Lج< ¿¶ ìœÎÅ&™a&à lL³ôí¿š.!åA%pu9Õx¶1턶뉟 OÀO0Ó·31Ý3Í°ú2Çw,™(×R*+gÇyƒÚ»Ôg•ÅÆvÊ¥>‚¥…l“‚¹ÚÃZ¦zUºªm(m¼–(.w\ÛåðkG¡7u :Bÿö€\@j÷ìGTÛ÷ºÏ .¬2²!Þ¡ë›}Ž †â­ @ÁˆÇzù£Dáœ|›Óõvš§E£®iÚ{Q8/ßàGÃö:k&?p¿CçEîhHd>¸ö7"ãç†00§?çîØ繞•´G9=ÊøI=¥úüÆ›…î ¢~ÏŠÇ ÁH‡—þ€.£À£ Îh ðü‰~ï×âë8?Ô¨N«ïiebð$\o¤ìhd:ÈüÿùÓ®ÌÓ$«ìºT³þ•Ç¦\ÅUªL ¡V-SíÊÉÒ*aÔs\÷ÉÉîט¬ôóû¬J㦬^FÚéõ’âL}xÕ¸Q[§ïP7/‡tá:<Ⱥ~N~Ñ´Éc-s=Ø'òÐò—úï}Ý~îíïª?öÅqZ׊š2að¥ÌŠ¦žá³6}¶&³î(ãcÖÔé~ÓÙÿ›Ñ©E⡇êæì=ÚgCõƒLóR7i>NfߊL{Ò!­ SÇM+h¼™è)i<5ÑÖËÒI¯(Ôç…Lmv¸¾ù¤ùdÅ´|ÿ™`¶ÞUåq»ÅCÝax•ÌÓ&­z`&÷e£HAì2‡\‚wô4±Ò!ú#NšF¶ì_Ì[uY5Ê-¸°¹ÏÎø¥Ügqf@B+šƒÙÀ·û‘E°j“´½»™ò ýÁ@ Ûh‰>$Ycøâ†à-3Nñ»lb^yÔnÌ«kÙ4¥Žþt³›Îú>8fuâ}ÙªRùÉL +vl7š®JZÔ 5op°›û2ç¹P!™‘…Êθs1ÿÃe$ð?f>ßendstream +endobj +6372 0 obj << /Type /Page -/Contents 3177 0 R -/Resources 3175 0 R +/Contents 6373 0 R +/Resources 6371 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3150 0 R +/Parent 6342 0 R >> endobj -3178 0 obj << -/D [3176 0 R /XYZ 85.039 781.388 null] +6374 0 obj << +/D [6372 0 R /XYZ 85.039 781.388 null] >> endobj -1002 0 obj << -/D [3176 0 R /XYZ 85.039 761.463 null] +6375 0 obj << +/D [6372 0 R /XYZ 85.039 659.915 null] >> endobj -3179 0 obj << -/D [3176 0 R /XYZ 85.039 642.137 null] +6376 0 obj << +/D [6372 0 R /XYZ 263.137 665.888 null] >> endobj -1006 0 obj << -/D [3176 0 R /XYZ 85.039 642.137 null] +2482 0 obj << +/D [6372 0 R /XYZ 85.039 374.658 null] >> endobj -3180 0 obj << -/D [3176 0 R /XYZ 85.039 617.419 null] +6377 0 obj << +/D [6372 0 R /XYZ 85.039 353.461 null] >> endobj -3175 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R /F70 2201 0 R /F18 2207 0 R >> -/XObject << /Im1 2193 0 R >> +6371 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F56 2890 0 R /F20 2865 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3183 0 obj << -/Length 2143 +6380 0 obj << +/Length 1050 /Filter /FlateDecode >> stream -xÚÅYëÛ6ÿ¾…^Q8Ë¢H½ -܇½\6M‘×%·C[ôh‰^ ÑÃéõýço†¤lɦ½Ûk‹"L‘œá<3ä’IÿÈ$ü€f“$%>MÓI^ß“{XyuCìøŸø1a¸öÏÅÍü.'$ð³ ›,VzÏ¢øÁ{ñÝí‡ÅËÓ¥Ô :K’Ôû0M™wûÖ̾xÿîîõ«Ïoqr1ïõû)ñÞá*óî¦aê½· ^¼|·øxûæÍ4¥ÞÌÔÛÛw·¸åÕK ù×ô§Å÷pòŒP?b™–@¯~^|¤¯_ ÷³s€ææåb ØŒ¤~@BÔì—›~ -&hÿýMàÓ,ì`ø$Ë&õ ‹ðj¿«›O7ÿ>°1klb¨œ± óƒ4›Ìhà§éÑ4r’çy»mÔtÆaäuâ—mÙ‰b:‹àkÃëŸ7»béËÖa)¤,Ûæÿ üÊl:0 QyíFÁ¯Ž *.UÕÞŸðˆ†,6\Ê]ÛgB„$4“¼ãù—ªÔ’h’N¨nÿêëÈ,ºª~Í‹vgÆu!»ùZxûaBÁ àˆêñ¨J¼ªÅ0ÚaÔH3½ê!ñ„ùnWøË@žMÅs¾¬ì| ‚iÛ·•Ð,H½ÅæÚ!Ž‡‘Ÿ„‰Âùåjæ•4Ù9GùÊå\ -<1ßvø©P‹½ë(pa<24º "L;ì +µé=h&ª².•t‡)®7ùæg¾UkMEKÕ­[©¤cAªÎžéf7ŠÆÕ}×n\, z¹¤Z••p¿¬…Ô(ÃóGËÕ¶ªý¢çhl篪ýe‰ -Ñì ±Ò”RnÅXšš—ÕeÑdž–œ&”Ú§UY‹+²”¼²†8P @à(býeÝÖ¢(»+BõÉz ’kQUrlœmS>^4±hÆ»«‚[7%êV—eèxQnO"PÖKÄ™±h(Æ«ºÌk·¢2¬â0Põ1x8AOk,»"ÚVŠÎè@¸ã]3VO³²0my]9¦Ù/Ö´Œ$Þª=A8ã÷fQ<òzSvv8ˆ=ÕÓêà6sLþö¾C\Â%„ˆxŒ¤@a ÇCèÄ=×sÔ 4õ K-º§›²ÌO*G©Ÿ±ôéºM}FcgÕÆ»«µXǬvØŒ&À:ŸQÁu9€D>KˆeÐׄ­ogÞ TæÓ0ñÖ834“4[zâXî¥Ò [›ÍHø¹C/ê∳Xu¸âK.-Ù€e‡,ñi÷(/T>7‘éÐ$¦vÛߌp²±õ÷7²8ü,NGvÕü4»ªTZ– %Áâ‘x»Œ¦G½ñ"°Ï¸&;ÎÏRŸEÉ囑,ö“˜MfaâÙï¹ø©À‘Ë”~öæÜ­1ˆRϪ= -"Ô}h‡O ü,¹Ù;ŒÝ! .’‘üYļÚäÊôI ºC°ám™w­lWÊ~b›ÎÌXÇ/’å8@øØovr¸ˆ ×’ËcLãÂú°`5ÐQ¥A VJ³©à(ƒ | Ί‡T­n -á Ï+û8… v„9ƒÕÓýW߶¾é_庇2Îg»ó9¼~^|Þuq®i Qñ½‹Í¯ÏçôÔ«äó9=õx…Ós/ÉAŠ—d{CÖˆuofu! Ž73qxøÇ€0¤@7÷¹ŠK8_ÉVS Œz‰›Ÿ Úį¸Ý ™ÌÛ>šÏ¾‹éK$631Üöl3æ2:ÍVˆ×<•yH7…u+ʦPok÷œU"H'®Þ“B¸A`_DÒØÿó‘dð–}Š$ GÖßL]) #ñ3BFîw&õøuü÷gµnµÏ³zlÇc3šÌ’ÄOá®çþƒÌ3«ÝÕ?[P„¶aåÔÖ&.k“˜ž7MÐz2ã¦^Àÿ´l²ûendstream +xÚ­V[s£6~÷¯àmí™@A ycã$ÍÖ·ÆdÚ™í>È ;š‰E¸^÷×WXss»v2I‡£ï|ç&Ç°ùŸc¾eƒÐ˜Ž‚ÀHò‘mìùÉóÈ‘¦T1:ãÑíÓg8¶Ú¡ï.v|Ëó§ŸÇ?EëøñubÆÀ±&ætŒgüòüM0Ž_VKqüô:q§ã?[ˆe<1±'k¾?{¨eo¯ÄÞ&Z|ŒL 6¥Â—øÓè1ÖÈ5&Ž2¬a}þb)wñÓȶ@G.Û–ÃóÇmùël´ý¢M‰3Ï_ ±äƒÀòЧ ø š7´¼Ð3¦¾mù¶wæiÁjGË|bú®?fJð'rEÅï!!-åŠÒLIâ7y‡d/uw%•zPüÌi³š%ÙtjÂ3õ±T{¥0Çd//,égÒâ$<[zìG€m^flÆï¶o/ã7†JkÅ|圕Lgj9k˜îÔ²C¡:§{*¡l’•¼·6ñ3¡Ó»ªwtÒ‘–_µe[Ú Î6ë‹%$ÂsI…sXšåÔÁßo瘾Ÿí)  Ÿ8Q%9ÒFdh`‚3\Ô¶¶šU”¢´I‘¯ +…UBÚ׹ݺ)!(‘:ËØk(³¾­Ó~`ôµEºE)®Úªn›Ñ=h9ˆÞJXa­V,Ö—«øñ~àÖ—dïk ]îç³h-YƒÉW!!8…±Ç,‚ +xÊRzÈeX0Á†Y÷‚Vp 9 ×Kg>{yºÑÉ&S³æª·Y¢ŒB“´¼iæP#ÙW›ÁÖÐÌû[]„œ«œýsZ¯qZ®DiÚ2–¢ Uò˺6ص_R¥¦f8Ç +šªS†ÿ”ZTöRuÙŠ2:/Ý2J¦‹uèb•×ªH›®ï5LˆÌžøÈúQs˜¼c‚úN‹JŒŠ"Ã(U.f§NJÑbéxŽòmÍžö”h¾º¸»!χŠæï ?_êøˆ–n†V‡]3ÛßÙžLpÖwìf Œˆê%LÔ ¹\¬†`QèÎUKÖÜž{LÓ yw5u§­‚ZˆŽ¢|ù°ºJ׬ÉJªR 61­džmªS†šs¥aa-'£ìkšáëe”p‡Y˾:Ú äPÖCâÚü7~l`¾…÷ª¨¶TIÂó˜¨5Ë·dì˜Þ´þMgÆ÷ü“”Ù}gà4Ù»Ì×$pJífùGç¤Áðãoo›+O1¶£CÝ[+œ\¦L¿\—ê™ÂŸW‡F}_—€*Ý2˜ËE–Ââ²ÊOì[Æ— +ÝÀÓØ–=ù¿àî?½JõÓÜVBýätšONßu-×QXj2€ïvñª×kð_Þˆ Dendstream endobj -3182 0 obj << +6379 0 obj << /Type /Page -/Contents 3183 0 R -/Resources 3181 0 R +/Contents 6380 0 R +/Resources 6378 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3185 0 R +/Parent 6342 0 R >> endobj -3184 0 obj << -/D [3182 0 R /XYZ 85.039 781.388 null] +6381 0 obj << +/D [6379 0 R /XYZ 85.039 781.388 null] >> endobj -3181 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F56 1642 0 R >> +6378 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3188 0 obj << -/Length 2658 +6384 0 obj << +/Length 2619 /Filter /FlateDecode >> stream -xÚÅYYoÛH~÷¯ †–4›7w‘O®ñ v<±ƒÅÌ`—")‰)*<ìøßo]MRc³ÀÂ0ØGuuu_U·Ô†?µˆ|ËvãE)Ë¢EZÙ‹-̼9SBÿ¡(ç~Z¿œ…²­ØŽ« Ѭ²?Œ?_ܬ^½_š®ëŽm-Í0ŒŒ›eäW<úâÝõëË7¿½¿ÀÁÕÒTÆ廥2®qÖ3^/Èx' ^¼º^½¿xûv¹Æ?yèêâúIÞ¼‚5/—­~MåZ¾“4ûÛêgXzù¹ŸìkÎ^­&3UdÙÊÁ“}<ûã/{‘Áé9³-7Ž÷ж-Ç‹êÌóqWúåÙíÙ¯žó¼jF¦gÇ–Å Óµ­(éú3Š|6s´¤ïv … ô&ÿØMž-M'p|ãTÿ:Ügk«­—¦û¾,ëÒ®³¼L¸Óî’¬¾çvÒgE7·OšÖý¾Þʶ¿¸s9ÚiÂÒ'ŽmÞ¶E½ÿJŽ3lD²CÒ¶÷u+•ÿZ˜¶Ê|dxþZMÕm–º`0ïÒ—(¦ã keäØvM]B§¬Ñ·îÑ• -èî·L˜ãÀ'H*lRÖMydÜTFZ´šE-{í’–køDFNt4§ bšd#£®fÚ¾Ù¥­–Nlê -W¶÷“gI‡2®X†š5E 3åwx@½¹ç:pð†°¬H± [@’®Jz`Ýíò=vEšthme`ü{®q Í>EÁvÌM–MUBîs)ÔÈ°Ì„;*Ÿv­yµâJìTI&­AXä)çA.ÀÖõlãÐÔÛFÌæz JLs -Œ  Bà(Ù‰AçB{ä8¢€í##à÷ÂCÛ…¶@2aŠ†E¢áx8˜â»d¿Í…E¯•aÎœ±À3lJ‰ }´¯¨4†Ã- Á(FŽ p_EÎQŒ<ûáæâÊT–}êÏ8ÜV`jÜ îc#­÷›bÛ7ì4´)J¡"Óa£ÓëþÝ&Õ:ùQ9oîŠtΨߎ“mµF«|Úü/qPX~7ú_‰ƒO’ÕY­ÑÏÏó.='=[Ù9 Z8ú8?šƒýíÈr<ïËiÒõc˃Ù4 ÇpìÀrí§Ó-­²·4ù1ê”…Š]KùjȤ!Ì(+F%™ôºFlBçÎçR¿í[> ³ø¸öâØåéI›DWÑÀùe¥/ki1Š1âøÁ"²ÁâÁ —Šf2ü V5 ć%JR -ž´Ø#uIú¡À$ƒ³õF¨z}šO ù® ØL¨IH -´Ñyª‰“}ÑV-G¹Å¡qÙ1]!;âêRpv> •j‘b‘ëEŠ@ ¿ŒtØ*ö:¢J5H5MyHU¯»„²h.xäE¶äV®BÓíe#Ö×wªšeÖs²=•¶Ûáöu¿ÅŒã,&âËDu8ÎÛ긧Ùb¾*…‚Aêp,hq‚ …™’õM™ë·ìrDÒ䛼™PÏJŒXíC¢f!Ò¾bóv£UqZ+—:Ø®{éÊÓ,øC_&Âö¡íˆ&;ß%Sp¹Rj?úüv§g9XýÅ ‹äÛD=#¯ÅÑ! Ák›T{Ÿ¶ò(ù3mšpçuQ]‘ [t{üNƒûhÞ `Uãùþ®h¨î0O!SŸ å)›J’º9P3¼%Ÿë?aZÕ¡äÙQ-r”ÔÜ9è3×wúX™0”"äQ2uœØŠlO0ú1&9\³°$ B+d ùÚZž;µ82X=}Ñ`ïmk)Ž§He:¾²”:2úx¥..ÐáØ!õL*e´k#ºIc KÅ¡L¤aª}à;Ö>À Ò:  TüÀt±×\LÊ1.¤©æ™ETŒNàÙ¹]™ƒ~÷B@ƒ9;ÁE‹'͉״’BËæßÿËN¾mA/tìçÝ®&Ef|æ¶à‘ {wDŽúyà,'O®;P9_à ~tìã}(ÄRYî „¢ŒÁÜâøšêÐB¨t?4 -ùNó m0º$ ` Ù•—aèU丮Ñ FöU@¸ÑÎxÇ}Aub¤–ÛW콆ÅV†ñD¢Êb“ó艶»¿A?váö4Õ%Rdv\òáê!~@ÕåÂ$®Bf ê’Ä×1N32#š`?Ø]ú>p‡L’Påêûr?M@79OS¦ÁÆÆ°“‘ž)óèóÈqŠÌ†ìC$j€]Ã,†’¤ÄL´Œ˜»¡Œ­¶ÒcTŽå@Mf†®åry÷ߊ&V£*&®‹¿¯zÅ`§÷ǶBgî•G@È @í̦ÀCY  …nêÛ` 06½’¡ñBJ%N“ãµ ç¨lâ&Ü4!eÎ×탬–ëøŸ“UA]ŽÅêúÀu®¡<CÂEc)êÃX2 |ô Øqù€%¤Q.TË¡ìÈ ®"0»ç3 òP³•¹÷o>#d=$Ž@å ï÷ m“4©M-®C™Ö„°tbÿ[q:ߧÍÃAL <ý( -“ÏY¶‡¡Ê<nBÿàö ^&^Í`™"ÿ r‹«ÙX \MêÖÀžè>úNJﾜZ &YõˆŒŒ 0@8AA¯ÌJ¿ýŽ¹’Ò -µÎö;Y½? -+›Ÿ@‡E3¶ŸFyn.4Ê“ ¿“äY./Ç:É0äÌ"˜Xg²d£+˜ýIé%žNqÎNG"6˜†ßžÈ\/ú;ç?˜˜ÛséÕr¬ p‰ë•`6Š#® -7[¦xÎóûúÔõãØ -üˆ‹Ó@=ñS)Kù}?(ºøî:œø³å™ -¼“¨€b8ðŽƒâ?ÙäOqendstream +xÚ¥YKãÈ ¾÷¯0‹ ŒÕ’JϽÍbw‚]$‚î`³sÛ²­ŒI·÷ׇÉ’ä¶Ý@4ÐbU‘,‹Ï²¿ðèÏ_¤‘ë™l‘¤¾kÒtñR?x‹­üõÁWŒ02n†ßX\ÙÕU¸^˜ÜÄÑ=V‰Ÿ¹&ôóóóÃã§À[žÇfñ¼]ø~à?XÄYè†&\âßóreâÄYÉçy_ð”×ë`ì|^Ï)Ö˯ϿÓþ« t3/f~7uÙ”Kßé‡.ʶQ&àÛì;m²‡_ŸGéUø8ÎÜ(Hß=ß ‡ÏçG ߣͳ‹ó㦤(ÈCÒwß ¼#±®óf¤Î#ãäÍ@àüXF‘à•„è;:ÝÊsmÓ AWìònƒc6;™XK{¦ÜÒÚ±jdGÒF/û¶`µÃÞ.a·SÙTíV¾t%t$º“Ô8Ï®U¶kÈøpÿ€FSœfŠN`ðm—A✦1ÉŠqn +™¦3ö:Ó +Ê¡#€È7Ç‹»WàÀ £ÐÛâà t ·8ðžîŽÀ°@Ë`O +§Ëça9Ë®¨ó’´z}¶„deíöéü{Ú “[ù˜iÑõm“W25ä¬Ê¡ »CU¢%†lØdP6¾¹RÌD3ØÂwöù ƒSYÑPWr†Gåé 0ùÖy? _ÚF4ADê +קÄABâÁ2ç5lr“ä ¿ XKå{sùœ€óû“é ë¬°]åJYçï,[ì‹ê Œå]¡*½’@ÖõÄ®³ØÞ÷cù¤oÕ*ý@³QÀ²Xqó[×I¼@5𖯊GT³aJh¿üÔBTì$€qñ—)rb¯LjœsM¤.í³´«…NÇ"÷ I#/aËãe²sâð£ÜŒ>*Ìà¹pS Õ£Q—CÛY]Üì‘œñØu–™œ–pý˜BaŽs‡~"÷MS“·4jØ`Î'$,ÞHä¨Ùr e“À'䢉ŸƒpG£T«èezŒ<ƒ¬ÀÀ»oBz*7*Îß ëI&?—ÍFBÇÈèú›Â²K #ßù[§ ‘÷|}ºÏFf)Èæ»B.@ôáÞ ý‘¡Œ¾ù'›ØüR]<ü‘Ÿº1eMl>R[˜9Ÿ8[åñå0 ú”›~.š‚íÚêïI¨¬ßq¹ŸœBJ¾AÏ“SyäÃÒLTœÌn “9®†)‰ˆ“kÛõ²Ê×%qŸy­%NWß­3sàÀ¨´ß^÷—ÏN‚¿DÄ¢Œ’+ÝçÄ1è ØÎÖ‘¹÷[F´‘=Øìö\j 6cPö£´ÀvŠ´ù^r¡eR•\³•\J@‡8Æ‹.sªLM1žùè. {™^ÛÔ'8üi4.«u·1›P4ºqú7‰çlôêÒ1a¶iqEq¦úl5´‰¦¨BÐÞªfÊ6LŒÉJQKk JË]­É‹Ì‹Ã(¶¼+_Ѐ÷EåÂÓÆÆÐ\ŠûÆ$P¶ ´…%ƱüSÌÎëbPî4»bØðw½ŠbH”¾¢Ó¾hz"”1ÝËý‡“•µ +\gŽ +³”¼§ÙD3“b!u/VS|<.d „Ñõ…“—°:Óç> Ä´=ÏÇW©ª—é1—ƒBD1J&ë ›”°CíhUºÌoôE9¢ýŒbê‰s]ÔJ¤wJlyTëd¼É‹ºmH‘©9¿úJÃý%ë87ŸCNûÒöõ†r`î%>Õ2¶¾)Ú¦‰q7ôúø7©b±òz›¯ó)iXçÝ¿¼~…î-+N)–Qiu¹y_Ž‰·Ê;WëìÈQzq8ùm‚ŽËKÁ\1M…ïÖn0?U[m +»ï ï¥Ú÷™‹— ër·×‡=[Ü“þtC ±&ªÌ)dCÖ¿P^ ¨ï:¡¬„Ò_¶hú ÀÏxT ¿§L?¦`î¹mo5šgB/ÐM2÷—ƒM{ÊËÁ =OÆ]Û*úã±ïûuÙ<ÎXºt®ÏõQt1w Ä‘¶šÊªxGÿM!¯èÝ,léƒÊ¤ø×r`ô‰ÝîÉEåæM»å;ÿÕ­lŠ-j®ŸdÔn·w’¸¡Â#›§ð»©|ļNäÆ3nXf\|Dæ톑IÝ(5÷wüÐEÕ +endstream endobj -3187 0 obj << +6383 0 obj << /Type /Page -/Contents 3188 0 R -/Resources 3186 0 R +/Contents 6384 0 R +/Resources 6382 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3185 0 R -/Annots [ 3191 0 R 3192 0 R ] +/Parent 6342 0 R >> endobj -3191 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [294.66 181.829 400.604 193.518] -/Subtype/Link/A<> +6385 0 obj << +/D [6383 0 R /XYZ 85.039 781.388 null] >> endobj -3192 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [366.309 100.534 485.694 112.223] -/Subtype/Link/A<> +2486 0 obj << +/D [6383 0 R /XYZ 85.039 761.463 null] >> endobj -3189 0 obj << -/D [3187 0 R /XYZ 85.039 781.388 null] +3034 0 obj << +/D [6383 0 R /XYZ 85.039 647.397 null] >> endobj -1010 0 obj << -/D [3187 0 R /XYZ 85.039 214.839 null] +2490 0 obj << +/D [6383 0 R /XYZ 85.039 534.44 null] >> endobj -3190 0 obj << -/D [3187 0 R /XYZ 85.039 196.171 null] +6386 0 obj << +/D [6383 0 R /XYZ 85.039 507.825 null] >> endobj -3186 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F70 2201 0 R /F18 2207 0 R /F20 1617 0 R /F56 1642 0 R >> -/XObject << /Im1 2193 0 R >> +2494 0 obj << +/D [6383 0 R /XYZ 85.039 263.788 null] +>> endobj +6387 0 obj << +/D [6383 0 R /XYZ 85.039 245.119 null] +>> endobj +6382 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F56 2890 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3195 0 obj << -/Length 2220 +6390 0 obj << +/Length 2748 /Filter /FlateDecode >> stream -xÚµX[oÛÈ~÷¯ö%Ô¢yE*ÝѦqâ­»± ´Ø]#rDqMr¸¼XVö·ï9sfF7ÊiQAÌáÌ™sùΕrüsQ`;þtF®íGÑ .ÎœA -'ŸÎ\EÿC{âŽñìÇùÙÅåĸŽ=u¦ƒùRÒÌ“Ÿ­Ÿgwó_‡#ß÷-ϱ‡£0Œ¬»a4¶f7´ûáöËåÕ§‡¯3ÜœG®uu;t­/x:¶.‡^dÝ*>~™]_#ßúmÝ̾ÌäÓG¸ó·á¯óŸ@òÈõí`<•ÈÓ‡ùg¸zõ¹É;gç;†ÜÈv\-ûýìç_AÖÿtæØþ4¬aíØît:(ÎÆÊñÕ{~vöÆÎƺÕàHSŒÜ©=õ‚>/´½Ð -6˜¨=8sa'Ø…Ðum0ȃÀ}×bM[ë¡ïXÿÔ À6 ­ûM¯jQf k3 %íwMV¦¸œX+¡ñÆ탹ßFÆ·§ã uòº-M:-ÐGCÿŠC}F^8#XØþ7Œài„ºAO¬öìÚÞÄýÏ F1ý{¡·cp¯l0Ø ­E5D—¡ÝðÇ< }£–ŒÛ܉\«Ã„wÒYΉ`½ÊbŒù‘ÄÈ•ô‚EØ5Ï:Š$å±® Š„H*àZ›¡Z´¼Pµ‚žO(ŽKf•ÌÀ‘7¶ßßËÃv €f†Ä§À[ ðo³VjŒÃ‰õ‹8÷ˆ‚+º³ÍD  »t1a-[%(+é°Ù”C nJq,¨$OÛ•"GËì…vûá/Ž;–Û=g§º9Òž»§)[HAZÎ:)ž—ˆA›Å„¸p#}Ï« Ù‰çYC,˜¢ŸÝ]ÑBªŠWªJzYÔ-OˆVÚ•þ®U+zQ(¤äÊb’vÞcUÓň -y%0^X÷"G˜ê î€ÎëóÝÃ?鈕„’_gÒRÔãE¶+ÖÒaU <|F—$\2ž ×ñ,• -•[ÕQIâO,[^c¸²XÙ‚'—RÉN²HuBHÀ­,$1å+3ó…üKÎVÉ+oòÒ%:\ÔÔ$¨2V8u°Lç“q²oé§ -•sz£|äô²’ -·Õ[¸|q±l1mÊ4DÉs[JJ/ªcÿ"GP¦V÷+¬ Íµ‹;ç+GPñJÈ$àÓ7ê„.åt)f9½7&[1ŸQ¿µj4†×´yŠþZ0²›Õ8°®–tºA‰¢£—Z;ïwä’Õ\ 3>¢j³ëeŸI¸N-ò®#ü80ÆR¢f)“¯TîÔ-:2*¢å´uó#‘(3Ÿ÷|„®:Fx¶¤§²óŽà#¥V‰×¥L_”½h é•gê(ÇZaRsR¥Œå&H_ҳ鲡*øŽÔŽÜ(ZÚAÿe%“IÆMr(ZAC¥tMoÍF·i#ÜQl²f+€Ò‰*MÁË„LšªìßaJW¶ÑÒcfOQs¹Ð¨§cïÿÞ¦×Tt¨„!-›VZÊ°ÈÊ2qqéï20ÑŸÚN0–Ìn+,`nàà³X¤eöoßz¶2QqUˆ¤ÃÅ5«õB.Ež‹uóVÂSZäâPÚز¾è ºƒÊãH¦QIœjΚ$KeãÇW(]b×TîX— «÷yeO»,Ε]«ÔÌA+ªTîʧR¬KõÒ@¼³÷Øïpö¸Ìê¦}TÅZªœˆò}¤¨Z ß2Ö©…9D4¡zî‡6ŒâûÅ´9À¨P÷k¡Vw³›G C„ÄøŸ*RÏzsÚ 8TòN)?´D«}¨ ÓÖóçLtÍI›îp$Ù’rÑ’å¹r‹Ÿöu @M4ìczlg`¼…%¶ÀÍ›x}1²Åa°|¿dYþ½Buy »äë×,|œÁ§ÞüöïD¼ÒéQ -Å{Áy¹W®€oxÛ7Ìáü–•­*]{qÔ´€˜Agß=„±’.Ê|#¸“±ú=‚*2<×é ðÂD¥ aão•S˜±g›Ó]× ¼Þ3Å>éñR$Vëdq<ôu•Vj $W™¤ÎtÏu“›îïÍÓ] ®;Ý\®y–®ÈŸâü}>‰W ÁêÄ.õ€òîÀ¬7n‡¡–ÃñÌO)T4Ö÷[ƒÁs+²*ŽYyÌr"AÚAHtU*ªàÖÕva‚h;JÕâ7·oÓÈÛ®éý°bêêç•.:Ôêmó×`eŠü­i÷½ñfìÓÃWU£G23‘mÞéƼXðº9L€ã†ÃèñçRàÚ‘3àìnOÂðÄïúÀÿöë·EÆ€ùêG•; u'¶?ÓטVðOºæP¦endstream -endobj -3194 0 obj << +xÚ­YmoÛ8þž_a`?œŒ«QÔkû^³Ûì¦Û^â^€ë…bɶ[ôJr]ãpÿýæ…TdYqrè¡HÅ—áp8œyf8–#þÉQW%£(–BÅñh¶>sG ˜ùåLŠ‰!™thÞLÏÎý‘tEâ&£éü‘O ü@¦Ùgçïï.>N/oÆ¥”£<1žDQìÜŽ¥s7–R:ãX9SžžàÇw¦ï.¹Tïß\ððÝ%tßpûâí{è\'Òùý +ɦ7Øf°œ†?Ààï†ß‡×ã/Ó_Ï.§íyZIAöóçÙç/î(ƒƒÿzæ +•Ä£´]!az}§¯Luv{ö–Ïù#^5¤»@Å"ˆÕ±òTÐQžôá'þ( +\¸>iï§ñ$ð'ËëYUlšB—¯yäöîbÊ­¢æo³ÌÍTº¾O¹y—ßsã"[%7§Z¯7?ÕfI½Kný!•ºÁ'Ï•X9"¸N£™l¦Ëy±ØVfý^o«£Íë¼ú–WÂîÊß­ÝðêE{Â^e>3òY6º2#‰+¹±+še_œyúMWEcöÜYuÜWzW£l]Ú….f]µ öo“‘±<˜`¡<éºÎß…;fPëÙCÞ|möØÈ Î×M•§ë»´èq.õ±ðº\í¿Î+½fC¹Ò³tµÔõÐQà:ªC¾•ÖC„|™àXnÐ’žoëê¼¾/Êó'µÒ‹¯ºü:O‹™ +-þ«YýéöòæêíÀª¬¨ÓûU~p†}^夫u>ôpâügÙu¥I(¼üM¹Â#"{£Ñ:|7Ghȱ8)„9zìÅÎ7üÏŒçßáE6@º‚½™¸®ql c4™[~è<Î$OväñÜD„Q%]îÆn¬±žà®%»/€[™V{d9ËÔˆÁ"ç¨O§ä¹x?KÍx´(Å:@œ‰ç£\ñúÛ[/ð…ÀwÍ=Û*ŸáŽ® ³G,‡÷¥r®`sÏw4ƒ‰¬hX›1tbú"dQ{ Q{ 8~‹1ÂkcíŠÕŠ[xµ¹b‚<¼t + DÚ›‰ɘqÍcR˜&ã†l¾sÀ®>æx2t)/’În‰+f(çG\‡ü2jå‚ÖJÙyh›¿Ô¼ÔXØÓ†gÿp¥oÍ RóÝÀ”áhgÀ3y,ŒÒ¡4KO2ꢜc¯Z§/ ‰7âA$mA–ÏSTÞjØg­)t]±ëÌ5îK6$Œ7ØáYpMzm¸wÝjtûGê}ÍV¹¦…iÅ6Íl±´6…ä|ÇFëE“Ð![ë2­òóCO E=Ë•ž à™U ü•" ÍŸ´„YCfï µ™nWc:#Ί"ÖÚ6&,Ûº(ÜiÐJ0b·Ï­©™˜ ÞÝ“ê‡<ÕS !ZçÐë/9´ìÚEÌ;zÑsŠôx,n$k~f +Äxx´RØXGaØlx1Û"S¤ü° K4ÊÄs®æ<¶G“ÑÛ–€ƺ5÷zh€ÜÑ3ˆ3î¹S’ÕOPŠO¼‡í AàjìPQ$åֆѶZ¬ãž“®V6vxÍyÆÔ슾ߊ|‡-ß™åU“vmÍZ"Ölì5“é9SXç– tתuIf€ä=¬€ÓzÀ©û¨\ΤèK Ä7:Œ®2ñ-ÎÁ– C4OgÅ +0´ à5ªÀx Ìߣ¤M£K» Gl=Z:’Ù£+7„`Ëš` ɳ¾|ì:HY’¯MNX±OjÜ,VœfâõC´Uå¯Ù=<·ã‘Ö7Þ}@ò÷—N®Â4¯†XÏÌüítœ ‹€UO‘Û§Ûn¾a½ã?¯.„D%/äñ幸EÀ<ŒnÞðl£º`N­ÖÑ&QíèŠüÌaaf(¥Fçàämp ;“­ya ”ÜTߨgé2@“Ö² BU, ¨y„!·6ËŠzàìB8D»'OÍØkX Âu{p š »py‹–éL‘5.¸CH¤ÜÁ—Ì;2è ªå_vHh´FL’†‡ ¥/‚Äƃj âiP®o/RÄ=VG¾Ä©—šÌH‰—À(…ÒÏ·Öca®m(p™©H(xï\3G‚5æG>HÖ»`†Ž(‰: ¶œøǾŸœaù€ú6NÒð1zàhQRž†ÀˆlÛð[r¥peòÃXø±™ÿåúÃ*H\@à`c²’C§¹}GÜn°2+þ3°væ?Þ\qqD:X™æ„Ï€L—ã2ü‹8äX>»á ™ýp9†Ïã¨ÿB? +$µ'T`y'«m*¡|R$DuÒJz`•žð#.)OHRa¡-ÀÜ-Ÿm+NJÃEÇc ~§<Ò,+½],ÍôíSu2ȵ„ô“Ó²>Ò¬‡©¨•UElÔך²à(¤¬GE͈ôŸÿ8Aþß}œã gO4’ñBû€Ü6Ü_šÔŒèm* MFÔAoÔý¤ˆvÅ53`}mi³[›úQ—ÞGØ`ša­c CÉ×BãxMUÔÍê”oÔàGXDCö÷)fWqè¼Ë«œg("î®ù8(-g¹?Æe蘜†êW˜60b 2$î™Îîþ>%ÚíP"ùN´l‘W\;N¨ßs2–æ‰k_JÚ1x“.•I¹éÁ„D”Ï’àv$o¶î’X&ô§†Ë\Sˆ²·Á’rñºoÆÖü¼(a¬íØÒL:D†ìÁóÓ[Nx^yäâRùBªÓÛ1É3»Á»/ˆƒƒÝŠÒ>š´}<úTðæªF^¢Íûr«„w~N D'”`ˆP,ïI%œÚÎ*áänV Ýy™WTî¢2·½†lnÖΤ¨¬Œ ˆ¨Å·qbçÚÔP­ÁÅën›7†n~ê”>±ò©7yY×+S;ÍÿäƤÄgµ¾nbšYº7µz–Pg¹œpQ½W§‚§7P¡£šG¦gç›töy}^7Û²ÌWö+fåüd}BpIÇÉ›ÙÑòMnêÈ“‡|ÿ<éÆ‹Xŧ­Cô´±Y" +sOÛÉ팱ÞÍ[w7„îni²WTjÈ+q{NøhÇ4é?ÿBŽÛ"vö¤ÆÂDxqòŒÆ‰NhÌáü'5vj;«±“»Yuv«›´ê¢8Eܲ=ÿêñ5cdÆ7/²Ø¬÷ÛPëžw­&«ŽOw«jí/?õj0•9Þ”[æ=iE&‚.zFF!…ýacÞÖ^ôXôÁG`:³UU˜ r|c$2»Gb³ÜTi×z=祩G¡@ERD+^>ø»&]>NT CqÓ1K=éÿ~Ù牚X6ͦ~}~¾ÞãP¯ÍÏa]I q…„°'IÏ -ÍÑþ‡O‚'Në©LÆÊä(ÁµI.…†žÂch«MUÈ­+ªðrT±¾Û—Ì&1ƒ&ö>Ö+(ë)Íï$Ýjqa’˜í†ŠôOdÞ®ðþXìúñºÍÞáA«'<<¯ñ¤•…ð7ðûòÚ¹þ/νendstream +endobj +6389 0 obj << /Type /Page -/Contents 3195 0 R -/Resources 3193 0 R +/Contents 6390 0 R +/Resources 6388 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3185 0 R ->> endobj -3196 0 obj << -/D [3194 0 R /XYZ 85.039 781.388 null] ->> endobj -1014 0 obj << -/D [3194 0 R /XYZ 85.039 761.463 null] +/Parent 6342 0 R +/Annots [ 6397 0 R ] >> endobj -3197 0 obj << -/D [3194 0 R /XYZ 85.039 741.134 null] +6397 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [370.786 98.123 475.868 110.115] +/Subtype/Link/A<> >> endobj -3193 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +6391 0 obj << +/D [6389 0 R /XYZ 85.039 781.388 null] >> endobj -3200 0 obj << -/Length 1719 -/Filter /FlateDecode ->> -stream -xÚåXÛnÛF}×W( -P@¸â.ïAÔuíÄí¸±òP¤AS´Äš·”eÿ}粤$›vŒiš ár/3³3gæ %Çü•ãÀ–Žý@ -;Æq>²Æ Xy3’züó…'\ûm6šzj,-ZáxvE{fóOÆþÛ½³ÙÁ‡‰iÛ¶¡,11}?0Î&cìðìþûÓã7?ìáälbJãèýD§¸ê‡ïµ€ýƒÓÙ‡½ããI`òÔÉÞénysg~Ÿ|ž½ͦ´…ë„d­~œ½…£Gû(ý83:˜m]Ì”°¤Â›}}úlçpûw#KØa0^ÃØ2 ÇùÈqQ­ß³Ñùè^ ¯9c>5à@Ó±BaáØ´-GÚî€#_-Û¶z9®×kÑDùe$Êz1¥Ñ´M¢\,Û<{ýbbºÊ5®ÊšqDmZ,ø-âÇ'yXÕå|·n‹Šù=Y‹ô¦—Ô.Ó¦—ðw·; -ªU]•MÒIU¾°B–jýÐ~Þ&Õ2)XÜqT,¢&¹æ·Wü¸)ë¬,~-’6¹­ê¤i yé5 -œÊm7šžP¾ ®—»6é˜-€çà ³¬D”¬Ó±ÀÙÀˆj' œ8 ܡJ Hà—R8*è᢬¸@–T*|˜p(Ö¶…ЯqXNÀõœ±q~WÄKô“ŽT›²`¸ì—Æt±ªL¸kÌ×ÆB%Ÿ´>Žï< ö=Píø`]—%mœ{%ÀÑ9ãÃß;¤`[ÐÛC%=BæS¼ÀúžÉjê9¬v’.êÍdö×™,|ÈdáöǬÇl–‰UM¬ÅV‡þ‹…²mKx°j´â®ÐÃ=$.W(°÷»‰K}q…š¸à™Sˆ´éWu™w¾ vzPîÕ¸w…Ì~p`K¾ ¡fÉmzñ®j¦ -Z†žÉð8¦7§pŒ>ŒpË9ø á“ Ó>6 *Ç×áÞ{$¢°&í²3Ø7ðñ¦B¶Œ>¯ð`ŒEÈ~'ŽB…œð0åØ*Àð¦#©Q´öëNŒ èá›ÎJ8R$7=?k)€¯¾yÛŽ‰p¥Ý;ç&ãñ"Ô«:!í/±e—ò nλî±O:’¯;mmÙãì»u°¬ÐQöiuµa@Îÿµp‡´>Õÿÿ»Â÷ œ‡¡p,ç‘ß{âÿŽ_élÌÍMÄ %IÏ»o(t'¶ç0—uþ£ a>endstream -endobj -3199 0 obj << -/Type /Page -/Contents 3200 0 R -/Resources 3198 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3185 0 R +2498 0 obj << +/D [6389 0 R /XYZ 85.039 364.301 null] >> endobj -3201 0 obj << -/D [3199 0 R /XYZ 85.039 781.388 null] +6392 0 obj << +/D [6389 0 R /XYZ 85.039 343.104 null] >> endobj -1018 0 obj << -/D [3199 0 R /XYZ 85.039 612.769 null] +6393 0 obj << +/D [6389 0 R /XYZ 85.039 289.111 null] >> endobj -3202 0 obj << -/D [3199 0 R /XYZ 85.039 592.174 null] +6394 0 obj << +/D [6389 0 R /XYZ 85.039 275.561 null] >> endobj -1022 0 obj << -/D [3199 0 R /XYZ 85.039 363.837 null] +6395 0 obj << +/D [6389 0 R /XYZ 85.039 196.388 null] >> endobj -3203 0 obj << -/D [3199 0 R /XYZ 85.039 341.121 null] +6396 0 obj << +/D [6389 0 R /XYZ 85.039 180.111 null] >> endobj -3198 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F20 1617 0 R >> +6388 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F56 2890 0 R /F20 2865 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3206 0 obj << -/Length 1821 +6400 0 obj << +/Length 3389 /Filter /FlateDecode >> stream -xÚ½XYoÛ8~÷¯0P,*µ"Š:ØoŽ6m“f÷aÑ-ɶ®$×éþúƒRìXu‚v»‘œá\~ñZð'†kZ2ú0e £|` @y9šþ}ÓÒþœŽÎ<{(,3´ÂátN<Óø£qüjr5=}?K) Û2Gcߌ«Qà“ ^=~wyvþòÃû .NGcaœ¿ ã©Žq6²ãp|z9}?yûvHão^º˜\Nåå)ì9}ž¾Íc!M× É¢~˜¾‚­çÇ(}OìœN·‹À´„ž}|ül cðþõÀ2e 70¶L†Ã|ศGêy6¸üÕ‰aš3ä]=·cš¡íöñؾiû8 °nØ…Ú¶zB Ñ&8d› îªYWèh±ò<»´ UO½Áa9’ †˜ŽËâ“%œïRM -¬eñ0@ãÖ*Û¶8hv`:þ}†·ÇìÉhlÛ¶Q“Æ|³—ä}– =jM†ª³ŒHó²ââÏóüF¶e>×òó‘í3X^©š”mb¦ ¨¢nT–X) ŸcùƪBÒבëB(FEaiAh¨"95ÚO»hŽãs´$˾ñl*}£\Ñ¢j’ø¬û ©ˆ™aƒÙšàØE—ë4nWÌ€&5Çxӕ–î PªDeù£D>µ€ÜÆÑxGû€ý«ëƃ½·àcË^$•@ÍÃÑð&C§O“NËVÔLFèÐO\EH. ™¨ ƒØûN7àã€ß/¾q‘FðT)çZÓ$jRmî^Y=I«ö•¢ÑŽg\w/Ÿ¯x­¢ö7 áyMN®ùtp!ÅÈ`Ûß>´`m®*àíÁo¥“ÂéVÉ^غi ELJàFuF)æ,’Ø`&”H¼Õò×m (¸ÈîºÂòà(áASàEæ^ÑkFHÈù½_!»æë'~«“þ6¢,aÂó÷^õ¤ž³[ÿTöendstream -endobj -3205 0 obj << +xÚ­ËrÛFò®¯`å²`Uc^xø&ËNœÔÆÊÚÜò!É"!eP@H´ÿ~û5 @‚Ôn²åJ8ÓÓ3ÓÓïnHÍ"ø§f© #“Í’T…&Mg«íU4{€•¯”`,e1Ày³¼zõClg* +³(›-ïç¸Ð:3[® nÞ_ÿº|÷q¾0ÆF‡óE’¤Á§¹ +>Ï•RÁõ<5Á’—øcƒåûwû3ü^$èû £¹CùÁ=F¡¥å2"3Q¸ eED*z•·^ßaùiG÷"Çžª~'\òê]°³ÀD W㕈±-òŠG¾Úš0Âï{<Ñ9;[–r…< +Þu/bF “&¡±³"B¬,G „·‚ðq?y1À>G'"eâ|‡šúúÕ«ý~Ï +'bðzjäy…«âGIvQêtLòQ ”Ë„ƒ„†Çwù`kÈ"´z9é0. ]O&¨IBp”œ=‡vEp<úøœ…§ +Ãa¨ïKô(ñHÂ8Ú£8Ìzš`F]“W7{ò\Þâ,$(*ÆsgÂ[2e1‘ƒ1=âð8¼úi«go v6"˜Ï] f¤#µBm2s©#ÅN"ð>}²á²`…Ž=0Iˆ£çÜkÆBG¨[O²¼,ÙRb†·'ŸÅbKë‚|F#67¤Ò¢X%‚·e7´.Àe¥“b‰ÓtÍŽ¯F?D_G Ö$:ɶ-µ8'“:Ž£i”ÿ¶O5Ç03ñªÌNÈaǾì6Í“ çøjð5ø$«\¯yŒøŽŽz) ƒdmYi8Øzs…CŸ A¨PBDAkÿ†¡ŠJzÐk˜€c½FŸTQF¸ßñFâ9ðú¡Ejø¥`´½;¸ƒúbf ìñ6º ª&žAh ó’x@*.óÚS’;Iô ‰éîÀQ‚ù5ñš¤ŸfèÖ:íõs‘Oh°²¡Š|tsqùž©9¨ÂÙ;Êå„XÅ^ñÈZÀÍéÌßòVöÕMÇQ c*=½eÍKyÍñaÌņؿ~Z§83ŸœéxÄ–¢~.Û¦†´;qÓ XP[e³?üî}¸‚Ç-úêð¯û|xZ¨s`û!xçKU™M Ôµñå*ÒÆ—ÕXðGãñrŒËØMŽ!P'Gȼs²>¯ŠmÛF„**Ô—x¢B¸$þ\ʹ³ù¢…Hoã—8{@ºÀYAz‰³—.ôœ=ºoš³ƒû®ç‘çœÒÅNŠ¹ÓšLT"˜¥f[ÿlÏslXPìÜù"Ï™iŠ<– ,¨}Ô.Ö”ÕHjkn4:Ò÷]¸8Å»®ƒC;ˆzP-É-}!tÚ@ãöÑeAƒg Mœ^ôé¼ =Ò ‚¾x¡úø¾IAï{[<°%ÜNH×Axísc/ݯ½XINv,RÎ Y¤zd6–ÚäÁq¥®¾ñ¨ïù¥–Ú.­ô8¿Ã]û’Bàr‚âk´»a +©£„*ß2©EËFLi0càƒ¥_g˜KÌ^1$Ce·Âë0Œ-g¦ðÛ`YÎ(Ô9Ê¥¨3[¥a{»8ç©LF={‹uÙQ–ýÀ‡¥Õt7i:’(û"ÕüKú[Ëj&|1Ž‰„%¾ð¿}í÷5ý5Sw€NBzdÕH0/©ÅÖ»O2×%åìßû€Wxg]˜`Æy1fPýa™†Ìvƒ—âª*N‚ äñ§”¤îjŸ2s¨#}ÒÞeñ¨²»¾ïÀ&Ø6ÿâ‹SVßo< ëk È9§µ³G\ÇûþÎ\Jý”/bE%t½¾ãÕoˆÙ<ÉÍÞâ´OÏO—gÙà´;° Ib»‚› ¿v‚ßàãì„ß õuÿ=ù}H©ŽÎ‚Ó]“¡ÂoeÉÈvh51€¬y_î¨l‹z.ôŽä#lH ã·#>°‹BEìÛ”.nY<¬ÄœMᔆò7Ž³‘FÇT¿•ÆÔ¿ø/K$Á>×€RX³$/4 ´MBË ¶/*‹s½')ÈÛ´ôžTÙ,ã~Óp|¦÷¤.ôžŸï=•‡Æ¦½'­c°´*+„:â׎»¾¿À_r¸-‚+›¢zÄz”h‰G5 FSÆ KíîÙ QoòÕ†GdÞT(ç¾ S0Û‰b…zNJ÷d-Ov%m£Äƒ­b¯ù…W{‡=¶ÛȆiâýåû^c§ZbÀaëƒ\E>î _CÝ7¹ƒUßï@5Ùc|R¶6(wÑ“ _ûŒÉ‚A­s¶30PÔ¿®ö£Æ@öl ¨Ëßk•Óaê^è (‹¡gÜpÒø´Éñ«qëKNl°"Aªq¶;á:Ôærw`€s¾; À¨²ØŒR+AІD·ê‚?`^$üV>Ù Îââ(¿ÄJ»MÞ˜DFLoû(ž•öÞ–TžK (…ÎÁgf¼ó‘¾ÊT¼°î» +‚yGÔŽ7:rî)Ú!üŸ?|ŠýŸû +6a`I˜$Þhnè{%&?Z„Qú4>ÆP¶ŸääGltþ.“„Yª|·®·ejkÐUÔe™¼ÎQ;î4ý!Ž÷µËÄúÉž"ùMbâá!Ä}¹ãî/£7Œ2jÉJÄd')ШdäšÅkŸº˜C¿K|']=—ú$NZËdœ“qo8ëI)£t §ÕΞ’d–†Ú™‘(#.wMfŽŒï”¹‰õIªãŸ$é? T$3~Š±–ÓPü†a͈=GÎS“Ç>ûÙ?ÓŸ¾-UôÝkRsèV.)i +;>Ÿ4+ƒ|ßÞ=ØHjÔ&ǹæV Y±çù®ÿn@ÀªìÐ*øÚ1r'gIËO áø-»Wµªï¬'X¡¡´ŒS/©O˜Õ™‰Œ× qh>E@û´|¥Šô@3ü+ 0òqÅÔ”p€ÿOÈt¯ÙŒ{w‚©ù¯däS>lÀ@ËHð&³½àš¸5®ÆŸd»b†ždƒ¶5o– 0mêÃMlÌ ÓÒæˆÚÊ9]n:Ñ¥‰à5µžŒªðóóoýÙ¡=nÂÔœùS*qO+O fçN>gƒ¸Ôœü4<^}endstream +endobj +6399 0 obj << /Type /Page -/Contents 3206 0 R -/Resources 3204 0 R +/Contents 6400 0 R +/Resources 6398 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3185 0 R +/Parent 6406 0 R +/Annots [ 6403 0 R ] >> endobj -3207 0 obj << -/D [3205 0 R /XYZ 85.039 781.388 null] +6403 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [386.344 644.891 509.276 657.792] +/Subtype/Link/A<> >> endobj -1026 0 obj << -/D [3205 0 R /XYZ 85.039 761.463 null] +6401 0 obj << +/D [6399 0 R /XYZ 85.039 781.388 null] >> endobj -3208 0 obj << -/D [3205 0 R /XYZ 85.039 741.337 null] +2502 0 obj << +/D [6399 0 R /XYZ 85.039 761.463 null] >> endobj -1030 0 obj << -/D [3205 0 R /XYZ 85.039 513 null] +6402 0 obj << +/D [6399 0 R /XYZ 85.039 741.134 null] >> endobj -3209 0 obj << -/D [3205 0 R /XYZ 85.039 490.285 null] +2506 0 obj << +/D [6399 0 R /XYZ 85.039 473.996 null] >> endobj -1034 0 obj << -/D [3205 0 R /XYZ 85.039 260.773 null] +6404 0 obj << +/D [6399 0 R /XYZ 85.039 455.327 null] >> endobj -3210 0 obj << -/D [3205 0 R /XYZ 85.039 232.037 null] +2510 0 obj << +/D [6399 0 R /XYZ 85.039 152.856 null] >> endobj -3204 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R >> +6405 0 obj << +/D [6399 0 R /XYZ 85.039 134.187 null] +>> endobj +6398 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F72 3966 0 R /F18 3969 0 R /F73 3992 0 R /F35 2880 0 R /F14 2895 0 R /F66 3242 0 R >> +/XObject << /Im2 4150 0 R /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3213 0 obj << -/Length 2094 +6409 0 obj << +/Length 3335 /Filter /FlateDecode >> stream -xÚÅYK“âF¾ó+8ŠˆE¨T*=áƒÞž6ÂnÖ±ã9©h´#$,‰¡ù÷›/ Û‡£ªGfÖW™Yù Õ܃?5ëédÅÊÕq<Ïö3oþ;fJ(£]0žØ\ö»ËÐw½ š¢ñ#×ô|énâÅ÷ëÙêÅ÷æ¾ç†¡ž¯·D¹Î?9¾rKc<çµK³/ ­œtS.”cKFÎ//¯<Ø×ðõœ|±TΑÚÅçõ³®/ÐäÜIÜl+7ÒO«ÈM´V«ƒð0AçcÕ5K9ù1늺B¨¡“V2çIVW¿z*À•·c“ÕÜKß’§úT® ýž2s冓1¼×tSe >ß×N›î~älRœúŽv½À(† N…ôx€É&±S70ìZÙà 헅 /ÆÁ4Žr~õŒ÷KÑtG”UòA/Eiyôzn;»Çëâ5´%œ’#G v„MÐhàEÎ+Š/èm¦ÀÙ ]춭ER„Ç2ªÎ§±¿YRÇ ]Í_ ‚ÅŒ9…µÛY €ªxgJ4S9Ø#až™P)G™À°RÖiÎldtE^‹ƒ7õ•³Þíø’AB·”;&mÀ…b.„‹_Q1¶iy--Kt;y,q8œ†8é4\$¨i׋"SXž -ྒྷrí¸K¸k¼C“ ø8»8l7vk½uH`=q¹örºû7¬Äipá¾KÄÃÇbþ»ˆ5ÂwL)êåŒÊÃ9+‹h·zS²¶¼ˆZ©y(:Aïg¯.úzY™°$>%T…ˆlwi3öW¨Å†Ö ;:¾§¤óI»ûCA’™o¾œ¸zZ¡Î# ’Ñu¿Ð5e©¨ø›àÉš xª…ŸàËÐê„L)šø¼`{Á"Å.ø¢ò§ùcæ×ò0˜ž›Ý÷nmà1¬wöÌ’²#rƒ_kyfæÝ•ynƒZàS¬Ü cUu#e\…‚ô--ª:v>üëß+V -Ê>¾óêà¦0þøóG¤ÿÏC¿Z“_!1D†Öò€b8isÿÊÈp'klÚyHOG³Sˆ€¶ ?#3§H¯ûSäýg]]Æ#å”ä±0;aì³î‘û>j£W§b«G.t ßKù%rŒƒŠ–¿˜W/&å—²½Š%É|ÝJp© „¹ÿÙ¬cž«œd oɼ'çžv¨>’“zq|¼²®éÓR1ø1B­¯ Ó˜4õžfB‚o:ívÕå`QñVÔ£Iüý ⢈­GÏ+$ýºCsæ%¼½1tûá Düq€)”hÑà@ý%Žø(º~ãAŠ‡”2–ÄÕöQ5 -JUV%&„¥YÙàOc³þÅÒ ´¡yCOç6¢1ð\/"E×O""þ”ó¢ûLbŒâjðò:!žîm0¾q¾åÏwÈ€šÄÉ*O»”‡yèºzébv a¾{BòF$¨7äˆW<(eÕÕ+‚ì¶õÍ2ÎJ‹÷‚O €†ŠÇ^‰<۩ĽiêSûøæa,cÏüP”sôÙÙÉ4È‹E4¦!¦qÀ£a×óSñ–ó£å³ÄÂFZ~M6Ã@Øܸùð±¹äA—@r¡¤ÉŽ„þ¶—¸!'•Èú/j0¢ƒ'RáÆý%aw[Ë)¯×%leiŃ!"2Up9sr(jâQô»˜¤“lŸŠà]Ô–݈Î? ðb¨í܇u»V1¤žvÆ•ÿ»…?t†‚#µ;VZ‰}ßk”Cqòg[ ÐHìé§@µ›ñPå&ø´o*§oÝèmý)(CGã¹& žw4ßÁ­);0Õq•¤ƒÛêš×(D9`Bëu<ÕöHtÛŒ‡ø]ÒU©ÃaH¶iVP­Ñqí eæd(føç³uYÖHp**aì=¬¯­èÅLE“á¹Ã™oòà•óÍ­ŽIûвšI+p¹xZÿÆ (1?U<×.›Up‚Pÿ%CÏ\A _åEËÅ1&ðŠÓX÷wÊ *eÅ׳ÄZ1hÕ®h“ -@H*ëQ©ûtð—€ûü*—óÊaÀeÍùd5*õ‡biuÄIIµö—ÕКÊåPZ~w1€‡ôSJàùO# \ÝÿcÆ—@-ã݉a E¦„™ßfŸ>{óŽüqæ¹2ë Æž«’d¾Ÿad32+g¯³Ÿ²óÌt”K7ˆÔˆræ¹µè÷€¥önS#¯õ{—lÄ•pAF¤Úóû~F’W/áø,eáí}nê¾Ò¿ ±"Ýp5~ÕÉÁº}'4öÐõ RQŠvð°\.”¢à¼:ˆv­¤îP¨àº2ÇÆRÔtW˜¶çvè0Ά µä¸uB—µôS ÌúU®”ù¸•ÓOçaŸËìU+IyÝóA9.x•B~ÓQHo hît…ì±F:Y¬&RÁ¥½ Æ€]’[\õæ}[kFue@×z“L9ô¦·Êè9§T¦QÙ»b9 -Ò^ŠŠDÖ©Ï`E×Ùž©î™…hJ½AßíÀ>ã<”…c ýTK6ƒ‘ÐQ7\Êÿ‰ÊÏ#{íû"ÖÀ6Ò.Âäb1ó¬nF¿MNTC"ŠWùWñú>!ÅÆ~/ë¨0¾=Ã× sóÿ„þûgÄßýendstream -endobj -3212 0 obj << +xÚ¥ZY“Û6~Ÿ_1T•Å%žû6vœMRñ±™©‡l8"Gb™"’²ìýõÛHPUÙÚJÅÂÑh }|hŽºà?uŸF~`²û$U¾IÓûÍþ.¸ßÂÌ?î”P¬…díм}ºûÛqx¯? ²û§×‰O䇑¹*~÷Þýôðùéýo«µ1Æ3Ú_­“$õWÊ{^)¥¼‡Uj¼'ž^ãOè=ýôžûHõðáí?¿‡î[n?üð:?¯ÖÊûø3’=ý†m`Ëiø ~~Ÿ>ýºúãé—»÷O£<ãIáì +óçÝï÷þË]à›,½?A;ðLïï@? +ôë»Ç»Ž¬x.¼çU×tg)Ö*ó3ÝÖo¬ü06£~5Ì*?‹"Ô¯RÚ7Jß'QàGAH +*„AµQxŸ» +zÍ€J(»TÇÞc‰Ýa )lnû%„©¯’ìö':£ŠϨ3‚3>á%·«µµ—ÿ;P†Ž³dŒ·9vpº®lV:õ†ú;OnÚ„0³=veÁƒ$¬˜šÄ­{sqàõÕþ0.®« }ánÛðï°ãE¸ëáíºæ‰ÚíJ'ÞI(_`à8 ¼PAw ÜÊyž®¤­Ô%¨h­ðžYdÙ&ø'ýd~N°wì@+&ðÚ™,:»=^>So’ Ʋú©êw²¬%=®µ +}è™:Û¨>‘›†9 ›Ï’Dã¦dàhóª6–5x³ÕÀîä‰R‚W \Ûž²Í$h3HÓZn»kêÕ&õ“$»v›aÞÒnQôB½V9ya%ªñ¾H7FëÅé5S£XG"a?ïìˆøTò›’hzž]6Súa-Xî†l!µÎdóY•iâë +`ÃChoÓ•t·ØÎù§)OÜ8àÍWÖ–@Ya¬aöÛÀÓy/7wÂÂqàÐÄ^¿Lv„âÔbW®66¤i¹Z{¬TýMü$°N'ñL,—N1E.±x)2#RJ4¿TŒW´ø*’$"ŽR`€ðĆ &ßËÒöÕNMìÎl7`ÍŠx¢ìØË`ÿA너 »4Ìtc÷Ÿ<FÛf¶å¥fN|Dgš5Il5K¹êªf×v­k>ntòÒZlŒoÂÛiÍ¡YN½1Äï0P³Ô›Hê}²åñy•i@#™"h#ÏÕò•! s»vHá}óÍrî²ÔOƒ„k'¡ž2]w &ùLÆ^y~4~Dp¦'pÓ(AWp»â<€”«`hWÖl…b…0ô¡Út-X!Û.Œ~iÆ$[—ŶÌ_êißÆÉ­-zû—+©5/ö±«~èò¡í8¶ÑAà—Œ’l½dKBK(D ˜ï‘7†…œOÕ°ã•9ÿs”èŽ{#7‚_ò0m7Xk³úwœ—u®õ¤4­¼C¾•Q +Ã- +úµc|Ïs9ÿ 4xO5¯}%)5Šrê*IXBi¯M¯…ó7½òTC-;WðcÔó{ía¨öU?…BÅ‘IÔþJ²G¢œ…_‡a€æÁѤê™Û©¢Àʼ¶¯GÞ.GéÙ +)ŽÀXõÊ¿.P¦DslUÀqÓîé •˜”VNŸNeÉ­=¥öE5ÐN¶ç˜cwYÄrpä/Àbj1%‚ÃT[2q:?Nçî¿ó$EJ +¾ÍÖ »|àÙ}>’†LEV‚ÿŒ{‘æ,ÐÑ©–+ qpf¼Ó®ª§c“úp‡wtû=€¡KA§HÊ®”ûÒ ¹½XcåÈÉ'놡“Gp¡ƒùËâÒk,¸Ž±´Ÿ›‡ß|ï—©AhÓµ+HÂææ€ÇÉ~ðЉãCÐ. Ç¿tŸ(˜EQ¯yLÏW€Ë¡µMo9ä|!랊Üh‚F‘xáfzmFäÍW@[å(â÷ùmØDN—ÁSNŒÅ]Š‘ý¨:kŠÐ[¼Æ‰_Žá,PCìÀóÎ"‘нÐ',1ÝŽ¤ ´ŽQ¦Àe%8N›äóøºÃ¢.M ‘£œ¦¥!ï‡ +M[ò9:ÖC·,Q‡©÷B9xl÷‡ó\ÕYŒ^!äÊ•ãñ#ÞQ$1‘@HÛ¸"Ÿí–yr–çŸ?>r«·rX­Èf‡œ²[µ±ìÉGÏKó+уãJ`/Þ>ÛM´ø;¶Fœ~uä5-ÓLlH×èɾ +HºÞ© Ä6Λ üÄÇÁV6jìoÉ 7"@wJ5ÈÜæÚ+¾¬§‡­ãNå79[Ob °`¤i‰Ð *ûv/NHa¬æ-Á^vá%|"˜›ØСY°¡Æ’€™ØôÀùp´Q^¿Ÿ»"~Y8¼Jµ¾]8th–«É28o:(|.õx˜žÛG¡{ÌìWÈÈ#¯@3”Å´ˆ|Ë¿„’HA´ê,DjŠœ%ɸb€Ü –\;É&ÖoÑÂqu[ó8 ¤·>J‡t£é¥…y¹‡,‡‰u8©’±ô 2:’Ž£·`Û†­L ¯ôYè úp~ ™{?q`¯ýJÆÙ6{qbžƒ`ýw0“XŠ ßH¡ü8¼”­i¯x#i‡¿/{qám8KÕ…àÚfÚ-%j +u:¡ª¡s95Õ ª(v=ÞG›¤`* …$¹ðÏùghÌãØÜv-Å" A€µ +®)qr²Â-^.ÒÃyFO´36 œH$?í>0üÒ<‰n„|86&Š×©¢³ã©¡š¥·­ÏwöÐó&X7dÊg¾ƒÑ²qzŠÜ2àVïr2°WSྼs7ñé„PNÜ·/2 ªNK]b.˜ôè`ÌAb±/Û+f{š. ‰Éá3smZE7ƒðæºòB¯»ò4¹ãÔ+‹K(ºbDpE^>=ëz|ÙòÈ”dœ÷é€j”j vâû6˜0™û¤-*ð̯ò$fÔ‰)J^©‹ÞõkÞc‘ƒQÁt’ &(Q×Ñuqn|£àÌG¡sìGÄ„,0Œ‚áÀá8(A·0‚ „>™»,Äi2J&ƒ«Ÿï@ z ‡Uò”! [”Ý<³÷ˆöéì¾Æ^QÅnȹÀâ5¿Øå{ƒ«Åš”NB_%·³¦C³œÒu ¿‘ž¥ôì<¥ÿ«Â—+Uno's~ “ÛÇšh–“¹ŽD¶ +…åífp츉ûãKç +©Äpnæª?…i$äŠ%6¿VNŒ9g"ï¬12`“z¯™½ãÄ‡Ø È~ÿÂ%”ˇf˜ú&µtŽÑЙ)”ê(¢²†40†ìà“G*ù±DáÌZôvƒÈ¬©E•‚ËÙŠµ0P'½+.5.>t¹¦âXÐ}ßò°-ÿB“=¸dnùœ-£Ý¾z‘º9Òoë– …Ê×:®ºå«.C&K™ïùEÇß( ¥?ŽËJ|µw?]nñ±Ê2ÿM«uh–IáÇë0ž9\þ™7±õýi…ß{¨²[ðÌ»Vvþ’§©ÔøJß®÷:4Ëž¦âÐO#å &üL±Òü^ƒ;›ûˆ„Ò€Ë@¶ Åô“c¦\ÌÃßœÉ8®BfÄ9ëŠX­$lùÕÖ‘…SÊDò™Ë§Ê)®É…ÛätçôULgjö5Œ“à5ÌY”9¤„¯«(öØþ V…ü¡€ŽÄÀÏ©¾ë8² ‡ž2N'†ÇИ{œÚb÷…í“ÇHÓõõjré5û’ìì¸:á_‘ñ¡¯!Ô‰’ÚTã>^.ÐÇ&oÆǨ“Ú*›çœró¬–î+gÕ£ÚÁl¹¬:?¡‘k)[O¥õc?>6ppÃÀæ8BÌE°òì~ÜÕ€¾IwÛ­ÅZjÛ8E^ÓI±KµØf݉„ƒm6­­.Xhããýçy’ã,¶v[Ž¥YÍZÃ߃­íä°|¥ÑÖ…P¹ÚZ‚/9U¿C6²é£%ò¤±¥ñp¶lÁ]2Ñ‚G±NA)ª/› RVyæO{¨_T®,¨d,ï9Æñ,m¦Ð´;»U„6ÿ\­Ñ SgÛÔR¨üŸdà?È?Ngo*kÊcøøƒUå”Ô®}¯=j,öU—±Í5Äsû1& +façì'2™Á_NÜcɇ‡ŽÀ[¸äø1Ͷ™¾·„&•'qH^Êöï®Èúá‘Ýï™êeò'/R;ìm½÷¬0ØsÁäz3¯¯~Y…ÿyÛÿëï«œò–Ÿš…¿:Š´öµ²g¡ÜÅççLêG©¹<ð!×lõendstream +endobj +6408 0 obj << /Type /Page -/Contents 3213 0 R -/Resources 3211 0 R +/Contents 6409 0 R +/Resources 6407 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3185 0 R +/Parent 6406 0 R >> endobj -3214 0 obj << -/D [3212 0 R /XYZ 85.039 781.388 null] +6410 0 obj << +/D [6408 0 R /XYZ 85.039 781.388 null] >> endobj -1038 0 obj << -/D [3212 0 R /XYZ 85.039 761.463 null] +2514 0 obj << +/D [6408 0 R /XYZ 85.039 761.463 null] >> endobj -3215 0 obj << -/D [3212 0 R /XYZ 85.039 672.697 null] +6411 0 obj << +/D [6408 0 R /XYZ 85.039 741.134 null] >> endobj -1042 0 obj << -/D [3212 0 R /XYZ 85.039 672.697 null] +2518 0 obj << +/D [6408 0 R /XYZ 85.039 633.349 null] >> endobj -3216 0 obj << -/D [3212 0 R /XYZ 85.039 641.171 null] +6412 0 obj << +/D [6408 0 R /XYZ 85.039 612.356 null] >> endobj -1046 0 obj << -/D [3212 0 R /XYZ 85.039 311.511 null] +2522 0 obj << +/D [6408 0 R /XYZ 85.039 431.773 null] >> endobj -3217 0 obj << -/D [3212 0 R /XYZ 85.039 284.896 null] +6413 0 obj << +/D [6408 0 R /XYZ 85.039 411.183 null] >> endobj -1050 0 obj << -/D [3212 0 R /XYZ 85.039 284.896 null] +2526 0 obj << +/D [6408 0 R /XYZ 85.039 274.178 null] >> endobj -3218 0 obj << -/D [3212 0 R /XYZ 85.039 263.903 null] +6414 0 obj << +/D [6408 0 R /XYZ 85.039 252.982 null] >> endobj -1054 0 obj << -/D [3212 0 R /XYZ 85.039 136.227 null] +2530 0 obj << +/D [6408 0 R /XYZ 85.039 197.272 null] >> endobj -3219 0 obj << -/D [3212 0 R /XYZ 85.039 117.961 null] +6415 0 obj << +/D [6408 0 R /XYZ 85.039 176.076 null] >> endobj -3211 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R /F65 2099 0 R >> +6407 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3222 0 obj << -/Length 2021 +6418 0 obj << +/Length 232 /Filter /FlateDecode >> stream -xÚíZKsãƾóWð°Ê˜Å¼ðØ›¬•üÈ:v,f“*Ûˆ„DX Á v•_Ÿ~ @ ¹»Z)»TZµPè(ü,ÍÞfMš¢EÍ@ûü‡qœ“/ÂEJîáîÉ«lÖ”Õ_þ¸žø*òˆQTäõþS*…z‡Oñ”ÔÒرÏAúàLÙäSL ð—VÄÒüOñ?¯2^BðUß -€â@p?Šñ£¨"$ŸŒ"QÇGP”‘“”GaÜÞýhEÇOQƒ€t1zÆÝÕŸ»dŸ.û+Æûi¢’m/q×µs‚^œØ%„["?ëO`Š?¸›¨?¿›àdϘtè2ý×åÕr)”\4ðÖ¼·f ùž¹ý–-¨¯ÌI¹1üŸö¶3À5 -Q‚ýòhPdþuŽÐGÖ+ò;ª†ð*ò–%øFìa͹)2T6ÒÞ?áj‘­˜×¦¦ÒFàh@úà¦fU`ñ²ºã™YZ¨¸væBj"=WK嫺ÉRǧ¼áÿk2NÖ¯ÅçmØh-H-‡C?æ®Ð>k¼²jZËuƒ -@•6Ø>ø\mûV‰08¸Ñ±Ûê¾s¼Üß ^ -ö{Fò§CC‹ð`XÐüi¹ìàïÖFÄF=³lðí×t(r&°tà•uΠaòa°Oƒ}Ö»»¤n‡9LöÄ ²ËïþõÃÅ>©cØb<+aeøàçx‡€e]ë¦Êº„ðö—ê“"28ûÜçwŸUœ¤9·í«b#aCóô¸©XØD½DÜãk¶r3[ì+a Â5ñÓC5%VÎ/±öhÈ–é‡+©ÿÐÛî@¨ÉPÇíñ‘&ãø%Ò[öaVlæC¼¬ÐÏQŒ(ˆß—bä9 E`õ3«0Ï«Ùaç=½ŸÐÆÊ—|üx?Y•÷¼=Vý„‰cûôÐ…™VÔ¦Ñqx²q EÜëœlX×°XeMÚ¤ÅݱvEpJ  - 0³mUÝ“CWm;bÓmü¿‚k`GOçH%±¿€ë|‘¥5¿ ‰mìKŸnŶœ›vÓ¾êz|3nôñ¶:]b3á…ðJÛ‰êØëK a½H+× ¶Þjv{Ô„åÖG[góû‰m»,¨qzËwpãaVRcx Õ‘†‡ñÊb{Z´U¯vMûúбpÒöû¸‚É#Õ æû1ÎVb^n[‘õê/nv–Vía7ŒÊM»B§%«ÛݶŒ8C+¬‹ìM‰OsÝ6wøpô®þŠÉ~ÇE‡?Mpã+kÍè ¶s½ÔÜuGéžö•£Ýº£ óË… >ž…Of-k†S› -ötTò†i°3ÅguëëdaX›•ìUiËè  QPCÆè‰\ä®å…“eÅÿÜu#bhhz› ÞÃ`pmA×W㶠b>ïzjs¶ºiJ<âÆŽâðOf€#l!´RžL{Øï—;iÏÀ®&ÜK{Ô¢5‰÷5¸Äï'¢‚{¾éÚô5/¤÷)e÷±@á¹2¬fï­Uö¸Œ šY}Ú/¦ 4²6Ò¥•™;G„‰>¾¬ªQ˜Ép­ØIƒL†SŸ6@ ¦½¼6Ž 1Qñ°û¨ÆÃììè»ìŒ‹U¹o›Ì ˆƒ»;€©kâTÖÃ}è-×ÞŸ"KrmNÆåx\­ªŒ»p}\ ­²:Ÿg<Î0RÏérE+½d„çï®%vhê†\¦ÊUÖræ7M鸶éªlPç~ l‰[ð,>s0r—~€ëC?}íu°)é#¬*!x³j7óïYØ,Þô:pÔ;úa&Eú÷îš>'" @ì±$><úªú -—\SÈ|’…R¹›Åƒžýƒ6§×ô‰Æ(ΞðCG ìÜÀkè†ÿ·gpA6â7K°,”]nŠ9“n3¬çË5GÏýOKþîŒÛš=oœ…1Vœp³Õ¬…Ò€8úêx&–„‡O±>òIħ}œ¥#Ø®÷?¯8qš&ƒÊ÷Ž{íºÿ`‚cendstream +xÚu;O1 „ûý)“"Æ8ö$@¢¢ˆhÏé`¥ãøÿx¹e%N‹ÒDšñø“C{äªJs¥H­îñ}@·5år Ù‘T@S²ÿŠÕÈR¡¥Õ„8/‰šÌk–MÎ.#ä,®¿8.˜Ô)h«®?Ýúë äßB”\ü „»~uMPj™F£fQƒiPI~F{hä÷ã×Ãîù3 ‘ühèÇÃÛÇvJÎû‚8¦Ì–°Z-^”ÿ¨ÿVnKSëE Û„+(M> endobj -3223 0 obj << -/D [3221 0 R /XYZ 85.039 781.388 null] ->> endobj -3224 0 obj << -/D [3221 0 R /XYZ 85.039 758.673 null] ->> endobj -3225 0 obj << -/D [3221 0 R /XYZ 257.152 764.647 null] ->> endobj -1058 0 obj << -/D [3221 0 R /XYZ 85.039 619.462 null] ->> endobj -3226 0 obj << -/D [3221 0 R /XYZ 85.039 599.133 null] ->> endobj -1062 0 obj << -/D [3221 0 R /XYZ 85.039 360.311 null] ->> endobj -3227 0 obj << -/D [3221 0 R /XYZ 85.039 341.439 null] +/Parent 6406 0 R >> endobj -1066 0 obj << -/D [3221 0 R /XYZ 85.039 223.65 null] +6419 0 obj << +/D [6417 0 R /XYZ 85.039 781.388 null] >> endobj -3228 0 obj << -/D [3221 0 R /XYZ 85.039 197.036 null] +2534 0 obj << +/D [6417 0 R /XYZ 85.039 542.44 null] >> endobj -3220 0 obj << -/Font << /F62 1689 0 R /F56 1642 0 R /F15 1628 0 R /F20 1617 0 R >> +6416 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3232 0 obj << -/Length 1608 +6422 0 obj << +/Length 2419 /Filter /FlateDecode >> stream -xÚÅMo›Hôî_aõ„¥2 ô–¶I·ÝTí&nµRÛÃÆ6ª .3Äõö·ïûlÇv¢j÷°Š†÷5ïû=Âaá0KD óaš…BfÙ°X ‚á0o¡£†±& ¢^Nã«I4 ‘ùp:#’iùÅ{õÛÅÇéåÍÈ—RzQ(F~šfÞí(ô¦£Lz£(ó^üÐû@/ñt}ÉÔŸ¯tËç÷^8¾›¾\N´ðcO$ªñcðå[0,AÓwƒ@È<nàˆ0χ«AœH‘ÄÒ½/·ƒ?vR™ëŒ±~OᇹȣäM”Š(•@^Hò_"À…Iý®ìA$Ià½VVÝ¡õÊT_Øé;éÁS7GHò}DÂäLD>Ý\¿8åb’§½l„´s‡ºyòä9Y k×/ÆãÍf# -c„UÛeÓvB—Ýøo Çj¥Ûq‰¦)£gf\Õ¥þ)Ö‹õ±2šˆ8 Ï[çË8$£b ò§í{¹=¦"ŒÂ'­;+é²…PTf`ì]ƒ5ðºÂéöøŠI(‚àHýÇ dúizE;«óväG“Ü[(¬‹{ü§’^Ñje5^^"Iæ)†÷E‚\«ž™WvZ:¾Íµ.FQê-˜ªZ­¬Ñ5Þa +¦˜)äi—[~-2š¹¬“ ê”~S/èȾa¼ÔI·¥ƒÏ†:j5 …ìÃØ{kAFÓ-Ë8Ð U=TÓ®”­šaÒ›axP7$Pü \Q¡ ‡3hPÑÌÖ°[´¼> —qçY@vh²jI=â€Ày®kÝB¶ ÅÁ[7h‰Â€«dy¶Á§ôÔ…5ˆÙ0o¨@AI:¡t`_0󑉆{‘wd’Aìu}tɼ_ƒ$€<žW¨7Üîô)Ùåhû¼fZp/9œÏ j2WuõWUÏ™çýGimMÈÔŽ¢‘-IØšVî$EF7u9)ŽL&Þ³ ¼ÈVÆÙógŒ~vÛ Ü9Kø]o7ÈKJ•†‰OÛ‚3 -~ØTƒ« 1 4ö° ð*C>(\š ™ZSŠW丵²gb‰~Ž”Gc»ò H9 ámãÒªÅ÷à4/‘¨W‡½e f’Š* â…b§Þtá¸Êj—èØ-_@L1]a;GCœ*ÓkÚ´hžÁtb² óÔDÐ5Å–Í­¯²†®C•fGä{ã™jáæ" -Ã:DØùNŠY­«ÝÖVžÛ²*KÛ„dáÁtÔ89t´YÐbì¢7Sï{±n˜·ïškî]Mk ï÷#X} 4]£¹ÛeLÝ:`¿+¢ðÊÁVªâ~­¨{>jÛ"Øgnh[]äûi«‘ð…‘ÁFœAyçÆÙ¯ø}¹ü‡ïg ßXÙ¯•^˜§…-ä$~X×ÿ«ï¹endstream -endobj -3231 0 obj << +xÚ¥koãÆñ»…/¥€hÍ}ð .Éåêàz½Æj‚âzh‰² ó¡Ô9þ÷W¤%ùІÍÝÙÙÙÙyÏZ/BøÑ‹4R¡ÍIª•MÓŦ¾ +÷°òîJ †‹¬Šœƒñ™ÅÕ¸ºŠ +]rGÎX%:SÖiÄùa}uý³ &TqlëÝBk£¬6‹8sÊY·Xo?Öªå*ŠÂ`ýP,W6N‚Û¼^êàn¹ÒAŽ8Ø<›Ç +€e†åçõ/Wo×þp9{¤z†½p±2VÙļÊ{œhÆfÊ»vp›xÆ;C›lä]#÷. nš¡k[l›¡l›KLÊöWù8â:ZèPea6ãä*Iâcý‚YÙ$þj"ª +žnPˆÀ‹Iƒ!/a¡¼œ?UÙïYlxˆu ŠF~5‰—Fµ.=2œÙÌÉ•²²¤®½C©ÝUϼöDRíËÀ÷ C[k +æSìsª-SËŠ÷è`âØòtÛò÷Íû÷< ½ˆƒç| Ž¿0D²Ý¨-jb[tr¨êvi’à©aÛq: ~_¦.=9^d41:©”…0†ŒÐMÞ;â%€+$ËôÑð[Q^~uæöG€·ü­F—@û¹¹,¶ €Ö”Øxr¾ÏQ%eUÄð¨÷0–ët(#Ô ÞI”Ðg›˜¼«üþ9,0m‘à“w¡ÿ-†78ËF!·ç<³Ú=ú5;~½ 3KêzYóÎÞµìêÇ]EWðp®9$TRÐn +J!K¬­Þ7/- äcÂt£”`%ù** lîeO ü" +óô¾Ó¨ žñ‹+ùcª=3»my½o+#t`ñkvÀÊ[ЩMB4ÒÑIQ5[P¸¡ ³A *Ä1¨&….¾}„Yb4Fº †ö†¿Ì^^VB/G'yö’Ð7]`@.Ÿˆo7èW¾én/zÔ$Ùkp£-Òê®­ª6¼å2CN–“ HK,urîlÑÁÍÏŽáF3>ŽQçPÉSFî8IòqýmœòGÉ®-;ÊÝœ2:颉ñå1”—÷ ÅBϵºP|¸4U&±¯œËEKŒrP)Id¤zÃn¿‡zEP‰‘8SñWª± Îå*ȹTiÍÎ@é Ë4^“ÅÛø}lr’ +I€ñQ¤  BB]Ô^Uvêi'_¡å² +vß.Ù­’€²(¯±Ê; ¦ Û@ÊIÿpóîö- ÿºÔe{û«l¶|Z~Æ&>þÈÆÀ•Y%•[»5 `áÇ÷7o?¬í±Å»?ˆ5óß‘îº~‹WY#ÉwÄÐû; þù“û¥°Ä•¼¯$N\jÔ…ó%G_Öe•w|(W”2ÎXZœ/xá¬Êãt¢r˜;Ö…6I¦-º•¤…ãùnB>=sVÅ#`ß3°v®¹´¥|=“ÀŽF‰ÙÃבǂ×QÈhϨ#”šÿRß!´ÒºlgUl¹±û4ÔûÏÄn¤“ÌXÞ´u]4`Õ‘‰‚ïù3õ¾íò»²*ú3·ÝçXÎLö]Ã9gðºÄF\˜Nv<'±}ŒÉÆ&ÊeÔ¾þqõés¸ØBÿå*T6KO0•†åúÊF™Š²XæÕÕíÕ?¦;ˆ5IõE2´)2<"ló‚Êjäi¥#XשÏ&X´VF,Ì&‰Š3àÜ`¦ã»hé©a,òçet gƆ8\ü±ÐàNYfg2&þ×"ÀõM­?µÀébÆ,Ó]MsêK§©/ŠU撅δrFKÄ5|¢å±‰Âé9ð—¢ëñ­‚&V…80lù«Ü‹A Þ̱ɴâw^S Ëý¡ +l$œn±?5+°\®›í±ˆQÂ*G@ˆè¸ZJÅÜ´Ò¥Ò½þäw‹IþâÞ)tT»úþÆú[ö'e‘K´Š@ªãøßM ­Ygࣸíÿ´þ¹ÝZ}é-È@í& SÌJß6äh .‹ÀÝ%â$Ç(6H€Ù…Œ&à2G} "ºÅ1K²“¤Œš+¨>¿ó0B}žDB]A‘½(¹Ü{Èà‹ý +ñ@–0TtvAÍô¸-¹?Ó\G–¸ +h;4o“&Ì/½ñ¤É¬Œ&@?V]b&ùÙ¾R¡S¿‚óÆû]ç[dê£è T8Á'ŠN±©¥Ž'üXPÐç‘A¯³xó‘±®ýÓÂËxÌ {ØqãPJ ~Õ‰ÜQ©ô’kéF=Œ‰‹¨ûïPìYð·Ü§ÐXj"bM¯"Æ•Ä™¤´ëbØ\ÐÔ^JY¤¢DÐQbb¬66è´ä&¼g O¹à_<ÁÎ{B)º0|\x?ô¯]¹ ÈiÕøª5>eB!åâ[Ö›ªoñù#2ܬ¹dRº”š[üúÞÆ/º¨¼~úpË{OZ@ÏIqq-†íÚîH7÷ÞPQb ÞS÷̦ˆ Ñ¿övåBçÅ0€s ‡Ú—æ. _3 ZJM_­ˆ"~izjxVÇÁ€|lóˆ‰Dñ„Hœ(Žå×_¸]Œï´íZ ?Ÿyú=~¨v?å;ÞxR%Ç.æ¼›4ƒ¨Wò1Ãh¢a¦Âd«ü³!QØà¦Çñ‘¶ìç¯òÊ„kÒ£î©Ø­Øók">Ö°> endobj -3235 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [141.013 726.489 469.456 738.481] -/Subtype/Link/A<> +6423 0 obj << +/D [6421 0 R /XYZ 85.039 781.388 null] >> endobj -3236 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [139.346 713.243 202.339 724.811] -/Subtype/Link/A<> +6424 0 obj << +/D [6421 0 R /XYZ 85.039 761.463 null] >> endobj -3238 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [141.013 527.64 309.095 539.633] -/Subtype/Link/A<> +2538 0 obj << +/D [6421 0 R /XYZ 85.039 761.463 null] >> endobj -3233 0 obj << -/D [3231 0 R /XYZ 85.039 781.388 null] +3035 0 obj << +/D [6421 0 R /XYZ 85.039 671.062 null] >> endobj -1070 0 obj << -/D [3231 0 R /XYZ 85.039 761.463 null] +2542 0 obj << +/D [6421 0 R /XYZ 85.039 671.062 null] >> endobj -3234 0 obj << -/D [3231 0 R /XYZ 85.039 743.459 null] +6425 0 obj << +/D [6421 0 R /XYZ 85.039 642.326 null] >> endobj -1074 0 obj << -/D [3231 0 R /XYZ 85.039 563.482 null] +2546 0 obj << +/D [6421 0 R /XYZ 85.039 488.273 null] >> endobj -3237 0 obj << -/D [3231 0 R /XYZ 85.039 544.61 null] +6426 0 obj << +/D [6421 0 R /XYZ 85.039 458.869 null] >> endobj -3230 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R >> +6420 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F56 2890 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3241 0 obj << -/Length 2552 +6429 0 obj << +/Length 3440 /Filter /FlateDecode >> stream -xÚ­koã6òûþŠýPˆI$õ(pd/—v , -4)Š¢íÚ–mmdÉäÍ÷ço^”d[Þ6@ "9ÃrÞC‡7ü…7©ñ•Ý$iè«4½YîÞ7€|ÿ. m”o´†ñpî ó8òLáD‰%êfi? ãýó»»Ç(¸‰?ŽÕÍóš0ŸW¿{QäÏæÆÞu۳Ы6³¹ŠÏòç#,˦nëuÇ+E k]3›F‹C‡Ã|…àØ{tëe>ûóùG`Ã爉ÝÓ±íòc2‰ÊW€ô‰„ÊÏB3–H¨}¥ã3‰„(yª¶kË®¨«öÚ‘‚¿Ð€2QÏX‡È"ó{Þ‚4 ¶kX¢(ॳBµ(aIðH†ÜñüÀ­q©aü‡5,´¸À×öM=‹Rï3rXå-ïµüÙ=[ñ.\!jkÞÙt@ÛØ®@¬ cuÛáXe½)–¶tJÑL3ºáç"œ,öj¤˜8U¨ÙDæÌ`Ä}ÅðUÑ0áÐ[v5 eŒJlmÇ“ƒ»jޘϛó%ÑÔ»ÑFØ%bu°p€SÛý%tté:(AYZ6w—Ë«:!B‰×äD«Æc6ËþAÌ"®pl`Ÿ Wn‡GyÅuóö~ë}èx§-KRx”x¯-ïÃkÖ ƒ·(¯Í6—©E¼Ï3#2#»(JÄèø²©òn1Ò|é_µn"dZP„Ýä—οìé€ÐjE2*k‹aX,lI8K(ΤÚË;ZBA?Î` ï ]Ýä<"›[×ÍŽÀí -†ŠáçëV¸69ïp~„wõ¹ +£ýÀ¤S!,ºPŠ€f#?ÿÇýX¸ûHxDÉÌ{¢( Cˆ«šNJ¨h;2Ï -Åßñ….bKªü¤+DFæúq|æŸêæy áz®¢˜O6|Ø k^&}SíK[ˆœvÛ[ãøè»…<Á#Ë»`4Ë#‰åÆ/H¶øº<øœ`[ˆµãŒbΈ™¬³¨¹åcÀÛ°ýÍåúã›.ËB.†çQšO¬ÀôšÁYò!&"èкh†žÐ9vˆ¸À t‚Ó3ú 3P£]H$ÃéÓÇ÷ó…m]ìVqê=<>ñ`MWƒÁÓˆ šlZ©+‰‰›ƒ„>•^ÑñŽWç5à•ÄÇy'Žÿ7‚ÎI¼íJ„‡àzß±OúWE÷Sï™HŠÊ@EÙáéŒ"=ÂêH>¸ Râîg;†ÄZÚŠ ²7¡¸³+ 1§_O‘YÌ¢ ¢Ã9"õ ¬õ€ñ¦¬ª®ìquéòÚ¹ƒ%"„8ñHÿoô|ö(ÄÙ²¦!Ü\T&ðÃÄLÊ"©®³ÙÛ†%ŽÒéP0È,–¾"`z÷¨ÆÛ¡²LM"4ÚÝÂãZ3Þ ú©­¯tÓÇ|`¼ßÈÎÌnÕ'¶bSQúÍ¢>ÞnÑ9ihÛˆÓ4.5¢úßFÌB^šÅ“ÙT)±Êû¬”9 Pù+Ÿj42¿T¼É| ™còF½Ÿh›Î0ÜçRù:T×”o2ýVå£N´òî™ïÃähŠÇ+šœ«›‰Y8•Upæx‘Â=]¯kE!qìÇ`Gc…8Uj"/ª—a†V©U …Œ -¥ Ùñ„ê>TâQø²wK!…GSë¶TÝÁŽ=ëÈà :Ö ƒ…juAZV¢°A”ü sOáúv¢Ž¡ &IçHyúì¬-)c¼Lø]ûAâüéÓ¡¢¾a.ˆéÑ„ÀÒ⿧<Øשîmnµn¿“â+ddðÚ2„™Ô±­&¨0yǼ4œ*õƒžgA\”Ù‹dp>X9«Ð¼j—”|u„1€¬(K£i¯6f”Œ÷ Kñ>õIkn øüu›ã™Œ>« ¨D†ˆÓ $OëØa;j9Yó¯Qm€0âµä]ðùÖ0ø„YÕÈ ƒRbÄ4œdžÄõžD(%…¨sȾ£C+N†'õ7»,Ú´vÒyðé÷ŠÊQ(D†€NבúãvÂX"­!ègÎZª K‘ØËu»SJSsjwá¹Ýé»ÃÂKª(Íü$M'£‹Š#)&û)¿„\:¥\À””O{a¼×‚+$*«äÕ¯Û ,9‡€PsnÊ0ØëÆV›áau“ù•´°âêRŠ4Ù”Fæ¦c²èŠ‚ ¸Zbþ³í|;¨ÖŠ¾OãÃ0¾"L -%´ó‚΋5î¿úÁ¨BæŠ qËŸ±˜‘ìItõ'bLA°Š´Žwø\ªzßÀA_ŠÐl]”ùwAøw.æþdÉ$ÛN£G•w‹3©ìNˆÿ‹?O÷ßßOPåŠ 1(žÂ}LÒo:æ.å »(ñƒLŽØWϲ·hm#öwÐ -×Mw›šš‹‚³ƒ{D&Œñn9Ç™Íc~KIö½èá9#`Öœªˆ¿3xî}¸£çM+4æf¹qõUJ)$Õæ0þíÎïBÁU€B/ ÕK+ª[2s Ï3³Àû \ïç@ѽ¯²‹OÞÄF”ë7‚ŒR?V±¤¥Äá;îG¢£Êªée6aëBèíݾû<›k­§Z³y’¤ÓÛŸßñÈ—™š¾úõõ+ì~ý7³¹šþãà ÎÝÎ~¿ýåêÝmGH·lš!\ýö{8YÅ¿\…ÎÒÉ#´Ã@Áôî +ȬÑÒß^}¹úW‡ŠçÌ„WÚê4°©>=µ²Þ©U¤ƒ(R“Ć û¦Í£(š– ~õôÎR๶и_fØ"ˆ¶âïg«=L”mUËœ,C ÛjÃÿ •Áå„®á±Õ¡Æ…{i‹'[l1‹Òé·q{‚(q?·è®@f_¿·±w¸(Mƒ$Í€x¬6/ùóÈÆÓù{üZ"íèšLl€aYÇ“g/JIlF¯iîpÍ=dt BMœ +„οdÕ¶8¡ dH©C£z†2`aš˜eû|'܈Ò\'q`ãh2W(›ÁÂ%Í#c¦9ºø{¸¸¼ÎÛ‚[D!Øu÷šoynÙIÝyµ¡2dÃC#e[ãÔòmëšï•lÂXW(;›;zó—ä¾»Y”pmÛò^d1·E½’á3éé€ '€¡þ¡?wÚB‡È[¾GFÍÊœ>@£ÓDÁqó=O,à“ÐIat ÕiX¹e6\áèO±Î™nž,;nµù‰ÈÛ²Ú7Hl@·§í@WT`"-ºr}hêëmµÌ·×M¾[ä×y=råJ8´•EÌŠ¹ÎlÅ)sÄÒÌ«mS½<¾Ð}Am$•X!WÄâ¬é¶vÜÙåK¼š;2…@0£È48Fá:ºáýŠñݵŒ;›tOÀUÃöcL«2Ê­² ‰RÇàðdÃU÷eaUÜ; +2¼Bg·ÐiàÑÑ•àá*G¯y¼\ó÷ çàpЉøn=¬ËRĈz+^„nJdÆF0í˜ê1Ÿb¬»Íf·–Õ~=rP“œ8²SnsËnðIæüè.ÿŠ]X§ÓäÚw9ñÆy\‚.Æ_Š†â”teÈšþ.Ò3{J9RðH†jûm*ò>Hh{×[Hç°@ÀuÿQ¾ÿÖ +'Â(0jÈ Ô\wÊ–o…N ßZpåѲ,4d™XÎårs±ØÞï38ÒÞÁ™¨# ›Ë’C® ‚Yð_&fe G‰µ RÐQ (°NÑÎUˆŠc$øÓð!ð.ÏÐ$¨.ÒÔÃMI40@B ?#šÞ–ù ´³¯pòùî&ŸPð©Å:ÌÍ‚„*M§E}L¨ÛÀfqÈQê`æÐX¤e·q‡ IU'—¥à´J_ÞŽAžÙMgýÙÁn7`Lw‘™É’˜²KLrùÄ@¥³Vˆ¦‘N‰MfÅÏÐBÁxÉÀ„Yéôy-·Ú¹¢}³:žÖ‡=oqÅneG„hë_ ‚M²SXC`‰¶Y§e @½‹Z£lG!Û/›BtËßšŒz:¥s· c`ÿÄ]HSWµÌ·]½g˜Ë&-²pƒF}—IK"ä 2lCXÉñ‹SFÖ'6øæÌ FûøEß› ˜ Ã¤f:"£"[43Óß„jPh<‘È)A©ˆÏ¢¡E! á–@³Ž¦¹I@ÍìÐ\(°ù–Ý„Ð(w‘˜ˆØð±rVê$Øvà `0 qNþ˜¨ 4Y¦Ækýý±hàúf§&o+ tâ+xçbVáÔWáÔ@j6±xs1_Ùñ>Î9ï@…gT+J‹Íº…÷obŽ½s'Â0ÐEVÚ$NPoÉ@Ža+†¤ˆæïcn9L€ª.¨,Úå xò銑•±@þ³~1„’Q€×íÉóI̺…ï8}J Nž”üy™Ó+2“9.ËþšsA?5ÊFFñe?cb´Ñe?ã€5Ñ9?ãa:ëg.ï&zçïöù@ÎvOCþ³¬HÀv9Fç8yï|ì¼¾ùé –O>Ï”RÓS͆ה0*Áó‰‹,šS*Ž‚[UÃÄ+”â7nÞ}¼õðxyûÃŽ<4ÊÊoØ1"ù:„oQUÉØ ÀìŽS .Ú£^ÓAš˜ódÓY8íŠGjŽo%Ù7BÂÐ?ðF Œ·o>]ß|âIN‡×¤Š”7®¼.°lF²Ò}… bªÅWÖµÛnÙR¦…†ÓÆb|¬(AO%{Î[îtî;åvË­½Ã†FQJCÍaL‹#9^¬ª†[÷pC÷¸ä… ¦ ’9É‹NDÉSji'hz#ckºXn‹Ät‘þIprS´ÜÈù³ãK"Òó`ozÙåV0|W5²¹PI»OF±GãEÙÕ:(?¯G7° }\E½·¿p£©Ö¾Hy$¡rÄ GiÆÖ7ÈH|3V@à…< Â7UáË"•œ)¤d¢=Ü‹"Efz#J‚Ó“Ë̉éå‚÷¢ÈE¥Y ¢aÕ¥KFÆÆeÅ9'C9uBÔÞÑ]H²E¼Ãyao±Y] Ï®9÷ŽÄäÀ­êÊVe’Í4–®ÔSzØ^òÂ…·édnMsØäþÄ0È£2ª +´=H¢l4$ÊÀf‰×*íN‰)Rñ HU£š1qœ º`?Ϫå®K ÀœF/Á¥Å/7Á«=+µ«Ò¼‘˜™ÖCÎ@aÄ©Tß;µ1* €¬÷À!ÅÁ'(uJ®cQsÍKz%ÀëÝhM…²½ó8$呺`%Ùnyù¨ê”ÆIìb-í$i+´ ÌB€Hž·.¶ù76ºthÙHf¹à‡VRLä¶h=Ü[P·Šh¤tã+Øg©™¥\ÖÁÁÑ—\âóªC¸æ.¿—ýÈl±ö\$7÷ØÓq|¹”ôÝ¥îGÇZ#NòÌ/älóî +)YÑ*üžÙÇr¥«t}(ITà›Ô>îäöü,„ýª¤&%)µ;§ÀhTÖˆ/_í8’ ’—ïø.ñö­:—ÂèËö/§0©³ú½Ñ$Ûìl2Õ2.f0†Tf¾7ƒ‰b ipüã3ñÙ d*H íGZ­ºBK'Šìò͇oÜ[• XdLÆT»æÑ’CéÜ÷ ÙI˜½&h]Ž² -Ó™éÞw1éœÔ²Å„?Ž§·¨4$‹âíð›óÇE²$ÑäºÐV°ÛŽÚŽ¦vˆìM!‹ª‡¢Þ2/*.ƒ®‚sÉŠ'^¼ÉJú#“•är²Š…ñå\E`¨¢x.UéñœÍT.n%êåmEyJ”†ýSeáíúE$Sƒ +ìr[ÝSÌÍ?ðw$ƒÁájd Î5Ø"ÌHºMð?ZâlpUÀl{‚0X=•a”O«9i\"b#rëø•PÓreù•¬˜mÚº+¿[M1~ùŠ¶”B7AׇÏÐáðäÜ÷ë_<²cŸâÔ½¬˜—9ùI]è…Tàˆáô¸/^çÈñ{"{«ÞO®^ðä0ÖÊK`d)è."XPȪÑ[ú1WäŲÇT3`.˽”¼C'iuÅ ¸ÁrÆŠ  ¦`u¤ +ë\Mçåb$©êÑÊí òFI˜=Gíq³§‘Í"ˆ³• ø]ö0ØT:M]5çaz¦•Ä°š¢>“JØ®B¹-%vŠ²P—ôRÑØÆA’|G¬^G=EA)?û¥Ã·#ØÜ ¨+çkngœœ•.«Ã1?w¯]!>¤Ç~ÿæ®`¥Æ€9xx¥öáQ„ÝœZâ£/“ƒƒäFÔÈ/ pð´¨­¢¾B«ù•}'‰V×”{>1`üî*_ö‡ æÄa¨Žù£âüsÒ«À$ö‚x'A–ÅcâMè/ˆ²ÍȵŸÁlÇQŸd¤&»¨"&ã-%x‚?üÈïÑ-M¡Þ‘®À¡©ly]ÿþ¢ÙP#Y„l9LÕàf@cöÅ’s­©?aªuhú'㤂F^7ºP¼U¨`EŒg§Ï”‰¬õg|õu±tºr‰N½r3t¸l³gÛÑ&\ÓÉXÚÜÿؤÿåC÷3£»’R=„[ù™×ëèÙ”ì +Í€÷ÏÅafÔ.ØkÒ3¨­lý‡wZíôæ½ß;a—Å HB,sZydÒæ|&Îè|øEG‘#:bì®òb×åæq&‡Ã¿éuvŠ'óÖÖ„dsð+ÂN_áBÍ5Sw,¤ÿ+/ë˜Áb¬,Y´è~K®ýÌ9@dÑ+É#]r(92ÕSxÄýà–böÑKE[úv &ÁM1æÅóüÜ›¹ƒ( 9áŸOð—~Ä×½qƒ£Nu6¸Ú( +"åh¡ÙfÇôºûüÃW²ÿendstream +endobj +6428 0 obj << /Type /Page -/Contents 3241 0 R -/Resources 3239 0 R +/Contents 6429 0 R +/Resources 6427 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3229 0 R -/Annots [ 3245 0 R 3246 0 R 3247 0 R 3248 0 R ] +/Parent 6406 0 R >> endobj -3245 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [465.374 560.105 512.306 571.795] -/Subtype/Link/A<> +6430 0 obj << +/D [6428 0 R /XYZ 85.039 781.388 null] >> endobj -3246 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 548.677 184.218 558.245] -/Subtype/Link/A<> +2550 0 obj << +/D [6428 0 R /XYZ 85.039 650.648 null] >> endobj -3247 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 478.81 163.483 490.499] -/Subtype/Link/A<> +6431 0 obj << +/D [6428 0 R /XYZ 85.039 624.034 null] >> endobj -3248 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [223.966 465.261 276.371 476.95] -/Subtype/Link/A<> +6432 0 obj << +/D [6428 0 R /XYZ 85.039 610.485 null] >> endobj -3242 0 obj << -/D [3240 0 R /XYZ 85.039 781.388 null] +6433 0 obj << +/D [6428 0 R /XYZ 85.039 469.804 null] >> endobj -1078 0 obj << -/D [3240 0 R /XYZ 85.039 761.463 null] +6434 0 obj << +/D [6428 0 R /XYZ 85.039 232.632 null] >> endobj -3243 0 obj << -/D [3240 0 R /XYZ 85.039 642.137 null] +6427 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F20 2865 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> +/ProcSet [ /PDF /Text ] >> endobj -1082 0 obj << -/D [3240 0 R /XYZ 85.039 642.137 null] +6437 0 obj << +/Length 3553 +/Filter /FlateDecode +>> +stream +xÚ­Ùrä¶ñ]_1ñËΤ<qñpU´‡c9ëÍfWI•Ëñ5CiXâ2ɱ4Ÿ>ÔPò±©--Fh ïƈE ÿÄ"3Q¬òEš‰HeÙb³?‹·0ò÷3a1Öe༾:;ÿ6Ñ Gyœ/®nÆuL¤Z\mZ¾ùîâãÕ»O«µRj©T´Z§i¶¼úîC>¯Äòâ‡×ØÓ€üúoVk±üÇûK»Zý|õýÙ»+Oˆß6Í‘Š_Î~ú9^lâïÏâHåÙâÚq$`xdDF+Û¯Ï>ŸýË/ÅczÁ³æ pØ%[¬%àHýÛÛ)%q~»x±q%*yvšÃ:ÜrèÓuÖBå‘ÉÌb$q¤åÈ‹T.„ˆrcBë(OÌ"Õi” MÌøЕx½åÓ{uèIn"©é¨‹_"Šuž+Æ Út€ñ`8¿Ü‹ÅÛ(]„ÄÚu×ÁÂD¬ÈÁ™Ž¤\¤®ÏH¢õs»/Wk-ôòßMd?bÇ,Ïñ£–ï«æà€zÙã‘ŽýPâwß3ðÐÓ!Ï¿•q¸“‘Q–$@nòX5å°e´ A +¨†+f¬ªáïaǺØX²Ú›™åA¤R“ûyó‹Kaá$,I¢Dä.eκ³+7w°hÆq%³e{è°§–ýêÎË[ ®]­msØ‹›¡@vWmÃ7„÷‡Ý +ÚµZ8t…ç£ï°£{$ùÚ ‘¶i›¡kkÀˆåò¿±Ð5ÑrÞ3äÆï€vèá%4:T›C]xDñ„SKd=ç¾fj¡Kÿ7N”ƒCÂòÌG¬½ÈaWõlo€#+™.ˆ$lu0ûŽ­O¸‡KH—eǸۢ¤[Ü*zª0:‘~Jø:­(.X˜µ7FÞÐL D¬F•3¡"X¤D'Q³±¾–+;Žqç–®{àNÁâTIÿ÷tõìÊ_ŽG=á ’¹¢ªË-£€,5¾.ÕýŠ[ÒÍìÎ-ƒÓQ¡éWà1D!lÊ òÜŠNŒ§¿f„ /ßÇÉNÿêÇU¦ð˜¸á3´¬½°O"Stvk’'½f‰ÁyŠÉ-ƒؾé*wìnëãWÓ3 8Ÿ½–$TŽ®½ÆK»®“-6$뇕U“rÊ©ÓãîH³ø(¸H“,‹ºÚ"0^Ҳힽ 2¹FÚšiu¶+Xñ†²ëghùÛ³¾Ââ×dEÐ}-0’oSðB}µ¯ê¢ãi$CQsï™Þ^רsˆúLËݬ6[0)_z5T¸Š2†I +\k@uF2‡î÷(|[#äò¢î[Ýà gÌOsÇ#£ýÂÕ6Þ$ Ù»el¢s(]×Äl÷U¨r2•Kœáï÷×H°õ"ÝÔ&ÊÀc0,&xY2à=Ì‘¸9ì?”0—©ÉE•]×v,025x£;lågÕ˜¯{ÍÖŽîˆ1<‰˜Pr›E‡¤º=ØE‘×UÇÒ9ÐnUéöÛ•ÙöîK‚»EÁ¤»¾I$E@êööÔé…ÊÀèèëpÙ;†’òˆ¹U>Vý]1%(:'<†Œ|è"äg¼|ЯËò£G«Tômc×Y¢ÁB¬IPee‰ ©cÐÞZ"^µ¼ ”úTÚiuplÛrSW¨ØAÊÁ9ö ð© ŽØ·_‘©ô}KfZ«ñn<0Xeo]ì,ÊíL Î'ùwmKà¾íJ¿Ú Z‹‘H[3 Ñ[»yª.¿KSrÈ4´×/¸‹µ°2_]Åçúff›užF`p K£Ü,O¸)˜`$xÙ¹õ7þ\¼*šÁ„¢®Û‡ÉŒÇÇÇ(ø;?gîçºBéFôª{q¦]°mê)?ÂÈéU¬E‰lzŽKŠŠÒ1Ô‹Á‡±‘nG÷¶ZË„œTkqþßk6v6Ù†žÛª”v#ö#Ûq7§ 8X8¹sB ЫX(Æv7o–‘t zz—ÅÍVËÄ ˆÆÞ“N…û+õŽÜPÓÊ +K²x­ÅÙ•Ü ð8E0›«ëÂ9¥ó÷CÙýmWö=¯(#À ZÃX¥×bèÃ6êðúõŒæp«'nûDÇ®hnKZC †.š ;shç¤"4ù~ÿ)é'8ÞÊïã·-#BÞPž@Üm5¿i‡™¥`¥§à¤Œ„DB¨ç½…u5Ô@ú|ðXûªŒŸR9¡Ý1Њ+Î ƒC²™\)УMh°œGFO"bŽðXNž|Ëc>2²R&lè¶ñ:X L%Èô׈Àqε1Î áÆi]iFó'ÆéMécÿ8§xQŠÍ†MCoûŒìsØ9“ÀI„öäž‚¤£‡v3²‰ÞõmM&…­Jí”d2Ý kjx¼cmä$#ÜslRújy‡N›‚h‡òìzV>•XF9†"ËÁ …‡P±s†ƒÙ ‘IÒ¬!¬{Aš3¥©yV˜UM‰¾wSùdgËѠ“hVƒ曨ÀÔ@ûÁéVßž»&Z>¬%o6ÖH•“ŠÖ›mŽ!Ã(¶h§-‡zÆ~¨P*kîxÿ†â?zÄtÆ®Íـќ#ÐiBšÄZØ/Èášv¥rb´±”(N%9ˆêµdÇ€ß×UÒ%‰xs‹Pç[öå°sé)â5Üûê##w”¶RµÍÍ'Ç,Ñ>ÐA)¯šËlŒ‰¤r¦V¨|Þ£]g 9Àbõ*ã&WÀ÷ó$[@j ×7¶\–ÊH‹dbѦ¶Ö™³•Zç¤Êöxî"ᦳqaS¹š(…]Ylœz!€BÀé[+ù;Ë%Kvgãc¼­n«nùUÏFÁ4WJh»»>ša/ýœæbL>O/ÝdQ–ª°Öø\”œX^ÎDɹ ƒ86f>tGwD¤ƒlo.& 6#>Mprö$8TpwRHCÎljµ Ô…±’1ptªÇc £­¶ìX +þÔd/„M΄bNzˆê¬•øËe‹0t´ŒaŠq ŠtAé:îsÙ¯µ±èµKä…ñº*‚L&Üd».—¶È t¬aÇÕÂNÙLj«Õ“0 a KºµÆªä5Ub☶¿ãeÄØ8ç‹©"ÕéÚb»aŸnçNâRmËæå0°FX •¸»j6m×ÆwNX?ÖcNŒÓ’ü™: +ŽŒ|’ÙР޼¡j0çŸvùxÃκüÈ|$ï§{>çÏk¼ý÷ƒ›37á$¥ûŒ>û: o­¤\þà¥;p`1 l5‘ñRU‰¹vçê#<Õٰíï1?³gMbìŠ~\gäUa§†Kòá,DÚó)ùLREiæ"ẽšýõödß3år!d¤„\ˆ¬Öük›CY83ek QºNÜ:¸±>ÝLéH¨÷bŒ—·²ò`«Orâ63D¾yR;EÿÝp-Ô%wTˆ„IkD|Í8¯±}ùwdù»O+QìðíóÓÓ£¨TGF¦ÁY~ãa ’éü³€ŠrÊn¾`  <Ž›—ïMe"JG’I—.PoèÌ')RB²¤ÿO'L¿ð„ZBZ™ˆ—O¨e¥#ÉüŒ·6‰Xº'âwïl{{¨­hÜ–ƒ `rØôp.l•YLN¦9©c…cèkpl,Lc/°C|ÎcŸ3æ*ÑåtîlÉu¾¸Ç¯5Øj&Õ}U–2.¡Ç8Wߪ|†ÃQmmg<*™å/>"Ö‘VÙïŠ| ¨ðqiu3Yz…Lp! `P‚°rŸ{î=VÊdžñ«†*†)žÌùX?V¶.¾I4„k2ô0&dÉÓ¸A\êÎ äÖö=´ñÑ S4_tQÛ{Æœ„è4*Tý“JÆYâz( ¾}j_UÌ4¥càÞUîža+»@ EbˆýéS-¦÷˜õüÒ Qß+¦{CácçXŒ›Qoæé Á\0ŒƒÂ¦<1ňG‘yS‚ˆÓÀ÷Á—Êkqâ¿>ƒŒ=”n„ž0cû4> + ¡àѶ)×¾ÊÑرÞÏ©îÆv…mó“ŽS»7èÙå–ò‡!Ó«ñBÚÏDIœ ÿïÈ)bÒÎ +ƒçvÏ-Î^òß {1ÿ„å>"½àÁ-Ògžuá/mç|ø‹»9'ìÖVjg®Ä›‘ôÄrH±Âù`ÌUîpê=#8wŽí D|óþò݇+¼úë+ï °ßï¨TÛÅý£ú„†ø맞ÛàNÀžV,rá"N”røÒ+x®ƒW|茖{Vˆ¹Åëlêªlœtå69hoVc`žÚçolŸÎþÈ¿ÛÂfÕ;ݦÞhöWT/·3òø.ÑÛJ¢±•6ÃÊL¡C9IE½3™Ì +Š©Ø¹míÌñY=)ú[”1.ÄìoxàŠÍ-¹N¸ÀÅ-ÓOÏ´mÇÌ®„¼„¶U—~|N“pI¿V7Þ~øÌhÖõhRÔÍ “… Šà[œ¦@2O8Hp,B¼gj®’™d×v.,ág¢4|&bø¾/Îÿ8OÅ‘ÌçTþø~¾èw{þ·ˆZE™ÊçõÞ@T)…£ù¡’ø)½Fe`Ô)ÁÿGeáendstream +endobj +6436 0 obj << +/Type /Page +/Contents 6437 0 R +/Resources 6435 0 R +/MediaBox [0 0 595.276 841.89] +/Parent 6406 0 R >> endobj -3244 0 obj << -/D [3240 0 R /XYZ 85.039 617.419 null] +6438 0 obj << +/D [6436 0 R /XYZ 85.039 781.388 null] >> endobj -3239 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F38 2158 0 R /F41 2104 0 R >> +6439 0 obj << +/D [6436 0 R /XYZ 85.039 210.005 null] +>> endobj +6440 0 obj << +/D [6436 0 R /XYZ 85.039 117.585 null] +>> endobj +6435 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F66 3242 0 R /F56 2890 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3251 0 obj << -/Length 1199 +6443 0 obj << +/Length 3989 /Filter /FlateDecode >> stream -xÚÍWKoÛ8¾ûWè¶2°bE‰Ô㘇ӦØ&»±ŠEÑöÀHr,Ø–²’œ ÿ~çAÉŽ«ôÒKQÔ$çÅáÌ73Št|ø'D ?L8‘"L'ßÍ|ç8ïgÒJÀÿXDR!ï<›½»ŠGú"õS'[‘LV|u/>œý-îæ^†nˆ¹ljûáv.Ýev}óžg¸(÷P¯çžt/îæAâÞ.á|{•1ór`"5»£íùçlqÉ&®®ÿZðù_–Ùâ³»…eà¥7óïÙGðÍ“¡Ð*%—gxñ9®)hNRÀÍðãií»7Mo=½×Zõvcà Nú$#¨sÅÚäÍ+hÞ|óe|zñ€Ê £ÈÒG6'»Æ¿Ïb,èu€†%ÔeYà.±‰M ¦1g6…ìóQiéájÅ«a1JùT5û¡x.‰»köc¢øZèZS{Cµ¡ÒCTq'JÕM´ï)S™…±+Iíà(³°q}ªr«Ãýçèp" öi*„}ß[)2Àëõ… UÇ+E ´ ÖA -]‘ïÇ‚ÝçÇnF˜?³æÉsQò5ùäuë¥ê‡ -,ys¢:@¼…cO¥Ãÿ}°z±oÇ^Ñ$E_Ù–àë"%ÐÚ’‚G3¨â®ˆ;j.¤bzÞí:†œ[`¡{ÙÙ¶ÍgÜšÝØ¢PbM(ÞlÂl·¼9ÔmíÜDJëM¤,7<ðÞNCÁTúÍZÆÕm'§iƒœþc­àæV é2°{¿ö-Æ0÷ǧþ¿2N=.¦ÁÁÿ\Ínendstream -endobj -3250 0 obj << +xÚ¥kã¶ñûþ +ã€âä"ÖJ$õ +йË%Ù´I®wn"Í­-ÛêÙ–#É{ÙßyQ¢lY¤8,L‘CÎp8oòÂYÿÂYùÎfIú:Mg«Ã]0ÛÂÈ·w¡@,dáÀ¼YÞÝ›YøYÍ–›~È7‘ž-×?{o¿ûêýò݇ùBkíiíÏI’zËïÞqÏÇyè}õÛ¯ðËð;ø~;_„Þßþþ€cËù/ËïïÞ-;B:€4C*~½ûù—`¶Š¿¿ |¥³ÏÐü†w@†-ßû»wÿè–â13ãYc›6*öU øijFaÂPù:TÀ™(ð£Àtœ #‡3¡ŠüØÄ3 „¬‰ýËÍ…Úø¡ž9+]£c°éÌÒh€íÃù8_“yíøZ@; +¼²º:ò㚇¹J½Ç}5_¨Ä«>OÜ¿qÅó^ÿù5ÌÆÕʆ»Ûò Æe¤×Òhëg>n-!Òßä\É‚7ÈØ-ìÎ'#ê;¢Mà YOeuF´*œßâ–ãÅñú¹„9„>K*sîŸG\·Ê׫¼ieb%¿ö57Coü¼·Xq&ôGqë=äë5QNÄ6¨ aâäe¼#òë ÃÀÿ(Aǫ þjïGêlß<üô‘îùgùöýýÃ{n#±s¤‘ÙGþeŽ#º¢E„ŸYUü'îoì‰Vçýš»j»ß…»¥ˆvÔ€tÀ2°|è­¿ø¸¾‡vWáf¶;Ðë ´F¥Æ³'u9ε©@æ†ø²*ž9ðNQì'*’‰Õ‰ +Œ\Xhú€Ó52å‘×ÐCêÇQ&k4‡GU7#¸LÑJ,p$z°_pwdnÉTѱC'»B©ÿ¡ÙÒY<$§_óšY­b<ì^‰Ã_à@záGp +¹Wlí„ö7Ÿü‡ ï:V~`¢88Áμç°H§ÖBcËÝ|àµ(6÷××d÷ñ·Ó5˜ß;ÛnÜë#º.dš•zúø\’A†V·‰BÈ ¾Âï¹"1B½x£Aì9|ŠA€_ÞLË0Î +Ûü õȃ÷i’¬Ôîò–[ä;¨GPïß +xsÆ•aßþ’­ò‚2ý³µÓ°õëýÕªóG‘"ko“8”þíÏRÅê’åp`+ò‰¿HZòÚÈÐð…‘¡>U³I¬%ºîØ´j}Thð(øPl@bF­Šóå»K Úùüt!®!d³ŠÛbÙƒÃëhV"ã(1¾Ž_ˆž ÛѳBB“[Ñó$:‰ž§±Iôìb£èY©C(va3‹è£²v–C2¬tû²w[0Ò2èýý›‡o?bºóa†¡÷¯wî—? žû ÐÅ´p_(²ÈŽ'ÄŽ.`DÊ(>®§ôóú€7†”…$øsÊÙxQÄ^Õk ob +o û€¹ôÐuî.ûºÚ—Kò +aá—ƒPŒW,¡çyÏèÌÕýºûj»ÝS)ÓÉáÕë;¶Ïx@åoìÕ˜Q$¹¿ñ0ø9´5Ž?l®§]!~ä‰H[< j«1T:Ó”ò£›æÐ\‚tÔï‰Hc¸+üÛ-Ñr«ê̾›CH+K&8 „õ0XP¾=t(4Ò/?L +ap_v&Ùµ·_‚¨@vÔ89Ëj_²­ë=Üß?¢.l‡në¾=œØÄð¾þ‹Ç¸#­’ôZÑEAƒÈWʼ\ЬŒ¯TÛ€áÖ*4'€U¸…ÀÑå" KÒ„ÙÀ²$ +ì Ÿa,–Å?‹#ˆJÀá'\ ù±âØ8Ù§7±¯!>€5g¿ÎBˆ²L3ŒÓ&úû]QÇýÃ!œ}]¥3—XYwá,Ìf0uÍ x‰™8†¦õ茓„BNü•ä«iÊÇ}Á](jøë$-ì|Êͳ@ìô”[Òp"ŠòP³5Åñ|OáØ–¿ØcL'ñú˜Û¬ÐDa„õúÅ|½Úï+N|+Èoj­Û}ÉoËP\·°â“èoè¨Ê¶"ˆÂE Cï¿,®cYȺêYð'–ûUÍàåi›$ô#`½#A\µ¡ÕXtÅ­?®!®p§ 8ñ´Û4H—æíÿt´áKÁÙ¬R&ž“sX‰Ý}´š’/Ë]©mô{±Ö O ‰ky $¯3äËûB²‡ÐÝR⇩¿Ž¤½$MC8 ¦BAÌ©õ%¹ÂUÇ×s‘ƒlxêjÔæ³›ØÛ|–?1ÊUV£T‚Æ”H¨¹û`ë!À¼|kÍ7z)$ !Ê–ç5\iø‹½éÓ<‚@›‚—5C‹FBp—Qàì+¢m!âs~B¼êlÞý7±›Y5èUËA©]è½9ÝÈØD7aËJ*S#Q0Å꙲ –8ñ³<òo­d 3qj~GÚ JÚÜØ'v#†–iCv£2Î}”æ-K(g`Âóöå'r²”äj¬±ùl$ß±åË[NVGŸu#œÃà“úFën%ª…bÆp…2J1:ŸÄÈ / Œõ€t'Ÿ†mƒX#×è ºJV„„’-ë°ëÚú¬¥8ƒ˜E¡ªá‚MÕ%ÕðQ_!ס0?7¶êDÌ?7hU,`#"+×R{»ö-«ÞÖ”û‚Ô–=µ“ÚŸ¤vH…O  ½ª¸£´Sˆn}S0”†¤Ì¼ =И`$~ª’n%*ÛM ÆF+“­`8‡ê>,q?M¬ušCzµS<“®ÞQ“<\€|y¬e*‰¾¦”·%Ù~á¸(bÙ9Jòpµ˜ª›¼LA½ÀûhŒ÷]¤Y ¢sŠ÷S-ï'ZÞ;{¥4jD)¡3çtÈáD\‘ÿ¦«‹¨&U봔ƹìf”‹ŒgÞ×-µm£úŽœÊÇ=2å˜ÚK)ÉÒ  Â£¾keƒ¶Î5°ÎR–Ðb?"D*õu'nÕ 'e–ú;‚©Ä }ű¯8ÃçÞ©þïoI”J•Ÿeñ´D9@·µÙQø;!Q“E¢¦ŠD¹ož8Ç$M»Cjw¬ÂsÞʇM@»ÜW´ô:(ÐÚ.ÿ®R´„)½vî!0@3Æ{»+è.ì“X 9l®É“éî §¼>Ücë$?Ü+."ap»GÛ«l~™øÙtQÞ2*u/¢3–^Ü"~Ë +)³@Àœ^­«†['¼©@ûûÊÂKå³0¬6C_O0t:*ŠŸr[Ϭ¬:|ÄÁ­j3ö0§¯w”û.òӱƜ°¿eÄ.Å‘{,AØÑ[ü>¦Ä/Jû W.˜Æ…©˜#[øéo„¥¶’rmÅŽñ“Xw7{8@¥Ì3E·1×{ð·{UÂѲ<ŸÞnQ×4%Ì.žT@GOÎ#¹HÜ´ +†U„“ëÇjO¾“]i˜±ÕÁeˆRh8/ŒÊãÖççTrÝjáaýsã\ÆC?Gö½[s÷£}7⣭›7²û‚òٰφû°ŒÚšoÙЕ.I´¤ê“zÕ'ô0ÂñWàšÉï\ÈO€€®í +G™À†\.\°±©h{}ñ¹”Ò6b%a°49)àÅÕƒ«cQ¬ÝÄÈ© 6â2*'fµ>H¡2ÃÍBO,ÞSLÆŠÐíBz©Ð3‰QbÅi„+º1ÓÆDñ|9èÁs7»¶%¦ŸÞeå·˜£ß/¤GÐíôȽTì˜Äh™3‰Ð2ÇAˆw‹ôºÎ}GZðÅÝåë¥îñòÞ`ß÷0þñõ'äZø)]Õ?©,†¾Ilò6žŒ–‚í¦VÖnŽÄ•±ŸXŸ×]ß&x}«¥jË*˜*â-Äe%©¯‚aÎvþ¸rÓûz’©–æ¬Ù<Á•¤÷oý[¢’A>¤Ó’ÒÃÜθæ¥ÂÌ:“Il"%6L°:ài¹uQ©föµ"@Œ9 `&g¯¡ýãGî/e¼ã'Œçëî\Ö<*—et]Å úI"£ìò•ä ùéß³Â»Í ›>«æ¶R ÌK%)trV“Øä¬l¬ÐºSP|3© Út«óª C6V¾Æ!´¢ûÞ› +qf†ã\ÿÆË|øjt‹ðÇZø=Úïþ#‚Ñ~ªo0*RÊW¡¥ùñÑ%½‘Æ S_ü?rP„yendstream +endobj +6442 0 obj << /Type /Page -/Contents 3251 0 R -/Resources 3249 0 R +/Contents 6443 0 R +/Resources 6441 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3229 0 R +/Parent 6457 0 R >> endobj -3252 0 obj << -/D [3250 0 R /XYZ 85.039 781.388 null] +6444 0 obj << +/D [6442 0 R /XYZ 85.039 781.388 null] >> endobj -1086 0 obj << -/D [3250 0 R /XYZ 85.039 706.019 null] +6445 0 obj << +/D [6442 0 R /XYZ 85.039 761.463 null] >> endobj -3253 0 obj << -/D [3250 0 R /XYZ 85.039 687.147 null] +6446 0 obj << +/D [6442 0 R /XYZ 85.039 585.186 null] >> endobj -3249 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F41 2104 0 R /F20 1617 0 R >> +6447 0 obj << +/D [6442 0 R /XYZ 85.039 362.17 null] +>> endobj +6448 0 obj << +/D [6442 0 R /XYZ 85.039 335.072 null] +>> endobj +6449 0 obj << +/D [6442 0 R /XYZ 85.039 320.917 null] +>> endobj +6450 0 obj << +/D [6442 0 R /XYZ 85.039 294.424 null] +>> endobj +6451 0 obj << +/D [6442 0 R /XYZ 85.039 280.269 null] +>> endobj +6452 0 obj << +/D [6442 0 R /XYZ 85.039 226.678 null] +>> endobj +6453 0 obj << +/D [6442 0 R /XYZ 85.039 144.777 null] +>> endobj +6454 0 obj << +/D [6442 0 R /XYZ 85.039 131.228 null] +>> endobj +6455 0 obj << +/D [6442 0 R /XYZ 85.039 104.13 null] +>> endobj +6456 0 obj << +/D [6442 0 R /XYZ 85.039 77.031 null] +>> endobj +6441 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R /F11 2898 0 R /F66 3242 0 R /F14 2895 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3256 0 obj << -/Length 2363 +6460 0 obj << +/Length 3438 /Filter /FlateDecode >> stream -xÚÍYKsÛ8¾ûWèHU i‚ øØ[bgv5+ÙH^oíÌh‰¶X¦H‡¤’øßO¿@Rí=̦R5  ßø«™ÿÔ,1ž¯ÓYœ(O'Él³¿ðg0óÏ %¡Ñž C '&];ëFç‡ñ”L{A¬gnz©Oï×—?þ,ð½(Ò³õI®·¿:öæ®1¾³˜+§êòÇfî*'ë ->Î]ÅÎÍŠï€WTÛz®}ç{‹¼È©P<ïæZ9ß‘O“ÍH¶óß׿À)¬FD§}/ºïµÊö÷J\|XÆi½e›6žJÒÞ6efʇ5éضõ®-C•‚.¨å¦+êŠ[P0'KKaÕZæÝûŧêy8ßð¿¼aÎúêóåâ3Ól“íisft5ÿZ Ú6ö´ ÀAy[—rr]Ab_A@àÁ:MA” Yñ‚‡×8]'!Ç~ï(@[Rb‘gƒ;”$:¬š ÌeMÎÄòÓZ¤ëê7_…XÐä[fv¨“‡Ö® ÝÄ'xöÈ'8#š­¯pð6 ÷Ðn;kx5¶+LÉ0š¥™ØFˆNB6ÊDXèâA"VÕó³çg+_xDn‡iñÕœ”By©í²²Ìo'*t¼rð.ŽŠŠ•ÈБ¸ÊjR?É캬Åva>ai‡%’Y(ô ¤WÌ;wf˜$Îé«Þ™(8v&3`Ìž¤GþcC™¿Ïæú…ýhÛ3ó¬ËxËš‡„L SŸò³òŽ–6OäµÇ »ŸqŸú¾Ì÷¤žwZï ^Deüõâ×ßýÙ -þ— ßÓi2û´ï©4í/´I=“F2./Vÿï¢TíÀ¼º­òa¦¬øñ>2tý9ìK 3ÊK±‡Æ²¬çèí“@Õ0¤f_g°[˜¦šgG4i:,"Æåb¯f×5¨4´Ò©ÀéZ{I ý.™èw}¡Î1Ã\J± ÒNý {WAÎ1«(¥pˆùµLCeQ=bÓÇ1¦þn¹# É-){Ì}@ꈅgçº÷n逹ÄG«©§ OtŒµó±~,6P}ÄþH*=ñÌU]uM]òà7ßøqú -(å±ø§Š'©%£Ö±³•²¢²Á¹ê(c.@œj§t†0ë4$Ýuj à0×wØxm¿-5Ï”]†2ÜbÑøX¤—|Q’kx)ç.@²,Á†ôYÖ].ì²­eç]Öß Ý.§®Ž}®åß%w¢ÛÃfÇÔYeܪ´IúXÁ ‚Š KR']^`›Òù¢å"¨6¯u=­µÕ¨ŒžÉãuÇ­}ƒE6Ù C+µ©)ŠÔæ9d¹Ç›…]G -k‰yѺx3@£nhͨgJÆ~>ÑŠ4´376^®“¸Ø®TÏ\\÷'Û›Ô¹ 'ùAü6âYÑ}·Án € òƒ ¾º vÈáXÑ‹…²=ð/B ü=…¸Càû¾ìÅiK¤L>S¡Õ-û÷^FÔ¼es³näâ£c*î-Tˆ®ŒnoïIU>*W*U¹rÀÑš“Z;ºú;f“õH01!'¤ N 0jܸy¸F@ÀX)¸j¼æw|o3"6©0‚Ä#Ûn¯?sµ‹é JÇHD MtMQ¢Êö9³›œ\_ãµ~àÀRÿ@'m™î5 `ÞphÂ>íxJ锧øPsdú¹þmlµI,LÜõ[±a‘oêÜír‘9Š2Ž£€œ o"›î‘„¹ ƒ3Nº-ó­7²ñiB£ '4R¤á¹Y€ü(‚ÈÙ”è k Kñ1Óé>¬cG†ah˜è“µ,™qO‚9ï,QÚò¶u9á ÎÂD’&°´ö©½üÙýÁ¡ÖúD)`8ë}a¦‘è¿f3?Ìz!â¿ŽÙîv6‘L<úŠ°ýÍÄɨQÆ”¾ÈãôÅ%_ˆ–¤E’¿!q»ö'À:qŠž±@„êÎÄ£{ÿ¼ -à›ªŽA@”ò ¿ p"¨À¢Íîû µ„ÃtŒ8ËE¸ Ã"Ѩ/Žç9÷èc‹å¸]ÁY"’ÅdhÇs˜ögùŒð¯ø«eI©UÞ؆ŠØ1Î=UÜ * -JB’ïQ îúÐlÇ×ÍÉûI6ežû”µAÕkƒ -¯`¯»År…¨ö'bTÎ@HSaI¹è)c˜~·¼f‡éé5Ü` úìArè\×lÓ2 /|/(sÁr‚=[ü\PHÓ5HFÀ¢˜3>oEž§%ÞJþ2¼iý6Þº;º üñ ƒ ˆàGýûÒ…@q?æR*ív[žïá¶ôÂ@cB3¾q®—r\!;1hGo@E†¡6ÎM¤éYÄ}sõ&òÐGªdøæ}sfGfÊlàöfÝ @4C¹ÞåÈB»‘ ßXµû¡ÜuÑ¿Olººya)¬&TkóÚ+ ¦ú»ëÕÜf¤«ÃÐA0ÔW<¿ ,…3×/°p7,EL^0¢êµ9ž³ØbôuÝÖx¡yåoA8eF{ê)w]æÝærm¿= ‹+rÅU©—f|ÂY|T÷åè¨ÉȨXŸžNOõ·¿¢ã\4endstream -endobj -3255 0 obj << +xÚ­ZmoÛÈþî_!äËQ@Äãr—oÒ"—æz¾^ib4(®÷–h‰5EêHÊŽÿ}çm—+‹¶´íËìÎÌîìÌ3C«EÿÔ"OÂH‹,W¡ÎóÅz-¶0ó· %+!Yy4?\]|ÿcj* +‹¨X\ÝLû$¡Iôâjó[ð¯ÞZ®´ÖÖár•eypõÓ{ù¼TÁÛ?¼Åžâ÷з\©àï¿\âÜÕò÷«Ÿ/Þ_9A `Z \üö{´Ø€Ä?_D¡.òÅ=´£PÁôþÄ£¥ß\|¾ø‡ÛŠçÌ‚WÍ)èZÞÔ-Ÿ•ViPü»Æ èûjm-G%pIDÂV²€Žû²e’C¹åZõ¶º×8^›ŽçÛNöòάGóëèè»[»1ÜÈl‹h+Ñ€Ž!!5&z÷îúQ(=ÙMÒÙö·ÃXŽu'}õÇÑ®Æ)ýU|"xT­=x1vùØY>BŽV ê]£P<ÅÇÖ‹ÂÍtÂÐ%ŽÜð¦ÓAgrëÐØFб‰Öâ=‰hÃDëΙÒq$;¶r&V´nœQPAUßÑnñµ&Ao·ô|pŽÜ,\/ÉUïkt€4€f¿‡¾£rÏÿíi:Ù†ÏéÙ_ø¼‘[µ¥K­ä4¼îøâáìa÷ÊW‡ÝÅ] k"CÏx-g"í.º^³2`§i’ïvYï­¬êøw¨$Va§¾™¶ÜÉKJ³þò‰ÉãÝÊ_†û£ÚÊšlo-ö5†<œ ÓY†C7ç56xãèMhmýaÌá¶àÑZfÅaP°Ð~°(RÀ(6X :CX6M7WÒ0Õ©¢í5ÖºÈÈm4@šþ°dÑ°Ã]7¯ÉqŒ¯=uÆuˆaæ1RS*µŠ©È¿sËÒ¬<¢€'ajR·jV„gü´ •~ž“¼ÀMàœÏíÓ‘kdCmŒOxï ^²¢sáÆqª¯’òQ²2q«B®¨mg.[J~¸üÛg„ÅŸ– +¶þ'`éó-SÐ+µ—>·!òDæ¯>|„íB|¿fOaG6ш>×ÖüQ•Ç)Š?#$Çq˜%'–Ïø.ÓyãÌ< Lqnô‘®qî;ƒ ‘ݱÙðÐW–3oEepoùI¼'z«IŒihª±’îp\¯«a¸96]g.!3aÙØ'+ÖX›"ÌÁ$}•‡’#FÕ<âü:c-CH·åÖéóƒïø—tínbXô_Š{×F !ÐÕíºë!Œˆ¹yÀETp 'áÆ0ÜŸØJopà(œpÕl7œ{kbácRŠî#ft…L¢NÑIâ°´‚Ä°Hbß¿Á ©üe Îέc—œD€vTQˆA·,ù¸Á1öêv΀ÀÝhwïÃþ:„]nf¸(I º|DV»Þf8¦Ëñ»ApQcïŠUJpNg,ÅhÉØËjìØ ¡ JwrìlK±¤ ä–¾ydzp·¼š.Bv½÷Y­d•lÖ2Bbxß&äk|Ô +6WbÐ6˜ê“ƒðå²´1y¤£3ìÁ +ú @(Τ÷‚×6^ZƒY”´Žƒ;è½y4¨¬Zø(çÔšrŽ8ømÜ~Çf$âsâ×ĉ=Ø™Av”¿lDàHœ³º»­xO+ì„RA:˜” Gͨ¤c2¼Êáô°7tÈ{)“ûüTgDS¦pºãCzÊi#»mcröVlÇÕ†\‚"ˆ“eak ôTqᎠ™L|uðÕÊÂ0w8c‰É;ñäN[YǛ΀M8ª^ÎPÛ¾DÝýé(ºe¢à/GÙ×ÛM]"Ì臎[\ ¨¸Ã— ~xƒ.eÝ©··„3` …hÉ£Ck¨ÚÍ\WµëþÁÀð:!:—ì=lÂ"¹D¬Ù+"ÉôRM +žËOPêóì¥úì¥ÆIakj‘M4áLË uÓ±g¸=xœŠkdµdÛžŒöÀ[Måœ^6·E¸-!C»SMÕ?å¢Rò»ÃQp•N™ü]ªBgMB¡Ò ½Ï\õŠÑ£çF§Ì]÷“6þ8g{ÊG*÷Á€=æðR¸L.:›N0ÄÓñQ»-âfiP56>v2Åœ+ºlX“îJiÜ”TuwÆøÐù|û452]É?ûšò磸@;þu•ì ¾@¨Ð‘1´Àñÿ8#ûÊ•SÙ ÁœÀ_P^Ç€?(‡F¹-ë–jjüµEZ°ïX4§&ÕRëfà^yãÜy/[J1Íؤ¨•gqÝDþ%pf]\nö’Ï5ÛF„\Ž‚,8OæÁrüœzæ*:|HE|˜ê‰–“«'æ>šÄZÓ™d‡­oœ_êý¼^)'èWØ`Íogô]:—. VípìmõN%ŠC£²ó‹/¥*â +:Í Ô‚ÓLà,…2j˜(%T cÙüöžŠH:S¡ŠÓç#’GôtD²D‘ÔSéY~‘ÎØ©™ˆä³ûóŒ-ä¡Ém)âGt¦=)üà"Ø°‘ï/{JbÊ­ÍGèÃO¿tŸ“èÕ§hõüVûøϾ*¹šqÈÅ;)zÈž§Ÿ Îyc¾«çOO~°äšôŠ5<(è uâ|G¬Sâ×{Õznjß=Á +™úQÑñª˜$cß}+HÛs<öÊwÌ^˜tí$ÇTlŠÁSgM¥k,–àŒUÁ/àc_e}e +gŠ+.•úÅ%ìº@k0ìQÆ‹-JC`zCÄ6ïÃFÍ5ÁS)+Ò„~I5$;ùFŠx~FM_cpL⤻`œçò4(d“TÜoêa.Ò¾Xñß•Îñ ô}ÛHê£ýŒEªVØÀ}!}ÅX™[ü›zÃóói×+žt _·Š#÷"ÎØ1Æ¡æ8O¥Šs½¸Ðw]^Ë']̯z¼Œ¶¥ÚÉ–“¬/uûëÏÚ(¶%ÞQSÒ¶Þ¹iü6&¥S¸Œó~Áijä™'ªœã•Âf'§Ey`÷m“IÏ3&#+¤xÝ°"ôIŠèAº\ÎE{“žÔÀXªIÔ†÷äù5…—z”¬'öü€7ôbÐeËã^EŸ·øµ3hYÕ\çÂBÀà¾A¹Îc†0ñÆŸ?/é(xûë_™fæxhe¶D6ýBW»±®øQ1: AµEœa®Õ˸¡Ã8›ÿ³•ÝkåmvýŒÎÃ4v ñÀ~=ûk“ÀV€gþ/bÉ^/ˆ•€XQ~"×N vî°Ôcóèb~J}›viÐL¦mÂ<+¾­ð”˜óEô‰‹2hùèã}ø…x0©ò¿e­¥NP Äy¢¡CEž­Néù«gWëð‰¿ú‰“,ÌâøÙ?Pòhèôc˜5`/)aN±Qø5×:4”ÚÁgè)&'w  ñïXzªÕ!Fáyüå)áÿ¨ds$3hÍŠ¦2xà9'ô +ä¢TýLÀÖRF‡|]Éã‘h1˜Œ‰´Û8óT¿]pã“'¦¥^yäç‚>Þ}ÛRQûÁU°éì´­>ÉzuÍ+¸¹´ër¿ý™×Ði,_ü³³µ4Ï ýx'ÎCæ/RGa\Ìñ‚ÿüÿ§?;sÖ`4x€b^Þ$æo„, Ùi?–×þyÚ™Àÿ¤»“Øendstream +endobj +6459 0 obj << /Type /Page -/Contents 3256 0 R -/Resources 3254 0 R +/Contents 6460 0 R +/Resources 6458 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3229 0 R +/Parent 6457 0 R +/Annots [ 6466 0 R ] >> endobj -3257 0 obj << -/D [3255 0 R /XYZ 85.039 781.388 null] +6466 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [212.407 214.44 369.551 226.13] +/Subtype /Link +/A << /S /GoTo /D (problems) >> >> endobj -1090 0 obj << -/D [3255 0 R /XYZ 85.039 761.463 null] +6461 0 obj << +/D [6459 0 R /XYZ 85.039 781.388 null] >> endobj -3258 0 obj << -/D [3255 0 R /XYZ 85.039 647.888 null] +6462 0 obj << +/D [6459 0 R /XYZ 85.039 625.834 null] >> endobj -1094 0 obj << -/D [3255 0 R /XYZ 85.039 111.902 null] +6463 0 obj << +/D [6459 0 R /XYZ 85.039 479.52 null] >> endobj -3259 0 obj << -/D [3255 0 R /XYZ 85.039 81.701 null] +6464 0 obj << +/D [6459 0 R /XYZ 85.039 382.554 null] >> endobj -3254 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F70 2201 0 R /F18 2207 0 R /F41 2104 0 R /F35 1632 0 R >> -/XObject << /Im1 2193 0 R >> +2554 0 obj << +/D [6459 0 R /XYZ 85.039 257.722 null] +>> endobj +6465 0 obj << +/D [6459 0 R /XYZ 85.039 228.317 null] +>> endobj +6458 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R /F11 2898 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3262 0 obj << -/Length 3108 +6469 0 obj << +/Length 2909 /Filter /FlateDecode >> stream -xÚÕËrÛÈñ®¯`ù°Ê„0ÀàA夵¯7±¬Ètù°» ”A@ €kéïÓ¯$¨¸*‡$¥*a=3=ýj–„®,gq¢Ü If›Ã•7ÛÃÌû+%ÞL»^âÔO««ë¿EþLyîÒ[ÎV;YmuÞü|{¿z÷0_Aàø;_Äqâ|¸[½{?WÎÃí< œÕ‡»÷ ðñ3¿~¸{ûiî'ÎW¸{Ы¯8ôéáïjõ3·>ß~üévþûê—«w«~ íê(@ÿ¸úõwo¶…;ürå¹Á2™}‡¶çªårv¸Òaà†:~yõùêŸvžÓ3^5A†…ö#סxn’è)¹A{XZi5A«ß<Ÿ^"tu( O7Å©p°gNìyu›ë&këòOwSW»Óý~ ÈðUn¼ôÿ‘Ïë¶û?E½jÛïE·É§Ñ5V4[¨ÐM‚`ê$sA.š}˜S\Pø·C¯§]{™nî2Y¾xnìF^¯àjê¢oê -µ²K‹ -NoQµ“²ZBOÁLWÀ̆gÊ¢íx²Þñ÷Ã=o·[k2\Ó¶ü‘Ýpç-CUé§àšZk‡:û¼ã 'y•ø •he@¸*¸˜ -…qè”õ&-‘F@2Ðu©µ­x)ØM‰B3°äm–¾«¢è­xáºØ¯ë'×dM -Ü>Ȩ«åÀ¦F–þ‰lÛÊy)O!'R¼#ÈiÁ^]a¦+@hømæ~ìäĺ¢=ð&mÍßó´#ÒmIQ8$„Žm&¬ßÖÂöZ¤¦Ê2‘„®f$IÁ!;à™k TÌ#ÍXÂR°-`L(3â.!!„2ù.ëp·ïH‰ºù†Ô€ p}ºÙ7Ï€¶0”ÃÛD*èà(ÃêÁ³LWZ*øáh—÷kó¹¿tži©¨ Y2`e®ÚácÔº&dY‰aJN-S„|>=Ä”†œ«Š…p㜛´CätDç##|²t¤ÜFû Œévk¹Ñ!Ö$ÜnRsaF[²{èòŒ 2®Ãn7›ž}²½1BM]ZLȘ0ÐkŒ€úrÚÇ[~3¡ÙãehbÂPÄ'B5q» ˆé73¼jÓßKè<ódàów”ëd)Ü›¾¥Ù™èâ­å‹­dAÂüFi,Àè”rÀc»œž™µíÄew5aʺñ›zþ)în3ºJq@Ñ#½Ãýþ\Ǭf- M³¸-x¤!’$kË×$ê#± Ã!D©ôX¢³¦¨É ""{â¨C–-4yÃ3õf cDb¶+v8KLõø²­X:„Ò ×Hubt,Ž^äDfyÓYI¢zÈÍ-C²¼ÀÈaš}ànzÄÍ~5[Ø¢dí‹î¢*çÙA:`c¸‹f8q<àVk"pÖO[‹K -z›õœK˜shFʺj§8¡½›$»ñÒåßúö£Kæö[Å6Õ¾wÑÒá\!ÔhvH¡tƒžÈÁ´Lë6'#Æèâ`Zñ× -.ç0VpLWÀ_Ýr¯&!dÅ`Zà.áå²ïxÛKL b„. #™€&y×Ô8 -zeƒPÖ©…2ÔndEmÖ~Àµh®"ÿä4…ÀÔUZÑò^wŸ¸o P¦(ÂàÐÛ¼xäE4 K'±X†´BX=|OïLc¨Ôàe‡Ÿ¨_|I~c€ö¸Að\¶à‹}E&ª×™V¶³nÛ¬Â) -.&¿_RÚhÓdËЪç‰ë¡ÕöƒÃ¡îh‰†Z ”s‹ÄéÄ:wð ‡ÚÈ&άӶØð„µþ,¦%ÚëâIgá r éÞ)ÒâpÁpŽ·Á^úÍzE•.Iy°‡xÏ›NxÇpBnÙaÃ…#p‘ŸñÀj#1a¯WžžÖ«L"ÎsõòŽû²Fn±qÄY¾çG³ák£Ó[žßgÄà¼!–Ÿò‚üé§>ÎX°ÙŽ4‹-…è!tÀ…u–ÆG"Ÿ€õ úÇ4Ǹ¨dh[.I'OS&$v ¿pL›¤À— „¡2$^¢¥ó|‡ #ÈÆ„^€Ž/š×‚<Þž${/qµEVÇÖMŽº‚…uÙµ‰`Q—ÓÝ`÷º’!º$ œYC˜Ûh±8<š¶6*ÞWä‰èLÜuà㽉Ðñ÷õÉTo`t .°E”’VèõA‡âT\G®¼ióÌt7:tBö_³“ïòBN௲–‚1&ÃyÉšÆ7ý^”¥qÌÆW`f”±iªŒÛæ`³O8èöA²£&{¥ιb¦¯y£rm‚÷a(o‚l™Ä\ÒzÍQÌNR—öVZs^Xsó%Ó–™ DÐÿÒ‘%žfN×r2PYŒI1ˆuuÇa%„2½vqx,ûL“©AV70é À -‚ö® å1‰‰ÃÞaä¼:E LiãwÉ…ÚyÅŠ ˆBΰ9ø\ ’Ë­Ë4ÅSÓ)OM²ªÔ™‚ÊgyQ”æa÷V`[yHî…@’@“XdR1<·,Iô”ßÇúж”P³zsmPØÔZã=¥%\5"ÒâÎÃaÐò£u'.FõÎ#”FkMTL´÷CÕnõÕÜÖFb%…Ðó·ŒqZ,ÇX”(ÐbèAø¦ýI㯥j_ë^4&kmWT‚Á¶‡^‰GóT¶;1Dd›è¡Ë곫€Ì‹ù’‚„R%`fûqˆ6åú ‹k"˜Gƒ„JÀhSør‰±-vœ0Ó<)i"C,£†’1UÃd…˜8®£èmŸ™ˆK…Ý€fi.Gm‡±¥!<¢Ø@ŸÕ+qL;låêòh™Ã÷'4Ę%\JÌpŽ{§ ¾&›”n7)*>ŽÔM1Èq„ ÝפÄ4~ÙI˜¢Zâ|y{ÏeÌ^¿´}©,vÞ’M÷ ùöþÄ>šA,õ·ØĦÒÀŸ&ë#4.øš‰ k¥ü1f‡”Ej)‹°‹Åúˆ`–W«9 …ßXòøjû>€ÁA+†$ {ìGc¬‰ÀQiyd z¢Fâs7Y–CáŸ9ÙÕæ$1¹É}ck«1àç7%&X"h¥ l*D0h&Çuè#¡$ºP¤Ã™º*ŸÿŠLo•˜JÌó¾b2’ð$’x”¶Qˆ^>Çô8Ë5À„7öÝPÉg¢ Êk0ù&9%œ¡Üö1¥T±O:ß‘ZžBÎÈÄC‘&ÎÚ¸DYÐÚ ÞqG/?q‹äÑ+ I'ÑÌûrøþ‘ ©9ïS³cOaìkrøÙµìÓξ7‡Mþk?l¸@ŒÌ¼ˆ© dhg* By<¼Ô‚ Í S³Àžäè}R%µ–’\ž½üû‰¥»ôÃé_(‰òüg¿ -ð—V_¤ŽŠõ)žCVÿ nvendstream -endobj -3261 0 obj << +xÚÛŽÛ¸õ=_á‡#±FuÝ·d“[l²ÅδAÑíƒl˶]\‰Î$hûï=7R²-{‹Æ$Ï!yîJ-øS‹,ö/ÒLù:Ë›æU°Ø䯔`D±öã(‚ñ pe¡«$ôƒ(Å‘;V©Ê})ÄyûüêñC,ÂÀO½xÞ-” +}­ÂE’G~¤£Åóöüå*ŽïM[ÔKå}ªv¿\é$ñŠv¹RÞ–'C‡Ð¯L½fE³.–ÿxþ° +#?:ò¸Ô×wkÜPâ D|õþÙ‘,'IìÇê.O# +±¤â… +à²üŒ%ú‰Üÿ|({¸WG¡Wð@{ 0fÞw^ºS4m¸r`ŒnÇ° +í®CxƒðÂÀ¨êZ9OùºŒA:U]¬TË a(Ïän8£á‘=º=tüžçu5˜á5Žcï×xòƒ¨B¥çÄPÑŠ¶ÝrX›SCr–rÏ©Sê1J{»N2ÆO™Ï— ‚'R"ºF°_*Ò:²|Õ¡h–p²ZÈ©(Áô® ˨ãÓHΦ >ù´¯¸B£P¿Ï0¸g¾ø?òªCÞðíˆ.Zàq‰g#:bjíí˶ìÁliòß2‚épcµüÏ:‘Æ•ãD.úi|!<ÖÃ^ã,ñóßq ŽuB[&S‹Så+['T¤¾Ü{gI(öm7f„k@8DPßñ¥8Éè–»´8·½)Ž?Í4ÑöKËö)É= +g¸¶&+It†Ád –~Ù!®ž£ƒ9\R5Ó~_áu{†!ˆ‡5bÀ¸X |ï ‰iÐ tX½c‡€Àçým™ÅœlbÁµ žp§Îbr`?~ÐSÑèÌOãö î +l4c¯;’õö™ ãØO£P°‰WE"ªŽ¼,«lÐðÖÎða™½-… ÐŠx+äu“ÝG>7ÕŽ¼‹^ä‶-×'–(®×å茵\gì–jtÏ +³DžŸ ‰/O½þ$'AM”$9‰-2nDЄ~${.mp'aÊàkÔ‘šå;µb·Àý6â(oÇ0uê5]/„AÅs%ŽŽkS°2sƨóÌêZ±à‘uÁ6Ï/-™wY×<Ý8©ä Ä‚Ž—í; +C ã)þù-ˆ3w"§Ú‚âÃH3¸3·ª@&ˆø8…€HÚ".‡5Én;à]­ÓAÀÞ´ÇŽƒúˆ—žˆï€%_šCç4 +HÅsu3 ½™=e3Ö±²™7/3`¤ˆÁ6•ÁxO»7”½ÿì¤âÄ ›tÄ¥jÇaŸÀ/ ¥c .!à |øy(ÞÈWó¼Ì4xÇ`Êí;ÉðºI³Ä{Æ£–)§¨½Ü¸µ×sÞgÙÕçÖc¬ÙèÔ#éÕôÀØd¹:„D.Y +òœ½¶;¶Œc®Iåx$„H ·dUuÍW±ó—|H!^džk.x4-΄C”&ųpfb*lå§f +p] NœÞqBnÊlaƒû—ËAšPvÀµ¾„ ú]à’»Å>/;p %¿ÅLCdTÜxuh’|qkÑnNË•-)’ Gn +¥»ÐÖ%fÑW‘CKð«—R]O‹s&Sbå¤Rçì´ecщ٥`ÊM0ŽÓ{¬ç.Ÿô\oÇ2ƒ#h*™8ì¸]QKTÏlÃ…iˆ;/“`H“¶ö™ÍQ<ýôÈ‹ëC§É­G€Ø"÷¢…Ñ’t&¹Ÿ…!7°è÷‚ñ뤕µØ« úu/{y& +á@ffÐß~x||yyáRÔ½»©-šÓÑ'ûØ?^’™fç”^´Ú‚rŸ¼‹s:)>uûy’™Êû12+Ú­ÇCGI…· +¯_Rðµ—†ñ«ú +r­–”@éhü—¶úÆ#ç²0þLñB‡<;@—O§EÐaS~P¶b@Å+튺+¶£©]%÷]Ï ûBè +ºoµ£ÐOCý;ÖÁ¸« òÌ;ÇÙyw-ƒìLŠ¯ý¥kG.é ãÜ¢s‚/ŒDPîÓyqÎÄH”ŽýL·(è¡T&‘gRÎ.‘âò‚ì~à)zvL¸ð‘žÍ,§)¶ÛI†8ë~ëžËpíÓókL—3r(#•aÚ4§ù/ ŽŠB8±4ëå)¯Þêè ˳1!ÔW剰p§Zçw¤PéӻɓJÏð9¶pýGÄy÷`ó!ÖcU7&ÑÒÂ5l8p÷Doº²Ÿ¯äTSH·‰áóÇw`­7¦ã[ŽŸÕ'‹û0y¬ˆS…ïâ :užææQ)¤ ÃJèè(¡^ÞŒ1±LîfšmŸz¯Ó©Í"îa–Î#–Ô½ëQ1VÂ…-Ç7~¬uNÇû7ÜéѺìåT´E´¿IE`Rüê¼_ƒmù,•±+´'—ô_IJö²ß9,¯†Q rco"]lN7~4è\®¥+ùf•& +4ŠÔ=…"¸“ËŒÅ'ŒnÛôB?3š×Ðq'÷¸ÒµT\FÁäiâZÛ`Häÿ|¸Š¤Çdø½%L„qs%/n«~ltlÑBØÜl`%ì¼Æõäe? *I@ÙÎƶµ¸âjh„’vŠí†ë`´D¢¼•ûse]-ýN1-IQ¡ë‘S´³(òÞJ-[¸øRô¶-Œ¬ÏÁï©T-±q™Ô´Üˆiìg¶×…õ‹Õkeä¼ñzvk@r¯QNŽ¸*íw]Jô˜ÿÚ ´ò£èîdžåöw…¢ Rû$”ï ?µƒ„>éNäÝ"ñ0ë„ÝR“½RPF(äÜí=~„|àÅN¾DòK>ðûy> endobj -3263 0 obj << -/D [3261 0 R /XYZ 85.039 781.388 null] +6472 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [389.071 266.098 509.276 279] +/Subtype/Link/A<> +>> endobj +6473 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [137.104 239 260.036 251.901] +/Subtype/Link/A<> +>> endobj +6470 0 obj << +/D [6468 0 R /XYZ 85.039 781.388 null] +>> endobj +2558 0 obj << +/D [6468 0 R /XYZ 85.039 761.463 null] +>> endobj +3036 0 obj << +/D [6468 0 R /XYZ 85.039 642.137 null] >> endobj -1098 0 obj << -/D [3261 0 R /XYZ 85.039 691.087 null] +2562 0 obj << +/D [6468 0 R /XYZ 85.039 586.947 null] >> endobj -3264 0 obj << -/D [3261 0 R /XYZ 85.039 668.014 null] +6471 0 obj << +/D [6468 0 R /XYZ 85.039 557.543 null] >> endobj -1102 0 obj << -/D [3261 0 R /XYZ 85.039 105.97 null] +2566 0 obj << +/D [6468 0 R /XYZ 85.039 131.44 null] >> endobj -3265 0 obj << -/D [3261 0 R /XYZ 85.039 84.109 null] +6474 0 obj << +/D [6468 0 R /XYZ 85.039 84.771 null] >> endobj -3260 0 obj << -/Font << /F62 1689 0 R /F41 2104 0 R /F35 1632 0 R /F20 1617 0 R /F15 1628 0 R >> +6467 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3268 0 obj << -/Length 1797 +6477 0 obj << +/Length 3882 /Filter /FlateDecode >> stream -xÚÍÉnÛFô®¯ …F4÷Å7'q§ˆãÆrHs“”Äš"rhÃß· µÛr)ÄÃ7oßGîØî8 mÇOÇqâÚ~’Œ³ÕÈ/àæãÈ gØNâÕ»ÙèìÏÈ»Ž:éx6'”YþÃzÿéâfvùm2õ}ßò|{2ãĺºž]~œ¸Ö·‹Iâ[³«ëŒðå–ÿ~¿ºþðuâ%Öw\_öì;‚¾~ûkÀš}âÓíÅ—w“Ÿ³Ï£ËÙ–~ÓÀ"ü5úñÓç`Ãç‘cûi2~„³c»i:^‚зÃÀ—ïjt;ú{àÂwÁ˜©Ž¸ax‘íÅpð;I‚c8ndûð|¸G|õãÆûF„v -á>S¼ -·xºáž³e1™z~`Õj'„„Nÿ¹ næüWÕ/µžø#oVª¬Áã~‡–^ÂYi¾ì š¾Êä[wð'±Dê5ë2SU%üºB!Q DÙÄ‹‰š”úGÃ’€5uûT¨^ K0˜."%«tÃqo Ò¦©&¬{ÔüW¯*$ŸEÎ˦Óxg =ìŽ!†£Ô([†\Ýð_•ÃMÞšë®ÛÕÔ‹!|ȃÈÔÅÿ,|7”<ðÝÈjZ†ð÷Ð@F›Ë5ºøaF–*+uh•0ú€É°BÌÖµ¢o‘y[´ Vx …·+…9ñĘJ±%ŒUwOdù3)°æÜkç¨D»Ú‹ï&´ÁQûðºU’ê`©U65ó®Ò¦¹ïׄ±ð0u"*üÔ?p“®k'^<„ȃ;×N!l[!‚îèÚ ›d:ÖY¡³3ÌY;CÛjTp~2é<;MÒgUˆíÈÙtkÿX–l‰lj’µ—N‰oG^ Øåv4%dë«Ž“]ýÄ`®5ãh„Üadåö”Ò( 6,cèZ—Ðè‚,M‘!h;´ x`µw² -3g*jSþ„¤û&ÏÈ ¨8Ÿò5#®EŽ!H¡40EaB‘¥ˆÈ²¶Ô%534ªbúhjé9‹­É%¸F ÔŒk ûÙ²‡SD¨D!0Ý£[2‹À'p\ -BÓæ&[æ?ø3Ùê§Æ§‡åSå±)ˆ¦êÉ,“þE×j Ä5Tp™ôo¡ƒ‚ .ƒEÅT®µÆ9ÀÔ'âúL÷­të’Àçœk;I ë&TWj;¡OZƒÙØz!5óîí]Yï4ÀB[³xI£ÞpÖ;ã'Jd¦5§O•£­’l™^”ZÝá„g|‰åÅÎÆ·šÒ¡ÞÌ=v™ç[7•ªnŸj¾cT;ÊÐ4Ôá°R502j!ôÜ -ù‚5{~¨ip»b;!æÌ;¤îQ" ¼ÐÐó;ûdóqƒØ£çÛo§AòºlwÀµË)É©ñ-ÍØóý0zijRå‡á¦:ál*&¬PÁ  àAeCÄ)õÃaèÂìÜ­6,Qª6¤Wí¢Ðšî:RI{‚¹ªÖfµòÃÀZªî± Û#eßÜ¡g­¥ÑIaÊ ÍJ–QÓêdé‘!9§Fóð(Ý‹À7\†&’¥†Ø ‰¸«Ü›£0¢¿&â w‰23ÄÏÈ´\ô¦ç"h^V…ýœ ȶz„­h—ŸcÕ³Õö“ƒÎ"ê\Tºhkô ŠµnKl$¶‘E<±UÓ,ÆKÀ+³- U[œŸ¶zÐÉ ãA§Á2‘V—r¨rµæÓcYï7FaÜ-UÞ<ž¶RÐmÓ¯Ïi:{Xä2Æ¢l°Ži”×Ýiã^éC^Ú‰íІiV½Î‹FÍ=¿¡r»êÂá!¥„-¿3ùµqÿŽ«ÙXß™Ø 2ö8tjm·3Ú£;´nÝdЄP<í^¦h×Ù«¹w\l§Ìxa²røŠ/ÌØìG4y~¾Å®Êì3Ëb6BžèäáÅìÃR2+œÁ ×Ðü~!ÿ’Æ4’è%½Zñ$ËžÕz ý_*-à¹ÊÊŠ»a¾#vÓú¬iOŽN6ž8´p¡ÂÒ5•è…g6¿¥%‚ìЕlUиd9„î…«'Ê9"†–Q?¡…›1½jãÍãïpÃh´y[ãõæ©×HWCäH¿”ÖY@d徎oÔðž±w½Ê>Ñg«áõ$+¢®A߉˜Írê’GxŸ}Ë ‚Þß [¯ðxsÒµ‡ª»ÀI°äñ3û²Úlo(†hEÐb*Fš½¿9Ãg.ž3~ª²Æõ3%«¯áÏöæ1S83áÔ©³r­D&-é#ÃTÝÓ/(‹ÃÒÔ•<ŒŽýôÀaOÌÄת}ÂÊN/`ŸØQâÿ™Nüù{?ƒù8Û‡Ø<»5¹q¸¯èöFÁÿéBzendstream -endobj -3267 0 obj << +xÚí]oÛFòÝ¿Â/E¨"¢ÉåwßÜ4É¥'¹HmQ´} -Z&B‰*IÅÉ¿¿ùZrIQ¤‡»âP¤âr‡;³ó=³k÷ÒÿÜË8°/¹Œb×öâøònwá\naæõ…+KY0߯/®^…þ¥ë؉“\®ï»uÛ¼Ëõæ7ëÅ?®?¬_~\,=ϳ<ß^,£(¶®ß]¿]ľõëêÍ»×1õà“N)][¹Zœïÿ9ŠÀv­öYQ +DåÎȺš¶ÍI{ +¡÷ߨ¼ |/ZŽz¡8J¦8¥;ô´¿ÐqÏ ŒZ38îÄ#% –<ØÀ‹ •9Ïp ß5®h‚á4Çð)„šáC|£ 7ðA2Ц­‘µiÄi¾èI¾ˆÙt6 F>–¨P¾Ð¦v"›Œ«rwh²-á9´!=¤_È„ÙÇIXW„’0óšN +(~ a2~ïP”"{ý"“ïkM䬞Ͼäµ,“‹µz= s!)µ£ùfõëjýòæãû÷ëoDMù†±)íÆVÃêÆ×ákÝd;O¬‘%vã™u=OiîÈ* !ås«|+âðâˆê#/üvÄðc£X.$¡µf9C.Jœ>§oId¨Ry¥=;9ÊÄ‹-ü(­ù—2Ĭ(žÐìFð¨}ã!­j¬F8èØNÒßzþÄ}íƒØ=0ö;ñ ©Ncñ%›<ì3©(ÇO«¯øÚ³~xûögüK¥P£û ç}YuúDçûí©¯A2\z‡LøDæ&fºA~î/®ò¼+F´ÖQ€[;Æ»ôЫ¬>§iÑ£LQ¾:É¨ß Ý +*´jCÞho¸bÄÇÎ?³RETŸQP–o›~Îïá³L¥òKž>ý…òuª!¤äyÎmÅ‚.óð;ôUW”л}–q*¥‘Ÿ«Œr&EÚ +îO;Îgcµ ŠG'ZþýÂŵžñ÷÷ìO-ìÈÿ–tc1+\;ögªè|ÌÒ@31k¡Ä¬|c1ËÄ÷ÿ*åïU¥`ËË›ÑI 2¡‘2§çQimìcÕÅÓ°>™,A”g;­FKXM¢Ç_«Bæ*@ùvÌȱ…™$ÃÌIr›åÙ¨,;dÿCµGi¨rfŠ=h‚Ù4Çí)„šÝC|£ü6ðý…ÚÃŒømgq¤×Ù ÖÊä!ÓéÖ H„¤®u¾y§{º^±…•|ƒ™_¤Ó˜¢JC—;5¿»§fñŽ-$í ~{õTt®qCÏþ› +ÿIˆÿÄU¾µÇê H®! pÃ^B¦“~aI©òÿ¶uÚ4›Àùm½C¥o¢Ï. 2›°„£ð4‰Õ~tÐ'9l®”©çõàLàR){Üü‹ã÷ÕeãAhm8ßÞñ(=p+€–ò Ñ ">%Òg!¦Wh_0¶3¬=]Owü‘¤ýA/ÅG”›v˜ÚAÙYŒ$ Ê·äœkþˆL Í<ˆô±Bÿ`GNÐq}¿&§ÕqÑ6?ör 5<~‘EÚCˆ0­9  )²}ìÇ¿ I}®7rìXÉþ ßwõY¨K]€Û÷jšO<«ñ¢J9ÚKû§1ø­.hNj*Ž¼:Lú~býBÒØ°—¥³ž˜HÅ_ôÜøû»8#–ãÂc›ˆÏYNºÙåcæ‡qÑ ŸnÄM‰í⧕ÒOsÁ9gÛvñÜ;Ž­õCVeÌŒ\˜”òO•Á΄—ƒP[²ÛTÇ9®ß=( ú†ú˜ã§9:H¹Ýéž4%`nC¶Ú?¯„×R |¢™´œäC‘â0 ïò{þí¼ƒ‰ jÏ'Æ;åáþ}èB²Ë–†Ô•2採=b¦/ºÈÝ¥^×#¤R¼ Ù0Hu+³-ëÉ0·:Áë6bBìPÄÈG®`8ÃrlꢄCi楠~hÞ#³}?¢m¡Î #ø©Îî?}|[Ÿ#C¾!Cq=¸„4Ù fšÝžïÚN2“Ýk ™„ÓXëlÂy‚o,á4ñ­0(åqÓW”Ç+ª‘Еa±¯”²n²ŠÔ›nÀ¸Îw(utß Uê Ãw)OÒå‘^ðඋ”ˆ&E4ŸstŽ8›6à CªŒ ú;Ɖj+½kèéÍ×ÄÍsk0Î~wuõøøÈSâÊ'TÔƒØDO\ÒUѶÖ_®jbÀ-¼YjÇÛ}?.†Ø”ö–0ÜÏ+N$œÀàq<…½å3"˜¥4"ãÁJ“å©t&I8£ÂЄ + Ðœ +O!Ô*<Ä7ªÂ¾Wëìaê¼Éºn¡n(–ÅFǬnøZ‚ÔÜ&&Å$=¯¿­â¤·¹i5ÔÐÓ®I½oLW t[æ`ïô%û®Ü]m².ž%å„W˜¹TÛ«o^­®†TŽgC59Åjßì$"²Ý0œôµ*ñíØ›vµ*‚M)_»Z_\íkΖî僿}àM,ˆñØÁ¹ç–n¨K?xØ¡ƒÈÙ̶üª pÕœsÕ* +Â`zÌù›c*¨CG©&gâÚ9… ë§ “¬ß¨XáîEÛÒÖ=È—U†ŽrùKrŒ*PÛ|¡çµx¾Tt='™¸v'-Õ3NR —8q¢—€ ×$t³Nw·©]VÛ!~ìÙ¾ +út N`N°÷¨ƒ•ûsÞþÙˆB—ïÚ.: ó–kA¬“¦ŠGmÖ”Vmç.¤%Ö.§xV +$yðИG²ø‚‘S·‡:+ žßÅ”D'¯«ã5\qJ4ÖŸô#Èb³=9:fÔÉ8êXÙQÒb¥¼·†“5Ž6ZÇœS®í%&ç@¥-ºu„2‹Gµî»Ž5¼ÃÐv£¨ô…¢ c3¾âXÕWÖŸÇN +y©a¢j]C*þ—Ä&1cJyfM÷Waj+ |–64)Tà²Ð?͘ˆ@/ ð¬i˜$6™ÉÌ +âýíåÄAûà-c`Nª¡ÁÌ -'ƒcMZÞ4ÌJ´êÎ\ùûaAÎ*ˆ¼µSJtí3–¾mÚð -Lp@eôþ™LqH-kþyÌÚŽJÎ-x›ò¡7µ-¼e ^’l ei Æ45&¯IÔ*©ý[šÓÝH9Ó.ʹÀ(r¶»ðFüvWuyÝvŒ Ylgžro³ÖMˉBÖm)E40ð¡ÈÒZ>,oë“û®´ þî¾,Š¶_aÖX[db¾i—ß›V˜ÿî\öç‘í{3'ŸÐùìOÍd“%û;Á7–ý™ø® :: šâ+Öýn΄…c芧Z5Æ+Ï|Þn4Ϙõ˜fuQ]ÕŸ ¬,Ží5¶£ª~ŽÛ1üøWÆD9~‰Ò)~¦«ùF øòî©÷ÖÂ~â>k{â8ÜÓ +>Æâ‚©`Ï/— ð‘ûˆí5“〤ÒÇL«&×ÕWs²ô}–6GÙ6} ÏÙ›|§›¾çZ×{.¢ŒÍI—‹à(û¡TH·Ú”ëY{A&3MpÛ9(zýL_õ{öØJä[óí=’]Yeg !× !†Î@¦ @s¦0…P›Âߨ)ø†¦à©@¼+)7^øý£¶è?'à6’òÙk))’ ª|óþˆ–¬p¬[—¤¤_Žó=,å a®=âùJ˜–cêŸI?<× gnï[သO—Õ×í7»ñï/P77 ʧq›bZŽ·øñ]Á¬¨‰-Ý8Ä“âº_#½Û@Ü5Ð<ù» œ1»ñ§ýÍþÎêÝ-xûû±ì01Ú²½c3}©I #Hï°]‡ƒ‘^yØ¿æ÷¿¡ +Ø>.ø‡q›F/˜6·g¬‹„Í*œ.àèÀøY³‚¢Ëõýi«ê`ΕÀÌØÔ61©!²1‹2Ñ­Ø±Ò ]ÏÓmÖ„Ã|ìv‘b×4"Râr76Û¸0(QñðêÕðÂÌQ`ø9—‡?¯øa§Ï/SmcÀ¼Áîõ‰oíÎr{ M‘Ö"Tªi2ã¸Î\Êcs¶KëØj4Ã?Öð¿ô7amÝî{P¶ŸÉ¥låjZ¨÷ú'ÝùÛ±‚ÿ Šiíîendstream +endobj +6476 0 obj << /Type /Page -/Contents 3268 0 R -/Resources 3266 0 R +/Contents 6477 0 R +/Resources 6475 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3272 0 R +/Parent 6457 0 R +/Annots [ 6480 0 R 6481 0 R 6482 0 R 6484 0 R 6485 0 R ] >> endobj -3269 0 obj << -/D [3267 0 R /XYZ 85.039 781.388 null] +6480 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [376.679 337.371 512.306 350.273] +/Subtype/Link/A<> >> endobj -1106 0 obj << -/D [3267 0 R /XYZ 85.039 683.504 null] +6481 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 326.549 194.521 336.117] +/Subtype/Link/A<> >> endobj -3270 0 obj << -/D [3267 0 R /XYZ 85.039 661.643 null] +6482 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [288.68 310.273 504.006 323.174] +/Subtype/Link/A<> >> endobj -1110 0 obj << -/D [3267 0 R /XYZ 85.039 503.514 null] +6484 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [390.793 251.851 484.421 263.844] +/Subtype/Link/A<> >> endobj -3271 0 obj << -/D [3267 0 R /XYZ 85.039 479.532 null] +6485 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [335.18 211.204 480.851 223.196] +/Subtype/Link/A<> >> endobj -3266 0 obj << -/Font << /F62 1689 0 R /F41 2104 0 R /F15 1628 0 R /F20 1617 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +6478 0 obj << +/D [6476 0 R /XYZ 85.039 781.388 null] >> endobj -3275 0 obj << -/Length 3307 -/Filter /FlateDecode ->> -stream -xÚ¥]sÛ6òÝ¿Bã—£n*š$ø¥L.3vâ:nk;g«“‡^h‰–x¡H•¤âäßw¿‚íM•³¸¾½b€›þý|}ûán¤Îg™¸½èÅgœº»ÿÕ@->òèáüæâ|úçâ—“Ë…Eß,tÃX!üñ§7Y¿œx®š§“g{®?ŸO¶'a¤Ü(Tò]ž<œü×`áµp»FÄ0 ýÈUÀüLynš†F~4"‡Éš®¨àw Ô§¾ó<ùNß݆'¾"ŸyÓuŸ°îñW‹ðÙ3žÚ ÖÇóà†¥=L}“ û|ì¦3˜®<ˆçŸàƒù·.¯è8ÂŽXºš—:Dó.ù3œaOfÂßÌG͉Á6Çõæ+€K Lôsì/§AÓ4²]=5B>‡Ãý²Û7SÙªœ¶fØn“u<*;sù g'l. Þ(q­kú¹(K=‚MQöXʨ“êÇ.#‚ø³É‰¤OÛw(dÚ°[?h‚5~?ÓþüW#—Ï(Í rnóîq]ßÁÊϱ4‰\"™’ëOü{¾BD ƒ°`[° 0 œŽ€¯³¢â]V!ØžPªeÇך• {Êw†|@ýI@ °b³WUž¯K*4¥½èðƒ¤]owE©¾Â…/xãl‡:×Ô;¼È"ëdgÖ¬÷ÛÜ\}‚Ñ4“’e_Èäȧ¶Û¬’£þçE^‘¿AâÏ~ŽbËÖTâ¹aˆÅm -´Æê5û«¶’n.§ŠMé¬$“|Ä•¯’(7£BðÉ]‹r“8u,²bÜÅ€í.ž‹ -iséêkæuàWÔÜõã¹@ƒH|ô°~ì,6¨ÛpÑ ÄûÒ¸œ) ¼õ&ËùÎS¤çÈx½Ç]ñ¬¾6ˆ@‘Ð…àj!Îl6ÃM¥Ö„,dG·É™he=óƒÄ ¢á-œ!]Ç d¦Âઠ{ õëjÍ@¤ÒŠ0 - Ía:§Ï=§¼¼Ë0¹Ž}O®3á‰ÈÈDÊò€,C€U¾2p’¤apJd‰´oNy’\R%Ê'¼Ø\“ <ïA©À§úvÏòny‰Šºq—uõ4".ßK æF!üИ(hF&Î9Ùžê÷þ?$>°ìaŠŽ)4QŠœ),ôâé7·­†bçŠgÔ}öš?28aN—à;9š„`›‘?ÏgºÂU‘3õ°h‰ ˆÝ#¾(þWË£[b¼»¸¾{à‰ÁVq7€±¥ø ‡)œB±ÕH.nËäd’!ÂE>j‰old…n…õ¢:ö±FSÃ@)2A#mjˆÖ0²äÂÈyÞp0•¨ +,úº“OVA€lÅ«gi]p&[QÒ’BP*ÚÅaÔ¡JÙÁï—j è#Uiq×ØD"9šR"lÁt «$xpQ‡l vÇôva¬ä™j Ƨ:Ã!i˜px­ø\FCœù¡i ‡=÷œÓá}1n1šÛ)a®‰ï0lu+ ‡p°zsÑ/ž‚ÐÓÀwÎÉ_G©aC<—àa,Y%0›1ò[ôÓsÐ`­R:ãSq@¿-é½¾Ø ¬P¶ ¿(à â4ÜÒMÁ^‹?—šDüàIJü._%9lÅÞÒ"#<ªVÞ—(IĪ$2.xÝP´ãe*l0rìWµ¿H©<º£8åü —º¼Ù¶<<µ¬Ý<Öd§ŒŸ³Zœ®êmFv}Ê›²fìFš<+QÁ5R’)¬ ×âó†µ!T€ÒÚ07S/äS*0‘Gi)³•÷%æ)?<ÙÀq Ó], ­@¦ïlи8ÎÙ(ËÜ™RX{Cæ;ì !ÊRüúZ販6Yªí.G[X„4®¡dj2ÒqYh‡G(KŽ›ÆAgœ#ă®”ÒT˵€¤7!}5ë¢ÏÆÚ92]âT/rjçt¦ä;oFj›˜B=î#¿WÅ_¨á‘4Lˆ ú hß0ÿ‰ë§ÃáæüýÇëÛËÛó›Ë·ž÷΋Àoþ‡·>€üò¦“Ià’Š¿Í¾ªHVøÆ€¿Êc%œ§Þñ9î*¯òEX²å†<¥æG˜© ØC§täتì³oxÖoYu“UÇl¶ÿ”M]zÝÝÿzu÷û§·þãð䣄ɶÓ'_4õ3œ.ÕœÜd¶Þ<%ŒW\Û¼r¥ÑÁɯʷ)©ùþ~üοlóí#Åbÿ‰Í1¯3¿|™ù÷uÕ5`rõ™ÑÞ²^׃Ëi_?eup¹5™é þ®|ˆëº‚ý˜uHí+$MÙA­1ƒÒ*ŒÂ}R°ƒÀ4Ö-š[í¨…(ïúŽPª›·H—‚Sƒ€+#Õ9‡UXã.èº0¹ŠúH@Í!žÖ0î ¦¡e:Å•7Çíìa‘® 7Ö¹uòɘëA𧲆@̯¤†Q"Á»íxjrïVÛÁ({€ÅûOgÔþ»ÃFmZ)xJ˵⓹ÙẆšV…éSÒŒ‡gùßE°àú•?玅" ¬É:Š~*=u­rLq¹öƒ]šuRî%ÓؼBTgv“Œ—4JjbûVÖ>Ü>È)Éà1keÅp ã—b‰áxŽj÷¯ÕŒ(îÈc0¥. I9ã‹‘ùN÷\ÎNö ‹„”T+_]˜nÌ¡o -=N -¨G[`o)©®Ùö·â©Þøh|¾ó¿ˆXq€-q/¶»Œ›ºíƼBì»i7ñTS|žu:E-j[0|­^ V½¬i¿*/ä ‡‰Ôø-ª•nµõå ŽMH¥v¡ƒ‡™›' ì§ÚÄ aêùɆ¾Õ'ï’@îHoì(=X–Eÿ¾1ˆ¤IÔu“ðÊs”Ì°~W¡·œ7 ó-œ"U¡xo%üúÅMog§‹Å›¤žøaiKl÷¿Í°uP1`Û]™¿ðü¦è„u¥D!¿Ïìòay“õyÕòäÐoU<™É¯nHÂp´!™Î_È›5¾@Q¹bHØð{$l‘1,eüc—øcO~Ù±°muv®o§RŽ”°Ž&BfAá&°úí*èó4üè[W¾tea€^3yl5÷0G’WB»z¡ZAãÉ„Žó1ˆŠn´—« •ØÙõ}݆-fk^¯U‚ TÉ~µþB­˜À4—ʆlwô -sMMŽ•o¤í¸7‡+R« -š7m¶ê&Ó]¥XºJ’íáÄX%9Þc°ª7ðõYÚyFòÊA™¹â3¤|K\ L‰‰óoq»©ýR“ÄnâéÇ·#Þ6uÃ4’u9†ÂsÁ; Ä»`pùëœ)%FNšª.“‹¨XªwJ*µ¹¶.š¯åN´˜%Lƨ°üÐå)wž¶[<Ôa~Na«ßLt<è(VV¶Ä=ŸóÚ%-ÚìçÎ~kî(ëú=ò‡†7˜ ]_ -è™ÖA4Ïé‰Ûë›Âúc:Ð6ö±§¨cCÐXý9.”wD—yúçn@euOµÓÀ¼eÏ®×è1]Û1eZëƒf‚¹We\‚éõç}¶2ú:«Â`üo}„§ö·4 -K=#ŸW9À< õcWé'sMàߺ aendstream -endobj -3274 0 obj << -/Type /Page -/Contents 3275 0 R -/Resources 3273 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3272 0 R +2570 0 obj << +/D [6476 0 R /XYZ 85.039 381.258 null] >> endobj -3276 0 obj << -/D [3274 0 R /XYZ 85.039 781.388 null] +6479 0 obj << +/D [6476 0 R /XYZ 85.039 354.644 null] >> endobj -1114 0 obj << -/D [3274 0 R /XYZ 85.039 610.729 null] +2574 0 obj << +/D [6476 0 R /XYZ 85.039 294.83 null] >> endobj -3277 0 obj << -/D [3274 0 R /XYZ 85.039 563.392 null] +6483 0 obj << +/D [6476 0 R /XYZ 85.039 266.032 null] >> endobj -3273 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R /F20 1617 0 R /F38 2158 0 R >> +6475 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F14 2895 0 R /F20 2865 0 R /F35 2880 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3280 0 obj << -/Length 3404 +6488 0 obj << +/Length 2519 /Filter /FlateDecode >> stream -xÚ¥ÙrÛ8òÝ_¡ò¼PUÃûÈ›íxÍÄŽ×RÖ»5™š¢%Ž%RCRQü÷Û@R¢œìn¥*@£Ñw·l,øg"ß´ÜxF¶éFÑ(ÝœY£%¬|8³e‡5òL+ðqér~öö×ÀÙ–[ñhþD[æ‹?Œ«wóëûñÄu]ÃqÍñ$ #cz;¿þ0¶û‹qäóéíÞp3ãñazûþó؉ŒÜ^Ãîù‚>ßÿ®wÍ?òlvqsy1þsþÛÙõ¼CßÄ3½ÀEÿ>ûãOk´€7üvf™nö0·L;ŽG›3ÏwMßså{}6;û‡ÆÂkÞˆO °aâÙ¾éÂã'®eF‘§ùaûü˜¯2$92 -xP²‘óýØ ²Øó²*w0nÏq‰€4ž/ÊM’ã©s>ƒ›á8`YÃlýÂÛR‚øã 0LîHËâ 6îjB²d |¤²Þ¬ÂZ HåßÆ-šŒMämùÓã’ÅBáXàÕ€*_âmùWËöÒ„îr"Ç(Ÿx™HYäiÒäÅ’AûUÒÈbÍ›a8¯wFD&Uyƒ¤½ð¤Jñk•7YÚ쪌¡ê.$œp ’!à +âíééô6«÷ª"kx]‹´ØG½ÅBœYFC/Çœ+,å0/ø?K¬ÉjABïwØ FЖ^ºIª^(’†/ËøÀÞþc‚»¯òéQYA‚Íq¹,6D9ðr/$ú"O#8]cÂÖ5,«&M9AÀœ =Z'D€{^Ó¢‡IÙ6îéãË. àkÞ³IR|ÓŠ˜— yI• ­Êê–œ²à×€¼ÑV€ϱ'´-ÏAžg¹LK¼`_ð‡hۮ \yGžñV=¬lÁÛ–Â=y&²H~éàØ‘œ‘ôâc5ÆEÔ{$oo@“üÑ”¼¸«‰x2¡ãWÿµS%q9Ì\×Ø&5A÷xMY-xñ«å[Ïë??šŽ_=c /î¯à |}~Í[Nølnèˆp]cSv©a4è…Àâ•Tð²=AWB-ë]RMž º¦ÆØi™¯4ŸùLz‚~%Væ[5‹²ªfÈ~Uòp‘dU¹V‡Þ¼b»Š‚?6dºât4 5/’?A -Ö‚Œ_¿Ù¢»~á›Ë-)ÍMÅñ†Êñø$Øé‚Ôtc«¡¤D®ã²½Â´69Ï6¦D ÃMb5çãZ\¬4‚Õ÷ÿ°òe†¡øž?Z­xƒÃž±: íý¿ðSo8ôƒˆœÌ¿¼6(þbÎ+¥¸sÇqÍc€¤go_—I?dšyg; ½ÑݽâÐÎLzÐ@¤¤Ç'b-‘µ.ÓÆ%/‘ü,Ë`›õ(Rd‹¬‰X ô$x¸)ydvÀ¡!-Fx‡‚ó‡²âã «ul¬K2ÅÒ“yyJ@Pe„¯Dú<Ë>pèS7'’%zX"zJé htΟÒ)<µ%i„´_„Šhåvr¬€ H]“_…³®×VzNÊ€«7Ú¦én$çØ/ð)ÏpÐɵÂÙÙÍ%:E†%”ìð¼YI€õ<¡ €è˜A¬õìüaA»,•º1ŠŒ'·ìø.§Ÿg -èóBHº=Î hí’^7äjëܼØèÑË;öWn`ŸiÞ…Ì^tôágÐÛÉûøŽ§è]Gäº~ â`£¦Gåû¡Ž«œ#mëÝšR%T<ÐÉgáħOW<Á×~*—9ª%¯Ð¶Lèªãô…ä‰k;\Dè{•æ*¼#4eUÍøY©Ì%-A¦­Mø‰Û8ÆÕ´ÍóõÛaÄI¬DüeÊ[Oˆy@m™H’¯ïŽïMVt3x×/±’¿¦¢˜Êbž’4S’F1[>%²u;å|$ëºäËZ)ÃGµ“øó² 7C¦w°ú/žãÛÕpÈÒaÍg¨<ïp_"¦Š×4 ¿þ®:ÙéR?‹×;ò‘"‹d+”/…èƒÑ\qö¨bÌo;/ZË àÐÖ½‰ŽVË¢ÖCà¦\ì*Œ:L ÃNM+šu0ï±î˜ ó«»·SL¨ãàÈYâ ât;u¸†ê PPrÉ Š½$Ù'×rC÷04—놔:ý!•žó^ª~aT>nþf(T5˜ëõ!†är¥l»Bµz;Åéæô¯GêÐ3¸bã0!:ô_Éÿ`±Í3ù;á!-ÑË2¨JT ªVẂz—AÞiGY3màTˆïNŠ\]¶¡ÿ1ß;˵ó(ÚÙýí;¹]Re*1”Š3—d§Úð)ÀŒN§¹ÍŠó+f*²÷ŽAíjž-$ÐYCÕ?«›šâ½¹N^ZØJU -&=1;@`T¦9#ä£é9áPûÆ M't#¶é8¶nÞ8°f›12©mÞ8®é˜p'¹:ß’fNh¸µ³«$åŽI0¹Õz"Ç2ýøí¤ ò)n$³H©©.ê(/Žu¢EYd&@"zƒ²^—ÊeqžB¨r7"³JTÁÅ( ºøÕ²Ý6sŽ´ß€õ}ßgà¢ÜY7eEªÓé8¹m3ä¾…«vÜöÌXìv,ɹ¤jÀ§/ª~Þ–Én*øq7w’}ÇHB9€û ÔPí;îf¯[%rØ9^=9N86xˆw·ýCu~Ü7'”mX1D?«“7¼b[ÛçµMNqr§§ÆÖ+x¿©ìå¤6–• Ë@ 9•ªGöŒ£¼ËëVn|¤[ú↴s [‰Îá\R‘LðÖœ,(­cà¢m˜Dž:ñTV-ͯ5”…™^vEM+_¥Ž™ªDsÌ߶yÕÍ^a‰ýL@r>u¿W™@žHÇ·NÐaÞ{2¦e^Üé -«Œ :Û¦ÅRò4ûÞ‘íR0'žà ¶~XØ -[ñL;ü9T 9ék·™!n×eÆ#†*ã/îÖ .ÎÈ`Ì7umK-1 Bôš’6“€œÍÌÌw0µC¶÷f,&mkE³DѸ8r¤!}l Êb‰»!ZJRmúý—àÀŒ(½$3 -\¥¿å35ÖÖëº! ÓE×Æ]Å…ÜMq¬áœËÂ…ýXÉ°4‘;‹R¶4˜ce½i7§>n·‚¶GAoW7UÒt›I­°AÕëX≉`QÅ7€òδî4¬<•#VI -±.¯ªø:m0­þ;,CO:$I},N<`J<æ|“¯{-Á@ÿÊ3p·:§ÆÙ÷bõ×DÐò G`µ CÀµ/©âgì³ðº¸‹À> Éë“^Fõƒçù›ºIšsj›zê7;n‰'¾©CKÀŒ[ßÆ>þR¡”±†æ2éSÝ -«VÒ9®‚˜ÛÐWõ5ýÜ<•ONì €D7úA¢9ÁÏ%ºÎa¢û ;b‰í3ª£$ßÅÀÈíãÿ9ÓõôÃ)¹Çá»2ž3¬c";ýã .¯;õ:çXt¨àñ†5§GÕà¼óšgZ<¡ÜFDz, ÞûöW·K1¸@Ó‹\õø;ÞâÙ-ÀqÏ÷dÇ(W@"¼þ0½RŽ‘8‘¸Á¨KfÿžÍ¯o\g监ý$1ïï§ÿ¼¾Ÿ ¡±L˜ü–k(iGOÔ˜Nšîqçص=ƒ¡a%yAI¶/>&œþûƧÿ:çD˜Æ¡wv¼íà öÀFnóÁ¤éúiÀ»L(ãБÒåŽôñã]?‚i(ÏÿtóÌg6ĵ±Ë„Ö¸ÄGëŸÇ*îÈojÕüh:­U×é$£T4cú'±A’s•€àžM²ÝòÏ §óÐFÅ ôå[l¯ò_¸ÊÖÊgÁF>ÿYwÔß p%`ówcÓEEü¿`«Ø7®ÊíK•/W bß/å^~Úqñì&O«².Ÿu¬Úá_at„Ý -ÎÔ˜ðP'اṒ}<å -Ì?œ=¾ðH6@Øi,‘¸†âªó,Õ-=I`ù ë>"•:x- D¥ÏBSYé‹å¾þ%›?Å„öqiYˆ¡õ†: -"` n8¢Vïh{u¦N•<¢'eœ›íŽ -îMVŸ&§Ã—öµtl̆Eã:IW fVÂüzUîÖJ Bîs¶fc.A$ʌʿå‹?ø½†\Ï|EÙàSO_½]'©Ò¼8`ãS^ÕbÊz·)”!ÚiÕIÂÒ²:¶RÛõÍæù=²É3öè£ròdŽáØži;î🄠ÿߟ\¹¡ iÒâ:ØaxH¨˜²÷3ŽÿÈ‚ûendstream +xÚ¥YY“Û6~Ÿ_¡}2µÑ ðÈËÖøXÇ)³ž©M¥’Ü(¡˜ Él@óæáæõ?c=QŸÙäauØÇøÚD“‡åoÞÛŸnïޛ΢(ò"íOgI’z·_n?MSíýzÿñËž»ýòŽ÷_?M•RÞ¿û©û©òn?¿¹Åžöî ÷m&ÞWh¼™Î”÷é=´>ßOÿxøùæýC/s/ È—¡ÀÞüöG0YÂá~¾ ü(K'OÐ|ÓÛØ7:’~ysó¯~+žÓ^5v?:Œý0FøiªGi” +ýH…p‰&ðM ûKTÃKTaêÇIÒ”…;9y ÌRƒÄ¼eÕ£(½’p ¹Pnëƺ)bÃÅÕ• ±±Å™æÖ’ÍdãPÍgb9IƤõÁ) ûw¯ÝœxC )f+­-[_çÚÑõá¤æLøeщ¤•pÕ±ÑÞ×¥ìŠgi»zkéXÈæ©ÀxPf­Ìä²ó‰çêâûD)±þvz§é8§7Lѧâ¼t»h’ØbÝ£·Ô¨€ªÅèšx®’)Vp nØN‚eýFxM@y~< ì—cd |G/ÄÈÑ•)D/ÅÈk ]Œ<å7#ü~E´Ié+‰85k€›·µ.Ê=+¤‚š#l˜…t[x¯5]‘—LzÄä‹GZÖkÞ]ÒZ)ðŠÆžzgíÈ|q,irþ,í|/‰-1XÅ1¢d¶iYÇžë[^Bajï":=gp7Saâ+ÈCKð))*XÖÝ8Ì@”>Ç„™s$ô ì9E:ËѳhCt ؘÃØ^v°U½@›£2ίûèÇ»ÊzAèýKÖ"ô9¢°MsfÝ…N¼û:01ÔU Í«–> ºléŽèK¿ÊP,ýŒß˜¥ó3Áù4Ƽ|†¿¡›FšJ@ Röík! \*&KÂÇÕ]oƒåEU?°¥H´]“/deᆟó)vHqبORzã””k¸#ÆTYì$ªžÇ1™2Å2hD. /a8s^*c$éíùwÿííÛLéR†sA° LËò²‰E‘Ÿ¨ä;]11!zÉÄ®1t&vÊoÔÄüîz3 ø 3ãr#BJtY(V” Áðhd€9ɺAz—sˆBSÅÄŠ rþ,¹j]ì·Ö‹8L@©*þÒÆX @Ë êKöÚ£DÜxiDzß.‡ºÞY]šŠ¦S,¶Kû}jbÁqî(ÅôMòÒlíV RK]Ê?ÝÏLBf&FR€»…°ª´7}„7eV<|UgaJ9jB™€…ƒoÎ*¨÷ˆ¸°Gâïy{v­†'HNøŠ‡Ö»Ò"ô0†¶l½±Ï²9ÁÜÐöÈêœEY€£K9:ØÚEDF ,ËâS%BJ\¨­¨œc:K,ï yç Šû(pÑXÚ®#´ôü y:Ѿ ²«Ï“r—fµé˜ÜEœXpÓŒÝÜÌ€ZAvï':Ò4BÀÐ9aåÀ—‘°Qƒ3GØŒÑæ &²ÜA¥siÎtRæ*¦j/ÇpäëÏ­š÷wç‰ðˆæðr‡†màŠ2FhÒc­"IE˜§»åó÷K–L²¢Ô€­œ)[´ø„ƒŒ Ï„hè? m†dèHÒ‰LŒ  !¾#Ü)yå )K†¢ñ $Î~!½H…AÁz(Ž´€l¬—±ÂÖÏ?¨OªÌÏ]j@[I&/H8Ѭ…âÛ@GŽz6 ?WÒéžT2ÓA:Lš?¾~=,ý£âS4^ŸŠ…Úס:óÄ€ÍuáNwBá(’HÒ-ûG‡ÇãË<üB¯²SÚþÎ%n’×7µÐp¥¦)ŠWŒsC°_‚ U¹(‹ž?ˆŽ7CÈYOÇÇßïw;Ä pQÝæ׉ŸÁ@0¨‘Z™ðK™_6Î/Õ~–¥Ž(0 Å{¸ b}|¡71cäi “ÀŒ& Eÿs Š•oO(?ö¾6,Dø†Y0y(ÅÖ^Â0QQh»n¹=š_/Žˆ,×6ç¼# Ó'¼Ïà Ó¼À1ŒüÌ1J_étÏ@x;Ô;: ‡Oë8¹=}/§ÑŽó"5Ý{´åq,E”øè Æ }Ž°3%Á_ŒÊñ +ezrö™þ³oEÜù$ÏäèCpÆ%SŸª­=ÖÍå•ì¨$›c>]öË[Á¾ˆõ÷UŽ­+saO¹Éåív×ÔtÒÅàGù-ÌÙ=ùºäÞÖ[;ÀÕ‡fß÷ Êç¼(ðÃÑ ÿùþ¯ßéy3òÓ(·2†>De‘…@@lNå5Q +Ð::øµÎLendstream endobj -3279 0 obj << +6487 0 obj << /Type /Page -/Contents 3280 0 R -/Resources 3278 0 R +/Contents 6488 0 R +/Resources 6486 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3272 0 R +/Parent 6457 0 R +/Annots [ 6491 0 R 6492 0 R ] >> endobj -3281 0 obj << -/D [3279 0 R /XYZ 85.039 781.388 null] +6491 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [218.97 417.072 325.417 429.974] +/Subtype/Link/A<> >> endobj -1118 0 obj << -/D [3279 0 R /XYZ 85.039 475.077 null] +6492 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 392.701 133.339 402.269] +/Subtype/Link/A<> >> endobj -3282 0 obj << -/D [3279 0 R /XYZ 85.039 456.811 null] +6489 0 obj << +/D [6487 0 R /XYZ 85.039 781.388 null] >> endobj -1122 0 obj << -/D [3279 0 R /XYZ 85.039 276.834 null] +2578 0 obj << +/D [6487 0 R /XYZ 85.039 474.509 null] >> endobj -3283 0 obj << -/D [3279 0 R /XYZ 85.039 257.962 null] +6490 0 obj << +/D [6487 0 R /XYZ 85.039 445.105 null] >> endobj -3278 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F35 1632 0 R /F41 2104 0 R >> +6486 0 obj << +/Font << /F64 3112 0 R /F14 2895 0 R /F15 2876 0 R /F66 3242 0 R /F20 2865 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3286 0 obj << -/Length 1706 +6495 0 obj << +/Length 2917 /Filter /FlateDecode >> stream -xÚ¥XmoÚ:þί@ôéd oÓt%Ú²ŽÝ–ö¦êj›®LbÀš±³8rýµ‰í`“ÐNÓ:Å$±Ïãsžóœãxu—ÿóꃮãúÃzà9þ`P75·¾âOnkž|íŽÛëŠGWóÚ»½NÝs¡;¬Ï—‡WæÑ×æõ§Ñã|üÔjû¾ßìøN«Ýïš“é||ÛòšO£ÖÀoÎ'ÓÛü…ûY~}žLoZAóYÞ˜ŽùÛógqëáé/ýÖüS>šî¯F­ïóϵñü_;p‚ž/þ¬}ýîÖ#¾‡Ï5×ñ‡ƒúŽ]Çë›ZÐõnàË߸6«ý­WÉŸõ|V‰Ú;tÜÁ°Þö]g0´?ün‰?.Zín§Ûdkšá(/ ¼c€ªÛûü -ÒüŠ!`rH‰šƒPi’_S°pòÑ|-5.ù \sa -á*áOìmx ±üº‚&c "c -VJók M¥TYb)HÆ¥„/MÓÍùì›Ûu´'×Æ)¢„UÃ[@Lw|ºç¿Ó•¯TN›¯Õ¾–Cs§Y R´P÷w(]ç£{&”Ñ¥D}7šÊû€€”þî8/ÒÆõã»É£ŒÕfMYzf†´H¤<¶„ ³œ²¤˜ï‘•òQ - >z_ºx©AßëºÍ‹Ç§q™ÏäÓ›‡û÷"ºˆüyn•ÉôúîËÍ8GóAlƒ€ <;åj|;™þ;ºã20ÍÇç^OoÞôâ7ÏÜB -:JÚq‚Hª]U=§fÇ4Iw~‰:Í"3‚“9‘CDì ¡S2é‡SÙÉ#ÓP¯c,ß<åªQISÀP™©ô$Nx²€H%.÷ µ&‹Ð)sáJݸګ _‚ §—…!¤9›œÁÆuÁ —Xdi1=$ZX(Qb–:jÑžcD¡ 7ŒâLh…t8@˜9oψÒÀž8´$x #QJrWvøc4DàX Ërïuƒ¹%¥ö0DKd…ƱµpA SùcMw¥X,}MèŽ)çkeÂt¥<ÍnQ¨x°€k°…fë $[”P"”Ÿ)xÔ Ç(.¤Ô&€öod{Nèȱ’z(5EŸ@¾ìÔ˜©Q©úU‰ð ©Æ|#í2¬åÕ@ðìYiÆœò6aµ6·PL$Ú™J©;ŒÌn Éy0¡mÜÁè×*íìÀѽN«FUÅ8Q¼%MB»%xúx¦0½š<Ì -½Ÿ^Ím)7ˆº½ÓB£Ä»ŽvÏbfÕQM3“à Uf(€tZZ!‚çôÓ`§ÜZEû%›¨/ÓëöhÅó.U -«6Š¬ý§Q­ŠU¸ìb"˜›òÿ…ZÈ„,ÀÄ©¹‰•£»çÑ?³³¹'t‹"h˜Ù€8Ö»\ê–W…RÉO^^!˜ÙˆžÕ½¿2ŒôÊv^+6Ÿh­l“)ÅʘMéB4"”pyF[èTãš½£¢ÚÔ]k‚7âlQبèHà ØÄ*¶‡&ÚFº€§S+aÝ›àÙ‘Ó0bVãߘfÏx8î™Ê,p4‰ÔlÊ#}JØpEâ„c:¯jXØôM ˆli.'<ËBAÃ%½?‰î¸7ù›‘È>˜·j–0`Õá7´·ˆˆúq©Z…Êã‘:«X9n0::=:Çt z戛(º0N{Ám\oרëE3¢¬ýÌ(— û¥žH”²«UÂ0ŠD®gy8oZŒR³†ò\¿8ƒ–LW½új´º¥ qrÜ?’mήÖâ Q‘'%ŽÁßøP &zn‡ßr†ü¯ßjwzB:¸qO}£|NB¦<-{®8Âó;GLþCB½¹~‹E>â&=×m68Ír:V̓èü77sP§­86Êø[Lu|i*¦q†lÏwåg’vo 6Èh¦[ÒÓ•» {}¹ð¡ÏcÉ–¿Ñïw• Ïg•Y§mL‰‚Çíøg;œ€Ci÷;®Óñ‚òï´r…ßûê÷o Ñ¨œ^ÙGN¯?°z=Çï|xðœ5êNendstream -endobj -3285 0 obj << +xÚk‹ãÈñûþ +s"ÃZ#©[¯ƒn¹ä²G>„»rù Û²­ŒF’wvòëS¯î–dyö÷£ºººÞU +7ü…›,ö•oÒ,ôU–m͇`s†Ÿ>„¡cåÇZÃxesgvwIä:]…‘;vi˜ûJ‡óéùÃÓ_£`~’¨Íói†‘¯Âh“äÚ×JožÿöTìowqx¿lC¯¼nw*ôº-üë·»Ð+Xmqt†$ñ>Ýh2lÿóüó‡¿<[äþ$|®’lv‘òUªÞ¥?IRx£žÒjxQ2£F¹¡?ÄèÜûÜŽ}G8ÞcÕµˆ”ãïÒá`ˆŽ0Þ„ŸùŒŽ(óÓ4%:þQ#ÿ9Å?Ji¯GvF©×õ#.(oÆÑè6TíyI^¤”À -чýY ~™Pj wð{R—8‘Ôý H=ÿiEñÖuqGI’ûyº dÁ)óû˜ð~¯ÛìBøiœÁÕ;_åb˜xcñ²2ÏÌ`ÿbÆH}ƒÀ´{cǽErÄí—j`ß‚P×¾éâS'ðxô ïên 0Üöæ†jä¥BŽ yÌb†Sˆf]Ô*÷~À‡ x²ûˆ`™w­Ëb`bùùÌ#z}LJy‹ÖWQF# ÆÃTêØ‹ö\ysOzFÇG|À«p °µ Ñ—µa+Di0gB +Û¯[>4ž~s˜ Nøê¢Å·£þÒâxÙZ¢ [pl…` ¢ƒôú`&õ†àx-`¯ 綕‚ŸE㡳ò†ÙXñIV¨)C¨SØêµ$¼£ü"p§ÁûoLÅ|Ç)EŽd"º–!̸K–^xâ½Qð_Êú*+È“‚¸ø"4lÑÛÂüUZý†kQùngP¨$ +¼_‹áp­¸W y/j¹sð( òߤ&!ˆÇÆC ƒpPñÛFîéiWžu'þem/»«0ѼâÁ =†æ_ˆ/pcBJº¤g FeØÿ˜E&jf”³¼°’WíqEyJ0iE†Fö7°B€ +†Þ?·™&]‰b§Ž{ñãW`û„|íq¬½¦ëK?ˆ^(ØÒºÛÈsr hâ…4FÆ’p÷À‹Ú˜Ñ6T(ÃúM¶FÛÍö™&vŒÖ© "ëÇ{䦰'A/•fi JP|,ÂOu¶ìïyiâR;*ÍIظE/T«t£ ]ìWVb i6y@²4çnƒÜÁ?ßË/öŽºcÞ•=o¢œú +Ž¢n½}·¢Ö5ƒƒèçH¼½tämÄh#3oà+`ï+¯VröT ãCoó#ÊJÇ^Û<`?ÜP±!…A-‘ôîø븓©–ÜH¾@cÀ9ËJ7ÛI¼»Ä+ë_QË;´‡®c°þV÷BcI&;8ÇU0¡G®ÅجJ0BTµ8óŠs¯®†‘GòÂ8·j‚ð¯U-&c$¢¨ £ +ƒe…Þç/8nÄ“|3´_]„;Ø»ŒÝÑžgÈŒ¾#;+M$Á þeÁ àQ™º„°kg€\mQ5Îäó Ê2a=õ˜õûºläÓò¨×T0×ãÔñ {QNÌn0xÆÎÜ „¿"+8@$#tþgž×6¬Ž”(ÔÎû;×ÜK-Lvãß‚8`ˉ¼º°Š +3Š¤Jìï2ä8>Ý3Ç{V¼e/æG섉‘ª)íf×PÑ|ã‰e+ѽ§™ö‘,¾oØØG6›<›‹ $™$<¦cìú¾L×þFîÜ@–Ë?0wä`&n­w¾Û¹¹e×$ý0Çv-6À[à°x0ëßôn¾Ò?YàDÂy϶ª»>\”k61‡ô¾s#0߸y oþ3ÖU±÷L* ŽÛü2#{‰UcͲ`I˜®OúAÎ$Aù_2å?LÈîI¤5JâH¹dÌ‘ƒl`:9XðZ ¬ŽÀ×jD©%jjžcë„$^éU0ŒKXZ9d3ŒÛCä±ÑgX!k€ì²e£Y¡+˽òkqà “WNm²iÅ”™ ݳcg½"Ì(øf®£òÀ;Ô&zó^1ÞÃ`ÅÕv ¤†Ë$‡øÊm +´&&+sé„CT®x·¾´Î»E1¸è]§f%´DYä'ßhÉN`‡¹(Ñ~’Û0§$ÌýHaŽ‹¨$åªïKY?jcGIòz¿Ó>yé" ‘Nk«år0ªÜ4$p¶[gÌZìs`U‚ƒŠf¼˜¼PÅðô±ã9«®Lrê 0nnÒ\ +M "Oü%Ò¼ÅdÇ ©ºë”p³îÄB 6Iïšœljo“×0µµ »IE×rïµàŸY„”:»½\Pñˆq T'¨%ž×6§ÀW×âf WBuðÆ@ΤÃtöPb .º*…^UûÜ™ý±\¦ +§ÏíÚw*¬(N×êÔ(&FDqÌî çõ´!Â{èùðWälº¾@‰á(î*Ág‚4ŒÃ€·×±Ãö£ñ'â(L ¬ò¦ØÖ@¸iYG—\ù5TWàý•Çÿ •Ø¢…5ž™óSköçj¦}âQ¤A§ŽåõÑGù¼‚i¡ÄîÜ™zú:¥Ë=ÐÇ *Óôå ŠÂc5¼Haú*ì ˇ™Ä3U‰ì(YQ–Þ}vi#Ì"Å“L¡¸V2ú½~€ÒÎI @^…‹’¿…ôm‘¾14{²ßÎË’ØÏÂLà°ë“ú7›Ö¿PÜÞE4Q¤¢¶ E¾(Ëý, §)!<ôt£4U±4rí؆«€yly€ëõ\Ap‰2‘ó¥ìyê2iíýÕa”][ò áþ;ûVY£è‡Ô¼¸ï&W¡«´JÐST':ºó ÷ñeJ>2ˆ­|á˜ÝêK…íiÑãxF%¯7Y•ó=߯È.QÔü]üEŨ+Èþ‰Àêð§ +9;º ýSÝŠZŠáºÚÃüìÿ¡YÁSµ‡úvüŒò šeÌâe‹n~Æž¦qÍ¥|©àïºÈqϪ,õ3¨¹Y»ß§„u©Úr…Ä(Lü8‹Ëë…²$ÀÈ—J#Yãä|ƒß!ÐëÝTp3mÑȈÒYjoÉÂ,‹SÓ¯õZ —yƒË~̱_Ž´ÖÞçYKmÒE›Zêɘf'¶zZ6õw’ç~˜å¿Ãä>(¹ÀI“ºAKC…^O»@òóðaòe!ïS/(J„òÀ$Y^« ©ßø°Yendstream +endobj +6494 0 obj << /Type /Page -/Contents 3286 0 R -/Resources 3284 0 R +/Contents 6495 0 R +/Resources 6493 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3272 0 R +/Parent 6457 0 R +/Annots [ 6498 0 R 6499 0 R 6501 0 R ] >> endobj -3287 0 obj << -/D [3285 0 R /XYZ 85.039 781.388 null] +6498 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [232.013 625.659 270.975 637.349] +/Subtype/Link/A<> >> endobj -3284 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R >> +6499 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [341.801 435.668 475.519 447.66] +/Subtype/Link/A<> +>> endobj +6501 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [250.165 336.599 295.309 348.288] +/Subtype /Link +/A << /S /GoTo /D (diagnosis) >> +>> endobj +6496 0 obj << +/D [6494 0 R /XYZ 85.039 781.388 null] +>> endobj +2582 0 obj << +/D [6494 0 R /XYZ 85.039 761.463 null] +>> endobj +3060 0 obj << +/D [6494 0 R /XYZ 85.039 667.044 null] +>> endobj +2586 0 obj << +/D [6494 0 R /XYZ 85.039 667.044 null] +>> endobj +6497 0 obj << +/D [6494 0 R /XYZ 85.039 642.326 null] +>> endobj +2590 0 obj << +/D [6494 0 R /XYZ 85.039 420.224 null] +>> endobj +6500 0 obj << +/D [6494 0 R /XYZ 85.039 393.913 null] +>> endobj +2594 0 obj << +/D [6494 0 R /XYZ 85.039 282.629 null] +>> endobj +6502 0 obj << +/D [6494 0 R /XYZ 85.039 251.104 null] +>> endobj +6493 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3290 0 obj << -/Length 2490 +6505 0 obj << +/Length 3381 /Filter /FlateDecode >> stream -xÚÅkoÛFò»…Ð~‘€ˆæcI‘îƒûõÙ)gmq ¤•Å Eª$e'ÿþæµ+Q¢’=à`Ø»;;;;ž ?^/7Hz£Øs‚8î-·Wnï vÞ\y‚áö”ãF!nÝ̯®ÿù=Ïu7éÍׄ2_ýÚývü0¿û0AÐ÷g0âþd:¿{3ðúƃ8èÏ'Ó7Œð~Æããdz{?ðãþ£¦w€=DÐý‡X¬ù[žÍÆïoƃßç?_ÝÍø*GE2øÇÕ¯¿»½Èðó•ëIÜ{¹ëxIÒÛ^©0pBÈ:¿š]ýÓRá=ÕãSj*7qÜ8é ׉ceõ„úøq0 ý°ÿãÍÝ›Éôßãw ›éx~‡¼#Ã^–´0'Ó×ï>ÞÞñê7/Pø›—Ë4¯«gœïö‹<[t»)ë¦þ³ÄªMV”ߤ¶ÝMo¿ÁýE&&ÍFó$]”Ï2ÕŸÓí.ׯN0~Hw»"ÝêxYëêYW<_–E“fE-¤a§—Yš_æa¹I«tÙ"™°”5B/;cbWîöyZ i±¸1FwHÇ°VéËüì*—éJ¯^?ÜNVºp…p_I¿Î´¨K#œÈžŠ´ 9·¯õ’¥9§V[m/•/uÑTižáål‚v1L‡¢Å:Ë ËëS1ʼ¨¬úKÝèm[æ}‘>§Yž.ríü9wœ–6L¤Í ;/›Ò°zĴܹK«ÚÈ—Ë|¿ÊŠ'ã•Û-(DKQ¸N—QGY~Úï^}EFQû'­w–ªe«ØoÆåºëJc6±Î6+²í^tö’å¹p½ÝU6övºZ—Õ6-–m¶Üa¾Ñ•4Ýö)£’¢@ºzÎj´F›n4.’®¾îèP™¶*4$P Õ¦Mܔֱ²#ÂÎé1TðD€„Cß‹Ð º¼?rüQ@·%*¶é݇=ÏIP=‡ô/œïÀS…]ºý·÷ƒ¡×ŸÍñÅŠFýß\OåúŒ ¹ÁýÚí¾ë„Éáqñº—9 ëû¾¹ˆæ ú{à«Fvp‘ŠÛ9èÕõ—¸1¾’CïwÆÓÇ æŪÄGøEhN缕OÊŠGßu]K ä=y}(+T˜"á'FQÞ -(W…J0ºh„d9Þ‡‚X9'âÇNDßIdöËl~÷>ð;è¨Ð‰½ÑwÒ¹ý0ù×݇Y×É÷Q¹›¿fŒ–©‡ÊOœà80é©ð•‡/!š³.[ÚW>ø?Ì5Ï'h✻ýñjUñ  -®¥Ô:ôÀ0 Q~jJîÐmÚ,à=CK(ìÐŲª†0PžêOa‘œLÎ.Èï„ ½A4[ ü¤ÿ¥#Ä WXð1'8«4ùt™£W7¦Ú ½þºJë¦Â º¸ÁY%ç2AÇéc -RäघW¼±Ò;à-¦ìâõ)#Øܵ1'î1—s$òú×¢ûs©4í9Ck”Å–”ÈvÄ+GoLu5`=í«ƒ¶½>ªÐé.¼ÛlÊqhÁd9 «Ÿñ]}áå Z1Eè­ÁúT[ö<#Ȇ¿„ùãDËøâ3ûX`ªø|ý.#Iðüçoo+âZ7Ëk[už¸}Ä3Ž JnFÎ¥l:AÉ>ò¾‘ѱÇù®Œ®$£ßN)£c>úï w`·O€°ß]äÄw?ü*#1Œß“Û×djŠ°E†z€G˜í†»Œ_òÆÁDÎSë®p9)ºëo×ÚÎŽ!PƦB¥ƒDanj8$àOY}¾™£'ŠÂ”Bõ<Öé2Ë‘?‘ ÚCtpÈX“5ê:é‹¢ô9æŒÀw)¥à¨¡¤¬Rša’*|¸Ô&<È *®”s,&9º%Oj¤T×ež—V2«RàŠÂQ ’_fõÑÙ"v%3“‹ü(á‚òàe“-‘ð—1‡,Œ+ÃÖÎdLæp•ÚD‡QÄ~¡*g("E1̧l•›ÉýŒÑ§%¥´•ìÏ1þ¿°™Y4„B…‹ŠÞ’8TÿóE*‘“ƒ]E'—hÇ$éA-¡oïß 1[¢Å­Œˆ„ŠÁÑÅ^â#Åf¡¶ ì©nnpI2"þ9‚¶j™Öì“ýÍ ]2â³5bÅ;oä ž2>oñøŽŒïD~%¼ªºé—ß³@¨Å T$qHsä µ¯æÑâÙZ \rïŒ,å)GaÖf²K1 g ›äÄ—ûŠCµRërOµÝ©0̈}TÜRïY{ BEØ^rE 1a1Çm¤Ž„¤5ÕyÍ«fs<½ÎòŠw¡†¶%´â"'ïðå~{ب Bš¸øD&^°"YMø*;Ì×öN¸‚ÐxTaЖJ44 -­°CÀGT{füŠaÝIØèçÇØŽNƒ|Ô­ºw°]¢q#¬>ªB¦³gº’‚@ O…ûÙJʃK¤ìÎÖ»ÌÛ[RÑq{ˆ€ƒa¶Âx3YÙÏ¢”??qhæ‰oÝ1fV_¾ËuOzÆÿ«V/”Âàq‹ÿSq0–m2™þ/t©V•Šv$-›t\Á‰«ÁR7¼9µWÖ) ;nqÞ­ž³¥æNP2 N¹t$~UQ|)µ}°|Nî8Zôj½ô\×»†?~‡Uk‰: ñg&^Q¬#!IB*ªC¨ìÇŒL¡ÃôúöÖz8€vݔԇà>çorJä| ð”žlÞºØ à7Ïô4µ9ŽåMŸ¸ \‡“J?q±3ªaÒ@1"ÔZw…½XžYs ¾S*0 ó×T"ÍÝ`Ôár“Öæ.2‰dŸsyž2ÖUÁ ¥¹àÀ†eYPäZ9ŠZ«Ù©²›jSǨªv+퀉cNæXJbN„P½P¸(xùgà%pß"eÌFN,lÒÙãhÃYÝåIB@<‡Õ£F²ÈoP-_‰»P™…G m{¼šñN¹AQ‡Ç²†GNd«SP#Dý -7ç­X¤_™Ï1õvá@±¾îèÃTrôQ¦Õ‡ýÔAu˜DNç‡Aâ¸a@‡^ì·úz¿Û••|/ü¿è®îoq&$2ªeÎÀÚ­ŽfØŒ«!Ð4š2O¸³¯%å͈³³È6Ÿ\q+[ýó'€žZ®Ò† Ûé÷*‘|kÛ­ý…ã\‘ðŒâø/›§ûýq•“DA÷ø„¹¿ö´`äx±ô«™7JNõ"Ê´öÇÑÿQòÞendstream -endobj -3289 0 obj << +xÚ¥ZYãÆ~Ÿ_1X,šlÞyÛw1âÍfgÀ°ýÐ#R3)óˆvþ}êêfS¢‚Åû(vWW×ñUQÁ½ÿ‚û,öü0¿O³À ³ì~{¼óï÷0óÃ] !Ù84ïŸî¾û˜D÷ïå~~ÿ´›Ö‰½(_WýÛ»ÏO¾¬7a®ÂØ[oÒ4[}ù°VŸÿñeE«§õ&X=|úIÞÿüÃãú÷§ï><ÙÍí²°QŽ;ÿq÷ëïþ}\þxç{ažÝŸ¡í{Lï`k/ŽBé×wwÿ´Kñ\tÏo-43/ÎÂ등sÒ P^¨û4ö½Ø訯k•­ÚΑú«3vtƒ‡oa(óW;8sÛñt‰‡þ +úˆ­´ê§àÙ.ÿƒ¯iÍCG½V)lDçõ:òÖØî1ÖðÇÉêéPA§g]÷HÓò뺮[\ÿ,³3ö‡ö‚Ïl¼tÕ±äCá%Ä6 +4'œ«áÀ·XÀÕo~Òûy…戇r;vÈÙ`΃¯ý@ôÇ%F$–®E^€jK¼×L;“MÏcÔ¶Üi~þ{äófû¶)¹A‚×[\æP5@Eï{t.¹h÷pO‡§¾ûºz ”—‚¦E|ö¶m³c²™ºD¹—&B&Âèèc¹î$¸ºnªz~ÿ¯ÈcK/¿ÛQ¦Î8E’<ðÀp(¹qÒ>–,ÑŽ‡ +sÊgT“ýÂŽ° +…/w“…`%"…˜x?hÜ6H÷àͲá®h_=UÉh[Û ;áýº¾jQËX­ÚO>²9ÀU#{š'5LPÍ7¯š=÷;³Ë QM)ô»¶3/ðM§«¶Ë®˜¶ß¶¤ ›…>$`Ûç +-ªHô¢E»eHÀDÉÿ¤ Q XIT›ô¬~›<÷ü<˜ñòÙõC¾¡’Ûø©´i –1Þ§¯ Ç`éxÝ%T²©ü–ïFÞÔÓ-ú®?€·ÎU-+vå¶í +nk~ôÕ¾AkÌŠè÷òÕP¿Ê–K[ñíÁì¥úJ¤ Ç¿6â|F‹ÞïiQ\"Šy¸í£X³ÀûEf>®³]n±½·ýÀ¯\˜ÂžG–kOìY;³\Ïã“D ƒ®˜Õ:dšÃÔ¦•I acÍãì÷†A¿Ö6rÕûCÙ±üÙ›=‹3âèO¸ `±—ªTæQ °ŸXìªÂ+o ùJzî˜ „ŽbàV†n2#{cêAÖä+œÕHÆMF©ÈËcc3¿p˜ p¬ƒb\³C÷­7àEŒÒ„TÝ•¢Ì{I«€_OE3¿¦Ùªÿ@4æ‰1¼/9‘’¶õx”>y­Ð±A+Èyjï€Imø¼šHs(˜Œ¼œŠƒ9?… “ñíÒÂP嫇f(»F“#GåíÚu诺þ3²Ê›ÜL4·!PŒa"Kˆ‡j[:YJ&$Aº-œÑüxø ðÓ»¿sï×/øàAêÙ’Áh|1¨¸KSLÁ + ØTóÛòÖà.©Å˜£0³‘Ž¦ݸsm™ûvà£è†Ÿ£5r‘å ¨qH‚N/Ûg2íZN‚Z56¸ø@Äq¸z ªžŸ§®%fžÑ‡Òβ*mºçã°—e'E³¨åz¬-³ÅÂYt}l'<ö^Ç Ñ³1î!T 2ÝôÜÔLÊž—‡(ƃ~=Î#6ÌüæÇ>pŠj²Ìä?a±ùOãúqÚroÂ,‘´…Ž:LNxqá˜}»£…Îȶq˜ ®!^l•W%aA¶)h”$¯žTÙE¥·ë@`«Q Ï,d­ƒÙ¹ÁE +‰gÂ5wNÈ_û¬QŠxá8f]¯J „l¥Wkª²0D ò‚Ž/ŒçV dì  –pý„¤ƒÄJÛµ¦ $?½çÆ•Ppí\ñ•Lúl.Ú3ñxl…ŸÈž*v-“šÁub ” £NèdI îËÝHâ¼V„J7zÙ°„© +'A†êPº©Ç³õ'G'yi¹}ªgÀ ßšNüfX¢•4e/1‡Ž{„¹Ý•ìRZ2Ë›)É/oFhÎœ¡¶µc]ðä{˜:AêÉ·Ëm¢A1œ¹?µ>:1€mÄ{UY`uÛWâÀ¬r€þ;^Œ;š¾šèðÚU²ú<®xÔTS¨·T·+5ßCÃ.Òø¬hBuœ ÔQ–Òºx.ÂÈ÷'H‡)YÆÆÉD°;(r ?89F~àÂzìêÓÉØsà¸#YŽt4Ï9ö\"¤0÷òÌ $ÀÞ宪Ë~ õÅ^ØdtC«ìfÛ¡íäp^ø4)°(ñ2?›£íŠðG6:e­ÑJrÇÐtê‰CQ#ÊogñIúyÄ€©x$qMªÜÆ,Æã ä'àÉf '¶ÁÞó¢S’ö“qɈ çžcè¸:ðbS Ñ0öâÔÙkHNlǨçÖ¶P½˜h´Nb˜Ù¿uCÓRâ/ Ú¤^)¼,ÏÏRbóÏ &¯öÅ37 ñ,¸…ʲ '›ÄSi8[CT±‘sFj´p@!dè•Hfćž›CË”Q§yPƒ8`ª–GˆMš",å+6­‚Íîñ(n"¼à¤ïìdöß ×îÁÔ(æÀ"…=×”&`{C@IƒÑê˜=E¬¯xq„E!ÃÚ–õÝ©sãé”’ÚJ"ľ4”Ò€~´ ´à{Ìgº€S^”š¼î|˜j'b£÷&^˜äBN;ÛŦ°éh^HÐN$DÃMˆÔÛ‹ìÆØ9 ¹J.€¥.BNµÝŽãÚØÛCæû°CöñÔª#¢(˜t·#!ç¹›w䫗Ɖt8ÀåØWépl’àãµs@> õ'wç"!ºÇ‚§­ÇLä`‚¥]A ‡ù¸õ]I0/iñâ'I!·R(à—F©û§Ñ„ÊÍ aÁÐg˜}øþÚš è»UFèìËô"nù=ößS¤:b'³™o‚ôgÄT#Ib{¸ˆ£yKñ€ZdJÒÛ¥š5@ë r ®¹åw2ÁŽrÁÊ ÄIQèr‹®“µ©x‰çY£îPAV11 SÊ +^9ÙŠ’R™§©(fXp ŒñdôÚ,Ê ·ã^˜4ÖgN«(³}"§2‰Ätfl°nÒwåÖ•AžKÁ^¾À ä4®¨ëÊâVTjEÁÛQÁ¡¹‚ ó¢ÌF…D¢Âçuȵdvï©Ý`FÖx“™‰æ¶oÏ#/•ý8 Rɧª!hÌÀC½õƒ2ÀØØ(~¥›£ldlž›ïå¹Ádá Lž,gÇ›“ŸÅ²øŸ@NâB›ãê¬Î¤Ðe×2v¦¥™ª¥èS^»ʵTp¹vÀÝ ë¦8ôñ8EuªÜŸW'pÀ©1ÒWjl…úbýÞèÞÉÊ®—åQÚTBŒéΕáÑaÖátQAÔ_ý4•Áp‡qÑ&QÊGýÖùzO.YM?Áà)½×UC*‘pÝÛº´°+™Ý8œŠr@Ô&¤Øô6|t[ÙÔ¢oú=ƒìv”IDÀÅ›É%èNü•¤zéç%æÇ3Æ.ë(ö—·1"xo•/™üçÝþ¯ŸY#ŽB/ óeŽ•òT`x!w’¤—üšŸ"]1ü_äå"> endobj -3291 0 obj << -/D [3289 0 R /XYZ 85.039 781.388 null] +6506 0 obj << +/D [6504 0 R /XYZ 85.039 781.388 null] >> endobj -1126 0 obj << -/D [3289 0 R /XYZ 85.039 532.001 null] +2598 0 obj << +/D [6504 0 R /XYZ 85.039 623.55 null] >> endobj -3292 0 obj << -/D [3289 0 R /XYZ 85.039 511.008 null] +6507 0 obj << +/D [6504 0 R /XYZ 85.039 596.935 null] >> endobj -1130 0 obj << -/D [3289 0 R /XYZ 85.039 427.088 null] +2602 0 obj << +/D [6504 0 R /XYZ 85.039 262.887 null] >> endobj -3293 0 obj << -/D [3289 0 R /XYZ 85.039 404.679 null] +6508 0 obj << +/D [6504 0 R /XYZ 85.039 231.362 null] >> endobj -1134 0 obj << -/D [3289 0 R /XYZ 85.039 269.796 null] +2606 0 obj << +/D [6504 0 R /XYZ 85.039 136.417 null] >> endobj -3294 0 obj << -/D [3289 0 R /XYZ 85.039 246.478 null] +6509 0 obj << +/D [6504 0 R /XYZ 85.039 107.681 null] >> endobj -3288 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F20 1617 0 R /F15 1628 0 R /F41 2104 0 R >> +6503 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3297 0 obj << -/Length 390 +6513 0 obj << +/Length 221 /Filter /FlateDecode >> stream -xÚ¥RMs ½ó+8’C²À¡mýì­2ãÁñЩ±:S«M¬úó !f¬õÖÉ]vß²Ë{pÌìDZ’”Ɖâ”Âo[Äð»Ít¯ ÊbéR-ƒ8ÂœQÍ46«b–sòØkŽM{„@" A˜$ŠôSÓîœLšbúi׆SogýôiDŠÌª@Ú¶h3s¡Ñä¹F™ž÷¦Ía«,̵ÍÕ|¡ "7àš/^Ú; £ >YŸQ®5Þ"!JÕþMÑK}ŠÏ ì«îÐ -¦)SÚ:¶@ÍÈ;|œ6ŸEÊH’â{¿ßå¿yð&ݹK¸É¹ëªoK²ü˜å¿*Îç3½Z®¼Ñá×ØF àì”Rø×Yž9æ9[^ËRgË8)MÉë¦ðö°®àý±¼.-n™ÛŸMpR>½[]ð>ãbVËJ¯¢ÄæG§b–Ó[½Jþ¤ÄaÂbû‡õ÷ÍUÄüOSH(W5ÉÁø=Á¸b·ƒò˜Bl_Äõ€?ѸLendstream +xÚu=O1 †÷ûsCŒclj3 L  b@´ ª +øùøèqÕ¡,‘Þ?vò—ÀITK(fðô6¼¸r5¤Ù‘UPsöÿŠÕÈbØòjCœ‡DÍŒîuËyÎ.™€ KèÏÀUÐ@9¡6ƒ¾½·£¤ð8 +…÷Ï1J©áîLJ~sLf¬V§dä‚*ì, -ÉOvs8x$…Ý~ûúµû˜RÃE_ˆf \Ø«Ìäu¨üGýw3!ä¶,–a£6á – NŠ©_OM`é9ø ½X&endstream endobj -3296 0 obj << +6512 0 obj << /Type /Page -/Contents 3297 0 R -/Resources 3295 0 R +/Contents 6513 0 R +/Resources 6511 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3272 0 R +/Parent 6510 0 R >> endobj -3298 0 obj << -/D [3296 0 R /XYZ 85.039 781.388 null] +6514 0 obj << +/D [6512 0 R /XYZ 85.039 781.388 null] >> endobj -3295 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R >> +2610 0 obj << +/D [6512 0 R /XYZ 85.039 542.44 null] +>> endobj +6511 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3301 0 obj << -/Length 2374 +6517 0 obj << +/Length 3034 /Filter /FlateDecode >> stream -xÚYÍoã6¿Ï_‘[äÅXCŠ”,è¡ÓmYìnÄ{X´=06m ±%C’'ãÿ~ße)–“‘äûü‘Öw -~ú.OceŠ»E®c“çw«Ã'u·…‘|ÒÂaS§ÖB{bpFçY+»˜âIq²0wóÄÆ…"Ž¯ËO_~MÔ]¢â,3wË q.׿GÀ3›§©ŠžüêÔ”3U³¹Ž¶³¹É²èÉžÝìÏå??ý²¼l!È·±Ò“PÀ“Ä‹4{owÚÄ…N‡»Ó666{³;û³EôPuM »ÒÑú´êʺºµ-õJLšô‹ÂúZ’Šá¢Ë]ÙÎæIV€*tTw: ½Î’šFm´Bn°  ú5“w¾‘éîìÇ}¶Þ2™ÔŒO¨¯†ZÿM6€ -!­¥˜$A+BkËÃqßgªŽ01~G·FIE4qW²§ }åH©ž‡J¡¢ìš›§„>Ì&E}ùŠç%’k p§Ïàg!}ÀT«ñÜT>ê¨è•ç2Afc›2ÝUë©%tlóä²B'¢×¾B©ç ©scUœ&éH—õQ -žUë^3Z_T -íS:m†¢µ‚ܪ­l§=<ÇŽ›‰=Ø"NTà´Ê–‚Ó,¦B ÛËÚä”@®«àäÂ=YvôÊÃŽÜŠóBÛŽ§^²ö¸x6äeP@Llu>ÒÍ3¦ô^ÇŽÚ^j´ø±ìvÅlCçÜŠË“wÂ,2¦<›F?IlÐ&¾»ÞU‘ÿ"c»ãÊO³%Š~˜Rü"Öàs³ˆ3“ !Ū½ßׯÜü‘? -‘‚Ÿ–n‘Ä:Ë¡.ª/‰Ó Ó®“Þ`ð¶óH¾"éê‹šò¿Lªùe¯Kö/0Þ3Ã<5Û…éõ!VŒ*8_Qº€Œ -q¡wþû+Ir›ªÈz±)tîÙ‡P»œ¶°Ç»gY¨T \wA«VÃ¥Gô_Æ (&iñ©ëÔ…Á<7¹¥ÂJe ;TžMžF¡Jæ”o€€®)¿ÍÒ 6Óé·çn^ZDëÁ8•)ä²êŶ`®býDÚ…ºë‘qÔ«zÚ^W¶N’›Ïs§ñ›Kž\3à0|‰X³±«ñƒ”\ôŠ¦(&",L÷ÕZŠ{¡(Z:iK(6­pôçÑ‹80ì(ÓV‘ŒÆ8µNÎN•_Ê’®¹ZOÄžc)îùNÀ4: l_õظ(çõesß¿5“+Ê»D¹gŠoBP·Ñr’±VɇpY—Í$\.+À·òÜíò»×<„Æ#ã®zˆ¡0ŽÐ"öGÕ‰(=ZÄN¨ GaŸpm¢£-,_È%"ñº2½”»Yˆô!^È3CɬÜñ‹Jñ8Mä -y>,VÐ#§9÷ØßÍ3È_ËA>à V¾J¸ô"Š;;7Ê®9£Iø<<ýý?̲—SÑTË„ëF™t Ãm9^’˜¾Ž”i$™d¯¸56)R¤@ Ð?÷(³Ðž> uÄÕ-5+'{Á"œª4'‰c'öÆNµ©ÀW\×¼ya`~{àCÞD±ÿ›åæ‚š]Ÿä•ÂUD+%¹H¢[–5a'žzjË>«ÐÅHÒOÈ^$sw›šb%TÁ€Û)¸q]ÁûdÐŽp€ïvãȽÖÖs‰u‡ßÎ7FgßþU,A:ÂW  -Èž(—b$8¤%²Àí–mG>í E@rón‰Bjá-¹Jõ(€ó£°¥½‚â‰àøSQrGAm皎œt{B¹¥Ù9Ðï=7ÛS¸¹bj|9¨ÐÈê3Fs2 h¡÷R¥M.Ì\(ÂêchTŸ9·Á2/ÌU†e=œ¶hF·IÜå¾¾§J5OᎽ ’¹¦ñœwÉ&!æ±Õë…#­‡ßá ûk/·Ìlb9³£`! (Ì ÷ˆIœ“ + ïgÎ%ã q+ºˆW‡q“;`‰ p@×ÃW‚·‹.P§N·)l÷î^óJACŠYdºÆâï1{æ8>#‚4ç +Ãuè=kû÷Z·Itã¹ùŒr)h¿Ê’f€­·é펉Ֆù¼ðöäyEk6¤H\°‘MÛk0°&I-B8ŒNÂïDbǽ°0˜!0\¯‰ŠylÛçwwwVÖkÜÍrÖ‡­ªÞ1Ë]~nüÇö°¿–W+ˆ§^Ø4òcN¢—2ˆ¹z>s²qê« ™_Å~(qà«|X \¼Ïû8ÃþSÅXãS"XãEínÀ±B_Ï£qÏrŒ­üÔÙ":>x1ySÆICôø"Æû zæ&C#B®ŒÉè§5ºLIWžºôïr½—}Y5²$Í2:W}æUÕ²™jíÖ£ bk˜F ÙÕ' Y¢¸N4g³½W•]G'°Ü Ÿªyé<[&àŒûïxkH™tªÙɺ3Ÿ6yðÍ¡ +…r/û'ŸIèyž pò2ÙqÃâýúm{ Y#Þíü‰#ÃíÖCT&úÅqËaµÌ`vȬ5#ˆm$wÛòïÕºìóþ넯)ê8ÉB´…†7JYú±jÚ[‰ø¯Fó‰ß€§óË‘±›TùÊ^¹åeú—;ÓkÄ¢)±“¬6¢Àò²„`X¬o+{ÌÉÚ³ÜöKpu×Å—Å—MÐò»(i,V^r³0î2UçöNVmÒ%ø|7@ØÒ•Ÿ{rÙ<óíÛ7P8ï¸aÌ­’Ù¨ ¶Èö{ÎKbïEHn³y2J¢»Z­F®Œ4w(«Á8æ·RÏÅ9­Øó6åbƒ²£ÃâFÊ}³Ž~ Ž@¨ N6«¦œa¸"™ÐÙ3Û7"¦wÏz­ž„¡uON]œKŽÍèÂ`ùŒfÆœk§1i_íš!&™écâÄå1ñN@¸ß¨l<ÉúÙ‘|5O<Ø"ž’4ü¼ÁÈ=0IJ;>ߺÏŪˆ×‚(™$l’5]!ϸ•”ªæY‚[ó!$¾™r}iô9¸úò_þÄï®ýZAæ@©àÖ˜Ïx÷jÀ>Îx®×e<˜Øä»rWÉqyÄüæeŒ9&†â6´—²]¡ŽNRØ+üSÙN?ÖzEuÙM_Á¨þ¿`Žs?Ýê³bö<·TC@æw‰ © hêüÀ¤vTu˜4ì-æ¯+$˜î*$æ`LM)WÇ*Ëêz'>â™y@¹AyYN‚ú"¨;ìJÙ~‡<}ð”×û– @¹ÏÖî+Ìô¶(Ûì_þ@.ÇãÛߘV +#H¸`&2˜($]aß1=¸V)}[<Ë k•Ì.¡<„Â`PÉõíÐ5³ŸÊýï#•µ{Ýe2°vñßìð¼—õÊV~Ù¸VIzÆ}ßS÷ýjã´HHk†Y Å';äv 3´ç®ä%ï"}£DD ×Â)Ü:}/ÜBü‘. /WÖêï/3Y^dJ\‚–]â×uMÐP\IK/¿, Cyç´îË74®SÛµú’*¯êºÈå•q‹‹éGF&:œáîc¬‡¹÷ø&?m]BåK™.ÚMœxTãðð$í#¢_×^’˧ŸDÓ_Å˪癨 ð³ Ü:(—u›”±¾2³{1ÇüV&¥Þï`«_ŽM‹Í•5ô©@ÓÃï²DãÌÐ,R¨±3gt±²à÷nÎþy5X_Þ9î…5‰|>ܶ··èº,ÀL@ƒÇ-›5EÒ «mëù·n.2~Ùù›ëynßœðàÆúÖÍÍí%77»•ÜÜ`«Ï§‰ÖC^‘ýK?Ì2pv%9ð»ç>£ö?•÷î21ùëu[ý î¤d¨¥Á$)ô¾¢’ðxKÛaàkÎk»ç¹­má¡ +ÿ–¶çömÏn%Úlõí±/‰ùwÁÏ®/*”î3@__rqÿÂBUo §×î‹1]å¹éÂìT/d»hªÜné:ΉÿèŒi·7MÒë C“€6Ìíÿ7e¦endstream +endobj +6516 0 obj << /Type /Page -/Contents 3301 0 R -/Resources 3299 0 R +/Contents 6517 0 R +/Resources 6515 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3306 0 R ->> endobj -3302 0 obj << -/D [3300 0 R /XYZ 85.039 781.388 null] +/Parent 6510 0 R +/Annots [ 6520 0 R 6523 0 R 6524 0 R 6527 0 R 6529 0 R 6530 0 R ] >> endobj -1138 0 obj << -/D [3300 0 R /XYZ 85.039 761.463 null] +6520 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [316.138 654.568 386.484 666.258] +/Subtype/Link/A<> >> endobj -2147 0 obj << -/D [3300 0 R /XYZ 85.039 667.661 null] +6523 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [435.86 506.864 512.306 518.857] +/Subtype/Link/A<> >> endobj -1142 0 obj << -/D [3300 0 R /XYZ 85.039 667.661 null] +6524 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 493.315 216.398 505.307] +/Subtype/Link/A<> >> endobj -3303 0 obj << -/D [3300 0 R /XYZ 85.039 642.943 null] +6527 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [195.316 312.928 375.35 324.921] +/Subtype/Link/A<> >> endobj -1146 0 obj << -/D [3300 0 R /XYZ 85.039 597.507 null] +6529 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [481.678 209.385 512.306 221.377] +/Subtype/Link/A<> >> endobj -3304 0 obj << -/D [3300 0 R /XYZ 85.039 568.103 null] +6530 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 195.836 210.671 207.828] +/Subtype/Link/A<> >> endobj -1150 0 obj << -/D [3300 0 R /XYZ 85.039 328.241 null] +6518 0 obj << +/D [6516 0 R /XYZ 85.039 781.388 null] >> endobj -3305 0 obj << -/D [3300 0 R /XYZ 85.039 298.837 null] +6519 0 obj << +/D [6516 0 R /XYZ 85.039 761.463 null] >> endobj -3299 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +2614 0 obj << +/D [6516 0 R /XYZ 85.039 761.463 null] >> endobj -3309 0 obj << -/Length 2319 -/Filter /FlateDecode ->> -stream -xÚµkoÛFò»~…PD4É]Rd~p]·qçrµò¡H‚b%R2/©’TTýû›×’ÔÃö¡ÅÙ€¹;;;;3;ϵ?öà×Ç¡ë©d<‹}WÅñx¹yã5¬ü<òÃk׋B\úa>ºú) -ƾç&^2ž¯ež~tnÞ\¿Ÿßþ6™*¥œ@»“él;ß¹½ùðÛÝ»Ÿyåáúþ‡ëÉçù/£Ûùà€©vu¤ð„?G?{ã˜øeä¹*‰Ç{{®Ÿ$ãÍH‡Ê µ’y1zý»£ÂkzÌ».È1µS?q“ ¼„ÌÜ`¦ “NäÖ´«t4¤D9C8š$-× d4s >y¾®³ýDyŽ)ŠS¡§ö¨À%ϱøn*·¬øáíß›r$Î=g;âN6™úNµ¾ŠŒá»†>1\[ÙˆÇhmÅß@DdHÛ,—ÊüÛoh»†m_óe6Dx˜ií$;ôTå+ø+KÌ -'¢ò` L±Sñ)*ÍÆÇ MHծо“ ç*òñ´¼Æ¡ç”Y;tH…\~ÁÛ "gŽìå o ñ€Ú²°šÄð¯H¤“ôÀkëŠ0+â2eÄ<ÍÌk±ˆ‚TPíÖ¼vÇæe‡º—MuF T› ©¹<5$IwM^Â06('oñ8£ï²*ÿ«;D!RmNjæÕ=é5þÈÐÓ1 ‘°""|C¢2û,]Ã;IÕ•¥b„n‰hbj!‚VXW-ËÖZ»J+ë5*\æ« ,”k$h»HôÄ|•&é–UËØfÙæö\X¡4B‰åØÈJ þ\bCÜmÈËÝ -±½^Z¥À>j1;ÊÉÚ6§xX»- ãu¬ã9{¤€á0à6Ê ”K«±,¼Š¾”t- =ö§Ád~ó^8C´”Ç~„±À9PTuÛ Ó ’òI -Y¬Ø{HM=Eå,ŠÎ6–È -º•Öš‚¿Ù dasg=4“ "ëÕUU(lÞß!OW?©a¼óg®ã©Š!&*bðÃï¯|5ƒã}Ïs¦èÑ!Fº”G‹ËÍâRÔàÝñßÜ -†ÝÉK»›“Ýa·YëðÝ|ù§gÒDÀI™‰ç &ÙŠÑâŒYV¬oàp#!­¶Å #( …ýR!éT‚ážúaÁ`ŽÓ-^øÖR3xÄ×Ù3a° &29˜-=¢Ž«/QÌz}n¦¬ËµxwÉÖÄáˆG6´ƒµuæÎkÌqÓª,bé)É(Æmí_,UÛP&ö^¼œËɾmÊduŒ\93uã>]€a‡aðlEº±¼X‘„ÏU$wèú7ßò¤É£Áê„t 4+Ï•)ñËuŠz¾NÁ¸Äš¯%ã±a8J<çØ>rfŬCØ5-‡шØìòÈ`¥ 7Hú(¥±êã)â/«æ[„›Âæ1œm ³úF¸¨já‡ð¤´¢<–‹í/y=ÖJê´- WiåÜñMhɤ¸kY†5²]€ìlåÃÐŽ˜¤·µ•xÙ3Ò’QÃö”Ü€K‹^Ñõ&°Ü!¼µ¾ -{)õ´Š‘}@¤±ÎåÜk“‚ŸÌݘÝcr) ÌU ?•Õ<9­+ƈ°tVóp¨*Ä륔—ï&Ö­õã&C‚IEzD;‘[@¬U]m&q¢eRmn(7]ºÔk¹î›­01®Âåˆ!·]&Ðí-VÖxÆQ‹´ c¾:{2ààmÅž… W¼Ú9 ùù{î ‰ëìðT%ÜÖd[’eurf¤Ÿ`°ôËxýl|DÀ0Å¢×'˜ïÙ b)ÊLÙ0®ôý8B’ô<ƒ,‹\’§œØéq©øÇA§DbtQÈX?·´E=‘Ú…« )ÇÉo›×ç]醚 [Ó¤Õ¾ß@+-¥j”nÔöº§†çt/߸Úçâ®?i®P4!-ÈôÖ"¡hì €ûŽ½}“•Ü†Ä?çÝ%ªaE‹ëöÕÊ·•:ö¬/$pÓxÅß®~D˜ÈÔÎKoD(ò¦<¿]Êcý#ÒÌéß[Tïè} £Ç+±iªò™î(‰ÜY=ÛÍÜD½ÜEÒ½ÃCçoïÑmn~2(}¡î¥·—ÿç[mWì_] öë< ©ÀwÞ{_aðÔPñhKÒ¥áà®üÄ&4Ÿ_µlµÂ¯OpF§ä5Ü_}` ‡~Ndƒ—«À<â!á–Gž'gïöîwí‹/7R’¾ùõö÷?Þþëæúí÷×7oîÞÝ~ò•~øýa~{£›]]ge 5G[WÅCÖg8|Û˜Ïç||SlÀ¶  E^äí²eV|ó}º‡´óÇ?êÉN×WÑ僈¡ÿ³ÿR(TDç4ÏZ -(ì”O?rU¤a8`ð¿çg==endstream -endobj -3308 0 obj << -/Type /Page -/Contents 3309 0 R -/Resources 3307 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3306 0 R +3061 0 obj << +/D [6516 0 R /XYZ 85.039 667.217 null] >> endobj -3310 0 obj << -/D [3308 0 R /XYZ 85.039 781.388 null] +2618 0 obj << +/D [6516 0 R /XYZ 85.039 625.638 null] >> endobj -1154 0 obj << -/D [3308 0 R /XYZ 85.039 761.463 null] +6521 0 obj << +/D [6516 0 R /XYZ 85.039 599.024 null] >> endobj -3311 0 obj << -/D [3308 0 R /XYZ 85.039 736.911 null] +2622 0 obj << +/D [6516 0 R /XYZ 85.039 599.024 null] >> endobj -1158 0 obj << -/D [3308 0 R /XYZ 85.039 508.6 null] +6522 0 obj << +/D [6516 0 R /XYZ 85.039 578.031 null] >> endobj -3312 0 obj << -/D [3308 0 R /XYZ 85.039 479.196 null] +2626 0 obj << +/D [6516 0 R /XYZ 85.039 479.108 null] >> endobj -1162 0 obj << -/D [3308 0 R /XYZ 85.039 171.71 null] +6525 0 obj << +/D [6516 0 R /XYZ 85.039 458.215 null] >> endobj -3313 0 obj << -/D [3308 0 R /XYZ 85.039 140.185 null] +2630 0 obj << +/D [6516 0 R /XYZ 85.039 402.568 null] >> endobj -3307 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +6526 0 obj << +/D [6516 0 R /XYZ 85.039 384.095 null] >> endobj -3316 0 obj << -/Length 941 -/Filter /FlateDecode ->> -stream -xÚ¥Vmoã6 þî_aÜ'¨UÉ’cû€}ÈeYÛ[Ò»Õ¹‡®(\[MŒù%g;ÍúïGJrš_÷a(ZQ"Eò!Êe6…f‡>¡<²ƒ†vZZÔ^æÊbƂڂбªOKëò·±g3J"ÙËge²Ìîéõäërv7r9çŽ'ÈÈ ‚ЉGÌ™M¿ÝÝÜ^iM•\Õ]žt2#§sî -s@ç2Ÿ‘ˆ³¡!…Ò{“,ø~D=Ð ÂÅøpDá™ °Ô"r¾mVM´cNONµ‚×f8qR>%gYô!<Dï¥à1âÃ[קÀ†^‰¯„“7ÁåsÒ‘8ëþv¡ó·Ö4ýáj R‘4Å+*(¼§I2oLà)ÓéáA³2š»«w­u×m>^^îv;Ò"vR7«Ësßz½÷cð‚x~¤U?Gý |U‰#ŽÍȈHÐôV#UOä%ª x—TXŠNŸ'•«xæz>UT8¤[U£ß*Uµ*¥¾×âº-¸p¾¤©.9’ÖB’ -ä&*ð:Pïžô…TbN«I#µP*™¶S…rx!õAn®¬‘b«µŽÉá bÖ¥ò€_ *;ŸiVü n7è+Íg1)‘5OFŸìÐÞE•>4: ¦Ôo(Añ²-ªþ -*“§¼8µQ( †¢PEMkT¿à}sht½ $6Î8‰¢Ÿü£`šøÿ¾ã< ,Üâ]"²Ÿ±{LøX“û_HZ3endstream -endobj -3315 0 obj << -/Type /Page -/Contents 3316 0 R -/Resources 3314 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3306 0 R -/Annots [ 3319 0 R ] +2634 0 obj << +/D [6516 0 R /XYZ 85.039 298.722 null] >> endobj -3319 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [237.716 552.867 359.98 564.86] -/Subtype/Link/A<> +6528 0 obj << +/D [6516 0 R /XYZ 85.039 280.551 null] >> endobj -3317 0 obj << -/D [3315 0 R /XYZ 85.039 781.388 null] +6531 0 obj << +/D [6516 0 R /XYZ 85.039 104.412 null] >> endobj -1166 0 obj << -/D [3315 0 R /XYZ 85.039 598.573 null] +6532 0 obj << +/D [6516 0 R /XYZ 85.039 75.192 null] >> endobj -3318 0 obj << -/D [3315 0 R /XYZ 85.039 567.047 null] +6533 0 obj << +/D [6516 0 R /XYZ 85.039 61.037 null] >> endobj -3314 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F20 1617 0 R /F15 1628 0 R >> +6515 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3322 0 obj << -/Length 2904 +6536 0 obj << +/Length 3098 /Filter /FlateDecode >> stream -xÚµZ[ÛÆ~÷¯Xä%TaÑœ/-Š"qÇi‘±hú0+qw…¥ÈIYÐßsŠ”¨]#EaÀœË™™3çúѪ›þ©›Üʼn)n²\Å&ÏoÖ»WÉÍ=̼{¥„Â:;k¡=3¹ ³ËTljÍæhtëÌÜ,µ‹„(¾]½zóNnt§©¹YÝåjó¯H»x±t.‰~]¨¨^,U´…ƺY,Mm°_¾y #Øô £¢¶+ûnñïÕ¯þ¶:±Ît±JÝS Ðè¸pÏ1¬tœ¥†•MÏVȲ-¢¾>ÓL#ny`=Ã2SÖl¤Ñgëá²*Ú”¹v«ä)§¦•»Q Ƚ3ý¶ÙáqOpÚ¾/[äŦÀ$Œ5»ÝBgÀNà†¸îK&ÙÖü­ºˆö@™G·‹%ü›€ln¢÷Dâ"\¢¢Ï°ÞUE¯q¸ˆJ¿Æý˜¨ÆNûd-jùö‚Õwäîô­¯aŠöEχmä䆩<Ê­ÐD ºùºiÛ²ãËãy Èl¬¾‡ž3QUö ¼‰Ê£Õ¨H^¥'‘âžô-à´âÖp \äé n{_—YÒð×3ÁZ® 2ò(Zœb‘Àéa*œß0SáÔDalº™ë6¨Œ4VKœ}ó]:6ccgr±‰õƒod¹ À*P%˜éo‰Kp†›Š7™Ø”Jò8q…ìÒ?:ðTkÇß}'êQº -pý ³Å¦àÛ ËR®}ÍáúØa’R¦¼lîùÓû[4!íÅäŲTVÇ®ÈX:Žx¶ÐbŒf‹ÁïØ®ØèaôŠ‘vÓµö¨ËA«´Z“µÑMÏ„mëf÷´?§7Æ°¼°Ñ‹b»ó»Ppíœä`õÊnËcð0º´©YÜá„;†‰ä]°²v‡ºÀ!¶Éàqû¾¶EýàŸHjDÞ•¼“89¶hPȺ²_£Ixr“E¿Òžò9ò‰þ»³ŽMj"?bA‚-k—rÔ™°ô$jÄÀ¾xÀéí)8ÑŽü°_Ì -我¾iCðÀ1ÏD³W'/¶¶½lˆd ŽlÃ1åga%}œuk1Š[\zì˘ˆÄ)Ç”+²…¥•C»ên­qrð –Ž'$ºü»ý“ËVFÊOË5ì>f¢-¹EI2Ö¸™;ÓõM'ÜÔeß4{¶Ñža š½xtCvâ)+&aV(VQÂDâ"rßý ÞÄ *ô÷%“v!'2ß%:®qC`ãƽF±u¼ÃZ †;ƒE”¡ÈéÒQäÔEg‰€DÊÚÿ†þŸù“:gÒ™ø» ÛL¼áy÷s -íÓ; Äf…k›¢K ú‚HRsËK*ƶƒ$·ÛŠÅƒ+ƒ1Q‘Ýšz4ßì‘zv'ïyäÓ›;Œ¦Ýòx=z%"äJ¢=ïæŠh€-U¿e·ÐjS5oå8ö5 -êk¿ïd !'tæ0*²á”Zsk¸!%,FÇp,æ¤èúaºîLôš×ÇÇ+® 9T{S„Úø– GHt%±g2ÎpÕØ„CþÀ¸ç÷5GCD„$žMùšŸâë]3%÷¸Ý§…ÐE ÍßVrïÏQ¬m5ÚkŠ)™±,N´÷BñË»g°ëápଠ-Ùâ„P‚‡6Š)fÜŸ EŽ³nŠŸ¯ŸÄ’_šÂÅE:A_,„³í=7ü†ï.O¢|sÇÓûàz$»Q¶€¹yå¬`¶´‚PÌŸ tŽxr³g -2HL¢Ø9×aŠþ„a%%èØðÃT)Ä`¾—¦ºò•13‘ýV8z7}á×<#ÁŽ¶Üm——‰2Ę–C6X%Èxj¢ï›A_tgÓ}=×#É¥É [|놿 -\ƒäÁ žÇï8[3myßô[¼M86(;3ó 6ã* ¿'ôŸ™‘°M¦¹Ít(lÎl´ µ“M€Ç¶é9†±UTpõÌ}…½*d ʪ‘ÙD³ëá@@6aÖpòäØ›xL6 -À ןBÈ ‚L #µcëÂøñ2`ü uF—æ˜Ôûêq@£Â)~Ž¸÷†'3&€• my²öœ®ãÌ•g|ç~\…:úï iÛèŸ?K®KjI† VÍÔÍIÞÂż‚Û–1ïäyÄjk „JÅʨgŸv²¸0æŧ-O;üîÖO^l2,˜_|úŸ_j¾Aùª”S‰rT’isá #&NPÔ`½çs©ÔÑ@„ªc˜ÀýC0ÁªÝÀ èZ2'I•¸» -®{8Q°bÀ¬r|BãÂ~…/†êÜq¨¼}ÿ~¦ÒùˆèuÀ [¾û°9ÙÊo‰²xI1!_ ½n4pC9vpŠs—á&sq†FBŸßk#à rTE±ä8Š,óÖ’á“´š·–ÒÚ Ã*ý‹¨øÌßÎÁ§È¦pfø;œmš_"šnøëGKêrªpí:< nŶ1ò†gâÜ%/iñ(8^fE¨.^ÿåÚSìÔf‚"Œ;•Šr'G¶uW­¨„.oxB´õYx(ùËþÊ[¤±¸È]ø• ìú'ßî¸Ì\~½ ÍÔþ‡}ë¾Åûbë+¶oö7MC»ë¿šûeá`<•ßéMø=üÀº“§v;——yHÝ9•ÅEª¸ôíÂÄ)Vcë÷üOŽ.Ε~—Á¥o›úSÙv[þ'…l†¦†¿îa!?$¨%ñvÿ?˜úíäõ ÝS°Ö'4öfO%sv‰øht )C}ÔÈ»;î¶ÙÊ«!ÐÖø; -6¸¡yO~täÎ,àQ!¦Ô£ -åöšÁêÅË%l´­g<áCî†,Jæ «Lå"OO…Þé' Y¸7”l—Š ç¶\‡×Üqa›@5îEï\Ÿ¹3rh¸¥_qyUS‡ƒîÔœmTqÌZû*0ñ¿¬„ŸÉÌ€Ù_$YBü}ó‘ñ÷9RŸDÖóW~ŸÀè­‡UGh*b­N¢ŽDCXâ©ç¡;2ol}è‡ÇÜá¾¾÷œO™`=Ñ6½ÚhÅ¿¿á´ ÁjF•#9KEo†àÌËäUlî‰eD¶]“ç® wå.*‘w|õ/2 ‰xR{\8¨ÊcW¼”ªUnÏÏÐÆÆ…;û‹Žðý/\;ôendstream -endobj -3321 0 obj << +xÚ­ZÛŽÛF}Ÿ¯ŒB‡÷ËìKƉ×vvƒx3ç!ÉG¢$Â’¨”'Ê×oªj²%Q“`waØêKuuuu]N5íO<úãO²ØõÂ|’f¾fÙd¾½ñ&+šywã+ÅLIf͛ǛÛ$ÑÄ÷ÜÜË'ËOìFq8y\üì|óþþããÛ§³0 0q§³4Íœ÷?LƒÌùIFßo~øþãÔw>üë­ôî¿s?ýõñ»›·½ ý´i)~»ùùWo² ‰¿»ñÜ0Ï&ÏÔö\Ÿ¦·7$†G¡ö777ÿîYÉ\4‘Uc‡Ž‚Ä Rj„ž›eÑ(ïn褙Øsc/ê5ãÇ–fü v“(™"¨&rÏ燑뇋ÓåvBò'»…¹gñÉn?vS:ïtëЙ×Ûítæ;ÅŽ´¾˜iex¶ÀoàÜíi¸AÙ|Áu•Í}ÝÛi:O…Kóu³º»å¥¾Ó ?eÝ ‹y-,Í"(×U+³ÏXTÑØfEÐùètt#9Ë;oJ®#j…yâø‰EÕȘïÌ»º9Êè¼ØlÊ…´íýdé¼Þá]Qá°üÏJfºõ°ÁÆìFï” ±Åâ§ÂªDÙÌKÞϽ(…â/ö*·tGŽe¶‹¼Ðyÿöþ[´’kµâmÒ—Ë ’'µØÍq¬$Î>ùP)R.ts,f‘šRNº9*+–lš’%ß“¨©SïÃê®Ö_K¸Ðõ„Á¢”ÛÇÚÍÌ>RÌ'ª÷[Ý’èÃÜéš’iÝo>=Èî¡áCdÎBD‘G6².]±6ZßÉÀû·4Àº!Ây±3l x©ËŸè.‰j‡;—Yâ~”ö¡­v+û„È·ÿm9½“Y#$§>„·E±ƒe%d{å/žíxgP"V™¤¸Béö +v,2€ç^&6•q¨Nê¥ü—Lú‘!å–ÚÜZa}ð2£Œ.Ù ELâ¬$ªYÜÙLdüÕ·öÝÖpø­Þîó6€Á0Ot 3~Íipæn˜}F¿|’N[uÐD°&0b"Ä R,ó·Ci4ƒ„pî4¤`ã'v^žÖK=»Fò^‹‰OL«=i7åFÂI«25–çJ¤zDG |uèv³‘^í`ƒõõ®43b‚hÃ%Ȉ¶”dYS°Ã™ˆÅ³M!ûl·diwSíR¸<%Â3²ãݾ5qÙß; Ä_Ûâ"DSãVY6µø?l0ŒX`7&’xá}#¹7LS7%¯ObJfÉŸ'ß’çxêV³×e kxAföÃéà ™²”òaú‘IY½,Sî¹5-™<ÑÚi¦8Ï슒(p}ÿe 1Ð\ÇJƒíãk0⥽E¼¸•‚k«Ÿ¬@­ Eä=yH¶ä@'@±*È93äšfèwÛ[,¢ +FàØLaµmwFÿÔc£œl—&ÃÉž­PÚÒ°Ó¹<¸Æ‚vP5G¦­D|ºÖ%’Ñ‘µˆJkˆŒ¡?3á´US²ïuœ…⥘DTÙ÷‡¢ãÊ°ñpvÉWp‚‹ +^Æê _o@³‘’ùàzÕÜâ<¦ëMÅ»îrÎÊ©…èoÙ¶CºKE§hÐaQšiëA!ÍO_*=>µ›öHi›šB)Suû+gŠs)H_<“E3b²æL©ç¦‰À“Ë0éž#X …Ø)6&=ÃLéxÁï +—šNáQ`qû‚AÙgf½Ä‘/«Ri‘/1%ù®íd”SjÓÑôÖOc +ž"…S,`w-ªÄqê¤ V&š•Rü8`,rÖa8ªC%‚éÊînoY“eãòÅ#­ÜîO·‡iâ3ià<0û™KaàT¶³K54†Ü€JÎ8;‘ˆ­)Hºµq! {»C»ØÕxŽÛúÐÊš"Ï^(2J7Ò¿¨HCý²"ÏyBlâNðX˜DnB+ìè3¦dR~¯äÛ -{¤B%.e£d\ÉB2³hFt|ʲ o ¯Mcg(¹4@–ìÏ©D±ÖŠ©<ˆƒ +ŒáÅ\W1ÞÇd·f›† €½ fÕôÙ‰BÊò2»ùnê%“˜Šr®?1z¥žYäc¹î”§]©!$›8FQy]Kú2¨øLº H8AŸHwv#†æe™š ²àD¦e­m[7¥´ªÝR@2ä¬5)5æNŽ¸“¹Q°—º^rZ<®5º,ôÒ©Ðü2ÎÞ(šWåõ@u5š:Pƒ\5ÄOºÿÎ0*ÒZhÐÝÕ:ÕšŠv?D`ž(]½-ºjnÅ +³Ïdá ©ÉæXtúÝô¬)èÓ0êgØgPäÕgÍèIPNEZ)ˆ’%C®ëu®–‘åó¹Ôn­ô+åk¥ƒ42¯CšâGŠ¡ª&¾y4HÆ‹\5º +§›è+MÎj÷JÆ¥£»yü2Š°h®£ˆ(NªÇE„Š">MCÐaµ¾›¢öäÛÿÜ»íQÓK×G¿ÍþE·­T²\ãêÛ’m[€K‡Ó-¨ýîÚÏ/³6?u}‚EgÆKXíWҘͪížzÁf ? Ù<ïÅ{+ji”0Ž£ìÁú:`\Óú:З…$:TÉ»³]5œ½õñpxf€"×c°…NðGµW ,ì³[^µúcÜ©Îô÷…“öY‡ðÀ¥CCg¨$øßÊèsÐa”QNd-¶ <1``‚]ì;¯Þ Ÿšôý„—Û¡ZF–òtC-ûš¨ûmE)¹‚[ºj*OÑÿ4ÍBäõs‰³«žÓU¹}矄di)ž\÷•˜Îɇ !;r£j…BÊ7ö"ëù¹´¦ hl'ñ¸ÕÐ.)‡Í¬Ó½šƒýy!ä7ï‚åÓa~ÖÞëÆò! ìä‚Õýý,úÄt’Vï—<‚u¿Ëw‰½†ÃÈ“¯˜{C­Á`X:›…tMŽÇJž*zÄK³òQJƒaYödéði “ŒùJSõ”™ï8dáwš@Þàû›·âNýLbØ·,VâWòê…¶šÐAl#Ÿà5Õ¼FÈ*^]Á²>Y½ˆe-šëØÛ§ÚÝ턽#ÅÞo˜ò÷UÁKkúïBòÐyÓïàzƒ·«q‘óÌÍÒäE‰’ëà;MéGó,|í{ +S¸ÙÉ'˜×ÀŽùƒÍk°—;lí;¥æÇiïù+ôªm¢ïÞRq¥ V0ZY‹ „ö/ò. uþ±™Ð=>ÀR%öh¾õK1Àæ}‰Eü)K¾·sÀÑòsÃàÛÓ±›J¦_ €Ý·#º~ïs#ô,ìy©w.ofnœ…—ÿKBs;endstream +endobj +6535 0 obj << /Type /Page -/Contents 3322 0 R -/Resources 3320 0 R +/Contents 6536 0 R +/Resources 6534 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3306 0 R -/Annots [ 3326 0 R ] +/Parent 6510 0 R +/Annots [ 6541 0 R 6542 0 R 6543 0 R 6544 0 R ] >> endobj -3326 0 obj << +6541 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [425.738 463.492 509.276 475.182] -/Subtype/Link/A<> +/Rect [111.316 553.795 319.488 565.787] +/Subtype/Link/A<> >> endobj -3323 0 obj << -/D [3321 0 R /XYZ 85.039 781.388 null] +6542 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [475.95 553.795 512.306 565.787] +/Subtype/Link/A<> >> endobj -1170 0 obj << -/D [3321 0 R /XYZ 85.039 761.463 null] +6543 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [111.316 540.246 302.306 552.238] +/Subtype/Link/A<> >> endobj -3324 0 obj << -/D [3321 0 R /XYZ 85.039 666.319 null] +6544 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [130.71 527 227.642 538.689] +/Subtype/Link/A<> >> endobj -1174 0 obj << -/D [3321 0 R /XYZ 85.039 666.319 null] +6537 0 obj << +/D [6535 0 R /XYZ 85.039 781.388 null] >> endobj -3325 0 obj << -/D [3321 0 R /XYZ 85.039 642.749 null] +6538 0 obj << +/D [6535 0 R /XYZ 85.039 761.463 null] >> endobj -1178 0 obj << -/D [3321 0 R /XYZ 85.039 355.479 null] +6539 0 obj << +/D [6535 0 R /XYZ 85.039 652.932 null] >> endobj -3327 0 obj << -/D [3321 0 R /XYZ 85.039 326.743 null] +2638 0 obj << +/D [6535 0 R /XYZ 85.039 610.928 null] >> endobj -1182 0 obj << -/D [3321 0 R /XYZ 85.039 144.576 null] +6540 0 obj << +/D [6535 0 R /XYZ 85.039 581.524 null] >> endobj -3328 0 obj << -/D [3321 0 R /XYZ 85.039 117.961 null] +2642 0 obj << +/D [6535 0 R /XYZ 85.039 473.958 null] >> endobj -3320 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F65 2099 0 R /F56 1642 0 R /F35 1632 0 R >> +6545 0 obj << +/D [6535 0 R /XYZ 85.039 442.432 null] +>> endobj +2646 0 obj << +/D [6535 0 R /XYZ 85.039 117.174 null] +>> endobj +6546 0 obj << +/D [6535 0 R /XYZ 85.039 88.073 null] +>> endobj +6534 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F35 2880 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3331 0 obj << -/Length 1621 +6549 0 obj << +/Length 2316 /Filter /FlateDecode >> stream -xÚÝXmoÛ6þî_áyBMŠ¤DµÈ‡ÎKÛèš5°¡-0űc-²äZrÝûñ»ãQŽâÈÁ€}Ø ŠF$<ÞësG˾€²o *éÇVremºì‰þ P^÷¤ß!úš‹È é‡Ioô* -ûRðD$ýÉÜm™\`ã7/Ï''ï‡RŠ…†ƒ8¶ìò§Óñ»O†’`P%»€ÉÉäbøirÖ;™´. 4בÂ[>÷>|ýkä¬'¸Jl cÁe’ô—=m7ZùyÞ»èý¼ãB4ݧSºZ®@ƒ@ n­Þ)¥L‡Rߢ”£W²M3<cOÿ(¤.@Ÿëa uÌF«´^ ®u9ªPWœ¤ëR- êahÙÝj„1sk ›ÓÁ`öu†û§´ó -yD÷„£ñùñ€dÒ²%S¨)奚ßtˆíG´cðb¡ÙiãwÇ¿Á_/ˆ‡‚—^ì‚d|7>ÐÒÈ¿„QÌelûD£'Žs6- Tó ‚Ô,˜ãW¡b’­€©5¢Cþ(Ÿ4âF×Æx:ØÑñΪÒZ“ÈZ”´R¡d ç´ç]²ã®s ˆðÍ1}ß:ýýò'ÇB0çFgŽ‚8,Ñ*_qC.ïþ,Ž:ôT|Qbþ¢¢/ös$P–K‹±òXF]ñÆ<Œ¸ÄðPܧl4Í•ŽÚÑ Yª!OÁuì JWi1«@kElºH‡J°u5««Gr4·€ÉSR„’ȵF -Ù•céæ*Eè°ì¦³ª8ªie‹¦/×`Ò[\HØ´\¯wÑZçw~[Ns£3T¤ÙàôÁCMX§ëÊ@-G¸ÃÛg5BG‚½™­ýÔßã•“©ÄÀrÑÝœ-çtcZ׳"pY!(ŒÓ­ÎÊ‚qû  `Á QÃrVÜÐZVÓwƒ™ò¼!!Í…Ñ]—dàÞÎÖâNÜãU¼Ï#ÎÜgÚã“þûuh+7^«Œ$˯(Iqn¢ÖéKŠô,–iq“ãN²„ÅtƒÙ¬^”˜R¯¸ˆ)k5[4"2 Ê›îäøçŒ4Y¸¸Ò²©241Ì0¨ÊMEÄÌ%Bh¾|FÀéIËU>[úÂÄXÆ«¾å¦©E8m‹²Æ`)žÎÑADÀøÅï=Ü-i¡s­¨ö ?û¼IsdsGõ`ëRhÇk¿ÙMž]¹Zçt -€TÑþCZiáKŽSúL×YFr‡ÒœªÑ -e+¯À"ž¥¯RãóÀ‘Àûå}E -$·Ê8áËõ-¦40ð0¢#bEÃ+ êš6Tuº»eŒDZ+)`i†Ù».ñîœlêw5.Áñ5X‡t´âœ„\½íoýl'vQ—®òjœ!7øÁ¬ˆ—Ô]ý¯ ãº¬¦CŠ…m(Y„0Æ°æ|ÙÑALlÓÎ=£«É0ÀÎ`‘͇^Ž¶êØqé„|º]UÎþ]ͪ§'—h>×L”tXzOx#îÒî^pêÔPÞýªo¬„'¡~Œ·T,r -ìÇFPJûÞJ±ô{G;ìlˆ3*,ð§m‘NÔðL’ú¿a¶;cœBPÑàñiÉAœGWôÎ,×ug|$­× ÅGÝÈ~ráÚ1}.'¯ðùæä-Œ^•t7¿<½9ùeäÞ§ßwO “È7g†A9ñ¶ô6öÝÖƹ[q™’º´ÃîY›Ä%¦«ð¦£»ob7úX@Ž)=C±ÇÊò´©ÆŽR?ê­ÁtÜÊx'Ÿs&Ö7~Çû×OüN°¨ëÕóÑh»Ýò´^¦ëÛ¬æÓ’ÿ¾yD0ÎɃ4˜çY±ù:ªV³i–æ£*]^¥ÊR¾¨—ù£(6øË…ÙqiÜáèêÈx”%P£°å"4Ý¿øÜßñ7~ŒQ1„"šË%E2@?œ}NωÝsχA”HI„(R!)_Œþó×òa‘Šã$…qæ>fwgfçñ›•š;ðOÍCßvt4Beë0œoŽ3g¾ƒ™¿Í”P,…dÙ£yþ8{öíÊ›+ÇŽœhþ¸íöñmÏ×óÇäGëÅÝÍÛÇ—‹¥ÖÚÒ+{± ‚к»_¸¡õ/}¼çï‹û7oÊzõú%÷ßݼy~³øéñ»ÙËÇ–‘ö84B.~žýø“3O€ãïfŽ­£pþmÇV0}œ¶ïiéç³w³´[ñœ7çUcBû:´ýP_J­ýžÔÊÕ¶ëªyà;¶ïx$vU–Í—Èû³oUŸÖ í•^ÁîHd?۔ſåÔ»s•²Øÿݧù —ΗB½TÈhDk¼úz±TVÃ+š’¿4–Ò6žõ´eº>-`'+Ýàtkãœ'ÊS“•o†K>॔gžÜÄ7R\†Tñ:Oáþ<ϳqlc2 „.·ácÎ0×d¸jÇZḧôIº:Æä.½TŒOóOY.Rmª4nD Í^”º&^â*KII"Æ=¿B–5_‰.êó†'ˆ¾Þ¢@yþAŽ(8z‚±,O×Þ¹Nÿ`{YÑÚ@ ‚OY YF\5ÑQ§‘‹Ó;Ô ÄEÂTGÎ;{¡S¼kÕçû¡õÃ"Ô,1L²Äp•žâ +ìO „ôFlô¸F…ò™H·7 ¡N‹M<£µ5 'Zé ‡¬*ëYY±¦FåÂ&ªé\gŘŽìöû/A‘6'ì™ýóí® Ûq1i/É7¼˜haLØr³3bϳÒ3Zú®Š¤…ÒàÚ¤{hÇü9UæÆßãý•çšÇß ÇÊjC:¤Üò÷]|\¸Ý|ÁËÊ:f»ýÂ,a9ÏZ- (夑PA%îü´¾gĦ–ø\ä 2«U üÕ2… úZb LTˆžLl%'ƒ}Ös¹S¥E|$ù唧 §VÌŸ/ìo/ù‚»J[ÿ)jŽÓ6‰94šÎ ûag')aoP ƒ„Cm%‡±Þ!ÿ|gz ^D<_w%ÿs͸J‡&ÒLÚo¶‰¶’C‹¤'^6%GÌŸ$«ãºiOüËÐð`{ntõh¸0«ìÕúQ®­•;÷µ²WŽKBòl8TQ u¬O ¼f9Yú×*°ê×1÷Äb u³i²÷)·o³*ÝÀ­jǪ>È2XþJéi ã<ÙL‰çF¶\‡|=op©­x ±ã„$Þ+дç¸À¤ÓŠ{h|ø&O£€ $qÆ´À›ÛwØØ9é„ &€#š¯aFEA Y‘oÞ9y#±4¹Ÿýe¥ˆavFC¹ô¿ú¯Oß|¬c£Á*Ä1%šeˆµì &xB°jw$\œ¨=[éë2Éåyƒ[Õ_p^4´õæÕ#7؉«5];SY‹ƒu¹iòòdÒSJÈ¢aÔ˜gëªAÈ›}'sO+¦èÀ t¶HŒÄŽ.üÔå¹j¡œlcpÁÙ\qÚ¿=ÉÊ1l0C>¤²] + ¨ ‹Ñä.ÍŽl"Œ Ð6@#±„ž§Ì€èPDþ´ Ó=˜>j4P„®û+FÓ]1!ú5£¹v 1šÏ5šÞyýLsꬵñúÍàæ­˜K/ŒÛJOÓ:´%ó¯l ¥(~¡hã(´ÅÜV5÷ƒ<#YšlÖ }8«.·»!X„dH$€€AÛÄÜ¥K-–A°—u"ÛöÀ#È2 SÂ-Àx¥U?ÇTPçJBXÊ™IÒ®œÄ;RQî(\‰âI›Tê]¦opð•$)/—˜f–‡jíÿõöÕÃH‡œA”—úU¸ðý‹4}³mÁKÅy©KØÐA nj`±–UØÐkã~%™`܉4ؼa0+6ù9I±ÌÞf;{?"P¼{ÊÐ7¼ù.-R(_(’¬äò@{?cˆF,¶v(ûÃØ9%”.è>PÕžA&ߌ—Ú±÷Ë$Ýf¬ò]ߺ»ùçËÿ|ÿðÜç®ÉB—ô¯oѳZú}U,‡Ž ZÑ:b%x…86^.úŠ¯üâsÍ°ö.ÍN6Èž/JY9€jQÏ9±w Ÿô™’ÀÐ 7À Î '·ÔI|â}F"²=é1¯YÈò Oc^â9¶ò]±±¦¼Ü(våôÄàíK<‹.é¡e‘—Ž!ݪ_Ì»„=àÜ`eà_p=šŸ^8"dÅž@õ"@tµTìT¢F ¥bižO SQûçsÆ÷í„ +ìa¡•%•9n— +ŒM×׬c! ëëµG3 Q]?bP"ÞK1€'/¨`¾¬*:IXƒÝᣢ›`@>@#WÆy^âfOŒçd ígaN¢F« +ŒÉí*;Thd×ruoýt®6D¼Ðk øÃÿþóñgP„«ðó9ëÖ_áLˆ¨ˆç¸°ÄÇ´¥Àð1KQ”Xúº¥t4W|ÁbF°;gpÿ?Îð°`ReÝÅSe›ŠB;ÒîUI{4Ó>¡Àë=?øÄCšÜ™·ãfŸuïÃü„O½×+—缋bâ ™½ó4f'štµÒSuÌ'Zoý´¡¢¾¡ @Gwl×B7S¡lM}q ¢ªU,&eñ[îçËÒ­¿"‹õea·– pÎÏ ‡öQ*yÇjöW…¯˜¨>M˜nýa„¨/Ì Jè.£š71E‰ ë4('ÐOô`'¿R´‘»âêÒ•F£¥Ffž–ò$ÙÀVº779‚=\ÇUò +åöwr&Ø¿¢Á>ÙØë <÷†ÙÈõÂ>~«ešßz¡ÁH-ˆ:>M±”ð8 ߘéRSß™ÝÉ ¨fÿ"Õ¡šÐé] +ìqŒ öÁ“ O©œDªƒ‰]ÚL¢·N¹µ`“–oÝ)ظwüQþxóßõÓb„!½†:·sßumW^(×g~‚¼`ø9\ü—endstream +endobj +6548 0 obj << /Type /Page -/Contents 3331 0 R -/Resources 3329 0 R +/Contents 6549 0 R +/Resources 6547 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3306 0 R -/Annots [ 3334 0 R 3335 0 R ] +/Parent 6510 0 R >> endobj -3334 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [361.406 452.141 512.306 465.042] -/Subtype/Link/A<> +6550 0 obj << +/D [6548 0 R /XYZ 85.039 781.388 null] >> endobj -3335 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 438.895 308.034 450.887] -/Subtype/Link/A<> +2650 0 obj << +/D [6548 0 R /XYZ 85.039 543.429 null] >> endobj -3332 0 obj << -/D [3330 0 R /XYZ 85.039 781.388 null] +6551 0 obj << +/D [6548 0 R /XYZ 85.039 522.232 null] >> endobj -1186 0 obj << -/D [3330 0 R /XYZ 85.039 717.788 null] +2654 0 obj << +/D [6548 0 R /XYZ 85.039 291.675 null] >> endobj -3333 0 obj << -/D [3330 0 R /XYZ 85.039 688.99 null] +6552 0 obj << +/D [6548 0 R /XYZ 85.039 271.383 null] >> endobj -3329 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F41 2104 0 R /F20 1617 0 R /F56 1642 0 R >> +2658 0 obj << +/D [6548 0 R /XYZ 85.039 214.603 null] +>> endobj +6553 0 obj << +/D [6548 0 R /XYZ 85.039 191.887 null] +>> endobj +6547 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3338 0 obj << -/Length 3376 -/Filter /FlateDecode ->> -stream -xÚµZmoÜ6þî_aôËi[I½¢¸I“Ò¦1.q¯(Ú ke¯.ÚÕFÒÖõ¿¿y£HíjãzE‹"Gäp8/Ï W]FðO]æI™â2ËUhòü²Ú^D—0ò %qbÂ$Ž¡½0xmG¯SFq¶D£³PgæòZÇaÅËÛ‹¯ßèèRGaššËÛ{¢¼]ÿè4\]'I¼iV*hëÕµIÓ Ü­®U°æ—uÕ­Lôôžƒ¦ -*h}jv«ßn¿»x}똴Äa¤YŒ€Æ„h¾À¿2a¡Ÿ‡&NøW¸ƒ¸^!ϸ‹¡: <›nwŽ³è¹™DOë *Iþº7;X¥eâ ìë’[\¶Zé,Ø` †n‹lÕc³­&ª°£< £4$Ýcr=ܵnâF†Z7LIó‚¼à!ÄY¾PR bìvS÷øy”!_ÜW:ñOçu<íiVZ?‚¡{|¦AËÇ ²¼ÃÓwGûê]]¯íœÊNÇóËžæªû{ï·µÕ,øøŽØàvÉÔꇗ܈Åò;òvlÜ&IàÚABø5Rqo¥;âê% Ô_¿Iý³4:Œ#-Ú¯”{¢aÛ rŠ‘O¥QþðR±(pÖžm¦iE*³=nPJ9JIç !(T˜…ŽášX£nfŽ¢møÜq ¾ÇŽ)g0û¸/w5÷à b‹u´óÉb 74Z -ñÞí GPpâT€r†ñ[loh*wQ„¦ÈgÇÇTu»5«9zÎÏ«å1ˆ±4l5ŠÔ.ßCI|e˜õ|RËcéób½É飀âüDçc€ìµÑ -íá$^jDé¡ úÐMÑwRÔ˜÷ŒÇ¶È ʺâÉk~WÍÞŸIo¾±¦£ÄU8 ›Œs£@C æσQNaZ«õªà^² ay3ˆ¹â(x{ÏT%?œ@jR~Ë΃tÎ6È]!iÏŽ¡ÎÞwXvRêü|˜P#ÙŒmJk”žhLMêd÷ŒqT®‘±ŸC+EV°M6oÑ5ÎŽº~…ùPÐàF6ôÁz°óˆÖiq -'[`º5-m±÷Ž§-3"lÿHþ -GI•ŸœNÓÑ@üÃ;t°‰~a³³“° _)0“C¦1sÛá¨WïìäDÆxj‚•ÄøD¤d"Àìç- 7Ö7워ÊY›@¨?@ÿK֬ŋɆM‡rl×üÊÉLm½v1Rãö±{¬æžâ:ì¯=( _Ch—eøx¹ýØ7¤ó´:!+Ò/ê øD{:‡R=(OH!‰FÕ÷XŒkÄŸ¸¶ñØŒ®z’Rnª´§#÷•`E…£–Ý~*˜ƒHêc§Ô¼H6L‰!Ò‘ûCv¾Þºž#쇱çÈ1œâµ ê$bØn«ðø„Ö(à[ ƒ kÂïÊv踳l·Ýà•­§BM¡~7ù]6>úˆb”äx¥P{hSëÃ30LI[" ¹ÜMxæzÁÏ8l²må'Qwôag“!«¾‰«“#»g%ÖžÃ)×Î!òéÁ:¤½Sç‰åR?®tÿ<›BŸŽ$‡\É*S“*plô9xùÄ#“ ZÊ#?.#•Cgæ¬,¶ÁËpçE)¦³Bƒæã†Ü´ê?(È6•-ÒvÚrøäccä²g‘’-lÓiÒƒiDk‡‘ƒr#Áù‰ìòÀ/ìkÇ…º„Š’ÐÄFê g–z³T‚~ü‡1P,Ö,Š"ÔYá×,¦ 9NJ¡5×N„Ç°Q'Üž|±  -”³(;v:ŠÃTë™ðüën¹•'ò=UÊ”ËCÑããŽ,8I¥¡$9æ#1º™-ŒM N6äû“ vZªæ -Üñà²Ó¿ÉÛiÅýG(ø{í’ó9&gŽh;7†=âê@µ®ã¥@±jM¥l:Ÿ¤€§·zm3°Š|JÒµþñb'9+ç.îÐ-´'‘»žj˜ -ÐÖ×µ|Aµî\ña@`}Ðpq‚Wa5keÒYCŠ rçBjq#rè¹ZÎ?o¾ÿRIØÄË)‰Uj£%+/1Ú"•€¡û\<Á±FhÇ©¬{ì -“8,5+Ò¢]ý/EZCWNÎ0”šŠŠð&®LªŒ¬XwL/“€6y|îÉÀ› -ëNú(¨°[SE˜¥™ïˆ(ÇG_dk¶¿—üð+¼R¤ÃîµËÿúm³sîHÍüÖdÒ?#ÚkT•½Ð™Æ|ûÀé]m(#CC%bÇEQ£2:Òº; §žªŽ€V@O ©bù%ëëD›à…@¯35Ú:¨QL¦ÆòâÕë÷?ߧéˆo=®M¡ÃBÓ]ßç‹_~‹.×Ñåwݼ½}-¡%ÂD™yE¯·;åR©8Œ²xúà¯Û‹wï°`˜ú¾`uª\2ê9vÀÁÁ3¾ª¡ÒpŠÞ}»ÿ€q¢i›ÑÓã­Å™øþ”];Ûi˜´‡@Û_}doÓo_ʾ!sàÓK’0Jç§wF¹DèPçÙÿëàžåøÕ †åð„Ô„†àeÆñ¯ô³°0úÙ+}-WúŽP*yñÍ~O¿9èV†Š”Ã7ÆzÕÉï\©ú¿]QèÄ/û®=û›fÅ Â$5Ïü:àq%‡óhËjfÎßÖœ> ¾hÊéFƸæYÚ2\†‘œBT¦¥j]œø—ˆFÒ*%ð•„\ rÊ¥íÇ®íJ¹É´Šy Ö$ ÁŸq‘;÷oc)ÓÄŠj)MÏ„Œd×ü²¦ÕTÛUWè,µÒ#)‘0Ø%˜sºPÁ706¡ž²7J3ÔÄ3,ßÝ([î™pvÝÒÍÐq°7‘«¼˜h~™~uv¼Ÿj+º˜š.‚^ê)Íï3È«¹4 “Ü­”•ŸdÀflÐ&ô|ð~ ÃÓŽ‹y}çt²æ1Öž9óv™rªýébY"vwÎÿtC¹OÔT)ØqãaÚ!¾M¹ÛÃÎÞÞWî&bd¢£Ÿ•”t‘K?”¤+²D#+ØßáØ…wxßpÖÂqf+û¾{è99®²¹²¶eu EeÉ$wÕãݤª¾´§D#)œJ@4ª:>üyuŒÐå¥õ rü8LÈVÚwåtR8›O0Ôý¼ä \ßwÒ(¥çRè¶>-3άðlîòÎ+3´ -<¸rtŽ³ÔkàÌ,A‘ú5vüÇ×^ì l ¤C5iðU·?Nt†¯¸"‹ÄLK6Á{zGÏ-N¸a¦n/×~ýÈ÷–È¥*¤Y¸< -Ï…‰™ýäí$Ž¨> +stream +xÚ­Y[oÛF~÷¯Ð>-…­FÎ /û–6éÖEšdEÑö–(‹°H:$Çÿ¾ç6$eKª[†Á¹Ï¹ŸoŽô,„?=K +M6KR­LšÎVÕE8»™ÿ]hY±%‹Éšo¯.–ßÇv¦C•…Ùìj3žã”ufvµþ-øî‡W®Þü<_c«ù"IÒà‡÷ó( ~áÑ«÷üýîýOæ:¸|û†û_ýôí«ùW?^¼¹®€K3¤âÓÅo„³5PüãE¨L–Îî¡* ÓÕ¡œ5Òß]|¼øÿpÏÙï:Æ´_±Ð™Ê"w^0±V66ƒ`"˜µÊØ£u¤ŒŽf‰ • -I„á@ÎfÁÇ>Ÿ›0hû²¾Þã$è·7:Hu m¬y$¯¥QW0ç§NˆÉ&*Ñö<áã"\»‰F£Xiá¿ÎS4{¸8 ƒj%Áéæ ô<¸ÂÁm3_À§¡ ä&ù†¿]Ÿ·½4é„kZ»æíÌ!4€C0œKý\Q‚hZÞšwü]çEÕÔÒidr4µMŲž @ÁZ(v—¯þw™,4j;#ûöv:Ç»8ÀmÒdZ›~û/8FëàM sBL? Í$ؾÊk½ƒ5û^ÎÜ]p÷ò{3•yv:ÔRRÖE¿V«¦ÞðÒõ€Í¡Vx%‹ ÎßÂ]9Jõ3’RðUýÖ‹@î&²¥!BfÀ˜SQhXŽŽ]•œlõ( ¸M„}ƒíŒ…cÞ X\ÆüÛAãÐ|D‰e=(ãœ'X0Gݲ‡° 6-ê¢ò²äÃHظ¶©FrwsT}qD¿DpìN( VI‹T—E¿Z¶+µkVùîˆ + ±ÎÊbòç0øè,øñf‡ ‹H ƒ&‘ßкŽG6ž¬õ`®¸¦ÜÑ|ŒZ‚¯Ïó˱#\°C“¬ Ù…õ%;9£b]ëP«Èˆå +];¿³‰2 ÕR¤›ÐÏwyË3«¼•5è#øm‹|-!‡®Au4’³7xDÏs÷Û\ZCü(äìÁŽpk](üÑr{!]C~D“M;H®=\Îá)oéú§öð1çP“ƒ­µÁeÍ9l ǸÇÝ *ƒ¡Ñâqõ“`ƒ¡ÆXˆH,†~îÕ –t ”ž…_ådý¨KÈ‘½Ïs°u¤+†nh)œ¸Á¯x5…»ÞÒ±£Mã(®#ÁÆcžºé½§¦-¼¹‘ÈÜ +Ù2ºîÂ×ÈÇ‘Š¬×€°eo9¢Jh‡ñ²ãoOvÁ-¯Í¸/w;nµ~¦»c‰z뇹nWÞl‘«~'ûª¦-¸õiâ¤uëg)ÆÇŽ‰„ ÀË?¹\Çœ×äUÔ&zjGmñi?PÖ«i9CÛó@k²fÀZe(Ì1-»4UiMð„4e·AùRË6DJŘ°iY•Ü;Ì1Gvi¬l–#8JT”@Â0FEŒ"Î#2HÊeñQD²L2•Úèä1´)„c¸%«OYxé,lb”µzaÈ0Qq2´p–a¾k8<¡IÂ/·ü}šiÚ,3¼fÒ&úG¶h`yYéÙë(Ëç.&3K§8ÌÅ*³ÉÌ…©Šb'aBR_l sìv šü½@È(¸§ØAþ=v~YÞZþjÃ1·¨{G+ÙpsŒk°yßÉÆw¸áÓÛ72@ÿp‡hyËÛ×ØyõgÀÞúʺìú¶¼&`$᱓РAŽ3NÑñD•ßuO¼É&Ðt6›¨ùŸ Ú¥_à¶ìev|h!ÛópÏDøIAó,”·’ n!®:ˆ?=½:P8OKœwÚ)`éŠ$ÒûkÀ’dð#È(wa¶.AXŠ¥È·>$J"/çTÑ&[ö¤¸;†Ùxøå†'kÊzÛ!·À%åJNΪÔ%‡RàÕv§ðaB’윯×ÒàÏÎã|4™]éq NõÛ²ûïÑ¡Iƃإ ^—M·è:qä„£»#r2ܸ½++Ÿ°&í5àK„€´µI–{ìÝø@©šÒâ~'¼ns\0àx`+Þ &üN!ÖaŸgXÇX]¡Ø3Œp[‡5˜Àgòû®ø" GôCPÈåƒz)öaVo&ò¨}øè8Ûý`}d!HïíD¶„7Êî´MF¾ˆR%Ù“q`1Ô +@“ÔFË¡FÝÜç(l·M#­å¾k—ô°Xvyu/¯ËzÙU×k9 [OãæTg¸l}ÓúûPsÔxömõp[-·=’ý‚Ôȳ*FùâK¾¢Ü!÷APék6G¤¨ØÀCù©_ Рk[’^%«%þ¥Ä @!HØ£¾Ë/…<|€ÓtcqI. OI8¸¡÷J Øî¾ÆÀñeÀ0”ï†ÇFŽç‡)e~–mËÈŒMPŒ(D<à¿¥fAq 믵O¸û(ü£“³žÊÁÄNÅÆÈ¡Ò‡T€7½P?ø‰h|d/¼¤*Nãƒ0Õñ›‰0!äq§ñ¤ìxÅÅFðÖÑgLzÀXð×_ç©•<šÕ¾ë¹%Õ£í¤(@Ãë²?™Øø3©áFÊ&î°¬ÄøÈÑÀ`œœyéã„çƒ^ßøê‚XàíÜ ¿Î¹’æ c¡öh˜'áóĵÿy 8€Ïé‹cW17s/>FCŒtý\Öüò“hÞÁKÑžÚòcä™1Ø{¾~Ï=µ†wGÊ)í=V˜4¼¸Õ=tLz%å.ð*¯•ÚvÆ*öÐfñ;Vöd|+²î‡·Þ&§’Œ„\«í¤d)‹O ÷I´©®O9“ œ9q& Qw#|X•›ža¡qù¿øÊBBt2Få³HOÂz•w·> endobj -3339 0 obj << -/D [3337 0 R /XYZ 85.039 781.388 null] ->> endobj -1190 0 obj << -/D [3337 0 R /XYZ 85.039 761.463 null] +/Parent 6510 0 R >> endobj -3340 0 obj << -/D [3337 0 R /XYZ 85.039 667.044 null] +6557 0 obj << +/D [6555 0 R /XYZ 85.039 781.388 null] >> endobj -1194 0 obj << -/D [3337 0 R /XYZ 85.039 667.044 null] +2662 0 obj << +/D [6555 0 R /XYZ 85.039 761.463 null] >> endobj -3341 0 obj << -/D [3337 0 R /XYZ 85.039 642.326 null] +6558 0 obj << +/D [6555 0 R /XYZ 85.039 736.911 null] >> endobj -1198 0 obj << -/D [3337 0 R /XYZ 85.039 192.312 null] +2666 0 obj << +/D [6555 0 R /XYZ 85.039 600.648 null] >> endobj -3342 0 obj << -/D [3337 0 R /XYZ 85.039 160.787 null] +6559 0 obj << +/D [6555 0 R /XYZ 85.039 579.451 null] >> endobj -3336 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F65 2099 0 R >> +6554 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3345 0 obj << -/Length 3282 +6562 0 obj << +/Length 2051 /Filter /FlateDecode >> stream -xÚ¥Ùrã¸ñÝ_¡·¡·,š$x¦*ž3³;3ތ̦6û@Q”؇–¤Æã¿O_A®T¥\e’@£ÑÝèòüù‹4r=•-’ÔwUš.ŠæÂ[<À̇ _ ¼Eèzq„S¯ï/®ßÇÁÂ÷ÜÌË÷¹_ÿî¼ùÛͯ÷ï¾^.•RN»—Ë$I÷—¾óñré;ŸÞáLàÜ|y‹/¡óõL½Á©[xù*£ŸnßüòñˇË?î¾xwoQ° Ý0VHŸ¿ÿá-Ö@åÏž«²tñïžëgÙ¢¹#åF¡’ïúâîâï Ï… ^u‚ÑeèG®ö–ÊsÓ44ûÑ Ž?•ß/ƒÔ)‘‡:ú}ϹÝ3uw¹„‰gœðï;ù^­á]†;ßx×Ãë¸oá5 α‚ׂáf(+„yà 7°Œ^r~üÛóC$¡äuã>ò‘瞪ºæ·`K ƒùX®Û€GGm3®âÔ U$ì÷—.‹ÜÚwÖ¸—d®/}”uF][?3º™ýÌM²P°¾„QêÜ#ƒÏ(”ª Šjdæ•#efP6ø¡Ÿû¡äíá+­ø‰b¨ËA¯# ÀpÞ—<Ô—ùzItñ²ž‡íå"E>*½;#’•9E]•-Ò-s7°8„G[mÇ6B§XU^›ï sFÚRÐÁ’e›°¬`ºè–´Ûjå ,^å ž*Ø}†©s‡D4¸ï*ÅƆȕéËLd×5/2*è;W0’Ä@?p·Gۼ㶚°msy9tZ¿q…îÈjÒó "aÁÒèCO2#ÕÁiT|~¾#V½“ßH ×´ Õ¶éY"¯ôˆãJ8b˜CΉ††#Å”ð)Á˾5 õ<‚xž+½ò%}Åïw>òËǯA~㯜èåw:ô”§Ä‘!}¸å1·`ñ¸Ÿh?)" º½{5hÃÐÖ$hæƒeÖ 0p¼0´UÈÏ -~lZBÛ?Zc~jB¢€P$nÇœ©Ò3+ ȶlhØïؾ»~”u'´ë벎¼DodíƒÔwûzÍCk”ò•øEÜçBž@v73Ž­Œ= -É-D×Lþ¾`ƒH#pX»(|gúJ'=ð÷†Ì¦aЇT2`ƒl«0}­ÞȶíšAî>¿æ‘ɘÄD‘ó•Í*ï×z? ðê”z’‡ÓÀîkÑÛë ;ɬ ëjÈWu)à"M|5¥BÍ`í°%Õg3Bü‚…ü@¾ÊAk ˜Þ#O|=ðæ¢ÑA(ÿl"/"ìˆÕ%;ž`÷¦ H ôA‚±?±‚ËØ‘H(Ñ%ÅžC¾”$2V;Qû0lÙ£ÏÌ”CNpæ4üÌËWSÆòÈ#äaYìð$QYWzŽÕ8Õ—ÌBÅ©ÜÀd@¢tÉVƒ;JE ‹SBž[òÛ¾ãÔM<¯J$'Errð®I€P_õ2f'môym72Žÿì-np`Ô˜ÐHDv -¢‹‘IÑ‘¢ây੦‘ó´­˜FÆ`ü3¥ƒ€É,öµìR ù –‘6“ i$‰cåˆrÓ&o ™¬š]Ž›öÍì Œ®Ðn èzYÌUSŽM®;U »õÝÊ$iÍÀkò™NêLg´'Á÷5š§ilóÈn‰ØÏvƦÓ#ʲþŒ! üÒ1ÆZSBzÁšÏí~œÊ…î‘¢¢·Ä8t-%ˆ@˦«§è9h²"ï'wgT„g&)d·©ZéI’Ç»Ê×:Ýöóæ¦Î…¨Á…'ÈÛ2G§“Æ©!RN7~F­¨Í 8pPÜbáøq‰"ÙZ“!Waá¤ÉTŤñ”mà)‘$øš8NM‹FÈ5ÃŽ’'þÏ©(øknÿ–Ÿ/Pn8î³%€ n ²tòÎ…uÆë լ܋¥k“xÓæðn‡»Bgbº§§Ò+{<^“QàB:4ØÔ6Iž§à«"ðö”\ÎyÅ]Ïí*Ä©êIõ:~mJNö3×jqZlQKDÎUIÙ–HñÈcT¥«Y­§ÎyÐ+n’U²” -Êêa+jiÈ“wc0ø1Å®‰Ô™ -y›C}Ð?2‡˜×“;,ócs®sô/L‹Èâ°ÈÛ óA]IÏ“l¬ˆWÝËù¡•ci«0CN ^5œ§X[…Õ[b&ÿÂ-Ke·,c7HÔÉõâPÛYW mEAäü•ïóz8‘SÖå÷ûÄòⲃ>éòx×›zäò>çdhr®“&‰¨¹ˆŸ„-©Ø±”%{AijÐòÍÝß V™Ï9à¡k8\¾$ËÌõ"æê{‰nd¿o**¹-A]ÿä6ëüÿüö5ü_¯6ðÿíë÷×/ ·QSÆØ©|ÖrÊULeBN¡Õ‡r -Xd*Fâ"à¶!NŸ0‚äúIÝØÚC°jC^§aˆ»œ"û*%KHK„T^Ö›ÊVš'Ú,3hr©¥;;¸X­æ]=Á)r:øòœ¬‰a¨[¤XÓ©wÇ-ჵ}{ÃÁ˦/=iûR" ë§ÁtÂw½$>u£$|ü~ä¦~`îs˜ ]Æö}N» -£E˜a«”úÅßè´×Ý¥ò¤åœ8·ØnSè+…5º´CÀ^FÁ Ÿ8HÀ|ñh„XšM*Ž7y±ÅQí#7S¬œoºvì»z8bÖp°/ðgQðòÝÕ=DñržçüxluÐ{b½§4»L¨“eOÚß–XOµ›¹cÀ¡|GWºr§![bL}™ÇK¶8üÂQŠëY÷J–ÿ¬zÓ -áTÙ.S„úo´õòD`³[Ü‘xžwͯ¿ýÊcd‡Qwp`°èŽåÀûH‰/í¾T‹$–(õ‰(Ú2ezV4½#Í® - {>Ž¥Á?JœntŽéŸg5Â=ß™Ç<¾$Àü »A°æ:"ôSXÐ;ÏÏkOT[ìl„)¨J%ÛUó}it»F8DW XÌóc]nr{šéGÉ"Ž™,ºé| ” -³¦ åÎ>M'õµaÚ×A8LÇŠ$_{aàÊGã´ ·Ñ’<®9¡ð°øô¨n$LĆÐD˜’rÇB‡Ý€—ÀiüW<.åzT0ÌZM§.GC7Ì’ér4½ø¶¥þi@¶Š«Q Âéâ¡fê…‡ðu!MêSê>²Ñ¥@é2L:ÀÆÁ›‹c1{·Ý¸’KÌÓ‹×O^4¢ò”6À+¾ž6 †"Šõì·Ð„æ -uA§°^xêJ)˜*2ïÐHO(-ÅË(áÌ èKcv8x¶%Š“+í¢øð†ÿG9A’Ùm‡ŠÒ)”7 wHPË;ê»'¶r>Q2»Á³nÚ!MÇ Hê6y÷\ëû-´!ÁS˜rÛ÷AæÏlöÐ’mü¤†§¦:jÚô'Ĉm\¶!Ë+mèÙ­n˜ù(!¶Ò&ÞžùC”Æbx7d¼æ_9H±¨¡l¼-[H#ù%Ä9CîzkÙ÷ºo¤Á’?˜¢…|ÖTg…V‘Dò“¤Ì.’Uà¬÷½}³®g~0ùEˆÆîùl#„Ô*ôOÿ*H˜ÿÿ~“£H⌠_LZü49$Ô‡œ-ÆßXþž3endstream -endobj -3344 0 obj << +xÚ¥XY“ÛÆ~ç¯@* VŒ!fƒ#/)y-[ë²"EËØ•r\Ä’ˆpШÕþûô18È7.©¶$ÌÑÓÓ3ýõ×=”ŽÒ‰ðuâD±:Žm¹ð=Ìü°V³"ÞDæÛõbõ}8Ò‰Ÿ8ë‡QÑÎz÷«{ûæÕûõëKOkíêP,½(ŠÝ7ï–*váÑõ;þÞ¾{û~)Ý»Ÿ^sÿþÕÛo_-[ÿ¸x½ ¶€M´â÷ů¿ùÎ,þqá ÄÎ#´}!aº\€ÂÚö‹Åýâƒ*ž ^5wè@…BEØ0"VñÿßN›D˜$œÝÎw<éû`ýU5´È5ܲÒçZ<)•ÐR9^¨0zpD¤)Eb :BÊH„‰r"¥D€¾Oü²„Q7mª¥'ݼÚ_Þl¿&Œ`Û€;¿ÃIàâߤMgF«»R9ßÕ`­sf0ëõ&ŠÉbO #M(’ rÂ$ìdñÛ´<<-½À×î Ûùç ­oy¨®Šq>Ýnq*;v¶¿T‰ÛÔ´lÇC?Ê=¦¾ÆÓ’ÔuY3hd‘‡ ‘ñ8©®Ë?) W;¼=r)`ȵE^ñ$p¿(°ú^›ÉU"tÃ*Ï«¬Û‰m]=°äÙm˜p§¬$ÄL Cw Úy‹úc—,Éè~ìÈÓREn}ÂN„cl}*v(tӱԩ͸AG¼ƒm¥8¼Oäò­à-=¢ÖŒút" ‚P„ŠÏ0°ºÌë0tëc—×Ö$ì§öî©MîØŸJ«Kò·ßÀtû4(jð$1;g'á!:ë¤O»mòcgM÷l;öt7uÖ™Ñ:°«™quÉQþÄ!‘Tš©ëf¼¦€›¤¼v_è0 8Æí—“òŒL"ǸëËyéœQ¤Vc€NÁ+•JI'TRHŸ!ÿ¡Ó¥ ^ 2nè]púüzdP5‡ôhÁ¡B÷¿'npm; cg•Ù‰”?oþù~ Ø»CálÀÀÄ|þ ÿËx§¼w¼Ef7¬Ð—6NÑ÷Ež5<Ö+D´±M!`/e +§ú„[•ˆe¤Ø*n¦B§LQòi\Iûeý¢š¿ó¢xIyÚ2‹ ¤Eq%sš@½˜ãG‚Â$³0XL™qŽ‡´nl©À7ÆøJ»üSöWà®8ûƒËO—Ú‡`ÄÔá¹9“6ÓvÑp²4+ù²ç…fÉË'efÜX6²þ[/c$!,3 +ÁF˜,ú©¬ap4gÚ +|xÁ}íc 9fù?R‡Xék¥ƒ–ˆdüòkÞBÆ\Ûÿ½îKÀìÚCD´@&?D$¼’„Óö•‡ˆ|á!2Q|ý!¢C-|Fcï0»ûÁXcc‡ËP¿ÏиÿÎô!àNÛQr/ì\^õ€ó-?µ§‰AKÅ­1]À.öÉa£ +f‰¦òCÆ£`Öy$½Vø΄Y”mƒ,ûœ–Ç"kWí§&ðˆNÇ™r+ÂÐô¡ÙnûÌÂå´ôÙ½5·'¬)¥{O¯MÊsÿöe`—äUgtk>PßaxvŠö‰³tF÷sµÖžÀòËA~Vl'_Yl+|ÙiøJ'úÅ"F%SžÕa]á´ˆQ1^NÔ×aø Ü‘{‹UIïY,¨^7MMÕW{¥¨êÕ¼hÏ(s½¨RPTIÉ1þŸ»·Äg'WÐÜã;]ËÄÕüHæîn†ºf¶uy̹X‡9† U¿©§yìÁÒ. p(Bã¾ÇNd“M[ÊíŒÇ*mräj2¤'Ï«ÿ§™0*H|où\dmß1~à3­¿Ý<§z5̤Ä×}LΛšR~éÛ”Íy…êG›6ée‚Ôr˜ûÅ!Ò7QÏ˪tSd^{H›l7“?c@nÐWx»áøÓ`äå{gª(¦r—~$H›‰àQ>iÊ´c É·6øÀ·¸½å†¶‹°>À‡uÝôÅ(Ží² y¿F˜@'é².ZÖ—Ûï¥yrxdÃÂmnó>˜Õ‰«O»{| +4ùñyÖ Ôk¥_3@hWW7cyÁ8—QMHrÞžGúâ$ûŸeò"{î`^„û–ëÌv–þlÄB«fßIðÏ÷U¿ŸÄhë+-£”P²·…X*Ò—ö ëçÿ !;Sendstream +endobj +6561 0 obj << /Type /Page -/Contents 3345 0 R -/Resources 3343 0 R +/Contents 6562 0 R +/Resources 6560 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3348 0 R +/Parent 6566 0 R >> endobj -3346 0 obj << -/D [3344 0 R /XYZ 85.039 781.388 null] +6563 0 obj << +/D [6561 0 R /XYZ 85.039 781.388 null] >> endobj -1202 0 obj << -/D [3344 0 R /XYZ 85.039 229.428 null] +2670 0 obj << +/D [6561 0 R /XYZ 85.039 590.17 null] >> endobj -3347 0 obj << -/D [3344 0 R /XYZ 85.039 184.88 null] +6564 0 obj << +/D [6561 0 R /XYZ 85.039 568.973 null] >> endobj -3343 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F65 2099 0 R /F35 1632 0 R /F20 1617 0 R >> +2674 0 obj << +/D [6561 0 R /XYZ 85.039 292.426 null] +>> endobj +6565 0 obj << +/D [6561 0 R /XYZ 85.039 270.664 null] +>> endobj +6560 0 obj << +/Font << /F64 3112 0 R /F72 3966 0 R /F18 3969 0 R /F35 2880 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R >> +/XObject << /Im2 4150 0 R /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3351 0 obj << -/Length 2333 +6569 0 obj << +/Length 2878 /Filter /FlateDecode >> stream -xÚ­YYsÛ8~÷¯à#U1oΛW–ÏøZ[UžÔÌTŠ!‹kŠtH*Žö×o‰JRë”4@£¯»iaØð'ŒÈ·l76ÂHXnË͉m<Áʇ¡8lóìÀÇ¥-NÞŸŽ!l+¶cc±"–Eú—9ûxz»˜ßM¦®ëšN`M¦a™ça^L¦Â¼œãŠcž^ŸáÀ3ïæ°4Ã¥Ü)êåÍì‹ë“¿ŸÌ= ¦žå.Šðåä¯l#)?±-7ŽŒWÛ–ˆccsâù®å{®šç'÷'ÿnOá5Ïà]#z·\xÞÔµ­(òÚ äŧyB;‘ùð„´œÀøµFZl–/“©šXÁjÒdų×HÛܨ-p -­7kɃë/¬’M–OpM›5Ç<É’QuR -«Àò˜Ô’ t“¬¾¢„²R\+à)+Tµ1U¯› -ÔPLÏS‡¯™ÛƒY.k=÷íL -z9¾ËA. -F) ˜ð·¶ûÔ…äqÝ”•Lõ^¦³²CBje†dI•ô’š8i%0ñQ;æ*ûçÐ*Ø¥aÛÐ^z°=xêí¬† tAan+ч¡ÐG’°@hJþ]+•½¬.L¶|Y5[Ü™ÕM¶äÕœ™ûrÏÌÉ)à¬4«“Ç\ߤ."–UÚJÁ§áÁ2C¶ÉþKbªõµTYýÜ´Oo.W(‰ßÙʉ‚ÎÌ<]–UµÅ5(IY@P{ ýbÕÌ@.óm+›¢? 8Š§ûâoï¯ä;ÇþAààÖëÅ;f,öplûÛˆ “"eeŒXœ0éÏÛIäšmq÷‹#Ð÷•[Þ“T’©Ûºõt˜%üs÷®Ï1 k\ ¹ê(ß1õ•¯žëð ,ø’Lý¾äÉR]W®ÕmdhgãÙ»‘=p_˜lëæh\'yMNèÏiJ[«Ãå/£}•ãR^ÒŠr_¥\@< çÏû®çàr@ýøfäo1 'ûZ¦r´ó ŠS1—ü–l^rvPÚŠ©ú퇱%ðsCVbdÞr¾AÊ«¶ ˆA È÷@N­\(T† •aa™ejßÖY2‚>Á'ƒ>l¯wuCô ϳæIÊ6÷ÀŠãåp×¼×pÞsÇó9¡õ -œºñ9zSŽ{µí8=#£c4RG–ƒß¬áß΂°EÃ:iãr©q ÆDUn˜­Dõ¬eÅK? Óï8TAºØ®YHFjW!µG G+™^¾t~™ÏµŠ:ˆ]‚… gk0]s>:io@¥wþÃÉH3ЯÛÏnœT–­a[V«äOZá±–Q{˜ª¡ç°£åGdVò)c÷Dïx)ö Ñö+Ž¯=É·=8Gò*…=i¡2°µ¦5fÔLe\…ÒV5Cý¤Œ>xÊE¡B‡ÂÅ9\üX‰ §\&Åš¬hƒ¢â…~Æ%oæ<†^#û§#^§~€ÙÃQdçÐ5 pé=mß8º?aŽ"ǾàA/Ðñ«“ t+Å‹ê]SÅô„× ŸÝ~¼0Å7‹ˆpùÛ¢fɆfó¡úwª‚äŒä™0¹k]ªRµ(‡ƒÌ”O|ëh\L;PÏw]¸oËv\ÇœSüB¹ˆyÁ³Í‡µ,˜·`c!I¥2upuð î»<êÉñ‡¿f\ê;û%Ÿ£ †g[³»•Íˆ'uYÆ,"”,êmÕ-«ZZƒ‘¢òUê'€ã‰¯” -Å úŽè£}j–Íð Cft0†WüÛbSn“gR]Dk¤[6†5/ééJƒ!B[]u[´ØA±¹äÓèÜÁ £u9(®®ÑÖ) ŒÇ<ì°Tó°´Yƒ+ÊJ¬m•!p*¬«ºÝCDA†ýJî*ÓèŽ&-éy%*¡Q…c¿<[®Ö~ãÛ¾Åñ#+râ7ÀŒ–£ 0¸c[‘w¼¦M6Ã#âvöN92‚À -b§mCXVŒ(Ö5È×%?ýw¤¡÷­Ð¡6ÜøbËöâØåÕÞ˜äì6áýÅFg%HdtB¹±åÀí`ò(]ßôíXktŽ:ÚB¡ -C -v˜AÝ«‡—3½únÙðæ6>a<×™½­§…yó²ç2”éÈ}4‚¾j$­gS%»öŒÀ¬ªÏàxÕDu?^ëš’¬‚èUýµÍ»$ ×ßu¿ qû;ðPz˧O&8¨ÿ&Ϭ«¡1m?ÑüÿÎÞ¢€gÙNøýO9]ÚÅ®—Òn¨N G)ÚŽg Qh>Ñ—ƺ¥"UÏGÁ÷>×Aa´G,…Ô5ý”Î`Ow+wæU™ç-†¨û`ŸÑ >gìÖ¿á¶÷çn_5"´D„f-Û÷èŒÌ?}¾¼™^~¾:}¼¸žÿ-\cͶU%‹fVMUæ÷²¡e(É2èp|u÷çýæG·I•ld#+¢sR ÁœÐ²ÁÌx!ÄN¹|®Ï¸tO±„:dþáóÙà ~1Ä©Í?˜^ðWŒDΙ\%Û¼ùm°‹§Ò4MRu•>Ç Xx¡åxÑ›!8鼟 Å=Á‘g…~ôö…åÚþ/†`'°\ÿû¼PNŒß€nŽ€–0Éì-Ž¦Ü÷ ¦c}Le7°n%Sè$‚2lmŸ¶„߸ð@ 7òe 7aMÓÔ,€ìAï-3 -}.œ ëV¾`)#ëöSlÀ¬b#7#þc̺&¢MÍ (Zrï6–DpgÁ¿‰¾€:²‘<§ïy@h?,Z#á± K¨H5ÊZœY‚°×/?׺H}Ý@AAÜ*g\/†c©¯ edØàw*ÚÒõIú@.ÕÊÐJdq< AìE¶û¦èúµiHã(ǦŽ w, ØO÷‹ùÕO,4²î‚e5„ÙCˆeMÎ ´‡Ú_°¢X>]÷㎷ÆZ<«‡ùZ K輬–r–—Ø7ÿ¤däö<ËO£Ø -ìpü_[êoûÇ’‹ŠmUòÝRCDѾœ3ðYµ€ÿ#&°endstream +xÚ­YoÛFúÝ¿B@BÙá¹ûÔ›ÄE›d×6h,(‘’ˆðPI*®ÿ}¿kHJ¦ÜZ!h'¸Ð,uä|ƒA‘åÈ>àÊJ0"²PãÅNÝô/ó~óYp`Є8R™ÖÙÌmZ¹Ú;¹¬lvE}éFЃċüŸBÑ~¤Ž8‚ü«ˆw+pÕ®G§,¬R’•ö·72êÉ™Ð}$U!›,·M˜Ñ¼è° €ã‰£b™¬ÑúÚ°¹½åx‡Ò'ñÑ.ˆ6ëžÞ¾ÔÄ)ßùµéú§Ž®{dåªW:§UÖ#áô7÷L!οÖì:Qh½- ÚF<•œdvVìf¾ÎŠOü½ÊV ûfN³´GÉ÷ëBâz9IιÍDð¨¥^t"xKÆÊèÄÉr³yW¿èye‚4CAÒ µÖvMÝñZχž1óÉ èÑQqyÎN@0ä%Ãê¹²“k-P™êÑÆEQÑÃ$Ž JŒ>OEnÌ$1; +´Ž$!׆kƒÅÀÚÄ}áôqicÏ‹V ÐmÖ|_:HÖ˜ï—ä*zP„}ÚñÕƒ’¦½¼%ßÍ©»³‰È`ˆ"1`9tæ°Ê€«…h÷ÇÕç/Þ"ƒÈøó.Æ‹{®J’Eue Ý eV^Ý]ý{Œœö®Õä2 +'h™ vÁ±/"r¿þøéËŒø´¦pͼyØçíµÿu ì ¡€µ«!ãþjïzžPß$n›sBçè+§BvxË$“°‹ú+™¥Äš8­Nô,ôà‡&ÒcTœ¶•¤£|äÊüàûÓ#J?~ry‰Â9å±Æƒ»Ø”xQ–K>ŒtNóC-Eó0Œͧѩì%!8ZkÂçç’ÓÆUúëfÝd3L26¿Pê +ÀÞ´o¦êv˱ÌzšHZ¥ÄÂK›dazíë@XÜñ}aÛ¬‡Ü¤¢àq¨M¿.Ùî²;¶6zâiocªÔCÛPNm91¼Å Á/áx›%IÚû†©œ9ïâQ'^[…c&“ö(NUÁk¯»·+\¸HaA‰A¼;$n<ùP*(÷ ÿ†ÜjŽ}g}Ή8À’K +) +€y&J‘ÇB¡ª#Q=«Ÿ™¤ñ¨ëœ‰X¥6)êó¼ÍGÕ§µŠ)<¦%Ï‘¸t7ê9«n=‰œöÑd6lj‘™ÅX ÒŽ@2‚uŸCðÓ@ú¾æóVŠ—“0I*¥]Ï3£ïAìßlx@™F)›ÕÁ k?¾»ƒÅ[žØB´ê“–3ûò‚û½Äãm›Ë%þ‹rÊ ûJÚ_ÔR©sáçCAÊræ~NKùbÏk€ðíÄ¡aRªp}4õ?’ÖãY_ð•T}hA\ªH ¸è¾ÏÕƒ˜Ë©‰ êÈV¤Z*Ò»Wï“0r>ÖÅŸ—p£Ïâ0Â\®IÑ)šhô†Æó&J䱤5o¤òmÊŒ߼ Þ̼±@r“"‡F`äõÌSUj½ˆÇ˜nÎå-Ê¥`c—÷<(*. +š¶¥ €÷xê*ÍË[.îŸÏ!íÉÁcEEE %’Ô»:%`?l›¼ÈÙµ‘*µåœ6 ÄÎ5uŸ°†Y3€ý· ½o¨Ù„wH´Ã1 ±A¼÷”­˜‘:Ö?„!×›æÈéº5+„cmGdZr0s­™,•Å[ö Ý6o»³¨ûlofÞ×æcs‰¨¡´[HÉFNÊ™t—¤¿õñý‰¿²éZ8‰Ö˺;7mÁªÖÊÑ»_î\Ýö§—¦Üzú(Óµx,ÄqK‘ºâ +ó‰3 +†²íÜò” +a;Xè$„”TÚ¹¸Ñîâ?#´Ð« øœžÞ‰ooQV·cÁºCR=A(‚EŸ"tæ ,Ìß qv“dÐè 3CËÉ]ß´’"÷~¹lÍ ABï‘ã-ÆCqêþ6Ó +lÈz3Ú/‘èÖýmv3>OG‘ë©çûp˜Ë~W‡Ê½Ðú]#~÷ñw{© hO=ûüsÙåjxÓ¸ ƒïQþF'Ò“¼rìò.‡EIn‘©Lœ¶lF>9Ñ>ß5mBv”CÍßIbÉÙ[_ ØâÕ +ÀÄ3çò†¸Î§žgÒÏÇεmg™ðÔ‰âÂÄ‘‰@Gê£"ú¡rÖÜwæköùãpK|Ò²ðMä ™Çv> endobj -3352 0 obj << -/D [3350 0 R /XYZ 85.039 781.388 null] +6573 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [115.558 292.455 171.248 305.357] +/Subtype/Link/A<> >> endobj -3349 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F70 2201 0 R /F18 2207 0 R /F35 1632 0 R >> -/XObject << /Im1 2193 0 R >> +6570 0 obj << +/D [6568 0 R /XYZ 85.039 781.388 null] +>> endobj +2678 0 obj << +/D [6568 0 R /XYZ 85.039 761.463 null] +>> endobj +3062 0 obj << +/D [6568 0 R /XYZ 85.039 667.044 null] +>> endobj +2682 0 obj << +/D [6568 0 R /XYZ 85.039 611.854 null] +>> endobj +6571 0 obj << +/D [6568 0 R /XYZ 85.039 585.239 null] +>> endobj +2686 0 obj << +/D [6568 0 R /XYZ 85.039 390.539 null] +>> endobj +6572 0 obj << +/D [6568 0 R /XYZ 85.039 363.924 null] +>> endobj +2690 0 obj << +/D [6568 0 R /XYZ 85.039 277.012 null] +>> endobj +6574 0 obj << +/D [6568 0 R /XYZ 85.039 251.003 null] +>> endobj +6567 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3355 0 obj << -/Length 2179 +6577 0 obj << +/Length 1158 /Filter /FlateDecode >> stream -xÚÕY[oÛÆ~÷¯à[) d¹\^{ž[IÜ(vO¬£hŠ€’h‹0E*$eWÿþÌewIItZ´/ ˜Ë™Ýå\¾¹ìJXü + ]O¦VœW&‰µÜœyÖpÞ 5ó׋Bd½™Ÿýô6ò-ṩ—Zó{š2_ýn_¼?ÿu>ý4q¤”¶¹'ŽûíDØWGس)r|ûüúýi -¬ dÝÀà“¢În.>\]¿›ü1ÿål:HànIáëÙïxÖ -¤üåÌsešXÏ0ö\‘¦Öæ,¥R½—g·gÿ5»0/°xÕˆ¢ŽLè•ÀÀs“$0ËpDãËü>Û•ÝÏ'ôCÛãÇg/ô.‹6[”ùŠ)‹=?Õt˜ ŽÕsdàJÐÎSíÛZÊ0uÃ4Õl.MÂôÅmh‘ÛðHÍ>Ü%0X±ïÆ^j¬ì†C+\×à¾ý˜y-tcŸ²¾ZÂõ‚4•ÌŒIÎ~~ºÚ벉¬^(™º>|]À#öX"qÎ|=A‰œÀ“ö´ÊàÉÇZÀÐw#OŽ• -AÆ8W81@~|¼yè¡Zx¼)²ÂÁž£€»íÐÙÚ8`S~Ô¾yÕ*“¯ó>úŒïdf£m÷u§Gê&X0r½àkHÃP´|ß EøÊŒT è1eâÙUÍϺ[ku1Æ©­3-½¬³–çéi8æä¥ÖD,[3ÊÔÀoM`L>ôÐdÕÄOíN}‚ã>Žñ^1MðT`¨:¼ -µÛ ‡¤åiºxÙK2Ò=Üë…²ÿ* ½V(û±ÆMo6?J7ø øâT¾î˜¸7@T„ç¦èº\­Ä¼LO´0í?¢±üžÊÅ a6LˈHõIÏÀY‹Òt -¢0|ÓäÙãH?¡ËÃì/ò9U.Ódü ¼ßEêæ¶sCÁ\0‚YßfŒ=OyÂ]»&0< Ú-uV–{]¡Õ€™Ò$"Ý£´gT ¹ÜV÷èžf3J{ÃdA¬æøÎh.2"\ÂèŽÆÖY©‹ãÀÃünuj¥zâ‚L­~£ ^?šˆSßÓ³fy_Jæ€ãËÍiÃBt¾Ó|mvÍaw;lÂèÞ LáDÚÏ:q±À 5–ÿû*ëlž$¤e-Ý’ˆÈ¦^f‚ûÑ5õ¹@ä -ƒ#rþAVQ_Etu0ßAmTó“û­Ò5YÙ4Ð"£< -U*2*Õwž| /UzT±¯ÎÑ|t6Qôˆ‹¹ „&á–Ù®Í DGv@ÉÉõØA“Úvñ ¢ITbä -.#ÁÖxS뇇]¸Äêv%²Gïc"ŠRœF•±Pk8CÖô°‰Ž}»ÏÁ{^jì¯?[Q¯ƒñÚÃ<êÔñI=9 è[§«ª®òå²Õ‚‹¼F×ûÿ°) [<ìï„vY•÷Eß·WÊï…22«õ4 CFr±Êºü¥F”=Ò’i)AäÙÊÉÖðŸßW„£ì4ÎÃ4ˆà™¸žs „p“Áåœ?v9íCNpáS°†ž}7‘èN Õ™®‚LÅö-nA7P §U×è*x!¦Œ  œwú"ø‹Ÿ> ¼ÿ0ýíËìæâ|öåãùÅû«ë)Ro»O?âèb×4yÕ]Ô R]Þæ±YØdz¬ÚdÕ]Hü5k²MÞåM«±2{iBŸý_›ßl·uÓíøŠwV/é^Y„qhš¾ûrywƒ?Éлúe#Ÿbl‡?…ˆþ§®Ùåú£ìéD*£§®é·¹¢ºU,³Îœ‚Dl?¯s@}£“`ÎÔ&_t©JPëjÅ'¼#°ë]©:1¸©T‹©RA†±†0ÁB9™6uús§ b.ë' NUabpOÔð)Ãyù*5ã{*1s±´¦6Š/c9?s»H)2€‚SôÉo›éÛ_˜Öt{ëƒ>ÿàzveú»ÁÍ°ŠüºÒaÜ™P—™®Ûh»¦^˜6uCÛœ†² *°£¿,*Cü»ßõdìŠÄõ›µZ$é± ÃÆA øÒÉendstream -endobj -3354 0 obj << +xÚµWßoÛ6~÷_!$y€ˆ!ER” ì¡YÒÕE’v‰Z´EAK²­E¶\In–ÿ~ÇR$[*¬C…äßÝ}wdˆƒá‡8G˜ND£È‰7ì¬@òÇ„X ߪøËùäâMÈ‚ÑOùòÅGŒSgž|vûúÃüúÞó)¥.Èó…ˆÜqßß{uçêóúrv3›ò¾ÎßM®çí¡­98`ªNü>ùü;  {7ÁˆN#ç Æo&p$âŒÚy>y˜üÙš22æ˜]Cr!Ñc)ïxHx„uLjc¦=Ü?ÒïžO¸àî)9OˆrlúD9mtrÏÆ.û‚9®vð%çrH·.åÎêžN»r®Å‹8®¬˜œ lÿk£v‡wã´,‹R«øŒ£ˆD=EröJËDq^6pçrDéÅ> ÿu|²òÿ•Pü—ñÉ$M.k °†¸¥¡N\ê™TëÙvu@,¹€s#·ðàóC}ô:Ó„ƒ yZ™ù³’ûv·%¨¬*e<ÝxpzƒÑ¯× ŒYP<׺ Æ1CÚsæÌó9„UVæoÞP]T‚ß=ÈT¡F+kƒ´Z +lžw%L +¥D­ÇÚá^{á:vŒ0 íži1T¤‘ˆXE¹MŒ$èØZØ:…(b} +¾¤E'0ìæ5t·iš˜Q]¨¿Â• è7kë´j}nm¢‡ÖªßÌ.•Ò¬Üš}y¶MÍ(Û¶–ŒòhÝÍ”þG#©4¶¸Î +«Z,{[B÷A¶\“¦Ò¬Ë]7oå£æ²n›Çpµ2ÆÜOêBÕ¶r£\¶ˆi‹˜ºO cóüú¹áDñh¦U±ÑÁѱhë,ÏÛ¢2 ~¨õâë!‚·†Æ¿õÙ\ôëÀNý|;þ&*ÃçoŸåÄ nÙÖïQoh›Ä©Ñ¹QŽî»Ó$]êè*äwï¿]Ï®þø¥.ÃM¿»¨ñÕÝì£-ÜT×fCž@‘g ƒxÚ +ʶq¾OÒ +­GWDDH0ñÓ7_GG¿ˆ2Dáu …Š%!†¶ožDðÎc@G «{Ÿ&omöiõ£é³ÿÛÌî•Ÿ›…G±[B?¨}à*Œgc`í?û¢£Áö߀¥!ba Á^>ÙÚ@º”š2µ™+äµÀ€³w VÕ74\àÍÌ€µ}©9³2+z¬›J-UæÒ&LÊ$1B*è…fŠìÕå³™ÖÅ@‚)#HM‚/Ò:¾XÕØ jt»ÍCÚ+o©—çšþOÕɉ€–ô¨J`†ˆay^»…ŒÍìDaÙÊMz‚N’b#³­žŒ$¬Ó¡t¯AüŸ^ý-)Es‚\9 C_~ˆ·ùïàð?gý$ endstream +endobj +6576 0 obj << /Type /Page -/Contents 3355 0 R -/Resources 3353 0 R +/Contents 6577 0 R +/Resources 6575 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3348 0 R +/Parent 6566 0 R >> endobj -3356 0 obj << -/D [3354 0 R /XYZ 85.039 781.388 null] +6578 0 obj << +/D [6576 0 R /XYZ 85.039 781.388 null] >> endobj -1206 0 obj << -/D [3354 0 R /XYZ 85.039 237.715 null] +2694 0 obj << +/D [6576 0 R /XYZ 85.039 178.747 null] >> endobj -3357 0 obj << -/D [3354 0 R /XYZ 85.039 218.843 null] +6579 0 obj << +/D [6576 0 R /XYZ 85.039 150.011 null] >> endobj -3353 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F70 2201 0 R /F18 2207 0 R /F15 1628 0 R /F41 2104 0 R /F20 1617 0 R >> -/XObject << /Im1 2193 0 R >> +6575 0 obj << +/Font << /F64 3112 0 R /F35 2880 0 R /F15 2876 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3360 0 obj << -/Length 2111 +6582 0 obj << +/Length 2076 /Filter /FlateDecode >> stream -xÚ­X[sÓ:~ϯȣ3ÓɷؼA ‡B943  £ÆJã‰/ÁJÿýÙ‹ä8MR˜9L,­VÒÞ´ûmäXÀOŽãÐ~2žÅÒõãx¼,Fb|+¯GÒpˆqàŠ(Ä¥—‹Ñ³W‘7–ÂMD2^¬ˆe‘~qÎß¼ø°˜œL}ßw¼ÈLg³Øy5‘Îåd*«9®x΋÷8œsX:Ç¥k|4Ô«ëó·—ï_O¾-þÍ ¦D>Šðcô囧 å?#áúI<¾‡±pe’Œ‹QúnøfžnFÿö§ðZ0æ]GZŽ©LÜÄ ñx3×›ùÀ“Þ&¬I „C›€|´óÀa(œ]ÿÔ5hÍpŒÊÿÌ`}©™6/Û:ÓÍcí§æNqLž ·NýÀ• ¹•Çøè«ôƒ7o矿ƒ™_\}÷âüÍåû9Ro>ß,æïptÞÕµ.Ûó -d©òÝÒ2ž-uƒã+UªdUpþAժЭ®Intˆ+ÀÀxã¼T·¹¾ÞæÕrÓ€¾á,Ï¿þ~ñé]NsÆñB§ªù+í1}‘Ð1z¥º¼}n9èóU„¢­; _Úóì•*=ØQ~âŠ0 cn¶ÎÑK´|öUÈŒ¯q²ùqèܯ-¡íGè¯8‚fžÆPÁw/ÞãQyäjwÜ›—y¦Käk ¡­øÛMèVºçÕ9,ïOØLz±ª’¿Fâ\ÓF ª$v®÷7ÆÎÆìRµ9Z‘E§Æ4C»6Ù]ií@FQ kâ´“iàKÇX˪»ªjp¼åÔÌ£Ëõ€V3ë Ä3à Cçu5g¢Yªg‡DkìÝ¥U»R¦rÃZáWi‡FÄU2?Ú!Ù³whz$ÀRÕ’`”„ÈÜÅšª°‚Y©[”æϪê½ùŒWÑ ªn³e—+4VþÀôû,ÕS¢¶÷«cçÁâ¦q9Œ÷Þ®œ¹2ööÂø]V^eåf±®«în½íÚ§š ¿Y¹ÊÊ ‹³Û‡Ã‡[mž^£—U™þöý‰¿ðÚ«9L|ë–†‹ -@wî%.0&l@m;¯“:ŽºÛ¶P0N5SÏ%O‰èI7„Њ(5˜FBjÅÔÓñÄ@¿xý„¥(É)3a¤Á€­ŒzR8à'Õ¶œŸÞ¾«ËË®asÁ {„Éиc«ÌC¯y±§0*-«ºÆ…ÞTûånKP:›cB†a`Œ ’ï÷@iŠm[1o`2ôK&3Pöe ¡D <ʈ¥*´¹õM3Só#N×½Y† øí¯µé'X:Ò÷9ét$|š@C}œ¹ç-¤,m)3Ä°e —k=,6 Wd«‚'©ÞÁ®¼²ž0œd7J¥¸ ÇÆ Žó±¸ f#'ao”†Sl/ š5ñœ¦3 ¢šÓh ³Å º¢ò.×<^Q±HeŸÄŒ41õ´¶9ðÖȦÂèH»BáøÁV| -·¤GÆØU\ ß];‘¯è[¾Œ/‚a,ÆøaÜxj.€­„‡’ÁCö’È`hÍ“GMbcæØÖ¶Œ!«½&ƒ M @ê ¨9ti•ï”7«K(ÖmïIA8O-‰éž'%8LW÷Y‹ÁHPxªG00K5n%pHþ'^Õðb¿‡Ž7š>[È=ÊÅIoª–ç}bă±–ÍJ×5¥ç;{Ád' +#L5å #á+rˆL¬âSß3`ɳXÌô†ò dÕ毓ÀOœŽÉš¥ð¤I¿žÅqÆQ¾â¦ìŽ’)…n׌¶RÓªyrž!­z…I4S¶m—õ¼!~­LCzDñeq óM©#Äß´þÖÈHЋTŸ³ï ¤yI—5Ú=‰d‚ -Ëã -yþß_²>6½nO‚ -™ˆÇ‚ÊÈõ£`ÿÑÿºö•/endstream -endobj -3359 0 obj << +xÚ¥XY“ÛD~÷¯ð£\‰9tò¶9€„!k +¨Ù–mUdi#ÉkößÓÇÌH>´TAmÕjŽžž>¾>Ær.àOÎÓ(:›'© tšÎׇ™˜ï`çû™4¾!ñG4/—³o¾‹Ã¹A&²ùr;ð‰‚0Òóåæ“÷ꇻË7¾ÖÚÓI°ð“$õ>,¤÷ËÇEª½%þ»{ùöýÛ埋ÏËw³7Kw©cdxã×Ù§Ïb¾éÞÍD ³t~‚±$lfpe…ÚÌ«ÙýìWÇŠ÷Â9Ÿº¥`¤Ó Jõµ†2i(•”’ó$A$BRq¹/;Ð/‹¼õ—^~å:´{÷ùa¡Ro•3Ußð·‚/,7<]Á±|½P‰÷…šOYê~_0· +èìÉ«3%Ÿ)Ú-ï `óX °4Lö°lø´ ‰ÒV½9mî‘,ïÑsß(ïK´`FoÒ]eÕñŒ†/]ÞˆòX—@Ãæé‹ñ~ ëmAã5{âÍS 20;+r’y'äÕ´H·áݼ¦A‚æi‹-°£ÙnBê§3/$lZŸtgÚYqÐ0x\H¯f¤·kú2ïDBy§={‰ÈzðeOÁà“…Á8ÞªmP¤ƒƒiªÒ¢¥çbXmì…æ(ë ƒÓþ궅cÆjwýøäª% "§Î¬K/ µÇž8Z›´ïËG”“p"¼;¶ÊÙÔß.ü(J¼×EU°jLã„€1m0 Ñ·O¼š£ÁÒltFZÇnxg [ãÞæð¾:‹h(ksy×çm_¢»v“è•* ü‘œH9q’iü|&ÑPžP°:Œ)OHh©æq,ƒL³q!ûE‹ †w‡vx ü1%€9wCAJ¥B?/]$©Õ™tÀý<’D’i8’L‚"F»/¾‹ºGAÑõ9ÆN{‹½'¬Ã§*èìó¼ŽäF¦µ2Ê8ˆØq¯Ë._±»wœ°îm˜|=Ú ðQ’¼@aä…ÑÝÞ CïØYµQ(2ïqÑAÒk ­Èó-\áŒ0)’b ‘ÉÁÌ‘b=ŠØØ\¹fŽ)Ñq|Ö67’OWîêò/!C—/Y!ÈDP(ƒ [Gi„ÏÃu ™Fk§A 6xˆ Zï›*_h²[­›ÃœÿϨ…Ü€ˆžG-Ôø “c)Ô¾7éŒ÷ÅÀŠRPÛæ±8°'u%àí_Äh¦A« wA÷Í!¦LóP˜}©Ú"j\ÚÂ#‡pRóRñ÷ðˆx* â T, éJû«ª8t|‰©¨aâ}w©¹N eIü¯ô@Éí>Ë·¼ü³ké6ÓèÜFo@âåûÃo¶k. K|µ.¨/-¶ò5p_A¾ Ó8”jgDC“¬M‹M=lÆÛ²CÅЕR ‡$>–Ô%ŠË¬šø¬ ‘©W\¨r@LÁ^PsF®ËîÀô'\Ë;žÔMσnWÞ +#ÂÂÂÍe"™øZ…¦’m‹¤´·)vm¾1Û½‰Ú +cFeCãÊÍÌœÍÛ‚™=´ Apmû[HDÐM]¿+ls“rhi•>«óæ|³å­¾}Uñsõ¹}“çf祜?è6d”zo{^$«7Ôînx¥omÃéN<±¥–Þ ì7†&‹Át¦Ÿ¤mlŠúË]^Ö7LgÍ7€£²f4­;’÷}áŠËXæ¼{‰mŽ¾ªŒüP% ”®A—á:µ£8ص .'äß;B DÜ6š¯í£ m9~ðÉd÷ŒæÈŠàø±ìÊUe&‚c¹e`ôÔ(—dxº¿==—Ü‚esÃÉN²sBáí‰ýµ;V¼Dx¯)Ȥãq€%0€–8wÆ"ŽˆÐ Ü·ÃàÕ‡ß^ðˆ/äñ‰Ì„OfÍ$l ¸×ºçK€§uÆg®ÕL@äAk‚ÐG‡m˜¢7¶Lv•Á•ˆ=C•þ¯üÍœü«ëì­<•“ᾋìÍ2^·}s` Õ‘:NR&GòìXül*6¼ò÷d†=¢J¥1¥?Úqi›¯À=Äà:WJß_NHŒ:ÊíHû@\“ ‰„ãÆ0GÎ ~g!uÂËûÜ̘ºqqÅEÝ$ˆ©wǹjh£'Ÿ~êEÆ•H‡ÒâéÖæ¤G÷†¤`ÓZ± Âz/)"™JÀ*/;Âô’,TêËŒ§.ÆG²‹#R)­}ÞÀùݶ½hC=J"e ﶪâ Ê#$$;Cë™´4sx»6”B®1Ú ­‰]Ãß–¶ÖMmŠøîØ‚XˆÊÞm€Í¤W;Ûð_{ÐP,9o}1f¢òf{ÇbÜû“S¶âwEɪ^˜¼-¸lƯÜ]¬†›ûçºØÍt³­5´ºê¬×V¦×þêê¬Íƒ°_ˆj±°Ù&lÀ³1›’“Ù?+¦#™îµ5.)Ž˜Ÿ; +èw f,œÎ¬p,ä댗¿©¸Œj‡p- ‡_ö\RçÁɵßô»Xé¢%óêÎð9°¿7T½°9 ce;:“Cö9{ßd"ܱ¢ÀþmÊÊ­ši~ðÒÜÒk æ{B¤„N:öEÄS×g—‘âNU›Þ ¨~ÊÛ16•ú<pKë.V¦é0’µMUùhÉ#•ý3Š¡e*†Zq ."PÙí祱Ãÿú•Øa"#ÕÙmÌEJJZY80âKyí¯ÉWÿÆJyendstream +endobj +6581 0 obj << /Type /Page -/Contents 3360 0 R -/Resources 3358 0 R +/Contents 6582 0 R +/Resources 6580 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3348 0 R +/Parent 6566 0 R >> endobj -3361 0 obj << -/D [3359 0 R /XYZ 85.039 781.388 null] +6583 0 obj << +/D [6581 0 R /XYZ 85.039 781.388 null] >> endobj -1210 0 obj << -/D [3359 0 R /XYZ 85.039 761.463 null] +2698 0 obj << +/D [6581 0 R /XYZ 85.039 679.868 null] >> endobj -3362 0 obj << -/D [3359 0 R /XYZ 85.039 743.459 null] +6584 0 obj << +/D [6581 0 R /XYZ 85.039 651.132 null] >> endobj -1214 0 obj << -/D [3359 0 R /XYZ 85.039 261.834 null] +2702 0 obj << +/D [6581 0 R /XYZ 85.039 651.132 null] >> endobj -3363 0 obj << -/D [3359 0 R /XYZ 85.039 232.43 null] +6585 0 obj << +/D [6581 0 R /XYZ 85.039 627.814 null] >> endobj -3358 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F35 1632 0 R /F15 1628 0 R >> +2706 0 obj << +/D [6581 0 R /XYZ 85.039 584.48 null] +>> endobj +6586 0 obj << +/D [6581 0 R /XYZ 85.039 557.865 null] +>> endobj +2710 0 obj << +/D [6581 0 R /XYZ 85.039 557.865 null] +>> endobj +6587 0 obj << +/D [6581 0 R /XYZ 85.039 534.548 null] +>> endobj +2714 0 obj << +/D [6581 0 R /XYZ 85.039 343.346 null] +>> endobj +5887 0 obj << +/D [6581 0 R /XYZ 85.039 324.475 null] +>> endobj +6580 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3366 0 obj << -/Length 1602 +6590 0 obj << +/Length 3165 /Filter /FlateDecode >> stream -xÚ­XYoÛF~ׯü´¢w¹<6F[¸>RDzÛ‚" -Z¤d©’TÿûÎì,iJ¢$…kÙ9¿9$ÑwàOôC;®î¡ànö§ËžÓŸÃ͇ž°N_qÇ÷ðêÏIotâ˾p¸vt23$“ø ;üëàÓäøz0t]—IŸ†A²“`§ƒ¡`ãc¼‘ìàâŠ]ÃÕ!^]ÂâÚžŽ/ÏN/> ¾M>öŽ'- †Š+ßEþí}ùæôcÐòcÏá®û°v¸Ðº¿ì)Ïåžrí~Ñ»é]5\èNõéU‡¡Ãšb(4×Ò뢑— àO7>‘p§¸«ü¶OÀ 8ÂSš ¥qœ‚­UšgÑìõ}vDqšÍ·íÖR$ôKZHÁ=G­…ð:"ó÷ tY¾J±%ê dÈñÀc¸Ž2ü_ÑI:æ´œdÀîóqOG3¼-h Ï Óõj³8ª’˜n¾#¿¤(ÁT"Ég–ù¼OKÜøìÁlª„®V±IPÅÂ>ËèÔ·gûŒö$·´)ñ9x!"0xÚØ<+PÍ%:ìJ—(Â×iÍ¡`&>;' Sü€´¢F,¬[ÊÂnKYÁJ: -K°å`•¤b ›åøˆ¢Z‘£àÝÕ¸m›æ%oÛçóN¡¢(@²Uwy™Púti%Ø»š,á8*+ZaÆiEW°$Úx€zYb.øÐ -ÄK`TW»ü«|E‡Æ“[—–™f!ÛŽßM2­È%Ïð8O§E^æ3+ûü®Ž.h3NoÑö¨x´ïk>+’›Æ5KË*ÒÕP!CfáÈæï;`u¹‚»•!5ñ«Ö™…3¦5,‘]è³qÃ.d÷%ú_‡*‡;J(I91L -:¿H*<7~6Bîéü«ã9ÖLXŠwtú9E âÜ<)Iz‹óÐ1ìð0¡ßæ=NÜ°U< táŠ*ÈïD°Q]„à -ÐHÛZ@mbFÆ- î$´ønge‡D!$,÷Š±$v¯œ¿Cï=‰_rœõaš¸1¨.â÷¯i89±p-*ˆÜn°ðô.n4ñu„…žÀà°s'‹¹i¦H= ²˜ú©óº‡M¹Ú ¶±Ùá‚…y‡Ä#fq¨jÄá…µðɈ–ž_ίneÔ«Ï/î凨# â¾ÌX©MYæË]z‚(tã(þNîZèÓ”íÞ‰”ýÑy?UJ9?ÜC"Ü >ÍT óSAñ|_MBÐD˜Ë‚Í_Á.ÃŒ¹íxTÐ7tÌ£)*»xl+ÀG)§FðÒòrþ€f­œ{2œ%ËH6¯ïøkФ—w‹ð€Ë^™¢%ÅÛX1¶d  OLè6¸l¦é½H_ƒ`Á™Ê XÑH;õ~}ç¥):BúHÐa²#†A\QÕð +#w²ö4„^‹Ö•ë¹0Egk¬Ö=Á‚øׯ*nØ5.MÇÔ!–¹wï˜2ƒ/ÿ9E–¥Y” Ä áH_þ<4–O²/‚#ûA§œ²6qâ˜ëÃp &[M»Aàú Q¿àI[tþ«zÝÓ€ÐØå"òr¿H-(†ÀÅ…ÃJ‘÷ám‡~±úÔg†XäL ,ùÎcC3Ó!W^,·Ä>™*Ë—?ð*‡Z‘Û\< àòÍãLâÓ7A…Ö‹*+7KËXÑŠõp¬†!ka áß}ü ^jg†ŸU„ íë°Ö±”àOÍ hM.»Åj]æ+¡‹Ôœ¨+¹˜Ø ß÷kädI€w@ ²å™7ÐÜpÐÒ¾è3@Ðâ3Eãe{Ô¾è _9?]ÏÁ‘ï¬ gä#8T!¯}Ëk_ÂF>~ +ÏÕD5ŒÀðWÑdï¢]Ù¨7ÓÚCfµV£áÒ×Ô¤(ŠMÖµ¼®¼0}%VnøÊ®> U͆c~¤¤–ȵ õ„;/Š¬—lX†Ö g pNÛR†ò•Ïw5obêÁ·Ôíom†›,K!r:/E'UÍ_³D’;ûöil7k6ƺA‡ž$ R ÝE“/yÝ~­ûIºÊÂ>ù5ÜÜÒT\è5'§4÷ »¨h§uäú:™èÔsƒ4|#äZèÙ|?îíÞ‰ü¸Î;Ó™òyïý$v!SÜz~·:`7ÞܾŸÄ@™r¢¿›7IÖ§!7JàÔYœ@ÏFàÇ3I „\¾¿ÙO !Iãí§wS6yãÁ›ðA²\íÜ?‘ìqR"¶• D v°ý· öyJUg‡Ô§¸½±FÐ.b# î®Ñ%àî(‹Éå =b³>­²=û–É$«˜ÅŒ®Ðe‚—$i“N±og¿å'ž­\xB§½)ò¸³fùL¡û±÷~Êe àº02ï“%8ö©÷-›o|5†Yò©8©‡‡^A—<ã]QNÛL“׶ËÉ϶ºø‘Vò„cJ©S7¶Eðw(åN:TJ¢˜Þuë/.^^^ÜÜt­ ‘à¢,ªÍ·ß ªüöRTîS·*÷²b?uS4°1v;zëk ƒÞªÄM  ?U”éÀs“DŸ.µ +!ÍmÕèKÕø…*tŸKôK©©„ãA%%9ÄUÍ ”Ùad¼RQ‘¬¤¬°’†'bÛE¡ÔïXQ€KŠâÓ}œÌqg„‘ë%¾T3¿Oa|Hu²zÅdaÞÕÉ¢©Ú—q±‰GÐíЗò¥–ÿ*ŠãA’ÁÁ‚i¥‚icÝìø®yĉ›ª¸GøÊU g#ð•ëÎd¼Ù;¤l83M]º/ä%sƒÄŒë·B!^ü—SÒ|CÎü¢58xAœ2 ÞæòÍû†©ÔõÒt›²™Z˜ÓôìÞÄ‹<¾NC7‰“­ ê»Ó[¯ÓD;RM ù%Lª¡Ö PÀœ·S‡l5D”¦2£öÇcÎ7ðC7=œ‡øÊMTr¤ƒ©íª0œ?±S7„Àf¤À_Q nK#›ð‰7 eù£ËnÇcÔùüÒ÷YÎ`»ˆßœSä9F/|õá4äûèΟ W€ˆÞË›‹ùÍï>Ye“íE%ÄA"=e9&˜ ÀúI‚übOúÿ4:œ ´%À3Hq?Ì¿HW¬æÎÁNÛK¨WΟÁ2¢‘¥1à>|üiÞS +øEniú†w±æU uÉ-ÌeRn&àãI_Çt²¹Uèz7G™Ù[‰ CÑÃÝØ­k“<[¯­‡ä‚ * ”Ü#ﶘ÷°§¡sä_ákätÙ¦zæÙøXL½ðTúÛ½š¢­#LÐ0èËm¹GWa(RÂ29°&0‡)1ûž3àMµÈ nyÀE¦ì{:f)-Ž0"'Œ ‚û‘vZ:¼ÚŽê~¹ÈžØµVŠse¥ìå²H ûÎÈPz¹6ÏVz\ƒbÎA|HãåÂ'œÝæ)²¡{‚ëóñóÔÇÐʃjnÿaÿÙÚêæ@ÎïüKDg{;Öe[óÁ:åUôU([í´’qc³>ã(*—˼ÙoÙ¾$—éV/Ó°WsŸ b³©ÛlÃ0[ö +ó]{M5«&lá+u7€qj‘Yí*¤ƒ¶”SÇ­XþjǤÚ®ÛÁQã÷Íȶƒ4áòƒr¶–%¿­ ó™M`ŠÊ¾›b¡‡J’ÙvïJt›~`êšEÚ#It¦‘G?#gînÝðùå㼘Y +©Àhµ4¾üsÊ­*x7+ ©-bûºsvɹ1ŠÓcí;ŸÞßÜŠL`Æ/ŒïÓ>? ß³!2j©5eÇ°~hßá–h¬}Áó?ãÆW^ ýK¤óbŽÃ›áÝBî?¿¡ÆXWÏàŸÕ%‰éœyb[ ç6ÅL¼ä.NÂ~qpÈ;’ÊHC— Oí,øž_nšf”夤X‘ü¸¾@D­DÏ´ûÞ0#1#“^OXhq Lf¹À¡=Qó(¦]Ùƶt!†ÀqfÄCºSTY“›¾ñˆ+â2ê™ÃÈã{‰vêìsßâÖŒƒ.Aô|æMU¢Ö?pâ¨óÀ ¡#¯„ŽÔÐ:à-iŠ;ÀÀ-U>nâ«xÆú\£.à+A)„ˆ’›ªÚ=]k qQåä·ÓQSdÔøNúaØv"±Ë‰«Ø¡$XÑÚ#~¤2+ìj$-ï– ·MZ AmhŽ½xXºBÃ4¸H¢QÖ½ÃàìÚ¬úÞ,Ì?½«?CÕR1ý&…÷ïÿxý . QãÏýüúvÝ?@)¡ês3ì„ö¨ØcÖIŸK'U³½ãÀ 7`ð¯ðÜ¥´eófEvR—õã+ÿDA[ÛÔ¢c÷ô£@³æVðÖ²²ŽïéeŒ“•áŸ€ö钇Ĥí[8”fÕ|ü;“¢*‚·éè%ÙvÎÛü«ìCíð™G7ÓþWžæœ—X’³hlj3²I¸£–'ú8k$b1ÎÊ|àq)ªÖò–°Dr/ØÐîzoó±1Ëx¨ñ1ò­u5«‘ÿ›ÈÅ©v:ôK*£sì?<žë§ã +áxÃB¨Ü½À|{õƒâx÷AH㡘Ž¿ø?èFàendstream +endobj +6589 0 obj << /Type /Page -/Contents 3366 0 R -/Resources 3364 0 R +/Contents 6590 0 R +/Resources 6588 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3348 0 R -/Annots [ 3369 0 R 3370 0 R 3371 0 R 3372 0 R 3373 0 R 3374 0 R 3375 0 R ] +/Parent 6566 0 R +/Annots [ 6593 0 R 6594 0 R 6595 0 R 6596 0 R 6597 0 R 6600 0 R ] >> endobj -3369 0 obj << +6593 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [147.71 627.887 511.015 639.879] -/Subtype/Link/A<> +/Rect [135.619 595.065 177.399 607.966] +/Subtype/Link/A<> >> endobj -3370 0 obj << +6594 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [365.256 600.485 512.306 613.387] -/Subtype/Link/A<> +/Rect [364.771 595.065 397.369 607.966] +/Subtype/Link/A<> >> endobj -3371 0 obj << +6595 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 587.542 167.915 599.111] -/Subtype/Link/A<> +/Rect [445.251 487.277 488.456 498.967] +/Subtype/Link/A<> >> endobj -3372 0 obj << +6596 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [367.133 560.141 512.306 572.133] -/Subtype/Link/A<> +/Rect [111.316 473.728 136.793 485.418] +/Subtype/Link/A<> >> endobj -3373 0 obj << +6597 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 546.592 331.441 558.584] -/Subtype/Link/A<> +/Rect [111.316 446.327 330.942 458.319] +/Subtype/Link/A<> >> endobj -3374 0 obj << +6600 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [424.405 519.493 512.306 531.486] -/Subtype/Link/A<> +/Rect [377.921 352.358 620.096 365.26] +/Subtype/Link/A<> >> endobj -3375 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 505.944 388.713 517.937] -/Subtype/Link/A<> +6591 0 obj << +/D [6589 0 R /XYZ 85.039 781.388 null] >> endobj -3367 0 obj << -/D [3365 0 R /XYZ 85.039 781.388 null] +2718 0 obj << +/D [6589 0 R /XYZ 85.039 761.463 null] >> endobj -1218 0 obj << -/D [3365 0 R /XYZ 85.039 761.463 null] +3063 0 obj << +/D [6589 0 R /XYZ 85.039 671.062 null] >> endobj -3368 0 obj << -/D [3365 0 R /XYZ 85.039 736.911 null] +2722 0 obj << +/D [6589 0 R /XYZ 85.039 638.952 null] >> endobj -3364 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F38 2158 0 R /F35 1632 0 R >> +6592 0 obj << +/D [6589 0 R /XYZ 85.039 612.337 null] +>> endobj +2726 0 obj << +/D [6589 0 R /XYZ 85.039 430.884 null] +>> endobj +6598 0 obj << +/D [6589 0 R /XYZ 85.039 404.572 null] +>> endobj +2730 0 obj << +/D [6589 0 R /XYZ 85.039 404.572 null] +>> endobj +6599 0 obj << +/D [6589 0 R /XYZ 85.039 369.631 null] +>> endobj +6588 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3378 0 obj << -/Length 220 +6603 0 obj << +/Length 3455 /Filter /FlateDecode >> stream -xÚmP¹NÄ0íó.íÂÃv2Ó"‚ŠÂ¢Aœ iYþŸI–åˆ"cÍ;ôÞP@´Š…A D5Ü¿u6ŽœuôÍ(U –âÿ0ÐÌ¢`eÕTaèÌZx¢·îè”1ø¦ï%´§™Ú®ãeŠ·I0nw)K?ÄóDñ*eŠnÚÅ^V`Ða’åÊ`ì9 ”dvhÉ(nÇÏ»×Ç—>OÒÑ­0Ž»—÷ÍdÒ´ß -?ñªÏÕèþÂPùºd1)TÛßiîG5‚¡ýíGÆË,¬..|˜_>iWsendstream -endobj -3377 0 obj << +xÚ­ZëoÛ8ÿž¿"ßNjZ$õ\ 8¤iöš^šôos‡Ýý Ør¢«,y%¹n¾Üß~ó õ°ew;¨ùg†Ã™ßP‘ç.ü“ç‘/\Ÿ‡‘:ŠÎë3÷üfþv& ÅÔL{4ïæg³Ÿï\º"vãóùªãã Ï×çóå¯Î凋Ïó«ûÉTkíèHL¦a9é\|zwÞsqûžçïæ®`枇/¯~àñË›ë«ÛùÃä÷ùdz«y+T»£Dœýú»{¾é?ž¹BÇÑùÚ®0½>‘„ïiÓÏÏÎþѲâ9ïœWÀRLe,båŸ6R …èÖH +f¥ˆ}$¥ZªóÐw…ïzd%0Œ 9ü7õ}×ùPN´ëì@û@;‹¤àƵéa CÒùÍ•Þó¶Jyü‡fŠ{-ÿ«p|ãš~s}¸“²á±Ë²(ÒESòaø€ó–¡$ßØŽÆÓµ§R‹Ø‹HÒl§ƒTùÎUô!Y?%=v:¾œ6mGC¦•~ÏÿZÓJ_Ä"™þ5‰´Sn'S¥$˜Bs*¥œ-èSã@Êýæ…ÚYÁD•šÎ§lbÖUhwZP"EÃó7·¼üÓY'ÏiÅ}%Ô‚I.ó,-&*â%Šø—†êŽÌŽVåzß6žçÂ^«'ªgCqß÷RC=í‘ÚiŸ'ÚiÕÀþ›Ÿf3Òm#ÖÙ¢*ërÕˆE¹ž½Cµ[ƒáõ}­g—ØΡ¥Øc§!‚XåÓÅ-zÌ݃šíëÊ€|f ÓÞ[šÓšìsBMyæ4p=è€oÌ<À¡î‰"µ+B¸ª¡«„'d^K=푸áOÜú…οـEÀÆ‹¤*s±Ë +kQ´ÔöÛÄœDhÒÙr2jºÅ…»Yž íÚø/,`†ë|_!í…BÉp¨Ðžm-Íi5´‘N´X‘Ûz³.1ê(/t²‚Ýy4F%œåß”†™‰ +1’a¿)y>+¦|FJ‡Â‡€KgäÅ´GÝ$yŽÑÂM—Ððcg[SŒÇD–YÍÓt+s¼ŸÖÿÀ"A•ç\†ÿon›ú%Ís +a¯Y"»†ièþcÃjNžéç7ÐAx:#¢ …¡èÛ Ÿoæïðš¨/”ü€kV°.í6Z#2ñ×eQª””jJ 6¯ÆH¾Q¬F‚D™‘ì‘r¾¤ý(ZCç x‡No Þ$ȵÉø p„\iiÚKÓÀ@ðbx’u‹”|ô'ÖW}Dh¼àñn’hÊ}[§Ív#Òïi/GXÉaºH›ÝW8fQ¿ÖG)¾-—v~ÏÆà5`eÏlÊ™‡Õ¥#ewDï ˜õßr‡t1î¥Bi>L,Æ8’Žt‘×å4£ç,K4×_^4H¡j‚v*ùvisÉÛÝ"¶Q®ë2Í#û†¦œ^ˆª§É"!¿'† û‚±Bß\x05¦4Êœ©Y±ï70´Âœ`Ys=ÏÕ(´0“SÀ[3:Éc×65£ÍZeÁ:·sCϯú®’bÕà䶺jÙ$fbCFc”˜VÆ™ç/ia®ÖÒ,,ù×$¤Cô£b¨:´{õú J%@Lj€´ +C—iØ…(k4¬ý@HXØ·Jjã-›‡gOÊ‚]=©Ç24s°áÎ[þaT[$ë6nD¾Ußcß:¯…Ø6H˜Úõ†ïÁ"ÃQô}2®â©¨s3Q¨½ (øÚ +„‘âö±däÝ«C JN G&nmioË„/ãÞÅ`ä}‡B>­IÍ¿äNy^~èpðÀƒ}Sp‰?z=¼Î ØyËdíYî¯9P­…”ßtÑÓwhn\—ŠgñÓˆ?|æù›¤n]ëcj/Lø7üû–9ß\ Í®î?bXŸ‹ÞrÚ¾ú˜vëwkŸ_(ºØÀð’ –VUÜeímNõÉ&ïìÐ(·ÙŸ6X^¶ÂUóBIT[¿#²]ƒŸyawÉ¡ƒµkþÊ­Ú¼›µp<[QQFk(Ûa£õ(ìŒ]GŽ/»àkg1þØ.ÓoÙ‚ÚÑÈrëÒ8kn]U/’/kçìFáàwÙÖè¸MÎ0 çí­Aš‘KûÌæè$‹f‹á›,D‹øÊ–¥Q§¢Fžð ¤ÙßÛS)åÅÎcV,¹â±È˪¯L)Còúç¹B×Éë#R+€®‘öƤvé¦G®>©’ŠBhÈÓ¢ +}u%¢ÆQšñ—ÚX4ÈðÖ¦*œ_~Ƹwý™5è¶øÚ«á +BïS¶˜KdU®šcº†JD‘wZŽæxͦ|à;Ï/zNÙ]rƒÚkã>sìô”A°Êz·ñë>¶ýdßÅM¾1X¥ 4Ðé? áæteL¤:AÆ¥IóøtwŸ|]Bs ‰Ò¤²ázp $|H>f’åKb$ÕâM=DZO¸å³y‰>¼‚½o Fu|"l]ó›R•æ©Kžµ_Y¨$i¿Ÿé×&„cÕBb6t’¥ýS¶d2óädµÃ¶VÓw™‘áË÷÷ö©j'X}Ʋ"Òó=ökQ°ßS†ÚÏFž¯»rgVtXøLSeÁ£Fp" 7*n×Yc–%f§}Ào-c˜ðË‹ÅÏàyIX„…i€‹¬)L†Ç7Û¤U¹l¶Ã(µ«g›íSž-fÍb“mf»Õ®ÑÊ>×îÑÚ‘´µ ;…–ãŽy‹¹ä |Z?,ùd„@Œékžâç[hlè=²KÎë–€¹øœiÒÊÐSÖL—˜e¥ïܦ»n¸C%öK…õ^ä¾]¦£U >Rد×·w—ïonFÌ(DZ!}3ÂÌ¡4Óó«›Û«¹°µa$a?\ýójd +©;"ðZaITcŸ2$œˆš‘oeýrûn~„ÉEF?à£Zà¦ÿ?šß_\^ÝÏŸ‘ý' ð0¿8ÊfxšJ%}³ñÈãž• lELíÉj8±Á ø'{ çH0· â“Y´GsH-…Rr +ìŸ'¼‡ÙP 6-êÉ{W½ÿÆcɪI Ú$uÝ{6¯Â‹—¤xN)¥"Åái¥:šãÐ@Joüêcì# aÏsM4µÙ£æÑ„(enëWîý{OÜÞe¬«oL2„µ¬]Öø÷.‡oêH„–¡\¡{o§ÈQ^s—Ç ÕˆÏ˜1<Éõ±‘`|/ž…Ði†!wÍà lq‡ì;OØ/†ðŸ)«®x1K(]r³Ï©NVm +mw1µF̵&ü.Í/%þxÊA·±ÅÇ‹i€s!^ʹwàX°1?鵫FŠÂÜåC^Éè<_[#M N*ƒ±€ìó%ÿvu ț Õ„üY<ÜØokr q!é·™¥è +0l­êÛìؾ⫆ysÚÙoߘkŽ4´A`×½¯|™5öÝ×>f±$ûؕΟÌCiï%ªÿ×¾aïì·åºæ.•°G?kiW¨x¼ž1züOÇÕ†OCáG_)¡¤•…\|„ çGúPàÿc&:†endstream +endobj +6602 0 obj << /Type /Page -/Contents 3378 0 R -/Resources 3376 0 R +/Contents 6603 0 R +/Resources 6601 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3348 0 R +/Parent 6566 0 R +/Annots [ 6606 0 R 6607 0 R 6608 0 R ] >> endobj -3379 0 obj << -/D [3377 0 R /XYZ 85.039 781.388 null] +6606 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [443.558 712.238 717.944 725.14] +/Subtype/Link/A<> >> endobj -1222 0 obj << -/D [3377 0 R /XYZ 85.039 542.44 null] +6607 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [129.766 698.689 348.214 711.591] +/Subtype/Link/A<> >> endobj -3376 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R >> +6608 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [338.851 570.769 555.269 583.67] +/Subtype/Link/A<> +>> endobj +6604 0 obj << +/D [6602 0 R /XYZ 85.039 781.388 null] +>> endobj +2734 0 obj << +/D [6602 0 R /XYZ 85.039 761.463 null] +>> endobj +6605 0 obj << +/D [6602 0 R /XYZ 85.039 729.511 null] +>> endobj +2738 0 obj << +/D [6602 0 R /XYZ 85.039 545.678 null] +>> endobj +6609 0 obj << +/D [6602 0 R /XYZ 85.039 521.696 null] +>> endobj +2742 0 obj << +/D [6602 0 R /XYZ 85.039 316.435 null] +>> endobj +6610 0 obj << +/D [6602 0 R /XYZ 85.039 287.031 null] +>> endobj +2746 0 obj << +/D [6602 0 R /XYZ 85.039 287.031 null] +>> endobj +6611 0 obj << +/D [6602 0 R /XYZ 85.039 265.839 null] +>> endobj +2750 0 obj << +/D [6602 0 R /XYZ 85.039 145.169 null] +>> endobj +6612 0 obj << +/D [6602 0 R /XYZ 85.039 121.851 null] +>> endobj +6601 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F14 2895 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3382 0 obj << -/Length 2351 -/Filter /FlateDecode ->> -stream -xÚ¥Y[oã6~÷¯0ú²2P+"©k>LÛtšb:;Ûx·(¦ó Ûr"D—’'Í¿ßs%ß2(Š yxHž¿Ã¨y?jžF~`²y’*ߤé|SÏ‚ùŒ¼)á#ãGaí ƒËatk?“K<:ñubæKúY@ß­f7?ê`®?ŽÍ|µ#ÎÕö£¼‹eÞê±X,MœxÝByy½Î¹·y,6O@©JøÓõ‹O«Ÿg·«QÙ뢬 k? -ÒׄT‰Ÿ=R…¾ ã!ŠfÞ]ÓÛDSÞö°é˶ù[M4c"ã6UÑ\ «lºéê±ì`£$öþTˆ*(¸»Y,•ëÔësTK#|9ªôD­v‡ßÈë‹çôÂ÷‚SÛÑjyÃýb C…ÝÁª­­™½oùûyÁU¹EõÅÑZ–çßç5ö×"IWàâø?#ÙõP—‰öîÈœh&…>•Ñ±óªÃý‚¤®*XgÙ(1vžq™G‚ =¹̨€X>¹­°ûÂ#›üÐ *…gÁ°Ðö(U»®Ššû¥ì[ -o);íHß(rådƒj›Bn}ÖºlÑõžó/ød íß}Þ±Þp‚B*V¤WìºpÌ°is¼\)#{`²íÕ¶®^xì™ÔjŸÊÈLCgk -Tœr*íï‹Ô°% ºGh>¶Üݶü}óî7È0‚»w’÷$ñ×@Žcœ÷„µESl +; ¶n:ñžvžP%Þo‹4ôdÎcŽ|Œ6ÄUÊBCFê&·ÅŽ$F àÈ—åõÑó[±~yáô£ ÈQÀÃÉW#¯¢€@ï¦.†‚ 8Ú†´ Ä›I<â8ßçh²*{’v0:ð~F¹ -‹ -BƒàA\6²>{|IJä¶ró`m™Èû©Eå<»Ð`]Ù¯1“ºY(j¸½—]ßî1ª9ìðëBYR”ídÌ…ºm­Ìê†Y…-¸yl6\f V€sÓlJIk¬­…Ó]Ÿ7§-XÈe„éD—&Áþ%E* ldN ò#*srÞˆ-=I™¹„‘Û¥Ú³¬[ Ζǻ¶rÂà•˜æà«œ÷\/ÊÑ4GGCEÓl™@ɆÂάäcRM$J\|ú(–ëÔ{Ã_–//+Y/GO|qšÒW”Z AñžH`7ÿêT¾ÖÝ^ §ÉEdμ!|‘FwmUøð–GÈ ùªœdDbµSdodŠòì~fÈ•Ð:’cL9‡J¶˜ -²æ+’·ëèãt{”Ú2£Ü¯ŒÁpS…˜F|9æñò¡¡Dè¤ö¯áŒ¥ -_eêUŒù©R_Ä8Z0Î-ø=Ô{Ä8ÝÕ͵Ÿd¯åG±~èÜÑ…Ð]”Ûä×&sŒIÎn»Dî¸xT\i†˜Pãµ3ˆ™ÆdÃW3 `öý‚ƒ'ñè¢ä16¬•”É´ ÜÊÃÒßݽ½¿ö_ -réÿn•%›-ï–Ÿg—ß³Å|UîØ¥€ß¿»»}¿b>vºþ(¾Ò_á–¼lÏÔÕ-žd…K¾%É`½Cã¿ðú¾š|ƒ;° ³=ØÁ¡ƒ]Y—Uny;†‹Ün1ÁKN$x´Ÿ$ žÛ -âÙTeÁ0ö20BëÆ)og¬'¾xࢭãtbkè`ñÐHæ §Jh49Ý*1C6Z°á¢ƒrÃݲbÄ$s\rÈ­Ì 3Ù—"ýæG3õu£3ߨP<¾«×þ¦mvÌx!†j*|CÍÁ Ô¤1T\êHGÏ%¡Ãä‚2˜ÜKq&z’¹°¦ógœRï  g#Ø3I2-`·­\Fئ!Þ™Ï7;ÂæH˜äí œ‘ô¸¶`Òs·SBH·‚‡S ×ñ¹’ÔW©þ›6øæÂBK¥¡Ž ˜U11}}"Y#?ÑÉ4Ô7m] ¸r¤#ï[þôE½omn_¸»+«¢»pÒ}Že2ﶹÀg P10ØœÌx)Îr7UÅ¡Qaþçìã§`¾…üýó,ðM–Ο¡J6¯g&Êü(‹¥_Íîgÿ™.úLR}ušÀ2ÜîãU"ߤó8òc3^O (?Cý—ÄûvA׺ ó“…¨v*óçÎDI–´IÎqnîj5ÿ¡‰æ£P&ó5ì®´Ÿ£Xà—Šô£šLƒçuv/…%?¶ÃÇê?À†f?¶Ü®rw`¡P–Òch4¤ay)áîPöÂýPy÷˜Ï|‘Ñ]³¡q’9‘Aôàh)À¶i¥¤sýÅo “ ˆ+\ÁÂtUˆq§ìÎÀ ¤B ¸Ÿá?r¡%z©Ê èxÚ?òjw)†~ “×qËçs4~˜E±’Ç°“ãuÝ tÇ[µŠ6³êdŒ‰mV•Ë)5Cž.îO¤ºû ²%æ¢d|Á˒ꨰ–½š×ãjáázÁk ¾¾[‹­Ó„¦——49‚·Dèœ$^ Ó˜Sà+È™êì0_ï¬+]©¾¡Â<à5ìLßR~£J;\ÁôybÒë"Þ}`®†±ž«÷Os*# ´ñ¡çPÁ" -"ÉŠâѪTáÇJê´žY{yéBôóð ê=ó~ÉÝ ˜!Ñ„ð -‚Ð!„Jœ‰ïÝýæd„jóÚ-–E˜ã™5&Þjbí‰MK.Ž;&öt‘2Ò0©o̱'Z„qåUÏ=Aå’"à^ª†§¦á‰ -L"甯Ë7U×â«D¤¹† -“ œ Sª9ñëJ2hŸÀy@L?¼¿ç¹gØØs²ÛFB‹i»ÖŽëæ.SÁ9ÚIÈ{Âìy7á<ñD$ žø¥÷¤0€ü]ô=ÄÆx ¤ƒà5¯PñC­¾Œi¬¨4=wÜËr28 ©—ýˆ‰âÉ"1TuÁ ¶øìÆøxÚ. hùë…»ßâ‡0÷¹iêëx‚nã0梷\O -…žITݸœ -„~ðÐ óƒäX™î-–Øଧáå´ìŽ_CåõǤªÜX­™Øñ>¢°B/à†á$ØUùZO«à³jX¥pã0â¸~Ÿ¨Ìœî¡M@èä_1Ã÷ÿm2Ÿendstream -endobj -3381 0 obj << +6615 0 obj << +/Length 3336 +/Filter /FlateDecode +>> +stream +xÚ¥ZYsã6~÷¯ÐÛPUCTíÃÄö$ÞÄÇÚòzRIh‰’X–D‡¢Æž¿}‡®¤fkjLh t÷×¥üSƒÄúNq¢|$ƒÉê,Ìaä§3%#!uh~Ÿ}ÿ)2øiƳvë«ãéïÞùÏïÆ—÷ÑÖÚÓ‰?Åqâ= •÷ñúÇØm¼7<~;þùFî¹ûüêÓ÷Ÿÿzuy3~þ9þ÷Ùå¸aªÙH‘£¿Î~ÿ3LûŸ¾N“Á´_Áðê Xò­Ñò¾<{8ûO³™Ï:t˜·‰Þ¿e;7 B퇡Ä6ðm`è +®fÃQ¨­÷u&^¹å—i¹†“~¨ñ-ò¦Ð.¹Y/ ]lø¥7e• úèå@\aʯõ"«¹õ4ƒÞ§9ϯ GÊ[ñ_\î†/¯d‹¬³ÊvCd›'9·Ë¥¼f› Ò¼g2þÊe0’K)¼É”NžA*ZsÍ’,fø ÛƒagM«ÓpÍÏŒëüU.‹Öñi³{Ýâ¹ëî^OÐ1ÛÀ—·b¹t»Õ´Þ$í9_—rO¸UÆWèÉ褛7¼v".{ÌÏ wHœV msÝ9Ž!)Ù²–P°0®þ>”“Rï ò•ž¶Ê–†t2„Qå§Ö’NªÐ×*D©Íg³eÖ>l +FÖÞy¹Fšo+¤KÐðªèÔˆo"Š¼¶³õ¯³XÏœ J•ŸD§q¥CsÀªÜ b7Ø'ž`¼È‘×0MÙZÒ¯_QtU9¯²¿OPÜL0]¨IdõeîçﲨÑÔ‹œKÍoS'u¼pÇ ¦bªMg½Š›å¬·^Jêøé‰;µ¯÷ò/¤ÕAO¡ÙkQ±7&š ÂâM;^j>öÕü¬Q¿¾’jáÆ6ô.?ß AY$ùøîWÜ…n…¾‰Sà÷^ EWˆéFÆ?^\_Ýœ½~B5ºü¼+z)°6Š?0ÿœ6ãÃÐ<’¥FµöUTÕ7&j6$ßsð Ü:}N+ãOW7·xʧ‡KÙØW¡ú‡Kõ¯Œ0ÁbÓ“úåçK‚‘6 +u|Í­l:•†tNKé@uâÁšŸ_ŠŒ¤„ظCÃ@h[á{è]ügsÒµŠ€àѤ÷™È!nrÆþý£†@I,d×À6œsË'1Q +'SÁM;J÷và+m{÷Š]âo0ÇOhðv%wNJڧƕKî[+Å™üþ„6‡“ìé–¹¬ˆžL }êì ¸òŠœI¦Å&{^²oÀ÷;\·õ +ìiñól‚K-È4ç]k¶ì ë û€ÉÐëöÌÅAa§T±ƒIÆH[lÚ<ø/Yd“WÇ@7Á%ØÓ ÛÒw6«LÒžÛ0Îms—±@G€^€\âŸø®ó˜nŽðk“€9Éo‡æ¸“°Q +N‚C¯'’Ç´Ñ$"!uçe^•xǯBBíC…Q$ˆ¬ ÌHØÞ‹‹h ‰µfM€”,×õT\&Ñ‘ÁâŠò⎾a¡¦*/ìøŒÇ5âÂ;è$\øáfÃ6,º^æn$LnŠº opœN\nç ¶ìcóENªÿÂË!Û»® µ¾œ´0ˆFâ@5ŠûŽ¬õ¨C~îwÖ$‡¹B>žý2,¢Ÿ¶ä–wØ2Vê¤}¶vÏÑœf@ÞOBÛc†ä¾Êê¢\ Þ”Ò=‰|§ö€°P…Rã-Ià,„%ÓÖ%?‰¼£¦“bö•GÞP@) $Î]dU6©)êǾMÆ—…dÒ³  H÷¨¾ö7Û"‡]›˜1àT‚®…‹Ð×ûèÇØ舟FÊcA¯²Ñi0hHŽc—ÏkÓÃ.+ØõØ®ñùÝ÷Ww \(|NÉfÙv)1=‚YUÒÀAÀçfߤ‘›ÓàÛ¡9f’‘RÄ+! V†Eß©²ªy€|kÁn‘{þÚº‹—†VÖ«òfž¸,¢m3xYâ9§˜!`R3å׺Q²Ý™ šÕäEJ´Fz^ú›‹Wš/iBv mŠ¢@¥ # "p]8Ûû’ço ['©GrbŒEtê}Âh¸”!b¦\å¼h•³ ’UÂ(¥«ÊvOyK·úÎ)# ê/¯x)n=u²JN€“»‡Žç&•Ï^¸‡„N[‘§œz¦D,ò„Ý@+uÍ©®Ø¹ èÝ|•üÇ•\„dlê]Ij„Ó(¬s|äfòa–r†Œé\…b&ž·§ Á„€ÅÁßØTKs‚’~@ (<¼’eçù” ÝéêµI{Ë/ùªÁ¹ú£Œ§öt$Ó¡9nü:Iü(aôº)kÒŸTJ=ØÚ°¬Â ‹Ë%Ša)´»†˜‚KÚ6&œ’pÛåX{ë&0ï~Ñ(ëýäK/šâ9ŠSFèøýk{c\éüZÍl'äï”så8ufBÙ…îÞHÖ%¿=Œ/¯ý«›«id:B„+±Õ0 Ž˜‡x™¶Âú1Š¤žâ[mU‡Ëa@”ñ*t!ó +§æ Fݻƒ£0ZL¡Åàªô­?ÔR3ƒ´IõëX/kN`bºbL  þûÅ/6œk, +Ú@òž5¿äï¯Ré+Z×,¡QΕ€7—o ýEîª"àòj.Ã9H¦å +©©æ‚õç°óŠœMJÅ[Ú˜‚êäÒW^×¥±S”¸âh™á£Ãñ±"#3¦#™0ô–Y5ϹùehÁ¡/ +†šÊ6*Ò‰á)äxª³CÑ"C¤Ì·õ¢ëNBuØÚ`‘kƒž*oC4pµ„*¡r& Áö×zA—<çÎŽ"U̇µÔ€ÇÜ,-’–b—[I^§Jà[¾n¯¶l\1À38DL}AÅn¥Òj(–èe@g4*ô:Q©,Þ8¨Þqq$n;빡)Î+¿ àÚÙCÏ zu©3¥–ø9!p’K¡u!eØ·NÝÙ¹ECº]•+7o»)6žD¥!ÉÜ "»‚-+;ËdðÃ]œeš£ÅÛ < O—>;4Ó2¾6Q×PFÅÎiQnRLp§”X;ÀÈõCj¿ÿ¼¦É1® E6ú4S ÉqÿðO‘dÚø¤-˜ü†ˆMû§<óJÇû:öñÄ‘€ ø¸r`^Q‰ÆjÐf§[ïn)dÎ7·ãKligóiƒAX8k>t€ú%g[ (a—|Á€¥2ðlº­ÕÜÛƨ|0™tûÜ´8Ú?·»IBò¦À§!lï±R0p&W¬7X…Æ8òeF*õ&€Å\ƒ!¨r¥µsZ¹Ï³Yw^dRûYH(°)ûY•kš “žVí—¤Qdbï7ʶ;üUù,¯RZ#²£j”CÞèº)ÌV妜lLL¥&ÃK=sǦÀ\Ý{©š¶êWI!¬ "$ôlÅ’lYëè%blU2SòfÄÊ^Aò¼ OèWˆš7ÃÛ^¿WsIí@:Q`ÝA€„X>QXy>„SJŸJ)Íô8¥Sß&ÖmÌý’WÎÈ÷ÀÇG~@ô·Þ/ˆC7¿>Þ]øXŒÿ|y”wø‰VßÎ|;ÿ÷B„ìß5èŒ*Þ`w…öÕÍOÈ0}Œ9ΰŽý0 ¿ávþ †…¾¿;ïÜr£—rÑ÷Èø9Êâ „²†GìûÛ‹µkýíçhçŸ8‡†¹:Å…1Þ‘ñ+düˆ@a9Ý|;ëíü¬ ‰@ ÌœbD=î…;ÌýÅ=Únÿ(hi¾Ž =­XÓÇå¦ü—‹äþm]b«©Ö»~àç-ŽÖË’ë/ÜÙ|2‹¿ˆÈ›Uªì™"l-e$!d¿#ý ÉmÔû&–“¸t·¿^Š€äH;w—@*†Ÿ ›Üñ]r«šÏW\Ƶ±ŸFý2.Ó7?ÓHÜÏ4¸„‚n¨›"Y固h±Î¹oFñ)¶ÄùSE#â'°¾Ÿ$¶÷Îï$È¡jt‚÷B~^’¸zpÄLK¼M-($±|b”϶gX8€xµóÔ$íü0F²%ç > endobj -3383 0 obj << -/D [3381 0 R /XYZ 85.039 781.388 null] +6619 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [394.325 552.321 452.136 565.223] +/Subtype/Link/A<> >> endobj -3384 0 obj << -/D [3381 0 R /XYZ 85.039 761.463 null] +6616 0 obj << +/D [6614 0 R /XYZ 85.039 781.388 null] >> endobj -1226 0 obj << -/D [3381 0 R /XYZ 85.039 761.463 null] +2754 0 obj << +/D [6614 0 R /XYZ 85.039 706.019 null] >> endobj -2163 0 obj << -/D [3381 0 R /XYZ 85.039 671.926 null] +6617 0 obj << +/D [6614 0 R /XYZ 85.039 684.823 null] >> endobj -1230 0 obj << -/D [3381 0 R /XYZ 85.039 671.926 null] +2758 0 obj << +/D [6614 0 R /XYZ 85.039 602.015 null] >> endobj -3385 0 obj << -/D [3381 0 R /XYZ 85.039 643.191 null] +6618 0 obj << +/D [6614 0 R /XYZ 85.039 580.819 null] >> endobj -1234 0 obj << -/D [3381 0 R /XYZ 85.039 489.45 null] +2762 0 obj << +/D [6614 0 R /XYZ 85.039 511.56 null] >> endobj -3386 0 obj << -/D [3381 0 R /XYZ 85.039 460.046 null] +6620 0 obj << +/D [6614 0 R /XYZ 85.039 489.699 null] >> endobj -3380 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F70 2201 0 R /F18 2207 0 R /F56 1642 0 R >> -/XObject << /Im1 2193 0 R >> +2766 0 obj << +/D [6614 0 R /XYZ 85.039 421.105 null] +>> endobj +6621 0 obj << +/D [6614 0 R /XYZ 85.039 399.909 null] +>> endobj +2770 0 obj << +/D [6614 0 R /XYZ 85.039 288.828 null] +>> endobj +6622 0 obj << +/D [6614 0 R /XYZ 85.039 258.627 null] +>> endobj +6613 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F14 2895 0 R /F35 2880 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3390 0 obj << -/Length 3267 +6626 0 obj << +/Length 2862 /Filter /FlateDecode >> stream -xÚ½ZK“Û¸¾Ï¯Pù©ÊÄA‚¹Ù^{wv½ŽcO¥’Úì#QË)“”ÇóïÓ"%Îص›¤æ@<F?¾nœÅð'gF‹X³ÜH¡Œ™-÷Wñl3?^I·"ž¥"Î4N½¼½º~“%3‹".f·kZr»úmþê§ïo_XDJ©y’‹E”çf~ûÓkù¸ó¿¾|½¿†þ«E$翼½Á¹ÛÅï·?_½¾¥"Ížúùê·ßãÙ -ûù*ª0³{hÇBÅl•j%tª\wõñêï -Ï¥3Þ5q·(•Z(¸Q¤baL.)õÄ%oúE”$ɼêð«æ[à¼Ä[ì qXØ¢}Ãß=Î65LT}Óº9· )ìš þ;–)n'r­Ž-n¬Ý’¾ìp²ŽÝ-3à6O+*<ÏoÚ–(Úë7:\(1Fä¦p×êmÅ—ˆÍ£7øÕÄÚÙ£¨T -™hóU”ȳtòMÜLôˆ1/iÇ®9ÝF×°¤9"+¿MÇkb¼C(×–ùæÉ*H«·;dÂöUSwÈlX@¯§ôHé¥Håžøúص׻fiw×ÝßÙë/¶xr)S¸´v›X‘*´(ÀH"šf^ìºæùùƒÖ%µ‘9´F‰Rq®cM¯µçÎÞ.ñi¶dÙ¥[Á‚"÷‚Â}ôÂõŠémËÖ{çr ÅMÇŽà…æÜäL”,Dž/ÈdÙ4·~¨ «òà9Îð ½B_WÇ€—kPAîÝxËãÕš¿8—ƒNÂo; º¬œQoÅ;€ÑM…ÂØ8JõˆR;¥Rí_³Û߉eS¯'.š°.:#¸SPË‘nðy1¸„¿½ý„]اL zí­%Ùx7[0V ·¢£¸d]‚ïÕZ}ë…¾ä9¸' C³Çó6 …d´ßž<÷9Ö¸•>ò€‚«"ù£~ÿ¥w’ˆ‘ʱ4Ðrý-{~º%|[GË⊞u¡#ÏÄzî×:_€íz’ÁiCg‹ó¸¥±Ä…0àÑ'"=`’$WÀ¥FÊàþ˜K…J³¡û‡µ - Ü€I„fŒd² 2é˜q|¿s>Ü!ñS $pœNy<~¨ìÌ{S7xEgÿT¨ÙÔb#åfIZcÌüKÙN@©$ZNŠ D<ˆ‡“ÀG^ˆÜˆÔèé‹jgbOC)0Ö´ÈJ‹œÞ¶jÏ$ zàE•[Ìúë|%sK í"mtŸrq!e¾mOCÐy°­²y{¬ùx„ZÄ€=…z§Çl)Y vì<½i1`€-JÁ@ÕOÁd™Äìi´@Éߖܯ™Ó½ûŽ)p,~à|´Mëæû]k^ó´óItËïr>yâq%¬Amˆ*…h>QôùH CG6~1JÚ#„}ºŒI/Mó„DÄiò˜P%B%Ó‰ÉQòGÉЦÈp‹VggT •0³,±ÉFö-Á#ë¡ö¿k¼)§.¤)Æ…Ù癄Ë…âÙA›øÉéà“äˆôeoéâäÁg½ØyyóãG¬ |XH)çÿ ² ¯ P3)Gç=ק'Œ(Z@¨0ñ•òÕÛ›×ïnt.sžÀhðê+vR§É úì¯O¢@ùi˜=!BH¬t¢©@‚)ËcJiÌ áº+i,:d_wŽÌ·Á…BNo_½¿¾yÏ“œ[®É´„-Û–¼°ê†×儦n0Ù2ÊE³¶õcÙSFž‚Àw‡)X¹ïJvËDmÏp{ìÜW»·jO mœ6Qz@Í1>ÄËŸg«¦ãÖ^è€[ž9”íPbärŒËç£DDšÓ3Êbþþ•køK±¬n¨#‚ÞQšÁ;BçôrбüÙó;ûvãNèØå}ƒ¡g” -u8Ùô<;È„Ÿñ,eJðíü%¹†@yoû„ž’b€ÑŸPõ~x÷‘]³ê‚+;䔚MøÚÄ“¥C_»mº¾›sm.!Ò¦Ò|Y½ò ^¨µCõBþH?úãÁÙT’ÎoœÐpÚSò/ Ÿ3Þ’q†4…É83¡Âœ*áccܹÇ[–Gî+bsì¹Ï2SÆ‹5ÕV”©§1?YË+CqÆ»²ýâò?²I$@ K_@©4±‚  qâ¾áe½:úç/yød^@tÿR¶¤€ž¥§ šÇ=†Œ‘¯§tJÉ-ðÃî½­ê•ïÐÂý o¤‘Øeé;ñž;Ú¤NmG¦ -C€÷=ŠUà³9׿ðTûj³u•'0œ0#Xt„Aª2Àwì#a`l‹ƒ-Ù` - …ö¥¬¶d‹Ù¹3q­ ²¼©ÃTLឬvÇ‘ÄòB:üýú„ac…«=ŽªÅ…+9cåÍ“íyœjyE2Ú}Obh?óvÅ)\¸`ÍÏÇA­¹©1ïãaA¦%pG‡*4´A,삹F#˥˛OÌ>b-º*kÁ² \ÀñŽÊhx•,¡¢ q í·©*Šá+/¦ ’W€NÅBl®'iì|©,ï'ˆàWÖ$»Úó$Ä— ê£ÝsÉGâÑ’C"Æ(Íü×&T$B†UO\jÌi -ê°ªBý’*üw8GAÀ§Æ%NÖÜYNÆØr¾®½½ó5VÜì߃Îòì…\Š¼©ìøv[ ìx½åÏa›©ëænWî9M ŸÊp.wÃè2È1a¦9y¢vÇÂk¸@¶•R"™cÝ+ÿãˆUýokbâ“I™ë0á‡19ªk-wU -ä0½åï–Åáf∣wH_yÍî„&8å„ msÜÚ”ý”Õ±ƒÝ9óaWÜx2wq)ž¾³w>U×.JÓû·¡¨©SRÓOh>7."œ@ÐEnhÔrX§àuCH…ñ«a9Z²—$óGš/B…»ê³—–âo¿аK"M!NŽ!”’Ã8Ë[Û†nxG`ŒÃ,®¢íÕ(ÌáBë(Võb°+vMýD—Q¤™S9†Zà›2Ž;–áŒû©zìóàëùa-r#OdGÅLH:S%ò8?+ð×xØÃÄa ,éÓjGÇIH¤/|Yd)ýðå² z”ôˆÔ¡’´«¼ /bhƬ•E +É_ÆŸ$‘V‘IJ ˜PÁÍ È'Š´w·…‹¯(Vð'^ k›í@Ítf<û½Ø¤ÀqÝK˜*“d/3:à£&½¦cÔÏ„Ïiëßµ áðõ®óC?òºG*Œ|oñX4£æýàû4ÂÊÍîZ! ÏÓЭg&1*£½ËïHöUÙ•ý-[Ÿ}`Û#>JvÈû³9‚`¹)hgõÌ[rÄb^Ê*¿„ +Þã´–Æi¨~`MŠ3¦Pa<ÖÑ8 +²Þ˜"´£0ó>—õÊ¢Ù<õ7‹cÏ×Z³YÝÍ÷rYðäñòå7A:ǯô"ÃÎy«ŠÃPé4!Žû·Œ¼eì‹i°ú7y%«¨ µ¥WÀÿPÓ[Æ*»GFúLÖ´B%@œáêÆ]Ö} |C:ôî±æmôö ° ),@mMŒ¬la 5øË›vlW‘¨zQ*xû] ÆÍÃ2òÿ`n@µC€­3âÞèÉÝá6t øûhÛŽ‘wSº°Ý0Ùi¬8§Êi2¬t$ ~&ï´b¹È²ÈD¸ºõù¤%)4^Ÿ½ìÔB²£¬ûË;Ð8Ø4œê f›¼¬AÖq¢á­Kç-]o²¡›¼{Ì;A˜D¥Þ}Î %ß94ÚË÷‰ É(FÅWDöÍÈ +ÐsâðúCصëÄs®ñ¾*6lìOeU±“h¾¹wÂé³8b„ä·Ü5Œ]’3ñ½²“¹ø“Ú²GÓÅDÆÇÏAÐax¶YõÞ ï—ø#`ETÀE mµÀa¢¬™³‚æíB*ÔiÄé©=bŠšàj¯&8>§&¸ãwé§G§y¶øããÛƒp–wl:èåÅ¡çüs{}˜W<”¬“æìZ ,â“YLSU!)× I»,Û"‚ô3ÿÔVöà“¬(AÁheû¨%¡Ÿ "XûˆŽíXÁÆñòžGŽ\ÎzÄaÐØ|ÀÉ`í•‹[³È›£®…hF¥à_ÓËž`+ë‚*Š0 +]À¥§brò¡: -ñ˜«‘'=ö˪[:q¨l;Qæ-ÙñUN΀9°Ýu<¯­ îÙÇÊÕ±*˜bïØ`˜ïiµ,÷Œ÷!¨—ËeïxÜ®ë¢v©>1*™œQ¯N¼à²!Ô¼“ÃR-ªWQJ±¥óÀiÒIvK¦Ò2…ð£¥øt+~uU¶ß‚L^„=.ç7 +£QZ“ÎgÀéÇXFðBo0°îË:gLK¥”\C`ÿS—À¸|ë êHÒÍ$ò}e ÷§ àf-ëŸFáŸqg#äÑ2вժÞ3‘^>àÅ#ýC¾ŽTf²}–òçeV|©ÒÙ13:£4 «Î×"ÌïlÃÐmêüq)‡%[Ù>$ÄGïJ‹0 Rï²j-£Ž¥aw²ÎæCÎÒh 9ßøíò%TžvYGhy=sJ™B@f'oš…r½MN1Ws†¯+Š|”xt›7ìaÑ\:—šÀ +Ù/ü6½Dª"˜0Ñ”VÐÉQÂïÝ8ý9VK_áßQ\ŒútqȽmU±c’@ÑW¾ mÈ{•û%z%KˆH>úï\ÁcM‰•Ÿ“Y ]ÂúüÉCY_™ÃD™Ôì'9f£”^?óÏëâÏ­mº×²ñ´#ÉQ²ˆ½ÉÑŒ¶ëÜíñžUÙËÎb9yz[²¿å%3­’þàô™ÛÛ +qîø<`qÅËœáØØÌT…{²£×óÓ‰µbñ0, לáä“”5{˜37ª¬üoLP"Çшæv;®ø˜Š`õÅäÍ o¦bƒœÕ·ËÞß–ÛŽÙ>—Ñ<æë>5Љ$•»2Î4òÆœr¦ŠÚŒ * { +£¼§âý¥VúÛ°³¢9®]sÆ‹Èň°SæT]NÁÝ׊'‹“ùñXª¡¯Ç‘l©e ôGô˜Hâ3 ¤†K—¢E㶚I2'} ¡>¡gØo‹d£$ŸGÕâŠÇÎ=å”­þÇ°V +÷}}ÃU‰UGÉm'Q?7¡;Jø*D  6?6=©yÊu=äÜf\ü‹ë§D¡ëø0ôÞË$Ê}?Cžƃ„Z +cÀënß¼£T `«AF˜ßÈ6£äŠâi_ê̲T™ÈßS¥7Xƒè“Èð¸!Æ'^zNÙNî ®´Ùrõ@® ãß+ÑÃqYHbJ„ÜVÇGs팾Wö4™9ë–€°V»ºdŠ‡þà ù wEó|×K\QIQŸap}Î 1©&w§`5ïÇüæ9åß0»,UóQÅqÀÊ^ïØå +<ÀWÅCNµ¥T¼—H„º¡¿êÖHO”5¢¿Ü6@ü”ïJ¨–õ²ÚQaÖ²mÄñžõ½Žž4‡Á)› c•šÜÙcïD‰÷Ó»i“Zb”åòÀW¶îši„‰ËOr˜wK}•¤Fˆýã(—æ™ñÔÒ÷ü¡`RQŸìùküšA§#C›4áaûTf=OÿDâ²íÄßëú'*΀søÕiJ×»±œªžª;[¶AŒ$'L dÀY0ÊhLì·"ÀëùÆL®-0:Ùã•Éκ\¤{5J¬²0™˜4T&–œ¥Ïç¡<ÃœuGý<Œ—\¶<å˜ +š@  +®£èŠl@t}<ŠõBõÉîK +×IìZ€}šˆx9ׯv‡¨]{ {OÞõÆn’Üoh¹³.V‰v*–y- 3rÆ Uš­óç㇠A°Èq¤ ÿ¿j¡öš,™Ìp[ö×´¼/§ñ¾Qi¾ØÀ6>œ‡/·ÜITš}Ë=~©å~ƒã÷ÙúÐu¦½Þ}‘»ç|{= T*Ÿ çò%ƒ:æv7¼|Žžsè‰Që¿VlF±r:*ÕPSëré:r€Û +Vcq½k7L©+÷qõf!ßE•á•¦¶ùÖ«W—ÏN(5ÖÒ=Æ+Þ8$/«#WÇðtþ$}Ñ?ìaòlÀ>!ã}ŠÄÒø+чcĦþUï}Š¨ÆÝ¥µ˜åN¼ú«éøÃC?¸S&ÀA°w§méQ^¼É¼É¹UqN~öü4é´Óî÷Ü·#lÕø¦ç… Oòá÷¯48fø¿³7ƒ{endstream +endobj +6625 0 obj << /Type /Page -/Contents 3390 0 R -/Resources 3388 0 R +/Contents 6626 0 R +/Resources 6624 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3387 0 R +/Parent 6623 0 R +/Annots [ 6630 0 R 6632 0 R ] >> endobj -3391 0 obj << -/D [3389 0 R /XYZ 85.039 781.388 null] +6630 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [149.104 518.42 206.915 531.322] +/Subtype/Link/A<> >> endobj -1238 0 obj << -/D [3389 0 R /XYZ 85.039 650.648 null] +6632 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [165.346 77.186 348.339 88.876] +/Subtype/Link/A<> >> endobj -3392 0 obj << -/D [3389 0 R /XYZ 85.039 624.034 null] +6627 0 obj << +/D [6625 0 R /XYZ 85.039 781.388 null] >> endobj -3393 0 obj << -/D [3389 0 R /XYZ 85.039 606.001 null] +2774 0 obj << +/D [6625 0 R /XYZ 85.039 761.463 null] >> endobj -3394 0 obj << -/D [3389 0 R /XYZ 85.039 456.354 null] +6628 0 obj << +/D [6625 0 R /XYZ 85.039 741.134 null] >> endobj -3395 0 obj << -/D [3389 0 R /XYZ 85.039 287.653 null] +2778 0 obj << +/D [6625 0 R /XYZ 85.039 684.25 null] >> endobj -3388 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R /F20 1617 0 R /F70 2201 0 R /F18 2207 0 R >> -/XObject << /Im1 2193 0 R >> +6629 0 obj << +/D [6625 0 R /XYZ 85.039 657.636 null] +>> endobj +2782 0 obj << +/D [6625 0 R /XYZ 85.039 129.164 null] +>> endobj +6631 0 obj << +/D [6625 0 R /XYZ 85.039 107.402 null] +>> endobj +6624 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R /F35 2880 0 R /F14 2895 0 R /F66 3242 0 R /F11 2898 0 R /F72 3966 0 R /F18 3969 0 R >> +/XObject << /Im1 3957 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3398 0 obj << -/Length 3144 +6635 0 obj << +/Length 2878 /Filter /FlateDecode >> stream -xÚµ]oÛ8ò=¿Â×—Ê@­ˆ¤>¸‡tÛÝÍ^·Ûk|,öö±åXˆ,¥’|‰ÿýÍ%ÙVÒÅ¡hM‡Ã!ç{T5 àš¥‘˜l–¤Ê7i:[í.‚Ù¬ü|¡#˜…~G¸ôvyqùS¬g*ð³ ›-7„²\ÿéýøËÕ§åûÏó…1ÆÓ‰?_$Iê-yÏ›¹ò®~{{…³ßÃüÇùByÿøpkËù_Ë_/Þ/G‡.B?Œ žúåâÏ¿‚Ùûõ"ðM–Îaø*Ëf»‹02~™—7ÿì©ðZ8ã]w[ÜÏ`m¡G‡_?Î ˆÓÇÓ*üØÄÏÒ¡]Ðá‘C?¦(fiâ‡iÜ¿z ÊÏ¢hüêkx»ß1ŸxÀHûq‚f_fÊÂ,3¼8ŸÃ\^ïÔì] ÍžLæk8D«‚´çJ¥ºpSïòù"T¡÷¯ªŸpy—øc¼EµwÀÐk‘ùCÛåø»k¸oé:—?é`D^Á}Ò8–CžŠ*ïÖŒvÄ… ý,«¨˜âœXÚ•°Uo&ȃª$QÖï›&®ÁZ”#î#hNû±Ž@ö¨l›Ã6_ÝÃa ì‡¹N½zßàÌxí/êîËk`®ž/mµß‘0«Î¢`‹ºbŒ aBÃón;G‘Ó¸”­Ö¡¼ýv[zGÒKà-"ÖVuÕ5u öþ¨°$^.[†lús`2âføˆ–V»bµ/m¨NĈ0ã¡èé:%s Sú·rJ;º$g©8få!»mѲ ‰Ìuâ=K8j`÷=;”vÿxyøk›ÓÉ5埚†ÓÒi6[Ä`P/Øü7Ù*œÇT½“ù>’ú‘ì+š°¯k¯Ž'œÄÞ<A-ÿ¼jé­[’ ½1b5ù—½F+6%ÅZ€ªøŠÁ <² Õˆ@D+oþ‹çâS#¬qäPG÷­P9Þ·êeQå4îæÄD‰Pk¹OìÝ„´e}˜“Ž™Øûcž¼¶Bå3apÆÁêM‡sRÛä¼·ÈܲÂÐë gw¼oãMS¸[át]^ñª³;„ƒà3`YÈ¡m4õ-ZÈmy`l9‚nl÷s±’œðÎo¼%ÃâÛ b QìÙ²À×MyÔé¹%6¹,èq"&ÛX¶».oZÆéjþmÙ\ø-9ÿløË„ÚbW”¶ám(jÛÙ’g¨õm‰&‡¨Šw;iÌü|&JøÑ‹®@*&Š˜•Î"­­aèÇ \ºÝ¡ðs®Ai"¥½«²­yu…‹½`Vx›{^ÜR´½Þ£àP´Ÿ§QÀnߌ-OÇ™ÅÎï·»[¼¨‘# #?…€Áx@L1Yòß\æ@Òì쇣0Ü›±‹Î›¦nX_táƒnq~?çgb±îh«µ¬nI.¼‰dó˜5‡”ºÞ Quш9ÒiEîÎÛæìl­<½bEˆàiQ/é©É‡²¾›<±h"XBÒ½g(E¡Þ-±´ò§¢íü%³‚Û8å‰ü¡‡ÜS˜éõƒh4L—õ'|”mëJè" ÁI,iP!ºDÐ#­cÐNœSÍ7#£>¿4Q‡¸¶ÎWe‰äbcË‚lÉ1#üØ1ûÚ—ÛœÑw5:k­ÄâÝ>º"`ðµ½w°ó¨ÿ¥s%„PvLîê&ï)¾`¹˜ŒÔ%‹£±øÎs“ù&kÉü0 -{ké•O/«3¯k -¾ÛÇ,2ˆå‰3Š©H! -¯" ZžWý®>|˜r¹Ã[–õãÑ–§§'ô÷òp˜ p[ Š#zQŸÝ@®)ëªttAýÜŠq<ü…E-¤+KÊ?x ¡ööŒÝpJœS¨ÚÚê.ç¬ulÃ0E§!;»zJ÷'4æÿ¯úÇWùF~‡Q:¼¿/ÙS%BAàŠ”ËŸ¢xD*U~(q l\&ãb¯`´7ÂÁȨ™`JÁ0Ž© -#–ˬŽ²Eà¡=„95¤Øˆµ³b¸òX´[¹€ÜPªVx…Lûa¬§h,5¯å´ ãAl€­¶}DÕ¬¼i¬%«!%¿“}V`4’’'f´\€\œ9P“Ng‚ØÊK1r®Œ6\-ÆJËeñÈ]PìjÕW4ŸP¦¾¥¤Nõ™yoÿ±Èl¡„Á+½ iërO¶O‘.rÁZ·:9£h éÞJh=Wv´^³Œ’½u—ÿÓT=£ˆGµ³("»`%äûaÉ@2%}Ô@ú%} 2_›äY}Ô1—aô -’ž²ÐójuàõÇS]Õ ¨‚ËjZ/JLÎãÀ«jY|YsMDóç)jö©¬ÅÂç‘×®±pÒ ÿj]î(gÎ`c·O€>!!¹ë“S¾˜ý+Pa>í_QœYICeÅqbçz+KE(ä6ˆùÕ -EbBê -~UòÔMË«B~¥0så"‚˜¿]ÞmÇP[6¹]˜`C%%5Â*Y'^VgÊ®(“½‘FÑÞ墈i……›Þmœ_Õ¹ e† 'É+Váx §À²Bå2D-€_‹ÊiV'%eœ²î4yŸ¸²Á¥ZÚm-*¼uÅUr6÷®’À»â®€ÂñµTùD -(”+Öëæ¾õ'®‡-5W3dj¨íÎãb”úibƼçÐXy=‘€fzœ±Ëx×ÜÓ!ä3uT¿2âiýqê…K–§Gm*”{@MZ[ëg;Ôªh솆AÝ£B¢¨Ð;P] -³i¨-é’X÷߮ȅÁÒAä #‘ijš’ÝI’wëÊd9#ÃaïŽaƒt’ö.€*)áU8J„pâúOçR&[ ÍID®èjÚ0Ä–ß-y®Ž—8YlïyFõ&.ù‡2¼ÐPÛÔv½²­Ü›°Q§×àªZ!͚ܱI zHˆ]T«ºéÃÔª›ÒÕOåPqâ¶8{¦K+Cf§’¶td‡#Ë`$®î0ê3Ùuý‰1®øJ}0myù’ÞâôiuÛ¹=SÎ/wƒþãvÄßÂ@Vü›TÜ“·»ŽýJ^›¡ˆ×è¹×஋…ãþQó†CäЈ@Œ­m:ƒ8¨ùËø8&É·ˆµç«Ý‰Œ;õ“ÔµwÊúίv·Su­ñœ»•‰^4XÔ¯f Ý™øHœAÀßfžï -‡g´S?LeÛ)É -ïèk?ï1õJ83‚ÁÐ}è%•ÀCsDriÀ=5ï`Óß2Î[_ÿŒr|ÿy®”òþ_?Ÿuæñã 9䯷ÑéÙ¦šèÆÏtú½$°§ð•ç¹¹B§«]^$  |I¾ÿÉ÷ßÃ|íØP…tеÕIx­s¿õ¾9ãþÞ•ÁQ`)SåNòA:É0<ò'¸†á׆Î,ÎFömÂÎcô¥`.¿ô¯‰ðdMÑíuÇ3ùx£ê¨½M B˜!ó{!ˆ]‡ófEßhè8‰î¿”P›.g&:Í^ÊLTú¡I¿)5¨o\o¬Ø‘Æ# Ô-0k@؆ÜŽ'ƒÃk°I¤3I×Ü’íŽñtÆײ¹Ë¨9‰CȧôY˜6i|šÜ"ˆ{½iä•…|ìSM\¦| ~1ˆ¬ó8ÆUeÿwꙦqÿ¥ƒ*A˜Ë·–á«"ƒ™§d:¸s]«‰Tca˜-`Q·;ÿT‰52åN-鄼ìµäëØvµ.»ÅÙnÔ"SSß^ÌͲ`ÔÔÓg~ñ(w®rб8ŒñÙKÝ¥ îûNC»Ÿ»•œºÆò)dèŠw‚`yµ®òEß*¨d­í÷ãu[+#Ðaþ¦álEŽã}x¸£ ¿cÈñÓôZÚ>ûéÀpÅm2Ìédc¤rÁ²Ÿ -±& ý8à ZAI›DÓÿÉEÎü¾ÿob°Öóÿ¢ÛUYtÊ©Š}ŸDìÿF/Ÿvendstream -endobj -3397 0 obj << +xÚÙrÛÈñ]_ÁG°Ê„1˜Áõ‡µc»´‰e'RÊIíîÈID$ÀÅ@æj¿>} rUJUÂ==}OwSÍ"øS³< #]̲\…:ÏgËýM4ÛÀΧ%&Ñab Œ/l.üî"ÃÈdaäŽE¦ŠP…0ïnÞ~Œ£Y…iªgë™Rq¨U" +ٶ䰋Ï{ j0™¦æEâ¶ò–‹r¦e¦•‘-wP w žF`¦Âäþ 㶻Ž/ÛlG ¨gœLÃÔ /îé‘c:·îU9’/iÄqô#Ï„ˆè5É> $î–»’TqÕ4îKqL‹6™˜\×(þÃÂ4ªàÊŠLV&¯Y4l‹áv¬SÄŒ¡ wF–„#^´5: +$PwÍøVÐ/H9† EÎè5øoä÷wáU3¹E%±[›8XZŽMŽ§g!ô‰µôo‘QCðƒ±°É"Ãø*¹°‡MÎ `·Ï`LA®igNYp+”úPCƒ‘,;¡`„ƒŒu³ñoÖY XÛeG!Y唿 ªèƒ .c„P¾Ó 0Ÿ£À¬ÁÈ-/ŽßÈ=ÏŸ%/Rù@ÜAîÒ®ˆKΡTΚÖ* Vd8Sßâ†äb%—×|h¸à+ Ûª‘s:U—½Áá+§Á§j’< rÈ[Ä*šlɮǴÒ± ðÀ4~âÒ²g¥³d™öðhÿZádÉ’ÍvU׋wáÜ9'ÁŽ<þX‘)òÄë§n`úrb¢4,²üÕ2ds½Ò… +UšùZ(–Zè“`ö‰ªºŽ«¸æÐU× #¨T¡<{½ØÁ\/tš†¹êsfR`qZ}ã'å×ÿ™õ*>ÏÍš¿Î§å +Îó: VÄäòl”õÃd‰ïBmÚÒvd0±}ö±$Eœ©{“§Ã^¨®dË—3dÚÚ¡éûtß“Þ¦¯>\ZB̽, Ƙ6„‘D’9h4ƒ‘ÓÀÆàÛÉÞ…è9‰B›æZEË;’Q(%dL!bÃg¨Ù“•ûd 7wU-»GL]¯= ª`ûíG=1"(«óDP‹/ 153°ÅB ØF²¦~#ž(¢®ä¥–÷âüž\…¹ñ÷¸ýc¸lêõ…ÛLšÄ•hþ]ñ¯^bÂ8‹Ïµc$¼¤5ÜèµæP õ Y~»‹Ô«$ 5¬ü˜ü{–†×ñC±ˆAUE”LDÃOŽƒÍèùq¬,®¤½U•õŠ|…tî‰$Ù]×70òÜ{t~-päƒÁ8ž·gŽRCÁŠDÈmï«yÎ! óÓ ‡†ÕÅjFqn&g¨Ìó“|.´NìpøÍU·ñ¯½‰²`C¼cQQ(ì:µˆ¬ÊMkEÍV ˆ¥þÁñ±(u²©~)?Ãt9¶ð¾¤iÂN4m[.¥‚ ŽÉ’£`.% n_Xíœnç¢ðQOëI÷NtŒæŒóz”ñRAôôzX5®.Ú‰1¹`hŒ¡þäÍŒá­-à!Œ sð~x¿ùå·h¶‚Çóç›(ÔE>;Â8 +UQÌö7‚„–ÙîæþæÃãêq-FÈÎ_×ØŠ¤¿¹¸ûò×Àæßšç:øÓJu††w9Z¤šY'I—{ áï`õ§hÀô7¥¤¹ L LçÓ< ôNo‡Ñ?v€¡Ö††ÎÎõè8ÞBíf‚ÏÜ7zaX±®œpcûWÓ +Æ!;0†;u+icS¿ƒ (:22„E£h}–ü=:¹d# +‚o®ÁVTfÜ÷þ¿mÄãZŒ]ÈÀ’8T‘éo¼d$HìŠòfß•’$*ê÷]M˜™Ëñj) œ$%!%©ê9¹®•pùiQH^{f×ñRùÇ‚m ü"+¦/ëaGmËΩc®Û°ŽŸöábßzï‹ €áôŽw)1¨OüwÔ;·RÆŸ+oºmãšuÇø|×Noo¿òÛ±¥Xù4Eîvþ ¥U¡É MyÈÎÃe·³kÙÎòdäK}Rc?ÏÖÞ\Öã®HK%>@P0ä!Ûã¨?5¾­0¾§Ÿ`0­/b×vùÜžôy¹zBï?Ãú;;¶¾%H'§“MJZhóß"_yAplPýS;CÒ‘ûÃıй³í†ŠNÏ­G†J}Ã÷ÙsŸŽ’ÝúDS'?/¼Ò;U¾j‹ +doÈe£ÑO~0^±Ž£||šÃ™@Tïo­ “¬¬”¸»âm&oÛ6»ÿÁždʺn±SrJÉùãŒzRTyóŠQ..¸wƒ¼oÿñŒ| ¾ü :¾ÒŒF¼QBŒ!ÌDlh¯Ž×ÇbÃ9Õ&ÅÐ Ã1ý°È|Ç{çX€ŽéÅàf¸"~U­eíë+M5ýȸç„vUyo|º½!¹Š‹q¼¼Þ‘ñçQÂi˜ÆÅï\^˜è> endobj -3399 0 obj << -/D [3397 0 R /XYZ 85.039 781.388 null] +6636 0 obj << +/D [6634 0 R /XYZ 85.039 781.388 null] >> endobj -3400 0 obj << -/D [3397 0 R /XYZ 85.039 165.173 null] +2786 0 obj << +/D [6634 0 R /XYZ 85.039 761.463 null] >> endobj -3396 0 obj << -/Font << /F62 1689 0 R /F70 2201 0 R /F18 2207 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R >> -/XObject << /Im1 2193 0 R >> +3064 0 obj << +/D [6634 0 R /XYZ 85.039 667.044 null] +>> endobj +2790 0 obj << +/D [6634 0 R /XYZ 85.039 667.044 null] +>> endobj +6637 0 obj << +/D [6634 0 R /XYZ 85.039 639.536 null] +>> endobj +2794 0 obj << +/D [6634 0 R /XYZ 85.039 406.978 null] +>> endobj +6638 0 obj << +/D [6634 0 R /XYZ 85.039 377.574 null] +>> endobj +2798 0 obj << +/D [6634 0 R /XYZ 85.039 172.114 null] +>> endobj +6639 0 obj << +/D [6634 0 R /XYZ 85.039 145.5 null] +>> endobj +6633 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3403 0 obj << -/Length 3539 -/Filter /FlateDecode ->> -stream -xÚµZmoÛFþî_!8D*jšK.ß -܉ë¶îµ©/ñpèõ-ÒkJTIÊŽÿýÍ3³Ë‰Ž‹$Es_fwgwçå™Y©™KÿÔ,×OfQ¬?ŽgË͉;[QÏ÷'ÊP¸3í¸a€®77'çß…ÞL¹Nâ&³›;&¹É~_üðúúæòÝâÌ÷ý¹9‹³(Šç7?\JËû…š¿þùÍkÔ4_Rýbq¦æÿüé -}7‹ßn~<¹¼,z¦úXõ“_sg1öã‰ëøI<{¤²ë¨$™mNtà;öM½Ïÿ\¥W,|°ÞX2@ «ŒïZakªµßIÏÈÝð ÆäžØíMÚÜ3CóÑj@l2ïsÂjÉ­SdÃA˜óãÛ#¢D´&ÝØÚìnóVª– ŒìD •Ç‚ÏMH»Mä™Y¤’ï¾Éíd¦pöF¾ÕŽõ®ãÊ cÛ>g²àì´;}¬¾ŸØ»è£ jÃÔ¾§­”ØÓrK.$׆¶;çf]Øñy§ù>ï»”Ò®®8P¹µ&…h(¥T -Vƒã˜sÄź.–ønnÑÜ£Ö£9”§åÉUGç6]Wõn™ÊSˆØJ‡$éû®ƒ9Æ60l¹iÌÍ¥ÄÝ\ñ'v´­z -aûÖ†Rêyˆ­âÀQnøé;úk0¶ç™ÈÉóü#Œíy&jë]dâ’¢W1¯ =?sõý{¤4Þ-”Róÿ\¾;¿ù¡¦#]ˆÍ÷¨ Õ±FRí5çàl'¸`×N†£w_jÄ>œ>»T Õ# cA°_4 È‹dÒ4ŒÝ´Û[”§”Œõ\¥€,]Š••”…ñ<×+Du?oY­V“{*Ìpš ƱöPÞ³+ý€Šž¤ñƒt?²o^ *É/€®ç*¼´c‘ZZ»N1Žfª”Ôa=T%´MmÚ³Q1Sd‡†=Ù=í›üÌ¿Qv‘ l¨öönÙŒƒ•½©o4ßµéÌÙïø®àîhzaqcFÔYiÂAáòêXKËXæû\ËñEŸsD³ɱ>ê¼Ýì$å'ûú¹f½2ˆt"Ó&ŽÒêåTŸï{ŽïM§úh25q<; ri)êñ,Yä9‘›tF$¢å$¸ºÞˆ¼­$w¤&7¤'òx†Ù3å¸:I|é”™Ï~7œ_mÔìÛŠ8šõLù‰ãÑê*qâ¨gKŶíŠX -£ˆq$¾;AÖMSÜ–¹4A|ðDfV‹»'C±6¤»ÔZ†F‚OÜq-6ýiY™ð5A™€˜!ÇÜS¹Âõ6„u -8}€/\UU–•»X•d2¶6k#‘5Ëd+ ‚+šñ¡¿$~f[ÒVµÔüwÁ³§¿þ&¢¼¬ß>¸W/&Ÿ't»ágËi‰”§gg–|¶è+BÒêãnï—­Æ·ôÐ*FÏ­yÏdБ8îz4u¹cŽQ@Žö!€!ʶŠ+Cò‰ð%•Î6UF -ÁßÀxÄÏ\õÉæg&V! CÀF‡#ùíBU¤\È‘´6ccplä’ ¬9«Ú(Pâ}b%”ä½C’f¼P€µ§FZNÅ>,¤X -“û “㜮ä¾ï3 ŠÓ1cŒ.À’Àc,iC ÒÙegÇÔõ”¬9fÒždµßáN”;íüËñ(eæÖóÖ¾P9A蛡¤¡}F%í2>|xF ŠÎé°˜ÔÆTL#ÙùÀŸ|MhÃ/ŠËiÕpõ%T¦‚uÂ`µ©|$kúÁÊ›5HãÁ…ý Ê–QZÇ*8xL$®ARýbÞG’zIä´·z gî{FwÝ3TpTšD4Qæå„4x±ãw‚D! -?ï H‚¥"œÜ䪰ÑgT©ZòÝåó¦?Yò¿DÞ=ocQwÇ D µúû”7óØ h™Í9ö’>R&þŸp’Vc8¢næpœ*ÒZÏ/Ö¹<ËÍ5÷öÈHž-cïÒzó ºûâQæÏéîñjŠðý6å—«/Z…S© ¦\ÖO}Möy匡˜ýå’ë.¤ÀÍzðDŠ2Òk?¿‘r?édÎãÀ0ºÁ®–¹QL PBø><Æñ¸@’m¾l»­é6Gå0ãÃ)lôhÌ»“Ádœ\ ï('¤=4`œ.k¦,NLh¦“묨e’ÒÐ(ìöí”s!h×9—¼]JŠB’ýv"ºóá©Ý0ÔÛõY…#&œ {5XçåN€Äð4Ç<ÄÚ ûŒ!à€0=«NÓÖû%KEÿèAŸ^;|“E0peãÁTrËÔÏš7PÀÈ$oØzFj`chë´wO«ñ/m6œ+’_ÃøæG!€5ìl)ÉŠæ~ƒvòKó|ïl<Ž\¸?å½Å@¬»¸Â:0¶/ÜL”8ÊSñ˜ê'ô¬ç—)4ãü2Eס$E>-½ñôò/[û4Êï¢æ7G_K¹?Q¿ èéÆ?íÂ#)« õ> +stream +xÚíZI“Û6¾÷¯Ðm¨”Ÿr°SN&©±“qwjj*É-±%–¹tHÊÝš_?oHJ¢|˜ëT*-,ÀÃ[¿:\ð_¸Êb?Pù*ÍB_eÙj[ß«=Ìüx +ÅFH6šwwßþèUøy¯žÆ}b_Çjõ°ûÝûþïo}xÿi½QJy*÷×›4ͼûuè½ýðî-kïWè½ÿôÃ:ʼ_>}À©ß¯70Æ«~ûøÓÇ×>ü|÷þÁqä΂Ósd篻ßÿ V;`ýç»ÀWy¶zvà‡0]ß?~¬•ô«»û»º­xN¯xÕµÛÇ*óãL]^?Œ'×#åGQ¸JãÀM÷8”ýzE©×®áϼdÑUæ®ù\ŸfÏÓ/8Ýv0ò™dÞ#ü¤^’èKÐÐhÃô¯éŸáN ùLÈ^íÓâ2§ð€iÖHHí¦½ 'B³Å[æD64]Á“´YY—•ÁoPM«Èd¢`sÄÁàÞ_ì•Q±, \KOl r8 UÁ44ýG*jl½ƒR‘7 +Þ‚„ ’+v¼@¿•,lÖxá#ô·Ø80á¾³Û›¡èxl8˜FZ"s\ÞŽ\ã“®Hच”@äOÐ0Ç +/•¢8âÄ3Õ‘g‘5…¿a¢2ýÚ™«½£[q.Àt.ÀTø:‘’–µÖãUÌP¶ ÓLÏlj%É2΄ÎÉ.Ü í¥òcºù®Ö%®ÔQÌŠÂFû<3$å +Ç´“B÷Õ:sŠôå ¿¬;%|ÛÏŽ•êÄ»€¦„Öj +Ûr¥^˜–ãb<„*Dd[xBUñsÔ¸7µ‹Š¤Ž—fšžx®õ(á¯Iê¸?õ Ô=Òʼn(ÉSNkP6„Ë Ë4sÑi„1%³1…i’8V 6²âЖpBî]Ðõݱ;&~)éºÐ"g7G±œ²¶Û#“ˆ¦ç—6UÕÒ½·â4ì)¤Ü‚þ¶ÎÍ•wl+Ç­pdºÔ—iö +±>I4Dïôf~šÐP€Ž`VûJ' ÃÈWa´JtQÌCyö‡©d6¸Ë^S³Rúœë¯DÚ©í.“=À¡úwÆpÝ9@'ÆÜM¿R›wÕÀ»MÃQÜ/Æ—±2X?iŠû_q‹ k„FïÇ´(¤cñØ­s7îÏ6 ½¹®dÐ< 1â,c3Á|—NÜžE1*,ßHÑNœÖØ[[N‹/]< H±PLëWÆÊÙe—\Nåà+ÁíG­ Ͳө,ô³Ü ‰8ݧÂì¸jèÌ`Õ˲ü&#Ͳߩ8¥×ªñI +ÅŽ¹Àåd*:©ßZ«³5~ÆÈçvE_î›BVJjåG«èYÕúïûb‡jÍÁÙK76¶›Á©‰löÄ«Y lH;»µ0¹¹†:ˆqFö*ÅbX%ú¢ÂÁ1Î}âµ8 ÆÆ<»'Hs®ù¦d·ã³d÷NF(3â¡Ì>´ó*^†lÝ…«fâÍ1ïõ|4œ´v5yG)æòÊüÙòç’RgêÅÇ'VJۘʺAl•c“ RÚ§·¢1"ì¬Šà”ºŠÀ.sk<¦V(¹ú¨8œ¥UìN‘RîHŸ¸w`’q@WL[|WzöľˆýĽ—¢¨x*¸%Æ=C'Ü»ÒH«3¥vL3·Äk/™O¤¶ZjJ±r‰]ÇÞ‰¸æ†ô@)â‘5œÐp–—EÚ¹%(?:÷hW¢ÒÅ* +kWð2,ºGG&Ï;ØqH’(¿J¨ šÃ8dí@ cË uÎDî;k„œUØ<&›½p‘ Ã3:HÑôç<"F]ÎûZ{¿àŽ•†Ô/ÃÔ"\–ùV#aU-¥¼2Dò•ï8šå”iÈGijS^*)ï_˜çºRj‘¯§>»ÍM~FšåÔ…ú¢iêÃx7rBŠsÁqÁع4:Ì„³€(®¢):‰<ëÌxë²wZÄp*J6h‘› +2a³}aú£:Å1=¬]Ôøú[H/ô±b<Ó­ÈåZâFX)êŸ~wrør`q-ùaõ‡ÊnÄMÊuX%X@œy‡²™¢k)!RF@šLÀÊ +æ&v õÅ,×añ4‹J<æJì4LªóÝØ¡/…rþL‹œp-ÑËÑ6^-†Kw r/Bëuܘ¬`_\yüùjQjí§Éíð0¡YWa”ùyìz&áêD©B,„*(’KÈ* ¬D‰&·Aú„f9R…ö“€?ß1!F†¥V)U AzËÀO]&Á¯½Ü·ŸƒRzÜúýBmR‚¶ïØ_BÑWÏ9ÑƾºÀÏŠHò™! îRÖf¥,÷~ã˦!<ê0{Žúk^üL6Í™±´8É"–gÓ÷ò¡Y¢m5‰-•5¶JZeM»M¾¡[pÅ,ö7KÀÀ¿þàÿ3»ÿÓ?ŸM”Ÿ©…W“8Šü(´¼…fÑ9¿öŸ\0ü_÷endstream +endobj +6641 0 obj << /Type /Page -/Contents 3403 0 R -/Resources 3401 0 R +/Contents 6642 0 R +/Resources 6640 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3387 0 R +/Parent 6623 0 R >> endobj -3404 0 obj << -/D [3402 0 R /XYZ 85.039 781.388 null] +6643 0 obj << +/D [6641 0 R /XYZ 85.039 781.388 null] >> endobj -3405 0 obj << -/D [3402 0 R /XYZ 85.039 761.463 null] +2802 0 obj << +/D [6641 0 R /XYZ 85.039 664.197 null] >> endobj -3406 0 obj << -/D [3402 0 R /XYZ 85.039 705.373 null] +6644 0 obj << +/D [6641 0 R /XYZ 85.039 637.583 null] >> endobj -3407 0 obj << -/D [3402 0 R /XYZ 85.039 517.54 null] +2806 0 obj << +/D [6641 0 R /XYZ 85.039 483.53 null] >> endobj -3408 0 obj << -/D [3402 0 R /XYZ 85.039 278.584 null] +6645 0 obj << +/D [6641 0 R /XYZ 85.039 454.126 null] >> endobj -3409 0 obj << -/D [3402 0 R /XYZ 85.039 247.5 null] +2810 0 obj << +/D [6641 0 R /XYZ 85.039 397.708 null] >> endobj -3410 0 obj << -/D [3402 0 R /XYZ 85.039 229.36 null] +6646 0 obj << +/D [6641 0 R /XYZ 85.039 371.093 null] >> endobj -3411 0 obj << -/D [3402 0 R /XYZ 85.039 198.883 null] +2814 0 obj << +/D [6641 0 R /XYZ 85.039 257.688 null] >> endobj -3412 0 obj << -/D [3402 0 R /XYZ 85.039 180.742 null] +6647 0 obj << +/D [6641 0 R /XYZ 85.039 231.074 null] >> endobj -3413 0 obj << -/D [3402 0 R /XYZ 85.039 98.16 null] +2818 0 obj << +/D [6641 0 R /XYZ 85.039 144.767 null] >> endobj -3401 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R /F70 2201 0 R /F18 2207 0 R /F38 2158 0 R /F41 2104 0 R >> -/XObject << /Im1 2193 0 R >> +6648 0 obj << +/D [6641 0 R /XYZ 85.039 115.363 null] +>> endobj +6640 0 obj << +/Font << /F64 3112 0 R /F15 2876 0 R /F20 2865 0 R /F35 2880 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3416 0 obj << -/Length 3796 -/Filter /FlateDecode ->> -stream -xÚµZmoÛFþî_aøKe b¹Üå[¤ië^äãŠCÛ´DI\«Å‹7/_`Í@ç×Pu½T‹þrƒm·×Üþ|ñúv²èÒ&Ѹꟿý^®ac?_„γËG(‡ÊóËý…‰u-õúâÃÅ¿Ü,Üf.y”‡·%ЃÚ–: ²Ì8&Uìa²ìº¶T¾v°ë9h˜ÐØúp¥ªí…D.öH/¹_WöXkë#´ U+ë^¦i.<^GéVS‹ûªÙ‚<η;Û¯’ùý±¨¡SýÄôN^àÜ´L¹fòÝu”-¤K²F+NNœp¡ö®.÷xB°ÿkfL{{w½„ÿ×@Æ­ '–éEË]ZÜëv+»U븅–jàß'll\YµÇ÷勵¡‘톇6-±×â8s…"ÝrãïaΦn–Å9‡MI²]ZÖÂܵÄXÛ—Ll婼‘»r+©o}Jš‰2>ÕÊ‚ÌdPú¬F8ïé´0ežòÈÓIãÀÄñs“þ*óØ8ìþGžÆÓL"ªé‡¢®‹ø?ÙÍ22 È4ˆõ'ØŒLôÜŽî|lB7ê/à³X#y42˜›ÅÍ;¦a£²· /K®ù@¡í%Òn~„ö`²”R‹£AzϽH?ðH …°ëo~ˆ“Éú‘RIìâäW"†UJ¼E×:bKÐñØÙÞ“$Hµ• -]ž¼±ª± •¼‡™X’:C_uhfZýp'‹¢YÑzV¿a™¾©D Ø ¬Ñ‚ìë6+Æ;´È÷ðµ -ÂÌ{ø9“yî˜V~sõg_6Å]-§ž„x(©ÑJà‰Ç`N‹½ôðÙ]èð€Æºà.ßCùí¦WÒîT Ú‹µ÷š[Y¨$l{{ˆNŠF£K)V‡ñXèH>)uý·¯Üúÿxå´»Bè»O¯(›XmÍ~Ç5ÀÏjÍ £ßfÝÁyº{ËÚƒ¹Š¾ŸæB_¬™x(zâDF -Uî?üµŒvWâ‰z‹ ÎuÄÚðR”9J²Eú€R|5¤8á—ÖÕš qçš¹@¸óU]•$–Û—Øþ‹ âû"-…³U™8zlD(E‹›†;ŠŽîÖêXSék\,îeî¹?v>~¦xÌ-Á(ܵ=ëL ÇXÓF{ûè3µQ+;®®ä #4³=ÿÒÅm»ÎÊy50aE_ -Œ‰&&“¼/&âi¬k=^¶ußËNaM”+FsØw"¸®ÈqÏ}†]1°ngi ábOŲ)pO& -y …TY—,Õ)r*xîœ œ!¼ùç±$™a—i÷UÛ4#çnÞÝÓ™QQáøI﹕-_',y‘Ÿ!»d8‰§…# ôO­º? ó5ç[bšÃ²øÍ7go)‰Å®ÍãâصZáþ…: ¨Ôív‹æË-_ÙŒí&ŽÜò{¿ÒnÖìpÈÿglÛ -†••ã.I¦ÒÅ/ã¢q*`ÇÐb@á±ö¢` ]îãŽ*¨}8  å( {ÎÒX~¬ø¨cb†:~‚ 9¦Ûtyzz¬D›I ¤±T*?ò6¤Ú‘Nž„>9mAJžž›MÔ͆ÛFDg̱rÕèî°ËÅ=¡Yž3&q^Òã@¬(#QVl£,·ƒf*«V@³3 ú+nle.ÖÉ}…ö¸è¸¤ÄÅÿ»âÎg†¹,Ù…;WW)¹ŒFÎw¥ðdMJ‚E°Ì&Œu@΂—,¹ýÁ1 €UzçŸ*ÆŽ=FìY¼xåâZº1÷2¸åÙú’¦ÍˆÑ ÓÜU„2mœJv¯¸Æ‘.µ»¾8fuðð÷ر‡ã#îú¯ñ&NmL˜ºuCQÕ–Ë“¥ ]0±Á9 -¦{’ÑÒ4XX¯§þBåÜ ÀÇ´^ß’Oâ-Á¢&ÌœëÅG„ëÒø°›Ë¦$ärÚN0NyOÍM¼›r­ˆŒÊaøpÞ2VAqÆReaG^ “ÃϾü,$È“™/€ï”ò°!¾Šðª²ù³öÐdS\8öÒëã·|FMÏÌDA¤ìA4稰¤¤ÃK@¬ S±¾÷L™˜@%V |Z.±ýöÍ;N‰àV‰ÇJ¿#›[ ?ŒŸ„ζ8û4HôƇè6ç €LNDXVƒ7>‡œ:²øÛGûi5îc-â….[o¤ì”WlGönd:!êr(eP\±µä˜zCüÕOW<`?6-Ïýe/H D•€+ Ü^‘ 1«l毈ðŽs…Xä;¿!+¥,€‚Ü$4’ÉÁßÆÀ3h‡FW’tûüŒoªšÝT5CÊ›­!ãã·Ë:f Sî–cðÇsýÙÃcéÄGŸ`eÂ@3GÀø› µwƒ6EÏáL|Ç”‘;´d[&`.G¾<Ö2‚¢Keôû»ÀÛƳ P0ga:šV³3 -n†¯zn ¬¦µñÜÀAu½uýwµÌ1úQ¬pÖ†Ê7çb–Žg[9ƒóÕÀ”I•GÓyȬÓ%ÆìªL&Y\½õB‘¦))¶H'—3JC -à$Œ3ªØÀÓ—<¤Ú0qØU¼2å—ƒ»TYÀQ[iî™l]#O }É5ÞÜx¶8KåX=#§pñ[®#縈áó£Î!R3ÖÖŠ(–â°0ÊæVAªgÎ"™á·ƒ„?ç‘B°·-–ß”Œë׬ -te( ’“?R˜^ÅwÒÞë”TEÙ_À‘e#1½dâ[ -ñ&ΊL¯9!yuÚ•µ¼™Ú¡lQùãx …ú¤ -5ÈVý}¤¾ÈéÌ3ç?<ÒÄ|uð? ñìÐ)EIb½l]ruOáP±µ‘M„f·³¯M1Ýuü½ë\Ö›EÈGHaž@øù@#2çü1á|Є6Ë[ µ8F£QH¾Œ9œEäèˆõ˜TtBëu“b!וæC.RÇsŒˆy·YAdJu1ä÷ˆW;ö¿](‘'ËË"ö«, ôè'ì¬*IfS‹e¡wÂâ;¾LS\ƒ•çIJŒ (cf (¨ŽÙÄ —"Æ -.ø%§|œ¶Œ¨Ø&ƒq&ºEƈ „nóD¿arkG;{YÀmØ„ôóüP)¸½®z!´¾¼K¿+$ª -Ø¡Ül<"vc¥à'¯Á"r?b¿â!òí<9‡³…èшŒ¼|=(ëTùÜÊ>œ³ÖáÑIÚsæÊà‹ÓÛ[.rô€ïäIãÑÃ&ãÛņ\­Ξ:>+H*øçô„F¼²Êð…'±}aªRdI"­â@lWueÓxOÜâ´!áZhþ êó” êrĘ5“$ pìdbþà &Ù·îã5›ƒŒµ¢gkçÒ*Øw1&zÄ& ë²°|Gãñ„sàRÂFMV>Q`Q"…^T¯YÖè}ß å9…7l¶_¼ýÞ—ªÉ‚ÄåJ('Œ)aýÉ;í¸=qÊò LkNö§N(ÊÀÕÀ^–™ -¢<~þL¤‰ñ~~)-Îgˆ‹wþöìÛO•ÃÂòéÜ—,­Ÿ[ú „ ƒ]Õø²Y1®gf¡1£D›Ï|»0Ãi‘(ð|Ή¿¤:yO’—ͯŽZO>¦À8Ù~LqÂœ`œ&³$ƒyù ¼Ä¹¾x‘~÷çp&Ã&ƒß,Í?ó¹" °)¾:GL?zË’K.‚(‰üß‹<¿ìs_jDˆŸ‡_yz¦wI ““§­ÿ®§âwendstream -endobj -3415 0 obj << +6651 0 obj << +/Length 2647 +/Filter /FlateDecode +>> +stream +xÚ¥YKsÛ8¾ûWhN¡f"šø¬=l9ž<<•Ø‰í©ÌV&X¢%®)RKRQ²¿~ú’²%Ïa*e‘l4€F£û눚ðOMÒÈL6IRå›4Ì×'Ád -oO”hÌDe6Òyu{rú&'*ð³ ›ÜÞãD~™Éíâ‹wþîìãíëëéÌã™ÌŸÎ’$õn¦Ê;ûðê Å¡÷¾^_¿™êÔ»ºþ€M—çÓȸ×íï——o§_o;y}Û[ÔϳghÎÿN¾| & 0ý·“À7Y:ÙÁ{à+h^Ÿ€=~ù.OnN>õCq[8á^‡Vï4f*ó3=ï¡Xùalzih }Æè!¥´o”ž$QàGAH.¯ _¢0óÎË–ŸW¬OÓtA W÷°lê-<7-Ì¢PC{sZ"¼ÔûƒÎâæ)o[‘³ ©ŸuR/ﺼáanÏ?ò‹¸¸AUå­Å›Š×ž“cBï|•Ï§ öÀ£±¡3mR>Ú[_DË«+N«N\ŠømÅžm +Z`˲ƒn–¶¢zÚ>Äsœe~QðsK³œðËõ(.Ey6Ò~—FDÓoìwîÎò +,l&¼hï +–ް켞ö±‰&èÍú$cœÎó¦= móägœj?þ›ü里8ý8U2ÀÆ p +9ð¢Æœ˜9Sƒ;ÃðÁèÁ¬c%Ði$WM{‹­´ÌW¶Z€4ôõ€ýó¦ÊËc+ K3ýüÊãȇ€¼š“ï]± 1L‹ø†™7?ðQW® +<=Kcå] "ÁšŸ ¥*ø³dé[ Ìe3ŸkLžüÞæ.ÏyRþ¢& +3Ò±ÔãÝÉÃkÞµŸZ²I{×9'(OZÊØ@†wE³D\µ3CÂãAlœÚ‚ì½{Û5·–M†‰û}¦ýêÛl9ÊXYù¬Qw@ ŽB3o˽t0Û‘›Ë‡ÐZ¬ÓJ{g°ô§¶W?Mœá6àceQæ|g’ào Œ{-aÕVzí +À%j{C=‚|ú 5ÖÕ³càB}P­:•ñÎÊ‘7J$Û3îçu…q¸ìg—}‰÷ +¶òþ‹W”1§œ±.­Aœ7T´š—Y´²šjZ„ 9ïê+Í, C¯”èyàQ(a›µ-Y› Ô ‰sO¬ºc6Lc_'ɳLo¤sœÃ†Igã¨ç°Ê{²Úl7îô»¸ã—7TÄóö˜uqâÇIü¼uƒÎq†pVLçéìG^)‰†%® /¸š2q„Æ9>Wv#ŒÎyˆ™‘ò®0UEB?Á®¦íø{ …‚ã¿rZEÑ“`dñÖ¿Üð;JàýjÛ°)Ìiú£Š>þz~ þ¤º`yº¢2–°”ÀÛê¶ëƒT ‹é€þŠEÄÂ}lg%jÁ™­LÁ/ü¶mÇ•¿<¦ (¼¤9NÿÀ«¢¯Ü“ƒaï w)-:Ú„šŒ„§¾mZþœêÖî|L,H¤ +M•pGìÀû³p 2¾Úv¬äB¤ç“ ³Äøpð}¾‚¢¡<õ4zܼ¿Â¯ÏÿâÏþÄ£”ìÿÀv +h5Ǽ™“@Š/G‡D4‰™$Pò9¥‹õ]åx¶UùŽ‡vNŽó¾"p¹Çfú¨¹³_–ʬ*æP0Ê!-Ø9 âh*ü.^´¹[ôGg.ÇVs~·ÌÛaH̘TGŽu&p~¸Œœ»@´íèƉÐ=¤ÝáÚŠWRxùû%¿¿†w=¤ì£‹nv¸7Uô÷78ñÙ}ßly,â ¿C&ËXÛPÑ_ ~2Äéù¼XäBV aˆÓ7Q)¹QËàÌÒÊ5!&¹´³•Œ†k(YˆéÞ8|óó‰ Â/?ûÒ»%Ü£‘$+*w¹‘[Æšˆ`Ñѱ›f’KÅÕèQgÂc徑w‡Ï—GøÎ"ïä„"%½nºW¤™”÷ïclñ̹ ¶æ?}yB #¬›”áO÷¯£3·E°w6W{ÛÍ ñ~\ts+Dïë¼®Xç<·å°Å×ݦ÷NYÕCKB{dTO’p¹óìÏ;li;ÛtaP©'=hÙ™Zùqºï•OZ¼’ÞgaZðA÷C(³Š(àò¶¤[XȵÂÝ·`#C7Æ×ÇŽ?¢i,é§p0‹ï£“j1Yi»¼šÿp +\Ôe Ëã–µŒ5¤? ŸG¤QðÜŒ 5ß} £³Káƒ|]ì.xËœSk‹{øÒ…F© HbEÙÝKš¹ê 5Á0Ý'ÈÙð !r×UŽGµìö¨6T=”÷cÉ]ç£C5íöH<ÚÜ>¢µŸÔOG¸¢ |bŠðÇ6ý£ÿIø¦ñS“¦›‘Ö¾V΢©ylodR?JÍSƒÿ„×tendstream +endobj +6650 0 obj << /Type /Page -/Contents 3416 0 R -/Resources 3414 0 R +/Contents 6651 0 R +/Resources 6649 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3387 0 R +/Parent 6623 0 R +/Annots [ 6654 0 R ] >> endobj -3417 0 obj << -/D [3415 0 R /XYZ 85.039 781.388 null] +6654 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[1 0 0] +/Rect [229.043 698.057 352.339 707.625] +/Subtype /Link +/A << /S /GoTo /D (Other-Clients) >> >> endobj -3418 0 obj << -/D [3415 0 R /XYZ 85.039 713.704 null] +6652 0 obj << +/D [6650 0 R /XYZ 85.039 781.388 null] >> endobj -3419 0 obj << -/D [3415 0 R /XYZ 85.039 696.17 null] +2822 0 obj << +/D [6650 0 R /XYZ 85.039 761.463 null] >> endobj -3420 0 obj << -/D [3415 0 R /XYZ 85.039 665.087 null] +6653 0 obj << +/D [6650 0 R /XYZ 85.039 736.911 null] >> endobj -3421 0 obj << -/D [3415 0 R /XYZ 85.039 634.003 null] +2826 0 obj << +/D [6650 0 R /XYZ 85.039 682.614 null] >> endobj -3422 0 obj << -/D [3415 0 R /XYZ 85.039 455.971 null] +6655 0 obj << +/D [6650 0 R /XYZ 85.039 651.089 null] >> endobj -3423 0 obj << -/D [3415 0 R /XYZ 85.039 300.691 null] +2830 0 obj << +/D [6650 0 R /XYZ 85.039 486.277 null] >> endobj -3424 0 obj << -/D [3415 0 R /XYZ 85.039 194.759 null] +6656 0 obj << +/D [6650 0 R /XYZ 85.039 456.872 null] >> endobj -3414 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R /F41 2104 0 R /F38 2158 0 R >> +6649 0 obj << +/Font << /F64 3112 0 R /F20 2865 0 R /F15 2876 0 R /F56 2890 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3427 0 obj << -/Length 410 +6659 0 obj << +/Length 411 /Filter /FlateDecode >> stream -xÚ¥RMOÂ@½ï¯Øc{踳_Ý=$øm¢Ðá IÔøïe‹iÒÎì¼Î¼÷v z;Byž;åž0Á+ª\1\#× ¬ ¥‹‚]ZÉQ€ž/+HQv“æuã±hµÓL)•ÈÒ,Ï]R\·âI'ŤñpÑ™&p‹òfšarwjEÚ+nY«ØšiÐV…©o¬Û¼$b·L€òŽR,½ç¦£Õ:¯Y‡=m»Äšæñ¯#Ú² "C^šcR#sEmüÖI5 JÛ]«I»Ñ>é,ÇuMz­MFýñ´ŠñrdÏÞõpAÂÏ÷…g›qrŠŽD0t:hŽÜJ{†õË`»L–£aôÿ9•ŽH½.‰À -1·4›î³A |ÈhN<œW<í«“Ó~MÝ¿¡ý˜¢•~šÑŸ–?+1«ÉúV‘×#…óÙ€ÞõŠÖdqÀÇ@##Ÿ3³€CwÝ7ZžYoÀEÿÃRøîžÊ­Í¶×ß<Ñ»¥”Õ¿…~RÔÈÔendstream +xÚ}R=sÛ0 Ýý+8’ƒP‚€ø±6IÓvÈõ®ÚÚj$GºØ’Ï‘ÿI‰JêÖÎiA<ཅŽ +_‚¦ œG ïÅã~£ÅSÌÜo0#¸$(™ãùB²X³…5 Ù]ÄdŽÂabL˜ÕæÃ'£…Ñ`-‰j+ a‹ªù!Yƒ*ÊRËÛ‡ïª ëd=4Ëáö³*PÞ|K‘•7ãðS#?ŽõÔù?õM«~U_7wÕ«˜¬Å ŒåjQrô®k]ôË{AŽîì™—84aõ‚É ù¤ÓUm¹ê]ú7ÌL¥@ A‡3zãÁ97ÓW]ÿ¢ +œ|TÆË®>L +e›”Ó½•Mß,‡A%u x_?'x»D}¾íe‚œÆ%šºX°v?¶»¹iý2ÿ¢c&#¿LKëuØÕ‰eh3åvÌ"¦.Sbúô{—;£ìVµ¹"ñÔsfcÚ¦—¸ {ÜÆ'@ô&ˆceô«}A¬;Åp?7’Å ®¬ƒ4œ/ãêR^‘ÿ¯„45k³$‘<ÿKX’‡ÒÓuÆ?ÆÂÏÐendstream endobj -3426 0 obj << +6658 0 obj << /Type /Page -/Contents 3427 0 R -/Resources 3425 0 R +/Contents 6659 0 R +/Resources 6657 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3387 0 R -/Annots [ 3430 0 R ] +/Parent 6623 0 R >> endobj -3430 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [212.407 723.034 369.551 734.724] -/Subtype /Link -/A << /S /GoTo /D (problems) >> +6660 0 obj << +/D [6658 0 R /XYZ 85.039 781.388 null] >> endobj -3428 0 obj << -/D [3426 0 R /XYZ 85.039 781.388 null] +2834 0 obj << +/D [6658 0 R /XYZ 85.039 761.463 null] >> endobj -1242 0 obj << -/D [3426 0 R /XYZ 85.039 761.463 null] +3065 0 obj << +/D [6658 0 R /XYZ 85.039 667.044 null] >> endobj -3429 0 obj << -/D [3426 0 R /XYZ 85.039 736.911 null] +2838 0 obj << +/D [6658 0 R /XYZ 85.039 667.044 null] >> endobj -3425 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R >> +6661 0 obj << +/D [6658 0 R /XYZ 85.039 642.326 null] +>> endobj +6657 0 obj << +/Font << /F20 2865 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3433 0 obj << -/Length 2894 +6664 0 obj << +/Length 2760 /Filter /FlateDecode >> stream -xÚÍÉŽã¸õÞ_Q·’¶J©mnÓÛ`‚éN0]I#Èä Û*[i-ŽDwuùø¼”¼NäP&ùÉ·/”º‹àOÝåIéâ.ËU¨óünݾŠî¶ùé• “è01Æ€K]¦q™ìNœ…q¦ï–± ‹ˆ0Þ<¾zøGwq¦©¾{|"ÌÇÍß‚8Ë$‰‚»²Y¨àe¬»íb©Ó4(»ÅRžŒ=B¿ 0 F˜•íª\üýñpß•Ò‘û…Ž‚¡_ᆠ-ha0"â«÷#žÊ<,bs‹ÃÙÆó¡’;ÁJ1çãqW p™6qPò@-pçÁ /ýaBÖHQ52FÿÄ°ÝSð᥅QÝwr žòm‘€Hê¦\¨‘jÂPÝÉÝpFË#wt {èø-Ï›z´ãk'Á¯ðä·÷£“¢BÝÄPÙ‰ä7ýd¬- X*[Z¤N¨<“÷,k挟1Ÿ#/YO¤9ô­`?פudy'«cÙ.à dµ”SQ £j\;X– Pǧ‘œmI|òißp…F¡¾\`pË|ñäUǼáû%\vÀãÏF&´ajl«®ÀViò0>¾aÛãÆz-ø#žu +;Æ/ˆ\ =ÒøLx¬¡ðª‘š$L“â–‘ª$Ì•š;›2¡6鉳)ÒX¼s·–Û®-S ò´  \7·}&Ìn«0?¿é1ìØfL”‘lM”zÀµ™QEâ± &#pËÑb3òÈã’:É`¶Û¯Û2lѼ¨#ÅÅzä{?Sd™™íH‡5OlôÅ‚¿.r°Š#‚¿ŸÛÙwêB³ÐØK4¸¼t?yz3õ8X1W$Þ= -I(ÙÌ. -ƒŽâÆ)˜T‰;÷tXµv*za„çù$Œî7ÕêÀòÁM5¹Â=/;ìg\ß‘­³iŸ3MwçY0$J¤(Ù -¹ÏóI0nEp„¾'ƒ¬\èp/#ö_£ÌÕ%¶“¥2Û÷»(¼3Œ ƒ¶„2£Ìîïé8çÒIÍ—.rT)ÇF²\d]çS€,ŠSËä]Nä O×^*±¤ãeû…Ž–ñÿü%‘½t"—‡Æ‚âÃØ*`g4mU‘L$ðŸp -AŒ´E\ŽÏ(j’ÝfÄ»(’9§§ƒ:çÇŽmºBñ§8höxé¡á9çbe -Ì°NÁ7ˆ Âå³T‘Ûâ/ñ•ÆÁºo÷5åÇTT€Îœ«’—N3ž“”ó'üð!Ig‘JkfP+q¼Ú®1ä¨4Xn÷(ªé4Ô‰`þ©¤ä`ÅCõE‘IóqGÁøy®Ñ¿žEkçtQ¢Iչɘ¤tVWËÉXÖø×»¢sË¡®äRòÄ*›†s¯¿à˜žÐ Žµ¥Ë`8ßnVWüÝD"8`Ç令±ÔYNµ¸üÀ?‡daz*%8ŒèOP¹üÜ1J?lªA®Ž†ù…·:Áé.‘tóâ LsÉ2vTøýôˆ¿(Oäðuôu\y–aÐ}GˈÛJÞyy·ø’?€N' x[~•è|¼³Ûï:g)ëY…›ÿ48À8·þs¦Övh–ec—›ª©,ù‘(mØÁ¶ýä91V{h@ÏœNµb@ *p–2mùÎ+ì¾ñT-ˆR¢¿®¸ªc8†©Rƾ°/G‹‚M Óx±/Dõ\Ø369Ù#1ùÌè¡ŽýG/%$NØ– מ=çs0%”ž1¸&´‚_2ðþ—±|O< _íã"×࣭6ïH$ã=è&ËÓàÑåS_¯2wèÞÖ¯½¾ävŽ]}Åltô§òxdl2YB¶ââ@/YÐk·cÃ8öœTDBˆxGVÝ4|{}Ň”ráyP8çr?øt°ö&£41Å™8Sa+?´s€oCpâõŽp—åêÜw/¸\ûÑ„*B\*ˆž/ß‘ÜöqM‚K(ù &%"£æ,×£YHfÆu,<ûKZ®%ZIEl9dãP(å …¶.Áj -»ŠZ¢^³Rz–Q¼3Ù -Ë*•yg§-kæDÉìRå®Vûù=Îs"ŸH.Fö¢ ‰ŠT½Av\/Ÿ%œç®ƒÂü픋I0žw -nèuÕµ*ä3·ŸPÂøj z:p"ÆãNËC -ýfä•É߬Æײ qÛ‚2Ù‚/vÛN{)|³€~,3ñ¥FJA9‘Ê µPF]h¡ Âe§ç&¡I®¼Ý (™y±-³B:wCÙ²œþÅRµ|µ)ŒÃD¥ÿ_ÜÌ}‘+«ÚÙ»Ï.À×òþ}xàÒL‡¹ÉåÀ§ µŸ£á]eWÔÑI£ß•ÎÔÜûÁèCçüâüZe¡JbW}^¸wG14ý`Úq&‘‘ -kdz™€±håô(†ž“™9 £TB*ì³ë½e ¥{^¬Ùet–^{˜ˆkRNÔ'QhòØLjEÀ°Œ_º¡Í©ŒL󇇇ççgî°ÀZI·{¹èÈûÖë¡û'ËQ(EØý,ød(ð{œ¢/ÛT¡Òj®Ñ3ÍBÑž¿×ë©¢8ë7´ ‹ÓÒýþ çýlendstream -endobj -3432 0 obj << +xÚµZ[oœH~ϯhÍËÐÒRC]}%NœËN&‘íÈíìî&n”6ôÒt<Ù_¿çÔ¥Át™j-ZEŠ8>Îwnu(ºHà]d’$<_¤%<Ë«‡É⮼}A­„œH!à·çbì®ÆŠ‘D¤^ûŒ8¥9Ⴂ̫›¿\²dÁ¢_Ü|]Pʧl¡rA‹›õ?#AÉ2–2‰.—œF‡¶[Æ4Ú”í2æ*®–4*÷Í¡]•ûå¿n>¼xss|¦}¤SæA•,bÆ OÙ$d•R’(6„L¼„zl@Yî kÐ"n—<‰Ê»=À¬ºç!Ú›=(XJXÊ'b¢û¶Ô¤À Éx¤¹£ˆr»>áJaÑ¡†‰™„¼ªò3©RÐùpàÊ +…ÈêuÍek„ÊO׉áäݧ%SÑí X𓇠+°Ϲ‡‰×|¯lÌ"jt¸˜ÿOˆ`,9$³‰—Žiª ïUg2^"2` +…˜èuÍeb„ÊÏÄ0ñ‹«3š‘»¦C»qý†V£ÿë|Ñ‹J}ÑòÓ¶\ëÎà¤]ã ´iùÔkÇ4‡"|ÓHΡ_Qa…BTôºæR1Bå§b€ÊZšcS½[ËDóuܸùˋ⡆÷ÝÿÒ@»!Ø”m !€~ŽŸ:à2<㾬Pˆ¯^×\¾F¨ü| Pùú‚V«@©Vèð…±¢áòi·íò/ÙQXsf\†³Ýo%´ )t Ø°£T{ÂX +FLØ”ub¦aç–D4`Ì +…ëuÍel„ÊÏØÕ³¾)Ñ×÷¦©^Ÿ®~/;Ý#4­.÷æž(‘Ýû&´i7Í13®½ëXø)ÿO!)dNr`o˜1‡ôªè™= È9a™œfØ èšÉð•—á!ª/û#£È+lX˜¸üŒf}}á Cª CPâ^Ö@Ⱥ-Mó÷ªh»-N84‘ÝI Šœ¤)›²FÌ8TÀ3‘‚>À5Í +1ÔëšËЕŸ¡ªÏ¯/±CK"èÆ÷NðkþÕ1È2Ýà¸H·èÍáN[yïâ ­}VÜ›û´x‰×W›ºú÷ÁžPÓjS캲õE(ô‚¹r¯­žkÁMqbñ÷^¼jjH¿Ld†ïµž"~ЋÉÔ¨²í +êÓe;z=W<üŒî—H ++†²° Nñè<ÕZ³†„Çn¿š àÁ(vgJ +êªjó— ó÷]ƒoÚîÍÑŸ‰Lvxân[9e½º7ºÀŒ‚Hû”×æõ ópjÊþ§iAú¢ Ž=HR +þ¸P=h¦ü‰º‘<ÏÎtkɈâ© +¹u¯k®[PùÝz€êZ›|­ù3f×ê5龬»â8 m̤Ô×Á1’{§kÆ´#æŒõ¡“†4xÇ´ûÓN•O\›C¯@Ïd Ld™ +±ÖëšËÚ•Ÿµª÷u×öECgõ„*ÝèV`ЙëºÂ\]á$ñ®ŠR’ùjÈÇF—üº¹;à fÈ,¾-¥Œ + Ö¢[sFõc[u]Y›•ýû¡Àù^Q—&k`°’“>!§D[MØ8æù¹³<Á$‘<0ËsB!â{]s‰¡ò?@5Ñ Rf;Aø ž 5í7w¢:·ÿ£¹$u dU–ó£+0 Ý´vÆ,Ã0¶É>fidÛ?-í¢Íæ(vÒbÞf¸\¯ö¦¹ç::ñéЩ Ž•¾£4îSìvý³ô ˶“9S@šù¨«È[GÆú`E÷ÚFÊêÒ‚ ÐÂòèð—õýâ¾øOU—§^ŠŸ Á»ÅÏ8~'MÒ³fX{D`¡beÞÙkšéœ#H^ß@õ­Œ$,û—9rmø)ôǶ¨ÿlpÐ¥È;ÚT)I£Ícǃœ}FÏ,P©ý†ó¶-µCÔ§ŸpR’P:a p+õæÌÅ%~ÊòÀLÓ …HëuÍem„ÊOÛ•iAmÑøc™ª¨´eÂÄ«]˜iθ”Œ§•\êà¯S¥ç̵O¡i ™ +™¸×5×Ä#T~PBãå’Iv섺«VúrWš¤¬¥Þ.ÍwÈNÅÏæ‰oó„¤ ›zɘьðs}[BÀåQ— +¾×5×ð#T~ÃPiK¿÷wfyfZ§•^ ™†©q pÓ˜Bš:Ž-Ÿ8¹‚…q*§Þ+¦p©3çŠ\à·åPò·B!c÷ºæ{„ÊoìªÛû¬XíM®¸x VÔã×+BÍLáí'ÇyNÎÜ÷€þ¯òÀÈ …LØëškÂ*¿ ¨n/o1ìqÊ Ñçb¿lL]›³Åjcj¦À.Úž}×àtG0íæ9÷o…åfÀÐíÍéßôùßÍÁG7÷­‹{=͉!ÌÜ£—éUçÛïw“œ¹>QSO¥ùÔ›ŽÎI † «¶ÑMT +ö?êkøã¶\ß—nDeÖ'NëÀœf NSBÅ3-ô +YŠy¿-LîÇbøùa0¦óîÇb#iÊÝ~,f÷c]•[È×k³yì°Ã·ÖE§· )…=Jl›8ÒVÁwo¾vÏìÜb°šÉ31¹s‹ê%“À$47,Д8¡@ tÍ „1*o Q½Ñ™zSÔº0Ëâ›z¥¿†ïŽó´Æt{ú*ºUÓzwés¹4uhÙY¹ -ܸ¡UžîÑb„)6e ½G+?s%Š[P²4ÐÓ8¡C½®¹ Pù ºÅm +ά?;»ê-U[·ckS´Ãçñ›“Þõ`‚åä «€º©¦^ ŠŒ(yfa`"hdœPÈÚ½®¹Ö¡ò[{€ê‰µ¿O£[Xßß÷«ªÝþhw×¼W_œÍu^=µ»{q9õŠzÃË•M¬t:³‚ýÓÐNWüVžKê2+·™õ•\%Qóí¹®î^ÿ^\ªpGÄ“«ÏB…ò;Üãõ¤Ä%œ(¸hD&ÏäÉ`™cá‹£žñÿ ª'¬endstream +endobj +6663 0 obj << /Type /Page -/Contents 3433 0 R -/Resources 3431 0 R +/Contents 6664 0 R +/Resources 6662 0 R /MediaBox [0 0 595.276 841.89] -/Parent 3439 0 R -/Annots [ 3436 0 R 3437 0 R ] +/Parent 6696 0 R +/Annots [ 6667 0 R 6668 0 R 6669 0 R 6670 0 R 6671 0 R 6672 0 R 6673 0 R 6674 0 R 6675 0 R 6676 0 R 6677 0 R 6678 0 R 6679 0 R 6680 0 R 6681 0 R 6682 0 R 6683 0 R 6684 0 R 6685 0 R 6686 0 R 6687 0 R 6688 0 R 6689 0 R 6690 0 R 6692 0 R 6693 0 R 6694 0 R ] >> endobj -3436 0 obj << +6667 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [389.071 266.298 509.276 279.199] -/Subtype/Link/A<> +/Rect [138.589 625.659 402.992 637.349] +/Subtype/Link/A<> >> endobj -3437 0 obj << +6668 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [137.104 239.199 260.036 252.101] -/Subtype/Link/A<> +/Rect [138.589 612.11 385.241 623.8] +/Subtype/Link/A<> >> endobj -3434 0 obj << -/D [3432 0 R /XYZ 85.039 781.388 null] +6669 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 598.561 357.484 610.25] +/Subtype/Link/A<> >> endobj -1246 0 obj << -/D [3432 0 R /XYZ 85.039 761.463 null] +6670 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 585.012 328.405 596.701] +/Subtype/Link/A<> >> endobj -2164 0 obj << -/D [3432 0 R /XYZ 85.039 642.137 null] +6671 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 571.463 370.677 583.152] +/Subtype/Link/A<> >> endobj -1250 0 obj << -/D [3432 0 R /XYZ 85.039 586.947 null] +6672 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 557.913 289.975 569.603] +/Subtype/Link/A<> >> endobj -3435 0 obj << -/D [3432 0 R /XYZ 85.039 557.543 null] +6673 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 543.758 309.786 556.66] +/Subtype/Link/A<> >> endobj -1254 0 obj << -/D [3432 0 R /XYZ 85.039 131.639 null] +6674 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 530.815 358.538 542.504] +/Subtype/Link/A<> >> endobj -3438 0 obj << -/D [3432 0 R /XYZ 85.039 84.97 null] +6675 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 517.266 379.598 528.955] +/Subtype/Link/A<> >> endobj -3431 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F56 1642 0 R /F41 2104 0 R >> -/ProcSet [ /PDF /Text ] +6676 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 503.717 460.925 515.406] +/Subtype/Link/A<> >> endobj -3442 0 obj << -/Length 2826 -/Filter /FlateDecode ->> -stream -xÚíZ[oÛ8~ϯð>‘‹†©û¼¥IÛÉ4i»µ»ƒbv[‰…Ê–GR&íËþö=7Ê’-§YXd±ƒ1ER也‡Ò#þô(”ë%£(ÖÊ‹ãÑ|uäŽnaäÍ‘–îÈWnàÐËÙÑäuhFÚU‰›Œf74e¶øÍ9ûùôÃìÕÇñ‰çyŽ‰Õø$ŠbçôÝéå8öÏÓ‹woxìôÝ97¦ï/ÇZkçíÐt¬Ó«—§øä;àéãØDÎ{h¼Ÿhçò´®¦ãßg¿½šuè;ñ•zHàG¿ýîŽÀÃ/G®ò’xtmWé$­ŽüÀSïÉsq4=ú{» -ù#~k@ '¾ •‰ á¹*ŽýV:ˆìði§\Ãoè;Wù¼*ëò¦áÇ_—|½€ÿ%2y_s÷»þ0 b+«/u“69/áᢠØÀ‹œÙ^ÌxꦢENLìÌQLY]ó@½,ï -[ðÒ×0%²/Õù*/ÒŠGnp -åŠÂÔ(ˆ„¸(ÙG;0Õóç¶Éª»r|m]ã@è”7š(h€kÐ RŠgbÒézÁ +6\p_“¬£ˆ21'"/ ê.Ö(ì&‡©ß@h®v¾!i(4ß5"4ì^gDî‚Ÿš’Çs”%É…7ñcÐiˆª¾pïUÉ;9Л3Ò WYð"¾‹œŽeãœÞfk\£9ægä‘6Gý`ˆ¹:é²%RŸf•XÚ‚ï·û¡8¥•f>¥íø}”¨ÈÕCÞªC– M륾ðÒº:Ú]6P~ /î.ŠCAgÍAÏS6B÷´²Óªá§±¯¬iH·5wHÿYÉB„‘ª{ø€=é:+z+ÞÐ’ÑPoí˜GòÌçYéÓ)k‡Oð%güèði qšyt³ïPǃ¸¢`”“áâsk¸0§yX«¥é&¯ùaÃaƒãzwNÆmÑß -uk¼E虼_[’&,x<ûš×² ) hòÚëŠÍh€‰µXxϦŸ§³WWß¿Ÿ=ãÉ=½…±ŠL$s‡V³Ê#ÿV7ÙÊ3ëøŠuüu;NÈb`ÏïPþ=jž‹:¼8"ÄØÍYÏù]ÝwË)B´$tfì0 hÈÿ$ê;õ5é m*¯l„Cð•SÌŽ«|)­ù—]V/ˆÖ4µì¼I«±Ù€]ï=úúFÆï—#–¼û\<=µ ;ÙG ±Îs®J«oØí9ç——ÇŒ²ÀëѤ{hæÆé %È:_ßî‡Q$ÏK%£»‰›.Pœ+ÜWy±E`VëBäñCáožnš»*«YZô€œº–&&b|³k.n ¸ZPtÚéØÜƘ’4AbB®ònÓG]¶e(•_ŠDðꯔë0„Y”ù‚Zˆ ñ=ŒU‹¹o eóC­‡%ǘ I]Èßr8C#]’¤;èò$|ÃaqáA,MñoE¦ íʸÁ_ˆñ/ĸ‡»çŽ%»P-m -¾Eãý -þ¿BÁn¶9}è´¿{ïÄef³BB$B"²vƒÃw¶ªa Xi¹Á§oød¶8F÷YðYs_eyrÆ *Ôï:ÎÊOí<Ã>œJ@°[±†„&÷±œ>Œ [q††F›G&ìÃÐà[ðX¢ž«ç‚ “@¹a×PO àâ=‰ HfÈÉT44Añdã¿*•Ç‚!” -ð.ðdЦmhïãžËõ2hԙ܉–cMV­òúD –©0Œz0¤Î©ôèù!ãd¿‹v sÑVW2kÃ…RúŸ§è\ø’Ô>iŠ,@O‹8o2¬LÅf[¥Ä™‚¥`V7á&¸í*_†¯€ÑŽëà^vÜ.)Z -Í,ùZd/ìJ]RŠŸøîW N% ?w:Úš)—Ww‹‰²~[d ƒA8Ý6Ú Ä¶Elþ œÔV©ŠØ“|åß–æˆh†÷·Ð7´‡ˆe¸›žaÔî‹:(¥Pöð"½k£Ø!¸ÚFÁ„ -Á˜Ò9dÖ܇´šÂ0.|Žm¢e๩ë)ÐÙ#ãDºXåCneକ<6Ø€dúç€7Tâ?~9° `O£Q{’–Y•1Ó¹$åÇÊZ›4y’•Ö¸]Ƚ¸Ó‚{îs8+ÎÎ(®n€´†íï˜*vfª|¯èÝmÑÂ󹺌¿Û¥L«;œœßp_'èþUŽÒ™á†B±Æ¾j׶ô,mr¥ Kþ]ÈAÎÒ“ó <Ä)Á,œ;ö–«ÝOj+Fíé‰á æÛs±u'Aûx+ðéà 4Ädب=áÙ×´ÉÀ˜ú »ÉÄÊÃò†Ÿ8ŸêìæŽ9t>}¼<ªÐ[¸ç>´¯]ó´ àÏåJ´„×ZtLJWh ×¢›òÂî¦I¢t`ì®ØSÝÊÐÇ7lÆù AÄ÷ÓdRãF„NЩ*«ÛÝ]b>Jôx;¼¶ÜªPΘôeŠûµiiko+{§WUöHÔúM*[¯‚‡¿íëÛ1=Ix¡Ž£cØ+  bγ?³¢Ü¬²u3HC_Å¡¤ ¾Z˜ÛºÈmb²)ÓµYN÷L(D”P©jy¶â€ ½ý‰\o¯ÿ8H†ZJÉׂ˜°l÷a‘­l ‹¸»®K©œåÍŽÜru"YÃf²ÊÒöX˜œ²Ù6r„´ÈÙÛ—j;÷@lë–tšÃ§G/àí?µúƒµ–«f{"3)›†OWiž/ºá¹ÎÉåQ™$R9ž¥œŸñC{…Ïu{öä¼”CYÚì2e ìSÝ÷‡BÒýý=[ŽÅ/¨ž5cßQ+&E{ q÷uR·1Ì"x&¤$·6¥b[±Ùìª\Ç>DUmß|dÐÛ]%Öt z’u˜Ó¢á;˜[,¸{Æ1ÊU‘ÕµÔ¢ŠUYwª[¤ý…õ\™´HåôOoÔ½àŽ_ÓœŸ‰¯Ÿ‹áÈ/ÓõڢĹ-Mp½=Ûl‹!ûF¨5pøá=°qeÿ¶-7àÑhÏ:£Bˆ½vµ²Ñk -Ž$"{-§À™(ÂòK¦²ÅÚpz×K²»Té(y´¨0¿§ÑÛÒÆ4Ó9`’ ø§½ Ì GÛ£k6ò> >> endobj -3445 0 obj << +6678 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [237.74 247.707 322.248 260.609] -/Subtype/Link/A<> +/Rect [138.589 476.618 512.306 488.308] +/Subtype/Link/A<> >> endobj -3446 0 obj << +6679 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [376.679 189.127 512.306 202.029] -/Subtype/Link/A<> +/Rect [138.589 462.463 512.306 475.365] +/Subtype/Link/A<> >> endobj -3447 0 obj << +6680 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [138.589 178.305 194.521 187.873] -/Subtype/Link/A<> +/Rect [138.589 449.52 356.69 461.209] +/Subtype/Link/A<> >> endobj -3448 0 obj << +6681 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [231.213 139.513 412.479 152.415] -/Subtype/Link/A<> +/Rect [138.589 435.365 492.684 448.266] +/Subtype/Link/A<> >> endobj -3449 0 obj << +6682 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [291.316 117.3 419.307 129.293] -/Subtype/Link/A<> +/Rect [138.589 422.421 512.306 434.111] +/Subtype/Link/A<> >> endobj -3450 0 obj << +6683 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [247.013 94.482 434.521 107.383] -/Subtype/Link/A<> +/Rect [138.589 408.872 420.309 420.562] +/Subtype/Link/A<> >> endobj -3451 0 obj << +6684 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [288.68 71.966 504.006 84.868] -/Subtype/Link/A<> +/Rect [138.589 395.323 388.007 407.012] +/Subtype/Link/A<> >> endobj -3443 0 obj << -/D [3441 0 R /XYZ 85.039 781.388 null] +6685 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 381.774 236.368 393.463] +/Subtype/Link/A<> >> endobj -1258 0 obj << -/D [3441 0 R /XYZ 85.039 291.595 null] +6686 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 368.225 331.698 379.914] +/Subtype/Link/A<> >> endobj -3444 0 obj << -/D [3441 0 R /XYZ 85.039 264.98 null] +6687 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 356.797 264.271 366.365] +/Subtype/Link/A<> >> endobj -3440 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F41 2104 0 R /F35 1632 0 R /F20 1617 0 R /F65 2099 0 R >> -/ProcSet [ /PDF /Text ] +6688 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 343.247 212.708 352.816] +/Subtype/Link/A<> >> endobj -3454 0 obj << -/Length 3364 -/Filter /FlateDecode ->> -stream -xÚÕZ[Û6~Ÿ_á}Š¼ˆ5¢DÝò²˜&mš¢Mf3ƒ.Š¶[¶µ‘%G’ëýõ{n¤iYÉ´»X ÅcŠ<¼žËw©fü©YûA”ÏÒLùQ–Í–»«`¶–×WJ(‚™öƒ$Ʀ¯î¯®¿I™ -ü<Èg÷k"¹_ýì½üöæöþë÷óEE^˜ùóEšfÞÍÛ›ïç™ö~º{óö5·Ý¼}Å…»wßÏ•RÞ¶én®¼›¾ºÁ/íÝÂ×ûy˜zï ðÕ|¡¼ï¿†Òwó_ï¿»úúÞYßBû:‰p¯~þ5˜­`ß]~”g³#”_åùlw¥ãÈu$ßõÕÝÕßí(ܦgÜk‚ C±P¹Ÿ‡ñM˜úað'Î-ÇBhÓ~¤—cÀ$ lŠuî½ÆÝ•ÃP5Ø{’xÛkjØî+Roݵ;. ؆…´U]ÁwK©CÕý˜C ³®ÐOóÏ­;T~ Çk֭≓¾ß–]ÉGTØÿ4ó0󰈞ÛÃæõh'p»–ƒ.„@™ž]YC¹â»-øæmá8CÓ:Ž)¯åÖ¡o7Ls_§)”i«XÕm¤íýkÞZ4µµí0ì_\_÷Åî¡ðÛn38W~%f\fá§õœ×·¬«%òåŽ6[D©ò•BAiʉ²m€Uqæ="]{èø«=÷ŠÎ”ú›roWuX× -eѬ¸0l ¥ŒÈ“§09}ÂD°ˆëoâÄY¯‚m…q,«¾;ìQæBÎôgûÓ©%†ü©©3ž:Ÿž:C´3ƒTÀ¼ až¢HÐæQ,˜s VBœ‹© H -) -ý'qÉ"ùêiõT¸ÜB’øŠñyø8öÃ$;;—oÐv!“#z§S¨Z<œž:«¬…h°V(•Ôˆ6M¤½à–{2wд’dy¬² -ØjXüDgÿ¥(GŸÄyz“xC³A¹¾Ϧtä'iv.Ù¦1òÓP”éÓÂþfàÍ ýIÔ¡§ËQÇ&”('p\V¸]£)ÀF’ªbàQþX!ךgÒ´§qÛ^>?J¶h9Ú¦çÚg§H4°Š,Qg³ c¡)[gêËd‘hµ¡ÇÃÚ5CwÜjp¶I;([»M2 ™ðÍ%~#6Ñn?ÌvxT%ƒíˆuÔЛҚ@¶¯MynhÙY˜50ñ¾.‹^:¶½Øgåý† 0š~붮IÁ¹F5æíÞ. èÓ°þg<¤¶þ*Š[3`³E¼=g\ Ð^½dòþ°ç`wJÀñÏ¥%oYà+4nÕÀBŸæìZ3FÄÇL¹šœÏ¡Ãš»Ÿô>Z”¦Å5Páâøü­’ÂË︰üŒf˜WÜμ4<¡ÇmÙL ˆºèå¨(Ø– -àêžUBÐ>s`Qñÿv`÷s„ŽbqŒi!ÃV|0H&Œ -Û -g¡m ŠÒŒÓ -oU®ñ`ÃÄ«ÛAl&[?0 ¤AjO=PUœÀqåì?Wf¾³˜¡wÏŽ#˜M‰î0§*†e0=G©ñ[ëÖ¸Ð(yó(³°—í Þ`ƒ!éÊbÅ¥¿ V½W€žC¥¨n/Ÿ[2l»š¿Êfyòüîâ.Ш„[#ùü%ˆƒêç†ìô ‘ÝÞ.™ -ËAâç¶ÛÉ’Údj/ö­þ-°…¥Z,œÙ,@ýÉ ²+HvÆÉqC+ˆ›ÊBLrÁQƒ´4èÞ×#'ªyöæ%hà#cÇo[ʱ¬%@A£Ô,ÚF P#.™¢È0ØDwêøÉ¢6£T(’XâÃGmiO~Ï–°d€ûª™‚}>[ÔNbR»°Ü´æLðåöÄLÚäå&_X*æ'vä[RÉvU›-!b¬Â eY˜¿"%î yH›DcÌÄ5—ÑT¤ý$0¤u»áÑÅéÔ6•uG«|I#Ö²š‚VåÃAÜNŸ Œ$‚˜†ETú±æjL•R²:c që&‰ªà°T|ž—ɉÜÚµRJ/Ìa)Öe„¹Ñ ÊÑçNJèLøߪˆ XÀÀå #”M{€€2YlßXkÆ£JÃCù/鋸䌢4×—Â:ÒÖ'œõ—ÙåÞ’Êñ.Р?Ôðá'¡˜ar&PIÎцhW¥ÇpÉfooej(¹“M¸;2@;tÅRZq-\ZSÞnÇœ -Pçi—Æؾ´É-1º²j/Fo"ÓŽò lÑÌÖÆêüwrov¼¿ú/onÍ@J×R]VdX×®öÖž(©®Îcã…¼¡6°^“ÛÁŒ”&µ´gÆ6_ú%Øz˜‹SìPðÏŠƒ·åaWš˜ « 2!Uÿ40Bh0.9ľ/Iô,«8›6z -nüd’ÇæÊFy2¨Ý“/#€µ²ÙïÖô6éã[O¡ç#“€féi" Cí@üÁͽi',±ÇéŠùR Íe ¸º£‹^üüCqå®_à‹¯½y|Ö’Ž8\ØB\þœS‚+¹¿Æ¡·å£ NŽ,-ä]ðR– ³Æ9C»¹Eª ÍòZ|“V§C\OìÔdO@¤:EÚÅ`dŠ¿)3ÖI - Éãß.T.Ö0x¿¹Ÿ}k b?SêÉ7±¼‘ø–62ñCˆ–)ƒ‚…–³”ø~‚.~ù¡DBgÍ,cìÿ÷û0xé œ;3ëÎ?sIÂÍØ$Ní©ËŠIøñ– -¦ìÏÞO`ÍiLˆ"ü¥Ž¯™é‚^ÖÄÎ -¢2;y˜bi.œ¥1]"óqaø¶[²¥ó -8CN R5 Ü×'êñ=túýÍП¾óžäÏÍåäúd¸ßóŽXRXµ ¯?œïÙI?ÂWS‚M·©y-†‹T®k…†cMf´aªÐW£kcça‡$r._WD¹ôù»Üù'uäêìQ;HÊ'w_sàçôkíçyvùš žûšƒ*8%T9O7ðÎ…ø!:Z!>ˆÈ“È>Úœxï:^XØŽÓ h¼˜Â²¼ÔtÃKPé Ïþ°ˆáÛ§ñs£À¢i$°È}*{pà‡Sú' Ý-6îÆyWª•[í<`ÐYdò8ø¢ÿ`œõˆÞ ü˜0FÏñ-?™\ÓÑ0º.¬øç¡—å>8€q1ñðÐ ‡Ö×9)>‹ýÌ›3xŒw»èV{‹Õˆ{éÞ¯îLÜfíé;eÍuÈ"o òhoF ,mÍåò(µéû>ÁÚ‹w™¯²~ã,œ~Py’‡ÿáÁbaöûd+ .Öé"_³Àÿ,ødendstream -endobj -3453 0 obj << -/Type /Page -/Contents 3454 0 R -/Resources 3452 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3439 0 R -/Annots [ 3457 0 R 3458 0 R 3460 0 R 3461 0 R ] +6689 0 obj << +/Type /Annot +/Border[0 0 0]/H/I/C[0 1 1] +/Rect [138.589 327.577 512.306 339.267] +/Subtype/Link/A<> >> endobj -3457 0 obj << +6690 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [390.793 722.731 484.421 734.724] -/Subtype/Link/A<> +/Rect [138.589 314.028 253.915 325.717] +/Subtype/Link/A<> >> endobj -3458 0 obj << +6692 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [335.18 682.084 480.851 694.076] -/Subtype/Link/A<> +/Rect [138.589 255.304 403.258 266.993] +/Subtype/Link/A<> >> endobj -3460 0 obj << +6693 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [218.97 105.796 325.417 118.698] -/Subtype/Link/A<> +/Rect [138.589 241.754 305.962 253.444] +/Subtype/Link/A<> >> endobj -3461 0 obj << +6694 0 obj << /Type /Annot /Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 81.425 133.339 90.993] -/Subtype/Link/A<> +/Rect [138.589 228.205 343.331 239.895] +/Subtype/Link/A<> >> endobj -3455 0 obj << -/D [3453 0 R /XYZ 85.039 781.388 null] +6665 0 obj << +/D [6663 0 R /XYZ 85.039 781.388 null] >> endobj -1262 0 obj << -/D [3453 0 R /XYZ 85.039 761.463 null] +2842 0 obj << +/D [6663 0 R /XYZ 85.039 761.463 null] >> endobj -3456 0 obj << -/D [3453 0 R /XYZ 85.039 736.911 null] +3066 0 obj << +/D [6663 0 R /XYZ 85.039 671.062 null] >> endobj -1266 0 obj << -/D [3453 0 R /XYZ 85.039 163.232 null] +2846 0 obj << +/D [6663 0 R /XYZ 85.039 671.062 null] >> endobj -3459 0 obj << -/D [3453 0 R /XYZ 85.039 133.828 null] +6666 0 obj << +/D [6663 0 R /XYZ 85.039 642.326 null] >> endobj -3452 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R /F41 2104 0 R /F65 2099 0 R >> +2850 0 obj << +/D [6663 0 R /XYZ 85.039 298.585 null] +>> endobj +6691 0 obj << +/D [6663 0 R /XYZ 85.039 269.181 null] +>> endobj +2854 0 obj << +/D [6663 0 R /XYZ 85.039 212.762 null] +>> endobj +6695 0 obj << +/D [6663 0 R /XYZ 85.039 186.147 null] +>> endobj +6662 0 obj << +/Font << /F20 2865 0 R /F14 2895 0 R /F66 3242 0 R /F15 2876 0 R >> /ProcSet [ /PDF /Text ] >> endobj -3464 0 obj << -/Length 2671 +6697 0 obj << +/Type /Encoding +/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/alpha/beta/gamma/delta/epsilon1/zeta/eta/theta/iota/kappa/lambda/mu/nu/xi/pi/rho/sigma/tau/upsilon/phi/chi/psi/omega/epsilon/theta1/pi1/rho1/sigma1/phi1/arrowlefttophalf/arrowleftbothalf/arrowrighttophalf/arrowrightbothalf/arrowhookleft/arrowhookright/triangleright/triangleleft/zerooldstyle/oneoldstyle/twooldstyle/threeoldstyle/fouroldstyle/fiveoldstyle/sixoldstyle/sevenoldstyle/eightoldstyle/nineoldstyle/period/comma/less/slash/greater/star/partialdiff/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/flat/natural/sharp/slurbelow/slurabove/lscript/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/dotlessi/dotlessj/weierstrass/vector/tie/psi 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/alpha/beta/gamma/delta/epsilon1/zeta/eta/theta/iota/kappa/lambda/mu/nu/xi/pi/rho/sigma/tau/upsilon/phi/chi/psi/tie 197/.notdef] +>> endobj +5446 0 obj << +/Length1 794 +/Length2 1135 +/Length3 532 +/Length 1714 +/Filter /FlateDecode +>> +stream +xÚíRkTT×Ê# PALyÄ’£a Ì †ÇP”ç /%ÊðæÞ 3÷wî0ÃS–@DÅP4 E:“¬X‹(: hJáQJ£AÅôueU¶¿ºzÏŸ»÷ÙçûöÙç³ÛÁsö…°$˜‹¡„3“Æäÿðð`?&€Á ØÙùã°€@04@@ÀÀôôt!r1`¹†;‡íÊYLš‰#É)p𧮋ܯÆ¡á"–5„1àaB&2iÀW,ÖOÈÀXã0D£0™B„H‚“”B_7ŒŠ0à¾ICré«­ —‘¦€Ã†M* MB*Î,¢Ð÷ad7˜ôòß°õzq®\,Þ'¬—ߌê @‚ˆ3ÿ%Á$R9ã ƒ`}] oºóÃÄoô &bDè‹&‹aàÌt¥1\7yDÆE”0 ˆeð£Ðë>Èø6\Ðý‚üB‚ö:½zÚÝ‚‘™R0~–o`æϘ G” –Ac0˜¤\¯þâ^ëˆ +1A“‹í8.ȤCD"6Èf…`%€•¤e: Åò ƒÉ" §¬¿«ÐÅ°L¶În,@O^Ÿ=2¼uîÍ»ùùaÊlg&8³Ød+Ó ¸³¹ÿ.<ˆ"ér88°î.ž¬ V(Çq%6†ŠÌí!dÔ0¬„…”Ñû˜Ð«0õì4å~zç²U¶½ª±ðvG‘ªÊ‹6ÿ­×Ö{ø—ƒ‘°Íc³"³TäŠiåBh ±Ç­¾ðÍéÍæÑ‹FÌzM¶Q/Tó …óüx¾Úž®-’óÅß¾ûôK§Å?Û.=ÊèÐû,l–é~Ñj¡D·éÁýµ'yiG4ã£Fç Û©JJ\íÂ*ਙGe·Vÿ„}Š6ôYð«—Ì_ŽZu=Nû‹I•ç‰Úp­Ð‰ëL©ÝÓÙqnßÄTµÓ`È`þE‰ò­Ü¿Ž—ÝýGÅÛO5'·ŽÀ×ÿJµ/fës˜]Âð‰ƒ<ÊåÖö÷¸iŠ²Ê‘ÉŸ([[Þ~šè½`}ôÉû懶¹˜Y”åß4%Œ|¶—WÚoº²ûÖàbÜÔžîÕÖŠ£'£Ë>Üå³XòÕƒŽ äeþ,¿;"±¼TãÓØi\m3êqI +:šÙNò„¥w'‚‹qƒ¦@Ý-Qé))ˆ™_vûøQeOoMÞ¬Öí07h%#Ë—L&ÿ* 1Á‘4é«zR¤c3GbC,Щléxo‰oèm©™x'áÚöÔ’ÏOé-t¬ }ýõ‰ÝBÅUÇ”¢Ì{Ëo­4 îº9ù‰ý.Sô¬ù´‡">‚4Éûâºø³—*/Åè÷Íë«vLpÈ7oîém?ÛäõN®"ðv{¬aÅ‘ˆ­¥jÛ†Ãý©YŽÚå nSeT›Ñojûþ;î4½ëý–Ô—C"gým! «I¥1Yûëb-j­ó¼lU +x­3ÒÞÚäz“êGÅ»ùCË—Guö¦t›´ð—ÆÓG$¼¶i¢ +-Õ^^<Ûnwñ8þ¬%è@½h\ÙÕæ è¶9_©…6íà cZÒóP?G¼û‡ü¢¹¹kÚ6µì?u„Æ%žPÕÊðæƒÑ—tf'»tËÎŽ;mtå̾cš~n?Þ¨V;Ãrÿ Oµô˜×u×T“_O~ä\éúQ5<\m«;scË‘³ößÌQùéìèýýü‰bÓõs{­Ú-‰wN{_*Ñ-ÿ¦¾äÚÕŸ ,‚äˆÂ Í5ÕeWT…Õ0wz…'7ü©QãíÁ;3øØ¥ÀxM<`øÌ)^ç¢jªª~hŠ¸‘çSû÷ÖW#x :DËY§;u_é›ôÖÉÕƒ3üAÏ ldi&kzBwïiÓÃ[û–v&öáÒîšÉêö‡ž÷Äñ3Uô¡­ œ*/ >žåõ½ŠgçÌ6KdÙsƒézý}1¼ûÞ]&Ìo6ç›K_,:X-$”ïxÜ’¾;<5ær›»õä;#駬¯p†ŠUÍôd/õAÎç±ù3m9·ôÌ©åÔÖ‘;*->åù‡¢øÌÞrrùãí×0÷Ë÷ +£¿óèZÃOÝ[úec½Úqg«±w„ÃmOWcfQ½ScøKµËäÜxMdLCÚIµW““ÁôpèýC1¿ø],‰zE.Jó±2x»îù± t+êAÄÊ”ëù´Õq³Àb†•Êø?Êÿ üOŠaN`žFù'þÜendstream +endobj +5447 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 6697 0 R +/FirstChar 60 +/LastChar 62 +/Widths 6698 0 R +/BaseFont /BGBJGH+CMMIB10 +/FontDescriptor 5445 0 R +>> endobj +5445 0 obj << +/Ascent 694 +/CapHeight 686 +/Descent -194 +/FontName /BGBJGH+CMMIB10 +/ItalicAngle -14 +/StemV 113 +/XHeight 444 +/FontBBox [-15 -250 1216 750] +/Flags 4 +/CharSet (/less/greater) +/FontFile 5446 0 R +>> endobj +6698 0 obj +[894 0 894 ] +endobj +6699 0 obj << +/Type /Encoding +/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] +>> endobj +5170 0 obj << +/Length1 800 +/Length2 1394 +/Length3 532 +/Length 1980 +/Filter /FlateDecode +>> +stream +xÚíR{ß +™‘Ç3ú … |ÉŸ<"ÃBà‚ñ`!úmëVxΚ ÌCÂB¾eÅáÚ |Pç Dä€DÂ<7DÌ þ_Ïâ0ÊûÖÛ¬ÓõNΞŽÎ«f·9K¹A*v—þ):Ó;[ÓþUãÙ‘HàM¥P©4¼¿~mÿf”=ÊÅxŠ_†9€„BHBÀï^1@4 (Žp$î×”‚bbüÀ#‰þ˜0³ÌÕT`*€„0ʇýÅ3ÔJû[ÞW_Ÿ)4[ýõw×­Ã"£Mè,`bÆÀ Péæ€É Æü{£Š„†ÁŽv€A¥R™,³Y”&Ä'‰gïå×ÚÁƒ‡áH˜KxÒq-cƒŽ—Çì¶?ó PÎHf]Àõd×Ò[m5ŠºRdøùMΡF½%žER5¥~¹~ƒˆ/DÑ¡ê]›Z†÷…&ŸhŸî÷ë—FU=ßK]$¿ +–}>0¨\UþøÃCfã£Þæ‚t¯³õÙ#wO¹Ú¹¿^ô”4ï¶wøµÛY±æLO)ß#þ`É÷tGåDhAÂêøž•ôÔ=­vÅËW¬êŪÖLœ‘ÏK›öù¬‘¤Ê­6 s^©s^[ ]8¯¢|õ;—­³@Àf!è—ûEžÓäx G-îrv”Ž½ïÃÍûö .áÃÆ•Õž¤)²ùöÞüW¾ôU¾gºÎQGRÏ`Åå’VÏŸ§Ú~Õ›jS¯ÔñóÐè\ùÜ!ËM¹Ê3Öd›{«ß’­iãŒ,;td©¦ yS‹n@‹"‘ÔÛn&»»<~uIJ@ª^—±o¼§ïÙ£ÀÀ°šE¾Z´›÷Jõ-É  +Ü=K¥¬ëšt¯mÏüÒÆã˜Q GN•‘[rÏÛLËéµ;™Ýhñ¸ØÃU•Ú +ÆÌŒ›‡²jÏ/o¶ÖøâT@x#PïU³0.h]œ8 ý6%åUY¹ˆô)ºRÍŸ–%}°Yºœ ¨cÝÛ—>ߨ”èsÒSúVÁY!l*v`Þ]œö¦G5Ú5z}lZ¥~>ë¶Êï´(¼ê8Y¢3ï¢QæI’Ýö—š{H]å…¥Hã~hm~ÙЖõÁ[Vké7XNwo‘ Ü·¤oÄ,œû²—j¼Œ¶’˜‡Ý/”unNÝÿ<èœæóm“ÓXe¯ë½eÿ^åhe™à¤[뛓T¹¤ù-³8ÛxíVæ +ñŒ ‡ï_ESï5PMSÔ;~;ri£7q*ë8[›Hÿ»%KK£X}´ù-#Ýhèñ<×àaf²ÿ”d7&R¸®’êÚÊ#áüšÔzè½ÀêJŸ?‡™6r¸éHáÈjÿ^éX´=öR¦"}µ“5+ôcâÔXWÇž¼Š÷y]±c·¤Û„jÚ•ªÝyg¼dãE¶uÑuü¥Ë7¯0ÑGÛ¿ä«Þ IwëÇ_ߊFí6W¾‚êXd]éM\ÝùRƒ±1!xÇÒckhÍ䃒גÕ~X°¼¢s:í‹ðtžƒqÒB£+ûQyŒ1úÓû¸r™O§HFu:û5|+!b¼åöɨ2× &AôJaQwoÛÊ6ý•ü €’ïÞ8:@w2T~<¦Ð´·0ÒdíçÓ/Ø~æÅKW8ï`e<éÛ_~Ž©Xõ¬òðŽ¢W땘OoíêÏQÝÃÌ3ˆ/Mt¸7='#¥î]7«½,¦éÚ]íë·JˆO9¶¯¨7ý#’ï$™k/½Øv\.?é ÷Þ'”ßÆüœ­“ÙŒ WØ=Ÿ$ïR¦Ò}}úwô»•I$Owz_´O®Ñ +›ÜóöÇM׶)Pæe®1üÔQÑ}´Š ^˜kW?˜›Nò[«ýäAÑé{ó-ÎPªvÖ“M°½Jýn°Yû—Àû :5îqT6©YŒëx¯7«É™÷ÚÿáÁ±&´|”m\ãÔ‹àÚ€IèaóìëOÊ™É7¾›h`Ö¦ä<¦­s7j‰Â®g²GÓ#['ÙƒA!Ïúä[Ùê›7)o ŽÉœïܾÃýÜtJ«ÓÁr±†øØ#k³²ýTq,IëÜ£éoO÷ µ?¦ÿœû:o fÿ…Np.é]ÒqªÞê¢ÅË= +WüPÖ–Jœ“ Ø`Ù8;Å¿Ã3ìSón×ü…4«¸'Ç«7P}4Ôê´ÌÙ0xS~׶§Rï V­2MBʪŽóÐÕòÕîvŬÝø’Gúþ¯ :¹BwX/ù²Ei­ô»ðêÉBêøþ/ð?!ÀåÃPŒ…@Â`Â?ã6Ðendstream +endobj +5171 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 6699 0 R +/FirstChar 40 +/LastChar 97 +/Widths 6700 0 R +/BaseFont /GJKXIK+CMR9 +/FontDescriptor 5169 0 R +>> endobj +5169 0 obj << +/Ascent 694 +/CapHeight 683 +/Descent -194 +/FontName /GJKXIK+CMR9 +/ItalicAngle 0 +/StemV 74 +/XHeight 431 +/FontBBox [-39 -250 1036 750] +/Flags 4 +/CharSet (/parenleft/parenright/a) +/FontFile 5170 0 R +>> endobj +6700 0 obj +[400 400 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 514 ] +endobj +6701 0 obj << +/Type /Encoding +/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/exclam/quotedbl/numbersign/sterling/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/dieresis/visiblespace 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/dieresis 197/.notdef] +>> endobj +5127 0 obj << +/Length1 966 +/Length2 3059 +/Length3 532 +/Length 3719 +/Filter /FlateDecode +>> +stream +xÚí“w<•ÿßÇí™ÉH]2"9Ã̈ì=2Cë8çàâ Î9ä ŒPÙ{Ï"¢"„¤“)’ŒdDTdïõ;ÕýýÕÝïÏûþë~Ü×õÏõ|^ï÷çu½ßŸ„¨¥µ¬ +ïŒÖÇãH²p\Ð13²±Ã8Æ&!¡C@#H §‹ ¡U¸Š +Ðòvà'¸²ªÂIUEªÐÁ{’  « Ò‘þ!R´°hˆDà3É ¥Ö@"0€5 ¢Id …ÁV?2ˆ€šˆ&ø Q68@HàŒvqlЖŒp.x@ùWåíùÏ’š@¤š¤¨&¥ªE‡!(´ ÔOÝ Muò¿aêïâúÞŒ9û£ü¯6ý‡1äÿ’౞Þ$40ãÐÜßR{ô/wfhèý{Õˆ„À€H-œ+ È 0…_q¨ú¢Q– éÞèŸa4õ·j÷~Ú€[ØXZÙËü3ן«–G²!{¢ØoùO†ÿfj— /àƒÀ`pªúþóuþ¯ÝôpH< +ĹrŠJ‚@@Ù¨'ˆJŠ€?q(´/€ö¥:†Bpx5 væ +à‚'°ý«‚õ¤ÎúÿR D ‚èöïu€PÄo: @“ +Eþ›à0EýpŠþå¨ËHÍÅþFj‹ ¸?š‹ÿ©¹ž "ÕåHýÒOüÏahkã}ý©Õdåäå%%@IEéÊ—Ùâ@/o´‘. ƒÁ”•U~F‘ÞGúy¨cþ‡]@êÁ@£}ÑH¶>ªñô¿¶A^äãvK¹’fMÊ (ÅQÁj­€VkhX?w+Ÿtnš5óòÛ¹ tmÙ-ÍœØ̈©#žeæÅVF|ï›~+ç ÎÞd¸û¾ogéªGà«Ñ})(±É$¶óÙOLÑvÓ#1›3ø|ü@aÛÁsi+¼»‚ÍÃ=8RU"³ÍhÌ.û¢ü7C„‰c ¬qcOSIœ·K &R¬Ûø28#ÇÕñò2MÊêáW˜Loîñ«^ºÿf·ý.$Y%ùÜù1ÈC–ÄKf¢GPçÍyå9£ª?Ù ÛÕ¼¡à‘aŠ^bEΗÉ<*…•2Ô:t–ëø%}…¬4ûӪ½֩3S2|þ^J‚ô$— fi®£ëòtëâfPNÞ }\ðhÕ(Û’­3›_üRƒQ+›kS %d‘QØ +ÅX«"¬s:o†K~îxã-?bìªC^­D÷ðݳnˆ‹Õ½.÷è kaZ G#CÒøÖsï(0¢ÔÒµ«ÕINØ>m,ý&|ÖãXêeÅzUñyÍRÝÌŠò´#®/=ø…ÛÛÆ Xñ§eC2μ†6­yÔ[9ð²×µ†ë;Ý Ó¶¥›Š÷‹å†*ƒ›]u„ù=õðýû¬,¹#æÛw{ÑØÀ$b¡«¤ŠuãÈËž1l(o]S jç\üœCÒò yÆ·³ mÝŸç+§Ò˜è"FÜ «ŒÈ×ÝÞK„jŽ$–¹ð}Zx0KΩ»ò{—¸j±'<ýñÜ{C[¯’W¦Ô0¶®òh£©±°—Ï’Fnš^°°××›k +ÌKló’±g›wÉVêyÞ¦°€.Fl‡×º¸Þ­ŽÒ¬ôàÁÁÚý—㲜æWè¸ôCŒ¶xAý#:sA0iž{Ün7Œùãî9<­×æ»W¸ÍD)u¸˜¹Š™üÚÔuÌgßÉgɃûUÝ:ÖD?=Ç1&_zQœ“ÃÅgã[JQ¿4ë™Æn\•ôäQ§Ž¼ˆãÐ+ ?7&æe—ÜW"¾Ý¼7’<ßè¹­»±vG1½¶ö62£&¾•¹«½È’ø¨¤ž <¨Ý@–*ZãÌwI3ugtÉa…'rxÖR˜Ûµ\í§¹œÒIB\KË$µ¨®Š%M—:>Æâèp4W…+ÃÁ}7, ÷ÜB×!RË !Ùe}µ•&ZÈ°ŒGRY3/í×u˜çv¥‘12 uת”D‡w+ zÄú"‘ü»OQf¦luØîÍ¦Ø ½Ž£¢q‘öij¾7Ïr·X®Ý +“7¿õ!·€³Ü×H§ëãMã¸xŠ“¼'MÓ:6zðj§ã/rv+&òdöp™}øms÷™Ç‡ø[2Ö¢3dˆFÕ2r}[÷™ôLF—6½7,‹<F-°oÚ‡øäƒV¯rŠÓr¿½#¿ÓfþŽ UíS",9ë}œ´X>Üí}ƒ¢½ IÁЇVu{jj>;†YX¦mè­'ÖzQt ú×_#Ží0)‘ÒŠô$6´[vr&Ø;‡ã< 2‘לLš˜"MD7üU3}ßá¬?'ØÍOí¸¥¸7š¹ŠíRXQ$ŒC5žŠµÍÄžþÄâÛªƒ+ +6¸Õ×) +[ªQöwøtµŸö]AÌ×Ù¤L +ßÁN­ÖˆÍRI|ÖkV±mÅt LŒoÔÈÌ-X;45êÑÓÖþ¾¼]G4wN.`jB܉%ál€±x)1½ùKËÛÇï[ g-?5Ó1Og°ë¶^OTµ¦×]³œD”㉓ù‹z_N±9Û2\Òë!äñ6KÞ‘]ýâÀ%1 :èÑ–¿óéQ¹ûD0M5îLB4ÏÅø72Øõ/ºßt=a¹>þP%uaOåcïó”8‡ÐÝñð'Î*Zã­*Žü>zM›ºe#/P$]ÉOnœ) ¾oô<Ö¼â=vYª¥þKñÄsî¡ò‚ÔÕ\Û‡ãwÖÑ*Ûcׄ¡D$×mo2‘âÙ[6"úhg† ›*7óbêÅGW\uq|. ý”Â=“­îøÞ‚ôÍËyýõ2‹aAÈ•=ìþìá1·ªhîÉ Ðe»›êܦN*áRŠÌ»î1ë ©Ž ªº3¾C¶ØØ[YAÒ:J6vö;x¿]°Š²©4¾ïfK´ +ÉÜc·˜gñ¾ÀÚU’ßrðCçÓD[¹BaåäJ7P»LwóúªÐY¸ ?W2/ÍñˆW giÈÞ\гè¨q$>ß)êŒü’¶_¼<[ŽÃð™8±£~ØòÑc™k,®ß–V3Ú®Ÿ†uÉ°:ÒðZæ‰R†œ¼Æ€)-ô&É¥¬t•8ýl³oˆˆÅƒïÇ_›>Øu¬ ß×d¼(Yxx¾JȆÿÐRNI6ŒÞ9NŒJAßβÔ>Mº /Þ½yErdfÜkgUaý™ÉÝ2íMlî¿5…§÷lDßAz>"¤Àí ó’ +óæ‡"ÏÜ«Kë^Öì 7>’cíÙ+«LÞpOLÑð +xýõ¢r‹1o#×ÜŽw¤ +K>·é˜$+ä-7¿cÎÀâ`ÍHO‘ÃWõW_ÚoÂ7¬7bõ,è»ã'¦É4”¾H¢Ñæ‹x%ôìeÙʤx~d‰ò„¢Ê€ýVVHâwŸ®EéYÕŠ+vM±JM‰é< ¦ÚæU¾×Îs4“kVMFd“kª2XQi®¥Ùþz8ï..¸Ö@Ò{L·nª¬Hfrh¼–À}Lãy\5{ Þvu5~d·ã¯g”¸ì1¥’S¥{Τµîa«H ˃~¬ñ¤·k‰GëA¨œZ'eŸ¨ßQH ú‰VÕGqYîéä•Ïc¢Iâó€1ù›SyG¶!y=Y5|VPÃ-Ÿ%ë=ú°n’#ÞéþKš”шx{äðç +é/ö™ê|ÎM+õQŽh¿8Ø´š]„±õÁ•ïb¶ +á׳û„ñ ÕåO*<i#í†êê·%”¿Èê‘UÌ]U/¨ÿ:×ß/uâz¾:8x·ŒKïh/÷!`Çê–ž™¢y@FOû]ž'+@àÜOª>Öþ([ý­LìR/{²s©”o¸ïØ WfµáˆdýÕ]Ïx‘’ú´2˜*÷Þ1û„®€o¢:Ö…~2|Ó•RºòƒJ#·cð×>L>ˆíJqbæ™A˜$äÛM÷·Ø{ª„Š¹_§±¯¸ašÙÁk“¸¼Á¥ï™¤ÌaðyÑêÛÀ‡! áĵ]öƙﱤ:¥Á½DgôDÒî†V]î *÷™|Ï®¡ýü§× +Æ73,W’ëMuÃßž÷ +¢-ÊË:õÈ.ë“]^|yEùãÚÉ6p`wõ´Õ·£HŠo Ó˜#]µý"œóÞPL?â”øƒÜ[þd¢³y·žÆ¤*FèEñõÉûu mx‡yè!·Š…ïÖŽÒ”yæ¤_)™PÑ~V±ä£.Paƒo¢û‚²úš’ÐŽñ¨ñï÷%G_ÝGßPηÒÒ5ˆ:> endobj +5126 0 obj << +/Ascent 611 +/CapHeight 611 +/Descent -222 +/FontName /JOTPRW+CMITT10 +/ItalicAngle -14 +/StemV 69 +/XHeight 431 +/FontBBox [11 -233 669 696] +/Flags 4 +/CharSet (/period/slash/a/b/c/d/e/f/m/n/o/p/s/t) +/FontFile 5127 0 R +>> endobj +6702 0 obj +[525 525 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 525 525 525 525 525 525 0 0 0 0 0 0 525 525 525 525 0 0 525 525 ] +endobj +6703 0 obj << +/Type /Encoding +/Differences [ 0 /minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/arrowright/arrowup/arrowdown/arrowboth/arrownortheast/arrowsoutheast/similarequal/arrowdblleft/arrowdblright/arrowdblup/arrowdbldown/arrowdblboth/arrownorthwest/arrowsouthwest/proportional/prime/infinity/element/owner/triangle/triangleinv/negationslash/mapsto/universal/existential/logicalnot/emptyset/Rfractur/Ifractur/latticetop/perpendicular/aleph/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/union/intersection/unionmulti/logicaland/logicalor/turnstileleft/turnstileright/floorleft/floorright/ceilingleft/ceilingright/braceleft/braceright/angbracketleft/angbracketright/bar/bardbl/arrowbothv/arrowdblbothv/backslash/wreathproduct/radical/coproduct/nabla/integral/unionsq/intersectionsq/subsetsqequal/supersetsqequal/section/dagger/daggerdbl/paragraph/club/diamond/heart/spade/arrowleft 129/.notdef 160/space/minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus 171/.notdef 173/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/spade 197/.notdef] +>> endobj +4585 0 obj << +/Length1 779 +/Length2 1014 +/Length3 532 +/Length 1585 +/Filter /FlateDecode +>> +stream +xÚí’{XLiÇki0¡yÊ%²ö CJÍ¥Ë4ºÈSS)¥ÒmMsÞ™N9§Îœ˜Q ‰)%—\JXPrkØ´êqÙ.„Ìn¨µ5VYT–iOÙÏòçî_ûì9ç÷÷û}ßßïs¾ï˶ ²uCˆèEà”-ÏŽç<ü܃–ó¸€gÇå2ÙlŠ)”À=Åt<¡|’0À·|ž ýñœ™làA$¨HTK+Ù"p“C•ˆqà'¦b¡œî!c ˆ RÙ7 Kv(ÀR¨€äJˆØ1y<€  +Ä@Š39LÞ¸”‚i$)a¨´’ + +X PÎ4#Bà˜ + PÊäøô0H£üTŸ7÷JÂ0±| ýG£¾ˆå(¦úKBÈ’(H?$þ¹4~¤s'°/æxSb •¸á2 [žƒ×ÞñcUx¡Jˆ ”$HŘæ!Ž|BÛ7ˆÁ õów[j3t²ƒÕ1ŠSÁª¸Ÿäƒ1ïSL»D¢JÁ¥]æÑBúZE}6m.!—¾£“¤XŤï9‚d@q*TÒÈ;œ è-€v&H ’9p®<š‹#–Ä+0±"v ÆüòoÜÝ e²-_l…ts{{>pæ;¦þ]¸ G“ ·'pär¹'þ`V’D’§¯íÔP,Eiw!TB óÁ=B2W·ûüÆ’5‹Šî7²6t—•gù—U5\6NoÞaˆ­%ZkÏ„½+Ýk6¶Ý¨ý›Uï-›/¥Þòz¹.1+¯Iß¾rEûÞÕ,Â^íõSµ%LëIï4¹x¾ñµÎÑpI½¶®dçòÃÕûºnt °ò þeD‹¥&båYM¾ÚIæµ[–±áÌL{Ë¥¬¼Ä’MW±vf|'}M\ÆÈ +›GÝÄ¥$ÓwE#äè#»×üa¢ÇP}ezf‹&Û•ëZ|+§gRTøˆJŽyÝ‚¦þ‡›çö„1,š}ªX†Go}“ö¦eüÙTÅÛÜežáõæÅ'•¼pŽ,´õê-âÖœ+^ÞÉ`Õl¯¾-L ŸÖ0<¯ªHàCÕ<ï¹êÆO(+=Îdh[šúôÇÿ?µ5<âˆÎQz¿IónuÝ7ÚnvÈFÛÔ7ÿqmùÁMq±õ¦&[.]sôº¤Èk|ª›h–i¹ÐW8¶ÂwÞ5ª~W]áÕ~×…Ó·SE×~/ÝaÁQŽòzýöõÇ#þ}Ëd.éL/ÈÄúÖ/œÀ‰ÃsWuÌ`\iíò”TÙ_»v÷œ¯ÌjØèÛN…·]%)/vZËÓ–·tÍ»§´iUYþ`q(<ò +?dßÚV/ÏV½éùA~Rs`q] ÿ¤²8uã#¡‰>B=EÈêgÕ˜>™?í½ºXƘù¼|–Á…ßö3^™š"š;¨^7d¦ŽÉ +fÅÕÜ,:t2²uì3}ãÅBëFn¨j}jJeN¶,çØ„qÁO«OĹœ*¾±(d{¤”³Âz/¤LÎ÷íìYrÙV®~óðÐiŸc7¡L™þh±Ié¶P¶† +¹<(g[àf× +·lt/°ÈºžKî‹×úÞ™qÅ`XÖý¼‡Š‹º‘ù“5ùs¤£»o錬öc§ºž9À§1©O¤ •Ål÷|Ñö6•ÕÌÔè+ÎÕWsú† ïÌÔšš¬sâœ+j JÙeóîºl+œˆ»ÝDb¢ÃŽF—„½´¹Ç¾*>ñI¶w‰<|ú.mìêÑ+*ç`rV/b=ë´àYÿ»õöå×!…Þaí_=&+>¯àfŸf]°\Ž´`uÝêþØ™óû[Ë}“_Ì|úS¡Ÿû$¿ú]µi•5!/{µç7Î3Þô¶½¼+dÊžÝõ]eïÒygD«ó¶?Ö§ÉgoPƒºx£ CVåÏòiç:"âƒ+;ç°ß›I~¹ÝÿbÏï|F‰¤[‹ÍŸLDÖ<ˆk­pþúE¶Ò¼â]i÷±¹),ŸjFùÛû¯¥×£\DNì¨Y¿N¯ÖÒD«{ÀŠªo“ëvtN]|=ÔúüÝ--S77$k­`ó¸Üø0ÿoðŸh Á ˜¤¹˜Œgþ E^\¼endstream +endobj +4586 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 6703 0 R +/FirstChar 110 +/LastChar 110 +/Widths 6704 0 R +/BaseFont /WWMNAR+CMBSY10 +/FontDescriptor 4584 0 R +>> endobj +4584 0 obj << +/Ascent 750 +/CapHeight 686 +/Descent -194 +/FontName /WWMNAR+CMBSY10 +/ItalicAngle -14 +/StemV 85 +/XHeight 444 +/FontBBox [-27 -940 1332 825] +/Flags 4 +/CharSet (/backslash) +/FontFile 4585 0 R +>> endobj +6704 0 obj +[575 ] +endobj +3991 0 obj << +/Length1 1354 +/Length2 5076 +/Length3 532 +/Length 5901 +/Filter /FlateDecode +>> +stream +xÚí”g<œ[»Æ%F”(ÑeA0£½w‰N”a£Ì(Ãè=ºè½›„¨!ˆ ZD ‘è-¢‹N$Q"™½ßwïx÷ùxΧó;Ï|yþ÷ºŸu]ëZk »¾€ e WE!ÑB !) ’Ž† P$àâRò€CÑRŠ†K…$%…€ +^@aÜ8DJDTJà*¡Ü|=Žh ïM ‚+ÜaEu hG¸+n;¨ Ðe‡€£}A@àý?¾ðÞ‡{Â=¼á0@HCØ¡¶pþÃ’Ò„ü« órûkÈîá‰3äÁ™äâ,ÂPH_ në¢pZpœ“ÿ Sÿœ\ÕËÅEêúÇôÿŠé¿5@].¾ÿnA¹ºy¡á@ îüg« ü_îtà0„—ë?G5ÐP„ÒÁþWá©ŠðÃôh;G =ÔÅþgŽ„ýÓ.»?M€Í ´îñýµ«ŽêCH´¡¯(ø»ýOú͸Œ<>@ A  ®÷ûëÍòj*H; Ä 1q ÔÃê À‰ý…€$ î„ûà,ƒAH÷ —K ÐåøcSq«Û#þ¨ý‰"’@°» +ÜŸùüU‚}ÝáÈß%q Ø ×†‚ý.A€`O¨§ãßq\Eé7IÁÊ¿ '¥ò7A`Õß$«ý&\§Þß$ëÔÿM"@°Áß„»!`[¨3í·ÿí_Räïú. w0ÁÐß„3hû›p²v“ Nv qRðKøGŽ—'èp Eqù]B\œˆKˆ‹Òéâ\¸\Bœ ×߈;G`ä%ÄÙ@]Bœ ·KˆÓõ¸„8]ÏKˆÓE_B\^—gÃûâl`~£0N×÷âÖ‹» íý¿ŠŠ(\ÜÂb¸ó)!b’ÿÙh„D¸{Á5”b‚‚‚ÿ¾1v^p$úÏ¿!œÄ_lÀ]N8Ün˜™DÙIG8e¾ˆ,RÁWñz²d—E¼kØ- Úž—¦÷hú`gûzýáu'D%UÆ®V5f/¶ÈøB! Ïßüpúz9-oqŽɾÝö+‚þÂÞ×”®ù1ë37WÝšøög9¼Û‰žio +AJwc ˧&} rZœ!Ë‚q¬e, [µÓáÆ Iƒ§;j(,jæI?ýƒœCšóÆןFçȳ%ã +u®LdËœ‘ +Í9–Sû[ê Þ†p5ªâ¡’ºtÚa&K¶»¯d‘Ú²»É*ã=õy?"±ãÃ]Ýúag˜¹·¶M>‹÷8¼xÅ}"ŸûÄqZ7¤…`^¸e~H‰¹b“"÷ƒ!#qÏ3È·gܹ`{Ÿ¹]•¬Î;5Ɤx´íú6”ÓÑËáPmiÉY·öMï«~bè[^ÒP‚È•ä½/¼köí¤÷½nT°b­Þ«5«Htq¹¥‘SnK¥rçIæ ñuãêºÇ³ž·‚aÖÞö¸UÎÒþ–e#&qOIÌL÷w ë§Qác2·ÝÇf~SÎ<â|Ä‚Æü÷ÆØ•,‡šd°þ âRµøaGKô` «¹†­=*ØŽñHRæ­|'e©]£9è[ZqEóÒ?Gùoò·Ô3Àü^§o È¥„ªŒe×Íìaoèõ¬SO>‰g«êçïx%¦8ª¾ÙX6—ˆDÞö|ýD¿§æ)'¨Âñl?I&â®tûk2rZy×ÂÙ«§GWqm…ùmE4gCŠýü’ßÏþ·UÎYòö» 2ÃTïMú|†‰Èn̺äïî‘Y 9’Û^JN6ˆlÞb‹-Ÿ*ÒñQ6â0•Y.å„Ìò„I¿¿ð/©L½˜xK¡Á]†/õÁsPúr’"1’„ûù¹™Õ未{H—¡ ÊLŒmÉ«Ý6æ .ºM¤Gm'¾(#y!Sì<ÿ©†#s BØ8sf¹ šs¦Jñ¥+šEgÌJ/C|våB>]j!”û kgå›óq•f›QLB­&BV¶eðºEwóª¹#oTqý°ë])i“\ÝÙö÷»X:êИӟ/œYÌ8ÒѾɤC!¾ŸAF¿\?x'Ï[Új¤é¹;S|ã0HÈDD"üAzsm»aq«ÙÒ¿V7άÝÕYÝôvZÉ–W<¾7ÈÓ€E‘–ÎÑ#ÃçÜ a3¼¶õâ“ú©¤[ö!¬ÿzéZ‹c°bÿ²u4S¢¬+Ép©ŸŽÛ$¤/¬”i.¢ÄªM5GÏŽ/LÄ‹îjéñKÕ=¿âðÕ£ïó0É·Íø"6öYùßÕEÉVJ¯±Z†êÉÆ/‰œGÇßý1ÎFW\»M\ƒ¥Ìx|NG&Tý8§Xb2QO}½³…8/–cl=Í=Hh,ˆÕu´ø®²J×hµs £Ì·‡F%ºÓî—Íl9CkEµ“DïI„hÄ8γœ.|‹äÝ":;)£;ì~ƒ ¦_ybl2ÆÎ!/“ØÀ{LXKRÓ ‰7"œíxê>QyW¶‹v!ɺ]:'û–ÑX¬ºÍÆëæ˜Naõ(§lŸ?è¡bô‘‰ü®öAw® Ï­õ´)ÂUÐ@ÑÕ¹trBæÝSÈÔ@æ,‡xˆÏ±1T{ø’è…ÇÏ(%K-b&ñB†vj=¿™Ô\RÜ’ïf-§ÒkqÑ;ÄUÍœÅSkì^MIÕßÍsƒ;׊òj®tÕ¬”¼OŤ„.”+ì7Ö«ÕÞ2a›iÈÅ™7Þj*¤ºqoÔ',›Œ‰ï[|_›`œîÂèÊ7ú%ÙáÉ + ®ˆ¶¸Mu‡ÒÕol|gÛ[ YãCª>‘|-áøñ¥ç“.Ý‹éùÁEï©V&¥Ÿo_Uql|NIk“YL¼’žív#t¤Yª'œøæüNfZGAÒAØ#θ›!î’áñsúRÃÎ^ç¶âït¢4ñ·—ÔGœ…ŸÕsµ3ÐÚJîøÙ ìYš}ؾž›‘v:Öòº°÷še ƒä1§Œn¹‰.r¾q§È<±þ¤/¼›*×ô½KöuÉ}¦{:¢}“Ñ|þ½e?«{€ãˆ9V¹wOkŒ Ó%µÂcC\E÷u>KLšo…ó¾Ê|ôÎ{gÌ0 FŒ]u ¸Íô+ëaëŒe[Åõ_\x™nßÁ3žŽóí™ô“KžE‚‰‘‹îv+v>§WK&‰íå1NúñÅé ñ«çŽ+(PÊHªî»b”%òÒ/Bý2V#Ò1˜€ÑÙ›ù%Ÿ»ç7©"bD1~4›“ÜbŸk(K:}QÖ> +áØaòá^¦Ïû‚Mð£fHXO˜í&ï PË^ó¶ÌÑΪfv9Ï)™»úy3í$2(òˆ©rAÄÚAëFÞ‰lŬñº+–­znmºYóU*»{ñm°féØyRêÿóY2G¾6IUìÐ2¯1.H:aŒõÄ©?þH™ë1½}­²¥ý±Dûë»òïcÏü,á¤ÝÏŸ/ÓRMyû¨©3K}1”·„º±óÀ»_¦)[¼’ †uu]ñˆbß™…ÖnlÅ¡Ú¿ˆQ½Ðr“, Z>(”…È{›UvÓœ:¡Í¤c*Mo*¢„\1ŒaõU¾ ûLbǦzP›=5Ÿ9JÁØXüqŽí§Û#üè£iDr5©$¼™0.¿k4X>íUðÓ·ß®Uê s:¼›ºA5“Ôv'óÙC]tø²Sœíq®9ˆÿ¼h÷ˆ^Xlò«…™Jw†ICbkÍ*”vWS9]œ›P/ ÒW£Ü+ž•hª*æK>”å¯X¼«þrœ%·S…éñDŒCc“Ü ç4†Ç39²ÙºƒU.Ø,¦’’>È„1\e‹'Ñðs + ïĪÛO}-DÜ3âÄæK½CFëÞÆc²ÂþRv› +¢õJëad>Ï]òÅ=D8¨qÓ˜wXü‘2Õz¢·nJèÎÀÒ{Sé°.RUfXž‰‹¶Ê÷ }9` §ß9ïöSaj»Â9“¨]´ïÙxá™ßkß½ûÔƒ¹Y¤>ç¯ÍN®Ú\I>·"*%†!ùߥ´ö~chuK„môQR|¿Ãtõ鱊 âa¹l‚^w¾ÂýÝk}+<•Eù»óÀ‹²Ž±Ï?°rQ_³cˆ–¼4)I¹ú튭ÀÖWåÄ>¼ªŽ9 +]¾Îª¨Ì+ÙÁW¶ír'ãc@#æ´œ×G¯iÇX‘u=qÿî ÆR…¤³ÅŽ ±°74C§ÁÜ w5ëù©óê#™R^ÕN×X'&\=ß {Ùz÷]1C(#°x­©a{ Ðò¶ŽÍÚŽ=Û¬ÑÎ8Úµ äßùÈ‘þËñKèZ‰ö¤~–¤FÓ =É÷7lÿnÏÜñý- éYnÒz ”Mª–ÑüNÆ;³U³õ Ô'~}¢ŽÃ•÷& ZÈÕe[)/ØYT¶Ì^Y5}:ÑƇu>+µR&p&ÇŒH|n1‘s„ÿ;° _6"y€OKÝ"U%,igŽq¤´¹øùm_8Lë{Í«J/ +H’›#'©ÇˆíÖ@ ˆÍÑ÷”“-ï5íÝUŸ#¨ÙÙ! ÷ÒaaºN9 ÒG±h“ž;#´b”WQ‹¼ayÔ>ñ jP5¬`›­+ž†§hŸÅ­×ˆðH½—ÿ!ùh•=&`#*à>ãIM“/Ío¬Œ Ü=ê}˜¨¢»ZhWx> +&‚øI~¼ÙDdV9œ¡´ÊFq¥zi@³½‘U¨€S¨G‘êþaÅâÌÉN½1½¿Û :e†ÌSE—Šé©Fç …§ÝçNï .ÔÕ3µ#ð#µ¬ø>o„óû|[~Æôþµ²ì•yÑÊXv²Èí¯´‹5O›§á&òæÓ +6¯$Ñ’Æ!¤Ú¶Á7fy–غ%ÀæFÙ‰o·bo\—Ðì bPÈÏ-)»ïòÉ´½ +Ò-¦nÍõèž: +=Ì °>6ȇÖ1Zí½d‰*Ÿ œrZ}cWõøf%­Ƭ˺ŒHeµzäezßÑ!Û„n/šä*Ù:¶†º~I{fÙ®Ña6_ÞË:‚{Ç7î#+9WMqŸ.ß>†Ü3 ϵg²s+¹Åé’™JÙ"\\óºó MpeÔ^D™d3ëíb¾Tü,ÎðSÀÃœ\¢ErdåÐV +‰W¶‹&u‚ÿÃðÿüŸ˜ÀÎõ@£\¡΀ÿê÷endstream +endobj +3992 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 6699 0 R +/FirstChar 12 +/LastChar 123 +/Widths 6705 0 R +/BaseFont /YTUKRU+CMSSI10 +/FontDescriptor 3990 0 R +>> endobj +3990 0 obj << +/Ascent 694 +/CapHeight 694 +/Descent -194 +/FontName /YTUKRU+CMSSI10 +/ItalicAngle -12 +/StemV 80 +/XHeight 444 +/FontBBox [-97 -250 1077 759] +/Flags 4 +/CharSet (/fi/quoteright/hyphen/period/slash/C/D/E/F/G/O/P/S/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/l/m/n/o/p/r/s/t/u/v/w/y/endash) +/FontFile 3991 0 R +>> endobj +6705 0 obj +[536 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 0 0 0 0 0 333 278 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 639 722 597 569 667 0 0 0 0 0 0 0 736 639 0 0 556 0 0 0 0 0 0 0 289 0 289 0 0 0 481 517 444 517 444 306 500 517 239 267 0 239 794 517 500 517 0 342 383 361 517 461 683 0 461 0 500 ] +endobj +3968 0 obj << +/Length1 2113 +/Length2 9913 +/Length3 532 +/Length 11050 +/Filter /FlateDecode +>> +stream +xÚí—UX\˶¨‘ Á=ÁšÜÝÝÝ5XC7® Hpw–@î4¸;Á-8÷§³öÞ‹¬}ï}ºßm^ú5fVÕ“¦¢PÕ`9˜‚¥ì]˜Ø˜ÙøJl¬6fVT** èbå`/ tóØøøØb®vè8??'*@ÂÁÑbeaé • ûijC¬Ì€ö% ‹%Ø:‡Ð á`fvñdˆÙÚÔ_á P;ƒ!n`3*deæ0[XÙ£²ü6’³7wðü+ ruüÏâ •ÐB%éPEƒ½­'6GeQv€ÖCMþoHý÷äÒ®¶¶Ê@»ßÓÿµJÿkhgeëùï ;GW0 äCìÿ;Uü/9%0ÈÊÕî¿Gå\€¶Vfbö¶`ë¿BVÎÒV`ª•‹™%Àhë þ+¶ý·táþR`QWÔSRgø÷Žþ5¨ +´²wÑôtü{ÚßÙ1ÛC×båxÃÊÌÊÊM„þýç›á“²7sYÙC7=Q¡gJ\€·l+{Øö€³0Û;¸@/@Å`îAý½¡Ð=g1ÿ+ö/d‡¢Õr@Ñö 9'? s@‡¡sÛížBÐ'W0ÈÔö_»ÿ÷7€ä`k „<…x,Ž`ˆØþ4¾OðÏ«9Y¡©@ØÞlþG”íßÑÿJ†z9Úº:? VfvvÀ§€ÅÒÓÑlÿâþËÆÊô‚ +:Û-Ÿ"¼/0Äá)õu°ÿÍ\PQ÷§q.¨¢‹%üGÆï5vp}Z®ß«låöGT׺ÿ3TÖìö‡+t¯YÀÿ¸g.¨ª½ÕŸ"¼¿ïÙÖá‹ø~OcgõÏ(7Tìä +|ÚfnŽß[vþÝwž‚P±'‚Ö"hm‰'‚–|"hQ©¿‰º:ÒO--óDÐu‘}"¨„ÜA«+<´ºâA«+=´ºòA««üM¼ÐêªO­®öDÐêêO­®ñDÐýÐ|"¨‹ÖA]´Ÿê¢óDPÝ'‚ºèýMÐFÎb +šÙ€]þq¤ù8þŽÿóPóqÿûÁøg:´àÓ©æƒ4}"hA³§‡—z÷ ?ð÷¾ÿ¿OåÕ°ø¡+`ùB—à.Á +U³þ¡N6 Tê +µzêlоÈbÿB­þ@¨•ãøûdþP+Èøû1ù¡V. ÔÊõ„Z¹ýP+÷?Ú ÔÊã„ZyþP+¯?ðw´ý§Müï—¸¸ƒÇ[&èƒÆÄm|Ð}ááâóùgž–½ô™““„6VV^èòÿŽš¹B ÍÍå¯×/´ÂØÜ +úVƒ=Àf¨s3fï­Sê‚‹|¥òǾ ÐÊ[ÔÇ*W·O¶<ük[0 àD¿\¥{[œŽ‹±…°Eîþ‹Ø9ü«·Ú°ô‘¿SlêôÖ›ÉVºW#±îiº’ç¦ã««À}Ì溩ó.X•‰åÁ¢D½ÝYÇ=û¹ª´’šÛH‹0oÜj:2ÞsóèJ§Ûj…UQsP¨c¥:…r†,¹c%Æ?[ ôµAn`X8qøêŠs›œ“ð`p…ƒmÖ2²…T÷0µSÓ?žÚÎëR»u}w1|Û²CXÖH!©—ÂÚ‰—¤ÕÉ\»²W*´ é5ûXõÀÍN¦YɧÕph ÒÇ'¤ä.Ëoøž‰‘α¹" í𶡳ïã¡âü£Ö/;á-ÔÓ‘¶Ž~{óøëfÿk¦à¦U‚RÓ_šÈŒÌú“²’ã™ z—Z±›Þ9˲/½8·ÓØ*ÕYñŽ¢é + ÒS8ãó×á“H¯N˜¾æõÔ|íŒB¬˜ˆ“[:PG‹iµ X_óÄ„©" e9yu„.SJL§¦´âýŒë2¯åÂ.Oû]ë_LÊ~’ž;Ò¡Y§o±ôÞ‹âÊù–\§j‚aULCÐàÝ›Áo[Öœâ>‚Jh4X´ þ7msÄ*çdüa¶Â{,lD!>¶h6n<&·ÜJ0ˆF$eYƒÚn‡´ÖÆÆû¥ ò +¢pßÉ ™®sŽþœ”/À…ä„œ¡Äöš,Ϧ;q8-ÄH²™,u‡;6Ô»ÜXS؉U¦º‡7ČӢ!R±Ñ‡[«Ú…Ü{î-‘f™üžcõ +B´ÇròØÆ´b£á¡4ÅÚÈ7ßÓÂEï„øsz­ì~¬GµÏì($²¹þâ}ì¢ÏDkÆ-BN‰LmÛ„W •Ådo\®ºs9ø<¬Bª-`ãÂÉ®GÈ”­ç½n +Éè¦`?ç{Õ¸Qÿ’µ$ÅL +XÅ„Ûuû€ŠÓ%õÂê•Í+ÞÒ¨ù4TeÆR…½ºÔ°ˆViJåš½Xœm’œä.6^þc¢Pp+w¼ˆ-æÌíx²AeµMÙzó{V‘øÑÚAo"ÆœU9³ëÝ&X=åל)¹.öh÷ßI¾‰‰ãØ8Í×aíëÕÛûâ·”ÑýÀ‹0v"5*Û +m¯zåÜN¬Òˆ&F¨øõe^ÅÇ7g]–³¹‡‡J1™]ꘄ¦\x;b§¤ß©€1TÞ|ØD¹<ó´NÚw/9²ŠnDTÜ°>w¹5‹Kõ>Øx|‘t‘}Ocê<™¹cÊîȹ9Ž`íO§B9C‘W¶°Ðäª^É/V½0áþ%WG\ÍÛÌÄå¸E¹ÆC¼’‡}—ƒŒýÓé}› + ä‡FP ×ÏMã:Cj ü4«Óž Ô…'§äs„å¸ëEhÃÉè²Æž™~4 +˜Î¶¬õe1nÀ½Æ÷˜|'áµañC2)&R{>cûû!ë\8ñO2†´ +** ÄûjD\¡B»4!koÃ[“q ;ã5v\µèõϨ0SwS“ÙLæ'Géd[Æ>®Ä¼‚}pl/Å!¯oó}ɳþÐÌ\–Âټ½‡zscV^vjÓôcU`HlEÒéHÇ¥œh®ÿKvóJÃ&›÷ú[ßžnìâYua™;u}¡ûùþ,$6ŒK‚¯µ[—è†Ë?à ¶b›èdÖgóñª]»ÊÈÝ^Ó¨mõœ}§•MQ7yÛ p<øªØÏ&ŒG—仲“ñ@¾¯'òýÜGÓI?ÔlØI}Ù4ø&@ã`½ðÊÅÒ¥çP©a:Ë7})ƒ°žŠ•¥‚áx;Ð@[|àÙævÐ;‰ÏyÇX€µ´À“%MÓýÄŸhÌD~-ìdTZÂɾ¯ánŒÕÏð‚´‘òYhöÓ=ÖrÚBE·ƒm»õr?ÆúLíc‡x$¾ˆVÎý¡oý]Û¢?Ë+œîŸoåFâ#Q®ðÌ·®H¦s uªÌ:+:Õs5<ˆµl·/.ˆBo¦I½Fƾﹸn¥¿W=nsHÏOÐØBÆAô¸‰Y¼•„µöNå>‡Û^뜒`éÐEP¢ENy†ó¦Án~Ï4µÆí£œ/7¹cúUp)[Ÿ÷åªcÛQ‘»Y@•;Ät9©ãã—èô‰æ>K™)NÏ‚ +;›Ê»q¶î”©·ŽÏªvmÂdãi,JŠyâ>©§9 ¶i[v3Êä×Ï„–´!Dâý¼áG92º…ä~þ*1NòE’…l°fy,Á¡P¼Œåce8  dÒ ‰V%¿ +äÕý’Kiß0FU12K´ó{® cû<ð~Á½Yo?Œ~•ÑY0Ï¡u‡ßËŽÔQÚɪž+Zšþš8XЬD=ÆoPj”åjØ'4ôž5*ŸËÛ@¨,\pÖZæ0I7Ž3͸5áyÓ®ïí„Ö¾—b*¼á8ŠYu,:_^à+Á³öJžã)¡¶‰*­xvÕTµbò9Q»À,¯Éû~±Ué¸Äëi ]ð{†ñ.’äi•Þ· «}2›Qj¯çÌ»wžzúzô.ªq¢‘Ì0ȸ³Ö™J|*Œ{h+ξfw»±o'ªq.Šã{ÑjuÏ/¬ûþ,cñíç&érR8d˜¥@?qé£M6–\ãm_g2Uá´¶VÚG`Bº¯gåÞèI"#Ô/|qS&Ô±§Žƒ—¼LwS³O*ì ›íqqÝyHÉ8ì¾7ˆŸ?ÂÈÓÁ#%s7”öš@ŸBxP¥8÷M)ŽaYr[_®ñ£1‘¯ŠYûOÚ^ª6V;·’^w-=´´ÆeL¯fν_’n0´†çqævò/G»eýªn 4V¸ù1M?šî%Þà ûw÷ ÎFN¤#ÏíÉw} ƒ7X:\€gØÿaæ»êz«âOóørôd»‰3ð£~=D”5ZÃ!Âd( ëëˆ"ÅbYޔΈþu]˜AºwAå´ñ?0« à=ë™ièp©¶Ÿ à‘îч]TÂá-7Ø7´Úq³'žß´åé‚Û1Ýëèj‘„G˜¸¤ Ï‹êÐ ldžÙðÑ«NÜiž7Í!‡Ü~cÜ:Ø}E&ªMGF2Õà‚×Wo›ðUϯ°³|Ø_(þx…êÒ0}ËÜžÛ½@û¤^Vs­jÖWææÀuTYPà¨wÀ>Œ¼V„3Ð0ßhãÝý½ï¦4–!­]½K2ø²â(‚Í6ò¦ Ô¨Ü{[²» ÐH1OÎ F¸ýi®£ó(7¨„7ä:jsIƒùƧ~LÝ@#ø"êX$Ùg‡wd5Éœ% ñ +G’ØÒÔE…îT5{Íí€Vî£|€©wØ|BKS3‹kKÐé:ë8Ëcê»×¨™/ÇAûÅ •|æSÄÒµÃë ‹¾½y;AîmÆœ3Ÿ¼–«+)>ùê&æ ìʲšHKú›0_ØÀ~t¼¹ lQ’t Y¢·àI'ÕË0yAaíÎJk +$ϤÄæëœËÊó9V¿[‹…ˆ>뤡Ó{1?Üü¤ Ú_}ô̹éÃ’µ]Ë~šér³íд{Ìtk“ÓkjÀïÇe¦’ÒÏõÈd^xà~Iàiy@ƒ{#¥"ÈÌÉ/øY…^¿D6zœžoy”?{Ìï+®H»÷‘ˆ` ÿý#<*©Æ"RÄ8­Õâ€\„‡…eÐËðj¸­@¬1–ÃEƒ|Û¾^Ü51‚ûçÏa(u§Ss¸èüûa†F¯Æiù=¦V„ß$Ñ@’’Ë°ðuÕî°}?*W;@èÿƒ¥‘g£@Í/rTY¶l`ϲ¼î+Ÿ%ÙÆ} Ó ñó™õã)8©}ërØ>ý’*iý]}#ᢣH©[‘¥"¨i‚±j—MrºJS ìSɟבiÁþ±$KØÁ>½± ntÊÆÓ-¯ø£Y<”`'^ƒ¼•¯`B æ¨?©ä_¤ßï›S?—P¿1?¥–÷ÇŽŠ—¶ª€¿£måÝè"é°Ài¶k–dFÎ` ™ÕÖžqï:?Z8¤4+}YäN4éEýˆMücyVYLfµ‘¦.l­—?/Z/öf›5JÉl2»`Ÿ€PÑÐB¥&n„¶Ñx#XjÞv—ëWψbš¾Š‚ŸÎƧ2úÑÒ‹¬¶sŠ½ÜÃ?ûû\ÙËeµ;Xø/!jì‰ÞG0ek ¹]ËMæ ¦ .à÷w[#ùsç4¸.é†Ý“ááé%‡»‡µ…H3Ðo}·DVý¡ïÞ_nªƒ g ¤¡¾áà|Õü:èVkgcmK×ǯîeV )\Ähº!$mòtyØ1¿¸'–e ú<»/±A>„ž + +i–ÀÏGH!7eñÇnÃ…s{Rïùutåup¹§t¯€è¯éJpd9î´$õßæÅø‹¶y”:fË¿7ÊÔR„ÔDǤ÷¿¨þ8ž.Kì‰g­œÓA³S0–èÈÖÒéµozð÷Ç÷ ¶Ÿj^Mš¯v±?‹”Aùôe(Æð‚íÄ]Äû )L™¹™Úë´—qŒ€ˆ4€þ«"@fé‘É[™=饖ŠRÖ'|6Ÿ  «É\#­¹1ƒ ú×û³äðný:: +¶W›†&݉%:®vÙÚìšéK¶g¹ØÖë—;×IÜ×ϤÜÆf}O"°hË"ˆ’ôˆ¦> ¿ýâÔ §ÇšnÜ VÀ/0“Ubà%ÌáD'/Þ±úùåf¹pÃÙ’ïi}ö2_( ‘„5ÁlMâ\hb1ÈUø]¥~ \["A¶(¹mÖG«$si»x¦®’ð£ï *ÆÂ¥±Ÿ>?YôN:xuC7†îd%N$d.ú¨§ÑZΩ|òãÅËOå¹Ïʼn(9¿!n»4ˆÒ)3¨*y=—Aê’z7e€4MNˆ¡MàQ¬Š@^ЭY³`¾¡´|Ø©26Ym°ØŽñ,ë~L‹6Œûž⻋ÈÞ€z9q‹=÷sÔY PÒíü«ÛÒƒ‰@²@dÛNP¦àa³ +—»êcОǤ +èB‰˜4«@¦‹¼êï—üÁ8¬~Ïôn!¾Wx}‚›®ˆšvïNÔ ‡}£é{m5o¯ex§µ5áe–dS¤¤T +<ª ó‰smç»70Ó_FgÝ›Ñ+²"àïP®Þä¿®S°QboÉÕt<=0ÓãéCŸ—" ‰ì®y~‚û¦;ÓÉkÈ\¸’~áEz`»ÖTÙ@¬þmcƒ0 ®¥5õÖý%‰FJ½ï:œöC´Sö"iX¾Ï$%’¿Â[ÄûÏbø‡ßw>YPÀñ¸g s:5–M¯î”?À£5æäQ{‰8þ""ɱèæ¦ÏƒCàC‹¨™ªæ÷"{ü ¶Rè³"'wM•¯îøœª´m=—°ËW*ìxÖ— ”­,½Z‰e¬í·5˜ílûÓIW½Y›Šå<†üùÙÄ-÷2IYÒJ@•—3‘Ö=Ã`’ºsÍ0SÕiåX‡pÔÚ%Êéçü[t‚†çã*Ûh6gÞL¸á=·áÈüß8N{ä¶w /§‰oïxœ(d‹ˆobGðhÖÑø\;œ5 Øëž=H"t¦¤g÷X\Y»…R”•Ík4y¬8ä;è=q´¬ðl®Ÿs4Ú¾5bßÃP“Çí•ôb¥Â&}5¶{Z¥ül eo ÑQ·p-ü !È<_³à:¼Ó +s•äó^W…nxŸxmøˆ©,¶ûõ ÝŒªÞ”ºÅcg'Q³œ3æ"H½®¬<݃p=ÅO¤±â^÷~À}./]À–™Å‚òƉÁÀ‚öþšªúµ™Î»”T–ýœ‡íâ-Þ¦w"ÊcÆñ*ÒÝ ˆâËоbëð žáL ¸8oKz¢¬ég¿:êõ'ji.2Â<Ìîëá64©<êµ7¦Ò gŒ¼d„w ¶ÕÀ+Ñ™Ž¿1y-JÉŒ®éYm!“ÙRá3²MN|ö|ØL:½G+zO¯‹"ÃùÕõ»Ç‚Æcs:¤qø’[Žý¨xˆrV#÷_ +À–Û55:B^b´Ë´³H‚ï…½Îjµ7¹‹pëBË™ê>°Îd˜39Ø×ö'2 £ ½9t:ä/0BÞWùȽ<¨­ûÒÝ5NÙÝqìÙç¯(dX–##&äÀ•8näË階7æd¥ y>CGô^V¹ð­0v‡å¨UfkµöŠ&`Cœ)ñ!]úñãÝùŠä—ûyˆ£n-(¶QI×z+6wyÝÅx!ý§;³é¶sÕ›nU£¾¥¯žŽÁcô{L¼(>Eq`©¾Uö$²æ×ÇùÞ.»=o€sÙXÔ,¤!T½QâLóQe%9‚xì_9®ÉZ8ž)ã >¶ žL|dÈ}MEÔi ïü(?ÄñºÛíÆÈd‡e"#Í-îY'ðcâ½\XAEY–¡•E ‹—Ëd +Ïñâ×8]Ö: õ4º(R³KˆÞ'¡æÑÊ0ùùUFŠzŽ¯8p’šFýòV±^Qûz½÷ü•Ú?Ò0~ÔQüÖA;š±ªmŸÔ#[5|¬‘؇›Ì^Az|EyÄ’l Ý<¡ÅñÞUj @Õc¯b§¹C`²FDZZL½0 ôçS˜!z%ŠŒ€­EIr +hÉþQ«fæ·øNŒñpX£”p*–ÁžVîò¾øñ¨ÅØvÚŒiG|?*Ëêx׋˜ &NH(¨Òæ«ê5rݹh¹trN;HíWZù{YÀéÑE¢bÿ/Æã’P1Ôbõ÷©Èíý;¨Â,“ÏDŒ®Š"i6MIƒ%Æ1ÈN›ÉÂl2éN^_§·& &HGùáÌ 4åué<ÞÖÔ‘ž‰1´2"ñ›]Ú&ë+˜nö>Xˆ w³zñ• Ò„¤&†Ów•°F¶4¸øÖ²7+¢çpó¹ÂÒ$El¬KµÁ¯{­ +k»…9?7`~Ѽ!>Ý´ö¶Q(ICDÇË/ÚOI[ÑÁþ¾óÑ& ø®¯fsVý[iÇ­*2¤&f“l&5·kkðƒÑ4)(ÌàO$dôÍ¿Ò•ÙuÊ žÂ½ºÃÈ]±·ßÅþœÇVn@5n¼VõΔjŽFÙµ4oÖàtm»ñÀÄ<ÙŽWÛ-òÞ‘Û"/WV8[yÉ>8dȳ~ßmVjÏr~Ë)µÚ_›bgÓã9DútIWô…~WªèðqÞ©¯«rŒ^Fï3F;Ä¥5šÖÖ«S‘ÃáÃák‚Cä©o¤8D…úï¸BLyͧØ›[Sý4›‰š:®ìY߀Ø{’Å‹MÆü*…^Rì¸ ¦a,Ò2!Š`OeÚ±2Áú½©p5öÅT¨R}¸o—ïj‡IŠTú>í°ã˜EÑbKâwUÐÄk^PÉ3üX×,0Âk|~. »ø /ãô.©ÙÅ &*»é,Àµ%âçÌö«hºX|·ªñ+Š¯pi‘ø¼fé9G ip‚>V!û¹åWU±º»‡HMµUµ±“±è |Uk§äZ[ÎñƒùO•‘R0€ ê½µæ]~e$r•.üÝÏ_í•ïI‘‰lÊ\Ç…b¶Ÿá}«¿ËÛ§x Û2Ç*0oÌ<þ ›’ûBB™Î#dÿgn3Èxî’kO Ð}”(¤,«5yB娾'ZXË:ÕÝ°£DgR"¼øü^\!Jsà• FR„„µ»¾…qjb"g>{[O0ï#2W²†¼Ð»£R|d¼VBy°QÊ3çÆ0­—€}—Ñ·Á¤³G![¸]Ú9Þ-{' +.Ò°gË1§†2%úFÆý߸ ~{”¢ùÈ.$ÙR­èÐM­˜ž©¹`˜m*r¿Gð%I;o u9’˜f*•-·ö¿o‰Ð±BOZ)¨ìÑŸœ¤õë.¢æº–Õƒ~Ú|:‘m.¸+;ibMûF)ŠŒ~¡¡‚Ÿ&Y§sê¸Ó³é¹¢¥>ãK¿åJ÷ä0t‘£tÒahc7 Ž\g#å½ë2._¾sU_æ$¯j]͇hØÐ÷µÕãšµŒ”D ϼN@—‘ˆ*¤¤DqùPà3¸µ. ÔYªÌEËè³y&ø“¾æúŸ¶¢GSìr¹ùÖ»(Á¥ê’™ûZþÆð/Ê}Æœ‹1ÈuˆDSøT¡èMEä°XrÉ  ŸqÓ +0=¶wÝ.-»Z408Š3¾G–¥áãü¥½5LL¼ +[àòá +0'•úÓ‹øBvÝîu”8 áïÊíå³dÄø]—!ôÖü-6Ÿ3æxŒÝƒèœ%“'ïS¦‡\%ßlìí®ú ùmèÔÂÜ´mžÊË×£³\ßÙÅz4Í •Èz¿šaßN“%j|ÌKèÜXÝÛ|o6Ì…fÕ²ü¶ƒ +Ó´üRιÆÁ\¼ÈÍo&I_Ç2ÕP¡9=ó’Oä 6÷Ý>ÀÜBþ|òŠÍ`ž]üý3á‚´Çô+áü&±™ÊïœÉ§Òã$y…FÔ )#QWöʪË?Ù´˜$J‰“½cG1-ßO6H:ðÒ9Å'}yU>+Û9hõ|3S‚ÞD‘Ûï!©`ø!ãË~®Ù¥šÖ4uLŠa랺£içBž Pd{®Ú˜Ñ7ߘF[æuºþåQô80îdû^uŸ|ª{GLdŒ8‰ñ©Ÿ¬é= P5’ØûðØÄÕ¨buh‡PÎu µµ`ê­À~äX—YÁD› ôÚ2ÄT't+Œï²…0W$F¹bNUáxÃèÞ)£±Ì@{SÕç'·6FÜ׬?6Kº³E…ÌÍY{ªTÎWIÝo•²æ¾ûr>ˆ$&ÛæY!á=’¨j_çDþä!1Úµptë¦$žÀ$©gÑ>=qR9[XºÞ£Õ+âƒQ÷ ºé']Œßó‰­ú¼Z'Ôß:ˆ¸Àìff˱ÿ¸ÐBBsÀI»Zíüðµþþ¢€êWòЧBûnR›ÕóÇ$rZy¿…‡ˆ¯í7™çÅmš¤E#¿0†*\.iF#¼ÃÙ#i~]ÄŽ–ÊùëŒîÔœ1'ÜjW}d ‰}Ð7}·Õé7·VØòƒeo6Œ·¤’%ÉZÁ¸Ìº?pëÆ›ã1´eOȽè/hßìk`gö¹¿h³ÀÆò°’ŠwqãVp{ßXã6g‘{Ú1 J\&Ó´àú²kI<Î9(fNæºVxbË€—¡ÁÇŠ?ꆆ<>Fvïm¬BÄì–E ÙŸ5 Ær‰¯xÀ&ÇË&µ#:‘"Ž,\M’ÇÌéÒÂOk"fh¾àÏ’Êšñ'øm}Yë±Ñ‹·ÒZ\‚Ü $!ޤͪÝPxDC[üéº)r9ê¾Q·,ëÏÕæÈöZ³Ý`”ŒÙ-Óý–,:LΉòæ?Ï)äüÚù°Ißå~H0Q¨Šç£*^ý´?‰Æ.Î…hP”?ÜòC[<‹Ç–Ž•µi*e]®` 9S¶z‹,†Â[ó¾Ø\̳\½ïÊxKŠ>`["1~û È°Gu30¹[€³#¶ÿMÿž!¬|¡(6ЙEíš4Ö·-õ>5 ¿Ÿ²OL–Wo†®Ò°'Þò»€aiZq>gE~giGg|Úô\£–¸µ²r""óèËk}ƒ"ÜШ<ú¬o +3u/4Ö?kóbÒ¬ÅÉÜòF_6Iæ}{`hMnÜ—›†þ£R=z©CR›qQ­¬#%™Iô¬Y±Ö‰ü9`Kj-4•t¿è•"™ÁïR™Ä<ÏU¼T5ÏŸü Ö¿L#Êpœ^öNìNRÊÖW¯ÿ¹aÍ­Õê}@º!Õð7ûOWHdÓ*ÍÚž|Z=Ì•>ñàJŒÞZŠf-weÎ9Ï{çX‡ù©½×xóÏ•K8MÚ…‚s(—«Zä}”á˜ü°ÂrÊùóó.ºYÎ껢ƒ_[ÅfÈcZ0E:‡HÙ…èÈoÒÖrëtÈ÷‰}¤0Ü^÷ª±…{á’ëÏ þ®}Áú¾³‡äDЪˆ‡~û.‡•&¨ÇgÇédN±±$«3ø`hI Û«ñP1QRÎíŒÂ®ÿçVvÀš­%#ó¾iw?;1#a’ÿ¨ççó/.ãÔXïòdU™ÂCj!m$›cgÔdÅìw8Y'+˜ÔäÍz®íÔvE åÆ8Ò¯î«`§Ø—¬jÉ¥Ô`^G7rð,©_ƒv»^"^E"FÙIxP *2õJ‰Ç +µe¼l¢‹~LÖ_3m²d ­¯‹ îcxà3_ÕTtP@Pèê£P|iÀOU4qYË!º"RKåŒD¼aË¥ùÝù–†œ­d7K:ã×&ùCˆÂi(U&°‡^ø5MPaDͧž÷S&*þ³·ÂÔ‰Ÿ¨ ºïII‡Ç=Œ¶ôÞmå®&…[ i!›bl/Ùwn³é&£“Á ¢AZZrÒU“O‰Xá9R¥éôÔÅ&$wØ]ª© mQŽIæ~×$j?ŒNýa°8kÌn"ÿá*ŸrÙ Èd +Ñëòµøó‚ mÝ!¦Oþh_ðJˆ7»Ä,BTÔ{aµÉ=Ž¸kþÔÏ^¨/úKŒz¹ŠYÌ„S:n9Á¨+9ÅÆ7(èe7ù‰a½³v¤ -Qá´l1¸….Å‹D”+KÑ|שøŠ<ÔÚ̇ó?»—‰õ¡óèeŸûp+Vï“â¯î·Øž÷«Ç¤éñûÂ0ܼ2ó¸s‘ª˜µõ þËâ-ÉäÁx…F/_‰(À‰°Ÿ›ØhŠØSIª§ž{¼‘D©àQüÁOç˜â1QÑW1Óïü˜ PeXO¬D"¡ÿ¦nϸÎV!-& 5aäêBˆÿð¢/¯†ìf5êå[¸v¹ŽÝ#gþ´÷G’šoçeࢇ³®bäÉ$‰W·h$wo¼¹å€/9àt~ìâ/ôµE]7·ÊË(QhIÇQŠ…5¡¥8úvÇEØp´¥o»XáW……Ø@æS‹/º©Û[sä}¾ì”ñâ=©ÖiIFQþK΀êÛ ›[ÖÿÃêÿŸàÿ‰ ÌlÁ@ˆ‹ƒbƒú?WÍ4dendstream +endobj +3969 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 6699 0 R +/FirstChar 11 +/LastChar 123 +/Widths 6706 0 R +/BaseFont /RLWAMR+CMSS10 +/FontDescriptor 3967 0 R +>> endobj +3967 0 obj << +/Ascent 694 +/CapHeight 694 +/Descent -194 +/FontName /RLWAMR+CMSS10 +/ItalicAngle 0 +/StemV 78 +/XHeight 444 +/FontBBox [-61 -250 999 759] +/Flags 4 +/CharSet (/ff/fi/fl/ffi/exclam/quotedblright/dollar/percent/quoteright/parenleft/parenright/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash) +/FontFile 3968 0 R +>> endobj +6706 0 obj +[583 536 536 814 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 319 500 0 500 833 0 278 389 389 0 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 0 667 667 639 722 597 569 667 708 278 0 694 542 875 708 736 639 736 646 556 681 688 667 944 667 667 0 289 0 289 0 0 278 481 517 444 517 444 306 500 517 239 267 489 239 794 517 500 517 517 342 383 361 517 461 683 461 461 435 500 ] +endobj +6707 0 obj << +/Type /Encoding +/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] +>> endobj +3965 0 obj << +/Length1 1393 +/Length2 8137 +/Length3 532 +/Length 8965 /Filter /FlateDecode >> stream -xÚµÙŽä¶ñ}¿b` ˆpk$QÔaÀ¼Øxc#=@ÄyPw«»•ÑѨ™|}ê"©¾f‡`€É*‹u;~ˆà/~(t©ò!/âPÅöû=òùC,©V¡NSß®-t%a”æ·p’ð˜Õ»ŒÃHUü€™pçð-¢Á©­«‰™åë³\èöš.?Õr—4HÐ{¦…gã÷ˆû¶E&U¨w ÙÐvƒ°W‘Pëc¬[+Vb˜JÁ›ˆ"€aCnOî*Üýæ))œl ÎEk@û¢Es\9¦ÙPxì”àŒ´¡tûèLëáÙ[5VrÛreØܧÁéVMûؘ–¼cJ%Pj'´2 vòÅû#¤Ã³gæàâ ¢D‘\Ï‘Š5ײÊf„þ±nO²‚ò¨H‚ÏÂà -Ì_… ³m8– Œ)K¢àתC<\«®Gî‹žÆ µ -ä œ™ŠB'™H ª±J…qŘ;+ 4|7cñ#]íijaÏ_¶ôz8‰p‘Ì+n<ÒehþBrA„™©é‘)XsáPbE™h•IÉÚæP#·ªúÝ Ã©Á9ùÞÄæ_)ÙJ¢½)nÝÁ/6¦xrqœÝ0Ö2"y¼P±— ³á9…„,ñH#ëEÝòbjÍŸx›Ôaû&{kéÞ_‘U I&у){+„}G² *—XÈ… ©¼ÈhP‰ì·¸Ÿæà40ò’€QÈ( •—¤oÑ%€ÔmVe'FÅû…‡Ãpè/˜í¾y’3øóÍ®~qg´‹¯ˆªÜŠbüæ†IØ„1b:’g+[Áø·HGì9IÐVÎPaFɃL‰C>`Æ ÑQñîÁœ€9õÖ£¸‰ 'UKÞ-ÔrÑQ|ã‰+ñ½¡2OI.†w:¥dµLà×>Íô«B9‹tuN¤”@ëÇäéJT4ÌQZöÃᙧt¥a>ej“=úÄy~bÚCzD¢âkÀÁèâvãæ„ÚÍRŸ”ü5„èQN3^ßõu¦ÖC˜%F(]¡D·¤åz™É¤aµ)o“°FEKÁ©lnÜð´:0ÃŒ -½h)ò$,bìŠ2ÌŠòžEÝj2ŽÆœ¾{|œªnS…ÃxàÑãUO¤â0O²ÿ©u9ëï°—)òYúno©C_í-é-?³û×cÕrëÛôûáÿÖ_~$m`~å -(O|Þt1.â¤âë‚`|ތ扔óµ«xó³ŠYp8šzÂØ‹Á@Üóƃêq¤*Ïy2Ë_>Sè7=o^dƒkˆ[±Aëw@3)s¹=Ž3ˆåHä¥!§x'¶ïMWÉ“1 á6ã:–\R#¨Ãó¢ø£u^:¡™8”¢°9ÑŒ¾J§Ðqæ ïƸ€«T  Æ8÷×5¡aÞ ¹Þر×ÙdƒÃÚGXu¡)X¸àÊæi¦±4,æ0ŽõvAkz“~äËÝÒé/Z]MìøZë8N,bFG}ȹrkðF ¾N£0KÉçÁƒï>xì -Pý05WM© -cÿÞ€ñ'ìFtðDÊ’Xg¿|ßQÂkÓ9ªX`ö$èŒÏF%S¶LÈCIò- -lGå—æ`K^ 8ƒl¬øƒ¾A§JØðÚn¦–Ž8®´Îôîžq|Žïe“KÊ>¨PlA¼WÈn¡ «Œs7/ _EÔ_ª-ç%˜¼r5P,›ŒÂ>iÐy0Û .~ÁŒòUáß.TÛÖ&<†UæûTìQ#%mO!i÷ 7÷hôÌVá3°'T߈CcíÂlkÄ0¸xýûÆyÄJë:£âÝ÷×8K¥¾šq”dœO”q¸×ÈrnŽ^êöþ[kæ63ßÉ-=zÁ§ú¢W£¤ä/šCÿNÓ‘èüVë–h’B¢5‡+œ·Ë7†adïhؾƒ'VœUBϦKǃ&ÿŽ…r6^ Šç0ƒNOØë˜c× ÐÉ9ñm¨7l Â…7.ÿƒ4'Ï2ØöØ9_µåØphÎìnêÜó—dÎ]m**œ¾å9i’Š} ß}I&•~EPéñȽˆÂÊεaÏ’ØOÕöý7Ø'êŸ0üÅâ5†'.¨‰†tåd_*—üÂq?êlLb…EKH!;ÁÇi$ -§ßóγ0”¥aìòFª ‹È'>Â?k0 ²ÈÒ\ð§nB»¿A7ÕԿؾa­‹|ÑOñB0‘~²àúŠsKä’aRFaŠ?¹ùznžÀ÷¨ÆÍ•©HÇðÄÙl©]LÀõöܦp‰Š“ñyêËà4ø7êd’C_ó ã‡lIJF ¹yö?>œ„¯Ú>QU#%zâc8Lr¦äµ^Ö?œJe…ï¼RÃîåì²àò–óÝ …Â!ª #­¼éèD£é |pø= P\•Õ}ß `Øó4>¶Ã¶j¥õl› Ìáºwkúm;ï~kqBævZ†ËEú¬½JÐЮ꒫Øû©9‰’ËC•†¥¾ømØ~ÿ MOLendstream -endobj -3463 0 obj << -/Type /Page -/Contents 3464 0 R -/Resources 3462 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3439 0 R -/Annots [ 3468 0 R 3469 0 R 3471 0 R ] ->> endobj -3468 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [232.013 625.659 270.975 637.349] -/Subtype/Link/A<> ->> endobj -3469 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [341.801 435.668 475.519 447.66] -/Subtype/Link/A<> +xÚí”eXÌ )ZZ¤ îîR,¸·R @‚ܽ¸»K)îRܽ¸××÷›ï»{o»wîþÚg“?yÏœ™óΙ™ÐP¨¨³ˆ›BÁÒP['VAP ¨ä`p°²£ÑÐÀ ' ¨­$È ,ààˆ;›8ø|‚ܼ‚Üh4 ÔÎÝÁÂÌÜ @dø;‰ nv°0Ù”@Næ`Ø& k€:ÔÄìäÎ +·¶¨ý=àv;¸€MYÑ88¦&Nc°™…-ÛßJr¶(€ï_aSg»¹€aRz˜$¦h +µµv˜‚!hlÊPX-0Ìäÿ†Ô/.ílm­ ²ù{ùµéKÙXX»ÿϨ³Ø 5;Øþwª6ø_vJ`S g›ÿ•sY[˜ˆÛšYƒìÿ +Y8J[¸MU,œL̵#øŸ8ØÖô¿%`ûGMA¨ ¨Êôï3ýgTdaë¤án÷ŸuÿNÿ‡9~3¬Cn€ì¬ìì°DØ÷ß¿>þW5)[¨©…­€“‡rp¹£ÁnŒxž [S°ìSfcµ…:Á¦`]ñ@ h)'€ uvø;ú¯?€Íj ;ÞGxyl⿉À&ñ›ølÀß›+ù›lRÿ!>v›ôoâ°Éü&.›Üoâ°Éÿ&X¥ß« ü›`Þÿ‡øaT~lcj¿ VAý7Á*hü&ØŽ´~¬žövmÙ@¿ VÝø7Áª›ü‡8ØaåMÿ@ØÁàß}þa>f LÈü„uÜâ„IXý0 ë?¦aóa÷ŒÍö„i@ÿ@˜†ÝÓ°ÿa LÃñ„õÉé„Y9ÿ0+—?fåú9aVn ÌÊýüߟŽ„ÔÍfÂÂÉÃþ÷Þù|<ìÞÿkž¦­…½3XNÀÃÎËàü'jâìà¶uúçß +ö*ÿÍ ØƒÝÀ&h‹sP¡@Ë”†à©¼ÉR$G’´¢ÀÑŽ º4!ÖÃ5¡W3`²sÜ \K‹2œäc… +6SÏ¢q¯ožêlA ¸ß0ñrÓÕQNLõ àsz°m²ÂvÉ·ì™N–¨®Ö]:ª÷9ø¾‡#–ÌÏ=^øXùŽýXDO5¥ÚNFû˜Óª˜ÖÚ[¹?’æA  õÓ¯^?-õ¬N[­`¦ Dä(!̦½û…ÊÎàù9†Æ~èŸÀ‹5Q#€QÐÕûYŠñ=­U®çVÈ·ŒÄû9YéÀþ΃¶Q×´)|5ƒ¤M8{Zñè™ séþ\åÐpZÏT(IŠEAU½Áüèòœx(©5z ©öb/)M%Ý+ž7YÌ‹¬Za?(ØÃÚi£ +¶œiF¢ËJÜrõ¸ítÂÊŸ›’„>pl3Ý£Š™ ­G¢õzÇ:R3dïûí©œ#Œ5Ð%³g Ýú$€cûnêíeRú¨tJUañ9:ÂC£= +ëñ¸8šeç6,^v±Pûž$×sz»Ò…ìb;#Ô;cˆ!•ü_^<œn—M¿!ò/";ÛE¹#û88¬2B°`Çò&Zko‘Íe]­l9g“šºõb'ÝΧèöjxà˜!ùÆÈfȸïq噓. ¸.9ÞÿŒ\ o‚د$Æ$Ñrt¶ ˜Í}$–"àÇŒøÚ·â¿÷^”±Ÿ@|ž%¼H£e3r%þy‰˜¤·í€ÕÚÛ‡à:Î#„œ¸eÑònÏÌQ…7Ÿ|‚ëE„Ì.á1v¬z|Æ?ò1ðˆqdÏ èÀäÔÀãx{YÎÔÊ2by£`:¥„±f'²\E‡ŸR_XÝôñt2› ʳ^ŽìéŠ+¸ƒñõÄðØq[²\|¥×®³‡¥’綆ËnÅâ(K,¾…GM:<5ê†KvàššDØ$QÈü%l“0"%ßåÂI- +Pgl Õña>º†è#.ËΉ—}¯$®37 öß7IlÞ혚QWónÆ*<²³*ýaµñôLz¯¦ƒ+’¡8ý¢™Âoª­Œe·i 5ËðYà‡zµ« 3J‡Ç!ž¾zU?Ýã¸çoÙ¿L +òaÒ?È’áídj‡Éæóõ}ÀjÚ¶9ã:}ëe¿\YUhÿCž¬]B¯p$5Í©ŒÀY…Põv \mÅ‚˜­ã%jªBSYñ0ª-ŸÂ*—î/ïâ#ñ Z¼>kB8úlÕRkŽ +±Å¬ÌÙï¿{íQdˆ·«zUD¥c¾§ØÑ%¹µhiZXiÁãåÉ“ÆK±”Gœ0°òŸùþeD½-ª [ +Y©wÒ¹º‰­‡˜ãR‘ |3l§ï}öSkç®|¹¢wÿTáØ1Ðc |ËmÜÛØ“Ó#û‰¾0y3Ãj$N2Qm[À,3Þœ74õÝEÆñòšÄ¶Ê_fð$o±Ë_¡>å:Wéç«û¦íÉ‘1¶ëndçò—ûõ;Ãx=Šû +Œ¯íï?b; F’þÒ’òáê’e·Ç ßt,u©"g"¢ö:Í]'çrn¤EW¤NÑ™«»iÖ[‰ü~Ðø>5ﾕ òd]_~^VE}\× ñEMj^KÜBÑ#p·¶œäGP¾šŽÿ_B/cå#‰·q¨Ê5fÖ|:꽧3Ó´D)(IÝ"•±Ï Ž+ôž2Q’œóž¦ÛòI/‚xÑË‚Ÿ3¶Å,/²Ò5B¨ïéÑ5u¡Ûª++(u¤ +2d>\ÔKÖx‰»‰¾aRJ»#,6Ý2ËgïcæR|ÆÂÞë2> „æxœDÑnýâf².h6[ïZø&QõvèGf’Š–ÛE'ÜÌh\(«"¶yvä˜ëèЛròÀÊ3¿y Óç…Õ“ìD'YsÛ|‘ÙH!¢àp5íñä¦Ov,vùüô š«ŠE:àÀËqO÷ÍŽ¬1¦U÷aùþáñ€"ÚÅxg‚ÿXF|ŸeJ¯n¿—ÛKƒæ°¸§HïðÓpñGñùì«ôƼ¼¯›à EÅ–ªíq}†bë§Èï Ž¬)Y†Ë‡ŒdJ¼GH7T3MnyËÁ¡L㱌’RAÚãpºØXžÒOnž†ÌOlÔx)©AÔtõ§î"¨oxq>D­r¼h5 ‰åIò£Ñ÷fOï‡45 Ån2>¯©mÞ‚Ú¿|”(+ˆþúå#³Xj³Ë¾‡ÑºeÈ{ïë±ïQH«çÒE/AÅÉyô 9±”Ò.Èû½ü[ÃóöÕx×àÖO¦·oý2_8b&M;—nʉ¢:}¥B–Pô0?Dš¦œ‰(úuxÌh:¢f­®ykߘd¬ïCAÑj&¾¾lðYïGŸ-×½Š--ômª¿°q ãm—µ.½÷”Ž´ÙóZ¬òHqaÐú™eÄ׃õÀóÐà{¬› ¸Ë,eHÚ»p‰—U§MÓÞÞíý-biXÊŸd l㶠ÜE/C;j^,ѶÂmdà"´ä1院íRJÎEÄê[kÜ¿k‘ÒЙ>y jÓ/:©*ÑSÖ'#aõ]JK^´¼Ô"ÜtøÔ-w¶mÊñÕr@‹Bå+‘øù/€PŠe™8.¶q<Û÷›pÝ8NÔÁX÷’a~–›ŸÉ"µû¢U©ZB´­S'1ü¦ÈT8¢§Ae±+'W8fÜß?z±„'+§W +q_v íPhᨴ ”ìòäòŸQ· ¼èú¼Z6ÝÙÄò̽ñþÊ™ÔÑ»K™ÖW¤Úðä¹N‘ýì¡d´uX×ç:ï]NOŒ˜÷"Iõ~&Çœ½QV^¨7fÉê +f{U|àäÓij †îÑòžè¬pöý8ˆ2ü]‡AgÊÌmEÚ«µÑK¦‡æŒ7Æ}µ«ÅŽ…vÜ*B<¯Ú¶¡U¿¼ê47³½iƒDñt’ZÓTèNk*è… SïÊF½Ð8âð;eŒªXWÂÅÜÖ¾fÜ+B`¸®pa7ÇC+KIU)t™ì;}*0 x´;+Õ6+˜¼ÙµKQÓð|(iûúª{ýh‘XöƒöÚÅú@ä¶[9Òçýæ¥Ú,௶Ý¡¬t„:‘áDž‡: .€ŒB† «º-_F½î2k÷ÃËLza5U–Xv¢²HÀ¶íL³|‘šÒÜ­—Ÿ8Cü‡¦RŠËJù8” !f£ƒûƒïq bX …Êmë‚as SW²èDN…KŠßtÜȲ†’æÌ´~’hcM?÷˜d1P4ܵ•Žñ‰½QWEõ2 ðÜ4Èq­ã.K4pïØEýRm¡¿(šQÑzæs›²é0Ñ{3 — †§<àvb}y—&@ë}%ðÚ·7Æa\ù×:#û%˜ÄfÑ-œF`∥í×UóÉ=6nN¯³o1¾ö’ð»¨ÊZ}?ì7A§ûÜ]g€Ÿ*õOÀWž»æ[¥ºaIŒ7¿2oä¶(cÕº õXäç?´KÝ +á4Ú4¾h€»¢vþZÆÈ=0`kþÙe-pK–î~–—p¡e£Ó™1É0i ÿ“%HA‡uqÔŠ¸v|þø®×b,4‘Ðø}Oó*Ïj{q pX¾ó#v¨ øvæÙÂH±šïµj> Áïx(œ—VZ ¾qã«,Mö¯rð † M!WêÔ¯&t +0>oÄW»šö +q±ÐèpªŽ–ãþ¬í’ö||À wÜ€É"s+†çÝò‹Â·pðGûöÖ¢2LVÎÁG\«D©[5mˆ§™'gŽb5%lÁ/ÆÛ/ºZþz.ãa2¯½¡ÉÆ.½ÇõurÈ—ù øüNÄÊ-‡ëk©¬‡¹)Ñ3ÇÁÊæÈ ¨x~GJŽÌ"ÿäòÆ`L”=ˆd©‹)Ä1Íè)B–T¢x¬ŸÔò¥HÊGúÝ|»ÊY{6aNð_pfÕo÷Åb8ÄÖ&%¡–Æ×#wM?@Xë”Q9Iº‘ØñA²=ªÍN_ð¶‹Íl©”$áŠM®hùRŽ˜@Y8Lnº’•žÝ¬4EÜ‹7"‡„ÍLÛ«xhè ù¡oá™5¸ø¹­OS¸ +$î2Ç2€ˆ†7<aûâ {&?ÕürÖW­*zUPr|§ÉZ—pÇ.à‚œ\J€ai‘dØxÜ\“šlhŠ}az™¨Š8ñ \–n+Þü[°Ç‰f¢éÍI®ÆÝàW.ÓÚ©Õ'ªŒ`Ý¥Ï q1j*§ñþš”ÚÃ{X‘_`óC}ýY?TÞµáq¾^¬+QGŽÍŸ+t7i h›ïˆÝdÈï1Ì"6%¶!,5¡­¢i&½Ž&·Ä²Îµ~}y®³˜î¶=F½$Ÿä¨ëN—| $¢‰£®€öåB„×3 4WhšÐ xÇÞ¼ ¨¥:œ2P®¼R|C™jsJ"íÜ#‡=þTHÚñý+o›g§?›wò³bø™F­203iõ÷©ÅORö4J™Õд°)ˆx‡Ä£Ç-€x暎Ùê•»!%>ÛzÂâÚqv´)+ÍïIãVWu=>ª ̶P¾?¼Ô¸È"õk77 "áœãb‘ K(OŽàMÌݹy‹ºp¦Ï´éŽ)Þu¤ë/$SÐQJ¥éàS· wì¼.Ë°‡cHfê¤slæz´(Øaj²ïu\;ÖD—æ)-Š÷ùSèÈÈ&9N"­µ~Õ¬z‡z4œ¿â©Þ…»ä+…žx¯@cTޫ휅BŽU@€D§uJ刊òÉL†ñäXñÔ§šþ}ãyw/x/¢¸ ½û%kCkz°_µÿH¼¥‹¾àBÈQ™öN&"ýa‘Ir·N_£à¡0öƒ=õö”ZZÖ3Pµ /!V½$Y®ËÿÆÂ…X¨¥FñjLÇ!g(‰²K[¸G%„ü +gZxeÃF³¨u–SXA¾°yÛ† 2ed˜`ŽxS%F}Œq0cEïY]-ŸÂ1Í &Øa9ÜѺt¤•kr•Ÿ׎ɨe•)QUU-Åáíž{ß:QK¦ŒzZè° ŬØ];®ê½RÛî'pïuïÀwÌs ¦7@¬”•Bæˆì½“|íââÛLISeý1®¹mþ*½Ê]zÅS¿ógÇ1Mb\u–†Ç²-”ù–õѤ(åj×FñXBMú\XÞó »©W úš¦Ñöe X3°ÈËÝCÿÒQÉ;*‚˜:>O•EñY»„‰qÍôÅ3ø¡bÃÒqÚì‘àö†zôåGþ¢§—”6DHÙ­.)¥ÅÇô5õ[ Œè#Nc+: ÎbQIÝþ-¥Ç*!ôñxÐuÎØïmìÌ”êAúškéu±½‹(¡|í%ÐëþÒ  þ./ÓúÐߪ>eÒØnuÞ +Ah{ñ!Î8X”ãÉ'jUUq*äó¤_K„ˆóR¾}„cNášE›†´Ÿ'p˜VE¶È|>û‰'ö=.Óøâ(w È~æY”ÚEÂÚ¨§`©ÿÃÞÃZØ·ÖðòQ{nN]šW1p¥ŽÅMðéÙI²o߉n;»Ã`zg/à®V/‰¡”€VkeSÇ /,§U_ÿ’*™8 ýÇïÎWÁ—J5Š%Ú\”sx0–ˆ„#Vû|xÉ÷çò»ªÐÑ꤈÷ƒŒÎ¯ •¯'¾$›·zE G(}Îaüð<ÇîqwA^€…ÏWj¡’ÏÉaM15@7Ïd-º®ÑÛlvšÇ&sÁj£]±¨—Ćm?¢´f +—²¹®¨‡SI‰g_ڨʣrgë¨!·3s¾¬P™aßþÀ»> ~¹šó³¹dë'US¸ä<9¹Ó8ì=÷•bÇká‡FÁ]ºP8\Kë’¦ûÅ!rL[¡Š^fK/^~Uå2–؃*YÑ*¶rRËψ‘‡UŽ"›· )Ærrd‡#AgòȘtk’ŽŽ¶Ê$2]>—Rx¥ü†¿zÙh§11´§¤â“sÓD)䬡,Oö,‰%¨Ók¹Ó‰1º; d„©œæúâè–= ÒõOÏâÅ­PJ€‰e ãÝmZÎÊD Z°È"²Bwé*¡ÞnÇ%’‹Zõ/ÍñëŽë/,ßßóÔ*rEM¼*U4ýÖ§8n,𽯷霡|‡Ë¡¢´ð¨Å$¥ÈÈ«£¦pöõMy©Æ^ä“úà|6Çkϧ®FÍò<\›öaOyÍß’Tº—Óî&;“pØ +Çæ4ÅwßYhŠ)]?§ºúÆIÊ ªköŠ7Ѫb±Ÿ$—û¨~d3&Ö;µk–#Š%G$Õ}VYÊ#´ƒ‡Ih?Mb¾žrue¬}dV8l0£ìP/ƒÚ»ƒ‹->àÿèë E‘«x¾L^•Ï´ÓQ4³ D¬+Nq¶ñ¿×+#6ÄÅtiÐînR¸²ej3¾–^:¼¿çŒEgåÔÜv©Ý}–]HT,ö®ìàsŽˆ. ðòx+¼bÔ6E3Ât;.Í:3¾·•5„¯ÁyŒµ§8 ©_{^)¶N‡«>9œãÀçOºÒSsWGœPêmä’‡èIÊ‘åÅê×JÙÅûìÑÄâPö¡(ζ;öDf½åï•á~ÑX‚áÀZèÓza¹î y ÂÏ䬬 +ñÆwZE¤³òÇël·*å8®7Ÿ¸,¶á‡Ê[¹Ü+ ÃÍv‹(¨´öNݲÿ~ÐþÿÿO,`b 98Am@VhÿÝ/îdendstream +endobj +3966 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 6707 0 R +/FirstChar 52 +/LastChar 121 +/Widths 6708 0 R +/BaseFont /KSCKLQ+CMCSC10 +/FontDescriptor 3964 0 R >> endobj -3471 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [250.165 336.599 295.309 348.288] -/Subtype /Link -/A << /S /GoTo /D (diagnosis) >> +3964 0 obj << +/Ascent 514 +/CapHeight 683 +/Descent 0 +/FontName /KSCKLQ+CMCSC10 +/ItalicAngle 0 +/StemV 72 +/XHeight 431 +/FontBBox [14 -250 1077 750] +/Flags 4 +/CharSet (/four/colon/A/B/C/D/E/F/G/I/J/M/N/O/P/R/S/T/V/W/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y) +/FontFile 3965 0 R >> endobj -3465 0 obj << -/D [3463 0 R /XYZ 85.039 781.388 null] +6708 0 obj +[553 0 0 0 0 0 319 0 0 0 0 0 0 814 771 786 829 742 713 851 0 406 567 0 0 989 814 844 742 0 800 611 786 0 814 1106 0 0 0 0 0 0 0 0 0 613 580 591 624 558 536 641 613 302 0 636 513 747 613 636 558 636 602 458 591 613 613 836 613 613 ] +endobj +6709 0 obj << +/Type /Encoding +/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/sterling/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] >> endobj -1270 0 obj << -/D [3463 0 R /XYZ 85.039 761.463 null] +3241 0 obj << +/Length1 2090 +/Length2 17727 +/Length3 532 +/Length 18922 +/Filter /FlateDecode +>> +stream +xÚ¬µeX\Ͷp‹»C x£Á-8Á]ƒ;kÜ‚»kpîÁÝ]‚»»»»ëíwŸsv²÷÷÷>Ý?z̪®9jV­¹(Hä•èl €b6ÖôÌ ÌÜaYeIf&3“…°PßÁÌÆZDßÈ `æâbˆ @?@_n6vnfv +€°­«™‰©€J˜úŸIA+ ™¡¾5@VßÁhZÃPß dchtpeZZÿù‡=@h´s1 03ŒÌ @3kÆœ$­mÿ6r´ý¿!' =H +@õ/MjHÒÈÆÚÒ`4F`”³e‚\þÿÐúïÅÅ--åô­þYþ_•úÆõ­Ì,]ÿw†•­£Ð kc´³þï©jÀÿ‘“™9Zý÷¨¤ƒ¾¥™¡ µ‰%@ÏÌÊÀÄú?q3{13 ‘¼™ƒ¡)ÀXßÒø¯8ÐÚè¿M@õû—£°¨²¤°:íÿí¿åõͬ”]m¦?³ÿÅÌT$;3€¨ÊÌ ‰ ÏÿýÒù¯d¢Ö†6FfÖ&6v€¾¾+èˆ àÎ 0³6º€. cFkÐ_ ÊxŒmìþ9WÐÑ3ÿ+ö?ÈB³?ÈúÏèþüÀZÌRßêO4廣ÐÈÀòÎüß#F[ !Ðú¯'€Qß +µ×•íßQ®ÿ]ã?`e- o´¶ÿeþßèM™ëÛÿ³„½ÅŸ HÎÐÆÊJÿO„ Àhêjk +´þbÿ—§™Í!Vº½¥¾½éŸHÜ hgó'r¶±þ›Ù@²ÎÆÙ@š¦vÀ¿füS[G»?ÏÿÛé¯ ]{йÿ›AfÀÿØ%HÌÚìï´œÿìÐÒæÏvØ@bö@+³ÿŒ²ƒt€ßAÏÜ¿#Ÿÿ):ÐþŸ&ó'*àåúC Ü”Xä’Šþ›8@µûC ÔâT‰?’üC ýKý!‹ô¹Èü!‹ì¹Èý!Ë×'ÈEþ²+þ!Pv¥?Ê®ü‡@ÙUþ(»êeWûC ìê”]ãßÄÊ®ù‡@•0°Ó7´:üÇ•æúüïø^jPãdüsw¹@‰ þ(‘áŸ'• ”Éè/üç¼ÿÂîÞ_Jhò‚vnú‚¶þW`íÝü/9Yü… )Ë¿dõ§90ƒº£õ_²²ù AV¶á?7ò/YÙý… +û¿dåð‚¬ÿB•Ó_²rþ«É¬\þB•ë_²rû ÿéyÖFÿ× þßV/$dãâNÏ zžèY@]äÍàbçòüÏ™*Öf §MRÔ(˜˜8Y8ÿ5t´52‡½eA9þÍ@¯ Ðhˆ°8gcÈ`žTTä%š;Q MmO\0ÒX›ÌÃp¼Æƒ1c×0® $ºBD77+AK<•.c42fÛÀ­ôèwWb \@ïGÆ¢ÎNQ‚=7<ÖÖ…ÈìëFµJÝ_$Þ±m =_"»]wj‡®9dæÈÁ=ýU4?÷zíeá=º±ˆøÓˆl7A'³E&¨z°=üt"n“k³˜?€£r‹ù¶ˆÛ½:e±‚œÌ–) 9›ÌûÏDíb¼9ŠÀœjA¼¨žÁ%ñ^Y»JÂ0è4'Ÿ¼ ‡ÌQPðý7¡ù”94&GÉ »0lÆÉÆ`‰r­3ƒÎßÄLiÿ cm\1Tn‡þÌÉf³N{Úë0$äÁôÓ§Qî§(Äãƒ!”ïFã*5,O3¬~3ÙÃüÃĺ&¸´~ØY oLZØ·u#˜Ò°‰g0Ê BŒÍ*퇋éPb²?Ýz¦8ºáž‚ÑTÆÜ9ür¥»x·qT+.3$‘"…uqN¼ ›°ý±É§¾rüN}L¢wØ;°sëDL“âž^" m3Ó÷BXºU&½¢Ò••}|™ Î7nx6&„f•EžëëEpãtì~8q6»¦!æ÷îê´k^tŽŸ9Dc£¢Á‚`³ÖL[,Y@èa¥QôßQ/ ŒU¼Q&h1R¬É˜•ýl…ˆ™6YBYæ È`è—GÏ1âÄ„æÑiƒ÷ ©»¤P>ÄBÜÖ¢ïýé“9øƒº–$êa[Z©züˆJ.Û™ß2£²©cÍìÃL¨8._Ùá‰àmtíG„pÚÊà^^'ùF¨þ#¹o#´nvN—@ŽžViø‰l¤Z'A[v!ÁÖ‚¡Z;ÂΆ:EùIy©|eÆ9Ø·u*2¥Î©òÎ÷û+¢Þ<ϵ{åVØãÁG|OZÑôdNý†žÊÅp!ôö±{¹”¡³P;>ËS¥m“ûφô¦åožÏj\è±ùÀm’»{ððìX]…þ|×µü•ÀüI˜&Ñëë ÁªÞÜ&tŠú“Šõ5SŒKváø`ûÉ'3‘¶# +µÐs¹¤ƳŠÆô„è‡i·Cb{õŒÛÁ·mPÍz^]…,ÎýÇêxÀàqEÈT_›<:h1©4£àn¿"¤í¿Ff6ùÏÙØ$îõù&Í=ZaÊZ¼6O)Ø}|“X5 ™Þ¸¿gE¥ó,Sà¤ï˜MA»\×Óï6œ°–Ì=\£tGü¦¬Îטs¡!Vw[<Ü·³ågA41¸xÇvC¡j(É1Yž¶or>?5‡| >o-ÏÁ4†š›8[6EuÛUžà¦' ó˜ÈAs)ð4y6ña/bˆJ¨¶Y&‹z¦”‹åR⤄ ͹SÓ`Ïä¯YÅKn'x4XyAˆV÷]w<+„ÊXÍ“†§ˆè¼+Ö¤< wæõ{_ÏH(¶~c+ßAíýü‡“éñr™L€â~æþ‡5è4“ª¾ŽE&‰«ö6ä`>ÌÚ¦!=‡Îù ”bÌy™uh€ ;îñ¥–NáqF!^§OÄ*ü1*:4°c£ÕŽuЭaÔé'‰ yò}:·ˆ¡~tÊ»w#¹NäœÛTHæ`e¸ÎIÓ´XÒÌŒ8ê3$›÷.~{òCƒÉxVçÏ–~ °.Á«‡®e6rp›¼µDí÷nÞø%p‰ƒUˆ-[F|“ô×6ù¡9ÀÖ§!"M›²ÈæŸK.µý•G’ÜH«¤Á|- +Åš±nÊžÄYìòzèºO-Ù|Œ È0 ®,QB‹­~ߤÄGaJqƒx¯?´õÔ÷t½!Í’ãËÇ_Q|¸¼ˆaíR[wx·k1÷®â%. >ym™¢ï+>e®ßžÚ7lÕ7ït½„ÒØtÌCÀ/Ó«ƒA"ó1Tû®Ü kƒ2¤zJÞúˉ9n„!ú6¥ã +ÿr$u§NÙ§ú,G_ïÓÛ(=,’Â|íúús3%v›ìà9,-sˆ4‡<²—ô ÈÛ3Zs»3¥•Õíš­ leñПrƃ·๦y”þÄß쫇؃uøЮ·õIçâWd„œúÛþÇ­ví˜B +Ø4mNƒëVË.÷õt”ü'•œ´e®´´÷åøPÃ|?¼¢Šò鼙휬V‘QxŠd÷™ΚÕÙ!Ì¿r”ÆûÙBzÅöêqÙÇñÇ,>(vwº.÷T}RÓÞ&ÓiŠ²Ô,‡ÒÊÍ„:øt˜(ÐTz5¸ùÅÎ<,˜Î*GÕÈ\S9xBÎØ)¿[îû@¯¬ZBT¦Ý_ù½,Ôiv¤í é3ñe¡Ì˜FÕ ™Ș¤6 p[‹ž„ÒPÊLò4¨.veº…£vºØ v³Ù÷ÓLUAl JîDŽå,óÊ|Zs“:à­/a¼sÌ^)¢ÄV˜‡D2+\ð¨Þ×pvM:¨Zí×Àh,| *_†|þ:æ*-¯ÀÜ®¹ýd:NñÆŒœ]Q¢.ßožÎ‡ÅˆiçÄÈ} ýk"®¹ÿZËÕ¸oëã&"!6`IT +ÓrD×O¯2Hð¤Íæ¢ÖÄjXjÖÃɆ^¼¥ÃyÇ£K^ò—öaÅbo´݃2ðY±ðq)OVh€›¥C¥)Б61)–?ad°ž?çÈO˜| +oÖ%Xlf•ƒÉVú'o‚+ôy^§ã5¿D,8w:+¶ªÑT–ׂ,oE¢5Á íÊ؉ݽvÑ•!*åøÃ1¿¯+IO„ot1Æ«Jáä`VŸžVÊŽPÅ>K6îN®Z/XÎA<žº¾M|7M®C±»)í¸eõ4òüŒ·rïÇ«Ñml]Ïû·&‚ +U–ƒ~A˧mQŒøš.ô*röÑ”:íãø26埸p¸Ð_8XgÔÔô>šÙ§˜ÒaÂ3™}EØc‹ˆ®b9Ò®8Ww?^\{QKdÈ|7MÖÊÔ÷’er”^q2#WLœðcþn[Ê(ˆ_#á ¡®ØÌ h§P5ÑvÖm£QŽdÚcNØx/þes¥´m­—È}Ã,%‚tRlpo®St×w, ¨“ÅòPÂ\Ãì¸ØÞ×rÚzÕ£fÞ˜rPÃþ~ú¡aè—Žµþ­Ç·½Zl¹Á²¡3æ˜`…ƒ$”/àoñ©#a‡¼ôÒt•g†„{ÄB†ý¶T* ¦‹ÝM¥öêÉ“éEÜ¡TÙ0ƨ}þ4º!3”‹¸‡Öuýx.·ƒõ»#©'í7HÕ¹ x„ó¦Lõ@ãoV|ífŸuƒ©‘rÃT]q/_"Okæ—¨š£îh>³\g`È\ÇO£O#ú7ùìÈP¹ÎR™b¼Š‘¢Š:éšÒÛC=x>ë2[Ue{‰ï¶%M âGó§ñÄK¢vÑ`yiâÏÞx­œY-ÕÏdm©´c§T´ÂxIÝcü8nøÁaÙHÜðD|œÜÝ¡…ןŸÒMƇK¢VXÞ6øV‚Þ”¨yé°·Gw1€ÏšªÄ¡`ñï”®G¯3½„6å•“×\.K +Q±xëlj2“{èZ^Ï@œ£ ;Ú°Ò’ 2³w-S@êÒí&’ùÚO…ȘðmüïÃŒÔäa V^5™,E‘ÉÞ5Ò‰¶ùÁÈZs\Z>”YecŠ:Ò\üÓäSÏDçÙÕœ¡~n²§sTÿº†˜2Gw€ï°¥»ƒŸ)½æ‰ñnz¬˜üÚŽòY¢„¶[Ztaœ.3òb>„´Æ¹Ì0¾Tglmž:¥X9‘àÑå/Æq) &  ">w·Ҹmñ“ûð¬­ÑkUiÓ/êxnÎ|jÖäU8Ÿ8ì ‰lÈkIÁ<3)îÝt-V¯É›oÔ™†MÞïäm0˜RÉ¥¼›å>Ï.Op3¹¾Aâ%î'_ÁÇJi 9Nêd¥¶ï¦DçÒÊW´'kc”ìègô»}P[k”¬+Þ·³~~‹;r¯ q°7¤ñ ÀM/Ÿj›åÎo¾gŠ}¦:ìbb[•Øœm9h/Üõòf-x±0¥°!¹Yܪ›Rõ‰^¬¼ <ºê›Ÿó^R±’hÉÛíiWmòn¯NN}W×@ú‘›,ÙÖŒwÑJ&W¡róDª- Ž %:´" ŠìádàM`˜ÝC– =Ûáú´–-g–p«G[D6z$Ô;¿Á Y¼™4t;€<LÂ0Äáà“kÎxh6¬ž +¯YöAÖ´Øq¢z[Œèf¶gºhó2-ÈWʼÑÎ8v~ŒHßJ\¹Üô‹Ú æmˆñ1þ;ïdz(î)¦&i¼P¬q§ƒ®U÷9ˆ «ÕeøbÞ“†ª›pSc4c£csâ$ý»;‚‚`^ )0p÷]³%Vk²«‘©èDw£€U4Š¸ +€Øª¤^ÈoîæzÎv“åZ|>Jýö{ÔnDJ:û©Ní©õ ÿ“ã׆´{}˜ˆ5õî­ÌGªåçþ»ŽÛ'|K§ŸÒý¸‹ÍuNußm.[c¤>Û`$M«237R)OBëÏø(gIƸý¬¥•æQ¾_슷£Û!Ò~©!ûÞù‹ßm…Õñ˜»”ŒžyÉÃ3œsºµ˜C¹kVV7çpŠZ¼bŸ´ †“…YñxÕ^;Y4…0´:[‹Å)蜬ˆÎõ'¢cçå³!~Ýâš?ã}¿Ëim<_¹¢É\ý]eõÉ~òzØø’XX9“‘ý¬Räbi‰ëÛc¦cœ!I£ÂÆåÓÚæÊ@…|3x/R)0z±¾lu»ÕaP$Â16–öUÄÞÏ~Ù›¤ú(‚Ù©„«ä1À«–l~Äf_צ~aYçËn×sv?nvr[&m~‘cšW¼`O¥š„¿iA^Ñãl”¨‹?¯ÒfjŸËw,õˆÖüŒ>]+¹BJÏOšÎš@"¶å¼ó‹^YŸ@•]ÆÅ"е$e>Ëgî¶í…6©Ä*¤ÝlN_9à¡0Sð¼æ’C5ì«a¨ÉÞq^çXb ×…A±Ÿ•/_W{íxR]ÑÎ4yRæx/’¥Î·¦ÌE|½5•›¹gr¨ +Æ®X¥)²™«ùÎÞo‰þ>kMû¶ô¯™Ù’£«yǼ¥¦æŠÏwYåžìðà+±ç¢˜W¾|¼¾Â[9Øâ†ð“wÞ6–^à‘¶~gòI´Ã‚°z”V¨2Dsm‚{Ä©+Ðǧɨâ,¶WÁSL “õôÛ$tÒ{±AånzÍ<<ÓzÞ&Px¸­ÓApÑ£ÇTq„þ aN‹5äNQØã÷G©ß×ÓMO^cblðEèù&èÖ)5‰àöZ¢¼áÂí3Gʾv0—#?δI#† c§ …8Nà› +û0U Jj’Æt>’—×-—C(¬TV<ï»ö*ŸZãÞncƒœ…ä>{Š!Ìöb‚³zÍræ÷ã/WýëÅÍĪ;·Æ—[qv»æ[XíÏuhÝq¿óÞ…‹ADÐ Äù A“ÛR• +]ÜõßÇÓÛ©2ŠïBB/èw^ïÀljÌ>PoF¸>í%g§±eÚtñîPϤ,Î…þ¦ ^Ïã„g¿þ›Å€@€òôÙ hHªãC »óšo.X÷gµÑ¡º^ ÄIÚ¬K¸äÁoëŒÛýâ=°ŒÝœtf‰(h±›Þ/Ë‘¥D±·žý¡FT¼3è…5Þh“Q»ŠKà¸-¾UC; šŠ£9˜,©‰Ÿg.Ÿ5é$8&Ãå3 c‡>³›ÿ`g0"uêdqXýÙ´“BžýNÚ•ÞÐÍÊ]ʃŽ¤Ò~à8mØï°Eoz#f¿C}î­,Eo^¡ $Ìg!‰IÞ;%"¢³øµY“~+ J駕tâL'«çævìÄJ¦` @DR$«•0€Ë$¦ÒŸ6í1‚à‚³ˆìɯ2\çûd>ûòuŒù—ÑM زO7ýIX*º ·É+^#–DèØ­bXj9 a<ùÀˆàƒà2Dt–jƒtìhÁG_Es!›4A~vÚlp*mØÎzÛžÂd”jr¾½Çœ@Ow](˜”5·Ù”–fTJSRù«û³)L¡Dƪ%þcÏÊ„ ùdè³(“ðiÕñ7/UƒëíòfR’pÐ\¹^¥Z¡¹‚# :vøì02,4ELÊ=k i½Éo¸g›—Õ¸;¹!˜]½&2ø×…†µgÍ+êN¡P·j8U›êDfi ®x7É:kÛ>ŽHËr\Œï*laêèoýFxaÛÇ€óVCÝŽ °˜ÈL#¡<ù‹Ã ÷š Èc"Y ͧú°èP…Ë‚ùjâž!D¤µ«p‡ $k”äèiy¿†Ž–"tœUå|ˆ{— +£äj9n/]ÂÕ)«ž‚¬B÷cÞøH…<¯=Õï«@îl®t~Îb “ô ß{U|ž%©ëÏÙÿÜòÈûSÿ澉© +e‹µEÎ<Ù³.-/ßoz2€†Ú+r0»ŽøÛî¦'éûë#1)!ïäiK4Þý¯;nH^ë›´]5IÍX?Ìã›ð0µŽEä–ide\V9Œœeàl¦G[óIåW®Ù¨›Â¤u­ ¡|ÞC"iKk°ýïF2ÍÙ8ZCØ[lyt<Þ³Ë82~5³æ:Èë{H¦~«î‰2Ô–^f™zØúoÚ‡lfB$·ú~ÚŽßlxÓL„ù%½è„Ñ"ÏSÉ.ÒvØ7ÈÉfûÀûM§[–ð8ʈ·Vó¥A1{" ïÅ©L~µ  ÚÎùº£¢¦›„ÜV×ÿsEcè€^C&9I±lG\&0`'Ù94ÃKûå·°;<³–ÍüƒIa +¢#g‚ :‰·‹C×€TˆšµÀŽùDæ•ÆÉÏì.èÙ–†OŸ#¢¹¼Ú iB”šknž$\ñˆÀÌVHGkŽ¸¾ÿ¶{2 1g© +¼ìù‘ÛÃ<ã»Õ6Šœ#Sp§8c’¾º*}aO©]Ýk•ï#Ö>”†l@$jߟ]zXU„ò"Ê1^dåöÞ’Zåw ôV0×¢ ¹Ûá^BÅÒ•r ¢¦a¥D,ò‡`Á§æ P7>½r\EI^,‰Jìÿ"zk6öÅÍŽµ´VYpj›Ð¯¦ h Äl»ÜÇÜÍ,>(Á|Š¶UàŸ ð*Ôã©mˆ÷÷ë¡âÈŠ?W£¢K° æÔèåb^X·Ã ª¦wÏU†ÐâGøUO¹Fo3H÷Øâ»\]÷>}1Þ5°náôÆß‚~ßuy-_íú’ Ýl ç‚Êm¨Ÿ‹E˜*‰~5 TØ$hF*€ü9öà™ ?ý3+Ræ‰gÇ „6èúñ(ÿÔí“;ôƒQ^á—†¯Þ(=~ýZGOh¥¾MD6ËÒiV¿žcëUQŠKÜÉ/6:G+^Kyq"ÄpÐaŽæ­|Ý5ŒÊšqk„OOb쾞ødýˆ¬H£n¸Q‹AC)‘‰Ý±Å€†ÕŽ¹`ãôP?¥§§NbŸÙúï0¥• —olLBßsü¡n'ŒÊç:º¶цî’z PÔÀ0‹‚ã¹ÄâÅ‚Éh¬tôÍʳò)z]¤ßEÒfÞ+ò]g˶üuD‹KyÔ6ŸÈ!C49ZŒž“D³Åí?ÅÑ— ÚÒBå Õ _pD6 ~ÜȘ;M?HûÖø™—Ö%Šb8†N1µj‡·>ÊVÝÏZ?ç¦Ì\ì÷VAüø¨ª1&dˆb¡£I^f|P \Š5ZBû@Só|h3¼ωÙ4LO/ Í…FßÒÍPA É‹ú¡a#aØšÓÙ¹’ “·Åfbƒk˜ï¿†[¡ôïVdq0ø [£ð––ag·¼j. +ˆqÈ7겓ňH©‚9­9ÎäÏçVKíJº·ì(ä.5Þ»îÇÆ濪€Ñ+aŽ}o­Åoé£2dÙCM¹Tù«iÞµçšÕ×ê_(‚ÃjΕ°ùø{™ü¯Ä]ãð?õuÝãR·?M`+ ¤üè;Â2'€¾¢)©M`¤O+*ø<‚ÖƒðjÝÉH †Äßò|¬Gl’j#íPøé#à8…‰5‡Áaœþãk¶“ÁËö·âÂꜦÿ´P¸†Ò È&½iÑÒÀ+H¯7¨¶ +˜_-áÒakÝ«f¥˜Ü|-[Jø.“Jùb zà`€Àé«P𠤟hüüÆ ¿ +hn1R ­mèE¥r…üùâ¦ËȤ_+/ÉKUü|ƒõ¾†ÚcôÛ¾2¥i¯’qµ¹õSã÷-rrIÊܩÅvÓËbÙïÁ ¬ÐôúÅE’–GoãÇk~;'JÊ[ oFÆsB‹óÏbX³8à÷[W2\¸w¦÷Uÿ©l›<î>½íêp.ÕSüÉ"ÌøÚî”g·ŸBÄnþsîüÒ¹²n»‚-»7~÷…_ì™kÁhä>«Ï©®r‡6\ YzbÔ«'x67¸-c]–CÛC¶Ž/ÇgÍïökvÃmÚXJdÐ0ò>Øw‰¢·.ø®Ç´-Ôk?j¡íC†´Õ¢ãíÜÓ¨øÕ Î,çÉÀg%”—Ne=ýnA ¹õß´š/m(Öè”Hß¹mÓwQÀÑõ;ÑÖ8ª%5V†?Ý™RÅÒ©^\&^¨ÅÄ-ÓDä€ÇÞ…I6W §dØà>æ~ˆ !O&Chðá4ñt_9g§_#QýŒD;r”˱„¿M'é$È Ú]à©*{¸žRCŠ +|µzš•Ë„LM Û+ÚŸûWSÿÔòXÌÖ¢íÚ™~£¥±4BnÎe$b¨^L_T'Œ2 ·µæ’‘Úÿ^Áè#EYé-jÊðxà€Ìg÷^RˆÔÝã¬4xX±“°NdúŽ óR£ßvv.Ôz QÇùé&b8}…¢¬4”€Öó[fRõpÀ»¯úiúðÇàf–ð-ç-œú¢;—r5ɇ”78ã»!ÚåRp"Œ’ï†äÔ›Í秌ü!þ¶Êj=Á@ûëûÆŽ*œ\ˆöVùaE«$ylë|ïˆMÈlV_µ7ƒ!Bi°: KØÇT9¥Ÿ fR¾½ï‰¶YR÷t›$]W¾Ò¼ó;ÃÒpžÑ“Aìw£û½±®´õ}®YP¤ :uƒ‹i.±r.L–?Vå%—(–­àk"°x>ÐQ ض®Œ®øálUöûø5MòÈ¿ô¥°úq«¨5æVé}õÍ +» Õoã«ôn Ž«Ê¹*~J×Übþn½ìqC†„¾ˆúb;µ=X×½ÜÞ¨†c†üAòM¯…NðÄ‚‹nžÑÊàîd©j ³Åú;yðã¨ÀªæÐ暉4´ãîö'„«î7nqnï VÚ; +*ÈŸm_ •É-e©jdD ½kp~ChsyyjóÝ«ÝéÖAð“Î+¸ÆuˆÌÛùÆd¤„ó`®½‰÷ê·‡ òŠz‰õŽý17Ó0qXkUÉMįç•/àûâÙR²!d,˜x?á)ûá64ýìzÁ¶‡¬¡¬î$yûQl‘å~tÿûðËaFt]iÿÞì Kn*¹yITBþ§ÑÁà¼YÊ03lüÎôwqÉû=N¥OjMYµ¼_DíÚÊÌ&ˆrÔz€÷væ‡EùoJ‘z_iVIí ¸ëðÉÞ”WèIÍ~…L©)M“6ÔÚ_Ÿ–šã9ÓÖlPš‹NNW´˜ê/óŒ”à0±º ++«íÍ•Öfo+…äi甡¢;@nÔ(T9TçÒVÃ÷y¾/uÐäHFíš7ªjçþRìc§ñrºEÀÖÆÐ?ÎÜs:£JÞ]øêÏÄýÄ,-·ó¤¶"¨C©8öçÚqc§5#y)¥·ó¯Œj[$w•Aæã –$ªÄÆñª­ùðÜoBX¨¯š¶ç¸_%'`Òö!Ô3%DÃ(§¬^bp牑û¡tÌsR¿²ÃMWÀqåöç†Ïóvç?váXï"ÑÓ''†ÍÏ/h«Rò4„Ù=ËáÊX]iê®ø˜2·K¸hçM¼øùƒñV4ñ9£³Kõ†m£Å(B_úñ9ïòƒ2_s‹mxƒ‡¥Hhyo4Ì/ÚîžÄ·G̯ÝéÚÝàÁT­‘Æ’2†îB]ÓdI¯ol5ô”š™©çŠ¼ˆå‚غO;3+Qr(}ô| «#79mékòß9Z“šá%ÝRÖ´-ü(òâ±æ)ˆÀc’(=²*ö7 Êvû1 +ÖâªüPè«ÓÀ~K®/²)—–®y76üX¦=\Y.›.WéŽ?KSçƒs‹ÝæJîâR݄Ф¥žÄ°vÛæžÔ[8¹DgùøÝ¡r`Þ ©Ñxî(˜0T<±ßEŸF¢>&ùh£µôÐâQ7GÌ™ðèd ÁÅlÍ9ÏD@ ;Ýi®U{–MÉÀ¬©°Q'_L£Õ°UYõƒMq½*èf¯yãz±6ê +ü¬R”<ðGð»—ò楤TxÁ!¾«…¾/þ +´{#ôŸ»Òä[vKñkGHxx í6~~èÖ '=çùbõæȃ°Öõãø#40,Úè$)zÏ=†üÖÞïÛîÙpKõ:¿ã´3m +kúƒÔäCqû]~ÙäûÜ…¥Ä0ç‰)T§ž[:oS¼íŒŸ fr‘[Ùî´ÝÐ{*tù ”Ö2ê›ÊYúÝ?¤˜,-þz¡paÅÑû¨V®$'s7ùíß,——Pï…¹+’²GÈH‰m †÷Ù^‰}Z+WŒy˜xE6Dž×óµ¬FÕr´ýŽo‡€IÞ9h?U0ÕHLzmI@I¼Nä Œënƒê¦èhU_à('RqJ¨]J@ü¼wù¹„­oe©šï'¬»çEY²ïÕüÒv 5B?}`ŒÓÚä©õ“ÕŒ +:чާKÕûŒ‡íËMÐ]äÕ(µ†\Õ‰'/YŽ!H³bAXž®Ú0ß,šÁõ¦ýãòjo®³ ¢ª7éÁŒQ bOìxÕµMÍ5¿ Z*­‘¾ä1qqA¤0¯içP²»ý>­MkØF‰Ý~’ôײWÛ"dE¦¦U“S†rü´$]]%K{¾ 5‘–í¶ýEʱŽE‚A•o¤â&NZtçlv[4­Z:œÑÏ4¯ÆìžúL¨ÍO9Œð¡DDýò˜YÔʹ2{ ϸ¥Ø×*âg—ÿÎï›ä,¿À°Æ’uÁt/Gùüñlµú¼‹Ò‡Q«)áâ@ŠÒìB«R·%Ôz\~:–-$AQø—–Ô¤d ¥sØIÏY,õm0[$s—ªïhoà±oÞ•,QqZÊŽ¥ò”ÜêNPç'‹¾ÛÞM…_´Ö5–zTÀ“íŒ_¿gjÑ¢œÕ`“b§(yã°û•ðÃgd¾û¨‘ï¡:ÜK©gt¤ÇÏ¥Yγ |Á®Àt¼éÞÌþ…˜í}ö£¶]äiƒ1¥(¢îYðI9¢wŽ¹©ñWúƒmåÐí¼°Ñ<Š«"úA}DÄË„ÇšŠsñ†Y½qMüÁ3,ì$Œ>hz^iBüžÇ_'ç¯Vƒ—_œTàË w—xpNÕ¢l(¿zÞÖëy&šÊ fÉ·²g_ÁÐïÚ]ç:Q¹Ñøæ±ÚrsšœD¼')šBU1†dä¦'·‚³p±gwJÍ54ß„ÆåÇ~‰ê ÐUÙøÁ«ptê=ä"ø”e©ŸSbçü[Op ®¹#Õ0–Ê”c~·€Ù¨8aÄþGsï‡æUå5×Ö€á›V V‚»oÒ=m)Mw§1·ÐkÖ<%o5åû€y—&°m4ýíLsx ŸJZt߀´aYÀðÔ ÖÜ‘SRÍû§r×7#í«ûPwì½.}Ãhß}S&ìê–P;TZN™Ó{{Û^Ï ¸¸Ñe ®ÑÀ_¶ˆüð¶ÀLˆsuÜnc=êµnÙ˜ŠS¶˜"÷aoò‚è©G$YÖú‚œ7q›Küb»DlWú"5“Q¨eæ"O䵫3è°UÇHz$l+‹Õ­c‘w+‚¹…ì¨íQqcü`=™"£‘ÿøè,ÕØÔEí)r“­ )ä=—!'°¢°•œb2Cár45ÃÛiþ¤¾}vœŽ‰:`*Cÿu¾›³‚&õ(Ô ¥yG÷©ÒÜ4‰*ƧÄ3ôŠo5î>&Ϊ +¾c}¼ÁR× ¼Ï<Ù죅H°ài  +'É¿'L{qaÓÃøʺêR,³«ceW6¸±äâÏßË ¼=ßLæÑϪwà¸Gbo Cùã!ŒlÁ36òتÖßàÉG_ª(~G(`5Å4ˆECS&¹Œ5Ø{¡Óû÷Îi»ýˆ!ØÊéàoF|tÅ&鶈SÊå67Š1 hdò.DR»ÖƒkQ´$/zÍ´^6XÁ§ˆÒïtg˦ ð 0'ä·´ ;³FO£ºø†ò.Ÿ\!I•÷+}…¨6DÏ69ÓâqëKm!û(>;|òíJ0Þ´^qñŸ«¸™a³c˜!˜±RÚ68Ée¿<:¼ÁÑ&­;¨[XGmM½}‹YÂKMc%@+zjä×S7ú©sú¶„«öåL¦(÷© ’ò6ûÎÑ Mû^å¾ÛÜÀ9ø*ˆzŒàrà®çM„7%’Õë:æé̹|&¯¢ôKîiü߈ȥSØo¥J€5Ì&«‰ –á Æ“ºŸޤ鱵¯ÆNJD1¥NáKq==W­èˆÆŽ›-Dÿz/5C(¢CÎǾT‚öçËz·Yf²^ÖWùg#XʦýÀ„éîŸ TÎÆFäÒ“´K¡«´ÄÓ¼#ÔÐI[L. EîÜ"âM[(+©Íð_ÞÅ[ÞÓgº •e ë=KÅüB9KK±àÔ^(tíÍ ¹X¢ðJ‘µŸš9ø*5±á¦7bƒ°dÁggZ(|âÖt¨ƒ»¶¤!åÃ7}!©ËÅ47^F>øK +U¡…è;b%IBµ×Oß^x¹âFÓÈd^å÷üðÉLyÖø3{”dv-g<(\»¾µ1zÐønQ º/­ÕÒ5£8!‡=‡¨^‰²®š²Ý³½8&úŽ.—jWåï F‰šº1"ph²d’ÚBÝkááã’i…cC$,Š îv& ßZ¤C£MVƒ`N¿3 þ”‘Kkà{Þ°»íRA—rÍxÝ×”Xõ[ùÎU×ÔÜ÷›;`&>Ü25¨Ý ¸\êu‚“]çæ˜1—B£»4„zæÜ’š?WŽèüTt}ŸQÉ¡šÃO FJ˘t¾ˆuH½¸Y]¼% Ï+Õ…Ñg0#0òå>Ëõêªù¾_åb¦£Z¥ jj]${ïs»™÷ïŠclôÕá1\þÔnM²ôï[`0GÔ0\žº‹ûßy"]b÷|a¦¤±ŽÙ”ر™µôÑI5I#¼í·%À4Ë튢°¤Z)€q„Û¼r‡ËN3—¡W¿·-O”ù&ÎxVœ¼²Ä”î Kévé‹©“m`Õ5Bâ…Ö›2Û7Ç• Q¿1ý²ý©å0o"ä}7bŒ|3`Û¥.IEuuúá”ø:ôB~üfôW Åx ²gn)žrqöƒ«ÈÄ¥FØ ñ;/ß*¦Ò!Ó!·Ô(ç±°ï¦XÛ±s2Õªri\æ©Šº#¡ùè4ûcƒÁœÑ-Ù.Dl;Ñ8¶ïaŸw s¹m¹C7M+H¶ååb!X¶Û³Ùéã~¦Í¦äò¿À<§.€‚. ã²Ô¾ˆ©KjL±>c²F÷˜~¨èûÀLV×”5¥˜cÿf +)ó¼f€òÐCÌØ—PEë&Øܵ.j9|í† yÄh:ø‚/„*¯`óƒ)ñ:Ìi;þ”“¢Ç o?>ªgrŽ;i›1[iÎïão÷½2Fku?°xü[Ô×¼E¥Qò³¼*ÅÍÕA§3k¹(÷P~ÃÚ£bt…¹¸a¸òÚ‚$s‡£¤` ôP²ÄÐòÓךTQëû*ìÂJƒ6@´”~7ÀJ‰Â[BÊ ©Cô0•mÀ›qÌP\á!ÔŠïQ +3 +ð¢I96ÃþÜ¡¦‘ÀòÐf€11³oÓd]ËÁÜ -ÍdìY#Å;mæˆð§ˆ†ñgµµ1ÒQ2Ðìr- +1û:©%-U-LEN¨ÎI¥W-Ñ$VÍ·Ë×øò¾'“¡lþ›®ßá“ú%Ñ +SöVF£®•¢™—)ï­˜eÙ’‰ÝǤß0 :ÛŸT´t[ó"Ñt&o7í9ÆQˆ^®ñjÉñqVäx·É„$žMhLè¤âH› sÓëÆbÕp“dò÷ ¾ öHÕ.W\x=R›£¾Ÿ!|È|ít±Àsû[ð+\ŸYWœrõâ›K2D•Jí_2õò3LCÂ5Hñpª,U•*vì?¼%‡;ßDÔ3Úã÷·sþûHâ±ááPÛ=—Ð…œBŒ€Ów¬í« ¨²$¹ù [¹Ë,-µUPóiH"Û9Ç(«sæβ·2ù%‡ÁV"Zø­GÌ*``GvíåÑš}~íòÃýœ&ꮤA 54LviS|vâT;³ÞÅ.k²‰‹Ü@ T,,¼&¦Õ ÎÖÉg›Ñît‡æé¬Ò¢$EÉ`Öå9p©O0ÕÆôÆâú¶›§O6_½êFBE_ÒhvøÁØÛ"ê“œj§$ã=»îY%g Õ²œŸŽÉËá.;b!0??÷AñgŸÒ5†!½Š¹>=!ô v™@»Mˆÿ‚Í +!l'‹|afj¹:$j•¾ðÅeÅÚHØlåI×TÍk/UZÙV*ÃjÃNêpS ™¹Z±àHÈ «]ÏPþ]<­…õÊ«L‹¿O%â&5T—3Ú¦øfzÛû–PàÜ 5 RÚXJ¤÷X§"&’Á CSz1¢€ÖCKÞL0.Šp÷×BÞM™UíáÌX&ølÄ+‚1Äg)ŽÇz q;FüØ +ù×N#¬¦ƒ¥ºÞ§lEž9¶Õ«ý—NUŒÂgÞµK5¯’ɳª* ÿ@ì­q*—¡šÝ~³Æ/â\ ¸¥œÁ åý ;r Õê¨ÓT®à-/‡¡ˆ¨¼à¤î€ro<Ê„úð{»^—(G”0qæs)WæqÖíKLŽÞдÉÌÁBÌp‹Çpgì>à¨ãxÅ2d€²Tâw¦:Ò+Œò{ï\ýF›qò£ºsœ|îX‡¦ã²üF`©qîi¿‡“äí½­¸T¤p´ŒÝݵºE+8EÜcû­T7­çžàF»Ó e?ZÆÝVŸIZlئ¯sJ¹˜růÞþ'`ÝAZŒäÌÂä-“3=QzÀäk¿ÀW²+Mj¡Ûÿ¯ùþ‡‚aŽãÈ&äqÙ#¢¸Œ"’™™=_[²ÇÙ{t²ŽãÂS莬;îNVFæ =â²÷Þ„'<ÄûÛûy¿ÀFƒsÆ’Mºè5}^º¥¦6ÈŒ–Î_çQ•lÁíq/­·ÄêIÿÉ+rD)ÙÞZä™ðgÔ[=â`²­yœ0âÂL¿&¨ + +šïð‡n0IÔ€Ýü,š]–ì*!f¡ +ûÃñAßfóÕkÏêžÕ“{\Ó7cM•pÒæjŽ0QóóÔÖ¨{^&©ÂòQÙ©Šd¹Ê¨)Yt°D—ÝòQŒ0Ä|j¨ŒQŸ“˜Ág%s^Mö<55H³mȱ¬–½¾]C÷²¿ÂHµÞ>gÀšçTùÔŠDFÛJËàÖª´ù•†)©Š,6[*3.)]ÀÀ¿ü\ijgVíª@>¹BõÓÙj©MÝ@ôù¼Ö[ÝÅËŒE4¾@Ü´÷µ¦–´Z¢¬[Dh-Bï= àûîDºhÖZþ ào*‡ªÍô®Ë ½I¸wi#¹ã;þSÝË}ü&¾sÓ‡ê¾w'·AIŒã9OMn%’Ï°ÍÓxJÖ6zÍ®ÀK»å×£> ¨Ì +‰‰¥%Úûª<çŒââ+ £Çö³o{!äÚÒ×M…VbÎhzèCü÷8_0>0ì*¦+„íþÌ‘t÷…@–KUK´ÃåW+M§îPJ}v}5}Çi!áæÓý‡M]Ô~ë߉H¨J# _4ûÚMa]ÍEó¹ÙgÙNþZŠk@ÇŒ²Uø—ÝÑ©2¶ÿ3,AU殀íའ:µgÛºáL1Ù +©Å?Ö49Fd¹k§n™&ŸñSõv”E’Prá÷К?ì¯7º—ûH÷e©ï3ðDî4åÞè‰ÍúÔzq¢·–§œàC$] ý_e8µ+^ñçaGWþ`³c+Áä$oåŠJŠª<ÍâdtG%$àã‘78{Bì½(1d³H*µåj"€ Ë°_"ßÀ—†R˜¾1“Ѻ7‚þ²¾™&®,}Kobµ¬²¯ú™Wþ¶ÆïÍRáð÷bÑöóá¥å¢~ž£E-×)@‡ùü‘Èéheì)õóAîEDè¨éʧŠO­gîÛ‚¬y<·à×’#ùÓz’ØLòj…(¬hÙ +“"kÉà¤Nô}zøˆÒÂí¡Ï ZÁÿ‹7Ÿëð›ùüUΠ&‹Mc|édžÇ=À‰öG#³©[ƘßS¿ƒ¬“TDÆ0 oloº,Xxvˆ>>jzeçÄ8M¤¸j´ 92’½¥9g~Yé´UM¿¹E±Ð™Kr»)Q¼~÷Ë—ØîB|?H­Å^J.¤•:tÇ Àv×¢~¹7<ËÅÙ· Þ3”u:Òõþ]ïfÞœz»½¸”KÞD—ž¢F¤3©m}­á©n?(#€û;Ù-œè½84y$‰Fqêà7¢˜ì^Ù#2 <˜™eÏR½濎ý¦/„vÞÆv°=;à rášq|½I{ò,¼.‹ï ~«È'.t†n£ËZ²µ˜í··/£h¬~¸Äß>·¡vó¡ªÿf$&…E|w0£q??fþPë6Aä,5`b`öUO@÷Ì^2™óãyþ$0„Z! û@Z6%l¦TÙ3å…Y½8åݯ þÍþ]¾sÉð rcóáÙˆ÷ƒ¹sž€Õó$Ìj:zC¥zs¬ GÏÙ4ùc†*ÆŠä«r“^E&¶O,Ä~òG©6 ¸$1 [âäk¤ÞéK$]ŒÝÿ K6?Rã_Ø ãc™ÅC  Vzg°¹ðNS‡Äæ¡Å¿¼z&l~meÙ.Gß³Í=Fi]dU­Ih²yÆÙ|hhÙŸh=¯–ÐÒ$c{·Þ®Nžë7$]žœ®×ryRzF•¥re¾¿H,)6d9çi{ÔsȚ̲¨†@Z–ÏŒžíq(I?P)ü¥EßR{‹’EñƒT@tZ~¡8y¢ïýRÅZüuAp‰”Æ-3æ17HWVýrÝ[ºQÁšGh×{j»g¶$ìÅo1iâ·qi¢0mñ„3ýeÙ#ÀƒCø,X»ŽEt^_8¼…úý% +´údwÞL<ì!¸xwë8˜b[áÅß±²I+—•ðña{¦£r!1ñ”ÅGºÝ ùíö³[Ût84±¨"±îø¸üΘm–»šËíI”xŸ‹è@»Ü¶â9PJßr,€ÔRÁ!@òîYQlø'¿^cgV’¼4Ì^1R¬Á1ÒÇÞhâƒ; zkñ…~Iifdaµ„ÚªRœ>BÞ“²ÅRP뉼¸67 + ÓÏXà_«îÉ;¦NoÔôÞ¡¨‘Õé Ÿ$TÐŒ k9·óªþèþ5÷Ú#QÑA¨D«Ô—§(­hÂîÚ xë…v’‚—1­ +¿Çx B‰ãþe¾´k\ÚJwP­¢üæà9ëÝmŒ‚êý_Ê'VÝÖFyNåú&RÀ¡;p{ç\Ë?r9Ú4ÍÖ—Ò|3 ã "bɪ32ÿ%úÿÿ«›s`°¿¯s 7ý¿AU‡¸endstream +endobj +3242 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 6709 0 R +/FirstChar 11 +/LastChar 123 +/Widths 6710 0 R +/BaseFont /CETICX+CMTI10 +/FontDescriptor 3240 0 R >> endobj -3466 0 obj << -/D [3463 0 R /XYZ 85.039 667.044 null] +3240 0 obj << +/Ascent 694 +/CapHeight 683 +/Descent -194 +/FontName /CETICX+CMTI10 +/ItalicAngle -14 +/StemV 68 +/XHeight 431 +/FontBBox [-163 -250 1146 969] +/Flags 4 +/CharSet (/ff/fi/ffi/exclam/quotedblright/percent/ampersand/quoteright/parenleft/parenright/asterisk/comma/hyphen/period/slash/zero/one/two/three/four/five/six/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash) +/FontFile 3241 0 R >> endobj -1274 0 obj << -/D [3463 0 R /XYZ 85.039 667.044 null] +6710 0 obj +[613 562 0 882 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 307 514 0 0 818 767 307 409 409 511 0 307 358 307 511 511 511 511 511 511 511 511 0 511 511 307 307 0 767 0 511 0 743 704 716 755 678 653 774 743 386 525 769 627 897 743 767 678 0 729 562 716 743 743 999 743 743 613 307 0 307 0 0 0 511 460 460 511 460 307 460 511 307 307 460 256 818 562 511 511 460 422 409 332 537 460 664 464 486 409 511 ] +endobj +3111 0 obj << +/Length1 1411 +/Length2 8632 +/Length3 532 +/Length 9503 +/Filter /FlateDecode +>> +stream +xÚí”U\Ú²æq÷Á&hãî‚»Ch ‘Æ‚{pw·à‚;Á‚C°à®0½÷¹÷°çÜÇ™§ùM÷Kÿ«j­ï[µj5=µª«„¹½)XÖêÂÊÁÆ!RÒPä`p°±cÐÓK9A.{¨4È,ààH¸Z8ay^AnvANX@ÊÞÁÓ biåx#ÅøW@Âì1AJ +°l3-@ÃÞ vñdHØÚÔÿZá P;ƒÜÀælsˆ™ Àl bÿr$µ°ðý+lîêðß)7°“3Ìà Ì$#fÑÜjë 0[`•íaZ`˜“ÿ¦þssYW[[eÝ_ÛÿÝ¥ÿ‘ÙAl=ÿ«ÂÞÎÁÕìP²7;Aÿ³Tü/sJ`sˆ«Ýfå]@¶3 ¨¥-À*ÀÆÍû¯0ÄYâ6W…¸˜Y,@¶Îà¿ã`¨ù5ïo@y }yæÿºÕ¿“ª ÔEÓÓ `®þ›9žÖ#'ˆÀ€Vûþ÷/£ÿ“šÙ›C °±àလœ@ž°ù€À›šƒ=`˜c ÔÞ¶kŒ/ÀÂÞ ã¯KåâÍímmANÅÿqs€fövv çhåé`†>‡`ë`7joþâmAÎVÏ~Ð ìdÿí¡à3;èâþœçေ•øœ …½ë³;.Xâö +˜]gX³þÍ0³Î`·x…5ø¯ ÿwf +ù‡^Ø"‰g‚-|&X±Ô3ÁÎ$ýL°Éü›ø`Ç‘}&Øaäž v·Ï;…ü3ÁÔž ¦®øL0u¥g‚©+?L]åßÄSW}&˜žú3Áô4ž Ö2Íg‚©k=L]û™`ê:ÏS×}&˜ºÞ¿‰6žÀç†rÀæý²öÿÀ¿.éý×íüÏ—$)iïáÍÊË `å„ '¬_ì¾ÿ{¡âè +–—†M;;ŸÿßQ3W''0Ôåï?0Ø+ýo¶€ÀÞ5ì6ÃX˜³7 +¶NýZþA¦pò2£3EziðhWHcºÛÁªÁŒSó„&˜ò?ßR—r¤P4·àY'ý,á3à­ ù?€MȘŸ¡zbv`hŒ0˜Û߃k—±»@µåÐÌ|²H{µæÖ…\£¸ÇÁW@z‰T>?÷xñÁÆol}3Íœv;Ã(·]1¬ýk-näþPξÐ~¡xð¥aÆÕ‹? ¤=+ßm–±Ó¢r•gÓEÐÙ=,6Æ082m¨t“[gÐé–‘éfF¥/îRËsl¿XZòŒYéWÆK¢-þˆj${RP§ãu^¾2õ|£| ÷9Õm˜¨#’›Û‡ÝCX½¦·K”G”iSs"¬I×ÝšfÀm ¯©ÂpãNâ¤gaø›SR·¸—%Þ–‹Ð­$¡˜ŠïŸ©6¡Î¨ÖÍów~kQÅp¦Xˆ¢Õ•Ï¿®ž ö¹ž5´¶GòÐ$ha¶|Ê «Ñ!a¦a¿;áè?¬[ºP?Hó„Ôe;ùJª~ØAw Uãz¡inrä“á*¾^ívVÐRUÊÜà`[Ÿòµú®è.ž´ÓPô´S «L)æ +¡ÜOÊÍoÝ´k=S ’cê©]]6C*>Ùý;”ýT,´ÿ, (Lo5‘9Ö}÷)Úþ”óÊßg±‰ÿøÖG<$·œ§.™®:ȬÎì>(µóIšóõŸ5ßzßoF¿)Œ¥Œò@†á5BkÆn>6Ä^ÁXœ:ùJ;¾Øßì/€q‘ªŒAíp.|›ª¨ékÆÓŽŠpp§èÑ{¹l­_{z¥“Õ'—óÒÊ„ÎÜ®ðÇ7DšOî|䚪&¢å஼L¦“ߧd^õªðÉó¡˜åɹÝȯÌ7¡¸,pjJÚ*œü4ïÚ Àâ nþBæÇx²@/·!Èâ¡V°‹þ{¶ÅCõôi¬v±äÒºÓ÷ß}Ñ9æV!ÑßÔÅ7±9*_Ìõù2æîÚ³ÏÛÀ fÆ/¸aâ™[!ïá|}Ћ²)Î^ƒõv‡'£¶×*m¬ŸdËæ) +îJ¹²ƒ©Ç´"â£d+Þj‚0IùéžfýØ÷"w 7L’67YArx½÷Yp8ÅUšh,\JùÆ? }/‘fôâÆ1m„þh•aFœjŠ¡tŸ@àê_[Yce2?dϽ‚Î[ñžâ&ˆ­yàñY”oO‘E(–^pïù}“ôüY¥¯ý)òŽ­Ú»bIb„âÒéIn~ §pÜ uìÍüì Ä©°n"ªµï…¸bç:ÔLÚŒ<y˳~ª+Þr.']Ìt䆊÷Œ~ÎFå‰å(žÙxóÝV|ñøôãæ}#†'tR¬@Q¶g#nJÒ_#ÓV´î0jkÑMK%]ùƒÞÖòë6!´5ì* Q”øŸNï¥k'wvåÍCý 0Ÿ*|í4ò³òð4ÈH:-·Ôç¿ü¢½ü‘t^ + uå¡%9ºÕz»6q^ÚÅãË´»Ë¯.OX†$ò‡›1ú6óüLš oºL× ‹|!Ô8u¡cý.T+{ MŽÊçOhOe=ìËKB6É, –½%ŠéÛFæýŠ®Ó£Ì1â¤AªCä…á¥áãCÖGxQˆÝ¥XZÛÖn8Y#¤ê£N¬?LË’ïi‰¹{J¤@ª¹“XD™åTñê>AémxÌyûò£–e?"2Ü\$' Ô°e…‹(!zækQ` :=uV¯Ì*°ZíÚsÊ~Aå(°‰–Ã1 ·Þ‰ÜzP¶ôs +>dŸ^ýDù ÔWSü b7wŸ¶Ë¿”¹:¨>¼Ö*Ì] "Ù¶má @öôqÐ[êPoïI"ü(ö¨7ý!.“¡ªîhÎÀ€òÊ"`ˆ>ͼ>åPÿšTR‰YL+jö.¨—åHn­™ÙçÃÓ›¨óÒûA[k§óM#“Ùü…©*ÐÛ%ÇÛÂÈÅYæod8‡TÈà‰±’~RXû ¹ääIÚm•É*èKôWê´„½0ïFÀYær ADbVâMDQÌ9;n÷3¾¦lþG/·ÈEô:Ô–<ëªÊåüÉÕÜ|¸•” ¥‹Mnª„TKo›‘Zþk”©ÕûYö>L5 +ý›‘’#Õ`é)…ТK -¢\hg}˜hØÊËI›×.©Á¾Š$¢ëH1“#'uJ£ó›X^ï­y šd{éViQ Ñ£zð6UØÒ¸-?âRû¶ô|.ËJB<òµ0íýÈãùuPîþ‹ô …QQ¯75±IZ¼£p1ÎýJPÕêÓgNé,uøft²Çõ±qV8B¢”xýä„nÙªËz ôÆ÷¤MÃK¡ùy‰¡…É" *•—NmQ[2áþ¤qôõàn9µ„+ªN½·ýÎ>¨ù,SSçêÌQî|$ÔR¯®Y82~]_Ü(EôùkwΑM€ÜÝ—›-ðACn¢Mf÷Vë­.pÙ/93òÑfö`Õ"¼†5uÁ•ä¦@ªò¢¨OäèºÔÍÛáŽÂ„ú©mHÅ&¬„¿V®²ùËèðºøw¼‡pGh˜—ɸÔbZ“ú€JBˆ¼ÛŒ¹ŸÚþ<¶.kf&˜ýöÕå >QîXãᜮG,îÆ÷+,4ÚZuœx`\W&È^N¨±}EM‰¹ ƾ†Ïónå ‡”¶Êpòìz}ÿ!ÓQW¥Hß{ù6Üüg©W–[wÇ‹F3Õwô ”¢Â ÂKÖtá*v¦¸ÚaU¹W¨¶›®ô÷¢£-Vp^o+)O“;e›ø,þð¾¹ÜÖJw™9³bN¿ïÞ“ú"nxÏ=áŠT¿Œc1%;§ ›ÅQ×v|U$åðÞpK m:¾ÎºYe?›uRDÉ5úžõëißO9¯Õbl‡°ùÚ&á´k=Àz$³Éé¹Ù“ÀÈPIvœ<7ãnŽ´û‰ÿ¸Ï¼¥­†Mã½mt•Ð+ÁhqºLÖÛ¤¥u¦Ô²ˆJà÷"çJÅ{ýhÿGÕ™ŸDäþuð4+-Ã4–aÕ«ÖòOùšX’T7:Ÿ‹Yôߢ]Æ•Z­P +ž*4˜ëpµ~x˜`²Š)§¤L'zS(J$¸cZ={”U9Û½ ]Ò`îY£ç7!¡ fî#6¥Á“¤ÞY"ƒÓè×R0švÄÔ ‡3‘³£˜ô™+dÑšpÀ¸Œ¯ šxI¼aˆéÇsÊæ\²]3;§<84Û`bœCíF)‹•xRP5â…] ø`€RÍ<%¾6Ú}ƒ›ñù>êñHÞ`¿eñÞr=ÅË¡"˜Eê.hèZè$Þ—P M®0–ê‹8| +éË™%ôE)ðgaÔÉGPOI¹êŠçŠY3å%é¾îöaIÅàñyï$\ØÁRX>™¿³éé×JŸ‚ˆà'´(?UIo¢FÌýc7‹»ÕÒ¸±·½(;—ûEB­Éva;¼d=7œ±*~KÅÞm‰ÙÍ”ø¨fÖU z*âaÚý½3„UÔ(&þBò_Ú‚žTH‰^'æù£’˜Àw þIÖv->Ò9m)/þ?&žXMÛ"é-ºI³m?ázµ8Mܲ^™Œ§ ê^À-K…ä¨Uò!Ø›!êg* ÃdnÒŸ‡0Ïã?ÇŸÿäY3Qx?ldy²*>ãZÕ[œÏûV„ƾyšù!léìEP+~IþªŒÄ7q>ñ„½zäï~£ðëß«1Pƺ¿ÔËsš6(HàÒœþÆcižÚï^û4&šÎíT%[þØì™zÝoAÛGE7ÎD»œ«¨kÇEÕ¹½uÕñkóÐ>~ .¬CÖ0Üá^j°áz«ñˆ¬þ뺠-œÇËo.lò“Éä>Z‘õ,¿°ìž„8שïÄ2Dªù^5˜2,‚š[6Rè$•‚Îv6ñ­²Ð.âìÙKÝ}6™xͱHv +1l˜üíð +Ìt8³&r Ä„õ—ճൽI 6kåW 1ɨ›’G]&µ–§"jìQ’(P˜m;)ÔÔv9€_ÃWe¸û!‡.iÕ•¦CJQuƒŒX‰ß$E ÷˜LÌO|_·\¥I~$›û•µ¿r °{DZŸÝ¹ FËÔó +¾÷°›B.Ð +v™È-±ih}°rŽºÙð#ÞâÓ2…µÕ7gí¼GŠŸ+,ù‰©ç#O—Œæ¬Zñ×&>°q³Qsd™²v˜*ŠÙMpñ0kHßÎ}YÜÅ_Â^>Œ×5aNóL†&z+fFhQaç òUu4îâ%‰‰á3åÇ0÷›*}ì!ȉ€Æ’1¨G{#–¢%ûøˆæ21á®^Ï'bZ-LŠCóÞ¿ì5¸6|t±CT–À‘Òy°á5}3{Z÷ª‘\çêЪs†«›sÃäØ¥» +/¸:^ÓRé_p¢¸Ï»\Yº"v$è_‚D7”•ã¬~»TÜÝKúiôœVŸ•ÆÚõR!-àâ( k[ Aâ%î:Ãw5ÚÑqùB}ZHžâPåëå0Y1§zšýë×ô_WfQ.ë#X^~”>fìœR± šr’È Kü þô¨•õfvÙ:«þºô˜÷]€Û[Û"¯¡A9’¾{9¯¾Ï“íì^4F@­™,ß\—„®¢ö£ûM“]t ›hZÉ +áeºByCb2æÎm¿òð’ð]ˆM¢&©§Õ>ÚçÃבŒhOç¤É‘´ÎôqÜ»¿´¤nWè䬣ÉwÑ"INµ›Áµ²}bÙ•–q©n}s¤¹TäPqÈyŒþa-Æ‚broÉl¯«ŠA0Tî© õÀÑ®ÒQúþí ü•)O‚Ü{}]¯° ¶O‚x6?¼*µv™Hä7´ ? _í`X)0¡c‘6C¦»™<==`¡CìpÐË”1³néÈ5‚½¯&A<~,Èj/Ö%„女’õçÎ +¸æTk1÷S|OxÖ3­WèúšTWŸ%íy3ÄÓXA¬­Òš¥í¹ÕÄ&Øt6¡®r`/êÒ›ó ƒÚŠ(Ó %Œ«”lc÷®ûØÒ1²,ÚCßG,TQWkµ\DˆZ‡´í %…¦ ÑX}õD´°kÀ™CpV+´[|)§x]F CjŽZ½>çwÜš^×EÑi\L]'€äÇ1h:¿wxCÔ§]®¦M,Z£€œ'ì‰6‡æp'…ùƒÚyiMºøÕßaªê5ÀúRä0´·„Ÿ~·ñ?ìöÇße7¥˜ºB¶ÑÙ:2צËåÚRáé×ù_!H¾T¶-újú-A…r(…¤ã†ŸCÃÈPZ|MôJNÔL¬†ˆq >2‘D«ß-œ[OD•&³2éΨöCÍ—À0ð¬ßë±:}•ª‰oËÍ4çâb΃Ó±§fµ)¢=Ôiº_môUq%p)Ôl^('ÑVMV†Ï›¾º|bcDì…;[î*{0Maÿ ”Mú»û9;B/ÑE㾬*¸xÜ´ƒ¶fOT6EÄu²ÓÁ0ýuT܃x²d 6ƒLŸåÝ^.k)R‡Àio÷:È¢Xv·³!"ÿQÊl™Û”†—t~gšZÒÕ¤¤>UŽ/.ã¥N´õgŒ_ü¢…N¢Î{ñ÷c‹ ßÓ÷šÍÜ® qÙ×-ïè@Ùt^’6wê-Õø<ä&›<¸ã 4¯7ë®tÜêt’ãYÆ–„’ˆUûsW¬îdÑWRK´‡»DçfÕѯ0›œµR«»îU”|EÒCC?©øÿI¯šH™uÐ9ítœ¨:›!¸BáÊàáuœAêpõ=#ÒDx™ñr»Söªu‹0ª)kb¼•vÃä•KÂxÁûããòšrÔKvjîP½÷ÕVòà=8Ô{_"éÛà·Ú¿ªéèQRM- lœ…m)vŠ8|¾êä ,ÌëÚàÜ; +€ŽK ëJ­ṫð¨ƒKÛb.´–s袾ïÿÚ¾[)' pÆiŒ¹“̦ÐLöå¯ï)¾ŠV¼nx‹u…cÃ8Ì]”FÅfq2'›q2ƒÓTK¾(jS¾Ï¤ú}G|ÑS­£‡ý¸OØÚ3Å<ÞÿÅ/Öêi^ü‹ÕÛ ÔÙ×æ«Ó)§ö1°ÅûáAšV±lP –½ë£m_¥#Šn—£·ñzRW²‰¬!Ù?ý³›‹Þ]â¯WÓ›îûBB'1*¶-×?ã–ê^ç°l1X/Òüö‘š—èP|Çò7*ܵ7,Är£l_šNÕž$Xç«õn«® +kbåÐÄwL§rú–gõ|·SvG£÷Mn*›3.8HNâí [ÈÙÊEÂ'ñnô–œkÅՕצ• '/V¤Ô§×¦¯èºÙi‡r +FØYY½úå xµ_ÒD3Lo DÂÒ|è¦ÅŠ3>ÅÂðH‰_)Ê9Ó0hâ`óÆXÔªMë‘c˜0æWˆ|7‘~Ý¢MT)1dFk:'·ZkÑ{úPÚxvpfŽõÁú"'1~/µê +-Ì™ëì-.ŽÙîlZ-Ÿ#nÑ9ã×ÃÖЕOŽÊ^à¢ÕTvAÔèÊÔz!ç|}¥‡„*ŸÔÊS ]CB37b›Bh“ø¬…õ¬VëHüÓ˜l5¼Ä~ÿ£Z‡mKªÇwªGAº—[¿`ð9}.ÿøit´(ÉeÔÿAÈm¾Ø-²1¯˜yægï.ój¸Ýƒ#½+1õ·ÑÂ(MšíR{ÎÇ26ãýHÝÓ¨¦7ÔŽpRAÒÔçSØ9¦/ ðþ¬t’!Mœ´teRlàðzWÖû,=8˜lIw«27§ áê0á ƒ +á1dßtÏ€„&GöÍté=¡1yBQJÇÔYˆî®æI5Óóä¾ÎÂÜÇð¶”,#B™¸cÁïafÙî|¿fq"ˆî:-ö¸¸6úé·Ãâ°èNª#×}E8€€ ¬V…3sEDšúÓ²“Ñϸ}<ŒŸ aüŽÝ,Ë)δlRWÇ$·ÒwßÕv½)w>'Æm-覫IR±:‹p`‘ôgîc}»§OÛ-¡Ãz}4q‚*Ÿy²±…ŸþA„‰ïè)?k’WÒ`M¦Ýâ²´xºdÕ¬í®­%ÉL ò"Ùòù¡L_-ò +Ú~DɅǸÕÃ~t¥;9Ö_é³mPÖMÔøí)Js°ØŸï•1¥;™€†„¿û æ÷U]i~™æï˜2 ú3{7yó (VÞmf£Õa uÞÌ(ï"VŽÃ= ê‘lÈÙßCÁ±eñþh[`–­=—G(7M챎tO7ª*J5ªRlGŒž`.oÓ ß Íaà +ó`u¦ 6û!£#‹ªú¾• +S•Ô}"$­—'B±srX´¼D¸ñh0¶­è˜M…jÛ”·t‘–·Œóöt((pôqÑ\å¬à í­Ê´Ø¯†…¼ãu>ŒÃ噲sµ7( ÎuÄoÉc|槤h¨ +}ø³9‚ºº)äÃA¤z>eÏîÿe17›ÿ…3Ö}Êi€\ý• ‘4§Œ$úm&ͬGc¿.pî«Iø{‘áº-`¨.úD™Dé*sÛÚZ’WoÞÎ Ç.­6kclŠÄ’.¼¤šS4…OØÃb®€`rÄE6ŸÕÊ>žó£k…5Šgïž)͈Od,ëYçÛbi[ŸÝ\D’zi^c·êþbI—¡rc¤/bCÆC(}Œñs­¦øUцÁã#H¶ÍirÎï†/2yƒ“`b<ìq°lÌ›p¬ú¸øV Ƶî 9É 7‘s­+¿Èõ6ÏS$”JºhzB2½¥v^Áä·æPŒ°ZPÕÈçUµ ÉNÒG!)æ˹FÚü”£jU ÃIû9 œWI‚ÏÙœ©Å±æpI%³ D’­Þÿi8Ö_’oš£²{ÃÖ…`bÅa£øµ Å5‰±^¨;oO"ö[^Fðãt"™õŒZ¾ú54Ç;ÿ„  ‹Õ`Ð(jÚT†Úºäª4{0­6‡UmeÑ)œ¥HGˆ«®ZË·XüļµÑ”Ðâ/scžQÂ%Õ¦.¬T_T^2¾0§7Å’Ñs2§_„¥' YÏ~Š¡@ÿ$•Ÿ¾ù½ËeÀLjZkìÊ7à˜—Ô3 «öÈ}ÿ\]7úËÇo´^Û’ÄWඌŽ÷GkÊ#ˆËÅ4ù±$. TüÂ2Ř…·Ã¹²‘o[Îû„t_øËå‹þ1Õ›¬÷U†6àžQ·Õؼ`Ít#ÞyÎÇênu$\³‡·Ú/sO!JŸ@šËšAÎB‡‘™¸Š´ÞMO÷ùò­OämÌï`¬·"ý´¦ñôbÁÍÃR1Œf$6 +Ô A[dÓ_?=bx4°ÝÇþRž„Þð5ÝØÉ×ÈÜ4¾rEàó¢tÆŽ4ŸÿÑoZZiÛ»æJJÐDZ +µû ŸP:ûI>6p3Y{Êâ¨í!OIËE¹¥rGÕäXNµSu‰¿ˆ Ý6;E°®‘Ù£Ãj gPåËBU9/99ª^teJœQKe™ßkÑ«58ùZ:×>€™§åywz„Èëg¥kO}Âó¾Ver¾ñó{>.ªrÂ_Iâ‡×¶Wô?øgC’ÙZ­†79oÏœCâøsÂ齓½HÐ8áòÓúÓÌõ=RŒãÆ°m£P¬v±ª‘šWžX‰¸‚±ðFµ¡QHñàý_áspÃúIYÝ›k9¢/ßø"\oÚŒÓ6ˆo²kÄœ¶•\¦õó'Ø'dÌ*MhÅÈ5”qyÇÅg=ÖW‚(“{ªsÊ™=vuÄŸÌ‚ÿHŽ»Ù™‡;ñÙÒ¹Ïõ¾ò@c +Þä?&]rk¢ÙPñƒ¥¹“—I­’O¤›úüü‡o[²~nDM{¶÷ N%ê +É®i’[nKS¹vc~ÖL‹ü’ô© ŽáÇÀà7“—†ŒÍܵ•žlçO  Lë7PÏfÙ”,°ïÍdâ1|ZDJÓËÊäÇz`cØË %(½žÿC…µ$Šôõxý/¸ðA4k8£`æ{䊣%jšïs<ÐFwØÿ?ÿƒÿ'60³ƒœ\ìí@N6ÿ _Ãë'endstream +endobj +3112 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 6699 0 R +/FirstChar 36 +/LastChar 116 +/Widths 6711 0 R +/BaseFont /WISZIO+CMSL10 +/FontDescriptor 3110 0 R >> endobj -3467 0 obj << -/D [3463 0 R /XYZ 85.039 642.326 null] +3110 0 obj << +/Ascent 694 +/CapHeight 683 +/Descent -194 +/FontName /WISZIO+CMSL10 +/ItalicAngle -9 +/StemV 79 +/XHeight 431 +/FontBBox [-62 -250 1123 750] +/Flags 4 +/CharSet (/dollar/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/R/S/T/U/V/W/X/Y/e/n/o/s/t) +/FontFile 3111 0 R >> endobj -1278 0 obj << -/D [3463 0 R /XYZ 85.039 420.224 null] +6711 0 obj +[500 0 0 0 0 0 0 0 278 333 278 500 500 500 500 500 500 500 500 500 500 500 0 0 0 0 0 0 0 750 708 722 764 681 653 785 750 361 0 778 625 917 750 778 681 0 736 556 722 750 750 1028 750 750 0 0 0 0 0 0 0 0 0 0 0 444 0 0 0 0 0 0 0 0 556 500 0 0 0 394 389 ] +endobj +2897 0 obj << +/Length1 793 +/Length2 1151 +/Length3 532 +/Length 1729 +/Filter /FlateDecode +>> +stream +xÚíRiTSבª¡¬2©¤j=,Œi† !¡€D EÃ(ƒÄÜrKr/^n )ƒˆª²,b£KFQQ*¬*u@©%V¡œH«X>Rµ*Nï‚uu•þ|ï×[ïœ?gû;{ç;›á.g‰a|„c$ bC" “I!. Î\.Á ‰âX ‚DD +=Á*ð<W â{ˆøà©MV“À-€9I±!P¥2©F´T ¥Bä¸EHˆ5°vòFX‹¤!D:³i`TI‚ H2ŠÑ8“š¤˜ +‚·0¬K}—JGˆ4Jp›’É”HÇ4#*' §º!”–ÿ†¬éŃtM˜B;Y~Ê©¿åZTcøƒkSu$B#6¼'C`T§ž•’ + ªcÉ° l8š„ê8%•j RhÒ)ÁàéJ(ÿ¦tpäQa±aî|íT2\bd„!Ü?ÙS1ôgL™D zÇes¹E¤ö»S´fL‰Ã(– x|O  …F ñA&P FôÑSŠ9l '©+€r&¨p‚6ù¯ž\ÀÑ ii“è[€8É“³G¹7‰ýýiþþ¸>“åÁ,ŸjÅ]á|nö_‰‘ºQ‡HŸë%ððâO¡JA 95T”mïbJ9 zDI3ßÄ•Þ[?Ûwz{MŽ¤ªó˜53m¡ñÈÖöóÛN½ÙýÞ׉Ɵ#~·ßfÿzÜ®d$ô¬â÷ÑO‹³L™rζ{“­³b¿|ÖCåp|âŒËem­hî¸g^<˜Úèþð×gwÓÏ[×­¾ *é#3knÝ|õ$'eSGŸÙækØu¨„–Pvfõ^$êŸw‹®N<Æ«psõåùñûŸ9¾6Ó[ït§Ü¶5 + ËdV7Œ>/çp™zU :²ØS*\%Í^èy=ªÜ,>ôq1Æø67…Ê~›=Пßï–æe—„DK#G«pPÖ,ÐøWÓ-‘úÖu-Z_ìbþ`ýš<‡”úNžO1”Ú¸—±6iüã÷%;g>Mxñ¢÷ù›BzËCe¦‹…ó‰Ñî^üÒÝ܇™í\ºõµ/L.± +õW÷H±_H¯ÍÊÂ6íO~ýYÍc2#¼‘ëtóè®fí¾h\»¯ücÙ:÷o›L{â%z aì%ì“þÊGÿºÔRx€—×›t6â–ûåÚ† UŽµù3LMAAUKšfã=þó]|zϵÇFõ.óÅn}Ñõ¹,þÄø¢ã"σÝ/½‡~.‰45Žñ\”c=´eAÊ.öƒˆå™^¿Y­M2tzÕž4ý8oÙ>8"‹µf_ÊñšÐšíZÃc᜽DŽõ «ò¬sOÅM?¨Êˆ"PçºéÙrfcý•ÚǤ]Qø‹Ê$6ëw¶¥#°Áã™é¼³Ÿ®ç{Ç'¿îö=²öPuæîMßZ±hÇzšÈ¦¿g@HO•|^’ófëhO°ÎÆ^ÒÔgÆî3Þù±l9wÈ^çêóÍRßzÝ…Œ­\ÃâÙ«"2¹šX÷Ëþ Ü\©­ubÀNƒ—ýÉnfg“Ìñ{éSgÌÔœZ¸=ˆd~u²ª$Š“3سò”§ ¹z¬R„É—JOk–[̸3sìI‰óà3bóÁk!‚†ò]°ßíŠðu£>w»&t¹ŽWF +:~=ã!SÉÞÄÉ÷&ÍWeôó2šºJØ•ëXn[Ï|šù%ï«Ó…›-æaÒpø;KuûöëŽWC¢lµÐ–h¡ž÷ühLGžÕûÙ«èôXáÒº1ýþºÒÁ¾£;/eD~˜oºëå\*)ymU7ÔnY˜'rhT6Öî¹XYlûI”&€(ÈS¶ÝNܲjXV×pb·Íè:«¸kn~ó¬…;7ÿâôxYº¼âëu¾çyéQç‚ø}~s¾w]\¤&áÄì“CE’êƒÉ÷$=!YÏý~ø~Ï:ptÉ“è³Æ‚üƒêÞ3^åÅÒá+â[­{µ]š¦êÒü=²¹5ëß ¶;Ü~EtÍÎgw{q;cÛ8}ùòuÜ©åNß’Š ÀîÂGÁ-«3`ìH hÖÛèÐæÇÎÍ—úwÝØ5¢Nlè¸^–û+)o O´UíŸEær|Ûf‹…V³ît5öóï’ªc$- ×z¾]³SðÒœÀa&±äÊnþ<ó†§á‡óªèµýÜÿpÑþ_ࢀRƒ(×*ˆÚ¿ß’Ñendstream +endobj +2898 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 6697 0 R +/FirstChar 60 +/LastChar 62 +/Widths 6712 0 R +/BaseFont /SVNYNC+CMMI10 +/FontDescriptor 2896 0 R >> endobj -3470 0 obj << -/D [3463 0 R /XYZ 85.039 393.913 null] +2896 0 obj << +/Ascent 694 +/CapHeight 683 +/Descent -194 +/FontName /SVNYNC+CMMI10 +/ItalicAngle -14 +/StemV 72 +/XHeight 431 +/FontBBox [-32 -250 1048 750] +/Flags 4 +/CharSet (/less/greater) +/FontFile 2897 0 R >> endobj -1282 0 obj << -/D [3463 0 R /XYZ 85.039 282.629 null] +6712 0 obj +[778 0 778 ] +endobj +6713 0 obj << +/Type /Encoding +/Differences [ 0 /minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/arrowright/arrowup/arrowdown/arrowboth/arrownortheast/arrowsoutheast/similarequal/arrowdblleft/arrowdblright/arrowdblup/arrowdbldown/arrowdblboth/arrownorthwest/arrowsouthwest/proportional/prime/infinity/element/owner/triangle/triangleinv/negationslash/mapsto/universal/existential/logicalnot/emptyset/Rfractur/Ifractur/latticetop/perpendicular/aleph/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/union/intersection/unionmulti/logicaland/logicalor/turnstileleft/turnstileright/floorleft/floorright/ceilingleft/ceilingright/braceleft/braceright/angbracketleft/angbracketright/bar/bardbl/arrowbothv/arrowdblbothv/backslash/wreathproduct/radical/coproduct/nabla/integral/unionsq/intersectionsq/subsetsqequal/supersetsqequal/section/dagger/daggerdbl/paragraph/club/diamond/heart/spade/arrowleft 129/.notdef 161/minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus 171/.notdef 173/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/spade 197/.notdef] >> endobj -3472 0 obj << -/D [3463 0 R /XYZ 85.039 251.104 null] +2894 0 obj << +/Length1 842 +/Length2 1048 +/Length3 532 +/Length 1656 +/Filter /FlateDecode +>> +stream +xÚíRkXguí*²Ð5«*ëG1‹€$3Ñ¡R…p1r Ä”ÛZvH&a ™ÁdI-žT*Ð Ô šDxDÄ¥rYŠÆ»\¤e»²‚(¶ŠÅÊ Û]ús÷×>ù3ïyÏw¾3ç}Y"±›·ŒˆCý œtƒÙ°'‹£`ÀlˆÆb Ô(Bb'€=<`à­U˜ ¾'òäñi, ’ôjLO‚ ç9x«P5&EpŒñ¨ŠÒ"J &¤JêÙÀ[©ás'4 Õ êdTƦÁ0aRÄ¡ + §qæ q9ø °L›ôª•Œª5”)°2é (‹2Wê •Ó8!uJ9ù_˜Z,î¯U*CÕœü|J?ë#*L©É TIZUƒ`B†ªñÅÔtÁ\0*ôªÅ]!‰(1©7®P¢À Þ̆6ñ˜ÆÓ¡2FJãQjÐyÅe‹­PñÍáïøùD»¾œë|S„`8¹KŸ„è'ö| ÿTS)©1ˆØSDê}õµ{Ñe~¸”a¸pyîQ«=Ú ªâ½0Àpª¨ŽrÌaãIT4©@N¨isc¥Ö‰GE‹’søq)LHQ%*ÿwxÓKxa¶ÿ©?ãÄ!ÒDÑÄÏÃ?ÃLJÐíuãz7wÊ »>Ÿ—úŸD ŽíÑ¢B_Àƒ h w!©V­Fqr~©¨_ÕrŒŠêP)­·‡¾•™PXŸuÊàwòvÅ2Žå´¹êa¯EKdƒ¡“¥ŠyGäi¤d .·™Ø±f§ô­C õ9ÛœƒïNœ`TÖe/ü(×ÌþJÌÔ]ð›®N#¶=ï}fxóY}ÿðǽŽifúQÙ°Oôɦg}=V+]Â?qyÓŽß[nq÷W«™ú»ºÖ=nH+¼ì%¿ñ· ¡ˆ©ñÏvê¿m7L~CÛ-Oîèp òníHY#{þzèÁæݘýþ7÷±¾ÿB\ª{šmxcï—W“,˜ûGsJž¾jIk¶÷i¿{»-óò'/= É>h­ùþ¦ø;³kHÁïPߦ¥5C ¶×¾‘œ=°û³aªIüì|¾½ïØ{{ʽžI˜9©ìÀú¢¨G¦Æ6«žÆU0c[w¯ oú˜eÈõåÙÜ`mÝdAC|î(‡9øíæë=·L÷ÓUKè¶GÞÛ}ž–Šø¿XžÓ:Ø÷a{T9ø ¾RümMØñ±*˳Öa©×ªÙ4ÉÉ›aA¿7$¯§¯«Uvï þ:ymëéýIVÎ;„=MóþðHís¡®ZdÌáË»bcr¾ˆ»0Óé)ŒÀO/ÿË5Ci×’"É’bC »K~KÏ==ôüæÛëÝê2­÷,–l±HäÌàš#KgÛǬƒþjÑä¿#6ׂgÅÿ{ykVH"à–t]é»Û#tÈÈ?¼qsÑ•1—ŒÖ‰Ù¢Ãþ»îkŸZvvžÊ·9#h¬ÉºgŒj™êUҜݻŽ‹žõ}e¶¶w\±r²aË^f~^ç±ïDí£ƒ½ ?®Ð‹C8 «%LÑô-ŸU¶Ç>ÍðʈٽVßogs­ÞéÆ 6u\{gi\JJã²Ü«-Š׸Š]Èˈ¯®+)e gÖ©œ]cƒ;ÝI3¾¶‡~rçÔÙ°:ÂÌ0+Ã#ÏŸÚßò®`ˆ°yœR†Iþ¸ëÌÙ.Žª)ƒ0¿Þÿ¤î¦i}òÈåŠknxÍê#7Æq®Ñâ¢õzÍNcÅ é½ÎÉÀþ?‘’ÏÆϦjm2Ï9žÞšá¬åEù<”ˆì¦¢·Ò‡Ý?¶›ÔøV%¤þÚÒÖ ¿Îú´z¥Ã3†ïÅÈïÆD­âBÉz{}­‡ÁuØ> endobj -3462 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R >> -/ProcSet [ /PDF /Text ] +2893 0 obj << +/Ascent 750 +/CapHeight 683 +/Descent -194 +/FontName /MHCEBZ+CMSY10 +/ItalicAngle -14 +/StemV 85 +/XHeight 431 +/FontBBox [-29 -960 1116 775] +/Flags 4 +/CharSet (/bullet/braceleft/braceright/backslash) +/FontFile 2894 0 R >> endobj -3475 0 obj << -/Length 3450 -/Filter /FlateDecode ->> -stream -xÚµZ[œÈ~Ÿ_1Ù—¥%7TQ@¤<؉wãUÖëس‘V›}`º› .;žŸs«ºñ8R4ÔåPuêÔ¹|çÐámámûÊn“4ôUšÞîN7Áíf¾¿ …"¸Õ~`bœzss÷‰nÃÀÏ‚ìö~O$÷ůޟÿúúÃýÛ›­RÊ‹2³M’Ôûøvz~ú¸Iµw¿Ù†Þ»÷ß3É›Ÿ¿ÿ´ùíþ‡›·÷³¶Ú×FáNÿ¾ùõ·à¶f~¸ |•¥·OÐü0ËnO7:V~¬•ôë›O7w«ðœ¾å·VγÕaì+8ÅV~šjw°0^9Øp„#”È{³Ùê(õvØîì`>”8œy9Ïþ3uM“p¸»ïÔ|É4ñÓHɺwcßÝÕí.¯ïúüôßÕÕÃ]zðwm³÷OùîX5²È‚¯(4~œF²ÊÓ±ì„xe%²‹oÒXÕã -pP›Ðn”Ó®Ï+rŒ²ÌÓLD`e¶"+ùZÇB·kO¸ñ)oG+úF-ãN™Ô{B™2+Ã+JCoßvN®b®÷Ç5ËŽ”ªðë -ƒÃ2B&ÒèžW4hEs…Ñqê‘¢LJƒCkjc´ŸËL…RÉR>û3ž¯e»:µ£LÉ}A˹„,sìÁȇ!Näl°(ÆC=g-[em«"ð^Itíˆr¼—$ôŽyÏ Qqëy(ñØS¯à^Õ0a‹š\”÷&}èìWthY–ü!­ÉWôä€æ¢•!¥Åçè@À öZ¨CH‚ÞEí'²›šJÈ… ¹žÁo+ïl@žç®%fÈ!)­J›Nò¾lø4‹&kÇì¬Ù]åõ©08U1bÕÉIqOeNñš9“² ó](ÓBp‚Öã€8ÅYf–` Çžu8혷q.¤<b¤ÄJ¡cÛ gpåÆúvO 14wfÌ…_„m¨½‘Q عä6›ôLqý×IzûÃ5¶z‘:´BÖšg†‘Á <ábvȵ9Š±~æ1ç#£{Î1AS•…%Š2O^È…c's <”·®O :É€bÜ?ÁãÐ8 `»Î) ɧßpãJ(Hq–aßiÁ¤ö6¡½& *ÅDö$w¾o™Ô¶¨CÙðè ·É’—iÍŠ&T‚î ¥rúûèBæ-鉥:–ó|âAÌ–|»ËH$=× ,‚oM8…Ba‡mÆÊÍf‘%K¨áØÎí®d—B e¸VX6å_0&Q.–dÌ*[;ÖåuéPÈår›h(¥ãþ 4‹PØÑ Å¬¯SZ«Êؾ’¦½àí=/Æ „M_Mt”vïÃRr¸â)”Û%¦Ž¶*±¢¹˜Üi}–ž€×íYl^HÕœ uPúLÚŠ¼¶w=Œ+ÿ±Ë‘ƒÈø1aLtòA8GÖØÍÏç)S˜ü‘,G:še{®ÒFÀõ©qŠ®ÜWÞVÇØÏB[AèG1´Êm¶ÚN‡è„ÏaËPXè2~ -@|.žÅ(zh;‘tblM ›“[‡_¢èŒLXƒ ‘ôË#½“Yô–td iàT£PI2§À8 3b¶Ð˜7Ø[’At"c-”.o¤\HŒÍή=‡£o‹Š±Ç°I§R³2™^Ö´îI½˜htNâºJFnhZª¢CüqµLté\´J)ú(¾?S– -C¨-+Šró *ÁÈu‘ÍYyÅÕË òÎùpì¹9´Lyñp -Q5hs¦jy„X¥)ÂQ—ö˜ýKyaâ¢1’L™t -²ùo‡/ú† X°é†ÒtPöÚH‹"Hr§úÙgÈto½¨+)×>B6RZD.; ¦ OPðE‡Á‚’Äéä0h!‹‹!…ì‰qèPÍù_ãý ̆¶|·H;”[†\0Ÿ¢šs¿ÕØ ˆÅÝØ‘É®*»«ÇbRïÁY#‡»…&³\Á¬âJã pKÏ“ì<63ûÒƸ -/Íæ kJç@j™¨I¤‡‘Ј&h?¯È‚Bû¢%øQT=‘žû­0CŽ];r†) >¹­“7ÆVC–šO©%HuZ…ìs'âyÀ+GÐŒ±/¼zi4V¸Lq´ËûpÀF&«dáòÔ¸îtL¹n,gÕóDËð¸ö£«.¥FVq¹üÅRA5 °zMÊ íÁF -Åx˜o»Gîµ”¤k›Lå;ªÀÝ$ðRV°æ¤Õª" Å=áb«ÅÝ?rÂ%\×kö¬ú-%w…8ĵêc£’|Fä½ekE|Ÿ%Œ€²dV(ÏÍ·÷:eéºZGT_qË:`9Θ"<5í%ºÁ¢4enØ çgx°Z'ÜÙâÌõÁ§J ˜þ2´ -ÂZ+*€¬_GúźFâg*új]#–ºÆk,c }þ:pžOÚÏœ3ûn$#hЇ©3?(Á€CÚÜÔ~æYgÝO²k"¡›¯ÔD~æKé”}Á”SùvªIE¡úLu •°C ïCÜ¥4 r×(»DÉô‚Ñf_OV± -ÀÀø™Gu®xá>øˆù*LãöSRÅCüÙÎx…«qWê -ÌÇ+%ß:…Iòp*±I4Ø9=r²ýž_sŸ)óæÀU¹Ä«‚Aá<ÙH] )‘\à*à“ §ÑvY%W¶:63 –¸ ÎœØ/UfJJ.K U‘UãsV™ þôâL$D×Xð´ó’F0<óaÈ]z>wþÊ„‹:’ð çnjJãpfìÙ\="äöBf0ôfßýeå¬öSrÎ+îÇøgày›Ú{ò¨'îôS 3Œˆð €úûE°å#¾±ãj.ÁM¢DÇéبÜBk¶­H©=9wKÛØ}éÜ)Ú 0O˜ÁD‘“[4ú‘TÈÆl1.Å\PS°À‘´~û:PÙzýqºXŸÜu/öѳ¢¼ÆkÕ×£ym-²ào-L/àžó'Á½/9ÁTû!äŸ_sßê«îÛˆûþ°Qü-ýðQõÿU”¾go“Í¿ÕQIKIÕ„«,<Àøtóï.c$Ì@êF–¸-ò¹d‡“±ÌÈbÉø 9ÉÁáY*(ŸaKºgè² dgWÚ±ZJ!k·Mše!'ñø…»[¾vª×ph:åO!áž› H¤³â[Ogl÷ü¼Ø¢·šuv‚ë§è7øé -L°{ª,›3~gÌî4Á¬Àûq*á㪆Ï><œR›pæ3£é×<•òª!e0\€Ç®.Ý÷)|ùc1S[ŸÏ1ÍØPàv²©ƒÄA´ìv’I„¥Eƒ8±D°´ uù°rdæ¯[2vY]p_Å_j&óÓ0[ÿu—lø¿ýèJ%àIó/m¨K>Cã+£—þà?ý\j®endstream +6714 0 obj +[500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 500 0 0 0 0 0 0 500 ] endobj -3474 0 obj << -/Type /Page -/Contents 3475 0 R -/Resources 3473 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3439 0 R +2889 0 obj << +/Length1 2066 +/Length2 14415 +/Length3 532 +/Length 15551 +/Filter /FlateDecode +>> +stream +xÚí·UX̶®‹»k€KpwwwwhÜ݃{p'ÜÝ ¸kp÷à®»ÿ¹ÖšÉ\ûòœ«óà¢ßQ£êûj”5$JªôÂf&@ {Wzff€¨¼ˆ3€™‰I‚BÔhìjå`/fì +ä0ss³$€&  ?v6& +€¨ƒ£—³•…¥+€Z”æŸ$N€°ÐÙÊÔØ oìj ´ajl Pu0µºz1„mm*ÿôp¨]€Îî@3ff€™•©+ÀhaeÀø'i{sç…ÍÜÿ§Éèì2 þ—MȤ™ƒ½­À hŽÀ¨àR‚¼ü¿aë.áfk«`l÷ÏðÿªÔÿÕnlgeëõßvŽn®@g€¼ƒÐÙþ§jÿËœˆƒíÿ%#íjlke*loa 0ýWÈÊEÂÊh¦dåjj 07¶uþ+´7ûß@…û—FQ-Oÿ½¦ÿjT2¶²wUórü÷°ÿdÿ‹™ÿ0¨:ÎVž]&Py™A‰ ßÿù¤ÿ¿ÄÄíM̬ì-,ìcggc/Ðî;À‡`eoô=AŽì\A] ’øÌœþYPf£¹Õ?±ÿB6þŬ¬FPo[c»?!PŠ“›ƒ+ÐÌÄö¿V÷ß-F3[[cç?!N£#ÐÙhÿW÷ðŸ½Ù˜@©ÆÎ@{[ ù_QæÿŽþ¯dmc—†p±ù™u´usùY5u°³3þa0Zz9Zíÿ„8þeÑÊÁìOäÚÅÖØÅòO„ Àè tvøMÂÁøof¹wõøÓÎòíjé ü+ãŸJ;¸ý© ;ë?¥wÿ+d×´ìÿfY û_^AKÌüB°ƒ¬Ú[ým„ëŸ9Û:üÕ‰ûŸaì¬þ3Ê2tr¾GXÿY Ë?×ÍŸ ȃðé‹ü!¶è ‹ý!¨ø¿‰T‰?ª„ÔÉJÿ!žìéÉý!žüé)ü!žâ¿‰ ¤§ô‡@z*¤§ú‡@5WûC uõ?R×øC uÍ?R×ú7qƒŠiâlljtýÝËÍúïøî_nŽÿ>ÿ™’ø³W¹A&4AÓ?ç” 4C³¿ðŸÕü ÿÙk!ȆÅ_š³å_šô_7Èšõ_òdó‚LÙþ… W®fÐ%Çhÿ‚\9ü… WŽá?ûí/¹rþ ÿÙü!È•ë_råö‚\¹ÿ… WäÊó/¹òú A®¼ÿB  Ùÿþÿûfqðô¡gUœžtêAÎØÜl~ÿ™©no:KÒb ‹‰‰t6þ‰šº9ƒn2×½¦ gãØÜ +ôÈž@S„_ ¦¼!ÖiÍaeþâSåдà"-ñ + ½³]ˆÁK à¶Å#²N´ëõZO™˜(ûÐûÄ/.Q¾ÊãçNñéóoûîFû™ÞmZW™ò^{Ž¤÷Á'¨Ís7§ìàŠ3ë£eÉÚ…Ù?Oò”¨ÅÔ`WIÀ¾ëº7~Ï +áàÔ’È´U­§d%QAKw*‹` _ó@KN„Z› ö·‡ký´réÐé†ñT—›ôföh +킱芈¼ü›@0ȯm£‘“ž›ýGØNÎAå·æ²¦ yÆj‚Þ=ÍO/¢žmwzd;íDO;bkÃ|£½ÆAñKüƒóÝo£èkw2Ò®Ìæàº`€E(þÉÃC_B2ëГ8•ã ï*2UÎ&uÊ(íSqãê3;Vw‡CtÚ80[{ƒ‚ë‚#3Î?}m{D›v[-üjÎò#D¾À¾ÕÝ€”[zWÙ­ì²8)x}}’^ÊË£¾fˆ¦†&ï ¾ÜW˜Ríÿ†pj•éÖJÆð-%È®áN”5.4,–5*2Jâ>i^ÌÀse—0¾^Ë·?¶¡Ø¬œŠ6í +IâÁo鱺QoUÐë]l…×…Šr=ÀŸÏ†Ð @Ýþó~å£è€gx#Ñ>ŽA¤÷¾ òç/D“ì#&rÝØØHÈ6R¥tدêþ +ÚÕ´9Ílßò{³ênoDÎ Ó™Nà üº)Í+u¸c诨ah'¿hhp#`ûÊdœr +-¹Lž3G‹`J$•iËOY}’ï!Æé?-NìG{í¾‡BCÿЩª©{EÅ|pïäÅVå¤ÓÇ«ÏáÕ2,$±?·°„2}§AY§À:¹l_¤ß/ödo¬ÛèòþºëeDýÙf.ø5ŒûñpŠ\W‚˜{IG9TzFƒææžÚwÉ,¶t¬!h]e\&ÝWBVÑšt…À>nãš[ª<±Klœ(ßg-!ƒ–W'Çúô ÆÀôÓ–`@hû‹7YÛ-g»®¼Ñëþ©@Å«ªÑ²˜¼›ržªçö÷¦…v,A´ç‡¸ÂÎgDe+zØÚîŽ$$ø´FÎí‚pã"Ó| n–PZ¬Oúõ´ëhdì³6gÃóµ›cÊÆ‚ÐƵ­DèèGÚƒ®ªÊÖ4ö¸!C›6‘Ôí¬;QÕókRþe`^#~y_(®- §0?JlÉßb¼`ýªtž‡²M=ŠÁíû|òqŽjØ÷î˜JΞ3î—6 šýXÉ{só/ßØïÝÎóÍŠ~ÌâËßVójÓØ…ǃXí¼ÚüèШã ^UÂ"=É’ÒMeî½Óè7¸Æ“¹Öš¤/5y$6õ4WÄkP2¸ðx:¨‘u„vI +§é­‚Ÿ²SŠý·¿÷º¥ôædÛo^ÙÞÒ×}'Êñµ®ïÞÓÌ(K]ûµI£:.CH»9µimqûÌGȦ¬´Øu„ÞÛïW% ’M¬Ø$‡˜1²>¸úž—Ä´ÔdÝ7šÆ|úœÌiÖò;9ÓV,ü¯|qò:ÕgA‰[fç4·ˆ`4Ôœ&n¯Í[~àÂì’^äiác‘ÖíõêjâÛTG 2}Â";3–i¿”®ó°8èE Õ(3%GF¸Oª|°eÇÔšwË›—z…|ÓYëàrVžDŸmyÔ>Ù'â¡ëp BryT—›þžÏK:Ž÷-·&Ø §Þs°¬µa¨-³!g’tþ]éŽ*1Ô._–ðz|éñQöJüV|© A.ð~9Ì3—!1gz¬ÊÜÇADîBúsCÈ›Jy5þ%¯4&Ø{EøV‘_Î ÍÃN綑â%¹ÿdÈ"XŒ Âòä +SK× [\Áæ.„›Àw÷1…þ[Ú4ÑH Ý0ŒµöZ¹(T¼wÒµæPÓq~ ‹íʦÑfk¨Ž==„éŠ`°¤¹wg~iÛ9DŠ-¿if¨ÖtöUø{GŒ$zÀ$¬ìøÄa/Ù9î6„ýÆ7ðò査z‰¹š-p!E ™Øå?”œÇ9ŽsÙÍekX½¹Ý·ÍêZx6 *£= /ày[æiuî©ê×ú) ŽF^'­;)ÒkÒ?uŽjÓ2ØH†‘½êÓ¼â‘1{tM!º|~‰w&¡lO…3€åD–=Z½|¡Zj¢Ÿ;6BÄ_•ã”•Úÿù{3ÃLDî5ÖeçÝ?¹%²ûF ´®hêÈMØSHE’Ø“nb+²þ(ºË+R[äû’¼iòD^"Íç~ûšåLõu¶¶Ê×Ãs€—2Ìë‚`ë Ù‚1Þ©Qºu$:˜21·/^Q> Dfùƒì°ij;æ êêöùÝŒ-Ľê¡écty5ë™´m¨xûYtxŠÄàkZ°þëáM^ ƒDžµQ­xè¥Ô€;,wü +Fý‰r",™mõÕx¥0ý–~ú;ªž#ôù° ±œzŠ¯Ÿ‰“çh‚=Qj`¢G¼Ó†Ã`—äˮ7ãé9Uà ‹Ou˜$Ë}œOtU•®Þº' +‚¸g&´Ë÷³a{È«é ¿ÔFÿ€êÜìPÞdÐЬ$1?RærÎÃFB?‘\‹4-‰£úÙº_*†½[¹ïdB¬d=§ÌìB) «+6²± +ÌÐ:×s(/¾ijÚ7xª¦˜²¡ ¼ÉH>Ú©©Â%@ÛVq} ©Uì´";HÙñ©^àÛI€DR_2@.Ë 8§—¢’kÏuך&kW¾=µ.žÄUÄC{FéBÚjk5©Iæ¡Ó^Î a¤¹¼ +oûè•)Ü Du+ï°Ëy7ͶEȪÛMÅíð‘\ +q›ð—(j2ežaí]D]xܽ)´8G³•%û˜åmoS:g\Ä.ù~œmZ6?Ï”«Ž³à6“ëKÉ˶G’3ÂÝ’éz’ÚB%‡k¸²„7’tB}àâÚ.ñg=Ò&œž ¥ 8ƒÂòÂ,4Vªð¶n®ùðec.žDò}R´2€¯‹ê ɻǟIF¡'㬦(8~‹cÇgÖ‹o£´Œïå~oKu¡éÈ4ªIzÙè‘òpïó™Ê¨î¶ûd¤F/„ˆ^Ê\/˜NñWåô>¶Mtß%ëi…B +DVº(‡ßêÈ{[\ô:ÿpw®JQ<ÎÕ«BÅšôl“‰álý? `-áÖµâØäòÉËq7Ï–ß!3¥Ìgš²%ì.—¶±)ßÎãs†ÑÜZ§ª›rsOëÎÁ1ÙòÇ[ Ë\³ÞØ8ç×$zSžP«’{°bCñìè2¹+®Ñù2R ès7lj@A°þNô÷,‹d´.&ê@§ù s¤¹"DÒSŸ¸WÇýœ»[´ò˜–Xˆ'V+¨7)~â£ÀÆ-Á9ë)ªŸ{@e‘¾úZ«³øŽ>féÛ–*'] Ï×à£ÉÃÃhÜwÂŒ®zpM7:àÂ#Ú\ðSÅ÷Íí&¯¹G„‡¼i•çÌÚš ïÎß$Gጻ!°uL"uT~<Ôðf¬ðs>*4nnØÆ¡~OÞ‰ W™‚îyJ¢K’Vߔʚ¥ì7ÖdAX¸rß÷ÆAf¸Å3,Å´¨ÀS ;Ç’g¤ûâi3ÉjS—´¶„N^MD”ÿ]ôn°™´ƒ}« üJÖÂZ[3 ¼‡®ÜpYìÖQ“% +/7Á‘ì‚–{Ùì²)†™ª ûáQÁ…êaÕ :5— _-Ž•ÎU¡eU;,?£˜·®€Õº`ÑÞÝ·¤Í¬až…Ù}°54î?ÿ0‡ÛMèEÔë[»²¯ÈÓ¹$vi52Ÿ¢šÚý%¾Œƒ~uAqã‘í×-ý$& “•ÂÑ? I‹˜`æÇ€XÕrÌи=xâf½QDmÙÎ7HÜEó~”ŸzIÛоYA’xøÆùä¹{?ÙümÁ'uäÀW/dÓ"ø%ŸZÒ¨µ’¯‰žðÓ2^Ù÷œ«uÆṬW” k:WÐí2¶=ôê¢äËšÎsréCñýXïWš/k­7à'Tu ç‡9jÊf¦Û2f^E'‚$³°Ý`<ã›Z<ɼiÌXJ)qê´–ß8ìÕXŠ hЧ,Æ)X}ïÕgV;¡˜Â×¹Ž.OÃ9fš/\íaWðõXUeÁ¤ÜRਃ£,G~ìÔyÞ 8òì¬Ýé$¶Oq«•q§ 1¶¸vOIÓÜ+±Š8 (K>.×8‰4™EÆÊžŽß)ÉðôÆ4Çã½çÒGÆç•L é1¸ÿ]@G‡þÖj²v<óýùÇjí4´­Ù^ôõæÁ1'Š{V¥g”4­ûV¥5m[n†„JXÊ·™ ºš¤GÆYZWR´1þZT¯t5À6¼]û_®=©K^%@H8ùîöã²ßr¬@ÙŸÚ"Ãܨ-‹ Û’2C2y3ÃMdu•´P¤µb~×?ßØ‘·‹{J¥Jïv¥ÄgÈÏ#Õ+®õ ŽêÿíILp¨é7+йˆ,L‘›ÎÚVmôKk”>¡'WŠ`9tƒëîëBÜ­üà:ÖÑ*göE˜­¹«9¸*ƒÚîæé:ïél$x’§y ÇkVÏü‚öQUûžö‘…&캨å{Õ9Ôè-øOù¹i˜êÙ—Ä…6ðF‚£ä`a þ÷È÷ܬ¡¼bÅ,ã +ZðÕ )A‹Bcª¯_£W6ä¹Äh›8•>§$ÇHh–}Ù&€‚6 +—¯>Ü|óøä‘SRvå •¼ç…Þ¥ŽðÊ’Àì¯nb˶£{“¡EÕn_þËw:êm‰*ÍÍ.©f$+°wø!4—Ä¡'q½{á4 +×,ïÔnLÛóQ8®µ/-igª0pº| { a®í[‰rUöòÕγj”°úÝ~‹xJí÷›ÔŸa»#oÀ’UqE«¨Z»•j¦=ü9:T¹oL:Áí+ ݘ/{m¦ +Ö´y¼u5lGT:ü$‡àÅ,3== ×p~eëÑ.!ayS“¦ÀW‰º>¯œ½ê2Ž[ùPZ&_’ô ï„M‡¬?xŒ|¹ +5[[ pÝϪÇ?U'Õ‘:u:n¶ÿ Tz4éH…nl@åYÿ*Íì»#Ød÷ù•åý¾NE–Y üÄø‹ËWo3«¹í;8l[±š½›RËk…él¯¸)ÏLhñ€*7C…Øçú)\};  í:UÖNɳ±nPÖ\…ät¡uß‚5SS½ }Øï_>¬èx{†è1Ý÷§º—káç“xË…þÕiû +{֬ьluÒxpÅÐÓÞö»]¨öíW•E6óFr8HŽïnkç-racòC‹uƒcË2 o¼ŠŒ ¦IhydýÝp­H ·ÍxóƒÜâ‹UúÑ_’N^{~ÄÞHÊò¾hú ó(ô!ä#µøRÓß±Ê4ñÀz™aûy«%56¸ÜîŽô%¼f[Ò—,°ñíHO<~»óТ¸(†2r¹³Ò}H0˜(K·úŸ 0zt,K*r8œDdë1c¢“àAvã!÷ΨŽ¥>‰e&+‹+yãBƒ¯guãeU–úŒá‚E&åíb‚µí$aïÆÊ­H'_¨$GgR Ê ³sªˆùÛ47}FsBxBw°;M¹(+üý” /Ì2ÝîY³Ö¨l¸Ö KO"³¬Ç0·¸Ó\{µSëšâ~^V:Ó¿€Ešx“ËZåhSFQmý›ç•×³te¬Ìaõòc:άBô‚Š¯_(ÒÀA¢ó;¾Ô±ÁÁCJSÍ +%ij/£õðÙ‹&O·×–B=- —pmõ‡‚y%fìi¿àÑ›auûžI*0i“aÞ3ÅËÅ}PÛûaÑè¦ý¬^Eã <:}3Ëòå©Éå¡îÉø‹ô””8µõ}wœäN °#§ ÍôËÖª’R 'è•'ù°1 Ÿ9äÔIPr}3,2ˆÅ‚…4'l‘!ª|`5‘IîL/”>´Èos²5¯¡øѯ/?ƒ_esŠýççSæ¢öd!9wzù—ª_ Ð#]EMgK¡IýŠ#«:ADÐò¡ˆ|[RY‚öjssPèKÆ]õ6n)ÊŒâ#t?øiÓê³oköH§Á{ßY±¾ ·{Ö;ä^ÇN,"ßYý‡ðŽòùÌt¯ÔrWÌùÙùy’–*ü¤ANà‡kÁ¯ó•§Öa”ü‰é\?Sm¶Ôœ•”]/äà)•r]âÝU\9§¨tžÖ²Ÿr°û.-9TUäËÞDK¥ÿâ‘{‘&·Ê—Gc!êaKRíçMV Ý^3ê !¨øjÄY°·7ÃrBÎVšA7 Ã°yÃ*•ˆÚj¡vLcÖÝé…è.ŠåË-b ; ÒÃO¥¬ûäɈQ:Ñ1\óÞ¥[ÒJYNoLŽœJ¹“JYLfU-cq5–žƒžo¯ãJÄñz¨úiÕ“(¹ÿ9 +~£§é®°ÖÐx/ ½¤‡Ë}W1QµE6t®4ÌúU¼|<‚»¾Ù!âÇæ±(×¹²0l òyð´ +£KK-®â>C9é]ÍèùBæöøŽo¶ÝÄÇÛ”>"‡âe0ä›o_®²î_NÎȧÌ[•LÞx0ÙÙ”,A³,7_/á½49Ïôs.­¤¬æíOп=‡Áj~t¿BÑ=I"Íë'öF9èa÷V —%ÉYà`Káb¼Š¡þF©ŒSÈ1¢@¯_Âm5³}o£ ÕrŸjßÁ´Caµ»…ØÎ=Ð=ÅÈ­H4‹Õ±LÎÐÛ ¶q𙾻χԆ_j“_Qõmbù €7÷µ¤+ o´>¿Î‡|@ÝÝ¥qù9nÏ©ªç½‰˜˜°$=sÊé°ÒpIòž§/“[˜°çɶ% ò+{¨aõñ`&2e‡è‚Ǹ)æ'mäÄ(øÖsIE´©¹Ü3‹w{ÿK×ÉÂ×Wi5Ú÷[¡O6¦ s=¸¾ðÍñ*i^cŽÞ%QË}µ`_.'Û®d„µoÛ «Šu/j/xr§£ðQÀJ×¼6Êžª[œ{}µ²5ßž QH@ôP+/cózØ ¹C s) ¦¤"˜þ¸ƒüé7Y=á­SA~iáuóAŒ€‡/ÌÀ4æCùc®!ù{Äž‚ûVCíªÍöÒƒ]Ž ‹þ+¹Ov÷tz%v6;¯~ ý·ÒH&Œ“!mQ_6dr%]DLø_²«'@Ûà/Aëßv'EïÀ-2í¾ýè>Ôd¾÷,Q¬þÅþÞÆÕý Š üZʾBÕ)g¼’ÚòëïO*ÉX\Ÿ>YÒãÅ+¡e¥Û H×Ò| «Peˆó¼¶ÙöÛû¦A j œðáú;]±bãÊ=ºƒl†¨K\•ôª(óŠ‹Ä³ŠEž[µÀo}]r°çA¨ìN²dwR{ö>é?hk…¨W«é¸v,Y÷.W—ØÖM›–pE¬Ï9ŒËS§æâšn;{ðhºrDš|t6RhºË÷uO«fôr!!;®®¦UÇ£hs›ÍH–¨¸ŸE§Z +Žšk`píÔÛ u³Zî=j?ª2x ô—¤=¶dDõW<̤èPBæ Ñ9Úy|ãpr 7ÛË*öÞý×ùtJ–á_,¨ôù$b¸óqNÕÇ}Ó XºGU‰Fh¾UoSù¨ƒ«_²¥ä™e°ÊÁÝ„\@“®…ý¬Ó²¾<Ä~ªG™=êlxN¡6V¸xcñPr<æ^a“9ÀFôžóò%CÃz¸‹/ +­e­ž1¯¯›xÑ>væ×›¹(¢’«,8Ln¾ªiŠXz–ð©SÓX‡Ìª®~ (ìFZUû¾B=Nw#<|¸û´[Þa‡LbÜÄü‚’¬!AÑ» +åCÁî>èÜóI ñ—‚ƒ,~½ÐäZiÝ®’}ê|µwïËŽ[f ¥°yλ»‘6£[òÖâDÎïÙÚÑéABàšc†PCöD|úJ@eMEfÑvµd©7FÙï´Ù/¤%ÉÕ’0œÌKOÃûeâd½v@6Fq¦èêŒBò¾Ƴs)‰*‘Éh¸)¡`gsšƒ=¬AÈäyמUìαǖ›ƒÅÍX­Y·d!SIÛuBO–xûì¨`ÊG¥ Wëäø2KSŽ•³’L¨^4¯?F¯ÍpA`:r²=‡(ŽI(X3$Æ¢%‚¤."Ì ÷Í$ö rSb [`Nëg¥×^-†á±QoûIJ¥Ã­VÓõéêù(RTÒ$/±¯WpyNpDàPÞHd㊂uÜ”rÌU¹Ûխ臉¢ñ Õ1Y˜‡bìÏ¿xZÊPü"r„bP¿,ƒ·ç—6ÚûÝ\;œ#ñàÄ-‚” )“XÜ?ýC1 >[qÇóÂáGÂ9*_Œ܇Ÿs`O}@oŒ}v$÷o‘ŒV·ž )ÎþD¾!2XJ *K¨r‡0?!Ξ•¦ MgE4›w#9Y’ …4&˜_°¬Kºøæ)CQ­«Ú³âVžë‹1&±DJÀaô«jQ¡ëB–<„ªêúú¡v=>TéåÜÇ«ãh‰'×Ó3ȉ`›ŽNË!öÏœÜ?Y¢jÅLx[%%Îr•ü2Ù<¯A·€7ª11âÆ1ó„ñ‘;íÆSÔö¹â JšÄl?’|ÄMS!:‡}Sf‹*ͯuöræMµëm¤ÉU#®+«QÑnO *Bù8ÎÑ óÄȃÛcÍýú}Ó¥HP¡JL;P#Lú†º7ÍÈÊ-Í„ó4™Ž9åË­ü P'òb°€°°õü%Æ>ê)ªJ¨PÔ¼dѪìúSÆgèžý®@ënjÛÄuN°Ì¼H¸Ó뉨±Í ÄíÐ2Ò@;ÀP b„OœÌ¢‰©„Q®C4wâù÷¥ñbG®Ù|zäEž R¡ˆêsë{6l\ÖlfÆ™qÁ dq7èƒà+É£¸•[ã;MѧýÚì ì›*ÁõHR榔oÀ¤8k8VÂw]MEg,A%£¤–÷Q»OÕ^MæFî|ižýCçîì,ƒ„ˆ1ùL7²70(1ÙË’®Šûô`(¤åúnŽ†N,ÖW­Ìýw»aâáF¿a¹™Ÿ ®+QWg—N5|S›útkÐb—È)ñ*ªÈö犴2¨v‘/ÉçªèSÄ—J þ2´>qé0ª%Åö¿¡ñˆäý–ïå‡Ä)˵¦ˆïÖ%Vs¶KÖÇR;wG/¢ÿ|¸ \}ï¦y¢tÚSÞ5¢5jÛ/âv›rb­­cû̵îU°•äa¯B çyq +¤«­"Þ¨N*YÃXæxŨA*3¶>q ¬7B+£q"xSùuÂGK¹¥»¡žüüí'k¦ù"T€±¼}WouðN–«|ìì…Ò{˜Ýá‚›Ô:f–Ä’Â3ä9OÞ[’ë%×ÑÂzå•€¨b†Ÿh‘HÉ›p™¨€(ã¥!ò'–<âÁÁu…è}Ðp¾y½ètÏñ˜èzºò¦ïkfù ¨la{zÔròãŽoÏÛñåçÕ±Å{úÌüÁO¨=ÜV} +ðsŧe4I~p†Þù&þ¿Ø¿„Ú#¶h>&kÂroÛÕ¹Þ@­®ßüFƒ©ÖV…î­ÁW€VÛÚº„‘â¢ß6Ÿç§Bù`ݽ¤exÂ._óAÕ2œ*±\¬ºÛ®}ŒJ'A‘W»×vàØbä,úSCBªüfßÆ·^>1Kc¾™x´ŸY£¨F¸Û7¨itöá/iaËûǾÌm¥f¹Éï±rÊfzî„S¨—„*—äÓÚ$™¨“â¾Îó¨%¸éÝØó†BZýÇ7P}3óeÂÞXåÃNCæ[÷)–&žîAŠÜ¹$+B”$œ–ò£»±?^‰Ýb*©k<×âÌÙÞ4K¹#DÜ´õNôî™ìC –~‚$Ú¬¬Œ§Ï³}þÄaA>-Τ»ñ>2Ñw…øL#›€íÝ>ºüÚ°LÞµþæÎŽŒ)¯°,sÒ8+ùc0_‘|JR‚dº1üÁáXºx³¾C¨À5&Ë‚Gi®"ÀqÞ7XÖßP@j$ÂH¯‡søœŒøÑ5u¤Hµ£‘Œp¤ÇH$€éÇ×2.›s¶àÀ¡qmêí7˜å_àvtbçî09çÀ»‡Y…ìM¢ò­g`¯skß6"ƒ AµªÉËÜã)¸|îgYÝÓsÜÕfmï gš¤6iëi]âøÔ‰Êêw¤×Þ S(;u½Þ«3Ç{Ü‹¡´Ãås °Þ +lié ªõ²#ëIðw\ò§N>­¹e -¬V¤ª Ã@ämŽæ¯FàŒÚVºÉ5 mkˆŒ^|/koY Ô0øÜSñËXæg·ÃñAK\Y(’+ª» ¯úºÕ.˜ŸÓî?ä^úÆòÍk««æ‡Ð \™#éÞw16y¦¶å¨ úVÙ/ºˆ"ÅSx-\‹SïE¶žÞ‹q1˜€ýÚ1³#¸—Xlj<™‚ +zE·æ¸õÅà“¨L"ç®5æćéƒP=™K£ý•©Õ(ZÏ!XŒè­p8ÆòxA5õ\RCøä_S¾â +7»ÖQQLçLä©=+(8˜àÐÂR‹Õú„´ÉѶ•‡–¾SIôÆ=Q[&6}¸‡øøY£imGî k$ Ê«ÞyvÞÏç1×Rû Zн|D•§k„«;_žÆcè+Äü‹6÷eéuPmí˜#:ø`9ŠÚþ¨…¹&B.­B)×ï³E(Š¬B]ù®‘²)Î¥.uT¼ÍºP ’€,i„sÇçûñYAËÛ‡g$´/"Ùì*1Ò/…Üψà]ô4[Dè!ž–UtXóÙÍê“ÆÉžuœHlêlNÛ}“1…Þ~笑Œ\ üÊ¿¥ô`Õy뇘Ո¯©ü¬FÓÐ@—ŸMéwÍbá-o”x™‚3‚8kò>[qó ¤ÂZ¼Ì ªKK„F¤%Þ*/i¡û<âC'ðIJ©†ÄX Öc(ó OŒfWÙeN ôâj'õ½ï°¥cl·¬¬ÜygsÕpOÜJf ï”c ?H–3@˜À¹tá샛ÀÕv Ðy=¥!Pž¢èÄðÁÓÁþò¤0-O‹kö^ WŠ”(ÁŠóºùØ{Y&€•´K}P+Hÿž¡â“]GEò…£ã"?üxÁ:SÇUQ+Ýâ·„i¾š2- VF„‡Ç! ¹A 5ŽõÑ›ê§ð<Þ0 +Ù% [+>Âú>[™)©­¯h3˜YkŠÍõâU xÑä5yöi§Æ(©¡Õ#'¹w F>çÞ)Knî'ÉÜö(ÿÅànNJ]FµÇÞ9âh‰»?Æ×RÓ+OxÏù²³\ ô޳Ȇ‡ëSNë³°ì·¡pB*Ày*cB>Àø"¢›úP˜ ¼SžWû³&¿Á•ªöd–Y‡ÜžÓÚpùïÈ<ñ +Ž›(s4oâvxî^V(åî6ê ¿\²aª¡ß–I£Éº$pFµ6Ú +¦¸¾8]É(p3EhElV%²iŒ3ä¤&x[÷0.7î~ÁÐBWæìUÊÀZ˲åÞ.ú2ýÉl™m¹.TkW°(Ë“Äó!kâcJÍO:=DQ¸ìÚƾvŸNÌ·C m¥di#µÒ Å6E„ÏijŽ¥»Œ1¸m]”û°‘whùà“x€ +¢óß"H¢GüŒPÒk‘¥¯ò±.ù'¤59Î…Œ¸©_Še6œ!¬Wô<,£p;ÑÖpŸ›^Ýñ4{ÌN˜ƒl$²Õž‹yn çVQ,F +^‹¥T…ÓJáa0xgTõâ3QïKùžÃ>Þ¨^0´´x´Õ®$Œk^×Pþô…œ-¤ã‘Æ(£³JÑ6(b×™ªè˜D#kA^±‘£OØá¼ã "ŒÏèÏYSÞÔÞ9Ézlò:÷ž)õC½šÙ=ÒïéŠ)¼Dªz‘ºL(ȵoù.—óŒ(¦…CPå’HʬÎ`Rï<ˆ=Å⮇/à"<Þ¦ Å«Ì(›8ÞaSè9›,úxõÿÂ"Zˆ‹ãØ%`[¡ð!¶eúñ…½¶=RÍOÏaavé|x2½…ë‹¡\g̉ìUæ͉‰.w/‘!B~fRjQ”öZû)[áü‘ü†üuq[C0â«I훨güñ8¤ØÌ…f|H©ÂG-,úÆ.º‚Êr +¼4ÈjÉEªÝ +zu;íÓ{í¨‹Ã-m—¨hšñæñž™íïðÂ\©‹jH§3¼ˆèGÞ÷7}VÑ4²¬ ôöEKùíê*ø¶%¨|g³œP×Úæjy|„ßkàœ÷¡Þ»jÞ¯Ä|gýR3åþüøIÛQ_\ZÇÇLÁÈà=£_mª±g#mB¬“iùXÑ8˜=Rûxª²‘ßzÀn¿Ÿ4Åòå N$úÈO\î¿?%0T1¢¸Øù­ÃìUk0Üê •d[D'|+›ʼ´ISRbPä jª ÊËqÌ{l9Ø"L +¦Q‹ngÈxì@2ѯL§¨²âaô&Hdž—5H¢ïë­òéÔfÈ {Ò¢EK!·m [›R¿§õp/3ˆÉ×eÁ³ß3þ@^o!øéõX"lé£qpúVŸ&ag0­YŸ#OÞ©Vß5¢ö5XðÂáše_oîqµH›‘”ŒØiº öq®.ú8– Úšü—Öü^ýîWè)?”5llKê{Ž +/#ª+Ýê®Qóã÷Å!ÆÞÛb÷å2¾¾Á?ZŒÇ^;š4Ï"êºìãfv›®c‘V]Å=ù~"K;ªm©Œ7û*}ä‘Lë•÷sþê}%å_r÷%U\ºXÍ‘ +å+~…ÓZ)Ÿ<{Ý°.åž‚Jû¸J­úYÉw€½]ùh ¦R„P‡†Ö.ðcü•ýg¹@0¤5´t³žén2ÍëDÃï‹ ”«›Žj–×™m³yUé Õ1þ³ï!d*ÝT¡åõ …“^ÄÍúŽ± +¿†ö¿X®±„Cå2š×h _†’ÿêáN2¾…ô.KÆÛ%{R20L{e©hfè—LvÀFI¨é)ó&‡Ëá¿y˜TªDòÒÃIJ€¸#2lÿ‰Wô9îZ)°ü»A³µñ–u^Ñ™’›bÁb‰ˆÇÛ!S\ç™2â{ÖfR!`œ|Ö! ,Õƒ9™4îYR8ãà0uTBeÁëWÆk^*v‘;ü8ìâ]©Ïb"§Ë‹t>ÌfNsˆHI=~㵫²Ãe>»TøRá‘ÄkBTÒF𵜠J±ú.ìLñÒlcÊ‹9œ/X“·~6Ã&bíUibý³uÅÖ$wÚ€S¿½k)J\qw\ÌiËßÁ–h"ï|^Y2Ÿ*¦&æ,ø/E2¼¡ÄÞ)ŒÍØKHÁU¤Ð5äYv´ý~=~P?÷¦oëAPÝÀ°_}ÛXÇQÕLþ>¶kr*C¾Ïìz_ñrAÖÛŒøåäòR²ÿ(Jõ»~‚X+§ðèëíµNÈ<.ÊÇ È£Wª‚2/E%µÕ½Ž××sÉõPŸ-7 +gi<Ôiáäå¯{×eŒLE'¾¨¥ŸO­o ¼Ø·¤Z‰I¹ùf2"å¶Ã't +ö¾£}m)•‰.|]ÊÉûÁ¸~² /¹ˆE&z醌 ¿Þˆ”Z\¿Î˜ÿfϲ݇±ða‡k©˜ 5z;Ò²üPtXFH7w×ÕUj½ÚeƒXµ¶A„ûI¢8y§š#-ö¸'·Qª%‘54T-öÙèÚ”›T‘‡×tæ§8É´OYE¹eèo:ànÒÑpj&pv?eäâ8§Q­äž!RI„*=myO +[f>ÕÌ®éd 9­…újUYº‘ÅJüîGm hÿarbw[¯ÃõâÝ…¯)Ç›aÏõ¹9Gr]ÖgV£[:¦Ñó“ï®T>:“oWg/߆GPε52¯.F0™¤JÊ[p˜™ˆÞÜoi±éå¡ou™°"Ø/hòªèË~f´s-ñLç_v˜±ÒbP›Ð 3>Ü:ŽÜ~ôÒrƒæ‰`)Ì’sf Ýî €™²ŒâKƒhPÕÿt„~ÕqnwBxÖ•7ê¾]UMÖ–øöÓ`˜‡r†åz2cÍÞ;Àf­Ø33ƒ´Ì#yï›Å½ñFâj®]EÒxõ|µkBP‡‡4ŠôÛ•sa"6ÉíJ1ÞRõGÙ™UõÆ!…d·N—cT¸ÉÇ°ž@ÀI@˜‹wéÆí•ÕPˆúY\0ÄÌ’7çq‚ÄO’8Ÿ¾…ÒËŸM¶AzóH_½ïñQd¿Ø“p]F†€?Ö4WvªÑ” Û®:r„ÔëÝÅ;eÃ1ô CÚ°v·0•³”f¹/âÌÄi!.—·¶°ÿpæ5xØ÷~D㥹æ&ë4‰-Ôô[›l(¹PF¾ÉvPcÏÔ%0öš¹í¢Ç¤H ±0LÒƒ¼¶Ù–Mb®Ú6fLèf@P©Ø¢ŽÍÈŠN ¤Wø–¯"'vŠY;@9VÅ÷õ8TzÞœYg®sÝÁÀ§¢’gßæÍcŸB¬6—“ì)Õkïî<.ƒq…ŠÄbþÅ0õÁh%*¿NdU-ŸÐÊ꧷Ðô³»iåì[áÒÍû ½9YÍ`´¾é.Å|½“QƒmÙ&åE)¦b)l0Ò°#£çïoÏÏãvº"K™:’N«Ø(Oç”æÞ}ØhÑÌ®‚×Ì(Aîì6Ú«êëåä0Q°W×#ÊGH•?‡úu +€„¡r®ó(KYø'ŽÌYŽ²R,î¿€}Þ{ü²þ²ØäÙ|©98>ÿMz¡1‰±úä;½»\ã†+NžZvÈõF÷Ä/Ž¼qôˆõön§_Ö+ÅáF…nµ®òq]õ‘HòhÔTp\³¼¯±Jü ·BL +ᯣ\ßlC¯ÏÎBè]2U¿„ÒOŠ r}&ÅÃrâý"üÍòpPË%RÞùŒFO:A šš¤öîŠ:)ThZÐH&½Õ»¿õ—±Í©å‰Ï  ÌELÒâ´ÌË{Obð¢âwt*úÐðÚ©lzD»(4R‚ß–~eAtH]ÖlƒŒ–ÝÏJ­¾¯ GQ~–KµÊÚŠ›ÔrGŸÇ´Ô¦_…Àpû6ÌÙÀe9µ.u´ý8ß÷–Ü«åÀ¿ï\XÖën…/Š]ÑHb÷r“ZcT;C-ŠÌ(² +GLÖ'šª©f_j½dî49¥„íþþ¹Îÿ3Žˆ]°Ò â·žøöy[?.s—<Õ8c¾»æa¬ŒH¥|ó ™h[ú\1¯L³H¥d‚ÀL ƒÆ,Í7ÂêîÛý—Ã{pTüÙº…'§á°9€÷ú=œ-Ö¬HbøÕf隈ÝÂF¸ô†B<3‡­«ï…fEšA?+ÊÌ&€U÷œ5O‰Áâ®YûT“’Ϫ>}gaQ UÔ|ð5œRGFäpæÖ,i;€ñÎÌ>¬ó!åKXUž§[îJKDÒDôŒ`i·ÇÞ £1öÐûSMá1£¯qÙ)¯Àšèý^Ö&ê^úæž @Ÿs=ùÑîé·í·ƒý¡%ÉéÊÜ8MàÁdAeœ»OÇ”ÕfU«¶@ÜÀ™Û¯ìIÀ®ðllï¯Ô++äBŽXIýàËü‘þå#¾—{Ûû›œQ6uó»2¯•?†’’{Ùã“iwÐm,´(ãÖTàà>9ÂOÁ׉N—l8ØT†óݺn¦_*ÛôW8Â\¨ +·l mB± ø§‘ÕOÂFµ ià°“`ä8ÊV™WŽòá÷ôjN%M‡ÅciS~Û¬íÒ-ëøÓÔ¬^7¶v¦èß?å`t ŠYŒÎ6ñìJ®˜6<‡¿VúOÑuçpëÊÒ´rJ}âSË­¨‚ªº»Rª~1„Â"öø® (E«Ö™Ë‹EñÀ:Ô[”c¢öóðâÎ~˧‚dªè–×ó6>øŠ;>YUÎ'Á=u0€‹T¦¡)‡BŒ‹£#Ò嵨#A@{q“[ã73Êú»B²Õ͑ἦ\š…Ý’ãÛÀÀ뤟Jûö.z^à‡@É +&¯ésòPð}—y¦"½P½ƒem„ˆìsó6ùpØÌk­fÉ]–h4—п¥„l7.³žXÐ4Ø gVpôAËÈ›f©b¶ÏØüxÈ ~YL¤£ZYþ^Â醎w8㳒ߺ«½ý)íC®‚ÎŒòE&·É^DþI,tõ-‹ŠSDZ³² uÅL$…D +fåoŽ=c©Pô\ôIõˆÙUsÊð#å ':aÐS¡‘mU˜=&«å0ÑSkQè72¡¥ím>K†zëïž­¦NâÙŠšèø·§××N Ké`Y­+Ðc•ùîg9ˆ‹Ãbã[ssµî&žUŸÏ~1X!k(g|oÇŽ¡P¼“ÎYÆ+ „œ~®¦ÜvGŠ±½é"í⧡‹›ý¾mé6ìñ:LœaÂuž ä5j»˜ÂúNÞM`üz¶ãÈVÝà\ +]Ç]5`‡.AcP[§\G®>\vT-ø³é‹QºwCg‘ÐØô¢+öÁb8x^Öï¹³kæc½[Iä0ªkç}Æ7Ùs"¡×†ÙáX)™í¹™ ƒ^y¯qõ—#-PÆK &Š$ÅqñÐoÙ¢QdSN¿±¨}1¢g*ŸCFúVqFuªÊ71×-4R9Bá6£#ÛJf\ð|i¯¿u¿g?¢JÉgÎg£ßf®@ÿËBpš +’¯$µ…¤ìYœ¿“ý[¥üúNÐP Ìyã5üñÅ"åK3dõ”?,j1DRÙ ˜ jSÏAÚLjAj¯dUÙ–MIÔ¯®ÛZšºgn[(@8DQvTÒ*£,e(ííÁåëƒO¬á`ñ)GKA™T9pAåw& Pmsœ§á×^À׃ãqË|¡ÍJïÕ Yý­2:(‹‰Ô§÷ wÚ·Hï1×ââg´9ЫH¡¯Þ~Å$¡rQŠŒ˜ž+ë=õõÈ:žžßžYÒ¢~Ÿkí{é-'œçgLqÞ³À¸ [”:ÝÕ¢™ž~¾Ò%õ"a(¸µs$u÷D¹Ú2 ]Úæì‡g£©ÏcR?ÁPrdo™7GiÔ”|ˆzU3­Ú­'½×ép‘÷È$óÏ3Íß~V¤w@n2•ª×O?ì×NØT¥99CÇ|o¹½¬/ÎÙ¤­Ä/#Ë%5¬Cš?>8!ðïh/}÷}Ø|«‹$x§9ˆù¦Ø3:ÂΪÕ8¢xòˆdõôQ´•XÉ %2@UÑžŠŒ6s.,ôlíË‹7¢ñxý¶3~iÄ,šÀÁ¶þgIî¡Óizh(B8"Ä'ñRBª˜Û=Vî[IÂïÕ®F3"©`wµ.î½o* Ç‘™ʈÞJÇUðºvD–®lÆÀ]8v%k’$!ì dçL&œ­<ZK¸Òå0v’Ìó l# +îÝ0¨K¬.KlH•;‰\F±Äi»’ÛÌòxÏ1†XïRw44Spá*O~Ä*ªÉLoçïò»ÄsáÑuÜêI½Is»)ñܦußì×TðË^dÝ׳ãˆ6§êQ]úElYŠàŠšQ"3`îoõŠޟ =…Êø¹g&ìe·bØ8L–¿Ý­¹µ&g(Ÿ/ûGn 'aÙ£žM«V[EñhÆ7Êž¢+zZ=<,E>²¿ã([9c®h&o…|W¹ T¨¾WS4²Ô$»®²ùÎä·¥|ï™þþ üÿübS[ ±³«ƒ±³ Âÿ‰=æIendstream +endobj +2890 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 6699 0 R +/FirstChar 12 +/LastChar 124 +/Widths 6715 0 R +/BaseFont /BCXZJZ+CMBX10 +/FontDescriptor 2888 0 R >> endobj -3476 0 obj << -/D [3474 0 R /XYZ 85.039 781.388 null] +2888 0 obj << +/Ascent 694 +/CapHeight 686 +/Descent -194 +/FontName /BCXZJZ+CMBX10 +/ItalicAngle 0 +/StemV 114 +/XHeight 444 +/FontBBox [-301 -250 1164 946] +/Flags 4 +/CharSet (/fi/ffi/exclam/quotedblright/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/H/I/K/L/M/N/O/P/R/S/T/U/V/W/X/bracketleft/bracketright/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/emdash) +/FontFile 2889 0 R >> endobj -1286 0 obj << -/D [3474 0 R /XYZ 85.039 596.451 null] +6715 0 obj +[639 0 958 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 350 603 0 575 958 0 319 447 447 575 894 319 383 319 575 575 575 575 575 575 575 575 575 575 575 319 319 0 894 0 543 0 869 818 831 882 756 724 0 900 436 0 901 692 1092 900 864 786 0 862 639 800 885 869 1189 869 0 0 319 0 319 0 0 319 559 639 511 639 527 351 575 639 319 351 607 319 958 639 575 639 607 474 454 447 639 607 831 607 607 511 0 1150 ] +endobj +6716 0 obj << +/Type /Encoding +/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/dieresis/visiblespace 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/dieresis 197/.notdef] >> endobj -3477 0 obj << -/D [3474 0 R /XYZ 85.039 569.837 null] +2879 0 obj << +/Length1 2332 +/Length2 15237 +/Length3 532 +/Length 16504 +/Filter /FlateDecode +>> +stream +xÚí·S|o·°ÛhϤ±m46Û3¶m7llÛÆnÒضÝè›ÿw­õ¶ïú÷>Ú¿ä`^ãÏý\ãæ 9‰¢2½‰PÜÎÖ™ž™™ "§¢ÂÌ`f`bF 'q:[ØÙŠ:yÌÜÜ,!{G €™‰‡ô‡@±³÷p´03wP‰Pÿ“Ä ²:ZÚä Í6 >Œ ­ÊvÆ@g€µ5@éŸ'œJ@' £+Є™`baì 0šYØ"0þã$ekjàü¯°‰‹ýÿ4¹@RªiR@’&v¶Ö )£¼èm@ËÿZÿ»sqkkyC›ºÿ×Hý_í†6Öÿagcïâ tÈÙ™mÿwª:ð¿ää€&.6ÿ»UÊÙÐÚÂXÈÖÌ`ú¯…“¸…;ÐDÑÂÙØàìèüWhkò¿@#÷/FEM 5ÚÿžÔ5*ZØ:«xØÿ»×²ÿÅÌ4<Žîm&Ðø2ƒA¿ÿóI÷½LÌÖØÎÄÂÖ ÀÂÎ0tt4ô@-±¼˜¶&@wÐ$ÌÈ`kç z€©#Â?3ÊÊ +`5[Úüÿ¯€ÑÁÅÎhbdý'È`´u±1úgæÍlÿ„9Œ&vÖÖ†ŽBœF{ £1ÐÖùOŒ ÀhhŠ:‚FëßQîÿ~Ñ­’ÿ ³1:0tÚZMÿŠ2ÿwô%³€zvú§ '«?APQöÖ.N ’Œíll ÿD@õ˜{Ø›ÿÔÂÆñ/q »?†l Zœ¬ ÌÿD@•xíþ@EØÙÿÍì {g·?íì ogsGà_ eS;—?#ÆÒ5µpý+¤ëšÿ3HÖ èú—+h®ÿ1ì U[‹¿E¸þ©ÙÚ¸ÿéÆÆâ?£ ak ÓŸÁâ\ ÿL>ÈØ쟓øGšƒõŸÉ:ýs:ý ‚Ä ÿ8q€¼…þÈYø|EþHVôDÅþMœ Añ?²“øC 3É?r’úC é?r‘ùC Ù?r‘ûC ù?rQø7q\ÿÈå˹(ý!‹ò¹¨ü!‹ê¹¨ý!‹ú¹hü!‹æ¿‰ä¢õ‡@.FŽ†ÆV@çÿØ7 ƒÑþÏeÌÍúïìÿÜOÜÿÌ “±……±…£±ËŸC¤ì:LŒíÿ,2nŽÿÞÂÿùNP ¶7¨£?ªÁøßÄÌ*Âä/ügíý…ÿl•¿dmö‚\ÍÿB¢Å_R³ü ANV!HÊú/Yý)–tX3Úþ… +»¿deÿþ³þB•ã_øÏÞý AVÎ!ÈÊå/Y¹þ… +·?Ȳrÿ AV!ÈÊó/üïþÏ™afaûg9üåÇÂþßyÿ¹˜A_1þk!8[X›ü×”üß·œ°°»=€žt?p²2ƒö“Ϧ©ÚZ€Ž )QÐÁÈÄÄÅÊò¯¨±‹#è$wþ×÷ +Ðýù?ljºl@w 1ÂÒ¼1o°eJSh™¯XÁt94 ¸°Ysœ|}Ïl'bÐb<¸uñ¨ŒÍúwßé˜(ûÐûÄn/øN‘Þ_&Ä/âRçÞö] öÓ=[ñ5®Óå<öìI‚NPÛ›~Ýž²ƒ+̬•%jd]žä)R‰ªÀ®’€õj»6ôfspjˆ§[«†…|§`%QBKu( g [sCKüµ6äk×B»re×á‚ñ».7áMìÉæk ‹pöbó”%X:=.ךŽ¨ÙÓZ”.¬¾¸›‘Ü(£º7­úë¯6Û¥ö‡åîé-嶺^°_/ÛðF4¸C²T°ÓÜNêg°âÈJP'ï…‡â㙘ÿP9ò .®3qÑ›]T·9Â8¥˜L7\ʨL\fP‘©cR˜Ò™ŒžÇV¨«¶^èeöï×ë;ßa-7¥°z€Åº¼œ:ÆÁ4«$žr¾=m‰ + ‰dÓÕbë ¯jrY-ëÁi¢4—kЬI¤ô•AAíð gF!'íöÁ±Ty›KõùÀÚÖb·¹$? %†E+¡Êx@²? C…ã9‚+âð²£ ôÅ.ÀX[ÛQÒ…Nà[ç¦ x? RT¤åd×åˆ(rÛòRoÎwŸú´Îêm€²&!KÃÛ5 +ß Ñ‡ˆ”ž>ò¦X‚¯¿gþÇæŠLÔITÆÏ IKÅå<Ä!£P¬Oª;ׄ3*ÛÞ`ýÂŽ‘ˆÕ#³WžG“,È_”ŽNõ¸œ¯;ÎÊBHf§~ ÊX,ÏTuùï%ËOW\X;5-Ï¢Ð)î8ûíqlýŒ›¦ºÆD¸‡»[{ZÛ r[ æ<­?M¨g‡Þ—[ù¹jÕõ9u*?ýþ7ÏŽ¨2B…r} òÂiXA Á—º’‚ô-I-8¿Ÿ.ô÷±ª´r%’¨4%{öõsÖòU^NÏ=%ìFÊŸ˜`p¾¦[õÆ´`7¦FØíÿ~õìㆥE‡)¸ƒç«>È`$Qíwôú™61Ü0­{Ûfø…¦Ó…{;:Á 5ìÝ£àQ–úôI¤tµ¥óñ8ÛÅ{±)*¹þ0b(eúê]RÜŠ?OèÀn°Ë½øI 6‹×F.çp®XSª/Ûí§ ‡K#¨‹ìÙß²ô„,?uj`}lx«M:1~¸Tª/ñô›·ý>@ûËza…)¾°9ÒÀ£ŽNŸ¬ù+ +hí`‰L8àƒ¿÷F0þhg7úàë°Ñ¢dÛ´SáKãùÈ»JcEÌ'Ùq>gîAšiÌ üð”Šn’'°“‘èŽG²FW[[Ǿ“FMåíš¾WÖÜÁË×w8Ûœ…ä2òäê7RvSWò‡l[Y(d¿—YV¯„ ë¦7"ÌdXÜïøs¸Ê™cȳÌÙˆ°°B>|á¯À/ƒoAvQÛ°/¦ }¡c.ª n oÛ0‰_£DrNõäDzÑWyd;\ÑwàâváŒ=Áóу…žÄ=SÛið!Ûucø›þÔùb~ÚltéE¡à{ÇÃØiГwÛC© ûALŒeò"ªN*±Rtíðcÿ6ÿ»v°!Õ}Þ©Ÿ•ù̾0ôX|ãÉYØcåVÓ™ü-˜Ê8Ê}M²±8t„˜3°Ÿ¾GôŽ».ZwíèÀη?а8»¥p<Z{'Ђ0Gèõ¥ /*I{ÓÖå»B³Ÿ"aç*™Œ³¸Á‘7•MÆYñ‰Q|Og+|9¯@®z8vá$ÏK¦E¦Ê°‰i*ãH7r³Óv½ô5´Ñ¢ ]MÅ‚·Më¨Ôl‚ñ _¾7”¤ £ª Ïc½xæÇ5ÿb¼þ¦YOÿ-ÈNÆa§—‰ Ñ81ÕeF˜•ûõ«îêm Zªãk Í+ýÝ‘´Ìçð’]ˆìëV¯åBAd*¤‰âØv§;ÒÏ +ÆÂ{l¼ŒÅ’KÝ$_kò0õÍÁ$¢ð³ûÙ{~Òë# +¸­•B•è•u®¶Šh_YÒ&N¹ï;¥m8pŒ>`Ãг•lIzg ÚtÑpP0¿~í¹½ù™ÄªøA*}*AÕUØtª×­%®Í¤#¦¼q{Ú ®Gù–h¬Ä:ÞŸÀƒòÁ‡øv¬³…ÝéøŠ¿Q#ãSÓãEWÇ(â,1“ȶ­&‰")LkÖÕ›Ò ݲtÙÅÏï3Vnz›³êvüÈ$à¿úùPͺ?¤ÊÔ¤^Ù¹*uR°$}˜âöPÎŒcÔnàýH¸ÿiÛ:W ÿð>.†,EäçÃþ'ÅTÛ[.=_C/¢Tg¸±¹ì4™(¨?à5:ÙIpÔZýñJ­Eü‰×„»¤®l$¥>ïݽ¹½SKŽKÉóÓLˆ¥ùpÁŸF6ÙUƬmÀ§k{ŒI‚ÿË +V…‘=?õ6ïgê*u~Á1õ¡Ô´õÅ'.%ÿÜzJÂU(Õ¥š=‚|‰'xˆyFà£tã½ö×aH׋ÜåOëûxçÉê®ÔË\ì×sH?°ö&ËHRoÏ:¤qÒô:J‹ë‡mßm»òÒyxû.Xƒ˜!o&ÊhG±Sd¥ê¯æB6ÕL-éZ9›’óÒ”EbYeÁFJíž’úU.ò§‹š BŠfï'»ÕŠÒû×ËlhÇUš]‚7¿ÚÕ,ðkWã=“¢<|yÊAY8$~ê™ó"nÅã[×ÆŽmZŽ¬/éT¤¿Æ/W´Õ¦x”BáÒÊ€µ_[à>Ú„ëb°jo€%õ»Š“¦ÌVònÃÕ‚«L‘²J¶xÝHÐä'[¢½Æir½0*DÃÉÖÓÌＬ“\ܺº}W_ÀÏ‘)àAÐ’ûrŠ»l“Ž^U³í§™;«×q_§ ¤t¼—v%ED”9xáíʶ®‰£Ü‘¤pÖå‡2Ÿ´„'è±wæð;['Œ2Ùƒâœ#Ó“´6N¾]\øµÄ¹}ù-º ¡PF` #£g“A™¬ qEÿtvh[ñ4º®sƒÃvt_{ršG¿øñ3“²‡ÄAzA–¯§Õ,¡dó$¡ÉÓFØì]ðôfgÌ ªyb2 ÕyZ~®Îl øXEáF"ù¼9ôA2‚|¼#ï‹.hߪ}4cÒ-$X„1AŒïÁÀ öÊþw:º²LQ1’á*$p™.ª@Oà,¨/1Ý"jë°Šö#aÛ\nI¥*†YŒ9‘v—FñËo½/o}—ÌKÓíE Faý£öá¬ôÚãÝ3ˆž°«¦¸…U\‰ƒiµøPºþ‚;†&Ñ?y­&’‚åqˆEüG#Jž$Ô˜Š?­éã å”ÿ WÓÉŸ2Ô4j¬k„¥f–3`.R)õ.Lôbf´ …L Åp‹RoKÅwº(„k²ž‡åöñ*>·$ôGY(Ãú„™+í圞ªÑ9!i—»Bâñ¤`¤¿í¹'dTô\¿ÒDÃÉx/ßÈjÆbú—©Ð¦ýöñŒ¯%:i}ª áΪA)#Ÿ~0Wòae` ŽŠËà˜‘õÈ!ÁU•v^í|"µ4± rÀž¾õØ#ðUÌhA{cäŸv%J²ª6ìØËAB%»…„il*eK0Ó§a½ÖhêöólÆyv,³FV\¶²•ØHü`úùÀ›£#œB"âwr¶R¥‡¤ JdÚb--JxŠ-dÒ\¿ž3– +ºÿš¦Û\´ÇŸ÷[l$`lê´¬÷¯Y´I óôñŸÆ®°Š¶Þuø˜‘Z%Z±³Á¶õı&Iјì. +mF*ç$¢ ,±_MÍgÙâ1ƒ)\·óôXMžo\ð¬F1É“Û!VÇ>Š ¢Rõæn­}j¯ š.à gç¡ìü>»á§âÉð™pŽCÈÏYçŠJ«ò×’©0¼­õ€á˜÷â·—,5gØ(acª„$- '±ÍÏ…kà7Áªn½µ>‚Î3âêG׳‰^B ‘Iëñó‚8/Û€¶Ž8þb*XŸ ¼«(jê2F7‰yB¤M3Å'ÊcÎrîÞ÷\ßåNf ÒèÄȨËnDW·®8Blùö®éGô‚6eIæ=Û^­ ¯»¹ b¯4ÏñŠUÍÕG0Õ‡²Ê.×:¤h³wŽ©]ø–;\ëßSâ$’r˹ƒ°x­‡ïŠ‘CöJùÂrà#˜©Ð}w Ý…ô¼¬ì¬´œ©ü$¼v>ëÅ$¡e¼ñ„ã¨ûÂI®¡)|›žóÇ’IåUº:‹îUnv­)z«¾; òuÌœç±0¼½'½„þ^瘖Ì%(×…VK©-u­¬—,Ï*­ÇÏ:os‹˜’Ñ–Tä0Ð2Ý´ªhQ¹óï‰u@Ôø4X"<|^F¢Ýeb·•ûrª,Vö¾¾îuinÛg³ÌBÚ1šËL<‚ª'óêå¿Ì±t§Íye~¼ñ +‹$ÂPŠ{ë§oïñ5£GSÒŽëá‡HJÉP¸>º— yS¢4í²—èTH×áÊ ¦¢—4, (œk㧥¬û9×/j‹j!â²ûJûV§ühQƒgÕÆ*byfTJÿl2ü²ŸðÛvÎŒ¥éÁ†ù±ør-ùçdkß7 s¤N|Ì+OvÖ ]yÁ 5»¹¯\D.Sª¢y;‰HKrÄê>ÄXaìA®ýœ3nzj,_ùùju[†œJ©Ú;ÁObjÉàÕPicwZ.YðæÔe& 8-‚¦=A8(UJRŸaŒßæ f'Myðez濪HÓ J_öï!ˆCNˆ°Rßx´äïÒpÆ//÷–œö݃5­8–²²Þ“H`Ç)FÐÙ¼%?ÚÔ¸G#î"¡#Ýç B!|…jöc‚™|ëNP'cþ¸ÔDÄ𣰺óëùº\7_£ºÌS•i®¡¦a.²ýé¾7ŽuBŸdyíì“Bç0ëönÑÐ¥5Æ[Gkf´¤4R}‡Ë¥Å`e(Îøáñ>ÂÜ®:¿\ßË^¢›=Íq’ rƒCßçdü«ÏŒ–«†?šéܱ´õOR•%uBû©º(®_òàO íܨdµÚ’ØsVÄ`—Häjä×ñа=yRÒ¶ü”Ý®ÝÀν¿+W}çÄ' •xE_åº}YZÐOžoT sêv¨²Ê’ +Ì2wœ tÈó¶NKÄNUTÊÒŠdX~ÛŸ«>ëŠOÚXÓ›öA_UÁÄ÷%MŠÐœ`ߣ~ZIòf®.¼Ö@Úl­{Y¨Æo‘Ðîn‹Ý!Í£ïÏ‘%ÉG€qceZÝ2’bšãMp††‘p™™ +€4y³ã@Öz÷ö^pºdâ+|y…k%Ÿœwƒ ûÍ/¿Ìàì<÷¥;Ù:çó­½oB&©[ÆúŠâQÛ¨ÿfKFÅfyû„æ!Òžñ£‚Ô3ÙÜã“ò4•š¸¦SUIgb€ô=üÛa‘¸Uk`žšhâÙt4;±)^…Íî+%v‚–wö >¬à;Öð~û›õ¡¼½tô퉴Ó@åãÌœQXw`aläô·V¾Þ/$*ÓÒE$=V V‘*JÂ17Ê#´Cô2½¶»iÕ"s ›Ç¾¹ó°ªQv·Dä¡I®¸GîÐÅT¹lQC#t]ö(—pE¡MN–”Ú'P̯.r©¦™U)9«Ù½lNlöê|tC7vøÒeF÷VqÜŽ gÑ^ÜèÂU µð•k/ 2XÞßò`:Î_½¡ßºJûÞ¸ÓòÛ½[×.á{B…ëëh(•ï;__yQC%À“EŽPÊò&çºZkH~½H…Ëâžz‘\Qtí ¼KíW<°e9î#¢1>c”]êž•þä„/3I1«É=)2^ôœ33‰ÿ½­‘o/®ñ /˜©-‡ó˜·š)BK}±+’ÿ˜¿lGç9‡}HüMIدS†²q˜XÁ&uÜË—êóë±Æ>u!Ö€±¶EóS'{Òfâos»ø^¼þ Îû/ï†íYp¾Â%§ßaù ·aªÐ’ ¥‚gýÏ9 ŒÕ’V¼ÈFæQ˜÷ƒCýj‡jt%ü’ûä8=ìËjEpü/W‰§>Š·Ó¥%ZS-j…LÁ"ÎÖéÐûÈêÛ5ØgùÉW×£²§¸^4f¤OtLmUS÷ïÏ„ÍÛ+sÒÈ[õêËÖ« êú ´GDh×»Yr )˜L0°±ŽSÜwäª(žQ2¼èÀô›šPDÝéÚÓ˧åiüZ[s!¿õw©”½ârŠâ®«½s¹ãéçU‡¬~³"Îùã·ÊPY<Ý‚!ΟæÅr‹N¥- ë&õEOÓÇ  Ÿ!×@éXå+†Æø;ûƒ œ›.:|Üw[¡j½“¾@×ï½êÜúþ€ Ž±³Ÿ~x-7ÓÀijç—90lüÆén™¯¦MÜe‡iú )Zð½“ú©C’÷)á#W§=qì‘ì—‚¾#»+iH¯3kzá%8ú‹T=nUŸtÝ"ûÍàIp|Áä&FV6…Æõ-É[óܲҀŽË¤Â/–OTq!$ÞäjFþ‘'hˆôüPÉÔƒáÜtÃÅ´Ήáøú&Ä–T¨¡«TQ_4)½:>º|ðy]ùË;Ï-±?bž²ö®VŒâìy—¾…”fÁ|&±©æ‰Zw’IãÃ5æ‚#½¤NHð›á9s‹¯„?çj\ÜpS^Ãl*ƃѲÏþ’«yí9^õÊsÕ÷ùlN¨Àö×IH¬4ðM·*u,/¢lmË°Än†½™çÝc?N•¯i©[èÍu‡›ð½4œ]3Ö¢M +sŸÀ¬Ïô¼ÆÔßZûI0C©÷k€°š ùflÑS¢‚„?Àî¾ê¶óEùê+~™÷¸¹6z»ßE«Ðç—m'n©JBò®¦ý™½EfQq– °¸-4*Ô¾>Àr’¯‚³ZTUö&m¡ +NOæ™ó/×b4Š3ÚÑÊtTâû5íѧ'†A¦N¶_/(Ÿ¢õJ†¦«ØÂ;k±Ck’è +(“‹)­hÞX,(jç%xôÛiüÖ$Ndk«§¶O4ÐÅ ¼> l (÷=Yˆ!ÿ’id«ýùøà{­B§~Sü{÷}u©©Ââƒkþª¦±ƒÇ_FÃc +5žÂœ v=sšàN[Ó°ZîIÎÞ’Š¦Ï1ùg•øEÝ4ÔCbÞ§§6±É}h^ z\Iß—£éÊ»ØVscI"üð}d¡ˆc¬æ‚aw{òwã#[ 3«#H¦H龋ólypìw¬a?ñÄÔmäP˜ÔuÀt]ÌIdzIîg¬v$g¸*·˜ÏÉD°ÕnÛ±·}ÖÄ™Ýî!5}üfاfd8µáµ»ûÊô¸¯0˜d q/Tè¾úˆ‘ß@›_@1 pT“P18MKKW‹Â—%ÏæõüÐ,¦p‡w{:Í(Z;8{Çc§ßcéV¹ÆòCÌMhnø-Ràvi¥"… +oI`„Iæi‡äóªw›ˆ0†môÍoèTÿ¥Ö“›¯Û® ±ÛIŒ×¥¢*§kõƒ|[:ZÔ(Õ5nŸd¤J{íeH0®²¿Æz›5éN³»5ÛìE½=ðŒ)]kÿñ—z+P«£[º©Í*ï$©fgB¬Þk´*ÒA‹> k‚kŠÁͧÃÁx ßQBèšWŽ—»o¶k‚wæso6F†õ3žåø|3ò]‘ÁÂ(E…å5&šÓD.¥¾Ïúâ½n¥´œ¤]âs9–dn—“]./"gR}C…ŸvÊ9òæ(tU„•ÄÁ>&‰Êžñ:„¬K%Üá"¬ñW‡3ß¾¡EÃiH ÎÁšÔ‚3øÏmÞšÕªbc¸sy¼£ð&™*<ˆ›úÝ +›HVN ïÑ놥.s‰ú·ìô®•]ÉúòÏ?p²=à€oêºõ6U‘ºk¯‡;iPÙŠQL˜z;©T8«í£Ý;*×ø>ßAhÊÐ*âŠÂ<2“½a[ÃðŠ}ýuËà“KÅúi + ºK„Óæôg̃’áSÒ[¼4¯I71ËOB1VÍ=O¿“ü#E³:?-`Þd>ÓK§·&¯Ú,ã)OÅê:hnòŽ gšG’¦ S¿bÇDþDæ®âg°ŒÏøîÙòDý=’Mó[lûô>¹C"ÂŽè•7˜,8gµ%ci`7RÊ\R;Òk )«“\Fò¡âóÜÍ nE›!·Ùá >Ö›Z‡ïdû!½Ò$cû^€7¿ÁTÂèÙS¸)ËwŸ?oë-z´+Æ–ìøÂUD!¼³,¶F¯ÚŠzó¹Ó²q‘¼âg±Ë¾G¼…ïõó#’Wà´?üJwxP6\=­¤#­XœÁ®™c¹X2ÊÁ‰,ÑCge¼¯Õ’Á¶`²äøpξÈ l2 dgÿ>xá[9Dô)¿]jT¢Ê¼‹ùÑt>ÈÎÅ¢˜î¤À>»ìÇÁÍí7¥RžI!àyád–jF÷êHá`ÁҦÜL9T×U¶ U¥-ÑÏà©üyãqÃ.ˆú‹k»§8«nTŸ²Ñlî‹(®g0*âT˜å#Ë” Ã÷Ð]õÄÊë0Œá ö¿E•«¿@‹<3¶Hó.lß…ã»~÷bèÃjÃ"gmP•8IÄÎø½nôYñTÇañ”;¬ì~4qfmÞÚ\'¶+ôC’Ü&*Ž§‘Ûs]#M³ÊwÀ׆mýÔ˜®VCÊmE»ÿ‹Š÷Gðéër¯×ç!C…öÀÌMf¼ùOÒ@™Îê«pÒÏлûü‘ì~!• Ä~ù±ƒºƒúW`šÅ÷Ò0GJsþ\Úôåq–«\ŸÉt<Ë1zõc°:§S +Ûôi÷î{íeÉíÖÝÖM^ÈkUÀ OvfÍCJ»0“á•|_#CÃ÷spåŽ[ yRõõ‰ço‰-Î/³*îžs¬Cž¯è¿u]”ާʚ—‡ÔdÓ0o! #v‡nW¶µ†ï| Ü”ºpHk¶eI–=Slk¾}Å¢g@P_½´uöPnZïLB8qôÁB–êÌÌÄUöÏJäêïí´‡…g87oŽ“ãi|Jû~)Ÿ'p38‰>ÿ¾.á@»?,Ju°¤G±Ž?ˆEåúÕ‚ºôчmÛîãº`‰XÌþH-þ›Iñ‚¶³ÆúnÉÕžÖV(}`áÑ<þŠ²ß‚e#÷8ÿ +¼²BQÑ£vÞJŸ“ DvûoŸ-@mXþ‰Ë Íý‡  }„ÔËø´l£m$˜Q̽ótt$”·v6÷íðUÉQ$Ì/Ë)Ï®ø‹pÆa6c´$ÁLÃÑ +«ÈÛþQK8 ýl˜c¦ùZŸf[&5 + B‹oÙ¹µ¶hâÎΞ"¦œÓØl¥þ©í@¾ô£ÃNÃœßaúë±’Q ©«+HÆÊôÈxÞæ'L¿7ø ÎuÀqcF7.Í͹û~)œªçwe‡³„:lšuÑHÍvè ¸'lÑ@±+c?#ŠŸ@ò?G¡­;3ö@bŠ0}s½wÏ!ÛÊ÷œûºbšÍÈä¡'>x¶˜ü`4r³/Ñþe—Ç«¡LêŽP5­O·ÅñA×ñ¨=ÏÐê8ÂÀâ’‚Êüwù‡¹Wp;ÿâuÑÂâ ­âŠ((²¾Ú– +~ÎXZÛ¹ã'Í„†ßáŸvéyNLX`®ÙP,M”SÐP÷0_Û$¢t÷Frƒ2tgD`É•Ò¸°"Úâ]ÒŒô>·2Ig?ó™ƒi¸‚£f–­8_i*R!1ÈTt""cçÀk¹ã}À ‰Üì<í7q²I¦$w¬®êúº›o &‰ê[XÓ–r,~±SDpÀ›Jô½ylôWDI4O¡mRßsûõþhª“Å¥}O+@Ø(æň|ˆQ(AÑ_oqž¹÷9¨§#²]±øº.d§¥£S¹D“#€ÒƒI+$[™g—¾ø‡2zÄ„úJˆµ¿¯2ò&IÅCñ{ùgB.“âe6™å"öì3§ òÉÞÂá9äxb‰$ªR×äkÄ€+ŠÌ“—ð±’©Ûfž^ô·Œ/xa(¤d0‹vBiæ؆¡†ßsLyZÝRêÚÀ— Ä÷j]Mi– g:bó:óQ1ŸÆ´ìÅÕÌêÏiˆ÷VZº…ª +›gS'q#¨+`cعñ{~3Žär;å~²u üuÁ2KÂ{ +½Ðí +k6®h‚?$Õ©Ú—Núy0ÍÄ¿„0~ظ‹À¯>?wYoŠc"TeÕŒ|¹º°$„è'á*跧̓·ÎÝe$ÔãE{2iŒô Šˆp®¼;BýfÑ¢I¸œÀÊùðQß¾: d…Öž”íJªMnAÍ ÚŠ( +,'++dñýD–MO$ŠÍŸÇÈK>/×±-eE惺NøB­z%dßKoŸ©šD§‘€„¹Tï×ük¸öu´± ö½{Â_¿.«'‹îäj•/Bö5a$cD¬O5þGH2 íI,Õz†ü¶èGÆeØ’â©÷µØÚXÏÅ{Ó½ÀÛ(M;>^ž{ÇÄŸý:zzÖ´^÷Þ‘»ŽAšáå­ˆï\Ûl'ÄRûŽ`^…Hohâü·‚úu‚xÞ]ˈb[6܇&Uf᫾aäh ¼ãŒ;ÅͬÌÃ^êAMÌ’à±0É^º^Ÿó´Á®¸/õ +jÏ6„J£±1Ö±îÕ¡4W ªâ»=ƒdãêy±ó¸æSÎŒÇ2bCÊîË<,ÉTŸ=†¨Pq+›lÈ–£¾±WûN¶)ûÁ—iܽ÷ïäöçˆ>Ž!FÓølKIaF9°ËYN´f- "}­¦†0'‘îÉýñàÒñmM™"lJRø¬áô“õêîã£hHró^ƘÞû˜OT\_Q›bNïk™Í ½C§D(í|Ö’:ñšÓ\S17½Ñ)˜Cô­\,O®‚Vj!!Ëg܆a§oxeöµÑæ‘߯4÷(O¼%›dEÊéçÖ«°«À M}(y_5Û0jàoù˶öêÇß|ëcáÖÖ Æ‘ò‹‘Îjíç¤_cc.ÅQ‚Ò©¡J×?L:ݳðµ¥׆6.mõgj‹™éÁTâ[|W–/Å^ ÕHtt f>âÜ»4¾I¤²ÜIÆØ«ÏÊÆà >Ħ‹,d%8 úÈíá”z¥&TȤ<¿`3³>ñMyÍþ +?ŽAÆSG[œF” ÞûÉB_7(5Óój#01oóxZŠHÐ/qÒöþ¦=jdt­4ZȸäLn¢§nì©°·®³!,²‹Î‘¿b{‘s€Íû-›‰Ü£¿–, ªº‰4ÏpÅË?!Ňw63ÕÞ—¸oº¹-•+„yq½Ôo¶t`h-l—Ð[ÅÏp 9¯Ñ'‚<„>îåb}£{^”¤¿3hòxOb rW+hÇ_œ\\sŒ`Û± ³wd_ZŒº&|ÒÕvíRñ—ì®^ÈÃùãnkÏd\ç¡Á¾ô;~¯Ñ;æ¾ÊF©fúQ~rÍ bQÙáu#gÁ#Rÿ)µTO4à ä¿fÞ’åµ]ýV5š“y‘¥ßñ徑båCŒãÝxº=[Ö²ø2“²9IáR¸d”cyzL˜Ò†þtåÊ·Ïz,äˆs ȸP C×™1R‘Pqé‡9òüè¼í~Æ¡s ·‹é- ª×ØEÖU…Iâ(öм—àe‹Ù'h9k¢«R‹²—929ÄI¡À¶wƒ¶¡U„v¨ßœ °Œ|´º,È d¬‹ÅD ëlbˆ© õdÊu¾k&¿…ßA83 +oÂù¢û¥0¥X©óÅø“àÖÃä–hw?ê[z=e«14am€si‡Þ_;ܨ¾iϱ‰Úɨ°ÿ +Z”Pœ$ŸUïñ3ˆà/ACÙ8°¶3Ýð×0Ò®ðààWÆ°R{Ãq ]«B#/ÏEØP!œçd˜Î,úÛÒÍ2F‰(á;©Ô”Ì[®™™‰% ÞFF;Ρ3ð–eL¿?/²£¢¹¡ïLFþük +Zÿ†_‡Ü€ŽÞàsgM×Ïo†q…Ìd·Ñlí*¹–fd«+t Øi Ë ¹aÏ™~qgª]†°‘ºTèžõêÔ!JY}#m"BÏ}Ȳbö¨Œ0Bšmpx‚@¹#¾™b“ª„Aú|‘ep‹^åÇKvvøÌ cÍ,‘1yÜž +¶ìƒ‚!àNrëE«½³~¿+#mÃÅ‹±þ;t‚Rtœ‡E‘ª Û7{ÍB ù¾¨V8Á»Œ¶Ê”9˜y +ĉ¹T®RëUl-74üçc…Œ/­¹i7ÌjéGä"¤gÅC†tâÇ?Ô1w=ÂêF‡ö´jë¼u.®Ñ*˜²ØG,µ3py¬ÈŠÚ85Õìw¡É½6QâW,qW`.Æ’™YÆÖ +~«SR[Úæäcý›ÒôVyTY¸1t!„Òé1bnq¡ô«Ù=?éïÀ]óo2½1‡gÖ0ànBÛ j_ðÜž$q¯èÝçâ¹óÖQéŸyüÞú_¸`œUÁ¸Í‹üœê­±)‚Á´u‚ùÅO“,‹ÝJW`µ ÷$ÖhcHX°ÈušôÖ͆¹u%Ü#Þ.Ñ…ŒEeÏ —øž#Èwß*|r‚>UßCaLÕnD«ó$—|Þ¢@ ø#½h1ÅpBj;@'‰,¦HÇ#³Ýp‘SéÓÂq9,’‚fvפ¼4D +T4ý‰Yþ õ¼ª=¹ùnVõ.‘+pwÒ 89»ëíCO†æ¤b#õ.c7Ž(@ßD¡%«:ç¶Ê¯_BvÊZupHóíÞ%Ù¢Î*Ç–b°|]Y`¡{{ùR±·'žæ§ †‰ñÇr0òŸƒSûƒ8\£9Ÿ¬l,Á$ÚmnHo¢‘ ò7}¯¶5Id.KÎ}†gðµºõñºpìßÛ•šNÇ 0šº·r—9×û{t +µ uò|Ë2&M¨|µ*bi‹¹¯£”&àÀ:Ø"â¦w‚h!!óçG²" Dày„éMÌS/Bªš$TdèvøWM\`Æã*k î™æPeÚFBÈT,{Â$;ßò½s¡³|ð± +¡„ xÒÖd+N`›_Åðç’ÝÈ]„‹Nae\ÉeÐ=z2ÂŒçîЇ|&ŒIø=³ +·/vë +)…Û÷Ñ‚;‚La¥æµáŠc9Kd8Nçq­ö r#KMflÇßé@8\±èè2ïùÜÇ•…W‘—,!OÑ.“‹MY *K}6ûæ…ÓuSAz=ÔsQœiÅ1±Lö#2X¯-;]À@©Qöc4¥ÈVXÓŠ­…WWüœ‘Oý zOe*GìïtªhEmò4qŠ_(²è¦Ç)Ê $-44-½ú²GK úþZŠø!×ÕgF–Sý:Ê 74©‡æŒ)£^yÁ†ù…öÿ%ÇýõM´Tõ;Bõ¨f¹Ýê´Ó—éBõ=Œ Åk{êÀsi`òJ»RÈ몌1U›™XZLõ-ÊÎ ÏE¤æ¡O Ïð|S®g]xãGÕ°ÄœW;×Îø’¼~³/ÌWáµÉo¦mŸ*úêe(Eüðƒtiˆs¾N‚Ä‘OÓï,¤ B­U|Fñ¿ºøÁH1ƒ¦DHiÿ¦ûm¬)±äÁ7þæw‚kðFýÞÜí[…¾ö†š»{åW…Ôç·ØŸ6°E1¤è-A¿uöÙÒ~WIÍ—ñ²MóáuEcÿ2XÌÙaÇ‹(&Úc Þ +{ݽh‰>©ÌÏçvîM<.÷_eë9¶=)J„+bå±;íSdEÏüóãWd^º)dŠQÆ[°ëj—þtµAÜ/šÞö×ËRw£n»¾ËÅ9iÍ‚ú®èRŸƒc'¡Á´åéâÑø›Û¼&=\ôDÈz¦™ô¶!©e‡É¾\pú£ª[[M;&z}ó +͉LQŠwº¦g:™%ñL5´å !¯Œœ¨õK@Wlä‚6cC2-Ãmoý dÓÛCð ¹¾dEÍúJÞÛÉ)Ý´¡¦@®*ì\0ƒ‘ù°¯Æ¨¶³ðI&Ô ˆcC\ôc'ÜΊw_~i Òq„ ô™±Y¡¯5ÒŠ·¾$•àÔZT éæ§~I‚•i!ño¸55÷è)Wùóuž[ýæd×¾)Qê³Wx•lõÆGo"/0ó™–ùÐX×xoZnv2¡Áí^õø¾¾â(D:öŠ©R”ÙÇ~á›êgÌlÂFpþn1èá`ÓËÙæ¹'M‚ XøMÂc‡xH/õðÉ5Nˆg6àn¦ Ýlš²?Xõ6ÆÁglkúŒ“ßhË¿aË*Þ@¯Ý5&…Œ®t%•¦§oõUFï0©s8ãŠ;ц¯A߬˜6°«OùÀ¼n%ã0쾂?ÿY‡ðÃ"Ñ·{õY”P¥k›„º!\«foäξÕÖC'aGl_™YZõß3¤îˆ©ËžãÛj·Ê‡%\¾úÍx]c“ðû³:Þ«sŠ§°¥AôæÌ-WÖvê;N<ü‘PjM²æ–ìo3]#eyK©ÎºóvK*åý1㨻æãÒç§6¶@H÷=5ܸ ΰŒ/>EsŠËÝ$6”‰ø+TvI7+âN]E˜ÃÕ±åî•÷™B)ÏIyº'¡{Ø*8#s]0ˆ<ŸÂFÈ« Í­ÌãCœ^1·=à?š{ýZæÃ(Û¼³Ìï`Miµ?„äÚcE5à -d,*¦ÒY¿tÊîªkÅm;7ݪ”|ä=ýõ›®àjî<&—¾ðÛ—x\¼$Áý(Lîz3¬¿-ëj¼Áv8{„BˆZkfä‘XÓLõFjr¦çèkàJ\zhË´«øWéïÒ©çÂ× Dž&pAOóIJCGRfÈ•Ÿ_:MîË·7Ú½ˆ,®¥­¢Cáðiá)‘ÕðÇ¿æë~!ú±ò \}?Â^6ƒoÃÎÓ„ýW토ÀÕý3^Jõkrg­›ÏÀB²<¯âíäý…ÈÍ×£K<ó&Ô¶þ®Íl\or•~ÌZȳèHxí³1j¼qÔú겶,‹W~T]4ý¤Íc°^IþFÎÎéb!«§LŒ4wéBŽ/ÊaÏó”ùM{:Vp¶aõÔ$ÎBW(Rkh ‹ Õso²Z=9†^ç Jè³o‹*KBÒ«–¹J©Ækq¯’ôWƒl‹<xu±äž\éG«NØäDfɵ·Øi?ß-{öñ»gŠW›·í“¼*]‚»ËŠ· ž©Q¿ ¤Íœˆ qÎôË5«6X BÊ`¸R5¨¤ç_E/TOõŸ{ñœòOç\?lŠu\¹½ŸZ²´tJœ=‘íýÞTø}§ L]¾¡(©c¤€è„['1ú=­øÅwb%U·r¯N0¶ô€*y´e–ÊB(ò-íû¹ýÝÔ>—P¢Šmrø>3%Ìèë-#µC1?KõAKJö“ÅéTÓB5³,ß½¤æòrZŠÏ£€—se¥ÒŒ¶ín~†uÕûë¤hÏT€- QíKtÖPár€ ï$N¬µZ7©ãJÂÝéÇ#BË6ÝÅð­£çŠ/”vîaº=û'š¯ßJ–mÔ[tyÇ$\ÑÖ»9í.—kÀ }‘ÆÁ”FøØÏ*3f¬‘u\ìT\'ð4°Íî´ì ØižIm†àü²´ÉåÅ„(– 0†Nçá,"Ø“Fïy¿Ö÷®¦ÿðxm~Ê!׉ìK/g¡ƒƒÀþ–œþaµÍBs •­ò3œègd[¶_Ä«áfûeLÿþÿþ?ѱ5ÐÐÑÙÎÆÐÑ +áÿÎÑ^endstream +endobj +2880 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 6716 0 R +/FirstChar 33 +/LastChar 126 +/Widths 6717 0 R +/BaseFont /CTPYGV+CMTT10 +/FontDescriptor 2878 0 R >> endobj -1290 0 obj << -/D [3474 0 R /XYZ 85.039 268.864 null] +2878 0 obj << +/Ascent 611 +/CapHeight 611 +/Descent -222 +/FontName /CTPYGV+CMTT10 +/ItalicAngle 0 +/StemV 69 +/XHeight 431 +/FontBBox [-4 -235 731 800] +/Flags 4 +/CharSet (/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde) +/FontFile 2879 0 R >> endobj -3478 0 obj << -/D [3474 0 R /XYZ 85.039 237.339 null] +6717 0 obj +[525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 ] +endobj +2875 0 obj << +/Length1 2307 +/Length2 17225 +/Length3 532 +/Length 18527 +/Filter /FlateDecode +>> +stream +xÚ¬·eT]M¶p»k‚»»»»»;ÜÝ%¸w îî înÁÝ]¿ótßÛIß÷ï7`0Î\U»ö¬Uk¯} 'VR¥6s0H8Ø»Ò330ó‰Ê«031301‰À‘“‹:Œ]­ìÅŒ]@~·ãS=-…\<³\hû-÷¾²Â,ß^x?1µÚåÞ™È{>]OU£0Îè‹ó¾è'K+Ž¼G…‘<ŸË‚–AX%Y„.§Wu2ˆÓHíö¾…ªÝ1ð[шØ1iÚóo?h#÷ f‰ü‹¢j²¯©,·cÉ㣋שøm4Y®Ä±$W/4©eµª¤ud;]Ö2MÌB¡A÷ K-“›ÄÍ+FÙ7òÌöÑb'3ËÏélØ° 5Ð)•æ\t:b÷a±E:OZƒ¹H6 $ì ß;+ÙÅâæ+µºd5›8¢}ÕÞCYd @ +¥¨_ˆ¾®o$µ‡}£ÁWô§,’º5\J4¼°|Q;cz6û.xÙãk°*bHEq`_³W¡S`?0­Z¥m˜rí]o9>lø5ÑÒäÐ0bM”%âÔ9s6A÷ +y໕ž´¿3üû`>¼Û‡AŸõF™ú·9ùù($uÎ@¸ò!·ÃgÌ6S˜X¦¾šÊ*+ò½OÐKè¯Ô†‘Õ„¢…4žÑZ’AôâA`©‹îÌ«vß©½­ ¿#©^xB@<Ƨ|ífÂ×ølåʲŒJFNÉWìÙ.ÁDµ­ näà p0æä±;=óþL›¾£¤Â"‚÷SB'K ¥FŽjÖÊq«ƒþý:éèHEÁ®Î¬ÐŒ¨IÑx°mâFUúëH’‹(Må>¦š«¼HQÞèºÝÉá +$ûîݼÓlüA;ôÕÌךæoÅÄ tf’‹tÄlSÔ¬n»ƒ½x¼ikF¶å­dK?~ ‘ +ø¶ßˆ–¿‚®tÔ:ewƒ&NyÔú‘ A¬/ á3C[ÂÔ_Ÿ»4æ%í»Í«­f‚@ö k­$,0Å Ú]¾ ÍUÿþq#ŽM ò½¨œ×&3Öm"ýº¤-ÜŽm'= †Öž ‹€»t˳rQlÚ,…Ï.ÃÄ÷õë¯|V‰H†1G"ÔOy§ªd8ük)àé"^Ó!ø šÁøÛR“­ø>Nf™Ñ¼{›©o"óˆk üàpD5âvÛ“4¥6 0^Ðå"äD$£üοÖÜ-Ö@cî\¶ª ¾Ðhf.:1v/CáUC‡ÛÔKí-‚;\ÖšÛðU\VSQ›§“5+KU§âv–bWEKu¤Ú͛֊'QÃr`¦#tsV±¬‘°Í›Õ“æ ×Â÷kПĽ„P#ÇãÕPñUû‡ `ËŹ ‹US0  +cDZV¬àÇ´Ç\³i™Ñ°jŽ_IÉgŒŒQÛòu7„(ˆ©Ïxz1¾œE‘ÛE«í˜SœI㻾Û„Yež9‰ÿ¶é™÷ë{úÍ´¢û3ö“߉™þë³äÜâìÙ+½Á6e­ÄãŠÉUaÖQÞSš Œé ØâîÈ@‚)²SÈ9o‘çªÃø÷•ˆ°ÈíÃ’(ƒ«TúÓ¸–Ÿ÷™TsHšâµ‹ÄhY¯«ßøDVÏèæ²qý©ÉY,±?¿0‡ÒÚÑ¢Z€¹5G–¸òØ.û‘@Ž¬p5¿ðu;è|×Sraõ(Qœê ¡¨fgɧ©YÞ‰RíD¥ñß~l00[DÙÐ^‹ó1_Ýtûáa“„àûž~ûp i>À“ükÙvöUrpj¯rã+ø¤ se³8Z +«Œ²rÞ˜?¿>65Â<ü +{)=T^9AÔâÌ8$ŒÉj³I=MçtRoå³õçþúß~?À6¹ï<ù¿$ËB(î$×½£ÛýtpÖœelÝû0ÕŸè§ó½‰€##ý<²Bµ-Š·aÃIIÈ#bÞ²}Tñþ“0šÁjøR_ƒ"d…Óȯ‘Æ™ö0/¡Ÿ:샺¬‰ç³îàÌ©ãQÖiѳÿ‰|}ĉéÁ© ±äCZHUô-t]Nét©.âïñ’@¿ÂM0Ó÷¨N!†y¹–¤‰ÛøA¢bÖ/F;EâmPדµt…µU©Žw{“37rÇqϱ°ž‚×?ð ¢XB‰9bk¸ÉIýd":nçÞ8Þvq!> )àj¬sNÀDÂð†kÔËþ‚®D“»g gïeGµ£;>JÑTiGqÛ.¾¡…TO·™AIúâaT3·úHú Yæ>u‰|„ËL„«IjšbÇ.q¿Ó­zÀ¿'-÷쉡ȃ´À&B%Ì0ázdÁ¬ˆÊ²ée2㯩Πý¸•aQ ï5/4lH`]n+ÌÙRélZ¸b>0¡å ºüŸ_ôb<ëÈz4Iý^× Š¿QSòÛYíoƱ“‘S"ã;}¨ˆ•¼æŸ&ùÖ|÷”:igžwg3$!iîþ+(¯¼¬NG—<Îꄸ[ +I˜›^Øû"¨Pã +r@JCÞ&>¢ EÛÚ!a3OÝþíGVi+ëYÿ|HB×wWv…kÅx­s T ëîS0Äzɇ˜ $Zm2¶4…JFé®ý|;/–hG ñÈà²êe‚ÍÚÆôëd¨õzA¡MÄâ1RCÜqbBÖã÷ZišB[mˆM‘Œ˜œu¥«wº…]Ú­íX§±'¢JŠŽXŠpæ,B*ìâ‘ŸÓ³áØ2>©Í£H=hØ{š* Œt†ì¸d[" @+ž7ïI–– +œ”ÃuSCºLÇ2C°h·È¤?Y/sypü(HJ#g£´Š/áS4‘ï¦ö¯é: €Ù‰©7ç[¹Ä,3—Ìñ9Ç4ÄžÑóôH¹p8xÃéÚíX›“%¹'>ÿ<\:´rÑï^¹™;¿¯kzëòÌå^õ3Œið§çD\qJ@—_IÑד„+³?†}ö¹f"^ðã¬t3‘G¸ý( +ËÔŸ9Ç…?çWÚÍ_u­=¶©|œ†›D“ ¿ì¾'w«J¯ã‹~èÊÙfÊìRÁ,x4;TŽ¦.~úbDåa [ hã*§×b wÌ'v“ÝÒúi{UNzÊd-+ÍÕ¥ú¹×ö(¢Ö£á“%Ý ©o¯!Ò̬<ûƒ÷¡±°RÇmÏïšbýyn-mVõŸãávKÁÉí!Kc4T¿LÆ[ŒNŠ¼±;ˆ™¡ÂG¨É¾¶*ôë}(¼ µ4 +˜r'f1¨”?AÉÐc+ @Ì=~hSŒÌ#òÕ;0p#¼OG¬½ÒŠ²0Iú±¯±þRu¬ùæ[ƒIc~BPFß@/ÿÉ$µœ½þHzátÖ[ª~U—ÒõMEÇÅ¿±aÅÎüæq€ ÆB£@±5ÿ¼t1 +Ñᱞ§K„óAp²¢Bǯ¬oµöÜ»[œ»jÀèGOaóáj¸@D»H‡ãKXœ2dú…¹ZD[Ni[iLU¢(B(´…j[ÆQ›ì27>V€[í4Ų<º +ž_E3ÿv Z³wêXXŽ)yö4§½í|:ÛØ­\Œ}£ÉÅ}b\P[(ÈcM÷¸¼ç÷ˆÌýÄ)ý—_Æ5K)E¡4ËYãüö².ó5uËCyØöú|±¯{I'?®ÔEi_Ö_NH­-·íšI³OŽ•'P“0²yÿ½š4RhØ3‚wBŠpÃ'zñ𭺡:Ùp‹¹«ýù¼—Õ~Ô¹Îqh"»aÿþÁ‡A 9Ç ÊàÓA2¬ñ¡ŸT£ðŠß÷%(÷¸w°/-‚AºŸò§“ͤc çr·:xljÒv¾£ÁmÑÅh–ÄE~á°òóøúÂVY­N†Þþ®œž™¬v߈p þ!GÙ'–º¹ÂFgË<ócœ¥âÛâ—ÞN|£Û°È +@©F§*©7Dø˜mÈÉå‹ôÖ !C*ˆ¯¯B.F´ÏÛEl×wsl”•5s°WçÊ›¶å²UdŸ`ùìRŠìÖ–µC-‡V1œfœ±ßÙ«Ÿ<ˆî¼H—°`jg<æ ž×¤?ÿ qd‰†³­ô£¤!XÿæEkˆúGÇ $ŠÔ;EŠ‡ãÏ”9ÿVÊ%ÙµH¦ëªiìI¼jŒœÝSœ~ïréuC¶é8²Ð˜Ú¯ÙÞÁBIGÇbã)D ö`+?üšØ¾k‰}i¹º×­æùü§Hp»¼ðº£®†Nî €†òŒ„£”æ¼éŽ`™e£ ŒwyœxúhÀÇô5íD²Ê]—º(›“˜Ìè‹7÷V‡·v^ª íH¢ÈVUÈŠm#L›üÍÓVš9X$*eð½0Ÿ3é)”’RÆ7òó^öëÑÂÑ®ß{ÞÖ+2^_ »5¸ƒ f´V8|"?Þ‘E”7W´ÒÙ0Œ=b$rOø¯&1,‘Î×ØØSÜ êriA®ô—׬阕ȕõgÚçwl]¡ ú_ºé/~L/€B>²û¶‰.%ƬÐ,^:ªœY]ß]å•T]"‹4pæ«RWÃóÿpCÅçœQ÷cd„5©ì7ñä×3ºA4 +tŸ:`{‹áÕ‚uÿ +íqü#8©&<îFÞ·ÂÞ‚ÑŠvýܳ G‚ 3Q4r8#8vØ2,§D‘÷väT1éÒîy5Σ­AWÙªò«ö»ß<&t¢«%•~a9´€£®N ChñÛ:Ãýçó “µTŒ­Yd?gÿÂì#–Ü°Ûõ"PfšÑŸ&·Ióe¿‚­[n äBW¡ƒ"¶‘¬ziç{@‚™‰½¦¯F¢©x‰PÕ#¡F•ß*¨¢×ôÁ*ì~ç¦u›ö(‡®§ÎlÄtM}˜²¿0êÛ\’Ê•ØY[M׸s’s>ûaMÓ¹¼} ª+dñjo‚ˆÌEh†¶Ù4Ú&Ðq¹VZo\ æy2Öž£›¯ð¯+2¤ŸöÜœˆ±MÙØ^Æo`Ù©@ +è/ÆüP]õóc”Û«·3G¬+{tôefúäÔ»Qj@…¦~šç·Àá{sn/vÜMÛ “mƒÝ´‰Üµ2DýHð5,Z¢ú4þÅõy«û|(ÙÛXm"l£MÆ(‡Iœ†w'pܬ³WM%ê ×Üì'"øÙƵ‡P¼ºTCîõr]槊ó÷ŒX/Âþ¶å'â5@ówº¤‰oxe-ãt^ˆò*ïz‡×¼å6Bdê1÷³„-õT–•G?â!áH¿àÿ$+ö¼nã¬d¶ ÉK}çgG;BE\ÇùÆ:hÆGæáÆÖv>»Ù¤Ý‡Æ\E¦&raìø<¿]˜›pˆÐ¶Èélûî¿ÍyÜrU= ¼ð/Óí<76³iÂL7^è©vì¨ UŽËûJÇ\‡ü¸/I«‰4!l(¿4OE+RpŠ«7·LŸˆZæ{ëÏ÷ÞnŸ:Aøj››ùë5ÜM¯ô'FEÂ.ÙâÁÁñ}†T9þ9ñ©×—`kG†ni42†¤©oojàðTQ4š»xïå»as òÁl*/Üí\]O=g­Ùøxb®â`û.£þ„Z( +£`õ't†á¤ +ž­¤ç+‰?‹½’›¨íNƒ ÅzöÅ­B?›™!–<ŽÈ0O<_6¹í •w”8-Û´„Š’NƒëÎrÓzã- z×ëã|@G%l}%€„B·ç6Ýb³.’Ö*I4”Ð>xïäɆ ?¸ëeŒ¥¿LjŒ\M¡òUy"+R<É'ààuðÜaêïãËwŸ7JôÀÚ…¸Ö|’¦Qæè‘ÊQå%l}ÞðÔí|©d·›¨PŽ±f¢ŽÓTé%^ƒø‚‡2x'Øžb€ÑÀÔòPký0%’—ÓÌI‘5I)ΉÖe׆ô,ùlÖIººŸi€<6ÿñåË!$y/Vo˜,åûˆQ"f*é]^DI5½$Ž2#Õ}Ú«»UÝçÅ¢=hÿväŸF˜¢”×0 a³bá¤2NÏ’ãû +Jó±`MsD`ðx4ïo<f·Çy‰›¹ÙFœp(ô[Tä D®ƒï˜©©¬>Ìä +¬(ŸÃ ž°<¨Ví© êQ‡¸ø¿AÙØü(ot´e +Ë•fì¦ý,m·µŠ@-Ó ê|—`ÒÊ<Éœì?5J2À½{š×‘j„¤øD5 ¡Õø«¹,<:Þ¢J([á Ÿº%Hè½â±¤rUã•Pö±s†v-õâ•G ãc¿á8MñN³¹Â®*Kç§ÎwLUeI(N]5š<Ý5¡ÂuJ‚<)™ÊÔ¯“×Î]'* 9R´¼œó|NcÖŠÇ‚3–ÝÒ×›*†|DtG<),›K÷±ª{b¼s‰DÎùôŽïüü£´’*8!XhEw!ü’S2Ä޸Ѕ”ÓÞl9Ê·ÓÈÛelìž +S±[eò÷|aÂ\ Õ¦áÕ4}ØOO*=>*óÞJ•)&%W´ß`ä¦k <„Ñ4 ´ wèM}êð‚Çœ7…¹³Øî³>fO}û`Ñ#„$bÙv¡ÂßäG|ãÈe:rœxDã·Éb]P |{ÓCrþôÆÐ4è¥Eµ4|j¿GâL¥…Tx‹;Õ²Ú‹%ÅÔ*‡ƒúÓ9055ý`1|Ö¡ë4e_ª Êg䳑P:·u°q-4Á¬v ó#¡kàeÑHKOnûÀ·ßT»y˜ÕœGë" RdSo^¦‚ ß©åyÎ+SÚíìwÏñ?Aô\©›µjSŸÆ …!¸í>x”}Ú%'#Úå$±µ=r¨pTƒH{éy[~­mÌCW¼–œ W†6<ït?†™ê{ZY}r$z8ƒ5¤¡Ý\’ûòôd õpˆ¥Vì áqLìú\vÏ(S Žÿ˜¢@M×Sä6í¢áQ3?eát}‡ÀšŒvè»j=p@°xýXpë0Ôõ\êhÛ¿ZÓðÐ3²öÛŽ§øʃ´‘YêTÁløaºfÿ äò“c!‡v±“¯»wûî÷Òï~4¸¼”%Æ—þBRÊü~•ðÎ{*æx$r«¨:°ŠùBþ8¶p¸£‹2m®Và8[,©ÅÅ>*J.i¥p +*ˆôÍÂè±]¨¹ÝÇÛÕ1ÛžIê;Œ6õÚ#ÑP Œ3_cL¿5ÎeìYõ+h"ëæ? õ³QfÄœšÄqŠ«ÚQ +¼žÙäÓº¢ù˜G«²KÃy²×VÐB½^àŸ9+Q²ßÀ¤wMïrî¦ÒðïgùUÍ­•ÄÎɶƒÖlËA&ýaX\Œ?¨’WŒ­æyHÆ·0A³Ž›j8i`ΟþA*eÕµ"V6H±vNqÓ9ÄJ:äXÕ5"~«¶éuýƒÕÏvo5¹…§“«}³C•w1£ûˆBLÚÙf6n>¼"ÂØ,ÞmiÅaÎS-ýÛ·æ†Mâ*5SKSuq5)&«kŽŒ“RÛ.*ïR©îìÞçî5Á8âøÜõuðŸ3Ö¸X­*´Í:²åtM8[€†¼ÐîðX¨ïµœãU$+HI¨Ô:1eÿRÖElÖuüOŸËC’8¦†éßWú§(ņ-“r›£h lOÎ(gó,"cU)ë ›TœbépÙ`OÙ–ʸGtõc7LijÈ>m`ðÑYŸkLm)#A8Òg£Å)‡ÑÛ¢8MœrÈ-BçÖ”áÑ“ÿxzΙ³Å—ŸXqõ¢ \Ò®ƒdœâ8j:<OUry‚ÅzH¾ŠÿhDgÜ^X“߯°L®1g%‘OA,lU®Ùˆ1xP‘½ ¨‡2¤D]ŒUò­c\Ì--@Œo“Sh°òC}›á ÃÇÎðrä›DJ¯‘Œ{WzN ŸL‰^`ù†c^úó´åsHub£.lÇÆbÿvmêð“2ãjÌga®Öû”i=®Â Û&°BˆÍhdK…y {#ŽÚÛŒ2 `ñ,;T›!/¥á©ÁjQZØIþú*¤ÂÏ®åä榫v³ zAQ(ܶé8õ¯6ý!;%×{ <ûÄh +¾— -vmõÛ…GúO^h³r;!½[ß Ðo®/â=}ƒÙ~¶Ë‹‰´Ô>8°8ø€æ›L›­-ÔmA+ò¾#¤‹!óoÎü‚l³¯¯éÚ¹Ó@à8‰• ØŸ‚\ãT£ŸžN™å¯xgäå3ŵ›–Ü%BTã“7f´†‡Qû ;‹¼ð®ûÃEä„î½D[EñäöBd÷äá0ßcº5çù6fhÇ~ÎCUË‹æSÅï ì{•jô¦jž’2.ì˜lDvñ.  6L/‰öðÒ +NöÙãº)AÉà)ϵpxªp:zWS³" Xwìï{$ý MI,ÛÜ(GRÇâSÏ3媬®0~„£Š³…7§\¨Ð Øö f%²“Ogþ+e®öóenüïö±zÜu­íë/{ûqÕ§”ͧóŸ’NÓ «ÚÑkàAφû†á÷âÊÑ[Ö`g÷>¯M_LLð`x ½çxD.×oH¯¹t§•è¥²PÃG½X·žpÜ”^†Q_…u8ú*ýšŒ™¿Œ¦+ÊSúì¾ÅóÄX¥}¿i­Dižý û¢Ü–λ‘ªÙ’ô™syp Dn¡Ÿ;¿š?¦¤GÝOHÄàÓŽëV(‘|í8(Êi1 ÿÒw,f7·ÀRÄTîbS·„8Ò­>yµÀzL| +!#þ}Kµ%e3¼”UT9^ɴˬ˹ ÈÄê²&ßÂB/ÙäfZêïöœòœ×ÅžztA*Ž1ûôé}ô2ðÕó£9¿«J*>¬g¨$Éì#ø@8£Ë®ÜÛ"Z—/¿‚}ƧsËÀâI˜TÛ`,{ëÃØy ¨áeX¼rØ^¨žA·RÓà½g-A}W¬ArÆ’ .ë„X +Pý«ËÅÕWEïîhÆ 4®Ž`…ëã´9î~e}ASÖ¾øL1@ZaC(mZoŒ£=Á Î÷V Ï}èÂWn²øu«oU‰½ ui€ö˶vÞ•5 òYTS±®¬òXéPSgU5ú §¬GÖ§æ°{—ÏUaæCÆü\¾×)w4½~ɬ!óŸ}—^.à~D˜ÿÜBú-ØÌË~k¶Nª[WÉ>4!“0­]¦å—*Ñ©ð¼Âñ·Œ‡øGß°æxi»¦n±~1¹ö”¢ðö÷;- IuZ’ÞDëp(.q$JW›¯ÇfP¸¦‰E*ÖõC·f·<ŠŽ":μ&›‡Òµ‘HHi:³¾(5».‡T›TXì…bQhaªW^Äã-ËA¨ãÐ5'‹wðA—,‘¸s2O“èXrÑiŽ{“?×Y¸ýõˆ@Ó2Wæ×gÊwð ¯ù +ùeÎÈh6¬q›R77¹)ÆÏiu¦CAØ[9·Uaû8ôáM*“Åãú°IY6ŠDg9F¬8ìóSƒÁó\`÷÷ ´Yü _ìÒp¡9h†WOöz¨ÿ7HIßØ_>S½×ú9- +1·ô;aO³! }CDÙ˜x0Ý陬 ¢)ßzA‚¿¬1^iÊ•téE'Â=ºë +Æ™~µt…V?¿÷Б‰ JŒC±¹1|a¡¹v·Ôåt!£s¢Œ=­*¿gðº“pˆ}Éi·¾x«²aKñ%qÏ\iž…Á_àôl‘µÃi‡Ü3 +6T¶V“”pâx×2 \@§‹èæ_ ’j1ÌØk—b9‡ºýŽð w­3†:xDBV@GŠb=ë7&©Ðóï•‹êì_¿Êb°“‡’›•¿[E¼sã]hÉÏ1È•˜Å¡¹\v²ÄO1†„šÆúz…±s3R· V¥/Uò•ôº›¶¸d¯]ví`ÅøÖvâ‘~àÂ2ñæ0t"ž¯Æp-¿©«ªHû³#t“ªãy ÒV”œY¤/¥{c³:¡Ú~W6û\¹ôÎÔ5·Þ‡wɶ8s»;ú‰3+‡T($Y]mòÜäCÈ<8í(ûi!.Ù6Fï¥]‘¯æÀ«&OO´¨³Ë¯Æ®l7ùÑ„G§Ñ•þ½…ö’ƒ^™Ö;çTl¥Tƒ[Ž3áÍúŸQ4.UL3&"y"yâç‡EÚ'B0ðª7@8*§…Þ·3Ï_¿Bu7DÇ müºî±5òßÆß¹ÇݦƑ:VÑÝÕÂ$¼¤×™¿[zÓ%Œ~·Ñ7¦€$2Ô\LpíÄÓ33g¸å7õ0LÌì”t}ªÍ×ë'\‡{yÒ°ìxÃßáXÝ&åu»½ Ÿ-·I-—&¼E¶}2ìËê^¹ý¶¹8‚c5ÔŸoßXðÀ;Ú^^õni<~}¸£kþfe«ó"š”2âÝu)âÜ+'9Þ.›?#ÅÂYO¾¿×«Ý"ø}‚mb‰BDè£ +åóD(‘Æ{H•‘‡_Ú°¼$3‰_ü&ê´Z¸*EÃÃ+gâ=ÕHÒž ¬ùÙQ‡Éx¾vÔ~ºZ?j…Áⲑ5¨u^4r¹(}g÷:>LC.Û7âµH81·~¡™Ã +‡Œ7 ³î¼Ä6Ó)ù° Ì ˜ÜÏ·c7Y½ìéHfÎw]ð +º½2.oÚ/S<§Å4qd–øçY¿ +öG\|מ¨‰ ~«fs0M¨ß<ñeŸ‚£ó-çá€S3ÉÀ±ÏÌÁ4ƒÇ›XûKÏ–™iÉur·à1ˆïL#Ñ4˜uÃÆ·ˆƒhf×$Eî²îÅÜy^Á¸®¹ ˆ$Lq ÚT®Ÿ¨í¶±iTÙkFjDâR”(¶1jáŒ-<æè] ÂVs³Õ’wÕ j"î)ò5Ò‹“1rnGÙ¸öÁÒ«“º*ó»qLöHDîn„~™-Á ;à3—ê¢zÏô5—|­/+õ¾«íã{!L™Î„jä,jÐöRQšj¢ŠSeÊ"IQ{hé;ÛáH;‰ù±gpâä zB>ÖÕÍ AÌOk¹!‡Rkb¥憳‘aŸªIzÊbò3D5Ò¯•Ò¬ó—± ´1Ûq##‰ûíò졹#›}d³ÿnÆäŒ ±ÇRaÁ^5&Ki¾¦&šBûH'¾¿”ïM¢"ÜQ´l²QÀÝ5i,ﺸòó1Õ¸ë{à +û·J¥q¯0ã—z¿P£Û–䤨 L—$õØ +®Z¥3Hý4rª7¼é#S§ èßôÜ"fÚ…Â…þ¤ÜЧťòœ_b70*í*À{ a4#s+®Î¾Ê>°RÏÊ¡³C´ÙÐÚ6 }¨6¸mŽ›ÛÈþÕ2Ž0Ñþ2EE°ù=¼mmrà +´å©>ùžÚò®ä0ÙWI釫þˆf¬ÚezÓ#æ¾ÊãÓmÎñˆ;^§¨ï棈vw¿‘êÚó®C^žQN¹ÑX>&¿±ä¤w³Œ¬Ê†~’ Ø䥅K^ÚÐTAÇÙÆ4Þ•êŒF#ìE¤þ‰b\lìWêDºéhð‚û–(ÆÄ0ù§™17,š†º/vR”=_ó%×w ¥y¬6`´}Á²vêW…qÞ¥²x78}«È”».S–_¥¢‚'ž…³»¶ÄSB)¥þ\åjÆIÑݽ̶Äý,õ›ß¬Pî8 *ó'êË´€3ùÕFì ±¢ÀÍ)Ê’Ô¸[2å +k¦ÖˆFäÑW›ô*„@ª¢©+]Ö{Š=h×¼{œ;– JsS£Ë=ŸXÉe( ¥Þ4@%l™ì—Çs²šÚôÅK8ˆKÊ%aqÒ¯ùßAR™R펓•ÙÊ Œà‚ì²Ýƒã¼MVqõçÈýq̸ôSPIÖÇo— +ûØ`Mxàñ³Õó‘Uš÷–TÕÅ_ç+â{]¯NµÖËÅr ò'$ÝU-z¶ájËk‰iÝza»á©±8bnz|½¾á Mx>}Í@ƒéù´÷À%ø-ܥ̿ê“ÖpyŸµ¾1ùï†ÃÂAXŠ õW ÛPP“üVpAÙäTÖ&‘¯h­ÝÙ«aâu2HÝZúæP`JïƯp-ƒú² YH>z×(gúK¸Ë’ð“|ŠâðÍ7*Ñщ¾!¼ˆb5›¹ãe0’–ú°„¶fxÅÄ$¦¸»´IQÊó¥ï­" MõfSZ®(¯PIFG[ÌÙ#¥4K·\÷,îÏß&^Üñ¾Eû¢¨R½zC‚§y„zFÃ|èh¿q*ÍØ⚊bT;îÉÖŽàmàE—kM|IbÖY–±=h(tçnV«(„ÞþAb¾&Ì#†Ô‰ó†*Òs“Ž¨;h@dðc fÄ4CÀDÛ*ÉSˆõ{Ñ¢:t¤¿;é5¿Q„ ²Ï-Jôâ;ŠŨ;Š—O4ûêWþÈ‚ Ôn Ýú`¿ÆÙUsúe%¼ÍÕa£i1Ç¢« v’Ì ™B#ö´ùÈ].T„ÃIz žF°&´ï¨y×úà7Ô«k5'ÅI?Õ¦ü(*æš¼M¡­KÈãBÒZÞü¯lzø†žÛÞ†ù/°¤.×´2¦’¾nÆw^âê›_ê«”ªFs‹ñ‚2_ãD65æAò^r_Þ«J²"jž#Q 5'A"„ÎD˦Ï-Ÿ>‚ø~™ïÄrÊ«/  p©×:JÕ©—½fÖêí穱~Ø„Ú°;šlÜü9ÉÔyL3e<µÐc€ÿùT;îyoêøV*ïü$#$WhšÚ4€È1&ÏÆÞ8}éQãŒâ£ú*˜´â*dc.Pû눘£¸ ,ÊêÙY{Æ´ÖËÑRòyh«¸PS0íF¿Ž/êˆ )6Q,Ÿµo¶¶ÐUOZ±ìJ³ì£Yîίoç¬ð̤Ñ5b©òàÓ(éóñªï³ý7u?”%9$:DK¹D/`&)-Àzú®¿7› &:–ÒiÇR1½XJ$yä˜Ð&¢xÓÕÍhíÇ°˜9NWðqÕ|o@Œá»DÀ¸ l‰Ày˜šàòõÁ÷oË`w}‰Bö1Â`——>Øåâ*icÛêQV亭‰×V*´ÝŒ¶¥å9'ŠUô…uí4žýÙÊåõ3P‘&À<@%éI +¢¹ƒŠ.:šøp\î\ò§bòÆ.ÑŒ‘-½W½äåªl؃Eä`Î'aç“wÊQÏHY¹5~tÝ—«Ððo7·+5ñúäÐ’ým¢!ƒàüL€{Ø_#Ÿ×–šqI–o>T K¿ÖËoýtü F²¹j1)›éx}ÛqÀIJ2¡ò—l,¹Û$⧳2g_[1ê¡^eŸi´”Ï’`ÑB(‹Dû^8‘„² ëÁ‡î´Ø­0žLÛO¬µÄçg¾°NP_ß¾ËǬ£³™ÜÁ››±A›²‹aémÿ¾ 1`I?Âï,ii² ¢ÜŽEœ´I0ø€â@~áA8£eÉÔËò&²Ëb–ulì´XM÷íÙÄœøû!ÎÊ‚Ó•‡XlƲhNíÛ-ìæÒwœHf«2Å‘ß‘+_Ê®©¥:Ä´}ª·u4³.@ý,3Ÿãš1kÍ16Ãƃ–äê|·±rŸ¢`Lté{Ö¼Š²©Ë ÍÙA¯´#z¿îÓ•w;ïigqz¬ùËŒRòÈ{âìzÔ{J›!§‰EPr WÁœ£[ߟ“ç$"¦qÑqIAÞSy¬‡BÃHD’þw§ž¦hñÝWwŒ·èh<‚¬n·#[bË…KÛgWc,:O{ +Œ± fÛâç±›U²]?0“¢¢[Õd ¤Êðmó“Q”øD©R¹Ýë@縚G&‡ÓüI0ÄddlÊõ1.ÞêžF·9ß Øò +ç’è­#Ã[\‰²È@ (´øL5\·‰ï¦ñ’ùš¬-qàVõ‚„ÆCUXŸIJc~êÖZgq²PCCb éO»ÚýŠàY{pÌ¿áä~eÃOKÎÿÉž êz~¾¬ÆV—%Gá¬9#ú6($bdM¶î ‘(L'¯öÖ¯¯¹„_øÜyÌÀRz2ðÇVl(ÄlÛ¾^¥éSysv[2Ë’$QE'D Iy˜&k±½ù¢®‹.ÿíÌù? +p×s ÉÙÃc9Š ͹æxÉ=b…9¶Ì6rL®FØK¤'räH¢ô$ç0çc–ˆÐC¹¯eÈ‘Ü|&¼?âýö>ïû|õJ.?M·ÙÝLýµ í#˜Ñ¢†é&eðLÙ‰N¹ÛŠ9Iž··¯ š+üøŽûL£m…7bU]j)MLÅ7q6?a¼H8¯{«é|A³ÀCšä¾÷ì$§<\†²1Xa/©m¼Ý×)”ƒ„ÝZ×_QÏBKÓûóîô­Lë¿eàaðÛ¯;2ÎA*0>G)îαñªæÆ€]‡ #áƒþ\'þ½«Òpž±|-÷è;^V`5¿ l¢Di}–Þ}ž'|7ºéE0H7}Fðp'±€ùnM)ý6?0Kï‰I¥œ¾JÉiN{ïËÀáµÉr¿u¸%-fЄôD¾³’å;ÅãÖ³m‚È”J&Mi5ž]å,Õ°5j­6¸Ì\è8I°ÐîŸjé»B‚iˆÇ© µ"¶Ì~éˆ=†7]P>ó—>¤î‚sõH§!m°¨Dûä»ÆèM² sSa»»Mh©™žl\¨“yÓï´›F‚÷Ý>k¢ñÆã¦Fö€O+?ù€Þ+ˆ¢ÔÙë ³ÙKQ ]æ-]#XÝß n÷²j|5ø#Ÿ<‚d¸“°ÉîFBF1d#~žÓ;µžpÓÂïñ§mXüˆ> Ú…£¼¡„976d¨ÏÝðÏ{"©zè¿Ù§éÝž,¢ùÄqåñŽšHeÊÐú^GõA”fŸ•âOòRᵨyù % ´iÄ;gˆBŸBZyúï“ÆHï³·×ßÝ`#%ü¸lZ¢Vœ^§LŒ¯i¾@¹7ZV`ýÃퟙݕ«¹çÖ¸pœ¹Ú‚Þ‡¹. 3èúμ-Ÿú˜Ó9öĽ)“ÿ zN‡R7íªµáþ>–¥áÚ_i^†HQùóóq’Qº,çÝÀ¤iµ ržeϾ¹¨1…Y.¹'æè·]êá§Iv¨œŠdâP5/ûD…¡D÷5Þä_1Q¶• ݶr¹­£ß20‘"®@šûvñ¡¿Ïu½Ó}SĤ”ïZNŒ‹Å½©g~$1 o•ªÌÕœ–SY¶€Â‚6 Ô»e²Æ€&ˆÐkAÔ©6“OúPŽKàD ™˜øéKoj¹ÓA†õøØKù +ëR-+[~±[Ù—Õ]`Ê£™Fƒßê>ã<ãÝk­¾e•Ç‘ ®2ùÓ\'ú¬Þ©•qÿn”Pxtÿ¸áÕÑCüì"À°#×{ù¯w_Ö"3{Ÿk'&I£v¦ëA„%”uÑöùZ[oÁ.Û®MôÓw(õù·ž6ÙŽË¢ÀäP-Ïrx‹rX¡pL%żTmä·©Axz$9£«ò<Ñš‰©E]†Ð5ò9ñ;¯çöŸä» |TÒÜ…³æ^p.ä3>Ê»ßÒƒówCª„¶.¦MÉI]¸í¶ñQêRK+õÍþã+uõ‘u'„b-8ý +7b!]w©º ôô “ˆ`–ðLß­Jœ¥“—ôºcÉ6?@¯BËÅ”x²úcˆ!¬§gY8ž?“Úˆ å.0’f»(%£ #.(8š¦Š[¶©°Y‡cç†M:Ú ? ƒG4®SuôZÛÔª!?@ùk}ï¸w0̲£>Nü‰]| ³Ø3”¾r•x÷µòïæöªg/Ble§O˜k\g,U†iúõQŠÙXÎBb‹GH!AÈä­}©‰zÐ|טd©]æµô”NÕÕ¬ÝÄq·zÍ¢W +>X`ÐÇ N„[5|ÙÃ1^Ë¿|ÒÇ â¾½×—PפV;_k,ö wÈ“OOy˜ä•U´+â#S½€Û²ô'½Ú»Ô:¿ý\Ãv§@u¾FúSË26uø`ü}ÎÛD$*Ã{6ý•ƒrÂO¯dðÇe“½•ƒRו´‡µlòàEUmäó¢2égüu5]¢´L¦Ê1ÇÅ»:/’b­÷J”¤$z›¬=kY>L¨ôi»ž6èŸ[‘³Gzm}ýö¾È½Vwÿg²IÈÛ$ÍMb¸øHYTd+^½D¤XúúÒQ¨†_–óù”–ÙWuÀÄöâvý4&"BÒ¨o ®\2ø²ëé!a ³¸_f}Ð8èc«‚Š«µ,-ÂXØ&†Ä—&¦ë´"àâC£”Á¿UqÔãÆúV±ê{˜Òø1'…!rUÈw3І`6X] ™È2çÒÉ-íÒù—ÿÿ‰À7ˆàìø2…Ÿendstream +endobj +2876 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 6699 0 R +/FirstChar 11 +/LastChar 126 +/Widths 6718 0 R +/BaseFont /AQQDUI+CMR10 +/FontDescriptor 2874 0 R >> endobj -1294 0 obj << -/D [3474 0 R /XYZ 85.039 142.394 null] +2874 0 obj << +/Ascent 694 +/CapHeight 683 +/Descent -194 +/FontName /AQQDUI+CMR10 +/ItalicAngle 0 +/StemV 69 +/XHeight 431 +/FontBBox [-251 -250 1009 969] +/Flags 4 +/CharSet (/ff/fi/fl/ffi/cedilla/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/circumflex/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/tilde) +/FontFile 2875 0 R >> endobj -3479 0 obj << -/D [3474 0 R /XYZ 85.039 113.658 null] +6718 0 obj +[583 556 556 833 0 0 0 0 0 0 0 0 0 444 0 0 0 0 0 0 0 0 278 500 833 500 833 778 278 389 389 500 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 778 750 708 722 764 681 653 785 750 361 514 778 625 917 750 778 681 778 736 556 722 750 750 1028 750 750 611 278 0 278 500 0 278 500 556 444 556 444 306 500 556 278 306 528 278 833 556 500 556 528 392 394 389 556 528 722 528 528 444 500 1000 0 500 ] +endobj +2867 0 obj << +/Length1 899 +/Length2 2415 +/Length3 532 +/Length 3046 +/Filter /FlateDecode +>> +stream +xÚíSWXSk¥\¢R¤‰(ô‚Ô QB¤IQŠ”˜ HB¤PTzSŠ”¨ ÑPDé ÁA©"©”"MEºˆuîõŽ÷qæi¾9ç嬵×^ÿúöþ¼œƒ +K<š 58®[ÛÃ58‘—7&h +ŽH0AS@=®« PÁ>€ €kë!tô`ZyÀ˜JÂùøREc¥o"$€ +I8 šX£)¾`ǃÆD ¤„BØë ö $QA,‡X†œ}pˆú·@o"€üAcƒÿ(QA™ +Pä„T8±D>À‚Þu"ç,“ä¿êWs³`<ÞðÍþÛþVFàð¡ÿƒ) °&bAáWé1ðG6k‹ øµjAAãqÁ°Žl† ±v8 +ÆðFãÉàw$` Á™Û÷ê.(ËcÖ*?öù½f‡Æ(Ž¡º~ÇðŸ˜3.pƒAa08GÈyÿørÿå,S†ˆÅ8BK@“HèPçfpp,€!œÀêP‘Âi83‰¼‰$È·ujêêa ‰øýAèêDø'Ö‚ꔓ?ëZpö%?HM@ÝòO‡qñ?!\ P'ÿjsÚÿ‘€zðO¨Á1ýÿ>P##bH¸BPÓàdÐÕÑZ°ˆ×9pAÁ … '5 †ÔÕüÎb‚I$@ù~ƒ9»ú{ã8›Á`1úgý.VÇGš>)áSæ6ò©I³¹ÓÔ{wó™þóÜøëm‡ƒ”_T8¯•æŠ óï>¹.CNh¤é4{:(-»ocœê5žV'ã<Ÿk:¸gùÌ´pCõ³…-nÛ§/Ú‹3\/}øÇt¢‰ãÿ°ËZÉÊ;«t6ËÅ;Åž«P@ÈÙ‹dÇiÆŽœɸðÛH÷™H¿XZ•¡ÄÆàmk…ùéÇÞ=5t“¤÷i»ºúžû²ð¾èĤC*š»“ +Sòêê××ÊèêŸ ªÒ² Ï èéhmÓÚ½úÚ^ï U^Š„F?;מouRZ1μD–¶qaWò–¡ªóGGU63õΧ¹KU´ÉÂüÅ#Ï-lÉ‚‹úÃÞ +YU±/³Œážè-©ÙÛˆ{G^Á–+NŽäðO¥ß¤çH$´¼¶ë\Wõž½0]Ù!¨\Ÿôú„yµWc°Øî)o&SÇ +ñ•4U¸Ã-žJÀxš¶4ù–ENúè¦òž.§ÕY+}ŒpùšƒîÉ,>ô¦Ÿ–½y-@.Ö •&Yàh×Ü*ccìÔ€œwbW »²æ}–… . Ÿ ñ\HóÍ w„ίÜ<Ö·œW÷°ÛcÖ=ûX]VD^Vg7¹í¹ìºÖàM6Ü^?Šu!®ôC¨–鳜vÐç©Ø®-4sË4‡=nܧQËÔŽ™*çN_±–ÈlÉ– ƒÍf@+DË·Þ_llF©ÍˆÑ)a‚«[˜¥Æù¬ýú¢*¯ú¡ë²@8#1xNýåv^‡ÑŽ¬|3%«s Av"…€”˜ÔVh´&ê ÔUëÇfÅÉ×{µ5@sÁ°ÆðøHË®73u·|²ë]JöÌ|¾jß²€z¹ms†Åû¹é‹Ô¼gµ/DÊÅ6LÂÜ÷Ø"ì²@kc>øÇÌ›Hnç·¶’ fNpþC¡:ä‰eq—„ä@Üm­M{Þ{\ûÜo_z®©WÈðãôƒáªa'£¤Ä™•ìÒüäÀ¼þ†XÝ(£˜BêSIŵìw¼°T„¿P: ´SßçrðŒrmýzwkbW´âEá´™ƒôÃ:KÔ.ߺ7R|ÓynŒ¶¥–¹K–}ðWc3Õ4-rž¼c~£%×°°h`€Y9ü8¥HG¹TÎ=ß]!!Þ>¯ŠS ÜôÈü¹xÞ)ÑA‰Å:{B9­&ÝÖÎÞ@[_IuÕ³C/¢ÙyÜcÝ3¢û•dh¥ ׳:iô©ÛÂço¹Ò[^É;ß?™¥1 vÕÇËm™x¥ ³¾ðÒ؈ѥ²E¶FYI8‘ßÜgcZ›LlºiÊl«ˆ0õ¹m*›;ܧ;2œng%†j{Sæe|q͈v9×PD 3âYÃn¤ŠŸ¡Þ›ÿšÛCRi¢rà Y™ÄŠxqm£¤?4±ùM‹E³½ìÄÕÑ«ÞQZÓ³¤}oÊ]º{¹: wú%u®­‡W‰¦­³>idú/¼ÌÑ”ú©jVɧ ¨›Ó}½¼ŒW¾s†Žù˜%mïJõ¿ìi°¼reÊ¡ç†>ADçú]“¡%ýòw2U¥¥ì¯ºæ} ƒÞ¯2èRà¥î÷·œ¡oÎå ×b³ÄÃ|¬µ¹4:ÄŽöV‹Ô¬nÜšÊ#;'f uù%„Þ›-W³ÅÙ>4ýËD•îUíÎeV T÷E +´š¬xdöKEF¥R.-Îö¸Çv¶… }RnÖ×ÃY¡kÒ4UÂoÏþ’Q#cf@c¥L>ˆÅÉ)"ìï'›>ÈMÞ†B—HªÌvÂú©5Åz}GVM™f¯ïm 3ã3gŠæ¨µ›"Nêªo‰l›.ØWmêy?%ºsfº[A³Ù§l— $GÌ_P.ÂÃMÚkÿâkk ¿Z­˜\GÌ3WRçZ®ªÑ6Ô´Ì>ñIƒ{öc‹û,VLŽ¤¿Š÷ݘÕþrÏ»(ßR¬a틃+GN±IVT.›™ì%6ë<žk+ø5~¬nW¬\B}TȈ¡ã†<¢?%N.¶ž=µýío˜êõD®‹ÎììÃáwm´nÍ¥Œ': BNÉZŠ[¡¼ñÇ+C¨ +ÿl4&xJÕÈ»ù„÷ZíSƒ% TºÿsºÔ\+jE \æÛhfsÁÓØô—Ó´/g>Dñús9ÉölÖ­ðvHh“ 9´7 ,â~œµªR»ßE\çÕ +§”ÿ˫¼M=qÇ=1;µíän^:­P¼Íÿc¾é[åš‹DµJÞÕÝ›œUîAÝ.ÛŽYP!as=ƒOÚæÈÇ6EC-66=7²Iæ¬rKÂÏ)¦uÕx0ê'ÊÍvÑ’¨¸ÓgË“^-%º ïÛE‘»ìüБ>ühÎ{xT—·JeÚÐæürèâåí&F¡×¥w—ˆ6!=¸KÚ“xýÔÆî´ì¿nVÔŒ#‡ynj‡¸÷¨ ЋOéÚ¡ÁÌ›ù rw­˜¹ÕAU¸Š'ãTŸ0jn¨"rŇëMªH%áí Z…épG~g“GTé$ã|—!vúâ|k­WÆR¢1áÅŠ6þ¸:¼'dî뉜If? äH'¢E+=uéò–‹m{Ž¦-¸Ú$<¯mGiÜíßQåƒÈÜUwý÷Ö!û,Ú™øô.æÙH¯Ê¯«3G¹: +> endobj -3473 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F56 1642 0 R /F20 1617 0 R >> -/ProcSet [ /PDF /Text ] +2866 0 obj << +/Ascent 694 +/CapHeight 683 +/Descent -194 +/FontName /YAJWSM+CMR12 +/ItalicAngle 0 +/StemV 65 +/XHeight 431 +/FontBBox [-34 -251 988 750] +/Flags 4 +/CharSet (/zero/one/two/three/J/l/s/t/u/y) +/FontFile 2867 0 R >> endobj -3482 0 obj << -/Length 211 +6719 0 obj +[490 490 490 490 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 503 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 272 0 0 0 0 0 0 386 381 544 0 0 0 517 ] +endobj +2864 0 obj << +/Length1 2124 +/Length2 13008 +/Length3 532 +/Length 14161 /Filter /FlateDecode >> stream -xÚm?O1 Å÷ûsÃÿI.öØJ€ÄÄu©-ˆªj;ðññ])´§S†Dy???›ú¡ P,%ÕðöÕ`øp屡_"eœ’¿gÄî¢v, -–fȨôÎ hâYÖæî1øOßK¨ï#Z7ëøÜ -Å×V0Nm'}‰+h_êÓOP´ xÇæíŠ0P’±t±ß{Åínóù½=UÍ}ýÏú—#«ÛÌ%E÷†Ì7ê”bRÈv^È8å@†v=cš&`I`y²ÊËý"ŠRendstream +xÚí·UX\Ͷ°‹w ÖXp· ÁÝÝÝw×àœàÜàîww‡àçïoí½Yû¿<çê<§¹éwÌ1«Þ9ªj̆‚DA™^ÐÄÎÈTÌÎÖ™ž™™ ,«¬,¤ÁÌ`f`‚§ v45tÚÙŠ:›r˜¹¸˜‚.æÐun6Vn&x +€°½‡#ÐÜÂ@%LýO'@ÐÆÔhlh 5t¶0µalh P¶3š:{0­­JÿÜáP2u2ut55a€gf˜F¦æ@[xÆœ$mÍìœÿ6q±ÿŸK®¦ŽN )H’R4±³µö˜˜šÁ3ÊÙæ2™ü¿!õ¿s±¶–3´ùgøÿ®Óÿ•ah´öøï;{gSG€¬‰©£íÿNU7ý/=!;ëÿk"IgCk ± ­¹µ)€é¿B@'1 »©‰ÐÙØ`fhídú¯¸©­ÉÿVî_Œ* +¢jBª´ÿ^Ó]V0Ú:«xØÿ{àòÿÅÌï ª#РÍÄÀÄÄ JýýÏ7Ýÿ5¨­± д)Ø9†ŽŽ†ð Ý"v€3hkbê0u932ØÚ9ƒn€Šâ0³s„ÿgIA«Îhö¯Ø! ïÈ +Bë#+AcYÚ¼‡ØŒ.vΦ&FÖÿµÞÿ¾Â`4±³¶6t|qýwòf²1í Mm­MÍþŠ2ÿwô%ƒ þÂÉê=³·vqz€´Œíll ß#ìF { SÛ÷ÈÐ4É{ˆÀèdmèdñù `ô4u´{€ÂÎÖôß̲wv{¿Îòv¶p4ý+㟢ڹ¼×ýŸ²]ÿÊé:üß ’u2uýË´¸Œ¦ÿQvª-ðo‘Ïÿ<³µÝ_7qý3Œ ð?£ ASÃ÷uå`ýg]Lþi5ïA“áût %Áwé½HEø@"ïrý7q‚Š%öN ñw•Iâ@N’ï’‘z'‹ô;\dÞ ä"ûN ¹w¹Èÿ›>ƒ\Þ ä¢øN ¥w¹(¿ÈEå@.ªïrQ{'‹ú;\4Þ ä¢ùoâ¹h½ÈÅÈÑÐØÊÔù?Žë¿ãÿy(@Ý•ñ}«s&2z'ÐDÆï'š 4“É_øÏfø ÿÙª!hBó¿ôä!èÑÿêL g·ü ANV!HÊú/Y½wfPwd´ý AVv!ÈÊþ/üg»þ… +Ç¿ðŸ³ó‚¬œÿB•Ë_²rý AVn5C•û_²òø AVžá?ÍÑÖäzÇÿýR²s÷¢íyzPÏU€ ´=™|þ3QÕ:‰’" ¶ÂÄôTÒ¢Æ.Ž >èü¯÷0hŠÿa3 èõdjênj ¿4ogÌd™ÜRâ+š7Y +MíDZô«#¸>•‡ád}Öñç„Š)ÑZ0š%° õû™t£‰û&^£ ÷ —2cð"Ú &unšò‡sã=ˆ¡ì›Ìðƒ%â]ûŸ´çËd·®ÐU2GÌœ?ðÎ" Jæ_®}­üÆ6—RLÈö¾Ãëf·Ê$™ªnÄŽ>žŠÛåÙ- áè¤Ýb¼.áõ¬M[­"¥rEfËBÎ¥ò=Ã1¯Z” {éÊ! w‘{퉪ÕgÉUÙ–dcoçE®b¶.bnç’‚»+Å&) +½ç +²F×iªBÿP”±‡³ÆàØúÙ”Xœ[tVSé“ÍPV¸ŒfC¶-(ªÐÖGGý\DºÅj3ܸzçcQÛfù×åÎ04_PÀ~?'g¾Qþ@9Ú:j¬‹8 –l®¹ÇPeú ±(׶Q%³ý$}{láwY\«ÈH¸fÇe, Àð£yî«ôaš4­{2á)«_*ŒáÈÓQÅ1¡:Gx¨SŦ0÷ #bŒË%¶4eC%?à*«w ´¸×qaÕ!1±ÁÉ~*Å yQÑg,˜|EõüãÜrþCv”¾–u„W%5ÐhxxˆxZ³3Os*{à;—{½õx¨Èó÷¹K˜‚4[k[%øÒ‡L‹X–~~ÞÏ¿™óŽRõ«¿~h¹ÿ‚2~Ç­lJ˜HUAaq¥Ò¨sj¹²Ò@>kœÆ)¥ãÜgsõò‘i°/錥óÉFQNDºöºçNxºõ¹6ѯ$4“¬‘º:=›h£F˜¡Þ‰µ“NÔ‡P0”FrÉ~_Ó~k!0ó¡'Ä(%FOÐ[ÏÄ~!¯?§³KÍzhöº^0#U¡pîçõ/˜üöJ Ÿà ÞpW!èNìµ +ö˜©½/g´ª¹ŸÆW·]!;pRO +.ÚJgŒÞ¶ºb4mìâ†e²ßúd“Á;È¥êâ.¦ÂÂǽQDNýšûñ;ï—•’”OCÄ–’ŒDÕÒ™†%Í\qåŠè¿ùµW ‘L ?y^èó®VÄÑô%pnóËo¹Kdz—aj: ÕÕ;U -xÁÈkéïÆT“Nädúæ:²ÕêöBò”ö{ŠVÝ’µXªaüNv&Œ¡d‡æZ’Ñ¥P•±…+(›z~nÞOÁ{qÉÂgf"‘ƒmm̈Ó*ú±R¾¼ÅIfùˆ†IkÕÿ ¡²7­‚öT=,áS¤¬qìâr¡‰9‡Ü;Ñáuw”06y<—ÔzÌã‘åù±{uŠ°OÙôé† +± _ŒÔŸ”—¥~›ùBs”úÌõð†ýØ_OëqQÇ+½âÀ%ÐŠï ‡õ¿§q8gºbW6ÝmLÌ j=‘%öV=ŠÆ9ý¦!Aül —N:#×.JÕ=TAP$ýjÓr?¯•OürM»Ho]›qkž}¶µ ¡l±xŒƒ‹m½ökª‹‹õ…å™RæºÜÄ@uÙ§þMÕ¦AQ%)ruðïJ£¦œù©aÀàÇ…à‘éjsL©Ú œ`?ëÇ¥iÄ&"–xáÔ˜½s`e®1kÍñš —§6k«J{'Ú¡:êØzít»¬h= ;oèÌœ¶º±µRËF,ÎÓ•HÿA=6‡{Ã>?nŽ“ÊàÑY[RTKÒž0îÎíAUö¡y8“ݘ[7]»g¹3ɱø÷ÓíšX¹ù/WžLè}úÁQ\AiŒ÷?¬µŽ2¬‹GQF Ž˜aMô9¥imNÛ~ð =aáŠääN¯P÷k¢ÌøùT©*öýˆñq«T7r{~ͬî¯h©õB‡Y­\§ˆhHymê'DÃJ/ËÏÆ ¬ +»¥|Nsh|¼­üTSصnQ㾶§O"p¦]Ut í¡_È»jÏòžy§•ÇS3¬Þ´¬™æ.Ué®Õž'ª-,çõ9ñ'Äá­\]”ÕVõ`T¶°ÓRÉk¾Sê0WRú(yì.%„N~—k;ê+*ÓF¬a~D.û%Êwö ¢€øóiTµ²±T´“«Ãiø‚¤Å*sÑÀ£B0—y¹ Íòï/©9\'gËJ/üZ² +¶–Až¢Å}9IÄÖº¤53mÁmfó·0,„†?%ºÀ×rê•Ð;ÊKnÝ9‹˜}ˆwõmþÂÜ2-D7H’µó2!¿ÐɳzÒˆÂ~¸µÄ.' ©*£¨8F*Ÿ 5áÞ0˜ÿ¼˜Uµûs¢ìº?í|`çµ\L(I†ƒùŸ_ ÛUvÑÕ‘å‚é‹ò¬Ðcu¥OËÉÜ6ÆÛsœgS)ã=˜ÃÆ71z˙ʔú8¾öGE”ø¯žÚ‹iô ¶I·“´Î/D±ÛLsGbT{Q=Xåä¸ä‰)Ä—÷vÈŽg–­üº‘"Qôlù¾ûcäP§:ý±ÿ¤0ÃþÜù×^šØƒ>…T>–ï%åÆ] Î9€ÔðŽ¾atv7…Òéë¥c—kCå)°/4GïZ‘Ì9Z'œö,¡ë¾Ã½Zx̆ƒÞ£‚1…LŸþ!§ò[ zz‚m [>R¡Cí&£')ʈ0‰‡ó+hâªÐï½5rʳë(ŠùÌih&{ƒŽY?ßÇhÕÒ¤«}Ï·æaÇ0FïàÆf§ôøsì¹¾kLJf*p“±ÈXì·Ð/ÇåPhªdç…ût,åðLN®¶¸¼¦`Až ¹6R¾~Ëÿð:P˜Þ߉eh8éÄM/øØtÅS÷¡’A1V½ÊµêóŠ¼DEÀëFæ&ÁüxAͦ³iîRä-ÉÎQσâÔV«µÿÍ·4Ñx² ²Vl|ÈdlÝ$¼ ‰]EÍqd8&úUÄ9‘áK“>$Å× þˆÖH'ÿðÎ]:-%iKøïh§dõ“Â>.µÂ_º{Bk×ByxMݲ‘2BH±tâG|·TYJÆÝ<ŽB\Bór«¦´¬-Yª~Ð9ã Eòaq³fÐă›²ŒÉó2±[•´ò»[Q~ÚûÅÛ»BÒ3®QãÚÀa†íª€ag£¯—5¼ÿ8j²¦’+‡¨ù$††eD¥<5 ¯n×ò$H×ðuSÑÜ~¿Q)›)ÇÃ@éþÖ'D9»Ê¢_0-óû8µ„_ ©íÅ'^5‚­Ÿ§„Ñ>¸¢2¸ª2&_ão[W*ójÃë_|íVŽ ;–ÅÓ‡ÜÝ3Ù«!¯|°¹‚Üf¸OF†ï°úˆú(&,ZøÝvÀËMr°ÐÝÁèô~٘ȟ˜ï–k¨¤^J^©^ƒ¦Q5ÿ2’NÕ+ø.Šú¨©öú#a¾ØÛaF=Á98AäpD³r$[á¸Ç×u ÝH‘»YhÆ= $ÏÛed|øDEg¶Oý&K#™‘`[±A˜šup¨ŸŽôƒv?SSPlvË»àìžD iŠdÿ<ŸWDcÅF‘ƈæ£V¶5Ÿ–ØáÅr•ToF-õˆ”ÂSFªå@K/aœÊ¿áe*,«^ð¼ Èd!l• +ÈØa€úà÷c?2 l­T¸“Æ '*îÞLáqõߌçô°Þ<ÀíÚXÈñãìp/í äÊ÷Ètu¸Á˜0Ž’ÆáHQÛ‰YG +Òóýoè6EúbI;ÒÃ-mãöP+ù÷¼W*:1´’qÉT¹NŽ,-6]Å°/ʱ%„¸$QרÎò½&˜&Ì= J3}f7É¡Úìæ“OË&aʘ]ž7ô‹#VmÆÆÃãQG:2šÏ´vf¼8c¾/RH'·üu¨jÒôj4‡AŽ^¸V]vƒõW±×;ñ8+‡ñŠã-}âOí‚Q3§¡‡ +Oú¾øoÐþ†Áhví‘üJÑ1$— +¯Á·tóæðsÌÊ=»˜©Kºª‚ñ2"¹¤éd‘Ž:0BVŽ¤–?i®õ þàÈö iJ9—ànrÇ‘,.c„ÛkrXçÔ‡ä5X[”)FÿVej~b"kM°Êvΰš@ê5LÇMA&×Ñ% ÆU³þ‚gæ%uáè¦gkæ®ÙóV"ò„£œ¾‹/$EuZë/Ç%ÀۘȹVz{-²rHŸ §]Œ, +Ž«1#€Da3s] 9­þ%æÓûirV›/ÿÄpöýõÖ36$6«îñMc£k·.ò·Ûÿ¬AW*øó‹?aI-zöh+g+OCG¸rÚœ÷Ë'œÕßËdªè²ƒÅºöDþ03ÛWO’‹´â‘Ä¢ãBBªèk6MŠÛ4ëÕ·EÑ£7ïO}tצÏWú¦¦4¨ùCíºl":…«Of=¤‡l”¾ÖO³Ÿü3xûµ‘Ï‹zµpêEëÑÏ‘ØE^œÍûüÙƒû£×­n4ÃGá/â3ù8,&Z.ýÍ&Ò‰¥è”ìñ_ $x†1pyôUú?æfnI>¯®ŠoßÂÈ!jã÷Gä›ï+U¼²xq•Ái®ý¡¯Ô‚XòGu“Úçi…¾ô‚­’ŽguZ¨Z½“èÃ;šLnkõ¤!ð–bÒÇÜ[Ñ“¿ç +àð¥h0?öñœ­éçÌ~:}!(Úõcàb(½ÂNîÅüÑDPrv7.{Î7AÎL¯øa•V<‚ûu¿ŠÚ*ÂrÕñóÉ™}N*¤%Gi ù +|®å€„ME‰Q+ÌO";ªAo<ôMÀx Å +ÁP#ƒt?ìC¶TµtMoá‘×Ù×À{Y Ñ[O¬Ɔ ŒŠä´ó^H ûã“Rˆ€PÁ³‘\³[œ{^ ÒBݾ¤*ê…™îë}ž?|`p—¿ÙRy—ò^Ó¾!–3db›µ“E›h/r7phôÚ*Ô(g¼"1£6³—_¼ËýÄÓP»ƒ”ù—¼bè‚^ +Í´·D²ë,Ý,3m†¯eòöP6­7rIÀ¼òfv¶™ñ˜1Dô$Ü4 )ãð·ÒÎÊ×ù<õ×]Ül©62U!Wô!»$ãëG?½“)ð=æTl*¨dš…f£®†:„hƪbÙ3öÇ ¤úÝõâÚkâ>¢œª™!NÊ.ϱÉÇF'/Ng5g PÞß# 6QºÏ#èT ÀÙ4(ĽŠÑ(mF‡Âè¬6Qnšo冄؂uÌƈb]šC9çŠ"–Ã`÷ ¾W½~Zç燎6¯~h`V·§ñºASʱÚ:@; éÂÅœaúŒ6{íÆöÕ-X&»¿?¬#\‘¦5¡}Ëܢ𧦣 09ä‘Â7ßà‘IUÀC0NHäÄ$¢¼æ¯VÆ;çåñ‚œ‰Ò[£bQ°6A·fÊ]³î5E#Ɖ 'Í™vcW~Êv8DI1ˆo†¼zUL"¶÷‘ôokýÄ6iG{0Ïú#ýW®çîÀÄsgyæž‘~C¯Ÿê:‡/Ír `¢§DJ\ã×þ!ð¨÷´y6[½r½¢‹„C²ð?å~­Löȃ˨¯cý¥¯Û[0š%F œCpåÔ‘.e"D–.ìbêÊë'¨¬ÕÔÜ~?‹õ)²Ä }€KðâúÂpïDû• 5³üa:¬ØÓÈàî±Ý,ó×7ãœ{4¢Yʉhì7òÜ»O¾Â¤îæ{ +‘UÔ2ñÎê3kÒÙøÖ^88JåfäÅNÜK¤”^I¬Oaž`+‚¦s@?k¯ìsj1åÍ.¦sµ²|ÔFØ~Šö#å0®*Hõ«:y¸¦d’Ê™XÀq4c>}Úe5[ä®eÒ'fûÚ²å¾ÿ(ÿñž£ü4Þz[ +ƒû~s¹¡<ý^Õ]J™\Ü,5˦iBCw¸Öu;)_pÝ`ÄÀBu‹oÔñ¹ Õî­ +QÍÞpid#[^³ÿÖ€³ÑJ%é_ áa)I@-9´HÞ7){§ê½(N‘Ô†Q¯F±;ûižÕ¥ò4%ÔˆÏæY!Kx »¦'§é¬ ÿK?äÙj\]¨\æ(>½2óS“Ç.ï´ÙBú6§y¦AÖ˜+ƒÄ Ÿ%KSchæùÓBž´Àptë£í*Ò|ؘ·E£ù„äÑñ&çfê¶>§Bn—Bù௴î¯ü—äèpü("…þmúHgú8;Nã]ÚVO‚¡x|Ï‹´=ç;a5h¿>l•÷Ç֮ׄŸw=áè—æQ›‹¾›×¾ÉÌâ-N¤ë ¸Ê̈´ëÛÂi½ÖeÎÈŒ¹f¾nØD«œûxªc,ì*¤‡dT<̵ê@-éäm<‘Våzàr‡ÈîEgå~óÍsÐ]âà;ùÛÉ‹k½=ïp弄•ã Û­Œnø‹Yù0/ºýE§„H‰¾Y»c³¨‚Ȧ +º'ßE +ý§­œ6òݵ6fðOËrm?z]¹ü°šl¹Ç-Láf¨Â¤u38N÷J&ÞôżÆìN³Û©UV³_ê1«å„ Þß4žC´®èïhª1™ÅœÇlÜ›éí·² …Åèy½]œ¤a.ŽpGC`Å"¨`š… lÞyþ¸XŠ˜ ž)NíÈ0 öx¢«‚yF¼Óƒ}³ŽüÁ[ð«o:35˜Ýƒ»šQ™1wæ¦8\œò°í‡5P;õFó©y†Ãz´¤Ö¦eNÐ*t×>=îxïÑ!ën}}{BäÝÖ¢É,Ê‹C¹ºNË5‡ÝYG³ÂdÝÚ;ˆ‚™€¶®cÇòý6‹º®ÒKÿgÇ ¾”îåÞ'­ô8ÎjÖz*»‹þ¶‘D£M‚Ä·¥Ï¡ñå +Ñaë©dË{ÏÎÂ!^íÙe›É|¿ZõŒ>¥³®ãÑ4¹›œ)ñÏëd¬Öyáàçm'Y`-Ó÷ÜCÈ0Þˆ­­–çV5ö<öÚ}³ ºÑÑkÝ’n¸ö“°ù@h4æa€öÖ +?XG-¸“¶ðÇÇöè”m[³N{ìöž½“½Ú·™mŒdÙ=x„çI’pÓIÛzñ²‰H/E²lÄú4£[˜Lé8¦ç†'L·Q߆ȮnÈüÏ%ÇÁWÆ6¸ß…½.A¶pªÿ¾z¸eàK;ZáŒ`Å»?ËúSt`Ä¥¿×› +4{8Mƒ‹äÕ-¹\˜,÷P*‡nu|Oó—Ùoª‚®¦hD˜þ,òt¡tdaÌ臆û~ª I#›™B/>ÂýÑ»X´ÑïQ $Jï°ö¡ÆኌNX_.éò(uüEËMõÆ7aQ”¤,‡®@K>®$ø¡jŽ Ï^¦ãë,-ñmã¢yyDÒðƸýÞ…»å‘²»wBCYuéPDNWqhÿ Tóè7åÑ‘kWõ›hõ5ˆ¿"+ò*ONjcúH ï»KvȇOa’ïOÕF”-·«w ›kß(ö•T$û³‡ç«X1W™h+™¦‚M—FÛÇGÞäœòáušÔP+Þ¿ÃU#–ùéÀ&8¦%ô³ª/ƒÅ¥;ø}‚Ë8\#}[ ʱFMÌWýw%XSmãî •EÅ«ÀnlNœJ=Vñ,G?i1JõLý<î‘üœw³¤†[+ÍõH ¯Zé'đˬÖü3 òCó©§&c¥ŠpbÚ(ÊÒ0r¸`97EÖƒžgJÝaôÎfþø!·nª½×zW½—¢]Œp}á)nBõ'"¨…1ˆ¨^eØ:¹iÎsý¶¸/ØrÞäTW]s±ŸpZE[šºÅ Ê{‰ƒ—,(ø!‹ã«­6¢÷Î[G¨hÇ(`À4ˆŒ›²ﺻC…^¢Ð!LºÌT+ÃTí]UK”>"mÕèd™,îšÁ$ª\ríõNÿ¼§‚ý$o¸Ï“ð…&lÑpf¶É_m–;ØÆ=UMã…>bƒ8xƒØ¢ö9V™Í›Š´áUãÈ=+"Ð;ry±z䦺^±NR¦­Èˆ(‡¬ˆ3×0¸î§½ŸØPpd+;­)e÷˜Ðc„/—r çêξ›kªÆÀ@>ùà“ñ$ùœ4d6~oT]নO‡$Éc—@–ï'WþïWunã£ê —³žã6@ØvhÜL”ÌímÖ;h ±ú?ÚÝå¬N±CJW+ã²°]ÓAÙ8è Oê›ÕkQ´s-ÌÊNøò‡ÝÆÔwj½hLÙÈ¢WXAß‚ +Ä?®×l×u†þñ›<=Ä°ÿñ±ÊÁ$ÂÏ2y/ˆöÅÒúû‡Ûn»ÈrBäÁ’ùʸØÛ<¥§:dþZ\­’nd!Ýìa=`»Pqƒ>a¤‡^áçÛ¦3­¸ƒ-vXt~œåF4Cd³ F™/Fle‘[ú®§².¯Ú ©|µòO1ZùA´ß\ãGË{š Yò–Êpüì•Ùµ˜BtWçä)ò‰‚RN†´Íˆk‚$ŒúG«¾¿M±øŒ‹à éƘ—“‘ê'¾d×u@ë†/-u@RW,qò²°hßêuÝÕ;åþBŠ‹µB夅Ì&<ï¤3¾þ-TÜ\½^ËAÏ–Ú6Vªéƒ@Y¶B[Ò×^øåšç²H +T/7rŠ6$›K!uŸÌÂá'®Z|á ¶_šôá¨÷>KRçùºdØš‘~¼òË +gܸu|ýa7p§ìÜ]~áò1HŒŒ„8.«œP¥þwÒhËÏxp~ÔX÷mJöWNCžã˜My¿eÌ÷y»d,JÂIš,ø4½˜{L¦qxÖp½?vœxíxI–jΙdP«Ä†«F‹֘ Yíë!!aªá߬°Œ{;ÉÞ\ ž?"´2øÁ8 bí$h8œ8¼&ë!bálãïµ» ÂÛ„]í1 +æZæûÓn¡×t5¹D'>ç¾TeãniâÍÛö3Áp±Æ.ij“ä£R¼”ròiÚþ€Ñ*M™xsŒPùnž¦×â11VF-vÖ° —«EÏd×–üŽà&™nk¼ñïÇW†áŸ+F#YyU~Ïrï£6Â[ŽÈ5 sb{vË/å‘fü(úÉö½¡ÃÑêÀRI0Öù*wÈòKcÎÕnËÄøáïO$Qe”†tL®£-¢¿˜Ùîéð&jX“ÎÌæ‚n˜M æ}ÇÝ<Ç¿nc.)ÍŽ•‡!ïêG8űœlõ^‘Ën÷nõ;ízÊÉuŸ³g›¦méz³k`­ §0ä©ZÉ$ñeš"Ò®4jwÞvÓ)œ]çÔ8·FkÇzœ³wú6ùÚ©SµºŒ îÞÐl ~%“Úó‘`a—»9tž‡šµM[;zûYÜõQÀÍõFŽæäÕ¬+Ï·T;ŠˆÞŒénj°u91{3Ýù4UDö)» înc7„—žV×oܧ†šà’¼:H„‚6àZµ¸çÀ… 8㧗ܨÁ$jN¾¡¹‰‡ÂWÊ5h|MS‰9>òô‚ +ag»¬û•û-#ƒ+?SžEfg] ‡eð<^ê(™œS—5½´ $lÕ&ûó«DK>m¿Ûy«S]ŠÇmö¹,ôR×gý Æ ‡‰®òr]WÓèÌgc‚0Þ(u·rf<©$ùIRIôÙŽ¯œ —Ë7Dû}Gþ‘ ‡P¾„øãúŒ¥´ø¸ÇPïÌ>@‰kúg­9ªˆ€ó°(pP-òzýɇ'å¦õ|à$Úà`j •Ï¡Rïw¦èfÛ5 dì‰ÇíN.>$g¬ý—ú F~0é§0õ³c<{t¶ ÛóÏä^ûSvk Îæ>{æ:¨>îPS“±E!ÿœáÔ•µ¤YŠ0^¥òŽêˆfþ¯±¶Òn&,»Ènüx"ÐÞdJÛÚÈs47dä( +Íö¿ï^ÏÚ}ìµ¾BþèCæ¦Û@%eH£L¡¨ò^¸™ï$åqÕħ*ÈÞØL²Ë1ù0. ¶ +eüÈRs¦”ûØ9ì€Q¹µ^P%•›(y0pÙLºÌš8!v¡Öþò‹‹&LÙñ jÚ§$j¾¯áåekz¨´8,æá³@°þÜÇîØw¾¡œ1²R#ÕêîiC¥|äwFqvB¥6Ô5úóžÖÓ0[m÷D¬Œ7?É2߯"}ÝÎ £ŽueÊ'„b¢ã2ä_eš€ËÝ‘’Ѳ®'â•Ÿ=Ì® +]Ç·´VÄ çŸ.‘ž%ò0;_é6)Šw Ù4:zB!Ó‰/  }¯”ü·ì!GÌ,F8¬—L@ßV1öŸÕ¼uh,½EÉ” éx‚|6ob˜»œüQ—ÆÙ$…éâ÷»±z'ú暶é©d„êRºàÚTáè™´Ö–~ÙŒÑ(ýø¥/ùøV^`MS¸˜Õ ~çÁæF¢gÀ”à‰ »kô?¥šÇŸÒcø8ìüÖ7ÁÚß(yÿ]Ú£n%<{Iº÷œšÂ*Q¹*–¾E¦v–»P/Ï@ó±¼¾ÓŸerJ—ñ á¹}\à™ÈNÒu©öŸíD•‡kãs¤J>ØðÞf$z‚*éêeînÁ8ÊšæÕäôcÁiƒ/1ÂÐ6gÑõ];ŽöKSºù;>Ú±t}¥’eÈBÙ‚I­Ð²$pU^•fï„"°x ܸâmˆGU75ºÿAcõüü­‘ {ÉÐtë÷yh)5*kpútR{Æ»ÖO„z7T£ÍùÅ"ž"|Z E¡Aa‡'vÖþÐ>1Ž}1ÂC_÷HÁ;ÓÏ(xls ¸¦ò{;ò—Ì~4heC®ûÅa 7ð,4  ¡I«ÓZ~žá§ÉÒ #½*׉åÎùÅEO Ñ…r˜hC^×ä8 ¬lüEåÀg6!¼„?“ò÷-†(Ä‘\q›@ Â3À!ÏF«Ç,@äT´ºB¥lSvM™x5jOJvº€Õ°kÍØÒ8ü銆̓7…ª*”ª…á!èœ?¸OLH(S†ƒÁجiÞ¶­ÃG‘…¿ã#0Š#ëXôô‘î;Ouè„D á¯q5¼/!‹´ò˜ß3èÝ +ÂþSHªc²Ü.|Â#9…a¡0Üp=œJ‡˜ž½‡ÍH¸ JÂ}I‚õˆÚW°"ª”u\§þÈêû‘5»{°Ày¡d õ,£oÿ˜O(ò;ÁHî“ýb^OClá* +yÔ­¤ƒÕñº*£À*õ€zX!”ùƒœÕ &ö«ÇIXcîžüŸ2¼ÇLS ~ë_û¤Â\yÀj²›ïÖÜt¡Îô7K›–Á\&Áèä®fìJ¸–íÚd³ÖË[>ÂƘ‹oСâšQLüÚ3ÆqK“IŒÍžŒ•|bmýe½]B¸/æÁv͜蒂ÿ±ª¦Uàk3Pk CJÇå¤nÁESå®dWËô¢óOòÂf­²–C{9‰0&+‡·ŽüØ”©°³?¹Ó¥Ê`OƒàÛ’6lê3jÄ„m¨œ¼uN^ÿb±B–µ"¦ÇÚ„Ñ‚ +ºÙìâyÊþËAÓ V×ð—J¦ÆÚs«\ywÐÔ¬‰Z8Õ÷À<%løÏù¢V×™„HL¡ÄoƘò&Ë<»8ÃÝÀàÉfiˆ‘Õ§\m, ±¶#†÷~¢8¾½ø¬¹£¦¤6‹zÔØÏ_ìqõV™Ȭ)$‚}Ë nXâhâ“ê´®Þà„NûcŒŸL0i¬ÙÍVGŸ Qµ`ûÇŽô†¦†X¶2m¯÷f”7÷?ƪC5p}çI¤ +&ßÌ\ŽSî(…rc•IN4"’lö¼=ì©ùñõÎt¤? ZS¼p¡/™þ±]ÝüáäÞ%mïKw>â›…YhÀ¯1¶•³€Ålè·g•uYk9__‰Eëù65Ol=›.|ßžo!zhÁàpEv§NK÷oßâöÍ–e,òx­ËŒ“¾üPV/£:Êãr—ʉO‹Gõwc hŽÄ•/,Ö?3‰Ÿ´öNûyÜ£óëXšFæé[‚| ïM€KùŽµvdˆbµÿ·óH79|äWLa â‰ØMúË=C²­D…š=öZ˜<8 §r¦×´¬F7 3âò(“Sa´½’\°ÝÖ'ÙÑ_vÚm˜( +6šLKˆ¤7¿œsªfaHÖìüÖµ ¸ÏßÛY˲TJ59a¿CA¬§7,°£œ®PàÓ‘X0&M0?ØÓßoH! Þ]Ó<™^ò'žy`«ÑU·•”rŠö£ ˆþRxEIS³7a^$ÜP(ÎmÛY÷Ki¿0O ¸}¤´€S#ü„Tuçp•nš¬ä@TK8ðånÊ P—Õ“q;9%õ(¼½Š ˜Ï©Iü4ƒ«EieÓ9ÒÃ* b ­âR4õ&A_{÷~çƒu|{ëø0Þäñ‰‘¤¨‚w+*¾vnû“]òíÏã ˜H܉’ À0GÊþ`p w>â)‹!äsYxãÈ÷½pÜ ¯o#zqøøƒø™ãÏ©pÿÀM3f—®¢tiM ÃœÒÚ)O³ëlý`fßñ0˜$6§d *Ã`ŒåL‚ ÔbX¼•yuhÙZTl´jö[ êöf)ö1Ž®“tWîꇚ¨è“R‡ƒÕ–›Ê4ws-øÆ8£nê(„GO>0¶$Z+B7yÎ춗C•a^vÑÔ±V™ÔR:­†¬|áÒdH{<_I~EÍØݳ¦mše+¡Š,OƒJÖÙ–Ž6ÂóqU@¹rèP¸“Ûh°áéɹØ ¯ªJ-S¨ÿeÀ$ÿ¬Íó^öN9>.üY“â®»Šç)éæË]eA˜ÝdÀú&sC@GxÐW‡0†;ØÈþž‚iu]IÏCÆØÁZn£¹ÍŠ|xúÓš—¿_Wí‹—SÒ°c+ëZ®Ffíª¥ÉÀ´3 î$?ª,oÉM’E õ¡.Ó$Äúgû(ÎÌU_\í—YŸ&ÜÐ!ìéRT +Å n ólŸVðqMK=nDÝÄÇ ^£¤öc¨Öþ‚ß¹ï¾ÇÆÈv–¯Ê/¤~›Þ`òÓw'cJèœk! dfh=ÑúNà{ä° ÷Ó\1¬³á’ØhŽÍ2Sª«2¾½.¤— ú˜þÇɾ&:ý§È3Ûûš…D Ú˜3ùF!QÇÔ¤yGé)$è¯Ãyæ—wà+KDƒWèE˜ +Ù]¤WH +pG ¢ÞºB +S9ÀLÏLµ…ý-8ÈÊ æd`YÛOŠZa³µ‡šR–ô#„ñÛZVoʔ˙SØ×ùˆLW3yϵ"Mk£‡•ö3‘²çÝ?„ö¸Ä¹ÆÓÝ%AδÝ0tXÛßS²m ¦Ó¨´ý,î[ù»n¾ÍU»5ˆ8\Îá¼úo-j2j ZëhŸB9n&Éø{‚IˆƒW…SÊO\[‘^>éy)“ùöÌ*ÜyqËåÅŽÇÁx¨6RHÒmµžw¢µbBð€[S׫H÷¸jìfQÄÛ÷’täõ‹G„‡ýü*ébxÛIJݘBWçý™›?¾hã.To7Œxm­D`öæ,Ë6!Ίô”^yŒ‡“FlÑÂ(ø²®LÄW0å ¼YÚ5;JÄÎü\›Ãªoóž¥3âs- ›ÑWé‚LKs´ñ +÷„žL$©¼ Ì#'Òí]98f4d#:.uX¾óß ÿiùCöéÌdÞÔ®»Ò-ø¥DÊC-–\c/ã®_¸t°Ò½ÅxZðÀe& dE¼;vµYÏL»U|ó®PüÁÒtÌr‰ë¢Ô8à³kUÒ’ð‚ðÝ*»~£aû®üyÝu5 ù@ÃX3¹¨:9ˆìׯùÛÿ¢-_\`¬ *Ô‡GûexÃ7:£±žµËh~{´ï­,ÈJÖVKZ‰˜ý'0— Æ]•–•FŠ‹ž@þ‘Š32 ÃíÚ†x¯Á MÙÙq­sñQ|ÒŠ¾s:‘é¸íÛ!O¤1Ñ5:¥@è—µi?Q2¶L‡œ%{2ÇþøåÓÏ9‹xf÷P]óÍCÒ»6u]ßËðU£Û0vð÷ñ|Ý5ÉsWë¿Ÿî ú,Ød8R?{—ÚÂiA»žà#t#ÈygÐ|’uw"¸¦´<+p€ÿ´ÉŠS :"í.|‚ÿ‚íõx=P¡c|7~©¼‡»’€6­¡G­q¨[IM.ŸhäÂÀI‚ß +ñcБiJÚyÒÄÉÞÏ‹ng®³¯LëX¶öÁ­Ô%®ÔÑkÆRìC$1A³É!y21b@ÅùXëàþËñé¼ÿs÷ Älv°(´Q·KéÅgútK¼¶ ¦x«"#Òü™›t‹DQwamö?0<—b¯BanÖ1oIñW¤0¾~0'…)Ñ…æN\’ ”‹µõÿÀ«Â¡8¨üÀž!CÔ)e>Õ“›€vÑõrö¨Á˜ è‡`%Gfmû[Ƭ¬N?MѺ,ƒ‰=Ž8½òB¶v9 #Þ±‡œ8iAUjžéÿáþÿàÿ[›::ÛÙ:ZÁÿÊ‚&Eendstream endobj -3481 0 obj << -/Type /Page -/Contents 3482 0 R -/Resources 3480 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3439 0 R +2865 0 obj << +/Type /Font +/Subtype /Type1 +/Encoding 6699 0 R +/FirstChar 11 +/LastChar 123 +/Widths 6720 0 R +/BaseFont /TPEVBU+CMSSBX10 +/FontDescriptor 2863 0 R +>> endobj +2863 0 obj << +/Ascent 694 +/CapHeight 694 +/Descent -194 +/FontName /TPEVBU+CMSSBX10 +/ItalicAngle 0 +/StemV 136 +/XHeight 458 +/FontBBox [-71 -250 1099 780] +/Flags 4 +/CharSet (/ff/fi/fl/exclam/quotedblright/dollar/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash) +/FontFile 2864 0 R >> endobj -3483 0 obj << -/D [3481 0 R /XYZ 85.039 781.388 null] +6720 0 obj +[642 586 586 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 367 558 0 550 0 0 306 428 428 550 856 306 367 306 550 550 550 550 550 550 550 550 550 550 550 306 306 0 856 0 519 733 733 733 703 794 642 611 733 794 331 519 764 581 978 794 794 703 794 703 611 733 764 733 1039 733 733 672 343 0 343 0 0 0 525 561 489 561 511 336 550 561 256 286 531 256 867 561 550 561 561 372 422 404 561 500 744 500 500 476 550 ] +endobj +2869 0 obj << +/Type /Pages +/Count 6 +/Parent 6721 0 R +/Kids [2858 0 R 2871 0 R 2885 0 R 2963 0 R 3038 0 R 3068 0 R] >> endobj -1298 0 obj << -/D [3481 0 R /XYZ 85.039 542.44 null] +3158 0 obj << +/Type /Pages +/Count 6 +/Parent 6721 0 R +/Kids [3107 0 R 3160 0 R 3210 0 R 3265 0 R 3318 0 R 3368 0 R] >> endobj -3480 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R >> -/ProcSet [ /PDF /Text ] +3471 0 obj << +/Type /Pages +/Count 6 +/Parent 6721 0 R +/Kids [3421 0 R 3473 0 R 3525 0 R 3571 0 R 3624 0 R 3676 0 R] >> endobj -3486 0 obj << -/Length 2668 -/Filter /FlateDecode ->> -stream -xÚµYKsÛȾûW°|1XB˜^{Ó:±wSÎVÊ’íÚÊæ‚…¨Œþ}ú5HB’7[)0èÌôôtýõP-ø©EúIq¢|“$‹|÷&Xl¡çã%#lhüÐZhÏt®\ï*Ò~`ã¹1:öul+mý4 ?Þ¾¹ú ƒ…ü(2‹Û;y»ù—g¹ -ÃÀû©Yå—+Å^¿\)¯ÁväåÍî±\*¯*¸ïæú?^/ÿ}û÷7»ÕrkZ?P/*e4(e¥T¸PHÒ©R¿.ã5{X/H½uÉj~iÖ}VJ»¿GTàu4b·Ô‰·Î&"˜AymN£”w‡/ÍŽ_zxÏÏv¡ë'Ú8Ë£¨ÝJßç/(Üáêñ°úU)P…5¬Cº û‹£Ä7¡>=éçW“²&ön—‰¥Ã}4¸Àh’Œ¥ÒòR¤jA°CAQ£¤G=ðÌŒ¯âp±RàR!-Á´ƒÊMý˜Òï ;èHà%§ã€Æ¦Añ±®šlÃg ø6cÉZïqÖ¯7üÒ´üÜO-ToYØvOuî_8™ ßÚ„œH©—¼L…~¢ôÔõ•õÎ\_¡óÛÔ»FrP /ºŽÝþFœJñ©‚ãwÍž Ú9Ú?ð6òz(3þêýWüìæ¹ð˜ éÔ ü$0/nÈø©=‰e¥üOí|CÊSÒ?£E)”[QÛû¼ç“ýCJ˜øa¾¾7“XÔ¡W¢EuÆÝq…ô×üÌäIÝ1;°ˆØmeKŠï¤K`LXíýUæÆŽÊMÐÊÂû®àÆ{r>˜ï· Þ7u¾o[*Ôýñ§hW&LJM9Ò˦…•‡žiïæÉùo_P„ÁÔ -»@Ðð·9FĽ[ˆÞà­¬ßòÔ&«Ü<òÕ.Âáå sfÝ0'ÝílyëÖ^]¹qŽ‚‘!Ç…97ú¸ÄpVﺙÝ–aäemÙH”Ú f#Ú ¢o3T“7XÈB çˆ/iœ“ :R Ï{%ƒª:ˆ'X³+_` -)`ƒŽ‡Oý½©OvÇX·)8+w,‚_äŒFÃlä¶Æâæï>{dÇ`‚a“sý©Åné;kÇïz·B‹rã¹þŒ;9tˆßeÉ*0lôç}Ž…Í?y¯ðõì^Åb6¤œ×ìQ°‘Eûó¨7ÀˆO„ÖWiüBæ3s±~ß÷?\]ì¯36Êj˜qb–¦Ýò˜«üÐù÷ý®ºD­|ŽŸÍ‘^ Ø’ôEÀT~¨í÷¦Àd|<¿ÎÇDÀaSfÃdàQjÑæÛgiö /þ¬z <_†Ñ[â7€û8Éã“\냅y4ùøŽÊXŒþ»_£»—‰Øzâ®ÓÐ,ו¬Ëæ)©—µMÓÊäi­›&,hXÇ2²bÈQz‰.³j€Ý\0PbB¤èøøì&´¦Ì¡öÙ6Ë’È–—Ú¢S ñ‘Wˆ‡Ù4‰ck2ˆØwe+ØþmÕ÷E»Æ¶˜i`•Ûû1žE=«I»gÌFº4ƒ¨;æj€44$CE$… Øà>±óìH/bÊ{J¥æ‹V¬"ôªv_0Žï¾ézÿyÞn}›„¯ìÿ$ .\v ¨Sf•;›u²UâLÂ#Böã²Q±þ¿‘’±¦°ñ¤¦° ºë•ŒÅºBB Úçƒv~â•(aÚg“. à.#Â2ŠË¾àžoß¾qƒÒç˜à»¢EKRL!b%X"«*æ±w‘[ìÒ¹0ȬVˆ2·+«5ì„ÙŽT2‚’‹VœS6å݃Êcœa¦§jÆé;B<'ª)ZŽ¢UK±<@$_ kË ÚûÒ_¾Œí~ât1Õ±¼”çÍ’ïÚ±~¢+'ie½_š^æë¨/')Ú°qYÐÁºÛ–®[îËÜI†zGÛ`>¥t³¨XrÕ -¦ŠJ`f܇RX¼M‰¨aïé¢(‘è(Z´/IÁ=Ä\S± 6øvE_îvœ"2‚ØèY=®ÈYÐïˆ*ûYçÏìá1Å®¾ -ÁnH“4U9’yB116µ9ç¶QU‚5zYek÷¯ôŒÿŽÀË=£ì™®õDW}ÎöÔÂ{Ã"Èî\÷F3¼#Š&¼(¯wîîþ…:Hc¸û+x¸$áˆ÷¤T¯hCw;ûØ= ¼Då[÷¹£ 0wñŸl÷XÉ|e/Oö¬ÕÌ3¾ÈÜÿ®l'&ˆ4SúbB‰Îr]®Ajõ8PúPR—!Å„q¡àÝCáæ/w-”˜èÚËé°Zûú4—‹«»âp…Wç%ÆÜPÉÓ[rã튤K³_•úݾwåŤZÉ›¶-rùä‘c’ýy+ƒjÆ'ÚÍy*1ˆüÙ¿^a£ ?óï瓃º¸FIèòd–¶‡¾ Ã×fü¹îz¬ôWÖПxø€­Nÿ±#ó)ç,(¡¢{èÞ1pÇk7Ïà{<Ì/ßÔ…»ñ¶&‘ûèÀ-ûüà BðA¾g®–¥„–MJÉ“ãñž8Z¬"åÇöä¶ô¢öQ =¯YQáÅ?ºÆúixö_º{þuˆendstream -endobj -3485 0 obj << -/Type /Page -/Contents 3486 0 R -/Resources 3484 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3501 0 R -/Annots [ 3489 0 R 3492 0 R 3493 0 R 3496 0 R 3498 0 R 3499 0 R ] +3770 0 obj << +/Type /Pages +/Count 6 +/Parent 6721 0 R +/Kids [3727 0 R 3772 0 R 3820 0 R 3855 0 R 3859 0 R 3866 0 R] >> endobj -3489 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [316.138 654.395 386.484 666.085] -/Subtype/Link/A<> +3881 0 obj << +/Type /Pages +/Count 6 +/Parent 6721 0 R +/Kids [3872 0 R 3883 0 R 3889 0 R 3900 0 R 3913 0 R 3919 0 R] >> endobj -3492 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [435.86 506.629 512.306 518.621] -/Subtype/Link/A<> +3928 0 obj << +/Type /Pages +/Count 6 +/Parent 6721 0 R +/Kids [3924 0 R 3930 0 R 3934 0 R 3941 0 R 3949 0 R 3959 0 R] >> endobj -3493 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 493.079 216.398 505.072] -/Subtype/Link/A<> +3984 0 obj << +/Type /Pages +/Count 6 +/Parent 6722 0 R +/Kids [3977 0 R 3987 0 R 3996 0 R 4002 0 R 4010 0 R 4015 0 R] >> endobj -3496 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [195.316 312.568 375.35 324.56] -/Subtype/Link/A<> +4028 0 obj << +/Type /Pages +/Count 6 +/Parent 6722 0 R +/Kids [4022 0 R 4030 0 R 4035 0 R 4043 0 R 4051 0 R 4055 0 R] >> endobj -3498 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [481.678 208.962 512.306 220.955] -/Subtype/Link/A<> +4069 0 obj << +/Type /Pages +/Count 6 +/Parent 6722 0 R +/Kids [4064 0 R 4071 0 R 4083 0 R 4091 0 R 4098 0 R 4105 0 R] >> endobj -3499 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 195.413 210.671 207.406] -/Subtype/Link/A<> +4118 0 obj << +/Type /Pages +/Count 6 +/Parent 6722 0 R +/Kids [4111 0 R 4120 0 R 4127 0 R 4135 0 R 4140 0 R 4146 0 R] >> endobj -3487 0 obj << -/D [3485 0 R /XYZ 85.039 781.388 null] +4163 0 obj << +/Type /Pages +/Count 6 +/Parent 6722 0 R +/Kids [4152 0 R 4165 0 R 4177 0 R 4189 0 R 4197 0 R 4205 0 R] >> endobj -3488 0 obj << -/D [3485 0 R /XYZ 85.039 761.463 null] +4224 0 obj << +/Type /Pages +/Count 6 +/Parent 6722 0 R +/Kids [4217 0 R 4226 0 R 4230 0 R 4236 0 R 4248 0 R 4253 0 R] >> endobj -1302 0 obj << -/D [3485 0 R /XYZ 85.039 761.463 null] +4261 0 obj << +/Type /Pages +/Count 6 +/Parent 6723 0 R +/Kids [4258 0 R 4263 0 R 4269 0 R 4274 0 R 4281 0 R 4293 0 R] >> endobj -2146 0 obj << -/D [3485 0 R /XYZ 85.039 667.044 null] +4302 0 obj << +/Type /Pages +/Count 6 +/Parent 6723 0 R +/Kids [4298 0 R 4304 0 R 4310 0 R 4322 0 R 4329 0 R 4334 0 R] >> endobj -1306 0 obj << -/D [3485 0 R /XYZ 85.039 625.403 null] +4346 0 obj << +/Type /Pages +/Count 6 +/Parent 6723 0 R +/Kids [4341 0 R 4348 0 R 4354 0 R 4360 0 R 4365 0 R 4373 0 R] >> endobj -3490 0 obj << -/D [3485 0 R /XYZ 85.039 598.788 null] +4390 0 obj << +/Type /Pages +/Count 6 +/Parent 6723 0 R +/Kids [4384 0 R 4392 0 R 4397 0 R 4402 0 R 4407 0 R 4414 0 R] >> endobj -1310 0 obj << -/D [3485 0 R /XYZ 85.039 598.788 null] +4426 0 obj << +/Type /Pages +/Count 6 +/Parent 6723 0 R +/Kids [4421 0 R 4429 0 R 4438 0 R 4453 0 R 4458 0 R 4463 0 R] >> endobj -3491 0 obj << -/D [3485 0 R /XYZ 85.039 577.795 null] +4482 0 obj << +/Type /Pages +/Count 6 +/Parent 6723 0 R +/Kids [4478 0 R 4484 0 R 4492 0 R 4498 0 R 4506 0 R 4515 0 R] >> endobj -1314 0 obj << -/D [3485 0 R /XYZ 85.039 478.811 null] +4525 0 obj << +/Type /Pages +/Count 6 +/Parent 6724 0 R +/Kids [4520 0 R 4527 0 R 4533 0 R 4539 0 R 4545 0 R 4553 0 R] >> endobj -3494 0 obj << -/D [3485 0 R /XYZ 85.039 457.917 null] +4568 0 obj << +/Type /Pages +/Count 6 +/Parent 6724 0 R +/Kids [4562 0 R 4570 0 R 4575 0 R 4581 0 R 4592 0 R 4596 0 R] >> endobj -1318 0 obj << -/D [3485 0 R /XYZ 85.039 402.208 null] +4612 0 obj << +/Type /Pages +/Count 6 +/Parent 6724 0 R +/Kids [4605 0 R 4614 0 R 4621 0 R 4631 0 R 4640 0 R 4647 0 R] >> endobj -3495 0 obj << -/D [3485 0 R /XYZ 85.039 383.734 null] +4662 0 obj << +/Type /Pages +/Count 6 +/Parent 6724 0 R +/Kids [4654 0 R 4664 0 R 4673 0 R 4681 0 R 4686 0 R 4692 0 R] >> endobj -1322 0 obj << -/D [3485 0 R /XYZ 85.039 298.299 null] +4700 0 obj << +/Type /Pages +/Count 6 +/Parent 6724 0 R +/Kids [4697 0 R 4702 0 R 4711 0 R 4719 0 R 4724 0 R 4731 0 R] >> endobj -3497 0 obj << -/D [3485 0 R /XYZ 85.039 280.129 null] +4739 0 obj << +/Type /Pages +/Count 6 +/Parent 6724 0 R +/Kids [4736 0 R 4741 0 R 4747 0 R 4753 0 R 4766 0 R 4774 0 R] >> endobj -3500 0 obj << -/D [3485 0 R /XYZ 85.039 107.945 null] +4786 0 obj << +/Type /Pages +/Count 6 +/Parent 6725 0 R +/Kids [4781 0 R 4788 0 R 4797 0 R 4803 0 R 4812 0 R 4817 0 R] >> endobj -3484 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +4830 0 obj << +/Type /Pages +/Count 6 +/Parent 6725 0 R +/Kids [4823 0 R 4832 0 R 4837 0 R 4843 0 R 4857 0 R 4863 0 R] >> endobj -3504 0 obj << -/Length 2531 -/Filter /FlateDecode ->> -stream -xÚÅkoÛFò»…PÜ!­I.Ÿ¾/ç¦>'ÁñÅBó¡íZ¤(©òWÿþæµ$%Ñ6ö® wgggç=cgfÃ?gùÊÖñ,Œ¥£h¶Ú]سvn/Á°gž²·¾_^\þ+pgŽ­b;ž-ׄ²L¶Þ½¿¾[Þ|ž/´Ö–¶Õ|†‘õþÓܬ/¼ºüÄ¿ï>ýx7w¬ÿ¾áïûë¿¿žÿºüxq³]ºð”h¼õ·‹Ÿµg)0öñÂV:ŽfOÛʉãÙîÂóµò=-ßÛ‹û‹ÿôTxÏ›ñ©‰·-<7PnðEÞŽ£•Ö@£€ãOÀU§Oˆ”ɱS’¾ò|ÿ5ŠŸ»’Ô‚´6žµªvó…cí’2ÅûPNNtéÈêkÃh‹”^훬þŠJÈðX ”®ɱþÙ$»¹Z°–¨ªÎ¯¸\áÖצ®æ Ø«Z&·…­*/Ê£+5]ùe{D\¸-à[Ž%Í£ðs@ªŽ1ÖH­f8áý=2Al5O„Z§æíðuØ7FÌÿ™¼T©g ?R~ôíšÔ­&õÿT“«ŠÉÑÁѱ cZn -ÀòìÐzBdÔëvË +Ãñ’´/'øY)luFHm…h‡Ñ±d»5S^³?B¬J|m›àÅ%ØžcåL¿“Cx›´†ZÓòÒ99z,XðL”³þµb8Ê xGíıõ‹íÛ…Ê Žž3ºÑ¶Þß|ý£µIžg)ì2ê¹]!xh9BˆeJØ]]žƒEùd³ªëŒ¸f˯^*'ÛJ~7SïÐÊf §Ù`-ä¿û¹,6Úö,djÂßýt×Érü(ä ×+à¡f°Ç7AN($„Xí²ü@bÎä< —(C¾˜;0Œú"Ýó5rt!÷Wr:5,üb;ÞØjqBX >”¯k• Ôä¹ÚºÆUMb+ˆ…–Ѫ5ÿžÊƒW¨5Lbx;“0†;;Ã=,#IDú+ “526™ïøÄ>ɧL¹ÕqÐÔq8ø=È:áí'|BöÀMђуq\óŠ‰SÈ~×ÙoÝØåjÁªB­3Õ¢^…ö`63Ç g:–Ëpo‰ÛŒÁ‹NŠzòŒ‘!V×e.Á™#3h¦¢U¡\žŒ áÁÞ"³š–÷¸Ðª¿ |/˜×O&J(×Tù«( ^/¥4åÏ©BJv^)N9”öÿáâãœF¶}VÄ - N\¸®òÿÛëïO¯Æ5”l* a/ÖCõäÅ.»kb¢8n£Ëáï®7­<ãt@Â0ù `r@‰iøm|Ê`xÓ"kCá-g7gÌ®É 9ÀS0kUx /ÀŸFžë‹ãÅN_Ö¸ˆ|”¢Da*%³Àèºqç“ -ãê¥r¸ã4ŠÇ¨X{&¹ÒÝ™¹øD~Á*==¥ZSn:¾Š§×° {žÒpv\SÚ -‚1¬bÚ€ÿYÓˆ¼2#ÇŸ€ê!ŠÍ„㪫W¨.\ÿZˆ®›C¹be -ÀºÝ?[»*Œ_z„ë(»Íô<„)£šDQMùϳ¡Ä3mKÇ|àw©eê–w³+©ò§,úH¤S>Á nÆŸ0lï*Ì!¸BçëödŸËÞáa*cpu(w„ÑöT`: ”ÅÆ™q©Îeïó- GO „Ï&¸0$FæyI²ËjEºÅ ¹ï.áùÉê1KÏÔæÄ.UdhL)Nyî«¡ŠLÃu±èîÕẽ!¹Pê›s©}ØU]Ãb^&-#ÖF§´ÙÕ½ÉÂÈ,”Á3‘X‘ƒæ—hžØ¨äÙ©ü’S(¸®¯‚Ø?JùÐKcKœ½ÚIùCÎ é;&–© [hÐl iÍ_’’?0þ´{,#—2hÖ×Çæ ´ãô =o“âïƒ2$ wo*ŽÔdºùÙ±¯ì šN'Z…¶óšÖ×Ü\G\*VõÀU-ëŠÙ¨J±Wðý0<–ú Li´Í5c¤%¥ís8f§d ~@ -»·\pÐ3=l9L*‚µ S¤:ëàIy‰`»A{dBÙ¡´âß²’-bk³ýrh#éÚj—´ÅJìíüM£J–关ʄ’¥4²¸¬¥8I—ˆ^<ŠWàõR¤•)L 0 -‘o‰Ô½Ð‡¨ÈÍjÓðw!tY«Ôí†X’ ,)fJKI(d$åDMM6Q´>‡æ7¥a¦¥8¾=´h/V¶Ñ)´U ƒ“c¨b­_MŽZ’ãOsmcu½>°_C -¼Çˆù¦á»Û;É‘Èt^&mWO:î8ñE¯g>ý²G} : -;©Lzø”zµ#6@ÄÈ‘‹¦³æ‘g½…kèœÚ7 kÚº*ó­LK°#ÊLÕÔë5%!FÈ Õ†¡©‹õ@e(ýB’Þ¹4,GäF±Œ‰d®2š¢ ¢c›>{+çË柬eÓò؇} -ˆ-v™¡m]“tVUšZO´ìj~ì=²F(§'¸ÒšøŽË$y;zf.r?4½G–óHËôj÷³€ÃC–-Å_ü–ªkßuÿÎÇ|cpB8Ša¢WQHløð&û*¯¤B¿qòÓw×{ -6<ü‘>ôüaw·s¬_Áw—ä%Õ¹ ü`fÂUIì*¸GÉûÀ+}Eg÷ƒVk“²>º¿åTóD]¸™†/²•­Ü×Ï}$­¦H³:“Í„—’ô¼u »‘) -é†9ÆTFˆv³fPœáØ2.QR@ í[ú’y’ö­=ì®ñiÔ8\cÃÚ® ]P6…OàkÿØÏÆd8>ÕNjí`Âÿ@P[™¹…ªƒû”lÌX¼Mº|ÿþl¦þÂÍ•i­’vÜ0£üÒ·¼’Ë|!Ùd‰\Õ·l"ÀSã>kמŸhŠ[ T*ŸTÒ*B7„ìÉÅ÷ˆï¿At}ë)ÏZ†6-”Ù——]ãŒ*i‚°¼dB>ωj“Z%ÍjBâßF -öÇì`HždŠÅ÷z¨Ü GÖÔ³ ß[Ù.þí“!¹-Ñ6ºZ¶ÌŸOp·5W` kz19x®Í½Ûìh`þÑmýמdæþôS• öȆȤ­Ç>ÆÈà­hûü¸]Ë8ïÃN"^=ü ilYX0wÇW|ûÜOž²57¢ÂeÂÖò}ÎÀbQìöT9â×” L×A¤b'œþCêÐFü¿iBOb:C¦õÂ`ÌNu¥ƒ“aÕëü1endstream -endobj -3503 0 obj << -/Type /Page -/Contents 3504 0 R -/Resources 3502 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3501 0 R -/Annots [ 3510 0 R 3511 0 R 3512 0 R ] +4873 0 obj << +/Type /Pages +/Count 6 +/Parent 6725 0 R +/Kids [4869 0 R 4875 0 R 4880 0 R 4885 0 R 4893 0 R 4899 0 R] >> endobj -3510 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [487.405 435.806 512.306 447.799] -/Subtype/Link/A<> +4909 0 obj << +/Type /Pages +/Count 6 +/Parent 6725 0 R +/Kids [4904 0 R 4911 0 R 4917 0 R 4922 0 R 4930 0 R 4936 0 R] >> endobj -3511 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 421.954 296.579 434.856] -/Subtype/Link/A<> +4945 0 obj << +/Type /Pages +/Count 6 +/Parent 6725 0 R +/Kids [4941 0 R 4947 0 R 4953 0 R 4963 0 R 4967 0 R 4973 0 R] >> endobj -3512 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [334.322 409.011 431.382 420.7] -/Subtype/Link/A<> +4982 0 obj << +/Type /Pages +/Count 6 +/Parent 6725 0 R +/Kids [4978 0 R 4984 0 R 4989 0 R 4995 0 R 5000 0 R 5006 0 R] >> endobj -3505 0 obj << -/D [3503 0 R /XYZ 85.039 781.388 null] +5016 0 obj << +/Type /Pages +/Count 6 +/Parent 6726 0 R +/Kids [5011 0 R 5018 0 R 5039 0 R 5044 0 R 5048 0 R 5054 0 R] >> endobj -3506 0 obj << -/D [3503 0 R /XYZ 85.039 761.463 null] +5062 0 obj << +/Type /Pages +/Count 6 +/Parent 6726 0 R +/Kids [5059 0 R 5064 0 R 5068 0 R 5078 0 R 5088 0 R 5094 0 R] >> endobj -3507 0 obj << -/D [3503 0 R /XYZ 85.039 707.835 null] +5108 0 obj << +/Type /Pages +/Count 6 +/Parent 6726 0 R +/Kids [5100 0 R 5110 0 R 5120 0 R 5131 0 R 5136 0 R 5143 0 R] >> endobj -3508 0 obj << -/D [3503 0 R /XYZ 85.039 544.838 null] +5154 0 obj << +/Type /Pages +/Count 6 +/Parent 6726 0 R +/Kids [5149 0 R 5157 0 R 5164 0 R 5176 0 R 5186 0 R 5195 0 R] >> endobj -1326 0 obj << -/D [3503 0 R /XYZ 85.039 479.39 null] +5208 0 obj << +/Type /Pages +/Count 6 +/Parent 6726 0 R +/Kids [5200 0 R 5210 0 R 5218 0 R 5223 0 R 5231 0 R 5241 0 R] >> endobj -3509 0 obj << -/D [3503 0 R /XYZ 85.039 449.986 null] +5257 0 obj << +/Type /Pages +/Count 6 +/Parent 6726 0 R +/Kids [5251 0 R 5261 0 R 5272 0 R 5277 0 R 5282 0 R 5290 0 R] >> endobj -1330 0 obj << -/D [3503 0 R /XYZ 85.039 341.492 null] +5300 0 obj << +/Type /Pages +/Count 6 +/Parent 6727 0 R +/Kids [5295 0 R 5302 0 R 5309 0 R 5321 0 R 5333 0 R 5341 0 R] >> endobj -3513 0 obj << -/D [3503 0 R /XYZ 85.039 309.967 null] +5357 0 obj << +/Type /Pages +/Count 6 +/Parent 6727 0 R +/Kids [5349 0 R 5359 0 R 5366 0 R 5373 0 R 5378 0 R 5385 0 R] >> endobj -3502 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +5398 0 obj << +/Type /Pages +/Count 6 +/Parent 6727 0 R +/Kids [5390 0 R 5400 0 R 5405 0 R 5410 0 R 5420 0 R 5430 0 R] >> endobj -3516 0 obj << -/Length 2197 -/Filter /FlateDecode ->> -stream -xÚÍYëoÛÈÿî¿Bõ(”¾Iè9Î]|—4i"¤(®‡‚Wò©ò_îþùÎk)Ê¢Œ>€¸»œ™ùÍ íÏ<øógY¬¼p1K3_…Y6Û쯼ÙÞ|wå …7‹”—ÄøêfuõâÛ$˜ùžZx‹ÙjK$«âGçÕ›å‡Õës7 C'ôÔÜMÓÌyó~dΟyuõžŸ¯Þ¿û0÷»·¯yþiùîf9ÿiõýÕëÕèP7RQâ©¿úñ'oV€`ß_y*\d³G{Ê_,fû«(U…2/¯>]ýiàÂï¢ïšÐÍüX… ‘ 2gY4(éÇJ.«Eœ/¨–ž»¾ÓPeû•5é”ï‘bó´EʺÊfC‘³¡¥¹¤N!K¦š §#¶»ˆM‡L„÷#.ãaÝýK4Ö‹oñˆ~ªÒ 5EIûÛ¹±³ûÅxäülóý:w¨,W]Þ¨Ý/Èm'Û;Ùí~ÑAU'yäí†Å:±œ{"WHŒï¶ Q”‚b X…&¨/i¾¡_c-ŒïЊQæì5Ù±ÍwšJó@T¿‡iì;×ßÍÙ¤™ü¼½5» -Þä]ßÃmSïy4¾(˜Þš¶k̨ûm]W¼þyž…hÿWÏ`™./wÉh®(;6]ghcè;?诸UÁ&¥®Ùyº{««åeÉÓ2ÅãÜB—%DÍY!­l^çh±Ê f»–]$_“?‘£urVƒ²[Çg4ºÌI>YF¾æ oòŠÌIÎûÕÃý¨Ê„»,+Bÿœï¥¸t½罧 àÅã½[]Hâ²`Úªî¬Ç¿²ÒÕÌ¡%Iô@ö„à ¼ïL…J©$LNBœü%ûõÍòV´—Á)» Ž®?¡ëóXü¥ç Ç•Ï#f“WÀ®Ÿ¢›fÊÏ …Šãp -š‚TiH´ƒ˜x©0JÆÀà³À]87¨voÈø[œ€a’=Oì“ (U>=2¯§bZ•.ž“1ðUÌX}:z1kÀãŸùBvÆü ƒÉýÄÿ¼©ö9gЋvy4¥hµitÞ‰†:gM²ä„.æRã}e}^ÈL÷;±EÛoø§ò-Áv)n²á˜9`¬•º˜ðªÁz}«/à_q–Á¶³>€Iù’UÈ3R²j;NÞ©?ÄC˜§vÁ…œ*G ÚsBë­¿ÀÒ -k¾8Îœ¿Pöü’5NE*}È!à­ƒÝHŒ‘ÔhP>Ób% „6­¨f0´·½X¼ ¨¾óa‡YL.b¢™úÖT»ÿbÄ>{ >Yóì*âAØÿ½Àµ‚W=â5ÅF„9–FÔðpTêÆàBÚ£§Cþ*,‚㢅|çü8 yé Þ_Ý·¼>êB¬¸\xÂ!TyÁ“JJ÷ŸŸÉ’8{³»§®ƒ§¶¢Uê‹NòPQÎX|GVmIÄ •d°È¢6-È×Ê+0¶=,œ¸¨ ‰ƒ‚ ø¬syÒè*ßKQJ +åü¸V5Þ^qÍS†Ò!~ª–qzªœ=ávv’Öùz8¬mûgkôh|gÔHô:#CHnD™Ÿ¥øßuãFŸºHwÑÍvm%‡VÅH=sIiu ÓæR‚à‰¿¹\RF© -ýàÙÊ×WYœT¾¾Z 9žV¾¾ãxzÎ+È!©¦$o¢º7Åfa$ç™x Œ–›Î|Ñ<¾5†²J᯲ ûÀ§$Öùe÷L•ñ³ -eð|¾J¾ÃZÕ j¸ -Ýð = Ÿ§’×(îe#.†sª³p²¼ý„L<‡÷‰M‡U·¿8Þ:’UÚ†ÎìÉ÷TÏYw•3Œo«E ˽á<È Z¥ýzÿrâûôgöô& ­)#”à¾éS¶±ŠbÙø”)¾ŠG<'¯çâ¡óînŹfÔv6µ´äŹ‘¦¬6™èccî®›QÁ@±{U7Òƒ¥L¶4'Zllá%ll¾詆Å&ø úÃ<†Ì³Ó ?Q—bð%ªÙ¶ê-æÖÍ¿±ZÊÇÓ®¾nÔÅ0 -cå/âÿ×{‡òöp¼hŒ··¨ÒòƒÜøs§¯m…É®—cJR-kèÊÇÏeAô‘ópì’Éí‚,>¿Œ Kø‹‘f^b“ó”²yåJ4㬠êBØ Ö¸“íæRi ð?5Üyj©8ŽÑ „µœYÃ΋†´pCsL_“ÔþØŒó+¹ï¸xÆÒ­ã?Àãöî#[s‚ír;dÿ†Aþ˜ñþ -ÙW<>i"åö“lœaa6`j#i„ê ‰t¾U’fâM¦Ú”}¡±OÝšºŸÈê‹X%‘oé;f¾Ó6ü]pø¦fÄú-€`c†ž§‚ ;Q»4C3ßZ -’Ú_N×Ò£o·ßzk*ù&öfùùõß~øxóÔŸ€–sú··)ý ÄlÄÂjÏK¦ÿ!Üÿ³ÿ „©ò&z6ôï MÆ8dü‰õ°endstream -endobj -3515 0 obj << -/Type /Page -/Contents 3516 0 R -/Resources 3514 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3501 0 R +5448 0 obj << +/Type /Pages +/Count 6 +/Parent 6727 0 R +/Kids [5436 0 R 5450 0 R 5456 0 R 5461 0 R 5469 0 R 5475 0 R] >> endobj -3517 0 obj << -/D [3515 0 R /XYZ 85.039 781.388 null] +5487 0 obj << +/Type /Pages +/Count 6 +/Parent 6727 0 R +/Kids [5482 0 R 5489 0 R 5496 0 R 5503 0 R 5511 0 R 5518 0 R] >> endobj -1334 0 obj << -/D [3515 0 R /XYZ 85.039 570.951 null] +5548 0 obj << +/Type /Pages +/Count 6 +/Parent 6727 0 R +/Kids [5532 0 R 5550 0 R 5564 0 R 5578 0 R 5605 0 R 5615 0 R] >> endobj -3518 0 obj << -/D [3515 0 R /XYZ 85.039 539.426 null] +5629 0 obj << +/Type /Pages +/Count 6 +/Parent 6728 0 R +/Kids [5624 0 R 5631 0 R 5637 0 R 5644 0 R 5654 0 R 5660 0 R] >> endobj -1338 0 obj << -/D [3515 0 R /XYZ 85.039 281.354 null] +5668 0 obj << +/Type /Pages +/Count 6 +/Parent 6728 0 R +/Kids [5665 0 R 5670 0 R 5674 0 R 5678 0 R 5682 0 R 5686 0 R] >> endobj -3519 0 obj << -/D [3515 0 R /XYZ 85.039 260.158 null] +5694 0 obj << +/Type /Pages +/Count 6 +/Parent 6728 0 R +/Kids [5691 0 R 5696 0 R 5716 0 R 5721 0 R 5729 0 R 5737 0 R] >> endobj -3514 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F20 1617 0 R /F41 2104 0 R >> -/ProcSet [ /PDF /Text ] +5751 0 obj << +/Type /Pages +/Count 6 +/Parent 6728 0 R +/Kids [5745 0 R 5754 0 R 5762 0 R 5770 0 R 5777 0 R 5785 0 R] >> endobj -3522 0 obj << -/Length 2248 -/Filter /FlateDecode ->> -stream -xÚÕÙŽãÄö½¿"<áâx©òÂ}˜æΠaz˜Ž„—'v+^‚ít3ÏÙ\v§éJÔR»êÔvö-îÌ?wiÛñãY¹¶E³MyçÌv°òß;Wv83e;Æ¥oWwËïoæ:vìijՖ¶¬Ò_­ïÞ¼ú°ºÿ8_ø¾oùŽ=_„ad½y˜{‘õ3CWüýîáÇs×zûîžç¯~üöÕü·Õw÷«Ñ£ e«ÀÇW¿ûõ7g–b?Ü9¶G³g;¶dzòNißÖÊ—yq÷x÷“¹…×ÔŒOMжP®¶} h8G‘2Dºz‚È·[Ä8¶ò¾Ê±R £ž/€Ä¬/\«ú²Öíaœ”mêꎫv'€7ÙpAžòzUËIÜðJàŸ…õ©áÙ¡¥µæ_#$irDuÃ_9‡¯ »ÓäÈ÷ùWà\fk£ f !{á"ëb¢ûYX`yÅ_¡.ØÙE½c`Wó÷œV_1*Ÿ÷ˆÜ'Þ™TˆØpêy¥³/•báG¶±°b?˜¨Ú^èö®­¼ÐˆÓs&Ä ·(ÞvmôˆµÞVm— Ÿ -dK…lA²‚Ź Fᤡñ隆™ cD?­c²9Ì}ÇŽ¤[·õÜwH°ü:[ç@í%U=ΞízÞ‹DE¶ -ý—uôA„ƒo¡bȴךTI\xÞ±£\r©2“¢{‘á·E—=畈üˆ{7s/´s ñ¤OßLØ´§mí¨)Ýì,ÕP§Ü ê@?ÂËkµ­´¼¼—ôèÎIŽ±)ü¯iöt[@ž­ÝàŸ…½8„Å©%®7WÈkv€òhÛc/~S½Øâÿ¢ÍxÍ|œóV×z“té|ÌR|KT?g“@õ/‰ÅI5@ÎÌŠ Ý~}*—¶OpÏþ+êï.²„míßb)½®=£­×890 º‹¼®z'®-…!˜p¥ÊqÀÝ¥m±‡‘ŸQG¸:æ‹7|FŽ  Ûž`ýÏ$ ë+˜õ Ô5¤!C7 9œ+HÎ'paƒëò˜“s@«Ù a¤©Kž´˜Û¸¼9ë9ËL`;Є]Ÿw$˜6¥ù™Îõi‡ Uà”ª”2#±Ã´Ot˜´¢Æ°UÒ«BÄ(%e#“…û›ººØÆi’s– ½¯;|6’´ <瀭,' 8Û ãOöÞì6N„Á7áý%b³$)úÞâkÄîHEÎH(pG™ôé¾Üã”ÉKÄ:XØeÝÍ p D¤Vƒúù’Ï¿öì›Q'ˆmGù/zær9ï,ê(Û‡³çQGK¸y슧!Xä0hQR £>s I%ƒªDÅ–¥ÛA$Œ_ÂÔsmx/[Ð/óÈ'¾+Œè'OCJ@ Š²ØKFz¡ü€d€‹ ÎFöµtšM.eP/`³Z^îÈòARjù›&YYW2©eq‹‡–ˆHBe]úštþËn¬èl]ƒJ¤5ë äzRáñ¨»ý (×µîÙf / - Ç7”–mðÔÉû¬dhN9òò{ÌaÔ¼ƒð9GDm¨@¶¼õLdôÚ“¬p?Y&rÌÄb\(6H™©+¶/„äÉñÏL"ÍJ¹Zí^Lö¥c†©c®ÅôØEjŸ=3@õÇá*Š$‡X{à ®Ñ”\ pX ²dfŠFn³Ð娕M82B8Ð7$Øa[—Y·Y6(ü6ý]Ë „ò]û²™l×±ëáWÄrpPC¨”ú!Û%ã¿»„Š$‹ä'5ܵJMš–òYŽ>²‘c¨x!›õÏÞ -í89ˆ¦x1 †‚¾7Ѩ ˆu´²!¯Ž#4 ü6Ä( ZZcÓ!ÉšM_Êa\{Þ'22Î"“»æàÑ¡n£«å1•½˜L‡ë&ùñvÉØzþZ“Ÿ\' 3¥¤÷ìåQDCÍÎ:ÜA]V˜WžQ x@ä)ËavØݬy -Üw™ ]8¢Øÿ4×ä Áè:ÒÀM[üŠ÷Ù†¢°@&…DÑ“)ï#kÀAeÖØ‘S;¾ ëÑh²Þ”$KYdrd0ÒÅÍ(Zr¶¢¥ ­{œž·üíö\#è‘SøĀ眫rm5&¹82+M„\ä;ê±t…œ+knÄh‹k0®×ûUNŸ´´ 4‡‚¼£‚<ǤW#hŒ&4¡@ y³‰Ž‰ûÙ…Ñgz8ÑEǵcÔËÌëQp1Úáô@*Ìî² Ý6,>ž‡ï©Ï”•# '3‚÷«ûÿ`Nƒ>‹RXäRÍÌ­”¾d ”F!«‘qã™4§* -/ôCÞ -ó-3TcwÂó÷o¿6£¯xÄýBe½{ñêÏH!`5ÍÛ®¡òçÔe× 4žŒcÌúR99¶×f}ÝOTšÓeüŽ;–×Ñ2I«qôi³æ)ßÀ‹7¢¢OGÖÏ}jŽo¡¥)í Q¥ïº’=ÛbwI×—{$ßE—ck+rh{ã>à n °O€´8ÒáEO›¬œ ØCŸcª)`)9M,6ùÁ4¨YÁ]·)¦ƒ¶¯©b"…X´­éMûBÒqšۼì•â]!îŸú€M6\žÇ‰80n‰eýÁBô¹ùÔŠ S‡~s­}$Uí£)jÞgŒË> endobj -3523 0 obj << -/D [3521 0 R /XYZ 85.039 781.388 null] +5852 0 obj << +/Type /Pages +/Count 6 +/Parent 6728 0 R +/Kids [5845 0 R 5854 0 R 5860 0 R 5870 0 R 5877 0 R 5881 0 R] >> endobj -1342 0 obj << -/D [3521 0 R /XYZ 85.039 719.568 null] +5897 0 obj << +/Type /Pages +/Count 6 +/Parent 6729 0 R +/Kids [5889 0 R 5899 0 R 5905 0 R 5909 0 R 5915 0 R 5927 0 R] >> endobj -3524 0 obj << -/D [3521 0 R /XYZ 85.039 698.974 null] +5939 0 obj << +/Type /Pages +/Count 6 +/Parent 6729 0 R +/Kids [5934 0 R 5941 0 R 5945 0 R 5955 0 R 5961 0 R 5968 0 R] >> endobj -1346 0 obj << -/D [3521 0 R /XYZ 85.039 624.261 null] +5983 0 obj << +/Type /Pages +/Count 6 +/Parent 6729 0 R +/Kids [5975 0 R 5985 0 R 5999 0 R 6008 0 R 6016 0 R 6023 0 R] >> endobj -3525 0 obj << -/D [3521 0 R /XYZ 85.039 601.545 null] +6039 0 obj << +/Type /Pages +/Count 6 +/Parent 6729 0 R +/Kids [6030 0 R 6041 0 R 6057 0 R 6061 0 R 6083 0 R 6097 0 R] >> endobj -1350 0 obj << -/D [3521 0 R /XYZ 85.039 450.539 null] +6112 0 obj << +/Type /Pages +/Count 6 +/Parent 6729 0 R +/Kids [6105 0 R 6114 0 R 6122 0 R 6131 0 R 6135 0 R 6143 0 R] >> endobj -3526 0 obj << -/D [3521 0 R /XYZ 85.039 419.014 null] +6152 0 obj << +/Type /Pages +/Count 6 +/Parent 6729 0 R +/Kids [6149 0 R 6154 0 R 6160 0 R 6166 0 R 6172 0 R 6176 0 R] >> endobj -1354 0 obj << -/D [3521 0 R /XYZ 85.039 282.475 null] +6186 0 obj << +/Type /Pages +/Count 6 +/Parent 6730 0 R +/Kids [6180 0 R 6188 0 R 6192 0 R 6200 0 R 6207 0 R 6216 0 R] >> endobj -3527 0 obj << -/D [3521 0 R /XYZ 85.039 261.278 null] +6227 0 obj << +/Type /Pages +/Count 6 +/Parent 6730 0 R +/Kids [6224 0 R 6229 0 R 6235 0 R 6241 0 R 6248 0 R 6253 0 R] >> endobj -3520 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F41 2104 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +6262 0 obj << +/Type /Pages +/Count 6 +/Parent 6730 0 R +/Kids [6259 0 R 6264 0 R 6271 0 R 6279 0 R 6283 0 R 6291 0 R] >> endobj -3530 0 obj << -/Length 2194 -/Filter /FlateDecode ->> -stream -xÚÍYKsÜƾóW •C°e;OÊpØD2¼k7*Çâ3Ïutgû£^*‘BÄ ¨eUÛj,·u[û¸ìZ'öÑ,3/}»±IXôu5ð÷/7‘Jà -?=âÂÿhXµl©…-®?WdDÂÀϼ–…ÝG)œã5ˆ:Ǻñºêј R‘š ’¸‡9ÙÚAÁè Ñ&¬ñsZ… Oh|èznÁ?W§zÏ_AkîÅ:rNGFŨ/‡\Û<¶y²rN–ÄZšGÕÐKÔð““>× È‚TÇ’HHaAƹµKHü³Û` pç× lãTð‚? Îå¹æÕÅ3Ù9¿DÛ× ~èÀ¢`6J籂¯Ë”¦3R³¤~èŒ(€òÔÖ`ág²pà©âØûXð°¿ãi„Aqë^£UÄ6ÌëgZ Zd^"Ôºá¾ÿJØØHí=|2 ±J×3Ø­<ímë ü]Xfu£³q‚6mÄ„À>òÏâ’Œ nIÕP¢@‡~ö蓨(Gœ?Ìh€kb–ù‡Àl‹ÿ-%ZUæéŒ~‹çJjfø´w<ÁÇ­ƒHƒyŸÚðL‰„¯8ºã•‰¤ª=¯.aáäáV¹y|æ”#d+±°J çZ;Ûêv¬úC±ža6ØH'ÙÝŒuçùÈn™v.‰ø::K´H–òp:j™€ª†©’Î%yØòÎa¥eMØ6—dôžG¦q0¾r -Š"ÜWcå﵋„Nñ`¡Âý¢Ð©u -ê†^ü‡yˆÇðɉÑþ×Ça鋧û–iwè(ä(8s½x €;c›cBI¤­|5ý¿Ò.ÔçBµk,½BºpÔpõ8çþ²‘2…z¾åh_­¯‚¶$uÌ ù/a¶]>?¼ê1æU)$ª|šy߈>$¡§.ÂÓLQÂÝzQrŽßŒ8VaÁE¯íYÄòÊ /a2h>f$² `šg~hæ#`¿‚æ£Oe©ÒTk“NÜýDcS(6Õ¢F“I¸íטÿÊdœUáJœñ¼ƒ”‰èNÇ= -!!¡Ôi¨øÁQ5øSú=Åé•v†® -"ŠP%2_r³X’À!ãðšXpàéÂÅ€ž±;í¯NÍ\X qèpb5i5±çñ¹Â:g‘²¯'#œÎåç‡q -þ¸Bö8h@=#³Ó˜¿Y9ŒS¹¨¤)ž+¡T6S¯ý8%šÊ<+çÏÙ,{ ùFìËoí2â=#h,z×@‚ÏR:[Ôî¸K(¼_¹fPPáY_R`ðDBÅôy=š7(!ÂÿpƒOã=Oà!¥òœ0ÃWÿ~·É4fN¾>ðìŒ,fœ¸õ¥`ü¶g,•Ó`"UܲöÇé$íyþvºþè§.¢s™“¦q-øÙ x`ŒµtàBªqþí§æijÅØÈ(y7¿9—•ø’kw>ÖÇãSÊ wo2_ØÑ›‡W"?™ñµT®íÚÕ•J©5†v!ÎXQkh±1|GQ}"ÂG ß¶ëÛêïÀsY›»^l gîG<‘ qS -ÈÈÅ°H{p§¨Þá3«½MpxqZ=jt ß;Än«u,C èGžaÒðKÐñÒ†ö> endobj -3531 0 obj << -/D [3529 0 R /XYZ 85.039 781.388 null] +6342 0 obj << +/Type /Pages +/Count 6 +/Parent 6730 0 R +/Kids [6336 0 R 6344 0 R 6372 0 R 6379 0 R 6383 0 R 6389 0 R] >> endobj -1358 0 obj << -/D [3529 0 R /XYZ 85.039 321.713 null] +6406 0 obj << +/Type /Pages +/Count 6 +/Parent 6730 0 R +/Kids [6399 0 R 6408 0 R 6417 0 R 6421 0 R 6428 0 R 6436 0 R] >> endobj -3532 0 obj << -/D [3529 0 R /XYZ 85.039 300.516 null] +6457 0 obj << +/Type /Pages +/Count 6 +/Parent 6731 0 R +/Kids [6442 0 R 6459 0 R 6468 0 R 6476 0 R 6487 0 R 6494 0 R] >> endobj -3528 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F35 1632 0 R /F70 2201 0 R /F18 2207 0 R /F20 1617 0 R /F56 1642 0 R >> -/XObject << /Im1 2193 0 R /Im2 2261 0 R >> -/ProcSet [ /PDF /Text ] +6510 0 obj << +/Type /Pages +/Count 6 +/Parent 6731 0 R +/Kids [6504 0 R 6512 0 R 6516 0 R 6535 0 R 6548 0 R 6555 0 R] >> endobj -3535 0 obj << -/Length 563 -/Filter /FlateDecode ->> -stream -xÚ¥TKSÛ0¾ûWèh¤hõ´Ž†¦4”xÚåà‚)â$ÄN‹ÿ}W–‰ÆΔñÁ«}~ßjW@8~@R͸tĦÀdš’»2âä'Z>FÐyp¢7Ú›N²htfÎw${h]²û›øô||•M®*¥Œ%g µ6Ïg‰HãoA›ÍÂÿtvy•@<ý4 çùøòdœÜfÑ$;(JSFúªÏÑÍ-'÷ì"âLº”üF™3pŽ”‘Ò’i%»ó2šG_öY‚M‘5À*a˜°(ôêßå¤vL;3XA§†°MÓqL¤Îû8‹Æ‹ V"{»ï¹E0§õaÏ?¯±uB!.†Ú§™-iòL€qåœ Ö¹ÅÙµŠÑ´òaˆHJ:&°:vÉÈ~ …éÞ+Wq“¯wá°« -/è¸~ì„ùWD­Â¡ª½s³ìl‹Õ"PkmžaSÕ…ÿ—û,« 5~Â^«”Þ%÷š&X—˜fñämf×ëÞ€¢} -š¼öMô?4®åâÑ¢vt†¤{¦`Y -Ûâ%/7Ë¢U¿¶ŠVu¾­w›sÔ’mº¨êÎ#ÝztOx¸ÈuË| ž£[^þȃí;Õ…,VuP?vð)(ÀÉ1G,ª¦ía]´ýao‡E‚b·šª”I«Þ5¼Ôï8Kè~çþŸ¨°¸œ’P£$³Ú ¿NÑ÷=Ò2¼.Úç -ó­æ[ÛA0LÖçàC)4endstream -endobj -3534 0 obj << -/Type /Page -/Contents 3535 0 R -/Resources 3533 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3501 0 R +6566 0 obj << +/Type /Pages +/Count 6 +/Parent 6731 0 R +/Kids [6561 0 R 6568 0 R 6576 0 R 6581 0 R 6589 0 R 6602 0 R] >> endobj -3536 0 obj << -/D [3534 0 R /XYZ 85.039 781.388 null] +6623 0 obj << +/Type /Pages +/Count 6 +/Parent 6731 0 R +/Kids [6614 0 R 6625 0 R 6634 0 R 6641 0 R 6650 0 R 6658 0 R] >> endobj -3533 0 obj << -/Font << /F62 1689 0 R /F70 2201 0 R /F18 2207 0 R /F35 1632 0 R /F15 1628 0 R >> -/XObject << /Im1 2193 0 R >> -/ProcSet [ /PDF /Text ] +6696 0 obj << +/Type /Pages +/Count 1 +/Parent 6731 0 R +/Kids [6663 0 R] >> endobj -3539 0 obj << -/Length 2450 -/Filter /FlateDecode ->> -stream -xÚÕYIoãF¾÷¯ð-0bÈbqËeIO=H/ˆô!™CI¢(Æ\²dÇÿ>o+.’ìÎ1 f-¯–·}ï½RxÀ_x—Å~åwiúQ–Ýíš7Á] 3?¿ …BÇ‘k í“k7»N”èôJ}•Fwk¥ý< ŠÿlÞ|ÿNw*ð“$ºÛˆr³ÿÍ‹BµŽãÀû° -½ªì­ºvµŽ’Ä;¬Ö¡×w ÷>bo£±“zŸø-üÄ“¶[ýó?Ø’ÏLhë{ÓlÍ:bŠÏoB’7ÿÝL¬,ÆI”ø¹R#'a|°&Ÿs²9Vœ•ò5ø €…syäfy®àæû‚çáÖL7 È NQÃÊ4ôÝ@ÄÊ{ª†#R´å|qà5n)ÊN6>ôÐ'ÁÁÂ$4ÝÓ ©Zîî@Î*ó,ÑÖN~!j7'†è„(B9"¡È2ÒÞv…wÆs‹=“ìݾÐ^îë¿,õÜϳü5©‡©ŸGjn?¡ö#\ØYνϵiÛQD`%¦Ýsãç‚Äji›%ŽŎYE`gxyñª~úêEUèÇÉWÌã=¬ƒÈ³ÇÚ{¿áïJ«ëk4 !ŽС5á·;à8q"[ž îð ò'Æh‡#ªÈrÇÔ5ÓŸH%ÛºhdKãÎ(Ú]wfµÁ¹{&ß®Ö0PìHFggœÅÜRbb­OÕiâ`Aêu´¬ëe ùõšÊÒÈÛàFGæF§)˜LßwHX›þ™×¡ñÑ—¼ -[ëjÁ*¬¯Á¦=Ë@ÛvÒ`Þénˆ%ÛÚ‰°‘5;Ó2p{à "YœH¶´ J*ŒblŸjêµ…ôJO²0¢heIiˆ‹A\ªìf²wš‹ŽÇžœ·_|4]nw¢+éP{M7Xn ÇgŸn05ØîÄú"Fzö]KâÇÑهʞ‰aÀå¼Ù÷|»Í¨œz«%X…7ÀJ-ÁêÃ=~¡Õ„X+¸ËÓp‰es ÃMtr0£Ù‰Š18\`²°¾Áø§ÒˆÑ~ -=û]¶mÄ ñHœÅ‹ÏõžÉùæÓ Ñ“…ó ]éŠÇÅtwâqÃd{g®ÖT£éÊ GKºˆé­i­¼{ºÂ•³2° ²M/*6Ü?OÜ?® k¶qø¢!¢û¥.…€±Ñ×âhòߌLŒ]hÌÀß#eMÚä”q’m• g¨&|G%‰÷©-˜c]JL÷Øá‘GS¯opVmYá£y’ocGT!VKtÜŸ‚™}¡´àeœ%ny?[ï P<%‘ÐLèOâ(˜!œD…¡ðä¸'l¨`œÚNP Rh]ãÀ_A±G’í+‘ó -Óš² »¢ öy—HŒ:"öZ'hÁŒðQ6Š¼1&FÂPÏçÉÊp—C’í -±ÄûÀ!î™)žŽ3"58‡áõ·t (NbÚŸ08«$ ¸u!ŽVqî  )Ô N[4“–ÒÙ®¬P5*afH1øsT«)a»8˜ÒQò¹g2Ü}oÑ3êÃĹ—‹Ñ,5ü¡ziÇpŠt²k lÍàRu­E²®o$Àw5ÊeBm#*#dÀÆïA¨ûa®H²_!gc‹Pʸ¤—/f ï)XJ¤\µÃ&SÖÏ…´êxÔ’±S^½C33è\Õß‘EüϒůªévC÷±>Ù]¨ÀŒ¨ vø¦ìàï.à€p¦4A|Þœ§˜HVã²¢èµd@J-{ÄÓz3Æ)S/£8gï.Îãù§¿)»ú‘<¥«ö“„î¹ùKµ“2yÒ"'<]5§z|ë™@ù·«‹¨ôÝJª |‚—š -ô1”ˆy¹Ìͬ¿J6×Â*ä©~è1×ÃÀGѾ•E[Ãæô:‰óòJU}ãÍ)z~ŠìJæc|€Ó’ÝŽ”ÏÑßôl=¿ÉÇOnàc“ÖV±òÒ”±§8Âö¯“½Øý¸0{‡¤§ÃL‘{à|Y¤/ò` ç­™Š|œÆü[rÓ s™.´(ILgLŽ7­¦³&•I­+ü£ ÓsŒ\Õé°/zú­ÇNt˜ ™U~A:gN 6º¦à§ì”Äð=LY¸ú5À2´9zVÆgXÄÓÔÆ4 ª[ª‚äª\ ð)wèxÁTôÂÙSÞ†Qq™¤ãõ¯9\j.‹ÈÄ å…4SÉ™ 4fj*3|+3öLöDiø~IîOõÔ=¡8¹GNøoéŽø6)“lÖ½Û]‹()åt Äkv–Ï6J‡¢~ÈLèáà¥à4a=6¨´¢#±{¯__‘LAÀd%ؘ¥.œõK¡s¿qðT¡–±‡Ù3~q„ -Å[ºùqö†Øô¶šÔk»^àh-ñQ |€³Â벓]õËü Ã81Ó{Fá^>Q›si/Ÿ>nüF¿PÀD4¡ÂZ’Xþ…ïßW#ÖÀf‚Ëü|-¯¡Ê‰ó¯¡¼ -ÃËCT¤ýü2t¸ï_Û¸8Ôendstream -endobj -3538 0 obj << -/Type /Page -/Contents 3539 0 R -/Resources 3537 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3544 0 R +6721 0 obj << +/Type /Pages +/Count 36 +/Parent 6732 0 R +/Kids [2869 0 R 3158 0 R 3471 0 R 3770 0 R 3881 0 R 3928 0 R] >> endobj -3540 0 obj << -/D [3538 0 R /XYZ 85.039 781.388 null] +6722 0 obj << +/Type /Pages +/Count 36 +/Parent 6732 0 R +/Kids [3984 0 R 4028 0 R 4069 0 R 4118 0 R 4163 0 R 4224 0 R] >> endobj -1362 0 obj << -/D [3538 0 R /XYZ 85.039 761.463 null] +6723 0 obj << +/Type /Pages +/Count 36 +/Parent 6732 0 R +/Kids [4261 0 R 4302 0 R 4346 0 R 4390 0 R 4426 0 R 4482 0 R] >> endobj -3541 0 obj << -/D [3538 0 R /XYZ 85.039 646.155 null] +6724 0 obj << +/Type /Pages +/Count 36 +/Parent 6732 0 R +/Kids [4525 0 R 4568 0 R 4612 0 R 4662 0 R 4700 0 R 4739 0 R] >> endobj -1366 0 obj << -/D [3538 0 R /XYZ 85.039 602.617 null] +6725 0 obj << +/Type /Pages +/Count 36 +/Parent 6732 0 R +/Kids [4786 0 R 4830 0 R 4873 0 R 4909 0 R 4945 0 R 4982 0 R] >> endobj -3542 0 obj << -/D [3538 0 R /XYZ 85.039 571.092 null] +6726 0 obj << +/Type /Pages +/Count 36 +/Parent 6732 0 R +/Kids [5016 0 R 5062 0 R 5108 0 R 5154 0 R 5208 0 R 5257 0 R] >> endobj -1370 0 obj << -/D [3538 0 R /XYZ 85.039 461.651 null] +6727 0 obj << +/Type /Pages +/Count 36 +/Parent 6733 0 R +/Kids [5300 0 R 5357 0 R 5398 0 R 5448 0 R 5487 0 R 5548 0 R] >> endobj -3543 0 obj << -/D [3538 0 R /XYZ 85.039 440.454 null] +6728 0 obj << +/Type /Pages +/Count 36 +/Parent 6733 0 R +/Kids [5629 0 R 5668 0 R 5694 0 R 5751 0 R 5801 0 R 5852 0 R] >> endobj -3537 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F65 2099 0 R /F41 2104 0 R >> -/ProcSet [ /PDF /Text ] +6729 0 obj << +/Type /Pages +/Count 36 +/Parent 6733 0 R +/Kids [5897 0 R 5939 0 R 5983 0 R 6039 0 R 6112 0 R 6152 0 R] >> endobj -3547 0 obj << -/Length 2662 -/Filter /FlateDecode ->> -stream -xÚÕZIsãƾûWèHUY ÷%7/3ó&5ŽýÆJ½C’CK¤$¾i‘ -—±õ~ýÃÖ$µØS•\ìòAÝè @€¦Ý‰î$ mÇO'qâÚ~’L–Û g²†‘O®Ìp&íD!]Ï/~úy×±S'ÌW4ežýnÝüëêaþáëtæû¾å»ötlju7u­ÏŸ¾^Mßš¾ÿ•‡?~z±ucwLøu>¹VÀ ßÞ`;°æ÷L{¼º»¾šùL” ιø0q9 ì ò‘Í¿.~ÿÓ™d É/Ží§Éä ÚŽí¦éd{„¾¾ôõÅãÅ¿û]x,˜ðª3ʘ^d{14|ÇN’àÜ7²ýöè5¸g4ö‡ãÆÇB„vÊÂãMq(íé†gö¼Z¶Å÷©—X9«ê¶¨AY9jwÙVõ^´ih5Ï­Ù˜y1Èèïg‡nô¶dü„"UÝÎX HPi KID¼_Lgahýw¾aüá„NÔ’ç]Ñ¢±Ò|TZNd<µkÜ×U¾-Ý©%ʳ)J–Ÿ½†…²U‰¢XâF›we _ªuUfÍ÷†BîÌŸ¹m yIŽîÑ"mÿ®nú±Z¡‘"ãOªªnüj·ƒŽ.–ª-ŒŽZD6ÖÆ’ü£eÝÀDØ«%ÓFƒ½úŽÑf‰¯€ú¦.+o2}̼Ðop‘Z«\µ]J Û TËGµÅCŠ·÷`ø;µ«+ýŽgg²§*3l7¼I`mqwÅJ°sá€ÖˆH¬WÛiòŽrÍs@j/µÚÜ óÛŠ„|3ÃEJ¶kiOŽ"R¯)Ú¼×¢Ø'¢U—õ[þü¢ÅE†É[s¸ÞØr‘ñ¦j<QVÁOe^7òÅ÷`4€"—!s›H*”E«EAá¦5Æ5’™ôСÄhR±…˜BO˜8µÐ -*¶ˆ¦­É(Öâgªm¸óì]¡ÐíÅPäs`üùîZ}Â1B^î¡è‡eT*Ñ†Ö ù/OàYu'm:¤20K1fmÌ̪ÌùÈæìy4G¼]z¿•Å3ÌúéKAÈ×=3¹ÙÓ]ÎÈÝvtF²6'^M -üÈdÌoç’nê|ŒÅVxs3rß¹¥Še£©!–t²¬ ,íûJþžø kZîÙE?¢‘ê¼yWîù©_ª5˜ýتÉbp, ¬KúJS)aTq—£´;¯1ù¨ê­*—ä8c®ˆbjÙ¥à4%þQ~½µLšmÍÚ;ÔÉIyˆ2‹—›Þ{’bà.¥dJh„ïÉ|>êü¹@Ñ5h!t îÝ¥*–&‹C::U¦¹Qû6£AÉ8q‚Bo79ç˜})"~‰Kۼ߼¬tµ.F‰"î€q¢ÅÔiÑp¸{ N©2µã€‚¡èò¸·l~2å/=L~wX~µ TäÀMþYlwšC”èÙ¤1ô³êPn=‚sNAtN(Øë’1ÒƒZ¢¿‹¢•*º£Œÿ]¹ð‰®éHWð‹–T`†æÝQ¦TÕ Á€‹€¡†‚aH XÛ† «ª–… cSô"Ño¸-Ê‚jšnË„§"3gAX›ªe>Ôt”ì|ãë[Á—ŒïZ -»Óò+ ý®‰a†k<Ù ©u­Ú¾âq2(ì†(gêo®#3Æ äóL‘ò™jT…õÓðžÍa;¼›P0rƪƒù+J¶<¢˜6|N‚ -žGF«6úÚÁWoŠð‰TŽÏ%oÇéÖðTR¤€_p¯ZX?8ƒ›ú/_¬Ù(5s]ù¦„©3ö •ØÂ?ÏÃNãôD\y}‚yÍË_(§ gݬîÓ8×9®ø4$˜®' Ò¹ *þZÕ™©¦‰ñÊð= -ݧ–+”wRgŽ н"²«dÃ~ÉÉëÃï¸FíÔòà‰¨}±ÄÇ'ª 3¶òvc¿˜×»©o»itþ_†DÂöÏ8~l»I¯­WëÏõŽ?9ÿ¯H©Äendstream -endobj -3546 0 obj << -/Type /Page -/Contents 3547 0 R -/Resources 3545 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3544 0 R +6730 0 obj << +/Type /Pages +/Count 36 +/Parent 6733 0 R +/Kids [6186 0 R 6227 0 R 6262 0 R 6304 0 R 6342 0 R 6406 0 R] >> endobj -3548 0 obj << -/D [3546 0 R /XYZ 85.039 781.388 null] +6731 0 obj << +/Type /Pages +/Count 25 +/Parent 6733 0 R +/Kids [6457 0 R 6510 0 R 6566 0 R 6623 0 R 6696 0 R] >> endobj -1374 0 obj << -/D [3546 0 R /XYZ 85.039 255.509 null] +6732 0 obj << +/Type /Pages +/Count 216 +/Parent 6734 0 R +/Kids [6721 0 R 6722 0 R 6723 0 R 6724 0 R 6725 0 R 6726 0 R] >> endobj -3549 0 obj << -/D [3546 0 R /XYZ 85.039 234.914 null] +6733 0 obj << +/Type /Pages +/Count 169 +/Parent 6734 0 R +/Kids [6727 0 R 6728 0 R 6729 0 R 6730 0 R 6731 0 R] >> endobj -3545 0 obj << -/Font << /F62 1689 0 R /F41 2104 0 R /F15 1628 0 R /F20 1617 0 R >> -/ProcSet [ /PDF /Text ] +6734 0 obj << +/Type /Pages +/Count 385 +/Kids [6732 0 R 6733 0 R] >> endobj -3552 0 obj << -/Length 3822 -/Filter /FlateDecode ->> -stream -xÚµZY“£8~¯_ᘗÅmØ°oÕçöL_Û]û03*CÙÚÂà\îú÷›—„l㎉ØبˆBH™:Ry|™8žEðÏò,ŒT1[åq¨ò|¶ÞÝD³ Œ¼»‰…"š¥a´ÌpèåÝÍÏo—É,ŽÂ"*fwDrWþ¼úÇí—»7_ç ¥T âp¾X­òàã<Þ¿ûz;ÏUp÷þó'~ûuž¬‚Ï0ö‘;>ÝÍqòËèý -Ûip÷™û¾Ý~|y»PÜ)ÜýróæÎÛå" Ó¥ÂmþyóÛѬ„“ür…ªÈgGhGa\³ÝMš©0K•¼×7ßnþéfá±tÆ\ÂX¤q*ÁBEaž§N*q6!•[Øq{ØñvžäÁsoÖxT]ã@4Õ€ÝG”GÛÕ#3ôRmvôhd`†qÓTܱmÀÖcw%¼Ô~BbÇiy½8(¡ÝòšMÿûUPé5naËs¶L}Ü"‘?r¶<,¶× ÞÄl!‡_Ä(À‚N¿CNÜ^=A ûIVñ䩱ߚOLEJü{;ÇãÐ<‰œF›¦~Ü ´¢ #© ÄPr×__{ÍÀ\FÞéàm?ÐY£“Sêò f3´[}oYà• 7×mÓ›r<t®Ø,ïÚCEüƒ¼Éi‘u¾œ±Ûéf-ƒf·¯qqV*\д$ ˜o‘'«¸QòfƒB*–°¾,ŽSh”Ë3Š€Eç4£s²VD@ɪkOcÅ -œÝ#^×2e½‚W"ÔN׸†¨lB™è¡*¹§¤[Dë.:J |ðµu]uLC2Ñb(m|ÞÓL•ÁÍld®ñ”²Á’'Z&`ûèÄ@.ïsÔZ3X­Ujy®SJeÓæ ¤¼Ä©ù’a*µ -vÎ~pÒª?Ô·É"eâä-v²¾¯@ùà»–Uµ— x›¨—çìXPT‘bÏi ĹšJ—C<ÊÊ{½¦Z#Ã…8`€ÎTÿÕ¬Aøªë¾=Ý×Ь_”ìÐt)QÉ0¾¶ëYpXYx ¦glm®ÉB_xÜ#þÑŒ¹t²±àLã5C÷¤0S}¿V•õµ…Ü}!w õ‘_P¡“QÛ)¯*ðT¢‡² -402†|˜Dò+¹ Ó :åmàõv -ë] Ý‰èS:æ'y¬é¹åßôa8#c9ôÆò›©l”…™Æ©§™1>yëÕ^z»ú1Ú8ŽÉš±çš/æ&©äž×*™è°ç'¯ O½÷ÙÀ€yI8`']µGÆ ›=åÊÝ•™ÃUÿmMÁF 7_f–°Ø (džÇÍb›?súa³5ŽÛ¥XزíÊ°õï˜À«¤BË ¸Æº²Õ ØÖ‡ŠîÕExØRÁÉ{ÏÐ!NàY.¾ØiÏ ojLÖe—'™ï Iš°‡Íª=ÝFÚ²u·ÜÏ[㶓Ž>ç>ÏzwÚÌÙÆãSÆU¼<Ë4€T»‹ ˉ›~šg€kÃ&[qð˜¨ËDæw¯»Ê•G„Yóƒ®fÍ&³r›[¶óïY‡T2ÆÕ=AžÙ( qÜÈÓb þjàý—d*è—19vÔZŒgËh48Ûp)B¬I(4ízÝv¥MÊ‘”ü:Œ–§—( ¾žJÆŒ o½f?S. -ÞšZVç²ΉÒiq0¾Z -<ËÛ \’‘§W(À¨š$«‹"’eðd4Ómh×èh°[ÒíLÏ–`³v$åmÃtj½4Ø$^Ù fù©‡$”ÜÚ³Ý%VŽ†ç›ØOhìTòŒËü¥ëa„Ä®3.ªâpNÕ!* mo£ý}?hÉŒ9†=3õh•­‘ùÁ…¦²&SàBÞ•«àÖžë’¡‡ËÃØê5y~²)éÙêÓ -»(c'”+ªý‘³!´¢(þA®+¡NA$7€÷É^Û®ç‘㶒Îbv,$¹1ÈàèÁJ´+_!¿ r0”ô~q{Ð$uÀÆX¹¤¹¸ªÖ»£}{< -¼[¥Ñ–Ÿ\ øE,ÖÙöùÙ[$%‰"•C -¼_BÄFƒˆ P"¥ª,Ý™OIõ˜$–jÉ·"½¶‰[=¿m9r‰I|JÇËbéðƒÍT‘碥—e_äär§¼ß1¿$Óh6–luç/ºÜqœ´ãµÝßzî'~¨•ù@9^ž¶i%é;jMØ÷S!ÂfõpohNÕwI%Ç+ŤoÜ_Á±gñ{~‚öpÈX´» ¾Jº/ÖH,$ z¿×îâreþÓÞ_ªK¥´ÁEèBvžl³åœzÅA#qoU…ð {BJH´‹T¥û˜±>œ&QHʬIp[2Œol€+ |:­Zj½ `ì<ü tªŒÙدbâÜvÕƨ7ÜÃÙôR]‡!0F_cäÆ@ -®a6À,íž¾±óÎaà›¦ñ^/èêAÿÜÕ'§M}¼àôBü뽨zËO—YžZ£òK¾Xï«å³ÇaüîÑ3ÝF¾° -&8«Ràu&h-§iªµs±Tï|æɼá*꓃'yq~pê[k‰{Iîïi¤sî ”±°}[-Ä“eChNÙ¨í$‚/$š•÷°ÓTy’" -ªï¬á§¿€ IÅ -¼©rÖ¡Ïú*¤ËZ¢cyÄ'Þl-ÀÆ.¦€nOãO¦F]*7•l:Áú•Ð]Ìëù]Ô²<9Á]H±Ÿ²s›wдù•’G~Q—½^JÔNu:é-Ó@ï^ºÌ)øXÆSS>²¾åçxðr:Åeû£ñR°œû.„/^æœy‚+eòÖc«\ +IÝÕ:‚õ10’HG¿y¬=;*_ã~«|—ãÀ‰³ãîZÄYˆ¸«HI‰ãÄɯ’\00”Œg|“:÷1½fž‡Ëh)3|zs÷áó»ÏŸ&VJ‹0ÍR¡#ïÁF^…QrRKÿÖbHU‚Ï©dM8ÄÕø§jØçÿl ßõ8Œ®¸æWçî쯰S÷S,²påäñh¾RÓdQ‚:ÞE¸ƒ¾¯Í¨‹¼?.…>sáóµ$“$[…q±:цÆO”¤µÍÙÏBÀ‚ ÈÛß7\+??àÇ5íDT¸º0¹Ÿ‘¤ôIN`—Û9~DkùYÊSóc#&xŠÓòöIœ”N-‘ŒGNõûÒPÈù"p˜5M¦„ˆå¥¤…tú„ äpmÆ‚Ê4æ;išxHÎ~‹†GãN/)7>å L]·î·±ý­†Ü6¨ôŒvä£ûeí•CÌÕ3?RÕ”€ (Ʀº'Ä¥nâqÖµ¼üú2΋8ÊøMtªÒì}Óñ.é[5tlçR< -W+—%3s±ÁÛNc†­ü”‹Þ1ë™FM¢‡ò#ù6D™©+{*¹YWrâô®ú¼}çýÎCRâëØ;ÎWaž$Ó?@wñ?ü´Saæ¿á˜ÎI¬Î7/ÁÝ¢ô6ø_ö-»¤endstream -endobj -3551 0 obj << -/Type /Page -/Contents 3552 0 R -/Resources 3550 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3544 0 R +6735 0 obj << +/Type /Outlines +/First 7 0 R +/Last 2611 0 R +/Count 6 >> endobj -3553 0 obj << -/D [3551 0 R /XYZ 85.039 781.388 null] +2855 0 obj << +/Title 2856 0 R +/A 2853 0 R +/Parent 2843 0 R +/Prev 2851 0 R >> endobj -1378 0 obj << -/D [3551 0 R /XYZ 85.039 626.845 null] +2851 0 obj << +/Title 2852 0 R +/A 2849 0 R +/Parent 2843 0 R +/Prev 2847 0 R +/Next 2855 0 R >> endobj -3554 0 obj << -/D [3551 0 R /XYZ 85.039 604.129 null] +2847 0 obj << +/Title 2848 0 R +/A 2845 0 R +/Parent 2843 0 R +/Next 2851 0 R >> endobj -1382 0 obj << -/D [3551 0 R /XYZ 85.039 250.134 null] +2843 0 obj << +/Title 2844 0 R +/A 2841 0 R +/Parent 2611 0 R +/Prev 2835 0 R +/First 2847 0 R +/Last 2855 0 R +/Count -3 >> endobj -3555 0 obj << -/D [3551 0 R /XYZ 85.039 229.54 null] +2839 0 obj << +/Title 2840 0 R +/A 2837 0 R +/Parent 2835 0 R >> endobj -3550 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +2835 0 obj << +/Title 2836 0 R +/A 2833 0 R +/Parent 2611 0 R +/Prev 2787 0 R +/Next 2843 0 R +/First 2839 0 R +/Last 2839 0 R +/Count -1 >> endobj -3558 0 obj << -/Length 2202 -/Filter /FlateDecode ->> -stream -xÚÝZÛnÛF}×W¨( bHî./O…'®‹úÒHA¤}`$FfK‹*IÅÉßwnKQm·±]4E€poÎÎœ93»²?öàŸ?Žë©dž«âx¼¸yãÌœŒ|Yáµë…§žÏGÏ^…ÁØ÷ÜÄKÆó´d¾|ç¼øáèrþòõdª”r”ïN¦Q;gß9=y}4‰•3?½8çéW¯'Aä\ÀÜœÏ'SßÑܹ„ñãØÖÎü‚ÇfGgϦŠeÁoóG/ç-§ÚÕ¡B5ÿ½ûÍ/a'?Ž[àÿMΦB¨øèÄ„ö×äMaå.nÇYýGSn´ÑÖ%0r–®ÓUvMo¬qƒKrÅv]áÝ—qAسK`œ´ %Kîí¬„kéKKž±F‚& ÌÒk”ô>¥à€Õ@£g¯T×£‰Ýȋį›ªü£V´pÏõÚ¸±Ë:€¥Ö3G£æuÿ+ÔMÑ€E‰šÜ{ÈSåW+½omñM`b‡6=çð˜ŸEÔ<¬€sd† Vì^®Ù©[©òF̉ËóeÆNÉ‘_BQ`|çWÏx³Óãž>RQØI«ŒuSVh{º®óåîã 4¯dÙ¦‹CxÁ.€ü¶üyP¹Ç¨S"ã©‹-´,’\‹nì,ð«M´êâ”wkag™žø´BÔ"?¶1ÁzoD•ìˆ;ie£*!Ë°ü:k} ï—ëž@ò<<BÎçz`OâBbá°‹J»à0æÑ9~üx€¬àq dÃK bÖkK}‹†Ç,Kà`Ä÷duÌÌ„ÎÊ›ô½p,οAù§g?~øþ ZÙÔ/œ†B…ΫI¬!%H`ÙÏRâ€Nm«–oBšÓ0t•ÖCÞ&, ‡ÝØ÷)È`€äd7–ÙZ²·;üË+¹*ðXÓP6Á(ß6”¯•TW´c¸ì|×–fB½¸p%äTz§øŒy ©Æ\Àµ¤êCIi†H5Àø†L5k²MÍüyJá×­"9@¤j¤ (ÜÐ×ζ+‰û~U÷»±ÛQu^çWb¨-Åyãòz™óP³Kd{ÎKñ0"W¨òTBwÇÙ˜×xbW#ŠÏ¤´€º'ˆÀ¸ÆÓCÛôž!œ Új`‡É£¾X¨Œ¼ØŠS¦#sÐjo‘ 1*`ï›Ü‚:”)ðãÄ–Œ>§xîÒt.é@`¥CÑ­«´f)mñm`÷Šl÷öUKë5õµÍ†E¾È3k{x*“%ËÝô+Þ —˜$¸÷ -œö4püTh ÿÇôê)%Óp§%e*G 9ÙÞäTCòà:kŠre!^_A úÀ½wøÐ4ky\eÍ‚i˜’CÔ-½¦b‹ì]FXƒ©/ ¸Z7¥ÓNOlâ†Iô`s"Dt›i%Î/æ{ìËj‹”±¦cÇêCÆ—¤ƒ{¿DÁ£ƒ¨bäú¶È­;w%!úZ_ZLMqò ·–¶ì¡Ò0¯ ¼ð­­…RNh7˯ÄÿEþ¹ÍªÏ‡$ énɨ[tpŸì÷C -Ã2å©h|^Z -Ø;3ã5%×׌Në׆®Ö‰i¢æË!ª¢k›øª Á‹ ãì€ÞHjº@:?:{)soØ:àRÌ~ pÃÿpï…ÁS¹[?¹» ªª©>¦4UX>Îÿ7ΑÂG;k>AÄŒ`º'‹œö”K·fØÜŠ™R{r$á|¦·d§Ç³HÁ[5ö A·ƒ}Ýꔡß<nÌÓáƦ4ÞÊïe.Ÿe‡Ÿ“å<Ñýuf*f?¦ŸrúÄïZR!“oÉÊêÛMÊä›Ûëý‡fþðß²×lj ´½ÍÈ«¬o:&ܮلWSâÕ\• -ÍÃ4Ñ£›† ²ÜûAÆç»>k‰â+©hvÜ3eí—6{Ú+ÿÞmRÝ=ÀZÖøþÉ*ÚøÑÇÚÐÏy›Ú•Û..`è‚ãúN0>€×’'̇rwqÊI¼€@ûjRà~V‹z”ÜnOgöR¶îå©*[”+à‰Ëž "7Ž’{ëÞ#‰JŸql«‡KÛ=šý²òuj´ktHx÷þë¹ÔzØß(ø@Ü^Ý}ªõõ­ñ–§w.ú Eá§-endstream -endobj -3557 0 obj << -/Type /Page -/Contents 3558 0 R -/Resources 3556 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3544 0 R +2831 0 obj << +/Title 2832 0 R +/A 2829 0 R +/Parent 2787 0 R +/Prev 2827 0 R >> endobj -3559 0 obj << -/D [3557 0 R /XYZ 85.039 781.388 null] +2827 0 obj << +/Title 2828 0 R +/A 2825 0 R +/Parent 2787 0 R +/Prev 2823 0 R +/Next 2831 0 R >> endobj -1386 0 obj << -/D [3557 0 R /XYZ 85.039 761.463 null] +2823 0 obj << +/Title 2824 0 R +/A 2821 0 R +/Parent 2787 0 R +/Prev 2819 0 R +/Next 2827 0 R >> endobj -3560 0 obj << -/D [3557 0 R /XYZ 85.039 740.731 null] +2819 0 obj << +/Title 2820 0 R +/A 2817 0 R +/Parent 2787 0 R +/Prev 2815 0 R +/Next 2823 0 R >> endobj -1390 0 obj << -/D [3557 0 R /XYZ 85.039 658.326 null] +2815 0 obj << +/Title 2816 0 R +/A 2813 0 R +/Parent 2787 0 R +/Prev 2811 0 R +/Next 2819 0 R >> endobj -3561 0 obj << -/D [3557 0 R /XYZ 85.039 637.732 null] +2811 0 obj << +/Title 2812 0 R +/A 2809 0 R +/Parent 2787 0 R +/Prev 2807 0 R +/Next 2815 0 R >> endobj -1394 0 obj << -/D [3557 0 R /XYZ 85.039 554.721 null] +2807 0 obj << +/Title 2808 0 R +/A 2805 0 R +/Parent 2787 0 R +/Prev 2803 0 R +/Next 2811 0 R >> endobj -3562 0 obj << -/D [3557 0 R /XYZ 85.039 533.524 null] +2803 0 obj << +/Title 2804 0 R +/A 2801 0 R +/Parent 2787 0 R +/Prev 2799 0 R +/Next 2807 0 R >> endobj -3563 0 obj << -/D [3557 0 R /XYZ 85.039 430.743 null] +2799 0 obj << +/Title 2800 0 R +/A 2797 0 R +/Parent 2787 0 R +/Prev 2795 0 R +/Next 2803 0 R >> endobj -3564 0 obj << -/D [3557 0 R /XYZ 85.039 403.615 null] +2795 0 obj << +/Title 2796 0 R +/A 2793 0 R +/Parent 2787 0 R +/Prev 2791 0 R +/Next 2799 0 R >> endobj -3565 0 obj << -/D [3557 0 R /XYZ 85.039 382.984 null] +2791 0 obj << +/Title 2792 0 R +/A 2789 0 R +/Parent 2787 0 R +/Next 2795 0 R >> endobj -3566 0 obj << -/D [3557 0 R /XYZ 85.039 358.584 null] +2787 0 obj << +/Title 2788 0 R +/A 2785 0 R +/Parent 2611 0 R +/Prev 2719 0 R +/Next 2835 0 R +/First 2791 0 R +/Last 2831 0 R +/Count -11 >> endobj -3567 0 obj << -/D [3557 0 R /XYZ 85.039 340.444 null] +2783 0 obj << +/Title 2784 0 R +/A 2781 0 R +/Parent 2719 0 R +/Prev 2779 0 R >> endobj -3568 0 obj << -/D [3557 0 R /XYZ 85.039 320.419 null] +2779 0 obj << +/Title 2780 0 R +/A 2777 0 R +/Parent 2719 0 R +/Prev 2771 0 R +/Next 2783 0 R >> endobj -3569 0 obj << -/D [3557 0 R /XYZ 85.039 296.019 null] +2775 0 obj << +/Title 2776 0 R +/A 2773 0 R +/Parent 2771 0 R >> endobj -3570 0 obj << -/D [3557 0 R /XYZ 85.039 275.388 null] +2771 0 obj << +/Title 2772 0 R +/A 2769 0 R +/Parent 2719 0 R +/Prev 2743 0 R +/Next 2779 0 R +/First 2775 0 R +/Last 2775 0 R +/Count -1 >> endobj -3571 0 obj << -/D [3557 0 R /XYZ 85.039 250.988 null] +2767 0 obj << +/Title 2768 0 R +/A 2765 0 R +/Parent 2743 0 R +/Prev 2763 0 R >> endobj -3572 0 obj << -/D [3557 0 R /XYZ 85.039 230.357 null] +2763 0 obj << +/Title 2764 0 R +/A 2761 0 R +/Parent 2743 0 R +/Prev 2759 0 R +/Next 2767 0 R >> endobj -3573 0 obj << -/D [3557 0 R /XYZ 85.039 208.447 null] +2759 0 obj << +/Title 2760 0 R +/A 2757 0 R +/Parent 2743 0 R +/Prev 2755 0 R +/Next 2763 0 R >> endobj -3574 0 obj << -/D [3557 0 R /XYZ 85.039 185.932 null] +2755 0 obj << +/Title 2756 0 R +/A 2753 0 R +/Parent 2743 0 R +/Prev 2751 0 R +/Next 2759 0 R >> endobj -3575 0 obj << -/D [3557 0 R /XYZ 85.039 160.925 null] +2751 0 obj << +/Title 2752 0 R +/A 2749 0 R +/Parent 2743 0 R +/Prev 2747 0 R +/Next 2755 0 R >> endobj -3576 0 obj << -/D [3557 0 R /XYZ 85.039 140.294 null] +2747 0 obj << +/Title 2748 0 R +/A 2745 0 R +/Parent 2743 0 R +/Next 2751 0 R >> endobj -3577 0 obj << -/D [3557 0 R /XYZ 85.039 118.385 null] +2743 0 obj << +/Title 2744 0 R +/A 2741 0 R +/Parent 2719 0 R +/Prev 2727 0 R +/Next 2771 0 R +/First 2747 0 R +/Last 2767 0 R +/Count -6 >> endobj -3578 0 obj << -/D [3557 0 R /XYZ 85.039 93.379 null] +2739 0 obj << +/Title 2740 0 R +/A 2737 0 R +/Parent 2727 0 R +/Prev 2735 0 R >> endobj -3579 0 obj << -/D [3557 0 R /XYZ 85.039 72.748 null] +2735 0 obj << +/Title 2736 0 R +/A 2733 0 R +/Parent 2727 0 R +/Prev 2731 0 R +/Next 2739 0 R >> endobj -3556 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F65 2099 0 R /F41 2104 0 R /F70 2201 0 R >> -/ProcSet [ /PDF /Text ] +2731 0 obj << +/Title 2732 0 R +/A 2729 0 R +/Parent 2727 0 R +/Next 2735 0 R >> endobj -3582 0 obj << -/Length 2193 -/Filter /FlateDecode ->> -stream -xÚÕmoÛ6ó»…?ÊÀÄŠ¤¨—ax€4í¶MÚÕ.öa(2“è‰%y’Ü4ÿ~wvye>eºY ÑljL|‘Lñhìæ„%aòØÍÙâûǦ,Jã¯`ç²î4=¹Oä¨7·Ú|îhª»†²ŽÐ2änE 7M½YXêw ÄÒ^‹î.,ÚmÖ€ˆ‰§ fe(ns‘•*p -ªZ…VvÊ’<ƒ­÷°‰+<~[úvE©-TÓ5gâ [!é<žìÌï¬ÿx¸Ò†Üïp>!¦{ò`G‰p“‡Ç)«õªÈhDAÑ™`ª¡S­:TòÈh‰åg4Õ0“DÀYªˆÁLäÔçŠ%œ÷-`-döü…2T˜zF"ÈJíø‹"𯻢®ÚRÜE‚Ñ Dp¦ÀuÔ¸—™‰^µ±ôꊾ׺7¦«¬×>\€™¦.qUøø´d °ÕNf¿÷ˆ©A®vwNÍòn“­èÌ¢rzÛ‘ªg(ZËpÍÒmÔ!l‘zôŠ¾ÑX°sð1ŠTµ2;rÃ/*¼ z>“ºè¦ÐUn/€Ý9^py»EÓý÷Åš•™D5Ço¯æ¸­ç æ„ô›ánId¯¸\„¼ªKäÇ ž×FÎ1ŽÕ±05œë£ÍÈ+ÌQ™­ànÒ€ÛÇì¶^mHñ¬Í£™X×YÐõÀç4Úú¦«¬-rsk37Æ– -;ª±`§8¸w7UŠ&®çd/}m†Þ[»’ÙÚx7ÑïŠÖzßÂU»uë*êÞ³ö¨M<Á³>µM€J¦JŒw³ R”) -ÿ-ÄÉÊ—³DÄ;•/¤êX}íW¾ÜÆ™R÷ÞTÞUUT7XùÆÞu=“Í`¾ÉsÝž*¥O’”°EÇrïÕÓ~"U¨%ãýc©Œøçí±9zƒ—ƒ,Ù꘲§¦-¶Õ¬ -ººs. Ñ&îeTÿ}ÏX'o«aÔêzVrø¸&%YºJ~G» ä°¯Ù# -…ÒLVËmÿ/vi]éÝ:Éö´éS™Øò¸Ä¢ç%±óa¤ruô‡¾ÇEÖZÜ 4'ÇuÚ¶°´l‘<­4Š¾WX˜-ßU†(„-ÉóR†þ9ÓËÖ<æî‰òÂzetÐÖsöÂÒß”‡83® .–î&`)« Ž}KFkÞ‰z"¶~>{ûÖ6:Íl»)×ÖÛoœ³kc².T‘qû½Ÿ¶Hë¦&Ç_:— m‹¾Þ¡–ˆ!8¯7«åÞígyW|²ð«¢ÑyW7ÜÙuúoƒb‹›m˜>莤»‡õqß›$`ÜñxÕóHGòËþ—HÞ°»yܨW}ø‡qþ zF’endstream -endobj -3581 0 obj << -/Type /Page -/Contents 3582 0 R -/Resources 3580 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3544 0 R +2727 0 obj << +/Title 2728 0 R +/A 2725 0 R +/Parent 2719 0 R +/Prev 2723 0 R +/Next 2743 0 R +/First 2731 0 R +/Last 2739 0 R +/Count -3 >> endobj -3583 0 obj << -/D [3581 0 R /XYZ 85.039 781.388 null] +2723 0 obj << +/Title 2724 0 R +/A 2721 0 R +/Parent 2719 0 R +/Next 2727 0 R >> endobj -3584 0 obj << -/D [3581 0 R /XYZ 85.039 761.463 null] +2719 0 obj << +/Title 2720 0 R +/A 2717 0 R +/Parent 2611 0 R +/Prev 2679 0 R +/Next 2787 0 R +/First 2723 0 R +/Last 2783 0 R +/Count -6 >> endobj -3585 0 obj << -/D [3581 0 R /XYZ 85.039 741.409 null] +2715 0 obj << +/Title 2716 0 R +/A 2713 0 R +/Parent 2707 0 R +/Prev 2711 0 R >> endobj -1398 0 obj << -/D [3581 0 R /XYZ 85.039 686.912 null] +2711 0 obj << +/Title 2712 0 R +/A 2709 0 R +/Parent 2707 0 R +/Next 2715 0 R >> endobj -3586 0 obj << -/D [3581 0 R /XYZ 85.039 657.508 null] +2707 0 obj << +/Title 2708 0 R +/A 2705 0 R +/Parent 2679 0 R +/Prev 2699 0 R +/First 2711 0 R +/Last 2715 0 R +/Count -2 >> endobj -3587 0 obj << -/D [3581 0 R /XYZ 85.039 602.784 null] +2703 0 obj << +/Title 2704 0 R +/A 2701 0 R +/Parent 2699 0 R >> endobj -3588 0 obj << -/D [3581 0 R /XYZ 285.909 608.758 null] +2699 0 obj << +/Title 2700 0 R +/A 2697 0 R +/Parent 2679 0 R +/Prev 2695 0 R +/Next 2707 0 R +/First 2703 0 R +/Last 2703 0 R +/Count -1 >> endobj -1402 0 obj << -/D [3581 0 R /XYZ 85.039 442.729 null] +2695 0 obj << +/Title 2696 0 R +/A 2693 0 R +/Parent 2679 0 R +/Prev 2691 0 R +/Next 2699 0 R >> endobj -3589 0 obj << -/D [3581 0 R /XYZ 85.039 421.532 null] +2691 0 obj << +/Title 2692 0 R +/A 2689 0 R +/Parent 2679 0 R +/Prev 2687 0 R +/Next 2695 0 R >> endobj -1406 0 obj << -/D [3581 0 R /XYZ 85.039 164.777 null] +2687 0 obj << +/Title 2688 0 R +/A 2685 0 R +/Parent 2679 0 R +/Prev 2683 0 R +/Next 2691 0 R >> endobj -3590 0 obj << -/D [3581 0 R /XYZ 85.039 143.58 null] +2683 0 obj << +/Title 2684 0 R +/A 2681 0 R +/Parent 2679 0 R +/Next 2687 0 R >> endobj -3580 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F56 1642 0 R /F38 2158 0 R /F41 2104 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +2679 0 obj << +/Title 2680 0 R +/A 2677 0 R +/Parent 2611 0 R +/Prev 2615 0 R +/Next 2719 0 R +/First 2683 0 R +/Last 2707 0 R +/Count -6 >> endobj -3593 0 obj << -/Length 2091 -/Filter /FlateDecode ->> -stream -xÚÍYYoÛF~÷¯Ð[) ¤y,¯¼Š¤n}ÕRч¶+r%-Ì«$Çÿ¾3{P”´r¤¨ÑÞ;Ç7ßÌÒÞÄ…Þ$ 7H'qâ9A’L²ò̬aæÓ™§V¸â¸QˆSïgç#â¹NꦓÅJ,YäZ?Ïî¦vVà9S;ŽëfêYWŸfÓ$°Ww·rúãÃÔ­;˜»‘·‹©íYDvîaüòÛÄZÜɱùìæýÌä Zð÷â—³‹‘”6qH ˜ÿœýù·;ÉA“_Î\'H“É´]ÇKÓIyFÂÀ I úÅÙüì·á9G&r—Á¶^aû®ûþñuq«ë‚ƒë‚£ë@hÏIÓÀt“ç'[Û±ÆáxÅá¯ðJ¼²˜¦‘E—Ë%ýâ£ÝÎ?záhuáRµåÝ¡a£Àñ‚š# Ä{gèoi¿ÿ´Lúª^IöTcu5õë3þÇÚ]ÏaFÅÒ‹MÍ3†£Ý¡(^ä:$ ÷e9òP@¯A ¦ \Ç'éK‹C‡„L8Iê}tB'“‰‚„dˆ£æ¨n‰6Ðçª -¤A‚€Vqg”JÈà‚T²å¡h‡BENGñk”é÷fÝ‚04gù[çA — $ðuu(–¸‰¹Ñ÷#ç}E²ú(€ `uc ±.¬úïnd•¼‚^ÒBŽßÍåx×Lmà>¡” -¦ÂÓ3þ—ë‘LÊJ«O{hm[Öt;‘G¾Õ7~ì¸0aòÍî Ó&X ·´Òºœ$“xÇåqY+t€r‹©¾6h\±'©-2D-Îë%›>òmpÉ2A\DßÆ'°‹ëùÿ@çˆÉ 3ìãÔ&QlÑ¢À$!rVoÿöœ^aÜ×%vð1øˆË ¸NújŽ/ñŽ%¶l<78éH;Þ zàâ:1;fwÐiõ/ê…}–¢U.{”ÛÖ»dôÝëˆ>Û¢‰7LZ›g´ç˜ý”DŠ׃ÌিÜÐÍE,Ò%ípCì«ŸÁyú4“f9ÞO3&‚°ƒÓ¼Ó˜}ÂÈ{Ò#̘H]/»Â\[aÈ`[9/89­º†`-51¯°œZH¼ˆÚŽ[Ÿ(F^…wv–H€Q»ëVJØñÏÃ\ÉÇu“꥘büÍ0¬Àᣠp cñž ]3Jd˜Š¬ÖoLÊIôç&½^‹¡EþÜ!šx{ˆ&H­‚£SKõ‚á·ç¥Ú`L¥%_·˜‡ßP‘ª*^òN•ýÛnÊC>–‰©‚¿bö=CII¬Ÿ+½µBŽI‡ÄˆÑǾn:Ù;7øäw¥õ›ßõ@5;bh»m'Ç®DÜÕ…¨¸T.&ön¦`ëDßD.½¡_D®_—C‘®êêm%ª$ô´||Ò‚÷²pxò_åº @i¡š!AjÝ -o°E\¡Gݾ›ÚòŸÈUt}’åé´Lˆõ#ì„úz®-A Šå/pa p·Ì³æ²â¯û½CŽ¯š}ž‚D”ç™-ûZÕÄ•´,“li‡¡7.h)~gÂ1]Œ‰NÉM6U'سžÐ8¡®Ù¡/º´ã>°]¯bÐd;ý¥²Âò ¨BЫaÞÁ±Ls`éÇÙ;SH>¡V´‘´[£ûzSi·{å'~Ž`ø‰ÍÏüá oM…ž¹Í%z¤†Ð8Žº‹F!Þ! Ô“$"S&¤êÉÂ*:ºþ$…G–‚5rz/¨àkÁÿXàî;~‚úNúæO­¶G~g$€¬$ ñ>'}‹ -LèÊeC»î)‡(ýÐêóeGKÕ)rÚìz7Ïóß®¡+ì9ÙK|Wf[öYƺN.†\¡Ð ûšW½È€½m䬻J]½a²1߈XÁ&ï;V¬d1.Ò)vð¡*³ö3¦j!¡¨ [ o ŠÐ|ÍJD*¶ºç®g¥){Wü‹\Ò°JÌoJÁºÚ¢†Äc9oYÖ×-—_+½¯;}êìâZí . V²ªWŠWf!2¸Ø´õv½Qö å’ª;;6´¥%ëY{Ò ·µºD¯K¿Š[Iø%cZC#ÏzWW·½„F@œ " -Zç‚g\ -=©‹UyŽr`Ö²aL|’—°á1j’ühßh Á5J¢9ïõ¹x! æê€?hŸ)ëÕ[¥áJo]о¯ke‚Õ -üjÀÿPëµHËÖÖ+'Ô¸‡‚ n-•ï–ñÏTO °Õðoöƒ€…n)Cꤪ´µZ§pq]gðÌ5¤žzoÙCMK^­Õ…RzÜ´:gpV£µüÁæW—݉Ï· 4¦s9[ >3Yüº^ë8œg-oúÀ~­j%ÓF7 ô8žêöqŒ†‹½ìÅ’6Í`­ÒÄù5¯¶_N9 ÕV´dÃ!Ê54ÃêèY«Ær°*SßãM¯ -\ñCÅ`×(#üýëªBÌXÜ+±7{ĠíM¾d]ûû;ÖŸ½»ì2¬øzÛÊ/P{¾ÐÝ⃩€¹Rô/ ãÈö×—³{e5š=j2Íuú8aYF;®ÅÓ'åÛ²ÑäË{N‹Ã rýaítè\_^}üq›‚&Úêh°eEMµ˜Õž6c €‰ßà Ô0Æýù„`«²û:¬Æ~NžåùÞY9+˜¦d ㇬.7Ô$Ìu²Õ÷Õ5J;ØýÅÂÒ÷¢ã¿Š´´÷Çà Aìendstream -endobj -3592 0 obj << -/Type /Page -/Contents 3593 0 R -/Resources 3591 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3544 0 R +2675 0 obj << +/Title 2676 0 R +/A 2673 0 R +/Parent 2615 0 R +/Prev 2663 0 R >> endobj -3594 0 obj << -/D [3592 0 R /XYZ 85.039 781.388 null] +2671 0 obj << +/Title 2672 0 R +/A 2669 0 R +/Parent 2663 0 R +/Prev 2667 0 R >> endobj -3595 0 obj << -/D [3592 0 R /XYZ 85.039 758.673 null] +2667 0 obj << +/Title 2668 0 R +/A 2665 0 R +/Parent 2663 0 R +/Next 2671 0 R >> endobj -3596 0 obj << -/D [3592 0 R /XYZ 263.137 764.647 null] +2663 0 obj << +/Title 2664 0 R +/A 2661 0 R +/Parent 2615 0 R +/Prev 2647 0 R +/Next 2675 0 R +/First 2667 0 R +/Last 2671 0 R +/Count -2 >> endobj -3591 0 obj << -/Font << /F62 1689 0 R /F56 1642 0 R /F15 1628 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +2659 0 obj << +/Title 2660 0 R +/A 2657 0 R +/Parent 2651 0 R +/Prev 2655 0 R >> endobj -3599 0 obj << -/Length 698 -/Filter /FlateDecode ->> -stream -xÚ¥UKs›0¾ó+8â™ Hˆ‡èÍy6™úQ›L;“æ #ÅÑ”W®ëþú‚%0vHgÚ‡ÝÕ®v÷ûVÈ„õ‡LâˆC3 `BÌ85 ¹®=·ÒÐtô½Æuç7¾c"BšÑó>$bÖåÇñ<º^ŒlŒ±…ÙA@¬ÉYw·‹ñˆ`+º›M•ûf1rkVû&jald¹Ê˜×ëW—îZÑL­-Ç“‹±Õ¢xŠîë¨×¥í×ÇM›¯Æã4YäÞ€‡ÄÜÖ:( ÍÔp= <k;1–Æç.‹ò¹¦Ú5@†Ž_+âv¬`o€•i^ñ‘í9ž5[*™ˆTTRéy¦¤¿tTþ¬dFS½ò zð“È6?•I”ˆ_h)kjX0QqL5½‡ªpäªÈM¡d•+éxn/Å~»]€}÷hÿ˜1v®ã o¡¤4~—oj{jkQ$‚³b²;n€å)xÊÓ/åiÖñuÚ7ò‡ÛÐÿÔúm™o -ù.i9-š±v\Õ¦äï¥íoŸO©B¾v¶OvgšYИËÓÂyËVÁK‡JÞŸpÇíºÁN;ç“ú$¦í†ªÚD¬KZ‰k”çÉ»t]õ&y™gU™'‡jÝ\V»„w5±ÍËüY$\ž©ÐyžˆXtæ8®Ë£ü­kÉãM)ªÝñ!øGKš®èM(¯t‰²ˆãúg­-ÓUA¥Ü2mlÅ™h½…F2ò‹ÈX¾•º@ÇKŸ½ÙNoB3ºæe³üqâé1|ýõaùö&ìI ê&lª—€ˆÃ×uÊ·ºØx¢”¿+·ç¬©wJ@ÅV’¦ÚH-Vº“¯Im¶Ýõßi; € RK¹ÃÍßÿ½å¸ÛÍ¢}¨ÑÐCí à´Qäï_EØoð77Ëxendstream -endobj -3598 0 obj << -/Type /Page -/Contents 3599 0 R -/Resources 3597 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3601 0 R +2655 0 obj << +/Title 2656 0 R +/A 2653 0 R +/Parent 2651 0 R +/Next 2659 0 R >> endobj -3600 0 obj << -/D [3598 0 R /XYZ 85.039 781.388 null] +2651 0 obj << +/Title 2652 0 R +/A 2649 0 R +/Parent 2647 0 R +/First 2655 0 R +/Last 2659 0 R +/Count -2 >> endobj -3597 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R >> -/ProcSet [ /PDF /Text ] +2647 0 obj << +/Title 2648 0 R +/A 2645 0 R +/Parent 2615 0 R +/Prev 2643 0 R +/Next 2663 0 R +/First 2651 0 R +/Last 2651 0 R +/Count -1 >> endobj -3604 0 obj << -/Length 2614 -/Filter /FlateDecode ->> -stream -xÚµYëoÛFÿî¿BÀ}0Dô’»|õ>õì&qÑ6>ØFƒ¦Áa%R>T’Š«ÿþæŇ,Ù9Ü][ îÎîÎÎã73ko¦ào®ÒÉ,Š=WÇñlU^¨ÙfÞ]xÂaíÆ}frÑÏ.BßU&:ÇãG®éÙÂ7n¢ˆãWo}5ó•†zö°&·ô“£}w¾åÜ͵çÔøOÓÍžc—ùÜs -ü§›kåæŸ~¼øáa”¤?ƸÊ{U8#RÉ ‡Ì<’%S9îm9÷cgiç°¯vžð£n¾Àé-Ž§®ð×wz†<…¹Œç mµÉxª^óïå·Ý~ꦔm–ðµïx«n++ò -ë²yí -¯/3¶(žñî -äéÖ5Z"k+8PÏýÈù -Džf¨0¸ÝÂCƒ%tËxµŠªî˜°¸Û.²(ÂAæI„ºÜÙõ¿,20’Ñ¡ó°ÍY#Z%À˶(ÍD—…5_Å•ÆcE,Hæ -·ôœUþ»òÌŠ7 up¹ŽF•k¢-̱'_8½Õª&=à1yAl`¡6` S¤µ³o§3-š;"kX÷eÏ -Ü N^s-/pcÏ›º¸g\mÂg.î¡“›ÄyrÞÁ¡_:T}#¢tà¿îÉïï.YõFNÞ; Ù€Ô]fb"V°Ñì±µ²G¶]‘•ÄÉ|¨¢æÀ ›†Œ°kù3oß$NÖQÕ¨äE‹Ë;V¿mR>åw(ö^½eßÉWà‡§vm2KÕâKná ÚŒâ¼1k@PcÀEz¢ÃMÉ¡kØPXÀÅà+tÐÓŠŒöB‰£À¹ÊºÕÞK8l•2ÈwUP\µAmV½þ&U“qÀ˜Øiñ6¤ãémºLiIk¾qoo„êxg$I×{²ùåxF¦ÅýÁ@OЀMag‰0c|Í!•w½"Z´)’fAÉi{º#Ä+íççº=wí휕hP0BZæUËôÓ¶f!´ªÙ*4@H†DSO@@–µºª<¯¾0è\ƒX 5/ûÈÇvÚäÕÄâ:$¯Û¢žÊÏX§h?qÒš@&k«ËŽG†@_¨b"VDE[ãmq¬ãÅ5±VHÔÑ£§ ‹m„?F·ý–ÃÞhÄ\ãkŽ~Â.:ƘÍ1K H¸+{Ï@?Æx±^¡úCÃA²nelr~HûKË„ -NÛô¿ƒq -T½È)F - §‡–—>mm'‹;ž…lÑB¢jä8²hhFïÇUöìe(\¾ÎˆW*0fϹ½!RpV¾B–-—™%Ç Ð1º¶ÏÝ&ðÇëÃ\Cˆµ‘¯OÊu!VŸµoׄál”ŸÆ\|ú¬f)ÀöÊÕI<{Z¹^’ÌÊ Í¸N_ÅÅýÅ?‡­pÆgÄÏþþãç9Ãõ$˜äÙ) -yÇÿE(ýÅŠÎE­è‘·d©…6­âh -~„,Ðâ³F;¡‚ÿ˜\íÑ¿IKÅG)ùƒû¿¿[<~ty Ê–©Ý)«bŸö´LR…á3=”xfhóé€Q÷íÞ|ÔeU³ëq4§XzyÆûÞ€SÑÐ+f:y»f•ØáI§žV }ɇ (¨åŒÀ¦^ýµÊ7œÊí\˜1g»ïC“ö ø" ß55¡¡í Åá,f…ðšl°¶9oŸaj6è™[9Eê yáÀøÑðm -plßNsŽpEê1À+)èÀ³¤üO¸žšƒ-󿣬ŠSÓÇo6µR1-%2a{–Š„R¾¿hSñ;¨aø×8)gn_Jåý}ŬRtÒeôX$àÒ÷wåä, º!ÁâG†E½‘+‹ˆ£”Wsr®‰Eɢᕭª~ÑQ3’ñØý«Ý†ŽŒ@>ñ@r­ƒÿC»áK»qý#ç±Êÿüïýz.@ÄÓJ^¢‡ö¾â +¿u‘2ñU l@ÐUÝ3Én,;$;QÈÕ™£JÛ#…b¥39‹j,…Y½c"/¹ì¬›n´&0>àªktŒ«[nÓN‘bql|Ñ«üjoiiü ÍXÛÛš¹8ÔÒ•4\râÀªnšlÕ‡3$>sÙ³ÍÉ·kz*À=¤JA„àÚÒ‚ŸèQ~ìKŽ… wV­ê=W›=Œ Ç%^‘sõ}J·µ£d»¦r­‡'¶Ýkõy<ÍÆ—º >$Pÿ?±läT‰œÊÓ€…Îøâ:­äãÓÒãè©çEÜx‹÷â>\%3~LÖCI—Lõ‡ÓKÄ¿Óéô–v_t¼"Í0ꪬíwϘ(ù=–Wiä—'-aºßÆ•šø/o¾~€ÆdÎ嶃°l¤ZÄBB+?JÜ0ÖGú$›*ûuQî–ßØ ‘Òר`x‘OË¥?½–©¾åPgš¦÷ÅQ -ŸE^æT%ãØäýS :®ïŽ‹«;T_ÛFç3OÃ}l!° -î'5x·åœ%ØÚvü‚¢û‡~Òzú_M¾ÙR&}9³áÐO> endobj -3605 0 obj << -/D [3603 0 R /XYZ 85.039 781.388 null] +2639 0 obj << +/Title 2640 0 R +/A 2637 0 R +/Parent 2615 0 R +/Prev 2619 0 R +/Next 2643 0 R >> endobj -1410 0 obj << -/D [3603 0 R /XYZ 85.039 761.463 null] +2635 0 obj << +/Title 2636 0 R +/A 2633 0 R +/Parent 2627 0 R +/Prev 2631 0 R >> endobj -3606 0 obj << -/D [3603 0 R /XYZ 85.039 667.239 null] +2631 0 obj << +/Title 2632 0 R +/A 2629 0 R +/Parent 2627 0 R +/Next 2635 0 R >> endobj -1414 0 obj << -/D [3603 0 R /XYZ 85.039 612.119 null] +2627 0 obj << +/Title 2628 0 R +/A 2625 0 R +/Parent 2619 0 R +/Prev 2623 0 R +/First 2631 0 R +/Last 2635 0 R +/Count -2 >> endobj -3607 0 obj << -/D [3603 0 R /XYZ 85.039 585.505 null] +2623 0 obj << +/Title 2624 0 R +/A 2621 0 R +/Parent 2619 0 R +/Next 2627 0 R >> endobj -1418 0 obj << -/D [3603 0 R /XYZ 85.039 377.326 null] +2619 0 obj << +/Title 2620 0 R +/A 2617 0 R +/Parent 2615 0 R +/Next 2639 0 R +/First 2623 0 R +/Last 2627 0 R +/Count -2 >> endobj -3608 0 obj << -/D [3603 0 R /XYZ 85.039 350.712 null] +2615 0 obj << +/Title 2616 0 R +/A 2613 0 R +/Parent 2611 0 R +/Next 2679 0 R +/First 2619 0 R +/Last 2675 0 R +/Count -6 >> endobj -1422 0 obj << -/D [3603 0 R /XYZ 85.039 263.87 null] +2611 0 obj << +/Title 2612 0 R +/A 2609 0 R +/Parent 6735 0 R +/Prev 2535 0 R +/First 2615 0 R +/Last 2843 0 R +/Count -6 >> endobj -3609 0 obj << -/D [3603 0 R /XYZ 85.039 237.861 null] +2607 0 obj << +/Title 2608 0 R +/A 2605 0 R +/Parent 2583 0 R +/Prev 2603 0 R >> endobj -3602 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +2603 0 obj << +/Title 2604 0 R +/A 2601 0 R +/Parent 2583 0 R +/Prev 2599 0 R +/Next 2607 0 R >> endobj -3612 0 obj << -/Length 1134 -/Filter /FlateDecode ->> -stream -xÚµWmoÓHþž_a>l¤z»¯~AºôZŽ R Í ´±ÆW;¶Ç¿¿Ù;qáîÐ)’=»;;ûÌÌ3ã õü¨ILxì…Å<Š¼¤œïVþ˜Q§A%á¾+ªxI!蓳ý`°:…C6bO§âöïéD~NN÷?óIþÿtrëÿœOjÝ¡€5Õ–:ImFJÏçÛ»b©œ¡j/úaæ…!l(²ÆŽ¿éµjßïvUM£g圅he6XývÓÁ(í„æ¹ÑÍAÆŒzÊ ªJŸ Í°£´ÞÙLDf¨w7Ô;ˆÕAÊ5:ÕZdͦÒàŠÔº´«aP™¨¤z>1ŽÂ6 -Ïq%Q¡;¨<(Êjª(%¦uŠj›Nc3ʶî°ô p$¢cGML‚a´Í²ÔJm¥ß!R)èws›¬é}QkÃbDgUËW‹s­t 3/í¾"ßfVÊ·½%«|Z× ­ÿÖ®4[Òæ•S­Ö£-ºU=·”--çòÐÍ—êÞp×´ÉÎcà‚½ÓßT“aWWÀy˜÷ˆ9úÚ1´(©^XNT÷vØT¥ Ž‰E_WE~ß‘mèS­–¸’eËÚälS5m·eªñ¯+]è…!«©ÚÉJƒDш±8Žáêl>Ã*?j9YTÕn¥’{;:ÑÇnU™à“´*U¾5ƒ‡RáÃ]9Ž‚éÿì¯]×¹v wü‡ie4>Ä _{;üVd ¡endstream -endobj -3611 0 obj << -/Type /Page -/Contents 3612 0 R -/Resources 3610 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3601 0 R +2599 0 obj << +/Title 2600 0 R +/A 2597 0 R +/Parent 2583 0 R +/Prev 2595 0 R +/Next 2603 0 R >> endobj -3613 0 obj << -/D [3611 0 R /XYZ 85.039 781.388 null] +2595 0 obj << +/Title 2596 0 R +/A 2593 0 R +/Parent 2583 0 R +/Prev 2591 0 R +/Next 2599 0 R >> endobj -1426 0 obj << -/D [3611 0 R /XYZ 85.039 153.561 null] +2591 0 obj << +/Title 2592 0 R +/A 2589 0 R +/Parent 2583 0 R +/Prev 2587 0 R +/Next 2595 0 R >> endobj -3614 0 obj << -/D [3611 0 R /XYZ 85.039 124.826 null] +2587 0 obj << +/Title 2588 0 R +/A 2585 0 R +/Parent 2583 0 R +/Next 2591 0 R >> endobj -3610 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F56 1642 0 R /F20 1617 0 R >> -/ProcSet [ /PDF /Text ] +2583 0 obj << +/Title 2584 0 R +/A 2581 0 R +/Parent 2535 0 R +/Prev 2559 0 R +/First 2587 0 R +/Last 2607 0 R +/Count -6 >> endobj -3617 0 obj << -/Length 2003 -/Filter /FlateDecode ->> -stream -xÚ½XYoÛF~ׯÐ#„Ì<–}s®ÖiÒ¦¶Š´Hó@Y”D˜‡BRVüï;ÇòÐa¥EЀ¹Çìî73ßÌÎJNüÉ© <¡ãid¤§™Þ1]ÃÌi%ÄÔ÷DàÔ‹ùäù›PM¥ðbOç+™/?9/ºú0}3sµÖŽVÞÌ"ã|˜Iç×›™ÑÎÿ]½¸~w=ÿsöyþvòz>:Àõ=?Ôx—ɧÏbºo'ÂÓ±™î¡-<ÇÓbâÚ |mûùävò[¿ ÏùS^uF×—§½«…gŒß+$ƒ3 -Í7YÚÄs7s¥“ì@•[) ‡ÎmRÌ”q KµsøÂpµåî–%w39÷uJ mÞÚÕp‹bI‹ÖŸºVaW¢ÑbÒx¬øŽÎÊò†{¾txUä®Ì@†ÍÓ¦ãùÆë”Ú-jöÈ“û 0ðvä(vö¸WU£Ü’g“’š§NW°õ -: ¥ !¬j—tÚupÐ0¸\H§d ÒYWm–´‘PÎ~ÃÞ@!²|ÙSÐ(²0xûÂYÔBÚ39X&Ï:¶´<@æËî@»”õ„Æ~srڬߌÕnÚñÊEM"ûÆŽKÇ#µÇž 86«´o³ÄI<Î[qVå37"çUš§¬Ëô  MLCôí#&蘉GkdçØ%Ï !cw8wÏ»½OÖ"²ÒÞ´IÝfè®õ“ì•*òü=†*#ž@8·é—]Z¶ˆ -]›`l„¡s“&è…0bÀì>×UžVþE\¾—“竬IìÂõ ò®tn;êÙu-`øÆcWëÀ¹nynâ¥<ÐÖ¶*Öçc÷Âì3LϺ·sälÑ÷Œ³7”eå™-×IVZ s.±Ç˜zÛ¦äR´ÆkÒŒmÀeÔ*!ž·ÐAÆ@Xz Ç©XÄÆA%{}5lOÓÑ]W²×5óŸO vËÄáÙ Ø~Èšl‘wý*R"ýŠ©ÑR%›aâyè\ü¶ôžÁå]–gÜÜ+¤}f_ؘZ¢‚»œ‡ˆ1ðå”ÇJ0#bÂP³&½½hÇÜR`´ÖÐxùá÷gÜâ¹½g³à£³IÛ†ÎÕ}•ÀpµŽyÍ©šƒ è½:h­}½ë)]tÈŠÅN²¸+Cã L]x=«8ø?Ó9C:Šæî à«^êðyG9Å0[žò3&]òÈ6i9"‰” )ßÑ ‘Ò¸}Òà\ùà)PØ1ôõù%ƒÒ±Ç$£¨CÙ-=:)ª7,‘b7](ñð&±}$¦l\ð=nsÁSï€CÕÐF=[Ú $NÚ?ŒÔ]zèŸu^Z+6 -M¸AO8ØGŠ@ ìäá^Ћ™@WÆÜí©?^—hGJ„ ”Ö®ðÏ°ûjÕŽš¾e‰¬„çTžóe‡‘‡Š‚Öµ,šÙ><)+ÊE_-Ñä´]Åßšo檴åòzW@ˆ3$ÕÄ.³‰éœs»J#9õ¢•˜s¶º·Ö¥k Lö–ãĺø}¯lÎ/„ŒU=2{rñWŸ‡ñ¯àdíOÝØx¡QKVéþ³ZZÙZú#Ý‹¬´7"|!j¨ÖÂbšHO¼ø_•ÿ}¥-¼ .'_¢*b§lì>ûtI÷Vp~¨ºŸí@Φ‹M¶Ig:¨–”_í…qî6´¿50 îJˆö{š*¤„ò9tEÀݾ¸Î!ÅŨ¶uH½§8ÞF ¡Ó®ýÙÊ\]幋ÆÜZ`ÝχAµP:Ü çŸ[ Î?­9¾ï§YyÒô¦½È6¥Ä1Pz:ô‰ü7£‰Rìendstream -endobj -3616 0 obj << -/Type /Page -/Contents 3617 0 R -/Resources 3615 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3601 0 R +2579 0 obj << +/Title 2580 0 R +/A 2577 0 R +/Parent 2559 0 R +/Prev 2575 0 R >> endobj -3618 0 obj << -/D [3616 0 R /XYZ 85.039 781.388 null] +2575 0 obj << +/Title 2576 0 R +/A 2573 0 R +/Parent 2559 0 R +/Prev 2571 0 R +/Next 2579 0 R >> endobj -1430 0 obj << -/D [3616 0 R /XYZ 85.039 679.868 null] +2571 0 obj << +/Title 2572 0 R +/A 2569 0 R +/Parent 2559 0 R +/Prev 2567 0 R +/Next 2575 0 R >> endobj -3619 0 obj << -/D [3616 0 R /XYZ 85.039 651.132 null] +2567 0 obj << +/Title 2568 0 R +/A 2565 0 R +/Parent 2559 0 R +/Prev 2563 0 R +/Next 2571 0 R >> endobj -1434 0 obj << -/D [3616 0 R /XYZ 85.039 651.132 null] +2563 0 obj << +/Title 2564 0 R +/A 2561 0 R +/Parent 2559 0 R +/Next 2567 0 R >> endobj -3620 0 obj << -/D [3616 0 R /XYZ 85.039 627.814 null] +2559 0 obj << +/Title 2560 0 R +/A 2557 0 R +/Parent 2535 0 R +/Prev 2539 0 R +/Next 2583 0 R +/First 2563 0 R +/Last 2579 0 R +/Count -5 >> endobj -1438 0 obj << -/D [3616 0 R /XYZ 85.039 584.48 null] +2555 0 obj << +/Title 2556 0 R +/A 2553 0 R +/Parent 2539 0 R +/Prev 2551 0 R >> endobj -3621 0 obj << -/D [3616 0 R /XYZ 85.039 557.865 null] +2551 0 obj << +/Title 2552 0 R +/A 2549 0 R +/Parent 2539 0 R +/Prev 2547 0 R +/Next 2555 0 R >> endobj -1442 0 obj << -/D [3616 0 R /XYZ 85.039 557.865 null] +2547 0 obj << +/Title 2548 0 R +/A 2545 0 R +/Parent 2539 0 R +/Prev 2543 0 R +/Next 2551 0 R >> endobj -3622 0 obj << -/D [3616 0 R /XYZ 85.039 534.548 null] +2543 0 obj << +/Title 2544 0 R +/A 2541 0 R +/Parent 2539 0 R +/Next 2547 0 R >> endobj -1446 0 obj << -/D [3616 0 R /XYZ 85.039 343.346 null] +2539 0 obj << +/Title 2540 0 R +/A 2537 0 R +/Parent 2535 0 R +/Next 2559 0 R +/First 2543 0 R +/Last 2555 0 R +/Count -4 >> endobj -2945 0 obj << -/D [3616 0 R /XYZ 85.039 324.475 null] +2535 0 obj << +/Title 2536 0 R +/A 2533 0 R +/Parent 6735 0 R +/Prev 2419 0 R +/Next 2611 0 R +/First 2539 0 R +/Last 2583 0 R +/Count -3 >> endobj -3615 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R >> -/ProcSet [ /PDF /Text ] +2531 0 obj << +/Title 2532 0 R +/A 2529 0 R +/Parent 2491 0 R +/Prev 2527 0 R >> endobj -3625 0 obj << -/Length 3010 -/Filter /FlateDecode ->> -stream -xÚÍÙrÛFòÝ_¡Ò‹À*ƒ+/)Yke™µe•¥DÙÚl¥†$$"ÆÁ`d½ì·o_€—lç)¥*a¦g¦§§ïnªþÔIº^žÄ‰rƒ$9Y”¯¼“GXùá•’: ÜPkXœÚÕi仞Žíñc׃“©¯ÝÔ£oî^_ùÞ‰ï¹QœÜ=Ðλåœ p'Ó0ôœ[SN”37“iÅŽ©–<¨»UÖððr®&SåÜ" rE¬êÖNþ{÷ã«·w¥B†÷‰A䦾êITá‰ò€ètLâÝ*oá p?vVf ·vDU E]MüÄé ÒRµ,òŒÁÓ‰[O€'[à8ÿÕSö.xk^Áø¡nJÓå5ŽÝc™ªÄ #õÒsTè&Ês\i7ÐÑÇò\§Î{³ ª‘¬®na¸bVïpV9ßÿ%î‚¡ÿ2wÿ=I'#.í½Ï{ýieéã/J y¿i&H< žOüÔyÞŤn pð/¿¦ªñš'Ö•ÁÉŸø/cÉ^¸D -fWV[ (`žg8ª¸ŽœóŽ[d>®5Œ¯õ3E‘-wŸ¡Råj?üv.ýq_L”RÎÏo÷˜–êEG|€'n¢SÐ7ôé—Ì'{õ#°™¶ãQNßÐ1&¯,ðYv¯œíì©ep¾FëQÎ=éê’™.‹×wü5h9K·àIàü †!ˆ³áñ¢.×`j¸š@ {fbò–”ec™ß’>Â#ùIö±ø¦ ²íÉTƒTÀAÉ /i¤ú¿¾óÔäýOÐa²ÃrÞƒ´š–QÁ)b'z8‚+×saŠök¬àžPAüë¡Š‡ö@KÓñëÊœ\&Hiü2Ñbdi^˜yÁÛƒ8!éËŸ‡ÆòIÖEpd¨Õ ãµA/Ǽ¹.y#1 b¦°Ô´sŸèõsž´y'ÛõB¯[ =+"—!÷ñ‹~–Ô‚ìä~ëuoy‡Þ¿2âëáz¤BL@¾óØÐÌtÈ•gÞ–ÙÇ®LµÈ–¯ÊáK¤ÌzòÍãTÂÀg!…àyµ(6KËXÀ£ëáX CÖÂ¢Þ úl£ -µ3ÅOˆ*B—†öv€u,%øW3í£Éd5/×EVZ×”Ð(6 bb/|/ÖÈÉ‚6Þ¡7È–O¼ø€æ†ƒ–ÖEŸa?QÐ[¶Gí‹îÐóÓõìi§4|«Þ:‘Õ:VÃÞý›X’ÈEUë@Ið¬Yävc]Ù4Õ1±­µº §ð¥MMBÙ,º–À#÷A¦ÏÄÔ £ìêúÕl8àIJ -Šü RO¨GBÿ̽aÁz6<°n8\³óyñØ–ZÏ|¾«yã>c©Û/mLôptX^à<ål¨jþš%r —dØ·ÿÆv³f³¬òg (×›¼ôš€ìÔR±oQ†^.RÖË¥Ûz‹€RZÕ%;TH–­deBgËÛÐv –E'ÓTÃWk½ÎàS|ÚE«•ëC&¶?cyÍ–¤¡›Fñ¶C®ö">83Hâ¿…æË‹›½L+pu~-¹ ÈËœû)N4å,[5¨x@q gï1ò|äÕv°hß <ûª·ùŒ­Ñ$àk(…ÈÚñeŒð‘ºÃ”ªE»B(þ€Ø­!½ŒÇµ¬ÑEú‰g³rž ¢úñ.!¸²f¯ô‰âåcf©öS®g€Æ¹‘yŸ¡À±w½o>3jŒmäÉpR5 A?8åLVQ †eÙL“ç¶cµo1^ð%­ç]å‘WCŽî¥/©NpHò«®[w~þôôäf¦k]Ȧ΋¼Ú|þ ôoOy宺²ØÓ.C>}¬¢ô5׉Xß$P¾\ß„^úÅúÆ—úæ‹>W‹—RÓP±óMåŒG1*ñ^&-pSl‘¦Ük—4Îß°æýg= <ŠXs™Š ɼ®0@®«*[tR7ÓŠ$6ðÁ*9( B5c¥ìëï‘[O¡ÊGê\³TrÃ/WHõNéÑ÷Ç XFöRÅè¹a¾\P\€~û¾5V?À”~ðþMÕ>õ9QÃGÐ!Ðí ‹zÜøÇðS° â4ÁT¼}Î9&o§ZbcVáÈ®ºGO¡"£|, ƒ‘-LSîS^Yˆª³áÜÜ­Pçÿãô+Û+=·•9§§›1¹Œõ€Uj(ÿë>;MˆQIœlŨ7ì’r,PŸÑÃJ<¤C0©†$=@pÂI”rÈäë>ÁãÞ~·§M¡Aác¸t½PR'¹A¤Gõ»V^æïb]qT¸~©'@É -¾êŠ -L›øÛ$øpÓPk“8lôÝ"žc08›½A&¼—3Ø#`Q7gä♘ﻡ -ÿf<¹¼9ŸÝŒßÖl½Ì…@NX!NÞ»¯xtô7U„SHßÌ>Hó§w‰ØCT8¤œS>ƒéQ“o5ˆq°ïÍÛŸf=7À -ùS#£¦›gU iÁL>R.¹q€¥Ï¯:Y§Õ¨Y[i,@5À=Â-œsÃy™‡µµxJÎâ ûFÑ>òj‹Y -.•|Ž|-| A÷mªO<m>V$RW6»ø¼Fghò -s¢ LкèËØrNÉP p)Îljc -ŒÅ¾çÌxq{+·ƒ)úòÅ,¥üÓ!4pfÁ—û¹i¨õ'¬Øa:rˆ°Ñ¶÷ (öÞÖ%h¥(ráW ÐNÊwF&ÔK³ùduwoUe\àÜí²•.á\Éàô6ãಚ Ÿ)°5_¸ž¤:~!'Úõ çwîˆw¶ùaCƒµ¬)žEUåy%/ÝÏ…7¬O‘S,³f¿cbw\½Z­LÃ^Éq|*osMõØ\Þ³eª0ß5ÕT³bÂÞRwÃ6N2Ö:ò‘ò,ådÅß1Q%+†:©¶áA“ø}3²í M¸^ඕmZqIÓ70³ÙaO^Ù‹SgY} Û=TWƒñDÚ#qt¦‘Kß#{înÝ·ðùåík.ú®·”L­…Œÿb•Ä{E.å%lßBN/9;F9r‚¬}çÝÅÍ­fÒò·ðiŸ¯„ïéaµ‚äšòc€_#Ùw¸$j°xþg\øÈZ¿ÄwžÏpx3Ü› þ³juõôý‹º 11Cà!¡´‰)æâĬŠ’ÿ°>¹b÷®AM—¼Ÿj_øž]nšf”RñO X‘ü¸Â@B­DÏ„4ÿÞ:#±#“^OXhq Lf¹Â†m¡…"³åAbÞ•íþJ×`§¶‹:dMyµh2Ó÷ä"nã¡¡Æ2Œ<ÆKO§ö78& ¾bï—™>ÿ—ðM¢þ80â¨Á0¡#¯—ƒŽÔPêóÒ¨'‡Ë ÝR˜ã:^ŒÇ¬{@õÂà+]*„‹‚[Ž 4}ÂlMq^e:ðÔB -èËÂI¿SÚ>öŠý;Ú+z{Ì•T¦¤ÆŠÉâ ¿eíŽÖî ~-G^D°™ÇÍðkI<ʺyœ^›²o]Âü]Þ»üSÔ.SŒAüû?¦>ˆWCÒøs?»¾íî¯?`…”Sõ陟¤NOŠ=fEyÆëhÜ~’8½ïÀ 7n`ðWxî’·wYS’©ÔEýø̽ü©#¼Â†9ý$•PÊpÊ3,ã­qa5xz!ã¤4ü[Éþ{ Ä"1iû+å3*ù)-nú<{Iæ1˜Û÷°Ê÷<º™ô?‡4g bIμ±yÎÈ.ùYÜecÀH"ÄbœÙÀãBèjyIXÂÔá‚v÷Êm6¶gE?ƾµ±Þ¦y@°‰LüŠa¿C¿825û¿¿‡8a£J¹±·Õ¿Øëcàoôé—jßWû Xí¦»‡ýþyô;endstream -endobj -3624 0 obj << -/Type /Page -/Contents 3625 0 R -/Resources 3623 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3601 0 R -/Annots [ 3629 0 R 3630 0 R 3631 0 R 3632 0 R 3633 0 R 3636 0 R ] +2527 0 obj << +/Title 2528 0 R +/A 2525 0 R +/Parent 2491 0 R +/Prev 2523 0 R +/Next 2531 0 R >> endobj -3629 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [135.619 595.065 177.399 607.966] -/Subtype/Link/A<> +2523 0 obj << +/Title 2524 0 R +/A 2521 0 R +/Parent 2491 0 R +/Prev 2519 0 R +/Next 2527 0 R >> endobj -3630 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [370.468 595.065 403.066 607.966] -/Subtype/Link/A<> +2519 0 obj << +/Title 2520 0 R +/A 2517 0 R +/Parent 2491 0 R +/Prev 2515 0 R +/Next 2523 0 R >> endobj -3631 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [466.071 487.277 509.276 498.967] -/Subtype/Link/A<> +2515 0 obj << +/Title 2516 0 R +/A 2513 0 R +/Parent 2491 0 R +/Prev 2511 0 R +/Next 2519 0 R >> endobj -3632 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [132.201 473.728 157.678 485.418] -/Subtype/Link/A<> +2511 0 obj << +/Title 2512 0 R +/A 2509 0 R +/Parent 2491 0 R +/Prev 2507 0 R +/Next 2515 0 R >> endobj -3633 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [111.316 446.327 330.942 458.319] -/Subtype/Link/A<> +2507 0 obj << +/Title 2508 0 R +/A 2505 0 R +/Parent 2491 0 R +/Prev 2503 0 R +/Next 2511 0 R >> endobj -3636 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [377.921 352.358 620.096 365.26] -/Subtype/Link/A<> +2503 0 obj << +/Title 2504 0 R +/A 2501 0 R +/Parent 2491 0 R +/Prev 2499 0 R +/Next 2507 0 R >> endobj -3626 0 obj << -/D [3624 0 R /XYZ 85.039 781.388 null] +2499 0 obj << +/Title 2500 0 R +/A 2497 0 R +/Parent 2491 0 R +/Prev 2495 0 R +/Next 2503 0 R >> endobj -1450 0 obj << -/D [3624 0 R /XYZ 85.039 761.463 null] +2495 0 obj << +/Title 2496 0 R +/A 2493 0 R +/Parent 2491 0 R +/Next 2499 0 R >> endobj -3627 0 obj << -/D [3624 0 R /XYZ 85.039 671.062 null] +2491 0 obj << +/Title 2492 0 R +/A 2489 0 R +/Parent 2487 0 R +/First 2495 0 R +/Last 2531 0 R +/Count -10 >> endobj -1454 0 obj << -/D [3624 0 R /XYZ 85.039 638.952 null] +2487 0 obj << +/Title 2488 0 R +/A 2485 0 R +/Parent 2419 0 R +/Prev 2439 0 R +/First 2491 0 R +/Last 2491 0 R +/Count -1 >> endobj -3628 0 obj << -/D [3624 0 R /XYZ 85.039 612.337 null] +2483 0 obj << +/Title 2484 0 R +/A 2481 0 R +/Parent 2475 0 R +/Prev 2479 0 R >> endobj -1458 0 obj << -/D [3624 0 R /XYZ 85.039 430.884 null] +2479 0 obj << +/Title 2480 0 R +/A 2477 0 R +/Parent 2475 0 R +/Next 2483 0 R >> endobj -3634 0 obj << -/D [3624 0 R /XYZ 85.039 404.572 null] +2475 0 obj << +/Title 2476 0 R +/A 2473 0 R +/Parent 2439 0 R +/Prev 2443 0 R +/First 2479 0 R +/Last 2483 0 R +/Count -2 >> endobj -1462 0 obj << -/D [3624 0 R /XYZ 85.039 404.572 null] +2471 0 obj << +/Title 2472 0 R +/A 2469 0 R +/Parent 2443 0 R +/Prev 2447 0 R >> endobj -3635 0 obj << -/D [3624 0 R /XYZ 85.039 369.631 null] +2467 0 obj << +/Title 2468 0 R +/A 2465 0 R +/Parent 2447 0 R +/Prev 2463 0 R >> endobj -3623 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F35 1632 0 R /F41 2104 0 R >> -/ProcSet [ /PDF /Text ] +2463 0 obj << +/Title 2464 0 R +/A 2461 0 R +/Parent 2447 0 R +/Prev 2459 0 R +/Next 2467 0 R >> endobj -3639 0 obj << -/Length 3280 -/Filter /FlateDecode ->> -stream -xÚ½Z[oÛ8~ϯú²2PÓ©ëÅ"MÛiŠ6é6ž‹™>(’ìh+KI®“—ýí{.$-ÙŽÛÁbb^ÉÃs¾óªÞ¹ ÿ¼ó8®JΣØ*ŽÏ³Õ™{¾„ž_Ï<=Â=÷…Øõr~6{Êsω›œÏ4džÿî\¾½ø8ýi2UJ9J‰É4Šbçvâ9^^`³ï\\¿âþ›ùÛ×Ðó‰›/¯ÞÜrûåû«××óÛÉ×ù»³×óÁ¦¾ðC…;øóì÷¯îy›|wæ -•Äç[(»ÂK’óÕ™(øJ׫³Û³X)ÜçŸó¬#眚S/‰ Ž‘‘‘‚ € ±*‘ÐçAK0T hA -8&ü™ë¼m&Êu¶pÔP9YZsáJ×a`Mžó‡ëùËM[pû 6ÝÎ$×¾L”ç¤ø§Åö5·*þùà \BBšžÛ.›º.²º¼çZà-ömð¹©(T=êÛS"ñc:F£—SaGyàÂbØz›®îÒ¿ïßÚÔêŠeЦtEøV›^pÄÀþ9‰•Ól&S)=Ðœ5(¥t6p„ -®÷÷TPÎ:ÚBW>”=¯EUÓ„GôÜÿþ⚧˜ ètY´\—Bf<ä²*‹z"cž"I~£GÝЙֶYí«C)äK(“"°©]ê¾O¿ž8ø¢ë_f3ÚìZ¬Ê¬mºfÑ‹¬YÍ^â9¬Ðß»Ù%–+(—–`ωÓÓ€óÃÅ5ÞúÍ­œíoRF¼Ã7›äÛzzk‚Ìeº¾UH7.=· ö}{âPxq`†ýE5Ü“âû5ìt‘¥mS‰mY›“ã‰6ß'A褢ƣÏþ]Ñá‹ NÜΪÇ®´áÀ¸ªtà…Âöt`;E˜(î:qcd~è¬tcéGNY³±¬Ò¾D7Ç^þàdÐ3‘BÖû†ûËzÊú•*ÿˆYq~Bkt}ZUè~.'‡B8›Ž@¬E–w“ÍWhýÆàØIÒw®j-‚ÈP6}w_TaBÈsr×óò., NUt˳7¾7PœAø*ÖʨyÄHQ(8Ðý7h³ò3…ZÖ|»L‹Úˆ5 ¹¼•¶ Cõ ºò£VR Eœ¨‘’À¿)®> -Ž6´ÁTî@vä V€Áë¥ö%_¶½äºœëzå½–IÚ­ 2Ä_ø¼jx^å À×ó©J„ –…[“î‹®è7kQ<Ð5;‡îºè·ßàšE÷Ø=9â{ž›þ=ƒÕó¢ŠæðqéJÙÑ:# *Äóo¸BgÑæ%#OÃ)tdÇP ÉCº¨ºæ9ªÑwòÕõ·ž'À9’ö*h¥:«6¹1Ìœ—»Ff ]×å19^Fù7X0xÓ¨ÁI²”ìžöl Z ÃÖ{ G0BF®ˆU2t²ÿ'SêPwènfŽ„\ °~Å`·2&ö÷×8£Ÿ$‚ѥÍ)Ò$˜×IC5E¤¦²¦’”v:‡t*ŽKh-y‘ó dø›ò°ŠäYt†6pÞFDª€¿Öpðò!]»êµ¤Š’k¨˜ãE/’rWfmwM¶oeSRÆx3°WOkñ»ªXÑ*hÜ@ãºU¯;ðwݲíw´ÉzÉÍUcJDÌv.;£‹+h¾ïl Ôp`s‡HéüK³)-?eÎêÕjÓåÒ´¯lT£†aù Uˆ.Ó#θ&ýg'0ÝÒL"°H¥CÓÝÚ'¤XlìðÀ» ë9‡%¡ˆ N@ª!\埌(žˆeôsÅ?Là#ÂIü½bd_=××6;'"e­åT&ºpÐL õ¶6«Is–·Å5+ô›¹sœ¸°[¦vÉ}…Xݳ•zÎÓ‘EŠ$>™¢{‘Ýðt`yS¶6à?GìLœ¬-ÈñTBrK§»' Ã"§ñxÜÊFÉD9¿ütu=õiâyžóù+¥Ð’ö\¡ÜDn)rµ(!Ÿ¶$#E³Mï¬ÀÝ…2t(%nÖˆc,CG½–k&-8´Þ!ÅÁ^<ö°ŽÛÀxÛ‚@#q®:³— vÍC¸ 0”^ì_†Éw”xCØ?ýÚ¥èjŽ½u¡È¥©ÇNANg£ºÞw×ú*/"ô%¤vòhΗ4¼bÖ(]Ç`%Ž²ìçoc°À˜ð‰£O®•Ôh%"Pjˆ’œß*”Ï5äO˲N5š X'›Ó±¬* ÂîgvµI³±©ð0-šò¢BÏØ· h¢p>š£™#”0O#.¼â8ÌR´­]™ÄKù»tDî^Ïù—0y°$ õ]Ïzz°“Éð0dÎ9€Ï©9ݵι-NžðíÁTs{ 1¾¦K#EÖÔ nMùGÛÅ›éa.¦OYì6+'–t¨#LÓ=?Û¬¹ò‚‡Ú ­Ó}†0„öDIȯ ±‰,ÃIX œn=È#K줻ñeÀ E<œ4 -¨z‘Ñæp¥C á-’¹.ŸèrÉž2I2ÌÝŠÚüõõìyÂèecßPPŽÝ¥!ðKU¥™õàõ"xqä뉒„~bW‚»k?ÞÛ54¼àá|ÕPÆw#x²™Û|&žåÅ÷2L§æ#ï2ÔTÒðF êb)~Á‡‰Äyû›¤ó>Õ¤éjW9Á{ýp”(௣ׂ¬°÷·ô™âÝë¹ 9Ø–îr‰w…IeÅQ–}¹&p1¸@þ‰hkî/„üjSÑûÓºÚ]í¡[0bã”t=0bL%`REÁRi^Xˆ#æyµ@,ˆvPíGø2ݸöj7E,| -yÒЗOÃçÆÌ>á7·) .S1Ã~ãb8戇B3d':Ð@%Íú b8iˆ&±ÕFd4™ŒÁ¥C†c!íÝôûë'ÎÍÄ| ‚Žl—7^éÖ†ì¾0¥Q$¶b½ø, ›Œ~9*zød½6£ø=¦XÈznÐâ¼ÐÐœHó§&Т¤Ñ%hÆPêevûÖÜî›–>·oÚ°á²;Ì¡F9.Ó»rµF+ƲEt(c¤354õ‘[Â=Åý!SCÒ1Rí‘77±‹Ïw±'¼À;Éø{r”!ùBùá^†DÏm€ë_Ê:çÆÐILP(cÒÉ }¼g2ËͶÛÈL¢89þY=ö ?eë¨îù®"¼“¾ÈYDy g^BR×:Íšm÷ìÐñV1¶Ve6ë3”åz¶ÅmrõŠÞ|HàƒIèíp1¸[Ìï9 %œíA`¢w?ÒYÎI±èúƒG~(Ú½G‚§"N„çúÇ1ðgß -NþÏ /þ¹o:`~ï¡PáÞ÷¢ÿ®¡˜µendstream -endobj -3638 0 obj << -/Type /Page -/Contents 3639 0 R -/Resources 3637 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3601 0 R -/Annots [ 3642 0 R 3643 0 R 3644 0 R 3646 0 R ] +2459 0 obj << +/Title 2460 0 R +/A 2457 0 R +/Parent 2447 0 R +/Prev 2455 0 R +/Next 2463 0 R >> endobj -3642 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [443.558 712.238 717.944 725.14] -/Subtype/Link/A<> +2455 0 obj << +/Title 2456 0 R +/A 2453 0 R +/Parent 2447 0 R +/Prev 2451 0 R +/Next 2459 0 R >> endobj -3643 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [129.766 698.689 348.214 711.591] -/Subtype/Link/A<> +2451 0 obj << +/Title 2452 0 R +/A 2449 0 R +/Parent 2447 0 R +/Next 2455 0 R >> endobj -3644 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [338.851 552.836 555.269 565.737] -/Subtype/Link/A<> +2447 0 obj << +/Title 2448 0 R +/A 2445 0 R +/Parent 2443 0 R +/Next 2471 0 R +/First 2451 0 R +/Last 2467 0 R +/Count -5 >> endobj -3646 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [382.155 461.982 612.784 474.884] -/Subtype/Link/A<> +2443 0 obj << +/Title 2444 0 R +/A 2441 0 R +/Parent 2439 0 R +/Next 2475 0 R +/First 2447 0 R +/Last 2471 0 R +/Count -2 >> endobj -3640 0 obj << -/D [3638 0 R /XYZ 85.039 781.388 null] +2439 0 obj << +/Title 2440 0 R +/A 2437 0 R +/Parent 2419 0 R +/Prev 2423 0 R +/Next 2487 0 R +/First 2443 0 R +/Last 2475 0 R +/Count -2 >> endobj -1466 0 obj << -/D [3638 0 R /XYZ 85.039 761.463 null] +2435 0 obj << +/Title 2436 0 R +/A 2433 0 R +/Parent 2423 0 R +/Prev 2431 0 R >> endobj -3641 0 obj << -/D [3638 0 R /XYZ 85.039 729.511 null] +2431 0 obj << +/Title 2432 0 R +/A 2429 0 R +/Parent 2423 0 R +/Prev 2427 0 R +/Next 2435 0 R >> endobj -1470 0 obj << -/D [3638 0 R /XYZ 85.039 527.745 null] +2427 0 obj << +/Title 2428 0 R +/A 2425 0 R +/Parent 2423 0 R +/Next 2431 0 R >> endobj -3645 0 obj << -/D [3638 0 R /XYZ 85.039 492.804 null] +2423 0 obj << +/Title 2424 0 R +/A 2421 0 R +/Parent 2419 0 R +/Next 2439 0 R +/First 2427 0 R +/Last 2435 0 R +/Count -3 >> endobj -1474 0 obj << -/D [3638 0 R /XYZ 85.039 407.672 null] +2419 0 obj << +/Title 2420 0 R +/A 2417 0 R +/Parent 6735 0 R +/Prev 455 0 R +/Next 2535 0 R +/First 2423 0 R +/Last 2487 0 R +/Count -3 >> endobj -3647 0 obj << -/D [3638 0 R /XYZ 85.039 385.811 null] +2415 0 obj << +/Title 2416 0 R +/A 2413 0 R +/Parent 2411 0 R >> endobj -1478 0 obj << -/D [3638 0 R /XYZ 85.039 180.551 null] +2411 0 obj << +/Title 2412 0 R +/A 2409 0 R +/Parent 455 0 R +/Prev 2399 0 R +/First 2415 0 R +/Last 2415 0 R +/Count -1 >> endobj -3648 0 obj << -/D [3638 0 R /XYZ 85.039 151.147 null] +2407 0 obj << +/Title 2408 0 R +/A 2405 0 R +/Parent 2399 0 R +/Prev 2403 0 R >> endobj -1482 0 obj << -/D [3638 0 R /XYZ 85.039 151.147 null] +2403 0 obj << +/Title 2404 0 R +/A 2401 0 R +/Parent 2399 0 R +/Next 2407 0 R >> endobj -3649 0 obj << -/D [3638 0 R /XYZ 85.039 129.954 null] +2399 0 obj << +/Title 2400 0 R +/A 2397 0 R +/Parent 455 0 R +/Prev 2375 0 R +/Next 2411 0 R +/First 2403 0 R +/Last 2407 0 R +/Count -2 >> endobj -3637 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F41 2104 0 R /F35 1632 0 R /F56 1642 0 R >> -/ProcSet [ /PDF /Text ] +2395 0 obj << +/Title 2396 0 R +/A 2393 0 R +/Parent 2375 0 R +/Prev 2391 0 R >> endobj -3652 0 obj << -/Length 3198 -/Filter /FlateDecode ->> -stream -xÚµZYoÛÆ~÷¯ò -ˆ.Ãí÷Á‘Ôm,ûFêuŠ4ŒDI¼¦H•¤¬øß͈߳Z¬h‹ÑÌ™ý,ßYh·çÀ?·¶ã'½(vm?Ž{ÓÕ…Ó[Àȇ Wf8=e;a€Cï&o߇^ÏuìÄIz“9M™Ì¾Xß.ï'ןúß÷-ß·ûƒ(Š­qßµ.oß]"YY—£+¿›üt #Ÿ˜<¼y?fúðãÍõh2îü|q=é\` lúxƒ?.¾|uz3¸äÏŽí'qo mÇv“¤·ºPoÊ—~q1¾øÙ…ÇTWxç@y¡íEÐð;Ž•y°œxð,k¦ýkÕ9¼ä[àÅVÖôaeµËŒëƪoE¶Â™fˆiËm×Ñ>²æwÇU0á;gÐBVº¡5ʶ» …>*/§ÅgÉꇛÑønø‹ ”«ß0qrýq€]â;† ;Øu„½ ¾fL ˜q¹?íøji9C€Åïpád Ë”YöùšØr %/éù(FÛK¢SÖ3à¤DÅF¾Œ¹v]ù‚ûøJøŽu•Y \öÃȲ×}ßÙÁÕ -¤„, ié¼Íj^°N›fÛ÷«Â…õŒ©ÓeZ.²ßáÙ¾§Î>#†ßóZú0‡K=,@”CÚT±¦j}jÊ?xûjÓ³ñ׳&t˜v?äßmŽÜ¡EÕ -ÅP¤9ž¨+®æá¦ÏŒ€¹e% /º 3ˆ†³2¡`&¾A#ÀÝ\kÓš |Í`]=)ìEÖ²ó 7?ŠÖìDòö 7Ò¢`ŽðM€òŒ]¸8uH.ð›•Hm„eÈ育J-‹-¡)s÷ªg„CÚòºW¼u÷ü`w(vfî÷ºÅ^h š¬K wö–¬RÔÖgîq±!`·]¦-·Œ¡ãúZßyÅÿãvâ¢j9"íì²i´²™›dÜ® -™røê>Ê>8ñòìÉxµRd2g8?@1Ó"‰ñO™mE¸†ù/rùßÝvÏzÂüA$.E§µ d|梬jmÛŠV/¢Î‘ö,rýH\–‹-H³ìˆGêõç{ŠŽ0ºÆþå¿ðÈ·ï•Ûá­:vEÂá’gìq?°U düòêöf4|þ•çúó¡À=ÙÊ õ³~™û$ýSqy`‡ Þë¬J O¾‰[çŸèHèftu‡zŸØ*ˆl×sÿäVÇܹf,ˆ³Àß(Pfrݨ¢‚%ØZ>­¤…:˱HÌxˆ~ eŸÄ'Ð~uÏv€f€ón ÍÓû°WL|Ã+ž«a\]bmPñ”Ç1¹v;8M[îµbRZœÊįâ2ÕuÍÈ«B(‡ïB·ZW,ut‚£h-De?D!úŒ-`SžñøÎVS  -!ßãô“¸ ƒÃtŠ$Ö˜ÌF8=ñ¼y%qÀF–‰7Á6Ùã’U$;*¢Ök j²éï3Ðïø`éÿÆ…>·>ÑØÁd«7uLÂè‡Ðþ9èWú àö—æ¼#¤u KÀ ÿÏ}ðW³’Çl§M‰#ÌT‘‡‹š¢ÍµL¡öšÜ¨Dm‚û© dpš Ý¡}¿ÐÍM 3YÞæ‘=⎯ñæz¾¹Â.ꩵ_?P¬_KTžï˜½”à4<8E€Pž¹¢¦òírÉ&oM¢t²RmK)`Ie™‘ö?òv’>ì!yìÛN'ª"‘â@½Ÿ>œ‘a³Âí¿ÙZ³ÍÑ…ä1N ;vc†ûCÍQvÊÿO@*[¥m.©˜3\ÝÝÇݪUÝòyÎœ=SþØhKÃwHÅÍ:ã‰`îÎB‡J…©B°Ë©Yøº¤r´r™îra>Ï(J×Ý°´’XsOfÈ{ô³-›ÆønŠHlîlèŠ\ïr)§ }:ï1<%X=«©V·êŒU–" XDIbèvEÆ(lÜ,e­€ã&繬5Þø¡ÝyÁ1sÞðßL>2…ñ^j`$ê„3¾ä„¨È¢ŽXvÒö9Á&´H¬æ¹á,vÕp¾;P•Ê$±Œ9JÓÈŒ*®vÁ\>åyº"püìo›ÓƮ͂¢øïŠ>B±õñš 6ˤú‰ ¹Z›<³zÊV&LmÿÑ°cTq Îå šŒÉÏÏÚé9W«u!„óò8ͬ6¥Žê)ÇÐ^]²ìL»2ªø‰Lç åÓ€xWSìÓA4¾ÜŽu}ˆ±ÿ×Rå#§ä -¬c:Ο#€0þÍì‚ô[ûftÃ#‚1M ʵ4jžcê*J\þúNäqKDÞ"e*êe.kòA÷ÃsW:)‰)ïü²]Ñ ƒðÇRo"¹í’-—*›‡e"Ʊ[,ŸETHKîÐáß%Ž¬ó¬œbB…æ“jðÄ«LÀ𞤆k$/Á¦å`á ¨X‰ rð.|ó A°–¾à}ŽIÙ¸M]#{±äÆ5zTJ=«HëEÆͧ~µÐàäùTàpCHCx §´FŠñ t -Þˆ Yºk—uÀEø»ZëT 694¾léùàùÈþÑöÄX<|  és»$Õ_0q¯°{¬¬x>p¬)öëÞQh -óÒ±c/+)™¨WÕ¦ÈׄyÖ]™ñŒnjÑ\kmáûÈFoNoR*WðÐä%ÖkîPª¡…œÈ<Ói«“Oš‡S­æ™ÔuizÛ)³jw¤HOkô-¼˜Øä+SîŽÝÄ#¡Ò]Ÿ¬ÊCób<ÂS´y©sµÊÂÄó±þÞžËP¶¯Â—A¹ªJg•ùÊ&áàë$xû®—Ä/^x‡çîáA@†?ÈK—»‚ÉÀ"ÈÖåkF #pÜå¬@KüM¬;,Ý2 ¡ö“ÇmÆqhÌ+*A3z™ 6¬J³´¥Jì•êœÚ&™rÌ q0ˆT 6ØRÍôX£Æ¬ÂQ¦|':t¦ózŸÓg¨& ÷E¶Ë-`Æènr-_›°£v!lœš -w€~ðÁIRž‡­RpA>2Õ1Ó-¹;ò5`Ú¹°µÙÁâþ»5C)XÞ}KS”øìC”¯º¼ÐF–— Ö`³—?ðH™Z9°¡nxt9A9g „r•†éÆ—¼Jsvß<Ù²ã$ÖªeŽ#H6ŸI¡Š¬ß(àÞÜ­ÎæYm¦Ò\¯ã+œp.â> endobj -3657 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [394.325 421.418 452.136 434.32] -/Subtype/Link/A<> +2387 0 obj << +/Title 2388 0 R +/A 2385 0 R +/Parent 2375 0 R +/Prev 2383 0 R +/Next 2391 0 R >> endobj -3653 0 obj << -/D [3651 0 R /XYZ 85.039 781.388 null] +2383 0 obj << +/Title 2384 0 R +/A 2381 0 R +/Parent 2375 0 R +/Prev 2379 0 R +/Next 2387 0 R >> endobj -1486 0 obj << -/D [3651 0 R /XYZ 85.039 708.207 null] +2379 0 obj << +/Title 2380 0 R +/A 2377 0 R +/Parent 2375 0 R +/Next 2383 0 R >> endobj -3654 0 obj << -/D [3651 0 R /XYZ 85.039 684.889 null] +2375 0 obj << +/Title 2376 0 R +/A 2373 0 R +/Parent 455 0 R +/Prev 2303 0 R +/Next 2399 0 R +/First 2379 0 R +/Last 2395 0 R +/Count -5 >> endobj -1490 0 obj << -/D [3651 0 R /XYZ 85.039 575.05 null] +2371 0 obj << +/Title 2372 0 R +/A 2369 0 R +/Parent 2359 0 R +/Prev 2367 0 R >> endobj -3655 0 obj << -/D [3651 0 R /XYZ 85.039 553.853 null] +2367 0 obj << +/Title 2368 0 R +/A 2365 0 R +/Parent 2359 0 R +/Prev 2363 0 R +/Next 2371 0 R >> endobj -1494 0 obj << -/D [3651 0 R /XYZ 85.039 471.112 null] +2363 0 obj << +/Title 2364 0 R +/A 2361 0 R +/Parent 2359 0 R +/Next 2367 0 R >> endobj -3656 0 obj << -/D [3651 0 R /XYZ 85.039 449.916 null] +2359 0 obj << +/Title 2360 0 R +/A 2357 0 R +/Parent 2303 0 R +/Prev 2335 0 R +/First 2363 0 R +/Last 2371 0 R +/Count -3 >> endobj -1498 0 obj << -/D [3651 0 R /XYZ 85.039 380.724 null] +2355 0 obj << +/Title 2356 0 R +/A 2353 0 R +/Parent 2335 0 R +/Prev 2351 0 R >> endobj -3658 0 obj << -/D [3651 0 R /XYZ 85.039 358.863 null] +2351 0 obj << +/Title 2352 0 R +/A 2349 0 R +/Parent 2335 0 R +/Prev 2347 0 R +/Next 2355 0 R >> endobj -1502 0 obj << -/D [3651 0 R /XYZ 85.039 290.335 null] +2347 0 obj << +/Title 2348 0 R +/A 2345 0 R +/Parent 2335 0 R +/Prev 2343 0 R +/Next 2351 0 R >> endobj -3659 0 obj << -/D [3651 0 R /XYZ 85.039 269.139 null] +2343 0 obj << +/Title 2344 0 R +/A 2341 0 R +/Parent 2335 0 R +/Prev 2339 0 R +/Next 2347 0 R >> endobj -1506 0 obj << -/D [3651 0 R /XYZ 85.039 158.125 null] +2339 0 obj << +/Title 2340 0 R +/A 2337 0 R +/Parent 2335 0 R +/Next 2343 0 R >> endobj -3660 0 obj << -/D [3651 0 R /XYZ 85.039 127.924 null] +2335 0 obj << +/Title 2336 0 R +/A 2333 0 R +/Parent 2303 0 R +/Prev 2315 0 R +/Next 2359 0 R +/First 2339 0 R +/Last 2355 0 R +/Count -5 >> endobj -3650 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F41 2104 0 R /F56 1642 0 R >> -/ProcSet [ /PDF /Text ] +2331 0 obj << +/Title 2332 0 R +/A 2329 0 R +/Parent 2315 0 R +/Prev 2327 0 R >> endobj -3664 0 obj << -/Length 2875 -/Filter /FlateDecode ->> -stream -xÚ½YÝoÛ8Ï_aôåd f)Q”¥ö!MÒnvÓ&›¸Ûº}P,Å"[^In’ûëo¾(ËIq{½C€ˆÉ™á|üHû þ ¶J›d0Ž}eâx0]éÁ FÞù¡¡Ò‘Å¡·“£7ï¢`àk•èd0¹#–IöÅ;ùåøjrv=cm«úÐ"‹¸ëק×CÙVv0ò#e¢4´ÊjKK—Mõ— ¼â¾Qâ­›#›nø{¹n/*2huí- ÷³¼)êôv+s¦´•pbÆhPº6-‡”7hxΉÛ—gÎç@TZ÷Oí‡@y„ Æ›ÌÝFn@4b[|Lª i´H‡ ç˜È¼¦­VÜzBƒTk˜Z3a‘N‘qNŸ#mìÝápµ`†yŠ’ÏÈØ¿#»ûÖ:ÈäÀÃÆGî,ÏxŒÝè5îPÉQÑàÃu.Ôaå$Œ»à `ÌW d?#bA5Y«½r(/§“ŽÆdÄÅjhȱÀÔßò…SpÙ>Ÿd” ì‹¢Åð}9-œTK9ºÙºÎ1P,„•4Ü/Ë” ¥y*eWL©óYÑ´õ÷ض-: œc#ëUø €ü Ï1gÂíÆ5Ú6¯™»ïõÀ³  â£B4hïœy׬”8çN¯fu -±gèMÓ²Dƒ‡#&ŸnP‹³3JùcÎ<sp pÎlçLU-÷+°•a h˼¡¢ -ß<¯e´æóÃö·¡µL(ªu# Áôú€ÌºE íοadYÝq¾¦”W‘ã©3’(ûä ®žxJŠ\ X©(%½ªg*´*²É‹^eUìû[*Á²íð}=L¼ÏÅ2«Ðµœ:QäZkvý›¼þF‰;WÈ—Nï…é9!õKâ Œ ¾Såù¤L»q#×e÷¬ÓRFÑó–Ùÿ¥ËiÞ0ÿCgALŸÉÛ3ÊД©œž~§§ï‘»h`¹”ü…ëÐÉFš§Í9)aMajµ¤cDQV.wzyZ7}çá2,î*R}±™â'¡Û Ĭ‹ç/Ħ 2”\Ø`†,~çUÓ2óÚUà¼fŠêœ$²óÕn2ž</c£4LƒˆHWϘòet—*)½•ÅÒi².Ÿ©îmvu½EZ,1$¡ÒsÍGrÚô¨ÆÂU¤·óƒ[à  {·)¬pèS½Cž'V¤˜«™8'  è Äž’„¯1KÁ¬u»a|.aÝ–ù‚cù¡¬ƒ²Î}wNØ}’Ô@² §ku¥‹€ õ%c,+L0ýƒ¸ç|‰à¼®Î\þ©™B9¾â&HóŸñiÖÓ)÷i&§u)¢ã¸[uïC:Ørž‚œì)]v¤Ñmø§¶º $á yŒ`ž|ÕNÕI[†!R9‚FK‘„]˜'°ÿš =·Á.¹G,-çtÁ؈ñæz™ÉÇ*KzZáèpj9{Zr£Y¯5Tµ ýÌHO´ÞV¦óõXʼn‘Ó¬;OD~P -Y[)cØÀã+¥Ý8 br$“ ÀýÈl§›®T€4È^­›.XÍkc£®Òg$èl¼¥ìj"ôÄzçèµ!Æd!Kð×wÇG´¬êÐßk¤„Ý=€N›w ×’„0ŒròHœ–Eî@,åæ¢Ä0´‰7å°F%Ê”RSNÕºåþ²’ÃÒ\tGÆ2ç[ÆóØL9tþÊðÜ0ØVl!½üx 43ý4_›s¦hðeå!$<­‰5me³X{äËë’ðÇŠöƒL;U+ÊÏ óQÕ‚¬\Hy¨$KgEsÏòôæ|8>ÿ¨À3j¥5Äéå|Oãt0È8c©RJÔPÄ¿AœctäÒi*˜±²cŒñÀxh0à@=Žë÷/„†³¼r¸“\îU²dÔÝ,B¢ø0.Áûþwoç ºêˆ+‰^|[Ô–+O%˜G²¼0×p‡l¯­ ¤à2mQa …ºKH³‚‡v¶ÃúÇÓ%&¸ï©qmg&Ê RV˜ÄÛ7KÌV&4…©žVÀ‚·’Tä^.¨úDN¹ÈÒmÀh 8c5Ãú×’¡-øÌÊê–›áÈLó³¹e(Rñz•—yÚ¸ÀÁ5W Ì…  |7ITAûš -ÿö -©uørÇ«²äüS¸GA®Æ†Å½%©‚ñ‚<‰îÕTdlæbCš-C2ô5‰ÒÖ_ kÜeþ•%+?ö·ÁFŠðÕÂ%êgþ¼ÉWPZÞÈÄ}| Ù‚žˆy‘b˜÷fë’ê~ˆfòØôôÜ´ñÁipé¥ar'l`ñ£º×›Ëuog&Șñ0#ç=þp5·¡Ø.Üœ^q±F¢ú‘øu1ìÜ®ùùÛŽF iÛëȪP“‚{^P -‘û5‡úÕª äUd Ιˆö|ÌÀt;¡®Ì7ÓºXµ,ïs GÒK$åR:(€”~•×(‹˜º9£¹zh»Ý[ ÁÅlæ ¦;DZS†ÇÈLÏR(×O ôWf\/»àìSÅÉA0Ý7gè~ᆠj˜(/º/ þ„Mƒ ùÙ‡ŽÙ}B¿³Æ À¶ nÛw°~ŠÃ"Èûѽ2ãvíÎŒž6‹u·“€ŸHé+š¾µ™®hö.LN'ñ»®C:J <çÇVù&ØÎÝ Ò‹Ù²‡éÍA° -d ®n²…6*ÒÑ` ÅOÍ¿tOŸ iÜ㆜=´7&j¨ØPwJÀ÷jK1ÛX LöŠç-zð‰*®»’Xù6觾·ò”’IÌû¿£tÏ®9ö+h°Iv ½‰+–f§Xª”±"%ÏTÊ×,Àþˆ‚\M 77 -1¡³šq É/â®X±çŒC¥Áã·“nñE(¸{«Çå@55Øä@Aù;jœ×O7îl —„è âP²˜só.™ñRuÚí‚OA$/Ϥlm¥-¼§½›ÉŽ([X¿7„xèñ!ËïRÌû¥è¡÷Ñ‹]í¹òë„¿U›í¯<öNdÕb9-×ô3As蹟æ!f»€”Ð G«´o·ãuk±H^Û8^{/è´¯ ÿn÷Ï5=ñ-™¼»®ÊW{Ow~~£-þ"©0þy^Äþï~7ˆv:¼üëoîJ*?pmaù·£¬endstream -endobj -3663 0 obj << -/Type /Page -/Contents 3664 0 R -/Resources 3662 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3661 0 R -/Annots [ 3673 0 R ] +2327 0 obj << +/Title 2328 0 R +/A 2325 0 R +/Parent 2315 0 R +/Prev 2323 0 R +/Next 2331 0 R >> endobj -3673 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [148.895 332.993 206.706 345.895] -/Subtype/Link/A<> +2323 0 obj << +/Title 2324 0 R +/A 2321 0 R +/Parent 2315 0 R +/Prev 2319 0 R +/Next 2327 0 R >> endobj -3665 0 obj << -/D [3663 0 R /XYZ 85.039 781.388 null] +2319 0 obj << +/Title 2320 0 R +/A 2317 0 R +/Parent 2315 0 R +/Next 2323 0 R >> endobj -3666 0 obj << -/D [3663 0 R /XYZ 85.039 761.463 null] +2315 0 obj << +/Title 2316 0 R +/A 2313 0 R +/Parent 2303 0 R +/Prev 2311 0 R +/Next 2335 0 R +/First 2319 0 R +/Last 2331 0 R +/Count -4 >> endobj -3667 0 obj << -/D [3663 0 R /XYZ 85.039 743.9 null] +2311 0 obj << +/Title 2312 0 R +/A 2309 0 R +/Parent 2303 0 R +/Prev 2307 0 R +/Next 2315 0 R >> endobj -3668 0 obj << -/D [3663 0 R /XYZ 85.039 721.384 null] +2307 0 obj << +/Title 2308 0 R +/A 2305 0 R +/Parent 2303 0 R +/Next 2311 0 R >> endobj -3669 0 obj << -/D [3663 0 R /XYZ 85.039 698.868 null] +2303 0 obj << +/Title 2304 0 R +/A 2301 0 R +/Parent 455 0 R +/Prev 2235 0 R +/Next 2375 0 R +/First 2307 0 R +/Last 2359 0 R +/Count -5 >> endobj -3670 0 obj << -/D [3663 0 R /XYZ 85.039 675.747 null] +2299 0 obj << +/Title 2300 0 R +/A 2297 0 R +/Parent 2295 0 R >> endobj -1510 0 obj << -/D [3663 0 R /XYZ 85.039 579.025 null] +2295 0 obj << +/Title 2296 0 R +/A 2293 0 R +/Parent 2235 0 R +/Prev 2243 0 R +/First 2299 0 R +/Last 2299 0 R +/Count -1 >> endobj -3671 0 obj << -/D [3663 0 R /XYZ 85.039 555.707 null] +2291 0 obj << +/Title 2292 0 R +/A 2289 0 R +/Parent 2275 0 R +/Prev 2287 0 R >> endobj -1514 0 obj << -/D [3663 0 R /XYZ 85.039 498.823 null] +2287 0 obj << +/Title 2288 0 R +/A 2285 0 R +/Parent 2275 0 R +/Prev 2283 0 R +/Next 2291 0 R >> endobj -3672 0 obj << -/D [3663 0 R /XYZ 85.039 472.209 null] +2283 0 obj << +/Title 2284 0 R +/A 2281 0 R +/Parent 2275 0 R +/Prev 2279 0 R +/Next 2287 0 R >> endobj -3662 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F56 1642 0 R /F35 1632 0 R /F41 2104 0 R /F73 2564 0 R >> -/ProcSet [ /PDF /Text ] +2279 0 obj << +/Title 2280 0 R +/A 2277 0 R +/Parent 2275 0 R +/Next 2283 0 R >> endobj -3676 0 obj << -/Length 762 -/Filter /FlateDecode ->> -stream -xÚ¥UMoÛ0 ½ûWèh³ªK¶Ži›¶é¶lk ôPôà:Nj¬ŽVÇY°?Ò²“4u;`E¡HJ|$iNü8IeÒ8áT& É+‘%X.=Þy0Q¦šNSïäB Â5ÌtѺ¤ó;ÿìjô=ß¡”Ò—’a'þ,àþèëéÕ‘?šž;û·ôj –§>›\ÌœþìËd> endobj -3679 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [165.346 582.508 348.339 594.198] -/Subtype/Link/A<> +2271 0 obj << +/Title 2272 0 R +/A 2269 0 R +/Parent 2243 0 R +/Prev 2267 0 R +/Next 2275 0 R >> endobj -3677 0 obj << -/D [3675 0 R /XYZ 85.039 781.388 null] +2267 0 obj << +/Title 2268 0 R +/A 2265 0 R +/Parent 2243 0 R +/Prev 2255 0 R +/Next 2271 0 R >> endobj -1518 0 obj << -/D [3675 0 R /XYZ 85.039 634.486 null] +2263 0 obj << +/Title 2264 0 R +/A 2261 0 R +/Parent 2255 0 R +/Prev 2259 0 R >> endobj -3678 0 obj << -/D [3675 0 R /XYZ 85.039 612.724 null] +2259 0 obj << +/Title 2260 0 R +/A 2257 0 R +/Parent 2255 0 R +/Next 2263 0 R >> endobj -3674 0 obj << -/Font << /F62 1689 0 R /F70 2201 0 R /F18 2207 0 R /F20 1617 0 R /F15 1628 0 R >> -/XObject << /Im1 2193 0 R >> -/ProcSet [ /PDF /Text ] +2255 0 obj << +/Title 2256 0 R +/A 2253 0 R +/Parent 2243 0 R +/Prev 2247 0 R +/Next 2267 0 R +/First 2259 0 R +/Last 2263 0 R +/Count -2 >> endobj -3682 0 obj << -/Length 2515 -/Filter /FlateDecode ->> -stream -xÚ¥ÙŽã6ò½¿ÂÀ¾ÈÀX-‰:ó– ™E‚d ½˜‡É<ЖlkG‡G¢Ûí|ýÖE>:‚ZE²X,Ö]´¿ðàÏ_¤‘ë©l‘¤¾«Òt±­Ÿ¼ÅVþýä F)7 -C€ï,®ìê*\/Lîá‰$j± -B7óã‡õÓóÇÀ[žÇj±Þæ:ÿì¨Ð]®¢Ès^>-³Àùÿ­—+'Ί?ëCÁÀ‹®7ÁØù´TžSl–_Ö¿>(&zßçuÙ”KßiÊÞtÚ”mÃ[ÖËÌwZ€á…Ÿ~Z·š±¿w)»Y —ò£…ïÁžlz)`¹C¦½ÐÑð"p­›e:)G79óºŒ"Æ+Ñwdº=– εMϺb¯»œî¶çC¢àÔÓάª†Oô¾çsÛŽ±Zs°KxÚ¹ì펿 ßGE¤ÊY»VÂ>*=£Ëý…˜âmŒ):†‘n» ç<ŽWå¦àY3Þ±—™–QŽ°=?m-îA€#- LïŠ-‚†÷Üâ…ÿðüpB «sXFò pÐ7 KÃ$»¢Ö%Hõön7‚iµ4Jçãa8¹ã]ß6ºâ)£I”¦cC¢B ÉšÁèPØøÕ²cšÂ#|ç  ÎeCYÑ·h8gYFAƒñî£á¶mX°I¬rˈ.‰÷±¬k¤¼ÑÀxÀÏ×RV`Ï°æÏÑÑúþ¤}(êœWȬ´ì¬5²wá#Eudï‹ËûB$zïˀ h³ÈïÛ©Ü"Ò×ê‚ý³Q@¼Xvõ=m-ÜeèÈ7ÁN”ÃC«!J~ùŠ¨#ÛI€¶E_Ú¡‰‰ƒ©ñžØêÂ9;F;’XàFèWàÀiä%dx´Ü‘_Ë|pQ&†Ž‹^ŠHõ`Ó¥i;ë»sÉS×Yj|]@öc§7/ú +¦FoiÄ°‘:]°è$f¤&ËA1«}‚5 è"€;7J¾L‘Çð -x÷•·žË\Øù °^xòSÙä:B·7l -K.A!ùÎW´uº'ýÉ99ÏBÕû‚5ÀòpFû,sÓèÝhïGnêûÓ懮 -ã«æc 3Jbþ,‰}¤L¥Í©â$#Žý°üCÑÐ<Ú¼é1êýE–UÑßKHAæã"f,Öd¢%œÔ¨'Ê¡m×ó*©ˆc=ÑÚpl®8¦[BLCÁ ¡Ò~{9Ÿ?{øsAÜB 9çLn`ä¤ô‹õ^úîoã\ÎG¥ŸìµÄ&l’€„™€L3å{ù–%2U¬ÊXLxÎŽÓkÈ1¹Q^4O£<5†uèÁCºô<½±ÙŽqèÓH,·ºÈiCtÇk®ÏÉEsé{p¶iQCq&âl%š‰d¥‚Ñ®E3&ÚŒ“• –27”;8(%wµä+°.ŠP¸cG§’‚> ƒÒž+4­lÌÇ=sv¶Añ ÄåX‚C Öua„ C/€2¤xV0P8[fKS >“p n"’œì$eউM“rɇv|e<*^ ±¢ÛË‚—<Óï}aˆh{šoòSÏÓCÇ âabV6 gX(yYBüÁ{1‰èS%Û9ÛJ²Í¾w9c¯m(‘Í]Ñ;Ê{ªxT1‘ªb`ÛÖS·îyd$ë£?Á j{Ù¿C1´5¸ÔŒ½{ -ŠÄ²íÕ0Î -º ªÃÑü9^Ð >ppì,ö¡VÄRI³Í“Ào”0 ©kdV…¤MCöF+\}$6÷•Íð 2Ç n"©¢|8qüMD.¼ÌMÒ “Ç·§Ï_¼Eiæ—'ÏUYº8ì¹~–-ê'„e±Œ«§—§ßçt<è*’¡MaH°çT"hGiìrOJ©,yßÍPNc*ƒöƒB^îöBQàBZE -‹o Ô,S¼:‰ÍqM<ÿ\û‹[`h1ò¤27€Ó!Ó†“"ÀOïdØô[¨6c»²³• õ‚Ð➆ŠÓöp\2€é ̇£í†b$žÚÕC”> endobj -3683 0 obj << -/D [3681 0 R /XYZ 85.039 781.388 null] +2247 0 obj << +/Title 2248 0 R +/A 2245 0 R +/Parent 2243 0 R +/Next 2255 0 R +/First 2251 0 R +/Last 2251 0 R +/Count -1 >> endobj -1522 0 obj << -/D [3681 0 R /XYZ 85.039 761.463 null] +2243 0 obj << +/Title 2244 0 R +/A 2241 0 R +/Parent 2235 0 R +/Prev 2239 0 R +/Next 2295 0 R +/First 2247 0 R +/Last 2275 0 R +/Count -5 >> endobj -3684 0 obj << -/D [3681 0 R /XYZ 85.039 646.155 null] +2239 0 obj << +/Title 2240 0 R +/A 2237 0 R +/Parent 2235 0 R +/Next 2243 0 R >> endobj -1526 0 obj << -/D [3681 0 R /XYZ 85.039 532.75 null] +2235 0 obj << +/Title 2236 0 R +/A 2233 0 R +/Parent 455 0 R +/Prev 2119 0 R +/Next 2303 0 R +/First 2239 0 R +/Last 2295 0 R +/Count -3 >> endobj -3685 0 obj << -/D [3681 0 R /XYZ 85.039 506.136 null] +2231 0 obj << +/Title 2232 0 R +/A 2229 0 R +/Parent 2219 0 R +/Prev 2227 0 R >> endobj -1530 0 obj << -/D [3681 0 R /XYZ 85.039 261.65 null] +2227 0 obj << +/Title 2228 0 R +/A 2225 0 R +/Parent 2219 0 R +/Prev 2223 0 R +/Next 2231 0 R >> endobj -3686 0 obj << -/D [3681 0 R /XYZ 85.039 242.982 null] +2223 0 obj << +/Title 2224 0 R +/A 2221 0 R +/Parent 2219 0 R +/Next 2227 0 R >> endobj -3680 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F70 2201 0 R /F18 2207 0 R /F35 1632 0 R >> -/XObject << /Im1 2193 0 R >> -/ProcSet [ /PDF /Text ] +2219 0 obj << +/Title 2220 0 R +/A 2217 0 R +/Parent 2119 0 R +/Prev 2199 0 R +/First 2223 0 R +/Last 2231 0 R +/Count -3 >> endobj -3689 0 obj << -/Length 2402 -/Filter /FlateDecode ->> -stream -xÚÍYÝoã6Ï_a 'ã*Eõ¹À=8·i7½dÓ‹½ Ðíb¡H²#D]IŽcî¿ù ÙÑ&îeÀ"‡Crf8¿™!#&.ü‰I8®L&Q,Ç“l}âNV0òó‰ÐîÄwÜ0À¡³ÅÉéO¡7®“¸Éd±$–EþÙúç‡Ù¯‹ó›©-¥´¤ïLí(Š­ùTX·S!„5›ÆÒZð°ßZ|8ç>rÍ®ÎfL¾=‡î·gﯠs1µ…õñâã2.°sËùܼ¸âG½âõõåôËâ—“óÅ@zÛwüP¢øž|þâNrÐð—בI<ÙAÛuD’LÖ'~ À—º_ÌOþݯÂcþ„gÉöÝÄqã°”½µd0b­¦vàV^,ÓmÕ½ãžZ.Qx”XànÉ!k›5å¦+U­Ùç·³·Ê–¿Ý}¡‡Òõ]ÊÍÛ⎳|]ÖÜ\(U9ÜüÔê)í.í¸õ‡þPŽÀˆÉÀµ:Å\™ª—åjÛèé{µm^ìÝÍcÑ8fSþnÍŽ(ÿã[>«N{Â^u‘iñŒÕhJâ -nìÊîþXœeú¨š²Ó{îŒ5îµkQ¶—»¢Ôe64ËKžÿMDŽˆÅÁKå ×µþñ,Ý k¶*{(º¯Ý~ûx!°iî¶kŠt=²ã.-®Õ›ª«ý×e£ÖÌ£Y+•¥Õ½jÇTóhn”ê¾adnгžnÛæ´½+ëÓcC±ž•Z}Uõ×eZVä*4÷ïzò§ùùÍÅû‘ò²Mïªâ@…}ѧ=bôÿâÈéObˆ4;t¼HNl;±çÛ™B÷ð=—‚ÜÁ‹-5…ŸGü!º°Š§t½©`Kê¥m‹‘f f­º{„ ¯ä‚%8À:˜Ô …¼1Ï‘”^äø‰¯yîJX©N›=/Œë¦Z3Bá`«š‡+E¢giWäL)ë7$²=b”ÃêOpDºÀwDh¤ËQº¦ÈP†N5ÐÙcHtûBZ°·çƒAsÈË™•¦!bé‹V'&V¬õVGúS…ק -$íʪâZŸŽÁ,‚Ø È%ˆ"íõ@F2ÄÜ2mÃÇLÆ ÙUm­àЗ–¨ÂÇ‹„µ»ÇÊy°qÇ_-W„ç:óðvky*ŸHPmxôWø@#§B†TwÚ0¤W4#€BX‡Ð TRJ±ô$£æ.ë%öšuŠ¹šx"äB²60P’ÁÇ@ýìE%WìZK…;Æ‚ýs vx È®÷.{‹nŸ˜ÒîÛŽ´YÓD¬bšzv„XŸBv>ÀE&¡vBöÖû´)N[Ì3§ßÀ•ð\€¿§gq”·e8IèOVÂÒ!7ç…Ö„¤<%q„L±ýÓÞ±±nÙ¶e½â&Hƒ^‚™»Ç«u-¯nƒ'ÁL{FC‡L(z ”¦þW”GJû±ÂâC¥gG¡¼Žzqs¤hóðS`FíÑM‘°1H/¶LfgdŽ”?T^™xÖÅ’i{ôµí¸¡Ý[qï(àê Z™÷Ü©Éím¤a-pm qmžAÄÓ Õ~()krköY—l -ÏJ«Š²Ä#.r38$G8ø>–Å[¾•M—–fnËFêcxֵ̦–ÌaÀ-(L¬®MI^Ùb옶# >Ž€Ò岉¾äðÐØ@V#eT“#Å7q¶^i¦eš•Ä<26€§(¿CI»NÕfJ‹Øzötd3ªK7„ÜÊ–à@RäÇò1t³&¬Ù#6ŒI…›%1×”xúЋ,ˆïá‘p"˜Îèøp}uþ#¦®Èš/¦Q^?‹Os\‡Bë7º^€ ç·šõ×iZ³ùüöúæýω¨ ɶ0 -A›ý eܤ+MÓ&C¹‹éJÇ }'áâÇg1%K7P›ýAQt))Hy°~Ù2…#X«§•íˆdDHZƒ7Ô =¸ ù‡áÆsƒg¼i™ç -3£¥/Æøí£ëQÊH˜÷шî|ø’ƒFï$gbÄFPt0‹úF9z±f<Ž|í®¶UÎ$u§ôG`àÛ",qìð˜Ø2Xlx‡…kZc ILr_¯©¼H„ut y._yµGyO‘o‹ÔYHT5¤z!]§À&Û™lõ4¦0bãiaÊšŠŒ2ïœãȤ¤‹bJŠØúùòúlv©ÁÄyH³ñüŽÏnÎñ3Ç™B ¯÷ç7‹H¾EþÎüøû^Ó{ð†`a}.õŒ_l€ñbñ[~ -€¿ ýzøž@÷{Ð.ü14ü±Çð#º|—¨ -ð`L8 ªÿü Á-ÍÃ{2fß"Û6\W„º~‚)0¡‡¤t÷Ú®îõðüÅ{‡m6tz¯K;áÄØ;Å¥¢ÊÌ…™JFÉbjƒ÷3 /ÞŸÈï(9O4Eÿ¶ãþ½N§Äoªh²+v[vNä<®€ núèåz –K½Ò»õ隺TÓbƒsN†—Ñ‘¬R¬¯P3ÁEfM8(áF®3±ôµü_9pù»q‡Ö‡¢)x„¢-.ÀÝ5«ƒÒra’3½G)vtÒCK> -øà ˜HÓÛ=ó™Ý¯Râݶ/oÜÿ‘’f­Š†Ÿ)Ü!ùŠóg^ê[‰)nMÁA¦”ºJ¢™¨!¹ ¥è¶î’T:½¤z•¥¢:À—õêÝÈ3]©Ã“c+BGÒEÔ8«/Fœt‰Ž— ¢îØ¢ÁØ}em®]Ú—î¾u݇΢Fï{ †žãËäûÒjUÔxµ) -S:wäY?’¢ö9.•ûåã4t›ñ‡¾»ºÑK¡Î56u›ê~<áË‘ÚuÛVúí©ø“v¥4µž7ÑÍ<Ýë·N†QQ†¢6¿J=*Ž¼ ÊN7iöY{ÚvÛº.*óu2¸\¿öBiS8#uŠ.{1}Sèw8û¡Ø¿Íú-JÇ‚ïË…0VßoŽ„­ßªÌsÅ^‡¼Ùà¥ù??}!|õ!2Eþ÷e¶K›a¤”U÷úTo!">F„ví1›¿äWùѸñÓ#BåøPz°­ãÿâÑNýÿý“D¢~=@^µžç½8áQÿÂétdendstream -endobj -3688 0 obj << -/Type /Page -/Contents 3689 0 R -/Resources 3687 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3661 0 R +2215 0 obj << +/Title 2216 0 R +/A 2213 0 R +/Parent 2199 0 R +/Prev 2211 0 R +>> endobj +2211 0 obj << +/Title 2212 0 R +/A 2209 0 R +/Parent 2199 0 R +/Prev 2203 0 R +/Next 2215 0 R >> endobj -3690 0 obj << -/D [3688 0 R /XYZ 85.039 781.388 null] +2207 0 obj << +/Title 2208 0 R +/A 2205 0 R +/Parent 2203 0 R >> endobj -1534 0 obj << -/D [3688 0 R /XYZ 85.039 328.501 null] +2203 0 obj << +/Title 2204 0 R +/A 2201 0 R +/Parent 2199 0 R +/Next 2211 0 R +/First 2207 0 R +/Last 2207 0 R +/Count -1 >> endobj -3691 0 obj << -/D [3688 0 R /XYZ 85.039 307.304 null] +2199 0 obj << +/Title 2200 0 R +/A 2197 0 R +/Parent 2119 0 R +/Prev 2195 0 R +/Next 2219 0 R +/First 2203 0 R +/Last 2215 0 R +/Count -3 >> endobj -3687 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F65 2099 0 R /F56 1642 0 R /F20 1617 0 R /F41 2104 0 R >> -/ProcSet [ /PDF /Text ] +2195 0 obj << +/Title 2196 0 R +/A 2193 0 R +/Parent 2119 0 R +/Prev 2191 0 R +/Next 2199 0 R >> endobj -3694 0 obj << -/Length 2890 -/Filter /FlateDecode ->> -stream -xÚÍZIsÛF¾ëWp|°Ê„Эá-+¶R¶è‘éqMerIˆD ퟷ5Š“)¥¦R: ÷~ý–ï-”yð§F&t=?ÅF¹¾1£eyáÖ0óöBÉ -o¸^âÔëùÅåO‘)ÏM¼d4¿§%óÕ/ÎÕ»éÇùõÝxâû¾ãîxÇÆù4VΗ±RÊ™ŽïÌyz‚ŸÀ™¿»æ>®š~x=åá/×Ð}Ííé›йO”s{s{ƒ çعƒãnÞÌ`ðVNœÍÞÿ|q=ïQ? Ü ò‘üß.~ùÕ­à…?_x®Ÿ˜ÑÚž«’dT^¡ï†/ýââÓÅ¿ºSx.ñ®&MüÐO 4<ט ã–pkRŒ'¡Ë}S_Õ2-.›´\¤—‹|{ÙÒ–§©ï¹üIõO™„‘„\eÜ0ŽéÄô¾>dÈ‘ú0ÖÆIë 4㉎=§ÉË]ñÚ‘q–¸¦ÚâÜ’bwÙâ\â´8"vÒ–w,píwžÙ7ùv­eý&ãÆç»÷Üx±¡ƒÛ_®œW——%íßTMû*ñÔ‹—°ÒÀÅDÈ’HÆÕôÒÑDž9QÈð„ÞÖnøi(bÚ”ÕmCÿõT°$úÛã‚t»b­êïBÅùôžÇíû•³Í¨MgÁÍæ ïØ#Iîceš$ùÑh%nà*‚Ž]û@¿rŽ:5Ð0§Ü$ ûjv¢\¸Çs CÏ™#;ý(v>}'l&!}Ç‘wDu)O‚cx¸ÎÎH´h××á)4ðíTCzJItjÈdy8Jœk YƒC‚¸S#SQ‹ ‘¯²†ÇÓ%KtCÆZZÊM¶‹´ÍšöxZâq ÖY\ñ>P®å¾$=:ju›W[àjâ3WQµ¼¥*SZ¼OÁuà9;"[÷UÍ :Ô–mx„¨NIŸ)±:•;44ТLH€9x¶X`pªí ƒ“‹"ãé{èÔ ^êà6¹lì¸J§ØÓj°üÂö'KØdà¹ïf8÷e>›\UEaŸµ^ƒ%…^»aÝ÷Õ‘©ü˜V<•Šy>dEq:Ú7¹Ù?ï²(DX0‡èèê+o|ñàd-^À’ÿ‚Ìn4ÓUIè“7m¶U×êÈ9l*l„@òµÙp¯­xúa‚ÞùŠôÉ:ˆÇY^ó’æD·p䈈2ë=Ê'†ÁÙeŠë¿s§Z´)JsË[÷ú²{lç¸Òkè) l¥œ«vîÉlPŒ/è - ÔUjtÊÀz#¬¬°³[ŒÏÌ×éà6_òО µÈÛœí #òÁ0˜N^ÅJ… ”s-/Rd -©)ؽUÓsýê1Ö`¡càvUfÜSƒVZ4ã;³­Œý麣†ZÑš‚½ÝEÎ)VØø½Íy¶¤'±âæ$Aâ׊g‰Ñö » z9ð¨ÅžüÒÄWhi©´ÈLîBa‘Š„^¤µÕw˜Þ7t/²l_t;É›‡QkU€FhAÜ äXgi1àöß5@¯{‰'†NÊË¢B®¢à]÷"§¾oÐ1{böt"Î'구¸{ûoÐsíàÕ‡ë’0Øjhˆm¤Î -B>&Fi¸"ª¾‹zúîsWì'¡›DðmÜ ùñ&n˜DƒñÊü¢ÒæÉsh—çpË.?='„ ½ï&ñѵÆC¾ÿ¶bÝBV‡¬¼M‘€F¿”ë ¼f{m¢ô¸‰.oJ5zSI£#U~âj¸=®†ÉÑã›>CäÐ9ù0q–>Ø`GçygøXg+^…¶Š P ö²ŽÔ9V}½= ¯]ed¶•¨}Ÿ2¸‘Še]ÉH°Ê5ŒÆŒB\%]ÓðÕ„¹ÚY ú6]g¢‚«@ø&d_f"'où[﷌羉Ù˜AœÎÀŽCÞnª½,OñÙ`Ã[Àë/d˜Shãú°agH@èd…ÖáYÂC2Y„Ðœ¬s|!–E9=ètܦˆ …b‡†7D·ëLÆÈ[—6¤7t(N…½3OÂM{æë´Èõ<ÊôµEÔñ#OY’ Ö9¨Ò–NDº\©WU°tŸ¶0‰ðoƨéêaa]i !Î9¿Â¢Ð¨Ç/ŸÛ–æÔ^l‚7UTƒ®ÄÛLÂ’~|±-ÀtY‘ZÒ™å®È¾õ®Þ"[å-;?¾üQ J·€S Fd}r¶ü%Qäý”RH<Æg§DFÚõb›OÇ!ØË&.è)BÜjgÈ|NØk†î˜ø±(Ðí¾T@³”"|Bñ‚ÄM´ WÈ”´xi݈©–Å‘ GÿrNA¢Ý¸;슪Á%å)¡q®0¢¤›búsJ ä¦ZÉf®l´¢@ZÅ®÷!¦½_¸¶S¦_» ËEÔïÜýêÒ -€ .ÝÐÜ“õ4®Àt>´»°‘éQ_Å€päÄ1Ó%øv.éc(K×9‹ÝjûT1îiÍ2®‰ÍÏA¯¯6?`v@Yú)³!Rý ‹CŒãÆÜÖ–ËÉpIb³êLÕÖ¹VÈÄ!oäa€,}$y~àúñ©"3*¡úuôQèU²XXu92ëu)¤#y´O{¥•«£øÙQ%àO¦²z >û.EÏ)Ï!¢ù‹Ë3˜—øÑÿRžÑo(áÖä±X<ßZhĽ‹gϹp€3›¬ØaÔì%è#*ÊÃ0Z&)ðX*hàà 5"]n¸µ³n­Nm™¢ ÚÏCú\**÷máŽýEÛ}W­¯<ÚðI"®<^(Üxשãn¨pƒG´6XjÙ£+ùÚ:HÆÁS‘ÝK‡B}#É Nuñ@çÒkB/¶'üÍWù'¯ÞqŽ|Ì Ü'SeôAqð,½>Í”Í_•)“¹ þK€¼ôy?ªûô›Žk?Ìsµ6gä^Øi ü 4¾æendstream -endobj -3693 0 obj << -/Type /Page -/Contents 3694 0 R -/Resources 3692 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3661 0 R -/Annots [ 3697 0 R ] +2191 0 obj << +/Title 2192 0 R +/A 2189 0 R +/Parent 2119 0 R +/Prev 2127 0 R +/Next 2195 0 R >> endobj -3697 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[0 1 1] -/Rect [386.344 563.626 509.276 576.528] -/Subtype/Link/A<> +2187 0 obj << +/Title 2188 0 R +/A 2185 0 R +/Parent 2171 0 R +/Prev 2183 0 R >> endobj -3695 0 obj << -/D [3693 0 R /XYZ 85.039 781.388 null] +2183 0 obj << +/Title 2184 0 R +/A 2181 0 R +/Parent 2171 0 R +/Prev 2179 0 R +/Next 2187 0 R >> endobj -1538 0 obj << -/D [3693 0 R /XYZ 85.039 681.066 null] +2179 0 obj << +/Title 2180 0 R +/A 2177 0 R +/Parent 2171 0 R +/Prev 2175 0 R +/Next 2183 0 R >> endobj -3696 0 obj << -/D [3693 0 R /XYZ 85.039 659.87 null] +2175 0 obj << +/Title 2176 0 R +/A 2173 0 R +/Parent 2171 0 R +/Next 2179 0 R >> endobj -1542 0 obj << -/D [3693 0 R /XYZ 85.039 390.685 null] +2171 0 obj << +/Title 2172 0 R +/A 2169 0 R +/Parent 2127 0 R +/Prev 2167 0 R +/First 2175 0 R +/Last 2187 0 R +/Count -4 >> endobj -3698 0 obj << -/D [3693 0 R /XYZ 85.039 372.017 null] +2167 0 obj << +/Title 2168 0 R +/A 2165 0 R +/Parent 2127 0 R +/Prev 2151 0 R +/Next 2171 0 R >> endobj -3692 0 obj << -/Font << /F62 1689 0 R /F35 1632 0 R /F15 1628 0 R /F20 1617 0 R /F56 1642 0 R /F70 2201 0 R /F18 2207 0 R /F71 2204 0 R /F41 2104 0 R /F65 2099 0 R >> -/XObject << /Im1 2193 0 R >> -/ProcSet [ /PDF /Text ] +2163 0 obj << +/Title 2164 0 R +/A 2161 0 R +/Parent 2151 0 R +/Prev 2159 0 R >> endobj -3701 0 obj << -/Length 3154 -/Filter /FlateDecode ->> -stream -xÚ½ZIsÛF¾ëWèVYt7ֹɉ=q*¶3‘j|Hr€ˆD$8hÆóëçmÝ ’ å©L¥T%ô†^Þò½ï5¨n#øS·yF¦¸Írš<¿]nn¢ÛôüãFɈè6£4Á®×7{›ê[…ETÜ>>ÓÇê×à»î~|óËâΘ8\ÜeY<,Tði¡” -î¹ ¹ûqðøîã¨û÷¯ï¹ùÓ¨¾æòý÷ï¡ònq§‚ï>¼ÃXù¦‹¹øî#4~?~üiñûã7o'»¿‹Ã85¸ýßüú{t[Á ¼‰BSä·(G¡*ŠÛÍMœ˜0‰ÔÛ›‡›ºY¸/¾å·f„tgGÜ©",t27Fg¡Î Œé%…“§†>-ÉTž BÂÉd’DÁú\ôxäN›¦ 6,c³] §§¾³kéм°™žn/*™Ñí#ꮃEu”¿EÊÐÂKü?J+?¨i»îûzÛÂó+¶'Á²ÛÂk14¬öý‚ ‚ŠßÖe_¿Âr Í{v0¤ý:™§j– Ÿ¹µÛòs\ól¸Èn[…΃ƒ {ÚÐ7Ú·žwÐY4g­iC["Ú‹BMttY:À±Å‘¶Æ¿î‰ -ºA¶Êê±A^<jš† ˜¿XnA -ºÈ`¹ELj]ÈØï붿eæq&/=¡PF<¹ -<$J:J‚¡¶r¥ÂrÄmä´ *V¸øÅÔí¹rh†µ íøÙíà "ìË‘vƒ•…Q–ɱÛâÂE‚+ À p|Š1€†GéÀMðoÞ$©ŽlœzÙ htÖ¹õïžËQGPÔùŒ¶âÈ°‘@õ¼@s@ÆôT ö’Í©Õ" CÛECÜVZÚH’_·X=Ïgl$æG›´ ­ -úuò~|líž<Œì ·M¦D¦§ ã‡ý1ò8²$x½–)ýžhH[>±•Y«mÅjftmò0‹gŠVA´]£ôËú6¡I­×µ‚ù´\Ï›i ©ð»¢2Ÿ ·Îr4 A@ dBó!ÖmÅjvðeXzåÆÂ;4tÏ2HÄ‚mΘØ&:!xÆKRLõÊ®@î¥eëÔˆÃø-ÌÈ1A ñ%9²±T.Éâ®Ò—Œl6ZQF_ W*Ìuúm±3•Øùsp±I¸ý Ñ“Ýu¤.,þEATgÑL¥V~ÌQ×~!b?âG/¶É抗köC<æ̸)°[ÉéàÉÁgÞ“ËqÅGV¬M"+Uÿ‘µ5‹Õª@UnǺŸ±¶, •:Š«¦(.ăX#<Å̦GPHNyx…ïesá4Ž”s],;õäÔl%Ž"a±ÂKàÞ3nWÇÓÇC4vÊ< ÈÁ^¹ÃSXL%J¥A]5 &mØÈ!*e!"¹ 7 ‰/r°©Øô -^ÄQ˜çó16½&Ø4ÌU6]s·o]}$5* ³(™bëNƒµ4›‹¯¨ŒšÆ¼_•¦—'3öVæŽÈ‰Çå(›ƒ©Cî5gã$(Çr†à'I°­\?÷vÖ{ ªó–•s2§•ÎñÅ=Yœû ²iš(»âL]S8¼šÄóá·!>"Æo&Ùr@ðæY„ƒ .ºÍWÜì§Á¶ÜÈk[“D\º&gí¸ÛVÔ†•2-aclªÜG𵙜ZɃ’+dt¦ŽÊEܬ°Çsÿh>à……vØ„{í+.7ƒŒïø¹®ÛA\ &~ÏAU,¦#¤£cw„±Ÿ·F[—ý¬Ê§Ö¿¿ÄЧø<BËjCÝ #d_0Œ°Bá Ю±"F!PøÀ\S3”ÜxhàôfɘœYŒÛo„6 -)¥m#‹éúÑšHÿÎØÁ¼ÁŸƒ]¹’VÊs:\à ž£BH6 ïºGê%µÜ‚"¤ƒB¹¯a˳d¸]ŒÄ½A>…V$‰gîG´ÖÝÙ -¶~þ}KaÃ×nl6ÍàaïnNÎøL -Ú0*0îâ8âÛ©5©“vH‹¡QX)[›‘ÓÅJ ÉÎÙ'…mhkžùé‚Ž²›.-, g\v›ez#7y€÷»²Ã­}åvUƒú´HLË‹\d•‹ŽrŸ#›{cÃI€¡Äiµ%õáþ)o$¤ÿj“J° -ØÛ•0®KÉ7¥ó(¬Y0<óZ$¹ZÖbuT™%÷<¬›v’®q¶i‚ïH›M3N™œ '{U¹g{ÞPZ{„’,Ò±É[Ì,A)´—J®:ÐLüÕažÚðû¦â}Ÿ  Ž!õŒÏØcͬ‡ã3‘€"rN´âúoQ_Ä@‹âi ²É5\–I›²å>!—\á 9šÂÖ­^JÆœd'¨ù,øê3Ýlš1³ÝM Ò=¹vœÈÝò(;wM€Õ!rÄ3T¹²ÆƵ‹ -{Kó•ˆ!`bHâtB,ˈca¦1£Ô‰1xv—¤±ž1&vÈH(H{¹‡sÐB¥ <عèV4ÆK*ÏÝB[ÙÎÁ¿3:|uI6uÏÓ½ô,Žþ"*ZQ"q ¿–KN‡1„K7Ã8±9mHµ®ÁD{îÁ›Â+“Ê’ŸÞ}xÀR~²e™qG¦26ËfǬ^);ÃðlxK ™‘ÐVº¶Î8 AGgÝŠ­ z$¦j îñÓ 6Ïß±˜!’FÓǹ:O'×6 -òI-É=k.Lݪ>^há­å\ -.If«Sw©e?Ãä2 -QÀ ñQPêûÁ ¨¡uþ Œ®é}^Üõ G¯ËDT¥YóÂ%’ûMT4?£¢c9î-:§š" EFríö'þ³·?Ì.Aë¸úÀe øD…bƒW½G€†l 11¿tJe)ºg@XÞ’¬IÀ#_AtC{Oùzghbî)‹Xv„Mt¬åöî™Ç{Z›ãã¹AUe½LG‰;ªþLçBƒN;†{<\¥Éy‚ÅÍ™ Àøδ®œ4y,¢6ÉÄ 1þÒô„Û”²Té–ù;GNH}&‰Xš†*³‰Ø°YaBg - åã¬TFLða{<Œîþè´¼6ö5Ûªš Ôx `?/ÈÍ@–‡i¢Î™´†ÌèíÀmÌv,EÊ”ÇC¬œk¸­+î¢`E—B_šjo_ö<¤”5J~ŒÝX¶\\õá–6Á}Å_q8 M" r- I—Â…ó@ËJâ+:(÷c·)«¥ŸÀ¤¯]Ò mN£ÏþngÍ]csïVhŸiÜ ùÀOÌ<ò ¨œ`·‡ûÉÀ¼û -­õç.ñà 6Žò£o$XÄŸP[èàQüžn‰YkBõ(D¹ zQæ¯'°y) -æÝyUâÀÁ^ü’[h 9Ò4÷ÙŠL‡¿ëëgäš[P®|bâÐ S„™#ó)‘l[›ß¸ÅG¦I¦:¢$ý§‰é5Þ4+ðDmšÜ -]íØ/÷Ùì!Åð&ië9ƒcGþ©ÆÖ§Q‘ßO”Ræ,ŽŸQ‚cŸËQ°Ç3U¨ìGæ"ùl­#òï-ã~’ö°´†ŠÄh)}>¡¥A2“7M6àI1úápÑßÉgˆWuL؇\ìwÙòñui)Äá}Îhz˼\&ÛW]½ŒR: ³üÅï@Ù·Q€â”ü«ÁdKQðoN4½`eˆµýdŒlJ+ ¼¡»¹õð_K5àu}°ïÙ”Ö%V vÎêè+‹Ü!˜É37NTK;ÚÊàFúý·ÜV?wàhô¾¥Ý\lJ†®‰öA áÅ°d?°¡ïÿÑä «l‡Ž›Gyò©j®”> endobj -3702 0 obj << -/D [3700 0 R /XYZ 85.039 781.388 null] +2155 0 obj << +/Title 2156 0 R +/A 2153 0 R +/Parent 2151 0 R +/Next 2159 0 R >> endobj -1546 0 obj << -/D [3700 0 R /XYZ 85.039 761.463 null] +2151 0 obj << +/Title 2152 0 R +/A 2149 0 R +/Parent 2127 0 R +/Prev 2131 0 R +/Next 2167 0 R +/First 2155 0 R +/Last 2163 0 R +/Count -3 >> endobj -3703 0 obj << -/D [3700 0 R /XYZ 85.039 741.134 null] +2147 0 obj << +/Title 2148 0 R +/A 2145 0 R +/Parent 2131 0 R +/Prev 2143 0 R >> endobj -1550 0 obj << -/D [3700 0 R /XYZ 85.039 644.777 null] +2143 0 obj << +/Title 2144 0 R +/A 2141 0 R +/Parent 2131 0 R +/Prev 2139 0 R +/Next 2147 0 R >> endobj -3704 0 obj << -/D [3700 0 R /XYZ 85.039 623.581 null] +2139 0 obj << +/Title 2140 0 R +/A 2137 0 R +/Parent 2131 0 R +/Prev 2135 0 R +/Next 2143 0 R >> endobj -1554 0 obj << -/D [3700 0 R /XYZ 85.039 515.796 null] +2135 0 obj << +/Title 2136 0 R +/A 2133 0 R +/Parent 2131 0 R +/Next 2139 0 R >> endobj -3705 0 obj << -/D [3700 0 R /XYZ 85.039 494.803 null] +2131 0 obj << +/Title 2132 0 R +/A 2129 0 R +/Parent 2127 0 R +/Next 2151 0 R +/First 2135 0 R +/Last 2147 0 R +/Count -4 >> endobj -1558 0 obj << -/D [3700 0 R /XYZ 85.039 314.22 null] +2127 0 obj << +/Title 2128 0 R +/A 2125 0 R +/Parent 2119 0 R +/Prev 2123 0 R +/Next 2191 0 R +/First 2131 0 R +/Last 2171 0 R +/Count -4 >> endobj -3706 0 obj << -/D [3700 0 R /XYZ 85.039 293.629 null] +2123 0 obj << +/Title 2124 0 R +/A 2121 0 R +/Parent 2119 0 R +/Next 2127 0 R >> endobj -1562 0 obj << -/D [3700 0 R /XYZ 85.039 156.625 null] +2119 0 obj << +/Title 2120 0 R +/A 2117 0 R +/Parent 455 0 R +/Prev 2059 0 R +/Next 2235 0 R +/First 2123 0 R +/Last 2219 0 R +/Count -6 >> endobj -3707 0 obj << -/D [3700 0 R /XYZ 85.039 135.428 null] +2115 0 obj << +/Title 2116 0 R +/A 2113 0 R +/Parent 2111 0 R >> endobj -3699 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F65 2099 0 R /F56 1642 0 R >> -/ProcSet [ /PDF /Text ] +2111 0 obj << +/Title 2112 0 R +/A 2109 0 R +/Parent 2059 0 R +/Prev 2107 0 R +/First 2115 0 R +/Last 2115 0 R +/Count -1 >> endobj -3711 0 obj << -/Length 957 -/Filter /FlateDecode ->> -stream -xÚ¥VKoÛ8¾ëWèHˇ^<:i²M±Iºº9’b U$WVjôßw†CÉJãlQ,„œ‡ß|œYúþ¤ŸÅ\h㧙ä:ËüòÉþ,yÒy?â"‰Ñtž{ï®åKÁ0~þh]òê »ø°ú”_~B­5ÓÂ4ÍØ} Ù:R²Ui–“9Ä%bù‡K’Ñkus¾"õúÄsÚ¯Þ߀p„’Ý^ß^£cŽÂgÑöú”·.âÝÝßÁCþÑ»ÌèÈG‰Føß¼/¯ ÞàÚdþö‚Kcü'/Š5#íäÖ»÷þ™£-òéÔ ’ÂÉ#”†ŸòQ)W©`/63Ÿ -l4ñ’O PrÈ |ƒ0ŽË·5$™¤ìS %+öûC ëQ*²\l‹nó ¤_è'Šëß Ì`AÊøÄ£[L*“p›2€ ßp©”õ`¯Ð(ت· :ôßÎ -ÍžÖ‚Üw¸°]ž[ôÈ<¾'[ œDpKŽQ§ããd¤0EÛöȇɌ¾îÆ $Ãcƒ¡»30Díôm=6}Ò’ˆ…$ñ‰M½ª‹rl¾q‚çÁ-TIV´ÀŒ1ô+¯þטamß“jÝàEÕq’°n2Z-þ뇯ˆµÛP€gØ[ÒëaOšéŠ9[ˆÓÎÄYHEK.O€8ÜÚ€5?‘ãªëQ˜)œ'Z@ñ»ùŒº÷‡öLBYt´yÞ×Ô“ãôFV8¾:¡hOY s… gA–¤Gà¨ÛÙâ·E†…¯{„r³¦bq9¾0)K{¼G¶:;R²®ž—¯·çÈ£ÒÄÝfcUø´J±Æ™°Ü•²HQìl …ƒËptNeÙãÙãݤŸß,^‘Œ‡¦mig9ÁT'úíÙžÖÝ`Ëå;>`5Ù¶nÓ·•óZ²…i‡'ò¶¹˜ˆŠŒ^=[°mlØÏ…y ŸÝ±ó3zÔþ+bA•ÛXþkPHl\L/y6¯y•­Ë w'‹!åÎceÜ(BÞ¡€wëùb\©„K=9öðŸgeɃ Á“$#öbq*îy |ÃÑÕÌ"”7+îÎ]«…<9ù´®—Àê4Ǧ/Ú*§É‚k‰)ÀÇ,jÑ"BÐ<~5¾]”¢úý´'ÿÁ5*lq˜YUýd»l¬ß¬²›{jÈ5‚ï*;–ìd 1p¸¯‡ã¤¦Æào~Åcx"ÍéŸ-îêÿ÷á×)—ÙœÆ~•¿• × ülXü ê6Ýendstream -endobj -3710 0 obj << -/Type /Page -/Contents 3711 0 R -/Resources 3709 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3708 0 R +2107 0 obj << +/Title 2108 0 R +/A 2105 0 R +/Parent 2059 0 R +/Prev 2091 0 R +/Next 2111 0 R >> endobj -3712 0 obj << -/D [3710 0 R /XYZ 85.039 781.388 null] +2103 0 obj << +/Title 2104 0 R +/A 2101 0 R +/Parent 2091 0 R +/Prev 2099 0 R >> endobj -1566 0 obj << -/D [3710 0 R /XYZ 85.039 761.463 null] +2099 0 obj << +/Title 2100 0 R +/A 2097 0 R +/Parent 2091 0 R +/Prev 2095 0 R +/Next 2103 0 R >> endobj -3713 0 obj << -/D [3710 0 R /XYZ 85.039 741.134 null] +2095 0 obj << +/Title 2096 0 R +/A 2093 0 R +/Parent 2091 0 R +/Next 2099 0 R >> endobj -3709 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R /F56 1642 0 R >> -/ProcSet [ /PDF /Text ] +2091 0 obj << +/Title 2092 0 R +/A 2089 0 R +/Parent 2059 0 R +/Prev 2067 0 R +/Next 2107 0 R +/First 2095 0 R +/Last 2103 0 R +/Count -3 >> endobj -3716 0 obj << -/Length 2860 -/Filter /FlateDecode ->> -stream -xÚ­ZK“Ûƾï¯Ø#X¥…03xr°K%'Z)YVÉ.Û‡!’È‚ €¢×¿>ý|n)U-¦çÙÓ¯»‡R÷üS÷iä&»ORå›4½_nï‚û5Œ|¼S2#ŒŒ…!´/ >¸Ñ‡XûA˜\š£_'æþA‡~ÐŒwó»·tp¯?ŽÍý|E3çù¯ž‰üÙCÞ“ÝΔ·°³'Þ>Ê+ÚU33×â­—–ݾèf¿Ïºûq>2çNý@]d-€9Æ70çßÊø™Š¦|«Ð7a|·BÎÃÌ{ßlwvì¶e×Ô×™Ò~’f7å¥ü(6ùÀ‚ -@‚ÙôÜù…`2ï E²é„efR¯›= È¾Ït -îÛwöv¼fþþ+7zXÜHÓVÏ<·w=•S–¸ºº¤}Ꙇq¸wÀ -ž´—½Ëïò‚Íž ÛÊ>} {¼”5ü]KœÖÅñeDM)´´Œ® ö7%p§UÓnéÜÀ;Ðu« -(àm<ˆn-`?g²åkØ*¼Ñ ÷Ò Aƒ(Næ6ðJ z&6á»k›uË"yj‘”•™$j\=Ê/ð:ž_¸MPî¸%pÉ#'þôÂѨfdÞ¶!µöH¥^Ëüç¨ê…û,^ùû,Š<‹|WvQÉZ¼²mQVØbã5¿*t³H5¶îVE+îVH ;¹Òó÷H|•£[é]¡ÀvÜvgغA3ÛÀ¶çúK4`¼l¡9“hÕŸßa;ôºAÝlÒŽbq‰kL7ýj5tˆ‹=šTŠ#=»FÏ”]Û²îdJ×liDQÖkžR•ÏÂαÜù8g¯ô7”Å7Yqê’t< ¥>cU{‡­¡¢ë=\¸ßFTÍ<˜(aëŒb ‚³ ÜB†-¹Œcç¾çö A&ÓÔÜI·-墜©›yåÍ–U \ÃÙ²O#sŽïˆ˜¨Œ÷¥½ÊNÖŽn ¶t9 ªï~l* çúûŽ´AØâP  }‰=ŒÛ0O#¿0Lž— žGÝ¿QÐí—h%ÙXí±è#ì #”0Yɤ:çƲ!güà@«Ç[Â$tj,Èõ‹s‡ŽA_e~ËÀ?uÑèªpb?@&P…Í1/= £#èæ<£ß _cë8|`Ï9ÄÂ_‡vÃö嶬,ŽTÂy|Wèÿx¤;¡%ˆŽ@æšyw;ŽàÊá! ù„ÂwçaB)Yú„žó© =;$h¤ÏBðÛ+Ûõä‰Ðf «™xüÄÓÞÛV=¶ÞL¦¢‡!q G/ܹ¥`(vtnÅy1‘/i¤c”#äsšd߃÷‹ƒß¾ U\5§BЂ]kȧä¸fG8Çè=yS³¿#áâ )—±„†;ÃíY§¸3BŽL, [ÜIî¡!9zl¦§‚öÐxAÊò89/ ¨ó¿QŽð8÷¯šÉ'X¨£M¨½¥e ê˜'ç¸lQ~cP4YÀ)©±Ôð×YiN›ØbsQuÊëD’Do} à’ »à붨sòVDŸsE’#÷ýðΦÎWÓk¢^0rqæ4Ýy½q¥ô.@’g/L¹I1½\³Óçå€ëÈÉÒ…ÝTYÒô$ÝCÙ_M¿í¸Ç›«~ábv$ÞšD€%h@X…¹qúj‘ N¢;a#/Ö-½(<­7ZH ƒíÿ` ÙÉ&\ø%G¤7õ61â8bà¡š¶-–òx³%KA.…~ÂÓ6 Nš¡£ÎGyr!3u®DÕd×@ד¼•äú|7CÀ£‹æ†©‹ ÔF,?‰‚ -¢È6…0—…ôœ÷Çݯ¿÷9ÄŸîßdéýÚ¯ Voï EE¦ª»§» {ÉÈíHùøåï?•þùÃ,5Þ/ÌU*áø” -“NªÒBçµÅÖ-hø;úé6`íëBS°cÒãÌtÌ5ÇàPˆ/©'•'(| (DƒÂ‰ÇzváóhÈ?sÆƈÓ'ÎBÀ_Éî­TYM+ûrDÙx.ÈpáFkvr ÃuOSŸû·f‚>†S}É.ÒÔOÑØÀ>ÎÑ^3‹$¯˜EOÍâè"çf‘E`ç‘ N|º€““û,ª¡YðžØ€|(ç–ˆ¾½ P<£U¨¸þVGÉ’¨ˆV2dPp(ñ:s¡ÆÙH60ñ‘}î*:ѲêXc¡¥csZâÆ.©¢R(NÓ¸=TôH¸¯˜K¬ùæØõ¹t—k›®YÉ°{DSÞÛO_å¨Þ -XÐ ·eçÞ¶<Èyœ•ŒÖÇÆy‚ŠýrÇ@ö^ŽþÇè"§†–_!…‘GÿbÀH1ðo2¬:¼À_¬ñ+U@ðÊ/C&ÒÿÃ/_VpÏ}62°2› TGðöWqÁÜÃÔÏÀIyö4¥G=i3`¶OÞ,è¹Ëî„›ùÉõ™‰É»<)åí¡uïPü‚‚¯»ô|6£jŸ:Σ’ÛÌæÝÛƒ;v±_ûi=|J®£#Ïn›ýðö ”>B?§O–‰Éãæ0i|ª³µ»ÇjúàÑRõ3\N M¶ÞÉÓÓô´!W‡ö½êCã8÷ï¸a—ûv’5!ïüÎyV@=a8x‡Ó¦RƼ_ÇGƒ$lüYÄâê bÈMBñ,襒|U^{ñÆÂgeÛ5•šîv¶ž<+vo¹{wûx’úÖ'š:ù…àÆó7(¨tµZáõzRÄšéAØÐÎYÇA:]Íà'3ÊžÇ7V¶“T­\Îy˜ÙÄÓ6M5'Y4L]µ˜¤Ÿrrnã¨'EõÙù]ñ¥Mg‰€o–/{L‘ëÁ—$B7ÁNÞ™qß ¢‹áœ#±¡˜:î'±‰µ#M? dã;¶‰éĽæ=3O™8ìÑÄ tL¿Yœln†(â›j-$eÃÖŠ~'Ür–›—Ο¯¿ü¨@AÖ©¦˜{†½*õ©ò»‰ºÚ¨ÓC´ :Oþ?€ûþ€ÙÏendstream -endobj -3715 0 obj << -/Type /Page -/Contents 3716 0 R -/Resources 3714 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3708 0 R +2087 0 obj << +/Title 2088 0 R +/A 2085 0 R +/Parent 2083 0 R >> endobj -3717 0 obj << -/D [3715 0 R /XYZ 85.039 781.388 null] +2083 0 obj << +/Title 2084 0 R +/A 2081 0 R +/Parent 2067 0 R +/Prev 2075 0 R +/First 2087 0 R +/Last 2087 0 R +/Count -1 >> endobj -1570 0 obj << -/D [3715 0 R /XYZ 85.039 761.463 null] +2079 0 obj << +/Title 2080 0 R +/A 2077 0 R +/Parent 2075 0 R >> endobj -3718 0 obj << -/D [3715 0 R /XYZ 85.039 667.044 null] +2075 0 obj << +/Title 2076 0 R +/A 2073 0 R +/Parent 2067 0 R +/Prev 2071 0 R +/Next 2083 0 R +/First 2079 0 R +/Last 2079 0 R +/Count -1 >> endobj -1574 0 obj << -/D [3715 0 R /XYZ 85.039 667.044 null] +2071 0 obj << +/Title 2072 0 R +/A 2069 0 R +/Parent 2067 0 R +/Next 2075 0 R >> endobj -3719 0 obj << -/D [3715 0 R /XYZ 85.039 639.536 null] +2067 0 obj << +/Title 2068 0 R +/A 2065 0 R +/Parent 2059 0 R +/Prev 2063 0 R +/Next 2091 0 R +/First 2071 0 R +/Last 2083 0 R +/Count -3 >> endobj -1578 0 obj << -/D [3715 0 R /XYZ 85.039 406.978 null] +2063 0 obj << +/Title 2064 0 R +/A 2061 0 R +/Parent 2059 0 R +/Next 2067 0 R >> endobj -3720 0 obj << -/D [3715 0 R /XYZ 85.039 377.574 null] +2059 0 obj << +/Title 2060 0 R +/A 2057 0 R +/Parent 455 0 R +/Prev 2027 0 R +/Next 2119 0 R +/First 2063 0 R +/Last 2111 0 R +/Count -5 >> endobj -1582 0 obj << -/D [3715 0 R /XYZ 85.039 172.114 null] +2055 0 obj << +/Title 2056 0 R +/A 2053 0 R +/Parent 2027 0 R +/Prev 2047 0 R >> endobj -3721 0 obj << -/D [3715 0 R /XYZ 85.039 145.5 null] +2051 0 obj << +/Title 2052 0 R +/A 2049 0 R +/Parent 2047 0 R >> endobj -3714 0 obj << -/Font << /F20 1617 0 R /F15 1628 0 R /F56 1642 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +2047 0 obj << +/Title 2048 0 R +/A 2045 0 R +/Parent 2027 0 R +/Prev 2039 0 R +/Next 2055 0 R +/First 2051 0 R +/Last 2051 0 R +/Count -1 >> endobj -3724 0 obj << -/Length 2979 -/Filter /FlateDecode ->> -stream -xÚÅZK“Ûƾï¯à- K„Ì 08ø ¹¤D®Èv´ëJ¥l°$–D Ö¨óëÓ¯$¸{“ÔVƒyöôóëÆÆ‹þâ…5a¤òEfãPY»Xïo¢ÅFþzËŒh¡Ã(58ôæîæÛwi²ˆ£0òÅÝM¹Ûü|ÿ·×?ß½ý¸\)¥eÂå*Ëlp»Œƒ×Þ¼Ænü oo?¾[&6øéãúñûå -úxÕ{œ}ûË[ü]þ~÷ÃÍÛ» +êT!Üüú{´Ø?ÜD¡Êíâ ÚQçùb£ -Vò^ßÜÞüÃïÂczÁ«f®ºÒ± \p¥¢ÐZíï›™;ßíª~¹J’,h—ðó/Vvuñ7x¬à§Ùòð·ô|¢6¸‡G”xû~p“àes¨·áÎÞw%¯éá 'Ðød¯öçb§pGÑ,q"µ›r@òF”Èœ5.X3%²aÑ•roº«K|xÃ=ë–Ü#ÏD‘Qâ6þ…†ŠLÓÈŸC£?9²|Bòg—!ÞàÌ ]ìgè肺çblìż’x,!|=ô†Cl¢[¼Wça»xqÁdk@_+çÅà>ß͈(C¾Ê2q´èãñ$p4_çkw"Ñý}¸n›‡™}5Z˜›‡.²Á-ß'ñŽ7f.’‚n÷U' HlFQ<Ñ€)»ˆõÆs:IL↔¸Iï–ÿ _Î>¾çùD - -^HP€® -Þcâîq¼X“ –Ä2Ôh÷h­²¾i^ÉxÃÄ3D;¹ô’#RìIÑL|³®«’ò7Ø“S6ÅaˆTé8 îFh·½æC`èŒTt%߶r®;G:o)á€Ä0ñex…–i›p±+œy¼vN×è„!õ1TŒ·†×]‹cí¡ë(«¤U ®Â¯÷ˆ¡ód}1JÎÕµ<¼RV±ŽBé?ÁGo1WKg—ŸËúêÁI˜åÏ"¤84é é=ˆ_GÉiFNJ8sÓ‘"A#mØÏ -Ã⫹ ­“P=mÐrç'Ì= 2?5ÜSôs7.šXÈÚ”÷<'Ås>#JE»ŒŒ)°!Neš=Bqp»#„înQ‰ôQXlfÀ7²íĨ0I³±q÷Ÿ £ABXðƒsò-úŒÌ|iy¨jø)Ž¡{ pΧ5KÁ¡eÈ9Ï å¸ ?µSÑuqp¦„½¤ÁØàÎÎ''Ødo{>iî'+-¶a…& ä×â|T7cáe1ÎÞÛ3‡G î+)쪳\íÒz¹ÓEyB’–rœG{W1Ï]× @Sjò 3yÑ0S1Ìe±áÌ¥+– -aÌ+s¹›…¥IêÔ¡ÀŽ‰±LLÂÄœmgâÐ9ŒGgă<θæ¡ì)L÷ÕÖ£þ Ïaož‚.(dñ“{.s•›W<\³á¯j€ÞÍúÈ#õÂ×Sj¿ñ{±y¬Øø2ɱ2éœ^À -,c¦—Ú}cS¦QAÆ`ò˜„¨Ôðõ`œ‘&îvx\ú<¾“NŠ®x¹ \L;-3ȹB“S°j ¦¦â;{>}zØRò¿3kCw1ã9Ó0ͳ3¥PÏ+EfÏs”¢v†Jø[Õ)ZŠÌ+WD,›â¾žè‡rè“æŸÃ=Æ$$M“AT²cOŠ\#à hiàÆ(ˆëÔAÖêTy†cÒƒ¿ üÆ^~ÃÚ5Ã*P¥D› ¯Œz–W:´:‘"à#Ÿu‰•$@I’¦¹”/î¡”N<Â<¬õŸÊNl¹+ªÞÕË¥šNiœË÷Á¬GpWˆ”¹/탟šZTi(ûÁ{Ýý.G8Mô=׃wž‡¤úõ¨:“àýOŒØ]%ùÖÿ1ˆë0Žœf=ч’eÒè9_”‡™÷EÁÜ%“\o²Óñ¹)½Yoü2ƒhCøôÁ\[æØy -æþ‹(”ÁÂÿ(ž;=_‹7Ñ6¥Ð^—¼Ë“ÿî1HíÉ*p¦zìúg! Öß!¼RýÝ\u¥”wgt&L¸辀ήŸNë±MãT–ì¿“ÛMœÈ~Þ ¦ß|„@)ã›qxgêÆáý2ŒC¬ŒQr6¶C°ŒòxVW^ˆñi«ôäÿn -ªØž9ú=ù" ò2«ÎÔÍI¦¸µ@D`ðŒw‡¼6M̦˜±—ŸçKêl¨ŸøL&c-12œ_Í]O]5¸{¿’X+³ÇxWh+z¹³sÿÌk³¥gEX”O/ò9ÕP„c…³»méÊ’'’›¹^‘AÂlìŸàX­8Ö[`£Š9¨fX¼¨šþëŠêy¿z;BO+¥1ÍØV.äAô™û‹š?á—|~wŸú2ª-Êüûú mâ·¶‚| Êp´—½á^"ü= Ç>±íàòjOÒæÁ/Sp†g¸OOЮϒˆ~ø?’Ns ®œË-êãЀW3÷™é±èû% -Œ4™RíK*õ<îIµsü…ÜÄžhý;…¯ÓÅNo^ç@b5ÿ?,rϯûÿ•…#wó¬ö$*9§R(‚Ó€ÿËè}£endstream -endobj -3723 0 obj << -/Type /Page -/Contents 3724 0 R -/Resources 3722 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3708 0 R +2043 0 obj << +/Title 2044 0 R +/A 2041 0 R +/Parent 2039 0 R >> endobj -3725 0 obj << -/D [3723 0 R /XYZ 85.039 781.388 null] +2039 0 obj << +/Title 2040 0 R +/A 2037 0 R +/Parent 2027 0 R +/Prev 2035 0 R +/Next 2047 0 R +/First 2043 0 R +/Last 2043 0 R +/Count -1 >> endobj -1586 0 obj << -/D [3723 0 R /XYZ 85.039 664.197 null] +2035 0 obj << +/Title 2036 0 R +/A 2033 0 R +/Parent 2027 0 R +/Prev 2031 0 R +/Next 2039 0 R >> endobj -3726 0 obj << -/D [3723 0 R /XYZ 85.039 637.583 null] +2031 0 obj << +/Title 2032 0 R +/A 2029 0 R +/Parent 2027 0 R +/Next 2035 0 R >> endobj -1590 0 obj << -/D [3723 0 R /XYZ 85.039 483.53 null] +2027 0 obj << +/Title 2028 0 R +/A 2025 0 R +/Parent 455 0 R +/Prev 1923 0 R +/Next 2059 0 R +/First 2031 0 R +/Last 2055 0 R +/Count -5 >> endobj -3727 0 obj << -/D [3723 0 R /XYZ 85.039 454.126 null] +2023 0 obj << +/Title 2024 0 R +/A 2021 0 R +/Parent 1923 0 R +/Prev 2019 0 R >> endobj -1594 0 obj << -/D [3723 0 R /XYZ 85.039 397.708 null] +2019 0 obj << +/Title 2020 0 R +/A 2017 0 R +/Parent 1923 0 R +/Prev 1971 0 R +/Next 2023 0 R >> endobj -3728 0 obj << -/D [3723 0 R /XYZ 85.039 371.093 null] +2015 0 obj << +/Title 2016 0 R +/A 2013 0 R +/Parent 1983 0 R +/Prev 2011 0 R >> endobj -1598 0 obj << -/D [3723 0 R /XYZ 85.039 257.688 null] +2011 0 obj << +/Title 2012 0 R +/A 2009 0 R +/Parent 1983 0 R +/Prev 2007 0 R +/Next 2015 0 R >> endobj -3729 0 obj << -/D [3723 0 R /XYZ 85.039 231.074 null] +2007 0 obj << +/Title 2008 0 R +/A 2005 0 R +/Parent 1983 0 R +/Prev 2003 0 R +/Next 2011 0 R >> endobj -1602 0 obj << -/D [3723 0 R /XYZ 85.039 144.767 null] +2003 0 obj << +/Title 2004 0 R +/A 2001 0 R +/Parent 1983 0 R +/Prev 1999 0 R +/Next 2007 0 R >> endobj -3730 0 obj << -/D [3723 0 R /XYZ 85.039 115.363 null] +1999 0 obj << +/Title 2000 0 R +/A 1997 0 R +/Parent 1983 0 R +/Prev 1995 0 R +/Next 2003 0 R >> endobj -3722 0 obj << -/Font << /F62 1689 0 R /F15 1628 0 R /F20 1617 0 R /F56 1642 0 R /F35 1632 0 R >> -/ProcSet [ /PDF /Text ] +1995 0 obj << +/Title 1996 0 R +/A 1993 0 R +/Parent 1983 0 R +/Prev 1991 0 R +/Next 1999 0 R >> endobj -3733 0 obj << -/Length 615 -/Filter /FlateDecode ->> -stream -xÚ¥TMSÛ0½ûWè(¬êÓ²Ž ´ÌPhb†åà8NðØ©cJ~w%'’réd&^éí®ö½]I?A2ørÄf‚©,#å:âd Èe$N4ã©Aè<¾\¤’Îw$_x—|þ@G_Ïnóñ$N”RT'Öft zv}~†ÛšÞÂj<¹ˆeFo&×}Å ì…¨oè=½ãü˜_Eãü †D3*,âWôðÈÉ꼊8S.#¯`s&œ#ëHÅŒVÃzM£û,Ó$D šì<ᘓ攴LZ q{U$`š)ªB8ÂhGG«ˆUMdSKû—©ã^³üÈ6Ù!™uŸÕ 3ÐŽ] ÂœèÌÍÎè+< Ž”™£Eølqk¶¥­æaÓA@;[UkX;NK‹!v¶óG¤ïŠÒ‡‘};|Ÿ‡rUW ö»´t4Gï'â ÷ -ÖõP øôúÉ ÇÒÛ.¬«?Åz³z ½¯›9˜þƒ·(#NŠÀ:O~ᣭ ÷q¦!Õó²k_ j³…ô!IKÏ Œö½RõÆÖ*¨KЗƫÐ>3úd´êûª iòÑm0m;tt=È(éÊ+¢éè©*cp{Ù‚tì»S•}Ý6ïˆÏ«mÂé-ñzýŽMJ‹®ö·a菉V7çNˬ´~þ¸ó“ nI‚1¹üdҦś1+BmôÇ7±çÕ…Õh?Û£óaž‡ûy8óÿ>ß›4õ ’4͘ ÏÅñs6ÌÇÿ=%Ê2‘ígíÓ(•:b -u¦ˆþúœ>Žendstream -endobj -3732 0 obj << -/Type /Page -/Contents 3733 0 R -/Resources 3731 0 R -/MediaBox [0 0 595.276 841.89] -/Parent 3708 0 R -/Annots [ 3736 0 R ] +1991 0 obj << +/Title 1992 0 R +/A 1989 0 R +/Parent 1983 0 R +/Prev 1987 0 R +/Next 1995 0 R >> endobj -3736 0 obj << -/Type /Annot -/Border[0 0 0]/H/I/C[1 0 0] -/Rect [229.043 698.057 352.339 707.625] -/Subtype /Link -/A << /S /GoTo /D (Other-Clients) >> +1987 0 obj << +/Title 1988 0 R +/A 1985 0 R +/Parent 1983 0 R +/Next 1991 0 R >> endobj -3734 0 obj << -/D [3732 0 R /XYZ 85.039 781.388 null] +1983 0 obj << +/Title 1984 0 R +/A 1981 0 R +/Parent 1971 0 R +/Prev 1979 0 R +/First 1987 0 R +/Last 2015 0 R +/Count -8 >> endobj -1606 0 obj << -/D [3732 0 R /XYZ 85.039 761.463 null] +1979 0 obj << +/Title 1980 0 R +/A 1977 0 R +/Parent 1971 0 R +/Prev 1975 0 R +/Next 1983 0 R >> endobj -3735 0 obj << -/D [3732 0 R /XYZ 85.039 736.911 null] +1975 0 obj << +/Title 1976 0 R +/A 1973 0 R +/Parent 1971 0 R +/Next 1979 0 R >> endobj -3731 0 obj << -/Font << /F62 1689 0 R /F20 1617 0 R /F15 1628 0 R >> -/ProcSet [ /PDF /Text ] +1971 0 obj << +/Title 1972 0 R +/A 1969 0 R +/Parent 1923 0 R +/Prev 1943 0 R +/Next 2019 0 R +/First 1975 0 R +/Last 1983 0 R +/Count -3 >> endobj -3737 0 obj << -/Type /Encoding -/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/exclam/quotedbl/numbersign/sterling/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/dieresis/visiblespace 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/dieresis 197/.notdef] +1967 0 obj << +/Title 1968 0 R +/A 1965 0 R +/Parent 1943 0 R +/Prev 1963 0 R >> endobj -2908 0 obj << -/Length1 892 -/Length2 2242 -/Length3 532 -/Length 2868 -/Filter /FlateDecode ->> -stream -xÚíRk8”ë–#96%í|5Mæ`0 -5sΧœ—1óa̘aÌ`¨†"§HŠ"¬’J,r( *ç"äÉ)„dOµ[­Ýú¹÷¯}íïýóÝ÷s¿Ïs_Ïý*í¶°VÁ‘èî >ÆTA#ÐZÞÔÈÆÐDI Ï L2¦K`‚ZZS àXžúÕRûEK'ðt_6ƒìéÅöáa_DXç2ÈD 0%0½@^" -XÓ‰dÉF8*°úrðýAFHB@Ðh€D&2wГLƒ ¿X2¢yÐì7šÄòý^ -þžIÀ³H¢Ó¨l€z@ftÞ,çä¿aêçæú,*ÕŒàó¥ý·5ýM@ð!SÙÿ’Ð}|YL˜ÒI ƒö³ôøÍ)H"³|~®1 T2G󤂀 -Z RûÆ“ýõÉA É‚Ì$zL üJƒ4ÒÏFxÛûji­kjkeÿžëתLcÚ°}AõCþ£`Þ–ä À …@¡Ð({w¼>ÄÑ-Y/&ËN³Þ4Mœtvår¥®FÜ'#z¬G~Ä÷>|ú¥âÂ@@•`¡É[4öªìTŒ@þ‹®µù“NÓ`h -Iq4âråIh7>аò΀žCïÉ{²Í9mAúslMÿsJŸXªfìS>S7òö\Ѹ•SrþCÛDs‡ªS™âçnŒ¨¥X?‘Iž;HÇÀbž9±iëøÊ:TË­°õsØyê’æ%g—!ÄÂIn¦»åI.fÒ±û¤{¯mˆOµYH²|?W/éNÖÛÑãtRŠ··¾×^b¿›¾ZfÚ±ÃÑZrÖ”Ôwcp™? ÙL>ôM0 …ææþ{L‘âÒ¡ú´°Á»ƒyþ¶îà ó•FõχÉPŽbNPΊ$X¦)‡?œ³þNB}íÕ% Ä \-SjëÏ·÷"$˜/®7{LJžŽán0w42d¯>fÅ‘£ ¼¸Í‘‰eøK?6†µž™¢ìM T¯ÐÚ3cphYþnaQÝØu9¬Ö«ý¢ +uíõC6ͬtCZÍ Ë ô;]¹Övqܶ`E½ðF ·(¬Æ/õÕ£wˆZYHFïÜ%#znÎØàhôló»"ËòϤ†|Â¥ËÖ‘ÖšÐ{œ’?DaÛ§fŸ´½™)Kâ­ðλ»uS~n]ñ¢2òÐÐ@Ò-i…ê¼m™ªNmEï›È‹Ñër㯜_Úúe1ý*©†çË‹ªLŒåüæu²sÕ–ôÂäü&b–Ô6Í#®˜Ýz´’϶:¸ýª9Ëu¼YЧÁ¯˜?±cµa¹ órØË—e[ܪ‰[2f6nõèFlé²úòøéPLꦤW”14ñ¦Cu^NæfÞ'!nÃo‹ÔÑI²]è/ºŽ™ýÛ—á9ÂWÑœÊG5sšèHíâ3ÁñIáìÁ‰¥ŠÎÜ?$¹¸?Š…ÔW©3;K»öº·f'‹ëè5–'H%ß¼%Ñåìþv"D^ê° ºyD}µºM[õh{çêþ½' - ›¶£À2ɨ8|Óæ³ÐôNû¢t`dC~I¤¹¦ï± Bceü|Gˆá×(ë4Å Rb_n¤´¾H×ð±ð4ÅŠß^¡µ¦«ÁCü㩨Çj‡Î€Žk¶Ümõ{–Ì(îºÃé{5pÖI!YÏÚ†•8­ <¯“dˆÁ+xÊ&v3ùÚ6œ)ßôÔdx•ß%ìZÊ®°2K¿ø(Äl§Ùó åܳ.«K|Ÿ™ù¹Ð»[´aTïù:UÄyf»çH(çkîj¾×BÈèÖ¨êáXÞÝ?QZ¦2êeWQàZ—íRõÊä‚‚_fFç§n¸™7d·¦~º'ÔŸóX;tµLåÌÎ8$Ì™Y9ÑÜd— X±çî£èèB;îU{œtëIV—Ĩ“ânS¹”#ŸÆ’z]lvk³²W W냣۶¡yJ:»däPm¸ç‹:LjæõY}ÎR÷Eªq禎¹¨c íhb{ÏbY“|ƒ ¼Þ8Õ{²EaöŒq™êkX:!”®—›;§lx.¦.ŸayÅ[¾±.e¡ ¤2J@ŠžÐ0’×þp]Cs;yL1õö´›”­‰ÄÖÖ)GÙbଡ଼ء'šYÅ!»U–3Š Ë-EÇö á[Þ¨þ=ÓmÙýΣˆ‘ÖW ³Š‚8¥Þ©c¾6Ǩí‘|°ýÈ®%N‘VÜúîÚÇYO…oûá:Ö™ß:«¬V¯ŒUL\/ºÏ-5´Ã+Ùދό۾kΖÓhôéôÑ–ñGŸŸùØPšk,¥šçº3® õúw¶Rv÷‹Ö=BùÀ ÛÃ÷`"b>\úq¡hÔ¡ÖØ ½o:”V–f2oϽ˜t}­è¡aåyœOé´L¹ ÿÜÆ‚³%µÁ²gΈ“ɹڰKnÇ΂ûƒ6q¡6Ÿû¯&ë5á„…0FLóøØÃ%@kºCpe„þ.§NækÙèÑâȤFt§×~˜]Ó%öº2eP©kIBìZlIBÜ]'Âã!:«8ÒSðì%ÿÔMåÙcŸ®÷»±k¹ùÈzʸ‡°?jFþ1ÂEd+ÞNV;eÒVÛöö>ÅåìèfÝù bÊq~š>³Êu|9ŒÒ8†òÊ­¾üÙR¬_Éß$3W¨$;»¬º¸î.‚2ðÜLƒYüºWsö½àÓNV=R'-ìCuÕÅ™ÞÊÈì³Ó;Cœ,ðÆ;‡NóÖúÖ"—êßÂ¥Ö‚Ü$&{ÏA m…³ïýªPçÍÌì%¸kÃ×ÓÝbÔÌ8‡cGc®M ½ŽŒ+ïžÍ -#Š¼„õÀO„¯zíÕÃŽdQJS pRc€æ¥ÄÁJ½Ï‘ÙÉöãð&ˆÜÀÆš0[T+ÆnV~^úÊ+êM‚Hc:ÔáBÉ”Ý8\ظàHõ›@žÐqI–ÎÎ/6 ô°[L‡µ8¶çužv¬=Uɧ±¸÷\Lr‹ ödïúæj—XÅdƒ -¾S'Lü=?N^‡ºA_]ü5Ú¯ -Rÿ –òjó‰HÄØa[GöÕ¢l[óÆÇ¿r3Ô§ÖÇ:w­Tñ6 ½µ¥*}·%ýn ò¯á.ð‡µ¢uIo„t¯ógmÛ&‡?ß°%Ù`™¿BªyØ× /,Ž­‰ÄÙ_}«©-£n"Øå‹2sÅï–ìFPþè¸Þ½jÑ­PÓ¶¤Û+\ìx¦`t¬:^ëwäôš©ü¤ÓÃO~ZÁw̦“E+ãŸMûXPŒµÁ´sf åqäƒuûµ¶ÒÉÅ­ýt·„äí"9d5»¾Qpj͹[%Þ}âµLXÉ›÷]ûQB·Ü;eÚì4ù>Z¨D£þÃòÿÿ ˆTÀ`Ò} -䟢×endstream -endobj -2909 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 3737 0 R -/FirstChar 46 -/LastChar 116 -/Widths 3738 0 R -/BaseFont /SDMURR+CMITT10 -/FontDescriptor 2907 0 R +1963 0 obj << +/Title 1964 0 R +/A 1961 0 R +/Parent 1943 0 R +/Prev 1959 0 R +/Next 1967 0 R >> endobj -2907 0 obj << -/Ascent 611 -/CapHeight 611 -/Descent -222 -/FontName /SDMURR+CMITT10 -/ItalicAngle -14 -/StemV 69 -/XHeight 431 -/FontBBox [11 -233 669 696] -/Flags 4 -/CharSet (/period/slash/a/c/d/e/m/p/t) -/FontFile 2908 0 R +1959 0 obj << +/Title 1960 0 R +/A 1957 0 R +/Parent 1943 0 R +/Prev 1955 0 R +/Next 1963 0 R >> endobj -3738 0 obj -[525 525 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 525 0 525 525 525 0 0 0 0 0 0 0 525 0 0 525 0 0 0 525 ] -endobj -3739 0 obj << -/Type /Encoding -/Differences [ 0 /minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/arrowright/arrowup/arrowdown/arrowboth/arrownortheast/arrowsoutheast/similarequal/arrowdblleft/arrowdblright/arrowdblup/arrowdbldown/arrowdblboth/arrownorthwest/arrowsouthwest/proportional/prime/infinity/element/owner/triangle/triangleinv/negationslash/mapsto/universal/existential/logicalnot/emptyset/Rfractur/Ifractur/latticetop/perpendicular/aleph/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/union/intersection/unionmulti/logicaland/logicalor/turnstileleft/turnstileright/floorleft/floorright/ceilingleft/ceilingright/braceleft/braceright/angbracketleft/angbracketright/bar/bardbl/arrowbothv/arrowdblbothv/backslash/wreathproduct/radical/coproduct/nabla/integral/unionsq/intersectionsq/subsetsqequal/supersetsqequal/section/dagger/daggerdbl/paragraph/club/diamond/heart/spade/arrowleft 129/.notdef 160/space/minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus 171/.notdef 173/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/spade 197/.notdef] +1955 0 obj << +/Title 1956 0 R +/A 1953 0 R +/Parent 1943 0 R +/Prev 1951 0 R +/Next 1959 0 R >> endobj -2563 0 obj << -/Length1 779 -/Length2 1014 -/Length3 532 -/Length 1584 -/Filter /FlateDecode ->> -stream -xÚí’iTWÇ¡JÔ¸îXûP£B–‚x € ÈVCæ% Lf`2hÂ&J\¢GEPDA\pQëÄh‘*Ç¥à.¦EÅZ¬X  Oõcû©§3óáÝ{ÿïÞßüßc[Û{ D,ô&pÊžçÀs"Ïà¥<.à9p¹L6[DB …¸—„‚n€'òo2øŽ€Ïs£?ž+“ DD¢šDåq°Íì €‡’¨T‚ t©Á„…”Úx`XÜ·C C%$—CÄÉã•R ÊQœÉécòÁe ¤‘äÄ¥åTÒPÀ¦r& ÇÔ2&'€ ‡Aåß ú¼¹w2†H}íŒúB Q ˜ú/ ¡HL¦ ü ’øçÒ08@çI`_Ìñ¡$*õÀåö<'®£ó@Uz£*ˆ¢”4È$˜öç!Ž|BÛ×Á \¼0Lb÷ñdû«§BÔ‰p?ÉûcÞ§˜v‰DU ’K»Ì£…ôûqýÙ´¸”@P\øÎ.@B’5“¾Ctä RyŨPE#sp‚¢·Ú™t #Hfß¹òh.N¬Dš Ä$ʸ¾óË¿ñô$T©ö|°:ÑÍùÀ•ïœþwáMJ†>^À™Ëå -\øýYi2IBœê¿F´ScJ» ¡ -J™ïÒÙšøgÖ–f,(¾}ÄÌÖÔS^‘P^ÝpaxÖƒ­¦Ø¡ëâ$[ýÉðwe»,G½0{ñÍŠ÷VÊ çÓ‚nx¿Z•”×øbù²»RÎZ…¿Þå¯nNœÒ•Õj~îÌ7gÓEõúºÒmKÔìn¿Úº/ÐÆ+ä—!Ö&ºÈå§tA¸÷.lɺ5'§;Z/få'•®wZ÷dk[Îà'·²2â× ­´{ÜAœO¶xW‹M*K¬*a{ˆ·4«m¦§Ç\t­¹”Û3hp«Voa¾Ê…sº¸*c—Ï¹í¶¹hîq ‰ ?SþÊnèNÇꄤ§9>¥Šˆ©Ûõq)#–U -NÃÔìnÄvÆ ÁóÞw«ƒ*®@ -½ÅÚ“22;!¿ðZnUˆB4bušÞ¸iÚ¹½M~©¯ §?û©Èßs‚È¿~ûõÂL§ªÚÐWÝÁÊ3k瘯ùØ_Ø:içŽúörÑû†,ÞIqJþF“áÄõ™Š™k4 .Á,Ø”Uõ³bHæé–È„ªÖYlÄïZ²^‡. ÄÄë;ßabÙ¦’ñOÇ!ã›*]¿nËQ¯|WÖqxvË÷ƒ†QñöþÙ•h7± ;z†¨å× ©5†1Áº¨AuYÑ×G›䪭­“^ ³=s{cãä ©zø`ô<î?|˜ÿ7øO4bPBR„BB&0ÿ!\\·endstream -endobj -2564 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 3739 0 R -/FirstChar 110 -/LastChar 110 -/Widths 3740 0 R -/BaseFont /PRGWCT+CMBSY10 -/FontDescriptor 2562 0 R +1951 0 obj << +/Title 1952 0 R +/A 1949 0 R +/Parent 1943 0 R +/Prev 1947 0 R +/Next 1955 0 R >> endobj -2562 0 obj << -/Ascent 750 -/CapHeight 686 -/Descent -194 -/FontName /PRGWCT+CMBSY10 -/ItalicAngle -14 -/StemV 85 -/XHeight 444 -/FontBBox [-27 -940 1332 825] -/Flags 4 -/CharSet (/backslash) -/FontFile 2563 0 R +1947 0 obj << +/Title 1948 0 R +/A 1945 0 R +/Parent 1943 0 R +/Next 1951 0 R >> endobj -3740 0 obj -[575 ] -endobj -3741 0 obj << -/Type /Encoding -/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/alpha/beta/gamma/delta/epsilon1/zeta/eta/theta/iota/kappa/lambda/mu/nu/xi/pi/rho/sigma/tau/upsilon/phi/chi/psi/omega/epsilon/theta1/pi1/rho1/sigma1/phi1/arrowlefttophalf/arrowleftbothalf/arrowrighttophalf/arrowrightbothalf/arrowhookleft/arrowhookright/triangleright/triangleleft/zerooldstyle/oneoldstyle/twooldstyle/threeoldstyle/fouroldstyle/fiveoldstyle/sixoldstyle/sevenoldstyle/eightoldstyle/nineoldstyle/period/comma/less/slash/greater/star/partialdiff/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/flat/natural/sharp/slurbelow/slurabove/lscript/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/dotlessi/dotlessj/weierstrass/vector/tie/psi 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/alpha/beta/gamma/delta/epsilon1/zeta/eta/theta/iota/kappa/lambda/mu/nu/xi/pi/rho/sigma/tau/upsilon/phi/chi/psi/tie 197/.notdef] +1943 0 obj << +/Title 1944 0 R +/A 1941 0 R +/Parent 1923 0 R +/Prev 1935 0 R +/Next 1971 0 R +/First 1947 0 R +/Last 1967 0 R +/Count -6 >> endobj -2434 0 obj << -/Length1 794 -/Length2 1135 -/Length3 532 -/Length 1714 -/Filter /FlateDecode ->> -stream -xÚíRkTT×Â# PALyÄ’£a Ì †ÇP”ç^:qP†Ç0÷\˜¹w¸s‡ž²¢ *†€B0  -„Ð!Y± (P4 -¥F -ð(¥Ñ ‚bzêʪþluõž?wï³Ï÷í³Ïg·ƒÇwö…°D˜‹¡„3“Æäÿðð`?&€Á ØÙùã°@04@HÀÀôôt! - `¹†;‡íÊш€?&ËÀ‘¤d8øS5"wà+…qD$DA¸H†¥d ‘Pø˜‰ ð•HÀ~Í 9ØËa<†h&@ˆˆ‰p‚RèSÁ¨î›4¤½ÜJ‡q9i -8lؤÒ$„¡’ Áb -}/FvƒI/ÿ [¯ç*$’½B©¦üfT¯ „RD’ñ/ &•)áãè«Ò(xÓ&y­O0!” "_4Ig¦+áºÉ#r.¢‚!Bˆ’X(‘Ã<ŒB¯ú ãÛpA÷åŒà;½|Ú]žA‰ˆ  ¿È70óL†„#*à1LRH®—±¯t DE„ I€ÅvBfPÈ!"d1‚B° -À*Ò2†byÁä1†S4ïêÆt ,—kØM‚èIšÙ#ÃÓp¯ßÍÏSe93ÙÀ™Å&[±˜nÀÍÈùwáISÀÁ€Íðpwñdm°"ŽÃ(±1Tdn/±!£†a,¢ŒÝÃD^)g¾ü 17ðÓÛ—ô¨òí• ·: -Õ•^´…ＶÞÅ¿Š€m™š¥ —M+C›é˜=aõ¥ovoŸ^8jÖk²z¾Šo°$ZÄéôÕôtm‘ž+úaìïe_9-ýÙvùaz‡ÞçasL÷ V‹Åº÷ï­?ÎM=<01ft²® ÄÖü!¬Žœ}XzsíoAاØX}Ÿ… jÙüŘU׃‘Ô¿˜Tz¯ × -Í—ºÎ–Ø=”ãöMNW9 … å]ªŽÒÊükùYÝT¾õØq üÄ¡–QøÚ_©öEl}³K>¹jK¹ÔÒö.7UYZ1:õ3ekóûQO¼­<~ßüà63‹Ò¼¦„‘Ïö2ã -û-×wßZŠÞ3˽ÒR~äDT釻|–Š¿¾?Ø‘Ž¼¨uŸ&ãwF!–ç«}:˱mF=.‰AG2ºÑ)¾¨äÎdpnШ %.9)Ñ +a?̧ìé­ÎӺ武gÚâŠÁ©¤_4ÄÛ ÒF}uO²l|öpLˆ:UÍï. ½-&ߎ¿º=¥ø‹“z‹«Ãß|s|·HyÅ1¹0ãîÊ›«õCû"oL}b¿Ë=c>ã¡ŒK€ ¤½±]‚¹‹£õûæFôÕ;&¹?æ™7õô¶iôz;Gx«-Æ°ü0okI»mý¡þ”LGí²z·éRªÍØ·ÊvûþÛî4½ký–ÔÃbgým!ñk‰%Ñ™ûjc,j¬s½lÕJx½3ÂÞÚäZµ“ú'å;yÃ+—ÆtÞKî6i¬8Œ;¦Jù­3D%Z¢½²t¦ÍîÂ1üisÐþ:ñ„ª«,äÓm³¿nÙ´,ŽkÉÎy@ýÉîó -çç¯jÛÔ°ÿÔk”/|LmW…7ˆº¨37Õ¥[z®`üì)£Ë§÷HäÔ âŒj´Ó-÷=÷l—õºæšbò›©œk#\?ª‚¡Ñ+­µ§¯o9üSæ¾Ùj?½¿_8^dÐþLÇ^«fK‚ÃG…3Þ‹uçʾ­+þ‡vUà'ƒK ‰W0:@sMqÙBaÕÏŸZå+ nðöàŸzä’o¼.4|ê§sA=]Y7<ñ®çúÔüýºu`ú¿þ||‡x¥áëT§îïâ*|ß<±–íopZ0dà”…,ÏfÎLê¾wÊôÐÖ¾°å }¸ƒ¬»:^ºöà¹íÁg=±‚ßN~h+,c„*JƒezGþ &&ØÙsMRyÖüPš^_4ÿžw—I>ó»My&ƲçKV‹ñ%Á;µ†¤-ÃOŒ¹Ü¦n=ŃÎúIëËœ‘ø"u=É«ý狘¼ÙÖì›zæÔ2 jËèmµ–€òlœCQ~no9µòñö«˜û¥»Qß{t­ã'ï.ÿª¡®Ýqg‹±7Ïa¶'„;`fQµsÀð–z—ÉÙ‰êˆèúÔí^N3#¡÷F¿ñY,Ɖ:eJó±2x«öÙÑ 4+ò>ouÚõ\êÚ ¸‘o1ËJaü‡åÿþ' -ˆ$°'0©O¥üžžŽendstream -endobj -2435 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 3741 0 R -/FirstChar 60 -/LastChar 62 -/Widths 3742 0 R -/BaseFont /APYTPI+CMMIB10 -/FontDescriptor 2433 0 R +1939 0 obj << +/Title 1940 0 R +/A 1937 0 R +/Parent 1935 0 R >> endobj -2433 0 obj << -/Ascent 694 -/CapHeight 686 -/Descent -194 -/FontName /APYTPI+CMMIB10 -/ItalicAngle -14 -/StemV 113 -/XHeight 444 -/FontBBox [-15 -250 1216 750] -/Flags 4 -/CharSet (/less/greater) -/FontFile 2434 0 R +1935 0 obj << +/Title 1936 0 R +/A 1933 0 R +/Parent 1923 0 R +/Prev 1931 0 R +/Next 1943 0 R +/First 1939 0 R +/Last 1939 0 R +/Count -1 >> endobj -3742 0 obj -[894 0 894 ] -endobj -3743 0 obj << -/Type /Encoding -/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] +1931 0 obj << +/Title 1932 0 R +/A 1929 0 R +/Parent 1923 0 R +/Prev 1927 0 R +/Next 1935 0 R >> endobj -2206 0 obj << -/Length1 2135 -/Length2 10250 -/Length3 532 -/Length 11406 -/Filter /FlateDecode ->> -stream -xÚí—UXœQÒçàî hœànÁÝ]¬Æ¡qwwwww$Xp—à®A¶33ß™½Ü½Úg»oúW§Þªÿ©S§Þ§©È”ÕELÀF I°­#++@LAM•ÀÊÄ‚LE%æ:Y€mÅN >+//+@ÄÙ ÀYçæcgçcç@¦ˆíÜ,ÌÌ´bïþ8qDl@Æ@[€ÐÉd‰a ´¨-@NîLkk€êŸ'ª Gƒ È„ ™•`baì0™YØ"3ÿQ$ck -pÿÓlâl÷?K. Gˆ(-Dä;D¢ ØÖÚ`2EfVCr Jþoˆúïà’ÎÖÖŠ@›?áÿQ¥ÿmhcaíþ/°³È 69Øþ·«èŸâ@&Î6ÿ½*ã´¶0±5³Xþi²p”´p™([8›LÖŽ ØA¶&ÿ-R¸H`V“•QÕ¢ÿ׉þcQhaë¤în÷ï°¼ÿÁ¬/ ©ƒ…à#  +ÄòýŸ_zÿ•LÂÖlba i N.ÐÁèŽ é q.möi×Åp7ãHû–¡ˆ­ôËgàÏÎØ÷…ˆy‰Oº7x±XÆßâšx—gö›†&Óºyœ>íÞþ¾L€Êé¿îÚÀ­©¥׋J`î'ˆÓjÏemÜØ*”Z‡5[Ó„Ûÿ[Æö}eüj£‡:u3D¦ÓÒâ“bYô:×q;^ykÒ„{é¬õ*üò,x@;á ¹VÉìÉ¥Ûˆiò3ÆÏù£MŸ{£áë¦âeVTQcÛq¬67Ü1 ði™ÏÈOФZ‰Þ©(üð‚å<¦ˆÂí¼²)ÃòíºáMý™¬ãŠpl<àîÓN$yHPY¿Ô™o߈?¦Œ¡g2ò{ûnäë®%‡¨7¿ª &m¢ÿÝ—E"¥K¾pkÁCfV¸Þ7¡ÞÖ¨V.܆÷\ -PðúÄ5Ù#š.Ç´–9“C’+%%v¿¸~KÁmrŒÿš–-Á닦uÈ ½@Šû¦oÒn~1Ûó›ÃlY„8—l®=j׳¥ÚçjÏ’ÊF$¯4Ó?¶'bã s¼»®YÊuèÚeœÅçþ<Ñ"'@{*#‹e@+2FS©‰x^H0þ-ðÄ—7ha³½1Ý=·/—ÄêüÀóÜG—…ÚSŽ˜•öeç•R˜4[ÛZÃ#yìõJxD% jÀÖ•½Í€058WÇkÓÈ!³ŸŒí’—¼m3²…¥*ÉXØÀˆÓwÿ„ŒÝ'A`AnEÅS½”Ž¬ÈP­¶|ØœÙÉ"I¡Øt‡ºGÜ„ÒÇÊÃ×jð&ŒÔÅ• d1w?™³ïƒ*yµ?ºühO÷$»B]’¼bô|CÀž/\GKí*]…XÛ™œ Ç£&CV<¡ý»¯;x]^º=É`³_ï>GsH¬õ™f'ºp݉ºYwÈðm9¸¡&ÁgwòS½£yÇÖgB~‚„…ÝÆD¾A:%æb™'Ñ5‡qô›¨Šz‚‹ ®“FÛ»%0òÑ9²ÔšDÒ,V“Ù#‹ÚL½èÜ‚tµöËèSÙ0U栗+Ö¢¯ºgÌœ­°Ëí(øm<‚óq1ïö½zñÈ2c>ì^XÝæ š»^áÃlðñ]ªHõ9ôi¢‘Ÿhi?ÓÎ'ŒU5ñ$bšæÊò¼ëÁ›¨K—;ŸøœÖÐÐçXN5¸¸DÚ8þº†ßßµXÔX˜9@’{Ú>\7 -ž­¢"= ÜM@ 5m -©û„:CKµ~Ü&G¢Ô¦LŠ6zÇö,àu1"ûÝ8;Çá~²J~êžÉ bú‡›ç¼íYrX¹ŠÎ=*†kh Rf¼à7nYví-ƒt¢Ú#”1)à#w>'å×ù4[ß\ÑI„*xš÷bCâ× ËŽC ¸ÈƒÇpprÈ@–]uÅ5爞»—8fõ«Œ™¤õÅ­„&ƒ›F Ì/l¯Òm§~Ö§@õ²Þ ÐQù¤Õæ¯"ìÃäD×\ÿ½ß@Kñôù †öôÀÄlÍ(åæ]JaÎï¹Þþƒ9«*!¤tÔÖšñ´< ^U=ýÉã®ù)÷¤jæÇ;—†úÁœ÷jöQ­ÈÚö‹Q8æ0q¿pWµêßËRb?FœÆZ,¡íÙ‚Q("‚@T¸4Ã|áOáÙPv ²¹>Dœ6ý©è!ø_žtqÁÆ?ñ´¸¸_KìãùÝ¢çXpÌGÎÝ^Õô üèªÈ˜§™*U7êÒÄ‹¶è¦ˆ%j¥Uä(…å¸4ÙVµ.%‘°ß¤‚Ÿ¸t¬ÿÑH‡×mí«h l„ˆ1F\Y^ß«£Ÿîäœý<ï˜6ÖÐMö…»0tñ-ï^FbªM. -4KÐLÊG/ª4Ò æ[óy~hœKšû±î•M³™öáArFŸÎRfeÌ\¼n凚˜•~rzoœ1º‘.„¢¾Q@¬Ìg\Ãåo5~fÒÀ/WÍ9:Üþõ'<}?ØÐl*B¨jÕ q:]S$¦Áƒ¶Â­y?=$4¬N‚-÷ÑøB°¡>ÈÓFióÉ™a¤Þ.ð¹tÉ/=˜º]ªŒž¥±2x )H h ï&IrˆeZWVÒÈG°­AK«c›Œ*ûÉãIW=ט¿{´˜O„#ÿ`KÆîiêeJf­†=êar„)>ßÑl¿ŽîØpÉ7VËøH0õÏÍkÎÖîS¢†Jo‚Am—Ï;’îí†÷§­;f-¡g÷<ÀNbÇX6s} `Wû˜¤³h9$¡éñ°¤syJÜ ªÎ0|üLrã¿M¿átŠÏóí®44ÆŒçµ\ܯŽ”`¤å]ñCÉÜ Å®go¡^'¶yø/ðfµºªß«1Oº “úÞ¨00<ØXGq%èùAŠ®Çex]6#Îm^-ŽhÆŸÖÝ\~C|«\‰ÎÓˆ|´"ºü“L ¥âÁÎu½„$|±5¦œwÁ#êõðÛR“e -õÍîíù‰k”ÝEr­d^.èá9s—[(yLd¦œsOn÷Cµ³!~W‡ÖR6Çï°Ùôñ“ÔÍo¯ÚÃãàçÞUŒãÏqãÇi¶¹æfõ,‡qÎ@e׊ãßfŸ­ËÄzwÉVfH”Ò¹”2P­þÆJ:à£#[-Ÿô¸ëlE½À·M÷¨vÜIo[Ñ}õX¼Ø™öpPFZ™kL—uhAu”WÌpû1CE{j”j«ô›ÙIkgœFCÄ:£´4gtd6³Ìh%ëá-VNå¨ñ€­2’qeü­X á -±:&=vPe:ýkXn&w7˜ סZŽ³îÖ±éxõ=Õ[kÝò$Ig|…ïÆÂX;BÝl@ômdï@Q êÄ1sxsØ8Jg“Å*¬N9ܼ”‚t9ïyõ£<»†jCÕ?Ó2>cKQÿZmã›åîõEü$yr%Ÿ æª8hÄw¼Rå pìçŽk2¹¸Ùõ¯lªô‚6÷‹#õUÞPËÍòU.nV’\6 >#Ír:ÎaäªÊJ~Þ„±¼Ðm.Umd7Ã=ñžqx®Þhð°ÚÒx"W ùÁvÖ¨Ž€»l»ÕJèÊöÓÕ¡œ¤Ž0sB¦·Â~ãIP½¥·@N‚®àš‚oáÏ¿Mõq*--V»0Ša¤½Ñ(ÃÊ‘ A~†ÎÙÝ 5'³°ñ¬áøV"ͨÓÜÖ*UИá\37¶·ÇÌ–šÜŽ0ý;m6“;™»yI]¨ÄâZN¥:wØ ƒdÒ>»ZQ—¼IzBd1ÆŸ|±óIš ÷ÅD-¡÷ÆQ÷±¾î„ñlûKV…²b„$¯ë¬Õ 8¥gßö ´Õ.À שÖæ¦ÈHþêN¯É9.Ù– ˆöz·üØ9Þ«gž°ÿǾÖZÃxÖàÁ$|NÓ|Ò_·8ne ëhŽ“`0«ñÝ9¦bùÇ׫Ø:… ´Eý3Q2Uú²û–®,ÊË­FŒÒf 쓽ڌÃ)›ÓTñ51ÊÀÝä’âq ÿ)´kç%x“y™Ð¯Lqì×ý8©`¦WJ…œ¨ôN4nü 'çYT1Z,ìs©ï­ðMVeE#¿Ž“¶þëÃL³0 Ñawv½*‘ÕªšzTÁû[Çr ûöK¼tØò„F$XÝLl*½I÷˜H¡[A£›uŠ¤PÙ‰æ×j¿í“>æ˵”SR¥T±™J\¯Ëš<ùÏšõCèËM*i<«VÄZíI'^ïÎw°'•–\ΦHq9Þ¡3"üè(bñå½v:Úç›$ùi6;ë‡&†ßûÚ‹I­`ª”¸K'"ïlPvý†¼Gêß=|ÅÅ&úä&‚$jWÓ´£\î÷ö„”÷h>ØÞËÜ'u𗮊ÏOJ·o÷oª]oߟV*z7³Ö¢œ®Ý®_Ïš Åv‡ÇDòQ©Õ.Vl۲ørii½ˆT“2¤y)»××Bà˵?Ûãy¯q^~Ã:-öðù¦ºi¸…rã¿ü5“}_?‚¯8ŸÊ^Ò1žðª–å²óÒ×ir«õ8·MG(“NÔ&tytEûÎó€±xé‰Åf¼•»Í÷=Þ¬,ÿ·ŒG‘ÑS¤„½ÌºÉHQGßßj1!¨ÃZ1j½¹“0Qí è `¤ðÃJ”‘w-½Aò5Ûy¶”6š2 ço]ü,HhÃÞ´ Lµrafï”xˆÃ=É R‡Û2Òø43o¯Ì6ñwˆ¯&-íšmÄ]«AIƒø Àº/äÕÄÜhé¿‚Ìlbr?/_fï¬ÅVõ bh WèåP[B/±«‹v;O¶áÒW,ïc¦ìǺlt$åxuoÖï‚X9ßëE3ÀøJJ»§¤|jŸ<Ñ}pLò2'ZƒVîFßâe™¿Ó#^]4×L()Âk—ÿº)@›t²$l29td˜T&•+|_};˱ÿ5íLƒ MÁ»ÌPN Yjt ¶Ž¶%rj"öžÎQyþÊö›5!=-d²½êí­e)öÈ™¬ .Û#ÃN†üN/ÂïyPšË"GA+mcpÙ¨#Š,Ð#Õ4ѬßSÙ<þt‘s¡´èsbð2a㈩û#¦H|kh?éBÌúWÐýC¥¥û3v)YY°]EÐ"§Î*VáåÈÞ’a£—2MÎOU'G+,ø,z–ñ³A([Ž<¯f*›¼$zäKê|ýýš –XƒØœ:§LÛxñ¶Æ\èPµUâ°šæCÏdJZ%O-ÝèæºãR¶ ÀÀ[½8ÆJA°íù17bR_§†nðª§à;OE<Ù´NŽÉ{¦Ò^‹Ê(&ú±>M‚Þ•ç]Åe¬Eþsò -Aöõ'R¼ *C¤Þa´MæP’>L5•½¬Ð#õsÆæ¾%ü¡q”yÕÓÜ+Icc¡0×£ø#’ŽµñVb >ânÆéˆgŽ8dÝÜ-O‚ÀW¥ž0ĪMpøRKÏ«Ø5q¶Ü©Oû1µäi?!…NÉèt âáwÜ>»"#Õ>¡´6HB-nŒT6êurOöL/ø;¹ -{x•áhu\¤¿¯õsú×’sŠ¾N‡Ö³wÉ¿ÏýŽöev|C¾n"‚3Ùéð:!7QAï†M/i©õ¤"ÿ;Œj&?ïþñÒ,½C“}`ûÚD+v©Æx’úT>\B$÷år Uóµ šYõoŠ…6MýCÄI¬ËYÇyyfm6ÌTÖåÁr›\Ê`GÀ=#í¯;›eiž¤°Eóí¡–=’Líª|G`ª$â.ƒYÔs³à™ÙÔËç¬Û¬¼ÕçAc„õC)úl–íQòOIšä[î›Ø²ÂEûÖ¾„ï3J¦æ"ÙÜð‡uŸÅÛ¾¬j›éS¹ýd}f—äo\°S²ž¤zû=‹p¥!,<™¿ >f’Ø)£eº¶ËLc·ÜçAÚdéPÍ«£¡3Þ1"ÿKÑ"íx* ÿÔn˜QƒâC½±Ù!îxüw[‡Ø¥üµ½ò6’†÷ QioxX¨„:6}rÒM;¢ï ÒZë°¸Œ_¿ðC× -å¯pb5ž»Ü­]Ûþ5ÊG9ƒÍ8ó£¸Z÷«ÄY´²ˆúH1£ÇwU]uý½ÃÞ2«ë+¿–¤0zÁ¬s Þåsòrã¡ÔÀOÂûÃÜ·)ëN.ó±2·P"†jsr+u³ƒ—}º…—áÝÎ×ña‡b‡ÈtIJ:z1•Îæ×Iƒ},K1~UC…±gf}ã×O} Z§¸<+¶‹­Û’†óº¯«è÷÷_;ݬS6jLÙÉ¥iÕ²(.žÓýŠ«0ô¨Úp¯? ž¹V5õZÉÆjvùI÷¢%ÿ$$)¤iñŠ'Òþp-#tŠìÈþv>,œ5zÁ’æm“B:ù\¯§?Œ‘I¿Ÿû»7¡ôoëh+QÞÏ$¿Åëx%ÞuXºìRÝvqd| [Ìè@À—<ò3ô›ªŽWXT2&ïçw‘ M¨Rp=¬âo¹Èò´t“ec~.ú/㶌t Õ·¥OQªéÞŒ-^6Ô®a|½Od›ìȵ¡?ö~3ŽSžµ}sã‚ÜT%âì°gMÀ•Û‰B%ü ïÕÍ_3)-ùK]ÈÃàd."u¬2ZuMÆÊÈám‘Ëç^j¶õ•MqËó ÕeaˆïÎö:b iŽ#˜,†Ž|Áz…õ¹çèÏûJ…÷ä&ïÑäb¬ò\«9çB`´«ý·¡#FæDÉ8øë=fá™­TÒtóY{† ±Võ8A®½’O0ѲvRbW¸ƒßǹ„±‡ÎpæÝzrYÒl5‘1FÜôÉöƒÂ9Î<ñ´b/ÊÙúÆQzKbÝÒÁˆ%šÕó¿Cm%ÙöïPop¤BÖ¥»¡ÑÔ}/Ž£ ‚‘úóY|€P—c]‡q—Ìzòês¾è© e‡±c ncG ùùó$ü„exÒæŽàà\€íTò§WµŸ:Å5œ‹yý•â¤KCa°.>*…èŒSâÒ¦kÖìþqF!Õ n—`RÂIiÁ"FDcäa°©ÔpŽ³·_M ‘³ðõhÑüúuÃkkvëõ°! - aOÒ+Q“ŒWO“Eòñ‘¾Ôp m9k¦SãuäAºGÒçç•ÊÞr7yÞqN¹—WÕ/ÈDß -‡›»šïá­Q9xõñ룢|ŸS -ìUùɧI—dâ„ãëX¯Àèø‡XœjË·ûKß ½èp ²_aà>·)ãQ½e^ß×o¿böàù5l‰”tRÝkVz#jK6Fàùî‡Ð"ýûìì/d$¦ÍÊÚ³'ó¤ônËBåx %ðÈ)Ä_Q„´)#;ƒ‰ˆ0ÞîÏ¢00L³›ø&>“pOÌåbhÈG²õVÕŸ×ì™9Ùî¨ô ·Èà:R*¿‘â?åÎwetÂìäÂ"‚8樣÷ÅÖ—\|OݹñÍ®x±~1PI؇&#íaÐÖ÷û ߳Б/ÉYÇõ‡¯Äià[Ë9=Š >$Å(Š4åúuƒ4Xåoxõ”áHÃ}ÚÌ^õ{åq„Ü Ù½œ§‘OÐ%e‹¨ö;:–1¥.R­M³T—ïâRå1NWVyEœKôKøáꇡ–TÝã).$ éΠù8JÁ ¹î9÷®™oWìS£%¾±2äM¾bÁ¨Óuãƒbó1¥W¨HDÖ¾zÚ¨ÌòQ_›mûË‹MVq ဧú^Í»×ÒE"k+’ÙÐ 94tèîáê–¿!Šrà°G¯I"ÿtÔÈ—‰r‚_†y `Ù\Z¶ÐŽˆWKè%@[lxz¨®`®?³b“+,35<ý5AS9©4œ´aeÌì¾ëgž@àŒhVJJÙâ\cÕtöŽ¼.ÂŒ©æ­¸‡Òûó=UxÍb;•ÜÇHbÔyòˆ¦:l£kÖŒ~pàѯsÓ ™S‹_Oy¥ê6{ƒRv‘Õô,£6u¾²+þe_J—;õ“†]Ð^-×|~‡¨ÊaUΫ»æ@ÑèÇ0øªIºgÎ7–ÅqL)¨ÅùÛ×ÍÛøùÛˆz󤸭_ʼnzœ¿/?+Æ%õw37h’æÎÐÞëɽæ&|_i,ùö·šn–D¿Ê¾ÚlŽŽ†p24ÿ»¼S§¶ÍXw§æÆ„"A¤Kº!|iôy>ê½?Q¯˜r#²²9Æ‚ŸŽß½± ž)Ön?JTÉFÿœ_ Åî;)òaºŸTã ©… Tn\C¡ãŠóN£Œ`}v÷íwõc£þ[’‘òs¹˜ÂÓDÃð ®³µìÛ NµO‚M -w“ |åY_û`¹~猕¡þ”&qnŽÌçðZ¸ÒÀo3nÊ- -NÖÆ€'öÊ»«¦6òtµ “kqDÄÇ6]÷34lö²˜ö;§â1;”ÂQÅw¥–4î©–ç*1†ó -°Øtç%¯’ûƤ·b˜JýöùPºŽ;¥Wø@ZŒ5hþq”=ý±çÎ`ï;Áû†:U'®£°Â0qÌ-É­ì¨Õoþ2{Ê2ž ïÍ'ÛÊK”ïSBCÌ8…«#D6<Ö"nAæ·E¼Ôº_‰~G⦆ð0üÞÅë»s¤eØ:vO1È¥™–`U͘rUp¶é?âЗzp–:du_žäµë×Û¿å¡×L¸ß¨¯òtLb—´ ¿8B6AÐFPïo×3+èá$ÖG§’Q®aÀÅt².^½îÞ{ØΓlîß™NÃ-Á7î&~u¡€µÆŽé9wx…yÚLwwÌϧrô‰8É?êÊ'ÕB›ÚÌ™Ñ>gTNûëû›|Žsr—קLÂYVÆ?l TÔ6(ó;]9 œ‰£Qæ®jú•b\*å5å) ç×5‘yé\n¥ \žÅm¹÷RV{Îß_î×Í’¿ð]}›A`Áˆm&”n™c˜„ú=ð¾¬P€Ï/g˜4»äiRÒuÖ4&]†Ø®¯ÕäÍ„ê”éÞÓ›âEF˜ô¼zÖ{bû&¿ÀKMé<@×ÕÜËf&{½Ÿ‹A®æ:e°,¤Ì]|FHáø³¡%™cq…¦5#»ªÝ5v(1gêg!ø·ŽáÒ‰ÑÈ7â¯Ïd€Ö“å0 §4YئA¬Á=+Wi9V’£Br›Uµª[ßRØq’*Æ'x)ü4¡Öù·ÉJæ³TäîrЉ±Q'l”ûarÔ¸'LpÌǺ$Hxc’ØñiŒ= G`Ñø@k— Œ£ù¬iÿ¼v;lˆ¨2^Ýùž¶Íq¢/«—¾ ò£´ÅµÕåwã`ìË­YÆÊM„“w™sPß%!wãW þ8ÀšhPîÜ–Æ …}õ`Ê¾î¡ Íší•·¹ØßÈ€f)9÷,èøÝlª®ù“º`¶ì1Lj9Ï­ŽR Ðn´‚z;]µ¸Ü³÷§5ã¡=ªàìo· ¿ÜRF×°vf)⧳àņó£ìñ€ÅÎ=Óå(¶9ˆq?gIfúì4–2è-^=³h…ž$û-(ÄšjïõËc©ešÁß‹¥cŸÈ19š=v?Á¤n35"û·ò~ÝcBÍÝ™0Oÿ…îº_VTœxvN­A0!,l;ÅPƒË·ï‘ Ä·¬ - $'UËv×é–eÑÀBÞ-WŠ~>ÖºéÆÌQ)(×>5"=3 "örLFÄé³ä{Óʯ®¦ô!£òFpñåö Ccê& -üE’·ì®«#­[~÷Dlhå̸«:Ÿw->Q(·A=m8ˆFq:-³­^3L’˜MõjO;ªãdÉÓqEã™ÂÕ‡Ù>½.úŽÍ{Ä'Ö‡¸*×}Ê o£}öÍYÙMb³ï[IƒË·:ceFZyo”ʼ,¨úŸ½ŒÏ?KsîGoÑ°âÂUöÂnájefB©Å¼Ðø6ÉEb™bÈx#ŒZI_QNUÂ…8`ÕYªªçxÑ‹5¿¿uÎÍŸNŠ¯5ÚN? OëÁ3oMÞ¿³¦*6gÍ'ÚH -­Ý P³lûE¥Ä)‘©+QãÀooU8iÛ¤c6Èã»Ýº9ÊjñJÿ  ýµ­­w^WÆ-¿ñ’‚,k5œ¿œp¢Î`èžÿ«ÍÙi1žË׸‚Ëêw$ªá|€p6ïàb x²Î%œòà°—.˜…¸¬"±˜ŽyªøCÕiaýé§^­AÑóW}ð‘õ» §¢±jDI™xŨ“QyáðÍL£ÄÝ2ŠôišÁò×ù’yè³ÔÁÕªJÕ~¼U–¸xÜ©…… Œmþhδ†ao_›á¶J ÉkâÚ§#'@÷¦ÐH´ˆ¢!a*J)5x‚ãpBÆ(H®î‚¸ïÜÔÄJ y[rS:hÅÆÔü¡Çà’t?) s˜øÕ"§ïj3E´f^‹?³¹Roƒ9Üáy²ôë·hVv2­´ŒÃvÞHâf:Ûæ‡ ÃЩv87éüC–OH©ÎW,Tý—­·êFwPór¿Úâzæ¿2Ô™Í>jöÜøäxµúê/cãzšåàÏ‘÷Ħ¶[8$^™\²íD;V ;·¬bûi«¯ýŽ„LRYs}'Éúë¯åsßk>fT‘Ñ~Õ¯'Ïi½wgèOIúX+ƒ ºèz[MR -aÌŵ¹}—ffÓLÇ 1“ŶȥæYæ¾¹†ªãèî—äŸÛp¬pˆ48Æ›~¨ý|Œ±/¤¿ð§>“r[îoÎÔ³EždYþ\ÛüÀ°®¶×Üâ¯öa“o-¥Ö«–Þw² UL¬ß˜Cp§*{q]ŸˆI~~ŒöpùÙ¸~œå†löÈõ™3ÎLáIZ«®çWW§|[{o³«ÏxFfŠ_E›?)¦I;‡ÓaÉF«Ñaïfðtw${XÚ¬£¸¤ÐøØægc{’4Ëÿáùÿø"€±5èà¶:X!ÿ/ú2endstream -endobj -2207 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 3743 0 R -/FirstChar 11 -/LastChar 123 -/Widths 3744 0 R -/BaseFont /SEJIRW+CMSS10 -/FontDescriptor 2205 0 R +1927 0 obj << +/Title 1928 0 R +/A 1925 0 R +/Parent 1923 0 R +/Next 1931 0 R >> endobj -2205 0 obj << -/Ascent 694 -/CapHeight 694 -/Descent -194 -/FontName /SEJIRW+CMSS10 -/ItalicAngle 0 -/StemV 78 -/XHeight 444 -/FontBBox [-61 -250 999 759] -/Flags 4 -/CharSet (/ff/fi/fl/ffi/exclam/quotedblright/numbersign/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/R/S/T/U/V/W/X/Y/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash) -/FontFile 2206 0 R +1923 0 obj << +/Title 1924 0 R +/A 1921 0 R +/Parent 455 0 R +/Prev 1871 0 R +/Next 2027 0 R +/First 1927 0 R +/Last 2023 0 R +/Count -7 >> endobj -3744 0 obj -[583 536 536 814 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 319 500 833 500 833 0 278 389 389 500 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 0 667 667 639 722 597 569 667 708 278 472 694 542 875 708 736 639 0 646 556 681 688 667 944 667 667 0 289 0 289 0 0 0 481 517 444 517 444 306 500 517 239 267 489 239 794 517 500 517 517 342 383 361 517 461 683 461 461 435 500 ] -endobj -2203 0 obj << -/Length1 963 -/Length2 2491 -/Length3 532 -/Length 3136 -/Filter /FlateDecode ->> -stream -xÚí’y<Ô{ǹÊ2ŠP–P¿„’ef0Æš,Cˆ†±34ÍüÆ cF³Ù….ÝB!k¶˜ê¢K”­HºÜR"YµE!¢Ð3Õíæéþù<=¯ç÷ûç÷>ç|?ßÏ´Q7!ÐŽƒ4*S®×Ìl1+8 €kÀ JJftÇ$Ó¨æ8&¨Àõôà€ ËÐäæ‘úZÚúZHˆ`F ¦“}HL`¿™Êç"$`âÒÉx°Å1I ?W£ž 2ƒ5 -pø|‚8€ Î 8 ñLà8èC¦B Ÿ-YQ‰4ù5L`|K±A:ƒk -ØÏ5©p-hTJ0@‰¨{Èuòß0õ£¸‹B±Ãù–ÿÚ¦àüÉ”à¿Jhþ,&HliNý±ÔüêÎ$Yþ?f­˜8 -oBõ¡€€:\ókÌ° 4™‰'D…~‰ƒTÂ6¸½ûbjcçhjf£úmª_²h™Êt Ø÷ò/ ÿÎÜÑÉA€Lƒs ¹ï·/ì·¡¨xLå®BÀÑé¸`w?¸„Bá™Jƒ0ˆkªA¥1¹Gn_Â"ùÁ­Ì ÓýkTxR™_öŸ;åoL$s·ƒ@<¤÷ oð³ozUlQŠÓU¼Y…!—ùëÏ 1•™ÓâÝôêNGp×¼XŒ˜/ùÚ¶´›(ˆ’©2 k Å@cž‹µnÝ®’#ð?íéõS[Þý&Qÿœ3ã½»GªUßôí]d7l.;2 GÈÌœÝTÔólm!Âï䣡^á ÂÞ±46¯öH*è<1˜øðÃkK‡Ö{¥MÊóâ¢Äz¯LÓËÇ~ý[3õâòlùžf­ -ÁûIEâ¡X;æAäœÒM Zb£í`ÁeøÓñ™ºƒÔ#g’PÝ-Ù+±œî®Æöfttñj`ÿƒãÕACö{Y*:A±…üÁ˜8EïÊ”ÈÀ*ÿÍéÉgøŽ%¯H§ŸeD·tûåN¿‘m°.g_HójSâ\¿ž&YXý(°qòf×Ë¥\hzýû[Æ¢7FÊé‹,Û‰>ïì}·R+ÈÞ• Õo¶¶ÌÄ«…\?ˆ·7ûî«uW“«•\uQ¿õøE]d}Í¢â:DIe.ÅÚ ê–;Sï©°@¿¸šO¼}bTø4ûCÍ”™}u$ qTÔÌK¸´Ú8b_øiën“9§/·cô4(èÈõþ3rSY³oÆÏnØ›šŸÒ›óËUõŠ -ü­þQ³o¶C‡Ñ¤g·GŸOŠ4ø¾O¼ðä…f¤’ìI–RŽ]`šýf©€: ƒ§Üe—š"‚ô,l*~QÆ)’X>‹–ÃÃ~v7îݯkãÇ=PŠú©É—4ùVeŒØ äÀ’,†pµìÑR«Q*3¿(´ëä›Us-4éîrzAd'¿˜´sIùå>†òG(!Pþ~Cܨm¨âÕ¶šWN;uz½ÍïOßÇš-ÎÂ3—ÝBzüöë¨ò‚9«Ù?Ùc†}TmÄ •ÖÑ¿Á½4,ÕIÍr¬mAqîtÇ -ÉNåøšë{6>¾ÈlW°‰»4`ðñ±Únµ<þš -Ù0BHSêTûÁˆÔ°(Tî“ÌòÞÙÀpÉ£-ã"ÀòKL töÉ׬„ðdJ³Lã`þ DZl{A ÖZ’›å½9hw‰m‰p%õ¦åGYÒ_šu¨KròI¶ u;TMZtÇŸ i:×} ®-õ4_è"|K…5oÕ0}Âx@ÞÐGþ}W{ã錘eƒúÍUM •ºUnœæ°ñ:qýdƒËÂgƈÖÕ;í1Uktç$'ÊE´{CÒ’œÖ†eø—}ò:Ô"º%þ<’E¯©Ð!^—›Ö_ãdÌ€ÎGhW‡h=8øѲo‡@‘×Á˜œLA~ÙóÁé)¸ï¨§Û37œä»2¸Ir'_ O?;¹ØÃÍKs+MPõ»?ïÔw8çM¼ØEw|Í1Ÿ¢þΠᗠUOIÞR 0´ ª¯‡lž(ëðqY0$k$ L³ÃÌäw1ÀÁÕè3fß´,Ê8D‹“uyX™Ìxá¸V}W¨c7Ûœ@Î_åk­¸"”’žÊ 4_a ’ž|R*ջשi·/]í÷ó‘ÇØNŽ"¡©+¿:*ž¯±WÜýÄG¢l9ùöþÁ¨¢S+ -6*è¨Ã@¢5>íœ1©”$?]Û |5`p‘ÏkÛ‘÷“¹Ñ;n`wTïb„„3 -xO¶OOÄâ(ïZ”TòæhYÈ geE«¦˜ŸRj=cx\h ¨N7ÊhûU•–t5ÞÆMøá‹%™²½Gùî™AÈÌ‘°²ìíY¯å"»âg»Cü³—Òb20rÒ»™6³ì©×e.ž„ÙwÝH4à7`ok %Âý£q“»k›.S ‰<ê¸Í#IW®ç•BÞ¯ ²’˜9<ž®·öj<íšî át%¹c¶Ø‰H · È¥”pêéÛ$›9Hz~B‡R”rØ#ùƒÄµÓQ­Ùºv¼?ç,š,^›]ªª€&À‹6‡æM@ë?e›ä3ÝÜRÐÍóBõCî¨+¦cTýv¤‡°£^;›jÈd”Œ‰–Ñ8A|{ÈJK¾\0’¦?&ærýuÍ©)ž™wvhÃD3Ÿ¯+}ð]Ì] Ì ™¹î3ªýž^7­+Í‹z¡wM­Gt-÷ÇÃüø º²_ìÞ¯õõÉÎ3Qó›¶U†·\φ ©¼O¸•$³ËrÉ]¥f¹ è·¶ªºeÝZ¹ShÛ°o¿³ÀsÞ„: *ºuœø)w”˜š\O+Ÿ™SX€ªy@Eü˜ÜÙ©Öñµú|á-«êçÇnUMˆ<ÛÝë±Þm¥¹Þß[ÆD²5Ù€©¾½vþ`Éõžîv”Áe5ûè»æôG_é½0ñk·ígÊí³¤äm‰¤_Ås]OlWÙ*›Ê~»å’|¹Ñ¦ø ïº¥úJåÈ}ÃP÷C­{Âñ|œ0öˆwßk§eª¿Q¢ã ‰Xë…wJ¾ÇL´e'Ê}Û?Ô‹Õž„w¯[þ¹„qÐ\¢E§á‚VÆGk¤ü•=ºNDtDXÆè·[à3ú¥¨ópvœûñàíMµIÉ"/ͽfD_ìŒUô:Ú‹ŠtyuOa ö\PpÓ§$ø Â<±ÛnÅàä§Ç³d®4ø¡ëä&¤¯æèÍ>B.¼C|(A{øï/‡å:‡ì{x@JÀº&Éã -€HxÒ&mÃs‘üO_ö¥ÞºŠ}VIÙYYȸ¾,ñ;a„¥'›TŸ÷qíð–Nìé%ß͸óaARgµDR“4ÏR}¤š/æ‚– ÑÕ«X1™x—¹[ }3s»Ô)fA™q²hiô?U~íM&ÏoN{z,sâUÕ_5®$.qŠÏ±åšDßá='%CìV‡*h˜Æ‹N7‰Ó°¬ÅØD¯Ã¥äÀrw9ʉÈóW]pÑ…JÌ º~Ì,÷ÆF;œ—Ðý㵶žr*уŠHk;]zS¦¢Mï\±izê0MЫt ë:Ó¤"înE[y™ß‹¾ŒÎ®Ë¢×&ÏØ÷íçá—ê]붲Î)³ïœ8¼ÅUuÎW%uõü)F@ûræ^lñÒÖ<‘85>&í­ ‹‘±{8:ÛÝ¡ÏŠ„±”OÙ¿ =Ô -!Š›ßÉبCˆO5 ®]˜’2K«¶hóÆŠ¿S4^^8^¤§$i¹“]xÖb±«)qm;ý°W½'øèqž3¤õM—ÅRwu?ú8ª'kÓêíãi˜íZ<(õÄËw[ãözÕfõ&müÛ aõ­)òH¯±LÔ96¢!Wµ'V9^+FŒ?:6§²ûa·G×Û-<“Nyt#ŠgÄ©ö>ÿ üOà) ŽÎ¤ùãè~Õë\0endstream -endobj -2204 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 3743 0 R -/FirstChar 45 -/LastChar 118 -/Widths 3745 0 R -/BaseFont /KNTBCK+CMSSI10 -/FontDescriptor 2202 0 R +1919 0 obj << +/Title 1920 0 R +/A 1917 0 R +/Parent 1871 0 R +/Prev 1907 0 R >> endobj -2202 0 obj << -/Ascent 694 -/CapHeight 694 -/Descent -194 -/FontName /KNTBCK+CMSSI10 -/ItalicAngle -12 -/StemV 80 -/XHeight 444 -/FontBBox [-97 -250 1077 759] -/Flags 4 -/CharSet (/hyphen/S/a/c/d/e/h/l/m/n/o/r/s/v) -/FontFile 2203 0 R +1915 0 obj << +/Title 1916 0 R +/A 1913 0 R +/Parent 1907 0 R +/Prev 1911 0 R >> endobj -3745 0 obj -[333 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 556 0 0 0 0 0 0 0 0 0 0 0 0 0 481 0 444 517 444 0 0 517 0 0 0 239 794 517 500 0 0 342 383 0 0 461 ] -endobj -3746 0 obj << -/Type /Encoding -/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] +1911 0 obj << +/Title 1912 0 R +/A 1909 0 R +/Parent 1907 0 R +/Next 1915 0 R >> endobj -2200 0 obj << -/Length1 1380 -/Length2 7269 -/Length3 532 -/Length 8111 -/Filter /FlateDecode ->> -stream -xÚí”e\”]»öiFº„¡»Kº»`€a`hé”înFA¥SBA@é–©wîûyŸ[÷³?¾ï§ýÛ3_æ®ó:ã:ÖZÃD§¥Ë)c ³+Â\<8y¸xDrêrºr<Ü.nl&&98ä¹Èƒ<À¢€Œ§=€GÀ#$Ê/(Ê/‚̓¹úÂ!öV9¶¿š„2P0br¨ƒ<ÀPÄ 3@f{ørdœ:=áлƒá^`[.l€-ÄÆ` ¶‡¸`ÿ²¤ìbý«lëéúï%/0Üa -ÀŠ0É@X´…¹8ûlÁvØ@ B ŒpòÿÃÔWôtvÖAÿÿ¯˜þ[ -qöý¿-0¨«§P‡Ù‚á.ÿÙjþ—;u°-ÄúŸ«Ê gˆŒ‹½3Àý¯Ä]â¶Õ‚xØ8ì@Îîà¿ë`Ûÿ4Hîo @-59%Žïéß«Z ˆ‹‡ž¯ë?sÿjÿ›y~3"!8Ä`ÊÍÅÍ̓hD|ÿýËü?Ô\l`¶{¯€ ‡ƒ|±§A?ÄÅìû ,¹\`ˆGˆTv08ö_[ÊÇ"–Aпêÿ*‰€nž0Dt'ôï2¿ 芨Álÿ) -€2¿I”ûM üoBÌTø‡„¢Ê¿‰TùMˆ)ê¿ 1Eã7!¦hþCÂ܈„¨ý›x@ß„ÐÓýM=½ß„xýß„P7ü‡× h Ù8=œÁv¿£áû§þ_3Bœr è7!Ì[ÿ&„y›ˆ‡áÞöDHÿ@„‚ýˆ°ìð"öîåÛ,1®½e1¢Yx뤘æ„ð%¡#¤š ý@µhk'°JÑ"ã?è§ |9O8ˆGÂV”­‹yd³gf2T0ðš½µ@»îÚÊqô•á|Åëz½ÚP1ÅA Zå—¹»Ó@§ ñÕœL[†tló‚Nµ4°ÁöJâè¯ýç°ØBÙгìsâûŠߦ–ð²Db ÔQ?gIÜ>âfó±û>ŽÍ½ç…’"”øxònYïÇBV4Mf§"¿õÈÁœÔ_sJŠáý=»‘]cÞ³ØS¤:¨ikHnÌ2ñ³9Š±ÂEQ›1Ì~™˜0ª HY}«…)i|MA2ŒÚ'Úpá#5S ‘yÞ³.ƒèU:îèn渲uO¦Ñøê*UŸ"“]~W£èjч¶41SþÐ Ž_¤m°W^axèÎÈ–¿¼­u‚:ÞÂ’”û\îÓ'+7¾ã£Û=P­pgö¨–E½>:¹ÀH|xìƒêÊ@l2!~uÙ ”sÀß5æö!ÍyÎdK±—[zs”±=h¼-²N¸ùæç:eõ49EH…ôñæ5ùЈÖ(Ù¼+'y¼Á'’ ×ŽNõbÁ£ðtçéf)Ž’%A§œÑÈÀ[ú¥tغïîæ/KèG¹ù‰þŒ23\ÀN%•»§¸\¦ýœ9¥Õ€0^lSßRÈö]LEÎN -]DÄIžø“ôsä¹LáWJª]»\ÎdI/"i);¯·íݵžf ÓNòíqJÒ¸¦Ü%Ž7L̆¼ºË‰è(¹z,xü -ß*¸Or!ëitœ±íºV°Õ&¬¶üM¬_Ö†{ÉÑ^A;.>B›oz²É¢îmrÑ Ÿ'ç¥ÌÜ•‚Ð<ãç=”¶r-+p¦È@%¨›ONÞ˜;ݱ$`+^Jàõ\ª\Ÿ…œ·íiÊT°˜ ÞýìnõÜß1[Àª6Õ^xêÎlEJ™d½»ÏOmW^£! Ì@E`¡”]!1ýJ ÒU$b±öï„ܯGP«PŸß²éÐÝ -~Êvµ½ÍWÜŒž¢Ïh+6eÝQçÅÙ¯Î-é}ÀêðߟŸl™×ÊŸ³•M™PéU2é -Æ{©M«Þíš#%TLZ°¸š¨}TŸýÀ;²zˆõ§|ƒïk1DÔS+òótÁ#|ý¸¶ŸbÒ?’Tyá ¥d³×K7]-Ò½ßaúxî•r­½S‰HÒ”2e: -´h«¨ƒ³ìr”qÕзñ)Ù·Ž¸… ]•’ßÖ–Z‰kgÆ|ö„äc²Qöœ\Ô*OÒ,¶ÖÒTA+sRA"ñò“qeìÃ{ï߉¸xWt~^¸IjmßzÜl·/—äúÓðøg (°mø橹câ;¾ì×€&a«ÇøÑïðÔŠDk¿³UF¿ê³°«’1F§û¾ÿ¼žojçf‚ÍîP`;Pë¬m³çtï1ãÞ‰§ÇŒ¤ñV†^Ãà’ëVõxŠKU¥+a(J8Zô"æ+´&(\y[Œ¡dÁÐSþÁ§MòLÙôSSIo¼ ÑžßqNÊŸ|XÜ[6d/Äÿ0r$¯¾§/UçÄŸ‘ªN"ÀFýñÃêI0–„´Ž)^…Þ®]P§):¹›mVqfÄŽþº+#Aý·%[Š¼u¾4Hå…§ÓåXÏ Õ󂈾±E ©09{©û°âòJùŒL{&§b7nCDWÌÜX¼§†Ýt}‹ØfeˆÉîMs¼DŽby⊈™‹Å ëÛð‚K1[H‚B |ò±B¹ÖÈ£AåÓG §#dü¸±y|}VPu€¬±¯|ÕW¹˜Ùå í…*\ÒøÁº°#ºQíEðaIÉ„X…ŸúÓãï%u¦¨k%™ïJ¤5éÇ6ÚœÛ_ÈòÞ(|_¤‚ ±¥ï÷ŠV¨äíclY“G³%fÐãøѯL¦1^œ,.—݃´õeWÓã…¨ò«Àyk{>*±¥\‡öa7ï ƒ‰)Û$5Iò,@‰X:‚„ìó­ãz–±#ÊWt°„Þ™¯?¹Ä&'öåˆr>÷Åút…?u}ÿt¹¾¢èsË@I5-2y)ÊÆrbqW¸qSDØ¡>ë"<ÞÎè‹Xš–Í™K,Ò¤ý™+¢ð'©Î©ã›‡â•:.I#¤ð®û­5~vtP’Øvø÷}êÛênL2&nüâåo$ç9œQqm‡¾•N:nÍ­€ ã9œÓ(C‡›Å|³„îêú€ZV͹Éqxk‚s»†ø|]c­Ng6jS¸b^8"5=gûÇÅùTçJŸ<ÑŸnÏOà<ÏB÷µZ©N¤Â±õ‚W™ÙíÄk=¹ÎŽ›–Ïó7—ùÌ[òðµiXSì°BëcÀeѵU›èC¼t’ãÄáun)…R#uEa†ï(TñP$h0KÎhwO2êK@!_ïÞ'Ù[²OÆ#âÍ# +_NˆâÕ§æÙ{GY›!É9ÅÒ`/süwõ=¤±DÑÛ?sè À9ÔôÉw2뺌‡‘Q4ßÌd[Å}Ùo[Ñ,Ž€ü-P +– -¯q¸ã•NJè²8åë椷è¬îÏÌgâŠ*¡¿éI³+_ÖÉTíÍÓ9pÿžE©ìtGh¦¥[™L[}FHö¦24Áš5iÙŽÍ ¿ä~žÓ´Êý#To{.qĉA"´¸Ìˆø2ÝXƒÁ‹óz¨Ñ4·úu΋¶ÖŸŒ¬« =/ñZ´?NE¹NF“S&uÒ5Që¦VØÌ‹ÎÒÙó ¾~æn ½uêkM2Ò›R©0XkIäÒ÷cæFõ˜(•p—Ÿêh¥kÇ*wƒ®:CïцðUݤ—@@Í#Ÿó¥,—0·&’ýuʾÏ#ëôHâÇëëbÎWª¼/˵c³èB»èçvgÂÇùj¿ßd¾`4âà|„šxñ '™n‘–Ë–µâ×鯺øN±„V¨E`þãd³4 ‰[»ÌZû…z lˆù£ñšJ‡Ú¬¹场¢M×¼tØb×Ï­©˜# Mq& î}Îhå[î3>ý7£“"RŠ/áwí'8*“Ç­?‚öŸZ5Ó¨s²ÅÏ ƒÂ˜¾N<°»MExbMY.s ®<Í¡¨vs7>JÞJøÀ½B7Ia[ÒxX;D[ÿ*u+‡¶Å–ÇìjÆEgªùQsþøy¢ïQ '[¡Ï†itS¹†¥ãbãg¦¢LÁ…였ZŒƒèdJQ‘¤¥ÈG•iiïº%`꟮s|ŠkÆØ1!an‡*é¾aš´2ZoéПn9i<¹‰…V`Ŧ_Eú¤HxÏÑóq‘µµ¬Ñy¦¬nù:À”ü9k»Sþ®y6dßú ¦¬‡_¶€ÄšÔNUàýgÓJÆÁ5õ×æ¶'aø=™qØÇÕG&Avsn±bÞ1t?îýD_ä€ÆDŽßM¡X×ÄCqøîgïˆÕ ›>z¼V-Ì´ÍŽs–‰Ûƒ»\BˆnÏi¼ŒÚj_L|É¥º•Z¬÷ùßLðz–D6xpA…E¤¹v[9}Êø¬ø‰À÷tu=X¼'ÇxÈç²ÀÿSHYoîû­>ˆ€<)²“ÑâÔŠìÈ 'ðùê“u¡ï3yt7¾òèæS2,5Z5+t3ãF‰ìÍ—ßQMN”*9#Ó`Æ"“P<”bôùž›õ[›jžáÕò­*5|—íyÍãÁ‡ñ—Æ>‹¬<ãM”=‘O‘"màƒboEÕw»Gç1qÁVhÁ ó%D4÷¢^ }¼¤bhhší뵜:Fu›vÙ•ëÉýKÒä|_äµo>Kbç©û©„Žâ?ï^z"j›øSùþ àˉ¦¡ŠÚcåC›Faƒ)¯ÕäñÚa#W‰ÐQ¦Äûò9#s¼qY%DZí¸á±þtÒáï,;rȾšg•/7÷¤ùW„ë?Ï ´µŠþÂI—£k!Ú?nX}·3£BžZ|³À”º;B~Z›Í}A¡ÑyðÈ¡ŒuÞCܹÚE–ùL%Ų(¢ü†Ý®îFùù£2í£^ÏÄ© õ $ …¿ôüt–*–1—ßÌ9ï‘ÜÎ(sö¾¶š› á -³+5t«[(†Ø?mé'û½;&ŒÕ*ž£8¶Žv™ss~tAÀ ÉÌ¿”òa?‰zª’õôå²ÊëXyà9‰\ך¡\©Ûè‚V¹ÎFç劽ŸGÄÎ~7Q„Äa²^(¿^TÔÚ¶*ÿG5­7Û`ROÐÓ8ŒÓÏŸé@P3¨=¦"fS,¿\šø¼úñeEâº`¾Ý…+“|ûQ‡ªÊ]Ëå³×ÞYº˜ )†%êYïþw¼]É•22#ý¼Ð"«™þû>È–A^iÇIýE €¥RÇ«&®Š½›µëE¿å›Ñ7‹rã[r_†´& l+˜* Ùå%«¹ Âîih¹Ã3×'5„ ¯¿Ÿr >²ú‚ÛK¼Ê0ž½ò´iKfö£æNQñsÜßy® |É–IéqÑ»™ AÝxóÏnŒkeÄ#7a_±Þ{HŽ± ¾ú*"†ÎHò&÷¹÷š“Ž3’C °ÏMX.“ÂcY2]ÙD9ô\…·E(WHbðù²V#©•ß5Þ f­¸–ó‰çÙ±5YèÍ@̾£far>$¸1Vû¹«Iø(ÔaWp»ï‚²òz_ÝR€ ‡–ˆ¢Î'’F«½‹Ì$f#/Û-ØùoP¦¾¥6öË6ÚƈÕÿy˜¼Ò%¶9Šœw[š¡OÅaö0õ€ÑŒ6_ˆ}8yÓlíè@~%â_\×9;ÑX}|ãš*Ï0Î=@È̦û~Ð5J?ȉâK–›]SøÆ 8ÿí‡8ÌŠã+š¥a©—ÓÀó 1:ÀÎ¥û³«ñnt>\YoX %Ÿ—°S€â.#ÒÓHa™‘=‰]ÌiWÊq*^8„A[Õh‡ö8Ÿðé´ÖØ·Ât±QQß™Ÿ¨R¥Ï›{YtK"Ÿ?Å(ùÕÆW;ƒÉXTR6¼á¯·»dXë›%£{/c‹›u XáäÈålÁÕ+i1YgQ²žÛø¾µ™ìü†(Ä»áNÞ%¸#KSnô¿^Vì²õÈpµöôkx‡S¼]Ügt¹â+kÿ6ëPài|b0æ]4Ø,!{ ¥ ؉ï§;ói­w¬ÄKo`™«¹œ—ÊŠ1›hÊÒØ -—†?I‹ n?¤ˆ¼t=ã×) ÊLóuók3nÃÖ_ ótÔ8¦9Î7Þ®!a Œ7<õ!hÄ'ÍnINkÖƹÙz ïÃ!+•FÖ)|Ê¡ÇË…’Ò5W3vJ«ä<ÎvYázÇYßî‰åè}}©«°'u`F“ÖÅSSÙ¥éòîN–·¡¿K­uL*ë_wÚºI?%ÔR¢!î'¢éßµ &‰ÊŒBƒßM<Éۉђ{¿:£ô“ñÇÇ œ¾_mid›§J7‚Œ~å2}zÑþHC£}ƒw`hm^z]ã‹tþbþ]sÕ7ê_Ú‘*èïH‹úÊ%É'™É¾´œÕ“:|}Þ4F‰_»vhªóíþ~µÔàÏÝn’µO€ZRPŸ§b FCîjŽëùólC±ë“}Á/áìnß ‚ûH‡‚9Þ¨ÕgéÅ߸M\öŠŠ6deÇ(Bc9ð‘ÝÆøZl±îc2®Ñ§S‰¾è×õláÓT(@Êq OE’yc¢Ž7 I牤fã¯5ÈiÐ90÷96ö3ISHë ô@Nì˜5¥¡pd楛QìûBÚ}[•Ï' ŸÙ˜OÌx¨TB:ܹz¶äá®…î[­çº­1„„¯+«öêbùǦ5;÷AÝθÒ(§5Љƒ€CïÖ½¦§_¾åmgù"á¾ÒÎÞªðý@¨V¦Íséä¶Û·gñyí•-<[:/")Å»í㵞¥?g¬|÷zû±y(û[Y¥M6»e‰ Z$ùÊ1QãðëáØÔL.½¬Æ(þŒäý‡"æ¶k{ÅT+~%pç„ ±µ£Ùe¬w)‚γ7c×I6 -1éœøåÄf]q[¶¯F†kÐÍs>ek›Æ`äPo¾Ù¨¾×<ô‘¼û…y_˃¢ŽbµG–J0VÒ€â{Íq/ùãÖgÖ:qÓœ -¿ W–eL#ºbàžÄø©eͤm÷Ê_é‹ö¶ãÃôÖpÖ_™±jág1Yú!ŠGÉ5ûôç¨üÄ(·©ååY~ƒ¥ÇåÓZŽtqÊØGð)šÄ~Ý«ÆÈ%èâ÷âE’Ê -v41˶^“S‹„çI©v9û'/nFÓÉHS©™kX=jOjH—›c[ÊGþvµÀÙ´´œžnSDrÑŸšwn)?Å”»Ð“1¯7ÐÜr€TJ†¦Gh@1¥ÃÕdé¢ráþ„¢·WüS¨Ìá¬n×ÌY­ëš#5Ã!qN‰<ÊÈ[6Õ .!iÎB%ƒào#¶‚®÷¬^:Ÿµq8ÿ¬zW»Ÿäíg0 b*êã—Î!'|ì?ÝÐønšÖQØyÇ´‚i'œ9=„â+~SššHša^]]Íé¥ -.ùÓþGêUö¯–»Á£å«² ‚-¤K•vÃýr [½O[1‘³wW1å5ÞàËÛ‡ŠÈR")tù¤`š„-d´€št µ FГßúåÚ4†–£¢Ù½©&Ž::E+|_Õ˜jA:â?ØVà¼Ò:BbjªjôØ6õ4jú„¯~ñÅs8¨18½ùö¼ BýÆ–).P$G&Å6éCjèûÁÎ÷¡`D¢•$=íßAh$”¹;ë½$‹‰Ž ¤©øîZÂÞ¯ÒæPÃ;¿Q¼aÝË*š;Û™[ŽåN³[µû:z–Þ¼­ËCê|Œ±=z`,Ý?íNýÕ€+ÍÔBÐÈ2æ×ô‘})ñ«¨‘>}¾§ø«¤tþ©«þžR×3"1!;ßW+HÐ -õãWäp,j °÷ÿãûü`ã Á=`PÜ ûÿèŠ;Æendstream -endobj -2201 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 3746 0 R -/FirstChar 33 -/LastChar 121 -/Widths 3747 0 R -/BaseFont /PLRCHZ+CMCSC10 -/FontDescriptor 2199 0 R +1907 0 obj << +/Title 1908 0 R +/A 1905 0 R +/Parent 1871 0 R +/Prev 1883 0 R +/Next 1919 0 R +/First 1911 0 R +/Last 1915 0 R +/Count -2 >> endobj -2199 0 obj << -/Ascent 514 -/CapHeight 683 -/Descent 0 -/FontName /PLRCHZ+CMCSC10 -/ItalicAngle 0 -/StemV 72 -/XHeight 431 -/FontBBox [14 -250 1077 750] -/Flags 4 -/CharSet (/exclam/quoteright/period/A/C/D/E/I/J/M/N/O/P/Q/R/S/T/U/W/bracketleft/bracketright/a/b/c/d/e/g/h/i/l/m/n/o/p/r/s/t/u/v/w/y) -/FontFile 2200 0 R +1903 0 obj << +/Title 1904 0 R +/A 1901 0 R +/Parent 1883 0 R +/Prev 1899 0 R >> endobj -3747 0 obj -[319 0 0 0 0 0 319 0 0 0 0 0 0 319 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 814 0 786 829 742 0 0 0 406 567 0 0 989 814 844 742 844 800 611 786 814 0 1106 0 0 0 319 0 319 0 0 0 613 580 591 624 558 0 641 613 302 0 0 513 747 613 636 558 0 602 458 591 613 613 836 0 613 ] -endobj -2157 0 obj << -/Length1 793 -/Length2 1151 -/Length3 532 -/Length 1728 -/Filter /FlateDecode ->> -stream -xÚíRkTSW‘ª¡¬òRIÕzX™<1„„H b OyH̽!·$÷âå’ñA%UY±è’§¨(Vú@©%Va -ø"­" a9Rµ*¾æ‚uu•þœù5kÎùsö·¿³÷w¾³in2ºÂ6Âb %èl[‚¥R ›È3‹E¡Ñ‚qXN "'``óù>`•V 8Þ€Åp½\…‚±t=Ž¤ªàì9Iâ¡Æ…R9¡‚5d …\ d˜ =Õj°nòFXgÀx& 1(l6€6©JaNj’ J ðÞÁ6ý}*Æ3HQÀcJ¦' EBªÖVR˜k0²LjùoÈš^\¬U«×È5“姜úK^®AÔúߘ&]KÀ8bŒ£Ó©±ð;qRB´šéY !W# -!šª†½‚ÁZñG2Ĉ†"B¡J¹:žÂaš®„ôoJS¹Vêõû×N%#äJDéÓaÀúƒ=³ÿˆI“pDX ‹MÉýþ”4­™U`‚¦×Èq\®§CDF\``…`€u¤b&Åò - ÉJ §Lþ« 0ÕpFÆ$úàfêäì‘îMb}ZP¦3н9€Îá’­X+|ËÊù31E6iaIà²|yÞ¾Ü)T¡Åq%¦†Š´í}¬DH§aX+(æ[˜ÂoÛgûÏì¨ÍUw·õÌXXzt[Ç…í§KýÃ}~N7𦟢àO~sÜîør¡d$ü&¤äöSϳMs{¯£ÉÞųò€lÖ#ÅpbòŒ+åímií¼o^lIoòzô³ûó{™lëW?`óª¨#…3koßzý47msg¿ÙîkÈ}¨„’T~võ>8æŸ÷Š®M< Ū1sÍ•ù‰ž;¿1SÛîö¤Ý±/åË¥67Ký_Íayê”öÁ´Åæ¸2þ*™`öBŸ1¥Àêc·Ò¸€–æp鯳»=ùƒn¥öHòsJÂb%Ñ£ ŽW:)j¨ýCk¨ÖpCÛúVMz©ÀÒ™ï”ÖÐÅñ/f§7í£­KMûmÉ®™Ï’^¾ì{ñÖHm}¤0¸Y¹žœëå{00ÓÃkسƒEµ½þ…É-^®úê>! ë³[il×ü=p »eL -âø7ó\nûÂÝÌ¡<ŒköWüMºÞëÛfÓÞD‘Ίýt êñ¿.·r’ÅÁ })ç¢n{]©k¼Xâ\W03ÉÔ,W/ižõÍw p^è7×A˜h‰ªÝæK=º¢‡ªóÙN܉ñE'>‡z^ù ýTmj9ê³(×vhë‚´ÝŒ‡QË ¾¿Ú\¯KÑwùÖ2ý8oÙ~(*›¹?íDmxíþ ξãü†Çl›ŠìóÏ„Í?(Ëñ"Pï¾ùùrÏvÚ†«uO‡¢ˆ—U) <>ð\kŠ£–“ã†Lιµ¸~‰©ozŽ®;\cسùÑ“Û+íÜ@Ø ôò©é¢ÏKrßní ÕÚ9Šš;Ìèýã¥wìGøƒ[ÏvÔºûÇ}³4 •Zñc+#éGe”¥Ž÷*´˜ A-Uš:äb¹$Oõ0»š¤ÎßKž¹¢¦–tã1A;òúTuI 3×Ò»ò´±z¬J€Ê–JΨ—[͸;sìi‰«å9¾åÐõ0^cÅn(ðNeÄúÑÊ ÿ{ÝÚ<ç«#…¿œõ–*¥odûRæ+³ôº®yYÍÝe *tÁtmg×¾ä|uÆØ´Åj¾F}g­êØqÃùZXŒ½†½5–¯ã¼8×™oóaNá**uj\Z?¦;PVfé?¶ërVôǦ{1®e¢’7Öñ1õCÖå‰G8§&ESƒq索bûOcÔÁxYT¾¢ýNòÖUÃÒúÆ“{ìv²«²‹»ç´ÌZ¸kËÏ.O–eÊ*¿^p—Ÿs^Ìíœó½ûâ"%çœ*ÕJ½/ê Ë~øÃGж!£KžÆž+-,xiQõõ­(– _íÞnÛK«ëV7×”ì•Î­uÚðA¨Ã‘Ž«‚ëþ{:Š;¸›ÚǩˈWoN/wùVŸRÄé1>m]¡G[±û5}MN팼> endobj -2156 0 obj << -/Ascent 694 -/CapHeight 683 -/Descent -194 -/FontName /FPBQOM+CMMI10 -/ItalicAngle -14 -/StemV 72 -/XHeight 431 -/FontBBox [-32 -250 1048 750] -/Flags 4 -/CharSet (/less/greater) -/FontFile 2157 0 R +1895 0 obj << +/Title 1896 0 R +/A 1893 0 R +/Parent 1883 0 R +/Prev 1891 0 R +/Next 1899 0 R >> endobj -3748 0 obj -[778 0 778 ] -endobj -3749 0 obj << -/Type /Encoding -/Differences [ 0 /minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/arrowright/arrowup/arrowdown/arrowboth/arrownortheast/arrowsoutheast/similarequal/arrowdblleft/arrowdblright/arrowdblup/arrowdbldown/arrowdblboth/arrownorthwest/arrowsouthwest/proportional/prime/infinity/element/owner/triangle/triangleinv/negationslash/mapsto/universal/existential/logicalnot/emptyset/Rfractur/Ifractur/latticetop/perpendicular/aleph/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/union/intersection/unionmulti/logicaland/logicalor/turnstileleft/turnstileright/floorleft/floorright/ceilingleft/ceilingright/braceleft/braceright/angbracketleft/angbracketright/bar/bardbl/arrowbothv/arrowdblbothv/backslash/wreathproduct/radical/coproduct/nabla/integral/unionsq/intersectionsq/subsetsqequal/supersetsqequal/section/dagger/daggerdbl/paragraph/club/diamond/heart/spade/arrowleft 129/.notdef 161/minus/periodcentered/multiply/asteriskmath/divide/diamondmath/plusminus/minusplus/circleplus/circleminus 171/.notdef 173/circlemultiply/circledivide/circledot/circlecopyrt/openbullet/bullet/equivasymptotic/equivalence/reflexsubset/reflexsuperset/lessequal/greaterequal/precedesequal/followsequal/similar/approxequal/propersubset/propersuperset/lessmuch/greatermuch/precedes/follows/arrowleft/spade 197/.notdef] +1891 0 obj << +/Title 1892 0 R +/A 1889 0 R +/Parent 1883 0 R +/Prev 1887 0 R +/Next 1895 0 R >> endobj -2103 0 obj << -/Length1 867 -/Length2 1181 -/Length3 532 -/Length 1804 -/Filter /FlateDecode ->> -stream -xÚíUkXg]A"}o 8È"÷$„4Pd¹K€D¶€:L†d ÉÀ0¡á*¬ŠÊ¼pUARuED¥ -´4\*t—ˆ"^º* ¬¬tÝvéÏÝ_ûìÌŸyÏ9ßû9ï÷<Ÿ©±?ßÆUˆ…#ž˜Œ°é #àîË™HgRLMÝq"PLæˆ#r8 à* `²m™Ž,6ÅpÇ¢ãqT$&sw‹9p•"8 -C2À"Ĉ”ìC€Á(BÄÓW‰àÍ­ˆxH,‚Ç!B:! -@8"BeÆœ#oY°`¡<ú‡à±¤)Àœ4i…˜L‘ -ƒ‹‘{!¤“ÿ†©ÅÍ=å ’εŸOé7<$E%ñï˜4ZN 8à‹ \¶Xú9²`΢rébÖ›€$(ì*IÀ´§3íX ë‰*¡?JÀb ’Ä"ó8".¶BÆ7o„ÁÝ°oõ~®ó¤?„ʈñÑÀüE=_ƒ¿ÔdJ8ªv2éL&H -É÷×`ÑfÛd0&De"À–å@8ÅSÈDV, P™Qˆ‚tÌ Ë0‚\Ñ$N™+h0`‡%<75bŽ] X#œÌùÄ´%1‚ ñkØî=¼0ôáä/3Â!8*VÅŠçáßæäæ†)ml9€ Çô ‚›ÍJþwa  ‘#Þ‹Éd~l»,ÇqDFÌPrꔜ‚(˜2 Â`§½‘ùµé)ÛÊzÎ.cèL·ÿåñ€vSP]J!*L泊ŒE„r¼t¤&«™uwƒì”»¿¬ŸÉý*tâÔšó5%åA‡SYô~>5~OFÞGï¬Ìƽ›cþXP´oÄÀ±W?hb=0a²»]·X8æRÖðzXµbµ%ï¨åæì3ÚCKÖSã‡}·éeÝîü6gøy×àgÞþÔXÏ ³»[W„O@S(‚ˆ¸»w­ºÞèùrƒpf•ßW;O lÞoú¢…_®˜ÌH1Hìû6Z›zïÀ“ÌÒÉ$?J£¡[ëPOó޶ơT¯ÃÏhíj;ñÛíVܼµ"æ°Æ¥‡uú‘«*Áý³cÚ¿NySE]É1ôxšsºÞùu 53™¾½¶ ø'e}ó -Uý:pKï€û¡é“:ÜN­ [_yÍT^8ë ƒ:ú̾SÕã¥T§J§«")@p…’éy¾Óʼ1:üçÖh»¾cúhRG°3§ùì9=^‡£ ¼# dú¢µ•_)ié)¯h̸é«ÜÔ83µê«>ëô3©2ê1ޔфӑo]Ÿ~>j¨|é‘I +—ˆ¥{Ímø–}U¯z4MÜ‹óÕòÙî¦Æ.ÕýÇf´ö ,{®W²vÉ^Õ™[½2°dxµž;6MüC#êjqSíçM¶ûü¬„Ùåö)‚b|Ë•e3‚aÚïËÎÆ-­o1Ëønk‡vAÅù«Õá+±ÃRZê}]‹n1ó¥ñV.-ú¸Šg ƒ_Žg›¤yh0Rn ÔMZ_x165wqÍßL¾îø‘m›qÏ"êJÒ ÃÁîçª0#Õ±°Êî0—Ö‹ME9'÷› ¡ÕÕ¶üBCWÍ×Õ '¹ì -«…”A?©u=©ëëvÝ+ÌŽ µÈ*¶à§ºÔÛÖÀ1Ó:—ϺÓ*”~ŒàÊ=ê÷!^¹G“?Ôyd:´¡jœ6éÕßö·Ö†——uÇ&izP¡§£§ñŠòØÛÌdšÃ½Ð ‘¤ÒÓ œ-û,y[šíÊêu§ÛΖ÷kÕ¼62èù”7 ãSµ÷T ûÂÒ„LšH«üUišé9ÇÀÇ¡áŒu7×À]/‰ ìÊÝiøÏjáv -s€öV±N?é¸K†e¤Ï÷cÉGr"êj½¿>ü×µTÝÜçVœ™,qƒ:õ‚²®¿ÓÓmý;Ý^ñù㡉ÖÁwÚödGBö£œ¶†iùT̳DžI®·–+·®øÖ¾·«vƒË¾Ž“G² -¼\µ:îBŒZ×Y¿`s¹á‰)w³‡Æ!l#éÑŠþÙŠÅýÛ+Õ?°[‚íõüÒUKyíhÒèÆŸŠÝSfÚ}ÓmŒØŸfmçúvøô^Ý“ïxÇÿvÃ8&FKkwïÓ¨.£Ž–]»4mÝ2Èàsm÷œ«ñи¥ùªÄ(Øki©i5ïN¡oâ+Ÿî7Ζ—Œ ì ªmÒ½Ës‹|®?Š¡TûEÌë}­®½¶RçöÅ/éK‚NœÔüfåmñh¾÷'»ƒþrå¥[¨yãær†ôzÎþõŽ2‹0ä~Õøle秧xæ¦È¼79§š˜ÿáCùƒÿ‰äÍ á&…ð(ÊÏ•À¤endstream -endobj -2104 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 3749 0 R -/FirstChar 13 -/LastChar 110 -/Widths 3750 0 R -/BaseFont /NKXQES+CMSY10 -/FontDescriptor 2102 0 R +1887 0 obj << +/Title 1888 0 R +/A 1885 0 R +/Parent 1883 0 R +/Next 1891 0 R >> endobj -2102 0 obj << -/Ascent 750 -/CapHeight 683 -/Descent -194 -/FontName /NKXQES+CMSY10 -/ItalicAngle -14 -/StemV 85 -/XHeight 431 -/FontBBox [-29 -960 1116 775] -/Flags 4 -/CharSet (/circlecopyrt/bullet/braceleft/braceright/backslash) -/FontFile 2103 0 R +1883 0 obj << +/Title 1884 0 R +/A 1881 0 R +/Parent 1871 0 R +/Prev 1879 0 R +/Next 1907 0 R +/First 1887 0 R +/Last 1903 0 R +/Count -5 >> endobj -3750 0 obj -[1000 0 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 500 500 0 0 0 0 0 0 500 ] -endobj -3751 0 obj << -/Type /Encoding -/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/exclam/quotedblright/numbersign/sterling/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/exclamdown/equal/questiondown/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/quotedblleft/bracketright/circumflex/dotaccent/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/hungarumlaut/tilde/dieresis/suppress 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/suppress/dieresis 197/.notdef] +1879 0 obj << +/Title 1880 0 R +/A 1877 0 R +/Parent 1871 0 R +/Prev 1875 0 R +/Next 1883 0 R >> endobj -2098 0 obj << -/Length1 1930 -/Length2 16115 -/Length3 532 -/Length 17214 -/Filter /FlateDecode ->> -stream -xÚ¬·cx¥Í¶¶¤cvlÛ6;¶mÍضѱm»cÛ¶:¶ÓqÒq¾½üÿaë¿u¶²’5°þgùíÔÿ3n`mnåþ?¶ÖvÎN[c€ƒÍ§ªþmN`lîlýߣNVæFßlL­´Œ,t ,ÿŽ›;Šš»ŒåÍŒÌL ¬ÿŠlŒÿÛÉçþýËý7)eqaêÿ9Ú Ê˜Û8)»Ûþdÿ‹ÿðç&9˜»h1|î2ãgâççéü—˜ˆ‘­±¹)+ƒƒ;ôçCôI¬žŒæ6Æ7€Û§cz:[§Ï)Ÿ;ãM`bëýϹ~=½É¿bÿF¦O4ÿƒ,ÿŒþaffúÏŬ ¬ÿ„>SìmƆVÿ>óÿŒpþÏÈÿ ³0ÐÛ8l¬&Eÿ'ú_ÉŸ~ ÿYÂÑòOðSÒÈÖÚÚàO„•€ÞÌÝÎ `ó'Äö¹àç<[ã?!vzG+G³?z€ƒí¬Ÿæœ\ÿâO[NfÀŸÈ?;dëìð'ÀüÏ–¹ü•ñ© ø?U°~ -Û˜Ûü•ÂñOV¶ì²} -ì?{â?æ¶àøÏ%ð'øYè·?ô©$ø‡>U„þЧ„ðú< ‘ÿûg•¢èSZì}Ö'þ‡>MHü¡Ï—üCŸ^¤þЧé?ôéEæ}z‘ýCŸ^äþCŸ^äÿЧºâúTWúCŸêÊèS]å}ª«þ¡Ouµ?ô©®þ‡>Õ5þCœŸêšèsÞŸ‡Šósžáúœgô§1>'ÿ…ÿß_øÏCò~Öaú~bö~VòWË1|–bñ~z²ü ?MYý…Ÿ®þô"ãç%Coó~º²ý ?]Ùý…ÿ<`á§+‡¿ðÓ•ã_øéÊé/ütåü~ºrù ?]¹þu§|ºrû ?]¹ÿ…ÿÜ)6ÆÿÛ–ÿïU*(hëæIËøÙ´LŸýùi”€“ÓûÿfªØ˜v‹„ðg 30p0qü+jäìðy¥8ýë¯Ø§Æÿ²‰ùçÕ¸Œ W–l¸ƒ,RšBÊ|D -fÊÁ(qÒJ‚&º‚Ò¸éÎ6¹‘š§•x7ˆÁˆæ_“IUÑ›°nc6}óöT¢þ‰8 ‡B™—®qit¦­ 2’3Ô‡`v´‚¿o×L}¹J|¿åÒV-}ÂÈžù+´lyéíÖÇÒwr{&Õ˜ø Z'§]:  z¼;þ|.f[`»R4‚®~ü¾‚Ù·1g¹—Æ‘#óe1÷ŠÒÍdgš1ÃE=›Sü£¦ánÔeI>í§,{I‰}ÿW\‹9 0döÂs6!ˆìóíÑ -åW:±€™…Êá;ú†„rЂnIì%ðóF®Ì·q¬/_ŽçÈ'¹žc`LJÇàí§UꙞXœ¢òÆùÆñuM1©Ðr¾3<]i]¡Ý7N CKA$_€+' Ò·©tt¯dŠÊ¤z ̱÷A>‡À Ò©Ly²HõÑñî¡«¬T_gKÀF µè¢Ÿû–¶¢¢‘Ìɱ÷g<¥Ð:ž‹9xôÀdJrͯâušø@¯Þ+ÝPéÊLÊ<½Î†™4¿˜à‚1ˆÈÀ- B{p8?ž»šßRáóûöö8´mŽº&.œÀ±RP¡ƒ‚°Úhf®Tü„`¡R ÜW/!‹W¼SÆi7V¬Ï^”a¶†ÁŒÎœ­ « -<#Ȧ–GÌ7æ@ãÖi…ò'l¼%U>AÙÓ¢ížLõK}CØ̆ ñ²«¬Q={B ‘é)j_PÙѱaôcÄUœ–¯éö†ö5¾Í ÀƒþÕAçù£QâW2•=mh;¬qqIG––Zv ÿ™x¢N'I[æg0#´%tv”-e“ò³òêCø×PoÌŽ¹èôF—šSHû7 ýenµßÊg£ÝÎØÞÔL"YiÍ5+‘‚Tˆ]S¿me_áÇ.Âø¬~)í™F92Ñ^™ý¸z÷~Qãä^-ä,.ìO~Ôg*óƒ:Ý!ñô>ææÞ·¾ Nýе*Nb$¢Jö‘[ÀÙÐ_ÚGKWV±¹eˆskôB+1ší:'7î<%U »”Å›Ü9ºXKRA¾£Û˜æü¡H…Û·®Èjs.=¶«ß Ò÷Ý‘^ ¹qâè¸)/o-¤ö”ã;Ÿ8öi£ñ¯•öÄ#7¸‹"תr´lCy5Ê)GØíŠÁTWþz ÛßxSX.¿ïz†¹¬A¡°`ñXì.ð«ÈeQHÓÅÕðè"ëÏkÇ{Xª¦Ó/O[r“—Â&?(Š¿?itÌ`Þ7ãxö|3,–§§¡›‹Ïf°§Â» uŽÔð³2H[aC,Ÿ|j@ÆWÞ{›“à/0³²E²ñ¤l¤›œšÎ“2“Åó³×’pÇç‹uL,‡lë&ØŒâ­\”Uéû½*O„çì?>ön‰çÌàïÑÙû Ü\È[\ª·‚Ì¿K0Ž_/g%£Ô¶`Ó?²+½â?ê'þ.UãžÁÝ>|ÂUÓÅË›Ž)çgçÏäB/œ›6¸½ÝÀ›°§'!*¬™eP2Z}Ëaiœ¡RÅȸkv -žŒoqóé9£à $ {¡ï33k«Pw_ó'ì#ëY®—97µ/S¶±ä—4)•(fÙY‹´E,L}ÇJ‹üÃ>Ýv¶x=ýQÑ”ré`‰¾¨öQd ŽP—JCÕêг½Q…×Âg¼ßÓÎGµpè¼(Ø~¦?ºGÑ|1x×cä[ñuúÁÇ4’&ÆB,䕪^ýŽxY§’ -]åшž™qkl>üLJÒð¹!ÿ¯Üê¶iD£µÎ…'¥ ÎÉ°Ö›Ul%;±õÉ]>V² 6_ИŠy&_ù2'X,‹õÛêƒ)÷¼qï­ùIä‚]þµêÁv¯y9Þm?Ó+ãáœßÍK*³òb%Ê…”äSç­no§jBúÚH²;³¸uåyE—ú^qwÊcQ C³rGø´Á÷P£Í¦aÐß߈_hÁå¶í”æ*ÃÌZà;c¸îòU‹Ç/ñFÞ-€ÒGíe -<ÕÖÓÁÃjDÅSÒ;<@Æ…êUXÐ?v^T×zÓôY2fÔ2k?Âêò¨cË"}éI²`0Q»ÆàÔü|¥p3¾I*x^6Øá’ŸX!G™y£Ým2úª·€È”"—}ôk|”³ÐÁ-“wÀÍ´Œv¤Z§ëÐdu[Ñó7ú>ÁûÊ]CêÍ0² Ì@¡00½úRqÍÃá¥$óNr*ßÕ¸£·M| $“vÉa–3nGPP¤4œ€qGç”]rÜZÉÄA­[Äs·£Ù²—”<ÞùKûèfúQšŒþ:KDf´±2ÅÑÀ”³*_[»´m¡äÖ¶×Ë7¾ó‚gƒjv -ß¹Cõ„rï-4ŸÆÙcèk?RÅk­”»=fbð)Ü‚Ói%™o‘Ïvòü™Ú#¿`³è.Ì<˜"f„jº¥yœðEŸãKÇïFBâ~%97ñýš•¢ÛH ž\žÆi·ˆHÑ}¡!Ša Ù%-¥k2W}áŽLÆÎS‚ŒÑŽ§bocSw¯bùeÞÈ4F˜gÛu3Cæeݱ·íA¼ñV¦ßÝ.Üu³ÌþûÂŽé„5ÖÉAZ[Ñʆ ÚEªT½ý%˜’žÝ\FPîmÌ1!wLÉz®üpGCŽ5*µ¢w÷•ýJ¤‘G7«p¦tÞ¾u¢ §+íp®»ËÒÔ(Z¤‡1Åà•H\½9BØÅZ½£¤¶ÓTV9>àG›Ÿ5ƒ±ÝËy¾sR‹y3HX5ÚØ0€/%.§<åýX¿û¥ÄI"@•~ ÕÅPç{U{åX­¸ÄXGœÃ2³ÿ=FÂ_Âxgr^ÀèXd\~„R¿Î€•¬í2Ê‘¬†‹/õ[÷r Œ†j”ì`ñ€„“0ƒ]¯y~„ ¾S‡ÎAd$–Û8y® ש…dAj9)7Ì,°¸¼s‘»ORšÓÈcj¤¶tº±gAãMaWGªÞ(k¼gQi·öé7ßd’€¬==ãGœ¾Õ¿ÎY° 7L³%EŠ] ©å[±è0ªª <Û6믣˜‹¼`ÔvÕ„íYNS\§ÓZ÷œ=±D׬¬ñ gÿüäøJ$¦œ£eà4¯”\:ú/ÑþD_ª™œl-.;séÖÈMØÔè[Ñ(Y„d=ªR1š ëªcŠ¾ûü¸,1\²*ÆÖ¸ìíÈõ¥*E•œšÇ8ëg…}€8%·íï‡+á Z 6ׯägšfa5ý:ç&;5¶V溜BœÂe2N»Ëº6Ó¢LÄ9rƬZ¶ÑÝbé™ø3E ³¾ŠhJ™Úš(o2Þ6Nÿ¦R¿>? -¬~¦çe }@—–ðÆ oD·æVÙ…Ý…É6iSú‚$ -ÖŒ¾E¿0! ÖÜï">È^ô²Õ2¶Y Ž¬äŸ¨Û;Æ¥ç€g“¨É¾vk”퇮7Pƒ°]ëwr¥ÁNÕ±xƒa&ºLZŒÑEÉú#ˆ$4~8õ…~lŠ]š‡J(Èuš)-žƒM&Áb¥ýàÞ¶jL:ì%ìèÂö¬¯yí¬»–>/0òš´ï'ÄAAÔpkã†Ø!W©J[Þ‹”Ì\ô ?•Í.ÀãT r>Ò<@RH £ü77ÓªúOT\_ÁS«Ò^±ùøÏú8íKÞ ƒ~]þZÐr¡¨Z£®_¿`k,D­5’–ŒÈ×ë -ˆAP«I9’u/É>ž­›ukcöQµP-d¤-0`êævbÜR»Æf™‚Ðï `0¬ "i?¯÷€91tòÚ©IEO½¿cøT“¬âµÒ¿RL µš}_x'PCÇ„~3õ/ÔÕ¸Öd'~(E‡¥myd.T¿\-å•{¸ÕŒy íé‰iÔN±ä¦¥-Íì?çuÅÅ’~õ²F‰îK`oIh>ÛÛì6e ‡/ÓÇ"Ã>(KåÊ_^¹Î*Ôk”dYÄsš›Ew“õ*áf•®ûým¦á&ÑÛíµj®=šYfS·ÑReéÌŠÆèÇZš¯}øŒÎ”)Ê3»±§Hqí8iøËyKˆ /žÈxNlÝ÷ì%iæ¯ 6 ¾ã 9àdÉË0Ž{–g…ƒ_Q["†¢E= ZorMg¨Œ´Œ - |½§2ó’0jçÙ…è«O¸ŸÓ݆¶;ŒÏZuÕ3ÞÒbÚô œ¶q¡rûu‹-:BÐEÖ–ø¾F¡ßòÂÍ0x&«í:Ù¾Ûh7Ö-Ð@¬„¶‹Xš­…ÒªYðì_¹uj›R, ö¤T:8J^§Çé¡&èJˆsjgå7ª6¸%ñ8cFä"Ý”ØB6keœ2qhq}ù8¾«±r…H"™Ä²ÖÔIð1åÞrK=/Èð¿Õ~BÜßø†¯HÄòmk;I_÷ˆ°ÙOÙøîÙ§y$r*òªí=™˜.D¾[?ù¡ÊQ-©*?Î#×âFl»¯sU;ߘ~¥’˜2 Áï©»§åW³ÿúô„NŒýk2=¯øNçRe´‡¸î2>[õ ŸÉË3W»xS¢õQ#ò†ÜæŠCC"d—e‰ûÇÆ¥Crzâxáˆ7#bª¯¹^`…Ì¢íeþTa‘õ×ð-”wg‚{É-—<ïήÓ)Èì3«ËÉÃSu±fÑá4ßéÜ'4[Ò”ÙNxÓ /( ›Š—û¸)óêT@%Õm¿w6á`\&Ó«™w÷„·4Ó>`Ÿ‰ÃX'ßÍm¯(g¿=JÁ’•ÇÝN5Æ»)þÜ&1ÛÖ -®  v6®©… åùU´²âq÷T²¶¸Òm 0¥ :1ØÎ>$X?ØJ¸ðE7Œó0ò‚W6™G’¤áæËlQCÑ¿i·:;óQB¯V™}ÀÞOwj¬ýeí’ñ…Û!pÏhôšU³ÌÁ¨“3Kwå[ŸùÒû‘#ò×LJñâþ{|Z†k"¡ÅQ¿N%B«E…íµòÂé댨S¹äù4Å Ìæ¬o’o*yב•àSÝë˜G—–^±‡RÐ\Dsê­„­ž!ÙêHE½_Åâ¼wE·Ÿ]°+HGÚVLúmö…ï&Ž—ðø`6~Fx€Ø$‰K'á6„û•R²FÊ‚6Cc^Ž¥µ,NÇo•‰üÞgƒkã}O$Ľÿ ŠS}¸¸ üt‡*sö„¶K½F¯€è‘ñ‘¾iPÏÓPuï6ÇZ4Ð\h/= RaÎÍ Á­½Ô)å¾>Kµm¸“â .aЪåœî‚3~ëÜ “ʹûÙÆ«òðk -#+ÓÂaÔG]%8Õ—ýÔ–Ãíæk×J ûÛØ‚&®½Ú6»'ÆϹ“Ë2t&Á6¡ðèeâå1i!È,)üÓ{.KÕÊßÖLÀ4pX½¦óCå_Š*Ù êsvöíÕtç³*æ¨ÎMÁûÈãBj4ú©;"½q…º«iòÈ×éæ&½/ÄÁê—*›®Uø -ß šµ¥=ßñfprCÇGlªÄe $‡ËÓ<{‘£)ö1¿{]Kà6œ<ø¿¼úÏÏú[’ÏÞt=IJM%¥<%ÂgDƒP£hò µx–Ð ºÇÌÕ^6HoX‘07'$â¦Û{Á®h5H‘mŽ fÚƒÞN×uwá¾ ¯ˆY½G÷±8Ó"Ÿ/c¢ ŸÆùYèaÖçÌrŸ'!!—äTÇr{§iˆ»ôd×–L¿9ä:œ6ÉÜ0)}ÝБ‚FÓ>ùø韴œF»SnhF¶›Ž˜óöµ¨_ƒª €w¸›vwÑ‚OÔ}ôsnÐÁ y/+ªñ}iSÂÏ«çÖŒ*Æ{Õ@þÐ:§¬‘º$ïrщ~¸õ'·!äÊó™+äà\¨w°-r Î7n"\#'С§ÂþìˆÉta#×RëûTTÄ/Ôy¥¡¡»`oA‰ö–a5/ ÊJ5+¥òn)܆RjÏ1tƒÉw*éõß^È:“ƒØ‹éW¨à‚¢0†aW IÓ~q‹©šþÊfçW3=Øq¦´|Dñi-MÒi~âæ—ĸÙæOÁ €€Â­C«hÙBïqf«gÊj…¨)Æž|»Ý<3‡ÔrˆÅHu¾lÕq¹¤r­weÉg”ó-geÁä ’•O]´¸Í"1]¨óŸnÙ‰`—~_mkÓú!|mÏ€ÑÏß"Ujˆú}´O}³Gý%Ã3:wàg -òȸ‹iÒ>ÞÚœ3‰ÖñýÆàЉ۱“œoF 8DZ6€-9NJ[îDÿ«ÑðJäÓλM̓|a2‰‘=$.€20æ÷X¬ñ†ñnRo-€œ £¨ÌÊÿ*I||ˆÀ”V1ô—VG£–LŠÚ!¬‰©T?XˆçZZ¢á¢Ùœma¢E@ !*t`²øþ­Â’ÎmzoáÒŒDo'÷~~G -½+Û«ØË|cÂKd2Ìý+ué-a§]OQrõŠGèÍ(HÎ^—Æ©K¾/­^LŽ5Ø%É¥‰äw½lªSþ“-@ÅÒ½ÒÒPI6͘î·R˜Us§]ê€È|r—²óÂ\ÍåµÆü¦U²  €Š-iùÕçÅ(˜³SÞ™TœŸŒo? ðÍŽ™Œƒ—>Duv9üàˆƒ£l¶uW±)1_y‡XiIZ¶ÉeýAÜPk %Xr!p€„ ’RÃî H³nb¹/1,KU§°|RÏѾÁ-A™{Z¯©¿š\ºlW& í(ã.¼Ïà~kJ‰]ÓI³ÃÅÚs70Рâõ.Y!` z’ py£„%dü.ÖÃ÷UŠ‹Êì ®ÊÁDjéÉ:üTj²EmᨼDÞ‹­¹P“2™°øæä¬Ç7. N“!üûJú]¬\àIOÐ4 þqZÜݲ¾€ÁT÷¾XÑ€ì[>ëC-Š¶/4Hòß=¿°ˆ9Ð2oÓÅCšd_ö5B˹Éh©¿9Ml4Ñá6&ÒâžÊO“U5Ù¡36gœZ‰pf¬Z}BŒUN|-ÙrDÈ r[j¶kUšSu#„«ç7 ñÔõXOZÓ¬e<Oúé£Qè¢w$°ÛËhwqÏôŒã0†G™Iw]Ë;þÆòüž‰ï?|Cþ"Z¡±ÿ›[Ö¹ü²GjX&fÔiÚ‡½>¢Æ¼Ú U@@•®;šP%@/‹“úÁ¥Æ3PµÉY þ.äÔuEX[áoE&.ž3™Óæîà·P•f‡ft‹‹6-Ë[“ ¡f§ïfWÕ‹¼Ô——Š™™[pØð;»|,z—±Î7)°‹+0˜Û-…¼Sä«Ë¢É¬sù*ÏëÞ«F@¹ÉÊœpal-—@jQ.¨~Ë`1ûK ê¤<½ÁKHYÁ…´£¬è/zü¶8e ¬ ¡NA—ö/Ðh_£¡&擸«Å­'(Œ^™EV3ÛåCŒŸ¥ÏdÆó¹ó&÷ù0Þï‘zÂ}` 4€c—|\jï¤ëolh -ý8Ž§ -ƒ9ß·w3Û¥ã 0¾Ÿ7qf³GàIØp¼¤êñOŒÌ–ÑzˆãžNÿ¢j¡ÐŽy˜ð#îQ°þ—¾rÆ—ñûÉ7Žtñxåø"!mè5ú!=$C’FöamË?)ÊŽâ¨; &è]ú2¼~¥3Ž"lÍ_(Áðq¿ àM«µ;ÎhÝlÚ n9Ü RáS1.“ZÈNà I5õHhÂ,¢¢õ~H¶Ø`-Loè¥z¼,%8庉>°éE‰MÌTåh$q÷NtbÐ×ØlõVعôô«‡Voë'ÊZ©õC¯ÂBܶ¿¨±ƒä… Ž5öaÔ0;ÄþVØ÷ -·­.Çw:\‰B÷8e#;W²W¡“mj^î}£u´¯¬šï_Ô÷‚÷ à[¹LÐéwçeÞë2×Aw^yŽ†Ð¶ðŽ­92cZNõív<Ã:ÿ^nûâweE¬íc”ó¤µP4µFšµØr©<«£ †DÛá»ûR=m†N%žÛH:B>ÿí¥ràOkUÈÒØt|0…˜9 –0–¯ÕO{À„Uh¡g'O„³ß{êÈfFÃÑÒ'Î]hnFJáQ¨èå©h9Øï@ãþ"Uå.ç8Ä#¤ªbQwÌäywió£ùr9°„ Ó*ˆG®‹ï&rJc«ü‰£–N!L† »YX‹uceF·¥6µòRå•Å»F£j o&‘¦™ «b¿«<§9HfÌ;¬Ù>/öÔÌ¢`Œºg9ɧ:8'^OC—3o¶I“ãŠ:]|Q!-HI‹°Í8w†pŸO•zùê°)ûôV]ñêŠN—Q<îå+8éÚ€Z]ƒûJf}ƒpX^–\½†L¤mžµ“{C¢©EïHÅ!û€Ï€Ä>¦‹ dñGôIº®ÂƒÅ™ßÎ0šLܶP˜ÁI]ö BMìM¼ÜÜ/Uƒ»iŽf‰Õò%§¾/v;K‰"¬þ¡>zà1Ci ˆ6 ¶ÙÛDÖ@&xÔ‡ï|(ß«&5”¹å—[k† }VB¦ˆõ»ö7Ö~³!n‹§oÿóÍ­ø{‹»«’H¸óÈVc€Ñ‚ÄGµK©¸ÂÏ(/ÛÁGË‚`”­([]ØÅWçŒòL6zé1,ÅòN`£Ø(ÃÛh‡ð{ÇïØÒŽ·3¢$gý«³1%ÂÏ#‚{ÁGƒ@i?­­!“8IAè¡Î‚ÒÀÝॡdü«Hy›€ˆbe³NUúS¤ %b[œg†Z¢J,NãS$£ß§èd„Δ¾ßç%"¼øe­ÍƒÊŠj&#€Âs¸nñxj‡€¨öÉÏaÐf.8BQ‚ÃËÏWÊûç•ÿXÙ†òŸuià®-Ïv)—ïçâgœ3ƒn7H¶í‡èa0ŠA¤&¹ØØu¢ AÔ»£¤è -y–;aа -ZôH›o@…#c½6%ïÍRã$øŽkP=ózXü=c«q¿ÑŽWfÙÄôbß½øcµ›ƒ¤odëå{+YqêµDFôÅÓ.XUËöåäGhÏ ÑT4‡'â Fü¡´å/P‚ zqmZœŒh…úë°’ÅÆáøü60ö1˜q1Ó‡FÐk¬Ý@4!­K ¢‚Í»p$…B;Ú«OüMuåº9©@ô%w~™þÞÃÓ” -ŠP¥>I/XBAȱÜ⨀²d¾.»ÇKÕmºÖf÷G¤ƒÊÏÐj!7øé¹:/ŽV?0> É\ 5˜˜VÉYæåôþaÄà_g\ê -Ûk”‹'‚¨Â&£]# l›ÌÇ›Ž{K.¿¼øÞKÙ–àZî#á±@Úô²~`-K1ô¹1!ƒ‹n¥vMFºØhà…0&ël`×íŽs M:2gu”¹îà.÷dAܺÓZ¶ŽLµ£ûeß®‡xëâ|¡ê 5ÿVqÿŨŠ>Xáƒ{ùRÚU¥ÙMã­1`ƒ•ðšBß]F‚ìk«61õ½ "›æÕÃÞ£d¬þ†Lò{‹:ô™¤(3×K‘‰†ü&ê$" n6¯G)¬ñ2÷\{ÛoˆšZmoÉéxË×nä×gµÖ=W‹‚TD%1ƒ•)p/bø•P’#®QÓ ðÈä-C/Qç+j½JàõÓab‡InQCë_‡pŒ?ÆbúM¯,§è–F1}׃÷Z²È§VÒ9H NõÞ°é³ßO¸±4†4 -’ƒÛÎÊT?Ñ}.Jõá×$M‡Z…6§½Ûzó×Ú£_4žÐç -즭…_UU¨ë¸=™/µCœÃ´…f§á]‚@ÍR_%ç¶2f]ëIÊBŸRÒ²AÄêKÄV"¤¿Ã¦ùÈOi¨àkT¥r”µOWL21²%‹6pQ?™E”*ƒllV­Ç‹ÝŸc5­ÁíS¢×q`(#cÑ•›ú™«s½ä0ëÞ+DÚÛŠIÄ„òä„„Œ÷¨5,q2 ‚¦*mÛß"(´@Eì   ÷P-C>C︧YôÄPÙwpýò@Š8JÔ çò|†:Ô 2Ø!¡¸ñx-Bé…ÕÔGO%õŽà¨Aäu=Wc­•á Q/wêéǪ³¬É±.cLï f'ƒfýî+¢Ìîv0n›SÊíZizÄ©KráÀŸá7û6¼×o3‚uˆÉ s³qFÜ”Ë"ãÚ'†Æ>ÁW¯CIeÝ7œÁV2Ìn~~!6­¢©NÈK»lrcùë(}¦ÕO÷> —Sžù þèP¢w†zª~&^e|+éîÞBŽ‡í Q›ßÖ«“ ʤªöùbò˜#ÃÂgD2’Ë«ì|2pg•]ŸÄæÎu‚†ÇE¯L‰!`Ö'Ñ-J.¥¼iâþW€ãÅ¥õ¢Q(Ðb5­, ìLŽ­‹}OcÌõ%©<TKß8ž¸žC %·k^€å„ipàû9\:µÏE|’JU³#\°ìì¢Û‚ØR=U£´á ¹BŽË–Óo#aÅ2<æåIH¶—†þ˜,uÔ²§=Ü8/Bøõ©®^ó5zÝ[=kwˆ)ÙÏf¼\ ¾çz[-ê'.l;u®¹cáÁˆðµOþ?Pª>ús’ÒUý‚ðŠ4‡Ìå¤Ü(ÅÝW]K¤"²¨ñÂg—‰†O•{ä‘dì™›{Ö«Ý.|”+XäV tnƒGdAìZ`*ñr–™ˆB L6¢Ë3p2ÖäÛ»o8üf›M¶æÍð06Ó:B¨[ªRì„ÜÌiK¡÷9ý7˜Œ>vàrÊd?‡ƒÐÐÝš 2X¨¾ýÆ•«˜73H1MWB|á‚›ˆDTYø‡" °Â\̱åˆz¨;JoÑqÉ1¡§TûP|¼€yà¶4BV>Š´E µÁN±t=zí›?ÙÅâ}•£ô›½ì"å# ìóՄݾÖZtkY†mÒ¾ö¤9¸ ]’ƒ8¾Jþ„ø"u°tÕQf ñ†X=RØñƒŸÀþk ÍùH´U_bseΓ×UrÈ'cNÐ\ôädÆ–¤õ}R+ᦾ†®L½Â™ak'aH,ƒ3=!ôÞȼiSª™Ž‰™Áë˜âxjüH¿«èS¥üqXs*ì*q)´Ò•§Hñ¤¢ 3Ð.æ=¥CŸžXÓ×Åùžå–Àê߯óåf¦›ƒb%Z¥£ðÙ[-b`²ÿ”ìAö>²K®ôÛ¢´ Úɹ ¡ ù&KIóìhÔsIC¦ 4an,&jHo°v°é”¶2—ÞýV“ø\K‡>-WŒ#S÷Ë\Ú4؆8¢'!?¨x3ÈœÌmkIH¬ô‰D(ÂBgmÅZ‡·—êx›¼ÄYežÂ™t¿¶¶švë¯Z\mg…Š]†2™°@-c–û2Øu+ýes(;SéE_²ô@¡œ¦„f4›údþŸYƒ{¼k»0”ߨw+n¿ªËM)n©û¦ä¬oΰ°á[¤à}8ÚJG*ÐuŒ¶HS´iȽFä2öÉÅ"Å+òÖEZÆ…j1¢PSžÄÃÖŸ•?Þ)äC7U¦cqãJ¨9Êp1@$Îû5Ñ0Øáoõ(ÂGÞüçA[gØ+<ÍV¨rRc|Ç—ñl(ºTÓ ñm‡…ÂÈAGŽ©û­mP‡¦ûC®»´Sè±Â_œêèýŽã„šÇÊþ8|±?cR_ÝM^¾n.‡¾ÌÖ2’ð‚rûÔru²‘fæ,ÛSPB©ãGÜMôF -›Pƒ6ô¯Gbo^„Ú{ TÛýä8J…n·²J¤ãøÌg»¢M¤ D"ŠÝýÛ€´›îùiuÇmdÑv«ÔŒ1[ ›(•›cŸ¤0T;  E–™Y_Ez’|ØÂÜÅé^+8ð2K7ó'>/x@×91Ä~ÛW©n 4· Íe–Þª¹ ˩ʾgŒ(Gw{rä-±h–¸ûšÚ£¿ÔÇZöZBª\RÇ/c±ôž‘°™þô`JÂkoôÖ’#gâ°Áb*>'’áÅ»Q"=”"«vÌÔ€œ‘}z•Rà¥(Î×/mÙÎÒá-íð–YMûϾÉW¡ˆ…#:7Ší¡Þ«ã8 {Ó{Y -J¹k¾›ÚSGºÃ& C«»w_Ñî•‘ÏÇ>—Ò P{P¾'×2®Í7CÊq¿D ø€QHˆRÓÀõ®/⧠„ˆvx`gùê‹ ¢½/_s ›)£w’CôટT“ò"k]¶TpF$âH®–·Ö£4ÑÑ_÷;gt.Ô"1Áx@‹ÝâL"÷ŽàZßênpQ.^ú»ð>½¡Žz¹n$ö7ø’ DÉCÖùãv-iLNB½öeîW`ž®…4ÎÑàª]th!íú]r2kd9V,}\ÙéÙŠ;ø~ÿ õÊe†A<á/ájj“ÄÏÃÇÄG™2ô`S1‹¤a– ï*ÉÚz_̵gdïæù²ÀxcgNwcnN¼™ ›~'Ja[{áÈiÊLè"yU…™ñeýŠx*%Xó…-iBõí¿ï­¬Z_†}¢žÓ!µ~HÓ0Á†‰,ÓzÎî›q³ÒOYÇî„„ñ1ÊòœÚº:³Ô$™WoºÛ‚Z…ÌbïáÉ•®† R´~ÓêdrÈq®eW AÐ-o–a¸¡ƒ{ò–h¥ÎõåH¡„ö±OÌ5õbr¿O\ÆàÏ÷ßFå{‚ìUõ^½ÜfäÆW ƒ3Ìð Ä 2ü Ëí;6÷¹_õtÏ‘1E-àÏMÎÌa5¤@E?¨¦Î-<â2ltcÛñIn{j¼8?‡ªè…™…ýŽaSç'«°â䤱¿*y¥bÞälϳ‘§¸|'uçºÃ7QS Èpd"&a| ¤ÛÃX¼ ³®•Æ ç…Ù¼ jÜÀZdLÜùy|è‘ù/ŠŠ÷:À'×8R©SðÜ9¾âº¥„!#9ŽÅ1ZŒ6›ö‹JÚ•íòï~T J´ˆû0)Có_wáD[aeiÙûÒ0m`Sk?ú§À®´ü*úHù{DÇ53Ø9ùá -š3Ûñ½5ªaqØ3&aŽS­CìxÉ­ eJ†e +^Tóh>ë.«Sk³×¥~€§Gym%Û³Dª -4Ïü­&Hó©@üZ˜ˆ€¦?™n‡ÆÔ&r6Ňù¸ŽŽäVdIƒm~§îpuãÞñ -0Óom@4¤"©¹à_ì¼À8È>œ}÷ä·Eý‘u˱Aëi[Ö]&ÞpÏßcÞ‘ó¡æ‚ºŠ£´†’‚ó¥oU¦Ew²Ö§…(_Æ]ƒ6첄ˋK"Ø{íGS@¼eåv°d¹º[óˆÄç…ÁÇF¬sp·$2Mö£n»öEæ¢&~¨¨©úŒyÀçVÍÛ!olßòÛ%˜K`vàÓhwI80uLu“”•2Z¶úÁsÀVqÒë1ËŒ׶òœ5 -‘DúpûäXù¯Ù`Âäû3—^¬íãâÅSõ±$Ó8YÏK#)ŠÚäÒß“±íäû5‚^ôç9Í«Vz0$17ѯþÓøyè÷$0­ßkó­_Š:> àijwN‘¿Lli1ìfö¤ô¨6vûL^1{û7ñFNÌʬ.¢³³åÛïÏ`C™.¥Â˜K"Ì'¬Õpð,Yvê€Äˆú© É: 2 û&Ln€~TL-¤¬þJÓþVòョ4²ØdpÆZ~®s-¬ ;°½€ ±C¨òqß³åØ‹$ã•šG.öG½Ù:aN‘$g¹6"l>ªå¼FãmÑ ø«ÄQ9 p‘ûàPoû6šhªÎ™ÞI|ÿ°×”R„·Û/Ç =’´Ø«-Q+œ’[“ô öÜ-ÈöA;Â2D¶íñ·4Kt¯+(<$y{#M¾¢l%%ê— 7„*F¹ë7to>NgÝ3ΠÁ>­~Hꉴ­K% Ú7 ,-¡ -ßpã[ Ê’„‡ -'|#–×Þó æÛ~õÝæ>sÿf ðV{·«>VŸÃ£Â„‚ô3Û‰Ã@9Ër©ö©ì©“¡ò][ëÂÚº€¸À—¦Ÿ@½±hù÷-û~2äÂ2‚zXá™;g"Á§ÒIñbª?+¥Pª¼xk–­ zĹNJ;S»CSñ¶<»ô\³lFgDè׬¸ç.’ÑAøS=¥BÞš”ÁB6›4)&Þ?wÔ‹¹&VŸ54×ÕcŠÆ?R6&âëžÅžY€ÒãÆ aœm„` ¥xòLFÛ(:=Ãœ‹Ó]…“•ÏpH è…6 aõ°Z\Î -Ç-óg¢œfœØlpwÓOÐÛ>Øüú@gÝÐq](lQ•Ÿx{y‚Ó@Ct8ÎH"'NÎŽhv$6m}­ë2Á_’dh¶ -jE%(ÑÄŒ]fœ=¯ÙPÂø ë -eÝŠfdECy¨eÖ‚ì§Z¼ë¾Ê(4•J£vÊJ ¹ÌKݵ'¤›¸Ñ7iEÝ27#Ÿ6vgð“·êvzU:rÔydbå™sE„:fÞöX©7I¸Ž‡¥.'Áq -³Šð ‡ógúÉ®(aDòÂÁîA^•Ò -.ÜüÅóKšÍþûY¶ßbN8ýºÛB…ôàù ðßågÖt~øŒö!£´5ž;xï}yˆ=0PéžÓ.NTòíöx|qäDÐ?ÝÏ&¹ƒ8¡6*÷rmš%èþÍ4’ˆàc`€0éä^¾‡¤ f–ܧ¯eçY$ƒ0í4Ý(Z¦úI‰3ðåçªTôÒû© -‚Ö=iíÄ*«.á›H„?‹eøœæàÆZåö7Ö°=K¸ ئ¼3,÷Quý€Fòí;FÉR^-¢8É¥óÀ0îAjM%£Ôx~ÆIý -6Iáߢ²­;¡ÊÐX÷éThnöd‹¿(SvµÈzxLNÎ×U\A†—a>P*EO’cÌ1 Ó…Gö(°†'³G‹wÞ|.=tàkhãrlÈò¿Úä\"Ûõ鄺h£—„›‡¿†Ç7v“Prhs[‹F¤CI)o܃¼‘+ɦ‹’$$ÓZ+áÕ<0n[ åù¿MÝfÀIÊγL\½a¹’û~‡ÅµÛ|,yh‹?Mxôßú pMqed„¿Ú–óÉJ¿úv­yVdOUáÿ¡M0T$“Ò`å‚Ô瞉°­ßüÁdC'ø¸¢Ã]üös"Îwnû”=5œbƒ€Yl¿?Ü[3ÿ‡OøÇÅܲ‘áÔ6’#íJ”ÆØû¼ãª¥ ¹˜„_¸t~¸ ­Áqñf05óàìÓÖMè¾Ògd×î…ûyÖêP¾r.CS)…dÈA0´¿oÙM31‚·Z³ ­Šu–¬qäT²Irbé w" ‡nKºPºçk\Lì×¾SÀ´é¶¯œW•–5¦‘ÉYÙlœpøþžÔyL2¨]ÎkÛ ‰$ B¾ _Ø;í5¾xDÓÅ›PF’u…Â{æñú~Tîv%b²•cí ÿCÞßê~` D¸ÔwxD»b¹š£„’ yŠmS>dB/÷lU>Lvuóᙫ¿€±ìõk²¿Øý·nýKÇê«!J`eí5vŒ%$‡@ÝäbO }‘•Z0÷ݵîñøuo>|ª6`u½ - æÉŒ§['ڶͯjï±³&wÝž¤—×jc ÌùÓ¨þC¼LTÚ}‘ÃŽõlHGK‘žþväëdm„ËDÍ2Ã-;«´E2 ZŽ0ú|EˆØƒü FsÕî¹÷0-ƒã¢H¥ƒÆÖéÑ„UÿÞ 5óèâF³qÎ_ߘLÛ -²Oµ«%ƒ¯Ç¦$Õ¡ÕÌʯÔ8DF˜Eõ)jµÄ0;,œžNÂMüS{£° ¢°Þ™ÕQ4wÓ%««€+õärÙLÓˆtE6@æˆ2©I?aSöž¦šS”ë CÐÖ‚–™? -‹J·© -eÌ%µvƒN&Èé#ãbVÄŠ“†7©N®Ê,7Ÿ ˆaiè²Ï/»p[à>õÁDŲ;ÚKð~ ‡±%q¿t0|k§uZç(þe®ÈƒCó 1(Ö,Í…Wè*ª|ýÎ+W^Où==þy»5NÏ¡r•ìMÒÒ‹”%3¶1wüÇ…ÒÇ&wòF,ÍŸ#á«D奕Gú8’1†&1è»vå÷äíê7*EqkÀ@ÃqâRA®Þã#šyºñ¹ÛIÙJLÔâGò‹‡m£ÒøÍØW²>Êß׋) gvVëïff_´~z€Òu =MØaƒì¹¸ÔÌvÔœH µhDìú«ŽJ¬0cOãÁœÍñ#O¸†é×ý‚Ù~\ù‰8Ïg%XЩX:T 4 ª9‡sª!íäLm_\žÝþZ»Q¹ÛçRb·QHðêJFÊnóßì…D ¢Ìºq§ìdå›øÖ~]°I€%vط˽mÆhí…Jù{dÛfý.p-bÖ"šÈ-XìH¾ßi.±°³|†Ot—7a¼\r~;œ–ô<Ú3„2 $wl½ÙÖ>ìüŠm ÿß&IÎÿ`çYóK{ò+¥’²Ï÷_¸uõJú•©.Ë«EjžÞ™“§$üæåkõØ)Fl ¶ ³ÙS«­¾é¡zëá¤e»Wži­ßu÷‰–~J–ï«‹fË)~·ƒËFN‡ÙlGúɧ"—*nôe—ÝuØRѽÄg{™õ—â¸ûq&œF¯\ÅWhV¬‰ò]¬Pdæ8åKú\ÁǺs?ÚzŸç½°^Õ4J@ýð6¿9‡«Å[Ú.3ÍÉú?ãÎU¾:×O—.?rrú±¯>ø=³½·‹c›«þŸézO7,8{èÛ)YUæ/Ëþ^û| ¶sÖôJ³ØÔæC¶‹DuLéç >&ê{ÚŸ5Ôí@« -cEEÕ\•Æú;Lv$¤\gX|(–ÿhí<»cqïb¿|î›ÏU-Ûן§¯ly¯we×söõz5"ya­SN*lù¥Ó4oí—F¿H¾¯³£Lâ²/ñVŠ¿™º¶:®ûWoÏú(®¬eáú}"/óBs“ÿJ4-_/>ñ¦“Ùº'oTìÒ¾®?ø3zâl÷¿Eµ×j=µ<¯âšt9G¥ãΫ¯Âî¾ô·I©ŽLþøõÊ/¿Ûæ_½,b@!à5`Xœ“šXT’Ÿ›X”Íè8wendstream -endobj -2099 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 3751 0 R -/FirstChar 11 -/LastChar 123 -/Widths 3752 0 R -/BaseFont /AKTHUD+CMTI10 -/FontDescriptor 2097 0 R +1875 0 obj << +/Title 1876 0 R +/A 1873 0 R +/Parent 1871 0 R +/Next 1879 0 R >> endobj -2097 0 obj << -/Ascent 694 -/CapHeight 683 -/Descent -194 -/FontName /AKTHUD+CMTI10 -/ItalicAngle -14 -/StemV 68 -/XHeight 431 -/FontBBox [-163 -250 1146 969] -/Flags 4 -/CharSet (/ff/fi/ffi/exclam/quotedblright/quoteright/parenleft/parenright/asterisk/comma/hyphen/period/slash/zero/two/three/four/five/eight/nine/colon/equal/question/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/R/S/T/U/V/W/X/Y/Z/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/endash) -/FontFile 2098 0 R +1871 0 obj << +/Title 1872 0 R +/A 1869 0 R +/Parent 455 0 R +/Prev 1327 0 R +/Next 1923 0 R +/First 1875 0 R +/Last 1919 0 R +/Count -5 >> endobj -3752 0 obj -[613 562 0 882 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 307 514 0 0 0 0 307 409 409 511 0 307 358 307 511 511 0 511 511 511 511 0 0 511 511 307 0 0 767 0 511 0 743 704 716 755 678 653 774 743 386 525 769 627 897 743 767 678 0 729 562 716 743 743 999 743 743 613 0 0 0 0 0 0 511 460 460 511 460 307 460 511 307 307 460 256 818 562 511 511 460 422 409 332 537 460 664 464 486 0 511 ] -endobj -1688 0 obj << -/Length1 1393 -/Length2 8536 -/Length3 532 -/Length 9398 -/Filter /FlateDecode ->> -stream -xÚí”U\Ú¶î)îŠ+NîE‹kÐâJŠ‚»»/®ÅŠ»»(Z(îÚ-RŠÜ¬µÏÙ¬»Ïã½O÷w“—üÇs~ßsÎ0ÓkhrI[ÂÌ!/aöÎ\ n(@VUSÄqó`33ËÂ!fÎP˜½œ™3D¤]ÞxyAQ~Q^D@æà‡¾µv°Ê²ýU$¶ƒÀ¡föU3gkˆb 3[€&Ì -qöàHÛÚÀ­p€!N¸+Ä’XB-œæ·P{là_Ž”ì­`¡…-]þ;å -;!LX&Ù‹–0{[€%Ä -¨ChANþo˜úÏÍ_ºØÚª™ÙýµýßSúy3;¨­ÇUÀì\œ!p€*Ì·ÿÏR]È¿Ì©B,¡.vÿ™Ur6³…ZHÛ¿µ…¸D¸ùÿ†:½„ºC,5 ÎÖ+3['Èßqˆ½åA ïoÀ—¯ôuå8þëTÿNj˜Aíµ< žÇê¿ôȈÁ¡în¢ñýï_Fÿ!&oo³„Ú#®…€ À 7óÀFÜ ¼@¨½%ÄqG8rÛÃœKˆÁø¬`pì¿•O´„ÙÚšÁÿŠÿâ­=¬!ö!D•âü`–!!ÐÉÖÌÉú1" zBà°Ç€³‡ü›x@g·Ç¼ÁÖpÈ?*x@+˜Ë£>Dêú -~„,b4ÿf„Y'ˆë?¼"Æü×ñþ;‚°jý‡AÄ"éGB,y$D±ì#!z’{$DCòÿ&!D;/ ÑŒÂ#!Q|$DJ„PõHu•GB¨«>B]í‘êêÿ&a„ºÆ#!ôÀ„ÐÓ|$ÄÈ´ ¡®ýHuGB¨ë>B]ï‘êoþM Äe>„¸Ý@û " ûþuHÿ@„è¿N羘»— /€‹q]@ ^>ļx|þ÷Bm{¨£ DIq£xx„D„ÿŽZ¸Àá{ç¿ÿ®oò¿Ù -Šxň;Ä{af!ü.µ1´ÔW¾`² ͉:ýcðXgH}º÷÷U1âYxÓ„„öŒ(„è´œ0åç«O@K+uÊFiï!/M`È7¢!xú`çÀøH ‡s¶ 6$g¡- Œô5cìGl$¤¬ƒƒî–žÞ~¹»dðärnZé+±S× ¢/MÇ7?½>MÄ( ]xšLÕ'›¦d\ô« ) ¡[ä*¸^)­Ì7 ;/ðjÉؾ:Þ´ìÜ À -nê¦òc;^`VØåt¿‡õçk³»†²ÜIœN‘ÌÒ:|úÏ@L¶¥õFyHLXj 4TA27àÃÑÈßyËÝ æ úqÅÎ'1·2ú¬——å{?úŽO®â®À‡ê~ë´ñ*"Šm›‡(¤ µŠvö^óòˆh™nL\ÂÕ÷â•×fö«èËû¡õô¨ö¾ªö@£¶¦ú(‡À‰æ#ã>©«ŠòIŒ\Ÿ6WÈ&³ãB¾°e·â?5ºü’tѼqŒó—š)›ž^Éwþx1!+"ݲèLE*±êÙÛ–š<•{o€-Dw9Øž6^IÐɺOr?í”8=ûðMuæ{«ŸF:5áw|*Ü8f.‡~Ò™Ô{ÙvùâgLÚ² =Žà­D‹KcøÊ„«›ä¹Îa¾AŠ[½e^ "7ºU¶¤ÀŒé J¹¿&>< ›9ÄtBOðöf&›–/ø4½î—!·_âÝ…¸©¾<=‘TÆÊY‘Òyv -E» ïë›r›ÉDú'°¶=¸$®"SNûð™tÏ‚OT§+UýÄXB<Í^гâÜ#õú¥¹É¥ÌøÄÚZ¸ÃµB/SûÑS'*\²âJàðü¦ÉÑ»‹ ’7Ô¤.Ck’yá+­e0CÂñNÉJ¦€¡zhìÐrh‡;‰í™ÃBrYJJ„y—)ú'ÿ±æeWã”R©ªX -ŽH’DGùZƇÛÿ7+§Ù¹3ô§-̶è›wHþÔžK -˜Ò¿$b»h®â@­Ÿßõ U,¡há©P†™Z0ûqýÎs‹ÿŽze¤Åm‹ÖëÕ늛ýößýõõSe-”–bê]×'È؆KÏÅƾ΋Z¤ZÅü®2Ò­ÁȉZ–gí¦£Ò­nL·O[Rèd}SÛôô5Ð/5[ ×0Ø9<§Ï¦(øyãbÛªI-Æ2×à’Ùý®>–Š6 ä³RM‚w)Òt÷Òé=Žªè¢˜ÑÊ%%‚rZw· -œÚÓlOí|yB7F¼Ó7$à&Í@öì-¸l*Ú/®:Ѻ!‹èº½Þ0KVŠº‡!ÚK ­# À1µ1\Ó ómN|ý2Ã$¿ÝI|®‹ÀèO}¤3¾}x¶üíòªÒ¨M°ªe*AK¼ÓTÚÞN²»»p÷¦„-©™‹ÏÚt³UwÐ3”ïäÕ\UÈè8/ƒm¬ÑP%ÞY!#%Ïh`K3¦(ô~úžÒ¿ÍÍ^‹Œ0)EM”´K“WG«?‡~Púb‰6ü•$ú¦–&ô3àÇÉaP2žØ×Ïχv Wùý?§y>b¦*UûÜQÐ*M ì•s ).æ÷\<·‚ðéxžÓOJ«žïË£%Ü¿ÃS ˆ±ÆòÌÓ‰ÞÜÓèô2o©nua&o:Ùö–y3(^Û|Ú½-Ÿ¾“¤×êó|úa@³ÙQ‰—Îß’O­ÄrçÑÝ­D1µc^ÂLÒÿyÂ…$κi¯»ù‹S®[Eä¶@t{ò¤–õÔÐÌ©M4ÚSD6ïnÌua#ÄÃø]œ%úÂÓدüÐ á!ým½¦–$fݼªY:žo_õ\ÞáëâG§!÷Ì´Wª§}!X%UÈ1A1(Ö²iß«2YKoîOà~F%8]¢ ×X9­ÃBaÂyö­eÉ,›¤¹Åþeî@¹ar¶ˆÁÜ&úy%E<©ÿ{Èu’ìâ†Yx›lpýSÝöW­ ¢ÍÝ÷J.ÙCÞòÝ3 hP ¼/K$ž®Ñ™):Fqæbž(óY6ˆ}{’"bŽÙa-ÀI«5…WŠ=5ž£™pßÁæÇ“àwR‰Û'üYÖ>zHu&âDôt%cÕï{*Æqçõá{tí£Ó¶]H´×³ÒRžížñ¥çÜLä_Éû˯¢=l»Ã’æ®æ=%Ò·Š -hmiŽÕ#½ºs†¼( >²¿ôV”½Ä|‚õÊ£<àM õ¿®u ö»ýç}曌è^p&)çàÆýŽ¬êIµ”Œ}Ô/àÇ¡>í.Ýæ%ßVDnÑ ï¾^r1¦ë}æ?›Ìăƒ«Gš0ëÂeO<.o¨z E¼jJ°TX šZ(Õüë)¾—AÈðì¾W!o\Žò¬´°«svFNƒËoƒs_NX4îÏyGí?ëˆ7!ïDVÌW²–³²±×žuï)Cw´IlyºX}+Æ]™ ð¯ò¬uýSdN¾k…Ш”’óýz{Å·4ïu`û…ódyj6×æ7—Ë»øÚŸp¬õþ¯àò|1ÚzŽFKIj¼øoOzéÕiŠ6?nXWýzŸ)¬˜(þø1)?PÞ\×,ñºÂ´_(¬¤‹ÅÝTø}vÓðHëUíÄt‰-â´(ÎPì’üàüþ¬ßÐ;—wŒì33·÷Ó,÷àÃ\ç{øQ `ä¯uänϺÉF¾ª]G[>I{–Ô(PŸ'JhSÀ`¶kÜ,ÙÓ67åGUBåÖêƒ<~ÌùÉ´ÆÞ<}jÃMBžûE›À]B-ÀXoH‘ü̇Ÿ³²þ{¢4½['WvƪV¹òÚtéB׉)möÜàšéÂŽÉ6ŽsAd‹|þCÓVhÞö>H ’05*µãPÙWqwe!üÌYý9*<–úI´¡g¨XGO8h’@»ª¡MY-ôAýD%Ž>rýke­>þŒhŸp¢ -k^ŠSí—éŒÕ·®ÓŽlÞBÂí¢Ý#‘¶ò( Ù£i¢éµ‹-ÁL¸cÆ.+HkE¥–À•b_·÷ö©QRr"X_rۘϒ7¯2/‰Ä%V‡‰GÈAÙ˜ŽäΗ›”Z|mïc<ƒxRú&ÐD-Q±gÄ\¹} ž ^ïÓDiAÑʨ¸ð$úË›RîÞ3îг|”×' ì _¥: ¼¡0¡«Oì·½þú’­ÊáBˆAÚMI¥lSk!å¤~¢ 6Aô¼²{+½ºÃ®Nõfì ”—µEÒ6Ç"ø|q7ï^"\ î~8G¸7û FÈ@zŸ+2Áë„<â7-8­ÏŠ\ÁŽžñÊo¹EjÚ%_ ?2d«†DE5óÌXH¶|áÛD:Å?0Ï´”(‰Œÿ¦ ÝÎt8“C¾l`ø1C%§ëÉ¿ ×”*+ñt*iŸ÷Ç™•êëæF¥ànl½j¼*à¢ô˽_\Ÿ62¤¶ÜÕ`¾›v yÂrØ4÷üÏX‡½%àŒA®Ç™uÙÈkZœKêš²œ”M øþ¤¯ãïU½<¾--,7š²è';jþ"ò¿À=é(a®Ÿz:Eú ù“ÐqoÜLœØߟfVa„ý¦‡nÝòÊ IGƒ°~»@_¦=’®CR¯ ÐS4ÌèD®÷#”MÉÚûI¯ÜƶLÕRµ¿›x¨­Žõ2ùÝbÄ42¸3¼\EüƤ놇$Ô£ü -7®A÷> ~¶þºéV éuz·°J$Z´XNþ(©0þ(J⤠Á߆–Nj¾RλƒS"êZÈ:Ý ÊŽ#³Û’i^6õð+ªÿðý»StžâæF`-Ïx¢%ÓD´¾ÛôH©|E£ì\@-R‰Z7Ôf&Öuh,´£µØÃÿxOY<\ËøÓ$¼ë‡³d„¸{Ù}@õšÝWÓg‡°‹ÃŽ†—3B—rZ†‡7L6H«fÕw955&Õ.Õo9t -Ç’Hùæ™Gj„¢¬Õ_| Þ–gž·Ž"ÚD+xM­fèÈx;ㆌ -ÚÞÚq#biM²#×'5B%.™×D’pÙëH¹Ÿ#X_?azme{øªQ²f9”^½èÇyúšVãeTÃNn\üJ¼Ž°eÏP¯«ÑÇöïQJ[lõ·Çódx˜û¢ƒ‘+ñXYxÈDrM‡+§%Ë¢˜}>2Uó‰ºF}£ää¦z$D£Æevå+þ„äuÈY„Ô© ?•%&7ÎlyÝÑqw­6›‹Fïˆÿ¡ÌŰὑzcav¿\ñÃÏ“oæM–KÛÄ™´ŽèV¿:ü½#ŸÅcIˆoJR¬{xøýZ ÕæL§Å)k¹=Ðû’1‘ØdúäÍó®–ò¨ß}Nˆíƒ˜‹K‚žÅÒ' Ö>i(Ø+ÖÈ-ºqªd÷ʪ ×Æõµe  -Ö±7èèB!©f¡oèx#ðµáŠŒ?Ô¾.æ…a)_аÕo)¼Qå{q&¥«Öù11°rN]Š>6Õ3™åÊéY×dò-R†7Õ[ÏFJĽÔBÐý8š±~$eÜ–^ìe™ÖJÐucÂOÓó£Æ‹òŒžg'*KS-àÓncÞˆ—`ò*Ë:a¿Ô™}wð;vsR-¥²'yg}`”ž}.¹+ØáÍ_-ûöE®2tðžo¿Õîµ'ã×Â_£6sc8Iäh/ü)_ Q%ïê|€l^»Þ¢àÊ[«cö§¼xæˆÛÑuâÕ—ÁH÷ìϸ²·-t e&P¾ºÛKu¼­ˆ½ÁýƒÇæ_áu1Á’ø›¼åYÅuÀçî½%¯„öhÊ@Ýó7ýè˜Êí«y”›™:—9 -=±‰Hòát·~Ba •Ÿ¾ØÔ}ÿT†<µÎCÑÅ ÔXÒÿ¾8숷ڬ9’±Þ!Â>½6¶cŒ$(õ3$î÷ÁŸ(¦d0¨÷¯IŽz{+$0ˆtúÚ7·rI o%Nhæ9sZÁ]\M´¢J iÙœ³žµm -ËébNãhZ²^¤¿§möáÛ'±¡"I#¿ ”`´»NöF‚œ#BJh3o}¿oõPÏð‹†êœ˜¬ÆD^ȃ)dý¼öÉ™wTëý—”äžw~é?œ…˜E¯¹b‹*ait˜U]xõ$_X{§‰nÊñY^§‰+Ml=·K{QAh®·>иò»Gs™­Æµ’U:#_Õ <ôÐ0½0~Áì“´”¨+öl`ŒÈ›•ù¢îBÙük?è&°ºŠœà¨:Ï\÷þgÌ;1@É„Ç_LÜ…mZ·%”¶V@“Lš‚ˆ‹²µ±&À‚Õx¹TJhÝF"ÖUkŒ¿7¦¤*H G)7Û™_µMðs{wðÝ%…ÛW@|´'½ÄÚáÑÆÏ#Jpäñìëʆ úÕêbÇÆï{ÌÐí«ñüœulÕÆó™¬Ò™KÇ7„æ¾…íjƒF–%uþq…174"RÍä©–ií3ª—ÅÆŒty~áïßégžö‹+}3­è…l ±pQÎC‹pV"DFžP{l¼jÙà¦s&æk½Ë­Ô¶uIÇ`¡,>'v)Ć¯%ë‚ËBCHßôü”:Ý)¤»~é],e#<×öâº&gÛ略ëšy¿&iLnÅûºßKlt£èkûsþ„PSùÚê6Çs'ᢙg ¦@«p<Úžö뽪#§ri o}b¶ØV¼yJEWËw³9á: -#Ë9âfŽlÈ9¹t ¡ºõT{ «˜XW'å‡øŒi+ ø iLT%±ÌËÕVƒ£sr uM©²%YNФ‡á}l×ýH% • iKgä6 ,]Àú\³Ê/ÂveuhXøAócµÙ»È -í9àzÞ -Šs­ÌŸ§®NÆDº›ø+Ú˜×óº-µý÷´ÚM<ü¿ù“ל¸ºaßøò C¶áÚ&~ÚSŒ±|¿§›3«³ ‘¯!ãÂR3Ÿs{–Â_)˜g“Ó‘Rº5fáI’ÖipÏí+ðÎãyZ%ÇÑ$«ßuG7ȼq¯Mž ÷<—„à-’_\Tÿñeº«ªHò«›^·1äøýno› -@Åc àø°"ÙxóúIfXZ³´7þÍK\3¹·‡ß'_aÀ˜&p8iPÊ|Ò†3å"¦šÁÍè¤û³ö4V4‰A»¯:z<"û¶IRO’‡UV˜z6¯®>¸¥³d›.:M¡]è -…ßX‡¶”²¬Ûk¶rÍ`Q?"4@ÌuJ"uÐD0-5o45™Æ¤i]…Vw:{¯e†OV!áÐøäðâ:EˆèÏÊï?Õz)AŒ¯u”,€¶t WmÏ£%jÒ¶Ú¥nºÕ pLÌorä‡T?6¡FKи¾³’¦I‰/Ö:™ZÆ]„žO€—»Ðµó…Ñ©JézòÀNrb9ºß®Á¬®cèøv\«Búœê†b¶T„v×>É÷"XȎΊ¿£Á4ãj•j[–c‘Š€Ö°æëkùÆN‘טû[xòÃS]–èD.ÈìQ,í]4±j.š8 ùãá(³q¨Å=lĸÈOâ6QŒG¬Ó©(cj?쟆‰_ÌϲQÅ?Y>¢[ý Å=<ø:¤°šWó¿º +™‰[9¿*ë*â-ˆ.ût!Ò˜rr“•ÁÛeðIäâYȉ" Öo¬¢t 6fv@ÚñÅtNt“¹ä¾e½I"“¢›‰cîŒÕ™ÂcÁ_>Ó°j…aÎ+ú¢È¼†­G•ç£²_zq0Qû§]Añ¤Vy”ç훞X.~Ç©Í^Tx5„úN`…r%rËÓóö«ÏA‰gI+2Ö×ß㊅킠ÃblòAéqmKÈ­c)W±×¨Ø(„ò -Im¶_^õa´rõÅ; oÍG¦)Îè¬o÷®ªó.H]?SÎd êÒ¼ ˆ]cÁa±bÍÕ7Œêk;ÞfµôE“Þ\¹ôȳ;j%´­\*boÐGJ›n‰Õ”Õˆ¬Çrh¶‘IóI¦"•ÆÑ‹•ÜQÌI‹ÞñI¬G÷V÷Uoÿp¼Ë$׬⧳ô†å,†COãDãtCT ®)ô•Uê~°ð(’–‘ì“çÚ·£æð:–¾Â»mdvÇÌ1«ïdz¡K–ê;jƒyÄ_éžvhlõ÷P 6é¢Åj%ï3é7h‘á(¡½ -ôÁ÷„t’åÆQò”oL]@)³•°lJÈ1 ÚÂ… æ- -ÒÍ¥ð§'çL#E®Ù÷¡‹jðJC» ‘‰úÌI~ 1ß“?82Û}êûf)}uzš¨½4‹êNœ¿(Þ]k*7` ¸i†ƒŸ™+UŸŠÝ¶öíºNÊÞ^å0r‹á*¸j>Wÿ¬]$·sÒ%’ùê.;ô=ƒõ°¤[ø ùŒ¹uµ'AJS*Sþ— %Ï‘€vŠbyÝ`ékÕ ªa³/°“–_úÞä@½â¥ÓÐE‹vÝó8Y unF“Ü ‘7t]yO6@kÒ¯†‘:P‚ü¿úoH—Ô 3Ó©e#[k> (³w®¾JÓ!Æœ.æ›;ïO:f¼)!Ë÷‹ž}ºÎur (¾%ò3ÏÞ%ËŠE— ë±S‰‹eò:Ú)S•”§¥—Kâ9Xô1¬>cœ=Í-­kÈÛ´²üÝ~2N®küÁ[›pó©ñ×­[Ræ‡üoÒyh‡öÝüTt•RGí³|¾Ö%¸²Ú¡ÆÐd§B» E7 •“¡Üçj¸9Xia­–6a– îWZÛSJ¦ÅÂàÈ‘A®ÊÄD>Š(À*a²?ènL(øzxµvõk‰"È;þl2% ™_ã½¥ÊÔ>¸O F«y®¼bal!{M܇Y=8.¡ß{’ˆþ£8fßÿ3ñÎqÍûbqZ¸X2èÒ*b˜¹ŽñK¹_áÆrÂìõ· ¡³ûW›h¡ htƒUr+š/©Ì -ñF²ŸP‘0– üõGî°KúCçk^¶ÙhïšeòK^b¥±“ ¦·¹ÌF‡ö°µ&©q¥ ´4Yçíþì`¦tzmUˆ:žIAˆ3ˆî¡Ž+Ë~ñy¸ÏÉóøÁþÿü?±…-Ä î ³3ƒÛ`ÿ/øú¡endstream -endobj -1689 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 3743 0 R -/FirstChar 36 -/LastChar 116 -/Widths 3753 0 R -/BaseFont /FKZVHD+CMSL10 -/FontDescriptor 1687 0 R +1867 0 obj << +/Title 1868 0 R +/A 1865 0 R +/Parent 1851 0 R +/Prev 1863 0 R >> endobj -1687 0 obj << -/Ascent 694 -/CapHeight 683 -/Descent -194 -/FontName /FKZVHD+CMSL10 -/ItalicAngle -9 -/StemV 79 -/XHeight 431 -/FontBBox [-62 -250 1123 750] -/Flags 4 -/CharSet (/dollar/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/A/B/C/D/E/F/G/H/I/K/L/M/N/O/P/R/S/T/U/V/W/X/Y/e/n/o/s/t) -/FontFile 1688 0 R +1863 0 obj << +/Title 1864 0 R +/A 1861 0 R +/Parent 1851 0 R +/Prev 1859 0 R +/Next 1867 0 R >> endobj -3753 0 obj -[500 0 0 0 0 0 0 0 0 333 278 500 500 500 500 500 500 500 500 500 500 500 0 0 0 0 0 0 0 750 708 722 764 681 653 785 750 361 0 778 625 917 750 778 681 0 736 556 722 750 750 1028 750 750 0 0 0 0 0 0 0 0 0 0 0 444 0 0 0 0 0 0 0 0 556 500 0 0 0 394 389 ] -endobj -1641 0 obj << -/Length1 2027 -/Length2 14300 -/Length3 532 -/Length 15414 -/Filter /FlateDecode ->> -stream -xÚí·Sxo·öÛ¶m«±m6¶gl³ÑØNcÛ65hìÆö;ÿÏZëi×Z›ß·õïÌܘ¿q{œç¸t¡$UVc1s01—t¸2²2±ò‘ˆ)ˆj³²°2±°ˆÂQRŠ9›»Z;Ä]ÍùHXyyÙH$ÍM€?€_>N>.8J1G/gkK+W1Ú’¸IDìÍ­M$ -Æ®VæöÀ¦Æv$j¦Öæ®^L$"vv$ªÿ<áB¢jîbîìnnÆÇÊJbfmêJbbni €cþÇ“ À„û?ÂfnŽÿ5änîì4EBó/›´$@“f;/3s 8fE š9ÐËÿ¶þgqI7;;EcûÊÿk¦þ׸±½µ×f8Ø;º¹š;“(8˜™;þgª–ù˜u°û_22®ÆvÖ¦"K;s–ÿY»HZ{š›)[»šZ‘XÛ¹˜ÿ+n0ûŸ€÷/ÌR’*¢êôÿ¹¦ÿT6¶¸ª{9þ»ì?ÙÿbÖ? œgkO]àô²ÿõKÿˆIL̬–$lœ\$ÆÎÎÆ^pÀÝ$NVk€™¹'‰¹'Ð13ÀÁø pJüH,œáþYPàš3[ü+öÈDë?ÈñÏèf²“›ƒ«¹™‰Ý¬ì¿G¸H˜ÍììŒÿ„¸I˜ÍMÍ¥ñþgÿþ4 0ÕØÙ`gnñW”õ?£ÿ#èÑØåŸ.¶‚ìÀ\;7—? US{{ã?Nf+/G+sÀŸ׿,Z;˜ý ]»Ø»Xý‰ð0{›;;ü ›p˜ÿ›9î]=þŒs}»Z9›ÿ•ñÏ´:¸ý™NöæÙý¯  ]à’ÿ›ÎÌÿ[Ûœ@cë¿eyþéÐÎáO;\@as'7à‰úwسÈýCÀ‚bXMü[”ø7q”üCÀf¤ÿ°™?lCöÕåþP]þÕþP]ñÕ•þM<@uå?TWýC@uµ?TWÿC@u?T×üC@u­?T×þC@u/pNMœMmÍ]ÿÛæäeÿwü¿oOà-ÇügÓñK›ü!`iÓ?§‹Ø™Ù_øÏòý…ÿlš¿(hù{µú ÍþunY€ÝÚü…@O¶!ДÝ_teÿ73à/ºrø ®ÿB +§¿èÊù/ºrù ®\ÿB +·¿èÊý/ºòøëbºòü ®¼þB +ï¿è -x/ÿ}ŠYÙ€ÖÌíÿûßW¶¨¨ƒ§#;pÙ€Gè–ƒ„—ƒËï¿gj¬ÜÌeħž……xjþ‰šº9¯)×½&ºÿÅÖÀ·‡¹¹§¹)ÜÏ%ÓO¡6©Íáeþ…³åt ¢–-ñŠ ½?ºàCV@íJÆåœè~Õk?Wd #@{¼â»DvúªLI^9ŧ-¾¸dx·ák_g(xí;’=„œ"w4/ÜþæUšÿ5Q–¤S4”}9|š¯L#®~½N -Ò§ëÞØ—ÊÅ­-™a§ñ%¬žŠT%Í©ì+Ç— ”¤Dˆ™›/0­ôkWnhÏ…0yßÞ AžL¡¢¢\ð¾.»Â#®žá ûµm6r3òrö‡ïæVæ6—5M+0Wã÷îÞ¢•óôh»×#ßmo$zÞß«ÀçŸè5Ž_Ñ|Zì~ŸÀa¬ÝMO½6[€é‚v0/FòO ͨ?&œ)ĪœJøP•­r6©WBjŸkœÒ˜ßµ¾?âeÐÁ‚ÚÞú%T8>ï<ìk×#Öì°×jéWsžŸøU4ú½î¿ÜÊ»Ê~mÍIÑ+ëYf%?Ÿæ†)Š’¢3Päê@qZXm0î·u†[+5Snr°}ý{\X *H,{dDÉMf=­u'‰d§t\¾ÄÏÂ{Ž¤…ˆsŒÖ!ÏÙÉ%þ;}½nɽy‡Ù€­k»z}Ý¢_›úî}­¼é²”Ÿ[´j“_d é¶f·l,ï†A|„m˾—¸Ž3 -ìøñÿ¬¤ÅG°Ÿá7FôÑÕ8ÄõÒ›“ž©Ë¥m,`Ìɘc/¿—“5mEÂÀËâ+Tø\X}œ¸mvQH{_BKÃmiâöÖ¼íz)Â)æE‘ -Çõe2¦½^C]b‡ú¸Av@DtwžË*õLQù&ƒ›‰QR*cYjâpœ÷´ÊçSnR½©Ñy¯¼y¥WØ7 ž ±>V0gí9P´ÑøÅŽOˆm„ú™WœÇ£ºÜôl6äÛIœ„ol¹ þÞš}[¡Z[öéÚ2[ -)ç3ÌJw´0ÉÑv…²„·“+}èk!Š;‰•Âù ‡ÕpÏ<¦4朹* Qù~¸´—†ÐgÕòj¼«O2 Z ‡î_¶‹ýrniÇ™v =wŒ”®,ügB—A¢e1àîUfÖXZâxFü8â -·öÀÜûÜ'EïèRÅ"4uÃÑ6Úkå#‘q?È6- æâü–ÛUL£Ì6{zÓ”@ /ÉòîÏýRwr<ˆ”ZÎhç©7>¨ -ôN4Iö*‚HZÛóK@_qr9ÜoŠøNm9:áæ/¾tõó4Ybƒ‹Á²4p>)à”^Ä;NñØ/dkZ¿»=´ýеôl*Q9.‚EyD\Âõ¶Ê×îÜWÓ¯õS,šˆ¸:ùöËI‰Q³øˆñ¹sB‡ŽÉÀV*œüMŸö —|’ÕËx¼‹hÞ%à5Þ™xœª=! zÒšaLîxYìê•z¥‰qáÄo]ž[&Lú`øl+ÝLTþ-Öe÷ -Õ?©%¢ûV—Dø—xü‘©#/aO5ib;Tš‰ Ò¯'±=hÑÚbßפ-RÉTŸ{ضsEä·µU¾žCŸ¨Â½ŽÁð·’’/ãþ6J³‰@Q!æõÅ-.€Ë(”3Mi‡@eÁE^Ǽ¸Ÿ·{P;R&{Š*¯f$—± “h?ú’,9ÒoC2x3¶õIÓ ‘ocB»re9ðï‚YºœCvGc=^9\¿eñžºçu1ΧºjÊ×ïÝÓ…Á¼óÓ:åÙÐ=Õ Kà1µQý[*[Lšº$kßXŸ¨ - ¹˜‡‡Ñ“Þˆ6­ˆŠ ûÙ¹_)…X»ï¦­e>'ÏïA(Ži(5r° .â3œ:×s©,¿ëi<Õ’-‚8Pße¥žlGÕÕ` íªxú‚Bk•:­É“w}ª—>Åí&€#h,  –å“8§G¦Ð"^è®5MÒ©|n]>«ˆ‡ôŒÔ·Ó10¯Õ¢!]„L}½(‚’áñ*r¼`T¡t3Ó­¼Ç,çkÜ2Û%¯n7Y–°ÂCp)ÂnÂ[ ¤¬ ÝàÜ›Ÿž.îýªKY×-³)tAœ­¹ù -r”yÄ«ñNÔÜ÷‰œŸCûtûºFß ‹& íÂ’þ:TªŸÈÞÒåíz Ñ}sÿE³ÂXúÉMB~ºÊQRb,%œÈ‚àb!f_±¬Dlm™yàR -…¼|ÕÕõTô'ã-¢T¹ev÷H“«k·sgd§˜öy*¼&éxáçìªÚþâÓEÝb}HÏèjÃ%gP¯˜üÐÁ«dÓÉ÷c·ûµ‰«y wAÙòAÎ-Ôƒɬ%·):ÏšÆöÔ¶…Ø ™)Áûw¸ýžWçJ_+ß3$*AóˆWyU½ezz˜np¶·& íO‘-m?#¥ßõ|Œ&Û?±c´K˜MGßUZls¤Úö.­Úaíd ¾a¡Kʇ50¦çʶL}ÛeDøm,q©ò« mS¯!ý—ó@ˆ¯]gñ"ò„§\ŽÒÙ﹦¬­@I{‡ uÊÔ°tæQµžž&±\‡P%<³RʵÙ5ôñj£þ6 ÖÑ öQ§;3K×ceKp>w^a@JLæåAua øÑy[Èl÷¬ÊÇܳ…¿ª{$X¯GŒ¸Â€öì7‹Í TI>…¼&S †YèCòÒ™¾"ßKVïF¶ µ´,§¥²3ïn¡Îu—¥ÚJíC‡"&gRH³Âù?¦²‘Á|N÷Ž©Åt8Ÿû.[Rÿ«¯˜~I”·þ©É³ý*ĵÞG¯–µÌš€.Ÿ•ÒTŽíq¯¬’ ;Jú^'âFÿýÓqA7™Ñôã×ùÆML©qª=Íú°SéõŒÞÉ%é’ev¿²MÝH5ô­^î"*䎑³ô_ÔúèŸV—V_ÊüÜ» -¡¡ï·vopZ}ËÊUiOVÖìéJ çšÈêøó2¾âË¢Cˆå±=)(•ÃÑgƒ¶B¹• -øÕÝ‘§þÞeæeýat`w9\xjÏ-51ð½¹)¯g˜ëˆy%mrû˜–+€[Ç©(Ayly.ñ) «Ëb8ègV@~a3F/{Õxcr«£Sr™ÓoèK;õŽȗ§ƒWéö{èb’!N ¶šDïf“;â«g#ǾÕz¨§ôHørâ·)º“xoœT>Ôë`$³†¯iÁzk™ºóðÉVWç(jb8ë_ÓÔl[(à)åø0ºßDd²ZC}j®åDpÃmŸÄŸt¿è-< ­ì&+ÜŸHÇJ>gPò’4wXíÁA×É3ª\Šhöútví - eýü˜Æ-Ï7õ6Ë—ê¤zˆ›ã²Ñ3E$,Wi¯ÃÂõÊ]k“)FU.ÇD¢EE]ÀÏÓdFÓâ4Âk¾c £’ƒ‡ð4 ’Ùž$ ˆCeycÍ);KŠ¡Ç - #ê°Šüs2~¹ñq§´¡=Ár„|dƒ=îÈ’‘ºàöÐJú±Ó’9˜1^ßGÇÒ ¬>7Ú'%Òƒö®#P"rV{SiŠ‡üÒýˆý•“ ¬üÐq-ÒÏ‚Ëô@]ýäíaéòs¹DÐïWˆ’@./ðª;9²U£ÄÆÔÃpš°lú “…nÈ'a¨ð@“ÒÂÆÁ3¹_‡»­ÈœS¼òÂKÅ5ЊñÏ´)Ûõ´×‰“ƒãRråBJ¶êŸ<:_P{m;,zRð]¬Íó©?Ñ8$˜诼Gž”ÜGóÑÖk°«@üZ5WÂðûFãCñºÑ 'ÄÂÄñ¼óÌÝLÂ:9ñ=¯¾¢¬?ü² s«{62H bz]Ašg£r]çê17:ƒÈÝfa>}¨“ ÄítÞåQg‡)>«¥ˆÄoÃhh¶x4înÚ!ÿåu»Ó h’lÿm—cwß bß~tº‘‰àgØ>ë–ì¹%(e. -¥J•—©wý%‚‡ÕL€{êÅ¥žÑ»Q…osóÃJ°LÇ;³Óp!à÷*Î)®_vWŒojµ^'(h8üä|S£`¿ûÔ-V?]ÑÞ=¨ã}œ‰jÊP>Ñ›Ù.Ë 6UZ•fŽ­|gó<5>ƒŒõð$â<õë¿‘ 2¦ížHø$üŠEïʦI0Ö~lCËü€ï•0-áª×©\§Ü+–ª›ü-¸ÛzmSðã½Ô»Óªÿ`Bé™Fí«öªµ|ö9ÇÖÉs‘ª_#6"ÑФœCL¨ûyZÑões™Ÿ©ò7¨¦¤\CÄaõlxCXò†ü+jì-$ŸusC~-n¶*dÈQÌÏ<çbHÅ!DyªDd#]ÍÂHhð}?´œ„t^Œ(5#H–·V‘ð3Ð˜èƒ ”jÖ–›®»~¯æ,WM#ìj‡±{eÅÒ‡ãηýr`]Ä þØ[’­-E/Œ‹’ëk÷¸‹Árÿì.§ø´ÃŒ4¶¤’þØàôãÉâ—mS'6éG4Ûd ô—…æ·©åä1zdëwTåŸú -›ËÜxÙP -uœ½§S‹!)™/N^‡KÒUÓp¦Ž¶?Evö½/È»@¨”å#‡èw`í¤sˆ§˜dDkO×[§g÷‰çÝÕ%úô¦3ë12Ë©.Ëï{1`ÍÓ‘ ’Ua~èžK''O‚b’¼êè…ìL—?äN0Ã2ŒrSûnèX &ÑÂT«”þÞ* ðò¨Ç„õ¸$C"gÀ§&j ìœJÁwÍ`7oÓ$¿«µÏÞ‰™  OmÞ0>‚´Éð0S¿75‰½þÖØ5’5ÁgÙ:Ÿ•pú ‘½\Iè‚thÒ5’yœƒÕĶ¤’Rð¨íÎ1!åJÙ÷ñwTï=z F’*ÈD€ö ­¼Ó—g€:¬ÄÝÌ·Ç»ûF/†Qß ¹€AöÍOÝz9vʳóm²pdi±gŽýäJÐŒiß‹æ„lVɺfŽ•'>/›Ù±++CÝ.‘]^£x°êÐÃó“#Úá§$Vð‹b¸ õ¯MbÝðSŽU|ŒÒD5Ètíì¾k‘Nùp[Óº¥­*Ýg0؈àzŒ_(~ -úºYýˆW´bò~PqÙœ&ÎÝ”T®C E'æÕšya -]MЖ¸êžl2ªï=à äÉ"a$…wêzæ2‘_ ·|Ó®+•¤¬ØrÀŒ¼b–Ñ؈®ÉlyâÝnFV ÕxìðÏXñcWë9„ K¼ÇÙ -6¹D?=èI[ÔŽ–s#øþ±wÝ\µ†mŠ>F¼Ë£“j¾s>7ö1ûK2/ìÒú{-´»39JY¦ü‡üërX5Šbu÷ÝWŠ¢èý$@­Í˜²/‘Op×°Ø%٤Я!¹­ÏRý(È'ëù¬–ÜÍ øù -Oà=TãÛŽD¿b_uîÂ0È!?ÇiÔÛ¹+ªßn_MÞ ×ˆddüT¹ƒÓ¥_DI÷ëdä'!Æl^¨=Æ`NX¹eÆÿ‘Ç&Bý½^Òêæó#zÌ-ô4—SÛ¼½·ógåµÇ¨@¾ïÉɯõšÖ)¿Ý/ž¼ãðá»1¾Fº9>AŸ"ДµTíaàI[ 5v¿ •Ô>ÉIŒtµx˜ôÑÚƒ‡ëßh‡mífÖ÷“IHy™­%rŠñF…‡žX[½¡6'èvß‹1#Ü'J¬<¿Š‡øÆöÆîëÆiÖ$Òü06 Ù6Se|–|옇ü5°~Ÿ‘Ã}Y{ž»À•ÈF®¹ íäêLHä™vsÿt¨ÈqíÓ}ê(‘Þw𓬯±³V1'VÏ5P¢¦-tW…àÉÐÚÇ°õÛ—U挤|¹ -✤UÉÙ¾ N|&¸%šn7½P¶ -§¶×·XU·B&µV5Pu(­z{qË,¹ƻ܇ÝvŸÚþ¡F´&¹.$a sÔí…·3Û[5N€u5Ël`ð·5*ù”8Ÿê!%ûec¸X -(ªçðln_óÀÝŒßK– fÛ½(FÔåpB93]yè5lÇ-îF|eTUÜË£«EÆÑñž73Øm~ÄÇ…q#ózæNN“Ð$y{c¤¼1Êî¸h¢­Ð7LNÊû Z‹öœÈK¯d\¨»»gKL_Ä•¹ö1=ÆÆ0`\Üþbáðè`A9>d‡¥ùßÙ¦©i„3_îZž„õû)£°sðiDç°@Mk•]çÀY3ËòRŒ>ßÐÍéDÁxÓl‹­¤€ª³9ð²k|åeÃâ2ñ–º vH¿;¢×÷©‹Üy¡_;*‰\÷À=ÍGeˆÎ–O³l¢ÃWwoÎû²æûªŒ›oÐû}Xy“n½7pç˜âÅFN –˜ZÚCcÊ2·fVj t8ÛäþÇ»Áã°š3l¨(ˆîr˜›kTÅ؇ -B$y8{¾˜ž‹‚¼ü™uܸ%šÍÚ -¬'È«Œø-»8†»§z1g{&ÂiÌ¢ûNhûÐÕÃœ×ôÚ ?cÓUW66ê> ªÉNí"ÛMÍìR9Â6FqF.¢=(ÊŒ„m«ø$Q$D¢mÞå>8wíÓ>ì ;ïŽ#ˆékÁ¡q »÷qRþô2¯æD&ï•GF¦1í7¹øS߃áß‹yÃllX:™|i½³ÔöÞ‹»Á Q#Aaïg„ºqZW=ôãß7a\í&æ -^{:La uG4µýÀbó`mD.°bŒ½c‘¹¸ùÜôœ…žù .°n›ŽØæ#D 2ŠfêÅ‚‘=OÝ,,h§¶÷BSð“e_G1­sMxé.KÓóŽ´¨¨k®mû.qN¶+7æ…AÖ¨ÙãÞWlèÝ¢6í5sy¼åpîog”´æ¤[y-7êHœÕQÎÖ&Ô_Ót4rµ¿?›®?¦  ýì)í3ê¾±Îc¯ëÝÒt½g–3`ÌwèÊ£7ªýøb|¨9½eÛkÂnÀ{1Ùö\åb&ñ @TXaž2Êd,’4ñ‡ R{%ÄjœRfhDN+ „›|ý‡ÉR±þóÔžvÏÙÍ°"Qò⌳`‡ Ÿn—ó\ûŠpSúÕÃ>mã$ᆳ¿²ìB‰žG»Lª3w­êöçøzºN‚1³'Üûññ'ÖôƒÚºà%OuìI‘xûãsü÷E'4ßœgÊUe;™µÛ÷º‹•#'¿<Ûn¿ÈZ[Íš-<;ñBÙóë;( -J}Κ}{é™èwd ¶}Rnœ4è7ˆ7í…  Ïfôå¯Ò¥Óºõ¤LçÍA7NçЫ„¹—…¥ŠÐl0ä÷“ŒvÕ!ágý0y=,;ÓQC܇ØøÚØRq[fd5Ææ^dÕ1çÉþ.ç2góc!Hnš:TQ=’N³œç–#Í&‹hIý…Kâ!í™6<:Ó'%“ºãõ+:"Ñup—YÓ^GÔDšrag$–¢îåä{g7çf5½À£”g¨îwþý´aGÁ÷ôä¹Q/Ëo5ܽÁȤ¡Äªú’Ó:ûTˆk+©òñ¯€¶Õ–c…Û †íL$Or¨yåba–ʪr Õi_›.ñe4ùFΞû—þ¹Ç‹áI™fb=۳џA,9 és⃫ÜÍÁ¤nU5¸Ú2­»‚n¶Ù?Ÿ¨ÊÞ²Â]?ï[Œ£9Öó‰~g®4…l3Â$¿ƒ­ñ †©éªô†’så¸_ 4O­æ¯9=Ž×δOD}U'kE¡ Y”=©rAž¬ááMs€ÈmúôŠµ·žR€Ê ðOjþÕà«ŒßE¸Ù"¹Z8¨Qì#`¸“(£xk ÎET§B"™²ÃNÅA/ú¼žà„Eç^2šÀÍ”Ä  À6Ê‘;`&cÿÙmð~‰Ó‰w“@?yÕ©“Ï/î—¹xÑ+ÅÄH¡Ü_˾ŠFÚÍ彯i¸/Rÿ`ɼcŒÚ¾#‹×0IJŒ‚¡mJDIúDõ^ŒÜ2ôIû\Ñz¥Že"¡ý‡›ôÞ`)ÊC[¢ø SYï{Ò:¥3Úho÷Dönð]€9S>aè5½ïVߌ)Þh©2u/Z{Ò¿í¡Ò ÁõÇTj(¹ÆÉ¿*›öQvˆ XÆåßBs(Û•Ó]4žƒe½«ä³‡º¤¢¼Kœñ'OðNOÒí³$#›¤É·ñM÷oˆm¯j‹×ÚþBĶXÒÑ=ƒ`Hå´ð¶è™ ¦Ï¡Á9FAúE«ÅtòƒÛßWB¡0Ö¨Â,ìÌó“õif@³ª9·g¬*0‡ÒŒk?Rat»øK_”öXÙ¾Eï\r¹ÔÒsXd´UAeÖÒWÍÄûè™paëœÌ{¤<=à¼a}S–ó-¾)4Ú=šÌnŸµ#^¶³è˜÷Rý2'AŒÆÛÌMøRkÙmŸòl 8¦†B5¢,VæÍ_è«Y´·ŠÄá¶L~Á¤ÉÍYíí²ã{“b™d» º=ÇKémùÆè7Y9¦ßkp+ú] kmŽ±ºzì°Ø„™F÷Ÿ·Âdf§FGm¾›ñJX@³Æî™$KýÚï9PªÿÚåÚù[Jñ›dÏçh¦On¤íæ­2©öë嵋k³[$i6BÉÌà3¸SNpƒÐuˆ 5 ¥v¸ ãÆI­X•Ž -ø ˜ÃËs#CleÍdŽXƒ¸C}â9u›ØêaÌõ…zÚOrƒeäè—e‘âF‡4Ÿ'“Cö¶£C?¡Öã@ª²¥*Yô d3¡¿c› [‰Õ&•»€ÿÔžCèü^!%«Ñúûöå¬ÏjË«Ž`z¹› “¶c.½å÷Î%F -…Ö%i ³=&Ñ[liQz[åÐ…˜øhñké¾6xzÖ° -® -uԓߘ²|MŠNðÆÁrR-ªP3âçÎ/c߆ËÏõ<¶ÏñÁgB<û«4\—edßä„WxhK+ëmn÷x Õ³Ó.Þè£}—|·Ú¾£¤°›™éQ–‰ÜÀÿXóëv™¨œŽÊ;‡ - Jì"›ë½Z>•ÑRØb:z’9Ж¥?çå»êI‰ÝºXÖþ„²äpd® {ÑËæý´Á;*ÝéN«oÜ\z‘ÁT» -` -+³(ü"—c Ñý,’؆©' z»~¦]àÏfHÁ‹†+9,Dz½3)ö3EüwÂÁE?ÃTÁÎ\ƒh¶׎áɇ ¤ô¼…:/g+u[Xûȱ·íæÒ*ÿ;N¿ÎÒøûÈ»+2ˆWžü áͼܥ>izˆ7£¨ fL -ißmrõÁ‡•R(–‡¨™WcÆ ö$ÂÛ6v¿ñ‹ôcIÊ1œVÀ¾‹?1%à -¹(:¹|ºÎv1¤’„D€Þr¥/"R73ƒÀúë"ÚÄçÁÊ;ÁõfHbS7=‚m„G±lŽk,GÓêóŠ¢Ë1E¤¸*öŽH›6¤!D$vŸ׊H³s‰I“×wo¹¥³á™þ9bur‹g)ÖO“ênG~apvŒDe¼FêQ -Áfi!Ñd2¢3ÙÊØì`Šoܧà)FËõc0 -‡›^ -;Þ)?ç$x…^mnéÖ¶~Êl­Þ©ß§?š„R®aÝ7™Ï뤱X1…×nõ¼©)r¬ûz,ÅZe½ z—9U0ƒ¨8o#ŸÝ,ô‚ª¦nS²ø&V^¡S,N Ÿ-!g….¿=vÎs4_7 Ýjâ…Båï0dëîßftñò5a‹N&€g¦sÝÉâ=íP`¢DPŠ\JSã#CœRE„ ¾9ÏŠ>]ú5Vƒèr -—€ì –Š*íç sdóš‰a¡z¢Jƒú>}:³Ø!Ñ}êêyO5˜gèlzþˆÌ#î;N½½Á·`¯Ð$½»ñTzê|í+¿á2{jYžÍ-'õÂH™˜Ò_W)T™˜ˆ5Îûtâ©]ñúmÂVÀÂñ@ɤøŒp±ëe.h§L\›ojôÊf´ÉÐN¡®0Á÷éñéÆ£º]3ûa›Õ½|­øzèÎ1ó_~ t]ÿE΃Ã`ò¶AlQºz(d±e"Zo*Á–z$µR¸zN\Ž•³~«>&R«{#¡ ‰ñª‘Wyâ¢óNJPy‹Ušg2©¡×Ó\È©yà&»êç<‹`E£5¡@•8ꥬñ!ž„Ql‹BªDë|[Â_&Fís‰¶¢ :¯K^2wU Üîè$T]‡È ÑQuyt„~•Ÿüb!ÅŽXÏ|V76ö]7ÃŽkHõYäΪâ*ˆRÎi•Á'ø|D"«GlÌ9Ãt4J‘ú èåïïA9òšã£û›¼½bóO­.°{¦?N Ñ~ÍòÙ'¤ß–€ÔOð=œ(¿]í“p¿ˆŒG<ÑYµš9S^{ámŠgûüªWD{Þb­ K=ÀjvÁ±R_œúy,6èEž-è•ÇB¹#é¡ÁuŽ$£š_ï#ì½k~ˆ‹Ô>/ê¥í‰Ímò ¼ŒT"Öˆ'œëR–¸Ÿq4š©þMœ(§óå~Ð$»C7û(R'+›,Ôi ÷g8ÑáÔ2Ù"±DäãóËý … £ ¾&æmT,!-ƒƒ '>D™Pþ¤Jõ±åæËÙÕ4ôìL3}ôék:KaøÎkGó¯¢p†<;‘e[Ö‘0ûTÒ$X^ZÈníĪuA[†®!Œ¦)b÷é%xÜ(eCŸ4„¾O˜ÜNl²Ê}’oGÍQ†QŒç ¥Áó•¥Ò?ЋÊ}ùjÖê噃-WÔ»ï¼ÄIù½¿‚Wê±³ Qèõ,ÕÇt;®fJÎs¾‘ Àg߇ÈÅ«F ÐÎ#ÖZOjleãF@œÕh† -|=­BϺº¥é0 ó.ò;þp¢òS,Ö°ë÷¥¼ª½£ú”ä,.YŒ -k"”±2©«jÌáPÿ©ÒQ0g–bž¥Ã'2Ù&ˆ)íNW àý~áÀOÝ;Öxˆ3ð5I‘¨²j¥É¹=Ñ× kÃ&+xÃÆ0š°ÒK¶ÉÜžà˜ö‹ùÖÊ'߯ýù¹ÞpHø¿$Ÿun©Ý×]Å ýôÎN]Ú¦gZhèuû­ÐÛ= ¶ëwó³1Û'(ûà„ b v¬L¬ÅåóÙM­rËj´Éèû`åÖ¨YTfRiíÞx–#¥m!íðæk5Êù Ú…W$÷ê£aúÙ*¨/Ò[‰<€SIfUõX’5k9`Cù¾}¶(˜»&!e*âÙò>šÆÙl°LÝ_™.וH6vçáÖèG±BdKF¯^9òªóýº¼TðªÝZÒÄ ½Ý(YÔÊ9n"S%}ÿBѧlçB™é†Ñø:Û›D¤:µ7šÍ‚í§ó¦vuïkF¢Ó®lºÕM«?]×…ò)*ÎÙþ­-¦z¢ž«ÏÓo´å“‘‘ÒÁ¡­e›ÎeäÏà€µ!ÃÖ@Åä˜Ä(yËŠ"Êc)R/¥”†‰Æ0B¬%¥¥ŠØ»ÒJd,òx´*nr‘_U+FÁïÃ0ûÞ±èf -( {¤Í‘n!<¡½MÓڞπýÜ+YûÕ VïáÁ¼"Ö}ÑüŽ© ŽÛ…!æÉZ¡ó -Ê{æØùŽú*´gÞï#:Ì(ʵßÛ–êò”°Fx>ׇuÇæ½Ã©æf˜¥ · ALLË°@,qîn›û¦ÙW*uJ&^WNZ§­Š†ioüHçï¨0M§#_Nï½=Ý2Äb_<¿û„I¸¿œq1´ß+Ì5Z9ìsΔDô‹e] ŸuÈÄ m‡«§y„§Ý€N‹ùà¶ýVY줞ÇóÕ`”(nµëpÓæ«Ý…˜TJ¦qÄ4ÂÉZ*ñ†],±ô‹ÂŒCøU[qƒÑrÝaW ÃÀ5ü.“éq¿Ä½ÒÈëñ]ÿæ® FC÷×ˉ, ~J6Ðl -ÛÏŠÓ-Îܼî-tmšÙØLʯZð…PÉ6Þ¦}«=ä®ØAͼ¨ÇÕjãêüš( AYØ£†Šˆ±g2´ -óÖÙÛ2ta ïk̈£Þ¯è]l-6ÑýžLnͽ$†CŸ$TTe‰’X±¤~É”êG´ñ긋ÍÉQÂ$§Eÿï6Q!µ~¼s­Ðc@¥#d<°6¼ÞØe±f¡>Æ>7%zýDÊŽî=À´™'õ(¶ë¶°§zø=T*T’¬KðlÔ'P#L#ñƒ‚Ê[–ÓwÒcnM[fÊô1ÿj¯s’úÊÇÂ×D¹–S—‚Dëþ 1`÷k:3qÿSð7"ða:É>1ºæ«¢Ö¼…=ì x÷Z¡ç¯”Ó;Cò£Ãè0*Ô^õ; T <ݾ– 97P%¾r;oÅŠ4âdŒ|³z±æâ{4úàžÇKš¢œ¶]x¤ÊŽöÍÊÃiùÓ…‡þ`BY©Éq¦[¦šéJŽ¢Á¯Äò©­ÌyœKÅ5~÷Ž­®ÛÍNSv#ŽB–{;0¼¸# ‰ù P+:^0Fá•Ò/e‹¸ÊkÝíCƒ­Ž„Ù %ƒ‚K²óö‚ýùv7ût¬ E÷)îóò²Èxaµs"Òk#“埅¡¨>ZÅ»·jWßM¤ÕÆO7PlÔ¥Þ!:—!1¢™Kkݼ»R:££0`¿¹h6û&ò $ª¾Õ·ýŽxô{¸¬ÃFp–·½ŽÅd•¦…1M‡…_û”4me®ˆO¾Vä[h £À˜*…±@ðËPÒ"4.8(’Ó²Œo[ª£ÚSD -7A gAöCú -5@RÛ¥ñ9¢ëй¦·˜F ý„‚½© ¶˜Ù6iùAAY,f+ÕIV$ùΖ•¼Ç•ñ›ÿaAÖæÇt‹OŸ˜nN›™CùR®­ñP@06…:·*Dѳ»:TêÜRŠ„°Ô—U¹{%_éäoËf$¯³ß”’êÁÕfjgæ¹µcæe*Ÿ ýÛ¥¿2&fFÉ÷‹å¡²_%rd{'N×"žäãž1åuJ Ž| }ØÈgZÒCb7Å¢Øß2nK4ÊWZ[>FŽÁ¡mÆcýÜbO1Vq² -A›”Ç8Î`W.ó\j"uB‘™¬(ñJ‰¥”Q#¢r`<šµ)œ v´_§öÃœÎæh]»í|»e~¼é87£Ê¹ ãó# X²[žÖ„},àÀe °Vÿš2*pµi3Ñ/”¾ð»ãò‹ôk‹Ù‹ ßW}·‡Þc¯!Zœs¿Ö*ƒ¡'žNcH -_2H×|8N -"UÈõkQÎUc½Kë7‘sÿ3²xÅï¥>Þ^YicÜ9ŸÄæÀÏN$|Ž3BÅä8¿*¥é¶I .…s«zG5D-NDBPQãyÀÜ"à¾!&~çHE]µJ½k¼Šm,ãžà–‚uqÎ êO#Ý÷ËX³ýQû¦¹æxñŽ.~{5ǹ2ƒñéÈŸivÅI†£æ°HXú¾æo©Ì¥<Ü’ádÞ½SÇŠ0 #qeb•èh“z/Ä„«,w 8æ¢Êt8§Ä,v×\dåûrá1»tý¶yß@î`Doi°,м°FØ/´¶'J¸%;4ˆß³ª¨^žÞ’³µ¹c@b˜?†v¸#ûjŒ#·EªSL ¼Û![!{5uS¨¹DãúwÍ$Q=ÔØö¯¼6¯ôaø˽{¢l™?ÈÚ)-”VêÍ«éàµéIûõiBŠgÂ̇ -*?»[)0»†%žY¼²Ç#n+Ñš(¢d -î¦ãzúr,RlÓBXÜòØmSÖk¯­¹WQH. iô!óƒ¹Zh¥î>9sèÐÐ]…~,à‘MB#…͸vÕ{ø<»ûa3Í$l‰xxçk§ƒ°øöôܼeÚSÑs› w’ ~þ°c†©‘Z×ÛóìÁÝÖì@›|çap®â$7"¡ÓP¼gÖÀ²ÑóÕWÓ ––ª¨Ã',àL[¼­¼dòžÛú¨dÄGï~Žé%lÖ뚇ûŠ”wv//?NN^{CáIÈ’+Q±Îx¯ -%_õ⇕9€`v=;ñé„Õ×QT§òD¾u$Lf®¥Ð(>ý—³çïÄ‚1Ī.ŒÎ¦ˆQÎ2ò¥î—ååÒ??Ìtç+M Œ¦°¾0Ýîýªû#À9P®$xÿ.$ zktôŽ=op´•.Ip"øy- B-w?Éj”©ñwî7q'Ÿu3JÚ–ÿ%æèU8–òÄ8à7·)„-Y>,GR^¬„Ĺ;=ª\#íêÛ¤Èã0þà/(Iç÷ÍL¼‚fý0c½A˜Ë9!n‚^¦;+ÉÁò06Apmêøeî!EöÕ§F#ç>úŒT’kyÁ ´99sšk‰BFVrv¦Dççoîð$–í‹ÐàV?¤à?l“ÐÌá‹ÞKy÷à7[k+ÊÏÈH1Ö”…÷Rà±¢Ã=?`q½>-y„G ÎqM -|_Ñá½PôY 1KyòñÂA}·ElülyÕ"Ï‘ '.d÷ziš¯aú¤Æ|‚¥OÝš[õYëÙÌv`7q2O5˜%BrÎiÔد•ÒB+ÒŸÉô×,ÍÂÁF|íw@fACWÐ5ž ƒŠZ?¿ªb O#’k¤.[‡šþN#8;ÞYéÊN,Ô¤ò1ïx7W•@IôÔ©y¯©+[x -Õ­(W­UÊ ÂçTÐåssš-]¹2Ðߣvª ×–¢¨¡…Ÿí%ÒÙè.bi Îmפ/H£M˨&> -'¹fbB§:üehz†T1Ίr'm">=6Ñ›ï•#w‘¶,ßkz¯l>ËÂøÀ¦”—ðGŽ W‡Á2´­Ä‘áQçöÄ…Li)ä“ÔMiõŽ®uf·HWÝŽ½Ë›äŒÿšò©¨uB® wŸ0T°{€_¶q)ÖÞ~=¢ò@\0;À"9e®ïþFÈTAÐ,-H'úD^+%~é»Ã}Œ[²mYa~Ïa3u,õ–÷Ýk\k¶¤»LQ -ñ]ÆŸÅ{Rèá$w¤ög< œ¡m…˜‚cWÁ±þÁß'çnD ÊOÐyÏÏP<ŠS×ÛÔ+F¨¨AwYÊÖˆC@R¤šw™ýØ´jRÃY_‰ßºoÓÄIçb&–K´¡Î“">ø=‰ÿm‘G%Pe.&„y§ë¶Å~œIiFÝg2ëZFßHæ3µ75ÑͧpbrA»f¼ìr”‘ÒùGl€@çCYŽtíRþ%–ñM~ÐkfÀVàuMõd-ózyv2…ž/ê˧¸‹÷›94 À®ÍˆÄò×0z¼Ò-JjB-s:L¸Fǧ91Œ.¢Ýäƒyï.,Q8W;”wÁüIêσ6o’'ï}­&_´ûžŠÌ¯Ü—ä-›Â T_~ –}{mxS¾<ÑEåíb”Í3xŸ‚?o0†ÎE] W’©Ù›¨3 fS¡¬ŸÏ)ð:y±ÐY½£?ºõ7z:b31¶Ä­KÂ'åéŽ0’åˆMØ {ÍŒ‘ê&Ü­'òh7$ÄïÛ¯¾}TéXrÌ~tÞ=¢h³|Çs’k¾”Ú¤±ó⢨nÌòB ò¹5~RׂBé:Ÿe7d¤&n‰õ‘¡¨PjØ­úq.‘úÌ“K—û ñÍxø|º®Ÿ'–·³ED®Ðæ9ô,¥ÂìÅ®¤ky+šÙ´]`š0OMëÝùV€Ëû5•ï -ðTVç—˜ ¡.­ ¤ê+þ¬ùø@q±¿!.Ê0[¾õ«\Ä°¬nSQO7û€LxŒg߸á'HìÑ9Ø.Õ¢LÕtïúgö¦–êÝ2&üA¸9gRbÚÎ*×ʃ,q|(­BòP“h¿,¦öš¨|© 3o“g°ö±àïoù©Bõäà»zŸ†p¾6´rXK|®ÿiµõðÔ#êðÏT8ÿ²Ç]T•ŠS&Ž§Qµ€¹ gft-š³=LÜhîs“‚Yù¤ èÏ‘“‡ŒŽ::üLe{pÒœ´Òz~,í¹™[0SX»Ì®Ý£t™£(naÙ«pÿOzh­q@WŒšš8'|ÖLJi:—u(ﺔ1¿(Ûý8›&Z‡[¬Ñ+?n–(j‘o7MHµ“Ó½hüÔpÌÎÀuT1$8ñ0„_o¶}è8ó$©}„÷á5Õm¾:{’š…2oΕ2‡=æÔÇ0z¤NÖòût܈ùCþHøq:Bœ§ñ¥,ÿ?pÿ¯ÀÿLíÌ]ìmáþfâ±endstream -endobj -1642 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 3743 0 R -/FirstChar 11 -/LastChar 124 -/Widths 3754 0 R -/BaseFont /GUFQBT+CMBX10 -/FontDescriptor 1640 0 R +1859 0 obj << +/Title 1860 0 R +/A 1857 0 R +/Parent 1851 0 R +/Prev 1855 0 R +/Next 1863 0 R >> endobj -1640 0 obj << -/Ascent 694 -/CapHeight 686 -/Descent -194 -/FontName /GUFQBT+CMBX10 -/ItalicAngle 0 -/StemV 114 -/XHeight 444 -/FontBBox [-301 -250 1164 946] -/Flags 4 -/CharSet (/ff/fi/ffi/quotedblright/dollar/percent/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/eight/nine/colon/equal/A/B/C/D/E/F/H/I/J/K/L/M/N/O/P/R/S/T/U/V/W/X/Y/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash) -/FontFile 1641 0 R +1855 0 obj << +/Title 1856 0 R +/A 1853 0 R +/Parent 1851 0 R +/Next 1859 0 R >> endobj -3754 0 obj -[671 639 0 958 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 603 0 575 958 0 319 447 447 575 894 319 383 319 575 575 575 575 575 575 575 575 0 575 575 319 0 0 894 0 0 0 869 818 831 882 756 724 0 900 436 594 901 692 1092 900 864 786 0 862 639 800 885 869 1189 869 869 0 319 0 319 0 0 0 559 639 511 639 527 351 575 639 319 351 607 319 958 639 575 639 607 474 454 447 639 607 831 607 607 511 575 1150 ] -endobj -3755 0 obj << -/Type /Encoding -/Differences [ 0 /Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde/dieresis/visiblespace 129/.notdef 160/space/Gamma/Delta/Theta/Lambda/Xi/Pi/Sigma/Upsilon/Phi/Psi 171/.notdef 173/Omega/arrowup/arrowdown/quotesingle/exclamdown/questiondown/dotlessi/dotlessj/grave/acute/caron/breve/macron/ring/cedilla/germandbls/ae/oe/oslash/AE/OE/Oslash/visiblespace/dieresis 197/.notdef] +1851 0 obj << +/Title 1852 0 R +/A 1849 0 R +/Parent 1327 0 R +/Prev 1835 0 R +/First 1855 0 R +/Last 1867 0 R +/Count -4 >> endobj -1631 0 obj << -/Length1 2318 -/Length2 15115 -/Length3 532 -/Length 16377 -/Filter /FlateDecode ->> -stream -xÚí¶UX\Í¢v wwîîîîî4ÐXãÜÝ A‚»‡àww÷‡¿¿µ÷^díÿòœ«óœ¦/oÕ¬9Ê›ŠLEQÔd9¸2²2±ò‘Š+jh°²²2±°ˆ!RQ‰;L]  SW)+//©¨£3))+ ø‹HE*rôrZY»’ÒˆÓþS‰›TÔà 47u U4uµ؃Û07µ#U™®^L¤¢vv¤jÿ<áBªp8»,˜YYI-€æ®¤f+ "ó?N²– RîÿŠ-Üÿ§Èàì–"¥ù—&-)XÒä`çEj°DdVß»ü¿¡õ¿—r³³S2µÿ§ùÔÿUnj´óúï {G7W€3©"Èàìð¿«jþKN`t³ÿߥ²®¦v@sQ+;)ËE@) 'ÀBèjnMêêìøW p°øßà‘û—³ª„¶®’6ýOê¿ -UL®^ŽÿnõŸÚÿbÖ73ГTŸ<¾¬àŠà¿ÿùÏð½LÒÁdt°"eãä"5uv6õB/0q’z³’,ž¤O°03“Èü)xL|I-AΈÿÌ(;;)3¸ØÎÔþŸü¿"Rf'7+ÀÂÌî-ä$evp³7ûgæ­Þb.Rf ©ó[ÄMÊìp68¸¾e<¤Ì¦öàÔÅÛþzˆ÷Ÿfìÿ™r…í.oƒÅ68¹™¾M>ØØꟓð&ÍÅþÏä\þ9ÞB°¸é›Ø[ôÀÎboö#°¬ÄE%ÿMÜ`A©7ÛI¿ØLæÀN²o–‘{#°‹ü]Þì¢øF`¥7»(ÿ›xÀ.*ovQ}#°‹Ú]Ôßì¢ñF`Í7»h½ØEûÀ.:ovÑý7ñ‚ßnæljn pý¾#˜ÍÀñ.\^ö×þÏÄûÏœ¹˜æ@gs··c€,é>>œ]ÌAÎoËŠ—ë¿7í¾lý¶¹xÁÖfo¶6ÿ7±²€‡Ðâ/ügµý…ÿlŽ¿lmõ‚]­ÿB°"ð/«Ùü…`'Û¿,e÷‚­Þ:Ë ->ž™þB°è/[9þ…ÿ¬ý¿låüþ³[ÿB°•ë_¶rû ÁVî!ØÊã ÙÀVž!ØÊë/[}ú ÿ{†ÿsfXÙ8þYù±qþw½ÿ\¬àÿµ\vÿ5%ÿ÷½&&òôfä edßÜì¬àÁâûŸÕ4€àƒAV|²°ð°³ý+5wsŸÝ®ÿú%¾1ÿ‡-àëð˜#.ÎÌùClÒ›ÃÊü$ 'Êaè ŬZ”z¦;‘‚!íŠGåèÖêu*²0Q÷`öH<ž\¢:|TÇ¥Î2f_öÜMö²>}#йÊRôÚu$¿ >Fkož¹9á„TžZûQ–¢[4s1xœ¯B#¡±·BÑ«ïÞØû9„‹[G*ËN3<´þ#;™z†SYGøªzJôê¯`?›pøVúåKP‡Ûû‡Bø/É/Æ÷æ°ÑAlb¹ -¿lóñxV $¬îWc ñI!Š»™©Ì>W÷fVGÏ´9,¶ß.uOlª·ÕõzAÌa™õbÌÈÍ -êkïN4=!Éà’î°‘/Ç=ÍN£bß·±(—zñ2mtôl»6ä?ñ â@áÎSJ •£ â¹’|}Åt›P!ŽQKÊwçÊ'dµtN W;•7òÚ 3qWÆ6 -»È}Ès½ú å7¬ç¡Þ€J -\SRÔ~¿?Á.ƒ¯^àH_¢ÁàKæò.åÍ·A~Í´²FzöýEò9'öài‹(¹K“ÂÚákîÏEÜô[ûG²åmnÕg«› ÝÖ2‚dÔï*¾iŒ¦°1U8oR!º# /9[Àœïšëëû#ɸ1À %unX@öÓ1¨ÅD™ð¼§þÙu1"Òñ´Ø›WïÛÙY½Eª®KàÑñq!ðFò%&gdŒº.–èï™û¾±, sóyr`\ÆFe)iÈ×, ‹BsûŠhJcË¢_Ì9 -©zdúòÓáO6.UµÃc#׫ŽÓ²P²)á_ß‘äKSU]»iJçv.ÍKÓ¨ *¦Û®þ»\›_'&h®0ÿÀÿ^½_]'öX á>i8Inà„Y—ŽP\ž\±íÉX‡.ÈúóÀ·-a‚‚X¡Þ„2Ò QØ -A¨ZÃPR˜µ)£ï?éÆø'^³‰^±Dæ]É®cìR—÷g—ÇžN3u -Xœè,ÛÞ„ÀV즌¨}ÐÞÃó§>^8z ØÂß<øÕûŸ™É4Fû½'3LJ' oÚ €Aªtn¼[±ÉÞhá¯^…w -´'÷â¥+­wG¹ŸP}æúXbÒ"‡Ò'^i^e¤!móE÷Aƒ]žÅgÙ~’;gD|8]çiÍLÂ[¶?ùå_ꌧÄE~½Ìdâ -iŸ(¿ÿõ¸MK$~K ã6øÌtT5QŽÕ¿`™…Ó“gN [“Ÿz¬¸Âë‘{‚è±›@†4w†§ÅkNnÛwÉ8n*þÕÒë›ë@ÁH †qþôǬڥ -UhövÞN™S¦ô}ª[ìvͪæðzØçSDÏ`Yt–º’£Z%=ßT&'û…«s3·3xw¬_šO[í'ó‹#h œ¹I9Fˆ¢6:ØÁ¸¯áµ©Çæ·j %þ˜ 9‡úú»ùe–Ä¢–(§÷u Š8t-Ѩ„µ‹È¤‹”b¿ß öþN<ÜÞ‰Ý6[i›p)zj:yÕhªˆ£Ppå¤ëÃ<'ˆH¯è&»‡°)„yâzr¦Lfvwppî;nÒU_ߪéÛ~fÿ2xñü -ï7Ÿ¶OI•VÚêAÎÉféNµí4…í âÿ4Íî¼k×üBŒ™‡wìÓˆp`_9Õcþî4{[!2<¼H€@,: :øÒ„LŠÙ‚z²dê ûá¦YØȤãÁô²›#žwb¤ô#c…O¡Ãc>aÞüdFˆhã½Ô§Œv:‚wí̆q‚-““¸±¹¡&'-fÞ„°PÊ~¿ù˜;Mzòoz¨ á>HJR¡þ<©Ó‡.X¨”X=Àíßþ1õõm']%ÂnþWù]K•q亿²A»®ò~¯®o .f_*Ýô†š„î±ÓTZZ£Êeó×añx®/—óëûi©ì\–ór{Xs¯¤waj -‘òµÔäd=&ÊüÚ;zÒyu$ؽ¯ÁðjŽ8žØ[áÃÒ—y—R« És/­m Æ0}$™%x|Ç>3ÙÏ7,1vÖc©z’OOUe…ÝaµÚk]ì†4hê<ó{6ÓyñŸ5#”I¸ý›ÃòÚº„Êå?-èï9;ËËÇSØÂG6ïCg·iFE^zš0^J.ÇøM^›³­Q@¨·(…¢å+玜÷ñ]Æa Œ€j_Ñ9\wýQå‚·&#Ï´8ôèšê~¤KJu×?ѵc¯ ö¶ó].×ßsò|cVQèüT³ 2æ›1ª3÷¼Öy_¥Z?þAaÖ-JkDTÆ~&=í½»GÇÞßìÍGòJÊ×TRËë:„)„PçÚÉ®•/!þàÚÓ¾þÅf”ã¶{I+ÁºDq>whÿ3¾ -üu݆ôû¹H.Z±f|ª#F&5ÁM‹ý†e¯3¼‘êØÀ¯"Þߎ´NãË åTã6,Ð߸d"TÛˆÅLzìf¥sF늫ɾÞh±PÞ»Ìó4¢,ÛÙOmW’5þY4¸/õ¤Åû=½‡9GÂFYT#c{Á-ŠÚ‚Ø2}‚£`o¸;2OŽzÛ×"‘YõóüÂcrZ¥÷½$ç]Œ€°¥´ŸØeòG@›lCÆT€~ö‘9³>±ÊƒŽ7:çÖ¥Q㜃ⅰ| Ná©û–d\ãBÚj Äd‡Ó á(u$êû‹Èé=ƒrZ1ÿ؆.b ò —zÌ ‰Äo‚õ‰˜çÎdĬ7%Ï:’xR¿z`0˜·4|1X‹¬Ð×[´t ¹R_kVEªÕLª¬,——j‹mr´ËÏÙšNÛoÇÞñ×ë¾,ѵ ïòupv`0Z]^R‡ò `ÃÀKß=ª¦r!¨0ò!Œ`­à~»àÕåêó{pOÇe4·:ˆc³™5cГôß²P>ZŠ05ÌÙÞ î^dK³JX»Ÿº˜¹`¬ˆÊx>&­^lÞÚCÖì}ÙÒûÿ;¯3Ü„öç»Ì}Vó.~ÆžiÆi!td4í=êêôgdÂÚÛø…­‡`|AzBú†«™ƒ÷Ex -álµT\DÃ2Èõ>,㊿.0q§Ž•Õ8‹˜Jû„¼…NŠâ”5f%£¹ÏÑêorëò”J«èՃР-’WYreBü ë0â~úB†íµ¦²K{ôÊç;–,˜ -¶³°C  |:P…KÔP¥”yE BáèE‚¥eï‡ôíN#8„C~í´jî¡2¦ÛEÛ®*‘^xÐúµæ Ô”o=®ƒ-‰åܶÃc†¼’p)¥Þ“eë%ê'œ0ð˜J4!>^º `|`Æ[µ&„î‡Ü„ê‘Ö HÿöQ1ìƪPh³{Žv}²ØÆ6B ¹¶òu9}ÿ1Ã7IšaŽªôö2çü—AAµö]OÆU/„>®ï ˆ®Íµ#YÔsã0=³a¤zIDuÝ|aä]aæJÄàaÒàÀ‚®¯Æñ›×tôÅÔ”eY²n/òϺU^ˆïÆKhŽ¼æ:tº¬K¶$F÷dtÉÁFÿ‘c©ûž"ös1ªš`&õÏ(Û¬E ÿ­zc®¨g’Ÿ|,t|ÚšKÒë2;øüu:Ê›wÖH‹—Fn1ëÐÇ)~Êkúg>ûBCZÀ‚õzDý¨5 nîØt:”.<Ù,3nGQŸn5 ^=Û²Y4i¸"Égá. Æ#ä/êY,ÞÄN+ô°9«íJÕÜÑcnU¦K ˆwmö[ŸbÉuVHÕa*lº·­ÞíÁ»k.ÕPa{ }#ONÊVé~ßzÌ«ŠÁýœèÕ$¢¹…~>RC ®äÀi·Œq¬@NÀšQοŽP¢_×ñ±¥€ÞEy-Тü<<ßÂÜ*7K -×o¢lë˜ ƒ~†¹·ÄqgñÕy1 óuˆ ᜾îim»2Hf@r#ìh² C|_nÉZÉÍHwŸKÓ;Ñ8éÜó Çl&ÏãÝuž]ñ‰«bùFôÙh áøÑŒ‘‰Ê_›ìÉU“Ѧ¦i÷åw–ND‡qRèæ/""*ó>šê–\J”Ñ…Ï÷Kpð»Æ -·etÉkCÍi<—NõÑþ¡ -c6gXaò¿±” -í¥ÊúÒÉõjÙŒhÎm'ìýD¶K(ˆUú?ðã¼Î®ÒÍ·ÖˆS'§`ø=›]ÄÚ—^T -Q¨ËÒfÖÐ<–è|ÿŠd-2æ #®¹÷cydÍÉ]„¡"ÛñáCg_móï16akÖ5%ZV8ž5Ši{‡  ¥f·ÇHÏ<ךíÖP1Õ@æ®Ç_h¥5Å)–ZCòö¥y&%pöí;jæuÂçge¨C)ñ׊"²ðŸþhq%‰ú.Ï–iÒq PÑܽÃî±LòºJzïÓ&R[±…åÞ‘Û]ÚihF?ðÓ·t0²³Fe¶î¨4—Ö*|L=Ä°¾MãyÛ|e$Ê»@Ë’x¸Á„粎O'ZŒö[‹­)&kR[-ßÜsšãzäJ¤Wd}Õ Ü€jQ#ÑF>P5j“"•-oߪ:ߦvª·^œV|î -BÃî©èYe\°5áÐy÷´Jf `6Ä©ñ:æ;÷džþ4ðÏXÁ -F˜¹‡çlȤ™±bôÊ/w·^V_ªëKB§.œˆn¾ñ•Óû+!ß _L㩤,M`!ø~aèÔ;ŠñóÖ_BÀ†Aq6¿´ØÜég©¬"Ž/A‡<ì8¯–ÊJ´1Ì.´Ôæ€ÿ<>£3ŠŸ‡Ó}­]F’õ)Ê輎Œ“¯ ökÏÔng ຄ²KžS©¤Â|ülq¾ŸÇÇßcËëîJ˜ðÊgð ­Ì ¤4±M«JoÙÝZÝd'8WOy7·Å­Z*cì×h…w8õ÷åÀÞòä—‚ƒ+WTÜgYJÀ}ÅÇ‘”Ò¡ô\癥ôvè O+¸yëœñO'_ð{ ÿ8rôÚºfJ¼{Øwå¿ “íêú­(ÎÚ’"\¡ÈáGpؘd_šÜ­8Ü7ï©ÿ5ÃÏØCr¹1ér^±„g¯èEÜÂë³þIrãèŸZÛÏ1±”ãóÛ€lÐ°Ê ¸°ß3ÑQ¡NJ'’4cZÙÙ£9s´dø½3ó0¡Oð÷Q§çuŸø!Ú“e«’Ë®BY™W‡üË(ê¢q]¦"úʯö&jº©Ê‚ZÅ=s´Ìæ -Vu6PÖ¡&ø]3µÙå…ög¶âHØ]ˆïIzÛŸôTHà2~½¾T¨BîÃ]~AŽƒ”ã4}æMg*«@kOC<òÿƒÌ‚?÷ã©Ü—óÇŸ;):E÷þÇâëuÛ³u/ˆ< ZVãѽ¥„<•“ÉA{I>%rð îw‹ß"Þ - XV±T.êðù–ˆ‹òÑ1Gr‚=Èz„éñѲ„²lñvë©Ýfˆ»,Z\!D!¢Ñ}EÒµcw æÂ[rr½ƒCRÔgã#)0yÕ¹¶èóV /éÝ3˜+µ¥²*¼®ò2Í<ñMÄ|\'–%+¯p¼|‘a=ÏšátÍXÅc^9ê%EÒMðpÇÍ¡MEÙe…*'r1î§ EK„¹BxëðšìP™ñ¤0!bˆ -jj·còŸäÏm¾$:žˆzÓÚ/n±.uÉÁûYÄÁP•½Ö|äV~ŒÉ ᱸÁ­¬ Ý­òªQ©Sš”âÉÅ6./PZZ‡Âärõ¤3 J1FXIdÂ-Y&}!»øxÃÝ9ñQ£ƒ‡ YÓÝ|£¶µÿê¸ãRª(NÆèÀ¿Ã6öµç^Idú…/ß…é¾Ð¸v êv•ÃϨ!³Ã(d2ÂÁ‘Á$w™5r…d$Íú³OòŽˆ*­2Ò:–`3w`RýpV;)…ãó#Ãfy´pa:®6^hn]”[«íVô©Wæ–m\ }ü;˜Œ.fûö¢ÁEÀ[ZiŒ“åÅ2Š}æÝØ«PMîm3sœ§Éƒ2ò‘ö¢Ÿ‰æEð6ý¬}ݜ߳ô;^DC*}¿h¨ä°jÓoê: !i ^u£j/ËŠ/qŽ~>SÄò,­¹™-á®W ÝàÉÂþæ ÙcòX¨BHw¯H®oœ‰/RpÒu†*°àó2:ø‰¿¿ÃT&v{ØŒÕâ'¹áS%Ì=zÌ}úƒ•_ôÌp­‘äíœ_‚o‰eu©D Fêûœ¥Q¸VÓ|R>=¾#xºu|QÑÄÇT¼˜¬ AL~õÛT -ïib˜ Gd.÷¥.×= »v³mv誔¨ÁyVÌäà(3_ËØmÔæ¾ñC(Ž¬éH@¡o´‘>+?[óœh}I¢tžé?CîÔ–ÿ‹‹“ë"T„(â‡U¢¿ïä3°úCN©táóºŸ2ÍÙ/ôÍú(~ 6 -³!j²oÄb§Ö/á› ƒdЇZš ßÙä¯-VØçûK©$=ž—„~L÷“jÖØ-×d87yÑóŸSÞ©Ò±ù ÇWãXí‡PÈ´‰»Xäá“-3hõvÜ?(•ÚžB¼Jö_òØÝõõ¿G6ÁûÙnžÇHÍßëÎ'"ÿ‡eX¼XÌΊùýˇ“ŒÃËç'¨“¡õ‡Ø&á¹ùžF¿‘82ER¾_@T5Þ°0¯]Ò8᥄kªöo­ž?Tc\QÈ=/Z@´{÷Îçµ9Âò5Êâ|½ÐhÖn‡ÖM)ºËwC×\·°—doN¥@RïÈIÃ"B6>^ÈŸù…Ùßm„Ø}W¶`>Ô2Ê+m7*@,s´3ˆùìa½Ï_âòÉ>=È9Pf4p,5Iá;®·ë}µ¶‹|-: Z ܪæX1xG>v˜a -’ÁFʧÁÀs0sаATXÑÌ Çêëü¤*Ó»0Æ"|"Í®15óˆ†F7ñ —ŽNiN“ '‰\eccF)þf™ë{•Ex›ú°F8VqÞ¯8!5¨‹༄¯:Èß©¦Iwë“}›‹™²DcÅFFt¡$ZÐ'ÙØÁéA—ß&9¿¶Þz–5TC“jï’ì•›õRë(G3…"ëˆa"w+êv‘ä&Éd+nl3nàëL -UOˆLVD‘¯5qqœÝýr“,Ô—cÕ÷FŸ¥¾‰Ì€n´ES‘ŒG=,Ñ;½(ßcƒ ÜÒyBZÍÚ…[]mö3(ÝÙ =:{_Ë%¶-fšGÕJK‰¢q"3pOßyóqt^cBr¼<=öâËÂßM½hòØbhy™œ©%Tý–ž_l{á½JÑaf€yw8,¼œÛ>Üèñ#ºA÷t±}$ÙzÎÄ˺!˜àÔùÏžÙã²,rŠÝ µA49ß=¹¥®.ímÊfzîd´Â´©Ú½‹8ß ÷–|N*›Æcg³Äøu7*mÁ抌ƒÔÚÔÏø؇h´Ïɢ¬Ò BBÁ®“ÓÃ?5)V•´ 'åì!£]ºQ_æBs±I[£¯—m¾ÃFéÇ<»·\ü¹©Q`“D1‹V'ýrÅGo®©‚­ö±-š{ƒ&=$qeÕ«çTgý#±×·%œÝOgïΒЙ*Í÷²"ΈIÃO‘‘ÿHu~ïzG9ùï°°§.¤ÁuէßF{ ýNÜi^Ó3匜ý\¡Ž‰xÙp÷ÄÐé&yN{ðö뚦¥", Bu°aÜ…‡’¤ñÝUÇR]éñ&RkÞüO››þù¨-©O` «©8&È5€ ëµ°êgÜ;ªºÎo&¿h#z~—u/ˆ`WDGÕÒÓ$žÎ«0æÑÜìÆÆ[MVÖL|çdÝšÔ—»G:Þ[SÑŽö¤©§‚ÄÅ¿å*ãüˆî’„mÐÿìx%ã4ii}¿6·N¿»WÙ{It³]õõeÖ—PÌ,)2³Ý’†ÂÎ&ÁÛ:q5üÊs‹œô•ÖÀûFî–£W|믮½tàaŸÒ˜¨õÕîEævl-Ôüä }× ê×" -¼´0óÈ•"ö=ú/kÇÞ9ï¤Ý¤ä¼Pi·1Š°…ÁéŸ% ‰åCfËé­°S@H¿b<ð}–¾l’•ªõ0žÂ¤fRºÂµÓhäµí¯ý†ù5WBb’€7ª Ä<ëõ¹Èð«l–J›ëT8ÜÒ°ï;&d7>ÖÒ5Z~]fÕyÅ“¯4:c·vÀ¶+re `ו‰lð£t ‹£õ;”OÂÁ5/) ΑŸº‡cJ»wBJÔ çYtfœK lTÚHèU~ÜÇJ­Ÿ"}Ñ6ý|í¸ÃùER:)Ö–fîšÿ!Õ\±ÅŽªy'ù¬Ü»ØdyÁ¦&ˆ ·Ö -Øe5/j%Àk8±*ìfBÚBHñÌÅÚÔ÷;kV¥“îò…úÒÔ‹Ø6 ] û=<„¤jö`¿­ÚÅ5Ñåû*¯8©o‘ÙšÔ_0*Ì$ø~&\¤pô¥~]Üs㻲Ѐ“‰›ÊõÀÐ…4ÀDro4'Ûá5û:6³lþ¡àZ môˆE³B/“ê(ùÀŸ£ž}'1ÿe϶éݪ5åi›XZtàÒfÆp€¶xŒ½Ô€Êöî_f§<Üž ™Wû@Ã#ìì<)ùŸ0[ŠóìWÿO$J¬Ó·…¨+D’òÕMëÖ’ùc…í £õ?ÎÊ2ÄœÑbŠÓ"T{êM_e æ°0˜QÙõÏ|aÚ$¢"´´;¢ ·Hlÿà&“Ë— ¥¶¤ñÃÈIô··ç3É1O¦öàSØy`S¦4ÆKðw -Í¥EŸ±WaÍâ>ºUTÌ"À¯Â…²êfvLט¢›´.öû¬Î Í±ÉÜCUUÍŠ“2YÆ!ñ.Q±9á¦M_Í‘ f¸LM¨êñM­w“úú;¤ÅzÊùBËDÿP´02 -Ñj8oO%h»~‡qÿÀPÆôxf£>ýä"4¯ôRõâóqɑΚ&¯x%ÊëŽX wô€y tIp¼ð©‰—¶<ÖƒQýÉ>ˆ¸ëXšçQëg -úËù¥Rq6ndrcÍI€±Bú§s@5¾í9÷Ï8¨o©ý˜A2PU‚ïËóʹ‚ýóòâM&m¥Åx.¹nÄF?c™¡ï@;ˆ£MÐO(–„ ^YR6Édµ¶qÖ6”NÒ< o4“÷Ù ø”dŸµlºãžÇ»Â³6Åå…jdöúN´ÔÖ^PÇ]±¤:ž|†áÖ~ìŒy›Uñ#P†ßð,¢3×ýR ÞY#ŽîX÷wÑ­ÛM¼ohÀÎ ÏJIâ•g»?óks å»dôﯺYº»º‰òðKú”h¸ùœHÕÄ(b[YÛ•/ûçÏ|NÒ„¦¡µ>x0H˜Ü'S|™f»Ÿæu6ÌšÄõŸqÑü¸9fW+lé‹ÅSõ¸úƒºÚáGô 9”Ñm½“šŠWo‹Ï›âr­À+hõÚXŃʭ4t´Åµ»ébÚWâ¢V·àðS·‚ ˆ!b-Æ™¼ÿ˜ˆÞbƒ¢;Ôª˜1üÂÎ>"ëðÉcJâeChþѨq®¢EΉöŠïMd×`¿ÐÔ³;h9eZ`š$ïE{xd›hp¾ŸÁ¦›(x‹<­h>Ï™ µ%­Hègk<¡Eiú÷ê¸ 'âçûnj$ÍoðŒK¾luÖ?µ9ÓWô$ÝS;W;p2îŠ%«<››Úþ g=䆋œ–§ûu}ù§Ž­²·÷T«,DÞ‘c!²¹©><@&Xÿ+楖7…î>À‚Zrch™¨ë9H‹Ú+"ý40tŠ£¹'ü±ªªî£šnͨ7‘ÒtÇ=WßÒQvìR$KŸÜd~›´áÉ«ó±0u/`”då’ -Ù®¨$¢ül#ªB©VÀa†°àw­ë°î¯9õí¯€[¯ŠzãO–’‚¿MlO´˜Mõ’zWNux1ºÚÜ©_•ÊêIŽ"cñS&Ð’ð‘ùü Ť[ú‚‹cH+ÄYå8Αz4u\í9¯Xµ(säâ&…ñ£Z½âƾyg±G¿Kù¬Ä¹r[D¬¤þSàƒÐÙÏÀRꘗ²íRÔÓÜ<8ÈïoŽ)Îã!q(”wmP_âfw$õ¨ÕÄñèI½å=þý¸Å^ÈŒKö·¼ßšÂšƒÌÍâªè1Þù~|e}dÒªòà%«E½ð=©Þ*}vª ` Syù4ŒÜÙ_{˜ù“y ’+ܘ¹©'BܶC7…ôB\hÝ>íù³›è]t ”1=$ü*Ñ-÷ë%®~ Åwèìmª Kt…ØC6²ð¥’ç„×uÆëaû”ƒý$nBôç¡8’µ§(íþ$æBˆáé‡^®6ZíA·ÇU²í²­l/'±6{–‡v£ôòvÙI̯2<õê±®Þ9FGz‰œ üž|¿jç8†üME¢§#úGûÝs Š ñ9y·*> 2kC*Öh¢O Y2^Þ¯¤y“jIH -Ù*‹µ]&Õ“IÃÇDÊ*‰ø¹À+ÌÓaÍ£n®âa'VP'¬/ÇÿnØn;µä¨iE‚·k”],`郼Ÿ1PW«ËQ¡N?[ùã('Ư{Yx[Aï06ÁYœ%b1HµXq0*Ÿ1þ,ÀÛOŸï“ ùSu’͸q±X?ëwÊ™`–éÕ<|uõN¿œ]–è”Ûü¸B`3üƒEÈßi"®3 ~¢§ó”Éq«kŸ>+)KLÛ}i¾þçÎOMVÿ¨%5|¤ãš%üs'G샯%{þg2_PaúbbÙòó˜&ÛVŒ“ÄYÉÎ]úepfDÄ:”j¼µÔ¢âÊ%òV.O¼hJ¿¨Y­í'ô¨@!Aý%¢T‚Ñqn}á6§Í™¶Û!–Jª_îi³÷š…Ý°;4Žt •]Ðfñy‹+§6Á ­­a”$4Ã/M¡0Áh)ƒ2>ƒ”qúòþÖÙ£ßoyCf¡b’¥5YÍü1 À½ïUŒ{#«ÝÍ«Û´ÍQdé”u|¬éoÿàoQ®n³¶‰‘nÌØqÊFÐaJ‰O¡ Ẋù…­cãf]žP¦˜³rwë™dCåÙÍ!D²uù+ÇÌZ@Ãy¤H…±áä1Û~¦4´ ²¦7æðCO4^zමYÎA-:]˜uÒÏY,HNiœrТœ­.ÜIE,tÑ_”'°ý (!ã;«7En·‚ÎGá¾ "舦æJ×ÂÂhW„ˆÚ²cˆ#‰ð4º•¬ÁÆ\d뎫 å¾£‘üþQŒTkðƾŠºq€ ¿wwuo×d´âX@ôÁ°£äf¨mé=e«[‘êÈ­1öÇl €¥u<é«ø‘­á%¬§4‘uõ*“ŠFîhÙöbb˜V?jX¨ù2vÆÆ}uk9Œ¿VErQÀÔR„»k•Æ$·ÀBrýªÕR|ÇÌ$Ò‘“„íéÙÄE¢U‚+ÿVØÑt׺;È£·•fîŒ%+éz~ÔqJv(Pbæ!@dÔ‰Ù8'‚ä ³ñøFæ`F»›_âWÂhàÑ€{N¥ éTqÞËýòË0%©|ö»¹ïõ•¯ÈÁjÞR÷³w&Ië8NÈ•»ÝÖèûåoÍ?E[9䎗*oÐÐryLÅøQX˜\mâ§BŒÉÆaŒy­˜7œds›¿E!iŒG‡˜Ò¿ -%µÞïÕüüšÃnj:Ð>œ°ÖjÓ ø uhq‰KÒñ¦r!YoòJnæùRПÇ·Û¿¡ÒBJì\ˆ‡%Xù°óŽ.ÄÚ˜•þõ|} uúãþÇ“gwb}±ÐXNräeç†M§Pu¡ÁM÷5²h¢p„?GîúŒšÃʪSèœåµº3.Êy-ŒFEó5S¿j:÷k†íë¯^JØ?’3—´2QV­·p¿*ÝHIìÒ`=•éñ½#3¾\æzŸjщÝÉ(Û²!5dè ñÓ$±â­ÖžNá¢èxð„ ŠNB>!¶õXò - -g»Ó ¯œD™Ò‡\”%TF¥lÜgXŒ§Ô¿Â·¬ˆí°>ä8µã-\(‰fhuÕ <¦²ÌÐ'}ƈOvHßØÔ…èú°J„‹¶:˜dX77§Ä1WdG¦«A¥ÈFî9ðÔ<†S³Å:6¢íKü‘|…”éÛÚœ­ýñ9J É ^£"%4ÒrDì ÓÃÏæCf“„9Ê6z(¿äiW\“„ßXÇrp  y¬)F ~Ÿ,b©Rã{ Ï©× í`›¬è¾–Š>œ?’EpÇH°¦O(?É×æ´’†ÒÖ«$ïŒÓ•ì„©å ²~”¾*Š«(ÿ·2è+jVˆ¿ÁP;'kûse>ñ“ó–gF¶âýJ”PêóÀöˆ¹ù¶N-APtòïñÃpŠÁVŽ«ÑþJ#+ƒŒŸfI+1ªMq󼓙‚º é U¸ø,û3töç]A1ƒ÷…Þä%A(~~Ç‘9Ž(²L_oÍ^ʈy=ÐÖ•É^÷b.O~2³UÝž|êøö[LÛ@È÷ä»Õ@Æ~Uô*ÛŽ,à¢P¬¨rƒ„bTnI+G¨rãÔ“R¦#0º›šÐq³ÄÌÅ ¥Åœ[fG÷¼HðÂøÉðõkΰ¨T2#æÕ £Ú~Ħòme }ð&ÓÜJ¹øzù/ˆ<Ô‰ó%®º´M²ŽœUU ßç§ßAÕ…šuÛZ:fua‰9Š±HI¼[ê¿Œó¶.*Ï |…ô 9«8 )›D)ºë« (ZKøüö`>R=ô'ltˆ„½ÝMŸëʽ£lè3¦Îäߊw›×{åüŽ{Æ"/å…Ó0ju2šÙ£rk‘¨8Œ5V:»ù<¿p ññw>}šN¢?ÞDœ‹î×MëÓ(U2#H -PðŽmÐHB#Û~ a·.B~G£iÏ7çlC‰…б~f¨4 -·¸º5¶ªtê#Q«á3"³Õµ†ÑêLVs˜¦Ô‹C¹+ßXÇ<»Y|6ØhèWY¯—L-gŸ€ä$ÿñ¥3§Iv¼="{”‹k¼¤XýSÍ•cÑuÎa¢½§KüÃöÙ¦JºzáT¾´D±Mž\-Áes‘^+qCJIB‡AçdÅra„¢ýåÏz™Ü,T¥ç€2NŠŠÀ’–Ñ•Œò>l ™§Ò_ÚŒ½bÖcVPü_K,“ æÿ|œ …ŒsG…¬7Ëè”^+K½ûéS/觕õÒ—ÐœŒFŸTtǹº>*–¦š*ýž£Àm»f âÝ ˆ’™¢"ݹìÖNEÿ`’ôÔI¤0r&³sP®:|”ÀVf”!qž¦’¨8Ư)¦>Ы÷³‚¾ëcÛdÓo~¾QAÑà6Ôìïy¾ãϼƕÔ„¦ãAúHY".³*–2µ§þ åå8ëtŒ ðâº* -(Xv!‘E5……¶€G­ª,’Ê:€%C”×Qö†.$ÁQªÄñ(bÆ·l§ÙóGT!ŽþsîJ„w"줔,ŽÜÐݨŒ²djÙÙQ9¤+¶t?«¼ 1{´œí”²Z¯§&Ö xvñbH©Ÿ8ßíÓ¦}›¦ÅŒÙô…S&;I.¾êg -gÜ*çA}#ÆÍØ|À9–p žBi¤ùY·ÊH¬H¡«úm™v8ò=uýýÕ‹¤o2VMÂTŠÛpIy½˜‰gyz‚HdI‰´õôTubgÐèÆN½*V$xŽlB¿‹Ð#«}:˜§Îü.`½˜;”¦Šo]cYžX?3ÞâаP¿­€ÞqÛy7w᱓,"÷Ýà¯W!åšâ˶„¶8aÛqظ/µ}p“ŒpúVR‚Ìù„OI:k¥I„ÑøG›W;÷»±±Æ*>«¶lJÑΑ— -ˆ¥žÔ8Fïš×ÊOoâŸ1g·Ÿ •:TfÄO‹Ö,{'ëƒv2qK²)·[êQTÌñ-¼dµMÒW„,6åëã y÷°,BsׯÂ[ïÍc¼¨²½mž¶·Vôge§¾Zr´³>ª8×5›¥]MƒX“âE$ñ€v³Ž¨Œ£²*¸mW?«koU"Éšsy-a„5&èGô|[Õ‘;æ̹֠¡§ÉÇ›‡­B›ìWç¹~äñe,ŸÛHkç} O~¬Ÿš©Tû)[LÌP¸ÑÍ릟AãVå¦,.Í#Éîô †ß±šš:'æÈ­ð*,qG³ö"m”¥bá)5«ków±Ë³¿}xN$·¾²—ü\ Q¦oªásŒ³BÈ»‚ánÌš&Õíì üƒd–¤MÑñ#‘8¡iÉ©#&?Œ?ŽB¥ž#Æ+8ý.ÁÏfiÀ; ˆ½¼…gÀÃÛ²ìÁ¾®H%d¸ÆZÒ†›ÄÎ"WÓÜ $÷F–žÁ.üö߬PÙѼD¢Èüœ ÍS6Iàšó9_{vl×…¨Æ%Pǘ0Žõ‹…›Vº£þ©í.±–ïÛm(è )kÒÄTñ%»×áǦ´HãÚ\û/W—îrþA¥Ÿžñ -²º|qg¹W…¢Èüý…fˆapx ðz™‹ åÙF›´êìa®K|Ü_D®¿,‘<Ëœ›œ -¦¼›ø’`nJ_ÂD5pÔÓ"´.±¼e·èPj¯˜MÜò€à]OGƒ-Ö¾ãW…ǽøUáÁµ¾ö¨ÃdVãNKûBò,‡ÃF¬L'Æ´)ø>SgãO3F0ë}c±÷éw<`[ uÄt8È[ƒ‰-£=~s >­@77ÎbÍÛŸô?|­·ÃŒŠz´Àð–ê—.IÞuHÿ‰¾ò \ƒ]ܾ‹ï™dÞ^v/5].3ö¶…bšõ¶S" -’är_µÔDÅâè&ÛâÔ¨ðò˜d_ëç*¡CŒø#iåä÷¾¿‡¼‚ô„»¡•Q4†À¦)gY9ϹÜYwWͪ -ãk0!8òé'B-Ä/ÇYeùô%UI¤jèå]h‰‘¸© `cÝ{V5*P'aõ“Ç\ßzñ6:a»-³U ¹9!Éùƒ×jПQÙûÍQÖªGøD2nuÓ9 —ÖH\=dJ¤H*äæ(/)ÚÔ /m&Úd´'ŽæüŒÛJËÊë]¹dw óÜN¨6~ˆÚï1:ãåvš¹ÅïU;ôðãšç<²§|?-ssé"Ñ×)ˆÈtQ¾ûÜžZŠ‰}ŒÍû¾°‰Áý’íEFs'°U[ªrÞ%´’H2^ -Ps'lPCýÒÌƸɧȥPš`É/ZbËØf½&ËZÉ:³úýÀ1õû·wUš­ò{´”K™h'r-þZëð.¿Í>½¿w¼)PדU{±˜5K–eí\®šµø(œñä†e¬;L^Ž<˜ko!â7>Ñg÷ón»‹tQ.íÊkW¯ ñúÞ+›õ%J›8‰ …ô;sx%¼Uù¤{géšiÉû±è A{!æu^¢æÆ@Çrš'¨†ÈùÀ—B@MnP:œîÆ:oU‘3ÑÔ°->lvHwÊ¡¥Ïûl»+5õ’Q4ë³á‹"ñ{ñcÿ}ÝÝ)ŠÄ-Œ²²mmv:wß ¡Ž?ø/nüô Û‡¸)iôyßÖ× :dÎõ\lLiå®w§íÛ…_%\xôUríQïTõÃ(1HJ¹ÕÊóW.¿nMáùê”Ä/‡o øªÚþ÷2$I«4Ó¶ŠÅ"ÆÑeç´x<ûŒZž?ÒDÓÛ:îÒv& Qß¼k}îãQÎï’£º‘snÁ¶ò‡÷–»-V[ÖRÁ(…&Ö&;gÂ!¡7³m¯p}T·IIÇŸÝû=“lIÉý”5ª ¶Ûô{Ý€´áEd²Ñ‡!‰~ìCˆEõ£yÆ´t³!§¶•s”Ï?:gñ6xèÔ­kd¢„Ä×7$‹V-5LÁ|PY¡µƒÃö[ˆŽ¡§OÄ9K³§ µF™?ƒC€\«GwØØDƒÂ€Oδš:Ô¥z…é?2> endobj -1630 0 obj << -/Ascent 611 -/CapHeight 611 -/Descent -222 -/FontName /QDWYNW+CMTT10 -/ItalicAngle 0 -/StemV 69 -/XHeight 431 -/FontBBox [-4 -235 731 800] -/Flags 4 -/CharSet (/exclam/quotedbl/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/bracketleft/backslash/bracketright/asciicircum/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde) -/FontFile 1631 0 R +1843 0 obj << +/Title 1844 0 R +/A 1841 0 R +/Parent 1835 0 R +/Prev 1839 0 R +/Next 1847 0 R >> endobj -3756 0 obj -[525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 0 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 525 ] -endobj -1627 0 obj << -/Length1 2287 -/Length2 17128 -/Length3 532 -/Length 18419 -/Filter /FlateDecode ->> -stream -xÚ¬·eTœÍ¶p‹kp— ÁÝÝÝ îÞHhÜÝÝÝÝà܃»CÐàÜrûÝûœìóý½ƒŒž«ê©šµªju7©²*ƒˆ™ @ÒÎÖ™…‘…—DLA……™„…‘™Y‚BÌ`ìleg+nì à%aááa%‘˜€Þ€^¼ì¼¬$bvöŽV–Î$Ôb4ÿtâ"±8Z™Û’(;[l@c˜ITíL­ÎŒ$"@ ‰Ê?O8‘¨œŽ®3F3+Sg€…•-Ó?J2¶æv$\ÿ›¹Øÿo“+ÀÑ $EBý/M¤™-ÐƒÄ `ŽÀ¤hš rùÿCëÿ.é*Ûü3ü?‰úšm¬€ÿÓÁÎÆÞÅàH¢`gp´ý¿]5ÿvS˜Y¹ØüßVgc •©ˆ­@Âüï•“¤•;ÀLÙÊÙÔ’ÄÜèøW`kö%@™û—“–²Šº¸"Ý¿÷ô_mÊÆV¶ÎjöÿõŸÎÿb–? ÊŽ£•;‰.3(½, Ž ¿ÿ}§ÿæ’°5µ3³²µ aåà$1vt4ö@qx±XÙšÜIî a&F[;gÐ#$ œø˜Û9"ü³¡ =g2ÿWìßÈ -B«?ÈBàdÿ§óŸf6P3hl ±ÍŸ¨‹ƒ‹3ÀÌøï½ÿO  “­‹É?GÇÂöO˜“„ÉÌ4vüâ"a²8šlÿzš›„ÉØu2¥û?Qžÿ™í¿§bg `ì°ÌÿŠ²üOôÿt-ÙØéŸ!œ¬ÿA+³º8ý €Öejgccü'Z¥‡½%àÏZØ9ÿ%ne÷Ç´' ±“åŸh%žG»?Ð"ìlÿa½³ÛŸv·³¥#à¯ÿì’ËŸŒqü³OV®õé:NÐ$ëpýËtZ˜ÿ•ª­Õß"Üÿ¬h÷×C<ÿ ccõßQN ÀÁÅøÏAádûg_NÿT®?A“ñŸé8AJ"¤#ú‡@*bä!þ‡@ÿ!.P²$ÿÈDêÒ$ý‡@N2$#û‡@.rä"ÿ‡@. -ä¢ø‡@.Jÿ!n‹ò¹|þC •?rQýC µ?rQÿC ?rÑüC ­?rÑþñ€\tþÈÅÄÑØÔàü_W‚‡í?ñÿ¾<ÿw+GSs àÏ1âáüŸûöߣ€¬þÜ •ÉY™þ) Ì -³¿ðŸ“óþs®ÿBÅ_r²ü Ayú«R1ƒÔ¾ü… 'ë¿$õWcYý©Y, ÚÌdû‚¬ìþB•ý_øÏÙþ AVŽá?í/Y9ÿ… +—¿dåú‚¬Üþ*Å +÷¿dåñ‚¬<ÿÂJ±­Ùß…†…¤°ù?±„¬€fÿÎúÿû±%*jçîÅÀ -ª9 Ìÿlh×y|þ»§º­èzˈƒj33èý5uqWç}W©ü/›[>Aw€)Âê’)_ð—´–Ð -_‰¢™JhZpQ‹ÖxÅÆÞùoˆA+ àÀÒq9Ú­­çªL äCèCb·W§È.ïÏ“’—ñé‹ï‡®F‡™žíZ7™ -ödA§(- ·gàJs[ß+’µ‹‡r®†O ”©ÅÕŽ`7HÁút]›ú²‚9¹´$3êa! ”l¤*¨éáìa›n¨É‰P›ÓA¾_ÂàÚèÖ¯íº\П‹àò“Þõ°âÐL»ˆÙTvi1UŽ„ÎÊ‹ÃPQ¾þ­Î"±Pu$9„^ƒS— ÊÅ­ËñÄ—0œ½Â™’Wp½¤oïÒ"}£àÔß*Ý7d£3´,–])a¾J,²«Ž¡z‚ó|?!I}ä)ì’Kòû´ãé’ä\£¡G£MŠÔþ…Gg(3kÓ“ù6[_ÄÌ^(ù·—‹p¦¾ˆO©‚ÕêóQšW_%D”Áa~åã\œÜf"y¹AG&¢Xá뢱Œu;z:ÊóÑ*h -¯s -jÞ=è›hvP¦[Â*e5ª-"…¾ûÉîÁSæ2XB¹´¡¼ŒÕC˜kaÊ‘%q`\];›h3?Uw Ö{yò½—+óL¼Ø¨é6t æ`§™ÁVå$«®à>]jfY‚µlðÖ# - R;rÆò‰:oÂŒsÖÅ™Jöˆ8N|bâ#¥—[q((“ÏL>K*yhÞJÕ-“¤Ÿ·ÕZ¢¡¤s¥\Ã`Ê|ÞÖub-d~+jvÑán>J£­ê#‡ÉÇÏx}ÄÍqh[¿MQî8ɾn÷î™H•‰HŠÂÇAm±ø“—j¯‡ibza"HÃ8Qí= øà†7Ç‹K|Øéº8Ûž4 ÿõÊw¹²:® @aRµÔ üúÁj™u¤ ÈÆT¹×ú\ŒÊÉžæ C‹¹ýg¤ð§Ö/s¿”¤š¥xšÂ)jÌ3fqNäeÏÄ…{l*Á2¶ÞXM8RõLÍQ*s¦†ÐÖî  ¯fp”ì¨|‰p6DæÖ‚–„R§uˤP¨™°koGÆ!ƒÙ ñ¼M)»i”M)Êd~‚Ü°e…˜ËìC]±¼uþî.ì•#zÏehñ&’¸_áÖ~„«6+6‰Ÿ»1ëêÝŸ˜ KÜ!/€£ŒL](d奯7c¨q2+·µã(´~'¬è|FQÖWZà—f. ¡¤Ë)¾õb|£«.€¨è]TCa@¾iÊ™™øQÔ÷>6@ú«m¤FùcÉ5|.V ö™ºœ™Â/˜«ih€ë&3•œ¦Ü„¼ð#-TóîAW–ÎÝèOº=ˆÎÆHÌüÅ¿Z “J›¦Àt8êéã"N¦.ˆëT?7©ø'¤Ë2kXÈW-j‘ß«Á/R6J§©(/ÖܶÃßÛOƒìåî…¸GìãË× -‡Ã]¡F˜ÇwP‹îuÐè1ÑSs¨š)1úÓ¦I*'KM…¥æú!!"ßY”ýr™…µÝZÅ4ÞÓulÔpƒ¿ŠïÊFéÛW¨%'>øöI0=Þ3Êžt[ò>Ç[àùæ…øÃÔËÆV(’îøAå45ö]òaŸOd¶Q&]¥=Iõ_¹xï d7Ýt®3Z´³ëZ䌺»Å³¡½tÈlQô½_ô2e‚_hJRŽÑUjÝÝKÙˆûÍ¡ÇR?“ 6™Jñz#»±_–ï¬eÑJÆðd·ß|ŸcYÍãW’sÏO–;×ñÂßä5¿XPMðKL…u‚™.sì6 -‘e×z ÆÙ™¨’¨zǵ óäòÓÇÙä@© -pVIÞÓÑo€$>«¥²6íÄá´´ø%9¾(S“ -OXí"©;¹½•-fÖP~)”ßv­×Úï"6¶Þ3µ ˜=T••Ñ´M[d_€ QÁLêå RâL=øŒ‡C{ôãKùëgàÜÔâ›K:¶®í ŠÂ7µwLX4ðS©Û†æ4÷¯'>?x·%ya×wáè?…%Ë:Lm*.ϯ¸9çP€™yR‹w¾—Ùß·”ªo´#”“ÛþºÇe$ŒHãQv[]ÇjŸ)ÜÎ2S´•¡O5P ­–½kÀƒiù)»[O‡ºõ|œ³"ØóøCb&Ï•ÏC–¢`ÆÛ¦oÆ1Jï±ÂR;&èÀˆqèXü)8–”"ºQ|U?_vK^¿f*¾ŒÎ¶—ÈKïqˆn{® ûîGÐgIíU¹†[•3%FÀ”CåCL¾dŒë\PÍ‚‚O³+B1ÍáÇþcô‘dɾÍ‚YFìV@· -cùÏ«(G,V¡þubFèO–NS¸¹Ï4ø©D²«Ð¦åõ;‘[òFÞ¶ãh -3Ç®»pƆüBƒÂ"œ`¡ÅN‹â³ÙŠü1àóœŽQºRýãœEß4¶½•ä³ÈÁ¦L¬åØ8m×Z -×)OLÃÜÊö§="̾ŠEò¸X/ñÔ}¸·­‰ƒ@ÐMM¸>—¸{ŒÊ® "†¿ê‹Àýì»’¿…’û431äÍ—^[-þÖãñð¶j¦ŽÅ‡1ùÉ þâ£g2 û½ßË"0õQ]xóú¹[!ŠhM#lo‘™^å´ƒªí¯•òURÖ|]~=Ã?٠ë­ÊPG@â¥#År“„hL¥RÆ;Jï!ñ¡ñ àýËL¸m¼½¾$"O(õ0ØY IÔÚMRV‚°–Ð,˜‡F©úó¥ÌéÞI,«oÊq7›„dßW?]öÍŽ¢ ú%Í5´±¢OB;ùD«º õ8j$9M~Ênh£FÓ.)€¾¿¯†A -Ëà^®¡sƒƒ˜¤#‘@×bš¦ á÷ìý’emšS°Åð‰ hÄ\Gl06)·ñŸ\¸e»ÓÎ0v4ÅWN „ G,tIÞ›ýþ–L µŸÏ¶ú6óûñàâìiË-bû̳̙rˆ`VyfHþñ¦”–Å€fÌ+k™Þü6·c] -Mk—½IçÅìIÙ¶v/ŽÞWeªÌ¿ûÄ0e2û -Mæ‹£ž½Ð8˜ÄÑ›`…€‡fïæäò§cÙÙ…iáíý^†„‘·¯Þ"zb†#8¶¬ðßa뚺Àzù;jVeô"°´[QLâ„2ø¾¢S[::P8ì˜)•Ùv~áD0}ÓÚ-÷…Tí2Jî4÷ú±§3îÉrÍ4C&Èaœ/k ÆÝÛ”#ëŸÎã0ï.¾âuåË]˜{ÛAÚÛ€ô@ÍB=×@óâ¥ðO(Žr6¤ûf2·¿$†ÞÔamœ÷¹–“κÄfà1fq;Sçó÷•ðÂVÏï’LŒuÛú·J„&¦`çú%îÃia Làªk÷ƒ5•È¯±5óä¥EeÞgŒóŒ˜¬r^ib±Ž¶·P×פ½¦Xô¨ûÁ…="ÛjRƒ(›æåæϬ¦–µ™ý¬YÕ߉Må½CN™žÐêÄ[øôŒVk”4äàeî#T½<ÙÏ5€g:Møû^í¶ÝLuŠFA„ü`‹…ZkùŒîÙOXÚyJ?'^*E¤9ùŽF«ÛT}’¨¨ø.Ó |ºÌ,ô²‰5Á„‚®?Òü–œb~µéù¶wã9àÄ@€§ÑÈrö†ø h$0å[àزO2ôIËý&P2RÖOU\Òô”åÒ«vºjö` †D£–7veÎþÙ ¢¯ÒÂg[ÿ•ïALÀz€´6ëâÖyÎÿŽðjà† r”"*ž±úÜ…*À¸¼éšÚã^Ó_ãrkWÛücT…Î…#‡<âre²œô76µo Ñ\ø­ÓŠZùy‰Ø´õ­9rU[ãÛô@0VÓÜàÞöVÍÇo?ïƒå=Ò`亪09š•[(J8'¦ˆID¨)±ÖNJWÜQçyr`íW¾]t°Dº„éã #¨  ¯CËd¤àðOk¢Bcƒïð‰ -v¸NÙÓ^‘BÃÉÛ<kèøÐþ¬=YLq‹¢èzâ|R«%銶ßMX¬*tNº¼uö=J1E¤Â¸°¤EMF„òüd%xYAjªPê4æÍo^'[S<†Î ›85Ux¡³‚¯Á€5XFGFêñ;W :J.ʇó¦æ›×¶EëJ9—}í-»=*FÀvp©¹áyŠ`Î7‡3þz£®Ñ*bNEÕtËZÇù÷Çj6L¸}‡¯(šå½¾ÁL/+=‹8]Š’ƒ>…X¦NTüæèI•óp/\CÕÃNßHÞœ_:öðÚ¡‰Ô:¶õ¹Ùd… ñÓ˜mlk“»Ýâû†4äqàŽ îî™Í.Ø͘qôãyu†è¸RS+’l / SU/ ÒÑVc/G¿xÂ÷ÍLÙ‘Ýžp¯ê®»{™a?Ú¸x{ äõŠ;”ü¨¢sÖT"&ÿd‡“Šç9€ï°ŠøZR£Iû³¢6¢–›˜S¤?NÜÏŒ+š ÔSúo仸aÈÞ5E?áoñ»g×g ‹eî¤O gì®w9ÁOÜ°tháy•G\áéÁ?ßËœ`&1>Cg hñõ!{Û×亟kÎo—ƒåYIln/„Å6›Þ è ¾Ñ懑°YÍÁô¨€£àÒg(Š!Xçèéý¸h»’[ê”òKµ-ªÖòn%È‹îËÅ4c³Ç7(ì‘0¿ÿMšŒa” çÉFó°xó"‘ÄßqÏÎFÿmÉŠþ$ÊÀö=$vË÷&K C½ñ¤¬$4 áø>°c·{/ßÉ,7^âvR˜îQÇB ó·³z¾¸ Gè Á¾Ñf-ü'\7žʇ[v›¥SÍ~ -¨ ïcY+¨ŠµÁtß[ÚV)$“(jÚõÍÚI.ú Â&AóÚôÈXL»|¥:0{~­HÙ-›6$ÇL˜êGÒ3Œº_Èè=¿ÊÞ‹tsfâ;%¬ú| -S ^¼´uDfV€ ’a¿8í:¬ÇíÀ76ú~{ʆzÍžnç óâ0£ß#H¡€ÃhÈíj²‚8.2›2¶r…Ÿdœ ¢¼K»d•øjh”fI3dPà×ÙE‹óÐó¸ìáyS¸¬â—؆_u0vÌ™R_„»XFuµV”†B“¾¦1Íd—‡Ê—Œ‰óŒØõgÒc—ý\ŸI豯éª@Ö²c½¦‹zr‘ÞñÜ.XÜQ7GgMØn@¼b#ݼ*$PAªŒv-–¸QÍDS¶S;ñ0?ÚïBe‰" ¥¯™{ÏÇã¡ïû0Á©äWC==×R"Ã,ܱû ¾½ñ¿(}Û¿ÁnÑõz-¶B6r”ý1â -í;þÚ¨€Öbƒ™[;izx*'?÷‡¾ñ̆à·3¿¡›ã†¡â@hÊ.|gVAs0ö pp<¢NX ãŠ3™ÛÁœ{ÈY¬ö£ì¶ù«ïìPöÌë¥ÓL±.ý{›¬Ç3®p@²£ò¸þ4]<ÅB¦Ð­õ?¿ŠºÖËl| à4!N¢=¶ÏŽmꀟîw¦N—P .†+agž%­’ ú6üä÷=v»e‘#Í…LºG’ò,Qït>É`¯Hl=Ãhi&¬8䞟Y"[MÚ¥¿ŒÃùìšñŸª§Ï)Š Áغ”bX3an«U/–<DÓC‡QpŸñ}’©òPØ–Z*+Î þ`åùmUÜ}n‡å!Jo±ýú³Q«ÎpÓÇ©O×ñ—©‚caÆsçÈ ·\}1‡ReEb™m9U{¶Œ8YÞ{,wËç{ ØÐ@µ•@€Í |«à'v팧>3™¬:Go‰ 3C©4t*>²AZ¨ãt+\-h@j¬“Så–\oÐa­÷M½Ó?£–.eWÈà9îeVJù³ÖPàu¼ ë§¥¬ßî©ÇŽÔœ(ä4 ´Ü¥`¸óŠ¼¯äd5¥©ö¯“Ǫ,1¦=¦P¬Ìfõ˜ì UñQØVc^j5ëÔIR©mgkegjÕÒBβ*sû¶ß³[Lü_Õª†'cÀõ~“*ó'ayŒÉŒÇ+ñ½ül{âw¢"çÈ鋦±…*±u;]¼Á¾ß°´™šä¥µø>Oç´éØPÔNÃ\‡¥Ó9›œC?¢ Ü”,ü¶‹`Ï~b‘qØkâ{5àJeŸhÐúò1¸'¨& %1„ÿ|’ÜÌ䩆Ԕ´oçÃfmªÚñ”«LmO•-›T¤:)ï@ MæôÔAáÇ{'iI¿à¶_|ÍÓ¿è‘Qq¾ô}yóqOf3Rô¾;¬þjƒr 8H™SI—Jq#½Ü Í£‚í§r †…zNœ­,7l³A=‹T쑇¬eBÄX$æTðÈÃN×Ç«É/¬êÿ•,¨§ÃgÔ;Ž'UçÉ žbѳ iʽEâëƒ"=»Êç00·ññ’pÐŽ"Kö>­ ®§RË·âb¾¯÷‚Ê‹w[æJý¶mm -¡sf·º¿ª—Kò9Gù‡ª»ïÐ -´N*¶2ëzþTã³cdJh­U¸pqÜÝùè°^9vþËpf²É­<&? vŒà’©„; v©”„SK!6#'ðšû?Ë'mçwzÉÂä2R×κÜK\‡~*]Nx¼;`´ë×9®)¯çþ”GÞ¹¡.aÐK+®%Ï™Štšeè˜ÆôPaèeö¯€yÎÔÐõÓ‹ÄÆ}¨I;;)s$%ìt,Ú'ƒG'ŠN<=«(6`b3ýõ0Q«1}iK‹ÓyU©Üç\_÷hÉ ã—tÍ2K™µç¥8¯¤‹À:·üíhè?!v×$6E -æ` -ËÀ‰GøÛÈkdìkÞ÷OŸÀ8‰^zúe_?œZZã“{\Å-3?Ͼ,3•“˜¯ÌKwvèJ’6ÔYàUü¡è"Ök›By1‰ÔZPgƒ.¥F1ÒàQž -#çoð.ƒL™,ÂÛh«FÀ*±4;ÐúêÓ>‘+NœZÊèc|û>jô¢Ç¦&0nJr¸¸ú ‹€ˆýlÕÙC.·}ƒÝÓì Î''ר»"eLœ#=(©QÍÁ|Ÿ†«Ë•ÖÒ|ø«Uþõ©ºÚo{ e8Ñ" §íbR?»zq±t܇gþ­£¢§ƒ]ñ·€‘ðæ~ü Šá¡,$²j°Ô^\ Ê‹óíââ½bñljô_Íwi‘:˜(k‹Ze˜ÍÙ[LŸ¶Ð°3j˜#(\hg("öÊæÌGð&EÍÂÑää~ÿ訚¤ªH˜XÞ$·1Œn)ò<1B;f×æ.èØ!­¯ >kŽSÅë ¿1BJrø]žEß †7ôû÷šßåÁ¶€x§#䫦wr¦4‚¦Œ\fi:ø[rú ûÂ.ÄÛ—9/ìéòì47"Ëpd4„†“¼=ÏÇ„„ -·:½ JÈÞ>…ý|1^ÝÔà¼#¥gn #ÊNÖÝ7\xyõw•EØã=ñ#Ý|Áò-ˆ·ØÛBGSqV°'îíÖ|ya`æ›b7¹VV°w«ÏþaÎteâô°4)H·¼º‚°/­þš63.¡>…—±:KwŒL½${6cZ^²œ¿2Î^–²|Ñüa¢£Ï†yoè|Î6>&wXº&TaùîxpO°.äoãw^ÏfÕcÊ> GfOè÷û×d õò„;ž’§!ìó"ǤԪ÷¹Ë -‹æøÇ¥iæûdÉ#ôOÊ‚Lï4ùŒj•IŒ‘HÕïÖ­Bé­¼*©_ÕIßé`>w8L(à åiÌó¨D(®9ÄCe}E2UÊŠÇZÅs®mp6Ñ—DC©R¬kkÁ-½] „N— e•"7¬=¯’Xnwsr¥µ&¹iÜß›g"HËPèø±«|³W­3C­•îqœ')†ݧVÁR8dQv×ù¬ÝŸ¸žLKsä^80ÎÖÊúéÇk‰5ß¼¢ïNAŒnC“sÅa íPÒÍJ i²¤{¬›ë•E)ŸN -9¯©G›¦B’æû¡WhÍèÖ‡–6ä㤲èÕGö—ôn&ÙGe¾"·“¬%•sR¢YqŒÜìÅÁų>¸ì¹dvÓ.ÀÐ qÚ1þ‰ò¼ÈZ¾õ`mƒŽ.N¶/WüÆ<„×óuFèË Ø®R~åSŸõ»Ô?ÜâÜ:X˜µÞléÞÚEÑ kQ“êõPOó[í!y›P~ל̅™f–<ùHnWN¬ºãØ,µX[ ~Vu¹m}0¶ÈÙ,ÝuWåTh×­˜¨ÂWC¨iY6ÖL±­'#9·¨@ý²Œœ§–Š*ÊÒþ©‚´Ftº¦;Bš«x®%˜Ø Ü.¢©² AúHN[i«G¥8FíÀ CžY,ðj1"h¶®`â™î±Ô ×}ºœH1нò*aD:gMɧ8-NlX² ©ƒÜ£3%»Fé/ߤüÅØvbçšçÂPOåºá,ì/•µÐ¤iOP¨8vtØX˜–á–o ¨E;=‹*3Ø’€ÌU¿2=ÖÃê?³£ÍnŸ΀x¼ï›=y×UáYiYhMî<ôui8<.Ƚñö¹tŠfví €h×??Î5_÷Üfu3LÿƒïÄë>š4-Þ|þ¨P¶w†ùàUbpÔÖÕž|·ß]ÉMž.~;Ũ£ÏO¿ñR›[îÆtÀËÅVô²³C9ì`G(å}àë·›Æãp -ëá˜ÝO±&Q.R†39&dÚw-©÷~Õªãz^p§ÙŒø¹GèÂyV­¢Åfá>Ç]íL€a}q -˜l°àh“ß?pþÔƒò²‡2’Üú…½ß¢áÇ/Z—ÍÂk“˜ìó^Ø1Íuß¿qç½ ¥öÉ>J•ñÜzûê“rüŽs‘þq«£$ÍKXÞîñ›Úæ¡°n¼‰ùJzï¾"|‡\tó•çãozXÔ±Ú–²‚K]*ɽÞVÍ#_yETð“Úö±ì¬´M^ï iDZ܀Jh((Ï“¿¤?@XBm R3{+‰Lê‹÷ÿ.K ø—9üëNˆþÝ‚Hrgh[0’ðÕa¼n¤^o•ƒÐ -°*¿"lðØ[òD.þÚ§[ŽôcÆò ~ñòýè\úuu}3Z÷ƣ]¡$þÌXÛŠã™%«R°“RA‰ÔøþùêA7Þ^Žû—E”ºœ‚Äâº:L–TÛø—ëK6½ÞT2ÕŽoY}V1r4?­æOEj¦ð‰ÉnC\ÔkƲó§2Ï’ˆw•°yÒb±!)3¢ž®ž¢¿²o:¡7™–s¸:/.ÒCj‰'¡šHj±w3GqÏaI¼Ã“QçgÚEW¯$(o­4&B‡NÓù0µÍÔ×Ȳ¸3‰;¦×碚RRšdlˆ,/™™i×&Cµó³âfVCØ=EyŸùƒ:ßÆÛ ¸so ë FsS:=X3º‚Ì?Kß³RØ}×ý´ßóÈŠlñó|´WÎ;°]JâÜMcÞ…] c0hUì€é²ZßûtÅÁÚ+'[ãðJùv¦ý]®J@´Ä$oÛ„´Ñ¼4¶ä¼Ïf½zÔé¬ÍüaßMZFÊyÕ¨ ÛD»àÛJŸTZ÷®dØLbÐP•@ß´g´DåéBëxÂù“!†#E7ôNPx£K?Oó:€r¿W>šÁvt'ÑÊ/Áe•Ä‘+¤Ü¯ÉªŽZ !pù!eqľHµÙæQ/^–Q´+Ø3}+d2l¦Ä,[x‹2ݹGW·•×Ï÷'fégzõà:½‘gŠZ€ûV -ÖæDKéÇÍäS°›˜a^#â ;E–*`Ä+º]lþe?®i0H-® îkÓÈê‰mÔ6ˆæ¿,ÖÎPXžjD"¿Ì¶âJ/(h÷$^ë™=ð‹ qÅzó:ø+œgïVÑïò¥@£Éž[H¸‰ÄKÊJëðuˆkº|ré2Á}ž ¯BšÇJ¾N4ÑŠ™Fyú‰3 Ä(V_»hÖ”‚öø² $?-Š7™ñÒ"5¾ç§™Ñm•Ãvê¶ëø b]þÖ?rûq‰‚óqð'†>ü„1.mÒ–ÂÓI˜U2«)б—™æt“еé'X´Øn!ÁÝùÅóÙJlÆn¤\wS5¶Ã®c4>G”ûÐ~íØOsä‹Rhç÷z .³Ñ?„¹YG¸ƒýfX{ö®“É Èì‘…Ôæ›|EžeŽµ¿1ŸÎLBy—¹òQ,¤¿o&iÏ H˜taò¾õ®†˜ëÆzë±áðkYb gZ7ù>>¬LÒ'hK¨ÍÒ50ö/£EÏ|øꕆÅÅwÝQ=HèF´+²†xµ?jãŸã×±°¯ÐÄsó؆ )n/nþy§9-°¶iJíc{~XábQ-Æ @ïÞÍû nΨoÉÄþƒâÆ>tºá…7«ìwü’yúqYƒù€dw4 Ö¢F±(ëï4oòbÅòÐ>ÉRÍo¢f`_¡õò9Žo™µ}|j¡ƒ÷Š ¶Eèû{kjö_ƒé)hJ̇E§¸ÿzXQfŸyòÿñ½ôr :iž" P>æ«Ž.Á[D,M^ûa=’·Z©NçÚ„-ï2€N!'Á2ÈÕ4-8}|Ƹl[CÆwÂrçÆi®GåáÈÀàÙ¿Ò†L !p'|E·wàÇÀM™euüþ=åãutQV!¼‡ ô…ÏÏÏ×px¸ŸR }dÐÚj2ÇÒç®t¿‡Xªa Æ5xÆ3óc0Nà÷fO×1>vòÙuØøyÀߘ7ˆJÚ¯‚ݺºbâÄ6~˜þÅvqµwjÐ4YÓˆÓVŠaËD=^5Éy³ÚSŸJJ×)!6œý~Â¥ç -çmz³àÿé¥ûì#ÄÁ±E÷:BAË=âP‰ƒûीßh;ÉïÍ'ÔÆŒø¥ûgllË%!Âé…gsvŒHAû·yăv¹ŸëGz$õ[ž ¡À"rû>Ò›Ùf²Ò½;‘hKŽ˜·F›òûOõ$+§4ŠVch˜A fÓâݧ¾rA¡DÔG>܇:ˆ©­ìáìÊ–F\Øc|Sž¦Ýʯh>ÒWr^2yDód8 ¯–$—?¡”áqßGm´ „ïl‹¿ÑåíþæÁ¼„a;¯aÈÇÐڤȵ•ç¶z¹p/ö56PxÆØÒÈaŸ¼”ͪ 5TåZnÁË»¬ÂNCÜ2Ãaô"Á‡~3õ;&-¨¥4e`<ÃöèÞ˜—N¤.Å_Îå½ÊÇ´nç!§rÆf­Då8QÀx¡Å%z…v.s£„øäÐ÷’×VIü(‚-€_hßÄÖÃËÉdÔÍ'¨É†hƧÛ5R»ôSDWé>^æPÉÙçÀí9¡Y ª ü"ÔoØäÚŽ ÐèJ# Š^ÿ‚¸ÞÚ¾¹v ZO~²3|Ñ¢P6‹`+§-ã+æh}+<ô.®ñ5®ª¥Ý*Î![÷ENšß?®æ·Û¯Ïuˆ¹ŸVŸïa=t©˜uÐßËʃ™õZ‘7—Cª3¢GP,eÑ?G­Ä/r7%çk³ Sc#c™=Ú0šÓ?A6ÂR—™ìMÞ»™Ew/øž,¿ÕÆ»±ôl£é›Æ7|)“ù†€QŽŸoÄ›-:GíuÛí9¾= u!“}¶~kuã¡ðV»:i"-ê§òÁÊÈJ˜Õf… ï—­m°ÇAýLÒgê#*ì‡ñ*1.`õ]¼±¢V¥ˆÂ!&¶¡³Å““= ÚLãÃd4Pp3mæºCkõF>.KÒ»åÐ<4wA40(–­Æd”ÖQëô\çu¾¼§lȉ¬³´rÌóî ŽN£Á8Ô £náô“ˆ‰±eqžt6éÇà³ô_›J‚;’|Àê^Á¾¤m‡–Ù_ì`¤0ޖ宼Å+yÖÇhÕV8ytÝ7ü‡5­—2>Jk/8:]Éf°w{dgƒÑ¯Ì9ÖÈv«<·å<­ã‡sQK¿ˆ%’q—‹‘ú5?³´è>ÉzJR¯fx£SÊ7bÁXÖµç'Ý­Þ$²Üo‹Mà\½æŠÎÉw2ïœM§Ð)li¨˜5ÜwÔÃï®z`¶»‰DËû|Ô¦PïBÂö…µ£‘Îêlƒî¼×ÂK'ùΧµµE“»ÝSg”{ÞE]óεûä½34T²ÙEäE7”Å/Â’Ì«,“=Ú‚°™£$‹ŒÉjCš„E­çMî/©?¤JJÅ–,YÓ²Xº@/¢Ñ‹²¬—@“gö% =­ªíÞœ¨É8ª)"WøzÑôªÆb§ -' ¿Iv šãù ä%P’Ÿº¡,¹wWD¢DjÅ¡¡!¨¼éJ"ëÔŠÇ£°Ç*ô}’öU§òxî§ ™Ì³ ãÞù’Ú«Ä: %}Œ#E}T`þŽ×e\xŸ>Œd¹Lm¬ÀE\Á=õ IjÙ¼¥Æ©ž…ÒßžÆHfKpTœË@à§s;8¤™À³BÈíä]õMÕÖŽ¬“ Zë¦üÒôDv?+ËpàìÒúÞ -‘¸·ÀÕïkÂ7ÖêU×Ö -š-yríL~s‚5Üó×a= „UÒ¡¼†V§Ò§Ñ‰NŽÏÜLþÃ>U‹>kÊ(K™ïôŸ‘×'8ƒ¥OnBõß©¦‰ÙäX~0äå¶îø‰wW÷fð*"œhsÌ“dlQøÓº3Ûn× ÞX ñ*tµ14Ñ=ÕYy3ÒêçÞ ”ˆøË£s'}Óorß÷ò\m,ZzÊ×Eu‘Û0±Zb³Ë6³ “ë£;ˆ˜…›T¢:•+ËWØHENô×%÷aÁ6å†%R5Qëï!Œ-ÍYhMظ»@K :€æ{ËE—µH²ˆVUÇv»\’?áIeiŽx¬í÷Œ´Ëä=½ßÓFö×pæ©=,v¥P=ù¡S‹15E¯iéÄöuôèü¿çΫ* ÔUW¦Ì«rÜ¥í¤ÎiÂ}"?¥A’Á2’’ÉÚ!t|ir§x´9$•¢_¡¥°Ê‰7fÁÎ:†!S~‘A°º¦v’'šZøžR”¡~üYÞÝ™)ünx`:&‹îcïôá-x­:J¯‚Ý“Ý -%!¨†ÜdƒCî6ÔåÖï3 ÝŸÌ äÅû.;)\g%Ö—nκNL2§¥[©vûxãÅõíÔ)u˜ö¾ ¹£{Üè0:ø›)·éÏûuÄ¥n¯˜Ö¶ªÜ9GÌØ&©p™ÍOgã9úÐv¾¸ŠQDó lܧ9z?qV§§yA˜ôI£Æ -ÉñæË ô­{FšgÑúÁsáfÏ¢eJ>FÙSÌti›v" þL†ô#ç³.ïø %Þmüªh~ň­F1åVç£ÚššfˆS®hï~P ‡k -šÎ`õŠ\P£RÎPU tQh¼i=é 6iHo+·ÛÇ䶆ü,—:`åDP§¡Á'vxæ>¿csè9Œ~j Œôëèå‚’Ìb9|ÆUîŽ&`%6Ò8B,Ý~6£.+]¯*:v®¹n1$˜$Õçà…¹cÝŒåþ'¦!°SAèi:Ê<ÿSð2w «ÀÒKÞÞi.v#£8Q÷Œ²KZ9ÓÒúëfƒ¦ òíyv瘺½ë0köBñ)Ò9øдŸŒ¼} ;šÕͽz8ãÆG(ÔÞõÞéGýòwA£ƒ³W˜†»  –•¡^ñh óñ)©t!®{+ôz3hI”±ƒ,A¥vòâ!&¸aÚñ8ÓÂ]}۠¦ñƒØäŸ|!ƒG©9±¯ƒ¡%Ø™¤a¾´´¬¡X™šói;§XþžEtÄYÁ tiOgãÊAÈo ûÄñ #ø€ç3ÆÙÖd2oïˬa£gµl 2Žùö—£·Eɾ´†œ›zì9Jéa’¨H‡¬z;¤iû”Jñ‰Ë4f^zÁ˜a°«¹N‡ò–µÌ³áÓ¹dÙØß~¥7zSч˜Š[@D¶èÒ–ö¯Z8^’?Y”d5@^ëáÙ²õè0Ԋ׿_)†vø"À’÷D&ª?ßdžáb@eO{º¹MÉÇV ‹––=žÒãA„|ƒìë0Ç2 —k{;Ði¡Òn¸^Çßhç 0éCs ­gBä§ßàŽv†¸¯—¼´xôòæ -ç„“ûþ8ç<@áÞ«íQ´ °Ë78Úô¤ÏÕzMýmaYB<Æå ÇaÕJ1ÙµúøVTN=ñQ§{By‘ïçUïCÕi/Ê&êņÁIÅkY”.Wîu¦ßwF0 ëÍ&Iéqq¬Œ®Ë/Í)÷¯@Ý)Ü®«QVë{¾^”€WpKjµÁa™6ŒLœñªÆ­HW“ÊpçËvLxGüq'0€Œ”TmC`”dÈ<}é%'‡Ô¨êë6~AÕY!X49S e¶ò>š Ãj;ãg„Ú1Ý“*`Ôä"³‡@zð믣™ëæ¿(YL3á&ÉW¾Þ¹¨5Ù:9½wˬŒ~ Sš|˃óo›õ³NÑ×£Ö¬ <'í*1¶.¯çIÖ:ïŠRþú9÷üý‚€_®%t$nÍÃÌ?iæ¹i1]ñ:ªÔ«ü^nôY‚NHbÌÙxL9"T<74 -JÂpcI¼hÙÈJ›¡¨œï)õ¿ü¼¨Uôxª4% ï­Î«¯ÖG¡4Ö÷ƒ#óª ¬êHs®hg|Þ¢pˆœp…ÌØ…úVðë«è’ý6J·öí`_Ì2µ»sTTÖê¥4šÕ—Å ¦µ(®°Ô -šŽúqi¡ì( JÉvWà·Í9W_! F?5•z -!.‰©|°¤2Á@R%ÏK¡ÏÓ…M¨4øTkÏô|LÐèþS–ÁB›G~˜”aÅœò>0Õ—;«ò¯lr–h,Ç Š=ÄÔÚ—Æ™I¸Ô;·ßz..qRâ_ËP ÖuVî-Ày¦E£I”|ÃhÎEd-Ô«æ(›€v?ä7œWñʶ3¾Iy{Ï-*Ѫ™+ÆgÍôÔ£SåäjŇ*^åuüŸá`yÊ Ò‡¾Óî„°åW'o ›ºªf쳡oåQ9IqmkµJðhÔ›.Ÿ"¿£<†7YÖ€×A»-VLÐå9’] 3‰}‘“]øÂuÅQÝ9+‡»-$®f `¤‡â·¿mZì·Ó©:à4žkë<ƒAnÄÇ®¢8±‘Ÿ–Cú—× -ÃTåÏÄœŸÜK¦V·,&~ö›¯º@Eú½Ýs¹¥¤j>³IE’—OS]ω‹p™üà\BÀN*6èîÝÏ¿›ó${ƒÇ%8ïF6àð-%éĈ@Ñè½£^+ýO#¶ -ì¡0Vüqj‰ÍË/>®ãÕm»¶´>Ø冔Ì{”øÒ¹°µ{¯èÿHÂg"X{à%w#$Q6Œ@îx! ²ž~ìÃx^Å—s$àaûtL1áÈÁéœgìhèp;}*øXkÔvÐ|¿r„©eõH¹·{üB@ÞTü3a…Š8l4rhÁ­ch7E1ÚÈH½Z‚Û¥'„[ûuÛ-BßT˜UÛ‚1Æ(H´ó–ú Á•„„§ñöw¾ÿÅP ¶¥–B:r†[S›Ñ…ñá%ôÅ¥—KUÉ•Å)%¢[gnp#¿ V=„iÑÆ—0eðôÖ†,WÛ|²H(,€pØ\XXžj }쫸îuxõçP7¡É—±¯•&kܧuGÎ~ * ²ë°%–æ¨y ¨nË‘/?íÕ_o^ß$û"3›…˽—²{µÒµ'fŽÏÖiœýmÀ¶«Èú»©9÷Á•y@†§<Ï3ü"7&` ‘Ÿ?IÖ«™V4Ý·F~0^Õ(w•²-5’'f&-îõ;À$þð@Sy]Ùðã¿ þ|È?¤¸òÃÙaµØ&1ÇÇ›Ç ~ò"ÓV­Þf÷BKmù~PëÄ ÏI: • ÏTõÏ ìiòÎtÚ^Ä%wì&¶!ß8ˆgv`«UGlsîo"÷½‡›¾ØþnƒËìºEÓt ~ÇŽ<ퟵ¦ñbÿJ¦Ƙ -}•{‹\€·ýÜÚx>-×|hfVÉèÏgsÅ¡n Ÿ«ëÊ„ºø{#2U °µžgí–X±ƒÒ9j PV4L4ƒžümÜCBà“\†¾ªqm` ÆùÄ…LÞ>%J -Œ´Œ-¢ŠÚ$.adSüT|×b+H8$ ª›°¡½pöÝylúˆ´)›ÀË° ×.wæÎ…%÷"ƒ“%[Vâù¬Õåü‹§ât›S¹´æÈÚhE£Â>¨ÛDkükU™¯*tÊʉé,"ðòÂ;g«bЇVcwgPÁÏ¡ 0•nVû]S(K0ÕIÍ´\ø» ¨ASXÝF4ø¼‰$5¨ß¸Ñª¼)—™HÝ/ DÜÈ3¸¼$/ýþ¾©ŒÒJç—êki\ÌÅcöž©~ó$¬·¥—¦ì¸“um[Æ´nŒhÑj½‘âÙÄ”Û4ö]7Ĭ×G¦ ß© ;gÏúQÁ÷¸P1oÞÕMÄPÊËü;ÞŒlô<…²tOþŽüü_Xü5L !ê&wä_«åxoendstream -endobj -1628 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 3743 0 R -/FirstChar 11 -/LastChar 126 -/Widths 3757 0 R -/BaseFont /XPRUDN+CMR10 -/FontDescriptor 1626 0 R +1839 0 obj << +/Title 1840 0 R +/A 1837 0 R +/Parent 1835 0 R +/Next 1843 0 R >> endobj -1626 0 obj << -/Ascent 694 -/CapHeight 683 -/Descent -194 -/FontName /XPRUDN+CMR10 -/ItalicAngle 0 -/StemV 69 -/XHeight 431 -/FontBBox [-251 -250 1009 969] -/Flags 4 -/CharSet (/ff/fi/fl/ffi/exclam/quotedblright/numbersign/dollar/percent/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/equal/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/bracketright/circumflex/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/endash/emdash/tilde) -/FontFile 1627 0 R +1835 0 obj << +/Title 1836 0 R +/A 1833 0 R +/Parent 1327 0 R +/Prev 1831 0 R +/Next 1851 0 R +/First 1839 0 R +/Last 1847 0 R +/Count -3 >> endobj -3757 0 obj -[583 556 556 833 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 500 833 500 833 778 278 389 389 500 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 278 0 778 0 472 778 750 708 722 764 681 653 785 750 361 514 778 625 917 750 778 681 778 736 556 722 750 750 1028 750 750 611 278 0 278 500 0 278 500 556 444 556 444 306 500 556 278 306 528 278 833 556 500 556 528 392 394 389 556 528 722 528 528 444 500 1000 0 500 ] -endobj -1619 0 obj << -/Length1 988 -/Length2 3734 -/Length3 532 -/Length 4423 -/Filter /FlateDecode ->> -stream -xÚí–y<”ý×Çí[Ù·²uÉ13ÖHËز“-kŒ™ÁˆÆ`FȾgÉ’,!„PÈÒ "†²d ÙoeßoÙ’øMÝÏ]¿çþýù<=¯çºþ¹Þçœï9Ÿïùžëz]bÂ&f2PÆ ©Aãd ²U@ÃÐ"@dÁLbbX$ ‡Â 5a8¤*QQP@ @”Tå/¨‚™Ä Œ'‹rqÅ’ç~)P$‡¡CÎéA·¹f8 -‰#ÈPwwÀôÇ -oÀéÄú"²L€@Áq€Ò…fý¤‹vÆÊ™>ž»|‘Xo²(@’,ò@–ˆÀ Ý éÌ2Âk!ÉJþ7Dý3¹¶»»ÌãGúMú7ÌåNø¯Œ‡§‰ 1$ýÏÐÈ¿´"(zuq0wŠvqGà¿L(om‰0Aá஀3ÌÝùÓŽD#þ)‚Ü·Ÿ@P=Cé¿Îó§Ï†BãÌ ž¿²þþÉßLî…lÁ²`0„H¾ÿ~²ÿG--4ƒ@¡É¡¨À°X‰<dRnCÄH~ëO+Õùü1*t/­ÈC8Êš‘èÏ“oåiÒÚÁo¤aѨ¼e1\­ü>}ËÜe5ÿ!kÞa;É55»›°µÿôÆÐ^‘Ô{sÍ>ã1=0+½§×{hØaÏæ ÑÙûꩆOk,ð6·ß› î«—BÕ‡¯Ya9Ç•8ÌF¿þh²êôÓhRP×,“Bšà„¢k‰Á;¯â*>6U>O“ïW÷’®¸ p -ž ¸¦—d‰ÎŽž¿‰’kˆ*VŠ\®¤L‰Ù7äÎ`lËò¯¥ÊV³W2¿Þiê¶?ù¶ÊgAê–+ñ,nŒÊ`Ø£BĨôŽA«M¨T­åçÖªiëµAë ç¸ª¬nu¾ôËÜG´«O¾®÷lW{™°l²˜øÎõv3q¯÷¯([ˆ¡ú{4‹¼!Æ_ß Oß ™m 8SN¥'Ú17¡}ð7†¾o)!X³bªtJõîç}Í—œšT2Ÿï~7î¿ÚqŽdE¥èÀ­*Þýv°?ÜÊg\;ÆßÉÆ-L©¿ññöÜ>Rä½EºÞòx×ÎQ[ÒqÒa†Žñy­¥à `Í|Ìs’]`8Þî:{›jH¸yhµÏŽúÔ{æ §C<›ŸÏÍs+ü©œ²ÓaôÉ™¡sÐ]‘î§ß*C¼+Õï¶û±³eµøª¢Ù¬KyRΦ‹¶{=è¡PÛp=›VÞäªÚC+u…ãOu»Ô³×Ô2•,%ÀÏXfpg{„´µë¨ŽÃ–Ì$’¶~6: -ø2ìÅÐÖ~õî éés˜ª'š‹ïP¼ç$ÒLìI—ÌF5½¦ãºÚˆôí¦‹Ë‡ƒ ª({îÀüµ¨¯l_2yÜ {'7ÞŒ Š -¤ mÏÙ?+yDTZ.UjûZ51“ò‡Õð!Œþ“i‡ÅXwœçwõDÞë³t5ƤrœGØ©ÖKëé¾´-{WšxÒÔ›õýÝ`-ê9Œß0ýSÞ ŠÁìCð6çƒ9ûWõTg­wHYWj%w=j²µ–Ú §®NnJmöÕé}úóä'CíóuÀù¨cp2Çé]_GÚðÉ~æom®lüùÞ›íy(ZDõn@1ÛN®X›¹sOz€Gðn ètr„Î}!Ffæs‘&̪1r©LcÅÁ#`\19í:Ä«¬Òùy/Qo^¡mòÒ°ò4ì(ÐàhË·îæIãæPO~†¬ÃúPÄÓ9›·ŸéÏúê)É•|²(#&º- ôK@*–µsF¯¶«fjük75s¼”¡•ÙQãüRGßGM”Í‘¬ Ë"Û—ÚºßÖ#ý=(²åã -©G&eþl¸ÕŸÍÛPPL0*üè4$q«º†Ú0Jœ7}c¬ÜÃ’LÜצ*sqØ4Nàœò¶fàɧ¹ïÆ=„’vÎÝŸËÖ\çQ$Ø%¼û¦ïµ ®*¸æÚ´<ï¥ÆëÁrÃH+øR…[[ý:k™Vg€IºcÑâ†ý}(Åõ´£ÆU.ÝkÛMyþ öÅJÉL©#g—¼&ëW¯¼ò…äžìqùyq¥útÊåèÛFª“$ Y6Ô†RŒRlLïJ¯´½«P­‹–W5û²ÇOÊòs¹0NÒ›¦¤ÕâŒ^I•™^y#Óçù6°üãòe:Áû¡y¾·N©Evò+^•aÔ³[vÜóIGcÂ"I­H ·Œ P=' BcÅ» V S -žuÂdãõŽºØ«£y™eŠ;B>ëZ»,1ð{¶m^¬F-…èYj´"eŸ¢>G‹çå/ri|Éæoƒ"ÖõL3´òÞK©‰ „ÖËñ·éÍNTMQBp—ÁæáOúS–4G¥Më½k´‘5³Z®³p‹ˆkößÓ ›¾‘¬™f‰-Æ(Øs·ê§â&ü×ége¤éJö™ö]—Oèú}{=Sô9*'*eÝ:a$½©”ß¿Áü.ÆšØG[˵ûT&pM˜.¸ÿ£OUB”ll¯X~´šv²O8ŸKã<}äÜy­Ò–¼o¦4°cÎl.ebò]¯9h’œ¿°?í8Þ‡’¦ÍSû~#ŠVk9•á ߆«ãt]pUãñ“Ûtw‹¾;>D ºõ“À’¹ƔaÃÛLÅ3r¡Çån]’Õ¯{¢-Ñ–Û••œµmj|Ö†]Ÿõ[nÇѹãc\p@_8¢/«ÿ™cðx6êZO[uÙÙÉ·/gEÞ+¹œ cÞàHÃ?XúŽˆlêƵ3…ND*ÓçÙ™¼w¤‡M¹„좹Ln‚7á›^™>±T‚/ ¬yQÒm½Âlß“št{C§‹ª»%ÆL^å³”ï$ëå®j†½É¯ï|*YWüÛ›|ƒ¢&½gÃã|úDú5Žyb¼’c‚Êó¸Ê~Â[ŒkÖòîÅΊÖ‚w*cGM“Ì..s!·lx›?8C{ ÒÅØ<üõ¹N,½‘š!~¸e–Tñ¢k¾£V‹Vv´dÁIL9.Æ.8W™96FS—¬R¨Xš´Îr]‰p{MÔÂ|]^_x"‚‰zLóZ`ZŸâÌh‰áÙU@€ãÑ€¡·UŠßŠRóèáþÁ›5ܤŠdàìý—$AgÎÂ1ŠáG5çÔÏ°u« ê=¼X€Kk>xí­‘CñxvGöˆ˜IpòI§¿Å“Í:'LØÖ˜ñq;Ý•jÝQ. RÐë”õiËɨ³nA¡ËX6ç„+˜9†ñܵ®µËŸ×aƒéCh5Ôt -®\Áfõr™iæŠßf {$rJjZʆ² غo~u=MxY5õ¬ÏrùòÌú?´4»á©b)—”Ÿ8ÉJäîÀEª3WÑìË_6Þ ˆÛ6¡;â¦áTNS -ø*z1ì¢8;µsWÀ©'&c°–ú¤”Öwg¡3ïð¹õšŒ6‡p–“‘—×˹#} -ܶ’Žž KÃÞ´iXì}6IJH±ú}Õ¬Hà<ÞšÂ?ÎÜe¼‡Î<±éÃÁI÷­h‹Æ…ÄÁ¾¨ÓÝwBOø80JUGv_È.ÿ«2"6p?îs4‰‡pC;cH4ùö]ã[Éf£d1Ëݲ-¾W…SÇ¢<{™*¦»HÿÇ®ÑYlðï%„ÝFݶÆ9›ˆå‰*ò'÷NüÓCÁøâÞ–/Ò6*mîŠQ ÚÔ4¾^±uSpÖ B@>–Vóêb^oà”&Ÿæ…ÛMz–%©]?˯ G2ÁõƼ} ìññ/ÞvqxSSˆ\Xf—4J%I‡^õêha§ã -<ܤÜ7òÎ,o6É8Ü輊ÿ&Où€ò­D“÷5CŽIŸðÿðbúÿÿ'ÀÝ‘0,ãÃÞbúOsïendstream -endobj -1620 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 3743 0 R -/FirstChar 36 -/LastChar 121 -/Widths 3758 0 R -/BaseFont /CUAHJM+CMR12 -/FontDescriptor 1618 0 R +1831 0 obj << +/Title 1832 0 R +/A 1829 0 R +/Parent 1327 0 R +/Prev 1815 0 R +/Next 1835 0 R >> endobj -1618 0 obj << -/Ascent 694 -/CapHeight 683 -/Descent -194 -/FontName /CUAHJM+CMR12 -/ItalicAngle 0 -/StemV 65 -/XHeight 431 -/FontBBox [-34 -251 988 750] -/Flags 4 -/CharSet (/dollar/zero/one/two/three/A/B/M/S/T/a/e/m/s/t/y) -/FontFile 1619 0 R +1827 0 obj << +/Title 1828 0 R +/A 1825 0 R +/Parent 1815 0 R +/Prev 1823 0 R >> endobj -3758 0 obj -[490 0 0 0 0 0 0 0 0 0 0 0 490 490 490 490 0 0 0 0 0 0 0 0 0 0 0 0 0 734 693 0 0 0 0 0 0 0 0 0 0 897 0 0 0 0 0 544 707 0 0 0 0 0 0 0 0 0 0 0 0 490 0 0 0 435 0 0 0 0 0 0 0 816 0 0 0 0 0 386 381 0 0 0 0 517 ] -endobj -1616 0 obj << -/Length1 2015 -/Length2 12128 -/Length3 532 -/Length 13233 -/Filter /FlateDecode ->> -stream -xÚíµUX\]—h»»Sww î‚»…»»[îNp$8 î,8w8õ~Ýý‘î¾üÿ«óê†1÷ÜkŽ5—ljŠjÌbæ S 4ÈÁ•™…] ¡¤¦&®ÍÎ`gaC¢¦–pš¸Zƒ$M\v~~v€˜›%€üœG€‹S€‰ rôr¶¶´rÐIÐÿ“Ä ³:[›™8”L\­€öà1ÌLìj 3k « @ÌÎðñŸ7\.@gw 9 ;;ÀÜÚÌ` -´´v@býÇIÎÁàý°¹›ã=r:»€¥t`IzXÑä`ç0Z ±*ƒÀµ€`“ÿ?¤þçàÒnvvÊ&öÿ ÿŸ}ú_&öÖv^ÿ™²wts:”@æ@g‡ÿ™ªü=qÝÿ*$çjbgm&æ`i°ýGÈÚEÚÚhþÁÚÕÌ -`abçüWè`þ?Àû—«‚”’œ”ã¿×ô_?˜X;¸ª{9þ{àòÿÅìo î³µ'@…œþý×ÿ£œ”ƒÈÜÚ¼)¸y&ÎÎ&^HàÝ&n€;ÀÚÁè z‚YY@®àWà¦ø,@ÎHÿ,)xÕY-þûä£õr‚ÑîßÈ FðXv&öo!.«“Èhnj÷ëýï'<Vs‰ó[ˆÿ?“ÿ{&€ÕÑÄè`´ø+ÊþŸÑÿ‘ .h²·7y‹pX­¼­€o!pmGpù[ˆÀêbgâbõá°zAo°Èøoæ{¹z¼=ç¹Z9ÿÊø§] ··rÿÓ0k÷¿2Àº.à¥ü7ƒe]€î¹‚—øß¦È Vu°þ[„ïŸ9ÛÞ^â«ÜLÞÖ†‡óŸÞ]þ¹.Þ‚àjbo®$þFà*o.!ùFàNHý›xÁ}~#pi™7w@öÀrož»ü]Þì¢øF`¥7»(¿ØEåßÄvùðF`Õ7»||#°‹Ú]Ôßì¢ñF`Í7»h½ØEûÀ.:ÿ&ðmÌjêlbf týo;—Ÿóßñÿ¾wÁ— ëÛ¾åmúFà¡ÍÞxžæá?ëýþ³ïþBpAË¿`cã·ïŸ¨™›3øjrýקü ø/¶°1€@O ÒÒ<ÈL0Ô&­%¼Â_ªhò ,½ IFYèxwXS† ËѺ Ö¬sëOu Ùf¦u%Fê‰B5«¹÷/Â1ß!5Ö°EÌ!Tú‚L5ø3³#}C¨á¼Á>tûœ¨½%òÇVƳeÊë ÷nØZÅvÞB“h˜Š…ùçKÛ€‰_KÈéæ”»©HyŠŸšû‰cÇ2 "ÐRÉ0¾~æ5öËaßÚ´í*jLžô\†ð"ûªU–22Ú7*Ÿí)ͦ\åZ‡Š<€¨jÊÕâ¼äEÂæŸÄ}ä롹Ïa½5Ò“Ô¥¾s%¹cë µ·Ô¡ÜQœ aƒøö•×výÕ æ4 ô~ÓÙð-+굘ëccî…Ñb‰z,Wî¾Å¸tf¥¹3lÆm¨RϨدÔàiÇ:ÆÌ P¥Ó,uvYêr­˜(e-†è9]4ÐÌ]‰¥©J¶1}ÐpˆmÎ˸ڀ‘Ë‚BÛ¬'†LÝ;J‰)ÛquÖ(´éXäò„ýdBŒ©ò‡ ÜݧQiÖå -§ÊáŠBĽšº]u-h¼CHÊÖÉâ>tÌÙ ÀòÁ` ï[×ö³B¥1æ*ŒQ!uôŒÓ‘‘aòiž"º¼ÁT~Ï&»’O©sçp%Ÿ0Íì>"}©pʱJäø."ÄwÊ^taT ß~÷ýÇ€.$…®š,ÚêB½EÿØfe¥™jÖìS$¯¼¾ë€ýÅ3ÛP á玞Ç8UeI…z„Ënü‰éŽ§†”€Šˆ(fˆvغ¬<ªðí‡+¾ƒ{"QuYòjÁc>¢ï¬¿]PömÝDöI™W¸x¦¡ù¶Y7!âÁ eë˜c€èe­x—IA»z»êçÜ3á8kíH?%WÚ£)eÒB²x³)´ìÅó%è]n_‰ÖhmXJÕa ÷/£uÚé.[ÛÕ—Èý¤ÖL}‰#Ä•ñЄ5$‘Hu(|Þ2èqÞ÷^ݬvÒ ÖÔŒ8´Ÿà’k¼«¾’VÎ/¾)_iŽk~ñ ²Ì/˜ïð[ÙÏØ_G·çH%‹öžNW³µU˜[rõYs甃DkOÃû{ÝÕ®ºøø(¡¾ÚÒ“Vy" #Z‘0Ëè<ÌÈÉ­BÑKvnSõùYÎíJÛJmy¾= Äò݇–aýT75aÅ°©e§pàÞ~|ÏñÍcµ… wa²g¿3V’¸)úçÈ`ŸM®cMP³ŽÀ>Ù¾å7ñ5IUÏ,eHÎÁö¨$þ,~× M,¨ª((»&vêÀÙSæNÿB|4Û ØÓ)ÓO œS¸ÆÎs³Ë ù½¿%ÐVCªÆ*¯[àiïtµ\í–¥q``ö˜«ùì÷Ÿø*wéŒé¸e½Ttî0¡$>¸hŠˆ+Ž¶vñt ¸R3ê?©w™OnÉydY²‹[í÷1ªjUfÙÃ1 펡Â$¢Y`r+P£{¿C®{©‚iŒöŽpï²K6çÚÌ÷<|}+ÝR§©éãÐ"8WËXOÈJœâõ_±ž~%ˆÅ©–ÏÂ=,ÙÊk4NÉçÜ2V5ÙóaQ¡Ï¨Ê5Ðr;/ÄÔíE?æÒôüx²•q–†Ð¿Ï;]¬Þe; ö§¡¬;ö8 @ø0E}«;uƒï25íï@ÅÆ¿vÀË8¾Õ{„³1˜Ïfƒ¨tíü‚rÙ°pA– `(ž,µ)H¬8šÃ©:õa!'h)᮸÷7òýY•ÜôÉ…‰$Ò:loC#ñnÇîÀ;dCyÙ+­’%u‚dDZջ„¤&ÌZéÉÉ‘ûu§”öŧïQúTAfeï6i*&w—Qü_G~ùjb ÏùôêÍõÑjˆ‹¬Å8 ÇYµÅMìÓzÓó\J}[Ã17Œn¢ºÖ¦‹ŒŒ»¼ÒOD´R ‡¶H¦Fƒä3O,ïÕf±ïý¤ˆŒÀIr{A&t»»Ü¤ÀqãfÓ‰—jš>õg§ì V áGãxÉÏb¼Ý:MW#ý —ǃ¾bh*sjdâFܘ€TõOÚ¦ƒsÙC§b¶FDXqåä˜Â{\ªS ©g'†ãQ¦íïPU›T¾‘€üKÛq Û?²N`«Œ‹<¹ ¶ -çÌßHÚ"¶…º8ˆBíZmô‹T†€HE2èÜ_cûÎ…ÙÒ~ÃÇsDÝR_²Útãçbì…#ñ9K ‘„R”x¬C$¢jþ²M‘™¨º"ôI±ç×Hê*ãx‚ú|2÷obrá¸r(ÿÞÙ8ÎÚ-ÍçªoíMÔS—5¹þ¯c rÑ—¬¡”ËN…ñGŒg¬hŒZz#CË"¡çËÈú¬Îòî2žâ¦[ól³âA×ÝÓ•)KHçÍt*,–ôêèL’ñïŸûýHóS1‘¥gëg•"‰Ÿ…†ÃŠ?Ä­äHÏ èRëZü€ÛÃDLÙ·Ôlí­ÌBñÃÔ¹Ê_…¹É]Ì -m7…:UW󿽚ÄtZr2` ^·àG•cñ+ÔV~ÓáC³iÀÇV‘+÷©ÐÚkÄ7,™­¿eœ‚4~Çïe]Ó©ý=‡=·r=Íxrn9ô WŸeB.zñ{#âçQëŠPê`÷RWÁ µ¨µ…ÛµÊ÷@%Okså¨Þb4ÃEƒæ) fñ|¯ ƒõ©¦P£¬u$VÄ BþIË4³y[Ž¼Ö  -(mq?8Y§# -‚”ÓŒ 2"ërÍösè¨Yەʳ¢ãnûðì_KÞUÈå–ã$‘6cúL=ùUòá,‚DÇCæ_¤=›ûrGêoþ±g…S”.L°ø¨T8h,•ìÿþá‘[{½‰[â d%Õn®ð$(0Þ)u°õœ™oôé0G_?Ç@äRQm‡vèèâ5ÏSZ îá^‚!ɹ³ãW1 -ÁÙ-ðúŠókµ,Ý~ö/]Üäû/ѶŠ}L"‘ÂÉJëGåµÒ°/x¸ˆZz©ü§Òǯûšh!=Ò KwAð)ù]ÊÅiipïÚlýÓrLICGŸ¤LýKr>Ð~V%|ÂÈÊÚ§Ù,»Æ“-’xe…¿Âge½ÛcH“Ò_Ÿûl䉆¬XBn¨ï¼.æÔý½=qé,¬oE/B‡äwjÜv×r¦2ìÎhH‚ô=ÈAÃÌ¥3•_5䨟6î¾D}w5$Ít¨U•VªRÿK'öãÞg'€E ¿[¾D$ìýL„`£~å2?%¾£{;¡›]žàäBn *ösOz)Tzå^‚_TkUÉÔ—Ž-M_lNX„Tgɶ?µ—Ær° œk'r¸ÐÈŽ§¤e‡äq¯l}d«>í¤®Ž¡d¡!sÒ÷A­¾\˜âï›éžÛé~ÔœµE¯ˆ¯…tDÖm/Iä’@ðÎM Þ¾.0ÙýV}„%ä/IÆ®ÌÆX›ÐjzÃz¸<ö©è²¯ÂÇžÏ!‹~-ÀOôù¡Þç‡^¯òÙzÈâyôaß} Ãˆ $&‘ÍÑpøÌB¾ÞýÜ\z’ E»/æ·– N¹¸È@YõöŸdf{Ú’Cƒíø£—¤$›ÒøÈžQä’¤­±GW~7ã¬e{ï¶ñ¨FnË*DŠ2ç6ͬVV™$<ÃA#Ý…kîÌ,“?‰áÀ-,Üd{?Š«EŸóa© oÇl°)“áObtévOFnm(ÈF8îk"%쯫î{¢GÇá„ŠÏCD(¨èæôî= #æ÷Í14‹6ÕØѬíí}'sÐ6"Åp·´Ñå18’9.x<ºðÝ·xI¨Y8Ü=)ålÂnpØÝÄNÄ;³n£.éã[û'1YÚ Ty…(Ç­RÖ.ïÌpy»hi¢†‘ñÒk'Áo8ȸ{ÌH]²±UTY¦Ûòß/¸aÎðÃXhdET¶\Fòè®ÉÎÛ±ˆŸ Þ¤i™~îé o‡wf`ã0Ux»MËÂÙ¨XR. /½K45@É+éy,í™ÏÚk–þD¼ ×à€YeÒ ç=É2R¢ÕS½½R·qºHÇ”=@ÖÏ¢|j¤V`ù9Nj›»2ó×ólWóÛøŠžŠTÝzË^±¦îBQº¸¿*4_Õ– ºZa½ú]"ìŸZŽˆäx¡å#yUPç³ýŸå…Ôá:®‘SIƒÛ)¦žûøyzú¾Jô͉N)¡ÈÝãiâ=çÕW¢Å¢OõÚKô»f3KgRn„ÌuP­É÷2¾ŸOÙ‰‘îz™íz2§Í”“¿å‰îÓu2!µ¢+í #ur× ,×±÷¦%¾p!Ç„%7cG—ÚÄœ(VRè†áœê§ß2¥zúD å¡œH´hJðO5Ä£©«—ï5Š'fÁ™=ÂLàkänõœ3†Ä†&‰¨t¡¼gCh‘•ñK˜-Ÿ½ÿ'˜aq†3n˜ï›Ÿt#OõºÿPûž¦ ¸–ïf®/ë‰4k°Y—ûöØ°Föãšì0“ ¥¤gŸÍÄöÄh$ùÝß}ã|ÄûÍFzùjÊ{$èsÛqUó2gkOU8ÑC+8„BÕ¢gúùÖ€†”‘8|R$É“ .ŽÇ+ÒCìÛèœ?›aºÙ5¯BùC~Áó:'lÊe<e Û\»'OHåÜó¾Š\“`(eÞ£šEÙ{]¨,d¥HZ£ˆð/V_iZ={C¯I웡du˜tÜX/+ÈM‰‘t¨¬zJÁ÷3ÂÞþ…b¯bó«ù±äæÂYyw˜Ìú¹’àNsßûâKwb}Mê–mÓâc=…w’©£ö7³´ªø%‚ÅUv©˜ß±Ç(}|lÒªe·H™xòxËíäD{é’ÛÓÄ‹K㼯SÍÁ¥¤Ñ Pæ.à Æ¯¼w³N"€VÖo‡{i-LÞÌÁúCô]Rôãf —3’ªŽƒJØI2ñ`"ï„÷ð.©Ò zi{™O«¾Ø|šÊÏî°Á’§èkÒÙmH[<Ñ–u¶Èc](Êño›™?qÆ›¼„üÏ°9ÍûŠÙ§°P•<æŽ&þ<#k¨ígÕ–ÂC4Výw£$’‰ÿ¬"°"ÿƒ. Z…eÚ<ðÆW«ôròçÊf†vÀ}f–S²AUðØy\²½ -À“­ö>Ýyù’J¹"Aƒžf»'?·^Að>÷ÉÛ‹÷&°Y‚!3m·ƒ*×A6xÍŸ'’v†Ü…Ál5¢zœkÔÉÊ ÷þ(-|m<°Ú¬øVþûðf6‡" ýÒ&ÿœúZ­ :ù™Ôm8ÖŸK„—ÓVS»xL&€9öÍ´2ƒSÒÊí :ô–ÛA9=ó䬂z…¶ç -é$à”ÍÖ]ªxÎü•zVB&Ax‹[,—> -H¿ã3–!yÔåZ: §¢ð’Øó¸¾cs¢UÅ ð*Žð(„ó¥V©Áú ÊÜ.>“IõfUPæ°†ø·¹¤Ã؃ÞV­€\®2ñL˜ˆ À¦“PË%ûᑧNj¿å}°³låT'ÚÁk aÛµ5¥:t~Ufsº{L‰P‡î§]è Uì ñnåxkm|Kçè1GwF¹‡ñÍ—ëï5ÓƧá^þM:Ž&Št.P[ZsgU´´TËW¹!5äÔšs⇿i|ÂLÅš;¸F*’lÃÊc©X("÷@r‘Í …Ë_óÖv>¿Ó¹|üF"æ¢4ˆÆ¡6º7ƒ?½÷ÓÀøYF/]ÁC~_B¿JÅ ±ºf“ຠp<ãµ -‹w0¤Úîéæ¬Q‚m´|º½8ÖüsKœÌÈÁA2”Ýë@É5Ïàš÷äÔìÐÓÄM¾;o«VÔÁ_Ù7˘.W)ÂSb­d•”2:¾®Ž—Y¥¶íŠI5ç"´µS³+ä¸f?´ÇgHnë6.8²ÿÙ(õhÄ«cµ^ßn¨Ûj¦AqhÛ±b3A>ÿ¾;„†BÊ»|­C’ÊË瑩FMèþujà -—B>y81[o^ç«1~„îVyq…?œ]Ú¾6æI²*wwl!(|Ô8ôWpºì(£Û”âÂ@âÙ¶u„8½ºƺ»´ŠÇ7>ƒ·2WHøÛÔð¿GÒg->|«øN+hv5K-0Ò±â{¹†gˆ[àÌòâ¾A0pHw±@e«ŠîMïøõ¬ÄLêÿ;…‘&½“¡F¤AÖ‰w!nyîOÃ9ÂRÇÖ*S…šs½Xü“šk(v¨ ÂOÞ°/Y÷CÙL“îf©Ì®´ïý—· Ô™?ç¿ŽUb‹¸¿¯+_&E»ë¾Z÷£ÆîO: ÿ°èªI—ÍeŒ2KX,T§Ça¤á_ ]y|ú‰…[’ýÈ>œ,׌é?™Hýa2,vÕqþ­2ÝÛ5Dó;™Òåz¸õ¯ƒG%KD}Ïzšòh…v¨´NÒ¥Œ–ÇMëñÆFçÎÂÝ»œñ„‚Ÿˆ¯,VÁ™¨÷IKFFô2:Ðî µðí*°]3ÿ"}©­õÓäIþ‘¯–Â, —%ìL»›ÈVÎhû:l¾Ýõ±,ÙÆŸ¶Rgû]2©_wxdi˯xÿÂhcÁðä&ŒFûù?öMxð²ö£8<èêÕBÞÛ üjfÚ–Š<_5äìÏ;ñ߀Åì[¥\?G‰‹ŸîXOÏ%R®à4â?pík7w̾sÀƒSPÙÍIjñÓÅsSt£f°¡°…ÿúÔÍùAƒØ*O“§û ¢÷q>ûyÙó—ÄüVyg_6¡¹_ŸþÜpRdÛ“zµ_Wˆá ˆy{½7NÕŒ]±^kíñ“ -~VéÔrúªÍð$ðA€/Ã}ÈsãŸË\X$´ÄëTmã#™*6VíÝàÝ¡X6qM­«ñøb¨³4 ¾Æ"“¶ì…“û]É,ɈB.ËvÞÒ,ºs䣫ڮŒä•D&ñëܧ -mJyrròTŒHºh6z1|#÷$ãx2ÇléOu…‘])` Ç`Ùå µFFè1¹G¸×l`8™B™c|¶z^æìø7É”SÉqS¹›YýüüC%÷ÞçÂËÈoCÌq§ v^!¿w•¾‘äÏ´å;ölMÔü†P™mVÊ—M“í9— /QX ¶†§q7[8k×Jß!Hmd1õÞ³‰¶ÔÉfíTþéâ´®¬‘8±ô¾üÕ Ÿ}®z 3äЯç׺ß _à ›J¯‹ë¨É•ˆÞÅ ;Ô$ðnO(Þ}Ú»!.µÚ¹ÈZçóM}Õ§š¹Y¾ÄGnç#áKT–㣱)¶“lÐ_5Ạ-â7ÂâBÑóŸ ›&Œ³]MÔÇ4„Ä00]BÐìYHÌ#9æ.ßÆOþ‚[¤šòIñ×o˜EIq…’g¢öæ¯Ö©jIõ?Èv* -B¬qQeö×®ÊyŸåqI¿ÜõK|_t­wªæ™ñKk’¼C;†Œ§ˆœáìÔéZ™mÛÉZ·œƒó„¥‘×É,c‡R²†ã¾šW¦8üºò ¥»".¹Q†òICJösy$·‹µ€‘\•u}~6¥sü¯!E…Š)#¯fÛEûç!æPz¯¿; ô‰-«Ò×\ Éq¦_p!"Wí—dž©UI£!•£ £í!5â7;Ë;ýð~·F3Þ#§±^Ο”Ðrðª_sÄü®Ä¤¤o Qa4üj©!=O‡õÂt0óÛ™ƒ)¿¸J“ZðÇýL­¼•Åil¿ÏÂ`EønvÐS‰S©{!€ø}°iu·j¡/lá¡ëaÐð^¢T-H"èöxcD7˜+-ì•öžÍ´Dª¼¬r×%F½«VRå€SáòûµxUƒ‡wêF§GÊÓ .uô,)Ò¢ªoc¼9' "îBŽš|ÔI)+‚Ð -{vò˜‰à×j'‡ƒ²“#M1qH~§öEÒ¶Âòý -…Ý#ι¢Ìš´ÙQ˜Cõ è; Þ2z6²‘Õn[bìˆaÝݨ7ò·Æ—GCMÞ",7k}sP`Ä\óÝÆo"´˜ö¢K©qÚ§Ž¸Š4ÊŽX~ýÔªL¥ùlU’îþ†Ë'èGø%ÐɘP¨ËjÝ—jÊ¥Þ÷[æ2ôªmÍÏX輞´ g ÝçØ-Êçè[DZ×ï{/²?CÙÌ\6 !ùÎbÍÃ+Ù¢®²+>]=鞉FN¢}xݧjð¸ -öѼ¢øP=\©ï ijêÑÇ7hŸÿ^å Æñ=ÕÍíT}¥FA±§®tºˆ.kët+½$½ê6D dÝ !¢®)G*. -÷°ÂAQEÕH%â.¬°Qs.á‘žH[¨Ëñ‹_#Ë‚‰Që aFëïÒ“+ž”»¢“ýÐ!Áü娠;µžlâý¯b¶¾“à‘Eê¢>$]¤½|9¾Dƒ¦é@—‡º`é½±µü½Yå3ªeÖkò`-¼ž'(eîܬaCò á8ÊÝ(s ²·G¾­ç$r†xǘ'É­$Hi–vØUö%r‘DÒ¾·ÕM¬_©Q;PÀïìÊó¾bDVF+&Q‡d\¾í>b×`@h÷à% .PÁvââûN’ú篵ñ_¢ìbþd¨ñëaÚµ±žŠ¡LQÁš‹ôT©‹i)%~ãÁ·*¢yò{Ÿ>ü¨ …„e°œ˜ôK¦­Äü4Fï.U£6¯­•q“ ¡ññ×|•@)›Lþ…Å-íê›÷t%ü7_¡Æã]°¨kÚÉ*® -ZD-žQü$hÕþ”y­v(Í?fÉl£åšøë1õù~i.ÀMé¯z¢°g¿%„ùÒ™À»H•™ÔÍÄw­m’^ •k -‚g¿Á¬QÞr`f“M`˜Z¡¦= â%‹ë Ÿd8Héñe²å¦¢Yúe'f%*û|üžé®pzŒÏ“ ú'§æk̉`'Ò:‘{vcò\ó´.mýKk€7)½%aä¶lœÕRobéñ‰U‹öGsâùÍèöºØ´õŠxhSùJ/Éí„<áË<iuÈaÎIÛ¨)¼Sz£RÔr‡˜‰#7¡>«´Öž…ñ¸pÂhrXèj<²å€ jâ»¤æ ­ð¯|ÃöXwX«cöw­Ýàæ/F‡‹snØ=rèáˬÂ1èHCæ9R&5j´´)$— ãJJ~3á¹cMk Œ4ðØñO¨£ïî$d?ò± V†cJOßØÁ›Õg¾Ì™q`ùìúø(pøx‡c¹ásè}ŒU§à•ÿ1XKàÉŠ³Àª:nÈÚgÉŸ*M •ÅjÏ¡û9™¼ígñÕŸ'\´o±ŠÕë(;¦è÷×6¾Ë¢ÀE„ŽBÒþø#±K3sžõëÛµ¥jç>;”¹Ç †IÄ—À†#ÞÄš‡H3·`óáÏn‰¬xÚIÆý¡q_-g¼òCÕt -ò•%-©e:·…¾ülËП8¯äbë|2-„䮑zÉq—h9®¤L³"æaMo-ÿvL-»’[€Íÿ½9=¾Rµ*w^æ‚Xþ݆›Œž(w`\˜S³™­Y…šI¶ÉªÞN–éi‡ùÀÂŽ¸pi`)ÿïñ -}¹ #q…³ª]°ár°þÝÜ -Á¡oI}f_ynv¡ -‹ -¢\Èv .7üÏÕéDxÛ¤·B$4tœº7×0Qj6‹"$ùˆ~à@*ßYË!>냀ž²†Ñâ˜;ý·ÕTõ¾øw' -ËàZë`RßÒ£#ÕFÑZ·Î2ŽôtrˆšÜ±WbÕsQº éò¦ˆWúÜ;ƾy´O2R_hõ‚u´˜w´f_ýT*£Â"iukþ\ø´ÁM÷i¡/ðýPNPÓ´×'>÷‡D‰±¦/AŽ›Œ(ó‚ÕÜ37*e‹êíÈß|ž›¢Æs\ž3å”@C’›âÖå ÍHít[ ¹¹dS)„¬–ºmÅø¦GdéÍë*ð§lW¶GE•·÷7_:=ˆs7A e —3½Tðªhâ¥1(MŠ0gÃ3µ)"ù†™o°óƒ‘5ª‚¼Ø«t6ÄÓÖæäŸñ‹Eò;¨ôŸð˜i$I!²;Ï[”hš²=®5…´ ùSÜ™‘ãÈ/DEtÃEóÄ­Tìz©‡ Jß}]-Ò¿%Ö©cvÝ©göÎ{aÜž{—7AÏ­6mÊCx~yy|R§Ä‘™—ÈhõC/hÜ·6ÎgI—¡hâ… -1ýL®üÁ²‘Â¥‘Y–èùúaŽ{ª; ‹÷/È”¹ü•äENïô»dòa®KÖbíÒÓ¯ -­j'zë3sw8=º—ôÔj†Ì>ûñ)³êm¾ Žž˜oÇÚgù¯U:†J¢9Q ø/¤ßz ®…‡)CŒ2lŠÂ øã­ï쌻°ž†Ij¨¢Ë§Jð›åtí»\Ÿ"§%Ï¿ø -þºhg­?kðD¸ëê„-Ÿó¿óXóÖrÅ8úþ3heè©šA1ɼ ð{—æ$oM¼1¼èÅì9÷igzQAÚ¼>ÛgN¦Û+e)¨KûMòI‘"*˜Û»m†‰Á/ßaÕ;€^-é§[¤àMÄêNWïLÖ­ã¾åÅ rsÛèšßOGü_²¨SÅÈ~»ÚñVÎ{Áц -œbˆì•æ+§’-Spì„åì]¦è®ƒXKÔ9ûý«‰>€Ûø–”Ú^Ótáà•¤ã„¢s€> ›žÌ…bZ_4©K[o»"­‚Aͽ ´¹@Vù%É>UÚ /­„ic§Î{9Ï9U‘–°UQgùÃm"Çšm­˜­;ú8&ßÔïÑË/Cß‹dšS=lÓD·~£ c Àxâåh¬hÝxÞùÄÍxíܼÏ6Q/[EïBÝáó9—y5{3ÞgÏQ³_j:$?m8s†Ø Sr»þB~qo£S(,'©±XKÍ/%«ùC£ÎsÚ@&B!Ì©¸Íí9ØýÅÁøžÚ/+×)ñóôÓý9žD¬Ù%Ia´Ï—e.ý¾×Ü~‹ñ–íUÏùP þAj¼iL‡ñç9Ôáʬ’û®ó¯Ú„ -P«ùåQ±üò#OX;V.}øü[jUJ»£ZÂ0Ä…t›L%IwZ½Ì O°{Ò¦²ócN–šû¦p\8œ ßÚn¶ç£W$ë舙Îä¢1×Lf¬3‘ζ}ÞJáw‘wWmÖèDŸÄ“Roll†•1¤íË©ÔÑ.uâKòcù€qaªÃwX¨£ˆ‰ý„àSÙE+%Ò±;¸%„g”ð86øî²ó˜²Fo—°Wz&Ü¡%qôf|ŠÇBméÚß$9÷òâѦ‚°,Ó¦ãwÕÇdv)AßÓ׉uŠËôÚ=»tMÎH2“tÝNqüó ìp ¥¤‡RI‘ÀÔÅ¥¤ 4žy­âó¤1Ná -UN§ËŸßÒû?iÄèäkw76›»žz;¸> -ÀáÊ<ð„ò(ŠB*ÿè<óÛL7¶Xë|O@jÖX‚á£5À$@ÆàÁQ¤=@ È×Ò^sBŽ„M=¸W/þA³Ò?u*MÔß ŒUì$‚]'<ådÁ -Fý¤“ª?‘!Cæ2¶Í@6ÒP=8ÿÃEŒÁÚŽÀ6€Ñ -Ñs›§‘þÇ­eó%tE.“!ˆò¼qï€*¼uðqâ2‡(|=\NeLˆ2cѧÚ¾î9ˆb´ 6í×LW„%MZûC¾Û:RâŸ.z!«ìЊÑxíÖ­”‹TÒk‡ôÑû¼µ<{ƒTÁ‡À¡Ç›Ìõ({À°¼¶Ñ6~Õè¼µ–r Êê°É¶Ì -ij'GAí¹ºZLMë§.mת¥A_€%–!&VØZrWæo…c)gÜ>7³­Ô'Ò¨Ân&Ú؇~៙wâEãÉ"cœ7ȸøÕ‚È:j{/iŸ´õ7à®&Ý9¿š®ág—'ÆLÎ\2ßüôß`>j³!)î:v¾6W‘Ýæí×ÿÔT”S뜤·X.rJšV¿¬ùR0¢_§Ô-E&”­u;Ù{¢™SELp ÈU{jù!ˆb’uƒµBÎr3÷˳Ì÷'¹¾í¾Ùfû¼Eµ_8ûÄXÙ"©EçÛmáù›©£WŸoLtT5{Æ'7$;%°„¨z@ò.»²¶„'éGá’i¹Ñž°“¥š(j7a?ôô¬*уg«„4ec»ZÒ¤—e»±±œÒ5•=J“)‹‚e6°• ︸™Öbk ºýg¯u_ÇkÌ9¢s^8©üBÜ—ÓŒq%ý¶ã‡–*6¸yì,èƒãIé*š%rj\Çãf\Ÿ\¡èFËÍ»»eËÞij¥zïEg…fgzñ¤m)°\º^ZÆŒÍAP†Â•½"kÍø~­{®ve#Z¦ XÝ")E~&«8|f+N5ê¸Rß´aAsÙCM?·L€“áíòrŸ7Âp{TÐ[xê­ .p¾f|Bq3 W¼R¯*s(=¢ÛG<ÆÌ[«šxΙ挨ߢ—AvŸ÷5HÇêö8àáÑЦì0Œ«OÊ—Þi2*|½< B¹\…nåùÊt¬„¿T¾œ¥ÕTuÚ>%×—¥^²âÝ ÆÈ™b€VJÊþöé’Óß‹ÊQÕ¢ùDÚ¢#¦Ý8d´Žº±øbíºØ‰z®"_±É9†‘£¡—»±:­ä2IÊC…¯˜N/ &t8Õ…åFœÁ]LõhzÊÞé)”Rø5Ç´zò« ­e‰Ç`l&Ð8.áQ2Iìdð®s)ÙbCF!&Ñ\»:}zèî–yï}œ»f†ã¥wj#´”!òU½Í¨©‚Oã>¼¶Ìãqú¿Ñâ4ƒ9í‚ih]Út¢Þ‡{$öœK_‡‰Šôjšú_O_¼puÉEu×Ä#¹z ÈåÒ›®^ûû­Áü]‚4’4jH‰ üðú.¼u ð›'ˆÚ;~mÓJÇóCòæU=êm¿Ã Ó§Z'Î¥îK}s %¬h%­È|¿*7­ÝŠÊ¿÷‰7U›VùÀô3çº@4?ÕEQœü¸0¸ÙúXØ}õ¡„îŠ"‚¤ò[¶¥o&Ù—¨õkò-©ÚeñÒoW{~nƒ¦¬”»[~ê;t¾ Þþ¼z úàè#U?:¦Ã4ëÏ„/Á«*0ñ[YZf=§ -^0„ö(,ò3ÏÄ[àƒc%HÞÙ„Dl­;B0’Bôßj‘RÌÝeÎÙö_dcíàÎÐز´™DÛ‡þ^€ºÍŸ^WeUM<´0iKCÆT§øx°2ááÀrô>Óy¸26|55c‚±ž ÞWõÜ÷éô–«?\”Bu)ãG‡šr¥¬°•btÎãã ˱\ íÌa(0M9–¢ì]¬²ÖÇ)ªYRtü'ºj?U½ þ¶¾ê:jêö3X÷í¢c3Úè a^¸öíÜ z±Â’¶„¿ y¾ßü—hcô‘Ó½mb}Ö€ÄCª„‘êä:IbžQ®^8QF6M‰.Ä%qS›!䵯T¥ê¶ïMo8äé;÷8ö ôž½u¹éÜwM±è¹OÔ’Z˜00mÊjy _­ ¿öH£¤MÈIªAY|¾_5Tvzê? }¦ .«0 ,5òåë3\B.[T–÷¬˜Ek—v>i² -!kî2W„„B`nEãÜ-%ÚKæ0w“éë.v’8 ëÚ2r]C¢‹¨Üf#¨§O.£[ì$zf[¸-ÅNAú~Ñ£¯It¢;bMÂn€˜¯{+’šy®ÈB§áS7Û‘‹H×%vŽÈ÷=DOî^*Ú¾{^OLíKУˆÐóIíú!,÷îµ9×{’:—pY²©£E|*œÊïDYï~…¼ÆCxà º>ÅRÝTê¼7¥%ó åd¾™®B=è8³;¨ò(ó‹ÙÚ­Ï•þ©8W…ÿ(º#ÈUg»:hÍ/ü8¦„)ïhbæ`à4[âVøS²ö![8óø…íK"E›õb‡ûü‹+ ³4¸oÿR “çÉZõƒ¸´'«Ém³JM*±C®ba0•å&À·D‚ÿÚªªoIQ7– kÀrÃ<©xÿa`,þç™ùVó+²å5uÒ‚z­ªÎ\½Û -AcܧŒ-ôÙ_ŠÐSz‰O Ò¡Ü ¹äýaqƒÓ/Tm1Axî[ï¡×y:²a`°‹éÅ‚0нvÿzN™æÍ -+Ðß - Ül®„k;ܵl›`+5-³XW­°ù †@m ® eŸ=8ö–èÓÉ~ƒtœd¡õО}¹aDaNb¯()>cÔxˆN±"î˜ð^Y±G‘ö/á;¸É†MA©"ºî‡\Þɽ†!:ý†?¢¢¿vZ ‡¸¸°ýüCúü_1€™ÐÄÙdoâl‹ô>sendstream -endobj -1617 0 obj << -/Type /Font -/Subtype /Type1 -/Encoding 3743 0 R -/FirstChar 11 -/LastChar 122 -/Widths 3759 0 R -/BaseFont /KEMIEU+CMSSBX10 -/FontDescriptor 1615 0 R +1823 0 obj << +/Title 1824 0 R +/A 1821 0 R +/Parent 1815 0 R +/Prev 1819 0 R +/Next 1827 0 R >> endobj -1615 0 obj << -/Ascent 694 -/CapHeight 694 -/Descent -194 -/FontName /KEMIEU+CMSSBX10 -/ItalicAngle 0 -/StemV 136 -/XHeight 458 -/FontBBox [-71 -250 1099 780] -/Flags 4 -/CharSet (/ff/fi/fl/exclam/quotedblright/dollar/quoteright/parenleft/parenright/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/equal/question/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) -/FontFile 1616 0 R +1819 0 obj << +/Title 1820 0 R +/A 1817 0 R +/Parent 1815 0 R +/Next 1823 0 R >> endobj -3759 0 obj -[642 586 586 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 367 558 0 550 0 0 306 428 428 0 0 306 367 306 550 550 550 550 550 550 550 550 550 550 550 306 0 0 856 0 519 0 733 733 703 794 642 611 733 794 331 519 764 581 978 794 794 703 794 703 611 733 764 733 1039 733 733 0 343 0 343 0 0 0 525 561 489 561 511 336 550 561 256 286 531 256 867 561 550 561 561 372 422 404 561 500 744 500 500 476 ] -endobj -1621 0 obj << -/Type /Pages -/Count 6 -/Parent 3760 0 R -/Kids [1610 0 R 1623 0 R 1637 0 R 1645 0 R 1684 0 R 1730 0 R] +1815 0 obj << +/Title 1816 0 R +/A 1813 0 R +/Parent 1327 0 R +/Prev 1811 0 R +/Next 1831 0 R +/First 1819 0 R +/Last 1827 0 R +/Count -3 >> endobj -1836 0 obj << -/Type /Pages -/Count 6 -/Parent 3760 0 R -/Kids [1784 0 R 1838 0 R 1887 0 R 1938 0 R 1988 0 R 2038 0 R] +1811 0 obj << +/Title 1812 0 R +/A 1809 0 R +/Parent 1327 0 R +/Prev 1779 0 R +/Next 1815 0 R >> endobj -2090 0 obj << -/Type /Pages -/Count 6 -/Parent 3760 0 R -/Kids [2087 0 R 2092 0 R 2106 0 R 2111 0 R 2119 0 R 2135 0 R] +1807 0 obj << +/Title 1808 0 R +/A 1805 0 R +/Parent 1779 0 R +/Prev 1803 0 R >> endobj -2162 0 obj << -/Type /Pages -/Count 6 -/Parent 3760 0 R -/Kids [2149 0 R 2166 0 R 2170 0 R 2178 0 R 2184 0 R 2195 0 R] +1803 0 obj << +/Title 1804 0 R +/A 1801 0 R +/Parent 1779 0 R +/Prev 1799 0 R +/Next 1807 0 R >> endobj -2217 0 obj << -/Type /Pages -/Count 6 -/Parent 3760 0 R -/Kids [2213 0 R 2219 0 R 2228 0 R 2235 0 R 2243 0 R 2249 0 R] +1799 0 obj << +/Title 1800 0 R +/A 1797 0 R +/Parent 1779 0 R +/Prev 1795 0 R +/Next 1803 0 R >> endobj -2260 0 obj << -/Type /Pages -/Count 6 -/Parent 3760 0 R -/Kids [2255 0 R 2263 0 R 2270 0 R 2280 0 R 2287 0 R 2299 0 R] +1795 0 obj << +/Title 1796 0 R +/A 1793 0 R +/Parent 1779 0 R +/Prev 1791 0 R +/Next 1799 0 R >> endobj -2311 0 obj << -/Type /Pages -/Count 6 -/Parent 3761 0 R -/Kids [2303 0 R 2313 0 R 2321 0 R 2327 0 R 2334 0 R 2346 0 R] +1791 0 obj << +/Title 1792 0 R +/A 1789 0 R +/Parent 1779 0 R +/Prev 1787 0 R +/Next 1795 0 R >> endobj -2360 0 obj << -/Type /Pages -/Count 6 -/Parent 3761 0 R -/Kids [2351 0 R 2362 0 R 2371 0 R 2375 0 R 2382 0 R 2387 0 R] +1787 0 obj << +/Title 1788 0 R +/A 1785 0 R +/Parent 1779 0 R +/Prev 1783 0 R +/Next 1791 0 R >> endobj -2396 0 obj << -/Type /Pages -/Count 6 -/Parent 3761 0 R -/Kids [2392 0 R 2398 0 R 2406 0 R 2414 0 R 2424 0 R 2429 0 R] +1783 0 obj << +/Title 1784 0 R +/A 1781 0 R +/Parent 1779 0 R +/Next 1787 0 R >> endobj -2445 0 obj << -/Type /Pages -/Count 6 -/Parent 3761 0 R -/Kids [2438 0 R 2447 0 R 2452 0 R 2458 0 R 2464 0 R 2468 0 R] +1779 0 obj << +/Title 1780 0 R +/A 1777 0 R +/Parent 1327 0 R +/Prev 1735 0 R +/Next 1811 0 R +/First 1783 0 R +/Last 1807 0 R +/Count -7 >> endobj -2478 0 obj << -/Type /Pages -/Count 6 -/Parent 3761 0 R -/Kids [2472 0 R 2480 0 R 2486 0 R 2490 0 R 2497 0 R 2512 0 R] +1775 0 obj << +/Title 1776 0 R +/A 1773 0 R +/Parent 1735 0 R +/Prev 1739 0 R >> endobj -2529 0 obj << -/Type /Pages -/Count 6 -/Parent 3761 0 R -/Kids [2524 0 R 2531 0 R 2546 0 R 2553 0 R 2558 0 R 2567 0 R] +1771 0 obj << +/Title 1772 0 R +/A 1769 0 R +/Parent 1739 0 R +/Prev 1767 0 R >> endobj -2577 0 obj << -/Type /Pages -/Count 6 -/Parent 3762 0 R -/Kids [2574 0 R 2579 0 R 2586 0 R 2594 0 R 2601 0 R 2607 0 R] +1767 0 obj << +/Title 1768 0 R +/A 1765 0 R +/Parent 1739 0 R +/Prev 1763 0 R +/Next 1771 0 R >> endobj -2619 0 obj << -/Type /Pages -/Count 6 -/Parent 3762 0 R -/Kids [2616 0 R 2621 0 R 2629 0 R 2633 0 R 2643 0 R 2653 0 R] +1763 0 obj << +/Title 1764 0 R +/A 1761 0 R +/Parent 1739 0 R +/Prev 1759 0 R +/Next 1767 0 R >> endobj -2664 0 obj << -/Type /Pages -/Count 6 -/Parent 3762 0 R -/Kids [2659 0 R 2666 0 R 2675 0 R 2684 0 R 2691 0 R 2697 0 R] +1759 0 obj << +/Title 1760 0 R +/A 1757 0 R +/Parent 1739 0 R +/Prev 1755 0 R +/Next 1763 0 R >> endobj -2715 0 obj << -/Type /Pages -/Count 6 -/Parent 3762 0 R -/Kids [2702 0 R 2717 0 R 2723 0 R 2730 0 R 2738 0 R 2743 0 R] +1755 0 obj << +/Title 1756 0 R +/A 1753 0 R +/Parent 1739 0 R +/Prev 1751 0 R +/Next 1759 0 R >> endobj -2750 0 obj << -/Type /Pages -/Count 6 -/Parent 3762 0 R -/Kids [2747 0 R 2752 0 R 2757 0 R 2763 0 R 2774 0 R 2779 0 R] +1751 0 obj << +/Title 1752 0 R +/A 1749 0 R +/Parent 1739 0 R +/Prev 1747 0 R +/Next 1755 0 R >> endobj -2787 0 obj << -/Type /Pages -/Count 6 -/Parent 3762 0 R -/Kids [2783 0 R 2789 0 R 2793 0 R 2797 0 R 2801 0 R 2805 0 R] +1747 0 obj << +/Title 1748 0 R +/A 1745 0 R +/Parent 1739 0 R +/Prev 1743 0 R +/Next 1751 0 R >> endobj -2812 0 obj << -/Type /Pages -/Count 6 -/Parent 3763 0 R -/Kids [2809 0 R 2814 0 R 2823 0 R 2832 0 R 2839 0 R 2843 0 R] +1743 0 obj << +/Title 1744 0 R +/A 1741 0 R +/Parent 1739 0 R +/Next 1747 0 R >> endobj -2852 0 obj << -/Type /Pages -/Count 6 -/Parent 3763 0 R -/Kids [2849 0 R 2854 0 R 2858 0 R 2863 0 R 2868 0 R 2872 0 R] +1739 0 obj << +/Title 1740 0 R +/A 1737 0 R +/Parent 1735 0 R +/Next 1775 0 R +/First 1743 0 R +/Last 1771 0 R +/Count -8 >> endobj -2885 0 obj << -/Type /Pages -/Count 6 -/Parent 3763 0 R -/Kids [2879 0 R 2887 0 R 2894 0 R 2903 0 R 2913 0 R 2920 0 R] +1735 0 obj << +/Title 1736 0 R +/A 1733 0 R +/Parent 1327 0 R +/Prev 1715 0 R +/Next 1779 0 R +/First 1739 0 R +/Last 1775 0 R +/Count -2 >> endobj -2930 0 obj << -/Type /Pages -/Count 6 -/Parent 3763 0 R -/Kids [2927 0 R 2932 0 R 2939 0 R 2947 0 R 2956 0 R 2960 0 R] +1731 0 obj << +/Title 1732 0 R +/A 1729 0 R +/Parent 1715 0 R +/Prev 1727 0 R >> endobj -2971 0 obj << -/Type /Pages -/Count 6 -/Parent 3763 0 R -/Kids [2966 0 R 2973 0 R 2984 0 R 2996 0 R 3002 0 R 3007 0 R] +1727 0 obj << +/Title 1728 0 R +/A 1725 0 R +/Parent 1715 0 R +/Prev 1723 0 R +/Next 1731 0 R >> endobj -3018 0 obj << -/Type /Pages -/Count 6 -/Parent 3763 0 R -/Kids [3011 0 R 3020 0 R 3027 0 R 3036 0 R 3042 0 R 3057 0 R] +1723 0 obj << +/Title 1724 0 R +/A 1721 0 R +/Parent 1715 0 R +/Prev 1719 0 R +/Next 1727 0 R >> endobj -3071 0 obj << -/Type /Pages -/Count 6 -/Parent 3764 0 R -/Kids [3065 0 R 3073 0 R 3081 0 R 3089 0 R 3097 0 R 3101 0 R] +1719 0 obj << +/Title 1720 0 R +/A 1717 0 R +/Parent 1715 0 R +/Next 1723 0 R >> endobj -3111 0 obj << -/Type /Pages -/Count 6 -/Parent 3764 0 R -/Kids [3105 0 R 3113 0 R 3122 0 R 3129 0 R 3138 0 R 3142 0 R] +1715 0 obj << +/Title 1716 0 R +/A 1713 0 R +/Parent 1327 0 R +/Prev 1627 0 R +/Next 1735 0 R +/First 1719 0 R +/Last 1731 0 R +/Count -4 >> endobj -3150 0 obj << -/Type /Pages -/Count 6 -/Parent 3764 0 R -/Kids [3147 0 R 3152 0 R 3156 0 R 3162 0 R 3171 0 R 3176 0 R] +1711 0 obj << +/Title 1712 0 R +/A 1709 0 R +/Parent 1627 0 R +/Prev 1647 0 R >> endobj -3185 0 obj << -/Type /Pages -/Count 6 -/Parent 3764 0 R -/Kids [3182 0 R 3187 0 R 3194 0 R 3199 0 R 3205 0 R 3212 0 R] +1707 0 obj << +/Title 1708 0 R +/A 1705 0 R +/Parent 1647 0 R +/Prev 1703 0 R >> endobj -3229 0 obj << -/Type /Pages -/Count 6 -/Parent 3764 0 R -/Kids [3221 0 R 3231 0 R 3240 0 R 3250 0 R 3255 0 R 3261 0 R] +1703 0 obj << +/Title 1704 0 R +/A 1701 0 R +/Parent 1647 0 R +/Prev 1699 0 R +/Next 1707 0 R >> endobj -3272 0 obj << -/Type /Pages -/Count 6 -/Parent 3764 0 R -/Kids [3267 0 R 3274 0 R 3279 0 R 3285 0 R 3289 0 R 3296 0 R] +1699 0 obj << +/Title 1700 0 R +/A 1697 0 R +/Parent 1647 0 R +/Prev 1695 0 R +/Next 1703 0 R >> endobj -3306 0 obj << -/Type /Pages -/Count 6 -/Parent 3765 0 R -/Kids [3300 0 R 3308 0 R 3315 0 R 3321 0 R 3330 0 R 3337 0 R] +1695 0 obj << +/Title 1696 0 R +/A 1693 0 R +/Parent 1647 0 R +/Prev 1691 0 R +/Next 1699 0 R >> endobj -3348 0 obj << -/Type /Pages -/Count 6 -/Parent 3765 0 R -/Kids [3344 0 R 3350 0 R 3354 0 R 3359 0 R 3365 0 R 3377 0 R] +1691 0 obj << +/Title 1692 0 R +/A 1689 0 R +/Parent 1647 0 R +/Prev 1687 0 R +/Next 1695 0 R >> endobj -3387 0 obj << -/Type /Pages -/Count 6 -/Parent 3765 0 R -/Kids [3381 0 R 3389 0 R 3397 0 R 3402 0 R 3415 0 R 3426 0 R] +1687 0 obj << +/Title 1688 0 R +/A 1685 0 R +/Parent 1647 0 R +/Prev 1683 0 R +/Next 1691 0 R >> endobj -3439 0 obj << -/Type /Pages -/Count 6 -/Parent 3765 0 R -/Kids [3432 0 R 3441 0 R 3453 0 R 3463 0 R 3474 0 R 3481 0 R] +1683 0 obj << +/Title 1684 0 R +/A 1681 0 R +/Parent 1647 0 R +/Prev 1679 0 R +/Next 1687 0 R +>> endobj +1679 0 obj << +/Title 1680 0 R +/A 1677 0 R +/Parent 1647 0 R +/Prev 1675 0 R +/Next 1683 0 R >> endobj -3501 0 obj << -/Type /Pages -/Count 6 -/Parent 3765 0 R -/Kids [3485 0 R 3503 0 R 3515 0 R 3521 0 R 3529 0 R 3534 0 R] +1675 0 obj << +/Title 1676 0 R +/A 1673 0 R +/Parent 1647 0 R +/Prev 1671 0 R +/Next 1679 0 R >> endobj -3544 0 obj << -/Type /Pages -/Count 6 -/Parent 3765 0 R -/Kids [3538 0 R 3546 0 R 3551 0 R 3557 0 R 3581 0 R 3592 0 R] +1671 0 obj << +/Title 1672 0 R +/A 1669 0 R +/Parent 1647 0 R +/Prev 1667 0 R +/Next 1675 0 R >> endobj -3601 0 obj << -/Type /Pages -/Count 6 -/Parent 3766 0 R -/Kids [3598 0 R 3603 0 R 3611 0 R 3616 0 R 3624 0 R 3638 0 R] +1667 0 obj << +/Title 1668 0 R +/A 1665 0 R +/Parent 1647 0 R +/Prev 1663 0 R +/Next 1671 0 R >> endobj -3661 0 obj << -/Type /Pages -/Count 6 -/Parent 3766 0 R -/Kids [3651 0 R 3663 0 R 3675 0 R 3681 0 R 3688 0 R 3693 0 R] +1663 0 obj << +/Title 1664 0 R +/A 1661 0 R +/Parent 1647 0 R +/Prev 1659 0 R +/Next 1667 0 R >> endobj -3708 0 obj << -/Type /Pages -/Count 5 -/Parent 3766 0 R -/Kids [3700 0 R 3710 0 R 3715 0 R 3723 0 R 3732 0 R] +1659 0 obj << +/Title 1660 0 R +/A 1657 0 R +/Parent 1647 0 R +/Prev 1655 0 R +/Next 1663 0 R >> endobj -3760 0 obj << -/Type /Pages -/Count 36 -/Parent 3767 0 R -/Kids [1621 0 R 1836 0 R 2090 0 R 2162 0 R 2217 0 R 2260 0 R] +1655 0 obj << +/Title 1656 0 R +/A 1653 0 R +/Parent 1647 0 R +/Prev 1651 0 R +/Next 1659 0 R >> endobj -3761 0 obj << -/Type /Pages -/Count 36 -/Parent 3767 0 R -/Kids [2311 0 R 2360 0 R 2396 0 R 2445 0 R 2478 0 R 2529 0 R] +1651 0 obj << +/Title 1652 0 R +/A 1649 0 R +/Parent 1647 0 R +/Next 1655 0 R >> endobj -3762 0 obj << -/Type /Pages -/Count 36 -/Parent 3767 0 R -/Kids [2577 0 R 2619 0 R 2664 0 R 2715 0 R 2750 0 R 2787 0 R] +1647 0 obj << +/Title 1648 0 R +/A 1645 0 R +/Parent 1627 0 R +/Prev 1643 0 R +/Next 1711 0 R +/First 1651 0 R +/Last 1707 0 R +/Count -15 >> endobj -3763 0 obj << -/Type /Pages -/Count 36 -/Parent 3767 0 R -/Kids [2812 0 R 2852 0 R 2885 0 R 2930 0 R 2971 0 R 3018 0 R] +1643 0 obj << +/Title 1644 0 R +/A 1641 0 R +/Parent 1627 0 R +/Prev 1639 0 R +/Next 1647 0 R >> endobj -3764 0 obj << -/Type /Pages -/Count 36 -/Parent 3767 0 R -/Kids [3071 0 R 3111 0 R 3150 0 R 3185 0 R 3229 0 R 3272 0 R] +1639 0 obj << +/Title 1640 0 R +/A 1637 0 R +/Parent 1627 0 R +/Prev 1635 0 R +/Next 1643 0 R >> endobj -3765 0 obj << -/Type /Pages -/Count 36 -/Parent 3767 0 R -/Kids [3306 0 R 3348 0 R 3387 0 R 3439 0 R 3501 0 R 3544 0 R] +1635 0 obj << +/Title 1636 0 R +/A 1633 0 R +/Parent 1627 0 R +/Prev 1631 0 R +/Next 1639 0 R >> endobj -3766 0 obj << -/Type /Pages -/Count 17 -/Parent 3768 0 R -/Kids [3601 0 R 3661 0 R 3708 0 R] +1631 0 obj << +/Title 1632 0 R +/A 1629 0 R +/Parent 1627 0 R +/Next 1635 0 R >> endobj -3767 0 obj << -/Type /Pages -/Count 216 -/Parent 3769 0 R -/Kids [3760 0 R 3761 0 R 3762 0 R 3763 0 R 3764 0 R 3765 0 R] +1627 0 obj << +/Title 1628 0 R +/A 1625 0 R +/Parent 1327 0 R +/Prev 1559 0 R +/Next 1715 0 R +/First 1631 0 R +/Last 1711 0 R +/Count -6 >> endobj -3768 0 obj << -/Type /Pages -/Count 17 -/Parent 3769 0 R -/Kids [3766 0 R] +1623 0 obj << +/Title 1624 0 R +/A 1621 0 R +/Parent 1559 0 R +/Prev 1619 0 R >> endobj -3769 0 obj << -/Type /Pages -/Count 233 -/Kids [3767 0 R 3768 0 R] +1619 0 obj << +/Title 1620 0 R +/A 1617 0 R +/Parent 1559 0 R +/Prev 1615 0 R +/Next 1623 0 R >> endobj -3770 0 obj << -/Type /Outlines -/First 7 0 R -/Last 1299 0 R -/Count 5 +1615 0 obj << +/Title 1616 0 R +/A 1613 0 R +/Parent 1559 0 R +/Prev 1611 0 R +/Next 1619 0 R +>> endobj +1611 0 obj << +/Title 1612 0 R +/A 1609 0 R +/Parent 1559 0 R +/Prev 1607 0 R +/Next 1615 0 R >> endobj 1607 0 obj << /Title 1608 0 R /A 1605 0 R -/Parent 1571 0 R +/Parent 1559 0 R /Prev 1603 0 R +/Next 1611 0 R >> endobj 1603 0 obj << /Title 1604 0 R /A 1601 0 R -/Parent 1571 0 R +/Parent 1559 0 R /Prev 1599 0 R /Next 1607 0 R >> endobj 1599 0 obj << /Title 1600 0 R /A 1597 0 R -/Parent 1571 0 R +/Parent 1559 0 R /Prev 1595 0 R /Next 1603 0 R >> endobj 1595 0 obj << /Title 1596 0 R /A 1593 0 R -/Parent 1571 0 R +/Parent 1559 0 R /Prev 1591 0 R /Next 1599 0 R >> endobj 1591 0 obj << /Title 1592 0 R /A 1589 0 R -/Parent 1571 0 R +/Parent 1559 0 R /Prev 1587 0 R /Next 1595 0 R >> endobj 1587 0 obj << /Title 1588 0 R /A 1585 0 R -/Parent 1571 0 R +/Parent 1559 0 R /Prev 1583 0 R /Next 1591 0 R >> endobj 1583 0 obj << /Title 1584 0 R /A 1581 0 R -/Parent 1571 0 R +/Parent 1559 0 R /Prev 1579 0 R /Next 1587 0 R >> endobj 1579 0 obj << /Title 1580 0 R /A 1577 0 R -/Parent 1571 0 R +/Parent 1559 0 R /Prev 1575 0 R /Next 1583 0 R >> endobj 1575 0 obj << /Title 1576 0 R /A 1573 0 R -/Parent 1571 0 R +/Parent 1559 0 R +/Prev 1571 0 R /Next 1579 0 R >> endobj 1571 0 obj << /Title 1572 0 R /A 1569 0 R -/Parent 1299 0 R -/Prev 1523 0 R -/First 1575 0 R -/Last 1607 0 R -/Count -9 +/Parent 1559 0 R +/Prev 1567 0 R +/Next 1575 0 R >> endobj 1567 0 obj << /Title 1568 0 R /A 1565 0 R -/Parent 1527 0 R +/Parent 1559 0 R /Prev 1563 0 R +/Next 1571 0 R >> endobj 1563 0 obj << /Title 1564 0 R /A 1561 0 R -/Parent 1527 0 R -/Prev 1559 0 R +/Parent 1559 0 R /Next 1567 0 R >> endobj 1559 0 obj << /Title 1560 0 R /A 1557 0 R -/Parent 1527 0 R -/Prev 1555 0 R -/Next 1563 0 R +/Parent 1327 0 R +/Prev 1539 0 R +/Next 1627 0 R +/First 1563 0 R +/Last 1623 0 R +/Count -16 >> endobj 1555 0 obj << /Title 1556 0 R /A 1553 0 R -/Parent 1527 0 R +/Parent 1539 0 R /Prev 1551 0 R -/Next 1559 0 R >> endobj 1551 0 obj << /Title 1552 0 R /A 1549 0 R -/Parent 1527 0 R +/Parent 1539 0 R /Prev 1547 0 R /Next 1555 0 R >> endobj 1547 0 obj << /Title 1548 0 R /A 1545 0 R -/Parent 1527 0 R +/Parent 1539 0 R /Prev 1543 0 R /Next 1551 0 R >> endobj 1543 0 obj << /Title 1544 0 R /A 1541 0 R -/Parent 1527 0 R -/Prev 1539 0 R +/Parent 1539 0 R /Next 1547 0 R >> endobj 1539 0 obj << /Title 1540 0 R /A 1537 0 R -/Parent 1527 0 R -/Prev 1535 0 R -/Next 1543 0 R +/Parent 1327 0 R +/Prev 1527 0 R +/Next 1559 0 R +/First 1543 0 R +/Last 1555 0 R +/Count -4 >> endobj 1535 0 obj << /Title 1536 0 R /A 1533 0 R /Parent 1527 0 R /Prev 1531 0 R -/Next 1539 0 R >> endobj 1531 0 obj << /Title 1532 0 R @@ -17911,376 +35256,371 @@ endobj 1527 0 obj << /Title 1528 0 R /A 1525 0 R -/Parent 1523 0 R +/Parent 1327 0 R +/Prev 1515 0 R +/Next 1539 0 R /First 1531 0 R -/Last 1567 0 R -/Count -10 +/Last 1535 0 R +/Count -2 >> endobj 1523 0 obj << /Title 1524 0 R /A 1521 0 R -/Parent 1299 0 R -/Prev 1451 0 R -/Next 1571 0 R -/First 1527 0 R -/Last 1527 0 R -/Count -1 +/Parent 1515 0 R +/Prev 1519 0 R >> endobj 1519 0 obj << /Title 1520 0 R /A 1517 0 R -/Parent 1451 0 R -/Prev 1515 0 R +/Parent 1515 0 R +/Next 1523 0 R >> endobj 1515 0 obj << /Title 1516 0 R /A 1513 0 R -/Parent 1451 0 R -/Prev 1507 0 R -/Next 1519 0 R +/Parent 1327 0 R +/Prev 1499 0 R +/Next 1527 0 R +/First 1519 0 R +/Last 1523 0 R +/Count -2 >> endobj 1511 0 obj << /Title 1512 0 R /A 1509 0 R -/Parent 1507 0 R +/Parent 1499 0 R +/Prev 1507 0 R >> endobj 1507 0 obj << /Title 1508 0 R /A 1505 0 R -/Parent 1451 0 R -/Prev 1479 0 R -/Next 1515 0 R -/First 1511 0 R -/Last 1511 0 R -/Count -1 +/Parent 1499 0 R +/Prev 1503 0 R +/Next 1511 0 R >> endobj 1503 0 obj << /Title 1504 0 R /A 1501 0 R -/Parent 1479 0 R -/Prev 1499 0 R +/Parent 1499 0 R +/Next 1507 0 R >> endobj 1499 0 obj << /Title 1500 0 R /A 1497 0 R -/Parent 1479 0 R -/Prev 1495 0 R -/Next 1503 0 R +/Parent 1327 0 R +/Prev 1419 0 R +/Next 1515 0 R +/First 1503 0 R +/Last 1511 0 R +/Count -3 >> endobj 1495 0 obj << /Title 1496 0 R /A 1493 0 R -/Parent 1479 0 R +/Parent 1419 0 R /Prev 1491 0 R -/Next 1499 0 R >> endobj 1491 0 obj << /Title 1492 0 R /A 1489 0 R -/Parent 1479 0 R +/Parent 1419 0 R /Prev 1487 0 R /Next 1495 0 R >> endobj 1487 0 obj << /Title 1488 0 R /A 1485 0 R -/Parent 1479 0 R +/Parent 1419 0 R /Prev 1483 0 R /Next 1491 0 R >> endobj 1483 0 obj << /Title 1484 0 R /A 1481 0 R -/Parent 1479 0 R +/Parent 1419 0 R +/Prev 1479 0 R /Next 1487 0 R >> endobj 1479 0 obj << /Title 1480 0 R /A 1477 0 R -/Parent 1451 0 R -/Prev 1459 0 R -/Next 1507 0 R -/First 1483 0 R -/Last 1503 0 R -/Count -6 +/Parent 1419 0 R +/Prev 1475 0 R +/Next 1483 0 R >> endobj 1475 0 obj << /Title 1476 0 R /A 1473 0 R -/Parent 1459 0 R +/Parent 1419 0 R /Prev 1471 0 R +/Next 1479 0 R >> endobj 1471 0 obj << /Title 1472 0 R /A 1469 0 R -/Parent 1459 0 R +/Parent 1419 0 R /Prev 1467 0 R /Next 1475 0 R >> endobj 1467 0 obj << /Title 1468 0 R /A 1465 0 R -/Parent 1459 0 R +/Parent 1419 0 R /Prev 1463 0 R /Next 1471 0 R >> endobj 1463 0 obj << /Title 1464 0 R /A 1461 0 R -/Parent 1459 0 R +/Parent 1419 0 R +/Prev 1459 0 R /Next 1467 0 R >> endobj 1459 0 obj << /Title 1460 0 R /A 1457 0 R -/Parent 1451 0 R +/Parent 1419 0 R /Prev 1455 0 R -/Next 1479 0 R -/First 1463 0 R -/Last 1475 0 R -/Count -4 +/Next 1463 0 R >> endobj 1455 0 obj << /Title 1456 0 R /A 1453 0 R -/Parent 1451 0 R +/Parent 1419 0 R +/Prev 1451 0 R /Next 1459 0 R >> endobj 1451 0 obj << /Title 1452 0 R /A 1449 0 R -/Parent 1299 0 R -/Prev 1411 0 R -/Next 1523 0 R -/First 1455 0 R -/Last 1519 0 R -/Count -6 +/Parent 1419 0 R +/Prev 1447 0 R +/Next 1455 0 R >> endobj 1447 0 obj << /Title 1448 0 R /A 1445 0 R -/Parent 1439 0 R +/Parent 1419 0 R /Prev 1443 0 R +/Next 1451 0 R >> endobj 1443 0 obj << /Title 1444 0 R /A 1441 0 R -/Parent 1439 0 R +/Parent 1419 0 R +/Prev 1439 0 R /Next 1447 0 R >> endobj 1439 0 obj << /Title 1440 0 R /A 1437 0 R -/Parent 1411 0 R -/Prev 1431 0 R -/First 1443 0 R -/Last 1447 0 R -/Count -2 +/Parent 1419 0 R +/Prev 1435 0 R +/Next 1443 0 R >> endobj 1435 0 obj << /Title 1436 0 R /A 1433 0 R -/Parent 1431 0 R +/Parent 1419 0 R +/Prev 1431 0 R +/Next 1439 0 R >> endobj 1431 0 obj << /Title 1432 0 R /A 1429 0 R -/Parent 1411 0 R +/Parent 1419 0 R /Prev 1427 0 R -/Next 1439 0 R -/First 1435 0 R -/Last 1435 0 R -/Count -1 +/Next 1435 0 R >> endobj 1427 0 obj << /Title 1428 0 R /A 1425 0 R -/Parent 1411 0 R +/Parent 1419 0 R /Prev 1423 0 R /Next 1431 0 R >> endobj 1423 0 obj << /Title 1424 0 R /A 1421 0 R -/Parent 1411 0 R -/Prev 1419 0 R +/Parent 1419 0 R /Next 1427 0 R >> endobj 1419 0 obj << /Title 1420 0 R /A 1417 0 R -/Parent 1411 0 R -/Prev 1415 0 R -/Next 1423 0 R +/Parent 1327 0 R +/Prev 1383 0 R +/Next 1499 0 R +/First 1423 0 R +/Last 1495 0 R +/Count -19 >> endobj 1415 0 obj << /Title 1416 0 R /A 1413 0 R -/Parent 1411 0 R -/Next 1419 0 R +/Parent 1383 0 R +/Prev 1411 0 R >> endobj 1411 0 obj << /Title 1412 0 R /A 1409 0 R -/Parent 1299 0 R -/Prev 1363 0 R -/Next 1451 0 R -/First 1415 0 R -/Last 1439 0 R -/Count -6 +/Parent 1383 0 R +/Prev 1407 0 R +/Next 1415 0 R >> endobj 1407 0 obj << /Title 1408 0 R /A 1405 0 R -/Parent 1399 0 R +/Parent 1383 0 R /Prev 1403 0 R +/Next 1411 0 R >> endobj 1403 0 obj << /Title 1404 0 R /A 1401 0 R -/Parent 1399 0 R +/Parent 1383 0 R +/Prev 1399 0 R /Next 1407 0 R >> endobj 1399 0 obj << /Title 1400 0 R /A 1397 0 R -/Parent 1363 0 R -/Prev 1367 0 R -/First 1403 0 R -/Last 1407 0 R -/Count -2 +/Parent 1383 0 R +/Prev 1395 0 R +/Next 1403 0 R >> endobj 1395 0 obj << /Title 1396 0 R /A 1393 0 R -/Parent 1367 0 R -/Prev 1371 0 R +/Parent 1383 0 R +/Prev 1391 0 R +/Next 1399 0 R >> endobj 1391 0 obj << /Title 1392 0 R /A 1389 0 R -/Parent 1371 0 R +/Parent 1383 0 R /Prev 1387 0 R +/Next 1395 0 R >> endobj 1387 0 obj << /Title 1388 0 R /A 1385 0 R -/Parent 1371 0 R -/Prev 1383 0 R +/Parent 1383 0 R /Next 1391 0 R >> endobj 1383 0 obj << /Title 1384 0 R /A 1381 0 R -/Parent 1371 0 R -/Prev 1379 0 R -/Next 1387 0 R +/Parent 1327 0 R +/Prev 1359 0 R +/Next 1419 0 R +/First 1387 0 R +/Last 1415 0 R +/Count -8 >> endobj 1379 0 obj << /Title 1380 0 R /A 1377 0 R -/Parent 1371 0 R +/Parent 1359 0 R /Prev 1375 0 R -/Next 1383 0 R >> endobj 1375 0 obj << /Title 1376 0 R /A 1373 0 R -/Parent 1371 0 R +/Parent 1359 0 R +/Prev 1371 0 R /Next 1379 0 R >> endobj 1371 0 obj << /Title 1372 0 R /A 1369 0 R -/Parent 1367 0 R -/Next 1395 0 R -/First 1375 0 R -/Last 1391 0 R -/Count -5 +/Parent 1359 0 R +/Prev 1367 0 R +/Next 1375 0 R >> endobj 1367 0 obj << /Title 1368 0 R /A 1365 0 R -/Parent 1363 0 R -/Next 1399 0 R -/First 1371 0 R -/Last 1395 0 R -/Count -2 +/Parent 1359 0 R +/Prev 1363 0 R +/Next 1371 0 R >> endobj 1363 0 obj << /Title 1364 0 R /A 1361 0 R -/Parent 1299 0 R -/Prev 1303 0 R -/Next 1411 0 R -/First 1367 0 R -/Last 1399 0 R -/Count -2 +/Parent 1359 0 R +/Next 1367 0 R >> endobj 1359 0 obj << /Title 1360 0 R /A 1357 0 R -/Parent 1351 0 R -/Prev 1355 0 R +/Parent 1327 0 R +/Prev 1343 0 R +/Next 1383 0 R +/First 1363 0 R +/Last 1379 0 R +/Count -5 >> endobj 1355 0 obj << /Title 1356 0 R /A 1353 0 R -/Parent 1351 0 R -/Next 1359 0 R +/Parent 1343 0 R +/Prev 1351 0 R >> endobj 1351 0 obj << /Title 1352 0 R /A 1349 0 R -/Parent 1303 0 R -/Prev 1335 0 R -/First 1355 0 R -/Last 1359 0 R -/Count -2 +/Parent 1343 0 R +/Prev 1347 0 R +/Next 1355 0 R >> endobj 1347 0 obj << /Title 1348 0 R /A 1345 0 R -/Parent 1339 0 R -/Prev 1343 0 R +/Parent 1343 0 R +/Next 1351 0 R >> endobj 1343 0 obj << /Title 1344 0 R /A 1341 0 R -/Parent 1339 0 R -/Next 1347 0 R +/Parent 1327 0 R +/Prev 1331 0 R +/Next 1359 0 R +/First 1347 0 R +/Last 1355 0 R +/Count -3 >> endobj 1339 0 obj << /Title 1340 0 R /A 1337 0 R -/Parent 1335 0 R -/First 1343 0 R -/Last 1347 0 R -/Count -2 +/Parent 1331 0 R +/Prev 1335 0 R >> endobj 1335 0 obj << /Title 1336 0 R /A 1333 0 R -/Parent 1303 0 R -/Prev 1331 0 R -/Next 1351 0 R -/First 1339 0 R -/Last 1339 0 R -/Count -1 +/Parent 1331 0 R +/Next 1339 0 R >> endobj 1331 0 obj << /Title 1332 0 R /A 1329 0 R -/Parent 1303 0 R -/Prev 1327 0 R -/Next 1335 0 R +/Parent 1327 0 R +/Next 1343 0 R +/First 1335 0 R +/Last 1339 0 R +/Count -2 >> endobj 1327 0 obj << /Title 1328 0 R /A 1325 0 R -/Parent 1303 0 R -/Prev 1307 0 R -/Next 1331 0 R +/Parent 455 0 R +/Prev 1079 0 R +/Next 1871 0 R +/First 1331 0 R +/Last 1851 0 R +/Count -19 >> endobj 1323 0 obj << /Title 1324 0 R @@ -18297,7 +35637,7 @@ endobj 1315 0 obj << /Title 1316 0 R /A 1313 0 R -/Parent 1307 0 R +/Parent 1079 0 R /Prev 1311 0 R /First 1319 0 R /Last 1323 0 R @@ -18306,90 +35646,86 @@ endobj 1311 0 obj << /Title 1312 0 R /A 1309 0 R -/Parent 1307 0 R +/Parent 1079 0 R +/Prev 1307 0 R /Next 1315 0 R >> endobj 1307 0 obj << /Title 1308 0 R /A 1305 0 R -/Parent 1303 0 R -/Next 1327 0 R -/First 1311 0 R -/Last 1315 0 R -/Count -2 +/Parent 1079 0 R +/Prev 1303 0 R +/Next 1311 0 R >> endobj 1303 0 obj << /Title 1304 0 R /A 1301 0 R -/Parent 1299 0 R -/Next 1363 0 R -/First 1307 0 R -/Last 1351 0 R -/Count -5 +/Parent 1079 0 R +/Prev 1299 0 R +/Next 1307 0 R >> endobj 1299 0 obj << /Title 1300 0 R /A 1297 0 R -/Parent 3770 0 R -/Prev 1223 0 R -/First 1303 0 R -/Last 1571 0 R -/Count -6 +/Parent 1079 0 R +/Prev 1279 0 R +/Next 1303 0 R >> endobj 1295 0 obj << /Title 1296 0 R /A 1293 0 R -/Parent 1271 0 R +/Parent 1279 0 R /Prev 1291 0 R >> endobj 1291 0 obj << /Title 1292 0 R /A 1289 0 R -/Parent 1271 0 R +/Parent 1279 0 R /Prev 1287 0 R /Next 1295 0 R >> endobj 1287 0 obj << /Title 1288 0 R /A 1285 0 R -/Parent 1271 0 R +/Parent 1279 0 R /Prev 1283 0 R /Next 1291 0 R >> endobj 1283 0 obj << /Title 1284 0 R /A 1281 0 R -/Parent 1271 0 R -/Prev 1279 0 R +/Parent 1279 0 R /Next 1287 0 R >> endobj 1279 0 obj << /Title 1280 0 R /A 1277 0 R -/Parent 1271 0 R -/Prev 1275 0 R -/Next 1283 0 R +/Parent 1079 0 R +/Prev 1247 0 R +/Next 1299 0 R +/First 1283 0 R +/Last 1295 0 R +/Count -4 >> endobj 1275 0 obj << /Title 1276 0 R /A 1273 0 R -/Parent 1271 0 R -/Next 1279 0 R +/Parent 1247 0 R +/Prev 1271 0 R >> endobj 1271 0 obj << /Title 1272 0 R /A 1269 0 R -/Parent 1223 0 R -/Prev 1247 0 R -/First 1275 0 R -/Last 1295 0 R -/Count -6 +/Parent 1247 0 R +/Prev 1267 0 R +/Next 1275 0 R >> endobj 1267 0 obj << /Title 1268 0 R /A 1265 0 R /Parent 1247 0 R /Prev 1263 0 R +/Next 1271 0 R >> endobj 1263 0 obj << /Title 1264 0 R @@ -18421,12 +35757,12 @@ endobj 1247 0 obj << /Title 1248 0 R /A 1245 0 R -/Parent 1223 0 R +/Parent 1079 0 R /Prev 1227 0 R -/Next 1271 0 R +/Next 1279 0 R /First 1251 0 R -/Last 1267 0 R -/Count -5 +/Last 1275 0 R +/Count -7 >> endobj 1243 0 obj << /Title 1244 0 R @@ -18457,7 +35793,8 @@ endobj 1227 0 obj << /Title 1228 0 R /A 1225 0 R -/Parent 1223 0 R +/Parent 1079 0 R +/Prev 1179 0 R /Next 1247 0 R /First 1231 0 R /Last 1243 0 R @@ -18466,272 +35803,269 @@ endobj 1223 0 obj << /Title 1224 0 R /A 1221 0 R -/Parent 3770 0 R -/Prev 295 0 R -/Next 1299 0 R -/First 1227 0 R -/Last 1271 0 R -/Count -3 +/Parent 1187 0 R +/Prev 1219 0 R >> endobj 1219 0 obj << /Title 1220 0 R /A 1217 0 R -/Parent 1191 0 R +/Parent 1187 0 R /Prev 1215 0 R +/Next 1223 0 R >> endobj 1215 0 obj << /Title 1216 0 R /A 1213 0 R -/Parent 1191 0 R -/Prev 1203 0 R +/Parent 1187 0 R +/Prev 1211 0 R /Next 1219 0 R >> endobj 1211 0 obj << /Title 1212 0 R /A 1209 0 R -/Parent 1203 0 R +/Parent 1187 0 R /Prev 1207 0 R +/Next 1215 0 R >> endobj 1207 0 obj << /Title 1208 0 R /A 1205 0 R -/Parent 1203 0 R +/Parent 1187 0 R +/Prev 1203 0 R /Next 1211 0 R >> endobj 1203 0 obj << /Title 1204 0 R /A 1201 0 R -/Parent 1191 0 R +/Parent 1187 0 R /Prev 1199 0 R -/Next 1215 0 R -/First 1207 0 R -/Last 1211 0 R -/Count -2 +/Next 1207 0 R >> endobj 1199 0 obj << /Title 1200 0 R /A 1197 0 R -/Parent 1191 0 R +/Parent 1187 0 R /Prev 1195 0 R /Next 1203 0 R >> endobj 1195 0 obj << /Title 1196 0 R /A 1193 0 R -/Parent 1191 0 R +/Parent 1187 0 R +/Prev 1191 0 R /Next 1199 0 R >> endobj 1191 0 obj << /Title 1192 0 R /A 1189 0 R -/Parent 295 0 R -/Prev 1171 0 R -/First 1195 0 R -/Last 1219 0 R -/Count -5 +/Parent 1187 0 R +/Next 1195 0 R >> endobj 1187 0 obj << /Title 1188 0 R /A 1185 0 R -/Parent 1171 0 R +/Parent 1179 0 R /Prev 1183 0 R +/First 1191 0 R +/Last 1223 0 R +/Count -9 >> endobj 1183 0 obj << /Title 1184 0 R /A 1181 0 R -/Parent 1171 0 R -/Prev 1179 0 R +/Parent 1179 0 R /Next 1187 0 R >> endobj 1179 0 obj << /Title 1180 0 R /A 1177 0 R -/Parent 1171 0 R -/Prev 1175 0 R -/Next 1183 0 R +/Parent 1079 0 R +/Prev 1155 0 R +/Next 1227 0 R +/First 1183 0 R +/Last 1187 0 R +/Count -2 >> endobj 1175 0 obj << /Title 1176 0 R /A 1173 0 R -/Parent 1171 0 R -/Next 1179 0 R +/Parent 1155 0 R +/Prev 1171 0 R >> endobj 1171 0 obj << /Title 1172 0 R /A 1169 0 R -/Parent 295 0 R -/Prev 1139 0 R -/Next 1191 0 R -/First 1175 0 R -/Last 1187 0 R -/Count -4 +/Parent 1155 0 R +/Prev 1167 0 R +/Next 1175 0 R >> endobj 1167 0 obj << /Title 1168 0 R /A 1165 0 R -/Parent 1139 0 R +/Parent 1155 0 R /Prev 1163 0 R +/Next 1171 0 R >> endobj 1163 0 obj << /Title 1164 0 R /A 1161 0 R -/Parent 1139 0 R +/Parent 1155 0 R /Prev 1159 0 R /Next 1167 0 R >> endobj 1159 0 obj << /Title 1160 0 R /A 1157 0 R -/Parent 1139 0 R -/Prev 1155 0 R +/Parent 1155 0 R /Next 1163 0 R >> endobj 1155 0 obj << /Title 1156 0 R /A 1153 0 R -/Parent 1139 0 R -/Prev 1151 0 R -/Next 1159 0 R +/Parent 1079 0 R +/Prev 1127 0 R +/Next 1179 0 R +/First 1159 0 R +/Last 1175 0 R +/Count -5 >> endobj 1151 0 obj << /Title 1152 0 R /A 1149 0 R -/Parent 1139 0 R +/Parent 1127 0 R /Prev 1147 0 R -/Next 1155 0 R >> endobj 1147 0 obj << /Title 1148 0 R /A 1145 0 R -/Parent 1139 0 R +/Parent 1127 0 R /Prev 1143 0 R /Next 1151 0 R >> endobj 1143 0 obj << /Title 1144 0 R /A 1141 0 R -/Parent 1139 0 R +/Parent 1127 0 R +/Prev 1139 0 R /Next 1147 0 R >> endobj 1139 0 obj << /Title 1140 0 R /A 1137 0 R -/Parent 295 0 R -/Prev 1091 0 R -/Next 1171 0 R -/First 1143 0 R -/Last 1167 0 R -/Count -7 +/Parent 1127 0 R +/Prev 1135 0 R +/Next 1143 0 R >> endobj 1135 0 obj << /Title 1136 0 R /A 1133 0 R -/Parent 1115 0 R +/Parent 1127 0 R /Prev 1131 0 R +/Next 1139 0 R >> endobj 1131 0 obj << /Title 1132 0 R /A 1129 0 R -/Parent 1115 0 R -/Prev 1127 0 R +/Parent 1127 0 R /Next 1135 0 R >> endobj 1127 0 obj << /Title 1128 0 R /A 1125 0 R -/Parent 1115 0 R +/Parent 1079 0 R /Prev 1123 0 R -/Next 1131 0 R +/Next 1155 0 R +/First 1131 0 R +/Last 1151 0 R +/Count -6 >> endobj 1123 0 obj << /Title 1124 0 R /A 1121 0 R -/Parent 1115 0 R -/Prev 1119 0 R +/Parent 1079 0 R +/Prev 1111 0 R /Next 1127 0 R >> endobj 1119 0 obj << /Title 1120 0 R /A 1117 0 R -/Parent 1115 0 R -/Next 1123 0 R +/Parent 1111 0 R +/Prev 1115 0 R >> endobj 1115 0 obj << /Title 1116 0 R /A 1113 0 R -/Parent 1091 0 R -/Prev 1095 0 R -/First 1119 0 R -/Last 1135 0 R -/Count -5 +/Parent 1111 0 R +/Next 1119 0 R >> endobj 1111 0 obj << /Title 1112 0 R /A 1109 0 R -/Parent 1095 0 R -/Prev 1107 0 R +/Parent 1079 0 R +/Prev 1087 0 R +/Next 1123 0 R +/First 1115 0 R +/Last 1119 0 R +/Count -2 >> endobj 1107 0 obj << /Title 1108 0 R /A 1105 0 R -/Parent 1095 0 R +/Parent 1087 0 R /Prev 1103 0 R -/Next 1111 0 R >> endobj 1103 0 obj << /Title 1104 0 R /A 1101 0 R -/Parent 1095 0 R +/Parent 1087 0 R /Prev 1099 0 R /Next 1107 0 R >> endobj 1099 0 obj << /Title 1100 0 R /A 1097 0 R -/Parent 1095 0 R +/Parent 1087 0 R +/Prev 1095 0 R /Next 1103 0 R >> endobj 1095 0 obj << /Title 1096 0 R /A 1093 0 R -/Parent 1091 0 R -/Next 1115 0 R -/First 1099 0 R -/Last 1111 0 R -/Count -4 +/Parent 1087 0 R +/Prev 1091 0 R +/Next 1099 0 R >> endobj 1091 0 obj << /Title 1092 0 R /A 1089 0 R -/Parent 295 0 R -/Prev 1079 0 R -/Next 1139 0 R -/First 1095 0 R -/Last 1115 0 R -/Count -2 +/Parent 1087 0 R +/Next 1095 0 R >> endobj 1087 0 obj << /Title 1088 0 R /A 1085 0 R -/Parent 1083 0 R +/Parent 1079 0 R +/Prev 1083 0 R +/Next 1111 0 R +/First 1091 0 R +/Last 1107 0 R +/Count -5 >> endobj 1083 0 obj << /Title 1084 0 R /A 1081 0 R /Parent 1079 0 R -/First 1087 0 R -/Last 1087 0 R -/Count -1 +/Next 1087 0 R >> endobj 1079 0 obj << /Title 1080 0 R /A 1077 0 R -/Parent 295 0 R -/Prev 1039 0 R -/Next 1091 0 R +/Parent 455 0 R +/Prev 1067 0 R +/Next 1327 0 R /First 1083 0 R -/Last 1083 0 R -/Count -1 +/Last 1315 0 R +/Count -15 >> endobj 1075 0 obj << /Title 1076 0 R @@ -18748,8 +36082,9 @@ endobj 1067 0 obj << /Title 1068 0 R /A 1065 0 R -/Parent 1039 0 R -/Prev 1047 0 R +/Parent 455 0 R +/Prev 1023 0 R +/Next 1079 0 R /First 1071 0 R /Last 1075 0 R /Count -2 @@ -18757,22 +36092,22 @@ endobj 1063 0 obj << /Title 1064 0 R /A 1061 0 R -/Parent 1047 0 R -/Prev 1059 0 R +/Parent 1059 0 R >> endobj 1059 0 obj << /Title 1060 0 R /A 1057 0 R -/Parent 1047 0 R -/Prev 1055 0 R -/Next 1063 0 R +/Parent 1023 0 R +/Prev 1047 0 R +/First 1063 0 R +/Last 1063 0 R +/Count -1 >> endobj 1055 0 obj << /Title 1056 0 R /A 1053 0 R /Parent 1047 0 R /Prev 1051 0 R -/Next 1059 0 R >> endobj 1051 0 obj << /Title 1052 0 R @@ -18783,121 +36118,119 @@ endobj 1047 0 obj << /Title 1048 0 R /A 1045 0 R -/Parent 1039 0 R -/Prev 1043 0 R -/Next 1067 0 R +/Parent 1023 0 R +/Prev 1035 0 R +/Next 1059 0 R /First 1051 0 R -/Last 1063 0 R -/Count -4 +/Last 1055 0 R +/Count -2 >> endobj 1043 0 obj << /Title 1044 0 R /A 1041 0 R -/Parent 1039 0 R -/Next 1047 0 R +/Parent 1035 0 R +/Prev 1039 0 R >> endobj 1039 0 obj << /Title 1040 0 R /A 1037 0 R -/Parent 295 0 R -/Prev 1003 0 R -/Next 1079 0 R -/First 1043 0 R -/Last 1067 0 R -/Count -3 +/Parent 1035 0 R +/Next 1043 0 R >> endobj 1035 0 obj << /Title 1036 0 R /A 1033 0 R -/Parent 1003 0 R -/Prev 1007 0 R +/Parent 1023 0 R +/Prev 1031 0 R +/Next 1047 0 R +/First 1039 0 R +/Last 1043 0 R +/Count -2 >> endobj 1031 0 obj << /Title 1032 0 R /A 1029 0 R -/Parent 1015 0 R +/Parent 1023 0 R /Prev 1027 0 R +/Next 1035 0 R >> endobj 1027 0 obj << /Title 1028 0 R /A 1025 0 R -/Parent 1015 0 R -/Prev 1023 0 R +/Parent 1023 0 R /Next 1031 0 R >> endobj 1023 0 obj << /Title 1024 0 R /A 1021 0 R -/Parent 1015 0 R -/Prev 1019 0 R -/Next 1027 0 R +/Parent 455 0 R +/Prev 967 0 R +/Next 1067 0 R +/First 1027 0 R +/Last 1059 0 R +/Count -5 >> endobj 1019 0 obj << /Title 1020 0 R /A 1017 0 R -/Parent 1015 0 R -/Next 1023 0 R +/Parent 1011 0 R +/Prev 1015 0 R >> endobj 1015 0 obj << /Title 1016 0 R /A 1013 0 R -/Parent 1007 0 R -/Prev 1011 0 R -/First 1019 0 R -/Last 1031 0 R -/Count -4 +/Parent 1011 0 R +/Next 1019 0 R >> endobj 1011 0 obj << /Title 1012 0 R /A 1009 0 R -/Parent 1007 0 R -/Next 1015 0 R +/Parent 967 0 R +/Prev 1007 0 R +/First 1015 0 R +/Last 1019 0 R +/Count -2 >> endobj 1007 0 obj << /Title 1008 0 R /A 1005 0 R -/Parent 1003 0 R -/Next 1035 0 R -/First 1011 0 R -/Last 1015 0 R -/Count -2 +/Parent 967 0 R +/Prev 979 0 R +/Next 1011 0 R >> endobj 1003 0 obj << /Title 1004 0 R /A 1001 0 R -/Parent 295 0 R -/Prev 971 0 R -/Next 1039 0 R -/First 1007 0 R -/Last 1035 0 R -/Count -2 +/Parent 979 0 R +/Prev 999 0 R >> endobj 999 0 obj << /Title 1000 0 R /A 997 0 R -/Parent 991 0 R +/Parent 979 0 R /Prev 995 0 R +/Next 1003 0 R >> endobj 995 0 obj << /Title 996 0 R /A 993 0 R -/Parent 991 0 R +/Parent 979 0 R +/Prev 991 0 R /Next 999 0 R >> endobj 991 0 obj << /Title 992 0 R /A 989 0 R -/Parent 971 0 R -/Prev 979 0 R -/First 995 0 R -/Last 999 0 R -/Count -2 +/Parent 979 0 R +/Prev 987 0 R +/Next 995 0 R >> endobj 987 0 obj << /Title 988 0 R /A 985 0 R /Parent 979 0 R /Prev 983 0 R +/Next 991 0 R >> endobj 983 0 obj << /Title 984 0 R @@ -18908,41 +36241,41 @@ endobj 979 0 obj << /Title 980 0 R /A 977 0 R -/Parent 971 0 R +/Parent 967 0 R /Prev 975 0 R -/Next 991 0 R +/Next 1007 0 R /First 983 0 R -/Last 987 0 R -/Count -2 +/Last 1003 0 R +/Count -6 >> endobj 975 0 obj << /Title 976 0 R /A 973 0 R -/Parent 971 0 R +/Parent 967 0 R +/Prev 971 0 R /Next 979 0 R >> endobj 971 0 obj << /Title 972 0 R /A 969 0 R -/Parent 295 0 R -/Prev 875 0 R -/Next 1003 0 R -/First 975 0 R -/Last 991 0 R -/Count -3 +/Parent 967 0 R +/Next 975 0 R >> endobj 967 0 obj << /Title 968 0 R /A 965 0 R -/Parent 951 0 R -/Prev 963 0 R +/Parent 455 0 R +/Prev 871 0 R +/Next 1023 0 R +/First 971 0 R +/Last 1011 0 R +/Count -5 >> endobj 963 0 obj << /Title 964 0 R /A 961 0 R -/Parent 951 0 R +/Parent 871 0 R /Prev 955 0 R -/Next 967 0 R >> endobj 959 0 obj << /Title 960 0 R @@ -18952,7 +36285,8 @@ endobj 955 0 obj << /Title 956 0 R /A 953 0 R -/Parent 951 0 R +/Parent 871 0 R +/Prev 951 0 R /Next 963 0 R /First 959 0 R /Last 959 0 R @@ -18961,102 +36295,102 @@ endobj 951 0 obj << /Title 952 0 R /A 949 0 R -/Parent 875 0 R -/Prev 947 0 R -/First 955 0 R -/Last 967 0 R -/Count -3 +/Parent 871 0 R +/Prev 939 0 R +/Next 955 0 R >> endobj 947 0 obj << /Title 948 0 R /A 945 0 R -/Parent 875 0 R +/Parent 939 0 R /Prev 943 0 R -/Next 951 0 R >> endobj 943 0 obj << /Title 944 0 R /A 941 0 R -/Parent 875 0 R -/Prev 879 0 R +/Parent 939 0 R /Next 947 0 R >> endobj 939 0 obj << /Title 940 0 R /A 937 0 R -/Parent 923 0 R -/Prev 935 0 R +/Parent 871 0 R +/Prev 923 0 R +/Next 951 0 R +/First 943 0 R +/Last 947 0 R +/Count -2 >> endobj 935 0 obj << /Title 936 0 R /A 933 0 R -/Parent 923 0 R +/Parent 927 0 R /Prev 931 0 R -/Next 939 0 R >> endobj 931 0 obj << /Title 932 0 R /A 929 0 R -/Parent 923 0 R -/Prev 927 0 R +/Parent 927 0 R /Next 935 0 R >> endobj 927 0 obj << /Title 928 0 R /A 925 0 R /Parent 923 0 R -/Next 931 0 R +/First 931 0 R +/Last 935 0 R +/Count -2 >> endobj 923 0 obj << /Title 924 0 R /A 921 0 R -/Parent 879 0 R -/Prev 919 0 R +/Parent 871 0 R +/Prev 879 0 R +/Next 939 0 R /First 927 0 R -/Last 939 0 R -/Count -4 +/Last 927 0 R +/Count -1 >> endobj 919 0 obj << /Title 920 0 R /A 917 0 R -/Parent 879 0 R -/Prev 903 0 R -/Next 923 0 R +/Parent 883 0 R +/Prev 915 0 R >> endobj 915 0 obj << /Title 916 0 R /A 913 0 R -/Parent 903 0 R +/Parent 883 0 R /Prev 911 0 R +/Next 919 0 R >> endobj 911 0 obj << /Title 912 0 R /A 909 0 R -/Parent 903 0 R +/Parent 883 0 R /Prev 907 0 R /Next 915 0 R >> endobj 907 0 obj << /Title 908 0 R /A 905 0 R -/Parent 903 0 R +/Parent 883 0 R +/Prev 903 0 R /Next 911 0 R >> endobj 903 0 obj << /Title 904 0 R /A 901 0 R -/Parent 879 0 R -/Prev 883 0 R -/Next 919 0 R -/First 907 0 R -/Last 915 0 R -/Count -3 +/Parent 883 0 R +/Prev 899 0 R +/Next 907 0 R >> endobj 899 0 obj << /Title 900 0 R /A 897 0 R /Parent 883 0 R /Prev 895 0 R +/Next 903 0 R >> endobj 895 0 obj << /Title 896 0 R @@ -19082,35 +36416,35 @@ endobj /Title 884 0 R /A 881 0 R /Parent 879 0 R -/Next 903 0 R /First 887 0 R -/Last 899 0 R -/Count -4 +/Last 919 0 R +/Count -9 >> endobj 879 0 obj << /Title 880 0 R /A 877 0 R -/Parent 875 0 R -/Next 943 0 R +/Parent 871 0 R +/Prev 875 0 R +/Next 923 0 R /First 883 0 R -/Last 923 0 R -/Count -4 +/Last 883 0 R +/Count -1 >> endobj 875 0 obj << /Title 876 0 R /A 873 0 R -/Parent 295 0 R -/Prev 831 0 R -/Next 971 0 R -/First 879 0 R -/Last 951 0 R -/Count -4 +/Parent 871 0 R +/Next 879 0 R >> endobj 871 0 obj << /Title 872 0 R /A 869 0 R -/Parent 831 0 R -/Prev 859 0 R +/Parent 455 0 R +/Prev 763 0 R +/Next 967 0 R +/First 875 0 R +/Last 963 0 R +/Count -7 >> endobj 867 0 obj << /Title 868 0 R @@ -19127,9 +36461,8 @@ endobj 859 0 obj << /Title 860 0 R /A 857 0 R -/Parent 831 0 R -/Prev 835 0 R -/Next 871 0 R +/Parent 763 0 R +/Prev 819 0 R /First 863 0 R /Last 867 0 R /Count -2 @@ -19137,31 +36470,28 @@ endobj 855 0 obj << /Title 856 0 R /A 853 0 R -/Parent 851 0 R +/Parent 819 0 R +/Prev 851 0 R >> endobj 851 0 obj << /Title 852 0 R /A 849 0 R -/Parent 835 0 R -/Prev 843 0 R -/First 855 0 R -/Last 855 0 R -/Count -1 +/Parent 819 0 R +/Prev 847 0 R +/Next 855 0 R >> endobj 847 0 obj << /Title 848 0 R /A 845 0 R -/Parent 843 0 R +/Parent 819 0 R +/Prev 835 0 R +/Next 851 0 R >> endobj 843 0 obj << /Title 844 0 R /A 841 0 R /Parent 835 0 R /Prev 839 0 R -/Next 851 0 R -/First 847 0 R -/Last 847 0 R -/Count -1 >> endobj 839 0 obj << /Title 840 0 R @@ -19172,42 +36502,42 @@ endobj 835 0 obj << /Title 836 0 R /A 833 0 R -/Parent 831 0 R -/Next 859 0 R +/Parent 819 0 R +/Prev 831 0 R +/Next 847 0 R /First 839 0 R -/Last 851 0 R -/Count -3 +/Last 843 0 R +/Count -2 >> endobj 831 0 obj << /Title 832 0 R /A 829 0 R -/Parent 295 0 R -/Prev 799 0 R -/Next 875 0 R -/First 835 0 R -/Last 871 0 R -/Count -3 +/Parent 819 0 R +/Prev 827 0 R +/Next 835 0 R >> endobj 827 0 obj << /Title 828 0 R /A 825 0 R -/Parent 823 0 R +/Parent 819 0 R +/Prev 823 0 R +/Next 831 0 R >> endobj 823 0 obj << /Title 824 0 R /A 821 0 R -/Parent 799 0 R -/Prev 819 0 R -/First 827 0 R -/Last 827 0 R -/Count -1 +/Parent 819 0 R +/Next 827 0 R >> endobj 819 0 obj << /Title 820 0 R /A 817 0 R -/Parent 799 0 R +/Parent 763 0 R /Prev 803 0 R -/Next 823 0 R +/Next 859 0 R +/First 823 0 R +/Last 855 0 R +/Count -7 >> endobj 815 0 obj << /Title 816 0 R @@ -19232,7 +36562,8 @@ endobj 803 0 obj << /Title 804 0 R /A 801 0 R -/Parent 799 0 R +/Parent 763 0 R +/Prev 787 0 R /Next 819 0 R /First 807 0 R /Last 807 0 R @@ -19241,362 +36572,362 @@ endobj 799 0 obj << /Title 800 0 R /A 797 0 R -/Parent 295 0 R -/Prev 695 0 R -/Next 831 0 R -/First 803 0 R -/Last 823 0 R -/Count -3 +/Parent 787 0 R +/Prev 795 0 R >> endobj 795 0 obj << /Title 796 0 R /A 793 0 R -/Parent 695 0 R +/Parent 787 0 R /Prev 791 0 R +/Next 799 0 R >> endobj 791 0 obj << /Title 792 0 R /A 789 0 R -/Parent 695 0 R -/Prev 743 0 R +/Parent 787 0 R /Next 795 0 R >> endobj 787 0 obj << /Title 788 0 R /A 785 0 R -/Parent 755 0 R -/Prev 783 0 R +/Parent 763 0 R +/Prev 771 0 R +/Next 803 0 R +/First 791 0 R +/Last 799 0 R +/Count -3 >> endobj 783 0 obj << /Title 784 0 R /A 781 0 R -/Parent 755 0 R +/Parent 771 0 R /Prev 779 0 R -/Next 787 0 R >> endobj 779 0 obj << /Title 780 0 R /A 777 0 R -/Parent 755 0 R +/Parent 771 0 R /Prev 775 0 R /Next 783 0 R >> endobj 775 0 obj << /Title 776 0 R /A 773 0 R -/Parent 755 0 R -/Prev 771 0 R +/Parent 771 0 R /Next 779 0 R >> endobj 771 0 obj << /Title 772 0 R /A 769 0 R -/Parent 755 0 R +/Parent 763 0 R /Prev 767 0 R -/Next 775 0 R +/Next 787 0 R +/First 775 0 R +/Last 783 0 R +/Count -3 >> endobj 767 0 obj << /Title 768 0 R /A 765 0 R -/Parent 755 0 R -/Prev 763 0 R +/Parent 763 0 R /Next 771 0 R >> endobj 763 0 obj << /Title 764 0 R /A 761 0 R -/Parent 755 0 R -/Prev 759 0 R -/Next 767 0 R +/Parent 455 0 R +/Prev 723 0 R +/Next 871 0 R +/First 767 0 R +/Last 859 0 R +/Count -6 >> endobj 759 0 obj << /Title 760 0 R /A 757 0 R -/Parent 755 0 R -/Next 763 0 R +/Parent 751 0 R +/Prev 755 0 R >> endobj 755 0 obj << /Title 756 0 R /A 753 0 R -/Parent 743 0 R -/Prev 751 0 R -/First 759 0 R -/Last 787 0 R -/Count -8 +/Parent 751 0 R +/Next 759 0 R >> endobj 751 0 obj << /Title 752 0 R /A 749 0 R -/Parent 743 0 R -/Prev 747 0 R -/Next 755 0 R +/Parent 723 0 R +/Prev 739 0 R +/First 755 0 R +/Last 759 0 R +/Count -2 >> endobj 747 0 obj << /Title 748 0 R /A 745 0 R -/Parent 743 0 R -/Next 751 0 R +/Parent 739 0 R +/Prev 743 0 R >> endobj 743 0 obj << /Title 744 0 R /A 741 0 R -/Parent 695 0 R -/Prev 715 0 R -/Next 791 0 R -/First 747 0 R -/Last 755 0 R -/Count -3 +/Parent 739 0 R +/Next 747 0 R >> endobj 739 0 obj << /Title 740 0 R /A 737 0 R -/Parent 715 0 R -/Prev 735 0 R +/Parent 723 0 R +/Prev 731 0 R +/Next 751 0 R +/First 743 0 R +/Last 747 0 R +/Count -2 >> endobj 735 0 obj << /Title 736 0 R /A 733 0 R -/Parent 715 0 R -/Prev 731 0 R -/Next 739 0 R +/Parent 731 0 R >> endobj 731 0 obj << /Title 732 0 R /A 729 0 R -/Parent 715 0 R +/Parent 723 0 R /Prev 727 0 R -/Next 735 0 R +/Next 739 0 R +/First 735 0 R +/Last 735 0 R +/Count -1 >> endobj 727 0 obj << /Title 728 0 R /A 725 0 R -/Parent 715 0 R -/Prev 723 0 R +/Parent 723 0 R /Next 731 0 R >> endobj 723 0 obj << /Title 724 0 R /A 721 0 R -/Parent 715 0 R -/Prev 719 0 R -/Next 727 0 R +/Parent 455 0 R +/Prev 583 0 R +/Next 763 0 R +/First 727 0 R +/Last 751 0 R +/Count -4 >> endobj 719 0 obj << /Title 720 0 R /A 717 0 R -/Parent 715 0 R -/Next 723 0 R +/Parent 707 0 R +/Prev 715 0 R >> endobj 715 0 obj << /Title 716 0 R /A 713 0 R -/Parent 695 0 R -/Prev 707 0 R -/Next 743 0 R -/First 719 0 R -/Last 739 0 R -/Count -6 +/Parent 707 0 R +/Prev 711 0 R +/Next 719 0 R >> endobj 711 0 obj << /Title 712 0 R /A 709 0 R /Parent 707 0 R +/Next 715 0 R >> endobj 707 0 obj << /Title 708 0 R /A 705 0 R -/Parent 695 0 R -/Prev 703 0 R -/Next 715 0 R +/Parent 583 0 R +/Prev 623 0 R /First 711 0 R -/Last 711 0 R -/Count -1 +/Last 719 0 R +/Count -3 >> endobj 703 0 obj << /Title 704 0 R /A 701 0 R -/Parent 695 0 R -/Prev 699 0 R -/Next 707 0 R +/Parent 623 0 R +/Prev 683 0 R >> endobj 699 0 obj << /Title 700 0 R /A 697 0 R -/Parent 695 0 R -/Next 703 0 R +/Parent 683 0 R +/Prev 695 0 R >> endobj 695 0 obj << /Title 696 0 R /A 693 0 R -/Parent 295 0 R -/Prev 635 0 R -/Next 799 0 R -/First 699 0 R -/Last 795 0 R -/Count -7 +/Parent 683 0 R +/Prev 691 0 R +/Next 699 0 R >> endobj 691 0 obj << /Title 692 0 R /A 689 0 R -/Parent 635 0 R +/Parent 683 0 R /Prev 687 0 R +/Next 695 0 R >> endobj 687 0 obj << /Title 688 0 R /A 685 0 R -/Parent 635 0 R -/Prev 683 0 R +/Parent 683 0 R /Next 691 0 R >> endobj 683 0 obj << /Title 684 0 R /A 681 0 R -/Parent 635 0 R -/Prev 675 0 R -/Next 687 0 R +/Parent 623 0 R +/Prev 639 0 R +/Next 703 0 R +/First 687 0 R +/Last 699 0 R +/Count -4 >> endobj 679 0 obj << /Title 680 0 R /A 677 0 R -/Parent 675 0 R +/Parent 639 0 R +/Prev 675 0 R >> endobj 675 0 obj << /Title 676 0 R /A 673 0 R -/Parent 635 0 R +/Parent 639 0 R /Prev 671 0 R -/Next 683 0 R -/First 679 0 R -/Last 679 0 R -/Count -1 +/Next 679 0 R >> endobj 671 0 obj << /Title 672 0 R /A 669 0 R -/Parent 635 0 R -/Prev 663 0 R +/Parent 639 0 R +/Prev 667 0 R /Next 675 0 R >> endobj 667 0 obj << /Title 668 0 R /A 665 0 R -/Parent 663 0 R +/Parent 639 0 R +/Prev 663 0 R +/Next 671 0 R >> endobj 663 0 obj << /Title 664 0 R /A 661 0 R -/Parent 635 0 R +/Parent 639 0 R /Prev 659 0 R -/Next 671 0 R -/First 667 0 R -/Last 667 0 R -/Count -1 +/Next 667 0 R >> endobj 659 0 obj << /Title 660 0 R /A 657 0 R -/Parent 635 0 R +/Parent 639 0 R /Prev 655 0 R /Next 663 0 R >> endobj 655 0 obj << /Title 656 0 R /A 653 0 R -/Parent 635 0 R +/Parent 639 0 R /Prev 651 0 R /Next 659 0 R >> endobj 651 0 obj << /Title 652 0 R /A 649 0 R -/Parent 635 0 R +/Parent 639 0 R /Prev 647 0 R /Next 655 0 R >> endobj 647 0 obj << /Title 648 0 R /A 645 0 R -/Parent 635 0 R +/Parent 639 0 R /Prev 643 0 R /Next 651 0 R >> endobj 643 0 obj << /Title 644 0 R /A 641 0 R -/Parent 635 0 R -/Prev 639 0 R +/Parent 639 0 R /Next 647 0 R >> endobj 639 0 obj << /Title 640 0 R /A 637 0 R -/Parent 635 0 R -/Next 643 0 R +/Parent 623 0 R +/Prev 635 0 R +/Next 683 0 R +/First 643 0 R +/Last 679 0 R +/Count -10 >> endobj 635 0 obj << /Title 636 0 R /A 633 0 R -/Parent 295 0 R -/Prev 543 0 R -/Next 695 0 R -/First 639 0 R -/Last 691 0 R -/Count -12 +/Parent 623 0 R +/Prev 631 0 R +/Next 639 0 R >> endobj 631 0 obj << /Title 632 0 R /A 629 0 R -/Parent 595 0 R +/Parent 623 0 R /Prev 627 0 R +/Next 635 0 R >> endobj 627 0 obj << /Title 628 0 R /A 625 0 R -/Parent 595 0 R -/Prev 623 0 R +/Parent 623 0 R /Next 631 0 R >> endobj 623 0 obj << /Title 624 0 R /A 621 0 R -/Parent 595 0 R -/Prev 619 0 R -/Next 627 0 R +/Parent 583 0 R +/Prev 611 0 R +/Next 707 0 R +/First 627 0 R +/Last 703 0 R +/Count -6 >> endobj 619 0 obj << /Title 620 0 R /A 617 0 R -/Parent 595 0 R +/Parent 611 0 R /Prev 615 0 R -/Next 623 0 R >> endobj 615 0 obj << /Title 616 0 R /A 613 0 R -/Parent 595 0 R -/Prev 611 0 R +/Parent 611 0 R /Next 619 0 R >> endobj 611 0 obj << /Title 612 0 R /A 609 0 R -/Parent 595 0 R -/Prev 607 0 R -/Next 615 0 R +/Parent 583 0 R +/Prev 591 0 R +/Next 623 0 R +/First 615 0 R +/Last 619 0 R +/Count -2 >> endobj 607 0 obj << /Title 608 0 R /A 605 0 R -/Parent 595 0 R -/Prev 603 0 R -/Next 611 0 R +/Parent 591 0 R +/Prev 595 0 R >> endobj 603 0 obj << /Title 604 0 R /A 601 0 R /Parent 595 0 R /Prev 599 0 R -/Next 607 0 R >> endobj 599 0 obj << /Title 600 0 R @@ -19607,67 +36938,72 @@ endobj 595 0 obj << /Title 596 0 R /A 593 0 R -/Parent 543 0 R -/Prev 575 0 R +/Parent 591 0 R +/Next 607 0 R /First 599 0 R -/Last 631 0 R -/Count -9 +/Last 603 0 R +/Count -2 >> endobj 591 0 obj << /Title 592 0 R /A 589 0 R -/Parent 575 0 R +/Parent 583 0 R /Prev 587 0 R +/Next 611 0 R +/First 595 0 R +/Last 607 0 R +/Count -2 >> endobj 587 0 obj << /Title 588 0 R /A 585 0 R -/Parent 575 0 R -/Prev 583 0 R +/Parent 583 0 R /Next 591 0 R >> endobj 583 0 obj << /Title 584 0 R /A 581 0 R -/Parent 575 0 R -/Prev 579 0 R -/Next 587 0 R +/Parent 455 0 R +/Prev 459 0 R +/Next 723 0 R +/First 587 0 R +/Last 707 0 R +/Count -5 >> endobj 579 0 obj << /Title 580 0 R /A 577 0 R -/Parent 575 0 R -/Next 583 0 R +/Parent 571 0 R +/Prev 575 0 R >> endobj 575 0 obj << /Title 576 0 R /A 573 0 R -/Parent 543 0 R -/Prev 551 0 R -/Next 595 0 R -/First 579 0 R -/Last 591 0 R -/Count -4 +/Parent 571 0 R +/Next 579 0 R >> endobj 571 0 obj << /Title 572 0 R /A 569 0 R -/Parent 551 0 R -/Prev 567 0 R +/Parent 459 0 R +/Prev 551 0 R +/First 575 0 R +/Last 579 0 R +/Count -2 >> endobj 567 0 obj << /Title 568 0 R /A 565 0 R -/Parent 551 0 R -/Prev 563 0 R -/Next 571 0 R +/Parent 563 0 R >> endobj 563 0 obj << /Title 564 0 R /A 561 0 R /Parent 551 0 R /Prev 559 0 R -/Next 567 0 R +/First 567 0 R +/Last 567 0 R +/Count -1 >> endobj 559 0 obj << /Title 560 0 R @@ -19685,294 +37021,294 @@ endobj 551 0 obj << /Title 552 0 R /A 549 0 R -/Parent 543 0 R -/Prev 547 0 R -/Next 575 0 R -/First 555 0 R -/Last 571 0 R -/Count -5 +/Parent 459 0 R +/Prev 539 0 R +/Next 571 0 R +/First 555 0 R +/Last 563 0 R +/Count -3 >> endobj 547 0 obj << /Title 548 0 R /A 545 0 R -/Parent 543 0 R -/Next 551 0 R +/Parent 539 0 R +/Prev 543 0 R >> endobj 543 0 obj << /Title 544 0 R /A 541 0 R -/Parent 295 0 R -/Prev 539 0 R -/Next 635 0 R -/First 547 0 R -/Last 595 0 R -/Count -4 +/Parent 539 0 R +/Next 547 0 R >> endobj 539 0 obj << /Title 540 0 R /A 537 0 R -/Parent 295 0 R -/Prev 499 0 R -/Next 543 0 R +/Parent 459 0 R +/Prev 523 0 R +/Next 551 0 R +/First 543 0 R +/Last 547 0 R +/Count -2 >> endobj 535 0 obj << /Title 536 0 R /A 533 0 R -/Parent 499 0 R +/Parent 523 0 R /Prev 531 0 R >> endobj 531 0 obj << /Title 532 0 R /A 529 0 R -/Parent 499 0 R +/Parent 523 0 R /Prev 527 0 R /Next 535 0 R >> endobj 527 0 obj << /Title 528 0 R /A 525 0 R -/Parent 499 0 R -/Prev 515 0 R +/Parent 523 0 R /Next 531 0 R >> endobj 523 0 obj << /Title 524 0 R /A 521 0 R -/Parent 515 0 R -/Prev 519 0 R +/Parent 459 0 R +/Prev 487 0 R +/Next 539 0 R +/First 527 0 R +/Last 535 0 R +/Count -3 >> endobj 519 0 obj << /Title 520 0 R /A 517 0 R -/Parent 515 0 R -/Next 523 0 R +/Parent 487 0 R +/Prev 515 0 R >> endobj 515 0 obj << /Title 516 0 R /A 513 0 R -/Parent 499 0 R +/Parent 487 0 R /Prev 511 0 R -/Next 527 0 R -/First 519 0 R -/Last 523 0 R -/Count -2 +/Next 519 0 R >> endobj 511 0 obj << /Title 512 0 R /A 509 0 R -/Parent 499 0 R +/Parent 487 0 R /Prev 507 0 R /Next 515 0 R >> endobj 507 0 obj << /Title 508 0 R /A 505 0 R -/Parent 499 0 R +/Parent 487 0 R /Prev 503 0 R /Next 511 0 R >> endobj 503 0 obj << /Title 504 0 R /A 501 0 R -/Parent 499 0 R +/Parent 487 0 R +/Prev 499 0 R /Next 507 0 R >> endobj 499 0 obj << /Title 500 0 R /A 497 0 R -/Parent 295 0 R -/Prev 395 0 R -/Next 539 0 R -/First 503 0 R -/Last 535 0 R -/Count -7 +/Parent 487 0 R +/Prev 495 0 R +/Next 503 0 R >> endobj 495 0 obj << /Title 496 0 R /A 493 0 R -/Parent 395 0 R -/Prev 475 0 R +/Parent 487 0 R +/Prev 491 0 R +/Next 499 0 R >> endobj 491 0 obj << /Title 492 0 R /A 489 0 R -/Parent 475 0 R -/Prev 487 0 R +/Parent 487 0 R +/Next 495 0 R >> endobj 487 0 obj << /Title 488 0 R /A 485 0 R -/Parent 475 0 R -/Prev 483 0 R -/Next 491 0 R +/Parent 459 0 R +/Prev 471 0 R +/Next 523 0 R +/First 491 0 R +/Last 519 0 R +/Count -8 >> endobj 483 0 obj << /Title 484 0 R /A 481 0 R -/Parent 475 0 R +/Parent 471 0 R /Prev 479 0 R -/Next 487 0 R >> endobj 479 0 obj << /Title 480 0 R /A 477 0 R -/Parent 475 0 R +/Parent 471 0 R +/Prev 475 0 R /Next 483 0 R >> endobj 475 0 obj << /Title 476 0 R /A 473 0 R -/Parent 395 0 R -/Prev 427 0 R -/Next 495 0 R -/First 479 0 R -/Last 491 0 R -/Count -4 +/Parent 471 0 R +/Next 479 0 R >> endobj 471 0 obj << /Title 472 0 R /A 469 0 R -/Parent 427 0 R +/Parent 459 0 R /Prev 467 0 R +/Next 487 0 R +/First 475 0 R +/Last 483 0 R +/Count -3 >> endobj 467 0 obj << /Title 468 0 R /A 465 0 R -/Parent 427 0 R +/Parent 459 0 R /Prev 463 0 R /Next 471 0 R >> endobj 463 0 obj << /Title 464 0 R /A 461 0 R -/Parent 427 0 R -/Prev 459 0 R +/Parent 459 0 R /Next 467 0 R >> endobj 459 0 obj << /Title 460 0 R /A 457 0 R -/Parent 427 0 R -/Prev 447 0 R -/Next 463 0 R +/Parent 455 0 R +/Next 583 0 R +/First 463 0 R +/Last 571 0 R +/Count -8 >> endobj 455 0 obj << /Title 456 0 R /A 453 0 R -/Parent 447 0 R -/Prev 451 0 R +/Parent 6735 0 R +/Prev 99 0 R +/Next 2419 0 R +/First 459 0 R +/Last 2411 0 R +/Count -20 >> endobj 451 0 obj << /Title 452 0 R /A 449 0 R /Parent 447 0 R -/Next 455 0 R >> endobj 447 0 obj << /Title 448 0 R /A 445 0 R -/Parent 427 0 R -/Prev 443 0 R -/Next 459 0 R +/Parent 99 0 R +/Prev 419 0 R /First 451 0 R -/Last 455 0 R -/Count -2 +/Last 451 0 R +/Count -1 >> endobj 443 0 obj << /Title 444 0 R /A 441 0 R -/Parent 427 0 R -/Prev 439 0 R -/Next 447 0 R +/Parent 419 0 R +/Prev 431 0 R >> endobj 439 0 obj << /Title 440 0 R /A 437 0 R -/Parent 427 0 R +/Parent 431 0 R /Prev 435 0 R -/Next 443 0 R >> endobj 435 0 obj << /Title 436 0 R /A 433 0 R -/Parent 427 0 R -/Prev 431 0 R +/Parent 431 0 R /Next 439 0 R >> endobj 431 0 obj << /Title 432 0 R /A 429 0 R -/Parent 427 0 R -/Next 435 0 R +/Parent 419 0 R +/Prev 427 0 R +/Next 443 0 R +/First 435 0 R +/Last 439 0 R +/Count -2 >> endobj 427 0 obj << /Title 428 0 R /A 425 0 R -/Parent 395 0 R +/Parent 419 0 R /Prev 423 0 R -/Next 475 0 R -/First 431 0 R -/Last 471 0 R -/Count -9 +/Next 431 0 R >> endobj 423 0 obj << /Title 424 0 R /A 421 0 R -/Parent 395 0 R -/Prev 419 0 R +/Parent 419 0 R /Next 427 0 R >> endobj 419 0 obj << /Title 420 0 R /A 417 0 R -/Parent 395 0 R -/Prev 415 0 R -/Next 423 0 R +/Parent 99 0 R +/Prev 323 0 R +/Next 447 0 R +/First 423 0 R +/Last 443 0 R +/Count -4 >> endobj 415 0 obj << /Title 416 0 R /A 413 0 R -/Parent 395 0 R -/Prev 403 0 R -/Next 419 0 R +/Parent 407 0 R +/Prev 411 0 R >> endobj 411 0 obj << /Title 412 0 R /A 409 0 R -/Parent 403 0 R -/Prev 407 0 R +/Parent 407 0 R +/Next 415 0 R >> endobj 407 0 obj << /Title 408 0 R /A 405 0 R -/Parent 403 0 R -/Next 411 0 R +/Parent 323 0 R +/Prev 375 0 R +/First 411 0 R +/Last 415 0 R +/Count -2 >> endobj 403 0 obj << /Title 404 0 R /A 401 0 R -/Parent 395 0 R +/Parent 375 0 R /Prev 399 0 R -/Next 415 0 R -/First 407 0 R -/Last 411 0 R -/Count -2 >> endobj 399 0 obj << /Title 400 0 R /A 397 0 R -/Parent 395 0 R +/Parent 375 0 R +/Prev 395 0 R /Next 403 0 R >> endobj 395 0 obj << /Title 396 0 R /A 393 0 R -/Parent 295 0 R -/Prev 299 0 R -/Next 499 0 R -/First 399 0 R -/Last 495 0 R -/Count -8 +/Parent 375 0 R +/Prev 387 0 R +/Next 399 0 R >> endobj 391 0 obj << /Title 392 0 R @@ -19984,6 +37320,7 @@ endobj /A 385 0 R /Parent 375 0 R /Prev 383 0 R +/Next 395 0 R /First 391 0 R /Last 391 0 R /Count -1 @@ -20004,11 +37341,12 @@ endobj 375 0 obj << /Title 376 0 R /A 373 0 R -/Parent 299 0 R +/Parent 323 0 R /Prev 363 0 R +/Next 407 0 R /First 379 0 R -/Last 387 0 R -/Count -3 +/Last 403 0 R +/Count -6 >> endobj 371 0 obj << /Title 372 0 R @@ -20025,8 +37363,8 @@ endobj 363 0 obj << /Title 364 0 R /A 361 0 R -/Parent 299 0 R -/Prev 347 0 R +/Parent 323 0 R +/Prev 331 0 R /Next 375 0 R /First 367 0 R /Last 371 0 R @@ -20054,9 +37392,8 @@ endobj 347 0 obj << /Title 348 0 R /A 345 0 R -/Parent 299 0 R -/Prev 311 0 R -/Next 363 0 R +/Parent 331 0 R +/Prev 343 0 R /First 351 0 R /Last 359 0 R /Count -3 @@ -20064,313 +37401,316 @@ endobj 343 0 obj << /Title 344 0 R /A 341 0 R -/Parent 311 0 R +/Parent 331 0 R /Prev 339 0 R +/Next 347 0 R >> endobj 339 0 obj << /Title 340 0 R /A 337 0 R -/Parent 311 0 R +/Parent 331 0 R /Prev 335 0 R /Next 343 0 R >> endobj 335 0 obj << /Title 336 0 R /A 333 0 R -/Parent 311 0 R -/Prev 331 0 R +/Parent 331 0 R /Next 339 0 R >> endobj 331 0 obj << /Title 332 0 R /A 329 0 R -/Parent 311 0 R +/Parent 323 0 R /Prev 327 0 R -/Next 335 0 R +/Next 363 0 R +/First 335 0 R +/Last 347 0 R +/Count -4 >> endobj 327 0 obj << /Title 328 0 R /A 325 0 R -/Parent 311 0 R -/Prev 323 0 R +/Parent 323 0 R /Next 331 0 R >> endobj 323 0 obj << /Title 324 0 R /A 321 0 R -/Parent 311 0 R -/Prev 319 0 R -/Next 327 0 R +/Parent 99 0 R +/Prev 263 0 R +/Next 419 0 R +/First 327 0 R +/Last 407 0 R +/Count -5 >> endobj 319 0 obj << /Title 320 0 R /A 317 0 R -/Parent 311 0 R +/Parent 303 0 R /Prev 315 0 R -/Next 323 0 R >> endobj 315 0 obj << /Title 316 0 R /A 313 0 R -/Parent 311 0 R +/Parent 303 0 R +/Prev 311 0 R /Next 319 0 R >> endobj 311 0 obj << /Title 312 0 R /A 309 0 R -/Parent 299 0 R +/Parent 303 0 R /Prev 307 0 R -/Next 347 0 R -/First 315 0 R -/Last 343 0 R -/Count -8 +/Next 315 0 R >> endobj 307 0 obj << /Title 308 0 R /A 305 0 R -/Parent 299 0 R -/Prev 303 0 R +/Parent 303 0 R /Next 311 0 R >> endobj 303 0 obj << /Title 304 0 R /A 301 0 R -/Parent 299 0 R -/Next 307 0 R +/Parent 263 0 R +/Prev 295 0 R +/First 307 0 R +/Last 319 0 R +/Count -4 >> endobj 299 0 obj << /Title 300 0 R /A 297 0 R /Parent 295 0 R -/Next 395 0 R -/First 303 0 R -/Last 375 0 R -/Count -6 >> endobj 295 0 obj << /Title 296 0 R /A 293 0 R -/Parent 3770 0 R -/Prev 83 0 R -/Next 1223 0 R +/Parent 263 0 R +/Prev 271 0 R +/Next 303 0 R /First 299 0 R -/Last 1191 0 R -/Count -18 +/Last 299 0 R +/Count -1 >> endobj 291 0 obj << /Title 292 0 R /A 289 0 R -/Parent 283 0 R +/Parent 271 0 R /Prev 287 0 R >> endobj 287 0 obj << /Title 288 0 R /A 285 0 R -/Parent 283 0 R +/Parent 271 0 R +/Prev 283 0 R /Next 291 0 R >> endobj 283 0 obj << /Title 284 0 R /A 281 0 R -/Parent 83 0 R -/Prev 251 0 R -/First 287 0 R -/Last 291 0 R -/Count -2 +/Parent 271 0 R +/Prev 275 0 R +/Next 287 0 R >> endobj 279 0 obj << /Title 280 0 R /A 277 0 R -/Parent 251 0 R -/Prev 275 0 R +/Parent 275 0 R >> endobj 275 0 obj << /Title 276 0 R /A 273 0 R -/Parent 251 0 R -/Prev 271 0 R -/Next 279 0 R +/Parent 271 0 R +/Next 283 0 R +/First 279 0 R +/Last 279 0 R +/Count -1 >> endobj 271 0 obj << /Title 272 0 R /A 269 0 R -/Parent 251 0 R -/Prev 263 0 R -/Next 275 0 R +/Parent 263 0 R +/Prev 267 0 R +/Next 295 0 R +/First 275 0 R +/Last 291 0 R +/Count -4 >> endobj 267 0 obj << /Title 268 0 R /A 265 0 R /Parent 263 0 R +/Next 271 0 R >> endobj 263 0 obj << /Title 264 0 R /A 261 0 R -/Parent 251 0 R -/Prev 259 0 R -/Next 271 0 R +/Parent 99 0 R +/Prev 183 0 R +/Next 323 0 R /First 267 0 R -/Last 267 0 R -/Count -1 +/Last 303 0 R +/Count -4 >> endobj 259 0 obj << /Title 260 0 R /A 257 0 R -/Parent 251 0 R +/Parent 235 0 R /Prev 255 0 R -/Next 263 0 R >> endobj 255 0 obj << /Title 256 0 R /A 253 0 R -/Parent 251 0 R +/Parent 235 0 R +/Prev 251 0 R /Next 259 0 R >> endobj 251 0 obj << /Title 252 0 R /A 249 0 R -/Parent 83 0 R -/Prev 211 0 R -/Next 283 0 R -/First 255 0 R -/Last 279 0 R -/Count -6 +/Parent 235 0 R +/Prev 247 0 R +/Next 255 0 R >> endobj 247 0 obj << /Title 248 0 R /A 245 0 R -/Parent 239 0 R +/Parent 235 0 R /Prev 243 0 R +/Next 251 0 R >> endobj 243 0 obj << /Title 244 0 R /A 241 0 R -/Parent 239 0 R +/Parent 235 0 R +/Prev 239 0 R /Next 247 0 R >> endobj 239 0 obj << /Title 240 0 R /A 237 0 R -/Parent 211 0 R -/Prev 235 0 R -/First 243 0 R -/Last 247 0 R -/Count -2 +/Parent 235 0 R +/Next 243 0 R >> endobj 235 0 obj << /Title 236 0 R /A 233 0 R -/Parent 211 0 R -/Prev 223 0 R -/Next 239 0 R +/Parent 183 0 R +/Prev 211 0 R +/First 239 0 R +/Last 259 0 R +/Count -6 >> endobj 231 0 obj << /Title 232 0 R /A 229 0 R -/Parent 223 0 R -/Prev 227 0 R +/Parent 211 0 R +/Prev 215 0 R >> endobj 227 0 obj << /Title 228 0 R /A 225 0 R -/Parent 223 0 R -/Next 231 0 R +/Parent 215 0 R +/Prev 223 0 R >> endobj 223 0 obj << /Title 224 0 R /A 221 0 R -/Parent 211 0 R +/Parent 215 0 R /Prev 219 0 R -/Next 235 0 R -/First 227 0 R -/Last 231 0 R -/Count -2 +/Next 227 0 R >> endobj 219 0 obj << /Title 220 0 R /A 217 0 R -/Parent 211 0 R -/Prev 215 0 R +/Parent 215 0 R /Next 223 0 R >> endobj 215 0 obj << /Title 216 0 R /A 213 0 R /Parent 211 0 R -/Next 219 0 R +/Next 231 0 R +/First 219 0 R +/Last 227 0 R +/Count -3 >> endobj 211 0 obj << /Title 212 0 R /A 209 0 R -/Parent 83 0 R -/Prev 147 0 R -/Next 251 0 R +/Parent 183 0 R +/Prev 207 0 R +/Next 235 0 R /First 215 0 R -/Last 239 0 R -/Count -5 +/Last 231 0 R +/Count -2 >> endobj 207 0 obj << /Title 208 0 R /A 205 0 R -/Parent 203 0 R +/Parent 183 0 R +/Prev 203 0 R +/Next 211 0 R >> endobj 203 0 obj << /Title 204 0 R /A 201 0 R -/Parent 147 0 R -/Prev 179 0 R -/First 207 0 R -/Last 207 0 R -/Count -1 +/Parent 183 0 R +/Prev 191 0 R +/Next 207 0 R >> endobj 199 0 obj << /Title 200 0 R /A 197 0 R -/Parent 179 0 R +/Parent 191 0 R /Prev 195 0 R >> endobj 195 0 obj << /Title 196 0 R /A 193 0 R -/Parent 179 0 R -/Prev 191 0 R +/Parent 191 0 R /Next 199 0 R >> endobj 191 0 obj << /Title 192 0 R /A 189 0 R -/Parent 179 0 R +/Parent 183 0 R /Prev 187 0 R -/Next 195 0 R +/Next 203 0 R +/First 195 0 R +/Last 199 0 R +/Count -2 >> endobj 187 0 obj << /Title 188 0 R /A 185 0 R -/Parent 179 0 R -/Prev 183 0 R +/Parent 183 0 R /Next 191 0 R >> endobj 183 0 obj << /Title 184 0 R /A 181 0 R -/Parent 179 0 R -/Next 187 0 R +/Parent 99 0 R +/Prev 103 0 R +/Next 263 0 R +/First 187 0 R +/Last 235 0 R +/Count -6 >> endobj 179 0 obj << /Title 180 0 R /A 177 0 R -/Parent 147 0 R -/Prev 163 0 R -/Next 203 0 R -/First 183 0 R -/Last 199 0 R -/Count -5 +/Parent 163 0 R +/Prev 175 0 R >> endobj 175 0 obj << /Title 176 0 R /A 173 0 R /Parent 163 0 R /Prev 171 0 R +/Next 179 0 R >> endobj 171 0 obj << /Title 172 0 R @@ -20388,48 +37728,47 @@ endobj 163 0 obj << /Title 164 0 R /A 161 0 R -/Parent 147 0 R +/Parent 103 0 R /Prev 159 0 R -/Next 179 0 R /First 167 0 R -/Last 175 0 R -/Count -3 +/Last 179 0 R +/Count -4 >> endobj 159 0 obj << /Title 160 0 R /A 157 0 R -/Parent 147 0 R -/Prev 155 0 R +/Parent 103 0 R +/Prev 115 0 R /Next 163 0 R >> endobj 155 0 obj << /Title 156 0 R /A 153 0 R -/Parent 147 0 R -/Prev 151 0 R -/Next 159 0 R +/Parent 151 0 R >> endobj 151 0 obj << /Title 152 0 R /A 149 0 R -/Parent 147 0 R -/Next 155 0 R +/Parent 115 0 R +/Prev 143 0 R +/First 155 0 R +/Last 155 0 R +/Count -1 >> endobj 147 0 obj << /Title 148 0 R /A 145 0 R -/Parent 83 0 R -/Prev 107 0 R -/Next 211 0 R -/First 151 0 R -/Last 203 0 R -/Count -6 +/Parent 143 0 R >> endobj 143 0 obj << /Title 144 0 R /A 141 0 R -/Parent 111 0 R +/Parent 115 0 R /Prev 135 0 R +/Next 151 0 R +/First 147 0 R +/Last 147 0 R +/Count -1 >> endobj 139 0 obj << /Title 140 0 R @@ -20439,8 +37778,8 @@ endobj 135 0 obj << /Title 136 0 R /A 133 0 R -/Parent 111 0 R -/Prev 123 0 R +/Parent 115 0 R +/Prev 127 0 R /Next 143 0 R /First 139 0 R /Last 139 0 R @@ -20449,186 +37788,188 @@ endobj 131 0 obj << /Title 132 0 R /A 129 0 R -/Parent 123 0 R -/Prev 127 0 R +/Parent 127 0 R >> endobj 127 0 obj << /Title 128 0 R /A 125 0 R -/Parent 123 0 R -/Next 131 0 R +/Parent 115 0 R +/Prev 119 0 R +/Next 135 0 R +/First 131 0 R +/Last 131 0 R +/Count -1 >> endobj 123 0 obj << /Title 124 0 R /A 121 0 R -/Parent 111 0 R -/Prev 119 0 R -/Next 135 0 R -/First 127 0 R -/Last 131 0 R -/Count -2 +/Parent 119 0 R >> endobj 119 0 obj << /Title 120 0 R /A 117 0 R -/Parent 111 0 R -/Prev 115 0 R -/Next 123 0 R +/Parent 115 0 R +/Next 127 0 R +/First 123 0 R +/Last 123 0 R +/Count -1 >> endobj 115 0 obj << /Title 116 0 R /A 113 0 R -/Parent 111 0 R -/Next 119 0 R +/Parent 103 0 R +/Prev 111 0 R +/Next 159 0 R +/First 119 0 R +/Last 151 0 R +/Count -5 >> endobj 111 0 obj << /Title 112 0 R /A 109 0 R -/Parent 107 0 R -/First 115 0 R -/Last 143 0 R -/Count -5 +/Parent 103 0 R +/Prev 107 0 R +/Next 115 0 R >> endobj 107 0 obj << /Title 108 0 R /A 105 0 R -/Parent 83 0 R -/Prev 87 0 R -/Next 147 0 R -/First 111 0 R -/Last 111 0 R -/Count -1 +/Parent 103 0 R +/Next 111 0 R >> endobj 103 0 obj << /Title 104 0 R /A 101 0 R /Parent 99 0 R +/Next 183 0 R +/First 107 0 R +/Last 163 0 R +/Count -5 >> endobj 99 0 obj << /Title 100 0 R /A 97 0 R -/Parent 87 0 R -/Prev 95 0 R +/Parent 6735 0 R +/Prev 7 0 R +/Next 455 0 R /First 103 0 R -/Last 103 0 R -/Count -1 +/Last 447 0 R +/Count -6 >> endobj 95 0 obj << /Title 96 0 R /A 93 0 R -/Parent 87 0 R -/Prev 91 0 R -/Next 99 0 R +/Parent 91 0 R >> endobj 91 0 obj << /Title 92 0 R /A 89 0 R -/Parent 87 0 R -/Next 95 0 R +/Parent 7 0 R +/Prev 39 0 R +/First 95 0 R +/Last 95 0 R +/Count -1 >> endobj 87 0 obj << /Title 88 0 R /A 85 0 R -/Parent 83 0 R -/Next 107 0 R -/First 91 0 R -/Last 99 0 R -/Count -3 +/Parent 79 0 R +/Prev 83 0 R >> endobj 83 0 obj << /Title 84 0 R /A 81 0 R -/Parent 3770 0 R -/Prev 7 0 R -/Next 295 0 R -/First 87 0 R -/Last 283 0 R -/Count -6 +/Parent 79 0 R +/Next 87 0 R >> endobj 79 0 obj << /Title 80 0 R /A 77 0 R -/Parent 43 0 R +/Parent 39 0 R /Prev 75 0 R +/First 83 0 R +/Last 87 0 R +/Count -2 >> endobj 75 0 obj << /Title 76 0 R /A 73 0 R -/Parent 43 0 R +/Parent 39 0 R /Prev 71 0 R /Next 79 0 R >> endobj 71 0 obj << /Title 72 0 R /A 69 0 R -/Parent 43 0 R +/Parent 39 0 R /Prev 67 0 R /Next 75 0 R >> endobj 67 0 obj << /Title 68 0 R /A 65 0 R -/Parent 43 0 R -/Prev 51 0 R +/Parent 39 0 R +/Prev 63 0 R /Next 71 0 R >> endobj 63 0 obj << /Title 64 0 R /A 61 0 R -/Parent 51 0 R -/Prev 55 0 R +/Parent 39 0 R +/Prev 47 0 R +/Next 67 0 R >> endobj 59 0 obj << /Title 60 0 R /A 57 0 R -/Parent 55 0 R +/Parent 47 0 R +/Prev 51 0 R >> endobj 55 0 obj << /Title 56 0 R /A 53 0 R /Parent 51 0 R -/Next 63 0 R -/First 59 0 R -/Last 59 0 R -/Count -1 >> endobj 51 0 obj << /Title 52 0 R /A 49 0 R -/Parent 43 0 R -/Prev 47 0 R -/Next 67 0 R +/Parent 47 0 R +/Next 59 0 R /First 55 0 R -/Last 63 0 R -/Count -2 +/Last 55 0 R +/Count -1 >> endobj 47 0 obj << /Title 48 0 R /A 45 0 R -/Parent 43 0 R -/Next 51 0 R +/Parent 39 0 R +/Prev 43 0 R +/Next 63 0 R +/First 51 0 R +/Last 59 0 R +/Count -2 >> endobj 43 0 obj << /Title 44 0 R /A 41 0 R -/Parent 7 0 R -/Prev 11 0 R -/First 47 0 R -/Last 79 0 R -/Count -6 +/Parent 39 0 R +/Next 47 0 R >> endobj 39 0 obj << /Title 40 0 R /A 37 0 R -/Parent 11 0 R -/Prev 35 0 R +/Parent 7 0 R +/Prev 11 0 R +/Next 91 0 R +/First 43 0 R +/Last 79 0 R +/Count -7 >> endobj 35 0 obj << /Title 36 0 R /A 33 0 R /Parent 11 0 R /Prev 31 0 R -/Next 39 0 R >> endobj 31 0 obj << /Title 32 0 R @@ -20668,3829 +38009,6792 @@ endobj /Title 12 0 R /A 9 0 R /Parent 7 0 R -/Next 43 0 R +/Next 39 0 R /First 15 0 R -/Last 39 0 R -/Count -7 +/Last 35 0 R +/Count -6 >> endobj 7 0 obj << /Title 8 0 R /A 5 0 R -/Parent 3770 0 R -/Next 83 0 R +/Parent 6735 0 R +/Next 99 0 R /First 11 0 R -/Last 43 0 R -/Count -2 +/Last 91 0 R +/Count -3 >> endobj -3771 0 obj << -/Names [(ADS) 2330 0 R (AdvancedNetworkManagement) 2976 0 R (Appendixes) 3488 0 R (CUPS-printing) 2733 0 R (Doc-Start) 1614 0 R (InterdomainTrusts) 3159 0 R (IntroSMB) 2096 0 R (Item.1) 2190 0 R (Item.10) 2294 0 R (Item.100) 3578 0 R (Item.101) 3579 0 R (Item.102) 3584 0 R (Item.103) 3585 0 R (Item.104) 3666 0 R (Item.105) 3667 0 R (Item.106) 3668 0 R (Item.107) 3669 0 R (Item.108) 3670 0 R (Item.11) 2295 0 R (Item.12) 2296 0 R (Item.13) 2410 0 R (Item.14) 2411 0 R (Item.15) 2412 0 R (Item.16) 2417 0 R (Item.17) 2475 0 R (Item.18) 2476 0 R (Item.19) 2477 0 R (Item.2) 2191 0 R (Item.20) 2625 0 R (Item.21) 2626 0 R (Item.22) 2627 0 R (Item.23) 2707 0 R (Item.24) 2708 0 R (Item.25) 2709 0 R (Item.26) 2710 0 R (Item.27) 2711 0 R (Item.28) 2712 0 R (Item.29) 2713 0 R (Item.3) 2238 0 R (Item.30) 2714 0 R (Item.31) 2980 0 R (Item.32) 2981 0 R (Item.33) 2987 0 R (Item.34) 2988 0 R (Item.35) 2989 0 R (Item.36) 3031 0 R (Item.37) 3032 0 R (Item.38) 3033 0 R (Item.39) 3034 0 R (Item.4) 2239 0 R (Item.40) 3047 0 R (Item.41) 3048 0 R (Item.42) 3049 0 R (Item.43) 3050 0 R (Item.44) 3051 0 R (Item.45) 3052 0 R (Item.46) 3053 0 R (Item.47) 3054 0 R (Item.48) 3055 0 R (Item.49) 3078 0 R (Item.5) 2240 0 R (Item.50) 3079 0 R (Item.51) 3084 0 R (Item.52) 3085 0 R (Item.53) 3086 0 R (Item.54) 3087 0 R (Item.55) 3092 0 R (Item.56) 3093 0 R (Item.57) 3133 0 R (Item.58) 3134 0 R (Item.59) 3135 0 R (Item.6) 2290 0 R (Item.60) 3136 0 R (Item.61) 3393 0 R (Item.62) 3394 0 R (Item.63) 3395 0 R (Item.64) 3400 0 R (Item.65) 3405 0 R (Item.66) 3406 0 R (Item.67) 3407 0 R (Item.68) 3408 0 R (Item.69) 3409 0 R (Item.7) 2291 0 R (Item.70) 3410 0 R (Item.71) 3411 0 R (Item.72) 3412 0 R (Item.73) 3413 0 R (Item.74) 3418 0 R (Item.75) 3419 0 R (Item.76) 3420 0 R (Item.77) 3421 0 R (Item.78) 3422 0 R (Item.79) 3423 0 R (Item.8) 2292 0 R (Item.80) 3424 0 R (Item.81) 3500 0 R (Item.82) 3506 0 R (Item.83) 3507 0 R (Item.84) 3508 0 R (Item.85) 3563 0 R (Item.86) 3564 0 R (Item.87) 3565 0 R (Item.88) 3566 0 R (Item.89) 3567 0 R (Item.9) 2293 0 R (Item.90) 3568 0 R (Item.91) 3569 0 R (Item.92) 3570 0 R (Item.93) 3571 0 R (Item.94) 3572 0 R (Item.95) 3573 0 R (Item.96) 3574 0 R (Item.97) 3575 0 R (Item.98) 3576 0 R (Item.99) 3577 0 R (NT4Migration) 3541 0 R (NetworkBrowsing) 2379 0 R (Other-Clients) 3627 0 R (PolicyMgmt) 3014 0 R (Portability) 3606 0 R (ProfileMgmt) 3060 0 R (SWAT) 3684 0 R (ServerType) 2174 0 R (VFS) 3215 0 R (ads-create-machine-account) 2341 0 R (ads-test-server) 2343 0 R (ads-test-smbclient) 2344 0 R (browse-force-master) 2404 0 R (bugreport) 3466 0 R (chapter*.1) 1648 0 R (chapter.1) 10 0 R (chapter.10) 394 0 R (chapter.11) 498 0 R (chapter.12) 538 0 R (chapter.13) 542 0 R (chapter.14) 634 0 R (chapter.15) 694 0 R (chapter.16) 798 0 R (chapter.17) 830 0 R (chapter.18) 874 0 R (chapter.19) 970 0 R (chapter.2) 42 0 R (chapter.20) 1002 0 R (chapter.21) 1038 0 R (chapter.22) 1078 0 R (chapter.23) 1090 0 R (chapter.24) 1138 0 R (chapter.25) 1170 0 R (chapter.26) 1190 0 R (chapter.27) 1226 0 R (chapter.28) 1246 0 R (chapter.29) 1270 0 R (chapter.3) 86 0 R (chapter.30) 1302 0 R (chapter.31) 1362 0 R (chapter.32) 1410 0 R (chapter.33) 1450 0 R (chapter.34) 1522 0 R (chapter.35) 1570 0 R (chapter.4) 106 0 R (chapter.5) 146 0 R (chapter.6) 210 0 R (chapter.7) 250 0 R (chapter.8) 282 0 R (chapter.9) 298 0 R (compiling) 2146 0 R (diagnosis) 2163 0 R (domain-member) 2278 0 R (groupmapping) 2624 0 R (id2733677) 2115 0 R (id2733814) 2109 0 R (id2733867) 2143 0 R (id2733970) 2139 0 R (id2733997) 2142 0 R (id2736665) 3190 0 R (id2736726) 3197 0 R (id2736835) 3202 0 R (id2736861) 3203 0 R (id2738692) 2131 0 R (id2738754) 2100 0 R (id2738812) 2101 0 R (id2738964) 2133 0 R (id2739101) 2175 0 R (id2788270) 3216 0 R (id2788445) 3180 0 R (id2788527) 2114 0 R (id2802059) 2145 0 R (id2802112) 2152 0 R (id2802151) 2153 0 R (id2802202) 2154 0 R (id2802305) 2155 0 R (id2802366) 2159 0 R (id2802412) 2188 0 R (id2802434) 2189 0 R (id2802598) 2176 0 R (id2802639) 2181 0 R (id2802654) 2182 0 R (id2802780) 2232 0 R (id2802804) 2233 0 R (id2802916) 2192 0 R (id2802970) 2198 0 R (id2803054) 2208 0 R (id2803230) 2216 0 R (id2803291) 2222 0 R (id2803311) 2223 0 R (id2803429) 2225 0 R (id2803493) 2309 0 R (id2803553) 2310 0 R (id2803565) 2307 0 R (id2803758) 2241 0 R (id2804059) 2252 0 R (id2804328) 2258 0 R (id2804562) 2266 0 R (id2804618) 2268 0 R (id2804725) 2274 0 R (id2804732) 2275 0 R (id2804770) 2276 0 R (id2804817) 2277 0 R (id2804868) 2283 0 R (id2804917) 2284 0 R (id2804942) 2285 0 R (id2805105) 2297 0 R (id2805216) 2331 0 R (id2805383) 2316 0 R (id2805407) 2317 0 R (id2805426) 2318 0 R (id2805460) 2319 0 R (id2805556) 2324 0 R (id2805585) 2325 0 R (id2805609) 2354 0 R (id2805766) 2332 0 R (id2805960) 2342 0 R (id2806114) 2349 0 R (id2806191) 2380 0 R (id2806514) 2365 0 R (id2806782) 2432 0 R (id2806842) 2385 0 R (id2807004) 2390 0 R (id2807131) 2395 0 R (id2807320) 2401 0 R (id2807585) 2409 0 R (id2807734) 2418 0 R (id2807751) 2419 0 R (id2807780) 2420 0 R (id2807891) 2421 0 R (id2807958) 2427 0 R (id2808132) 2591 0 R (id2808250) 2590 0 R (id2808414) 2436 0 R (id2808439) 2441 0 R (id2808469) 2442 0 R (id2808483) 2443 0 R (id2808550) 2444 0 R (id2808665) 2450 0 R (id2808712) 2455 0 R (id2808819) 2456 0 R (id2808899) 2461 0 R (id2808950) 2462 0 R (id2809295) 2483 0 R (id2809348) 2484 0 R (id2809510) 2493 0 R (id2809549) 2494 0 R (id2809583) 2495 0 R (id2809764) 2500 0 R (id2809793) 2501 0 R (id2809809) 2502 0 R (id2809816) 2503 0 R (id2809917) 2509 0 R (id2810056) 2517 0 R (id2810094) 2521 0 R (id2810204) 2527 0 R (id2810212) 2528 0 R (id2810329) 2534 0 R (id2810500) 2549 0 R (id2810537) 2550 0 R (id2810652) 2556 0 R (id2810932) 2565 0 R (id2810989) 2570 0 R (id2810996) 2571 0 R (id2811050) 2572 0 R (id2811195) 2582 0 R (id2811224) 2583 0 R (id2811268) 2584 0 R (id2811476) 2592 0 R (id2811597) 2597 0 R (id2811679) 2598 0 R (id2811783) 2599 0 R (id2811833) 2604 0 R (id2811992) 2605 0 R (id2812308) 2614 0 R (id2812430) 2680 0 R (id2812456) 2682 0 R (id2812535) 2694 0 R (id2812542) 2695 0 R (id2812694) 2637 0 R (id2812810) 2641 0 R (id2812857) 2646 0 R (id2813089) 2657 0 R (id2813187) 2662 0 R (id2813295) 2669 0 R (id2813427) 2678 0 R (id2813530) 2687 0 R (id2813550) 2688 0 R (id2813574) 2689 0 R (id2813747) 2700 0 R (id2813814) 2705 0 R (id2813856) 2706 0 R (id2813990) 2720 0 R (id2814213) 2734 0 R (id2814271) 2736 0 R (id2814297) 2755 0 R (id2814539) 2721 0 R (id2814615) 2726 0 R (id2814634) 2727 0 R (id2814659) 2728 0 R (id2814803) 2741 0 R (id2815273) 2882 0 R (id2815303) 2883 0 R (id2815332) 2884 0 R (id2815366) 2890 0 R (id2815389) 2891 0 R (id2815469) 2760 0 R (id2815510) 2761 0 R (id2815597) 2766 0 R (id2815763) 2777 0 R (id2816112) 2786 0 R (id2816498) 2817 0 R (id2816535) 2818 0 R (id2816954) 2837 0 R (id2817563) 2861 0 R (id2817669) 2866 0 R (id2817911) 2875 0 R (id2817939) 2876 0 R (id2818011) 2877 0 R (id2818101) 2978 0 R (id2818115) 2979 0 R (id2818167) 2990 0 R (id2818250) 2999 0 R (id2818334) 2977 0 R (id2818477) 2892 0 R (id2818549) 2897 0 R (id2818583) 2898 0 R (id2818611) 2899 0 R (id2818639) 2901 0 R (id2818714) 2906 0 R (id2818808) 2911 0 R (id2818885) 2916 0 R (id2819005) 2917 0 R (id2819210) 2918 0 R (id2819283) 2923 0 R (id2819398) 2924 0 R (id2819455) 2925 0 R (id2819700) 2935 0 R (id2819708) 2937 0 R (id2819844) 2943 0 R (id2819945) 2951 0 R (id2819982) 2952 0 R (id2820091) 2954 0 R (id2820315) 2964 0 R (id2820406) 2969 0 R (id2820461) 2970 0 R (id2820524) 2982 0 R (id2820685) 3062 0 R (id2820699) 3063 0 R (id2820796) 3061 0 R (id2820871) 3015 0 R (id2821084) 3005 0 R (id2821122) 3017 0 R (id2821211) 3023 0 R (id2821313) 3024 0 R (id2821336) 3025 0 R (id2821434) 3030 0 R (id2821541) 3039 0 R (id2821654) 3040 0 R (id2821674) 3045 0 R (id2821699) 3046 0 R (id2821880) 3160 0 R (id2822021) 3068 0 R (id2822117) 3069 0 R (id2822156) 3070 0 R (id2822276) 3076 0 R (id2822284) 3077 0 R (id2822555) 3094 0 R (id2822622) 3095 0 R (id2822892) 3108 0 R (id2822938) 3109 0 R (id2822956) 3110 0 R (id2823049) 3116 0 R (id2823071) 3117 0 R (id2823087) 3118 0 R (id2823121) 3119 0 R (id2823166) 3120 0 R (id2823208) 3125 0 R (id2823237) 3126 0 R (id2823276) 3127 0 R (id2823326) 3132 0 R (id2823710) 3145 0 R (id2824202) 3165 0 R (id2824215) 3166 0 R (id2824259) 3167 0 R (id2824283) 3168 0 R (id2824310) 3169 0 R (id2824406) 3174 0 R (id2825175) 3208 0 R (id2825208) 3209 0 R (id2825244) 3210 0 R (id2825412) 3244 0 R (id2825446) 3217 0 R (id2825454) 3218 0 R (id2825492) 3219 0 R (id2825530) 3224 0 R (id2825613) 3226 0 R (id2825751) 3227 0 R (id2825790) 3228 0 R (id2825812) 3234 0 R (id2825867) 3237 0 R (id2825942) 3259 0 R (id2826159) 3253 0 R (id2826228) 3282 0 R (id2826267) 3283 0 R (id2826310) 3292 0 R (id2826342) 3293 0 R (id2826354) 3294 0 R (id2826376) 3264 0 R (id2826514) 3265 0 R (id2826558) 3270 0 R (id2826601) 3271 0 R (id2826696) 3277 0 R (id2826803) 3303 0 R (id2826819) 3304 0 R (id2826920) 3313 0 R (id2826957) 3318 0 R (id2827268) 3305 0 R (id2827319) 3311 0 R (id2827361) 3312 0 R (id2827407) 3341 0 R (id2827556) 3325 0 R (id2827625) 3327 0 R (id2827715) 3328 0 R (id2827760) 3333 0 R (id2827902) 3385 0 R (id2827936) 3386 0 R (id2828069) 3342 0 R (id2828185) 3347 0 R (id2828409) 3357 0 R (id2828437) 3362 0 R (id2828517) 3363 0 R (id2828547) 3368 0 R (id2828675) 3435 0 R (id2828941) 3392 0 R (id2830051) 3429 0 R (id2830124) 3470 0 R (id2830215) 3467 0 R (id2830292) 3438 0 R (id2830434) 3444 0 R (id2830540) 3456 0 R (id2830694) 3459 0 R (id2830752) 3719 0 R (id2830777) 3490 0 R (id2830784) 3491 0 R (id2830817) 3494 0 R (id2830833) 3495 0 R (id2830910) 3472 0 R (id2831046) 3477 0 R (id2831139) 3478 0 R (id2831186) 3479 0 R (id2831225) 3543 0 R (id2831355) 3542 0 R (id2831397) 3497 0 R (id2831574) 3509 0 R (id2831615) 3513 0 R (id2831698) 3518 0 R (id2831835) 3519 0 R (id2831902) 3524 0 R (id2831933) 3525 0 R (id2831983) 3526 0 R (id2832050) 3527 0 R (id2832242) 3532 0 R (id2832373) 3608 0 R (id2832396) 3609 0 R (id2832471) 3607 0 R (id2832694) 3549 0 R (id2832748) 3554 0 R (id2832809) 3555 0 R (id2832867) 3560 0 R (id2832897) 3561 0 R (id2832922) 3562 0 R (id2833177) 3586 0 R (id2833194) 3587 0 R (id2833259) 3589 0 R (id2833331) 3595 0 R (id2833501) 3590 0 R (id2833599) 3628 0 R (id2833868) 3614 0 R (id2833905) 3619 0 R (id2833912) 3620 0 R (id2833938) 3621 0 R (id2833945) 3622 0 R (id2834033) 3686 0 R (id2834156) 3685 0 R (id2834174) 3634 0 R (id2834180) 3635 0 R (id2834263) 3641 0 R (id2834323) 3645 0 R (id2834352) 3647 0 R (id2834415) 3648 0 R (id2834422) 3649 0 R (id2834454) 3654 0 R (id2834484) 3655 0 R (id2834510) 3656 0 R (id2834541) 3658 0 R (id2834558) 3659 0 R (id2834585) 3660 0 R (id2834655) 3671 0 R (id2834672) 3672 0 R (id2834782) 3678 0 R (id2834849) 3720 0 R (id2835070) 3691 0 R (id2835143) 3696 0 R (id2835207) 3698 0 R (id2835315) 3703 0 R (id2835364) 3704 0 R (id2835413) 3705 0 R (id2835458) 3706 0 R (id2835496) 3707 0 R (id2835513) 3713 0 R (id2835738) 3721 0 R (id2835781) 3726 0 R (id2835834) 3727 0 R (id2835857) 3728 0 R (id2835914) 3729 0 R (id2835956) 3730 0 R (id2835977) 3735 0 R (install) 2138 0 R (integrate-ms-networks) 3258 0 R (introduction) 2095 0 R (locking) 3340 0 R (msdfs) 3243 0 R (optional) 2378 0 R (page.1) 1613 0 R (page.10) 1940 0 R (page.100) 2765 0 R (page.101) 2776 0 R (page.102) 2781 0 R (page.103) 2785 0 R (page.104) 2791 0 R (page.105) 2795 0 R (page.106) 2799 0 R (page.107) 2803 0 R (page.108) 2807 0 R (page.109) 2811 0 R (page.11) 1990 0 R (page.110) 2816 0 R (page.111) 2825 0 R (page.112) 2834 0 R (page.113) 2841 0 R (page.114) 2845 0 R (page.115) 2851 0 R (page.116) 2856 0 R (page.117) 2860 0 R (page.118) 2865 0 R (page.119) 2870 0 R (page.12) 2040 0 R (page.120) 2874 0 R (page.121) 2881 0 R (page.122) 2889 0 R (page.123) 2896 0 R (page.124) 2905 0 R (page.125) 2915 0 R (page.126) 2922 0 R (page.127) 2929 0 R (page.128) 2934 0 R (page.129) 2941 0 R (page.13) 2089 0 R (page.130) 2949 0 R (page.131) 2958 0 R (page.132) 2962 0 R (page.133) 2968 0 R (page.134) 2975 0 R (page.135) 2986 0 R (page.136) 2998 0 R (page.137) 3004 0 R (page.138) 3009 0 R (page.139) 3013 0 R (page.14) 2094 0 R (page.140) 3022 0 R (page.141) 3029 0 R (page.142) 3038 0 R (page.143) 3044 0 R (page.144) 3059 0 R (page.145) 3067 0 R (page.146) 3075 0 R (page.147) 3083 0 R (page.148) 3091 0 R (page.149) 3099 0 R (page.15) 2108 0 R (page.150) 3103 0 R (page.151) 3107 0 R (page.152) 3115 0 R (page.153) 3124 0 R (page.154) 3131 0 R (page.155) 3140 0 R (page.156) 3144 0 R (page.157) 3149 0 R (page.158) 3154 0 R (page.159) 3158 0 R (page.16) 2113 0 R (page.160) 3164 0 R (page.161) 3173 0 R (page.162) 3178 0 R (page.163) 3184 0 R (page.164) 3189 0 R (page.165) 3196 0 R (page.166) 3201 0 R (page.167) 3207 0 R (page.168) 3214 0 R (page.169) 3223 0 R (page.17) 2121 0 R (page.170) 3233 0 R (page.171) 3242 0 R (page.172) 3252 0 R (page.173) 3257 0 R (page.174) 3263 0 R (page.175) 3269 0 R (page.176) 3276 0 R (page.177) 3281 0 R (page.178) 3287 0 R (page.179) 3291 0 R (page.18) 2137 0 R (page.180) 3298 0 R (page.181) 3302 0 R (page.182) 3310 0 R (page.183) 3317 0 R (page.184) 3323 0 R (page.185) 3332 0 R (page.186) 3339 0 R (page.187) 3346 0 R (page.188) 3352 0 R (page.189) 3356 0 R (page.19) 2151 0 R (page.190) 3361 0 R (page.191) 3367 0 R (page.192) 3379 0 R (page.193) 3383 0 R (page.194) 3391 0 R (page.195) 3399 0 R (page.196) 3404 0 R (page.197) 3417 0 R (page.198) 3428 0 R (page.199) 3434 0 R (page.2) 1625 0 R (page.20) 2168 0 R (page.200) 3443 0 R (page.201) 3455 0 R (page.202) 3465 0 R (page.203) 3476 0 R (page.204) 3483 0 R (page.205) 3487 0 R (page.206) 3505 0 R (page.207) 3517 0 R (page.208) 3523 0 R (page.209) 3531 0 R (page.21) 2172 0 R (page.210) 3536 0 R (page.211) 3540 0 R (page.212) 3548 0 R (page.213) 3553 0 R (page.214) 3559 0 R (page.215) 3583 0 R (page.216) 3594 0 R (page.217) 3600 0 R (page.218) 3605 0 R (page.219) 3613 0 R (page.22) 2180 0 R (page.220) 3618 0 R (page.221) 3626 0 R (page.222) 3640 0 R (page.223) 3653 0 R (page.224) 3665 0 R (page.225) 3677 0 R (page.226) 3683 0 R (page.227) 3690 0 R (page.228) 3695 0 R (page.229) 3702 0 R (page.23) 2186 0 R (page.230) 3712 0 R (page.231) 3717 0 R (page.232) 3725 0 R (page.233) 3734 0 R (page.24) 2197 0 R (page.25) 2215 0 R (page.26) 2221 0 R (page.27) 2230 0 R (page.28) 2237 0 R (page.29) 2245 0 R (page.3) 1639 0 R (page.30) 2251 0 R (page.31) 2257 0 R (page.32) 2265 0 R (page.33) 2272 0 R (page.34) 2282 0 R (page.35) 2289 0 R (page.36) 2301 0 R (page.37) 2305 0 R (page.38) 2315 0 R (page.39) 2323 0 R (page.4) 1647 0 R (page.40) 2329 0 R (page.41) 2336 0 R (page.42) 2348 0 R (page.43) 2353 0 R (page.44) 2364 0 R (page.45) 2373 0 R (page.46) 2377 0 R (page.47) 2384 0 R (page.48) 2389 0 R (page.49) 2394 0 R (page.5) 1686 0 R (page.50) 2400 0 R (page.51) 2408 0 R (page.52) 2416 0 R (page.53) 2426 0 R (page.54) 2431 0 R (page.55) 2440 0 R (page.56) 2449 0 R (page.57) 2454 0 R (page.58) 2460 0 R (page.59) 2466 0 R (page.6) 1732 0 R (page.60) 2470 0 R (page.61) 2474 0 R (page.62) 2482 0 R (page.63) 2488 0 R (page.64) 2492 0 R (page.65) 2499 0 R (page.66) 2514 0 R (page.67) 2526 0 R (page.68) 2533 0 R (page.69) 2548 0 R (page.7) 1786 0 R (page.70) 2555 0 R (page.71) 2560 0 R (page.72) 2569 0 R (page.73) 2576 0 R (page.74) 2581 0 R (page.75) 2588 0 R (page.76) 2596 0 R (page.77) 2603 0 R (page.78) 2609 0 R (page.79) 2618 0 R (page.8) 1840 0 R (page.80) 2623 0 R (page.81) 2631 0 R (page.82) 2635 0 R (page.83) 2645 0 R (page.84) 2655 0 R (page.85) 2661 0 R (page.86) 2668 0 R (page.87) 2677 0 R (page.88) 2686 0 R (page.89) 2693 0 R (page.9) 1889 0 R (page.90) 2699 0 R (page.91) 2704 0 R (page.92) 2719 0 R (page.93) 2725 0 R (page.94) 2732 0 R (page.95) 2740 0 R (page.96) 2745 0 R (page.97) 2749 0 R (page.98) 2754 0 R (page.99) 2759 0 R (pam) 3179 0 R (part.1) 6 0 R (part.2) 82 0 R (part.3) 294 0 R (part.4) 1222 0 R (part.5) 1298 0 R (passdb) 2247 0 R (printing) 2636 0 R (problems) 2164 0 R (samba-bdc) 2306 0 R (samba-pdc) 2231 0 R (section*.2) 2936 0 R (section*.3) 2942 0 R (section*.4) 2950 0 R (section*.5) 2953 0 R (section*.6) 2963 0 R (section.1.1) 14 0 R (section.1.2) 18 0 R (section.1.3) 22 0 R (section.1.4) 26 0 R (section.1.5) 30 0 R (section.1.6) 34 0 R (section.1.7) 38 0 R (section.10.1) 398 0 R (section.10.2) 402 0 R (section.10.3) 414 0 R (section.10.4) 418 0 R (section.10.5) 422 0 R (section.10.6) 426 0 R (section.10.7) 474 0 R (section.10.8) 494 0 R (section.11.1) 502 0 R (section.11.2) 506 0 R (section.11.3) 510 0 R (section.11.4) 514 0 R (section.11.5) 526 0 R (section.11.6) 530 0 R (section.11.7) 534 0 R (section.13.1) 546 0 R (section.13.2) 550 0 R (section.13.3) 574 0 R (section.13.4) 594 0 R (section.14.1) 638 0 R (section.14.10) 682 0 R (section.14.11) 686 0 R (section.14.12) 690 0 R (section.14.2) 642 0 R (section.14.3) 646 0 R (section.14.4) 650 0 R (section.14.5) 654 0 R (section.14.6) 658 0 R (section.14.7) 662 0 R (section.14.8) 670 0 R (section.14.9) 674 0 R (section.15.1) 698 0 R (section.15.2) 702 0 R (section.15.3) 706 0 R (section.15.4) 714 0 R (section.15.5) 742 0 R (section.15.6) 790 0 R (section.15.7) 794 0 R (section.16.1) 802 0 R (section.16.2) 818 0 R (section.16.3) 822 0 R (section.17.1) 834 0 R (section.17.2) 858 0 R (section.17.3) 870 0 R (section.18.1) 878 0 R (section.18.2) 942 0 R (section.18.3) 946 0 R (section.18.4) 950 0 R (section.19.1) 974 0 R (section.19.2) 978 0 R (section.19.3) 990 0 R (section.2.1) 46 0 R (section.2.2) 50 0 R (section.2.3) 66 0 R (section.2.4) 70 0 R (section.2.5) 74 0 R (section.2.6) 78 0 R (section.20.1) 1006 0 R (section.20.2) 1034 0 R (section.21.1) 1042 0 R (section.21.2) 1046 0 R (section.21.3) 1066 0 R (section.22.1) 1082 0 R (section.23.1) 1094 0 R (section.23.2) 1114 0 R (section.24.1) 1142 0 R (section.24.2) 1146 0 R (section.24.3) 1150 0 R (section.24.4) 1154 0 R (section.24.5) 1158 0 R (section.24.6) 1162 0 R (section.24.7) 1166 0 R (section.25.1) 1174 0 R (section.25.2) 1178 0 R (section.25.3) 1182 0 R (section.25.4) 1186 0 R (section.26.1) 1194 0 R (section.26.2) 1198 0 R (section.26.3) 1202 0 R (section.26.4) 1214 0 R (section.26.5) 1218 0 R (section.27.1) 1230 0 R (section.27.2) 1234 0 R (section.27.3) 1238 0 R (section.27.4) 1242 0 R (section.28.1) 1250 0 R (section.28.2) 1254 0 R (section.28.3) 1258 0 R (section.28.4) 1262 0 R (section.28.5) 1266 0 R (section.29.1) 1274 0 R (section.29.2) 1278 0 R (section.29.3) 1282 0 R (section.29.4) 1286 0 R (section.29.5) 1290 0 R (section.29.6) 1294 0 R (section.3.1) 90 0 R (section.3.2) 94 0 R (section.3.3) 98 0 R (section.30.1) 1306 0 R (section.30.2) 1326 0 R (section.30.3) 1330 0 R (section.30.4) 1334 0 R (section.30.5) 1350 0 R (section.31.1) 1366 0 R (section.31.2) 1398 0 R (section.32.1) 1414 0 R (section.32.2) 1418 0 R (section.32.3) 1422 0 R (section.32.4) 1426 0 R (section.32.5) 1430 0 R (section.32.6) 1438 0 R (section.33.1) 1454 0 R (section.33.2) 1458 0 R (section.33.3) 1478 0 R (section.33.4) 1506 0 R (section.33.5) 1514 0 R (section.33.6) 1518 0 R (section.34.1) 1526 0 R (section.35.1) 1574 0 R (section.35.2) 1578 0 R (section.35.3) 1582 0 R (section.35.4) 1586 0 R (section.35.5) 1590 0 R (section.35.6) 1594 0 R (section.35.7) 1598 0 R (section.35.8) 1602 0 R (section.35.9) 1606 0 R (section.4.1) 110 0 R (section.5.1) 150 0 R (section.5.2) 154 0 R (section.5.3) 158 0 R (section.5.4) 162 0 R (section.5.5) 178 0 R (section.5.6) 202 0 R (section.6.1) 214 0 R (section.6.2) 218 0 R (section.6.3) 222 0 R (section.6.4) 234 0 R (section.6.5) 238 0 R (section.7.1) 254 0 R (section.7.2) 258 0 R (section.7.3) 262 0 R (section.7.4) 270 0 R (section.7.5) 274 0 R (section.7.6) 278 0 R (section.8.1) 286 0 R (section.8.2) 290 0 R (section.9.1) 302 0 R (section.9.2) 306 0 R (section.9.3) 310 0 R (section.9.4) 346 0 R (section.9.5) 362 0 R (section.9.6) 374 0 R (securing-samba) 2147 0 R (securitylevels) 2187 0 R (speed) 3718 0 R (subsection.10.2.1) 406 0 R (subsection.10.2.2) 410 0 R (subsection.10.6.1) 430 0 R (subsection.10.6.2) 434 0 R (subsection.10.6.3) 438 0 R (subsection.10.6.4) 442 0 R (subsection.10.6.5) 446 0 R (subsection.10.6.6) 458 0 R (subsection.10.6.7) 462 0 R (subsection.10.6.8) 466 0 R (subsection.10.6.9) 470 0 R (subsection.10.7.1) 478 0 R (subsection.10.7.2) 482 0 R (subsection.10.7.3) 486 0 R (subsection.10.7.4) 490 0 R (subsection.11.4.1) 518 0 R (subsection.11.4.2) 522 0 R (subsection.13.2.1) 554 0 R (subsection.13.2.2) 558 0 R (subsection.13.2.3) 562 0 R (subsection.13.2.4) 566 0 R (subsection.13.2.5) 570 0 R (subsection.13.3.1) 578 0 R (subsection.13.3.2) 582 0 R (subsection.13.3.3) 586 0 R (subsection.13.3.4) 590 0 R (subsection.13.4.1) 598 0 R (subsection.13.4.2) 602 0 R (subsection.13.4.3) 606 0 R (subsection.13.4.4) 610 0 R (subsection.13.4.5) 614 0 R (subsection.13.4.6) 618 0 R (subsection.13.4.7) 622 0 R (subsection.13.4.8) 626 0 R (subsection.13.4.9) 630 0 R (subsection.14.7.1) 666 0 R (subsection.14.9.1) 678 0 R (subsection.15.3.1) 710 0 R (subsection.15.4.1) 718 0 R (subsection.15.4.2) 722 0 R (subsection.15.4.3) 726 0 R (subsection.15.4.4) 730 0 R (subsection.15.4.5) 734 0 R (subsection.15.4.6) 738 0 R (subsection.15.5.1) 746 0 R (subsection.15.5.2) 750 0 R (subsection.15.5.3) 754 0 R (subsection.16.1.1) 806 0 R (subsection.16.3.1) 826 0 R (subsection.17.1.1) 838 0 R (subsection.17.1.2) 842 0 R (subsection.17.1.3) 850 0 R (subsection.17.2.1) 862 0 R (subsection.17.2.2) 866 0 R (subsection.18.1.1) 882 0 R (subsection.18.1.2) 902 0 R (subsection.18.1.3) 918 0 R (subsection.18.1.4) 922 0 R (subsection.18.4.1) 954 0 R (subsection.18.4.2) 962 0 R (subsection.18.4.3) 966 0 R (subsection.19.2.1) 982 0 R (subsection.19.2.2) 986 0 R (subsection.19.3.1) 994 0 R (subsection.19.3.2) 998 0 R (subsection.2.2.1) 54 0 R (subsection.2.2.2) 62 0 R (subsection.20.1.1) 1010 0 R (subsection.20.1.2) 1014 0 R (subsection.21.2.1) 1050 0 R (subsection.21.2.2) 1054 0 R (subsection.21.2.3) 1058 0 R (subsection.21.2.4) 1062 0 R (subsection.21.3.1) 1070 0 R (subsection.21.3.2) 1074 0 R (subsection.22.1.1) 1086 0 R (subsection.23.1.1) 1098 0 R (subsection.23.1.2) 1102 0 R (subsection.23.1.3) 1106 0 R (subsection.23.1.4) 1110 0 R (subsection.23.2.1) 1118 0 R (subsection.23.2.2) 1122 0 R (subsection.23.2.3) 1126 0 R (subsection.23.2.4) 1130 0 R (subsection.23.2.5) 1134 0 R (subsection.26.3.1) 1206 0 R (subsection.26.3.2) 1210 0 R (subsection.3.3.1) 102 0 R (subsection.30.1.1) 1310 0 R (subsection.30.1.2) 1314 0 R (subsection.30.4.1) 1338 0 R (subsection.30.5.1) 1354 0 R (subsection.30.5.2) 1358 0 R (subsection.31.1.1) 1370 0 R (subsection.31.1.2) 1394 0 R (subsection.31.2.1) 1402 0 R (subsection.31.2.2) 1406 0 R (subsection.32.5.1) 1434 0 R (subsection.32.6.1) 1442 0 R (subsection.32.6.2) 1446 0 R (subsection.33.2.1) 1462 0 R (subsection.33.2.2) 1466 0 R (subsection.33.2.3) 1470 0 R (subsection.33.2.4) 1474 0 R (subsection.33.3.1) 1482 0 R (subsection.33.3.2) 1486 0 R (subsection.33.3.3) 1490 0 R (subsection.33.3.4) 1494 0 R (subsection.33.3.5) 1498 0 R (subsection.33.3.6) 1502 0 R (subsection.33.4.1) 1510 0 R (subsection.34.1.1) 1530 0 R (subsection.34.1.10) 1566 0 R (subsection.34.1.2) 1534 0 R (subsection.34.1.3) 1538 0 R (subsection.34.1.4) 1542 0 R (subsection.34.1.5) 1546 0 R (subsection.34.1.6) 1550 0 R (subsection.34.1.7) 1554 0 R (subsection.34.1.8) 1558 0 R (subsection.34.1.9) 1562 0 R (subsection.4.1.1) 114 0 R (subsection.4.1.2) 118 0 R (subsection.4.1.3) 122 0 R (subsection.4.1.4) 134 0 R (subsection.4.1.5) 142 0 R (subsection.5.4.1) 166 0 R (subsection.5.4.2) 170 0 R (subsection.5.4.3) 174 0 R (subsection.5.5.1) 182 0 R (subsection.5.5.2) 186 0 R (subsection.5.5.3) 190 0 R (subsection.5.5.4) 194 0 R (subsection.5.5.5) 198 0 R (subsection.5.6.1) 206 0 R (subsection.6.3.1) 226 0 R (subsection.6.3.2) 230 0 R (subsection.6.5.1) 242 0 R (subsection.6.5.2) 246 0 R (subsection.7.3.1) 266 0 R (subsection.9.3.1) 314 0 R (subsection.9.3.2) 318 0 R (subsection.9.3.3) 322 0 R (subsection.9.3.4) 326 0 R (subsection.9.3.5) 330 0 R (subsection.9.3.6) 334 0 R (subsection.9.3.7) 338 0 R (subsection.9.3.8) 342 0 R (subsection.9.4.1) 350 0 R (subsection.9.4.2) 354 0 R (subsection.9.4.3) 358 0 R (subsection.9.5.1) 366 0 R (subsection.9.5.2) 370 0 R (subsection.9.6.1) 378 0 R (subsection.9.6.2) 382 0 R (subsection.9.6.3) 386 0 R (subsubsection.10.6.5.1) 450 0 R (subsubsection.10.6.5.2) 454 0 R (subsubsection.15.5.3.1) 758 0 R (subsubsection.15.5.3.2) 762 0 R (subsubsection.15.5.3.3) 766 0 R (subsubsection.15.5.3.4) 770 0 R (subsubsection.15.5.3.5) 774 0 R (subsubsection.15.5.3.6) 778 0 R (subsubsection.15.5.3.7) 782 0 R (subsubsection.15.5.3.8) 786 0 R (subsubsection.16.1.1.1) 810 0 R (subsubsection.16.1.1.2) 814 0 R (subsubsection.17.1.2.1) 846 0 R (subsubsection.17.1.3.1) 854 0 R (subsubsection.18.1.1.1) 886 0 R (subsubsection.18.1.1.2) 890 0 R (subsubsection.18.1.1.3) 894 0 R (subsubsection.18.1.1.4) 898 0 R (subsubsection.18.1.2.1) 906 0 R (subsubsection.18.1.2.2) 910 0 R (subsubsection.18.1.2.3) 914 0 R (subsubsection.18.1.4.1) 926 0 R (subsubsection.18.1.4.2) 930 0 R (subsubsection.18.1.4.3) 934 0 R (subsubsection.18.1.4.4) 938 0 R (subsubsection.18.4.1.1) 958 0 R (subsubsection.2.2.1.1) 58 0 R (subsubsection.20.1.2.1) 1018 0 R (subsubsection.20.1.2.2) 1022 0 R (subsubsection.20.1.2.3) 1026 0 R (subsubsection.20.1.2.4) 1030 0 R (subsubsection.30.1.2.1) 1318 0 R (subsubsection.30.1.2.2) 1322 0 R (subsubsection.30.4.1.1) 1342 0 R (subsubsection.30.4.1.2) 1346 0 R (subsubsection.31.1.1.1) 1374 0 R (subsubsection.31.1.1.2) 1378 0 R (subsubsection.31.1.1.3) 1382 0 R (subsubsection.31.1.1.4) 1386 0 R (subsubsection.31.1.1.5) 1390 0 R (subsubsection.4.1.3.1) 126 0 R (subsubsection.4.1.3.2) 130 0 R (subsubsection.4.1.4.1) 138 0 R (subsubsection.9.6.3.1) 390 0 R (table.21.1) 3225 0 R (table.31.1) 3588 0 R (table.31.2) 3596 0 R (troubleshooting) 3384 0 R (type) 2173 0 R (unicode) 3324 0 R (unix-permissions) 2589 0 R (winbind) 2226 0 R (winbind-solaris9) 2945 0 R] -/Limits [(ADS) (winbind-solaris9)] +6736 0 obj << +/Names [(AccessControls) 2959 0 R (AdvancedNetworkManagement) 3024 0 R (Appendixes) 6519 0 R (Backup) 3030 0 R (CUPS-printing) 3021 0 R (ClientConfig) 2955 0 R (DNSDHCP) 3065 0 R (Doc-Start) 2862 0 R (FastStart) 2949 0 R (Further-Resources) 3066 0 R (InterdomainTrusts) 3018 0 R (IntroSMB) 2947 0 R (Item.1) 3946 0 R (Item.10) 4079 0 R (Item.100) 5705 0 R (Item.101) 5706 0 R (Item.102) 5707 0 R (Item.103) 5708 0 R (Item.104) 5709 0 R (Item.105) 5710 0 R (Item.106) 5711 0 R (Item.107) 5712 0 R (Item.108) 5713 0 R (Item.109) 5978 0 R (Item.11) 4080 0 R (Item.110) 5979 0 R (Item.111) 5980 0 R (Item.112) 5981 0 R (Item.113) 5992 0 R (Item.114) 5993 0 R (Item.115) 5994 0 R (Item.116) 5995 0 R (Item.117) 5996 0 R (Item.118) 5997 0 R (Item.119) 6002 0 R (Item.12) 4157 0 R (Item.120) 6003 0 R (Item.121) 6004 0 R (Item.122) 6028 0 R (Item.123) 6033 0 R (Item.124) 6034 0 R (Item.125) 6035 0 R (Item.126) 6036 0 R (Item.127) 6037 0 R (Item.128) 6038 0 R (Item.129) 6046 0 R (Item.13) 4158 0 R (Item.130) 6047 0 R (Item.131) 6048 0 R (Item.132) 6049 0 R (Item.133) 6050 0 R (Item.134) 6051 0 R (Item.135) 6052 0 R (Item.136) 6053 0 R (Item.137) 6054 0 R (Item.138) 6055 0 R (Item.139) 6064 0 R (Item.14) 4159 0 R (Item.140) 6065 0 R (Item.141) 6066 0 R (Item.142) 6067 0 R (Item.143) 6068 0 R (Item.144) 6069 0 R (Item.145) 6070 0 R (Item.146) 6071 0 R (Item.147) 6072 0 R (Item.148) 6073 0 R (Item.149) 6074 0 R (Item.15) 4160 0 R (Item.150) 6075 0 R (Item.151) 6076 0 R (Item.152) 6077 0 R (Item.153) 6078 0 R (Item.154) 6079 0 R (Item.155) 6080 0 R (Item.156) 6088 0 R (Item.157) 6089 0 R (Item.158) 6090 0 R (Item.159) 6091 0 R (Item.16) 4161 0 R (Item.160) 6092 0 R (Item.161) 6093 0 R (Item.162) 6094 0 R (Item.163) 6117 0 R (Item.164) 6118 0 R (Item.165) 6119 0 R (Item.166) 6120 0 R (Item.167) 6348 0 R (Item.168) 6349 0 R (Item.169) 6350 0 R (Item.17) 4162 0 R (Item.170) 6351 0 R (Item.171) 6352 0 R (Item.172) 6353 0 R (Item.173) 6354 0 R (Item.174) 6355 0 R (Item.175) 6356 0 R (Item.176) 6357 0 R (Item.177) 6358 0 R (Item.178) 6359 0 R (Item.179) 6360 0 R (Item.18) 4242 0 R (Item.180) 6361 0 R (Item.181) 6362 0 R (Item.182) 6363 0 R (Item.183) 6364 0 R (Item.184) 6365 0 R (Item.185) 6366 0 R (Item.186) 6393 0 R (Item.187) 6394 0 R (Item.188) 6395 0 R (Item.189) 6396 0 R (Item.19) 4243 0 R (Item.190) 6432 0 R (Item.191) 6433 0 R (Item.192) 6434 0 R (Item.193) 6439 0 R (Item.194) 6440 0 R (Item.195) 6445 0 R (Item.196) 6446 0 R (Item.197) 6447 0 R (Item.198) 6448 0 R (Item.199) 6449 0 R (Item.2) 3947 0 R (Item.20) 4245 0 R (Item.200) 6450 0 R (Item.201) 6451 0 R (Item.202) 6452 0 R (Item.203) 6453 0 R (Item.204) 6454 0 R (Item.205) 6455 0 R (Item.206) 6456 0 R (Item.207) 6462 0 R (Item.208) 6463 0 R (Item.209) 6464 0 R (Item.21) 4246 0 R (Item.210) 6531 0 R (Item.211) 6532 0 R (Item.212) 6533 0 R (Item.213) 6538 0 R (Item.214) 6539 0 R (Item.22) 4284 0 R (Item.23) 4285 0 R (Item.24) 4286 0 R (Item.25) 4287 0 R (Item.26) 4288 0 R (Item.27) 4289 0 R (Item.28) 4314 0 R (Item.29) 4315 0 R (Item.3) 3962 0 R (Item.30) 4316 0 R (Item.31) 4317 0 R (Item.32) 4380 0 R (Item.33) 4381 0 R (Item.34) 4382 0 R (Item.35) 4548 0 R (Item.36) 4549 0 R (Item.37) 4550 0 R (Item.38) 4627 0 R (Item.39) 4628 0 R (Item.4) 3963 0 R (Item.40) 4634 0 R (Item.41) 4635 0 R (Item.42) 4636 0 R (Item.43) 4670 0 R (Item.44) 4671 0 R (Item.45) 4676 0 R (Item.46) 4677 0 R (Item.47) 4678 0 R (Item.48) 4679 0 R (Item.49) 4847 0 R (Item.5) 4074 0 R (Item.50) 4848 0 R (Item.51) 4849 0 R (Item.52) 4850 0 R (Item.53) 4851 0 R (Item.54) 4852 0 R (Item.55) 4853 0 R (Item.56) 4957 0 R (Item.57) 4958 0 R (Item.58) 4959 0 R (Item.59) 4960 0 R (Item.6) 4075 0 R (Item.60) 5023 0 R (Item.61) 5024 0 R (Item.62) 5025 0 R (Item.63) 5026 0 R (Item.64) 5027 0 R (Item.65) 5028 0 R (Item.66) 5029 0 R (Item.67) 5030 0 R (Item.68) 5031 0 R (Item.69) 5032 0 R (Item.7) 4076 0 R (Item.70) 5033 0 R (Item.71) 5034 0 R (Item.72) 5035 0 R (Item.73) 5036 0 R (Item.74) 5037 0 R (Item.75) 5084 0 R (Item.76) 5085 0 R (Item.77) 5086 0 R (Item.78) 5393 0 R (Item.79) 5394 0 R (Item.8) 4077 0 R (Item.80) 5395 0 R (Item.81) 5396 0 R (Item.82) 5414 0 R (Item.83) 5415 0 R (Item.84) 5416 0 R (Item.85) 5417 0 R (Item.86) 5418 0 R (Item.87) 5424 0 R (Item.88) 5425 0 R (Item.89) 5426 0 R (Item.9) 4078 0 R (Item.90) 5440 0 R (Item.91) 5441 0 R (Item.92) 5442 0 R (Item.93) 5443 0 R (Item.94) 5699 0 R (Item.95) 5700 0 R (Item.96) 5701 0 R (Item.97) 5702 0 R (Item.98) 5703 0 R (Item.99) 5704 0 R (NT4Migration) 3033 0 R (NetworkBrowsing) 2956 0 R (Other-Clients) 3063 0 R (PolicyMgmt) 3025 0 R (Portability) 3062 0 R (ProfileMgmt) 3026 0 R (SWAT) 3034 0 R (SambaHA) 3031 0 R (ServerType) 2950 0 R (StandAloneServer) 2954 0 R (VFS) 3022 0 R (XMLpassdb) 4427 0 R (ads-create-machine-account) 4212 0 R (ads-member) 3985 0 R (ads-test-server) 4214 0 R (ads-test-smbclient) 4215 0 R (browse-force-master) 4308 0 R (bugreport) 3060 0 R (chapter*.1) 3071 0 R (chapter.1) 10 0 R (chapter.10) 458 0 R (chapter.11) 582 0 R (chapter.12) 722 0 R (chapter.13) 762 0 R (chapter.14) 870 0 R (chapter.15) 966 0 R (chapter.16) 1022 0 R (chapter.17) 1066 0 R (chapter.18) 1078 0 R (chapter.19) 1326 0 R (chapter.2) 38 0 R (chapter.20) 1870 0 R (chapter.21) 1922 0 R (chapter.22) 2026 0 R (chapter.23) 2058 0 R (chapter.24) 2118 0 R (chapter.25) 2234 0 R (chapter.26) 2302 0 R (chapter.27) 2374 0 R (chapter.28) 2398 0 R (chapter.29) 2410 0 R (chapter.3) 90 0 R (chapter.30) 2422 0 R (chapter.31) 2438 0 R (chapter.32) 2486 0 R (chapter.33) 2538 0 R (chapter.34) 2558 0 R (chapter.35) 2582 0 R (chapter.36) 2614 0 R (chapter.37) 2678 0 R (chapter.38) 2718 0 R (chapter.39) 2786 0 R (chapter.4) 102 0 R (chapter.40) 2834 0 R (chapter.41) 2842 0 R (chapter.5) 182 0 R (chapter.6) 262 0 R (chapter.7) 322 0 R (chapter.8) 418 0 R (chapter.9) 446 0 R (compiling) 3061 0 R (diagnosis) 3035 0 R (domain-member) 2953 0 R (domain-member-server) 4175 0 R (example.12.3.1) 4558 0 R (example.13.2.1) 4599 0 R (figure.19.1) 5172 0 R (figure.19.10) 5742 0 R (figure.19.11) 5750 0 R (figure.19.12) 5759 0 R (figure.19.13) 5767 0 R (figure.19.14) 5775 0 R (figure.19.15) 5782 0 R (figure.19.2) 5182 0 R (figure.19.3) 5192 0 R (figure.19.4) 5236 0 R (figure.19.5) 5246 0 R (figure.19.6) 5256 0 R (figure.19.7) 5266 0 R (figure.19.8) 5726 0 R (figure.19.9) 5734 0 R (groupmapping) 2958 0 R (id2807070) 3863 0 R (id2807281) 3864 0 R (id2807435) 3870 0 R (id2807504) 3877 0 R (id2807592) 3880 0 R (id2807665) 3887 0 R (id2808200) 3927 0 R (id2808325) 3892 0 R (id2808366) 3895 0 R (id2808403) 3896 0 R (id2808498) 3898 0 R (id2808553) 3903 0 R (id2808597) 3906 0 R (id2808647) 3907 0 R (id2808748) 3908 0 R (id2808811) 3909 0 R (id2808845) 3916 0 R (id2808858) 3917 0 R (id2809073) 3922 0 R (id2810224) 3938 0 R (id2810319) 3939 0 R (id2810403) 3944 0 R (id2810518) 3945 0 R (id2810612) 3952 0 R (id2810652) 3953 0 R (id2810731) 3954 0 R (id2810773) 3955 0 R (id2810795) 3956 0 R (id2811025) 3972 0 R (id2811055) 3980 0 R (id2811112) 3983 0 R (id2811268) 3993 0 R (id2811336) 3994 0 R (id2811513) 3999 0 R (id2811541) 4000 0 R (id2811574) 4005 0 R (id2811602) 4006 0 R (id2811636) 4008 0 R (id2813443) 4013 0 R (id2813747) 4026 0 R (id2813762) 4027 0 R (id2813974) 4033 0 R (id2814294) 4049 0 R (id2814593) 4059 0 R (id2814615) 4060 0 R (id2814630) 4061 0 R (id2814663) 4062 0 R (id2814683) 4067 0 R (id2814718) 4068 0 R (id2814956) 4081 0 R (id2815064) 4086 0 R (id2815072) 4087 0 R (id2815110) 4088 0 R (id2815159) 4089 0 R (id2815230) 4094 0 R (id2815293) 4095 0 R (id2815320) 4096 0 R (id2817486) 4102 0 R (id2817659) 4108 0 R (id2817687) 4109 0 R (id2817836) 4114 0 R (id2817908) 4116 0 R (id2817929) 4117 0 R (id2817955) 4123 0 R (id2818000) 4124 0 R (id2818102) 4125 0 R (id2818163) 4130 0 R (id2818177) 4131 0 R (id2818208) 4132 0 R (id2818241) 4133 0 R (id2818285) 4138 0 R (id2819355) 4143 0 R (id2819470) 4144 0 R (id2819646) 4149 0 R (id2819898) 4156 0 R (id2820094) 4168 0 R (id2820157) 4170 0 R (id2820170) 4171 0 R (id2820236) 4172 0 R (id2820277) 4173 0 R (id2820359) 4181 0 R (id2820370) 4182 0 R (id2820741) 4193 0 R (id2820883) 4202 0 R (id2820966) 4203 0 R (id2821176) 4213 0 R (id2821329) 4220 0 R (id2821351) 4221 0 R (id2821376) 4222 0 R (id2821408) 4223 0 R (id2823423) 4256 0 R (id2823762) 4233 0 R (id2823959) 4234 0 R (id2824031) 4239 0 R (id2824046) 4240 0 R (id2824096) 4241 0 R (id2824309) 4251 0 R (id2825015) 4267 0 R (id2825095) 4272 0 R (id2825205) 4277 0 R (id2825221) 4278 0 R (id2825384) 4279 0 R (id2825515) 4290 0 R (id2825651) 4291 0 R (id2825777) 4296 0 R (id2825999) 4301 0 R (id2826268) 4313 0 R (id2826424) 4318 0 R (id2826442) 4319 0 R (id2826470) 4320 0 R (id2826580) 4325 0 R (id2826640) 4326 0 R (id2826799) 4332 0 R (id2826998) 4337 0 R (id2827023) 4338 0 R (id2827107) 4339 0 R (id2827121) 4344 0 R (id2827188) 4345 0 R (id2827325) 4351 0 R (id2827372) 4352 0 R (id2827479) 4357 0 R (id2827558) 4358 0 R (id2827608) 4363 0 R (id2827725) 4368 0 R (id2827840) 4370 0 R (id2827939) 4376 0 R (id2828039) 4378 0 R (id2828178) 4387 0 R (id2828193) 4388 0 R (id2828222) 4389 0 R (id2831766) 4395 0 R (id2832094) 4400 0 R (id2832158) 4405 0 R (id2832321) 4410 0 R (id2832376) 4411 0 R (id2832412) 4412 0 R (id2832467) 4417 0 R (id2832499) 4418 0 R (id2832764) 4419 0 R (id2832916) 4425 0 R (id2832952) 4432 0 R (id2832992) 4433 0 R (id2833098) 4435 0 R (id2833126) 4436 0 R (id2833278) 4448 0 R (id2833304) 4450 0 R (id2833411) 4456 0 R (id2833599) 4461 0 R (id2833728) 4466 0 R (id2833926) 4481 0 R (id2833962) 4487 0 R (id2834099) 4489 0 R (id2834117) 4523 0 R (id2834466) 4495 0 R (id2834528) 4496 0 R (id2834642) 4502 0 R (id2834662) 4503 0 R (id2834726) 4504 0 R (id2834803) 4530 0 R (id2834928) 4536 0 R (id2835308) 4509 0 R (id2835338) 4510 0 R (id2835447) 4511 0 R (id2835454) 4512 0 R (id2835469) 4513 0 R (id2835530) 4518 0 R (id2841728) 4573 0 R (id2841765) 4578 0 R (id2841784) 4579 0 R (id2842040) 4587 0 R (id2842061) 4588 0 R (id2842136) 4590 0 R (id2842274) 4600 0 R (id2842352) 4601 0 R (id2842907) 4542 0 R (id2843008) 4543 0 R (id2843199) 4551 0 R (id2843264) 4556 0 R (id2843278) 4557 0 R (id2843301) 4559 0 R (id2843346) 4560 0 R (id2843438) 4565 0 R (id2843454) 4566 0 R (id2843515) 4567 0 R (id2843532) 4602 0 R (id2843592) 4608 0 R (id2843803) 4603 0 R (id2843824) 4617 0 R (id2844048) 4610 0 R (id2844072) 4624 0 R (id2844264) 4611 0 R (id2844336) 4619 0 R (id2844350) 4626 0 R (id2844432) 4629 0 R (id2844635) 4637 0 R (id2844643) 4638 0 R (id2844681) 4643 0 R (id2844760) 4644 0 R (id2844882) 4645 0 R (id2844974) 4650 0 R (id2845065) 4651 0 R (id2845110) 4652 0 R (id2845262) 4657 0 R (id2845592) 4667 0 R (id2845668) 4668 0 R (id2845682) 4669 0 R (id2846062) 4684 0 R (id2849674) 4689 0 R (id2849729) 4690 0 R (id2849861) 4695 0 R (id2850152) 4705 0 R (id2850177) 4706 0 R (id2850206) 4707 0 R (id2850232) 4708 0 R (id2850266) 4709 0 R (id2850287) 4714 0 R (id2850328) 4715 0 R (id2850406) 4716 0 R (id2850449) 4717 0 R (id2850507) 4722 0 R (id2850616) 4727 0 R (id2850630) 4728 0 R (id2850693) 4729 0 R (id2850877) 4734 0 R (id2851107) 4744 0 R (id2851134) 4745 0 R (id2851214) 4750 0 R (id2851244) 4751 0 R (id2851318) 4756 0 R (id2851348) 4757 0 R (id2853401) 4769 0 R (id2853434) 4770 0 R (id2853508) 4771 0 R (id2853528) 4772 0 R (id2853598) 4777 0 R (id2853650) 4778 0 R (id2853702) 4779 0 R (id2853758) 4784 0 R (id2853820) 4785 0 R (id2853860) 4791 0 R (id2853885) 4793 0 R (id2853903) 4794 0 R (id2853928) 4795 0 R (id2854737) 4826 0 R (id2854834) 4800 0 R (id2854863) 4801 0 R (id2854947) 4806 0 R (id2854959) 4807 0 R (id2855044) 4808 0 R (id2855080) 4809 0 R (id2855108) 4810 0 R (id2855248) 4815 0 R (id2855381) 4820 0 R (id2855395) 4821 0 R (id2855980) 4840 0 R (id2856048) 4841 0 R (id2856085) 4846 0 R (id2856156) 4854 0 R (id2856389) 4835 0 R (id2857074) 4855 0 R (id2857404) 4860 0 R (id2857512) 4861 0 R (id2857605) 4866 0 R (id2857674) 4867 0 R (id2857763) 4872 0 R (id2858070) 4883 0 R (id2858173) 4896 0 R (id2858187) 4897 0 R (id2858569) 4902 0 R (id2858898) 4907 0 R (id2859119) 4908 0 R (id2859169) 4914 0 R (id2859220) 4915 0 R (id2859695) 4920 0 R (id2859974) 4925 0 R (id2860139) 4928 0 R (id2860291) 4933 0 R (id2860404) 4934 0 R (id2860475) 4939 0 R (id2860706) 4944 0 R (id2860866) 4950 0 R (id2860961) 4951 0 R (id2861145) 4956 0 R (id2861254) 4961 0 R (id2861582) 4970 0 R (id2861734) 4971 0 R (id2861970) 4976 0 R (id2862131) 4981 0 R (id2862231) 4987 0 R (id2862399) 4992 0 R (id2862603) 4993 0 R (id2862714) 4998 0 R (id2862866) 5003 0 R (id2862886) 5004 0 R (id2863084) 5009 0 R (id2863374) 5014 0 R (id2863469) 5015 0 R (id2863610) 5021 0 R (id2863644) 5022 0 R (id2864080) 5042 0 R (id2864383) 5051 0 R (id2864626) 5052 0 R (id2864725) 5057 0 R (id2865070) 5071 0 R (id2865141) 5072 0 R (id2865163) 5073 0 R (id2865209) 5076 0 R (id2865250) 5081 0 R (id2865269) 5082 0 R (id2865293) 5083 0 R (id2865446) 5091 0 R (id2865775) 5097 0 R (id2865820) 5098 0 R (id2865990) 5104 0 R (id2866004) 5105 0 R (id2866017) 5106 0 R (id2866050) 5107 0 R (id2875244) 5113 0 R (id2875251) 5114 0 R (id2875304) 5116 0 R (id2875358) 5118 0 R (id2875438) 5125 0 R (id2875581) 5129 0 R (id2875663) 5134 0 R (id2875781) 5139 0 R (id2875802) 5140 0 R (id2875828) 5141 0 R (id2875865) 5146 0 R (id2875924) 5147 0 R (id2876084) 5152 0 R (id2876178) 5153 0 R (id2876253) 5160 0 R (id2876298) 5161 0 R (id2876363) 5167 0 R (id2876398) 5162 0 R (id2876486) 5179 0 R (id2876534) 5180 0 R (id2876584) 5189 0 R (id2876614) 5190 0 R (id2876696) 5198 0 R (id2876766) 5203 0 R (id2876856) 5206 0 R (id2876878) 5207 0 R (id2877018) 5216 0 R (id2877205) 5221 0 R (id2877322) 5226 0 R (id2877492) 5227 0 R (id2877542) 5234 0 R (id2877578) 5237 0 R (id2877607) 5244 0 R (id2877680) 5247 0 R (id2877710) 5254 0 R (id2877763) 5264 0 R (id2877837) 5267 0 R (id2877857) 5724 0 R (id2877893) 5268 0 R (id2877942) 5732 0 R (id2877977) 5275 0 R (id2878289) 5280 0 R (id2878402) 5285 0 R (id2878417) 5286 0 R (id2878470) 5287 0 R (id2878524) 5288 0 R (id2878740) 5298 0 R (id2878968) 5299 0 R (id2879019) 5740 0 R (id2879124) 5307 0 R (id2879355) 5312 0 R (id2879483) 5324 0 R (id2879559) 5327 0 R (id2879574) 5328 0 R (id2879613) 5329 0 R (id2879649) 5748 0 R (id2879685) 5336 0 R (id2879707) 5757 0 R (id2879747) 5337 0 R (id2879768) 5338 0 R (id2879897) 5765 0 R (id2879932) 5339 0 R (id2880008) 5344 0 R (id2880063) 5346 0 R (id2880104) 5347 0 R (id2880170) 5352 0 R (id2880187) 5353 0 R (id2880221) 5354 0 R (id2880243) 5355 0 R (id2880269) 5356 0 R (id2880323) 5362 0 R (id2880342) 5363 0 R (id2880433) 5364 0 R (id2880480) 5369 0 R (id2880678) 5376 0 R (id2880736) 5381 0 R (id2880768) 5382 0 R (id2880818) 5388 0 R (id2881040) 5397 0 R (id2881221) 5403 0 R (id2881323) 5408 0 R (id2881549) 5413 0 R (id2881644) 5423 0 R (id2881731) 5427 0 R (id2881766) 5428 0 R (id2881784) 5773 0 R (id2881819) 5433 0 R (id2881931) 5434 0 R (id2882066) 5439 0 R (id2882181) 5444 0 R (id2882294) 5453 0 R (id2882383) 5454 0 R (id2882473) 5459 0 R (id2882635) 5464 0 R (id2882652) 5465 0 R (id2882683) 5466 0 R (id2882745) 5467 0 R (id2882784) 5472 0 R (id2882835) 5473 0 R (id2882873) 5478 0 R (id2882928) 5479 0 R (id2882962) 5480 0 R (id2882995) 5485 0 R (id2883045) 5486 0 R (id2883124) 5492 0 R (id2883189) 5493 0 R (id2883222) 5494 0 R (id2883249) 5499 0 R (id2883267) 5500 0 R (id2883288) 5501 0 R (id2883388) 5506 0 R (id2883491) 5507 0 R (id2883562) 5508 0 R (id2883624) 5509 0 R (id2883682) 5514 0 R (id2883749) 5515 0 R (id2883857) 5523 0 R (id2883912) 5527 0 R (id2883936) 5528 0 R (id2883982) 5535 0 R (id2884048) 5536 0 R (id2884183) 5553 0 R (id2884269) 5559 0 R (id2884351) 5567 0 R (id2884420) 5572 0 R (id2884486) 5575 0 R (id2884947) 5613 0 R (id2884978) 5618 0 R (id2885010) 5619 0 R (id2885051) 5621 0 R (id2885123) 5622 0 R (id2885224) 5627 0 R (id2885295) 5628 0 R (id2885344) 5634 0 R (id2885358) 5635 0 R (id2885552) 5640 0 R (id2885598) 5641 0 R (id2885680) 5642 0 R (id2885741) 5647 0 R (id2885759) 5648 0 R (id2885776) 5649 0 R (id2885811) 5650 0 R (id2885824) 5651 0 R (id2885836) 5652 0 R (id2885850) 5657 0 R (id2885858) 5658 0 R (id2886072) 5663 0 R (id2886378) 5689 0 R (id2887500) 5719 0 R (id2887511) 5780 0 R (id2899670) 5788 0 R (id2899688) 5789 0 R (id2899780) 5794 0 R (id2899786) 5795 0 R (id2899825) 5796 0 R (id2899866) 5797 0 R (id2899948) 5799 0 R (id2899967) 5800 0 R (id2900105) 5806 0 R (id2900149) 5807 0 R (id2900171) 5808 0 R (id2900226) 5811 0 R (id2900257) 5813 0 R (id2901154) 5818 0 R (id2901183) 5819 0 R (id2901255) 5820 0 R (id2901315) 5825 0 R (id2901346) 5826 0 R (id2901373) 5827 0 R (id2901408) 5832 0 R (id2901431) 5833 0 R (id2901567) 5834 0 R (id2901639) 5839 0 R (id2901673) 5840 0 R (id2901701) 5841 0 R (id2901730) 5843 0 R (id2901805) 5848 0 R (id2901898) 5850 0 R (id2901960) 5851 0 R (id2902072) 5857 0 R (id2902280) 5858 0 R (id2902359) 5866 0 R (id2902476) 5867 0 R (id2902530) 5868 0 R (id2902771) 5873 0 R (id2902779) 5875 0 R (id2902941) 5885 0 R (id2903059) 5893 0 R (id2903096) 5894 0 R (id2903202) 5896 0 R (id2903426) 5903 0 R (id2903517) 5912 0 R (id2903536) 5913 0 R (id2905838) 5958 0 R (id2905893) 5959 0 R (id2906029) 5918 0 R (id2906218) 5919 0 R (id2906317) 5924 0 R (id2906335) 5925 0 R (id2906546) 5937 0 R (id2906742) 5951 0 R (id2906776) 5953 0 R (id2907676) 5965 0 R (id2907771) 5966 0 R (id2907880) 5971 0 R (id2907904) 5972 0 R (id2908004) 5973 0 R (id2908156) 5982 0 R (id2908257) 5988 0 R (id2908277) 5989 0 R (id2908298) 5990 0 R (id2908342) 5991 0 R (id2908489) 6005 0 R (id2908503) 6006 0 R (id2909710) 6011 0 R (id2909744) 6012 0 R (id2909785) 6013 0 R (id2909798) 6014 0 R (id2909891) 6019 0 R (id2910000) 6020 0 R (id2910039) 6021 0 R (id2910190) 6026 0 R (id2910198) 6027 0 R (id2910692) 6044 0 R (id2910850) 6045 0 R (id2911361) 6081 0 R (id2911426) 6086 0 R (id2911443) 6087 0 R (id2911612) 6095 0 R (id2911634) 6100 0 R (id2911650) 6101 0 R (id2911691) 6102 0 R (id2911749) 6103 0 R (id2911795) 6108 0 R (id2911815) 6109 0 R (id2911913) 6110 0 R (id2911963) 6111 0 R (id2912313) 6125 0 R (id2912457) 6127 0 R (id2912517) 6129 0 R (id2912712) 6138 0 R (id2913021) 6140 0 R (id2913034) 6141 0 R (id2913097) 6146 0 R (id2913318) 6147 0 R (id2917263) 6158 0 R (id2917531) 6163 0 R (id2917548) 6164 0 R (id2917605) 6169 0 R (id2918219) 6183 0 R (id2918250) 6184 0 R (id2918276) 6185 0 R (id2918521) 6195 0 R (id2918579) 6198 0 R (id2918662) 6203 0 R (id2918695) 6204 0 R (id2918895) 6213 0 R (id2918928) 6214 0 R (id2918963) 6219 0 R (id2918995) 6220 0 R (id2919029) 6221 0 R (id2919043) 6222 0 R (id2921165) 6232 0 R (id2921190) 6233 0 R (id2921235) 6238 0 R (id2921291) 6239 0 R (id2921415) 6244 0 R (id2921460) 6245 0 R (id2921502) 6246 0 R (id2921590) 6251 0 R (id2921738) 6256 0 R (id2921783) 6257 0 R (id2922026) 6267 0 R (id2922059) 6268 0 R (id2922084) 6269 0 R (id2922154) 6274 0 R (id2922170) 6275 0 R (id2922202) 6276 0 R (id2922254) 6277 0 R (id2922798) 6327 0 R (id2922827) 6328 0 R (id2922992) 6302 0 R (id2923017) 6303 0 R (id2923143) 6319 0 R (id2923168) 6321 0 R (id2923372) 6286 0 R (id2923574) 6287 0 R (id2923644) 6289 0 R (id2923744) 6294 0 R (id2923789) 6295 0 R (id2924342) 6333 0 R (id2924395) 6334 0 R (id2924456) 6339 0 R (id2924514) 6340 0 R (id2924559) 6309 0 R (id2924779) 6322 0 R (id2925388) 6386 0 R (id2925422) 6387 0 R (id2925477) 6341 0 R (id2925503) 6347 0 R (id2925840) 6367 0 R (id2925858) 6368 0 R (id2925922) 6370 0 R (id2925995) 6375 0 R (id2926164) 6377 0 R (id2927531) 6425 0 R (id2927781) 6392 0 R (id2927895) 6402 0 R (id2927959) 6404 0 R (id2928064) 6405 0 R (id2928128) 6411 0 R (id2928193) 6412 0 R (id2928241) 6413 0 R (id2928293) 6414 0 R (id2928316) 6415 0 R (id2929391) 6426 0 R (id2929568) 6431 0 R (id2930743) 6465 0 R (id2932367) 6471 0 R (id2932509) 6474 0 R (id2932793) 6479 0 R (id2932838) 6483 0 R (id2932990) 6490 0 R (id2933605) 6521 0 R (id2933612) 6522 0 R (id2933642) 6525 0 R (id2933658) 6526 0 R (id2933729) 6497 0 R (id2933951) 6500 0 R (id2933988) 6502 0 R (id2934130) 6507 0 R (id2934238) 6508 0 R (id2934285) 6509 0 R (id2934938) 6571 0 R (id2934971) 6528 0 R (id2935161) 6540 0 R (id2935210) 6545 0 R (id2935346) 6546 0 R (id2935483) 6551 0 R (id2935563) 6552 0 R (id2935596) 6553 0 R (id2935648) 6558 0 R (id2935740) 6559 0 R (id2935944) 6564 0 R (id2936039) 6565 0 R (id2937123) 6592 0 R (id2937469) 6572 0 R (id2937499) 6574 0 R (id2937670) 6579 0 R (id2937714) 6584 0 R (id2937721) 6585 0 R (id2937746) 6586 0 R (id2937754) 6587 0 R (id2938476) 6598 0 R (id2938483) 6599 0 R (id2938562) 6605 0 R (id2938624) 6609 0 R (id2938720) 6610 0 R (id2938728) 6611 0 R (id2938817) 6612 0 R (id2938848) 6617 0 R (id2938893) 6618 0 R (id2938924) 6620 0 R (id2938941) 6621 0 R (id2938988) 6622 0 R (id2939061) 6628 0 R (id2939085) 6629 0 R (id2939196) 6631 0 R (id2940065) 6661 0 R (id2940225) 6666 0 R (id2940228) 6637 0 R (id2940272) 6638 0 R (id2940347) 6639 0 R (id2940391) 6644 0 R (id2940444) 6645 0 R (id2940467) 6646 0 R (id2940524) 6647 0 R (id2940566) 6648 0 R (id2940587) 6653 0 R (id2940612) 6655 0 R (id2940646) 6656 0 R (id2941876) 6691 0 R (id2941944) 6695 0 R (install) 2948 0 R (integrate-ms-networks) 3028 0 R (introduction) 3862 0 R (locking) 2960 0 R (migration) 6318 0 R (msdfs) 3019 0 R (optional) 4266 0 R (page.1) 2861 0 R (page.10) 3267 0 R (page.100) 4455 0 R (page.101) 4460 0 R (page.102) 4465 0 R (page.103) 4480 0 R (page.104) 4486 0 R (page.105) 4494 0 R (page.106) 4500 0 R (page.107) 4508 0 R (page.108) 4517 0 R (page.109) 4522 0 R (page.11) 3320 0 R (page.110) 4529 0 R (page.111) 4535 0 R (page.112) 4541 0 R (page.113) 4547 0 R (page.114) 4555 0 R (page.115) 4564 0 R (page.116) 4572 0 R (page.117) 4577 0 R (page.118) 4583 0 R (page.119) 4594 0 R (page.12) 3370 0 R (page.120) 4598 0 R (page.121) 4607 0 R (page.122) 4616 0 R (page.123) 4623 0 R (page.124) 4633 0 R (page.125) 4642 0 R (page.126) 4649 0 R (page.127) 4656 0 R (page.128) 4666 0 R (page.129) 4675 0 R (page.13) 3423 0 R (page.130) 4683 0 R (page.131) 4688 0 R (page.132) 4694 0 R (page.133) 4699 0 R (page.134) 4704 0 R (page.135) 4713 0 R (page.136) 4721 0 R (page.137) 4726 0 R (page.138) 4733 0 R (page.139) 4738 0 R (page.14) 3475 0 R (page.140) 4743 0 R (page.141) 4749 0 R (page.142) 4755 0 R (page.143) 4768 0 R (page.144) 4776 0 R (page.145) 4783 0 R (page.146) 4790 0 R (page.147) 4799 0 R (page.148) 4805 0 R (page.149) 4814 0 R (page.15) 3527 0 R (page.150) 4819 0 R (page.151) 4825 0 R (page.152) 4834 0 R (page.153) 4839 0 R (page.154) 4845 0 R (page.155) 4859 0 R (page.156) 4865 0 R (page.157) 4871 0 R (page.158) 4877 0 R (page.159) 4882 0 R (page.16) 3573 0 R (page.160) 4887 0 R (page.161) 4895 0 R (page.162) 4901 0 R (page.163) 4906 0 R (page.164) 4913 0 R (page.165) 4919 0 R (page.166) 4924 0 R (page.167) 4932 0 R (page.168) 4938 0 R (page.169) 4943 0 R (page.17) 3626 0 R (page.170) 4949 0 R (page.171) 4955 0 R (page.172) 4965 0 R (page.173) 4969 0 R (page.174) 4975 0 R (page.175) 4980 0 R (page.176) 4986 0 R (page.177) 4991 0 R (page.178) 4997 0 R (page.179) 5002 0 R (page.18) 3678 0 R (page.180) 5008 0 R (page.181) 5013 0 R (page.182) 5020 0 R (page.183) 5041 0 R (page.184) 5046 0 R (page.185) 5050 0 R (page.186) 5056 0 R (page.187) 5061 0 R (page.188) 5066 0 R (page.189) 5070 0 R (page.19) 3729 0 R (page.190) 5080 0 R (page.191) 5090 0 R (page.192) 5096 0 R (page.193) 5102 0 R (page.194) 5112 0 R (page.195) 5122 0 R (page.196) 5133 0 R (page.197) 5138 0 R (page.198) 5145 0 R (page.199) 5151 0 R (page.2) 2873 0 R (page.20) 3774 0 R (page.200) 5159 0 R (page.201) 5166 0 R (page.202) 5178 0 R (page.203) 5188 0 R (page.204) 5197 0 R (page.205) 5202 0 R (page.206) 5212 0 R (page.207) 5220 0 R (page.208) 5225 0 R (page.209) 5233 0 R (page.21) 3822 0 R (page.210) 5243 0 R (page.211) 5253 0 R (page.212) 5263 0 R (page.213) 5274 0 R (page.214) 5279 0 R (page.215) 5284 0 R (page.216) 5292 0 R (page.217) 5297 0 R (page.218) 5304 0 R (page.219) 5311 0 R (page.22) 3857 0 R (page.220) 5323 0 R (page.221) 5335 0 R (page.222) 5343 0 R (page.223) 5351 0 R (page.224) 5361 0 R (page.225) 5368 0 R (page.226) 5375 0 R (page.227) 5380 0 R (page.228) 5387 0 R (page.229) 5392 0 R (page.23) 3861 0 R (page.230) 5402 0 R (page.231) 5407 0 R (page.232) 5412 0 R (page.233) 5422 0 R (page.234) 5432 0 R (page.235) 5438 0 R (page.236) 5452 0 R (page.237) 5458 0 R (page.238) 5463 0 R (page.239) 5471 0 R (page.24) 3868 0 R (page.240) 5477 0 R (page.241) 5484 0 R (page.242) 5491 0 R (page.243) 5498 0 R (page.244) 5505 0 R (page.245) 5513 0 R (page.246) 5520 0 R (page.247) 5534 0 R (page.248) 5552 0 R (page.249) 5566 0 R (page.25) 3874 0 R (page.250) 5580 0 R (page.251) 5607 0 R (page.252) 5617 0 R (page.253) 5626 0 R (page.254) 5633 0 R (page.255) 5639 0 R (page.256) 5646 0 R (page.257) 5656 0 R (page.258) 5662 0 R (page.259) 5667 0 R (page.26) 3885 0 R (page.260) 5672 0 R (page.261) 5676 0 R (page.262) 5680 0 R (page.263) 5684 0 R (page.264) 5688 0 R (page.265) 5693 0 R (page.266) 5698 0 R (page.267) 5718 0 R (page.268) 5723 0 R (page.269) 5731 0 R (page.27) 3891 0 R (page.270) 5739 0 R (page.271) 5747 0 R (page.272) 5756 0 R (page.273) 5764 0 R (page.274) 5772 0 R (page.275) 5779 0 R (page.276) 5787 0 R (page.277) 5793 0 R (page.278) 5805 0 R (page.279) 5817 0 R (page.28) 3902 0 R (page.280) 5824 0 R (page.281) 5831 0 R (page.282) 5838 0 R (page.283) 5847 0 R (page.284) 5856 0 R (page.285) 5862 0 R (page.286) 5872 0 R (page.287) 5879 0 R (page.288) 5883 0 R (page.289) 5891 0 R (page.29) 3915 0 R (page.290) 5901 0 R (page.291) 5907 0 R (page.292) 5911 0 R (page.293) 5917 0 R (page.294) 5929 0 R (page.295) 5936 0 R (page.296) 5943 0 R (page.297) 5947 0 R (page.298) 5957 0 R (page.299) 5963 0 R (page.3) 2887 0 R (page.30) 3921 0 R (page.300) 5970 0 R (page.301) 5977 0 R (page.302) 5987 0 R (page.303) 6001 0 R (page.304) 6010 0 R (page.305) 6018 0 R (page.306) 6025 0 R (page.307) 6032 0 R (page.308) 6043 0 R (page.309) 6059 0 R (page.31) 3926 0 R (page.310) 6063 0 R (page.311) 6085 0 R (page.312) 6099 0 R (page.313) 6107 0 R (page.314) 6116 0 R (page.315) 6124 0 R (page.316) 6133 0 R (page.317) 6137 0 R (page.318) 6145 0 R (page.319) 6151 0 R (page.32) 3932 0 R (page.320) 6156 0 R (page.321) 6162 0 R (page.322) 6168 0 R (page.323) 6174 0 R (page.324) 6178 0 R (page.325) 6182 0 R (page.326) 6190 0 R (page.327) 6194 0 R (page.328) 6202 0 R (page.329) 6209 0 R (page.33) 3936 0 R (page.330) 6218 0 R (page.331) 6226 0 R (page.332) 6231 0 R (page.333) 6237 0 R (page.334) 6243 0 R (page.335) 6250 0 R (page.336) 6255 0 R (page.337) 6261 0 R (page.338) 6266 0 R (page.339) 6273 0 R (page.34) 3943 0 R (page.340) 6281 0 R (page.341) 6285 0 R (page.342) 6293 0 R (page.343) 6301 0 R (page.344) 6308 0 R (page.345) 6313 0 R (page.346) 6317 0 R (page.347) 6326 0 R (page.348) 6332 0 R (page.349) 6338 0 R (page.35) 3951 0 R (page.350) 6346 0 R (page.351) 6374 0 R (page.352) 6381 0 R (page.353) 6385 0 R (page.354) 6391 0 R (page.355) 6401 0 R (page.356) 6410 0 R (page.357) 6419 0 R (page.358) 6423 0 R (page.359) 6430 0 R (page.36) 3961 0 R (page.360) 6438 0 R (page.361) 6444 0 R (page.362) 6461 0 R (page.363) 6470 0 R (page.364) 6478 0 R (page.365) 6489 0 R (page.366) 6496 0 R (page.367) 6506 0 R (page.368) 6514 0 R (page.369) 6518 0 R (page.37) 3979 0 R (page.370) 6537 0 R (page.371) 6550 0 R (page.372) 6557 0 R (page.373) 6563 0 R (page.374) 6570 0 R (page.375) 6578 0 R (page.376) 6583 0 R (page.377) 6591 0 R (page.378) 6604 0 R (page.379) 6616 0 R (page.38) 3989 0 R (page.380) 6627 0 R (page.381) 6636 0 R (page.382) 6643 0 R (page.383) 6652 0 R (page.384) 6660 0 R (page.385) 6665 0 R (page.39) 3998 0 R (page.4) 2965 0 R (page.40) 4004 0 R (page.41) 4012 0 R (page.42) 4017 0 R (page.43) 4024 0 R (page.44) 4032 0 R (page.45) 4037 0 R (page.46) 4045 0 R (page.47) 4053 0 R (page.48) 4057 0 R (page.49) 4066 0 R (page.5) 3040 0 R (page.50) 4073 0 R (page.51) 4085 0 R (page.52) 4093 0 R (page.53) 4100 0 R (page.54) 4107 0 R (page.55) 4113 0 R (page.56) 4122 0 R (page.57) 4129 0 R (page.58) 4137 0 R (page.59) 4142 0 R (page.6) 3070 0 R (page.60) 4148 0 R (page.61) 4154 0 R (page.62) 4167 0 R (page.63) 4179 0 R (page.64) 4191 0 R (page.65) 4199 0 R (page.66) 4207 0 R (page.67) 4219 0 R (page.68) 4228 0 R (page.69) 4232 0 R (page.7) 3109 0 R (page.70) 4238 0 R (page.71) 4250 0 R (page.72) 4255 0 R (page.73) 4260 0 R (page.74) 4265 0 R (page.75) 4271 0 R (page.76) 4276 0 R (page.77) 4283 0 R (page.78) 4295 0 R (page.79) 4300 0 R (page.8) 3162 0 R (page.80) 4306 0 R (page.81) 4312 0 R (page.82) 4324 0 R (page.83) 4331 0 R (page.84) 4336 0 R (page.85) 4343 0 R (page.86) 4350 0 R (page.87) 4356 0 R (page.88) 4362 0 R (page.89) 4367 0 R (page.9) 3212 0 R (page.90) 4375 0 R (page.91) 4386 0 R (page.92) 4394 0 R (page.93) 4399 0 R (page.94) 4404 0 R (page.95) 4409 0 R (page.96) 4416 0 R (page.97) 4423 0 R (page.98) 4431 0 R (page.99) 4440 0 R (pam) 3027 0 R (part.1) 6 0 R (part.2) 98 0 R (part.3) 454 0 R (part.4) 2418 0 R (part.5) 2534 0 R (part.6) 2610 0 R (passdb) 2957 0 R (printing) 3020 0 R (problems) 3036 0 R (samba-bdc) 2952 0 R (samba-pdc) 2951 0 R (section*.2) 5874 0 R (section*.3) 5884 0 R (section*.4) 5892 0 R (section*.5) 5895 0 R (section*.6) 5902 0 R (section.1.1) 14 0 R (section.1.2) 18 0 R (section.1.3) 22 0 R (section.1.4) 26 0 R (section.1.5) 30 0 R (section.1.6) 34 0 R (section.10.1) 462 0 R (section.10.2) 466 0 R (section.10.3) 470 0 R (section.10.4) 486 0 R (section.10.5) 522 0 R (section.10.6) 538 0 R (section.10.7) 550 0 R (section.10.8) 570 0 R (section.11.1) 586 0 R (section.11.2) 590 0 R (section.11.3) 610 0 R (section.11.4) 622 0 R (section.11.5) 706 0 R (section.12.1) 726 0 R (section.12.2) 730 0 R (section.12.3) 738 0 R (section.12.4) 750 0 R (section.13.1) 766 0 R (section.13.2) 770 0 R (section.13.3) 786 0 R (section.13.4) 802 0 R (section.13.5) 818 0 R (section.13.6) 858 0 R (section.14.1) 874 0 R (section.14.2) 878 0 R (section.14.3) 922 0 R (section.14.4) 938 0 R (section.14.5) 950 0 R (section.14.6) 954 0 R (section.14.7) 962 0 R (section.15.1) 970 0 R (section.15.2) 974 0 R (section.15.3) 978 0 R (section.15.4) 1006 0 R (section.15.5) 1010 0 R (section.16.1) 1026 0 R (section.16.2) 1030 0 R (section.16.3) 1034 0 R (section.16.4) 1046 0 R (section.16.5) 1058 0 R (section.17.1) 1070 0 R (section.17.2) 1074 0 R (section.18.1) 1082 0 R (section.18.10) 1278 0 R (section.18.11) 1298 0 R (section.18.12) 1302 0 R (section.18.13) 1306 0 R (section.18.14) 1310 0 R (section.18.15) 1314 0 R (section.18.2) 1086 0 R (section.18.3) 1110 0 R (section.18.4) 1122 0 R (section.18.5) 1126 0 R (section.18.6) 1154 0 R (section.18.7) 1178 0 R (section.18.8) 1226 0 R (section.18.9) 1246 0 R (section.19.1) 1330 0 R (section.19.10) 1558 0 R (section.19.11) 1626 0 R (section.19.12) 1714 0 R (section.19.13) 1734 0 R (section.19.14) 1778 0 R (section.19.15) 1810 0 R (section.19.16) 1814 0 R (section.19.17) 1830 0 R (section.19.18) 1834 0 R (section.19.19) 1850 0 R (section.19.2) 1342 0 R (section.19.3) 1358 0 R (section.19.4) 1382 0 R (section.19.5) 1418 0 R (section.19.6) 1498 0 R (section.19.7) 1514 0 R (section.19.8) 1526 0 R (section.19.9) 1538 0 R (section.2.1) 42 0 R (section.2.2) 46 0 R (section.2.3) 62 0 R (section.2.4) 66 0 R (section.2.5) 70 0 R (section.2.6) 74 0 R (section.2.7) 78 0 R (section.20.1) 1874 0 R (section.20.2) 1878 0 R (section.20.3) 1882 0 R (section.20.4) 1906 0 R (section.20.5) 1918 0 R (section.21.1) 1926 0 R (section.21.2) 1930 0 R (section.21.3) 1934 0 R (section.21.4) 1942 0 R (section.21.5) 1970 0 R (section.21.6) 2018 0 R (section.21.7) 2022 0 R (section.22.1) 2030 0 R (section.22.2) 2034 0 R (section.22.3) 2038 0 R (section.22.4) 2046 0 R (section.22.5) 2054 0 R (section.23.1) 2062 0 R (section.23.2) 2066 0 R (section.23.3) 2090 0 R (section.23.4) 2106 0 R (section.23.5) 2110 0 R (section.24.1) 2122 0 R (section.24.2) 2126 0 R (section.24.3) 2190 0 R (section.24.4) 2194 0 R (section.24.5) 2198 0 R (section.24.6) 2218 0 R (section.25.1) 2238 0 R (section.25.2) 2242 0 R (section.25.3) 2294 0 R (section.26.1) 2306 0 R (section.26.2) 2310 0 R (section.26.3) 2314 0 R (section.26.4) 2334 0 R (section.26.5) 2358 0 R (section.27.1) 2378 0 R (section.27.2) 2382 0 R (section.27.3) 2386 0 R (section.27.4) 2390 0 R (section.27.5) 2394 0 R (section.28.1) 2402 0 R (section.28.2) 2406 0 R (section.29.1) 2414 0 R (section.3.1) 94 0 R (section.30.1) 2426 0 R (section.30.2) 2430 0 R (section.30.3) 2434 0 R (section.31.1) 2442 0 R (section.31.2) 2474 0 R (section.32.1) 2490 0 R (section.33.1) 2542 0 R (section.33.2) 2546 0 R (section.33.3) 2550 0 R (section.33.4) 2554 0 R (section.34.1) 2562 0 R (section.34.2) 2566 0 R (section.34.3) 2570 0 R (section.34.4) 2574 0 R (section.34.5) 2578 0 R (section.35.1) 2586 0 R (section.35.2) 2590 0 R (section.35.3) 2594 0 R (section.35.4) 2598 0 R (section.35.5) 2602 0 R (section.35.6) 2606 0 R (section.36.1) 2618 0 R (section.36.2) 2638 0 R (section.36.3) 2642 0 R (section.36.4) 2646 0 R (section.36.5) 2662 0 R (section.36.6) 2674 0 R (section.37.1) 2682 0 R (section.37.2) 2686 0 R (section.37.3) 2690 0 R (section.37.4) 2694 0 R (section.37.5) 2698 0 R (section.37.6) 2706 0 R (section.38.1) 2722 0 R (section.38.2) 2726 0 R (section.38.3) 2742 0 R (section.38.4) 2770 0 R (section.38.5) 2778 0 R (section.38.6) 2782 0 R (section.39.1) 2790 0 R (section.39.10) 2826 0 R (section.39.11) 2830 0 R (section.39.2) 2794 0 R (section.39.3) 2798 0 R (section.39.4) 2802 0 R (section.39.5) 2806 0 R (section.39.6) 2810 0 R (section.39.7) 2814 0 R (section.39.8) 2818 0 R (section.39.9) 2822 0 R (section.4.1) 106 0 R (section.4.2) 110 0 R (section.4.3) 114 0 R (section.4.4) 158 0 R (section.4.5) 162 0 R (section.40.1) 2838 0 R (section.41.1) 2846 0 R (section.41.2) 2850 0 R (section.41.3) 2854 0 R (section.5.1) 186 0 R (section.5.2) 190 0 R (section.5.3) 202 0 R (section.5.4) 206 0 R (section.5.5) 210 0 R (section.5.6) 234 0 R (section.6.1) 266 0 R (section.6.2) 270 0 R (section.6.3) 294 0 R (section.6.4) 302 0 R (section.7.1) 326 0 R (section.7.2) 330 0 R (section.7.3) 362 0 R (section.7.4) 374 0 R (section.7.5) 406 0 R (section.8.1) 422 0 R (section.8.2) 426 0 R (section.8.3) 430 0 R (section.8.4) 442 0 R (section.9.1) 450 0 R (securing-samba) 2961 0 R (speed) 3064 0 R (subfigure.19.1.1) 5168 0 R (subfigure.19.10.1) 5741 0 R (subfigure.19.11.1) 5749 0 R (subfigure.19.12.1) 5758 0 R (subfigure.19.13.1) 5766 0 R (subfigure.19.14.1) 5774 0 R (subfigure.19.15.1) 5781 0 R (subfigure.19.2.1) 5181 0 R (subfigure.19.3.1) 5191 0 R (subfigure.19.4.1) 5235 0 R (subfigure.19.5.1) 5245 0 R (subfigure.19.6.1) 5255 0 R (subfigure.19.7.1) 5265 0 R (subfigure.19.8.1) 5725 0 R (subfigure.19.9.1) 5733 0 R (subsection.10.3.1) 474 0 R (subsection.10.3.2) 478 0 R (subsection.10.3.3) 482 0 R (subsection.10.4.1) 490 0 R (subsection.10.4.2) 494 0 R (subsection.10.4.3) 498 0 R (subsection.10.4.4) 502 0 R (subsection.10.4.5) 506 0 R (subsection.10.4.6) 510 0 R (subsection.10.4.7) 514 0 R (subsection.10.4.8) 518 0 R (subsection.10.5.1) 526 0 R (subsection.10.5.2) 530 0 R (subsection.10.5.3) 534 0 R (subsection.10.6.1) 542 0 R (subsection.10.6.2) 546 0 R (subsection.10.7.1) 554 0 R (subsection.10.7.2) 558 0 R (subsection.10.7.3) 562 0 R (subsection.10.8.1) 574 0 R (subsection.10.8.2) 578 0 R (subsection.11.2.1) 594 0 R (subsection.11.2.2) 606 0 R (subsection.11.3.1) 614 0 R (subsection.11.3.2) 618 0 R (subsection.11.4.1) 626 0 R (subsection.11.4.2) 630 0 R (subsection.11.4.3) 634 0 R (subsection.11.4.4) 638 0 R (subsection.11.4.5) 682 0 R (subsection.11.4.6) 702 0 R (subsection.11.5.1) 710 0 R (subsection.11.5.2) 714 0 R (subsection.11.5.3) 718 0 R (subsection.12.2.1) 734 0 R (subsection.12.3.1) 742 0 R (subsection.12.3.2) 746 0 R (subsection.12.4.1) 754 0 R (subsection.12.4.2) 758 0 R (subsection.13.2.1) 774 0 R (subsection.13.2.2) 778 0 R (subsection.13.2.3) 782 0 R (subsection.13.3.1) 790 0 R (subsection.13.3.2) 794 0 R (subsection.13.3.3) 798 0 R (subsection.13.4.1) 806 0 R (subsection.13.5.1) 822 0 R (subsection.13.5.2) 826 0 R (subsection.13.5.3) 830 0 R (subsection.13.5.4) 834 0 R (subsection.13.5.5) 846 0 R (subsection.13.5.6) 850 0 R (subsection.13.5.7) 854 0 R (subsection.13.6.1) 862 0 R (subsection.13.6.2) 866 0 R (subsection.14.2.1) 882 0 R (subsection.14.3.1) 926 0 R (subsection.14.4.1) 942 0 R (subsection.14.4.2) 946 0 R (subsection.14.6.1) 958 0 R (subsection.15.3.1) 982 0 R (subsection.15.3.2) 986 0 R (subsection.15.3.3) 990 0 R (subsection.15.3.4) 994 0 R (subsection.15.3.5) 998 0 R (subsection.15.3.6) 1002 0 R (subsection.15.5.1) 1014 0 R (subsection.15.5.2) 1018 0 R (subsection.16.3.1) 1038 0 R (subsection.16.3.2) 1042 0 R (subsection.16.4.1) 1050 0 R (subsection.16.4.2) 1054 0 R (subsection.16.5.1) 1062 0 R (subsection.18.10.1) 1282 0 R (subsection.18.10.2) 1286 0 R (subsection.18.10.3) 1290 0 R (subsection.18.10.4) 1294 0 R (subsection.18.15.1) 1318 0 R (subsection.18.15.2) 1322 0 R (subsection.18.2.1) 1090 0 R (subsection.18.2.2) 1094 0 R (subsection.18.2.3) 1098 0 R (subsection.18.2.4) 1102 0 R (subsection.18.2.5) 1106 0 R (subsection.18.3.1) 1114 0 R (subsection.18.3.2) 1118 0 R (subsection.18.5.1) 1130 0 R (subsection.18.5.2) 1134 0 R (subsection.18.5.3) 1138 0 R (subsection.18.5.4) 1142 0 R (subsection.18.5.5) 1146 0 R (subsection.18.5.6) 1150 0 R (subsection.18.6.1) 1158 0 R (subsection.18.6.2) 1162 0 R (subsection.18.6.3) 1166 0 R (subsection.18.6.4) 1170 0 R (subsection.18.6.5) 1174 0 R (subsection.18.7.1) 1182 0 R (subsection.18.7.2) 1186 0 R (subsection.18.8.1) 1230 0 R (subsection.18.8.2) 1234 0 R (subsection.18.8.3) 1238 0 R (subsection.18.8.4) 1242 0 R (subsection.18.9.1) 1250 0 R (subsection.18.9.2) 1254 0 R (subsection.18.9.3) 1258 0 R (subsection.18.9.4) 1262 0 R (subsection.18.9.5) 1266 0 R (subsection.18.9.6) 1270 0 R (subsection.18.9.7) 1274 0 R (subsection.19.1.1) 1334 0 R (subsection.19.1.2) 1338 0 R (subsection.19.10.1) 1562 0 R (subsection.19.10.10) 1598 0 R (subsection.19.10.11) 1602 0 R (subsection.19.10.12) 1606 0 R (subsection.19.10.13) 1610 0 R (subsection.19.10.14) 1614 0 R (subsection.19.10.15) 1618 0 R (subsection.19.10.16) 1622 0 R (subsection.19.10.2) 1566 0 R (subsection.19.10.3) 1570 0 R (subsection.19.10.4) 1574 0 R (subsection.19.10.5) 1578 0 R (subsection.19.10.6) 1582 0 R (subsection.19.10.7) 1586 0 R (subsection.19.10.8) 1590 0 R (subsection.19.10.9) 1594 0 R (subsection.19.11.1) 1630 0 R (subsection.19.11.2) 1634 0 R (subsection.19.11.3) 1638 0 R (subsection.19.11.4) 1642 0 R (subsection.19.11.5) 1646 0 R (subsection.19.11.6) 1710 0 R (subsection.19.12.1) 1718 0 R (subsection.19.12.2) 1722 0 R (subsection.19.12.3) 1726 0 R (subsection.19.12.4) 1730 0 R (subsection.19.13.1) 1738 0 R (subsection.19.13.2) 1774 0 R (subsection.19.14.1) 1782 0 R (subsection.19.14.2) 1786 0 R (subsection.19.14.3) 1790 0 R (subsection.19.14.4) 1794 0 R (subsection.19.14.5) 1798 0 R (subsection.19.14.6) 1802 0 R (subsection.19.14.7) 1806 0 R (subsection.19.16.1) 1818 0 R (subsection.19.16.2) 1822 0 R (subsection.19.16.3) 1826 0 R (subsection.19.18.1) 1838 0 R (subsection.19.18.2) 1842 0 R (subsection.19.18.3) 1846 0 R (subsection.19.19.1) 1854 0 R (subsection.19.19.2) 1858 0 R (subsection.19.19.3) 1862 0 R (subsection.19.19.4) 1866 0 R (subsection.19.2.1) 1346 0 R (subsection.19.2.2) 1350 0 R (subsection.19.2.3) 1354 0 R (subsection.19.3.1) 1362 0 R (subsection.19.3.2) 1366 0 R (subsection.19.3.3) 1370 0 R (subsection.19.3.4) 1374 0 R (subsection.19.3.5) 1378 0 R (subsection.19.4.1) 1386 0 R (subsection.19.4.2) 1390 0 R (subsection.19.4.3) 1394 0 R (subsection.19.4.4) 1398 0 R (subsection.19.4.5) 1402 0 R (subsection.19.4.6) 1406 0 R (subsection.19.4.7) 1410 0 R (subsection.19.4.8) 1414 0 R (subsection.19.5.1) 1422 0 R (subsection.19.5.10) 1458 0 R (subsection.19.5.11) 1462 0 R (subsection.19.5.12) 1466 0 R (subsection.19.5.13) 1470 0 R (subsection.19.5.14) 1474 0 R (subsection.19.5.15) 1478 0 R (subsection.19.5.16) 1482 0 R (subsection.19.5.17) 1486 0 R (subsection.19.5.18) 1490 0 R (subsection.19.5.19) 1494 0 R (subsection.19.5.2) 1426 0 R (subsection.19.5.3) 1430 0 R (subsection.19.5.4) 1434 0 R (subsection.19.5.5) 1438 0 R (subsection.19.5.6) 1442 0 R (subsection.19.5.7) 1446 0 R (subsection.19.5.8) 1450 0 R (subsection.19.5.9) 1454 0 R (subsection.19.6.1) 1502 0 R (subsection.19.6.2) 1506 0 R (subsection.19.6.3) 1510 0 R (subsection.19.7.1) 1518 0 R (subsection.19.7.2) 1522 0 R (subsection.19.8.1) 1530 0 R (subsection.19.8.2) 1534 0 R (subsection.19.9.1) 1542 0 R (subsection.19.9.2) 1546 0 R (subsection.19.9.3) 1550 0 R (subsection.19.9.4) 1554 0 R (subsection.2.2.1) 50 0 R (subsection.2.2.2) 58 0 R (subsection.2.7.1) 82 0 R (subsection.2.7.2) 86 0 R (subsection.20.3.1) 1886 0 R (subsection.20.3.2) 1890 0 R (subsection.20.3.3) 1894 0 R (subsection.20.3.4) 1898 0 R (subsection.20.3.5) 1902 0 R (subsection.20.4.1) 1910 0 R (subsection.20.4.2) 1914 0 R (subsection.21.3.1) 1938 0 R (subsection.21.4.1) 1946 0 R (subsection.21.4.2) 1950 0 R (subsection.21.4.3) 1954 0 R (subsection.21.4.4) 1958 0 R (subsection.21.4.5) 1962 0 R (subsection.21.4.6) 1966 0 R (subsection.21.5.1) 1974 0 R (subsection.21.5.2) 1978 0 R (subsection.21.5.3) 1982 0 R (subsection.22.3.1) 2042 0 R (subsection.22.4.1) 2050 0 R (subsection.23.2.1) 2070 0 R (subsection.23.2.2) 2074 0 R (subsection.23.2.3) 2082 0 R (subsection.23.3.1) 2094 0 R (subsection.23.3.2) 2098 0 R (subsection.23.3.3) 2102 0 R (subsection.23.5.1) 2114 0 R (subsection.24.2.1) 2130 0 R (subsection.24.2.2) 2150 0 R (subsection.24.2.3) 2166 0 R (subsection.24.2.4) 2170 0 R (subsection.24.5.1) 2202 0 R (subsection.24.5.2) 2210 0 R (subsection.24.5.3) 2214 0 R (subsection.24.6.1) 2222 0 R (subsection.24.6.2) 2226 0 R (subsection.24.6.3) 2230 0 R (subsection.25.2.1) 2246 0 R (subsection.25.2.2) 2254 0 R (subsection.25.2.3) 2266 0 R (subsection.25.2.4) 2270 0 R (subsection.25.2.5) 2274 0 R (subsection.25.3.1) 2298 0 R (subsection.26.3.1) 2318 0 R (subsection.26.3.2) 2322 0 R (subsection.26.3.3) 2326 0 R (subsection.26.3.4) 2330 0 R (subsection.26.4.1) 2338 0 R (subsection.26.4.2) 2342 0 R (subsection.26.4.3) 2346 0 R (subsection.26.4.4) 2350 0 R (subsection.26.4.5) 2354 0 R (subsection.26.5.1) 2362 0 R (subsection.26.5.2) 2366 0 R (subsection.26.5.3) 2370 0 R (subsection.31.1.1) 2446 0 R (subsection.31.1.2) 2470 0 R (subsection.31.2.1) 2478 0 R (subsection.31.2.2) 2482 0 R (subsection.32.1.1) 2494 0 R (subsection.32.1.10) 2530 0 R (subsection.32.1.2) 2498 0 R (subsection.32.1.3) 2502 0 R (subsection.32.1.4) 2506 0 R (subsection.32.1.5) 2510 0 R (subsection.32.1.6) 2514 0 R (subsection.32.1.7) 2518 0 R (subsection.32.1.8) 2522 0 R (subsection.32.1.9) 2526 0 R (subsection.36.1.1) 2622 0 R (subsection.36.1.2) 2626 0 R (subsection.36.4.1) 2650 0 R (subsection.36.5.1) 2666 0 R (subsection.36.5.2) 2670 0 R (subsection.37.5.1) 2702 0 R (subsection.37.6.1) 2710 0 R (subsection.37.6.2) 2714 0 R (subsection.38.2.1) 2730 0 R (subsection.38.2.2) 2734 0 R (subsection.38.2.3) 2738 0 R (subsection.38.3.1) 2746 0 R (subsection.38.3.2) 2750 0 R (subsection.38.3.3) 2754 0 R (subsection.38.3.4) 2758 0 R (subsection.38.3.5) 2762 0 R (subsection.38.3.6) 2766 0 R (subsection.38.4.1) 2774 0 R (subsection.4.3.1) 118 0 R (subsection.4.3.2) 126 0 R (subsection.4.3.3) 134 0 R (subsection.4.3.4) 142 0 R (subsection.4.3.5) 150 0 R (subsection.4.5.1) 166 0 R (subsection.4.5.2) 170 0 R (subsection.4.5.3) 174 0 R (subsection.4.5.4) 178 0 R (subsection.5.2.1) 194 0 R (subsection.5.2.2) 198 0 R (subsection.5.5.1) 214 0 R (subsection.5.5.2) 230 0 R (subsection.5.6.1) 238 0 R (subsection.5.6.2) 242 0 R (subsection.5.6.3) 246 0 R (subsection.5.6.4) 250 0 R (subsection.5.6.5) 254 0 R (subsection.5.6.6) 258 0 R (subsection.6.2.1) 274 0 R (subsection.6.2.2) 282 0 R (subsection.6.2.3) 286 0 R (subsection.6.2.4) 290 0 R (subsection.6.3.1) 298 0 R (subsection.6.4.1) 306 0 R (subsection.6.4.2) 310 0 R (subsection.6.4.3) 314 0 R (subsection.6.4.4) 318 0 R (subsection.7.2.1) 334 0 R (subsection.7.2.2) 338 0 R (subsection.7.2.3) 342 0 R (subsection.7.2.4) 346 0 R (subsection.7.3.1) 366 0 R (subsection.7.3.2) 370 0 R (subsection.7.4.1) 378 0 R (subsection.7.4.2) 382 0 R (subsection.7.4.3) 386 0 R (subsection.7.4.4) 394 0 R (subsection.7.4.5) 398 0 R (subsection.7.4.6) 402 0 R (subsection.7.5.1) 410 0 R (subsection.7.5.2) 414 0 R (subsection.8.3.1) 434 0 R (subsection.8.3.2) 438 0 R (subsubsection.10.7.3.1) 566 0 R (subsubsection.11.2.1.1) 598 0 R (subsubsection.11.2.1.2) 602 0 R (subsubsection.11.4.4.1) 642 0 R (subsubsection.11.4.4.10) 678 0 R (subsubsection.11.4.4.2) 646 0 R (subsubsection.11.4.4.3) 650 0 R (subsubsection.11.4.4.4) 654 0 R (subsubsection.11.4.4.5) 658 0 R (subsubsection.11.4.4.6) 662 0 R (subsubsection.11.4.4.7) 666 0 R (subsubsection.11.4.4.8) 670 0 R (subsubsection.11.4.4.9) 674 0 R (subsubsection.11.4.5.1) 686 0 R (subsubsection.11.4.5.2) 690 0 R (subsubsection.11.4.5.3) 694 0 R (subsubsection.11.4.5.4) 698 0 R (subsubsection.13.4.1.1) 810 0 R (subsubsection.13.4.1.2) 814 0 R (subsubsection.13.5.4.1) 838 0 R (subsubsection.13.5.4.2) 842 0 R (subsubsection.14.2.1.1) 886 0 R (subsubsection.14.2.1.2) 890 0 R (subsubsection.14.2.1.3) 894 0 R (subsubsection.14.2.1.4) 898 0 R (subsubsection.14.2.1.5) 902 0 R (subsubsection.14.2.1.6) 906 0 R (subsubsection.14.2.1.7) 910 0 R (subsubsection.14.2.1.8) 914 0 R (subsubsection.14.2.1.9) 918 0 R (subsubsection.14.3.1.1) 930 0 R (subsubsection.14.3.1.2) 934 0 R (subsubsection.18.7.2.1) 1190 0 R (subsubsection.18.7.2.2) 1194 0 R (subsubsection.18.7.2.3) 1198 0 R (subsubsection.18.7.2.4) 1202 0 R (subsubsection.18.7.2.5) 1206 0 R (subsubsection.18.7.2.6) 1210 0 R (subsubsection.18.7.2.7) 1214 0 R (subsubsection.18.7.2.8) 1218 0 R (subsubsection.18.7.2.9) 1222 0 R (subsubsection.19.11.5.1) 1650 0 R (subsubsection.19.11.5.10) 1686 0 R (subsubsection.19.11.5.11) 1690 0 R (subsubsection.19.11.5.12) 1694 0 R (subsubsection.19.11.5.13) 1698 0 R (subsubsection.19.11.5.14) 1702 0 R (subsubsection.19.11.5.15) 1706 0 R (subsubsection.19.11.5.2) 1654 0 R (subsubsection.19.11.5.3) 1658 0 R (subsubsection.19.11.5.4) 1662 0 R (subsubsection.19.11.5.5) 1666 0 R (subsubsection.19.11.5.6) 1670 0 R (subsubsection.19.11.5.7) 1674 0 R (subsubsection.19.11.5.8) 1678 0 R (subsubsection.19.11.5.9) 1682 0 R (subsubsection.19.13.1.1) 1742 0 R (subsubsection.19.13.1.2) 1746 0 R (subsubsection.19.13.1.3) 1750 0 R (subsubsection.19.13.1.4) 1754 0 R (subsubsection.19.13.1.5) 1758 0 R (subsubsection.19.13.1.6) 1762 0 R (subsubsection.19.13.1.7) 1766 0 R (subsubsection.19.13.1.8) 1770 0 R (subsubsection.2.2.1.1) 54 0 R (subsubsection.21.5.3.1) 1986 0 R (subsubsection.21.5.3.2) 1990 0 R (subsubsection.21.5.3.3) 1994 0 R (subsubsection.21.5.3.4) 1998 0 R (subsubsection.21.5.3.5) 2002 0 R (subsubsection.21.5.3.6) 2006 0 R (subsubsection.21.5.3.7) 2010 0 R (subsubsection.21.5.3.8) 2014 0 R (subsubsection.23.2.2.1) 2078 0 R (subsubsection.23.2.3.1) 2086 0 R (subsubsection.24.2.1.1) 2134 0 R (subsubsection.24.2.1.2) 2138 0 R (subsubsection.24.2.1.3) 2142 0 R (subsubsection.24.2.1.4) 2146 0 R (subsubsection.24.2.2.1) 2154 0 R (subsubsection.24.2.2.2) 2158 0 R (subsubsection.24.2.2.3) 2162 0 R (subsubsection.24.2.4.1) 2174 0 R (subsubsection.24.2.4.2) 2178 0 R (subsubsection.24.2.4.3) 2182 0 R (subsubsection.24.2.4.4) 2186 0 R (subsubsection.24.5.1.1) 2206 0 R (subsubsection.25.2.1.1) 2250 0 R (subsubsection.25.2.2.1) 2258 0 R (subsubsection.25.2.2.2) 2262 0 R (subsubsection.25.2.5.1) 2278 0 R (subsubsection.25.2.5.2) 2282 0 R (subsubsection.25.2.5.3) 2286 0 R (subsubsection.25.2.5.4) 2290 0 R (subsubsection.31.1.1.1) 2450 0 R (subsubsection.31.1.1.2) 2454 0 R (subsubsection.31.1.1.3) 2458 0 R (subsubsection.31.1.1.4) 2462 0 R (subsubsection.31.1.1.5) 2466 0 R (subsubsection.36.1.2.1) 2630 0 R (subsubsection.36.1.2.2) 2634 0 R (subsubsection.36.4.1.1) 2654 0 R (subsubsection.36.4.1.2) 2658 0 R (subsubsection.4.3.1.1) 122 0 R (subsubsection.4.3.2.1) 130 0 R (subsubsection.4.3.3.1) 138 0 R (subsubsection.4.3.4.1) 146 0 R (subsubsection.4.3.5.1) 154 0 R (subsubsection.5.5.1.1) 218 0 R (subsubsection.5.5.1.2) 222 0 R (subsubsection.5.5.1.3) 226 0 R (subsubsection.6.2.1.1) 278 0 R (subsubsection.7.2.4.1) 350 0 R (subsubsection.7.2.4.2) 354 0 R (subsubsection.7.2.4.3) 358 0 R (subsubsection.7.4.3.1) 390 0 R (table.10.1) 4369 0 R (table.10.2) 4371 0 R (table.10.3) 4377 0 R (table.10.4) 4379 0 R (table.11.1) 4524 0 R (table.11.2) 4531 0 R (table.11.3) 4537 0 R (table.13.1) 4589 0 R (table.13.2) 4609 0 R (table.13.3) 4618 0 R (table.13.4) 4625 0 R (table.20.1) 5798 0 R (table.24.1) 6126 0 R (table.24.2) 6128 0 R (table.24.3) 6139 0 R (table.25.1) 6205 0 R (table.31.1) 6369 0 R (table.31.2) 6376 0 R (table.7.1) 4183 0 R (troubleshooting) 6424 0 R (type) 3937 0 R (unicode) 3029 0 R (upgrading-to-3.0) 3032 0 R (winbind) 3023 0 R (winbind-solaris9) 5887 0 R] +/Limits [(AccessControls) (winbind-solaris9)] >> endobj -3772 0 obj << -/Kids [3771 0 R] +6737 0 obj << +/Kids [6736 0 R] >> endobj -3773 0 obj << -/Dests 3772 0 R +6738 0 obj << +/Dests 6737 0 R >> endobj -3774 0 obj << +6739 0 obj << /Type /Catalog -/Pages 3769 0 R -/Outlines 3770 0 R -/Names 3773 0 R +/Pages 6734 0 R +/Outlines 6735 0 R +/Names 6738 0 R /PageMode /UseOutlines /URI<> /ViewerPreferences<<>> -/OpenAction 1609 0 R -/PTEX.Fullbanner (This is pdfTeX, Version 3.14159-1.10a) +/OpenAction 2857 0 R +/PTEX.Fullbanner (This is pdfTeX, Version 3.14159-1.10b) >> endobj -3775 0 obj << -/Producer (pdfTeX-1.10a) -/Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfTeX-1.10a)/Keywords() -/Creator (TeX) -/CreationDate (D:20030501010500) +6740 0 obj << +/Author()/Title()/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfTeX-1.10b)/Keywords() +/CreationDate (D:20030701232500) >> endobj xref -0 3776 +0 6741 0000000001 65535 f 0000000002 00000 f 0000000003 00000 f 0000000004 00000 f 0000000000 00000 f 0000000009 00000 n -0000136457 00000 n -0001055067 00000 n +0000294422 00000 n +0002263819 00000 n 0000000051 00000 n 0000000091 00000 n -0000140279 00000 n -0001054958 00000 n +0000298358 00000 n +0002263710 00000 n 0000000136 00000 n 0000000178 00000 n -0000140403 00000 n -0001054884 00000 n +0000298482 00000 n +0002263636 00000 n 0000000226 00000 n 0000000259 00000 n -0000140526 00000 n -0001054797 00000 n +0000298604 00000 n +0002263549 00000 n 0000000307 00000 n 0000000341 00000 n -0000144468 00000 n -0001054710 00000 n +0000303319 00000 n +0002263462 00000 n 0000000389 00000 n 0000000428 00000 n -0000148740 00000 n -0001054623 00000 n +0000308603 00000 n +0002263375 00000 n 0000000476 00000 n 0000000514 00000 n -0000148864 00000 n -0001054536 00000 n +0000308727 00000 n +0002263288 00000 n 0000000562 00000 n -0000000605 00000 n -0000154611 00000 n -0001054449 00000 n -0000000653 00000 n -0000000684 00000 n -0000154735 00000 n -0001054375 00000 n -0000000732 00000 n -0000000768 00000 n -0000158156 00000 n -0001054265 00000 n -0000000814 00000 n -0000000864 00000 n -0000158280 00000 n -0001054191 00000 n -0000000912 00000 n -0000000965 00000 n -0000158403 00000 n -0001054067 00000 n -0000001013 00000 n -0000001053 00000 n -0000158527 00000 n -0001053956 00000 n -0000001106 00000 n -0000001156 00000 n -0000158651 00000 n -0001053895 00000 n -0000001214 00000 n +0000000593 00000 n +0000310915 00000 n +0002263214 00000 n +0000000641 00000 n +0000000677 00000 n +0000314590 00000 n +0002263091 00000 n +0000000723 00000 n +0000000773 00000 n +0000314714 00000 n +0002263017 00000 n +0000000821 00000 n +0000000874 00000 n +0000314837 00000 n +0002262893 00000 n +0000000922 00000 n +0000000975 00000 n +0000314961 00000 n +0002262782 00000 n +0000001028 00000 n +0000001074 00000 n +0000315085 00000 n +0002262721 00000 n +0000001132 00000 n +0000001194 00000 n +0000319356 00000 n +0002262647 00000 n +0000001247 00000 n 0000001276 00000 n -0000162385 00000 n -0001053821 00000 n -0000001329 00000 n -0000001358 00000 n -0000162509 00000 n -0001053734 00000 n -0000001406 00000 n -0000001476 00000 n -0000162632 00000 n -0001053647 00000 n -0000001524 00000 n -0000001582 00000 n -0000162756 00000 n -0001053560 00000 n -0000001630 00000 n -0000001726 00000 n -0000162880 00000 n -0001053486 00000 n -0000001774 00000 n -0000001823 00000 n -0000163666 00000 n -0001053359 00000 n -0000001866 00000 n -0000001915 00000 n -0000166659 00000 n -0001053247 00000 n -0000001961 00000 n -0000002010 00000 n -0000166783 00000 n -0001053173 00000 n -0000002058 00000 n -0000002099 00000 n -0000166907 00000 n -0001053086 00000 n -0000002147 00000 n -0000002190 00000 n -0000170588 00000 n -0001052972 00000 n -0000002238 00000 n -0000002279 00000 n -0000170711 00000 n -0001052908 00000 n -0000002333 00000 n -0000002382 00000 n -0000174048 00000 n -0001052778 00000 n -0000002429 00000 n -0000002478 00000 n -0000174173 00000 n -0001052674 00000 n -0000002527 00000 n -0000002580 00000 n -0000174298 00000 n -0001052595 00000 n -0000002634 00000 n -0000002679 00000 n -0000174547 00000 n -0001052502 00000 n -0000002733 00000 n -0000002779 00000 n -0000179862 00000 n -0001052370 00000 n -0000002833 00000 n -0000002880 00000 n -0000179987 00000 n -0001052291 00000 n -0000002939 00000 n -0000003025 00000 n -0000183593 00000 n -0001052212 00000 n -0000003084 00000 n -0000003157 00000 n -0000187287 00000 n -0001052080 00000 n -0000003211 00000 n -0000003258 00000 n -0000187411 00000 n -0001052015 00000 n -0000003317 00000 n -0000003398 00000 n -0000187536 00000 n -0001051936 00000 n -0000003452 00000 n +0000319480 00000 n +0002262560 00000 n +0000001324 00000 n +0000001394 00000 n +0000319603 00000 n +0002262473 00000 n +0000001442 00000 n +0000001500 00000 n +0000319727 00000 n +0002262386 00000 n +0000001548 00000 n +0000001644 00000 n +0000319851 00000 n +0002262299 00000 n +0000001692 00000 n +0000001741 00000 n +0000322705 00000 n +0002262188 00000 n +0000001789 00000 n +0000001825 00000 n +0000322829 00000 n +0002262114 00000 n +0000001878 00000 n +0000001948 00000 n +0000323996 00000 n +0002262040 00000 n +0000002001 00000 n +0000002160 00000 n +0000324896 00000 n +0002261930 00000 n +0000002206 00000 n +0000002255 00000 n +0000325020 00000 n +0002261869 00000 n +0000002303 00000 n +0000002330 00000 n +0000325751 00000 n +0002261740 00000 n +0000002373 00000 n +0000002423 00000 n +0000329370 00000 n +0002261623 00000 n +0000002470 00000 n +0000002523 00000 n +0000329495 00000 n +0002261544 00000 n +0000002572 00000 n +0000002617 00000 n +0000329620 00000 n +0002261451 00000 n +0000002666 00000 n +0000002702 00000 n +0000333853 00000 n +0002261319 00000 n +0000002751 00000 n +0000002795 00000 n +0000333977 00000 n +0002261201 00000 n +0000002849 00000 n +0000002894 00000 n +0000337565 00000 n +0002261136 00000 n +0000002953 00000 n +0000003002 00000 n +0000337690 00000 n +0002261004 00000 n +0000003056 00000 n +0000003102 00000 n +0000337815 00000 n +0002260939 00000 n +0000003161 00000 n +0000003210 00000 n +0000337940 00000 n +0002260807 00000 n +0000003264 00000 n +0000003334 00000 n +0000338065 00000 n +0002260742 00000 n +0000003393 00000 n +0000003442 00000 n +0000343638 00000 n +0002260610 00000 n 0000003496 00000 n -0000189919 00000 n -0001051805 00000 n -0000003543 00000 n -0000003615 00000 n -0000190044 00000 n -0001051726 00000 n -0000003664 00000 n -0000003708 00000 n -0000190169 00000 n -0001051633 00000 n -0000003757 00000 n -0000003791 00000 n -0000192905 00000 n -0001051540 00000 n -0000003840 00000 n -0000003903 00000 n -0000199218 00000 n -0001051408 00000 n -0000003952 00000 n -0000004041 00000 n -0000203306 00000 n -0001051329 00000 n -0000004095 00000 n -0000004162 00000 n -0000208020 00000 n -0001051236 00000 n -0000004216 00000 n -0000004289 00000 n -0000208145 00000 n -0001051157 00000 n -0000004343 00000 n -0000004401 00000 n -0000212003 00000 n -0001051025 00000 n -0000004450 00000 n -0000004500 00000 n -0000212128 00000 n -0001050946 00000 n -0000004554 00000 n -0000004623 00000 n -0000212253 00000 n -0001050853 00000 n -0000004677 00000 n -0000004884 00000 n -0000212377 00000 n -0001050760 00000 n -0000004938 00000 n -0000005010 00000 n -0000216554 00000 n -0001050667 00000 n -0000005064 00000 n -0000005177 00000 n -0000216679 00000 n -0001050588 00000 n -0000005231 00000 n -0000005375 00000 n -0000216802 00000 n -0001050470 00000 n -0000005424 00000 n -0000005480 00000 n -0000219993 00000 n -0001050405 00000 n -0000005534 00000 n -0000005602 00000 n -0000225948 00000 n -0001050274 00000 n -0000005649 00000 n -0000005725 00000 n -0000226073 00000 n -0001050195 00000 n -0000005774 00000 n -0000005818 00000 n -0000226198 00000 n -0001050102 00000 n -0000005867 00000 n -0000005901 00000 n -0000226321 00000 n -0001049970 00000 n -0000005950 00000 n -0000006024 00000 n -0000230057 00000 n -0001049891 00000 n -0000006078 00000 n -0000006154 00000 n -0000230182 00000 n -0001049812 00000 n -0000006208 00000 n -0000006257 00000 n -0000230306 00000 n -0001049719 00000 n -0000006306 00000 n -0000006383 00000 n -0000230431 00000 n -0001049601 00000 n -0000006432 00000 n -0000006484 00000 n -0000233419 00000 n -0001049522 00000 n -0000006538 00000 n -0000006602 00000 n -0000233544 00000 n -0001049443 00000 n -0000006656 00000 n -0000006710 00000 n -0000235680 00000 n -0001049312 00000 n -0000006757 00000 n -0000006807 00000 n -0000235805 00000 n -0001049233 00000 n -0000006856 00000 n -0000006899 00000 n -0000235930 00000 n -0001049140 00000 n -0000006948 00000 n -0000006997 00000 n -0000239806 00000 n -0001049008 00000 n -0000007046 00000 n +0000003563 00000 n +0000347436 00000 n +0002260545 00000 n +0000003622 00000 n +0000003671 00000 n +0000347561 00000 n +0002260427 00000 n +0000003725 00000 n +0000003790 00000 n +0000351297 00000 n +0002260362 00000 n +0000003849 00000 n +0000003898 00000 n +0000351422 00000 n +0002260269 00000 n +0000003947 00000 n +0000004007 00000 n +0000355368 00000 n +0002260151 00000 n +0000004056 00000 n +0000004093 00000 n +0000355493 00000 n +0002260072 00000 n +0000004147 00000 n +0000004199 00000 n +0000358128 00000 n +0002259979 00000 n +0000004253 00000 n +0000004316 00000 n +0000358252 00000 n +0002259886 00000 n +0000004370 00000 n +0000004429 00000 n +0000358377 00000 n +0002259807 00000 n +0000004483 00000 n +0000004557 00000 n +0000362152 00000 n +0002259676 00000 n +0000004604 00000 n +0000004640 00000 n +0000362277 00000 n +0002259597 00000 n +0000004689 00000 n +0000004734 00000 n +0000371231 00000 n +0002259465 00000 n +0000004783 00000 n +0000004831 00000 n +0000371356 00000 n +0002259386 00000 n +0000004885 00000 n +0000004934 00000 n +0000375833 00000 n +0002259307 00000 n +0000004988 00000 n +0000005042 00000 n +0000384401 00000 n +0002259214 00000 n +0000005091 00000 n +0000005153 00000 n +0000389029 00000 n +0002259121 00000 n +0000005202 00000 n +0000005250 00000 n +0000389152 00000 n +0002258989 00000 n +0000005299 00000 n +0000005361 00000 n +0000389277 00000 n +0002258871 00000 n +0000005415 00000 n +0000005469 00000 n +0000389402 00000 n +0002258792 00000 n +0000005528 00000 n +0000005577 00000 n +0000393046 00000 n +0002258699 00000 n +0000005636 00000 n +0000005710 00000 n +0000393171 00000 n +0002258620 00000 n +0000005769 00000 n +0000005832 00000 n +0000398292 00000 n +0002258541 00000 n +0000005886 00000 n +0000005945 00000 n +0000402204 00000 n +0002258423 00000 n +0000005994 00000 n +0000006044 00000 n +0000402328 00000 n +0002258344 00000 n +0000006098 00000 n +0000006167 00000 n +0000402453 00000 n +0002258251 00000 n +0000006221 00000 n +0000006428 00000 n +0000402578 00000 n +0002258158 00000 n +0000006482 00000 n +0000006554 00000 n +0000405160 00000 n +0002258065 00000 n +0000006608 00000 n +0000006721 00000 n +0000405285 00000 n +0002257972 00000 n +0000006775 00000 n +0000006919 00000 n +0000405410 00000 n +0002257893 00000 n +0000006973 00000 n 0000007097 00000 n -0000239931 00000 n -0001048943 00000 n -0000007151 00000 n -0000007192 00000 n -0000240056 00000 n -0001048850 00000 n -0000007241 00000 n -0000007287 00000 n -0000241845 00000 n -0001048757 00000 n -0000007336 00000 n -0000007382 00000 n -0000241970 00000 n -0001048678 00000 n -0000007431 00000 n -0000007460 00000 n -0000245879 00000 n -0001048561 00000 n -0000007507 00000 n -0000007566 00000 n -0000246004 00000 n -0001048482 00000 n -0000007615 00000 n -0000007674 00000 n -0000250585 00000 n -0001048403 00000 n -0000007723 00000 n -0000007789 00000 n -0000251412 00000 n -0001048268 00000 n -0000007833 00000 n -0000007879 00000 n -0000254100 00000 n -0001048150 00000 n -0000007926 00000 n -0000007989 00000 n -0000254225 00000 n -0001048071 00000 n -0000008038 00000 n -0000008079 00000 n -0000257406 00000 n -0001047978 00000 n -0000008128 00000 n -0000008162 00000 n -0000261767 00000 n -0001047846 00000 n -0000008211 00000 n -0000008257 00000 n -0000264971 00000 n -0001047767 00000 n -0000008311 00000 n -0000008366 00000 n -0000268280 00000 n -0001047674 00000 n -0000008420 00000 n -0000008472 00000 n -0000268404 00000 n -0001047581 00000 n -0000008526 00000 n -0000008582 00000 n -0000272543 00000 n -0001047488 00000 n -0000008636 00000 n -0000008692 00000 n -0000276057 00000 n -0001047395 00000 n -0000008746 00000 n -0000008802 00000 n -0000276181 00000 n -0001047302 00000 n -0000008856 00000 n -0000008901 00000 n -0000276306 00000 n -0001047209 00000 n -0000008955 00000 n -0000009017 00000 n -0000276431 00000 n -0001047130 00000 n -0000009071 00000 n -0000009136 00000 n -0000281296 00000 n -0001046998 00000 n -0000009185 00000 n -0000009255 00000 n -0000285270 00000 n -0001046919 00000 n -0000009309 00000 n -0000009359 00000 n -0000285395 00000 n -0001046826 00000 n -0000009413 00000 n -0000009455 00000 n -0000289012 00000 n -0001046747 00000 n -0000009509 00000 n -0000009554 00000 n -0000289137 00000 n -0001046615 00000 n -0000009603 00000 n -0000009640 00000 n -0000289261 00000 n -0001046536 00000 n -0000009694 00000 n -0000009748 00000 n -0000289386 00000 n -0001046457 00000 n -0000009802 00000 n -0000009849 00000 n -0000292429 00000 n -0001046339 00000 n -0000009898 00000 n -0000009952 00000 n -0000296634 00000 n -0001046260 00000 n -0000010006 00000 n -0000010057 00000 n -0000296759 00000 n -0001046167 00000 n -0000010111 00000 n -0000010155 00000 n -0000300271 00000 n -0001046049 00000 n -0000010209 00000 n -0000010258 00000 n -0000300396 00000 n -0001045984 00000 n -0000010317 00000 n -0000010382 00000 n -0000310698 00000 n -0001045852 00000 n -0000010430 00000 n -0000010478 00000 n -0000310823 00000 n -0001045773 00000 n -0000010528 00000 n -0000010565 00000 n -0000310948 00000 n -0001045641 00000 n -0000010615 00000 n -0000010670 00000 n -0000317073 00000 n -0001045562 00000 n -0000010725 00000 n -0000010780 00000 n -0000317198 00000 n -0001045483 00000 n -0000010835 00000 n -0000010899 00000 n -0000317323 00000 n -0001045390 00000 n -0000010949 00000 n -0000010995 00000 n -0000322220 00000 n -0001045297 00000 n -0000011045 00000 n -0000011080 00000 n -0000322345 00000 n -0001045204 00000 n -0000011130 00000 n -0000011158 00000 n -0000322470 00000 n -0001045072 00000 n -0000011208 00000 n -0000011237 00000 n -0000322595 00000 n -0001044993 00000 n -0000011292 00000 n -0000011331 00000 n -0000322719 00000 n -0001044900 00000 n -0000011386 00000 n +0000409591 00000 n +0002257762 00000 n +0000007144 00000 n +0000007187 00000 n +0000409716 00000 n +0002257683 00000 n +0000007236 00000 n +0000007281 00000 n +0000413782 00000 n +0002257551 00000 n +0000007330 00000 n +0000007386 00000 n +0000413907 00000 n +0002257433 00000 n +0000007440 00000 n +0000007501 00000 n +0000418168 00000 n +0002257368 00000 n +0000007560 00000 n +0000007613 00000 n +0000418293 00000 n +0002257275 00000 n +0000007667 00000 n +0000007724 00000 n +0000418418 00000 n +0002257182 00000 n +0000007778 00000 n +0000007854 00000 n +0000422406 00000 n +0002257103 00000 n +0000007908 00000 n +0000007984 00000 n +0000422531 00000 n +0002256971 00000 n +0000008033 00000 n +0000008095 00000 n +0000422656 00000 n +0002256906 00000 n +0000008149 00000 n +0000008196 00000 n +0000426529 00000 n +0002256788 00000 n +0000008245 00000 n +0000008282 00000 n +0000426654 00000 n +0002256709 00000 n +0000008336 00000 n +0000008408 00000 n +0000426778 00000 n +0002256616 00000 n +0000008462 00000 n +0000008542 00000 n +0000426903 00000 n +0002256523 00000 n +0000008596 00000 n +0000008660 00000 n +0000428427 00000 n +0002256444 00000 n +0000008714 00000 n +0000008768 00000 n +0000432001 00000 n +0002256313 00000 n +0000008815 00000 n +0000008854 00000 n +0000432126 00000 n +0002256234 00000 n +0000008903 00000 n +0000008948 00000 n +0000432251 00000 n +0002256102 00000 n +0000008997 00000 n +0000009073 00000 n +0000436687 00000 n +0002256023 00000 n +0000009127 00000 n +0000009194 00000 n +0000441726 00000 n +0002255930 00000 n +0000009248 00000 n +0000009336 00000 n +0000446282 00000 n +0002255837 00000 n +0000009390 00000 n +0000009463 00000 n +0000446407 00000 n +0002255719 00000 n +0000009517 00000 n +0000009601 00000 n +0000446532 00000 n +0002255640 00000 n +0000009660 00000 n +0000009716 00000 n +0000446657 00000 n +0002255547 00000 n +0000009775 00000 n +0000009814 00000 n +0000446782 00000 n +0002255468 00000 n +0000009873 00000 n +0000009906 00000 n +0000451374 00000 n +0002255336 00000 n +0000009955 00000 n +0000009999 00000 n +0000451499 00000 n +0002255257 00000 n +0000010053 00000 n +0000010118 00000 n +0000456336 00000 n +0002255178 00000 n +0000010172 00000 n +0000010240 00000 n +0000459404 00000 n +0002255046 00000 n +0000010289 00000 n +0000010340 00000 n +0000459529 00000 n +0002254967 00000 n +0000010394 00000 n +0000010439 00000 n +0000459654 00000 n +0002254874 00000 n +0000010493 00000 n +0000010544 00000 n +0000464042 00000 n +0002254742 00000 n +0000010598 00000 n +0000010651 00000 n +0000464167 00000 n +0002254677 00000 n +0000010710 00000 n +0000010753 00000 n +0000464292 00000 n +0002254584 00000 n +0000010807 00000 n +0000010855 00000 n +0000468254 00000 n +0002254491 00000 n +0000010909 00000 n +0000010957 00000 n +0000468379 00000 n +0002254412 00000 n +0000011011 00000 n +0000011042 00000 n +0000468504 00000 n +0002254294 00000 n +0000011091 00000 n +0000011128 00000 n +0000468629 00000 n +0002254215 00000 n +0000011182 00000 n +0000011242 00000 n +0000468753 00000 n +0002254136 00000 n +0000011296 00000 n +0000011352 00000 n +0000473590 00000 n +0002254005 00000 n +0000011399 00000 n 0000011440 00000 n -0000327697 00000 n -0001044807 00000 n -0000011495 00000 n -0000011544 00000 n -0000327822 00000 n -0001044714 00000 n -0000011599 00000 n -0000011678 00000 n -0000330418 00000 n -0001044582 00000 n -0000011733 00000 n -0000011787 00000 n -0000330541 00000 n -0001044503 00000 n -0000011847 00000 n -0000011898 00000 n -0000334540 00000 n -0001044424 00000 n -0000011958 00000 n -0000012004 00000 n -0000337917 00000 n -0001044331 00000 n -0000012059 00000 n -0000012116 00000 n -0000338042 00000 n -0001044238 00000 n -0000012171 00000 n -0000012223 00000 n -0000341134 00000 n -0001044145 00000 n -0000012278 00000 n -0000012347 00000 n -0000344535 00000 n -0001044066 00000 n -0000012402 00000 n -0000012468 00000 n -0000347065 00000 n -0001043934 00000 n -0000012518 00000 n -0000012548 00000 n -0000347189 00000 n -0001043855 00000 n -0000012603 00000 n -0000012651 00000 n -0000347314 00000 n -0001043762 00000 n -0000012706 00000 n -0000012744 00000 n -0000351664 00000 n -0001043669 00000 n -0000012799 00000 n -0000012873 00000 n -0000351789 00000 n -0001043590 00000 n -0000012928 00000 n -0000012993 00000 n -0000351914 00000 n -0001043511 00000 n -0000013043 00000 n -0000013071 00000 n -0000355209 00000 n -0001043379 00000 n -0000013119 00000 n -0000013198 00000 n -0000355334 00000 n -0001043300 00000 n -0000013248 00000 n -0000013340 00000 n -0000355459 00000 n -0001043207 00000 n -0000013390 00000 n -0000013457 00000 n -0000355584 00000 n -0001043114 00000 n -0000013507 00000 n -0000013554 00000 n -0000360077 00000 n -0001042982 00000 n -0000013604 00000 n -0000013666 00000 n -0000360201 00000 n -0001042903 00000 n -0000013721 00000 n -0000013764 00000 n -0000360326 00000 n -0001042824 00000 n -0000013819 00000 n -0000013867 00000 n -0000364230 00000 n -0001042731 00000 n -0000013917 00000 n -0000013981 00000 n -0000364355 00000 n -0001042638 00000 n -0000014031 00000 n -0000014114 00000 n -0000369138 00000 n -0001042559 00000 n -0000014164 00000 n -0000014247 00000 n -0000373360 00000 n -0001042466 00000 n -0000014295 00000 n -0000014343 00000 n -0000378699 00000 n -0001042334 00000 n -0000014391 00000 n -0000014430 00000 n -0000378824 00000 n -0001042255 00000 n -0000014480 00000 n -0000014517 00000 n -0000378949 00000 n -0001042123 00000 n -0000014567 00000 n -0000014605 00000 n -0000383311 00000 n -0001042044 00000 n -0000014660 00000 n -0000014707 00000 n -0000387076 00000 n -0001041951 00000 n -0000014762 00000 n -0000014826 00000 n -0000390130 00000 n -0001041858 00000 n -0000014881 00000 n -0000014942 00000 n -0000393924 00000 n -0001041765 00000 n -0000014997 00000 n +0000473715 00000 n +0002253926 00000 n +0000011489 00000 n +0000011534 00000 n +0000473840 00000 n +0002253833 00000 n +0000011583 00000 n +0000011617 00000 n +0000477269 00000 n +0002253701 00000 n +0000011666 00000 n +0000011711 00000 n +0000477394 00000 n +0002253622 00000 n +0000011765 00000 n +0000011821 00000 n +0000477518 00000 n +0002253543 00000 n +0000011875 00000 n +0000011922 00000 n +0000479796 00000 n +0002253464 00000 n +0000011971 00000 n +0000012008 00000 n +0000480771 00000 n +0002253347 00000 n +0000012055 00000 n +0000012115 00000 n +0000480896 00000 n +0002253282 00000 n +0000012164 00000 n +0000012192 00000 n +0000481624 00000 n +0002253147 00000 n +0000012236 00000 n +0000012282 00000 n +0000485104 00000 n +0002253029 00000 n +0000012330 00000 n +0000012394 00000 n +0000485229 00000 n +0002252950 00000 n +0000012444 00000 n +0000012490 00000 n +0000488090 00000 n +0002252857 00000 n +0000012540 00000 n +0000012582 00000 n +0000492290 00000 n +0002252725 00000 n +0000012632 00000 n +0000012667 00000 n +0000492415 00000 n +0002252646 00000 n +0000012722 00000 n +0000012768 00000 n +0000492538 00000 n +0002252553 00000 n +0000012823 00000 n +0000012874 00000 n +0000497088 00000 n +0002252474 00000 n +0000012929 00000 n +0000012980 00000 n +0000497212 00000 n +0002252342 00000 n +0000013030 00000 n +0000013077 00000 n +0000501595 00000 n +0002252263 00000 n +0000013132 00000 n +0000013188 00000 n +0000504535 00000 n +0002252170 00000 n +0000013243 00000 n +0000013296 00000 n +0000508324 00000 n +0002252077 00000 n +0000013351 00000 n +0000013408 00000 n +0000512065 00000 n +0002251984 00000 n +0000013463 00000 n +0000013520 00000 n +0000512442 00000 n +0002251891 00000 n +0000013575 00000 n +0000013632 00000 n +0000512566 00000 n +0002251798 00000 n +0000013687 00000 n +0000013733 00000 n +0000512691 00000 n +0002251705 00000 n +0000013788 00000 n +0000013851 00000 n +0000516723 00000 n +0002251626 00000 n +0000013906 00000 n +0000013972 00000 n +0000516847 00000 n +0002251494 00000 n +0000014022 00000 n +0000014093 00000 n +0000521532 00000 n +0002251415 00000 n +0000014148 00000 n +0000014199 00000 n +0000525010 00000 n +0002251322 00000 n +0000014254 00000 n +0000014297 00000 n +0000525133 00000 n +0002251243 00000 n +0000014352 00000 n +0000014398 00000 n +0000525258 00000 n +0002251111 00000 n +0000014448 00000 n +0000014486 00000 n +0000528959 00000 n +0002251032 00000 n +0000014541 00000 n +0000014596 00000 n +0000529084 00000 n +0002250953 00000 n +0000014651 00000 n +0000014699 00000 n +0000532489 00000 n +0002250821 00000 n +0000014749 00000 n +0000014804 00000 n +0000532613 00000 n +0002250742 00000 n +0000014859 00000 n +0000014911 00000 n +0000536851 00000 n +0002250649 00000 n +0000014966 00000 n +0000015011 00000 n +0000536976 00000 n +0002250531 00000 n 0000015066 00000 n -0000397165 00000 n -0001041686 00000 n -0000015121 00000 n -0000015171 00000 n -0000397290 00000 n -0001041554 00000 n -0000015221 00000 n -0000015266 00000 n -0000397415 00000 n -0001041475 00000 n -0000015321 00000 n -0000015365 00000 n -0000400877 00000 n -0001041382 00000 n -0000015420 00000 n -0000015479 00000 n -0000401002 00000 n -0001041289 00000 n -0000015534 00000 n -0000015580 00000 n -0000401127 00000 n -0001041210 00000 n -0000015635 00000 n -0000015685 00000 n -0000403963 00000 n -0001041092 00000 n -0000015735 00000 n -0000015769 00000 n -0000404088 00000 n -0001041013 00000 n -0000015824 00000 n -0000015863 00000 n -0000406849 00000 n -0001040920 00000 n -0000015918 00000 n -0000015971 00000 n -0000409623 00000 n -0001040827 00000 n -0000016026 00000 n -0000016077 00000 n -0000409748 00000 n -0001040734 00000 n -0000016132 00000 n -0000016196 00000 n -0000413408 00000 n -0001040641 00000 n -0000016251 00000 n -0000016297 00000 n -0000413533 00000 n -0001040548 00000 n -0000016352 00000 n -0000016403 00000 n -0000415543 00000 n -0001040455 00000 n -0000016458 00000 n -0000016507 00000 n -0000415668 00000 n -0001040362 00000 n -0000016562 00000 n -0000016606 00000 n -0000415793 00000 n -0001040283 00000 n -0000016661 00000 n -0000016702 00000 n -0000419441 00000 n -0001040150 00000 n -0000016750 00000 n -0000016794 00000 n -0000419566 00000 n -0001040071 00000 n -0000016844 00000 n -0000016881 00000 n -0000419691 00000 n -0001039978 00000 n -0000016931 00000 n -0000016985 00000 n -0000423132 00000 n -0001039885 00000 n -0000017035 00000 n +0000015116 00000 n +0000540837 00000 n +0002250466 00000 n +0000015176 00000 n +0000015242 00000 n +0000552546 00000 n +0002250348 00000 n +0000015292 00000 n +0000015330 00000 n +0000552671 00000 n +0002250269 00000 n +0000015385 00000 n +0000015484 00000 n +0000552795 00000 n +0002250190 00000 n +0000015539 00000 n +0000015640 00000 n +0000556406 00000 n +0002250058 00000 n +0000015688 00000 n +0000015740 00000 n +0000556531 00000 n +0002249979 00000 n +0000015790 00000 n +0000015836 00000 n +0000560960 00000 n +0002249847 00000 n +0000015886 00000 n +0000015932 00000 n +0000564967 00000 n +0002249729 00000 n +0000015987 00000 n +0000016044 00000 n +0000569068 00000 n +0002249650 00000 n +0000016104 00000 n +0000016166 00000 n +0000569193 00000 n +0002249571 00000 n +0000016226 00000 n +0000016292 00000 n +0000569318 00000 n +0002249492 00000 n +0000016347 00000 n +0000016426 00000 n +0000572796 00000 n +0002249360 00000 n +0000016476 00000 n +0000016525 00000 n +0000572921 00000 n +0002249281 00000 n +0000016580 00000 n +0000016628 00000 n +0000573046 00000 n +0002249202 00000 n +0000016683 00000 n +0000016729 00000 n +0000575869 00000 n +0002249070 00000 n +0000016779 00000 n +0000016821 00000 n +0000580268 00000 n +0002248991 00000 n +0000016876 00000 n +0000016913 00000 n +0000580393 00000 n +0002248898 00000 n +0000016968 00000 n +0000017034 00000 n +0000580518 00000 n +0002248805 00000 n 0000017089 00000 n -0000433674 00000 n -0001039792 00000 n -0000017139 00000 n -0000017196 00000 n -0000436639 00000 n -0001039699 00000 n -0000017246 00000 n -0000017319 00000 n -0000436764 00000 n -0001039606 00000 n -0000017369 00000 n -0000017429 00000 n -0000441445 00000 n -0001039474 00000 n -0000017479 00000 n -0000017534 00000 n -0000444574 00000 n -0001039409 00000 n -0000017589 00000 n -0000017626 00000 n -0000448944 00000 n -0001039316 00000 n -0000017676 00000 n -0000017723 00000 n -0000460436 00000 n -0001039184 00000 n -0000017773 00000 n -0000017828 00000 n -0000460561 00000 n -0001039119 00000 n -0000017883 00000 n -0000017932 00000 n -0000469056 00000 n -0001039026 00000 n -0000017983 00000 n -0000018053 00000 n -0000486416 00000 n -0001038933 00000 n -0000018104 00000 n -0000018174 00000 n -0000490103 00000 n -0001038854 00000 n -0000018225 00000 n -0000018284 00000 n -0000495540 00000 n -0001038722 00000 n -0000018332 00000 n -0000018411 00000 n -0000495665 00000 n -0001038643 00000 n -0000018461 00000 n -0000018494 00000 n -0000495790 00000 n -0001038550 00000 n -0000018544 00000 n -0000018581 00000 n -0000495915 00000 n -0001038418 00000 n -0000018631 00000 n -0000018677 00000 n -0000499967 00000 n -0001038353 00000 n -0000018732 00000 n -0000018770 00000 n -0000500092 00000 n -0001038221 00000 n -0000018820 00000 n -0000018862 00000 n -0000500217 00000 n -0001038142 00000 n -0000018917 00000 n -0000018976 00000 n -0000504404 00000 n -0001038049 00000 n -0000019031 00000 n -0000019093 00000 n -0000504529 00000 n -0001037956 00000 n -0000019148 00000 n -0000019194 00000 n -0000504654 00000 n -0001037863 00000 n -0000019249 00000 n -0000019308 00000 n -0000508888 00000 n -0001037770 00000 n -0000019363 00000 n -0000019418 00000 n -0000509013 00000 n -0001037691 00000 n -0000019473 00000 n -0000019514 00000 n -0000509138 00000 n -0001037559 00000 n -0000019564 00000 n -0000019619 00000 n -0000509263 00000 n -0001037480 00000 n -0000019674 00000 n +0000017122 00000 n +0000580642 00000 n +0002248672 00000 n +0000017177 00000 n +0000017211 00000 n +0000586482 00000 n +0002248593 00000 n +0000017271 00000 n +0000017322 00000 n +0000586607 00000 n +0002248500 00000 n +0000017382 00000 n +0000017463 00000 n +0000589758 00000 n +0002248407 00000 n +0000017523 00000 n +0000017574 00000 n +0000591589 00000 n +0002248314 00000 n +0000017634 00000 n +0000017691 00000 n +0000596265 00000 n +0002248221 00000 n +0000017751 00000 n +0000017797 00000 n +0000598797 00000 n +0002248128 00000 n +0000017857 00000 n +0000017916 00000 n +0000603112 00000 n +0002248035 00000 n +0000017976 00000 n +0000018033 00000 n +0000603237 00000 n +0002247942 00000 n +0000018093 00000 n +0000018166 00000 n +0000605221 00000 n +0002247849 00000 n +0000018226 00000 n +0000018297 00000 n +0000605346 00000 n +0002247770 00000 n +0000018358 00000 n +0000018412 00000 n +0000609512 00000 n +0002247638 00000 n +0000018467 00000 n +0000018499 00000 n +0000609636 00000 n +0002247559 00000 n +0000018559 00000 n +0000018609 00000 n +0000609760 00000 n +0002247466 00000 n +0000018669 00000 n +0000018709 00000 n +0000612768 00000 n +0002247373 00000 n +0000018769 00000 n +0000018845 00000 n +0000612893 00000 n +0002247294 00000 n +0000018905 00000 n +0000018972 00000 n +0000613018 00000 n +0002247215 00000 n +0000019027 00000 n +0000019057 00000 n +0000613143 00000 n +0002247097 00000 n +0000019107 00000 n +0000019145 00000 n +0000613268 00000 n +0002247018 00000 n +0000019200 00000 n +0000019271 00000 n +0000613393 00000 n +0002246925 00000 n +0000019326 00000 n +0000019404 00000 n +0000614646 00000 n +0002246846 00000 n +0000019459 00000 n +0000019512 00000 n +0000626517 00000 n +0002246714 00000 n +0000019560 00000 n +0000019617 00000 n +0000626642 00000 n +0002246635 00000 n +0000019667 00000 n 0000019713 00000 n -0000513616 00000 n -0001037387 00000 n -0000019768 00000 n -0000019807 00000 n -0000513741 00000 n -0001037269 00000 n -0000019862 00000 n -0000019907 00000 n -0000516912 00000 n -0001037190 00000 n -0000019967 00000 n -0000020023 00000 n -0000517037 00000 n -0001037097 00000 n -0000020083 00000 n -0000020182 00000 n -0000517162 00000 n -0001037004 00000 n -0000020242 00000 n -0000020289 00000 n -0000520126 00000 n -0001036911 00000 n -0000020349 00000 n -0000020396 00000 n -0000520251 00000 n -0001036818 00000 n -0000020456 00000 n -0000020524 00000 n -0000520376 00000 n -0001036725 00000 n -0000020584 00000 n -0000020654 00000 n -0000524885 00000 n -0001036632 00000 n -0000020714 00000 n -0000020773 00000 n -0000529906 00000 n -0001036553 00000 n -0000020833 00000 n -0000020887 00000 n -0000537324 00000 n -0001036460 00000 n -0000020937 00000 n -0000020973 00000 n -0000537449 00000 n -0001036381 00000 n -0000021023 00000 n -0000021058 00000 n -0000540923 00000 n -0001036249 00000 n -0000021106 00000 n -0000021157 00000 n -0000541048 00000 n -0001036131 00000 n -0000021207 00000 n -0000021271 00000 n -0000541172 00000 n -0001036027 00000 n -0000021326 00000 n -0000021381 00000 n -0000541297 00000 n -0001035948 00000 n -0000021441 00000 n -0000021500 00000 n -0000541547 00000 n -0001035869 00000 n -0000021560 00000 n -0000021604 00000 n -0000546151 00000 n -0001035776 00000 n -0000021654 00000 n -0000021707 00000 n -0000548879 00000 n -0001035658 00000 n -0000021757 00000 n -0000021808 00000 n -0000550778 00000 n -0001035593 00000 n -0000021863 00000 n -0000021931 00000 n -0000555957 00000 n -0001035461 00000 n -0000021979 00000 n -0000022029 00000 n -0000556082 00000 n -0001035343 00000 n -0000022079 00000 n -0000022141 00000 n -0000556207 00000 n -0001035264 00000 n -0000022196 00000 n -0000022245 00000 n -0000560782 00000 n -0001035132 00000 n -0000022300 00000 n -0000022357 00000 n -0000560907 00000 n -0001035067 00000 n -0000022417 00000 n -0000022462 00000 n -0000561032 00000 n -0001034949 00000 n -0000022517 00000 n -0000022586 00000 n -0000564926 00000 n -0001034884 00000 n -0000022646 00000 n -0000022724 00000 n -0000568861 00000 n -0001034752 00000 n -0000022774 00000 n -0000022829 00000 n -0000568986 00000 n -0001034673 00000 n -0000022884 00000 n -0000022932 00000 n -0000572263 00000 n -0001034594 00000 n -0000022987 00000 n -0000023030 00000 n -0000572388 00000 n -0001034515 00000 n -0000023080 00000 n -0000023149 00000 n -0000575644 00000 n -0001034383 00000 n -0000023197 00000 n -0000023246 00000 n -0000575769 00000 n -0001034265 00000 n -0000023296 00000 n -0000023337 00000 n -0000575894 00000 n -0001034147 00000 n -0000023392 00000 n -0000023459 00000 n -0000576019 00000 n -0001034068 00000 n +0000626767 00000 n +0002246503 00000 n +0000019763 00000 n +0000019798 00000 n +0000630257 00000 n +0002246438 00000 n +0000019853 00000 n +0000019901 00000 n +0000632490 00000 n +0002246306 00000 n +0000019951 00000 n +0000019997 00000 n +0000632615 00000 n +0002246227 00000 n +0000020052 00000 n +0000020111 00000 n +0000632867 00000 n +0002246148 00000 n +0000020166 00000 n +0000020226 00000 n +0000635391 00000 n +0002246030 00000 n +0000020276 00000 n +0000020314 00000 n +0000635516 00000 n +0002245951 00000 n +0000020369 00000 n +0000020415 00000 n +0000635640 00000 n +0002245872 00000 n +0000020470 00000 n +0000020548 00000 n +0000639278 00000 n +0002245740 00000 n +0000020596 00000 n +0000020660 00000 n +0000639403 00000 n +0002245661 00000 n +0000020710 00000 n +0000020756 00000 n +0000643795 00000 n +0002245529 00000 n +0000020806 00000 n +0000020858 00000 n +0000643920 00000 n +0002245450 00000 n +0000020913 00000 n +0000020989 00000 n +0000648549 00000 n +0002245357 00000 n +0000021044 00000 n +0000021091 00000 n +0000648801 00000 n +0002245278 00000 n +0000021146 00000 n +0000021206 00000 n +0000655110 00000 n +0002245146 00000 n +0000021256 00000 n +0000021313 00000 n +0000655235 00000 n +0002245067 00000 n +0000021368 00000 n +0000021424 00000 n +0000655360 00000 n +0002244974 00000 n +0000021479 00000 n +0000021551 00000 n +0000659177 00000 n +0002244895 00000 n +0000021606 00000 n +0000021655 00000 n +0000659301 00000 n +0002244763 00000 n +0000021705 00000 n +0000021755 00000 n +0000663208 00000 n +0002244659 00000 n +0000021810 00000 n +0000021865 00000 n +0000667274 00000 n +0002244580 00000 n +0000021925 00000 n +0000021984 00000 n +0000667525 00000 n +0002244501 00000 n +0000022044 00000 n +0000022088 00000 n +0000671349 00000 n +0002244369 00000 n +0000022138 00000 n +0000022220 00000 n +0000671474 00000 n +0002244290 00000 n +0000022275 00000 n +0000022353 00000 n +0000675803 00000 n +0002244197 00000 n +0000022408 00000 n +0000022473 00000 n +0000675928 00000 n +0002244104 00000 n +0000022528 00000 n +0000022577 00000 n +0000676052 00000 n +0002243972 00000 n +0000022632 00000 n +0000022696 00000 n +0000680405 00000 n +0002243893 00000 n +0000022756 00000 n +0000022801 00000 n +0000680530 00000 n +0002243814 00000 n +0000022861 00000 n +0000022911 00000 n +0000680654 00000 n +0002243721 00000 n +0000022966 00000 n +0000023032 00000 n +0000685675 00000 n +0002243628 00000 n +0000023087 00000 n +0000023172 00000 n +0000689491 00000 n +0002243549 00000 n +0000023227 00000 n +0000023312 00000 n +0000689616 00000 n +0002243431 00000 n +0000023362 00000 n +0000023400 00000 n +0000689741 00000 n +0002243352 00000 n +0000023455 00000 n 0000023519 00000 n -0000023570 00000 n -0000578933 00000 n -0001033975 00000 n -0000023630 00000 n -0000023688 00000 n -0000579058 00000 n -0001033882 00000 n -0000023748 00000 n -0000023833 00000 n -0000579183 00000 n -0001033803 00000 n -0000023893 00000 n -0000023955 00000 n -0000582838 00000 n -0001033671 00000 n -0000024010 00000 n -0000024085 00000 n -0000582963 00000 n -0001033592 00000 n -0000024145 00000 n -0000024203 00000 n -0000591351 00000 n -0001033499 00000 n -0000024263 00000 n -0000024315 00000 n -0000591476 00000 n -0001033420 00000 n -0000024375 00000 n +0000693651 00000 n +0002243273 00000 n +0000023574 00000 n +0000023685 00000 n +0000697225 00000 n +0002243141 00000 n +0000023733 00000 n +0000023779 00000 n +0000697350 00000 n +0002243062 00000 n +0000023829 00000 n +0000023875 00000 n +0000697475 00000 n +0002242930 00000 n +0000023925 00000 n +0000023960 00000 n +0000702287 00000 n +0002242826 00000 n +0000024015 00000 n +0000024072 00000 n +0000710410 00000 n +0002242747 00000 n +0000024132 00000 n +0000024188 00000 n +0000710535 00000 n +0002242654 00000 n +0000024248 00000 n +0000024310 00000 n +0000710659 00000 n +0002242561 00000 n +0000024370 00000 n 0000024432 00000 n -0000598835 00000 n -0001033327 00000 n -0000024487 00000 n -0000024574 00000 n -0000598960 00000 n -0001033209 00000 n -0000024629 00000 n -0000024711 00000 n -0000599085 00000 n -0001033130 00000 n -0000024771 00000 n -0000024836 00000 n -0000602676 00000 n -0001033037 00000 n -0000024896 00000 n -0000024939 00000 n -0000602801 00000 n -0001032944 00000 n -0000024999 00000 n -0000025040 00000 n -0000602926 00000 n -0001032865 00000 n -0000025100 00000 n -0000025136 00000 n -0000603051 00000 n -0001032772 00000 n -0000025186 00000 n -0000025229 00000 n -0000603176 00000 n -0001032679 00000 n -0000025279 00000 n -0000025336 00000 n -0000607171 00000 n -0001032561 00000 n -0000025386 00000 n -0000025444 00000 n -0000607296 00000 n -0001032443 00000 n -0000025499 00000 n -0000025542 00000 n -0000607421 00000 n -0001032378 00000 n -0000025602 00000 n -0000025680 00000 n -0000611194 00000 n -0001032285 00000 n -0000025735 00000 n -0000025788 00000 n -0000616978 00000 n -0001032206 00000 n -0000025843 00000 n -0000025888 00000 n -0000624534 00000 n -0001032073 00000 n -0000025936 00000 n -0000025990 00000 n -0000624659 00000 n -0001031994 00000 n -0000026040 00000 n -0000026094 00000 n -0000628180 00000 n -0001031862 00000 n -0000026144 00000 n -0000026211 00000 n -0000628305 00000 n -0001031783 00000 n -0000026266 00000 n -0000026356 00000 n -0000628429 00000 n -0001031704 00000 n -0000026411 00000 n -0000026507 00000 n -0000628553 00000 n -0001031586 00000 n -0000026557 00000 n -0000026622 00000 n -0000628678 00000 n -0001031507 00000 n -0000026677 00000 n -0000026734 00000 n -0000632363 00000 n -0001031427 00000 n -0000026789 00000 n -0000026846 00000 n -0000635258 00000 n -0001031289 00000 n -0000026895 00000 n -0000026973 00000 n -0000635384 00000 n -0001031164 00000 n -0000027024 00000 n -0000027063 00000 n -0000641538 00000 n -0001031080 00000 n -0000027119 00000 n -0000027176 00000 n -0000644338 00000 n -0001030955 00000 n -0000027232 00000 n -0000027308 00000 n -0000646566 00000 n -0001030871 00000 n -0000027369 00000 n -0000027436 00000 n -0000646692 00000 n -0001030772 00000 n -0000027497 00000 n -0000027559 00000 n -0000649022 00000 n -0001030673 00000 n -0000027620 00000 n -0000027679 00000 n -0000649148 00000 n -0001030589 00000 n -0000027740 00000 n -0000027813 00000 n -0000649270 00000 n -0001030505 00000 n -0000027864 00000 n -0000027916 00000 n -0000651887 00000 n -0001030366 00000 n -0000027965 00000 n -0000028010 00000 n -0000652013 00000 n -0001030282 00000 n -0000028061 00000 n -0000028117 00000 n -0000652139 00000 n -0001030142 00000 n -0000028168 00000 n -0000028210 00000 n -0000652265 00000 n -0001030058 00000 n -0000028266 00000 n -0000028299 00000 n -0000652391 00000 n -0001029959 00000 n -0000028355 00000 n -0000028396 00000 n -0000655062 00000 n -0001029860 00000 n -0000028452 00000 n -0000028487 00000 n -0000655188 00000 n -0001029776 00000 n -0000028543 00000 n -0000028579 00000 n -0000655314 00000 n -0001029651 00000 n -0000028630 00000 n -0000028687 00000 n -0000658032 00000 n -0001029567 00000 n -0000028743 00000 n -0000028781 00000 n -0000658158 00000 n -0001029483 00000 n -0000028837 00000 n -0000028870 00000 n -0000662094 00000 n -0001029344 00000 n -0000028919 00000 n -0000029000 00000 n -0000662220 00000 n -0001029234 00000 n -0000029051 00000 n -0000029089 00000 n -0000663942 00000 n -0001029165 00000 n -0000029145 00000 n -0000029178 00000 n -0000666814 00000 n -0001029026 00000 n -0000029227 00000 n +0000710784 00000 n +0002242468 00000 n +0000024492 00000 n +0000024552 00000 n +0000710909 00000 n +0002242375 00000 n +0000024612 00000 n +0000024661 00000 n +0000715004 00000 n +0002242282 00000 n +0000024721 00000 n +0000024765 00000 n +0000715129 00000 n +0002242189 00000 n +0000024825 00000 n +0000024874 00000 n +0000715253 00000 n +0002242096 00000 n +0000024934 00000 n +0000025010 00000 n +0000715377 00000 n +0002242017 00000 n +0000025070 00000 n +0000025133 00000 n +0000719861 00000 n +0002241885 00000 n +0000025183 00000 n +0000025243 00000 n +0000723028 00000 n +0002241781 00000 n +0000025298 00000 n +0000025346 00000 n +0000723153 00000 n +0002241702 00000 n +0000025406 00000 n +0000025452 00000 n +0000723277 00000 n +0002241623 00000 n +0000025512 00000 n +0000025565 00000 n +0000726618 00000 n +0002241491 00000 n +0000025615 00000 n +0000025693 00000 n +0000732106 00000 n +0002241412 00000 n +0000025748 00000 n +0000025802 00000 n +0000732231 00000 n +0002241333 00000 n +0000025857 00000 n +0000025906 00000 n +0000736071 00000 n +0002241240 00000 n +0000025956 00000 n +0000026007 00000 n +0000736195 00000 n +0002241108 00000 n +0000026057 00000 n +0000026095 00000 n +0000740647 00000 n +0002241043 00000 n +0000026150 00000 n +0000026203 00000 n +0000740772 00000 n +0002240964 00000 n +0000026253 00000 n +0000026296 00000 n +0000744256 00000 n +0002240830 00000 n +0000026344 00000 n +0000026381 00000 n +0000744381 00000 n +0002240751 00000 n +0000026431 00000 n +0000026468 00000 n +0000744506 00000 n +0002240658 00000 n +0000026518 00000 n +0000026564 00000 n +0000744631 00000 n +0002240524 00000 n +0000026614 00000 n +0000026693 00000 n +0000744756 00000 n +0002240445 00000 n +0000026748 00000 n +0000026802 00000 n +0000748116 00000 n +0002240352 00000 n +0000026857 00000 n +0000026905 00000 n +0000748241 00000 n +0002240259 00000 n +0000026960 00000 n +0000027013 00000 n +0000748366 00000 n +0002240166 00000 n +0000027068 00000 n +0000027111 00000 n +0000751161 00000 n +0002240071 00000 n +0000027166 00000 n +0000027220 00000 n +0000751285 00000 n +0002239989 00000 n +0000027276 00000 n +0000027319 00000 n +0000755169 00000 n +0002239892 00000 n +0000027370 00000 n +0000027411 00000 n +0000755295 00000 n +0002239768 00000 n +0000027462 00000 n +0000027501 00000 n +0000755421 00000 n +0002239684 00000 n +0000027557 00000 n +0000027638 00000 n +0000755547 00000 n +0002239600 00000 n +0000027694 00000 n +0000027775 00000 n +0000759264 00000 n +0002239462 00000 n +0000027824 00000 n +0000027879 00000 n +0000759390 00000 n +0002239378 00000 n +0000027930 00000 n +0000027977 00000 n +0000759515 00000 n +0002239279 00000 n +0000028028 00000 n +0000028083 00000 n +0000763467 00000 n +0002239139 00000 n +0000028134 00000 n +0000028202 00000 n +0000763591 00000 n +0002239055 00000 n +0000028258 00000 n +0000028349 00000 n +0000763717 00000 n +0002238971 00000 n +0000028405 00000 n +0000028502 00000 n +0000763842 00000 n +0002238831 00000 n +0000028553 00000 n +0000028619 00000 n +0000763968 00000 n +0002238747 00000 n +0000028675 00000 n +0000028733 00000 n +0000767929 00000 n +0002238663 00000 n +0000028789 00000 n +0000028846 00000 n +0000770347 00000 n +0002238538 00000 n +0000028897 00000 n +0000028936 00000 n +0000770473 00000 n +0002238469 00000 n +0000028992 00000 n +0000029065 00000 n +0000774183 00000 n +0002238330 00000 n +0000029114 00000 n +0000029195 00000 n +0000774309 00000 n +0002238246 00000 n +0000029246 00000 n 0000029293 00000 n -0000666940 00000 n -0001028901 00000 n +0000776289 00000 n +0002238162 00000 n 0000029344 00000 n -0000029412 00000 n -0000670613 00000 n -0001028817 00000 n -0000029468 00000 n -0000029506 00000 n -0000670739 00000 n -0001028718 00000 n -0000029562 00000 n -0000029606 00000 n -0000673057 00000 n -0001028619 00000 n -0000029662 00000 n -0000029704 00000 n -0000673183 00000 n -0001028535 00000 n -0000029760 00000 n -0000029806 00000 n -0000677013 00000 n -0001028410 00000 n -0000029857 00000 n -0000029935 00000 n -0000680954 00000 n -0001028326 00000 n -0000029991 00000 n -0000030041 00000 n -0000681080 00000 n -0001028227 00000 n -0000030097 00000 n -0000030141 00000 n -0000686168 00000 n -0001028128 00000 n -0000030197 00000 n -0000030235 00000 n -0000686294 00000 n -0001028029 00000 n -0000030291 00000 n -0000030329 00000 n -0000686420 00000 n -0001027945 00000 n -0000030385 00000 n -0000030424 00000 n -0000690076 00000 n -0001027806 00000 n -0000030473 00000 n -0000030511 00000 n -0000690202 00000 n -0001027722 00000 n -0000030562 00000 n -0000030600 00000 n -0000690328 00000 n -0001027623 00000 n -0000030651 00000 n -0000030704 00000 n -0000690454 00000 n -0001027524 00000 n -0000030755 00000 n -0000030807 00000 n -0000693282 00000 n -0001027425 00000 n -0000030858 00000 n -0000030900 00000 n -0000693408 00000 n -0001027326 00000 n -0000030951 00000 n -0000031003 00000 n -0000693532 00000 n -0001027227 00000 n -0000031054 00000 n -0000031095 00000 n -0000695170 00000 n -0001027143 00000 n -0000031146 00000 n -0000031187 00000 n -0000698776 00000 n -0001027004 00000 n -0000031236 00000 n -0000031276 00000 n -0000698902 00000 n -0001026920 00000 n -0000031327 00000 n -0000031383 00000 n -0000699028 00000 n -0001026821 00000 n -0000031434 00000 n -0000031478 00000 n -0000699154 00000 n -0001026722 00000 n -0000031529 00000 n -0000031580 00000 n -0000701746 00000 n -0001026638 00000 n -0000031631 00000 n -0000031674 00000 n -0000705658 00000 n -0001026514 00000 n -0000031723 00000 n -0000031770 00000 n -0000705784 00000 n -0001026430 00000 n -0000031821 00000 n -0000031857 00000 n -0000705910 00000 n -0001026331 00000 n -0000031908 00000 n -0000031969 00000 n -0000709687 00000 n -0001026191 00000 n -0000032020 00000 n -0000032099 00000 n -0000715147 00000 n -0001026107 00000 n -0000032155 00000 n -0000032210 00000 n -0000717838 00000 n -0001026023 00000 n -0000032266 00000 n -0000032316 00000 n -0000717964 00000 n -0001025924 00000 n -0000032367 00000 n -0000032419 00000 n -0000721634 00000 n -0001025840 00000 n -0000032470 00000 n -0000032514 00000 n -0000722377 00000 n -0001025701 00000 n -0000032559 00000 n -0000032598 00000 n -0000725208 00000 n -0001025576 00000 n -0000032647 00000 n -0000032690 00000 n -0000725334 00000 n -0001025492 00000 n -0000032741 00000 n -0000032779 00000 n -0000725460 00000 n -0001025393 00000 n -0000032830 00000 n -0000032867 00000 n -0000729292 00000 n -0001025294 00000 n -0000032918 00000 n -0000032953 00000 n -0000743520 00000 n -0001025210 00000 n -0000033004 00000 n -0000033052 00000 n -0000747284 00000 n -0001025070 00000 n -0000033101 00000 n -0000033161 00000 n -0000747410 00000 n -0001024986 00000 n -0000033212 00000 n -0000033255 00000 n -0000747536 00000 n -0001024887 00000 n -0000033306 00000 n -0000033401 00000 n -0000752216 00000 n -0001024788 00000 n -0000033452 00000 n -0000033490 00000 n -0000756869 00000 n -0001024689 00000 n -0000033541 00000 n -0000033602 00000 n -0000756995 00000 n -0001024605 00000 n -0000033653 00000 n -0000033710 00000 n -0000760756 00000 n -0001024480 00000 n -0000033759 00000 n -0000033797 00000 n -0000760882 00000 n -0001024396 00000 n -0000033848 00000 n -0000033886 00000 n -0000761008 00000 n -0001024297 00000 n -0000033937 00000 n -0000033975 00000 n -0000761134 00000 n -0001024198 00000 n -0000034026 00000 n -0000034064 00000 n -0000765093 00000 n -0001024099 00000 n -0000034115 00000 n -0000034156 00000 n -0000765219 00000 n -0001024000 00000 n -0000034207 00000 n -0000034263 00000 n -0000765345 00000 n -0001023916 00000 n -0000034314 00000 n -0000034347 00000 n -0000766079 00000 n -0001023791 00000 n -0000034392 00000 n +0000029383 00000 n +0000780062 00000 n +0002238022 00000 n +0000029432 00000 n +0000029482 00000 n +0000780188 00000 n +0002237938 00000 n +0000029533 00000 n +0000029580 00000 n +0000780314 00000 n +0002237798 00000 n +0000029631 00000 n +0000029679 00000 n +0000784146 00000 n +0002237714 00000 n +0000029735 00000 n +0000029807 00000 n +0000784712 00000 n +0002237615 00000 n +0000029863 00000 n +0000029932 00000 n +0000784838 00000 n +0002237516 00000 n +0000029988 00000 n +0000030046 00000 n +0000788481 00000 n +0002237417 00000 n +0000030102 00000 n +0000030168 00000 n +0000788606 00000 n +0002237333 00000 n +0000030224 00000 n +0000030279 00000 n +0000791918 00000 n +0002237193 00000 n +0000030330 00000 n +0000030400 00000 n +0000792044 00000 n +0002237109 00000 n +0000030456 00000 n +0000030531 00000 n +0000794414 00000 n +0002237025 00000 n +0000030587 00000 n +0000030646 00000 n +0000800151 00000 n +0002236926 00000 n +0000030697 00000 n +0000030774 00000 n +0000811177 00000 n +0002236786 00000 n +0000030825 00000 n +0000030897 00000 n +0000811303 00000 n +0002236702 00000 n +0000030953 00000 n +0000031001 00000 n +0000816263 00000 n +0002236603 00000 n +0000031057 00000 n +0000031107 00000 n +0000821145 00000 n +0002236504 00000 n +0000031163 00000 n +0000031226 00000 n +0000821271 00000 n +0002236405 00000 n +0000031282 00000 n +0000031324 00000 n +0000825810 00000 n +0002236306 00000 n +0000031380 00000 n +0000031464 00000 n +0000830167 00000 n +0002236222 00000 n +0000031520 00000 n +0000031582 00000 n +0000835221 00000 n +0002236082 00000 n +0000031633 00000 n +0000031698 00000 n +0000835347 00000 n +0002235998 00000 n +0000031754 00000 n +0000031830 00000 n +0000839626 00000 n +0002235899 00000 n +0000031886 00000 n +0000031963 00000 n +0000839751 00000 n +0002235800 00000 n +0000032019 00000 n +0000032077 00000 n +0000843594 00000 n +0002235701 00000 n +0000032133 00000 n +0000032198 00000 n +0000847128 00000 n +0002235617 00000 n +0000032254 00000 n +0000032319 00000 n +0000851850 00000 n +0002235477 00000 n +0000032370 00000 n +0000032431 00000 n +0000851976 00000 n +0002235393 00000 n +0000032487 00000 n +0000032570 00000 n +0000856634 00000 n +0002235268 00000 n +0000032626 00000 n +0000032706 00000 n +0000857011 00000 n +0002235184 00000 n +0000032767 00000 n +0000032825 00000 n +0000863560 00000 n +0002235085 00000 n +0000032886 00000 n +0000032983 00000 n +0000863686 00000 n +0002234986 00000 n +0000033044 00000 n +0000033118 00000 n +0000866461 00000 n +0002234887 00000 n +0000033179 00000 n +0000033263 00000 n +0000869178 00000 n +0002234788 00000 n +0000033324 00000 n +0000033386 00000 n +0000871959 00000 n +0002234689 00000 n +0000033447 00000 n +0000033540 00000 n +0000876366 00000 n +0002234590 00000 n +0000033601 00000 n +0000033673 00000 n +0000876492 00000 n +0002234491 00000 n +0000033734 00000 n +0000033819 00000 n +0000879013 00000 n +0002234407 00000 n +0000033880 00000 n +0000033960 00000 n +0000883361 00000 n +0002234267 00000 n +0000034011 00000 n +0000034118 00000 n +0000883487 00000 n +0002234183 00000 n +0000034174 00000 n +0000034238 00000 n +0000888348 00000 n +0002234084 00000 n +0000034294 00000 n +0000034369 00000 n +0000892647 00000 n +0002233985 00000 n 0000034425 00000 n -0000770338 00000 n -0001023666 00000 n -0000034474 00000 n -0000034518 00000 n -0000770464 00000 n -0001023541 00000 n -0000034569 00000 n -0000034627 00000 n -0000770590 00000 n -0001023457 00000 n -0000034683 00000 n -0000034723 00000 n -0000770716 00000 n -0001023332 00000 n -0000034779 00000 n -0000034830 00000 n -0000770842 00000 n -0001023248 00000 n -0000034891 00000 n -0000034938 00000 n -0000770968 00000 n -0001023164 00000 n -0000034999 00000 n -0000035043 00000 n -0000774825 00000 n -0001023065 00000 n -0000035094 00000 n -0000035165 00000 n -0000774950 00000 n -0001022966 00000 n -0000035216 00000 n -0000035273 00000 n -0000777656 00000 n -0001022826 00000 n -0000035324 00000 n -0000035371 00000 n -0000777782 00000 n -0001022716 00000 n -0000035427 00000 n -0000035500 00000 n -0000780553 00000 n -0001022632 00000 n -0000035561 00000 n -0000035634 00000 n -0000780679 00000 n -0001022548 00000 n -0000035695 00000 n -0000035768 00000 n -0000780805 00000 n -0001022423 00000 n -0000035819 00000 n -0000035871 00000 n -0000780931 00000 n -0001022339 00000 n -0000035927 00000 n -0000035979 00000 n -0000783648 00000 n -0001022255 00000 n -0000036035 00000 n -0000036099 00000 n -0000787681 00000 n -0001022115 00000 n -0000036148 00000 n -0000036209 00000 n -0000787807 00000 n -0001021990 00000 n -0000036260 00000 n -0000036314 00000 n -0000787933 00000 n -0001021865 00000 n -0000036370 00000 n -0000036408 00000 n -0000791104 00000 n -0001021781 00000 n -0000036469 00000 n -0000036512 00000 n -0000795435 00000 n -0001021682 00000 n +0000034493 00000 n +0000892773 00000 n +0002233901 00000 n +0000034549 00000 n +0000034639 00000 n +0000897559 00000 n +0002233761 00000 n +0000034690 00000 n +0000034729 00000 n +0000897685 00000 n +0002233677 00000 n +0000034785 00000 n +0000034865 00000 n +0000902206 00000 n +0002233578 00000 n +0000034921 00000 n +0000034985 00000 n +0000907515 00000 n +0002233479 00000 n +0000035041 00000 n +0000035112 00000 n +0000907641 00000 n +0002233380 00000 n +0000035168 00000 n +0000035253 00000 n +0000911900 00000 n +0002233281 00000 n +0000035309 00000 n +0000035376 00000 n +0000919443 00000 n +0002233182 00000 n +0000035432 00000 n +0000035483 00000 n +0000919569 00000 n +0002233098 00000 n +0000035539 00000 n +0000035630 00000 n +0000919695 00000 n +0002232958 00000 n +0000035682 00000 n +0000035729 00000 n +0000919821 00000 n +0002232874 00000 n +0000035786 00000 n +0000035832 00000 n +0000923822 00000 n +0002232775 00000 n +0000035889 00000 n +0000035950 00000 n +0000923948 00000 n +0002232676 00000 n +0000036007 00000 n +0000036055 00000 n +0000924074 00000 n +0002232592 00000 n +0000036112 00000 n +0000036164 00000 n +0000928870 00000 n +0002232493 00000 n +0000036216 00000 n +0000036297 00000 n +0000933248 00000 n +0002232394 00000 n +0000036349 00000 n +0000036398 00000 n +0000933374 00000 n +0002232295 00000 n +0000036450 00000 n +0000036521 00000 n +0000936499 00000 n +0002232196 00000 n 0000036573 00000 n -0000036636 00000 n -0000795561 00000 n -0001021583 00000 n -0000036697 00000 n -0000036740 00000 n -0000798271 00000 n -0001021484 00000 n -0000036801 00000 n -0000036857 00000 n -0000798397 00000 n -0001021400 00000 n -0000036918 00000 n -0000036971 00000 n -0000798523 00000 n -0001021316 00000 n -0000037027 00000 n -0000037081 00000 n -0000802462 00000 n -0001021191 00000 n -0000037132 00000 n -0000037175 00000 n -0000802715 00000 n -0001021107 00000 n -0000037231 00000 n -0000037279 00000 n -0000802841 00000 n -0001021023 00000 n -0000037335 00000 n -0000037391 00000 n -0000809673 00000 n -0001020883 00000 n -0000037440 00000 n -0000037475 00000 n -0000809799 00000 n -0001020799 00000 n -0000037526 00000 n -0000037556 00000 n -0000809925 00000 n -0001020700 00000 n -0000037607 00000 n -0000037641 00000 n -0000810051 00000 n -0001020601 00000 n -0000037692 00000 n -0000037722 00000 n -0000811679 00000 n -0001020502 00000 n -0000037773 00000 n -0000037824 00000 n -0000814205 00000 n -0001020362 00000 n -0000037875 00000 n -0000037904 00000 n -0000814331 00000 n -0001020293 00000 n -0000037960 00000 n -0000038009 00000 n -0000814457 00000 n -0001020168 00000 n -0000038060 00000 n -0000038093 00000 n -0000814582 00000 n -0001020084 00000 n -0000038149 00000 n -0000038197 00000 n -0000814708 00000 n -0001020000 00000 n -0000038253 00000 n -0000038301 00000 n -0000819400 00000 n -0001019860 00000 n -0000038350 00000 n -0000038402 00000 n -0000819526 00000 n -0001019776 00000 n -0000038453 00000 n -0000038497 00000 n -0000819652 00000 n -0001019636 00000 n -0000038548 00000 n -0000038584 00000 n -0000819778 00000 n -0001019552 00000 n -0000038640 00000 n -0000038743 00000 n -0000824390 00000 n -0001019453 00000 n -0000038799 00000 n -0000038907 00000 n -0000824516 00000 n -0001019354 00000 n -0000038963 00000 n -0000039064 00000 n -0000824642 00000 n -0001019270 00000 n -0000039120 00000 n -0000039210 00000 n -0000824768 00000 n -0001019130 00000 n +0000036658 00000 n +0000936625 00000 n +0002232071 00000 n +0000036710 00000 n +0000036763 00000 n +0000936751 00000 n +0002231987 00000 n +0000036820 00000 n +0000036895 00000 n +0000936877 00000 n +0002231903 00000 n +0000036952 00000 n +0000037052 00000 n +0000941301 00000 n +0002231763 00000 n +0000037101 00000 n +0000037159 00000 n +0000941427 00000 n +0002231638 00000 n +0000037210 00000 n +0000037248 00000 n +0000941553 00000 n +0002231554 00000 n +0000037304 00000 n +0000037353 00000 n +0000941679 00000 n +0002231470 00000 n +0000037409 00000 n +0000037445 00000 n +0000941804 00000 n +0002231330 00000 n +0000037496 00000 n +0000037557 00000 n +0000945844 00000 n +0002231246 00000 n +0000037613 00000 n +0000037672 00000 n +0000945970 00000 n +0002231147 00000 n +0000037728 00000 n +0000037789 00000 n +0000948433 00000 n +0002231063 00000 n +0000037845 00000 n +0000037912 00000 n +0000952054 00000 n +0002230923 00000 n +0000037963 00000 n +0000038011 00000 n +0000952180 00000 n +0002230839 00000 n +0000038067 00000 n +0000038139 00000 n +0000952306 00000 n +0002230740 00000 n +0000038195 00000 n +0000038322 00000 n +0000955803 00000 n +0002230641 00000 n +0000038378 00000 n +0000038452 00000 n +0000955928 00000 n +0002230542 00000 n +0000038508 00000 n +0000038598 00000 n +0000960370 00000 n +0002230458 00000 n +0000038654 00000 n +0000038737 00000 n +0000960496 00000 n +0002230318 00000 n +0000038788 00000 n +0000038905 00000 n +0000964847 00000 n +0002230234 00000 n +0000038961 00000 n +0000039025 00000 n +0000964973 00000 n +0002230135 00000 n +0000039081 00000 n +0000039137 00000 n +0000965099 00000 n +0002230036 00000 n +0000039193 00000 n 0000039261 00000 n -0000039309 00000 n -0000824894 00000 n -0001019046 00000 n -0000039365 00000 n -0000039431 00000 n -0000828818 00000 n -0001018947 00000 n -0000039487 00000 n -0000039554 00000 n -0000828944 00000 n -0001018848 00000 n -0000039610 00000 n -0000039669 00000 n -0000829069 00000 n -0001018749 00000 n -0000039725 00000 n -0000039779 00000 n -0000829195 00000 n -0001018650 00000 n -0000039835 00000 n -0000039893 00000 n -0000829321 00000 n -0001018566 00000 n -0000039949 00000 n -0000039994 00000 n -0000829447 00000 n -0001018426 00000 n -0000040045 00000 n -0000040086 00000 n -0000833348 00000 n -0001018357 00000 n -0000040142 00000 n -0000040187 00000 n -0000833474 00000 n -0001018258 00000 n -0000040238 00000 n -0000040291 00000 n -0000835019 00000 n -0001018174 00000 n -0000040342 00000 n -0000040382 00000 n -0000838086 00000 n -0001018034 00000 n -0000040431 00000 n -0000040497 00000 n -0000838212 00000 n -0001017923 00000 n -0000040548 00000 n -0000040600 00000 n -0000838337 00000 n -0001017839 00000 n -0000040656 00000 n -0000040705 00000 n -0000841290 00000 n -0001017740 00000 n -0000040761 00000 n -0000040814 00000 n -0000844924 00000 n -0001017641 00000 n -0000040870 00000 n -0000040916 00000 n -0000845049 00000 n -0001017542 00000 n -0000040972 00000 n -0000041015 00000 n -0000848825 00000 n -0001017443 00000 n -0000041071 00000 n -0000041113 00000 n -0000848951 00000 n -0001017344 00000 n -0000041169 00000 n -0000041214 00000 n -0000849077 00000 n -0001017245 00000 n -0000041270 00000 n -0000041313 00000 n -0000849203 00000 n -0001017146 00000 n -0000041369 00000 n -0000041412 00000 n -0000849328 00000 n -0001017047 00000 n -0000041468 00000 n -0000041509 00000 n -0000850808 00000 n -0001016963 00000 n -0000041566 00000 n -0000041619 00000 n -0000854177 00000 n -0001016838 00000 n -0000041668 00000 n -0000041716 00000 n -0000854303 00000 n -0001016754 00000 n -0000041767 00000 n -0000041804 00000 n -0000854429 00000 n -0001016655 00000 n -0000041855 00000 n -0000041895 00000 n -0000854555 00000 n -0001016556 00000 n -0000041946 00000 n -0000041981 00000 n -0000858041 00000 n -0001016457 00000 n -0000042032 00000 n -0000042066 00000 n -0000858167 00000 n -0001016358 00000 n -0000042117 00000 n -0000042152 00000 n -0000858292 00000 n -0001016259 00000 n -0000042203 00000 n -0000042237 00000 n -0000858418 00000 n -0001016160 00000 n -0000042288 00000 n -0000042323 00000 n -0000858544 00000 n -0001016061 00000 n -0000042374 00000 n -0000042411 00000 n -0000859860 00000 n -0001015977 00000 n -0000042462 00000 n -0000042501 00000 n -0000042880 00000 n -0000043129 00000 n -0000042555 00000 n -0000043003 00000 n -0000043066 00000 n -0001008999 00000 n -0000995475 00000 n -0001008831 00000 n -0000995006 00000 n -0000990297 00000 n -0000994841 00000 n -0001009897 00000 n -0000045598 00000 n -0000044684 00000 n -0000043217 00000 n -0000045535 00000 n -0000989262 00000 n -0000970555 00000 n -0000989097 00000 n -0000044855 00000 n -0000969537 00000 n -0000952871 00000 n -0000969371 00000 n -0000045023 00000 n -0000045195 00000 n -0000045364 00000 n -0000046712 00000 n -0000046321 00000 n -0000045686 00000 n -0000046649 00000 n -0000950938 00000 n -0000935235 00000 n -0000950772 00000 n -0000046465 00000 n -0000054523 00000 n -0000048642 00000 n -0000046814 00000 n -0000054397 00000 n -0000054460 00000 n -0000049083 00000 n -0000049233 00000 n -0000049386 00000 n -0000049541 00000 n -0000049695 00000 n -0000049850 00000 n -0000050005 00000 n -0000050159 00000 n -0000050313 00000 n -0000050468 00000 n -0000050621 00000 n -0000050776 00000 n -0000050931 00000 n -0000051091 00000 n -0000051256 00000 n -0000051415 00000 n -0000051570 00000 n -0000051725 00000 n -0000051879 00000 n -0000052034 00000 n -0000052184 00000 n -0000052337 00000 n -0000052491 00000 n -0000052646 00000 n -0000052801 00000 n -0000052961 00000 n -0000053114 00000 n -0000053269 00000 n -0000053429 00000 n +0000998311 00000 n +0002229937 00000 n +0000039317 00000 n +0000039371 00000 n +0001012636 00000 n +0002229838 00000 n +0000039427 00000 n +0000039514 00000 n +0001016878 00000 n +0002229739 00000 n +0000039570 00000 n +0000039650 00000 n +0001021018 00000 n +0002229640 00000 n +0000039706 00000 n +0000039780 00000 n +0001021144 00000 n +0002229556 00000 n +0000039836 00000 n +0000039911 00000 n +0001021270 00000 n +0002229415 00000 n +0000039962 00000 n +0000040019 00000 n +0001026242 00000 n +0002229331 00000 n +0000040075 00000 n +0000040130 00000 n +0001029369 00000 n +0002229232 00000 n +0000040186 00000 n +0000040240 00000 n +0001032576 00000 n +0002229133 00000 n +0000040296 00000 n +0000040343 00000 n +0001032702 00000 n +0002229034 00000 n +0000040399 00000 n +0000040437 00000 n +0001052711 00000 n +0002228935 00000 n +0000040493 00000 n +0000040527 00000 n +0001077201 00000 n +0002228836 00000 n +0000040583 00000 n +0000040621 00000 n +0001133098 00000 n +0002228737 00000 n +0000040677 00000 n +0000040732 00000 n +0001133224 00000 n +0002228638 00000 n +0000040788 00000 n +0000040844 00000 n +0001138202 00000 n +0002228539 00000 n +0000040900 00000 n +0000040941 00000 n +0001141848 00000 n +0002228440 00000 n +0000040998 00000 n +0000041083 00000 n +0001145596 00000 n +0002228341 00000 n +0000041140 00000 n +0000041189 00000 n +0001145722 00000 n +0002228242 00000 n +0000041246 00000 n +0000041285 00000 n +0001145848 00000 n +0002228143 00000 n +0000041342 00000 n +0000041385 00000 n +0001145973 00000 n +0002228044 00000 n +0000041442 00000 n +0000041506 00000 n +0001153147 00000 n +0002227945 00000 n +0000041563 00000 n +0000041652 00000 n +0001153272 00000 n +0002227846 00000 n +0000041709 00000 n +0000041805 00000 n +0001157962 00000 n +0002227747 00000 n +0000041862 00000 n +0000041920 00000 n +0001163425 00000 n +0002227648 00000 n +0000041977 00000 n +0000042036 00000 n +0001167682 00000 n +0002227564 00000 n +0000042093 00000 n +0000042153 00000 n +0001167808 00000 n +0002227424 00000 n +0000042204 00000 n +0000042265 00000 n +0001167934 00000 n +0002227340 00000 n +0000042321 00000 n +0000042391 00000 n +0001168059 00000 n +0002227241 00000 n +0000042447 00000 n +0000042505 00000 n +0001172193 00000 n +0002227157 00000 n +0000042561 00000 n +0000042619 00000 n +0001172318 00000 n +0002227017 00000 n +0000042670 00000 n +0000042760 00000 n +0001172444 00000 n +0002226933 00000 n +0000042816 00000 n +0000042893 00000 n +0001172570 00000 n +0002226849 00000 n +0000042949 00000 n +0000043026 00000 n +0001177101 00000 n +0002226709 00000 n +0000043077 00000 n +0000043197 00000 n +0001177227 00000 n +0002226625 00000 n +0000043253 00000 n +0000043313 00000 n +0001177353 00000 n +0002226541 00000 n +0000043369 00000 n +0000043432 00000 n +0001181511 00000 n +0002226401 00000 n +0000043483 00000 n +0000043557 00000 n +0001181637 00000 n +0002226317 00000 n +0000043613 00000 n +0000043701 00000 n +0001181763 00000 n +0002226218 00000 n +0000043757 00000 n +0000043821 00000 n +0001181888 00000 n +0002226119 00000 n +0000043877 00000 n +0000043929 00000 n +0001182013 00000 n +0002226035 00000 n +0000043985 00000 n +0000044077 00000 n +0001185726 00000 n +0002225894 00000 n +0000044129 00000 n +0000044191 00000 n +0001185852 00000 n +0002225810 00000 n +0000044248 00000 n +0000044308 00000 n +0001185978 00000 n +0002225711 00000 n +0000044365 00000 n +0000044430 00000 n +0001188573 00000 n +0002225612 00000 n +0000044487 00000 n +0000044567 00000 n +0001191233 00000 n +0002225513 00000 n +0000044624 00000 n +0000044689 00000 n +0001194835 00000 n +0002225414 00000 n +0000044746 00000 n +0000044807 00000 n +0001194961 00000 n +0002225315 00000 n +0000044864 00000 n +0000044953 00000 n +0001197095 00000 n +0002225216 00000 n +0000045010 00000 n +0000045063 00000 n +0001201576 00000 n +0002225117 00000 n +0000045120 00000 n +0000045262 00000 n +0001205835 00000 n +0002225018 00000 n +0000045319 00000 n +0000045379 00000 n +0001208307 00000 n +0002224919 00000 n +0000045437 00000 n +0000045503 00000 n +0001211407 00000 n +0002224820 00000 n +0000045561 00000 n +0000045615 00000 n +0001214986 00000 n +0002224721 00000 n +0000045673 00000 n +0000045755 00000 n +0001215301 00000 n +0002224622 00000 n +0000045813 00000 n +0000045870 00000 n +0001215426 00000 n +0002224523 00000 n +0000045928 00000 n +0000045978 00000 n +0001219703 00000 n +0002224424 00000 n +0000046036 00000 n +0000046110 00000 n +0001219829 00000 n +0002224340 00000 n +0000046168 00000 n +0000046256 00000 n +0001223758 00000 n +0002224200 00000 n +0000046308 00000 n +0000046398 00000 n +0001224135 00000 n +0002224116 00000 n +0000046455 00000 n +0000046517 00000 n +0001227869 00000 n +0002224017 00000 n +0000046574 00000 n +0000046639 00000 n +0001227995 00000 n +0002223918 00000 n +0000046696 00000 n +0000046771 00000 n +0001231484 00000 n +0002223819 00000 n +0000046828 00000 n +0000046912 00000 n +0001234547 00000 n +0002223678 00000 n +0000046969 00000 n +0000047055 00000 n +0001234673 00000 n +0002223594 00000 n +0000047117 00000 n +0000047187 00000 n +0001234798 00000 n +0002223495 00000 n +0000047249 00000 n +0000047349 00000 n +0001234924 00000 n +0002223396 00000 n +0000047411 00000 n +0000047512 00000 n +0001237477 00000 n +0002223297 00000 n +0000047574 00000 n +0000047672 00000 n +0001237603 00000 n +0002223198 00000 n +0000047734 00000 n +0000047814 00000 n +0001240068 00000 n +0002223099 00000 n +0000047876 00000 n +0000047971 00000 n +0001240194 00000 n +0002223000 00000 n +0000048033 00000 n +0000048115 00000 n +0001240320 00000 n +0002222901 00000 n +0000048177 00000 n +0000048275 00000 n +0001242399 00000 n +0002222802 00000 n +0000048337 00000 n +0000048448 00000 n +0001242525 00000 n +0002222703 00000 n +0000048511 00000 n +0000048615 00000 n +0001245472 00000 n +0002222604 00000 n +0000048678 00000 n +0000048782 00000 n +0001245598 00000 n +0002222505 00000 n +0000048845 00000 n +0000048942 00000 n +0001245722 00000 n +0002222406 00000 n +0000049005 00000 n +0000049084 00000 n +0001248358 00000 n +0002222307 00000 n +0000049147 00000 n +0000049231 00000 n +0001248482 00000 n +0002222223 00000 n +0000049294 00000 n +0000049392 00000 n +0001248608 00000 n +0002222139 00000 n +0000049449 00000 n +0000049503 00000 n +0001252383 00000 n +0002221999 00000 n +0000049555 00000 n +0000049606 00000 n +0001252509 00000 n +0002221915 00000 n +0000049663 00000 n +0000049714 00000 n +0001252635 00000 n +0002221816 00000 n +0000049771 00000 n +0000049813 00000 n +0001252761 00000 n +0002221717 00000 n +0000049870 00000 n +0000049917 00000 n +0001255816 00000 n +0002221633 00000 n +0000049974 00000 n +0000050018 00000 n +0001255942 00000 n +0002221493 00000 n +0000050070 00000 n +0000050138 00000 n +0001261775 00000 n +0002221368 00000 n +0000050195 00000 n +0000050259 00000 n +0001261901 00000 n +0002221284 00000 n +0000050321 00000 n +0000050374 00000 n +0001262027 00000 n +0002221185 00000 n +0000050436 00000 n +0000050506 00000 n +0001269044 00000 n +0002221086 00000 n +0000050568 00000 n +0000050622 00000 n +0001269170 00000 n +0002220987 00000 n +0000050684 00000 n +0000050761 00000 n +0001275539 00000 n +0002220888 00000 n +0000050823 00000 n +0000050896 00000 n +0001275665 00000 n +0002220789 00000 n +0000050958 00000 n +0000051015 00000 n +0001281729 00000 n +0002220690 00000 n +0000051077 00000 n +0000051185 00000 n +0001281855 00000 n +0002220606 00000 n +0000051247 00000 n +0000051310 00000 n +0001281980 00000 n +0002220522 00000 n +0000051367 00000 n +0000051451 00000 n +0001297295 00000 n +0002220382 00000 n +0000051503 00000 n +0000051555 00000 n +0001301420 00000 n +0002220298 00000 n +0000051612 00000 n +0000051658 00000 n +0001301546 00000 n +0002220199 00000 n +0000051715 00000 n +0000051776 00000 n +0001301672 00000 n +0002220100 00000 n +0000051833 00000 n +0000051915 00000 n +0001301798 00000 n +0002220001 00000 n +0000051972 00000 n +0000052028 00000 n +0001305441 00000 n +0002219902 00000 n +0000052085 00000 n +0000052135 00000 n +0001305566 00000 n +0002219803 00000 n +0000052192 00000 n +0000052240 00000 n +0001308927 00000 n +0002219719 00000 n +0000052297 00000 n +0000052348 00000 n +0001309053 00000 n +0002219620 00000 n +0000052400 00000 n +0000052446 00000 n +0001313270 00000 n +0002219480 00000 n +0000052498 00000 n +0000052574 00000 n +0001313396 00000 n +0002219396 00000 n +0000052631 00000 n +0000052697 00000 n +0001313522 00000 n +0002219297 00000 n +0000052754 00000 n +0000052797 00000 n +0001316015 00000 n +0002219213 00000 n +0000052854 00000 n +0000052903 00000 n +0001316141 00000 n +0002219114 00000 n +0000052955 00000 n +0000053020 00000 n +0001316266 00000 n +0002218974 00000 n +0000053072 00000 n +0000053122 00000 n +0001316392 00000 n +0002218890 00000 n +0000053179 00000 n +0000053235 00000 n +0001316517 00000 n +0002218791 00000 n +0000053292 00000 n +0000053340 00000 n +0001316643 00000 n +0002218707 00000 n +0000053397 00000 n +0000053444 00000 n +0001319801 00000 n +0002218582 00000 n +0000053496 00000 n +0000053531 00000 n +0001319927 00000 n +0002218498 00000 n 0000053588 00000 n -0000053747 00000 n -0000053912 00000 n -0000054076 00000 n -0000054234 00000 n -0000063616 00000 n -0000056970 00000 n -0000054611 00000 n -0000063553 00000 n -0000934635 00000 n -0000924949 00000 n -0000934469 00000 n -0000057456 00000 n -0000057616 00000 n -0000057769 00000 n -0000057924 00000 n -0000058079 00000 n -0000058234 00000 n -0000058389 00000 n -0000058549 00000 n -0000058708 00000 n -0000058868 00000 n -0000059023 00000 n -0000059182 00000 n -0000059342 00000 n -0000059502 00000 n -0000059662 00000 n -0000059822 00000 n -0000059976 00000 n -0000060136 00000 n -0000060287 00000 n -0000060441 00000 n -0000060596 00000 n -0000060751 00000 n -0000060911 00000 n -0000061071 00000 n -0000061226 00000 n -0000061381 00000 n -0000061541 00000 n -0000061700 00000 n -0000061853 00000 n -0000062008 00000 n -0000062161 00000 n -0000062316 00000 n -0000062476 00000 n -0000062631 00000 n -0000062786 00000 n -0000062941 00000 n -0000063094 00000 n -0000063249 00000 n -0000063403 00000 n -0000074547 00000 n -0000065955 00000 n -0000063718 00000 n -0000074484 00000 n -0000066540 00000 n -0000066693 00000 n -0000066848 00000 n -0000067003 00000 n -0000067158 00000 n -0000067318 00000 n -0000067478 00000 n -0000067638 00000 n -0000067798 00000 n -0000067957 00000 n -0000068117 00000 n -0000068277 00000 n -0000068436 00000 n -0000068591 00000 n -0000068751 00000 n -0000068911 00000 n -0000069071 00000 n -0000069226 00000 n -0000069386 00000 n -0000069546 00000 n -0000069701 00000 n -0000069860 00000 n -0000070020 00000 n -0000070180 00000 n -0000070345 00000 n -0000070499 00000 n -0000070655 00000 n -0000070811 00000 n -0000070972 00000 n -0000071133 00000 n -0000071289 00000 n -0000071445 00000 n -0000071600 00000 n -0000071755 00000 n -0000071916 00000 n -0000072077 00000 n +0000053664 00000 n +0001322582 00000 n +0002218399 00000 n +0000053721 00000 n +0000053776 00000 n +0001333246 00000 n +0002218300 00000 n +0000053833 00000 n +0000053928 00000 n +0001348424 00000 n +0002218216 00000 n +0000053985 00000 n +0000054056 00000 n +0001626808 00000 n +0002218077 00000 n +0000054105 00000 n +0000054150 00000 n +0001626934 00000 n +0002217993 00000 n +0000054201 00000 n +0000054248 00000 n +0001627060 00000 n +0002217894 00000 n +0000054299 00000 n +0000054335 00000 n +0001630319 00000 n +0002217754 00000 n +0000054386 00000 n +0000054428 00000 n +0001630445 00000 n +0002217670 00000 n +0000054484 00000 n +0000054517 00000 n +0001630571 00000 n +0002217571 00000 n +0000054573 00000 n +0000054614 00000 n +0001630823 00000 n +0002217472 00000 n +0000054670 00000 n +0000054711 00000 n +0001630949 00000 n +0002217373 00000 n +0000054767 00000 n +0000054802 00000 n +0001634755 00000 n +0002217289 00000 n +0000054858 00000 n +0000054894 00000 n +0001634881 00000 n +0002217149 00000 n +0000054945 00000 n +0000055002 00000 n +0001635007 00000 n +0002217065 00000 n +0000055058 00000 n +0000055096 00000 n +0001635133 00000 n +0002216981 00000 n +0000055152 00000 n +0000055185 00000 n +0001635259 00000 n +0002216897 00000 n +0000055236 00000 n +0000055275 00000 n +0001638656 00000 n +0002216758 00000 n +0000055324 00000 n +0000055386 00000 n +0001638780 00000 n +0002216674 00000 n +0000055437 00000 n +0000055484 00000 n +0001638904 00000 n +0002216575 00000 n +0000055535 00000 n +0000055573 00000 n +0001639030 00000 n +0002216435 00000 n +0000055624 00000 n +0000055671 00000 n +0001643004 00000 n +0002216366 00000 n +0000055727 00000 n +0000055766 00000 n +0001643130 00000 n +0002216226 00000 n +0000055817 00000 n +0000055860 00000 n +0001643256 00000 n +0002216142 00000 n +0000055916 00000 n +0000055976 00000 n +0001647425 00000 n +0002216043 00000 n +0000056032 00000 n +0000056095 00000 n +0001647551 00000 n +0002215944 00000 n +0000056151 00000 n +0000056198 00000 n +0001647677 00000 n +0002215845 00000 n +0000056254 00000 n +0000056314 00000 n +0001651985 00000 n +0002215746 00000 n +0000056370 00000 n +0000056426 00000 n +0001652111 00000 n +0002215662 00000 n +0000056482 00000 n +0000056524 00000 n +0001652237 00000 n +0002215522 00000 n +0000056575 00000 n +0000056631 00000 n +0001652363 00000 n +0002215438 00000 n +0000056687 00000 n +0000056727 00000 n +0001656845 00000 n +0002215339 00000 n +0000056783 00000 n +0000056823 00000 n +0001656971 00000 n +0002215214 00000 n +0000056879 00000 n +0000056925 00000 n +0001657095 00000 n +0002215130 00000 n +0000056986 00000 n +0000057043 00000 n +0001659917 00000 n +0002215031 00000 n +0000057104 00000 n +0000057204 00000 n +0001660043 00000 n +0002214932 00000 n +0000057265 00000 n +0000057313 00000 n +0001664210 00000 n +0002214833 00000 n +0000057374 00000 n +0000057422 00000 n +0001664336 00000 n +0002214734 00000 n +0000057483 00000 n +0000057552 00000 n +0001664461 00000 n +0002214635 00000 n +0000057613 00000 n +0000057684 00000 n +0001667267 00000 n +0002214536 00000 n +0000057745 00000 n +0000057805 00000 n +0001673992 00000 n +0002214452 00000 n +0000057866 00000 n +0000057921 00000 n +0001680814 00000 n +0002214353 00000 n +0000057972 00000 n +0000058008 00000 n +0001680939 00000 n +0002214269 00000 n +0000058059 00000 n +0000058098 00000 n +0001685044 00000 n +0002214130 00000 n +0000058147 00000 n +0000058198 00000 n +0001685170 00000 n +0002214046 00000 n +0000058249 00000 n +0000058296 00000 n +0001685296 00000 n +0002213947 00000 n +0000058347 00000 n +0000058401 00000 n +0001685421 00000 n +0002213807 00000 n +0000058452 00000 n +0000058503 00000 n +0001685547 00000 n +0002213738 00000 n +0000058559 00000 n +0000058624 00000 n +0001693534 00000 n +0002213598 00000 n +0000058675 00000 n +0000058727 00000 n +0001697773 00000 n +0002213529 00000 n +0000058783 00000 n +0000058852 00000 n +0001697899 00000 n +0002213445 00000 n +0000058903 00000 n +0000058942 00000 n +0001701745 00000 n +0002213306 00000 n +0000058991 00000 n +0000059042 00000 n +0001701871 00000 n +0002213222 00000 n +0000059093 00000 n +0000059140 00000 n +0001701996 00000 n +0002213082 00000 n +0000059191 00000 n +0000059254 00000 n +0001707068 00000 n +0002212998 00000 n +0000059310 00000 n +0000059360 00000 n +0001707194 00000 n +0002212858 00000 n +0000059416 00000 n +0000059474 00000 n +0001711687 00000 n +0002212789 00000 n +0000059535 00000 n +0000059582 00000 n +0001711813 00000 n +0002212664 00000 n +0000059638 00000 n +0000059708 00000 n +0001711939 00000 n +0002212595 00000 n +0000059769 00000 n +0000059836 00000 n +0001716601 00000 n +0002212455 00000 n +0000059887 00000 n +0000059943 00000 n +0001720434 00000 n +0002212371 00000 n +0000059999 00000 n +0000060048 00000 n +0001720560 00000 n +0002212272 00000 n +0000060104 00000 n +0000060148 00000 n +0001720686 00000 n +0002212188 00000 n +0000060204 00000 n +0000060241 00000 n +0001720812 00000 n +0002212089 00000 n +0000060292 00000 n +0000060362 00000 n +0001723889 00000 n +0002211964 00000 n +0000060413 00000 n +0000060452 00000 n +0001724015 00000 n +0002211895 00000 n +0000060508 00000 n +0000060556 00000 n +0001726903 00000 n +0002211756 00000 n +0000060605 00000 n +0000060655 00000 n +0001727029 00000 n +0002211672 00000 n +0000060706 00000 n +0000060753 00000 n +0001727155 00000 n +0002211532 00000 n +0000060804 00000 n +0000060846 00000 n +0001727281 00000 n +0002211407 00000 n +0000060902 00000 n +0000060970 00000 n +0001727407 00000 n +0002211323 00000 n +0000061031 00000 n +0000061083 00000 n +0001730819 00000 n +0002211224 00000 n +0000061144 00000 n +0000061203 00000 n +0001730945 00000 n +0002211125 00000 n +0000061264 00000 n +0000061350 00000 n +0001731071 00000 n +0002211041 00000 n +0000061411 00000 n +0000061474 00000 n +0001734842 00000 n +0002210901 00000 n +0000061530 00000 n +0000061606 00000 n +0001734968 00000 n +0002210817 00000 n +0000061667 00000 n +0000061726 00000 n +0001744319 00000 n +0002210718 00000 n +0000061787 00000 n +0000061840 00000 n +0001744445 00000 n +0002210634 00000 n +0000061901 00000 n +0000061959 00000 n +0001750614 00000 n +0002210535 00000 n +0000062015 00000 n +0000062103 00000 n +0001754443 00000 n +0002210410 00000 n +0000062159 00000 n +0000062242 00000 n +0001754569 00000 n +0002210326 00000 n +0000062303 00000 n +0000062369 00000 n +0001755135 00000 n +0002210227 00000 n +0000062430 00000 n +0000062474 00000 n +0001758967 00000 n +0002210128 00000 n +0000062535 00000 n +0000062577 00000 n +0001759093 00000 n +0002210044 00000 n +0000062638 00000 n +0000062675 00000 n +0001759219 00000 n +0002209945 00000 n +0000062726 00000 n +0000062770 00000 n +0001759345 00000 n +0002209846 00000 n +0000062821 00000 n +0000062879 00000 n +0001763429 00000 n +0002209706 00000 n +0000062930 00000 n +0000062989 00000 n +0001763555 00000 n +0002209581 00000 n +0000063045 00000 n +0000063089 00000 n +0001763681 00000 n +0002209512 00000 n +0000063150 00000 n +0000063229 00000 n +0001763807 00000 n +0002209413 00000 n +0000063285 00000 n +0000063339 00000 n +0001772341 00000 n +0002209329 00000 n +0000063395 00000 n +0000063441 00000 n +0001780665 00000 n +0002209204 00000 n +0000063492 00000 n +0000063531 00000 n +0001780791 00000 n +0002209120 00000 n +0000063587 00000 n +0000063696 00000 n +0001784674 00000 n +0002209021 00000 n +0000063752 00000 n +0000063808 00000 n +0001784800 00000 n +0002208937 00000 n +0000063864 00000 n +0000063920 00000 n +0001790575 00000 n +0002208798 00000 n +0000063969 00000 n +0000064029 00000 n +0001790701 00000 n +0002208714 00000 n +0000064080 00000 n +0000064127 00000 n +0001794912 00000 n +0002208574 00000 n +0000064178 00000 n +0000064224 00000 n +0001795037 00000 n +0002208449 00000 n +0000064280 00000 n +0000064332 00000 n +0001799359 00000 n +0002208380 00000 n +0000064393 00000 n +0000064452 00000 n +0001811756 00000 n +0002208240 00000 n +0000064508 00000 n +0000064565 00000 n +0001811880 00000 n +0002208156 00000 n +0000064626 00000 n +0000064682 00000 n +0001812006 00000 n +0002208072 00000 n +0000064743 00000 n +0000064804 00000 n +0001819237 00000 n +0002207973 00000 n +0000064860 00000 n +0000064914 00000 n +0001819363 00000 n +0002207874 00000 n +0000064970 00000 n +0000065042 00000 n +0001823690 00000 n +0002207749 00000 n +0000065098 00000 n +0000065174 00000 n +0001827255 00000 n +0002207665 00000 n +0000065235 00000 n +0000065303 00000 n +0001827381 00000 n +0002207566 00000 n +0000065364 00000 n +0000065426 00000 n +0001829523 00000 n +0002207467 00000 n +0000065487 00000 n +0000065546 00000 n +0001829649 00000 n +0002207383 00000 n +0000065607 00000 n +0000065680 00000 n +0001829775 00000 n +0002207258 00000 n +0000065731 00000 n +0000065770 00000 n +0001829900 00000 n +0002207189 00000 n +0000065826 00000 n +0000065876 00000 n +0001834366 00000 n +0002207050 00000 n +0000065925 00000 n +0000065991 00000 n +0001834491 00000 n +0002206966 00000 n +0000066042 00000 n +0000066089 00000 n +0001834616 00000 n +0002206867 00000 n +0000066140 00000 n +0000066188 00000 n +0001838437 00000 n +0002206727 00000 n +0000066239 00000 n +0000066307 00000 n +0001838563 00000 n +0002206643 00000 n +0000066363 00000 n +0000066401 00000 n +0001841192 00000 n +0002206544 00000 n +0000066457 00000 n +0000066501 00000 n +0001841318 00000 n +0002206445 00000 n +0000066557 00000 n +0000066599 00000 n +0001841442 00000 n +0002206361 00000 n +0000066655 00000 n +0000066701 00000 n +0001845221 00000 n +0002206221 00000 n +0000066752 00000 n +0000066830 00000 n +0001849389 00000 n +0002206137 00000 n +0000066886 00000 n +0000066936 00000 n +0001849514 00000 n +0002206038 00000 n +0000066992 00000 n +0000067036 00000 n +0001854808 00000 n +0002205939 00000 n +0000067092 00000 n +0000067130 00000 n +0001854933 00000 n +0002205840 00000 n +0000067186 00000 n +0000067224 00000 n +0001855058 00000 n +0002205756 00000 n +0000067280 00000 n +0000067319 00000 n +0001858277 00000 n +0002205631 00000 n +0000067370 00000 n +0000067409 00000 n +0001858403 00000 n +0002205547 00000 n +0000067465 00000 n +0000067521 00000 n +0001858529 00000 n +0002205448 00000 n +0000067577 00000 n +0000067634 00000 n +0001858655 00000 n +0002205364 00000 n +0000067690 00000 n +0000067750 00000 n +0001863877 00000 n +0002205225 00000 n +0000067799 00000 n +0000067839 00000 n +0001864003 00000 n +0002205141 00000 n +0000067890 00000 n +0000067937 00000 n +0001864129 00000 n +0002205042 00000 n +0000067988 00000 n +0000068044 00000 n +0001864255 00000 n +0002204943 00000 n +0000068095 00000 n +0000068139 00000 n +0001867639 00000 n +0002204844 00000 n +0000068190 00000 n +0000068241 00000 n +0001867765 00000 n +0002204760 00000 n +0000068292 00000 n +0000068335 00000 n +0001869182 00000 n +0002204621 00000 n +0000068384 00000 n +0000068431 00000 n +0001869308 00000 n +0002204537 00000 n +0000068482 00000 n +0000068512 00000 n +0001869434 00000 n +0002204453 00000 n +0000068563 00000 n +0000068610 00000 n +0001870325 00000 n +0002204329 00000 n +0000068659 00000 n +0000068708 00000 n +0001870451 00000 n +0002204260 00000 n +0000068759 00000 n +0000068789 00000 n +0001871175 00000 n +0002204121 00000 n +0000068834 00000 n +0000068880 00000 n +0001873487 00000 n +0002203996 00000 n +0000068929 00000 n +0000068992 00000 n +0001873613 00000 n +0002203912 00000 n +0000069043 00000 n +0000069077 00000 n +0001873739 00000 n +0002203813 00000 n +0000069128 00000 n +0000069184 00000 n +0001873865 00000 n +0002203729 00000 n +0000069235 00000 n +0000069277 00000 n +0001877135 00000 n +0002203589 00000 n +0000069326 00000 n +0000069387 00000 n +0001877261 00000 n +0002203464 00000 n +0000069438 00000 n +0000069492 00000 n +0001877387 00000 n +0002203339 00000 n +0000069548 00000 n +0000069586 00000 n +0001881500 00000 n +0002203255 00000 n +0000069647 00000 n +0000069690 00000 n +0001881626 00000 n +0002203156 00000 n +0000069751 00000 n +0000069814 00000 n +0001885799 00000 n +0002203057 00000 n +0000069875 00000 n +0000069918 00000 n +0001885925 00000 n +0002202958 00000 n +0000069979 00000 n +0000070035 00000 n +0001886051 00000 n +0002202874 00000 n +0000070096 00000 n +0000070149 00000 n +0001889855 00000 n +0002202790 00000 n +0000070205 00000 n +0000070259 00000 n +0001891177 00000 n +0002202665 00000 n +0000070310 00000 n +0000070353 00000 n +0001891430 00000 n +0002202581 00000 n +0000070409 00000 n +0000070457 00000 n +0001894676 00000 n +0002202497 00000 n +0000070513 00000 n +0000070569 00000 n +0001899251 00000 n +0002202372 00000 n +0000070618 00000 n +0000070682 00000 n +0001899377 00000 n +0002202261 00000 n +0000070733 00000 n +0000070780 00000 n +0001899502 00000 n +0002202177 00000 n +0000070836 00000 n +0000070885 00000 n +0001903003 00000 n +0002202078 00000 n +0000070941 00000 n +0000070994 00000 n +0001907374 00000 n +0002201979 00000 n +0000071050 00000 n +0000071096 00000 n +0001907500 00000 n +0002201880 00000 n +0000071152 00000 n +0000071195 00000 n +0001907626 00000 n +0002201781 00000 n +0000071251 00000 n +0000071293 00000 n +0001911597 00000 n +0002201682 00000 n +0000071349 00000 n +0000071394 00000 n +0001911723 00000 n +0002201583 00000 n +0000071450 00000 n +0000071493 00000 n +0001911849 00000 n +0002201484 00000 n +0000071549 00000 n +0000071592 00000 n +0001911975 00000 n +0002201385 00000 n +0000071648 00000 n +0000071689 00000 n +0001912101 00000 n +0002201301 00000 n +0000071746 00000 n +0000071799 00000 n +0001912856 00000 n +0002201161 00000 n +0000071844 00000 n +0000071882 00000 n +0001915755 00000 n +0002201036 00000 n +0000071931 00000 n +0000071974 00000 n +0001915881 00000 n +0002200952 00000 n +0000072025 00000 n +0000072063 00000 n +0001916007 00000 n +0002200853 00000 n +0000072114 00000 n +0000072151 00000 n +0001920013 00000 n +0002200754 00000 n +0000072202 00000 n 0000072237 00000 n -0000072398 00000 n -0000072559 00000 n -0000072725 00000 n -0000072891 00000 n -0000073052 00000 n -0000073213 00000 n -0000073374 00000 n -0000073535 00000 n -0000073689 00000 n -0000073850 00000 n -0000074011 00000 n -0000074171 00000 n -0000074330 00000 n -0000085294 00000 n -0000076930 00000 n -0000074649 00000 n -0000085231 00000 n -0000077506 00000 n -0000077660 00000 n -0000077816 00000 n -0000077972 00000 n -0000078128 00000 n -0000078284 00000 n -0000078445 00000 n -0000078606 00000 n -0000078762 00000 n -0000078917 00000 n -0000079073 00000 n -0000079226 00000 n -0000079379 00000 n -0000079535 00000 n -0000079691 00000 n -0000079852 00000 n -0000080013 00000 n -0000080174 00000 n -0000080335 00000 n -0000080495 00000 n -0000080651 00000 n -0000080812 00000 n -0000080971 00000 n -0000081131 00000 n -0000081292 00000 n -0000081448 00000 n -0000081609 00000 n -0000081770 00000 n -0000081931 00000 n -0000082092 00000 n -0000082253 00000 n -0000082413 00000 n -0000082573 00000 n -0000082734 00000 n -0000082895 00000 n -0000083049 00000 n -0000083205 00000 n -0000083361 00000 n -0000083517 00000 n -0000083673 00000 n -0000083829 00000 n -0000083985 00000 n -0000084140 00000 n -0000084299 00000 n -0000084454 00000 n -0000084609 00000 n -0000084768 00000 n -0000084923 00000 n -0000085077 00000 n -0001010022 00000 n -0000095363 00000 n -0000087590 00000 n -0000085396 00000 n -0000095300 00000 n -0000088130 00000 n -0000088284 00000 n -0000088439 00000 n -0000088594 00000 n -0000088749 00000 n -0000088909 00000 n -0000089064 00000 n -0000089224 00000 n -0000089384 00000 n -0000089543 00000 n -0000089703 00000 n -0000089863 00000 n -0000090022 00000 n -0000090177 00000 n -0000090337 00000 n -0000090497 00000 n -0000090657 00000 n -0000090822 00000 n -0000090987 00000 n -0000091152 00000 n -0000091316 00000 n -0000091481 00000 n -0000091646 00000 n -0000091811 00000 n -0000091975 00000 n -0000092130 00000 n -0000092285 00000 n -0000092439 00000 n -0000092594 00000 n -0000092754 00000 n -0000092919 00000 n -0000093083 00000 n -0000093237 00000 n -0000093392 00000 n -0000093552 00000 n -0000093706 00000 n -0000093861 00000 n -0000094021 00000 n -0000094181 00000 n -0000094346 00000 n -0000094506 00000 n -0000094671 00000 n -0000094826 00000 n -0000094985 00000 n -0000095145 00000 n -0000105915 00000 n -0000097788 00000 n -0000095465 00000 n -0000105852 00000 n -0000098346 00000 n -0000098500 00000 n -0000098655 00000 n -0000098815 00000 n -0000098980 00000 n -0000099145 00000 n -0000099310 00000 n -0000099475 00000 n -0000099634 00000 n -0000099799 00000 n -0000099964 00000 n -0000100128 00000 n -0000100288 00000 n -0000100448 00000 n -0000100613 00000 n -0000100778 00000 n -0000100943 00000 n -0000101108 00000 n -0000101263 00000 n -0000101417 00000 n -0000101572 00000 n -0000101732 00000 n -0000101897 00000 n -0000102056 00000 n -0000102216 00000 n -0000102370 00000 n -0000102525 00000 n -0000102680 00000 n -0000102840 00000 n -0000102999 00000 n -0000103153 00000 n -0000103313 00000 n -0000103473 00000 n -0000103627 00000 n -0000103782 00000 n -0000103942 00000 n -0000104102 00000 n -0000104267 00000 n -0000104432 00000 n -0000104597 00000 n -0000104762 00000 n -0000104916 00000 n -0000105070 00000 n -0000105224 00000 n -0000105378 00000 n -0000105536 00000 n -0000105694 00000 n -0000115869 00000 n -0000108078 00000 n -0000106017 00000 n -0000115806 00000 n -0000108627 00000 n -0000108787 00000 n -0000108942 00000 n -0000109102 00000 n -0000109262 00000 n -0000109416 00000 n -0000109571 00000 n -0000109731 00000 n -0000109885 00000 n -0000110040 00000 n -0000110199 00000 n -0000110359 00000 n -0000110519 00000 n -0000110679 00000 n -0000110834 00000 n -0000110994 00000 n -0000111154 00000 n -0000111314 00000 n -0000111474 00000 n -0000111633 00000 n -0000111787 00000 n -0000111941 00000 n -0000112095 00000 n -0000112250 00000 n -0000112405 00000 n -0000112560 00000 n -0000112715 00000 n -0000112870 00000 n -0000113024 00000 n -0000113178 00000 n -0000113333 00000 n -0000113488 00000 n -0000113643 00000 n -0000113797 00000 n -0000113952 00000 n -0000114107 00000 n -0000114262 00000 n -0000114422 00000 n -0000114582 00000 n -0000114737 00000 n -0000114891 00000 n -0000115041 00000 n -0000115195 00000 n -0000115349 00000 n -0000115501 00000 n -0000115653 00000 n -0000125988 00000 n -0000118134 00000 n -0000115971 00000 n -0000125925 00000 n -0000118683 00000 n -0000118837 00000 n -0000118992 00000 n -0000119147 00000 n -0000119302 00000 n -0000119457 00000 n -0000119612 00000 n -0000119766 00000 n -0000119921 00000 n -0000120076 00000 n -0000120230 00000 n -0000120385 00000 n -0000120540 00000 n -0000120695 00000 n -0000120845 00000 n -0000120999 00000 n -0000121154 00000 n -0000121314 00000 n -0000121474 00000 n -0000121639 00000 n -0000121804 00000 n -0000121959 00000 n -0000122114 00000 n -0000122268 00000 n +0001933950 00000 n +0002200670 00000 n +0000072288 00000 n +0000072336 00000 n +0001937777 00000 n +0002200530 00000 n +0000072385 00000 n +0000072445 00000 n +0001937903 00000 n +0002200446 00000 n +0000072496 00000 n +0000072539 00000 n +0001938029 00000 n +0002200347 00000 n +0000072590 00000 n +0000072685 00000 n +0001943371 00000 n +0002200248 00000 n +0000072736 00000 n +0000072773 00000 n +0001943497 00000 n +0002200149 00000 n +0000072824 00000 n +0000072885 00000 n +0001946951 00000 n +0002200065 00000 n +0000072936 00000 n +0000072994 00000 n +0001950944 00000 n +0002199940 00000 n +0000073043 00000 n +0000073081 00000 n +0001951070 00000 n +0002199856 00000 n +0000073132 00000 n +0000073170 00000 n +0001951196 00000 n +0002199757 00000 n +0000073221 00000 n +0000073259 00000 n +0001951322 00000 n +0002199658 00000 n +0000073310 00000 n +0000073348 00000 n +0001955198 00000 n +0002199559 00000 n +0000073399 00000 n +0000073440 00000 n +0001955323 00000 n +0002199460 00000 n +0000073491 00000 n +0000073547 00000 n +0001955449 00000 n +0002199376 00000 n +0000073598 00000 n +0000073631 00000 n +0001956193 00000 n +0002199251 00000 n +0000073676 00000 n +0000073710 00000 n +0001960819 00000 n +0002199126 00000 n +0000073759 00000 n +0000073803 00000 n +0001960945 00000 n +0002199001 00000 n +0000073854 00000 n +0000073912 00000 n +0001961071 00000 n +0002198917 00000 n +0000073968 00000 n +0000074008 00000 n +0001961197 00000 n +0002198792 00000 n +0000074064 00000 n +0000074115 00000 n +0001961323 00000 n +0002198708 00000 n +0000074176 00000 n +0000074223 00000 n +0001961449 00000 n +0002198624 00000 n +0000074284 00000 n +0000074328 00000 n +0001966144 00000 n +0002198525 00000 n +0000074379 00000 n +0000074450 00000 n +0001966270 00000 n +0002198426 00000 n +0000074501 00000 n +0000074558 00000 n +0001966396 00000 n +0002198286 00000 n +0000074609 00000 n +0000074656 00000 n +0001969220 00000 n +0002198176 00000 n +0000074712 00000 n +0000074785 00000 n +0001969346 00000 n +0002198092 00000 n +0000074846 00000 n +0000074919 00000 n +0001969472 00000 n +0002198008 00000 n +0000074980 00000 n +0000075053 00000 n +0001972552 00000 n +0002197868 00000 n +0000075104 00000 n +0000075156 00000 n +0001972678 00000 n +0002197784 00000 n +0000075212 00000 n +0000075264 00000 n +0001975295 00000 n +0002197700 00000 n +0000075320 00000 n +0000075384 00000 n +0001975420 00000 n +0002197616 00000 n +0000075435 00000 n +0000075474 00000 n +0001979080 00000 n +0002197476 00000 n +0000075523 00000 n +0000075558 00000 n +0001979206 00000 n +0002197392 00000 n +0000075609 00000 n +0000075639 00000 n +0001979332 00000 n +0002197293 00000 n +0000075690 00000 n +0000075724 00000 n +0001979458 00000 n +0002197194 00000 n +0000075775 00000 n +0000075805 00000 n +0001981111 00000 n +0002197095 00000 n +0000075856 00000 n +0000075907 00000 n +0001983696 00000 n +0002196955 00000 n +0000075958 00000 n +0000075987 00000 n +0001983822 00000 n +0002196886 00000 n +0000076043 00000 n +0000076092 00000 n +0001983948 00000 n +0002196761 00000 n +0000076143 00000 n +0000076176 00000 n +0001984073 00000 n +0002196677 00000 n +0000076232 00000 n +0000076280 00000 n +0001984199 00000 n +0002196593 00000 n +0000076336 00000 n +0000076384 00000 n +0001989046 00000 n +0002196453 00000 n +0000076433 00000 n +0000076485 00000 n +0001989172 00000 n +0002196369 00000 n +0000076536 00000 n +0000076580 00000 n +0001989298 00000 n +0002196229 00000 n +0000076631 00000 n +0000076667 00000 n +0001989424 00000 n +0002196145 00000 n +0000076723 00000 n +0000076826 00000 n +0001993992 00000 n +0002196046 00000 n +0000076882 00000 n +0000076990 00000 n +0001994118 00000 n +0002195962 00000 n +0000077046 00000 n +0000077136 00000 n +0001994244 00000 n +0002195822 00000 n +0000077187 00000 n +0000077235 00000 n +0001994370 00000 n +0002195738 00000 n +0000077291 00000 n +0000077357 00000 n +0001994496 00000 n +0002195639 00000 n +0000077413 00000 n +0000077480 00000 n +0001998545 00000 n +0002195540 00000 n +0000077536 00000 n +0000077595 00000 n +0001998671 00000 n +0002195441 00000 n +0000077651 00000 n +0000077705 00000 n +0001998797 00000 n +0002195342 00000 n +0000077761 00000 n +0000077819 00000 n +0001998922 00000 n +0002195258 00000 n +0000077875 00000 n +0000077920 00000 n +0001999048 00000 n +0002195118 00000 n +0000077971 00000 n +0000078012 00000 n +0002002854 00000 n +0002195049 00000 n +0000078068 00000 n +0000078113 00000 n +0002002980 00000 n +0002194950 00000 n +0000078164 00000 n +0000078217 00000 n +0002003105 00000 n +0002194866 00000 n +0000078268 00000 n +0000078308 00000 n +0002006605 00000 n +0002194725 00000 n +0000078357 00000 n +0000078405 00000 n +0002006731 00000 n +0002194641 00000 n +0000078456 00000 n +0000078493 00000 n +0002006857 00000 n +0002194542 00000 n +0000078544 00000 n +0000078584 00000 n +0002006983 00000 n +0002194443 00000 n +0000078635 00000 n +0000078670 00000 n +0002010270 00000 n +0002194344 00000 n +0000078721 00000 n +0000078755 00000 n +0002010396 00000 n +0002194245 00000 n +0000078806 00000 n +0000078841 00000 n +0002010521 00000 n +0002194146 00000 n +0000078892 00000 n +0000078926 00000 n +0002010647 00000 n +0002194047 00000 n +0000078977 00000 n +0000079012 00000 n +0002010773 00000 n +0002193948 00000 n +0000079063 00000 n +0000079100 00000 n +0002014107 00000 n +0002193849 00000 n +0000079151 00000 n +0000079190 00000 n +0002014233 00000 n +0002193750 00000 n +0000079242 00000 n +0000079314 00000 n +0002014359 00000 n +0002193666 00000 n +0000079366 00000 n +0000079410 00000 n +0002015279 00000 n +0002193526 00000 n +0000079459 00000 n +0000079515 00000 n +0002015405 00000 n +0002193457 00000 n +0000079566 00000 n +0000079596 00000 n +0002024181 00000 n +0002193332 00000 n +0000079645 00000 n +0000079686 00000 n +0002024307 00000 n +0002193248 00000 n +0000079737 00000 n +0000079771 00000 n +0002024433 00000 n +0002193149 00000 n +0000079822 00000 n +0000079878 00000 n +0002024559 00000 n +0002193065 00000 n +0000079929 00000 n +0000079960 00000 n +0000080328 00000 n +0000080577 00000 n +0000080014 00000 n +0000080451 00000 n +0000080514 00000 n +0002182264 00000 n +0002167812 00000 n +0002182096 00000 n +0002167396 00000 n +0002164064 00000 n +0002167231 00000 n +0002183212 00000 n +0000083111 00000 n +0000082197 00000 n +0000080665 00000 n +0000083048 00000 n +0002163019 00000 n +0002144204 00000 n +0002162854 00000 n +0000082368 00000 n +0002143182 00000 n +0002126389 00000 n +0002143016 00000 n +0000082537 00000 n +0000082709 00000 n +0000082877 00000 n +0000096161 00000 n +0000087241 00000 n +0000083199 00000 n +0000096098 00000 n +0002124428 00000 n +0002108588 00000 n +0002124262 00000 n +0000087826 00000 n +0000088010 00000 n +0002108129 00000 n +0002106186 00000 n +0002107963 00000 n +0002104284 00000 n +0002102269 00000 n +0002104119 00000 n +0000088160 00000 n +0000088332 00000 n +0000088482 00000 n +0000088650 00000 n +0000088821 00000 n +0000088990 00000 n +0000089143 00000 n +0000089312 00000 n +0000089464 00000 n +0000089632 00000 n +0000089804 00000 n +0000089973 00000 n +0000090126 00000 n +0000090295 00000 n +0000090466 00000 n +0000090639 00000 n +0000090792 00000 n +0000090960 00000 n +0000091139 00000 n +0000091296 00000 n +0000091465 00000 n +0000091633 00000 n +0000091804 00000 n +0000091971 00000 n +0000092143 00000 n +0000092303 00000 n +0000092472 00000 n +0000092628 00000 n +0000092797 00000 n +0000092956 00000 n +0000093125 00000 n +0000093275 00000 n +0000093447 00000 n +0000093618 00000 n +0000093787 00000 n +0000093955 00000 n +0000094126 00000 n +0000094282 00000 n +0000094452 00000 n +0000094621 00000 n +0000094779 00000 n +0000094948 00000 n +0000095117 00000 n +0000095267 00000 n +0000095436 00000 n +0000095606 00000 n +0000095773 00000 n +0000095944 00000 n +0000298419 00000 n +0000314651 00000 n +0000324957 00000 n +0000329432 00000 n +0000362214 00000 n +0000409653 00000 n +0000432063 00000 n +0000473652 00000 n +0000480833 00000 n +0000485166 00000 n +0000556468 00000 n +0000626579 00000 n +0000639340 00000 n +0000697287 00000 n +0000744318 00000 n +0000109751 00000 n +0000100544 00000 n +0000096305 00000 n +0000109688 00000 n +0000101147 00000 n +0000101315 00000 n +0000101484 00000 n +0000101645 00000 n +0000101814 00000 n +0000101985 00000 n +0000102134 00000 n +0000102305 00000 n +0000102457 00000 n +0000102630 00000 n +0000102800 00000 n +0000102956 00000 n +0000103129 00000 n +0000103302 00000 n +0000103448 00000 n +0000103620 00000 n +0000103789 00000 n +0000103938 00000 n +0000104113 00000 n +0000104281 00000 n +0000104456 00000 n +0000104628 00000 n +0000104797 00000 n +0000104966 00000 n +0000105135 00000 n +0000105289 00000 n +0000105458 00000 n +0000105612 00000 n +0000105781 00000 n +0000105927 00000 n +0000106096 00000 n +0000106273 00000 n +0000106437 00000 n +0000106605 00000 n +0000106755 00000 n +0000106927 00000 n +0000107100 00000 n +0000107248 00000 n +0000107417 00000 n +0000107568 00000 n +0000107737 00000 n +0000107897 00000 n +0000108069 00000 n +0000108224 00000 n +0000108392 00000 n +0000108540 00000 n +0000108709 00000 n +0000108862 00000 n +0000109030 00000 n +0000109200 00000 n +0000109350 00000 n +0000109519 00000 n +0000759327 00000 n +0000774246 00000 n +0000780125 00000 n +0000941364 00000 n +0001626871 00000 n +0001638719 00000 n +0001685107 00000 n +0001701808 00000 n +0001726966 00000 n +0001790638 00000 n +0001834429 00000 n +0001863940 00000 n +0001869245 00000 n +0001870388 00000 n +0001873550 00000 n +0001877198 00000 n +0001899314 00000 n +0001915818 00000 n +0001937840 00000 n +0000115193 00000 n +0000111685 00000 n +0000109867 00000 n +0000115130 00000 n +0000111991 00000 n +0000112164 00000 n +0000112317 00000 n +0000112489 00000 n +0000112642 00000 n +0000112814 00000 n +0000112969 00000 n +0000113141 00000 n +0000113298 00000 n +0000113467 00000 n +0000113639 00000 n +0000113788 00000 n +0000113965 00000 n +0000114137 00000 n +0000114306 00000 n +0000114456 00000 n +0000114625 00000 n +0000114786 00000 n +0000114958 00000 n +0001951007 00000 n +0001960882 00000 n +0001979143 00000 n +0001989109 00000 n +0002006668 00000 n +0002015342 00000 n +0002024244 00000 n +0000123985 00000 n +0000118106 00000 n +0000115309 00000 n +0000123859 00000 n +0000123922 00000 n +0000118547 00000 n +0000118697 00000 n +0000118850 00000 n +0000119005 00000 n +0000119159 00000 n +0000119314 00000 n +0000119469 00000 n +0000119623 00000 n +0000119777 00000 n +0000119929 00000 n +0000120084 00000 n +0000120239 00000 n +0000120399 00000 n +0000120564 00000 n +0000120724 00000 n +0000120878 00000 n +0000121033 00000 n +0000121188 00000 n +0000121342 00000 n +0000121497 00000 n +0000121657 00000 n +0000121817 00000 n +0000121970 00000 n +0000122125 00000 n +0000122275 00000 n 0000122428 00000 n -0000122593 00000 n -0000122757 00000 n -0000122911 00000 n -0000123071 00000 n -0000123231 00000 n -0000123385 00000 n -0000123540 00000 n -0000123700 00000 n -0000123865 00000 n -0000124029 00000 n -0000124194 00000 n -0000124359 00000 n -0000124524 00000 n -0000124683 00000 n -0000124838 00000 n -0000124998 00000 n -0000125158 00000 n -0000125312 00000 n -0000125467 00000 n -0000125620 00000 n -0000125773 00000 n -0000135862 00000 n -0000128178 00000 n -0000126090 00000 n -0000135799 00000 n -0000128718 00000 n -0000128873 00000 n -0000129033 00000 n -0000129188 00000 n -0000129348 00000 n -0000129508 00000 n -0000129662 00000 n -0000129817 00000 n -0000129971 00000 n -0000130131 00000 n -0000130291 00000 n -0000130451 00000 n -0000130611 00000 n -0000130766 00000 n -0000130926 00000 n -0000131086 00000 n -0000131246 00000 n -0000131405 00000 n -0000131565 00000 n -0000131725 00000 n -0000131879 00000 n -0000132038 00000 n -0000132193 00000 n -0000132348 00000 n -0000132502 00000 n -0000132657 00000 n -0000132817 00000 n -0000132977 00000 n -0000133136 00000 n -0000133295 00000 n -0000133455 00000 n -0000133615 00000 n -0000133774 00000 n -0000133934 00000 n -0000134094 00000 n -0000134255 00000 n -0000134409 00000 n -0000134564 00000 n -0000134719 00000 n -0000134874 00000 n -0000135028 00000 n -0000135183 00000 n -0000135338 00000 n -0000135492 00000 n -0000135646 00000 n -0000136517 00000 n -0000136271 00000 n -0000135964 00000 n -0000136394 00000 n -0001010147 00000 n -0000140649 00000 n -0000140030 00000 n -0000136605 00000 n -0000140153 00000 n -0000140216 00000 n -0000140340 00000 n -0000924091 00000 n -0000906588 00000 n -0000923925 00000 n -0000140464 00000 n -0000140587 00000 n -0000905160 00000 n -0000903069 00000 n -0000904994 00000 n -0000144592 00000 n -0000144282 00000 n -0000140765 00000 n -0000144405 00000 n -0000144529 00000 n -0000148987 00000 n -0000148148 00000 n -0000144708 00000 n -0000148677 00000 n -0000148801 00000 n -0000148925 00000 n -0000148301 00000 n -0000148486 00000 n -0000154858 00000 n -0000152423 00000 n -0000149117 00000 n -0000154548 00000 n -0000152648 00000 n -0000152818 00000 n -0000153017 00000 n -0000153212 00000 n -0000153401 00000 n -0000153594 00000 n -0000153789 00000 n -0000153974 00000 n -0000154166 00000 n -0000154672 00000 n -0000154361 00000 n -0000154796 00000 n -0000158774 00000 n -0000157454 00000 n -0000154988 00000 n -0000158093 00000 n -0000158217 00000 n -0000158341 00000 n -0000157616 00000 n -0000157782 00000 n -0000158464 00000 n -0000158588 00000 n -0000157935 00000 n -0000158711 00000 n -0000770401 00000 n -0000690139 00000 n -0000163003 00000 n -0000161866 00000 n -0000158890 00000 n -0000162322 00000 n -0000162446 00000 n -0000162569 00000 n -0000162693 00000 n -0000162817 00000 n -0000901167 00000 n -0000899153 00000 n -0000901002 00000 n -0000162940 00000 n -0000162019 00000 n -0000162171 00000 n -0001010272 00000 n -0000725271 00000 n -0000747347 00000 n -0000163727 00000 n -0000163480 00000 n -0000163161 00000 n -0000163603 00000 n -0000167030 00000 n -0000166410 00000 n -0000163815 00000 n -0000166533 00000 n -0000166596 00000 n -0000166720 00000 n -0000166844 00000 n -0000166968 00000 n -0000170835 00000 n -0000170402 00000 n -0000167160 00000 n -0000170525 00000 n -0000170649 00000 n -0000170773 00000 n -0000174672 00000 n -0000173862 00000 n -0000170951 00000 n -0000173985 00000 n -0000174110 00000 n -0000174235 00000 n -0000174360 00000 n -0000174423 00000 n -0000174486 00000 n -0000174609 00000 n -0000178269 00000 n -0000180112 00000 n -0000178146 00000 n -0000174774 00000 n -0000179799 00000 n -0000179924 00000 n -0000898554 00000 n -0000890154 00000 n -0000898387 00000 n -0000888713 00000 n -0000885289 00000 n -0000888546 00000 n -0000884330 00000 n -0000872635 00000 n -0000884164 00000 n -0000180049 00000 n -0000179628 00000 n -0000179686 00000 n -0000179776 00000 n -0000183718 00000 n -0000183407 00000 n -0000180327 00000 n -0000183530 00000 n -0000183655 00000 n -0001010397 00000 n -0000187660 00000 n -0000186930 00000 n -0000183862 00000 n -0000187224 00000 n -0000187348 00000 n -0000187473 00000 n -0000187074 00000 n -0000187598 00000 n -0000495602 00000 n -0000190294 00000 n -0000189733 00000 n -0000187818 00000 n -0000189856 00000 n -0000189981 00000 n -0000190106 00000 n -0000190231 00000 n -0000193030 00000 n -0000192530 00000 n -0000190467 00000 n -0000192653 00000 n -0000192716 00000 n -0000192779 00000 n -0000192842 00000 n -0000192967 00000 n -0000195507 00000 n -0000195151 00000 n -0000193160 00000 n -0000195444 00000 n -0000195295 00000 n -0000310760 00000 n -0000199343 00000 n -0000198862 00000 n -0000195680 00000 n -0000199155 00000 n -0000199280 00000 n -0000199006 00000 n -0000203431 00000 n -0000202932 00000 n -0000199487 00000 n -0000203243 00000 n -0000203368 00000 n -0000203076 00000 n -0001010522 00000 n -0000206961 00000 n -0000208270 00000 n -0000206817 00000 n -0000203632 00000 n -0000207957 00000 n -0000208082 00000 n -0000207774 00000 n -0000208207 00000 n -0000212502 00000 n -0000211639 00000 n -0000208471 00000 n -0000211940 00000 n -0000211783 00000 n -0000212065 00000 n -0000212190 00000 n -0000212315 00000 n -0000212439 00000 n -0000245941 00000 n -0000216925 00000 n -0000216368 00000 n -0000212674 00000 n -0000216491 00000 n -0000216616 00000 n -0000216739 00000 n -0000216862 00000 n -0000220117 00000 n -0000219366 00000 n -0000217041 00000 n -0000219489 00000 n -0000219552 00000 n -0000219615 00000 n -0000219678 00000 n -0000219741 00000 n -0000219804 00000 n -0000219867 00000 n -0000219930 00000 n -0000220054 00000 n -0000222836 00000 n -0000222650 00000 n -0000220247 00000 n -0000222773 00000 n -0000226445 00000 n -0000225567 00000 n -0000222995 00000 n -0000225885 00000 n -0000226010 00000 n -0000226135 00000 n -0000225711 00000 n -0000226260 00000 n -0000226383 00000 n -0001010647 00000 n -0000230556 00000 n -0000229871 00000 n -0000226547 00000 n -0000229994 00000 n -0000230119 00000 n -0000230244 00000 n -0000230368 00000 n -0000230493 00000 n -0000233669 00000 n -0000233233 00000 n -0000230672 00000 n -0000233356 00000 n -0000233481 00000 n -0000233606 00000 n -0000236054 00000 n -0000235494 00000 n -0000233799 00000 n -0000235617 00000 n -0000235742 00000 n -0000235867 00000 n -0000235992 00000 n -0000240181 00000 n -0000238923 00000 n -0000236227 00000 n -0000239743 00000 n -0000239094 00000 n -0000239254 00000 n -0000239416 00000 n -0000239586 00000 n -0000239868 00000 n -0000239993 00000 n -0000240118 00000 n -0000241907 00000 n -0000242095 00000 n -0000241659 00000 n -0000240354 00000 n -0000241782 00000 n -0000242032 00000 n -0000246128 00000 n -0000244750 00000 n -0000242211 00000 n -0000245816 00000 n -0000246066 00000 n -0000244930 00000 n -0000245108 00000 n -0000245286 00000 n -0000245472 00000 n -0000245654 00000 n -0001010772 00000 n -0000250710 00000 n -0000249608 00000 n -0000246258 00000 n -0000250522 00000 n -0000250647 00000 n -0000249779 00000 n -0000249969 00000 n -0000250135 00000 n -0000250309 00000 n -0000251473 00000 n -0000251226 00000 n -0000250911 00000 n -0000251349 00000 n -0000254350 00000 n -0000253851 00000 n -0000251561 00000 n -0000253974 00000 n -0000254037 00000 n -0000254162 00000 n -0000254287 00000 n -0000257531 00000 n -0000257220 00000 n -0000254509 00000 n -0000257343 00000 n -0000257468 00000 n -0000261892 00000 n -0000261581 00000 n -0000257661 00000 n -0000261704 00000 n -0000261829 00000 n -0000265096 00000 n -0000264785 00000 n -0000262022 00000 n -0000264908 00000 n -0000265033 00000 n -0001010897 00000 n -0000268529 00000 n -0000267738 00000 n -0000265226 00000 n -0000268217 00000 n -0000268341 00000 n -0000267891 00000 n -0000268054 00000 n -0000268466 00000 n -0000272855 00000 n -0000272357 00000 n -0000268673 00000 n -0000272480 00000 n -0000272604 00000 n -0000272667 00000 n -0000272730 00000 n -0000272793 00000 n -0000276556 00000 n -0000275808 00000 n -0000272985 00000 n -0000275931 00000 n -0000275994 00000 n -0000276118 00000 n -0000276243 00000 n -0000276368 00000 n -0000276493 00000 n -0000280418 00000 n -0000281421 00000 n -0000280295 00000 n -0000276686 00000 n -0000281233 00000 n -0000281358 00000 n -0000285520 00000 n -0000285084 00000 n -0000281608 00000 n -0000285207 00000 n -0000285332 00000 n -0000871442 00000 n -0000869441 00000 n -0000871276 00000 n -0000285457 00000 n -0000289511 00000 n -0000288826 00000 n -0000285678 00000 n -0000288949 00000 n -0000289074 00000 n -0000289199 00000 n -0000289323 00000 n -0000289448 00000 n -0001011022 00000 n -0000292553 00000 n -0000292243 00000 n -0000289698 00000 n -0000292366 00000 n -0000292491 00000 n -0000296884 00000 n -0000296448 00000 n -0000292683 00000 n -0000296571 00000 n -0000296696 00000 n -0000296821 00000 n -0000300521 00000 n -0000300085 00000 n -0000297099 00000 n -0000300208 00000 n -0000300333 00000 n -0000300458 00000 n -0000303934 00000 n -0000303748 00000 n -0000300637 00000 n -0000303871 00000 n -0000305975 00000 n -0000305789 00000 n -0000304050 00000 n -0000305912 00000 n -0000307748 00000 n -0000307373 00000 n -0000306077 00000 n -0000307496 00000 n -0000307559 00000 n -0000307622 00000 n -0000307685 00000 n -0001011147 00000 n -0000311073 00000 n -0000310512 00000 n -0000307850 00000 n -0000310635 00000 n -0000310885 00000 n -0000311010 00000 n -0000313480 00000 n -0000313294 00000 n -0000311175 00000 n -0000313417 00000 n -0000317448 00000 n -0000316887 00000 n -0000313653 00000 n -0000317010 00000 n -0000317135 00000 n -0000317260 00000 n -0000317385 00000 n -0000322844 00000 n -0000320888 00000 n -0000317606 00000 n -0000322157 00000 n -0000322282 00000 n -0000322407 00000 n -0000322532 00000 n -0000322657 00000 n -0000321077 00000 n -0000321248 00000 n -0000321433 00000 n -0000321600 00000 n -0000321801 00000 n -0000322781 00000 n -0000321973 00000 n -0000327947 00000 n -0000326411 00000 n -0000322988 00000 n -0000327634 00000 n -0000326600 00000 n -0000326769 00000 n -0000327759 00000 n -0000326938 00000 n -0000327117 00000 n -0000327296 00000 n -0000327884 00000 n -0000327467 00000 n -0000330666 00000 n -0000330232 00000 n -0000328077 00000 n -0000330355 00000 n -0000330478 00000 n -0000330603 00000 n -0001011272 00000 n -0000334665 00000 n -0000332457 00000 n -0000330782 00000 n -0000334477 00000 n -0000334602 00000 n -0000332682 00000 n -0000332865 00000 n -0000333041 00000 n -0000333222 00000 n -0000333402 00000 n -0000333582 00000 n -0000333759 00000 n -0000333945 00000 n -0000334128 00000 n -0000334309 00000 n -0000338167 00000 n -0000337561 00000 n -0000334795 00000 n -0000337854 00000 n -0000337979 00000 n -0000338104 00000 n -0000337705 00000 n -0000341259 00000 n -0000340948 00000 n -0000338325 00000 n -0000341071 00000 n -0000341196 00000 n -0000344660 00000 n -0000344154 00000 n -0000341389 00000 n -0000344472 00000 n -0000344298 00000 n -0000868209 00000 n -0000866336 00000 n -0000868041 00000 n -0000344597 00000 n -0000347439 00000 n -0000346879 00000 n -0000344818 00000 n -0000347002 00000 n -0000347126 00000 n -0000347251 00000 n -0000347376 00000 n -0000349365 00000 n -0000349179 00000 n -0000347583 00000 n -0000349302 00000 n -0001011397 00000 n -0000352039 00000 n -0000351478 00000 n -0000349524 00000 n -0000351601 00000 n -0000351726 00000 n -0000351851 00000 n -0000351976 00000 n -0000355709 00000 n -0000355023 00000 n -0000352169 00000 n -0000355146 00000 n -0000355271 00000 n -0000355396 00000 n -0000355521 00000 n -0000355646 00000 n -0000360449 00000 n -0000359891 00000 n -0000355896 00000 n -0000360014 00000 n -0000360138 00000 n -0000360263 00000 n -0000360387 00000 n -0000364480 00000 n -0000364044 00000 n -0000360607 00000 n -0000364167 00000 n -0000364292 00000 n -0000364417 00000 n -0000369263 00000 n -0000368170 00000 n -0000364610 00000 n -0000369075 00000 n -0000368341 00000 n -0000368523 00000 n -0000368703 00000 n -0000368890 00000 n -0000369200 00000 n -0000370153 00000 n -0000369967 00000 n -0000369407 00000 n -0000370090 00000 n -0001011522 00000 n -0000373674 00000 n -0000373174 00000 n -0000370255 00000 n -0000373297 00000 n -0000373422 00000 n -0000373485 00000 n -0000373548 00000 n -0000373611 00000 n -0000374950 00000 n -0000374764 00000 n -0000373790 00000 n -0000374887 00000 n -0000379074 00000 n -0000377909 00000 n -0000375066 00000 n -0000378636 00000 n -0000378761 00000 n -0000378886 00000 n -0000378071 00000 n -0000378251 00000 n -0000378426 00000 n -0000379011 00000 n -0000383435 00000 n -0000382185 00000 n -0000379275 00000 n -0000383248 00000 n -0000383373 00000 n -0000382365 00000 n -0000382542 00000 n -0000382711 00000 n -0000382888 00000 n -0000383068 00000 n -0000387201 00000 n -0000386687 00000 n -0000383622 00000 n -0000387013 00000 n -0000386831 00000 n -0000387138 00000 n -0000390255 00000 n -0000389753 00000 n -0000387402 00000 n -0000390067 00000 n -0000390192 00000 n -0000389897 00000 n -0001011647 00000 n -0000394049 00000 n -0000392939 00000 n -0000390399 00000 n -0000393861 00000 n -0000393986 00000 n -0000393110 00000 n -0000393298 00000 n -0000393485 00000 n -0000393675 00000 n -0000397540 00000 n -0000396584 00000 n -0000394193 00000 n -0000397102 00000 n -0000397227 00000 n -0000396737 00000 n -0000397352 00000 n -0000396923 00000 n -0000397477 00000 n -0000401252 00000 n -0000400691 00000 n -0000397670 00000 n -0000400814 00000 n -0000400939 00000 n -0000401064 00000 n -0000401189 00000 n -0000404213 00000 n -0000403777 00000 n -0000401410 00000 n -0000403900 00000 n -0000404025 00000 n -0000404150 00000 n -0000406974 00000 n -0000406663 00000 n -0000404329 00000 n -0000406786 00000 n -0000406911 00000 n -0000410374 00000 n -0000409437 00000 n -0000407104 00000 n -0000409560 00000 n -0000409685 00000 n -0000409810 00000 n -0000409873 00000 n -0000409936 00000 n -0000409999 00000 n -0000410062 00000 n -0000410125 00000 n -0000410188 00000 n -0000410250 00000 n -0000410312 00000 n -0001011772 00000 n -0000413658 00000 n -0000413222 00000 n -0000410504 00000 n -0000413345 00000 n -0000413470 00000 n -0000413595 00000 n -0000415918 00000 n -0000415357 00000 n -0000413774 00000 n -0000415480 00000 n -0000415605 00000 n -0000415730 00000 n -0000415855 00000 n -0000419815 00000 n -0000419065 00000 n -0000416034 00000 n -0000419378 00000 n -0000419503 00000 n -0000419628 00000 n -0000419209 00000 n -0000419752 00000 n -0000423257 00000 n -0000422946 00000 n -0000419931 00000 n -0000423069 00000 n -0000423194 00000 n -0000426455 00000 n -0000426269 00000 n -0000423486 00000 n -0000426392 00000 n -0000429412 00000 n -0000429226 00000 n -0000426656 00000 n -0000429349 00000 n -0001011897 00000 n -0000433799 00000 n -0000433488 00000 n -0000429571 00000 n -0000433611 00000 n -0000433736 00000 n -0000436889 00000 n -0000436453 00000 n -0000433957 00000 n -0000436576 00000 n -0000436701 00000 n -0000436826 00000 n -0000441570 00000 n -0000440085 00000 n -0000437033 00000 n -0000441382 00000 n -0000441507 00000 n -0000440274 00000 n -0000440455 00000 n -0000440638 00000 n -0000440812 00000 n -0000441023 00000 n -0000441204 00000 n -0000444699 00000 n -0000444388 00000 n -0000441714 00000 n -0000444511 00000 n -0000444636 00000 n -0000446306 00000 n -0000446120 00000 n -0000444829 00000 n -0000446243 00000 n -0000449069 00000 n -0000448758 00000 n -0000446408 00000 n -0000448881 00000 n -0000449006 00000 n -0001012022 00000 n -0000450303 00000 n -0000450117 00000 n -0000449213 00000 n -0000450240 00000 n -0000451802 00000 n -0000451616 00000 n -0000450405 00000 n -0000451739 00000 n -0000452865 00000 n -0000452679 00000 n -0000451904 00000 n -0000452802 00000 n -0000454108 00000 n -0000453922 00000 n -0000452967 00000 n -0000454045 00000 n -0000455454 00000 n -0000455268 00000 n -0000454210 00000 n -0000455391 00000 n -0000456696 00000 n -0000456510 00000 n -0000455556 00000 n -0000456633 00000 n -0001012147 00000 n -0000460686 00000 n -0000459604 00000 n -0000456798 00000 n -0000460373 00000 n -0000460498 00000 n -0000460623 00000 n -0000459766 00000 n -0000459960 00000 n -0000460167 00000 n -0000465180 00000 n -0000463846 00000 n -0000460830 00000 n -0000465117 00000 n -0000464026 00000 n -0000464214 00000 n -0000464463 00000 n -0000464712 00000 n -0000464903 00000 n -0000469180 00000 n -0000468476 00000 n -0000465339 00000 n -0000468993 00000 n -0000468629 00000 n -0000468811 00000 n -0000469118 00000 n -0000472406 00000 n -0000472220 00000 n -0000469367 00000 n -0000472343 00000 n -0000475763 00000 n -0000475374 00000 n -0000472508 00000 n -0000475700 00000 n -0000475518 00000 n -0000478643 00000 n -0000479519 00000 n -0000478520 00000 n -0000475865 00000 n -0000479456 00000 n -0001012272 00000 n -0000482824 00000 n -0000482638 00000 n -0000479692 00000 n -0000482761 00000 n -0000486541 00000 n -0000486230 00000 n -0000482983 00000 n -0000486353 00000 n -0000486478 00000 n -0000490228 00000 n -0000489917 00000 n -0000486643 00000 n -0000490040 00000 n -0000490165 00000 n -0000492561 00000 n -0000492375 00000 n -0000490415 00000 n -0000492498 00000 n -0000496040 00000 n -0000495354 00000 n -0000492734 00000 n -0000495477 00000 n -0000495727 00000 n -0000495852 00000 n -0000495977 00000 n -0000500342 00000 n -0000499781 00000 n -0000496156 00000 n -0000499904 00000 n -0000500029 00000 n -0000500154 00000 n -0000500279 00000 n -0001012397 00000 n -0000504778 00000 n -0000504218 00000 n -0000500472 00000 n -0000504341 00000 n -0000504466 00000 n -0000504591 00000 n -0000504715 00000 n -0000509387 00000 n -0000508502 00000 n -0000504908 00000 n -0000508825 00000 n -0000508950 00000 n -0000509075 00000 n -0000509200 00000 n -0000508646 00000 n -0000509325 00000 n -0000513866 00000 n -0000513244 00000 n -0000509503 00000 n -0000513553 00000 n -0000513678 00000 n -0000864265 00000 n -0000861109 00000 n -0000864098 00000 n -0000513388 00000 n -0000513803 00000 n -0000517287 00000 n -0000516726 00000 n -0000514038 00000 n -0000516849 00000 n -0000516974 00000 n -0000517099 00000 n -0000517224 00000 n -0000520500 00000 n -0000519940 00000 n -0000517417 00000 n -0000520063 00000 n -0000520188 00000 n -0000520313 00000 n -0000520438 00000 n -0000522941 00000 n -0000522755 00000 n -0000520630 00000 n -0000522878 00000 n -0001012522 00000 n -0000525136 00000 n -0000524699 00000 n -0000523057 00000 n -0000524822 00000 n +0000122583 00000 n +0000122737 00000 n +0000122891 00000 n +0000123051 00000 n +0000123216 00000 n +0000123375 00000 n +0000123538 00000 n +0000123696 00000 n +0000135403 00000 n +0000127658 00000 n +0000124073 00000 n +0000135340 00000 n +0002101661 00000 n +0002091870 00000 n +0002101495 00000 n +0000128198 00000 n +0000128358 00000 n +0000128523 00000 n +0000128683 00000 n +0000128848 00000 n +0000129003 00000 n +0000129158 00000 n +0000129318 00000 n +0000129478 00000 n +0000129637 00000 n +0000129797 00000 n +0000129949 00000 n +0000130104 00000 n +0000130259 00000 n +0000130419 00000 n +0000130579 00000 n +0000130734 00000 n +0000130889 00000 n +0000131044 00000 n +0000131204 00000 n +0000131368 00000 n +0000131533 00000 n +0000131698 00000 n +0000131857 00000 n +0000132011 00000 n +0000132171 00000 n +0000132331 00000 n +0000132491 00000 n +0000132651 00000 n +0000132810 00000 n +0000132970 00000 n +0000133123 00000 n +0000133278 00000 n +0000133433 00000 n +0000133593 00000 n +0000133758 00000 n +0000133918 00000 n +0000134078 00000 n +0000134238 00000 n +0000134392 00000 n +0000134552 00000 n +0000134707 00000 n +0000134866 00000 n +0000135024 00000 n +0000135182 00000 n +0002183337 00000 n +0000146664 00000 n +0000138783 00000 n +0000135505 00000 n +0000146601 00000 n +0000139332 00000 n +0000139485 00000 n +0000139640 00000 n +0000139795 00000 n +0000139955 00000 n +0000140115 00000 n +0000140275 00000 n +0000140434 00000 n +0000140599 00000 n +0000140764 00000 n +0000140928 00000 n +0000141083 00000 n +0000141243 00000 n +0000141403 00000 n +0000141558 00000 n +0000141718 00000 n +0000141878 00000 n +0000142038 00000 n +0000142203 00000 n +0000142362 00000 n +0000142522 00000 n +0000142682 00000 n +0000142837 00000 n +0000142996 00000 n +0000143156 00000 n +0000143309 00000 n +0000143464 00000 n +0000143619 00000 n +0000143774 00000 n +0000143934 00000 n +0000144093 00000 n +0000144247 00000 n +0000144400 00000 n +0000144554 00000 n +0000144704 00000 n +0000144858 00000 n +0000145014 00000 n +0000145169 00000 n +0000145325 00000 n +0000145486 00000 n +0000145647 00000 n +0000145808 00000 n +0000145964 00000 n +0000146125 00000 n +0000146284 00000 n +0000146443 00000 n +0000158665 00000 n +0000150302 00000 n +0000146766 00000 n +0000158602 00000 n +0000150869 00000 n +0000151030 00000 n +0000151191 00000 n +0000151352 00000 n +0000151513 00000 n +0000151669 00000 n +0000151830 00000 n +0000151991 00000 n +0000152152 00000 n +0000152307 00000 n +0000152468 00000 n +0000152629 00000 n +0000152784 00000 n +0000152945 00000 n +0000153106 00000 n +0000153267 00000 n +0000153433 00000 n +0000153589 00000 n +0000153750 00000 n +0000153910 00000 n +0000154064 00000 n +0000154219 00000 n +0000154374 00000 n +0000154535 00000 n +0000154701 00000 n +0000154867 00000 n +0000155028 00000 n +0002090933 00000 n +0002071722 00000 n +0002090767 00000 n +0000155184 00000 n +0000155345 00000 n +0000155506 00000 n +0000155661 00000 n +0000155821 00000 n +0000155982 00000 n +0000156143 00000 n +0000156303 00000 n +0000156469 00000 n +0000156635 00000 n +0000156800 00000 n +0000156965 00000 n +0000157130 00000 n +0000157295 00000 n +0000157460 00000 n +0000157623 00000 n +0000157788 00000 n +0000157954 00000 n +0000158113 00000 n +0000158276 00000 n +0000158439 00000 n +0000170752 00000 n +0000162339 00000 n +0000158781 00000 n +0000170689 00000 n +0000162915 00000 n +0000163080 00000 n +0000163240 00000 n +0000163395 00000 n +0000163555 00000 n +0000163715 00000 n +0000163875 00000 n +0000164029 00000 n +0000164183 00000 n +0000164338 00000 n +0000164498 00000 n +0000164652 00000 n +0000164812 00000 n +0000164972 00000 n +0000165127 00000 n +0000165287 00000 n +0000165447 00000 n +0000165601 00000 n +0000165756 00000 n +0000165910 00000 n +0000166070 00000 n +0000166230 00000 n +0000166388 00000 n +0000166542 00000 n +0000166702 00000 n +0000166862 00000 n +0000167022 00000 n +0000167177 00000 n +0000167337 00000 n +0000167502 00000 n +0000167667 00000 n +0000167821 00000 n +0000167980 00000 n +0000168140 00000 n +0000168300 00000 n +0000168459 00000 n +0000168624 00000 n +0000168789 00000 n +0000168949 00000 n +0000169109 00000 n +0000169269 00000 n +0000169424 00000 n +0000169584 00000 n +0000169743 00000 n +0000169897 00000 n +0000170051 00000 n +0000170205 00000 n +0000170363 00000 n +0000170526 00000 n +0000182099 00000 n +0000174195 00000 n +0000170868 00000 n +0000182036 00000 n +0000174744 00000 n +0000174909 00000 n +0000175074 00000 n +0000175239 00000 n +0000175404 00000 n +0000175569 00000 n +0000175734 00000 n +0000175899 00000 n +0000176054 00000 n +0000176213 00000 n +0000176378 00000 n +0000176543 00000 n +0000176697 00000 n +0000176857 00000 n +0000177017 00000 n +0000177172 00000 n +0000177327 00000 n +0000177487 00000 n +0000177642 00000 n +0000177796 00000 n +0000177950 00000 n +0000178105 00000 n +0000178260 00000 n +0000178419 00000 n +0000178578 00000 n +0000178738 00000 n +0000178898 00000 n +0000179058 00000 n +0000179218 00000 n +0000179373 00000 n +0000179528 00000 n +0000179688 00000 n +0000179847 00000 n +0000180001 00000 n +0000180156 00000 n +0000180310 00000 n +0000180465 00000 n +0000180625 00000 n +0000180785 00000 n +0000180940 00000 n +0000181100 00000 n +0000181260 00000 n +0000181415 00000 n +0000181574 00000 n +0000181728 00000 n +0000181882 00000 n +0000194674 00000 n +0000186216 00000 n +0000182201 00000 n +0000194611 00000 n +0000186792 00000 n +0000186946 00000 n +0000187101 00000 n +0000187256 00000 n +0000187416 00000 n +0000187576 00000 n +0000187736 00000 n +0000187896 00000 n +0000188056 00000 n +0000188210 00000 n +0000188370 00000 n +0000188530 00000 n +0000188684 00000 n +0000188839 00000 n +0000188999 00000 n +0000189159 00000 n +0000189319 00000 n +0000189479 00000 n +0000189639 00000 n +0000189799 00000 n +0000189954 00000 n +0000190113 00000 n +0000190273 00000 n +0000190433 00000 n +0000190593 00000 n +0000190752 00000 n +0000190907 00000 n +0000191067 00000 n +0000191227 00000 n +0000191392 00000 n +0000191557 00000 n +0000191722 00000 n +0000191887 00000 n +0000192051 00000 n +0000192216 00000 n +0000192380 00000 n +0000192545 00000 n +0000192710 00000 n +0000192865 00000 n +0000193025 00000 n +0000193185 00000 n +0000193345 00000 n +0000193505 00000 n +0000193659 00000 n +0000193819 00000 n +0000193979 00000 n +0000194138 00000 n +0000194295 00000 n +0000194453 00000 n +0000206694 00000 n +0000198618 00000 n +0000194790 00000 n +0000206631 00000 n +0000199176 00000 n +0000199336 00000 n +0000199492 00000 n +0000199653 00000 n +0000199814 00000 n +0000199975 00000 n +0000200136 00000 n +0000200292 00000 n +0000200447 00000 n +0000200603 00000 n +0000200759 00000 n +0000200914 00000 n +0000201075 00000 n +0000201236 00000 n +0000201390 00000 n +0000201545 00000 n +0000201705 00000 n +0000201865 00000 n +0000202019 00000 n +0000202179 00000 n +0000202339 00000 n +0000202498 00000 n +0000202652 00000 n +0000202812 00000 n +0000202972 00000 n +0000203132 00000 n +0000203292 00000 n +0000203452 00000 n +0000203606 00000 n +0000203765 00000 n +0000203925 00000 n +0000204085 00000 n +0000204244 00000 n +0000204404 00000 n +0000204564 00000 n +0000204724 00000 n +0000204884 00000 n +0000205039 00000 n +0000205199 00000 n +0000205359 00000 n +0000205519 00000 n +0000205677 00000 n +0000205837 00000 n +0000205997 00000 n +0000206156 00000 n +0000206314 00000 n +0000206472 00000 n +0002183462 00000 n +0000219115 00000 n +0000210805 00000 n +0000206810 00000 n +0000219052 00000 n +0000211372 00000 n +0000211533 00000 n +0000211694 00000 n +0000211855 00000 n +0000212016 00000 n +0000212177 00000 n +0000212338 00000 n +0000212499 00000 n +0000212659 00000 n +0000212820 00000 n +0000212975 00000 n +0000213134 00000 n +0000213294 00000 n +0000213454 00000 n +0000213609 00000 n +0000213769 00000 n +0000213929 00000 n +0000214084 00000 n +0000214244 00000 n +0000214403 00000 n +0000214558 00000 n +0000214718 00000 n +0000214878 00000 n +0000215037 00000 n +0000215197 00000 n +0000215353 00000 n +0000215514 00000 n +0000215675 00000 n +0000215836 00000 n +0000215997 00000 n +0000216158 00000 n +0000216318 00000 n +0000216479 00000 n +0000216639 00000 n +0000216800 00000 n +0000216962 00000 n +0000217124 00000 n +0000217286 00000 n +0000217448 00000 n +0000217610 00000 n +0000217772 00000 n +0000217934 00000 n +0000218089 00000 n +0000218250 00000 n +0000218411 00000 n +0000218571 00000 n +0000218729 00000 n +0000218888 00000 n +0000230412 00000 n +0000222999 00000 n +0000219217 00000 n +0000230349 00000 n +0000223512 00000 n +0000223678 00000 n +0000223844 00000 n +0000224010 00000 n +0000224176 00000 n +0000224341 00000 n +0000224507 00000 n +0000224672 00000 n +0000224838 00000 n +0000225005 00000 n +0000225172 00000 n +0000225338 00000 n +0000225505 00000 n +0000225671 00000 n +0000225838 00000 n +0000225999 00000 n +0000226154 00000 n +0000226315 00000 n +0000226476 00000 n +0000226637 00000 n +0000226798 00000 n +0000226954 00000 n +0000227115 00000 n +0000227281 00000 n +0000227447 00000 n +0000227612 00000 n +0000227778 00000 n +0000227944 00000 n +0000228109 00000 n +0000228275 00000 n +0000228441 00000 n +0000228602 00000 n +0000228758 00000 n +0000228919 00000 n +0000229080 00000 n +0000229241 00000 n +0000229401 00000 n +0000229562 00000 n +0000229723 00000 n +0000229883 00000 n +0000230036 00000 n +0000230190 00000 n +0000242428 00000 n +0000233991 00000 n +0000230514 00000 n +0000242365 00000 n +0000234567 00000 n +0000234728 00000 n +0000234889 00000 n +0000235045 00000 n +0000235201 00000 n +0000235362 00000 n +0000235523 00000 n +0000235684 00000 n +0000235840 00000 n +0000236000 00000 n +0000236161 00000 n +0000236321 00000 n +0000236482 00000 n +0000236636 00000 n +0000236791 00000 n +0000236946 00000 n +0000237101 00000 n +0000237261 00000 n +0000237421 00000 n +0000237580 00000 n +0000237740 00000 n +0000237900 00000 n +0000238054 00000 n +0000238213 00000 n +0000238373 00000 n +0000238528 00000 n +0000238682 00000 n +0000238837 00000 n +0000238992 00000 n +0000239147 00000 n +0000239306 00000 n +0000239460 00000 n +0000239620 00000 n +0000239780 00000 n +0000239939 00000 n +0000240099 00000 n +0000240259 00000 n +0000240419 00000 n +0000240574 00000 n +0000240734 00000 n +0000240894 00000 n +0000241054 00000 n +0000241219 00000 n +0000241384 00000 n +0000241549 00000 n +0000241713 00000 n +0000241876 00000 n +0000242039 00000 n +0000242202 00000 n +0000254036 00000 n +0000245776 00000 n +0000242544 00000 n +0000253973 00000 n +0000246343 00000 n +0000246498 00000 n +0000246653 00000 n +0000246807 00000 n +0000246962 00000 n +0000247117 00000 n +0000247272 00000 n +0000247432 00000 n +0000247586 00000 n +0000247746 00000 n +0000247901 00000 n +0000248055 00000 n +0000248210 00000 n +0000248365 00000 n +0000248525 00000 n +0000248685 00000 n +0000248850 00000 n +0000249010 00000 n +0000249175 00000 n +0000249329 00000 n +0000249489 00000 n +0000249649 00000 n +0000249807 00000 n +0000249961 00000 n +0000250116 00000 n +0000250276 00000 n +0000250430 00000 n +0000250585 00000 n +0000250740 00000 n +0000250900 00000 n +0000251064 00000 n +0000251229 00000 n +0000251394 00000 n +0000251557 00000 n +0000251717 00000 n +0000251882 00000 n +0000252047 00000 n +0000252212 00000 n +0000252372 00000 n +0000252532 00000 n +0000252697 00000 n +0000252861 00000 n +0000253026 00000 n +0000253191 00000 n +0000253345 00000 n +0000253499 00000 n +0000253652 00000 n +0000253810 00000 n +0000265598 00000 n +0000257522 00000 n +0000254138 00000 n +0000265535 00000 n +0000258080 00000 n +0000258240 00000 n +0000258400 00000 n +0000258555 00000 n +0000258715 00000 n +0000258875 00000 n +0000259035 00000 n +0000259189 00000 n +0000259344 00000 n +0000259499 00000 n +0000259658 00000 n +0000259823 00000 n +0000259983 00000 n +0000260148 00000 n +0000260313 00000 n +0000260473 00000 n +0000260633 00000 n +0000260793 00000 n +0000260958 00000 n +0000261122 00000 n +0000261287 00000 n +0000261452 00000 n +0000261606 00000 n +0000261765 00000 n +0000261918 00000 n +0000262073 00000 n +0000262228 00000 n +0000262383 00000 n +0000262543 00000 n +0000262703 00000 n +0000262862 00000 n +0000263021 00000 n +0000263176 00000 n +0000263336 00000 n +0000263495 00000 n +0000263655 00000 n +0000263815 00000 n +0000263975 00000 n +0000264130 00000 n +0000264290 00000 n +0000264450 00000 n +0000264610 00000 n +0000264764 00000 n +0000264919 00000 n +0000265074 00000 n +0000265228 00000 n +0000265382 00000 n +0000275327 00000 n +0000268468 00000 n +0000265700 00000 n +0000275264 00000 n +0000268963 00000 n +0000269117 00000 n +0000269272 00000 n +0000269427 00000 n +0000269581 00000 n +0000269736 00000 n +0000269886 00000 n +0000270040 00000 n +0000270195 00000 n +0000270350 00000 n +0000270505 00000 n +0000270659 00000 n +0000270814 00000 n +0000270974 00000 n +0000271138 00000 n +0000271303 00000 n +0000271468 00000 n +0000271633 00000 n +0000271798 00000 n +0000271958 00000 n +0000272113 00000 n +0000272273 00000 n +0000272433 00000 n +0000272587 00000 n +0000272742 00000 n +0000272901 00000 n +0000273061 00000 n +0000273221 00000 n +0000273381 00000 n +0000273541 00000 n +0000273701 00000 n +0000273861 00000 n +0000274021 00000 n +0000274181 00000 n +0000274341 00000 n +0000274491 00000 n +0000274645 00000 n +0000274800 00000 n +0000274954 00000 n +0000275109 00000 n +0002183587 00000 n +0000286081 00000 n +0000278600 00000 n +0000275429 00000 n +0000286018 00000 n +0000279131 00000 n +0000279285 00000 n +0000279440 00000 n +0000279595 00000 n +0000279750 00000 n +0000279905 00000 n +0000280060 00000 n +0000280214 00000 n +0000280369 00000 n +0000280524 00000 n +0000280678 00000 n +0000280833 00000 n +0000280988 00000 n +0000281143 00000 n +0000281293 00000 n +0000281447 00000 n +0000281602 00000 n +0000281762 00000 n +0000281922 00000 n +0000282087 00000 n +0000282252 00000 n +0000282407 00000 n +0000282562 00000 n +0000282716 00000 n +0000282876 00000 n +0000283041 00000 n +0000283205 00000 n +0000283359 00000 n +0000283519 00000 n +0000283679 00000 n +0000283834 00000 n +0000283988 00000 n +0000284143 00000 n +0000284298 00000 n +0000284452 00000 n +0000284607 00000 n +0000284762 00000 n +0000284922 00000 n +0000285076 00000 n +0000285236 00000 n +0000285396 00000 n +0000285550 00000 n +0000285705 00000 n +0000285860 00000 n +0000293812 00000 n +0000288492 00000 n +0000286183 00000 n +0000293749 00000 n +0000288906 00000 n +0000289066 00000 n +0000289226 00000 n +0000289381 00000 n +0000289541 00000 n +0000289701 00000 n +0000289861 00000 n +0000290021 00000 n +0000290180 00000 n +0000290340 00000 n +0000290495 00000 n +0000290654 00000 n +0000290809 00000 n +0000290964 00000 n +0000291118 00000 n +0000291273 00000 n +0000291428 00000 n +0000291583 00000 n +0000291738 00000 n +0000291892 00000 n +0000292047 00000 n +0000292202 00000 n +0000292356 00000 n +0000292510 00000 n +0000292666 00000 n +0000292822 00000 n +0000292976 00000 n +0000293131 00000 n +0000293285 00000 n +0000293439 00000 n +0000293594 00000 n +0000294482 00000 n +0000294236 00000 n +0000293914 00000 n +0000294359 00000 n +0000298727 00000 n +0000298109 00000 n +0000294570 00000 n +0000298232 00000 n +0000298295 00000 n +0000298541 00000 n +0000298665 00000 n +0000303442 00000 n +0000302943 00000 n +0000298843 00000 n +0000303256 00000 n +0000303087 00000 n +0000303379 00000 n +0000308850 00000 n +0000307610 00000 n +0000303558 00000 n +0000308540 00000 n +0000307781 00000 n +0000307952 00000 n +0000308664 00000 n +0000308124 00000 n +0000308332 00000 n +0000308787 00000 n +0002183712 00000 n +0000311039 00000 n +0000310521 00000 n +0000308966 00000 n +0000310852 00000 n +0000310665 00000 n +0000310976 00000 n +0000315209 00000 n +0000313888 00000 n +0000311141 00000 n +0000314527 00000 n +0000314775 00000 n +0000314050 00000 n +0000314216 00000 n +0000314898 00000 n +0000315022 00000 n +0000314369 00000 n +0000315146 00000 n +0000319974 00000 n +0000318479 00000 n +0000315311 00000 n +0000319293 00000 n +0000319417 00000 n +0000318650 00000 n +0000318820 00000 n +0000319540 00000 n +0000319664 00000 n +0000319788 00000 n +0000319911 00000 n +0000318990 00000 n +0000319142 00000 n +0000322952 00000 n +0000322519 00000 n +0000320132 00000 n +0000322642 00000 n +0000322766 00000 n +0000322889 00000 n +0000324120 00000 n +0000323810 00000 n +0000323082 00000 n +0000323933 00000 n +0000324057 00000 n +0000325144 00000 n +0000324710 00000 n +0000324222 00000 n +0000324833 00000 n +0000325081 00000 n +0002183837 00000 n +0000325812 00000 n +0000325565 00000 n +0000325232 00000 n +0000325688 00000 n +0000329744 00000 n +0000329121 00000 n +0000325900 00000 n +0000329244 00000 n +0000329307 00000 n +0000329557 00000 n +0000329682 00000 n +0000334228 00000 n +0000333667 00000 n +0000329846 00000 n +0000333790 00000 n +0000333914 00000 n +0000334039 00000 n +0000334102 00000 n +0000334165 00000 n +0000338189 00000 n +0000337379 00000 n +0000334358 00000 n +0000337502 00000 n +0000337627 00000 n +0000337752 00000 n +0000337877 00000 n +0000338002 00000 n +0000338127 00000 n +0000341613 00000 n +0000343762 00000 n +0000341460 00000 n +0000338319 00000 n +0000343449 00000 n +0000343512 00000 n +0000343575 00000 n +0002070233 00000 n +0002060979 00000 n +0002070066 00000 n +0002059022 00000 n +0002047684 00000 n +0002058856 00000 n +0000343143 00000 n +0000343293 00000 n +0000343699 00000 n +0000342972 00000 n +0000343030 00000 n +0000343120 00000 n +0000347686 00000 n +0000346911 00000 n +0000343935 00000 n +0000347373 00000 n +0000347498 00000 n +0000347064 00000 n +0000347220 00000 n +0000347623 00000 n +0002183962 00000 n +0000459466 00000 n +0000351547 00000 n +0000351111 00000 n +0000347816 00000 n +0000351234 00000 n +0002047036 00000 n +0002040846 00000 n +0002046869 00000 n +0000351359 00000 n +0000351484 00000 n +0000355616 00000 n +0000355182 00000 n +0000351762 00000 n +0000355305 00000 n +0000355430 00000 n +0000355555 00000 n +0000358502 00000 n +0000357764 00000 n +0000355746 00000 n +0000358065 00000 n +0000358190 00000 n +0000358314 00000 n +0000357908 00000 n +0000358439 00000 n +0000362402 00000 n +0000361966 00000 n +0000358632 00000 n +0000362089 00000 n +0000362339 00000 n +0000366995 00000 n +0000366301 00000 n +0000362518 00000 n +0000366932 00000 n +0000366463 00000 n +0000366620 00000 n +0000366776 00000 n +0000371481 00000 n +0000370874 00000 n +0000367168 00000 n +0000371168 00000 n +0000371018 00000 n +0000371293 00000 n +0000371418 00000 n +0002184087 00000 n +0000375958 00000 n +0000375647 00000 n +0000371682 00000 n +0000375770 00000 n +0000375895 00000 n +0000380394 00000 n +0000379524 00000 n +0000376088 00000 n +0000380331 00000 n +0000379695 00000 n +0000379852 00000 n +0000380009 00000 n +0000380167 00000 n +0000384525 00000 n +0000383712 00000 n +0000380553 00000 n +0000384338 00000 n +0000383874 00000 n +0000384029 00000 n +0000384184 00000 n +0000384462 00000 n +0000385792 00000 n +0000385606 00000 n +0000384726 00000 n +0000385729 00000 n +0000389527 00000 n +0000388673 00000 n +0000385894 00000 n +0000388966 00000 n +0000388817 00000 n +0000389091 00000 n +0000389214 00000 n +0000389339 00000 n +0000389464 00000 n +0000393296 00000 n +0000392860 00000 n +0000389728 00000 n +0000392983 00000 n +0000393108 00000 n +0000393233 00000 n +0002184212 00000 n +0000398417 00000 n +0000397665 00000 n +0000393469 00000 n +0000397788 00000 n +0000397851 00000 n +0000397914 00000 n +0000397977 00000 n +0000398040 00000 n +0000398103 00000 n +0000398166 00000 n +0000398229 00000 n +0000398354 00000 n +0000402703 00000 n +0000402018 00000 n +0000398575 00000 n +0000402141 00000 n +0000402265 00000 n +0000402390 00000 n +0000402515 00000 n +0000402640 00000 n +0000405535 00000 n +0000404974 00000 n +0000402833 00000 n +0000405097 00000 n +0000405222 00000 n +0000405347 00000 n +0000405472 00000 n +0000409841 00000 n +0000409054 00000 n +0000405651 00000 n +0000409528 00000 n +0000409207 00000 n +0000409778 00000 n +0000409360 00000 n +0000414030 00000 n +0000413596 00000 n +0000409957 00000 n +0000413719 00000 n +0000413844 00000 n +0000413967 00000 n +0000418542 00000 n +0000417808 00000 n +0000414160 00000 n +0000418105 00000 n +0000418230 00000 n +0000417952 00000 n +0000418355 00000 n +0000418480 00000 n +0002184337 00000 n +0000422780 00000 n +0000422220 00000 n +0000418700 00000 n +0000422343 00000 n +0000422468 00000 n +0000422593 00000 n +0000422718 00000 n +0000427028 00000 n +0000426343 00000 n +0000422924 00000 n +0000426466 00000 n +0000426591 00000 n +0000426716 00000 n +0000426840 00000 n +0000426965 00000 n +0000428552 00000 n +0000428241 00000 n +0000427172 00000 n +0000428364 00000 n +0000428489 00000 n +0000432375 00000 n +0000431815 00000 n +0000428668 00000 n +0000431938 00000 n +0000432188 00000 n +0000432313 00000 n +0000436811 00000 n +0000436501 00000 n +0000432505 00000 n +0000436624 00000 n +0000436748 00000 n +0000440680 00000 n +0000442228 00000 n +0000440536 00000 n +0000436969 00000 n +0000441663 00000 n +0000441493 00000 n +0000441788 00000 n +0000441851 00000 n +0000441914 00000 n +0000441977 00000 n +0000442040 00000 n +0000442103 00000 n +0000442166 00000 n +0002184462 00000 n +0000446906 00000 n +0000445720 00000 n +0000442415 00000 n +0000446219 00000 n +0000446344 00000 n +0000445873 00000 n +0000446469 00000 n +0000446594 00000 n +0000446719 00000 n +0000446844 00000 n +0000446059 00000 n +0000451436 00000 n +0000451751 00000 n +0000450256 00000 n +0000447036 00000 n +0000451311 00000 n +0000450436 00000 n +0000451561 00000 n +0000451624 00000 n +0000451687 00000 n +0000450589 00000 n +0000450766 00000 n +0000450944 00000 n +0000451129 00000 n +0000456461 00000 n +0000455607 00000 n +0000451895 00000 n +0000456273 00000 n +0000455769 00000 n +0000456398 00000 n +0000455932 00000 n +0000456122 00000 n +0000459779 00000 n +0000458801 00000 n +0000456591 00000 n +0000459341 00000 n +0000458954 00000 n +0000459128 00000 n +0000459591 00000 n +0000459716 00000 n +0000464417 00000 n +0000463158 00000 n +0000459966 00000 n +0000463979 00000 n +0000463329 00000 n +0000463490 00000 n +0000463652 00000 n +0000463822 00000 n +0000464104 00000 n +0000464229 00000 n +0000464354 00000 n +0000468316 00000 n +0000468878 00000 n +0000468068 00000 n +0000464604 00000 n +0000468191 00000 n +0000468441 00000 n +0000468566 00000 n +0000468691 00000 n +0000468815 00000 n +0002184587 00000 n +0000470109 00000 n +0000469923 00000 n +0000469022 00000 n +0000470046 00000 n +0000473965 00000 n +0000473404 00000 n +0000470253 00000 n +0000473527 00000 n +0000473777 00000 n +0000473902 00000 n +0000477895 00000 n +0000476906 00000 n +0000474081 00000 n +0000477206 00000 n +0000477331 00000 n +0000477455 00000 n +0000477580 00000 n +0000477643 00000 n +0000477706 00000 n +0000477050 00000 n +0000477769 00000 n +0000477832 00000 n +0000479921 00000 n +0000479610 00000 n +0000478025 00000 n +0000479733 00000 n +0000479858 00000 n +0000481021 00000 n +0000480585 00000 n +0000480065 00000 n +0000480708 00000 n +0000480958 00000 n +0000481686 00000 n +0000481438 00000 n +0000481109 00000 n +0000481561 00000 n +0002184712 00000 n +0000485354 00000 n +0000484855 00000 n +0000481774 00000 n +0000484978 00000 n +0000485041 00000 n +0000485291 00000 n +0000488215 00000 n +0000487904 00000 n +0000485513 00000 n +0000488027 00000 n +0000488152 00000 n +0000492662 00000 n +0000492104 00000 n +0000488331 00000 n +0000492227 00000 n +0000492352 00000 n +0000492477 00000 n +0000492600 00000 n +0000497337 00000 n +0000496525 00000 n +0000492792 00000 n +0000496648 00000 n +0000496711 00000 n +0000496774 00000 n +0000496837 00000 n +0000496899 00000 n +0000496962 00000 n +0000497025 00000 n +0000497150 00000 n +0000497274 00000 n +0000501720 00000 n +0000501409 00000 n +0000497495 00000 n +0000501532 00000 n +0000501657 00000 n +0000504659 00000 n +0000504349 00000 n +0000501850 00000 n +0000504472 00000 n +0000504596 00000 n +0002184837 00000 n +0000508449 00000 n +0000507954 00000 n +0000504803 00000 n +0000508261 00000 n +0000508098 00000 n +0000508386 00000 n +0000512816 00000 n +0000511879 00000 n +0000508565 00000 n +0000512002 00000 n +0000512127 00000 n +0000512190 00000 n +0000512253 00000 n +0000512316 00000 n +0000512379 00000 n +0000512504 00000 n +0000512628 00000 n +0000512753 00000 n +0000516971 00000 n +0000516537 00000 n +0000512960 00000 n +0000516660 00000 n +0000516785 00000 n +0000516909 00000 n +0000520654 00000 n +0000521657 00000 n +0000520531 00000 n +0000517101 00000 n +0000521469 00000 n +0000521594 00000 n +0000525382 00000 n +0000524824 00000 n +0000521844 00000 n 0000524947 00000 n -0000525010 00000 n -0000525073 00000 n -0000527209 00000 n -0000526716 00000 n -0000525266 00000 n -0000527020 00000 n -0000527083 00000 n -0000527146 00000 n -0000526860 00000 n -0000814771 00000 n -0000530155 00000 n -0000529594 00000 n -0000527325 00000 n -0000529717 00000 n -0000529780 00000 n -0000529843 00000 n -0000529968 00000 n -0000530031 00000 n -0000530093 00000 n -0000532352 00000 n -0000532166 00000 n -0000530285 00000 n -0000532289 00000 n -0000534537 00000 n -0000534225 00000 n -0000532468 00000 n -0000534348 00000 n -0000534411 00000 n -0000534474 00000 n -0000537574 00000 n -0000537138 00000 n -0000534667 00000 n -0000537261 00000 n -0000537386 00000 n -0000537511 00000 n -0001012647 00000 n -0000541670 00000 n -0000540737 00000 n -0000537704 00000 n -0000540860 00000 n -0000540985 00000 n -0000541110 00000 n -0000541234 00000 n -0000541359 00000 n -0000541422 00000 n -0000541485 00000 n -0000541608 00000 n -0000546276 00000 n -0000544932 00000 n -0000541800 00000 n -0000545899 00000 n -0000545962 00000 n -0000546025 00000 n -0000546088 00000 n -0000546213 00000 n -0000545103 00000 n -0000545302 00000 n -0000545500 00000 n -0000545700 00000 n -0000549004 00000 n -0000548503 00000 n -0000546491 00000 n -0000548816 00000 n -0000548941 00000 n -0000548647 00000 n -0000550901 00000 n -0000550592 00000 n -0000549120 00000 n -0000550715 00000 n -0000550839 00000 n -0000551724 00000 n -0000551538 00000 n -0000551017 00000 n -0000551661 00000 n -0000556332 00000 n -0000555518 00000 n -0000551826 00000 n -0000555894 00000 n -0000556019 00000 n -0000556144 00000 n -0000555662 00000 n -0000556269 00000 n -0001012772 00000 n -0000561157 00000 n -0000560596 00000 n -0000556462 00000 n -0000560719 00000 n -0000560844 00000 n -0000560969 00000 n -0000561094 00000 n -0000565302 00000 n -0000564740 00000 n -0000561315 00000 n -0000564863 00000 n -0000564988 00000 n -0000565051 00000 n -0000565114 00000 n -0000565177 00000 n -0000565239 00000 n -0000569110 00000 n -0000568675 00000 n -0000565432 00000 n -0000568798 00000 n -0000568923 00000 n -0000569048 00000 n -0000573080 00000 n -0000572077 00000 n -0000569283 00000 n -0000572200 00000 n -0000572325 00000 n -0000572450 00000 n -0000572513 00000 n -0000572576 00000 n -0000572639 00000 n -0000572702 00000 n -0000572765 00000 n -0000572828 00000 n -0000572891 00000 n -0000572954 00000 n -0000573017 00000 n -0000576144 00000 n -0000575458 00000 n -0000573196 00000 n -0000575581 00000 n -0000575706 00000 n -0000575831 00000 n -0000575956 00000 n -0000576081 00000 n -0000579308 00000 n -0000578747 00000 n -0000576317 00000 n -0000578870 00000 n -0000578995 00000 n -0000579120 00000 n -0000579245 00000 n -0001012897 00000 n -0000583213 00000 n -0000582652 00000 n -0000579509 00000 n -0000582775 00000 n -0000582900 00000 n -0000583025 00000 n -0000583088 00000 n -0000583151 00000 n -0000587682 00000 n -0000587246 00000 n -0000583442 00000 n -0000587369 00000 n -0000587432 00000 n -0000587494 00000 n -0000587557 00000 n -0000587620 00000 n -0000591601 00000 n -0000591039 00000 n -0000587812 00000 n -0000591162 00000 n -0000591225 00000 n -0000591288 00000 n -0000591413 00000 n -0000591538 00000 n -0000593137 00000 n -0000592951 00000 n -0000591731 00000 n -0000593074 00000 n -0000595507 00000 n -0000595321 00000 n -0000593310 00000 n -0000595444 00000 n -0000599210 00000 n -0000598649 00000 n -0000595666 00000 n -0000598772 00000 n -0000598897 00000 n -0000599022 00000 n -0000599147 00000 n -0001013022 00000 n -0000603300 00000 n -0000602490 00000 n -0000599411 00000 n -0000602613 00000 n -0000602738 00000 n -0000602863 00000 n -0000602988 00000 n -0000603113 00000 n -0000603238 00000 n -0000607546 00000 n -0000606985 00000 n -0000603473 00000 n -0000607108 00000 n -0000607233 00000 n -0000607358 00000 n -0000607483 00000 n -0000611571 00000 n -0000611008 00000 n -0000607747 00000 n -0000611131 00000 n -0000611256 00000 n -0000611319 00000 n -0000611382 00000 n -0000611445 00000 n -0000611508 00000 n -0000613695 00000 n -0000613509 00000 n -0000611715 00000 n -0000613632 00000 n -0000617103 00000 n -0000616792 00000 n -0000613811 00000 n -0000616915 00000 n -0000617040 00000 n -0000619408 00000 n -0000619222 00000 n -0000617290 00000 n -0000619345 00000 n -0001013147 00000 n -0000621045 00000 n -0000620859 00000 n -0000619524 00000 n -0000620982 00000 n -0000624784 00000 n -0000624348 00000 n -0000621161 00000 n -0000624471 00000 n -0000624596 00000 n -0000624721 00000 n -0000628803 00000 n -0000627994 00000 n -0000624886 00000 n -0000628117 00000 n -0000628242 00000 n -0000628367 00000 n -0000628490 00000 n -0000628615 00000 n -0000628740 00000 n -0000632487 00000 n -0000632177 00000 n -0000628919 00000 n -0000632300 00000 n -0000632424 00000 n -0000635510 00000 n -0000635072 00000 n -0000632660 00000 n -0000635195 00000 n -0000635321 00000 n -0000635447 00000 n -0000638093 00000 n -0000637907 00000 n -0000635683 00000 n -0000638030 00000 n -0001013272 00000 n -0000641664 00000 n -0000640948 00000 n -0000638209 00000 n -0000641475 00000 n -0000641601 00000 n -0000641101 00000 n -0000641289 00000 n -0000644464 00000 n -0000644152 00000 n -0000641851 00000 n -0000644275 00000 n -0000644401 00000 n -0000646818 00000 n -0000646380 00000 n -0000644580 00000 n -0000646503 00000 n -0000646629 00000 n -0000646755 00000 n -0000649396 00000 n -0000648836 00000 n -0000646934 00000 n -0000648959 00000 n -0000649085 00000 n -0000649207 00000 n -0000649333 00000 n -0000652517 00000 n -0000651701 00000 n -0000649526 00000 n -0000651824 00000 n -0000651950 00000 n -0000652076 00000 n -0000652202 00000 n -0000652328 00000 n -0000652454 00000 n -0000655439 00000 n -0000654749 00000 n -0000652647 00000 n -0000654872 00000 n -0000654935 00000 n -0000654998 00000 n -0000655125 00000 n -0000655251 00000 n -0000655376 00000 n -0001013397 00000 n -0000658283 00000 n -0000657244 00000 n -0000655555 00000 n -0000657969 00000 n -0000658095 00000 n -0000657406 00000 n -0000657612 00000 n -0000658221 00000 n -0000657792 00000 n -0000662346 00000 n -0000661032 00000 n -0000658399 00000 n -0000662031 00000 n -0000662157 00000 n -0000662283 00000 n -0000661203 00000 n -0000661439 00000 n -0000661675 00000 n -0000661853 00000 n -0000664068 00000 n -0000663756 00000 n -0000662476 00000 n -0000663879 00000 n -0000664005 00000 n -0000667065 00000 n -0000666628 00000 n -0000664184 00000 n -0000666751 00000 n -0000666877 00000 n -0000667003 00000 n -0000670863 00000 n -0000670427 00000 n -0000667238 00000 n -0000670550 00000 n -0000670676 00000 n -0000670801 00000 n -0000673309 00000 n -0000672871 00000 n -0000670993 00000 n -0000672994 00000 n -0000673120 00000 n -0000673246 00000 n -0001013522 00000 n -0000677139 00000 n -0000676827 00000 n -0000673439 00000 n -0000676950 00000 n -0000677076 00000 n -0000681206 00000 n -0000680768 00000 n -0000677283 00000 n -0000680891 00000 n -0000681017 00000 n -0000681143 00000 n -0000683309 00000 n -0000683123 00000 n -0000681336 00000 n -0000683246 00000 n -0000686546 00000 n -0000685982 00000 n -0000683411 00000 n -0000686105 00000 n -0000686231 00000 n -0000686357 00000 n -0000686483 00000 n -0000687333 00000 n -0000687147 00000 n -0000686676 00000 n -0000687270 00000 n -0000690580 00000 n -0000689890 00000 n -0000687435 00000 n -0000690013 00000 n -0000690265 00000 n -0000690391 00000 n -0000690517 00000 n -0001013647 00000 n -0000693657 00000 n -0000693096 00000 n -0000690696 00000 n -0000693219 00000 n -0000693345 00000 n -0000693469 00000 n -0000693594 00000 n -0000695296 00000 n -0000694795 00000 n -0000693773 00000 n -0000695107 00000 n -0000695233 00000 n -0000694939 00000 n -0000699280 00000 n -0000698397 00000 n -0000695412 00000 n -0000698713 00000 n -0000698839 00000 n -0000698965 00000 n -0000698541 00000 n -0000699091 00000 n -0000699217 00000 n -0000701871 00000 n -0000701112 00000 n -0000699410 00000 n -0000701683 00000 n -0000701809 00000 n -0000701265 00000 n -0000701474 00000 n -0000706036 00000 n -0000705472 00000 n -0000702015 00000 n -0000705595 00000 n -0000705721 00000 n -0000705847 00000 n -0000705973 00000 n -0000709812 00000 n -0000709501 00000 n -0000706138 00000 n -0000709624 00000 n -0000709750 00000 n -0001013772 00000 n -0000712542 00000 n -0000712356 00000 n -0000709942 00000 n -0000712479 00000 n -0000715273 00000 n -0000714961 00000 n -0000712701 00000 n -0000715084 00000 n -0000715210 00000 n -0000718089 00000 n -0000717652 00000 n -0000715460 00000 n -0000717775 00000 n -0000717901 00000 n -0000718027 00000 n -0000721760 00000 n -0000719888 00000 n -0000718205 00000 n -0000721571 00000 n -0000721697 00000 n -0000720086 00000 n -0000720297 00000 n -0000720510 00000 n -0000720723 00000 n -0000720935 00000 n -0000721147 00000 n -0000721359 00000 n -0000722439 00000 n -0000722191 00000 n -0000721890 00000 n -0000722314 00000 n -0000725585 00000 n -0000724959 00000 n -0000722527 00000 n -0000725082 00000 n -0000725145 00000 n -0000725397 00000 n -0000725522 00000 n -0001013897 00000 n -0000729607 00000 n -0000729106 00000 n -0000725758 00000 n -0000729229 00000 n -0000729355 00000 n -0000729418 00000 n -0000729481 00000 n -0000729544 00000 n -0000733268 00000 n -0000733019 00000 n -0000729794 00000 n -0000733142 00000 n -0000733205 00000 n -0000737822 00000 n -0000737075 00000 n -0000733455 00000 n -0000737198 00000 n -0000737261 00000 n -0000737324 00000 n -0000737387 00000 n -0000737449 00000 n -0000737512 00000 n -0000737573 00000 n -0000737635 00000 n -0000737698 00000 n -0000737761 00000 n -0000742526 00000 n -0000741900 00000 n -0000738023 00000 n -0000742023 00000 n -0000742086 00000 n -0000742149 00000 n -0000742211 00000 n -0000742274 00000 n -0000742337 00000 n -0000742400 00000 n -0000742463 00000 n -0000743646 00000 n -0000743161 00000 n -0000742670 00000 n -0000743457 00000 n -0000743583 00000 n -0000743305 00000 n -0000747660 00000 n -0000746723 00000 n -0000743748 00000 n -0000747221 00000 n -0000747473 00000 n -0000746876 00000 n -0000747048 00000 n -0000747599 00000 n -0001014022 00000 n -0000752341 00000 n -0000750683 00000 n -0000747776 00000 n -0000752153 00000 n -0000752279 00000 n -0000750881 00000 n -0000751045 00000 n -0000751236 00000 n -0000751427 00000 n -0000751612 00000 n -0000751781 00000 n -0000751965 00000 n -0000757121 00000 n -0000755930 00000 n -0000752485 00000 n -0000756806 00000 n -0000756932 00000 n -0000756101 00000 n -0000756266 00000 n -0000757058 00000 n -0000756439 00000 n -0000756610 00000 n -0000761260 00000 n -0000760031 00000 n -0000757279 00000 n -0000760693 00000 n -0000760819 00000 n -0000760945 00000 n -0000760193 00000 n -0000760369 00000 n -0000761071 00000 n -0000760540 00000 n -0000761197 00000 n -0000765471 00000 n -0000764907 00000 n -0000761376 00000 n -0000765030 00000 n -0000765156 00000 n -0000765282 00000 n -0000765408 00000 n -0000766141 00000 n -0000765893 00000 n -0000765601 00000 n -0000766016 00000 n -0000771157 00000 n -0000768978 00000 n -0000766229 00000 n -0000770212 00000 n -0000770275 00000 n -0000769167 00000 n -0000770527 00000 n -0000770653 00000 n -0000769333 00000 n -0000769512 00000 n -0000770779 00000 n -0000770905 00000 n -0000769692 00000 n -0000771031 00000 n -0000769870 00000 n -0000770041 00000 n -0000771094 00000 n -0001014147 00000 n -0000775076 00000 n -0000773871 00000 n -0000771259 00000 n -0000774573 00000 n -0000774636 00000 n -0000774699 00000 n -0000774762 00000 n -0000774887 00000 n -0000774033 00000 n -0000774218 00000 n -0000774403 00000 n -0000775013 00000 n -0000777908 00000 n -0000777470 00000 n -0000775192 00000 n -0000777593 00000 n -0000777719 00000 n -0000777845 00000 n -0000781057 00000 n -0000780367 00000 n -0000778038 00000 n -0000780490 00000 n -0000780616 00000 n -0000780742 00000 n -0000780868 00000 n -0000780994 00000 n -0000783774 00000 n -0000783462 00000 n -0000781187 00000 n -0000783585 00000 n -0000783711 00000 n -0000784805 00000 n -0000784619 00000 n -0000783975 00000 n -0000784742 00000 n -0000788059 00000 n -0000787495 00000 n +0000525072 00000 n +0000525195 00000 n +0000525320 00000 n +0000529209 00000 n +0000528773 00000 n +0000525512 00000 n +0000528896 00000 n +0000529021 00000 n +0000529146 00000 n +0002184962 00000 n +0000532738 00000 n +0000532303 00000 n +0000529396 00000 n +0000532426 00000 n +0000532550 00000 n +0000532675 00000 n +0000537101 00000 n +0000536665 00000 n +0000532854 00000 n +0000536788 00000 n +0000536913 00000 n +0000537038 00000 n +0000540961 00000 n +0000540651 00000 n +0000537302 00000 n +0000540774 00000 n +0000540899 00000 n +0000545726 00000 n +0000545286 00000 n +0000541077 00000 n +0000545409 00000 n +0000545472 00000 n +0000545535 00000 n +0000545599 00000 n +0000545662 00000 n +0000550307 00000 n +0000549679 00000 n +0000545842 00000 n +0000549802 00000 n +0000549865 00000 n +0000549928 00000 n +0000549991 00000 n +0000550054 00000 n +0000550118 00000 n +0000550181 00000 n +0000550244 00000 n +0000552920 00000 n +0000552360 00000 n +0000550409 00000 n +0000552483 00000 n +0000552608 00000 n +0000552732 00000 n +0000552857 00000 n +0002185087 00000 n +0000556656 00000 n +0000556220 00000 n +0000553036 00000 n +0000556343 00000 n +0000556593 00000 n +0000561084 00000 n +0000560774 00000 n +0000556829 00000 n +0000560897 00000 n +0000561022 00000 n +0000565092 00000 n +0000564781 00000 n +0000561242 00000 n +0000564904 00000 n +0000565029 00000 n +0000569443 00000 n +0000568882 00000 n +0000565265 00000 n +0000569005 00000 n +0000569130 00000 n +0000569255 00000 n +0000569380 00000 n +0000573170 00000 n +0000572610 00000 n +0000569587 00000 n +0000572733 00000 n +0000572858 00000 n +0000572983 00000 n +0000573108 00000 n +0000575994 00000 n +0000575510 00000 n +0000573314 00000 n +0000575806 00000 n +0000575654 00000 n +0000575931 00000 n +0002185212 00000 n +0000613080 00000 n +0000580766 00000 n +0000579876 00000 n +0000576124 00000 n +0000580205 00000 n +0000580330 00000 n +0000580455 00000 n +0000580020 00000 n +0000580580 00000 n +0000580703 00000 n +0000586732 00000 n +0000584620 00000 n +0000580910 00000 n +0000586419 00000 n +0000584836 00000 n +0000585005 00000 n +0000585174 00000 n +0000585368 00000 n +0000585540 00000 n +0000585725 00000 n +0000585927 00000 n +0000586544 00000 n +0000586097 00000 n +0000586669 00000 n +0000586250 00000 n +0000589882 00000 n +0000589572 00000 n +0000586919 00000 n +0000589695 00000 n +0000589819 00000 n +0000591713 00000 n +0000591403 00000 n +0000589998 00000 n +0000591526 00000 n +0000591651 00000 n +0000596390 00000 n +0000594161 00000 n +0000591829 00000 n +0000596202 00000 n +0000596327 00000 n +0000594386 00000 n +0000594569 00000 n +0000594745 00000 n +0000594926 00000 n +0000595106 00000 n +0000595286 00000 n +0000595472 00000 n +0000595656 00000 n +0000595837 00000 n +0000596020 00000 n +0000598922 00000 n +0000598611 00000 n +0000596591 00000 n +0000598734 00000 n +0000598859 00000 n +0002185337 00000 n +0000603362 00000 n +0000602594 00000 n +0000599038 00000 n +0000603049 00000 n +0000603174 00000 n +0000602747 00000 n +0000603299 00000 n +0000602896 00000 n +0000605471 00000 n +0000605035 00000 n +0000603506 00000 n +0000605158 00000 n +0000605283 00000 n +0000605408 00000 n +0000609885 00000 n +0000609123 00000 n +0000605587 00000 n +0000609449 00000 n +0000609267 00000 n +0000609574 00000 n +0000609698 00000 n +0000609822 00000 n +0000613518 00000 n +0000612582 00000 n +0000610058 00000 n +0000612705 00000 n +0000612830 00000 n +0000612955 00000 n +0000613205 00000 n +0000613330 00000 n +0000613455 00000 n +0000614771 00000 n +0000614460 00000 n +0000613662 00000 n +0000614583 00000 n +0000614708 00000 n +0000618607 00000 n +0000618294 00000 n +0000614887 00000 n +0000618417 00000 n +0000618480 00000 n +0000618543 00000 n +0002185462 00000 n +0000620088 00000 n +0000619776 00000 n +0000618737 00000 n +0000619899 00000 n +0000619962 00000 n +0000620024 00000 n +0000623280 00000 n +0000622967 00000 n +0000620190 00000 n +0000623090 00000 n +0000623153 00000 n +0000623216 00000 n +0000626892 00000 n +0000626331 00000 n +0000623382 00000 n +0000626454 00000 n +0000626704 00000 n +0000626829 00000 n +0000630382 00000 n +0000629883 00000 n +0000627065 00000 n +0000630006 00000 n +0000630069 00000 n +0000630132 00000 n +0000630194 00000 n +0000630319 00000 n +0000632990 00000 n +0000632304 00000 n +0000630512 00000 n +0000632427 00000 n +0000632552 00000 n +0000632677 00000 n +0000632740 00000 n +0000632804 00000 n +0000632929 00000 n +0000635764 00000 n +0000635205 00000 n +0000633120 00000 n +0000635328 00000 n +0000635453 00000 n +0000635577 00000 n +0000635701 00000 n +0002185587 00000 n +0000639528 00000 n +0000639092 00000 n +0000635894 00000 n +0000639215 00000 n +0000639465 00000 n +0000644045 00000 n +0000643609 00000 n +0000639658 00000 n +0000643732 00000 n +0000643857 00000 n +0000643982 00000 n +0000648925 00000 n +0000648363 00000 n +0000644203 00000 n +0000648486 00000 n +0002040610 00000 n +0002038736 00000 n +0002040442 00000 n +0000648611 00000 n +0000648674 00000 n +0000648737 00000 n +0000648862 00000 n +0000651116 00000 n +0000650930 00000 n +0000649083 00000 n +0000651053 00000 n +0000655484 00000 n +0000654798 00000 n +0000651218 00000 n +0000654921 00000 n +0000654984 00000 n +0000655047 00000 n +0000655172 00000 n +0000655297 00000 n +0000655422 00000 n +0000659425 00000 n +0000658865 00000 n +0000655600 00000 n +0000658988 00000 n +0000659051 00000 n +0000659114 00000 n +0000659238 00000 n +0000659362 00000 n +0002185712 00000 n +0000663332 00000 n +0000662896 00000 n +0000659555 00000 n +0000663019 00000 n +0000663082 00000 n +0000663145 00000 n +0000663270 00000 n +0000667647 00000 n +0000666962 00000 n +0000663462 00000 n +0000667085 00000 n +0000667148 00000 n +0000667211 00000 n +0000667336 00000 n +0000667399 00000 n +0000667462 00000 n +0000667586 00000 n +0000671599 00000 n +0000670974 00000 n +0000667777 00000 n +0000671097 00000 n +0000671160 00000 n +0000671223 00000 n +0000671286 00000 n +0000671411 00000 n +0000671536 00000 n +0000676176 00000 n +0000675617 00000 n +0000671814 00000 n +0000675740 00000 n +0000675865 00000 n +0000675990 00000 n +0000676114 00000 n +0000680778 00000 n +0000680219 00000 n +0000676391 00000 n +0000680342 00000 n +0000680467 00000 n +0000680591 00000 n +0000680715 00000 n +0000685799 00000 n +0000684707 00000 n +0000680908 00000 n +0000685612 00000 n +0000685737 00000 n +0000684878 00000 n +0000685060 00000 n +0000685240 00000 n +0000685427 00000 n +0002185837 00000 n +0000689992 00000 n +0000689305 00000 n +0000685943 00000 n +0000689428 00000 n +0000689553 00000 n +0000689678 00000 n +0000689803 00000 n +0000689866 00000 n +0000689929 00000 n +0000692080 00000 n +0000691643 00000 n +0000690122 00000 n +0000691766 00000 n +0000691829 00000 n +0000691891 00000 n +0000691954 00000 n +0000692017 00000 n +0000693774 00000 n +0000693465 00000 n +0000692239 00000 n +0000693588 00000 n +0000693712 00000 n +0000697600 00000 n +0000697039 00000 n +0000693975 00000 n +0000697162 00000 n +0000697412 00000 n +0000697537 00000 n +0000702412 00000 n +0000702101 00000 n +0000697759 00000 n +0000702224 00000 n +0000702349 00000 n +0000706762 00000 n +0000706576 00000 n +0000702556 00000 n +0000706699 00000 n +0002185962 00000 n +0000711034 00000 n +0000710224 00000 n +0000706864 00000 n +0000710347 00000 n +0000710472 00000 n +0000710596 00000 n +0000710721 00000 n +0000710846 00000 n +0000710971 00000 n +0000715502 00000 n +0000714818 00000 n +0000711136 00000 n +0000714941 00000 n +0000715066 00000 n +0000715191 00000 n +0000715315 00000 n +0000715439 00000 n +0000719985 00000 n +0000719675 00000 n +0000715632 00000 n +0000719798 00000 n +0000719923 00000 n +0000723402 00000 n +0000722842 00000 n +0000720101 00000 n +0000722965 00000 n +0000723090 00000 n +0000723215 00000 n +0000723339 00000 n +0000726743 00000 n +0000726432 00000 n +0000723518 00000 n +0000726555 00000 n +0000726680 00000 n +0000729114 00000 n +0000728928 00000 n +0000726873 00000 n +0000729051 00000 n +0002186087 00000 n +0000732356 00000 n +0000731920 00000 n +0000729273 00000 n +0000732043 00000 n +0000732168 00000 n +0000732293 00000 n +0000736320 00000 n +0000735885 00000 n +0000732486 00000 n +0000736008 00000 n +0000736132 00000 n +0000736257 00000 n +0000740895 00000 n +0000738904 00000 n +0000736450 00000 n +0000740584 00000 n +0000740709 00000 n +0000740832 00000 n +0000739102 00000 n +0000739313 00000 n +0000739525 00000 n +0000739737 00000 n +0000739949 00000 n +0000740161 00000 n +0000740372 00000 n +0000744880 00000 n +0000744070 00000 n +0000741025 00000 n +0000744193 00000 n +0000744443 00000 n +0000744568 00000 n +0000744693 00000 n +0000744818 00000 n +0000748491 00000 n +0000747930 00000 n +0000744982 00000 n +0000748053 00000 n +0000748178 00000 n +0000748303 00000 n +0000748428 00000 n +0000751410 00000 n +0000750975 00000 n +0000748621 00000 n +0000751098 00000 n +0000751223 00000 n +0000751348 00000 n +0002186212 00000 n +0000755673 00000 n +0000754793 00000 n +0000751526 00000 n +0000755106 00000 n +0000755232 00000 n +0000754937 00000 n +0000755358 00000 n +0000755484 00000 n +0000755610 00000 n +0000759641 00000 n +0000759078 00000 n +0000755789 00000 n +0000759201 00000 n +0000759452 00000 n +0000759578 00000 n +0000764092 00000 n +0000763281 00000 n +0000759743 00000 n +0000763404 00000 n +0000763530 00000 n +0000763654 00000 n +0000763779 00000 n +0000763905 00000 n +0000764030 00000 n +0000768054 00000 n +0000767743 00000 n +0000764194 00000 n +0000767866 00000 n +0000767991 00000 n +0000770599 00000 n +0000770161 00000 n +0000768170 00000 n +0000770284 00000 n +0000770410 00000 n +0000770536 00000 n +0000774435 00000 n +0000773364 00000 n +0000770772 00000 n +0000774120 00000 n +0000774372 00000 n +0000773526 00000 n +0000773762 00000 n +0000773941 00000 n +0002186337 00000 n +0000776415 00000 n +0000776103 00000 n +0000774565 00000 n +0000776226 00000 n +0000776352 00000 n +0000780440 00000 n +0000779876 00000 n +0000776531 00000 n +0000779999 00000 n +0000780251 00000 n +0000780377 00000 n 0000784964 00000 n -0000787618 00000 n -0000787744 00000 n -0000787870 00000 n -0000787996 00000 n -0001014272 00000 n -0000791230 00000 n -0000790918 00000 n -0000788175 00000 n -0000791041 00000 n -0000791167 00000 n -0000795686 00000 n -0000795249 00000 n -0000791346 00000 n -0000795372 00000 n -0000795498 00000 n -0000795624 00000 n -0000799718 00000 n -0000798085 00000 n -0000795802 00000 n -0000798208 00000 n -0000798334 00000 n -0000798460 00000 n -0000798586 00000 n -0000798649 00000 n -0000798712 00000 n -0000798775 00000 n -0000798838 00000 n -0000798901 00000 n -0000798964 00000 n -0000799027 00000 n -0000799090 00000 n -0000799153 00000 n -0000799216 00000 n -0000799279 00000 n -0000799342 00000 n -0000799405 00000 n -0000799468 00000 n -0000799531 00000 n -0000799594 00000 n -0000799656 00000 n -0000802966 00000 n -0000802150 00000 n -0000799876 00000 n -0000802273 00000 n -0000802336 00000 n -0000802399 00000 n -0000802525 00000 n -0000802588 00000 n -0000802651 00000 n -0000802778 00000 n -0000802904 00000 n -0000805609 00000 n -0000805296 00000 n -0000803124 00000 n -0000805419 00000 n -0000805482 00000 n -0000805545 00000 n -0000806690 00000 n -0000806504 00000 n -0000805725 00000 n -0000806627 00000 n -0001014397 00000 n -0000810176 00000 n -0000809487 00000 n -0000806792 00000 n -0000809610 00000 n -0000809736 00000 n -0000809862 00000 n -0000809988 00000 n -0000810113 00000 n -0000811805 00000 n -0000811493 00000 n -0000810278 00000 n -0000811616 00000 n -0000811742 00000 n -0000814834 00000 n -0000814019 00000 n -0000811935 00000 n -0000814142 00000 n -0000814268 00000 n -0000814394 00000 n -0000814519 00000 n -0000814645 00000 n -0000819904 00000 n -0000818027 00000 n -0000814936 00000 n -0000819337 00000 n -0000819463 00000 n -0000819589 00000 n -0000818216 00000 n -0000818388 00000 n -0000818578 00000 n -0000818763 00000 n -0000818955 00000 n -0000819715 00000 n -0000819841 00000 n -0000819142 00000 n -0000825020 00000 n -0000823381 00000 n -0000820020 00000 n -0000824327 00000 n -0000824453 00000 n -0000823552 00000 n -0000823750 00000 n -0000823942 00000 n -0000824579 00000 n -0000824132 00000 n -0000824705 00000 n -0000824831 00000 n -0000824957 00000 n -0000829573 00000 n -0000828443 00000 n -0000825164 00000 n -0000828755 00000 n -0000828881 00000 n -0000829006 00000 n -0000829132 00000 n -0000828587 00000 n -0000829258 00000 n -0000829384 00000 n -0000829510 00000 n -0001014522 00000 n -0000833600 00000 n -0000832659 00000 n -0000829703 00000 n -0000832972 00000 n -0000833035 00000 n -0000833098 00000 n -0000833159 00000 n -0000833222 00000 n -0000833285 00000 n -0000833411 00000 n -0000833537 00000 n -0000832803 00000 n -0000835145 00000 n -0000834601 00000 n -0000833758 00000 n -0000834956 00000 n -0000835082 00000 n -0000834745 00000 n -0000838462 00000 n -0000837900 00000 n -0000835304 00000 n -0000838023 00000 n -0000838149 00000 n -0000838274 00000 n -0000838399 00000 n -0000841416 00000 n -0000841104 00000 n -0000838621 00000 n -0000841227 00000 n -0000841353 00000 n -0000845175 00000 n -0000844545 00000 n -0000841574 00000 n -0000844861 00000 n -0000844987 00000 n -0000844689 00000 n -0000845112 00000 n -0000849454 00000 n -0000848639 00000 n -0000845404 00000 n -0000848762 00000 n -0000848888 00000 n -0000849014 00000 n -0000849140 00000 n -0000849265 00000 n -0000849391 00000 n -0001014647 00000 n -0000850934 00000 n -0000850622 00000 n -0000849584 00000 n -0000850745 00000 n -0000850871 00000 n -0000854679 00000 n -0000853991 00000 n -0000851050 00000 n -0000854114 00000 n -0000854240 00000 n -0000854366 00000 n -0000854492 00000 n -0000854618 00000 n -0000858670 00000 n -0000857855 00000 n -0000854795 00000 n -0000857978 00000 n -0000858104 00000 n -0000858229 00000 n -0000858355 00000 n -0000858481 00000 n -0000858607 00000 n -0000859986 00000 n -0000859496 00000 n -0000858800 00000 n -0000859797 00000 n -0000859923 00000 n -0000859640 00000 n -0000860088 00000 n -0000864491 00000 n -0000864672 00000 n -0000868420 00000 n -0000868445 00000 n -0000871657 00000 n -0000871688 00000 n -0000884872 00000 n -0000888947 00000 n -0000889144 00000 n -0000898871 00000 n -0000901380 00000 n -0000901411 00000 n -0000905411 00000 n -0000905639 00000 n -0000924554 00000 n -0000934967 00000 n -0000951442 00000 n -0000951852 00000 n -0000970160 00000 n -0000989856 00000 n -0000995250 00000 n -0001009493 00000 n -0001014763 00000 n -0001014889 00000 n -0001015015 00000 n -0001015141 00000 n -0001015267 00000 n -0001015393 00000 n -0001015519 00000 n -0001015618 00000 n -0001015745 00000 n -0001015826 00000 n -0001015900 00000 n -0001055177 00000 n -0001081128 00000 n -0001081169 00000 n -0001081209 00000 n -0001081441 00000 n +0000783960 00000 n +0000780585 00000 n +0000784083 00000 n +0000784209 00000 n +0000784272 00000 n +0000784335 00000 n +0000784398 00000 n +0000784461 00000 n +0000784524 00000 n +0000784587 00000 n +0000784650 00000 n +0000784775 00000 n +0000784901 00000 n +0000788732 00000 n +0000788295 00000 n +0000785179 00000 n +0000788418 00000 n +0000788543 00000 n +0000788669 00000 n +0000792169 00000 n +0000791732 00000 n +0000788904 00000 n +0000791855 00000 n +0000791981 00000 n +0000792106 00000 n +0000794539 00000 n +0000794228 00000 n +0000792299 00000 n +0000794351 00000 n +0000794477 00000 n +0002186462 00000 n +0000797301 00000 n +0000797115 00000 n +0000794726 00000 n +0000797238 00000 n +0000802523 00000 n +0000800277 00000 n +0000799965 00000 n +0000797445 00000 n +0000800088 00000 n +0000800214 00000 n +0000806000 00000 n +0000802400 00000 n +0000800421 00000 n +0000805937 00000 n +0000805766 00000 n +0000805824 00000 n +0000805914 00000 n +0000810301 00000 n +0000811429 00000 n +0000810178 00000 n +0000806187 00000 n +0000811114 00000 n +0000811240 00000 n +0000811366 00000 n +0000816388 00000 n +0000816077 00000 n +0000811630 00000 n +0000816200 00000 n +0000816326 00000 n +0000821396 00000 n +0000820959 00000 n +0000816532 00000 n +0000821082 00000 n +0000821208 00000 n +0000821334 00000 n +0002186587 00000 n +0000825999 00000 n +0000825624 00000 n +0000821512 00000 n +0000825747 00000 n +0000825873 00000 n +0000825936 00000 n +0000830293 00000 n +0000829981 00000 n +0000826143 00000 n +0000830104 00000 n +0000830230 00000 n +0000835473 00000 n +0000834650 00000 n +0000830437 00000 n +0000835158 00000 n +0000835284 00000 n +0000834803 00000 n +0000834983 00000 n +0000835410 00000 n +0000839877 00000 n +0000839440 00000 n +0000835617 00000 n +0000839563 00000 n +0000839689 00000 n +0000839814 00000 n +0000843720 00000 n +0000843408 00000 n +0000840035 00000 n +0000843531 00000 n +0000843657 00000 n +0000847254 00000 n +0000846942 00000 n +0000843921 00000 n +0000847065 00000 n +0000847191 00000 n +0002186712 00000 n +0000852101 00000 n +0000851664 00000 n +0000847455 00000 n +0000851787 00000 n +0000851913 00000 n +0000852039 00000 n +0000857137 00000 n +0000856448 00000 n +0000852259 00000 n +0000856571 00000 n +0000856697 00000 n +0000856760 00000 n +0000856823 00000 n +0000856886 00000 n +0000856948 00000 n +0000857074 00000 n +0000859887 00000 n +0000859701 00000 n +0000857295 00000 n +0000859824 00000 n +0000863812 00000 n +0000863374 00000 n +0000860074 00000 n +0000863497 00000 n +0000863623 00000 n +0000863749 00000 n +0000866587 00000 n +0000866275 00000 n +0000863970 00000 n +0000866398 00000 n +0000866524 00000 n +0000869304 00000 n +0000868992 00000 n +0000866731 00000 n +0000869115 00000 n +0000869241 00000 n +0002186837 00000 n +0000872085 00000 n +0000871773 00000 n +0000869448 00000 n +0000871896 00000 n +0000872022 00000 n +0000876618 00000 n +0000876180 00000 n +0000872215 00000 n +0000876303 00000 n +0000876429 00000 n +0000876555 00000 n +0000879139 00000 n +0000878827 00000 n +0000876776 00000 n +0000878950 00000 n +0000879076 00000 n +0000883613 00000 n +0000883175 00000 n +0000879283 00000 n +0000883298 00000 n +0000883424 00000 n +0000883550 00000 n +0000888474 00000 n +0000888162 00000 n +0000883814 00000 n +0000888285 00000 n +0000888411 00000 n +0000892899 00000 n +0000892461 00000 n +0000888618 00000 n +0000892584 00000 n +0000892710 00000 n +0000892836 00000 n +0002186962 00000 n +0000898753 00000 n +0000897373 00000 n +0000893029 00000 n +0000897496 00000 n +0000897622 00000 n +0000897748 00000 n +0000897811 00000 n +0000897874 00000 n +0000897935 00000 n +0000897997 00000 n +0000898060 00000 n +0000898123 00000 n +0000898186 00000 n +0000898249 00000 n +0000898312 00000 n +0000898375 00000 n +0000898438 00000 n +0000898501 00000 n +0000898564 00000 n +0000898627 00000 n +0000898690 00000 n +0000902332 00000 n +0000902020 00000 n +0000898883 00000 n +0000902143 00000 n +0000902269 00000 n +0000903628 00000 n +0000903442 00000 n +0000902533 00000 n +0000903565 00000 n +0000907766 00000 n +0000907329 00000 n +0000903744 00000 n +0000907452 00000 n +0000907578 00000 n +0000907704 00000 n +0000912026 00000 n +0000911714 00000 n +0000907981 00000 n +0000911837 00000 n +0000911963 00000 n +0000913407 00000 n +0000913221 00000 n +0000912198 00000 n +0000913344 00000 n +0002187087 00000 n +0000915093 00000 n +0000914907 00000 n +0000913509 00000 n +0000915030 00000 n +0000919946 00000 n +0000918865 00000 n +0000915195 00000 n +0000919380 00000 n +0000919506 00000 n +0000919632 00000 n +0000919758 00000 n +0000919018 00000 n +0000919199 00000 n +0000919884 00000 n +0000924388 00000 n +0000923636 00000 n +0000920090 00000 n +0000923759 00000 n +0000923885 00000 n +0000924011 00000 n +0000924137 00000 n +0000924199 00000 n +0000924262 00000 n +0000924325 00000 n +0000928996 00000 n +0000928452 00000 n +0000924532 00000 n +0000928807 00000 n +0000928933 00000 n +0000928596 00000 n +0000933499 00000 n +0000933062 00000 n +0000929154 00000 n +0000933185 00000 n +0000933311 00000 n +0000933436 00000 n +0000937002 00000 n +0000936111 00000 n +0000933657 00000 n +0000936436 00000 n +0000936255 00000 n +0000936562 00000 n +0000936688 00000 n +0000936814 00000 n +0000936939 00000 n +0002187212 00000 n +0000941929 00000 n +0000940744 00000 n +0000937160 00000 n +0000941238 00000 n +0000941490 00000 n +0000941616 00000 n +0000940897 00000 n +0000941742 00000 n +0000941065 00000 n +0000941866 00000 n +0000946096 00000 n +0000945253 00000 n +0000942045 00000 n +0000945781 00000 n +0000945406 00000 n +0000945593 00000 n +0000945907 00000 n +0002036645 00000 n +0002032638 00000 n +0002036478 00000 n +0000946033 00000 n +0000948559 00000 n +0000948247 00000 n +0000946325 00000 n +0000948370 00000 n +0000948496 00000 n +0000952432 00000 n +0000951868 00000 n +0000948675 00000 n +0000951991 00000 n +0000952117 00000 n +0000952243 00000 n +0000952369 00000 n +0000956054 00000 n +0000955617 00000 n +0000952562 00000 n +0000955740 00000 n +0000955865 00000 n +0000955991 00000 n +0000960622 00000 n +0000960184 00000 n +0000956269 00000 n +0000960307 00000 n +0000960433 00000 n +0000960559 00000 n +0002187337 00000 n +0000967989 00000 n +0000965225 00000 n +0000964661 00000 n +0000960766 00000 n +0000964784 00000 n +0000964910 00000 n +0000965036 00000 n +0000965162 00000 n +0000984281 00000 n +0000967866 00000 n +0000965412 00000 n +0000984028 00000 n +0000984091 00000 n +0000984154 00000 n +0002031255 00000 n +0002028991 00000 n +0002031092 00000 n +0000984217 00000 n +0000983840 00000 n +0000986873 00000 n +0000998627 00000 n +0000986750 00000 n +0000984456 00000 n +0000998248 00000 n +0000998374 00000 n +0000998437 00000 n +0000998500 00000 n +0000998563 00000 n +0000998063 00000 n +0001000452 00000 n +0001012951 00000 n +0001000329 00000 n +0000998858 00000 n +0001012573 00000 n +0001012698 00000 n +0001012761 00000 n +0001012824 00000 n +0001012887 00000 n +0001012387 00000 n +0001017004 00000 n +0001016692 00000 n +0001013140 00000 n +0001016815 00000 n +0001016941 00000 n +0001021395 00000 n +0001020442 00000 n +0001017191 00000 n +0001020955 00000 n +0001021081 00000 n +0001020595 00000 n +0001020775 00000 n +0001021207 00000 n +0001021333 00000 n +0002187462 00000 n +0001026368 00000 n +0001025480 00000 n +0001021624 00000 n +0001026179 00000 n +0001025642 00000 n +0001025824 00000 n +0001026001 00000 n +0001026305 00000 n +0001029495 00000 n +0001029183 00000 n +0001026540 00000 n +0001029306 00000 n +0001029432 00000 n +0001032827 00000 n +0001032390 00000 n +0001029710 00000 n +0001032513 00000 n +0001032639 00000 n +0001032765 00000 n +0001034926 00000 n +0001054724 00000 n +0001052836 00000 n +0001034803 00000 n +0001033028 00000 n +0001052459 00000 n +0001052522 00000 n +0001052585 00000 n +0001052648 00000 n +0001052774 00000 n +0001052273 00000 n +0001079461 00000 n +0001077326 00000 n +0001054601 00000 n +0001053025 00000 n +0001076948 00000 n +0001077011 00000 n +0001077074 00000 n +0001077137 00000 n +0001077264 00000 n +0001076760 00000 n +0001108502 00000 n +0001106336 00000 n +0001079338 00000 n +0001077544 00000 n +0001106083 00000 n +0001106146 00000 n +0001106209 00000 n +0001106272 00000 n +0002187587 00000 n +0001105895 00000 n +0001349411 00000 n +0001133349 00000 n +0001108379 00000 n +0001106512 00000 n +0001132845 00000 n +0001132908 00000 n +0001132971 00000 n +0001133034 00000 n +0001133161 00000 n +0001133287 00000 n +0001132657 00000 n +0001387184 00000 n +0001138328 00000 n +0001138016 00000 n +0001133525 00000 n +0001138139 00000 n +0001138265 00000 n +0001141974 00000 n +0001141662 00000 n +0001138472 00000 n +0001141785 00000 n +0001141911 00000 n +0001146099 00000 n +0001145410 00000 n +0001142104 00000 n +0001145533 00000 n +0001145659 00000 n +0001145785 00000 n +0001145911 00000 n +0001146036 00000 n +0001149199 00000 n +0001149013 00000 n +0001146300 00000 n +0001149136 00000 n +0001413617 00000 n +0001153398 00000 n +0001152961 00000 n +0001149414 00000 n +0001153084 00000 n +0001153210 00000 n +0001153335 00000 n +0002187712 00000 n +0001158088 00000 n +0001157380 00000 n +0001153528 00000 n +0001157899 00000 n +0001157533 00000 n +0001157716 00000 n +0001158025 00000 n +0001163551 00000 n +0001162065 00000 n +0001158232 00000 n +0001163362 00000 n +0001163488 00000 n +0001162254 00000 n +0001162435 00000 n +0001162618 00000 n +0001162793 00000 n +0001163004 00000 n +0001163185 00000 n +0001453313 00000 n +0001168185 00000 n +0001167043 00000 n +0001163695 00000 n +0001167619 00000 n +0001167745 00000 n +0001167196 00000 n +0001167408 00000 n +0001167871 00000 n +0001167997 00000 n +0001168122 00000 n +0001476940 00000 n +0001502068 00000 n +0001172696 00000 n +0001172007 00000 n +0001168386 00000 n +0001172130 00000 n +0001172255 00000 n +0001172381 00000 n +0001172507 00000 n +0001172633 00000 n +0001177479 00000 n +0001176715 00000 n +0001172840 00000 n +0001177038 00000 n +0001177164 00000 n +0001176859 00000 n +0001177290 00000 n +0001177416 00000 n +0001182138 00000 n +0001181325 00000 n +0001177637 00000 n +0001181448 00000 n +0001181574 00000 n +0001181700 00000 n +0001181825 00000 n +0001181951 00000 n +0001182076 00000 n +0002187837 00000 n +0001186104 00000 n +0001185540 00000 n +0001182254 00000 n +0001185663 00000 n +0001185789 00000 n +0001185915 00000 n +0001186041 00000 n +0001188699 00000 n +0001187995 00000 n +0001186248 00000 n +0001188510 00000 n +0001188636 00000 n +0001188148 00000 n +0001188328 00000 n +0001191357 00000 n +0001191047 00000 n +0001188829 00000 n +0001191170 00000 n +0001191296 00000 n +0001195087 00000 n +0001194444 00000 n +0001191544 00000 n +0001194772 00000 n +0001194898 00000 n +0001195024 00000 n +0001194588 00000 n +0001197221 00000 n +0001196909 00000 n +0001195274 00000 n +0001197032 00000 n +0001197158 00000 n +0001201702 00000 n +0001201134 00000 n +0001197436 00000 n +0001201257 00000 n +0001201320 00000 n +0001201384 00000 n +0001201448 00000 n +0001201512 00000 n +0001201639 00000 n +0002187962 00000 n +0001205961 00000 n +0001205649 00000 n +0001201931 00000 n +0001205772 00000 n +0001205898 00000 n +0001208433 00000 n +0001208121 00000 n +0001206119 00000 n +0001208244 00000 n +0001208370 00000 n +0001211846 00000 n +0001211221 00000 n +0001208620 00000 n +0001211344 00000 n +0001211469 00000 n +0001211531 00000 n +0001211594 00000 n +0001211657 00000 n +0001211720 00000 n +0001211783 00000 n +0001215551 00000 n +0001214800 00000 n +0001211962 00000 n +0001214923 00000 n +0001215049 00000 n +0001215112 00000 n +0001215175 00000 n +0001215238 00000 n +0001215364 00000 n +0001215489 00000 n +0001219955 00000 n +0001219517 00000 n +0001215738 00000 n +0001219640 00000 n +0001219766 00000 n +0001219892 00000 n +0001224261 00000 n +0001223572 00000 n +0001220156 00000 n +0001223695 00000 n +0001223821 00000 n +0001223884 00000 n +0001223947 00000 n +0001224009 00000 n +0001224072 00000 n +0001224198 00000 n +0002027798 00000 n +0002025797 00000 n +0002027632 00000 n +0002188087 00000 n +0001228120 00000 n +0001227683 00000 n +0001224433 00000 n +0001227806 00000 n +0001227932 00000 n +0001228057 00000 n +0001231610 00000 n +0001231298 00000 n +0001228306 00000 n +0001231421 00000 n +0001231547 00000 n +0001235050 00000 n +0001234361 00000 n +0001231782 00000 n +0001234484 00000 n +0001234610 00000 n +0001234736 00000 n +0001234861 00000 n +0001234987 00000 n +0001237729 00000 n +0001237291 00000 n +0001235194 00000 n +0001237414 00000 n +0001237540 00000 n +0001237666 00000 n +0001240446 00000 n +0001239882 00000 n +0001237873 00000 n +0001240005 00000 n +0001240131 00000 n +0001240257 00000 n +0001240383 00000 n +0001242651 00000 n +0001242213 00000 n +0001240562 00000 n +0001242336 00000 n +0001242462 00000 n +0001242588 00000 n +0002188212 00000 n +0001245846 00000 n +0001245286 00000 n +0001242781 00000 n +0001245409 00000 n +0001245535 00000 n +0001245660 00000 n +0001245784 00000 n +0001248734 00000 n +0001248172 00000 n +0001246004 00000 n +0001248295 00000 n +0001248421 00000 n +0001248545 00000 n +0001248671 00000 n +0001252887 00000 n +0001252197 00000 n +0001248878 00000 n +0001252320 00000 n +0001252446 00000 n +0001252572 00000 n +0001252698 00000 n +0001252824 00000 n +0001256068 00000 n +0001255417 00000 n +0001253031 00000 n +0001255753 00000 n +0001255879 00000 n +0001256005 00000 n +0001255561 00000 n +0001262153 00000 n +0001260159 00000 n +0001256184 00000 n +0001261712 00000 n +0001260357 00000 n +0001260550 00000 n +0001261838 00000 n +0001260743 00000 n +0001260949 00000 n +0001261139 00000 n +0001261964 00000 n +0001262090 00000 n +0001261332 00000 n +0001261517 00000 n +0001269296 00000 n +0001266640 00000 n +0001262340 00000 n +0001268981 00000 n +0001269107 00000 n +0001269233 00000 n +0001266874 00000 n +0001267092 00000 n +0001267309 00000 n +0001267526 00000 n +0001267707 00000 n +0001267884 00000 n +0001268051 00000 n +0001268230 00000 n +0001268406 00000 n +0001268591 00000 n +0001268761 00000 n +0002188337 00000 n +0001275791 00000 n +0001273479 00000 n +0001269426 00000 n +0001275476 00000 n +0001275602 00000 n +0001273686 00000 n +0001273918 00000 n +0001274150 00000 n +0001274382 00000 n +0001274651 00000 n +0001275728 00000 n +0001274920 00000 n +0001275130 00000 n +0001275302 00000 n +0001282106 00000 n +0001280080 00000 n +0001275907 00000 n +0001281666 00000 n +0001281792 00000 n +0001280278 00000 n +0001280493 00000 n +0001280682 00000 n +0001280866 00000 n +0001281917 00000 n +0001281100 00000 n +0001281296 00000 n +0001282043 00000 n +0001281474 00000 n +0001291972 00000 n +0001286741 00000 n +0001282307 00000 n +0001291909 00000 n +0001287083 00000 n +0001287289 00000 n +0001287495 00000 n +0001287715 00000 n +0001287935 00000 n +0001288141 00000 n +0001288347 00000 n +0001288536 00000 n +0001288726 00000 n +0001288916 00000 n +0001289105 00000 n +0001289295 00000 n +0001289485 00000 n +0001289675 00000 n +0001289868 00000 n +0001290060 00000 n +0001290299 00000 n +0001290539 00000 n +0001290779 00000 n +0001291017 00000 n +0001291257 00000 n +0001291497 00000 n +0001291703 00000 n +0001297421 00000 n +0001295898 00000 n +0001292102 00000 n +0001297232 00000 n +0001296078 00000 n +0001296308 00000 n +0001296539 00000 n +0001296770 00000 n +0001297001 00000 n +0001297358 00000 n +0001301924 00000 n +0001301019 00000 n +0001297579 00000 n +0001301357 00000 n +0001301483 00000 n +0001301609 00000 n +0001301163 00000 n +0001301735 00000 n +0001301861 00000 n +0001305692 00000 n +0001305255 00000 n +0001302068 00000 n +0001305378 00000 n +0001305504 00000 n +0001305629 00000 n +0002188462 00000 n +0001309179 00000 n +0001308741 00000 n +0001305836 00000 n +0001308864 00000 n +0001308990 00000 n +0001309116 00000 n +0001313648 00000 n +0001313084 00000 n +0001309309 00000 n +0001313207 00000 n +0001313333 00000 n +0001313459 00000 n +0001313585 00000 n +0001316767 00000 n +0001315829 00000 n +0001313792 00000 n +0001315952 00000 n +0001316078 00000 n +0001316204 00000 n +0001316329 00000 n +0001316455 00000 n +0001316580 00000 n +0001316706 00000 n +0001320053 00000 n +0001319615 00000 n +0001316940 00000 n +0001319738 00000 n +0001319864 00000 n +0001319990 00000 n +0001322708 00000 n +0001322396 00000 n +0001320197 00000 n +0001322519 00000 n +0001322645 00000 n +0001324077 00000 n +0001323891 00000 n +0001322852 00000 n +0001324014 00000 n +0002188587 00000 n +0001325485 00000 n +0001325299 00000 n +0001324179 00000 n +0001325422 00000 n +0001326757 00000 n +0001326571 00000 n +0001325587 00000 n +0001326694 00000 n +0001327934 00000 n +0001327748 00000 n +0001326859 00000 n +0001327871 00000 n +0001329514 00000 n +0001329328 00000 n +0001328036 00000 n +0001329451 00000 n +0001333371 00000 n +0001333060 00000 n +0001329616 00000 n +0001333183 00000 n +0001333308 00000 n +0001338528 00000 n +0001338342 00000 n +0001333543 00000 n +0001338465 00000 n +0002188712 00000 n +0001344656 00000 n +0001343526 00000 n +0001338714 00000 n +0001343649 00000 n +0001343712 00000 n +0001343775 00000 n +0001343838 00000 n +0001343900 00000 n +0001343963 00000 n +0001344026 00000 n +0001344089 00000 n +0001344152 00000 n +0001344215 00000 n +0001344278 00000 n +0001344341 00000 n +0001344404 00000 n +0001344467 00000 n +0001344530 00000 n +0001344593 00000 n +0001528554 00000 n +0001348550 00000 n +0001348238 00000 n +0001344800 00000 n +0001348361 00000 n +0001348487 00000 n +0001386303 00000 n +0001349288 00000 n +0001348694 00000 n +0001386051 00000 n +0001386114 00000 n +0001386177 00000 n +0001386240 00000 n +0001385863 00000 n +0001412727 00000 n +0001387061 00000 n +0001386465 00000 n +0001412475 00000 n +0001412538 00000 n +0001412601 00000 n +0001412664 00000 n +0001412287 00000 n +0001452437 00000 n +0001413494 00000 n +0001412889 00000 n +0001452185 00000 n +0001452248 00000 n +0001452311 00000 n +0001452374 00000 n +0001451997 00000 n +0001476063 00000 n +0001453190 00000 n +0001452599 00000 n +0001475810 00000 n +0001475873 00000 n +0001475936 00000 n +0001475999 00000 n +0002188837 00000 n +0001475624 00000 n +0001501188 00000 n +0001476817 00000 n +0001476225 00000 n +0001500935 00000 n +0001500998 00000 n +0001501061 00000 n +0001501124 00000 n +0001500747 00000 n +0001526580 00000 n +0001501945 00000 n +0001501350 00000 n +0001526328 00000 n +0001526391 00000 n +0001526454 00000 n +0001526517 00000 n +0001526140 00000 n +0001527694 00000 n +0001527319 00000 n +0001526742 00000 n +0001527442 00000 n +0001527505 00000 n +0001527568 00000 n +0001527631 00000 n +0001624535 00000 n +0001528431 00000 n +0001527855 00000 n +0001624281 00000 n +0001624344 00000 n +0001624407 00000 n +0001624470 00000 n +0001624093 00000 n +0001627185 00000 n +0001626622 00000 n +0001624697 00000 n +0001626745 00000 n +0001626997 00000 n +0001627122 00000 n +0001631075 00000 n +0001630133 00000 n +0001627315 00000 n +0001630256 00000 n +0001630382 00000 n +0001630508 00000 n +0001630633 00000 n +0001630696 00000 n +0001630759 00000 n +0001630886 00000 n +0001631012 00000 n +0002188962 00000 n +0001635385 00000 n +0001633966 00000 n +0001631219 00000 n +0001634692 00000 n +0001634818 00000 n +0001634944 00000 n +0001635070 00000 n +0001634128 00000 n +0001634334 00000 n +0001635196 00000 n +0001634514 00000 n +0001635322 00000 n +0001639156 00000 n +0001638470 00000 n +0001635501 00000 n +0001638593 00000 n +0001638841 00000 n +0001638967 00000 n +0001639093 00000 n +0001643382 00000 n +0001642818 00000 n +0001639272 00000 n +0001642941 00000 n +0001643067 00000 n +0001643193 00000 n +0001643319 00000 n +0001647802 00000 n +0001647239 00000 n +0001643512 00000 n +0001647362 00000 n +0001647488 00000 n +0001647614 00000 n +0001647740 00000 n +0001652488 00000 n +0001651599 00000 n +0001647918 00000 n +0001651922 00000 n +0001652048 00000 n +0001652174 00000 n +0001652300 00000 n +0001651743 00000 n +0001652426 00000 n +0001657219 00000 n +0001656472 00000 n +0001652604 00000 n +0001656782 00000 n +0001656908 00000 n +0001656616 00000 n +0001657034 00000 n +0001657158 00000 n +0002189087 00000 n +0001660169 00000 n +0001659731 00000 n +0001657377 00000 n +0001659854 00000 n +0001659980 00000 n +0001660106 00000 n +0001664587 00000 n +0001663271 00000 n +0001660299 00000 n +0001664147 00000 n +0001663433 00000 n +0001663672 00000 n +0001663911 00000 n +0001664273 00000 n +0001664399 00000 n +0001664524 00000 n +0001667519 00000 n +0001667081 00000 n +0001664703 00000 n +0001667204 00000 n +0001667330 00000 n +0001667393 00000 n +0001667456 00000 n +0001668828 00000 n +0001668642 00000 n +0001667635 00000 n +0001668765 00000 n +0001670833 00000 n +0001670340 00000 n +0001668930 00000 n +0001670644 00000 n +0001670707 00000 n +0001670770 00000 n +0001670484 00000 n +0001984262 00000 n +0001674244 00000 n +0001673680 00000 n +0001670949 00000 n +0001673803 00000 n +0001673866 00000 n +0001673929 00000 n +0001674055 00000 n +0001674118 00000 n +0001674181 00000 n +0002189212 00000 n +0001676961 00000 n +0001676649 00000 n +0001674360 00000 n +0001676772 00000 n +0001676835 00000 n +0001676898 00000 n +0001678146 00000 n +0001677960 00000 n +0001677091 00000 n +0001678083 00000 n +0001681064 00000 n +0001680628 00000 n +0001678248 00000 n +0001680751 00000 n +0001680876 00000 n +0001681001 00000 n +0001685673 00000 n +0001684010 00000 n +0001681194 00000 n +0001684981 00000 n +0001685233 00000 n +0001685359 00000 n +0001684181 00000 n +0001684379 00000 n +0001684578 00000 n +0001684780 00000 n +0001685484 00000 n +0001685610 00000 n +0001690183 00000 n +0001689423 00000 n +0001685789 00000 n +0001690120 00000 n +0001689585 00000 n +0001689759 00000 n +0001689933 00000 n +0001693660 00000 n +0001693158 00000 n +0001690299 00000 n +0001693471 00000 n +0001693597 00000 n +0001693302 00000 n +0002189337 00000 n +0001695178 00000 n +0001694992 00000 n +0001693790 00000 n +0001695115 00000 n +0001698024 00000 n +0001696760 00000 n +0001695280 00000 n +0001697710 00000 n +0001696931 00000 n +0001697122 00000 n +0001697291 00000 n +0001697836 00000 n +0001697500 00000 n +0001697962 00000 n +0001702121 00000 n +0001701559 00000 n +0001698140 00000 n +0001701682 00000 n +0001701934 00000 n +0001702059 00000 n +0001707320 00000 n +0001706629 00000 n +0001702265 00000 n +0001707005 00000 n +0001706773 00000 n +0001707131 00000 n +0001707257 00000 n +0001712064 00000 n +0001711501 00000 n +0001707478 00000 n +0001711624 00000 n +0001711750 00000 n +0001711876 00000 n +0001712002 00000 n +0001716727 00000 n +0001716163 00000 n +0001712208 00000 n +0001716286 00000 n +0001716349 00000 n +0001716412 00000 n +0001716475 00000 n +0001716538 00000 n +0001716664 00000 n +0002189462 00000 n +0001721315 00000 n +0001720248 00000 n +0001716914 00000 n +0001720371 00000 n +0001720497 00000 n +0001720623 00000 n +0001720749 00000 n +0001720875 00000 n +0001720937 00000 n +0001721000 00000 n +0001721063 00000 n +0001721126 00000 n +0001721189 00000 n +0001721252 00000 n +0001724137 00000 n +0001723515 00000 n +0001721431 00000 n +0001723638 00000 n +0001723701 00000 n +0001723764 00000 n +0001723827 00000 n +0001723952 00000 n +0001724074 00000 n +0001727533 00000 n +0001726717 00000 n +0001724267 00000 n +0001726840 00000 n +0001727092 00000 n +0001727218 00000 n +0001727344 00000 n +0001727470 00000 n +0001731197 00000 n +0001730633 00000 n +0001727692 00000 n +0001730756 00000 n +0001730882 00000 n +0001731008 00000 n +0001731134 00000 n +0001735156 00000 n +0001734656 00000 n +0001731398 00000 n +0001734779 00000 n +0001734905 00000 n +0001735031 00000 n +0001735094 00000 n +0001740227 00000 n +0001739664 00000 n +0001735357 00000 n +0001739787 00000 n +0001739850 00000 n +0001739913 00000 n +0001739976 00000 n +0001740039 00000 n +0001740102 00000 n +0001740164 00000 n +0002189587 00000 n +0001745201 00000 n +0001744133 00000 n +0001740385 00000 n +0001744256 00000 n +0001744382 00000 n +0001744508 00000 n +0001744571 00000 n +0001744634 00000 n +0001744697 00000 n +0001744760 00000 n +0001744823 00000 n +0001744886 00000 n +0001744949 00000 n +0001745012 00000 n +0001745075 00000 n +0001745138 00000 n +0001746258 00000 n +0001746072 00000 n +0001745416 00000 n +0001746195 00000 n +0001750739 00000 n +0001749345 00000 n +0001746403 00000 n +0001749468 00000 n +0001749531 00000 n +0001749595 00000 n +0001749658 00000 n +0001749722 00000 n +0001749786 00000 n +0001749850 00000 n +0001749914 00000 n +0001749978 00000 n +0001750042 00000 n +0001750105 00000 n +0001750169 00000 n +0001750233 00000 n +0001750295 00000 n +0001750359 00000 n +0001750423 00000 n +0001750486 00000 n +0001750550 00000 n +0001750677 00000 n +0001755261 00000 n +0001754257 00000 n +0001750926 00000 n +0001754380 00000 n +0001754506 00000 n +0001754631 00000 n +0001754694 00000 n +0001754757 00000 n +0001754820 00000 n +0001754883 00000 n +0001754946 00000 n +0001755009 00000 n +0001755072 00000 n +0001755198 00000 n +0001759471 00000 n +0001758781 00000 n +0001755448 00000 n +0001758904 00000 n +0001759030 00000 n +0001759156 00000 n +0001759282 00000 n +0001759408 00000 n +0001763932 00000 n +0001763243 00000 n +0001759672 00000 n +0001763366 00000 n +0001763492 00000 n +0001763618 00000 n +0001763744 00000 n +0001763870 00000 n +0002189712 00000 n +0001768634 00000 n +0001768196 00000 n +0001764147 00000 n +0001768319 00000 n +0001768382 00000 n +0001768445 00000 n +0001768508 00000 n +0001768571 00000 n +0001772467 00000 n +0001771905 00000 n +0001768764 00000 n +0001772028 00000 n +0001772091 00000 n +0001772154 00000 n +0001772214 00000 n +0001772277 00000 n +0001772404 00000 n +0001776630 00000 n +0001776444 00000 n +0001772668 00000 n +0001776567 00000 n +0001780917 00000 n +0001780356 00000 n +0001776803 00000 n +0001780479 00000 n +0001780542 00000 n +0001780605 00000 n +0001780728 00000 n +0001780854 00000 n +0001784925 00000 n +0001784488 00000 n +0001781075 00000 n +0001784611 00000 n +0001784737 00000 n +0001784862 00000 n +0001786877 00000 n +0001786691 00000 n +0001785027 00000 n +0001786814 00000 n +0002189837 00000 n +0001790827 00000 n +0001790217 00000 n +0001787050 00000 n +0001790512 00000 n +0001790361 00000 n +0001790764 00000 n +0001795163 00000 n +0001794726 00000 n +0001791000 00000 n +0001794849 00000 n +0001794974 00000 n +0001795100 00000 n +0001799485 00000 n +0001798963 00000 n +0001795293 00000 n +0001799296 00000 n +0001799422 00000 n +0001799107 00000 n +0001804411 00000 n +0001804225 00000 n +0001799629 00000 n +0001804348 00000 n +0001809086 00000 n +0001808900 00000 n +0001804541 00000 n +0001809023 00000 n +0001812131 00000 n +0001811570 00000 n +0001809230 00000 n +0001811693 00000 n +0001811818 00000 n +0001811943 00000 n +0001812069 00000 n +0002189962 00000 n +0001814824 00000 n +0001814638 00000 n +0001812261 00000 n +0001814761 00000 n +0001819489 00000 n +0001818647 00000 n +0001814940 00000 n +0001819174 00000 n +0001819300 00000 n +0001818800 00000 n +0001818988 00000 n +0001819426 00000 n +0001823943 00000 n +0001823504 00000 n +0001819676 00000 n +0001823627 00000 n +0001823753 00000 n +0001823816 00000 n +0001823879 00000 n +0001827506 00000 n +0001826510 00000 n +0001824130 00000 n +0001827192 00000 n +0001826672 00000 n +0001826848 00000 n +0001827019 00000 n +0001827318 00000 n +0001827443 00000 n +0001830026 00000 n +0001829337 00000 n +0001827622 00000 n +0001829460 00000 n +0001829586 00000 n +0001829712 00000 n +0001829838 00000 n +0001829963 00000 n +0001831589 00000 n +0001831403 00000 n +0001830142 00000 n +0001831526 00000 n +0002190087 00000 n +0001834742 00000 n +0001834180 00000 n +0001831691 00000 n +0001834303 00000 n +0001834554 00000 n +0001834679 00000 n +0001838689 00000 n +0001838251 00000 n +0001834887 00000 n +0001838374 00000 n +0001838500 00000 n +0001838626 00000 n +0001841567 00000 n +0001841006 00000 n +0001838819 00000 n +0001841129 00000 n +0001841255 00000 n +0001841380 00000 n +0001841504 00000 n +0001845347 00000 n +0001845035 00000 n +0001841697 00000 n +0001845158 00000 n +0001845284 00000 n +0001849640 00000 n +0001849203 00000 n +0001845463 00000 n +0001849326 00000 n +0001849451 00000 n +0001849577 00000 n +0001851811 00000 n +0001851625 00000 n +0001849798 00000 n +0001851748 00000 n +0002190212 00000 n +0001855183 00000 n +0001854622 00000 n +0001851913 00000 n +0001854745 00000 n +0001854871 00000 n +0001854995 00000 n +0001855121 00000 n +0001858781 00000 n +0001858091 00000 n +0001855313 00000 n +0001858214 00000 n +0001858340 00000 n +0001858466 00000 n +0001858592 00000 n +0001858718 00000 n +0001860105 00000 n +0001859919 00000 n +0001858911 00000 n +0001860042 00000 n +0001864379 00000 n +0001863498 00000 n +0001860207 00000 n +0001863814 00000 n +0001864066 00000 n +0001864192 00000 n +0001863642 00000 n +0001864318 00000 n +0001867890 00000 n +0001867005 00000 n +0001864509 00000 n +0001867576 00000 n +0001867702 00000 n +0001867827 00000 n +0001867158 00000 n +0001867367 00000 n +0001869560 00000 n +0001868996 00000 n +0001868034 00000 n +0001869119 00000 n +0001869371 00000 n +0001869497 00000 n +0002190337 00000 n +0001870577 00000 n +0001870139 00000 n +0001869648 00000 n +0001870262 00000 n +0001870514 00000 n +0001871237 00000 n +0001870989 00000 n +0001870665 00000 n +0001871112 00000 n +0001873990 00000 n +0001873067 00000 n +0001871325 00000 n +0001873361 00000 n +0001873424 00000 n +0001873676 00000 n +0001873211 00000 n +0001873802 00000 n +0001873928 00000 n +0001877513 00000 n +0001876949 00000 n +0001874092 00000 n +0001877072 00000 n +0001877324 00000 n +0001877450 00000 n +0001881751 00000 n +0001881314 00000 n +0001877615 00000 n +0001881437 00000 n +0001881563 00000 n +0001881689 00000 n +0001886177 00000 n +0001885613 00000 n +0001881853 00000 n +0001885736 00000 n +0001885862 00000 n +0001885988 00000 n +0001886114 00000 n +0002190462 00000 n +0001891556 00000 n +0001889669 00000 n +0001886321 00000 n +0001889792 00000 n +0001889918 00000 n +0001889981 00000 n +0001890044 00000 n +0001890107 00000 n +0001890170 00000 n +0001890233 00000 n +0001890296 00000 n +0001890359 00000 n +0001890422 00000 n +0001890485 00000 n +0001890547 00000 n +0001890610 00000 n +0001890673 00000 n +0001890736 00000 n +0001890799 00000 n +0001890862 00000 n +0001890925 00000 n +0001890988 00000 n +0001891051 00000 n +0001891114 00000 n +0001891240 00000 n +0001891303 00000 n +0001891366 00000 n +0001891493 00000 n +0001894802 00000 n +0001894363 00000 n +0001891714 00000 n +0001894486 00000 n +0001894549 00000 n +0001894612 00000 n +0001894739 00000 n +0001896263 00000 n +0001896077 00000 n +0001894946 00000 n +0001896200 00000 n +0001899628 00000 n +0001899065 00000 n +0001896365 00000 n +0001899188 00000 n +0001899439 00000 n +0001899565 00000 n +0001903381 00000 n +0001902630 00000 n +0001899801 00000 n +0001902940 00000 n +0001903066 00000 n +0001903129 00000 n +0001903192 00000 n +0001903255 00000 n +0001903318 00000 n +0001902774 00000 n +0001907752 00000 n +0001906995 00000 n +0001903525 00000 n +0001907311 00000 n +0001907437 00000 n +0001907139 00000 n +0001907563 00000 n +0001907689 00000 n +0002190587 00000 n +0001912227 00000 n +0001911411 00000 n +0001907995 00000 n +0001911534 00000 n +0001911660 00000 n +0001911786 00000 n +0001911912 00000 n +0001912038 00000 n +0001912164 00000 n +0001912918 00000 n +0001912670 00000 n +0001912357 00000 n +0001912793 00000 n +0001916133 00000 n +0001915506 00000 n +0001913006 00000 n +0001915629 00000 n +0001915692 00000 n +0001915944 00000 n +0001916070 00000 n +0001920328 00000 n +0001919827 00000 n +0001916306 00000 n +0001919950 00000 n +0001920076 00000 n +0001920139 00000 n +0001920202 00000 n +0001920265 00000 n +0001924461 00000 n +0001924149 00000 n +0001920515 00000 n +0001924272 00000 n +0001924335 00000 n +0001924398 00000 n +0001929671 00000 n +0001928732 00000 n +0001924662 00000 n +0001928855 00000 n +0001928918 00000 n +0001928981 00000 n +0001929044 00000 n +0001929106 00000 n +0001929169 00000 n +0001929232 00000 n +0001929295 00000 n +0001929358 00000 n +0001929421 00000 n +0001929484 00000 n +0001929547 00000 n +0001929609 00000 n +0002190712 00000 n +0001934076 00000 n +0001933405 00000 n +0001929886 00000 n +0001933699 00000 n +0001933762 00000 n +0001933825 00000 n +0001933887 00000 n +0001934013 00000 n +0001933549 00000 n +0001938153 00000 n +0001937224 00000 n +0001934234 00000 n +0001937714 00000 n +0001937966 00000 n +0001937377 00000 n +0001937545 00000 n +0001938091 00000 n +0001943622 00000 n +0001942218 00000 n +0001938255 00000 n +0001943308 00000 n +0001943434 00000 n +0001942398 00000 n +0001942589 00000 n +0001942780 00000 n +0001943559 00000 n +0001942970 00000 n +0001943135 00000 n +0001947077 00000 n +0001946366 00000 n +0001943766 00000 n +0001946888 00000 n +0001947014 00000 n +0001946519 00000 n +0001946690 00000 n +0001951448 00000 n +0001950219 00000 n +0001947221 00000 n +0001950881 00000 n +0001951133 00000 n +0001950381 00000 n +0001950557 00000 n +0001951259 00000 n +0001950728 00000 n +0001951385 00000 n +0001955575 00000 n +0001955012 00000 n +0001951550 00000 n +0001955135 00000 n +0001955260 00000 n +0001955386 00000 n +0001955512 00000 n +0002190837 00000 n +0001956255 00000 n +0001956007 00000 n +0001955705 00000 n +0001956130 00000 n +0001961762 00000 n +0001959458 00000 n +0001956343 00000 n +0001960693 00000 n +0001960756 00000 n +0001959647 00000 n +0001961008 00000 n +0001961134 00000 n +0001959813 00000 n +0001959992 00000 n +0001961260 00000 n +0001961386 00000 n +0001960172 00000 n +0001961512 00000 n +0001960351 00000 n +0001960522 00000 n +0001961575 00000 n +0001961638 00000 n +0001961700 00000 n +0001966521 00000 n +0001965057 00000 n +0001961878 00000 n +0001965955 00000 n +0001966018 00000 n +0001966081 00000 n +0001966207 00000 n +0001965228 00000 n +0001965413 00000 n +0001965600 00000 n +0001965788 00000 n +0001966333 00000 n +0001966459 00000 n +0001969598 00000 n +0001969034 00000 n +0001966637 00000 n +0001969157 00000 n +0001969283 00000 n +0001969409 00000 n +0001969535 00000 n +0001972804 00000 n +0001972366 00000 n +0001969728 00000 n +0001972489 00000 n +0001972615 00000 n +0001972741 00000 n +0001975546 00000 n +0001975109 00000 n +0001972977 00000 n +0001975232 00000 n +0001975357 00000 n +0001975483 00000 n +0002190962 00000 n +0001979584 00000 n +0001978706 00000 n +0001975747 00000 n +0001979017 00000 n +0001979269 00000 n +0001979395 00000 n +0001978850 00000 n +0001979521 00000 n +0001981237 00000 n +0001980925 00000 n +0001979686 00000 n +0001981048 00000 n +0001981174 00000 n +0001984325 00000 n +0001983510 00000 n +0001981353 00000 n +0001983633 00000 n +0001983759 00000 n +0001983885 00000 n +0001984010 00000 n +0001984136 00000 n +0001989550 00000 n +0001987673 00000 n +0001984427 00000 n +0001988983 00000 n +0001989235 00000 n +0001987862 00000 n +0001988034 00000 n +0001988224 00000 n +0001988409 00000 n +0001988601 00000 n +0001989361 00000 n +0001989487 00000 n +0001988788 00000 n +0001994622 00000 n +0001993188 00000 n +0001989652 00000 n +0001993929 00000 n +0001994055 00000 n +0001993350 00000 n +0001993548 00000 n +0001993740 00000 n +0001994181 00000 n +0001994307 00000 n +0001994433 00000 n +0001994559 00000 n +0001999174 00000 n +0001998169 00000 n +0001994752 00000 n +0001998482 00000 n +0001998608 00000 n +0001998734 00000 n +0001998313 00000 n +0001998859 00000 n +0001998985 00000 n +0001999111 00000 n +0002191087 00000 n +0002003231 00000 n +0002002261 00000 n +0001999318 00000 n +0002002791 00000 n +0002002917 00000 n +0002003042 00000 n +0002002414 00000 n +0002003168 00000 n +0002002582 00000 n +0002007107 00000 n +0002006419 00000 n +0002003460 00000 n +0002006542 00000 n +0002006794 00000 n +0002006920 00000 n +0002007046 00000 n +0002010899 00000 n +0002010084 00000 n +0002007209 00000 n +0002010207 00000 n +0002010333 00000 n +0002010458 00000 n +0002010584 00000 n +0002010710 00000 n +0002010836 00000 n +0002014485 00000 n +0002013743 00000 n +0002011015 00000 n +0002014044 00000 n +0002014170 00000 n +0002013887 00000 n +0002014296 00000 n +0002014422 00000 n +0002015531 00000 n +0002015093 00000 n +0002014601 00000 n +0002015216 00000 n +0002015468 00000 n +0002024685 00000 n +0002018460 00000 n +0002015619 00000 n +0002024118 00000 n +0002024370 00000 n +0002018838 00000 n +0002019025 00000 n +0002019216 00000 n +0002019386 00000 n +0002019585 00000 n +0002019780 00000 n +0002019969 00000 n +0002020161 00000 n +0002020356 00000 n +0002020541 00000 n +0002020734 00000 n +0002020929 00000 n +0002021128 00000 n +0002021327 00000 n +0002021511 00000 n +0002021720 00000 n +0002021913 00000 n +0002022106 00000 n +0002022301 00000 n +0002022490 00000 n +0002022699 00000 n +0002022891 00000 n +0002023066 00000 n +0002023276 00000 n +0002024496 00000 n +0002023486 00000 n +0002023696 00000 n +0002023907 00000 n +0002024622 00000 n +0002191212 00000 n +0002024801 00000 n +0002028013 00000 n +0002028044 00000 n +0002031474 00000 n +0002031617 00000 n +0002036881 00000 n +0002037072 00000 n +0002040821 00000 n +0002047363 00000 n +0002059554 00000 n +0002059969 00000 n +0002070523 00000 n +0002070773 00000 n +0002091459 00000 n +0002101999 00000 n +0002104497 00000 n +0002104528 00000 n +0002108367 00000 n +0002124960 00000 n +0002125370 00000 n +0002143807 00000 n +0002163621 00000 n +0002167623 00000 n +0002182794 00000 n +0002191292 00000 n +0002191418 00000 n +0002191544 00000 n +0002191670 00000 n +0002191796 00000 n +0002191922 00000 n +0002192048 00000 n +0002192174 00000 n +0002192300 00000 n +0002192426 00000 n +0002192552 00000 n +0002192669 00000 n +0002192796 00000 n +0002192914 00000 n +0002192988 00000 n +0002263929 00000 n +0002312718 00000 n +0002312759 00000 n +0002312799 00000 n +0002313031 00000 n trailer << -/Size 3776 -/Root 3774 0 R -/Info 3775 0 R +/Size 6741 +/Root 6739 0 R +/Info 6740 0 R >> startxref -1081637 +2313187 %%EOF diff --git a/docs/docbook/.cvsignore b/docs/docbook/.cvsignore index 052b1cf2a2..c096f1e488 100644 --- a/docs/docbook/.cvsignore +++ b/docs/docbook/.cvsignore @@ -3,4 +3,4 @@ config.cache config.log config.status samba-doc.* -dev-doc.* \ No newline at end of file +dev-doc.* diff --git a/docs/docbook/Makefile.in b/docs/docbook/Makefile.in index 6dad4664fd..ba3d0845ef 100644 --- a/docs/docbook/Makefile.in +++ b/docs/docbook/Makefile.in @@ -30,16 +30,23 @@ MANPAGES_NAMES=findsmb.1 smbclient.1 \ XSLTPROC = @XSLTPROC@ PDFLATEX = @PDFLATEX@ +LATEX = @LATEX@ +DVIPS = @DVIPS@ HTMLDOC = @HTMLDOC@ +PNGTOPNM = @PNGTOPNM@ +PNMTOPS = @PNMTOPS@ +XMLTO = @XMLTO@ SRCDIR = @srcdir@ MANDIR=../manpages HTMLDIR=../htmldocs MANPROJDOC = manpages PROJDOC = projdoc +IMAGEPROJDIR = $(PROJDOC)/imagefiles DEVDOC = devdoc SMBDOTCONFDOC = smbdotconf PSDIR = .. PDFDIR = .. +DVIDIR = .. TXTDIR = ../textdocs FAQPROJDOC = faq FAQDIR = ../faq @@ -47,53 +54,114 @@ FAQDIR = ../faq MANPAGES=$(patsubst %,$(MANDIR)/%,$(MANPAGES_NAMES)) MANPAGES_HTML=$(patsubst %,$(HTMLDIR)/%.html,$(MANPAGES_NAMES)) +PROJDOC_IMAGES_PNG = $(wildcard $(IMAGEPROJDIR)/*.png) +PROJDOC_IMAGES_EPS=$(patsubst %.png,%.eps,$(wildcard $(IMAGEPROJDIR)/*.png)) +PROJDOC_DEPS = $(PROJDOC)/*.xml $(PROJDOC)/attributions.xml +DEVDOC_DEPS = $(DEVDOC)/*.xml $(DEVDOC)/attributions.xml + all: @echo "Supported make targets:" @echo "manpages - Build manpages" - @echo "pdf - Build PDF version of HOWTO Collection" + @echo "pdf - Build PDF version of HOWTO Collection and Developers Guide" + @echo "tex - Build Latex version of HOWTO Collection and Developers Guide" + @echo "dvi - Build Device Independant Files of HOWTO Collection and Developers Guide" + @echo "ps - Build PostScript version of HOWTO Collection and Developers Guide" + @echo "txt - Build plain text version of HOWTO Collection and Developers Guide" @echo -n "html-single - Build single file HTML version of HOWTO Collection" @echo " and developers guide" - @echo "html - Build HTML version of HOWTO Collection" + @echo "html - Build HTML version of HOWTO Collection and Developers Guide" @echo "htmlman - Build html version of manpages" @echo "htmlfaq - Build html version of the FAQ" + @echo "undocumented - Output list of undocumented smb.conf options" @echo "everything - Build all of the above" -everything: manpages pdf html-single html htmlman htmlfaq +everything: manpages pdf html-single html htmlman htmlfaq txt ps # Global rules manpages: $(MANDIR) $(MANPAGES) +tex: samba-doc.tex dev-doc.tex pdf: $(PDFDIR) $(PDFDIR)/Samba-HOWTO-Collection.pdf $(PDFDIR)/Samba-Developers-Guide.pdf +dvi: $(DVIDIR) $(DVIDIR)/Samba-HOWTO-Collection.dvi $(DVIDIR)/Samba-Developers-Guide.dvi +ps: $(PSDIR) $(PSDIR)/Samba-HOWTO-Collection.ps $(PSDIR)/Samba-Developers-Guide.ps +hpdf: $(PDFDIR) $(PDFDIR)/Samba-HOWTO-Collection.pdf +txt: $(TXTDIR) $(TXTDIR)/Samba-HOWTO-Collection.txt $(TXTDIR)/Samba-Developers-Guide.txt htmlman: $(HTMLDIR) $(MANPAGES_HTML) CSS htmlfaq: $(HTMLDIR) CSS @$(XSLTPROC) --stringparam base.dir "$(FAQDIR)/" --stringparam root.filename samba-faq xslt/html-chunk.xsl $(FAQPROJDOC)/sambafaq.xml html-single: $(HTMLDIR) CSS $(HTMLDIR)/Samba-HOWTO-Collection.html $(HTMLDIR)/Samba-Developers-Guide.html -html: $(HTMLDIR) CSS +html: $(HTMLDIR) CSS $(PROJDOC_DEPS) @$(XSLTPROC) xslt/html-chunk.xsl $(PROJDOC)/samba-doc.xml # Text files +$(TXTDIR): + mkdir $(TXTDIR) -# Adobe PDF files -$(PDFDIR)/Samba-HOWTO-Collection.pdf: $(PROJDOC)/samba-doc.xml +$(TXTDIR)/Samba-HOWTO-Collection.txt: $(PROJDOC)/samba-doc.xml $(PROJDOC_DEPS) + @echo "Converting samba-doc to plain text..." + @$(XMLTO) txt -o $(TXTDIR) $< + @mv $(TXTDIR)/samba-doc.txt $(TXTDIR)/Samba-HOWTO-Collection.txt + +$(TXTDIR)/Samba-Developers-Guide.txt: $(DEVDOC)/dev-doc.xml $(DEVDOC_DEPS) + @echo "Converting dev-doc to plain text..." + @$(XMLTO) txt -o $(TXTDIR) $< + @mv $(TXTDIR)/dev-doc.txt $(TXTDIR)/Samba-Developers-Guide.txt + +# Tex files +samba-doc.tex: $(PROJDOC)/samba-doc.xml $(PROJDOC_DEPS) @echo "Converting samba-doc to LaTeX..." - @$(XSLTPROC) --output samba-doc.tex xslt/latex.xsl $< + @$(XSLTPROC) --output $@ xslt/latex.xsl $< + +dev-doc.tex: $(DEVDOC)/dev-doc.xml $(DEVDOC_DEPS) + @echo "Converting dev-doc to LaTeX..." + @$(XSLTPROC) --output $@ xslt/latex.xsl $< + +# Adobe PDF files +$(PDFDIR)/Samba-HOWTO-Collection.pdf: samba-doc.tex $(PROJDOC_IMAGES_PNG) @echo "Building LaTeX sources via $(PDFLATEX)..." - @$(PDFLATEX) samba-doc.tex | grep 'Rerun to get cross-references right' && \ - $(PDFLATEX) samba-doc.tex | grep 'Rerun to get cross-references right' && \ - $(PDFLATEX) samba-doc.tex || echo + @$(PDFLATEX) $< | grep 'Rerun to get cross-references right' && \ + $(PDFLATEX) $< | grep 'Rerun to get cross-references right' && \ + $(PDFLATEX) $< || echo @echo "done" @mv samba-doc.pdf $@ -$(PDFDIR)/Samba-Developers-Guide.pdf: $(DEVDOC)/dev-doc.xml - @echo "Converting dev-doc to LaTeX..." - @$(XSLTPROC) --output dev-doc.tex xslt/latex.xsl $< +$(PDFDIR)/Samba-Developers-Guide.pdf: dev-doc.tex @echo "Building LaTeX sources via $(PDFLATEX)..." - @$(PDFLATEX) dev-doc.tex | grep 'Rerun to get cross-references right' && \ - $(PDFLATEX) dev-doc.tex | grep 'Rerun to get cross-references right' && \ - $(PDFLATEX) dev-doc.tex || echo + @$(PDFLATEX) $< | grep 'Rerun to get cross-references right' && \ + $(PDFLATEX) $< | grep 'Rerun to get cross-references right' && \ + $(PDFLATEX) $< || echo @echo "done" @mv dev-doc.pdf $@ +epsimages: $(PROJDOC_IMAGES_EPS) + +# DVI files +$(DVIDIR)/Samba-HOWTO-Collection.dvi: samba-doc.tex $(PROJDOC_IMAGES_EPS) + @echo "Building LaTeX sources via $(LATEX)..." + @$(LATEX) $< 2>&1 | grep 'Rerun to get cross-references right' && \ + $(LATEX) $< 2>&1 | grep 'Rerun to get cross-references right' && \ + $(LATEX) $< 2>&1 || echo + @echo "done" + @mv samba-doc.dvi $@ + +$(DVIDIR)/Samba-Developers-Guide.dvi: dev-doc.tex + @echo "Building LaTeX sources via $(LATEX)..." + @$(LATEX) $< 2>&1 | grep 'Rerun to get cross-references right' && \ + $(LATEX) $< 2>&1 | grep 'Rerun to get cross-references right' && \ + $(LATEX) $< 2>&1 || echo + @echo "done" + @mv dev-doc.dvi $@ + +$(IMAGEPROJDIR)/%.eps: $(IMAGEPROJDIR)/%.png + @$(PNGTOPNM) $< | $(PNMTOPS) > $@ + +# PostScript files +$(PSDIR)/Samba-HOWTO-Collection.ps: $(DVIDIR)/Samba-HOWTO-Collection.dvi + $(DVIPS) -o $@ $< + +$(PSDIR)/Samba-Developers-Guide.ps: $(DVIDIR)/Samba-Developers-Guide.dvi + $(DVIPS) -o $@ $< + # Single large HTML files $(HTMLDIR): @@ -102,10 +170,10 @@ $(HTMLDIR): CSS: $(HTMLDIR) xslt/html/samba.css @cp xslt/html/samba.css $(HTMLDIR)/ -$(HTMLDIR)/Samba-HOWTO-Collection.html: $(PROJDOC)/samba-doc.xml +$(HTMLDIR)/Samba-HOWTO-Collection.html: $(PROJDOC)/samba-doc.xml $(PROJDOC_DEPS) $(PROJDOC_IMAGES_PNG) @$(XSLTPROC) --output $@ xslt/html.xsl $< -$(HTMLDIR)/Samba-Developers-Guide.html: $(DEVDOC)/dev-doc.xml +$(HTMLDIR)/Samba-Developers-Guide.html: $(DEVDOC)/dev-doc.xml $(DEVDOC_DEPS) @$(XSLTPROC) --output $@ xslt/html.xsl $< @@ -139,14 +207,28 @@ $(MANPROJDOC)/smb.conf.5.xml: $(SMBDOTCONFDOC)/smb.conf.5.xml $(SMBDOTCONFDOC)/p $(SMBDOTCONFDOC)/expand-smb.conf.xsl @$(XSLTPROC) --xinclude --output $(MANPROJDOC)/smb.conf.5.xml $(SMBDOTCONFDOC)/expand-smb.conf.xsl $(SMBDOTCONFDOC)/smb.conf.5.xml +$(PROJDOC)/attributions.xml: $(PROJDOC)/samba-doc.xml + @echo > $@ # Make sure we don't get recursive dependencies, etc! + @echo "Generating attributions page" + @$(XSLTPROC) --output $@ xslt/generate-attributions.xsl $< + +$(DEVDOC)/attributions.xml: $(DEVDOC)/dev-doc.xml + @echo > $@ # Make sure we don't get recursive dependencies, etc! + @echo "Generating attributions page" + @$(XSLTPROC) --output $@ xslt/generate-attributions.xsl $< + $(MANDIR): mkdir $(MANDIR) $(MANDIR)/%: $(MANPROJDOC)/%.xml @$(XSLTPROC) xslt/man.xsl $< +undocumented: $(SMBDOTCONFDOC)/parameters.all.xml + $(PERL) scripts/find_missing_doc.pl ../.. + clean: @rm -f $(MANPAGES) $(MANPAGES_HTML) $(HTMLDIR)/*.html $(HTMLDIR)/*.css $(TXTDIR)/*.txt $(PSDIR)/*.ps $(PDFDIR)/*.pdf - @rm -f $(MANPROJDOC)/smb.conf.5.xml $(SMBDOTCONFDOC)/parameters.*.xml - @rm -f samba-doc.* dev-doc.* + @rm -f $(MANPROJDOC)/smb.conf.5.xml $(SMBDOTCONFDOC)/parameters.*.xml $(DVIDIR)/*.dvi + @rm -f samba-doc.* dev-doc.* $(PROJDOC)/attributions.xml + @rm -f $(IMAGEPROJDIR)/*.eps diff --git a/docs/docbook/configure b/docs/docbook/configure index 690e16437a..303ea97f57 100755 --- a/docs/docbook/configure +++ b/docs/docbook/configure @@ -1,287 +1,26 @@ #! /bin/sh + # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.57. +# Generated automatically using autoconf version 2.13 +# Copyright (C) 1992, 93, 94, 95, 96 Free Software Foundation, Inc. # -# Copyright 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, 2002 -# Free Software Foundation, Inc. # This configure script is free software; the Free Software Foundation # gives unlimited permission to copy, distribute and modify it. -## --------------------- ## -## M4sh Initialization. ## -## --------------------- ## - -# Be Bourne compatible -if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then - emulate sh - NULLCMD=: - # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which - # is contrary to our usage. Disable this feature. - alias -g '${1+"$@"}'='"$@"' -elif test -n "${BASH_VERSION+set}" && (set -o posix) >/dev/null 2>&1; then - set -o posix -fi - -# Support unset when possible. -if (FOO=FOO; unset FOO) >/dev/null 2>&1; then - as_unset=unset -else - as_unset=false -fi - - -# Work around bugs in pre-3.0 UWIN ksh. -$as_unset ENV MAIL MAILPATH -PS1='$ ' -PS2='> ' -PS4='+ ' - -# NLS nuisances. -for as_var in \ - LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \ - LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \ - LC_TELEPHONE LC_TIME -do - if (set +x; test -n "`(eval $as_var=C; export $as_var) 2>&1`"); then - eval $as_var=C; export $as_var - else - $as_unset $as_var - fi -done - -# Required to use basename. -if expr a : '\(a\)' >/dev/null 2>&1; then - as_expr=expr -else - as_expr=false -fi - -if (basename /) >/dev/null 2>&1 && test "X`basename / 2>&1`" = "X/"; then - as_basename=basename -else - as_basename=false -fi - - -# Name of the executable. -as_me=`$as_basename "$0" || -$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ - X"$0" : 'X\(//\)$' \| \ - X"$0" : 'X\(/\)$' \| \ - . : '\(.\)' 2>/dev/null || -echo X/"$0" | - sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/; q; } - /^X\/\(\/\/\)$/{ s//\1/; q; } - /^X\/\(\/\).*/{ s//\1/; q; } - s/.*/./; q'` - - -# PATH needs CR, and LINENO needs CR and PATH. -# Avoid depending upon Character Ranges. -as_cr_letters='abcdefghijklmnopqrstuvwxyz' -as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' -as_cr_Letters=$as_cr_letters$as_cr_LETTERS -as_cr_digits='0123456789' -as_cr_alnum=$as_cr_Letters$as_cr_digits - -# The user is always right. -if test "${PATH_SEPARATOR+set}" != set; then - echo "#! /bin/sh" >conf$$.sh - echo "exit 0" >>conf$$.sh - chmod +x conf$$.sh - if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then - PATH_SEPARATOR=';' - else - PATH_SEPARATOR=: - fi - rm -f conf$$.sh -fi - - - as_lineno_1=$LINENO - as_lineno_2=$LINENO - as_lineno_3=`(expr $as_lineno_1 + 1) 2>/dev/null` - test "x$as_lineno_1" != "x$as_lineno_2" && - test "x$as_lineno_3" = "x$as_lineno_2" || { - # Find who we are. Look in the path if we contain no path at all - # relative or not. - case $0 in - *[\\/]* ) as_myself=$0 ;; - *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR -for as_dir in $PATH -do - IFS=$as_save_IFS - test -z "$as_dir" && as_dir=. - test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break -done - - ;; - esac - # We did not find ourselves, most probably we were run as `sh COMMAND' - # in which case we are not to be found in the path. - if test "x$as_myself" = x; then - as_myself=$0 - fi - if test ! -f "$as_myself"; then - { echo "$as_me: error: cannot find myself; rerun with an absolute path" >&2 - { (exit 1); exit 1; }; } - fi - case $CONFIG_SHELL in - '') - as_save_IFS=$IFS; IFS=$PATH_SEPARATOR -for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH -do - IFS=$as_save_IFS - test -z "$as_dir" && as_dir=. - for as_base in sh bash ksh sh5; do - case $as_dir in - /*) - if ("$as_dir/$as_base" -c ' - as_lineno_1=$LINENO - as_lineno_2=$LINENO - as_lineno_3=`(expr $as_lineno_1 + 1) 2>/dev/null` - test "x$as_lineno_1" != "x$as_lineno_2" && - test "x$as_lineno_3" = "x$as_lineno_2" ') 2>/dev/null; then - $as_unset BASH_ENV || test "${BASH_ENV+set}" != set || { BASH_ENV=; export BASH_ENV; } - $as_unset ENV || test "${ENV+set}" != set || { ENV=; export ENV; } - CONFIG_SHELL=$as_dir/$as_base - export CONFIG_SHELL - exec "$CONFIG_SHELL" "$0" ${1+"$@"} - fi;; - esac - done -done -;; - esac - - # Create $as_me.lineno as a copy of $as_myself, but with $LINENO - # uniformly replaced by the line number. The first 'sed' inserts a - # line-number line before each line; the second 'sed' does the real - # work. The second script uses 'N' to pair each line-number line - # with the numbered line, and appends trailing '-' during - # substitution so that $LINENO is not a special case at line end. - # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the - # second 'sed' script. Blame Lee E. McMahon for sed's syntax. :-) - sed '=' <$as_myself | - sed ' - N - s,$,-, - : loop - s,^\(['$as_cr_digits']*\)\(.*\)[$]LINENO\([^'$as_cr_alnum'_]\),\1\2\1\3, - t loop - s,-$,, - s,^['$as_cr_digits']*\n,, - ' >$as_me.lineno && - chmod +x $as_me.lineno || - { echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2 - { (exit 1); exit 1; }; } - - # Don't try to exec as it changes $[0], causing all sort of problems - # (the dirname of $[0] is not the place where we might find the - # original and so on. Autoconf is especially sensible to this). - . ./$as_me.lineno - # Exit status is that of the last command. - exit -} - - -case `echo "testing\c"; echo 1,2,3`,`echo -n testing; echo 1,2,3` in - *c*,-n*) ECHO_N= ECHO_C=' -' ECHO_T=' ' ;; - *c*,* ) ECHO_N=-n ECHO_C= ECHO_T= ;; - *) ECHO_N= ECHO_C='\c' ECHO_T= ;; -esac - -if expr a : '\(a\)' >/dev/null 2>&1; then - as_expr=expr -else - as_expr=false -fi - -rm -f conf$$ conf$$.exe conf$$.file -echo >conf$$.file -if ln -s conf$$.file conf$$ 2>/dev/null; then - # We could just check for DJGPP; but this test a) works b) is more generic - # and c) will remain valid once DJGPP supports symlinks (DJGPP 2.04). - if test -f conf$$.exe; then - # Don't use ln at all; we don't have any links - as_ln_s='cp -p' - else - as_ln_s='ln -s' - fi -elif ln conf$$.file conf$$ 2>/dev/null; then - as_ln_s=ln -else - as_ln_s='cp -p' -fi -rm -f conf$$ conf$$.exe conf$$.file - -if mkdir -p . 2>/dev/null; then - as_mkdir_p=: -else - as_mkdir_p=false -fi - -as_executable_p="test -f" - -# Sed expression to map a string onto a valid CPP name. -as_tr_cpp="sed y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g" - -# Sed expression to map a string onto a valid variable name. -as_tr_sh="sed y%*+%pp%;s%[^_$as_cr_alnum]%_%g" - - -# IFS -# We need space, tab and new line, in precisely that order. -as_nl=' -' -IFS=" $as_nl" - -# CDPATH. -$as_unset CDPATH - -# Name of the host. -# hostname on some systems (SVR3.2, Linux) returns a bogus exit status, -# so uname gets run too. -ac_hostname=`(hostname || uname -n) 2>/dev/null | sed 1q` - -exec 6>&1 - -# -# Initializations. -# +# Defaults: +ac_help= ac_default_prefix=/usr/local -ac_config_libobj_dir=. -cross_compiling=no -subdirs= -MFLAGS= -MAKEFLAGS= -SHELL=${CONFIG_SHELL-/bin/sh} - -# Maximum number of lines to put in a shell here document. -# This variable seems obsolete. It should probably be removed, and -# only ac_max_sed_lines should be used. -: ${ac_max_here_lines=38} - -# Identity of this package. -PACKAGE_NAME= -PACKAGE_TARNAME= -PACKAGE_VERSION= -PACKAGE_STRING= -PACKAGE_BUGREPORT= - -ac_unique_file="global.ent" -ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS XSLTPROC PDFLATEX DOC_BUILD_DATE LIBOBJS LTLIBOBJS' -ac_subst_files='' +# Any additions from configure.in: # Initialize some variables set by options. -ac_init_help= -ac_init_version=false # The variables have the same names as the options, with # dashes changed to underlines. -cache_file=/dev/null +build=NONE +cache_file=./config.cache exec_prefix=NONE +host=NONE no_create= +nonopt=NONE no_recursion= prefix=NONE program_prefix=NONE @@ -290,15 +29,10 @@ program_transform_name=s,x,x, silent= site= srcdir= +target=NONE verbose= x_includes=NONE x_libraries=NONE - -# Installation directory options. -# These are left unexpanded so users can "make install exec_prefix=/foo" -# and all the variables that are supposed to be based on exec_prefix -# by default will actually change. -# Use braces instead of parens because sh, perl, etc. also accept them. bindir='${exec_prefix}/bin' sbindir='${exec_prefix}/sbin' libexecdir='${exec_prefix}/libexec' @@ -312,9 +46,17 @@ oldincludedir='/usr/include' infodir='${prefix}/info' mandir='${prefix}/man' +# Initialize some other variables. +subdirs= +MFLAGS= MAKEFLAGS= +SHELL=${CONFIG_SHELL-/bin/sh} +# Maximum number of lines to put in a shell here document. +ac_max_here_lines=12 + ac_prev= for ac_option do + # If the previous option needs an argument, assign it. if test -n "$ac_prev"; then eval "$ac_prev=\$ac_option" @@ -322,59 +64,59 @@ do continue fi - ac_optarg=`expr "x$ac_option" : 'x[^=]*=\(.*\)'` + case "$ac_option" in + -*=*) ac_optarg=`echo "$ac_option" | sed 's/[-_a-zA-Z0-9]*=//'` ;; + *) ac_optarg= ;; + esac # Accept the important Cygnus configure options, so we can diagnose typos. - case $ac_option in + case "$ac_option" in -bindir | --bindir | --bindi | --bind | --bin | --bi) ac_prev=bindir ;; -bindir=* | --bindir=* | --bindi=* | --bind=* | --bin=* | --bi=*) - bindir=$ac_optarg ;; + bindir="$ac_optarg" ;; -build | --build | --buil | --bui | --bu) - ac_prev=build_alias ;; + ac_prev=build ;; -build=* | --build=* | --buil=* | --bui=* | --bu=*) - build_alias=$ac_optarg ;; + build="$ac_optarg" ;; -cache-file | --cache-file | --cache-fil | --cache-fi \ | --cache-f | --cache- | --cache | --cach | --cac | --ca | --c) ac_prev=cache_file ;; -cache-file=* | --cache-file=* | --cache-fil=* | --cache-fi=* \ | --cache-f=* | --cache-=* | --cache=* | --cach=* | --cac=* | --ca=* | --c=*) - cache_file=$ac_optarg ;; - - --config-cache | -C) - cache_file=config.cache ;; + cache_file="$ac_optarg" ;; -datadir | --datadir | --datadi | --datad | --data | --dat | --da) ac_prev=datadir ;; -datadir=* | --datadir=* | --datadi=* | --datad=* | --data=* | --dat=* \ | --da=*) - datadir=$ac_optarg ;; + datadir="$ac_optarg" ;; -disable-* | --disable-*) - ac_feature=`expr "x$ac_option" : 'x-*disable-\(.*\)'` + ac_feature=`echo $ac_option|sed -e 's/-*disable-//'` # Reject names that are not valid shell variable names. - expr "x$ac_feature" : ".*[^-_$as_cr_alnum]" >/dev/null && - { echo "$as_me: error: invalid feature name: $ac_feature" >&2 - { (exit 1); exit 1; }; } - ac_feature=`echo $ac_feature | sed 's/-/_/g'` - eval "enable_$ac_feature=no" ;; + if test -n "`echo $ac_feature| sed 's/[-a-zA-Z0-9_]//g'`"; then + { echo "configure: error: $ac_feature: invalid feature name" 1>&2; exit 1; } + fi + ac_feature=`echo $ac_feature| sed 's/-/_/g'` + eval "enable_${ac_feature}=no" ;; -enable-* | --enable-*) - ac_feature=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'` + ac_feature=`echo $ac_option|sed -e 's/-*enable-//' -e 's/=.*//'` # Reject names that are not valid shell variable names. - expr "x$ac_feature" : ".*[^-_$as_cr_alnum]" >/dev/null && - { echo "$as_me: error: invalid feature name: $ac_feature" >&2 - { (exit 1); exit 1; }; } - ac_feature=`echo $ac_feature | sed 's/-/_/g'` - case $ac_option in - *=*) ac_optarg=`echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"`;; + if test -n "`echo $ac_feature| sed 's/[-_a-zA-Z0-9]//g'`"; then + { echo "configure: error: $ac_feature: invalid feature name" 1>&2; exit 1; } + fi + ac_feature=`echo $ac_feature| sed 's/-/_/g'` + case "$ac_option" in + *=*) ;; *) ac_optarg=yes ;; esac - eval "enable_$ac_feature='$ac_optarg'" ;; + eval "enable_${ac_feature}='$ac_optarg'" ;; -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \ | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \ @@ -383,47 +125,95 @@ do -exec-prefix=* | --exec_prefix=* | --exec-prefix=* | --exec-prefi=* \ | --exec-pref=* | --exec-pre=* | --exec-pr=* | --exec-p=* | --exec-=* \ | --exec=* | --exe=* | --ex=*) - exec_prefix=$ac_optarg ;; + exec_prefix="$ac_optarg" ;; -gas | --gas | --ga | --g) # Obsolete; use --with-gas. with_gas=yes ;; - -help | --help | --hel | --he | -h) - ac_init_help=long ;; - -help=r* | --help=r* | --hel=r* | --he=r* | -hr*) - ac_init_help=recursive ;; - -help=s* | --help=s* | --hel=s* | --he=s* | -hs*) - ac_init_help=short ;; + -help | --help | --hel | --he) + # Omit some internal or obsolete options to make the list less imposing. + # This message is too long to be a string in the A/UX 3.1 sh. + cat << EOF +Usage: configure [options] [host] +Options: [defaults in brackets after descriptions] +Configuration: + --cache-file=FILE cache test results in FILE + --help print this message + --no-create do not create output files + --quiet, --silent do not print \`checking...' messages + --version print the version of autoconf that created configure +Directory and file names: + --prefix=PREFIX install architecture-independent files in PREFIX + [$ac_default_prefix] + --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX + [same as prefix] + --bindir=DIR user executables in DIR [EPREFIX/bin] + --sbindir=DIR system admin executables in DIR [EPREFIX/sbin] + --libexecdir=DIR program executables in DIR [EPREFIX/libexec] + --datadir=DIR read-only architecture-independent data in DIR + [PREFIX/share] + --sysconfdir=DIR read-only single-machine data in DIR [PREFIX/etc] + --sharedstatedir=DIR modifiable architecture-independent data in DIR + [PREFIX/com] + --localstatedir=DIR modifiable single-machine data in DIR [PREFIX/var] + --libdir=DIR object code libraries in DIR [EPREFIX/lib] + --includedir=DIR C header files in DIR [PREFIX/include] + --oldincludedir=DIR C header files for non-gcc in DIR [/usr/include] + --infodir=DIR info documentation in DIR [PREFIX/info] + --mandir=DIR man documentation in DIR [PREFIX/man] + --srcdir=DIR find the sources in DIR [configure dir or ..] + --program-prefix=PREFIX prepend PREFIX to installed program names + --program-suffix=SUFFIX append SUFFIX to installed program names + --program-transform-name=PROGRAM + run sed PROGRAM on installed program names +EOF + cat << EOF +Host type: + --build=BUILD configure for building on BUILD [BUILD=HOST] + --host=HOST configure for HOST [guessed] + --target=TARGET configure for TARGET [TARGET=HOST] +Features and packages: + --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) + --enable-FEATURE[=ARG] include FEATURE [ARG=yes] + --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] + --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) + --x-includes=DIR X include files are in DIR + --x-libraries=DIR X library files are in DIR +EOF + if test -n "$ac_help"; then + echo "--enable and --with options recognized:$ac_help" + fi + exit 0 ;; -host | --host | --hos | --ho) - ac_prev=host_alias ;; + ac_prev=host ;; -host=* | --host=* | --hos=* | --ho=*) - host_alias=$ac_optarg ;; + host="$ac_optarg" ;; -includedir | --includedir | --includedi | --included | --include \ | --includ | --inclu | --incl | --inc) ac_prev=includedir ;; -includedir=* | --includedir=* | --includedi=* | --included=* | --include=* \ | --includ=* | --inclu=* | --incl=* | --inc=*) - includedir=$ac_optarg ;; + includedir="$ac_optarg" ;; -infodir | --infodir | --infodi | --infod | --info | --inf) ac_prev=infodir ;; -infodir=* | --infodir=* | --infodi=* | --infod=* | --info=* | --inf=*) - infodir=$ac_optarg ;; + infodir="$ac_optarg" ;; -libdir | --libdir | --libdi | --libd) ac_prev=libdir ;; -libdir=* | --libdir=* | --libdi=* | --libd=*) - libdir=$ac_optarg ;; + libdir="$ac_optarg" ;; -libexecdir | --libexecdir | --libexecdi | --libexecd | --libexec \ | --libexe | --libex | --libe) ac_prev=libexecdir ;; -libexecdir=* | --libexecdir=* | --libexecdi=* | --libexecd=* | --libexec=* \ | --libexe=* | --libex=* | --libe=*) - libexecdir=$ac_optarg ;; + libexecdir="$ac_optarg" ;; -localstatedir | --localstatedir | --localstatedi | --localstated \ | --localstate | --localstat | --localsta | --localst \ @@ -432,19 +222,19 @@ do -localstatedir=* | --localstatedir=* | --localstatedi=* | --localstated=* \ | --localstate=* | --localstat=* | --localsta=* | --localst=* \ | --locals=* | --local=* | --loca=* | --loc=* | --lo=*) - localstatedir=$ac_optarg ;; + localstatedir="$ac_optarg" ;; -mandir | --mandir | --mandi | --mand | --man | --ma | --m) ac_prev=mandir ;; -mandir=* | --mandir=* | --mandi=* | --mand=* | --man=* | --ma=* | --m=*) - mandir=$ac_optarg ;; + mandir="$ac_optarg" ;; -nfp | --nfp | --nf) # Obsolete; use --without-fp. with_fp=no ;; -no-create | --no-create | --no-creat | --no-crea | --no-cre \ - | --no-cr | --no-c | -n) + | --no-cr | --no-c) no_create=yes ;; -no-recursion | --no-recursion | --no-recursio | --no-recursi \ @@ -458,26 +248,26 @@ do -oldincludedir=* | --oldincludedir=* | --oldincludedi=* | --oldincluded=* \ | --oldinclude=* | --oldinclud=* | --oldinclu=* | --oldincl=* | --oldinc=* \ | --oldin=* | --oldi=* | --old=* | --ol=* | --o=*) - oldincludedir=$ac_optarg ;; + oldincludedir="$ac_optarg" ;; -prefix | --prefix | --prefi | --pref | --pre | --pr | --p) ac_prev=prefix ;; -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*) - prefix=$ac_optarg ;; + prefix="$ac_optarg" ;; -program-prefix | --program-prefix | --program-prefi | --program-pref \ | --program-pre | --program-pr | --program-p) ac_prev=program_prefix ;; -program-prefix=* | --program-prefix=* | --program-prefi=* \ | --program-pref=* | --program-pre=* | --program-pr=* | --program-p=*) - program_prefix=$ac_optarg ;; + program_prefix="$ac_optarg" ;; -program-suffix | --program-suffix | --program-suffi | --program-suff \ | --program-suf | --program-su | --program-s) ac_prev=program_suffix ;; -program-suffix=* | --program-suffix=* | --program-suffi=* \ | --program-suff=* | --program-suf=* | --program-su=* | --program-s=*) - program_suffix=$ac_optarg ;; + program_suffix="$ac_optarg" ;; -program-transform-name | --program-transform-name \ | --program-transform-nam | --program-transform-na \ @@ -494,7 +284,7 @@ do | --program-transfo=* | --program-transf=* \ | --program-trans=* | --program-tran=* \ | --progr-tra=* | --program-tr=* | --program-t=*) - program_transform_name=$ac_optarg ;; + program_transform_name="$ac_optarg" ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) @@ -504,7 +294,7 @@ do ac_prev=sbindir ;; -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ | --sbi=* | --sb=*) - sbindir=$ac_optarg ;; + sbindir="$ac_optarg" ;; -sharedstatedir | --sharedstatedir | --sharedstatedi \ | --sharedstated | --sharedstate | --sharedstat | --sharedsta \ @@ -515,57 +305,58 @@ do | --sharedstated=* | --sharedstate=* | --sharedstat=* | --sharedsta=* \ | --sharedst=* | --shareds=* | --shared=* | --share=* | --shar=* \ | --sha=* | --sh=*) - sharedstatedir=$ac_optarg ;; + sharedstatedir="$ac_optarg" ;; -site | --site | --sit) ac_prev=site ;; -site=* | --site=* | --sit=*) - site=$ac_optarg ;; + site="$ac_optarg" ;; -srcdir | --srcdir | --srcdi | --srcd | --src | --sr) ac_prev=srcdir ;; -srcdir=* | --srcdir=* | --srcdi=* | --srcd=* | --src=* | --sr=*) - srcdir=$ac_optarg ;; + srcdir="$ac_optarg" ;; -sysconfdir | --sysconfdir | --sysconfdi | --sysconfd | --sysconf \ | --syscon | --sysco | --sysc | --sys | --sy) ac_prev=sysconfdir ;; -sysconfdir=* | --sysconfdir=* | --sysconfdi=* | --sysconfd=* | --sysconf=* \ | --syscon=* | --sysco=* | --sysc=* | --sys=* | --sy=*) - sysconfdir=$ac_optarg ;; + sysconfdir="$ac_optarg" ;; -target | --target | --targe | --targ | --tar | --ta | --t) - ac_prev=target_alias ;; + ac_prev=target ;; -target=* | --target=* | --targe=* | --targ=* | --tar=* | --ta=* | --t=*) - target_alias=$ac_optarg ;; + target="$ac_optarg" ;; -v | -verbose | --verbose | --verbos | --verbo | --verb) verbose=yes ;; - -version | --version | --versio | --versi | --vers | -V) - ac_init_version=: ;; + -version | --version | --versio | --versi | --vers) + echo "configure generated by autoconf version 2.13" + exit 0 ;; -with-* | --with-*) - ac_package=`expr "x$ac_option" : 'x-*with-\([^=]*\)'` + ac_package=`echo $ac_option|sed -e 's/-*with-//' -e 's/=.*//'` # Reject names that are not valid shell variable names. - expr "x$ac_package" : ".*[^-_$as_cr_alnum]" >/dev/null && - { echo "$as_me: error: invalid package name: $ac_package" >&2 - { (exit 1); exit 1; }; } + if test -n "`echo $ac_package| sed 's/[-_a-zA-Z0-9]//g'`"; then + { echo "configure: error: $ac_package: invalid package name" 1>&2; exit 1; } + fi ac_package=`echo $ac_package| sed 's/-/_/g'` - case $ac_option in - *=*) ac_optarg=`echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"`;; + case "$ac_option" in + *=*) ;; *) ac_optarg=yes ;; esac - eval "with_$ac_package='$ac_optarg'" ;; + eval "with_${ac_package}='$ac_optarg'" ;; -without-* | --without-*) - ac_package=`expr "x$ac_option" : 'x-*without-\(.*\)'` + ac_package=`echo $ac_option|sed -e 's/-*without-//'` # Reject names that are not valid shell variable names. - expr "x$ac_package" : ".*[^-_$as_cr_alnum]" >/dev/null && - { echo "$as_me: error: invalid package name: $ac_package" >&2 - { (exit 1); exit 1; }; } - ac_package=`echo $ac_package | sed 's/-/_/g'` - eval "with_$ac_package=no" ;; + if test -n "`echo $ac_package| sed 's/[-a-zA-Z0-9_]//g'`"; then + { echo "configure: error: $ac_package: invalid package name" 1>&2; exit 1; } + fi + ac_package=`echo $ac_package| sed 's/-/_/g'` + eval "with_${ac_package}=no" ;; --x) # Obsolete; use --with-x. @@ -576,110 +367,99 @@ do ac_prev=x_includes ;; -x-includes=* | --x-includes=* | --x-include=* | --x-includ=* | --x-inclu=* \ | --x-incl=* | --x-inc=* | --x-in=* | --x-i=*) - x_includes=$ac_optarg ;; + x_includes="$ac_optarg" ;; -x-libraries | --x-libraries | --x-librarie | --x-librari \ | --x-librar | --x-libra | --x-libr | --x-lib | --x-li | --x-l) ac_prev=x_libraries ;; -x-libraries=* | --x-libraries=* | --x-librarie=* | --x-librari=* \ | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*) - x_libraries=$ac_optarg ;; + x_libraries="$ac_optarg" ;; - -*) { echo "$as_me: error: unrecognized option: $ac_option -Try \`$0 --help' for more information." >&2 - { (exit 1); exit 1; }; } + -*) { echo "configure: error: $ac_option: invalid option; use --help to show usage" 1>&2; exit 1; } ;; - *=*) - ac_envvar=`expr "x$ac_option" : 'x\([^=]*\)='` - # Reject names that are not valid shell variable names. - expr "x$ac_envvar" : ".*[^_$as_cr_alnum]" >/dev/null && - { echo "$as_me: error: invalid variable name: $ac_envvar" >&2 - { (exit 1); exit 1; }; } - ac_optarg=`echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` - eval "$ac_envvar='$ac_optarg'" - export $ac_envvar ;; - *) - # FIXME: should be removed in autoconf 3.0. - echo "$as_me: WARNING: you should use --build, --host, --target" >&2 - expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null && - echo "$as_me: WARNING: invalid host type: $ac_option" >&2 - : ${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option} + if test -n "`echo $ac_option| sed 's/[-a-z0-9.]//g'`"; then + echo "configure: warning: $ac_option: invalid host type" 1>&2 + fi + if test "x$nonopt" != xNONE; then + { echo "configure: error: can only configure for one host and one target at a time" 1>&2; exit 1; } + fi + nonopt="$ac_option" ;; esac done if test -n "$ac_prev"; then - ac_option=--`echo $ac_prev | sed 's/_/-/g'` - { echo "$as_me: error: missing argument to $ac_option" >&2 - { (exit 1); exit 1; }; } + { echo "configure: error: missing argument to --`echo $ac_prev | sed 's/_/-/g'`" 1>&2; exit 1; } fi -# Be sure to have absolute paths. -for ac_var in exec_prefix prefix -do - eval ac_val=$`echo $ac_var` - case $ac_val in - [\\/$]* | ?:[\\/]* | NONE | '' ) ;; - *) { echo "$as_me: error: expected an absolute directory name for --$ac_var: $ac_val" >&2 - { (exit 1); exit 1; }; };; - esac -done +trap 'rm -fr conftest* confdefs* core core.* *.core $ac_clean_files; exit 1' 1 2 15 + +# File descriptor usage: +# 0 standard input +# 1 file creation +# 2 errors and warnings +# 3 some systems may open it to /dev/tty +# 4 used on the Kubota Titan +# 6 checking for... messages and results +# 5 compiler messages saved in config.log +if test "$silent" = yes; then + exec 6>/dev/null +else + exec 6>&1 +fi +exec 5>./config.log + +echo "\ +This file contains any messages produced by compilers while +running configure, to aid debugging if configure makes a mistake. +" 1>&5 -# Be sure to have absolute paths. -for ac_var in bindir sbindir libexecdir datadir sysconfdir sharedstatedir \ - localstatedir libdir includedir oldincludedir infodir mandir +# Strip out --no-create and --no-recursion so they do not pile up. +# Also quote any args containing shell metacharacters. +ac_configure_args= +for ac_arg do - eval ac_val=$`echo $ac_var` - case $ac_val in - [\\/$]* | ?:[\\/]* ) ;; - *) { echo "$as_me: error: expected an absolute directory name for --$ac_var: $ac_val" >&2 - { (exit 1); exit 1; }; };; + case "$ac_arg" in + -no-create | --no-create | --no-creat | --no-crea | --no-cre \ + | --no-cr | --no-c) ;; + -no-recursion | --no-recursion | --no-recursio | --no-recursi \ + | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r) ;; + *" "*|*" "*|*[\[\]\~\#\$\^\&\*\(\)\{\}\\\|\;\<\>\?]*) + ac_configure_args="$ac_configure_args '$ac_arg'" ;; + *) ac_configure_args="$ac_configure_args $ac_arg" ;; esac done -# There might be people who depend on the old broken behavior: `$host' -# used to hold the argument of --host etc. -# FIXME: To remove some day. -build=$build_alias -host=$host_alias -target=$target_alias - -# FIXME: To remove some day. -if test "x$host_alias" != x; then - if test "x$build_alias" = x; then - cross_compiling=maybe - echo "$as_me: WARNING: If you wanted to set the --build type, don't use --host. - If a cross compiler is detected then cross compile mode will be used." >&2 - elif test "x$build_alias" != "x$host_alias"; then - cross_compiling=yes - fi -fi - -ac_tool_prefix= -test -n "$host_alias" && ac_tool_prefix=$host_alias- +# NLS nuisances. +# Only set these to C if already set. These must not be set unconditionally +# because not all systems understand e.g. LANG=C (notably SCO). +# Fixing LC_MESSAGES prevents Solaris sh from translating var values in `set'! +# Non-C LC_CTYPE values break the ctype check. +if test "${LANG+set}" = set; then LANG=C; export LANG; fi +if test "${LC_ALL+set}" = set; then LC_ALL=C; export LC_ALL; fi +if test "${LC_MESSAGES+set}" = set; then LC_MESSAGES=C; export LC_MESSAGES; fi +if test "${LC_CTYPE+set}" = set; then LC_CTYPE=C; export LC_CTYPE; fi -test "$silent" = yes && exec 6>/dev/null +# confdefs.h avoids OS command line length limits that DEFS can exceed. +rm -rf conftest* confdefs.h +# AIX cpp loses on an empty file, so make sure it contains at least a newline. +echo > confdefs.h +# A filename unique to this package, relative to the directory that +# configure is in, which we can look for to find out if srcdir is correct. +ac_unique_file=global.ent # Find the source files, if location was not specified. if test -z "$srcdir"; then ac_srcdir_defaulted=yes # Try the directory containing this script, then its parent. - ac_confdir=`(dirname "$0") 2>/dev/null || -$as_expr X"$0" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ - X"$0" : 'X\(//\)[^/]' \| \ - X"$0" : 'X\(//\)$' \| \ - X"$0" : 'X\(/\)' \| \ - . : '\(.\)' 2>/dev/null || -echo X"$0" | - sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/; q; } - /^X\(\/\/\)[^/].*/{ s//\1/; q; } - /^X\(\/\/\)$/{ s//\1/; q; } - /^X\(\/\).*/{ s//\1/; q; } - s/.*/./; q'` + ac_prog=$0 + ac_confdir=`echo $ac_prog|sed 's%/[^/][^/]*$%%'` + test "x$ac_confdir" = "x$ac_prog" && ac_confdir=. srcdir=$ac_confdir if test ! -r $srcdir/$ac_unique_file; then srcdir=.. @@ -689,390 +469,13 @@ else fi if test ! -r $srcdir/$ac_unique_file; then if test "$ac_srcdir_defaulted" = yes; then - { echo "$as_me: error: cannot find sources ($ac_unique_file) in $ac_confdir or .." >&2 - { (exit 1); exit 1; }; } + { echo "configure: error: can not find sources in $ac_confdir or .." 1>&2; exit 1; } else - { echo "$as_me: error: cannot find sources ($ac_unique_file) in $srcdir" >&2 - { (exit 1); exit 1; }; } + { echo "configure: error: can not find sources in $srcdir" 1>&2; exit 1; } fi fi -(cd $srcdir && test -r ./$ac_unique_file) 2>/dev/null || - { echo "$as_me: error: sources are in $srcdir, but \`cd $srcdir' does not work" >&2 - { (exit 1); exit 1; }; } -srcdir=`echo "$srcdir" | sed 's%\([^\\/]\)[\\/]*$%\1%'` -ac_env_build_alias_set=${build_alias+set} -ac_env_build_alias_value=$build_alias -ac_cv_env_build_alias_set=${build_alias+set} -ac_cv_env_build_alias_value=$build_alias -ac_env_host_alias_set=${host_alias+set} -ac_env_host_alias_value=$host_alias -ac_cv_env_host_alias_set=${host_alias+set} -ac_cv_env_host_alias_value=$host_alias -ac_env_target_alias_set=${target_alias+set} -ac_env_target_alias_value=$target_alias -ac_cv_env_target_alias_set=${target_alias+set} -ac_cv_env_target_alias_value=$target_alias +srcdir=`echo "${srcdir}" | sed 's%\([^/]\)/*$%\1%'` -# -# Report the --help message. -# -if test "$ac_init_help" = "long"; then - # Omit some internal or obsolete options to make the list less imposing. - # This message is too long to be a string in the A/UX 3.1 sh. - cat <<_ACEOF -\`configure' configures this package to adapt to many kinds of systems. - -Usage: $0 [OPTION]... [VAR=VALUE]... - -To assign environment variables (e.g., CC, CFLAGS...), specify them as -VAR=VALUE. See below for descriptions of some of the useful variables. - -Defaults for the options are specified in brackets. - -Configuration: - -h, --help display this help and exit - --help=short display options specific to this package - --help=recursive display the short help of all the included packages - -V, --version display version information and exit - -q, --quiet, --silent do not print \`checking...' messages - --cache-file=FILE cache test results in FILE [disabled] - -C, --config-cache alias for \`--cache-file=config.cache' - -n, --no-create do not create output files - --srcdir=DIR find the sources in DIR [configure dir or \`..'] - -_ACEOF - - cat <<_ACEOF -Installation directories: - --prefix=PREFIX install architecture-independent files in PREFIX - [$ac_default_prefix] - --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX - [PREFIX] - -By default, \`make install' will install all the files in -\`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify -an installation prefix other than \`$ac_default_prefix' using \`--prefix', -for instance \`--prefix=\$HOME'. - -For better control, use the options below. - -Fine tuning of the installation directories: - --bindir=DIR user executables [EPREFIX/bin] - --sbindir=DIR system admin executables [EPREFIX/sbin] - --libexecdir=DIR program executables [EPREFIX/libexec] - --datadir=DIR read-only architecture-independent data [PREFIX/share] - --sysconfdir=DIR read-only single-machine data [PREFIX/etc] - --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] - --localstatedir=DIR modifiable single-machine data [PREFIX/var] - --libdir=DIR object code libraries [EPREFIX/lib] - --includedir=DIR C header files [PREFIX/include] - --oldincludedir=DIR C header files for non-gcc [/usr/include] - --infodir=DIR info documentation [PREFIX/info] - --mandir=DIR man documentation [PREFIX/man] -_ACEOF - - cat <<\_ACEOF -_ACEOF -fi - -if test -n "$ac_init_help"; then - - cat <<\_ACEOF - -_ACEOF -fi - -if test "$ac_init_help" = "recursive"; then - # If there are subdirs, report their specific --help. - ac_popdir=`pwd` - for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue - test -d $ac_dir || continue - ac_builddir=. - -if test "$ac_dir" != .; then - ac_dir_suffix=/`echo "$ac_dir" | sed 's,^\.[\\/],,'` - # A "../" for each directory in $ac_dir_suffix. - ac_top_builddir=`echo "$ac_dir_suffix" | sed 's,/[^\\/]*,../,g'` -else - ac_dir_suffix= ac_top_builddir= -fi - -case $srcdir in - .) # No --srcdir option. We are building in place. - ac_srcdir=. - if test -z "$ac_top_builddir"; then - ac_top_srcdir=. - else - ac_top_srcdir=`echo $ac_top_builddir | sed 's,/$,,'` - fi ;; - [\\/]* | ?:[\\/]* ) # Absolute path. - ac_srcdir=$srcdir$ac_dir_suffix; - ac_top_srcdir=$srcdir ;; - *) # Relative path. - ac_srcdir=$ac_top_builddir$srcdir$ac_dir_suffix - ac_top_srcdir=$ac_top_builddir$srcdir ;; -esac -# Don't blindly perform a `cd "$ac_dir"/$ac_foo && pwd` since $ac_foo can be -# absolute. -ac_abs_builddir=`cd "$ac_dir" && cd $ac_builddir && pwd` -ac_abs_top_builddir=`cd "$ac_dir" && cd ${ac_top_builddir}. && pwd` -ac_abs_srcdir=`cd "$ac_dir" && cd $ac_srcdir && pwd` -ac_abs_top_srcdir=`cd "$ac_dir" && cd $ac_top_srcdir && pwd` - - cd $ac_dir - # Check for guested configure; otherwise get Cygnus style configure. - if test -f $ac_srcdir/configure.gnu; then - echo - $SHELL $ac_srcdir/configure.gnu --help=recursive - elif test -f $ac_srcdir/configure; then - echo - $SHELL $ac_srcdir/configure --help=recursive - elif test -f $ac_srcdir/configure.ac || - test -f $ac_srcdir/configure.in; then - echo - $ac_configure --help - else - echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2 - fi - cd $ac_popdir - done -fi - -test -n "$ac_init_help" && exit 0 -if $ac_init_version; then - cat <<\_ACEOF - -Copyright 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, 2002 -Free Software Foundation, Inc. -This configure script is free software; the Free Software Foundation -gives unlimited permission to copy, distribute and modify it. -_ACEOF - exit 0 -fi -exec 5>config.log -cat >&5 <<_ACEOF -This file contains any messages produced by compilers while -running configure, to aid debugging if configure makes a mistake. - -It was created by $as_me, which was -generated by GNU Autoconf 2.57. Invocation command line was - - $ $0 $@ - -_ACEOF -{ -cat <<_ASUNAME -## --------- ## -## Platform. ## -## --------- ## - -hostname = `(hostname || uname -n) 2>/dev/null | sed 1q` -uname -m = `(uname -m) 2>/dev/null || echo unknown` -uname -r = `(uname -r) 2>/dev/null || echo unknown` -uname -s = `(uname -s) 2>/dev/null || echo unknown` -uname -v = `(uname -v) 2>/dev/null || echo unknown` - -/usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null || echo unknown` -/bin/uname -X = `(/bin/uname -X) 2>/dev/null || echo unknown` - -/bin/arch = `(/bin/arch) 2>/dev/null || echo unknown` -/usr/bin/arch -k = `(/usr/bin/arch -k) 2>/dev/null || echo unknown` -/usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null || echo unknown` -hostinfo = `(hostinfo) 2>/dev/null || echo unknown` -/bin/machine = `(/bin/machine) 2>/dev/null || echo unknown` -/usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null || echo unknown` -/bin/universe = `(/bin/universe) 2>/dev/null || echo unknown` - -_ASUNAME - -as_save_IFS=$IFS; IFS=$PATH_SEPARATOR -for as_dir in $PATH -do - IFS=$as_save_IFS - test -z "$as_dir" && as_dir=. - echo "PATH: $as_dir" -done - -} >&5 - -cat >&5 <<_ACEOF - - -## ----------- ## -## Core tests. ## -## ----------- ## - -_ACEOF - - -# Keep a trace of the command line. -# Strip out --no-create and --no-recursion so they do not pile up. -# Strip out --silent because we don't want to record it for future runs. -# Also quote any args containing shell meta-characters. -# Make two passes to allow for proper duplicate-argument suppression. -ac_configure_args= -ac_configure_args0= -ac_configure_args1= -ac_sep= -ac_must_keep_next=false -for ac_pass in 1 2 -do - for ac_arg - do - case $ac_arg in - -no-create | --no-c* | -n | -no-recursion | --no-r*) continue ;; - -q | -quiet | --quiet | --quie | --qui | --qu | --q \ - | -silent | --silent | --silen | --sile | --sil) - continue ;; - *" "*|*" "*|*[\[\]\~\#\$\^\&\*\(\)\{\}\\\|\;\<\>\?\"\']*) - ac_arg=`echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; - esac - case $ac_pass in - 1) ac_configure_args0="$ac_configure_args0 '$ac_arg'" ;; - 2) - ac_configure_args1="$ac_configure_args1 '$ac_arg'" - if test $ac_must_keep_next = true; then - ac_must_keep_next=false # Got value, back to normal. - else - case $ac_arg in - *=* | --config-cache | -C | -disable-* | --disable-* \ - | -enable-* | --enable-* | -gas | --g* | -nfp | --nf* \ - | -q | -quiet | --q* | -silent | --sil* | -v | -verb* \ - | -with-* | --with-* | -without-* | --without-* | --x) - case "$ac_configure_args0 " in - "$ac_configure_args1"*" '$ac_arg' "* ) continue ;; - esac - ;; - -* ) ac_must_keep_next=true ;; - esac - fi - ac_configure_args="$ac_configure_args$ac_sep'$ac_arg'" - # Get rid of the leading space. - ac_sep=" " - ;; - esac - done -done -$as_unset ac_configure_args0 || test "${ac_configure_args0+set}" != set || { ac_configure_args0=; export ac_configure_args0; } -$as_unset ac_configure_args1 || test "${ac_configure_args1+set}" != set || { ac_configure_args1=; export ac_configure_args1; } - -# When interrupted or exit'd, cleanup temporary files, and complete -# config.log. We remove comments because anyway the quotes in there -# would cause problems or look ugly. -# WARNING: Be sure not to use single quotes in there, as some shells, -# such as our DU 5.0 friend, will then `close' the trap. -trap 'exit_status=$? - # Save into config.log some information that might help in debugging. - { - echo - - cat <<\_ASBOX -## ---------------- ## -## Cache variables. ## -## ---------------- ## -_ASBOX - echo - # The following way of writing the cache mishandles newlines in values, -{ - (set) 2>&1 | - case `(ac_space='"'"' '"'"'; set | grep ac_space) 2>&1` in - *ac_space=\ *) - sed -n \ - "s/'"'"'/'"'"'\\\\'"'"''"'"'/g; - s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='"'"'\\2'"'"'/p" - ;; - *) - sed -n \ - "s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1=\\2/p" - ;; - esac; -} - echo - - cat <<\_ASBOX -## ----------------- ## -## Output variables. ## -## ----------------- ## -_ASBOX - echo - for ac_var in $ac_subst_vars - do - eval ac_val=$`echo $ac_var` - echo "$ac_var='"'"'$ac_val'"'"'" - done | sort - echo - - if test -n "$ac_subst_files"; then - cat <<\_ASBOX -## ------------- ## -## Output files. ## -## ------------- ## -_ASBOX - echo - for ac_var in $ac_subst_files - do - eval ac_val=$`echo $ac_var` - echo "$ac_var='"'"'$ac_val'"'"'" - done | sort - echo - fi - - if test -s confdefs.h; then - cat <<\_ASBOX -## ----------- ## -## confdefs.h. ## -## ----------- ## -_ASBOX - echo - sed "/^$/d" confdefs.h | sort - echo - fi - test "$ac_signal" != 0 && - echo "$as_me: caught signal $ac_signal" - echo "$as_me: exit $exit_status" - } >&5 - rm -f core core.* *.core && - rm -rf conftest* confdefs* conf$$* $ac_clean_files && - exit $exit_status - ' 0 -for ac_signal in 1 2 13 15; do - trap 'ac_signal='$ac_signal'; { (exit 1); exit 1; }' $ac_signal -done -ac_signal=0 - -# confdefs.h avoids OS command line length limits that DEFS can exceed. -rm -rf conftest* confdefs.h -# AIX cpp loses on an empty file, so make sure it contains at least a newline. -echo >confdefs.h - -# Predefined preprocessor variables. - -cat >>confdefs.h <<_ACEOF -#define PACKAGE_NAME "$PACKAGE_NAME" -_ACEOF - - -cat >>confdefs.h <<_ACEOF -#define PACKAGE_TARNAME "$PACKAGE_TARNAME" -_ACEOF - - -cat >>confdefs.h <<_ACEOF -#define PACKAGE_VERSION "$PACKAGE_VERSION" -_ACEOF - - -cat >>confdefs.h <<_ACEOF -#define PACKAGE_STRING "$PACKAGE_STRING" -_ACEOF - - -cat >>confdefs.h <<_ACEOF -#define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT" -_ACEOF - - -# Let the site file select an alternate cache file if it wants to. # Prefer explicitly selected file to automatically selected ones. if test -z "$CONFIG_SITE"; then if test "x$prefix" != xNONE; then @@ -1083,1064 +486,554 @@ if test -z "$CONFIG_SITE"; then fi for ac_site_file in $CONFIG_SITE; do if test -r "$ac_site_file"; then - { echo "$as_me:$LINENO: loading site script $ac_site_file" >&5 -echo "$as_me: loading site script $ac_site_file" >&6;} - sed 's/^/| /' "$ac_site_file" >&5 + echo "loading site script $ac_site_file" . "$ac_site_file" fi done if test -r "$cache_file"; then - # Some versions of bash will fail to source /dev/null (special - # files actually), so we avoid doing that. - if test -f "$cache_file"; then - { echo "$as_me:$LINENO: loading cache $cache_file" >&5 -echo "$as_me: loading cache $cache_file" >&6;} - case $cache_file in - [\\/]* | ?:[\\/]* ) . $cache_file;; - *) . ./$cache_file;; - esac - fi + echo "loading cache $cache_file" + . $cache_file else - { echo "$as_me:$LINENO: creating cache $cache_file" >&5 -echo "$as_me: creating cache $cache_file" >&6;} - >$cache_file -fi - -# Check that the precious variables saved in the cache have kept the same -# value. -ac_cache_corrupted=false -for ac_var in `(set) 2>&1 | - sed -n 's/^ac_env_\([a-zA-Z_0-9]*\)_set=.*/\1/p'`; do - eval ac_old_set=\$ac_cv_env_${ac_var}_set - eval ac_new_set=\$ac_env_${ac_var}_set - eval ac_old_val="\$ac_cv_env_${ac_var}_value" - eval ac_new_val="\$ac_env_${ac_var}_value" - case $ac_old_set,$ac_new_set in - set,) - { echo "$as_me:$LINENO: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5 -echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;} - ac_cache_corrupted=: ;; - ,set) - { echo "$as_me:$LINENO: error: \`$ac_var' was not set in the previous run" >&5 -echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;} - ac_cache_corrupted=: ;; - ,);; - *) - if test "x$ac_old_val" != "x$ac_new_val"; then - { echo "$as_me:$LINENO: error: \`$ac_var' has changed since the previous run:" >&5 -echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;} - { echo "$as_me:$LINENO: former value: $ac_old_val" >&5 -echo "$as_me: former value: $ac_old_val" >&2;} - { echo "$as_me:$LINENO: current value: $ac_new_val" >&5 -echo "$as_me: current value: $ac_new_val" >&2;} - ac_cache_corrupted=: - fi;; - esac - # Pass precious variables to config.status. - if test "$ac_new_set" = set; then - case $ac_new_val in - *" "*|*" "*|*[\[\]\~\#\$\^\&\*\(\)\{\}\\\|\;\<\>\?\"\']*) - ac_arg=$ac_var=`echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;; - *) ac_arg=$ac_var=$ac_new_val ;; - esac - case " $ac_configure_args " in - *" '$ac_arg' "*) ;; # Avoid dups. Use of quotes ensures accuracy. - *) ac_configure_args="$ac_configure_args '$ac_arg'" ;; - esac - fi -done -if $ac_cache_corrupted; then - { echo "$as_me:$LINENO: error: changes in the environment can compromise the build" >&5 -echo "$as_me: error: changes in the environment can compromise the build" >&2;} - { { echo "$as_me:$LINENO: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&5 -echo "$as_me: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&2;} - { (exit 1); exit 1; }; } + echo "creating cache $cache_file" + > $cache_file fi ac_ext=c +# CFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options. ac_cpp='$CPP $CPPFLAGS' -ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' -ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' -ac_compiler_gnu=$ac_cv_c_compiler_gnu - - - - - - - - - - - - - - - - - +ac_compile='${CC-cc} -c $CFLAGS $CPPFLAGS conftest.$ac_ext 1>&5' +ac_link='${CC-cc} -o conftest${ac_exeext} $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS 1>&5' +cross_compiling=$ac_cv_prog_cc_cross + +ac_exeext= +ac_objext=o +if (echo "testing\c"; echo 1,2,3) | grep c >/dev/null; then + # Stardent Vistra SVR4 grep lacks -e, says ghazi@caip.rutgers.edu. + if (echo -n testing; echo 1,2,3) | sed s/-n/xn/ | grep xn >/dev/null; then + ac_n= ac_c=' +' ac_t=' ' + else + ac_n=-n ac_c= ac_t= + fi +else + ac_n= ac_c='\c' ac_t= +fi # Extract the first word of "xsltproc", so it can be a program name with args. set dummy xsltproc; ac_word=$2 -echo "$as_me:$LINENO: checking for $ac_word" >&5 -echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6 -if test "${ac_cv_path_XSLTPROC+set}" = set; then - echo $ECHO_N "(cached) $ECHO_C" >&6 +echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 +echo "configure:529: checking for $ac_word" >&5 +if eval "test \"`echo '$''{'ac_cv_path_XSLTPROC'+set}'`\" = set"; then + echo $ac_n "(cached) $ac_c" 1>&6 else - case $XSLTPROC in - [\\/]* | ?:[\\/]*) + case "$XSLTPROC" in + /*) ac_cv_path_XSLTPROC="$XSLTPROC" # Let the user override the test with a path. ;; + ?:/*) + ac_cv_path_XSLTPROC="$XSLTPROC" # Let the user override the test with a dos path. + ;; *) - as_save_IFS=$IFS; IFS=$PATH_SEPARATOR -for as_dir in $PATH -do - IFS=$as_save_IFS - test -z "$as_dir" && as_dir=. - for ac_exec_ext in '' $ac_executable_extensions; do - if $as_executable_p "$as_dir/$ac_word$ac_exec_ext"; then - ac_cv_path_XSLTPROC="$as_dir/$ac_word$ac_exec_ext" - echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 - break 2 - fi -done -done - + IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" + ac_dummy="$PATH" + for ac_dir in $ac_dummy; do + test -z "$ac_dir" && ac_dir=. + if test -f $ac_dir/$ac_word; then + ac_cv_path_XSLTPROC="$ac_dir/$ac_word" + break + fi + done + IFS="$ac_save_ifs" ;; esac fi -XSLTPROC=$ac_cv_path_XSLTPROC - +XSLTPROC="$ac_cv_path_XSLTPROC" if test -n "$XSLTPROC"; then - echo "$as_me:$LINENO: result: $XSLTPROC" >&5 -echo "${ECHO_T}$XSLTPROC" >&6 + echo "$ac_t""$XSLTPROC" 1>&6 else - echo "$as_me:$LINENO: result: no" >&5 -echo "${ECHO_T}no" >&6 + echo "$ac_t""no" 1>&6 fi if test "x$XSLTPROC" = x; then - { { echo "$as_me:$LINENO: error: \"xsltproc is required\"" >&5 -echo "$as_me: error: \"xsltproc is required\"" >&2;} - { (exit 1); exit 1; }; } + { echo "configure: error: "xsltproc is required"" 1>&2; exit 1; } fi # Extract the first word of "pdflatex", so it can be a program name with args. set dummy pdflatex; ac_word=$2 -echo "$as_me:$LINENO: checking for $ac_word" >&5 -echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6 -if test "${ac_cv_path_PDFLATEX+set}" = set; then - echo $ECHO_N "(cached) $ECHO_C" >&6 +echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 +echo "configure:567: checking for $ac_word" >&5 +if eval "test \"`echo '$''{'ac_cv_path_PDFLATEX'+set}'`\" = set"; then + echo $ac_n "(cached) $ac_c" 1>&6 else - case $PDFLATEX in - [\\/]* | ?:[\\/]*) + case "$PDFLATEX" in + /*) ac_cv_path_PDFLATEX="$PDFLATEX" # Let the user override the test with a path. ;; + ?:/*) + ac_cv_path_PDFLATEX="$PDFLATEX" # Let the user override the test with a dos path. + ;; *) - as_save_IFS=$IFS; IFS=$PATH_SEPARATOR -for as_dir in $PATH -do - IFS=$as_save_IFS - test -z "$as_dir" && as_dir=. - for ac_exec_ext in '' $ac_executable_extensions; do - if $as_executable_p "$as_dir/$ac_word$ac_exec_ext"; then - ac_cv_path_PDFLATEX="$as_dir/$ac_word$ac_exec_ext" - echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 - break 2 - fi -done -done - + IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" + ac_dummy="$PATH" + for ac_dir in $ac_dummy; do + test -z "$ac_dir" && ac_dir=. + if test -f $ac_dir/$ac_word; then + ac_cv_path_PDFLATEX="$ac_dir/$ac_word" + break + fi + done + IFS="$ac_save_ifs" ;; esac fi -PDFLATEX=$ac_cv_path_PDFLATEX - +PDFLATEX="$ac_cv_path_PDFLATEX" if test -n "$PDFLATEX"; then - echo "$as_me:$LINENO: result: $PDFLATEX" >&5 -echo "${ECHO_T}$PDFLATEX" >&6 + echo "$ac_t""$PDFLATEX" 1>&6 else - echo "$as_me:$LINENO: result: no" >&5 -echo "${ECHO_T}no" >&6 + echo "$ac_t""no" 1>&6 fi if test "x$PDFLATEX" = x; then - { { echo "$as_me:$LINENO: error: \"pdflatex is required\"" >&5 -echo "$as_me: error: \"pdflatex is required\"" >&2;} - { (exit 1); exit 1; }; } + { echo "configure: error: "pdflatex is required"" 1>&2; exit 1; } +fi + +# Extract the first word of "xmlto", so it can be a program name with args. +set dummy xmlto; ac_word=$2 +echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 +echo "configure:606: checking for $ac_word" >&5 +if eval "test \"`echo '$''{'ac_cv_path_XMLTO'+set}'`\" = set"; then + echo $ac_n "(cached) $ac_c" 1>&6 +else + case "$XMLTO" in + /*) + ac_cv_path_XMLTO="$XMLTO" # Let the user override the test with a path. + ;; + ?:/*) + ac_cv_path_XMLTO="$XMLTO" # Let the user override the test with a dos path. + ;; + *) + IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" + ac_dummy="$PATH" + for ac_dir in $ac_dummy; do + test -z "$ac_dir" && ac_dir=. + if test -f $ac_dir/$ac_word; then + ac_cv_path_XMLTO="$ac_dir/$ac_word" + break + fi + done + IFS="$ac_save_ifs" + ;; +esac +fi +XMLTO="$ac_cv_path_XMLTO" +if test -n "$XMLTO"; then + echo "$ac_t""$XMLTO" 1>&6 +else + echo "$ac_t""no" 1>&6 +fi + +# Extract the first word of "latex", so it can be a program name with args. +set dummy latex; ac_word=$2 +echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 +echo "configure:641: checking for $ac_word" >&5 +if eval "test \"`echo '$''{'ac_cv_path_LATEX'+set}'`\" = set"; then + echo $ac_n "(cached) $ac_c" 1>&6 +else + case "$LATEX" in + /*) + ac_cv_path_LATEX="$LATEX" # Let the user override the test with a path. + ;; + ?:/*) + ac_cv_path_LATEX="$LATEX" # Let the user override the test with a dos path. + ;; + *) + IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" + ac_dummy="$PATH" + for ac_dir in $ac_dummy; do + test -z "$ac_dir" && ac_dir=. + if test -f $ac_dir/$ac_word; then + ac_cv_path_LATEX="$ac_dir/$ac_word" + break + fi + done + IFS="$ac_save_ifs" + ;; +esac +fi +LATEX="$ac_cv_path_LATEX" +if test -n "$LATEX"; then + echo "$ac_t""$LATEX" 1>&6 +else + echo "$ac_t""no" 1>&6 fi +# Extract the first word of "dvips", so it can be a program name with args. +set dummy dvips; ac_word=$2 +echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 +echo "configure:676: checking for $ac_word" >&5 +if eval "test \"`echo '$''{'ac_cv_path_DVIPS'+set}'`\" = set"; then + echo $ac_n "(cached) $ac_c" 1>&6 +else + case "$DVIPS" in + /*) + ac_cv_path_DVIPS="$DVIPS" # Let the user override the test with a path. + ;; + ?:/*) + ac_cv_path_DVIPS="$DVIPS" # Let the user override the test with a dos path. + ;; + *) + IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" + ac_dummy="$PATH" + for ac_dir in $ac_dummy; do + test -z "$ac_dir" && ac_dir=. + if test -f $ac_dir/$ac_word; then + ac_cv_path_DVIPS="$ac_dir/$ac_word" + break + fi + done + IFS="$ac_save_ifs" + ;; +esac +fi +DVIPS="$ac_cv_path_DVIPS" +if test -n "$DVIPS"; then + echo "$ac_t""$DVIPS" 1>&6 +else + echo "$ac_t""no" 1>&6 +fi + +# Extract the first word of "pngtopnm", so it can be a program name with args. +set dummy pngtopnm; ac_word=$2 +echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 +echo "configure:711: checking for $ac_word" >&5 +if eval "test \"`echo '$''{'ac_cv_path_PNGTOPNM'+set}'`\" = set"; then + echo $ac_n "(cached) $ac_c" 1>&6 +else + case "$PNGTOPNM" in + /*) + ac_cv_path_PNGTOPNM="$PNGTOPNM" # Let the user override the test with a path. + ;; + ?:/*) + ac_cv_path_PNGTOPNM="$PNGTOPNM" # Let the user override the test with a dos path. + ;; + *) + IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" + ac_dummy="$PATH" + for ac_dir in $ac_dummy; do + test -z "$ac_dir" && ac_dir=. + if test -f $ac_dir/$ac_word; then + ac_cv_path_PNGTOPNM="$ac_dir/$ac_word" + break + fi + done + IFS="$ac_save_ifs" + ;; +esac +fi +PNGTOPNM="$ac_cv_path_PNGTOPNM" +if test -n "$PNGTOPNM"; then + echo "$ac_t""$PNGTOPNM" 1>&6 +else + echo "$ac_t""no" 1>&6 +fi + +# Extract the first word of "pnmtops", so it can be a program name with args. +set dummy pnmtops; ac_word=$2 +echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 +echo "configure:746: checking for $ac_word" >&5 +if eval "test \"`echo '$''{'ac_cv_path_PNMTOPS'+set}'`\" = set"; then + echo $ac_n "(cached) $ac_c" 1>&6 +else + case "$PNMTOPS" in + /*) + ac_cv_path_PNMTOPS="$PNMTOPS" # Let the user override the test with a path. + ;; + ?:/*) + ac_cv_path_PNMTOPS="$PNMTOPS" # Let the user override the test with a dos path. + ;; + *) + IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" + ac_dummy="$PATH" + for ac_dir in $ac_dummy; do + test -z "$ac_dir" && ac_dir=. + if test -f $ac_dir/$ac_word; then + ac_cv_path_PNMTOPS="$ac_dir/$ac_word" + break + fi + done + IFS="$ac_save_ifs" + ;; +esac +fi +PNMTOPS="$ac_cv_path_PNMTOPS" +if test -n "$PNMTOPS"; then + echo "$ac_t""$PNMTOPS" 1>&6 +else + echo "$ac_t""no" 1>&6 +fi + + DOC_BUILD_DATE=`date '+%d-%m-%Y'` - ac_config_files="$ac_config_files Makefile" -cat >confcache <<\_ACEOF +trap '' 1 2 15 +cat > confcache <<\EOF # This file is a shell script that caches the results of configure # tests run on this system so they can be shared between configure -# scripts and configure runs, see configure's option --config-cache. -# It is not useful on other systems. If it contains results you don't -# want to keep, you may remove or edit it. +# scripts and configure runs. It is not useful on other systems. +# If it contains results you don't want to keep, you may remove or edit it. # -# config.status only pays attention to the cache file if you give it -# the --recheck option to rerun configure. +# By default, configure uses ./config.cache as the cache file, +# creating it if it does not exist already. You can give configure +# the --cache-file=FILE option to use a different cache file; that is +# what configure does when it calls configure scripts in +# subdirectories, so they share the cache. +# Giving --cache-file=/dev/null disables caching, for debugging configure. +# config.status only pays attention to the cache file if you give it the +# --recheck option to rerun configure. # -# `ac_cv_env_foo' variables (set or unset) will be overridden when -# loading this file, other *unset* `ac_cv_foo' will be assigned the -# following values. - -_ACEOF - +EOF # The following way of writing the cache mishandles newlines in values, # but we know of no workaround that is simple, portable, and efficient. # So, don't put newlines in cache variables' values. # Ultrix sh set writes to stderr and can't be redirected directly, # and sets the high bit in the cache file unless we assign to the vars. -{ - (set) 2>&1 | - case `(ac_space=' '; set | grep ac_space) 2>&1` in - *ac_space=\ *) - # `set' does not quote correctly, so add quotes (double-quote - # substitution turns \\\\ into \\, and sed turns \\ into \). - sed -n \ - "s/'/'\\\\''/g; - s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p" - ;; - *) - # `set' quotes correctly as required by POSIX, so do not add quotes. - sed -n \ - "s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1=\\2/p" - ;; - esac; -} | - sed ' - t clear - : clear - s/^\([^=]*\)=\(.*[{}].*\)$/test "${\1+set}" = set || &/ - t end - /^ac_cv_env/!s/^\([^=]*\)=\(.*\)$/\1=${\1=\2}/ - : end' >>confcache -if diff $cache_file confcache >/dev/null 2>&1; then :; else +(set) 2>&1 | + case `(ac_space=' '; set | grep ac_space) 2>&1` in + *ac_space=\ *) + # `set' does not quote correctly, so add quotes (double-quote substitution + # turns \\\\ into \\, and sed turns \\ into \). + sed -n \ + -e "s/'/'\\\\''/g" \ + -e "s/^\\([a-zA-Z0-9_]*_cv_[a-zA-Z0-9_]*\\)=\\(.*\\)/\\1=\${\\1='\\2'}/p" + ;; + *) + # `set' quotes correctly as required by POSIX, so do not add quotes. + sed -n -e 's/^\([a-zA-Z0-9_]*_cv_[a-zA-Z0-9_]*\)=\(.*\)/\1=${\1=\2}/p' + ;; + esac >> confcache +if cmp -s $cache_file confcache; then + : +else if test -w $cache_file; then - test "x$cache_file" != "x/dev/null" && echo "updating cache $cache_file" - cat confcache >$cache_file + echo "updating cache $cache_file" + cat confcache > $cache_file else echo "not updating unwritable cache $cache_file" fi fi rm -f confcache +trap 'rm -fr conftest* confdefs* core core.* *.core $ac_clean_files; exit 1' 1 2 15 + test "x$prefix" = xNONE && prefix=$ac_default_prefix # Let make expand exec_prefix. test "x$exec_prefix" = xNONE && exec_prefix='${prefix}' -# VPATH may cause trouble with some makes, so we remove $(srcdir), -# ${srcdir} and @srcdir@ from VPATH if srcdir is ".", strip leading and -# trailing colons and then remove the whole line if VPATH becomes empty -# (actually we leave an empty line to preserve line numbers). +# Any assignment to VPATH causes Sun make to only execute +# the first set of double-colon rules, so remove it if not needed. +# If there is a colon in the path, we need to keep it. if test "x$srcdir" = x.; then - ac_vpsub='/^[ ]*VPATH[ ]*=/{ -s/:*\$(srcdir):*/:/; -s/:*\${srcdir}:*/:/; -s/:*@srcdir@:*/:/; -s/^\([^=]*=[ ]*\):*/\1/; -s/:*$//; -s/^[^=]*=[ ]*$//; -}' + ac_vpsub='/^[ ]*VPATH[ ]*=[^:]*$/d' fi +trap 'rm -f $CONFIG_STATUS conftest*; exit 1' 1 2 15 + # Transform confdefs.h into DEFS. # Protect against shell expansion while executing Makefile rules. # Protect against Makefile macro expansion. -# -# If the first sed substitution is executed (which looks for macros that -# take arguments), then we branch to the quote section. Otherwise, -# look for a macro that doesn't take arguments. -cat >confdef2opt.sed <<\_ACEOF -t clear -: clear -s,^[ ]*#[ ]*define[ ][ ]*\([^ (][^ (]*([^)]*)\)[ ]*\(.*\),-D\1=\2,g -t quote -s,^[ ]*#[ ]*define[ ][ ]*\([^ ][^ ]*\)[ ]*\(.*\),-D\1=\2,g -t quote -d -: quote -s,[ `~#$^&*(){}\\|;'"<>?],\\&,g -s,\[,\\&,g -s,\],\\&,g -s,\$,$$,g -p -_ACEOF -# We use echo to avoid assuming a particular line-breaking character. -# The extra dot is to prevent the shell from consuming trailing -# line-breaks from the sub-command output. A line-break within -# single-quotes doesn't work because, if this script is created in a -# platform that uses two characters for line-breaks (e.g., DOS), tr -# would break. -ac_LF_and_DOT=`echo; echo .` -DEFS=`sed -n -f confdef2opt.sed confdefs.h | tr "$ac_LF_and_DOT" ' .'` -rm -f confdef2opt.sed - - -ac_libobjs= -ac_ltlibobjs= -for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue - # 1. Remove the extension, and $U if already installed. - ac_i=`echo "$ac_i" | - sed 's/\$U\././;s/\.o$//;s/\.obj$//'` - # 2. Add them. - ac_libobjs="$ac_libobjs $ac_i\$U.$ac_objext" - ac_ltlibobjs="$ac_ltlibobjs $ac_i"'$U.lo' -done -LIBOBJS=$ac_libobjs - -LTLIBOBJS=$ac_ltlibobjs - - - +cat > conftest.defs <<\EOF +s%#define \([A-Za-z_][A-Za-z0-9_]*\) *\(.*\)%-D\1=\2%g +s%[ `~#$^&*(){}\\|;'"<>?]%\\&%g +s%\[%\\&%g +s%\]%\\&%g +s%\$%$$%g +EOF +DEFS=`sed -f conftest.defs confdefs.h | tr '\012' ' '` +rm -f conftest.defs + + +# Without the "./", some shells look in PATH for config.status. : ${CONFIG_STATUS=./config.status} -ac_clean_files_save=$ac_clean_files -ac_clean_files="$ac_clean_files $CONFIG_STATUS" -{ echo "$as_me:$LINENO: creating $CONFIG_STATUS" >&5 -echo "$as_me: creating $CONFIG_STATUS" >&6;} -cat >$CONFIG_STATUS <<_ACEOF -#! $SHELL -# Generated by $as_me. + +echo creating $CONFIG_STATUS +rm -f $CONFIG_STATUS +cat > $CONFIG_STATUS </dev/null | sed 1q`: +# +# $0 $ac_configure_args +# # Compiler output produced by configure, useful for debugging -# configure, is in config.log if it exists. - -debug=false -ac_cs_recheck=false -ac_cs_silent=false -SHELL=\${CONFIG_SHELL-$SHELL} -_ACEOF - -cat >>$CONFIG_STATUS <<\_ACEOF -## --------------------- ## -## M4sh Initialization. ## -## --------------------- ## - -# Be Bourne compatible -if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then - emulate sh - NULLCMD=: - # Zsh 3.x and 4.x performs word splitting on ${1+"$@"}, which - # is contrary to our usage. Disable this feature. - alias -g '${1+"$@"}'='"$@"' -elif test -n "${BASH_VERSION+set}" && (set -o posix) >/dev/null 2>&1; then - set -o posix -fi - -# Support unset when possible. -if (FOO=FOO; unset FOO) >/dev/null 2>&1; then - as_unset=unset -else - as_unset=false -fi - - -# Work around bugs in pre-3.0 UWIN ksh. -$as_unset ENV MAIL MAILPATH -PS1='$ ' -PS2='> ' -PS4='+ ' +# configure, is in ./config.log if it exists. -# NLS nuisances. -for as_var in \ - LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION \ - LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER \ - LC_TELEPHONE LC_TIME +ac_cs_usage="Usage: $CONFIG_STATUS [--recheck] [--version] [--help]" +for ac_option do - if (set +x; test -n "`(eval $as_var=C; export $as_var) 2>&1`"); then - eval $as_var=C; export $as_var - else - $as_unset $as_var - fi + case "\$ac_option" in + -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) + echo "running \${CONFIG_SHELL-/bin/sh} $0 $ac_configure_args --no-create --no-recursion" + exec \${CONFIG_SHELL-/bin/sh} $0 $ac_configure_args --no-create --no-recursion ;; + -version | --version | --versio | --versi | --vers | --ver | --ve | --v) + echo "$CONFIG_STATUS generated by autoconf version 2.13" + exit 0 ;; + -help | --help | --hel | --he | --h) + echo "\$ac_cs_usage"; exit 0 ;; + *) echo "\$ac_cs_usage"; exit 1 ;; + esac done -# Required to use basename. -if expr a : '\(a\)' >/dev/null 2>&1; then - as_expr=expr -else - as_expr=false -fi +ac_given_srcdir=$srcdir -if (basename /) >/dev/null 2>&1 && test "X`basename / 2>&1`" = "X/"; then - as_basename=basename -else - as_basename=false -fi +trap 'rm -fr `echo "Makefile " | sed "s/:[^ ]*//g"` conftest*; exit 1' 1 2 15 +EOF +cat >> $CONFIG_STATUS < conftest.subs <<\\CEOF +$ac_vpsub +$extrasub +s%@SHELL@%$SHELL%g +s%@CFLAGS@%$CFLAGS%g +s%@CPPFLAGS@%$CPPFLAGS%g +s%@CXXFLAGS@%$CXXFLAGS%g +s%@FFLAGS@%$FFLAGS%g +s%@DEFS@%$DEFS%g +s%@LDFLAGS@%$LDFLAGS%g +s%@LIBS@%$LIBS%g +s%@exec_prefix@%$exec_prefix%g +s%@prefix@%$prefix%g +s%@program_transform_name@%$program_transform_name%g +s%@bindir@%$bindir%g +s%@sbindir@%$sbindir%g +s%@libexecdir@%$libexecdir%g +s%@datadir@%$datadir%g +s%@sysconfdir@%$sysconfdir%g +s%@sharedstatedir@%$sharedstatedir%g +s%@localstatedir@%$localstatedir%g +s%@libdir@%$libdir%g +s%@includedir@%$includedir%g +s%@oldincludedir@%$oldincludedir%g +s%@infodir@%$infodir%g +s%@mandir@%$mandir%g +s%@XSLTPROC@%$XSLTPROC%g +s%@PDFLATEX@%$PDFLATEX%g +s%@XMLTO@%$XMLTO%g +s%@LATEX@%$LATEX%g +s%@DVIPS@%$DVIPS%g +s%@PNGTOPNM@%$PNGTOPNM%g +s%@PNMTOPS@%$PNMTOPS%g +s%@DOC_BUILD_DATE@%$DOC_BUILD_DATE%g -# Name of the executable. -as_me=`$as_basename "$0" || -$as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ - X"$0" : 'X\(//\)$' \| \ - X"$0" : 'X\(/\)$' \| \ - . : '\(.\)' 2>/dev/null || -echo X/"$0" | - sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/; q; } - /^X\/\(\/\/\)$/{ s//\1/; q; } - /^X\/\(\/\).*/{ s//\1/; q; } - s/.*/./; q'` - - -# PATH needs CR, and LINENO needs CR and PATH. -# Avoid depending upon Character Ranges. -as_cr_letters='abcdefghijklmnopqrstuvwxyz' -as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' -as_cr_Letters=$as_cr_letters$as_cr_LETTERS -as_cr_digits='0123456789' -as_cr_alnum=$as_cr_Letters$as_cr_digits - -# The user is always right. -if test "${PATH_SEPARATOR+set}" != set; then - echo "#! /bin/sh" >conf$$.sh - echo "exit 0" >>conf$$.sh - chmod +x conf$$.sh - if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then - PATH_SEPARATOR=';' +CEOF +EOF + +cat >> $CONFIG_STATUS <<\EOF + +# Split the substitutions into bite-sized pieces for seds with +# small command number limits, like on Digital OSF/1 and HP-UX. +ac_max_sed_cmds=90 # Maximum number of lines to put in a sed script. +ac_file=1 # Number of current file. +ac_beg=1 # First line for current file. +ac_end=$ac_max_sed_cmds # Line after last line for current file. +ac_more_lines=: +ac_sed_cmds="" +while $ac_more_lines; do + if test $ac_beg -gt 1; then + sed "1,${ac_beg}d; ${ac_end}q" conftest.subs > conftest.s$ac_file else - PATH_SEPARATOR=: - fi - rm -f conf$$.sh -fi - - - as_lineno_1=$LINENO - as_lineno_2=$LINENO - as_lineno_3=`(expr $as_lineno_1 + 1) 2>/dev/null` - test "x$as_lineno_1" != "x$as_lineno_2" && - test "x$as_lineno_3" = "x$as_lineno_2" || { - # Find who we are. Look in the path if we contain no path at all - # relative or not. - case $0 in - *[\\/]* ) as_myself=$0 ;; - *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR -for as_dir in $PATH -do - IFS=$as_save_IFS - test -z "$as_dir" && as_dir=. - test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break -done - - ;; - esac - # We did not find ourselves, most probably we were run as `sh COMMAND' - # in which case we are not to be found in the path. - if test "x$as_myself" = x; then - as_myself=$0 + sed "${ac_end}q" conftest.subs > conftest.s$ac_file fi - if test ! -f "$as_myself"; then - { { echo "$as_me:$LINENO: error: cannot find myself; rerun with an absolute path" >&5 -echo "$as_me: error: cannot find myself; rerun with an absolute path" >&2;} - { (exit 1); exit 1; }; } - fi - case $CONFIG_SHELL in - '') - as_save_IFS=$IFS; IFS=$PATH_SEPARATOR -for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH -do - IFS=$as_save_IFS - test -z "$as_dir" && as_dir=. - for as_base in sh bash ksh sh5; do - case $as_dir in - /*) - if ("$as_dir/$as_base" -c ' - as_lineno_1=$LINENO - as_lineno_2=$LINENO - as_lineno_3=`(expr $as_lineno_1 + 1) 2>/dev/null` - test "x$as_lineno_1" != "x$as_lineno_2" && - test "x$as_lineno_3" = "x$as_lineno_2" ') 2>/dev/null; then - $as_unset BASH_ENV || test "${BASH_ENV+set}" != set || { BASH_ENV=; export BASH_ENV; } - $as_unset ENV || test "${ENV+set}" != set || { ENV=; export ENV; } - CONFIG_SHELL=$as_dir/$as_base - export CONFIG_SHELL - exec "$CONFIG_SHELL" "$0" ${1+"$@"} - fi;; - esac - done -done -;; - esac - - # Create $as_me.lineno as a copy of $as_myself, but with $LINENO - # uniformly replaced by the line number. The first 'sed' inserts a - # line-number line before each line; the second 'sed' does the real - # work. The second script uses 'N' to pair each line-number line - # with the numbered line, and appends trailing '-' during - # substitution so that $LINENO is not a special case at line end. - # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the - # second 'sed' script. Blame Lee E. McMahon for sed's syntax. :-) - sed '=' <$as_myself | - sed ' - N - s,$,-, - : loop - s,^\(['$as_cr_digits']*\)\(.*\)[$]LINENO\([^'$as_cr_alnum'_]\),\1\2\1\3, - t loop - s,-$,, - s,^['$as_cr_digits']*\n,, - ' >$as_me.lineno && - chmod +x $as_me.lineno || - { { echo "$as_me:$LINENO: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&5 -echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2;} - { (exit 1); exit 1; }; } - - # Don't try to exec as it changes $[0], causing all sort of problems - # (the dirname of $[0] is not the place where we might find the - # original and so on. Autoconf is especially sensible to this). - . ./$as_me.lineno - # Exit status is that of the last command. - exit -} - - -case `echo "testing\c"; echo 1,2,3`,`echo -n testing; echo 1,2,3` in - *c*,-n*) ECHO_N= ECHO_C=' -' ECHO_T=' ' ;; - *c*,* ) ECHO_N=-n ECHO_C= ECHO_T= ;; - *) ECHO_N= ECHO_C='\c' ECHO_T= ;; -esac - -if expr a : '\(a\)' >/dev/null 2>&1; then - as_expr=expr -else - as_expr=false -fi - -rm -f conf$$ conf$$.exe conf$$.file -echo >conf$$.file -if ln -s conf$$.file conf$$ 2>/dev/null; then - # We could just check for DJGPP; but this test a) works b) is more generic - # and c) will remain valid once DJGPP supports symlinks (DJGPP 2.04). - if test -f conf$$.exe; then - # Don't use ln at all; we don't have any links - as_ln_s='cp -p' + if test ! -s conftest.s$ac_file; then + ac_more_lines=false + rm -f conftest.s$ac_file else - as_ln_s='ln -s' + if test -z "$ac_sed_cmds"; then + ac_sed_cmds="sed -f conftest.s$ac_file" + else + ac_sed_cmds="$ac_sed_cmds | sed -f conftest.s$ac_file" + fi + ac_file=`expr $ac_file + 1` + ac_beg=$ac_end + ac_end=`expr $ac_end + $ac_max_sed_cmds` fi -elif ln conf$$.file conf$$ 2>/dev/null; then - as_ln_s=ln -else - as_ln_s='cp -p' -fi -rm -f conf$$ conf$$.exe conf$$.file - -if mkdir -p . 2>/dev/null; then - as_mkdir_p=: -else - as_mkdir_p=false -fi - -as_executable_p="test -f" - -# Sed expression to map a string onto a valid CPP name. -as_tr_cpp="sed y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g" - -# Sed expression to map a string onto a valid variable name. -as_tr_sh="sed y%*+%pp%;s%[^_$as_cr_alnum]%_%g" - - -# IFS -# We need space, tab and new line, in precisely that order. -as_nl=' -' -IFS=" $as_nl" - -# CDPATH. -$as_unset CDPATH - -exec 6>&1 - -# Open the log real soon, to keep \$[0] and so on meaningful, and to -# report actual input values of CONFIG_FILES etc. instead of their -# values after options handling. Logging --version etc. is OK. -exec 5>>config.log -{ - echo - sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX -## Running $as_me. ## -_ASBOX -} >&5 -cat >&5 <<_CSEOF - -This file was extended by $as_me, which was -generated by GNU Autoconf 2.57. Invocation command line was - - CONFIG_FILES = $CONFIG_FILES - CONFIG_HEADERS = $CONFIG_HEADERS - CONFIG_LINKS = $CONFIG_LINKS - CONFIG_COMMANDS = $CONFIG_COMMANDS - $ $0 $@ - -_CSEOF -echo "on `(hostname || uname -n) 2>/dev/null | sed 1q`" >&5 -echo >&5 -_ACEOF - -# Files that config.status was made for. -if test -n "$ac_config_files"; then - echo "config_files=\"$ac_config_files\"" >>$CONFIG_STATUS -fi - -if test -n "$ac_config_headers"; then - echo "config_headers=\"$ac_config_headers\"" >>$CONFIG_STATUS -fi - -if test -n "$ac_config_links"; then - echo "config_links=\"$ac_config_links\"" >>$CONFIG_STATUS -fi - -if test -n "$ac_config_commands"; then - echo "config_commands=\"$ac_config_commands\"" >>$CONFIG_STATUS -fi - -cat >>$CONFIG_STATUS <<\_ACEOF - -ac_cs_usage="\ -\`$as_me' instantiates files from templates according to the -current configuration. - -Usage: $0 [OPTIONS] [FILE]... - - -h, --help print this help, then exit - -V, --version print version number, then exit - -q, --quiet do not print progress messages - -d, --debug don't remove temporary files - --recheck update $as_me by reconfiguring in the same conditions - --file=FILE[:TEMPLATE] - instantiate the configuration file FILE - -Configuration files: -$config_files - -Report bugs to ." -_ACEOF - -cat >>$CONFIG_STATUS <<_ACEOF -ac_cs_version="\\ -config.status -configured by $0, generated by GNU Autoconf 2.57, - with options \\"`echo "$ac_configure_args" | sed 's/[\\""\`\$]/\\\\&/g'`\\" - -Copyright 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001 -Free Software Foundation, Inc. -This config.status script is free software; the Free Software Foundation -gives unlimited permission to copy, distribute and modify it." -srcdir=$srcdir -_ACEOF - -cat >>$CONFIG_STATUS <<\_ACEOF -# If no file are specified by the user, then we need to provide default -# value. By we need to know if files were specified by the user. -ac_need_defaults=: -while test $# != 0 -do - case $1 in - --*=*) - ac_option=`expr "x$1" : 'x\([^=]*\)='` - ac_optarg=`expr "x$1" : 'x[^=]*=\(.*\)'` - ac_shift=: - ;; - -*) - ac_option=$1 - ac_optarg=$2 - ac_shift=shift - ;; - *) # This is not an option, so the user has probably given explicit - # arguments. - ac_option=$1 - ac_need_defaults=false;; - esac - - case $ac_option in - # Handling of the options. -_ACEOF -cat >>$CONFIG_STATUS <<\_ACEOF - -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) - ac_cs_recheck=: ;; - --version | --vers* | -V ) - echo "$ac_cs_version"; exit 0 ;; - --he | --h) - # Conflict between --help and --header - { { echo "$as_me:$LINENO: error: ambiguous option: $1 -Try \`$0 --help' for more information." >&5 -echo "$as_me: error: ambiguous option: $1 -Try \`$0 --help' for more information." >&2;} - { (exit 1); exit 1; }; };; - --help | --hel | -h ) - echo "$ac_cs_usage"; exit 0 ;; - --debug | --d* | -d ) - debug=: ;; - --file | --fil | --fi | --f ) - $ac_shift - CONFIG_FILES="$CONFIG_FILES $ac_optarg" - ac_need_defaults=false;; - --header | --heade | --head | --hea ) - $ac_shift - CONFIG_HEADERS="$CONFIG_HEADERS $ac_optarg" - ac_need_defaults=false;; - -q | -quiet | --quiet | --quie | --qui | --qu | --q \ - | -silent | --silent | --silen | --sile | --sil | --si | --s) - ac_cs_silent=: ;; - - # This is an error. - -*) { { echo "$as_me:$LINENO: error: unrecognized option: $1 -Try \`$0 --help' for more information." >&5 -echo "$as_me: error: unrecognized option: $1 -Try \`$0 --help' for more information." >&2;} - { (exit 1); exit 1; }; } ;; - - *) ac_config_targets="$ac_config_targets $1" ;; - - esac - shift done - -ac_configure_extra_args= - -if $ac_cs_silent; then - exec 6>/dev/null - ac_configure_extra_args="$ac_configure_extra_args --silent" -fi - -_ACEOF -cat >>$CONFIG_STATUS <<_ACEOF -if \$ac_cs_recheck; then - echo "running $SHELL $0 " $ac_configure_args \$ac_configure_extra_args " --no-create --no-recursion" >&6 - exec $SHELL $0 $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion +if test -z "$ac_sed_cmds"; then + ac_sed_cmds=cat fi +EOF -_ACEOF +cat >> $CONFIG_STATUS <>$CONFIG_STATUS <<\_ACEOF -for ac_config_target in $ac_config_targets -do - case "$ac_config_target" in - # Handling of arguments. - "Makefile" ) CONFIG_FILES="$CONFIG_FILES Makefile" ;; - *) { { echo "$as_me:$LINENO: error: invalid argument: $ac_config_target" >&5 -echo "$as_me: error: invalid argument: $ac_config_target" >&2;} - { (exit 1); exit 1; }; };; - esac -done - -# If the user did not use the arguments to specify the items to instantiate, -# then the envvar interface is used. Set only those that are not. -# We use the long form for the default assignment because of an extremely -# bizarre bug on SunOS 4.1.3. -if $ac_need_defaults; then - test "${CONFIG_FILES+set}" = set || CONFIG_FILES=$config_files -fi - -# Have a temporary directory for convenience. Make it in the build tree -# simply because there is no reason to put it here, and in addition, -# creating and moving files from /tmp can sometimes cause problems. -# Create a temporary directory, and hook for its removal unless debugging. -$debug || -{ - trap 'exit_status=$?; rm -rf $tmp && exit $exit_status' 0 - trap '{ (exit 1); exit 1; }' 1 2 13 15 -} - -# Create a (secure) tmp directory for tmp files. - -{ - tmp=`(umask 077 && mktemp -d -q "./confstatXXXXXX") 2>/dev/null` && - test -n "$tmp" && test -d "$tmp" -} || -{ - tmp=./confstat$$-$RANDOM - (umask 077 && mkdir $tmp) -} || -{ - echo "$me: cannot create a temporary directory in ." >&2 - { (exit 1); exit 1; } -} - -_ACEOF - -cat >>$CONFIG_STATUS <<_ACEOF - -# -# CONFIG_FILES section. -# - -# No need to generate the scripts if there are no CONFIG_FILES. -# This happens for instance when ./config.status config.h -if test -n "\$CONFIG_FILES"; then - # Protect against being on the right side of a sed subst in config.status. - sed 's/,@/@@/; s/@,/@@/; s/,;t t\$/@;t t/; /@;t t\$/s/[\\\\&,]/\\\\&/g; - s/@@/,@/; s/@@/@,/; s/@;t t\$/,;t t/' >\$tmp/subs.sed <<\\CEOF -s,@SHELL@,$SHELL,;t t -s,@PATH_SEPARATOR@,$PATH_SEPARATOR,;t t -s,@PACKAGE_NAME@,$PACKAGE_NAME,;t t -s,@PACKAGE_TARNAME@,$PACKAGE_TARNAME,;t t -s,@PACKAGE_VERSION@,$PACKAGE_VERSION,;t t -s,@PACKAGE_STRING@,$PACKAGE_STRING,;t t -s,@PACKAGE_BUGREPORT@,$PACKAGE_BUGREPORT,;t t -s,@exec_prefix@,$exec_prefix,;t t -s,@prefix@,$prefix,;t t -s,@program_transform_name@,$program_transform_name,;t t -s,@bindir@,$bindir,;t t -s,@sbindir@,$sbindir,;t t -s,@libexecdir@,$libexecdir,;t t -s,@datadir@,$datadir,;t t -s,@sysconfdir@,$sysconfdir,;t t -s,@sharedstatedir@,$sharedstatedir,;t t -s,@localstatedir@,$localstatedir,;t t -s,@libdir@,$libdir,;t t -s,@includedir@,$includedir,;t t -s,@oldincludedir@,$oldincludedir,;t t -s,@infodir@,$infodir,;t t -s,@mandir@,$mandir,;t t -s,@build_alias@,$build_alias,;t t -s,@host_alias@,$host_alias,;t t -s,@target_alias@,$target_alias,;t t -s,@DEFS@,$DEFS,;t t -s,@ECHO_C@,$ECHO_C,;t t -s,@ECHO_N@,$ECHO_N,;t t -s,@ECHO_T@,$ECHO_T,;t t -s,@LIBS@,$LIBS,;t t -s,@XSLTPROC@,$XSLTPROC,;t t -s,@PDFLATEX@,$PDFLATEX,;t t -s,@DOC_BUILD_DATE@,$DOC_BUILD_DATE,;t t -s,@LIBOBJS@,$LIBOBJS,;t t -s,@LTLIBOBJS@,$LTLIBOBJS,;t t -CEOF - -_ACEOF - - cat >>$CONFIG_STATUS <<\_ACEOF - # Split the substitutions into bite-sized pieces for seds with - # small command number limits, like on Digital OSF/1 and HP-UX. - ac_max_sed_lines=48 - ac_sed_frag=1 # Number of current file. - ac_beg=1 # First line for current file. - ac_end=$ac_max_sed_lines # Line after last line for current file. - ac_more_lines=: - ac_sed_cmds= - while $ac_more_lines; do - if test $ac_beg -gt 1; then - sed "1,${ac_beg}d; ${ac_end}q" $tmp/subs.sed >$tmp/subs.frag - else - sed "${ac_end}q" $tmp/subs.sed >$tmp/subs.frag - fi - if test ! -s $tmp/subs.frag; then - ac_more_lines=false - else - # The purpose of the label and of the branching condition is to - # speed up the sed processing (if there are no `@' at all, there - # is no need to browse any of the substitutions). - # These are the two extra sed commands mentioned above. - (echo ':t - /@[a-zA-Z_][a-zA-Z_0-9]*@/!b' && cat $tmp/subs.frag) >$tmp/subs-$ac_sed_frag.sed - if test -z "$ac_sed_cmds"; then - ac_sed_cmds="sed -f $tmp/subs-$ac_sed_frag.sed" - else - ac_sed_cmds="$ac_sed_cmds | sed -f $tmp/subs-$ac_sed_frag.sed" - fi - ac_sed_frag=`expr $ac_sed_frag + 1` - ac_beg=$ac_end - ac_end=`expr $ac_end + $ac_max_sed_lines` - fi - done - if test -z "$ac_sed_cmds"; then - ac_sed_cmds=cat - fi -fi # test -n "$CONFIG_FILES" - -_ACEOF -cat >>$CONFIG_STATUS <<\_ACEOF -for ac_file in : $CONFIG_FILES; do test "x$ac_file" = x: && continue +CONFIG_FILES=\${CONFIG_FILES-"Makefile "} +EOF +cat >> $CONFIG_STATUS <<\EOF +for ac_file in .. $CONFIG_FILES; do if test "x$ac_file" != x..; then # Support "outfile[:infile[:infile...]]", defaulting infile="outfile.in". - case $ac_file in - - | *:- | *:-:* ) # input from stdin - cat >$tmp/stdin - ac_file_in=`echo "$ac_file" | sed 's,[^:]*:,,'` - ac_file=`echo "$ac_file" | sed 's,:.*,,'` ;; - *:* ) ac_file_in=`echo "$ac_file" | sed 's,[^:]*:,,'` - ac_file=`echo "$ac_file" | sed 's,:.*,,'` ;; - * ) ac_file_in=$ac_file.in ;; + case "$ac_file" in + *:*) ac_file_in=`echo "$ac_file"|sed 's%[^:]*:%%'` + ac_file=`echo "$ac_file"|sed 's%:.*%%'` ;; + *) ac_file_in="${ac_file}.in" ;; esac - # Compute @srcdir@, @top_srcdir@, and @INSTALL@ for subdirectories. - ac_dir=`(dirname "$ac_file") 2>/dev/null || -$as_expr X"$ac_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ - X"$ac_file" : 'X\(//\)[^/]' \| \ - X"$ac_file" : 'X\(//\)$' \| \ - X"$ac_file" : 'X\(/\)' \| \ - . : '\(.\)' 2>/dev/null || -echo X"$ac_file" | - sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/; q; } - /^X\(\/\/\)[^/].*/{ s//\1/; q; } - /^X\(\/\/\)$/{ s//\1/; q; } - /^X\(\/\).*/{ s//\1/; q; } - s/.*/./; q'` - { if $as_mkdir_p; then - mkdir -p "$ac_dir" + # Adjust a relative srcdir, top_srcdir, and INSTALL for subdirectories. + + # Remove last slash and all that follows it. Not all systems have dirname. + ac_dir=`echo $ac_file|sed 's%/[^/][^/]*$%%'` + if test "$ac_dir" != "$ac_file" && test "$ac_dir" != .; then + # The file is in a subdirectory. + test ! -d "$ac_dir" && mkdir "$ac_dir" + ac_dir_suffix="/`echo $ac_dir|sed 's%^\./%%'`" + # A "../" for each directory in $ac_dir_suffix. + ac_dots=`echo $ac_dir_suffix|sed 's%/[^/]*%../%g'` else - as_dir="$ac_dir" - as_dirs= - while test ! -d "$as_dir"; do - as_dirs="$as_dir $as_dirs" - as_dir=`(dirname "$as_dir") 2>/dev/null || -$as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ - X"$as_dir" : 'X\(//\)[^/]' \| \ - X"$as_dir" : 'X\(//\)$' \| \ - X"$as_dir" : 'X\(/\)' \| \ - . : '\(.\)' 2>/dev/null || -echo X"$as_dir" | - sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/; q; } - /^X\(\/\/\)[^/].*/{ s//\1/; q; } - /^X\(\/\/\)$/{ s//\1/; q; } - /^X\(\/\).*/{ s//\1/; q; } - s/.*/./; q'` - done - test ! -n "$as_dirs" || mkdir $as_dirs - fi || { { echo "$as_me:$LINENO: error: cannot create directory \"$ac_dir\"" >&5 -echo "$as_me: error: cannot create directory \"$ac_dir\"" >&2;} - { (exit 1); exit 1; }; }; } - - ac_builddir=. - -if test "$ac_dir" != .; then - ac_dir_suffix=/`echo "$ac_dir" | sed 's,^\.[\\/],,'` - # A "../" for each directory in $ac_dir_suffix. - ac_top_builddir=`echo "$ac_dir_suffix" | sed 's,/[^\\/]*,../,g'` -else - ac_dir_suffix= ac_top_builddir= -fi + ac_dir_suffix= ac_dots= + fi -case $srcdir in - .) # No --srcdir option. We are building in place. - ac_srcdir=. - if test -z "$ac_top_builddir"; then - ac_top_srcdir=. - else - ac_top_srcdir=`echo $ac_top_builddir | sed 's,/$,,'` - fi ;; - [\\/]* | ?:[\\/]* ) # Absolute path. - ac_srcdir=$srcdir$ac_dir_suffix; - ac_top_srcdir=$srcdir ;; + case "$ac_given_srcdir" in + .) srcdir=. + if test -z "$ac_dots"; then top_srcdir=. + else top_srcdir=`echo $ac_dots|sed 's%/$%%'`; fi ;; + /*) srcdir="$ac_given_srcdir$ac_dir_suffix"; top_srcdir="$ac_given_srcdir" ;; *) # Relative path. - ac_srcdir=$ac_top_builddir$srcdir$ac_dir_suffix - ac_top_srcdir=$ac_top_builddir$srcdir ;; -esac -# Don't blindly perform a `cd "$ac_dir"/$ac_foo && pwd` since $ac_foo can be -# absolute. -ac_abs_builddir=`cd "$ac_dir" && cd $ac_builddir && pwd` -ac_abs_top_builddir=`cd "$ac_dir" && cd ${ac_top_builddir}. && pwd` -ac_abs_srcdir=`cd "$ac_dir" && cd $ac_srcdir && pwd` -ac_abs_top_srcdir=`cd "$ac_dir" && cd $ac_top_srcdir && pwd` + srcdir="$ac_dots$ac_given_srcdir$ac_dir_suffix" + top_srcdir="$ac_dots$ac_given_srcdir" ;; + esac + echo creating "$ac_file" + rm -f "$ac_file" + configure_input="Generated automatically from `echo $ac_file_in|sed 's%.*/%%'` by configure." + case "$ac_file" in + *Makefile*) ac_comsub="1i\\ +# $configure_input" ;; + *) ac_comsub= ;; + esac - if test x"$ac_file" != x-; then - { echo "$as_me:$LINENO: creating $ac_file" >&5 -echo "$as_me: creating $ac_file" >&6;} - rm -f "$ac_file" - fi - # Let's still pretend it is `configure' which instantiates (i.e., don't - # use $as_me), people would be surprised to read: - # /* config.h. Generated by config.status. */ - if test x"$ac_file" = x-; then - configure_input= - else - configure_input="$ac_file. " - fi - configure_input=$configure_input"Generated from `echo $ac_file_in | - sed 's,.*/,,'` by configure." - - # First look for the input files in the build tree, otherwise in the - # src tree. - ac_file_inputs=`IFS=: - for f in $ac_file_in; do - case $f in - -) echo $tmp/stdin ;; - [\\/$]*) - # Absolute (can't be DOS-style, as IFS=:) - test -f "$f" || { { echo "$as_me:$LINENO: error: cannot find input file: $f" >&5 -echo "$as_me: error: cannot find input file: $f" >&2;} - { (exit 1); exit 1; }; } - echo $f;; - *) # Relative - if test -f "$f"; then - # Build tree - echo $f - elif test -f "$srcdir/$f"; then - # Source tree - echo $srcdir/$f - else - # /dev/null tree - { { echo "$as_me:$LINENO: error: cannot find input file: $f" >&5 -echo "$as_me: error: cannot find input file: $f" >&2;} - { (exit 1); exit 1; }; } - fi;; - esac - done` || { (exit 1); exit 1; } -_ACEOF -cat >>$CONFIG_STATUS <<_ACEOF - sed "$ac_vpsub -$extrasub -_ACEOF -cat >>$CONFIG_STATUS <<\_ACEOF -:t -/@[a-zA-Z_][a-zA-Z_0-9]*@/!b -s,@configure_input@,$configure_input,;t t -s,@srcdir@,$ac_srcdir,;t t -s,@abs_srcdir@,$ac_abs_srcdir,;t t -s,@top_srcdir@,$ac_top_srcdir,;t t -s,@abs_top_srcdir@,$ac_abs_top_srcdir,;t t -s,@builddir@,$ac_builddir,;t t -s,@abs_builddir@,$ac_abs_builddir,;t t -s,@top_builddir@,$ac_top_builddir,;t t -s,@abs_top_builddir@,$ac_abs_top_builddir,;t t -" $ac_file_inputs | (eval "$ac_sed_cmds") >$tmp/out - rm -f $tmp/stdin - if test x"$ac_file" != x-; then - mv $tmp/out $ac_file - else - cat $tmp/out - rm -f $tmp/out - fi + ac_file_inputs=`echo $ac_file_in|sed -e "s%^%$ac_given_srcdir/%" -e "s%:% $ac_given_srcdir/%g"` + sed -e "$ac_comsub +s%@configure_input@%$configure_input%g +s%@srcdir@%$srcdir%g +s%@top_srcdir@%$top_srcdir%g +" $ac_file_inputs | (eval "$ac_sed_cmds") > $ac_file +fi; done +rm -f conftest.s* -done -_ACEOF +EOF +cat >> $CONFIG_STATUS <>$CONFIG_STATUS <<\_ACEOF +EOF +cat >> $CONFIG_STATUS <<\EOF -{ (exit 0); exit 0; } -_ACEOF +exit 0 +EOF chmod +x $CONFIG_STATUS -ac_clean_files=$ac_clean_files_save - - -# configure is writing to config.log, and then calls config.status. -# config.status does its own redirection, appending to config.log. -# Unfortunately, on DOS this fails, as config.log is still kept open -# by configure, so config.status won't be able to write to it; its -# output is simply discarded. So we exec the FD to /dev/null, -# effectively closing config.log, so it can be properly (re)opened and -# appended to by config.status. When coming back to configure, we -# need to make the FD available again. -if test "$no_create" != yes; then - ac_cs_success=: - ac_config_status_args= - test "$silent" = yes && - ac_config_status_args="$ac_config_status_args --quiet" - exec 5>/dev/null - $SHELL $CONFIG_STATUS $ac_config_status_args || ac_cs_success=false - exec 5>>config.log - # Use ||, not &&, to avoid exiting from the if with $? = 1, which - # would make configure fail if this is the last instruction. - $ac_cs_success || { (exit 1); exit 1; } -fi +rm -fr confdefs* $ac_clean_files +test "$no_create" = yes || ${CONFIG_SHELL-/bin/sh} $CONFIG_STATUS || exit 1 diff --git a/docs/docbook/configure.in b/docs/docbook/configure.in index 6775e6db94..25abecafe1 100644 --- a/docs/docbook/configure.in +++ b/docs/docbook/configure.in @@ -9,6 +9,12 @@ if test "x$PDFLATEX" = x; then AC_MSG_ERROR("pdflatex is required") fi +AC_PATH_PROG(XMLTO, xmlto) +AC_PATH_PROG(LATEX, latex) +AC_PATH_PROG(DVIPS, dvips) +AC_PATH_PROG(PNGTOPNM, pngtopnm) +AC_PATH_PROG(PNMTOPS, pnmtops) + DOC_BUILD_DATE=`date '+%d-%m-%Y'` AC_SUBST(DOC_BUILD_DATE) diff --git a/docs/docbook/devdoc/contributing.xml b/docs/docbook/devdoc/contributing.xml index d0fb1d41a3..2583c8727a 100644 --- a/docs/docbook/devdoc/contributing.xml +++ b/docs/docbook/devdoc/contributing.xml @@ -35,6 +35,7 @@ because someone else was working on the same thing or because your implementation is not the correct one. + @@ -67,6 +68,8 @@ Make sure your patch complies to the samba coding style as suggested in the coding-suggestions chapter. + + diff --git a/docs/docbook/devdoc/dev-doc.xml b/docs/docbook/devdoc/dev-doc.xml index 0ed4275972..9236b18986 100644 --- a/docs/docbook/devdoc/dev-doc.xml +++ b/docs/docbook/devdoc/dev-doc.xml @@ -1,5 +1,6 @@ - %globalentities; @@ -17,6 +18,8 @@ + + ]> @@ -28,13 +31,9 @@ SAMBA Team